diff --git a/.agent/prompts/outdated-agent-rules.md b/.agent/prompts/outdated-agent-rules.md
deleted file mode 100644
index 9d1612f0036..00000000000
--- a/.agent/prompts/outdated-agent-rules.md
+++ /dev/null
@@ -1,4 +0,0 @@
-Review if the agent instructions (`.agent/`, `.claude/`, `.cursor/`) are still up to date and correct.
-
-- Paths might need to be updated if files have been moved.
-- There might be drift (e.g. missing symlinks for rules)
diff --git a/.agent/rules/testing.md b/.agent/rules/testing.md
deleted file mode 100644
index 67f41cd2ea2..00000000000
--- a/.agent/rules/testing.md
+++ /dev/null
@@ -1,143 +0,0 @@
----
-description: Rules for the testing strategy of this repo
----
-
-# Rules for the testing strategy of this repo
-
-## Test Types
-
-- **Unit tests**: Standard Go tests alongside source files
-- **Integration tests**: `integration/` directory, requires live Databricks workspace
-- **Acceptance tests**: `acceptance/` directory, uses mock HTTP server
-
-## Choosing a test level
-
-**RULE: For user-visible CLI output and changes to the bundle mutator pipeline, reach for acceptance tests first.** They exercise the full pipeline and capture the exact output the user sees. `cmd/...` commands and anything under the mutator pipeline (`bundle/config/mutator/...` and `bundle/mutator/...`) are the strongest candidates. When the coverage overlaps with an existing test, extend the existing acceptance directory instead of creating a new one.
-
-**Unit tests are still the right tool** for pure functions, utility code, parsing/formatting helpers, and anything you can meaningfully test without mocking the whole world. Don't force a unit into an acceptance test just because the code lives under `cmd/`, and don't add a mutator unit test that only duplicates what an acceptance test already covers.
-
-When in doubt: would the test fail in a useful way if a mutator earlier in the pipeline changed? If yes, the test wants to be an acceptance test.
-
-## Unit tests
-
-**RULE: Each source file should have a corresponding test file.** If you add new functionality to a file, extend the test file to cover it.
-
-**RULE: Place tests in the same package but with a `_test` suffix.** Test names start with `Test` and describe the function or module under test.
-
-**RULE: Use `require` for preconditions that would make the rest of the test meaningless on failure.** Use `assert` for expected values where the test can keep running after a failure.
-
-```go
-package mutator_test
-
-func TestApplySomeChangeReturnsDiagnostics(t *testing.T) {
-	...
-}
-
-func TestApplySomeChangeFixesThings(t *testing.T) {
-	ctx := t.Context()
-	b, err := ...some operation...
-	require.NoError(t, err)
-	...
-	assert.Equal(t, ...)
-}
-```
-
-**RULE: Use table-driven tests for multiple similar cases.** Reviewers prefer this pattern over repeating near-identical test functions when the inputs differ but the logic is the same.
-
-**RULE: If a value is shared across tests and they must change together, extract it to a package-level `const` or `var`.** Think shared fixtures, identifiers that must stay in sync across tests, and expected error messages that the tests verify as a set. Repeated literals that happen to be the same (e.g. a header name like `"Authorization"` appearing inline in many tests) are fine to leave inline; forcing extraction there hurts readability without buying anything.
-
-When writing tests, don't include an explanation in each test case in your responses. Only the tests are needed.
-
-## Acceptance Tests
-
-**RULE: Never edit generated acceptance output files directly.** Files named `output.txt`, `out.test.toml`, `out.requests.txt`, or anything starting with `out` are regenerated. Use the `-update` flag to regenerate them.
-
-Exception: mass string replacement when the change is predictable and much cheaper than re-running the test suite.
-
-**RULE: All `EnvMatrix` variants MUST produce identical output files.** Filenames containing `$DATABRICKS_BUNDLE_ENGINE` (e.g. `output.direct.txt`) are the only per-engine exception.
-
-**RULE: Do not run `-update` while a divergent variant exists.** It is destructive: it overwrites with the last variant and breaks the others. To debug: run a single variant you consider correct with `-update`, then debug the other variant to find why it diverges.
-
-**RULE: Put common `test.toml` options in a parent directory.** Config is inherited from parents.
-
-**RULE: Add test artifacts (e.g. `.databricks`) to `Ignore` in `test.toml`.**
-
-**RULE: Commit static test inputs into the acceptance test directory; do not create them in `script` at test time.** If a file's content is dynamic, generating it in `script` is fine. For everything else, check it in and let the test read it directly; you won't need an `Ignore` entry because there's nothing to clean up.
-
-GOOD:
-
-```
-acceptance/cmd/fs/cp/file-to-dir/
-  script        # $CLI fs cp local.txt dbfs:/path/
-  test.toml
-  local.txt     # committed input
-  output.txt
-```
-
-BAD:
-
-```
-acceptance/cmd/fs/cp/file-to-dir/
-  script        # echo "contents" > local.txt; $CLI fs cp local.txt dbfs:/path/; rm local.txt
-  test.toml     # Ignore = ["local.txt"]
-  output.txt
-```
-
-**RULE: When output genuinely diverges between engines (terraform vs direct), split only the diverging file into per-engine variants.** Keep the rest of the output unified. Files named `output.$DATABRICKS_BUNDLE_ENGINE.txt` or `out.requests.$DATABRICKS_BUNDLE_ENGINE.json` are the allowed per-engine form.
-
-If the only reason for divergence is a server-side default that one engine sets and the other doesn't, set the field explicitly in `databricks.yml` so both engines produce identical output. Don't paper over it with per-engine files.
-
-### Reference
-
-- Tests live in `acceptance/` with a nested directory structure.
-- Each test directory contains `databricks.yml`, `script`, and `output.txt`.
-- Source files: `test.toml`, `script`, `script.prepare`, `databricks.yml`, etc.
-- Tests are configured via `test.toml`. Config schema and explanation is in `acceptance/internal/config.go`. Certain options are also dumped to `out.test.toml` so that inherited values are visible on PRs.
-- Run a single test: `go test ./acceptance -run TestAccept/bundle/<path>/<to>/<folder>`
-- Run a specific variant by appending `EnvMatrix` values to the test name: `go test ./acceptance -run 'TestAccept/.../DATABRICKS_BUNDLE_ENGINE=direct'`. When there are multiple `EnvMatrix` variables, they appear in alphabetical order.
-- Useful flags: `-v` for verbose output, `-tail` to follow test output (requires `-v`), `-logrequests` to log all HTTP requests/responses (requires `-v`).
-- Run tests on cloud: `deco env run -i -n aws-prod-ucws -- <go test command>` (requires `deco` tool and access to test env).
-- `script.prepare` files from parent directories are concatenated into the test script. Use them for shared bash helpers.
-
-### Helper scripts
-
-**RULE: Use the `acceptance/bin/` helpers before reaching for inline `jq` or `grep` pipelines.** When a test needs to filter recorded requests, assert a substring is or isn't present, or register a dynamic replacement, the helpers handle sorting, URL query normalization, redaction hooks, and cross-platform path issues. Inline `jq` in an acceptance script is brittle and hard to read.
-
-GOOD:
-
-```bash
-trace $CLI bundle plan | contains.py "Plan: 0 to add, 0 to delete, 1 to update"
-trace print_requests.py //api/2.0/apps
-echo "$deployment_id:DEPLOYMENT_ID" >> ACC_REPLS
-```
-
-BAD:
-
-```bash
-{ trace jq 'select(.method == "POST" and .path == "/api/2.0/apps")' out.requests.txt; } || true
-```
-
-Available on `PATH` during test execution (from `acceptance/bin/`):
-
-- `contains.py SUBSTR [!SUBSTR_NOT]`: passthrough filter (stdin→stdout) that checks substrings are present (or absent with `!` prefix). Errors are reported on stderr.
-- `print_requests.py //path [^//exclude] [--get] [--sort] [--keep]`: print recorded HTTP requests matching path filters. Requires `RecordRequests=true` in `test.toml`. Clears `out.requests.txt` afterwards unless `--keep`. Use `--get` to include GET requests (excluded by default). Use `^` prefix to exclude paths.
-- `replace_ids.py [-t TARGET]`: read deployment state and add `[NAME_ID]` replacements for all resource IDs.
-- `read_id.py [-t TARGET] NAME`: read ID of a single resource from state, print it, and add a `[NAME_ID]` replacement.
-- `add_repl.py VALUE REPLACEMENT`: add a custom replacement (VALUE will be replaced with `[REPLACEMENT]` in output).
-- `update_file.py FILENAME OLD NEW`: replace all occurrences of OLD with NEW in FILENAME. Errors if OLD is not found. Cannot be used on `output.txt`.
-- `find.py REGEX [--expect N]`: find files matching regex in current directory. `--expect N` asserts an exact count.
-- `diff.py DIR1 DIR2` or `diff.py FILE1 FILE2`: recursive diff with test replacements applied.
-- `print_state.py [-t TARGET] [--backup]`: print deployment state (terraform or direct).
-- `edit_resource.py TYPE ID < script.py`: fetch resource by ID, execute Python on it (resource in `r`), then update it. TYPE is `jobs` or `pipelines`.
-- `gron.py`: flatten JSON into greppable discrete assignments (simpler than `jq` for searching JSON).
-- `jq` is also available for JSON processing.
-
-### Update workflow
-
-**RULE: Run `./task test-update` to regenerate outputs, then `./task fmt` and `./task lint`.** If fmt or lint modify files in `acceptance/`, there's an issue in the source files. Fix the source, regenerate, and verify fmt/lint pass cleanly.
-
-### Template tests
-
-Tests in `acceptance/bundle/templates` include materialized templates in output directories. These directories follow the same `out` convention: everything starting with `out` is generated output. Sources are in `libs/template/templates/`.
-
-**RULE: Use `./task test-update-templates` to regenerate materialized templates.** If linters or formatters find issues in materialized templates, do not fix the output files; fix the source in `libs/template/templates/` and regenerate.
diff --git a/.agent/skills/pr-checklist/SKILL.md b/.agent/skills/pr-checklist/SKILL.md
deleted file mode 100644
index 3eae258d6e7..00000000000
--- a/.agent/skills/pr-checklist/SKILL.md
+++ /dev/null
@@ -1,72 +0,0 @@
----
-name: pr-checklist
-description: Checklist to run before submitting a PR
----
-
-Before submitting a PR, run these commands to match what CI checks. CI uses the full variants (not the `-q` diff-only wrappers), so `./task lint-q` alone is insufficient.
-
-```bash
-# 1. Formatting and checks (CI runs fmt, not fmt-q)
-./task fmt
-./task checks
-
-# 2. Linting (CI runs full golangci-lint across all modules, not the diff-only wrapper)
-./task lint
-
-# 3. Tests (CI runs with both deployment engines)
-./task test
-
-# 4. If you changed bundle config structs or schema-related code:
-./task generate-schema
-
-# 5. If you changed files in python/:
-./task pydabs-codegen pydabs-test pydabs-lint pydabs-docs
-
-# 6. If you changed experimental/aitools or experimental/ssh:
-./task test-exp-aitools   # only if aitools code changed
-./task test-exp-ssh       # only if ssh code changed
-```
-
-## Final cleanup scan
-
-After the commands above pass, scrub the diff before pushing. The quick version: run `git diff @{u}` and read through what you added. Specifically:
-
-- **Debug prints**: look for newly added `fmt.Print`, `fmt.Printf`, `fmt.Println`, `log.Print`, `log.Printf`, `log.Println`, or bare `println(...)` calls. A regex that scans only added lines against your upstream branch:
-
-  ```bash
-  git diff @{u} -- '*.go' | rg '^\+.*\b(fmt|log)\.(Print|Printf|Println)\b|^\+.*\bprintln\('
-  ```
-
-  If you have no upstream yet, substitute the intended base (e.g. `origin/main`) for `@{u}`.
-- **Commented-out code**: delete it. If it's needed for reference, it lives in git history.
-- **TODOs without a ticket**: either add a ticket reference (e.g. `// TODO(DECO-1234): ...`) or remove the TODO. Un-tracked TODOs rot.
-- **Unintended files**: review `git status` and `git diff --stat` to confirm only the files you meant to change are staged.
-
-## PR description
-
-Follow `.github/PULL_REQUEST_TEMPLATE.md` exactly. Use its section headings (`## Changes`, `## Why`, `## Tests`) in the same order, and fill each one in. Do not invent new sections (`## Summary`, `## Test plan`, etc.), do not drop sections, and do not leave the HTML comment placeholders in the final body — replace them with real content. If a section genuinely does not apply (e.g. a docs-only change has no test steps), say so explicitly under that heading rather than removing it.
-
-When using `gh pr create`, read `.github/PULL_REQUEST_TEMPLATE.md` first and base `--body` on it.
-
-If an agent (you) authored or substantially helped author the PR, disclose it on the last line of the body, e.g. `_This PR was written by Claude Code._` or `_PR description drafted with Claude Code._`. Be honest about the level of involvement — "written by" vs. "drafted with" vs. "reviewed by" — and keep it to a single italicized line so it doesn't crowd the template sections.
-
-## Changelog entry
-
-Add a `NEXT_CHANGELOG.md` entry when your change is user-visible. CI generates the real `CHANGELOG.md` from `NEXT_CHANGELOG.md` at release time, so never hand-edit `CHANGELOG.md` directly.
-
-**When to add an entry:**
-- New or changed CLI command, flag, or subcommand behavior
-- New or changed bundle config field, schema, or engine behavior
-- New direct dependency (annotate under `Dependency updates`)
-- Bug fix that users will notice
-
-**When to skip:**
-- Experimental commands (under `experimental/`): no entry until the feature graduates out of experimental
-- Pure refactors, internal renames, test-only changes, and doc-only changes
-- Auto-generated output changes without a corresponding user-facing change
-
-**How to add:**
-- Pick the right section (`CLI`, `Bundles`, `Dependency updates`) under the current `## Release vX.Y.Z` header.
-- One or two sentences, user-facing language, no Jira links.
-- Reference the PR number once it's open: after `gh pr create`, edit the entry to append ` (#NNNN)` or similar matching nearby entries.
-- Match the voice and tense of the existing entries in the file.
diff --git a/.agents/prompts/outdated-agent-rules.md b/.agents/prompts/outdated-agent-rules.md
new file mode 100644
index 00000000000..d7aa036e1f7
--- /dev/null
+++ b/.agents/prompts/outdated-agent-rules.md
@@ -0,0 +1,4 @@
+Review if the agent instructions (`.agents/`, `.claude/`, `.cursor/`) are still up to date and correct.
+
+- Paths might need to be updated if files have been moved.
+- There might be drift (e.g. missing symlinks for rules)
diff --git a/.agent/rules/auto-generated-files.md b/.agents/rules/auto-generated-files.md
similarity index 77%
rename from .agent/rules/auto-generated-files.md
rename to .agents/rules/auto-generated-files.md
index 458e3041c6c..6d29f4f55f9 100644
--- a/.agent/rules/auto-generated-files.md
+++ b/.agents/rules/auto-generated-files.md
@@ -1,7 +1,7 @@
 ---
 description: Rules for how to deal with auto-generated files
 globs:
-  - ".codegen/openapi.json"
+  - ".codegen/cli.json"
   - ".gitattributes"
   - "acceptance/**/out*"
   - "acceptance/**/output.txt"
@@ -13,17 +13,14 @@ globs:
   - "cmd/workspace/**/*.go"
   - "internal/genkit/tagging.py"
   - "internal/mocks/**/*.go"
-  - "bundle/direct/dresources/*.generated.yml"
-  - "bundle/docsgen/output/**/*.md"
-  - "bundle/internal/schema/annotations_openapi.yml"
+  - "bundle/direct/dresources/configs/*.generated.yml"
   - "bundle/internal/validation/generated/*.go"
   - "bundle/schema/jsonschema.json"
-  - "bundle/schema/jsonschema_for_docs.json"
   - "python/databricks/bundles/version.py"
   - "python/databricks/bundles/*/__init__.py"
   - "python/databricks/bundles/*/_models/*.py"
 paths:
-  - ".codegen/openapi.json"
+  - ".codegen/cli.json"
   - ".gitattributes"
   - "acceptance/**/out*"
   - "acceptance/**/output.txt"
@@ -35,12 +32,9 @@ paths:
   - "cmd/workspace/**/*.go"
   - "internal/genkit/tagging.py"
   - "internal/mocks/**/*.go"
-  - "bundle/direct/dresources/*.generated.yml"
-  - "bundle/docsgen/output/**/*.md"
-  - "bundle/internal/schema/annotations_openapi.yml"
+  - "bundle/direct/dresources/configs/*.generated.yml"
   - "bundle/internal/validation/generated/*.go"
   - "bundle/schema/jsonschema.json"
-  - "bundle/schema/jsonschema_for_docs.json"
   - "python/databricks/bundles/version.py"
   - "python/databricks/bundles/*/__init__.py"
   - "python/databricks/bundles/*/_models/*.py"
@@ -67,16 +61,14 @@ Files matching this rule's glob pattern are most likely generated artifacts. Aut
 - Everything, in one shot:
   - `./task generate` — aggregator that runs all generators below
 - OpenAPI SDK/CLI command stubs and related generated artifacts:
-  - `./task generate-genkit`
-  - Includes generated `cmd/account/**`, `cmd/workspace/**`, `.gitattributes`, `internal/genkit/tagging.py`.
+  - `./task generate-cligen` — regenerates `cmd/account/**`, `cmd/workspace/**` and `.gitattributes` from the checked-in `.codegen/cli.json`.
+  - `./task generate-clijson` — refreshes `.codegen/cli.json` from the OpenAPI spec via genkit (requires universe repo); also updates `internal/genkit/tagging.py`.
 - Direct engine generated YAML:
   - `./task generate-direct` (or `./task generate-direct-apitypes`, `./task generate-direct-resources`)
 - Bundle schemas:
   - `./task generate-schema`
-  - `./task generate-schema-docs`
-  - This can also refresh `bundle/internal/schema/annotations_openapi.yml` when OpenAPI annotation extraction is enabled.
-- Bundle docs:
-  - `./task generate-docs`
+  - Rewrites `bundle/internal/schema/annotations.yml` in place: upstream docs are sourced from `.codegen/cli.json` at generation time, and the file is synced with the config structure (placeholders added, stale entries dropped).
+  - The docs schema (`jsonschema_for_docs.json`) is not generated on main; it is built and published to the `docgen` branch on release by `.github/workflows/update-schema-docs.yml`.
 - Validation generated code:
   - `./task generate-validation`
 - Mock files:
diff --git a/.agents/rules/changelog.md b/.agents/rules/changelog.md
new file mode 100644
index 00000000000..f5099a0c98e
--- /dev/null
+++ b/.agents/rules/changelog.md
@@ -0,0 +1,8 @@
+---
+description: New changelog entries go in .nextchanges/, not CHANGELOG.md
+globs:
+  - "CHANGELOG.md"
+  - ".nextchanges/**"
+---
+
+**RULE: Do not add new release entries to `CHANGELOG.md`.** For a user-visible change, add a fragment file under `.nextchanges/<section>/` (sections: `notable-changes`, `cli`, `air`, `bundles`, `dependency-updates`, `api-changes`). Each PR adds its own file, so entries never conflict. `CHANGELOG.md` is generated automatically from these fragments by the release process — never hand-edit it. See `.nextchanges/README.md`.
diff --git a/.agents/rules/comments.md b/.agents/rules/comments.md
new file mode 100644
index 00000000000..858204aadc6
--- /dev/null
+++ b/.agents/rules/comments.md
@@ -0,0 +1,62 @@
+---
+description: Comment conventions for source files
+globs:
+  - "**/*.go"
+  - "**/*.py"
+  - "**/*.pyi"
+  - "**/*.sh"
+  - "**/*.scala"
+  - "**/*.js"
+  - "**/*.java"
+  - "**/*.sql"
+  - "**/*.r"
+  - "**/*.yml"
+  - "**/*.yaml"
+paths:
+  - "**/*.go"
+  - "**/*.py"
+  - "**/*.pyi"
+  - "**/*.sh"
+  - "**/*.scala"
+  - "**/*.js"
+  - "**/*.java"
+  - "**/*.sql"
+  - "**/*.r"
+  - "**/*.yml"
+  - "**/*.yaml"
+---
+
+# Comment conventions
+
+**RULE: Do not modify or remove existing comments in code you didn't write.** Comments often encode non-obvious context (a bug reference, a workaround, a reason the code is shaped a certain way) that is lost if rewritten. Leave them alone unless the user explicitly asks for a change.
+
+**RULE: Comments should explain "why", not "what".** Reviewers consistently reject comments that merely restate the code.
+
+**RULE: Keep comments concise, and avoid redundant or verbose ones.** Say only what the code cannot, then stop — only add a comment if it complements the code rather than repeating it or its signature. A doc comment gives the caller the contract and any surprising behavior, not a line-by-line re-spec. AI-generated comments trend long and explanatory, so tighten them before committing.
+
+**RULE: When code relies on a non-obvious invariant, workaround, or backend quirk, add a short comment stating the reason.** The inverse of the rule above: noise comments are bad, but missing comments are the single most common thing reviewers catch. Triggers include: API quirks (PATCH-like semantics, no get-by-name, stripped prefixes), fields intentionally included or excluded (output-only, etag, `ForceSendFields`), branches that look dead but are kept as guards, and tests where the expectation isn't obvious from the assertions.
+
+GOOD:
+
+```go
+// The Workspace API strips the "/Workspace" prefix from parent_path on GET,
+// so we re-add it here to match the local configuration.
+parentPath = "/Workspace" + parentPath
+```
+
+BAD:
+
+```go
+parentPath = "/Workspace" + parentPath
+```
+
+**RULE: In Go, document functions with a doc comment that starts with the function name and ends with a period.**
+
+```go
+// SomeFunc does something.
+func SomeFunc() {
+	...
+}
+```
+
+**RULE: When integrating external tools or detecting environment variables, include source reference URLs as comments.** This lets future readers trace where the behavior came from.
diff --git a/.agent/rules/databricks-template-schema-json.md b/.agents/rules/databricks-template-schema-json.md
similarity index 100%
rename from .agent/rules/databricks-template-schema-json.md
rename to .agents/rules/databricks-template-schema-json.md
diff --git a/.agent/rules/dresources.md b/.agents/rules/dresources.md
similarity index 100%
rename from .agent/rules/dresources.md
rename to .agents/rules/dresources.md
diff --git a/.agents/rules/pydabs-acceptance-tests.md b/.agents/rules/pydabs-acceptance-tests.md
new file mode 100644
index 00000000000..e2914c74593
--- /dev/null
+++ b/.agents/rules/pydabs-acceptance-tests.md
@@ -0,0 +1,8 @@
+---
+description: Rules for authoring PyDABs resource acceptance tests
+globs: acceptance/bundle/python/**
+paths:
+  - "acceptance/bundle/python/**"
+---
+
+**RULE: Before adding a PyDABs resource acceptance test, read `acceptance/bundle/python/README.md`.** It covers the `<plural>-support/` fixture layout, how to source and adapt realistic field values, the version/engine `test.toml` knobs, the determinism re-run, and how to cover interface (`Any`) fields in both authoring forms. Every PyDABs resource needs one (enforced by `test_python_support_coverage`).
diff --git a/.agent/rules/style-guide-go.md b/.agents/rules/style-guide-go.md
similarity index 89%
rename from .agent/rules/style-guide-go.md
rename to .agents/rules/style-guide-go.md
index f7e360b174e..ab2dad3b6e9 100644
--- a/.agent/rules/style-guide-go.md
+++ b/.agents/rules/style-guide-go.md
@@ -11,19 +11,10 @@ paths:
 
 Code you author should be consistent with the codebase and concise. The code should be self-documenting based on its function and variable names.
 
-**RULE: Document functions with a doc comment that starts with the function name and ends with a period.**
-
-```go
-// SomeFunc does something.
-func SomeFunc() {
-	...
-}
-```
-
-**RULE: Avoid redundant and verbose comments.** Only add a comment if it complements the code rather than repeating it.
-
 **RULE: Focus on making implementations as small and elegant as possible.** Avoid unnecessary loops and allocations. If dropping or relaxing a requirement would simplify things, ask the user about the trade-off.
 
+**RULE: Do not declare inline function closures just to name a repeated operation.** Extract it as a regular named function instead. Closures that capture local variables hide their dependencies, complicate reading, and can't be tested in isolation.
+
 ### Modern Go (1.24+) idioms
 
 **RULE: Use `for i := range X` for integer iteration, not `for i := 0; i < X; i++`.**
@@ -48,8 +39,6 @@ type myKeyType int
 
 **RULE: Define magic strings as named constants at the top of the file.** When a value is used in more than one place, define a package-level constant even if the literal is short. If a related value already has a constant in the same package, follow the existing pattern instead of introducing a parallel literal.
 
-**RULE: When integrating external tools or detecting environment variables, include source reference URLs as comments.** This lets future readers trace where the behavior came from.
-
 ### Control flow
 
 **RULE: When several branches are alternatives for the same decision, prefer `switch` over `if / else if`.** Same-decision means: you're dispatching on one value or one boolean question and each branch is a different answer to it. Ordered precedence chains (try this, else this, else this) are a different shape; leave those as early-return `if`s.
@@ -122,6 +111,12 @@ for p := range changes {
 return fieldPaths
 ```
 
+### Encoding
+
+**RULE: When mutating an API response by round-tripping JSON, decode with `json.Decoder` + `UseNumber()`.** The naive `json.Marshal` → `map[string]any` → `Marshal` path corrupts any int64 larger than 2^53 (it degrades to a float64 mantissa — e.g. a real `spark_context_id`) and alphabetizes object keys. `libs/dyn/jsonloader` preserves key order but also lacks `UseNumber`, so it shares the int64 hazard.
+
+**RULE: Be careful with `encoding/csv` `Writer.UseCRLF = true`.** It rewrites both record terminators AND embedded newlines inside quoted fields to `\r\n`, so tests for quoted multiline fields must expect `\r\n`, not just the line endings between rows.
+
 ### Environment variables
 
 **RULE: In library and product code, use `github.com/databricks/cli/libs/env` for reading environment variables, not `os.Getenv`.** `env.Get(ctx, name)` and `env.Lookup(ctx, name)` can be overridden per-context in tests, so you don't have to mutate process-wide state to exercise a code path. `os.Getenv` is still fine in `main`, tests, and acceptance/integration harnesses where no `ctx` is available and overrides aren't needed.
diff --git a/.agent/rules/style-guide-py.md b/.agents/rules/style-guide-py.md
similarity index 94%
rename from .agent/rules/style-guide-py.md
rename to .agents/rules/style-guide-py.md
index 280af2181b8..482f74d8141 100644
--- a/.agent/rules/style-guide-py.md
+++ b/.agents/rules/style-guide-py.md
@@ -19,8 +19,6 @@ Python in this codebase is written as scripts. Bias for conciseness.
 
 **RULE: Do not catch exceptions just to add a nicer message.** Only catch if you can add critical information the caller can't produce.
 
-**RULE: Avoid redundant comments.**
-
 **RULE: Keep code small and minimize abstractions.**
 
 **RULE: Format with `ruff format -n <path>` before committing.**
diff --git a/.agents/rules/telemetry.md b/.agents/rules/telemetry.md
new file mode 100644
index 00000000000..5526dfb2007
--- /dev/null
+++ b/.agents/rules/telemetry.md
@@ -0,0 +1,44 @@
+---
+description: How to add or extend bundle deploy telemetry metrics
+globs:
+  - "libs/telemetry/**/*.go"
+  - "bundle/phases/telemetry.go"
+  - "bundle/phases/resources_metadata.go"
+  - "bundle/metrics/**/*.go"
+paths:
+  - "libs/telemetry/**/*.go"
+  - "bundle/phases/telemetry.go"
+  - "bundle/phases/resources_metadata.go"
+  - "bundle/metrics/**/*.go"
+---
+
+# Extending bundle deploy telemetry
+
+The deploy payload is declared twice: the proto in the universe repo (`proto/logs/frontend/databricks_cli/bundle_deploy.proto`, source of truth for the backend table) and the Go struct in `libs/telemetry/protos/` that the CLI serializes to JSON. Ingestion ignores unknown fields, so the two PRs can land in either order — a field the CLI sends before the proto lands is dropped, not rejected.
+
+## Adding a new resource type
+
+**RULE: A new bundle resource type needs no telemetry change.** Per-type counts come from `resources_metadata.resources[*]`, which `resourceMetadata` in `bundle/phases/resources_metadata.go` derives from `Resources.AllResources()` — exhaustive by construction and guarded by `TestResourcesAllResourcesCompleteness`.
+
+**RULE: Do not add new `resource_<type>_count` fields to `BundleDeployEvent`.** The 12 that exist, and the aggregate `resource_count`, are `deprecated = true` in the universe proto, kept only for continuity of existing dashboards. Adding more re-creates what `resources_metadata` fixed: a hand-maintained field list that silently lags the resource types, making a new type indistinguishable from zero adoption. New dashboard panels should read `resources_metadata`.
+
+## Adding a new metric
+
+1. Add the field to the relevant message in `libs/telemetry/protos/`, and populate it in `bundle/phases/telemetry.go`.
+2. Refresh the acceptance golden: `go test ./acceptance -run '^TestAccept/bundle/telemetry' -update`.
+3. Send the universe PR adding the same field to the proto, with a `compliance.data_label` annotation matching the neighbouring fields.
+
+**RULE: Never send a resource name, path, or any other user-authored string.** Names are PII. Resource identity goes through the numeric/UUID ID lists (`resource_job_ids` and friends), and only for types that have such an ID.
+
+**RULE: Do not add `omitempty` to a count or measurement that can legitimately be zero.** An explicit `0` distinguishes "nothing of this kind in this deploy" from "CLI too old to report the field"; with `omitempty` both arrive as null and the population can't be sized.
+
+Other things worth knowing:
+
+- A one-off boolean needs no proto change: add a key constant to `bundle/metrics/metrics.go` (snake_case, matching the constant name) and call `b.Metrics.SetBoolValue(...)`. It lands in `experimental.bool_values`.
+- Metrics that may be removed later belong in `BundleDeployExperimental`, which carries no compatibility guarantees.
+- Positional encodings such as the `upload_file_sizes` histogram are frozen once the metric has adoption: changing a bucket bound silently changes the meaning of every previously reported entry.
+- Per-resource state sizes come from the direct engine's state in `resources.json`.
+
+## Where the data lands
+
+Deploy events land in `main.team_eng_deco.bundle_deploy_telemetry`; the dashboard is `app/dabs_telemetry` in `databricks-eng/ds-projects`. The daily pipeline reads `entry.bundle_deploy_event.*` wholesale, so a new field arrives on its own, but it has to be added to a dashboard panel by hand to become visible.
diff --git a/.agents/rules/template-versions.md b/.agents/rules/template-versions.md
new file mode 100644
index 00000000000..4fab6805437
--- /dev/null
+++ b/.agents/rules/template-versions.md
@@ -0,0 +1,31 @@
+---
+description: Version pins in bundle templates (DBR, DB Connect, serverless env, Python)
+globs:
+  - "libs/template/templates/**/library/versions.tmpl"
+  - "libs/template/templates/**/library/template_variables.tmpl"
+  - "libs/template/templates/**/build.sbt.tmpl"
+  - "libs/template/templates/**/resources/*.job.yml.tmpl"
+  - "libs/template/templates/**/pyproject.toml.tmpl"
+paths:
+  - "libs/template/templates/**/library/versions.tmpl"
+  - "libs/template/templates/**/library/template_variables.tmpl"
+  - "libs/template/templates/**/build.sbt.tmpl"
+  - "libs/template/templates/**/resources/*.job.yml.tmpl"
+  - "libs/template/templates/**/pyproject.toml.tmpl"
+---
+
+# Bundle template version pins
+
+Bundle templates pin the runtime versions they render. Most pins are macros in `libs/template/templates/default/library/versions.tmpl` (DBR, DB Connect, serverless environment, Python, and the `databricks-bundles` package), and that single file serves five shipped templates: `default-minimal`, `default-python`, `lakeflow-pipelines` and `pydabs` alias it through `"template_dir": "../default"` in their `databricks_template_schema.json`, while the deprecated `cli-pipelines` is registered in `libs/template/template.go` with `lakeflow-pipelines`'s reader. The `default` template itself is not shipped. `dbt-sql` defines its own subset, `default-scala` defines its own in `library/template_variables.tmpl`, and two templates hardcode a version in the files they render instead of going through a macro. The `.tmpl` files are the source of truth for the current values; the rules below describe how the pins relate, not what they are.
+
+**RULE: Keep the serverless environment version, the Python pins, the DB Connect pin, and `latest_lts_dbr_version` mutually compatible. This is a hard constraint.** A serverless environment version dictates a runtime Python version, and the DB Connect pin must support that Python. The DBR LTS pin belongs in the same check rather than being treated as independent — the two have drifted before: `latest_lts_dbr_version` reached 16.4 in #3671 while the DB Connect pin stayed on 15.4 until #6378. Cross-check the [serverless environment version release notes](https://docs.databricks.com/aws/en/release-notes/serverless/environment-version/) and the [DB Connect requirements](https://docs.databricks.com/dev-tools/databricks-connect/python/index.html#requirements) whenever you change any of the four.
+
+**RULE: Within that constraint, keep `default`'s `conservative_db_connect_version_spec` as low as compatibility allows.** The DB Connect client is only forward-compatible (it reaches compute of its own version and higher), so the lowest compatible pin maximizes the range of DBR versions a customer can connect to; a higher pin rules out customers on older DBR, and they can move to a newer version themselves after initializing the template. The floor is the *oldest* release that passes two tests: its DBR line has more than six months of support remaining, *and* the DBR version it targets runs `python_version_spec`'s Python on the cluster — not merely that the client supports that Python. The support buffer prevents freshly generated projects from immediately approaching end of support. DB Connect 15.4 is the worked example: its client supports Python 3.12, but DBR 15 clusters run Python 3.11, so it fails the second test and 16.4 is the floor. Never read this as "pin the current DBR LTS" — that is the newest release, the opposite of a floor, and #6378 rejected exactly that bump. Keep the upper bound at the next minor release, so the spec stays inside one minor: widening it lets a freshly initialized project resolve a client far newer than the floor advertises, which is the opposite of conservative. Do not raise the pin merely to match a newer serverless environment version — raise it only when the constraint above forces it, or when the pinned DBR line has six months or less of support remaining. Use the [DBR release notes](https://docs.databricks.com/aws/en/release-notes/runtime/) to choose the oldest compatible replacement with more than six months of support remaining. See PR #3897 and PR #6378 for prior history.
+
+This rule governs `default`'s pin. `default-scala` deliberately does the opposite: it tracks the newest LTS in `dbr_version`. Its client in `template/{{.project_name}}/build.sbt.tmpl` uses that macro as an open-ended `.+` dependency, while its classic-cluster `spark_version` combines `dbr_version` with `scala_major_minor_version`. Keep `dbr_version` and `scala_major_minor_version` compatible with the selected DBR release. Do not lower `dbr_version`, or pin the client dependency, to satisfy the rule above.
+
+**RULE: When bumping the serverless environment version or the Python version, update every occurrence, not just the macros.** More than one template defines `serverless_environment_version`, and those definitions must stay in sync. Two templates hardcode the value in the files they render instead — `default-scala` in one job and `lakeflow-integrations` in two — and `lakeflow-integrations` also hardcodes `requires-python`. A Python bump additionally needs `default_python_version`, which supplies the notebook kernel version in `src/sample_notebook.ipynb.tmpl`. Grep `environment_version`, `requires-python` and `default_python_version` under `libs/template/templates/` and move every hit together.
+
+**RULE: Do not sync a value across templates just because a macro name matches.** Outside the serverless environment version, a pin is a per-template choice that may legitimately differ, so check each template's intended value and change only the ones that should move.
+
+Version pins are rendered into the materialized templates checked into `acceptance/`, and not all of those live under `acceptance/bundle/templates/` — `acceptance/pipelines/` renders the pins too. Regenerate with `./task test-update`, not `./task test-update-templates`, which covers only the `bundle/templates` subtree. See `.agents/rules/testing.md` and `.agents/rules/auto-generated-files.md`.
diff --git a/.agents/rules/testing.md b/.agents/rules/testing.md
new file mode 100644
index 00000000000..ae6248d2d1b
--- /dev/null
+++ b/.agents/rules/testing.md
@@ -0,0 +1,260 @@
+---
+description: Rules for the testing strategy of this repo
+paths:
+  - "**/*_test.go"
+  - "acceptance/**"
+  - "integration/**"
+---
+
+# Rules for the testing strategy of this repo
+
+## Test Types
+
+- **Unit tests**: Standard Go tests alongside source files
+- **Acceptance tests**: `acceptance/` directory. Every test runs locally against the mock HTTP server; a subset *additionally* runs against a real workspace (`Cloud = true`). This is where new end-to-end coverage belongs.
+- **Integration tests**: `integration/` directory, requires a live Databricks workspace. **Deprecated — do not add tests here.** Write an acceptance test with `Cloud = true` instead, so the same test runs both locally and against a real workspace.
+
+## Choosing a test level
+
+**RULE: For user-visible CLI output and changes to the bundle mutator pipeline, reach for acceptance tests first.** They exercise the full pipeline and capture the exact output the user sees. `cmd/...` commands and anything under the mutator pipeline (`bundle/config/mutator/...` and `bundle/mutator/...`) are the strongest candidates. When the coverage overlaps with an existing test, extend the existing acceptance directory instead of creating a new one.
+
+**Unit tests are still the right tool** for pure functions, utility code, parsing/formatting helpers, and anything you can meaningfully test without mocking the whole world. Don't force a unit into an acceptance test just because the code lives under `cmd/`, and don't add a mutator unit test that only duplicates what an acceptance test already covers.
+
+When in doubt: would the test fail in a useful way if a mutator earlier in the pipeline changed? If yes, the test wants to be an acceptance test.
+
+**RULE: Do not add new tests under `integration/`. That tree is deprecated.** When coverage needs a real workspace, write an acceptance test and set `Cloud = true` in its `test.toml`. You get the local run against the fake server *and* the real-workspace run from one test, instead of a workspace-only test that never runs in the local suite.
+
+## Unit tests
+
+**RULE: Each source file should have a corresponding test file.** If you add new functionality to a file, extend the test file to cover it.
+
+**RULE: Place tests in the same package but with a `_test` suffix.** Test names start with `Test` and describe the function or module under test.
+
+**RULE: Use `require` for preconditions that would make the rest of the test meaningless on failure.** Use `assert` for expected values where the test can keep running after a failure.
+
+```go
+package mutator_test
+
+func TestApplySomeChangeReturnsDiagnostics(t *testing.T) {
+	...
+}
+
+func TestApplySomeChangeFixesThings(t *testing.T) {
+	ctx := t.Context()
+	b, err := ...some operation...
+	require.NoError(t, err)
+	...
+	assert.Equal(t, ...)
+}
+```
+
+**RULE: Use table-driven tests for multiple similar cases.** Reviewers prefer this pattern over repeating near-identical test functions when the inputs differ but the logic is the same.
+
+**RULE: If a value is shared across tests and they must change together, extract it to a package-level `const` or `var`.** Think shared fixtures, identifiers that must stay in sync across tests, and expected error messages that the tests verify as a set. Repeated literals that happen to be the same (e.g. a header name like `"Authorization"` appearing inline in many tests) are fine to leave inline; forcing extraction there hurts readability without buying anything.
+
+When writing tests, don't include an explanation in each test case in your responses. Only the tests are needed.
+
+## Acceptance Tests
+
+**RULE: `Cloud = true` adds a cloud run; it never removes the local run.** Every test under `acceptance/` runs locally against the fake server in `libs/testserver`. `Cloud = true` in a `test.toml` or `out.test.toml` means "this test *also* runs against a real workspace when `CLOUD_ENV` is set" — it never means "this test does not run locally". Never tell the user a test doesn't run locally because it is `Cloud = true`. `CloudSlow` does *not* enable a cloud run on its own; it only narrows an existing `Cloud = true` run (see below).
+
+The whole `Cloud*` family lives inside an `if isRunningOnCloud` branch in `getSkipReason` (`acceptance/acceptance_test.go`), so it can only ever subtract from the cloud run: `CloudSlow` (only meaningful when `Cloud = true`) drops it under `-short`, and `CloudEnvs` narrows it to the listed clouds. To find what skips a test *locally*, look at a different set: `GOOS`, `RunsOnDbr`, and `DATABRICKS_TEST_SELECT_CHANGED` (which cloud PR runs set to cover only the tests the branch touches).
+
+`Cloud` is inherited, so a parent `test.toml` can opt a whole subtree in; a leaf `test.toml` with no `Cloud` line is not evidence of anything. Read the generated `out.test.toml` for a test's effective settings.
+
+**RULE: Never edit generated acceptance output files directly.** Files named `output.txt`, `out.test.toml`, `out.requests.txt`, or anything starting with `out` are regenerated. Use the `-update` flag to regenerate them.
+
+Exception: mass string replacement when the change is predictable and much cheaper than re-running the test suite.
+
+**RULE: All `EnvMatrix` variants MUST produce identical output files.** The only exception is a test that sets `EnvVaryOutput`, whose files named after the variant value (e.g. `out.deploy.<value>.txt`) are per-variant.
+
+**RULE: Do not run `-update` while a divergent variant exists.** It is destructive: it overwrites with the last variant and breaks the others. To debug: run a single variant you consider correct with `-update`, then debug the other variant to find why it diverges.
+
+**RULE: Put common `test.toml` options in a parent directory.** Config is inherited from parents.
+
+**RULE: Add test artifacts (e.g. `.databricks`) to `Ignore` in `test.toml`.**
+
+**RULE: Commit static test inputs into the acceptance test directory; do not create them in `script` at test time.** If a file's content is dynamic, generating it in `script` is fine. For everything else, check it in and let the test read it directly; you won't need an `Ignore` entry because there's nothing to clean up.
+
+GOOD:
+
+```
+acceptance/cmd/fs/cp/file-to-dir/
+  script        # $CLI fs cp local.txt dbfs:/path/
+  test.toml
+  local.txt     # committed input
+  output.txt
+```
+
+BAD:
+
+```
+acceptance/cmd/fs/cp/file-to-dir/
+  script        # echo "contents" > local.txt; $CLI fs cp local.txt dbfs:/path/; rm local.txt
+  test.toml     # Ignore = ["local.txt"]
+  output.txt
+```
+
+**RULE: On Windows, Git Bash auto-converts a leading-`/` path argument (e.g. `/api/2.0/...`) into a Windows path, so `$CLI` sees the wrong path and the testserver 404s.** Set `Env.MSYS_NO_PATHCONV = "1"` in the test directory's `test.toml`. Quoting the argument in bash does NOT help — the conversion is done by the Windows binary's argument processing. Precedent: `acceptance/cmd/workspace/export-dir-*/test.toml`.
+
+**RULE: `EnvMatrix.<VAR> = []` removes that variable from the inherited matrix** (see `ExpandEnvMatrix` in `acceptance/internal/config.go`). For example, `acceptance/bundle/test.toml` matrixes `DMS = ["", "true"]`, so a bundle test opts out of the DMS run with `EnvMatrix.DMS = []`. The `out.test.toml` snapshot of inherited values is generated and committed by design.
+
+**RULE: Write every map-valued setting in dotted form at the top of `test.toml`, never under a table header.** This covers `Env`, `EnvMatrix`, `EnvMatrixExclude`, `EnvRepl`, `GOOS` and `CloudEnvs` — e.g. `Env.MSYS_NO_PATHCONV = "1"`, `GOOS.windows = false`. In TOML every key after a `[EnvMatrix]` header belongs to that table until the next header — a blank line does not end it. So a top-level key like `Ignore` placed below `[EnvMatrix]` is silently parsed as `EnvMatrix.Ignore` (a bogus matrix variable) instead of the real top-level field, and the test runs with the field unset. Dotted form keeps each key's table explicit and is immune to ordering.
+
+`[[Repls]]` and `[[Server]]` are the exception: they are arrays of tables whose elements carry several keys each, so they keep the header form (as does `[Server.Response.Headers]`, which belongs to a `[[Server]]` element). Place dotted keys *above* the first such header — below one they would be captured by it, which is the same trap in reverse.
+
+GOOD:
+
+```toml
+EnvMatrix.READPLAN = ["", "1"]
+Ignore = ["databricks.yml"]
+```
+
+BAD:
+
+```toml
+[EnvMatrix]
+READPLAN = ["", "1"]
+
+Ignore = ["databricks.yml"]   # parsed as EnvMatrix.Ignore, not top-level Ignore
+```
+
+**RULE: If a test's `out.test.toml` is still in the older `[EnvMatrix]` block format, a regen rewrites it to the inline form and the post-test `git diff --exit-code` check fails** ("out.test.toml files that are out of date"). Regenerate just those files with `go test ./acceptance -run "^TestAccept$" -only-out-test-toml`, then commit.
+
+### Reference
+
+- Tests live in `acceptance/` with a nested directory structure. All of them run locally; those with `Cloud = true` set also run against a real workspace.
+- Each test directory contains `databricks.yml`, `script`, and `output.txt`.
+- Source files: `test.toml`, `script`, `script.prepare`, `databricks.yml`, etc.
+- Tests are configured via `test.toml`. Config schema and explanation is in `acceptance/internal/config.go`. Certain options are also dumped to `out.test.toml` so that inherited values are visible on PRs.
+- Run a single test: `go test ./acceptance -run TestAccept/bundle/<path>/<to>/<folder>`
+- Run a specific variant by appending `EnvMatrix` values to the test name: `go test ./acceptance -run 'TestAccept/.../DMS=true'`. When there are multiple `EnvMatrix` variables, they appear in alphabetical order.
+- Useful flags: `-v` for verbose output, `-tail` to follow test output (requires `-v`), `-logrequests` to log all HTTP requests/responses (requires `-v`).
+- Run tests on cloud: `deco env run -i -n aws-prod-ucws -- <go test command>` (requires `deco` tool and access to test env). This is an *additional* pass over the same test directories, restricted to those with `Cloud = true` set; it does not replace the local run.
+- `script.prepare` files from parent directories are concatenated into the test script. Use them for shared bash helpers.
+
+### Built-in shell helpers
+
+`acceptance/script.prepare` defines shell helpers that are in scope for every `script`. Prefer them over hand-rolled equivalents — they keep `output.txt` consistent across tests and make intent obvious to the next reader.
+
+- `trace CMD...`: print `>>> CMD` to stderr, then run CMD. Wrap commands whose invocation should appear in `output.txt` so the captured output explains what produced it. Leading `KEY=value` arguments are exported for the command (e.g. `trace FOO=bar $CLI ...`).
+- `title "TEXT"`: print a `=== TEXT` section header. Use `\n` escapes for spacing. Use it to label the phases of a multi-step script.
+- `errcode CMD...`: run CMD; if it exits non-zero, append `Exit code: N` to the output but let the script continue (scripts run under `bash -e`, which would otherwise abort). Use when a command is *allowed* to fail and later steps must still run.
+- `musterr CMD...`: run CMD and fail the whole test if it *succeeds*; on the expected failure the script continues. Use to assert a command must error.
+- `withdir DIR CMD...`: run CMD with the working directory set to DIR, restoring it afterwards.
+- `git-repo-init`: initialize a deterministic git repo (fixed user/email, no hooks) and commit `databricks.yml`.
+- `uuid`, `sethome DIR`, `venv_activate`, `as-test-sp CMD...`, `readplanarg FILE`, `envsubst`: see `acceptance/script.prepare` for the full list and exact semantics.
+
+**RULE: Wrap commands whose invocation should be visible in `output.txt` with `trace`.** The `>>> ...` line ties each block of output to the command that produced it; without it the output is an unlabeled wall of text.
+
+**RULE: Assert an expected failure with `musterr`, not `! cmd` or a bare `errcode`.** Only `musterr` fails the test when the command unexpectedly *succeeds*. `! cmd` is exempt from `set -e` and silently passes on success; `errcode` is for *tolerated* failures, not required ones.
+
+**RULE: Capture a tolerated non-zero exit with `errcode`, not `cmd || true`.** `errcode` records `Exit code: N` in the output so the failure stays visible and asserted; `|| true` hides it entirely.
+
+### Helper scripts
+
+**RULE: Use the `acceptance/bin/` helpers before reaching for inline `jq` or `grep` pipelines.** When a test needs to filter recorded requests, assert a substring is or isn't present, or register a dynamic replacement, the helpers handle sorting, URL query normalization, redaction hooks, and cross-platform path issues. Inline `jq` in an acceptance script is brittle and hard to read.
+
+GOOD:
+
+```bash
+trace $CLI bundle plan | contains.py "Plan: 0 to add, 0 to delete, 1 to update"
+trace print_requests.py //api/2.0/apps
+add_repl "$deployment_id" DEPLOYMENT_ID
+```
+
+BAD:
+
+```bash
+{ trace jq 'select(.method == "POST" and .path == "/api/2.0/apps")' out.requests.txt; } || true
+```
+
+Available on `PATH` during test execution (from `acceptance/bin/`):
+
+- `contains.py SUBSTR [!SUBSTR_NOT]`: passthrough filter (stdin→stdout) that checks substrings are present (or absent with `!` prefix). Errors are reported on stderr.
+- `print_requests.py //path [^//exclude] [--get] [--sort] [--unique] [--oneline] [--keep]`: print recorded HTTP requests matching path filters. Requires `RecordRequests = true` in `test.toml`. Excludes GET by default (`--get` includes them); clears `out.requests.txt` afterwards (`--keep` retains it). `^` prefix excludes a path; multiple positive filters are OR'd together. `--sort` orders output deterministically (use when the request set is order-independent), `--unique` collapses consecutive duplicates (e.g. repeated polls), `--oneline` prints one request per line.
+- `replace_ids.py [-t TARGET]`: read deployment state and add `[NAME_ID]` replacements for all resource IDs.
+- `read_id.py [-t TARGET] NAME`: read ID of a single resource from state, print it, and add a `[NAME_ID]` replacement.
+- `add_repl VALUE REPLACEMENT`: add a custom replacement (VALUE will be replaced with `[REPLACEMENT]` in output). Wraps `add_repl.py`, which appends a JSON line to `$ACC_REPLS` — the file holding every replacement applied to the output, read back by the harness and by `diff.py` / `sort_lines.py --repl`. Always go through the helper; do not write `$ACC_REPLS` from a script.
+- `update_file.py FILENAME OLD NEW`: replace all occurrences of OLD with NEW in FILENAME. Errors if OLD is not found. Cannot be used on `output.txt`.
+- `find.py REGEX [--expect N]`: find files matching regex in current directory. `--expect N` asserts an exact count.
+- `diff.py DIR1 DIR2` or `diff.py FILE1 FILE2`: recursive diff with test replacements applied.
+- `print_state.py [-t TARGET] [--backup]`: print deployment state (`resources.json`, or a terraform state left by an older CLI).
+- `edit_resource.py TYPE ID < script.py`: fetch resource by ID, execute Python on it (resource in `r`), then update it. TYPE is `jobs` or `pipelines`.
+- `gron.py`: flatten JSON into greppable discrete assignments (simpler than `jq` for searching JSON).
+- `jq` is also available for JSON processing.
+
+**RULE: Prefer `gron.py | grep <field>` over inline `jq` paths for single-value lookups.** The gron output prints the JSON path inline, so the test log explains itself.
+
+**RULE: Don't pass `--keep` to `print_requests.py` if a later `print_requests.py` call follows.** The buffer accumulates, so the second call double-prints the earlier requests.
+
+**RULE: Filter recorded requests with `print_requests.py`, never with a hand-written `jq 'select(...)' out.requests.txt` pipeline** — inline, or hidden inside a local `print_requests()` shell function. The helper already excludes GET, normalizes query strings, optionally sorts, and deletes `out.requests.txt` afterwards. A copy-pasted `jq` wrapper reimplements all of that, drifts from the canonical output format, and is the single most common acceptance-test anti-pattern in this repo. Wrapping `print_requests.py` *itself* in a local function is fine — e.g. to send each variant's output to its own `out.requests.<name>.json`. Reach for `jq` on `out.requests.txt` only for what `print_requests.py` genuinely can't express: filtering on request *body* content, or deleting noisy body fields (prefer a `Repls` entry in `test.toml` even then).
+
+GOOD:
+
+```bash
+trace print_requests.py //pipelines --sort
+```
+
+BAD:
+
+```bash
+print_requests() {
+    jq --sort-keys 'select(.method != "GET" and (.path | contains("/pipelines")))' < out.requests.txt
+    rm out.requests.txt
+}
+trace print_requests
+```
+
+**RULE: Route noisy or non-deterministic command output to `LOG.<name>` instead of `output.txt` or `/dev/null`.** `LOG.*` files are visible under `go test -v` but excluded from the diff — see `acceptance/selftest/log/`. Use `&> LOG.<name>` to capture both streams (then `contains.py` to assert invariants like `'!panic' '!internal error'`), or `2>>LOG.<name>` for cleanup-step stderr you'd otherwise drop to `/dev/null`.
+
+**RULE: When a test prints an API GET/read response into `output.txt`, project it to an allow-list of the fields the test asserts — never dump the full payload or strip a deny-list of volatile fields with `jq 'del(...)'`.** The backend keeps adding response fields, and cloud tests run against the real API, so a full payload (or a `del` that only removes today's volatile fields) breaks the golden every time the response grows — even for fields the test does not care about. Instead define a `<resource>_fields()` helper in the resource directory's `script.prepare` that `jq`-selects the fields you assert, and pipe the response through it. Precedent: `acceptance/bundle/resources/postgres_*/script.prepare`.
+
+GOOD:
+
+```bash
+# in script.prepare
+branch_fields() {
+    jq '{branch_id, name, parent, status: (.status | {branch_id, default, is_protected})}'
+}
+# in script
+trace $CLI postgres get-branch "$name" | branch_fields
+```
+
+BAD:
+
+```bash
+trace $CLI postgres get-branch "$name" | jq 'del(.create_time, .update_time)'
+trace $CLI postgres get-branch "$name"   # full payload straight into output.txt
+```
+
+For a field that appears on some responses but not others (e.g. a provenance field absent on a default resource), append `| with_entries(select(.value != null))` to the projected object so the optional field is dropped rather than emitted as `null`.
+
+### Test server
+
+Acceptance tests run against an in-process fake of the Databricks API in `libs/testserver/` (`FakeWorkspace` and the per-service handler files). The fake keeps real in-memory state and returns the same errors the backend does: 404 on a missing parent, 409 on a duplicate create, 400 on a missing required field, and so on. `test.toml` can also stub a single route with a canned response:
+
+```toml
+[[Server]]
+Pattern = "POST /api/2.2/jobs/create"
+Response.StatusCode = 400
+Response.Body = '''{"error_code": "INVALID_PARAMETER_VALUE", "message": "..."}'''
+```
+
+**RULE: Model API behavior in `libs/testserver/`, not in per-test `[[Server]]` response stubs.** When a test needs the fake server to validate input or return an error, add or extend the handler in `libs/testserver/` so the behavior is stateful and shared by every test. A `[[Server]]` stub hijacks the route with a static response that ignores request state, diverges from the real API, and only helps the one test that declares it — so the next test re-stubs the same error and the fake never converges on the real contract.
+
+GOOD: teach the create handler in `libs/testserver/postgres.go` to return 404 when the referenced role does not exist, so every test that creates a database against a missing role observes the real error.
+
+BAD: add `[[Server]]` with `Pattern = "POST .../databases"` and `Response.StatusCode = 404` to a single test's `test.toml` to fake that same error.
+
+Reserve `[[Server]]` for routes the testserver does not model at all (a one-off endpoint exercised by a single test) and for injecting a response a stateful handler genuinely can't express (for transient faults and forced disconnects, prefer the `fault.py` / kill helpers instead).
+
+### Update workflow
+
+**RULE: Run `./task test-update` to regenerate outputs, then `./task fmt` and `./task lint`.** If fmt or lint modify files in `acceptance/`, there's an issue in the source files. Fix the source, regenerate, and verify fmt/lint pass cleanly.
+
+### Template tests
+
+Tests in `acceptance/bundle/templates` include materialized templates in output directories. These directories follow the same `out` convention: everything starting with `out` is generated output. Sources are in `libs/template/templates/`.
+
+**RULE: Use `./task test-update-templates` to regenerate materialized templates.** If linters or formatters find issues in materialized templates, do not fix the output files; fix the source in `libs/template/templates/` and regenerate.
diff --git a/.agents/skills/bump-cli-compat/SKILL.md b/.agents/skills/bump-cli-compat/SKILL.md
new file mode 100644
index 00000000000..454c93e14a9
--- /dev/null
+++ b/.agents/skills/bump-cli-compat/SKILL.md
@@ -0,0 +1,153 @@
+---
+name: bump-cli-compat
+description: "Bump cli-compat.json with new AppKit and Agent Skills versions, then create a PR. Use when the user says 'bump cli-compat', 'update cli-compat', 'bump compatibility manifest', 'new appkit release cli-compat', or wants to update the CLI compatibility manifest after an AppKit or Agent Skills release."
+user-invocable: true
+allowed-tools: Read, Edit, Write, Bash, Glob, Grep, AskUserQuestion
+---
+
+# Bump CLI Compatibility Manifest
+
+Updates `internal/build/cli-compat.json` with new AppKit and Agent Skills versions, validates the result, and creates a PR.
+
+## Arguments
+
+Parse the user's input for optional named flags:
+
+- `--appkit <version>` → AppKit version (e.g. `0.28.0`)
+- `--skills <version>` → Agent Skills version (e.g. `0.1.6`)
+- No args → auto-detect latest versions from GitHub tags
+
+Versions should be provided **without** the `v` prefix (e.g. `0.28.0`, not `v0.28.0`). If provided with the prefix, strip it.
+
+## Workflow
+
+### Step 1: Resolve versions
+
+If both `--appkit` and `--skills` versions were provided, skip to Step 2.
+
+For any missing version, fetch the latest tag from GitHub:
+
+```bash
+# Latest appkit version (strip leading 'v')
+gh api repos/databricks/appkit/tags --jq '.[0].name' | sed 's/^v//'
+
+# Latest skills version (strip leading 'v')
+gh api repos/databricks/databricks-agent-skills/tags --jq '.[0].name' | sed 's/^v//'
+```
+
+Show the resolved versions to the user and ask:
+
+> The latest versions are:
+> - AppKit: `{appkit_version}`
+> - Agent Skills: `{skills_version}`
+>
+> Have these versions been evaluated (evals passed with no regressions)?
+
+**Do NOT proceed until the user confirms.** If the user says no or wants different versions, ask them to provide the correct versions.
+
+### Step 2: Validate tags exist
+
+Verify that the corresponding Git tags exist on GitHub. For AppKit, also validate the `template-v` tag (used by `apps init`):
+
+```bash
+# AppKit release tag
+gh api repos/databricks/appkit/git/ref/tags/v{appkit_version} --jq '.ref'
+
+# AppKit template tag (used by apps init)
+gh api repos/databricks/appkit/git/ref/tags/template-v{appkit_version} --jq '.ref'
+
+# Agent Skills tag
+gh api repos/databricks/databricks-agent-skills/git/ref/tags/v{skills_version} --jq '.ref'
+```
+
+If any tag doesn't exist, report the error and stop.
+
+### Step 3: Read current manifest
+
+Read `internal/build/cli-compat.json` and `AgentSkillsFallbackVersion` in `internal/build/clicompat.go`. Note the current versions and the list of versioned entries. The newest CLI range uses `"skills": "latest"`; the compiled constant supplies the tested fallback. Keep older released ranges pinned. Routine skills releases need no manifest bump. CLIs before `1.6.0` reject `"latest"` and use a valid cached or embedded manifest without returning a parse error; losing remote AppKit and skills compatibility updates for these CLIs is accepted.
+
+### Step 4: Determine update type
+
+Ask the user:
+
+> Do any of these apply?
+> - **AppKit**: The new templates require new CLI logic in `apps init` (e.g. new flags, prompts, or template handling that older CLIs don't have)
+> - **Skills**: The new skills version uses CLI commands that older CLIs don't support
+>
+> If **neither** applies, this is a non-breaking bump (default).
+
+- **No breaking changes** (default): proceed to Step 4a.
+- **Breaking changes**: proceed to Step 4b.
+
+### Step 4a: No breaking changes (update in-place)
+
+Update the **highest versioned entry** to the new `appkit` version, keeping `"skills": "latest"`. Update `AgentSkillsFallbackVersion` in `internal/build/clicompat.go` to the tested skills version. Do NOT add new versioned keys. The manifest is range-based: updating the highest entry automatically covers all CLI versions in that range.
+
+Write the updated `internal/build/cli-compat.json` and `internal/build/clicompat.go`.
+
+### Step 4b: Breaking changes (add new entry)
+
+Ask the user for the **minimum CLI version** that supports the new features.
+
+Add a new entry keyed to that CLI version with the new `appkit` and `"skills": "latest"`. Update `AgentSkillsFallbackVersion` in `internal/build/clicompat.go` to the tested skills version. If skills compatibility changed, replace `"latest"` in the affected older ranges with the last compatible release. Preserve unrelated AppKit and skills compatibility boundaries.
+
+Write the updated `internal/build/cli-compat.json` and `internal/build/clicompat.go`.
+
+### Step 5: Validate
+
+Run the Go tests to ensure the manifest is well-formed:
+
+```bash
+go test ./libs/clicompat/... -run 'Test(EmbeddedManifest|ResolveEmbeddedAgentSkillsVersion)' -v
+```
+
+If validation fails, show the errors and fix them before proceeding.
+
+### Step 6: Create branch, commit, and PR
+
+```bash
+# Create a new branch from the current branch (or main)
+git checkout -b bump-cli-compat-appkit-{appkit_version}-skills-fallback-{skills_version}
+
+# Stage and commit
+git add internal/build/cli-compat.json internal/build/clicompat.go
+git commit -s -m "Bump cli-compat to appkit {appkit_version}, skills fallback {skills_version}"
+
+# Push and create PR
+git push -u origin HEAD
+gh pr create \
+  --title "Bump cli-compat to appkit {appkit_version}, skills fallback {skills_version}" \
+  --body "$(cat <<'EOF'
+## Summary
+Bump `cli-compat.json` to use:
+- AppKit `{appkit_version}`
+- Agent Skills track latest, with compiled fallback `{skills_version}`
+
+## Checklist
+- [ ] Evals passed with no regressions
+- [ ] `go test ./libs/clicompat/... -run 'Test(EmbeddedManifest|ResolveEmbeddedAgentSkillsVersion)'` passes
+EOF
+)"
+```
+
+Show the PR URL to the user when done.
+
+## Examples
+
+### Example: With explicit versions
+```
+/bump-cli-compat --appkit 0.28.0 --skills 0.1.6
+```
+Validates tags exist (including `template-v0.28.0`), updates manifest, creates PR.
+
+### Example: Auto-detect latest
+```
+/bump-cli-compat
+```
+Fetches latest tags, asks for eval confirmation, then updates and creates PR.
+
+### Example: Only bump AppKit
+```
+/bump-cli-compat --appkit 0.28.0
+```
+Auto-detects latest skills version, asks for confirmation, then updates both.
diff --git a/.agents/skills/bump-sdk/SKILL.md b/.agents/skills/bump-sdk/SKILL.md
new file mode 100644
index 00000000000..4f257c10b4b
--- /dev/null
+++ b/.agents/skills/bump-sdk/SKILL.md
@@ -0,0 +1,115 @@
+---
+name: bump-sdk
+description: "Use when bumping the databricks-sdk-go dependency, finishing an automated \"Update Go SDK to vX.Y.Z\" PR from the SDK bumper, upgrading the Go SDK, updating the .codegen/_openapi_sha spec SHA, or moving the CLI to the SDK version used by a given Terraform provider release."
+user-invocable: true
+allowed-tools: Read, Edit, Write, Bash, Glob, Grep, WebFetch, AskUserQuestion
+---
+
+# Bump the Go SDK
+
+The SDK version lives in `go.mod` (`github.com/databricks/databricks-sdk-go`) and the pinned spec SHA lives in `.codegen/_openapi_sha`.
+These two move as a pair; everything else in this skill is regenerated from them or is fallout you fix by hand.
+Do not hand-edit generated files (`.codegen/cli.json`, `cmd/workspace/*`, `cmd/account/*`, `bundle/schema/jsonschema.json`, `bundle/internal/validation/generated/*`, `bundle/direct/dresources/configs/*.generated.yml`, `python/databricks/bundles/**`); regenerate them.
+
+The Python tasks (`pydabs-*`, and the `pydabs-codegen` step inside `generate-check`) all run through `uv`. If one fails because `uv` is missing or because the host's `python3` is too old (e.g. 3.9), install `uv` (`curl -LsSf https://astral.sh/uv/install.sh | sh`) rather than touching the system Python: `uv run` provisions the interpreter each package pins (`>=3.10`, and `==3.13.*` under `python/codegen/`) and downloads it if needed. Do not chase the system Python version.
+The acceptance goldens are the exception: they need CI's `uv` index, see step 4.
+
+## The SDK bumper
+
+The SDK bumper (eng-dev-ecosystem automation) does steps 1-4 for every new stable Go SDK release.
+It opens a PR from the `automation/go-sdk-vX.Y.Z` branch of `databricks/cli`, titled `Update Go SDK to vX.Y.Z`, containing the `go get` + `go mod tidy` result, `.codegen/_openapi_sha`, `.codegen/cli.json` (genkit, followed by `./task generate-clijson-post`), and a changelog fragment without a PR link.
+`generate-clijson-post` ends with `bump-sdk-post` (step 4), whose error it ignores so that the bumper, which aborts on any error there, still opens a PR. The PR therefore carries whatever got regenerated, and stays red while the bump needs hand fixes (step 5).
+Bumper PRs opened before `generate-clijson-post` ran `bump-sdk-post` (e.g. #7138) have nothing downstream of `cli.json`: their stale command stubs usually fail to compile, which fails lint and every test job.
+The bumper does not merge CLI PRs, and it reuses an open PR for the same release on later runs, keeping commits pushed to its branch.
+
+So for a release the bumper already picked up, finish its PR instead of starting a new bump:
+
+- Find it with `gh pr list --repo databricks/cli --head automation/go-sdk-vX.Y.Z`.
+- Check its branch out in a worktree (it lives on `databricks/cli`, not a fork) and `git merge origin/main` into it: CI tests the PR merged into `main`, so the goldens must be produced against the same base.
+- Continue at step 4: rerun `./task bump-sdk-post` against the merged base and in your environment, which also shows what it failed on in the bumper.
+
+## Steps
+
+Steps 1-4 are the manual equivalent of the bumper (no bumper PR yet, a pinned version, or the version a given Terraform provider uses).
+
+**1. Resolve the target versions.**
+Use the SDK version the user gave. If they didn't specify one, look up the latest released version yourself (the newest `vX.Y.Z` tag at `https://github.com/databricks/databricks-sdk-go/tags`) instead of prompting for it.
+If they want "the version the Terraform provider vX.Y.Z uses", read the provider's `go.mod` at that tag: `https://raw.githubusercontent.com/databricks/terraform-provider-databricks/vX.Y.Z/go.mod`.
+The accompanying OpenAPI SHA is pinned inside the SDK at that tag: `https://raw.githubusercontent.com/databricks/databricks-sdk-go/vX.Y.Z/.codegen/_openapi_sha`.
+Always bump the spec SHA together with the SDK; they are expected to move as a pair.
+
+**2. Apply the core bump.**
+Run `go get github.com/databricks/databricks-sdk-go@vX.Y.Z` to update `go.mod`/`go.sum`.
+Write the new SHA with `echo ${SHA} > .codegen/_openapi_sha`; `generate` reformats the file afterward, so a trailing newline here does not matter.
+Run `go mod tidy` and confirm the `go.mod`/`go.sum` diff is the SDK line only.
+
+**3. Regenerate cli.json via genkit.**
+Run `./task generate-clijson`, which clones `$UNIVERSE_DIR` (default `$HOME/universe`) into a temporary directory and builds genkit and the OpenAPI spec at `.codegen/_openapi_sha`. If that commit is absent locally, the task fetches `master` from the Universe checkout's `origin` remote into the temporary clone.
+The task also syncs `internal/genkit/tagging.py`, its two `.lock` files, and `.github/workflows/tagging.yml` from that Universe commit; this is drift unrelated to the SDK bump.
+Decide with the user whether to keep the tagging-producer drift or restore those files to `origin/main`.
+The task ends with step 4 (`generate-clijson-post` runs `bump-sdk-post`) and ignores its error, so read the end of its output, or go on with step 4 directly.
+
+**4. Regenerate everything downstream: `./task bump-sdk-post`.**
+This is the whole mechanical part of the bump: `generate-check` (command stubs, refschema, schema, validation, direct-engine YAML, pydabs), then `test-update` for the acceptance goldens.
+Everything after it needs judgment.
+Run directly, it fails on errors: `generate-refschema` and `test-update` build the CLI, so it fails while the bump still breaks compilation; fix that (step 5) and rerun the task.
+
+Run it in CI's environment, or the goldens pick up local drift:
+- `uv` index: the acceptance tests build wheels offline from the vendored packages (`UV_OFFLINE`, `UV_FIND_LINKS`), but `uv` still reads its default index's pages from the shared cache. If a `uv.toml` (e.g. `/etc/uv/uv.toml`, which applies even under the tests' temporary `HOME`) makes an internal PyPI proxy the default index, `uv` picks versions from cached proxy pages that it cannot download offline and fails with `No solution found when resolving: hatchling`; `-update` then bakes that error into dozens of template goldens and deletes their `output/` trees. The same failure on `main` tells it apart from bump fallout. Set `UV_DEFAULT_INDEX=https://pypi.org/simple`, CI's default, for the acceptance runs only: the generators fetch tools such as `ruff` and need the proxy where `pypi.org` is unreachable. On such a machine, run the task's two halves separately: `./task generate-check`, then `UV_DEFAULT_INDEX=https://pypi.org/simple ./task test-update` (and the same prefix for `./task test` later). If `generate-clijson` already ran `test-update` without it, first revert the `acceptance/` churn (`git checkout -- acceptance`, plus any stray untracked files it left).
+- Python: CI installs the managed interpreters with `./task install-pythons`; do the same.
+- Go: the `toolchain` in `go.mod`. A newer local `go` also changes goldens and generated `gofmt` output; use `GOTOOLCHAIN=<pinned>` if they differ.
+
+Before going on, account for every changed file outside the generated set, including the bumper's (its environment is not CI's either): a bump without fallout changes `cmd/**`, `bundle/schema/jsonschema.json`, `bundle/internal/validation/generated/*`, `python/databricks/bundles/**`, `acceptance/bundle/refschema/out.fields.txt` and help-text goldens (`acceptance/help/output.txt`, `acceptance/cmd/account/account-help/output.txt`).
+Revert any golden change you can't attribute to the new SDK or spec.
+
+**5. Handle SDK breaking changes.**
+Read the SDK's `CHANGELOG.md` at the target version (in the module cache) to enumerate breaking changes before chasing compile errors.
+A removed struct field that the CLI used (e.g. `jobs.AiRuntimeTask.CodeSourcePath`) should have its usage temporarily disabled with a comment noting it returns in a later SDK bump, not deleted outright.
+A new struct field triggers an `exhaustruct` lint failure in `bundle/direct/dresources/*`. Run `./task lint` and (in case of issues) wire the field through `PrepareState` and `RemapState` when it exists on both the input and remote types.
+Where a remote is rebuilt by hand from a GET response (e.g. `makeJobRunRemote` maps `jobs.Run` into the `jobs.RunNow`-shaped `JobRunRemote`), copy the new field from the response if the response has it, and list it with the request-only zero values otherwise.
+`job_runs.yml` must list every `jobs.RunNow` field under `ignore_remote_changes`; `TestJobRunIgnoresEveryRequestField` fails on a new one.
+A field the new spec now annotates as output-only may already be emitted into `<resource_type>.generated.yml`, making the manual entry in `<resource_type>.yml` redundant; `TestResourcesYMLNoRedundantRules` catches this, so remove the manual entry.
+Rerun `./task bump-sdk-post` after the fixes.
+
+**6. VERIFY.**
+
+```bash
+go test ./acceptance -run '^TestAccept$' -timeout=60m       # MUST pass on its own
+```
+
+The verify pass is not optional.
+Many bundle tests run under an `EnvMatrix` (e.g. `DMS`, `READPLAN`).
+When a schema change makes one variant error while another succeeds, the variants produce different output; `-update` runs all of them and each overwrites the other's `output.txt`, so it can silently settle on the passing variant and report `ok` while the golden is actually wrong.
+Only the non-update run catches this.
+(Ignore `rejecting_proxy.go: blocking proxy` log lines, which are normal.
+A test that times out under full parallel load but passes when run alone is a flake, not a regression.)
+
+**7. Handle acceptance-test fallout** if the verify pass fails.
+A field that becomes required in the spec makes the CLI emit a client-side "required field ... is not set" warning wherever a test config omits it.
+For a test that legitimately sets the field, add a non-empty value; if a sibling Terraform-provider bump PR is open, reuse its exact value to avoid conflicts.
+For a test that deliberately omits the field to exercise a backend error, that test is likely now redundant with generic client-side validation, so confirm with the user and `git rm` it.
+Regenerate the affected test's `out*` files with `go test ./acceptance -run 'TestAccept/<path>' -update` (never hand-edit them), then re-run the full verify pass.
+
+**8. Verify the rest.**
+Run the full `pr-checklist` (`./task fmt`, `./task checks`, `./task lint`, `./task test`, and the pydabs suite, since `python/` changes); if `fmt` or `lint` touches `acceptance/`, a fixture is wrong, so fix the source rather than editing output.
+`./task checks` includes `check-lockfiles`, which fails if the internal PyPI proxy URL leaked into a `*uv.lock` or genkit `*.py.lock`.
+If a test fails, confirm whether it is pre-existing by reproducing it on the base commit in a throwaway worktree (`git worktree add --detach /tmp/base HEAD`) before assuming the bump caused it.
+
+**9. Changelog fragment.**
+The bumper writes `.nextchanges/dependency-updates/go-sdk-vX.Y.Z.md` as `* Update the Go SDK to [vX.Y.Z](https://github.com/databricks/databricks-sdk-go/releases/tag/vX.Y.Z).`; for a manual bump, write the same file so both read alike.
+Never reference the Terraform provider version in the changelog fragment or PR body.
+The trailing PR link is missing until the PR exists, and the `Changelog Preview` check fails until it is there: append `([#NNNN](https://github.com/databricks/cli/pull/NNNN))` after the period and commit the result.
+
+**10. Commit, push, PR.**
+If the push 403s, the active gh account lacks write access to `databricks/cli`; switch to one that has it with `gh auth switch`.
+
+For a bumper PR, commit the fixes on top of the bumper's commit and push to its branch (`git push origin HEAD:automation/go-sdk-vX.Y.Z`); do not rewrite the bumper's commit.
+The commit body lists the hand fixes, one terse bullet each.
+
+For a manual bump, follow the `pr-checklist` skill for the commit body, PR description, and changelog, and do not run `gh pr create` without the user's explicit permission.
+The bump-specific content for that template is a `## Changes` line ``Bump `github.com/databricks/databricks-sdk-go` from v{old_version} to v{version}.`` followed by one terse bullet per user-visible breaking change or new field handled.
+
+## Stacking and rebasing
+
+On any merge/rebase conflict in a generated file like `generated.go`, resolve to a compilable state and then regenerate rather than hand-merging.
+A squash-merged upstream PR leaves its original commits as non-ancestors, so the branch log may show duplicate commits even when the net diff vs `origin/main` is correct.
diff --git a/.agents/skills/bump-serverless-env-version/SKILL.md b/.agents/skills/bump-serverless-env-version/SKILL.md
new file mode 100644
index 00000000000..3fe6340ab5e
--- /dev/null
+++ b/.agents/skills/bump-serverless-env-version/SKILL.md
@@ -0,0 +1,111 @@
+---
+name: bump-serverless-env-version
+description: "Use when bumping or upgrading the default serverless environment version shipped by Databricks bundle templates, including its coupled Python and DB Connect pins."
+user-invocable: true
+allowed-tools: Read, Edit, Write, Bash, Glob, Grep, WebFetch, AskUserQuestion
+---
+
+# Bump the serverless environment version
+
+Read `.agents/rules/template-versions.md` first for compatibility and
+synchronization policy. Never hand-edit generated acceptance output.
+
+## 1. Resolve a compatible version set
+
+Use the requested environment version, or the newest published version when none
+was specified. Confirm its runtime Python version from the
+[environment release notes](https://docs.databricks.com/aws/en/release-notes/serverless/environment-version/)
+and [databricks/environments](https://github.com/databricks/environments).
+
+Apply `.agents/rules/template-versions.md` to the environment, Python, and DB
+Connect pins. Check Python compatibility in the
+[DB Connect requirements](https://docs.databricks.com/dev-tools/databricks-connect/python/index.html#requirements).
+Advance `conservative_db_connect_version_spec` when compatibility requires it or its
+DBR line has six months or less of support remaining. Use the supported-LTS table in
+the [Databricks Runtime release notes](https://docs.databricks.com/aws/en/release-notes/runtime/)
+to choose the oldest compatible replacement with more than six months of support remaining.
+Do not advance it merely to match the environment version.
+
+## 2. Update every template source
+
+Find both macro definitions and hardcoded literals; trust the search results:
+
+```bash
+grep -rn 'environment_version\|environment-version\|requires-python\|default_python_version' libs/template/templates/
+```
+
+Inspect every hit and change only values that pin a version. Re-run the command
+after editing and confirm every version-bearing template hit uses the target.
+If all sources and coupled pins already match the resolved set and the worktree has
+no partial bump, report that no changes are needed and stop.
+
+Current sources include:
+
+- `serverless_environment_version` definitions in `default/library/versions.tmpl`
+  and `dbt-sql/library/versions.tmpl`;
+- a hardcoded value in the `default-scala` job template;
+- three hardcoded values in `lakeflow-integrations`, including its
+  `--environment-version` argument.
+
+In `default/library/versions.tmpl`, update `python_version_spec` and
+`default_python_version` when the runtime Python version changes. Update
+`conservative_db_connect_version_spec` only under the compatibility and support rule
+above. Keep the version-specific compatibility comments accurate even when their pin
+is unchanged. Do not synchronize unrelated DBR or SQL-template DB Connect macros.
+
+Update version-specific examples in `.agents/rules/template-versions.md` so its
+policy remains accurate; do not change the policy itself as part of the bump.
+
+Also inspect `defaultServerlessVersion` in `libs/localenv/envkey.go`. It is the
+product-spec fallback for `databricks environments setup-local`, not a template
+pin; do not infer that it should move with the templates. Change it only when the
+user or current product specification also requires the fallback to move, and first
+confirm `python/serverless/serverless-v{N}/pyproject.toml` exists in
+`databricks/environments`. Then update default-version help, error, and test
+expectations under `libs/localenv` and `cmd/environments`; verify with
+`go test ./libs/localenv ./cmd/environments`, then update and verify with:
+
+```bash
+go test ./acceptance -run '^TestAccept/localenv' -update -timeout=60m
+go test ./acceptance -run '^TestAccept/localenv' -timeout=60m
+```
+
+Otherwise leave it unchanged and record why. Do not change the intentionally older
+SSH fixtures in `acceptance/ssh/connect-serverless-*`.
+
+## 3. Regenerate and verify goldens
+
+Update and verify the acceptance suite:
+
+```bash
+./task test-update
+go test ./acceptance -run '^TestAccept$' -timeout=60m
+```
+
+The non-update command must pass. Update mode selects covering `EnvMatrix` variants;
+the non-update run verifies every variant against the regenerated goldens.
+
+## 4. Add the changelog fragment
+
+Add `.nextchanges/bundles/serverless-environment-version-v{N}.md`. Follow the
+`pr-checklist` skill's changelog conventions. Describe a benefit stated in the
+target version's release notes, link the actual version page, and mention the DB
+Connect version only if it changed.
+
+Cross-check the final source and generated-output footprint against the prior
+template bumps in [PR #3897](https://github.com/databricks/cli/pull/3897) and
+[PR #6378](https://github.com/databricks/cli/pull/6378). Explain material
+differences in the final handoff or PR description. Prior PRs are not sources of
+truth: revalidate their compatibility decisions, wording, URLs, and file lists.
+
+## 5. Finish only when requested
+
+**Required sub-skill:** use `pr-checklist`, run its checks, and inspect the final
+diff. If formatting or linting changes generated acceptance files, fix the source
+and regenerate them.
+
+Commit, push, or create/update a PR only when the user explicitly requests that
+operation. When requested, follow `pr-checklist` rather than duplicating its commit
+and PR-body instructions here.
+
+When creating a PR for the bump, suggest `lennartkats-db` as a reviewer.
diff --git a/.agents/skills/onboard-team-area/SKILL.md b/.agents/skills/onboard-team-area/SKILL.md
new file mode 100644
index 00000000000..e24020169d4
--- /dev/null
+++ b/.agents/skills/onboard-team-area/SKILL.md
@@ -0,0 +1,59 @@
+---
+name: onboard-team-area
+description: "Use when onboarding a team, reserving an experimental area, or assigning code ownership in the Databricks CLI through native GitHub CODEOWNERS."
+user-invocable: true
+allowed-tools: Read, Edit, Write, Bash, Glob, Grep, AskUserQuestion
+---
+
+# Onboard a team / area into the CLI
+
+How ownership works here: `.github/CODEOWNERS` uses GitHub's native code-owner reviews. The last matching rule wins, and any owner on that line can approve. Include `@databricks/eng-deco-cli` on every rule so maintainers can approve changes across all areas. Team membership is maintained in GitHub.
+
+Enforcement requires "Require review from Code Owners" in the target branch's ruleset. Adding a CODEOWNERS file alone requests reviews but does not require them.
+
+## Inputs (ask if missing)
+
+- GitHub team slug, e.g. `eng-ai-custom-training`.
+- Area/dir name, e.g. `air`.
+- Experimental or stable? This decides where code lands (see the last section).
+
+## Step 1 — Identify the native GitHub team
+
+Use the team as `@databricks/<team>`. GitHub requires the team to be visible and have explicit write access to the repository for its approvals to count.
+
+Use the team slug supplied by the user when they are arranging team creation separately. Verify its access before enabling enforcement.
+
+## Step 2 — Reserve the directories
+
+Create empty `.gitkeep` placeholders so the owned paths exist before any code lands:
+
+```
+experimental/<area>/.gitkeep
+acceptance/experimental/<area>/.gitkeep
+```
+
+## Step 3 — Map the paths in `.github/CODEOWNERS`
+
+Add rules under an `# <Area>` comment. Specific rules go after the `*` maintainer catch-all and must repeat the maintainer team:
+
+```
+/experimental/<area>/             @databricks/eng-deco-cli @databricks/<team>
+/acceptance/experimental/<area>/  @databricks/eng-deco-cli @databricks/<team>
+```
+
+## Step 4 — Validate and open the PR
+
+```bash
+git diff --check
+# Repo quick checks (no Go/Python/YAML changed, so the formatters have nothing to do)
+./task checks
+```
+
+Check that the new paths exist and every new rule includes the maintainer team. Once the branch is pushed, inspect GitHub's CODEOWNERS diagnostics for invalid entries or team permissions.
+
+No `.nextchanges/` entry; this is ownership/config only. Write the PR using the `.github/PULL_REQUEST_TEMPLATE.md` sections (Why / Changes / Tests).
+
+## Experimental vs stable, and graduation
+
+- **Experimental** — code under `experimental/<area>/`, tests under `acceptance/experimental/<area>/`. Register it under the hidden parent in `cmd/experimental/experimental.go`, or top-level in `cmd/cmd.go` with `Hidden: true` (as `ssh` does). Experimental commands still ship enabled in every release; `Hidden` only removes them from `--help`, it does not gate or compile them out. No `.nextchanges/` entries while experimental. To hand a build to testers, push a `bugbash-<topic>` branch (auto-builds a snapshot) and share the `internal/bugbash/exec.sh` one-liner.
+- **Graduating to stable** — `git mv` the feature-complete commands to `cmd/<area>/` + `libs/<area>/`, register them top-level in `cmd/cmd.go`, keep the old `experimental` paths as deprecated cobra aliases (`sub.Hidden = true`, `sub.Deprecated = '...'`), add CODEOWNERS rules for the new stable paths, and add a `.nextchanges/` entry. See `experimental/aitools` graduating to top-level `aitools` (PR #4917) as the worked example.
diff --git a/.agents/skills/pr-checklist/SKILL.md b/.agents/skills/pr-checklist/SKILL.md
new file mode 100644
index 00000000000..25a20943d28
--- /dev/null
+++ b/.agents/skills/pr-checklist/SKILL.md
@@ -0,0 +1,82 @@
+---
+name: pr-checklist
+description: Checklist to run before submitting a PR
+---
+
+Before submitting a PR, run these commands to match what CI checks. CI uses the full variants (not the `-q` diff-only wrappers), so `./task lint-q` alone is insufficient.
+
+```bash
+# 1. Formatting and checks (CI runs fmt, not fmt-q)
+./task fmt
+./task checks
+
+# 2. Linting (CI runs full golangci-lint across all modules, not the diff-only wrapper)
+./task lint
+
+# 3. Tests
+./task test
+
+# 4. If you changed bundle config structs, schema, or direct-engine resource code:
+./task generate-schema
+./task generate-direct
+
+# 5. If you changed files in python/:
+./task pydabs-codegen pydabs-test pydabs-lint pydabs-docs
+
+# 6. If you changed cmd/aitools/, libs/aitools/, experimental/aitools/, or experimental/ssh/:
+./task test-exp-aitools   # only if aitools code changed (top-level or experimental)
+./task test-exp-ssh       # only if ssh code changed
+```
+
+## Final cleanup scan
+
+After the commands above pass, scrub the diff before pushing. The quick version: run `git diff @{u}` and read through what you added. Specifically:
+
+- **Debug prints**: look for newly added `fmt.Print`, `fmt.Printf`, `fmt.Println`, `log.Print`, `log.Printf`, `log.Println`, or bare `println(...)` calls. A regex that scans only added lines against your upstream branch:
+
+  ```bash
+  git diff @{u} -- '*.go' | rg '^\+.*\b(fmt|log)\.(Print|Printf|Println)\b|^\+.*\bprintln\('
+  ```
+
+  If you have no upstream yet, substitute the intended base (e.g. `origin/main`) for `@{u}`.
+- **Commented-out code**: delete it. If it's needed for reference, it lives in git history.
+- **TODOs without a ticket**: either add a ticket reference (e.g. `// TODO(DECO-1234): ...`) or remove the TODO. Un-tracked TODOs rot.
+- **Unintended files**: review `git status` and `git diff --stat` to confirm only the files you meant to change are staged.
+
+## PR description
+
+Follow `.github/PULL_REQUEST_TEMPLATE.md` exactly. Use its section headings (`## Changes`, `## Why`, `## Tests`) in the same order, and fill each one in. Do not invent new sections (`## Summary`, `## Test plan`, etc.), do not drop sections, and do not leave the HTML comment placeholders in the final body — replace them with real content. If a section genuinely does not apply (e.g. a docs-only change has no test steps), say so explicitly under that heading rather than removing it.
+
+**RULE: Be concise in the PR summary.** Overly verbose descriptions tend to be ignored by reviewers. Let the diff speak for itself and only describe at a high level what you have implemented/what components were touched.
+
+When using `gh pr create`, read `.github/PULL_REQUEST_TEMPLATE.md` first and base `--body` on it.
+
+If an agent (you) authored or substantially helped author the PR, disclose it on the last line of the body, e.g. `_This PR was written by Claude Code._` or `_PR description drafted with Claude Code._`. Be honest about the level of involvement — "written by" vs. "drafted with" vs. "reviewed by" — and keep it to a single italicized line so it doesn't crowd the template sections.
+
+## Changelog entry
+
+Add a changelog fragment under `.nextchanges/` when your change is user-visible. Each PR adds its own file, so entries never conflict between PRs. The release renders these fragments into the real `CHANGELOG.md`, so never hand-edit `CHANGELOG.md` directly.
+
+**When to add an entry:**
+- New or changed CLI command, flag, or subcommand behavior
+- User-visible change to a `databricks air` command, including preview commands (put it under `air`)
+- New or changed bundle config field, schema, or engine behavior
+- New direct dependency (annotate under `Dependency updates`)
+- Bug fix that users will notice
+
+**When to skip:**
+- Experimental commands (under `experimental/`): no entry until the feature graduates out of experimental
+- Pure refactors, internal renames, test-only changes, and doc-only changes
+- Auto-generated output changes without a corresponding user-facing change
+
+**How to add:**
+- Create `.nextchanges/<section>/<name>.md`, picking the section folder that fits: `cli`, `air`, `bundles`, `dependency-updates`, `notable-changes`, or `api-changes`. `<name>` is arbitrary (a feature name or your PR number) — just keep it unique.
+- Write a single line in user-facing language, no Jira links: start it with a `* ` bullet marker and end it with a period.
+- **Voice and tense: imperative mood, active voice.** Lead with a verb that names the change — `Add`, `Fix`, `Bump`, `Remove`, `Deprecate`, `Support`, `Reject`, `Warn` — and describe the user-facing effect, not the implementation. Never use past tense (`Added`/`Fixed`) or first person (`we`/`I`/`our`). When a change reads better as a resulting behavior than as a verb, lead with the affected command, flag, or field in the present tense with "now".
+  - GOOD: Add support for the `cluster_policies` resource type.
+  - GOOD: Fix `--force-lock` being ignored when set in `databricks.yml`.
+  - GOOD: `bundle plan` now ignores the output-only `securable_kind` field during drift detection.
+  - BAD: Added support for cluster policies. — past tense; write "Add".
+  - BAD: We now reject secret scopes that name no principal. — first person; write "Reject secret scopes that name no principal."
+- A trailing PR link is required whenever the change is associated with a PR, and the introducing PR must be among the linked ones (the checker infers it and fails if it's missing) — enforced in CI (every PR and `main`) and locally once your branch has an open PR. Write the full markdown link at the very end, after the period: `([#NNNN](https://github.com/databricks/cli/pull/NNNN))` (your PR number). For an entry spanning several PRs, list them comma-separated: `([#NNNN](…), [#MMMM](…))`. Every `#NNNN` reference must be a full markdown link — a bare or paren-wrapped `#NNNN` is rejected.
+- See `.nextchanges/README.md` for details.
diff --git a/.claude/rules b/.claude/rules
index dc4007369dd..2d5c9a97a7a 120000
--- a/.claude/rules
+++ b/.claude/rules
@@ -1 +1 @@
-../.agent/rules
\ No newline at end of file
+../.agents/rules
\ No newline at end of file
diff --git a/.claude/skills b/.claude/skills
index 9b058317d13..2b7a412b8fa 120000
--- a/.claude/skills
+++ b/.claude/skills
@@ -1 +1 @@
-../.agent/skills
\ No newline at end of file
+../.agents/skills
\ No newline at end of file
diff --git a/.codegen.json b/.codegen.json
index e2a84cb8c14..990e248ed56 100644
--- a/.codegen.json
+++ b/.codegen.json
@@ -1,6 +1,5 @@
 {
-    "mode": "cli_v0",
-    "api_changelog": true,
+    "mode": "cli_v1",
     "formatter": "go run golang.org/x/tools/cmd/goimports@latest -w $FILENAMES && go fmt ./...",
     "version": {
         "python/README.md": "version $VERSION or above",
@@ -9,6 +8,14 @@
         "python/uv.lock": "name = \"databricks-bundles\"\nversion = \"$VERSION\"",
         "libs/template/templates/default/library/versions.tmpl": "{{define \"latest_databricks_bundles_version\" -}}$VERSION{{- end}}"
     },
+    "nextchanges_sections": {
+        "notable-changes": "Notable Changes",
+        "cli": "CLI",
+        "air": "AI Runtime",
+        "bundles": "Bundles",
+        "dependency-updates": "Dependency Updates",
+        "api-changes": "API Changes"
+    },
     "toolchain": {
         "required": [
             "go"
diff --git a/.codegen/.gitattributes b/.codegen/.gitattributes
new file mode 100644
index 00000000000..00da4383df4
--- /dev/null
+++ b/.codegen/.gitattributes
@@ -0,0 +1 @@
+cli.json linguist-generated=true
diff --git a/.codegen/_openapi_sha b/.codegen/_openapi_sha
index 15378345074..165042179b5 100644
--- a/.codegen/_openapi_sha
+++ b/.codegen/_openapi_sha
@@ -1 +1 @@
-11ae6f9d98f0d0838a5e53c27032f178fecc4ee0
\ No newline at end of file
+1603cd4e00e208260dc36be11f5ba9822ff73360
\ No newline at end of file
diff --git a/.codegen/cli.json b/.codegen/cli.json
new file mode 100644
index 00000000000..372ab22fee1
--- /dev/null
+++ b/.codegen/cli.json
@@ -0,0 +1,237208 @@
+{
+  "schemas": {
+    "agentbricks.CancelCustomLlmOptimizationRunRequest": {},
+    "agentbricks.CreateCustomLlmRequest": {
+      "fields": {
+        "agent_artifact_path": {
+          "description": "This will soon be deprecated!!\nOptional: UC path for agent artifacts. If you are using a dataset that you only have read permissions,\nplease provide a destination path where you have write permissions. Please provide this in catalog.schema format.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "datasets": {
+          "description": "Datasets used for training and evaluating the model, not for inference.\nCurrently, only 1 dataset is accepted.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "guidelines": {
+          "description": "Guidelines for the custom LLM to adhere to",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "instructions": {
+          "description": "Instructions for the custom LLM to follow",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "name": {
+          "description": "Name of the custom LLM. Only alphanumeric characters and dashes allowed.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "agentbricks.CustomLlm": {
+      "fields": {
+        "agent_artifact_path": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "creation_time": {
+          "description": "Creation timestamp of the custom LLM",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "creator": {
+          "description": "Creator of the custom LLM",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "datasets": {
+          "description": "Datasets used for training and evaluating the model, not for inference",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "endpoint_name": {
+          "description": "Name of the endpoint that will be used to serve the custom LLM",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "guidelines": {
+          "description": "Guidelines for the custom LLM to adhere to",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "id": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "instructions": {
+          "description": "Instructions for the custom LLM to follow",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "name": {
+          "description": "Name of the custom LLM",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "optimization_state": {
+          "description": "If optimization is kicked off, tracks the state of the custom LLM",
+          "ref": "agentbricks.State",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "agentbricks.Dataset": {
+      "fields": {
+        "table": {
+          "ref": "agentbricks.Table",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "agentbricks.DeleteCustomLlmRequest": {},
+    "agentbricks.GetCustomLlmRequest": {},
+    "agentbricks.StartCustomLlmOptimizationRunRequest": {},
+    "agentbricks.State": {
+      "description": "States of Custom LLM optimization lifecycle.",
+      "enum": [
+        "CREATED",
+        "RUNNING",
+        "COMPLETED",
+        "FAILED",
+        "PENDING",
+        "CANCELLED"
+      ],
+      "enum_launch_stages": {
+        "CANCELLED": "PRIVATE_PREVIEW",
+        "COMPLETED": "PRIVATE_PREVIEW",
+        "CREATED": "PRIVATE_PREVIEW",
+        "FAILED": "PRIVATE_PREVIEW",
+        "PENDING": "PRIVATE_PREVIEW",
+        "RUNNING": "PRIVATE_PREVIEW"
+      }
+    },
+    "agentbricks.Table": {
+      "fields": {
+        "request_col": {
+          "description": "Name of the request column",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "response_col": {
+          "description": "Optional: Name of the response column if the data is labeled",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "table_path": {
+          "description": "Full UC table path in catalog.schema.table_name format",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "agentbricks.UpdateCustomLlmRequest": {
+      "fields": {
+        "custom_llm": {
+          "description": "The CustomLlm containing the fields which should be updated.",
+          "ref": "agentbricks.CustomLlm",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "update_mask": {
+          "description": "The list of the CustomLlm fields to update. These should correspond to the values (or lack thereof) present in `custom_llm`.\n\nThe field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "agentkit.AppendSessionItemsRequest": {
+      "description": "Request to append items to a session.",
+      "fields": {
+        "items": {
+          "description": "Items to append atomically in request order. Concurrent append requests are serialized into one\ncommitted order without exposing a numeric sequence in the public contract.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "agentkit.AppendSessionItemsResponse": {
+      "description": "Response containing appended items.",
+      "fields": {
+        "session_items": {
+          "description": "Persisted session items with service-assigned fields.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "agentkit.ClearSessionItemsRequest": {
+      "description": "Request to clear all items from a session."
+    },
+    "agentkit.ClearSessionItemsResponse": {
+      "description": "Response from clearing items from a session."
+    },
+    "agentkit.CreateManagedMemoryEntryRequest": {
+      "fields": {
+        "managed_memory_entry": {
+          "description": "The memory entry to create.",
+          "ref": "agentkit.ManagedMemoryEntry",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "managed_memory_entry_id": {
+          "description": "Optional caller-selected memory entry ID. The service generates an ID when omitted.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "agentkit.CreateManagedMemoryStoreRequest": {
+      "fields": {
+        "managed_memory_store": {
+          "description": "The memory store to create.",
+          "ref": "agentkit.ManagedMemoryStore",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "managed_memory_store_id": {
+          "description": "Caller-provided, workspace-unique memory store ID. It must be 3-56 characters, begin\nwith a lowercase letter, contain only lowercase letters, digits, and hyphens, and end with a\nletter or digit.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "agentkit.CreateSessionRequest": {
+      "fields": {
+        "session": {
+          "description": "The session to create. `actor_id` is required. A session with `parent_session_id` is a child and\nmust use its parent's `actor_id`. Independent forks are created only through `ForkSession`.",
+          "ref": "agentkit.Session",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "session_id": {
+          "description": "Optional caller-selected session ID. The service generates a UUID when this field is omitted.\nThe ID must be unique; a collision returns `ALREADY_EXISTS`.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "agentkit.CreateSessionStoreRequest": {
+      "fields": {
+        "session_store": {
+          "description": "The session store to create.",
+          "ref": "agentkit.SessionStore",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "session_store_id": {
+          "description": "Caller-provided, workspace-unique session store ID. It must be 3-55 characters, begin with a\nlowercase letter, and contain only lowercase letters, digits, and hyphens.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "agentkit.DeleteManagedMemoryEntryRequest": {},
+    "agentkit.DeleteManagedMemoryStoreRequest": {},
+    "agentkit.DeleteSessionRequest": {},
+    "agentkit.DeleteSessionStoreRequest": {},
+    "agentkit.ExtractMemoriesRequest": {
+      "description": "Request to synchronously extract memories from a single session.",
+      "fields": {
+        "dry_run": {
+          "description": "When true, extract and return the entries without writing them to the memory store. Defaults\nto false, which persists the extracted entries and returns them.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "instructions": {
+          "description": "Instructions steering what is extracted from the session.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "memory_store": {
+          "description": "Memory store the extracted entries are written to, in the form\n`memory-stores/{managed_memory_store_id}`.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "agentkit.ExtractMemoriesResponse": {
+      "description": "Result of a single-session memory extraction.",
+      "fields": {
+        "entries": {
+          "description": "The memory entries written by this extraction.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "Correlation identifier for this extraction, for logging and tracing. Not a fetchable resource.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "agentkit.ForkSessionRequest": {
+      "description": "Request to fork a session.",
+      "fields": {
+        "actor_id": {
+          "description": "Opaque caller-provided identifier for the application actor associated with the forked session.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "metadata": {
+          "description": "Optional metadata for the fork.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "session_id": {
+          "description": "Optional unique ID for the forked session. A collision returns `ALREADY_EXISTS`.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "source_session_id": {
+          "description": "ID of the session to copy.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "up_to_item_id": {
+          "description": "Optional last item ID to copy through, inclusively. When omitted, the fork atomically copies\nall items committed before the fork operation begins.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "agentkit.ForkSessionResponse": {
+      "description": "Response from forking a session.",
+      "fields": {
+        "session": {
+          "description": "The newly-created independent top-level session.",
+          "ref": "agentkit.Session",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "agentkit.GetManagedMemoryEntryRequest": {
+      "fields": {
+        "view": {
+          "description": "Controls whether the response includes memory content. Defaults to `FULL`.",
+          "ref": "agentkit.ManagedMemoryEntryView",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "agentkit.GetManagedMemoryStoreRequest": {},
+    "agentkit.GetSessionRequest": {},
+    "agentkit.GetSessionStoreRequest": {},
+    "agentkit.ListManagedMemoryEntriesRequest": {
+      "fields": {
+        "actor_id": {
+          "description": "Customer-provided identifier for the actor whose entries are listed.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "page_size": {
+          "description": "Maximum number of entries to return. The service may return fewer entries than requested.\nDefaults to 10; must be between 1 and 100.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Opaque pagination token from a previous ListManagedMemoryEntries response.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "path_prefix": {
+          "description": "Optional path prefix used to restrict entries within the actor partition.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "session_id": {
+          "description": "Optional session identifier. When set, only entries with this exact `session_id` are\nreturned. Omitted-session (cross-session) entries are not included. Ignored when path is set.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "view": {
+          "description": "Controls whether each returned entry includes memory content. Defaults to `FULL`.",
+          "ref": "agentkit.ManagedMemoryEntryView",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "agentkit.ListManagedMemoryEntriesResponse": {
+      "description": "Response containing memory entries.",
+      "fields": {
+        "managed_memory_entries": {
+          "description": "Memory entries matching the request and selected response view.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "next_page_token": {
+          "description": "Opaque pagination token. This field is omitted when there are no more results.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "agentkit.ListManagedMemoryStoresRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Maximum number of stores to return. The service may return fewer stores than requested.\nDefaults to 10; must be between 1 and 100.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Opaque pagination token from a previous ListManagedMemoryStores response.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "agentkit.ListManagedMemoryStoresResponse": {
+      "description": "Response containing memory stores in the caller's workspace.",
+      "fields": {
+        "managed_memory_stores": {
+          "description": "Memory stores in the caller's workspace.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "next_page_token": {
+          "description": "Opaque pagination token. This field is omitted when there are no more results.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "agentkit.ListSessionItemsRequest": {
+      "fields": {
+        "order_by": {
+          "description": "Sort order. Supported values are `create_time asc` and `create_time desc`. The default is\n`create_time desc`, which returns the most recently appended items first. Equal timestamps are\nresolved by committed append order in the requested direction.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_size": {
+          "description": "Maximum number of items to return. Defaults to 10; must be between 1 and 100.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Token returned by a previous list request.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "agentkit.ListSessionItemsResponse": {
+      "description": "Response containing a page of session items.",
+      "fields": {
+        "next_page_token": {
+          "description": "Token to retrieve the next page.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "session_items": {
+          "description": "Session items in the requested page.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "agentkit.ListSessionStoresRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Maximum number of session stores to return. Defaults to 10; must be between 1 and 100.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Token returned by a previous list request.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "agentkit.ListSessionStoresResponse": {
+      "description": "Response containing a page of session stores.",
+      "fields": {
+        "next_page_token": {
+          "description": "Token to retrieve the next page.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "session_stores": {
+          "description": "Session stores in the requested page.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "agentkit.ListSessionsRequest": {
+      "fields": {
+        "filter": {
+          "description": "Filter expression. Supported fields include `actor_id` and `metadata`; for example,\n`actor_id = \"support-customer-123\"`.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "order_by": {
+          "description": "Sort order. Defaults to `last_activity_time desc`. Page-token continuation is exactly-once when\nordering by `create_time` (immutable); ordering by `last_activity_time` is best-effort, because\nthat value changes as a session gains activity, so a session updated between page requests may\nbe repeated or skipped. To enumerate every session exactly once, order by `create_time`.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_size": {
+          "description": "Maximum number of sessions to return. Defaults to 10; must be between 1 and 100.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Token returned by a previous list request.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "agentkit.ListSessionsResponse": {
+      "description": "Response containing a page of sessions.",
+      "fields": {
+        "next_page_token": {
+          "description": "Token to retrieve the next page.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "sessions": {
+          "description": "Sessions in the requested page.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "agentkit.ManagedMemoryEntry": {
+      "description": "A workspace-scoped entry in a memory store.",
+      "fields": {
+        "actor_id": {
+          "description": "Customer-provided identifier for the actor whose memory this entry represents.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "content": {
+          "description": "Optional free-form memory content.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "create_time": {
+          "description": "Time when the entry was created.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "description": {
+          "description": "Human-readable description of the memory entry.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "name": {
+          "description": "Resource name in the form\n`memory-stores/{managed_memory_store_id}/entries/{managed_memory_entry_id}`.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "path": {
+          "description": "Absolute, case-sensitive path identifying the entry within its actor and optional session.\nPaths must begin with `/` and must not contain empty, `.` or `..` segments.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "session_id": {
+          "description": "Optional identifier for the session associated with this memory entry. When omitted, the\nentry applies across the actor's sessions.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "IMMUTABLE",
+            "OPTIONAL"
+          ]
+        },
+        "source_type": {
+          "description": "Which writer created this entry. Caller sets this on Create; immutable after creation.",
+          "ref": "agentkit.ManagedMemoryEntrySourceType",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "IMMUTABLE",
+            "OPTIONAL"
+          ]
+        },
+        "update_time": {
+          "description": "Time when the entry was last updated.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "agentkit.ManagedMemoryEntrySearchResult": {
+      "description": "One relevance-ranked memory search result.",
+      "fields": {
+        "managed_memory_entry": {
+          "description": "Memory entry matching the query.",
+          "ref": "agentkit.ManagedMemoryEntry",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "score": {
+          "description": "Relevance score for the result. Higher scores are more relevant.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "agentkit.ManagedMemoryEntrySourceType": {
+      "description": "Identifies the source that created a memory entry.",
+      "enum": [
+        "MANAGED_MEMORY_ENTRY_SOURCE_TYPE_AGENT",
+        "MANAGED_MEMORY_ENTRY_SOURCE_TYPE_DREAMER"
+      ],
+      "enum_launch_stages": {
+        "MANAGED_MEMORY_ENTRY_SOURCE_TYPE_AGENT": "PUBLIC_BETA",
+        "MANAGED_MEMORY_ENTRY_SOURCE_TYPE_DREAMER": "PUBLIC_BETA"
+      }
+    },
+    "agentkit.ManagedMemoryEntryView": {
+      "description": "Controls how much memory entry data is returned.",
+      "enum": [
+        "MANAGED_MEMORY_ENTRY_VIEW_BASIC",
+        "MANAGED_MEMORY_ENTRY_VIEW_FULL"
+      ],
+      "enum_launch_stages": {
+        "MANAGED_MEMORY_ENTRY_VIEW_BASIC": "PRIVATE_PREVIEW",
+        "MANAGED_MEMORY_ENTRY_VIEW_FULL": "PRIVATE_PREVIEW"
+      }
+    },
+    "agentkit.ManagedMemoryStore": {
+      "description": "A workspace-scoped memory store backed by service-managed storage.",
+      "fields": {
+        "create_time": {
+          "description": "Time when the store was created.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "creator_user_id": {
+          "description": "Workspace-local user ID of the authenticated principal that created the store. This is\nimmutable server-set attribution and does not grant access; authorization is evaluated from\nthe authenticated request context.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "description": {
+          "description": "Human-readable description of the memory store.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "display_name": {
+          "description": "Deprecated compatibility alias for the caller-provided memory store ID. Canonical\nclients provide the ID through `CreateMemoryStoreRequest.managed_memory_store_id` and use\n`name` as the resource identifier.",
+          "deprecated": true,
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "IMMUTABLE",
+            "OPTIONAL"
+          ]
+        },
+        "name": {
+          "description": "Resource name in the form `memory-stores/{managed_memory_store_id}`.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "owner_user_id": {
+          "description": "Deprecated alias for `creator_user_id`. This identifies the original creator, not a\ntransferable owner. Use `creator_user_id` instead.",
+          "deprecated": true,
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "storage_backend": {
+          "description": "Service-managed storage backing this memory store.",
+          "ref": "agentkit.StorageBackend",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "update_time": {
+          "description": "Time when the store was last updated.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "workspace_id": {
+          "description": "Workspace that owns the memory store.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "agentkit.PopSessionItemRequest": {
+      "description": "Request to pop an item from a session."
+    },
+    "agentkit.PopSessionItemResponse": {
+      "description": "Response containing the popped item.",
+      "fields": {
+        "item": {
+          "description": "Removed item, if any.",
+          "ref": "agentkit.SessionItem",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "agentkit.SearchManagedMemoryEntriesRequest": {
+      "description": "Request to search memory entries by text query for one actor.\nSearch returns a relevance-ranked top-N result set and does not currently paginate.",
+      "fields": {
+        "actor_id": {
+          "description": "Customer-provided identifier for the actor whose entries are searched.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "limit": {
+          "description": "Deprecated alias for `page_size`. When both fields are set, their values must match.",
+          "deprecated": true,
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_size": {
+          "description": "Maximum number of relevance-ranked entries to return. Defaults to 10 and must be between 1 and\n100.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Reserved for pagination compatibility. The server currently ignores this field because Search\nreturns a ranked top-N result set.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "path_prefix": {
+          "description": "Optional absolute, case-sensitive path prefix used to restrict searched entries within the\nactor partition. The prefix must begin with `/` and must not contain empty, `.` or `..`\nsegments.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "query": {
+          "description": "Free-form search query.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "session_id": {
+          "description": "Optional session identifier. When set, only entries with this exact `session_id` are\nsearched. Omitted-session (cross-session) entries are not included.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "view": {
+          "description": "Controls whether each returned entry includes memory content. Search scores are always\nreturned. Defaults to `FULL`.",
+          "ref": "agentkit.ManagedMemoryEntryView",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "agentkit.SearchManagedMemoryEntriesResponse": {
+      "description": "Response containing memory entries ranked by relevance.",
+      "fields": {
+        "managed_memory_entries": {
+          "description": "Deprecated compatibility alias for clients migrating to `results`. This contains the same\nentries in the same order, but omits their relevance scores.",
+          "deprecated": true,
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "next_page_token": {
+          "description": "Opaque pagination token. Search currently returns an unpaginated ranked top-N result set, so\nthe server does not populate this field.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "results": {
+          "description": "Canonical matching entries and relevance scores, ordered most relevant first.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "agentkit.Session": {
+      "description": "A durable logical interaction stored within a Session Store.",
+      "fields": {
+        "actor_id": {
+          "description": "Opaque caller-provided identifier for the application actor associated with the session.\n\nThis is application data and has no Databricks authentication or authorization semantics.\nUse the same value as the Managed Memory Entry `actor_id` when storing memories associated\nwith this actor. Every session must set it. A child session must use the same value as its parent.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "create_time": {
+          "description": "Time when the session was created.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "last_activity_time": {
+          "description": "Time when the session's item history was last mutated.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "metadata": {
+          "description": "Mutable caller-defined string labels.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "name": {
+          "description": "Resource name in the form `session-stores/{session_store_id}/sessions/{session_id}`.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "parent_session_id": {
+          "description": "Immediate parent session ID. Set only at creation for child sessions, immutable thereafter, and\nrestricted to the same store.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "IMMUTABLE",
+            "OPTIONAL"
+          ]
+        },
+        "root_session_id": {
+          "description": "Top-level session ID in the spawn tree. This equals `session_id` for a root or fork and is\ninherited transitively by child sessions.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "session_id": {
+          "description": "Unique session ID. The service generates a UUID unless the caller supplies\n`CreateSessionRequest.session_id`.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "update_time": {
+          "description": "Time when session resource fields last changed.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "agentkit.SessionItem": {
+      "description": "A transcript entry in a session's history.",
+      "fields": {
+        "create_time": {
+          "description": "Server-assigned time when the append commits. Values are nondecreasing within a session. Item\nlisting orders by this timestamp; equal timestamps are resolved by committed append order.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "data": {
+          "description": "Complete SDK-native, JSON-compatible item. The service stores and returns this value without\ninterpreting provider-specific fields such as `type`, `role`, or `content`.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "item_id": {
+          "description": "Stable service-generated item ID.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "agentkit.SessionStore": {
+      "description": "A workspace-scoped session store.",
+      "fields": {
+        "create_time": {
+          "description": "Time when the store was created.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "creator_user_id": {
+          "description": "Workspace-local user ID of the authenticated principal that created the store. This is\nimmutable server-set attribution and does not grant access; authorization is evaluated from\nthe authenticated request context.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "description": {
+          "description": "Human-readable description of the session store.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "metadata": {
+          "description": "Mutable caller-defined string labels.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "name": {
+          "description": "Resource name in the form `session-stores/{session_store_id}`.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "update_time": {
+          "description": "Time when the store was last updated.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "agentkit.StorageBackend": {
+      "description": "Service-managed storage backing a memory store.",
+      "fields": {
+        "backend_id": {
+          "description": "Backend-specific identifier. For Lakebase, this is the project ID.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "backend_type": {
+          "description": "Type of the storage backend.",
+          "ref": "agentkit.StorageBackendType",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "agentkit.StorageBackendType": {
+      "description": "Type of service-managed storage backing a memory store.",
+      "enum": [
+        "STORAGE_BACKEND_TYPE_LAKEBASE"
+      ],
+      "enum_launch_stages": {
+        "STORAGE_BACKEND_TYPE_LAKEBASE": "PUBLIC_BETA"
+      }
+    },
+    "agentkit.UpdateManagedMemoryEntryRequest": {
+      "fields": {
+        "managed_memory_entry": {
+          "description": "The memory entry to update.",
+          "ref": "agentkit.ManagedMemoryEntry",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "update_mask": {
+          "description": "Fields to update. Only `content` and `description` may be updated.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "agentkit.UpdateManagedMemoryStoreRequest": {
+      "fields": {
+        "managed_memory_store": {
+          "description": "The memory store to update. `name` is taken from the URL.",
+          "ref": "agentkit.ManagedMemoryStore",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "update_mask": {
+          "description": "Only `description` and `metadata` may be updated. Selecting `metadata` replaces the entire map.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "agentkit.UpdateSessionRequest": {
+      "fields": {
+        "session": {
+          "description": "Session to update.",
+          "ref": "agentkit.Session",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "update_mask": {
+          "description": "Fields to update. Only `metadata` is mutable; any other path returns\n`INVALID_PARAMETER_VALUE`.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "agentkit.UpdateSessionStoreRequest": {
+      "fields": {
+        "session_store": {
+          "description": "Session store to update.",
+          "ref": "agentkit.SessionStore",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "update_mask": {
+          "description": "Fields to update. Only `description` and `metadata` are mutable; any other\npath returns `INVALID_PARAMETER_VALUE`.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "aifunctions.AiClassifyOptions": {
+      "description": "ai_classify",
+      "fields": {
+        "enable_confidence_scores": {
+          "description": "When true, includes a per-label confidence score in the response.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "enable_rationales": {
+          "description": "When true, includes a rationale explaining each classification in the response.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "instructions": {
+          "description": "Natural-language guidance that steers how the text is classified (up to 20,000 characters).",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "multilabel": {
+          "description": "When true, allows more than one label to be returned per input.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "version": {
+          "description": "The function version to invoke. Defaults to the latest version. Supported versions: [\"2.1\"].",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "aifunctions.AiClassifyRequest": {
+      "fields": {
+        "content": {
+          "description": "The content to classify. It accepts a plain string or the response object of [ai_parse_document](:method:AiFunctions/AiParseDocument).",
+          "launch_stage": "GA"
+        },
+        "labels": {
+          "description": "The label set to classify as. Either a JSON array of label strings (e.g. [\"spam\", \"not_spam\"]), or a JSON object mapping each label to a description (e.g. {\"spam\": \"unsolicited bulk message\", \"not_spam\": \"a legitimate message\"}). Accepts 2 to 500 labels, each 1 to 100 characters.",
+          "launch_stage": "GA"
+        },
+        "options": {
+          "description": "Function options. Omitted fields fall back to their documented defaults.",
+          "ref": "aifunctions.AiClassifyOptions",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "aifunctions.AiClassifyResponse": {
+      "fields": {
+        "metadata": {
+          "description": "Additional metadata returned by AI Classify.",
+          "ref": "aifunctions.AiClassifyResponseMetadata",
+          "launch_stage": "GA"
+        },
+        "response": {
+          "description": "The function result as a JSON value. An array of per-label objects: one element in single-label mode (the default), or multiple elements when `multilabel` is true. When `enable_confidence_scores` and `enable_rationales` are true, `confidence_score` and `rationale` are included in each response value, respectively.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "aifunctions.AiClassifyResponseMetadata": {
+      "fields": {
+        "version": {
+          "description": "The resolved function version.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "aifunctions.AiDecideOptions": {
+      "description": "ai_decide",
+      "fields": {
+        "version": {
+          "description": "The function API version to invoke. Defaults to \"1.0\". Supported versions: [\"1.0\"].",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "aifunctions.AiDecideRequest": {
+      "fields": {
+        "options": {
+          "description": "Function options. Omitted fields fall back to their documented defaults.",
+          "ref": "aifunctions.AiDecideOptions",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "questions": {
+          "description": "A JSON object mapping question IDs to their definitions. Each ID must contain non-whitespace text; its answer is returned with the same ID in `response.answers`.\n\nEach definition is an object with the required fields `type` and `instructions`. The `criteria` field is optional for the type `noul` but is required for the types `choice` and `score`.\n\nThe `instructions` field describes the judgment to make and can be a string, object, or array. Use an object or array to include supporting context alongside the instructions.\n\nThe `type` can be one of:\n\n- `choice`: Selects one option from a defined set. Requires `criteria` to be an object mapping 1 to 255 nonempty option names to descriptions. The criteria description can be a string, object, array, or null when the name needs no additional detail. For example:\n\n```json\n{\n\"team\": {\n\"type\": \"choice\",\n\"instructions\": \"Which team should handle this ticket?\",\n\"criteria\": {\n\"billing\": \"Payments, charges, and refunds\",\n\"technical_support\": null\n}\n}\n}\n```\n\n- `noul`: Estimates the probability that the answer to a true-or-false question is true. `criteria` can take the fields `true` or `false`, or both, with descriptions that are strings, objects, or arrays. Omit `criteria` to use the question alone. The instructions or at least one criteria description must contain non-whitespace text, a nonempty object, or a nonempty array. For example, both of the following are valid:\n\n```json\n{\n\"escalate\": {\n\"type\": \"noul\",\n\"instructions\": \"Does this ticket need escalation?\",\n\"criteria\": {\n\"true\": \"Suspected fraud or an exception to standard policy\",\n\"false\": \"A routine issue frontline support can resolve\"\n}\n}\n}\n```\n\nor\n\n```json\n{\n\"escalate\": {\n\"type\": \"noul\",\n\"instructions\": \"Does this ticket need escalation?\"\n}\n}\n```\n\n- `score`: Rates the state on an ordered scale. Requires `criteria` to be an array of 2 to 10 level descriptions, ordered from low to high. Descriptions must contain non-whitespace text, a nonempty object, or a nonempty array. Array positions define levels starting at 0. For example:\n\n```json\n{\n\"urgency\": {\n\"type\": \"score\",\n\"instructions\": \"How urgent is this ticket?\",\n\"criteria\": [\n\"Routine: can wait a few days\",\n\"Time-sensitive: needs attention today\",\n\"Critical: needs immediate action\"\n]\n}\n}\n```",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "state": {
+          "description": "A string, JSON object, or array containing the content, related context, and examples needed to answer the provided questions. For example, provide a support message, a conversation, or records describing the current state of an application. All questions receive this same state.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "aifunctions.AiDecideResponse": {
+      "fields": {
+        "metadata": {
+          "description": "Metadata identifying the function API version used for this request.",
+          "ref": "aifunctions.AiDecideResponseMetadata",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "response": {
+          "description": "A JSON object containing an `answers` map with one answer for each question, keyed by the same IDs as `questions`.\n\nEach answer has a `type` matching its question and the following fields:\n\n- `choice`: choice is the highest-probability option from `criteria`. `probabilities` maps every option name to its probability. `confidence` is a number from 0 to 1 indicating how well the state supports the assessment. The `probabilities` values sum to 1. For example:\n\n```json\n{\n\"answers\": {\n\"team\": {\n\"type\": \"choice\",\n\"choice\": \"billing\",\n\"probabilities\": {\n\"billing\": 0.85,\n\"technical_support\": 0.15\n},\n\"confidence\": 0.9\n}\n}\n}\n```\n\n- `noul`: `probability` is a number from 0 to 1 estimating the probability that the answer is true. For example:\n\n```json\n{\n\"answers\": {\n\"escalate\": {\n\"type\": \"noul\",\n\"probability\": 0.8\n}\n}\n}\n```\n\n- `score`: score is the probability-weighted mean of the zero-based level indices. It can fall between levels, from 0 to the number of levels minus 1. `probabilities` maps each level index to its probability, and `legend` maps each index to its original description. Both maps use string keys such as \"0\", \"1\", and \"2\". `confidence` is a number from 0 to 1 indicating how well the state supports the assessment. The `probabilities` values sum to 1. For example:\n\n```json\n{\n\"answers\": {\n\"urgency\": {\n\"type\": \"score\",\n\"score\": 1.6,\n\"probabilities\": {\n\"0\": 0.1,\n\"1\": 0.2,\n\"2\": 0.7\n},\n\"legend\": {\n\"0\": \"Routine: can wait a few days\",\n\"1\": \"Time-sensitive: needs attention today\",\n\"2\": \"Critical: needs immediate action\"\n},\n\"confidence\": 0.85\n}\n}\n}\n```",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "aifunctions.AiDecideResponseMetadata": {
+      "fields": {
+        "version": {
+          "description": "The function API version used to evaluate the request.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "aifunctions.AiExtractBbox": {
+      "description": "A bounding box on a source page; used by bbox-input citations.",
+      "fields": {
+        "coord": {
+          "description": "Pixel coordinates on the page image as [x0, y0, x1, y1].",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_id": {
+          "description": "0-based page index the box is on.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "aifunctions.AiExtractCitation": {
+      "description": "A citation locating an extracted value in the source. start/stop are set for span (STRING input) citations, bbox for bbox (parsed-document input) citations.",
+      "fields": {
+        "bbox": {
+          "description": "Bounding boxes locating the citation on the source pages; set for bbox citations.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "id": {
+          "description": "Integer matching a citation_ids entry on an extracted field.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "start": {
+          "description": "Inclusive 0-based character offset into the input string; set for span citations.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "stop": {
+          "description": "Exclusive 0-based character offset into the input string; set for span citations.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "aifunctions.AiExtractOptions": {
+      "description": "ai_extract",
+      "fields": {
+        "enable_citations": {
+          "description": "When true, includes citation metadata locating each extracted value in the source. Depending on the type of input, citations can be one of two types:\n\nFor raw text (STRING) inputs, a citation is a span of text in the original input. Each object in `metadata.citations` has an `id` (integer matching a `citation_ids` entry on a field), a `start` (inclusive 0-based character offset into the input string), and a `stop` (exclusive 0-based character offset into the input string).\n\nFor PDF documents and images (when using ai_extract downstream of ai_parse_document), a citation is a bounding box in the original input. Each object in `metadata.citations` has an `id` (integer matching a `citation_ids` entry on a field) and a `bbox` (array of {coord, page_id} objects, identical in shape to element.bbox in ai_parse_document output; coord is pixel coordinates on the page image as [x0, y0, x1, y1], and page_id is a 0-based page index).",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "enable_confidence_scores": {
+          "description": "When true, includes a per-field confidence score in the response.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "instructions": {
+          "description": "Natural-language guidance that steers how data is extracted (up to 20,000 characters).",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "mode": {
+          "description": "Extraction mode. Supported modes: \"precision\" — more powerful extraction for complex schemas, long documents, and reasoning-heavy extractions. Defaults to none (standard extraction).",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "version": {
+          "description": "The function version to invoke. Defaults to the latest version. Supported versions: [\"2.1\"].",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "aifunctions.AiExtractRequest": {
+      "fields": {
+        "content": {
+          "description": "The text to extract from. It accepts a plain string or the response object of [ai_parse_document](:method:AiFunctions/AiParseDocument).",
+          "launch_stage": "GA"
+        },
+        "options": {
+          "description": "Function options. Omitted fields fall back to their documented defaults.",
+          "ref": "aifunctions.AiExtractOptions",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "schema": {
+          "description": "The extraction schema defining the fields to extract. Either a JSON array of field names, assumed to be strings (e.g. [\"company\", \"valuation\"]), or a JSON object mapping each field to its type/description/nullability (e.g. {\"company\": {\"type\": \"string\", \"description\": \"the company name\"}}). Accepts up to 256 fields, 12 levels of nesting, and 500 enum values. Supported field types are string, integer, number, boolean, and enum.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "aifunctions.AiExtractResponse": {
+      "fields": {
+        "metadata": {
+          "description": "Additional metadata returned by AI Extract.",
+          "ref": "aifunctions.AiExtractResponseMetadata",
+          "launch_stage": "GA"
+        },
+        "response": {
+          "description": "The function result as a JSON value. When `enable_confidence_scores` and `enable_citations` are true, `confidence` and `citation_ids` are included in each response field, respectively.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "aifunctions.AiExtractResponseMetadata": {
+      "fields": {
+        "chunk_type": {
+          "description": "How the source was chunked for citation offsets (span for text input, bbox for parsed-document input); present when citations are enabled.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "citations": {
+          "description": "Citation objects locating each result in the source; present when citations are enabled.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "mode": {
+          "description": "The resolved extraction mode; present when a non-default mode was used.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "version": {
+          "description": "The resolved function version.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "aifunctions.AiParseDocumentFileMetadata": {
+      "description": "Metadata about the source file; present only for file-path input.",
+      "fields": {
+        "file_modification_time": {
+          "description": "Last-modified timestamp of the source file, as an HTTP date string.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "file_name": {
+          "description": "Base name of the source file.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "file_path": {
+          "description": "Unity Catalog volume path of the source file.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "file_size": {
+          "description": "Size of the source file in bytes.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "aifunctions.AiParseDocumentOptions": {
+      "description": "ai_parse_document",
+      "fields": {
+        "description_element_types": {
+          "description": "Element types for which an AI-generated description is produced. Use \"*\" (default) to generate descriptions for all supported element types, \"figure\" to generate them for figures only, or \"\" (empty string) to generate none. Only figure descriptions are supported for version \"2.0\", so \"*\" and \"figure\" produce the same behavior.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "image_output_path": {
+          "description": "Unity Catalog volume path where rendered page and element images are written.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_range": {
+          "description": "Pages to parse (1-indexed), as a comma-separated list of page numbers or ranges (e.g. \"1,3,5-10\").",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "version": {
+          "description": "The ai_parse_document output schema version. Supported value: \"2.0\".",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "aifunctions.AiParseDocumentPageError": {
+      "description": "A single page that failed to parse while the overall request succeeded.",
+      "fields": {
+        "error_message": {
+          "description": "Message describing why the page failed.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_id": {
+          "description": "0-based index of the page that failed.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "aifunctions.AiParseDocumentRequest": {
+      "fields": {
+        "content": {
+          "description": "The document to parse. The REST API accepts a Unity Catalog volume path to the source file or a base64 data URL containing the file bytes (for example, data:application/pdf;base64,\u003cencoded-file-bytes\u003e or data:image/jpeg;base64,\u003cencoded-file-bytes\u003e). Supported formats: PDF, DOCX, DOC, PPTX, PPT, JPG, JPEG, PNG, TIFF. Accepts up to 100 pages and 100 MB per document.",
+          "launch_stage": "GA"
+        },
+        "options": {
+          "description": "Function options. Omitted fields fall back to their documented defaults.",
+          "ref": "aifunctions.AiParseDocumentOptions",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "aifunctions.AiParseDocumentResponse": {
+      "fields": {
+        "document": {
+          "description": "The parsed document as a JSON value, containing the extracted pages and elements.",
+          "launch_stage": "GA"
+        },
+        "error_status": {
+          "description": "Per-page partial-failure details; present when the request succeeds (2xx) but individual pages fail.",
+          "launch_stage": "GA"
+        },
+        "metadata": {
+          "description": "Additional metadata returned by AI Parse Document.",
+          "ref": "aifunctions.AiParseDocumentResponseMetadata",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "aifunctions.AiParseDocumentResponseMetadata": {
+      "fields": {
+        "file_metadata": {
+          "description": "Describes the source file; present only for file-path input.",
+          "ref": "aifunctions.AiParseDocumentFileMetadata",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "id": {
+          "description": "Unique identifier for the parse request.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "version": {
+          "description": "The resolved function version.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "aisearch.ColumnInfo": {
+      "description": "Column information (name and data type) for an index column. Surfaced on `Index.column_info`.",
+      "fields": {
+        "name": {
+          "description": "Name of the column.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "type_text": {
+          "description": "Data type of the column (e.g., \"string\", \"int\", \"array\u003cfloat\u003e\").",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "aisearch.CreateEndpointRequest": {
+      "fields": {
+        "endpoint": {
+          "description": "The Endpoint resource to create. Fields other than `endpoint.name` carry the desired\nconfiguration; `endpoint.name` is server-assigned from `parent` and `endpoint_id`.",
+          "ref": "aisearch.Endpoint",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "endpoint_id": {
+          "description": "The user-supplied short name for the Endpoint, per AIP-133. The server composes the\nfull `Endpoint.name` as `{parent}/endpoints/{endpoint_id}`. AIP-133 does not list\n`endpoint_id` as a fields-may-be-required entry, so we annotate it OPTIONAL on the\nwire; the server still rejects empty values with INVALID_PARAMETER_VALUE.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "aisearch.CreateIndexRequest": {
+      "fields": {
+        "index": {
+          "description": "The Index resource to create. Fields other than `index.name` carry the desired\nconfiguration; `index.name` is server-assigned from `parent` and `index_id`.",
+          "ref": "aisearch.Index",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "index_id": {
+          "description": "The user-supplied Unity Catalog table name for the Index, per AIP-133. The server\ncomposes the full `Index.name` as `{parent}/indexes/{index_id}`. AIP-133 does not\nlist `index_id` as a fields-may-be-required entry, so we annotate it OPTIONAL on the\nwire; the server still rejects empty values with INVALID_PARAMETER_VALUE.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "aisearch.CustomTag": {
+      "description": "User-defined key/value tag attached to an AI Search endpoint for cost attribution and access control.",
+      "fields": {
+        "key": {
+          "description": "Key field for an AI Search endpoint tag.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "value": {
+          "description": "[Optional] Value field for an AI Search endpoint tag.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "aisearch.DataModificationResult": {
+      "description": "Per-row outcome of a data-plane upsert or delete operation.",
+      "fields": {
+        "failed_primary_keys": {
+          "description": "Primary keys of rows that failed to process.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "success_row_count": {
+          "description": "Count of rows processed successfully.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "aisearch.DataModificationStatus": {
+      "description": "Overall outcome of a data-plane upsert or delete. Mirrors the legacy\n`databricks.brickindexscheduler.UpsertDeleteDataStatus` value-for-value.",
+      "enum": [
+        "SUCCESS",
+        "PARTIAL_SUCCESS",
+        "FAILURE"
+      ],
+      "enum_launch_stages": {
+        "FAILURE": "PUBLIC_PREVIEW",
+        "PARTIAL_SUCCESS": "PUBLIC_PREVIEW",
+        "SUCCESS": "PUBLIC_PREVIEW"
+      }
+    },
+    "aisearch.DeleteEndpointRequest": {},
+    "aisearch.DeleteIndexRequest": {},
+    "aisearch.DeltaSyncIndexSpec": {
+      "description": "Specification for a Delta Sync index — the index is kept in sync with a source Delta table.",
+      "fields": {
+        "columns_to_sync": {
+          "description": "[Optional] Select the columns to sync with the index. If left blank, all columns\nfrom the source table are synced. The primary key column and embedding source or\nvector column are always synced.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "embedding_source_columns": {
+          "description": "The columns that contain the embedding source.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "embedding_vector_columns": {
+          "description": "The columns that contain the embedding vectors.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "embedding_writeback_table": {
+          "description": "[Optional] Name of the Delta table to sync the index contents and computed embeddings to.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "pipeline_id": {
+          "description": "The ID of the pipeline that is used to sync the index.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "pipeline_type": {
+          "description": "Pipeline execution mode. Required on create — the backend rejects an unset value.\nStorage Optimized endpoints accept only `TRIGGERED`; Standard endpoints accept both.\nNo explicit `stage` — a REQUIRED field staged below its service would be dropped from\ncombined specs while remaining in `required`, tripping the OpenAPI required-vs-properties\nconsistency check. The field inherits the service's launch stage.",
+          "ref": "aisearch.PipelineType",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "source_table": {
+          "description": "The full name of the source Delta table.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "aisearch.DirectAccessIndexSpec": {
+      "description": "Specification for a Direct Access index — the customer manages vectors and metadata directly.",
+      "fields": {
+        "embedding_source_columns": {
+          "description": "The columns that contain the embedding source.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "embedding_vector_columns": {
+          "description": "The columns that contain the embedding vectors.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "schema_json": {
+          "description": "The schema of the index in JSON format. Supported types are `integer`, `long`,\n`float`, `double`, `boolean`, `string`, `date`, `timestamp`. Supported types for\nvector columns: `array\u003cfloat\u003e`, `array\u003cdouble\u003e`.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "aisearch.EmbeddingSourceColumn": {
+      "description": "Name of an embedding source column and its associated embedding model endpoint.",
+      "fields": {
+        "embedding_model_endpoint": {
+          "description": "Name of the embedding model endpoint, used by default for both ingestion and querying.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "model_endpoint_name_for_query": {
+          "description": "Name of the embedding model endpoint which, if specified, is used for querying (not ingestion).",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "name": {
+          "description": "Name of the source column.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "aisearch.EmbeddingVectorColumn": {
+      "description": "Name and dimension of an embedding vector column.",
+      "fields": {
+        "embedding_dimension": {
+          "description": "Dimension of the embedding vector.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "name": {
+          "description": "Name of the column.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "aisearch.Endpoint": {
+      "description": "An AI Search endpoint — compute infrastructure that hosts AI Search indexes\nand serves queries against them. Customers create, query, and delete endpoints;\nthe system manages provisioning, scaling, and health status.",
+      "fields": {
+        "budget_policy_id": {
+          "description": "The user-selected budget policy id for the endpoint.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "create_time": {
+          "description": "Time the endpoint was created.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "creator": {
+          "description": "Creator of the endpoint",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "custom_tags": {
+          "description": "The custom tags assigned to the endpoint",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "effective_budget_policy_id": {
+          "description": "The budget policy id applied to the endpoint",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "endpoint_status": {
+          "description": "Current status of the endpoint",
+          "ref": "aisearch.EndpointStatus",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "endpoint_type": {
+          "description": "Type of endpoint. Required on create and immutable thereafter.",
+          "ref": "aisearch.EndpointType",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "id": {
+          "description": "Unique identifier of the endpoint",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "index_count": {
+          "description": "Number of indexes on the endpoint",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "last_updated_user": {
+          "description": "User who last updated the endpoint",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "Name of the AI Search endpoint. Server-assigned full resource path\n(`workspaces/{workspace}/endpoints/{endpoint}`) on output. On create, the\nuser-supplied short name is conveyed via `CreateEndpointRequest.endpoint_id`;\nthe server composes the full `name` and returns it on the response.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "replica_count": {
+          "description": "The client-supplied desired number of replicas for the endpoint, applied at\ncreate/update time. Mutually exclusive with `target_qps`.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "scaling_info": {
+          "description": "Scaling information for the endpoint",
+          "ref": "aisearch.EndpointScalingInfo",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "target_qps": {
+          "description": "Target QPS for the endpoint. Mutually exclusive with `replica_count`. Best-effort;\nthe system does not guarantee this QPS will be achieved.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "throughput_info": {
+          "description": "Throughput information for the endpoint",
+          "ref": "aisearch.EndpointThroughputInfo",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "update_time": {
+          "description": "Time the endpoint was last updated.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "usage_policy_id": {
+          "description": "The usage policy id applied to the endpoint.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "aisearch.EndpointScalingInfo": {
+      "description": "Scaling information for a Standard endpoint: the current scaling state, the requested QPS\ntarget, and the progress of an in-progress scaling change.",
+      "fields": {
+        "requested_target_qps": {
+          "description": "The requested QPS target for the endpoint. Best-effort; the system does not\nguarantee this QPS will be achieved.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "state": {
+          "description": "The current state of the scaling change request.",
+          "ref": "aisearch.ScalingChangeState",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "aisearch.EndpointStatus": {
+      "description": "Lifecycle and health state of an AI Search endpoint, along with any human-readable detail\nabout that state.",
+      "fields": {
+        "message": {
+          "description": "Human-readable detail about the endpoint's current state or the reason for a state transition.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "state": {
+          "description": "Current lifecycle state of the endpoint. See `State` for the meaning of each value.",
+          "ref": "aisearch.EndpointStatusState",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "aisearch.EndpointStatusState": {
+      "description": "Lifecycle state of an AI Search endpoint, used by both Standard and Storage Optimized SKUs.",
+      "enum": [
+        "PROVISIONING",
+        "ONLINE",
+        "OFFLINE",
+        "RED_STATE",
+        "YELLOW_STATE",
+        "DELETED"
+      ],
+      "enum_launch_stages": {
+        "DELETED": "PUBLIC_PREVIEW",
+        "OFFLINE": "PUBLIC_PREVIEW",
+        "ONLINE": "PUBLIC_PREVIEW",
+        "PROVISIONING": "PUBLIC_PREVIEW",
+        "RED_STATE": "PUBLIC_PREVIEW",
+        "YELLOW_STATE": "PUBLIC_PREVIEW"
+      }
+    },
+    "aisearch.EndpointThroughputInfo": {
+      "description": "Throughput information for an AI Search endpoint, including requested and current concurrency settings.",
+      "fields": {
+        "change_request_message": {
+          "description": "Additional information about the throughput change request",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "change_request_state": {
+          "description": "The state of the most recent throughput change request",
+          "ref": "aisearch.ThroughputChangeRequestState",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "current_concurrency": {
+          "description": "The current concurrency (total CPU) allocated to the endpoint",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "current_concurrency_utilization_percentage": {
+          "description": "The current utilization of concurrency as a percentage (0-100)",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "current_num_replicas": {
+          "description": "The current number of replicas allocated to the endpoint",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "maximum_concurrency_allowed": {
+          "description": "The maximum concurrency allowed for this endpoint",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "minimal_concurrency_allowed": {
+          "description": "The minimum concurrency allowed for this endpoint",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "requested_concurrency": {
+          "description": "The requested concurrency (total CPU) for the endpoint",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "requested_num_replicas": {
+          "description": "The requested number of replicas for the endpoint",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "aisearch.EndpointType": {
+      "description": "Type of endpoint.",
+      "enum": [
+        "STORAGE_OPTIMIZED",
+        "STANDARD"
+      ],
+      "enum_launch_stages": {
+        "STANDARD": "PUBLIC_PREVIEW",
+        "STORAGE_OPTIMIZED": "PUBLIC_PREVIEW"
+      }
+    },
+    "aisearch.FacetResultData": {
+      "description": "Facet aggregation rows returned by a query.",
+      "fields": {
+        "facet_array": {
+          "description": "Facet rows; each row is `[facet_column_name, value_or_range, count]`.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "facet_row_count": {
+          "description": "Number of facet rows returned.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "aisearch.GetEndpointRequest": {},
+    "aisearch.GetIndexRequest": {},
+    "aisearch.Index": {
+      "description": "An AI Search index — a searchable collection of vectors and metadata hosted on an\nAI Search endpoint. Indexes are children of endpoints; customers create, get, list,\nand delete them. The `{index}` segment of the resource name is the index's Unity\nCatalog table name.",
+      "fields": {
+        "creator": {
+          "description": "Creator of the index.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "delta_sync_index_spec": {
+          "description": "Specification for a Delta Sync index. Set when `index_type` is `DELTA_SYNC`.",
+          "ref": "aisearch.DeltaSyncIndexSpec",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE",
+            "OPTIONAL"
+          ]
+        },
+        "direct_access_index_spec": {
+          "description": "Specification for a Direct Access index. Set when `index_type` is `DIRECT_ACCESS`.",
+          "ref": "aisearch.DirectAccessIndexSpec",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE",
+            "OPTIONAL"
+          ]
+        },
+        "endpoint": {
+          "description": "Name of the endpoint associated with the index. Ignored on create — the endpoint is\ntaken from `CreateIndexRequest.parent`; populated only on output.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "index_subtype": {
+          "description": "The subtype of the index. Set on create and immutable thereafter.",
+          "ref": "aisearch.IndexSubtype",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE",
+            "OPTIONAL"
+          ]
+        },
+        "index_type": {
+          "description": "Type of index. Required on create and immutable thereafter.",
+          "ref": "aisearch.IndexType",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "name": {
+          "description": "Name of the AI Search index. Server-assigned full resource path\n(`workspaces/{workspace}/endpoints/{endpoint}/indexes/{index}`) on output, where\n`{index}` is the index's Unity Catalog table name. On create, the user-supplied UC\ntable name is conveyed via `CreateIndexRequest.index_id`; the server composes the\nfull `name` and returns it on the response.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "primary_key": {
+          "description": "Primary key of the index. Set on create and immutable thereafter.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "status": {
+          "description": "Current status of the index.",
+          "ref": "aisearch.IndexStatus",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "aisearch.IndexStatus": {
+      "description": "Lifecycle and health state of an AI Search index, along with human-readable\ndetail about that state and basic indexing progress.",
+      "fields": {
+        "index_url": {
+          "description": "Index API URL used to perform operations on the index.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "indexed_row_count": {
+          "description": "Number of rows indexed.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "message": {
+          "description": "Human-readable detail about the index's current state.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "ready": {
+          "description": "Whether the index is ready for search.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "aisearch.IndexSubtype": {
+      "description": "The subtype of the AI Search index, determining the indexing and retrieval strategy.\n- `VECTOR`: Not a supported create value — do not select it. Use `HYBRID` (vector + hybrid\nsearch) or `FULL_TEXT` (full-text only). It is the proto2 default (`= 0`) solely to mirror\nthe legacy `index_v2.proto` enum value-for-value; it is not an offered index subtype.\n- `FULL_TEXT`: An index that uses full-text search without vector embeddings.\n- `HYBRID`: An index that uses vector embeddings for similarity search and hybrid search.",
+      "enum": [
+        "VECTOR",
+        "FULL_TEXT",
+        "HYBRID"
+      ],
+      "enum_launch_stages": {
+        "FULL_TEXT": "PUBLIC_PREVIEW",
+        "HYBRID": "PUBLIC_PREVIEW",
+        "VECTOR": "PUBLIC_PREVIEW"
+      },
+      "enum_descriptions": {
+        "FULL_TEXT": "An index that uses full-text search without vector embeddings.",
+        "HYBRID": "An index that uses vector embeddings for similarity search and hybrid search.",
+        "VECTOR": "Not a supported create value — do not select it. Use `HYBRID` (vector + hybrid"
+      }
+    },
+    "aisearch.IndexType": {
+      "description": "There are 2 types of AI Search indexes:\n- `DELTA_SYNC`: An index that automatically syncs with a source Delta Table,\nautomatically and incrementally updating the index as the underlying data in\nthe Delta Table changes.\n- `DIRECT_ACCESS`: An index that supports direct read and write of vectors and\nmetadata through our REST and SDK APIs. With this model, the user manages\nindex updates.",
+      "enum": [
+        "DELTA_SYNC",
+        "DIRECT_ACCESS"
+      ],
+      "enum_launch_stages": {
+        "DELTA_SYNC": "PUBLIC_PREVIEW",
+        "DIRECT_ACCESS": "PUBLIC_PREVIEW"
+      },
+      "enum_descriptions": {
+        "DELTA_SYNC": "An index that automatically syncs with a source Delta Table,",
+        "DIRECT_ACCESS": "An index that supports direct read and write of vectors and"
+      }
+    },
+    "aisearch.ListEndpointsRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Best-effort upper bound on the number of results to return. Honored as an upper\nbound by the shim: `page_size` only narrows the legacy backend's response, never\nwidens it, so the practical cap is `min(page_size, legacy_fixed_page_size)`.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Page token from a previous response. If not provided, returns the first page.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "aisearch.ListEndpointsResponse": {
+      "description": "Response for ListEndpoints carrying the page of endpoints and an optional continuation token.",
+      "fields": {
+        "endpoints": {
+          "description": "The endpoints in the workspace.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "next_page_token": {
+          "description": "A token that can be used to get the next page of results. Empty when there are no more results.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "aisearch.ListIndexesRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Best-effort upper bound on the number of results to return. Honored as an upper\nbound by the shim: `page_size` only narrows the legacy backend's response, never\nwidens it, so the practical cap is `min(page_size, legacy_fixed_page_size)`.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Page token from a previous response. If not provided, returns the first page.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "aisearch.ListIndexesResponse": {
+      "description": "Response for ListIndexes carrying the page of indexes and an optional continuation token.",
+      "fields": {
+        "indexes": {
+          "description": "The indexes on the endpoint. The field is named `indexes` (not the irregular plural\n`indices`) to satisfy core::0132, which derives the response field name from the\nListIndexes method. core::0158::response-plural-first-field independently computes the\nresource plural as `indices` and is satisfied via a scoped field exception below.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "next_page_token": {
+          "description": "A token that can be used to get the next page of results. Empty when there are no more results.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "aisearch.PipelineType": {
+      "description": "Pipeline execution mode for a Delta Sync index. Required on create for Delta Sync\nindexes; the legacy backend rejects an unset value with INVALID_PARAMETER_VALUE.\n- `TRIGGERED`: the pipeline stops after refreshing the source table once, using the\ndata available when the update started.\n- `CONTINUOUS`: the pipeline processes new data as it arrives in the source table to\nkeep the index fresh.",
+      "enum": [
+        "TRIGGERED",
+        "CONTINUOUS"
+      ],
+      "enum_launch_stages": {
+        "CONTINUOUS": "PUBLIC_PREVIEW",
+        "TRIGGERED": "PUBLIC_PREVIEW"
+      },
+      "enum_descriptions": {
+        "CONTINUOUS": "the pipeline processes new data as it arrives in the source table to",
+        "TRIGGERED": "the pipeline stops after refreshing the source table once, using the"
+      }
+    },
+    "aisearch.QueryIndexRequest": {
+      "description": "Request to query (search) an AI Search index. The legacy `num_results` count is exposed as\n`max_results`; v1 returns up to `max_results` rows in a single response (no cursor pagination\n— see the note on `max_results` below).",
+      "fields": {
+        "columns": {
+          "description": "Column names to include in each result row.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "columns_to_rerank": {
+          "description": "Columns whose values are sent to the reranker.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "facets": {
+          "description": "Facets to compute over the matched results (e.g. `\"category TOP 5\"`).",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "filters_json": {
+          "description": "JSON string describing query filters (e.g. `{\"id \u003e\": 5}`).",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "max_results": {
+          "description": "Maximum number of results to return (the legacy `num_results`). Defaults to 10.\nPrefer `page_size`; when both are set, `page_size` takes precedence.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "query_columns": {
+          "description": "Text columns to search for `query_text`. When empty, all text columns are searched.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "query_text": {
+          "description": "Query text. Required for Delta Sync indexes that compute embeddings from a model endpoint.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "query_type": {
+          "description": "Query type: `ANN`, `HYBRID`, or `FULL_TEXT`. Defaults to `ANN`.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "query_vector": {
+          "description": "Query vector. Required for Direct Access indexes and Delta Sync indexes with self-managed\nvectors.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "reranker": {
+          "description": "If set, results are reranked before being returned.",
+          "ref": "aisearch.RerankerConfig",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "score_threshold": {
+          "description": "Score threshold for the approximate nearest-neighbor search. Defaults to 0.0.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "sort_columns": {
+          "description": "Sort clauses, e.g. `[\"rating DESC\", \"price ASC\"]`. Overrides relevance ordering.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "aisearch.QueryIndexResponse": {
+      "description": "Response for QueryIndex carrying the matched rows and their column metadata.",
+      "fields": {
+        "facet_result": {
+          "description": "Facet aggregation rows, when facets were requested.",
+          "ref": "aisearch.FacetResultData",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "manifest": {
+          "description": "Metadata describing the result columns.",
+          "ref": "aisearch.ResultManifest",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "result": {
+          "description": "The matched result rows.",
+          "ref": "aisearch.ResultData",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "aisearch.RemoveDataRequest": {
+      "description": "Request to remove rows by primary key from a Direct Access AI Search index.\nNamed RemoveData (not DeleteData) so the linter does not classify it as a standard\nAIP-135 Delete method — it deletes rows within an index, not the index resource.",
+      "fields": {
+        "primary_keys": {
+          "description": "Primary keys of the rows to remove.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "aisearch.RemoveDataResponse": {
+      "description": "Response for RemoveData.",
+      "fields": {
+        "result": {
+          "description": "Per-row outcome of the delete.",
+          "ref": "aisearch.DataModificationResult",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "status": {
+          "description": "Overall status of the delete.",
+          "ref": "aisearch.DataModificationStatus",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "aisearch.RerankerConfig": {
+      "description": "Configuration for reranking query results with a reranker model.",
+      "fields": {
+        "model": {
+          "description": "Reranker identifier: \"databricks_reranker\" for the base model, or a Model Serving\nendpoint name when `model_type` is MODEL_TYPE_FINETUNED.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "model_type": {
+          "description": "Discriminator for how `model` is interpreted.",
+          "ref": "aisearch.RerankerConfigModelType",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "parameters": {
+          "description": "Parameters controlling reranking.",
+          "ref": "aisearch.RerankerConfigRerankerParameters",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "aisearch.RerankerConfigModelType": {
+      "description": "How the `model` field is interpreted.",
+      "enum": [
+        "MODEL_TYPE_BASE",
+        "MODEL_TYPE_FINETUNED"
+      ],
+      "enum_launch_stages": {
+        "MODEL_TYPE_BASE": "PUBLIC_PREVIEW",
+        "MODEL_TYPE_FINETUNED": "PUBLIC_PREVIEW"
+      }
+    },
+    "aisearch.RerankerConfigRerankerParameters": {
+      "description": "Parameters controlling how the reranker processes results.",
+      "fields": {
+        "columns_to_rerank": {
+          "description": "Columns whose values are concatenated and sent to the reranker.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "aisearch.ResultData": {
+      "description": "The rows of a query result set.",
+      "fields": {
+        "data_array": {
+          "description": "Result rows; each row is a list of column values aligned with the manifest columns.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "row_count": {
+          "description": "Number of rows in the result set.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "aisearch.ResultManifest": {
+      "description": "Metadata describing the columns of a query result set.",
+      "fields": {
+        "column_count": {
+          "description": "Number of columns in the result set.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "columns": {
+          "description": "Information about each column in the result set.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "facet_column_count": {
+          "description": "Number of columns in the facet result.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "facet_columns": {
+          "description": "Information about each facet column.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "aisearch.ScalingChangeState": {
+      "description": "State of the most recent scaling change request for a Standard endpoint.",
+      "enum": [
+        "SCALING_CHANGE_UNSPECIFIED",
+        "SCALING_CHANGE_APPLIED",
+        "SCALING_CHANGE_IN_PROGRESS"
+      ],
+      "enum_launch_stages": {
+        "SCALING_CHANGE_APPLIED": "PUBLIC_PREVIEW",
+        "SCALING_CHANGE_IN_PROGRESS": "PUBLIC_PREVIEW",
+        "SCALING_CHANGE_UNSPECIFIED": "PUBLIC_PREVIEW"
+      }
+    },
+    "aisearch.ScanIndexRequest": {
+      "description": "Request to scan (paginate over) the rows of an AI Search index. Models the legacy\n`num_results` / `last_primary_key` cursor as AIP-158 `page_size` / `page_token`.",
+      "fields": {
+        "page_size": {
+          "description": "Maximum number of rows to return in this page.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Page token from a previous response; if unset, scanning starts from the beginning.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "aisearch.ScanIndexResponse": {
+      "description": "Response for ScanIndex carrying a page of rows and an optional continuation token.",
+      "fields": {
+        "data": {
+          "description": "The rows in this page, each a struct of column name to value.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "next_page_token": {
+          "description": "Token for the next page; empty when the scan is exhausted.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "aisearch.SyncIndexRequest": {
+      "description": "Request to synchronize a Delta Sync AI Search index with its source Delta table."
+    },
+    "aisearch.SyncIndexResponse": {
+      "description": "Response for SyncIndex. Empty today; reserved so future sync metadata (e.g. an\noperation handle) can be added without breaking the wire contract."
+    },
+    "aisearch.ThroughputChangeRequestState": {
+      "description": "State of the most recent throughput change request issued against a Storage Optimized\nendpoint. Surfaced on `EndpointThroughputInfo.change_request_state`.",
+      "enum": [
+        "CHANGE_SUCCESS",
+        "CHANGE_FAILED",
+        "CHANGE_REACHED_MINIMUM",
+        "CHANGE_REACHED_MAXIMUM",
+        "CHANGE_IN_PROGRESS",
+        "CHANGE_ADJUSTED"
+      ],
+      "enum_launch_stages": {
+        "CHANGE_ADJUSTED": "PUBLIC_PREVIEW",
+        "CHANGE_FAILED": "PUBLIC_PREVIEW",
+        "CHANGE_IN_PROGRESS": "PUBLIC_PREVIEW",
+        "CHANGE_REACHED_MAXIMUM": "PUBLIC_PREVIEW",
+        "CHANGE_REACHED_MINIMUM": "PUBLIC_PREVIEW",
+        "CHANGE_SUCCESS": "PUBLIC_PREVIEW"
+      }
+    },
+    "aisearch.UpdateEndpointRequest": {
+      "fields": {
+        "endpoint": {
+          "description": "The Endpoint resource to update. `endpoint.name` carries the full resource path.",
+          "ref": "aisearch.Endpoint",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "update_mask": {
+          "description": "The list of fields to update.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "aisearch.UpsertDataRequest": {
+      "description": "Request to upsert rows into a Direct Access AI Search index.",
+      "fields": {
+        "inputs_json": {
+          "description": "JSON document describing the rows to upsert.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "aisearch.UpsertDataResponse": {
+      "description": "Response for UpsertData.",
+      "fields": {
+        "result": {
+          "description": "Per-row outcome of the upsert.",
+          "ref": "aisearch.DataModificationResult",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "status": {
+          "description": "Overall status of the upsert.",
+          "ref": "aisearch.DataModificationStatus",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "apps.App": {
+      "fields": {
+        "active_deployment": {
+          "description": "The active deployment of the app. A deployment is considered active when it has been deployed\nto the app compute.",
+          "ref": "apps.AppDeployment",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "app_status": {
+          "ref": "apps.ApplicationStatus",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "budget_policy_id": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "compute_max_instances": {
+          "description": "Maximum number of app instances the app is configured to run. Must be set together with `compute_min_instances`.",
+          "launch_stage": "GA"
+        },
+        "compute_min_instances": {
+          "description": "Minimum number of app instances the app is configured to run. Must be set together with `compute_max_instances`.",
+          "launch_stage": "GA"
+        },
+        "compute_size": {
+          "ref": "apps.ComputeSize",
+          "launch_stage": "GA"
+        },
+        "compute_status": {
+          "ref": "apps.ComputeStatus",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "create_time": {
+          "description": "The creation time of the app. Formatted timestamp in ISO 6801.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "creator": {
+          "description": "The email of the user that created the app.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "default_git_source": {
+          "description": "The Git source of the app's most recent active deployment, including the repository\nconfiguration and the resolved reference. Populated by the system after a Git-based\ndeployment and used as the default reference when automatic deployments are enabled.",
+          "ref": "apps.GitSource",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "default_source_code_path": {
+          "description": "The default workspace file system path of the source code from which app deployment are\ncreated. This field tracks the workspace source code path of the last active deployment.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "description": {
+          "description": "The description of the app.",
+          "launch_stage": "GA"
+        },
+        "effective_budget_policy_id": {
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "effective_usage_policy_id": {
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "effective_user_api_scopes": {
+          "description": "The effective api scopes granted to the user access token.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "forward_user_access_token": {
+          "description": "Forward the user's access token to the app. Requires stopping and starting app compute to take effect.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "git_repository": {
+          "description": "Git repository configuration for app deployments. When specified, deployments can\nreference code from this repository by providing only the git reference (branch, tag, or commit).",
+          "ref": "apps.GitRepository",
+          "launch_stage": "GA"
+        },
+        "git_source": {
+          "description": "The Git source to deploy from, specifying the reference to check out (branch, tag, or\ncommit) and an optional path to the app source code within the repository configured in\ngit_repository.",
+          "ref": "apps.GitSource",
+          "launch_stage": "GA",
+          "behaviors": [
+            "INPUT_ONLY"
+          ]
+        },
+        "id": {
+          "description": "The unique identifier of the app.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "The name of the app. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+          "launch_stage": "GA"
+        },
+        "oauth2_app_client_id": {
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "oauth2_app_integration_id": {
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "pending_deployment": {
+          "description": "The pending deployment of the app. A deployment is considered pending when it is being prepared\nfor deployment to the app compute.",
+          "ref": "apps.AppDeployment",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "resources": {
+          "description": "Resources for the app.",
+          "launch_stage": "GA"
+        },
+        "service_principal_client_id": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "service_principal_id": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "service_principal_name": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "source_code_path": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "INPUT_ONLY"
+          ]
+        },
+        "space": {
+          "description": "Name of the space this app belongs to.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "telemetry_export_destinations": {
+          "launch_stage": "GA"
+        },
+        "thumbnail_url": {
+          "description": "The URL of the thumbnail image for the app.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "update_time": {
+          "description": "The update time of the app. Formatted timestamp in ISO 6801.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "updater": {
+          "description": "The email of the user that last updated the app.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "url": {
+          "description": "The URL of the app once it is deployed.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "usage_policy_id": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "user_api_scopes": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "apps.AppAccessControlRequest": {
+      "fields": {
+        "group_name": {
+          "description": "name of the group",
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "apps.AppPermissionLevel",
+          "launch_stage": "GA"
+        },
+        "service_principal_name": {
+          "description": "application ID of a service principal",
+          "launch_stage": "GA"
+        },
+        "user_name": {
+          "description": "name of the user",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "apps.AppAccessControlResponse": {
+      "fields": {
+        "all_permissions": {
+          "description": "All permissions.",
+          "launch_stage": "GA"
+        },
+        "display_name": {
+          "description": "Display name of the user or service principal.",
+          "launch_stage": "GA"
+        },
+        "group_name": {
+          "description": "name of the group",
+          "launch_stage": "GA"
+        },
+        "service_principal_name": {
+          "description": "Name of the service principal.",
+          "launch_stage": "GA"
+        },
+        "user_name": {
+          "description": "name of the user",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "apps.AppDeployment": {
+      "fields": {
+        "command": {
+          "description": "The command with which to run the app. This will override the command specified in the app.yaml file.",
+          "launch_stage": "GA"
+        },
+        "create_time": {
+          "description": "The creation time of the deployment. Formatted timestamp in ISO 6801.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "creator": {
+          "description": "The email of the user creates the deployment.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "deployment_artifacts": {
+          "description": "The deployment artifacts for an app.",
+          "ref": "apps.AppDeploymentArtifacts",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "deployment_id": {
+          "description": "The unique id of the deployment.",
+          "launch_stage": "GA"
+        },
+        "env_vars": {
+          "description": "The environment variables to set in the app runtime environment. This will override the environment variables specified in the app.yaml file.",
+          "launch_stage": "GA"
+        },
+        "git_source": {
+          "description": "Git repository to use as the source for the app deployment.",
+          "ref": "apps.GitSource",
+          "launch_stage": "GA"
+        },
+        "health_check": {
+          "description": "Deploy-time health check for the app. Verifies the app is responding to HTTP requests before considering the deployment successful.",
+          "ref": "apps.AppHealthCheck",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "mode": {
+          "description": "The mode of which the deployment will manage the source code.",
+          "ref": "apps.AppDeploymentMode",
+          "launch_stage": "GA"
+        },
+        "source_code_path": {
+          "description": "The workspace file system path of the source code used to create the app deployment. This is different from\n`deployment_artifacts.source_code_path`, which is the path used by the deployed app. The former refers\nto the original source code location of the app in the workspace during deployment creation, whereas\nthe latter provides a system generated stable snapshotted source code path used by the deployment.",
+          "launch_stage": "GA"
+        },
+        "status": {
+          "description": "Status and status message of the deployment",
+          "ref": "apps.AppDeploymentStatus",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "update_time": {
+          "description": "The update time of the deployment. Formatted timestamp in ISO 6801.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "apps.AppDeploymentArtifacts": {
+      "fields": {
+        "source_code_path": {
+          "description": "The snapshotted workspace file system path of the source code loaded by the deployed app.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "apps.AppDeploymentMode": {
+      "enum": [
+        "SNAPSHOT",
+        "AUTO_SYNC"
+      ],
+      "enum_launch_stages": {
+        "AUTO_SYNC": "GA",
+        "SNAPSHOT": "GA"
+      }
+    },
+    "apps.AppDeploymentState": {
+      "enum": [
+        "SUCCEEDED",
+        "FAILED",
+        "IN_PROGRESS",
+        "CANCELLED"
+      ],
+      "enum_launch_stages": {
+        "CANCELLED": "GA",
+        "FAILED": "GA",
+        "IN_PROGRESS": "GA",
+        "SUCCEEDED": "GA"
+      }
+    },
+    "apps.AppDeploymentStatus": {
+      "fields": {
+        "message": {
+          "description": "Message corresponding with the deployment state.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "state": {
+          "description": "State of the deployment.",
+          "ref": "apps.AppDeploymentState",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "apps.AppHealthCheck": {
+      "description": "Deploy-time HTTP health check configuration for an app deployment.",
+      "fields": {
+        "path": {
+          "description": "HTTP path to probe, e.g. \"/health\" or \"/api/status\".",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "timeout": {
+          "description": "Timeout to wait for the health check to pass before failing the deployment. If not set, a default timeout is used.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "apps.AppManifest": {
+      "description": "App manifest definition",
+      "fields": {
+        "description": {
+          "description": "Description of the app defined by manifest author / publisher",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "name": {
+          "description": "Name of the app defined by manifest author / publisher",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "resource_specs": {
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "version": {
+          "description": "The manifest schema version, for now only 1 is allowed",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "apps.AppManifestAppResourceExperimentSpec": {
+      "fields": {
+        "permission": {
+          "ref": "apps.AppManifestAppResourceExperimentSpecExperimentPermission",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "apps.AppManifestAppResourceExperimentSpecExperimentPermission": {
+      "enum": [
+        "CAN_MANAGE",
+        "CAN_EDIT",
+        "CAN_READ"
+      ],
+      "enum_launch_stages": {
+        "CAN_EDIT": "PRIVATE_PREVIEW",
+        "CAN_MANAGE": "PRIVATE_PREVIEW",
+        "CAN_READ": "PRIVATE_PREVIEW"
+      }
+    },
+    "apps.AppManifestAppResourceJobSpec": {
+      "fields": {
+        "permission": {
+          "description": "Permissions to grant on the Job. Supported permissions are: \"CAN_MANAGE\", \"IS_OWNER\", \"CAN_MANAGE_RUN\", \"CAN_VIEW\".",
+          "ref": "apps.AppManifestAppResourceJobSpecJobPermission",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "apps.AppManifestAppResourceJobSpecJobPermission": {
+      "enum": [
+        "CAN_MANAGE",
+        "IS_OWNER",
+        "CAN_MANAGE_RUN",
+        "CAN_VIEW"
+      ],
+      "enum_launch_stages": {
+        "CAN_MANAGE": "PRIVATE_PREVIEW",
+        "CAN_MANAGE_RUN": "PRIVATE_PREVIEW",
+        "CAN_VIEW": "PRIVATE_PREVIEW",
+        "IS_OWNER": "PRIVATE_PREVIEW"
+      }
+    },
+    "apps.AppManifestAppResourceSecretSpec": {
+      "fields": {
+        "permission": {
+          "description": "Permission to grant on the secret scope. For secrets, only one permission is allowed. Permission must be one of: \"READ\", \"WRITE\", \"MANAGE\".",
+          "ref": "apps.AppManifestAppResourceSecretSpecSecretPermission",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "apps.AppManifestAppResourceSecretSpecSecretPermission": {
+      "description": "Permission to grant on the secret scope. Supported permissions are: \"READ\", \"WRITE\", \"MANAGE\".",
+      "enum": [
+        "READ",
+        "WRITE",
+        "MANAGE"
+      ],
+      "enum_launch_stages": {
+        "MANAGE": "PRIVATE_PREVIEW",
+        "READ": "PRIVATE_PREVIEW",
+        "WRITE": "PRIVATE_PREVIEW"
+      }
+    },
+    "apps.AppManifestAppResourceServingEndpointSpec": {
+      "fields": {
+        "permission": {
+          "description": "Permission to grant on the serving endpoint. Supported permissions are: \"CAN_MANAGE\", \"CAN_QUERY\", \"CAN_VIEW\".",
+          "ref": "apps.AppManifestAppResourceServingEndpointSpecServingEndpointPermission",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "apps.AppManifestAppResourceServingEndpointSpecServingEndpointPermission": {
+      "enum": [
+        "CAN_MANAGE",
+        "CAN_QUERY",
+        "CAN_VIEW"
+      ],
+      "enum_launch_stages": {
+        "CAN_MANAGE": "PRIVATE_PREVIEW",
+        "CAN_QUERY": "PRIVATE_PREVIEW",
+        "CAN_VIEW": "PRIVATE_PREVIEW"
+      }
+    },
+    "apps.AppManifestAppResourceSpec": {
+      "description": "AppResource related fields are copied from app.proto but excludes resource identifiers (e.g. name, id, key, scope, etc.)",
+      "fields": {
+        "description": {
+          "description": "Description of the App Resource.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "experiment_spec": {
+          "ref": "apps.AppManifestAppResourceExperimentSpec",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "job_spec": {
+          "ref": "apps.AppManifestAppResourceJobSpec",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "name": {
+          "description": "Name of the App Resource.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "secret_spec": {
+          "ref": "apps.AppManifestAppResourceSecretSpec",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "serving_endpoint_spec": {
+          "ref": "apps.AppManifestAppResourceServingEndpointSpec",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "sql_warehouse_spec": {
+          "ref": "apps.AppManifestAppResourceSqlWarehouseSpec",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "uc_securable_spec": {
+          "ref": "apps.AppManifestAppResourceUcSecurableSpec",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "apps.AppManifestAppResourceSqlWarehouseSpec": {
+      "fields": {
+        "permission": {
+          "description": "Permission to grant on the SQL warehouse. Supported permissions are: \"CAN_MANAGE\", \"CAN_USE\", \"IS_OWNER\".",
+          "ref": "apps.AppManifestAppResourceSqlWarehouseSpecSqlWarehousePermission",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "apps.AppManifestAppResourceSqlWarehouseSpecSqlWarehousePermission": {
+      "enum": [
+        "CAN_MANAGE",
+        "CAN_USE",
+        "IS_OWNER"
+      ],
+      "enum_launch_stages": {
+        "CAN_MANAGE": "PRIVATE_PREVIEW",
+        "CAN_USE": "PRIVATE_PREVIEW",
+        "IS_OWNER": "PRIVATE_PREVIEW"
+      }
+    },
+    "apps.AppManifestAppResourceUcSecurableSpec": {
+      "fields": {
+        "permission": {
+          "ref": "apps.AppManifestAppResourceUcSecurableSpecUcSecurablePermission",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "securable_type": {
+          "ref": "apps.AppManifestAppResourceUcSecurableSpecUcSecurableType",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "apps.AppManifestAppResourceUcSecurableSpecUcSecurablePermission": {
+      "enum": [
+        "READ_VOLUME",
+        "WRITE_VOLUME",
+        "MANAGE",
+        "SELECT",
+        "EXECUTE",
+        "USE_CONNECTION"
+      ],
+      "enum_launch_stages": {
+        "EXECUTE": "PRIVATE_PREVIEW",
+        "MANAGE": "PRIVATE_PREVIEW",
+        "READ_VOLUME": "PRIVATE_PREVIEW",
+        "SELECT": "PRIVATE_PREVIEW",
+        "USE_CONNECTION": "PRIVATE_PREVIEW",
+        "WRITE_VOLUME": "PRIVATE_PREVIEW"
+      }
+    },
+    "apps.AppManifestAppResourceUcSecurableSpecUcSecurableType": {
+      "enum": [
+        "VOLUME",
+        "TABLE",
+        "FUNCTION",
+        "CONNECTION",
+        "MODEL_SERVICE"
+      ],
+      "enum_launch_stages": {
+        "CONNECTION": "PRIVATE_PREVIEW",
+        "FUNCTION": "PRIVATE_PREVIEW",
+        "MODEL_SERVICE": "PRIVATE_PREVIEW",
+        "TABLE": "PRIVATE_PREVIEW",
+        "VOLUME": "PRIVATE_PREVIEW"
+      }
+    },
+    "apps.AppPermission": {
+      "fields": {
+        "inherited": {
+          "launch_stage": "GA"
+        },
+        "inherited_from_object": {
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "apps.AppPermissionLevel",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "apps.AppPermissionLevel": {
+      "description": "Permission level",
+      "enum": [
+        "CAN_MANAGE",
+        "CAN_USE"
+      ]
+    },
+    "apps.AppPermissions": {
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "GA"
+        },
+        "object_id": {
+          "launch_stage": "GA"
+        },
+        "object_type": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "apps.AppPermissionsDescription": {
+      "fields": {
+        "description": {
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "apps.AppPermissionLevel",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "apps.AppPermissionsRequest": {
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "apps.AppResource": {
+      "fields": {
+        "app": {
+          "ref": "apps.AppResourceApp",
+          "launch_stage": "GA"
+        },
+        "database": {
+          "ref": "apps.AppResourceDatabase",
+          "launch_stage": "GA"
+        },
+        "description": {
+          "description": "Description of the App Resource.",
+          "launch_stage": "GA"
+        },
+        "experiment": {
+          "ref": "apps.AppResourceExperiment",
+          "launch_stage": "GA"
+        },
+        "genie_space": {
+          "ref": "apps.AppResourceGenieSpace",
+          "launch_stage": "GA"
+        },
+        "job": {
+          "ref": "apps.AppResourceJob",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of the App Resource.",
+          "launch_stage": "GA"
+        },
+        "postgres": {
+          "ref": "apps.AppResourcePostgres",
+          "launch_stage": "GA"
+        },
+        "secret": {
+          "ref": "apps.AppResourceSecret",
+          "launch_stage": "GA"
+        },
+        "serving_endpoint": {
+          "ref": "apps.AppResourceServingEndpoint",
+          "launch_stage": "GA"
+        },
+        "sql_warehouse": {
+          "ref": "apps.AppResourceSqlWarehouse",
+          "launch_stage": "GA"
+        },
+        "uc_securable": {
+          "ref": "apps.AppResourceUcSecurable",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "apps.AppResourceApp": {
+      "fields": {
+        "name": {
+          "launch_stage": "GA"
+        },
+        "permission": {
+          "ref": "apps.AppResourceAppAppPermission",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "apps.AppResourceAppAppPermission": {
+      "enum": [
+        "CAN_USE"
+      ],
+      "enum_launch_stages": {
+        "CAN_USE": "GA"
+      }
+    },
+    "apps.AppResourceDatabase": {
+      "fields": {
+        "database_name": {
+          "launch_stage": "GA"
+        },
+        "instance_name": {
+          "launch_stage": "GA"
+        },
+        "permission": {
+          "ref": "apps.AppResourceDatabaseDatabasePermission",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "apps.AppResourceDatabaseDatabasePermission": {
+      "enum": [
+        "CAN_CONNECT_AND_CREATE"
+      ],
+      "enum_launch_stages": {
+        "CAN_CONNECT_AND_CREATE": "GA"
+      }
+    },
+    "apps.AppResourceExperiment": {
+      "fields": {
+        "experiment_id": {
+          "launch_stage": "GA"
+        },
+        "permission": {
+          "ref": "apps.AppResourceExperimentExperimentPermission",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "apps.AppResourceExperimentExperimentPermission": {
+      "enum": [
+        "CAN_MANAGE",
+        "CAN_EDIT",
+        "CAN_READ"
+      ],
+      "enum_launch_stages": {
+        "CAN_EDIT": "GA",
+        "CAN_MANAGE": "GA",
+        "CAN_READ": "GA"
+      }
+    },
+    "apps.AppResourceGenieSpace": {
+      "fields": {
+        "name": {
+          "launch_stage": "GA"
+        },
+        "permission": {
+          "ref": "apps.AppResourceGenieSpaceGenieSpacePermission",
+          "launch_stage": "GA"
+        },
+        "space_id": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "apps.AppResourceGenieSpaceGenieSpacePermission": {
+      "enum": [
+        "CAN_MANAGE",
+        "CAN_EDIT",
+        "CAN_RUN",
+        "CAN_VIEW"
+      ],
+      "enum_launch_stages": {
+        "CAN_EDIT": "GA",
+        "CAN_MANAGE": "GA",
+        "CAN_RUN": "GA",
+        "CAN_VIEW": "GA"
+      }
+    },
+    "apps.AppResourceJob": {
+      "fields": {
+        "id": {
+          "description": "Id of the job to grant permission on.",
+          "launch_stage": "GA"
+        },
+        "permission": {
+          "description": "Permissions to grant on the Job. Supported permissions are: \"CAN_MANAGE\", \"IS_OWNER\", \"CAN_MANAGE_RUN\", \"CAN_VIEW\".",
+          "ref": "apps.AppResourceJobJobPermission",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "apps.AppResourceJobJobPermission": {
+      "enum": [
+        "CAN_MANAGE",
+        "IS_OWNER",
+        "CAN_MANAGE_RUN",
+        "CAN_VIEW"
+      ],
+      "enum_launch_stages": {
+        "CAN_MANAGE": "GA",
+        "CAN_MANAGE_RUN": "GA",
+        "CAN_VIEW": "GA",
+        "IS_OWNER": "GA"
+      }
+    },
+    "apps.AppResourcePostgres": {
+      "fields": {
+        "branch": {
+          "launch_stage": "GA"
+        },
+        "database": {
+          "launch_stage": "GA"
+        },
+        "permission": {
+          "ref": "apps.AppResourcePostgresPostgresPermission",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "apps.AppResourcePostgresPostgresPermission": {
+      "enum": [
+        "CAN_CONNECT_AND_CREATE"
+      ],
+      "enum_launch_stages": {
+        "CAN_CONNECT_AND_CREATE": "GA"
+      }
+    },
+    "apps.AppResourceSecret": {
+      "fields": {
+        "key": {
+          "description": "Key of the secret to grant permission on.",
+          "launch_stage": "GA"
+        },
+        "permission": {
+          "description": "Permission to grant on the secret scope. For secrets, only one permission is allowed. Permission must be one of: \"READ\", \"WRITE\", \"MANAGE\".",
+          "ref": "apps.AppResourceSecretSecretPermission",
+          "launch_stage": "GA"
+        },
+        "scope": {
+          "description": "Scope of the secret to grant permission on.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "apps.AppResourceSecretSecretPermission": {
+      "description": "Permission to grant on the secret scope. Supported permissions are: \"READ\", \"WRITE\", \"MANAGE\".",
+      "enum": [
+        "READ",
+        "WRITE",
+        "MANAGE"
+      ],
+      "enum_launch_stages": {
+        "MANAGE": "GA",
+        "READ": "GA",
+        "WRITE": "GA"
+      }
+    },
+    "apps.AppResourceServingEndpoint": {
+      "fields": {
+        "name": {
+          "description": "Name of the serving endpoint to grant permission on.",
+          "launch_stage": "GA"
+        },
+        "permission": {
+          "description": "Permission to grant on the serving endpoint. Supported permissions are: \"CAN_MANAGE\", \"CAN_QUERY\", \"CAN_VIEW\".",
+          "ref": "apps.AppResourceServingEndpointServingEndpointPermission",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "apps.AppResourceServingEndpointServingEndpointPermission": {
+      "enum": [
+        "CAN_MANAGE",
+        "CAN_QUERY",
+        "CAN_VIEW"
+      ],
+      "enum_launch_stages": {
+        "CAN_MANAGE": "GA",
+        "CAN_QUERY": "GA",
+        "CAN_VIEW": "GA"
+      }
+    },
+    "apps.AppResourceSqlWarehouse": {
+      "fields": {
+        "id": {
+          "description": "Id of the SQL warehouse to grant permission on.",
+          "launch_stage": "GA"
+        },
+        "permission": {
+          "description": "Permission to grant on the SQL warehouse. Supported permissions are: \"CAN_MANAGE\", \"CAN_USE\", \"IS_OWNER\".",
+          "ref": "apps.AppResourceSqlWarehouseSqlWarehousePermission",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "apps.AppResourceSqlWarehouseSqlWarehousePermission": {
+      "enum": [
+        "CAN_MANAGE",
+        "CAN_USE",
+        "IS_OWNER"
+      ],
+      "enum_launch_stages": {
+        "CAN_MANAGE": "GA",
+        "CAN_USE": "GA",
+        "IS_OWNER": "GA"
+      }
+    },
+    "apps.AppResourceUcSecurable": {
+      "fields": {
+        "permission": {
+          "ref": "apps.AppResourceUcSecurableUcSecurablePermission",
+          "launch_stage": "GA"
+        },
+        "securable_full_name": {
+          "launch_stage": "GA"
+        },
+        "securable_kind": {
+          "description": "The securable kind from Unity Catalog.\nSee https://docs.databricks.com/api/workspace/tables/get#securable_kind_manifest-securable_kind.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "securable_type": {
+          "ref": "apps.AppResourceUcSecurableUcSecurableType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "apps.AppResourceUcSecurableUcSecurablePermission": {
+      "enum": [
+        "READ_VOLUME",
+        "WRITE_VOLUME",
+        "SELECT",
+        "EXECUTE",
+        "USE_CONNECTION",
+        "MODIFY"
+      ],
+      "enum_launch_stages": {
+        "EXECUTE": "GA",
+        "MODIFY": "GA",
+        "READ_VOLUME": "GA",
+        "SELECT": "GA",
+        "USE_CONNECTION": "GA",
+        "WRITE_VOLUME": "GA"
+      }
+    },
+    "apps.AppResourceUcSecurableUcSecurableType": {
+      "enum": [
+        "VOLUME",
+        "TABLE",
+        "FUNCTION",
+        "CONNECTION",
+        "MODEL_SERVICE"
+      ],
+      "enum_launch_stages": {
+        "CONNECTION": "GA",
+        "FUNCTION": "GA",
+        "MODEL_SERVICE": "GA",
+        "TABLE": "GA",
+        "VOLUME": "GA"
+      }
+    },
+    "apps.AppThumbnail": {
+      "description": "The thumbnail for an app.",
+      "fields": {
+        "thumbnail": {
+          "description": "The thumbnail image bytes.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "apps.AppUpdate": {
+      "fields": {
+        "budget_policy_id": {
+          "launch_stage": "GA"
+        },
+        "compute_max_instances": {
+          "description": "Maximum number of app instances the app is configured to run. Must be set together with `compute_min_instances`.",
+          "launch_stage": "GA"
+        },
+        "compute_min_instances": {
+          "description": "Minimum number of app instances the app is configured to run. Must be set together with `compute_max_instances`.",
+          "launch_stage": "GA"
+        },
+        "compute_size": {
+          "ref": "apps.ComputeSize",
+          "launch_stage": "GA"
+        },
+        "description": {
+          "launch_stage": "GA"
+        },
+        "forward_user_access_token": {
+          "description": "Forward the user's access token to the app. Requires stopping and starting app compute to take effect.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "git_repository": {
+          "ref": "apps.GitRepository",
+          "launch_stage": "GA"
+        },
+        "resources": {
+          "launch_stage": "GA"
+        },
+        "status": {
+          "ref": "apps.AppUpdateUpdateStatus",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "telemetry_export_destinations": {
+          "launch_stage": "GA"
+        },
+        "usage_policy_id": {
+          "launch_stage": "GA"
+        },
+        "user_api_scopes": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "apps.AppUpdateUpdateStatus": {
+      "fields": {
+        "message": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "state": {
+          "ref": "apps.AppUpdateUpdateStatusUpdateState",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "apps.AppUpdateUpdateStatusUpdateState": {
+      "enum": [
+        "NOT_UPDATED",
+        "IN_PROGRESS",
+        "SUCCEEDED",
+        "FAILED"
+      ],
+      "enum_launch_stages": {
+        "FAILED": "GA",
+        "IN_PROGRESS": "GA",
+        "NOT_UPDATED": "GA",
+        "SUCCEEDED": "GA"
+      }
+    },
+    "apps.ApplicationState": {
+      "enum": [
+        "DEPLOYING",
+        "RUNNING",
+        "CRASHED",
+        "UNAVAILABLE"
+      ],
+      "enum_launch_stages": {
+        "CRASHED": "GA",
+        "DEPLOYING": "GA",
+        "RUNNING": "GA",
+        "UNAVAILABLE": "GA"
+      }
+    },
+    "apps.ApplicationStatus": {
+      "fields": {
+        "message": {
+          "description": "Application status message",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "running_instances": {
+          "description": "The number of app instances whose application process is running.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "state": {
+          "description": "State of the application.",
+          "ref": "apps.ApplicationState",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "apps.AsyncUpdateAppRequest": {
+      "fields": {
+        "app": {
+          "ref": "apps.App",
+          "launch_stage": "GA"
+        },
+        "update_mask": {
+          "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "apps.ComputeSize": {
+      "enum": [
+        "MEDIUM",
+        "LARGE",
+        "XLARGE"
+      ],
+      "enum_launch_stages": {
+        "LARGE": "GA",
+        "MEDIUM": "GA",
+        "XLARGE": "GA"
+      }
+    },
+    "apps.ComputeState": {
+      "enum": [
+        "ERROR",
+        "DELETING",
+        "STARTING",
+        "STOPPING",
+        "UPDATING",
+        "STOPPED",
+        "ACTIVE"
+      ],
+      "enum_launch_stages": {
+        "ACTIVE": "GA",
+        "DELETING": "GA",
+        "ERROR": "GA",
+        "STARTING": "GA",
+        "STOPPED": "GA",
+        "STOPPING": "GA",
+        "UPDATING": "GA"
+      }
+    },
+    "apps.ComputeStatus": {
+      "fields": {
+        "active_instances": {
+          "description": "The number of active compute instances currently used and billed for this application.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "message": {
+          "description": "Compute status message",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "state": {
+          "description": "State of the app compute.",
+          "ref": "apps.ComputeState",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "apps.CreateAppDeploymentRequest": {
+      "fields": {
+        "app_deployment": {
+          "description": "The app deployment configuration.",
+          "ref": "apps.AppDeployment",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "apps.CreateAppRequest": {
+      "fields": {
+        "app": {
+          "ref": "apps.App",
+          "launch_stage": "GA"
+        },
+        "no_compute": {
+          "description": "If true, the app will not be started after creation.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "apps.CreateCustomTemplateRequest": {
+      "fields": {
+        "template": {
+          "ref": "apps.CustomTemplate",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "apps.CreateSpaceRequest": {
+      "fields": {
+        "space": {
+          "ref": "apps.Space",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "apps.CustomTemplate": {
+      "fields": {
+        "creator": {
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "description": {
+          "description": "The description of the template.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "git_provider": {
+          "description": "The Git provider of the template.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "git_repo": {
+          "description": "The Git repository URL that the template resides in.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "manifest": {
+          "description": "The manifest of the template. It defines fields and default values when installing the template.",
+          "ref": "apps.AppManifest",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "name": {
+          "description": "The name of the template. It must contain only alphanumeric characters, hyphens, underscores, and whitespaces.\nIt must be unique within the workspace.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "path": {
+          "description": "The path to the template within the Git repository.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "apps.DatabricksServiceExceptionWithDetailsProto": {
+      "description": "Databricks Error that is returned by all Databricks APIs.",
+      "fields": {
+        "details": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "error_code": {
+          "ref": "apps.ErrorCode",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "message": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "stack_trace": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "apps.DeleteAppRequest": {},
+    "apps.DeleteAppThumbnailRequest": {},
+    "apps.DeleteCustomTemplateRequest": {},
+    "apps.DeleteSpaceRequest": {},
+    "apps.EnvVar": {
+      "fields": {
+        "name": {
+          "description": "The name of the environment variable.",
+          "launch_stage": "GA"
+        },
+        "value": {
+          "description": "The value for the environment variable.",
+          "launch_stage": "GA"
+        },
+        "value_from": {
+          "description": "The name of an external Databricks resource that contains the value, such as a secret or a database table.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "apps.ErrorCode": {
+      "description": "Error codes returned by Databricks APIs to indicate specific failure conditions.",
+      "enum": [
+        "UNKNOWN",
+        "INTERNAL_ERROR",
+        "TEMPORARILY_UNAVAILABLE",
+        "IO_ERROR",
+        "BAD_REQUEST",
+        "SERVICE_UNDER_MAINTENANCE",
+        "WORKSPACE_TEMPORARILY_UNAVAILABLE",
+        "DEADLINE_EXCEEDED",
+        "CANCELLED",
+        "RESOURCE_EXHAUSTED",
+        "ABORTED",
+        "NOT_FOUND",
+        "ALREADY_EXISTS",
+        "UNAUTHENTICATED",
+        "UNAVAILABLE",
+        "INVALID_PARAMETER_VALUE",
+        "ENDPOINT_NOT_FOUND",
+        "MALFORMED_REQUEST",
+        "INVALID_STATE",
+        "PERMISSION_DENIED",
+        "FEATURE_DISABLED",
+        "CUSTOMER_UNAUTHORIZED",
+        "REQUEST_LIMIT_EXCEEDED",
+        "RESOURCE_CONFLICT",
+        "UNPARSEABLE_HTTP_ERROR",
+        "NOT_IMPLEMENTED",
+        "DATA_LOSS",
+        "INVALID_STATE_TRANSITION",
+        "COULD_NOT_ACQUIRE_LOCK",
+        "RESOURCE_ALREADY_EXISTS",
+        "RESOURCE_DOES_NOT_EXIST",
+        "QUOTA_EXCEEDED",
+        "MAX_BLOCK_SIZE_EXCEEDED",
+        "MAX_READ_SIZE_EXCEEDED",
+        "PARTIAL_DELETE",
+        "MAX_LIST_SIZE_EXCEEDED",
+        "DRY_RUN_FAILED",
+        "RESOURCE_LIMIT_EXCEEDED",
+        "DIRECTORY_NOT_EMPTY",
+        "DIRECTORY_PROTECTED",
+        "MAX_NOTEBOOK_SIZE_EXCEEDED",
+        "MAX_CHILD_NODE_SIZE_EXCEEDED",
+        "SEARCH_QUERY_TOO_LONG",
+        "SEARCH_QUERY_TOO_SHORT",
+        "MANAGED_RESOURCE_GROUP_DOES_NOT_EXIST",
+        "PERMISSION_NOT_PROPAGATED",
+        "DEPLOYMENT_TIMEOUT",
+        "GIT_CONFLICT",
+        "GIT_UNKNOWN_REF",
+        "GIT_SENSITIVE_TOKEN_DETECTED",
+        "GIT_URL_NOT_ON_ALLOW_LIST",
+        "GIT_REMOTE_ERROR",
+        "PROJECTS_OPERATION_TIMEOUT",
+        "IPYNB_FILE_IN_REPO",
+        "INSECURE_PARTNER_RESPONSE",
+        "MALFORMED_PARTNER_RESPONSE",
+        "METASTORE_DOES_NOT_EXIST",
+        "DAC_DOES_NOT_EXIST",
+        "CATALOG_DOES_NOT_EXIST",
+        "SCHEMA_DOES_NOT_EXIST",
+        "TABLE_DOES_NOT_EXIST",
+        "SHARE_DOES_NOT_EXIST",
+        "RECIPIENT_DOES_NOT_EXIST",
+        "STORAGE_CREDENTIAL_DOES_NOT_EXIST",
+        "EXTERNAL_LOCATION_DOES_NOT_EXIST",
+        "PRINCIPAL_DOES_NOT_EXIST",
+        "PROVIDER_DOES_NOT_EXIST",
+        "METASTORE_ALREADY_EXISTS",
+        "DAC_ALREADY_EXISTS",
+        "CATALOG_ALREADY_EXISTS",
+        "SCHEMA_ALREADY_EXISTS",
+        "TABLE_ALREADY_EXISTS",
+        "SHARE_ALREADY_EXISTS",
+        "RECIPIENT_ALREADY_EXISTS",
+        "STORAGE_CREDENTIAL_ALREADY_EXISTS",
+        "EXTERNAL_LOCATION_ALREADY_EXISTS",
+        "PROVIDER_ALREADY_EXISTS",
+        "CATALOG_NOT_EMPTY",
+        "SCHEMA_NOT_EMPTY",
+        "METASTORE_NOT_EMPTY",
+        "PROVIDER_SHARE_NOT_ACCESSIBLE"
+      ],
+      "enum_launch_stages": {
+        "ABORTED": "PRIVATE_PREVIEW",
+        "ALREADY_EXISTS": "PRIVATE_PREVIEW",
+        "BAD_REQUEST": "PRIVATE_PREVIEW",
+        "CANCELLED": "PRIVATE_PREVIEW",
+        "CATALOG_ALREADY_EXISTS": "PRIVATE_PREVIEW",
+        "CATALOG_DOES_NOT_EXIST": "PRIVATE_PREVIEW",
+        "CATALOG_NOT_EMPTY": "PRIVATE_PREVIEW",
+        "COULD_NOT_ACQUIRE_LOCK": "PRIVATE_PREVIEW",
+        "CUSTOMER_UNAUTHORIZED": "PRIVATE_PREVIEW",
+        "DAC_ALREADY_EXISTS": "PRIVATE_PREVIEW",
+        "DAC_DOES_NOT_EXIST": "PRIVATE_PREVIEW",
+        "DATA_LOSS": "PRIVATE_PREVIEW",
+        "DEADLINE_EXCEEDED": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_TIMEOUT": "PRIVATE_PREVIEW",
+        "DIRECTORY_NOT_EMPTY": "PRIVATE_PREVIEW",
+        "DIRECTORY_PROTECTED": "PRIVATE_PREVIEW",
+        "DRY_RUN_FAILED": "PRIVATE_PREVIEW",
+        "ENDPOINT_NOT_FOUND": "PRIVATE_PREVIEW",
+        "EXTERNAL_LOCATION_ALREADY_EXISTS": "PRIVATE_PREVIEW",
+        "EXTERNAL_LOCATION_DOES_NOT_EXIST": "PRIVATE_PREVIEW",
+        "FEATURE_DISABLED": "PRIVATE_PREVIEW",
+        "GIT_CONFLICT": "PRIVATE_PREVIEW",
+        "GIT_REMOTE_ERROR": "PRIVATE_PREVIEW",
+        "GIT_SENSITIVE_TOKEN_DETECTED": "PRIVATE_PREVIEW",
+        "GIT_UNKNOWN_REF": "PRIVATE_PREVIEW",
+        "GIT_URL_NOT_ON_ALLOW_LIST": "PRIVATE_PREVIEW",
+        "INSECURE_PARTNER_RESPONSE": "PRIVATE_PREVIEW",
+        "INTERNAL_ERROR": "PRIVATE_PREVIEW",
+        "INVALID_PARAMETER_VALUE": "PRIVATE_PREVIEW",
+        "INVALID_STATE": "PRIVATE_PREVIEW",
+        "INVALID_STATE_TRANSITION": "PRIVATE_PREVIEW",
+        "IO_ERROR": "PRIVATE_PREVIEW",
+        "IPYNB_FILE_IN_REPO": "PRIVATE_PREVIEW",
+        "MALFORMED_PARTNER_RESPONSE": "PRIVATE_PREVIEW",
+        "MALFORMED_REQUEST": "PRIVATE_PREVIEW",
+        "MANAGED_RESOURCE_GROUP_DOES_NOT_EXIST": "PRIVATE_PREVIEW",
+        "MAX_BLOCK_SIZE_EXCEEDED": "PRIVATE_PREVIEW",
+        "MAX_CHILD_NODE_SIZE_EXCEEDED": "PRIVATE_PREVIEW",
+        "MAX_LIST_SIZE_EXCEEDED": "PRIVATE_PREVIEW",
+        "MAX_NOTEBOOK_SIZE_EXCEEDED": "PRIVATE_PREVIEW",
+        "MAX_READ_SIZE_EXCEEDED": "PRIVATE_PREVIEW",
+        "METASTORE_ALREADY_EXISTS": "PRIVATE_PREVIEW",
+        "METASTORE_DOES_NOT_EXIST": "PRIVATE_PREVIEW",
+        "METASTORE_NOT_EMPTY": "PRIVATE_PREVIEW",
+        "NOT_FOUND": "PRIVATE_PREVIEW",
+        "NOT_IMPLEMENTED": "PRIVATE_PREVIEW",
+        "PARTIAL_DELETE": "PRIVATE_PREVIEW",
+        "PERMISSION_DENIED": "PRIVATE_PREVIEW",
+        "PERMISSION_NOT_PROPAGATED": "PRIVATE_PREVIEW",
+        "PRINCIPAL_DOES_NOT_EXIST": "PRIVATE_PREVIEW",
+        "PROJECTS_OPERATION_TIMEOUT": "PRIVATE_PREVIEW",
+        "PROVIDER_ALREADY_EXISTS": "PRIVATE_PREVIEW",
+        "PROVIDER_DOES_NOT_EXIST": "PRIVATE_PREVIEW",
+        "PROVIDER_SHARE_NOT_ACCESSIBLE": "PRIVATE_PREVIEW",
+        "QUOTA_EXCEEDED": "PRIVATE_PREVIEW",
+        "RECIPIENT_ALREADY_EXISTS": "PRIVATE_PREVIEW",
+        "RECIPIENT_DOES_NOT_EXIST": "PRIVATE_PREVIEW",
+        "REQUEST_LIMIT_EXCEEDED": "PRIVATE_PREVIEW",
+        "RESOURCE_ALREADY_EXISTS": "PRIVATE_PREVIEW",
+        "RESOURCE_CONFLICT": "PRIVATE_PREVIEW",
+        "RESOURCE_DOES_NOT_EXIST": "PRIVATE_PREVIEW",
+        "RESOURCE_EXHAUSTED": "PRIVATE_PREVIEW",
+        "RESOURCE_LIMIT_EXCEEDED": "PRIVATE_PREVIEW",
+        "SCHEMA_ALREADY_EXISTS": "PRIVATE_PREVIEW",
+        "SCHEMA_DOES_NOT_EXIST": "PRIVATE_PREVIEW",
+        "SCHEMA_NOT_EMPTY": "PRIVATE_PREVIEW",
+        "SEARCH_QUERY_TOO_LONG": "PRIVATE_PREVIEW",
+        "SEARCH_QUERY_TOO_SHORT": "PRIVATE_PREVIEW",
+        "SERVICE_UNDER_MAINTENANCE": "PRIVATE_PREVIEW",
+        "SHARE_ALREADY_EXISTS": "PRIVATE_PREVIEW",
+        "SHARE_DOES_NOT_EXIST": "PRIVATE_PREVIEW",
+        "STORAGE_CREDENTIAL_ALREADY_EXISTS": "PRIVATE_PREVIEW",
+        "STORAGE_CREDENTIAL_DOES_NOT_EXIST": "PRIVATE_PREVIEW",
+        "TABLE_ALREADY_EXISTS": "PRIVATE_PREVIEW",
+        "TABLE_DOES_NOT_EXIST": "PRIVATE_PREVIEW",
+        "TEMPORARILY_UNAVAILABLE": "PRIVATE_PREVIEW",
+        "UNAUTHENTICATED": "PRIVATE_PREVIEW",
+        "UNAVAILABLE": "PRIVATE_PREVIEW",
+        "UNKNOWN": "PRIVATE_PREVIEW",
+        "UNPARSEABLE_HTTP_ERROR": "PRIVATE_PREVIEW",
+        "WORKSPACE_TEMPORARILY_UNAVAILABLE": "PRIVATE_PREVIEW"
+      }
+    },
+    "apps.GetAppDeploymentRequest": {},
+    "apps.GetAppPermissionLevelsRequest": {},
+    "apps.GetAppPermissionLevelsResponse": {
+      "fields": {
+        "permission_levels": {
+          "description": "Specific permission levels",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "apps.GetAppPermissionsRequest": {},
+    "apps.GetAppRequest": {},
+    "apps.GetAppUpdateRequest": {},
+    "apps.GetCustomTemplateRequest": {},
+    "apps.GetOperationRequest": {},
+    "apps.GetSpaceRequest": {},
+    "apps.GitRepository": {
+      "description": "Git repository configuration specifying the location of the repository.",
+      "fields": {
+        "auto_deploy": {
+          "description": "When true, automatically deploys the app on push events to the branch configured in\nthe app's deployment_source.git_source.",
+          "launch_stage": "GA"
+        },
+        "caller_credential_id": {
+          "description": "ID of a personal access token Git credential owned by the caller, used to\ngrant the app's service principal access to this repository.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "INPUT_ONLY"
+          ]
+        },
+        "provider": {
+          "description": "Git provider. Case insensitive. Supported values: gitHub, gitHubEnterprise, bitbucketCloud,\nbitbucketServer, azureDevOpsServices, gitLab, gitLabEnterpriseEdition, awsCodeCommit.",
+          "launch_stage": "GA"
+        },
+        "url": {
+          "description": "URL of the Git repository.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "apps.GitSource": {
+      "description": "Complete git source specification including repository location and reference.",
+      "fields": {
+        "branch": {
+          "description": "Git branch to checkout.",
+          "launch_stage": "GA"
+        },
+        "commit": {
+          "description": "Git commit SHA to checkout.",
+          "launch_stage": "GA"
+        },
+        "git_repository": {
+          "description": "Git repository configuration. Populated from the app's git_repository configuration.",
+          "ref": "apps.GitRepository",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "resolved_commit": {
+          "description": "The resolved commit SHA that was actually used for the deployment. This is populated by the\nsystem after resolving the reference (branch, tag, or commit). If commit is specified\ndirectly, this will match commit. If a branch or tag is specified, this contains the\ncommit SHA that the branch or tag pointed to at deployment time.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "source_code_path": {
+          "description": "Relative path to the app source code within the Git repository. If not specified, the root\nof the repository is used.",
+          "launch_stage": "GA"
+        },
+        "tag": {
+          "description": "Git tag to checkout.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "apps.ListAppDeploymentsRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Upper bound for items returned.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Pagination token to go to the next page of apps. Requests first page if absent.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "apps.ListAppDeploymentsResponse": {
+      "fields": {
+        "app_deployments": {
+          "description": "Deployment history of the app.",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "Pagination token to request the next page of apps.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "apps.ListAppsRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Upper bound for items returned.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Pagination token to go to the next page of apps. Requests first page if absent.",
+          "launch_stage": "GA"
+        },
+        "space": {
+          "description": "Filter apps by app space name. When specified, only apps belonging to this space are returned.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "apps.ListAppsResponse": {
+      "fields": {
+        "apps": {
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "Pagination token to request the next page of apps.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "apps.ListCustomTemplatesRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Upper bound for items returned.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Pagination token to go to the next page of custom templates. Requests first page if absent.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "apps.ListCustomTemplatesResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "Pagination token to request the next page of custom templates.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "templates": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "apps.ListSpacesRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Upper bound for items returned.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Pagination token to go to the next page of app spaces. Requests first page if absent.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "apps.ListSpacesResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "Pagination token to request the next page of app spaces.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "spaces": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "apps.Operation": {
+      "description": "This resource represents a long-running operation that is the result of a\nnetwork API call.",
+      "fields": {
+        "done": {
+          "description": "If the value is `false`, it means the operation is still in progress.\nIf `true`, the operation is completed, and either `error` or `response` is\navailable.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "error": {
+          "description": "The error result of the operation in case of failure or cancellation.",
+          "ref": "apps.DatabricksServiceExceptionWithDetailsProto",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "metadata": {
+          "description": "Service-specific metadata associated with the operation.  It typically\ncontains progress information and common metadata such as create time.\nSome services might not provide such metadata.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "name": {
+          "description": "The server-assigned name, which is only unique within the same service that\noriginally returns it. If you use the default HTTP mapping, the\n`name` should be a resource name ending with `operations/{unique_id}`.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "response": {
+          "description": "The normal, successful response of the operation.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "apps.Space": {
+      "fields": {
+        "assume_group_id": {
+          "description": "The group whose permissions users assume via Role Authorization for apps in this space. When\nset, user tokens assume the role of this group instead of doing regular obo token downscoping.\nSet only at space creation.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "create_time": {
+          "description": "The creation time of the app space. Formatted timestamp in ISO 6801.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "creator": {
+          "description": "The email of the user that created the app space.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "description": {
+          "description": "The description of the app space.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "effective_usage_policy_id": {
+          "description": "The effective usage policy ID used by apps in the space.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "effective_user_api_scopes": {
+          "description": "The effective api scopes granted to the user access token.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "id": {
+          "description": "The unique identifier of the app space.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "The name of the app space. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "resources": {
+          "description": "Resources for the app space. Resources configured at the space level are available to all apps in the space.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "service_principal_client_id": {
+          "description": "The service principal client ID for the app space.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "service_principal_id": {
+          "description": "The service principal ID for the app space.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "service_principal_name": {
+          "description": "The service principal name for the app space.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "status": {
+          "description": "The status of the app space.",
+          "ref": "apps.SpaceStatus",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "update_time": {
+          "description": "The update time of the app space. Formatted timestamp in ISO 6801.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "updater": {
+          "description": "The email of the user that last updated the app space.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "usage_policy_id": {
+          "description": "The usage policy ID for managing cost at the space level.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "user_api_scopes": {
+          "description": "OAuth scopes for apps in the space.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "apps.SpaceStatus": {
+      "fields": {
+        "message": {
+          "description": "Message providing context about the current state.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "state": {
+          "description": "The state of the app space.",
+          "ref": "apps.SpaceStatusSpaceState",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "apps.SpaceStatusSpaceState": {
+      "enum": [
+        "SPACE_CREATING",
+        "SPACE_ACTIVE",
+        "SPACE_ERROR",
+        "SPACE_DELETING",
+        "SPACE_DELETED",
+        "SPACE_UPDATING"
+      ],
+      "enum_launch_stages": {
+        "SPACE_ACTIVE": "PRIVATE_PREVIEW",
+        "SPACE_CREATING": "PRIVATE_PREVIEW",
+        "SPACE_DELETED": "PRIVATE_PREVIEW",
+        "SPACE_DELETING": "PRIVATE_PREVIEW",
+        "SPACE_ERROR": "PRIVATE_PREVIEW",
+        "SPACE_UPDATING": "PRIVATE_PREVIEW"
+      }
+    },
+    "apps.SpaceUpdate": {
+      "description": "Tracks app space update information.",
+      "fields": {
+        "description": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "resources": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "status": {
+          "ref": "apps.SpaceUpdateStatus",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "usage_policy_id": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "user_api_scopes": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "apps.SpaceUpdateState": {
+      "enum": [
+        "NOT_UPDATED",
+        "IN_PROGRESS",
+        "SUCCEEDED",
+        "FAILED"
+      ],
+      "enum_launch_stages": {
+        "FAILED": "PRIVATE_PREVIEW",
+        "IN_PROGRESS": "PRIVATE_PREVIEW",
+        "NOT_UPDATED": "PRIVATE_PREVIEW",
+        "SUCCEEDED": "PRIVATE_PREVIEW"
+      }
+    },
+    "apps.SpaceUpdateStatus": {
+      "description": "Status of an app space update operation",
+      "fields": {
+        "message": {
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "state": {
+          "ref": "apps.SpaceUpdateState",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "apps.StartAppRequest": {},
+    "apps.StopAppRequest": {},
+    "apps.TelemetryExportDestination": {
+      "description": "A single telemetry export destination with its configuration and status.",
+      "fields": {
+        "unity_catalog": {
+          "ref": "apps.UnityCatalog",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "apps.UnityCatalog": {
+      "description": "Unity Catalog Destinations for OTEL telemetry export.",
+      "fields": {
+        "logs_table": {
+          "description": "Unity Catalog table for OTEL logs.",
+          "launch_stage": "GA"
+        },
+        "metrics_table": {
+          "description": "Unity Catalog table for OTEL metrics.",
+          "launch_stage": "GA"
+        },
+        "traces_table": {
+          "description": "Unity Catalog table for OTEL traces (spans).",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "apps.UpdateAppRequest": {
+      "fields": {
+        "app": {
+          "ref": "apps.App",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "apps.UpdateAppThumbnailRequest": {
+      "fields": {
+        "app_thumbnail": {
+          "description": "The app thumbnail to set.",
+          "ref": "apps.AppThumbnail",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "apps.UpdateCustomTemplateRequest": {
+      "fields": {
+        "template": {
+          "ref": "apps.CustomTemplate",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "apps.UpdateSpaceRequest": {
+      "fields": {
+        "space": {
+          "ref": "apps.Space",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "update_mask": {
+          "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "billing.ActionConfiguration": {
+      "fields": {
+        "action_configuration_id": {
+          "description": "Databricks action configuration ID.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "action_type": {
+          "description": "The type of the action.",
+          "ref": "billing.ActionConfigurationType",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "target": {
+          "description": "Target for the action. For example, an email address.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "billing.ActionConfigurationType": {
+      "description": "Type of action that a budget alert executes when its threshold is crossed.",
+      "enum": [
+        "EMAIL_NOTIFICATION",
+        "BLOCK_USAGE"
+      ],
+      "enum_launch_stages": {
+        "BLOCK_USAGE": "PUBLIC_BETA",
+        "EMAIL_NOTIFICATION": "PUBLIC_PREVIEW"
+      }
+    },
+    "billing.AlertConfiguration": {
+      "fields": {
+        "action_configurations": {
+          "description": "Configured actions for this alert. These define what happens when an alert enters a triggered state.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "alert_configuration_id": {
+          "description": "Databricks alert configuration ID.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "principal_overrides": {
+          "description": "Per-principal threshold overrides for this alert. Only applies to per-user alerts (`scope_type` = `ALERT_CONFIGURATION_SCOPE_TYPE_PER_USER`); ignored for shared alerts.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "quantity_threshold": {
+          "description": "The threshold for the budget alert to determine if it is in a triggered state. The number is evaluated based on `quantity_type`.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "quantity_type": {
+          "description": "The way to calculate cost for this budget alert. This is what `quantity_threshold` is measured in.",
+          "ref": "billing.AlertConfigurationQuantityType",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "scope_type": {
+          "description": "How the alert threshold is evaluated. Determines whether spend is tracked in aggregate or per individual user.",
+          "ref": "billing.AlertConfigurationScopeType",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "time_period": {
+          "description": "The time window of usage data for the budget.",
+          "ref": "billing.AlertConfigurationTimePeriod",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "trigger_type": {
+          "description": "The evaluation method to determine when this budget alert is in a triggered state.",
+          "ref": "billing.AlertConfigurationTriggerType",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "billing.AlertConfigurationQuantityType": {
+      "enum": [
+        "LIST_PRICE_DOLLARS_USD"
+      ],
+      "enum_launch_stages": {
+        "LIST_PRICE_DOLLARS_USD": "PUBLIC_PREVIEW"
+      }
+    },
+    "billing.AlertConfigurationScopeType": {
+      "description": "Evaluation scope for an alert configuration.",
+      "enum": [
+        "ALERT_CONFIGURATION_SCOPE_TYPE_SHARED",
+        "ALERT_CONFIGURATION_SCOPE_TYPE_PER_USER"
+      ],
+      "enum_launch_stages": {
+        "ALERT_CONFIGURATION_SCOPE_TYPE_PER_USER": "PUBLIC_BETA",
+        "ALERT_CONFIGURATION_SCOPE_TYPE_SHARED": "PUBLIC_BETA"
+      }
+    },
+    "billing.AlertConfigurationTimePeriod": {
+      "enum": [
+        "MONTH"
+      ],
+      "enum_launch_stages": {
+        "MONTH": "PUBLIC_PREVIEW"
+      }
+    },
+    "billing.AlertConfigurationTriggerType": {
+      "enum": [
+        "CUMULATIVE_SPENDING_EXCEEDED"
+      ],
+      "enum_launch_stages": {
+        "CUMULATIVE_SPENDING_EXCEEDED": "PUBLIC_PREVIEW"
+      }
+    },
+    "billing.BudgetConfiguration": {
+      "fields": {
+        "account_id": {
+          "description": "Databricks account ID.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "alert_configurations": {
+          "description": "Alerts to configure when this budget is in a triggered state. Budgets must have exactly one alert configuration.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "budget_configuration_id": {
+          "description": "Databricks budget configuration ID.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "create_time": {
+          "description": "Creation time of this budget configuration.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "display_name": {
+          "description": "Human-readable name of budget configuration. Max Length: 128",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "filter": {
+          "description": "Configured filters for this budget. These are applied to your account's usage to limit the scope of what is considered for this budget.\nLeave empty to include all usage for this account. All provided filters must be matched for usage to be included.",
+          "ref": "billing.BudgetConfigurationFilter",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "resource_type": {
+          "description": "The resource scope for this budget. Determines whether the budget tracks all resources or a specific resource.",
+          "ref": "billing.BudgetResourceType",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "update_time": {
+          "description": "Update time of this budget configuration.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "billing.BudgetConfigurationFilter": {
+      "fields": {
+        "tags": {
+          "description": "A list of tag keys and values that will limit the budget to usage that includes those specific custom tags.\nTags are case-sensitive and should be entered exactly as they appear in your usage data.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "workspace_id": {
+          "description": "If provided, usage must match with the provided Databricks workspace IDs.",
+          "ref": "billing.BudgetConfigurationFilterWorkspaceIdClause",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "billing.BudgetConfigurationFilterClause": {
+      "fields": {
+        "operator": {
+          "ref": "billing.BudgetConfigurationFilterOperator",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "values": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "billing.BudgetConfigurationFilterOperator": {
+      "enum": [
+        "IN"
+      ],
+      "enum_launch_stages": {
+        "IN": "PUBLIC_PREVIEW"
+      }
+    },
+    "billing.BudgetConfigurationFilterTagClause": {
+      "fields": {
+        "key": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "value": {
+          "ref": "billing.BudgetConfigurationFilterClause",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "billing.BudgetConfigurationFilterWorkspaceIdClause": {
+      "fields": {
+        "operator": {
+          "ref": "billing.BudgetConfigurationFilterOperator",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "values": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "billing.BudgetPolicy": {
+      "description": "Contains the BudgetPolicy details.",
+      "fields": {
+        "binding_workspace_ids": {
+          "description": "List of workspaces that this budget policy will be exclusively bound to.\nAn empty binding implies that this budget policy is open to any workspace in the account.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "custom_tags": {
+          "description": "A list of tags defined by the customer. At most 20 entries are allowed per policy.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "policy_id": {
+          "description": "The Id of the policy. This field is generated by Databricks and globally unique.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "policy_name": {
+          "description": "The name of the policy.\n- Must be unique among active policies.\n- Can contain only characters from the ISO 8859-1 (latin1) set.\n- Can't start with reserved keywords such as `databricks:default-policy`.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "billing.BudgetResourceType": {
+      "description": "Resource scope for a budget configuration. Determines whether the budget tracks all\nresources or a specific resource.",
+      "enum": [
+        "BUDGET_RESOURCE_TYPE_ALL_RESOURCES",
+        "BUDGET_RESOURCE_TYPE_UNITY_AI_GATEWAY"
+      ],
+      "enum_launch_stages": {
+        "BUDGET_RESOURCE_TYPE_ALL_RESOURCES": "PUBLIC_BETA",
+        "BUDGET_RESOURCE_TYPE_UNITY_AI_GATEWAY": "PUBLIC_BETA"
+      }
+    },
+    "billing.CreateBillingUsageDashboardRequest": {
+      "fields": {
+        "dashboard_type": {
+          "description": "Workspace level usage dashboard shows usage data for the specified workspace ID. Global level usage dashboard shows usage data for all workspaces in the account.",
+          "ref": "billing.UsageDashboardType",
+          "launch_stage": "GA"
+        },
+        "major_version": {
+          "description": "The major version of the usage dashboard template to use. Defaults to VERSION_1.",
+          "ref": "billing.UsageDashboardMajorVersion",
+          "launch_stage": "GA"
+        },
+        "workspace_id": {
+          "description": "The workspace ID of the workspace in which the usage dashboard is created.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "billing.CreateBillingUsageDashboardResponse": {
+      "fields": {
+        "dashboard_id": {
+          "description": "The unique id of the usage dashboard.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "billing.CreateBudgetConfigurationBudget": {
+      "fields": {
+        "account_id": {
+          "description": "Databricks account ID.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "alert_configurations": {
+          "description": "Alerts to configure when this budget is in a triggered state. Budgets must have exactly one alert configuration.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "display_name": {
+          "description": "Human-readable name of budget configuration. Max Length: 128",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "filter": {
+          "description": "Configured filters for this budget. These are applied to your account's usage to limit the scope of what is considered for this budget.\nLeave empty to include all usage for this account. All provided filters must be matched for usage to be included.",
+          "ref": "billing.BudgetConfigurationFilter",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "resource_type": {
+          "description": "The resource scope for this budget. Determines whether the budget tracks all resources or a specific resource.",
+          "ref": "billing.BudgetResourceType",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "billing.CreateBudgetConfigurationBudgetActionConfigurations": {
+      "fields": {
+        "action_type": {
+          "description": "The type of the action.",
+          "ref": "billing.ActionConfigurationType",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "target": {
+          "description": "Target for the action. For example, an email address.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "billing.CreateBudgetConfigurationBudgetAlertConfigurations": {
+      "fields": {
+        "action_configurations": {
+          "description": "Configured actions for this alert. These define what happens when an alert enters a triggered state.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "principal_overrides": {
+          "description": "Per-principal threshold overrides for this alert. Only applies to per-user alerts (`scope_type` = `ALERT_CONFIGURATION_SCOPE_TYPE_PER_USER`); ignored for shared alerts.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "quantity_threshold": {
+          "description": "The threshold for the budget alert to determine if it is in a triggered state. The number is evaluated based on `quantity_type`.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "quantity_type": {
+          "description": "The way to calculate cost for this budget alert. This is what `quantity_threshold` is measured in.",
+          "ref": "billing.AlertConfigurationQuantityType",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "scope_type": {
+          "description": "How the alert threshold is evaluated. Determines whether spend is tracked in aggregate or per individual user.",
+          "ref": "billing.AlertConfigurationScopeType",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "time_period": {
+          "description": "The time window of usage data for the budget.",
+          "ref": "billing.AlertConfigurationTimePeriod",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "trigger_type": {
+          "description": "The evaluation method to determine when this budget alert is in a triggered state.",
+          "ref": "billing.AlertConfigurationTriggerType",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "billing.CreateBudgetConfigurationRequest": {
+      "fields": {
+        "budget": {
+          "description": "Properties of the new budget configuration.",
+          "ref": "billing.CreateBudgetConfigurationBudget",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "billing.CreateBudgetConfigurationResponse": {
+      "fields": {
+        "budget": {
+          "description": "The created budget configuration.",
+          "ref": "billing.BudgetConfiguration",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "billing.CreateBudgetPolicyRequest": {
+      "description": "A request to create a BudgetPolicy.",
+      "fields": {
+        "policy": {
+          "description": "The policy to create. `policy_id` needs to be empty as it will be generated\n`policy_name` must be provided, custom_tags may need to be provided\ndepending on the cloud provider. All other fields are optional.",
+          "ref": "billing.BudgetPolicy",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "request_id": {
+          "description": "A unique identifier for this request. Restricted to 36 ASCII characters.\nA random UUID is recommended.\nThis request is only idempotent if a `request_id` is provided.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "billing.CreateLogDeliveryConfigurationParams": {
+      "description": "*\nLog Delivery Configuration",
+      "fields": {
+        "config_name": {
+          "description": "The optional human-readable name of the log delivery configuration. Defaults to empty.",
+          "launch_stage": "GA"
+        },
+        "credentials_id": {
+          "description": "The ID for a method:credentials/create that represents the AWS IAM role with policy and trust relationship as described in the main billable usage documentation page. See [Configure billable usage delivery](https://docs.databricks.com/administration-guide/account-settings/billable-usage-delivery.html).",
+          "launch_stage": "GA"
+        },
+        "delivery_path_prefix": {
+          "description": "The optional delivery path prefix within Amazon S3 storage. Defaults to empty, which means that logs are delivered to the root of the bucket. This must be a valid S3 object key. This must not start or end with a slash character.",
+          "launch_stage": "GA"
+        },
+        "delivery_start_time": {
+          "description": "This field applies only if log_type is BILLABLE_USAGE. This is the optional start month and year for delivery, specified in YYYY-MM format. Defaults to current year and month. BILLABLE_USAGE logs are not available for usage before March 2019 (2019-03).",
+          "launch_stage": "GA"
+        },
+        "log_type": {
+          "description": "Log delivery type. Supported values are:\n* `BILLABLE_USAGE` — Configure [billable usage log delivery](https://docs.databricks.com/administration-guide/account-settings/billable-usage-delivery.html). For the CSV schema, see the [View billable usage](https://docs.databricks.com/administration-guide/account-settings/usage.html).\n* `AUDIT_LOGS` — Configure [audit log delivery](https://docs.databricks.com/administration-guide/account-settings/audit-logs.html). For the JSON schema, see [Configure audit logging](https://docs.databricks.com/administration-guide/account-settings/audit-logs.html)",
+          "ref": "billing.LogType",
+          "launch_stage": "GA"
+        },
+        "output_format": {
+          "description": "The file type of log delivery.\n* If `log_type` is `BILLABLE_USAGE`, this value must be `CSV`. Only the CSV (comma-separated values) format is supported. For the schema, see the [View billable usage](https://docs.databricks.com/administration-guide/account-settings/usage.html)\n* If `log_type` is `AUDIT_LOGS`, this value must be `JSON`. Only the JSON (JavaScript Object Notation) format is supported. For the schema, see the [Configuring audit logs](https://docs.databricks.com/administration-guide/account-settings/audit-logs.html).",
+          "ref": "billing.OutputFormat",
+          "launch_stage": "GA"
+        },
+        "status": {
+          "description": "Status of log delivery configuration. Set to `ENABLED` (enabled) or `DISABLED` (disabled). Defaults to `ENABLED`. You can [enable or disable the configuration](#operation/patch-log-delivery-config-status) later. Deletion of a configuration is not supported, so disable a log delivery configuration that is no longer needed.",
+          "ref": "billing.LogDeliveryConfigStatus",
+          "launch_stage": "GA"
+        },
+        "storage_configuration_id": {
+          "description": "The ID for a method:storage/create  that represents the S3 bucket with bucket policy as described in the main billable usage documentation page. See [Configure billable usage delivery](https://docs.databricks.com/administration-guide/account-settings/billable-usage-delivery.html).",
+          "launch_stage": "GA"
+        },
+        "workspace_ids_filter": {
+          "description": "Optional filter that specifies workspace IDs to deliver logs for. By default the workspace filter is empty and log delivery applies at the account level, delivering workspace-level logs for all workspaces in your account, plus account level logs. You can optionally set this field to an array of workspace IDs (each one is an `int64`) to which log delivery should apply, in which case only workspace-level logs relating to the specified workspaces are delivered. If you plan to use different log delivery configurations for different workspaces, set this field explicitly. Be aware that delivery configurations mentioning specific workspaces won't apply to new workspaces created in the future, and delivery won't include account level logs. For some types of Databricks deployments there is only one workspace per account ID, so this field is unnecessary.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "billing.DeleteBudgetConfigurationRequest": {},
+    "billing.DeleteBudgetConfigurationResponse": {},
+    "billing.DeleteBudgetPolicyRequest": {},
+    "billing.DeliveryStatus": {
+      "description": "*\nThe status string for log delivery. Possible values are:\n`CREATED`: There were no log delivery attempts since the config was created.\n`SUCCEEDED`: The latest attempt of log delivery has succeeded completely.\n`USER_FAILURE`: The latest attempt of log delivery failed because of misconfiguration of customer provided permissions on role or storage.\n`SYSTEM_FAILURE`: The latest attempt of log delivery failed because of an Databricks internal error. Contact support if it doesn't go away soon.\n`NOT_FOUND`: The log delivery status as the configuration has been disabled since the release of this feature or there are no workspaces in the account.",
+      "enum": [
+        "CREATED",
+        "SUCCEEDED",
+        "USER_FAILURE",
+        "SYSTEM_FAILURE",
+        "NOT_FOUND"
+      ],
+      "enum_launch_stages": {
+        "CREATED": "GA",
+        "NOT_FOUND": "GA",
+        "SUCCEEDED": "GA",
+        "SYSTEM_FAILURE": "GA",
+        "USER_FAILURE": "GA"
+      }
+    },
+    "billing.DownloadRequest": {
+      "fields": {
+        "end_month": {
+          "description": "Format: `YYYY-MM`. Last month to return billable usage logs for.\nThis field is required.",
+          "launch_stage": "GA"
+        },
+        "personal_data": {
+          "description": "Specify whether to include personally identifiable information in\nthe billable usage logs, for example the email addresses of cluster\ncreators. Handle this information with care. Defaults to false.",
+          "launch_stage": "GA"
+        },
+        "start_month": {
+          "description": "Format specification for month in the format `YYYY-MM`. This is\nused to specify billable usage `start_month` and `end_month`\nproperties. **Note**: Billable usage logs are unavailable before\nMarch 2019 (`2019-03`).",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "billing.DownloadResponse": {
+      "fields": {
+        "contents": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "billing.Filter": {
+      "description": "Structured representation of a filter to be applied to a list of policies. All specified filters\nwill be applied in conjunction.",
+      "fields": {
+        "creator_user_id": {
+          "description": "The policy creator user id to be filtered on.\nIf unspecified, all policies will be returned.",
+          "deprecated": true,
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "creator_user_name": {
+          "description": "Deprecated: Do not use this field in new integrations. Creator filtering will be removed in a\nfuture version.\nThe policy creator user name to be filtered on.\nIf unspecified, all policies will be returned.",
+          "deprecated": true,
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "policy_name": {
+          "description": "The partial name of policies to be filtered on.\nIf unspecified, all policies will be returned.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "billing.GetBillingUsageDashboardRequest": {
+      "fields": {
+        "dashboard_type": {
+          "description": "Workspace level usage dashboard shows usage data for the specified workspace ID. Global level usage dashboard shows usage data for all workspaces in the account.",
+          "ref": "billing.UsageDashboardType",
+          "launch_stage": "GA"
+        },
+        "workspace_id": {
+          "description": "The workspace ID of the workspace in which the usage dashboard is created.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "billing.GetBillingUsageDashboardResponse": {
+      "fields": {
+        "dashboard_id": {
+          "description": "The unique id of the usage dashboard.",
+          "launch_stage": "GA"
+        },
+        "dashboard_url": {
+          "description": "The URL of the usage dashboard.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "billing.GetBudgetConfigurationRequest": {},
+    "billing.GetBudgetConfigurationResponse": {
+      "fields": {
+        "budget": {
+          "ref": "billing.BudgetConfiguration",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "billing.GetBudgetPolicyRequest": {},
+    "billing.GetLogDeliveryConfigurationResponse": {
+      "fields": {
+        "log_delivery_configuration": {
+          "description": "The fetched log delivery configuration",
+          "ref": "billing.LogDeliveryConfiguration",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "billing.GetLogDeliveryRequest": {},
+    "billing.LimitConfig": {
+      "description": "The limit configuration of the policy.\nLimit configuration provide a budget policy level cost control by enforcing the limit."
+    },
+    "billing.ListBudgetConfigurationsRequest": {
+      "fields": {
+        "page_token": {
+          "description": "A page token received from a previous get all budget configurations call. This token can be used to retrieve the subsequent page.\nRequests first page if absent.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "billing.ListBudgetConfigurationsResponse": {
+      "fields": {
+        "budgets": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "next_page_token": {
+          "description": "Token which can be sent as `page_token` to retrieve the next page of results. If this field is omitted, there are no subsequent budgets.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "billing.ListBudgetPoliciesRequest": {
+      "fields": {
+        "filter_by": {
+          "description": "A filter to apply to the list of policies.",
+          "ref": "billing.Filter",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_size": {
+          "description": "The maximum number of budget policies to return.\nIf unspecified, at most 100 budget policies will be returned.\nThe maximum value is 1000; values above 1000 will be coerced to 1000.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "A page token, received from a previous `ListServerlessPolicies` call.\nProvide this to retrieve the subsequent page.\nIf unspecified, the first page will be returned.\n\nWhen paginating, all other parameters provided to `ListServerlessPoliciesRequest` must match\nthe call that provided the page token.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "sort_spec": {
+          "description": "The sort specification.",
+          "ref": "billing.SortSpec",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "billing.ListBudgetPoliciesResponse": {
+      "description": "A list of policies.",
+      "fields": {
+        "next_page_token": {
+          "description": "A token that can be sent as `page_token` to retrieve the next page.\nIf this field is omitted, there are no subsequent pages.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "policies": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "previous_page_token": {
+          "description": "A token that can be sent as `page_token` to retrieve the previous page.\nIn this field is omitted, there are no previous pages.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "billing.ListLogDeliveryRequest": {
+      "fields": {
+        "credentials_id": {
+          "description": "The Credentials id to filter the search results with",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "A page token received from a previous get all budget configurations call. This token can be used to retrieve the subsequent page.\nRequests first page if absent.",
+          "launch_stage": "GA"
+        },
+        "status": {
+          "description": "The log delivery status to filter the search results with",
+          "ref": "billing.LogDeliveryConfigStatus",
+          "launch_stage": "GA"
+        },
+        "storage_configuration_id": {
+          "description": "The Storage Configuration id to filter the search results with",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "billing.LogDeliveryConfigStatus": {
+      "description": "*\nLog Delivery Status\n\n`ENABLED`: All dependencies have executed and succeeded\n`DISABLED`: At least one dependency has succeeded",
+      "enum": [
+        "ENABLED",
+        "DISABLED"
+      ],
+      "enum_launch_stages": {
+        "DISABLED": "GA",
+        "ENABLED": "GA"
+      }
+    },
+    "billing.LogDeliveryConfiguration": {
+      "description": "*\nLog Delivery Configuration",
+      "fields": {
+        "account_id": {
+          "description": "Databricks account ID.",
+          "launch_stage": "GA"
+        },
+        "config_id": {
+          "description": "The unique UUID of log delivery configuration",
+          "launch_stage": "GA"
+        },
+        "config_name": {
+          "description": "The optional human-readable name of the log delivery configuration. Defaults to empty.",
+          "launch_stage": "GA"
+        },
+        "creation_time": {
+          "description": "Time in epoch milliseconds when the log delivery configuration was created.",
+          "launch_stage": "GA"
+        },
+        "credentials_id": {
+          "description": "The ID for a method:credentials/create that represents the AWS IAM role with policy and trust relationship as described in the main billable usage documentation page. See [Configure billable usage delivery](https://docs.databricks.com/administration-guide/account-settings/billable-usage-delivery.html).",
+          "launch_stage": "GA"
+        },
+        "delivery_path_prefix": {
+          "description": "The optional delivery path prefix within Amazon S3 storage. Defaults to empty, which means that logs are delivered to the root of the bucket. This must be a valid S3 object key. This must not start or end with a slash character.",
+          "launch_stage": "GA"
+        },
+        "delivery_start_time": {
+          "description": "This field applies only if log_type is BILLABLE_USAGE. This is the optional start month and year for delivery, specified in YYYY-MM format. Defaults to current year and month. BILLABLE_USAGE logs are not available for usage before March 2019 (2019-03).",
+          "launch_stage": "GA"
+        },
+        "log_delivery_status": {
+          "description": "The LogDeliveryStatus of this log delivery configuration",
+          "ref": "billing.LogDeliveryStatus",
+          "launch_stage": "GA"
+        },
+        "log_type": {
+          "description": "Log delivery type. Supported values are:\n* `BILLABLE_USAGE` — Configure [billable usage log delivery](https://docs.databricks.com/administration-guide/account-settings/billable-usage-delivery.html). For the CSV schema, see the [View billable usage](https://docs.databricks.com/administration-guide/account-settings/usage.html).\n* `AUDIT_LOGS` — Configure [audit log delivery](https://docs.databricks.com/administration-guide/account-settings/audit-logs.html). For the JSON schema, see [Configure audit logging](https://docs.databricks.com/administration-guide/account-settings/audit-logs.html)",
+          "ref": "billing.LogType",
+          "launch_stage": "GA"
+        },
+        "output_format": {
+          "description": "The file type of log delivery.\n* If `log_type` is `BILLABLE_USAGE`, this value must be `CSV`. Only the CSV (comma-separated values) format is supported. For the schema, see the [View billable usage](https://docs.databricks.com/administration-guide/account-settings/usage.html)\n* If `log_type` is `AUDIT_LOGS`, this value must be `JSON`. Only the JSON (JavaScript Object Notation) format is supported. For the schema, see the [Configuring audit logs](https://docs.databricks.com/administration-guide/account-settings/audit-logs.html).",
+          "ref": "billing.OutputFormat",
+          "launch_stage": "GA"
+        },
+        "status": {
+          "description": "Status of log delivery configuration. Set to `ENABLED` (enabled) or `DISABLED` (disabled). Defaults to `ENABLED`. You can [enable or disable the configuration](#operation/patch-log-delivery-config-status) later. Deletion of a configuration is not supported, so disable a log delivery configuration that is no longer needed.",
+          "ref": "billing.LogDeliveryConfigStatus",
+          "launch_stage": "GA"
+        },
+        "storage_configuration_id": {
+          "description": "The ID for a method:storage/create  that represents the S3 bucket with bucket policy as described in the main billable usage documentation page. See [Configure billable usage delivery](https://docs.databricks.com/administration-guide/account-settings/billable-usage-delivery.html).",
+          "launch_stage": "GA"
+        },
+        "update_time": {
+          "description": "Time in epoch milliseconds when the log delivery configuration was updated.",
+          "launch_stage": "GA"
+        },
+        "workspace_ids_filter": {
+          "description": "Optional filter that specifies workspace IDs to deliver logs for. By default the workspace filter is empty and log delivery applies at the account level, delivering workspace-level logs for all workspaces in your account, plus account level logs. You can optionally set this field to an array of workspace IDs (each one is an `int64`) to which log delivery should apply, in which case only workspace-level logs relating to the specified workspaces are delivered. If you plan to use different log delivery configurations for different workspaces, set this field explicitly. Be aware that delivery configurations mentioning specific workspaces won't apply to new workspaces created in the future, and delivery won't include account level logs. For some types of Databricks deployments there is only one workspace per account ID, so this field is unnecessary.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "billing.LogDeliveryStatus": {
+      "fields": {
+        "last_attempt_time": {
+          "description": "The UTC time for the latest log delivery attempt.",
+          "launch_stage": "GA"
+        },
+        "last_successful_attempt_time": {
+          "description": "The UTC time for the latest successful log delivery.",
+          "launch_stage": "GA"
+        },
+        "message": {
+          "description": "Informative message about the latest log delivery attempt. If the log delivery fails with USER_FAILURE, error details will be provided for fixing misconfigurations in cloud permissions.",
+          "launch_stage": "GA"
+        },
+        "status": {
+          "description": "Enum that describes the status. Possible values are:\n* `CREATED`: There were no log delivery attempts since the config was created.\n* `SUCCEEDED`: The latest attempt of log delivery has succeeded completely.\n* `USER_FAILURE`: The latest attempt of log delivery failed because of misconfiguration of customer provided permissions on role or storage.\n* `SYSTEM_FAILURE`: The latest attempt of log delivery failed because of an Databricks internal error. Contact support if it doesn't go away soon.\n* `NOT_FOUND`: The log delivery status as the configuration has been disabled since the release of this feature or there are no workspaces in the account.",
+          "ref": "billing.DeliveryStatus",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "billing.LogType": {
+      "description": "*\nLog Delivery Type",
+      "enum": [
+        "BILLABLE_USAGE",
+        "AUDIT_LOGS"
+      ],
+      "enum_launch_stages": {
+        "AUDIT_LOGS": "GA",
+        "BILLABLE_USAGE": "GA"
+      }
+    },
+    "billing.OutputFormat": {
+      "description": "*\nLog Delivery Output Format",
+      "enum": [
+        "CSV",
+        "JSON"
+      ],
+      "enum_launch_stages": {
+        "CSV": "GA",
+        "JSON": "GA"
+      }
+    },
+    "billing.PatchStatusResponse": {},
+    "billing.PrincipalOverride": {
+      "description": "Per-principal threshold override on a PER_USER alert: bumps the alert's quantity_threshold for one principal_id.",
+      "fields": {
+        "override_threshold": {
+          "description": "Dollar amount that overrides the parent alert's quantity_threshold for this principal.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "principal_id": {
+          "description": "Account-level principal id (user, group, or service principal).",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "billing.SortSpec": {
+      "fields": {
+        "descending": {
+          "description": "Whether to sort in descending order.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "field": {
+          "description": "The filed to sort by",
+          "ref": "billing.SortSpecField",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "billing.SortSpecField": {
+      "enum": [
+        "POLICY_NAME"
+      ],
+      "enum_launch_stages": {
+        "POLICY_NAME": "PUBLIC_PREVIEW"
+      }
+    },
+    "billing.UpdateBudgetConfigurationBudget": {
+      "fields": {
+        "account_id": {
+          "description": "Databricks account ID.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "alert_configurations": {
+          "description": "Alerts to configure when this budget is in a triggered state. Budgets must have exactly one alert configuration.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "budget_configuration_id": {
+          "description": "Databricks budget configuration ID.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "display_name": {
+          "description": "Human-readable name of budget configuration. Max Length: 128",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "filter": {
+          "description": "Configured filters for this budget. These are applied to your account's usage to limit the scope of what is considered for this budget.\nLeave empty to include all usage for this account. All provided filters must be matched for usage to be included.",
+          "ref": "billing.BudgetConfigurationFilter",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "resource_type": {
+          "description": "The resource scope for this budget. Determines whether the budget tracks all resources or a specific resource.",
+          "ref": "billing.BudgetResourceType",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "billing.UpdateBudgetConfigurationRequest": {
+      "fields": {
+        "budget": {
+          "description": "The updated budget. This will overwrite the budget specified by the budget ID.",
+          "ref": "billing.UpdateBudgetConfigurationBudget",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "billing.UpdateBudgetConfigurationResponse": {
+      "fields": {
+        "budget": {
+          "description": "The updated budget.",
+          "ref": "billing.BudgetConfiguration",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "billing.UpdateBudgetPolicyRequest": {
+      "fields": {
+        "limit_config": {
+          "description": "DEPRECATED. This is redundant field as LimitConfig is part of the BudgetPolicy",
+          "ref": "billing.LimitConfig",
+          "deprecated": true,
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "policy": {
+          "description": "The policy to update. `creator_user_id` cannot be specified in the request. All other fields\nmust be specified even if not changed. The `policy_id` is used to identify the policy to\nupdate.",
+          "ref": "billing.BudgetPolicy",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "billing.UpdateLogDeliveryConfigurationStatusRequest": {
+      "description": "*\nUpdate Log Delivery Configuration",
+      "fields": {
+        "status": {
+          "description": "Status of log delivery configuration. Set to `ENABLED` (enabled) or `DISABLED` (disabled). Defaults to `ENABLED`. You can [enable or disable the configuration](#operation/patch-log-delivery-config-status) later. Deletion of a configuration is not supported, so disable a log delivery configuration that is no longer needed.",
+          "ref": "billing.LogDeliveryConfigStatus",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "billing.UsageDashboardMajorVersion": {
+      "enum": [
+        "USAGE_DASHBOARD_MAJOR_VERSION_1",
+        "USAGE_DASHBOARD_MAJOR_VERSION_2"
+      ],
+      "enum_launch_stages": {
+        "USAGE_DASHBOARD_MAJOR_VERSION_1": "GA",
+        "USAGE_DASHBOARD_MAJOR_VERSION_2": "GA"
+      }
+    },
+    "billing.UsageDashboardType": {
+      "enum": [
+        "USAGE_DASHBOARD_TYPE_WORKSPACE",
+        "USAGE_DASHBOARD_TYPE_GLOBAL"
+      ],
+      "enum_launch_stages": {
+        "USAGE_DASHBOARD_TYPE_GLOBAL": "GA",
+        "USAGE_DASHBOARD_TYPE_WORKSPACE": "GA"
+      }
+    },
+    "billing.WrappedCreateLogDeliveryConfiguration": {
+      "description": "*\nProperties of the new log delivery configuration.",
+      "fields": {
+        "log_delivery_configuration": {
+          "ref": "billing.CreateLogDeliveryConfigurationParams",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "billing.WrappedLogDeliveryConfiguration": {
+      "fields": {
+        "log_delivery_configuration": {
+          "description": "The created log delivery configuration",
+          "ref": "billing.LogDeliveryConfiguration",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "billing.WrappedLogDeliveryConfigurations": {
+      "fields": {
+        "log_delivery_configurations": {
+          "description": "Log delivery configurations were returned successfully.",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "Token which can be sent as `page_token` to retrieve the next page of results. If this field is omitted, there are no subsequent budgets.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "bundledeployments.CompleteVersionRequest": {
+      "description": "A request to complete a Version.",
+      "fields": {
+        "completion_reason": {
+          "description": "The reason for completing the version. Must be VERSION_COMPLETE_SUCCESS\nor VERSION_COMPLETE_FAILURE.",
+          "ref": "bundledeployments.VersionComplete",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "force": {
+          "description": "If true, force-completes the version even if the caller is not the\noriginal creator.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "bundledeployments.CreateDeploymentRequest": {
+      "fields": {
+        "deployment": {
+          "description": "The deployment to create. `initial_parent_path` is required. `display_name`, `target_name`,\n`deployment_mode`, and `workspace_info` may be set; every other field is assigned by the\nservice and ignored on input.",
+          "ref": "bundledeployments.Deployment",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "bundledeployments.CreateVersionRequest": {
+      "fields": {
+        "version": {
+          "description": "The version to create.",
+          "ref": "bundledeployments.Version",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "version_id": {
+          "description": "The ID to use for the version, which becomes the final component of\nthe version's resource name. A numeric string (base-10, fits in a\nsigned 64-bit integer) chosen by the caller; must be greater than or\nequal to 1. Must be numerically greater than the deployment's\nmost recent version (see `version.previous_version_id`); it does not\nneed to start at 1 or increase by exactly 1. If the value is not\nnumerically greater, the server returns `INVALID_PARAMETER_VALUE`.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "bundledeployments.DashboardMetadata": {
+      "description": "Dashboard-specific per-resource metadata. Set only for dashboard resources.",
+      "fields": {
+        "definition_path": {
+          "description": "Path of the file that declares this dashboard, relative to the bundle's\nworkspace.file_path (Deployment.workspace_info.file_path) — join the two to\nget the file's absolute workspace path.\n\nFor now this lives only on the dashboard metadata, and is a single string\nbecause it was a single string (`relative_path`) in the legacy bundle\nmetadata.json. We may generalize it in the future: lifting it to a\ntop-level field on Resource/Operation (every resource type has a definition\nlocation) and converting it to a repeated field, since a resource can be\ndeclared across multiple files/locations.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "source_path": {
+          "description": "Path of the dashboard's source artifact (its `.lvdash.json`), relative to\nthe deployment root.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "bundledeployments.DeleteDeploymentRequest": {},
+    "bundledeployments.Deployment": {
+      "description": "A bundle deployment registered with the control plane.",
+      "fields": {
+        "create_time": {
+          "description": "When the deployment was created.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "created_by": {
+          "description": "The user who created the deployment (email or principal name). Empty if authoritative\ndeployment metadata does not identify a creator or the principal cannot be resolved.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "deployment_mode": {
+          "description": "Bundle target deployment mode (development or production).",
+          "ref": "bundledeployments.DeploymentMode",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "destroy_time": {
+          "description": "When deletion was recorded. Unset if deletion has not been recorded.\nThis response metadata does not determine the deployment's lifecycle status.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "destroyed_by": {
+          "description": "The user who destroyed the deployment (email or principal name).\nUnset if the deployment has not been destroyed.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "display_name": {
+          "description": "Human-readable name for the deployment, up to 256 characters.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "git_info": {
+          "description": "Git provenance of the deployment's source, derived from the latest version.",
+          "ref": "bundledeployments.GitInfo",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "initial_parent_path": {
+          "description": "The workspace path of the existing folder where the deployment is initially created. Must be\nabsolute and canonical, with single separators, no `.` or `..` segments, and no trailing slash\nunless the path is `/`. It may contain at most 24 path segments, excluding an optional leading\n`/Workspace` segment. The complete path may contain up to 1,024 characters, and each segment\nmay contain up to 511 characters. This field is input only and is not returned in create, get,\nor list responses.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "INPUT_ONLY"
+          ]
+        },
+        "last_successful_version_id": {
+          "description": "The version_id of the most recent version that completed successfully.\nUnset until a version has completed successfully. Unlike last_version_id,\nit is not advanced when a version fails, so it always points at the last\nknown-good deployment state (or is unset if there has never been one).",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "last_version_id": {
+          "description": "The version_id of the most recent deployment version.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "Resource name of the deployment.\nFormat: deployments/{deployment_id}",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "status": {
+          "description": "Current status of the deployment.",
+          "ref": "bundledeployments.DeploymentStatus",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "target_name": {
+          "description": "The bundle target name associated with this deployment.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "update_time": {
+          "description": "When the deployment was last updated.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "updated_by": {
+          "description": "The user who most recently updated the deployment (email or principal name). Empty if\nauthoritative deployment metadata does not identify a modifier or the principal cannot be\nresolved.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "workspace_info": {
+          "description": "Workspace location of the deployment.",
+          "ref": "bundledeployments.WorkspaceInfo",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "bundledeployments.DeploymentMode": {
+      "description": "Bundle target deployment mode. Mirrors the `mode` field on a bundle target\nin `databricks.yml` (see https://docs.databricks.com/dev-tools/bundles/deployment-modes).",
+      "enum": [
+        "DEPLOYMENT_MODE_DEVELOPMENT",
+        "DEPLOYMENT_MODE_PRODUCTION"
+      ],
+      "enum_launch_stages": {
+        "DEPLOYMENT_MODE_DEVELOPMENT": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_MODE_PRODUCTION": "PRIVATE_PREVIEW"
+      }
+    },
+    "bundledeployments.DeploymentResourceType": {
+      "description": "Type of a deployment resource.",
+      "enum": [
+        "DEPLOYMENT_RESOURCE_TYPE_JOB",
+        "DEPLOYMENT_RESOURCE_TYPE_PIPELINE",
+        "DEPLOYMENT_RESOURCE_TYPE_MODEL",
+        "DEPLOYMENT_RESOURCE_TYPE_REGISTERED_MODEL",
+        "DEPLOYMENT_RESOURCE_TYPE_EXPERIMENT",
+        "DEPLOYMENT_RESOURCE_TYPE_MODEL_SERVING_ENDPOINT",
+        "DEPLOYMENT_RESOURCE_TYPE_QUALITY_MONITOR",
+        "DEPLOYMENT_RESOURCE_TYPE_SCHEMA",
+        "DEPLOYMENT_RESOURCE_TYPE_VOLUME",
+        "DEPLOYMENT_RESOURCE_TYPE_CLUSTER",
+        "DEPLOYMENT_RESOURCE_TYPE_DASHBOARD",
+        "DEPLOYMENT_RESOURCE_TYPE_APP",
+        "DEPLOYMENT_RESOURCE_TYPE_CATALOG",
+        "DEPLOYMENT_RESOURCE_TYPE_EXTERNAL_LOCATION",
+        "DEPLOYMENT_RESOURCE_TYPE_SECRET_SCOPE",
+        "DEPLOYMENT_RESOURCE_TYPE_ALERT",
+        "DEPLOYMENT_RESOURCE_TYPE_SQL_WAREHOUSE",
+        "DEPLOYMENT_RESOURCE_TYPE_DATABASE_INSTANCE",
+        "DEPLOYMENT_RESOURCE_TYPE_DATABASE_CATALOG",
+        "DEPLOYMENT_RESOURCE_TYPE_SYNCED_DATABASE_TABLE",
+        "DEPLOYMENT_RESOURCE_TYPE_POSTGRES_PROJECT",
+        "DEPLOYMENT_RESOURCE_TYPE_POSTGRES_BRANCH",
+        "DEPLOYMENT_RESOURCE_TYPE_POSTGRES_ENDPOINT",
+        "DEPLOYMENT_RESOURCE_TYPE_VECTOR_SEARCH_ENDPOINT",
+        "DEPLOYMENT_RESOURCE_TYPE_VECTOR_SEARCH_INDEX",
+        "DEPLOYMENT_RESOURCE_TYPE_JOB_RUN",
+        "DEPLOYMENT_RESOURCE_TYPE_POSTGRES_CATALOG",
+        "DEPLOYMENT_RESOURCE_TYPE_POSTGRES_SYNCED_TABLE",
+        "DEPLOYMENT_RESOURCE_TYPE_GENIE_SPACE",
+        "DEPLOYMENT_RESOURCE_TYPE_INSTANCE_POOL",
+        "DEPLOYMENT_RESOURCE_TYPE_POSTGRES_DATABASE",
+        "DEPLOYMENT_RESOURCE_TYPE_POSTGRES_ROLE",
+        "DEPLOYMENT_RESOURCE_TYPE_SECRET",
+        "DEPLOYMENT_RESOURCE_TYPE_CLUSTER_POLICY"
+      ],
+      "enum_launch_stages": {
+        "DEPLOYMENT_RESOURCE_TYPE_ALERT": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_RESOURCE_TYPE_APP": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_RESOURCE_TYPE_CATALOG": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_RESOURCE_TYPE_CLUSTER": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_RESOURCE_TYPE_CLUSTER_POLICY": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_RESOURCE_TYPE_DASHBOARD": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_RESOURCE_TYPE_DATABASE_CATALOG": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_RESOURCE_TYPE_DATABASE_INSTANCE": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_RESOURCE_TYPE_EXPERIMENT": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_RESOURCE_TYPE_EXTERNAL_LOCATION": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_RESOURCE_TYPE_GENIE_SPACE": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_RESOURCE_TYPE_INSTANCE_POOL": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_RESOURCE_TYPE_JOB": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_RESOURCE_TYPE_JOB_RUN": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_RESOURCE_TYPE_MODEL": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_RESOURCE_TYPE_MODEL_SERVING_ENDPOINT": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_RESOURCE_TYPE_PIPELINE": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_RESOURCE_TYPE_POSTGRES_BRANCH": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_RESOURCE_TYPE_POSTGRES_CATALOG": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_RESOURCE_TYPE_POSTGRES_DATABASE": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_RESOURCE_TYPE_POSTGRES_ENDPOINT": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_RESOURCE_TYPE_POSTGRES_PROJECT": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_RESOURCE_TYPE_POSTGRES_ROLE": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_RESOURCE_TYPE_POSTGRES_SYNCED_TABLE": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_RESOURCE_TYPE_QUALITY_MONITOR": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_RESOURCE_TYPE_REGISTERED_MODEL": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_RESOURCE_TYPE_SCHEMA": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_RESOURCE_TYPE_SECRET": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_RESOURCE_TYPE_SECRET_SCOPE": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_RESOURCE_TYPE_SQL_WAREHOUSE": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_RESOURCE_TYPE_SYNCED_DATABASE_TABLE": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_RESOURCE_TYPE_VECTOR_SEARCH_ENDPOINT": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_RESOURCE_TYPE_VECTOR_SEARCH_INDEX": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_RESOURCE_TYPE_VOLUME": "PRIVATE_PREVIEW"
+      }
+    },
+    "bundledeployments.DeploymentStatus": {
+      "description": "Status of a deployment.",
+      "enum": [
+        "DEPLOYMENT_STATUS_ACTIVE",
+        "DEPLOYMENT_STATUS_FAILED",
+        "DEPLOYMENT_STATUS_IN_PROGRESS",
+        "DEPLOYMENT_STATUS_DELETED"
+      ],
+      "enum_launch_stages": {
+        "DEPLOYMENT_STATUS_ACTIVE": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_STATUS_DELETED": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_STATUS_FAILED": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_STATUS_IN_PROGRESS": "PRIVATE_PREVIEW"
+      }
+    },
+    "bundledeployments.GetDeploymentRequest": {},
+    "bundledeployments.GetOperationRequest": {},
+    "bundledeployments.GetResourceRequest": {},
+    "bundledeployments.GetVersionRequest": {},
+    "bundledeployments.GitInfo": {
+      "description": "Git provenance of a bundle's source, captured at deploy time. Lets consumers\nlink a deployed resource back to its source in version control.",
+      "fields": {
+        "branch": {
+          "description": "Branch the source was deployed from.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "commit": {
+          "description": "Commit SHA of the deployed source.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "origin_url": {
+          "description": "URL of the git remote the source was deployed from.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "bundledeployments.HeartbeatRequest": {
+      "description": "A request to send a heartbeat for a Version."
+    },
+    "bundledeployments.HeartbeatResponse": {
+      "description": "Response for Heartbeat.",
+      "fields": {
+        "expire_time": {
+          "description": "The new lock expiry time after renewal.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "bundledeployments.ListDeploymentsRequest": {
+      "fields": {
+        "page_size": {
+          "description": "The maximum number of deployments to return. The service may return\nfewer than this value.\nIf unspecified, at most 20 deployments will be returned.\nThe maximum value is 1000; values above 1000 will be coerced to 1000.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "A page token, received from a previous `ListDeployments` call.\nProvide this to retrieve the subsequent page.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "show_deleted": {
+          "description": "Whether to include soft-deleted deployments in the response. Defaults to\nfalse. When true, returns both live and soft-deleted deployments visible to\nthe caller, subject to the filter. Soft-deleted deployments have status\n`DEPLOYMENT_STATUS_DELETED`.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "bundledeployments.ListDeploymentsResponse": {
+      "description": "Response for ListDeployments.",
+      "fields": {
+        "deployments": {
+          "description": "The deployments from the queried workspace.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "next_page_token": {
+          "description": "A token, which can be sent as `page_token` to retrieve the next page.\nIf this field is omitted, there are no subsequent pages.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "bundledeployments.ListOperationsRequest": {
+      "fields": {
+        "page_size": {
+          "description": "The maximum number of operations to return. The service may return\nfewer than this value.\nIf unspecified, at most 50 operations will be returned.\nThe maximum value is 1000; values above 1000 will be coerced to 1000.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "A page token, received from a previous `ListOperations` call.\nProvide this to retrieve the subsequent page.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "bundledeployments.ListOperationsResponse": {
+      "description": "Response for ListOperations.",
+      "fields": {
+        "next_page_token": {
+          "description": "A token, which can be sent as `page_token` to retrieve the next page.\nIf this field is omitted, there are no subsequent pages.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "operations": {
+          "description": "The resource operations under the specified version.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "bundledeployments.ListResourcesRequest": {
+      "fields": {
+        "page_size": {
+          "description": "The maximum number of resources to return. The service may return\nfewer than this value.\nIf unspecified, at most 50 resources will be returned.\nThe maximum value is 1000; values above 1000 will be coerced to 1000.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "A page token, received from a previous `ListResources` call.\nProvide this to retrieve the subsequent page.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "bundledeployments.ListResourcesResponse": {
+      "description": "Response for ListResources.",
+      "fields": {
+        "next_page_token": {
+          "description": "A token, which can be sent as `page_token` to retrieve the next page.\nIf this field is omitted, there are no subsequent pages.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "resources": {
+          "description": "The resources under the specified deployment.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "bundledeployments.ListVersionsRequest": {
+      "fields": {
+        "page_size": {
+          "description": "The maximum number of versions to return. The service may return\nfewer than this value.\nIf unspecified, at most 20 versions will be returned.\nThe maximum value is 100; values above 100 will be coerced to 100.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "A page token, received from a previous `ListVersions` call.\nProvide this to retrieve the subsequent page.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "bundledeployments.ListVersionsResponse": {
+      "description": "Response for ListVersions.",
+      "fields": {
+        "next_page_token": {
+          "description": "A token, which can be sent as `page_token` to retrieve the next page.\nIf this field is omitted, there are no subsequent pages.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "versions": {
+          "description": "The versions under the specified deployment.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "bundledeployments.Operation": {
+      "description": "An operation on a single resource performed during a version. The full set\nof operations for a version is recorded when the version is created: each\ncarries its `resource_key` and `action_type` and starts in\n`OPERATION_STATUS_PENDING`. As each resource is applied, its operation is\nupdated (via UpdateOperation) to record the result of applying the change to\nthe workspace. `state`, `error_message`, `resource_id`, `status`, and\n`dashboard_metadata` may be updated afterwards, guarded by `sequence_id` for\noptimistic concurrency control; all other fields are immutable once recorded.",
+      "fields": {
+        "action_type": {
+          "description": "The type of operation performed on this resource. Set when the version is\ncreated and immutable thereafter.",
+          "ref": "bundledeployments.OperationActionType",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "create_time": {
+          "description": "When the operation was recorded.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "dashboard_metadata": {
+          "description": "Dashboard-specific metadata; set only for dashboard resources. Mutable: may\nbe set or updated via UpdateOperation as the resource is applied, and is\nmirrored onto the corresponding deployment-level resource.",
+          "ref": "bundledeployments.DashboardMetadata",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "error_message": {
+          "description": "Error message if the operation failed. Set when status is\nOPERATION_STATUS_FAILED. Captures the error encountered while applying the\nresource to the workspace. Mutable: may be updated after creation via\nUpdateOperation; setting it to an empty string clears it. After an update\nis applied, an operation whose status is OPERATION_STATUS_SUCCEEDED cannot\ncarry an error_message.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "name": {
+          "description": "Resource name of the operation.\nFormat: deployments/{deployment_id}/versions/{version_id}/operations/{resource_key}",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "resource_id": {
+          "description": "ID of the actual resource in the workspace (e.g. the job ID, pipeline ID).\nRequired whenever `state` is set, because state records a resource that\nexists. A CREATE or RECREATE that has not produced its resource yet records\nneither. Mutable: may be filled in (or corrected) later via UpdateOperation\nonce the ID is known.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "resource_key": {
+          "description": "Resource identifier within the bundle (e.g. \"jobs.foo\",\n\"pipelines.bar\", \"jobs.foo.permissions\", \"files.\u003crel-path\u003e\").\nCan be an arbitrary UTF-8 encoded string key. This key links the\noperation to the corresponding deployment-level Resource. Set when the\nversion is created and immutable thereafter.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "resource_type": {
+          "description": "The type of the deployment resource this operation applies to. Derived\nfrom the `resource_key` prefix (e.g. \"jobs\" → JOB); the caller does not\nset this field.",
+          "ref": "bundledeployments.DeploymentResourceType",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "sequence_id": {
+          "description": "Monotonically increasing revision used for optimistic concurrency control\n(the AIP-154 concurrency token for this resource, realized as a sequence\nnumber rather than an opaque etag). The server assigns 0 when the operation\nis created and increments it on every successful UpdateOperation, so a\nnever-updated operation is at 0 and the first successful update makes it 1.\nIt is OPTIONAL rather than OUTPUT_ONLY because it is dual-purpose:\nGetOperation returns the current value, and UpdateOperation reads the\ncaller-supplied value as a precondition. The caller must echo the value it\nlast observed; if it no longer matches the server's value, the update is\nrejected with ABORTED so the caller can re-read and retry.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "state": {
+          "description": "Serialized local config state after the operation. Its presence records\nwhether the resource still exists. Explicitly clearing state removes the resource;\nomitting it from the update mask leaves resource state unchanged.\nState is stored only on Resources. UpdateOperation accepts state but omits it\nfrom its response, as do subsequent GetOperation and ListOperations.\n\nMutable: may be updated after creation via UpdateOperation. When updating,\nthe caller must echo the last-observed `sequence_id` as a concurrency\nprecondition.\n\nThe string is not parsed; it is projected onto the corresponding Resource's\nstate. It is deliberately not google.protobuf.Value, whose only numeric case\nis `double number_value`, so parsing the client's JSON into it rewrites every\ninteger as a double - `1` reads back as `1.0`, which no longer deserializes\ninto an integer field - and silently loses precision above 2^53, which is\nwithin range for IDs the client records.\n\nA string rather than bytes: the payload is always UTF-8 JSON, and proto3 JSON\nmaps bytes to base64, which inflates every request and response by a third\nand makes state unreadable in logs and API responses. Both generate the same\nOpenAPI schema (\"type\": \"string\"), so the SDKs are identical either way.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "status": {
+          "description": "Status of the operation. Starts as OPERATION_STATUS_PENDING when the version\nis created and moves to a terminal status once the resource is applied.\nMutable: updated via UpdateOperation, e.g. when an operation recorded as\nfailed is retried and eventually succeeds.",
+          "ref": "bundledeployments.OperationStatus",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "update_time": {
+          "description": "When the operation was last updated. Set to `create_time` when the operation is created and\nto the server timestamp on each successful UpdateOperation.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "bundledeployments.OperationActionType": {
+      "description": "Type of action performed on a resource during a deployment.",
+      "enum": [
+        "OPERATION_ACTION_TYPE_RESIZE",
+        "OPERATION_ACTION_TYPE_UPDATE",
+        "OPERATION_ACTION_TYPE_UPDATE_WITH_ID",
+        "OPERATION_ACTION_TYPE_CREATE",
+        "OPERATION_ACTION_TYPE_RECREATE",
+        "OPERATION_ACTION_TYPE_DELETE",
+        "OPERATION_ACTION_TYPE_BIND",
+        "OPERATION_ACTION_TYPE_BIND_AND_UPDATE",
+        "OPERATION_ACTION_TYPE_INITIAL_REGISTER"
+      ],
+      "enum_launch_stages": {
+        "OPERATION_ACTION_TYPE_BIND": "PRIVATE_PREVIEW",
+        "OPERATION_ACTION_TYPE_BIND_AND_UPDATE": "PRIVATE_PREVIEW",
+        "OPERATION_ACTION_TYPE_CREATE": "PRIVATE_PREVIEW",
+        "OPERATION_ACTION_TYPE_DELETE": "PRIVATE_PREVIEW",
+        "OPERATION_ACTION_TYPE_INITIAL_REGISTER": "PRIVATE_PREVIEW",
+        "OPERATION_ACTION_TYPE_RECREATE": "PRIVATE_PREVIEW",
+        "OPERATION_ACTION_TYPE_RESIZE": "PRIVATE_PREVIEW",
+        "OPERATION_ACTION_TYPE_UPDATE": "PRIVATE_PREVIEW",
+        "OPERATION_ACTION_TYPE_UPDATE_WITH_ID": "PRIVATE_PREVIEW"
+      }
+    },
+    "bundledeployments.OperationStatus": {
+      "description": "Status of a resource operation.",
+      "enum": [
+        "OPERATION_STATUS_SUCCEEDED",
+        "OPERATION_STATUS_FAILED",
+        "OPERATION_STATUS_PENDING"
+      ],
+      "enum_launch_stages": {
+        "OPERATION_STATUS_FAILED": "PRIVATE_PREVIEW",
+        "OPERATION_STATUS_PENDING": "PRIVATE_PREVIEW",
+        "OPERATION_STATUS_SUCCEEDED": "PRIVATE_PREVIEW"
+      }
+    },
+    "bundledeployments.Resource": {
+      "description": "A resource managed by a deployment. Resources are implicitly created,\nupdated, or deleted when operations are recorded on a version.",
+      "fields": {
+        "dashboard_metadata": {
+          "description": "Dashboard-specific metadata; set only for dashboard resources.",
+          "ref": "bundledeployments.DashboardMetadata",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "last_action_type": {
+          "description": "The action performed on this resource during the last version.",
+          "ref": "bundledeployments.OperationActionType",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "last_version_id": {
+          "description": "The version_id of the last version where this resource was updated.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "Resource name.\nFormat: deployments/{deployment_id}/resources/{resource_key}",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "resource_id": {
+          "description": "ID that references the actual resource in the workspace\n(e.g. the job ID, pipeline ID).",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "resource_key": {
+          "description": "Resource identifier within the bundle (e.g. \"jobs.foo\",\n\"pipelines.bar\", \"jobs.foo.permissions\").",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "resource_type": {
+          "description": "The type of the deployment resource.",
+          "ref": "bundledeployments.DeploymentResourceType",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "state": {
+          "description": "Serialized local config state (what the CLI deployed). Opaque to this\nservice; see Operation.state for why this is a string and not\ngoogle.protobuf.Value.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "update_time": {
+          "description": "When the last operation that updated this resource's recorded state was applied. Pairs with\nlast_action_type and last_version_id (all three advance together on that write).",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "bundledeployments.StagedOperation": {
+      "description": "A resource operation to record when a version is created. Each staged\noperation identifies the resource it applies to and the action planned for\nit; the server records the operation in `OPERATION_STATUS_PENDING`, and its\noutcome is filled in later via UpdateOperation.",
+      "fields": {
+        "action_type": {
+          "description": "The type of operation planned for this resource.",
+          "ref": "bundledeployments.OperationActionType",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "resource_key": {
+          "description": "The key identifying the resource this operation applies to (e.g.\n\"jobs.foo\", \"pipelines.bar\"). Becomes the final component of the\noperation's name and must be unique among the operations in the version.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "bundledeployments.UpdateDeploymentRequest": {
+      "fields": {
+        "deployment": {
+          "description": "The deployment to update. Its `name` selects the deployment; the fields\nnamed in `update_mask` carry the new values. All other fields are ignored.",
+          "ref": "bundledeployments.Deployment",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "update_mask": {
+          "description": "The fields to update; supported paths are `display_name`, `deployment_mode`, `target_name`,\nand `workspace_info`. An empty mask or any other path returns INVALID_PARAMETER_VALUE.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "bundledeployments.UpdateOperationRequest": {
+      "fields": {
+        "operation": {
+          "description": "The operation to update. Its `name` selects the operation; the fields named\nin `update_mask` carry the new values; and `sequence_id` carries the\noptimistic-concurrency precondition (see the field docs on Operation). All\nother fields are ignored.",
+          "ref": "bundledeployments.Operation",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "update_mask": {
+          "description": "The set of fields to update. Required; supported paths are `state`,\n`error_message`, `resource_id`, `status`, and `dashboard_metadata`. An empty\nmask or any other path is rejected with INVALID_PARAMETER_VALUE.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "bundledeployments.Version": {
+      "description": "A single invocation of a deploy or destroy command against a deployment.\nCreating a version acquires an exclusive lock on the parent deployment.",
+      "fields": {
+        "cli_version": {
+          "description": "CLI version used to initiate the version.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "complete_time": {
+          "description": "When the version completed. Unset while the version is in progress.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "completed_by": {
+          "description": "The user who completed the version (email or principal name).\nMay differ from `created_by` when another user force-completes\nthe version.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "completion_reason": {
+          "description": "Why the version was completed. Unset while in progress.\nSet when status transitions to COMPLETED.",
+          "ref": "bundledeployments.VersionComplete",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "create_time": {
+          "description": "When the version was created.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "created_by": {
+          "description": "The user who created the version (email or principal name).",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "deployment_mode": {
+          "description": "Bundle target deployment mode (development or production), captured at the\ntime of this version.",
+          "ref": "bundledeployments.DeploymentMode",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "display_name": {
+          "description": "Display name for the deployment, captured at the time of this version. Up to 256 characters.\nWhen present, creating the version updates the deployment display name. An empty value clears\nit; an absent value leaves the current deployment display name unchanged.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "git_info": {
+          "description": "Git provenance of the source, captured at the time of this version.",
+          "ref": "bundledeployments.GitInfo",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "name": {
+          "description": "Resource name of the version.\nFormat: deployments/{deployment_id}/versions/{version_id}",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "operations": {
+          "description": "The full operation plan for this version: one PENDING operation per entry,\nrecorded in the same transaction. Input only -- supplied on create and never\nreturned by create/get/list; read the recorded operations via ListOperations.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "INPUT_ONLY",
+            "OPTIONAL"
+          ]
+        },
+        "previous_version_id": {
+          "description": "The version_id this version was created on top of — the deployment's\nmost recent version at creation time. Leave unset when creating the\nfirst version (the deployment has no prior versions). Set by the\nclient on creation and immutable thereafter.\n\nActs as an optimistic-concurrency precondition: the server requires\nit to equal the deployment's current most-recent version (and to be\nunset when the deployment has no versions) and returns\n`INVALID_PARAMETER_VALUE` on mismatch, so a deploy racing against a\nconcurrent deploy is rejected rather than silently overwriting it.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE",
+            "OPTIONAL"
+          ]
+        },
+        "status": {
+          "description": "Status of the version: IN_PROGRESS or COMPLETED.",
+          "ref": "bundledeployments.VersionStatus",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "target_name": {
+          "description": "Target name of the deployment, captured at the time of this version.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "version_id": {
+          "description": "Version identifier within the parent deployment, assigned by the\nclient on creation. A numeric string (base-10, fits in a signed\n64-bit integer) that is greater than or equal to 1. Version IDs are\nstrictly increasing within a deployment but are not required to\nstart at 1 or to be contiguous.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "version_type": {
+          "description": "Type of version (deploy or destroy).",
+          "ref": "bundledeployments.VersionType",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "workspace_info": {
+          "description": "Workspace location of the deployment, captured at the time of this version.",
+          "ref": "bundledeployments.WorkspaceInfo",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        }
+      }
+    },
+    "bundledeployments.VersionComplete": {
+      "description": "Reason why a version was completed.",
+      "enum": [
+        "VERSION_COMPLETE_SUCCESS",
+        "VERSION_COMPLETE_FAILURE",
+        "VERSION_COMPLETE_FORCE_ABORT",
+        "VERSION_COMPLETE_LEASE_EXPIRED"
+      ],
+      "enum_launch_stages": {
+        "VERSION_COMPLETE_FAILURE": "PRIVATE_PREVIEW",
+        "VERSION_COMPLETE_FORCE_ABORT": "PRIVATE_PREVIEW",
+        "VERSION_COMPLETE_LEASE_EXPIRED": "PRIVATE_PREVIEW",
+        "VERSION_COMPLETE_SUCCESS": "PRIVATE_PREVIEW"
+      }
+    },
+    "bundledeployments.VersionStatus": {
+      "description": "Status of a version.",
+      "enum": [
+        "VERSION_STATUS_IN_PROGRESS",
+        "VERSION_STATUS_COMPLETED"
+      ],
+      "enum_launch_stages": {
+        "VERSION_STATUS_COMPLETED": "PRIVATE_PREVIEW",
+        "VERSION_STATUS_IN_PROGRESS": "PRIVATE_PREVIEW"
+      }
+    },
+    "bundledeployments.VersionType": {
+      "description": "Type of version.",
+      "enum": [
+        "VERSION_TYPE_DEPLOY",
+        "VERSION_TYPE_DESTROY"
+      ],
+      "enum_launch_stages": {
+        "VERSION_TYPE_DEPLOY": "PRIVATE_PREVIEW",
+        "VERSION_TYPE_DESTROY": "PRIVATE_PREVIEW"
+      }
+    },
+    "bundledeployments.WorkspaceInfo": {
+      "description": "Workspace location of a bundle deployment, captured at deploy time.",
+      "fields": {
+        "bundle_root_path": {
+          "description": "Path of the bundle root (the directory containing databricks.yml) relative\nto git_folder_path. Empty when the deployment is not from a Databricks Git\nfolder.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "file_path": {
+          "description": "Absolute workspace path where the deployed bundle files live. Mirrors the\nworkspace.file_path field in DABs bundle config.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "git_folder_path": {
+          "description": "When deployed from a Databricks Git folder, the absolute workspace path of\nthat folder; empty for local deploys.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "root_path": {
+          "description": "Absolute workspace path of the deployment root — the base path the deployed\nfiles live under. Mirrors workspace.root_path in the DABs bundle config;\nfile_path is its files subdirectory.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "source_linked": {
+          "description": "Whether files are served directly from the source sync root instead of\nbeing copied into file_path.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "catalog.AccessRequestDestinations": {
+      "fields": {
+        "are_any_destinations_hidden": {
+          "description": "Indicates whether any destinations are hidden from the caller due to a lack of permissions.\nThis value is true if the caller does not have permission to see all destinations.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "destination_source_securable": {
+          "description": "The source securable from which the destinations are inherited. Either the same value as securable (if destination\nis set directly on the securable) or the nearest parent securable with destinations set.",
+          "ref": "catalog.Securable",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "destinations": {
+          "description": "The access request destinations for the securable.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL",
+            "UNORDERED_LIST"
+          ]
+        },
+        "full_name": {
+          "description": "The full name of the securable. Redundant with the name in the securable object, but necessary for Terraform integration",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "securable": {
+          "description": "The securable for which the access request destinations are being modified or read.",
+          "ref": "catalog.Securable",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "securable_type": {
+          "description": "The type of the securable. Redundant with the type in the securable object, but necessary for Terraform integration",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "catalog.AccountsCreateMetastore": {
+      "description": "Properties of the new metastore.",
+      "fields": {
+        "metastore_info": {
+          "ref": "catalog.CreateAccountsMetastore",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.AccountsCreateMetastoreAssignment": {
+      "description": "The mapping from workspace to metastore.",
+      "fields": {
+        "metastore_assignment": {
+          "ref": "catalog.CreateMetastoreAssignment",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.AccountsCreateMetastoreAssignmentResponse": {
+      "description": "The metastore assignment was successfully created."
+    },
+    "catalog.AccountsCreateMetastoreResponse": {
+      "fields": {
+        "metastore_info": {
+          "ref": "catalog.MetastoreInfo",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.AccountsCreateStorageCredential": {
+      "fields": {
+        "credential_info": {
+          "ref": "catalog.CreateAccountsStorageCredential",
+          "launch_stage": "GA"
+        },
+        "skip_validation": {
+          "description": "Optional, default false.\nSupplying true to this argument skips validation of the created set of credentials.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.AccountsCreateStorageCredentialInfo": {
+      "fields": {
+        "credential_info": {
+          "ref": "catalog.StorageCredentialInfo",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.AccountsDeleteMetastoreAssignmentResponse": {
+      "description": "The metastore assignment was successfully deleted."
+    },
+    "catalog.AccountsDeleteMetastoreResponse": {
+      "description": "The metastore was successfully deleted."
+    },
+    "catalog.AccountsDeleteStorageCredentialResponse": {
+      "description": "The storage credential was successfully deleted."
+    },
+    "catalog.AccountsGetMetastoreResponse": {
+      "description": "The metastore was successfully returned.",
+      "fields": {
+        "metastore_info": {
+          "ref": "catalog.MetastoreInfo",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.AccountsListMetastoresResponse": {
+      "description": "Metastores were returned successfully.",
+      "fields": {
+        "metastores": {
+          "description": "An array of metastore information objects.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.AccountsMetastoreAssignment": {
+      "description": "The workspace metastore assignment was successfully returned.",
+      "fields": {
+        "metastore_assignment": {
+          "ref": "catalog.MetastoreAssignment",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.AccountsStorageCredentialInfo": {
+      "description": "The storage credential was successfully retrieved.",
+      "fields": {
+        "credential_info": {
+          "ref": "catalog.StorageCredentialInfo",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.AccountsUpdateMetastore": {
+      "description": "Properties of the metastore to change.",
+      "fields": {
+        "metastore_info": {
+          "description": "Properties of the metastore to change.",
+          "ref": "catalog.UpdateAccountsMetastore",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.AccountsUpdateMetastoreAssignment": {
+      "description": "The metastore assignment to update.",
+      "fields": {
+        "metastore_assignment": {
+          "ref": "catalog.UpdateMetastoreAssignment",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.AccountsUpdateMetastoreAssignmentResponse": {
+      "description": "The metastore assignment was successfully updated."
+    },
+    "catalog.AccountsUpdateMetastoreResponse": {
+      "description": "The metastore update request succeeded.",
+      "fields": {
+        "metastore_info": {
+          "ref": "catalog.MetastoreInfo",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.AccountsUpdateStorageCredential": {
+      "description": "The storage credential to update.",
+      "fields": {
+        "credential_info": {
+          "ref": "catalog.UpdateAccountsStorageCredential",
+          "launch_stage": "GA"
+        },
+        "skip_validation": {
+          "description": "Optional. Supplying true to this argument skips validation of the updated set of credentials.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.AccountsUpdateStorageCredentialResponse": {
+      "description": "The storage credential was successfully updated.",
+      "fields": {
+        "credential_info": {
+          "ref": "catalog.StorageCredentialInfo",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ArtifactAllowlistInfo": {
+      "fields": {
+        "artifact_matchers": {
+          "description": "A list of allowed artifact match patterns.",
+          "launch_stage": "GA"
+        },
+        "created_at": {
+          "description": "Time at which this artifact allowlist was set, in epoch milliseconds.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "created_by": {
+          "description": "Username of the user who set the artifact allowlist.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "metastore_id": {
+          "description": "Unique identifier of parent metastore.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "catalog.ArtifactMatcher": {
+      "fields": {
+        "artifact": {
+          "description": "The artifact path or maven coordinate",
+          "launch_stage": "GA"
+        },
+        "match_type": {
+          "description": "The pattern matching type of the artifact",
+          "ref": "catalog.MatchType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ArtifactType": {
+      "description": "The artifact type",
+      "enum": [
+        "INIT_SCRIPT",
+        "LIBRARY_JAR",
+        "LIBRARY_MAVEN"
+      ],
+      "enum_launch_stages": {
+        "INIT_SCRIPT": "GA",
+        "LIBRARY_JAR": "GA",
+        "LIBRARY_MAVEN": "GA"
+      }
+    },
+    "catalog.AssignResponse": {},
+    "catalog.AwsCredentials": {
+      "description": "AWS temporary credentials for API authentication.\nRead more at https://docs.aws.amazon.com/STS/latest/APIReference/API_Credentials.html.",
+      "fields": {
+        "access_key_id": {
+          "description": "The access key ID that identifies the temporary credentials.",
+          "launch_stage": "GA"
+        },
+        "access_point": {
+          "description": "The Amazon Resource Name (ARN) of the S3 access point for\ntemporary credentials related the external location.",
+          "launch_stage": "GA"
+        },
+        "secret_access_key": {
+          "description": "The secret access key that can be used to sign AWS API requests.",
+          "launch_stage": "GA"
+        },
+        "session_token": {
+          "description": "The token that users must pass to AWS API to use the temporary credentials.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.AwsIamRole": {
+      "description": "The AWS IAM role configuration",
+      "fields": {
+        "external_id": {
+          "description": "The external ID used in role assumption to prevent the confused deputy problem.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "role_arn": {
+          "description": "The Amazon Resource Name (ARN) of the AWS IAM role used to vend temporary credentials.",
+          "launch_stage": "GA"
+        },
+        "unity_catalog_iam_arn": {
+          "description": "The Amazon Resource Name (ARN) of the AWS IAM user managed by Databricks.\nThis is the identity that is going to assume the AWS IAM role.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "catalog.AwsIamRoleRequest": {
+      "description": "The AWS IAM role configuration",
+      "fields": {
+        "role_arn": {
+          "description": "The Amazon Resource Name (ARN) of the AWS IAM role used to vend temporary credentials.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.AwsIamRoleResponse": {
+      "description": "The AWS IAM role configuration",
+      "fields": {
+        "external_id": {
+          "description": "The external ID used in role assumption to prevent the confused deputy problem.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "role_arn": {
+          "description": "The Amazon Resource Name (ARN) of the AWS IAM role used to vend temporary credentials.",
+          "launch_stage": "GA"
+        },
+        "unity_catalog_iam_arn": {
+          "description": "The Amazon Resource Name (ARN) of the AWS IAM user managed by Databricks.\nThis is the identity that is going to assume the AWS IAM role.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "catalog.AwsSqsQueue": {
+      "fields": {
+        "managed_resource_id": {
+          "description": "Unique identifier included in the name of file events managed cloud resources.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "queue_url": {
+          "description": "The AQS queue url in the format https://sqs.{region}.amazonaws.com/{account id}/{queue name}.\nOnly required for provided_sqs.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.AzureActiveDirectoryToken": {
+      "description": "Azure Active Directory token, essentially the Oauth token for Azure Service Principal or Managed\nIdentity.\nRead more at https://learn.microsoft.com/en-us/azure/databricks/dev-tools/api/latest/aad/service-prin-aad-token",
+      "fields": {
+        "aad_token": {
+          "description": "Opaque token that contains claims that you can use in Azure Active Directory to access cloud services.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.AzureEncryptionSettings": {
+      "fields": {
+        "azure_cmk_access_connector_id": {
+          "launch_stage": "GA"
+        },
+        "azure_cmk_managed_identity_id": {
+          "launch_stage": "GA"
+        },
+        "azure_tenant_id": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.AzureManagedIdentity": {
+      "description": "The Azure managed identity configuration.",
+      "fields": {
+        "access_connector_id": {
+          "description": "The Azure resource ID of the Azure Databricks Access Connector. Use the format\n`/subscriptions/{guid}/resourceGroups/{rg-name}/providers/Microsoft.Databricks/accessConnectors/{connector-name}`.",
+          "launch_stage": "GA"
+        },
+        "credential_id": {
+          "description": "The Databricks internal ID that represents this managed identity.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "managed_identity_id": {
+          "description": "The Azure resource ID of the managed identity. Use the format,\n`/subscriptions/{guid}/resourceGroups/{rg-name}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identity-name}`\nThis is only available for user-assgined identities. For system-assigned identities, the access_connector_id is used to identify the identity.\nIf this field is not provided, then we assume the AzureManagedIdentity is using the system-assigned identity.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.AzureManagedIdentityRequest": {
+      "description": "The Azure managed identity configuration.",
+      "fields": {
+        "access_connector_id": {
+          "description": "The Azure resource ID of the Azure Databricks Access Connector. Use the format\n`/subscriptions/{guid}/resourceGroups/{rg-name}/providers/Microsoft.Databricks/accessConnectors/{connector-name}`.",
+          "launch_stage": "GA"
+        },
+        "managed_identity_id": {
+          "description": "The Azure resource ID of the managed identity. Use the format,\n`/subscriptions/{guid}/resourceGroups/{rg-name}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identity-name}`\nThis is only available for user-assgined identities. For system-assigned identities, the access_connector_id is used to identify the identity.\nIf this field is not provided, then we assume the AzureManagedIdentity is using the system-assigned identity.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.AzureManagedIdentityResponse": {
+      "description": "The Azure managed identity configuration.",
+      "fields": {
+        "access_connector_id": {
+          "description": "The Azure resource ID of the Azure Databricks Access Connector. Use the format\n`/subscriptions/{guid}/resourceGroups/{rg-name}/providers/Microsoft.Databricks/accessConnectors/{connector-name}`.",
+          "launch_stage": "GA"
+        },
+        "credential_id": {
+          "description": "The Databricks internal ID that represents this managed identity.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "managed_identity_id": {
+          "description": "The Azure resource ID of the managed identity. Use the format,\n`/subscriptions/{guid}/resourceGroups/{rg-name}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identity-name}`\nThis is only available for user-assgined identities. For system-assigned identities, the access_connector_id is used to identify the identity.\nIf this field is not provided, then we assume the AzureManagedIdentity is using the system-assigned identity.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.AzureQueueStorage": {
+      "fields": {
+        "managed_resource_id": {
+          "description": "Unique identifier included in the name of file events managed cloud resources.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "queue_url": {
+          "description": "The AQS queue url in the format https://{storage account}.queue.core.windows.net/{queue name}\nOnly required for provided_aqs.",
+          "launch_stage": "GA"
+        },
+        "resource_group": {
+          "description": "Optional resource group for the queue, event grid subscription, and external location storage\naccount.\nOnly required for locations with a service principal storage credential",
+          "launch_stage": "GA"
+        },
+        "subscription_id": {
+          "description": "Optional subscription id for the queue, event grid subscription, and external location storage\naccount.\nRequired for locations with a service principal storage credential",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.AzureServicePrincipal": {
+      "description": "The Azure service principal configuration. Only applicable when purpose is **STORAGE**.",
+      "fields": {
+        "application_id": {
+          "description": "The application ID of the application registration within the referenced AAD tenant.",
+          "launch_stage": "GA"
+        },
+        "client_secret": {
+          "description": "The client secret generated for the above app ID in AAD.",
+          "launch_stage": "GA"
+        },
+        "directory_id": {
+          "description": "The directory ID corresponding to the Azure Active Directory (AAD) tenant of the application.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.AzureUserDelegationSas": {
+      "description": "Azure temporary credentials for API authentication.\nRead more at https://docs.microsoft.com/en-us/rest/api/storageservices/create-user-delegation-sas",
+      "fields": {
+        "sas_token": {
+          "description": "The signed URI (SAS Token) used to access blob services for a given path",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.BatchCreateAccessRequestsRequest": {
+      "fields": {
+        "requests": {
+          "description": "A list of individual access requests, where each request corresponds to\na set of permissions being requested on a list of securables for a specified principal.\n\nAt most 30 requests per API call.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.BatchCreateAccessRequestsResponse": {
+      "fields": {
+        "responses": {
+          "description": "The access request destinations for each securable object the principal requested.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.CancelRefreshRequest": {},
+    "catalog.CancelRefreshResponse": {},
+    "catalog.CatalogInfo": {
+      "fields": {
+        "browse_only": {
+          "description": "Indicates whether the principal is limited to retrieving metadata for the associated object through the BROWSE privilege when include_browse is enabled in the request.",
+          "launch_stage": "GA"
+        },
+        "catalog_type": {
+          "ref": "catalog.CatalogType",
+          "launch_stage": "GA"
+        },
+        "comment": {
+          "description": "User-provided free-form text description.",
+          "launch_stage": "GA"
+        },
+        "connection_name": {
+          "description": "The name of the connection to an external data source.",
+          "launch_stage": "GA"
+        },
+        "created_at": {
+          "description": "Time at which this catalog was created, in epoch milliseconds.",
+          "launch_stage": "GA"
+        },
+        "created_by": {
+          "description": "Username of catalog creator.",
+          "launch_stage": "GA"
+        },
+        "custom_max_retention_hours": {
+          "description": "Custom maximum retention period in hours for the catalog",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "effective_predictive_optimization_flag": {
+          "ref": "catalog.EffectivePredictiveOptimizationFlag",
+          "launch_stage": "GA"
+        },
+        "enable_predictive_optimization": {
+          "description": "Whether predictive optimization should be enabled for this object and objects under it.",
+          "ref": "catalog.EnablePredictiveOptimization",
+          "launch_stage": "GA"
+        },
+        "full_name": {
+          "description": "The full name of the catalog. Corresponds with the name field.",
+          "launch_stage": "GA"
+        },
+        "isolation_mode": {
+          "description": "Whether the current securable is accessible from all workspaces or a specific set of workspaces.",
+          "ref": "catalog.CatalogIsolationMode",
+          "launch_stage": "GA"
+        },
+        "managed_encryption_settings": {
+          "description": "Control CMK encryption for managed catalog data",
+          "ref": "catalog.EncryptionSettings",
+          "launch_stage": "GA"
+        },
+        "metastore_id": {
+          "description": "Unique identifier of parent metastore.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of catalog.",
+          "launch_stage": "GA"
+        },
+        "options": {
+          "description": "A map of key-value properties attached to the securable.",
+          "launch_stage": "GA"
+        },
+        "owner": {
+          "description": "Username of current owner of catalog.",
+          "launch_stage": "GA"
+        },
+        "properties": {
+          "description": "A map of key-value properties attached to the securable.",
+          "launch_stage": "GA"
+        },
+        "provider_name": {
+          "description": "The name of delta sharing provider.\n\nA Delta Sharing catalog is a catalog that is based on a Delta share on a remote sharing server.",
+          "launch_stage": "GA"
+        },
+        "provisioning_info": {
+          "ref": "catalog.ProvisioningInfo",
+          "launch_stage": "GA"
+        },
+        "securable_type": {
+          "ref": "catalog.SecurableType",
+          "launch_stage": "GA"
+        },
+        "share_name": {
+          "description": "The name of the share under the share provider.",
+          "launch_stage": "GA"
+        },
+        "storage_location": {
+          "description": "Storage Location URL (full path) for managed tables within catalog.",
+          "launch_stage": "GA"
+        },
+        "storage_root": {
+          "description": "Storage root URL for managed tables within catalog.",
+          "launch_stage": "GA"
+        },
+        "updated_at": {
+          "description": "Time at which this catalog was last modified, in epoch milliseconds.",
+          "launch_stage": "GA"
+        },
+        "updated_by": {
+          "description": "Username of user who last modified catalog.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.CatalogIsolationMode": {
+      "enum": [
+        "OPEN",
+        "ISOLATED"
+      ],
+      "enum_launch_stages": {
+        "ISOLATED": "GA",
+        "OPEN": "GA"
+      }
+    },
+    "catalog.CatalogType": {
+      "description": "The type of the catalog.",
+      "enum": [
+        "MANAGED_CATALOG",
+        "DELTASHARING_CATALOG",
+        "SYSTEM_CATALOG",
+        "INTERNAL_CATALOG",
+        "FOREIGN_CATALOG",
+        "MANAGED_ONLINE_CATALOG"
+      ],
+      "enum_launch_stages": {
+        "DELTASHARING_CATALOG": "GA",
+        "FOREIGN_CATALOG": "GA",
+        "INTERNAL_CATALOG": "GA",
+        "MANAGED_CATALOG": "GA",
+        "MANAGED_ONLINE_CATALOG": "GA",
+        "SYSTEM_CATALOG": "GA"
+      }
+    },
+    "catalog.CloudflareApiToken": {
+      "description": "The Cloudflare API token configuration.\nRead more at https://developers.cloudflare.com/r2/api/s3/tokens/",
+      "fields": {
+        "access_key_id": {
+          "description": "The access key ID associated with the API token.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "account_id": {
+          "description": "The ID of the account associated with the API token.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "secret_access_key": {
+          "description": "The secret access token generated for the above access key ID.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "catalog.ColumnInfo": {
+      "fields": {
+        "comment": {
+          "description": "User-provided free-form text description.",
+          "launch_stage": "GA"
+        },
+        "mask": {
+          "ref": "catalog.ColumnMask",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of Column.",
+          "launch_stage": "GA"
+        },
+        "nullable": {
+          "description": "Whether field may be Null (default: true).",
+          "launch_stage": "GA"
+        },
+        "partition_index": {
+          "description": "Partition index for column.",
+          "launch_stage": "GA"
+        },
+        "position": {
+          "description": "Ordinal position of column (starting at position 0).",
+          "launch_stage": "GA"
+        },
+        "type_interval_type": {
+          "description": "Format of IntervalType.",
+          "launch_stage": "GA"
+        },
+        "type_json": {
+          "description": "Full data type specification, JSON-serialized.",
+          "launch_stage": "GA"
+        },
+        "type_name": {
+          "ref": "catalog.ColumnTypeName",
+          "launch_stage": "GA"
+        },
+        "type_precision": {
+          "description": "Digits of precision; required for DecimalTypes.",
+          "launch_stage": "GA"
+        },
+        "type_scale": {
+          "description": "Digits to right of decimal; Required for DecimalTypes.",
+          "launch_stage": "GA"
+        },
+        "type_text": {
+          "description": "Full data type specification as SQL/catalogString text.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ColumnMask": {
+      "fields": {
+        "function_name": {
+          "description": "The full name of the column mask SQL UDF.",
+          "launch_stage": "GA"
+        },
+        "using_arguments": {
+          "description": "The list of table columns or literals to be passed as additional arguments to a column mask\nfunction, carrying the type (column reference vs constant literal) of each argument.\nDeprecated: use using_column_names instead.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "using_column_names": {
+          "description": "The list of additional table columns to be passed as input to the column mask function. The\nfirst arg of the mask function should be of the type of the column being masked and the\ntypes of the rest of the args should match the types of columns in 'using_column_names'.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ColumnMaskOptions": {
+      "fields": {
+        "function_name": {
+          "description": "The fully qualified name of the column mask function.\nThe function is called on each row of the target table.\nThe function's first argument and its return type should match the type of the masked column.\nRequired on create and update.",
+          "launch_stage": "GA"
+        },
+        "on_column": {
+          "description": "The alias of the column to be masked. The alias must refer to one of matched columns.\nThe values of the column is passed to the column mask function as the first argument.\nRequired on create and update.",
+          "launch_stage": "GA"
+        },
+        "using": {
+          "description": "Optional list of column aliases or constant literals to be passed as additional arguments to the column mask function.\nThe type of each column should match the positional argument of the column mask function.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.ColumnRelationship": {
+      "fields": {
+        "source": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "target": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.ColumnTagValueExtraction": {
+      "description": "Extracts the value of a column-level tag: get_column_tag_value(col, \"tagKey\").",
+      "fields": {
+        "column_alias": {
+          "description": "The alias from MATCH COLUMNS that identifies the column.",
+          "launch_stage": "GA"
+        },
+        "tag_key": {
+          "description": "1024 matches the max_length on FunctionArgument.constant above.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ColumnTypeName": {
+      "enum": [
+        "BOOLEAN",
+        "BYTE",
+        "SHORT",
+        "INT",
+        "LONG",
+        "FLOAT",
+        "DOUBLE",
+        "DATE",
+        "TIMESTAMP",
+        "STRING",
+        "BINARY",
+        "DECIMAL",
+        "INTERVAL",
+        "ARRAY",
+        "STRUCT",
+        "MAP",
+        "CHAR",
+        "NULL",
+        "USER_DEFINED_TYPE",
+        "TIMESTAMP_NTZ",
+        "VARIANT",
+        "GEOMETRY",
+        "GEOGRAPHY",
+        "TABLE_TYPE"
+      ],
+      "enum_launch_stages": {
+        "ARRAY": "GA",
+        "BINARY": "GA",
+        "BOOLEAN": "GA",
+        "BYTE": "GA",
+        "CHAR": "GA",
+        "DATE": "GA",
+        "DECIMAL": "GA",
+        "DOUBLE": "GA",
+        "FLOAT": "GA",
+        "GEOGRAPHY": "GA",
+        "GEOMETRY": "GA",
+        "INT": "GA",
+        "INTERVAL": "GA",
+        "LONG": "GA",
+        "MAP": "GA",
+        "NULL": "GA",
+        "SHORT": "GA",
+        "STRING": "GA",
+        "STRUCT": "GA",
+        "TABLE_TYPE": "GA",
+        "TIMESTAMP": "GA",
+        "TIMESTAMP_NTZ": "GA",
+        "USER_DEFINED_TYPE": "GA",
+        "VARIANT": "GA"
+      }
+    },
+    "catalog.ConnectionDependency": {
+      "description": "A connection that is dependent on a SQL object.",
+      "fields": {
+        "connection_name": {
+          "description": "Full name of the dependent connection, in the form of __connection_name__.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ConnectionInfo": {
+      "fields": {
+        "comment": {
+          "description": "User-provided free-form text description.",
+          "launch_stage": "GA"
+        },
+        "connection_id": {
+          "description": "Unique identifier of the Connection.",
+          "launch_stage": "GA"
+        },
+        "connection_type": {
+          "description": "The type of connection.",
+          "ref": "catalog.ConnectionType",
+          "launch_stage": "GA"
+        },
+        "created_at": {
+          "description": "Time at which this connection was created, in epoch milliseconds.",
+          "launch_stage": "GA"
+        },
+        "created_by": {
+          "description": "Username of connection creator.",
+          "launch_stage": "GA"
+        },
+        "credential_type": {
+          "description": "The type of credential.",
+          "ref": "catalog.CredentialType",
+          "launch_stage": "GA"
+        },
+        "environment_settings": {
+          "description": "[Create,Update:OPT] Connection environment settings as EnvironmentSettings object.",
+          "ref": "catalog.EnvironmentSettings",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "full_name": {
+          "description": "Full name of connection.",
+          "launch_stage": "GA"
+        },
+        "metastore_id": {
+          "description": "Unique identifier of parent metastore.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of the connection.",
+          "launch_stage": "GA"
+        },
+        "options": {
+          "description": "A map of key-value properties attached to the securable.",
+          "launch_stage": "GA"
+        },
+        "owner": {
+          "description": "Username of current owner of the connection.",
+          "launch_stage": "GA"
+        },
+        "properties": {
+          "description": "A map of key-value properties attached to the securable.",
+          "launch_stage": "GA"
+        },
+        "provisioning_info": {
+          "ref": "catalog.ProvisioningInfo",
+          "launch_stage": "GA"
+        },
+        "read_only": {
+          "description": "If the connection is read only.",
+          "launch_stage": "GA"
+        },
+        "secrets": {
+          "description": "A map of option names to UC Secret references. Keys are connection option names\n(same as in OptionsKVPairs) and values are UC Secret fully qualified names.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "securable_type": {
+          "ref": "catalog.SecurableType",
+          "launch_stage": "GA"
+        },
+        "updated_at": {
+          "description": "Time at which this connection was updated, in epoch milliseconds.",
+          "launch_stage": "GA"
+        },
+        "updated_by": {
+          "description": "Username of user who last modified connection.",
+          "launch_stage": "GA"
+        },
+        "url": {
+          "description": "URL of the remote data source, extracted from options.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ConnectionType": {
+      "enum": [
+        "UNKNOWN_CONNECTION_TYPE",
+        "MYSQL",
+        "POSTGRESQL",
+        "SNOWFLAKE",
+        "REDSHIFT",
+        "SQLDW",
+        "SQLSERVER",
+        "DATABRICKS",
+        "SALESFORCE",
+        "BIGQUERY",
+        "NETSUITE",
+        "WORKDAY_RAAS",
+        "HIVE_METASTORE",
+        "GA4_RAW_DATA",
+        "SERVICENOW",
+        "SALESFORCE_DATA_CLOUD",
+        "GLUE",
+        "ORACLE",
+        "TERADATA",
+        "HTTP",
+        "POWER_BI",
+        "DYNAMICS365",
+        "CONFLUENCE",
+        "JDBC",
+        "META_MARKETING",
+        "TIKTOK_ADS",
+        "HUBSPOT",
+        "ZENDESK",
+        "AWS_SECRETS_MANAGER",
+        "AZURE_KEY_VAULT",
+        "GITHUB",
+        "OUTLOOK",
+        "SMARTSHEET"
+      ],
+      "enum_launch_stages": {
+        "AWS_SECRETS_MANAGER": "PUBLIC_BETA",
+        "AZURE_KEY_VAULT": "PUBLIC_BETA",
+        "BIGQUERY": "GA",
+        "CONFLUENCE": "GA",
+        "DATABRICKS": "GA",
+        "DYNAMICS365": "GA",
+        "GA4_RAW_DATA": "GA",
+        "GITHUB": "PUBLIC_BETA",
+        "GLUE": "GA",
+        "HIVE_METASTORE": "GA",
+        "HTTP": "GA",
+        "HUBSPOT": "GA",
+        "JDBC": "PUBLIC_PREVIEW",
+        "META_MARKETING": "GA",
+        "MYSQL": "GA",
+        "NETSUITE": "GA",
+        "ORACLE": "GA",
+        "OUTLOOK": "PUBLIC_BETA",
+        "POSTGRESQL": "GA",
+        "POWER_BI": "GA",
+        "REDSHIFT": "GA",
+        "SALESFORCE": "GA",
+        "SALESFORCE_DATA_CLOUD": "GA",
+        "SERVICENOW": "GA",
+        "SMARTSHEET": "GA",
+        "SNOWFLAKE": "GA",
+        "SQLDW": "GA",
+        "SQLSERVER": "GA",
+        "TERADATA": "GA",
+        "TIKTOK_ADS": "PUBLIC_BETA",
+        "UNKNOWN_CONNECTION_TYPE": "GA",
+        "WORKDAY_RAAS": "GA",
+        "ZENDESK": "GA"
+      }
+    },
+    "catalog.ContinuousUpdateStatus": {
+      "description": "Detailed status of an online table. Shown if the online table is in the ONLINE_CONTINUOUS_UPDATE\nor the ONLINE_UPDATING_PIPELINE_RESOURCES state.",
+      "fields": {
+        "initial_pipeline_sync_progress": {
+          "description": "Progress of the initial data synchronization.",
+          "ref": "catalog.PipelineProgress",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "last_processed_commit_version": {
+          "description": "The last source table Delta version that was synced to the online table. Note that this Delta\nversion may not be completely synced to the online table yet.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "timestamp": {
+          "description": "The timestamp of the last time any data was synchronized from the source table to the online\ntable.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.CreateAccessRequest": {
+      "fields": {
+        "behalf_of": {
+          "description": "Optional. The principal this request is for.\nEmpty `behalf_of` defaults to the requester's identity.\n\nPrincipals must be unique across the API call.",
+          "ref": "catalog.Principal",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "comment": {
+          "description": "Optional. Comment associated with the request.\n\nAt most 200 characters, can only contain lowercase/uppercase\nletters (a-z, A-Z), numbers (0-9), punctuation, and spaces.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "securable_permissions": {
+          "description": "List of securables and their corresponding requested UC privileges.\n\nAt most 30 securables can be requested for a principal per batched call.\nEach securable can only be requested once per principal.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.CreateAccessRequestResponse": {
+      "fields": {
+        "behalf_of": {
+          "description": "The principal the request was made on behalf of.",
+          "ref": "catalog.Principal",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "request_destinations": {
+          "description": "The access request destinations for all the securables the principal requested.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.CreateAccountsMetastore": {
+      "fields": {
+        "external_access_enabled": {
+          "description": "Whether to allow non-DBR clients to directly access entities under the metastore.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The user-specified name of the metastore.",
+          "launch_stage": "GA"
+        },
+        "region": {
+          "description": "Cloud region which the metastore serves (e.g., `us-west-2`, `westus`).",
+          "launch_stage": "GA"
+        },
+        "storage_root": {
+          "description": "The storage root URL for metastore",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.CreateAccountsStorageCredential": {
+      "fields": {
+        "aws_iam_role": {
+          "description": "The AWS IAM role configuration.",
+          "ref": "catalog.AwsIamRoleRequest",
+          "launch_stage": "GA"
+        },
+        "azure_managed_identity": {
+          "description": "The Azure managed identity configuration.",
+          "ref": "catalog.AzureManagedIdentityRequest",
+          "launch_stage": "GA"
+        },
+        "azure_service_principal": {
+          "description": "The Azure service principal configuration.",
+          "ref": "catalog.AzureServicePrincipal",
+          "launch_stage": "GA"
+        },
+        "cloudflare_api_token": {
+          "description": "The Cloudflare API token configuration.",
+          "ref": "catalog.CloudflareApiToken",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "comment": {
+          "description": "Comment associated with the credential.",
+          "launch_stage": "GA"
+        },
+        "databricks_gcp_service_account": {
+          "description": "The Databricks managed GCP service account configuration.",
+          "ref": "catalog.DatabricksGcpServiceAccountRequest",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The credential name. The name must be unique among storage and service\ncredentials within the metastore.",
+          "launch_stage": "GA"
+        },
+        "read_only": {
+          "description": "Whether the credential is usable only for read operations. Only applicable\nwhen purpose is **STORAGE**.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.CreateCatalog": {
+      "fields": {
+        "comment": {
+          "description": "User-provided free-form text description.",
+          "launch_stage": "GA"
+        },
+        "connection_name": {
+          "description": "The name of the connection to an external data source.",
+          "launch_stage": "GA"
+        },
+        "custom_max_retention_hours": {
+          "description": "Custom maximum retention period in hours for the catalog",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "managed_encryption_settings": {
+          "description": "Control CMK encryption for managed catalog data",
+          "ref": "catalog.EncryptionSettings",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of catalog.",
+          "launch_stage": "GA"
+        },
+        "options": {
+          "description": "A map of key-value properties attached to the securable.",
+          "launch_stage": "GA"
+        },
+        "properties": {
+          "description": "A map of key-value properties attached to the securable.",
+          "launch_stage": "GA"
+        },
+        "provider_name": {
+          "description": "The name of delta sharing provider.\n\nA Delta Sharing catalog is a catalog that is based on a Delta share on a remote sharing server.",
+          "launch_stage": "GA"
+        },
+        "share_name": {
+          "description": "The name of the share under the share provider.",
+          "launch_stage": "GA"
+        },
+        "storage_root": {
+          "description": "Storage root URL for managed tables within catalog.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.CreateConnection": {
+      "fields": {
+        "comment": {
+          "description": "User-provided free-form text description.",
+          "launch_stage": "GA"
+        },
+        "connection_type": {
+          "description": "The type of connection.",
+          "ref": "catalog.ConnectionType",
+          "launch_stage": "GA"
+        },
+        "environment_settings": {
+          "description": "[Create,Update:OPT] Connection environment settings as EnvironmentSettings object.",
+          "ref": "catalog.EnvironmentSettings",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "name": {
+          "description": "Name of the connection.",
+          "launch_stage": "GA"
+        },
+        "options": {
+          "description": "A map of key-value properties attached to the securable.",
+          "launch_stage": "GA"
+        },
+        "parent": {
+          "description": "Parent schema for schema-level connections, in format \"schemas/{catalog}.{schema}\".\nAbsent for metastore-level (L1) connections.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "properties": {
+          "description": "A map of key-value properties attached to the securable.",
+          "launch_stage": "GA"
+        },
+        "read_only": {
+          "description": "If the connection is read only.",
+          "launch_stage": "GA"
+        },
+        "secrets": {
+          "description": "A map of option names to UC Secret references. Keys are connection option names\n(same as in OptionsKVPairs) and values are UC Secret fully qualified names.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.CreateCredentialRequest": {
+      "fields": {
+        "aws_iam_role": {
+          "description": "The AWS IAM role configuration.",
+          "ref": "catalog.AwsIamRole",
+          "launch_stage": "GA"
+        },
+        "azure_managed_identity": {
+          "description": "The Azure managed identity configuration.",
+          "ref": "catalog.AzureManagedIdentity",
+          "launch_stage": "GA"
+        },
+        "azure_service_principal": {
+          "description": "The Azure service principal configuration.",
+          "ref": "catalog.AzureServicePrincipal",
+          "launch_stage": "GA"
+        },
+        "comment": {
+          "description": "Comment associated with the credential.",
+          "launch_stage": "GA"
+        },
+        "databricks_gcp_service_account": {
+          "description": "The Databricks managed GCP service account configuration.",
+          "ref": "catalog.DatabricksGcpServiceAccount",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The credential name. The name must be unique among storage and service\ncredentials within the metastore.",
+          "launch_stage": "GA"
+        },
+        "purpose": {
+          "description": "Indicates the purpose of the credential.",
+          "ref": "catalog.CredentialPurpose",
+          "launch_stage": "GA"
+        },
+        "read_only": {
+          "description": "Whether the credential is usable only for read operations. Only applicable\nwhen purpose is **STORAGE**.",
+          "launch_stage": "GA"
+        },
+        "skip_validation": {
+          "description": "Optional. Supplying true to this argument skips validation of the created\nset of credentials.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.CreateEntityTagAssignmentRequest": {
+      "fields": {
+        "tag_assignment": {
+          "ref": "catalog.EntityTagAssignment",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.CreateExternalLineageRelationshipRequest": {
+      "fields": {
+        "external_lineage_relationship": {
+          "ref": "catalog.CreateRequestExternalLineage",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.CreateExternalLocation": {
+      "fields": {
+        "comment": {
+          "description": "User-provided free-form text description.",
+          "launch_stage": "GA"
+        },
+        "credential_name": {
+          "description": "Name of the storage credential used with this location.",
+          "launch_stage": "GA"
+        },
+        "effective_enable_file_events": {
+          "description": "The effective value of `enable_file_events` after applying server-side defaults.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "effective_file_event_queue": {
+          "description": "The effective file event queue configuration after applying server-side defaults.\nAlways populated when a queue is provisioned, regardless of whether the user explicitly\nset `enable_file_events`. Use this field instead of `file_event_queue` for reading\nthe actual queue state.",
+          "ref": "catalog.FileEventQueue",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "enable_file_events": {
+          "description": "Whether to enable file events on this external location. Default to `true`. Set to `false` to disable file events.\nThe actual applied value may differ due to server-side defaults; check `effective_enable_file_events` for the effective state.",
+          "launch_stage": "GA"
+        },
+        "encryption_details": {
+          "ref": "catalog.EncryptionDetails",
+          "launch_stage": "GA"
+        },
+        "fallback": {
+          "description": "Indicates whether fallback mode is enabled for this external location. When fallback mode is enabled, the access to the location falls back to cluster credentials if UC credentials are not sufficient.",
+          "launch_stage": "GA"
+        },
+        "file_event_queue": {
+          "description": "File event queue settings. If `enable_file_events` is not `false`, must be defined and have exactly one of the documented properties.",
+          "ref": "catalog.FileEventQueue",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of the external location.",
+          "launch_stage": "GA"
+        },
+        "read_only": {
+          "description": "Indicates whether the external location is read-only.",
+          "launch_stage": "GA"
+        },
+        "skip_validation": {
+          "description": "Skips validation of the storage credential associated with the external location.",
+          "launch_stage": "GA"
+        },
+        "url": {
+          "description": "Path URL of the external location.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.CreateExternalMetadataRequest": {
+      "fields": {
+        "external_metadata": {
+          "ref": "catalog.ExternalMetadata",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.CreateFunction": {
+      "fields": {
+        "catalog_name": {
+          "description": "Name of parent Catalog.",
+          "launch_stage": "GA"
+        },
+        "comment": {
+          "description": "User-provided free-form text description.",
+          "launch_stage": "GA"
+        },
+        "data_type": {
+          "description": "Scalar function return data type.",
+          "ref": "catalog.ColumnTypeName",
+          "launch_stage": "GA"
+        },
+        "external_language": {
+          "description": "External function language.",
+          "launch_stage": "GA"
+        },
+        "external_name": {
+          "description": "External function name.",
+          "launch_stage": "GA"
+        },
+        "full_data_type": {
+          "description": "Pretty printed function data type.",
+          "launch_stage": "GA"
+        },
+        "input_params": {
+          "description": "Function input parameters.",
+          "ref": "catalog.FunctionParameterInfos",
+          "launch_stage": "GA"
+        },
+        "is_deterministic": {
+          "description": "Whether the function is deterministic.",
+          "launch_stage": "GA"
+        },
+        "is_null_call": {
+          "description": "Function null call.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of function, relative to parent schema.",
+          "launch_stage": "GA"
+        },
+        "parameter_style": {
+          "description": "Function parameter style. **S** is the value for SQL.",
+          "ref": "catalog.CreateFunctionParameterStyle",
+          "launch_stage": "GA"
+        },
+        "properties": {
+          "description": "JSON-serialized key-value pair map, encoded (escaped) as a string.",
+          "launch_stage": "GA"
+        },
+        "return_params": {
+          "description": "Table function return parameters.",
+          "ref": "catalog.FunctionParameterInfos",
+          "launch_stage": "GA"
+        },
+        "routine_body": {
+          "description": "Function language. When **EXTERNAL** is used, the language of the routine function should be specified in the **external_language** field, and the **return_params** of the function cannot be used (as **TABLE** return type is not supported), and the **sql_data_access** field must be **NO_SQL**.",
+          "ref": "catalog.CreateFunctionRoutineBody",
+          "launch_stage": "GA"
+        },
+        "routine_definition": {
+          "description": "Function body.",
+          "launch_stage": "GA"
+        },
+        "routine_dependencies": {
+          "description": "Function dependencies. For external UDFs, dependencies may\ncontain only credential, secret, or volume objects.",
+          "ref": "catalog.DependencyList",
+          "launch_stage": "GA"
+        },
+        "schema_name": {
+          "description": "Name of parent Schema relative to its parent Catalog.",
+          "launch_stage": "GA"
+        },
+        "security_type": {
+          "description": "Function security type.",
+          "ref": "catalog.CreateFunctionSecurityType",
+          "launch_stage": "GA"
+        },
+        "specific_name": {
+          "description": "Specific name of the function; Reserved for future use.",
+          "launch_stage": "GA"
+        },
+        "sql_data_access": {
+          "description": "Function SQL data access.",
+          "ref": "catalog.CreateFunctionSqlDataAccess",
+          "launch_stage": "GA"
+        },
+        "sql_path": {
+          "description": "List of schemes whose objects can be referenced without qualification.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.CreateFunctionParameterStyle": {
+      "enum": [
+        "S"
+      ],
+      "enum_launch_stages": {
+        "S": "GA"
+      }
+    },
+    "catalog.CreateFunctionRequest": {
+      "fields": {
+        "function_info": {
+          "description": "Partial __FunctionInfo__ specifying the function to be created.",
+          "ref": "catalog.CreateFunction",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.CreateFunctionRoutineBody": {
+      "enum": [
+        "SQL",
+        "EXTERNAL"
+      ],
+      "enum_launch_stages": {
+        "EXTERNAL": "GA",
+        "SQL": "GA"
+      }
+    },
+    "catalog.CreateFunctionSecurityType": {
+      "enum": [
+        "DEFINER"
+      ],
+      "enum_launch_stages": {
+        "DEFINER": "GA"
+      }
+    },
+    "catalog.CreateFunctionSqlDataAccess": {
+      "enum": [
+        "CONTAINS_SQL",
+        "READS_SQL_DATA",
+        "NO_SQL"
+      ],
+      "enum_launch_stages": {
+        "CONTAINS_SQL": "GA",
+        "NO_SQL": "GA",
+        "READS_SQL_DATA": "GA"
+      }
+    },
+    "catalog.CreateMcpServiceRequest": {
+      "fields": {
+        "mcp_service": {
+          "description": "The MCP service to create. Do not set `name`; the server derives it from\n`parent` and `mcp_service_id`. `source_connection` is required.",
+          "ref": "catalog.McpService",
+          "launch_stage": "GA"
+        },
+        "mcp_service_id": {
+          "description": "Name for the MCP service, e.g. \"my_mcp_service\".",
+          "launch_stage": "GA"
+        },
+        "parent": {
+          "description": "Name of the parent schema.\nFormat: `schemas/{catalog}.{schema}`.\nEach `{...}` component is capped at 255 characters individually.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.CreateMcpServiceUserMappedCredentialRequest": {
+      "fields": {
+        "login": {
+          "ref": "catalog.McpServiceUserMappedCredentialLogin",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "catalog.CreateMetastore": {
+      "fields": {
+        "external_access_enabled": {
+          "description": "Whether to allow non-DBR clients to directly access entities under the metastore.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The user-specified name of the metastore.",
+          "launch_stage": "GA"
+        },
+        "region": {
+          "description": "Cloud region which the metastore serves (e.g., `us-west-2`, `westus`).",
+          "launch_stage": "GA"
+        },
+        "storage_root": {
+          "description": "The storage root URL for metastore",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.CreateMetastoreAssignment": {
+      "fields": {
+        "default_catalog_name": {
+          "description": "The name of the default catalog in the metastore.\nThis field is deprecated. Please use \"Default Namespace API\" to\nconfigure the default catalog for a Databricks workspace.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "metastore_id": {
+          "description": "The unique ID of the metastore.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.CreateModelProviderServiceRequest": {
+      "fields": {
+        "model_provider_service": {
+          "description": "The model provider service to create. Do not set `name`; the server derives\nit from `parent` and `model_provider_service_id`.",
+          "ref": "catalog.ModelProviderService",
+          "launch_stage": "GA"
+        },
+        "model_provider_service_id": {
+          "description": "Name for the model provider service, e.g. \"openai_prod\".",
+          "launch_stage": "GA"
+        },
+        "parent": {
+          "description": "Name of the parent schema.\nFormat: `schemas/{catalog}.{schema}`.\nEach `{...}` component is capped at 255 characters individually.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.CreateModelServiceRequest": {
+      "fields": {
+        "model_service": {
+          "description": "The model service to create. Do not set `name`; the server derives it from\n`parent` and `model_service_id`.",
+          "ref": "catalog.ModelService",
+          "launch_stage": "GA"
+        },
+        "model_service_id": {
+          "description": "Name for the model service, e.g. \"my_model_service\".",
+          "launch_stage": "GA"
+        },
+        "parent": {
+          "description": "Name of the parent schema.\nFormat: `schemas/{catalog}.{schema}`.\nEach `{...}` component is capped at 255 characters individually.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.CreateMonitor": {
+      "fields": {
+        "assets_dir": {
+          "description": "[Create:REQ Update:IGN] Field for specifying the absolute path to a custom directory to store data-monitoring\nassets. Normally prepopulated to a default user location via UI and Python APIs.",
+          "launch_stage": "GA"
+        },
+        "baseline_table_name": {
+          "description": "[Create:OPT Update:OPT] Baseline table name.\nBaseline data is used to compute drift from the data in the monitored `table_name`.\nThe baseline table and the monitored table shall have the same schema.",
+          "launch_stage": "GA"
+        },
+        "custom_metrics": {
+          "description": "[Create:OPT Update:OPT] Custom metrics.",
+          "launch_stage": "GA"
+        },
+        "data_classification_config": {
+          "description": "[Create:OPT Update:OPT] Data classification related config.",
+          "ref": "catalog.MonitorDataClassificationConfig",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "inference_log": {
+          "ref": "catalog.MonitorInferenceLog",
+          "launch_stage": "GA"
+        },
+        "latest_monitor_failure_msg": {
+          "description": "[Create:ERR Update:IGN] The latest error message for a monitor failure.",
+          "launch_stage": "GA"
+        },
+        "notifications": {
+          "description": "[Create:OPT Update:OPT] Field for specifying notification settings.",
+          "ref": "catalog.MonitorNotifications",
+          "launch_stage": "GA"
+        },
+        "output_schema_name": {
+          "description": "[Create:REQ Update:REQ] Schema where output tables are created. Needs to be in 2-level format {catalog}.{schema}",
+          "launch_stage": "GA"
+        },
+        "schedule": {
+          "description": "[Create:OPT Update:OPT] The monitor schedule.",
+          "ref": "catalog.MonitorCronSchedule",
+          "launch_stage": "GA"
+        },
+        "skip_builtin_dashboard": {
+          "description": "Whether to skip creating a default dashboard summarizing data quality metrics.",
+          "launch_stage": "GA"
+        },
+        "slicing_exprs": {
+          "description": "[Create:OPT Update:OPT] List of column expressions to slice data with for targeted analysis. The data is grouped by\neach expression independently, resulting in a separate slice for each predicate and its\ncomplements. For example `slicing_exprs=[“col_1”, “col_2 \u003e 10”]` will generate the following\nslices: two slices for `col_2 \u003e 10` (True and False), and one slice per unique value in\n`col1`. For high-cardinality columns, only the top 100 unique values by frequency will\ngenerate slices.",
+          "launch_stage": "GA"
+        },
+        "snapshot": {
+          "description": "Configuration for monitoring snapshot tables.",
+          "ref": "catalog.MonitorSnapshot",
+          "launch_stage": "GA"
+        },
+        "time_series": {
+          "description": "Configuration for monitoring time series tables.",
+          "ref": "catalog.MonitorTimeSeries",
+          "launch_stage": "GA"
+        },
+        "warehouse_id": {
+          "description": "Optional argument to specify the warehouse for dashboard creation. If not specified, the first running\nwarehouse will be used.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.CreateOnlineTableRequest": {
+      "fields": {
+        "table": {
+          "description": "Specification of the online table to be created.",
+          "ref": "catalog.OnlineTable",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.CreatePolicyRequest": {
+      "fields": {
+        "policy_info": {
+          "description": "Required. The policy to create.",
+          "ref": "catalog.PolicyInfo",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.CreateRegisteredModelRequest": {
+      "fields": {
+        "aliases": {
+          "description": "List of aliases associated with the registered model",
+          "launch_stage": "GA"
+        },
+        "browse_only": {
+          "description": "Indicates whether the principal is limited to retrieving metadata for the associated object through the BROWSE privilege when include_browse is enabled in the request.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "catalog_name": {
+          "description": "The name of the catalog where the schema and the registered model reside",
+          "launch_stage": "GA"
+        },
+        "comment": {
+          "description": "The comment attached to the registered model",
+          "launch_stage": "GA"
+        },
+        "created_at": {
+          "description": "Creation timestamp of the registered model in milliseconds since the Unix epoch",
+          "launch_stage": "GA"
+        },
+        "created_by": {
+          "description": "The identifier of the user who created the registered model",
+          "launch_stage": "GA"
+        },
+        "full_name": {
+          "description": "The three-level (fully qualified) name of the registered model",
+          "launch_stage": "GA"
+        },
+        "metastore_id": {
+          "description": "The unique identifier of the metastore",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The name of the registered model",
+          "launch_stage": "GA"
+        },
+        "owner": {
+          "description": "The identifier of the user who owns the registered model",
+          "launch_stage": "GA"
+        },
+        "schema_name": {
+          "description": "The name of the schema where the registered model resides",
+          "launch_stage": "GA"
+        },
+        "storage_location": {
+          "description": "The storage location on the cloud under which model version data files are stored",
+          "launch_stage": "GA"
+        },
+        "updated_at": {
+          "description": "Last-update timestamp of the registered model in milliseconds since the Unix epoch",
+          "launch_stage": "GA"
+        },
+        "updated_by": {
+          "description": "The identifier of the user who updated the registered model last time",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.CreateRequestExternalLineage": {
+      "fields": {
+        "columns": {
+          "description": "List of column relationships between source and target objects.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "id": {
+          "description": "Unique identifier of the external lineage relationship.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "properties": {
+          "description": "Key-value properties associated with the external lineage relationship.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "source": {
+          "description": "Source object of the external lineage relationship.",
+          "ref": "catalog.ExternalLineageObject",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "target": {
+          "description": "Target object of the external lineage relationship.",
+          "ref": "catalog.ExternalLineageObject",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.CreateSchema": {
+      "fields": {
+        "catalog_name": {
+          "description": "Name of parent catalog.",
+          "launch_stage": "GA"
+        },
+        "comment": {
+          "description": "User-provided free-form text description.",
+          "launch_stage": "GA"
+        },
+        "custom_max_retention_hours": {
+          "description": "Custom maximum retention period in hours for the schema.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "name": {
+          "description": "Name of schema, relative to parent catalog.",
+          "launch_stage": "GA"
+        },
+        "properties": {
+          "description": "A map of key-value properties attached to the securable.",
+          "launch_stage": "GA"
+        },
+        "storage_root": {
+          "description": "Storage root URL for managed tables within schema.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.CreateSecretRequest": {
+      "fields": {
+        "secret": {
+          "description": "The secret object to create. The **name**, **catalog_name**, **schema_name**, and **value**\nfields are required.",
+          "ref": "catalog.Secret",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.CreateSkillRequest": {
+      "fields": {
+        "parent": {
+          "description": "Name of the parent schema.\nFormat: `schemas/{catalog}.{schema}`.\nEach `{...}` component is capped at 255 characters individually.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "skill": {
+          "description": "The skill to create. `comment` is the only accepted client input and may be\nomitted. Do not set `name`; the server derives it from `parent` and\n`skill_id`.",
+          "ref": "catalog.Skill",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "skill_id": {
+          "description": "Name for the skill, e.g. \"basic-math\". The server normalizes this\nidentifier to lowercase. It is independent of the bundle name read from\nSKILL.md.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "catalog.CreateStorageCredential": {
+      "fields": {
+        "aws_iam_role": {
+          "description": "The AWS IAM role configuration.",
+          "ref": "catalog.AwsIamRoleRequest",
+          "launch_stage": "GA"
+        },
+        "azure_managed_identity": {
+          "description": "The Azure managed identity configuration.",
+          "ref": "catalog.AzureManagedIdentityRequest",
+          "launch_stage": "GA"
+        },
+        "azure_service_principal": {
+          "description": "The Azure service principal configuration.",
+          "ref": "catalog.AzureServicePrincipal",
+          "launch_stage": "GA"
+        },
+        "cloudflare_api_token": {
+          "description": "The Cloudflare API token configuration.",
+          "ref": "catalog.CloudflareApiToken",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "comment": {
+          "description": "Comment associated with the credential.",
+          "launch_stage": "GA"
+        },
+        "databricks_gcp_service_account": {
+          "description": "The Databricks managed GCP service account configuration.",
+          "ref": "catalog.DatabricksGcpServiceAccountRequest",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The credential name. The name must be unique among storage and service\ncredentials within the metastore.",
+          "launch_stage": "GA"
+        },
+        "read_only": {
+          "description": "Whether the credential is usable only for read operations. Only applicable\nwhen purpose is **STORAGE**.",
+          "launch_stage": "GA"
+        },
+        "skip_validation": {
+          "description": "Supplying true to this argument skips validation of the created credential.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.CreateTableConstraint": {
+      "fields": {
+        "constraint": {
+          "ref": "catalog.TableConstraint",
+          "launch_stage": "GA"
+        },
+        "full_name_arg": {
+          "description": "The full name of the table referenced by the constraint.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.CreateTableRequest": {
+      "fields": {
+        "catalog_name": {
+          "description": "Name of parent catalog.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "columns": {
+          "description": "The array of __ColumnInfo__ definitions of the table's columns.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "data_source_format": {
+          "ref": "catalog.DataSourceFormat",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "name": {
+          "description": "Name of table, relative to parent schema.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "properties": {
+          "description": "A map of key-value properties attached to the securable.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "schema_name": {
+          "description": "Name of parent schema relative to its parent catalog.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "storage_location": {
+          "description": "Storage root URL for table (for **MANAGED**, **EXTERNAL** tables).",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "table_type": {
+          "ref": "catalog.TableType",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.CreateVolumeRequestContent": {
+      "fields": {
+        "catalog_name": {
+          "description": "The name of the catalog where the schema and the volume are",
+          "launch_stage": "GA"
+        },
+        "comment": {
+          "description": "The comment attached to the volume",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The name of the volume",
+          "launch_stage": "GA"
+        },
+        "schema_name": {
+          "description": "The name of the schema where the volume is",
+          "launch_stage": "GA"
+        },
+        "storage_location": {
+          "description": "The storage location on the cloud",
+          "launch_stage": "GA"
+        },
+        "volume_type": {
+          "description": "The type of the volume. An external volume is located in the specified external location.\nA managed volume is located in the default location which is specified by the parent schema, or the parent catalog, or the Metastore.\n[Learn more](https://docs.databricks.com/aws/en/volumes/managed-vs-external)",
+          "ref": "catalog.VolumeType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.CredentialDependency": {
+      "description": "A credential that is dependent on a SQL object.",
+      "fields": {
+        "credential_name": {
+          "description": "Full name of the dependent credential, in the form of __credential_name__.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.CredentialInfo": {
+      "fields": {
+        "aws_iam_role": {
+          "description": "The AWS IAM role configuration.",
+          "ref": "catalog.AwsIamRole",
+          "launch_stage": "GA"
+        },
+        "azure_managed_identity": {
+          "description": "The Azure managed identity configuration.",
+          "ref": "catalog.AzureManagedIdentity",
+          "launch_stage": "GA"
+        },
+        "azure_service_principal": {
+          "description": "The Azure service principal configuration.",
+          "ref": "catalog.AzureServicePrincipal",
+          "launch_stage": "GA"
+        },
+        "comment": {
+          "description": "Comment associated with the credential.",
+          "launch_stage": "GA"
+        },
+        "created_at": {
+          "description": "Time at which this credential was created, in epoch milliseconds.",
+          "launch_stage": "GA"
+        },
+        "created_by": {
+          "description": "Username of credential creator.",
+          "launch_stage": "GA"
+        },
+        "databricks_gcp_service_account": {
+          "description": "The Databricks managed GCP service account configuration.",
+          "ref": "catalog.DatabricksGcpServiceAccount",
+          "launch_stage": "GA"
+        },
+        "full_name": {
+          "description": "The full name of the credential.",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "The unique identifier of the credential.",
+          "launch_stage": "GA"
+        },
+        "isolation_mode": {
+          "description": "Whether the current securable is accessible from all workspaces or a\nspecific set of workspaces.",
+          "ref": "catalog.IsolationMode",
+          "launch_stage": "GA"
+        },
+        "metastore_id": {
+          "description": "Unique identifier of the parent metastore.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The credential name. The name must be unique among storage and service\ncredentials within the metastore.",
+          "launch_stage": "GA"
+        },
+        "owner": {
+          "description": "Username of current owner of credential.",
+          "launch_stage": "GA"
+        },
+        "purpose": {
+          "description": "Indicates the purpose of the credential.",
+          "ref": "catalog.CredentialPurpose",
+          "launch_stage": "GA"
+        },
+        "read_only": {
+          "description": "Whether the credential is usable only for read operations. Only applicable\nwhen purpose is **STORAGE**.",
+          "launch_stage": "GA"
+        },
+        "updated_at": {
+          "description": "Time at which this credential was last modified, in epoch milliseconds.",
+          "launch_stage": "GA"
+        },
+        "updated_by": {
+          "description": "Username of user who last modified the credential.",
+          "launch_stage": "GA"
+        },
+        "used_for_managed_storage": {
+          "description": "Whether this credential is the current metastore's root storage credential.\nOnly applicable when purpose is **STORAGE**.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.CredentialPurpose": {
+      "enum": [
+        "STORAGE",
+        "SERVICE"
+      ],
+      "enum_launch_stages": {
+        "SERVICE": "GA",
+        "STORAGE": "GA"
+      }
+    },
+    "catalog.CredentialType": {
+      "enum": [
+        "UNKNOWN_CREDENTIAL_TYPE",
+        "USERNAME_PASSWORD",
+        "OAUTH_U2M",
+        "OAUTH_M2M",
+        "OAUTH_REFRESH_TOKEN",
+        "OAUTH_ACCESS_TOKEN",
+        "OAUTH_RESOURCE_OWNER_PASSWORD",
+        "SERVICE_CREDENTIAL",
+        "BEARER_TOKEN",
+        "OIDC_TOKEN",
+        "PEM_PRIVATE_KEY",
+        "OAUTH_U2M_MAPPING",
+        "ANY_STATIC_CREDENTIAL",
+        "OAUTH_MTLS",
+        "SSWS_TOKEN",
+        "EDGEGRID_AKAMAI"
+      ],
+      "enum_launch_stages": {
+        "ANY_STATIC_CREDENTIAL": "GA",
+        "BEARER_TOKEN": "GA",
+        "EDGEGRID_AKAMAI": "GA",
+        "OAUTH_ACCESS_TOKEN": "GA",
+        "OAUTH_M2M": "GA",
+        "OAUTH_MTLS": "GA",
+        "OAUTH_REFRESH_TOKEN": "GA",
+        "OAUTH_RESOURCE_OWNER_PASSWORD": "GA",
+        "OAUTH_U2M": "GA",
+        "OAUTH_U2M_MAPPING": "GA",
+        "OIDC_TOKEN": "GA",
+        "PEM_PRIVATE_KEY": "GA",
+        "SERVICE_CREDENTIAL": "GA",
+        "SSWS_TOKEN": "GA",
+        "UNKNOWN_CREDENTIAL_TYPE": "GA",
+        "USERNAME_PASSWORD": "GA"
+      }
+    },
+    "catalog.CredentialValidationResult": {
+      "fields": {
+        "message": {
+          "description": "Error message would exist when the result does not equal to **PASS**.",
+          "launch_stage": "GA"
+        },
+        "result": {
+          "description": "The results of the tested operation.",
+          "ref": "catalog.ValidateCredentialResult",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.CurrentRequest": {},
+    "catalog.DataSourceFormat": {
+      "description": "Data source format",
+      "enum": [
+        "DELTA",
+        "CSV",
+        "JSON",
+        "AVRO",
+        "PARQUET",
+        "ORC",
+        "TEXT",
+        "UNITY_CATALOG",
+        "DELTASHARING",
+        "DATABRICKS_FORMAT",
+        "MYSQL_FORMAT",
+        "ORACLE_FORMAT",
+        "POSTGRESQL_FORMAT",
+        "REDSHIFT_FORMAT",
+        "SNOWFLAKE_FORMAT",
+        "SQLDW_FORMAT",
+        "SQLSERVER_FORMAT",
+        "SALESFORCE_FORMAT",
+        "SALESFORCE_DATA_CLOUD_FORMAT",
+        "TERADATA_FORMAT",
+        "BIGQUERY_FORMAT",
+        "NETSUITE_FORMAT",
+        "WORKDAY_RAAS_FORMAT",
+        "MONGODB_FORMAT",
+        "HIVE",
+        "VECTOR_INDEX_FORMAT",
+        "DATABRICKS_ROW_STORE_FORMAT",
+        "DELTA_UNIFORM_HUDI",
+        "DELTA_UNIFORM_ICEBERG",
+        "ICEBERG"
+      ],
+      "enum_launch_stages": {
+        "AVRO": "GA",
+        "BIGQUERY_FORMAT": "GA",
+        "CSV": "GA",
+        "DATABRICKS_FORMAT": "GA",
+        "DATABRICKS_ROW_STORE_FORMAT": "GA",
+        "DELTA": "GA",
+        "DELTASHARING": "GA",
+        "DELTA_UNIFORM_HUDI": "GA",
+        "DELTA_UNIFORM_ICEBERG": "GA",
+        "HIVE": "GA",
+        "ICEBERG": "GA",
+        "JSON": "GA",
+        "MONGODB_FORMAT": "GA",
+        "MYSQL_FORMAT": "GA",
+        "NETSUITE_FORMAT": "GA",
+        "ORACLE_FORMAT": "GA",
+        "ORC": "GA",
+        "PARQUET": "GA",
+        "POSTGRESQL_FORMAT": "GA",
+        "REDSHIFT_FORMAT": "GA",
+        "SALESFORCE_DATA_CLOUD_FORMAT": "GA",
+        "SALESFORCE_FORMAT": "GA",
+        "SNOWFLAKE_FORMAT": "GA",
+        "SQLDW_FORMAT": "GA",
+        "SQLSERVER_FORMAT": "GA",
+        "TERADATA_FORMAT": "GA",
+        "TEXT": "GA",
+        "UNITY_CATALOG": "GA",
+        "VECTOR_INDEX_FORMAT": "GA",
+        "WORKDAY_RAAS_FORMAT": "GA"
+      }
+    },
+    "catalog.DatabricksGcpServiceAccount": {
+      "description": "GCP long-lived credential.\nDatabricks-created Google Cloud Storage service account.",
+      "fields": {
+        "credential_id": {
+          "description": "The Databricks internal ID that represents this managed identity.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "email": {
+          "description": "The email of the service account.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "private_key_id": {
+          "description": "The ID that represents the private key for this Service Account",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "catalog.DatabricksGcpServiceAccountRequest": {
+      "description": "GCP long-lived credential.\nDatabricks-created Google Cloud Storage service account."
+    },
+    "catalog.DatabricksGcpServiceAccountResponse": {
+      "description": "GCP long-lived credential.\nDatabricks-created Google Cloud Storage service account.",
+      "fields": {
+        "credential_id": {
+          "description": "The Databricks internal ID that represents this managed identity.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "email": {
+          "description": "The email of the service account.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "catalog.DeleteAccountMetastoreAssignmentRequest": {},
+    "catalog.DeleteAccountMetastoreRequest": {
+      "fields": {
+        "force": {
+          "description": "Force deletion even if the metastore is not empty. Default is false.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.DeleteAccountStorageCredentialRequest": {
+      "fields": {
+        "force": {
+          "description": "Force deletion even if the Storage Credential is not empty. Default is false.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.DeleteAliasRequest": {},
+    "catalog.DeleteCatalogRequest": {
+      "fields": {
+        "force": {
+          "description": "Force deletion even if the catalog is not empty.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.DeleteConnectionRequest": {},
+    "catalog.DeleteCredentialRequest": {
+      "fields": {
+        "force": {
+          "description": "Force an update even if there are dependent services (when purpose is\n**SERVICE**) or dependent external locations and external tables (when\npurpose is **STORAGE**).",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.DeleteCredentialResponse": {},
+    "catalog.DeleteEntityTagAssignmentRequest": {},
+    "catalog.DeleteExternalLineageRelationshipRequest": {
+      "fields": {
+        "external_lineage_relationship": {
+          "ref": "catalog.DeleteRequestExternalLineage",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.DeleteExternalLocationRequest": {
+      "fields": {
+        "force": {
+          "description": "Force deletion even if there are dependent external tables or mounts.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.DeleteExternalMetadataRequest": {},
+    "catalog.DeleteFunctionRequest": {
+      "fields": {
+        "force": {
+          "description": "Force deletion even if the function is notempty.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.DeleteMcpServiceRequest": {
+      "fields": {
+        "etag": {
+          "description": "Optimistic concurrency token from the most recent read. When set, the\ndelete succeeds only if the resource has not changed. Leave unset for an\nunconditional delete. For REST requests, URL-encode the base64 string\nreturned by the API when setting the `etag` query parameter.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.DeleteMcpServiceUserMappedCredentialRequest": {},
+    "catalog.DeleteMcpServiceUserMappedCredentialResponse": {
+      "description": "Delete returns no resource; a dedicated (empty) response keeps the revoke RPC's shape owned\nhere rather than google.protobuf.Empty."
+    },
+    "catalog.DeleteMetastoreRequest": {
+      "fields": {
+        "force": {
+          "description": "Force deletion even if the metastore is not empty. Default is false.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.DeleteModelProviderServiceRequest": {
+      "fields": {
+        "etag": {
+          "description": "Optimistic concurrency token from the most recent read. When set, the\ndelete succeeds only if the resource has not changed. Leave unset for an\nunconditional delete. For REST requests, URL-encode the base64 string\nreturned by the API when setting the `etag` query parameter.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.DeleteModelServiceRequest": {
+      "fields": {
+        "etag": {
+          "description": "Optimistic concurrency token from the most recent read. When set, the\ndelete succeeds only if the resource has not changed. Leave unset for an\nunconditional delete. For REST requests, URL-encode the base64 string\nreturned by the API when setting the `etag` query parameter.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.DeleteModelVersionRequest": {},
+    "catalog.DeleteMonitorResponse": {},
+    "catalog.DeleteOnlineTableRequest": {},
+    "catalog.DeletePolicyRequest": {},
+    "catalog.DeletePolicyResponse": {},
+    "catalog.DeleteQualityMonitorRequest": {},
+    "catalog.DeleteRegisteredModelRequest": {},
+    "catalog.DeleteRequestExternalLineage": {
+      "fields": {
+        "id": {
+          "description": "Unique identifier of the external lineage relationship.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "source": {
+          "description": "Source object of the external lineage relationship.",
+          "ref": "catalog.ExternalLineageObject",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "target": {
+          "description": "Target object of the external lineage relationship.",
+          "ref": "catalog.ExternalLineageObject",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.DeleteResponse": {},
+    "catalog.DeleteSchemaRequest": {
+      "fields": {
+        "force": {
+          "description": "Force deletion even if the schema is not empty.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.DeleteSecretRequest": {},
+    "catalog.DeleteSkillRequest": {
+      "fields": {
+        "etag": {
+          "description": "Optimistic concurrency token from the most recent read. When set, the\ndelete succeeds only if the resource has not changed. Leave unset for an\nunconditional delete. For REST requests, URL-encode the base64 string\nreturned by the API when setting the `etag` query parameter.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.DeleteStorageCredentialRequest": {
+      "fields": {
+        "force": {
+          "description": "Force an update even if there are dependent external locations or external\ntables (when purpose is **STORAGE**) or dependent services (when purpose is\n**SERVICE**).",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.DeleteTableConstraintRequest": {
+      "fields": {
+        "cascade": {
+          "description": "If true, try deleting all child constraints of the current constraint.\nIf false, reject this operation if the current constraint has any child constraints.",
+          "launch_stage": "GA"
+        },
+        "constraint_name": {
+          "description": "The name of the constraint to delete.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.DeleteTableConstraintResponse": {},
+    "catalog.DeleteTableRequest": {},
+    "catalog.DeleteVolumeRequest": {},
+    "catalog.DeltaRuntimePropertiesKvPairs": {
+      "description": "Properties pertaining to the current state of the delta table as given by the commit server.\nThis does not contain **delta.*** (input) properties in __TableInfo.properties__.",
+      "fields": {
+        "delta_runtime_properties": {
+          "description": "A map of key-value properties attached to the securable.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.DeltaSharingScopeEnum": {
+      "enum": [
+        "INTERNAL",
+        "INTERNAL_AND_EXTERNAL"
+      ],
+      "enum_launch_stages": {
+        "INTERNAL": "GA",
+        "INTERNAL_AND_EXTERNAL": "GA"
+      }
+    },
+    "catalog.DenyOptions": {
+      "fields": {
+        "privileges": {
+          "description": "List of privileges to deny.\nWhen any of these privileges are requested, the policy will deny access\nif the principal and condition match.\nRequired on create and update.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.Dependency": {
+      "description": "A dependency of a SQL object. One of the following fields must be defined:\n__table__, __function__, __connection__, __credential__, __volume__, or __secret__.",
+      "fields": {
+        "connection": {
+          "ref": "catalog.ConnectionDependency",
+          "launch_stage": "GA"
+        },
+        "credential": {
+          "ref": "catalog.CredentialDependency",
+          "launch_stage": "GA"
+        },
+        "function": {
+          "ref": "catalog.FunctionDependency",
+          "launch_stage": "GA"
+        },
+        "table": {
+          "ref": "catalog.TableDependency",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.DependencyList": {
+      "description": "A list of dependencies.",
+      "fields": {
+        "dependencies": {
+          "description": "Array of dependencies.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.DestinationType": {
+      "enum": [
+        "EMAIL",
+        "SLACK",
+        "GENERIC_WEBHOOK",
+        "MICROSOFT_TEAMS",
+        "URL"
+      ],
+      "enum_launch_stages": {
+        "EMAIL": "PUBLIC_PREVIEW",
+        "GENERIC_WEBHOOK": "PUBLIC_PREVIEW",
+        "MICROSOFT_TEAMS": "PUBLIC_PREVIEW",
+        "SLACK": "PUBLIC_PREVIEW",
+        "URL": "PUBLIC_PREVIEW"
+      }
+    },
+    "catalog.DisableRequest": {},
+    "catalog.DisableResponse": {},
+    "catalog.EffectivePermissionsList": {
+      "fields": {
+        "next_page_token": {
+          "description": "Opaque token to retrieve the next page of results. Absent if there are no more pages.\n__page_token__ should be set to this value for the next request (for the next page of results).",
+          "launch_stage": "GA"
+        },
+        "privilege_assignments": {
+          "description": "The privileges conveyed to each principal (either directly or via inheritance)",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.EffectivePredictiveOptimizationFlag": {
+      "fields": {
+        "inherited_from_name": {
+          "description": "The name of the object from which the flag was inherited. If there was no inheritance, this field is left blank.",
+          "launch_stage": "GA"
+        },
+        "inherited_from_type": {
+          "description": "The type of the object from which the flag was inherited. If there was no inheritance, this field is left blank.",
+          "ref": "catalog.EffectivePredictiveOptimizationFlagInheritedFromType",
+          "launch_stage": "GA"
+        },
+        "value": {
+          "description": "Whether predictive optimization should be enabled for this object and objects under it.",
+          "ref": "catalog.EnablePredictiveOptimization",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.EffectivePredictiveOptimizationFlagInheritedFromType": {
+      "enum": [
+        "CATALOG",
+        "SCHEMA"
+      ],
+      "enum_launch_stages": {
+        "CATALOG": "GA",
+        "SCHEMA": "GA"
+      }
+    },
+    "catalog.EffectivePrivilege": {
+      "fields": {
+        "inherited_from_name": {
+          "description": "The full name of the object that conveys this privilege via inheritance.\nThis field is omitted when privilege is not inherited (it's assigned to the securable itself).",
+          "launch_stage": "GA"
+        },
+        "inherited_from_type": {
+          "description": "The type of the object that conveys this privilege via inheritance.\nThis field is omitted when privilege is not inherited (it's assigned to the securable itself).",
+          "ref": "catalog.SecurableType",
+          "launch_stage": "GA"
+        },
+        "privilege": {
+          "description": "The privilege assigned to the principal.",
+          "ref": "catalog.Privilege",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.EffectivePrivilegeAssignment": {
+      "fields": {
+        "principal": {
+          "description": "The principal (user email address or group name).",
+          "launch_stage": "GA"
+        },
+        "privileges": {
+          "description": "The privileges conveyed to the principal (either directly or via inheritance).",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.EnablePredictiveOptimization": {
+      "enum": [
+        "DISABLE",
+        "ENABLE",
+        "INHERIT"
+      ],
+      "enum_launch_stages": {
+        "DISABLE": "GA",
+        "ENABLE": "GA",
+        "INHERIT": "GA"
+      }
+    },
+    "catalog.EnableRequest": {
+      "fields": {
+        "catalog_name": {
+          "description": "the catalog for which the system schema is to enabled in",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.EnableResponse": {},
+    "catalog.EncryptionDetails": {
+      "description": "Encryption options that apply to clients connecting to cloud storage.",
+      "fields": {
+        "sse_encryption_details": {
+          "description": "Server-Side Encryption properties for clients communicating with AWS s3.",
+          "ref": "catalog.SseEncryptionDetails",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.EncryptionSettings": {
+      "description": "Encryption Settings are used to carry metadata for securable encryption at rest.\nCurrently used for catalogs, we can use the information supplied here to interact with a CMK.",
+      "fields": {
+        "azure_encryption_settings": {
+          "description": "optional Azure settings - only required if an Azure CMK is used.",
+          "ref": "catalog.AzureEncryptionSettings",
+          "launch_stage": "GA"
+        },
+        "azure_key_vault_key_id": {
+          "description": "the AKV URL in Azure, null otherwise.",
+          "launch_stage": "GA"
+        },
+        "customer_managed_key_id": {
+          "description": "the CMK uuid in AWS and GCP, null otherwise.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.EntityTagAssignment": {
+      "description": "Represents a tag assignment to an entity",
+      "fields": {
+        "entity_name": {
+          "description": "The fully qualified name of the entity to which the tag is assigned",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "entity_type": {
+          "description": "The type of the entity to which the tag is assigned.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "source_type": {
+          "description": "The source type of the tag assignment, e.g., user-assigned or system-assigned",
+          "ref": "catalog.TagAssignmentSourceType",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "tag_key": {
+          "description": "The key of the tag",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "tag_value": {
+          "description": "The value of the tag",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "update_time": {
+          "description": "The timestamp when the tag assignment was last updated",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "updated_by": {
+          "description": "The user or principal who updated the tag assignment",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "catalog.EnvironmentSettings": {
+      "fields": {
+        "environment_version": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "java_dependencies": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.ExistsRequest": {},
+    "catalog.ExternalLineageExternalMetadata": {
+      "fields": {
+        "name": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.ExternalLineageExternalMetadataInfo": {
+      "description": "Represents the external metadata object in the lineage event.",
+      "fields": {
+        "entity_type": {
+          "description": "Type of entity represented by the external metadata object.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "event_time": {
+          "description": "Timestamp of the lineage event.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "name": {
+          "description": "Name of the external metadata object.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "system_type": {
+          "description": "Type of external system.",
+          "ref": "catalog.SystemType",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.ExternalLineageFileInfo": {
+      "description": "Represents the path information in the lineage event.",
+      "fields": {
+        "event_time": {
+          "description": "Timestamp of the lineage event.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "path": {
+          "description": "URL of the path.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "securable_name": {
+          "description": "The full name of the securable on the path.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "securable_type": {
+          "description": "The securable type of the securable on the path.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "storage_location": {
+          "description": "The storage location associated with securable on the path.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.ExternalLineageInfo": {
+      "description": "Lineage response containing lineage information of a data asset.",
+      "fields": {
+        "external_lineage_info": {
+          "description": "Information about the edge metadata of the external lineage relationship.",
+          "ref": "catalog.ExternalLineageRelationshipInfo",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "external_metadata_info": {
+          "description": "Information about external metadata involved in the lineage relationship.",
+          "ref": "catalog.ExternalLineageExternalMetadataInfo",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "file_info": {
+          "description": "Information about the file involved in the lineage relationship.",
+          "ref": "catalog.ExternalLineageFileInfo",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "model_info": {
+          "description": "Information about the model version involved in the lineage relationship.",
+          "ref": "catalog.ExternalLineageModelVersionInfo",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "table_info": {
+          "description": "Information about the table involved in the lineage relationship.",
+          "ref": "catalog.ExternalLineageTableInfo",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.ExternalLineageModelVersion": {
+      "fields": {
+        "name": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "version": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.ExternalLineageModelVersionInfo": {
+      "description": "Represents the model version information in the lineage event.",
+      "fields": {
+        "event_time": {
+          "description": "Timestamp of the lineage event.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "model_name": {
+          "description": "Name of the model.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "version": {
+          "description": "Version number of the model.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.ExternalLineageObject": {
+      "fields": {
+        "external_metadata": {
+          "ref": "catalog.ExternalLineageExternalMetadata",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "model_version": {
+          "ref": "catalog.ExternalLineageModelVersion",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "path": {
+          "ref": "catalog.ExternalLineagePath",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "table": {
+          "ref": "catalog.ExternalLineageTable",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.ExternalLineagePath": {
+      "fields": {
+        "url": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.ExternalLineageRelationship": {
+      "fields": {
+        "columns": {
+          "description": "List of column relationships between source and target objects.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "id": {
+          "description": "Unique identifier of the external lineage relationship.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "properties": {
+          "description": "Key-value properties associated with the external lineage relationship.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "source": {
+          "description": "Source object of the external lineage relationship.",
+          "ref": "catalog.ExternalLineageObject",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "target": {
+          "description": "Target object of the external lineage relationship.",
+          "ref": "catalog.ExternalLineageObject",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.ExternalLineageRelationshipInfo": {
+      "fields": {
+        "columns": {
+          "description": "List of column relationships between source and target objects.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "id": {
+          "description": "Unique identifier of the external lineage relationship.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "properties": {
+          "description": "Key-value properties associated with the external lineage relationship.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "source": {
+          "description": "Source object of the external lineage relationship.",
+          "ref": "catalog.ExternalLineageObject",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "target": {
+          "description": "Target object of the external lineage relationship.",
+          "ref": "catalog.ExternalLineageObject",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.ExternalLineageTable": {
+      "fields": {
+        "name": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.ExternalLineageTableInfo": {
+      "description": "Represents the table information in the lineage event.",
+      "fields": {
+        "catalog_name": {
+          "description": "Name of Catalog.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "event_time": {
+          "description": "Timestamp of the lineage event.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "name": {
+          "description": "Name of Table.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "schema_name": {
+          "description": "Name of Schema.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.ExternalLocationInfo": {
+      "fields": {
+        "browse_only": {
+          "description": "Indicates whether the principal is limited to retrieving metadata for the associated object through the BROWSE privilege when include_browse is enabled in the request.",
+          "launch_stage": "GA"
+        },
+        "comment": {
+          "description": "User-provided free-form text description.",
+          "launch_stage": "GA"
+        },
+        "created_at": {
+          "description": "Time at which this external location was created, in epoch milliseconds.",
+          "launch_stage": "GA"
+        },
+        "created_by": {
+          "description": "Username of external location creator.",
+          "launch_stage": "GA"
+        },
+        "credential_id": {
+          "description": "Unique ID of the location's storage credential.",
+          "launch_stage": "GA"
+        },
+        "credential_name": {
+          "description": "Name of the storage credential used with this location.",
+          "launch_stage": "GA"
+        },
+        "effective_enable_file_events": {
+          "description": "The effective value of `enable_file_events` after applying server-side defaults.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "effective_file_event_queue": {
+          "description": "The effective file event queue configuration after applying server-side defaults.\nAlways populated when a queue is provisioned, regardless of whether the user explicitly\nset `enable_file_events`. Use this field instead of `file_event_queue` for reading\nthe actual queue state.",
+          "ref": "catalog.FileEventQueue",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "enable_file_events": {
+          "description": "Whether to enable file events on this external location. Default to `true`. Set to `false` to disable file events.\nThe actual applied value may differ due to server-side defaults; check `effective_enable_file_events` for the effective state.",
+          "launch_stage": "GA"
+        },
+        "encryption_details": {
+          "ref": "catalog.EncryptionDetails",
+          "launch_stage": "GA"
+        },
+        "fallback": {
+          "description": "Indicates whether fallback mode is enabled for this external location. When fallback mode is enabled, the access to the location falls back to cluster credentials if UC credentials are not sufficient.",
+          "launch_stage": "GA"
+        },
+        "file_event_queue": {
+          "description": "File event queue settings. If `enable_file_events` is not `false`, must be defined and have exactly one of the documented properties.",
+          "ref": "catalog.FileEventQueue",
+          "launch_stage": "GA"
+        },
+        "isolation_mode": {
+          "ref": "catalog.IsolationMode",
+          "launch_stage": "GA"
+        },
+        "metastore_id": {
+          "description": "Unique identifier of metastore hosting the external location.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of the external location.",
+          "launch_stage": "GA"
+        },
+        "owner": {
+          "description": "The owner of the external location.",
+          "launch_stage": "GA"
+        },
+        "read_only": {
+          "description": "Indicates whether the external location is read-only.",
+          "launch_stage": "GA"
+        },
+        "updated_at": {
+          "description": "Time at which external location this was last modified, in epoch milliseconds.",
+          "launch_stage": "GA"
+        },
+        "updated_by": {
+          "description": "Username of user who last modified the external location.",
+          "launch_stage": "GA"
+        },
+        "url": {
+          "description": "Path URL of the external location.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ExternalMetadata": {
+      "fields": {
+        "columns": {
+          "description": "List of columns associated with the external metadata object.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "create_time": {
+          "description": "Time at which this external metadata object was created.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "created_by": {
+          "description": "Username of external metadata object creator.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "description": {
+          "description": "User-provided free-form text description.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "entity_type": {
+          "description": "Type of entity within the external system.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "id": {
+          "description": "Unique identifier of the external metadata object.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "metastore_id": {
+          "description": "Unique identifier of parent metastore.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "Name of the external metadata object.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "owner": {
+          "description": "Owner of the external metadata object.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "properties": {
+          "description": "A map of key-value properties attached to the external metadata object.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "system_type": {
+          "description": "Type of external system.",
+          "ref": "catalog.SystemType",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "update_time": {
+          "description": "Time at which this external metadata object was last modified.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "updated_by": {
+          "description": "Username of user who last modified external metadata object.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "url": {
+          "description": "URL associated with the external metadata object.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.FailedStatus": {
+      "description": "Detailed status of an online table. Shown if the online table is in the OFFLINE_FAILED or the\nONLINE_PIPELINE_FAILED state.",
+      "fields": {
+        "last_processed_commit_version": {
+          "description": "The last source table Delta version that was synced to the online table. Note that this Delta\nversion may only be partially synced to the online table. Only populated if the table is still\nonline and available for serving.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "timestamp": {
+          "description": "The timestamp of the last time any data was synchronized from the source table to the online\ntable. Only populated if the table is still online and available for serving.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.FileEventQueue": {
+      "fields": {
+        "managed_aqs": {
+          "ref": "catalog.AzureQueueStorage",
+          "launch_stage": "GA"
+        },
+        "managed_pubsub": {
+          "ref": "catalog.GcpPubsub",
+          "launch_stage": "GA"
+        },
+        "managed_sqs": {
+          "ref": "catalog.AwsSqsQueue",
+          "launch_stage": "GA"
+        },
+        "provided_aqs": {
+          "ref": "catalog.AzureQueueStorage",
+          "launch_stage": "GA"
+        },
+        "provided_pubsub": {
+          "ref": "catalog.GcpPubsub",
+          "launch_stage": "GA"
+        },
+        "provided_sqs": {
+          "ref": "catalog.AwsSqsQueue",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.FinalizeSkillRequest": {},
+    "catalog.ForeignKeyConstraint": {
+      "fields": {
+        "child_columns": {
+          "description": "Column names for this constraint.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The name of the constraint.",
+          "launch_stage": "GA"
+        },
+        "parent_columns": {
+          "description": "Column names for this constraint.",
+          "launch_stage": "GA"
+        },
+        "parent_table": {
+          "description": "The full name of the parent constraint.",
+          "launch_stage": "GA"
+        },
+        "rely": {
+          "description": "True if the constraint is RELY, false or unset if NORELY.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.FunctionArgExpression": {
+      "description": "An expression that is evaluated at query time against per-request context.\nNew variants (e.g., identity attributes) are added as additional oneof cases.",
+      "fields": {
+        "tag_introspection": {
+          "description": "An expression that introspects tags at query time.",
+          "ref": "catalog.TagIntrospectionExpression",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.FunctionArgument": {
+      "fields": {
+        "alias": {
+          "description": "The alias of a matched column.",
+          "launch_stage": "GA"
+        },
+        "constant": {
+          "description": "A constant literal.",
+          "launch_stage": "GA"
+        },
+        "function_arg_expression": {
+          "description": "An expression evaluated at query time. Wraps per-request expression variants\n(e.g., tag introspection) so new variants can be added without extending the\nFunctionArgument oneof.",
+          "ref": "catalog.FunctionArgExpression",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.FunctionDependency": {
+      "description": "A function that is dependent on a SQL object.",
+      "fields": {
+        "function_full_name": {
+          "description": "Full name of the dependent function, in the form of __catalog_name__.__schema_name__.__function_name__.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.FunctionInfo": {
+      "fields": {
+        "browse_only": {
+          "description": "Indicates whether the principal is limited to retrieving metadata for the associated object through the BROWSE privilege when include_browse is enabled in the request.",
+          "launch_stage": "GA"
+        },
+        "catalog_name": {
+          "description": "Name of parent Catalog.",
+          "launch_stage": "GA"
+        },
+        "comment": {
+          "description": "User-provided free-form text description.",
+          "launch_stage": "GA"
+        },
+        "created_at": {
+          "description": "Time at which this function was created, in epoch milliseconds.",
+          "launch_stage": "GA"
+        },
+        "created_by": {
+          "description": "Username of function creator.",
+          "launch_stage": "GA"
+        },
+        "data_type": {
+          "description": "Scalar function return data type.",
+          "ref": "catalog.ColumnTypeName",
+          "launch_stage": "GA"
+        },
+        "external_language": {
+          "description": "External function language.",
+          "launch_stage": "GA"
+        },
+        "external_name": {
+          "description": "External function name.",
+          "launch_stage": "GA"
+        },
+        "full_data_type": {
+          "description": "Pretty printed function data type.",
+          "launch_stage": "GA"
+        },
+        "full_name": {
+          "description": "Full name of Function, in form of **catalog_name**.**schema_name**.**function_name**",
+          "launch_stage": "GA"
+        },
+        "function_id": {
+          "description": "Id of Function, relative to parent schema.",
+          "launch_stage": "GA"
+        },
+        "input_params": {
+          "description": "Function input parameters.",
+          "ref": "catalog.FunctionParameterInfos",
+          "launch_stage": "GA"
+        },
+        "is_deterministic": {
+          "description": "Whether the function is deterministic.",
+          "launch_stage": "GA"
+        },
+        "is_null_call": {
+          "description": "Function null call.",
+          "launch_stage": "GA"
+        },
+        "metastore_id": {
+          "description": "Unique identifier of parent metastore.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of function, relative to parent schema.",
+          "launch_stage": "GA"
+        },
+        "owner": {
+          "description": "Username of current owner of the function.",
+          "launch_stage": "GA"
+        },
+        "parameter_style": {
+          "description": "Function parameter style. **S** is the value for SQL.",
+          "ref": "catalog.FunctionInfoParameterStyle",
+          "launch_stage": "GA"
+        },
+        "properties": {
+          "description": "JSON-serialized key-value pair map, encoded (escaped) as a string.",
+          "launch_stage": "GA"
+        },
+        "return_params": {
+          "description": "Table function return parameters.",
+          "ref": "catalog.FunctionParameterInfos",
+          "launch_stage": "GA"
+        },
+        "routine_body": {
+          "description": "Function language. When **EXTERNAL** is used, the language of the routine function should be specified in the **external_language** field, and the **return_params** of the function cannot be used (as **TABLE** return type is not supported), and the **sql_data_access** field must be **NO_SQL**.",
+          "ref": "catalog.FunctionInfoRoutineBody",
+          "launch_stage": "GA"
+        },
+        "routine_definition": {
+          "description": "Function body.",
+          "launch_stage": "GA"
+        },
+        "routine_dependencies": {
+          "description": "Function dependencies. For external UDFs, dependencies may\ncontain only credential, secret, or volume objects.",
+          "ref": "catalog.DependencyList",
+          "launch_stage": "GA"
+        },
+        "schema_name": {
+          "description": "Name of parent Schema relative to its parent Catalog.",
+          "launch_stage": "GA"
+        },
+        "security_type": {
+          "description": "Function security type.",
+          "ref": "catalog.FunctionInfoSecurityType",
+          "launch_stage": "GA"
+        },
+        "specific_name": {
+          "description": "Specific name of the function; Reserved for future use.",
+          "launch_stage": "GA"
+        },
+        "sql_data_access": {
+          "description": "Function SQL data access.",
+          "ref": "catalog.FunctionInfoSqlDataAccess",
+          "launch_stage": "GA"
+        },
+        "sql_path": {
+          "description": "List of schemes whose objects can be referenced without qualification.",
+          "launch_stage": "GA"
+        },
+        "updated_at": {
+          "description": "Time at which this function was last modified, in epoch milliseconds.",
+          "launch_stage": "GA"
+        },
+        "updated_by": {
+          "description": "Username of user who last modified the function.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.FunctionInfoParameterStyle": {
+      "enum": [
+        "S"
+      ],
+      "enum_launch_stages": {
+        "S": "GA"
+      }
+    },
+    "catalog.FunctionInfoRoutineBody": {
+      "enum": [
+        "SQL",
+        "EXTERNAL"
+      ],
+      "enum_launch_stages": {
+        "EXTERNAL": "GA",
+        "SQL": "GA"
+      }
+    },
+    "catalog.FunctionInfoSecurityType": {
+      "enum": [
+        "DEFINER"
+      ],
+      "enum_launch_stages": {
+        "DEFINER": "GA"
+      }
+    },
+    "catalog.FunctionInfoSqlDataAccess": {
+      "enum": [
+        "CONTAINS_SQL",
+        "READS_SQL_DATA",
+        "NO_SQL"
+      ],
+      "enum_launch_stages": {
+        "CONTAINS_SQL": "GA",
+        "NO_SQL": "GA",
+        "READS_SQL_DATA": "GA"
+      }
+    },
+    "catalog.FunctionParameterInfo": {
+      "fields": {
+        "comment": {
+          "description": "User-provided free-form text description.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of Parameter.",
+          "launch_stage": "GA"
+        },
+        "parameter_default": {
+          "description": "Default value of the parameter.",
+          "launch_stage": "GA"
+        },
+        "parameter_mode": {
+          "description": "Function parameter mode.",
+          "ref": "catalog.FunctionParameterMode",
+          "launch_stage": "GA"
+        },
+        "parameter_type": {
+          "description": "Function parameter type.",
+          "ref": "catalog.FunctionParameterType",
+          "launch_stage": "GA"
+        },
+        "position": {
+          "description": "Ordinal position of column (starting at position 0).",
+          "launch_stage": "GA"
+        },
+        "type_interval_type": {
+          "description": "Format of IntervalType.",
+          "launch_stage": "GA"
+        },
+        "type_json": {
+          "description": "Full data type spec, JSON-serialized.",
+          "launch_stage": "GA"
+        },
+        "type_name": {
+          "description": "Name of type (INT, STRUCT, MAP, etc.)",
+          "ref": "catalog.ColumnTypeName",
+          "launch_stage": "GA"
+        },
+        "type_precision": {
+          "description": "Digits of precision; required on Create for DecimalTypes.",
+          "launch_stage": "GA"
+        },
+        "type_scale": {
+          "description": "Digits to right of decimal; Required on Create for DecimalTypes.",
+          "launch_stage": "GA"
+        },
+        "type_text": {
+          "description": "Full data type spec, SQL/catalogString text.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.FunctionParameterInfos": {
+      "fields": {
+        "parameters": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.FunctionParameterMode": {
+      "enum": [
+        "IN"
+      ],
+      "enum_launch_stages": {
+        "IN": "GA"
+      }
+    },
+    "catalog.FunctionParameterType": {
+      "enum": [
+        "PARAM",
+        "COLUMN"
+      ],
+      "enum_launch_stages": {
+        "COLUMN": "GA",
+        "PARAM": "GA"
+      }
+    },
+    "catalog.GcpOauthToken": {
+      "description": "GCP temporary credentials for API authentication.\nRead more at https://developers.google.com/identity/protocols/oauth2/service-account",
+      "fields": {
+        "oauth_token": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.GcpPubsub": {
+      "fields": {
+        "managed_resource_id": {
+          "description": "Unique identifier included in the name of file events managed cloud resources.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "subscription_name": {
+          "description": "The Pub/Sub subscription name in the format projects/{project}/subscriptions/{subscription name}.\nOnly required for provided_pubsub.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.GenerateTemporaryPathCredentialRequest": {
+      "fields": {
+        "dry_run": {
+          "description": "Optional. When set to true, the service will not validate that the generated\ncredentials can perform write operations, therefore no new paths will be created\nand the response will not contain valid credentials. Defaults to false.",
+          "launch_stage": "GA"
+        },
+        "operation": {
+          "description": "The operation being performed on the path.",
+          "ref": "catalog.PathOperation",
+          "launch_stage": "GA"
+        },
+        "url": {
+          "description": "URL for path-based access.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.GenerateTemporaryPathCredentialResponse": {
+      "fields": {
+        "aws_temp_credentials": {
+          "ref": "catalog.AwsCredentials",
+          "launch_stage": "GA"
+        },
+        "azure_aad": {
+          "ref": "catalog.AzureActiveDirectoryToken",
+          "launch_stage": "GA"
+        },
+        "azure_user_delegation_sas": {
+          "ref": "catalog.AzureUserDelegationSas",
+          "launch_stage": "GA"
+        },
+        "expiration_time": {
+          "description": "Server time when the credential will expire, in epoch milliseconds.\nThe API client is advised to cache the credential given this expiration time.",
+          "launch_stage": "GA"
+        },
+        "gcp_oauth_token": {
+          "ref": "catalog.GcpOauthToken",
+          "launch_stage": "GA"
+        },
+        "r2_temp_credentials": {
+          "ref": "catalog.R2Credentials",
+          "launch_stage": "GA"
+        },
+        "url": {
+          "description": "The URL of the storage path accessible by the temporary credential.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.GenerateTemporaryServiceCredentialAzureOptions": {
+      "description": "The Azure cloud options to customize the requested temporary credential",
+      "fields": {
+        "resources": {
+          "description": "The resources to which the temporary Azure credential should apply. These resources\nare the scopes that are passed to the token provider (see https://learn.microsoft.com/python/api/azure-core/azure.core.credentials.tokencredential?view=azure-python)",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.GenerateTemporaryServiceCredentialGcpOptions": {
+      "description": "The GCP cloud options to customize the requested temporary credential",
+      "fields": {
+        "scopes": {
+          "description": "The scopes to which the temporary GCP credential should apply. These resources\nare the scopes that are passed to the token provider (see\nhttps://google-auth.readthedocs.io/en/latest/reference/google.auth.html#google.auth.credentials.Credentials)",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.GenerateTemporaryServiceCredentialRequest": {
+      "fields": {
+        "azure_options": {
+          "ref": "catalog.GenerateTemporaryServiceCredentialAzureOptions",
+          "launch_stage": "GA"
+        },
+        "credential_name": {
+          "description": "The name of the service credential used to generate a temporary credential",
+          "launch_stage": "GA"
+        },
+        "gcp_options": {
+          "ref": "catalog.GenerateTemporaryServiceCredentialGcpOptions",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.GenerateTemporaryTableCredentialRequest": {
+      "fields": {
+        "operation": {
+          "description": "The operation performed against the table data, either READ or READ_WRITE. If READ_WRITE is specified,\nthe credentials returned will have write permissions, otherwise, it will be read only.",
+          "ref": "catalog.TableOperation",
+          "launch_stage": "GA"
+        },
+        "table_id": {
+          "description": "UUID of the table to read or write.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.GenerateTemporaryTableCredentialResponse": {
+      "fields": {
+        "aws_temp_credentials": {
+          "ref": "catalog.AwsCredentials",
+          "launch_stage": "GA"
+        },
+        "azure_aad": {
+          "ref": "catalog.AzureActiveDirectoryToken",
+          "launch_stage": "GA"
+        },
+        "azure_user_delegation_sas": {
+          "ref": "catalog.AzureUserDelegationSas",
+          "launch_stage": "GA"
+        },
+        "expiration_time": {
+          "description": "Server time when the credential will expire, in epoch milliseconds.\nThe API client is advised to cache the credential given this expiration time.",
+          "launch_stage": "GA"
+        },
+        "gcp_oauth_token": {
+          "ref": "catalog.GcpOauthToken",
+          "launch_stage": "GA"
+        },
+        "r2_temp_credentials": {
+          "ref": "catalog.R2Credentials",
+          "launch_stage": "GA"
+        },
+        "url": {
+          "description": "The URL of the storage path accessible by the temporary credential.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.GenerateTemporaryVolumeCredentialRequest": {
+      "description": "Generate volume credentials RPC",
+      "fields": {
+        "operation": {
+          "description": "The operation performed against the volume data, either READ_VOLUME or WRITE_VOLUME. If WRITE_VOLUME is specified,\nthe credentials returned will have write permissions, otherwise, it will be read only.",
+          "ref": "catalog.VolumeOperation",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "volume_id": {
+          "description": "Id of the volume to read or write.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.GenerateTemporaryVolumeCredentialResponse": {
+      "fields": {
+        "aws_temp_credentials": {
+          "ref": "catalog.AwsCredentials",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "azure_aad": {
+          "ref": "catalog.AzureActiveDirectoryToken",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "azure_user_delegation_sas": {
+          "ref": "catalog.AzureUserDelegationSas",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "expiration_time": {
+          "description": "Server time when the credential will expire, in epoch milliseconds.\nThe API client is advised to cache the credential given this expiration time.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "gcp_oauth_token": {
+          "ref": "catalog.GcpOauthToken",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "r2_temp_credentials": {
+          "ref": "catalog.R2Credentials",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "url": {
+          "description": "The URL of the storage path accessible by the temporary credential.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.GetAccessRequestDestinationsRequest": {},
+    "catalog.GetAccountMetastoreAssignmentRequest": {},
+    "catalog.GetAccountMetastoreRequest": {},
+    "catalog.GetAccountStorageCredentialRequest": {},
+    "catalog.GetArtifactAllowlistRequest": {},
+    "catalog.GetBindingsRequest": {
+      "fields": {
+        "max_results": {
+          "description": "Maximum number of workspace bindings to return.\n- When set to 0, the page length is set to a server configured value (recommended);\n- When set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- When set to a value less than 0, an invalid parameter error is returned;\n- If not set, all the workspace bindings are returned (not recommended).",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Opaque pagination token to go to next page based on previous query.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.GetByAliasRequest": {
+      "fields": {
+        "include_aliases": {
+          "description": "Whether to include aliases associated with the model version in the response",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.GetCatalogRequest": {
+      "fields": {
+        "include_browse": {
+          "description": "Whether to include catalogs in the response for which the principal can only access selective metadata for",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.GetCatalogWorkspaceBindingsResponse": {
+      "fields": {
+        "workspaces": {
+          "description": "A list of workspace IDs",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.GetConnectionRequest": {},
+    "catalog.GetCredentialRequest": {},
+    "catalog.GetEffectiveRequest": {
+      "fields": {
+        "max_results": {
+          "description": "Specifies the maximum number of privileges to return (page length).\nEvery EffectivePrivilegeAssignment present in a single page response is guaranteed to contain all the effective\nprivileges granted on (or inherited by) the requested Securable for the respective principal.\n\nIf not set, all the effective permissions are returned.\nIf set to\n- lesser than 0: invalid parameter error\n- 0: page length is set to a server configured value\n- lesser than 150 but greater than 0: invalid parameter error (this is to ensure that server is able to return at\nleast one complete EffectivePrivilegeAssignment in a single page response)\n- greater than (or equal to) 150: page length is the minimum of this value and a server configured value",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Opaque token for the next page of results (pagination).",
+          "launch_stage": "GA"
+        },
+        "principal": {
+          "description": "If provided, only the effective permissions for the specified principal (user or group) are returned.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.GetEntityTagAssignmentRequest": {},
+    "catalog.GetExternalLocationRequest": {
+      "fields": {
+        "include_browse": {
+          "description": "Whether to include external locations in the response for which the principal can only access selective metadata for",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.GetExternalMetadataRequest": {},
+    "catalog.GetFunctionRequest": {
+      "fields": {
+        "include_browse": {
+          "description": "Whether to include functions in the response for which the principal can only access selective metadata for",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.GetGrantRequest": {
+      "fields": {
+        "max_results": {
+          "description": "Specifies the maximum number of privileges to return (page length).\nEvery PrivilegeAssignment present in a single page response is guaranteed to contain all the privileges granted on\nthe requested Securable for the respective principal.\n\nIf not set, all the permissions are returned.\nIf set to\n- lesser than 0: invalid parameter error\n- 0: page length is set to a server configured value\n- lesser than 150 but greater than 0: invalid parameter error (this is to ensure that server is able to return at\nleast one complete PrivilegeAssignment in a single page response)\n- greater than (or equal to) 150: page length is the minimum of this value and a server configured value",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Opaque pagination token to go to next page based on previous query.",
+          "launch_stage": "GA"
+        },
+        "principal": {
+          "description": "If provided, only the permissions for the specified principal (user or group) are returned.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.GetMcpServiceRequest": {},
+    "catalog.GetMcpServiceUserMappedCredentialRequest": {},
+    "catalog.GetMetastoreRequest": {},
+    "catalog.GetMetastoreSummaryResponse": {
+      "fields": {
+        "cloud": {
+          "description": "Cloud vendor of the metastore home shard (e.g., `aws`, `azure`, `gcp`).",
+          "launch_stage": "GA"
+        },
+        "created_at": {
+          "description": "Time at which this metastore was created, in epoch milliseconds.",
+          "launch_stage": "GA"
+        },
+        "created_by": {
+          "description": "Username of metastore creator.",
+          "launch_stage": "GA"
+        },
+        "default_data_access_config_id": {
+          "description": "Unique identifier of the metastore's (Default) Data Access Configuration.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "delta_sharing_organization_name": {
+          "description": "The organization name of a Delta Sharing entity, to be used in Databricks-to-Databricks Delta Sharing as the official name.",
+          "launch_stage": "GA"
+        },
+        "delta_sharing_recipient_token_lifetime_in_seconds": {
+          "description": "The lifetime of delta sharing recipient token in seconds.",
+          "launch_stage": "GA"
+        },
+        "delta_sharing_scope": {
+          "description": "The scope of Delta Sharing enabled for the metastore.",
+          "ref": "catalog.DeltaSharingScopeEnum",
+          "launch_stage": "GA"
+        },
+        "external_access_enabled": {
+          "description": "Whether to allow non-DBR clients to directly access entities under the metastore.",
+          "launch_stage": "GA"
+        },
+        "global_metastore_id": {
+          "description": "Globally unique metastore ID across clouds and regions, of the form `cloud:region:metastore_id`.",
+          "launch_stage": "GA"
+        },
+        "metastore_id": {
+          "description": "Unique identifier of metastore.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The user-specified name of the metastore.",
+          "launch_stage": "GA"
+        },
+        "owner": {
+          "description": "The owner of the metastore.",
+          "launch_stage": "GA"
+        },
+        "privilege_model_version": {
+          "description": "Privilege model version of the metastore, of the form `major.minor` (e.g., `1.0`).",
+          "launch_stage": "GA"
+        },
+        "region": {
+          "description": "Cloud region which the metastore serves (e.g., `us-west-2`, `westus`).",
+          "launch_stage": "GA"
+        },
+        "storage_root": {
+          "description": "The storage root URL for metastore",
+          "launch_stage": "GA"
+        },
+        "storage_root_credential_id": {
+          "description": "UUID of storage credential to access the metastore storage_root.",
+          "launch_stage": "GA"
+        },
+        "storage_root_credential_name": {
+          "description": "Name of the storage credential to access the metastore storage_root.",
+          "launch_stage": "GA"
+        },
+        "updated_at": {
+          "description": "Time at which the metastore was last modified, in epoch milliseconds.",
+          "launch_stage": "GA"
+        },
+        "updated_by": {
+          "description": "Username of user who last modified the metastore.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.GetModelProviderServiceRequest": {},
+    "catalog.GetModelServiceRequest": {},
+    "catalog.GetModelVersionRequest": {
+      "fields": {
+        "include_aliases": {
+          "description": "Whether to include aliases associated with the model version in the response",
+          "launch_stage": "GA"
+        },
+        "include_browse": {
+          "description": "Whether to include model versions in the response for which the principal can only access selective metadata for",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.GetOnlineTableRequest": {},
+    "catalog.GetPermissionsResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "Opaque token to retrieve the next page of results. Absent if there are no more pages.\n__page_token__ should be set to this value for the next request (for the next page of results).",
+          "launch_stage": "GA"
+        },
+        "privilege_assignments": {
+          "description": "The privileges assigned to each principal",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.GetPolicyRequest": {},
+    "catalog.GetQualityMonitorRequest": {},
+    "catalog.GetQuotaRequest": {},
+    "catalog.GetQuotaResponse": {
+      "fields": {
+        "quota_info": {
+          "description": "The returned QuotaInfo.",
+          "ref": "catalog.QuotaInfo",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.GetRefreshRequest": {},
+    "catalog.GetRegisteredModelRequest": {
+      "fields": {
+        "include_aliases": {
+          "description": "Whether to include registered model aliases in the response",
+          "launch_stage": "GA"
+        },
+        "include_browse": {
+          "description": "Whether to include registered models in the response for which the principal can only access selective metadata for",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.GetSchemaRequest": {
+      "fields": {
+        "include_browse": {
+          "description": "Whether to include schemas in the response for which the principal can only access selective metadata for",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.GetSecretRequest": {
+      "fields": {
+        "include_value": {
+          "description": "Whether to include the secret value in the response. Defaults to false. Requires the\n**READ_SECRET** privilege.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.GetSkillRequest": {},
+    "catalog.GetStorageCredentialRequest": {},
+    "catalog.GetTableRequest": {
+      "fields": {
+        "include_browse": {
+          "description": "Whether to include tables in the response for which the principal can only access selective metadata for.",
+          "launch_stage": "GA"
+        },
+        "include_delta_metadata": {
+          "description": "Whether delta metadata should be included in the response.",
+          "launch_stage": "GA"
+        },
+        "include_manifest_capabilities": {
+          "description": "Whether to include a manifest containing table capabilities in the response.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.GetWorkspaceBindingRequest": {},
+    "catalog.GetWorkspaceBindingsResponse": {
+      "fields": {
+        "bindings": {
+          "description": "List of workspace bindings",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "Opaque token to retrieve the next page of results. Absent if there are no more pages.\n__page_token__ should be set to this value for the next request (for the next page of results).",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.GovernedTagReference": {
+      "description": "A governed tag referenced by a policy condition.",
+      "fields": {
+        "tag_key": {
+          "description": "The governed tag key.",
+          "launch_stage": "GA"
+        },
+        "tag_value": {
+          "description": "The governed tag value, when the policy references a specific value.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.GrantOptions": {
+      "fields": {
+        "privileges": {
+          "description": "List of privileges to grant.\nWhen any of these privileges are requested, the policy will grant access\nif the principal and condition match.\nRequired on create and update.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.InferenceTableConfig": {
+      "description": "Configuration for logging request and response payloads to a Unity Catalog\ninference table. When this configuration is present, payload logging is\nenabled by default.",
+      "fields": {
+        "is_deleted": {
+          "description": "Whether the referenced inference table has been deleted. The configuration\nremains visible so you can identify the broken dependency. Payload logging\ncannot continue until the table is restored or the configuration is updated.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "parent": {
+          "description": "Parent Unity Catalog schema where the inference table is created, in the\nform `schemas/{catalog}.{schema}`. Required when configuring an inference\ntable. After the inference table is created, this field cannot be changed.",
+          "launch_stage": "GA"
+        },
+        "table": {
+          "description": "Resolved UC table for payload logs.\nFormat: `tables/{catalog}.{schema}.{table}`.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "table_name_prefix": {
+          "description": "Prefix used to form the inference table's registered name. AI Gateway\nappends `_payload`; for example, `table_name_prefix = \"orders\"` creates\n`orders_payload`. If unset, the prefix defaults to the service name. Read\n`table` from the response for the resulting resource name. After the\ninference table is created, this field cannot be changed.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.IsolationMode": {
+      "enum": [
+        "ISOLATION_MODE_OPEN",
+        "ISOLATION_MODE_ISOLATED"
+      ],
+      "enum_launch_stages": {
+        "ISOLATION_MODE_ISOLATED": "GA",
+        "ISOLATION_MODE_OPEN": "GA"
+      }
+    },
+    "catalog.LineageDirection": {
+      "enum": [
+        "UPSTREAM",
+        "DOWNSTREAM"
+      ],
+      "enum_launch_stages": {
+        "DOWNSTREAM": "PUBLIC_PREVIEW",
+        "UPSTREAM": "PUBLIC_PREVIEW"
+      }
+    },
+    "catalog.ListAccountMetastoreAssignmentsRequest": {},
+    "catalog.ListAccountMetastoreAssignmentsResponse": {
+      "description": "The metastore assignments were successfully returned.",
+      "fields": {
+        "workspace_ids": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ListAccountMetastoresRequest": {},
+    "catalog.ListAccountStorageCredentialsRequest": {},
+    "catalog.ListAccountStorageCredentialsResponse": {
+      "description": "The metastore storage credentials were successfully returned.",
+      "fields": {
+        "storage_credentials": {
+          "description": "An array of metastore storage credentials.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ListCatalogsRequest": {
+      "fields": {
+        "include_browse": {
+          "description": "Whether to include catalogs in the response for which the principal can only access selective metadata for",
+          "launch_stage": "GA"
+        },
+        "include_unbound": {
+          "description": "Whether to include catalogs not bound to the workspace.\nEffective only if the user has permission to update the catalog–workspace binding.",
+          "launch_stage": "GA"
+        },
+        "max_results": {
+          "description": "Maximum number of catalogs to return.\n- when set to 0, the page length is set to a server configured value (recommended);\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- when set to a value less than 0, an invalid parameter error is returned;\n- If not set, all valid catalogs are returned (not recommended).\n- Note: The number of returned catalogs might be less than the specified max_results size, even zero.\nThe only definitive indication that no further catalogs can be fetched is when the next_page_token is unset from the response.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Opaque pagination token to go to next page based on previous query.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ListCatalogsResponse": {
+      "fields": {
+        "catalogs": {
+          "description": "An array of catalog information objects.",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "Opaque token to retrieve the next page of results. Absent if there are no more pages.\n__page_token__ should be set to this value for the next request (for the next page of results).",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ListConnectionsRequest": {
+      "fields": {
+        "max_results": {
+          "description": "Maximum number of connections to return.\n- If not set, all connections are returned (not recommended).\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- when set to 0, the page length is set to a server configured value (recommended);\n- when set to a value less than 0, an invalid parameter error is returned;",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Opaque pagination token to go to next page based on previous query.",
+          "launch_stage": "GA"
+        },
+        "parent": {
+          "description": "Optional. Parent schema filter for listing schema-level connections, in format \"schemas/{catalog}.{schema}\".",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.ListConnectionsResponse": {
+      "fields": {
+        "connections": {
+          "description": "An array of connection information objects.",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "Opaque token to retrieve the next page of results. Absent if there are no more pages.\n__page_token__ should be set to this value for the next request (for the next page of results).",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ListCredentialsRequest": {
+      "fields": {
+        "include_unbound": {
+          "description": "Whether to include credentials not bound to the workspace.\nEffective only if the user has permission to update the credential–workspace binding.",
+          "launch_stage": "GA"
+        },
+        "max_results": {
+          "description": "Maximum number of credentials to return.\n- If not set, the default max page size is used.\n- When set to a value greater than 0, the page length is the minimum of\nthis value and a server-configured value.\n- When set to 0, the page length is set to a server-configured value\n(recommended).\n- When set to a value less than 0, an invalid parameter error is\nreturned.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Opaque token to retrieve the next page of results.",
+          "launch_stage": "GA"
+        },
+        "purpose": {
+          "description": "Return only credentials for the specified purpose.",
+          "ref": "catalog.CredentialPurpose",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ListCredentialsResponse": {
+      "fields": {
+        "credentials": {
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "Opaque token to retrieve the next page of results. Absent if there are no\nmore pages.\n__page_token__ should be set to this value for the next request (for the\nnext page of results).",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ListEffectivePrivilegeAssignmentsRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Specifies the maximum number of privilege assignments to return (page length).\nEvery EffectivePrivilegeAssignment present in a single page response is guaranteed to contain all the effective\nprivileges granted on (or inherited by) the requested Securable for the respective principal.\n\nIf not set, a server-configured default is used.\nIf set to\n- lesser than 0: invalid parameter error\n- 0: page length is set to a server configured value\n- lesser than 150 but greater than 0: invalid parameter error (this is to ensure that server is able to return at\nleast one complete EffectivePrivilegeAssignment in a single page response)\n- greater than (or equal to) 150: page length is the minimum of this value and a server configured value",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Opaque pagination token to go to next page based on previous query.",
+          "launch_stage": "GA"
+        },
+        "principal": {
+          "description": "If provided, only the effective permissions for the specified principal (user or group) are returned.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.ListEffectivePrivilegeAssignmentsResponse": {
+      "fields": {
+        "effective_privilege_assignments": {
+          "description": "The effective privilege assignments for the securable (and optional principal).",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "next_page_token": {
+          "description": "Opaque token to retrieve the next page of results. Absent if there are no more pages.\n__page_token__ should be set to this value for the next request (for the next page of results).",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "catalog.ListEntityTagAssignmentsRequest": {
+      "fields": {
+        "max_results": {
+          "description": "Optional. Maximum number of tag assignments to return in a single page",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Optional. Pagination token to retrieve the next page of results",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.ListEntityTagAssignmentsResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "Optional. Pagination token for retrieving the next page of results",
+          "launch_stage": "GA"
+        },
+        "tag_assignments": {
+          "description": "The list of tag assignments",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ListExternalLineageRelationshipsRequest": {
+      "fields": {
+        "lineage_direction": {
+          "description": "The lineage direction to filter on.",
+          "ref": "catalog.LineageDirection",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "object_info": {
+          "description": "The object to query external lineage relationships for.\nSince this field is a query parameter, please flatten the nested fields. For example, if the object is a table, the query parameter should look like:\n`object_info.table.name=main.sales.customers`",
+          "ref": "catalog.ExternalLineageObject",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "page_size": {
+          "description": "Specifies the maximum number of external lineage relationships to return in a single response.\nThe value must be less than or equal to 1000.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "page_token": {
+          "description": "Opaque pagination token to go to next page based on previous query.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.ListExternalLineageRelationshipsResponse": {
+      "fields": {
+        "external_lineage_relationships": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "next_page_token": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.ListExternalLocationsRequest": {
+      "fields": {
+        "include_browse": {
+          "description": "Whether to include external locations in the response for which the principal can only access selective metadata for",
+          "launch_stage": "GA"
+        },
+        "include_unbound": {
+          "description": "Whether to include external locations not bound to the workspace.\nEffective only if the user has permission to update the location–workspace binding.",
+          "launch_stage": "GA"
+        },
+        "max_results": {
+          "description": "Maximum number of external locations to return.\nIf not set, all the external locations are returned (not recommended).\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- when set to 0, the page length is set to a server configured value (recommended);\n- when set to a value less than 0, an invalid parameter error is returned;",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Opaque pagination token to go to next page based on previous query.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ListExternalLocationsResponse": {
+      "fields": {
+        "external_locations": {
+          "description": "An array of external locations.",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "Opaque token to retrieve the next page of results. Absent if there are no more pages.\n__page_token__ should be set to this value for the next request (for the next page of results).",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ListExternalMetadataRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Specifies the maximum number of external metadata objects to return in a single response.\nThe value must be less than or equal to 1000.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Opaque pagination token to go to next page based on previous query.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.ListExternalMetadataResponse": {
+      "fields": {
+        "external_metadata": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "next_page_token": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.ListFunctionsRequest": {
+      "fields": {
+        "catalog_name": {
+          "description": "Name of parent catalog for functions of interest.",
+          "launch_stage": "GA"
+        },
+        "include_browse": {
+          "description": "Whether to include functions in the response for which the principal can only access selective metadata for",
+          "launch_stage": "GA"
+        },
+        "max_results": {
+          "description": "Maximum number of functions to return.\nIf not set, all the functions are returned (not recommended).\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- when set to 0, the page length is set to a server configured value (recommended);\n- when set to a value less than 0, an invalid parameter error is returned;",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Opaque pagination token to go to next page based on previous query.",
+          "launch_stage": "GA"
+        },
+        "schema_name": {
+          "description": "Parent schema of functions.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ListFunctionsResponse": {
+      "fields": {
+        "functions": {
+          "description": "An array of function information objects.",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "Opaque token to retrieve the next page of results. Absent if there are no more pages.\n__page_token__ should be set to this value for the next request (for the next page of results).",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ListMcpServicesRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Maximum number of MCP services to return. Defaults to 100 when unset or 0;\nthe maximum is 200. Use `page_token` to retrieve additional pages.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Opaque pagination token from the previous response.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "parent": {
+          "description": "Parent schema to list within, in the form\n`schemas/{catalog}.{schema}`. Required. Each `{...}` component is capped at\n255 characters individually.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "view": {
+          "description": "Fields to return for each service. `FULL` includes source-connection\ndetails and rate-limit principal names. `BASIC` omits the source connection\nand omits principal names from rate limits. Defaults to `BASIC` when unset.",
+          "ref": "catalog.ListMcpServicesRequestView",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.ListMcpServicesRequestView": {
+      "description": "Controls which fields are populated on each McpService in the response.\nThe server uses `BASIC` when `view` is unset. Callers needing the full\nconfiguration must request it explicitly with `view = FULL`.",
+      "enum": [
+        "FULL",
+        "BASIC"
+      ],
+      "enum_launch_stages": {
+        "BASIC": "GA",
+        "FULL": "GA"
+      }
+    },
+    "catalog.ListMcpServicesResponse": {
+      "description": "Response for listing MCP services.",
+      "fields": {
+        "mcp_services": {
+          "description": "The list of MCP services.",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "Pagination token for retrieving the next page. Empty when there are no\nmore results.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ListMetastoresRequest": {
+      "fields": {
+        "max_results": {
+          "description": "Maximum number of metastores to return.\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- when set to 0, the page length is set to a server configured value (recommended);\n- when set to a value less than 0, an invalid parameter error is returned;\n- If not set, all the metastores are returned (not recommended).\n- Note: The number of returned metastores might be less than the specified max_results size, even zero.\nThe only definitive indication that no further metastores can be fetched is when the next_page_token is unset from the response.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Opaque pagination token to go to next page based on previous query.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ListMetastoresResponse": {
+      "fields": {
+        "metastores": {
+          "description": "An array of metastore information objects.",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "Opaque token to retrieve the next page of results. Absent if there are no more pages.\n__page_token__ should be set to this value for the next request (for the next page of results).",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ListModelProviderServicesRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Maximum number of provider services to return. Defaults to 100 when unset or\n0; the maximum is 200. Use `page_token` to retrieve additional pages.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Opaque pagination token from the previous response.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "parent": {
+          "description": "Parent schema to list within, in the form\n`schemas/{catalog}.{schema}`. Required. Each `{...}` component is capped at\n255 characters individually.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "view": {
+          "description": "Fields to return for each service. `FULL` includes resolved\nservice-credential and inference-table details and rate-limit principal\nnames. `BASIC` omits those details and principal names from rate limits.\nDefaults to `BASIC` when unset.",
+          "ref": "catalog.ListModelProviderServicesRequestView",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.ListModelProviderServicesRequestView": {
+      "description": "Controls which fields are populated on each ModelProviderService in the\nresponse. The server uses `BASIC` when `view` is unset. Callers needing the\nfull configuration must request it explicitly with `view = FULL`.",
+      "enum": [
+        "FULL",
+        "BASIC"
+      ],
+      "enum_launch_stages": {
+        "BASIC": "GA",
+        "FULL": "GA"
+      }
+    },
+    "catalog.ListModelProviderServicesResponse": {
+      "description": "Response for listing model provider services.",
+      "fields": {
+        "model_provider_services": {
+          "description": "The list of model provider services.",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "Pagination token for retrieving the next page. Empty when there are no\nmore results.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ListModelServicesRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Maximum number of model services to return. Defaults to 100 when unset or 0;\nthe maximum is 200. Use `page_token` to retrieve additional pages.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Opaque pagination token from the previous response.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "parent": {
+          "description": "Parent schema to list within, in the form\n`schemas/{catalog}.{schema}`. Required. Each `{...}` component is capped at\n255 characters individually.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "view": {
+          "description": "Fields to return for each service. `FULL` includes destinations,\ninference-table details, and rate-limit principal names. `BASIC` omits\ndestinations and inference-table details and omits principal names from\nrate limits. Defaults to `BASIC` when unset.",
+          "ref": "catalog.ListModelServicesRequestView",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.ListModelServicesRequestView": {
+      "description": "Controls which fields are populated on each ModelService in the response.\nThe server uses `BASIC` when `view` is unset. Callers needing the full\nconfiguration must request it explicitly with `view = FULL`.",
+      "enum": [
+        "FULL",
+        "BASIC"
+      ],
+      "enum_launch_stages": {
+        "BASIC": "GA",
+        "FULL": "GA"
+      }
+    },
+    "catalog.ListModelServicesResponse": {
+      "description": "Response for listing model services.",
+      "fields": {
+        "model_services": {
+          "description": "The list of model services.",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "Pagination token for retrieving the next page. Empty when there are no\nmore results.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ListModelVersionsRequest": {
+      "fields": {
+        "include_browse": {
+          "description": "Whether to include model versions in the response for which the principal can only access selective metadata for",
+          "launch_stage": "GA"
+        },
+        "max_results": {
+          "description": "Maximum number of model versions to return.\nIf not set, the page length is set to a server configured value (100, as of 1/3/2024).\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value(1000, as of 1/3/2024);\n- when set to 0, the page length is set to a server configured value (100, as of 1/3/2024) (recommended);\n- when set to a value less than 0, an invalid parameter error is returned;",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Opaque pagination token to go to next page based on previous query.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ListModelVersionsResponse": {
+      "fields": {
+        "model_versions": {
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "Opaque token to retrieve the next page of results. Absent if there are no more pages.\n__page_token__ should be set to this value for the next request (for the next page of results).",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ListPoliciesRequest": {
+      "fields": {
+        "include_inherited": {
+          "description": "Optional. Whether to include policies defined on parent securables.\nBy default, the inherited policies are not included.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "max_results": {
+          "description": "Optional.  Maximum number of policies to return on a single page (page length).\n- When not set or set to 0, the page length is set to a server configured value (recommended);\n- When set to a value greater than 0, the page length is the minimum of this value and a server configured value;",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Optional. Opaque pagination token to go to next page based on previous query.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.ListPoliciesResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "Optional opaque token for continuing pagination. `page_token` should be set to this value for\nthe next request to retrieve the next page of results.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "policies": {
+          "description": "The list of retrieved policies.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "catalog.ListPrivilegeAssignmentsRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Specifies the maximum number of privilege assignments to return (page length).\nEvery PrivilegeAssignment present in a single page response is guaranteed to contain all the privileges granted on\nthe requested Securable for the respective principal.\n\nIf not set, page length is the server configured value.\nIf set to\n- lesser than 0: invalid parameter error\n- 0: page length is set to a server configured value\n- lesser than 150 but greater than 0: invalid parameter error (this is to ensure that server is able to return at\nleast one complete PrivilegeAssignment in a single page response)\n- greater than (or equal to) 150: page length is the minimum of this value and a server configured value",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Opaque pagination token to go to next page based on previous query.",
+          "launch_stage": "GA"
+        },
+        "principal": {
+          "description": "If provided, only the permissions for the specified principal (user or group) are returned.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.ListPrivilegeAssignmentsResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "Opaque token to retrieve the next page of results. Absent if there are no more pages.\n__page_token__ should be set to this value for the next request (for the next page of results).",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "privilege_assignments": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "catalog.ListQuotasRequest": {
+      "fields": {
+        "max_results": {
+          "description": "The number of quotas to return.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Opaque token for the next page of results.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ListQuotasResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "Opaque token to retrieve the next page of results. Absent if there are no more pages.\n__page_token__ should be set to this value for the next request.",
+          "launch_stage": "GA"
+        },
+        "quotas": {
+          "description": "An array of returned QuotaInfos.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ListRefreshesRequest": {},
+    "catalog.ListRegisteredModelsRequest": {
+      "fields": {
+        "catalog_name": {
+          "description": "The identifier of the catalog under which to list registered models.\nIf specified, schema_name must be specified.",
+          "launch_stage": "GA"
+        },
+        "include_browse": {
+          "description": "Whether to include registered models in the response for which the principal can only access selective metadata for",
+          "launch_stage": "GA"
+        },
+        "max_results": {
+          "description": "Max number of registered models to return.\n\nIf both catalog and schema are specified:\n- when max_results is not specified, the page length is set to a server configured value (10000, as of 4/2/2024).\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value (10000, as of 4/2/2024);\n- when set to 0, the page length is set to a server configured value (10000, as of 4/2/2024);\n- when set to a value less than 0, an invalid parameter error is returned;\n\nIf neither schema nor catalog is specified:\n- when max_results is not specified, the page length is set to a server configured value (100, as of 4/2/2024).\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value (1000, as of 4/2/2024);\n- when set to 0, the page length is set to a server configured value (100, as of 4/2/2024);\n- when set to a value less than 0, an invalid parameter error is returned;",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Opaque token to send for the next page of results (pagination).",
+          "launch_stage": "GA"
+        },
+        "schema_name": {
+          "description": "The identifier of the schema under which to list registered models.\nIf specified, catalog_name must be specified.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ListRegisteredModelsResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "Opaque token for pagination. Omitted if there are no more results. page_token should\nbe set to this value for fetching the next page.",
+          "launch_stage": "GA"
+        },
+        "registered_models": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ListSchemasRequest": {
+      "fields": {
+        "catalog_name": {
+          "description": "Parent catalog for schemas of interest.",
+          "launch_stage": "GA"
+        },
+        "include_browse": {
+          "description": "Whether to include schemas in the response for which the principal can only access selective metadata for",
+          "launch_stage": "GA"
+        },
+        "max_results": {
+          "description": "Maximum number of schemas to return.\nIf not set, all the schemas are returned (not recommended).\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- when set to 0, the page length is set to a server configured value (recommended);\n- when set to a value less than 0, an invalid parameter error is returned;",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Opaque pagination token to go to next page based on previous query.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ListSchemasResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "Opaque token to retrieve the next page of results. Absent if there are no more pages.\n__page_token__ should be set to this value for the next request (for the next page of results).",
+          "launch_stage": "GA"
+        },
+        "schemas": {
+          "description": "An array of schema information objects.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ListSecretsRequest": {
+      "fields": {
+        "catalog_name": {
+          "description": "The name of the catalog under which to list secrets. Both **catalog_name** and\n**schema_name** must be specified together.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_size": {
+          "description": "Maximum number of secrets to return.\n\n- If not specified, at most 1000 secrets are returned.\n- If set to a value greater than 0, the page length is the minimum of this value and 1000.\n- If set to 0, the page length is set to 1000.\n- If set to a value less than 0, an invalid parameter error is returned.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Opaque pagination token to go to the next page based on previous query. The maximum page length\nis determined by a server configured value.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "schema_name": {
+          "description": "The name of the schema under which to list secrets. Both **catalog_name** and\n**schema_name** must be specified together.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.ListSecretsResponse": {
+      "description": "Response message for ListSecrets.",
+      "fields": {
+        "next_page_token": {
+          "description": "Opaque token to retrieve the next page of results. Absent if there are no more pages.\n**page_token** should be set to this value for the next request.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "secrets": {
+          "description": "An array of secret objects.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "catalog.ListSkillsRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Maximum number of skills to return. Defaults to 100 when unset or 0; the\nmaximum is 200. Use `page_token` to retrieve additional pages.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Opaque pagination token from a previous request.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "parent": {
+          "description": "Name of the parent schema. Format: `schemas/{catalog}.{schema}`.\nEach `{...}` component is capped at 255 characters individually.\n\nRequired: skill listing is schema-scoped, so `parent` must be set; an unset\nor empty `parent` is rejected with INVALID_PARAMETER_VALUE.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "catalog.ListSkillsResponse": {
+      "description": "Response for listing skills.",
+      "fields": {
+        "next_page_token": {
+          "description": "Pagination token for retrieving the next page of results.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "skills": {
+          "description": "The list of skills.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "catalog.ListStorageCredentialsRequest": {
+      "fields": {
+        "include_unbound": {
+          "description": "Whether to include credentials not bound to the workspace.\nEffective only if the user has permission to update the credential–workspace binding.",
+          "launch_stage": "GA"
+        },
+        "max_results": {
+          "description": "Maximum number of storage credentials to return.\nIf not set, all the storage credentials are returned (not recommended).\n- when set to a value greater than 0, the page length is the minimum of\nthis value and a server configured value;\n- when set to 0, the page length is set to a server configured value\n(recommended);\n- when set to a value less than 0, an invalid parameter error is returned;",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Opaque pagination token to go to next page based on previous query.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ListStorageCredentialsResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "Opaque token to retrieve the next page of results. Absent if there are no\nmore pages.\n__page_token__ should be set to this value for the next request (for the\nnext page of results).",
+          "launch_stage": "GA"
+        },
+        "storage_credentials": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ListSummariesRequest": {
+      "fields": {
+        "catalog_name": {
+          "description": "Name of parent catalog for tables of interest.",
+          "launch_stage": "GA"
+        },
+        "include_manifest_capabilities": {
+          "description": "Whether to include a manifest containing table capabilities in the response.",
+          "launch_stage": "GA"
+        },
+        "max_results": {
+          "description": "Maximum number of summaries for tables to return.\nIf not set, the page length is set to a server configured value (10000, as of 1/5/2024).\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value (10000, as of 1/5/2024);\n- when set to 0, the page length is set to a server configured value (10000, as of 1/5/2024) (recommended);\n- when set to a value less than 0, an invalid parameter error is returned;",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Opaque pagination token to go to next page based on previous query.",
+          "launch_stage": "GA"
+        },
+        "schema_name_pattern": {
+          "description": "A sql LIKE pattern (% and _) for schema names.\nAll schemas will be returned if not set or empty.",
+          "launch_stage": "GA"
+        },
+        "table_name_pattern": {
+          "description": "A sql LIKE pattern (% and _) for table names.\nAll tables will be returned if not set or empty.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ListSystemSchemasRequest": {
+      "fields": {
+        "max_results": {
+          "description": "Maximum number of schemas to return.\n- When set to 0, the page length is set to a server configured value (recommended);\n- When set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- When set to a value less than 0, an invalid parameter error is returned;\n- If not set, all the schemas are returned (not recommended).",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "page_token": {
+          "description": "Opaque pagination token to go to next page based on previous query.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.ListSystemSchemasResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "Opaque token to retrieve the next page of results. Absent if there are no more pages.\n__page_token__ should be set to this value for the next request (for the next page of results).",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "schemas": {
+          "description": "An array of system schema information objects.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.ListTableSummariesResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "Opaque token to retrieve the next page of results. Absent if there are no more pages.\n__page_token__ should be set to this value for the next request (for the next page of results).",
+          "launch_stage": "GA"
+        },
+        "tables": {
+          "description": "List of table summaries.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ListTablesRequest": {
+      "fields": {
+        "catalog_name": {
+          "description": "Name of parent catalog for tables of interest.",
+          "launch_stage": "GA"
+        },
+        "include_browse": {
+          "description": "Whether to include tables in the response for which the principal can only access selective metadata for.",
+          "launch_stage": "GA"
+        },
+        "include_manifest_capabilities": {
+          "description": "Whether to include a manifest containing table capabilities in the response.",
+          "launch_stage": "GA"
+        },
+        "max_results": {
+          "description": "Maximum number of tables to return.\nIf not set, all the tables are returned (not recommended).\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- when set to 0, the page length is set to a server configured value (recommended);\n- when set to a value less than 0, an invalid parameter error is returned;",
+          "launch_stage": "GA"
+        },
+        "omit_columns": {
+          "description": "Whether to omit the columns of the table from the response or not.",
+          "launch_stage": "GA"
+        },
+        "omit_properties": {
+          "description": "Whether to omit the properties of the table from the response or not.",
+          "launch_stage": "GA"
+        },
+        "omit_username": {
+          "description": "Whether to omit the username of the table (e.g. owner, updated_by, created_by) from the response or not.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Opaque token to send for the next page of results (pagination).",
+          "launch_stage": "GA"
+        },
+        "schema_name": {
+          "description": "Parent schema of tables.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ListTablesResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "Opaque token to retrieve the next page of results. Absent if there are no more pages.\n__page_token__ should be set to this value for the next request (for the next page of results).",
+          "launch_stage": "GA"
+        },
+        "tables": {
+          "description": "An array of table information objects.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ListVolumesRequest": {
+      "fields": {
+        "catalog_name": {
+          "description": "The identifier of the catalog",
+          "launch_stage": "GA"
+        },
+        "include_browse": {
+          "description": "Whether to include volumes in the response for which the principal can only access selective metadata for",
+          "launch_stage": "GA"
+        },
+        "max_results": {
+          "description": "Maximum number of volumes to return (page length).\n\nIf not set, the page length is set to a server configured value (10000, as of 1/29/2024).\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value (10000, as of 1/29/2024);\n- when set to 0, the page length is set to a server configured value (10000, as of 1/29/2024) (recommended);\n- when set to a value less than 0, an invalid parameter error is returned;\n\nNote: this parameter controls only the maximum number of volumes to return. The actual number of volumes returned in a page\nmay be smaller than this value, including 0, even if there are more pages.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Opaque token returned by a previous request. It must be included in the request to retrieve the next page of results (pagination).",
+          "launch_stage": "GA"
+        },
+        "schema_name": {
+          "description": "The identifier of the schema",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ListVolumesResponseContent": {
+      "fields": {
+        "next_page_token": {
+          "description": "Opaque token to retrieve the next page of results. Absent if there are no more pages.\n__page_token__ should be set to this value for the next request to retrieve the next page of results.",
+          "launch_stage": "GA"
+        },
+        "volumes": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.MatchColumn": {
+      "fields": {
+        "alias": {
+          "description": "Optional alias of the matched column.",
+          "launch_stage": "GA"
+        },
+        "condition": {
+          "description": "The condition expression used to match a table column.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.MatchType": {
+      "description": "The artifact pattern matching type",
+      "enum": [
+        "PREFIX_MATCH"
+      ],
+      "enum_launch_stages": {
+        "PREFIX_MATCH": "GA"
+      }
+    },
+    "catalog.McpService": {
+      "description": "A Unity Catalog securable that registers an MCP server through a Unity\nCatalog connection and exposes its tools for discovery, authorization, and\ninvocation.",
+      "fields": {
+        "comment": {
+          "description": "User-provided description.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "config": {
+          "description": "Connection, tool selectors, and rate limits. Required on Create. On Update,\nprovide this field when `update_mask` contains `config` or one of its\nsubpaths.",
+          "ref": "catalog.McpServiceConfig",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "create_time": {
+          "description": "Time the MCP service was created.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "created_by": {
+          "description": "Creator identity.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "effective_owner": {
+          "description": "Owner of the MCP service.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "etag": {
+          "description": "Optimistic concurrency token returned on every read. To make an Update or\nDelete conditional, pass the last-read value in that request's `etag`\nfield. In REST responses, this value is a base64 string; URL-encode it when\nsetting the `etag` query parameter.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "metastore_id": {
+          "description": "Metastore hosting the MCP service.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "Resource name of the MCP service.\nFormat: `mcp-services/{catalog}.{schema}.{mcp_service}`.\nEach `{...}` component is capped at 255 characters individually.\nServer-derived on Create from `parent` +\n`mcp_service_id`; required and immutable on Update/Get/Delete.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "update_time": {
+          "description": "Time the MCP service was last modified.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "updated_by": {
+          "description": "Identity of the last updater.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "catalog.McpServiceConfig": {
+      "description": "Operational configuration for an MCP service. Groups the source reference,\ntool selectors, and rate limits -- the fields that configure how the MCP\nservice behaves at invocation time.",
+      "fields": {
+        "include_tool_selectors": {
+          "description": "Tool names or prefix patterns to expose from the MCP server. Use exact\ntool names or prefix patterns such as `read_*`. An empty list exposes all\ntools. At most 1,024 selectors are allowed, and each selector can contain\nat most 256 characters.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "rate_limits": {
+          "description": "Rate limits for tool invocations. Supported scopes are user, group, service\nprincipal, the service as a whole, and each user by default. Request and\ntoken limits are supported. Empty when no rate limit is configured.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "source_connection": {
+          "description": "Unity Catalog connection referencing the MCP server. Required on Create.",
+          "ref": "catalog.McpServiceConfigSourceConnection",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.McpServiceConfigSourceConnection": {
+      "description": "Unity Catalog connection that points to the MCP server. On Create, provide\n`name` in the schema-scoped form\n`connections/{catalog}.{schema}.{connection}`. On read, the service\npopulates the resolved connection metadata. If the connection is deleted,\nits reference remains visible so you can identify the broken dependency.",
+      "fields": {
+        "is_deleted": {
+          "description": "Whether the referenced connection has been deleted. The MCP service keeps\nthe reference so callers can identify the broken dependency; tool\ninvocation fails until the source connection is updated.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "Resource name of the Unity Catalog connection used to access the MCP\nserver, in the form `connections/{catalog}.{schema}.{connection}`.",
+          "launch_stage": "GA"
+        },
+        "options": {
+          "description": "Options needed to build the U2M authorize request, returned as a flat map. When set, it\nincludes: `authorization_endpoint` (OAuth authorize URL), `token_endpoint` (token-exchange\nURL), `oauth_scope` (space-separated scopes to request), `client_id` (OAuth client id), and\n`oauth_provider` (the OAuth provider).",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "catalog.McpServiceUserMappedCredential": {
+      "description": "A caller's per-user OAuth credential for an MCP service.",
+      "fields": {
+        "options": {
+          "description": "Token-expiry info for the credential, returned as a flat map: `access_token_expiration` (always\nset) and `refresh_token_expiration` (set when the credential has a refresh token). Both values\nare timestamps.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "provisioning_info": {
+          "description": "Provisioning state of the credential. `ACTIVE` means the caller is logged in and the credential\nis usable; any other state means the login has not completed.",
+          "ref": "catalog.ProvisioningInfo",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "catalog.McpServiceUserMappedCredentialLogin": {
+      "description": "Login input for an MCP service user credential. Carries the OAuth exchange fields as a flat map.",
+      "fields": {
+        "options": {
+          "description": "OAuth exchange fields: `pkce_verifier`, `authorization_code`, and `oauth_redirect_uri`.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.MetastoreAssignment": {
+      "fields": {
+        "default_catalog_name": {
+          "description": "The name of the default catalog in the metastore. This field is deprecated.\nPlease use \"Default Namespace API\" to configure the default catalog for a Databricks workspace.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "metastore_id": {
+          "description": "The unique ID of the metastore.",
+          "launch_stage": "GA"
+        },
+        "workspace_id": {
+          "description": "The unique ID of the Databricks workspace.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.MetastoreInfo": {
+      "fields": {
+        "cloud": {
+          "description": "Cloud vendor of the metastore home shard (e.g., `aws`, `azure`, `gcp`).",
+          "launch_stage": "GA"
+        },
+        "created_at": {
+          "description": "Time at which this metastore was created, in epoch milliseconds.",
+          "launch_stage": "GA"
+        },
+        "created_by": {
+          "description": "Username of metastore creator.",
+          "launch_stage": "GA"
+        },
+        "default_data_access_config_id": {
+          "description": "Unique identifier of the metastore's (Default) Data Access Configuration.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "delta_sharing_organization_name": {
+          "description": "The organization name of a Delta Sharing entity, to be used in Databricks-to-Databricks Delta Sharing as the official name.",
+          "launch_stage": "GA"
+        },
+        "delta_sharing_recipient_token_lifetime_in_seconds": {
+          "description": "The lifetime of delta sharing recipient token in seconds.",
+          "launch_stage": "GA"
+        },
+        "delta_sharing_scope": {
+          "description": "The scope of Delta Sharing enabled for the metastore.",
+          "ref": "catalog.DeltaSharingScopeEnum",
+          "launch_stage": "GA"
+        },
+        "external_access_enabled": {
+          "description": "Whether to allow non-DBR clients to directly access entities under the metastore.",
+          "launch_stage": "GA"
+        },
+        "global_metastore_id": {
+          "description": "Globally unique metastore ID across clouds and regions, of the form `cloud:region:metastore_id`.",
+          "launch_stage": "GA"
+        },
+        "metastore_id": {
+          "description": "Unique identifier of metastore.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The user-specified name of the metastore.",
+          "launch_stage": "GA"
+        },
+        "owner": {
+          "description": "The owner of the metastore.",
+          "launch_stage": "GA"
+        },
+        "privilege_model_version": {
+          "description": "Privilege model version of the metastore, of the form `major.minor` (e.g., `1.0`).",
+          "launch_stage": "GA"
+        },
+        "region": {
+          "description": "Cloud region which the metastore serves (e.g., `us-west-2`, `westus`).",
+          "launch_stage": "GA"
+        },
+        "storage_root": {
+          "description": "The storage root URL for metastore",
+          "launch_stage": "GA"
+        },
+        "storage_root_credential_id": {
+          "description": "UUID of storage credential to access the metastore storage_root.",
+          "launch_stage": "GA"
+        },
+        "storage_root_credential_name": {
+          "description": "Name of the storage credential to access the metastore storage_root.",
+          "launch_stage": "GA"
+        },
+        "updated_at": {
+          "description": "Time at which the metastore was last modified, in epoch milliseconds.",
+          "launch_stage": "GA"
+        },
+        "updated_by": {
+          "description": "Username of user who last modified the metastore.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ModelProviderService": {
+      "description": "A Unity Catalog securable that stores authentication and request\nconfiguration for an external model provider, such as OpenAI, Azure OpenAI,\nor Amazon Bedrock. Model service destinations reference it to send requests\nto that provider.\n\nA model provider service can be referenced by multiple model services. A\nmodel service can route across multiple model provider services for traffic\nsplitting or failover.",
+      "fields": {
+        "comment": {
+          "description": "User-provided description.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "config": {
+          "description": "Provider authentication, exposed models, request-forwarding controls, rate\nlimits, and payload logging. Required on Create. On Update, it is required\nonly when `config` or one of its subpaths appears in `update_mask`.",
+          "ref": "catalog.ModelProviderServiceConfig",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "create_time": {
+          "description": "Time the provider service was created.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "created_by": {
+          "description": "Creator identity.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "effective_owner": {
+          "description": "Owner of the model provider service.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "etag": {
+          "description": "Optimistic concurrency token returned on every read. To make an Update or\nDelete conditional, pass the last-read value in that request's `etag`\nfield. In REST responses, this value is a base64 string; URL-encode it when\nsetting the `etag` query parameter.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "metastore_id": {
+          "description": "Metastore hosting the provider service.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "Resource name of the provider service.\nFormat: `model-provider-services/{catalog}.{schema}.{model_provider_service}`.\nEach `{...}` component is capped at 255 characters individually.\nServer-derived on Create from `parent` +\n`model_provider_service_id`; required and immutable on Update/Get/Delete.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "update_time": {
+          "description": "Time the provider service was last modified.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "updated_by": {
+          "description": "Identity of the last updater.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "catalog.ModelProviderServiceConfig": {
+      "description": "Behavioral configuration for a ModelProviderService: provider authentication\nand provider-specific fields, the catalog of models this provider\nservice can route to, and the passthrough policy that governs how request\nheaders, query parameters, and unmanaged subpaths cross the trust boundary\nto the upstream provider.",
+      "fields": {
+        "allow_all_targets": {
+          "description": "When true, accepts any model exposed by the upstream provider; `targets`\nis not required and does not restrict routability. When false, only\nmodels listed in `targets` are routable. Defaults to false.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "amazon_bedrock": {
+          "ref": "catalog.ModelProviderServiceConfigAmazonBedrockProviderConfig",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "anthropic": {
+          "ref": "catalog.ModelProviderServiceConfigAnthropicProviderConfig",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "azure_openai": {
+          "ref": "catalog.ModelProviderServiceConfigAzureOpenAiProviderConfig",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "bedrock_mantle": {
+          "ref": "catalog.ModelProviderServiceConfigAmazonBedrockProviderConfig",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "custom": {
+          "ref": "catalog.ModelProviderServiceConfigCustomProviderConfig",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "forward_headers": {
+          "description": "Whether to forward incoming HTTP headers to the upstream provider. Defaults\nto false and is configured for the entire provider service, not per request.\nUpstream authentication is configured separately in the provider-specific\nconfiguration.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "forward_query_parameters": {
+          "description": "Whether to forward incoming query parameters to the upstream provider.\nDefaults to false and is configured for the entire provider service, not\nper request.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "forward_unmanaged_paths": {
+          "description": "Whether to proxy paths that AI Gateway does not recognize as configured\nprovider-native API types. Defaults to false. When true, these paths are\nforwarded unchanged to the upstream provider. When false, only\nrecognized API paths are served. Enabling this broadens the upstream API\nsurface exposed through the provider service. AI Gateway cannot evaluate\nService Policies on opaque unmanaged requests, so unmanaged requests are\nrejected whenever Service Policies are attached to this securable.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "gemini_enterprise": {
+          "ref": "catalog.ModelProviderServiceConfigGeminiEnterpriseProviderConfig",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "inference_table": {
+          "description": "Payload logging configuration for requests sent directly to this provider\nservice. Requests routed through a model service are captured by that model\nservice's inference table instead.",
+          "ref": "catalog.InferenceTableConfig",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "microsoft_foundry": {
+          "ref": "catalog.ModelProviderServiceConfigMicrosoftFoundryProviderConfig",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "openai": {
+          "ref": "catalog.ModelProviderServiceConfigOpenAiProviderConfig",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "pricing": {
+          "description": "Pricing configuration for this provider service. An explicitly empty\nconfiguration is retained on Create and Update and applies no adjustment.",
+          "ref": "catalog.ModelProviderServiceConfigProviderPricingConfig",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "provider_type": {
+          "description": "External model provider. Required on Create and immutable thereafter. Set\nthe matching provider-specific configuration, such as `openai`,\n`azure_openai`, or `amazon_bedrock`.",
+          "ref": "catalog.ModelProviderServiceConfigExternalModelProviderType",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE",
+            "OPTIONAL"
+          ]
+        },
+        "rate_limits": {
+          "description": "Rate limits for requests sent directly to this provider service. Requests\nrouted through a model service use that model service's rate limits instead.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "targets": {
+          "description": "Models and provider-native API types exposed by this provider service. Each\nentry must include at least one `native_api_types` value. When\n`allow_all_targets` is false, at least one entry is required and model\nservice destinations can reference only listed models. When\n`allow_all_targets` is true, any upstream model is routable; entries in\nthis list provide API-type metadata without restricting other models.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.ModelProviderServiceConfigAmazonBedrockProviderConfig": {
+      "description": "Amazon Bedrock provider configuration.",
+      "fields": {
+        "direct": {
+          "description": "Amazon Bedrock region and authentication configuration.",
+          "ref": "catalog.ModelProviderServiceConfigAmazonBedrockProviderDirectConfig",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.ModelProviderServiceConfigAmazonBedrockProviderDirectConfig": {
+      "description": "Direct form of Amazon Bedrock provider config.\n\nAuthentication is one of two mutually exclusive modes, exactly one of which\nmust be supplied on Create:\n- Access keys: set `aws_access_key`, leave `service_credential` unset.\n- Unity Catalog service credential: set `service_credential.name` to the\nresource name `credentials/{name}`, leave `aws_access_key` unset. The\ncredential value lives in Unity Catalog and is referenced by name, not\nheld on this message.\nSetting more than one mode is rejected.",
+      "fields": {
+        "aws_access_key": {
+          "description": "AWS access-key-pair authentication. Set `access_key_id` and\n`secret_access_key.plaintext`. Mutually exclusive with\n`service_credential`.",
+          "ref": "catalog.ModelProviderServiceConfigAwsAccessKey",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "region": {
+          "description": "AWS region where the Bedrock endpoint is hosted (e.g., `us-east-1`).\nRequired on Create.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "service_credential": {
+          "description": "Reference to a Unity Catalog service credential authorizing Bedrock\nrequests. On Create, supply `service_credential.name` in the form\n`credentials/{name}`. Required on Create when using service-credential\nauthentication; mutually exclusive with `aws_access_key`. The credential\nis referenced by name; its value is not carried here. Only\nsupported on AWS-hosted workspaces.",
+          "ref": "catalog.ModelProviderServiceConfigServiceCredential",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.ModelProviderServiceConfigAnthropicProviderConfig": {
+      "description": "Anthropic provider configuration. Exactly one of `direct` or `relayed` must\nbe set on Create; the two are mutually exclusive.",
+      "fields": {
+        "direct": {
+          "description": "Direct authentication with an API key supplied in\n`direct.api_key.plaintext`. Required unless `relayed` is set.",
+          "ref": "catalog.ModelProviderServiceConfigAnthropicProviderDirectConfig",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "relayed": {
+          "description": "Relayed authentication. Each inference request supplies the caller's\nOAuth token, which is forwarded to Anthropic. No Anthropic credential is\nstored. Mutually exclusive with `direct`.",
+          "ref": "catalog.ModelProviderServiceConfigAnthropicProviderRelayedConfig",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.ModelProviderServiceConfigAnthropicProviderDirectConfig": {
+      "description": "Direct form of Anthropic provider config.",
+      "fields": {
+        "api_key": {
+          "description": "Anthropic API key. Required when creating the service. Supply the value\nin `api_key.plaintext`.",
+          "ref": "catalog.ModelProviderServiceConfigProviderSecret",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.ModelProviderServiceConfigAnthropicProviderRelayedConfig": {
+      "description": "Relayed Anthropic provider configuration. Each inference request supplies\nthe caller's OAuth token, which is forwarded to Anthropic. No Anthropic\ncredential is stored."
+    },
+    "catalog.ModelProviderServiceConfigAwsAccessKey": {
+      "description": "AWS access-key-pair auth for Amazon Bedrock: a SigV4-signing key pair.",
+      "fields": {
+        "access_key_id": {
+          "description": "AWS access key ID. Required on Create when using access-key auth. Treated as\nusername-equivalent (not a secret value): round-trips on reads and is\nscrubbed from audit logs.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "secret_access_key": {
+          "description": "AWS secret access key paired with `access_key_id`. Required when creating\na service with access-key authentication. Supply the value in\n`secret_access_key.plaintext`.",
+          "ref": "catalog.ModelProviderServiceConfigProviderSecret",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.ModelProviderServiceConfigAzureOpenAiProviderConfig": {
+      "description": "Azure OpenAI provider configuration.",
+      "fields": {
+        "direct": {
+          "description": "Azure OpenAI endpoint and authentication configuration.",
+          "ref": "catalog.ModelProviderServiceConfigAzureOpenAiProviderDirectConfig",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.ModelProviderServiceConfigAzureOpenAiProviderDirectConfig": {
+      "description": "Direct form of Azure OpenAI provider config. Exactly one of three\nmutually-exclusive auth modes must be supplied on Create:\n- API key: set `api_key`, leave `entra_service_principal` and\n`service_credential` unset.\n- Entra ID (service principal): set `entra_service_principal`, leave\n`api_key` and `service_credential` unset.\n- Unity Catalog service credential: set `service_credential.name` to the\nresource name `credentials/{name}`, leave `api_key` and\n`entra_service_principal` unset. The credential value lives in Unity\nCatalog and is referenced by name, not held on this message. Only\nsupported on Azure-hosted workspaces.\nSetting more than one mode is rejected.",
+      "fields": {
+        "api_key": {
+          "description": "Azure OpenAI API key. Supply the value in `api_key.plaintext`. Mutually\nexclusive with Entra ID and Unity Catalog service credential\nauthentication.",
+          "ref": "catalog.ModelProviderServiceConfigProviderSecret",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "base_url": {
+          "description": "Full Azure OpenAI endpoint base URL, e.g.\n`https://myresource.openai.azure.com`. Required on Create.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "entra_service_principal": {
+          "description": "Entra ID service-principal authentication. Set `tenant_id`, `client_id`,\nand `client_secret.plaintext`. Mutually exclusive with `api_key` and\n`service_credential`.",
+          "ref": "catalog.ModelProviderServiceConfigEntraServicePrincipal",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "service_credential": {
+          "description": "Reference to a Unity Catalog service credential authorizing Azure OpenAI\nrequests. On Create, supply `service_credential.name` in the form\n`credentials/{name}`. Required on Create when using service-credential\nauthentication; mutually exclusive with `api_key` and\n`entra_service_principal`. The credential is referenced by name; its value\nis not carried here. Only supported on Azure-hosted workspaces.",
+          "ref": "catalog.ModelProviderServiceConfigServiceCredential",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.ModelProviderServiceConfigCustomProviderApiKeyHeaderAuth": {
+      "description": "Header-based API-key authentication for a custom provider: the secret is\nforwarded on outbound requests under a caller-chosen HTTP header, as\n`\u003capi_key_name\u003e: \u003capi_key_value\u003e`.",
+      "fields": {
+        "api_key_name": {
+          "description": "HTTP header name that carries the API key on outbound requests (e.g.,\n`Ocp-Apim-Subscription-Key`). The value forwarded under this header is\nsupplied via `api_key_value`.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "api_key_value": {
+          "description": "Secret value forwarded under the `api_key_name` header on outbound\nrequests. Supplied as inline plaintext via `ProviderSecret.plaintext`.",
+          "ref": "catalog.ModelProviderServiceConfigProviderSecret",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.ModelProviderServiceConfigCustomProviderConfig": {
+      "description": "Custom OpenAI-compatible provider configuration with bearer-token\nauthentication.",
+      "fields": {
+        "direct": {
+          "description": "Endpoint and authentication configuration for the custom provider.",
+          "ref": "catalog.ModelProviderServiceConfigCustomProviderDirectConfig",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.ModelProviderServiceConfigCustomProviderDirectConfig": {
+      "description": "Direct form of a custom provider configuration. Set `api_key` to send the\nsecret as an `Authorization` bearer token, or `header_auth` to forward it\nunder a caller-chosen HTTP header.",
+      "fields": {
+        "api_key": {
+          "description": "Bearer token forwarded in the `Authorization` header. Supply the value\nin `api_key.plaintext`.",
+          "ref": "catalog.ModelProviderServiceConfigProviderSecret",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "base_url": {
+          "description": "Endpoint URL of the OpenAI-compatible service (e.g.,\n`https://api.example.com/v1`). Required on Create.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "header_auth": {
+          "description": "Header-based API-key auth: the secret is forwarded on outbound requests\nunder a caller-chosen HTTP header rather than as an `Authorization`\nbearer token. Set this instead of `api_key` for header auth.",
+          "ref": "catalog.ModelProviderServiceConfigCustomProviderApiKeyHeaderAuth",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.ModelProviderServiceConfigEntraServicePrincipal": {
+      "description": "Entra ID (Azure AD) service-principal authentication. The `tenant_id` and\n`client_id` identify the service principal, and `client_secret` authenticates\nit. AI Gateway exchanges these credentials for an Entra bearer token for\nrequests to Azure OpenAI or Microsoft Foundry.",
+      "fields": {
+        "client_id": {
+          "description": "Entra ID client (application) ID. Required on Create.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "client_secret": {
+          "description": "Entra ID client secret. Supply the value in `client_secret.plaintext`.",
+          "ref": "catalog.ModelProviderServiceConfigProviderSecret",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "tenant_id": {
+          "description": "Entra ID (Azure AD) tenant ID. Required on Create.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.ModelProviderServiceConfigExternalModelProviderType": {
+      "description": "External LLM provider for an EXTERNAL_FOUNDATION_MODEL destination.",
+      "enum": [
+        "EXTERNAL_MODEL_PROVIDER_TYPE_OPENAI",
+        "EXTERNAL_MODEL_PROVIDER_TYPE_AZURE_OPENAI",
+        "EXTERNAL_MODEL_PROVIDER_TYPE_ANTHROPIC",
+        "EXTERNAL_MODEL_PROVIDER_TYPE_AMAZON_BEDROCK",
+        "EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM",
+        "EXTERNAL_MODEL_PROVIDER_TYPE_MICROSOFT_FOUNDRY",
+        "EXTERNAL_MODEL_PROVIDER_TYPE_GEMINI_ENTERPRISE",
+        "EXTERNAL_MODEL_PROVIDER_TYPE_BEDROCK_MANTLE"
+      ],
+      "enum_launch_stages": {
+        "EXTERNAL_MODEL_PROVIDER_TYPE_AMAZON_BEDROCK": "GA",
+        "EXTERNAL_MODEL_PROVIDER_TYPE_ANTHROPIC": "GA",
+        "EXTERNAL_MODEL_PROVIDER_TYPE_AZURE_OPENAI": "GA",
+        "EXTERNAL_MODEL_PROVIDER_TYPE_BEDROCK_MANTLE": "GA",
+        "EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM": "GA",
+        "EXTERNAL_MODEL_PROVIDER_TYPE_GEMINI_ENTERPRISE": "GA",
+        "EXTERNAL_MODEL_PROVIDER_TYPE_MICROSOFT_FOUNDRY": "GA",
+        "EXTERNAL_MODEL_PROVIDER_TYPE_OPENAI": "GA"
+      }
+    },
+    "catalog.ModelProviderServiceConfigGeminiEnterpriseProviderConfig": {
+      "description": "Gemini Enterprise provider configuration.",
+      "fields": {
+        "direct": {
+          "description": "Gemini Enterprise project, region, and authentication configuration.",
+          "ref": "catalog.ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfig",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfig": {
+      "description": "Direct Gemini Enterprise provider configuration. An API key is required\nwhen creating the service.",
+      "fields": {
+        "api_key": {
+          "description": "Google Gemini Enterprise API key. Required when creating the service.\nSupply the value in `api_key.plaintext`.",
+          "ref": "catalog.ModelProviderServiceConfigProviderSecret",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "project_id": {
+          "description": "GCP project ID hosting the Gemini Enterprise endpoint. Required on Create.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "region": {
+          "description": "GCP region of the Gemini Enterprise endpoint (e.g., `us-central1`).\nRequired on Create.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "service_credential": {
+          "description": "Reference to a Unity Catalog service credential authorizing Gemini\nEnterprise requests. On Create, supply `service_credential.name` as\n`credentials/{name}`; required when using service-credential\nauthentication and mutually exclusive with `api_key`. The credential is\nreferenced by name; its value is not carried here. On read, the resolved\n`id` and `is_deleted` are also populated. Supported only on GCP-hosted\nworkspaces.",
+          "ref": "catalog.ModelProviderServiceConfigServiceCredential",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.ModelProviderServiceConfigMicrosoftFoundryProviderConfig": {
+      "description": "Microsoft Foundry provider configuration.",
+      "fields": {
+        "direct": {
+          "description": "Microsoft Foundry endpoint and authentication configuration.",
+          "ref": "catalog.ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfig",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfig": {
+      "description": "Direct form of Microsoft Foundry provider config.\n\nAuthentication is one of three mutually exclusive modes, exactly one of which\nmust be supplied on Create:\n- API key: set `api_key`, leave `entra_service_principal` and\n`service_credential` unset.\n- Entra ID (service principal): set `entra_service_principal`, leave\n`api_key` and `service_credential` unset. AI Gateway exchanges these for\nan Entra bearer token on outbound requests via the OAuth2\nclient-credentials grant.\n- Unity Catalog service credential: set `service_credential.name` to the\nresource name `credentials/{name}`, leave `api_key` and\n`entra_service_principal` unset. The credential value lives in Unity\nCatalog and is referenced by name, not held on this message. Only\nsupported on Azure-hosted workspaces.\nSetting more than one mode is rejected.",
+      "fields": {
+        "api_key": {
+          "description": "Microsoft Foundry API key. Supply the value in `api_key.plaintext`.\nMutually exclusive with Entra ID and Unity Catalog service credential\nauthentication.",
+          "ref": "catalog.ModelProviderServiceConfigProviderSecret",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "base_url": {
+          "description": "Microsoft Foundry endpoint URL. Required on Create.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "entra_service_principal": {
+          "description": "Entra ID service-principal authentication. Set `tenant_id`, `client_id`,\nand `client_secret.plaintext`. Mutually exclusive with `api_key` and\n`service_credential`.",
+          "ref": "catalog.ModelProviderServiceConfigEntraServicePrincipal",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "service_credential": {
+          "description": "Reference to a Unity Catalog service credential authorizing Microsoft\nFoundry requests. On Create, supply `service_credential.name` in the form\n`credentials/{name}`. Required on Create when using service-credential\nauthentication; mutually exclusive with `api_key` and\n`entra_service_principal`. The credential is referenced by name; its value\nis not carried here. Only supported on Azure-hosted workspaces.",
+          "ref": "catalog.ModelProviderServiceConfigServiceCredential",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.ModelProviderServiceConfigModelTargetConfig": {
+      "description": "Model target configuration shared by model provider service targets and\nexternal model destinations on model services.",
+      "fields": {
+        "endpoint_route": {
+          "description": "Relative path appended to a custom provider's `base_url` for this model,\nsuch as `serve/openai/chat`. Nonempty values are only supported for\ncustom model provider service targets; other provider types reject them.\nModel service destinations do not support this field. Do not include\nURI templates, queries, or fragments. When empty, `base_url` is used unchanged.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "model": {
+          "description": "Provider-side model identifier, such as `gpt-5` or `claude-opus-4-7`.\nThis identifies a model at the upstream provider; it is not a Unity\nCatalog model resource.",
+          "launch_stage": "GA"
+        },
+        "native_api_types": {
+          "description": "Provider-native API types supported by this model, such as\n`openai/v1/chat/completions`. A model provider service target requires at\nleast one value. A model service destination may omit the list to use the\nmatching provider service target's types when available. AI Gateway uses\nthe selected types for translation. At most 64 entries of 256 characters\neach are allowed.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.ModelProviderServiceConfigOpenAiProviderConfig": {
+      "description": "OpenAI provider configuration.",
+      "fields": {
+        "direct": {
+          "description": "OpenAI configuration with an API key supplied in the request.",
+          "ref": "catalog.ModelProviderServiceConfigOpenAiProviderDirectConfig",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.ModelProviderServiceConfigOpenAiProviderDirectConfig": {
+      "description": "Direct (inline-credentials) form of the OpenAI provider config.",
+      "fields": {
+        "api_key": {
+          "description": "OpenAI API key. Required when creating the service. Supply the value in\n`api_key.plaintext`.",
+          "ref": "catalog.ModelProviderServiceConfigProviderSecret",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "base_url": {
+          "description": "Optional custom base URL. Defaults to `https://api.openai.com/v1`. Use for\nOpenAI-API-compatible third-party endpoints or in-network proxies.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "organization": {
+          "description": "Optional OpenAI organization ID. When set, the platform forwards it as\nthe `OpenAI-Organization` header.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.ModelProviderServiceConfigProviderPricingConfig": {
+      "description": "Pricing adjustments applied to this provider service's external-model spend\nestimates.",
+      "fields": {
+        "default_discount_basis_points": {
+          "description": "Provider-wide adjustment to external-model spend estimates in basis points:\n2000 = 20% off; -2000 = a 20% markup. Negative values have no lower bound\nbeyond the int32 range. Values cannot exceed 10000 (100% off). An omitted\nvalue or zero leaves the estimate unchanged.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.ModelProviderServiceConfigProviderSecret": {
+      "description": "A secret value supplied as part of an inline provider config. The caller\nsupplies the value as inline `plaintext` on writes; the platform stores it\nencrypted. The `plaintext` field is `INPUT_ONLY` and never round-trips on\nreads.",
+      "fields": {
+        "plaintext": {
+          "description": "Inline plaintext credential. INPUT_ONLY: the value never round-trips on\nreads. Get and List responses omit `plaintext`; the enclosing secret\nobject remains present to indicate that a secret is configured.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "INPUT_ONLY",
+            "OPTIONAL"
+          ]
+        },
+        "secret_reference": {
+          "description": "Reference to a customer-owned UC Secret that carries this secret value.\nThe value is read at invoke time under the model provider service\nowner's access and is never copied onto the model provider service, so\nrotating the UC Secret takes effect with no change to the model provider\nservice. On Create, supply `secret_reference.name` as\n`secrets/{catalog}.{schema}.{secret}`.",
+          "ref": "catalog.ModelProviderServiceConfigSecretReference",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.ModelProviderServiceConfigSecretReference": {
+      "description": "Reference to a customer-owned UC Secret backing a secret-bearing provider\nfield, in the `ProviderSecret.secret_reference` arm.",
+      "fields": {
+        "name": {
+          "description": "Resource name of the bound UC Secret, in the form\n`secrets/{catalog}.{schema}.{secret}`. On Create the caller supplies the\nname here. On read it reflects the secret's current name at read time.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ModelProviderServiceConfigServiceCredential": {
+      "description": "The customer-owned Unity Catalog service credential a model provider service\nuses to authenticate to its provider, referenced by name.",
+      "fields": {
+        "name": {
+          "description": "Resource name of the bound Unity Catalog service credential, in the form\n`credentials/{name}`. Supply this field when creating the service or\nrebinding its credential. On read, it reflects the credential's current\nname.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ModelService": {
+      "description": "A governed AI Gateway endpoint in Unity Catalog that routes inference\nrequests to one or more destinations, such as a Databricks foundation model\nor an external model reached through a model provider service. Applies\ncentralized access control, rate limits, and auditing to its traffic.",
+      "fields": {
+        "comment": {
+          "description": "User-provided description.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "config": {
+          "description": "Destinations, routing, rate limits, and payload logging configuration.\nRequired on Create. On Update, provide this field when `update_mask`\ncontains `config` or one of its subpaths.",
+          "ref": "catalog.ModelServiceConfig",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "create_time": {
+          "description": "Time the model service was created.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "created_by": {
+          "description": "Creator identity.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "effective_owner": {
+          "description": "Owner of the model service.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "etag": {
+          "description": "Optimistic concurrency token returned on every read. To make an Update or\nDelete conditional, pass the last-read value in that request's `etag`\nfield. In REST responses, this value is a base64 string; URL-encode it when\nsetting the `etag` query parameter.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "metastore_id": {
+          "description": "Metastore hosting the model service.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "Resource name of the model service.\nFormat: `model-services/{catalog}.{schema}.{model_service}`.\nEach `{...}` component is capped at 255 characters individually.\nServer-derived on Create from `parent` +\n`model_service_id`; required and immutable on Update/Get/Delete.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "supported_api_types": {
+          "description": "API types supported across this service's destinations, such as\n`openai/v1/chat/completions`, `openai/v1/embeddings`, and\n`mlflow/v1/chat/completions`. Derived from the backing models and providers\nat read time.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY",
+            "UNORDERED_LIST"
+          ]
+        },
+        "update_time": {
+          "description": "Time the model service was last modified.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "updated_by": {
+          "description": "Identity of the last updater.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "catalog.ModelServiceConfig": {
+      "description": "Operational configuration wrapped around the ModelService resource.",
+      "fields": {
+        "inference_table": {
+          "description": "Inference table configuration for payload logging.",
+          "ref": "catalog.InferenceTableConfig",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "rate_limits": {
+          "description": "Rate limits applied to requests routed through this model service.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "routing": {
+          "description": "Routing configuration: destinations and fallback.",
+          "ref": "catalog.ModelServiceConfigRoutingConfig",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.ModelServiceConfigDestinationConfig": {
+      "description": "A destination the model service can route traffic to. Exactly one of the\nper-type configs inside `type_config` must be set, and it must match\n`destination_type`.",
+      "fields": {
+        "destination_type": {
+          "description": "Backing-model category. Provide the matching type-specific configuration\nand leave the other type-specific configurations unset.",
+          "ref": "catalog.ModelServiceConfigDestinationConfigDestinationType",
+          "launch_stage": "GA"
+        },
+        "external_model_config": {
+          "description": "Configuration for an external model reached through a model provider service.",
+          "ref": "catalog.ModelServiceConfigExternalModelConfig",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "is_deleted": {
+          "description": "Whether the destination's backing model or model provider service has\nbeen deleted. The destination remains visible so you can identify the\nbroken dependency. Requests cannot use this destination until the backing\nresource is restored or the destination is replaced.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "User-facing label for this destination, used in routing references.",
+          "launch_stage": "GA"
+        },
+        "pay_per_token_config": {
+          "description": "Configuration for a pay-per-token Databricks foundation model.",
+          "ref": "catalog.ModelServiceConfigPayPerTokenConfig",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "provisioned_throughput_config": {
+          "description": "Configuration for a provisioned-throughput Databricks foundation model.",
+          "ref": "catalog.ModelServiceConfigProvisionedThroughputConfig",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "traffic_percentage": {
+          "description": "Percentage of primary traffic sent to this destination, from 0 to 100.\nRequired when there is more than one primary destination, in which case the\nprimary percentages must sum to 100; a single primary destination receives\nall traffic. Fallback destinations are ordered and do not use this field.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.ModelServiceConfigDestinationConfigDestinationType": {
+      "description": "Backing-model category for a model service destination.",
+      "enum": [
+        "DESTINATION_TYPE_PAY_PER_TOKEN_FOUNDATION_MODEL",
+        "DESTINATION_TYPE_PROVISIONED_THROUGHPUT_FOUNDATION_MODEL",
+        "DESTINATION_TYPE_EXTERNAL_FOUNDATION_MODEL"
+      ],
+      "enum_launch_stages": {
+        "DESTINATION_TYPE_EXTERNAL_FOUNDATION_MODEL": "GA",
+        "DESTINATION_TYPE_PAY_PER_TOKEN_FOUNDATION_MODEL": "GA",
+        "DESTINATION_TYPE_PROVISIONED_THROUGHPUT_FOUNDATION_MODEL": "GA"
+      }
+    },
+    "catalog.ModelServiceConfigExternalModelConfig": {
+      "description": "Configuration for an external-foundation-model destination. Provider auth\nand provider-specific cloud configuration are owned by a separate, governed\nModelProviderService entity referenced via `model_provider_service`; the\nplatform resolves the provider at invocation time.",
+      "fields": {
+        "model_provider_service": {
+          "description": "Resource name of the governed ModelProviderService that owns provider\nauth and provider-specific configuration. The referenced\nModelProviderService also carries the provider type, so this message\ndoes not surface it directly.\nFormat: `model-provider-services/{catalog}.{schema}.{model_provider_service}`.\nEach `{...}` component is capped at 255 characters individually.",
+          "launch_stage": "GA"
+        },
+        "target": {
+          "description": "Routing target for the destination: the provider-side model selected from\nthe referenced ModelProviderService's `targets` catalog, plus the unified\nAPI types the platform should translate to/from at request time.",
+          "ref": "catalog.ModelProviderServiceConfigModelTargetConfig",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ModelServiceConfigFallbackConfig": {
+      "description": "Fallback routing applied after a primary destination fails. Fallback\ndestinations are tried in the listed order.",
+      "fields": {
+        "destinations": {
+          "description": "Fallback destinations, tried in the listed order. At most 5 are allowed.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.ModelServiceConfigPayPerTokenConfig": {
+      "description": "Configuration for a pay-per-token foundation-model destination. Identifies\nthe foundation model by its UC resource name; the platform resolves it to a\nModel Serving endpoint at request time.",
+      "fields": {
+        "model": {
+          "description": "Resource name of the Unity Catalog model.\nFormat: `models/{catalog}.{schema}.{model}`.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ModelServiceConfigProvisionedThroughputConfig": {
+      "description": "Configuration for a provisioned-throughput foundation-model destination.\nReferences a pre-existing Model Serving endpoint that serves the model;\nsizing (provisioned throughput, burst scaling, model version) is owned by\nthe Model Serving endpoint itself, not by this message.",
+      "fields": {
+        "model": {
+          "description": "UC model FQN of the model served by the backing endpoint (e.g.,\n`system.ai.databricks-claude-opus-4-6`). Resolved from Model Serving at\nCreate/Update time.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "model_serving_endpoint": {
+          "description": "Name of the backing Model Serving endpoint serving the provisioned-\nthroughput foundation model, in the form `serving-endpoints/{name}`. The\nsame Unity Catalog model can be served on multiple Model Serving endpoints\nwith different throughput, regions, or configurations. The caller selects\nthe endpoint to which this destination routes. The endpoint must exist at\ncreate time.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ModelServiceConfigRoutingConfig": {
+      "description": "Routing configuration for a model service, nesting destinations and\nfallback under a single sub-message.",
+      "fields": {
+        "destinations": {
+          "description": "Primary routing destinations. At most 10 are allowed. At least one is\nrequired on Create. On Update, provide this list when replacing the full\n`config` or updating `config.routing.destinations`; other granular routing\nupdates do not require resending destinations. The intermediate\n`config.routing` mask path is not supported.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "fallback": {
+          "description": "Fallback routing applied after a primary destination fails. Fallback\ndestinations are tried in the listed order.",
+          "ref": "catalog.ModelServiceConfigFallbackConfig",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.ModelVersionInfo": {
+      "fields": {
+        "aliases": {
+          "description": "List of aliases associated with the model version",
+          "launch_stage": "GA"
+        },
+        "catalog_name": {
+          "description": "The name of the catalog containing the model version",
+          "launch_stage": "GA"
+        },
+        "comment": {
+          "description": "The comment attached to the model version",
+          "launch_stage": "GA"
+        },
+        "created_at": {
+          "launch_stage": "GA"
+        },
+        "created_by": {
+          "description": "The identifier of the user who created the model version",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "The unique identifier of the model version",
+          "launch_stage": "GA"
+        },
+        "metastore_id": {
+          "description": "The unique identifier of the metastore containing the model version",
+          "launch_stage": "GA"
+        },
+        "model_name": {
+          "description": "The name of the parent registered model of the model version, relative to parent schema",
+          "launch_stage": "GA"
+        },
+        "model_version_dependencies": {
+          "description": "Model version dependencies, for feature-store packaged models",
+          "ref": "catalog.DependencyList",
+          "launch_stage": "GA"
+        },
+        "run_id": {
+          "description": "MLflow run ID used when creating the model version, if ``source`` was generated by an\nexperiment run stored in an MLflow tracking server",
+          "launch_stage": "GA"
+        },
+        "run_workspace_id": {
+          "description": "ID of the Databricks workspace containing the MLflow run that generated this model\nversion, if applicable",
+          "launch_stage": "GA"
+        },
+        "schema_name": {
+          "description": "The name of the schema containing the model version, relative to parent catalog",
+          "launch_stage": "GA"
+        },
+        "source": {
+          "description": "URI indicating the location of the source artifacts (files) for the model version",
+          "launch_stage": "GA"
+        },
+        "status": {
+          "description": "Current status of the model version. Newly created model versions start in\nPENDING_REGISTRATION status, then move to READY status once the model version files are uploaded and\nthe model version is finalized. Only model versions in READY status can be loaded for inference or\nserved.",
+          "ref": "catalog.ModelVersionInfoStatus",
+          "launch_stage": "GA"
+        },
+        "storage_location": {
+          "description": "The storage location on the cloud under which model version data files are stored",
+          "launch_stage": "GA"
+        },
+        "updated_at": {
+          "launch_stage": "GA"
+        },
+        "updated_by": {
+          "description": "The identifier of the user who updated the model version last time",
+          "launch_stage": "GA"
+        },
+        "version": {
+          "description": "Integer model version number, used to reference the model version in API requests.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ModelVersionInfoStatus": {
+      "enum": [
+        "MODEL_VERSION_STATUS_UNKNOWN",
+        "PENDING_REGISTRATION",
+        "FAILED_REGISTRATION",
+        "READY"
+      ],
+      "enum_launch_stages": {
+        "FAILED_REGISTRATION": "GA",
+        "MODEL_VERSION_STATUS_UNKNOWN": "GA",
+        "PENDING_REGISTRATION": "GA",
+        "READY": "GA"
+      }
+    },
+    "catalog.MonitorCronSchedule": {
+      "fields": {
+        "pause_status": {
+          "description": "Read only field that indicates whether a schedule is paused or not.",
+          "ref": "catalog.MonitorCronSchedulePauseStatus",
+          "launch_stage": "GA"
+        },
+        "quartz_cron_expression": {
+          "description": "The expression that determines when to run the monitor. See [examples](https://www.quartz-scheduler.org/documentation/quartz-2.3.0/tutorials/crontrigger.html).",
+          "launch_stage": "GA"
+        },
+        "timezone_id": {
+          "description": "The timezone id (e.g., ``PST``) in which to evaluate the quartz expression.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.MonitorCronSchedulePauseStatus": {
+      "description": "Source link: https://src.dev.databricks.com/databricks/universe/-/blob/elastic-spark-common/api/messages/schedule.proto\nMonitoring workflow schedule pause status.",
+      "enum": [
+        "UNSPECIFIED",
+        "UNPAUSED",
+        "PAUSED"
+      ],
+      "enum_launch_stages": {
+        "PAUSED": "GA",
+        "UNPAUSED": "GA",
+        "UNSPECIFIED": "GA"
+      }
+    },
+    "catalog.MonitorDataClassificationConfig": {
+      "description": "Data classification related configuration.",
+      "fields": {
+        "enabled": {
+          "description": "Whether to enable data classification.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "catalog.MonitorDestination": {
+      "fields": {
+        "email_addresses": {
+          "description": "The list of email addresses to send the notification to. A maximum of 5 email addresses is supported.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.MonitorInferenceLog": {
+      "fields": {
+        "granularities": {
+          "description": "List of granularities to use when aggregating data into time windows based on their timestamp.",
+          "launch_stage": "GA"
+        },
+        "label_col": {
+          "description": "Column for the label.",
+          "launch_stage": "GA"
+        },
+        "model_id_col": {
+          "description": "Column for the model identifier.",
+          "launch_stage": "GA"
+        },
+        "prediction_col": {
+          "description": "Column for the prediction.",
+          "launch_stage": "GA"
+        },
+        "prediction_proba_col": {
+          "description": "Column for prediction probabilities",
+          "launch_stage": "GA"
+        },
+        "problem_type": {
+          "description": "Problem type the model aims to solve.",
+          "ref": "catalog.MonitorInferenceLogProblemType",
+          "launch_stage": "GA"
+        },
+        "timestamp_col": {
+          "description": "Column for the timestamp.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.MonitorInferenceLogProblemType": {
+      "enum": [
+        "PROBLEM_TYPE_CLASSIFICATION",
+        "PROBLEM_TYPE_REGRESSION"
+      ],
+      "enum_launch_stages": {
+        "PROBLEM_TYPE_CLASSIFICATION": "GA",
+        "PROBLEM_TYPE_REGRESSION": "GA"
+      }
+    },
+    "catalog.MonitorInfo": {
+      "fields": {
+        "assets_dir": {
+          "description": "[Create:REQ Update:IGN] Field for specifying the absolute path to a custom directory to store data-monitoring\nassets. Normally prepopulated to a default user location via UI and Python APIs.",
+          "launch_stage": "GA"
+        },
+        "baseline_table_name": {
+          "description": "[Create:OPT Update:OPT] Baseline table name.\nBaseline data is used to compute drift from the data in the monitored `table_name`.\nThe baseline table and the monitored table shall have the same schema.",
+          "launch_stage": "GA"
+        },
+        "custom_metrics": {
+          "description": "[Create:OPT Update:OPT] Custom metrics.",
+          "launch_stage": "GA"
+        },
+        "dashboard_id": {
+          "description": "[Create:ERR Update:OPT] Id of dashboard that visualizes the computed metrics.\nThis can be empty if the monitor is in PENDING state.",
+          "launch_stage": "GA"
+        },
+        "data_classification_config": {
+          "description": "[Create:OPT Update:OPT] Data classification related config.",
+          "ref": "catalog.MonitorDataClassificationConfig",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "drift_metrics_table_name": {
+          "description": "[Create:ERR Update:IGN] Table that stores drift metrics data. Format: `catalog.schema.table_name`.",
+          "launch_stage": "GA"
+        },
+        "inference_log": {
+          "ref": "catalog.MonitorInferenceLog",
+          "launch_stage": "GA"
+        },
+        "latest_monitor_failure_msg": {
+          "description": "[Create:ERR Update:IGN] The latest error message for a monitor failure.",
+          "launch_stage": "GA"
+        },
+        "monitor_version": {
+          "description": "[Create:ERR Update:IGN] Represents the current monitor configuration version in use. The version will be represented in a\nnumeric fashion (1,2,3...). The field has flexibility to take on negative values, which can indicate corrupted\nmonitor_version numbers.",
+          "launch_stage": "GA"
+        },
+        "notifications": {
+          "description": "[Create:OPT Update:OPT] Field for specifying notification settings.",
+          "ref": "catalog.MonitorNotifications",
+          "launch_stage": "GA"
+        },
+        "output_schema_name": {
+          "description": "[Create:REQ Update:REQ] Schema where output tables are created. Needs to be in 2-level format {catalog}.{schema}",
+          "launch_stage": "GA"
+        },
+        "profile_metrics_table_name": {
+          "description": "[Create:ERR Update:IGN] Table that stores profile metrics data. Format: `catalog.schema.table_name`.",
+          "launch_stage": "GA"
+        },
+        "schedule": {
+          "description": "[Create:OPT Update:OPT] The monitor schedule.",
+          "ref": "catalog.MonitorCronSchedule",
+          "launch_stage": "GA"
+        },
+        "slicing_exprs": {
+          "description": "[Create:OPT Update:OPT] List of column expressions to slice data with for targeted analysis. The data is grouped by\neach expression independently, resulting in a separate slice for each predicate and its\ncomplements. For example `slicing_exprs=[“col_1”, “col_2 \u003e 10”]` will generate the following\nslices: two slices for `col_2 \u003e 10` (True and False), and one slice per unique value in\n`col1`. For high-cardinality columns, only the top 100 unique values by frequency will\ngenerate slices.",
+          "launch_stage": "GA"
+        },
+        "snapshot": {
+          "description": "Configuration for monitoring snapshot tables.",
+          "ref": "catalog.MonitorSnapshot",
+          "launch_stage": "GA"
+        },
+        "status": {
+          "description": "[Create:ERR Update:IGN] The monitor status.",
+          "ref": "catalog.MonitorInfoStatus",
+          "launch_stage": "GA"
+        },
+        "table_name": {
+          "description": "[Create:ERR Update:IGN] UC table to monitor. Format: `catalog.schema.table_name`",
+          "launch_stage": "GA"
+        },
+        "time_series": {
+          "description": "Configuration for monitoring time series tables.",
+          "ref": "catalog.MonitorTimeSeries",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.MonitorInfoStatus": {
+      "enum": [
+        "MONITOR_STATUS_ACTIVE",
+        "MONITOR_STATUS_PENDING",
+        "MONITOR_STATUS_DELETE_PENDING",
+        "MONITOR_STATUS_ERROR",
+        "MONITOR_STATUS_FAILED"
+      ],
+      "enum_launch_stages": {
+        "MONITOR_STATUS_ACTIVE": "GA",
+        "MONITOR_STATUS_DELETE_PENDING": "GA",
+        "MONITOR_STATUS_ERROR": "GA",
+        "MONITOR_STATUS_FAILED": "GA",
+        "MONITOR_STATUS_PENDING": "GA"
+      }
+    },
+    "catalog.MonitorMetric": {
+      "description": "Custom metric definition.",
+      "fields": {
+        "definition": {
+          "description": "Jinja template for a SQL expression that specifies how to compute the metric. See [create metric definition](https://docs.databricks.com/en/lakehouse-monitoring/custom-metrics.html#create-definition).",
+          "launch_stage": "GA"
+        },
+        "input_columns": {
+          "description": "A list of column names in the input table the metric should be computed for.\nCan use ``\":table\"`` to indicate that the metric needs information from multiple columns.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of the metric in the output tables.",
+          "launch_stage": "GA"
+        },
+        "output_data_type": {
+          "description": "The output type of the custom metric.",
+          "launch_stage": "GA"
+        },
+        "type": {
+          "description": "Can only be one of ``\"CUSTOM_METRIC_TYPE_AGGREGATE\"``, ``\"CUSTOM_METRIC_TYPE_DERIVED\"``, or ``\"CUSTOM_METRIC_TYPE_DRIFT\"``.\nThe ``\"CUSTOM_METRIC_TYPE_AGGREGATE\"`` and ``\"CUSTOM_METRIC_TYPE_DERIVED\"`` metrics\nare computed on a single table, whereas the ``\"CUSTOM_METRIC_TYPE_DRIFT\"`` compare metrics across\nbaseline and input table, or across the two consecutive time windows.\n- CUSTOM_METRIC_TYPE_AGGREGATE: only depend on the existing columns in your table\n- CUSTOM_METRIC_TYPE_DERIVED: depend on previously computed aggregate metrics\n- CUSTOM_METRIC_TYPE_DRIFT:  depend on previously computed aggregate or derived metrics",
+          "ref": "catalog.MonitorMetricType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.MonitorMetricType": {
+      "description": "Can only be one of ``\\\"CUSTOM_METRIC_TYPE_AGGREGATE\\\"``, ``\\\"CUSTOM_METRIC_TYPE_DERIVED\\\"``, or ``\\\"CUSTOM_METRIC_TYPE_DRIFT\\\"``.\nThe ``\\\"CUSTOM_METRIC_TYPE_AGGREGATE\\\"`` and ``\\\"CUSTOM_METRIC_TYPE_DERIVED\\\"`` metrics\nare computed on a single table, whereas the ``\\\"CUSTOM_METRIC_TYPE_DRIFT\\\"`` compare metrics across\nbaseline and input table, or across the two consecutive time windows.\n- CUSTOM_METRIC_TYPE_AGGREGATE: only depend on the existing columns in your table\n- CUSTOM_METRIC_TYPE_DERIVED: depend on previously computed aggregate metrics\n- CUSTOM_METRIC_TYPE_DRIFT:  depend on previously computed aggregate or derived metrics",
+      "enum": [
+        "CUSTOM_METRIC_TYPE_AGGREGATE",
+        "CUSTOM_METRIC_TYPE_DERIVED",
+        "CUSTOM_METRIC_TYPE_DRIFT"
+      ],
+      "enum_launch_stages": {
+        "CUSTOM_METRIC_TYPE_AGGREGATE": "GA",
+        "CUSTOM_METRIC_TYPE_DERIVED": "GA",
+        "CUSTOM_METRIC_TYPE_DRIFT": "GA"
+      }
+    },
+    "catalog.MonitorNotifications": {
+      "fields": {
+        "on_failure": {
+          "description": "Destinations to send notifications on failure/timeout.",
+          "ref": "catalog.MonitorDestination",
+          "launch_stage": "GA"
+        },
+        "on_new_classification_tag_detected": {
+          "description": "Destinations to send notifications on new classification tag detected.",
+          "ref": "catalog.MonitorDestination",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "catalog.MonitorRefreshInfo": {
+      "fields": {
+        "end_time_ms": {
+          "description": "Time at which refresh operation completed (milliseconds since 1/1/1970 UTC).",
+          "launch_stage": "GA"
+        },
+        "message": {
+          "description": "An optional message to give insight into the current state of the job (e.g. FAILURE messages).",
+          "launch_stage": "GA"
+        },
+        "refresh_id": {
+          "description": "Unique id of the refresh operation.",
+          "launch_stage": "GA"
+        },
+        "start_time_ms": {
+          "description": "Time at which refresh operation was initiated (milliseconds since 1/1/1970 UTC).",
+          "launch_stage": "GA"
+        },
+        "state": {
+          "description": "The current state of the refresh.",
+          "ref": "catalog.MonitorRefreshInfoState",
+          "launch_stage": "GA"
+        },
+        "trigger": {
+          "description": "The method by which the refresh was triggered.",
+          "ref": "catalog.MonitorRefreshInfoTrigger",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.MonitorRefreshInfoState": {
+      "description": "The current state of the refresh.",
+      "enum": [
+        "UNKNOWN",
+        "PENDING",
+        "RUNNING",
+        "SUCCESS",
+        "FAILED",
+        "CANCELED"
+      ],
+      "enum_launch_stages": {
+        "CANCELED": "GA",
+        "FAILED": "GA",
+        "PENDING": "GA",
+        "RUNNING": "GA",
+        "SUCCESS": "GA",
+        "UNKNOWN": "GA"
+      }
+    },
+    "catalog.MonitorRefreshInfoTrigger": {
+      "enum": [
+        "UNKNOWN_TRIGGER",
+        "SCHEDULE",
+        "MANUAL"
+      ],
+      "enum_launch_stages": {
+        "MANUAL": "GA",
+        "SCHEDULE": "GA",
+        "UNKNOWN_TRIGGER": "GA"
+      }
+    },
+    "catalog.MonitorRefreshListResponse": {
+      "fields": {
+        "refreshes": {
+          "description": "List of refreshes.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.MonitorSnapshot": {
+      "description": "Snapshot analysis configuration"
+    },
+    "catalog.MonitorTimeSeries": {
+      "description": "Time series analysis configuration.",
+      "fields": {
+        "granularities": {
+          "description": "Granularities for aggregating data into time windows based on their timestamp. Currently the following static\ngranularities are supported:\n{``\\\"5 minutes\\\"``, ``\\\"30 minutes\\\"``, ``\\\"1 hour\\\"``, ``\\\"1 day\\\"``, ``\\\"\\u003cn\\u003e week(s)\\\"``, ``\\\"1 month\\\"``, ``\\\"1 year\\\"``}.",
+          "launch_stage": "GA"
+        },
+        "timestamp_col": {
+          "description": "Column for the timestamp.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.NamedTableConstraint": {
+      "fields": {
+        "name": {
+          "description": "The name of the constraint.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.NotificationDestination": {
+      "fields": {
+        "destination_id": {
+          "description": "The identifier for the destination. This is the email address for EMAIL destinations, the URL for URL destinations,\nor the unique Databricks notification destination ID for all other external destinations.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "destination_type": {
+          "description": "The type of the destination.",
+          "ref": "catalog.DestinationType",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "special_destination": {
+          "description": "This field is used to denote whether the destination is the email of the owner of the securable object.\nThe special destination cannot be assigned to a securable and only represents the default destination of the securable.\nThe securable types that support default special destinations are: \"catalog\", \"external_location\", \"connection\", \"credential\", and \"metastore\".\nThe **destination_type** of a **special_destination** is always EMAIL.",
+          "ref": "catalog.SpecialDestination",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.OnlineTable": {
+      "description": "Online Table information.",
+      "fields": {
+        "name": {
+          "description": "Full three-part (catalog, schema, table) name of the table.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "spec": {
+          "description": "Specification of the online table.",
+          "ref": "catalog.OnlineTableSpec",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "status": {
+          "description": "Online Table data synchronization status",
+          "ref": "catalog.OnlineTableStatus",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "table_serving_url": {
+          "description": "Data serving REST API URL for this table",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "unity_catalog_provisioning_state": {
+          "description": "The provisioning state of the online table entity in Unity Catalog. This is distinct from the\nstate of the data synchronization pipeline (i.e. the table may be in \"ACTIVE\" but the pipeline\nmay be in \"PROVISIONING\" as it runs asynchronously).",
+          "ref": "catalog.ProvisioningInfoState",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "catalog.OnlineTableSpec": {
+      "description": "Specification of an online table.",
+      "fields": {
+        "perform_full_copy": {
+          "description": "Whether to create a full-copy pipeline -- a pipeline that stops after creates a full copy of\nthe source table upon initialization and does not process any change data feeds (CDFs)\nafterwards. The pipeline can still be manually triggered afterwards, but it always perform a\nfull copy of the source table and there are no incremental updates. This mode is useful for\nsyncing views or tables without CDFs to online tables.\nNote that the full-copy pipeline only supports \"triggered\" scheduling policy.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "pipeline_id": {
+          "description": "ID of the associated pipeline. Generated by the server - cannot be set by the caller.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "primary_key_columns": {
+          "description": "Primary Key columns to be used for data insert/update in the destination.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "run_continuously": {
+          "description": "Pipeline runs continuously after generating the initial data.",
+          "ref": "catalog.OnlineTableSpecContinuousSchedulingPolicy",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "run_triggered": {
+          "description": "Pipeline stops after generating the initial data and can be triggered later (manually, through a cron job or through data triggers)",
+          "ref": "catalog.OnlineTableSpecTriggeredSchedulingPolicy",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "source_table_full_name": {
+          "description": "Three-part (catalog, schema, table) name of the source Delta table.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "timeseries_key": {
+          "description": "Time series key to deduplicate (tie-break) rows with the same primary key.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.OnlineTableSpecContinuousSchedulingPolicy": {},
+    "catalog.OnlineTableSpecTriggeredSchedulingPolicy": {},
+    "catalog.OnlineTableState": {
+      "description": "The state of an online table.",
+      "enum": [
+        "PROVISIONING",
+        "PROVISIONING_PIPELINE_RESOURCES",
+        "PROVISIONING_INITIAL_SNAPSHOT",
+        "ONLINE",
+        "ONLINE_CONTINUOUS_UPDATE",
+        "ONLINE_TRIGGERED_UPDATE",
+        "ONLINE_NO_PENDING_UPDATE",
+        "OFFLINE",
+        "OFFLINE_FAILED",
+        "ONLINE_PIPELINE_FAILED",
+        "ONLINE_UPDATING_PIPELINE_RESOURCES"
+      ],
+      "enum_launch_stages": {
+        "OFFLINE": "PUBLIC_PREVIEW",
+        "OFFLINE_FAILED": "PUBLIC_PREVIEW",
+        "ONLINE": "PUBLIC_PREVIEW",
+        "ONLINE_CONTINUOUS_UPDATE": "PUBLIC_PREVIEW",
+        "ONLINE_NO_PENDING_UPDATE": "PUBLIC_PREVIEW",
+        "ONLINE_PIPELINE_FAILED": "PUBLIC_PREVIEW",
+        "ONLINE_TRIGGERED_UPDATE": "PUBLIC_PREVIEW",
+        "ONLINE_UPDATING_PIPELINE_RESOURCES": "PUBLIC_PREVIEW",
+        "PROVISIONING": "PUBLIC_PREVIEW",
+        "PROVISIONING_INITIAL_SNAPSHOT": "PUBLIC_PREVIEW",
+        "PROVISIONING_PIPELINE_RESOURCES": "PUBLIC_PREVIEW"
+      }
+    },
+    "catalog.OnlineTableStatus": {
+      "description": "Status of an online table.",
+      "fields": {
+        "continuous_update_status": {
+          "ref": "catalog.ContinuousUpdateStatus",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "detailed_state": {
+          "description": "The state of the online table.",
+          "ref": "catalog.OnlineTableState",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "failed_status": {
+          "ref": "catalog.FailedStatus",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "message": {
+          "description": "A text description of the current state of the online table.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "provisioning_status": {
+          "ref": "catalog.ProvisioningStatus",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "triggered_update_status": {
+          "ref": "catalog.TriggeredUpdateStatus",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.OptionSpec": {
+      "description": "Spec of an allowed option on a securable kind and its attributes.\nThis is mostly used by UI to provide user friendly hints and descriptions\nin order to facilitate the securable creation process.",
+      "fields": {
+        "allowed_values": {
+          "description": "For drop down / radio button selections, UI will want to know the possible\ninput values, it can also be used by other option types to limit input selections.",
+          "launch_stage": "GA"
+        },
+        "default_value": {
+          "description": "The default value of the option, for example, value '443' for 'port' option.",
+          "launch_stage": "GA"
+        },
+        "description": {
+          "description": "A concise user facing description of what the input value of this option should look like.",
+          "launch_stage": "GA"
+        },
+        "hint": {
+          "description": "The hint is used on the UI to suggest what the input value\ncan possibly be like, for example: example.com for 'host' option.\nUnlike default value, it will not be applied automatically without user input.",
+          "launch_stage": "GA"
+        },
+        "is_copiable": {
+          "description": "Indicates whether an option should be displayed with copy button on the UI.",
+          "launch_stage": "GA"
+        },
+        "is_creatable": {
+          "description": "Indicates whether an option can be provided by users in the create/update path of an entity.",
+          "launch_stage": "GA"
+        },
+        "is_hidden": {
+          "description": "Is the option value not user settable and is thus not shown on the UI.",
+          "launch_stage": "GA"
+        },
+        "is_loggable": {
+          "description": "Specifies whether this option is safe to log, i.e. no sensitive information.",
+          "launch_stage": "GA"
+        },
+        "is_required": {
+          "description": "Is the option required.",
+          "launch_stage": "GA"
+        },
+        "is_secret": {
+          "description": "Is the option value considered secret and thus redacted on the UI.",
+          "launch_stage": "GA"
+        },
+        "is_updatable": {
+          "description": "Is the option updatable by users.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The unique name of the option.",
+          "launch_stage": "GA"
+        },
+        "oauth_stage": {
+          "description": "Specifies when the option value is displayed on the UI within the OAuth flow.",
+          "ref": "catalog.OptionSpecOauthStage",
+          "launch_stage": "GA"
+        },
+        "type": {
+          "description": "The type of the option.",
+          "ref": "catalog.OptionSpecOptionType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.OptionSpecOauthStage": {
+      "description": "During the OAuth flow, specifies which stage the option should be displayed in the UI.\nOAUTH_STAGE_UNSPECIFIED is the default value for options unrelated to the OAuth flow.\nBEFORE_AUTHORIZATION_CODE corresponds to options necessary to initiate the OAuth process.\nBEFORE_ACCESS_TOKEN corresponds to options that are necessary to create a foreign connection,\nbut that should be displayed after the authorization code has already been received.",
+      "enum": [
+        "BEFORE_AUTHORIZATION_CODE",
+        "BEFORE_ACCESS_TOKEN"
+      ],
+      "enum_launch_stages": {
+        "BEFORE_ACCESS_TOKEN": "GA",
+        "BEFORE_AUTHORIZATION_CODE": "GA"
+      }
+    },
+    "catalog.OptionSpecOptionType": {
+      "description": "Type of the option, we purposely follow JavaScript types so that\nthe UI can map the options to JS types.\nhttps://www.w3schools.com/js/js_datatypes.asp\nEnum is a special case that it's just string with selections.",
+      "enum": [
+        "OPTION_BOOLEAN",
+        "OPTION_NUMBER",
+        "OPTION_BIGINT",
+        "OPTION_STRING",
+        "OPTION_ENUM",
+        "OPTION_SERVICE_CREDENTIAL",
+        "OPTION_MULTILINE_STRING"
+      ],
+      "enum_launch_stages": {
+        "OPTION_BIGINT": "GA",
+        "OPTION_BOOLEAN": "GA",
+        "OPTION_ENUM": "GA",
+        "OPTION_MULTILINE_STRING": "GA",
+        "OPTION_NUMBER": "GA",
+        "OPTION_SERVICE_CREDENTIAL": "GA",
+        "OPTION_STRING": "GA"
+      }
+    },
+    "catalog.PathOperation": {
+      "enum": [
+        "PATH_READ",
+        "PATH_READ_WRITE",
+        "PATH_CREATE_TABLE"
+      ],
+      "enum_launch_stages": {
+        "PATH_CREATE_TABLE": "GA",
+        "PATH_READ": "GA",
+        "PATH_READ_WRITE": "GA"
+      }
+    },
+    "catalog.PermissionsChange": {
+      "fields": {
+        "add": {
+          "description": "The set of privileges to add.",
+          "launch_stage": "GA"
+        },
+        "principal": {
+          "description": "The principal whose privileges we are changing.\nOnly one of principal or principal_id should be specified, never both at the same time.",
+          "launch_stage": "GA"
+        },
+        "remove": {
+          "description": "The set of privileges to remove.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.PipelineProgress": {
+      "description": "Progress information of the Online Table data synchronization pipeline.",
+      "fields": {
+        "estimated_completion_time_seconds": {
+          "description": "The estimated time remaining to complete this update in seconds.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "latest_version_currently_processing": {
+          "description": "The source table Delta version that was last processed by the pipeline. The pipeline may not\nhave completely processed this version yet.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "sync_progress_completion": {
+          "description": "The completion ratio of this update. This is a number between 0 and 1.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "synced_row_count": {
+          "description": "The number of rows that have been synced in this update.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "total_row_count": {
+          "description": "The total number of rows that need to be synced in this update. This number may be an estimate.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.PolicyFunctionArgument": {
+      "description": "A positional argument passed to a row filter or column mask function.\nDistinguishes between column references and literals.",
+      "fields": {
+        "column": {
+          "description": "A column reference.",
+          "launch_stage": "GA"
+        },
+        "constant": {
+          "description": "A constant literal.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.PolicyInfo": {
+      "fields": {
+        "column_mask": {
+          "description": "Options for column mask policies. Valid only if `policy_type` is `POLICY_TYPE_COLUMN_MASK`.\nRequired on create and optional on update. When specified on update,\nthe new options will replace the existing options as a whole.",
+          "ref": "catalog.ColumnMaskOptions",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "comment": {
+          "description": "Optional description of the policy.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "created_at": {
+          "description": "Time at which the policy was created, in epoch milliseconds. Output only.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "created_by": {
+          "description": "Username of the user who created the policy. Output only.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "deny": {
+          "description": "Options for deny policies. Valid only if `policy_type` is `POLICY_TYPE_DENY`.\nRequired on create and optional on update. When specified on update,\nthe new options will replace the existing options as a whole.",
+          "ref": "catalog.DenyOptions",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "except_principals": {
+          "description": "Optional list of user or group names that should be excluded from the policy.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "for_securable_type": {
+          "description": "Type of securables that the policy should take effect on.\nRequired on create and optional on update.",
+          "ref": "catalog.SecurableType",
+          "launch_stage": "GA"
+        },
+        "governed_tags": {
+          "description": "Governed tag keys and values referenced by this policy's conditions and function arguments. Output only.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "grant": {
+          "description": "Options for grant policies. Valid only if `policy_type` is `POLICY_TYPE_GRANT`.\nRequired on create and optional on update. When specified on update,\nthe new options will replace the existing options as a whole.",
+          "ref": "catalog.GrantOptions",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "id": {
+          "description": "Unique identifier of the policy. This field is output only and is generated by the system.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "match_columns": {
+          "description": "Optional list of condition expressions used to match table columns.\nOnly valid when `for_securable_type` is `TABLE`.\nWhen specified, the policy only applies to tables whose columns satisfy all match conditions.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "name": {
+          "description": "Name of the policy. Required on create and optional on update.\nTo rename the policy, set `name` to a different value on update.",
+          "launch_stage": "GA"
+        },
+        "on_securable_fullname": {
+          "description": "Full name of the securable on which the policy is defined.\nRequired on create.",
+          "launch_stage": "GA"
+        },
+        "on_securable_type": {
+          "description": "Type of the securable on which the policy is defined.\nOnly `CATALOG`, `SCHEMA` and `TABLE` are supported at this moment.\nRequired on create.",
+          "ref": "catalog.SecurableType",
+          "launch_stage": "GA"
+        },
+        "policy_type": {
+          "description": "Type of the policy. Required on create.",
+          "ref": "catalog.PolicyType",
+          "launch_stage": "GA"
+        },
+        "row_filter": {
+          "description": "Options for row filter policies. Valid only if `policy_type` is `POLICY_TYPE_ROW_FILTER`.\nRequired on create and optional on update. When specified on update,\nthe new options will replace the existing options as a whole.",
+          "ref": "catalog.RowFilterOptions",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "to_principals": {
+          "description": "List of user or group names that the policy applies to.\nRequired on create and optional on update.",
+          "launch_stage": "GA"
+        },
+        "updated_at": {
+          "description": "Time at which the policy was last modified, in epoch milliseconds. Output only.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "updated_by": {
+          "description": "Username of the user who last modified the policy. Output only.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "when_condition": {
+          "description": "Optional condition when the policy should take effect.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.PolicyType": {
+      "enum": [
+        "POLICY_TYPE_ROW_FILTER",
+        "POLICY_TYPE_COLUMN_MASK",
+        "POLICY_TYPE_DENY",
+        "POLICY_TYPE_GRANT"
+      ],
+      "enum_launch_stages": {
+        "POLICY_TYPE_COLUMN_MASK": "GA",
+        "POLICY_TYPE_DENY": "GA",
+        "POLICY_TYPE_GRANT": "GA",
+        "POLICY_TYPE_ROW_FILTER": "GA"
+      }
+    },
+    "catalog.PrimaryKeyConstraint": {
+      "fields": {
+        "child_columns": {
+          "description": "Column names for this constraint.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The name of the constraint.",
+          "launch_stage": "GA"
+        },
+        "rely": {
+          "description": "True if the constraint is RELY, false or unset if NORELY.",
+          "launch_stage": "GA"
+        },
+        "timeseries_columns": {
+          "description": "Column names that represent a timeseries.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.Principal": {
+      "fields": {
+        "id": {
+          "description": "Databricks user, group or service principal ID.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "principal_type": {
+          "ref": "catalog.PrincipalType",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.PrincipalType": {
+      "enum": [
+        "USER_PRINCIPAL",
+        "GROUP_PRINCIPAL",
+        "SERVICE_PRINCIPAL"
+      ],
+      "enum_launch_stages": {
+        "GROUP_PRINCIPAL": "PUBLIC_PREVIEW",
+        "SERVICE_PRINCIPAL": "PUBLIC_PREVIEW",
+        "USER_PRINCIPAL": "PUBLIC_PREVIEW"
+      }
+    },
+    "catalog.Privilege": {
+      "enum": [
+        "SELECT",
+        "READ_PRIVATE_FILES",
+        "WRITE_PRIVATE_FILES",
+        "CREATE",
+        "USAGE",
+        "USE_CATALOG",
+        "USE_SCHEMA",
+        "CREATE_SCHEMA",
+        "CREATE_VIEW",
+        "CREATE_EXTERNAL_TABLE",
+        "CREATE_MATERIALIZED_VIEW",
+        "CREATE_FUNCTION",
+        "CREATE_MODEL",
+        "CREATE_CATALOG",
+        "CREATE_MANAGED_STORAGE",
+        "CREATE_EXTERNAL_LOCATION",
+        "CREATE_STORAGE_CREDENTIAL",
+        "CREATE_SERVICE_CREDENTIAL",
+        "ACCESS",
+        "CREATE_SHARE",
+        "CREATE_RECIPIENT",
+        "CREATE_PROVIDER",
+        "USE_SHARE",
+        "USE_RECIPIENT",
+        "USE_PROVIDER",
+        "USE_MARKETPLACE_ASSETS",
+        "SET_SHARE_PERMISSION",
+        "MODIFY",
+        "REFRESH",
+        "EXECUTE",
+        "READ_FILES",
+        "WRITE_FILES",
+        "CREATE_TABLE",
+        "ALL_PRIVILEGES",
+        "CREATE_CONNECTION",
+        "USE_CONNECTION",
+        "APPLY_TAG",
+        "CREATE_FOREIGN_CATALOG",
+        "CREATE_FOREIGN_SECURABLE",
+        "MANAGE_ALLOWLIST",
+        "CREATE_VOLUME",
+        "CREATE_EXTERNAL_VOLUME",
+        "READ_VOLUME",
+        "WRITE_VOLUME",
+        "MANAGE",
+        "BROWSE",
+        "CREATE_CLEAN_ROOM",
+        "MODIFY_CLEAN_ROOM",
+        "EXECUTE_CLEAN_ROOM_TASK",
+        "EXTERNAL_USE_SCHEMA",
+        "READ_METADATA",
+        "EXTERNAL_USE_LOCATION"
+      ],
+      "enum_launch_stages": {
+        "ACCESS": "GA",
+        "ALL_PRIVILEGES": "GA",
+        "APPLY_TAG": "GA",
+        "BROWSE": "GA",
+        "CREATE": "GA",
+        "CREATE_CATALOG": "GA",
+        "CREATE_CLEAN_ROOM": "GA",
+        "CREATE_CONNECTION": "GA",
+        "CREATE_EXTERNAL_LOCATION": "GA",
+        "CREATE_EXTERNAL_TABLE": "GA",
+        "CREATE_EXTERNAL_VOLUME": "GA",
+        "CREATE_FOREIGN_CATALOG": "GA",
+        "CREATE_FOREIGN_SECURABLE": "GA",
+        "CREATE_FUNCTION": "GA",
+        "CREATE_MANAGED_STORAGE": "GA",
+        "CREATE_MATERIALIZED_VIEW": "GA",
+        "CREATE_MODEL": "GA",
+        "CREATE_PROVIDER": "GA",
+        "CREATE_RECIPIENT": "GA",
+        "CREATE_SCHEMA": "GA",
+        "CREATE_SERVICE_CREDENTIAL": "GA",
+        "CREATE_SHARE": "GA",
+        "CREATE_STORAGE_CREDENTIAL": "GA",
+        "CREATE_TABLE": "GA",
+        "CREATE_VIEW": "GA",
+        "CREATE_VOLUME": "GA",
+        "EXECUTE": "GA",
+        "EXECUTE_CLEAN_ROOM_TASK": "GA",
+        "EXTERNAL_USE_LOCATION": "PUBLIC_PREVIEW",
+        "EXTERNAL_USE_SCHEMA": "GA",
+        "MANAGE": "GA",
+        "MANAGE_ALLOWLIST": "GA",
+        "MODIFY": "GA",
+        "MODIFY_CLEAN_ROOM": "GA",
+        "READ_FILES": "GA",
+        "READ_METADATA": "GA",
+        "READ_PRIVATE_FILES": "GA",
+        "READ_VOLUME": "GA",
+        "REFRESH": "GA",
+        "SELECT": "GA",
+        "SET_SHARE_PERMISSION": "GA",
+        "USAGE": "GA",
+        "USE_CATALOG": "GA",
+        "USE_CONNECTION": "GA",
+        "USE_MARKETPLACE_ASSETS": "GA",
+        "USE_PROVIDER": "GA",
+        "USE_RECIPIENT": "GA",
+        "USE_SCHEMA": "GA",
+        "USE_SHARE": "GA",
+        "WRITE_FILES": "GA",
+        "WRITE_PRIVATE_FILES": "GA",
+        "WRITE_VOLUME": "GA"
+      }
+    },
+    "catalog.PrivilegeAssignment": {
+      "fields": {
+        "principal": {
+          "description": "The principal (user email address or group name).\nFor deleted principals, `principal` is empty while `principal_id` is populated.",
+          "launch_stage": "GA"
+        },
+        "privileges": {
+          "description": "The privileges assigned to the principal.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ProvisioningInfo": {
+      "description": "Status of an asynchronously provisioned resource.",
+      "fields": {
+        "state": {
+          "description": "The provisioning state of the resource.",
+          "ref": "catalog.ProvisioningInfoState",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ProvisioningInfoState": {
+      "enum": [
+        "PROVISIONING",
+        "ACTIVE",
+        "FAILED",
+        "DELETING",
+        "UPDATING",
+        "DEGRADED"
+      ],
+      "enum_launch_stages": {
+        "ACTIVE": "GA",
+        "DEGRADED": "GA",
+        "DELETING": "GA",
+        "FAILED": "GA",
+        "PROVISIONING": "GA",
+        "UPDATING": "GA"
+      }
+    },
+    "catalog.ProvisioningStatus": {
+      "description": "Detailed status of an online table. Shown if the online table is in the\nPROVISIONING_PIPELINE_RESOURCES or the PROVISIONING_INITIAL_SNAPSHOT state.",
+      "fields": {
+        "initial_pipeline_sync_progress": {
+          "description": "Details about initial data synchronization. Only populated when in the\nPROVISIONING_INITIAL_SNAPSHOT state.",
+          "ref": "catalog.PipelineProgress",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.QuotaInfo": {
+      "fields": {
+        "last_refreshed_at": {
+          "description": "The timestamp that indicates when the quota count was last updated.",
+          "launch_stage": "GA"
+        },
+        "parent_full_name": {
+          "description": "Name of the parent resource. Returns metastore ID if the parent is a metastore.",
+          "launch_stage": "GA"
+        },
+        "parent_securable_type": {
+          "description": "The quota parent securable type.",
+          "ref": "catalog.SecurableType",
+          "launch_stage": "GA"
+        },
+        "quota_count": {
+          "description": "The current usage of the resource quota.",
+          "launch_stage": "GA"
+        },
+        "quota_limit": {
+          "description": "The current limit of the resource quota.",
+          "launch_stage": "GA"
+        },
+        "quota_name": {
+          "description": "The name of the quota.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.R2Credentials": {
+      "description": "R2 temporary credentials for API authentication.\nRead more at https://developers.cloudflare.com/r2/api/s3/tokens/.",
+      "fields": {
+        "access_key_id": {
+          "description": "The access key ID that identifies the temporary credentials.",
+          "launch_stage": "GA"
+        },
+        "secret_access_key": {
+          "description": "The secret access key associated with the access key.",
+          "launch_stage": "GA"
+        },
+        "session_token": {
+          "description": "The generated JWT that users must pass to use the temporary credentials.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.RateLimit": {
+      "description": "A rate limit applied to service requests. Leave `requests` or `tokens`\nunset to impose no limit on that dimension; set a value to cap that dimension\nwithin the renewal period.",
+      "fields": {
+        "key": {
+          "description": "Scope of the rate limit. Depending on this value, the limit applies to a\nprincipal, the service as a whole, or each user by default.",
+          "ref": "catalog.RateLimitRateLimitKey",
+          "launch_stage": "GA"
+        },
+        "principal": {
+          "description": "Principal this limit applies to: user email, group name, or service\nprincipal application ID. Required when `key` applies to a user, group, or\nservice principal; otherwise it must be unset.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "renewal_period": {
+          "description": "Renewal period.",
+          "ref": "catalog.RateLimitRateLimitRenewalPeriod",
+          "launch_stage": "GA"
+        },
+        "requests": {
+          "description": "Maximum requests allowed in one renewal period. Leave unset for no request\nlimit. Set to `0` to deny all requests.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "tokens": {
+          "description": "Maximum tokens allowed in one renewal period. Leave unset for no token\nlimit. Set to `0` to deny all requests.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.RateLimitRateLimitKey": {
+      "description": "Scope key for a rate limit.",
+      "enum": [
+        "RATE_LIMIT_KEY_USER",
+        "RATE_LIMIT_KEY_USER_GROUP",
+        "RATE_LIMIT_KEY_SERVICE_PRINCIPAL",
+        "RATE_LIMIT_KEY_SERVICE",
+        "RATE_LIMIT_KEY_USER_DEFAULT"
+      ],
+      "enum_launch_stages": {
+        "RATE_LIMIT_KEY_SERVICE": "GA",
+        "RATE_LIMIT_KEY_SERVICE_PRINCIPAL": "GA",
+        "RATE_LIMIT_KEY_USER": "GA",
+        "RATE_LIMIT_KEY_USER_DEFAULT": "GA",
+        "RATE_LIMIT_KEY_USER_GROUP": "GA"
+      }
+    },
+    "catalog.RateLimitRateLimitRenewalPeriod": {
+      "description": "Renewal period for a rate limit.",
+      "enum": [
+        "RATE_LIMIT_RENEWAL_PERIOD_MINUTE",
+        "RATE_LIMIT_RENEWAL_PERIOD_HOUR"
+      ],
+      "enum_launch_stages": {
+        "RATE_LIMIT_RENEWAL_PERIOD_HOUR": "GA",
+        "RATE_LIMIT_RENEWAL_PERIOD_MINUTE": "GA"
+      }
+    },
+    "catalog.ReadVolumeRequest": {
+      "fields": {
+        "include_browse": {
+          "description": "Whether to include volumes in the response for which the principal can only access selective metadata for",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.RegenerateDashboardRequest": {
+      "fields": {
+        "warehouse_id": {
+          "description": "Optional argument to specify the warehouse for dashboard regeneration. If not specified, the first running\nwarehouse will be used.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "catalog.RegenerateDashboardResponse": {
+      "fields": {
+        "dashboard_id": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "parent_folder": {
+          "description": "Parent folder is equivalent to {assets_dir}/{tableName}",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "catalog.RegisteredModelAlias": {
+      "fields": {
+        "alias_name": {
+          "description": "Name of the alias, e.g. 'champion' or 'latest_stable'",
+          "launch_stage": "GA"
+        },
+        "catalog_name": {
+          "description": "The name of the catalog containing the model version",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "The unique identifier of the alias",
+          "launch_stage": "GA"
+        },
+        "model_name": {
+          "description": "The name of the parent registered model of the model version, relative to parent schema",
+          "launch_stage": "GA"
+        },
+        "schema_name": {
+          "description": "The name of the schema containing the model version, relative to parent catalog",
+          "launch_stage": "GA"
+        },
+        "version_num": {
+          "description": "Integer version number of the model version to which this alias points.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.RegisteredModelInfo": {
+      "fields": {
+        "aliases": {
+          "description": "List of aliases associated with the registered model",
+          "launch_stage": "GA"
+        },
+        "browse_only": {
+          "description": "Indicates whether the principal is limited to retrieving metadata for the associated object through the BROWSE privilege when include_browse is enabled in the request.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "catalog_name": {
+          "description": "The name of the catalog where the schema and the registered model reside",
+          "launch_stage": "GA"
+        },
+        "comment": {
+          "description": "The comment attached to the registered model",
+          "launch_stage": "GA"
+        },
+        "created_at": {
+          "description": "Creation timestamp of the registered model in milliseconds since the Unix epoch",
+          "launch_stage": "GA"
+        },
+        "created_by": {
+          "description": "The identifier of the user who created the registered model",
+          "launch_stage": "GA"
+        },
+        "full_name": {
+          "description": "The three-level (fully qualified) name of the registered model",
+          "launch_stage": "GA"
+        },
+        "metastore_id": {
+          "description": "The unique identifier of the metastore",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The name of the registered model",
+          "launch_stage": "GA"
+        },
+        "owner": {
+          "description": "The identifier of the user who owns the registered model",
+          "launch_stage": "GA"
+        },
+        "schema_name": {
+          "description": "The name of the schema where the registered model resides",
+          "launch_stage": "GA"
+        },
+        "storage_location": {
+          "description": "The storage location on the cloud under which model version data files are stored",
+          "launch_stage": "GA"
+        },
+        "updated_at": {
+          "description": "Last-update timestamp of the registered model in milliseconds since the Unix epoch",
+          "launch_stage": "GA"
+        },
+        "updated_by": {
+          "description": "The identifier of the user who updated the registered model last time",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.RowFilterOptions": {
+      "fields": {
+        "function_name": {
+          "description": "The fully qualified name of the row filter function.\nThe function is called on each row of the target table. It should return a boolean value\nindicating whether the row should be visible to the user.\nRequired on create and update.",
+          "launch_stage": "GA"
+        },
+        "using": {
+          "description": "Optional list of column aliases or constant literals to be passed as arguments to the row filter function.\nThe type of each column should match the positional argument of the row filter function.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.RunRefreshRequest": {},
+    "catalog.SchemaInfo": {
+      "fields": {
+        "browse_only": {
+          "description": "Indicates whether the principal is limited to retrieving metadata for the associated object through the BROWSE privilege when include_browse is enabled in the request.",
+          "launch_stage": "GA"
+        },
+        "catalog_name": {
+          "description": "Name of parent catalog.",
+          "launch_stage": "GA"
+        },
+        "catalog_type": {
+          "description": "The type of the parent catalog.",
+          "ref": "catalog.CatalogType",
+          "launch_stage": "GA"
+        },
+        "comment": {
+          "description": "User-provided free-form text description.",
+          "launch_stage": "GA"
+        },
+        "created_at": {
+          "description": "Time at which this schema was created, in epoch milliseconds.",
+          "launch_stage": "GA"
+        },
+        "created_by": {
+          "description": "Username of schema creator.",
+          "launch_stage": "GA"
+        },
+        "custom_max_retention_hours": {
+          "description": "Custom maximum retention period in hours for the schema.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "effective_predictive_optimization_flag": {
+          "ref": "catalog.EffectivePredictiveOptimizationFlag",
+          "launch_stage": "GA"
+        },
+        "enable_predictive_optimization": {
+          "description": "Whether predictive optimization should be enabled for this object and objects under it.",
+          "ref": "catalog.EnablePredictiveOptimization",
+          "launch_stage": "GA"
+        },
+        "full_name": {
+          "description": "Full name of schema, in form of __catalog_name__.__schema_name__.",
+          "launch_stage": "GA"
+        },
+        "metastore_id": {
+          "description": "Unique identifier of parent metastore.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of schema, relative to parent catalog.",
+          "launch_stage": "GA"
+        },
+        "owner": {
+          "description": "Username of current owner of schema.",
+          "launch_stage": "GA"
+        },
+        "properties": {
+          "description": "A map of key-value properties attached to the securable.",
+          "launch_stage": "GA"
+        },
+        "schema_id": {
+          "description": "The unique identifier of the schema.",
+          "launch_stage": "GA"
+        },
+        "storage_location": {
+          "description": "Storage location for managed tables within schema.",
+          "launch_stage": "GA"
+        },
+        "storage_root": {
+          "description": "Storage root URL for managed tables within schema.",
+          "launch_stage": "GA"
+        },
+        "updated_at": {
+          "description": "Time at which this schema was created, in epoch milliseconds.",
+          "launch_stage": "GA"
+        },
+        "updated_by": {
+          "description": "Username of user who last modified schema.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.Secret": {
+      "description": "A secret stored in Unity Catalog. Secrets are three-level namespace objects\n(catalog.schema.secret) that securely store sensitive credential data such as\npasswords, tokens, and keys.",
+      "fields": {
+        "catalog_name": {
+          "description": "The name of the catalog where the schema and the secret reside.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "comment": {
+          "description": "User-provided free-form text description of the secret.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "create_time": {
+          "description": "The time at which this secret was created.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "created_by": {
+          "description": "The principal that created the secret.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "effective_owner": {
+          "description": "The effective owner of the secret, which may differ from the directly-set **owner** due to\ninheritance.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "effective_value": {
+          "description": "The secret value. Only populated in responses when you have the **READ_SECRET**\nprivilege and **include_value** is set to true in the request. The maximum size is 60 KiB.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "expire_time": {
+          "description": "User-provided expiration time of the secret. This field indicates when the secret should no\nlonger be used and may be displayed as a warning in the UI. It is purely informational and\ndoes not trigger any automatic actions or affect the secret's lifecycle.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "full_name": {
+          "description": "The three-level (fully qualified) name of the secret, in the form of **catalog_name.schema_name.secret_name**.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "metastore_id": {
+          "description": "Unique identifier of the metastore hosting the secret.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "The name of the secret, relative to its parent schema.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "owner": {
+          "description": "The owner of the secret. Defaults to the creating principal on creation. Can be updated to\ntransfer ownership of the secret to another principal.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "INPUT_ONLY",
+            "OPTIONAL"
+          ]
+        },
+        "schema_name": {
+          "description": "The name of the schema where the secret resides.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "update_time": {
+          "description": "The time at which this secret was last updated.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "updated_by": {
+          "description": "The principal that last updated the secret.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "value": {
+          "description": "The secret value to store. This field is input-only and is not returned in responses — use\nthe **effective_value** field (via GetSecret with **include_value** set to true) to read the\nsecret value. The maximum size is 60 KiB (pre-encryption). Accepted content includes\npasswords, tokens, keys, and other sensitive credential data.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "INPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "catalog.Securable": {
+      "description": "Generic definition of a securable, which is uniquely defined in a metastore\nby its type and full name.",
+      "fields": {
+        "full_name": {
+          "description": "Required. The full name of the catalog/schema/table.\nOptional if resource_name is present.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "provider_share": {
+          "description": "Optional. The name of the Share object that contains the securable when the securable is\ngetting shared in D2D Delta Sharing.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "type": {
+          "description": "Required. The type of securable (catalog/schema/table).\nOptional if resource_name is present.",
+          "ref": "catalog.SecurableType",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.SecurableKind": {
+      "enum": [
+        "TABLE_STANDARD",
+        "TABLE_EXTERNAL",
+        "TABLE_DELTA",
+        "TABLE_DELTA_EXTERNAL",
+        "TABLE_VIEW",
+        "TABLE_METRIC_VIEW",
+        "TABLE_DELTASHARING",
+        "TABLE_DELTASHARING_MUTABLE",
+        "TABLE_VIEW_DELTASHARING",
+        "TABLE_METRIC_VIEW_DELTASHARING",
+        "TABLE_MATERIALIZED_VIEW_DELTASHARING",
+        "TABLE_STREAMING_LIVE_TABLE_DELTASHARING",
+        "TABLE_FOREIGN_DELTASHARING",
+        "TABLE_DELTA_ICEBERG_DELTASHARING",
+        "TABLE_DELTASHARING_OPEN_DIR_BASED",
+        "TABLE_FOREIGN_DELTA_DELTASHARING",
+        "TABLE_FEATURE_STORE",
+        "TABLE_FEATURE_STORE_EXTERNAL",
+        "TABLE_STREAMING_LIVE_TABLE",
+        "TABLE_SYSTEM",
+        "TABLE_SYSTEM_DELTASHARING",
+        "TABLE_MATERIALIZED_VIEW",
+        "TABLE_INTERNAL",
+        "TABLE_FOREIGN_BIGQUERY",
+        "TABLE_FOREIGN_MYSQL",
+        "TABLE_FOREIGN_ORACLE",
+        "TABLE_FOREIGN_POSTGRESQL",
+        "TABLE_FOREIGN_SQLDW",
+        "TABLE_FOREIGN_REDSHIFT",
+        "TABLE_FOREIGN_SNOWFLAKE",
+        "TABLE_FOREIGN_SQLSERVER",
+        "TABLE_FOREIGN_SALESFORCE",
+        "TABLE_FOREIGN_SALESFORCE_DATA_CLOUD",
+        "TABLE_FOREIGN_SALESFORCE_DATA_CLOUD_FILE_SHARING",
+        "TABLE_FOREIGN_SALESFORCE_DATA_CLOUD_FILE_SHARING_VIEW",
+        "TABLE_FOREIGN_TERADATA",
+        "TABLE_FOREIGN_NETSUITE",
+        "TABLE_FOREIGN_DATABRICKS",
+        "TABLE_FOREIGN_WORKDAY_RAAS",
+        "TABLE_FOREIGN_HIVE_METASTORE",
+        "TABLE_FOREIGN_HIVE_METASTORE_MANAGED",
+        "TABLE_FOREIGN_HIVE_METASTORE_DBFS_MANAGED",
+        "TABLE_FOREIGN_HIVE_METASTORE_EXTERNAL",
+        "TABLE_FOREIGN_HIVE_METASTORE_DBFS_EXTERNAL",
+        "TABLE_FOREIGN_HIVE_METASTORE_VIEW",
+        "TABLE_FOREIGN_HIVE_METASTORE_DBFS_VIEW",
+        "TABLE_FOREIGN_HIVE_METASTORE_SHALLOW_CLONE_MANAGED",
+        "TABLE_FOREIGN_HIVE_METASTORE_DBFS_SHALLOW_CLONE_MANAGED",
+        "TABLE_FOREIGN_HIVE_METASTORE_SHALLOW_CLONE_EXTERNAL",
+        "TABLE_FOREIGN_HIVE_METASTORE_DBFS_SHALLOW_CLONE_EXTERNAL",
+        "TABLE_FOREIGN_MONGODB",
+        "TABLE_DELTA_UNIFORM_HUDI_EXTERNAL",
+        "TABLE_DELTA_UNIFORM_ICEBERG_EXTERNAL",
+        "TABLE_DELTA_UNIFORM_ICEBERG_FOREIGN_HIVE_METASTORE_EXTERNAL",
+        "TABLE_DELTA_UNIFORM_ICEBERG_FOREIGN_HIVE_METASTORE_MANAGED",
+        "TABLE_DELTA_UNIFORM_ICEBERG_FOREIGN_SNOWFLAKE",
+        "TABLE_DELTA_UNIFORM_ICEBERG_FOREIGN_DELTASHARING",
+        "TABLE_DELTA_UNIFORM_ICEBERG_EXTERNAL_DELTASHARING",
+        "TABLE_ICEBERG_UNIFORM_MANAGED",
+        "TABLE_DELTA_ICEBERG_MANAGED",
+        "TABLE_ONLINE_VECTOR_INDEX_REPLICA",
+        "TABLE_ONLINE_VECTOR_INDEX_DIRECT",
+        "TABLE_ONLINE_VIEW",
+        "TABLE_DB_STORAGE",
+        "TABLE_MANAGED_POSTGRESQL"
+      ],
+      "enum_launch_stages": {
+        "TABLE_DB_STORAGE": "GA",
+        "TABLE_DELTA": "GA",
+        "TABLE_DELTASHARING": "GA",
+        "TABLE_DELTASHARING_MUTABLE": "GA",
+        "TABLE_DELTASHARING_OPEN_DIR_BASED": "GA",
+        "TABLE_DELTA_EXTERNAL": "GA",
+        "TABLE_DELTA_ICEBERG_DELTASHARING": "GA",
+        "TABLE_DELTA_ICEBERG_MANAGED": "GA",
+        "TABLE_DELTA_UNIFORM_HUDI_EXTERNAL": "GA",
+        "TABLE_DELTA_UNIFORM_ICEBERG_EXTERNAL": "GA",
+        "TABLE_DELTA_UNIFORM_ICEBERG_EXTERNAL_DELTASHARING": "GA",
+        "TABLE_DELTA_UNIFORM_ICEBERG_FOREIGN_DELTASHARING": "GA",
+        "TABLE_DELTA_UNIFORM_ICEBERG_FOREIGN_HIVE_METASTORE_EXTERNAL": "GA",
+        "TABLE_DELTA_UNIFORM_ICEBERG_FOREIGN_HIVE_METASTORE_MANAGED": "GA",
+        "TABLE_DELTA_UNIFORM_ICEBERG_FOREIGN_SNOWFLAKE": "GA",
+        "TABLE_EXTERNAL": "GA",
+        "TABLE_FEATURE_STORE": "GA",
+        "TABLE_FEATURE_STORE_EXTERNAL": "GA",
+        "TABLE_FOREIGN_BIGQUERY": "GA",
+        "TABLE_FOREIGN_DATABRICKS": "GA",
+        "TABLE_FOREIGN_DELTASHARING": "GA",
+        "TABLE_FOREIGN_DELTA_DELTASHARING": "GA",
+        "TABLE_FOREIGN_HIVE_METASTORE": "GA",
+        "TABLE_FOREIGN_HIVE_METASTORE_DBFS_EXTERNAL": "GA",
+        "TABLE_FOREIGN_HIVE_METASTORE_DBFS_MANAGED": "GA",
+        "TABLE_FOREIGN_HIVE_METASTORE_DBFS_SHALLOW_CLONE_EXTERNAL": "GA",
+        "TABLE_FOREIGN_HIVE_METASTORE_DBFS_SHALLOW_CLONE_MANAGED": "GA",
+        "TABLE_FOREIGN_HIVE_METASTORE_DBFS_VIEW": "GA",
+        "TABLE_FOREIGN_HIVE_METASTORE_EXTERNAL": "GA",
+        "TABLE_FOREIGN_HIVE_METASTORE_MANAGED": "GA",
+        "TABLE_FOREIGN_HIVE_METASTORE_SHALLOW_CLONE_EXTERNAL": "GA",
+        "TABLE_FOREIGN_HIVE_METASTORE_SHALLOW_CLONE_MANAGED": "GA",
+        "TABLE_FOREIGN_HIVE_METASTORE_VIEW": "GA",
+        "TABLE_FOREIGN_MONGODB": "GA",
+        "TABLE_FOREIGN_MYSQL": "GA",
+        "TABLE_FOREIGN_NETSUITE": "GA",
+        "TABLE_FOREIGN_ORACLE": "GA",
+        "TABLE_FOREIGN_POSTGRESQL": "GA",
+        "TABLE_FOREIGN_REDSHIFT": "GA",
+        "TABLE_FOREIGN_SALESFORCE": "GA",
+        "TABLE_FOREIGN_SALESFORCE_DATA_CLOUD": "GA",
+        "TABLE_FOREIGN_SALESFORCE_DATA_CLOUD_FILE_SHARING": "GA",
+        "TABLE_FOREIGN_SALESFORCE_DATA_CLOUD_FILE_SHARING_VIEW": "GA",
+        "TABLE_FOREIGN_SNOWFLAKE": "GA",
+        "TABLE_FOREIGN_SQLDW": "GA",
+        "TABLE_FOREIGN_SQLSERVER": "GA",
+        "TABLE_FOREIGN_TERADATA": "GA",
+        "TABLE_FOREIGN_WORKDAY_RAAS": "GA",
+        "TABLE_ICEBERG_UNIFORM_MANAGED": "GA",
+        "TABLE_INTERNAL": "GA",
+        "TABLE_MANAGED_POSTGRESQL": "GA",
+        "TABLE_MATERIALIZED_VIEW": "GA",
+        "TABLE_MATERIALIZED_VIEW_DELTASHARING": "GA",
+        "TABLE_METRIC_VIEW": "GA",
+        "TABLE_METRIC_VIEW_DELTASHARING": "GA",
+        "TABLE_ONLINE_VECTOR_INDEX_DIRECT": "GA",
+        "TABLE_ONLINE_VECTOR_INDEX_REPLICA": "GA",
+        "TABLE_ONLINE_VIEW": "GA",
+        "TABLE_STANDARD": "GA",
+        "TABLE_STREAMING_LIVE_TABLE": "GA",
+        "TABLE_STREAMING_LIVE_TABLE_DELTASHARING": "GA",
+        "TABLE_SYSTEM": "GA",
+        "TABLE_SYSTEM_DELTASHARING": "GA",
+        "TABLE_VIEW": "GA",
+        "TABLE_VIEW_DELTASHARING": "GA"
+      }
+    },
+    "catalog.SecurableKindManifest": {
+      "description": "Manifest of a specific securable kind.",
+      "fields": {
+        "assignable_privileges": {
+          "description": "Privileges that can be assigned to the securable.",
+          "launch_stage": "GA"
+        },
+        "capabilities": {
+          "description": "A list of capabilities in the securable kind.",
+          "launch_stage": "GA"
+        },
+        "options": {
+          "description": "Detailed specs of allowed options.",
+          "launch_stage": "GA"
+        },
+        "securable_kind": {
+          "description": "Securable kind to get manifest of.",
+          "ref": "catalog.SecurableKind",
+          "launch_stage": "GA"
+        },
+        "securable_type": {
+          "description": "Securable Type of the kind.",
+          "ref": "catalog.SecurableType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.SecurablePermissions": {
+      "fields": {
+        "permissions": {
+          "description": "List of requested Unity Catalog permissions.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "securable": {
+          "description": "The securable for which the access request destinations are being requested.",
+          "ref": "catalog.Securable",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.SecurableType": {
+      "description": "The type of Unity Catalog securable.",
+      "enum": [
+        "CATALOG",
+        "SCHEMA",
+        "TABLE",
+        "STORAGE_CREDENTIAL",
+        "EXTERNAL_LOCATION",
+        "FUNCTION",
+        "SHARE",
+        "PROVIDER",
+        "RECIPIENT",
+        "CLEAN_ROOM",
+        "METASTORE",
+        "PIPELINE",
+        "VOLUME",
+        "CONNECTION",
+        "CREDENTIAL",
+        "EXTERNAL_METADATA",
+        "STAGING_TABLE",
+        "MODEL",
+        "MODEL_SERVICE",
+        "MCP_SERVICE",
+        "MODEL_PROVIDER_SERVICE",
+        "AGENT_SERVICE",
+        "SKILL"
+      ],
+      "enum_launch_stages": {
+        "AGENT_SERVICE": "PUBLIC_BETA",
+        "CATALOG": "GA",
+        "CLEAN_ROOM": "GA",
+        "CONNECTION": "GA",
+        "CREDENTIAL": "GA",
+        "EXTERNAL_LOCATION": "GA",
+        "EXTERNAL_METADATA": "GA",
+        "FUNCTION": "GA",
+        "MCP_SERVICE": "GA",
+        "METASTORE": "GA",
+        "MODEL": "GA",
+        "MODEL_PROVIDER_SERVICE": "GA",
+        "MODEL_SERVICE": "GA",
+        "PIPELINE": "GA",
+        "PROVIDER": "GA",
+        "RECIPIENT": "GA",
+        "SCHEMA": "GA",
+        "SHARE": "GA",
+        "SKILL": "PUBLIC_BETA",
+        "STAGING_TABLE": "GA",
+        "STORAGE_CREDENTIAL": "GA",
+        "TABLE": "GA",
+        "VOLUME": "GA"
+      }
+    },
+    "catalog.SetArtifactAllowlist": {
+      "fields": {
+        "artifact_matchers": {
+          "description": "A list of allowed artifact match patterns.",
+          "launch_stage": "GA"
+        },
+        "created_at": {
+          "description": "Time at which this artifact allowlist was set, in epoch milliseconds.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "created_by": {
+          "description": "Username of the user who set the artifact allowlist.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "metastore_id": {
+          "description": "Unique identifier of parent metastore.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "catalog.SetRegisteredModelAliasRequest": {
+      "fields": {
+        "version_num": {
+          "description": "The version number of the model version to which the alias points",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.Skill": {
+      "description": "A Skill is an agentskills.io bundle registered in Unity Catalog. Clients\ntransfer bundle bytes through the Files API. FinalizeSkill reads the uploaded\nSKILL.md and projects its frontmatter onto the Skill metadata.",
+      "fields": {
+        "bundle_name": {
+          "description": "Name from the most recently successfully finalized SKILL.md. It may differ\nfrom the final component of the Skill resource name. Unset until\nFinalizeSkill succeeds.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "comment": {
+          "description": "User-provided comment for the skill. Free-text, user-editable via\nUpdateSkill (listed in its `update_mask`). DISTINCT from `description`,\nwhich is the server-parsed, OUTPUT_ONLY SKILL.md frontmatter value: `comment`\nis the customer's own annotation and is preserved across bundle re-uploads.\nWhen `comment` is in the update mask, omitting it clears the field, while\nan explicitly empty string is retained.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "create_time": {
+          "description": "Time the skill was created.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "created_by": {
+          "description": "Creator identity.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "description": {
+          "description": "Description from the most recently successfully finalized SKILL.md. Unset\nuntil FinalizeSkill succeeds.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "effective_owner": {
+          "description": "Owner of the skill.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "etag": {
+          "description": "Optimistic concurrency token returned on every read. To make an Update or\nDelete conditional, pass the last-read value in that request's `etag`\nfield. In REST responses, this value is a base64 string; URL-encode it when\nsetting the `etag` query parameter.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "finalize_time": {
+          "description": "Time of the most recent successful FinalizeSkill. Unset until one succeeds.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "metastore_id": {
+          "description": "Metastore hosting the skill.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "Resource name of the skill.\nFormat: `skills/{catalog}.{schema}.{skill}`.\nEach `{...}` component is capped at 255 characters individually.\nServer-derived on Create from `parent` +\n`skill_id`; required and immutable on Update/Get/Delete.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "update_time": {
+          "description": "Time of the most recent Skill metadata mutation. Uploading bundle files\nalone does not change this value.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "updated_by": {
+          "description": "Identity of the last updater.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "catalog.SpecialDestination": {
+      "enum": [
+        "SPECIAL_DESTINATION_CATALOG_OWNER",
+        "SPECIAL_DESTINATION_EXTERNAL_LOCATION_OWNER",
+        "SPECIAL_DESTINATION_CONNECTION_OWNER",
+        "SPECIAL_DESTINATION_CREDENTIAL_OWNER",
+        "SPECIAL_DESTINATION_METASTORE_OWNER",
+        "SPECIAL_DESTINATION_SCHEMA_OWNER",
+        "SPECIAL_DESTINATION_TABLE_OWNER",
+        "SPECIAL_DESTINATION_VOLUME_OWNER",
+        "SPECIAL_DESTINATION_FUNCTION_OWNER",
+        "SPECIAL_DESTINATION_REGISTERED_MODEL_OWNER"
+      ],
+      "enum_launch_stages": {
+        "SPECIAL_DESTINATION_CATALOG_OWNER": "PUBLIC_PREVIEW",
+        "SPECIAL_DESTINATION_CONNECTION_OWNER": "PUBLIC_PREVIEW",
+        "SPECIAL_DESTINATION_CREDENTIAL_OWNER": "PUBLIC_PREVIEW",
+        "SPECIAL_DESTINATION_EXTERNAL_LOCATION_OWNER": "PUBLIC_PREVIEW",
+        "SPECIAL_DESTINATION_FUNCTION_OWNER": "PUBLIC_BETA",
+        "SPECIAL_DESTINATION_METASTORE_OWNER": "PUBLIC_PREVIEW",
+        "SPECIAL_DESTINATION_REGISTERED_MODEL_OWNER": "PUBLIC_BETA",
+        "SPECIAL_DESTINATION_SCHEMA_OWNER": "PUBLIC_BETA",
+        "SPECIAL_DESTINATION_TABLE_OWNER": "PUBLIC_BETA",
+        "SPECIAL_DESTINATION_VOLUME_OWNER": "PUBLIC_BETA"
+      }
+    },
+    "catalog.SseEncryptionDetails": {
+      "description": "Server-Side Encryption properties for clients communicating with AWS s3.",
+      "fields": {
+        "algorithm": {
+          "description": "Sets the value of the 'x-amz-server-side-encryption' header in S3 request.",
+          "ref": "catalog.SseEncryptionDetailsAlgorithm",
+          "launch_stage": "GA"
+        },
+        "aws_kms_key_arn": {
+          "description": "Optional. The ARN of the SSE-KMS key used with the S3 location, when algorithm = \"SSE-KMS\".\nSets the value of the 'x-amz-server-side-encryption-aws-kms-key-id' header.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.SseEncryptionDetailsAlgorithm": {
+      "enum": [
+        "AWS_SSE_S3",
+        "AWS_SSE_KMS"
+      ],
+      "enum_launch_stages": {
+        "AWS_SSE_KMS": "GA",
+        "AWS_SSE_S3": "GA"
+      }
+    },
+    "catalog.StorageCredentialInfo": {
+      "fields": {
+        "aws_iam_role": {
+          "description": "The AWS IAM role configuration.",
+          "ref": "catalog.AwsIamRoleResponse",
+          "launch_stage": "GA"
+        },
+        "azure_managed_identity": {
+          "description": "The Azure managed identity configuration.",
+          "ref": "catalog.AzureManagedIdentityResponse",
+          "launch_stage": "GA"
+        },
+        "azure_service_principal": {
+          "description": "The Azure service principal configuration.",
+          "ref": "catalog.AzureServicePrincipal",
+          "launch_stage": "GA"
+        },
+        "cloudflare_api_token": {
+          "description": "The Cloudflare API token configuration.",
+          "ref": "catalog.CloudflareApiToken",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "comment": {
+          "description": "Comment associated with the credential.",
+          "launch_stage": "GA"
+        },
+        "created_at": {
+          "description": "Time at which this credential was created, in epoch milliseconds.",
+          "launch_stage": "GA"
+        },
+        "created_by": {
+          "description": "Username of credential creator.",
+          "launch_stage": "GA"
+        },
+        "databricks_gcp_service_account": {
+          "description": "The Databricks managed GCP service account configuration.",
+          "ref": "catalog.DatabricksGcpServiceAccountResponse",
+          "launch_stage": "GA"
+        },
+        "full_name": {
+          "description": "The full name of the credential.",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "The unique identifier of the credential.",
+          "launch_stage": "GA"
+        },
+        "isolation_mode": {
+          "description": "Whether the current securable is accessible from all workspaces or a\nspecific set of workspaces.",
+          "ref": "catalog.IsolationMode",
+          "launch_stage": "GA"
+        },
+        "metastore_id": {
+          "description": "Unique identifier of the parent metastore.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The credential name. The name must be unique among storage and service\ncredentials within the metastore.",
+          "launch_stage": "GA"
+        },
+        "owner": {
+          "description": "Username of current owner of credential.",
+          "launch_stage": "GA"
+        },
+        "read_only": {
+          "description": "Whether the credential is usable only for read operations. Only applicable\nwhen purpose is **STORAGE**.",
+          "launch_stage": "GA"
+        },
+        "updated_at": {
+          "description": "Time at which this credential was last modified, in epoch milliseconds.",
+          "launch_stage": "GA"
+        },
+        "updated_by": {
+          "description": "Username of user who last modified the credential.",
+          "launch_stage": "GA"
+        },
+        "used_for_managed_storage": {
+          "description": "Whether this credential is the current metastore's root storage credential.\nOnly applicable when purpose is **STORAGE**.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.SummaryRequest": {},
+    "catalog.SystemSchemaInfo": {
+      "fields": {
+        "schema": {
+          "description": "Name of the system schema.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "state": {
+          "description": "The current state of enablement for the system schema. An empty string means the system schema is available and ready for opt-in.\nPossible values: AVAILABLE | ENABLE_INITIALIZED | ENABLE_COMPLETED | DISABLE_INITIALIZED | UNAVAILABLE | MANAGED",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.SystemType": {
+      "enum": [
+        "OTHER",
+        "TABLEAU",
+        "POWER_BI",
+        "LOOKER",
+        "KAFKA",
+        "SAP",
+        "ORACLE",
+        "SALESFORCE",
+        "WORKDAY",
+        "MYSQL",
+        "POSTGRESQL",
+        "MICROSOFT_SQL_SERVER",
+        "SERVICENOW",
+        "AMAZON_REDSHIFT",
+        "AZURE_SYNAPSE",
+        "SNOWFLAKE",
+        "GOOGLE_BIGQUERY",
+        "MICROSOFT_FABRIC",
+        "MONGODB",
+        "TERADATA",
+        "CONFLUENT",
+        "DATABRICKS",
+        "STREAM_NATIVE"
+      ],
+      "enum_launch_stages": {
+        "AMAZON_REDSHIFT": "PUBLIC_PREVIEW",
+        "AZURE_SYNAPSE": "PUBLIC_PREVIEW",
+        "CONFLUENT": "PUBLIC_PREVIEW",
+        "DATABRICKS": "PUBLIC_PREVIEW",
+        "GOOGLE_BIGQUERY": "PUBLIC_PREVIEW",
+        "KAFKA": "PUBLIC_PREVIEW",
+        "LOOKER": "PUBLIC_PREVIEW",
+        "MICROSOFT_FABRIC": "PUBLIC_PREVIEW",
+        "MICROSOFT_SQL_SERVER": "PUBLIC_PREVIEW",
+        "MONGODB": "PUBLIC_PREVIEW",
+        "MYSQL": "PUBLIC_PREVIEW",
+        "ORACLE": "PUBLIC_PREVIEW",
+        "OTHER": "PUBLIC_PREVIEW",
+        "POSTGRESQL": "PUBLIC_PREVIEW",
+        "POWER_BI": "PUBLIC_PREVIEW",
+        "SALESFORCE": "PUBLIC_PREVIEW",
+        "SAP": "PUBLIC_PREVIEW",
+        "SERVICENOW": "PUBLIC_PREVIEW",
+        "SNOWFLAKE": "PUBLIC_PREVIEW",
+        "STREAM_NATIVE": "PUBLIC_PREVIEW",
+        "TABLEAU": "PUBLIC_PREVIEW",
+        "TERADATA": "PUBLIC_PREVIEW",
+        "WORKDAY": "PUBLIC_PREVIEW"
+      }
+    },
+    "catalog.TableConstraint": {
+      "description": "A table constraint, as defined by *one* of the following fields being set:\n__primary_key_constraint__, __foreign_key_constraint__, __named_table_constraint__.",
+      "fields": {
+        "foreign_key_constraint": {
+          "ref": "catalog.ForeignKeyConstraint",
+          "launch_stage": "GA"
+        },
+        "named_table_constraint": {
+          "ref": "catalog.NamedTableConstraint",
+          "launch_stage": "GA"
+        },
+        "primary_key_constraint": {
+          "ref": "catalog.PrimaryKeyConstraint",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.TableDependency": {
+      "description": "A table that is dependent on a SQL object.",
+      "fields": {
+        "table_full_name": {
+          "description": "Full name of the dependent table, in the form of __catalog_name__.__schema_name__.__table_name__.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.TableExistsResponse": {
+      "fields": {
+        "table_exists": {
+          "description": "Whether the table exists or not.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.TableInfo": {
+      "fields": {
+        "access_point": {
+          "description": "The AWS access point to use when accesing s3 for this external location.",
+          "launch_stage": "GA"
+        },
+        "browse_only": {
+          "description": "Indicates whether the principal is limited to retrieving metadata for the associated object through the BROWSE privilege when include_browse is enabled in the request.",
+          "launch_stage": "GA"
+        },
+        "catalog_name": {
+          "description": "Name of parent catalog.",
+          "launch_stage": "GA"
+        },
+        "columns": {
+          "description": "The array of __ColumnInfo__ definitions of the table's columns.",
+          "launch_stage": "GA"
+        },
+        "comment": {
+          "description": "User-provided free-form text description.",
+          "launch_stage": "GA"
+        },
+        "created_at": {
+          "description": "Time at which this table was created, in epoch milliseconds.",
+          "launch_stage": "GA"
+        },
+        "created_by": {
+          "description": "Username of table creator.",
+          "launch_stage": "GA"
+        },
+        "data_access_configuration_id": {
+          "description": "Unique ID of the Data Access Configuration to use with the table data.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "data_source_format": {
+          "ref": "catalog.DataSourceFormat",
+          "launch_stage": "GA"
+        },
+        "deleted_at": {
+          "description": "Time at which this table was deleted, in epoch milliseconds. Field is omitted if table is not deleted.",
+          "launch_stage": "GA"
+        },
+        "delta_runtime_properties_kvpairs": {
+          "description": "Information pertaining to current state of the delta table.",
+          "ref": "catalog.DeltaRuntimePropertiesKvPairs",
+          "launch_stage": "GA"
+        },
+        "effective_predictive_optimization_flag": {
+          "ref": "catalog.EffectivePredictiveOptimizationFlag",
+          "launch_stage": "GA"
+        },
+        "enable_predictive_optimization": {
+          "ref": "catalog.EnablePredictiveOptimization",
+          "launch_stage": "GA"
+        },
+        "encryption_details": {
+          "ref": "catalog.EncryptionDetails",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "full_name": {
+          "description": "Full name of table, in form of __catalog_name__.__schema_name__.__table_name__",
+          "launch_stage": "GA"
+        },
+        "metastore_id": {
+          "description": "Unique identifier of parent metastore.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of table, relative to parent schema.",
+          "launch_stage": "GA"
+        },
+        "owner": {
+          "description": "Username of current owner of table.",
+          "launch_stage": "GA"
+        },
+        "pipeline_id": {
+          "description": "The pipeline ID of the table. Applicable for tables created by pipelines (Materialized View, Streaming Table, etc.).",
+          "launch_stage": "GA"
+        },
+        "properties": {
+          "description": "A map of key-value properties attached to the securable.",
+          "launch_stage": "GA"
+        },
+        "row_filter": {
+          "ref": "catalog.TableRowFilter",
+          "launch_stage": "GA"
+        },
+        "schema_name": {
+          "description": "Name of parent schema relative to its parent catalog.",
+          "launch_stage": "GA"
+        },
+        "securable_kind_manifest": {
+          "description": "SecurableKindManifest of table, including capabilities the table has.",
+          "ref": "catalog.SecurableKindManifest",
+          "launch_stage": "GA"
+        },
+        "sql_path": {
+          "description": "List of schemes whose objects can be referenced without qualification.",
+          "launch_stage": "GA"
+        },
+        "storage_credential_name": {
+          "description": "Name of the storage credential, when a storage credential is configured for use with this table.",
+          "launch_stage": "GA"
+        },
+        "storage_location": {
+          "description": "Storage root URL for table (for **MANAGED**, **EXTERNAL** tables).",
+          "launch_stage": "GA"
+        },
+        "table_constraints": {
+          "description": "List of table constraints. Note: this field is not set in the output of the __listTables__ API.",
+          "launch_stage": "GA"
+        },
+        "table_id": {
+          "description": "The unique identifier of the table.",
+          "launch_stage": "GA"
+        },
+        "table_type": {
+          "ref": "catalog.TableType",
+          "launch_stage": "GA"
+        },
+        "updated_at": {
+          "description": "Time at which this table was last modified, in epoch milliseconds.",
+          "launch_stage": "GA"
+        },
+        "updated_by": {
+          "description": "Username of user who last modified the table.",
+          "launch_stage": "GA"
+        },
+        "view_definition": {
+          "description": "View definition SQL (when __table_type__ is **VIEW**, **MATERIALIZED_VIEW**, or **STREAMING_TABLE**)",
+          "launch_stage": "GA"
+        },
+        "view_dependencies": {
+          "description": "View dependencies (when table_type == **VIEW** or **MATERIALIZED_VIEW**, **STREAMING_TABLE**)\n- when DependencyList is None, the dependency is not provided;\n- when DependencyList is an empty list, the dependency is provided but is empty;\n- when DependencyList is not an empty list, dependencies are provided and recorded.\nNote: this field is not set in the output of the __listTables__ API.",
+          "ref": "catalog.DependencyList",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.TableOperation": {
+      "enum": [
+        "READ",
+        "READ_WRITE"
+      ],
+      "enum_launch_stages": {
+        "READ": "GA",
+        "READ_WRITE": "GA"
+      }
+    },
+    "catalog.TableRowFilter": {
+      "fields": {
+        "function_name": {
+          "description": "The full name of the row filter SQL UDF.",
+          "launch_stage": "GA"
+        },
+        "input_arguments": {
+          "description": "The list of table columns or literals to be passed as additional arguments to a row filter\nfunction, carrying the type (column reference vs constant literal) of each argument.\nDeprecated: use input_column_names instead.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "input_column_names": {
+          "description": "The list of table columns to be passed as input to the row filter function. The column types\nshould match the types of the filter function arguments.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.TableSummary": {
+      "fields": {
+        "full_name": {
+          "description": "The full name of the table.",
+          "launch_stage": "GA"
+        },
+        "securable_kind_manifest": {
+          "description": "SecurableKindManifest of table, including capabilities the table has.",
+          "ref": "catalog.SecurableKindManifest",
+          "launch_stage": "GA"
+        },
+        "table_type": {
+          "ref": "catalog.TableType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.TableType": {
+      "enum": [
+        "MANAGED",
+        "EXTERNAL",
+        "VIEW",
+        "MATERIALIZED_VIEW",
+        "STREAMING_TABLE",
+        "MANAGED_SHALLOW_CLONE",
+        "FOREIGN",
+        "EXTERNAL_SHALLOW_CLONE",
+        "METRIC_VIEW"
+      ],
+      "enum_launch_stages": {
+        "EXTERNAL": "GA",
+        "EXTERNAL_SHALLOW_CLONE": "GA",
+        "FOREIGN": "GA",
+        "MANAGED": "GA",
+        "MANAGED_SHALLOW_CLONE": "GA",
+        "MATERIALIZED_VIEW": "GA",
+        "METRIC_VIEW": "GA",
+        "STREAMING_TABLE": "GA",
+        "VIEW": "GA"
+      }
+    },
+    "catalog.TagAssignmentSourceType": {
+      "description": "Enum representing the source type of a tag assignment",
+      "enum": [
+        "TAG_ASSIGNMENT_SOURCE_TYPE_SYSTEM_DATA_CLASSIFICATION"
+      ],
+      "enum_launch_stages": {
+        "TAG_ASSIGNMENT_SOURCE_TYPE_SYSTEM_DATA_CLASSIFICATION": "GA"
+      }
+    },
+    "catalog.TagIntrospectionExpression": {
+      "description": "An expression that introspects tags at query time.",
+      "fields": {
+        "column_tag_value": {
+          "description": "Extracts the value of a column-level tag.",
+          "ref": "catalog.ColumnTagValueExtraction",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "tag_value": {
+          "description": "Extracts the value of a securable-level tag.",
+          "ref": "catalog.TagValueExtraction",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.TagKeyValue": {
+      "fields": {
+        "key": {
+          "description": "name of the tag",
+          "launch_stage": "GA"
+        },
+        "value": {
+          "description": "value of the tag associated with the key, could be optional",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.TagValueExtraction": {
+      "description": "Extracts the value of a securable-level tag: get_tag_value(\"tagKey\").",
+      "fields": {
+        "tag_key": {
+          "description": "1024 matches the max_length on FunctionArgument.constant above.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.TemporaryCredentials": {
+      "fields": {
+        "aws_temp_credentials": {
+          "ref": "catalog.AwsCredentials",
+          "launch_stage": "GA"
+        },
+        "azure_aad": {
+          "ref": "catalog.AzureActiveDirectoryToken",
+          "launch_stage": "GA"
+        },
+        "expiration_time": {
+          "description": "Server time when the credential will expire, in epoch milliseconds.\nThe API client is advised to cache the credential given this expiration time.",
+          "launch_stage": "GA"
+        },
+        "gcp_oauth_token": {
+          "ref": "catalog.GcpOauthToken",
+          "launch_stage": "GA"
+        },
+        "r2_temp_credentials": {
+          "ref": "catalog.R2Credentials",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.TriggeredUpdateStatus": {
+      "description": "Detailed status of an online table. Shown if the online table is in the ONLINE_TRIGGERED_UPDATE\nor the ONLINE_NO_PENDING_UPDATE state.",
+      "fields": {
+        "last_processed_commit_version": {
+          "description": "The last source table Delta version that was synced to the online table. Note that this Delta\nversion may not be completely synced to the online table yet.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "timestamp": {
+          "description": "The timestamp of the last time any data was synchronized from the source table to the online\ntable.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "triggered_update_progress": {
+          "description": "Progress of the active data synchronization pipeline.",
+          "ref": "catalog.PipelineProgress",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.UnassignRequest": {
+      "fields": {
+        "metastore_id": {
+          "description": "Query for the ID of the metastore to delete.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.UnassignResponse": {},
+    "catalog.UpdateAccessRequestDestinationsRequest": {
+      "fields": {
+        "access_request_destinations": {
+          "description": "The access request destinations to assign to the securable.\nFor each destination, a **destination_id** and **destination_type** must be defined.",
+          "ref": "catalog.AccessRequestDestinations",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "update_mask": {
+          "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.UpdateAccountsMetastore": {
+      "fields": {
+        "delta_sharing_organization_name": {
+          "description": "The organization name of a Delta Sharing entity, to be used in Databricks-to-Databricks Delta Sharing as the official name.",
+          "launch_stage": "GA"
+        },
+        "delta_sharing_recipient_token_lifetime_in_seconds": {
+          "description": "The lifetime of delta sharing recipient token in seconds.",
+          "launch_stage": "GA"
+        },
+        "delta_sharing_scope": {
+          "description": "The scope of Delta Sharing enabled for the metastore.",
+          "ref": "catalog.DeltaSharingScopeEnum",
+          "launch_stage": "GA"
+        },
+        "external_access_enabled": {
+          "description": "Whether to allow non-DBR clients to directly access entities under the metastore.",
+          "launch_stage": "GA"
+        },
+        "owner": {
+          "description": "The owner of the metastore.",
+          "launch_stage": "GA"
+        },
+        "privilege_model_version": {
+          "description": "Privilege model version of the metastore, of the form `major.minor` (e.g., `1.0`).",
+          "launch_stage": "GA"
+        },
+        "storage_root_credential_id": {
+          "description": "UUID of storage credential to access the metastore storage_root.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.UpdateAccountsStorageCredential": {
+      "fields": {
+        "aws_iam_role": {
+          "description": "The AWS IAM role configuration.",
+          "ref": "catalog.AwsIamRoleRequest",
+          "launch_stage": "GA"
+        },
+        "azure_managed_identity": {
+          "description": "The Azure managed identity configuration.",
+          "ref": "catalog.AzureManagedIdentityResponse",
+          "launch_stage": "GA"
+        },
+        "azure_service_principal": {
+          "description": "The Azure service principal configuration.",
+          "ref": "catalog.AzureServicePrincipal",
+          "launch_stage": "GA"
+        },
+        "cloudflare_api_token": {
+          "description": "The Cloudflare API token configuration.",
+          "ref": "catalog.CloudflareApiToken",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "comment": {
+          "description": "Comment associated with the credential.",
+          "launch_stage": "GA"
+        },
+        "databricks_gcp_service_account": {
+          "description": "The Databricks managed GCP service account configuration.",
+          "ref": "catalog.DatabricksGcpServiceAccountRequest",
+          "launch_stage": "GA"
+        },
+        "isolation_mode": {
+          "description": "Whether the current securable is accessible from all workspaces or a\nspecific set of workspaces.",
+          "ref": "catalog.IsolationMode",
+          "launch_stage": "GA"
+        },
+        "owner": {
+          "description": "Username of current owner of credential.",
+          "launch_stage": "GA"
+        },
+        "read_only": {
+          "description": "Whether the credential is usable only for read operations. Only applicable\nwhen purpose is **STORAGE**.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.UpdateAssignmentResponse": {},
+    "catalog.UpdateCatalog": {
+      "fields": {
+        "comment": {
+          "description": "User-provided free-form text description.",
+          "launch_stage": "GA"
+        },
+        "custom_max_retention_hours": {
+          "description": "Custom maximum retention period in hours for the catalog",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "enable_predictive_optimization": {
+          "description": "Whether predictive optimization should be enabled for this object and objects under it.",
+          "ref": "catalog.EnablePredictiveOptimization",
+          "launch_stage": "GA"
+        },
+        "isolation_mode": {
+          "description": "Whether the current securable is accessible from all workspaces or a specific set of workspaces.",
+          "ref": "catalog.CatalogIsolationMode",
+          "launch_stage": "GA"
+        },
+        "managed_encryption_settings": {
+          "description": "Control CMK encryption for managed catalog data",
+          "ref": "catalog.EncryptionSettings",
+          "launch_stage": "GA"
+        },
+        "new_name": {
+          "description": "New name for the catalog.",
+          "launch_stage": "GA"
+        },
+        "options": {
+          "description": "A map of key-value properties attached to the securable.",
+          "launch_stage": "GA"
+        },
+        "owner": {
+          "description": "Username of current owner of catalog.",
+          "launch_stage": "GA"
+        },
+        "properties": {
+          "description": "A map of key-value properties attached to the securable.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.UpdateCatalogWorkspaceBindingsResponse": {
+      "fields": {
+        "workspaces": {
+          "description": "A list of workspace IDs",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.UpdateConnection": {
+      "fields": {
+        "environment_settings": {
+          "description": "[Create,Update:OPT] Connection environment settings as EnvironmentSettings object.",
+          "ref": "catalog.EnvironmentSettings",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "new_name": {
+          "description": "New name for the connection.",
+          "launch_stage": "GA"
+        },
+        "options": {
+          "description": "A map of key-value properties attached to the securable.",
+          "launch_stage": "GA"
+        },
+        "owner": {
+          "description": "Username of current owner of the connection.",
+          "launch_stage": "GA"
+        },
+        "secrets": {
+          "description": "A map of option names to UC Secret references. Keys are connection option names\n(same as in OptionsKVPairs) and values are UC Secret fully qualified names.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.UpdateCredentialRequest": {
+      "fields": {
+        "aws_iam_role": {
+          "description": "The AWS IAM role configuration.",
+          "ref": "catalog.AwsIamRole",
+          "launch_stage": "GA"
+        },
+        "azure_managed_identity": {
+          "description": "The Azure managed identity configuration.",
+          "ref": "catalog.AzureManagedIdentity",
+          "launch_stage": "GA"
+        },
+        "azure_service_principal": {
+          "description": "The Azure service principal configuration.",
+          "ref": "catalog.AzureServicePrincipal",
+          "launch_stage": "GA"
+        },
+        "comment": {
+          "description": "Comment associated with the credential.",
+          "launch_stage": "GA"
+        },
+        "databricks_gcp_service_account": {
+          "description": "The Databricks managed GCP service account configuration.",
+          "ref": "catalog.DatabricksGcpServiceAccount",
+          "launch_stage": "GA"
+        },
+        "force": {
+          "description": "Force an update even if there are dependent services (when purpose is\n**SERVICE**) or dependent external locations and external tables (when\npurpose is **STORAGE**).",
+          "launch_stage": "GA"
+        },
+        "isolation_mode": {
+          "description": "Whether the current securable is accessible from all workspaces or a\nspecific set of workspaces.",
+          "ref": "catalog.IsolationMode",
+          "launch_stage": "GA"
+        },
+        "new_name": {
+          "description": "New name of credential.",
+          "launch_stage": "GA"
+        },
+        "owner": {
+          "description": "Username of current owner of credential.",
+          "launch_stage": "GA"
+        },
+        "read_only": {
+          "description": "Whether the credential is usable only for read operations. Only applicable\nwhen purpose is **STORAGE**.",
+          "launch_stage": "GA"
+        },
+        "skip_validation": {
+          "description": "Supply true to this argument to skip validation of the updated credential.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.UpdateEntityTagAssignmentRequest": {
+      "fields": {
+        "tag_assignment": {
+          "ref": "catalog.EntityTagAssignment",
+          "launch_stage": "GA"
+        },
+        "update_mask": {
+          "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.UpdateExternalLineageRelationshipRequest": {
+      "fields": {
+        "external_lineage_relationship": {
+          "ref": "catalog.UpdateRequestExternalLineage",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "update_mask": {
+          "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.UpdateExternalLocation": {
+      "fields": {
+        "comment": {
+          "description": "User-provided free-form text description.",
+          "launch_stage": "GA"
+        },
+        "credential_name": {
+          "description": "Name of the storage credential used with this location.",
+          "launch_stage": "GA"
+        },
+        "effective_enable_file_events": {
+          "description": "The effective value of `enable_file_events` after applying server-side defaults.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "effective_file_event_queue": {
+          "description": "The effective file event queue configuration after applying server-side defaults.\nAlways populated when a queue is provisioned, regardless of whether the user explicitly\nset `enable_file_events`. Use this field instead of `file_event_queue` for reading\nthe actual queue state.",
+          "ref": "catalog.FileEventQueue",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "enable_file_events": {
+          "description": "Whether to enable file events on this external location. Default to `true`. Set to `false` to disable file events.\nThe actual applied value may differ due to server-side defaults; check `effective_enable_file_events` for the effective state.",
+          "launch_stage": "GA"
+        },
+        "encryption_details": {
+          "ref": "catalog.EncryptionDetails",
+          "launch_stage": "GA"
+        },
+        "fallback": {
+          "description": "Indicates whether fallback mode is enabled for this external location. When fallback mode is enabled, the access to the location falls back to cluster credentials if UC credentials are not sufficient.",
+          "launch_stage": "GA"
+        },
+        "file_event_queue": {
+          "description": "File event queue settings. If `enable_file_events` is not `false`, must be defined and have exactly one of the documented properties.",
+          "ref": "catalog.FileEventQueue",
+          "launch_stage": "GA"
+        },
+        "force": {
+          "description": "Force update even if changing url invalidates dependent external tables or mounts.",
+          "launch_stage": "GA"
+        },
+        "isolation_mode": {
+          "ref": "catalog.IsolationMode",
+          "launch_stage": "GA"
+        },
+        "new_name": {
+          "description": "New name for the external location.",
+          "launch_stage": "GA"
+        },
+        "owner": {
+          "description": "The owner of the external location.",
+          "launch_stage": "GA"
+        },
+        "read_only": {
+          "description": "Indicates whether the external location is read-only.",
+          "launch_stage": "GA"
+        },
+        "skip_validation": {
+          "description": "Skips validation of the storage credential associated with the external location.",
+          "launch_stage": "GA"
+        },
+        "url": {
+          "description": "Path URL of the external location.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.UpdateExternalMetadataRequest": {
+      "fields": {
+        "external_metadata": {
+          "ref": "catalog.ExternalMetadata",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "update_mask": {
+          "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.UpdateFunction": {
+      "fields": {
+        "owner": {
+          "description": "Username of current owner of the function.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.UpdateMcpServiceRequest": {
+      "fields": {
+        "etag": {
+          "description": "Optimistic concurrency token from the most recent read. When set, the\nupdate succeeds only if the resource has not changed. Leave unset for an\nunconditional update. For REST requests, URL-encode the base64 string\nreturned by the API when setting the `etag` query parameter.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "mcp_service": {
+          "description": "The MCP service with the updated field values. `name` identifies the\nresource (`mcp-services/{catalog}.{schema}.{mcp_service}`); only fields\nlisted in `update_mask` are applied.",
+          "ref": "catalog.McpService",
+          "launch_stage": "GA"
+        },
+        "update_mask": {
+          "description": "Fields to update. Use `config` to replace the entire configuration. The\nreplacement must include every required field; any optional field you omit\nis cleared. To preserve sibling fields, use one or more granular paths:\n`comment`, `config.source_connection.name`, `config.include_tool_selectors`, or\n`config.rate_limits`.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.UpdateMetastore": {
+      "fields": {
+        "delta_sharing_organization_name": {
+          "description": "The organization name of a Delta Sharing entity, to be used in Databricks-to-Databricks Delta Sharing as the official name.",
+          "launch_stage": "GA"
+        },
+        "delta_sharing_recipient_token_lifetime_in_seconds": {
+          "description": "The lifetime of delta sharing recipient token in seconds.",
+          "launch_stage": "GA"
+        },
+        "delta_sharing_scope": {
+          "description": "The scope of Delta Sharing enabled for the metastore.",
+          "ref": "catalog.DeltaSharingScopeEnum",
+          "launch_stage": "GA"
+        },
+        "external_access_enabled": {
+          "description": "Whether to allow non-DBR clients to directly access entities under the metastore.",
+          "launch_stage": "GA"
+        },
+        "new_name": {
+          "description": "New name for the metastore.",
+          "launch_stage": "GA"
+        },
+        "owner": {
+          "description": "The owner of the metastore.",
+          "launch_stage": "GA"
+        },
+        "privilege_model_version": {
+          "description": "Privilege model version of the metastore, of the form `major.minor` (e.g., `1.0`).",
+          "launch_stage": "GA"
+        },
+        "storage_root_credential_id": {
+          "description": "UUID of storage credential to access the metastore storage_root.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.UpdateMetastoreAssignment": {
+      "fields": {
+        "default_catalog_name": {
+          "description": "The name of the default catalog in the metastore.\nThis field is deprecated. Please use \"Default Namespace API\" to\nconfigure the default catalog for a Databricks workspace.",
+          "launch_stage": "GA"
+        },
+        "metastore_id": {
+          "description": "The unique ID of the metastore.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.UpdateModelProviderServiceRequest": {
+      "fields": {
+        "etag": {
+          "description": "Optimistic concurrency token from the most recent read. When set, the\nupdate succeeds only if the resource has not changed. Leave unset for an\nunconditional update. For REST requests, URL-encode the base64 string\nreturned by the API when setting the `etag` query parameter.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "model_provider_service": {
+          "description": "The model provider service with the updated field values. `name`\nidentifies the resource\n(`model-provider-services/{catalog}.{schema}.{model_provider_service}`);\nonly fields listed in `update_mask` are applied.",
+          "ref": "catalog.ModelProviderService",
+          "launch_stage": "GA"
+        },
+        "update_mask": {
+          "description": "Fields to update. Use `config` to replace the entire configuration. The\nreplacement must include every required field; any optional field you omit\nis cleared. To preserve sibling fields, use one or more granular paths:\n`comment`; `config.provider` to replace the active provider-specific value\n(for example, `config.openai`; the mask path remains `config.provider`);\n`config.allow_all_targets`, `config.targets`, `config.forward_headers`,\n`config.forward_query_parameters`, `config.forward_unmanaged_paths`,\n`config.rate_limits`, `config.pricing.default_discount_basis_points`, or\n`config.inference_table`. For a pricing update, an explicitly empty `pricing`\nobject clears the discount but retains the object; omitting `pricing` clears\nit. `config.pricing` is not a supported mask path. The provider type is\nimmutable. A `config` or `config.provider` replacement that carries no\nauthentication material preserves the existing authentication binding;\ninput-only plaintext does not need to be read back and re-sent.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.UpdateModelServiceRequest": {
+      "fields": {
+        "etag": {
+          "description": "Optimistic concurrency token from the most recent read. When set, the\nupdate succeeds only if the resource has not changed. Leave unset for an\nunconditional update. For REST requests, URL-encode the base64 string\nreturned by the API when setting the `etag` query parameter.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "model_service": {
+          "description": "The model service with the updated field values. `name` identifies the\nresource (`model-services/{catalog}.{schema}.{model_service}`); only\nfields listed in `update_mask` are applied.",
+          "ref": "catalog.ModelService",
+          "launch_stage": "GA"
+        },
+        "update_mask": {
+          "description": "Fields to update. Use `config` to replace the entire configuration. The\nreplacement must include every required field; any optional field you omit\nis cleared. To preserve sibling fields, use one or more granular paths:\n`comment`, `config.routing.destinations`,\n`config.routing.fallback.destinations`,\n`config.rate_limits`, or `config.inference_table`. Intermediate paths such\nas `config.routing` and `config.routing.fallback` are not supported.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.UpdateModelVersionRequest": {
+      "fields": {
+        "aliases": {
+          "description": "List of aliases associated with the model version",
+          "launch_stage": "GA"
+        },
+        "catalog_name": {
+          "description": "The name of the catalog containing the model version",
+          "launch_stage": "GA"
+        },
+        "comment": {
+          "description": "The comment attached to the model version",
+          "launch_stage": "GA"
+        },
+        "created_at": {
+          "launch_stage": "GA"
+        },
+        "created_by": {
+          "description": "The identifier of the user who created the model version",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "The unique identifier of the model version",
+          "launch_stage": "GA"
+        },
+        "metastore_id": {
+          "description": "The unique identifier of the metastore containing the model version",
+          "launch_stage": "GA"
+        },
+        "model_name": {
+          "description": "The name of the parent registered model of the model version, relative to parent schema",
+          "launch_stage": "GA"
+        },
+        "model_version_dependencies": {
+          "description": "Model version dependencies, for feature-store packaged models",
+          "ref": "catalog.DependencyList",
+          "launch_stage": "GA"
+        },
+        "run_id": {
+          "description": "MLflow run ID used when creating the model version, if ``source`` was generated by an\nexperiment run stored in an MLflow tracking server",
+          "launch_stage": "GA"
+        },
+        "run_workspace_id": {
+          "description": "ID of the Databricks workspace containing the MLflow run that generated this model\nversion, if applicable",
+          "launch_stage": "GA"
+        },
+        "schema_name": {
+          "description": "The name of the schema containing the model version, relative to parent catalog",
+          "launch_stage": "GA"
+        },
+        "source": {
+          "description": "URI indicating the location of the source artifacts (files) for the model version",
+          "launch_stage": "GA"
+        },
+        "status": {
+          "description": "Current status of the model version. Newly created model versions start in\nPENDING_REGISTRATION status, then move to READY status once the model version files are uploaded and\nthe model version is finalized. Only model versions in READY status can be loaded for inference or\nserved.",
+          "ref": "catalog.ModelVersionInfoStatus",
+          "launch_stage": "GA"
+        },
+        "storage_location": {
+          "description": "The storage location on the cloud under which model version data files are stored",
+          "launch_stage": "GA"
+        },
+        "updated_at": {
+          "launch_stage": "GA"
+        },
+        "updated_by": {
+          "description": "The identifier of the user who updated the model version last time",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.UpdateMonitor": {
+      "fields": {
+        "baseline_table_name": {
+          "description": "[Create:OPT Update:OPT] Baseline table name.\nBaseline data is used to compute drift from the data in the monitored `table_name`.\nThe baseline table and the monitored table shall have the same schema.",
+          "launch_stage": "GA"
+        },
+        "custom_metrics": {
+          "description": "[Create:OPT Update:OPT] Custom metrics.",
+          "launch_stage": "GA"
+        },
+        "dashboard_id": {
+          "description": "[Create:ERR Update:OPT] Id of dashboard that visualizes the computed metrics.\nThis can be empty if the monitor is in PENDING state.",
+          "launch_stage": "GA"
+        },
+        "data_classification_config": {
+          "description": "[Create:OPT Update:OPT] Data classification related config.",
+          "ref": "catalog.MonitorDataClassificationConfig",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "inference_log": {
+          "ref": "catalog.MonitorInferenceLog",
+          "launch_stage": "GA"
+        },
+        "latest_monitor_failure_msg": {
+          "description": "[Create:ERR Update:IGN] The latest error message for a monitor failure.",
+          "launch_stage": "GA"
+        },
+        "notifications": {
+          "description": "[Create:OPT Update:OPT] Field for specifying notification settings.",
+          "ref": "catalog.MonitorNotifications",
+          "launch_stage": "GA"
+        },
+        "output_schema_name": {
+          "description": "[Create:REQ Update:REQ] Schema where output tables are created. Needs to be in 2-level format {catalog}.{schema}",
+          "launch_stage": "GA"
+        },
+        "schedule": {
+          "description": "[Create:OPT Update:OPT] The monitor schedule.",
+          "ref": "catalog.MonitorCronSchedule",
+          "launch_stage": "GA"
+        },
+        "slicing_exprs": {
+          "description": "[Create:OPT Update:OPT] List of column expressions to slice data with for targeted analysis. The data is grouped by\neach expression independently, resulting in a separate slice for each predicate and its\ncomplements. For example `slicing_exprs=[“col_1”, “col_2 \u003e 10”]` will generate the following\nslices: two slices for `col_2 \u003e 10` (True and False), and one slice per unique value in\n`col1`. For high-cardinality columns, only the top 100 unique values by frequency will\ngenerate slices.",
+          "launch_stage": "GA"
+        },
+        "snapshot": {
+          "description": "Configuration for monitoring snapshot tables.",
+          "ref": "catalog.MonitorSnapshot",
+          "launch_stage": "GA"
+        },
+        "time_series": {
+          "description": "Configuration for monitoring time series tables.",
+          "ref": "catalog.MonitorTimeSeries",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.UpdatePermissions": {
+      "fields": {
+        "changes": {
+          "description": "Array of permissions change objects.",
+          "launch_stage": "GA"
+        },
+        "omit_permissions_in_response": {
+          "description": "Optional, default false. Specifies whether all the permissions should be returned in the response.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.UpdatePermissionsResponse": {
+      "fields": {
+        "privilege_assignments": {
+          "description": "The privileges assigned to each principal",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.UpdatePolicyRequest": {
+      "fields": {
+        "policy_info": {
+          "description": "Optional fields to update. This is the request body for updating a policy.\nUse `update_mask` field to specify which fields in the request is to be updated.\n- If `update_mask` is empty or \"*\", all specified fields will be updated.\n- If `update_mask` is specified, only the fields specified in the `update_mask` will be updated.\nIf a field is specified in `update_mask` and not set in the request, the field will be cleared.\nUsers can use the update mask to explicitly unset optional fields such as\n`exception_principals` and `when_condition`.",
+          "ref": "catalog.PolicyInfo",
+          "launch_stage": "GA"
+        },
+        "update_mask": {
+          "description": "Optional. The update mask field for specifying user intentions on which\nfields to update in the request.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "catalog.UpdateRegisteredModelRequest": {
+      "fields": {
+        "aliases": {
+          "description": "List of aliases associated with the registered model",
+          "launch_stage": "GA"
+        },
+        "browse_only": {
+          "description": "Indicates whether the principal is limited to retrieving metadata for the associated object through the BROWSE privilege when include_browse is enabled in the request.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "catalog_name": {
+          "description": "The name of the catalog where the schema and the registered model reside",
+          "launch_stage": "GA"
+        },
+        "comment": {
+          "description": "The comment attached to the registered model",
+          "launch_stage": "GA"
+        },
+        "created_at": {
+          "description": "Creation timestamp of the registered model in milliseconds since the Unix epoch",
+          "launch_stage": "GA"
+        },
+        "created_by": {
+          "description": "The identifier of the user who created the registered model",
+          "launch_stage": "GA"
+        },
+        "metastore_id": {
+          "description": "The unique identifier of the metastore",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The name of the registered model",
+          "launch_stage": "GA"
+        },
+        "new_name": {
+          "description": "New name for the registered model.",
+          "launch_stage": "GA"
+        },
+        "owner": {
+          "description": "The identifier of the user who owns the registered model",
+          "launch_stage": "GA"
+        },
+        "schema_name": {
+          "description": "The name of the schema where the registered model resides",
+          "launch_stage": "GA"
+        },
+        "storage_location": {
+          "description": "The storage location on the cloud under which model version data files are stored",
+          "launch_stage": "GA"
+        },
+        "updated_at": {
+          "description": "Last-update timestamp of the registered model in milliseconds since the Unix epoch",
+          "launch_stage": "GA"
+        },
+        "updated_by": {
+          "description": "The identifier of the user who updated the registered model last time",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.UpdateRequestExternalLineage": {
+      "fields": {
+        "columns": {
+          "description": "List of column relationships between source and target objects.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "id": {
+          "description": "Unique identifier of the external lineage relationship.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "properties": {
+          "description": "Key-value properties associated with the external lineage relationship.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "source": {
+          "description": "Source object of the external lineage relationship.",
+          "ref": "catalog.ExternalLineageObject",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "target": {
+          "description": "Target object of the external lineage relationship.",
+          "ref": "catalog.ExternalLineageObject",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "catalog.UpdateResponse": {},
+    "catalog.UpdateSchema": {
+      "fields": {
+        "comment": {
+          "description": "User-provided free-form text description.",
+          "launch_stage": "GA"
+        },
+        "custom_max_retention_hours": {
+          "description": "Custom maximum retention period in hours for the schema.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "enable_predictive_optimization": {
+          "description": "Whether predictive optimization should be enabled for this object and objects under it.",
+          "ref": "catalog.EnablePredictiveOptimization",
+          "launch_stage": "GA"
+        },
+        "new_name": {
+          "description": "New name for the schema.",
+          "launch_stage": "GA"
+        },
+        "owner": {
+          "description": "Username of current owner of schema.",
+          "launch_stage": "GA"
+        },
+        "properties": {
+          "description": "A map of key-value properties attached to the securable.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.UpdateSecretRequest": {
+      "fields": {
+        "secret": {
+          "description": "The secret object containing the fields to update. Only fields specified in **update_mask**\nwill be updated.",
+          "ref": "catalog.Secret",
+          "launch_stage": "GA"
+        },
+        "update_mask": {
+          "description": "The field mask specifying which fields of the secret to update.\n- If **update_mask** is **\"*\"**, all fields specified in **secret** are updated.\n- If **update_mask** specifies one or more fields, only those fields are updated.\nEach specified field must be set in **secret**.\nSupported fields: **value**, **comment**, **owner**, **expire_time**. To change the secret\nname, delete and recreate the secret.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.UpdateSkillRequest": {
+      "fields": {
+        "etag": {
+          "description": "Optimistic concurrency token from the most recent read. When set, the\nupdate succeeds only if the resource has not changed. Leave unset for an\nunconditional update. For REST requests, URL-encode the base64 string\nreturned by the API when setting the `etag` query parameter.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "skill": {
+          "description": "The skill with the updated field values. `name` identifies the resource\n(`skills/{catalog}.{schema}.{skill}`); only fields listed in `update_mask`\nare applied.",
+          "ref": "catalog.Skill",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "update_mask": {
+          "description": "Fields to update; validated against `skill`. REQUIRED, matching the sibling\nUpdate RPCs. `comment` is the only mutable field.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "catalog.UpdateStorageCredential": {
+      "fields": {
+        "aws_iam_role": {
+          "description": "The AWS IAM role configuration.",
+          "ref": "catalog.AwsIamRoleRequest",
+          "launch_stage": "GA"
+        },
+        "azure_managed_identity": {
+          "description": "The Azure managed identity configuration.",
+          "ref": "catalog.AzureManagedIdentityResponse",
+          "launch_stage": "GA"
+        },
+        "azure_service_principal": {
+          "description": "The Azure service principal configuration.",
+          "ref": "catalog.AzureServicePrincipal",
+          "launch_stage": "GA"
+        },
+        "cloudflare_api_token": {
+          "description": "The Cloudflare API token configuration.",
+          "ref": "catalog.CloudflareApiToken",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "comment": {
+          "description": "Comment associated with the credential.",
+          "launch_stage": "GA"
+        },
+        "databricks_gcp_service_account": {
+          "description": "The Databricks managed GCP service account configuration.",
+          "ref": "catalog.DatabricksGcpServiceAccountRequest",
+          "launch_stage": "GA"
+        },
+        "force": {
+          "description": "Force update even if there are dependent external locations or external\ntables.",
+          "launch_stage": "GA"
+        },
+        "isolation_mode": {
+          "description": "Whether the current securable is accessible from all workspaces or a\nspecific set of workspaces.",
+          "ref": "catalog.IsolationMode",
+          "launch_stage": "GA"
+        },
+        "new_name": {
+          "description": "New name for the storage credential.",
+          "launch_stage": "GA"
+        },
+        "owner": {
+          "description": "Username of current owner of credential.",
+          "launch_stage": "GA"
+        },
+        "read_only": {
+          "description": "Whether the credential is usable only for read operations. Only applicable\nwhen purpose is **STORAGE**.",
+          "launch_stage": "GA"
+        },
+        "skip_validation": {
+          "description": "Supplying true to this argument skips validation of the updated credential.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.UpdateTableRequest": {
+      "fields": {
+        "owner": {
+          "description": "Username of current owner of table.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "catalog.UpdateVolumeRequestContent": {
+      "fields": {
+        "comment": {
+          "description": "The comment attached to the volume",
+          "launch_stage": "GA"
+        },
+        "new_name": {
+          "description": "New name for the volume.",
+          "launch_stage": "GA"
+        },
+        "owner": {
+          "description": "The identifier of the user who owns the volume",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.UpdateWorkspaceBindings": {
+      "fields": {
+        "assign_workspaces": {
+          "description": "A list of workspace IDs.",
+          "launch_stage": "GA"
+        },
+        "unassign_workspaces": {
+          "description": "A list of workspace IDs.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.UpdateWorkspaceBindingsParameters": {
+      "fields": {
+        "add": {
+          "description": "List of workspace bindings to add. If a binding for the workspace already exists with a\ndifferent binding_type, adding it again with a new binding_type will update the existing\nbinding (e.g., from READ_WRITE to READ_ONLY).",
+          "launch_stage": "GA"
+        },
+        "remove": {
+          "description": "List of workspace bindings to remove.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.UpdateWorkspaceBindingsResponse": {
+      "description": "A list of workspace IDs that are bound to the securable",
+      "fields": {
+        "bindings": {
+          "description": "List of workspace bindings.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ValidateCredentialRequest": {
+      "fields": {
+        "aws_iam_role": {
+          "ref": "catalog.AwsIamRole",
+          "launch_stage": "GA"
+        },
+        "azure_managed_identity": {
+          "ref": "catalog.AzureManagedIdentity",
+          "launch_stage": "GA"
+        },
+        "credential_name": {
+          "description": "Required. The name of an existing credential or long-lived cloud\ncredential to validate.",
+          "launch_stage": "GA"
+        },
+        "databricks_gcp_service_account": {
+          "ref": "catalog.DatabricksGcpServiceAccount",
+          "launch_stage": "GA"
+        },
+        "external_location_name": {
+          "description": "The name of an existing external location to validate. Only applicable for\nstorage credentials (purpose is\n**STORAGE**.)",
+          "launch_stage": "GA"
+        },
+        "purpose": {
+          "description": "The purpose of the credential. This should only be used when the credential\nis specified.",
+          "ref": "catalog.CredentialPurpose",
+          "launch_stage": "GA"
+        },
+        "read_only": {
+          "description": "Whether the credential is only usable for read operations. Only applicable\nfor storage credentials (purpose is\n**STORAGE**.)",
+          "launch_stage": "GA"
+        },
+        "url": {
+          "description": "The external location url to validate. Only applicable when purpose is\n**STORAGE**.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ValidateCredentialResponse": {
+      "fields": {
+        "isDir": {
+          "description": "Whether the tested location is a directory in cloud storage. Only\napplicable for when purpose is **STORAGE**.",
+          "launch_stage": "GA"
+        },
+        "results": {
+          "description": "The results of the validation check.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ValidateCredentialResult": {
+      "description": "A enum represents the result of the file operation",
+      "enum": [
+        "PASS",
+        "FAIL",
+        "SKIP"
+      ],
+      "enum_launch_stages": {
+        "FAIL": "GA",
+        "PASS": "GA",
+        "SKIP": "GA"
+      }
+    },
+    "catalog.ValidateStorageCredential": {
+      "fields": {
+        "aws_iam_role": {
+          "description": "The AWS IAM role configuration.",
+          "ref": "catalog.AwsIamRoleRequest",
+          "launch_stage": "GA"
+        },
+        "azure_managed_identity": {
+          "description": "The Azure managed identity configuration.",
+          "ref": "catalog.AzureManagedIdentityRequest",
+          "launch_stage": "GA"
+        },
+        "azure_service_principal": {
+          "description": "The Azure service principal configuration.",
+          "ref": "catalog.AzureServicePrincipal",
+          "launch_stage": "GA"
+        },
+        "cloudflare_api_token": {
+          "description": "The Cloudflare API token configuration.",
+          "ref": "catalog.CloudflareApiToken",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "databricks_gcp_service_account": {
+          "description": "The Databricks created GCP service account configuration.",
+          "ref": "catalog.DatabricksGcpServiceAccountRequest",
+          "launch_stage": "GA"
+        },
+        "external_location_name": {
+          "description": "The name of an existing external location to validate.",
+          "launch_stage": "GA"
+        },
+        "read_only": {
+          "description": "Whether the storage credential is only usable for read operations.",
+          "launch_stage": "GA"
+        },
+        "storage_credential_name": {
+          "description": "Required. The name of an existing credential or long-lived cloud\ncredential to validate.",
+          "launch_stage": "GA"
+        },
+        "url": {
+          "description": "The external location url to validate.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ValidateStorageCredentialResponse": {
+      "fields": {
+        "isDir": {
+          "description": "Whether the tested location is a directory in cloud storage.",
+          "launch_stage": "GA"
+        },
+        "results": {
+          "description": "The results of the validation check.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ValidationResult": {
+      "fields": {
+        "message": {
+          "description": "Error message would exist when the result does not equal to **PASS**.",
+          "launch_stage": "GA"
+        },
+        "operation": {
+          "description": "The operation tested.",
+          "ref": "catalog.ValidationResultOperation",
+          "launch_stage": "GA"
+        },
+        "result": {
+          "description": "The results of the tested operation.",
+          "ref": "catalog.ValidationResultResult",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.ValidationResultOperation": {
+      "description": "A enum represents the file operation performed on the external location\nwith the storage credential",
+      "enum": [
+        "LIST",
+        "READ",
+        "WRITE",
+        "DELETE",
+        "PATH_EXISTS"
+      ],
+      "enum_launch_stages": {
+        "DELETE": "GA",
+        "LIST": "GA",
+        "PATH_EXISTS": "GA",
+        "READ": "GA",
+        "WRITE": "GA"
+      }
+    },
+    "catalog.ValidationResultResult": {
+      "description": "A enum represents the result of the file operation",
+      "enum": [
+        "PASS",
+        "FAIL",
+        "SKIP"
+      ],
+      "enum_launch_stages": {
+        "FAIL": "GA",
+        "PASS": "GA",
+        "SKIP": "GA"
+      }
+    },
+    "catalog.VolumeInfo": {
+      "fields": {
+        "access_point": {
+          "description": "The AWS access point to use when accesing s3 for this external location.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "browse_only": {
+          "description": "Indicates whether the principal is limited to retrieving metadata for the associated object through the BROWSE privilege when include_browse is enabled in the request.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "catalog_name": {
+          "description": "The name of the catalog where the schema and the volume are",
+          "launch_stage": "GA"
+        },
+        "comment": {
+          "description": "The comment attached to the volume",
+          "launch_stage": "GA"
+        },
+        "created_at": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "created_by": {
+          "description": "The identifier of the user who created the volume",
+          "launch_stage": "GA"
+        },
+        "encryption_details": {
+          "ref": "catalog.EncryptionDetails",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "full_name": {
+          "description": "The three-level (fully qualified) name of the volume",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "metastore_id": {
+          "description": "The unique identifier of the metastore",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "The name of the volume",
+          "launch_stage": "GA"
+        },
+        "owner": {
+          "description": "The identifier of the user who owns the volume",
+          "launch_stage": "GA"
+        },
+        "schema_name": {
+          "description": "The name of the schema where the volume is",
+          "launch_stage": "GA"
+        },
+        "storage_location": {
+          "description": "The storage location on the cloud",
+          "launch_stage": "GA"
+        },
+        "updated_at": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "updated_by": {
+          "description": "The identifier of the user who updated the volume last time",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "volume_id": {
+          "description": "The unique identifier of the volume",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "volume_type": {
+          "description": "The type of the volume. An external volume is located in the specified external location.\nA managed volume is located in the default location which is specified by the parent schema, or the parent catalog, or the Metastore.\n[Learn more](https://docs.databricks.com/aws/en/volumes/managed-vs-external)",
+          "ref": "catalog.VolumeType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.VolumeOperation": {
+      "enum": [
+        "READ_VOLUME",
+        "WRITE_VOLUME"
+      ],
+      "enum_launch_stages": {
+        "READ_VOLUME": "PUBLIC_PREVIEW",
+        "WRITE_VOLUME": "PUBLIC_PREVIEW"
+      }
+    },
+    "catalog.VolumeType": {
+      "enum": [
+        "MANAGED",
+        "EXTERNAL"
+      ],
+      "enum_launch_stages": {
+        "EXTERNAL": "GA",
+        "MANAGED": "GA"
+      }
+    },
+    "catalog.WorkspaceBinding": {
+      "fields": {
+        "binding_type": {
+          "description": "One of READ_WRITE/READ_ONLY. Default is READ_WRITE.",
+          "ref": "catalog.WorkspaceBindingBindingType",
+          "launch_stage": "GA"
+        },
+        "workspace_id": {
+          "description": "Required",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "catalog.WorkspaceBindingBindingType": {
+      "description": "Using `BINDING_TYPE_` prefix here to avoid conflict with `TableOperation` enum in `credentials_common.proto`.",
+      "enum": [
+        "BINDING_TYPE_READ_WRITE",
+        "BINDING_TYPE_READ_ONLY"
+      ],
+      "enum_launch_stages": {
+        "BINDING_TYPE_READ_ONLY": "GA",
+        "BINDING_TYPE_READ_WRITE": "GA"
+      }
+    },
+    "cleanrooms.CleanRoom": {
+      "fields": {
+        "access_restricted": {
+          "description": "Whether clean room access is restricted due to [CSP](https://docs.databricks.com/en/security/privacy/security-profile.html)",
+          "ref": "cleanrooms.CleanRoomAccessRestricted",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "comment": {
+          "launch_stage": "GA"
+        },
+        "created_at": {
+          "description": "When the clean room was created, in epoch milliseconds.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "enable_shared_output": {
+          "description": "Whether allow task to write to shared output schema.\nWhen enabled, clean room task runs triggered by the current collaborator\ncan write to the run-scoped shared output schema which is accessible by all collaborators.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "local_collaborator_alias": {
+          "description": "The alias of the collaborator tied to the local clean room.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "The name of the clean room.\nIt should follow [UC securable naming requirements](https://docs.databricks.com/en/data-governance/unity-catalog/index.html#securable-object-naming-requirements).",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "output_catalog": {
+          "description": "Output catalog of the clean room. It is an output only field. Output catalog is manipulated\nusing the separate CreateCleanRoomOutputCatalog API.",
+          "ref": "cleanrooms.CleanRoomOutputCatalog",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "owner": {
+          "description": "This is the Databricks username of the owner of the local clean room securable for permission management.",
+          "launch_stage": "GA"
+        },
+        "remote_detailed_info": {
+          "description": "Central clean room details. During creation, users need to specify\ncloud_vendor, region, and collaborators.global_metastore_id.\nThis field will not be filled in the ListCleanRooms call.",
+          "ref": "cleanrooms.CleanRoomRemoteDetail",
+          "launch_stage": "GA"
+        },
+        "status": {
+          "description": "Clean room status.",
+          "ref": "cleanrooms.CleanRoomStatusEnum",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "updated_at": {
+          "description": "When the clean room was last updated, in epoch milliseconds.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "cleanrooms.CleanRoomAccessRestricted": {
+      "enum": [
+        "NO_RESTRICTION",
+        "CSP_MISMATCH"
+      ],
+      "enum_launch_stages": {
+        "CSP_MISMATCH": "GA",
+        "NO_RESTRICTION": "GA"
+      }
+    },
+    "cleanrooms.CleanRoomAsset": {
+      "description": "Metadata of the clean room asset",
+      "fields": {
+        "added_at": {
+          "description": "When the asset is added to the clean room, in epoch milliseconds.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "asset_type": {
+          "description": "The type of the asset.",
+          "ref": "cleanrooms.CleanRoomAssetAssetType",
+          "launch_stage": "GA"
+        },
+        "clean_room_name": {
+          "description": "The name of the clean room this asset belongs to.\nThis field is required for create operations and populated by the server for responses.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "foreign_table": {
+          "description": "Foreign table details available to all collaborators of the clean room.\nPresent if and only if **asset_type** is **FOREIGN_TABLE**",
+          "ref": "cleanrooms.CleanRoomAssetForeignTable",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "foreign_table_local_details": {
+          "description": "Local details for a foreign that are only available to its owner.\nPresent if and only if **asset_type** is **FOREIGN_TABLE**",
+          "ref": "cleanrooms.CleanRoomAssetForeignTableLocalDetails",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "jar_analysis": {
+          "description": "Jar analysis details available to all collaborators of the clean room.\nPresent if and only if **asset_type** is **JAR_ANALYSIS**",
+          "ref": "cleanrooms.CleanRoomAssetJarAnalysis",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "name": {
+          "description": "A fully qualified name that uniquely identifies the asset within the clean room.\nThis is also the name displayed in the clean room UI.\n\nFor UC securable assets (tables, volumes, etc.), the format is *shared_catalog*.*shared_schema*.*asset_name*\n\nFor notebooks, the name is the notebook file name.\nFor jar analyses, the name is the jar analysis name.\nFor Genie spaces, the name is derived from the clean room; the caller does not choose it.",
+          "launch_stage": "GA"
+        },
+        "notebook": {
+          "description": "Notebook details available to all collaborators of the clean room.\nPresent if and only if **asset_type** is **NOTEBOOK_FILE**",
+          "ref": "cleanrooms.CleanRoomAssetNotebook",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "owner_collaborator_alias": {
+          "description": "The alias of the collaborator who owns this asset",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "status": {
+          "description": "Status of the asset",
+          "ref": "cleanrooms.CleanRoomAssetStatusEnum",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "table": {
+          "description": "Table details available to all collaborators of the clean room.\nPresent if and only if **asset_type** is **TABLE** or **STREAMING_TABLE**",
+          "ref": "cleanrooms.CleanRoomAssetTable",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "table_local_details": {
+          "description": "Local details for a table that are only available to its owner.\nPresent if and only if **asset_type** is **TABLE** or **STREAMING_TABLE**",
+          "ref": "cleanrooms.CleanRoomAssetTableLocalDetails",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "view": {
+          "description": "View details available to all collaborators of the clean room.\nPresent if and only if **asset_type** is **VIEW** or **METRIC_VIEW**",
+          "ref": "cleanrooms.CleanRoomAssetView",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "view_local_details": {
+          "description": "Local details for a view that are only available to its owner.\nPresent if and only if **asset_type** is **VIEW** or **METRIC_VIEW**",
+          "ref": "cleanrooms.CleanRoomAssetViewLocalDetails",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "volume_local_details": {
+          "description": "Local details for a volume that are only available to its owner.\nPresent if and only if **asset_type** is **VOLUME**",
+          "ref": "cleanrooms.CleanRoomAssetVolumeLocalDetails",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "cleanrooms.CleanRoomAssetAssetType": {
+      "enum": [
+        "TABLE",
+        "NOTEBOOK_FILE",
+        "VOLUME",
+        "VIEW",
+        "FOREIGN_TABLE",
+        "JAR_ANALYSIS"
+      ],
+      "enum_launch_stages": {
+        "FOREIGN_TABLE": "GA",
+        "JAR_ANALYSIS": "PUBLIC_PREVIEW",
+        "NOTEBOOK_FILE": "GA",
+        "TABLE": "GA",
+        "VIEW": "GA",
+        "VOLUME": "GA"
+      }
+    },
+    "cleanrooms.CleanRoomAssetForeignTable": {
+      "fields": {
+        "columns": {
+          "description": "The metadata information of the columns in the foreign table",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "cleanrooms.CleanRoomAssetForeignTableLocalDetails": {
+      "fields": {
+        "local_name": {
+          "description": "The fully qualified name of the foreign table in its owner's local metastore,\nin the format of *catalog*.*schema*.*foreign_table_name*",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "cleanrooms.CleanRoomAssetJarAnalysis": {
+      "fields": {
+        "central_jar_file_paths": {
+          "description": "The full paths in central to the jar files that are added to the library during execution (e.g. /Volumes/creator/schema/volume/folder/my_jar_file.jar)\nOnly returned for the owner collaborator.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "description": {
+          "description": "Optional description of the jar analysis shown to all collaborators.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "environment_version": {
+          "description": "The serverless environment version used to execute the JAR analysis (e.g. \"4\").\nIf not specified, uses the service-configured JAR analysis default.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "etag": {
+          "description": "Server generated etag that represents the jar analysis version.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "main_class_name": {
+          "description": "The full name of the class containing the main method to be executed. This class must be contained in a JAR provided as a library\nThe code must use `SparkContext.getOrCreate` to obtain a Spark context; otherwise, runs of the job fail",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "review_state": {
+          "description": "Top-level status derived from all reviews.",
+          "ref": "cleanrooms.CleanRoomJarAnalysisReviewJarAnalysisReviewState",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "reviews": {
+          "description": "All existing approvals or rejections.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "runner_collaborator_aliases": {
+          "description": "Collaborators that can run the jar.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "cleanrooms.CleanRoomAssetNotebook": {
+      "fields": {
+        "description": {
+          "description": "Optional description of the notebook shown to all collaborators.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "environment_version": {
+          "description": "The serverless environment version used to execute the notebook (e.g. \"4\").\nDefaults to \"2\" if not specified.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "etag": {
+          "description": "Server generated etag that represents the notebook version.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "notebook_content": {
+          "description": "Base 64 representation of the notebook contents.\nThis is the same format as returned by [workspace/export](https://docs.databricks.com/api/workspace/workspace/export) with the format of **HTML**.",
+          "launch_stage": "GA"
+        },
+        "review_state": {
+          "description": "Top-level status derived from all reviews",
+          "ref": "cleanrooms.CleanRoomNotebookReviewNotebookReviewState",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "reviews": {
+          "description": "All existing approvals or rejections",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "runner_collaborator_aliases": {
+          "description": "Aliases of collaborators that can run the notebook.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "cleanrooms.CleanRoomAssetStatusEnum": {
+      "enum": [
+        "ACTIVE",
+        "PERMISSION_DENIED",
+        "PENDING"
+      ],
+      "enum_launch_stages": {
+        "ACTIVE": "GA",
+        "PENDING": "GA",
+        "PERMISSION_DENIED": "GA"
+      }
+    },
+    "cleanrooms.CleanRoomAssetTable": {
+      "fields": {
+        "columns": {
+          "description": "The metadata information of the columns in the table",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "cleanrooms.CleanRoomAssetTableLocalDetails": {
+      "fields": {
+        "local_name": {
+          "description": "The fully qualified name of the table in its owner's local metastore,\nin the format of *catalog*.*schema*.*table_name*",
+          "launch_stage": "GA"
+        },
+        "partitions": {
+          "description": "Partition filtering specification for a shared table.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "cleanrooms.CleanRoomAssetView": {
+      "fields": {
+        "columns": {
+          "description": "The metadata information of the columns in the view",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "cleanrooms.CleanRoomAssetViewLocalDetails": {
+      "fields": {
+        "local_name": {
+          "description": "The fully qualified name of the view in its owner's local metastore,\nin the format of *catalog*.*schema*.*view_name*",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "cleanrooms.CleanRoomAssetVolumeLocalDetails": {
+      "fields": {
+        "local_name": {
+          "description": "The fully qualified name of the volume in its owner's local metastore,\nin the format of *catalog*.*schema*.*volume_name*",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "cleanrooms.CleanRoomAutoApprovalRule": {
+      "fields": {
+        "author_collaborator_alias": {
+          "description": "Collaborator alias of the author covered by the rule.\nOnly one of `author_collaborator_alias` and `author_scope` can be set.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "author_scope": {
+          "description": "Scope of authors covered by the rule.\nOnly one of `author_collaborator_alias` and `author_scope` can be set.",
+          "ref": "cleanrooms.CleanRoomAutoApprovalRuleAuthorScope",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "clean_room_name": {
+          "description": "The name of the clean room this auto-approval rule belongs to.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "created_at": {
+          "description": "Timestamp of when the rule was created, in epoch milliseconds.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "rule_id": {
+          "description": "A generated UUID identifying the rule.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "rule_owner_collaborator_alias": {
+          "description": "The owner of the rule to whom the rule applies.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "runner_collaborator_alias": {
+          "description": "Collaborator alias of the runner covered by the rule.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "cleanrooms.CleanRoomAutoApprovalRuleAuthorScope": {
+      "enum": [
+        "ANY_AUTHOR"
+      ],
+      "enum_launch_stages": {
+        "ANY_AUTHOR": "PUBLIC_BETA"
+      }
+    },
+    "cleanrooms.CleanRoomCollaborator": {
+      "description": "Publicly visible clean room collaborator.",
+      "fields": {
+        "collaborator_alias": {
+          "description": "Collaborator alias specified by the clean room creator. It is unique across all collaborators of this clean room, and used to derive\nmultiple values internally such as catalog alias and clean room name for single metastore clean rooms.\nIt should follow [UC securable naming requirements](https://docs.databricks.com/en/data-governance/unity-catalog/index.html#securable-object-naming-requirements).",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "display_name": {
+          "description": "Generated display name for the collaborator. In the case of a single metastore clean room, it is the clean\nroom name. For x-metastore clean rooms, it is the organization name of the metastore. It is not restricted to\nthese values and could change in the future",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "global_metastore_id": {
+          "description": "The global Unity Catalog metastore ID of the collaborator. The identifier is of format cloud:region:metastore-uuid.",
+          "launch_stage": "GA"
+        },
+        "invite_recipient_email": {
+          "description": "Email of the user who is receiving the clean room \"invitation\". It should be empty\nfor the creator of the clean room, and non-empty for the invitees of the clean room.\nIt is only returned in the output when clean room creator calls GET",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "invite_recipient_workspace_id": {
+          "description": "Workspace ID of the user who is receiving the clean room \"invitation\". Must be specified if\ninvite_recipient_email is specified.\nIt should be empty when the collaborator is the creator of the clean room.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "INPUT_ONLY"
+          ]
+        },
+        "organization_name": {
+          "description": "[Organization name](:method:metastores/list#metastores-delta_sharing_organization_name)\nconfigured in the metastore",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "cleanrooms.CleanRoomJarAnalysisReview": {
+      "description": "This only applies to a JAR Analysis as a first-class asset in the Clean Room, and not to Volumes",
+      "fields": {
+        "comment": {
+          "description": "review comment",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "created_at_millis": {
+          "description": "timestamp of when the review was submitted",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "review_state": {
+          "description": "review outcome",
+          "ref": "cleanrooms.CleanRoomJarAnalysisReviewJarAnalysisReviewState",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "review_sub_reason": {
+          "description": "specified when the review was not explicitly made by a user",
+          "ref": "cleanrooms.CleanRoomJarAnalysisReviewJarAnalysisReviewSubReason",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "reviewer_collaborator_alias": {
+          "description": "collaborator alias of the reviewer",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "cleanrooms.CleanRoomJarAnalysisReviewJarAnalysisReviewState": {
+      "enum": [
+        "APPROVED",
+        "REJECTED",
+        "PENDING"
+      ],
+      "enum_launch_stages": {
+        "APPROVED": "PUBLIC_PREVIEW",
+        "PENDING": "PUBLIC_PREVIEW",
+        "REJECTED": "PUBLIC_PREVIEW"
+      }
+    },
+    "cleanrooms.CleanRoomJarAnalysisReviewJarAnalysisReviewSubReason": {
+      "enum": [
+        "AUTO_APPROVED"
+      ],
+      "enum_launch_stages": {
+        "AUTO_APPROVED": "PUBLIC_PREVIEW"
+      }
+    },
+    "cleanrooms.CleanRoomNotebookReview": {
+      "fields": {
+        "comment": {
+          "description": "Review comment",
+          "launch_stage": "GA"
+        },
+        "created_at_millis": {
+          "description": "When the review was submitted, in epoch milliseconds",
+          "launch_stage": "GA"
+        },
+        "review_state": {
+          "description": "Review outcome",
+          "ref": "cleanrooms.CleanRoomNotebookReviewNotebookReviewState",
+          "launch_stage": "GA"
+        },
+        "review_sub_reason": {
+          "description": "Specified when the review was not explicitly made by a user",
+          "ref": "cleanrooms.CleanRoomNotebookReviewNotebookReviewSubReason",
+          "launch_stage": "GA"
+        },
+        "reviewer_collaborator_alias": {
+          "description": "Collaborator alias of the reviewer",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "cleanrooms.CleanRoomNotebookReviewNotebookReviewState": {
+      "enum": [
+        "APPROVED",
+        "REJECTED",
+        "PENDING"
+      ],
+      "enum_launch_stages": {
+        "APPROVED": "GA",
+        "PENDING": "GA",
+        "REJECTED": "GA"
+      }
+    },
+    "cleanrooms.CleanRoomNotebookReviewNotebookReviewSubReason": {
+      "enum": [
+        "BACKFILLED",
+        "AUTO_APPROVED"
+      ],
+      "enum_launch_stages": {
+        "AUTO_APPROVED": "GA",
+        "BACKFILLED": "GA"
+      }
+    },
+    "cleanrooms.CleanRoomNotebookTaskRun": {
+      "description": "Stores information about a single task run.",
+      "fields": {
+        "collaborator_job_run_info": {
+          "description": "Job run info of the task in the runner's local workspace.\nThis field is only included in the LIST API.\nif the task was run within the same workspace the API is being called.\nIf the task run was in a different workspace under the same metastore, only the workspace_id is included.",
+          "ref": "cleanrooms.CollaboratorJobRunInfo",
+          "launch_stage": "GA"
+        },
+        "notebook_etag": {
+          "description": "Etag of the notebook executed in this task run, used to identify the notebook version.",
+          "launch_stage": "GA"
+        },
+        "notebook_job_run_state": {
+          "description": "State of the task run.",
+          "ref": "jobs.CleanRoomTaskRunState",
+          "launch_stage": "GA"
+        },
+        "notebook_name": {
+          "description": "Asset name of the notebook executed in this task run.",
+          "launch_stage": "GA"
+        },
+        "notebook_updated_at": {
+          "description": "The timestamp of when the notebook was last updated.",
+          "launch_stage": "GA"
+        },
+        "output_schema_expiration_time": {
+          "description": "Expiration time of the output schema of the task run (if any), in epoch milliseconds.",
+          "launch_stage": "GA"
+        },
+        "output_schema_name": {
+          "description": "Name of the output schema associated with the clean rooms notebook task run.",
+          "launch_stage": "GA"
+        },
+        "run_duration": {
+          "description": "Duration of the task run, in milliseconds.",
+          "launch_stage": "GA"
+        },
+        "shared_output_schema_expiration_time": {
+          "description": "Expiration time of the shared output schema of the task run (if any), in epoch milliseconds.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "shared_output_schema_name": {
+          "description": "Name of the shared output schema associated with the clean rooms notebook task run.\nThis schema is accessible by all collaborators when enable_shared_output is true.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "start_time": {
+          "description": "When the task run started, in epoch milliseconds.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "cleanrooms.CleanRoomOutputCatalog": {
+      "fields": {
+        "catalog_name": {
+          "description": "The name of the output catalog in UC.\nIt should follow [UC securable naming requirements](https://docs.databricks.com/en/data-governance/unity-catalog/index.html#securable-object-naming-requirements).\nThe field will always exist if status is CREATED.",
+          "launch_stage": "GA"
+        },
+        "status": {
+          "ref": "cleanrooms.CleanRoomOutputCatalogOutputCatalogStatus",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "cleanrooms.CleanRoomOutputCatalogOutputCatalogStatus": {
+      "enum": [
+        "NOT_ELIGIBLE",
+        "NOT_CREATED",
+        "CREATED"
+      ],
+      "enum_launch_stages": {
+        "CREATED": "GA",
+        "NOT_CREATED": "GA",
+        "NOT_ELIGIBLE": "GA"
+      }
+    },
+    "cleanrooms.CleanRoomRemoteDetail": {
+      "description": "Publicly visible central clean room details.",
+      "fields": {
+        "central_clean_room_id": {
+          "description": "Central clean room ID.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "cloud_vendor": {
+          "description": "Cloud vendor (aws,azure,gcp) of the central clean room.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "collaborators": {
+          "description": "Collaborators in the central clean room. There should one and only one collaborator\nin the list that satisfies the owner condition:\n\n1. It has the creator's global_metastore_id (determined by caller of CreateCleanRoom).\n\n2. Its invite_recipient_email is empty.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "compliance_security_profile": {
+          "ref": "cleanrooms.ComplianceSecurityProfile",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "creator": {
+          "description": "Collaborator who creates the clean room.",
+          "ref": "cleanrooms.CleanRoomCollaborator",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "egress_network_policy": {
+          "description": "Egress network policy to apply to the central clean room workspace.",
+          "ref": "settings.EgressNetworkPolicy",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "enable_shared_output": {
+          "description": "Whether to enable shared output for the central clean room.\nWhen enabled, clean room task runs can write to the run-scoped shared output schema\nwhich is accessible by all collaborators.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "package_provider_collaborator_alias": {
+          "description": "Alias of the provider collaborator. If set, packaged clean rooms mode is enabled.\nThe consumer's experience is restricted: they can view notebook names and READMEs,\nadd their own data assets, and trigger runs, but cannot view notebook code,\nprovider data assets, or notebook run output.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "region": {
+          "description": "Region of the central clean room.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        }
+      }
+    },
+    "cleanrooms.CleanRoomStatusEnum": {
+      "enum": [
+        "ACTIVE",
+        "PROVISIONING",
+        "DELETED",
+        "FAILED"
+      ],
+      "enum_launch_stages": {
+        "ACTIVE": "GA",
+        "DELETED": "GA",
+        "FAILED": "GA",
+        "PROVISIONING": "GA"
+      }
+    },
+    "cleanrooms.CleanRoomTaskRun": {
+      "description": "Stores information about a single task run.",
+      "fields": {
+        "analysis_details": {
+          "description": "Information about the analysis run (etag, updated at)",
+          "ref": "cleanrooms.CleanRoomTaskRunCleanRoomTaskAnalysisDetails",
+          "launch_stage": "GA"
+        },
+        "collaborator_job_run_info": {
+          "description": "Job run info of the task in the runner's local workspace.\nThis field is only included in the LIST API if the task was run within the same workspace the API is being called.\nIf the task run was in a different workspace under the same metastore, only the workspace_id is included.",
+          "ref": "cleanrooms.CollaboratorJobRunInfo",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of the executable.",
+          "launch_stage": "GA"
+        },
+        "output_info": {
+          "description": "Information about run output",
+          "ref": "cleanrooms.CleanRoomTaskRunOutputInfo",
+          "launch_stage": "GA"
+        },
+        "run_duration": {
+          "description": "Duration of the task run, in milliseconds.",
+          "launch_stage": "GA"
+        },
+        "shared_output_info": {
+          "description": "Information about shared output accessible by all collaborators.\nThis field is only populated when enable_shared_output is true.",
+          "ref": "cleanrooms.CleanRoomTaskRunOutputInfo",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "start_time": {
+          "description": "When the task run started, in epoch milliseconds.",
+          "launch_stage": "GA"
+        },
+        "task_run_state": {
+          "description": "State of the task run.",
+          "ref": "jobs.CleanRoomTaskRunState",
+          "launch_stage": "GA"
+        },
+        "task_type": {
+          "description": "The type of Clean Room task.",
+          "ref": "cleanrooms.CleanRoomTaskType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "cleanrooms.CleanRoomTaskRunCleanRoomTaskAnalysisDetails": {
+      "fields": {
+        "etag": {
+          "description": "Etag of the asset executed in this task run, used to identify the asset version.",
+          "launch_stage": "GA"
+        },
+        "updated_at": {
+          "description": "The timestamp of when the asset was last updated.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "cleanrooms.CleanRoomTaskRunOutputInfo": {
+      "fields": {
+        "output_schema_expiration_time": {
+          "description": "Expiration time of the output schema of the task run (if any), in epoch milliseconds.",
+          "launch_stage": "GA"
+        },
+        "output_schema_name": {
+          "description": "Name of the output schema associated with the clean room task run.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "cleanrooms.CleanRoomTaskType": {
+      "enum": [
+        "NOTEBOOK",
+        "JAR"
+      ],
+      "enum_launch_stages": {
+        "JAR": "GA",
+        "NOTEBOOK": "GA"
+      }
+    },
+    "cleanrooms.CollaboratorJobRunInfo": {
+      "fields": {
+        "collaborator_alias": {
+          "description": "Alias of the collaborator that triggered the task run.",
+          "launch_stage": "GA"
+        },
+        "collaborator_job_id": {
+          "description": "Job ID of the task run in the collaborator's workspace.",
+          "launch_stage": "GA"
+        },
+        "collaborator_job_run_id": {
+          "description": "Job run ID of the task run in the collaborator's workspace.",
+          "launch_stage": "GA"
+        },
+        "collaborator_task_run_id": {
+          "description": "Task run ID of the task run in the collaborator's workspace.",
+          "launch_stage": "GA"
+        },
+        "collaborator_workspace_id": {
+          "description": "ID of the collaborator's workspace that triggered the task run.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "cleanrooms.ComplianceSecurityProfile": {
+      "description": "The compliance security profile used to process regulated data following compliance standards.",
+      "fields": {
+        "compliance_standards": {
+          "description": "The list of compliance standards that the compliance security profile is configured to enforce.",
+          "launch_stage": "GA"
+        },
+        "is_enabled": {
+          "description": "Whether the compliance security profile is enabled.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "cleanrooms.CreateCleanRoomAssetRequest": {
+      "fields": {
+        "asset": {
+          "ref": "cleanrooms.CleanRoomAsset",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "cleanrooms.CreateCleanRoomAssetReviewRequest": {
+      "fields": {
+        "jar_analysis_review": {
+          "ref": "cleanrooms.JarAnalysisVersionReview",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "notebook_review": {
+          "ref": "cleanrooms.NotebookVersionReview",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "cleanrooms.CreateCleanRoomAssetReviewResponse": {
+      "fields": {
+        "jar_analysis_review_state": {
+          "description": "top-level status derived from all reviews",
+          "ref": "cleanrooms.CleanRoomJarAnalysisReviewJarAnalysisReviewState",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "jar_analysis_reviews": {
+          "description": "All existing jar analysis approvals or rejections",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "notebook_review_state": {
+          "description": "Top-level status derived from all reviews",
+          "ref": "cleanrooms.CleanRoomNotebookReviewNotebookReviewState",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "notebook_reviews": {
+          "description": "All existing notebook approvals or rejections",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "cleanrooms.CreateCleanRoomAutoApprovalRuleRequest": {
+      "fields": {
+        "auto_approval_rule": {
+          "ref": "cleanrooms.CleanRoomAutoApprovalRule",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "cleanrooms.CreateCleanRoomOutputCatalogRequest": {
+      "fields": {
+        "output_catalog": {
+          "ref": "cleanrooms.CleanRoomOutputCatalog",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "cleanrooms.CreateCleanRoomOutputCatalogResponse": {
+      "fields": {
+        "output_catalog": {
+          "ref": "cleanrooms.CleanRoomOutputCatalog",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "cleanrooms.CreateCleanRoomRequest": {
+      "fields": {
+        "clean_room": {
+          "ref": "cleanrooms.CleanRoom",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "cleanrooms.DeleteCleanRoomAssetRequest": {},
+    "cleanrooms.DeleteCleanRoomAssetResponse": {
+      "description": "Response for delete clean room request. Using an empty message since the generic Empty proto does not externd\nUnshadedMessageMarker."
+    },
+    "cleanrooms.DeleteCleanRoomAutoApprovalRuleRequest": {},
+    "cleanrooms.DeleteCleanRoomRequest": {},
+    "cleanrooms.GetCleanRoomAssetRequest": {},
+    "cleanrooms.GetCleanRoomAssetRevisionRequest": {},
+    "cleanrooms.GetCleanRoomAutoApprovalRuleRequest": {},
+    "cleanrooms.GetCleanRoomRequest": {},
+    "cleanrooms.JarAnalysisVersionReview": {
+      "fields": {
+        "comment": {
+          "description": "Review comment",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "etag": {
+          "description": "Etag identifying the jar analysis version, with its value being a hash of an internally-generated UUID",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "review_state": {
+          "description": "Review outcome",
+          "ref": "cleanrooms.CleanRoomJarAnalysisReviewJarAnalysisReviewState",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "cleanrooms.ListCleanRoomAssetRevisionsRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Maximum number of asset revisions to return. Defaults to 10.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Opaque pagination token to go to next page based on the previous query.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "cleanrooms.ListCleanRoomAssetRevisionsResponse": {
+      "fields": {
+        "next_page_token": {
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "revisions": {
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "cleanrooms.ListCleanRoomAssetsRequest": {
+      "fields": {
+        "page_token": {
+          "description": "Opaque pagination token to go to next page based on previous query.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "cleanrooms.ListCleanRoomAssetsResponse": {
+      "fields": {
+        "assets": {
+          "description": "Assets in the clean room.",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "Opaque token to retrieve the next page of results. Absent if there are no more pages.\npage_token should be set to this value for the next request (for the next page of results).",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "cleanrooms.ListCleanRoomAutoApprovalRulesRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Maximum number of auto-approval rules to return. Defaults to 100.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Opaque pagination token to go to next page based on previous query.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "cleanrooms.ListCleanRoomAutoApprovalRulesResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "Opaque token to retrieve the next page of results. Absent if there are no more pages.\npage_token should be set to this value for the next request (for the next page of results).",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "rules": {
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "cleanrooms.ListCleanRoomNotebookTaskRunsRequest": {
+      "fields": {
+        "notebook_name": {
+          "description": "Notebook name",
+          "launch_stage": "GA"
+        },
+        "page_size": {
+          "description": "The maximum number of task runs to return. Currently ignored - all runs will be returned.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Opaque pagination token to go to next page based on previous query.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "cleanrooms.ListCleanRoomNotebookTaskRunsResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "Opaque token to retrieve the next page of results. Absent if there are no more pages.\npage_token should be set to this value for the next request (for the next page of results).",
+          "launch_stage": "GA"
+        },
+        "runs": {
+          "description": "Name of the clean room.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "cleanrooms.ListCleanRoomTaskRunsRequest": {
+      "fields": {
+        "name": {
+          "description": "Executable name.",
+          "launch_stage": "GA"
+        },
+        "page_size": {
+          "description": "The maximum number of task runs to return. Maximum value of 100.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Opaque pagination token to go to next page based on previous query.",
+          "launch_stage": "GA"
+        },
+        "task_type": {
+          "description": "Filter by the type of Clean Room task.",
+          "ref": "cleanrooms.CleanRoomTaskType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "cleanrooms.ListCleanRoomTaskRunsResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "Opaque token to retrieve the next page of results. Absent if there are no more pages.\npage_token should be set to this value for the next request (for the next page of results).",
+          "launch_stage": "GA"
+        },
+        "runs": {
+          "description": "Task runs in the clean room.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "cleanrooms.ListCleanRoomsRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Maximum number of clean rooms to return (i.e., the page length). Defaults to 100.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Opaque pagination token to go to next page based on previous query.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "cleanrooms.ListCleanRoomsResponse": {
+      "fields": {
+        "clean_rooms": {
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "Opaque token to retrieve the next page of results. Absent if there are no more pages.\npage_token should be set to this value for the next request (for the next page of results).",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "cleanrooms.NotebookVersionReview": {
+      "fields": {
+        "comment": {
+          "description": "Review comment",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "etag": {
+          "description": "Etag identifying the notebook version",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "review_state": {
+          "description": "Review outcome",
+          "ref": "cleanrooms.CleanRoomNotebookReviewNotebookReviewState",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "cleanrooms.UpdateCleanRoomAssetRequest": {
+      "fields": {
+        "asset": {
+          "description": "The asset to update.\nThe asset's `name` and `asset_type` fields are used to identify the asset to update.",
+          "ref": "cleanrooms.CleanRoomAsset",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "cleanrooms.UpdateCleanRoomAutoApprovalRuleRequest": {
+      "fields": {
+        "auto_approval_rule": {
+          "description": "The auto-approval rule to update. The rule_id field is used to identify the rule to update.",
+          "ref": "cleanrooms.CleanRoomAutoApprovalRule",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "cleanrooms.UpdateCleanRoomRequest": {
+      "fields": {
+        "clean_room": {
+          "ref": "cleanrooms.CleanRoom",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.AddInstanceProfile": {
+      "fields": {
+        "iam_role_arn": {
+          "description": "The AWS IAM role ARN of the role associated with the instance profile.\nThis field is required if your role name and instance profile name do\nnot match and you want to use the instance profile with\n[Databricks SQL Serverless](https://docs.databricks.com/sql/admin/serverless.html).\n\nOtherwise, this field is optional.",
+          "launch_stage": "GA"
+        },
+        "instance_profile_arn": {
+          "description": "The AWS ARN of the instance profile to register with Databricks. This field is required.",
+          "launch_stage": "GA"
+        },
+        "is_meta_instance_profile": {
+          "description": "Boolean flag indicating whether the instance profile should only be used in credential\npassthrough scenarios. If true, it means the instance profile contains an meta IAM role\nwhich could assume a wide range of roles. Therefore it should always be used with\nauthorization.\nThis field is optional, the default value is `false`.",
+          "launch_stage": "GA"
+        },
+        "skip_validation": {
+          "description": "By default, Databricks validates that it has sufficient permissions to launch\ninstances with the instance profile. This validation uses AWS dry-run mode for\nthe RunInstances API. If validation fails with an error message that does not\nindicate an IAM related permission issue,\n(e.g. “Your requested instance type is not supported in your requested availability zone”),\nyou can pass this flag to skip the validation and forcibly add the instance profile.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.AddResponse": {},
+    "compute.Adlsgen2Info": {
+      "description": "A storage location in Adls Gen2",
+      "fields": {
+        "destination": {
+          "description": "abfss destination, e.g. `abfss://\u003ccontainer-name\u003e@\u003cstorage-account-name\u003e.dfs.core.windows.net/\u003cdirectory-name\u003e`.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.AutoScale": {
+      "fields": {
+        "max_workers": {
+          "description": "The maximum number of workers to which the cluster can scale up when overloaded.\nNote that `max_workers` must be strictly greater than `min_workers`.",
+          "launch_stage": "GA"
+        },
+        "min_workers": {
+          "description": "The minimum number of workers to which the cluster can scale down when underutilized.\nIt is also the initial number of workers the cluster will have after creation.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.AwsAttributes": {
+      "description": "Attributes set during cluster creation which are related to Amazon Web Services.",
+      "fields": {
+        "availability": {
+          "ref": "compute.AwsAvailability",
+          "launch_stage": "GA"
+        },
+        "ebs_volume_count": {
+          "description": "The number of volumes launched for each instance. Users can choose up to 10 volumes.\nThis feature is only enabled for supported node types. Legacy node types cannot specify\ncustom EBS volumes.\nFor node types with no instance store, at least one EBS volume needs to be specified;\notherwise, cluster creation will fail.\n\nThese EBS volumes will be mounted at `/ebs0`, `/ebs1`, and etc.\nInstance store volumes will be mounted at `/local_disk0`, `/local_disk1`, and etc.\n\nIf EBS volumes are attached, Databricks will configure Spark to use only the EBS volumes for\nscratch storage because heterogenously sized scratch devices can lead to inefficient disk\nutilization. If no EBS volumes are attached, Databricks will configure Spark to use instance\nstore volumes.\n\nPlease note that if EBS volumes are specified, then the Spark configuration `spark.local.dir`\nwill be overridden.",
+          "launch_stage": "GA"
+        },
+        "ebs_volume_iops": {
+          "description": "If using gp3 volumes, what IOPS to use for the disk. If this is not set, the maximum performance of a gp2 volume with the same volume size will be used.",
+          "launch_stage": "GA"
+        },
+        "ebs_volume_size": {
+          "description": "The size of each EBS volume (in GiB) launched for each instance. For general purpose\nSSD, this value must be within the range 100 - 4096. For throughput optimized HDD,\nthis value must be within the range 500 - 4096.",
+          "launch_stage": "GA"
+        },
+        "ebs_volume_throughput": {
+          "description": "If using gp3 volumes, what throughput to use for the disk. If this is not set, the maximum performance of a gp2 volume with the same volume size will be used.",
+          "launch_stage": "GA"
+        },
+        "ebs_volume_type": {
+          "description": "The type of EBS volumes that will be launched with this cluster.",
+          "ref": "compute.EbsVolumeType",
+          "launch_stage": "GA"
+        },
+        "first_on_demand": {
+          "description": "The first `first_on_demand` nodes of the cluster will be placed on on-demand instances.\nIf this value is greater than 0, the cluster driver node in particular will be placed on an\non-demand instance. If this value is greater than or equal to the current cluster size, all\nnodes will be placed on on-demand instances. If this value is less than the current cluster\nsize, `first_on_demand` nodes will be placed on on-demand instances and the remainder will\nbe placed on `availability` instances. Note that this value does not affect\ncluster size and cannot currently be mutated over the lifetime of a cluster.",
+          "launch_stage": "GA"
+        },
+        "instance_profile_arn": {
+          "description": "Nodes for this cluster will only be placed on AWS instances with this instance profile. If\nommitted, nodes will be placed on instances without an IAM instance profile. The instance\nprofile must have previously been added to the Databricks environment by an account\nadministrator.\n\nThis feature may only be available to certain customer plans.",
+          "launch_stage": "GA"
+        },
+        "spot_bid_price_percent": {
+          "description": "The bid price for AWS spot instances, as a percentage of the corresponding instance type's\non-demand price.\nFor example, if this field is set to 50, and the cluster needs a new `r3.xlarge` spot\ninstance, then the bid price is half of the price of\non-demand `r3.xlarge` instances. Similarly, if this field is set to 200, the bid price is twice\nthe price of on-demand `r3.xlarge` instances. If not specified, the default value is 100.\nWhen spot instances are requested for this cluster, only spot instances whose bid price\npercentage matches this field will be considered.\nNote that, for safety, we enforce this field to be no more than 10000.",
+          "launch_stage": "GA"
+        },
+        "zone_id": {
+          "description": "Identifier for the availability zone/datacenter in which the cluster resides.\nThis string will be of a form like \"us-west-2a\". The provided availability\nzone must be in the same region as the Databricks deployment. For example, \"us-west-2a\"\nis not a valid zone id if the Databricks deployment resides in the \"us-east-1\" region.\nThis is an optional field at cluster creation, and if not specified, the zone \"auto\" will be used.\nIf the zone specified is \"auto\", will try to place cluster in a zone with high availability,\nand will retry placement in a different AZ if there is not enough capacity.\n\nThe list of available zones as well as the default value can be found by using the\n`List Zones` method.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.AwsAvailability": {
+      "description": "Availability type used for all subsequent nodes past the `first_on_demand` ones.\n\nNote: If `first_on_demand` is zero, this availability type will be used for the entire cluster.",
+      "enum": [
+        "SPOT",
+        "ON_DEMAND",
+        "SPOT_WITH_FALLBACK"
+      ],
+      "enum_launch_stages": {
+        "ON_DEMAND": "GA",
+        "SPOT": "GA",
+        "SPOT_WITH_FALLBACK": "GA"
+      }
+    },
+    "compute.AzureAttributes": {
+      "description": "Attributes set during cluster creation which are related to Microsoft Azure.",
+      "fields": {
+        "availability": {
+          "description": "Availability type used for all subsequent nodes past the `first_on_demand` ones.\nNote: If `first_on_demand` is zero, this availability\ntype will be used for the entire cluster.",
+          "ref": "compute.AzureAvailability",
+          "launch_stage": "GA"
+        },
+        "capacity_reservation_group": {
+          "description": "The Azure capacity reservation group resource ID to use for launching VMs.\nWhen specified, VMs will be launched using the provided capacity reservation.\n\nCapacity reservations can only be specified when the workspace uses injected vnet (i.e. customer defined vnet not\nmanaged by databricks). Ensure the databricks-login-prod Enterprise Application is granted the following four permissions:\n1. Microsoft.Compute/capacityReservationGroups/read\n2. Microsoft.Compute/capacityReservationGroups/deploy/action\n3. Microsoft.Compute/capacityReservationGroups/capacityReservations/read\n4. Microsoft.Compute/capacityReservationGroups/capacityReservations/deploy/action\n\nFormat: `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/capacityReservationGroups/{capacityReservationGroupName}`",
+          "launch_stage": "GA"
+        },
+        "first_on_demand": {
+          "description": "The first `first_on_demand` nodes of the cluster will be placed on on-demand instances.\nThis value should be greater than 0, to make sure the cluster driver node is placed on an\non-demand instance. If this value is greater than or equal to the current cluster size, all\nnodes will be placed on on-demand instances. If this value is less than the current cluster\nsize, `first_on_demand` nodes will be placed on on-demand instances and the remainder will\nbe placed on `availability` instances. Note that this value does not affect\ncluster size and cannot currently be mutated over the lifetime of a cluster.",
+          "launch_stage": "GA"
+        },
+        "log_analytics_info": {
+          "description": "Defines values necessary to configure and run Azure Log Analytics agent",
+          "ref": "compute.LogAnalyticsInfo",
+          "launch_stage": "GA"
+        },
+        "spot_bid_max_price": {
+          "description": "The max bid price to be used for Azure spot instances.\nThe Max price for the bid cannot be higher than the on-demand price of the instance.\nIf not specified, the default value is -1, which specifies that the instance cannot be evicted\non the basis of price, and only on the basis of availability. Further, the value should \u003e 0 or -1.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.AzureAvailability": {
+      "description": "Availability type used for all subsequent nodes past the `first_on_demand` ones.\nNote: If `first_on_demand` is zero, this availability type will be used for the entire cluster.",
+      "enum": [
+        "SPOT_AZURE",
+        "ON_DEMAND_AZURE",
+        "SPOT_WITH_FALLBACK_AZURE"
+      ],
+      "enum_launch_stages": {
+        "ON_DEMAND_AZURE": "GA",
+        "SPOT_AZURE": "GA",
+        "SPOT_WITH_FALLBACK_AZURE": "GA"
+      }
+    },
+    "compute.CancelCommand": {
+      "fields": {
+        "clusterId": {
+          "launch_stage": "GA"
+        },
+        "commandId": {
+          "launch_stage": "GA"
+        },
+        "contextId": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.CancelPendingClusterEnforcementRequest": {
+      "description": "Request to cancel the pending enforcement for a cluster.",
+      "fields": {
+        "allow_missing": {
+          "description": "If true and no pending enforcement exists, the request will succeed but no action\nwill be taken.",
+          "launch_stage": "GA"
+        },
+        "cluster_id": {
+          "description": "The ID of the cluster to cancel the pending enforcement for.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.CancelPendingClusterEnforcementResponse": {
+      "description": "Response for canceling the pending enforcement for a cluster.\nIf the cancel request succeeds, an empty response object is returned.\nOtherwise, an error response is returned."
+    },
+    "compute.CancelResponse": {},
+    "compute.ChangeClusterOwner": {
+      "fields": {
+        "cluster_id": {
+          "launch_stage": "GA"
+        },
+        "owner_username": {
+          "description": "New owner of the cluster_id after this RPC.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ChangeClusterOwnerResponse": {},
+    "compute.ClientsTypes": {
+      "fields": {
+        "jobs": {
+          "description": "With jobs set, the cluster can be used for jobs",
+          "launch_stage": "GA"
+        },
+        "notebooks": {
+          "description": "With notebooks set, this cluster can be used for notebooks",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.CloneCluster": {
+      "fields": {
+        "source_cluster_id": {
+          "description": "The cluster that is being cloned.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.CloudProviderNodeInfo": {
+      "fields": {
+        "status": {
+          "description": "Status as reported by the cloud provider",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.CloudProviderNodeStatus": {
+      "enum": [
+        "NotEnabledOnSubscription",
+        "NotAvailableInRegion"
+      ],
+      "enum_launch_stages": {
+        "NotAvailableInRegion": "GA",
+        "NotEnabledOnSubscription": "GA"
+      }
+    },
+    "compute.ClusterAccessControlRequest": {
+      "fields": {
+        "group_name": {
+          "description": "name of the group",
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "compute.ClusterPermissionLevel",
+          "launch_stage": "GA"
+        },
+        "service_principal_name": {
+          "description": "application ID of a service principal",
+          "launch_stage": "GA"
+        },
+        "user_name": {
+          "description": "name of the user",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ClusterAccessControlResponse": {
+      "fields": {
+        "all_permissions": {
+          "description": "All permissions.",
+          "launch_stage": "GA"
+        },
+        "display_name": {
+          "description": "Display name of the user or service principal.",
+          "launch_stage": "GA"
+        },
+        "group_name": {
+          "description": "name of the group",
+          "launch_stage": "GA"
+        },
+        "service_principal_name": {
+          "description": "Name of the service principal.",
+          "launch_stage": "GA"
+        },
+        "user_name": {
+          "description": "name of the user",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ClusterAttributes": {
+      "description": "Common set of attributes set during cluster creation. These attributes cannot be changed\nover the lifetime of a cluster.",
+      "fields": {
+        "autotermination_minutes": {
+          "description": "Automatically terminates the cluster after it is inactive for this time in minutes. If not set,\nthis cluster will not be automatically terminated. If specified, the threshold must be between\n10 and 10000 minutes.\nUsers can also set this value to 0 to explicitly disable automatic termination.",
+          "launch_stage": "GA"
+        },
+        "aws_attributes": {
+          "description": "Attributes related to clusters running on Amazon Web Services.\nIf not specified at cluster creation, a set of default values will be used.",
+          "ref": "compute.AwsAttributes",
+          "launch_stage": "GA"
+        },
+        "azure_attributes": {
+          "description": "Attributes related to clusters running on Microsoft Azure.\nIf not specified at cluster creation, a set of default values will be used.",
+          "ref": "compute.AzureAttributes",
+          "launch_stage": "GA"
+        },
+        "cluster_log_conf": {
+          "description": "The configuration for delivering spark logs to a long-term storage destination.\nThree kinds of destinations (DBFS, S3 and Unity Catalog volumes) are supported. Only one destination can be specified\nfor one cluster. If the conf is given, the logs will be delivered to the destination every\n`5 mins`. The destination of driver logs is `$destination/$clusterId/driver`, while\nthe destination of executor logs is `$destination/$clusterId/executor`.",
+          "ref": "compute.ClusterLogConf",
+          "launch_stage": "GA"
+        },
+        "cluster_name": {
+          "description": "Cluster name requested by the user. This doesn't have to be unique.\nIf not specified at creation, the cluster name will be an empty string.\nFor job clusters, the cluster name is automatically set based on the job and job run IDs.",
+          "launch_stage": "GA"
+        },
+        "custom_tags": {
+          "description": "Additional tags for cluster resources. Databricks will tag all cluster resources (e.g., AWS\ninstances and EBS volumes) with these tags in addition to `default_tags`. Notes:\n\n- Currently, Databricks allows at most 45 custom tags\n\n- Clusters can only reuse cloud resources if the resources' tags are a subset of the cluster tags",
+          "launch_stage": "GA"
+        },
+        "data_security_mode": {
+          "ref": "compute.DataSecurityMode",
+          "launch_stage": "GA"
+        },
+        "dependency_mode": {
+          "description": "Controls dependency configuration for the cluster.",
+          "ref": "compute.DependencyMode",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "docker_image": {
+          "description": "Custom docker image BYOC",
+          "ref": "compute.DockerImage",
+          "launch_stage": "GA"
+        },
+        "driver_instance_pool_id": {
+          "description": "The optional ID of the instance pool for the driver of the cluster belongs.\nThe pool cluster uses the instance pool with id (instance_pool_id) if the driver pool is not\nassigned.",
+          "launch_stage": "GA"
+        },
+        "driver_node_type_flexibility": {
+          "description": "Flexible node type configuration for the driver node.",
+          "ref": "compute.NodeTypeFlexibility",
+          "launch_stage": "GA"
+        },
+        "driver_node_type_id": {
+          "description": "The node type of the Spark driver.\nNote that this field is optional; if unset, the driver node type will be set as the same value\nas `node_type_id` defined above.",
+          "launch_stage": "GA"
+        },
+        "enable_elastic_disk": {
+          "description": "Autoscaling Local Storage: when enabled, this cluster will dynamically acquire additional disk\nspace when its Spark workers are running low on disk space.",
+          "launch_stage": "GA"
+        },
+        "enable_local_disk_encryption": {
+          "description": "Whether to enable LUKS on cluster VMs' local disks",
+          "launch_stage": "GA"
+        },
+        "gcp_attributes": {
+          "description": "Attributes related to clusters running on Google Cloud Platform.\nIf not specified at cluster creation, a set of default values will be used.",
+          "ref": "compute.GcpAttributes",
+          "launch_stage": "GA"
+        },
+        "init_scripts": {
+          "description": "The configuration for storing init scripts. Any number of destinations can be specified.\nThe scripts are executed sequentially in the order provided.\nIf `cluster_log_conf` is specified, init script logs are sent to `\u003cdestination\u003e/\u003ccluster-ID\u003e/init_scripts`.",
+          "launch_stage": "GA"
+        },
+        "instance_pool_id": {
+          "description": "The optional ID of the instance pool to which the cluster belongs.",
+          "launch_stage": "GA"
+        },
+        "is_single_node": {
+          "description": "This field can only be used when `kind = CLASSIC_PREVIEW`.\n\nWhen set to true, Databricks will automatically set single node related `custom_tags`, `spark_conf`, and `num_workers`",
+          "launch_stage": "GA"
+        },
+        "kind": {
+          "ref": "compute.Kind",
+          "launch_stage": "GA"
+        },
+        "node_type_id": {
+          "description": "This field encodes, through a single value, the resources available to each of\nthe Spark nodes in this cluster. For example, the Spark nodes can be provisioned\nand optimized for memory or compute intensive workloads. A list of available node\ntypes can be retrieved by using the [clusters/listNodeTypes](https://docs.databricks.com/api/workspace/clusters/listnodetypes) API call.",
+          "launch_stage": "GA"
+        },
+        "policy_id": {
+          "description": "The ID of the cluster policy used to create the cluster if applicable.",
+          "launch_stage": "GA"
+        },
+        "remote_disk_throughput": {
+          "description": "If set, what the configurable throughput (in Mb/s) for the remote disk is. Currently only supported for GCP HYPERDISK_BALANCED disks.",
+          "launch_stage": "GA"
+        },
+        "runtime_engine": {
+          "description": "Determines the cluster's runtime engine, either standard or Photon.\n\nThis field is not compatible with legacy `spark_version` values that contain `-photon-`.\nRemove `-photon-` from the `spark_version` and set `runtime_engine` to `PHOTON`.\n\nIf left unspecified, the runtime engine defaults to standard unless the spark_version\ncontains -photon-, in which case Photon will be used.",
+          "ref": "compute.RuntimeEngine",
+          "launch_stage": "GA"
+        },
+        "single_user_name": {
+          "description": "Single user name if data_security_mode is `SINGLE_USER`",
+          "launch_stage": "GA"
+        },
+        "spark_conf": {
+          "description": "An object containing a set of optional, user-specified Spark configuration key-value pairs.\nUsers can also pass in a string of extra JVM options to the driver and the executors via\n`spark.driver.extraJavaOptions` and `spark.executor.extraJavaOptions` respectively.",
+          "launch_stage": "GA"
+        },
+        "spark_env_vars": {
+          "description": "An object containing a set of optional, user-specified environment variable key-value pairs.\nPlease note that key-value pair of the form (X,Y) will be exported as is (i.e.,\n`export X='Y'`) while launching the driver and workers.\n\nIn order to specify an additional set of `SPARK_DAEMON_JAVA_OPTS`, we recommend appending\nthem to `$SPARK_DAEMON_JAVA_OPTS` as shown in the example below. This ensures that all\ndefault databricks managed environmental variables are included as well.\n\nExample Spark environment variables:\n`{\"SPARK_WORKER_MEMORY\": \"28000m\", \"SPARK_LOCAL_DIRS\": \"/local_disk0\"}` or\n`{\"SPARK_DAEMON_JAVA_OPTS\": \"$SPARK_DAEMON_JAVA_OPTS -Dspark.shuffle.service.enabled=true\"}`",
+          "launch_stage": "GA"
+        },
+        "spark_version": {
+          "description": "The Spark version of the cluster, e.g. `3.3.x-scala2.11`.\nA list of available Spark versions can be retrieved by using\nthe [clusters/sparkVersions](https://docs.databricks.com/api/workspace/clusters/sparkversions) API call.",
+          "launch_stage": "GA"
+        },
+        "ssh_public_keys": {
+          "description": "SSH public key contents that will be added to each Spark node in this cluster. The\ncorresponding private keys can be used to login with the user name `ubuntu` on port `2200`.\nUp to 10 keys can be specified.",
+          "launch_stage": "GA"
+        },
+        "total_initial_remote_disk_size": {
+          "description": "If set, what the total initial volume size (in GB) of the remote disks should be. Supported for GCP.",
+          "launch_stage": "GA"
+        },
+        "use_ml_runtime": {
+          "description": "This field can only be used when `kind = CLASSIC_PREVIEW`.\n\n`effective_spark_version` is determined by `spark_version` (DBR release), this field `use_ml_runtime`, and whether `node_type_id` is gpu node or not.",
+          "launch_stage": "GA"
+        },
+        "worker_node_type_flexibility": {
+          "description": "Flexible node type configuration for worker nodes.",
+          "ref": "compute.NodeTypeFlexibility",
+          "launch_stage": "GA"
+        },
+        "workload_type": {
+          "ref": "compute.WorkloadType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ClusterCompliance": {
+      "fields": {
+        "cluster_id": {
+          "description": "Canonical unique identifier for a cluster.",
+          "launch_stage": "GA"
+        },
+        "is_compliant": {
+          "description": "Whether this cluster is in compliance with the latest version of its policy.",
+          "launch_stage": "GA"
+        },
+        "pending_enforcement": {
+          "description": "Information about the pending enforcement for the cluster. Only present if a pending enforcement\nis scheduled for the cluster.",
+          "ref": "compute.PendingEnforcement",
+          "launch_stage": "GA"
+        },
+        "violations": {
+          "description": "An object containing key-value mappings representing the first 200 policy validation errors.\nThe keys indicate the path where the policy validation error is occurring.\nThe values indicate an error message describing the policy validation error.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ClusterDetails": {
+      "description": "Describes all of the metadata about a single Spark cluster in Databricks.",
+      "fields": {
+        "autoscale": {
+          "description": "Parameters needed in order to automatically scale clusters up and down based on load.\nNote: autoscaling works best with DB runtime versions 3.0 or later.",
+          "ref": "compute.AutoScale",
+          "launch_stage": "GA"
+        },
+        "autotermination_minutes": {
+          "description": "Automatically terminates the cluster after it is inactive for this time in minutes. If not set,\nthis cluster will not be automatically terminated. If specified, the threshold must be between\n10 and 10000 minutes.\nUsers can also set this value to 0 to explicitly disable automatic termination.",
+          "launch_stage": "GA"
+        },
+        "aws_attributes": {
+          "description": "Attributes related to clusters running on Amazon Web Services.\nIf not specified at cluster creation, a set of default values will be used.",
+          "ref": "compute.AwsAttributes",
+          "launch_stage": "GA"
+        },
+        "azure_attributes": {
+          "description": "Attributes related to clusters running on Microsoft Azure.\nIf not specified at cluster creation, a set of default values will be used.",
+          "ref": "compute.AzureAttributes",
+          "launch_stage": "GA"
+        },
+        "cluster_cores": {
+          "description": "Number of CPU cores available for this cluster.\nNote that this can be fractional, e.g. 7.5 cores, since certain node types are configured to\nshare cores between Spark nodes on the same instance.",
+          "launch_stage": "GA"
+        },
+        "cluster_id": {
+          "description": "Canonical identifier for the cluster. This id is retained during cluster restarts and resizes,\nwhile each new cluster has a globally unique id.",
+          "launch_stage": "GA"
+        },
+        "cluster_log_conf": {
+          "description": "The configuration for delivering spark logs to a long-term storage destination.\nThree kinds of destinations (DBFS, S3 and Unity Catalog volumes) are supported. Only one destination can be specified\nfor one cluster. If the conf is given, the logs will be delivered to the destination every\n`5 mins`. The destination of driver logs is `$destination/$clusterId/driver`, while\nthe destination of executor logs is `$destination/$clusterId/executor`.",
+          "ref": "compute.ClusterLogConf",
+          "launch_stage": "GA"
+        },
+        "cluster_log_status": {
+          "description": "Cluster log delivery status.",
+          "ref": "compute.LogSyncStatus",
+          "launch_stage": "GA"
+        },
+        "cluster_memory_mb": {
+          "description": "Total amount of cluster memory, in megabytes",
+          "launch_stage": "GA"
+        },
+        "cluster_name": {
+          "description": "Cluster name requested by the user. This doesn't have to be unique.\nIf not specified at creation, the cluster name will be an empty string.\nFor job clusters, the cluster name is automatically set based on the job and job run IDs.",
+          "launch_stage": "GA"
+        },
+        "cluster_source": {
+          "description": "Determines whether the cluster was created by a user through the UI, created by the Databricks\nJobs Scheduler, or through an API request.",
+          "ref": "compute.ClusterSource",
+          "launch_stage": "GA"
+        },
+        "creator_user_name": {
+          "description": "Creator user name.\nThe field won't be included in the response if the user has already been deleted.",
+          "launch_stage": "GA"
+        },
+        "custom_tags": {
+          "description": "Additional tags for cluster resources. Databricks will tag all cluster resources (e.g., AWS\ninstances and EBS volumes) with these tags in addition to `default_tags`. Notes:\n\n- Currently, Databricks allows at most 45 custom tags\n\n- Clusters can only reuse cloud resources if the resources' tags are a subset of the cluster tags",
+          "launch_stage": "GA"
+        },
+        "data_security_mode": {
+          "ref": "compute.DataSecurityMode",
+          "launch_stage": "GA"
+        },
+        "default_tags": {
+          "description": "Tags that are added by Databricks regardless of any `custom_tags`, including:\n\n- Vendor: Databricks\n\n- Creator: \u003cusername_of_creator\u003e\n\n- ClusterName: \u003cname_of_cluster\u003e\n\n- ClusterId: \u003cid_of_cluster\u003e\n\n- Name: \u003cDatabricks internal use\u003e",
+          "launch_stage": "GA"
+        },
+        "dependency_mode": {
+          "description": "Controls dependency configuration for the cluster.",
+          "ref": "compute.DependencyMode",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "docker_image": {
+          "description": "Custom docker image BYOC",
+          "ref": "compute.DockerImage",
+          "launch_stage": "GA"
+        },
+        "driver": {
+          "description": "Node on which the Spark driver resides. The driver node contains the Spark master and\nthe Databricks application that manages the per-notebook Spark REPLs.",
+          "ref": "compute.SparkNode",
+          "launch_stage": "GA"
+        },
+        "driver_instance_pool_id": {
+          "description": "The optional ID of the instance pool for the driver of the cluster belongs.\nThe pool cluster uses the instance pool with id (instance_pool_id) if the driver pool is not\nassigned.",
+          "launch_stage": "GA"
+        },
+        "driver_node_type_flexibility": {
+          "description": "Flexible node type configuration for the driver node.",
+          "ref": "compute.NodeTypeFlexibility",
+          "launch_stage": "GA"
+        },
+        "driver_node_type_id": {
+          "description": "The node type of the Spark driver.\nNote that this field is optional; if unset, the driver node type will be set as the same value\nas `node_type_id` defined above.",
+          "launch_stage": "GA"
+        },
+        "enable_elastic_disk": {
+          "description": "Autoscaling Local Storage: when enabled, this cluster will dynamically acquire additional disk\nspace when its Spark workers are running low on disk space.",
+          "launch_stage": "GA"
+        },
+        "enable_local_disk_encryption": {
+          "description": "Whether to enable LUKS on cluster VMs' local disks",
+          "launch_stage": "GA"
+        },
+        "executors": {
+          "description": "Nodes on which the Spark executors reside.",
+          "launch_stage": "GA"
+        },
+        "gcp_attributes": {
+          "description": "Attributes related to clusters running on Google Cloud Platform.\nIf not specified at cluster creation, a set of default values will be used.",
+          "ref": "compute.GcpAttributes",
+          "launch_stage": "GA"
+        },
+        "init_scripts": {
+          "description": "The configuration for storing init scripts. Any number of destinations can be specified.\nThe scripts are executed sequentially in the order provided.\nIf `cluster_log_conf` is specified, init script logs are sent to `\u003cdestination\u003e/\u003ccluster-ID\u003e/init_scripts`.",
+          "launch_stage": "GA"
+        },
+        "instance_pool_id": {
+          "description": "The optional ID of the instance pool to which the cluster belongs.",
+          "launch_stage": "GA"
+        },
+        "is_single_node": {
+          "description": "This field can only be used when `kind = CLASSIC_PREVIEW`.\n\nWhen set to true, Databricks will automatically set single node related `custom_tags`, `spark_conf`, and `num_workers`",
+          "launch_stage": "GA"
+        },
+        "jdbc_port": {
+          "description": "Port on which Spark JDBC server is listening, in the driver nod. No service will be listeningon\non this port in executor nodes.",
+          "launch_stage": "GA"
+        },
+        "kind": {
+          "ref": "compute.Kind",
+          "launch_stage": "GA"
+        },
+        "last_restarted_time": {
+          "description": "the timestamp that the cluster was started/restarted",
+          "launch_stage": "GA"
+        },
+        "last_state_loss_time": {
+          "description": "Time when the cluster driver last lost its state (due to a restart or driver failure).",
+          "launch_stage": "GA"
+        },
+        "node_type_id": {
+          "description": "This field encodes, through a single value, the resources available to each of\nthe Spark nodes in this cluster. For example, the Spark nodes can be provisioned\nand optimized for memory or compute intensive workloads. A list of available node\ntypes can be retrieved by using the [clusters/listNodeTypes](https://docs.databricks.com/api/workspace/clusters/listnodetypes) API call.",
+          "launch_stage": "GA"
+        },
+        "num_workers": {
+          "description": "Number of worker nodes that this cluster should have. A cluster has one Spark Driver\nand `num_workers` Executors for a total of `num_workers` + 1 Spark nodes.\n\nNote: When reading the properties of a cluster, this field reflects the desired number\nof workers rather than the actual current number of workers. For instance, if a cluster\nis resized from 5 to 10 workers, this field will immediately be updated to reflect\nthe target size of 10 workers, whereas the workers listed in `spark_info` will gradually\nincrease from 5 to 10 as the new nodes are provisioned.",
+          "launch_stage": "GA"
+        },
+        "policy_id": {
+          "description": "The ID of the cluster policy used to create the cluster if applicable.",
+          "launch_stage": "GA"
+        },
+        "remote_disk_throughput": {
+          "description": "If set, what the configurable throughput (in Mb/s) for the remote disk is. Currently only supported for GCP HYPERDISK_BALANCED disks.",
+          "launch_stage": "GA"
+        },
+        "runtime_engine": {
+          "description": "Determines the cluster's runtime engine, either standard or Photon.\n\nThis field is not compatible with legacy `spark_version` values that contain `-photon-`.\nRemove `-photon-` from the `spark_version` and set `runtime_engine` to `PHOTON`.\n\nIf left unspecified, the runtime engine defaults to standard unless the spark_version\ncontains -photon-, in which case Photon will be used.",
+          "ref": "compute.RuntimeEngine",
+          "launch_stage": "GA"
+        },
+        "single_user_name": {
+          "description": "Single user name if data_security_mode is `SINGLE_USER`",
+          "launch_stage": "GA"
+        },
+        "spark_conf": {
+          "description": "An object containing a set of optional, user-specified Spark configuration key-value pairs.\nUsers can also pass in a string of extra JVM options to the driver and the executors via\n`spark.driver.extraJavaOptions` and `spark.executor.extraJavaOptions` respectively.",
+          "launch_stage": "GA"
+        },
+        "spark_context_id": {
+          "description": "A canonical SparkContext identifier. This value *does* change when the Spark driver restarts.\nThe pair `(cluster_id, spark_context_id)` is a globally unique identifier over all Spark\ncontexts.",
+          "launch_stage": "GA"
+        },
+        "spark_env_vars": {
+          "description": "An object containing a set of optional, user-specified environment variable key-value pairs.\nPlease note that key-value pair of the form (X,Y) will be exported as is (i.e.,\n`export X='Y'`) while launching the driver and workers.\n\nIn order to specify an additional set of `SPARK_DAEMON_JAVA_OPTS`, we recommend appending\nthem to `$SPARK_DAEMON_JAVA_OPTS` as shown in the example below. This ensures that all\ndefault databricks managed environmental variables are included as well.\n\nExample Spark environment variables:\n`{\"SPARK_WORKER_MEMORY\": \"28000m\", \"SPARK_LOCAL_DIRS\": \"/local_disk0\"}` or\n`{\"SPARK_DAEMON_JAVA_OPTS\": \"$SPARK_DAEMON_JAVA_OPTS -Dspark.shuffle.service.enabled=true\"}`",
+          "launch_stage": "GA"
+        },
+        "spark_version": {
+          "description": "The Spark version of the cluster, e.g. `3.3.x-scala2.11`.\nA list of available Spark versions can be retrieved by using\nthe [clusters/sparkVersions](https://docs.databricks.com/api/workspace/clusters/sparkversions) API call.",
+          "launch_stage": "GA"
+        },
+        "spec": {
+          "description": "The spec contains a snapshot of the latest user specified settings that were used to create/edit the cluster.\nNote: not included in the response of the ListClusters API.",
+          "ref": "compute.ClusterSpec",
+          "launch_stage": "GA"
+        },
+        "ssh_public_keys": {
+          "description": "SSH public key contents that will be added to each Spark node in this cluster. The\ncorresponding private keys can be used to login with the user name `ubuntu` on port `2200`.\nUp to 10 keys can be specified.",
+          "launch_stage": "GA"
+        },
+        "start_time": {
+          "description": "Time (in epoch milliseconds) when the cluster creation request was received (when the cluster\nentered a `PENDING` state).",
+          "launch_stage": "GA"
+        },
+        "state": {
+          "description": "Current state of the cluster.",
+          "ref": "compute.State",
+          "launch_stage": "GA"
+        },
+        "state_message": {
+          "description": "A message associated with the most recent state transition (e.g., the reason why\nthe cluster entered a `TERMINATED` state).",
+          "launch_stage": "GA"
+        },
+        "terminated_time": {
+          "description": "Time (in epoch milliseconds) when the cluster was terminated, if applicable.",
+          "launch_stage": "GA"
+        },
+        "termination_reason": {
+          "description": "Information about why the cluster was terminated.\nThis field only appears when the cluster is in a `TERMINATING` or `TERMINATED` state.",
+          "ref": "compute.TerminationReason",
+          "launch_stage": "GA"
+        },
+        "total_initial_remote_disk_size": {
+          "description": "If set, what the total initial volume size (in GB) of the remote disks should be. Supported for GCP.",
+          "launch_stage": "GA"
+        },
+        "use_ml_runtime": {
+          "description": "This field can only be used when `kind = CLASSIC_PREVIEW`.\n\n`effective_spark_version` is determined by `spark_version` (DBR release), this field `use_ml_runtime`, and whether `node_type_id` is gpu node or not.",
+          "launch_stage": "GA"
+        },
+        "worker_node_type_flexibility": {
+          "description": "Flexible node type configuration for worker nodes.",
+          "ref": "compute.NodeTypeFlexibility",
+          "launch_stage": "GA"
+        },
+        "workload_type": {
+          "ref": "compute.WorkloadType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ClusterEvent": {
+      "fields": {
+        "cluster_id": {
+          "launch_stage": "GA"
+        },
+        "data_plane_event_details": {
+          "ref": "compute.DataPlaneEventDetails",
+          "launch_stage": "GA"
+        },
+        "details": {
+          "ref": "compute.EventDetails",
+          "launch_stage": "GA"
+        },
+        "timestamp": {
+          "description": "The timestamp when the event occurred, stored as the number of milliseconds since\nthe Unix epoch. If not provided, this will be assigned by the Timeline service.",
+          "launch_stage": "GA"
+        },
+        "type": {
+          "ref": "compute.EventType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ClusterLibraryStatuses": {
+      "fields": {
+        "cluster_id": {
+          "description": "Unique identifier for the cluster.",
+          "launch_stage": "GA"
+        },
+        "library_statuses": {
+          "description": "Status of all libraries on the cluster.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ClusterLogConf": {
+      "description": "Cluster log delivery config",
+      "fields": {
+        "dbfs": {
+          "description": "destination needs to be provided. e.g.\n`{ \"dbfs\" : { \"destination\" : \"dbfs:/home/cluster_log\" } }`",
+          "ref": "compute.DbfsStorageInfo",
+          "launch_stage": "GA"
+        },
+        "s3": {
+          "description": "destination and either the region or endpoint need to be provided. e.g.\n`{ \"s3\": { \"destination\" : \"s3://cluster_log_bucket/prefix\", \"region\" : \"us-west-2\" } }`\nCluster iam role is used to access s3, please make sure the cluster iam role in\n`instance_profile_arn` has permission to write data to the s3 destination.",
+          "ref": "compute.S3StorageInfo",
+          "launch_stage": "GA"
+        },
+        "volumes": {
+          "description": "destination needs to be provided, e.g.\n`{ \"volumes\": { \"destination\": \"/Volumes/catalog/schema/volume/cluster_log\" } }`",
+          "ref": "compute.VolumesStorageInfo",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ClusterPermission": {
+      "fields": {
+        "inherited": {
+          "launch_stage": "GA"
+        },
+        "inherited_from_object": {
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "compute.ClusterPermissionLevel",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ClusterPermissionLevel": {
+      "description": "Permission level",
+      "enum": [
+        "CAN_MANAGE",
+        "CAN_RESTART",
+        "CAN_ATTACH_TO"
+      ]
+    },
+    "compute.ClusterPermissions": {
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "GA"
+        },
+        "object_id": {
+          "launch_stage": "GA"
+        },
+        "object_type": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ClusterPermissionsDescription": {
+      "fields": {
+        "description": {
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "compute.ClusterPermissionLevel",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ClusterPermissionsRequest": {
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ClusterPolicyAccessControlRequest": {
+      "fields": {
+        "group_name": {
+          "description": "name of the group",
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "compute.ClusterPolicyPermissionLevel",
+          "launch_stage": "GA"
+        },
+        "service_principal_name": {
+          "description": "application ID of a service principal",
+          "launch_stage": "GA"
+        },
+        "user_name": {
+          "description": "name of the user",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ClusterPolicyAccessControlResponse": {
+      "fields": {
+        "all_permissions": {
+          "description": "All permissions.",
+          "launch_stage": "GA"
+        },
+        "display_name": {
+          "description": "Display name of the user or service principal.",
+          "launch_stage": "GA"
+        },
+        "group_name": {
+          "description": "name of the group",
+          "launch_stage": "GA"
+        },
+        "service_principal_name": {
+          "description": "Name of the service principal.",
+          "launch_stage": "GA"
+        },
+        "user_name": {
+          "description": "name of the user",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ClusterPolicyPermission": {
+      "fields": {
+        "inherited": {
+          "launch_stage": "GA"
+        },
+        "inherited_from_object": {
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "compute.ClusterPolicyPermissionLevel",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ClusterPolicyPermissionLevel": {
+      "description": "Permission level",
+      "enum": [
+        "CAN_USE"
+      ]
+    },
+    "compute.ClusterPolicyPermissions": {
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "GA"
+        },
+        "object_id": {
+          "launch_stage": "GA"
+        },
+        "object_type": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ClusterPolicyPermissionsDescription": {
+      "fields": {
+        "description": {
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "compute.ClusterPolicyPermissionLevel",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ClusterPolicyPermissionsRequest": {
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ClusterSettingsChange": {
+      "description": "Represents a change to the cluster settings required for the cluster\nto become compliant with its policy.",
+      "fields": {
+        "field": {
+          "description": "The field where this change would be made.",
+          "launch_stage": "GA"
+        },
+        "new_value": {
+          "description": "The new value of this field after enforcing policy compliance\n(either a number, a boolean, or a string) converted to a string.\nThis is intended to be read by a human. The typed new value of this field\ncan be retrieved by reading the settings field in the API response.",
+          "launch_stage": "GA"
+        },
+        "previous_value": {
+          "description": "The previous value of this field before enforcing policy compliance\n(either a number, a boolean, or a string) converted to a string.\nThis is intended to be read by a human. The type of the field\ncan be retrieved by reading the settings field in the API response.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ClusterSize": {
+      "fields": {
+        "autoscale": {
+          "description": "Parameters needed in order to automatically scale clusters up and down based on load.\nNote: autoscaling works best with DB runtime versions 3.0 or later.",
+          "ref": "compute.AutoScale",
+          "launch_stage": "GA"
+        },
+        "num_workers": {
+          "description": "Number of worker nodes that this cluster should have. A cluster has one Spark Driver\nand `num_workers` Executors for a total of `num_workers` + 1 Spark nodes.\n\nNote: When reading the properties of a cluster, this field reflects the desired number\nof workers rather than the actual current number of workers. For instance, if a cluster\nis resized from 5 to 10 workers, this field will immediately be updated to reflect\nthe target size of 10 workers, whereas the workers listed in `spark_info` will gradually\nincrease from 5 to 10 as the new nodes are provisioned.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ClusterSource": {
+      "description": "Determines whether the cluster was created by a user through the UI, created by the Databricks\nJobs Scheduler, or through an API request.\nThis is the same as cluster_creator, but read only.",
+      "enum": [
+        "UI",
+        "JOB",
+        "API",
+        "SQL",
+        "MODELS",
+        "PIPELINE",
+        "PIPELINE_MAINTENANCE"
+      ],
+      "enum_launch_stages": {
+        "API": "GA",
+        "JOB": "GA",
+        "MODELS": "GA",
+        "PIPELINE": "GA",
+        "PIPELINE_MAINTENANCE": "GA",
+        "SQL": "GA",
+        "UI": "GA"
+      }
+    },
+    "compute.ClusterSpec": {
+      "description": "Contains a snapshot of the latest user specified settings that were used to create/edit the cluster.",
+      "fields": {
+        "apply_policy_default_values": {
+          "description": "When set to true, fixed and default values from the policy will be used for fields that are omitted. When set to false, only fixed values from the policy will be applied.",
+          "launch_stage": "GA"
+        },
+        "autoscale": {
+          "description": "Parameters needed in order to automatically scale clusters up and down based on load.\nNote: autoscaling works best with DB runtime versions 3.0 or later.",
+          "ref": "compute.AutoScale",
+          "launch_stage": "GA"
+        },
+        "autotermination_minutes": {
+          "description": "Automatically terminates the cluster after it is inactive for this time in minutes. If not set,\nthis cluster will not be automatically terminated. If specified, the threshold must be between\n10 and 10000 minutes.\nUsers can also set this value to 0 to explicitly disable automatic termination.",
+          "launch_stage": "GA"
+        },
+        "aws_attributes": {
+          "description": "Attributes related to clusters running on Amazon Web Services.\nIf not specified at cluster creation, a set of default values will be used.",
+          "ref": "compute.AwsAttributes",
+          "launch_stage": "GA"
+        },
+        "azure_attributes": {
+          "description": "Attributes related to clusters running on Microsoft Azure.\nIf not specified at cluster creation, a set of default values will be used.",
+          "ref": "compute.AzureAttributes",
+          "launch_stage": "GA"
+        },
+        "cluster_log_conf": {
+          "description": "The configuration for delivering spark logs to a long-term storage destination.\nThree kinds of destinations (DBFS, S3 and Unity Catalog volumes) are supported. Only one destination can be specified\nfor one cluster. If the conf is given, the logs will be delivered to the destination every\n`5 mins`. The destination of driver logs is `$destination/$clusterId/driver`, while\nthe destination of executor logs is `$destination/$clusterId/executor`.",
+          "ref": "compute.ClusterLogConf",
+          "launch_stage": "GA"
+        },
+        "cluster_name": {
+          "description": "Cluster name requested by the user. This doesn't have to be unique.\nIf not specified at creation, the cluster name will be an empty string.\nFor job clusters, the cluster name is automatically set based on the job and job run IDs.",
+          "launch_stage": "GA"
+        },
+        "custom_tags": {
+          "description": "Additional tags for cluster resources. Databricks will tag all cluster resources (e.g., AWS\ninstances and EBS volumes) with these tags in addition to `default_tags`. Notes:\n\n- Currently, Databricks allows at most 45 custom tags\n\n- Clusters can only reuse cloud resources if the resources' tags are a subset of the cluster tags",
+          "launch_stage": "GA"
+        },
+        "data_security_mode": {
+          "ref": "compute.DataSecurityMode",
+          "launch_stage": "GA"
+        },
+        "dependency_mode": {
+          "description": "Controls dependency configuration for the cluster.",
+          "ref": "compute.DependencyMode",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "docker_image": {
+          "description": "Custom docker image BYOC",
+          "ref": "compute.DockerImage",
+          "launch_stage": "GA"
+        },
+        "driver_instance_pool_id": {
+          "description": "The optional ID of the instance pool for the driver of the cluster belongs.\nThe pool cluster uses the instance pool with id (instance_pool_id) if the driver pool is not\nassigned.",
+          "launch_stage": "GA"
+        },
+        "driver_node_type_flexibility": {
+          "description": "Flexible node type configuration for the driver node.",
+          "ref": "compute.NodeTypeFlexibility",
+          "launch_stage": "GA"
+        },
+        "driver_node_type_id": {
+          "description": "The node type of the Spark driver.\nNote that this field is optional; if unset, the driver node type will be set as the same value\nas `node_type_id` defined above.",
+          "launch_stage": "GA"
+        },
+        "enable_elastic_disk": {
+          "description": "Autoscaling Local Storage: when enabled, this cluster will dynamically acquire additional disk\nspace when its Spark workers are running low on disk space.",
+          "launch_stage": "GA"
+        },
+        "enable_local_disk_encryption": {
+          "description": "Whether to enable LUKS on cluster VMs' local disks",
+          "launch_stage": "GA"
+        },
+        "gcp_attributes": {
+          "description": "Attributes related to clusters running on Google Cloud Platform.\nIf not specified at cluster creation, a set of default values will be used.",
+          "ref": "compute.GcpAttributes",
+          "launch_stage": "GA"
+        },
+        "init_scripts": {
+          "description": "The configuration for storing init scripts. Any number of destinations can be specified.\nThe scripts are executed sequentially in the order provided.\nIf `cluster_log_conf` is specified, init script logs are sent to `\u003cdestination\u003e/\u003ccluster-ID\u003e/init_scripts`.",
+          "launch_stage": "GA"
+        },
+        "instance_pool_id": {
+          "description": "The optional ID of the instance pool to which the cluster belongs.",
+          "launch_stage": "GA"
+        },
+        "is_single_node": {
+          "description": "This field can only be used when `kind = CLASSIC_PREVIEW`.\n\nWhen set to true, Databricks will automatically set single node related `custom_tags`, `spark_conf`, and `num_workers`",
+          "launch_stage": "GA"
+        },
+        "kind": {
+          "ref": "compute.Kind",
+          "launch_stage": "GA"
+        },
+        "node_type_id": {
+          "description": "This field encodes, through a single value, the resources available to each of\nthe Spark nodes in this cluster. For example, the Spark nodes can be provisioned\nand optimized for memory or compute intensive workloads. A list of available node\ntypes can be retrieved by using the [clusters/listNodeTypes](https://docs.databricks.com/api/workspace/clusters/listnodetypes) API call.",
+          "launch_stage": "GA"
+        },
+        "num_workers": {
+          "description": "Number of worker nodes that this cluster should have. A cluster has one Spark Driver\nand `num_workers` Executors for a total of `num_workers` + 1 Spark nodes.\n\nNote: When reading the properties of a cluster, this field reflects the desired number\nof workers rather than the actual current number of workers. For instance, if a cluster\nis resized from 5 to 10 workers, this field will immediately be updated to reflect\nthe target size of 10 workers, whereas the workers listed in `spark_info` will gradually\nincrease from 5 to 10 as the new nodes are provisioned.",
+          "launch_stage": "GA"
+        },
+        "policy_id": {
+          "description": "The ID of the cluster policy used to create the cluster if applicable.",
+          "launch_stage": "GA"
+        },
+        "remote_disk_throughput": {
+          "description": "If set, what the configurable throughput (in Mb/s) for the remote disk is. Currently only supported for GCP HYPERDISK_BALANCED disks.",
+          "launch_stage": "GA"
+        },
+        "runtime_engine": {
+          "description": "Determines the cluster's runtime engine, either standard or Photon.\n\nThis field is not compatible with legacy `spark_version` values that contain `-photon-`.\nRemove `-photon-` from the `spark_version` and set `runtime_engine` to `PHOTON`.\n\nIf left unspecified, the runtime engine defaults to standard unless the spark_version\ncontains -photon-, in which case Photon will be used.",
+          "ref": "compute.RuntimeEngine",
+          "launch_stage": "GA"
+        },
+        "single_user_name": {
+          "description": "Single user name if data_security_mode is `SINGLE_USER`",
+          "launch_stage": "GA"
+        },
+        "spark_conf": {
+          "description": "An object containing a set of optional, user-specified Spark configuration key-value pairs.\nUsers can also pass in a string of extra JVM options to the driver and the executors via\n`spark.driver.extraJavaOptions` and `spark.executor.extraJavaOptions` respectively.",
+          "launch_stage": "GA"
+        },
+        "spark_env_vars": {
+          "description": "An object containing a set of optional, user-specified environment variable key-value pairs.\nPlease note that key-value pair of the form (X,Y) will be exported as is (i.e.,\n`export X='Y'`) while launching the driver and workers.\n\nIn order to specify an additional set of `SPARK_DAEMON_JAVA_OPTS`, we recommend appending\nthem to `$SPARK_DAEMON_JAVA_OPTS` as shown in the example below. This ensures that all\ndefault databricks managed environmental variables are included as well.\n\nExample Spark environment variables:\n`{\"SPARK_WORKER_MEMORY\": \"28000m\", \"SPARK_LOCAL_DIRS\": \"/local_disk0\"}` or\n`{\"SPARK_DAEMON_JAVA_OPTS\": \"$SPARK_DAEMON_JAVA_OPTS -Dspark.shuffle.service.enabled=true\"}`",
+          "launch_stage": "GA"
+        },
+        "spark_version": {
+          "description": "The Spark version of the cluster, e.g. `3.3.x-scala2.11`.\nA list of available Spark versions can be retrieved by using\nthe [clusters/sparkVersions](https://docs.databricks.com/api/workspace/clusters/sparkversions) API call.",
+          "launch_stage": "GA"
+        },
+        "ssh_public_keys": {
+          "description": "SSH public key contents that will be added to each Spark node in this cluster. The\ncorresponding private keys can be used to login with the user name `ubuntu` on port `2200`.\nUp to 10 keys can be specified.",
+          "launch_stage": "GA"
+        },
+        "total_initial_remote_disk_size": {
+          "description": "If set, what the total initial volume size (in GB) of the remote disks should be. Supported for GCP.",
+          "launch_stage": "GA"
+        },
+        "use_ml_runtime": {
+          "description": "This field can only be used when `kind = CLASSIC_PREVIEW`.\n\n`effective_spark_version` is determined by `spark_version` (DBR release), this field `use_ml_runtime`, and whether `node_type_id` is gpu node or not.",
+          "launch_stage": "GA"
+        },
+        "worker_node_type_flexibility": {
+          "description": "Flexible node type configuration for worker nodes.",
+          "ref": "compute.NodeTypeFlexibility",
+          "launch_stage": "GA"
+        },
+        "workload_type": {
+          "ref": "compute.WorkloadType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ClusterStatus": {
+      "fields": {
+        "cluster_id": {
+          "description": "Unique identifier of the cluster whose status should be retrieved.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.Command": {
+      "fields": {
+        "clusterId": {
+          "description": "Running cluster id",
+          "launch_stage": "GA"
+        },
+        "command": {
+          "description": "Executable code",
+          "launch_stage": "GA"
+        },
+        "contextId": {
+          "description": "Running context id",
+          "launch_stage": "GA"
+        },
+        "language": {
+          "ref": "compute.Language",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.CommandStatus": {
+      "enum": [
+        "Cancelled",
+        "Cancelling",
+        "Error",
+        "Finished",
+        "Queued",
+        "Running"
+      ],
+      "enum_launch_stages": {
+        "Cancelled": "GA",
+        "Cancelling": "GA",
+        "Error": "GA",
+        "Finished": "GA",
+        "Queued": "GA",
+        "Running": "GA"
+      }
+    },
+    "compute.CommandStatusRequest": {
+      "fields": {
+        "clusterId": {
+          "launch_stage": "GA"
+        },
+        "commandId": {
+          "launch_stage": "GA"
+        },
+        "contextId": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.CommandStatusResponse": {
+      "fields": {
+        "id": {
+          "launch_stage": "GA"
+        },
+        "results": {
+          "ref": "compute.Results",
+          "launch_stage": "GA"
+        },
+        "status": {
+          "ref": "compute.CommandStatus",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ConfidentialComputeType": {
+      "description": "Confidential computing technology for GCP instances.\nAligns with gcloud's --confidential-compute-type flag and the REST API's\nconfidentialInstanceConfig.confidentialInstanceType field.\nSee: https://cloud.google.com/confidential-computing/confidential-vm/docs/create-a-confidential-vm-instance",
+      "enum": [
+        "CONFIDENTIAL_COMPUTE_TYPE_NONE",
+        "SEV_SNP"
+      ],
+      "enum_launch_stages": {
+        "CONFIDENTIAL_COMPUTE_TYPE_NONE": "PRIVATE_PREVIEW",
+        "SEV_SNP": "PRIVATE_PREVIEW"
+      }
+    },
+    "compute.ContextStatus": {
+      "enum": [
+        "Running",
+        "Pending",
+        "Error"
+      ],
+      "enum_launch_stages": {
+        "Error": "GA",
+        "Pending": "GA",
+        "Running": "GA"
+      }
+    },
+    "compute.ContextStatusRequest": {
+      "fields": {
+        "clusterId": {
+          "launch_stage": "GA"
+        },
+        "contextId": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ContextStatusResponse": {
+      "fields": {
+        "id": {
+          "launch_stage": "GA"
+        },
+        "status": {
+          "ref": "compute.ContextStatus",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.CreateCluster": {
+      "fields": {
+        "apply_policy_default_values": {
+          "description": "When set to true, fixed and default values from the policy will be used for fields that are omitted.\nWhen set to false, only fixed values from the policy will be applied.",
+          "launch_stage": "GA"
+        },
+        "autoscale": {
+          "description": "Parameters needed in order to automatically scale clusters up and down based on load.\nNote: autoscaling works best with DB runtime versions 3.0 or later.",
+          "ref": "compute.AutoScale",
+          "launch_stage": "GA"
+        },
+        "autotermination_minutes": {
+          "description": "Automatically terminates the cluster after it is inactive for this time in minutes. If not set,\nthis cluster will not be automatically terminated. If specified, the threshold must be between\n10 and 10000 minutes.\nUsers can also set this value to 0 to explicitly disable automatic termination.",
+          "launch_stage": "GA"
+        },
+        "aws_attributes": {
+          "description": "Attributes related to clusters running on Amazon Web Services.\nIf not specified at cluster creation, a set of default values will be used.",
+          "ref": "compute.AwsAttributes",
+          "launch_stage": "GA"
+        },
+        "azure_attributes": {
+          "description": "Attributes related to clusters running on Microsoft Azure.\nIf not specified at cluster creation, a set of default values will be used.",
+          "ref": "compute.AzureAttributes",
+          "launch_stage": "GA"
+        },
+        "clone_from": {
+          "description": "When specified, this clones libraries from a source cluster during the creation of a new cluster.",
+          "ref": "compute.CloneCluster",
+          "launch_stage": "GA"
+        },
+        "cluster_log_conf": {
+          "description": "The configuration for delivering spark logs to a long-term storage destination.\nThree kinds of destinations (DBFS, S3 and Unity Catalog volumes) are supported. Only one destination can be specified\nfor one cluster. If the conf is given, the logs will be delivered to the destination every\n`5 mins`. The destination of driver logs is `$destination/$clusterId/driver`, while\nthe destination of executor logs is `$destination/$clusterId/executor`.",
+          "ref": "compute.ClusterLogConf",
+          "launch_stage": "GA"
+        },
+        "cluster_name": {
+          "description": "Cluster name requested by the user. This doesn't have to be unique.\nIf not specified at creation, the cluster name will be an empty string.\nFor job clusters, the cluster name is automatically set based on the job and job run IDs.",
+          "launch_stage": "GA"
+        },
+        "custom_tags": {
+          "description": "Additional tags for cluster resources. Databricks will tag all cluster resources (e.g., AWS\ninstances and EBS volumes) with these tags in addition to `default_tags`. Notes:\n\n- Currently, Databricks allows at most 45 custom tags\n\n- Clusters can only reuse cloud resources if the resources' tags are a subset of the cluster tags",
+          "launch_stage": "GA"
+        },
+        "data_security_mode": {
+          "ref": "compute.DataSecurityMode",
+          "launch_stage": "GA"
+        },
+        "dependency_mode": {
+          "description": "Controls dependency configuration for the cluster.",
+          "ref": "compute.DependencyMode",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "docker_image": {
+          "description": "Custom docker image BYOC",
+          "ref": "compute.DockerImage",
+          "launch_stage": "GA"
+        },
+        "driver_instance_pool_id": {
+          "description": "The optional ID of the instance pool for the driver of the cluster belongs.\nThe pool cluster uses the instance pool with id (instance_pool_id) if the driver pool is not\nassigned.",
+          "launch_stage": "GA"
+        },
+        "driver_node_type_flexibility": {
+          "description": "Flexible node type configuration for the driver node.",
+          "ref": "compute.NodeTypeFlexibility",
+          "launch_stage": "GA"
+        },
+        "driver_node_type_id": {
+          "description": "The node type of the Spark driver.\nNote that this field is optional; if unset, the driver node type will be set as the same value\nas `node_type_id` defined above.",
+          "launch_stage": "GA"
+        },
+        "enable_elastic_disk": {
+          "description": "Autoscaling Local Storage: when enabled, this cluster will dynamically acquire additional disk\nspace when its Spark workers are running low on disk space.",
+          "launch_stage": "GA"
+        },
+        "enable_local_disk_encryption": {
+          "description": "Whether to enable LUKS on cluster VMs' local disks",
+          "launch_stage": "GA"
+        },
+        "gcp_attributes": {
+          "description": "Attributes related to clusters running on Google Cloud Platform.\nIf not specified at cluster creation, a set of default values will be used.",
+          "ref": "compute.GcpAttributes",
+          "launch_stage": "GA"
+        },
+        "init_scripts": {
+          "description": "The configuration for storing init scripts. Any number of destinations can be specified.\nThe scripts are executed sequentially in the order provided.\nIf `cluster_log_conf` is specified, init script logs are sent to `\u003cdestination\u003e/\u003ccluster-ID\u003e/init_scripts`.",
+          "launch_stage": "GA"
+        },
+        "instance_pool_id": {
+          "description": "The optional ID of the instance pool to which the cluster belongs.",
+          "launch_stage": "GA"
+        },
+        "is_single_node": {
+          "description": "This field can only be used when `kind = CLASSIC_PREVIEW`.\n\nWhen set to true, Databricks will automatically set single node related `custom_tags`, `spark_conf`, and `num_workers`",
+          "launch_stage": "GA"
+        },
+        "kind": {
+          "ref": "compute.Kind",
+          "launch_stage": "GA"
+        },
+        "node_type_id": {
+          "description": "This field encodes, through a single value, the resources available to each of\nthe Spark nodes in this cluster. For example, the Spark nodes can be provisioned\nand optimized for memory or compute intensive workloads. A list of available node\ntypes can be retrieved by using the [clusters/listNodeTypes](https://docs.databricks.com/api/workspace/clusters/listnodetypes) API call.",
+          "launch_stage": "GA"
+        },
+        "num_workers": {
+          "description": "Number of worker nodes that this cluster should have. A cluster has one Spark Driver\nand `num_workers` Executors for a total of `num_workers` + 1 Spark nodes.\n\nNote: When reading the properties of a cluster, this field reflects the desired number\nof workers rather than the actual current number of workers. For instance, if a cluster\nis resized from 5 to 10 workers, this field will immediately be updated to reflect\nthe target size of 10 workers, whereas the workers listed in `spark_info` will gradually\nincrease from 5 to 10 as the new nodes are provisioned.",
+          "launch_stage": "GA"
+        },
+        "policy_id": {
+          "description": "The ID of the cluster policy used to create the cluster if applicable.",
+          "launch_stage": "GA"
+        },
+        "remote_disk_throughput": {
+          "description": "If set, what the configurable throughput (in Mb/s) for the remote disk is. Currently only supported for GCP HYPERDISK_BALANCED disks.",
+          "launch_stage": "GA"
+        },
+        "runtime_engine": {
+          "description": "Determines the cluster's runtime engine, either standard or Photon.\n\nThis field is not compatible with legacy `spark_version` values that contain `-photon-`.\nRemove `-photon-` from the `spark_version` and set `runtime_engine` to `PHOTON`.\n\nIf left unspecified, the runtime engine defaults to standard unless the spark_version\ncontains -photon-, in which case Photon will be used.",
+          "ref": "compute.RuntimeEngine",
+          "launch_stage": "GA"
+        },
+        "single_user_name": {
+          "description": "Single user name if data_security_mode is `SINGLE_USER`",
+          "launch_stage": "GA"
+        },
+        "spark_conf": {
+          "description": "An object containing a set of optional, user-specified Spark configuration key-value pairs.\nUsers can also pass in a string of extra JVM options to the driver and the executors via\n`spark.driver.extraJavaOptions` and `spark.executor.extraJavaOptions` respectively.",
+          "launch_stage": "GA"
+        },
+        "spark_env_vars": {
+          "description": "An object containing a set of optional, user-specified environment variable key-value pairs.\nPlease note that key-value pair of the form (X,Y) will be exported as is (i.e.,\n`export X='Y'`) while launching the driver and workers.\n\nIn order to specify an additional set of `SPARK_DAEMON_JAVA_OPTS`, we recommend appending\nthem to `$SPARK_DAEMON_JAVA_OPTS` as shown in the example below. This ensures that all\ndefault databricks managed environmental variables are included as well.\n\nExample Spark environment variables:\n`{\"SPARK_WORKER_MEMORY\": \"28000m\", \"SPARK_LOCAL_DIRS\": \"/local_disk0\"}` or\n`{\"SPARK_DAEMON_JAVA_OPTS\": \"$SPARK_DAEMON_JAVA_OPTS -Dspark.shuffle.service.enabled=true\"}`",
+          "launch_stage": "GA"
+        },
+        "spark_version": {
+          "description": "The Spark version of the cluster, e.g. `3.3.x-scala2.11`.\nA list of available Spark versions can be retrieved by using\nthe [clusters/sparkVersions](https://docs.databricks.com/api/workspace/clusters/sparkversions) API call.",
+          "launch_stage": "GA"
+        },
+        "ssh_public_keys": {
+          "description": "SSH public key contents that will be added to each Spark node in this cluster. The\ncorresponding private keys can be used to login with the user name `ubuntu` on port `2200`.\nUp to 10 keys can be specified.",
+          "launch_stage": "GA"
+        },
+        "total_initial_remote_disk_size": {
+          "description": "If set, what the total initial volume size (in GB) of the remote disks should be. Supported for GCP.",
+          "launch_stage": "GA"
+        },
+        "use_ml_runtime": {
+          "description": "This field can only be used when `kind = CLASSIC_PREVIEW`.\n\n`effective_spark_version` is determined by `spark_version` (DBR release), this field `use_ml_runtime`, and whether `node_type_id` is gpu node or not.",
+          "launch_stage": "GA"
+        },
+        "worker_node_type_flexibility": {
+          "description": "Flexible node type configuration for worker nodes.",
+          "ref": "compute.NodeTypeFlexibility",
+          "launch_stage": "GA"
+        },
+        "workload_type": {
+          "ref": "compute.WorkloadType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.CreateClusterResponse": {
+      "fields": {
+        "cluster_id": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.CreateContext": {
+      "fields": {
+        "clusterId": {
+          "description": "Running cluster id",
+          "launch_stage": "GA"
+        },
+        "language": {
+          "ref": "compute.Language",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.CreateInstancePool": {
+      "fields": {
+        "aws_attributes": {
+          "description": "Attributes related to instance pools running on Amazon Web Services.\nIf not specified at pool creation, a set of default values will be used.",
+          "ref": "compute.InstancePoolAwsAttributes",
+          "launch_stage": "GA"
+        },
+        "azure_attributes": {
+          "description": "Attributes related to instance pools running on Azure.\nIf not specified at pool creation, a set of default values will be used.",
+          "ref": "compute.InstancePoolAzureAttributes",
+          "launch_stage": "GA"
+        },
+        "custom_tags": {
+          "description": "Additional tags for pool resources. Databricks will tag all pool resources (e.g., AWS\ninstances and EBS volumes) with these tags in addition to `default_tags`. Notes:\n\n- Currently, Databricks allows at most 45 custom tags",
+          "launch_stage": "GA"
+        },
+        "disk_spec": {
+          "description": "Defines the specification of the disks that will be attached to all spark containers.",
+          "ref": "compute.DiskSpec",
+          "launch_stage": "GA"
+        },
+        "enable_elastic_disk": {
+          "description": "Autoscaling Local Storage: when enabled, this instances in this pool will dynamically acquire\nadditional disk space when its Spark workers are running low on disk space. In AWS, this\nfeature requires specific AWS permissions to function correctly - refer to the User Guide for\nmore details.",
+          "launch_stage": "GA"
+        },
+        "gcp_attributes": {
+          "description": "Attributes related to instance pools running on Google Cloud Platform.\nIf not specified at pool creation, a set of default values will be used.",
+          "ref": "compute.InstancePoolGcpAttributes",
+          "launch_stage": "GA"
+        },
+        "idle_instance_autotermination_minutes": {
+          "description": "Automatically terminates the extra instances in the pool cache after they are inactive for this\ntime in minutes if min_idle_instances requirement is already met. If not set, the extra pool\ninstances will be automatically terminated after a default timeout. If specified, the\nthreshold must be between 0 and 10000 minutes.\nUsers can also set this value to 0 to instantly remove idle instances from the cache if\nmin cache size could still hold.",
+          "launch_stage": "GA"
+        },
+        "instance_pool_name": {
+          "description": "Pool name requested by the user. Pool name must be unique. Length must be between 1 and 100\ncharacters.",
+          "launch_stage": "GA"
+        },
+        "max_capacity": {
+          "description": "Maximum number of outstanding instances to keep in the pool, including both instances used by\nclusters and idle instances. Clusters that require further instance provisioning will fail during\nupsize requests.",
+          "launch_stage": "GA"
+        },
+        "min_idle_instances": {
+          "description": "Minimum number of idle instances to keep in the instance pool",
+          "launch_stage": "GA"
+        },
+        "node_type_flexibility": {
+          "description": "Flexible node type configuration for the pool.",
+          "ref": "compute.NodeTypeFlexibility",
+          "launch_stage": "GA"
+        },
+        "node_type_id": {
+          "description": "This field encodes, through a single value, the resources available to each of\nthe Spark nodes in this cluster. For example, the Spark nodes can be provisioned\nand optimized for memory or compute intensive workloads. A list of available node\ntypes can be retrieved by using the [clusters/listNodeTypes](https://docs.databricks.com/api/workspace/clusters/listnodetypes) API call.",
+          "launch_stage": "GA"
+        },
+        "preloaded_docker_images": {
+          "description": "Custom Docker Image BYOC",
+          "launch_stage": "GA"
+        },
+        "preloaded_spark_versions": {
+          "description": "A list containing at most one preloaded Spark image version for the pool. Pool-backed clusters started\nwith the preloaded Spark version will start faster. A list of available Spark versions\ncan be retrieved by using the [clusters/sparkVersions](https://docs.databricks.com/api/workspace/clusters/sparkversions) API call.",
+          "launch_stage": "GA"
+        },
+        "remote_disk_throughput": {
+          "description": "If set, what the configurable throughput (in Mb/s) for the remote disk is. Currently only supported for GCP HYPERDISK_BALANCED types.",
+          "launch_stage": "GA"
+        },
+        "total_initial_remote_disk_size": {
+          "description": "If set, what the total initial volume size (in GB) of the remote disks should be. Currently only supported for GCP HYPERDISK_BALANCED types.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.CreateInstancePoolResponse": {
+      "fields": {
+        "instance_pool_id": {
+          "description": "The ID of the created instance pool.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.CreatePolicy": {
+      "fields": {
+        "definition": {
+          "description": "Policy definition document expressed in [Databricks Cluster Policy Definition Language](https://docs.databricks.com/administration-guide/clusters/policy-definition.html).",
+          "launch_stage": "GA"
+        },
+        "description": {
+          "description": "Additional human-readable description of the cluster policy.",
+          "launch_stage": "GA"
+        },
+        "libraries": {
+          "description": "A list of libraries to be installed on the next cluster restart that uses this policy. The maximum number of libraries is 500.",
+          "launch_stage": "GA"
+        },
+        "max_clusters_per_user": {
+          "description": "Max number of clusters per user that can be active using this policy. If not present, there is no max limit.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Cluster Policy name requested by the user. This has to be unique. Length must be between 1 and 100\ncharacters.",
+          "launch_stage": "GA"
+        },
+        "policy_family_definition_overrides": {
+          "description": "Policy definition JSON document expressed in [Databricks Policy Definition Language](https://docs.databricks.com/administration-guide/clusters/policy-definition.html).\nThe JSON document must be passed as a string and cannot be embedded in the requests.\n\nYou can use this to customize the policy definition inherited from the policy family.\nPolicy rules specified here are merged into the inherited policy definition.",
+          "launch_stage": "GA"
+        },
+        "policy_family_id": {
+          "description": "ID of the policy family. The cluster policy's policy definition inherits the policy\nfamily's policy definition.\n\nCannot be used with `definition`. Use `policy_family_definition_overrides` instead to\ncustomize the policy definition.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.CreatePolicyResponse": {
+      "fields": {
+        "policy_id": {
+          "description": "Canonical unique identifier for the cluster policy.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.CreateResponse": {
+      "fields": {
+        "script_id": {
+          "description": "The global init script ID.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.Created": {
+      "fields": {
+        "id": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.CustomPolicyTag": {
+      "fields": {
+        "key": {
+          "description": "The key of the tag.\n- Must be unique among all custom tags of the same policy\n- Cannot be “budget-policy-name”, “budget-policy-id” or \"budget-policy-resolution-result\" -\nthese tags are preserved.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "value": {
+          "description": "The value of the tag.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "compute.DataPlaneEventDetails": {
+      "fields": {
+        "event_type": {
+          "ref": "compute.DataPlaneEventDetailsEventType",
+          "launch_stage": "GA"
+        },
+        "executor_failures": {
+          "launch_stage": "GA"
+        },
+        "host_id": {
+          "launch_stage": "GA"
+        },
+        "timestamp": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.DataPlaneEventDetailsEventType": {
+      "enum": [
+        "NODE_BLACKLISTED",
+        "NODE_EXCLUDED_DECOMMISSIONED"
+      ],
+      "enum_launch_stages": {
+        "NODE_BLACKLISTED": "GA",
+        "NODE_EXCLUDED_DECOMMISSIONED": "GA"
+      }
+    },
+    "compute.DataSecurityMode": {
+      "description": "Data security mode decides what data governance model to use when accessing data\nfrom a cluster.\n\n* `DATA_SECURITY_MODE_AUTO`: Databricks will choose the most appropriate access mode depending on your compute configuration.\n* `DATA_SECURITY_MODE_STANDARD`: A secure cluster that can be shared by multiple users. Cluster users are fully isolated so that they cannot see each other’s data and credentials. Most data governance features are supported in this mode. But programming languages and cluster features might be limited.\n* `DATA_SECURITY_MODE_DEDICATED`: A secure cluster that can only be exclusively used by a single user specified in `single_user_name`. Most programming languages, cluster features and data governance features are available in this mode.\n\nThe following modes are legacy aliases for the above modes:\n\n* `USER_ISOLATION`: Legacy alias for `DATA_SECURITY_MODE_STANDARD`.\n* `SINGLE_USER`: Legacy alias for `DATA_SECURITY_MODE_DEDICATED`.\n\nThe following modes are deprecated starting with Databricks Runtime 15.0 and\nwill be removed for future Databricks Runtime versions:\n\n* `LEGACY_TABLE_ACL`: This mode is for users migrating from legacy Table ACL clusters.\n* `LEGACY_PASSTHROUGH`: This mode is for users migrating from legacy Passthrough on high concurrency clusters.\n* `LEGACY_SINGLE_USER`: This mode is for users migrating from legacy Passthrough on standard clusters.\n* `LEGACY_SINGLE_USER_STANDARD`: This mode provides a way that doesn’t have UC nor passthrough enabled.",
+      "enum": [
+        "NONE",
+        "SINGLE_USER",
+        "USER_ISOLATION",
+        "LEGACY_TABLE_ACL",
+        "LEGACY_PASSTHROUGH",
+        "LEGACY_SINGLE_USER",
+        "LEGACY_SINGLE_USER_STANDARD",
+        "DATA_SECURITY_MODE_STANDARD",
+        "DATA_SECURITY_MODE_DEDICATED",
+        "DATA_SECURITY_MODE_AUTO"
+      ],
+      "enum_launch_stages": {
+        "DATA_SECURITY_MODE_AUTO": "GA",
+        "DATA_SECURITY_MODE_DEDICATED": "GA",
+        "DATA_SECURITY_MODE_STANDARD": "GA",
+        "LEGACY_PASSTHROUGH": "GA",
+        "LEGACY_SINGLE_USER": "GA",
+        "LEGACY_SINGLE_USER_STANDARD": "GA",
+        "LEGACY_TABLE_ACL": "GA",
+        "NONE": "GA",
+        "SINGLE_USER": "GA",
+        "USER_ISOLATION": "GA"
+      },
+      "enum_descriptions": {
+        "DATA_SECURITY_MODE_AUTO": "\u003cDatabricks\u003e will choose the most appropriate access mode depending on your compute configuration.",
+        "DATA_SECURITY_MODE_DEDICATED": "A secure cluster that can only be exclusively used by a single user specified in `single_user_name`. Most programming languages, cluster features and data governance features are available in this mode.",
+        "DATA_SECURITY_MODE_STANDARD": "A secure cluster that can be shared by multiple users. Cluster users are fully isolated so that they cannot see each other’s data and credentials. Most data governance features are supported in this mode. But programming languages and cluster features might be limited.",
+        "LEGACY_PASSTHROUGH": "This mode is for users migrating from legacy Passthrough on high concurrency clusters.",
+        "LEGACY_SINGLE_USER": "This mode is for users migrating from legacy Passthrough on standard clusters.",
+        "LEGACY_SINGLE_USER_STANDARD": "This mode provides a way that doesn’t have UC nor passthrough enabled.",
+        "LEGACY_TABLE_ACL": "This mode is for users migrating from legacy Table ACL clusters.",
+        "SINGLE_USER": "Legacy alias for `DATA_SECURITY_MODE_DEDICATED`.",
+        "USER_ISOLATION": "Legacy alias for `DATA_SECURITY_MODE_STANDARD`."
+      }
+    },
+    "compute.DbfsStorageInfo": {
+      "description": "A storage location in DBFS",
+      "fields": {
+        "destination": {
+          "description": "dbfs destination, e.g. `dbfs:/my/path`",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.DeleteCluster": {
+      "fields": {
+        "cluster_id": {
+          "description": "The cluster to be terminated.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.DeleteClusterResponse": {},
+    "compute.DeleteGlobalInitScriptRequest": {},
+    "compute.DeleteInstancePool": {
+      "fields": {
+        "instance_pool_id": {
+          "description": "The instance pool to be terminated.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.DeleteInstancePoolResponse": {},
+    "compute.DeletePolicy": {
+      "fields": {
+        "policy_id": {
+          "description": "The ID of the policy to delete.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.DeletePolicyResponse": {},
+    "compute.DeleteResponse": {},
+    "compute.DependencyMode": {
+      "description": "Controls dependency configuration for the cluster.\n\n* `DEPENDENCY_MODE_AUTO`: Databricks will choose the most appropriate dependency mode based on your compute configuration.\n* `DEPENDENCY_MODE_ENVIRONMENTS`: Enables a unified dependency management experience across classic and serverless, resulting in increased stability and performance. Supported only on DBR 19+ in Standard access mode.\n* `DEPENDENCY_MODE_CLUSTER_LIBRARIES`: Legacy mode: dependencies come from cluster libraries and init scripts.",
+      "enum": [
+        "DEPENDENCY_MODE_ENVIRONMENTS",
+        "DEPENDENCY_MODE_CLUSTER_LIBRARIES",
+        "DEPENDENCY_MODE_AUTO"
+      ],
+      "enum_launch_stages": {
+        "DEPENDENCY_MODE_AUTO": "PUBLIC_BETA",
+        "DEPENDENCY_MODE_CLUSTER_LIBRARIES": "PUBLIC_BETA",
+        "DEPENDENCY_MODE_ENVIRONMENTS": "PUBLIC_BETA"
+      },
+      "enum_descriptions": {
+        "DEPENDENCY_MODE_AUTO": "\u003cDatabricks\u003e will choose the most appropriate dependency mode based on your compute configuration.",
+        "DEPENDENCY_MODE_CLUSTER_LIBRARIES": "Legacy mode: dependencies come from cluster libraries and init scripts.",
+        "DEPENDENCY_MODE_ENVIRONMENTS": "Enables a unified dependency management experience across classic and serverless, resulting in increased stability and performance. Supported only on DBR 19+ in Standard access mode."
+      }
+    },
+    "compute.DestroyContext": {
+      "fields": {
+        "clusterId": {
+          "launch_stage": "GA"
+        },
+        "contextId": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.DestroyResponse": {},
+    "compute.DiskSpec": {
+      "description": "Describes the disks that are launched for each instance in the spark cluster.\nFor example, if the cluster has 3 instances, each instance is configured to launch\n2 disks, 100 GiB each, then Databricks will launch a total of 6 disks,\n100 GiB each, for this cluster.",
+      "fields": {
+        "disk_count": {
+          "description": "The number of disks launched for each instance:\n- This feature is only enabled for supported node types.\n- Users can choose up to the limit of the disks supported by the node type.\n- For node types with no OS disk, at least one disk must be specified;\notherwise, cluster creation will fail.\n\nIf disks are attached, Databricks will configure Spark to use only the disks for\nscratch storage, because heterogenously sized scratch devices can lead to inefficient disk\nutilization. If no disks are attached, Databricks will configure Spark to use\ninstance store disks.\n\nNote: If disks are specified, then the Spark configuration\n`spark.local.dir` will be overridden.\n\nDisks will be mounted at:\n- For AWS: `/ebs0`, `/ebs1`, and etc.\n- For Azure: `/remote_volume0`, `/remote_volume1`, and etc.",
+          "launch_stage": "GA"
+        },
+        "disk_iops": {
+          "launch_stage": "GA"
+        },
+        "disk_size": {
+          "description": "The size of each disk (in GiB) launched for each instance.\nValues must fall into the supported range for a particular instance type.\n\nFor AWS:\n- General Purpose SSD: 100 - 4096 GiB\n- Throughput Optimized HDD: 500 - 4096 GiB\n\nFor Azure:\n- Premium LRS (SSD): 1 - 1023 GiB\n- Standard LRS (HDD): 1- 1023 GiB",
+          "launch_stage": "GA"
+        },
+        "disk_throughput": {
+          "launch_stage": "GA"
+        },
+        "disk_type": {
+          "description": "The type of disks that will be launched with this cluster.",
+          "ref": "compute.DiskType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.DiskType": {
+      "description": "Describes the disk type.",
+      "fields": {
+        "azure_disk_volume_type": {
+          "ref": "compute.DiskTypeAzureDiskVolumeType",
+          "launch_stage": "GA"
+        },
+        "ebs_volume_type": {
+          "ref": "compute.DiskTypeEbsVolumeType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.DiskTypeAzureDiskVolumeType": {
+      "description": "All Azure Disk types that Databricks supports.\nSee https://docs.microsoft.com/en-us/azure/storage/storage-about-disks-and-vhds-linux#types-of-disks",
+      "enum": [
+        "PREMIUM_LRS",
+        "STANDARD_LRS"
+      ],
+      "enum_launch_stages": {
+        "PREMIUM_LRS": "GA",
+        "STANDARD_LRS": "GA"
+      }
+    },
+    "compute.DiskTypeEbsVolumeType": {
+      "description": "All EBS volume types that Databricks supports.\nSee https://aws.amazon.com/ebs/details/ for details.",
+      "enum": [
+        "GENERAL_PURPOSE_SSD",
+        "THROUGHPUT_OPTIMIZED_HDD"
+      ],
+      "enum_launch_stages": {
+        "GENERAL_PURPOSE_SSD": "GA",
+        "THROUGHPUT_OPTIMIZED_HDD": "GA"
+      }
+    },
+    "compute.DockerBasicAuth": {
+      "fields": {
+        "password": {
+          "description": "Password of the user",
+          "launch_stage": "GA"
+        },
+        "username": {
+          "description": "Name of the user",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.DockerImage": {
+      "fields": {
+        "basic_auth": {
+          "description": "Basic auth with username and password",
+          "ref": "compute.DockerBasicAuth",
+          "launch_stage": "GA"
+        },
+        "url": {
+          "description": "URL of the docker image.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.EbsVolumeType": {
+      "description": "All EBS volume types that Databricks supports.\nSee https://aws.amazon.com/ebs/details/ for details.",
+      "enum": [
+        "GENERAL_PURPOSE_SSD",
+        "THROUGHPUT_OPTIMIZED_HDD"
+      ],
+      "enum_launch_stages": {
+        "GENERAL_PURPOSE_SSD": "GA",
+        "THROUGHPUT_OPTIMIZED_HDD": "GA"
+      }
+    },
+    "compute.EditCluster": {
+      "fields": {
+        "apply_policy_default_values": {
+          "description": "When set to true, fixed and default values from the policy will be used for fields that are omitted. When set to false, only fixed values from the policy will be applied.",
+          "launch_stage": "GA"
+        },
+        "autoscale": {
+          "description": "Parameters needed in order to automatically scale clusters up and down based on load.\nNote: autoscaling works best with DB runtime versions 3.0 or later.",
+          "ref": "compute.AutoScale",
+          "launch_stage": "GA"
+        },
+        "autotermination_minutes": {
+          "description": "Automatically terminates the cluster after it is inactive for this time in minutes. If not set,\nthis cluster will not be automatically terminated. If specified, the threshold must be between\n10 and 10000 minutes.\nUsers can also set this value to 0 to explicitly disable automatic termination.",
+          "launch_stage": "GA"
+        },
+        "aws_attributes": {
+          "description": "Attributes related to clusters running on Amazon Web Services.\nIf not specified at cluster creation, a set of default values will be used.",
+          "ref": "compute.AwsAttributes",
+          "launch_stage": "GA"
+        },
+        "azure_attributes": {
+          "description": "Attributes related to clusters running on Microsoft Azure.\nIf not specified at cluster creation, a set of default values will be used.",
+          "ref": "compute.AzureAttributes",
+          "launch_stage": "GA"
+        },
+        "cluster_id": {
+          "description": "ID of the cluster",
+          "launch_stage": "GA"
+        },
+        "cluster_log_conf": {
+          "description": "The configuration for delivering spark logs to a long-term storage destination.\nThree kinds of destinations (DBFS, S3 and Unity Catalog volumes) are supported. Only one destination can be specified\nfor one cluster. If the conf is given, the logs will be delivered to the destination every\n`5 mins`. The destination of driver logs is `$destination/$clusterId/driver`, while\nthe destination of executor logs is `$destination/$clusterId/executor`.",
+          "ref": "compute.ClusterLogConf",
+          "launch_stage": "GA"
+        },
+        "cluster_name": {
+          "description": "Cluster name requested by the user. This doesn't have to be unique.\nIf not specified at creation, the cluster name will be an empty string.\nFor job clusters, the cluster name is automatically set based on the job and job run IDs.",
+          "launch_stage": "GA"
+        },
+        "custom_tags": {
+          "description": "Additional tags for cluster resources. Databricks will tag all cluster resources (e.g., AWS\ninstances and EBS volumes) with these tags in addition to `default_tags`. Notes:\n\n- Currently, Databricks allows at most 45 custom tags\n\n- Clusters can only reuse cloud resources if the resources' tags are a subset of the cluster tags",
+          "launch_stage": "GA"
+        },
+        "data_security_mode": {
+          "ref": "compute.DataSecurityMode",
+          "launch_stage": "GA"
+        },
+        "dependency_mode": {
+          "description": "Controls dependency configuration for the cluster.",
+          "ref": "compute.DependencyMode",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "docker_image": {
+          "description": "Custom docker image BYOC",
+          "ref": "compute.DockerImage",
+          "launch_stage": "GA"
+        },
+        "driver_instance_pool_id": {
+          "description": "The optional ID of the instance pool for the driver of the cluster belongs.\nThe pool cluster uses the instance pool with id (instance_pool_id) if the driver pool is not\nassigned.",
+          "launch_stage": "GA"
+        },
+        "driver_node_type_flexibility": {
+          "description": "Flexible node type configuration for the driver node.",
+          "ref": "compute.NodeTypeFlexibility",
+          "launch_stage": "GA"
+        },
+        "driver_node_type_id": {
+          "description": "The node type of the Spark driver.\nNote that this field is optional; if unset, the driver node type will be set as the same value\nas `node_type_id` defined above.",
+          "launch_stage": "GA"
+        },
+        "enable_elastic_disk": {
+          "description": "Autoscaling Local Storage: when enabled, this cluster will dynamically acquire additional disk\nspace when its Spark workers are running low on disk space.",
+          "launch_stage": "GA"
+        },
+        "enable_local_disk_encryption": {
+          "description": "Whether to enable LUKS on cluster VMs' local disks",
+          "launch_stage": "GA"
+        },
+        "gcp_attributes": {
+          "description": "Attributes related to clusters running on Google Cloud Platform.\nIf not specified at cluster creation, a set of default values will be used.",
+          "ref": "compute.GcpAttributes",
+          "launch_stage": "GA"
+        },
+        "init_scripts": {
+          "description": "The configuration for storing init scripts. Any number of destinations can be specified.\nThe scripts are executed sequentially in the order provided.\nIf `cluster_log_conf` is specified, init script logs are sent to `\u003cdestination\u003e/\u003ccluster-ID\u003e/init_scripts`.",
+          "launch_stage": "GA"
+        },
+        "instance_pool_id": {
+          "description": "The optional ID of the instance pool to which the cluster belongs.",
+          "launch_stage": "GA"
+        },
+        "is_single_node": {
+          "description": "This field can only be used when `kind = CLASSIC_PREVIEW`.\n\nWhen set to true, Databricks will automatically set single node related `custom_tags`, `spark_conf`, and `num_workers`",
+          "launch_stage": "GA"
+        },
+        "kind": {
+          "ref": "compute.Kind",
+          "launch_stage": "GA"
+        },
+        "node_type_id": {
+          "description": "This field encodes, through a single value, the resources available to each of\nthe Spark nodes in this cluster. For example, the Spark nodes can be provisioned\nand optimized for memory or compute intensive workloads. A list of available node\ntypes can be retrieved by using the [clusters/listNodeTypes](https://docs.databricks.com/api/workspace/clusters/listnodetypes) API call.",
+          "launch_stage": "GA"
+        },
+        "num_workers": {
+          "description": "Number of worker nodes that this cluster should have. A cluster has one Spark Driver\nand `num_workers` Executors for a total of `num_workers` + 1 Spark nodes.\n\nNote: When reading the properties of a cluster, this field reflects the desired number\nof workers rather than the actual current number of workers. For instance, if a cluster\nis resized from 5 to 10 workers, this field will immediately be updated to reflect\nthe target size of 10 workers, whereas the workers listed in `spark_info` will gradually\nincrease from 5 to 10 as the new nodes are provisioned.",
+          "launch_stage": "GA"
+        },
+        "policy_id": {
+          "description": "The ID of the cluster policy used to create the cluster if applicable.",
+          "launch_stage": "GA"
+        },
+        "remote_disk_throughput": {
+          "description": "If set, what the configurable throughput (in Mb/s) for the remote disk is. Currently only supported for GCP HYPERDISK_BALANCED disks.",
+          "launch_stage": "GA"
+        },
+        "runtime_engine": {
+          "description": "Determines the cluster's runtime engine, either standard or Photon.\n\nThis field is not compatible with legacy `spark_version` values that contain `-photon-`.\nRemove `-photon-` from the `spark_version` and set `runtime_engine` to `PHOTON`.\n\nIf left unspecified, the runtime engine defaults to standard unless the spark_version\ncontains -photon-, in which case Photon will be used.",
+          "ref": "compute.RuntimeEngine",
+          "launch_stage": "GA"
+        },
+        "single_user_name": {
+          "description": "Single user name if data_security_mode is `SINGLE_USER`",
+          "launch_stage": "GA"
+        },
+        "spark_conf": {
+          "description": "An object containing a set of optional, user-specified Spark configuration key-value pairs.\nUsers can also pass in a string of extra JVM options to the driver and the executors via\n`spark.driver.extraJavaOptions` and `spark.executor.extraJavaOptions` respectively.",
+          "launch_stage": "GA"
+        },
+        "spark_env_vars": {
+          "description": "An object containing a set of optional, user-specified environment variable key-value pairs.\nPlease note that key-value pair of the form (X,Y) will be exported as is (i.e.,\n`export X='Y'`) while launching the driver and workers.\n\nIn order to specify an additional set of `SPARK_DAEMON_JAVA_OPTS`, we recommend appending\nthem to `$SPARK_DAEMON_JAVA_OPTS` as shown in the example below. This ensures that all\ndefault databricks managed environmental variables are included as well.\n\nExample Spark environment variables:\n`{\"SPARK_WORKER_MEMORY\": \"28000m\", \"SPARK_LOCAL_DIRS\": \"/local_disk0\"}` or\n`{\"SPARK_DAEMON_JAVA_OPTS\": \"$SPARK_DAEMON_JAVA_OPTS -Dspark.shuffle.service.enabled=true\"}`",
+          "launch_stage": "GA"
+        },
+        "spark_version": {
+          "description": "The Spark version of the cluster, e.g. `3.3.x-scala2.11`.\nA list of available Spark versions can be retrieved by using\nthe [clusters/sparkVersions](https://docs.databricks.com/api/workspace/clusters/sparkversions) API call.",
+          "launch_stage": "GA"
+        },
+        "ssh_public_keys": {
+          "description": "SSH public key contents that will be added to each Spark node in this cluster. The\ncorresponding private keys can be used to login with the user name `ubuntu` on port `2200`.\nUp to 10 keys can be specified.",
+          "launch_stage": "GA"
+        },
+        "total_initial_remote_disk_size": {
+          "description": "If set, what the total initial volume size (in GB) of the remote disks should be. Supported for GCP.",
+          "launch_stage": "GA"
+        },
+        "use_ml_runtime": {
+          "description": "This field can only be used when `kind = CLASSIC_PREVIEW`.\n\n`effective_spark_version` is determined by `spark_version` (DBR release), this field `use_ml_runtime`, and whether `node_type_id` is gpu node or not.",
+          "launch_stage": "GA"
+        },
+        "worker_node_type_flexibility": {
+          "description": "Flexible node type configuration for worker nodes.",
+          "ref": "compute.NodeTypeFlexibility",
+          "launch_stage": "GA"
+        },
+        "workload_type": {
+          "ref": "compute.WorkloadType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.EditClusterResponse": {},
+    "compute.EditInstancePool": {
+      "fields": {
+        "custom_tags": {
+          "description": "Additional tags for pool resources. Databricks will tag all pool resources (e.g., AWS\ninstances and EBS volumes) with these tags in addition to `default_tags`. Notes:\n\n- Currently, Databricks allows at most 45 custom tags",
+          "launch_stage": "GA"
+        },
+        "idle_instance_autotermination_minutes": {
+          "description": "Automatically terminates the extra instances in the pool cache after they are inactive for this\ntime in minutes if min_idle_instances requirement is already met. If not set, the extra pool\ninstances will be automatically terminated after a default timeout. If specified, the\nthreshold must be between 0 and 10000 minutes.\nUsers can also set this value to 0 to instantly remove idle instances from the cache if\nmin cache size could still hold.",
+          "launch_stage": "GA"
+        },
+        "instance_pool_id": {
+          "description": "Instance pool ID",
+          "launch_stage": "GA"
+        },
+        "instance_pool_name": {
+          "description": "Pool name requested by the user. Pool name must be unique. Length must be between 1 and 100\ncharacters.",
+          "launch_stage": "GA"
+        },
+        "max_capacity": {
+          "description": "Maximum number of outstanding instances to keep in the pool, including both instances used by\nclusters and idle instances. Clusters that require further instance provisioning will fail during\nupsize requests.",
+          "launch_stage": "GA"
+        },
+        "min_idle_instances": {
+          "description": "Minimum number of idle instances to keep in the instance pool",
+          "launch_stage": "GA"
+        },
+        "node_type_id": {
+          "description": "This field encodes, through a single value, the resources available to each of\nthe Spark nodes in this cluster. For example, the Spark nodes can be provisioned\nand optimized for memory or compute intensive workloads. A list of available node\ntypes can be retrieved by using the [clusters/listNodeTypes](https://docs.databricks.com/api/workspace/clusters/listnodetypes) API call.",
+          "launch_stage": "GA"
+        },
+        "remote_disk_throughput": {
+          "description": "If set, what the configurable throughput (in Mb/s) for the remote disk is. Currently only supported for GCP HYPERDISK_BALANCED types.",
+          "launch_stage": "GA"
+        },
+        "total_initial_remote_disk_size": {
+          "description": "If set, what the total initial volume size (in GB) of the remote disks should be. Currently only supported for GCP HYPERDISK_BALANCED types.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.EditInstancePoolResponse": {},
+    "compute.EditPolicy": {
+      "fields": {
+        "definition": {
+          "description": "Policy definition document expressed in [Databricks Cluster Policy Definition Language](https://docs.databricks.com/administration-guide/clusters/policy-definition.html).",
+          "launch_stage": "GA"
+        },
+        "description": {
+          "description": "Additional human-readable description of the cluster policy.",
+          "launch_stage": "GA"
+        },
+        "libraries": {
+          "description": "A list of libraries to be installed on the next cluster restart that uses this policy. The maximum number of libraries is 500.",
+          "launch_stage": "GA"
+        },
+        "max_clusters_per_user": {
+          "description": "Max number of clusters per user that can be active using this policy. If not present, there is no max limit.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Cluster Policy name requested by the user. This has to be unique. Length must be between 1 and 100\ncharacters.",
+          "launch_stage": "GA"
+        },
+        "policy_family_definition_overrides": {
+          "description": "Policy definition JSON document expressed in [Databricks Policy Definition Language](https://docs.databricks.com/administration-guide/clusters/policy-definition.html).\nThe JSON document must be passed as a string and cannot be embedded in the requests.\n\nYou can use this to customize the policy definition inherited from the policy family.\nPolicy rules specified here are merged into the inherited policy definition.",
+          "launch_stage": "GA"
+        },
+        "policy_family_id": {
+          "description": "ID of the policy family. The cluster policy's policy definition inherits the policy\nfamily's policy definition.\n\nCannot be used with `definition`. Use `policy_family_definition_overrides` instead to\ncustomize the policy definition.",
+          "launch_stage": "GA"
+        },
+        "policy_id": {
+          "description": "The ID of the policy to update.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.EditPolicyResponse": {},
+    "compute.EditResponse": {},
+    "compute.EnforceClusterComplianceRequest": {
+      "fields": {
+        "cluster_id": {
+          "description": "The ID of the cluster you want to enforce policy compliance on.",
+          "launch_stage": "GA"
+        },
+        "enforce_mode": {
+          "description": "Determines how changes should be made to clusters that are not in `TERMINATED` state.\n\n- `ENFORCE_IMMEDIATELY`: If the cluster is in a `RUNNING` state, it will be restarted so\nthat the new attributes can take effect. For other states aside from `TERMINATED` state,\nthe request will be rejected.\n- `WAIT_FOR_TERMINATION`: The cluster is not immediately edited. Instead, a pending enforcement\nis scheduled to update the cluster when it terminates or restarts. When this occurs,\n`enforce_result` will contain `DEFERRED`. Only workspace admins can use this mode.\n\nRegardless of the enforce mode, clusters in `TERMINATED` state are immediately edited.",
+          "ref": "compute.EnforcePolicyComplianceForClusterEnforceMode",
+          "launch_stage": "GA"
+        },
+        "validate_only": {
+          "description": "If set, previews the changes that would be made to a cluster\nto enforce compliance but does not update the cluster.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.EnforceClusterComplianceResponse": {
+      "fields": {
+        "changes": {
+          "description": "A list of changes that have been made to the cluster settings for\nthe cluster to become compliant with its policy.",
+          "launch_stage": "GA"
+        },
+        "enforce_result": {
+          "description": "Describes whether changes have been applied to the cluster.",
+          "ref": "compute.EnforcePolicyComplianceForClusterResponseEnforceResult",
+          "launch_stage": "GA"
+        },
+        "has_changes": {
+          "description": "Whether any changes have been made to the cluster settings for the cluster\nto become compliant with its policy.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.EnforcePolicyComplianceForClusterEnforceMode": {
+      "enum": [
+        "ENFORCE_IMMEDIATELY",
+        "WAIT_FOR_TERMINATION"
+      ],
+      "enum_launch_stages": {
+        "ENFORCE_IMMEDIATELY": "GA",
+        "WAIT_FOR_TERMINATION": "GA"
+      }
+    },
+    "compute.EnforcePolicyComplianceForClusterResponseClusterSettings": {
+      "fields": {
+        "autoscale": {
+          "description": "Parameters needed in order to automatically scale clusters up and down based on load.\nNote: autoscaling works best with DB runtime versions 3.0 or later.",
+          "ref": "compute.AutoScale",
+          "launch_stage": "GA"
+        },
+        "autotermination_minutes": {
+          "description": "Automatically terminates the cluster after it is inactive for this time in minutes. If not set,\nthis cluster will not be automatically terminated. If specified, the threshold must be between\n10 and 10000 minutes.\nUsers can also set this value to 0 to explicitly disable automatic termination.",
+          "launch_stage": "GA"
+        },
+        "aws_attributes": {
+          "description": "Attributes related to clusters running on Amazon Web Services.\nIf not specified at cluster creation, a set of default values will be used.",
+          "ref": "compute.AwsAttributes",
+          "launch_stage": "GA"
+        },
+        "azure_attributes": {
+          "description": "Attributes related to clusters running on Microsoft Azure.\nIf not specified at cluster creation, a set of default values will be used.",
+          "ref": "compute.AzureAttributes",
+          "launch_stage": "GA"
+        },
+        "cluster_log_conf": {
+          "description": "The configuration for delivering spark logs to a long-term storage destination.\nThree kinds of destinations (DBFS, S3 and Unity Catalog volumes) are supported. Only one destination can be specified\nfor one cluster. If the conf is given, the logs will be delivered to the destination every\n`5 mins`. The destination of driver logs is `$destination/$clusterId/driver`, while\nthe destination of executor logs is `$destination/$clusterId/executor`.",
+          "ref": "compute.ClusterLogConf",
+          "launch_stage": "GA"
+        },
+        "cluster_name": {
+          "description": "Cluster name requested by the user. This doesn't have to be unique.\nIf not specified at creation, the cluster name will be an empty string.\nFor job clusters, the cluster name is automatically set based on the job and job run IDs.",
+          "launch_stage": "GA"
+        },
+        "custom_tags": {
+          "description": "Additional tags for cluster resources. Databricks will tag all cluster resources (e.g., AWS\ninstances and EBS volumes) with these tags in addition to `default_tags`. Notes:\n\n- Currently, Databricks allows at most 45 custom tags\n\n- Clusters can only reuse cloud resources if the resources' tags are a subset of the cluster tags",
+          "launch_stage": "GA"
+        },
+        "data_security_mode": {
+          "ref": "compute.DataSecurityMode",
+          "launch_stage": "GA"
+        },
+        "dependency_mode": {
+          "description": "Controls dependency configuration for the cluster.",
+          "ref": "compute.DependencyMode",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "docker_image": {
+          "description": "Custom docker image BYOC",
+          "ref": "compute.DockerImage",
+          "launch_stage": "GA"
+        },
+        "driver_instance_pool_id": {
+          "description": "The optional ID of the instance pool for the driver of the cluster belongs.\nThe pool cluster uses the instance pool with id (instance_pool_id) if the driver pool is not\nassigned.",
+          "launch_stage": "GA"
+        },
+        "driver_node_type_flexibility": {
+          "description": "Flexible node type configuration for the driver node.",
+          "ref": "compute.NodeTypeFlexibility",
+          "launch_stage": "GA"
+        },
+        "driver_node_type_id": {
+          "description": "The node type of the Spark driver.\nNote that this field is optional; if unset, the driver node type will be set as the same value\nas `node_type_id` defined above.",
+          "launch_stage": "GA"
+        },
+        "enable_elastic_disk": {
+          "description": "Autoscaling Local Storage: when enabled, this cluster will dynamically acquire additional disk\nspace when its Spark workers are running low on disk space.",
+          "launch_stage": "GA"
+        },
+        "enable_local_disk_encryption": {
+          "description": "Whether to enable LUKS on cluster VMs' local disks",
+          "launch_stage": "GA"
+        },
+        "gcp_attributes": {
+          "description": "Attributes related to clusters running on Google Cloud Platform.\nIf not specified at cluster creation, a set of default values will be used.",
+          "ref": "compute.GcpAttributes",
+          "launch_stage": "GA"
+        },
+        "init_scripts": {
+          "description": "The configuration for storing init scripts. Any number of destinations can be specified.\nThe scripts are executed sequentially in the order provided.\nIf `cluster_log_conf` is specified, init script logs are sent to `\u003cdestination\u003e/\u003ccluster-ID\u003e/init_scripts`.",
+          "launch_stage": "GA"
+        },
+        "instance_pool_id": {
+          "description": "The optional ID of the instance pool to which the cluster belongs.",
+          "launch_stage": "GA"
+        },
+        "is_single_node": {
+          "description": "This field can only be used when `kind = CLASSIC_PREVIEW`.\n\nWhen set to true, Databricks will automatically set single node related `custom_tags`, `spark_conf`, and `num_workers`",
+          "launch_stage": "GA"
+        },
+        "kind": {
+          "ref": "compute.Kind",
+          "launch_stage": "GA"
+        },
+        "node_type_id": {
+          "description": "This field encodes, through a single value, the resources available to each of\nthe Spark nodes in this cluster. For example, the Spark nodes can be provisioned\nand optimized for memory or compute intensive workloads. A list of available node\ntypes can be retrieved by using the [clusters/listNodeTypes](https://docs.databricks.com/api/workspace/clusters/listnodetypes) API call.",
+          "launch_stage": "GA"
+        },
+        "num_workers": {
+          "description": "Number of worker nodes that this cluster should have. A cluster has one Spark Driver\nand `num_workers` Executors for a total of `num_workers` + 1 Spark nodes.\n\nNote: When reading the properties of a cluster, this field reflects the desired number\nof workers rather than the actual current number of workers. For instance, if a cluster\nis resized from 5 to 10 workers, this field will immediately be updated to reflect\nthe target size of 10 workers, whereas the workers listed in `spark_info` will gradually\nincrease from 5 to 10 as the new nodes are provisioned.",
+          "launch_stage": "GA"
+        },
+        "policy_id": {
+          "description": "The ID of the cluster policy used to create the cluster if applicable.",
+          "launch_stage": "GA"
+        },
+        "remote_disk_throughput": {
+          "description": "If set, what the configurable throughput (in Mb/s) for the remote disk is. Currently only supported for GCP HYPERDISK_BALANCED disks.",
+          "launch_stage": "GA"
+        },
+        "runtime_engine": {
+          "description": "Determines the cluster's runtime engine, either standard or Photon.\n\nThis field is not compatible with legacy `spark_version` values that contain `-photon-`.\nRemove `-photon-` from the `spark_version` and set `runtime_engine` to `PHOTON`.\n\nIf left unspecified, the runtime engine defaults to standard unless the spark_version\ncontains -photon-, in which case Photon will be used.",
+          "ref": "compute.RuntimeEngine",
+          "launch_stage": "GA"
+        },
+        "single_user_name": {
+          "description": "Single user name if data_security_mode is `SINGLE_USER`",
+          "launch_stage": "GA"
+        },
+        "spark_conf": {
+          "description": "An object containing a set of optional, user-specified Spark configuration key-value pairs.\nUsers can also pass in a string of extra JVM options to the driver and the executors via\n`spark.driver.extraJavaOptions` and `spark.executor.extraJavaOptions` respectively.",
+          "launch_stage": "GA"
+        },
+        "spark_env_vars": {
+          "description": "An object containing a set of optional, user-specified environment variable key-value pairs.\nPlease note that key-value pair of the form (X,Y) will be exported as is (i.e.,\n`export X='Y'`) while launching the driver and workers.\n\nIn order to specify an additional set of `SPARK_DAEMON_JAVA_OPTS`, we recommend appending\nthem to `$SPARK_DAEMON_JAVA_OPTS` as shown in the example below. This ensures that all\ndefault databricks managed environmental variables are included as well.\n\nExample Spark environment variables:\n`{\"SPARK_WORKER_MEMORY\": \"28000m\", \"SPARK_LOCAL_DIRS\": \"/local_disk0\"}` or\n`{\"SPARK_DAEMON_JAVA_OPTS\": \"$SPARK_DAEMON_JAVA_OPTS -Dspark.shuffle.service.enabled=true\"}`",
+          "launch_stage": "GA"
+        },
+        "spark_version": {
+          "description": "The Spark version of the cluster, e.g. `3.3.x-scala2.11`.\nA list of available Spark versions can be retrieved by using\nthe [clusters/sparkVersions](https://docs.databricks.com/api/workspace/clusters/sparkversions) API call.",
+          "launch_stage": "GA"
+        },
+        "ssh_public_keys": {
+          "description": "SSH public key contents that will be added to each Spark node in this cluster. The\ncorresponding private keys can be used to login with the user name `ubuntu` on port `2200`.\nUp to 10 keys can be specified.",
+          "launch_stage": "GA"
+        },
+        "total_initial_remote_disk_size": {
+          "description": "If set, what the total initial volume size (in GB) of the remote disks should be. Supported for GCP.",
+          "launch_stage": "GA"
+        },
+        "use_ml_runtime": {
+          "description": "This field can only be used when `kind = CLASSIC_PREVIEW`.\n\n`effective_spark_version` is determined by `spark_version` (DBR release), this field `use_ml_runtime`, and whether `node_type_id` is gpu node or not.",
+          "launch_stage": "GA"
+        },
+        "worker_node_type_flexibility": {
+          "description": "Flexible node type configuration for worker nodes.",
+          "ref": "compute.NodeTypeFlexibility",
+          "launch_stage": "GA"
+        },
+        "workload_type": {
+          "ref": "compute.WorkloadType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.EnforcePolicyComplianceForClusterResponseEnforceResult": {
+      "enum": [
+        "NO_CHANGES",
+        "APPLIED",
+        "DEFERRED"
+      ],
+      "enum_launch_stages": {
+        "APPLIED": "GA",
+        "DEFERRED": "GA",
+        "NO_CHANGES": "GA"
+      }
+    },
+    "compute.Environment": {
+      "description": "The environment entity used to preserve serverless environment side panel, jobs' environment for non-notebook task, and SDP's environment for classic and serverless pipelines.\nIn this minimal environment spec, only pip and java dependencies are supported.",
+      "fields": {
+        "base_environment": {
+          "description": "The base environment this environment is built on top of. A base environment defines the environment version and a\nlist of dependencies for serverless compute. The value can be a file path to a custom `env.yaml` file\n(e.g., `/Workspace/path/to/env.yaml`). Support for a Databricks-provided base environment ID\n(e.g., `workspace-base-environments/databricks_ai_v4`) and workspace base environment ID\n(e.g., `workspace-base-environments/dbe_b849b66e-b31a-4cb5-b161-1f2b10877fb7`) is in Beta.\nEither `environment_version` or `base_environment` can be provided.\nFor more information about Databricks-provided base environments, see the\n[list workspace base environments](:method:Environments/ListWorkspaceBaseEnvironments) API.\nFor more information, see",
+          "launch_stage": "GA"
+        },
+        "client": {
+          "description": "Use `environment_version` instead.",
+          "deprecated": true,
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "dependencies": {
+          "description": "List of pip dependencies, as supported by the version of pip in this environment.\nEach dependency is a valid pip requirements file line per https://pip.pypa.io/en/stable/reference/requirements-file-format/.\nAllowed dependencies include a requirement specifier, an archive URL, a local project path (such as WSFS or UC Volumes in Databricks), or a VCS project URL.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "environment_version": {
+          "description": "Either `environment_version` or `base_environment` needs to be provided. Environment version used by the environment.\nEach version comes with a specific Python version and a set of Python packages.\nThe version is a string, consisting of an integer.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "java_dependencies": {
+          "description": "List of java dependencies. Each dependency is a string representing a java library path. For example: `/Volumes/path/to/test.jar`.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "project_environment": {
+          "description": "File path of pyproject.toml file that defines the project-scoped environment.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "compute.EventDetails": {
+      "fields": {
+        "attributes": {
+          "description": "* For created clusters, the attributes of the cluster.\n* For edited clusters, the new attributes of the cluster.",
+          "ref": "compute.ClusterAttributes",
+          "launch_stage": "GA"
+        },
+        "cause": {
+          "description": "The cause of a change in target size.",
+          "ref": "compute.EventDetailsCause",
+          "launch_stage": "GA"
+        },
+        "cluster_size": {
+          "description": "The actual cluster size that was set in the cluster creation or edit.",
+          "ref": "compute.ClusterSize",
+          "launch_stage": "GA"
+        },
+        "current_num_vcpus": {
+          "description": "The current number of vCPUs in the cluster.",
+          "launch_stage": "GA"
+        },
+        "current_num_workers": {
+          "description": "The current number of nodes in the cluster.",
+          "launch_stage": "GA"
+        },
+        "did_not_expand_reason": {
+          "launch_stage": "GA"
+        },
+        "disk_size": {
+          "description": "Current disk size in bytes",
+          "launch_stage": "GA"
+        },
+        "driver_state_message": {
+          "description": "More details about the change in driver's state",
+          "launch_stage": "GA"
+        },
+        "enable_termination_for_node_blocklisted": {
+          "description": "Whether or not a blocklisted node should be terminated. For ClusterEventType NODE_BLACKLISTED.",
+          "launch_stage": "GA"
+        },
+        "free_space": {
+          "launch_stage": "GA"
+        },
+        "init_scripts": {
+          "description": "List of global and cluster init scripts associated with this cluster event.",
+          "ref": "compute.InitScriptEventDetails",
+          "launch_stage": "GA"
+        },
+        "instance_id": {
+          "description": "Instance Id where the event originated from",
+          "launch_stage": "GA"
+        },
+        "job_run_name": {
+          "description": "Unique identifier of the specific job run associated with this cluster event\n* For clusters created for jobs, this will be the same as the cluster name",
+          "launch_stage": "GA"
+        },
+        "previous_attributes": {
+          "description": "The cluster attributes before a cluster was edited.",
+          "ref": "compute.ClusterAttributes",
+          "launch_stage": "GA"
+        },
+        "previous_cluster_size": {
+          "description": "The size of the cluster before an edit or resize.",
+          "ref": "compute.ClusterSize",
+          "launch_stage": "GA"
+        },
+        "previous_disk_size": {
+          "description": "Previous disk size in bytes",
+          "launch_stage": "GA"
+        },
+        "reason": {
+          "description": "A termination reason:\n* On a TERMINATED event, this is the reason of the termination.\n* On a RESIZE_COMPLETE event, this indicates the reason that we failed to acquire some nodes.",
+          "ref": "compute.TerminationReason",
+          "launch_stage": "GA"
+        },
+        "target_num_vcpus": {
+          "description": "The targeted number of vCPUs in the cluster.",
+          "launch_stage": "GA"
+        },
+        "target_num_workers": {
+          "description": "The targeted number of nodes in the cluster.",
+          "launch_stage": "GA"
+        },
+        "user": {
+          "description": "The user that caused the event to occur. (Empty if it was done by the control plane.)",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.EventDetailsCause": {
+      "description": "The cause of a change in target size.",
+      "enum": [
+        "AUTOSCALE",
+        "USER_REQUEST",
+        "AUTORECOVERY",
+        "REPLACE_BAD_NODES",
+        "AUTOSCALE_V2",
+        "DBR_AUTOSCALE"
+      ],
+      "enum_launch_stages": {
+        "AUTORECOVERY": "GA",
+        "AUTOSCALE": "GA",
+        "AUTOSCALE_V2": "GA",
+        "DBR_AUTOSCALE": "GA",
+        "REPLACE_BAD_NODES": "GA",
+        "USER_REQUEST": "GA"
+      }
+    },
+    "compute.EventType": {
+      "enum": [
+        "CREATING",
+        "STARTING",
+        "RESTARTING",
+        "TERMINATING",
+        "EDITED",
+        "RUNNING",
+        "RESIZING",
+        "NODES_LOST",
+        "UPSIZE_COMPLETED",
+        "INIT_SCRIPTS_STARTED",
+        "INIT_SCRIPTS_FINISHED",
+        "DID_NOT_EXPAND_DISK",
+        "EXPANDED_DISK",
+        "FAILED_TO_EXPAND_DISK",
+        "DRIVER_HEALTHY",
+        "DRIVER_NOT_RESPONDING",
+        "DRIVER_UNAVAILABLE",
+        "SPARK_EXCEPTION",
+        "METASTORE_DOWN",
+        "DBFS_DOWN",
+        "AUTOSCALING_STATS_REPORT",
+        "NODE_BLACKLISTED",
+        "PINNED",
+        "UNPINNED",
+        "NODE_EXCLUDED_DECOMMISSIONED",
+        "ADD_NODES_FAILED",
+        "AUTOSCALING_BACKOFF",
+        "AUTOMATIC_CLUSTER_UPDATE",
+        "AUTOSCALING_FAILED",
+        "CLUSTER_MIGRATED",
+        "DECOMMISSION_STARTED",
+        "DECOMMISSION_ENDED",
+        "DEFERRED_POLICY_ENFORCEMENT_SCHEDULED",
+        "DEFERRED_POLICY_ENFORCEMENT_FAILED",
+        "UC_VOLUME_MISCONFIGURED"
+      ],
+      "enum_launch_stages": {
+        "ADD_NODES_FAILED": "GA",
+        "AUTOMATIC_CLUSTER_UPDATE": "GA",
+        "AUTOSCALING_BACKOFF": "GA",
+        "AUTOSCALING_FAILED": "GA",
+        "AUTOSCALING_STATS_REPORT": "GA",
+        "CLUSTER_MIGRATED": "GA",
+        "CREATING": "GA",
+        "DBFS_DOWN": "GA",
+        "DECOMMISSION_ENDED": "GA",
+        "DECOMMISSION_STARTED": "GA",
+        "DEFERRED_POLICY_ENFORCEMENT_FAILED": "GA",
+        "DEFERRED_POLICY_ENFORCEMENT_SCHEDULED": "GA",
+        "DID_NOT_EXPAND_DISK": "GA",
+        "DRIVER_HEALTHY": "GA",
+        "DRIVER_NOT_RESPONDING": "GA",
+        "DRIVER_UNAVAILABLE": "GA",
+        "EDITED": "GA",
+        "EXPANDED_DISK": "GA",
+        "FAILED_TO_EXPAND_DISK": "GA",
+        "INIT_SCRIPTS_FINISHED": "GA",
+        "INIT_SCRIPTS_STARTED": "GA",
+        "METASTORE_DOWN": "GA",
+        "NODES_LOST": "GA",
+        "NODE_BLACKLISTED": "GA",
+        "NODE_EXCLUDED_DECOMMISSIONED": "GA",
+        "PINNED": "GA",
+        "RESIZING": "GA",
+        "RESTARTING": "GA",
+        "RUNNING": "GA",
+        "SPARK_EXCEPTION": "GA",
+        "STARTING": "GA",
+        "TERMINATING": "GA",
+        "UC_VOLUME_MISCONFIGURED": "GA",
+        "UNPINNED": "GA",
+        "UPSIZE_COMPLETED": "GA"
+      }
+    },
+    "compute.GcpAttributes": {
+      "description": "Attributes set during cluster creation which are related to GCP.",
+      "fields": {
+        "availability": {
+          "description": "This field determines whether the spark executors will be scheduled to run on preemptible\nVMs, on-demand VMs, or preemptible VMs with a fallback to on-demand VMs if the former is unavailable.",
+          "ref": "compute.GcpAvailability",
+          "launch_stage": "GA"
+        },
+        "boot_disk_size": {
+          "description": "Boot disk size in GB",
+          "launch_stage": "GA"
+        },
+        "confidential_compute_type": {
+          "description": "The confidential computing technology for this cluster's instances.\nCurrently only SEV_SNP is supported, and only on N2D instance types.\nWhen not set, no confidential computing is applied.",
+          "ref": "compute.ConfidentialComputeType",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "first_on_demand": {
+          "description": "The first `first_on_demand` nodes of the cluster will be placed on on-demand instances.\nThis value should be greater than 0, to make sure the cluster driver node is placed on an\non-demand instance. If this value is greater than or equal to the current cluster size, all\nnodes will be placed on on-demand instances. If this value is less than the current cluster\nsize, `first_on_demand` nodes will be placed on on-demand instances and the remainder will\nbe placed on `availability` instances. Note that this value does not affect\ncluster size and cannot currently be mutated over the lifetime of a cluster.",
+          "launch_stage": "GA"
+        },
+        "google_service_account": {
+          "description": "If provided, the cluster will impersonate the google service account when accessing\ngcloud services (like GCS). The google service account\nmust have previously been added to the Databricks environment by an account\nadministrator.",
+          "launch_stage": "GA"
+        },
+        "local_ssd_count": {
+          "description": "If provided, each node (workers and driver) in the cluster will have this number of local SSDs attached.\nEach local SSD is 375GB in size.\nRefer to [GCP documentation](https://cloud.google.com/compute/docs/disks/local-ssd#choose_number_local_ssds)\nfor the supported number of local SSDs for each instance type.",
+          "launch_stage": "GA"
+        },
+        "use_preemptible_executors": {
+          "description": "This field determines whether the spark executors will be scheduled to run on preemptible\nVMs (when set to true) versus standard compute engine VMs (when set to false; default).\nNote: Soon to be deprecated, use the 'availability' field instead.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "zone_id": {
+          "description": "Identifier for the availability zone in which the cluster resides.\nThis can be one of the following:\n- \"HA\" =\u003e High availability, spread nodes across availability zones for a\nDatabricks deployment region [default].\n- \"AUTO\" =\u003e Databricks picks an availability zone to schedule the cluster on.\n- A GCP availability zone =\u003e Pick One of the available zones for (machine type + region) from\nhttps://cloud.google.com/compute/docs/regions-zones.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.GcpAvailability": {
+      "description": "This field determines whether the instance pool will contain preemptible\nVMs, on-demand VMs, or preemptible VMs with a fallback to on-demand VMs if the former is unavailable.",
+      "enum": [
+        "PREEMPTIBLE_GCP",
+        "ON_DEMAND_GCP",
+        "PREEMPTIBLE_WITH_FALLBACK_GCP"
+      ],
+      "enum_launch_stages": {
+        "ON_DEMAND_GCP": "GA",
+        "PREEMPTIBLE_GCP": "GA",
+        "PREEMPTIBLE_WITH_FALLBACK_GCP": "GA"
+      }
+    },
+    "compute.GcsStorageInfo": {
+      "description": "A storage location in Google Cloud Platform's GCS",
+      "fields": {
+        "destination": {
+          "description": "GCS destination/URI, e.g. `gs://my-bucket/some-prefix`",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.GetClusterComplianceRequest": {
+      "fields": {
+        "cluster_id": {
+          "description": "The ID of the cluster to get the compliance status",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.GetClusterComplianceResponse": {
+      "fields": {
+        "is_compliant": {
+          "description": "Whether the cluster is compliant with its policy or not. Clusters could be out\nof compliance if the policy was updated after the cluster was last edited.",
+          "launch_stage": "GA"
+        },
+        "pending_enforcement": {
+          "description": "Information about the pending enforcement for the cluster. Only present if a pending enforcement\nis scheduled for the cluster.",
+          "ref": "compute.PendingEnforcement",
+          "launch_stage": "GA"
+        },
+        "violations": {
+          "description": "An object containing key-value mappings representing the first 200 policy validation errors.\nThe keys indicate the path where the policy validation error is occurring.\nThe values indicate an error message describing the policy validation error.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.GetClusterPermissionLevelsRequest": {},
+    "compute.GetClusterPermissionLevelsResponse": {
+      "fields": {
+        "permission_levels": {
+          "description": "Specific permission levels",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.GetClusterPermissionsRequest": {},
+    "compute.GetClusterPolicyPermissionLevelsRequest": {},
+    "compute.GetClusterPolicyPermissionLevelsResponse": {
+      "fields": {
+        "permission_levels": {
+          "description": "Specific permission levels",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.GetClusterPolicyPermissionsRequest": {},
+    "compute.GetClusterPolicyRequest": {
+      "fields": {
+        "policy_id": {
+          "description": "Canonical unique identifier for the Cluster Policy.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.GetClusterRequest": {
+      "fields": {
+        "cluster_id": {
+          "description": "The cluster about which to retrieve information.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.GetEvents": {
+      "fields": {
+        "cluster_id": {
+          "description": "The ID of the cluster to retrieve events about.",
+          "launch_stage": "GA"
+        },
+        "end_time": {
+          "description": "The end time in epoch milliseconds.\nIf empty, returns events up to the current time.",
+          "launch_stage": "GA"
+        },
+        "event_types": {
+          "description": "An optional set of event types to filter on.\nIf empty, all event types are returned.",
+          "launch_stage": "GA"
+        },
+        "limit": {
+          "description": "Deprecated: use page_token in combination with page_size instead.\n\nThe maximum number of events to include in a page of events.\nDefaults to 50, and maximum allowed value is 500.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "offset": {
+          "description": "Deprecated: use page_token in combination with page_size instead.\n\nThe offset in the result set. Defaults to 0 (no offset). When an offset is specified\nand the results are requested in descending order, the end_time field is required.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "order": {
+          "description": "The order to list events in; either \"ASC\" or \"DESC\". Defaults to \"DESC\".",
+          "ref": "compute.GetEventsOrder",
+          "launch_stage": "GA"
+        },
+        "page_size": {
+          "description": "The maximum number of events to include in a page of events.\nThe server may further constrain the maximum number of results returned in a single page.\nIf the page_size is empty or 0, the server will decide the number of results to be returned.\nThe field has to be in the range [0,500]. If the value is outside the range, the server enforces 0 or 500.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Use next_page_token or prev_page_token returned from the previous request to list the next or previous page of events respectively.\nIf page_token is empty, the first page is returned.",
+          "launch_stage": "GA"
+        },
+        "start_time": {
+          "description": "The start time in epoch milliseconds.\nIf empty, returns events starting from the beginning of time.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.GetEventsOrder": {
+      "enum": [
+        "DESC",
+        "ASC"
+      ],
+      "enum_launch_stages": {
+        "ASC": "GA",
+        "DESC": "GA"
+      }
+    },
+    "compute.GetEventsResponse": {
+      "fields": {
+        "events": {
+          "launch_stage": "GA"
+        },
+        "next_page": {
+          "description": "Deprecated: use next_page_token or prev_page_token instead.\n\nThe parameters required to retrieve the next page of events.\nOmitted if there are no more events to read.",
+          "ref": "compute.GetEvents",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "This field represents the pagination token to retrieve the next page of results.\nIf the value is \"\", it means no further results for the request.",
+          "launch_stage": "GA"
+        },
+        "prev_page_token": {
+          "description": "This field represents the pagination token to retrieve the previous page of results.\nIf the value is \"\", it means no further results for the request.",
+          "launch_stage": "GA"
+        },
+        "total_count": {
+          "description": "Deprecated: Returns 0 when request uses page_token. Will start returning zero when request uses offset/limit soon.\n\nThe total number of events filtered by the start_time, end_time, and event_types.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.GetGlobalInitScriptRequest": {},
+    "compute.GetInstancePool": {
+      "fields": {
+        "aws_attributes": {
+          "description": "Attributes related to instance pools running on Amazon Web Services.\nIf not specified at pool creation, a set of default values will be used.",
+          "ref": "compute.InstancePoolAwsAttributes",
+          "launch_stage": "GA"
+        },
+        "azure_attributes": {
+          "description": "Attributes related to instance pools running on Azure.\nIf not specified at pool creation, a set of default values will be used.",
+          "ref": "compute.InstancePoolAzureAttributes",
+          "launch_stage": "GA"
+        },
+        "custom_tags": {
+          "description": "Additional tags for pool resources. Databricks will tag all pool resources (e.g., AWS\ninstances and EBS volumes) with these tags in addition to `default_tags`. Notes:\n\n- Currently, Databricks allows at most 45 custom tags",
+          "launch_stage": "GA"
+        },
+        "default_tags": {
+          "description": "Tags that are added by Databricks regardless of any ``custom_tags``, including:\n\n- Vendor: Databricks\n\n- InstancePoolCreator: \u003cuser_id_of_creator\u003e\n\n- InstancePoolName: \u003cname_of_pool\u003e\n\n- InstancePoolId: \u003cid_of_pool\u003e",
+          "launch_stage": "GA"
+        },
+        "disk_spec": {
+          "description": "Defines the specification of the disks that will be attached to all spark containers.",
+          "ref": "compute.DiskSpec",
+          "launch_stage": "GA"
+        },
+        "enable_elastic_disk": {
+          "description": "Autoscaling Local Storage: when enabled, this instances in this pool will dynamically acquire\nadditional disk space when its Spark workers are running low on disk space. In AWS, this\nfeature requires specific AWS permissions to function correctly - refer to the User Guide for\nmore details.",
+          "launch_stage": "GA"
+        },
+        "gcp_attributes": {
+          "description": "Attributes related to instance pools running on Google Cloud Platform.\nIf not specified at pool creation, a set of default values will be used.",
+          "ref": "compute.InstancePoolGcpAttributes",
+          "launch_stage": "GA"
+        },
+        "idle_instance_autotermination_minutes": {
+          "description": "Automatically terminates the extra instances in the pool cache after they are inactive for this\ntime in minutes if min_idle_instances requirement is already met. If not set, the extra pool\ninstances will be automatically terminated after a default timeout. If specified, the\nthreshold must be between 0 and 10000 minutes.\nUsers can also set this value to 0 to instantly remove idle instances from the cache if\nmin cache size could still hold.",
+          "launch_stage": "GA"
+        },
+        "instance_pool_id": {
+          "description": "Canonical unique identifier for the pool.",
+          "launch_stage": "GA"
+        },
+        "instance_pool_name": {
+          "description": "Pool name requested by the user. Pool name must be unique. Length must be between 1 and 100\ncharacters.",
+          "launch_stage": "GA"
+        },
+        "max_capacity": {
+          "description": "Maximum number of outstanding instances to keep in the pool, including both instances used by\nclusters and idle instances. Clusters that require further instance provisioning will fail during\nupsize requests.",
+          "launch_stage": "GA"
+        },
+        "min_idle_instances": {
+          "description": "Minimum number of idle instances to keep in the instance pool",
+          "launch_stage": "GA"
+        },
+        "node_type_flexibility": {
+          "description": "Flexible node type configuration for the pool.",
+          "ref": "compute.NodeTypeFlexibility",
+          "launch_stage": "GA"
+        },
+        "node_type_id": {
+          "description": "This field encodes, through a single value, the resources available to each of\nthe Spark nodes in this cluster. For example, the Spark nodes can be provisioned\nand optimized for memory or compute intensive workloads. A list of available node\ntypes can be retrieved by using the [clusters/listNodeTypes](https://docs.databricks.com/api/workspace/clusters/listnodetypes) API call.",
+          "launch_stage": "GA"
+        },
+        "preloaded_docker_images": {
+          "description": "Custom Docker Image BYOC",
+          "launch_stage": "GA"
+        },
+        "preloaded_spark_versions": {
+          "description": "A list containing at most one preloaded Spark image version for the pool. Pool-backed clusters started\nwith the preloaded Spark version will start faster. A list of available Spark versions\ncan be retrieved by using the [clusters/sparkVersions](https://docs.databricks.com/api/workspace/clusters/sparkversions) API call.",
+          "launch_stage": "GA"
+        },
+        "remote_disk_throughput": {
+          "description": "If set, what the configurable throughput (in Mb/s) for the remote disk is. Currently only supported for GCP HYPERDISK_BALANCED types.",
+          "launch_stage": "GA"
+        },
+        "state": {
+          "description": "Current state of the instance pool.",
+          "ref": "compute.InstancePoolState",
+          "launch_stage": "GA"
+        },
+        "stats": {
+          "description": "Usage statistics about the instance pool.",
+          "ref": "compute.InstancePoolStats",
+          "launch_stage": "GA"
+        },
+        "status": {
+          "description": "Status of failed pending instances in the pool.",
+          "ref": "compute.InstancePoolStatus",
+          "launch_stage": "GA"
+        },
+        "total_initial_remote_disk_size": {
+          "description": "If set, what the total initial volume size (in GB) of the remote disks should be. Currently only supported for GCP HYPERDISK_BALANCED types.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.GetInstancePoolPermissionLevelsRequest": {},
+    "compute.GetInstancePoolPermissionLevelsResponse": {
+      "fields": {
+        "permission_levels": {
+          "description": "Specific permission levels",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.GetInstancePoolPermissionsRequest": {},
+    "compute.GetInstancePoolRequest": {
+      "fields": {
+        "instance_pool_id": {
+          "description": "The canonical unique identifier for the instance pool.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.GetPolicyFamilyRequest": {
+      "fields": {
+        "version": {
+          "description": "The version number for the family to fetch. Defaults to the latest version.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.GetSparkVersionsResponse": {
+      "fields": {
+        "versions": {
+          "description": "All the available Spark versions.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.GlobalInitScriptCreateRequest": {
+      "fields": {
+        "enabled": {
+          "description": "Specifies whether the script is enabled. The script runs only if enabled.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The name of the script",
+          "launch_stage": "GA"
+        },
+        "position": {
+          "description": "The position of a global init script, where 0 represents the first script to run, 1 is the second script to run, in ascending order.\n\nIf you omit the numeric position for a new global init script, it defaults to last position. It will run after all current scripts.\nSetting any value greater than the position of the last script is equivalent to the last position. Example: Take three existing scripts with positions 0, 1, and 2. Any position of (3) or greater puts the script in the last position.\nIf an explicit position value conflicts with an existing script value, your request succeeds, but the original script at that position and all later scripts have their positions incremented by 1.",
+          "launch_stage": "GA"
+        },
+        "script": {
+          "description": "The Base64-encoded content of the script.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.GlobalInitScriptDetails": {
+      "fields": {
+        "created_at": {
+          "description": "Time when the script was created, represented as a Unix timestamp in milliseconds.",
+          "launch_stage": "GA"
+        },
+        "created_by": {
+          "description": "The username of the user who created the script.",
+          "launch_stage": "GA"
+        },
+        "enabled": {
+          "description": "Specifies whether the script is enabled. The script runs only if enabled.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The name of the script",
+          "launch_stage": "GA"
+        },
+        "position": {
+          "description": "The position of a script, where 0 represents the first script to run, 1 is the second script to run, in ascending order.",
+          "launch_stage": "GA"
+        },
+        "script_id": {
+          "description": "The global init script ID.",
+          "launch_stage": "GA"
+        },
+        "updated_at": {
+          "description": "Time when the script was updated, represented as a Unix timestamp in milliseconds.",
+          "launch_stage": "GA"
+        },
+        "updated_by": {
+          "description": "The username of the user who last updated the script",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.GlobalInitScriptDetailsWithContent": {
+      "fields": {
+        "created_at": {
+          "description": "Time when the script was created, represented as a Unix timestamp in milliseconds.",
+          "launch_stage": "GA"
+        },
+        "created_by": {
+          "description": "The username of the user who created the script.",
+          "launch_stage": "GA"
+        },
+        "enabled": {
+          "description": "Specifies whether the script is enabled. The script runs only if enabled.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The name of the script",
+          "launch_stage": "GA"
+        },
+        "position": {
+          "description": "The position of a script, where 0 represents the first script to run, 1 is the second script to run, in ascending order.",
+          "launch_stage": "GA"
+        },
+        "script": {
+          "description": "The Base64-encoded content of the script.",
+          "launch_stage": "GA"
+        },
+        "script_id": {
+          "description": "The global init script ID.",
+          "launch_stage": "GA"
+        },
+        "updated_at": {
+          "description": "Time when the script was updated, represented as a Unix timestamp in milliseconds.",
+          "launch_stage": "GA"
+        },
+        "updated_by": {
+          "description": "The username of the user who last updated the script",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.GlobalInitScriptUpdateRequest": {
+      "fields": {
+        "enabled": {
+          "description": "Specifies whether the script is enabled. The script runs only if enabled.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The name of the script",
+          "launch_stage": "GA"
+        },
+        "position": {
+          "description": "The position of a script, where 0 represents the first script to run,\n1 is the second script to run, in ascending order.\nTo move the script to run first, set its position to 0.\n\nTo move the script to the end, set its position to any value\ngreater or equal to the position of the last script.\nExample, three existing scripts with positions 0, 1, and 2.\nAny position value of 2 or greater puts the script in the last position (2).\n\nIf an explicit position value conflicts with an existing script, your request succeeds,\nbut the original script at that position and all later scripts have their positions\nincremented by 1.",
+          "launch_stage": "GA"
+        },
+        "script": {
+          "description": "The Base64-encoded content of the script.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.HardwareAcceleratorType": {
+      "description": "HardwareAcceleratorType: The type of hardware accelerator to use for compute workloads.\nNOTE: This enum is referenced and is intended to be used by other Databricks services\nthat need to specify hardware accelerator requirements for AI compute workloads.",
+      "enum": [
+        "GPU_1xA10",
+        "GPU_8xH100",
+        "GPU_1xH100",
+        "GPU_8xB300"
+      ],
+      "enum_launch_stages": {
+        "GPU_1xA10": "PUBLIC_PREVIEW",
+        "GPU_1xH100": "PUBLIC_PREVIEW",
+        "GPU_8xB300": "PUBLIC_PREVIEW",
+        "GPU_8xH100": "PUBLIC_PREVIEW"
+      }
+    },
+    "compute.InitScriptEventDetails": {
+      "fields": {
+        "cluster": {
+          "description": "The cluster scoped init scripts associated with this cluster event.",
+          "launch_stage": "GA"
+        },
+        "global": {
+          "description": "The global init scripts associated with this cluster event.",
+          "launch_stage": "GA"
+        },
+        "reported_for_node": {
+          "description": "The private ip of the node we are reporting init script execution details for\n(we will select the execution details from only one node rather than\nreporting the execution details from every node to keep these event\ndetails small)\n\nThis should only be defined for the INIT_SCRIPTS_FINISHED event",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.InitScriptExecutionDetailsInitScriptExecutionStatus": {
+      "description": "Result of attempted script execution",
+      "enum": [
+        "UNKNOWN",
+        "FAILED_FETCH",
+        "FAILED_EXECUTION",
+        "NOT_EXECUTED",
+        "SKIPPED",
+        "SUCCEEDED",
+        "FUSE_MOUNT_FAILED"
+      ],
+      "enum_launch_stages": {
+        "FAILED_EXECUTION": "GA",
+        "FAILED_FETCH": "GA",
+        "FUSE_MOUNT_FAILED": "GA",
+        "NOT_EXECUTED": "GA",
+        "SKIPPED": "GA",
+        "SUCCEEDED": "GA",
+        "UNKNOWN": "GA"
+      }
+    },
+    "compute.InitScriptInfo": {
+      "description": "Config for an individual init script",
+      "fields": {
+        "abfss": {
+          "description": "destination needs to be provided, e.g.\n`abfss://\u003ccontainer-name\u003e@\u003cstorage-account-name\u003e.dfs.core.windows.net/\u003cdirectory-name\u003e`",
+          "ref": "compute.Adlsgen2Info",
+          "launch_stage": "GA"
+        },
+        "dbfs": {
+          "description": "destination needs to be provided. e.g.\n`{ \"dbfs\": { \"destination\" : \"dbfs:/home/cluster_log\" } }`",
+          "ref": "compute.DbfsStorageInfo",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "file": {
+          "description": "destination needs to be provided, e.g.\n`{ \"file\": { \"destination\": \"file:/my/local/file.sh\" } }`",
+          "ref": "compute.LocalFileInfo",
+          "launch_stage": "GA"
+        },
+        "gcs": {
+          "description": "destination needs to be provided, e.g.\n`{ \"gcs\": { \"destination\": \"gs://my-bucket/file.sh\" } }`",
+          "ref": "compute.GcsStorageInfo",
+          "launch_stage": "GA"
+        },
+        "s3": {
+          "description": "destination and either the region or endpoint need to be provided. e.g.\n`{ \\\"s3\\\": { \\\"destination\\\": \\\"s3://cluster_log_bucket/prefix\\\", \\\"region\\\": \\\"us-west-2\\\" } }`\nCluster iam role is used to access s3, please make sure the cluster iam role in\n`instance_profile_arn` has permission to write data to the s3 destination.",
+          "ref": "compute.S3StorageInfo",
+          "launch_stage": "GA"
+        },
+        "volumes": {
+          "description": "destination needs to be provided. e.g.\n`{ \\\"volumes\\\" : { \\\"destination\\\" : \\\"/Volumes/my-init.sh\\\" } }`",
+          "ref": "compute.VolumesStorageInfo",
+          "launch_stage": "GA"
+        },
+        "workspace": {
+          "description": "destination needs to be provided, e.g.\n`{ \"workspace\": { \"destination\": \"/cluster-init-scripts/setup-datadog.sh\" } }`",
+          "ref": "compute.WorkspaceStorageInfo",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.InitScriptInfoAndExecutionDetails": {
+      "fields": {
+        "abfss": {
+          "description": "destination needs to be provided, e.g.\n`abfss://\u003ccontainer-name\u003e@\u003cstorage-account-name\u003e.dfs.core.windows.net/\u003cdirectory-name\u003e`",
+          "ref": "compute.Adlsgen2Info",
+          "launch_stage": "GA"
+        },
+        "dbfs": {
+          "description": "destination needs to be provided. e.g.\n`{ \"dbfs\": { \"destination\" : \"dbfs:/home/cluster_log\" } }`",
+          "ref": "compute.DbfsStorageInfo",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "error_message": {
+          "description": "Additional details regarding errors (such as a file not found message\nif the status is FAILED_FETCH). This field should only be used to\nprovide *additional* information to the status field, not duplicate it.",
+          "launch_stage": "GA"
+        },
+        "execution_duration_seconds": {
+          "description": "The number duration of the script execution in seconds",
+          "launch_stage": "GA"
+        },
+        "file": {
+          "description": "destination needs to be provided, e.g.\n`{ \"file\": { \"destination\": \"file:/my/local/file.sh\" } }`",
+          "ref": "compute.LocalFileInfo",
+          "launch_stage": "GA"
+        },
+        "gcs": {
+          "description": "destination needs to be provided, e.g.\n`{ \"gcs\": { \"destination\": \"gs://my-bucket/file.sh\" } }`",
+          "ref": "compute.GcsStorageInfo",
+          "launch_stage": "GA"
+        },
+        "s3": {
+          "description": "destination and either the region or endpoint need to be provided. e.g.\n`{ \\\"s3\\\": { \\\"destination\\\": \\\"s3://cluster_log_bucket/prefix\\\", \\\"region\\\": \\\"us-west-2\\\" } }`\nCluster iam role is used to access s3, please make sure the cluster iam role in\n`instance_profile_arn` has permission to write data to the s3 destination.",
+          "ref": "compute.S3StorageInfo",
+          "launch_stage": "GA"
+        },
+        "status": {
+          "description": "The current status of the script",
+          "ref": "compute.InitScriptExecutionDetailsInitScriptExecutionStatus",
+          "launch_stage": "GA"
+        },
+        "stderr": {
+          "description": "The stderr output from the init script execution.\nOnly populated when init scripts debug is enabled and script execution fails.",
+          "launch_stage": "GA"
+        },
+        "volumes": {
+          "description": "destination needs to be provided. e.g.\n`{ \\\"volumes\\\" : { \\\"destination\\\" : \\\"/Volumes/my-init.sh\\\" } }`",
+          "ref": "compute.VolumesStorageInfo",
+          "launch_stage": "GA"
+        },
+        "workspace": {
+          "description": "destination needs to be provided, e.g.\n`{ \"workspace\": { \"destination\": \"/cluster-init-scripts/setup-datadog.sh\" } }`",
+          "ref": "compute.WorkspaceStorageInfo",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.InstallLibraries": {
+      "fields": {
+        "cluster_id": {
+          "description": "Unique identifier for the cluster on which to install these libraries.",
+          "launch_stage": "GA"
+        },
+        "libraries": {
+          "description": "The libraries to install.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.InstallLibrariesResponse": {},
+    "compute.InstancePoolAccessControlRequest": {
+      "fields": {
+        "group_name": {
+          "description": "name of the group",
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "compute.InstancePoolPermissionLevel",
+          "launch_stage": "GA"
+        },
+        "service_principal_name": {
+          "description": "application ID of a service principal",
+          "launch_stage": "GA"
+        },
+        "user_name": {
+          "description": "name of the user",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.InstancePoolAccessControlResponse": {
+      "fields": {
+        "all_permissions": {
+          "description": "All permissions.",
+          "launch_stage": "GA"
+        },
+        "display_name": {
+          "description": "Display name of the user or service principal.",
+          "launch_stage": "GA"
+        },
+        "group_name": {
+          "description": "name of the group",
+          "launch_stage": "GA"
+        },
+        "service_principal_name": {
+          "description": "Name of the service principal.",
+          "launch_stage": "GA"
+        },
+        "user_name": {
+          "description": "name of the user",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.InstancePoolAndStats": {
+      "fields": {
+        "aws_attributes": {
+          "description": "Attributes related to instance pools running on Amazon Web Services.\nIf not specified at pool creation, a set of default values will be used.",
+          "ref": "compute.InstancePoolAwsAttributes",
+          "launch_stage": "GA"
+        },
+        "azure_attributes": {
+          "description": "Attributes related to instance pools running on Azure.\nIf not specified at pool creation, a set of default values will be used.",
+          "ref": "compute.InstancePoolAzureAttributes",
+          "launch_stage": "GA"
+        },
+        "custom_tags": {
+          "description": "Additional tags for pool resources. Databricks will tag all pool resources (e.g., AWS\ninstances and EBS volumes) with these tags in addition to `default_tags`. Notes:\n\n- Currently, Databricks allows at most 45 custom tags",
+          "launch_stage": "GA"
+        },
+        "default_tags": {
+          "description": "Tags that are added by Databricks regardless of any ``custom_tags``, including:\n\n- Vendor: Databricks\n\n- InstancePoolCreator: \u003cuser_id_of_creator\u003e\n\n- InstancePoolName: \u003cname_of_pool\u003e\n\n- InstancePoolId: \u003cid_of_pool\u003e",
+          "launch_stage": "GA"
+        },
+        "disk_spec": {
+          "description": "Defines the specification of the disks that will be attached to all spark containers.",
+          "ref": "compute.DiskSpec",
+          "launch_stage": "GA"
+        },
+        "enable_elastic_disk": {
+          "description": "Autoscaling Local Storage: when enabled, this instances in this pool will dynamically acquire\nadditional disk space when its Spark workers are running low on disk space. In AWS, this\nfeature requires specific AWS permissions to function correctly - refer to the User Guide for\nmore details.",
+          "launch_stage": "GA"
+        },
+        "gcp_attributes": {
+          "description": "Attributes related to instance pools running on Google Cloud Platform.\nIf not specified at pool creation, a set of default values will be used.",
+          "ref": "compute.InstancePoolGcpAttributes",
+          "launch_stage": "GA"
+        },
+        "idle_instance_autotermination_minutes": {
+          "description": "Automatically terminates the extra instances in the pool cache after they are inactive for this\ntime in minutes if min_idle_instances requirement is already met. If not set, the extra pool\ninstances will be automatically terminated after a default timeout. If specified, the\nthreshold must be between 0 and 10000 minutes.\nUsers can also set this value to 0 to instantly remove idle instances from the cache if\nmin cache size could still hold.",
+          "launch_stage": "GA"
+        },
+        "instance_pool_id": {
+          "description": "Canonical unique identifier for the pool.",
+          "launch_stage": "GA"
+        },
+        "instance_pool_name": {
+          "description": "Pool name requested by the user. Pool name must be unique. Length must be between 1 and 100\ncharacters.",
+          "launch_stage": "GA"
+        },
+        "max_capacity": {
+          "description": "Maximum number of outstanding instances to keep in the pool, including both instances used by\nclusters and idle instances. Clusters that require further instance provisioning will fail during\nupsize requests.",
+          "launch_stage": "GA"
+        },
+        "min_idle_instances": {
+          "description": "Minimum number of idle instances to keep in the instance pool",
+          "launch_stage": "GA"
+        },
+        "node_type_flexibility": {
+          "description": "Flexible node type configuration for the pool.",
+          "ref": "compute.NodeTypeFlexibility",
+          "launch_stage": "GA"
+        },
+        "node_type_id": {
+          "description": "This field encodes, through a single value, the resources available to each of\nthe Spark nodes in this cluster. For example, the Spark nodes can be provisioned\nand optimized for memory or compute intensive workloads. A list of available node\ntypes can be retrieved by using the [clusters/listNodeTypes](https://docs.databricks.com/api/workspace/clusters/listnodetypes) API call.",
+          "launch_stage": "GA"
+        },
+        "preloaded_docker_images": {
+          "description": "Custom Docker Image BYOC",
+          "launch_stage": "GA"
+        },
+        "preloaded_spark_versions": {
+          "description": "A list containing at most one preloaded Spark image version for the pool. Pool-backed clusters started\nwith the preloaded Spark version will start faster. A list of available Spark versions\ncan be retrieved by using the [clusters/sparkVersions](https://docs.databricks.com/api/workspace/clusters/sparkversions) API call.",
+          "launch_stage": "GA"
+        },
+        "remote_disk_throughput": {
+          "description": "If set, what the configurable throughput (in Mb/s) for the remote disk is. Currently only supported for GCP HYPERDISK_BALANCED types.",
+          "launch_stage": "GA"
+        },
+        "state": {
+          "description": "Current state of the instance pool.",
+          "ref": "compute.InstancePoolState",
+          "launch_stage": "GA"
+        },
+        "stats": {
+          "description": "Usage statistics about the instance pool.",
+          "ref": "compute.InstancePoolStats",
+          "launch_stage": "GA"
+        },
+        "status": {
+          "description": "Status of failed pending instances in the pool.",
+          "ref": "compute.InstancePoolStatus",
+          "launch_stage": "GA"
+        },
+        "total_initial_remote_disk_size": {
+          "description": "If set, what the total initial volume size (in GB) of the remote disks should be. Currently only supported for GCP HYPERDISK_BALANCED types.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.InstancePoolAwsAttributes": {
+      "description": "Attributes set during instance pool creation which are related to Amazon Web Services.",
+      "fields": {
+        "availability": {
+          "description": "Availability type used for the instances in the pool. Supports on-demand, spot, and\nspot-with-fallback (the pool acquires spot instances first, and falls back to on-demand\ninstances when spot capacity is unavailable).\n\nYou can change this value on an existing pool. New clusters use the updated availability, and\nexisting clusters keep the availability they launched with.",
+          "ref": "compute.InstancePoolAwsAttributesAvailability",
+          "launch_stage": "GA"
+        },
+        "instance_profile_arn": {
+          "description": "All AWS instances belonging to the instance pool will have this instance profile. If omitted, instances\nwill initially be launched with the workspace's default instance profile. If defined, clusters that use the\npool will inherit the instance profile, and must not specify their own instance profile on cluster creation or\nupdate. If the pool does not specify an instance profile, clusters using the pool may specify any instance profile.\nThe instance profile must have previously been added to the Databricks environment by an account administrator.\n\nThis feature may only be available to certain customer plans.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "spot_bid_price_percent": {
+          "description": "Calculates the bid price for AWS spot instances, as a percentage of the corresponding instance type's\non-demand price.\nFor example, if this field is set to 50, and the cluster needs a new `r3.xlarge` spot\ninstance, then the bid price is half of the price of\non-demand `r3.xlarge` instances. Similarly, if this field is set to 200, the bid price is twice\nthe price of on-demand `r3.xlarge` instances. If not specified, the default value is 100.\nWhen spot instances are requested for this cluster, only spot instances whose bid price\npercentage matches this field will be considered.\nNote that, for safety, we enforce this field to be no more than 10000.\n\nYou can change this value on an existing pool. New clusters use the updated bid price, and\nexisting clusters keep the bid price they launched with.",
+          "launch_stage": "GA"
+        },
+        "zone_id": {
+          "description": "Identifier for the availability zone/datacenter in which the cluster resides.\nThis string will be of a form like \"us-west-2a\". The provided availability\nzone must be in the same region as the Databricks deployment. For example, \"us-west-2a\"\nis not a valid zone id if the Databricks deployment resides in the \"us-east-1\" region.\nThis is an optional field at cluster creation, and if not specified, a default zone will be used.\nThe list of available zones as well as the default value can be found by using the\n`List Zones` method.\n\nSet this field to \"auto\" to enable Auto-AZ, in which case Databricks selects the availability\nzone for each cluster independently when the cluster launches, and retries another zone if the\ncluster can't be fulfilled because of insufficient capacity or quota. All nodes in a cluster\nland in the same zone, and different clusters backed by the pool can run in different zones.\n\nYou can change the zone on an existing pool. New clusters use the updated zone, and existing\nclusters keep the zone they launched with.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.InstancePoolAwsAttributesAvailability": {
+      "description": "The set of AWS availability types supported when setting up nodes for a cluster.",
+      "enum": [
+        "SPOT",
+        "ON_DEMAND"
+      ],
+      "enum_launch_stages": {
+        "ON_DEMAND": "GA",
+        "SPOT": "GA"
+      }
+    },
+    "compute.InstancePoolAzureAttributes": {
+      "description": "Attributes set during instance pool creation which are related to Azure.",
+      "fields": {
+        "availability": {
+          "description": "Availability type used for the instances in the pool. Supports on-demand, spot, and\nspot-with-fallback (the pool acquires spot instances first, and falls back to on-demand\ninstances when spot capacity is unavailable).\n\nYou can change this value on an existing pool. New clusters use the updated availability, and\nexisting clusters keep the availability they launched with.",
+          "ref": "compute.InstancePoolAzureAttributesAvailability",
+          "launch_stage": "GA"
+        },
+        "capacity_reservation_group": {
+          "description": "The Azure capacity reservation group resource ID to use for launching VMs in this pool.\nWhen specified, VMs will be launched using the provided capacity reservation.\n\nNOTE: Omitting this field will clear any existing configured capacity reservation group on the pool.\n\nCapacity reservations can only be specified when the workspace uses injected vnet (i.e. customer defined vnet not\nmanaged by databricks). Ensure the databricks-login-prod Enterprise Application is granted the following four permissions:\n1. Microsoft.Compute/capacityReservationGroups/read\n2. Microsoft.Compute/capacityReservationGroups/deploy/action\n3. Microsoft.Compute/capacityReservationGroups/capacityReservations/read\n4. Microsoft.Compute/capacityReservationGroups/capacityReservations/deploy/action\n\nFormat: `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/capacityReservationGroups/{capacityReservationGroupName}`",
+          "launch_stage": "GA"
+        },
+        "spot_bid_max_price": {
+          "description": "With variable pricing, you have option to set a max price, in US dollars (USD)\nFor example, the value 2 would be a max price of $2.00 USD per hour.\nIf you set the max price to be -1, the VM won't be evicted based on price.\nThe price for the VM will be the current price for spot or the price for a standard VM,\nwhich ever is less, as long as there is capacity and quota available.\n\nYou can change this value on an existing pool. New clusters use the updated max price, and\nexisting clusters keep the max price they launched with.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.InstancePoolAzureAttributesAvailability": {
+      "description": "The set of Azure availability types supported when setting up nodes for a cluster.",
+      "enum": [
+        "SPOT_AZURE",
+        "ON_DEMAND_AZURE"
+      ],
+      "enum_launch_stages": {
+        "ON_DEMAND_AZURE": "GA",
+        "SPOT_AZURE": "GA"
+      }
+    },
+    "compute.InstancePoolGcpAttributes": {
+      "description": "Attributes set during instance pool creation which are related to GCP.",
+      "fields": {
+        "gcp_availability": {
+          "description": "Availability type for the instances in the pool. One of:\n\n- `ON_DEMAND_GCP`: the pool uses on-demand instances only.\n- `PREEMPTIBLE_GCP`: the pool uses preemptible instances only.\n- `PREEMPTIBLE_WITH_FALLBACK_GCP`: the pool acquires preemptible instances first, and falls\nback to on-demand instances when preemptible capacity is unavailable.",
+          "ref": "compute.GcpAvailability",
+          "launch_stage": "GA"
+        },
+        "local_ssd_count": {
+          "description": "If provided, each node in the instance pool will have this number of local SSDs attached.\nEach local SSD is 375GB in size. Refer to [GCP documentation](https://cloud.google.com/compute/docs/disks/local-ssd#choose_number_local_ssds)\nfor the supported number of local SSDs for each instance type.",
+          "launch_stage": "GA"
+        },
+        "zone_id": {
+          "description": "Identifier for the availability zone/datacenter in which the cluster resides.\nThis string will be of a form like \"us-west1-a\". The provided availability\nzone must be in the same region as the Databricks workspace. For example, \"us-west1-a\"\nis not a valid zone id if the Databricks workspace resides in the \"us-east1\" region.\nThis is an optional field at instance pool creation, and if not specified, a default zone will be used.\n\nThis field can be one of the following:\n- \"HA\" =\u003e High availability, spread nodes across availability zones for a Databricks deployment region\n- \"auto\" =\u003e Auto-AZ. Databricks selects the availability zone for each cluster independently when the cluster launches, and retries another zone if the cluster can't be fulfilled because of insufficient capacity or quota. All nodes in a cluster land in the same zone, and different clusters backed by the pool can run in different zones.\n- A GCP availability zone =\u003e Pick One of the available zones for (machine type + region) from https://cloud.google.com/compute/docs/regions-zones (e.g. \"us-west1-a\").\n\nIf empty, Databricks picks an availability zone to schedule the cluster on.\n\nYou can change the zone on an existing pool. New clusters use the updated zone, and existing\nclusters keep the zone they launched with.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.InstancePoolPermission": {
+      "fields": {
+        "inherited": {
+          "launch_stage": "GA"
+        },
+        "inherited_from_object": {
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "compute.InstancePoolPermissionLevel",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.InstancePoolPermissionLevel": {
+      "description": "Permission level",
+      "enum": [
+        "CAN_MANAGE",
+        "CAN_ATTACH_TO"
+      ]
+    },
+    "compute.InstancePoolPermissions": {
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "GA"
+        },
+        "object_id": {
+          "launch_stage": "GA"
+        },
+        "object_type": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.InstancePoolPermissionsDescription": {
+      "fields": {
+        "description": {
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "compute.InstancePoolPermissionLevel",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.InstancePoolPermissionsRequest": {
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.InstancePoolState": {
+      "description": "The state of a Cluster. The current allowable state transitions are as follows:\n\n- ``ACTIVE`` -\u003e ``STOPPED``\n- ``ACTIVE`` -\u003e ``DELETED``\n- ``STOPPED`` -\u003e ``ACTIVE``\n- ``STOPPED`` -\u003e ``DELETED``",
+      "enum": [
+        "ACTIVE",
+        "STOPPED",
+        "DELETED"
+      ],
+      "enum_launch_stages": {
+        "ACTIVE": "GA",
+        "DELETED": "GA",
+        "STOPPED": "GA"
+      }
+    },
+    "compute.InstancePoolStats": {
+      "fields": {
+        "idle_count": {
+          "description": "Number of active instances in the pool that are NOT part of a cluster.",
+          "launch_stage": "GA"
+        },
+        "pending_idle_count": {
+          "description": "Number of pending instances in the pool that are NOT part of a cluster.",
+          "launch_stage": "GA"
+        },
+        "pending_used_count": {
+          "description": "Number of pending instances in the pool that are part of a cluster.",
+          "launch_stage": "GA"
+        },
+        "used_count": {
+          "description": "Number of active instances in the pool that are part of a cluster.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.InstancePoolStatus": {
+      "fields": {
+        "pending_instance_errors": {
+          "description": "List of error messages for the failed pending instances.\nThe pending_instance_errors follows FIFO with maximum length of the min_idle of the pool.\nThe pending_instance_errors is emptied once the number of exiting available instances reaches\nthe min_idle of the pool.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.InstanceProfile": {
+      "fields": {
+        "iam_role_arn": {
+          "description": "The AWS IAM role ARN of the role associated with the instance profile.\nThis field is required if your role name and instance profile name do\nnot match and you want to use the instance profile with\n[Databricks SQL Serverless](https://docs.databricks.com/sql/admin/serverless.html).\n\nOtherwise, this field is optional.",
+          "launch_stage": "GA"
+        },
+        "instance_profile_arn": {
+          "description": "The AWS ARN of the instance profile to register with Databricks. This field is required.",
+          "launch_stage": "GA"
+        },
+        "is_meta_instance_profile": {
+          "description": "Boolean flag indicating whether the instance profile should only be used in credential\npassthrough scenarios. If true, it means the instance profile contains an meta IAM role\nwhich could assume a wide range of roles. Therefore it should always be used with\nauthorization.\nThis field is optional, the default value is `false`.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.Kind": {
+      "description": "The kind of compute described by this compute specification.\n\nDepending on `kind`, different validations and default values will be applied.\n\nClusters with `kind = CLASSIC_PREVIEW` support the following fields, whereas clusters with no specified `kind` do not.\n* [is_single_node](/api/workspace/clusters/create#is_single_node)\n* [use_ml_runtime](/api/workspace/clusters/create#use_ml_runtime)\n\nBy using the [simple form](https://docs.databricks.com/compute/simple-form.html), your clusters are automatically using `kind = CLASSIC_PREVIEW`.",
+      "enum": [
+        "CLASSIC_PREVIEW"
+      ],
+      "enum_launch_stages": {
+        "CLASSIC_PREVIEW": "GA"
+      }
+    },
+    "compute.Language": {
+      "enum": [
+        "python",
+        "scala",
+        "sql",
+        "r"
+      ],
+      "enum_launch_stages": {
+        "python": "GA",
+        "r": "GA",
+        "scala": "GA",
+        "sql": "GA"
+      }
+    },
+    "compute.Library": {
+      "fields": {
+        "cran": {
+          "description": "Specification of a CRAN library to be installed as part of the library",
+          "ref": "compute.RCranLibrary",
+          "launch_stage": "GA"
+        },
+        "egg": {
+          "description": "Deprecated. URI of the egg library to install. Installing Python egg files is deprecated and is not supported in Databricks Runtime 14.0 and above.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "jar": {
+          "description": "URI of the JAR library to install. Supported URIs include Workspace paths, Unity Catalog Volumes paths, and S3 URIs.\nFor example: `{ \"jar\": \"/Workspace/path/to/library.jar\" }`, `{ \"jar\" : \"/Volumes/path/to/library.jar\" }` or\n`{ \"jar\": \"s3://my-bucket/library.jar\" }`.\nIf S3 is used, please make sure the cluster has read access on the library. You may need to\nlaunch the cluster with an IAM role to access the S3 URI.",
+          "launch_stage": "GA"
+        },
+        "maven": {
+          "description": "Specification of a maven library to be installed. For example:\n`{ \"coordinates\": \"org.jsoup:jsoup:1.7.2\" }`",
+          "ref": "compute.MavenLibrary",
+          "launch_stage": "GA"
+        },
+        "pypi": {
+          "description": "Specification of a PyPi library to be installed. For example:\n`{ \"package\": \"simplejson\" }`",
+          "ref": "compute.PythonPyPiLibrary",
+          "launch_stage": "GA"
+        },
+        "requirements": {
+          "description": "URI of the requirements.txt file to install. Only Workspace paths and Unity Catalog Volumes paths are supported.\nFor example: `{ \"requirements\": \"/Workspace/path/to/requirements.txt\" }` or `{ \"requirements\" : \"/Volumes/path/to/requirements.txt\" }`",
+          "launch_stage": "GA"
+        },
+        "whl": {
+          "description": "URI of the wheel library to install. Supported URIs include Workspace paths, Unity Catalog Volumes paths, and S3 URIs.\nFor example: `{ \"whl\": \"/Workspace/path/to/library.whl\" }`, `{ \"whl\" : \"/Volumes/path/to/library.whl\" }` or\n`{ \"whl\": \"s3://my-bucket/library.whl\" }`.\nIf S3 is used, please make sure the cluster has read access on the library. You may need to\nlaunch the cluster with an IAM role to access the S3 URI.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.LibraryFullStatus": {
+      "description": "The status of the library on a specific cluster.",
+      "fields": {
+        "is_library_for_all_clusters": {
+          "description": "Whether the library was set to be installed on all clusters via the libraries UI.",
+          "launch_stage": "GA"
+        },
+        "library": {
+          "description": "Unique identifier for the library.",
+          "ref": "compute.Library",
+          "launch_stage": "GA"
+        },
+        "messages": {
+          "description": "All the info and warning messages that have occurred so far for this library.",
+          "launch_stage": "GA"
+        },
+        "status": {
+          "description": "Status of installing the library on the cluster.",
+          "ref": "compute.LibraryInstallStatus",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.LibraryInstallStatus": {
+      "description": "The status of a library on a specific cluster.",
+      "enum": [
+        "PENDING",
+        "RESOLVING",
+        "INSTALLING",
+        "INSTALLED",
+        "FAILED",
+        "UNINSTALL_ON_RESTART",
+        "SKIPPED",
+        "RESTORED"
+      ],
+      "enum_launch_stages": {
+        "FAILED": "GA",
+        "INSTALLED": "GA",
+        "INSTALLING": "GA",
+        "PENDING": "GA",
+        "RESOLVING": "GA",
+        "RESTORED": "GA",
+        "SKIPPED": "GA",
+        "UNINSTALL_ON_RESTART": "GA"
+      }
+    },
+    "compute.ListAllClusterLibraryStatuses": {},
+    "compute.ListAllClusterLibraryStatusesResponse": {
+      "fields": {
+        "statuses": {
+          "description": "A list of cluster statuses.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ListAvailableZonesResponse": {
+      "fields": {
+        "default_zone": {
+          "description": "The availability zone if no ``zone_id`` is provided in the cluster creation request.",
+          "launch_stage": "GA"
+        },
+        "zones": {
+          "description": "The list of available zones (e.g., ['us-west-2c', 'us-east-2']).",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ListClusterCompliancesRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Use this field to specify the maximum number of results to be returned by the server.\nThe server may further constrain the maximum number of results returned in a\nsingle page.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "A page token that can be used to navigate to the next page or previous page as\nreturned by `next_page_token` or `prev_page_token`.",
+          "launch_stage": "GA"
+        },
+        "policy_id": {
+          "description": "Canonical unique identifier for the cluster policy.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ListClusterCompliancesResponse": {
+      "fields": {
+        "clusters": {
+          "description": "A list of clusters and their policy compliance statuses.",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "This field represents the pagination token to retrieve the next page of results.\nIf the value is \"\", it means no further results for the request.",
+          "launch_stage": "GA"
+        },
+        "prev_page_token": {
+          "description": "This field represents the pagination token to retrieve the previous page of results.\nIf the value is \"\", it means no further results for the request.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ListClusterPoliciesRequest": {
+      "fields": {
+        "sort_column": {
+          "description": "The cluster policy attribute to sort by.\n* `POLICY_CREATION_TIME` - Sort result list by policy creation time.\n* `POLICY_NAME` - Sort result list by policy name.",
+          "ref": "compute.ListSortColumn",
+          "launch_stage": "GA"
+        },
+        "sort_order": {
+          "description": "The order in which the policies get listed.\n* `DESC` - Sort result list in descending order.\n* `ASC` - Sort result list in ascending order.",
+          "ref": "compute.ListSortOrder",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ListClustersFilterBy": {
+      "fields": {
+        "cluster_sources": {
+          "description": "The source of cluster creation.",
+          "launch_stage": "GA"
+        },
+        "cluster_states": {
+          "description": "The current state of the clusters.",
+          "launch_stage": "GA"
+        },
+        "is_pinned": {
+          "description": "Whether the clusters are pinned or not.",
+          "launch_stage": "GA"
+        },
+        "policy_id": {
+          "description": "The ID of the cluster policy used to create the cluster if applicable.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ListClustersRequest": {
+      "fields": {
+        "filter_by": {
+          "description": "Filters to apply to the list of clusters.",
+          "ref": "compute.ListClustersFilterBy",
+          "launch_stage": "GA"
+        },
+        "page_size": {
+          "description": "Use this field to specify the maximum number of results to be returned by the server. The server may further constrain the maximum number of results returned in a single page.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Use next_page_token or prev_page_token returned from the previous request to list the next or previous page of clusters respectively.",
+          "launch_stage": "GA"
+        },
+        "sort_by": {
+          "description": "Sort the list of clusters by a specific criteria.",
+          "ref": "compute.ListClustersSortBy",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ListClustersResponse": {
+      "fields": {
+        "clusters": {
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "This field represents the pagination token to retrieve the next page of results.\nIf the value is \"\", it means no further results for the request.",
+          "launch_stage": "GA"
+        },
+        "prev_page_token": {
+          "description": "This field represents the pagination token to retrieve the previous page of results.\nIf the value is \"\", it means no further results for the request.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ListClustersSortBy": {
+      "fields": {
+        "direction": {
+          "description": "The direction to sort by.",
+          "ref": "compute.ListClustersSortByDirection",
+          "launch_stage": "GA"
+        },
+        "field": {
+          "description": "The sorting criteria. By default, clusters are sorted by 3 columns from highest to lowest precedence: cluster state, pinned or unpinned, then cluster name.",
+          "ref": "compute.ListClustersSortByField",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ListClustersSortByDirection": {
+      "enum": [
+        "ASC",
+        "DESC"
+      ],
+      "enum_launch_stages": {
+        "ASC": "GA",
+        "DESC": "GA"
+      }
+    },
+    "compute.ListClustersSortByField": {
+      "enum": [
+        "DEFAULT",
+        "CLUSTER_NAME"
+      ],
+      "enum_launch_stages": {
+        "CLUSTER_NAME": "GA",
+        "DEFAULT": "GA"
+      }
+    },
+    "compute.ListGlobalInitScriptsRequest": {},
+    "compute.ListGlobalInitScriptsResponse": {
+      "fields": {
+        "scripts": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ListInstancePools": {
+      "fields": {
+        "instance_pools": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ListInstancePoolsRequest": {},
+    "compute.ListInstanceProfilesRequest": {},
+    "compute.ListInstanceProfilesResponse": {
+      "fields": {
+        "instance_profiles": {
+          "description": "A list of instance profiles that the user can access.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ListNodeTypesRequest": {},
+    "compute.ListNodeTypesResponse": {
+      "fields": {
+        "node_types": {
+          "description": "The list of available Spark node types.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ListPoliciesResponse": {
+      "fields": {
+        "policies": {
+          "description": "List of policies.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ListPolicyFamiliesRequest": {
+      "fields": {
+        "max_results": {
+          "description": "Maximum number of policy families to return.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "A token that can be used to get the next page of results.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ListPolicyFamiliesResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "A token that can be used to get the next page of results. If not present, there are no more results to show.",
+          "launch_stage": "GA"
+        },
+        "policy_families": {
+          "description": "List of policy families.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ListSortColumn": {
+      "enum": [
+        "POLICY_CREATION_TIME",
+        "POLICY_NAME"
+      ],
+      "enum_launch_stages": {
+        "POLICY_CREATION_TIME": "GA",
+        "POLICY_NAME": "GA"
+      }
+    },
+    "compute.ListSortOrder": {
+      "enum": [
+        "DESC",
+        "ASC"
+      ],
+      "enum_launch_stages": {
+        "ASC": "GA",
+        "DESC": "GA"
+      }
+    },
+    "compute.ListZonesRequest": {},
+    "compute.LocalFileInfo": {
+      "fields": {
+        "destination": {
+          "description": "local file destination, e.g. `file:/my/local/file.sh`",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.LogAnalyticsInfo": {
+      "fields": {
+        "log_analytics_primary_key": {
+          "launch_stage": "GA"
+        },
+        "log_analytics_workspace_id": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.LogSyncStatus": {
+      "description": "The log delivery status",
+      "fields": {
+        "last_attempted": {
+          "description": "The timestamp of last attempt. If the last attempt fails, `last_exception` will contain the\nexception in the last attempt.",
+          "launch_stage": "GA"
+        },
+        "last_exception": {
+          "description": "The exception thrown in the last attempt, it would be null (omitted in the response) if\nthere is no exception in last attempted.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.MapAny": {},
+    "compute.MavenLibrary": {
+      "fields": {
+        "coordinates": {
+          "description": "Gradle-style maven coordinates. For example: \"org.jsoup:jsoup:1.7.2\".",
+          "launch_stage": "GA"
+        },
+        "exclusions": {
+          "description": "List of dependences to exclude. For example: `[\"slf4j:slf4j\", \"*:hadoop-client\"]`.\n\nMaven dependency exclusions:\nhttps://maven.apache.org/guides/introduction/introduction-to-optional-and-excludes-dependencies.html.",
+          "launch_stage": "GA"
+        },
+        "repo": {
+          "description": "Maven repo to install the Maven package from. If omitted, both Maven Central Repository\nand Spark Packages are searched.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.NodeInstanceType": {
+      "description": "This structure embodies the machine type that hosts spark containers\nNote: this should be an internal data structure for now\nIt is defined in proto in case we want to send it over the wire in the future (which is likely)",
+      "fields": {
+        "instance_type_id": {
+          "description": "Unique identifier across instance types",
+          "launch_stage": "GA"
+        },
+        "local_disk_size_gb": {
+          "description": "Size of the individual local disks attached to this instance (i.e. per local disk).",
+          "launch_stage": "GA"
+        },
+        "local_disks": {
+          "description": "Number of local disks that are present on this instance.",
+          "launch_stage": "GA"
+        },
+        "local_nvme_disk_size_gb": {
+          "description": "Size of the individual local nvme disks attached to this instance (i.e. per local disk).",
+          "launch_stage": "GA"
+        },
+        "local_nvme_disks": {
+          "description": "Number of local nvme disks that are present on this instance.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.NodeType": {
+      "description": "A description of a Spark node type including both the dimensions of the node and the\ninstance type on which it will be hosted.",
+      "fields": {
+        "category": {
+          "description": "A descriptive category for this node type. Examples include \"Memory Optimized\" and\n\"Compute Optimized\".",
+          "launch_stage": "GA"
+        },
+        "description": {
+          "description": "A string description associated with this node type, e.g., \"r3.xlarge\".",
+          "launch_stage": "GA"
+        },
+        "display_order": {
+          "description": "An optional hint at the display order of node types in the UI.\nWithin a node type category, lowest numbers come first.",
+          "launch_stage": "GA"
+        },
+        "instance_type_id": {
+          "description": "An identifier for the type of hardware that this node runs on, e.g., \"r3.2xlarge\" in AWS.",
+          "launch_stage": "GA"
+        },
+        "is_deprecated": {
+          "description": "Whether the node type is deprecated. Non-deprecated node types offer greater performance.",
+          "launch_stage": "GA"
+        },
+        "is_encrypted_in_transit": {
+          "description": "AWS specific, whether this instance supports encryption in transit, used for hipaa and pci\nworkloads.",
+          "launch_stage": "GA"
+        },
+        "is_graviton": {
+          "description": "Whether this is an Arm-based instance.",
+          "launch_stage": "GA"
+        },
+        "is_hidden": {
+          "description": "Whether this node is hidden from presentation in the UI.",
+          "launch_stage": "GA"
+        },
+        "is_io_cache_enabled": {
+          "description": "Whether this node comes with IO cache enabled by default.",
+          "launch_stage": "GA"
+        },
+        "memory_mb": {
+          "description": "Memory (in MB) available for this node type.",
+          "launch_stage": "GA"
+        },
+        "node_info": {
+          "description": "A collection of node type info reported by the cloud provider",
+          "ref": "compute.CloudProviderNodeInfo",
+          "launch_stage": "GA"
+        },
+        "node_instance_type": {
+          "description": "The NodeInstanceType object corresponding to instance_type_id",
+          "ref": "compute.NodeInstanceType",
+          "launch_stage": "GA"
+        },
+        "node_type_id": {
+          "description": "Unique identifier for this node type.",
+          "launch_stage": "GA"
+        },
+        "num_cores": {
+          "description": "Number of CPU cores available for this node type.\nNote that this can be fractional, e.g., 2.5 cores, if the number of cores on a\nmachine instance is not divisible by the number of Spark nodes on that machine.",
+          "launch_stage": "GA"
+        },
+        "num_gpus": {
+          "description": "Number of GPUs available for this node type.",
+          "launch_stage": "GA"
+        },
+        "photon_driver_capable": {
+          "launch_stage": "GA"
+        },
+        "photon_worker_capable": {
+          "launch_stage": "GA"
+        },
+        "support_cluster_tags": {
+          "description": "Whether this node type support cluster tags.",
+          "launch_stage": "GA"
+        },
+        "support_ebs_volumes": {
+          "description": "Whether this node type support EBS volumes. EBS volumes is disabled for node types that\nwe could place multiple corresponding containers on the same hosting instance.",
+          "launch_stage": "GA"
+        },
+        "support_port_forwarding": {
+          "description": "Whether this node type supports port forwarding.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.NodeTypeFlexibility": {
+      "description": "Configuration for flexible node types, allowing fallback to alternate node types during cluster launch and upscale.",
+      "fields": {
+        "alternate_node_type_ids": {
+          "description": "A list of node type IDs to use as fallbacks when the primary node type is unavailable.",
+          "launch_stage": "GA"
+        },
+        "aws_context_id": {
+          "description": "The AWS Context ID for EC2 Fleet.\nWhen set (non-empty), the value is passed to AWS CreateFleet API to create the EC2 Fleet.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.PendingEnforcement": {
+      "description": "Represents a pending enforcement on a cluster, which contains the changes to make to the cluster\nconfiguration when the cluster is next terminated or restarted.",
+      "fields": {
+        "enforcement_status": {
+          "description": "Whether the pending enforcement will be applied. A pending enforcement begins in `ACTIVE`\nstate. If the enforcement fails to apply too many times, the state transitions to `INACTIVE`.\nAfterwards, the enforcement must be re-scheduled to become `ACTIVE` again.",
+          "ref": "compute.PendingEnforcementEnforcementStatus",
+          "launch_stage": "GA"
+        },
+        "initiate_time": {
+          "description": "The time the pending enforcement was initiated.",
+          "launch_stage": "GA"
+        },
+        "initiator_user": {
+          "description": "The user who initiated the pending enforcement.",
+          "launch_stage": "GA"
+        },
+        "target_changes": {
+          "description": "A list of changes that will be made to the cluster configuration when the pending\nenforcement is applied.",
+          "launch_stage": "GA"
+        },
+        "target_spec": {
+          "description": "The new configuration to apply upon cluster termination or restart.",
+          "ref": "compute.EnforcePolicyComplianceForClusterResponseClusterSettings",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.PendingEnforcementEnforcementStatus": {
+      "enum": [
+        "ACTIVE",
+        "INACTIVE"
+      ],
+      "enum_launch_stages": {
+        "ACTIVE": "GA",
+        "INACTIVE": "GA"
+      }
+    },
+    "compute.PendingInstanceError": {
+      "description": "Error message of a failed pending instances",
+      "fields": {
+        "instance_id": {
+          "launch_stage": "GA"
+        },
+        "message": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.PermanentDeleteCluster": {
+      "fields": {
+        "cluster_id": {
+          "description": "The cluster to be deleted.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.PermanentDeleteClusterResponse": {},
+    "compute.PinCluster": {
+      "fields": {
+        "cluster_id": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.PinClusterResponse": {},
+    "compute.Policy": {
+      "description": "Describes a Cluster Policy entity.",
+      "fields": {
+        "created_at_timestamp": {
+          "description": "Creation time. The timestamp (in millisecond) when this Cluster Policy was created.",
+          "launch_stage": "GA"
+        },
+        "creator_user_name": {
+          "description": "Creator user name.\nThe field won't be included in the response if the user has already been deleted.",
+          "launch_stage": "GA"
+        },
+        "definition": {
+          "description": "Policy definition document expressed in [Databricks Cluster Policy Definition Language](https://docs.databricks.com/administration-guide/clusters/policy-definition.html).",
+          "launch_stage": "GA"
+        },
+        "description": {
+          "description": "Additional human-readable description of the cluster policy.",
+          "launch_stage": "GA"
+        },
+        "is_default": {
+          "description": "If true, policy is a default policy created and managed by Databricks.\nDefault policies cannot be deleted, and their policy families cannot be changed.",
+          "launch_stage": "GA"
+        },
+        "libraries": {
+          "description": "A list of libraries to be installed on the next cluster restart that uses this policy. The maximum number of libraries is 500.",
+          "launch_stage": "GA"
+        },
+        "max_clusters_per_user": {
+          "description": "Max number of clusters per user that can be active using this policy. If not present, there is no max limit.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Cluster Policy name requested by the user. This has to be unique. Length must be between 1 and 100\ncharacters.",
+          "launch_stage": "GA"
+        },
+        "policy_family_definition_overrides": {
+          "description": "Policy definition JSON document expressed in [Databricks Policy Definition Language](https://docs.databricks.com/administration-guide/clusters/policy-definition.html).\nThe JSON document must be passed as a string and cannot be embedded in the requests.\n\nYou can use this to customize the policy definition inherited from the policy family.\nPolicy rules specified here are merged into the inherited policy definition.",
+          "launch_stage": "GA"
+        },
+        "policy_family_id": {
+          "description": "ID of the policy family. The cluster policy's policy definition inherits the policy\nfamily's policy definition.\n\nCannot be used with `definition`. Use `policy_family_definition_overrides` instead to\ncustomize the policy definition.",
+          "launch_stage": "GA"
+        },
+        "policy_id": {
+          "description": "Canonical unique identifier for the Cluster Policy.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.PolicyFamily": {
+      "fields": {
+        "definition": {
+          "description": "Policy definition document expressed in [Databricks Cluster Policy Definition Language](https://docs.databricks.com/administration-guide/clusters/policy-definition.html).",
+          "launch_stage": "GA"
+        },
+        "description": {
+          "description": "Human-readable description of the purpose of the policy family.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of the policy family.",
+          "launch_stage": "GA"
+        },
+        "policy_family_id": {
+          "description": "Unique identifier for the policy family.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.PythonPyPiLibrary": {
+      "fields": {
+        "package": {
+          "description": "The name of the pypi package to install. An optional exact version specification is also\nsupported. Examples: \"simplejson\" and \"simplejson==3.8.0\".",
+          "launch_stage": "GA"
+        },
+        "repo": {
+          "description": "The repository where the package can be found. If not specified, the default pip index is\nused.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.RCranLibrary": {
+      "fields": {
+        "package": {
+          "description": "The name of the CRAN package to install.",
+          "launch_stage": "GA"
+        },
+        "repo": {
+          "description": "The repository where the package can be found. If not specified, the default CRAN repo is used.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.RemoveInstanceProfile": {
+      "fields": {
+        "instance_profile_arn": {
+          "description": "The ARN of the instance profile to remove. This field is required.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.RemoveResponse": {},
+    "compute.ResizeCluster": {
+      "fields": {
+        "autoscale": {
+          "description": "Parameters needed in order to automatically scale clusters up and down based on load.\nNote: autoscaling works best with DB runtime versions 3.0 or later.",
+          "ref": "compute.AutoScale",
+          "launch_stage": "GA"
+        },
+        "cluster_id": {
+          "description": "The cluster to be resized.",
+          "launch_stage": "GA"
+        },
+        "num_workers": {
+          "description": "Number of worker nodes that this cluster should have. A cluster has one Spark Driver\nand `num_workers` Executors for a total of `num_workers` + 1 Spark nodes.\n\nNote: When reading the properties of a cluster, this field reflects the desired number\nof workers rather than the actual current number of workers. For instance, if a cluster\nis resized from 5 to 10 workers, this field will immediately be updated to reflect\nthe target size of 10 workers, whereas the workers listed in `spark_info` will gradually\nincrease from 5 to 10 as the new nodes are provisioned.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.ResizeClusterResponse": {},
+    "compute.RestartCluster": {
+      "fields": {
+        "cluster_id": {
+          "description": "The cluster to be started.",
+          "launch_stage": "GA"
+        },
+        "restart_user": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.RestartClusterResponse": {},
+    "compute.ResultType": {
+      "enum": [
+        "error",
+        "image",
+        "images",
+        "table",
+        "text"
+      ],
+      "enum_launch_stages": {
+        "error": "GA",
+        "image": "GA",
+        "images": "GA",
+        "table": "GA",
+        "text": "GA"
+      }
+    },
+    "compute.Results": {
+      "fields": {
+        "cause": {
+          "description": "The cause of the error",
+          "launch_stage": "GA"
+        },
+        "data": {
+          "launch_stage": "GA"
+        },
+        "fileName": {
+          "description": "The image data in one of the following formats:\n\n1. A Data URL with base64-encoded image data: `data:image/{type};base64,{base64-data}`.\nExample: `data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAUA...`\n\n2. A FileStore file path for large images: `/plots/{filename}.png`.\nExample: `/plots/b6a7ad70-fb2c-4353-8aed-3f1e015174a4.png`",
+          "launch_stage": "GA"
+        },
+        "fileNames": {
+          "description": "List of image data for multiple images. Each element follows the same format as file_name.",
+          "launch_stage": "GA"
+        },
+        "isJsonSchema": {
+          "description": "true if a JSON schema is returned instead of a string representation of the Hive type.",
+          "launch_stage": "GA"
+        },
+        "pos": {
+          "description": "internal field used by SDK",
+          "launch_stage": "GA"
+        },
+        "resultType": {
+          "ref": "compute.ResultType",
+          "launch_stage": "GA"
+        },
+        "schema": {
+          "description": "The table schema",
+          "launch_stage": "GA"
+        },
+        "summary": {
+          "description": "The summary of the error",
+          "launch_stage": "GA"
+        },
+        "truncated": {
+          "description": "true if partial results are returned.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.RuntimeEngine": {
+      "enum": [
+        "NULL",
+        "STANDARD",
+        "PHOTON"
+      ],
+      "enum_launch_stages": {
+        "NULL": "GA",
+        "PHOTON": "GA",
+        "STANDARD": "GA"
+      }
+    },
+    "compute.S3StorageInfo": {
+      "description": "A storage location in Amazon S3",
+      "fields": {
+        "canned_acl": {
+          "description": "(Optional) Set canned access control list for the logs, e.g. `bucket-owner-full-control`.\nIf `canned_cal` is set, please make sure the cluster iam role has `s3:PutObjectAcl` permission on\nthe destination bucket and prefix. The full list of possible canned acl can be found at\nhttp://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl.\nPlease also note that by default only the object owner gets full controls. If you are using cross account\nrole for writing data, you may want to set `bucket-owner-full-control` to make bucket owner able to\nread the logs.",
+          "launch_stage": "GA"
+        },
+        "destination": {
+          "description": "S3 destination, e.g. `s3://my-bucket/some-prefix` Note that logs will be delivered using\ncluster iam role, please make sure you set cluster iam role and the role has write access to the\ndestination. Please also note that you cannot use AWS keys to deliver logs.",
+          "launch_stage": "GA"
+        },
+        "enable_encryption": {
+          "description": "(Optional) Flag to enable server side encryption, `false` by default.",
+          "launch_stage": "GA"
+        },
+        "encryption_type": {
+          "description": "(Optional) The encryption type, it could be `sse-s3` or `sse-kms`. It will be used only when\nencryption is enabled and the default type is `sse-s3`.",
+          "launch_stage": "GA"
+        },
+        "endpoint": {
+          "description": "S3 endpoint, e.g. `https://s3-us-west-2.amazonaws.com`. Either region or endpoint needs to be set.\nIf both are set, endpoint will be used.",
+          "launch_stage": "GA"
+        },
+        "kms_key": {
+          "description": "(Optional) Kms key which will be used if encryption is enabled and encryption type is set to `sse-kms`.",
+          "launch_stage": "GA"
+        },
+        "region": {
+          "description": "S3 region, e.g. `us-west-2`. Either region or endpoint needs to be set. If both are set,\nendpoint will be used.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.SparkNode": {
+      "description": "Describes a specific Spark driver or executor.",
+      "fields": {
+        "host_private_ip": {
+          "description": "The private IP address of the host instance.",
+          "launch_stage": "GA"
+        },
+        "instance_id": {
+          "description": "Globally unique identifier for the host instance from the cloud provider.",
+          "launch_stage": "GA"
+        },
+        "node_aws_attributes": {
+          "description": "Attributes specific to AWS for a Spark node.",
+          "ref": "compute.SparkNodeAwsAttributes",
+          "launch_stage": "GA"
+        },
+        "node_id": {
+          "description": "Globally unique identifier for this node.",
+          "launch_stage": "GA"
+        },
+        "private_ip": {
+          "description": "Private IP address (typically a 10.x.x.x address) of the Spark node.\nNote that this is different from the private IP address of the host instance.",
+          "launch_stage": "GA"
+        },
+        "public_dns": {
+          "description": "Public DNS address of this node. This address can be used to access\nthe Spark JDBC server on the driver node. To communicate with the JDBC server, traffic must\nbe manually authorized by adding security group rules to the \"worker-unmanaged\" security\ngroup via the AWS console.",
+          "launch_stage": "GA"
+        },
+        "start_timestamp": {
+          "description": "The timestamp (in millisecond) when the Spark node is launched.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.SparkNodeAwsAttributes": {
+      "description": "Attributes specific to AWS for a Spark node.",
+      "fields": {
+        "is_spot": {
+          "description": "Whether this node is on an Amazon spot instance.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.SparkVersion": {
+      "fields": {
+        "key": {
+          "description": "Spark version key, for example \"2.1.x-scala2.11\". This is the value which should be provided\nas the \"spark_version\" when creating a new cluster.\nNote that the exact Spark version may change over time for a \"wildcard\" version\n(i.e., \"2.1.x-scala2.11\" is a \"wildcard\" version) with minor bug fixes.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "A descriptive name for this Spark version, for example \"Spark 2.1\".",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.SparkVersionsRequest": {},
+    "compute.StartCluster": {
+      "fields": {
+        "cluster_id": {
+          "description": "The cluster to be started.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.StartClusterResponse": {},
+    "compute.State": {
+      "description": "The state of a Cluster. The current allowable state transitions are as follows:\n\n- `PENDING` -\u003e `RUNNING`\n- `PENDING` -\u003e `TERMINATING`\n- `RUNNING` -\u003e `RESIZING`\n- `RUNNING` -\u003e `RESTARTING`\n- `RUNNING` -\u003e `TERMINATING`\n- `RESTARTING` -\u003e `RUNNING`\n- `RESTARTING` -\u003e `TERMINATING`\n- `RESIZING` -\u003e `RUNNING`\n- `RESIZING` -\u003e `TERMINATING`\n- `TERMINATING` -\u003e `TERMINATED`",
+      "enum": [
+        "PENDING",
+        "RUNNING",
+        "RESTARTING",
+        "RESIZING",
+        "TERMINATING",
+        "TERMINATED",
+        "ERROR",
+        "UNKNOWN"
+      ],
+      "enum_launch_stages": {
+        "ERROR": "GA",
+        "PENDING": "GA",
+        "RESIZING": "GA",
+        "RESTARTING": "GA",
+        "RUNNING": "GA",
+        "TERMINATED": "GA",
+        "TERMINATING": "GA",
+        "UNKNOWN": "GA"
+      }
+    },
+    "compute.TerminationReason": {
+      "fields": {
+        "code": {
+          "description": "status code indicating why the cluster was terminated",
+          "ref": "compute.TerminationReasonCode",
+          "launch_stage": "GA"
+        },
+        "parameters": {
+          "description": "list of parameters that provide additional information about why the cluster was terminated",
+          "launch_stage": "GA"
+        },
+        "type": {
+          "description": "type of the termination",
+          "ref": "compute.TerminationReasonType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.TerminationReasonCode": {
+      "description": "The status code indicating why the cluster was terminated.",
+      "enum": [
+        "UNKNOWN",
+        "USER_REQUEST",
+        "JOB_FINISHED",
+        "INACTIVITY",
+        "CLOUD_PROVIDER_SHUTDOWN",
+        "COMMUNICATION_LOST",
+        "CLOUD_PROVIDER_LAUNCH_FAILURE",
+        "INIT_SCRIPT_FAILURE",
+        "SPARK_STARTUP_FAILURE",
+        "INVALID_ARGUMENT",
+        "UNEXPECTED_LAUNCH_FAILURE",
+        "INTERNAL_ERROR",
+        "INSTANCE_UNREACHABLE",
+        "REQUEST_REJECTED",
+        "TRIAL_EXPIRED",
+        "DRIVER_UNREACHABLE",
+        "SPARK_ERROR",
+        "DRIVER_UNRESPONSIVE",
+        "METASTORE_COMPONENT_UNHEALTHY",
+        "DBFS_COMPONENT_UNHEALTHY",
+        "EXECUTION_COMPONENT_UNHEALTHY",
+        "AZURE_RESOURCE_MANAGER_THROTTLING",
+        "AZURE_RESOURCE_PROVIDER_THROTTLING",
+        "NETWORK_CONFIGURATION_FAILURE",
+        "CONTAINER_LAUNCH_FAILURE",
+        "INSTANCE_POOL_CLUSTER_FAILURE",
+        "SKIPPED_SLOW_NODES",
+        "ATTACH_PROJECT_FAILURE",
+        "UPDATE_INSTANCE_PROFILE_FAILURE",
+        "DATABASE_CONNECTION_FAILURE",
+        "REQUEST_THROTTLED",
+        "SELF_BOOTSTRAP_FAILURE",
+        "GLOBAL_INIT_SCRIPT_FAILURE",
+        "SLOW_IMAGE_DOWNLOAD",
+        "INVALID_SPARK_IMAGE",
+        "NPIP_TUNNEL_TOKEN_FAILURE",
+        "HIVE_METASTORE_PROVISIONING_FAILURE",
+        "AZURE_INVALID_DEPLOYMENT_TEMPLATE",
+        "AZURE_UNEXPECTED_DEPLOYMENT_TEMPLATE_FAILURE",
+        "SUBNET_EXHAUSTED_FAILURE",
+        "BOOTSTRAP_TIMEOUT",
+        "STORAGE_DOWNLOAD_FAILURE",
+        "CONTROL_PLANE_REQUEST_FAILURE",
+        "BOOTSTRAP_TIMEOUT_CLOUD_PROVIDER_EXCEPTION",
+        "AWS_INSUFFICIENT_INSTANCE_CAPACITY_FAILURE",
+        "DOCKER_IMAGE_PULL_FAILURE",
+        "AZURE_VNET_CONFIGURATION_FAILURE",
+        "NPIP_TUNNEL_SETUP_FAILURE",
+        "AWS_AUTHORIZATION_FAILURE",
+        "NEPHOS_RESOURCE_MANAGEMENT",
+        "STS_CLIENT_SETUP_FAILURE",
+        "SECURITY_DAEMON_REGISTRATION_EXCEPTION",
+        "AWS_REQUEST_LIMIT_EXCEEDED",
+        "AWS_INSUFFICIENT_FREE_ADDRESSES_IN_SUBNET_FAILURE",
+        "AWS_UNSUPPORTED_FAILURE",
+        "AZURE_QUOTA_EXCEEDED_EXCEPTION",
+        "AZURE_OPERATION_NOT_ALLOWED_EXCEPTION",
+        "NFS_MOUNT_FAILURE",
+        "K8S_AUTOSCALING_FAILURE",
+        "K8S_DBR_CLUSTER_LAUNCH_TIMEOUT",
+        "SPARK_IMAGE_DOWNLOAD_FAILURE",
+        "AZURE_VM_EXTENSION_FAILURE",
+        "WORKSPACE_CANCELLED_ERROR",
+        "AWS_MAX_SPOT_INSTANCE_COUNT_EXCEEDED_FAILURE",
+        "TEMPORARILY_UNAVAILABLE",
+        "WORKER_SETUP_FAILURE",
+        "IP_EXHAUSTION_FAILURE",
+        "GCP_QUOTA_EXCEEDED",
+        "CLOUD_PROVIDER_RESOURCE_STOCKOUT",
+        "GCP_SERVICE_ACCOUNT_DELETED",
+        "AZURE_BYOK_KEY_PERMISSION_FAILURE",
+        "SPOT_INSTANCE_TERMINATION",
+        "AZURE_EPHEMERAL_DISK_FAILURE",
+        "ABUSE_DETECTED",
+        "IMAGE_PULL_PERMISSION_DENIED",
+        "WORKSPACE_CONFIGURATION_ERROR",
+        "SECRET_RESOLUTION_ERROR",
+        "UNSUPPORTED_INSTANCE_TYPE",
+        "CLOUD_PROVIDER_DISK_SETUP_FAILURE",
+        "SSH_BOOTSTRAP_FAILURE",
+        "AWS_INACCESSIBLE_KMS_KEY_FAILURE",
+        "INIT_CONTAINER_NOT_FINISHED",
+        "SPARK_IMAGE_DOWNLOAD_THROTTLED",
+        "SPARK_IMAGE_NOT_FOUND",
+        "CLUSTER_OPERATION_THROTTLED",
+        "CLUSTER_OPERATION_TIMEOUT",
+        "SERVERLESS_LONG_RUNNING_TERMINATED",
+        "AZURE_PACKED_DEPLOYMENT_PARTIAL_FAILURE",
+        "INVALID_WORKER_IMAGE_FAILURE",
+        "WORKSPACE_UPDATE",
+        "INVALID_AWS_PARAMETER",
+        "DRIVER_OUT_OF_DISK",
+        "DRIVER_OUT_OF_MEMORY",
+        "DRIVER_LAUNCH_TIMEOUT",
+        "DRIVER_UNEXPECTED_FAILURE",
+        "UNEXPECTED_POD_RECREATION",
+        "GCP_INACCESSIBLE_KMS_KEY_FAILURE",
+        "GCP_KMS_KEY_PERMISSION_DENIED",
+        "DRIVER_EVICTION",
+        "USER_INITIATED_VM_TERMINATION",
+        "GCP_IAM_TIMEOUT",
+        "AWS_RESOURCE_QUOTA_EXCEEDED",
+        "CLOUD_ACCOUNT_SETUP_FAILURE",
+        "AWS_INVALID_KEY_PAIR",
+        "DRIVER_POD_CREATION_FAILURE",
+        "MAINTENANCE_MODE",
+        "INTERNAL_CAPACITY_FAILURE",
+        "EXECUTOR_POD_UNSCHEDULED",
+        "STORAGE_DOWNLOAD_FAILURE_SLOW",
+        "STORAGE_DOWNLOAD_FAILURE_THROTTLED",
+        "DYNAMIC_SPARK_CONF_SIZE_EXCEEDED",
+        "AWS_INSTANCE_PROFILE_UPDATE_FAILURE",
+        "INSTANCE_POOL_NOT_FOUND",
+        "INSTANCE_POOL_MAX_CAPACITY_REACHED",
+        "AWS_INVALID_KMS_KEY_STATE",
+        "GCP_INSUFFICIENT_CAPACITY",
+        "GCP_API_RATE_QUOTA_EXCEEDED",
+        "GCP_RESOURCE_QUOTA_EXCEEDED",
+        "GCP_IP_SPACE_EXHAUSTED",
+        "GCP_SERVICE_ACCOUNT_ACCESS_DENIED",
+        "GCP_SERVICE_ACCOUNT_NOT_FOUND",
+        "GCP_FORBIDDEN",
+        "GCP_NOT_FOUND",
+        "RESOURCE_USAGE_BLOCKED",
+        "DATA_ACCESS_CONFIG_CHANGED",
+        "ACCESS_TOKEN_FAILURE",
+        "INVALID_INSTANCE_PLACEMENT_PROTOCOL",
+        "BUDGET_POLICY_RESOLUTION_FAILURE",
+        "IN_PENALTY_BOX",
+        "DISASTER_RECOVERY_REPLICATION",
+        "BOOTSTRAP_TIMEOUT_DUE_TO_MISCONFIG",
+        "INSTANCE_UNREACHABLE_DUE_TO_MISCONFIG",
+        "STORAGE_DOWNLOAD_FAILURE_DUE_TO_MISCONFIG",
+        "CONTROL_PLANE_REQUEST_FAILURE_DUE_TO_MISCONFIG",
+        "CLOUD_PROVIDER_LAUNCH_FAILURE_DUE_TO_MISCONFIG",
+        "GCP_SUBNET_NOT_READY",
+        "CLOUD_OPERATION_CANCELLED",
+        "CLOUD_PROVIDER_INSTANCE_NOT_LAUNCHED",
+        "GCP_TRUSTED_IMAGE_PROJECTS_VIOLATED",
+        "BUDGET_POLICY_LIMIT_ENFORCEMENT_ACTIVATED",
+        "EOS_SPARK_IMAGE",
+        "NO_MATCHED_K8S",
+        "LAZY_ALLOCATION_TIMEOUT",
+        "DRIVER_NODE_UNREACHABLE",
+        "SECRET_CREATION_FAILURE",
+        "POD_SCHEDULING_FAILURE",
+        "POD_ASSIGNMENT_FAILURE",
+        "ALLOCATION_TIMEOUT",
+        "ALLOCATION_TIMEOUT_NO_UNALLOCATED_CLUSTERS",
+        "ALLOCATION_TIMEOUT_NO_MATCHED_CLUSTERS",
+        "ALLOCATION_TIMEOUT_NO_READY_CLUSTERS",
+        "ALLOCATION_TIMEOUT_NO_WARMED_UP_CLUSTERS",
+        "ALLOCATION_TIMEOUT_NODE_DAEMON_NOT_READY",
+        "ALLOCATION_TIMEOUT_NO_HEALTHY_CLUSTERS",
+        "NETVISOR_SETUP_TIMEOUT",
+        "NO_MATCHED_K8S_TESTING_TAG",
+        "CLOUD_PROVIDER_RESOURCE_STOCKOUT_DUE_TO_MISCONFIG",
+        "GKE_BASED_CLUSTER_TERMINATION",
+        "ALLOCATION_TIMEOUT_NO_HEALTHY_AND_WARMED_UP_CLUSTERS",
+        "DOCKER_INVALID_OS_EXCEPTION",
+        "DOCKER_CONTAINER_CREATION_EXCEPTION",
+        "DOCKER_IMAGE_TOO_LARGE_FOR_INSTANCE_EXCEPTION",
+        "DNS_RESOLUTION_ERROR",
+        "GCP_DENIED_BY_ORG_POLICY",
+        "SECRET_PERMISSION_DENIED",
+        "NETWORK_CHECK_NIC_FAILURE",
+        "NETWORK_CHECK_DNS_SERVER_FAILURE",
+        "NETWORK_CHECK_STORAGE_FAILURE",
+        "NETWORK_CHECK_METADATA_ENDPOINT_FAILURE",
+        "NETWORK_CHECK_CONTROL_PLANE_FAILURE",
+        "NETWORK_CHECK_MULTIPLE_COMPONENTS_FAILURE",
+        "DRIVER_UNHEALTHY",
+        "USAGE_POLICY_ENTITLEMENT_DENIED",
+        "K8S_ACTIVE_POD_QUOTA_EXCEEDED",
+        "CLOUD_ACCOUNT_POD_QUOTA_EXCEEDED",
+        "NETWORK_CHECK_NIC_FAILURE_DUE_TO_MISCONFIG",
+        "NETWORK_CHECK_DNS_SERVER_FAILURE_DUE_TO_MISCONFIG",
+        "NETWORK_CHECK_STORAGE_FAILURE_DUE_TO_MISCONFIG",
+        "NETWORK_CHECK_METADATA_ENDPOINT_FAILURE_DUE_TO_MISCONFIG",
+        "NETWORK_CHECK_CONTROL_PLANE_FAILURE_DUE_TO_MISCONFIG",
+        "NETWORK_CHECK_MULTIPLE_COMPONENTS_FAILURE_DUE_TO_MISCONFIG",
+        "DBR_IMAGE_RESOLUTION_FAILURE",
+        "CONTROL_PLANE_CONNECTION_FAILURE",
+        "CONTROL_PLANE_CONNECTION_FAILURE_DUE_TO_MISCONFIG",
+        "RATE_LIMITED",
+        "MTLS_PORT_CONNECTIVITY_FAILURE",
+        "HIVEMETASTORE_CONNECTIVITY_FAILURE"
+      ],
+      "enum_launch_stages": {
+        "ABUSE_DETECTED": "GA",
+        "ACCESS_TOKEN_FAILURE": "GA",
+        "ALLOCATION_TIMEOUT": "GA",
+        "ALLOCATION_TIMEOUT_NODE_DAEMON_NOT_READY": "GA",
+        "ALLOCATION_TIMEOUT_NO_HEALTHY_AND_WARMED_UP_CLUSTERS": "GA",
+        "ALLOCATION_TIMEOUT_NO_HEALTHY_CLUSTERS": "GA",
+        "ALLOCATION_TIMEOUT_NO_MATCHED_CLUSTERS": "GA",
+        "ALLOCATION_TIMEOUT_NO_READY_CLUSTERS": "GA",
+        "ALLOCATION_TIMEOUT_NO_UNALLOCATED_CLUSTERS": "GA",
+        "ALLOCATION_TIMEOUT_NO_WARMED_UP_CLUSTERS": "GA",
+        "ATTACH_PROJECT_FAILURE": "GA",
+        "AWS_AUTHORIZATION_FAILURE": "GA",
+        "AWS_INACCESSIBLE_KMS_KEY_FAILURE": "GA",
+        "AWS_INSTANCE_PROFILE_UPDATE_FAILURE": "GA",
+        "AWS_INSUFFICIENT_FREE_ADDRESSES_IN_SUBNET_FAILURE": "GA",
+        "AWS_INSUFFICIENT_INSTANCE_CAPACITY_FAILURE": "GA",
+        "AWS_INVALID_KEY_PAIR": "GA",
+        "AWS_INVALID_KMS_KEY_STATE": "GA",
+        "AWS_MAX_SPOT_INSTANCE_COUNT_EXCEEDED_FAILURE": "GA",
+        "AWS_REQUEST_LIMIT_EXCEEDED": "GA",
+        "AWS_RESOURCE_QUOTA_EXCEEDED": "GA",
+        "AWS_UNSUPPORTED_FAILURE": "GA",
+        "AZURE_BYOK_KEY_PERMISSION_FAILURE": "GA",
+        "AZURE_EPHEMERAL_DISK_FAILURE": "GA",
+        "AZURE_INVALID_DEPLOYMENT_TEMPLATE": "GA",
+        "AZURE_OPERATION_NOT_ALLOWED_EXCEPTION": "GA",
+        "AZURE_PACKED_DEPLOYMENT_PARTIAL_FAILURE": "GA",
+        "AZURE_QUOTA_EXCEEDED_EXCEPTION": "GA",
+        "AZURE_RESOURCE_MANAGER_THROTTLING": "GA",
+        "AZURE_RESOURCE_PROVIDER_THROTTLING": "GA",
+        "AZURE_UNEXPECTED_DEPLOYMENT_TEMPLATE_FAILURE": "GA",
+        "AZURE_VM_EXTENSION_FAILURE": "GA",
+        "AZURE_VNET_CONFIGURATION_FAILURE": "GA",
+        "BOOTSTRAP_TIMEOUT": "GA",
+        "BOOTSTRAP_TIMEOUT_CLOUD_PROVIDER_EXCEPTION": "GA",
+        "BOOTSTRAP_TIMEOUT_DUE_TO_MISCONFIG": "GA",
+        "BUDGET_POLICY_LIMIT_ENFORCEMENT_ACTIVATED": "GA",
+        "BUDGET_POLICY_RESOLUTION_FAILURE": "GA",
+        "CLOUD_ACCOUNT_POD_QUOTA_EXCEEDED": "GA",
+        "CLOUD_ACCOUNT_SETUP_FAILURE": "GA",
+        "CLOUD_OPERATION_CANCELLED": "GA",
+        "CLOUD_PROVIDER_DISK_SETUP_FAILURE": "GA",
+        "CLOUD_PROVIDER_INSTANCE_NOT_LAUNCHED": "GA",
+        "CLOUD_PROVIDER_LAUNCH_FAILURE": "GA",
+        "CLOUD_PROVIDER_LAUNCH_FAILURE_DUE_TO_MISCONFIG": "GA",
+        "CLOUD_PROVIDER_RESOURCE_STOCKOUT": "GA",
+        "CLOUD_PROVIDER_RESOURCE_STOCKOUT_DUE_TO_MISCONFIG": "GA",
+        "CLOUD_PROVIDER_SHUTDOWN": "GA",
+        "CLUSTER_OPERATION_THROTTLED": "GA",
+        "CLUSTER_OPERATION_TIMEOUT": "GA",
+        "COMMUNICATION_LOST": "GA",
+        "CONTAINER_LAUNCH_FAILURE": "GA",
+        "CONTROL_PLANE_CONNECTION_FAILURE": "GA",
+        "CONTROL_PLANE_CONNECTION_FAILURE_DUE_TO_MISCONFIG": "GA",
+        "CONTROL_PLANE_REQUEST_FAILURE": "GA",
+        "CONTROL_PLANE_REQUEST_FAILURE_DUE_TO_MISCONFIG": "GA",
+        "DATABASE_CONNECTION_FAILURE": "GA",
+        "DATA_ACCESS_CONFIG_CHANGED": "GA",
+        "DBFS_COMPONENT_UNHEALTHY": "GA",
+        "DBR_IMAGE_RESOLUTION_FAILURE": "GA",
+        "DISASTER_RECOVERY_REPLICATION": "GA",
+        "DNS_RESOLUTION_ERROR": "GA",
+        "DOCKER_CONTAINER_CREATION_EXCEPTION": "GA",
+        "DOCKER_IMAGE_PULL_FAILURE": "GA",
+        "DOCKER_IMAGE_TOO_LARGE_FOR_INSTANCE_EXCEPTION": "GA",
+        "DOCKER_INVALID_OS_EXCEPTION": "GA",
+        "DRIVER_EVICTION": "GA",
+        "DRIVER_LAUNCH_TIMEOUT": "GA",
+        "DRIVER_NODE_UNREACHABLE": "GA",
+        "DRIVER_OUT_OF_DISK": "GA",
+        "DRIVER_OUT_OF_MEMORY": "GA",
+        "DRIVER_POD_CREATION_FAILURE": "GA",
+        "DRIVER_UNEXPECTED_FAILURE": "GA",
+        "DRIVER_UNHEALTHY": "GA",
+        "DRIVER_UNREACHABLE": "GA",
+        "DRIVER_UNRESPONSIVE": "GA",
+        "DYNAMIC_SPARK_CONF_SIZE_EXCEEDED": "GA",
+        "EOS_SPARK_IMAGE": "GA",
+        "EXECUTION_COMPONENT_UNHEALTHY": "GA",
+        "EXECUTOR_POD_UNSCHEDULED": "GA",
+        "GCP_API_RATE_QUOTA_EXCEEDED": "GA",
+        "GCP_DENIED_BY_ORG_POLICY": "GA",
+        "GCP_FORBIDDEN": "GA",
+        "GCP_IAM_TIMEOUT": "GA",
+        "GCP_INACCESSIBLE_KMS_KEY_FAILURE": "GA",
+        "GCP_INSUFFICIENT_CAPACITY": "GA",
+        "GCP_IP_SPACE_EXHAUSTED": "GA",
+        "GCP_KMS_KEY_PERMISSION_DENIED": "GA",
+        "GCP_NOT_FOUND": "GA",
+        "GCP_QUOTA_EXCEEDED": "GA",
+        "GCP_RESOURCE_QUOTA_EXCEEDED": "GA",
+        "GCP_SERVICE_ACCOUNT_ACCESS_DENIED": "GA",
+        "GCP_SERVICE_ACCOUNT_DELETED": "GA",
+        "GCP_SERVICE_ACCOUNT_NOT_FOUND": "GA",
+        "GCP_SUBNET_NOT_READY": "GA",
+        "GCP_TRUSTED_IMAGE_PROJECTS_VIOLATED": "GA",
+        "GKE_BASED_CLUSTER_TERMINATION": "GA",
+        "GLOBAL_INIT_SCRIPT_FAILURE": "GA",
+        "HIVEMETASTORE_CONNECTIVITY_FAILURE": "GA",
+        "HIVE_METASTORE_PROVISIONING_FAILURE": "GA",
+        "IMAGE_PULL_PERMISSION_DENIED": "GA",
+        "INACTIVITY": "GA",
+        "INIT_CONTAINER_NOT_FINISHED": "GA",
+        "INIT_SCRIPT_FAILURE": "GA",
+        "INSTANCE_POOL_CLUSTER_FAILURE": "GA",
+        "INSTANCE_POOL_MAX_CAPACITY_REACHED": "GA",
+        "INSTANCE_POOL_NOT_FOUND": "GA",
+        "INSTANCE_UNREACHABLE": "GA",
+        "INSTANCE_UNREACHABLE_DUE_TO_MISCONFIG": "GA",
+        "INTERNAL_CAPACITY_FAILURE": "GA",
+        "INTERNAL_ERROR": "GA",
+        "INVALID_ARGUMENT": "GA",
+        "INVALID_AWS_PARAMETER": "GA",
+        "INVALID_INSTANCE_PLACEMENT_PROTOCOL": "GA",
+        "INVALID_SPARK_IMAGE": "GA",
+        "INVALID_WORKER_IMAGE_FAILURE": "GA",
+        "IN_PENALTY_BOX": "GA",
+        "IP_EXHAUSTION_FAILURE": "GA",
+        "JOB_FINISHED": "GA",
+        "K8S_ACTIVE_POD_QUOTA_EXCEEDED": "GA",
+        "K8S_AUTOSCALING_FAILURE": "GA",
+        "K8S_DBR_CLUSTER_LAUNCH_TIMEOUT": "GA",
+        "LAZY_ALLOCATION_TIMEOUT": "GA",
+        "MAINTENANCE_MODE": "GA",
+        "METASTORE_COMPONENT_UNHEALTHY": "GA",
+        "MTLS_PORT_CONNECTIVITY_FAILURE": "GA",
+        "NEPHOS_RESOURCE_MANAGEMENT": "GA",
+        "NETVISOR_SETUP_TIMEOUT": "GA",
+        "NETWORK_CHECK_CONTROL_PLANE_FAILURE": "GA",
+        "NETWORK_CHECK_CONTROL_PLANE_FAILURE_DUE_TO_MISCONFIG": "GA",
+        "NETWORK_CHECK_DNS_SERVER_FAILURE": "GA",
+        "NETWORK_CHECK_DNS_SERVER_FAILURE_DUE_TO_MISCONFIG": "GA",
+        "NETWORK_CHECK_METADATA_ENDPOINT_FAILURE": "GA",
+        "NETWORK_CHECK_METADATA_ENDPOINT_FAILURE_DUE_TO_MISCONFIG": "GA",
+        "NETWORK_CHECK_MULTIPLE_COMPONENTS_FAILURE": "GA",
+        "NETWORK_CHECK_MULTIPLE_COMPONENTS_FAILURE_DUE_TO_MISCONFIG": "GA",
+        "NETWORK_CHECK_NIC_FAILURE": "GA",
+        "NETWORK_CHECK_NIC_FAILURE_DUE_TO_MISCONFIG": "GA",
+        "NETWORK_CHECK_STORAGE_FAILURE": "GA",
+        "NETWORK_CHECK_STORAGE_FAILURE_DUE_TO_MISCONFIG": "GA",
+        "NETWORK_CONFIGURATION_FAILURE": "GA",
+        "NFS_MOUNT_FAILURE": "GA",
+        "NO_MATCHED_K8S": "GA",
+        "NO_MATCHED_K8S_TESTING_TAG": "GA",
+        "NPIP_TUNNEL_SETUP_FAILURE": "GA",
+        "NPIP_TUNNEL_TOKEN_FAILURE": "GA",
+        "POD_ASSIGNMENT_FAILURE": "GA",
+        "POD_SCHEDULING_FAILURE": "GA",
+        "RATE_LIMITED": "GA",
+        "REQUEST_REJECTED": "GA",
+        "REQUEST_THROTTLED": "GA",
+        "RESOURCE_USAGE_BLOCKED": "GA",
+        "SECRET_CREATION_FAILURE": "GA",
+        "SECRET_PERMISSION_DENIED": "GA",
+        "SECRET_RESOLUTION_ERROR": "GA",
+        "SECURITY_DAEMON_REGISTRATION_EXCEPTION": "GA",
+        "SELF_BOOTSTRAP_FAILURE": "GA",
+        "SERVERLESS_LONG_RUNNING_TERMINATED": "GA",
+        "SKIPPED_SLOW_NODES": "GA",
+        "SLOW_IMAGE_DOWNLOAD": "GA",
+        "SPARK_ERROR": "GA",
+        "SPARK_IMAGE_DOWNLOAD_FAILURE": "GA",
+        "SPARK_IMAGE_DOWNLOAD_THROTTLED": "GA",
+        "SPARK_IMAGE_NOT_FOUND": "GA",
+        "SPARK_STARTUP_FAILURE": "GA",
+        "SPOT_INSTANCE_TERMINATION": "GA",
+        "SSH_BOOTSTRAP_FAILURE": "GA",
+        "STORAGE_DOWNLOAD_FAILURE": "GA",
+        "STORAGE_DOWNLOAD_FAILURE_DUE_TO_MISCONFIG": "GA",
+        "STORAGE_DOWNLOAD_FAILURE_SLOW": "GA",
+        "STORAGE_DOWNLOAD_FAILURE_THROTTLED": "GA",
+        "STS_CLIENT_SETUP_FAILURE": "GA",
+        "SUBNET_EXHAUSTED_FAILURE": "GA",
+        "TEMPORARILY_UNAVAILABLE": "GA",
+        "TRIAL_EXPIRED": "GA",
+        "UNEXPECTED_LAUNCH_FAILURE": "GA",
+        "UNEXPECTED_POD_RECREATION": "GA",
+        "UNKNOWN": "GA",
+        "UNSUPPORTED_INSTANCE_TYPE": "GA",
+        "UPDATE_INSTANCE_PROFILE_FAILURE": "GA",
+        "USAGE_POLICY_ENTITLEMENT_DENIED": "GA",
+        "USER_INITIATED_VM_TERMINATION": "GA",
+        "USER_REQUEST": "GA",
+        "WORKER_SETUP_FAILURE": "GA",
+        "WORKSPACE_CANCELLED_ERROR": "GA",
+        "WORKSPACE_CONFIGURATION_ERROR": "GA",
+        "WORKSPACE_UPDATE": "GA"
+      }
+    },
+    "compute.TerminationReasonType": {
+      "description": "type of the termination",
+      "enum": [
+        "SUCCESS",
+        "CLIENT_ERROR",
+        "SERVICE_FAULT",
+        "CLOUD_FAILURE"
+      ],
+      "enum_launch_stages": {
+        "CLIENT_ERROR": "GA",
+        "CLOUD_FAILURE": "GA",
+        "SERVICE_FAULT": "GA",
+        "SUCCESS": "GA"
+      }
+    },
+    "compute.UninstallLibraries": {
+      "fields": {
+        "cluster_id": {
+          "description": "Unique identifier for the cluster on which to uninstall these libraries.",
+          "launch_stage": "GA"
+        },
+        "libraries": {
+          "description": "The libraries to uninstall.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.UninstallLibrariesResponse": {},
+    "compute.UnpinCluster": {
+      "fields": {
+        "cluster_id": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.UnpinClusterResponse": {},
+    "compute.UpdateCluster": {
+      "fields": {
+        "cluster": {
+          "description": "The cluster to be updated.",
+          "ref": "compute.UpdateClusterResource",
+          "launch_stage": "GA"
+        },
+        "cluster_id": {
+          "description": "ID of the cluster.",
+          "launch_stage": "GA"
+        },
+        "update_mask": {
+          "description": "Used to specify which cluster attributes and size fields to update. See https://google.aip.dev/161 for more details.\n\nThe field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.UpdateClusterResource": {
+      "fields": {
+        "autoscale": {
+          "description": "Parameters needed in order to automatically scale clusters up and down based on load.\nNote: autoscaling works best with DB runtime versions 3.0 or later.",
+          "ref": "compute.AutoScale",
+          "launch_stage": "GA"
+        },
+        "autotermination_minutes": {
+          "description": "Automatically terminates the cluster after it is inactive for this time in minutes. If not set,\nthis cluster will not be automatically terminated. If specified, the threshold must be between\n10 and 10000 minutes.\nUsers can also set this value to 0 to explicitly disable automatic termination.",
+          "launch_stage": "GA"
+        },
+        "aws_attributes": {
+          "description": "Attributes related to clusters running on Amazon Web Services.\nIf not specified at cluster creation, a set of default values will be used.",
+          "ref": "compute.AwsAttributes",
+          "launch_stage": "GA"
+        },
+        "azure_attributes": {
+          "description": "Attributes related to clusters running on Microsoft Azure.\nIf not specified at cluster creation, a set of default values will be used.",
+          "ref": "compute.AzureAttributes",
+          "launch_stage": "GA"
+        },
+        "cluster_log_conf": {
+          "description": "The configuration for delivering spark logs to a long-term storage destination.\nThree kinds of destinations (DBFS, S3 and Unity Catalog volumes) are supported. Only one destination can be specified\nfor one cluster. If the conf is given, the logs will be delivered to the destination every\n`5 mins`. The destination of driver logs is `$destination/$clusterId/driver`, while\nthe destination of executor logs is `$destination/$clusterId/executor`.",
+          "ref": "compute.ClusterLogConf",
+          "launch_stage": "GA"
+        },
+        "cluster_name": {
+          "description": "Cluster name requested by the user. This doesn't have to be unique.\nIf not specified at creation, the cluster name will be an empty string.\nFor job clusters, the cluster name is automatically set based on the job and job run IDs.",
+          "launch_stage": "GA"
+        },
+        "custom_tags": {
+          "description": "Additional tags for cluster resources. Databricks will tag all cluster resources (e.g., AWS\ninstances and EBS volumes) with these tags in addition to `default_tags`. Notes:\n\n- Currently, Databricks allows at most 45 custom tags\n\n- Clusters can only reuse cloud resources if the resources' tags are a subset of the cluster tags",
+          "launch_stage": "GA"
+        },
+        "data_security_mode": {
+          "ref": "compute.DataSecurityMode",
+          "launch_stage": "GA"
+        },
+        "dependency_mode": {
+          "description": "Controls dependency configuration for the cluster.",
+          "ref": "compute.DependencyMode",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "docker_image": {
+          "description": "Custom docker image BYOC",
+          "ref": "compute.DockerImage",
+          "launch_stage": "GA"
+        },
+        "driver_instance_pool_id": {
+          "description": "The optional ID of the instance pool for the driver of the cluster belongs.\nThe pool cluster uses the instance pool with id (instance_pool_id) if the driver pool is not\nassigned.",
+          "launch_stage": "GA"
+        },
+        "driver_node_type_flexibility": {
+          "description": "Flexible node type configuration for the driver node.",
+          "ref": "compute.NodeTypeFlexibility",
+          "launch_stage": "GA"
+        },
+        "driver_node_type_id": {
+          "description": "The node type of the Spark driver.\nNote that this field is optional; if unset, the driver node type will be set as the same value\nas `node_type_id` defined above.",
+          "launch_stage": "GA"
+        },
+        "enable_elastic_disk": {
+          "description": "Autoscaling Local Storage: when enabled, this cluster will dynamically acquire additional disk\nspace when its Spark workers are running low on disk space.",
+          "launch_stage": "GA"
+        },
+        "enable_local_disk_encryption": {
+          "description": "Whether to enable LUKS on cluster VMs' local disks",
+          "launch_stage": "GA"
+        },
+        "gcp_attributes": {
+          "description": "Attributes related to clusters running on Google Cloud Platform.\nIf not specified at cluster creation, a set of default values will be used.",
+          "ref": "compute.GcpAttributes",
+          "launch_stage": "GA"
+        },
+        "init_scripts": {
+          "description": "The configuration for storing init scripts. Any number of destinations can be specified.\nThe scripts are executed sequentially in the order provided.\nIf `cluster_log_conf` is specified, init script logs are sent to `\u003cdestination\u003e/\u003ccluster-ID\u003e/init_scripts`.",
+          "launch_stage": "GA"
+        },
+        "instance_pool_id": {
+          "description": "The optional ID of the instance pool to which the cluster belongs.",
+          "launch_stage": "GA"
+        },
+        "is_single_node": {
+          "description": "This field can only be used when `kind = CLASSIC_PREVIEW`.\n\nWhen set to true, Databricks will automatically set single node related `custom_tags`, `spark_conf`, and `num_workers`",
+          "launch_stage": "GA"
+        },
+        "kind": {
+          "ref": "compute.Kind",
+          "launch_stage": "GA"
+        },
+        "node_type_id": {
+          "description": "This field encodes, through a single value, the resources available to each of\nthe Spark nodes in this cluster. For example, the Spark nodes can be provisioned\nand optimized for memory or compute intensive workloads. A list of available node\ntypes can be retrieved by using the [clusters/listNodeTypes](https://docs.databricks.com/api/workspace/clusters/listnodetypes) API call.",
+          "launch_stage": "GA"
+        },
+        "num_workers": {
+          "description": "Number of worker nodes that this cluster should have. A cluster has one Spark Driver\nand `num_workers` Executors for a total of `num_workers` + 1 Spark nodes.\n\nNote: When reading the properties of a cluster, this field reflects the desired number\nof workers rather than the actual current number of workers. For instance, if a cluster\nis resized from 5 to 10 workers, this field will immediately be updated to reflect\nthe target size of 10 workers, whereas the workers listed in `spark_info` will gradually\nincrease from 5 to 10 as the new nodes are provisioned.",
+          "launch_stage": "GA"
+        },
+        "policy_id": {
+          "description": "The ID of the cluster policy used to create the cluster if applicable.",
+          "launch_stage": "GA"
+        },
+        "remote_disk_throughput": {
+          "description": "If set, what the configurable throughput (in Mb/s) for the remote disk is. Currently only supported for GCP HYPERDISK_BALANCED disks.",
+          "launch_stage": "GA"
+        },
+        "runtime_engine": {
+          "description": "Determines the cluster's runtime engine, either standard or Photon.\n\nThis field is not compatible with legacy `spark_version` values that contain `-photon-`.\nRemove `-photon-` from the `spark_version` and set `runtime_engine` to `PHOTON`.\n\nIf left unspecified, the runtime engine defaults to standard unless the spark_version\ncontains -photon-, in which case Photon will be used.",
+          "ref": "compute.RuntimeEngine",
+          "launch_stage": "GA"
+        },
+        "single_user_name": {
+          "description": "Single user name if data_security_mode is `SINGLE_USER`",
+          "launch_stage": "GA"
+        },
+        "spark_conf": {
+          "description": "An object containing a set of optional, user-specified Spark configuration key-value pairs.\nUsers can also pass in a string of extra JVM options to the driver and the executors via\n`spark.driver.extraJavaOptions` and `spark.executor.extraJavaOptions` respectively.",
+          "launch_stage": "GA"
+        },
+        "spark_env_vars": {
+          "description": "An object containing a set of optional, user-specified environment variable key-value pairs.\nPlease note that key-value pair of the form (X,Y) will be exported as is (i.e.,\n`export X='Y'`) while launching the driver and workers.\n\nIn order to specify an additional set of `SPARK_DAEMON_JAVA_OPTS`, we recommend appending\nthem to `$SPARK_DAEMON_JAVA_OPTS` as shown in the example below. This ensures that all\ndefault databricks managed environmental variables are included as well.\n\nExample Spark environment variables:\n`{\"SPARK_WORKER_MEMORY\": \"28000m\", \"SPARK_LOCAL_DIRS\": \"/local_disk0\"}` or\n`{\"SPARK_DAEMON_JAVA_OPTS\": \"$SPARK_DAEMON_JAVA_OPTS -Dspark.shuffle.service.enabled=true\"}`",
+          "launch_stage": "GA"
+        },
+        "spark_version": {
+          "description": "The Spark version of the cluster, e.g. `3.3.x-scala2.11`.\nA list of available Spark versions can be retrieved by using\nthe [clusters/sparkVersions](https://docs.databricks.com/api/workspace/clusters/sparkversions) API call.",
+          "launch_stage": "GA"
+        },
+        "ssh_public_keys": {
+          "description": "SSH public key contents that will be added to each Spark node in this cluster. The\ncorresponding private keys can be used to login with the user name `ubuntu` on port `2200`.\nUp to 10 keys can be specified.",
+          "launch_stage": "GA"
+        },
+        "total_initial_remote_disk_size": {
+          "description": "If set, what the total initial volume size (in GB) of the remote disks should be. Supported for GCP.",
+          "launch_stage": "GA"
+        },
+        "use_ml_runtime": {
+          "description": "This field can only be used when `kind = CLASSIC_PREVIEW`.\n\n`effective_spark_version` is determined by `spark_version` (DBR release), this field `use_ml_runtime`, and whether `node_type_id` is gpu node or not.",
+          "launch_stage": "GA"
+        },
+        "worker_node_type_flexibility": {
+          "description": "Flexible node type configuration for worker nodes.",
+          "ref": "compute.NodeTypeFlexibility",
+          "launch_stage": "GA"
+        },
+        "workload_type": {
+          "ref": "compute.WorkloadType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.UpdateClusterResponse": {},
+    "compute.UpdateResponse": {},
+    "compute.VolumesStorageInfo": {
+      "description": "A storage location back by UC Volumes.",
+      "fields": {
+        "destination": {
+          "description": "UC Volumes destination, e.g. `/Volumes/catalog/schema/vol1/init-scripts/setup-datadog.sh`\nor `dbfs:/Volumes/catalog/schema/vol1/init-scripts/setup-datadog.sh`",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.WorkloadType": {
+      "description": "Cluster Attributes showing for clusters workload types.",
+      "fields": {
+        "clients": {
+          "description": "defined what type of clients can use the cluster. E.g. Notebooks, Jobs",
+          "ref": "compute.ClientsTypes",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "compute.WorkspaceStorageInfo": {
+      "description": "A storage location in Workspace Filesystem (WSFS)",
+      "fields": {
+        "destination": {
+          "description": "wsfs destination, e.g. `workspace:/cluster-init-scripts/setup-datadog.sh`",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dashboards.AuthorizationDetails": {
+      "fields": {
+        "grant_rules": {
+          "description": "Represents downscoped permission rules with specific access rights.\nThis field is specific to `workspace_rule_set` constraint.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "resource_legacy_acl_path": {
+          "description": "The acl path of the tree store resource resource.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "resource_name": {
+          "description": "The resource name to which the authorization rule applies.\nThis field is specific to `workspace_rule_set` constraint.\nFormat: `workspaces/{workspace_id}/dashboards/{dashboard_id}`",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "type": {
+          "description": "The type of authorization downscoping policy.\nEx: `workspace_rule_set` defines access rules for a specific workspace resource",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "dashboards.AuthorizationDetailsGrantRule": {
+      "fields": {
+        "permission_set": {
+          "description": "Permission sets for dashboard are defined in\niam-common/rbac-common/permission-sets/definitions/TreeStoreBasePermissionSets\nEx: `permissionSets/dashboard.runner`",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "dashboards.CreateDashboardRequest": {
+      "fields": {
+        "dashboard": {
+          "ref": "dashboards.Dashboard",
+          "launch_stage": "GA"
+        },
+        "dataset_catalog": {
+          "description": "Sets the default catalog for all datasets in this dashboard.\nDoes not impact table references that use fully qualified catalog names (ex: samples.nyctaxi.trips).\nLeave blank to keep each dataset’s existing configuration.",
+          "launch_stage": "GA"
+        },
+        "dataset_schema": {
+          "description": "Sets the default schema for all datasets in this dashboard.\nDoes not impact table references that use fully qualified schema names (ex: nyctaxi.trips).\nLeave blank to keep each dataset’s existing configuration.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dashboards.CreateScheduleRequest": {
+      "fields": {
+        "schedule": {
+          "description": "The schedule to create. A dashboard is limited to 10 schedules.",
+          "ref": "dashboards.Schedule",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dashboards.CreateSubscriptionRequest": {
+      "fields": {
+        "subscription": {
+          "description": "The subscription to create. A schedule is limited to 100 subscriptions.",
+          "ref": "dashboards.Subscription",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dashboards.CronSchedule": {
+      "fields": {
+        "quartz_cron_expression": {
+          "description": "A cron expression using quartz syntax. EX: `0 0 8 * * ?` represents everyday at 8am.\nSee [Cron Trigger](http://www.quartz-scheduler.org/documentation/quartz-2.3.0/tutorials/crontrigger.html) for details.",
+          "launch_stage": "GA"
+        },
+        "timezone_id": {
+          "description": "A Java timezone id. The schedule will be resolved with respect to this timezone.\nSee [Java TimeZone](https://docs.oracle.com/javase/7/docs/api/java/util/TimeZone.html) for details.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dashboards.Dashboard": {
+      "fields": {
+        "create_time": {
+          "description": "The timestamp of when the dashboard was created.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "dashboard_id": {
+          "description": "UUID identifying the dashboard.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "display_name": {
+          "description": "The display name of the dashboard.",
+          "launch_stage": "GA"
+        },
+        "etag": {
+          "description": "The etag for the dashboard. Can be optionally provided on updates to ensure that the dashboard\nhas not been modified since the last read.\nThis field is excluded in List Dashboards responses.",
+          "launch_stage": "GA"
+        },
+        "lifecycle_state": {
+          "description": "The state of the dashboard resource. Used for tracking trashed status.",
+          "ref": "dashboards.LifecycleState",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "parent_path": {
+          "description": "The workspace path of the folder containing the dashboard. Includes leading slash and no\ntrailing slash.\nThis field is excluded in List Dashboards responses.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "path": {
+          "description": "The workspace path of the dashboard asset, including the file name.\nExported dashboards always have the file extension `.lvdash.json`.\nThis field is excluded in List Dashboards responses.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "serialized_dashboard": {
+          "description": "The contents of the dashboard in serialized string form.\nThis field is excluded in List Dashboards responses.\nUse the [get dashboard API](https://docs.databricks.com/api/workspace/lakeview/get)\nto retrieve an example response, which includes the `serialized_dashboard` field.\nThis field provides the structure of the JSON string that represents the dashboard's\nlayout and components.",
+          "launch_stage": "GA"
+        },
+        "update_time": {
+          "description": "The timestamp of when the dashboard was last updated by the user.\nThis field is excluded in List Dashboards responses.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "warehouse_id": {
+          "description": "The warehouse ID used to run the dashboard.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dashboards.DashboardView": {
+      "enum": [
+        "DASHBOARD_VIEW_BASIC"
+      ],
+      "enum_launch_stages": {
+        "DASHBOARD_VIEW_BASIC": "GA"
+      }
+    },
+    "dashboards.DeleteScheduleRequest": {
+      "fields": {
+        "etag": {
+          "description": "The etag for the schedule. Optionally, it can be provided to verify that the schedule has not\nbeen modified from its last retrieval.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dashboards.DeleteSubscriptionRequest": {
+      "fields": {
+        "etag": {
+          "description": "The etag for the subscription. Can be optionally provided to ensure that the subscription has not been\nmodified since the last read.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dashboards.DownloadMessageAttachmentVisualizationRequest": {},
+    "dashboards.DownloadMessageAttachmentVisualizationResponse": {
+      "fields": {
+        "contents": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dashboards.EvaluationStatusType": {
+      "enum": [
+        "RUNNING",
+        "DONE",
+        "NOT_STARTED",
+        "EVALUATION_FAILED",
+        "EVALUATION_CANCELLED",
+        "EVALUATION_TIMEOUT"
+      ],
+      "enum_launch_stages": {
+        "DONE": "PUBLIC_BETA",
+        "EVALUATION_CANCELLED": "PUBLIC_BETA",
+        "EVALUATION_FAILED": "PUBLIC_BETA",
+        "EVALUATION_TIMEOUT": "PUBLIC_BETA",
+        "NOT_STARTED": "PUBLIC_BETA",
+        "RUNNING": "PUBLIC_BETA"
+      }
+    },
+    "dashboards.GenieAttachment": {
+      "description": "Genie AI Response",
+      "fields": {
+        "attachment_id": {
+          "description": "Attachment ID",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "query": {
+          "description": "Query Attachment if Genie responds with a SQL query",
+          "ref": "dashboards.GenieQueryAttachment",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "suggested_questions": {
+          "description": "Follow-up questions suggested by Genie",
+          "ref": "dashboards.GenieSuggestedQuestionsAttachment",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "text": {
+          "description": "Text Attachment if Genie responds with text\nThis also contains the final summary when available.",
+          "ref": "dashboards.TextAttachment",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "viz": {
+          "description": "Visualization generated by Genie, if requested via `enable_visualization`",
+          "ref": "dashboards.GenieVizAttachment",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "dashboards.GenieCancelResponseRequest": {
+      "description": "Request to cancel an in-flight agent-mode response."
+    },
+    "dashboards.GenieConversation": {
+      "description": "A Genie conversation. Use chat-mode message endpoints for classic chats and agent-mode\nresponse and item endpoints for agent conversations. Conversation management, feedback,\ncomments, and attachment operations support both modes.",
+      "fields": {
+        "conversation_id": {
+          "description": "Conversation ID",
+          "launch_stage": "GA"
+        },
+        "created_timestamp": {
+          "description": "Timestamp when the message was created",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "id": {
+          "description": "Conversation ID.\nLegacy identifier, use conversation_id instead",
+          "deprecated": true,
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "last_updated_timestamp": {
+          "description": "Timestamp when the message was last updated",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "space_id": {
+          "description": "Genie space ID",
+          "launch_stage": "GA"
+        },
+        "title": {
+          "description": "Conversation title",
+          "launch_stage": "GA"
+        },
+        "user_id": {
+          "description": "ID of the user who created the conversation",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "dashboards.GenieConversationSummary": {
+      "fields": {
+        "agent_type": {
+          "description": "Whether this is a classic chat or an agent-mode conversation. Allows callers to\nroute message retrieval (chat vs. agent endpoint) without an extra lookup.",
+          "ref": "dashboards.GenieConversationType",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "conversation_id": {
+          "launch_stage": "GA"
+        },
+        "created_timestamp": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "title": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "dashboards.GenieConversationType": {
+      "description": "The type of a Genie conversation. Distinguishes an agent-mode conversation from\na classic chat conversation so callers can route message retrieval accordingly\nwithout a per-conversation lookup.",
+      "enum": [
+        "GENIE_CONVERSATION_TYPE_CHAT",
+        "GENIE_CONVERSATION_TYPE_AGENT"
+      ],
+      "enum_launch_stages": {
+        "GENIE_CONVERSATION_TYPE_AGENT": "GA",
+        "GENIE_CONVERSATION_TYPE_CHAT": "GA"
+      }
+    },
+    "dashboards.GenieCreateConversationMessageRequest": {
+      "fields": {
+        "content": {
+          "description": "User message content.",
+          "launch_stage": "GA"
+        },
+        "enable_visualization": {
+          "description": "Enable visualization generation.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "dashboards.GenieCreateEvalRunRequest": {
+      "fields": {
+        "benchmark_question_ids": {
+          "description": "List of benchmark question IDs to evaluate. These questions must exist in the specified Genie space. If none are specified, then all benchmark questions are evaluated.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "dashboards.GenieCreateMessageCommentRequest": {
+      "fields": {
+        "content": {
+          "description": "Comment text content.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "dashboards.GenieCreateSpaceRequest": {
+      "fields": {
+        "description": {
+          "description": "Optional description",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "parent_path": {
+          "description": "Parent folder path where the space will be registered",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "serialized_space": {
+          "description": "The contents of the Genie Space in serialized string form.\nUse the [Get Genie Space](:method:genie/getspace) API to retrieve an example response, which includes the `serialized_space` field.\nThis field provides the structure of the JSON string that represents the space's layout and components.",
+          "launch_stage": "GA"
+        },
+        "title": {
+          "description": "Optional title override",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "warehouse_id": {
+          "description": "Warehouse to associate with the new space",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dashboards.GenieDeleteConversationMessageRequest": {},
+    "dashboards.GenieDeleteConversationRequest": {},
+    "dashboards.GenieEvalAssessment": {
+      "enum": [
+        "GOOD",
+        "BAD",
+        "NEEDS_REVIEW"
+      ],
+      "enum_launch_stages": {
+        "BAD": "PUBLIC_BETA",
+        "GOOD": "PUBLIC_BETA",
+        "NEEDS_REVIEW": "PUBLIC_BETA"
+      }
+    },
+    "dashboards.GenieEvalResponse": {
+      "fields": {
+        "response": {
+          "description": "The response content (either text or SQL query).",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "response_type": {
+          "description": "Type of response",
+          "ref": "dashboards.GenieEvalResponseType",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "sql_execution_result": {
+          "description": "SQL Statement Execution response.",
+          "ref": "sql.StatementResponse",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "dashboards.GenieEvalResponseType": {
+      "enum": [
+        "TEXT",
+        "SQL"
+      ],
+      "enum_launch_stages": {
+        "SQL": "PUBLIC_BETA",
+        "TEXT": "PUBLIC_BETA"
+      }
+    },
+    "dashboards.GenieEvalResult": {
+      "description": "Shows summary information for an evaluation result.\nFor detailed information including SQL execution results, actual/expected responses, and assessment scores, use GenieGetEvalResultDetails.",
+      "fields": {
+        "benchmark_answer": {
+          "description": "Stored snapshot of original benchmark answer text.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "benchmark_question_id": {
+          "description": "The ID of the benchmark question that was evaluated.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "created_by_user": {
+          "description": "User ID who created evaluation result.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "question": {
+          "description": "Stored snapshot of original benchmark question text.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "result_id": {
+          "description": "Unique identifier for this evaluation result.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "space_id": {
+          "description": "The ID of the space the evaluation result belongs to.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "status": {
+          "description": "Current status of this evaluation result.",
+          "ref": "dashboards.EvaluationStatusType",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "dashboards.GenieEvalResultDetails": {
+      "description": "Shows detailed information for an evaluation result.",
+      "fields": {
+        "actual_response": {
+          "description": "The actual response generated by Genie.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "assessment": {
+          "description": "Assessment of the evaluation result: good, bad, or needs review",
+          "ref": "dashboards.GenieEvalAssessment",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "assessment_reasons": {
+          "description": "Reasons for the assessment score.\n\nAssessment reasons describe why a Genie response was scored as BAD.\n\nDeterministic values (compared against the ground truth result):\n- EMPTY_RESULT: Genie's generated SQL results were empty for this benchmark question.\n- RESULT_MISSING_ROWS: Genie's generated SQL response is missing rows from the provided ground truth SQL.\n- RESULT_EXTRA_ROWS: Genie's generated SQL response has more rows than the provided ground truth SQL.\n- RESULT_MISSING_COLUMNS: Genie's generated SQL response is missing columns from the provided ground truth SQL.\n- RESULT_EXTRA_COLUMNS: Genie's generated SQL response has more columns than the provided ground truth SQL.\n- SINGLE_CELL_DIFFERENCE: Single value result was produced but differs from ground truth result.\n- EMPTY_GOOD_SQL: The benchmark SQL returned an empty result.\n- COLUMN_TYPE_DIFFERENCE: The values between the results match but the column type is different.\n\nLLM judge ratings explain the factors driving BAD results:\n- LLM_JUDGE_MISSING_OR_INCORRECT_FILTER: Genie's generated SQL is missing a WHERE clause condition or has incorrect filter logic that excludes/includes wrong data.\n- LLM_JUDGE_INCOMPLETE_OR_PARTIAL_OUTPUT: Genie's generated SQL returns only some of the requested data or columns, missing parts of what the ground truth SQL returns.\n- LLM_JUDGE_MISINTERPRETATION_OF_USER_REQUEST: Genie's generated SQL fundamentally misunderstands what the user is asking for, addressing the wrong question or goal.\n- LLM_JUDGE_INSTRUCTION_COMPLIANCE_OR_MISSING_BUSINESS_LOGIC: Genie's generated SQL fails to apply specified instructions or business logic that should be followed.\n- LLM_JUDGE_INCORRECT_METRIC_CALCULATION: Genie's generated SQL uses incorrect logic or makes wrong assumptions when calculating metrics.\n- LLM_JUDGE_INCORRECT_TABLE_OR_FIELD_USAGE: Genie's generated SQL references wrong tables, columns, or uses fields that don't match the ground truth SQL's intent.\n- LLM_JUDGE_INCORRECT_FUNCTION_USAGE: Genie's generated SQL uses SQL functions incorrectly or inappropriately (wrong parameters, wrong function for the task, etc.).\n- LLM_JUDGE_MISSING_OR_INCORRECT_JOIN: Genie's generated SQL is missing necessary joins between tables or has incorrect join conditions/types that produce wrong results.\n- LLM_JUDGE_MISSING_OR_INCORRECT_AGGREGATION: Genie's generated SQL is missing GROUP BY clauses or has incorrect grouping that doesn't match the requested aggregation level.\n- LLM_JUDGE_FORMATTING_ERROR: Genie's generated SQL output has incorrect formatting, ordering (ORDER BY), or presentation issues that don't match expectations.\n- LLM_JUDGE_OTHER: LLM judge identified an error that doesn't fall into other categories.\n\nDeprecated LLM judge values (kept for backward compatibility, do not use):\n- LLM_JUDGE_MISSING_JOIN (deprecated)\n- LLM_JUDGE_WRONG_FILTER (deprecated)\n- LLM_JUDGE_WRONG_AGGREGATION (deprecated)\n- LLM_JUDGE_WRONG_COLUMNS (deprecated)\n- LLM_JUDGE_SYNTAX_ERROR (deprecated)\n- LLM_JUDGE_SEMANTIC_ERROR (deprecated)",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "benchmark_question_id": {
+          "description": "The ID of the benchmark question that was evaluated.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "eval_run_status": {
+          "description": "Current status of the evaluation run.",
+          "ref": "dashboards.EvaluationStatusType",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "expected_response": {
+          "description": "The expected responses from the benchmark.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "manual_assessment": {
+          "description": "Whether this evaluation was manually assessed.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "result_id": {
+          "description": "The unique identifier for the evaluation result.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "space_id": {
+          "description": "The ID of the space the evaluation result belongs to.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "dashboards.GenieEvalRunResponse": {
+      "description": "A benchmark evaluation run. The public benchmark API currently evaluates chat-mode responses.",
+      "fields": {
+        "created_timestamp": {
+          "description": "Timestamp when the evaluation run was created (milliseconds since epoch).",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "eval_run_id": {
+          "description": "The unique identifier for the evaluation run.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "eval_run_status": {
+          "description": "Current status of the evaluation run.",
+          "ref": "dashboards.EvaluationStatusType",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "last_updated_timestamp": {
+          "description": "Timestamp when the evaluation run was last updated (milliseconds since epoch).",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "num_correct": {
+          "description": "Number of questions answered correctly.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "num_done": {
+          "description": "Number of questions that have been completed.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "num_needs_review": {
+          "description": "Number of questions that need manual review.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "num_questions": {
+          "description": "Total number of questions in the evaluation run.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "run_by_user": {
+          "description": "User ID who initiated the evaluation run.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "dashboards.GenieExecuteMessageAttachmentQueryRequest": {},
+    "dashboards.GenieExecuteMessageQueryRequest": {},
+    "dashboards.GenieFeedback": {
+      "description": "Feedback containing rating and optional comment",
+      "fields": {
+        "comment": {
+          "description": "Optional feedback comment text",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "rating": {
+          "description": "The feedback rating",
+          "ref": "dashboards.GenieFeedbackRating",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "dashboards.GenieFeedbackRating": {
+      "description": "Feedback rating for Genie messages",
+      "enum": [
+        "POSITIVE",
+        "NEGATIVE",
+        "NONE"
+      ],
+      "enum_launch_stages": {
+        "NEGATIVE": "GA",
+        "NONE": "GA",
+        "POSITIVE": "GA"
+      }
+    },
+    "dashboards.GenieGenerateDownloadFullQueryResultRequest": {},
+    "dashboards.GenieGenerateDownloadFullQueryResultResponse": {
+      "fields": {
+        "download_id": {
+          "description": "Download ID. Use this ID to track the download request in subsequent polling calls",
+          "launch_stage": "GA"
+        },
+        "download_id_signature": {
+          "description": "JWT signature for the download_id to ensure secure access to query results",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dashboards.GenieGetConversationMessageRequest": {},
+    "dashboards.GenieGetDownloadFullQueryResultRequest": {
+      "fields": {
+        "download_id_signature": {
+          "description": "JWT signature for the download_id to ensure secure access to query results",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dashboards.GenieGetDownloadFullQueryResultResponse": {
+      "fields": {
+        "statement_response": {
+          "description": "SQL Statement Execution response. See [Get status, manifest, and result first chunk](:method:statementexecution/getstatement) for more details.",
+          "ref": "sql.StatementResponse",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dashboards.GenieGetEvalResultDetailsRequest": {},
+    "dashboards.GenieGetEvalRunRequest": {},
+    "dashboards.GenieGetMessageAttachmentQueryResultRequest": {},
+    "dashboards.GenieGetMessageQueryResultRequest": {},
+    "dashboards.GenieGetMessageQueryResultResponse": {
+      "fields": {
+        "statement_response": {
+          "description": "SQL Statement Execution response. See [Get status, manifest, and result first chunk](:method:statementexecution/getstatement) for more details.",
+          "ref": "sql.StatementResponse",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dashboards.GenieGetQueryResultByAttachmentRequest": {},
+    "dashboards.GenieGetSpaceRequest": {
+      "fields": {
+        "include_serialized_space": {
+          "description": "Whether to include the serialized space export in the response.\nRequires at least CAN EDIT permission on the space.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "dashboards.GenieListConversationCommentsRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Maximum number of comments to return per page.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Pagination token for getting the next page of results.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "dashboards.GenieListConversationCommentsResponse": {
+      "fields": {
+        "comments": {
+          "description": "List of comments in the conversation.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "next_page_token": {
+          "description": "Token to get the next page of results.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "dashboards.GenieListConversationMessagesRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Maximum number of messages to return per page",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Token to get the next page of results",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "dashboards.GenieListConversationMessagesResponse": {
+      "fields": {
+        "messages": {
+          "description": "List of messages in the conversation.",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "The token to use for retrieving the next page of results.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dashboards.GenieListConversationsRequest": {
+      "fields": {
+        "include_all": {
+          "description": "Include all conversations in the space across all users.\nRequires at least CAN MANAGE permission on the space.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_size": {
+          "description": "Maximum number of conversations to return per page",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Token to get the next page of results",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "dashboards.GenieListConversationsResponse": {
+      "fields": {
+        "conversations": {
+          "description": "List of conversations in the Genie space",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "Token to get the next page of results",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dashboards.GenieListEvalResultsRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Maximum number of eval results to return per page.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Opaque token to retrieve the next page of results.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "dashboards.GenieListEvalResultsResponse": {
+      "fields": {
+        "eval_results": {
+          "description": "List of evaluation results for the specified run.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "next_page_token": {
+          "description": "The token to use for retrieving the next page of results.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "dashboards.GenieListEvalRunsRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Maximum number of evaluation runs to return per page",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Token to get the next page of results",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "dashboards.GenieListEvalRunsResponse": {
+      "fields": {
+        "eval_runs": {
+          "description": "List of evaluation runs for a space on provided page token and page size",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "next_page_token": {
+          "description": "The token to use for retrieving the next page of results.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "dashboards.GenieListMessageCommentsRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Maximum number of comments to return per page.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Pagination token for getting the next page of results.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "dashboards.GenieListMessageCommentsResponse": {
+      "fields": {
+        "comments": {
+          "description": "List of comments on the message.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "next_page_token": {
+          "description": "Token to get the next page of results.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "dashboards.GenieListSpacesRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Maximum number of spaces to return per page",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Pagination token for getting the next page of results",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "dashboards.GenieListSpacesResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "Token to get the next page of results",
+          "launch_stage": "GA"
+        },
+        "spaces": {
+          "description": "List of Genie spaces",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dashboards.GenieMessage": {
+      "fields": {
+        "attachments": {
+          "description": "AI-generated response to the message",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "content": {
+          "description": "User message content",
+          "launch_stage": "GA"
+        },
+        "conversation_id": {
+          "description": "Conversation ID",
+          "launch_stage": "GA"
+        },
+        "created_timestamp": {
+          "description": "Timestamp when the message was created",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "error": {
+          "description": "Error message if Genie failed to respond to the message",
+          "ref": "dashboards.MessageError",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "feedback": {
+          "description": "User feedback for the message if provided",
+          "ref": "dashboards.GenieFeedback",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "id": {
+          "description": "Message ID.\nLegacy identifier, use message_id instead",
+          "deprecated": true,
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "last_updated_timestamp": {
+          "description": "Timestamp when the message was last updated",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "message_id": {
+          "description": "Message ID",
+          "launch_stage": "GA"
+        },
+        "query_result": {
+          "description": "The result of SQL query if the message includes a query attachment.\nDeprecated. Use `query_result_metadata` in `GenieQueryAttachment` instead.",
+          "ref": "dashboards.Result",
+          "deprecated": true,
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "space_id": {
+          "description": "Genie space ID",
+          "launch_stage": "GA"
+        },
+        "status": {
+          "ref": "dashboards.MessageStatus",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "user_id": {
+          "description": "ID of the user who created the message",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "dashboards.GenieMessageComment": {
+      "description": "A comment on a Genie conversation message.",
+      "fields": {
+        "content": {
+          "description": "Comment text content",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "conversation_id": {
+          "description": "Conversation ID",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "created_timestamp": {
+          "description": "Timestamp when the comment was created",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "message_comment_id": {
+          "description": "Comment ID",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "message_id": {
+          "description": "Message ID",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "space_id": {
+          "description": "Genie space ID",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "user_id": {
+          "description": "ID of the user who created the comment",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "dashboards.GenieQueryAttachment": {
+      "fields": {
+        "description": {
+          "description": "Description of the query",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "id": {
+          "deprecated": true,
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "last_updated_timestamp": {
+          "description": "Time when the user updated the query last",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "parameters": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "query": {
+          "description": "AI generated SQL query",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "query_result_metadata": {
+          "description": "Metadata associated with the query result.",
+          "ref": "dashboards.GenieResultMetadata",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "statement_id": {
+          "description": "Statement Execution API statement id. Use [Get status, manifest, and result first chunk](:method:statementexecution/getstatement) to get the full result data.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "thoughts": {
+          "description": "Insights into how Genie came to generate the SQL.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "title": {
+          "description": "Name of the query",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "dashboards.GenieResultMetadata": {
+      "fields": {
+        "is_truncated": {
+          "description": "Indicates whether the result set is truncated.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "row_count": {
+          "description": "The number of rows in the result set.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "dashboards.GenieSendMessageFeedbackRequest": {
+      "fields": {
+        "comment": {
+          "description": "Optional text feedback that will be stored as a comment.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "rating": {
+          "description": "The rating (POSITIVE, NEGATIVE, or NONE).",
+          "ref": "dashboards.GenieFeedbackRating",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dashboards.GenieSpace": {
+      "fields": {
+        "create_time": {
+          "description": "Time when the Genie space was created.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "description": {
+          "description": "Description of the Genie Space",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "etag": {
+          "description": "ETag for this space. Pass this value back in the update request to prevent overwriting\nconcurrent changes.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "parent_path": {
+          "description": "Parent folder path of the Genie Space",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "serialized_space": {
+          "description": "The contents of the Genie Space in serialized string form.\nThis field is excluded in List Genie spaces responses.\nUse the [Get Genie Space](:method:genie/getspace) API to retrieve an example response, which includes the `serialized_space` field.\nThis field provides the structure of the JSON string that represents the space's layout and components.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "space_id": {
+          "description": "Genie space ID",
+          "launch_stage": "GA"
+        },
+        "title": {
+          "description": "Title of the Genie Space",
+          "launch_stage": "GA"
+        },
+        "update_time": {
+          "description": "Time when the Genie space was last modified, matching the value shown in the Genie Agent UI.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "warehouse_id": {
+          "description": "Warehouse associated with the Genie Space",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "dashboards.GenieStartConversationMessageRequest": {
+      "fields": {
+        "content": {
+          "description": "The text of the message that starts the conversation.",
+          "launch_stage": "GA"
+        },
+        "enable_visualization": {
+          "description": "Enable visualization generation.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "dashboards.GenieStartConversationResponse": {
+      "fields": {
+        "conversation": {
+          "ref": "dashboards.GenieConversation",
+          "launch_stage": "GA"
+        },
+        "conversation_id": {
+          "description": "Conversation ID",
+          "launch_stage": "GA"
+        },
+        "message": {
+          "ref": "dashboards.GenieMessage",
+          "launch_stage": "GA"
+        },
+        "message_id": {
+          "description": "Message ID",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dashboards.GenieSuggestedQuestionsAttachment": {
+      "description": "Follow-up questions suggested by Genie",
+      "fields": {
+        "questions": {
+          "description": "The suggested follow-up questions",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "dashboards.GenieTrashSpaceRequest": {},
+    "dashboards.GenieUpdateSpaceRequest": {
+      "fields": {
+        "description": {
+          "description": "Optional description",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "etag": {
+          "description": "ETag returned by a previous GET or UPDATE. When set, the update will fail if the space\nhas been modified since. Omit to apply the update unconditionally.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "parent_path": {
+          "description": "Parent workspace folder path to move this Genie space under.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "serialized_space": {
+          "description": "The contents of the Genie Space in serialized string form (full replacement).\nUse the [Get Genie Space](:method:genie/getspace) API to retrieve an example response, which includes the `serialized_space` field.\nThis field provides the structure of the JSON string that represents the space's layout and components.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "title": {
+          "description": "Optional title override",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "warehouse_id": {
+          "description": "Optional warehouse override",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "dashboards.GenieVizAttachment": {
+      "description": "Visualization generated by Genie for a query result. Use the attachment ID\nwith the download visualization API to retrieve the rendered image.",
+      "fields": {
+        "query_attachment_id": {
+          "description": "The ID of the query attachment the visualization was generated from",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "title": {
+          "description": "Name of the visualization",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "dashboards.GetDashboardRequest": {},
+    "dashboards.GetPublishedDashboardRequest": {},
+    "dashboards.GetPublishedDashboardTokenInfoRequest": {
+      "fields": {
+        "external_value": {
+          "description": "Provided external value to be included in the custom claim.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "external_viewer_id": {
+          "description": "Provided external viewer id to be included in the custom claim.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "dashboards.GetPublishedDashboardTokenInfoResponse": {
+      "fields": {
+        "authorization_details": {
+          "description": "Authorization constraints for accessing the published dashboard.\nCurrently includes `workspace_rule_set` and could be enriched with `unity_catalog_privileges` before\noAuth token generation.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "custom_claim": {
+          "description": "Custom claim generated from external_value and external_viewer_id.\nFormat: `urn:aibi:external_data:\u003cexternal_value\u003e:\u003cexternal_viewer_id\u003e:\u003cdashboard_id\u003e`",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "scope": {
+          "description": "Scope defining access permissions.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "dashboards.GetScheduleRequest": {},
+    "dashboards.GetSubscriptionRequest": {},
+    "dashboards.LifecycleState": {
+      "enum": [
+        "ACTIVE",
+        "TRASHED"
+      ],
+      "enum_launch_stages": {
+        "ACTIVE": "GA",
+        "TRASHED": "GA"
+      }
+    },
+    "dashboards.ListDashboardsRequest": {
+      "fields": {
+        "page_size": {
+          "description": "The number of dashboards to return per page.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "A page token, received from a previous `ListDashboards` call.\nThis token can be used to retrieve the subsequent page.",
+          "launch_stage": "GA"
+        },
+        "show_trashed": {
+          "description": "The flag to include dashboards located in the trash.\nIf unspecified, only active dashboards will be returned.",
+          "launch_stage": "GA"
+        },
+        "view": {
+          "description": "`DASHBOARD_VIEW_BASIC` only includes summary metadata from the dashboard.",
+          "ref": "dashboards.DashboardView",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dashboards.ListDashboardsResponse": {
+      "fields": {
+        "dashboards": {
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "A token, which can be sent as `page_token` to retrieve the next page.\nIf this field is omitted, there are no subsequent dashboards.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dashboards.ListSchedulesRequest": {
+      "fields": {
+        "page_size": {
+          "description": "The number of schedules to return per page.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "A page token, received from a previous `ListSchedules` call.\nUse this to retrieve the subsequent page.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dashboards.ListSchedulesResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "A token that can be used as a `page_token` in subsequent requests to retrieve the next page of results.\nIf this field is omitted, there are no subsequent schedules.",
+          "launch_stage": "GA"
+        },
+        "schedules": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dashboards.ListSubscriptionsRequest": {
+      "fields": {
+        "page_size": {
+          "description": "The number of subscriptions to return per page.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "A page token, received from a previous `ListSubscriptions` call.\nUse this to retrieve the subsequent page.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dashboards.ListSubscriptionsResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "A token that can be used as a `page_token` in subsequent requests to retrieve the next page of results.\nIf this field is omitted, there are no subsequent subscriptions.",
+          "launch_stage": "GA"
+        },
+        "subscriptions": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dashboards.MessageError": {
+      "fields": {
+        "error": {
+          "launch_stage": "GA"
+        },
+        "type": {
+          "ref": "dashboards.MessageErrorType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dashboards.MessageErrorType": {
+      "enum": [
+        "UNEXPECTED_REPLY_PROCESS_EXCEPTION",
+        "GENERIC_CHAT_COMPLETION_EXCEPTION",
+        "CONTEXT_EXCEEDED_EXCEPTION",
+        "DEPLOYMENT_NOT_FOUND_EXCEPTION",
+        "FUNCTIONS_NOT_AVAILABLE_EXCEPTION",
+        "INVALID_COMPLETION_REQUEST_EXCEPTION",
+        "CONTENT_FILTER_EXCEPTION",
+        "FUNCTION_ARGUMENTS_INVALID_JSON_EXCEPTION",
+        "RETRYABLE_PROCESSING_EXCEPTION",
+        "INVALID_FUNCTION_CALL_EXCEPTION",
+        "LOCAL_CONTEXT_EXCEEDED_EXCEPTION",
+        "CHAT_COMPLETION_NETWORK_EXCEPTION",
+        "INVALID_CHAT_COMPLETION_JSON_EXCEPTION",
+        "GENERIC_CHAT_COMPLETION_SERVICE_EXCEPTION",
+        "WAREHOUSE_ACCESS_MISSING_EXCEPTION",
+        "WAREHOUSE_NOT_FOUND_EXCEPTION",
+        "NO_TABLES_TO_QUERY_EXCEPTION",
+        "SQL_EXECUTION_EXCEPTION",
+        "REPLY_PROCESS_TIMEOUT_EXCEPTION",
+        "COULD_NOT_GET_UC_SCHEMA_EXCEPTION",
+        "INVALID_TABLE_IDENTIFIER_EXCEPTION",
+        "TOO_MANY_TABLES_EXCEPTION",
+        "FUNCTION_ARGUMENTS_INVALID_EXCEPTION",
+        "GENERIC_SQL_EXEC_API_CALL_EXCEPTION",
+        "CHAT_COMPLETION_CLIENT_EXCEPTION",
+        "CHAT_COMPLETION_CLIENT_TIMEOUT_EXCEPTION",
+        "UNKNOWN_AI_MODEL",
+        "TABLES_MISSING_EXCEPTION",
+        "MESSAGE_DELETED_WHILE_EXECUTING_EXCEPTION",
+        "MESSAGE_UPDATED_WHILE_EXECUTING_EXCEPTION",
+        "BLOCK_MULTIPLE_EXECUTIONS_EXCEPTION",
+        "INVALID_CERTIFIED_ANSWER_IDENTIFIER_EXCEPTION",
+        "TOO_MANY_CERTIFIED_ANSWERS_EXCEPTION",
+        "RATE_LIMIT_EXCEEDED_GENERIC_EXCEPTION",
+        "RATE_LIMIT_EXCEEDED_SPECIFIED_WAIT_EXCEPTION",
+        "FUNCTION_CALL_MISSING_PARAMETER_EXCEPTION",
+        "INVALID_CERTIFIED_ANSWER_FUNCTION_EXCEPTION",
+        "ILLEGAL_PARAMETER_DEFINITION_EXCEPTION",
+        "NO_QUERY_TO_VISUALIZE_EXCEPTION",
+        "NO_DEPLOYMENTS_AVAILABLE_TO_WORKSPACE",
+        "STOP_PROCESS_DUE_TO_AUTO_REGENERATE",
+        "FUNCTION_ARGUMENTS_INVALID_TYPE_EXCEPTION",
+        "MESSAGE_CANCELLED_WHILE_EXECUTING_EXCEPTION",
+        "COULD_NOT_GET_MODEL_DEPLOYMENTS_EXCEPTION",
+        "GENERATED_SQL_QUERY_TOO_LONG_EXCEPTION",
+        "MISSING_SQL_QUERY_EXCEPTION",
+        "DESCRIBE_QUERY_UNEXPECTED_FAILURE",
+        "DESCRIBE_QUERY_TIMEOUT",
+        "DESCRIBE_QUERY_INVALID_SQL_ERROR",
+        "INVALID_SQL_UNKNOWN_TABLE_EXCEPTION",
+        "INVALID_SQL_MULTIPLE_STATEMENTS_EXCEPTION",
+        "INVALID_SQL_MULTIPLE_DATASET_REFERENCES_EXCEPTION",
+        "MESSAGE_ATTACHMENT_TOO_LONG_ERROR",
+        "INTERNAL_CATALOG_PATH_OVERLAP_EXCEPTION",
+        "INTERNAL_CATALOG_MISSING_UC_PATH_EXCEPTION",
+        "EXCEEDED_MAX_TOKEN_LENGTH_EXCEPTION",
+        "INTERNAL_CATALOG_ASSET_CREATION_ONGOING_EXCEPTION",
+        "INTERNAL_CATALOG_ASSET_CREATION_FAILED_EXCEPTION",
+        "INTERNAL_CATALOG_ASSET_CREATION_UNSUPPORTED_EXCEPTION",
+        "UNSUPPORTED_CONVERSATION_TYPE_EXCEPTION",
+        "COULD_NOT_GET_DASHBOARD_SCHEMA_EXCEPTION"
+      ],
+      "enum_launch_stages": {
+        "BLOCK_MULTIPLE_EXECUTIONS_EXCEPTION": "GA",
+        "CHAT_COMPLETION_CLIENT_EXCEPTION": "GA",
+        "CHAT_COMPLETION_CLIENT_TIMEOUT_EXCEPTION": "GA",
+        "CHAT_COMPLETION_NETWORK_EXCEPTION": "GA",
+        "CONTENT_FILTER_EXCEPTION": "GA",
+        "CONTEXT_EXCEEDED_EXCEPTION": "GA",
+        "COULD_NOT_GET_DASHBOARD_SCHEMA_EXCEPTION": "GA",
+        "COULD_NOT_GET_MODEL_DEPLOYMENTS_EXCEPTION": "GA",
+        "COULD_NOT_GET_UC_SCHEMA_EXCEPTION": "GA",
+        "DEPLOYMENT_NOT_FOUND_EXCEPTION": "GA",
+        "DESCRIBE_QUERY_INVALID_SQL_ERROR": "GA",
+        "DESCRIBE_QUERY_TIMEOUT": "GA",
+        "DESCRIBE_QUERY_UNEXPECTED_FAILURE": "GA",
+        "EXCEEDED_MAX_TOKEN_LENGTH_EXCEPTION": "GA",
+        "FUNCTIONS_NOT_AVAILABLE_EXCEPTION": "GA",
+        "FUNCTION_ARGUMENTS_INVALID_EXCEPTION": "GA",
+        "FUNCTION_ARGUMENTS_INVALID_JSON_EXCEPTION": "GA",
+        "FUNCTION_ARGUMENTS_INVALID_TYPE_EXCEPTION": "GA",
+        "FUNCTION_CALL_MISSING_PARAMETER_EXCEPTION": "GA",
+        "GENERATED_SQL_QUERY_TOO_LONG_EXCEPTION": "GA",
+        "GENERIC_CHAT_COMPLETION_EXCEPTION": "GA",
+        "GENERIC_CHAT_COMPLETION_SERVICE_EXCEPTION": "GA",
+        "GENERIC_SQL_EXEC_API_CALL_EXCEPTION": "GA",
+        "ILLEGAL_PARAMETER_DEFINITION_EXCEPTION": "GA",
+        "INTERNAL_CATALOG_ASSET_CREATION_FAILED_EXCEPTION": "GA",
+        "INTERNAL_CATALOG_ASSET_CREATION_ONGOING_EXCEPTION": "GA",
+        "INTERNAL_CATALOG_ASSET_CREATION_UNSUPPORTED_EXCEPTION": "GA",
+        "INTERNAL_CATALOG_MISSING_UC_PATH_EXCEPTION": "GA",
+        "INTERNAL_CATALOG_PATH_OVERLAP_EXCEPTION": "GA",
+        "INVALID_CERTIFIED_ANSWER_FUNCTION_EXCEPTION": "GA",
+        "INVALID_CERTIFIED_ANSWER_IDENTIFIER_EXCEPTION": "GA",
+        "INVALID_CHAT_COMPLETION_JSON_EXCEPTION": "GA",
+        "INVALID_COMPLETION_REQUEST_EXCEPTION": "GA",
+        "INVALID_FUNCTION_CALL_EXCEPTION": "GA",
+        "INVALID_SQL_MULTIPLE_DATASET_REFERENCES_EXCEPTION": "GA",
+        "INVALID_SQL_MULTIPLE_STATEMENTS_EXCEPTION": "GA",
+        "INVALID_SQL_UNKNOWN_TABLE_EXCEPTION": "GA",
+        "INVALID_TABLE_IDENTIFIER_EXCEPTION": "GA",
+        "LOCAL_CONTEXT_EXCEEDED_EXCEPTION": "GA",
+        "MESSAGE_ATTACHMENT_TOO_LONG_ERROR": "GA",
+        "MESSAGE_CANCELLED_WHILE_EXECUTING_EXCEPTION": "GA",
+        "MESSAGE_DELETED_WHILE_EXECUTING_EXCEPTION": "GA",
+        "MESSAGE_UPDATED_WHILE_EXECUTING_EXCEPTION": "GA",
+        "MISSING_SQL_QUERY_EXCEPTION": "GA",
+        "NO_DEPLOYMENTS_AVAILABLE_TO_WORKSPACE": "GA",
+        "NO_QUERY_TO_VISUALIZE_EXCEPTION": "GA",
+        "NO_TABLES_TO_QUERY_EXCEPTION": "GA",
+        "RATE_LIMIT_EXCEEDED_GENERIC_EXCEPTION": "GA",
+        "RATE_LIMIT_EXCEEDED_SPECIFIED_WAIT_EXCEPTION": "GA",
+        "REPLY_PROCESS_TIMEOUT_EXCEPTION": "GA",
+        "RETRYABLE_PROCESSING_EXCEPTION": "GA",
+        "SQL_EXECUTION_EXCEPTION": "GA",
+        "STOP_PROCESS_DUE_TO_AUTO_REGENERATE": "GA",
+        "TABLES_MISSING_EXCEPTION": "GA",
+        "TOO_MANY_CERTIFIED_ANSWERS_EXCEPTION": "GA",
+        "TOO_MANY_TABLES_EXCEPTION": "GA",
+        "UNEXPECTED_REPLY_PROCESS_EXCEPTION": "GA",
+        "UNKNOWN_AI_MODEL": "GA",
+        "UNSUPPORTED_CONVERSATION_TYPE_EXCEPTION": "GA",
+        "WAREHOUSE_ACCESS_MISSING_EXCEPTION": "GA",
+        "WAREHOUSE_NOT_FOUND_EXCEPTION": "GA"
+      }
+    },
+    "dashboards.MessageStatus": {
+      "description": "MessageStatus.\nThe possible values are:\n* `FETCHING_METADATA`: Fetching metadata from the data sources.\n* `FILTERING_CONTEXT`: Running smart context step to determine relevant context.\n* `ASKING_AI`: Waiting for the LLM to respond to the user's question.\n* `PENDING_WAREHOUSE`: Waiting for warehouse before the SQL query can start executing.\n* `EXECUTING_QUERY`: Executing a generated SQL query. Get the SQL query result by calling [getMessageAttachmentQueryResult](:method:genie/getMessageAttachmentQueryResult) API.\n* `FAILED`: The response generation or query execution failed. See `error` field.\n* `COMPLETED`: Message processing is completed. Results are in the `attachments` field. Get the SQL query result by calling [getMessageAttachmentQueryResult](:method:genie/getMessageAttachmentQueryResult) API.\n* `SUBMITTED`: Message has been submitted.\n* `QUERY_RESULT_EXPIRED`: SQL result is not available anymore. The user needs to rerun the query. Rerun the SQL query result by calling [executeMessageAttachmentQuery](:method:genie/executeMessageAttachmentQuery) API.\n* `CANCELLED`: Message has been cancelled.",
+      "enum": [
+        "FETCHING_METADATA",
+        "FILTERING_CONTEXT",
+        "ASKING_AI",
+        "PENDING_WAREHOUSE",
+        "EXECUTING_QUERY",
+        "FAILED",
+        "COMPLETED",
+        "SUBMITTED",
+        "QUERY_RESULT_EXPIRED",
+        "CANCELLED"
+      ],
+      "enum_launch_stages": {
+        "ASKING_AI": "GA",
+        "CANCELLED": "GA",
+        "COMPLETED": "GA",
+        "EXECUTING_QUERY": "GA",
+        "FAILED": "GA",
+        "FETCHING_METADATA": "GA",
+        "FILTERING_CONTEXT": "GA",
+        "PENDING_WAREHOUSE": "GA",
+        "QUERY_RESULT_EXPIRED": "GA",
+        "SUBMITTED": "GA"
+      },
+      "enum_descriptions": {
+        "ASKING_AI": "Waiting for the LLM to respond to the user's question.",
+        "CANCELLED": "Message has been cancelled.",
+        "COMPLETED": "Message processing is completed. Results are in the `attachments` field. Get the SQL query result by calling [getMessageAttachmentQueryResult](:method:genie/getMessageAttachmentQueryResult) API.",
+        "EXECUTING_QUERY": "Executing a generated SQL query. Get the SQL query result by calling [getMessageAttachmentQueryResult](:method:genie/getMessageAttachmentQueryResult) API.",
+        "FAILED": "The response generation or query execution failed. See `error` field.",
+        "FETCHING_METADATA": "Fetching metadata from the data sources.",
+        "FILTERING_CONTEXT": "Running smart context step to determine relevant context.",
+        "PENDING_WAREHOUSE": "Waiting for warehouse before the SQL query can start executing.",
+        "QUERY_RESULT_EXPIRED": "SQL result is not available anymore. The user needs to rerun the query. Rerun the SQL query result by calling [executeMessageAttachmentQuery](:method:genie/executeMessageAttachmentQuery) API.",
+        "SUBMITTED": "Message has been submitted."
+      }
+    },
+    "dashboards.MigrateDashboardRequest": {
+      "fields": {
+        "display_name": {
+          "description": "Display name for the new Lakeview dashboard.",
+          "launch_stage": "GA"
+        },
+        "parent_path": {
+          "description": "The workspace path of the folder to contain the migrated Lakeview dashboard.",
+          "launch_stage": "GA"
+        },
+        "source_dashboard_id": {
+          "description": "UUID of the dashboard to be migrated.",
+          "launch_stage": "GA"
+        },
+        "update_parameter_syntax": {
+          "description": "Flag to indicate if mustache parameter syntax ({{ param }}) should be auto-updated\nto named syntax (:param) when converting datasets in the dashboard.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dashboards.PublishRequest": {
+      "fields": {
+        "embed_credentials": {
+          "description": "Flag to indicate if the publisher's credentials should be embedded in the\npublished dashboard. These embedded credentials will be used to execute the\npublished dashboard's queries.",
+          "launch_stage": "GA"
+        },
+        "warehouse_id": {
+          "description": "The ID of the warehouse that can be used to override the warehouse which\nwas set in the draft.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dashboards.PublishedDashboard": {
+      "fields": {
+        "display_name": {
+          "description": "The display name of the published dashboard.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "embed_credentials": {
+          "description": "Indicates whether credentials are embedded in the published dashboard.",
+          "launch_stage": "GA"
+        },
+        "revision_create_time": {
+          "description": "The timestamp of when the published dashboard was last revised.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "warehouse_id": {
+          "description": "The warehouse ID used to run the published dashboard.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dashboards.QueryAttachmentParameter": {
+      "fields": {
+        "keyword": {
+          "launch_stage": "GA"
+        },
+        "sql_type": {
+          "launch_stage": "GA"
+        },
+        "value": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dashboards.Result": {
+      "fields": {
+        "is_truncated": {
+          "description": "If result is truncated",
+          "launch_stage": "GA"
+        },
+        "row_count": {
+          "description": "Row count of the result",
+          "launch_stage": "GA"
+        },
+        "statement_id": {
+          "description": "Statement Execution API statement id. Use [Get status, manifest, and result first chunk](:method:statementexecution/getstatement) to get the full result data.",
+          "launch_stage": "GA"
+        },
+        "statement_id_signature": {
+          "description": "JWT corresponding to the statement contained in this result",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dashboards.RevertDashboardRequest": {
+      "description": "Request to revert a dashboard draft to its last published state.",
+      "fields": {
+        "etag": {
+          "description": "The etag for the dashboard. Optionally, it can be provided to verify that the dashboard\nhas not been modified from its last retrieval.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dashboards.RevertDashboardResponse": {
+      "description": "Response to revert a dashboard draft to its last published state.",
+      "fields": {
+        "dashboard": {
+          "description": "The reverted dashboard.",
+          "ref": "dashboards.Dashboard",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dashboards.Schedule": {
+      "fields": {
+        "create_time": {
+          "description": "A timestamp indicating when the schedule was created.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "cron_schedule": {
+          "description": "The cron expression describing the frequency of the periodic refresh for this schedule.",
+          "ref": "dashboards.CronSchedule",
+          "launch_stage": "GA"
+        },
+        "dashboard_id": {
+          "description": "UUID identifying the dashboard to which the schedule belongs.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "display_name": {
+          "description": "The display name for schedule.",
+          "launch_stage": "GA"
+        },
+        "etag": {
+          "description": "The etag for the schedule. Must be left empty on create, must be provided on updates to ensure\nthat the schedule has not been modified since the last read, and can be optionally provided on delete.",
+          "launch_stage": "GA"
+        },
+        "pause_status": {
+          "description": "The status indicates whether this schedule is paused or not.",
+          "ref": "dashboards.SchedulePauseStatus",
+          "launch_stage": "GA"
+        },
+        "schedule_id": {
+          "description": "UUID identifying the schedule.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "update_time": {
+          "description": "A timestamp indicating when the schedule was last updated.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "warehouse_id": {
+          "description": "The warehouse id to run the dashboard with for the schedule.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dashboards.SchedulePauseStatus": {
+      "enum": [
+        "UNPAUSED",
+        "PAUSED"
+      ],
+      "enum_launch_stages": {
+        "PAUSED": "GA",
+        "UNPAUSED": "GA"
+      }
+    },
+    "dashboards.ScoreReason": {
+      "enum": [
+        "EMPTY_RESULT",
+        "RESULT_MISSING_ROWS",
+        "RESULT_EXTRA_ROWS",
+        "RESULT_MISSING_COLUMNS",
+        "RESULT_EXTRA_COLUMNS",
+        "SINGLE_CELL_DIFFERENCE",
+        "EMPTY_GOOD_SQL",
+        "COLUMN_TYPE_DIFFERENCE",
+        "LLM_JUDGE_MISSING_JOIN",
+        "LLM_JUDGE_WRONG_FILTER",
+        "LLM_JUDGE_WRONG_AGGREGATION",
+        "LLM_JUDGE_WRONG_COLUMNS",
+        "LLM_JUDGE_SYNTAX_ERROR",
+        "LLM_JUDGE_SEMANTIC_ERROR",
+        "LLM_JUDGE_OTHER",
+        "LLM_JUDGE_MISSING_OR_INCORRECT_FILTER",
+        "LLM_JUDGE_INCOMPLETE_OR_PARTIAL_OUTPUT",
+        "LLM_JUDGE_MISINTERPRETATION_OF_USER_REQUEST",
+        "LLM_JUDGE_INSTRUCTION_COMPLIANCE_OR_MISSING_BUSINESS_LOGIC",
+        "LLM_JUDGE_INCORRECT_METRIC_CALCULATION",
+        "LLM_JUDGE_INCORRECT_TABLE_OR_FIELD_USAGE",
+        "LLM_JUDGE_INCORRECT_FUNCTION_USAGE",
+        "LLM_JUDGE_MISSING_OR_INCORRECT_JOIN",
+        "LLM_JUDGE_MISSING_OR_INCORRECT_AGGREGATION",
+        "LLM_JUDGE_FORMATTING_ERROR"
+      ],
+      "enum_launch_stages": {
+        "COLUMN_TYPE_DIFFERENCE": "PUBLIC_BETA",
+        "EMPTY_GOOD_SQL": "PUBLIC_BETA",
+        "EMPTY_RESULT": "PUBLIC_BETA",
+        "LLM_JUDGE_FORMATTING_ERROR": "PUBLIC_BETA",
+        "LLM_JUDGE_INCOMPLETE_OR_PARTIAL_OUTPUT": "PUBLIC_BETA",
+        "LLM_JUDGE_INCORRECT_FUNCTION_USAGE": "PUBLIC_BETA",
+        "LLM_JUDGE_INCORRECT_METRIC_CALCULATION": "PUBLIC_BETA",
+        "LLM_JUDGE_INCORRECT_TABLE_OR_FIELD_USAGE": "PUBLIC_BETA",
+        "LLM_JUDGE_INSTRUCTION_COMPLIANCE_OR_MISSING_BUSINESS_LOGIC": "PUBLIC_BETA",
+        "LLM_JUDGE_MISINTERPRETATION_OF_USER_REQUEST": "PUBLIC_BETA",
+        "LLM_JUDGE_MISSING_JOIN": "PUBLIC_BETA",
+        "LLM_JUDGE_MISSING_OR_INCORRECT_AGGREGATION": "PUBLIC_BETA",
+        "LLM_JUDGE_MISSING_OR_INCORRECT_FILTER": "PUBLIC_BETA",
+        "LLM_JUDGE_MISSING_OR_INCORRECT_JOIN": "PUBLIC_BETA",
+        "LLM_JUDGE_OTHER": "PUBLIC_BETA",
+        "LLM_JUDGE_SEMANTIC_ERROR": "PUBLIC_BETA",
+        "LLM_JUDGE_SYNTAX_ERROR": "PUBLIC_BETA",
+        "LLM_JUDGE_WRONG_AGGREGATION": "PUBLIC_BETA",
+        "LLM_JUDGE_WRONG_COLUMNS": "PUBLIC_BETA",
+        "LLM_JUDGE_WRONG_FILTER": "PUBLIC_BETA",
+        "RESULT_EXTRA_COLUMNS": "PUBLIC_BETA",
+        "RESULT_EXTRA_ROWS": "PUBLIC_BETA",
+        "RESULT_MISSING_COLUMNS": "PUBLIC_BETA",
+        "RESULT_MISSING_ROWS": "PUBLIC_BETA",
+        "SINGLE_CELL_DIFFERENCE": "PUBLIC_BETA"
+      }
+    },
+    "dashboards.Subscriber": {
+      "fields": {
+        "destination_subscriber": {
+          "description": "The destination to receive the subscription email.\nThis parameter is mutually exclusive with `user_subscriber`.",
+          "ref": "dashboards.SubscriptionSubscriberDestination",
+          "launch_stage": "GA"
+        },
+        "user_subscriber": {
+          "description": "The user to receive the subscription email.\nThis parameter is mutually exclusive with `destination_subscriber`.",
+          "ref": "dashboards.SubscriptionSubscriberUser",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dashboards.Subscription": {
+      "fields": {
+        "create_time": {
+          "description": "A timestamp indicating when the subscription was created.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "created_by_user_id": {
+          "description": "UserId of the user who adds subscribers (users or notification destinations) to the dashboard's schedule.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "dashboard_id": {
+          "description": "UUID identifying the dashboard to which the subscription belongs.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "etag": {
+          "description": "The etag for the subscription. Must be left empty on create, can be optionally provided on delete\nto ensure that the subscription has not been deleted since the last read.",
+          "launch_stage": "GA"
+        },
+        "schedule_id": {
+          "description": "UUID identifying the schedule to which the subscription belongs.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "skip_notify": {
+          "description": "Controls whether notifications are sent to the subscriber for scheduled dashboard refreshes.\nIf not defined, defaults to false in the backend to match the current behavior (refresh and notify)",
+          "launch_stage": "GA"
+        },
+        "subscriber": {
+          "description": "Subscriber details for users and destinations to be added as subscribers to the schedule.",
+          "ref": "dashboards.Subscriber",
+          "launch_stage": "GA"
+        },
+        "subscription_id": {
+          "description": "UUID identifying the subscription.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "update_time": {
+          "description": "A timestamp indicating when the subscription was last updated.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "dashboards.SubscriptionSubscriberDestination": {
+      "fields": {
+        "destination_id": {
+          "description": "The canonical identifier of the destination to receive email notification.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dashboards.SubscriptionSubscriberUser": {
+      "fields": {
+        "user_id": {
+          "description": "UserId of the subscriber.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dashboards.TextAttachment": {
+      "description": "A text response on a conversation message: the answer, the final summary, or a\nclarifying follow-up question, along with optional phase and verification metadata.",
+      "fields": {
+        "content": {
+          "description": "AI generated message",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "launch_stage": "GA"
+        },
+        "purpose": {
+          "description": "Purpose of this text attachment. A completed message may contain more than\none text attachment (for example a clarifying follow-up question alongside\nthe final answer); use this field to tell them apart. `TEXT_ATTACHMENT_PURPOSE_ANSWER`\nmarks the final answer/summary and `FOLLOW_UP_QUESTION` marks a clarifying question.",
+          "ref": "dashboards.TextAttachmentPurpose",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dashboards.TextAttachmentPurpose": {
+      "description": "Purpose/intent of a text attachment",
+      "enum": [
+        "FOLLOW_UP_QUESTION",
+        "TEXT_ATTACHMENT_PURPOSE_ANSWER"
+      ],
+      "enum_launch_stages": {
+        "FOLLOW_UP_QUESTION": "GA",
+        "TEXT_ATTACHMENT_PURPOSE_ANSWER": "GA"
+      }
+    },
+    "dashboards.Thought": {
+      "description": "A single thought in the AI's reasoning process for a query.",
+      "fields": {
+        "content": {
+          "description": "The md formatted content for this thought.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "thought_type": {
+          "description": "The category of this thought.\nThe possible values are:\n* `THOUGHT_TYPE_DESCRIPTION`: A high-level description of how the question was interpreted.\n* `THOUGHT_TYPE_UNDERSTANDING`: How ambiguous parts of the question were resolved.\n* `THOUGHT_TYPE_DATA_SOURCING`: Which tables or datasets were identified as relevant.\n* `THOUGHT_TYPE_INSTRUCTIONS`: Which author-defined instructions were referenced.\n* `THOUGHT_TYPE_STEPS`: The logical steps taken to compute the answer.",
+          "ref": "dashboards.ThoughtType",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "dashboards.ThoughtType": {
+      "description": "ThoughtType.\nThe possible values are:\n* `THOUGHT_TYPE_UNSPECIFIED`: Default value that should not be used.\n* `THOUGHT_TYPE_DESCRIPTION`: A high-level description of how the question was interpreted.\n* `THOUGHT_TYPE_UNDERSTANDING`: How ambiguous parts of the question were resolved.\n* `THOUGHT_TYPE_DATA_SOURCING`: Which tables or datasets were identified as relevant.\n* `THOUGHT_TYPE_INSTRUCTIONS`: Which author-defined instructions were referenced.\n* `THOUGHT_TYPE_STEPS`: The logical steps taken to compute the answer.\nThe category of a Thought.\nAdditional values may be added in the future.",
+      "enum": [
+        "THOUGHT_TYPE_DESCRIPTION",
+        "THOUGHT_TYPE_UNDERSTANDING",
+        "THOUGHT_TYPE_DATA_SOURCING",
+        "THOUGHT_TYPE_INSTRUCTIONS",
+        "THOUGHT_TYPE_STEPS"
+      ],
+      "enum_launch_stages": {
+        "THOUGHT_TYPE_DATA_SOURCING": "PUBLIC_PREVIEW",
+        "THOUGHT_TYPE_DESCRIPTION": "PUBLIC_PREVIEW",
+        "THOUGHT_TYPE_INSTRUCTIONS": "PUBLIC_PREVIEW",
+        "THOUGHT_TYPE_STEPS": "PUBLIC_PREVIEW",
+        "THOUGHT_TYPE_UNDERSTANDING": "PUBLIC_PREVIEW"
+      },
+      "enum_descriptions": {
+        "THOUGHT_TYPE_DATA_SOURCING": "Which tables or datasets were identified as relevant.",
+        "THOUGHT_TYPE_DESCRIPTION": "A high-level description of how the question was interpreted.",
+        "THOUGHT_TYPE_INSTRUCTIONS": "Which author-defined instructions were referenced.",
+        "THOUGHT_TYPE_STEPS": "The logical steps taken to compute the answer.",
+        "THOUGHT_TYPE_UNDERSTANDING": "How ambiguous parts of the question were resolved."
+      }
+    },
+    "dashboards.TrashDashboardRequest": {},
+    "dashboards.TrashDashboardResponse": {},
+    "dashboards.UnpublishDashboardRequest": {},
+    "dashboards.UnpublishDashboardResponse": {},
+    "dashboards.UpdateDashboardRequest": {
+      "fields": {
+        "dashboard": {
+          "ref": "dashboards.Dashboard",
+          "launch_stage": "GA"
+        },
+        "dataset_catalog": {
+          "description": "Sets the default catalog for all datasets in this dashboard.\nDoes not impact table references that use fully qualified catalog names (ex: samples.nyctaxi.trips).\nLeave blank to keep each dataset’s existing configuration.",
+          "launch_stage": "GA"
+        },
+        "dataset_schema": {
+          "description": "Sets the default schema for all datasets in this dashboard.\nDoes not impact table references that use fully qualified schema names (ex: nyctaxi.trips).\nLeave blank to keep each dataset’s existing configuration.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dashboards.UpdateScheduleRequest": {
+      "fields": {
+        "schedule": {
+          "description": "The schedule to update.",
+          "ref": "dashboards.Schedule",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "database.CreateDatabaseCatalogRequest": {
+      "fields": {
+        "catalog": {
+          "ref": "database.DatabaseCatalog",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "database.CreateDatabaseInstanceRequest": {
+      "fields": {
+        "database_instance": {
+          "description": "Instance to create.",
+          "ref": "database.DatabaseInstance",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "database.CreateDatabaseInstanceRoleRequest": {
+      "fields": {
+        "database_instance_name": {
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "database_instance_role": {
+          "ref": "database.DatabaseInstanceRole",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "database.CreateDatabaseTableRequest": {
+      "fields": {
+        "table": {
+          "ref": "database.DatabaseTable",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "database.CreateSyncedDatabaseTableRequest": {
+      "fields": {
+        "synced_table": {
+          "ref": "database.SyncedDatabaseTable",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "database.CustomTag": {
+      "fields": {
+        "key": {
+          "description": "The key of the custom tag.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "value": {
+          "description": "The value of the custom tag.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "database.DatabaseCatalog": {
+      "fields": {
+        "create_database_if_not_exists": {
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "INPUT_ONLY",
+            "OPTIONAL"
+          ]
+        },
+        "database_instance_name": {
+          "description": "The name of the DatabaseInstance housing the database.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "database_name": {
+          "description": "The name of the database (in an instance) associated with the catalog.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "name": {
+          "description": "The name of the catalog in UC.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "uid": {
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "database.DatabaseCredential": {
+      "fields": {
+        "expiration_time": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "token": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "database.DatabaseInstance": {
+      "description": "A DatabaseInstance represents a logical Postgres instance, comprised of both compute and storage.",
+      "fields": {
+        "capacity": {
+          "description": "The sku of the instance. Valid values are \"CU_1\", \"CU_2\", \"CU_4\", \"CU_8\".",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "child_instance_refs": {
+          "description": "The refs of the child instances. This is only available if the instance is\nparent instance.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "creation_time": {
+          "description": "The timestamp when the instance was created.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "creator": {
+          "description": "The email of the creator of the instance.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "custom_tags": {
+          "description": "Custom tags associated with the instance. This field is only included on create and update responses.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "INPUT_ONLY",
+            "OPTIONAL"
+          ]
+        },
+        "effective_capacity": {
+          "description": "Deprecated. The sku of the instance; this field will always match the value of capacity.\nThis is an output only field that contains the value computed from the input field combined with\nserver side defaults. Use the field without the effective_ prefix to set the value.",
+          "deprecated": true,
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "effective_custom_tags": {
+          "description": "The recorded custom tags associated with the instance.\nThis is an output only field that contains the value computed from the input field combined with\nserver side defaults. Use the field without the effective_ prefix to set the value.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "effective_enable_pg_native_login": {
+          "description": "Whether the instance has PG native password login enabled.\nThis is an output only field that contains the value computed from the input field combined with\nserver side defaults. Use the field without the effective_ prefix to set the value.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "effective_enable_readable_secondaries": {
+          "description": "Whether secondaries serving read-only traffic are enabled. Defaults to false.\nThis is an output only field that contains the value computed from the input field combined with\nserver side defaults. Use the field without the effective_ prefix to set the value.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "effective_node_count": {
+          "description": "The number of nodes in the instance, composed of 1 primary and 0 or more secondaries. Defaults to\n1 primary and 0 secondaries.\nThis is an output only field that contains the value computed from the input field combined with\nserver side defaults. Use the field without the effective_ prefix to set the value.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "effective_retention_window_in_days": {
+          "description": "The retention window for the instance. This is the time window in days\nfor which the historical data is retained.\nThis is an output only field that contains the value computed from the input field combined with\nserver side defaults. Use the field without the effective_ prefix to set the value.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "effective_stopped": {
+          "description": "Whether the instance is stopped.\nThis is an output only field that contains the value computed from the input field combined with\nserver side defaults. Use the field without the effective_ prefix to set the value.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "effective_usage_policy_id": {
+          "description": "The policy that is applied to the instance.\nThis is an output only field that contains the value computed from the input field combined with\nserver side defaults. Use the field without the effective_ prefix to set the value.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "enable_pg_native_login": {
+          "description": "Whether to enable PG native password login on the instance. Defaults to false.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "INPUT_ONLY",
+            "OPTIONAL"
+          ]
+        },
+        "enable_readable_secondaries": {
+          "description": "Whether to enable secondaries to serve read-only traffic. Defaults to false.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "INPUT_ONLY",
+            "OPTIONAL"
+          ]
+        },
+        "name": {
+          "description": "The name of the instance. This is the unique identifier for the instance.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "node_count": {
+          "description": "The number of nodes in the instance, composed of 1 primary and 0 or more secondaries. Defaults to\n1 primary and 0 secondaries. This field is input only, see effective_node_count for the output.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "INPUT_ONLY",
+            "OPTIONAL"
+          ]
+        },
+        "parent_instance_ref": {
+          "description": "The ref of the parent instance. This is only available if the instance is\nchild instance.\nInput: For specifying the parent instance to create a child instance. Optional.\nOutput: Only populated if provided as input to create a child instance.",
+          "ref": "database.DatabaseInstanceRef",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE",
+            "OPTIONAL"
+          ]
+        },
+        "pg_version": {
+          "description": "The version of Postgres running on the instance.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "read_only_dns": {
+          "description": "The DNS endpoint to connect to the instance for read only access. This is only available if\nenable_readable_secondaries is true.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "read_write_dns": {
+          "description": "The DNS endpoint to connect to the instance for read+write access.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "retention_window_in_days": {
+          "description": "The retention window for the instance. This is the time window in days\nfor which the historical data is retained. The default value is 7 days.\nValid values are 2 to 35 days.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "INPUT_ONLY",
+            "OPTIONAL"
+          ]
+        },
+        "state": {
+          "description": "The current state of the instance.",
+          "ref": "database.DatabaseInstanceState",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "stopped": {
+          "description": "Whether to stop the instance. An input only param, see effective_stopped for the output.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "INPUT_ONLY",
+            "OPTIONAL"
+          ]
+        },
+        "uid": {
+          "description": "An immutable UUID identifier for the instance.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "usage_policy_id": {
+          "description": "The desired usage policy to associate with the instance.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "INPUT_ONLY",
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "database.DatabaseInstanceRef": {
+      "description": "DatabaseInstanceRef is a reference to a database instance. It is used in the\nDatabaseInstance object to refer to the parent instance of an instance and\nto refer the child instances of an instance.\nTo specify as a parent instance during creation of an instance,\nthe lsn and branch_time fields are optional. If not specified, the child\ninstance will be created from the latest lsn of the parent.\nIf both lsn and branch_time are specified, the lsn will be used to create\nthe child instance.",
+      "fields": {
+        "branch_time": {
+          "description": "Branch time of the ref database instance.\nFor a parent ref instance, this is the point in time on the parent instance from which the\ninstance was created.\nFor a child ref instance, this is the point in time on the instance from which the child\ninstance was created.\nInput: For specifying the point in time to create a child instance. Optional.\nOutput: Only populated if provided as input to create a child instance.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "effective_lsn": {
+          "description": "For a parent ref instance, this is the LSN on the parent instance from which the\ninstance was created.\nFor a child ref instance, this is the LSN on the instance from which the child instance\nwas created.\nThis is an output only field that contains the value computed from the input field combined with\nserver side defaults. Use the field without the effective_ prefix to set the value.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "lsn": {
+          "description": "User-specified WAL LSN of the ref database instance.\n\nInput: For specifying the WAL LSN to create a child instance. Optional.\nOutput: Only populated if provided as input to create a child instance.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "INPUT_ONLY",
+            "OPTIONAL"
+          ]
+        },
+        "name": {
+          "description": "Name of the ref database instance.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "uid": {
+          "description": "Id of the ref database instance.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "database.DatabaseInstanceRole": {
+      "description": "A DatabaseInstanceRole represents a Postgres role in a database instance.",
+      "fields": {
+        "attributes": {
+          "description": "The desired API-exposed Postgres role attribute to associate with the role. Optional.",
+          "ref": "database.DatabaseInstanceRoleAttributes",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "effective_attributes": {
+          "description": "The attributes that are applied to the role.\nThis is an output only field that contains the value computed from the input field combined with\nserver side defaults. Use the field without the effective_ prefix to set the value.",
+          "ref": "database.DatabaseInstanceRoleAttributes",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "identity_type": {
+          "description": "The type of the role.",
+          "ref": "database.DatabaseInstanceRoleIdentityType",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "instance_name": {
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "membership_role": {
+          "description": "An enum value for a standard role that this role is a member of.",
+          "ref": "database.DatabaseInstanceRoleMembershipRole",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "name": {
+          "description": "The name of the role. This is the unique identifier for the role in an instance.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "database.DatabaseInstanceRoleAttributes": {
+      "description": "Attributes that can be granted to a Postgres role. We are only implementing a subset for now, see xref:\nhttps://www.postgresql.org/docs/16/sql-createrole.html\nThe values follow Postgres keyword naming e.g. CREATEDB, BYPASSRLS, etc. which is why they don't include typical\nunderscores between words. We were requested to make this a nested object/struct representation since these are\nknobs from an external spec.",
+      "fields": {
+        "bypassrls": {
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "createdb": {
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "createrole": {
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "database.DatabaseInstanceRoleIdentityType": {
+      "enum": [
+        "PG_ONLY",
+        "USER",
+        "SERVICE_PRINCIPAL",
+        "GROUP"
+      ],
+      "enum_launch_stages": {
+        "GROUP": "PRIVATE_PREVIEW",
+        "PG_ONLY": "PRIVATE_PREVIEW",
+        "SERVICE_PRINCIPAL": "PRIVATE_PREVIEW",
+        "USER": "PRIVATE_PREVIEW"
+      }
+    },
+    "database.DatabaseInstanceRoleMembershipRole": {
+      "description": "Roles that the DatabaseInstanceRole can be a member of.",
+      "enum": [
+        "DATABRICKS_SUPERUSER"
+      ],
+      "enum_launch_stages": {
+        "DATABRICKS_SUPERUSER": "PRIVATE_PREVIEW"
+      }
+    },
+    "database.DatabaseInstanceState": {
+      "enum": [
+        "STARTING",
+        "AVAILABLE",
+        "DELETING",
+        "STOPPED",
+        "UPDATING",
+        "FAILING_OVER"
+      ],
+      "enum_launch_stages": {
+        "AVAILABLE": "PUBLIC_PREVIEW",
+        "DELETING": "PUBLIC_PREVIEW",
+        "FAILING_OVER": "PUBLIC_PREVIEW",
+        "STARTING": "PUBLIC_PREVIEW",
+        "STOPPED": "PUBLIC_PREVIEW",
+        "UPDATING": "PUBLIC_PREVIEW"
+      }
+    },
+    "database.DatabaseTable": {
+      "fields": {
+        "database_instance_name": {
+          "description": "Name of the target database instance. This is required when creating database tables in standard catalogs.\nThis is optional when creating database tables in registered catalogs. If this field is specified\nwhen creating database tables in registered catalogs, the database instance name MUST\nmatch that of the registered catalog (or the request will be rejected).",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "logical_database_name": {
+          "description": "Target Postgres database object (logical database) name for this table.\n\nWhen creating a table in a standard catalog, this field is required.\nIn this scenario, specifying this field will allow targeting an arbitrary postgres database.\n\nRegistration of database tables via /database/tables is currently only supported in standard catalogs.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "name": {
+          "description": "Full three-part (catalog, schema, table) name of the table.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "database.DeleteDatabaseCatalogRequest": {},
+    "database.DeleteDatabaseInstanceRequest": {
+      "fields": {
+        "force": {
+          "description": "By default, an instance cannot be deleted if it has descendant instances created via PITR. If\nthis flag is specified as true, all descendent instances will be deleted as well.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "purge": {
+          "description": "Deprecated. Omitting the field or setting it to true will result in the field being hard deleted. Setting a value\nof false will throw a bad request.",
+          "deprecated": true,
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "database.DeleteDatabaseInstanceRoleRequest": {
+      "fields": {
+        "allow_missing": {
+          "description": "This is the AIP standard name for the equivalent of Postgres' `IF EXISTS` option",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "reassign_owned_to": {
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "database.DeleteDatabaseTableRequest": {},
+    "database.DeleteSyncedDatabaseTableRequest": {
+      "fields": {
+        "purge_data": {
+          "description": "Optional. When set to true, the actual PostgreSQL table will be dropped from the database.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "database.DeltaTableSyncInfo": {
+      "fields": {
+        "delta_commit_timestamp": {
+          "description": "The timestamp when the above Delta version was committed in the source Delta table.\nNote: This is the Delta commit time, not the time the data was written to the synced table.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "delta_commit_version": {
+          "description": "The Delta Lake commit version that was last successfully synced.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "database.FindDatabaseInstanceByUidRequest": {
+      "fields": {
+        "uid": {
+          "description": "UID of the cluster to get.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "database.GenerateDatabaseCredentialRequest": {
+      "description": "Generates a credential that can be used to access database instances",
+      "fields": {
+        "claims": {
+          "description": "A set of UC permissions to add to the credential. We verify that the caller has the necessary\npermissions in UC and include a reference in the token. Postgres uses that token to give the\nconnecting user additional grants to the Postgres resources that correspond to the UC resources.\nThe UC resources need to be something that have a Postgres counterpart. For example, a synced table or\na table in a UC database catalog.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "instance_names": {
+          "description": "Instances to request a credential for. At least one of instance_names or claims must be specified.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "request_id": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "database.GetDatabaseCatalogRequest": {},
+    "database.GetDatabaseInstanceRequest": {},
+    "database.GetDatabaseInstanceRoleRequest": {},
+    "database.GetDatabaseTableRequest": {},
+    "database.GetSyncedDatabaseTableRequest": {},
+    "database.ListDatabaseCatalogsRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Upper bound for items returned.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Pagination token to go to the next page of synced database tables. Requests first page if absent.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "database.ListDatabaseCatalogsResponse": {
+      "fields": {
+        "database_catalogs": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "next_page_token": {
+          "description": "Pagination token to request the next page of database catalogs.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "database.ListDatabaseInstanceRolesRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Upper bound for items returned.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Pagination token to go to the next page of Database Instances. Requests first page if absent.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "database.ListDatabaseInstanceRolesResponse": {
+      "fields": {
+        "database_instance_roles": {
+          "description": "List of database instance roles.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "next_page_token": {
+          "description": "Pagination token to request the next page of instances.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "database.ListDatabaseInstancesRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Upper bound for items returned. The maximum value is 100.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Pagination token to go to the next page of Database Instances. Requests first page if absent.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "database.ListDatabaseInstancesResponse": {
+      "fields": {
+        "database_instances": {
+          "description": "List of instances.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "next_page_token": {
+          "description": "Pagination token to request the next page of instances.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "database.ListSyncedDatabaseTablesRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Upper bound for items returned.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Pagination token to go to the next page of synced database tables. Requests first page if absent.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "database.ListSyncedDatabaseTablesResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "Pagination token to request the next page of synced tables.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "synced_tables": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "database.NewPipelineSpec": {
+      "description": "Custom fields that user can set for pipeline while creating SyncedDatabaseTable.\nNote that other fields of pipeline are still inferred by table def internally",
+      "fields": {
+        "budget_policy_id": {
+          "description": "Budget policy to set on the newly created pipeline.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "storage_catalog": {
+          "description": "This field needs to be specified if the destination catalog is a managed postgres catalog.\n\nUC catalog for the pipeline to store intermediate files (checkpoints, event logs etc).\nThis needs to be a standard catalog where the user has permissions to create Delta tables.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "storage_schema": {
+          "description": "This field needs to be specified if the destination catalog is a managed postgres catalog.\n\nUC schema for the pipeline to store intermediate files (checkpoints, event logs etc).\nThis needs to be in the standard catalog where the user has permissions to create Delta tables.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "database.ProvisioningInfoState": {
+      "enum": [
+        "PROVISIONING",
+        "ACTIVE",
+        "FAILED",
+        "DELETING",
+        "UPDATING",
+        "DEGRADED"
+      ],
+      "enum_launch_stages": {
+        "ACTIVE": "PUBLIC_PREVIEW",
+        "DEGRADED": "PUBLIC_PREVIEW",
+        "DELETING": "PUBLIC_PREVIEW",
+        "FAILED": "PUBLIC_PREVIEW",
+        "PROVISIONING": "PUBLIC_PREVIEW",
+        "UPDATING": "PUBLIC_PREVIEW"
+      }
+    },
+    "database.ProvisioningPhase": {
+      "enum": [
+        "PROVISIONING_PHASE_MAIN",
+        "PROVISIONING_PHASE_INDEX_SCAN",
+        "PROVISIONING_PHASE_INDEX_SORT"
+      ],
+      "enum_launch_stages": {
+        "PROVISIONING_PHASE_INDEX_SCAN": "PUBLIC_PREVIEW",
+        "PROVISIONING_PHASE_INDEX_SORT": "PUBLIC_PREVIEW",
+        "PROVISIONING_PHASE_MAIN": "PUBLIC_PREVIEW"
+      }
+    },
+    "database.RequestedClaims": {
+      "fields": {
+        "permission_set": {
+          "ref": "database.RequestedClaimsPermissionSet",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "resources": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "database.RequestedClaimsPermissionSet": {
+      "description": "Might add WRITE in the future",
+      "enum": [
+        "READ_ONLY"
+      ],
+      "enum_launch_stages": {
+        "READ_ONLY": "PUBLIC_PREVIEW"
+      }
+    },
+    "database.RequestedResource": {
+      "fields": {
+        "table_name": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "unspecified_resource_name": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "database.SyncedDatabaseTable": {
+      "fields": {
+        "data_synchronization_status": {
+          "description": "Synced Table data synchronization status",
+          "ref": "database.SyncedTableStatus",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "database_instance_name": {
+          "description": "Name of the target database instance. This is required when creating synced database tables in standard catalogs.\nThis is optional when creating synced database tables in registered catalogs. If this field is specified\nwhen creating synced database tables in registered catalogs, the database instance name MUST\nmatch that of the registered catalog (or the request will be rejected).",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "INPUT_ONLY",
+            "OPTIONAL"
+          ]
+        },
+        "effective_database_instance_name": {
+          "description": "The name of the database instance that this table is registered to. This field is always returned, and for\ntables inside database catalogs is inferred database instance associated with the catalog.\nThis is an output only field that contains the value computed from the input field combined with\nserver side defaults. Use the field without the effective_ prefix to set the value.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "effective_logical_database_name": {
+          "description": "The name of the logical database that this table is registered to.\nThis is an output only field that contains the value computed from the input field combined with\nserver side defaults. Use the field without the effective_ prefix to set the value.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "logical_database_name": {
+          "description": "Target Postgres database object (logical database) name for this table.\n\nWhen creating a synced table in a registered Postgres catalog, the\ntarget Postgres database name is inferred to be that of the registered catalog.\nIf this field is specified in this scenario, the Postgres database name MUST\nmatch that of the registered catalog (or the request will be rejected).\n\nWhen creating a synced table in a standard catalog, this field is required.\nIn this scenario, specifying this field will allow targeting an arbitrary postgres database.\nNote that this has implications for the `create_database_objects_is_missing` field in `spec`.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "INPUT_ONLY",
+            "OPTIONAL"
+          ]
+        },
+        "name": {
+          "description": "Full three-part (catalog, schema, table) name of the table.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "spec": {
+          "ref": "database.SyncedTableSpec",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "unity_catalog_provisioning_state": {
+          "description": "The provisioning state of the synced table entity in Unity Catalog. This is distinct from the\nstate of the data synchronization pipeline (i.e. the table may be in \"ACTIVE\" but the pipeline\nmay be in \"PROVISIONING\" as it runs asynchronously).",
+          "ref": "database.ProvisioningInfoState",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "database.SyncedTableContinuousUpdateStatus": {
+      "description": "Detailed status of a synced table. Shown if the synced table is in the SYNCED_CONTINUOUS_UPDATE\nor the SYNCED_UPDATING_PIPELINE_RESOURCES state.",
+      "fields": {
+        "initial_pipeline_sync_progress": {
+          "description": "Progress of the initial data synchronization.",
+          "ref": "database.SyncedTablePipelineProgress",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "last_processed_commit_version": {
+          "description": "The last source table Delta version that was successfully synced to the synced table.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "timestamp": {
+          "description": "The end timestamp of the last time any data was synchronized from the source table to the synced\ntable. This is when the data is available in the synced table.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "database.SyncedTableFailedStatus": {
+      "description": "Detailed status of a synced table. Shown if the synced table is in the OFFLINE_FAILED or the\nSYNCED_PIPELINE_FAILED state.",
+      "fields": {
+        "last_processed_commit_version": {
+          "description": "The last source table Delta version that was successfully synced to the synced table.\nThe last source table Delta version that was synced to the synced table.\nOnly populated if the table is still\nsynced and available for serving.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "timestamp": {
+          "description": "The end timestamp of the last time any data was synchronized from the source table to the synced\ntable. Only populated if the table is still synced and available for serving.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "database.SyncedTablePipelineProgress": {
+      "description": "Progress information of the Synced Table data synchronization pipeline.",
+      "fields": {
+        "estimated_completion_time_seconds": {
+          "description": "The estimated time remaining to complete this update in seconds.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "latest_version_currently_processing": {
+          "description": "The source table Delta version that was last processed by the pipeline. The pipeline may not\nhave completely processed this version yet.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "provisioning_phase": {
+          "description": "The current phase of the data synchronization pipeline.",
+          "ref": "database.ProvisioningPhase",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "sync_progress_completion": {
+          "description": "The completion ratio of this update. This is a number between 0 and 1.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "synced_row_count": {
+          "description": "The number of rows that have been synced in this update.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "total_row_count": {
+          "description": "The total number of rows that need to be synced in this update. This number may be an estimate.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "database.SyncedTablePosition": {
+      "fields": {
+        "delta_table_sync_info": {
+          "ref": "database.DeltaTableSyncInfo",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "sync_end_timestamp": {
+          "description": "The end timestamp of the most recent successful synchronization.\nThis is the time when the data is available in the synced table.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "sync_start_timestamp": {
+          "description": "The starting timestamp of the most recent successful synchronization from the source table\nto the destination (synced) table.\nNote this is the starting timestamp of the sync operation, not the end time.\nE.g., for a batch, this is the time when the sync operation started.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "database.SyncedTableProvisioningStatus": {
+      "description": "Detailed status of a synced table. Shown if the synced table is in the\nPROVISIONING_PIPELINE_RESOURCES or the PROVISIONING_INITIAL_SNAPSHOT state.",
+      "fields": {
+        "initial_pipeline_sync_progress": {
+          "description": "Details about initial data synchronization. Only populated when in the\nPROVISIONING_INITIAL_SNAPSHOT state.",
+          "ref": "database.SyncedTablePipelineProgress",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "database.SyncedTableSchedulingPolicy": {
+      "enum": [
+        "CONTINUOUS",
+        "TRIGGERED",
+        "SNAPSHOT"
+      ],
+      "enum_launch_stages": {
+        "CONTINUOUS": "PUBLIC_PREVIEW",
+        "SNAPSHOT": "PUBLIC_PREVIEW",
+        "TRIGGERED": "PUBLIC_PREVIEW"
+      }
+    },
+    "database.SyncedTableSpec": {
+      "description": "Specification of a synced database table.",
+      "fields": {
+        "accelerated_sync": {
+          "description": "When true, enables accelerated sync mode for the initial data load.\nThis significantly improves performance for large tables.\nRequires workspace-level enablement.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "INPUT_ONLY",
+            "OPTIONAL"
+          ]
+        },
+        "create_database_objects_if_missing": {
+          "description": "If true, the synced table's logical database and schema resources in PG\nwill be created if they do not already exist.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "INPUT_ONLY",
+            "OPTIONAL"
+          ]
+        },
+        "existing_pipeline_id": {
+          "description": "At most one of existing_pipeline_id and new_pipeline_spec should be defined.\n\nIf existing_pipeline_id is defined, the synced table will be bin packed into the existing pipeline\nreferenced. This avoids creating a new pipeline and allows sharing existing compute.\nIn this case, the scheduling_policy of this synced table must match the scheduling policy of the existing pipeline.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "INPUT_ONLY",
+            "OPTIONAL"
+          ]
+        },
+        "new_pipeline_spec": {
+          "description": "At most one of existing_pipeline_id and new_pipeline_spec should be defined.\n\nIf new_pipeline_spec is defined, a new pipeline is created for this synced table. The location pointed to is used\nto store intermediate files (checkpoints, event logs etc). The caller must have write permissions to create Delta\ntables in the specified catalog and schema. Again, note this requires write permissions, whereas the source table\nonly requires read permissions.",
+          "ref": "database.NewPipelineSpec",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "INPUT_ONLY",
+            "OPTIONAL"
+          ]
+        },
+        "primary_key_columns": {
+          "description": "Primary Key columns to be used for data insert/update in the destination.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "scheduling_policy": {
+          "description": "Scheduling policy of the underlying pipeline.",
+          "ref": "database.SyncedTableSchedulingPolicy",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "source_table_full_name": {
+          "description": "Three-part (catalog, schema, table) name of the source Delta table.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "timeseries_key": {
+          "description": "Time series key to deduplicate (tie-break) rows with the same primary key.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "type_overrides": {
+          "description": "Override the default Delta-\u003ePG type mapping for specific columns.\nA TypeOverride with PG_SPECIFIC_TYPE_UNSPECIFIED is rejected; a valid pg_type must be set.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "database.SyncedTableSpecPgSpecificType": {
+      "description": "PostgreSQL-specific target types that can override the default Delta-to-PG mapping.",
+      "enum": [
+        "PG_SPECIFIC_TYPE_VECTOR",
+        "PG_SPECIFIC_TYPE_HALFVEC",
+        "PG_SPECIFIC_TYPE_VARCHAR"
+      ],
+      "enum_launch_stages": {
+        "PG_SPECIFIC_TYPE_HALFVEC": "PRIVATE_PREVIEW",
+        "PG_SPECIFIC_TYPE_VARCHAR": "PRIVATE_PREVIEW",
+        "PG_SPECIFIC_TYPE_VECTOR": "PRIVATE_PREVIEW"
+      }
+    },
+    "database.SyncedTableSpecTypeOverride": {
+      "description": "Overrides the default Delta-to-PostgreSQL type mapping for a single column.",
+      "fields": {
+        "column_name": {
+          "description": "Name of the source column whose target PostgreSQL type should be overridden.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "pg_type": {
+          "description": "PostgreSQL-specific target type to use for the column.",
+          "ref": "database.SyncedTableSpecPgSpecificType",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "size": {
+          "description": "Size parameter for the target type, for types that take one (e.g. vector\ndimension, varchar length). Required when the chosen pg_type needs a size.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "database.SyncedTableState": {
+      "description": "The state of a synced table.",
+      "enum": [
+        "SYNCED_TABLE_PROVISIONING",
+        "SYNCED_TABLE_PROVISIONING_PIPELINE_RESOURCES",
+        "SYNCED_TABLE_PROVISIONING_INITIAL_SNAPSHOT",
+        "SYNCED_TABLE_ONLINE",
+        "SYNCED_TABLE_ONLINE_CONTINUOUS_UPDATE",
+        "SYNCED_TABLE_ONLINE_TRIGGERED_UPDATE",
+        "SYNCED_TABLE_ONLINE_NO_PENDING_UPDATE",
+        "SYNCED_TABLED_OFFLINE",
+        "SYNCED_TABLE_OFFLINE_FAILED",
+        "SYNCED_TABLE_ONLINE_PIPELINE_FAILED",
+        "SYNCED_TABLE_ONLINE_UPDATING_PIPELINE_RESOURCES"
+      ],
+      "enum_launch_stages": {
+        "SYNCED_TABLED_OFFLINE": "PUBLIC_PREVIEW",
+        "SYNCED_TABLE_OFFLINE_FAILED": "PUBLIC_PREVIEW",
+        "SYNCED_TABLE_ONLINE": "PUBLIC_PREVIEW",
+        "SYNCED_TABLE_ONLINE_CONTINUOUS_UPDATE": "PUBLIC_PREVIEW",
+        "SYNCED_TABLE_ONLINE_NO_PENDING_UPDATE": "PUBLIC_PREVIEW",
+        "SYNCED_TABLE_ONLINE_PIPELINE_FAILED": "PUBLIC_PREVIEW",
+        "SYNCED_TABLE_ONLINE_TRIGGERED_UPDATE": "PUBLIC_PREVIEW",
+        "SYNCED_TABLE_ONLINE_UPDATING_PIPELINE_RESOURCES": "PUBLIC_PREVIEW",
+        "SYNCED_TABLE_PROVISIONING": "PUBLIC_PREVIEW",
+        "SYNCED_TABLE_PROVISIONING_INITIAL_SNAPSHOT": "PUBLIC_PREVIEW",
+        "SYNCED_TABLE_PROVISIONING_PIPELINE_RESOURCES": "PUBLIC_PREVIEW"
+      }
+    },
+    "database.SyncedTableStatus": {
+      "description": "Status of a synced table.",
+      "fields": {
+        "continuous_update_status": {
+          "ref": "database.SyncedTableContinuousUpdateStatus",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "detailed_state": {
+          "description": "The state of the synced table.",
+          "ref": "database.SyncedTableState",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "failed_status": {
+          "ref": "database.SyncedTableFailedStatus",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "last_sync": {
+          "description": "Summary of the last successful synchronization from source to destination.\n\nWill always be present if there has been a successful sync. Even if the most recent syncs have failed.\n\nLimitation:\nThe only exception is if the synced table is doing a FULL REFRESH, then the last sync information\nwill not be available until the full refresh is complete. This limitation will be addressed in a future version.\n\nThis top-level field is a convenience for consumers who want easy access to last sync information\nwithout having to traverse detailed_status.",
+          "ref": "database.SyncedTablePosition",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "message": {
+          "description": "A text description of the current state of the synced table.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "pipeline_id": {
+          "description": "ID of the associated pipeline. The pipeline ID may have been provided by the client\n(in the case of bin packing), or generated by the server (when creating a new pipeline).",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "provisioning_status": {
+          "ref": "database.SyncedTableProvisioningStatus",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "triggered_update_status": {
+          "ref": "database.SyncedTableTriggeredUpdateStatus",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "database.SyncedTableTriggeredUpdateStatus": {
+      "description": "Detailed status of a synced table. Shown if the synced table is in the SYNCED_TRIGGERED_UPDATE\nor the SYNCED_NO_PENDING_UPDATE state.",
+      "fields": {
+        "last_processed_commit_version": {
+          "description": "The last source table Delta version that was successfully synced to the synced table.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "timestamp": {
+          "description": "The end timestamp of the last time any data was synchronized from the source table to the synced\ntable. This is when the data is available in the synced table.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "triggered_update_progress": {
+          "description": "Progress of the active data synchronization pipeline.",
+          "ref": "database.SyncedTablePipelineProgress",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "database.UpdateDatabaseCatalogRequest": {
+      "fields": {
+        "database_catalog": {
+          "description": "Note that updating a database catalog is not yet supported.",
+          "ref": "database.DatabaseCatalog",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "update_mask": {
+          "description": "The list of fields to update. Setting this field is not yet supported.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "database.UpdateDatabaseInstanceRequest": {
+      "fields": {
+        "database_instance": {
+          "ref": "database.DatabaseInstance",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "update_mask": {
+          "description": "The list of fields to update. If unspecified, all fields will be updated when possible. To wipe out custom_tags,\nspecify custom_tags in the update_mask with an empty custom_tags map.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "database.UpdateSyncedDatabaseTableRequest": {
+      "fields": {
+        "synced_table": {
+          "description": "Note that updating a synced database table is not yet supported.",
+          "ref": "database.SyncedDatabaseTable",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "update_mask": {
+          "description": "The list of fields to update. Setting this field is not yet supported.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "dataclassification.AutoTaggingConfig": {
+      "description": "Auto-tagging configuration for a classification tag.\nWhen enabled, detected columns are automatically tagged with Unity Catalog\ntags.",
+      "fields": {
+        "auto_tagging_mode": {
+          "description": "Whether auto-tagging is enabled or disabled for this classification tag.",
+          "ref": "dataclassification.AutoTaggingConfigAutoTaggingMode",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "classification_tag": {
+          "description": "The Classification Tag. For built-in classes this is a system tag (e.g., \"class.name\",\n\"class.location\"); for custom classes it is a user-defined governance tag key.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "dataclassification.AutoTaggingConfigAutoTaggingMode": {
+      "description": "Auto-tagging mode.",
+      "enum": [
+        "AUTO_TAGGING_DISABLED",
+        "AUTO_TAGGING_ENABLED"
+      ],
+      "enum_launch_stages": {
+        "AUTO_TAGGING_DISABLED": "PUBLIC_PREVIEW",
+        "AUTO_TAGGING_ENABLED": "PUBLIC_PREVIEW"
+      }
+    },
+    "dataclassification.CatalogConfig": {
+      "description": "Data Classification configuration for a Unity Catalog catalog. This message follows the \"At Most One Resource\" pattern: at most one CatalogConfig exists per catalog.\n- Full CRUD operations are supported: Create enables Data Classification, Delete disables it\n- It has no unique identifier of its own and uses its parent catalog's identifier (catalog_name)",
+      "fields": {
+        "auto_tag_configs": {
+          "description": "List of auto-tagging configurations for this catalog.\nEmpty list means no auto-tagging is enabled.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "excluded_schemas": {
+          "description": "Schemas to exclude from the scan, each named relative to the parent catalog.\nIf specified, all schemas except the specified ones will be scanned.\nMutually exclusive with `included_schemas`: only one may be set per request.\nIf neither `included_schemas` nor `excluded_schemas` is set, all schemas are scanned.",
+          "ref": "dataclassification.CatalogConfigSchemaNames",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "included_schemas": {
+          "description": "Schemas to include in the scan, each named relative to the parent catalog.\nIf specified, only listed schemas will be scanned.\nMutually exclusive with `excluded_schemas`: only one may be set per request.\nIf neither `included_schemas` nor `excluded_schemas` is set, all schemas are scanned.",
+          "ref": "dataclassification.CatalogConfigSchemaNames",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "name": {
+          "description": "Resource name in the format: catalogs/{catalog_name}/config.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dataclassification.CatalogConfigSchemaNames": {
+      "description": "Wrapper message for a list of schema names.",
+      "fields": {
+        "names": {
+          "description": "Schema names, each relative to the parent catalog. Must not be empty.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dataclassification.CreateCatalogConfigRequest": {
+      "fields": {
+        "catalog_config": {
+          "description": "The configuration to create.",
+          "ref": "dataclassification.CatalogConfig",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dataclassification.DeleteCatalogConfigRequest": {},
+    "dataclassification.GetCatalogConfigRequest": {},
+    "dataclassification.UpdateCatalogConfigRequest": {
+      "fields": {
+        "catalog_config": {
+          "description": "The configuration to apply to the catalog.\nThe name field in catalog_config identifies which resource to update.",
+          "ref": "dataclassification.CatalogConfig",
+          "launch_stage": "GA"
+        },
+        "update_mask": {
+          "description": "Field mask specifying which fields to update.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "dataquality.AggregationGranularity": {
+      "description": "The granularity for aggregating data into time windows based on their timestamp.",
+      "enum": [
+        "AGGREGATION_GRANULARITY_5_MINUTES",
+        "AGGREGATION_GRANULARITY_30_MINUTES",
+        "AGGREGATION_GRANULARITY_1_HOUR",
+        "AGGREGATION_GRANULARITY_1_DAY",
+        "AGGREGATION_GRANULARITY_1_WEEK",
+        "AGGREGATION_GRANULARITY_2_WEEKS",
+        "AGGREGATION_GRANULARITY_3_WEEKS",
+        "AGGREGATION_GRANULARITY_4_WEEKS",
+        "AGGREGATION_GRANULARITY_1_MONTH",
+        "AGGREGATION_GRANULARITY_1_YEAR"
+      ],
+      "enum_launch_stages": {
+        "AGGREGATION_GRANULARITY_1_DAY": "PUBLIC_PREVIEW",
+        "AGGREGATION_GRANULARITY_1_HOUR": "PUBLIC_PREVIEW",
+        "AGGREGATION_GRANULARITY_1_MONTH": "PUBLIC_PREVIEW",
+        "AGGREGATION_GRANULARITY_1_WEEK": "PUBLIC_PREVIEW",
+        "AGGREGATION_GRANULARITY_1_YEAR": "PUBLIC_PREVIEW",
+        "AGGREGATION_GRANULARITY_2_WEEKS": "PUBLIC_PREVIEW",
+        "AGGREGATION_GRANULARITY_30_MINUTES": "PUBLIC_PREVIEW",
+        "AGGREGATION_GRANULARITY_3_WEEKS": "PUBLIC_PREVIEW",
+        "AGGREGATION_GRANULARITY_4_WEEKS": "PUBLIC_PREVIEW",
+        "AGGREGATION_GRANULARITY_5_MINUTES": "PUBLIC_PREVIEW"
+      }
+    },
+    "dataquality.AnomalyDetectionConfig": {
+      "description": "Anomaly Detection Configurations.",
+      "fields": {
+        "excluded_table_full_names": {
+          "description": "List of fully qualified table names to exclude from anomaly detection.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "dataquality.CancelRefreshRequest": {
+      "description": "Request to cancel a refresh."
+    },
+    "dataquality.CancelRefreshResponse": {
+      "description": "Response to cancelling a refresh.",
+      "fields": {
+        "refresh": {
+          "description": "The refresh to cancel.",
+          "ref": "dataquality.Refresh",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "dataquality.CreateMonitorRequest": {
+      "fields": {
+        "monitor": {
+          "description": "The monitor to create.",
+          "ref": "dataquality.Monitor",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "dataquality.CreateRefreshRequest": {
+      "fields": {
+        "refresh": {
+          "description": "The refresh to create",
+          "ref": "dataquality.Refresh",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "dataquality.CronSchedule": {
+      "description": "The data quality monitoring workflow cron schedule.",
+      "fields": {
+        "pause_status": {
+          "description": "Read only field that indicates whether the schedule is paused or not.",
+          "ref": "dataquality.CronSchedulePauseStatus",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "quartz_cron_expression": {
+          "description": "The expression that determines when to run the monitor. See [examples](https://www.quartz-scheduler.org/documentation/quartz-2.3.0/tutorials/crontrigger.html).",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "timezone_id": {
+          "description": "A Java timezone id. The schedule for a job will be resolved with respect to this timezone.\nSee `Java TimeZone \u003chttp://docs.oracle.com/javase/7/docs/api/java/util/TimeZone.html\u003e`_ for details.\nThe timezone id (e.g., ``America/Los_Angeles``) in which to evaluate the quartz expression.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "dataquality.CronSchedulePauseStatus": {
+      "description": "The data quality monitoring workflow cron schedule pause status.",
+      "enum": [
+        "CRON_SCHEDULE_PAUSE_STATUS_UNPAUSED",
+        "CRON_SCHEDULE_PAUSE_STATUS_PAUSED"
+      ],
+      "enum_launch_stages": {
+        "CRON_SCHEDULE_PAUSE_STATUS_PAUSED": "PUBLIC_PREVIEW",
+        "CRON_SCHEDULE_PAUSE_STATUS_UNPAUSED": "PUBLIC_PREVIEW"
+      }
+    },
+    "dataquality.DataProfilingConfig": {
+      "description": "Data Profiling Configurations.",
+      "fields": {
+        "assets_dir": {
+          "description": "Field for specifying the absolute path to a custom directory to store data-monitoring\nassets. Normally prepopulated to a default user location via UI and Python APIs.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "baseline_table_name": {
+          "description": "Baseline table name.\nBaseline data is used to compute drift from the data in the monitored `table_name`.\nThe baseline table and the monitored table shall have the same schema.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "custom_metrics": {
+          "description": "Custom metrics.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "dashboard_id": {
+          "description": "Id of dashboard that visualizes the computed metrics.\nThis can be empty if the monitor is in PENDING state.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "drift_metrics_table_name": {
+          "description": "Table that stores drift metrics data. Format: `catalog.schema.table_name`.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "effective_warehouse_id": {
+          "description": "The warehouse for dashboard creation",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "inference_log": {
+          "description": "`Analysis Configuration` for monitoring inference log tables.",
+          "ref": "dataquality.InferenceLogConfig",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "latest_monitor_failure_message": {
+          "description": "The latest error message for a monitor failure.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "monitor_version": {
+          "description": "Represents the current monitor configuration version in use. The version will be represented in a\nnumeric fashion (1,2,3...). The field has flexibility to take on negative values, which can indicate corrupted\nmonitor_version numbers.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "monitored_table_name": {
+          "description": "Unity Catalog table to monitor. Format: `catalog.schema.table_name`",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "notification_settings": {
+          "description": "Field for specifying notification settings.",
+          "ref": "dataquality.NotificationSettings",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "output_schema_id": {
+          "description": "ID of the schema where output tables are created.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "profile_metrics_table_name": {
+          "description": "Table that stores profile metrics data. Format: `catalog.schema.table_name`.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "schedule": {
+          "description": "The cron schedule.",
+          "ref": "dataquality.CronSchedule",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "skip_builtin_dashboard": {
+          "description": "Whether to skip creating a default dashboard summarizing data quality metrics.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "slicing_exprs": {
+          "description": "List of column expressions to slice data with for targeted analysis. The data is grouped by\neach expression independently, resulting in a separate slice for each predicate and its\ncomplements. For example `slicing_exprs=[“col_1”, “col_2 \u003e 10”]` will generate the following\nslices: two slices for `col_2 \u003e 10` (True and False), and one slice per unique value in\n`col1`. For high-cardinality columns, only the top 100 unique values by frequency will\ngenerate slices.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "snapshot": {
+          "description": "`Analysis Configuration` for monitoring snapshot tables.",
+          "ref": "dataquality.SnapshotConfig",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "status": {
+          "description": "The data profiling monitor status.",
+          "ref": "dataquality.DataProfilingStatus",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "time_series": {
+          "description": "`Analysis Configuration` for monitoring time series tables.",
+          "ref": "dataquality.TimeSeriesConfig",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "warehouse_id": {
+          "description": "Optional argument to specify the warehouse for dashboard creation. If not specified, the first running\nwarehouse will be used.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "dataquality.DataProfilingCustomMetric": {
+      "description": "Custom metric definition.",
+      "fields": {
+        "definition": {
+          "description": "Jinja template for a SQL expression that specifies how to compute the metric. See [create metric definition](https://docs.databricks.com/en/lakehouse-monitoring/custom-metrics.html#create-definition).",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "input_columns": {
+          "description": "A list of column names in the input table the metric should be computed for.\nCan use ``\":table\"`` to indicate that the metric needs information from multiple columns.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "name": {
+          "description": "Name of the metric in the output tables.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "output_data_type": {
+          "description": "The output type of the custom metric.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "type": {
+          "description": "The type of the custom metric.",
+          "ref": "dataquality.DataProfilingCustomMetricType",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "dataquality.DataProfilingCustomMetricType": {
+      "description": "The custom metric type.",
+      "enum": [
+        "DATA_PROFILING_CUSTOM_METRIC_TYPE_AGGREGATE",
+        "DATA_PROFILING_CUSTOM_METRIC_TYPE_DERIVED",
+        "DATA_PROFILING_CUSTOM_METRIC_TYPE_DRIFT"
+      ],
+      "enum_launch_stages": {
+        "DATA_PROFILING_CUSTOM_METRIC_TYPE_AGGREGATE": "PUBLIC_PREVIEW",
+        "DATA_PROFILING_CUSTOM_METRIC_TYPE_DERIVED": "PUBLIC_PREVIEW",
+        "DATA_PROFILING_CUSTOM_METRIC_TYPE_DRIFT": "PUBLIC_PREVIEW"
+      }
+    },
+    "dataquality.DataProfilingStatus": {
+      "description": "The status of the data profiling monitor.",
+      "enum": [
+        "DATA_PROFILING_STATUS_ACTIVE",
+        "DATA_PROFILING_STATUS_PENDING",
+        "DATA_PROFILING_STATUS_DELETE_PENDING",
+        "DATA_PROFILING_STATUS_ERROR",
+        "DATA_PROFILING_STATUS_FAILED"
+      ],
+      "enum_launch_stages": {
+        "DATA_PROFILING_STATUS_ACTIVE": "PUBLIC_PREVIEW",
+        "DATA_PROFILING_STATUS_DELETE_PENDING": "PUBLIC_PREVIEW",
+        "DATA_PROFILING_STATUS_ERROR": "PUBLIC_PREVIEW",
+        "DATA_PROFILING_STATUS_FAILED": "PUBLIC_PREVIEW",
+        "DATA_PROFILING_STATUS_PENDING": "PUBLIC_PREVIEW"
+      }
+    },
+    "dataquality.DeleteMonitorRequest": {},
+    "dataquality.DeleteRefreshRequest": {},
+    "dataquality.GetMonitorRequest": {},
+    "dataquality.GetRefreshRequest": {},
+    "dataquality.InferenceLogConfig": {
+      "description": "Inference log configuration.",
+      "fields": {
+        "granularities": {
+          "description": "List of granularities to use when aggregating data into time windows based on their timestamp.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "label_column": {
+          "description": "Column for the label.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "model_id_column": {
+          "description": "Column for the model identifier.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "prediction_column": {
+          "description": "Column for the prediction.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "problem_type": {
+          "description": "Problem type the model aims to solve.",
+          "ref": "dataquality.InferenceProblemType",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "timestamp_column": {
+          "description": "Column for the timestamp.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "dataquality.InferenceProblemType": {
+      "description": "Inference problem type the model aims to solve.",
+      "enum": [
+        "INFERENCE_PROBLEM_TYPE_CLASSIFICATION",
+        "INFERENCE_PROBLEM_TYPE_REGRESSION"
+      ],
+      "enum_launch_stages": {
+        "INFERENCE_PROBLEM_TYPE_CLASSIFICATION": "PUBLIC_PREVIEW",
+        "INFERENCE_PROBLEM_TYPE_REGRESSION": "PUBLIC_PREVIEW"
+      }
+    },
+    "dataquality.ListMonitorRequest": {
+      "fields": {
+        "page_size": {
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "dataquality.ListMonitorResponse": {
+      "description": "Response for listing Monitors.",
+      "fields": {
+        "monitors": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "next_page_token": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "dataquality.ListRefreshRequest": {
+      "fields": {
+        "page_size": {
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "dataquality.ListRefreshResponse": {
+      "description": "Response for listing refreshes.",
+      "fields": {
+        "next_page_token": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "refreshes": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "dataquality.Monitor": {
+      "description": "Monitor for the data quality of unity catalog entities such as schema or table.",
+      "fields": {
+        "anomaly_detection_config": {
+          "description": "Anomaly Detection Configuration, applicable to `schema` object types.",
+          "ref": "dataquality.AnomalyDetectionConfig",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "data_profiling_config": {
+          "description": "Data Profiling Configuration, applicable to `table` object types. Exactly one `Analysis Configuration`\nmust be present.",
+          "ref": "dataquality.DataProfilingConfig",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "object_id": {
+          "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "object_type": {
+          "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "dataquality.NotificationDestination": {
+      "description": "Destination of the data quality monitoring notification.",
+      "fields": {
+        "email_addresses": {
+          "description": "The list of email addresses to send the notification to. A maximum of 5 email addresses is supported.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "dataquality.NotificationSettings": {
+      "description": "Settings for sending notifications on the data quality monitoring.",
+      "fields": {
+        "on_failure": {
+          "description": "Destinations to send notifications on failure/timeout.",
+          "ref": "dataquality.NotificationDestination",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "dataquality.Refresh": {
+      "description": "The Refresh object gives information on a refresh of the data quality monitoring pipeline.",
+      "fields": {
+        "end_time_ms": {
+          "description": "Time when the refresh ended (milliseconds since 1/1/1970 UTC).",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "message": {
+          "description": "An optional message to give insight into the current state of the refresh (e.g. FAILURE messages).",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "object_id": {
+          "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "object_type": {
+          "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "refresh_id": {
+          "description": "Unique id of the refresh operation.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "start_time_ms": {
+          "description": "Time when the refresh started (milliseconds since 1/1/1970 UTC).",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "state": {
+          "description": "The current state of the refresh.",
+          "ref": "dataquality.RefreshState",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "trigger": {
+          "description": "What triggered the refresh.",
+          "ref": "dataquality.RefreshTrigger",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "dataquality.RefreshState": {
+      "description": "The state of the refresh.",
+      "enum": [
+        "MONITOR_REFRESH_STATE_UNKNOWN",
+        "MONITOR_REFRESH_STATE_PENDING",
+        "MONITOR_REFRESH_STATE_RUNNING",
+        "MONITOR_REFRESH_STATE_SUCCESS",
+        "MONITOR_REFRESH_STATE_FAILED",
+        "MONITOR_REFRESH_STATE_CANCELED"
+      ],
+      "enum_launch_stages": {
+        "MONITOR_REFRESH_STATE_CANCELED": "PUBLIC_PREVIEW",
+        "MONITOR_REFRESH_STATE_FAILED": "PUBLIC_PREVIEW",
+        "MONITOR_REFRESH_STATE_PENDING": "PUBLIC_PREVIEW",
+        "MONITOR_REFRESH_STATE_RUNNING": "PUBLIC_PREVIEW",
+        "MONITOR_REFRESH_STATE_SUCCESS": "PUBLIC_PREVIEW",
+        "MONITOR_REFRESH_STATE_UNKNOWN": "PUBLIC_PREVIEW"
+      }
+    },
+    "dataquality.RefreshTrigger": {
+      "description": "The trigger of the refresh.",
+      "enum": [
+        "MONITOR_REFRESH_TRIGGER_UNKNOWN",
+        "MONITOR_REFRESH_TRIGGER_MANUAL",
+        "MONITOR_REFRESH_TRIGGER_SCHEDULE",
+        "MONITOR_REFRESH_TRIGGER_DATA_CHANGE"
+      ],
+      "enum_launch_stages": {
+        "MONITOR_REFRESH_TRIGGER_DATA_CHANGE": "PUBLIC_PREVIEW",
+        "MONITOR_REFRESH_TRIGGER_MANUAL": "PUBLIC_PREVIEW",
+        "MONITOR_REFRESH_TRIGGER_SCHEDULE": "PUBLIC_PREVIEW",
+        "MONITOR_REFRESH_TRIGGER_UNKNOWN": "PUBLIC_PREVIEW"
+      }
+    },
+    "dataquality.SnapshotConfig": {
+      "description": "Snapshot analysis configuration."
+    },
+    "dataquality.TimeSeriesConfig": {
+      "description": "Time series analysis configuration.",
+      "fields": {
+        "granularities": {
+          "description": "List of granularities to use when aggregating data into time windows based on their timestamp.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "timestamp_column": {
+          "description": "Column for the timestamp.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "dataquality.UpdateMonitorRequest": {
+      "fields": {
+        "monitor": {
+          "description": "The monitor to update.",
+          "ref": "dataquality.Monitor",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "update_mask": {
+          "description": "The field mask to specify which fields to update as a comma-separated list.\nExample value: `data_profiling_config.custom_metrics,data_profiling_config.schedule.quartz_cron_expression`",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "dataquality.UpdateRefreshRequest": {
+      "fields": {
+        "refresh": {
+          "description": "The refresh to update.",
+          "ref": "dataquality.Refresh",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "update_mask": {
+          "description": "The field mask to specify which fields to update.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "disasterrecovery.CreateFailoverGroupRequest": {
+      "fields": {
+        "failover_group": {
+          "description": "The failover group to create.",
+          "ref": "disasterrecovery.FailoverGroup",
+          "launch_stage": "GA"
+        },
+        "failover_group_id": {
+          "description": "Client-provided identifier for the failover group. Used to construct the\nresource name as {parent}/failover-groups/{failover_group_id}.",
+          "launch_stage": "GA"
+        },
+        "validate_only": {
+          "description": "When true, validates the request without creating the failover group.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "disasterrecovery.CreateStableUrlRequest": {
+      "fields": {
+        "stable_url": {
+          "description": "The stable URL to create.",
+          "ref": "disasterrecovery.StableUrl",
+          "launch_stage": "GA"
+        },
+        "stable_url_id": {
+          "description": "Client-provided identifier for the stable URL. Used to construct the\nresource name as {parent}/stable-urls/{stable_url_id}.",
+          "launch_stage": "GA"
+        },
+        "validate_only": {
+          "description": "When true, validates the request without creating the stable URL.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "disasterrecovery.DeleteFailoverGroupRequest": {
+      "fields": {
+        "etag": {
+          "description": "Opaque version string for optimistic locking. If provided, must match the\ncurrent etag. If omitted, the delete proceeds without an etag check.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "disasterrecovery.DeleteStableUrlRequest": {},
+    "disasterrecovery.FailoverFailoverGroupRequest": {
+      "description": "Request to failover a failover group to a new primary region.",
+      "fields": {
+        "etag": {
+          "description": "Opaque version string for optimistic locking. If provided, must match the\ncurrent etag. If omitted, the failover proceeds regardless of current state.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "failover_type": {
+          "description": "The type of failover to perform.",
+          "ref": "disasterrecovery.FailoverFailoverGroupRequestFailoverType",
+          "launch_stage": "GA"
+        },
+        "target_primary_region": {
+          "description": "The target primary region. Must be one of the participating regions and different\nfrom the current effective_primary_region. Serves as an idempotency check.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "disasterrecovery.FailoverFailoverGroupRequestFailoverType": {
+      "description": "The type of failover to perform.",
+      "enum": [
+        "FORCED"
+      ],
+      "enum_launch_stages": {
+        "FORCED": "GA"
+      }
+    },
+    "disasterrecovery.FailoverGroup": {
+      "description": "A failover group manages disaster recovery across workspace sets,\ncoordinating Unity Catalog and workspace assets replication.",
+      "fields": {
+        "create_time": {
+          "description": "Time at which this failover group was created.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "effective_primary_region": {
+          "description": "Current effective primary region. Replication flows FROM workspaces in this region.\nChanges after a successful failover.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "etag": {
+          "description": "Opaque version string for optimistic locking. Server-generated and returned in responses.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "has_replication_point_blocking_errors": {
+          "description": "True if errors currently block the replication point.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "initial_primary_region": {
+          "description": "Initial primary region. Used only in Create requests to set the starting\nprimary region. Not returned in responses.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE",
+            "INPUT_ONLY"
+          ]
+        },
+        "initial_replication_progress": {
+          "description": "Initial replication progress of all in-scope assets. Set only when the FailoverGroup is in INITIAL_REPLICATION state.",
+          "ref": "disasterrecovery.InitialReplicationProgress",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "Fully qualified resource name in the format\naccounts/{account_id}/failover-groups/{failover_group_id}.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "regions": {
+          "description": "List of all regions participating in this failover group.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "replication_point": {
+          "description": "The latest point in time to which data has been replicated.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "state": {
+          "description": "Aggregate state of the failover group.",
+          "ref": "disasterrecovery.FailoverGroupState",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "unity_catalog_assets": {
+          "description": "Unity Catalog replication configuration.",
+          "ref": "disasterrecovery.UcReplicationConfig",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "update_time": {
+          "description": "Time at which this failover group was last modified.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "workspace_sets": {
+          "description": "Workspace sets, each containing workspaces that replicate to each other.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "disasterrecovery.FailoverGroupState": {
+      "description": "The aggregate state of a FailoverGroup.",
+      "enum": [
+        "CREATING",
+        "CREATION_FAILED",
+        "INITIAL_REPLICATION",
+        "ACTIVE",
+        "FAILING_OVER",
+        "DELETING",
+        "FAILOVER_FAILED",
+        "DELETION_FAILED"
+      ],
+      "enum_launch_stages": {
+        "ACTIVE": "GA",
+        "CREATING": "GA",
+        "CREATION_FAILED": "GA",
+        "DELETING": "GA",
+        "DELETION_FAILED": "GA",
+        "FAILING_OVER": "GA",
+        "FAILOVER_FAILED": "GA",
+        "INITIAL_REPLICATION": "GA"
+      }
+    },
+    "disasterrecovery.GetFailoverGroupRequest": {},
+    "disasterrecovery.GetStableUrlRequest": {},
+    "disasterrecovery.InitialReplicationProgress": {
+      "description": "Progress of the initial replication of all in-scope assets (Unity Catalog and\nworkspace assets) of a FailoverGroup. Populated only while the FailoverGroup\nis in INITIAL_REPLICATION.",
+      "fields": {
+        "completed": {
+          "description": "Percent complete, 0-100.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "disasterrecovery.ListFailoverGroupsRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Maximum number of failover groups to return per page:\n- when set to a value greater than 0, the page length is the minimum of this value\nand a server configured value;\n- when set to 0 or unset, the page length is set to a server configured value\n(recommended);\n- when set to a value less than 0, an invalid parameter error is returned.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Page token received from a previous ListFailoverGroups call.\nProvide this to retrieve the subsequent page.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "disasterrecovery.ListFailoverGroupsResponse": {
+      "description": "Response for listing failover groups.",
+      "fields": {
+        "failover_groups": {
+          "description": "The failover groups for this account.",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "A token that can be sent as page_token to retrieve the next page.\nIf omitted, there are no subsequent pages.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "disasterrecovery.ListStableUrlsRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Maximum number of stable URLs to return per page:\n- when set to a value greater than 0, the page length is the minimum of this value\nand a server configured value;\n- when set to 0 or unset, the page length is set to a server configured value\n(recommended);\n- when set to a value less than 0, an invalid parameter error is returned.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Page token received from a previous ListStableUrls call.\nProvide this to retrieve the subsequent page.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "disasterrecovery.ListStableUrlsResponse": {
+      "description": "Response for listing stable URLs.",
+      "fields": {
+        "next_page_token": {
+          "description": "A token that can be sent as page_token to retrieve the next page.\nIf omitted, there are no subsequent pages.",
+          "launch_stage": "GA"
+        },
+        "stable_urls": {
+          "description": "The stable URLs for this account.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "disasterrecovery.LocationMapping": {
+      "description": "A location mapping identified by a name, with URIs per region.\nThe system derives replication direction from effective_primary_region.",
+      "fields": {
+        "name": {
+          "description": "Resource name for this location.",
+          "launch_stage": "GA"
+        },
+        "uri_by_region": {
+          "description": "URI for each region. Each entry maps a region name to a storage URI.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "disasterrecovery.LocationMappingEntry": {
+      "description": "A single entry in a location mapping, mapping a region to a storage URI.\nUsed instead of map\u003cstring, string\u003e for proto2 compatibility.",
+      "fields": {
+        "region": {
+          "description": "The region name.",
+          "launch_stage": "GA"
+        },
+        "uri": {
+          "description": "The storage URI for this region.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "disasterrecovery.StableUrl": {
+      "description": "A stable URL provides a failover-aware endpoint for accessing a workspace.\nIts lifecycle is independent of any failover group.",
+      "fields": {
+        "effective_workspace_id": {
+          "description": "The workspace this stable URL currently routes to. Set to\n`initial_workspace_id` at creation, advanced to the failover group's primary\nwhile attached (including across a failover), and preserved when the stable\nURL is detached from its failover group. Read this to see where an unattached\nstable URL points: after a failover followed by a detach it reflects the\npost-failover primary, not `initial_workspace_id`.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "failover_group_name": {
+          "description": "Fully qualified resource name of the FailoverGroup this stable URL is\ncurrently linked to, in the format\n`accounts/{account_id}/failover-groups/{failover_group_id}`. Empty when\nthe stable URL is not attached to any failover group.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "initial_workspace_id": {
+          "description": "The workspace this stable URL is initially bound to. Used only in Create\nrequests to associate the stable URL with a workspace. Not returned in\nresponses.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE",
+            "INPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "Fully qualified resource name.\nFormat: accounts/{account_id}/stable-urls/{stable_url_id}.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "stable_workspace_id": {
+          "description": "The stable workspace ID for this stable URL. Generated on creation and\nimmutable thereafter; identifies the URL across failovers and is the same\nvalue embedded in the `url` (as the `w=` query parameter for SPOG URLs,\nor in the `conn-\u003cid\u003e` hostname for Private-Link URLs).",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE",
+            "OUTPUT_ONLY"
+          ]
+        },
+        "url": {
+          "description": "The stable URL endpoint. Generated on creation and\nimmutable thereafter. For non-Private-Link workspaces this is\n`https://\u003cspog_host\u003e/?w=\u003cconnection_id\u003e`. For Private-Link workspaces\nthis is the per-connection hostname.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE",
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "disasterrecovery.UcCatalog": {
+      "description": "A Unity Catalog catalog to replicate.",
+      "fields": {
+        "name": {
+          "description": "The name of the UC catalog to replicate.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "disasterrecovery.UcReplicationConfig": {
+      "description": "Unity Catalog replication configuration (top-level, not per-set).",
+      "fields": {
+        "catalogs": {
+          "description": "UC catalogs to replicate.",
+          "launch_stage": "GA"
+        },
+        "data_replication_workspace_set": {
+          "description": "The workspace set whose workspaces will be used for data replication\nof all UC catalogs' underlying storage.",
+          "launch_stage": "GA"
+        },
+        "location_mappings": {
+          "description": "Location mappings - storage URI per region for each location.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "disasterrecovery.UpdateFailoverGroupRequest": {
+      "fields": {
+        "etag": {
+          "description": "Optional opaque version string for optimistic locking, obtained from a prior read of\nthe failover group. If provided, the update is rejected unless it matches the failover\ngroup's current etag. If omitted, the update proceeds without an optimistic-lock check.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "failover_group": {
+          "description": "The failover group with updated fields. The name field identifies the resource\nand is populated from the URL path.",
+          "ref": "disasterrecovery.FailoverGroup",
+          "launch_stage": "GA"
+        },
+        "update_mask": {
+          "description": "Comma-separated list of fields to update.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "disasterrecovery.WorkspaceSet": {
+      "description": "A set of workspaces that replicate to each other across regions.",
+      "fields": {
+        "name": {
+          "description": "Resource name for this workspace set.",
+          "launch_stage": "GA"
+        },
+        "replicate_workspace_assets": {
+          "description": "Whether to enable control plane DR (notebooks, jobs, clusters, etc.) for this set.\nDefaults to false.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "stable_url_names": {
+          "description": "Resource names of stable URLs associated with this workspace set.\nFormat: accounts/{account_id}/stable-urls/{stable_url_id}.\nThe referenced stable URLs must already exist (via CreateStableUrl).",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "workspace_ids": {
+          "description": "Workspace IDs in this set. The system derives and validates regions.\nAll workspaces must be in the Mission Critical tier.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "domains.CreateDomainRequest": {
+      "fields": {
+        "domain": {
+          "ref": "domains.Domain",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "domain_id": {
+          "description": "Client-supplied resource ID for the new domain. If omitted, the server\ngenerates one.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "domains.DeleteDomainRequest": {
+      "fields": {
+        "force": {
+          "description": "When false (default), DeleteDomain is rejected with FAILED_PRECONDITION if\nthe domain still has Glossary pages. When true, those pages are deleted\nfirst and then the domain is removed.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "INPUT_ONLY",
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "domains.Domain": {
+      "fields": {
+        "business_owner_ids": {
+          "description": "Principal IDs of the business owners (users, groups, or service principals).",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "create_time": {
+          "description": "Timestamp when the domain was created.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "description": {
+          "description": "Full description (max 4096 chars)",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "domain_id": {
+          "description": "Unique identifier for the domain. If omitted at Create, the server\ngenerates one.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "draft": {
+          "description": "Whether to mark the domain as a draft. If omitted on Create, the server\napplies a default; the resolved value is returned in `effective_draft`.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "INPUT_ONLY",
+            "OPTIONAL"
+          ]
+        },
+        "effective_draft": {
+          "description": "Resolved draft state of the domain.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "icon": {
+          "description": "Icon to display for the domain.",
+          "ref": "domains.DomainIcon",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "name": {
+          "description": "Full resource name of the domain. The primary identifier for this resource.\nFormat: `domains/{domain_id}`\nIdentifies the domain on get, update, and delete. Not an input on\ncreate — to choose the id, set `CreateDomainRequest.domain_id`.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "parent_domain_id": {
+          "description": "Domain ID of the parent. If absent, this is a top-level domain.\nIf present, this domain is a subdomain of the specified parent.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "IMMUTABLE",
+            "OPTIONAL"
+          ]
+        },
+        "subtitle": {
+          "description": "Short description (max 280 chars)",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "tag_key": {
+          "description": "Governed tag key associated with this domain.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "technical_owner_ids": {
+          "description": "Principal IDs of the technical owners (users, groups, or service principals).",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "update_time": {
+          "description": "Timestamp when the domain was last updated.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "domains.DomainIcon": {
+      "description": "Icon configuration for a domain.",
+      "fields": {
+        "color": {
+          "description": "Hex color code with # prefix (e.g., \"#FF5733\").",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "name": {
+          "ref": "domains.DomainIconName",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "domains.DomainIconName": {
+      "description": "Available icon names for a domain.",
+      "enum": [
+        "ADDRESS_BOOK",
+        "ALARM",
+        "ARROWS_IN",
+        "ATOM",
+        "BALLOON",
+        "BANK",
+        "BARRICADE",
+        "BASKET",
+        "BRIDGE",
+        "CACTUS",
+        "CALL_BELL",
+        "CARROT",
+        "CHART_PIE_SLICE",
+        "CITY",
+        "CLOUD",
+        "COINS",
+        "COMPASS_ROSE",
+        "CRANE_TOWER",
+        "CROWN",
+        "CUBE_TRANSPARENT",
+        "FADERS",
+        "FLAG_BANNER_FOLD",
+        "FLAG_CHECKERED",
+        "GAVEL",
+        "HAMBURGER",
+        "HEAD_CIRCUIT",
+        "HOURGLASS_HIGH",
+        "INTERSECT_THREE",
+        "MICROSCOPE",
+        "MOON_STARS",
+        "PACKAGE",
+        "PARACHUTE",
+        "PEPPER",
+        "PIGGY_BANK",
+        "PILL",
+        "PLANET",
+        "PLANT",
+        "PLUGS_CONNECTED",
+        "POPCORN",
+        "PRESENTATION_CHART",
+        "PUZZLE_PIECE",
+        "RAINBOW",
+        "RANKING",
+        "RECEIPT",
+        "ROCKET",
+        "RULER",
+        "SAILBOAT",
+        "SCALES",
+        "SCAN_SMILEY",
+        "SCROLL",
+        "SHIELD_CHECKERED",
+        "SNEAKER",
+        "SNOWFLAKE",
+        "SOLAR_ROOF",
+        "SPEEDOMETER",
+        "STAMP",
+        "STEPS",
+        "STRATEGY",
+        "SWORD",
+        "TELEVISION_SIMPLE",
+        "TENT",
+        "TICKET",
+        "TRACTOR",
+        "TRAFFIC_CONE",
+        "TRAIN",
+        "TREE_EVERGREEN",
+        "TREE_STRUCTURE",
+        "TROLLEY_SUITCASE",
+        "TROPHY",
+        "TRUCK_TRAILER",
+        "USERS_THREE",
+        "VECTOR_THREE"
+      ],
+      "enum_launch_stages": {
+        "ADDRESS_BOOK": "PUBLIC_BETA",
+        "ALARM": "PUBLIC_BETA",
+        "ARROWS_IN": "PUBLIC_BETA",
+        "ATOM": "PUBLIC_BETA",
+        "BALLOON": "PUBLIC_BETA",
+        "BANK": "PUBLIC_BETA",
+        "BARRICADE": "PUBLIC_BETA",
+        "BASKET": "PUBLIC_BETA",
+        "BRIDGE": "PUBLIC_BETA",
+        "CACTUS": "PUBLIC_BETA",
+        "CALL_BELL": "PUBLIC_BETA",
+        "CARROT": "PUBLIC_BETA",
+        "CHART_PIE_SLICE": "PUBLIC_BETA",
+        "CITY": "PUBLIC_BETA",
+        "CLOUD": "PUBLIC_BETA",
+        "COINS": "PUBLIC_BETA",
+        "COMPASS_ROSE": "PUBLIC_BETA",
+        "CRANE_TOWER": "PUBLIC_BETA",
+        "CROWN": "PUBLIC_BETA",
+        "CUBE_TRANSPARENT": "PUBLIC_BETA",
+        "FADERS": "PUBLIC_BETA",
+        "FLAG_BANNER_FOLD": "PUBLIC_BETA",
+        "FLAG_CHECKERED": "PUBLIC_BETA",
+        "GAVEL": "PUBLIC_BETA",
+        "HAMBURGER": "PUBLIC_BETA",
+        "HEAD_CIRCUIT": "PUBLIC_BETA",
+        "HOURGLASS_HIGH": "PUBLIC_BETA",
+        "INTERSECT_THREE": "PUBLIC_BETA",
+        "MICROSCOPE": "PUBLIC_BETA",
+        "MOON_STARS": "PUBLIC_BETA",
+        "PACKAGE": "PUBLIC_BETA",
+        "PARACHUTE": "PUBLIC_BETA",
+        "PEPPER": "PUBLIC_BETA",
+        "PIGGY_BANK": "PUBLIC_BETA",
+        "PILL": "PUBLIC_BETA",
+        "PLANET": "PUBLIC_BETA",
+        "PLANT": "PUBLIC_BETA",
+        "PLUGS_CONNECTED": "PUBLIC_BETA",
+        "POPCORN": "PUBLIC_BETA",
+        "PRESENTATION_CHART": "PUBLIC_BETA",
+        "PUZZLE_PIECE": "PUBLIC_BETA",
+        "RAINBOW": "PUBLIC_BETA",
+        "RANKING": "PUBLIC_BETA",
+        "RECEIPT": "PUBLIC_BETA",
+        "ROCKET": "PUBLIC_BETA",
+        "RULER": "PUBLIC_BETA",
+        "SAILBOAT": "PUBLIC_BETA",
+        "SCALES": "PUBLIC_BETA",
+        "SCAN_SMILEY": "PUBLIC_BETA",
+        "SCROLL": "PUBLIC_BETA",
+        "SHIELD_CHECKERED": "PUBLIC_BETA",
+        "SNEAKER": "PUBLIC_BETA",
+        "SNOWFLAKE": "PUBLIC_BETA",
+        "SOLAR_ROOF": "PUBLIC_BETA",
+        "SPEEDOMETER": "PUBLIC_BETA",
+        "STAMP": "PUBLIC_BETA",
+        "STEPS": "PUBLIC_BETA",
+        "STRATEGY": "PUBLIC_BETA",
+        "SWORD": "PUBLIC_BETA",
+        "TELEVISION_SIMPLE": "PUBLIC_BETA",
+        "TENT": "PUBLIC_BETA",
+        "TICKET": "PUBLIC_BETA",
+        "TRACTOR": "PUBLIC_BETA",
+        "TRAFFIC_CONE": "PUBLIC_BETA",
+        "TRAIN": "PUBLIC_BETA",
+        "TREE_EVERGREEN": "PUBLIC_BETA",
+        "TREE_STRUCTURE": "PUBLIC_BETA",
+        "TROLLEY_SUITCASE": "PUBLIC_BETA",
+        "TROPHY": "PUBLIC_BETA",
+        "TRUCK_TRAILER": "PUBLIC_BETA",
+        "USERS_THREE": "PUBLIC_BETA",
+        "VECTOR_THREE": "PUBLIC_BETA"
+      }
+    },
+    "domains.GetDomainRequest": {},
+    "domains.ListDomainsRequest": {
+      "fields": {
+        "page_size": {
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "parent_domain_id": {
+          "description": "Filter by parent domain.\n- Absent: return all domains regardless of hierarchy.\n- Present: return only direct children of the specified domain.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "domains.ListDomainsResponse": {
+      "fields": {
+        "domains": {
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "next_page_token": {
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "domains.UpdateDomainRequest": {
+      "fields": {
+        "domain": {
+          "ref": "domains.Domain",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "update_mask": {
+          "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "environments.BaseEnvironmentType": {
+      "description": "If changed, also update estore/namespaces/defaultbaseenvironments/latest.proto",
+      "enum": [
+        "CPU",
+        "GPU"
+      ],
+      "enum_launch_stages": {
+        "CPU": "GA",
+        "GPU": "GA"
+      }
+    },
+    "environments.CreateWorkspaceBaseEnvironmentRequest": {
+      "fields": {
+        "request_id": {
+          "description": "A unique identifier for this request. A random UUID is recommended.\nThis request is only idempotent if a request_id is provided.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "workspace_base_environment": {
+          "description": "Required. The workspace base environment to create.",
+          "ref": "environments.WorkspaceBaseEnvironment",
+          "launch_stage": "GA"
+        },
+        "workspace_base_environment_id": {
+          "description": "The ID to use for the workspace base environment, which will become the final component of\nthe resource name.\nThis value should be 4-63 characters, and valid characters are /[a-z][0-9]-/.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "environments.DatabricksServiceExceptionWithDetailsProto": {
+      "description": "Databricks Error that is returned by all Databricks APIs.",
+      "fields": {
+        "details": {
+          "launch_stage": "GA"
+        },
+        "error_code": {
+          "ref": "environments.ErrorCode",
+          "launch_stage": "GA"
+        },
+        "message": {
+          "launch_stage": "GA"
+        },
+        "stack_trace": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "environments.DefaultWorkspaceBaseEnvironment": {
+      "description": "A singleton resource representing the default workspace base environment configuration.\nThis resource contains the workspace base environments that are used as defaults\nfor serverless notebooks and jobs in the workspace, for both CPU and GPU compute types.",
+      "fields": {
+        "cpu_workspace_base_environment": {
+          "description": "The default workspace base environment for CPU compute.\nFormat: workspace-base-environments/{workspace_base_environment}",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "gpu_workspace_base_environment": {
+          "description": "The default workspace base environment for GPU compute.\nFormat: workspace-base-environments/{workspace_base_environment}",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "name": {
+          "description": "The resource name of this singleton resource.\nFormat: default-workspace-base-environment",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        }
+      }
+    },
+    "environments.DeleteWorkspaceBaseEnvironmentRequest": {},
+    "environments.EnvironmentSpec": {
+      "description": "Environment specification for a WorkspaceBaseEnvironment.\nContains the environment version and dependencies configuration.",
+      "fields": {
+        "dependencies": {
+          "description": "List of pip dependencies, as supported by the version of pip in this environment.\nEach dependency is a valid pip requirements file line per https://pip.pypa.io/en/stable/reference/requirements-file-format/.\nAllowed dependencies include a requirement specifier, an archive URL, a local project path (such as WSFS or UC Volumes in Databricks), or a VCS project URL.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "environment_version": {
+          "description": "Environment version used by the environment.\nEach version comes with a specific Python version and a set of Python packages.\nThe version is a string, consisting of an integer.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "environments.ErrorCode": {
+      "description": "Error codes returned by Databricks APIs to indicate specific failure conditions.",
+      "enum": [
+        "UNKNOWN",
+        "INTERNAL_ERROR",
+        "TEMPORARILY_UNAVAILABLE",
+        "IO_ERROR",
+        "BAD_REQUEST",
+        "SERVICE_UNDER_MAINTENANCE",
+        "WORKSPACE_TEMPORARILY_UNAVAILABLE",
+        "DEADLINE_EXCEEDED",
+        "CANCELLED",
+        "RESOURCE_EXHAUSTED",
+        "ABORTED",
+        "NOT_FOUND",
+        "ALREADY_EXISTS",
+        "UNAUTHENTICATED",
+        "UNAVAILABLE",
+        "INVALID_PARAMETER_VALUE",
+        "ENDPOINT_NOT_FOUND",
+        "MALFORMED_REQUEST",
+        "INVALID_STATE",
+        "PERMISSION_DENIED",
+        "FEATURE_DISABLED",
+        "CUSTOMER_UNAUTHORIZED",
+        "REQUEST_LIMIT_EXCEEDED",
+        "RESOURCE_CONFLICT",
+        "UNPARSEABLE_HTTP_ERROR",
+        "NOT_IMPLEMENTED",
+        "DATA_LOSS",
+        "INVALID_STATE_TRANSITION",
+        "COULD_NOT_ACQUIRE_LOCK",
+        "RESOURCE_ALREADY_EXISTS",
+        "RESOURCE_DOES_NOT_EXIST",
+        "QUOTA_EXCEEDED",
+        "MAX_BLOCK_SIZE_EXCEEDED",
+        "MAX_READ_SIZE_EXCEEDED",
+        "PARTIAL_DELETE",
+        "MAX_LIST_SIZE_EXCEEDED",
+        "DRY_RUN_FAILED",
+        "RESOURCE_LIMIT_EXCEEDED",
+        "DIRECTORY_NOT_EMPTY",
+        "DIRECTORY_PROTECTED",
+        "MAX_NOTEBOOK_SIZE_EXCEEDED",
+        "MAX_CHILD_NODE_SIZE_EXCEEDED",
+        "SEARCH_QUERY_TOO_LONG",
+        "SEARCH_QUERY_TOO_SHORT",
+        "MANAGED_RESOURCE_GROUP_DOES_NOT_EXIST",
+        "PERMISSION_NOT_PROPAGATED",
+        "DEPLOYMENT_TIMEOUT",
+        "GIT_CONFLICT",
+        "GIT_UNKNOWN_REF",
+        "GIT_SENSITIVE_TOKEN_DETECTED",
+        "GIT_URL_NOT_ON_ALLOW_LIST",
+        "GIT_REMOTE_ERROR",
+        "PROJECTS_OPERATION_TIMEOUT",
+        "IPYNB_FILE_IN_REPO",
+        "INSECURE_PARTNER_RESPONSE",
+        "MALFORMED_PARTNER_RESPONSE",
+        "METASTORE_DOES_NOT_EXIST",
+        "DAC_DOES_NOT_EXIST",
+        "CATALOG_DOES_NOT_EXIST",
+        "SCHEMA_DOES_NOT_EXIST",
+        "TABLE_DOES_NOT_EXIST",
+        "SHARE_DOES_NOT_EXIST",
+        "RECIPIENT_DOES_NOT_EXIST",
+        "STORAGE_CREDENTIAL_DOES_NOT_EXIST",
+        "EXTERNAL_LOCATION_DOES_NOT_EXIST",
+        "PRINCIPAL_DOES_NOT_EXIST",
+        "PROVIDER_DOES_NOT_EXIST",
+        "METASTORE_ALREADY_EXISTS",
+        "DAC_ALREADY_EXISTS",
+        "CATALOG_ALREADY_EXISTS",
+        "SCHEMA_ALREADY_EXISTS",
+        "TABLE_ALREADY_EXISTS",
+        "SHARE_ALREADY_EXISTS",
+        "RECIPIENT_ALREADY_EXISTS",
+        "STORAGE_CREDENTIAL_ALREADY_EXISTS",
+        "EXTERNAL_LOCATION_ALREADY_EXISTS",
+        "PROVIDER_ALREADY_EXISTS",
+        "CATALOG_NOT_EMPTY",
+        "SCHEMA_NOT_EMPTY",
+        "METASTORE_NOT_EMPTY",
+        "PROVIDER_SHARE_NOT_ACCESSIBLE"
+      ],
+      "enum_launch_stages": {
+        "ABORTED": "GA",
+        "ALREADY_EXISTS": "GA",
+        "BAD_REQUEST": "GA",
+        "CANCELLED": "GA",
+        "CATALOG_ALREADY_EXISTS": "GA",
+        "CATALOG_DOES_NOT_EXIST": "GA",
+        "CATALOG_NOT_EMPTY": "GA",
+        "COULD_NOT_ACQUIRE_LOCK": "GA",
+        "CUSTOMER_UNAUTHORIZED": "GA",
+        "DAC_ALREADY_EXISTS": "GA",
+        "DAC_DOES_NOT_EXIST": "GA",
+        "DATA_LOSS": "GA",
+        "DEADLINE_EXCEEDED": "GA",
+        "DEPLOYMENT_TIMEOUT": "GA",
+        "DIRECTORY_NOT_EMPTY": "GA",
+        "DIRECTORY_PROTECTED": "GA",
+        "DRY_RUN_FAILED": "GA",
+        "ENDPOINT_NOT_FOUND": "GA",
+        "EXTERNAL_LOCATION_ALREADY_EXISTS": "GA",
+        "EXTERNAL_LOCATION_DOES_NOT_EXIST": "GA",
+        "FEATURE_DISABLED": "GA",
+        "GIT_CONFLICT": "GA",
+        "GIT_REMOTE_ERROR": "GA",
+        "GIT_SENSITIVE_TOKEN_DETECTED": "GA",
+        "GIT_UNKNOWN_REF": "GA",
+        "GIT_URL_NOT_ON_ALLOW_LIST": "GA",
+        "INSECURE_PARTNER_RESPONSE": "GA",
+        "INTERNAL_ERROR": "GA",
+        "INVALID_PARAMETER_VALUE": "GA",
+        "INVALID_STATE": "GA",
+        "INVALID_STATE_TRANSITION": "GA",
+        "IO_ERROR": "GA",
+        "IPYNB_FILE_IN_REPO": "GA",
+        "MALFORMED_PARTNER_RESPONSE": "GA",
+        "MALFORMED_REQUEST": "GA",
+        "MANAGED_RESOURCE_GROUP_DOES_NOT_EXIST": "GA",
+        "MAX_BLOCK_SIZE_EXCEEDED": "GA",
+        "MAX_CHILD_NODE_SIZE_EXCEEDED": "GA",
+        "MAX_LIST_SIZE_EXCEEDED": "GA",
+        "MAX_NOTEBOOK_SIZE_EXCEEDED": "GA",
+        "MAX_READ_SIZE_EXCEEDED": "GA",
+        "METASTORE_ALREADY_EXISTS": "GA",
+        "METASTORE_DOES_NOT_EXIST": "GA",
+        "METASTORE_NOT_EMPTY": "GA",
+        "NOT_FOUND": "GA",
+        "NOT_IMPLEMENTED": "GA",
+        "PARTIAL_DELETE": "GA",
+        "PERMISSION_DENIED": "GA",
+        "PERMISSION_NOT_PROPAGATED": "GA",
+        "PRINCIPAL_DOES_NOT_EXIST": "GA",
+        "PROJECTS_OPERATION_TIMEOUT": "GA",
+        "PROVIDER_ALREADY_EXISTS": "GA",
+        "PROVIDER_DOES_NOT_EXIST": "GA",
+        "PROVIDER_SHARE_NOT_ACCESSIBLE": "GA",
+        "QUOTA_EXCEEDED": "GA",
+        "RECIPIENT_ALREADY_EXISTS": "GA",
+        "RECIPIENT_DOES_NOT_EXIST": "GA",
+        "REQUEST_LIMIT_EXCEEDED": "GA",
+        "RESOURCE_ALREADY_EXISTS": "GA",
+        "RESOURCE_CONFLICT": "GA",
+        "RESOURCE_DOES_NOT_EXIST": "GA",
+        "RESOURCE_EXHAUSTED": "GA",
+        "RESOURCE_LIMIT_EXCEEDED": "GA",
+        "SCHEMA_ALREADY_EXISTS": "GA",
+        "SCHEMA_DOES_NOT_EXIST": "GA",
+        "SCHEMA_NOT_EMPTY": "GA",
+        "SEARCH_QUERY_TOO_LONG": "GA",
+        "SEARCH_QUERY_TOO_SHORT": "GA",
+        "SERVICE_UNDER_MAINTENANCE": "GA",
+        "SHARE_ALREADY_EXISTS": "GA",
+        "SHARE_DOES_NOT_EXIST": "GA",
+        "STORAGE_CREDENTIAL_ALREADY_EXISTS": "GA",
+        "STORAGE_CREDENTIAL_DOES_NOT_EXIST": "GA",
+        "TABLE_ALREADY_EXISTS": "GA",
+        "TABLE_DOES_NOT_EXIST": "GA",
+        "TEMPORARILY_UNAVAILABLE": "GA",
+        "UNAUTHENTICATED": "GA",
+        "UNAVAILABLE": "GA",
+        "UNKNOWN": "GA",
+        "UNPARSEABLE_HTTP_ERROR": "GA",
+        "WORKSPACE_TEMPORARILY_UNAVAILABLE": "GA"
+      }
+    },
+    "environments.GetDefaultWorkspaceBaseEnvironmentRequest": {},
+    "environments.GetOperationRequest": {},
+    "environments.GetWorkspaceBaseEnvironmentRequest": {},
+    "environments.ListWorkspaceBaseEnvironmentsRequest": {
+      "fields": {
+        "page_size": {
+          "description": "The maximum number of environments to return per page.\nDefault is 1000.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Page token for pagination. Received from a previous ListWorkspaceBaseEnvironments call.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "environments.ListWorkspaceBaseEnvironmentsResponse": {
+      "description": "Response message for ListWorkspaceBaseEnvironments.",
+      "fields": {
+        "next_page_token": {
+          "description": "Token to retrieve the next page of results.\nEmpty if there are no more results.",
+          "launch_stage": "GA"
+        },
+        "workspace_base_environments": {
+          "description": "The list of workspace base environments.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "environments.Operation": {
+      "description": "This resource represents a long-running operation that is the result of a\nnetwork API call.",
+      "fields": {
+        "done": {
+          "description": "If the value is `false`, it means the operation is still in progress.\nIf `true`, the operation is completed, and either `error` or `response` is\navailable.",
+          "launch_stage": "GA"
+        },
+        "error": {
+          "description": "The error result of the operation in case of failure or cancellation.",
+          "ref": "environments.DatabricksServiceExceptionWithDetailsProto",
+          "launch_stage": "GA"
+        },
+        "metadata": {
+          "description": "Service-specific metadata associated with the operation.  It typically\ncontains progress information and common metadata such as create time.\nSome services might not provide such metadata.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The server-assigned name, which is only unique within the same service that\noriginally returns it. If you use the default HTTP mapping, the\n`name` should be a resource name ending with `operations/{unique_id}`.",
+          "launch_stage": "GA"
+        },
+        "response": {
+          "description": "The normal, successful response of the operation.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "environments.RefreshWorkspaceBaseEnvironmentRequest": {
+      "description": "Request message for RefreshWorkspaceBaseEnvironments."
+    },
+    "environments.UpdateDefaultWorkspaceBaseEnvironmentRequest": {
+      "fields": {
+        "default_workspace_base_environment": {
+          "description": "Required. The default workspace base environment configuration to update.",
+          "ref": "environments.DefaultWorkspaceBaseEnvironment",
+          "launch_stage": "GA"
+        },
+        "update_mask": {
+          "description": "Field mask specifying which fields to update. Use comma as the separator for multiple fields (no space).\nThe special value '*' indicates that all fields should be updated (full replacement).\nValid field paths: cpu_workspace_base_environment, gpu_workspace_base_environment\n\nTo unset one or both defaults, include the field path(s) in the mask and omit them from the request body.\nTo unset both, you must list both paths explicitly — the wildcard '*' cannot be used to unset fields.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "environments.UpdateWorkspaceBaseEnvironmentRequest": {
+      "fields": {
+        "workspace_base_environment": {
+          "description": "Required. The workspace base environment with updated fields.\nThe name field is used to identify the environment to update.",
+          "ref": "environments.WorkspaceBaseEnvironment",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "environments.WorkspaceBaseEnvironment": {
+      "description": "A WorkspaceBaseEnvironment defines a workspace-level environment configuration\nconsisting of an environment version and a list of dependencies.",
+      "fields": {
+        "base_environment_type": {
+          "description": "The type of base environment (CPU or GPU).",
+          "ref": "environments.BaseEnvironmentType",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "create_time": {
+          "description": "Timestamp when the environment was created.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "creator_user_id": {
+          "description": "User ID of the creator.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "display_name": {
+          "description": "Human-readable display name for the workspace base environment.",
+          "launch_stage": "GA"
+        },
+        "filepath": {
+          "description": "The WSFS or UC Volumes path to the environment YAML file.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "is_default": {
+          "description": "Whether this is the default environment for the workspace.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "last_updated_user_id": {
+          "description": "User ID of the last user who updated the environment.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "message": {
+          "description": "Status message providing additional details about the environment status.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "The resource name of the workspace base environment.\nFormat: workspace-base-environments/{workspace-base-environment}",
+          "launch_stage": "GA"
+        },
+        "spec": {
+          "description": "The environment specification containing version and dependencies.",
+          "ref": "environments.EnvironmentSpec",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "status": {
+          "description": "The status of the materialized workspace base environment.",
+          "ref": "environments.WorkspaceBaseEnvironmentCacheStatus",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "update_time": {
+          "description": "Timestamp when the environment was last updated.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "environments.WorkspaceBaseEnvironmentCacheStatus": {
+      "description": "Status of the environment materialization.",
+      "enum": [
+        "PENDING",
+        "CREATED",
+        "FAILED",
+        "EXPIRED",
+        "INVALID",
+        "REFRESHING"
+      ],
+      "enum_launch_stages": {
+        "CREATED": "GA",
+        "EXPIRED": "GA",
+        "FAILED": "GA",
+        "INVALID": "GA",
+        "PENDING": "GA",
+        "REFRESHING": "GA"
+      }
+    },
+    "environments.WorkspaceBaseEnvironmentOperationMetadata": {
+      "description": "Metadata for the WorkspaceBaseEnvironment long-running operations.\nThis message tracks the progress of the workspace base environment long-running process."
+    },
+    "files.AddBlock": {
+      "fields": {
+        "data": {
+          "description": "The base64-encoded data to append to the stream. This has a limit of 1 MB.",
+          "launch_stage": "GA"
+        },
+        "handle": {
+          "description": "The handle on an open stream.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "files.AddBlockResponse": {},
+    "files.Close": {
+      "fields": {
+        "handle": {
+          "description": "The handle on an open stream.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "files.CloseResponse": {},
+    "files.Create": {
+      "fields": {
+        "overwrite": {
+          "description": "The flag that specifies whether to overwrite existing file/files.",
+          "launch_stage": "GA"
+        },
+        "path": {
+          "description": "The path of the new file. The path should be the absolute DBFS path.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "files.CreateDirectoryRequest": {},
+    "files.CreateResponse": {
+      "fields": {
+        "handle": {
+          "description": "Handle which should subsequently be passed into the AddBlock and Close calls when writing to a file through a stream.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "files.Delete": {
+      "fields": {
+        "path": {
+          "description": "The path of the file or directory to delete. The path should be the absolute DBFS path.",
+          "launch_stage": "GA"
+        },
+        "recursive": {
+          "description": "Whether or not to recursively delete the directory's contents. Deleting empty directories can be done without providing the recursive flag.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "files.DeleteDirectoryRequest": {},
+    "files.DeleteFileRequest": {},
+    "files.DeleteResponse": {},
+    "files.DirectoryEntry": {
+      "fields": {
+        "file_size": {
+          "description": "The length of the file in bytes. This field is omitted for directories.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "is_directory": {
+          "description": "True if the path is a directory.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "last_modified": {
+          "description": "Last modification time of given file in milliseconds since unix epoch.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "name": {
+          "description": "The name of the file or directory. This is the last component of the path.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "path": {
+          "description": "The absolute path of the file or directory.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "files.DownloadRequest": {},
+    "files.DownloadResponse": {
+      "fields": {
+        "contents": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "files.FileInfo": {
+      "fields": {
+        "file_size": {
+          "description": "The length of the file in bytes. Set to 0 for directories.",
+          "launch_stage": "GA"
+        },
+        "is_dir": {
+          "description": "True if the path is a directory.",
+          "launch_stage": "GA"
+        },
+        "modification_time": {
+          "description": "Last modification time of given file in milliseconds since epoch.",
+          "launch_stage": "GA"
+        },
+        "path": {
+          "description": "The absolute path of the file or directory.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "files.GetDirectoryMetadataRequest": {},
+    "files.GetMetadataRequest": {},
+    "files.GetMetadataResponse": {},
+    "files.GetStatusRequest": {
+      "fields": {
+        "path": {
+          "description": "The path of the file or directory. The path should be the absolute DBFS path.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "files.ListDbfsRequest": {
+      "fields": {
+        "path": {
+          "description": "The path of the file or directory. The path should be the absolute DBFS path.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "files.ListDirectoryContentsRequest": {
+      "fields": {
+        "page_size": {
+          "description": "The maximum number of directory entries to return. The response may contain fewer\nentries. If the response contains a `next_page_token`, there may be more entries,\neven if fewer than `page_size` entries are in the response.\n\nWe recommend not to set this value unless you are intentionally listing less than\nthe complete directory contents.\n\nIf unspecified, at most 1000 directory entries will be returned.\nThe maximum value is 1000. Values above 1000 will be coerced to 1000.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "page_token": {
+          "description": "An opaque page token which was the `next_page_token` in the response of the previous\nrequest to list the contents of this directory. Provide this token to retrieve the\nnext page of directory entries.\nWhen providing a `page_token`, all other parameters provided to the request must match\nthe previous request.\nTo list all of the entries in a directory, it is necessary to continue requesting\npages of entries until the response contains no `next_page_token`. Note that the\nnumber of entries returned must not be used to determine when the listing is complete.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "files.ListDirectoryResponse": {
+      "fields": {
+        "contents": {
+          "description": "Array of DirectoryEntry.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "next_page_token": {
+          "description": "A token, which can be sent as `page_token` to retrieve the next page.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "files.ListStatusResponse": {
+      "fields": {
+        "files": {
+          "description": "A list of FileInfo's that describe contents of directory or file. See example above.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "files.MkDirs": {
+      "fields": {
+        "path": {
+          "description": "The path of the new directory. The path should be the absolute DBFS path.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "files.MkDirsResponse": {},
+    "files.Move": {
+      "fields": {
+        "destination_path": {
+          "description": "The destination path of the file or directory. The path should be the absolute DBFS path.",
+          "launch_stage": "GA"
+        },
+        "source_path": {
+          "description": "The source path of the file or directory. The path should be the absolute DBFS path.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "files.MoveResponse": {},
+    "files.Put": {
+      "fields": {
+        "contents": {
+          "description": "This parameter might be absent, and instead a posted file will be used.",
+          "launch_stage": "GA"
+        },
+        "overwrite": {
+          "description": "The flag that specifies whether to overwrite existing file/files.",
+          "launch_stage": "GA"
+        },
+        "path": {
+          "description": "The path of the new file. The path should be the absolute DBFS path.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "files.PutResponse": {},
+    "files.ReadDbfsRequest": {
+      "fields": {
+        "length": {
+          "description": "The number of bytes to read starting from the offset. This has a limit of 1 MB, and a default\nvalue of 0.5 MB.",
+          "launch_stage": "GA"
+        },
+        "offset": {
+          "description": "The offset to read from in bytes.",
+          "launch_stage": "GA"
+        },
+        "path": {
+          "description": "The path of the file to read. The path should be the absolute DBFS path.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "files.ReadResponse": {
+      "fields": {
+        "bytes_read": {
+          "description": "The number of bytes read (could be less than ``length`` if we hit end of file). This refers to\nnumber of bytes read in unencoded version (response data is base64-encoded).",
+          "launch_stage": "GA"
+        },
+        "data": {
+          "description": "The base64-encoded contents of the file read.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "files.UploadRequest": {
+      "fields": {
+        "contents": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "overwrite": {
+          "description": "If true or unspecified, an existing file will be overwritten. If false, an error will be returned if the path points to an existing file.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "iam.AccessControlRequest": {
+      "fields": {
+        "group_name": {
+          "description": "name of the group",
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "iam.PermissionLevel",
+          "launch_stage": "GA"
+        },
+        "service_principal_name": {
+          "description": "application ID of a service principal",
+          "launch_stage": "GA"
+        },
+        "user_name": {
+          "description": "name of the user",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "iam.AccessControlResponse": {
+      "fields": {
+        "all_permissions": {
+          "description": "All permissions.",
+          "launch_stage": "GA"
+        },
+        "display_name": {
+          "description": "Display name of the user or service principal.",
+          "launch_stage": "GA"
+        },
+        "group_name": {
+          "description": "name of the group",
+          "launch_stage": "GA"
+        },
+        "service_principal_name": {
+          "description": "Name of the service principal.",
+          "launch_stage": "GA"
+        },
+        "user_name": {
+          "description": "name of the user",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "iam.AccountGroup": {
+      "fields": {
+        "account_id": {
+          "description": "Databricks account ID",
+          "launch_stage": "GA"
+        },
+        "displayName": {
+          "description": "String that represents a human-readable group name",
+          "launch_stage": "GA"
+        },
+        "externalId": {
+          "description": "external_id should be unique for identifying groups",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "Databricks group ID",
+          "launch_stage": "GA"
+        },
+        "members": {
+          "launch_stage": "GA"
+        },
+        "meta": {
+          "description": "Container for the group identifier. Workspace local versus account.",
+          "ref": "iam.ResourceMeta",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "roles": {
+          "description": "Indicates if the group has the admin role.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "iam.AccountServicePrincipal": {
+      "fields": {
+        "account_id": {
+          "description": "Databricks account ID",
+          "launch_stage": "GA"
+        },
+        "active": {
+          "description": "If this user is active",
+          "launch_stage": "GA"
+        },
+        "applicationId": {
+          "description": "UUID relating to the service principal",
+          "launch_stage": "GA"
+        },
+        "displayName": {
+          "description": "String that represents a concatenation of given and family names.",
+          "launch_stage": "GA"
+        },
+        "externalId": {
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "Databricks service principal ID.",
+          "launch_stage": "GA"
+        },
+        "roles": {
+          "description": "Indicates if the group has the admin role.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "iam.AccountUser": {
+      "fields": {
+        "account_id": {
+          "description": "Databricks account ID",
+          "launch_stage": "GA"
+        },
+        "active": {
+          "description": "If this user is active",
+          "launch_stage": "GA"
+        },
+        "displayName": {
+          "description": "String that represents a concatenation of given and family names. For example `John Smith`.",
+          "launch_stage": "GA"
+        },
+        "emails": {
+          "description": "All the emails associated with the Databricks user. This attribute cannot be updated through the SCIM PATCH or PUT APIs; any supplied change is ignored.",
+          "launch_stage": "GA"
+        },
+        "externalId": {
+          "description": "External ID is not currently supported. It is reserved for future use.",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "Databricks user ID.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "ref": "iam.Name",
+          "launch_stage": "GA"
+        },
+        "roles": {
+          "description": "Indicates if the group has the admin role.",
+          "launch_stage": "GA"
+        },
+        "userName": {
+          "description": "Email address of the Databricks user. This attribute cannot be updated through the SCIM PATCH or PUT APIs; any supplied change is ignored.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "iam.Actor": {
+      "description": "represents an identity trying to access a resource - user or a service principal\ngroup can be a principal of a permission set assignment but an actor is always a user or a service principal",
+      "fields": {
+        "actor_id": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "iam.AutoscopeState": {
+      "description": "State of inferred scope collection (autoscope) for an external PAT.\nMirrored in databricks.identity.AutoscopeState in common/principal-context/api/proto/tokendetails.proto.\nToken store and token management proto can depend on this.\nPrincipal context proto should NOT depend on this proto definitions because too many services depend on the principal context proto.",
+      "enum": [
+        "AUTOSCOPE_STATE_DISABLED",
+        "AUTOSCOPE_STATE_RUNNING",
+        "AUTOSCOPE_STATE_COMPLETED",
+        "AUTOSCOPE_STATE_BACKFILLED",
+        "AUTOSCOPE_STATE_USER_SELECTED",
+        "AUTOSCOPE_STATE_API_NOT_COVERED"
+      ],
+      "enum_launch_stages": {
+        "AUTOSCOPE_STATE_API_NOT_COVERED": "PRIVATE_PREVIEW",
+        "AUTOSCOPE_STATE_BACKFILLED": "PRIVATE_PREVIEW",
+        "AUTOSCOPE_STATE_COMPLETED": "PRIVATE_PREVIEW",
+        "AUTOSCOPE_STATE_DISABLED": "PRIVATE_PREVIEW",
+        "AUTOSCOPE_STATE_RUNNING": "PRIVATE_PREVIEW",
+        "AUTOSCOPE_STATE_USER_SELECTED": "PRIVATE_PREVIEW"
+      }
+    },
+    "iam.CheckPolicyRequest": {
+      "fields": {
+        "actor": {
+          "ref": "iam.Actor",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "authz_identity": {
+          "ref": "iam.RequestAuthzIdentity",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "consistency_token": {
+          "ref": "iam.ConsistencyToken",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "permission": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "resource": {
+          "description": "Ex: (servicePrincipal/use, accounts/\u003caccount-id\u003e/servicePrincipals/\u003csp-id\u003e)\nEx: (servicePrincipal.ruleSet/update, accounts/\u003caccount-id\u003e/servicePrincipals/\u003csp-id\u003e/ruleSets/default)",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "resource_info": {
+          "ref": "iam.ResourceInfo",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "iam.CheckPolicyResponse": {
+      "fields": {
+        "consistency_token": {
+          "ref": "iam.ConsistencyToken",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "is_permitted": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "iam.ComplexValue": {
+      "fields": {
+        "$ref": {
+          "launch_stage": "GA"
+        },
+        "display": {
+          "launch_stage": "GA"
+        },
+        "primary": {
+          "launch_stage": "GA"
+        },
+        "type": {
+          "launch_stage": "GA"
+        },
+        "value": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "iam.ConsistencyToken": {
+      "fields": {
+        "value": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "iam.CreateAccountGroupRequest": {
+      "fields": {
+        "displayName": {
+          "description": "String that represents a human-readable group name",
+          "launch_stage": "GA"
+        },
+        "externalId": {
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "Databricks group ID",
+          "launch_stage": "GA"
+        },
+        "members": {
+          "launch_stage": "GA"
+        },
+        "meta": {
+          "description": "Container  for the group identifier. Workspace local versus account.",
+          "ref": "iam.ResourceMeta",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "roles": {
+          "description": "Indicates if the group has the admin role.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "iam.CreateAccountServicePrincipalRequest": {
+      "fields": {
+        "active": {
+          "description": "If this user is active",
+          "launch_stage": "GA"
+        },
+        "applicationId": {
+          "description": "UUID relating to the service principal",
+          "launch_stage": "GA"
+        },
+        "displayName": {
+          "description": "String that represents a concatenation of given and family names.",
+          "launch_stage": "GA"
+        },
+        "externalId": {
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "Databricks service principal ID.",
+          "launch_stage": "GA"
+        },
+        "roles": {
+          "description": "Indicates if the group has the admin role.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "iam.CreateAccountUserRequest": {
+      "fields": {
+        "active": {
+          "description": "If this user is active",
+          "launch_stage": "GA"
+        },
+        "displayName": {
+          "description": "String that represents a concatenation of given and family names. For example `John Smith`.",
+          "launch_stage": "GA"
+        },
+        "emails": {
+          "description": "All the emails associated with the Databricks user.",
+          "launch_stage": "GA"
+        },
+        "externalId": {
+          "description": "External ID is not currently supported. It is reserved for future use.",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "Databricks user ID.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "ref": "iam.Name",
+          "launch_stage": "GA"
+        },
+        "roles": {
+          "description": "Indicates if the group has the admin role.",
+          "launch_stage": "GA"
+        },
+        "userName": {
+          "description": "Email address of the Databricks user.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "iam.CreateGroupRequest": {
+      "fields": {
+        "displayName": {
+          "description": "String that represents a human-readable group name",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "entitlements": {
+          "description": "Entitlements assigned to the group. See [assigning entitlements](https://docs.databricks.com/administration-guide/users-groups/index.html#assigning-entitlements) for a full list of supported values.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "externalId": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "groups": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "id": {
+          "description": "Databricks group ID",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "members": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "meta": {
+          "description": "Container  for the group identifier. Workspace local versus account.",
+          "ref": "iam.ResourceMeta",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "roles": {
+          "description": "Corresponds to AWS instance profile/arn role.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "schemas": {
+          "description": "The schema of the group.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "iam.CreateServicePrincipalRequest": {
+      "fields": {
+        "active": {
+          "description": "If this user is active",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "applicationId": {
+          "description": "UUID relating to the service principal",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "displayName": {
+          "description": "String that represents a concatenation of given and family names.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "entitlements": {
+          "description": "Entitlements assigned to the service principal. See [assigning entitlements](https://docs.databricks.com/administration-guide/users-groups/index.html#assigning-entitlements) for a full list of supported values.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "externalId": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "groups": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "id": {
+          "description": "Databricks service principal ID.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "roles": {
+          "description": "Corresponds to AWS instance profile/arn role.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "schemas": {
+          "description": "The schema of the List response.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "iam.CreateUserRequest": {
+      "fields": {
+        "active": {
+          "description": "If this user is active",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "displayName": {
+          "description": "String that represents a concatenation of given and family names. For example `John Smith`. This field cannot be updated through the Workspace SCIM APIs when [identity federation is enabled](https://docs.databricks.com/administration-guide/users-groups/best-practices.html#enable-identity-federation). Use Account SCIM APIs to update `displayName`.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "emails": {
+          "description": "All the emails associated with the Databricks user.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "entitlements": {
+          "description": "Entitlements assigned to the user. See [assigning entitlements](https://docs.databricks.com/administration-guide/users-groups/index.html#assigning-entitlements) for a full list of supported values.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "externalId": {
+          "description": "External ID is not currently supported. It is reserved for future use.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "groups": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "id": {
+          "description": "Databricks user ID.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "name": {
+          "ref": "iam.Name",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "roles": {
+          "description": "Corresponds to AWS instance profile/arn role.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "schemas": {
+          "description": "The schema of the user.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "userName": {
+          "description": "Email address of the Databricks user.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "iam.DeleteAccountGroupRequest": {},
+    "iam.DeleteAccountServicePrincipalRequest": {},
+    "iam.DeleteAccountUserRequest": {},
+    "iam.DeleteGroupRequest": {},
+    "iam.DeleteServicePrincipalRequest": {},
+    "iam.DeleteUserRequest": {},
+    "iam.DeleteWorkspaceAssignmentRequest": {},
+    "iam.DeleteWorkspacePermissionAssignmentResponse": {},
+    "iam.GetAccountGroupRequest": {},
+    "iam.GetAccountServicePrincipalRequest": {},
+    "iam.GetAccountUserRequest": {
+      "fields": {
+        "attributes": {
+          "description": "Comma-separated list of attributes to return in response.",
+          "launch_stage": "GA"
+        },
+        "count": {
+          "description": "Desired number of results per page. Default is 10000.",
+          "launch_stage": "GA"
+        },
+        "excludedAttributes": {
+          "description": "Comma-separated list of attributes to exclude in response.",
+          "launch_stage": "GA"
+        },
+        "filter": {
+          "description": "Query by which the results have to be filtered. Supported operators are equals(`eq`), contains(`co`), starts with(`sw`) and not equals(`ne`). Additionally, simple expressions can be formed using logical operators - `and` and `or`. The [SCIM RFC](https://tools.ietf.org/html/rfc7644#section-3.4.2.2) has more details but we currently only support simple expressions.",
+          "launch_stage": "GA"
+        },
+        "sortBy": {
+          "description": "Attribute to sort the results. Multi-part paths are supported. For example, `userName`, `name.givenName`, and `emails`.",
+          "launch_stage": "GA"
+        },
+        "sortOrder": {
+          "description": "The order to sort the results.",
+          "ref": "iam.GetSortOrder",
+          "launch_stage": "GA"
+        },
+        "startIndex": {
+          "description": "Specifies the index of the first result. First item is number 1.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "iam.GetAssignableRolesForResourceRequest": {
+      "fields": {
+        "resource": {
+          "description": "The resource name for which assignable roles will be listed.\n\nExamples | Summary\n:--- | :---\n`resource=accounts/\u003cACCOUNT_ID\u003e` | A resource name for the account.\n`resource=accounts/\u003cACCOUNT_ID\u003e/groups/\u003cGROUP_ID\u003e` | A resource name for the group.\n`resource=accounts/\u003cACCOUNT_ID\u003e/servicePrincipals/\u003cSP_ID\u003e` | A resource name for the service principal.\n`resource=accounts/\u003cACCOUNT_ID\u003e/tagPolicies/\u003cTAG_POLICY_ID\u003e` | A resource name for the tag policy.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "iam.GetAssignableRolesForResourceResponse": {
+      "fields": {
+        "roles": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "iam.GetGroupRequest": {},
+    "iam.GetPasswordPermissionLevelsRequest": {},
+    "iam.GetPasswordPermissionLevelsResponse": {
+      "fields": {
+        "permission_levels": {
+          "description": "Specific permission levels",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "iam.GetPasswordPermissionsRequest": {},
+    "iam.GetPermissionLevelsRequest": {},
+    "iam.GetPermissionLevelsResponse": {
+      "fields": {
+        "permission_levels": {
+          "description": "Specific permission levels",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "iam.GetPermissionRequest": {},
+    "iam.GetRuleSetRequest": {
+      "fields": {
+        "etag": {
+          "description": "Etag used for versioning. The response is at least as fresh as the eTag provided. Etag is used for optimistic\nconcurrency control as a way to help prevent simultaneous updates of a rule set from overwriting each other. It is\nstrongly suggested that systems make use of the etag in the read -\u003e modify -\u003e write pattern to perform rule set\nupdates in order to avoid race conditions that is get an etag from a GET rule set request, and pass it with the\nPUT update request to identify the rule set version you are updating.\n\nExamples | Summary\n:--- | :---\n`etag=` | An empty etag can only be used in GET to indicate no freshness requirements.\n`etag=RENUAAABhSweA4NvVmmUYdiU717H3Tgy0UJdor3gE4a+mq/oj9NjAf8ZsQ==` | An etag encoded a specific version of the rule set to get or to be updated.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "name": {
+          "description": "The ruleset name associated with the request.\n\nExamples | Summary\n:--- | :---\n`name=accounts/\u003cACCOUNT_ID\u003e/ruleSets/default` | A name for a rule set on the account.\n`name=accounts/\u003cACCOUNT_ID\u003e/groups/\u003cGROUP_ID\u003e/ruleSets/default` | A name for a rule set on the group.\n`name=accounts/\u003cACCOUNT_ID\u003e/servicePrincipals/\u003cSERVICE_PRINCIPAL_APPLICATION_ID\u003e/ruleSets/default` | A name for a rule set on the service principal.\n`name=accounts/\u003cACCOUNT_ID\u003e/tagPolicies/\u003cTAG_POLICY_ID\u003e/ruleSets/default` | A name for a rule set on the tag policy.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "iam.GetServicePrincipalRequest": {},
+    "iam.GetSortOrder": {
+      "enum": [
+        "ascending",
+        "descending"
+      ],
+      "enum_launch_stages": {
+        "ascending": "GA",
+        "descending": "GA"
+      }
+    },
+    "iam.GetUserRequest": {
+      "fields": {
+        "attributes": {
+          "description": "Comma-separated list of attributes to return in response.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "count": {
+          "description": "Desired number of results per page.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "excludedAttributes": {
+          "description": "Comma-separated list of attributes to exclude in response.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "filter": {
+          "description": "Query by which the results have to be filtered. Supported operators are equals(`eq`), contains(`co`), starts with(`sw`) and not equals(`ne`). Additionally, simple expressions can be formed using logical operators - `and` and `or`. The [SCIM RFC](https://tools.ietf.org/html/rfc7644#section-3.4.2.2) has more details but we currently only support simple expressions.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "sortBy": {
+          "description": "Attribute to sort the results. Multi-part paths are supported. For example, `userName`, `name.givenName`, and `emails`.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "sortOrder": {
+          "description": "The order to sort the results.",
+          "ref": "iam.GetSortOrder",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "startIndex": {
+          "description": "Specifies the index of the first result. First item is number 1.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "iam.GetWorkspaceAssignmentRequest": {},
+    "iam.GrantRule": {
+      "fields": {
+        "principals": {
+          "description": "Principals this grant rule applies to.\nA principal can be a user (for end users), a service principal (for applications and\ncompute workloads), or an account group. Each principal has its own identifier format:\n* users/\u003cUSERNAME\u003e\n* groups/\u003cGROUP_NAME\u003e\n* servicePrincipals/\u003cSERVICE_PRINCIPAL_APPLICATION_ID\u003e",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "role": {
+          "description": "Role that is assigned to the list of principals.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "iam.Group": {
+      "fields": {
+        "displayName": {
+          "description": "String that represents a human-readable group name",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "entitlements": {
+          "description": "Entitlements assigned to the group. See [assigning entitlements](https://docs.databricks.com/administration-guide/users-groups/index.html#assigning-entitlements) for a full list of supported values.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "externalId": {
+          "description": "external_id should be unique for identifying groups",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "groups": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "id": {
+          "description": "Databricks group ID",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "members": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "meta": {
+          "description": "Container for the group identifier. Workspace local versus account.",
+          "ref": "iam.ResourceMeta",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "roles": {
+          "description": "Corresponds to AWS instance profile/arn role.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "schemas": {
+          "description": "The schema of the group.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "iam.GroupSchema": {
+      "enum": [
+        "urn:ietf:params:scim:schemas:core:2.0:Group"
+      ],
+      "enum_launch_stages": {
+        "urn:ietf:params:scim:schemas:core:2.0:Group": "PUBLIC_PREVIEW"
+      }
+    },
+    "iam.ListAccountGroupsRequest": {
+      "fields": {
+        "attributes": {
+          "description": "Comma-separated list of attributes to return in response.",
+          "launch_stage": "GA"
+        },
+        "count": {
+          "description": "Desired number of results per page. Default is 10000.",
+          "launch_stage": "GA"
+        },
+        "excludedAttributes": {
+          "description": "Comma-separated list of attributes to exclude in response.",
+          "launch_stage": "GA"
+        },
+        "filter": {
+          "description": "Query by which the results have to be filtered. Supported operators are equals(`eq`), contains(`co`), starts with(`sw`) and not equals(`ne`). Additionally, simple expressions can be formed using logical operators - `and` and `or`. The [SCIM RFC](https://tools.ietf.org/html/rfc7644#section-3.4.2.2) has more details but we currently only support simple expressions.",
+          "launch_stage": "GA"
+        },
+        "sortBy": {
+          "description": "Attribute to sort the results.",
+          "launch_stage": "GA"
+        },
+        "sortOrder": {
+          "description": "The order to sort the results.",
+          "ref": "iam.ListSortOrder",
+          "launch_stage": "GA"
+        },
+        "startIndex": {
+          "description": "Specifies the index of the first result. First item is number 1.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "iam.ListAccountGroupsResponse": {
+      "fields": {
+        "Resources": {
+          "description": "User objects returned in the response.",
+          "launch_stage": "GA"
+        },
+        "itemsPerPage": {
+          "description": "Total results returned in the response.",
+          "launch_stage": "GA"
+        },
+        "startIndex": {
+          "description": "Starting index of all the results that matched the request filters. First item is number 1.",
+          "launch_stage": "GA"
+        },
+        "totalResults": {
+          "description": "Total results that match the request filters.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "iam.ListAccountServicePrincipalsRequest": {
+      "fields": {
+        "attributes": {
+          "description": "Comma-separated list of attributes to return in response.",
+          "launch_stage": "GA"
+        },
+        "count": {
+          "description": "Desired number of results per page. Default is 10000.",
+          "launch_stage": "GA"
+        },
+        "excludedAttributes": {
+          "description": "Comma-separated list of attributes to exclude in response.",
+          "launch_stage": "GA"
+        },
+        "filter": {
+          "description": "Query by which the results have to be filtered. Supported operators are equals(`eq`), contains(`co`), starts with(`sw`) and not equals(`ne`). Additionally, simple expressions can be formed using logical operators - `and` and `or`. The [SCIM RFC](https://tools.ietf.org/html/rfc7644#section-3.4.2.2) has more details but we currently only support simple expressions.",
+          "launch_stage": "GA"
+        },
+        "sortBy": {
+          "description": "Attribute to sort the results.",
+          "launch_stage": "GA"
+        },
+        "sortOrder": {
+          "description": "The order to sort the results.",
+          "ref": "iam.ListSortOrder",
+          "launch_stage": "GA"
+        },
+        "startIndex": {
+          "description": "Specifies the index of the first result. First item is number 1.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "iam.ListAccountServicePrincipalsResponse": {
+      "fields": {
+        "Resources": {
+          "description": "User objects returned in the response.",
+          "launch_stage": "GA"
+        },
+        "itemsPerPage": {
+          "description": "Total results returned in the response.",
+          "launch_stage": "GA"
+        },
+        "startIndex": {
+          "description": "Starting index of all the results that matched the request filters. First item is number 1.",
+          "launch_stage": "GA"
+        },
+        "totalResults": {
+          "description": "Total results that match the request filters.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "iam.ListAccountUsersRequest": {
+      "fields": {
+        "attributes": {
+          "description": "Comma-separated list of attributes to return in response.",
+          "launch_stage": "GA"
+        },
+        "count": {
+          "description": "Desired number of results per page. Default is 10000.",
+          "launch_stage": "GA"
+        },
+        "excludedAttributes": {
+          "description": "Comma-separated list of attributes to exclude in response.",
+          "launch_stage": "GA"
+        },
+        "filter": {
+          "description": "Query by which the results have to be filtered. Supported operators are equals(`eq`), contains(`co`), starts with(`sw`) and not equals(`ne`). Additionally, simple expressions can be formed using logical operators - `and` and `or`. The [SCIM RFC](https://tools.ietf.org/html/rfc7644#section-3.4.2.2) has more details but we currently only support simple expressions.",
+          "launch_stage": "GA"
+        },
+        "sortBy": {
+          "description": "Attribute to sort the results. Multi-part paths are supported. For example, `userName`, `name.givenName`, and `emails`.",
+          "launch_stage": "GA"
+        },
+        "sortOrder": {
+          "description": "The order to sort the results.",
+          "ref": "iam.ListSortOrder",
+          "launch_stage": "GA"
+        },
+        "startIndex": {
+          "description": "Specifies the index of the first result. First item is number 1.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "iam.ListAccountUsersResponse": {
+      "fields": {
+        "Resources": {
+          "description": "User objects returned in the response.",
+          "launch_stage": "GA"
+        },
+        "itemsPerPage": {
+          "description": "Total results returned in the response.",
+          "launch_stage": "GA"
+        },
+        "startIndex": {
+          "description": "Starting index of all the results that matched the request filters. First item is number 1.",
+          "launch_stage": "GA"
+        },
+        "totalResults": {
+          "description": "Total results that match the request filters.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "iam.ListGroupsRequest": {
+      "fields": {
+        "attributes": {
+          "description": "Comma-separated list of attributes to return in response.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "count": {
+          "description": "Desired number of results per page.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "excludedAttributes": {
+          "description": "Comma-separated list of attributes to exclude in response.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "filter": {
+          "description": "Query by which the results have to be filtered. Supported operators are equals(`eq`), contains(`co`), starts with(`sw`) and not equals(`ne`). Additionally, simple expressions can be formed using logical operators - `and` and `or`. The [SCIM RFC](https://tools.ietf.org/html/rfc7644#section-3.4.2.2) has more details but we currently only support simple expressions.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "sortBy": {
+          "description": "Attribute to sort the results.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "sortOrder": {
+          "description": "The order to sort the results.",
+          "ref": "iam.ListSortOrder",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "startIndex": {
+          "description": "Specifies the index of the first result. First item is number 1.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "iam.ListGroupsResponse": {
+      "fields": {
+        "Resources": {
+          "description": "User objects returned in the response.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "itemsPerPage": {
+          "description": "Total results returned in the response.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "schemas": {
+          "description": "The schema of the service principal.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "startIndex": {
+          "description": "Starting index of all the results that matched the request filters. First item is number 1.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "totalResults": {
+          "description": "Total results that match the request filters.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "iam.ListResponseSchema": {
+      "enum": [
+        "urn:ietf:params:scim:api:messages:2.0:ListResponse"
+      ],
+      "enum_launch_stages": {
+        "urn:ietf:params:scim:api:messages:2.0:ListResponse": "PUBLIC_PREVIEW"
+      }
+    },
+    "iam.ListServicePrincipalResponse": {
+      "fields": {
+        "Resources": {
+          "description": "User objects returned in the response.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "itemsPerPage": {
+          "description": "Total results returned in the response.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "schemas": {
+          "description": "The schema of the List response.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "startIndex": {
+          "description": "Starting index of all the results that matched the request filters. First item is number 1.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "totalResults": {
+          "description": "Total results that match the request filters.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "iam.ListServicePrincipalsRequest": {
+      "fields": {
+        "attributes": {
+          "description": "Comma-separated list of attributes to return in response.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "count": {
+          "description": "Desired number of results per page.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "excludedAttributes": {
+          "description": "Comma-separated list of attributes to exclude in response.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "filter": {
+          "description": "Query by which the results have to be filtered. Supported operators are equals(`eq`), contains(`co`), starts with(`sw`) and not equals(`ne`). Additionally, simple expressions can be formed using logical operators - `and` and `or`. The [SCIM RFC](https://tools.ietf.org/html/rfc7644#section-3.4.2.2) has more details but we currently only support simple expressions.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "sortBy": {
+          "description": "Attribute to sort the results.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "sortOrder": {
+          "description": "The order to sort the results.",
+          "ref": "iam.ListSortOrder",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "startIndex": {
+          "description": "Specifies the index of the first result. First item is number 1.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "iam.ListSortOrder": {
+      "enum": [
+        "ascending",
+        "descending"
+      ],
+      "enum_launch_stages": {
+        "ascending": "GA",
+        "descending": "GA"
+      }
+    },
+    "iam.ListUsersRequest": {
+      "fields": {
+        "attributes": {
+          "description": "Comma-separated list of attributes to return in response.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "count": {
+          "description": "Desired number of results per page.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "excludedAttributes": {
+          "description": "Comma-separated list of attributes to exclude in response.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "filter": {
+          "description": "Query by which the results have to be filtered. Supported operators are equals(`eq`), contains(`co`), starts with(`sw`) and not equals(`ne`). Additionally, simple expressions can be formed using logical operators - `and` and `or`. The [SCIM RFC](https://tools.ietf.org/html/rfc7644#section-3.4.2.2) has more details but we currently only support simple expressions.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "sortBy": {
+          "description": "Attribute to sort the results. Multi-part paths are supported. For example, `userName`, `name.givenName`, and `emails`.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "sortOrder": {
+          "description": "The order to sort the results.",
+          "ref": "iam.ListSortOrder",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "startIndex": {
+          "description": "Specifies the index of the first result. First item is number 1.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "iam.ListUsersResponse": {
+      "fields": {
+        "Resources": {
+          "description": "User objects returned in the response.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "itemsPerPage": {
+          "description": "Total results returned in the response.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "schemas": {
+          "description": "The schema of the List response.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "startIndex": {
+          "description": "Starting index of all the results that matched the request filters. First item is number 1.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "totalResults": {
+          "description": "Total results that match the request filters.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "iam.ListWorkspaceAssignmentRequest": {},
+    "iam.MeRequest": {
+      "fields": {
+        "attributes": {
+          "description": "Comma-separated list of attributes to return in response.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "excludedAttributes": {
+          "description": "Comma-separated list of attributes to exclude in response.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "iam.MigratePermissionsRequest": {
+      "fields": {
+        "from_workspace_group_name": {
+          "description": "The name of the workspace group that permissions will be migrated from.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "size": {
+          "description": "The maximum number of permissions that will be migrated.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "to_account_group_name": {
+          "description": "The name of the account group that permissions will be migrated to.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "workspace_id": {
+          "description": "WorkspaceId of the associated workspace where the permission migration will occur.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "iam.MigratePermissionsResponse": {
+      "fields": {
+        "permissions_migrated": {
+          "description": "Number of permissions migrated.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "iam.Name": {
+      "fields": {
+        "familyName": {
+          "description": "Family name of the Databricks user.",
+          "launch_stage": "GA"
+        },
+        "givenName": {
+          "description": "Given name of the Databricks user.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "iam.ObjectPermissions": {
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "GA"
+        },
+        "object_id": {
+          "launch_stage": "GA"
+        },
+        "object_type": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "iam.PasswordAccessControlRequest": {
+      "fields": {
+        "group_name": {
+          "description": "name of the group",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "permission_level": {
+          "description": "Permission level",
+          "ref": "iam.PasswordPermissionLevel",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "service_principal_name": {
+          "description": "application ID of a service principal",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "user_name": {
+          "description": "name of the user",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "iam.PasswordAccessControlResponse": {
+      "fields": {
+        "all_permissions": {
+          "description": "All permissions.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "display_name": {
+          "description": "Display name of the user or service principal.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "group_name": {
+          "description": "name of the group",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "service_principal_name": {
+          "description": "Name of the service principal.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "user_name": {
+          "description": "name of the user",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "iam.PasswordPermission": {
+      "fields": {
+        "inherited": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "inherited_from_object": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "permission_level": {
+          "description": "Permission level",
+          "ref": "iam.PasswordPermissionLevel",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "iam.PasswordPermissionLevel": {
+      "description": "Permission level",
+      "enum": [
+        "CAN_USE"
+      ],
+      "enum_launch_stages": {
+        "CAN_USE": "PUBLIC_PREVIEW"
+      }
+    },
+    "iam.PasswordPermissions": {
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "object_id": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "object_type": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "iam.PasswordPermissionsDescription": {
+      "fields": {
+        "description": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "permission_level": {
+          "description": "Permission level",
+          "ref": "iam.PasswordPermissionLevel",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "iam.PasswordPermissionsRequest": {
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "iam.Patch": {
+      "fields": {
+        "op": {
+          "description": "Type of patch operation.",
+          "ref": "iam.PatchOp",
+          "launch_stage": "GA"
+        },
+        "path": {
+          "description": "Selection of patch operation",
+          "launch_stage": "GA"
+        },
+        "value": {
+          "description": "Value to modify",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "iam.PatchAccountGroupRequest": {
+      "fields": {
+        "Operations": {
+          "launch_stage": "GA"
+        },
+        "schemas": {
+          "description": "The schema of the patch request. Must be [\"urn:ietf:params:scim:api:messages:2.0:PatchOp\"].",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "iam.PatchAccountServicePrincipalRequest": {
+      "fields": {
+        "Operations": {
+          "launch_stage": "GA"
+        },
+        "schemas": {
+          "description": "The schema of the patch request. Must be [\"urn:ietf:params:scim:api:messages:2.0:PatchOp\"].",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "iam.PatchAccountUserRequest": {
+      "fields": {
+        "Operations": {
+          "launch_stage": "GA"
+        },
+        "schemas": {
+          "description": "The schema of the patch request. Must be [\"urn:ietf:params:scim:api:messages:2.0:PatchOp\"].",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "iam.PatchGroupRequest": {
+      "fields": {
+        "Operations": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "schemas": {
+          "description": "The schema of the patch request. Must be [\"urn:ietf:params:scim:api:messages:2.0:PatchOp\"].",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "iam.PatchOp": {
+      "description": "Type of patch operation.",
+      "enum": [
+        "add",
+        "remove",
+        "replace"
+      ],
+      "enum_launch_stages": {
+        "add": "GA",
+        "remove": "GA",
+        "replace": "GA"
+      }
+    },
+    "iam.PatchSchema": {
+      "enum": [
+        "urn:ietf:params:scim:api:messages:2.0:PatchOp"
+      ],
+      "enum_launch_stages": {
+        "urn:ietf:params:scim:api:messages:2.0:PatchOp": "GA"
+      }
+    },
+    "iam.PatchServicePrincipalRequest": {
+      "fields": {
+        "Operations": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "schemas": {
+          "description": "The schema of the patch request. Must be [\"urn:ietf:params:scim:api:messages:2.0:PatchOp\"].",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "iam.PatchUserRequest": {
+      "fields": {
+        "Operations": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "schemas": {
+          "description": "The schema of the patch request. Must be [\"urn:ietf:params:scim:api:messages:2.0:PatchOp\"].",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "iam.Permission": {
+      "fields": {
+        "inherited": {
+          "launch_stage": "GA"
+        },
+        "inherited_from_object": {
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "iam.PermissionLevel",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "iam.PermissionAssignment": {
+      "description": "The output format for existing workspace PermissionAssignment records, which contains some info for\nuser consumption.",
+      "fields": {
+        "error": {
+          "description": "Error response associated with a workspace permission assignment, if any.",
+          "launch_stage": "GA"
+        },
+        "permissions": {
+          "description": "The permissions level of the principal.",
+          "launch_stage": "GA"
+        },
+        "principal": {
+          "description": "Information about the principal assigned to the workspace.",
+          "ref": "iam.PrincipalOutput",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "iam.PermissionAssignments": {
+      "fields": {
+        "permission_assignments": {
+          "description": "Array of permissions assignments defined for a workspace.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "iam.PermissionLevel": {
+      "description": "Permission level",
+      "enum": [
+        "CAN_MANAGE",
+        "CAN_RESTART",
+        "CAN_ATTACH_TO",
+        "IS_OWNER",
+        "CAN_MANAGE_RUN",
+        "CAN_VIEW",
+        "CAN_READ",
+        "CAN_RUN",
+        "CAN_EDIT",
+        "CAN_USE",
+        "CAN_MANAGE_STAGING_VERSIONS",
+        "CAN_MANAGE_PRODUCTION_VERSIONS",
+        "CAN_EDIT_METADATA",
+        "CAN_VIEW_METADATA",
+        "CAN_BIND",
+        "CAN_QUERY",
+        "CAN_MONITOR",
+        "CAN_CREATE",
+        "CAN_MONITOR_ONLY",
+        "CAN_CREATE_APP"
+      ],
+      "enum_launch_stages": {
+        "CAN_ATTACH_TO": "GA",
+        "CAN_BIND": "GA",
+        "CAN_CREATE": "GA",
+        "CAN_CREATE_APP": "PRIVATE_PREVIEW",
+        "CAN_EDIT": "GA",
+        "CAN_EDIT_METADATA": "GA",
+        "CAN_MANAGE": "GA",
+        "CAN_MANAGE_PRODUCTION_VERSIONS": "GA",
+        "CAN_MANAGE_RUN": "GA",
+        "CAN_MANAGE_STAGING_VERSIONS": "GA",
+        "CAN_MONITOR": "GA",
+        "CAN_MONITOR_ONLY": "PRIVATE_PREVIEW",
+        "CAN_QUERY": "GA",
+        "CAN_READ": "GA",
+        "CAN_RESTART": "GA",
+        "CAN_RUN": "GA",
+        "CAN_USE": "GA",
+        "CAN_VIEW": "GA",
+        "CAN_VIEW_METADATA": "GA",
+        "IS_OWNER": "GA"
+      }
+    },
+    "iam.PermissionOutput": {
+      "fields": {
+        "description": {
+          "description": "The results of a permissions query.",
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "iam.WorkspacePermission",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "iam.PermissionsDescription": {
+      "fields": {
+        "description": {
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "iam.PermissionLevel",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "iam.PrincipalOutput": {
+      "description": "Information about the principal assigned to the workspace.",
+      "fields": {
+        "display_name": {
+          "description": "The display name of the principal.",
+          "launch_stage": "GA"
+        },
+        "group_name": {
+          "description": "The group name of the group. Present only if the principal is a group.",
+          "launch_stage": "GA"
+        },
+        "principal_id": {
+          "description": "The unique, opaque id of the principal.",
+          "launch_stage": "GA"
+        },
+        "service_principal_name": {
+          "description": "The name of the service principal. Present only if the principal is a service principal.",
+          "launch_stage": "GA"
+        },
+        "user_name": {
+          "description": "The username of the user. Present only if the principal is a user.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "iam.RequestAuthzIdentity": {
+      "description": "Defines the identity to be used for authZ of the request on the server side. See one pager for\nfor more information: http://go/acl/service-identity",
+      "enum": [
+        "REQUEST_AUTHZ_IDENTITY_USER_CONTEXT",
+        "REQUEST_AUTHZ_IDENTITY_SERVICE_IDENTITY"
+      ],
+      "enum_launch_stages": {
+        "REQUEST_AUTHZ_IDENTITY_SERVICE_IDENTITY": "PRIVATE_PREVIEW",
+        "REQUEST_AUTHZ_IDENTITY_USER_CONTEXT": "PRIVATE_PREVIEW"
+      }
+    },
+    "iam.ResourceInfo": {
+      "fields": {
+        "id": {
+          "description": "Id of the current resource.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "legacy_acl_path": {
+          "description": "The legacy acl path of the current resource.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "parent_resource_info": {
+          "description": "Parent resource info for the current resource. The parent may have another parent.",
+          "ref": "iam.ResourceInfo",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "iam.ResourceMeta": {
+      "fields": {
+        "resourceType": {
+          "description": "Identifier for group type. Can be local workspace group (`WorkspaceGroup`) or account group (`Group`).",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "iam.Role": {
+      "fields": {
+        "name": {
+          "description": "Role to assign to a principal or a list of principals on a resource.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "iam.RuleSetResponse": {
+      "fields": {
+        "etag": {
+          "description": "Identifies the version of the rule set returned.\nEtag used for versioning. The response is at least as fresh as the eTag provided.\nEtag is used for optimistic concurrency control as a way to help prevent simultaneous\nupdates of a rule set from overwriting each other. It is strongly suggested that systems\nmake use of the etag in the read -\u003e modify -\u003e write pattern to perform rule set updates in\norder to avoid race conditions that is get an etag from a GET rule set request, and pass it\nwith the PUT update request to identify the rule set version you are updating.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "grant_rules": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "name": {
+          "description": "Name of the rule set.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "iam.RuleSetUpdateRequest": {
+      "fields": {
+        "etag": {
+          "description": "Identifies the version of the rule set returned.\nEtag used for versioning. The response is at least as fresh as the eTag provided.\nEtag is used for optimistic concurrency control as a way to help prevent simultaneous\nupdates of a rule set from overwriting each other. It is strongly suggested that systems\nmake use of the etag in the read -\u003e modify -\u003e write pattern to perform rule set updates in\norder to avoid race conditions that is get an etag from a GET rule set request, and pass it\nwith the PUT update request to identify the rule set version you are updating.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "grant_rules": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "name": {
+          "description": "Name of the rule set.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "iam.ServicePrincipal": {
+      "fields": {
+        "active": {
+          "description": "If this user is active",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "applicationId": {
+          "description": "UUID relating to the service principal",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "displayName": {
+          "description": "String that represents a concatenation of given and family names.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "entitlements": {
+          "description": "Entitlements assigned to the service principal. See [assigning entitlements](https://docs.databricks.com/administration-guide/users-groups/index.html#assigning-entitlements) for a full list of supported values.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "externalId": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "groups": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "id": {
+          "description": "Databricks service principal ID.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "roles": {
+          "description": "Corresponds to AWS instance profile/arn role.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "schemas": {
+          "description": "The schema of the List response.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "iam.ServicePrincipalSchema": {
+      "enum": [
+        "urn:ietf:params:scim:schemas:core:2.0:ServicePrincipal"
+      ],
+      "enum_launch_stages": {
+        "urn:ietf:params:scim:schemas:core:2.0:ServicePrincipal": "PUBLIC_PREVIEW"
+      }
+    },
+    "iam.SetObjectPermissions": {
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "iam.UpdateAccountGroupRequest": {
+      "fields": {
+        "displayName": {
+          "description": "String that represents a human-readable group name",
+          "launch_stage": "GA"
+        },
+        "externalId": {
+          "launch_stage": "GA"
+        },
+        "members": {
+          "launch_stage": "GA"
+        },
+        "meta": {
+          "description": "Container  for the group identifier. Workspace local versus account.",
+          "ref": "iam.ResourceMeta",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "roles": {
+          "description": "Indicates if the group has the admin role.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "iam.UpdateAccountServicePrincipalRequest": {
+      "fields": {
+        "active": {
+          "description": "If this user is active",
+          "launch_stage": "GA"
+        },
+        "applicationId": {
+          "description": "UUID relating to the service principal",
+          "launch_stage": "GA"
+        },
+        "displayName": {
+          "description": "String that represents a concatenation of given and family names.",
+          "launch_stage": "GA"
+        },
+        "externalId": {
+          "launch_stage": "GA"
+        },
+        "roles": {
+          "description": "Indicates if the group has the admin role.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "iam.UpdateAccountUserRequest": {
+      "fields": {
+        "active": {
+          "description": "If this user is active",
+          "launch_stage": "GA"
+        },
+        "displayName": {
+          "description": "String that represents a concatenation of given and family names. For example `John Smith`.",
+          "launch_stage": "GA"
+        },
+        "emails": {
+          "description": "All the emails associated with the Databricks user. This attribute cannot be updated through the SCIM PATCH or PUT APIs; any supplied change is ignored.",
+          "launch_stage": "GA"
+        },
+        "externalId": {
+          "description": "External ID is not currently supported. It is reserved for future use.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "ref": "iam.Name",
+          "launch_stage": "GA"
+        },
+        "roles": {
+          "description": "Indicates if the group has the admin role.",
+          "launch_stage": "GA"
+        },
+        "userName": {
+          "description": "Email address of the Databricks user. This attribute cannot be updated through the SCIM PATCH or PUT APIs; any supplied change is ignored.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "iam.UpdateGroupRequest": {
+      "fields": {
+        "displayName": {
+          "description": "String that represents a human-readable group name",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "entitlements": {
+          "description": "Entitlements assigned to the group. See [assigning entitlements](https://docs.databricks.com/administration-guide/users-groups/index.html#assigning-entitlements) for a full list of supported values.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "externalId": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "groups": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "members": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "meta": {
+          "description": "Container  for the group identifier. Workspace local versus account.",
+          "ref": "iam.ResourceMeta",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "roles": {
+          "description": "Corresponds to AWS instance profile/arn role.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "schemas": {
+          "description": "The schema of the group.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "iam.UpdateObjectPermissions": {
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "iam.UpdateRuleSetRequest": {
+      "fields": {
+        "name": {
+          "description": "Name of the rule set.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "rule_set": {
+          "ref": "iam.RuleSetUpdateRequest",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "iam.UpdateServicePrincipalRequest": {
+      "fields": {
+        "active": {
+          "description": "If this user is active",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "applicationId": {
+          "description": "UUID relating to the service principal",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "displayName": {
+          "description": "String that represents a concatenation of given and family names.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "entitlements": {
+          "description": "Entitlements assigned to the service principal. See [assigning entitlements](https://docs.databricks.com/administration-guide/users-groups/index.html#assigning-entitlements) for a full list of supported values.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "externalId": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "groups": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "roles": {
+          "description": "Corresponds to AWS instance profile/arn role.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "schemas": {
+          "description": "The schema of the List response.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "iam.UpdateUserRequest": {
+      "fields": {
+        "active": {
+          "description": "If this user is active",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "displayName": {
+          "description": "String that represents a concatenation of given and family names. For example `John Smith`. This field cannot be updated through the Workspace SCIM APIs when [identity federation is enabled](https://docs.databricks.com/administration-guide/users-groups/best-practices.html#enable-identity-federation). Use Account SCIM APIs to update `displayName`.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "emails": {
+          "description": "All the emails associated with the Databricks user. This attribute cannot be updated through the SCIM PATCH or PUT APIs; any supplied change is ignored.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "entitlements": {
+          "description": "Entitlements assigned to the user. See [assigning entitlements](https://docs.databricks.com/administration-guide/users-groups/index.html#assigning-entitlements) for a full list of supported values.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "externalId": {
+          "description": "External ID is not currently supported. It is reserved for future use.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "groups": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "name": {
+          "ref": "iam.Name",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "roles": {
+          "description": "Corresponds to AWS instance profile/arn role.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "schemas": {
+          "description": "The schema of the user.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "userName": {
+          "description": "Email address of the Databricks user. This attribute cannot be updated through the SCIM PATCH or PUT APIs; any supplied change is ignored.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "iam.UpdateWorkspaceAssignments": {
+      "fields": {
+        "permissions": {
+          "description": "Array of permissions assignments to update on the workspace.\nValid values are \"USER\" and \"ADMIN\" (case-sensitive).\nIf both \"USER\" and \"ADMIN\" are provided, \"ADMIN\" takes precedence.\nOther values will be ignored.\nNote that excluding this field, or providing unsupported values, will have the same effect as providing an empty list, which will result in the deletion of all permissions for the principal.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "iam.User": {
+      "fields": {
+        "active": {
+          "description": "If this user is active",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "displayName": {
+          "description": "String that represents a concatenation of given and family names. For example `John Smith`. This field cannot be updated through the Workspace SCIM APIs when [identity federation is enabled](https://docs.databricks.com/administration-guide/users-groups/best-practices.html#enable-identity-federation). Use Account SCIM APIs to update `displayName`.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "emails": {
+          "description": "All the emails associated with the Databricks user. This attribute cannot be updated through the SCIM PATCH or PUT APIs; any supplied change is ignored.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "entitlements": {
+          "description": "Entitlements assigned to the user. See [assigning entitlements](https://docs.databricks.com/administration-guide/users-groups/index.html#assigning-entitlements) for a full list of supported values.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "externalId": {
+          "description": "External ID is not currently supported. It is reserved for future use.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "groups": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "id": {
+          "description": "Databricks user ID.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "name": {
+          "ref": "iam.Name",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "roles": {
+          "description": "Corresponds to AWS instance profile/arn role.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "schemas": {
+          "description": "The schema of the user.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "userName": {
+          "description": "Email address of the Databricks user. This attribute cannot be updated through the SCIM PATCH or PUT APIs; any supplied change is ignored.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "iam.UserSchema": {
+      "enum": [
+        "urn:ietf:params:scim:schemas:core:2.0:User",
+        "urn:ietf:params:scim:schemas:extension:workspace:2.0:User"
+      ],
+      "enum_launch_stages": {
+        "urn:ietf:params:scim:schemas:core:2.0:User": "PUBLIC_PREVIEW",
+        "urn:ietf:params:scim:schemas:extension:workspace:2.0:User": "PUBLIC_PREVIEW"
+      }
+    },
+    "iam.WorkspacePermission": {
+      "enum": [
+        "UNKNOWN",
+        "USER",
+        "ADMIN"
+      ],
+      "enum_launch_stages": {
+        "ADMIN": "GA",
+        "UNKNOWN": "GA",
+        "USER": "GA"
+      }
+    },
+    "iam.WorkspacePermissions": {
+      "fields": {
+        "permissions": {
+          "description": "Array of permissions defined for a workspace.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "iamv2.CreateDirectGroupMemberProxyRequest": {
+      "fields": {
+        "direct_group_member": {
+          "description": "Required. The group membership to create.",
+          "ref": "iamv2.DirectGroupMember",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "iamv2.CreateDirectGroupMemberRequest": {
+      "fields": {
+        "direct_group_member": {
+          "description": "Required. The direct group member to be added to the group.",
+          "ref": "iamv2.DirectGroupMember",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "iamv2.CreateGroupProxyRequest": {
+      "fields": {
+        "group": {
+          "description": "Required. Group to be created in Databricks",
+          "ref": "iamv2.Group",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "iamv2.CreateGroupRequest": {
+      "fields": {
+        "group": {
+          "description": "Required. Group to be created in Databricks",
+          "ref": "iamv2.Group",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "iamv2.CreateIdentityVisibilityFilterRequest": {
+      "fields": {
+        "identity_visibility_filter": {
+          "description": "Required. The filter to create. Set `principal_type` to `GROUP` and specify exactly one of\n`exact` or `prefix`. The server assigns the resource name; any supplied `name` is ignored.",
+          "ref": "iamv2.IdentityVisibilityFilter",
+          "launch_stage": "GA"
+        },
+        "identity_visibility_filter_id": {
+          "description": "Optional. The ID to use for the filter, which becomes the final component of its resource name.\nIf not specified or empty, the server generates one. Must not contain `/`.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "iamv2.CreateServicePrincipalProxyRequest": {
+      "fields": {
+        "service_principal": {
+          "description": "Required. Service principal to be created in Databricks",
+          "ref": "iamv2.ServicePrincipal",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "iamv2.CreateServicePrincipalRequest": {
+      "fields": {
+        "service_principal": {
+          "description": "Required. Service principal to be created in Databricks",
+          "ref": "iamv2.ServicePrincipal",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "iamv2.CreateUserProxyRequest": {
+      "fields": {
+        "user": {
+          "description": "Required. User to be created in Databricks",
+          "ref": "iamv2.User",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "iamv2.CreateUserRequest": {
+      "fields": {
+        "user": {
+          "description": "Required. User to be created in Databricks",
+          "ref": "iamv2.User",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "iamv2.CreateWorkspaceAssignmentDetailProxyRequest": {
+      "fields": {
+        "workspace_assignment_detail": {
+          "description": "Required. Workspace assignment detail to be created in Databricks.",
+          "ref": "iamv2.WorkspaceAssignmentDetail",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "iamv2.CreateWorkspaceAssignmentDetailRequest": {
+      "fields": {
+        "workspace_assignment_detail": {
+          "description": "Required. Workspace assignment detail to be created in Databricks.",
+          "ref": "iamv2.WorkspaceAssignmentDetail",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "iamv2.CreateWorkspaceAssignmentProxyRequest": {
+      "fields": {
+        "workspace_assignment": {
+          "description": "Required. Workspace assignment to be created in Databricks.",
+          "ref": "iamv2.WorkspaceAssignment",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "iamv2.CreateWorkspaceAssignmentRequest": {
+      "fields": {
+        "workspace_assignment": {
+          "description": "Required. Workspace assignment to be created in Databricks.",
+          "ref": "iamv2.WorkspaceAssignment",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "iamv2.DeleteDirectGroupMemberProxyRequest": {},
+    "iamv2.DeleteDirectGroupMemberRequest": {},
+    "iamv2.DeleteGroupProxyRequest": {},
+    "iamv2.DeleteGroupRequest": {},
+    "iamv2.DeleteIdentityVisibilityFilterRequest": {},
+    "iamv2.DeleteServicePrincipalProxyRequest": {},
+    "iamv2.DeleteServicePrincipalRequest": {},
+    "iamv2.DeleteUserProxyRequest": {},
+    "iamv2.DeleteUserRequest": {},
+    "iamv2.DeleteWorkspaceAssignmentDetailProxyRequest": {},
+    "iamv2.DeleteWorkspaceAssignmentDetailRequest": {},
+    "iamv2.DeleteWorkspaceAssignmentProxyRequest": {},
+    "iamv2.DeleteWorkspaceAssignmentRequest": {},
+    "iamv2.DirectGroupMember": {
+      "description": "Represents a principal that is a direct member of a group, with its source of membership.",
+      "fields": {
+        "display_name": {
+          "description": "Display name of the principal.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "external_id": {
+          "description": "The external ID of the principal in Databricks.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "group_id": {
+          "description": "The internal ID of the group this member belongs to.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL",
+            "OUTPUT_ONLY"
+          ]
+        },
+        "membership_source": {
+          "description": "The source of group membership (internal or from identity provider).",
+          "ref": "iamv2.GroupMembershipSource",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "principal_id": {
+          "description": "Internal ID of the principal in Databricks.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "principal_type": {
+          "description": "The type of the principal (user/service principal/group).",
+          "ref": "iamv2.PrincipalType",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "iamv2.Entitlement": {
+      "enum": [
+        "WORKSPACE_ACCESS",
+        "WORKSPACE_CONSUME",
+        "DATABRICKS_SQL_ACCESS",
+        "WORKSPACE_ADMIN",
+        "ALLOW_CLUSTER_CREATE",
+        "ALLOW_INSTANCE_POOL_CREATE"
+      ],
+      "enum_launch_stages": {
+        "ALLOW_CLUSTER_CREATE": "PUBLIC_BETA",
+        "ALLOW_INSTANCE_POOL_CREATE": "PUBLIC_BETA",
+        "DATABRICKS_SQL_ACCESS": "PUBLIC_BETA",
+        "WORKSPACE_ACCESS": "PUBLIC_BETA",
+        "WORKSPACE_ADMIN": "PUBLIC_BETA",
+        "WORKSPACE_CONSUME": "PUBLIC_BETA"
+      }
+    },
+    "iamv2.ExactMatchRule": {
+      "description": "An exact-match rule that matches a group's external ID from the identity provider.",
+      "fields": {
+        "external_id": {
+          "description": "The identity provider's external ID for the group to match. This is not the Databricks group ID.\nThe value must be non-empty and is matched exactly, including case.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        }
+      }
+    },
+    "iamv2.ExternalGroup": {
+      "description": "An external group from the customer's Identity Provider, resolved into\nDatabricks. This is a read-only resource keyed by the IdP external ID.\nThe Get method may trigger an idempotent sync from the customer's IdP to\nprovision or refresh the group's data in Databricks.",
+      "fields": {
+        "account_id": {
+          "description": "The parent account ID, from Databricks.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "display_name": {
+          "description": "Display name of the group from the customer's IdP.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "external_group_id": {
+          "description": "The external ID of the group in the customer's IdP.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "internal_id": {
+          "description": "Internal groupId of the group in Databricks.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "The resource name of the external group. The format depends on the API that\nreturned it:\n- Account-scoped: accounts/{account_id}/external-groups/{external_group_id}\n- Workspace-scoped: external-groups/{external_group_id}",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "iamv2.ExternalServicePrincipal": {
+      "description": "An external service principal from the customer's Identity Provider, resolved\ninto Databricks. This is a read-only resource keyed by the IdP external ID.\nThe Get method may trigger an idempotent sync from the customer's IdP to\nprovision or refresh the service principal's data in Databricks.",
+      "fields": {
+        "account_id": {
+          "description": "The parent account ID, from Databricks.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "account_sp_status": {
+          "description": "The activity status of the service principal in the Databricks account.",
+          "ref": "iamv2.State",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "application_id": {
+          "description": "Application ID of the service principal, from the customer's IdP.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "display_name": {
+          "description": "Display name of the service principal, from the customer's IdP.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "external_service_principal_id": {
+          "description": "The external ID of the service principal in the customer's IdP.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "internal_id": {
+          "description": "Internal servicePrincipalId of the service principal in Databricks.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "The resource name of the external service principal. The format depends on\nthe API that returned it:\n- Account-scoped: accounts/{account_id}/external-service-principals/{external_service_principal_id}\n- Workspace-scoped: external-service-principals/{external_service_principal_id}",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "iamv2.ExternalUser": {
+      "description": "An external user from the customer's Identity Provider, resolved into\nDatabricks. This is a read-only resource that allows customers to look up\nexternal user identities by their IdP external ID and retrieve the\ncorresponding Databricks internal ID and metadata. The Get method may\ntrigger an idempotent sync from the customer's IdP to provision or refresh\nthe user's data in Databricks.",
+      "fields": {
+        "account_id": {
+          "description": "The parent account ID, from Databricks.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "account_user_status": {
+          "description": "The activity status of the user in the Databricks account.",
+          "ref": "iamv2.State",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "display_name": {
+          "description": "Display name of the user from the customer's IdP.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "external_user_id": {
+          "description": "The external ID of the user in the customer's IdP.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "full_name": {
+          "description": "The full name of the user, from the customer's IdP.",
+          "ref": "iamv2.FullName",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "internal_id": {
+          "description": "Internal userId of the user in Databricks.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "The resource name of the external user. The format depends on the API that\nreturned it:\n- Account-scoped: accounts/{account_id}/external-users/{external_user_id}\n- Workspace-scoped: external-users/{external_user_id}",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "username": {
+          "description": "Username/email of the user, from Databricks.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "iamv2.FullName": {
+      "description": "The full name of a user.",
+      "fields": {
+        "family_name": {
+          "description": "The family (last) name of the user, from the customer's IdP.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "given_name": {
+          "description": "The given (first) name of the user, from the customer's IdP.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "iamv2.GetDirectGroupMemberProxyRequest": {},
+    "iamv2.GetDirectGroupMemberRequest": {},
+    "iamv2.GetExternalGroupProxyRequest": {},
+    "iamv2.GetExternalGroupRequest": {},
+    "iamv2.GetExternalServicePrincipalProxyRequest": {},
+    "iamv2.GetExternalServicePrincipalRequest": {},
+    "iamv2.GetExternalUserProxyRequest": {},
+    "iamv2.GetExternalUserRequest": {},
+    "iamv2.GetGroupProxyRequest": {},
+    "iamv2.GetGroupRequest": {},
+    "iamv2.GetIdentityVisibilityFilterRequest": {},
+    "iamv2.GetServicePrincipalProxyRequest": {},
+    "iamv2.GetServicePrincipalRequest": {},
+    "iamv2.GetUserProxyRequest": {},
+    "iamv2.GetUserRequest": {},
+    "iamv2.GetWorkspaceAccessDetailLocalRequest": {
+      "fields": {
+        "view": {
+          "description": "Controls what fields are returned.",
+          "ref": "iamv2.WorkspaceAccessDetailView",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "iamv2.GetWorkspaceAccessDetailRequest": {
+      "fields": {
+        "view": {
+          "description": "Controls what fields are returned.",
+          "ref": "iamv2.WorkspaceAccessDetailView",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "iamv2.GetWorkspaceAssignmentDetailProxyRequest": {},
+    "iamv2.GetWorkspaceAssignmentDetailRequest": {},
+    "iamv2.GetWorkspaceAssignmentProxyRequest": {},
+    "iamv2.GetWorkspaceAssignmentRequest": {},
+    "iamv2.GetWorkspaceIdentityDetailRequest": {},
+    "iamv2.Group": {
+      "description": "The details of a Group resource.",
+      "fields": {
+        "account_id": {
+          "description": "The parent account ID for group in Databricks.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "external_id": {
+          "description": "ExternalId of the group in the customer's IdP.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "group_id": {
+          "description": "Internal group ID of the group in Databricks.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "group_name": {
+          "description": "Display name of the group.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "iamv2.GroupMembershipSource": {
+      "description": "The source of the group membership (internal or from identity provider).",
+      "enum": [
+        "INTERNAL",
+        "IDENTITY_PROVIDER"
+      ],
+      "enum_launch_stages": {
+        "IDENTITY_PROVIDER": "PUBLIC_BETA",
+        "INTERNAL": "PUBLIC_BETA"
+      }
+    },
+    "iamv2.IdentityVisibilityFilter": {
+      "description": "An account-level rule that controls which identity provider groups are discoverable in directory\nsearch and group pickers when automatic identity management is enabled. Filters apply across all\nworkspaces in the account.\n\nIf no group filters are configured, all groups are visible. Otherwise, a group is visible if it\nor any of its transitive parent groups matches at least one rule. A group is also visible if it\nor any transitive parent group is already provisioned in the account. Local Databricks groups\nremain visible regardless of the filters.\n\nOnly group filters can be created. Filters do not change provisioning or sign-in for users and\nservice principals. Filters are immutable: to change a rule, delete it and create a new one.",
+      "fields": {
+        "exact": {
+          "description": "Exact match on the group's external ID from the identity provider.",
+          "ref": "iamv2.ExactMatchRule",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE",
+            "OPTIONAL"
+          ]
+        },
+        "name": {
+          "description": "The resource name of the identity-visibility filter.\nFormat: accounts/{account_id}/identity-visibility-filters/{identity_visibility_filter_id}",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "prefix": {
+          "description": "Case-sensitive starts-with match on the group's display name.",
+          "ref": "iamv2.PrefixMatchRule",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE",
+            "OPTIONAL"
+          ]
+        },
+        "principal_type": {
+          "description": "The type of principal this rule applies to. Set to `GROUP` when creating a filter.\nOther principal types are not supported for creation.",
+          "ref": "iamv2.PrincipalType",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        }
+      }
+    },
+    "iamv2.ListDirectGroupMembersProxyRequest": {
+      "fields": {
+        "page_size": {
+          "description": "The maximum number of members to return. The service may return fewer than this value.\nIf not provided, defaults to 1000, which is also the maximum allowed. Requests for more than the maximum are clamped to 1000.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "A page token from a previous list call. Provide this to retrieve the subsequent page.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "iamv2.ListDirectGroupMembersRequest": {
+      "fields": {
+        "page_size": {
+          "description": "The maximum number of members to return. The service may return fewer than this value.\nIf not provided, defaults to 1000, which is also the maximum allowed. Requests for more than the maximum are clamped to 1000.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "A page token, received from a previous ListDirectGroupMembers call. Provide this to retrieve the subsequent page.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "iamv2.ListDirectGroupMembersResponse": {
+      "description": "Response message for listing direct group members.",
+      "fields": {
+        "direct_group_members": {
+          "description": "The list of direct group members with their membership source type.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "next_page_token": {
+          "description": "A token, which can be sent as page_token to retrieve the next page. If this field is omitted, there are no subsequent pages.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "iamv2.ListGroupsProxyRequest": {
+      "fields": {
+        "filter": {
+          "description": "Optional. Allows filtering groups by group name or external id.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_size": {
+          "description": "The maximum number of groups to return. The service may return fewer than this value.\nIf not provided, defaults to 1000, which is also the maximum allowed. Requests for more than the maximum are clamped to 1000.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "A page token, received from a previous ListGroups call. Provide this to retrieve the subsequent page.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "iamv2.ListGroupsRequest": {
+      "fields": {
+        "filter": {
+          "description": "Optional. Allows filtering groups by group name or external id.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_size": {
+          "description": "The maximum number of groups to return. The service may return fewer than this value.\nIf not provided, defaults to 1000, which is also the maximum allowed. Requests for more than the maximum are clamped to 1000.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "A page token, received from a previous ListGroups call. Provide this to retrieve the subsequent page.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "iamv2.ListGroupsResponse": {
+      "description": "Response message containing a page of groups in the account.",
+      "fields": {
+        "groups": {
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "next_page_token": {
+          "description": "A token, which can be sent as page_token to retrieve the next page. If this field is omitted, there are no subsequent pages.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "iamv2.ListIdentityVisibilityFiltersRequest": {
+      "fields": {
+        "page_size": {
+          "description": "The maximum number of filters to return. The service may return fewer than this value.\nIf omitted or non-positive, defaults to 100. Values above 1000 are reduced to 1000.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "A page token, received from a previous ListIdentityVisibilityFilters call. Provide this to retrieve the subsequent page.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "iamv2.ListIdentityVisibilityFiltersResponse": {
+      "description": "Response message containing a page of identity-visibility filters in the account.",
+      "fields": {
+        "identity_visibility_filters": {
+          "description": "The filters in this page. These are filter rules, not the groups matched by the rules.",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "A token, which can be sent as page_token to retrieve the next page. If omitted, there are no subsequent pages.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "iamv2.ListServicePrincipalsProxyRequest": {
+      "fields": {
+        "filter": {
+          "description": "Optional. Allows filtering service principals by application id or external id.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_size": {
+          "description": "The maximum number of SPs to return. The service may return fewer than this value.\nIf not provided, defaults to 1000, which is also the maximum allowed. Requests for more than the maximum are clamped to 1000.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "A page token, received from a previous ListServicePrincipals call. Provide this to retrieve the subsequent page.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "iamv2.ListServicePrincipalsRequest": {
+      "fields": {
+        "filter": {
+          "description": "Optional. Allows filtering service principals by application id or external id.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_size": {
+          "description": "The maximum number of service principals to return. The service may return fewer than this value.\nIf not provided, defaults to 1000, which is also the maximum allowed. Requests for more than the maximum are clamped to 1000.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "A page token, received from a previous ListServicePrincipals call. Provide this to retrieve the subsequent page.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "iamv2.ListServicePrincipalsResponse": {
+      "description": "Response message containing a page of service principals in the account.",
+      "fields": {
+        "next_page_token": {
+          "description": "A token, which can be sent as page_token to retrieve the next page. If this field is omitted, there are no subsequent pages.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "service_principals": {
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "iamv2.ListTransitiveParentGroupsProxyRequest": {
+      "fields": {
+        "page_size": {
+          "description": "The maximum number of parent groups to return. The service may return fewer than this value.\nIf not provided, defaults to 1000, which is also the maximum allowed. Requests for more than the maximum are clamped to 1000.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "A page token, received from a previous ListTransitiveParentGroups call. Provide this to retrieve the subsequent page.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "iamv2.ListTransitiveParentGroupsRequest": {
+      "fields": {
+        "page_size": {
+          "description": "The maximum number of parent groups to return. The service may return fewer than this value.\nIf not provided, defaults to 1000, which is also the maximum allowed. Requests for more than the maximum are clamped to 1000.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "A page token, received from a previous ListTransitiveParentGroups call. Provide this to retrieve the subsequent page.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "iamv2.ListTransitiveParentGroupsResponse": {
+      "description": "Response message for listing all transitive parent groups of a principal.",
+      "fields": {
+        "next_page_token": {
+          "description": "A token, which can be sent as page_token to retrieve the next page. If this field is omitted, there are no subsequent pages.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "transitive_parent_groups": {
+          "description": "The list of transitive parent groups.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "iamv2.ListUsersProxyRequest": {
+      "fields": {
+        "filter": {
+          "description": "Optional. Allows filtering users by username or external id.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_size": {
+          "description": "The maximum number of users to return. The service may return fewer than this value.\nIf not provided, defaults to 1000, which is also the maximum allowed. Requests for more than the maximum are clamped to 1000.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "A page token, received from a previous ListUsers call. Provide this to retrieve the subsequent page.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "iamv2.ListUsersRequest": {
+      "fields": {
+        "filter": {
+          "description": "Optional. Allows filtering users by username or external id.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_size": {
+          "description": "The maximum number of users to return. The service may return fewer than this value.\nIf not provided, defaults to 1000, which is also the maximum allowed. Requests for more than the maximum are clamped to 1000.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "A page token, received from a previous ListUsers call. Provide this to retrieve the subsequent page.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "iamv2.ListUsersResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "A token, which can be sent as page_token to retrieve the next page. If this field is omitted, there are no subsequent pages.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "users": {
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "iamv2.ListWorkspaceAssignmentDetailsProxyRequest": {
+      "fields": {
+        "page_size": {
+          "description": "The maximum number of workspace assignment details to return. The service may return fewer than this value.\nIf not provided, defaults to 1000, which is also the maximum allowed. Requests for more than the maximum are clamped to 1000.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "A page token from a previous list call. Provide this to retrieve the subsequent page.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "iamv2.ListWorkspaceAssignmentDetailsRequest": {
+      "fields": {
+        "page_size": {
+          "description": "The maximum number of workspace assignment details to return. The service may return fewer than this value.\nIf not provided, defaults to 1000, which is also the maximum allowed. Requests for more than the maximum are clamped to 1000.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "A page token, received from a previous ListWorkspaceAssignmentDetails call. Provide this to retrieve the subsequent page.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "iamv2.ListWorkspaceAssignmentDetailsResponse": {
+      "description": "Response message for listing workspace assignment details.",
+      "fields": {
+        "next_page_token": {
+          "description": "A token, which can be sent as page_token to retrieve the next page. If this field is omitted, there are no subsequent pages.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "workspace_assignment_details": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "iamv2.ListWorkspaceAssignmentsProxyRequest": {
+      "fields": {
+        "page_size": {
+          "description": "The maximum number of workspace assignments to return. The service may return fewer than this value.\nIf not provided, defaults to 1000, which is also the maximum allowed. Requests for more than the maximum are clamped to 1000.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "A page token from a previous list call. Provide this to retrieve the subsequent page.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "iamv2.ListWorkspaceAssignmentsRequest": {
+      "fields": {
+        "page_size": {
+          "description": "The maximum number of workspace assignments to return. The service may return fewer than this value.\nIf not provided, defaults to 1000, which is also the maximum allowed. Requests for more than the maximum are clamped to 1000.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "A page token, received from a previous ListWorkspaceAssignments call. Provide this to retrieve the subsequent page.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "iamv2.ListWorkspaceAssignmentsResponse": {
+      "description": "Response message for listing workspace assignments.",
+      "fields": {
+        "next_page_token": {
+          "description": "A token, which can be sent as page_token to retrieve the next page. If this field is omitted, there are no subsequent pages.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "workspace_assignments": {
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "iamv2.PrefixMatchRule": {
+      "description": "A starts-with rule that matches groups whose display name begins with a specified prefix.\nMatching is case-sensitive. For example, the prefix `data-` matches `data-platform`.",
+      "fields": {
+        "display_name_prefix": {
+          "description": "The display-name prefix to match. Must contain at least one non-whitespace character.\nLeading and trailing whitespace are preserved, and matching is case-sensitive.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        }
+      }
+    },
+    "iamv2.PrincipalType": {
+      "description": "The type of the principal (user/sp/group).",
+      "enum": [
+        "USER",
+        "SERVICE_PRINCIPAL",
+        "GROUP"
+      ],
+      "enum_launch_stages": {
+        "GROUP": "GA",
+        "SERVICE_PRINCIPAL": "GA",
+        "USER": "GA"
+      }
+    },
+    "iamv2.ResolveGroupProxyRequest": {
+      "description": "Request message for resolving a group with the given external ID from the customer's IdP into Databricks.\nWill resolve metadata such as the group's name and inherited parent groups.",
+      "fields": {
+        "external_id": {
+          "description": "Required. The external ID of the group in the customer's IdP.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "iamv2.ResolveGroupRequest": {
+      "description": "Request message for resolving a group with the given external ID from the customer's IdP into Databricks.\nWill resolve metadata such as the group's name and inherited parent groups.",
+      "fields": {
+        "external_id": {
+          "description": "Required. The external ID of the group in the customer's IdP.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "iamv2.ResolveGroupResponse": {
+      "fields": {
+        "group": {
+          "description": "The group that was resolved.",
+          "ref": "iamv2.Group",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "iamv2.ResolveServicePrincipalProxyRequest": {
+      "description": "Request message for resolving a service principal with the given external ID from the customer's IdP into Databricks.\nWill resolve metadata such as the service principal's display name, status, and inherited parent groups.",
+      "fields": {
+        "external_id": {
+          "description": "Required. The external ID of the service principal in the customer's IdP.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "iamv2.ResolveServicePrincipalRequest": {
+      "description": "Request message for resolving a service principal with the given external ID from the customer's IdP into Databricks.\nWill resolve metadata such as the service principal's display name, status, and inherited parent groups.",
+      "fields": {
+        "external_id": {
+          "description": "Required. The external ID of the service principal in the customer's IdP.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "iamv2.ResolveServicePrincipalResponse": {
+      "fields": {
+        "service_principal": {
+          "description": "The service principal that was resolved.",
+          "ref": "iamv2.ServicePrincipal",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "iamv2.ResolveUserProxyRequest": {
+      "description": "Request message for resolving a user with the given external ID from the customer's IdP into Databricks.\nWill resolve metadata such as the user's display name, status, and inherited parent groups.",
+      "fields": {
+        "external_id": {
+          "description": "Required. The external ID of the user in the customer's IdP.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "iamv2.ResolveUserRequest": {
+      "description": "Request message for resolving a user with the given external ID from the customer's IdP into Databricks.\nWill resolve metadata such as the user's display name, status, and inherited parent groups.",
+      "fields": {
+        "external_id": {
+          "description": "Required. The external ID of the user in the customer's IdP.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "iamv2.ResolveUserResponse": {
+      "fields": {
+        "user": {
+          "description": "The user that was resolved.",
+          "ref": "iamv2.User",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "iamv2.ServicePrincipal": {
+      "description": "The details of a ServicePrincipal resource.",
+      "fields": {
+        "account_id": {
+          "description": "The parent account ID for the service principal in Databricks.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "account_sp_status": {
+          "description": "The activity status of a service principal in a Databricks account.",
+          "ref": "iamv2.State",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "application_id": {
+          "description": "Application ID of the service principal. Set at creation time and cannot be changed\nafterwards; when omitted, the server generates one.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "IMMUTABLE",
+            "OPTIONAL"
+          ]
+        },
+        "display_name": {
+          "description": "Display name of the service principal.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "external_id": {
+          "description": "ExternalId of the service principal in the customer's IdP.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "service_principal_id": {
+          "description": "Internal service principal ID of the service principal in Databricks.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "iamv2.State": {
+      "description": "The activity status of a user or service principal in a Databricks account or workspace.",
+      "enum": [
+        "ACTIVE",
+        "INACTIVE"
+      ],
+      "enum_launch_stages": {
+        "ACTIVE": "PUBLIC_BETA",
+        "INACTIVE": "PUBLIC_BETA"
+      }
+    },
+    "iamv2.TransitiveParentGroup": {
+      "description": "Represents a group that is a transitive parent of a principal.",
+      "fields": {
+        "account_id": {
+          "description": "The parent account ID for group in Databricks.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "external_id": {
+          "description": "ExternalId of the group in the customer's IdP.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "group_id": {
+          "description": "Internal group ID of the group in Databricks.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "iamv2.UpdateGroupProxyRequest": {
+      "fields": {
+        "group": {
+          "description": "Required. Group to be updated in Databricks",
+          "ref": "iamv2.Group",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "update_mask": {
+          "description": "Optional. The list of fields to update.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "iamv2.UpdateGroupRequest": {
+      "fields": {
+        "group": {
+          "description": "Required. Group to be updated in Databricks",
+          "ref": "iamv2.Group",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "update_mask": {
+          "description": "Optional. The list of fields to update.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "iamv2.UpdateServicePrincipalProxyRequest": {
+      "fields": {
+        "service_principal": {
+          "description": "Required. Service principal to be updated in Databricks",
+          "ref": "iamv2.ServicePrincipal",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "update_mask": {
+          "description": "Optional. The list of fields to update.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "iamv2.UpdateServicePrincipalRequest": {
+      "fields": {
+        "service_principal": {
+          "description": "Required. Service Principal to be updated in Databricks",
+          "ref": "iamv2.ServicePrincipal",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "update_mask": {
+          "description": "Optional. The list of fields to update.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "iamv2.UpdateUserProxyRequest": {
+      "fields": {
+        "update_mask": {
+          "description": "Optional. The list of fields to update.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "user": {
+          "description": "Required. User to be updated in Databricks",
+          "ref": "iamv2.User",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "iamv2.UpdateUserRequest": {
+      "fields": {
+        "update_mask": {
+          "description": "Optional. The list of fields to update.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "user": {
+          "description": "Required. User to be updated in Databricks",
+          "ref": "iamv2.User",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "iamv2.UpdateWorkspaceAssignmentDetailProxyRequest": {
+      "fields": {
+        "update_mask": {
+          "description": "Required. The list of fields to update.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "workspace_assignment_detail": {
+          "description": "Required. Workspace assignment detail to be updated in Databricks.",
+          "ref": "iamv2.WorkspaceAssignmentDetail",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "iamv2.UpdateWorkspaceAssignmentDetailRequest": {
+      "fields": {
+        "update_mask": {
+          "description": "Required. The list of fields to update.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "workspace_assignment_detail": {
+          "description": "Required. Workspace assignment detail to be updated in Databricks.",
+          "ref": "iamv2.WorkspaceAssignmentDetail",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "iamv2.UpdateWorkspaceAssignmentProxyRequest": {
+      "fields": {
+        "update_mask": {
+          "description": "Required. The list of fields to update.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "workspace_assignment": {
+          "description": "Required. Workspace assignment to be updated in Databricks.",
+          "ref": "iamv2.WorkspaceAssignment",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "iamv2.UpdateWorkspaceAssignmentRequest": {
+      "fields": {
+        "update_mask": {
+          "description": "Required. The list of fields to update.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "workspace_assignment": {
+          "description": "Required. Workspace assignment to be updated in Databricks.",
+          "ref": "iamv2.WorkspaceAssignment",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "iamv2.UpdateWorkspaceIdentityDetailRequest": {
+      "fields": {
+        "update_mask": {
+          "description": "Required. The list of fields to update.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "workspace_identity_detail": {
+          "description": "Required. Workspace identity detail to be updated in Databricks.",
+          "ref": "iamv2.WorkspaceIdentityDetail",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "iamv2.User": {
+      "description": "The details of a User resource.",
+      "fields": {
+        "account_id": {
+          "description": "The accountId parent of the user in Databricks.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "account_user_status": {
+          "description": "The activity status of a user in a Databricks account.",
+          "ref": "iamv2.State",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "external_id": {
+          "description": "ExternalId of the user in the customer's IdP.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "full_name": {
+          "ref": "iamv2.UserFullName",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "user_id": {
+          "description": "Internal userId of the user in Databricks.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "username": {
+          "description": "Username/email of the user.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        }
+      }
+    },
+    "iamv2.UserFullName": {
+      "fields": {
+        "family_name": {
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "given_name": {
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "iamv2.WorkspaceAccessDetail": {
+      "description": "The details of a principal's access to a workspace.",
+      "fields": {
+        "access_type": {
+          "ref": "iamv2.WorkspaceAccessDetailAccessType",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "account_id": {
+          "description": "The account ID parent of the workspace where the principal has access.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "permissions": {
+          "description": "The permissions granted to the principal in the workspace.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "principal_id": {
+          "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "principal_type": {
+          "ref": "iamv2.PrincipalType",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "status": {
+          "description": "The activity status of the principal in the workspace. Not applicable for groups at the moment.",
+          "ref": "iamv2.State",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "workspace_id": {
+          "description": "The workspace ID where the principal has access.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "iamv2.WorkspaceAccessDetailAccessType": {
+      "description": "The type of access the principal has to the workspace.",
+      "enum": [
+        "DIRECT",
+        "INDIRECT"
+      ],
+      "enum_launch_stages": {
+        "DIRECT": "PUBLIC_BETA",
+        "INDIRECT": "PUBLIC_BETA"
+      }
+    },
+    "iamv2.WorkspaceAccessDetailView": {
+      "description": "Controls what fields are returned in the GetWorkspaceAccessDetail response.",
+      "enum": [
+        "BASIC",
+        "FULL"
+      ],
+      "enum_launch_stages": {
+        "BASIC": "PUBLIC_BETA",
+        "FULL": "PUBLIC_BETA"
+      }
+    },
+    "iamv2.WorkspaceAssignment": {
+      "description": "The direct assignment of a provisioned account-level principal (user, service\nprincipal, or group) to a workspace, together with the entitlements that\nassignment grants in the workspace.\n\nThis resource covers only principals assigned directly to the workspace.\nPrincipals that inherit workspace access through a group are not represented\nhere. See WorkspaceAccessDetail and WorkspaceIdentityDetail for the effective,\ndirect-or-indirect view. Creating the resource assigns the principal to the\nworkspace, and deleting it removes the assignment.\n\n`entitlements` is the only client-settable field. It holds the entitlements\ngranted directly on this assignment, including any the principal also holds\nthrough a group. `effective_entitlements` is the read-only union of those and\nany granted through group membership.\n\nA direct assignment always carries at least one directly-assigned entitlement,\nbecause the assignment is what grants it. Create and update both reject an\nempty `entitlements` set. To remove a principal's assignment entirely, delete\nthe resource.\n\nThis resource replaces workspace assignment previously managed through the\nworkspace SCIM and permission-assignment APIs, and is intended for account\nand workspace admins.",
+      "fields": {
+        "account_id": {
+          "description": "The account ID parent of the workspace where the principal is assigned",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "effective_entitlements": {
+          "description": "Every entitlement the principal holds in this workspace, whether granted directly or through\ngroup membership. Get responses populate this field. List responses leave it empty.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY",
+            "UNORDERED_LIST"
+          ]
+        },
+        "entitlements": {
+          "description": "Entitlements granted directly to the principal on this workspace. This is the only\nclient-settable field. Create and update manage exactly this set, including entitlements the\nprincipal also holds through a group.\nList responses leave this field empty. Get a single principal to read its entitlements.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL",
+            "UNORDERED_LIST"
+          ]
+        },
+        "principal_id": {
+          "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "principal_type": {
+          "description": "The type of the principal (user/service principal/group) that is assigned.",
+          "ref": "iamv2.PrincipalType",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "workspace_id": {
+          "description": "The workspace ID where the principal is assigned.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL",
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "iamv2.WorkspaceAssignmentDetail": {
+      "description": "The direct assignment of a provisioned account-level principal (user, service\nprincipal, or group) to a workspace, together with the entitlements that\nassignment grants in the workspace.\n\nThis resource covers only principals assigned directly to the workspace.\nPrincipals that inherit workspace access through a group are not represented\nhere. See WorkspaceAccessDetail and WorkspaceIdentityDetail for the effective,\ndirect-or-indirect view. Creating the resource assigns the principal to the\nworkspace, and deleting it removes the assignment.\n\n`entitlements` is the only client-settable field. It holds the entitlements\ngranted directly on this assignment, including any the principal also holds\nthrough a group. `effective_entitlements` is the read-only union of those and\nany granted through group membership.\n\nA direct assignment always carries at least one directly-assigned entitlement,\nbecause the assignment is what grants it. Create and update both reject an\nempty `entitlements` set. To remove a principal's assignment entirely, delete\nthe resource.\n\nThis resource replaces workspace assignment previously managed through the\nworkspace SCIM and permission-assignment APIs, and is intended for account\nand workspace admins.",
+      "fields": {
+        "account_id": {
+          "description": "The account ID parent of the workspace where the principal is assigned",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "effective_entitlements": {
+          "description": "Every entitlement the principal holds in this workspace, whether granted directly or through\ngroup membership. Get responses populate this field. List responses leave it empty.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY",
+            "UNORDERED_LIST"
+          ]
+        },
+        "entitlements": {
+          "description": "Entitlements granted directly to the principal on this workspace. This is the only\nclient-settable field. Create and update manage exactly this set, including entitlements the\nprincipal also holds through a group.\nList responses leave this field empty. Get a single principal to read its entitlements.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL",
+            "UNORDERED_LIST"
+          ]
+        },
+        "principal_id": {
+          "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "principal_type": {
+          "ref": "iamv2.PrincipalType",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "workspace_id": {
+          "description": "The workspace ID where the principal is assigned.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL",
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "iamv2.WorkspaceIdentityDetail": {
+      "description": "The details of a directly or indirectly assigned principal's details in a workspace.",
+      "fields": {
+        "assignment_type": {
+          "description": "The type of assignment the principal has to the workspace (direct or indirect).",
+          "ref": "iamv2.WorkspaceIdentityDetailAssignmentType",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "principal_id": {
+          "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "principal_type": {
+          "description": "The type of the principal (user/service principal/group).",
+          "ref": "iamv2.PrincipalType",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "workspace_identity_status": {
+          "description": "The activity status of an identity in a Databricks workspace.",
+          "ref": "iamv2.State",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "iamv2.WorkspaceIdentityDetailAssignmentType": {
+      "description": "The type of assignment the principal has to the workspace.",
+      "enum": [
+        "DIRECT",
+        "INDIRECT"
+      ],
+      "enum_launch_stages": {
+        "DIRECT": "PUBLIC_BETA",
+        "INDIRECT": "PUBLIC_BETA"
+      }
+    },
+    "iamv2.WorkspacePermission": {
+      "description": "The type of permission a principal has to a workspace (admin/user).",
+      "enum": [
+        "USER_PERMISSION",
+        "ADMIN_PERMISSION"
+      ],
+      "enum_launch_stages": {
+        "ADMIN_PERMISSION": "PUBLIC_BETA",
+        "USER_PERMISSION": "PUBLIC_BETA"
+      }
+    },
+    "jobs.AiRuntimeTask": {
+      "description": "AiRuntimeTask: multi-node GPU compute task definition for Databricks AI\nRuntime workloads.\n\nJobs-framework-level concepts (retries, per-task timeout, idempotency\ntoken, usage/budget policy, permissions) live on the surrounding\nTaskSettings / run-submit request and are intentionally NOT duplicated\nhere. Users compose `ai_runtime_task` with the standard Jobs/DABs task\nwrapper to get those.",
+      "fields": {
+        "code_source_path": {
+          "description": "Workspace or UC volume path of the code-source archive, unpacked on\neach node and exposed through `$CODE_SOURCE`. Set by first-party\ntooling; not for direct callers.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "deployments": {
+          "description": "Deployment specs for this task. Exactly one deployment is currently\nsupported (a single entry where every node runs the same command); this\nis a current-Preview constraint. Role-split workloads (driver + worker,\nparameter server, separate eval node, etc.) with multiple entries are the\neventual intent but not yet supported.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "docker_image_url": {
+          "description": "Optional Docker image URL for a custom container image. When set,\nthe task runs on the specified container image instead of the default\nDatabricks client image. Format:\n`{organization}/{repository}:{tag}`",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "experiment": {
+          "description": "MLflow experiment name for this run. If an experiment with this name\nalready exists under the calling user, the run is appended to it;\notherwise a new experiment is created. To target a specific MLflow\nstorage location (for example, when running as a service principal), set\n`mlflow_experiment_directory`.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "mlflow_artifact_location": {
+          "description": "Optional root location for MLflow artifacts logged by the run.\nIf this field isn't specified the default artifact location will be in dbfs\ni.e. `dbfs:/databricks/mlflow-tracking/\u003cexperiment_id\u003e/...`\nIf dbfs access is restricted or UC is preferred this can be a custom location in UC:\n`dbfs:/Volumes/\u003ccatalog\u003e/\u003cschema\u003e/\u003cvolume\u003e/...`\nThe location should be unique for each experiment.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "mlflow_experiment_directory": {
+          "description": "Optional workspace directory under which the MLflow experiment named in\n`experiment` is created. Must start with `/Workspace`. Set this when\nrunning as a service principal that has no default user directory; for\nregular users the experiment defaults to the user's home directory.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "mlflow_run": {
+          "description": "Optional display name for the MLflow run created under `experiment`. If\nomitted, MLflow generates a default name.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "priority_class": {
+          "description": "Scheduling priority class for the workload. May only be set together with\na pre-provisioned capacity reservation (a deployment's\n`compute.provisioned_capacity_id`); it is rejected on a workload that runs\non on-demand capacity.",
+          "ref": "jobs.AiRuntimeTaskPriorityClass",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "unity_catalog_image_path": {
+          "description": "Optional Unity Catalog path for a custom container image. When set,\nthe task runs on the specified container image instead of the default\nDatabricks client image. Format:\n`{catalog}.{schema}.{image_name}:{tag}`",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "jobs.AiRuntimeTaskOutput": {
+      "description": "AiRuntimeTaskOutput: output identifiers for an AiRuntimeTask run — the\nMLflow experiment and run IDs the task wrote to.\n\nRun lifecycle and termination status are not on this message; they live\non the surrounding `RunTask.status` field (see `runs.proto:RunTask.status`).",
+      "fields": {
+        "mlflow_experiment_id": {
+          "description": "MLflow experiment ID the run was logged to. Use it to look up the\nexperiment in MLflow APIs or the workspace MLflow UI.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "mlflow_run_id": {
+          "description": "MLflow run ID for this task execution. Use it to look up the run in\nMLflow APIs or the workspace MLflow UI.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "status_message": {
+          "description": "Human-readable status message for this run, suitable for display to the\nuser (for example, that the run is still waiting for GPU compute). Set by\nthe server only when there is something to surface; empty otherwise.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "jobs.AiRuntimeTaskPriorityClass": {
+      "description": "Scheduling priority class for a workload — its priority and preemptability\nwhen the scheduler ranks pending work.",
+      "enum": [
+        "BEST_EFFORT",
+        "NORMAL",
+        "CRITICAL"
+      ],
+      "enum_launch_stages": {
+        "BEST_EFFORT": "PRIVATE_PREVIEW",
+        "CRITICAL": "PRIVATE_PREVIEW",
+        "NORMAL": "PRIVATE_PREVIEW"
+      }
+    },
+    "jobs.AlertEvaluationState": {
+      "description": "Same alert evaluation state as in redash-v2/api/proto/alertsv2/alerts.proto",
+      "enum": [
+        "UNKNOWN",
+        "TRIGGERED",
+        "OK",
+        "ERROR"
+      ],
+      "enum_launch_stages": {
+        "ERROR": "PUBLIC_PREVIEW",
+        "OK": "PUBLIC_PREVIEW",
+        "TRIGGERED": "PUBLIC_PREVIEW",
+        "UNKNOWN": "PUBLIC_PREVIEW"
+      }
+    },
+    "jobs.AlertTask": {
+      "fields": {
+        "alert_id": {
+          "description": "The alert_id is the canonical identifier of the alert.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "parameters": {
+          "description": "Per-run parameter overrides, keyed by parameter name, applied onto the alert's stored\nquery parameters before the query is executed. Only scalar values are supported. Values\nmay reference job parameters with `{{job.parameters.*}}`, which are resolved before the\ntask runs. An override whose key does not match a stored parameter fails the task run.\nLimited to 10000 characters when serialized as JSON; keys must be 1-100 characters and\ncontain only letters, digits, underscores, dashes, and periods.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "subscribers": {
+          "description": "The subscribers receive alert evaluation result notifications after the alert task is completed.\nThe number of subscriptions is limited to 100.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "warehouse_id": {
+          "description": "The warehouse_id identifies the warehouse settings used by the alert task.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "workspace_path": {
+          "description": "The workspace_path is the path to the alert file in the workspace. The path:\n* must start with \"/Workspace\"\n* must be a normalized path.\nUser has to select only one of alert_id or workspace_path to identify the alert.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "jobs.AlertTaskOutput": {
+      "fields": {
+        "alert_state": {
+          "ref": "jobs.AlertEvaluationState",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "jobs.AlertTaskSubscriber": {
+      "description": "Represents a subscriber that will receive alert notifications.\nA subscriber can be either a user (via email) or a notification destination (via destination_id).",
+      "fields": {
+        "destination_id": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "user_name": {
+          "description": "A valid workspace email address.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "jobs.AuthenticationMethod": {
+      "enum": [
+        "OAUTH",
+        "PAT"
+      ],
+      "enum_launch_stages": {
+        "OAUTH": "PUBLIC_PREVIEW",
+        "PAT": "PUBLIC_PREVIEW"
+      }
+    },
+    "jobs.BaseJob": {
+      "fields": {
+        "created_time": {
+          "description": "The time at which this job was created in epoch milliseconds (milliseconds since 1/1/1970 UTC).",
+          "launch_stage": "GA"
+        },
+        "creator_user_name": {
+          "description": "The creator user name. This field won’t be included in the response if the user has already been deleted.",
+          "launch_stage": "GA"
+        },
+        "effective_budget_policy_id": {
+          "description": "The id of the budget policy used by this job for cost attribution purposes.\nThis may be set through (in order of precedence):\n1. Budget admins through the account or workspace console\n2. Jobs UI in the job details page and Jobs API using `budget_policy_id`\n3. Inferred default based on accessible budget policies of the run_as identity on job creation or modification.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "effective_usage_policy_id": {
+          "description": "The id of the usage policy used by this job for cost attribution purposes.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "has_more": {
+          "description": "Indicates if the job has more array properties (`tasks`, `job_clusters`) that are not shown. They can be accessed via :method:jobs/get endpoint.\nIt is only relevant for API 2.2 :method:jobs/list requests with `expand_tasks=true`.",
+          "launch_stage": "GA"
+        },
+        "job_id": {
+          "description": "The canonical identifier for this job.",
+          "launch_stage": "GA"
+        },
+        "settings": {
+          "description": "Settings for this job and all of its runs. These settings can be updated using the `resetJob` method.",
+          "ref": "jobs.JobSettings",
+          "launch_stage": "GA"
+        },
+        "trigger_details": {
+          "description": "Per-trigger runtime information for the multi-trigger surface. Same length\nand order as `JobSettings.triggers`; `trigger_details[i]` corresponds to\n`triggers[i]`. Sub-fields (`state`, `history`) are populated independently\nbased on the `GetJob.include_trigger_state` / `include_trigger_history` flags.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "trigger_state": {
+          "description": "State of the trigger associated with the job.",
+          "ref": "jobs.TriggerStateProto",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "jobs.BaseRun": {
+      "fields": {
+        "attempt_number": {
+          "description": "The sequence number of this run attempt for a triggered job run. The initial attempt of a run has an attempt_number of 0. If the initial run attempt fails, and the job has a retry policy (`max_retries` \u003e 0), subsequent runs are created with an `original_attempt_run_id` of the original attempt’s ID and an incrementing `attempt_number`. Runs are retried only until they succeed, and the maximum `attempt_number` is the same as the `max_retries` value for the job.",
+          "launch_stage": "GA"
+        },
+        "cleanup_duration": {
+          "description": "The time in milliseconds it took to terminate the cluster and clean up any associated artifacts. The duration of a task run is the sum of the `setup_duration`, `execution_duration`, and the `cleanup_duration`. The `cleanup_duration` field is set to 0 for multitask job runs. The total duration of a multitask job run is the value of the `run_duration` field.",
+          "launch_stage": "GA"
+        },
+        "cluster_instance": {
+          "description": "The cluster used for this run. If the run is specified to use a new cluster, this field is set once the Jobs service has requested a cluster for the run.",
+          "ref": "jobs.ClusterInstance",
+          "launch_stage": "GA"
+        },
+        "cluster_spec": {
+          "description": "A snapshot of the job’s cluster specification when this run was created.",
+          "ref": "jobs.ClusterSpec",
+          "launch_stage": "GA"
+        },
+        "creator_user_name": {
+          "description": "The creator user name. This field won’t be included in the response if the user has already been deleted.",
+          "launch_stage": "GA"
+        },
+        "deployment_id": {
+          "description": "ID of the deployment that produced the job when this run was created. Used to look up\ndeployment metadata from the Deployment Metadata service. Only set for job runs of jobs\nwith a `BUNDLE` deployment.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "description": {
+          "description": "Description of the run",
+          "launch_stage": "GA"
+        },
+        "duration_target": {
+          "description": "The window the run aims to finish within, in hours, for a Cost-optimized serverless run.\nRequired only when `performance_target` is `COST_OPTIMIZED`. Must be one of the\nsupported values: `NO_FLEXIBILITY`, `4h`, `12h`, `24h`, `72h`. `NO_FLEXIBILITY` means the run\nuses the default cost-optimized performance level without additional cost-saving optimizations.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "effective_performance_target": {
+          "description": "The actual performance target used by the serverless run during execution. This can differ from the client-set performance target on the request depending on whether the performance mode is supported by the job type.\n\n* `PERFORMANCE_OPTIMIZED`: Prioritizes fast startup and execution times through rapid scaling and optimized cluster performance.\n* `STANDARD`: Enables cost-efficient execution of serverless workloads.\n* `COST_OPTIMIZED`: Enables lower job costs by optimizing compute for your selected target duration time. Must provide a duration target.",
+          "ref": "jobs.PerformanceTarget",
+          "launch_stage": "GA"
+        },
+        "effective_usage_policy_id": {
+          "description": "The id of the usage policy used by this run for cost attribution purposes.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "end_time": {
+          "description": "The time at which this run ended in epoch milliseconds (milliseconds since 1/1/1970 UTC). This field is set to 0 if the job is still running.",
+          "launch_stage": "GA"
+        },
+        "environment_variables": {
+          "description": "Snapshot of `JobSettings.environment_variables` as it was at run\nlaunch — the full list of named environment-variable entries the job\ndefined. To find which entry a given task ran with, look at\n`RunTaskSettings.environment_variables_key`.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "execution_duration": {
+          "description": "The time in milliseconds it took to execute the commands in the JAR or notebook until they  completed, failed, timed out, were cancelled, or encountered an unexpected error. The duration of a task run is the sum of the `setup_duration`, `execution_duration`, and the  `cleanup_duration`. The `execution_duration` field is set to 0 for multitask job runs. The total  duration of a multitask job run is the value of the `run_duration` field.",
+          "launch_stage": "GA"
+        },
+        "git_source": {
+          "description": "An optional specification for a remote Git repository containing the source code used by tasks. Version-controlled source code is supported by notebook, dbt, Python script, and SQL File tasks.\n\nIf `git_source` is set, these tasks retrieve the file from the remote repository by default. However, this behavior can be overridden by setting `source` to `WORKSPACE` on the task.\n\nNote: dbt and SQL File tasks support only version-controlled sources. If dbt or SQL File tasks are used, `git_source` must be defined on the job.",
+          "ref": "jobs.GitSource",
+          "launch_stage": "GA"
+        },
+        "has_more": {
+          "description": "Indicates if the run has more array properties (`tasks`, `job_clusters`) that are not shown. They can be accessed via :method:jobs/getrun endpoint.\nIt is only relevant for API 2.2 :method:jobs/listruns requests with `expand_tasks=true`.",
+          "launch_stage": "GA"
+        },
+        "job_clusters": {
+          "description": "A list of job cluster specifications that can be shared and reused by tasks of this job. Libraries cannot be declared in a shared job cluster. You must declare dependent libraries in task settings.\nIf more than 100 job clusters are available, you can paginate through them using :method:jobs/getrun.",
+          "launch_stage": "GA"
+        },
+        "job_id": {
+          "description": "The canonical identifier of the job that contains this run.",
+          "launch_stage": "GA"
+        },
+        "job_parameters": {
+          "description": "Job-level parameters used in the run",
+          "launch_stage": "GA"
+        },
+        "job_run_id": {
+          "description": "ID of the job run that this run belongs to.\nFor legacy and single-task job runs the field is populated with the job run ID.\nFor task runs, the field is populated with the ID of the job run that the task run belongs to.",
+          "launch_stage": "GA"
+        },
+        "number_in_job": {
+          "description": "A unique identifier for this job run. This is set to the same value as `run_id`.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "original_attempt_run_id": {
+          "description": "If this run is a retry of a prior run attempt, this field contains the run_id of the original attempt; otherwise, it is the same as the run_id.",
+          "launch_stage": "GA"
+        },
+        "overriding_parameters": {
+          "description": "The parameters used for this run.",
+          "ref": "jobs.RunParameters",
+          "launch_stage": "GA"
+        },
+        "queue_duration": {
+          "description": "The time in milliseconds that the run has spent in the queue.",
+          "launch_stage": "GA"
+        },
+        "repair_history": {
+          "description": "The repair history of the run.",
+          "launch_stage": "GA"
+        },
+        "run_duration": {
+          "description": "The time in milliseconds it took the job run and all of its repairs to finish.",
+          "launch_stage": "GA"
+        },
+        "run_id": {
+          "description": "The canonical identifier of the run. This ID is unique across all runs of all jobs.",
+          "launch_stage": "GA"
+        },
+        "run_name": {
+          "description": "An optional name for the run. The maximum length is 4096 bytes in UTF-8 encoding.",
+          "launch_stage": "GA"
+        },
+        "run_page_url": {
+          "description": "The URL to the detail page of the run.",
+          "launch_stage": "GA"
+        },
+        "run_type": {
+          "ref": "jobs.RunType",
+          "launch_stage": "GA"
+        },
+        "schedule": {
+          "description": "The cron schedule that triggered this run if it was triggered by the periodic scheduler.",
+          "ref": "jobs.CronSchedule",
+          "launch_stage": "GA"
+        },
+        "setup_duration": {
+          "description": "The time in milliseconds it took to set up the cluster. For runs that run on new clusters this is the cluster creation time, for runs that run on existing clusters this time should be very short. The duration of a task run is the sum of the `setup_duration`, `execution_duration`, and the `cleanup_duration`. The `setup_duration` field is set to 0 for multitask job runs. The total duration of a multitask job run is the value of the `run_duration` field.",
+          "launch_stage": "GA"
+        },
+        "start_time": {
+          "description": "The time at which this run was started in epoch milliseconds (milliseconds since 1/1/1970 UTC). This may not be the time when the job task starts executing, for example, if the job is scheduled to run on a new cluster, this is the time the cluster creation call is issued.",
+          "launch_stage": "GA"
+        },
+        "state": {
+          "description": "Deprecated. Please use the `status` field instead.",
+          "ref": "jobs.RunState",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "status": {
+          "ref": "jobs.RunStatus",
+          "launch_stage": "GA"
+        },
+        "tasks": {
+          "description": "The list of tasks performed by the run. Each task has its own `run_id` which you can use to call `JobsGetOutput` to retrieve the run results.\nIf more than 100 tasks are available, you can paginate through them using :method:jobs/getrun. Use the `next_page_token` field at the object root to determine if more results are available.",
+          "launch_stage": "GA"
+        },
+        "trigger": {
+          "ref": "jobs.TriggerType",
+          "launch_stage": "GA"
+        },
+        "trigger_info": {
+          "ref": "jobs.TriggerInfo",
+          "launch_stage": "GA"
+        },
+        "version_id": {
+          "description": "ID of the deployment version that produced the job when this run was created. Identifies\na specific snapshot of the deployment in the Deployment Metadata service. Only set for\njob runs of jobs with a `BUNDLE` deployment.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "jobs.CancelAllRuns": {
+      "fields": {
+        "all_queued_runs": {
+          "description": "Optional boolean parameter to cancel all queued runs. If no job_id is provided, all queued runs in the workspace are canceled.",
+          "launch_stage": "GA"
+        },
+        "job_id": {
+          "description": "The canonical identifier of the job to cancel all runs of.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.CancelRun": {
+      "fields": {
+        "run_id": {
+          "description": "This field is required.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.CleanRoomTaskRunLifeCycleState": {
+      "description": "Copied from elastic-spark-common/api/messages/runs.proto.\nUsing the original definition to remove coupling with jobs API definition",
+      "enum": [
+        "RUN_LIFE_CYCLE_STATE_UNSPECIFIED",
+        "PENDING",
+        "RUNNING",
+        "TERMINATING",
+        "TERMINATED",
+        "SKIPPED",
+        "INTERNAL_ERROR",
+        "BLOCKED",
+        "WAITING_FOR_RETRY",
+        "QUEUED"
+      ],
+      "enum_launch_stages": {
+        "BLOCKED": "GA",
+        "INTERNAL_ERROR": "GA",
+        "PENDING": "GA",
+        "QUEUED": "GA",
+        "RUNNING": "GA",
+        "RUN_LIFE_CYCLE_STATE_UNSPECIFIED": "GA",
+        "SKIPPED": "GA",
+        "TERMINATED": "GA",
+        "TERMINATING": "GA",
+        "WAITING_FOR_RETRY": "GA"
+      }
+    },
+    "jobs.CleanRoomTaskRunResultState": {
+      "description": "Copied from elastic-spark-common/api/messages/runs.proto.\nUsing the original definition to avoid cyclic dependency.",
+      "enum": [
+        "RUN_RESULT_STATE_UNSPECIFIED",
+        "SUCCESS",
+        "FAILED",
+        "TIMEDOUT",
+        "CANCELED",
+        "MAXIMUM_CONCURRENT_RUNS_REACHED",
+        "UPSTREAM_CANCELED",
+        "UPSTREAM_FAILED",
+        "EXCLUDED",
+        "EVICTED",
+        "SUCCESS_WITH_FAILURES",
+        "UPSTREAM_EVICTED",
+        "DISABLED"
+      ],
+      "enum_launch_stages": {
+        "CANCELED": "GA",
+        "DISABLED": "GA",
+        "EVICTED": "GA",
+        "EXCLUDED": "GA",
+        "FAILED": "GA",
+        "MAXIMUM_CONCURRENT_RUNS_REACHED": "GA",
+        "RUN_RESULT_STATE_UNSPECIFIED": "GA",
+        "SUCCESS": "GA",
+        "SUCCESS_WITH_FAILURES": "GA",
+        "TIMEDOUT": "GA",
+        "UPSTREAM_CANCELED": "GA",
+        "UPSTREAM_EVICTED": "GA",
+        "UPSTREAM_FAILED": "GA"
+      }
+    },
+    "jobs.CleanRoomTaskRunState": {
+      "description": "Stores the run state of the clean rooms notebook task.",
+      "fields": {
+        "life_cycle_state": {
+          "description": "A value indicating the run's current lifecycle state. This field is always available in the response. Note: Additional states might be introduced in future releases.",
+          "ref": "jobs.CleanRoomTaskRunLifeCycleState",
+          "launch_stage": "GA"
+        },
+        "result_state": {
+          "description": "A value indicating the run's result. This field is only available for terminal lifecycle states. Note: Additional states might be introduced in future releases.",
+          "ref": "jobs.CleanRoomTaskRunResultState",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.CleanRoomsNotebookTask": {
+      "description": "Clean Rooms notebook task for V1 Clean Room service (GA).\nReplaces the deprecated CleanRoomNotebookTask (defined above) which was for V0 service.",
+      "fields": {
+        "clean_room_name": {
+          "description": "The clean room that the notebook belongs to.",
+          "launch_stage": "GA"
+        },
+        "etag": {
+          "description": "Checksum to validate the freshness of the notebook resource (i.e. the notebook being run is the latest version).\nIt can be fetched by calling the :method:cleanroomassets/get API.",
+          "launch_stage": "GA"
+        },
+        "notebook_base_parameters": {
+          "description": "Base parameters to be used for the clean room notebook job.",
+          "launch_stage": "GA"
+        },
+        "notebook_name": {
+          "description": "Name of the notebook being run.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.CleanRoomsNotebookTaskCleanRoomsNotebookTaskOutput": {
+      "fields": {
+        "clean_room_job_run_state": {
+          "description": "The run state of the clean rooms notebook task.",
+          "ref": "jobs.CleanRoomTaskRunState",
+          "launch_stage": "GA"
+        },
+        "notebook_output": {
+          "description": "The notebook output for the clean room run",
+          "ref": "jobs.NotebookOutput",
+          "launch_stage": "GA"
+        },
+        "output_schema_info": {
+          "description": "Information on how to access the output schema for the clean room run",
+          "ref": "jobs.OutputSchemaInfo",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.ClusterInstance": {
+      "fields": {
+        "cluster_id": {
+          "description": "The canonical identifier for the cluster used by a run. This field is always available for runs on existing clusters. For runs on new clusters, it becomes available once the cluster is created. This value can be used to view logs by browsing to `/#setting/sparkui/$cluster_id/driver-logs`. The logs continue to be available after the run completes.\n\nThe response won’t include this field if the identifier is not available yet.",
+          "launch_stage": "GA"
+        },
+        "spark_context_id": {
+          "description": "The canonical identifier for the Spark context used by a run. This field is filled in once the run begins execution. This value can be used to view the Spark UI by browsing to `/#setting/sparkui/$cluster_id/$spark_context_id`. The Spark UI continues to be available after the run has completed.\n\nThe response won’t include this field if the identifier is not available yet.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.ClusterSpec": {
+      "fields": {
+        "existing_cluster_id": {
+          "description": "If existing_cluster_id, the ID of an existing cluster that is used for all runs.\nWhen running jobs or tasks on an existing cluster, you may need to manually restart\nthe cluster if it stops responding. We suggest running jobs and tasks on new clusters for\ngreater reliability",
+          "launch_stage": "GA"
+        },
+        "job_cluster_key": {
+          "description": "If job_cluster_key, this task is executed reusing the cluster specified in `job.settings.job_clusters`.",
+          "launch_stage": "GA"
+        },
+        "libraries": {
+          "description": "An optional list of libraries to be installed on the cluster.\nThe default value is an empty list.",
+          "launch_stage": "GA"
+        },
+        "new_cluster": {
+          "description": "If new_cluster, a description of a new cluster that is created for each run.",
+          "ref": "compute.ClusterSpec",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.Compute": {
+      "fields": {
+        "hardware_accelerator": {
+          "description": "Hardware accelerator configuration for Serverless GPU workloads.",
+          "ref": "compute.HardwareAcceleratorType",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "jobs.ComputeConfig": {
+      "fields": {
+        "gpu_node_pool_id": {
+          "description": "IDof the GPU pool to use.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "gpu_type": {
+          "description": "GPU type.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "num_gpus": {
+          "description": "Number of GPUs.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "jobs.ComputeSpec": {
+      "description": "ComputeSpec: compute configuration — accelerator type and total\naccelerator count across all nodes.",
+      "fields": {
+        "accelerator_count": {
+          "description": "Total number of accelerators across all nodes. Must be a positive\nmultiple of the per-node accelerator count encoded in `accelerator_type`.\nFor example, `GPU_8xH100` with `accelerator_count: 16` allocates 2 nodes\n(8 GPUs per node).",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "accelerator_type": {
+          "description": "Hardware accelerator type (for example, `GPU_1xA10` or `GPU_8xH100`).\nThe number of accelerators per node is encoded in the enum value —\n`GPU_8xH100` means 8 H100 GPUs per node.",
+          "ref": "jobs.ComputeSpecAcceleratorType",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "provisioned_capacity_id": {
+          "description": "Optional ID of a pre-provisioned accelerator capacity reservation to run\nthis AI Runtime workload on. When set, the workload is scheduled onto the\nreferenced reserved capacity instead of the on-demand capacity shared among\nall Databricks customers.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "jobs.ComputeSpecAcceleratorType": {
+      "description": "Hardware accelerator type for the AiRuntime workload. Per-node\naccelerator count is encoded in the value name (e.g. `GPU_8xH100` means\n8 H100s per node).",
+      "enum": [
+        "GPU_1xA10",
+        "GPU_1xH100",
+        "GPU_8xH100",
+        "GPU_8xB300"
+      ],
+      "enum_launch_stages": {
+        "GPU_1xA10": "PUBLIC_PREVIEW",
+        "GPU_1xH100": "PUBLIC_PREVIEW",
+        "GPU_8xB300": "PUBLIC_PREVIEW",
+        "GPU_8xH100": "PUBLIC_PREVIEW"
+      }
+    },
+    "jobs.Condition": {
+      "enum": [
+        "ANY_UPDATED",
+        "ALL_UPDATED"
+      ],
+      "enum_launch_stages": {
+        "ALL_UPDATED": "GA",
+        "ANY_UPDATED": "GA"
+      }
+    },
+    "jobs.ConditionTask": {
+      "fields": {
+        "left": {
+          "description": "The left operand of the condition task. Can be either a string value or a job state or parameter reference.",
+          "launch_stage": "GA"
+        },
+        "op": {
+          "description": "* `EQUAL_TO`, `NOT_EQUAL` operators perform string comparison of their operands. This means that `“12.0” == “12”` will evaluate to `false`.\n* `GREATER_THAN`, `GREATER_THAN_OR_EQUAL`, `LESS_THAN`, `LESS_THAN_OR_EQUAL` operators perform numeric comparison of their operands. `“12.0” \u003e= “12”` will evaluate to `true`, `“10.0” \u003e= “12”` will evaluate to `false`.\n\nThe boolean comparison to task values can be implemented with operators `EQUAL_TO`, `NOT_EQUAL`. If a task value was set to a boolean value, it will be serialized to `“true”` or `“false”` for the comparison.",
+          "ref": "jobs.ConditionTaskOp",
+          "launch_stage": "GA"
+        },
+        "right": {
+          "description": "The right operand of the condition task. Can be either a string value or a job state or parameter reference.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.ConditionTaskOp": {
+      "description": "* `EQUAL_TO`, `NOT_EQUAL` operators perform string comparison of their operands. This means that `“12.0” == “12”` will evaluate to `false`.\n* `GREATER_THAN`, `GREATER_THAN_OR_EQUAL`, `LESS_THAN`, `LESS_THAN_OR_EQUAL` operators perform numeric comparison of their operands. `“12.0” \u003e= “12”` will evaluate to `true`, `“10.0” \u003e= “12”` will evaluate to `false`.\n\nThe boolean comparison to task values can be implemented with operators `EQUAL_TO`, `NOT_EQUAL`. If a task value was set to a boolean value, it will be serialized to `“true”` or `“false”` for the comparison.",
+      "enum": [
+        "EQUAL_TO",
+        "GREATER_THAN",
+        "GREATER_THAN_OR_EQUAL",
+        "LESS_THAN",
+        "LESS_THAN_OR_EQUAL",
+        "NOT_EQUAL"
+      ],
+      "enum_launch_stages": {
+        "EQUAL_TO": "GA",
+        "GREATER_THAN": "GA",
+        "GREATER_THAN_OR_EQUAL": "GA",
+        "LESS_THAN": "GA",
+        "LESS_THAN_OR_EQUAL": "GA",
+        "NOT_EQUAL": "GA"
+      }
+    },
+    "jobs.Continuous": {
+      "fields": {
+        "maintenance_window": {
+          "description": "Defines when platform-initiated maintenance may run for this job. If unspecified, maintenance may run at any time.",
+          "ref": "jobs.MaintenanceWindow",
+          "launch_stage": "GA"
+        },
+        "pause_status": {
+          "description": "Indicate whether the continuous execution of the job is paused or not. Defaults to UNPAUSED.",
+          "ref": "jobs.PauseStatus",
+          "launch_stage": "GA"
+        },
+        "task_retry_mode": {
+          "description": "Indicate whether the continuous job is applying task level retries or not. Defaults to NEVER.",
+          "ref": "jobs.TaskRetryMode",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.ContinuousTriggerConfiguration": {
+      "description": "Continuous trigger. Stripped-down counterpart to `ContinuousSettings`: `pause_status` is owned by the enclosing\n`TriggerConfiguration` and intentionally omitted here.",
+      "fields": {
+        "maintenance_window": {
+          "description": "Defines when platform-initiated maintenance may run for this trigger. If unspecified,\nmaintenance may run at any time.",
+          "ref": "jobs.MaintenanceWindow",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "task_retry_mode": {
+          "description": "Whether the continuous job applies task-level retries. Defaults to NEVER.",
+          "ref": "jobs.TaskRetryMode",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "jobs.ContinuousTriggerState": {
+      "fields": {
+        "consecutive_failures": {
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "is_backing_off": {
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "next_attempt_ms": {
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "jobs.CreateJob": {
+      "fields": {
+        "access_control_list": {
+          "description": "List of permissions to set on the job.",
+          "launch_stage": "GA"
+        },
+        "budget_policy_id": {
+          "description": "The id of the user specified budget policy to use for this job.\nIf not specified, a default budget policy may be applied when creating or modifying the job.\nSee `effective_budget_policy_id` for the budget policy used by this workload.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "continuous": {
+          "description": "An optional continuous property for this job. The continuous property will ensure that there is always one run executing. Only one of `schedule` and `continuous` can be used.\n\nPipelines started by a continuous job also run continuously, regardless of their own pipeline mode setting.",
+          "ref": "jobs.Continuous",
+          "launch_stage": "GA"
+        },
+        "deployment": {
+          "description": "Deployment information for jobs managed by external sources.",
+          "ref": "jobs.JobDeployment",
+          "launch_stage": "GA"
+        },
+        "description": {
+          "description": "An optional description for the job. The maximum length is 27700 characters in UTF-8 encoding.",
+          "launch_stage": "GA"
+        },
+        "duration_target": {
+          "description": "The window the run aims to finish within, in hours, for a Cost-optimized serverless run.\nRequired only when `performance_target` is `COST_OPTIMIZED`. Must be one of the\nsupported values: `NO_FLEXIBILITY`, `4h`, `12h`, `24h`, `72h`. `NO_FLEXIBILITY` means the run\nuses the default cost-optimized performance level without additional cost-saving optimizations.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "edit_mode": {
+          "description": "Edit mode of the job.\n\n* `UI_LOCKED`: The job is in a locked UI state and cannot be modified.\n* `EDITABLE`: The job is in an editable state and can be modified.",
+          "ref": "jobs.JobEditMode",
+          "launch_stage": "GA"
+        },
+        "email_notifications": {
+          "description": "An optional set of email addresses that is notified when runs of this job begin or complete as well as when this job is deleted.",
+          "ref": "jobs.JobEmailNotifications",
+          "launch_stage": "GA"
+        },
+        "environment_variables": {
+          "description": "Named environment-variable entries that tasks can reference by key from\n`TaskSettings.environment_variables_key`. Each entry's `spec` holds inline\n`variables` and optional `.env` `files`. Maximum 10 entries per job. A task\ncan reference at most one entry from this list.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "environments": {
+          "description": "A list of task execution environment specifications that can be referenced by tasks that use serverless compute or a compute resource that uses Environments mode.\n\nFor notebook tasks that use serverless compute or a compute resource that uses Environments mode, if the environment_key is not specified, the notebook environment will be used if present. If a jobs environment is specified, it will override the notebook environment.\nFor other tasks that use serverless compute or a compute resource that uses Environments mode, the task environment is required to be specified using environment_key in the task settings.",
+          "launch_stage": "GA"
+        },
+        "format": {
+          "description": "Used to tell what is the format of the job. This field is ignored in Create/Update/Reset calls. When using the Jobs API 2.1 this value is always set to `\"MULTI_TASK\"`.",
+          "ref": "jobs.Format",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "git_source": {
+          "description": "An optional specification for a remote Git repository containing the source code used by tasks. Version-controlled source code is supported by notebook, dbt, Python script, and SQL File tasks.\n\nIf `git_source` is set, these tasks retrieve the file from the remote repository by default. However, this behavior can be overridden by setting `source` to `WORKSPACE` on the task.\n\nNote: dbt and SQL File tasks support only version-controlled sources. If dbt or SQL File tasks are used, `git_source` must be defined on the job.",
+          "ref": "jobs.GitSource",
+          "launch_stage": "GA"
+        },
+        "health": {
+          "ref": "jobs.JobsHealthRules",
+          "launch_stage": "GA"
+        },
+        "job_clusters": {
+          "description": "A list of job cluster specifications that can be shared and reused by tasks of this job. Libraries cannot be declared in a shared job cluster. You must declare dependent libraries in task settings.",
+          "launch_stage": "GA"
+        },
+        "max_concurrent_runs": {
+          "description": "An optional maximum allowed number of concurrent runs of the job.\nSet this value if you want to be able to execute multiple runs of the same job concurrently.\nThis is useful for example if you trigger your job on a frequent schedule and want to allow consecutive runs to overlap with each other, or if you want to trigger multiple runs which differ by their input parameters.\nThis setting affects only new runs. For example, suppose the job’s concurrency is 4 and there are 4 concurrent active runs. Then setting the concurrency to 3 won’t kill any of the active runs.\nHowever, from then on, new runs are skipped unless there are fewer than 3 active runs.\nThis value cannot exceed 1000. Setting this value to `0` causes all new runs to be skipped.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "An optional name for the job. The maximum length is 4096 bytes in UTF-8 encoding.",
+          "launch_stage": "GA"
+        },
+        "notification_settings": {
+          "description": "Optional notification settings that are used when sending notifications to each of the `email_notifications` and `webhook_notifications` for this job.",
+          "ref": "jobs.JobNotificationSettings",
+          "launch_stage": "GA"
+        },
+        "parameters": {
+          "description": "Job-level parameter definitions",
+          "launch_stage": "GA"
+        },
+        "parent_path": {
+          "description": "Path of the job parent folder in workspace file tree. If absent, the job doesn't have a workspace object.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "performance_target": {
+          "description": "The performance mode on a serverless job. This field determines the level of compute performance or cost-efficiency for the run.\nThe performance target does not apply to tasks that run on Serverless GPU compute.\n\n* `PERFORMANCE_OPTIMIZED`: Prioritizes fast startup and execution times through rapid scaling and optimized cluster performance.\n* `STANDARD`: Enables cost-efficient execution of serverless workloads.\n* `COST_OPTIMIZED`: Enables lower job costs by optimizing compute for your selected target duration time. Must provide a duration target.",
+          "ref": "jobs.PerformanceTarget",
+          "launch_stage": "GA"
+        },
+        "queue": {
+          "description": "The queue settings of the job.",
+          "ref": "jobs.QueueSettings",
+          "launch_stage": "GA"
+        },
+        "run_as": {
+          "description": "The user or service principal that the job runs as, if specified in the request.\nThis field indicates the explicit configuration of `run_as` for the job.\nTo find the value in all cases, explicit or implicit, use `run_as_user_name`.",
+          "ref": "jobs.JobRunAs",
+          "launch_stage": "GA"
+        },
+        "schedule": {
+          "description": "An optional periodic schedule for this job. The default behavior is that the job only runs when triggered by clicking “Run Now” in the Jobs UI or sending an API request to `runNow`.",
+          "ref": "jobs.CronSchedule",
+          "launch_stage": "GA"
+        },
+        "tags": {
+          "description": "A map of tags associated with the job. These are forwarded to the cluster as cluster tags for jobs clusters, and are subject to the same limitations as cluster tags. A maximum of 25 tags can be added to the job.",
+          "launch_stage": "GA"
+        },
+        "tasks": {
+          "description": "A list of task specifications to be executed by this job.\nIt supports up to 1000 elements in write endpoints (:method:jobs/create, :method:jobs/reset, :method:jobs/update, :method:jobs/submit).\nRead endpoints return only 100 tasks. If more than 100 tasks are available, you can paginate through them using :method:jobs/get. Use the `next_page_token` field at the object root to determine if more results are available.",
+          "launch_stage": "GA"
+        },
+        "timeout_seconds": {
+          "description": "An optional timeout applied to each run of this job. A value of `0` means no timeout.",
+          "launch_stage": "GA"
+        },
+        "trigger": {
+          "description": "A configuration to trigger a run when certain conditions are met. The default behavior is that the job runs only when triggered by clicking “Run Now” in the Jobs UI or sending an API request to `runNow`.",
+          "ref": "jobs.TriggerSettings",
+          "launch_stage": "GA"
+        },
+        "triggers": {
+          "description": "List of triggers attached to this job. A run starts when any active trigger evaluates to true. Cannot be set in\nthe same request as the legacy `schedule`, `trigger`, or `continuous` fields. Gated behind the \"Multiple Triggers\" feature preview.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "usage_policy_id": {
+          "description": "The id of the user specified usage policy to use for this job.\nIf not specified, a default usage policy may be applied when creating or modifying the job.\nSee `effective_usage_policy_id` for the usage policy used by this workload.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "webhook_notifications": {
+          "description": "A collection of system notification IDs to notify when runs of this job begin or complete.",
+          "ref": "jobs.WebhookNotifications",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.CreateResponse": {
+      "description": "Job was created successfully",
+      "fields": {
+        "job_id": {
+          "description": "The canonical identifier for the newly created job.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.CronSchedule": {
+      "fields": {
+        "pause_status": {
+          "description": "Indicate whether this schedule is paused or not.",
+          "ref": "jobs.PauseStatus",
+          "launch_stage": "GA"
+        },
+        "quartz_cron_expression": {
+          "description": "A Cron expression using Quartz syntax that describes the schedule for a job. See [Cron Trigger](http://www.quartz-scheduler.org/documentation/quartz-2.3.0/tutorials/crontrigger.html) for details. This field is required.",
+          "launch_stage": "GA"
+        },
+        "sql_condition": {
+          "description": "SQL condition that must be satisfied before a scheduled run is triggered. The condition is evaluated\nafter the cron expression fires and must return a truthy result for the run to proceed.",
+          "ref": "jobs.SqlConditionConfiguration",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "timezone_id": {
+          "description": "A Java timezone ID. The schedule for a job is resolved with respect to this timezone. See [Java TimeZone](https://docs.oracle.com/javase/7/docs/api/java/util/TimeZone.html) for details. This field is required.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.CronTriggerConfiguration": {
+      "description": "Cron schedule trigger. Stripped-down counterpart to `CronSchedule`: `pause_status` and `sql_condition` are owned\nby the enclosing `TriggerConfiguration` and intentionally omitted here.",
+      "fields": {
+        "quartz_cron_expression": {
+          "description": "A Cron expression using Quartz syntax that describes the schedule for this trigger. See\n[Cron Trigger](http://www.quartz-scheduler.org/documentation/quartz-2.3.0/tutorials/crontrigger.html) for details.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "timezone_id": {
+          "description": "A Java timezone ID. The schedule is resolved with respect to this timezone. See\n[Java TimeZone](https://docs.oracle.com/javase/7/docs/api/java/util/TimeZone.html) for details.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "jobs.DashboardPageSnapshot": {
+      "fields": {
+        "page_display_name": {
+          "launch_stage": "GA"
+        },
+        "widget_error_details": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.DashboardTask": {
+      "description": "Configures the Lakeview Dashboard job task type.",
+      "fields": {
+        "dashboard_id": {
+          "description": "The identifier of the dashboard to refresh.",
+          "launch_stage": "GA"
+        },
+        "filters": {
+          "description": "Dashboard task parameters. Used to apply dashboard filter values during dashboard task execution. Parameter values get applied to any dashboard filters that have a matching URL identifier as the parameter key.\nThe parameter value format is dependent on the filter type:\n- For text and single-select filters, provide a single value (e.g. `\"value\"`)\n- For date and datetime filters, provide the value in ISO 8601 format (e.g. `\"2000-01-01T00:00:00\"`)\n- For multi-select filters, provide a JSON array of values (e.g. `\"[\\\"value1\\\",\\\"value2\\\"]\"`)\n- For range and date range filters, provide a JSON object with `start` and `end` (e.g. `\"{\\\"start\\\":\\\"1\\\",\\\"end\\\":\\\"10\\\"}\"`)",
+          "launch_stage": "GA"
+        },
+        "subscription": {
+          "description": "Optional: subscription configuration for sending the dashboard snapshot.",
+          "ref": "jobs.Subscription",
+          "launch_stage": "GA"
+        },
+        "warehouse_id": {
+          "description": "Optional: The warehouse id to execute the dashboard with for the schedule.\nIf not specified, the default warehouse of the dashboard will be used.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.DashboardTaskOutput": {
+      "fields": {
+        "page_snapshots": {
+          "description": "Should only be populated for manual PDF download jobs.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.DayOfWeek": {
+      "description": "Days of week that can be referenced by Jobs scheduling settings.",
+      "enum": [
+        "MONDAY",
+        "TUESDAY",
+        "WEDNESDAY",
+        "THURSDAY",
+        "FRIDAY",
+        "SATURDAY",
+        "SUNDAY"
+      ],
+      "enum_launch_stages": {
+        "FRIDAY": "GA",
+        "MONDAY": "GA",
+        "SATURDAY": "GA",
+        "SUNDAY": "GA",
+        "THURSDAY": "GA",
+        "TUESDAY": "GA",
+        "WEDNESDAY": "GA"
+      }
+    },
+    "jobs.DbtCloudJobRunStep": {
+      "description": "Format of response retrieved from dbt Cloud, for inclusion in output\nDeprecated in favor of DbtPlatformJobRunStep",
+      "fields": {
+        "index": {
+          "description": "Orders the steps in the job",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "logs": {
+          "description": "Output of the step",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "name": {
+          "description": "Name of the step in the job",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "status": {
+          "description": "State of the step",
+          "ref": "jobs.DbtPlatformRunStatus",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "jobs.DbtCloudTask": {
+      "description": "Deprecated in favor of DbtPlatformTask",
+      "fields": {
+        "connection_resource_name": {
+          "description": "The resource name of the UC connection that authenticates the dbt Cloud for this task",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "dbt_cloud_job_id": {
+          "description": "Id of the dbt Cloud job to be triggered",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "jobs.DbtCloudTaskOutput": {
+      "description": "Deprecated in favor of DbtPlatformTaskOutput",
+      "fields": {
+        "dbt_cloud_job_run_id": {
+          "description": "Id of the job run in dbt Cloud",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "dbt_cloud_job_run_output": {
+          "description": "Steps of the job run as received from dbt Cloud",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "dbt_cloud_job_run_url": {
+          "description": "Url where full run details can be viewed",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "jobs.DbtOutput": {
+      "fields": {
+        "artifacts_headers": {
+          "description": "An optional map of headers to send when retrieving the artifact from the `artifacts_link`.",
+          "launch_stage": "GA"
+        },
+        "artifacts_link": {
+          "description": "A pre-signed URL to download the (compressed) dbt artifacts. This link is valid for a limited time (30 minutes). This information is only available after the run has finished.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.DbtPlatformJobRunStep": {
+      "description": "Format of response retrieved from dbt platform, for inclusion in output",
+      "fields": {
+        "index": {
+          "description": "Orders the steps in the job",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "logs": {
+          "description": "Output of the step",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "logs_truncated": {
+          "description": "Whether the logs of this step have been truncated. If true, the logs has been truncated to 10000 characters.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "name": {
+          "description": "Name of the step in the job",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "name_truncated": {
+          "description": "Whether the name of the job has been truncated. If true, the name has been truncated to 100 characters.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "status": {
+          "description": "State of the step",
+          "ref": "jobs.DbtPlatformRunStatus",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "jobs.DbtPlatformRunStatus": {
+      "description": "Response enumeration from calling the dbt platform API, for inclusion in output",
+      "enum": [
+        "QUEUED",
+        "STARTING",
+        "RUNNING",
+        "SUCCESS",
+        "ERROR",
+        "CANCELLED"
+      ],
+      "enum_launch_stages": {
+        "CANCELLED": "PRIVATE_PREVIEW",
+        "ERROR": "PRIVATE_PREVIEW",
+        "QUEUED": "PRIVATE_PREVIEW",
+        "RUNNING": "PRIVATE_PREVIEW",
+        "STARTING": "PRIVATE_PREVIEW",
+        "SUCCESS": "PRIVATE_PREVIEW"
+      }
+    },
+    "jobs.DbtPlatformTask": {
+      "fields": {
+        "connection_resource_name": {
+          "description": "The resource name of the UC connection that authenticates the dbt platform for this task",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "dbt_platform_job_id": {
+          "description": "Id of the dbt platform job to be triggered. Specified as a string for maximum compatibility with clients.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "jobs.DbtPlatformTaskOutput": {
+      "fields": {
+        "dbt_platform_job_run_id": {
+          "description": "Id of the job run in dbt platform. Specified as a string for maximum compatibility with clients.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "dbt_platform_job_run_output": {
+          "description": "Steps of the job run as received from dbt platform",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "dbt_platform_job_run_url": {
+          "description": "Url where full run details can be viewed",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "steps_truncated": {
+          "description": "Whether the number of steps in the output has been truncated. If true, the output will contain the first 20 steps of the output.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "jobs.DbtTask": {
+      "fields": {
+        "catalog": {
+          "description": "Optional name of the catalog to use. The value is the top level in the 3-level namespace of Unity Catalog (catalog / schema / relation). The catalog value can only be specified if a warehouse_id is specified. Requires dbt-databricks \u003e= 1.1.1.",
+          "launch_stage": "GA"
+        },
+        "commands": {
+          "description": "A list of dbt commands to execute. All commands must start with `dbt`. This parameter must not be empty. A maximum of up to 10 commands can be provided.",
+          "launch_stage": "GA"
+        },
+        "profiles_directory": {
+          "description": "Optional (relative) path to the profiles directory. Can only be specified if no warehouse_id is specified. If no warehouse_id is specified and this folder is unset, the root directory is used.",
+          "launch_stage": "GA"
+        },
+        "project_directory": {
+          "description": "Path to the project directory. Optional for Git sourced tasks, in which\ncase if no value is provided, the root of the Git repository is used.",
+          "launch_stage": "GA"
+        },
+        "schema": {
+          "description": "Optional schema to write to. This parameter is only used when a warehouse_id is also provided. If not provided, the `default` schema is used.",
+          "launch_stage": "GA"
+        },
+        "source": {
+          "description": "Optional location type of the project directory. When set to `WORKSPACE`, the project will be retrieved\nfrom the local Databricks workspace. When set to `GIT`, the project will be retrieved from a Git repository\ndefined in `git_source`. If the value is empty, the task will use `GIT` if `git_source` is defined and `WORKSPACE` otherwise.\n\n* `WORKSPACE`: Project is located in Databricks workspace.\n* `GIT`: Project is located in cloud Git provider.",
+          "ref": "jobs.Source",
+          "launch_stage": "GA"
+        },
+        "warehouse_id": {
+          "description": "ID of the SQL warehouse to connect to. If provided, we automatically generate and provide the profile and connection details to dbt. It can be overridden on a per-command basis by using the `--profiles-dir` command line argument.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.DeleteJob": {
+      "fields": {
+        "job_id": {
+          "description": "The canonical identifier of the job to delete. This field is required.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.DeleteRun": {
+      "fields": {
+        "run_id": {
+          "description": "ID of the run to delete.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.DeploymentSpec": {
+      "description": "DeploymentSpec: configuration for one deployment within an AiRuntimeTask.\nEach entry in `AiRuntimeTask.deployments` describes a group of nodes that\nshare the same command and compute. Many single-program training\nalgorithms use a single entry where every node runs the same command;\nrole-split workloads (driver + worker, parameter server, separate eval\nnode, etc.) use multiple entries.",
+      "fields": {
+        "command_path": {
+          "description": "Workspace path of the script to run on each node in this deployment.\nUpload the script to this path and supply the path here. When the task\nruns, the file at this path is run on each node; if it fails, the task\nfails with its exit code.\n\nExample script contents:\n\n```bash\n# Plain Python:\npython train.py --epochs 10\n\n# Multi-GPU via accelerate:\naccelerate launch train.py --config config.yaml\n\n# Distributed via torchrun:\ntorchrun --nproc_per_node=8 train.py\n```",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "compute": {
+          "description": "Compute resources allocated to each node in this deployment.",
+          "ref": "jobs.ComputeSpec",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "name": {
+          "description": "Optional human-readable name for this deployment (for example, `driver`,\n`worker`, `param_server`). Used for log and UI display. Distinct names\nare recommended so deployments can be told apart, but uniqueness is not\nenforced.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "jobs.EnforcePolicyComplianceForJobResponseJobClusterSettingsChange": {
+      "description": "Represents a change to the job cluster's settings that would be required for the\njob clusters to become compliant with their policies.",
+      "fields": {
+        "field": {
+          "description": "The field where this change would be made, prepended with the job cluster key.",
+          "launch_stage": "GA"
+        },
+        "new_value": {
+          "description": "The new value of this field after enforcing policy compliance\n(either a number, a boolean, or a string) converted to a string.\nThis is intended to be read by a human. The typed new value of this field\ncan be retrieved by reading the settings field in the API response.",
+          "launch_stage": "GA"
+        },
+        "previous_value": {
+          "description": "The previous value of this field before enforcing policy compliance\n(either a number, a boolean, or a string) converted to a string.\nThis is intended to be read by a human. The type of the field\ncan be retrieved by reading the settings field in the API response.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.EnforcePolicyComplianceRequest": {
+      "fields": {
+        "job_id": {
+          "description": "The ID of the job you want to enforce policy compliance on.",
+          "launch_stage": "GA"
+        },
+        "validate_only": {
+          "description": "If set, previews changes made to the job to comply with its policy, but\ndoes not update the job.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.EnforcePolicyComplianceResponse": {
+      "fields": {
+        "has_changes": {
+          "description": "Whether any changes have been made to the job cluster settings for the job to\nbecome compliant with its policies.",
+          "launch_stage": "GA"
+        },
+        "job_cluster_changes": {
+          "description": "A list of job cluster changes that have been made to the job’s cluster\nsettings in order for all job clusters to become compliant with their\npolicies.",
+          "launch_stage": "GA"
+        },
+        "settings": {
+          "description": "Updated job settings after policy enforcement. Policy enforcement only\napplies to job clusters that are created when running the job (which are\nspecified in new_cluster) and does not apply to existing all-purpose clusters.\nUpdated job settings are derived by applying policy default values to the\nexisting job clusters in order to satisfy policy requirements.",
+          "ref": "jobs.JobSettings",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.ExportRunOutput": {
+      "description": "Run was exported successfully.",
+      "fields": {
+        "views": {
+          "description": "The exported content in HTML format (one for every view item). To extract the HTML notebook from the JSON response, download and run this [Python script](/_static/examples/extract.py).",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.ExportRunRequest": {
+      "fields": {
+        "run_id": {
+          "description": "The canonical identifier for the run. This field is required.",
+          "launch_stage": "GA"
+        },
+        "views_to_export": {
+          "description": "Which views to export (CODE, DASHBOARDS, or ALL). Defaults to CODE.",
+          "ref": "jobs.ViewsToExport",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.FileArrivalTriggerConfiguration": {
+      "fields": {
+        "min_time_between_triggers_seconds": {
+          "description": "If set, the trigger starts a run only after the specified amount of time passed since\nthe last time the trigger fired. The minimum allowed value is 60 seconds",
+          "launch_stage": "GA"
+        },
+        "url": {
+          "description": "URL to be monitored for file arrivals. The path must point to the root or a subpath of the external location.",
+          "launch_stage": "GA"
+        },
+        "wait_after_last_change_seconds": {
+          "description": "If set, the trigger starts a run only after no file activity has occurred for the specified amount of time.\nThis makes it possible to wait for a batch of incoming files to arrive before triggering a run. The\nminimum allowed value is 60 seconds.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.FileArrivalTriggerState": {
+      "fields": {
+        "using_file_events": {
+          "description": "Indicates whether the trigger leverages file events to detect file arrivals.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.ForEachStats": {
+      "fields": {
+        "error_message_stats": {
+          "description": "Sample of 3 most common error messages occurred during the iteration.",
+          "launch_stage": "GA"
+        },
+        "task_run_stats": {
+          "description": "Describes stats of the iteration. Only latest retries are considered.",
+          "ref": "jobs.ForEachTaskTaskRunStats",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.ForEachTask": {
+      "fields": {
+        "concurrency": {
+          "description": "An optional maximum allowed number of concurrent runs of the task.\nSet this value if you want to be able to execute multiple runs of the task concurrently.",
+          "launch_stage": "GA"
+        },
+        "inputs": {
+          "description": "Array for task to iterate on. This can be a JSON string or a reference to\nan array parameter.",
+          "launch_stage": "GA"
+        },
+        "task": {
+          "description": "Configuration for the task that will be run for each element in the array",
+          "ref": "jobs.Task",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.ForEachTaskErrorMessageStats": {
+      "fields": {
+        "count": {
+          "description": "Describes the count of such error message encountered during the\niterations.",
+          "launch_stage": "GA"
+        },
+        "error_message": {
+          "description": "Describes the error message occurred during the iterations.",
+          "launch_stage": "GA"
+        },
+        "termination_category": {
+          "description": "Describes the termination reason for the error message.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.ForEachTaskTaskRunStats": {
+      "fields": {
+        "active_iterations": {
+          "description": "Describes the iteration runs having an active lifecycle state or an active run sub state.",
+          "launch_stage": "GA"
+        },
+        "completed_iterations": {
+          "description": "Describes the number of failed and succeeded iteration runs.",
+          "launch_stage": "GA"
+        },
+        "failed_iterations": {
+          "description": "Describes the number of failed iteration runs.",
+          "launch_stage": "GA"
+        },
+        "scheduled_iterations": {
+          "description": "Describes the number of iteration runs that have been scheduled.",
+          "launch_stage": "GA"
+        },
+        "succeeded_iterations": {
+          "description": "Describes the number of succeeded iteration runs.",
+          "launch_stage": "GA"
+        },
+        "total_iterations": {
+          "description": "Describes the length of the list of items to iterate over.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.Format": {
+      "enum": [
+        "SINGLE_TASK",
+        "MULTI_TASK"
+      ],
+      "enum_launch_stages": {
+        "MULTI_TASK": "GA",
+        "SINGLE_TASK": "GA"
+      }
+    },
+    "jobs.GenAiComputeTask": {
+      "description": "DEPRECATED — use `AiRuntimeTask` for all new BYOT multi-node GPU\nworkloads (see ai_runtime_task.proto). `AiRuntimeTask` is the only\nsupported BYOT task type for new workloads; this proto is retained only\nfor AIR CLI (fka SGCLI) pywheel backwards compatibility and will be\nremoved once the pywheel → databricks-cli migration completes (post-\nPuPr).",
+      "fields": {
+        "command": {
+          "description": "Command launcher to run the actual script, e.g. bash, python etc.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "compute": {
+          "ref": "jobs.ComputeConfig",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "dl_runtime_image": {
+          "description": "Runtime image",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "mlflow_experiment_name": {
+          "description": "Optional string containing the name of the MLflow experiment to log the run to. If name is not\nfound, backend will create the mlflow experiment using the name.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "source": {
+          "description": "Optional location type of the training script. When set to `WORKSPACE`, the script will be retrieved from the local Databricks workspace. When set to `GIT`, the script will be retrieved from a Git repository\ndefined in `git_source`. If the value is empty, the task will use `GIT` if `git_source` is defined and `WORKSPACE` otherwise.\n* `WORKSPACE`: Script is located in Databricks workspace.\n* `GIT`: Script is located in cloud Git provider.",
+          "ref": "jobs.Source",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "training_script_path": {
+          "description": "The training script file path to be executed. Cloud file URIs (such as dbfs:/, s3:/, adls:/, gcs:/) and workspace paths are supported. For python files stored in the Databricks workspace, the path must be absolute and begin with `/`. For files stored in a remote repository, the path must be relative. This field is required.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "yaml_parameters": {
+          "description": "Optional string containing model parameters passed to the training script in yaml format.\nIf present, then the content in yaml_parameters_file_path will be ignored.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "yaml_parameters_file_path": {
+          "description": "Optional path to a YAML file containing model parameters passed to the training script.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "jobs.GetJobPermissionLevelsRequest": {},
+    "jobs.GetJobPermissionLevelsResponse": {
+      "fields": {
+        "permission_levels": {
+          "description": "Specific permission levels",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.GetJobPermissionsRequest": {},
+    "jobs.GetJobRequest": {
+      "fields": {
+        "include_trigger_state": {
+          "description": "Flag that indicates that trigger state should be included in the response.",
+          "launch_stage": "GA"
+        },
+        "job_id": {
+          "description": "The canonical identifier of the job to retrieve information about. This field is required.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Use `next_page_token` returned from the previous GetJob response to request the next page of the job's array properties.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.GetPolicyComplianceRequest": {
+      "fields": {
+        "job_id": {
+          "description": "The ID of the job whose compliance status you are requesting.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.GetPolicyComplianceResponse": {
+      "fields": {
+        "is_compliant": {
+          "description": "Whether the job is compliant with its policies or not. Jobs could be out of\ncompliance if a policy they are using was updated after the job was\nlast edited and some of its job clusters no longer comply with\ntheir updated policies.",
+          "launch_stage": "GA"
+        },
+        "violations": {
+          "description": "An object containing key-value mappings representing the first 200 policy\nvalidation errors.\nThe keys indicate the path where the policy validation error is occurring.\nAn identifier for the job cluster is prepended to the path.\nThe values indicate an error message describing the policy validation error.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.GetRunOutputRequest": {
+      "fields": {
+        "run_id": {
+          "description": "The canonical identifier for the run.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.GetRunRequest": {
+      "fields": {
+        "include_history": {
+          "description": "Whether to include the repair history in the response.",
+          "launch_stage": "GA"
+        },
+        "include_resolved_values": {
+          "description": "Whether to include resolved parameter values in the response.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Use `next_page_token` returned from the previous GetRun response to request the next page of the run's array properties.",
+          "launch_stage": "GA"
+        },
+        "run_id": {
+          "description": "The canonical identifier of the run for which to retrieve the metadata.\nThis field is required.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.GitProvider": {
+      "enum": [
+        "gitHub",
+        "bitbucketCloud",
+        "azureDevOpsServices",
+        "gitHubEnterprise",
+        "bitbucketServer",
+        "gitLab",
+        "gitLabEnterpriseEdition",
+        "awsCodeCommit"
+      ],
+      "enum_launch_stages": {
+        "awsCodeCommit": "GA",
+        "azureDevOpsServices": "GA",
+        "bitbucketCloud": "GA",
+        "bitbucketServer": "GA",
+        "gitHub": "GA",
+        "gitHubEnterprise": "GA",
+        "gitLab": "GA",
+        "gitLabEnterpriseEdition": "GA"
+      }
+    },
+    "jobs.GitSnapshot": {
+      "description": "Read-only state of the remote repository at the time the job was run. This field is only included on job runs.",
+      "fields": {
+        "used_commit": {
+          "description": "Commit that was used to execute the run. If git_branch was specified, this points to the HEAD of the branch at the time of the run; if git_tag was specified, this points to the commit the tag points to.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.GitSource": {
+      "description": "An optional specification for a remote Git repository containing the source code used by tasks. Version-controlled source code is supported by notebook, dbt, Python script, and SQL File tasks.\n\nIf `git_source` is set, these tasks retrieve the file from the remote repository by default. However, this behavior can be overridden by setting `source` to `WORKSPACE` on the task.\n\nNote: dbt and SQL File tasks support only version-controlled sources. If dbt or SQL File tasks are used, `git_source` must be defined on the job.",
+      "fields": {
+        "git_branch": {
+          "description": "Name of the branch to be checked out and used by this job. This field cannot be specified in conjunction with git_tag or git_commit.",
+          "launch_stage": "GA"
+        },
+        "git_commit": {
+          "description": "Commit to be checked out and used by this job. This field cannot be specified in conjunction with git_branch or git_tag.",
+          "launch_stage": "GA"
+        },
+        "git_provider": {
+          "description": "Unique identifier of the service used to host the Git repository. The value is case insensitive.",
+          "ref": "jobs.GitProvider",
+          "launch_stage": "GA"
+        },
+        "git_snapshot": {
+          "ref": "jobs.GitSnapshot",
+          "launch_stage": "GA"
+        },
+        "git_tag": {
+          "description": "Name of the tag to be checked out and used by this job. This field cannot be specified in conjunction with git_branch or git_commit.",
+          "launch_stage": "GA"
+        },
+        "git_url": {
+          "description": "URL of the repository to be cloned by this job.",
+          "launch_stage": "GA"
+        },
+        "job_source": {
+          "description": "The source of the job specification in the remote repository when the job is source controlled.",
+          "ref": "jobs.JobSource",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "sparse_checkout": {
+          "ref": "jobs.SparseCheckout",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.Job": {
+      "description": "Job was retrieved successfully.",
+      "fields": {
+        "created_time": {
+          "description": "The time at which this job was created in epoch milliseconds (milliseconds since 1/1/1970 UTC).",
+          "launch_stage": "GA"
+        },
+        "creator_user_name": {
+          "description": "The creator user name. This field won’t be included in the response if the user has already been deleted.",
+          "launch_stage": "GA"
+        },
+        "effective_budget_policy_id": {
+          "description": "The id of the budget policy used by this job for cost attribution purposes.\nThis may be set through (in order of precedence):\n1. Budget admins through the account or workspace console\n2. Jobs UI in the job details page and Jobs API using `budget_policy_id`\n3. Inferred default based on accessible budget policies of the run_as identity on job creation or modification.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "effective_usage_policy_id": {
+          "description": "The id of the usage policy used by this job for cost attribution purposes.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "has_more": {
+          "description": "Indicates if the job has more array properties (`tasks`, `job_clusters`) that are not shown. They can be accessed via :method:jobs/get endpoint.\nIt is only relevant for API 2.2 :method:jobs/list requests with `expand_tasks=true`.",
+          "launch_stage": "GA"
+        },
+        "job_id": {
+          "description": "The canonical identifier for this job.",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "A token that can be used to list the next page of array properties.",
+          "launch_stage": "GA"
+        },
+        "run_as_user_name": {
+          "description": "The email of an active workspace user or the application ID of a service principal that the job runs as. This value can be changed by setting the `run_as` field when creating or updating a job.\n\nBy default, `run_as_user_name` is based on the current job settings and is set to the creator of the job if job access control is disabled or to the user with the `is_owner` permission if job access control is enabled.",
+          "launch_stage": "GA"
+        },
+        "settings": {
+          "description": "Settings for this job and all of its runs. These settings can be updated using the `resetJob` method.",
+          "ref": "jobs.JobSettings",
+          "launch_stage": "GA"
+        },
+        "trigger_details": {
+          "description": "Per-trigger runtime information for the multi-trigger surface. Same length\nand order as `JobSettings.triggers`; `trigger_details[i]` corresponds to\n`triggers[i]`. Sub-fields (`state`, `history`) are populated independently\nbased on the `GetJob.include_trigger_state` / `include_trigger_history` flags.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "trigger_state": {
+          "description": "State of the trigger associated with the job.",
+          "ref": "jobs.TriggerStateProto",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "jobs.JobAccessControlRequest": {
+      "fields": {
+        "group_name": {
+          "description": "name of the group",
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "jobs.JobPermissionLevel",
+          "launch_stage": "GA"
+        },
+        "service_principal_name": {
+          "description": "application ID of a service principal",
+          "launch_stage": "GA"
+        },
+        "user_name": {
+          "description": "name of the user",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.JobAccessControlResponse": {
+      "fields": {
+        "all_permissions": {
+          "description": "All permissions.",
+          "launch_stage": "GA"
+        },
+        "display_name": {
+          "description": "Display name of the user or service principal.",
+          "launch_stage": "GA"
+        },
+        "group_name": {
+          "description": "name of the group",
+          "launch_stage": "GA"
+        },
+        "service_principal_name": {
+          "description": "Name of the service principal.",
+          "launch_stage": "GA"
+        },
+        "user_name": {
+          "description": "name of the user",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.JobCluster": {
+      "fields": {
+        "job_cluster_key": {
+          "description": "A unique name for the job cluster. This field is required and must be unique within the job.\n`JobTaskSettings` may refer to this field to determine which cluster to launch for the task execution.",
+          "launch_stage": "GA"
+        },
+        "new_cluster": {
+          "description": "If new_cluster, a description of a cluster that is created for each task.",
+          "ref": "compute.ClusterSpec",
+          "launch_stage": "GA"
+        },
+        "serverless_compute_id": {
+          "description": "The ID of the serverless compute object to bind this cluster to. At most one\nJobCluster per job may set this field; the rate limit defined on the referenced\nserverless compute applies across all tasks bound to this cluster.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "jobs.JobCompliance": {
+      "fields": {
+        "is_compliant": {
+          "description": "Whether this job is in compliance with the latest version of its policy.",
+          "launch_stage": "GA"
+        },
+        "job_id": {
+          "description": "Canonical unique identifier for a job.",
+          "launch_stage": "GA"
+        },
+        "violations": {
+          "description": "An object containing key-value mappings representing the first 200 policy\nvalidation errors.\nThe keys indicate the path where the policy validation error is occurring.\nAn identifier for the job cluster is prepended to the path.\nThe values indicate an error message describing the policy validation error.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.JobDeployment": {
+      "fields": {
+        "deployment_id": {
+          "description": "ID of the deployment that manages this job. Only set when `kind` is\n`BUNDLE`. Used to look up deployment metadata from the Deployment\nMetadata service.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "kind": {
+          "description": "The kind of deployment that manages the job.\n\n* `BUNDLE`: The job is managed by Databricks Asset Bundle.\n* `SYSTEM_MANAGED`: The job is managed by Databricks and is read-only.",
+          "ref": "jobs.JobDeploymentKind",
+          "launch_stage": "GA"
+        },
+        "metadata_file_path": {
+          "description": "Path of the file that contains deployment metadata.",
+          "launch_stage": "GA"
+        },
+        "version_id": {
+          "description": "ID of the version of the deployment that produced this job. Only set\nwhen `kind` is `BUNDLE`. Identifies a specific snapshot of the deployment\nin the Deployment Metadata service.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "jobs.JobDeploymentKind": {
+      "description": "* `BUNDLE`: The job is managed by Databricks Asset Bundle.\n* `SYSTEM_MANAGED`: The job is managed by Databricks and is read-only.",
+      "enum": [
+        "BUNDLE",
+        "SYSTEM_MANAGED"
+      ],
+      "enum_launch_stages": {
+        "BUNDLE": "GA",
+        "SYSTEM_MANAGED": "PUBLIC_BETA"
+      },
+      "enum_descriptions": {
+        "BUNDLE": "The job is managed by Databricks Asset Bundle.",
+        "SYSTEM_MANAGED": "The job is managed by \u003cDatabricks\u003e and is read-only."
+      }
+    },
+    "jobs.JobEditMode": {
+      "description": "Edit mode of the job.\n\n* `UI_LOCKED`: The job is in a locked UI state and cannot be modified.\n* `EDITABLE`: The job is in an editable state and can be modified.",
+      "enum": [
+        "UI_LOCKED",
+        "EDITABLE"
+      ],
+      "enum_launch_stages": {
+        "EDITABLE": "GA",
+        "UI_LOCKED": "GA"
+      },
+      "enum_descriptions": {
+        "EDITABLE": "The job is in an editable state and can be modified.",
+        "UI_LOCKED": "The job is in a locked UI state and cannot be modified."
+      }
+    },
+    "jobs.JobEmailNotifications": {
+      "fields": {
+        "no_alert_for_skipped_runs": {
+          "description": "If true, do not send email to recipients specified in `on_failure` if the run is skipped.\nThis field is `deprecated`. Please use the `notification_settings.no_alert_for_skipped_runs` field.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "on_duration_warning_threshold_exceeded": {
+          "description": "A list of email addresses to be notified when the duration of a run exceeds the threshold specified for the `RUN_DURATION_SECONDS` metric in the `health` field. If no rule for the `RUN_DURATION_SECONDS` metric is specified in the `health` field for the job, notifications are not sent.",
+          "launch_stage": "GA"
+        },
+        "on_failure": {
+          "description": "A list of email addresses to be notified when a run unsuccessfully completes. A run is considered to have completed unsuccessfully if it ends with an `INTERNAL_ERROR` `life_cycle_state` or a `FAILED`, or `TIMED_OUT` result_state. If this is not specified on job creation, reset, or update the list is empty, and notifications are not sent.",
+          "launch_stage": "GA"
+        },
+        "on_maintenance_complete": {
+          "description": "A list of email addresses to notify when platform-initiated maintenance completes for a continuous job.",
+          "launch_stage": "GA"
+        },
+        "on_maintenance_start": {
+          "description": "A list of email addresses to notify when platform-initiated maintenance starts for a continuous job.",
+          "launch_stage": "GA"
+        },
+        "on_start": {
+          "description": "A list of email addresses to be notified when a run begins. If not specified on job creation, reset, or update, the list is empty, and notifications are not sent.",
+          "launch_stage": "GA"
+        },
+        "on_streaming_backlog_exceeded": {
+          "description": "A list of email addresses to notify when any streaming backlog thresholds are exceeded for any stream.\nStreaming backlog thresholds can be set in the `health` field using the following metrics: `STREAMING_BACKLOG_BYTES`, `STREAMING_BACKLOG_RECORDS`, `STREAMING_BACKLOG_SECONDS`, or `STREAMING_BACKLOG_FILES`.\nAlerting is based on the 10-minute average of these metrics. If the issue persists, notifications are resent every 30 minutes.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "on_success": {
+          "description": "A list of email addresses to be notified when a run successfully completes. A run is considered to have completed successfully if it ends with a `TERMINATED` `life_cycle_state` and a `SUCCESS` result_state. If not specified on job creation, reset, or update, the list is empty, and notifications are not sent.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.JobEnvironment": {
+      "fields": {
+        "environment_key": {
+          "description": "The key of an environment. It has to be unique within a job.",
+          "launch_stage": "GA"
+        },
+        "spec": {
+          "ref": "compute.Environment",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.JobEnvironmentVariables": {
+      "description": "A named environment-variable entry, defined once at the job level and\nreferenced by key from one or more tasks. Entries live on\n`JobSettings.environment_variables`, and tasks select one via\n`TaskSettings.environment_variables_key`.",
+      "fields": {
+        "environment_variables_key": {
+          "description": "Identifier for this entry. Must be unique within\n`JobSettings.environment_variables`. Tasks reference it from\n`TaskSettings.environment_variables_key`.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "spec": {
+          "description": "The environment variable specification.",
+          "ref": "jobs.JobEnvironmentVariablesSpec",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "jobs.JobEnvironmentVariablesSpec": {
+      "description": "The environment variables and files associated with a job environment\nvariable entry. Runtime environment variables override inline `variables`,\nwhich override values from `files`, on duplicate keys.",
+      "fields": {
+        "files": {
+          "description": "Workspace (`/Workspace/...`) or UC Volumes (`/Volumes/...`) paths to\n`.env` files. Maximum 5 files. Files are read, parsed, and merged at\ntask execution time, not at job creation or update API call time.\n\nFile format: each line containing a variable must be exactly `KEY=VALUE`.\nEmpty and whitespace-only lines, and lines beginning with `#`, are ignored.\nKeys must match the same regex as inlined variable names\n(`^[A-Za-z_][A-Za-z0-9_]*$`); the value continues to the end of the line.\nNo other syntax is supported — no inline comments, no quoted values, no\nescape sequences, no variable interpolation. Any other line that does not\nmatch the `KEY=VALUE` shape fails the run.\n\nSize limits: maximum 32,768 bytes (32 KiB) per file on disk;\nmaximum 1,024 bytes (1 KiB) per `KEY=VALUE` line combined.\nFiles or lines exceeding these limits fail the run.\n\nOn a duplicate key, the later file wins; `variables` override values\nfrom any file.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "variables": {
+          "description": "Environment variables specified directly as key/value pairs. Maximum 20\nentries.\n\nEach key must be 1 to 256 characters and match\n`^[A-Za-z_][A-Za-z0-9_]*$`: it must start with an ASCII letter or\nunderscore and contain only ASCII letters, digits, and underscores. Each\nvalue can be any Unicode string of up to 512 characters, including an\nempty string.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "jobs.JobNotificationSettings": {
+      "fields": {
+        "no_alert_for_canceled_runs": {
+          "description": "If true, do not send notifications to recipients specified in `on_failure` if the run is canceled.",
+          "launch_stage": "GA"
+        },
+        "no_alert_for_skipped_runs": {
+          "description": "If true, do not send notifications to recipients specified in `on_failure` if the run is skipped.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.JobParameter": {
+      "fields": {
+        "default": {
+          "description": "The optional default value of the parameter",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The name of the parameter",
+          "launch_stage": "GA"
+        },
+        "value": {
+          "description": "The value used in the run",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.JobParameterDefinition": {
+      "fields": {
+        "default": {
+          "description": "Default value of the parameter.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The name of the defined parameter. May only contain alphanumeric characters, `_`, `-`, and `.`",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.JobPermission": {
+      "fields": {
+        "inherited": {
+          "launch_stage": "GA"
+        },
+        "inherited_from_object": {
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "jobs.JobPermissionLevel",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.JobPermissionLevel": {
+      "description": "Permission level",
+      "enum": [
+        "CAN_MANAGE",
+        "IS_OWNER",
+        "CAN_MANAGE_RUN",
+        "CAN_VIEW"
+      ]
+    },
+    "jobs.JobPermissions": {
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "GA"
+        },
+        "object_id": {
+          "launch_stage": "GA"
+        },
+        "object_type": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.JobPermissionsDescription": {
+      "fields": {
+        "description": {
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "jobs.JobPermissionLevel",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.JobPermissionsRequest": {
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.JobRunAs": {
+      "description": "Write-only setting. Specifies the user, service principal, or group that the job runs as. If not specified, the job runs as the user who created the job.\n\nOne of `user_name`, `service_principal_name`, or `group_name` should be specified. If not, an error is thrown.",
+      "fields": {
+        "group_name": {
+          "description": "Group name of an account group assigned to the workspace. When set, all tasks run as the group and the group's permissions are used for data access. Setting this field requires being a member of the group, or having the `Assume` permission on the group.",
+          "launch_stage": "GA"
+        },
+        "service_principal_name": {
+          "description": "Application ID of an active service principal. Setting this field requires the `servicePrincipal/user` role.",
+          "launch_stage": "GA"
+        },
+        "user_name": {
+          "description": "The email of an active workspace user. Non-admin users can only set this field to their own email.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.JobSettings": {
+      "fields": {
+        "budget_policy_id": {
+          "description": "The id of the user specified budget policy to use for this job.\nIf not specified, a default budget policy may be applied when creating or modifying the job.\nSee `effective_budget_policy_id` for the budget policy used by this workload.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "continuous": {
+          "description": "An optional continuous property for this job. The continuous property will ensure that there is always one run executing. Only one of `schedule` and `continuous` can be used.\n\nPipelines started by a continuous job also run continuously, regardless of their own pipeline mode setting.",
+          "ref": "jobs.Continuous",
+          "launch_stage": "GA"
+        },
+        "deployment": {
+          "description": "Deployment information for jobs managed by external sources.",
+          "ref": "jobs.JobDeployment",
+          "launch_stage": "GA"
+        },
+        "description": {
+          "description": "An optional description for the job. The maximum length is 27700 characters in UTF-8 encoding.",
+          "launch_stage": "GA"
+        },
+        "duration_target": {
+          "description": "The window the run aims to finish within, in hours, for a Cost-optimized serverless run.\nRequired only when `performance_target` is `COST_OPTIMIZED`. Must be one of the\nsupported values: `NO_FLEXIBILITY`, `4h`, `12h`, `24h`, `72h`. `NO_FLEXIBILITY` means the run\nuses the default cost-optimized performance level without additional cost-saving optimizations.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "edit_mode": {
+          "description": "Edit mode of the job.\n\n* `UI_LOCKED`: The job is in a locked UI state and cannot be modified.\n* `EDITABLE`: The job is in an editable state and can be modified.",
+          "ref": "jobs.JobEditMode",
+          "launch_stage": "GA"
+        },
+        "email_notifications": {
+          "description": "An optional set of email addresses that is notified when runs of this job begin or complete as well as when this job is deleted.",
+          "ref": "jobs.JobEmailNotifications",
+          "launch_stage": "GA"
+        },
+        "environment_variables": {
+          "description": "Named environment-variable entries that tasks can reference by key from\n`TaskSettings.environment_variables_key`. Each entry's `spec` holds inline\n`variables` and optional `.env` `files`. Maximum 10 entries per job. A task\ncan reference at most one entry from this list.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "environments": {
+          "description": "A list of task execution environment specifications that can be referenced by tasks that use serverless compute or a compute resource that uses Environments mode.\n\nFor notebook tasks that use serverless compute or a compute resource that uses Environments mode, if the environment_key is not specified, the notebook environment will be used if present. If a jobs environment is specified, it will override the notebook environment.\nFor other tasks that use serverless compute or a compute resource that uses Environments mode, the task environment is required to be specified using environment_key in the task settings.",
+          "launch_stage": "GA"
+        },
+        "format": {
+          "description": "Used to tell what is the format of the job. This field is ignored in Create/Update/Reset calls. When using the Jobs API 2.1 this value is always set to `\"MULTI_TASK\"`.",
+          "ref": "jobs.Format",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "git_source": {
+          "description": "An optional specification for a remote Git repository containing the source code used by tasks. Version-controlled source code is supported by notebook, dbt, Python script, and SQL File tasks.\n\nIf `git_source` is set, these tasks retrieve the file from the remote repository by default. However, this behavior can be overridden by setting `source` to `WORKSPACE` on the task.\n\nNote: dbt and SQL File tasks support only version-controlled sources. If dbt or SQL File tasks are used, `git_source` must be defined on the job.",
+          "ref": "jobs.GitSource",
+          "launch_stage": "GA"
+        },
+        "health": {
+          "ref": "jobs.JobsHealthRules",
+          "launch_stage": "GA"
+        },
+        "job_clusters": {
+          "description": "A list of job cluster specifications that can be shared and reused by tasks of this job. Libraries cannot be declared in a shared job cluster. You must declare dependent libraries in task settings.",
+          "launch_stage": "GA"
+        },
+        "max_concurrent_runs": {
+          "description": "An optional maximum allowed number of concurrent runs of the job.\nSet this value if you want to be able to execute multiple runs of the same job concurrently.\nThis is useful for example if you trigger your job on a frequent schedule and want to allow consecutive runs to overlap with each other, or if you want to trigger multiple runs which differ by their input parameters.\nThis setting affects only new runs. For example, suppose the job’s concurrency is 4 and there are 4 concurrent active runs. Then setting the concurrency to 3 won’t kill any of the active runs.\nHowever, from then on, new runs are skipped unless there are fewer than 3 active runs.\nThis value cannot exceed 1000. Setting this value to `0` causes all new runs to be skipped.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "An optional name for the job. The maximum length is 4096 bytes in UTF-8 encoding.",
+          "launch_stage": "GA"
+        },
+        "notification_settings": {
+          "description": "Optional notification settings that are used when sending notifications to each of the `email_notifications` and `webhook_notifications` for this job.",
+          "ref": "jobs.JobNotificationSettings",
+          "launch_stage": "GA"
+        },
+        "parameters": {
+          "description": "Job-level parameter definitions",
+          "launch_stage": "GA"
+        },
+        "parent_path": {
+          "description": "Path of the job parent folder in workspace file tree. If absent, the job doesn't have a workspace object.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "performance_target": {
+          "description": "The performance mode on a serverless job. This field determines the level of compute performance or cost-efficiency for the run.\nThe performance target does not apply to tasks that run on Serverless GPU compute.\n\n* `PERFORMANCE_OPTIMIZED`: Prioritizes fast startup and execution times through rapid scaling and optimized cluster performance.\n* `STANDARD`: Enables cost-efficient execution of serverless workloads.\n* `COST_OPTIMIZED`: Enables lower job costs by optimizing compute for your selected target duration time. Must provide a duration target.",
+          "ref": "jobs.PerformanceTarget",
+          "launch_stage": "GA"
+        },
+        "queue": {
+          "description": "The queue settings of the job.",
+          "ref": "jobs.QueueSettings",
+          "launch_stage": "GA"
+        },
+        "run_as": {
+          "description": "The user or service principal that the job runs as, if specified in the request.\nThis field indicates the explicit configuration of `run_as` for the job.\nTo find the value in all cases, explicit or implicit, use `run_as_user_name`.",
+          "ref": "jobs.JobRunAs",
+          "launch_stage": "GA"
+        },
+        "schedule": {
+          "description": "An optional periodic schedule for this job. The default behavior is that the job only runs when triggered by clicking “Run Now” in the Jobs UI or sending an API request to `runNow`.",
+          "ref": "jobs.CronSchedule",
+          "launch_stage": "GA"
+        },
+        "tags": {
+          "description": "A map of tags associated with the job. These are forwarded to the cluster as cluster tags for jobs clusters, and are subject to the same limitations as cluster tags. A maximum of 25 tags can be added to the job.",
+          "launch_stage": "GA"
+        },
+        "tasks": {
+          "description": "A list of task specifications to be executed by this job.\nIt supports up to 1000 elements in write endpoints (:method:jobs/create, :method:jobs/reset, :method:jobs/update, :method:jobs/submit).\nRead endpoints return only 100 tasks. If more than 100 tasks are available, you can paginate through them using :method:jobs/get. Use the `next_page_token` field at the object root to determine if more results are available.",
+          "launch_stage": "GA"
+        },
+        "timeout_seconds": {
+          "description": "An optional timeout applied to each run of this job. A value of `0` means no timeout.",
+          "launch_stage": "GA"
+        },
+        "trigger": {
+          "description": "A configuration to trigger a run when certain conditions are met. The default behavior is that the job runs only when triggered by clicking “Run Now” in the Jobs UI or sending an API request to `runNow`.",
+          "ref": "jobs.TriggerSettings",
+          "launch_stage": "GA"
+        },
+        "triggers": {
+          "description": "List of triggers attached to this job. A run starts when any active trigger evaluates to true. Cannot be set in\nthe same request as the legacy `schedule`, `trigger`, or `continuous` fields. Gated behind the \"Multiple Triggers\" feature preview.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "usage_policy_id": {
+          "description": "The id of the user specified usage policy to use for this job.\nIf not specified, a default usage policy may be applied when creating or modifying the job.\nSee `effective_usage_policy_id` for the usage policy used by this workload.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "webhook_notifications": {
+          "description": "A collection of system notification IDs to notify when runs of this job begin or complete.",
+          "ref": "jobs.WebhookNotifications",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.JobSource": {
+      "description": "The source of the job specification in the remote repository when the job is source controlled.",
+      "fields": {
+        "dirty_state": {
+          "description": "Dirty state indicates the job is not fully synced with the job specification in the remote repository.\n\nPossible values are:\n* `NOT_SYNCED`: The job is not yet synced with the remote job specification. Import the remote job specification from UI to make the job fully synced.\n* `DISCONNECTED`: The job is temporary disconnected from the remote job specification and is allowed for live edit. Import the remote job specification again from UI to make the job fully synced.",
+          "ref": "jobs.JobSourceDirtyState",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "import_from_git_branch": {
+          "description": "Name of the branch which the job is imported from.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "job_config_path": {
+          "description": "Path of the job YAML file that contains the job specification.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "jobs.JobSourceDirtyState": {
+      "description": "Dirty state indicates the job is not fully synced with the job specification\nin the remote repository.\n\nPossible values are:\n* `NOT_SYNCED`: The job is not yet synced with the remote job specification. Import the remote job specification from UI to make the job fully synced.\n* `DISCONNECTED`: The job is temporary disconnected from the remote job specification and is allowed for live edit. Import the remote job specification again from UI to make the job fully synced.",
+      "enum": [
+        "NOT_SYNCED",
+        "DISCONNECTED"
+      ],
+      "enum_launch_stages": {
+        "DISCONNECTED": "PRIVATE_PREVIEW",
+        "NOT_SYNCED": "PRIVATE_PREVIEW"
+      },
+      "enum_descriptions": {
+        "DISCONNECTED": "The job is temporary disconnected from the remote job specification and is allowed for live edit. Import the remote job specification again from UI to make the job fully synced.",
+        "NOT_SYNCED": "The job is not yet synced with the remote job specification. Import the remote job specification from UI to make the job fully synced."
+      }
+    },
+    "jobs.JobsHealthMetric": {
+      "description": "Specifies the health metric that is being evaluated for a particular health rule.\n\n* `RUN_DURATION_SECONDS`: Expected total time for a run in seconds.\n* `STREAMING_BACKLOG_BYTES`: An estimate of the maximum bytes of data waiting to be consumed across all streams. This metric is in Public Preview.\n* `STREAMING_BACKLOG_RECORDS`: An estimate of the maximum offset lag across all streams. This metric is in Public Preview.\n* `STREAMING_BACKLOG_SECONDS`: An estimate of the maximum consumer delay across all streams. This metric is in Public Preview.\n* `STREAMING_BACKLOG_FILES`: An estimate of the maximum number of outstanding files across all streams. This metric is in Public Preview.",
+      "enum": [
+        "RUN_DURATION_SECONDS",
+        "STREAMING_BACKLOG_BYTES",
+        "STREAMING_BACKLOG_RECORDS",
+        "STREAMING_BACKLOG_SECONDS",
+        "STREAMING_BACKLOG_FILES"
+      ],
+      "enum_launch_stages": {
+        "RUN_DURATION_SECONDS": "GA",
+        "STREAMING_BACKLOG_BYTES": "GA",
+        "STREAMING_BACKLOG_FILES": "GA",
+        "STREAMING_BACKLOG_RECORDS": "GA",
+        "STREAMING_BACKLOG_SECONDS": "GA"
+      },
+      "enum_descriptions": {
+        "RUN_DURATION_SECONDS": "Expected total time for a run in seconds.",
+        "STREAMING_BACKLOG_BYTES": "An estimate of the maximum bytes of data waiting to be consumed across all streams. This metric is in Public Preview.",
+        "STREAMING_BACKLOG_FILES": "An estimate of the maximum number of outstanding files across all streams. This metric is in Public Preview.",
+        "STREAMING_BACKLOG_RECORDS": "An estimate of the maximum offset lag across all streams. This metric is in Public Preview.",
+        "STREAMING_BACKLOG_SECONDS": "An estimate of the maximum consumer delay across all streams. This metric is in Public Preview."
+      }
+    },
+    "jobs.JobsHealthOperator": {
+      "description": "Specifies the operator used to compare the health metric value with the specified threshold.",
+      "enum": [
+        "GREATER_THAN"
+      ],
+      "enum_launch_stages": {
+        "GREATER_THAN": "GA"
+      }
+    },
+    "jobs.JobsHealthRule": {
+      "fields": {
+        "metric": {
+          "ref": "jobs.JobsHealthMetric",
+          "launch_stage": "GA"
+        },
+        "op": {
+          "ref": "jobs.JobsHealthOperator",
+          "launch_stage": "GA"
+        },
+        "value": {
+          "description": "Specifies the threshold value that the health metric should obey to satisfy the health rule.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.JobsHealthRules": {
+      "description": "An optional set of health rules that can be defined for this job.",
+      "fields": {
+        "rules": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.ListJobComplianceForPolicyResponse": {
+      "fields": {
+        "jobs": {
+          "description": "A list of jobs and their policy compliance statuses.",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "This field represents the pagination token to retrieve the next page of results.\nIf this field is not in the response, it means no further results for the request.",
+          "launch_stage": "GA"
+        },
+        "prev_page_token": {
+          "description": "This field represents the pagination token to retrieve the previous page of results.\nIf this field is not in the response, it means no further results for the request.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.ListJobComplianceRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Use this field to specify the maximum number of results to be returned by the server.\nThe server may further constrain the maximum number of results returned in a\nsingle page.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "A page token that can be used to navigate to the next page or previous page as\nreturned by `next_page_token` or `prev_page_token`.",
+          "launch_stage": "GA"
+        },
+        "policy_id": {
+          "description": "Canonical unique identifier for the cluster policy.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.ListJobsRequest": {
+      "fields": {
+        "expand_tasks": {
+          "description": "Whether to include task and cluster details in the response. Note that only the first 100 elements will be shown.\nUse :method:jobs/get to paginate through all tasks and clusters.",
+          "launch_stage": "GA"
+        },
+        "limit": {
+          "description": "The number of jobs to return. This value must be greater than 0 and less or equal to 100. The default value is 20.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "A filter on the list based on the exact (case insensitive) job name.",
+          "launch_stage": "GA"
+        },
+        "offset": {
+          "description": "The offset of the first job to return, relative to the most recently created job.\nDeprecated since June 2023. Use `page_token` to iterate through the pages instead.",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "page_token": {
+          "description": "Use `next_page_token` or `prev_page_token` returned from the previous request to list the next or previous page of jobs respectively.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.ListJobsResponse": {
+      "description": "List of jobs was retrieved successfully.",
+      "fields": {
+        "has_more": {
+          "description": "If true, additional jobs matching the provided filter are available for listing.",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "jobs": {
+          "description": "The list of jobs. Only included in the response if there are jobs to list.",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "A token that can be used to list the next page of jobs (if applicable).",
+          "launch_stage": "GA"
+        },
+        "prev_page_token": {
+          "description": "A token that can be used to list the previous page of jobs (if applicable).",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.ListRunsRequest": {
+      "fields": {
+        "active_only": {
+          "description": "If active_only is `true`, only active runs are included in the results; otherwise,\nlists both active and completed runs. An active run is a run in the `QUEUED`, `PENDING`,\n`RUNNING`, or `TERMINATING`. This field cannot be `true` when completed_only is `true`.",
+          "launch_stage": "GA"
+        },
+        "completed_only": {
+          "description": "If completed_only is `true`, only completed runs are included in the results;\notherwise, lists both active and completed runs. This field cannot be `true` when\nactive_only is `true`.",
+          "launch_stage": "GA"
+        },
+        "expand_tasks": {
+          "description": "Whether to include task and cluster details in the response. Note that only the first 100 elements will be shown.\nUse :method:jobs/getrun to paginate through all tasks and clusters.",
+          "launch_stage": "GA"
+        },
+        "job_id": {
+          "description": "The job for which to list runs. If omitted, the Jobs service lists runs from all jobs.",
+          "launch_stage": "GA"
+        },
+        "limit": {
+          "description": "The number of runs to return. This value must be greater than 0 and less than 25.\nThe default value is 20. If a request specifies a limit of 0, the service instead\nuses the maximum limit.",
+          "launch_stage": "GA"
+        },
+        "offset": {
+          "description": "The offset of the first run to return, relative to the most recent run.\nDeprecated since June 2023. Use `page_token` to iterate through the pages instead.",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "page_token": {
+          "description": "Use `next_page_token` or `prev_page_token` returned from the previous request to list the next or previous page of runs respectively.",
+          "launch_stage": "GA"
+        },
+        "run_type": {
+          "description": "The type of runs to return. For a description of run types, see :method:jobs/getRun.",
+          "ref": "jobs.RunType",
+          "launch_stage": "GA"
+        },
+        "start_time_from": {
+          "description": "Show runs that started _at or after_ this value. The value must be a UTC timestamp\nin milliseconds. Can be combined with _start_time_to_ to filter by a time range.",
+          "launch_stage": "GA"
+        },
+        "start_time_to": {
+          "description": "Show runs that started _at or before_ this value. The value must be a UTC timestamp\nin milliseconds. Can be combined with _start_time_from_ to filter by a time range.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.ListRunsResponse": {
+      "description": "List of runs was retrieved successfully.",
+      "fields": {
+        "has_more": {
+          "description": "If true, additional runs matching the provided filter are available for listing.",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "next_page_token": {
+          "description": "A token that can be used to list the next page of runs (if applicable).",
+          "launch_stage": "GA"
+        },
+        "prev_page_token": {
+          "description": "A token that can be used to list the previous page of runs (if applicable).",
+          "launch_stage": "GA"
+        },
+        "runs": {
+          "description": "A list of runs, from most recently started to least. Only included in the response if there are runs to list.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.MaintenanceWindow": {
+      "description": "A recurring weekly time window during which platform-initiated maintenance is\nallowed to run for a continuous job.",
+      "fields": {
+        "day_of_week": {
+          "description": "The day of week on which maintenance is allowed to happen. This field is required.",
+          "ref": "jobs.DayOfWeek",
+          "launch_stage": "GA"
+        },
+        "start_hour": {
+          "description": "An integer between 0 and 23 denoting the start hour for the maintenance window in the 24-hour day.\nPlatform-initiated maintenance is triggered only within a one-hour window starting at this hour.\nThis field is required.",
+          "launch_stage": "GA"
+        },
+        "timezone_id": {
+          "description": "A Java timezone ID. The maintenance window is resolved with respect to this timezone. See [Java TimeZone](https://docs.oracle.com/javase/7/docs/api/java/util/TimeZone.html) for details. This field is required.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.ModelTriggerConfiguration": {
+      "fields": {
+        "aliases": {
+          "description": "Aliases of the model versions to monitor. Can only be used in conjunction with condition MODEL_ALIAS_SET.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "condition": {
+          "description": "The condition based on which to trigger a job run.",
+          "ref": "jobs.ModelTriggerConfigurationCondition",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "min_time_between_triggers_seconds": {
+          "description": "If set, the trigger starts a run only after the specified amount of time has passed since\nthe last time the trigger fired. The minimum allowed value is 60 seconds.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "securable_name": {
+          "description": "Name of the securable to monitor (\"mycatalog.myschema.mymodel\" in the case of model-level triggers,\n\"mycatalog.myschema\" in the case of schema-level triggers) or empty in the case of metastore-level triggers.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "wait_after_last_change_seconds": {
+          "description": "If set, the trigger starts a run only after no model updates have occurred for the specified time\nand can be used to wait for a series of model updates before triggering a run. The\nminimum allowed value is 60 seconds.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "jobs.ModelTriggerConfigurationCondition": {
+      "enum": [
+        "MODEL_CREATED",
+        "MODEL_VERSION_READY",
+        "MODEL_ALIAS_SET"
+      ],
+      "enum_launch_stages": {
+        "MODEL_ALIAS_SET": "PRIVATE_PREVIEW",
+        "MODEL_CREATED": "PRIVATE_PREVIEW",
+        "MODEL_VERSION_READY": "PRIVATE_PREVIEW"
+      }
+    },
+    "jobs.ModelTriggerState": {
+      "description": "Runtime state for a model trigger. Currently empty because model triggers do not\nexpose any trigger-specific runtime state."
+    },
+    "jobs.NotebookOutput": {
+      "fields": {
+        "result": {
+          "description": "The value passed to [dbutils.notebook.exit()](/notebooks/notebook-workflows.html#notebook-workflows-exit).\nDatabricks restricts this API to return the first 5 MB of the value. For a larger result, your job can store the results in a cloud storage service.\nThis field is absent if `dbutils.notebook.exit()` was never called.",
+          "launch_stage": "GA"
+        },
+        "truncated": {
+          "description": "Whether or not the result was truncated.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.NotebookTask": {
+      "fields": {
+        "base_parameters": {
+          "description": "Base parameters to be used for each run of this job. If the run is initiated by a call to :method:jobs/run\nNow with parameters specified, the two parameters maps are merged. If the same key is specified in\n`base_parameters` and in `run-now`, the value from `run-now` is used.\nUse [Task parameter variables](https://docs.databricks.com/jobs.html#parameter-variables) to set parameters containing information about job runs.\n\nIf the notebook takes a parameter that is not specified in the job’s `base_parameters` or the `run-now` override parameters,\nthe default value from the notebook is used.\n\nRetrieve these parameters in a notebook using [dbutils.widgets.get](https://docs.databricks.com/dev-tools/databricks-utils.html#dbutils-widgets).\n\nThe JSON representation of this field cannot exceed 1MB.",
+          "launch_stage": "GA"
+        },
+        "notebook_path": {
+          "description": "The path of the notebook to be run in the Databricks workspace or remote repository.\nFor notebooks stored in the Databricks workspace, the path must be absolute and begin with a slash.\nFor notebooks stored in a remote repository, the path must be relative. This field is required.",
+          "launch_stage": "GA"
+        },
+        "source": {
+          "description": "Optional location type of the notebook. When set to `WORKSPACE`, the notebook will be retrieved from the local Databricks workspace. When set to `GIT`, the notebook will be retrieved from a Git repository\ndefined in `git_source`. If the value is empty, the task will use `GIT` if `git_source` is defined and `WORKSPACE` otherwise.\n* `WORKSPACE`: Notebook is located in Databricks workspace.\n* `GIT`: Notebook is located in cloud Git provider.",
+          "ref": "jobs.Source",
+          "launch_stage": "GA"
+        },
+        "warehouse_id": {
+          "description": "Optional `warehouse_id` to run the notebook on a SQL warehouse. Classic SQL warehouses are NOT supported, please use serverless or pro SQL warehouses.\n\nNote that SQL warehouses only support SQL cells; if the notebook contains non-SQL cells, the run will fail.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.OutputSchemaInfo": {
+      "description": "Stores the catalog name, schema name, and the output schema expiration time for the clean room run.",
+      "fields": {
+        "catalog_name": {
+          "launch_stage": "GA"
+        },
+        "expiration_time": {
+          "description": "The expiration time for the output schema as a Unix timestamp in milliseconds.",
+          "launch_stage": "GA"
+        },
+        "schema_name": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.PauseStatus": {
+      "enum": [
+        "UNPAUSED",
+        "PAUSED"
+      ],
+      "enum_launch_stages": {
+        "PAUSED": "GA",
+        "UNPAUSED": "GA"
+      }
+    },
+    "jobs.PerTriggerState": {
+      "description": "Per-trigger runtime state for the multi-trigger surface. Mirrors `TriggerConfiguration`'s\ntrigger-type variants 1:1; each entry sets exactly one variant matching the corresponding\ntrigger's type. Variants with no runtime state today (`schedule`, `model`) are emitted as\nempty messages.",
+      "fields": {
+        "continuous": {
+          "ref": "jobs.ContinuousTriggerState",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "file_arrival": {
+          "ref": "jobs.FileArrivalTriggerState",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "model": {
+          "ref": "jobs.ModelTriggerState",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "pause_status": {
+          "description": "Whether this trigger is paused or not. Mirrors the configured pause_status.",
+          "ref": "jobs.PauseStatus",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "periodic": {
+          "ref": "jobs.PeriodicTriggerState",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "schedule": {
+          "ref": "jobs.ScheduleTriggerState",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "sql_condition": {
+          "description": "State for SQL condition evaluation, can coexist with other trigger states.",
+          "ref": "jobs.SqlConditionState",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "table_update": {
+          "ref": "jobs.TableTriggerState",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "jobs.PerformanceTarget": {
+      "description": "PerformanceTarget defines how performant (lower latency) or cost efficient the execution of run on serverless compute should be.\nThe performance mode on the job or pipeline should map to a performance setting that is passed to Cluster Manager\n(see cluster-common PerformanceTarget).",
+      "enum": [
+        "PERFORMANCE_OPTIMIZED",
+        "STANDARD"
+      ],
+      "enum_launch_stages": {
+        "PERFORMANCE_OPTIMIZED": "GA",
+        "STANDARD": "GA"
+      }
+    },
+    "jobs.PeriodicTriggerConfiguration": {
+      "fields": {
+        "interval": {
+          "description": "The interval at which the trigger should run.",
+          "launch_stage": "GA"
+        },
+        "unit": {
+          "description": "The unit of time for the interval.",
+          "ref": "jobs.PeriodicTriggerConfigurationTimeUnit",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.PeriodicTriggerConfigurationTimeUnit": {
+      "enum": [
+        "HOURS",
+        "DAYS",
+        "WEEKS",
+        "MINUTES"
+      ],
+      "enum_launch_stages": {
+        "DAYS": "GA",
+        "HOURS": "GA",
+        "MINUTES": "GA",
+        "WEEKS": "GA"
+      }
+    },
+    "jobs.PeriodicTriggerState": {
+      "fields": {
+        "next_run_time": {
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "jobs.PipelineParams": {
+      "fields": {
+        "full_refresh": {
+          "description": "If true, triggers a full refresh on the spark declarative pipeline.",
+          "launch_stage": "GA"
+        },
+        "full_refresh_selection": {
+          "description": "A list of tables to update with fullRefresh.",
+          "launch_stage": "GA"
+        },
+        "refresh_flow_selection": {
+          "description": "Flow names to selectively refresh. These are unioned with other selective refresh\noptions (refresh_selection, full_refresh_selection) to determine the final set of flows to refresh.",
+          "launch_stage": "GA"
+        },
+        "refresh_selection": {
+          "description": "A list of tables to update without fullRefresh.",
+          "launch_stage": "GA"
+        },
+        "reset_checkpoint_selection": {
+          "description": "A list of streaming flows to reset checkpoints without clearing data.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.PipelineTask": {
+      "fields": {
+        "full_refresh": {
+          "description": "If true, triggers a full refresh on the spark declarative pipeline.",
+          "launch_stage": "GA"
+        },
+        "full_refresh_selection": {
+          "description": "A list of tables to update with fullRefresh.",
+          "launch_stage": "GA"
+        },
+        "parameters": {
+          "description": "Key/value-map of parameters passed to the pipeline execution.\nLimited to 10k characters in total.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "pipeline_id": {
+          "description": "The full name of the pipeline task to execute.",
+          "launch_stage": "GA"
+        },
+        "refresh_flow_selection": {
+          "description": "Flow names to selectively refresh. These are unioned with other selective refresh\noptions (refresh_selection, full_refresh_selection) to determine the final set of flows to refresh.",
+          "launch_stage": "GA"
+        },
+        "refresh_selection": {
+          "description": "A list of tables to update without fullRefresh.",
+          "launch_stage": "GA"
+        },
+        "reset_checkpoint_selection": {
+          "description": "A list of streaming flows to reset checkpoints without clearing data.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.PowerBiModel": {
+      "fields": {
+        "authentication_method": {
+          "description": "How the published Power BI model authenticates to Databricks",
+          "ref": "jobs.AuthenticationMethod",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "model_name": {
+          "description": "The name of the Power BI model",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "overwrite_existing": {
+          "description": "Whether to overwrite existing Power BI models",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "storage_mode": {
+          "description": "The default storage mode of the Power BI model",
+          "ref": "jobs.StorageMode",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "workspace_name": {
+          "description": "The name of the Power BI workspace of the model",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "jobs.PowerBiTable": {
+      "fields": {
+        "catalog": {
+          "description": "The catalog name in Databricks",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "name": {
+          "description": "The table name in Databricks",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "schema": {
+          "description": "The schema name in Databricks",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "storage_mode": {
+          "description": "The Power BI storage mode of the table",
+          "ref": "jobs.StorageMode",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "jobs.PowerBiTask": {
+      "fields": {
+        "connection_resource_name": {
+          "description": "The resource name of the UC connection to authenticate from Databricks to Power BI",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "power_bi_model": {
+          "description": "The semantic model to update",
+          "ref": "jobs.PowerBiModel",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "refresh_after_update": {
+          "description": "Whether the model should be refreshed after the update",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "tables": {
+          "description": "The tables to be exported to Power BI",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "warehouse_id": {
+          "description": "The SQL warehouse ID to use as the Power BI data source",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "jobs.PythonOperatorTask": {
+      "fields": {
+        "main": {
+          "description": "Fully qualified name of the main class or function.\nFor example, `my_project.my_function` or `my_project.MyOperator`.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "parameters": {
+          "description": "An ordered list of task parameters.\nTODO(JOBS-30885): Add limits for parameters.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "jobs.PythonOperatorTaskParameter": {
+      "fields": {
+        "name": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "value": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "jobs.PythonWheelTask": {
+      "fields": {
+        "entry_point": {
+          "description": "Named entry point to use, if it does not exist in the metadata of the package it executes the function from the package directly using `$packageName.$entryPoint()`",
+          "launch_stage": "GA"
+        },
+        "named_parameters": {
+          "description": "Command-line parameters passed to Python wheel task in the form of `[\"--name=task\", \"--data=dbfs:/path/to/data.json\"]`. Leave it empty if `parameters` is not null.",
+          "launch_stage": "GA"
+        },
+        "package_name": {
+          "description": "Name of the package to execute",
+          "launch_stage": "GA"
+        },
+        "parameters": {
+          "description": "Command-line parameters passed to Python wheel task. Leave it empty if `named_parameters` is not null.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.QueueDetails": {
+      "fields": {
+        "code": {
+          "ref": "jobs.QueueDetailsCodeCode",
+          "launch_stage": "GA"
+        },
+        "message": {
+          "description": "A descriptive message with the queuing details. This field is unstructured, and its exact format is subject\nto change.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.QueueDetailsCodeCode": {
+      "description": "The reason for queuing the run.\n* `ACTIVE_RUNS_LIMIT_REACHED`: The run was queued due to reaching the workspace limit of active task runs.\n* `MAX_CONCURRENT_RUNS_REACHED`: The run was queued due to reaching the per-job limit of concurrent job runs.\n* `ACTIVE_RUN_JOB_TASKS_LIMIT_REACHED`: The run was queued due to reaching the workspace limit of active run job tasks.",
+      "enum": [
+        "ACTIVE_RUNS_LIMIT_REACHED",
+        "MAX_CONCURRENT_RUNS_REACHED",
+        "ACTIVE_RUN_JOB_TASKS_LIMIT_REACHED"
+      ],
+      "enum_launch_stages": {
+        "ACTIVE_RUNS_LIMIT_REACHED": "GA",
+        "ACTIVE_RUN_JOB_TASKS_LIMIT_REACHED": "GA",
+        "MAX_CONCURRENT_RUNS_REACHED": "GA"
+      },
+      "enum_descriptions": {
+        "ACTIVE_RUNS_LIMIT_REACHED": "The run was queued due to reaching the workspace limit of active task runs.",
+        "ACTIVE_RUN_JOB_TASKS_LIMIT_REACHED": "The run was queued due to reaching the workspace limit of active run job tasks.",
+        "MAX_CONCURRENT_RUNS_REACHED": "The run was queued due to reaching the per-job limit of concurrent job runs."
+      }
+    },
+    "jobs.QueueSettings": {
+      "fields": {
+        "enabled": {
+          "description": "If true, enable queueing for the job. This is a required field.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.RepairHistoryItem": {
+      "fields": {
+        "effective_performance_target": {
+          "description": "The actual performance target used by the serverless run during execution. This can differ from the client-set performance target on the request depending on whether the performance mode is supported by the job type.\n\n* `PERFORMANCE_OPTIMIZED`: Prioritizes fast startup and execution times through rapid scaling and optimized cluster performance.\n* `STANDARD`: Enables cost-efficient execution of serverless workloads.\n* `COST_OPTIMIZED`: Enables lower job costs by optimizing compute for your selected target duration time. Must provide a duration target.",
+          "ref": "jobs.PerformanceTarget",
+          "launch_stage": "GA"
+        },
+        "end_time": {
+          "description": "The end time of the (repaired) run.",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "The ID of the repair. Only returned for the items that represent a repair in `repair_history`.",
+          "launch_stage": "GA"
+        },
+        "start_time": {
+          "description": "The start time of the (repaired) run.",
+          "launch_stage": "GA"
+        },
+        "state": {
+          "description": "Deprecated. Please use the `status` field instead.",
+          "ref": "jobs.RunState",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "status": {
+          "ref": "jobs.RunStatus",
+          "launch_stage": "GA"
+        },
+        "task_run_ids": {
+          "description": "The run IDs of the task runs that ran as part of this repair history item.",
+          "launch_stage": "GA"
+        },
+        "type": {
+          "description": "The repair history item type. Indicates whether a run is the original run or a repair run.",
+          "ref": "jobs.RepairHistoryItemType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.RepairHistoryItemType": {
+      "description": "The repair history item type. Indicates whether a run is the original run or\na repair run.",
+      "enum": [
+        "ORIGINAL",
+        "REPAIR"
+      ],
+      "enum_launch_stages": {
+        "ORIGINAL": "GA",
+        "REPAIR": "GA"
+      }
+    },
+    "jobs.RepairRun": {
+      "fields": {
+        "dbt_commands": {
+          "description": "An array of commands to execute for jobs with the dbt task, for example `\"dbt_commands\": [\"dbt deps\", \"dbt seed\", \"dbt deps\", \"dbt seed\", \"dbt run\"]`\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "duration_target": {
+          "description": "The window the run aims to finish within, in hours, for a Cost-optimized serverless run.\nRequired only when `performance_target` is `COST_OPTIMIZED`. Must be one of the\nsupported values: `NO_FLEXIBILITY`, `4h`, `12h`, `24h`, `72h`. `NO_FLEXIBILITY` means the run\nuses the default cost-optimized performance level without additional cost-saving optimizations.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "jar_params": {
+          "description": "A list of parameters for jobs with Spark JAR tasks, for example `\"jar_params\": [\"john doe\", \"35\"]`.\nThe parameters are used to invoke the main function of the main class specified in the Spark JAR task.\nIf not specified upon `run-now`, it defaults to an empty list.\njar_params cannot be specified in conjunction with notebook_params.\nThe JSON representation of this field (for example `{\"jar_params\":[\"john doe\",\"35\"]}`) cannot exceed 10,000 bytes.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "job_parameters": {
+          "description": "Job-level parameters used in the run. for example `\"param\": \"overriding_val\"`",
+          "launch_stage": "GA"
+        },
+        "latest_repair_id": {
+          "description": "The ID of the latest repair. This parameter is not required when repairing a run for the first time, but must be provided on subsequent requests to repair the same run.",
+          "launch_stage": "GA"
+        },
+        "notebook_params": {
+          "description": "A map from keys to values for jobs with notebook task, for example `\"notebook_params\": {\"name\": \"john doe\", \"age\": \"35\"}`.\nThe map is passed to the notebook and is accessible through the [dbutils.widgets.get](https://docs.databricks.com/dev-tools/databricks-utils.html) function.\n\nIf not specified upon `run-now`, the triggered run uses the job’s base parameters.\n\nnotebook_params cannot be specified in conjunction with jar_params.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.\n\nThe JSON representation of this field (for example `{\"notebook_params\":{\"name\":\"john doe\",\"age\":\"35\"}}`) cannot exceed 10,000 bytes.",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "performance_target": {
+          "description": "The performance mode on a serverless job. The performance target determines the level of compute performance or cost-efficiency for the run. This field overrides the performance target defined on the job level.\n\n* `PERFORMANCE_OPTIMIZED`: Prioritizes fast startup and execution times through rapid scaling and optimized cluster performance.\n* `STANDARD`: Enables cost-efficient execution of serverless workloads.\n* `COST_OPTIMIZED`: Enables lower job costs by optimizing compute for your selected target duration time. Must provide a duration target.",
+          "ref": "jobs.PerformanceTarget",
+          "launch_stage": "GA"
+        },
+        "pipeline_params": {
+          "description": "Controls whether the pipeline should perform a full refresh",
+          "ref": "jobs.PipelineParams",
+          "launch_stage": "GA"
+        },
+        "python_named_params": {
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "python_params": {
+          "description": "A list of parameters for jobs with Python tasks, for example `\"python_params\": [\"john doe\", \"35\"]`.\nThe parameters are passed to Python file as command-line parameters. If specified upon `run-now`, it would overwrite\nthe parameters specified in job setting. The JSON representation of this field (for example `{\"python_params\":[\"john doe\",\"35\"]}`)\ncannot exceed 10,000 bytes.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.\n\nImportant\n\nThese parameters accept only Latin characters (ASCII character set). Using non-ASCII characters returns an error.\nExamples of invalid, non-ASCII characters are Chinese, Japanese kanjis, and emojis.",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "rerun_all_failed_tasks": {
+          "description": "If true, repair all failed tasks. Only one of `rerun_tasks` or `rerun_all_failed_tasks` can be used.",
+          "launch_stage": "GA"
+        },
+        "rerun_dependent_tasks": {
+          "description": "If true, repair all tasks that depend on the tasks in `rerun_tasks`, even if they were previously successful. Can be also used in combination with `rerun_all_failed_tasks`.",
+          "launch_stage": "GA"
+        },
+        "rerun_tasks": {
+          "description": "The task keys of the task runs to repair.",
+          "launch_stage": "GA"
+        },
+        "run_id": {
+          "description": "The job run ID of the run to repair. The run must not be in progress.",
+          "launch_stage": "GA"
+        },
+        "spark_submit_params": {
+          "description": "A list of parameters for jobs with spark submit task, for example `\"spark_submit_params\": [\"--class\", \"org.apache.spark.examples.SparkPi\"]`.\nThe parameters are passed to spark-submit script as command-line parameters. If specified upon `run-now`, it would overwrite the\nparameters specified in job setting. The JSON representation of this field (for example `{\"python_params\":[\"john doe\",\"35\"]}`)\ncannot exceed 10,000 bytes.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.\n\nImportant\n\nThese parameters accept only Latin characters (ASCII character set). Using non-ASCII characters returns an error.\nExamples of invalid, non-ASCII characters are Chinese, Japanese kanjis, and emojis.",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "sql_params": {
+          "description": "A map from keys to values for jobs with SQL task, for example `\"sql_params\": {\"name\": \"john doe\", \"age\": \"35\"}`. The SQL alert task does not support custom parameters.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "jobs.RepairRunResponse": {
+      "description": "Run repair was initiated.",
+      "fields": {
+        "repair_id": {
+          "description": "The ID of the repair. Must be provided in subsequent repairs using the `latest_repair_id` field to ensure sequential repairs.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.ResetJob": {
+      "fields": {
+        "job_id": {
+          "description": "The canonical identifier of the job to reset. This field is required.",
+          "launch_stage": "GA"
+        },
+        "new_settings": {
+          "description": "The new settings of the job. These settings completely replace the old settings.\n\nChanges to the field `JobBaseSettings.timeout_seconds` are applied to active runs. Changes to other fields are applied to future runs only.",
+          "ref": "jobs.JobSettings",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.ResolvedConditionTaskValues": {
+      "fields": {
+        "left": {
+          "launch_stage": "GA"
+        },
+        "right": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.ResolvedDbtTaskValues": {
+      "fields": {
+        "commands": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.ResolvedNotebookTaskValues": {
+      "fields": {
+        "base_parameters": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.ResolvedParamPairValues": {
+      "fields": {
+        "parameters": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.ResolvedPipelineTaskValues": {
+      "fields": {
+        "parameters": {
+          "description": "Key/value-map of parameters passed to the pipeline execution.\nLimited to 10k characters in total.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "jobs.ResolvedPythonWheelTaskValues": {
+      "fields": {
+        "named_parameters": {
+          "launch_stage": "GA"
+        },
+        "parameters": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.ResolvedRunJobTaskValues": {
+      "fields": {
+        "job_parameters": {
+          "launch_stage": "GA"
+        },
+        "parameters": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.ResolvedStringParamsValues": {
+      "fields": {
+        "parameters": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.ResolvedValues": {
+      "fields": {
+        "ai_runtime_task": {
+          "description": "Resolved values for an AI Runtime task — env_vars with\n`{{tasks.\u003ckey\u003e.values.\u003cname\u003e}}` references substituted to concrete\nvalues before submission to the training service.",
+          "ref": "jobs.ResolvedValuesAiRuntimeTaskResolvedValues",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "condition_task": {
+          "ref": "jobs.ResolvedConditionTaskValues",
+          "launch_stage": "GA"
+        },
+        "dbt_task": {
+          "ref": "jobs.ResolvedDbtTaskValues",
+          "launch_stage": "GA"
+        },
+        "notebook_task": {
+          "ref": "jobs.ResolvedNotebookTaskValues",
+          "launch_stage": "GA"
+        },
+        "pipeline_task": {
+          "ref": "jobs.ResolvedPipelineTaskValues",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "python_wheel_task": {
+          "ref": "jobs.ResolvedPythonWheelTaskValues",
+          "launch_stage": "GA"
+        },
+        "run_job_task": {
+          "ref": "jobs.ResolvedRunJobTaskValues",
+          "launch_stage": "GA"
+        },
+        "simulation_task": {
+          "ref": "jobs.ResolvedParamPairValues",
+          "launch_stage": "GA"
+        },
+        "spark_jar_task": {
+          "ref": "jobs.ResolvedStringParamsValues",
+          "launch_stage": "GA"
+        },
+        "spark_python_task": {
+          "ref": "jobs.ResolvedStringParamsValues",
+          "launch_stage": "GA"
+        },
+        "spark_submit_task": {
+          "ref": "jobs.ResolvedStringParamsValues",
+          "launch_stage": "GA"
+        },
+        "sql_task": {
+          "ref": "jobs.ResolvedParamPairValues",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.ResolvedValuesAiRuntimeTaskResolvedValues": {
+      "description": "Resolved values for an AiRuntimeTask after dynamic-value substitution, so\nJobs can expand `{{tasks.\u003ckey\u003e.values.\u003cname\u003e}}` references before\nsubmission."
+    },
+    "jobs.Run": {
+      "description": "Run was retrieved successfully",
+      "fields": {
+        "attempt_number": {
+          "description": "The sequence number of this run attempt for a triggered job run. The initial attempt of a run has an attempt_number of 0. If the initial run attempt fails, and the job has a retry policy (`max_retries` \u003e 0), subsequent runs are created with an `original_attempt_run_id` of the original attempt’s ID and an incrementing `attempt_number`. Runs are retried only until they succeed, and the maximum `attempt_number` is the same as the `max_retries` value for the job.",
+          "launch_stage": "GA"
+        },
+        "cleanup_duration": {
+          "description": "The time in milliseconds it took to terminate the cluster and clean up any associated artifacts. The duration of a task run is the sum of the `setup_duration`, `execution_duration`, and the `cleanup_duration`. The `cleanup_duration` field is set to 0 for multitask job runs. The total duration of a multitask job run is the value of the `run_duration` field.",
+          "launch_stage": "GA"
+        },
+        "cluster_instance": {
+          "description": "The cluster used for this run. If the run is specified to use a new cluster, this field is set once the Jobs service has requested a cluster for the run.",
+          "ref": "jobs.ClusterInstance",
+          "launch_stage": "GA"
+        },
+        "cluster_spec": {
+          "description": "A snapshot of the job’s cluster specification when this run was created.",
+          "ref": "jobs.ClusterSpec",
+          "launch_stage": "GA"
+        },
+        "creator_user_name": {
+          "description": "The creator user name. This field won’t be included in the response if the user has already been deleted.",
+          "launch_stage": "GA"
+        },
+        "deployment_id": {
+          "description": "ID of the deployment that produced the job when this run was created. Used to look up\ndeployment metadata from the Deployment Metadata service. Only set for job runs of jobs\nwith a `BUNDLE` deployment.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "description": {
+          "description": "Description of the run",
+          "launch_stage": "GA"
+        },
+        "duration_target": {
+          "description": "The window the run aims to finish within, in hours, for a Cost-optimized serverless run.\nRequired only when `performance_target` is `COST_OPTIMIZED`. Must be one of the\nsupported values: `NO_FLEXIBILITY`, `4h`, `12h`, `24h`, `72h`. `NO_FLEXIBILITY` means the run\nuses the default cost-optimized performance level without additional cost-saving optimizations.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "effective_performance_target": {
+          "description": "The actual performance target used by the serverless run during execution. This can differ from the client-set performance target on the request depending on whether the performance mode is supported by the job type.\n\n* `PERFORMANCE_OPTIMIZED`: Prioritizes fast startup and execution times through rapid scaling and optimized cluster performance.\n* `STANDARD`: Enables cost-efficient execution of serverless workloads.\n* `COST_OPTIMIZED`: Enables lower job costs by optimizing compute for your selected target duration time. Must provide a duration target.",
+          "ref": "jobs.PerformanceTarget",
+          "launch_stage": "GA"
+        },
+        "effective_usage_policy_id": {
+          "description": "The id of the usage policy used by this run for cost attribution purposes.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "end_time": {
+          "description": "The time at which this run ended in epoch milliseconds (milliseconds since 1/1/1970 UTC). This field is set to 0 if the job is still running.",
+          "launch_stage": "GA"
+        },
+        "environment_variables": {
+          "description": "Snapshot of `JobSettings.environment_variables` as it was at run\nlaunch — the full list of named environment-variable entries the job\ndefined. To find which entry a given task ran with, look at\n`RunTaskSettings.environment_variables_key`.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "execution_duration": {
+          "description": "The time in milliseconds it took to execute the commands in the JAR or notebook until they  completed, failed, timed out, were cancelled, or encountered an unexpected error. The duration of a task run is the sum of the `setup_duration`, `execution_duration`, and the  `cleanup_duration`. The `execution_duration` field is set to 0 for multitask job runs. The total  duration of a multitask job run is the value of the `run_duration` field.",
+          "launch_stage": "GA"
+        },
+        "git_source": {
+          "description": "An optional specification for a remote Git repository containing the source code used by tasks. Version-controlled source code is supported by notebook, dbt, Python script, and SQL File tasks.\n\nIf `git_source` is set, these tasks retrieve the file from the remote repository by default. However, this behavior can be overridden by setting `source` to `WORKSPACE` on the task.\n\nNote: dbt and SQL File tasks support only version-controlled sources. If dbt or SQL File tasks are used, `git_source` must be defined on the job.",
+          "ref": "jobs.GitSource",
+          "launch_stage": "GA"
+        },
+        "has_more": {
+          "description": "Indicates if the run has more array properties (`tasks`, `job_clusters`) that are not shown. They can be accessed via :method:jobs/getrun endpoint.\nIt is only relevant for API 2.2 :method:jobs/listruns requests with `expand_tasks=true`.",
+          "launch_stage": "GA"
+        },
+        "iterations": {
+          "description": "Only populated by for-each iterations. The parent for-each task is located in tasks array.",
+          "launch_stage": "GA"
+        },
+        "job_clusters": {
+          "description": "A list of job cluster specifications that can be shared and reused by tasks of this job. Libraries cannot be declared in a shared job cluster. You must declare dependent libraries in task settings.\nIf more than 100 job clusters are available, you can paginate through them using :method:jobs/getrun.",
+          "launch_stage": "GA"
+        },
+        "job_id": {
+          "description": "The canonical identifier of the job that contains this run.",
+          "launch_stage": "GA"
+        },
+        "job_parameters": {
+          "description": "Job-level parameters used in the run",
+          "launch_stage": "GA"
+        },
+        "job_run_id": {
+          "description": "ID of the job run that this run belongs to.\nFor legacy and single-task job runs the field is populated with the job run ID.\nFor task runs, the field is populated with the ID of the job run that the task run belongs to.",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "A token that can be used to list the next page of array properties.",
+          "launch_stage": "GA"
+        },
+        "number_in_job": {
+          "description": "A unique identifier for this job run. This is set to the same value as `run_id`.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "original_attempt_run_id": {
+          "description": "If this run is a retry of a prior run attempt, this field contains the run_id of the original attempt; otherwise, it is the same as the run_id.",
+          "launch_stage": "GA"
+        },
+        "overriding_parameters": {
+          "description": "The parameters used for this run.",
+          "ref": "jobs.RunParameters",
+          "launch_stage": "GA"
+        },
+        "queue_duration": {
+          "description": "The time in milliseconds that the run has spent in the queue.",
+          "launch_stage": "GA"
+        },
+        "repair_history": {
+          "description": "The repair history of the run.",
+          "launch_stage": "GA"
+        },
+        "run_duration": {
+          "description": "The time in milliseconds it took the job run and all of its repairs to finish.",
+          "launch_stage": "GA"
+        },
+        "run_id": {
+          "description": "The canonical identifier of the run. This ID is unique across all runs of all jobs.",
+          "launch_stage": "GA"
+        },
+        "run_name": {
+          "description": "An optional name for the run. The maximum length is 4096 bytes in UTF-8 encoding.",
+          "launch_stage": "GA"
+        },
+        "run_page_url": {
+          "description": "The URL to the detail page of the run.",
+          "launch_stage": "GA"
+        },
+        "run_type": {
+          "ref": "jobs.RunType",
+          "launch_stage": "GA"
+        },
+        "schedule": {
+          "description": "The cron schedule that triggered this run if it was triggered by the periodic scheduler.",
+          "ref": "jobs.CronSchedule",
+          "launch_stage": "GA"
+        },
+        "setup_duration": {
+          "description": "The time in milliseconds it took to set up the cluster. For runs that run on new clusters this is the cluster creation time, for runs that run on existing clusters this time should be very short. The duration of a task run is the sum of the `setup_duration`, `execution_duration`, and the `cleanup_duration`. The `setup_duration` field is set to 0 for multitask job runs. The total duration of a multitask job run is the value of the `run_duration` field.",
+          "launch_stage": "GA"
+        },
+        "start_time": {
+          "description": "The time at which this run was started in epoch milliseconds (milliseconds since 1/1/1970 UTC). This may not be the time when the job task starts executing, for example, if the job is scheduled to run on a new cluster, this is the time the cluster creation call is issued.",
+          "launch_stage": "GA"
+        },
+        "state": {
+          "description": "Deprecated. Please use the `status` field instead.",
+          "ref": "jobs.RunState",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "status": {
+          "ref": "jobs.RunStatus",
+          "launch_stage": "GA"
+        },
+        "tasks": {
+          "description": "The list of tasks performed by the run. Each task has its own `run_id` which you can use to call `JobsGetOutput` to retrieve the run results.\nIf more than 100 tasks are available, you can paginate through them using :method:jobs/getrun. Use the `next_page_token` field at the object root to determine if more results are available.",
+          "launch_stage": "GA"
+        },
+        "trigger": {
+          "ref": "jobs.TriggerType",
+          "launch_stage": "GA"
+        },
+        "trigger_info": {
+          "ref": "jobs.TriggerInfo",
+          "launch_stage": "GA"
+        },
+        "version_id": {
+          "description": "ID of the deployment version that produced the job when this run was created. Identifies\na specific snapshot of the deployment in the Deployment Metadata service. Only set for\njob runs of jobs with a `BUNDLE` deployment.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "jobs.RunConditionTask": {
+      "fields": {
+        "left": {
+          "description": "The left operand of the condition task. Can be either a string value or a job state or parameter reference.",
+          "launch_stage": "GA"
+        },
+        "op": {
+          "description": "* `EQUAL_TO`, `NOT_EQUAL` operators perform string comparison of their operands. This means that `“12.0” == “12”` will evaluate to `false`.\n* `GREATER_THAN`, `GREATER_THAN_OR_EQUAL`, `LESS_THAN`, `LESS_THAN_OR_EQUAL` operators perform numeric comparison of their operands. `“12.0” \u003e= “12”` will evaluate to `true`, `“10.0” \u003e= “12”` will evaluate to `false`.\n\nThe boolean comparison to task values can be implemented with operators `EQUAL_TO`, `NOT_EQUAL`. If a task value was set to a boolean value, it will be serialized to `“true”` or `“false”` for the comparison.",
+          "ref": "jobs.ConditionTaskOp",
+          "launch_stage": "GA"
+        },
+        "outcome": {
+          "description": "The condition expression evaluation result. Filled in if the task was successfully completed. Can be `\"true\"` or `\"false\"`",
+          "launch_stage": "GA"
+        },
+        "right": {
+          "description": "The right operand of the condition task. Can be either a string value or a job state or parameter reference.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.RunForEachTask": {
+      "fields": {
+        "concurrency": {
+          "description": "An optional maximum allowed number of concurrent runs of the task.\nSet this value if you want to be able to execute multiple runs of the task concurrently.",
+          "launch_stage": "GA"
+        },
+        "inputs": {
+          "description": "Array for task to iterate on. This can be a JSON string or a reference to\nan array parameter.",
+          "launch_stage": "GA"
+        },
+        "stats": {
+          "description": "Read only field. Populated for GetRun and ListRuns RPC calls and stores the execution stats of a `For each` task.",
+          "ref": "jobs.ForEachStats",
+          "launch_stage": "GA"
+        },
+        "task": {
+          "description": "Configuration for the task that will be run for each element in the array",
+          "ref": "jobs.Task",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.RunIf": {
+      "description": "An optional value indicating the condition that determines whether the task should be run once its dependencies have been completed. When omitted, defaults to `ALL_SUCCESS`.\n\nPossible values are:\n* `ALL_SUCCESS`: All dependencies have executed and succeeded\n* `AT_LEAST_ONE_SUCCESS`: At least one dependency has succeeded\n* `NONE_FAILED`: None of the dependencies have failed and at least one was executed\n* `ALL_DONE`: All dependencies have been completed\n* `AT_LEAST_ONE_FAILED`: At least one dependency failed\n* `ALL_FAILED`: ALl dependencies have failed",
+      "enum": [
+        "ALL_SUCCESS",
+        "ALL_DONE",
+        "NONE_FAILED",
+        "AT_LEAST_ONE_SUCCESS",
+        "ALL_FAILED",
+        "AT_LEAST_ONE_FAILED"
+      ],
+      "enum_launch_stages": {
+        "ALL_DONE": "GA",
+        "ALL_FAILED": "GA",
+        "ALL_SUCCESS": "GA",
+        "AT_LEAST_ONE_FAILED": "GA",
+        "AT_LEAST_ONE_SUCCESS": "GA",
+        "NONE_FAILED": "GA"
+      },
+      "enum_descriptions": {
+        "ALL_DONE": "All dependencies have been completed",
+        "ALL_FAILED": "ALl dependencies have failed",
+        "ALL_SUCCESS": "All dependencies have executed and succeeded",
+        "AT_LEAST_ONE_FAILED": "At least one dependency failed",
+        "AT_LEAST_ONE_SUCCESS": "At least one dependency has succeeded",
+        "NONE_FAILED": "None of the dependencies have failed and at least one was executed"
+      }
+    },
+    "jobs.RunJobOutput": {
+      "fields": {
+        "run_id": {
+          "description": "The run id of the triggered job run",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.RunJobTask": {
+      "fields": {
+        "dbt_commands": {
+          "description": "An array of commands to execute for jobs with the dbt task, for example `\"dbt_commands\": [\"dbt deps\", \"dbt seed\", \"dbt deps\", \"dbt seed\", \"dbt run\"]`\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "jar_params": {
+          "description": "A list of parameters for jobs with Spark JAR tasks, for example `\"jar_params\": [\"john doe\", \"35\"]`.\nThe parameters are used to invoke the main function of the main class specified in the Spark JAR task.\nIf not specified upon `run-now`, it defaults to an empty list.\njar_params cannot be specified in conjunction with notebook_params.\nThe JSON representation of this field (for example `{\"jar_params\":[\"john doe\",\"35\"]}`) cannot exceed 10,000 bytes.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "job_id": {
+          "description": "ID of the job to trigger.",
+          "launch_stage": "GA"
+        },
+        "job_parameters": {
+          "description": "Job-level parameters used to trigger the job.",
+          "launch_stage": "GA"
+        },
+        "notebook_params": {
+          "description": "A map from keys to values for jobs with notebook task, for example `\"notebook_params\": {\"name\": \"john doe\", \"age\": \"35\"}`.\nThe map is passed to the notebook and is accessible through the [dbutils.widgets.get](https://docs.databricks.com/dev-tools/databricks-utils.html) function.\n\nIf not specified upon `run-now`, the triggered run uses the job’s base parameters.\n\nnotebook_params cannot be specified in conjunction with jar_params.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.\n\nThe JSON representation of this field (for example `{\"notebook_params\":{\"name\":\"john doe\",\"age\":\"35\"}}`) cannot exceed 10,000 bytes.",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "pipeline_params": {
+          "description": "Controls whether the pipeline should perform a full refresh",
+          "ref": "jobs.PipelineParams",
+          "launch_stage": "GA"
+        },
+        "python_named_params": {
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "python_params": {
+          "description": "A list of parameters for jobs with Python tasks, for example `\"python_params\": [\"john doe\", \"35\"]`.\nThe parameters are passed to Python file as command-line parameters. If specified upon `run-now`, it would overwrite\nthe parameters specified in job setting. The JSON representation of this field (for example `{\"python_params\":[\"john doe\",\"35\"]}`)\ncannot exceed 10,000 bytes.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.\n\nImportant\n\nThese parameters accept only Latin characters (ASCII character set). Using non-ASCII characters returns an error.\nExamples of invalid, non-ASCII characters are Chinese, Japanese kanjis, and emojis.",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "spark_submit_params": {
+          "description": "A list of parameters for jobs with spark submit task, for example `\"spark_submit_params\": [\"--class\", \"org.apache.spark.examples.SparkPi\"]`.\nThe parameters are passed to spark-submit script as command-line parameters. If specified upon `run-now`, it would overwrite the\nparameters specified in job setting. The JSON representation of this field (for example `{\"python_params\":[\"john doe\",\"35\"]}`)\ncannot exceed 10,000 bytes.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.\n\nImportant\n\nThese parameters accept only Latin characters (ASCII character set). Using non-ASCII characters returns an error.\nExamples of invalid, non-ASCII characters are Chinese, Japanese kanjis, and emojis.",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "sql_params": {
+          "description": "A map from keys to values for jobs with SQL task, for example `\"sql_params\": {\"name\": \"john doe\", \"age\": \"35\"}`. The SQL alert task does not support custom parameters.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "jobs.RunLifeCycleState": {
+      "description": "A value indicating the run's lifecycle state. The possible values are:\n* `QUEUED`: The run is queued.\n* `PENDING`: The run is waiting to be executed while the cluster and execution context are being prepared.\n* `RUNNING`: The task of this run is being executed.\n* `TERMINATING`: The task of this run has completed, and the cluster and execution context are being cleaned up.\n* `TERMINATED`: The task of this run has completed, and the cluster and execution context have been cleaned up. This state is terminal.\n* `SKIPPED`: This run was aborted because a previous run of the same job was already active. This state is terminal.\n* `INTERNAL_ERROR`: An exceptional state that indicates a failure in the Jobs service, such as network failure over a long period. If a run on a new cluster ends in the `INTERNAL_ERROR` state, the Jobs service terminates the cluster as soon as possible. This state is terminal.\n* `BLOCKED`: The run is blocked on an upstream dependency.\n* `WAITING_FOR_RETRY`: The run is waiting for a retry.",
+      "enum": [
+        "PENDING",
+        "RUNNING",
+        "TERMINATING",
+        "TERMINATED",
+        "SKIPPED",
+        "INTERNAL_ERROR",
+        "BLOCKED",
+        "WAITING_FOR_RETRY",
+        "QUEUED"
+      ],
+      "enum_launch_stages": {
+        "BLOCKED": "GA",
+        "INTERNAL_ERROR": "GA",
+        "PENDING": "GA",
+        "QUEUED": "GA",
+        "RUNNING": "GA",
+        "SKIPPED": "GA",
+        "TERMINATED": "GA",
+        "TERMINATING": "GA",
+        "WAITING_FOR_RETRY": "GA"
+      },
+      "enum_descriptions": {
+        "BLOCKED": "The run is blocked on an upstream dependency.",
+        "INTERNAL_ERROR": "An exceptional state that indicates a failure in the Jobs service, such as network failure over a long period. If a run on a new cluster ends in the `INTERNAL_ERROR` state, the Jobs service terminates the cluster as soon as possible. This state is terminal.",
+        "PENDING": "The run is waiting to be executed while the cluster and execution context are being prepared.",
+        "QUEUED": "The run is queued.",
+        "RUNNING": "The task of this run is being executed.",
+        "SKIPPED": "This run was aborted because a previous run of the same job was already active. This state is terminal.",
+        "TERMINATED": "The task of this run has completed, and the cluster and execution context have been cleaned up. This state is terminal.",
+        "TERMINATING": "The task of this run has completed, and the cluster and execution context are being cleaned up.",
+        "WAITING_FOR_RETRY": "The run is waiting for a retry."
+      }
+    },
+    "jobs.RunLifecycleStateV2State": {
+      "description": "The current state of the run.",
+      "enum": [
+        "BLOCKED",
+        "PENDING",
+        "QUEUED",
+        "RUNNING",
+        "TERMINATING",
+        "TERMINATED",
+        "WAITING"
+      ],
+      "enum_launch_stages": {
+        "BLOCKED": "GA",
+        "PENDING": "GA",
+        "QUEUED": "GA",
+        "RUNNING": "GA",
+        "TERMINATED": "GA",
+        "TERMINATING": "GA",
+        "WAITING": "GA"
+      }
+    },
+    "jobs.RunNow": {
+      "fields": {
+        "dbt_commands": {
+          "description": "An array of commands to execute for jobs with the dbt task, for example `\"dbt_commands\": [\"dbt deps\", \"dbt seed\", \"dbt deps\", \"dbt seed\", \"dbt run\"]`\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "duration_target": {
+          "description": "The window the run aims to finish within, in hours, for a Cost-optimized serverless run.\nRequired only when `performance_target` is `COST_OPTIMIZED`. Must be one of the\nsupported values: `NO_FLEXIBILITY`, `4h`, `12h`, `24h`, `72h`. `NO_FLEXIBILITY` means the run\nuses the default cost-optimized performance level without additional cost-saving optimizations.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "idempotency_token": {
+          "description": "An optional token to guarantee the idempotency of job run requests. If a run with the provided token already exists,\nthe request does not create a new run but returns the ID of the existing run instead. If a run with the provided token is deleted,\nan error is returned.\n\nIf you specify the idempotency token, upon failure you can retry until the request succeeds. Databricks guarantees that exactly one run\nis launched with that idempotency token.\n\nThis token must have at most 64 characters.",
+          "launch_stage": "GA"
+        },
+        "jar_params": {
+          "description": "A list of parameters for jobs with Spark JAR tasks, for example `\"jar_params\": [\"john doe\", \"35\"]`.\nThe parameters are used to invoke the main function of the main class specified in the Spark JAR task.\nIf not specified upon `run-now`, it defaults to an empty list.\njar_params cannot be specified in conjunction with notebook_params.\nThe JSON representation of this field (for example `{\"jar_params\":[\"john doe\",\"35\"]}`) cannot exceed 10,000 bytes.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "job_id": {
+          "description": "The ID of the job to be executed",
+          "launch_stage": "GA"
+        },
+        "job_parameters": {
+          "description": "Job-level parameters used in the run. for example `\"param\": \"overriding_val\"`",
+          "launch_stage": "GA"
+        },
+        "notebook_params": {
+          "description": "A map from keys to values for jobs with notebook task, for example `\"notebook_params\": {\"name\": \"john doe\", \"age\": \"35\"}`.\nThe map is passed to the notebook and is accessible through the [dbutils.widgets.get](https://docs.databricks.com/dev-tools/databricks-utils.html) function.\n\nIf not specified upon `run-now`, the triggered run uses the job’s base parameters.\n\nnotebook_params cannot be specified in conjunction with jar_params.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.\n\nThe JSON representation of this field (for example `{\"notebook_params\":{\"name\":\"john doe\",\"age\":\"35\"}}`) cannot exceed 10,000 bytes.",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "only": {
+          "description": "A list of task keys to run inside of the job. If this field is not provided, all tasks in the job will be run.\n\nPrefix a task key with `+` to also run its upstream tasks, or suffix it with `+` to also run its downstream tasks.\nFor example, `+my_task` runs `my_task` and everything upstream of it, `my_task+` runs `my_task` and everything\ndownstream of it, and `+my_task+` runs both. A task key with no `+` runs only that task.",
+          "launch_stage": "GA"
+        },
+        "performance_target": {
+          "description": "The performance mode on a serverless job. The performance target determines the level of compute performance or cost-efficiency for the run. This field overrides the performance target defined on the job level.\n\n* `PERFORMANCE_OPTIMIZED`: Prioritizes fast startup and execution times through rapid scaling and optimized cluster performance.\n* `STANDARD`: Enables cost-efficient execution of serverless workloads.\n* `COST_OPTIMIZED`: Enables lower job costs by optimizing compute for your selected target duration time. Must provide a duration target.",
+          "ref": "jobs.PerformanceTarget",
+          "launch_stage": "GA"
+        },
+        "pipeline_params": {
+          "description": "Controls whether the pipeline should perform a full refresh",
+          "ref": "jobs.PipelineParams",
+          "launch_stage": "GA"
+        },
+        "python_named_params": {
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "python_params": {
+          "description": "A list of parameters for jobs with Python tasks, for example `\"python_params\": [\"john doe\", \"35\"]`.\nThe parameters are passed to Python file as command-line parameters. If specified upon `run-now`, it would overwrite\nthe parameters specified in job setting. The JSON representation of this field (for example `{\"python_params\":[\"john doe\",\"35\"]}`)\ncannot exceed 10,000 bytes.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.\n\nImportant\n\nThese parameters accept only Latin characters (ASCII character set). Using non-ASCII characters returns an error.\nExamples of invalid, non-ASCII characters are Chinese, Japanese kanjis, and emojis.",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "queue": {
+          "description": "The queue settings of the run.",
+          "ref": "jobs.QueueSettings",
+          "launch_stage": "GA"
+        },
+        "spark_submit_params": {
+          "description": "A list of parameters for jobs with spark submit task, for example `\"spark_submit_params\": [\"--class\", \"org.apache.spark.examples.SparkPi\"]`.\nThe parameters are passed to spark-submit script as command-line parameters. If specified upon `run-now`, it would overwrite the\nparameters specified in job setting. The JSON representation of this field (for example `{\"python_params\":[\"john doe\",\"35\"]}`)\ncannot exceed 10,000 bytes.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.\n\nImportant\n\nThese parameters accept only Latin characters (ASCII character set). Using non-ASCII characters returns an error.\nExamples of invalid, non-ASCII characters are Chinese, Japanese kanjis, and emojis.",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "sql_params": {
+          "description": "A map from keys to values for jobs with SQL task, for example `\"sql_params\": {\"name\": \"john doe\", \"age\": \"35\"}`. The SQL alert task does not support custom parameters.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "jobs.RunNowResponse": {
+      "description": "Run was started successfully.",
+      "fields": {
+        "number_in_job": {
+          "description": "A unique identifier for this job run. This is set to the same value as `run_id`.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "run_id": {
+          "description": "The globally unique ID of the newly triggered run.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.RunOutput": {
+      "description": "Run output was retrieved successfully.",
+      "fields": {
+        "ai_runtime_task_output": {
+          "description": "The output of an AiRuntimeTask, if available — MLflow identifiers,\nartifact paths, and per-replica allocated compute. Run lifecycle /\ntermination status lives on the surrounding framework `RunTask.status`\n(`runs.proto:RunTask.status` of type `RunStatus`), not on this output.\nSee `tasks/genai/ai_runtime_task.proto:AiRuntimeTaskOutput`.",
+          "ref": "jobs.AiRuntimeTaskOutput",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "alert_output": {
+          "description": "The output of an alert task, if available",
+          "ref": "jobs.AlertTaskOutput",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "clean_rooms_notebook_output": {
+          "description": "The output of a clean rooms notebook task, if available",
+          "ref": "jobs.CleanRoomsNotebookTaskCleanRoomsNotebookTaskOutput",
+          "launch_stage": "GA"
+        },
+        "dashboard_output": {
+          "description": "The output of a dashboard task, if available",
+          "ref": "jobs.DashboardTaskOutput",
+          "launch_stage": "GA"
+        },
+        "dbt_cloud_output": {
+          "description": "Deprecated in favor of the new dbt_platform_output",
+          "ref": "jobs.DbtCloudTaskOutput",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "dbt_output": {
+          "description": "The output of a dbt task, if available.",
+          "ref": "jobs.DbtOutput",
+          "launch_stage": "GA"
+        },
+        "dbt_platform_output": {
+          "ref": "jobs.DbtPlatformTaskOutput",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "error": {
+          "description": "An error message indicating why a task failed or why output is not available. The message is unstructured, and its exact format is subject to change.",
+          "launch_stage": "GA"
+        },
+        "error_trace": {
+          "description": "If there was an error executing the run, this field contains any available stack traces.",
+          "launch_stage": "GA"
+        },
+        "info": {
+          "launch_stage": "GA"
+        },
+        "logs": {
+          "description": "The output from tasks that write to standard streams (stdout/stderr) such as\nspark_jar_task, spark_python_task, python_wheel_task.\n\nIt's not supported for the notebook_task, pipeline_task or spark_submit_task.\n\nDatabricks restricts this API to return the last 5 MB of these logs.",
+          "launch_stage": "GA"
+        },
+        "logs_truncated": {
+          "description": "Whether the logs are truncated.",
+          "launch_stage": "GA"
+        },
+        "metadata": {
+          "description": "All details of the run except for its output.",
+          "ref": "jobs.Run",
+          "launch_stage": "GA"
+        },
+        "notebook_output": {
+          "description": "The output of a notebook task, if available. A notebook task that terminates (either successfully or with a failure)\nwithout calling `dbutils.notebook.exit()` is considered to have an empty output.\nThis field is set but its result value is empty. Databricks restricts this API to return the first 5 MB of the output.\nTo return a larger result, use the [ClusterLogConf](https://docs.databricks.com/dev-tools/api/latest/clusters.html#clusterlogconf) field to configure log storage\nfor the job cluster.",
+          "ref": "jobs.NotebookOutput",
+          "launch_stage": "GA"
+        },
+        "run_job_output": {
+          "description": "The output of a run job task, if available",
+          "ref": "jobs.RunJobOutput",
+          "launch_stage": "GA"
+        },
+        "sql_output": {
+          "description": "The output of a SQL task, if available.",
+          "ref": "jobs.SqlOutput",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.RunParameters": {
+      "fields": {
+        "dbt_commands": {
+          "description": "An array of commands to execute for jobs with the dbt task, for example `\"dbt_commands\": [\"dbt deps\", \"dbt seed\", \"dbt deps\", \"dbt seed\", \"dbt run\"]`\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "jar_params": {
+          "description": "A list of parameters for jobs with Spark JAR tasks, for example `\"jar_params\": [\"john doe\", \"35\"]`.\nThe parameters are used to invoke the main function of the main class specified in the Spark JAR task.\nIf not specified upon `run-now`, it defaults to an empty list.\njar_params cannot be specified in conjunction with notebook_params.\nThe JSON representation of this field (for example `{\"jar_params\":[\"john doe\",\"35\"]}`) cannot exceed 10,000 bytes.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "notebook_params": {
+          "description": "A map from keys to values for jobs with notebook task, for example `\"notebook_params\": {\"name\": \"john doe\", \"age\": \"35\"}`.\nThe map is passed to the notebook and is accessible through the [dbutils.widgets.get](https://docs.databricks.com/dev-tools/databricks-utils.html) function.\n\nIf not specified upon `run-now`, the triggered run uses the job’s base parameters.\n\nnotebook_params cannot be specified in conjunction with jar_params.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.\n\nThe JSON representation of this field (for example `{\"notebook_params\":{\"name\":\"john doe\",\"age\":\"35\"}}`) cannot exceed 10,000 bytes.",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "pipeline_params": {
+          "description": "Controls whether the pipeline should perform a full refresh",
+          "ref": "jobs.PipelineParams",
+          "launch_stage": "GA"
+        },
+        "python_named_params": {
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "python_params": {
+          "description": "A list of parameters for jobs with Python tasks, for example `\"python_params\": [\"john doe\", \"35\"]`.\nThe parameters are passed to Python file as command-line parameters. If specified upon `run-now`, it would overwrite\nthe parameters specified in job setting. The JSON representation of this field (for example `{\"python_params\":[\"john doe\",\"35\"]}`)\ncannot exceed 10,000 bytes.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.\n\nImportant\n\nThese parameters accept only Latin characters (ASCII character set). Using non-ASCII characters returns an error.\nExamples of invalid, non-ASCII characters are Chinese, Japanese kanjis, and emojis.",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "spark_submit_params": {
+          "description": "A list of parameters for jobs with spark submit task, for example `\"spark_submit_params\": [\"--class\", \"org.apache.spark.examples.SparkPi\"]`.\nThe parameters are passed to spark-submit script as command-line parameters. If specified upon `run-now`, it would overwrite the\nparameters specified in job setting. The JSON representation of this field (for example `{\"python_params\":[\"john doe\",\"35\"]}`)\ncannot exceed 10,000 bytes.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.\n\nImportant\n\nThese parameters accept only Latin characters (ASCII character set). Using non-ASCII characters returns an error.\nExamples of invalid, non-ASCII characters are Chinese, Japanese kanjis, and emojis.",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "sql_params": {
+          "description": "A map from keys to values for jobs with SQL task, for example `\"sql_params\": {\"name\": \"john doe\", \"age\": \"35\"}`. The SQL alert task does not support custom parameters.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "jobs.RunResultState": {
+      "description": "A value indicating the run's result. The possible values are:\n* `SUCCESS`: The task completed successfully.\n* `FAILED`: The task completed with an error.\n* `TIMEDOUT`: The run was stopped after reaching the timeout.\n* `CANCELED`: The run was canceled at user request.\n* `MAXIMUM_CONCURRENT_RUNS_REACHED`: The run was skipped because the maximum concurrent runs were reached.\n* `EXCLUDED`: The run was skipped because the necessary conditions were not met.\n* `SUCCESS_WITH_FAILURES`: The job run completed successfully with some failures; leaf tasks were successful.\n* `UPSTREAM_FAILED`: The run was skipped because of an upstream failure.\n* `UPSTREAM_CANCELED`: The run was skipped because an upstream task was canceled.\n* `DISABLED`: The run was skipped because it was disabled explicitly by the user.",
+      "enum": [
+        "SUCCESS",
+        "FAILED",
+        "TIMEDOUT",
+        "CANCELED",
+        "MAXIMUM_CONCURRENT_RUNS_REACHED",
+        "UPSTREAM_CANCELED",
+        "UPSTREAM_FAILED",
+        "EXCLUDED",
+        "SUCCESS_WITH_FAILURES",
+        "DISABLED"
+      ],
+      "enum_launch_stages": {
+        "CANCELED": "GA",
+        "DISABLED": "GA",
+        "EXCLUDED": "GA",
+        "FAILED": "GA",
+        "MAXIMUM_CONCURRENT_RUNS_REACHED": "GA",
+        "SUCCESS": "GA",
+        "SUCCESS_WITH_FAILURES": "GA",
+        "TIMEDOUT": "GA",
+        "UPSTREAM_CANCELED": "GA",
+        "UPSTREAM_FAILED": "GA"
+      },
+      "enum_descriptions": {
+        "CANCELED": "The run was canceled at user request.",
+        "DISABLED": "The run was skipped because it was disabled explicitly by the user.",
+        "EXCLUDED": "The run was skipped because the necessary conditions were not met.",
+        "FAILED": "The task completed with an error.",
+        "MAXIMUM_CONCURRENT_RUNS_REACHED": "The run was skipped because the maximum concurrent runs were reached.",
+        "SUCCESS": "The task completed successfully.",
+        "SUCCESS_WITH_FAILURES": "The job run completed successfully with some failures; leaf tasks were successful.",
+        "TIMEDOUT": "The run was stopped after reaching the timeout.",
+        "UPSTREAM_CANCELED": "The run was skipped because an upstream task was canceled.",
+        "UPSTREAM_FAILED": "The run was skipped because of an upstream failure."
+      }
+    },
+    "jobs.RunState": {
+      "description": "The current state of the run.",
+      "fields": {
+        "life_cycle_state": {
+          "description": "A value indicating the run's current lifecycle state. This field is always available in the response. Note: Additional states might be introduced in future releases.",
+          "ref": "jobs.RunLifeCycleState",
+          "launch_stage": "GA"
+        },
+        "queue_reason": {
+          "description": "The reason indicating why the run was queued.",
+          "launch_stage": "GA"
+        },
+        "result_state": {
+          "description": "A value indicating the run's result. This field is only available for terminal lifecycle states. Note: Additional states might be introduced in future releases.",
+          "ref": "jobs.RunResultState",
+          "launch_stage": "GA"
+        },
+        "state_message": {
+          "description": "A descriptive message for the current state. This field is unstructured, and its exact format is subject to change.",
+          "launch_stage": "GA"
+        },
+        "user_cancelled_or_timedout": {
+          "description": "A value indicating whether a run was canceled manually by a user or by the scheduler because the run timed out.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.RunStatus": {
+      "description": "The current status of the run",
+      "fields": {
+        "queue_details": {
+          "description": "If the run was queued, details about the reason for queuing the run.",
+          "ref": "jobs.QueueDetails",
+          "launch_stage": "GA"
+        },
+        "state": {
+          "ref": "jobs.RunLifecycleStateV2State",
+          "launch_stage": "GA"
+        },
+        "termination_details": {
+          "description": "If the run is in a TERMINATING or TERMINATED state, details about the reason for terminating the run.",
+          "ref": "jobs.TerminationDetails",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.RunTask": {
+      "description": "Used when outputting a child run, in GetRun or ListRuns.",
+      "fields": {
+        "ai_runtime_task": {
+          "description": "The task runs a multi-gpu compute workload on Databricks AI Runtime. Specify\nthe accelerator type and count, the command to run, and where the workload's\ncode and MLflow output are stored.",
+          "ref": "jobs.AiRuntimeTask",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "alert_task": {
+          "description": "The task evaluates a Databricks alert and sends notifications to subscribers\nwhen the `alert_task` field is present.",
+          "ref": "jobs.AlertTask",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "attempt_number": {
+          "description": "The sequence number of this run attempt for a triggered job run. The initial attempt of a run has an attempt_number of 0. If the initial run attempt fails, and the job has a retry policy (`max_retries` \u003e 0), subsequent runs are created with an `original_attempt_run_id` of the original attempt’s ID and an incrementing `attempt_number`. Runs are retried only until they succeed, and the maximum `attempt_number` is the same as the `max_retries` value for the job.",
+          "launch_stage": "GA"
+        },
+        "clean_rooms_notebook_task": {
+          "description": "The task runs a [clean rooms](https://docs.databricks.com/clean-rooms/index.html) notebook\nwhen the `clean_rooms_notebook_task` field is present.",
+          "ref": "jobs.CleanRoomsNotebookTask",
+          "launch_stage": "GA"
+        },
+        "cleanup_duration": {
+          "description": "The time in milliseconds it took to terminate the cluster and clean up any associated artifacts. The duration of a task run is the sum of the `setup_duration`, `execution_duration`, and the `cleanup_duration`. The `cleanup_duration` field is set to 0 for multitask job runs. The total duration of a multitask job run is the value of the `run_duration` field.",
+          "launch_stage": "GA"
+        },
+        "cluster_instance": {
+          "description": "The cluster used for this run. If the run is specified to use a new cluster, this field is set once the Jobs service has requested a cluster for the run.",
+          "ref": "jobs.ClusterInstance",
+          "launch_stage": "GA"
+        },
+        "compute": {
+          "description": "Task level compute configuration.",
+          "ref": "jobs.Compute",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "INPUT_ONLY"
+          ]
+        },
+        "condition_task": {
+          "description": "The task evaluates a condition that can be used to control the execution of other tasks when the `condition_task` field is present.\nThe condition task does not require a cluster to execute and does not support retries or notifications.",
+          "ref": "jobs.RunConditionTask",
+          "launch_stage": "GA"
+        },
+        "dashboard_task": {
+          "description": "The task refreshes a dashboard and sends a snapshot to subscribers.",
+          "ref": "jobs.DashboardTask",
+          "launch_stage": "GA"
+        },
+        "dbt_cloud_task": {
+          "description": "Task type for dbt cloud, deprecated in favor of the new name dbt_platform_task",
+          "ref": "jobs.DbtCloudTask",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "dbt_platform_task": {
+          "ref": "jobs.DbtPlatformTask",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "dbt_task": {
+          "description": "The task runs one or more dbt commands when the `dbt_task` field is present. The dbt task requires both Databricks SQL and the ability to use a serverless or a pro SQL warehouse.",
+          "ref": "jobs.DbtTask",
+          "launch_stage": "GA"
+        },
+        "depends_on": {
+          "description": "An optional array of objects specifying the dependency graph of the task. All tasks specified in this field must complete successfully before executing this task.\nThe key is `task_key`, and the value is the name assigned to the dependent task.",
+          "launch_stage": "GA"
+        },
+        "description": {
+          "description": "An optional description for this task.",
+          "launch_stage": "GA"
+        },
+        "disable_auto_optimization": {
+          "description": "An option to disable auto optimization in serverless",
+          "launch_stage": "GA"
+        },
+        "disabled": {
+          "description": "An optional flag to disable the task. If set to true, the task will not run even if it is part of a job.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "effective_performance_target": {
+          "description": "The actual performance target used by the serverless run during execution. This can differ from the client-set performance target on the request depending on whether the performance mode is supported by the job type.\n\n* `PERFORMANCE_OPTIMIZED`: Prioritizes fast startup and execution times through rapid scaling and optimized cluster performance.\n* `STANDARD`: Enables cost-efficient execution of serverless workloads.\n* `COST_OPTIMIZED`: Enables lower job costs by optimizing compute for your selected target duration time. Must provide a duration target.",
+          "ref": "jobs.PerformanceTarget",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "email_notifications": {
+          "description": "An optional set of email addresses notified when the task run begins or completes. The default behavior is to not send any emails.",
+          "ref": "jobs.JobEmailNotifications",
+          "launch_stage": "GA"
+        },
+        "end_time": {
+          "description": "The time at which this run ended in epoch milliseconds (milliseconds since 1/1/1970 UTC). This field is set to 0 if the job is still running.",
+          "launch_stage": "GA"
+        },
+        "environment_key": {
+          "description": "The key that references an environment spec in a job. This field is required for Python script, Python wheel and dbt tasks when using serverless compute or a compute resource that uses Environments mode.",
+          "launch_stage": "GA"
+        },
+        "environment_variables_key": {
+          "description": "Reference to a `JobEnvironmentVariables` entry defined in\n`RunSettings.environment_variables` for one-time runs or preserved in\n`Run.environment_variables` for run snapshots. The selected entry's\nvariables are applied to this task at execution time. This field supports\nserverless tasks using environment version 5 or later.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "execution_duration": {
+          "description": "The time in milliseconds it took to execute the commands in the JAR or notebook until they  completed, failed, timed out, were cancelled, or encountered an unexpected error. The duration of a task run is the sum of the `setup_duration`, `execution_duration`, and the  `cleanup_duration`. The `execution_duration` field is set to 0 for multitask job runs. The total  duration of a multitask job run is the value of the `run_duration` field.",
+          "launch_stage": "GA"
+        },
+        "existing_cluster_id": {
+          "description": "If existing_cluster_id, the ID of an existing cluster that is used for all runs.\nWhen running jobs or tasks on an existing cluster, you may need to manually restart\nthe cluster if it stops responding. We suggest running jobs and tasks on new clusters for\ngreater reliability",
+          "launch_stage": "GA"
+        },
+        "for_each_task": {
+          "description": "The task executes a nested task for every input provided when the `for_each_task` field is present.",
+          "ref": "jobs.RunForEachTask",
+          "launch_stage": "GA"
+        },
+        "gen_ai_compute_task": {
+          "ref": "jobs.GenAiComputeTask",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "git_source": {
+          "description": "An optional specification for a remote Git repository containing the source code used by tasks. Version-controlled source code is supported by notebook, dbt, Python script, and SQL File tasks.  If `git_source` is set, these tasks retrieve the file from the remote repository by default. However, this behavior can be overridden by setting `source` to `WORKSPACE` on the task.  Note: dbt and SQL File tasks support only version-controlled sources. If dbt or SQL File tasks are used, `git_source` must be defined on the job.",
+          "ref": "jobs.GitSource",
+          "launch_stage": "GA"
+        },
+        "job_cluster_key": {
+          "description": "If job_cluster_key, this task is executed reusing the cluster specified in `job.settings.job_clusters`.",
+          "launch_stage": "GA"
+        },
+        "libraries": {
+          "description": "An optional list of libraries to be installed on the cluster.\nThe default value is an empty list.",
+          "launch_stage": "GA"
+        },
+        "max_retries": {
+          "description": "An optional maximum number of times to retry an unsuccessful run. A run is considered to be unsuccessful if it completes with the `FAILED` result_state or `INTERNAL_ERROR` `life_cycle_state`. The value `-1` means to retry indefinitely and the value `0` means to never retry.",
+          "launch_stage": "GA"
+        },
+        "min_retry_interval_millis": {
+          "description": "An optional minimal interval in milliseconds between the start of the failed run and the subsequent retry run. The default behavior is that unsuccessful runs are immediately retried.",
+          "launch_stage": "GA"
+        },
+        "new_cluster": {
+          "description": "If new_cluster, a description of a new cluster that is created for each run.",
+          "ref": "compute.ClusterSpec",
+          "launch_stage": "GA"
+        },
+        "notebook_task": {
+          "description": "The task runs a notebook when the `notebook_task` field is present.",
+          "ref": "jobs.NotebookTask",
+          "launch_stage": "GA"
+        },
+        "notification_settings": {
+          "description": "Optional notification settings that are used when sending notifications to each of the `email_notifications` and `webhook_notifications` for this task run.",
+          "ref": "jobs.TaskNotificationSettings",
+          "launch_stage": "GA"
+        },
+        "pipeline_task": {
+          "description": "The task triggers a pipeline update when the `pipeline_task` field is present. Only pipelines configured to use triggered more are supported.",
+          "ref": "jobs.PipelineTask",
+          "launch_stage": "GA"
+        },
+        "power_bi_task": {
+          "description": "The task triggers a Power BI semantic model update when the `power_bi_task` field is present.",
+          "ref": "jobs.PowerBiTask",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "python_operator_task": {
+          "description": "The task runs a Python operator task.",
+          "ref": "jobs.PythonOperatorTask",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "python_wheel_task": {
+          "description": "The task runs a Python wheel when the `python_wheel_task` field is present.",
+          "ref": "jobs.PythonWheelTask",
+          "launch_stage": "GA"
+        },
+        "queue_duration": {
+          "description": "The time in milliseconds that the run has spent in the queue.",
+          "launch_stage": "GA"
+        },
+        "resolved_values": {
+          "description": "Parameter values including resolved references",
+          "ref": "jobs.ResolvedValues",
+          "launch_stage": "GA"
+        },
+        "retry_on_timeout": {
+          "description": "An optional policy to specify whether to retry a job when it times out. The default behavior\nis to not retry on timeout.",
+          "launch_stage": "GA"
+        },
+        "run_duration": {
+          "description": "The time in milliseconds it took the job run and all of its repairs to finish.",
+          "launch_stage": "GA"
+        },
+        "run_id": {
+          "description": "The ID of the task run.",
+          "launch_stage": "GA"
+        },
+        "run_if": {
+          "description": "An optional value indicating the condition that determines whether the task should be run once its dependencies have been completed. When omitted, defaults to `ALL_SUCCESS`. See :method:jobs/create for a list of possible values.",
+          "ref": "jobs.RunIf",
+          "launch_stage": "GA"
+        },
+        "run_job_task": {
+          "description": "The task triggers another job when the `run_job_task` field is present.",
+          "ref": "jobs.RunJobTask",
+          "launch_stage": "GA"
+        },
+        "run_page_url": {
+          "launch_stage": "GA"
+        },
+        "setup_duration": {
+          "description": "The time in milliseconds it took to set up the cluster. For runs that run on new clusters this is the cluster creation time, for runs that run on existing clusters this time should be very short. The duration of a task run is the sum of the `setup_duration`, `execution_duration`, and the `cleanup_duration`. The `setup_duration` field is set to 0 for multitask job runs. The total duration of a multitask job run is the value of the `run_duration` field.",
+          "launch_stage": "GA"
+        },
+        "spark_jar_task": {
+          "description": "The task runs a JAR when the `spark_jar_task` field is present.",
+          "ref": "jobs.SparkJarTask",
+          "launch_stage": "GA"
+        },
+        "spark_python_task": {
+          "description": "The task runs a Python file when the `spark_python_task` field is present.",
+          "ref": "jobs.SparkPythonTask",
+          "launch_stage": "GA"
+        },
+        "spark_submit_task": {
+          "description": "(Legacy) The task runs the spark-submit script when the spark_submit_task field is present. Databricks recommends using the spark_jar_task instead; see [Spark Submit task for jobs](/jobs/spark-submit).",
+          "ref": "jobs.SparkSubmitTask",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "sql_task": {
+          "description": "The task runs a SQL query or file, or it refreshes a SQL alert or a legacy SQL dashboard when the `sql_task` field is present.",
+          "ref": "jobs.SqlTask",
+          "launch_stage": "GA"
+        },
+        "start_time": {
+          "description": "The time at which this run was started in epoch milliseconds (milliseconds since 1/1/1970 UTC). This may not be the time when the job task starts executing, for example, if the job is scheduled to run on a new cluster, this is the time the cluster creation call is issued.",
+          "launch_stage": "GA"
+        },
+        "state": {
+          "description": "Deprecated. Please use the `status` field instead.",
+          "ref": "jobs.RunState",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "status": {
+          "ref": "jobs.RunStatus",
+          "launch_stage": "GA"
+        },
+        "task_key": {
+          "description": "A unique name for the task. This field is used to refer to this task from other tasks.\nThis field is required and must be unique within its parent job.\nOn Update or Reset, this field is used to reference the tasks to be updated or reset.",
+          "launch_stage": "GA"
+        },
+        "timeout_seconds": {
+          "description": "An optional timeout applied to each run of this job task. A value of `0` means no timeout.",
+          "launch_stage": "GA"
+        },
+        "webhook_notifications": {
+          "description": "A collection of system notification IDs to notify when the run begins or completes. The default behavior is to not send any system notifications. Task webhooks respect the task notification settings.",
+          "ref": "jobs.WebhookNotifications",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.RunType": {
+      "description": "The type of a run.\n* `JOB_RUN`: Normal job run. A run created with :method:jobs/runNow.\n* `WORKFLOW_RUN`: Workflow run. A run created with [dbutils.notebook.run](https://docs.databricks.com/dev-tools/databricks-utils.html#dbutils-workflow).\n* `SUBMIT_RUN`: Submit run. A run created with :method:jobs/submit.",
+      "enum": [
+        "JOB_RUN",
+        "WORKFLOW_RUN",
+        "SUBMIT_RUN"
+      ],
+      "enum_launch_stages": {
+        "JOB_RUN": "GA",
+        "SUBMIT_RUN": "GA",
+        "WORKFLOW_RUN": "GA"
+      },
+      "enum_descriptions": {
+        "JOB_RUN": "Normal job run. A run created with :method:jobs/runNow.",
+        "SUBMIT_RUN": "Submit run. A run created with :method:jobs/submit.",
+        "WORKFLOW_RUN": "Workflow run. A run created with [dbutils.notebook.run](/dev-tools/databricks-utils.html#dbutils-workflow)."
+      }
+    },
+    "jobs.ScheduleTriggerState": {
+      "description": "Runtime state for a schedule trigger. Currently empty because schedule triggers\ndo not expose any trigger-specific runtime state."
+    },
+    "jobs.Source": {
+      "description": "Optional location type of the SQL file. When set to `WORKSPACE`, the SQL file will be retrieved\\\nfrom the local Databricks workspace. When set to `GIT`, the SQL file will be retrieved from a Git repository\ndefined in `git_source`. If the value is empty, the task will use `GIT` if `git_source` is defined and `WORKSPACE` otherwise.\n\n* `WORKSPACE`: SQL file is located in Databricks workspace.\n* `GIT`: SQL file is located in cloud Git provider.",
+      "enum": [
+        "WORKSPACE",
+        "GIT"
+      ],
+      "enum_launch_stages": {
+        "GIT": "GA",
+        "WORKSPACE": "GA"
+      },
+      "enum_descriptions": {
+        "GIT": "SQL file is located in cloud Git provider.",
+        "WORKSPACE": "SQL file is located in \u003cDatabricks\u003e workspace."
+      }
+    },
+    "jobs.SparkJarTask": {
+      "fields": {
+        "jar_uri": {
+          "description": "Deprecated since 04/2016. For classic compute, provide a `jar` through the `libraries` field instead. For serverless compute, provide a `jar` though the `java_dependencies` field inside the `environments` list.\n\nSee the examples of classic and serverless compute usage at the top of the page.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "main_class_name": {
+          "description": "The full name of the class containing the main method to be executed. This class must be contained in a JAR provided as a library.\n\nThe code must use `SparkContext.getOrCreate` to obtain a Spark context; otherwise, runs of the job fail.",
+          "launch_stage": "GA"
+        },
+        "parameters": {
+          "description": "Parameters passed to the main method.\n\nUse [Task parameter variables](https://docs.databricks.com/jobs.html#parameter-variables) to set parameters containing information about job runs.",
+          "launch_stage": "GA"
+        },
+        "run_as_repl": {
+          "description": "Deprecated. A value of `false` is no longer supported.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.SparkPythonTask": {
+      "fields": {
+        "parameters": {
+          "description": "Command line parameters passed to the Python file.\n\nUse [Task parameter variables](https://docs.databricks.com/jobs.html#parameter-variables) to set parameters containing information about job runs.",
+          "launch_stage": "GA"
+        },
+        "python_file": {
+          "description": "The Python file to be executed. Cloud file URIs (such as dbfs:/, s3:/, adls:/, gcs:/) and workspace paths are supported. For python files stored in the Databricks workspace, the path must be absolute and begin with `/`. For files stored in a remote repository, the path must be relative. This field is required.",
+          "launch_stage": "GA"
+        },
+        "source": {
+          "description": "Optional location type of the Python file. When set to `WORKSPACE` or not specified, the file will be retrieved from the local\nDatabricks workspace or cloud location (if the `python_file` has a URI format). When set to `GIT`,\nthe Python file will be retrieved from a Git repository defined in `git_source`.\n\n* `WORKSPACE`: The Python file is located in a Databricks workspace or at a cloud filesystem URI.\n* `GIT`: The Python file is located in a remote Git repository.",
+          "ref": "jobs.Source",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.SparkSubmitTask": {
+      "fields": {
+        "parameters": {
+          "description": "Command-line parameters passed to spark submit.\n\nUse [Task parameter variables](https://docs.databricks.com/jobs.html#parameter-variables) to set parameters containing information about job runs.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.SparseCheckout": {
+      "fields": {
+        "patterns": {
+          "description": "List of patterns to include for sparse checkout.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.SqlAlertOutput": {
+      "fields": {
+        "alert_state": {
+          "ref": "jobs.SqlAlertState",
+          "launch_stage": "GA"
+        },
+        "output_link": {
+          "description": "The link to find the output results.",
+          "launch_stage": "GA"
+        },
+        "query_text": {
+          "description": "The text of the SQL query. Can Run permission of the SQL query associated with the SQL alert is required to view this field.",
+          "launch_stage": "GA"
+        },
+        "sql_statements": {
+          "description": "Information about SQL statements executed in the run.",
+          "launch_stage": "GA"
+        },
+        "warehouse_id": {
+          "description": "The canonical identifier of the SQL warehouse.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.SqlAlertState": {
+      "description": "The state of the SQL alert.\n\n* UNKNOWN: alert yet to be evaluated\n* OK: alert evaluated and did not fulfill trigger conditions\n* TRIGGERED: alert evaluated and fulfilled trigger conditions",
+      "enum": [
+        "UNKNOWN",
+        "OK",
+        "TRIGGERED"
+      ],
+      "enum_launch_stages": {
+        "OK": "GA",
+        "TRIGGERED": "GA",
+        "UNKNOWN": "GA"
+      }
+    },
+    "jobs.SqlConditionConfiguration": {
+      "fields": {
+        "sql_query_id": {
+          "description": "The ID of the SQL query to evaluate as the trigger condition.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "trigger_mode": {
+          "description": "Determines how the SQL query result is interpreted to decide whether the condition fires.\nMust be set to a recognized value when provided.\nWhen unset on an existing serialized configuration, the server preserves the original\nsemantics by interpreting it as `QUERY_RETURNS_ROWS`. New configurations should set this\nexplicitly — explicit `SQL_CONDITION_TRIGGER_MODE_UNSPECIFIED` is rejected at validation.",
+          "ref": "jobs.SqlConditionTriggerMode",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "warehouse_id": {
+          "description": "The canonical identifier of the SQL warehouse to run the condition query against.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "jobs.SqlConditionRunInfoDetails": {
+      "description": "SQL condition evaluation details captured at the time the run was triggered",
+      "fields": {
+        "condition_evaluation_satisfied": {
+          "description": "Whether the last condition evaluation was satisfied (query returned truthy result).",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "condition_evaluation_sql_session_id": {
+          "description": "The ID of the SQL session, used by the UI to track session context.\nSet for the QUERY_RETURNS_ROWS trigger mode.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "condition_evaluation_sql_statement_id": {
+          "description": "The SQL statement ID of the condition evaluation, set when the condition is\nevaluated by running a single SQL statement (the RESULT_VALUE_CHANGES trigger\nmode). The UI uses it to link to the query execution details.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "jobs.SqlConditionState": {
+      "fields": {
+        "latest_condition_evaluation_satisfied": {
+          "description": "Whether the last condition evaluation was satisfied (query returned truthy result).",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "latest_condition_evaluation_sql_session_id": {
+          "description": "The ID of the SQL session, used by UI to track session context.\nPopulated for QUERY_RETURNS_ROWS, which executes the query through Redash.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "latest_condition_evaluation_sql_statement_id": {
+          "description": "The SEA statement ID of the SQL statement executed for the latest condition evaluation.\nPopulated for RESULT_VALUE_CHANGES, which executes the query through the SQL execution API.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "jobs.SqlConditionTriggerMode": {
+      "description": "The strategy used to evaluate a SQL condition trigger against a query result set.\n\n* `SQL_CONDITION_TRIGGER_MODE_UNSPECIFIED`: Sentinel zero-value. Not a valid input — the\nvalidator rejects this when sent explicitly. Internally treated as `QUERY_RETURNS_ROWS`\nwhen reading legacy data that predates this field.\n* `QUERY_RETURNS_ROWS`: Fires whenever the result set has at least one row. Zero rows means\nthe condition is not met. This is the original SQL condition behavior.\n* `RESULT_VALUE_CHANGES`: Fires whenever the query's single result value differs from the\nprevious evaluation. The first evaluation always fires. Queries must return exactly one\ncell (one row, one column).",
+      "enum": [
+        "QUERY_RETURNS_ROWS",
+        "RESULT_VALUE_CHANGES"
+      ],
+      "enum_launch_stages": {
+        "QUERY_RETURNS_ROWS": "PRIVATE_PREVIEW",
+        "RESULT_VALUE_CHANGES": "PRIVATE_PREVIEW"
+      },
+      "enum_descriptions": {
+        "QUERY_RETURNS_ROWS": "Fires whenever the result set has at least one row. Zero rows means",
+        "RESULT_VALUE_CHANGES": "Fires whenever the query's single result value differs from the"
+      }
+    },
+    "jobs.SqlDashboardOutput": {
+      "fields": {
+        "warehouse_id": {
+          "description": "The canonical identifier of the SQL warehouse.",
+          "launch_stage": "GA"
+        },
+        "widgets": {
+          "description": "Widgets executed in the run. Only SQL query based widgets are listed.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.SqlDashboardWidgetOutput": {
+      "fields": {
+        "end_time": {
+          "description": "Time (in epoch milliseconds) when execution of the SQL widget ends.",
+          "launch_stage": "GA"
+        },
+        "error": {
+          "description": "The information about the error when execution fails.",
+          "ref": "jobs.SqlOutputError",
+          "launch_stage": "GA"
+        },
+        "output_link": {
+          "description": "The link to find the output results.",
+          "launch_stage": "GA"
+        },
+        "start_time": {
+          "description": "Time (in epoch milliseconds) when execution of the SQL widget starts.",
+          "launch_stage": "GA"
+        },
+        "status": {
+          "description": "The execution status of the SQL widget.",
+          "ref": "jobs.SqlDashboardWidgetOutputStatus",
+          "launch_stage": "GA"
+        },
+        "widget_id": {
+          "description": "The canonical identifier of the SQL widget.",
+          "launch_stage": "GA"
+        },
+        "widget_title": {
+          "description": "The title of the SQL widget.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.SqlDashboardWidgetOutputStatus": {
+      "enum": [
+        "PENDING",
+        "RUNNING",
+        "SUCCESS",
+        "FAILED",
+        "CANCELLED"
+      ],
+      "enum_launch_stages": {
+        "CANCELLED": "GA",
+        "FAILED": "GA",
+        "PENDING": "GA",
+        "RUNNING": "GA",
+        "SUCCESS": "GA"
+      }
+    },
+    "jobs.SqlOutput": {
+      "fields": {
+        "alert_output": {
+          "description": "The output of a SQL alert task, if available.",
+          "ref": "jobs.SqlAlertOutput",
+          "launch_stage": "GA"
+        },
+        "dashboard_output": {
+          "description": "The output of a SQL dashboard task, if available.",
+          "ref": "jobs.SqlDashboardOutput",
+          "launch_stage": "GA"
+        },
+        "query_output": {
+          "description": "The output of a SQL query task, if available.",
+          "ref": "jobs.SqlQueryOutput",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.SqlOutputError": {
+      "fields": {
+        "message": {
+          "description": "The error message when execution fails.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.SqlQueryOutput": {
+      "fields": {
+        "endpoint_id": {
+          "launch_stage": "GA"
+        },
+        "output_link": {
+          "description": "The link to find the output results.",
+          "launch_stage": "GA"
+        },
+        "query_text": {
+          "description": "The text of the SQL query. Can Run permission of the SQL query is required to view this field.",
+          "launch_stage": "GA"
+        },
+        "sql_statements": {
+          "description": "Information about SQL statements executed in the run.",
+          "launch_stage": "GA"
+        },
+        "warehouse_id": {
+          "description": "The canonical identifier of the SQL warehouse.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.SqlStatementOutput": {
+      "fields": {
+        "lookup_key": {
+          "description": "A key that can be used to look up query details.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.SqlTask": {
+      "fields": {
+        "alert": {
+          "description": "If alert, indicates that this job must refresh a SQL alert.",
+          "ref": "jobs.SqlTaskAlert",
+          "launch_stage": "GA"
+        },
+        "dashboard": {
+          "description": "If dashboard, indicates that this job must refresh a SQL dashboard.",
+          "ref": "jobs.SqlTaskDashboard",
+          "launch_stage": "GA"
+        },
+        "file": {
+          "description": "If file, indicates that this job runs a SQL file in a remote Git repository.",
+          "ref": "jobs.SqlTaskFile",
+          "launch_stage": "GA"
+        },
+        "parameters": {
+          "description": "Parameters to be used for each run of this job. The SQL alert task does not support custom parameters.",
+          "launch_stage": "GA"
+        },
+        "query": {
+          "description": "If query, indicates that this job must execute a SQL query.",
+          "ref": "jobs.SqlTaskQuery",
+          "launch_stage": "GA"
+        },
+        "warehouse_id": {
+          "description": "The canonical identifier of the SQL warehouse. Recommended to use with serverless or pro SQL warehouses. Classic SQL warehouses are only supported for SQL alert, dashboard and query tasks and are limited to scheduled single-task jobs.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.SqlTaskAlert": {
+      "fields": {
+        "alert_id": {
+          "description": "The canonical identifier of the SQL alert.",
+          "launch_stage": "GA"
+        },
+        "pause_subscriptions": {
+          "description": "If true, the alert notifications are not sent to subscribers.",
+          "launch_stage": "GA"
+        },
+        "subscriptions": {
+          "description": "If specified, alert notifications are sent to subscribers.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.SqlTaskDashboard": {
+      "fields": {
+        "custom_subject": {
+          "description": "Subject of the email sent to subscribers of this task.",
+          "launch_stage": "GA"
+        },
+        "dashboard_id": {
+          "description": "The canonical identifier of the SQL dashboard.",
+          "launch_stage": "GA"
+        },
+        "pause_subscriptions": {
+          "description": "If true, the dashboard snapshot is not taken, and emails are not sent to subscribers.",
+          "launch_stage": "GA"
+        },
+        "subscriptions": {
+          "description": "If specified, dashboard snapshots are sent to subscriptions.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.SqlTaskFile": {
+      "fields": {
+        "path": {
+          "description": "Path of the SQL file. Must be relative if the source is a remote Git repository and absolute for workspace paths.",
+          "launch_stage": "GA"
+        },
+        "source": {
+          "description": "Optional location type of the SQL file. When set to `WORKSPACE`, the SQL file will be retrieved\nfrom the local Databricks workspace. When set to `GIT`, the SQL file will be retrieved from a Git repository\ndefined in `git_source`. If the value is empty, the task will use `GIT` if `git_source` is defined and `WORKSPACE` otherwise.\n\n* `WORKSPACE`: SQL file is located in Databricks workspace.\n* `GIT`: SQL file is located in cloud Git provider.",
+          "ref": "jobs.Source",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.SqlTaskQuery": {
+      "fields": {
+        "query_id": {
+          "description": "The canonical identifier of the SQL query.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.SqlTaskSubscription": {
+      "fields": {
+        "destination_id": {
+          "description": "The canonical identifier of the destination to receive email notification. This parameter is mutually exclusive with user_name. You cannot set both destination_id and user_name for subscription notifications.",
+          "launch_stage": "GA"
+        },
+        "user_name": {
+          "description": "The user name to receive the subscription email. This parameter is mutually exclusive with destination_id. You cannot set both destination_id and user_name for subscription notifications.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.StorageMode": {
+      "enum": [
+        "DIRECT_QUERY",
+        "IMPORT",
+        "DUAL"
+      ],
+      "enum_launch_stages": {
+        "DIRECT_QUERY": "PUBLIC_PREVIEW",
+        "DUAL": "PUBLIC_PREVIEW",
+        "IMPORT": "PUBLIC_PREVIEW"
+      }
+    },
+    "jobs.SubmitRun": {
+      "fields": {
+        "access_control_list": {
+          "description": "List of permissions to set on the job.",
+          "launch_stage": "GA"
+        },
+        "budget_policy_id": {
+          "description": "The user specified id of the budget policy to use for this one-time run.\nIf not specified, the run will be not be attributed to any budget policy.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "INPUT_ONLY"
+          ]
+        },
+        "duration_target": {
+          "description": "The window the run aims to finish within, in hours, for a Cost-optimized serverless run.\nRequired only when `performance_target` is `COST_OPTIMIZED`. Must be one of the\nsupported values: `NO_FLEXIBILITY`, `4h`, `12h`, `24h`, `72h`. `NO_FLEXIBILITY` means the run\nuses the default cost-optimized performance level without additional cost-saving optimizations.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "email_notifications": {
+          "description": "An optional set of email addresses notified when the run begins or completes.",
+          "ref": "jobs.JobEmailNotifications",
+          "launch_stage": "GA"
+        },
+        "environment_variables": {
+          "description": "Named environment-variable entries that tasks of this one-time run can\nreference by key from `RunTaskSettings.environment_variables_key`. Each\nentry's `spec` holds inline `variables` and optional `.env` `files`.\nHandled identically to `JobSettings.environment_variables`. Maximum 10 entries.\nEntries are independent of one another — there is no cross-entry merging.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "environments": {
+          "description": "A list of task execution environment specifications that can be referenced by tasks of this run.",
+          "launch_stage": "GA"
+        },
+        "git_source": {
+          "description": "An optional specification for a remote Git repository containing the source code used by tasks. Version-controlled source code is supported by notebook, dbt, Python script, and SQL File tasks.\n\nIf `git_source` is set, these tasks retrieve the file from the remote repository by default. However, this behavior can be overridden by setting `source` to `WORKSPACE` on the task.\n\nNote: dbt and SQL File tasks support only version-controlled sources. If dbt or SQL File tasks are used, `git_source` must be defined on the job.",
+          "ref": "jobs.GitSource",
+          "launch_stage": "GA"
+        },
+        "health": {
+          "ref": "jobs.JobsHealthRules",
+          "launch_stage": "GA"
+        },
+        "idempotency_token": {
+          "description": "An optional token that can be used to guarantee the idempotency of job run requests. If a run with the provided token already exists,\nthe request does not create a new run but returns the ID of the existing run instead. If a run with the provided token is deleted,\nan error is returned.\n\nIf you specify the idempotency token, upon failure you can retry until the request succeeds. Databricks guarantees that exactly\none run is launched with that idempotency token.\n\nThis token must have at most 64 characters.",
+          "launch_stage": "GA"
+        },
+        "notification_settings": {
+          "description": "Optional notification settings that are used when sending notifications to each of the `email_notifications` and `webhook_notifications` for this run.",
+          "ref": "jobs.JobNotificationSettings",
+          "launch_stage": "GA"
+        },
+        "performance_target": {
+          "description": "The performance mode on a serverless one-time run. This field determines the level of compute performance or cost-efficiency for the run.\nThe performance target does not apply to tasks that run on Serverless GPU compute.\n\n* `PERFORMANCE_OPTIMIZED`: Prioritizes fast startup and execution times through rapid scaling and optimized cluster performance.\n* `STANDARD`: Enables cost-efficient execution of serverless workloads.\n* `COST_OPTIMIZED`: Enables lower job costs by optimizing compute for your selected target duration time. Must provide a duration target.",
+          "ref": "jobs.PerformanceTarget",
+          "launch_stage": "GA"
+        },
+        "queue": {
+          "description": "The queue settings of the one-time run.",
+          "ref": "jobs.QueueSettings",
+          "launch_stage": "GA"
+        },
+        "run_as": {
+          "description": "Specifies the user or service principal that the job runs as. If not specified, the job runs as the user who submits the request.",
+          "ref": "jobs.JobRunAs",
+          "launch_stage": "GA"
+        },
+        "run_name": {
+          "description": "An optional name for the run. The default value is `Untitled`.",
+          "launch_stage": "GA"
+        },
+        "tasks": {
+          "launch_stage": "GA"
+        },
+        "timeout_seconds": {
+          "description": "An optional timeout applied to each run of this job. A value of `0` means no timeout.",
+          "launch_stage": "GA"
+        },
+        "usage_policy_id": {
+          "description": "The user specified id of the usage policy to use for this one-time run.\nIf not specified, a default usage policy may be applied when creating or modifying the job.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "INPUT_ONLY"
+          ]
+        },
+        "webhook_notifications": {
+          "description": "A collection of system notification IDs to notify when the run begins or completes.",
+          "ref": "jobs.WebhookNotifications",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.SubmitRunResponse": {
+      "description": "Run was created and started successfully.",
+      "fields": {
+        "run_id": {
+          "description": "The canonical identifier for the newly submitted run.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.SubmitTask": {
+      "fields": {
+        "ai_runtime_task": {
+          "description": "The task runs a multi-gpu compute workload on Databricks AI Runtime. Specify\nthe accelerator type and count, the command to run, and where the workload's\ncode and MLflow output are stored.",
+          "ref": "jobs.AiRuntimeTask",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "alert_task": {
+          "description": "The task evaluates a Databricks alert and sends notifications to subscribers\nwhen the `alert_task` field is present.",
+          "ref": "jobs.AlertTask",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "clean_rooms_notebook_task": {
+          "description": "The task runs a [clean rooms](https://docs.databricks.com/clean-rooms/index.html) notebook\nwhen the `clean_rooms_notebook_task` field is present.",
+          "ref": "jobs.CleanRoomsNotebookTask",
+          "launch_stage": "GA"
+        },
+        "compute": {
+          "description": "Task level compute configuration.",
+          "ref": "jobs.Compute",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "INPUT_ONLY"
+          ]
+        },
+        "condition_task": {
+          "description": "The task evaluates a condition that can be used to control the execution of other tasks when the `condition_task` field is present.\nThe condition task does not require a cluster to execute and does not support retries or notifications.",
+          "ref": "jobs.ConditionTask",
+          "launch_stage": "GA"
+        },
+        "dashboard_task": {
+          "description": "The task refreshes a dashboard and sends a snapshot to subscribers.",
+          "ref": "jobs.DashboardTask",
+          "launch_stage": "GA"
+        },
+        "dbt_cloud_task": {
+          "description": "Task type for dbt cloud, deprecated in favor of the new name dbt_platform_task",
+          "ref": "jobs.DbtCloudTask",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "dbt_platform_task": {
+          "ref": "jobs.DbtPlatformTask",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "dbt_task": {
+          "description": "The task runs one or more dbt commands when the `dbt_task` field is present. The dbt task requires both Databricks SQL and the ability to use a serverless or a pro SQL warehouse.",
+          "ref": "jobs.DbtTask",
+          "launch_stage": "GA"
+        },
+        "depends_on": {
+          "description": "An optional array of objects specifying the dependency graph of the task. All tasks specified in this field must complete successfully before executing this task.\nThe key is `task_key`, and the value is the name assigned to the dependent task.",
+          "launch_stage": "GA"
+        },
+        "description": {
+          "description": "An optional description for this task.",
+          "launch_stage": "GA"
+        },
+        "disable_auto_optimization": {
+          "description": "An option to disable auto optimization in serverless",
+          "launch_stage": "GA"
+        },
+        "disabled": {
+          "description": "An optional flag to disable the task. If set to true, the task will not run even if it is part of a job.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "email_notifications": {
+          "description": "An optional set of email addresses notified when the task run begins or completes. The default behavior is to not send any emails.",
+          "ref": "jobs.JobEmailNotifications",
+          "launch_stage": "GA"
+        },
+        "environment_key": {
+          "description": "The key that references an environment spec in a job. This field is required for Python script, Python wheel and dbt tasks when using serverless compute or a compute resource that uses Environments mode.",
+          "launch_stage": "GA"
+        },
+        "environment_variables_key": {
+          "description": "Reference to a `JobEnvironmentVariables` entry defined in\n`RunSettings.environment_variables` for one-time runs or preserved in\n`Run.environment_variables` for run snapshots. The selected entry's\nvariables are applied to this task at execution time. This field supports\nserverless tasks using environment version 5 or later.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "existing_cluster_id": {
+          "description": "If existing_cluster_id, the ID of an existing cluster that is used for all runs.\nWhen running jobs or tasks on an existing cluster, you may need to manually restart\nthe cluster if it stops responding. We suggest running jobs and tasks on new clusters for\ngreater reliability",
+          "launch_stage": "GA"
+        },
+        "for_each_task": {
+          "description": "The task executes a nested task for every input provided when the `for_each_task` field is present.",
+          "ref": "jobs.ForEachTask",
+          "launch_stage": "GA"
+        },
+        "gen_ai_compute_task": {
+          "ref": "jobs.GenAiComputeTask",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "health": {
+          "ref": "jobs.JobsHealthRules",
+          "launch_stage": "GA"
+        },
+        "libraries": {
+          "description": "An optional list of libraries to be installed on the cluster.\nThe default value is an empty list.",
+          "launch_stage": "GA"
+        },
+        "max_retries": {
+          "description": "An optional maximum number of times to retry an unsuccessful run. A run is considered to be unsuccessful if it completes with the `FAILED` result_state or `INTERNAL_ERROR` `life_cycle_state`. The value `-1` means to retry indefinitely and the value `0` means to never retry.",
+          "launch_stage": "GA"
+        },
+        "min_retry_interval_millis": {
+          "description": "An optional minimal interval in milliseconds between the start of the failed run and the subsequent retry run. The default behavior is that unsuccessful runs are immediately retried.",
+          "launch_stage": "GA"
+        },
+        "new_cluster": {
+          "description": "If new_cluster, a description of a new cluster that is created for each run.",
+          "ref": "compute.ClusterSpec",
+          "launch_stage": "GA"
+        },
+        "notebook_task": {
+          "description": "The task runs a notebook when the `notebook_task` field is present.",
+          "ref": "jobs.NotebookTask",
+          "launch_stage": "GA"
+        },
+        "notification_settings": {
+          "description": "Optional notification settings that are used when sending notifications to each of the `email_notifications` and `webhook_notifications` for this task run.",
+          "ref": "jobs.TaskNotificationSettings",
+          "launch_stage": "GA"
+        },
+        "pipeline_task": {
+          "description": "The task triggers a pipeline update when the `pipeline_task` field is present. Only pipelines configured to use triggered more are supported.",
+          "ref": "jobs.PipelineTask",
+          "launch_stage": "GA"
+        },
+        "power_bi_task": {
+          "description": "The task triggers a Power BI semantic model update when the `power_bi_task` field is present.",
+          "ref": "jobs.PowerBiTask",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "python_operator_task": {
+          "description": "The task runs a Python operator task.",
+          "ref": "jobs.PythonOperatorTask",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "python_wheel_task": {
+          "description": "The task runs a Python wheel when the `python_wheel_task` field is present.",
+          "ref": "jobs.PythonWheelTask",
+          "launch_stage": "GA"
+        },
+        "retry_on_timeout": {
+          "description": "An optional policy to specify whether to retry a job when it times out. The default behavior\nis to not retry on timeout.",
+          "launch_stage": "GA"
+        },
+        "run_if": {
+          "description": "An optional value indicating the condition that determines whether the task should be run once its dependencies have been completed. When omitted, defaults to `ALL_SUCCESS`. See :method:jobs/create for a list of possible values.",
+          "ref": "jobs.RunIf",
+          "launch_stage": "GA"
+        },
+        "run_job_task": {
+          "description": "The task triggers another job when the `run_job_task` field is present.",
+          "ref": "jobs.RunJobTask",
+          "launch_stage": "GA"
+        },
+        "spark_jar_task": {
+          "description": "The task runs a JAR when the `spark_jar_task` field is present.",
+          "ref": "jobs.SparkJarTask",
+          "launch_stage": "GA"
+        },
+        "spark_python_task": {
+          "description": "The task runs a Python file when the `spark_python_task` field is present.",
+          "ref": "jobs.SparkPythonTask",
+          "launch_stage": "GA"
+        },
+        "spark_submit_task": {
+          "description": "(Legacy) The task runs the spark-submit script when the spark_submit_task field is present. Databricks recommends using the spark_jar_task instead; see [Spark Submit task for jobs](/jobs/spark-submit).",
+          "ref": "jobs.SparkSubmitTask",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "sql_task": {
+          "description": "The task runs a SQL query or file, or it refreshes a SQL alert or a legacy SQL dashboard when the `sql_task` field is present.",
+          "ref": "jobs.SqlTask",
+          "launch_stage": "GA"
+        },
+        "task_key": {
+          "description": "A unique name for the task. This field is used to refer to this task from other tasks.\nThis field is required and must be unique within its parent job.\nOn Update or Reset, this field is used to reference the tasks to be updated or reset.",
+          "launch_stage": "GA"
+        },
+        "timeout_seconds": {
+          "description": "An optional timeout applied to each run of this job task. A value of `0` means no timeout.",
+          "launch_stage": "GA"
+        },
+        "webhook_notifications": {
+          "description": "A collection of system notification IDs to notify when the run begins or completes. The default behavior is to not send any system notifications. Task webhooks respect the task notification settings.",
+          "ref": "jobs.WebhookNotifications",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.Subscription": {
+      "fields": {
+        "attachment": {
+          "description": "Optional: The configuration for the files attached to the dashboard snapshot notification. It\ncontrols the underlying data of dashboard widgets that is attached as data files and which\npages are included in the attached PDF. If not specified, the notification is sent with only\nthe default snapshot.",
+          "ref": "jobs.SubscriptionAttachment",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "custom_subject": {
+          "description": "Optional: Allows users to specify a custom subject line on the email sent\nto subscribers.",
+          "launch_stage": "GA"
+        },
+        "paused": {
+          "description": "When true, the subscription will not send emails.",
+          "launch_stage": "GA"
+        },
+        "subscribers": {
+          "description": "The list of subscribers to send the snapshot of the dashboard to.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.SubscriptionAttachment": {
+      "description": "The configuration for the files attached to the dashboard snapshot notification sent to\nsubscribers. `data_attachment` describes the underlying data of dashboard widgets attached\nas data files, and `page_attachment` describes which dashboard pages are included in the\nattached PDF.",
+      "fields": {
+        "data_attachment": {
+          "description": "Optional: The configuration for the underlying data of dashboard widgets attached as tabular\ndata files. If not specified, no tabular data is attached.",
+          "ref": "jobs.SubscriptionAttachmentDataAttachment",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_attachment": {
+          "description": "Optional: The selection of dashboard pages included in the attached PDF. If not specified,\nonly the first page is included.",
+          "ref": "jobs.SubscriptionAttachmentPageAttachment",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "jobs.SubscriptionAttachmentDataAttachment": {
+      "description": "The configuration for the tabular data files attached to the dashboard snapshot. `widgets`\nlists the widgets whose data is exported and `file_format` is the output format; each\nreferenced widget's data is exported as a separate file.",
+      "fields": {
+        "file_format": {
+          "description": "The file format of the exported tabular data files.",
+          "ref": "jobs.SubscriptionAttachmentDataAttachmentFileFormat",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "include_applied_filters": {
+          "description": "When true, the dashboard's applied filter values are included alongside the tabular data as\nan additional attached file.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "widgets": {
+          "description": "The widgets whose underlying data is exported. At least one widget must be referenced.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "jobs.SubscriptionAttachmentDataAttachmentFileFormat": {
+      "description": "The output format of an exported tabular data file. Must be set to a value other than\n`FILE_FORMAT_UNSPECIFIED`.",
+      "enum": [
+        "FILE_FORMAT_CSV",
+        "FILE_FORMAT_TSV",
+        "FILE_FORMAT_EXCEL"
+      ],
+      "enum_launch_stages": {
+        "FILE_FORMAT_CSV": "PRIVATE_PREVIEW",
+        "FILE_FORMAT_EXCEL": "PRIVATE_PREVIEW",
+        "FILE_FORMAT_TSV": "PRIVATE_PREVIEW"
+      }
+    },
+    "jobs.SubscriptionAttachmentDataAttachmentWidget": {
+      "description": "Identifies a dashboard widget whose data to attach. `page_id` and `widget_id` are\nthe URL identifiers from the dashboard's serialized definition returned by the Get dashboard\nAPI (`serialized_dashboard`), and together they uniquely identify the widget.",
+      "fields": {
+        "page_id": {
+          "description": "The URL identifier of the page containing the widget. This is the value of the `name`\nfield of the corresponding entry under `pages` in the serialized dashboard definition.\nFormat: alphanumeric, hyphen, and underscore characters allowed, max length 63.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "widget_id": {
+          "description": "The URL identifier of the widget. This is the value of the `name` field of the\ncorresponding widget under that page's `layout` in the serialized dashboard definition.\nFormat: alphanumeric, hyphen, and underscore characters allowed, max length 63.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "jobs.SubscriptionAttachmentPageAttachment": {
+      "description": "The selection of dashboard pages included in the attached PDF. `page_selection` chooses\nbetween all pages, the first page only, or an explicit subset listed in `page_ids`.",
+      "fields": {
+        "page_ids": {
+          "description": "The identifiers of the pages to include in the PDF. Only specified when `page_selection` is\n`PAGE_SELECTION_SUBSET`. Each value is the identifier of a page in the dashboard's\nserialized definition returned by the Get dashboard API (`serialized_dashboard`): the value\nof the `name` field of an entry under `pages`.\nFormat: alphanumeric, hyphen, and underscore characters allowed, max length 63.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_selection": {
+          "description": "How the attached pages are selected. When set to `PAGE_SELECTION_SUBSET`, the pages to\ninclude are listed in `page_ids`.",
+          "ref": "jobs.SubscriptionAttachmentPageAttachmentPageSelection",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "jobs.SubscriptionAttachmentPageAttachmentPageSelection": {
+      "description": "Determines which dashboard pages are attached to the notification.",
+      "enum": [
+        "PAGE_SELECTION_ALL",
+        "PAGE_SELECTION_SUBSET"
+      ],
+      "enum_launch_stages": {
+        "PAGE_SELECTION_ALL": "PRIVATE_PREVIEW",
+        "PAGE_SELECTION_SUBSET": "PRIVATE_PREVIEW"
+      }
+    },
+    "jobs.SubscriptionSubscriber": {
+      "fields": {
+        "destination_id": {
+          "description": "A snapshot of the dashboard will be sent to the destination when the `destination_id` field is present.",
+          "launch_stage": "GA"
+        },
+        "user_name": {
+          "description": "A snapshot of the dashboard will be sent to the user's email when the `user_name` field is present.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.TableState": {
+      "fields": {
+        "has_seen_updates": {
+          "description": "Whether or not the table has seen updates since either\nthe creation of the trigger or the last successful evaluation of the trigger",
+          "launch_stage": "GA"
+        },
+        "table_name": {
+          "description": "Full table name of the table to monitor, e.g. `mycatalog.myschema.mytable`",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.TableTriggerState": {
+      "fields": {
+        "last_seen_table_states": {
+          "launch_stage": "GA"
+        },
+        "using_scalable_monitoring": {
+          "description": "Indicates whether the trigger is using scalable monitoring.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.TableUpdateTriggerConfiguration": {
+      "fields": {
+        "condition": {
+          "description": "The table(s) condition based on which to trigger a job run.",
+          "ref": "jobs.Condition",
+          "launch_stage": "GA"
+        },
+        "min_time_between_triggers_seconds": {
+          "description": "If set, the trigger starts a run only after the specified amount of time has passed since\nthe last time the trigger fired. The minimum allowed value is 60 seconds.",
+          "launch_stage": "GA"
+        },
+        "table_names": {
+          "description": "A list of tables to monitor for changes. The table name must be in the format `catalog_name.schema_name.table_name`.",
+          "launch_stage": "GA"
+        },
+        "wait_after_last_change_seconds": {
+          "description": "If set, the trigger starts a run only after no table updates have occurred for the specified time\nand can be used to wait for a series of table updates before triggering a run. The\nminimum allowed value is 60 seconds.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.Task": {
+      "fields": {
+        "ai_runtime_task": {
+          "description": "The task runs a multi-gpu compute workload on Databricks AI Runtime. Specify\nthe accelerator type and count, the command to run, and where the workload's\ncode and MLflow output are stored.",
+          "ref": "jobs.AiRuntimeTask",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "alert_task": {
+          "description": "The task evaluates a Databricks alert and sends notifications to subscribers\nwhen the `alert_task` field is present.",
+          "ref": "jobs.AlertTask",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "clean_rooms_notebook_task": {
+          "description": "The task runs a [clean rooms](https://docs.databricks.com/clean-rooms/index.html) notebook\nwhen the `clean_rooms_notebook_task` field is present.",
+          "ref": "jobs.CleanRoomsNotebookTask",
+          "launch_stage": "GA"
+        },
+        "compute": {
+          "description": "Task level compute configuration.",
+          "ref": "jobs.Compute",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "condition_task": {
+          "description": "The task evaluates a condition that can be used to control the execution of other tasks when the `condition_task` field is present.\nThe condition task does not require a cluster to execute and does not support retries or notifications.",
+          "ref": "jobs.ConditionTask",
+          "launch_stage": "GA"
+        },
+        "dashboard_task": {
+          "description": "The task refreshes a dashboard and sends a snapshot to subscribers.",
+          "ref": "jobs.DashboardTask",
+          "launch_stage": "GA"
+        },
+        "dbt_cloud_task": {
+          "description": "Task type for dbt cloud, deprecated in favor of the new name dbt_platform_task",
+          "ref": "jobs.DbtCloudTask",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "dbt_platform_task": {
+          "ref": "jobs.DbtPlatformTask",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "dbt_task": {
+          "description": "The task runs one or more dbt commands when the `dbt_task` field is present. The dbt task requires both Databricks SQL and the ability to use a serverless or a pro SQL warehouse.",
+          "ref": "jobs.DbtTask",
+          "launch_stage": "GA"
+        },
+        "depends_on": {
+          "description": "An optional array of objects specifying the dependency graph of the task. All tasks specified in this field must complete before executing this task. The task will run only if the `run_if` condition is true.\nThe key is `task_key`, and the value is the name assigned to the dependent task.",
+          "launch_stage": "GA"
+        },
+        "description": {
+          "description": "An optional description for this task.",
+          "launch_stage": "GA"
+        },
+        "disable_auto_optimization": {
+          "description": "An option to disable auto optimization in serverless",
+          "launch_stage": "GA"
+        },
+        "disabled": {
+          "description": "An optional flag to disable the task. If set to true, the task will not run even if it is part of a job.",
+          "launch_stage": "GA"
+        },
+        "email_notifications": {
+          "description": "An optional set of email addresses that is notified when runs of this task begin or complete as well as when this task is deleted. The default behavior is to not send any emails.",
+          "ref": "jobs.TaskEmailNotifications",
+          "launch_stage": "GA"
+        },
+        "environment_key": {
+          "description": "The key that references an environment spec in a job. This field is required for Python script, Python wheel and dbt tasks when using serverless compute or a compute resource that uses Environments mode.",
+          "launch_stage": "GA"
+        },
+        "environment_variables_key": {
+          "description": "Reference to a `JobEnvironmentVariables` entry defined in\n`JobSettings.environment_variables`. The selected entry's variables are\napplied to this task at execution time. This field supports serverless\ntasks using environment version 5 or later.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "existing_cluster_id": {
+          "description": "If existing_cluster_id, the ID of an existing cluster that is used for all runs.\nWhen running jobs or tasks on an existing cluster, you may need to manually restart\nthe cluster if it stops responding. We suggest running jobs and tasks on new clusters for\ngreater reliability",
+          "launch_stage": "GA"
+        },
+        "for_each_task": {
+          "description": "The task executes a nested task for every input provided when the `for_each_task` field is present.",
+          "ref": "jobs.ForEachTask",
+          "launch_stage": "GA"
+        },
+        "gen_ai_compute_task": {
+          "ref": "jobs.GenAiComputeTask",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "health": {
+          "ref": "jobs.JobsHealthRules",
+          "launch_stage": "GA"
+        },
+        "job_cluster_key": {
+          "description": "If job_cluster_key, this task is executed reusing the cluster specified in `job.settings.job_clusters`.",
+          "launch_stage": "GA"
+        },
+        "libraries": {
+          "description": "An optional list of libraries to be installed on the cluster.\nThe default value is an empty list.",
+          "launch_stage": "GA"
+        },
+        "max_retries": {
+          "description": "An optional maximum number of times to retry an unsuccessful run. A run is considered to be unsuccessful if it completes with the `FAILED` result_state or `INTERNAL_ERROR` `life_cycle_state`. The value `-1` means to retry indefinitely and the value `0` means to never retry.",
+          "launch_stage": "GA"
+        },
+        "min_retry_interval_millis": {
+          "description": "An optional minimal interval in milliseconds between the start of the failed run and the subsequent retry run. The default behavior is that unsuccessful runs are immediately retried.",
+          "launch_stage": "GA"
+        },
+        "new_cluster": {
+          "description": "If new_cluster, a description of a new cluster that is created for each run.",
+          "ref": "compute.ClusterSpec",
+          "launch_stage": "GA"
+        },
+        "notebook_task": {
+          "description": "The task runs a notebook when the `notebook_task` field is present.",
+          "ref": "jobs.NotebookTask",
+          "launch_stage": "GA"
+        },
+        "notification_settings": {
+          "description": "Optional notification settings that are used when sending notifications to each of the `email_notifications` and `webhook_notifications` for this task.",
+          "ref": "jobs.TaskNotificationSettings",
+          "launch_stage": "GA"
+        },
+        "pipeline_task": {
+          "description": "The task triggers a pipeline update when the `pipeline_task` field is present. Only pipelines configured to use triggered more are supported.",
+          "ref": "jobs.PipelineTask",
+          "launch_stage": "GA"
+        },
+        "power_bi_task": {
+          "description": "The task triggers a Power BI semantic model update when the `power_bi_task` field is present.",
+          "ref": "jobs.PowerBiTask",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "python_operator_task": {
+          "description": "The task runs a Python operator task.",
+          "ref": "jobs.PythonOperatorTask",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "python_wheel_task": {
+          "description": "The task runs a Python wheel when the `python_wheel_task` field is present.",
+          "ref": "jobs.PythonWheelTask",
+          "launch_stage": "GA"
+        },
+        "retry_on_timeout": {
+          "description": "An optional policy to specify whether to retry a job when it times out. The default behavior\nis to not retry on timeout.",
+          "launch_stage": "GA"
+        },
+        "run_if": {
+          "description": "An optional value specifying the condition determining whether the task is run once its dependencies have been completed.\n\n* `ALL_SUCCESS`: All dependencies have executed and succeeded\n* `AT_LEAST_ONE_SUCCESS`: At least one dependency has succeeded\n* `NONE_FAILED`: None of the dependencies have failed and at least one was executed\n* `ALL_DONE`: All dependencies have been completed\n* `AT_LEAST_ONE_FAILED`: At least one dependency failed\n* `ALL_FAILED`: ALl dependencies have failed",
+          "ref": "jobs.RunIf",
+          "launch_stage": "GA"
+        },
+        "run_job_task": {
+          "description": "The task triggers another job when the `run_job_task` field is present.",
+          "ref": "jobs.RunJobTask",
+          "launch_stage": "GA"
+        },
+        "spark_jar_task": {
+          "description": "The task runs a JAR when the `spark_jar_task` field is present.",
+          "ref": "jobs.SparkJarTask",
+          "launch_stage": "GA"
+        },
+        "spark_python_task": {
+          "description": "The task runs a Python file when the `spark_python_task` field is present.",
+          "ref": "jobs.SparkPythonTask",
+          "launch_stage": "GA"
+        },
+        "spark_submit_task": {
+          "description": "(Legacy) The task runs the spark-submit script when the spark_submit_task field is present. Databricks recommends using the spark_jar_task instead; see [Spark Submit task for jobs](/jobs/spark-submit).",
+          "ref": "jobs.SparkSubmitTask",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "sql_task": {
+          "description": "The task runs a SQL query or file, or it refreshes a SQL alert or a legacy SQL dashboard when the `sql_task` field is present.",
+          "ref": "jobs.SqlTask",
+          "launch_stage": "GA"
+        },
+        "task_key": {
+          "description": "A unique name for the task. This field is used to refer to this task from other tasks.\nThis field is required and must be unique within its parent job.\nOn Update or Reset, this field is used to reference the tasks to be updated or reset.",
+          "launch_stage": "GA"
+        },
+        "timeout_seconds": {
+          "description": "An optional timeout applied to each run of this job task. A value of `0` means no timeout.",
+          "launch_stage": "GA"
+        },
+        "webhook_notifications": {
+          "description": "A collection of system notification IDs to notify when runs of this task begin or complete. The default behavior is to not send any system notifications.",
+          "ref": "jobs.WebhookNotifications",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.TaskDependency": {
+      "fields": {
+        "outcome": {
+          "description": "Can only be specified on condition task dependencies. The outcome of the dependent task that must be met for this task to run.",
+          "launch_stage": "GA"
+        },
+        "task_key": {
+          "description": "The name of the task this task depends on.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.TaskEmailNotifications": {
+      "fields": {
+        "no_alert_for_skipped_runs": {
+          "description": "If true, do not send email to recipients specified in `on_failure` if the run is skipped.\nThis field is `deprecated`. Please use the `notification_settings.no_alert_for_skipped_runs` field.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "on_duration_warning_threshold_exceeded": {
+          "description": "A list of email addresses to be notified when the duration of a run exceeds the threshold specified for the `RUN_DURATION_SECONDS` metric in the `health` field. If no rule for the `RUN_DURATION_SECONDS` metric is specified in the `health` field for the job, notifications are not sent.",
+          "launch_stage": "GA"
+        },
+        "on_failure": {
+          "description": "A list of email addresses to be notified when a run unsuccessfully completes. A run is considered to have completed unsuccessfully if it ends with an `INTERNAL_ERROR` `life_cycle_state` or a `FAILED`, or `TIMED_OUT` result_state. If this is not specified on job creation, reset, or update the list is empty, and notifications are not sent.",
+          "launch_stage": "GA"
+        },
+        "on_maintenance_complete": {
+          "description": "A list of email addresses to notify when platform-initiated maintenance completes for a continuous job.",
+          "launch_stage": "GA"
+        },
+        "on_maintenance_start": {
+          "description": "A list of email addresses to notify when platform-initiated maintenance starts for a continuous job.",
+          "launch_stage": "GA"
+        },
+        "on_start": {
+          "description": "A list of email addresses to be notified when a run begins. If not specified on job creation, reset, or update, the list is empty, and notifications are not sent.",
+          "launch_stage": "GA"
+        },
+        "on_streaming_backlog_exceeded": {
+          "description": "A list of email addresses to notify when any streaming backlog thresholds are exceeded for any stream.\nStreaming backlog thresholds can be set in the `health` field using the following metrics: `STREAMING_BACKLOG_BYTES`, `STREAMING_BACKLOG_RECORDS`, `STREAMING_BACKLOG_SECONDS`, or `STREAMING_BACKLOG_FILES`.\nAlerting is based on the 10-minute average of these metrics. If the issue persists, notifications are resent every 30 minutes.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "on_success": {
+          "description": "A list of email addresses to be notified when a run successfully completes. A run is considered to have completed successfully if it ends with a `TERMINATED` `life_cycle_state` and a `SUCCESS` result_state. If not specified on job creation, reset, or update, the list is empty, and notifications are not sent.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.TaskNotificationSettings": {
+      "fields": {
+        "alert_on_last_attempt": {
+          "description": "If true, do not send notifications to recipients specified in `on_start` for the retried runs and do not send notifications to recipients specified in `on_failure` until the last retry of the run.",
+          "launch_stage": "GA"
+        },
+        "no_alert_for_canceled_runs": {
+          "description": "If true, do not send notifications to recipients specified in `on_failure` if the run is canceled.",
+          "launch_stage": "GA"
+        },
+        "no_alert_for_skipped_runs": {
+          "description": "If true, do not send notifications to recipients specified in `on_failure` if the run is skipped.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.TaskRetryMode": {
+      "description": "task retry mode of the continuous job\n* NEVER: The failed task will not be retried.\n* ON_FAILURE: Retry a failed task if at least one other task in the job is still running its first attempt.\nWhen this condition is no longer met or the retry limit is reached, the job run is cancelled and a new run is started.",
+      "enum": [
+        "NEVER",
+        "ON_FAILURE"
+      ],
+      "enum_launch_stages": {
+        "NEVER": "GA",
+        "ON_FAILURE": "GA"
+      }
+    },
+    "jobs.TerminationCodeCode": {
+      "description": "The code indicates why the run was terminated. Additional codes might be introduced in future releases.\n* `SUCCESS`: The run was completed successfully.\n* `SUCCESS_WITH_FAILURES`: The run was completed successfully but some child runs failed.\n* `USER_CANCELED`: The run was successfully canceled during execution by a user.\n* `CANCELED`: The run was canceled during execution by the Databricks platform; for example, if the maximum run duration was exceeded.\n* `SKIPPED`: Run was never executed, for example, if the upstream task run failed, the dependency type condition was not met, or there were no material tasks to execute.\n* `INTERNAL_ERROR`: The run encountered an unexpected error. Refer to the state message for further details.\n* `DRIVER_ERROR`: The run encountered an error while communicating with the Spark Driver.\n* `CLUSTER_ERROR`: The run failed due to a cluster error. Refer to the state message for further details.\n* `REPOSITORY_CHECKOUT_FAILED`: Failed to complete the checkout due to an error when communicating with the third party service.\n* `INVALID_CLUSTER_REQUEST`: The run failed because it issued an invalid request to start the cluster.\n* `WORKSPACE_RUN_LIMIT_EXCEEDED`: The workspace has reached the quota for the maximum number of concurrent active runs. Consider scheduling the runs over a larger time frame.\n* `FEATURE_DISABLED`: The run failed because it tried to access a feature unavailable for the workspace.\n* `CLUSTER_REQUEST_LIMIT_EXCEEDED`: The number of cluster creation, start, and upsize requests have exceeded the allotted rate limit. Consider spreading the run execution over a larger time frame.\n* `STORAGE_ACCESS_ERROR`: The run failed due to an error when accessing the customer blob storage. Refer to the state message for further details.\n* `RUN_EXECUTION_ERROR`: The run was completed with task failures. For more details, refer to the state message or run output.\n* `UNAUTHORIZED_ERROR`: The run failed due to a permission issue while accessing a resource. Refer to the state message for further details.\n* `LIBRARY_INSTALLATION_ERROR`: The run failed while installing the user-requested library. Refer to the state message for further details. The causes might include, but are not limited to: The provided library is invalid, there are insufficient permissions to install the library, and so forth.\n* `MAX_CONCURRENT_RUNS_EXCEEDED`: The scheduled run exceeds the limit of maximum concurrent runs set for the job.\n* `MAX_SPARK_CONTEXTS_EXCEEDED`: The run is scheduled on a cluster that has already reached the maximum number of contexts it is configured to create. See: [Link](https://kb.databricks.com/en_US/notebooks/too-many-execution-contexts-are-open-right-now).\n* `RESOURCE_NOT_FOUND`: A resource necessary for run execution does not exist. Refer to the state message for further details.\n* `INVALID_RUN_CONFIGURATION`: The run failed due to an invalid configuration. Refer to the state message for further details.\n* `CLOUD_FAILURE`: The run failed due to a cloud provider issue. Refer to the state message for further details.\n* `MAX_JOB_QUEUE_SIZE_EXCEEDED`: The run was skipped due to reaching the job level queue size limit.\n* `DISABLED`: The run was never executed because it was disabled explicitly by the user.\n* `BREAKING_CHANGE`: Run failed because of an intentional breaking change in Spark, but it will be retried with a mitigation config.\n* `CLUSTER_TERMINATED_BY_USER`: The run failed because the externally managed cluster entered an unusable state, likely due to the user terminating or restarting it outside the jobs service.",
+      "enum": [
+        "SUCCESS",
+        "CANCELED",
+        "DRIVER_ERROR",
+        "CLUSTER_ERROR",
+        "REPOSITORY_CHECKOUT_FAILED",
+        "INVALID_CLUSTER_REQUEST",
+        "WORKSPACE_RUN_LIMIT_EXCEEDED",
+        "FEATURE_DISABLED",
+        "CLUSTER_REQUEST_LIMIT_EXCEEDED",
+        "STORAGE_ACCESS_ERROR",
+        "RUN_EXECUTION_ERROR",
+        "UNAUTHORIZED_ERROR",
+        "LIBRARY_INSTALLATION_ERROR",
+        "MAX_CONCURRENT_RUNS_EXCEEDED",
+        "MAX_SPARK_CONTEXTS_EXCEEDED",
+        "RESOURCE_NOT_FOUND",
+        "INVALID_RUN_CONFIGURATION",
+        "INTERNAL_ERROR",
+        "CLOUD_FAILURE",
+        "MAX_JOB_QUEUE_SIZE_EXCEEDED",
+        "SKIPPED",
+        "USER_CANCELED",
+        "BUDGET_POLICY_LIMIT_EXCEEDED",
+        "DISABLED",
+        "SUCCESS_WITH_FAILURES",
+        "BREAKING_CHANGE"
+      ],
+      "enum_launch_stages": {
+        "BREAKING_CHANGE": "GA",
+        "BUDGET_POLICY_LIMIT_EXCEEDED": "GA",
+        "CANCELED": "GA",
+        "CLOUD_FAILURE": "GA",
+        "CLUSTER_ERROR": "GA",
+        "CLUSTER_REQUEST_LIMIT_EXCEEDED": "GA",
+        "DISABLED": "GA",
+        "DRIVER_ERROR": "GA",
+        "FEATURE_DISABLED": "GA",
+        "INTERNAL_ERROR": "GA",
+        "INVALID_CLUSTER_REQUEST": "GA",
+        "INVALID_RUN_CONFIGURATION": "GA",
+        "LIBRARY_INSTALLATION_ERROR": "GA",
+        "MAX_CONCURRENT_RUNS_EXCEEDED": "GA",
+        "MAX_JOB_QUEUE_SIZE_EXCEEDED": "GA",
+        "MAX_SPARK_CONTEXTS_EXCEEDED": "GA",
+        "REPOSITORY_CHECKOUT_FAILED": "GA",
+        "RESOURCE_NOT_FOUND": "GA",
+        "RUN_EXECUTION_ERROR": "GA",
+        "SKIPPED": "GA",
+        "STORAGE_ACCESS_ERROR": "GA",
+        "SUCCESS": "GA",
+        "SUCCESS_WITH_FAILURES": "GA",
+        "UNAUTHORIZED_ERROR": "GA",
+        "USER_CANCELED": "GA",
+        "WORKSPACE_RUN_LIMIT_EXCEEDED": "GA"
+      },
+      "enum_descriptions": {
+        "BREAKING_CHANGE": "Run failed because of an intentional breaking change in Spark, but it will be retried with a mitigation config.",
+        "CANCELED": "The run was canceled during execution by the \u003cDatabricks\u003e platform; for example, if the maximum run duration was exceeded.",
+        "CLOUD_FAILURE": "The run failed due to a cloud provider issue. Refer to the state message for further details.",
+        "CLUSTER_ERROR": "The run failed due to a cluster error. Refer to the state message for further details.",
+        "CLUSTER_REQUEST_LIMIT_EXCEEDED": "The number of cluster creation, start, and upsize requests have exceeded the allotted rate limit. Consider spreading the run execution over a larger time frame.",
+        "DISABLED": "The run was never executed because it was disabled explicitly by the user.",
+        "DRIVER_ERROR": "The run encountered an error while communicating with the Spark Driver.",
+        "FEATURE_DISABLED": "The run failed because it tried to access a feature unavailable for the workspace.",
+        "INTERNAL_ERROR": "The run encountered an unexpected error. Refer to the state message for further details.",
+        "INVALID_CLUSTER_REQUEST": "The run failed because it issued an invalid request to start the cluster.",
+        "INVALID_RUN_CONFIGURATION": "The run failed due to an invalid configuration. Refer to the state message for further details.",
+        "LIBRARY_INSTALLATION_ERROR": "The run failed while installing the user-requested library. Refer to the state message for further details. The causes might include, but are not limited to: The provided library is invalid, there are insufficient permissions to install the library, and so forth.",
+        "MAX_CONCURRENT_RUNS_EXCEEDED": "The scheduled run exceeds the limit of maximum concurrent runs set for the job.",
+        "MAX_JOB_QUEUE_SIZE_EXCEEDED": "The run was skipped due to reaching the job level queue size limit.",
+        "MAX_SPARK_CONTEXTS_EXCEEDED": "The run is scheduled on a cluster that has already reached the maximum number of contexts it is configured to create. See: [Link](https://kb.databricks.com/en_US/notebooks/too-many-execution-contexts-are-open-right-now).",
+        "REPOSITORY_CHECKOUT_FAILED": "Failed to complete the checkout due to an error when communicating with the third party service.",
+        "RESOURCE_NOT_FOUND": "A resource necessary for run execution does not exist. Refer to the state message for further details.",
+        "RUN_EXECUTION_ERROR": "The run was completed with task failures. For more details, refer to the state message or run output.",
+        "SKIPPED": "Run was never executed, for example, if the upstream task run failed, the dependency type condition was not met, or there were no material tasks to execute.",
+        "STORAGE_ACCESS_ERROR": "The run failed due to an error when accessing the customer blob storage. Refer to the state message for further details.",
+        "SUCCESS": "The run was completed successfully.",
+        "SUCCESS_WITH_FAILURES": "The run was completed successfully but some child runs failed.",
+        "UNAUTHORIZED_ERROR": "The run failed due to a permission issue while accessing a resource. Refer to the state message for further details.",
+        "USER_CANCELED": "The run was successfully canceled during execution by a user.",
+        "WORKSPACE_RUN_LIMIT_EXCEEDED": "The workspace has reached the quota for the maximum number of concurrent active runs. Consider scheduling the runs over a larger time frame."
+      }
+    },
+    "jobs.TerminationDetails": {
+      "fields": {
+        "code": {
+          "ref": "jobs.TerminationCodeCode",
+          "launch_stage": "GA"
+        },
+        "message": {
+          "description": "A descriptive message with the termination details. This field is unstructured and the format might change.",
+          "launch_stage": "GA"
+        },
+        "type": {
+          "ref": "jobs.TerminationTypeType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.TerminationTypeType": {
+      "description": "* `SUCCESS`: The run terminated without any issues\n* `INTERNAL_ERROR`: An error occurred in the Databricks platform. Please look at the [status page](https://status.databricks.com/) or contact support if the issue persists.\n* `CLIENT_ERROR`: The run was terminated because of an error caused by user input or the job configuration.\n* `CLOUD_FAILURE`: The run was terminated because of an issue with your cloud provider.",
+      "enum": [
+        "SUCCESS",
+        "INTERNAL_ERROR",
+        "CLIENT_ERROR",
+        "CLOUD_FAILURE"
+      ],
+      "enum_launch_stages": {
+        "CLIENT_ERROR": "GA",
+        "CLOUD_FAILURE": "GA",
+        "INTERNAL_ERROR": "GA",
+        "SUCCESS": "GA"
+      },
+      "enum_descriptions": {
+        "CLIENT_ERROR": "The run was terminated because of an error caused by user input or the job configuration.",
+        "CLOUD_FAILURE": "The run was terminated because of an issue with your cloud provider.",
+        "INTERNAL_ERROR": "An error occurred in the \u003cDatabricks\u003e platform. Please look at the [status page](https://status.databricks.com/) or contact support if the issue persists.",
+        "SUCCESS": "The run terminated without any issues"
+      }
+    },
+    "jobs.TriggerConfiguration": {
+      "description": "A single trigger attached to a job via `JobSettings.triggers`. Exactly one of the trigger-type fields\n(`periodic`, `schedule`, `continuous`, `file_arrival`, `table_update`, `model`, `job_completion`) must be set;\nmutual exclusivity is enforced in the API handler rather than via `oneof` so that codegen, validation, and JSON\nserialization across SDKs and Terraform behave consistently.",
+      "fields": {
+        "continuous": {
+          "description": "Continuous trigger configuration.",
+          "ref": "jobs.ContinuousTriggerConfiguration",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "file_arrival": {
+          "description": "File arrival trigger configuration.",
+          "ref": "jobs.FileArrivalTriggerConfiguration",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "model": {
+          "description": "Model trigger configuration.",
+          "ref": "jobs.ModelTriggerConfiguration",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "pause_status": {
+          "description": "Whether this trigger is paused. Defaults to UNPAUSED when unset; the server always returns an explicit value on read.",
+          "ref": "jobs.PauseStatus",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "periodic": {
+          "description": "Trigger type: exactly one must be set; mutual exclusivity is enforced in the API handler\nPeriodic trigger configuration.",
+          "ref": "jobs.PeriodicTriggerConfiguration",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "schedule": {
+          "description": "Cron schedule trigger configuration.",
+          "ref": "jobs.CronTriggerConfiguration",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "sql_condition": {
+          "description": "Optional SQL condition that gates whether this trigger fires.",
+          "ref": "jobs.SqlConditionConfiguration",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "table_update": {
+          "description": "Table update trigger configuration.",
+          "ref": "jobs.TableUpdateTriggerConfiguration",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "jobs.TriggerDetails": {
+      "description": "Per-trigger runtime details returned by `GetJob`. Same length and order as\n`JobSettings.triggers`; sub-fields are populated independently based on the\ncorresponding `GetJob.include_trigger_state` / `include_trigger_history` flags.",
+      "fields": {
+        "history": {
+          "description": "Recent evaluation history. Populated when `GetJob.include_trigger_history` is set.",
+          "ref": "jobs.TriggerHistory",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "state": {
+          "description": "Current runtime state. Populated when `GetJob.include_trigger_state` is set.",
+          "ref": "jobs.PerTriggerState",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "jobs.TriggerEvaluation": {
+      "fields": {
+        "description": {
+          "description": "Human-readable description of the trigger evaluation result. Explains why the trigger evaluation triggered or did not trigger a run, or failed.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "run_id": {
+          "description": "The ID of the run that was triggered by the trigger evaluation. Only returned if a run was triggered.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "timestamp": {
+          "description": "Timestamp at which the trigger was evaluated.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "jobs.TriggerHistory": {
+      "fields": {
+        "last_failed": {
+          "description": "The last time the trigger failed to evaluate.",
+          "ref": "jobs.TriggerEvaluation",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "last_not_triggered": {
+          "description": "The last time the trigger was evaluated but did not trigger a run.",
+          "ref": "jobs.TriggerEvaluation",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "last_triggered": {
+          "description": "The last time the run was triggered due to a file arrival.",
+          "ref": "jobs.TriggerEvaluation",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "jobs.TriggerInfo": {
+      "description": "Additional details about what triggered the run",
+      "fields": {
+        "run_id": {
+          "description": "The run id of the Run Job task run",
+          "launch_stage": "GA"
+        },
+        "sql_condition": {
+          "description": "SQL condition evaluation details for this run",
+          "ref": "jobs.SqlConditionRunInfoDetails",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "jobs.TriggerSettings": {
+      "fields": {
+        "file_arrival": {
+          "description": "File arrival trigger settings.",
+          "ref": "jobs.FileArrivalTriggerConfiguration",
+          "launch_stage": "GA"
+        },
+        "model": {
+          "ref": "jobs.ModelTriggerConfiguration",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "pause_status": {
+          "description": "Whether this trigger is paused or not.",
+          "ref": "jobs.PauseStatus",
+          "launch_stage": "GA"
+        },
+        "periodic": {
+          "description": "Periodic trigger settings.",
+          "ref": "jobs.PeriodicTriggerConfiguration",
+          "launch_stage": "GA"
+        },
+        "sql_condition": {
+          "description": "SQL condition that must be satisfied for the trigger to fire. Can be used in combination with other trigger types and\nruns *after* other trigger types conditions are evaluated.",
+          "ref": "jobs.SqlConditionConfiguration",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "table_update": {
+          "ref": "jobs.TableUpdateTriggerConfiguration",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.TriggerStateProto": {
+      "fields": {
+        "file_arrival": {
+          "ref": "jobs.FileArrivalTriggerState",
+          "launch_stage": "GA"
+        },
+        "pause_status": {
+          "description": "Whether this trigger is paused or not. For continuous schedules, it can differ from the\nconfigured pause_status whenever a paused continuous job is kickstarted by an operation\nother than an update, such as a run-now.",
+          "ref": "jobs.PauseStatus",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "sql_condition": {
+          "description": "State for SQL condition evaluation, can coexist with other trigger states.",
+          "ref": "jobs.SqlConditionState",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "table": {
+          "ref": "jobs.TableTriggerState",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.TriggerType": {
+      "description": "The type of trigger that fired this run.\n\n* `PERIODIC`: Schedules that periodically trigger runs, such as a cron scheduler.\n* `ONE_TIME`: One time triggers that fire a single run. This occurs you triggered a single run on demand through the UI or the API.\n* `RETRY`: Indicates a run that is triggered as a retry of a previously failed run. This occurs when you request to re-run the job in case of failures.\n* `RUN_JOB_TASK`: Indicates a run that is triggered using a Run Job task.\n* `FILE_ARRIVAL`: Indicates a run that is triggered by a file arrival.\n* `CONTINUOUS`: Indicates a run that is triggered by a continuous job.\n* `TABLE`: Indicates a run that is triggered by a table update.\n* `CONTINUOUS_RESTART`: Indicates a run created by user to manually restart a continuous job run.\n* `MODEL`: Indicates a run that is triggered by a model update.\n* `JOB_COMPLETION`: Indicates a run that is triggered by an upstream job completion.",
+      "enum": [
+        "PERIODIC",
+        "ONE_TIME",
+        "RETRY",
+        "RUN_JOB_TASK",
+        "FILE_ARRIVAL",
+        "CONTINUOUS",
+        "TABLE",
+        "CONTINUOUS_RESTART"
+      ],
+      "enum_launch_stages": {
+        "CONTINUOUS": "GA",
+        "CONTINUOUS_RESTART": "GA",
+        "FILE_ARRIVAL": "GA",
+        "ONE_TIME": "GA",
+        "PERIODIC": "GA",
+        "RETRY": "GA",
+        "RUN_JOB_TASK": "GA",
+        "TABLE": "GA"
+      },
+      "enum_descriptions": {
+        "CONTINUOUS": "Indicates a run that is triggered by a continuous job.",
+        "CONTINUOUS_RESTART": "Indicates a run created by user to manually restart a continuous job run.",
+        "FILE_ARRIVAL": "Indicates a run that is triggered by a file arrival.",
+        "ONE_TIME": "One time triggers that fire a single run. This occurs you triggered a single run on demand through the UI or the API.",
+        "PERIODIC": "Schedules that periodically trigger runs, such as a cron scheduler.",
+        "RETRY": "Indicates a run that is triggered as a retry of a previously failed run. This occurs when you request to re-run the job in case of failures.",
+        "RUN_JOB_TASK": "Indicates a run that is triggered using a Run Job task.",
+        "TABLE": "Indicates a run that is triggered by a table update."
+      }
+    },
+    "jobs.UpdateJob": {
+      "fields": {
+        "fields_to_remove": {
+          "description": "Remove top-level fields in the job settings. Removing nested fields is not supported, except for tasks and job clusters (`tasks/task_1`). This field is optional.",
+          "launch_stage": "GA"
+        },
+        "job_id": {
+          "description": "The canonical identifier of the job to update. This field is required.",
+          "launch_stage": "GA"
+        },
+        "new_settings": {
+          "description": "The new settings for the job.\n\nTop-level fields specified in `new_settings` are completely replaced, except for arrays which are merged. That is, new and existing entries are completely replaced based on the respective key fields, i.e. `task_key` or `job_cluster_key`, while previous entries are kept.\n\nPartially updating nested fields is not supported.\n\nChanges to the field `JobSettings.timeout_seconds` are applied to active runs. Changes to other fields are applied to future runs only.",
+          "ref": "jobs.JobSettings",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.ViewItem": {
+      "fields": {
+        "content": {
+          "description": "Content of the view.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of the view item. In the case of code view, it would be the notebook’s name. In the case of dashboard view, it would be the dashboard’s name.",
+          "launch_stage": "GA"
+        },
+        "type": {
+          "description": "Type of the view item.",
+          "ref": "jobs.ViewType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.ViewType": {
+      "description": "* `NOTEBOOK`: Notebook view item.\n* `DASHBOARD`: Dashboard view item.",
+      "enum": [
+        "NOTEBOOK",
+        "DASHBOARD"
+      ],
+      "enum_launch_stages": {
+        "DASHBOARD": "GA",
+        "NOTEBOOK": "GA"
+      },
+      "enum_descriptions": {
+        "DASHBOARD": "Dashboard view item.",
+        "NOTEBOOK": "Notebook view item."
+      }
+    },
+    "jobs.ViewsToExport": {
+      "description": "* `CODE`: Code view of the notebook.\n* `DASHBOARDS`: All dashboard views of the notebook.\n* `ALL`: All views of the notebook.",
+      "enum": [
+        "CODE",
+        "DASHBOARDS",
+        "ALL"
+      ],
+      "enum_launch_stages": {
+        "ALL": "GA",
+        "CODE": "GA",
+        "DASHBOARDS": "GA"
+      },
+      "enum_descriptions": {
+        "ALL": "All views of the notebook.",
+        "CODE": "Code view of the notebook.",
+        "DASHBOARDS": "All dashboard views of the notebook."
+      }
+    },
+    "jobs.Webhook": {
+      "fields": {
+        "id": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.WebhookNotifications": {
+      "fields": {
+        "on_duration_warning_threshold_exceeded": {
+          "description": "An optional list of system notification IDs to call when the duration of a run exceeds the threshold specified for the `RUN_DURATION_SECONDS` metric in the `health` field. A maximum of 3 destinations can be specified for the `on_duration_warning_threshold_exceeded` property.",
+          "launch_stage": "GA"
+        },
+        "on_failure": {
+          "description": "An optional list of system notification IDs to call when the run fails. A maximum of 3 destinations can be specified for the `on_failure` property.",
+          "launch_stage": "GA"
+        },
+        "on_maintenance_complete": {
+          "description": "An optional list of system notification IDs to call when platform-initiated maintenance completes for a continuous job.\nA maximum of 3 destinations can be specified for the `on_maintenance_complete` property.",
+          "launch_stage": "GA"
+        },
+        "on_maintenance_start": {
+          "description": "An optional list of system notification IDs to call when platform-initiated maintenance starts for a continuous job.\nA maximum of 3 destinations can be specified for the `on_maintenance_start` property.",
+          "launch_stage": "GA"
+        },
+        "on_start": {
+          "description": "An optional list of system notification IDs to call when the run starts. A maximum of 3 destinations can be specified for the `on_start` property.",
+          "launch_stage": "GA"
+        },
+        "on_streaming_backlog_exceeded": {
+          "description": "An optional list of system notification IDs to call when any streaming backlog thresholds are exceeded for any stream.\nStreaming backlog thresholds can be set in the `health` field using the following metrics: `STREAMING_BACKLOG_BYTES`, `STREAMING_BACKLOG_RECORDS`, `STREAMING_BACKLOG_SECONDS`, or `STREAMING_BACKLOG_FILES`.\nAlerting is based on the 10-minute average of these metrics. If the issue persists, notifications are resent every 30 minutes.\nA maximum of 3 destinations can be specified for the `on_streaming_backlog_exceeded` property.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "on_success": {
+          "description": "An optional list of system notification IDs to call when the run completes successfully. A maximum of 3 destinations can be specified for the `on_success` property.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "jobs.WidgetErrorDetail": {
+      "fields": {
+        "message": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "knowledgeassistants.CreateExampleRequest": {
+      "fields": {
+        "example": {
+          "description": "The example to create under the parent Knowledge Assistant.",
+          "ref": "knowledgeassistants.Example",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "knowledgeassistants.CreateKnowledgeAssistantRequest": {
+      "fields": {
+        "knowledge_assistant": {
+          "description": "The Knowledge Assistant to create.",
+          "ref": "knowledgeassistants.KnowledgeAssistant",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "knowledgeassistants.CreateKnowledgeSourceRequest": {
+      "fields": {
+        "knowledge_source": {
+          "ref": "knowledgeassistants.KnowledgeSource",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "knowledgeassistants.DeleteExampleRequest": {},
+    "knowledgeassistants.DeleteKnowledgeAssistantRequest": {},
+    "knowledgeassistants.DeleteKnowledgeSourceRequest": {},
+    "knowledgeassistants.Example": {
+      "description": "An example associated with a Knowledge Assistant.\nContains a question and guidelines for how the assistant should respond.",
+      "fields": {
+        "create_time": {
+          "description": "Timestamp when this example was created.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "example_id": {
+          "description": "The universally unique identifier (UUID) of the example.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "guidelines": {
+          "description": "Guidelines for answering the question. Optional — examples may be created\nwith just a question; the front-end form does not require guidelines.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "name": {
+          "description": "Full resource name:\nknowledge-assistants/{knowledge_assistant_id}/examples/{example_id}",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "question": {
+          "description": "The example question.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "update_time": {
+          "description": "Timestamp when this example was last updated.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "knowledgeassistants.FileTableSpec": {
+      "description": "FileTableSpec specifies a file table source configuration.",
+      "fields": {
+        "file_col": {
+          "description": "The name of the column containing BINARY file content to be indexed.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "table_name": {
+          "description": "Full UC name of the table, in the format of {CATALOG}.{SCHEMA}.{TABLE_NAME}.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "knowledgeassistants.FilesSpec": {
+      "description": "FilesSpec specifies a files source configuration.",
+      "fields": {
+        "path": {
+          "description": "A UC volume path that includes a list of files.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "knowledgeassistants.GetExampleRequest": {},
+    "knowledgeassistants.GetKnowledgeAssistantPermissionLevelsRequest": {},
+    "knowledgeassistants.GetKnowledgeAssistantPermissionLevelsResponse": {
+      "fields": {
+        "permission_levels": {
+          "description": "Specific permission levels",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "knowledgeassistants.GetKnowledgeAssistantPermissionsRequest": {},
+    "knowledgeassistants.GetKnowledgeAssistantRequest": {},
+    "knowledgeassistants.GetKnowledgeSourceRequest": {},
+    "knowledgeassistants.IndexSpec": {
+      "description": "IndexSpec specifies a vector search index source configuration.",
+      "fields": {
+        "doc_uri_col": {
+          "description": "The column that specifies a link or reference to where the information came from.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "index_name": {
+          "description": "Full UC name of the vector search index, in the format of {CATALOG}.{SCHEMA}.{INDEX_NAME}.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "text_col": {
+          "description": "The column that includes the document text for retrieval.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "knowledgeassistants.KnowledgeAssistant": {
+      "description": "Entity message that represents a knowledge assistant.\nNote: REQUIRED annotations below represent create-time requirements.\nFor updates, required fields are determined by the update mask.",
+      "fields": {
+        "create_time": {
+          "description": "Creation timestamp.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "creator": {
+          "description": "The creator of the Knowledge Assistant.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "description": {
+          "description": "Description of what this agent can do (user-facing).\nRequired when creating a Knowledge Assistant.\nWhen updating a Knowledge Assistant, optional unless included in\nupdate_mask.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "display_name": {
+          "description": "The display name of the Knowledge Assistant, unique at workspace level.\nRequired when creating a Knowledge Assistant.\nWhen updating a Knowledge Assistant, optional unless included in\nupdate_mask.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "endpoint_name": {
+          "description": "The name of the knowledge assistant agent endpoint.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "error_info": {
+          "description": "Error details when the Knowledge Assistant is in FAILED state.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "experiment_id": {
+          "description": "The MLflow experiment ID.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "id": {
+          "description": "Deprecated: use knowledge_assistant_id instead.",
+          "deprecated": true,
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "instructions": {
+          "description": "Additional global instructions on how the agent should generate answers.\nOptional on create and update.\nWhen updating a Knowledge Assistant, include this field in update_mask to\nmodify it.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "name": {
+          "description": "The resource name of the Knowledge Assistant.\nFormat: knowledge-assistants/{knowledge_assistant_id}",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "state": {
+          "description": "State of the Knowledge Assistant. Not returned in List responses.",
+          "ref": "knowledgeassistants.KnowledgeAssistantState",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "knowledgeassistants.KnowledgeAssistantAccessControlRequest": {
+      "fields": {
+        "group_name": {
+          "description": "name of the group",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "permission_level": {
+          "ref": "knowledgeassistants.KnowledgeAssistantPermissionLevel",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "service_principal_name": {
+          "description": "application ID of a service principal",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "user_name": {
+          "description": "name of the user",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "knowledgeassistants.KnowledgeAssistantAccessControlResponse": {
+      "fields": {
+        "all_permissions": {
+          "description": "All permissions.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "display_name": {
+          "description": "Display name of the user or service principal.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "group_name": {
+          "description": "name of the group",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "service_principal_name": {
+          "description": "Name of the service principal.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "user_name": {
+          "description": "name of the user",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "knowledgeassistants.KnowledgeAssistantPermission": {
+      "fields": {
+        "inherited": {
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "inherited_from_object": {
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "permission_level": {
+          "ref": "knowledgeassistants.KnowledgeAssistantPermissionLevel",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "knowledgeassistants.KnowledgeAssistantPermissionLevel": {
+      "description": "Permission level",
+      "enum": [
+        "CAN_MANAGE",
+        "CAN_QUERY"
+      ]
+    },
+    "knowledgeassistants.KnowledgeAssistantPermissions": {
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "object_id": {
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "object_type": {
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "knowledgeassistants.KnowledgeAssistantPermissionsDescription": {
+      "fields": {
+        "description": {
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "permission_level": {
+          "ref": "knowledgeassistants.KnowledgeAssistantPermissionLevel",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "knowledgeassistants.KnowledgeAssistantPermissionsRequest": {
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "knowledgeassistants.KnowledgeAssistantState": {
+      "enum": [
+        "CREATING",
+        "ACTIVE",
+        "FAILED"
+      ],
+      "enum_launch_stages": {
+        "ACTIVE": "PUBLIC_BETA",
+        "CREATING": "PUBLIC_BETA",
+        "FAILED": "PUBLIC_BETA"
+      }
+    },
+    "knowledgeassistants.KnowledgeSource": {
+      "description": "KnowledgeSource represents a source of knowledge for the KnowledgeAssistant.\nUsed in create/update requests and returned in Get/List responses.\nNote: REQUIRED annotations below represent create-time requirements.\nFor updates, required fields are determined by the update mask.",
+      "fields": {
+        "create_time": {
+          "description": "Timestamp when this knowledge source was created.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "description": {
+          "description": "Description of the knowledge source.\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, optional unless included in update_mask.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "display_name": {
+          "description": "Human-readable display name of the knowledge source.\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, optional unless included in update_mask.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "file_table": {
+          "ref": "knowledgeassistants.FileTableSpec",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "files": {
+          "ref": "knowledgeassistants.FilesSpec",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "id": {
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "index": {
+          "ref": "knowledgeassistants.IndexSpec",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "knowledge_cutoff_time": {
+          "description": "Timestamp representing the cutoff before which content in this knowledge source is being ingested.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "Full resource name:\nknowledge-assistants/{knowledge_assistant_id}/knowledge-sources/{knowledge_source_id}",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "source_type": {
+          "description": "The type of the source: \"index\", \"files\", or \"file_table\".\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, this field is ignored.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "state": {
+          "ref": "knowledgeassistants.KnowledgeSourceState",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "knowledgeassistants.KnowledgeSourceState": {
+      "enum": [
+        "UPDATING",
+        "UPDATED",
+        "FAILED_UPDATE"
+      ],
+      "enum_launch_stages": {
+        "FAILED_UPDATE": "PUBLIC_BETA",
+        "UPDATED": "PUBLIC_BETA",
+        "UPDATING": "PUBLIC_BETA"
+      }
+    },
+    "knowledgeassistants.ListExamplesRequest": {
+      "fields": {
+        "page_size": {
+          "description": "The maximum number of examples to return.\nIf unspecified, at most 100 examples will be returned.\nThe maximum value is 100; values above 100 will be coerced to 100.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "A page token, received from a previous `ListExamples` call.\nProvide this to retrieve the subsequent page.\nIf unspecified, the first page will be returned.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "knowledgeassistants.ListExamplesResponse": {
+      "description": "A list of Knowledge Assistant examples.",
+      "fields": {
+        "examples": {
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "next_page_token": {
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "knowledgeassistants.ListKnowledgeAssistantsRequest": {
+      "fields": {
+        "page_size": {
+          "description": "The maximum number of knowledge assistants to return.\nIf unspecified, at most 100 knowledge assistants will be returned.\nThe maximum value is 100; values above 100 will be coerced to 100.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "A page token, received from a previous `ListKnowledgeAssistants` call.\nProvide this to retrieve the subsequent page.\nIf unspecified, the first page will be returned.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "knowledgeassistants.ListKnowledgeAssistantsResponse": {
+      "description": "A list of Knowledge Assistants.",
+      "fields": {
+        "knowledge_assistants": {
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "next_page_token": {
+          "description": "A token that can be sent as `page_token` to retrieve the next page.\nIf this field is omitted, there are no subsequent pages.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "knowledgeassistants.ListKnowledgeSourcesRequest": {
+      "fields": {
+        "page_size": {
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "knowledgeassistants.ListKnowledgeSourcesResponse": {
+      "fields": {
+        "knowledge_sources": {
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "next_page_token": {
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "knowledgeassistants.SyncKnowledgeSourcesRequest": {},
+    "knowledgeassistants.UpdateExampleRequest": {
+      "fields": {
+        "example": {
+          "ref": "knowledgeassistants.Example",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "update_mask": {
+          "description": "Comma-delimited list of fields to update on the example.\nAllowed values: `question`, `guidelines`.\nExamples:\n- `question`\n- `question,guidelines`",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "knowledgeassistants.UpdateKnowledgeAssistantRequest": {
+      "fields": {
+        "knowledge_assistant": {
+          "description": "The Knowledge Assistant update payload.\nOnly fields listed in update_mask are updated.\nREQUIRED annotations on Knowledge Assistant fields describe create-time\nrequirements and do not mean all those fields are required for update.",
+          "ref": "knowledgeassistants.KnowledgeAssistant",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "update_mask": {
+          "description": "Comma-delimited list of fields to update on the Knowledge Assistant.\nAllowed values: `display_name`, `description`, `instructions`.\nExamples:\n- `display_name`\n- `description,instructions`",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "knowledgeassistants.UpdateKnowledgeSourceRequest": {
+      "fields": {
+        "knowledge_source": {
+          "description": "The Knowledge Source update payload.\nOnly fields listed in update_mask are updated.\nREQUIRED annotations on Knowledge Source fields describe create-time\nrequirements and do not mean all those fields are required for update.",
+          "ref": "knowledgeassistants.KnowledgeSource",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "update_mask": {
+          "description": "Comma-delimited list of fields to update on the Knowledge Source.\nAllowed values: `display_name`, `description`.\nExamples:\n- `display_name`\n- `display_name,description`",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "marketplace.AddExchangeForListingRequest": {
+      "fields": {
+        "exchange_id": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "listing_id": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.AddExchangeForListingResponse": {
+      "fields": {
+        "exchange_for_listing": {
+          "ref": "marketplace.ExchangeListing",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.AssetType": {
+      "enum": [
+        "ASSET_TYPE_GIT_REPO",
+        "ASSET_TYPE_DATA_TABLE",
+        "ASSET_TYPE_MODEL",
+        "ASSET_TYPE_NOTEBOOK",
+        "ASSET_TYPE_MEDIA",
+        "ASSET_TYPE_PARTNER_INTEGRATION",
+        "ASSET_TYPE_APP",
+        "ASSET_TYPE_MCP"
+      ],
+      "enum_launch_stages": {
+        "ASSET_TYPE_APP": "GA",
+        "ASSET_TYPE_DATA_TABLE": "GA",
+        "ASSET_TYPE_GIT_REPO": "GA",
+        "ASSET_TYPE_MCP": "GA",
+        "ASSET_TYPE_MEDIA": "GA",
+        "ASSET_TYPE_MODEL": "GA",
+        "ASSET_TYPE_NOTEBOOK": "GA",
+        "ASSET_TYPE_PARTNER_INTEGRATION": "GA"
+      }
+    },
+    "marketplace.BatchGetListingsRequest": {
+      "fields": {
+        "ids": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.BatchGetListingsResponse": {
+      "fields": {
+        "listings": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.BatchGetProvidersRequest": {
+      "fields": {
+        "ids": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.BatchGetProvidersResponse": {
+      "fields": {
+        "providers": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.Category": {
+      "enum": [
+        "ADVERTISING_AND_MARKETING",
+        "CLIMATE_AND_ENVIRONMENT",
+        "COMMERCE",
+        "DEMOGRAPHICS",
+        "ECONOMICS",
+        "EDUCATION",
+        "ENERGY",
+        "FINANCIAL",
+        "GAMING",
+        "GEOSPATIAL",
+        "HEALTH",
+        "LOOKUP_TABLES",
+        "MANUFACTURING",
+        "MEDIA",
+        "OTHER",
+        "PUBLIC_SECTOR",
+        "RETAIL",
+        "SECURITY",
+        "SCIENCE_AND_RESEARCH",
+        "SPORTS",
+        "TRANSPORTATION_AND_LOGISTICS",
+        "TRAVEL_AND_TOURISM"
+      ],
+      "enum_launch_stages": {
+        "ADVERTISING_AND_MARKETING": "GA",
+        "CLIMATE_AND_ENVIRONMENT": "GA",
+        "COMMERCE": "GA",
+        "DEMOGRAPHICS": "GA",
+        "ECONOMICS": "GA",
+        "EDUCATION": "GA",
+        "ENERGY": "GA",
+        "FINANCIAL": "GA",
+        "GAMING": "GA",
+        "GEOSPATIAL": "GA",
+        "HEALTH": "GA",
+        "LOOKUP_TABLES": "GA",
+        "MANUFACTURING": "GA",
+        "MEDIA": "GA",
+        "OTHER": "GA",
+        "PUBLIC_SECTOR": "GA",
+        "RETAIL": "GA",
+        "SCIENCE_AND_RESEARCH": "GA",
+        "SECURITY": "GA",
+        "SPORTS": "GA",
+        "TRANSPORTATION_AND_LOGISTICS": "GA",
+        "TRAVEL_AND_TOURISM": "GA"
+      }
+    },
+    "marketplace.ConsumerTerms": {
+      "fields": {
+        "version": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.ContactInfo": {
+      "description": "contact info for the consumer requesting data or performing a listing installation",
+      "fields": {
+        "company": {
+          "launch_stage": "GA"
+        },
+        "email": {
+          "launch_stage": "GA"
+        },
+        "first_name": {
+          "launch_stage": "GA"
+        },
+        "last_name": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.Cost": {
+      "enum": [
+        "FREE",
+        "PAID"
+      ],
+      "enum_launch_stages": {
+        "FREE": "GA",
+        "PAID": "GA"
+      }
+    },
+    "marketplace.CreateExchangeFilterRequest": {
+      "fields": {
+        "filter": {
+          "ref": "marketplace.ExchangeFilter",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.CreateExchangeFilterResponse": {
+      "fields": {
+        "filter_id": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.CreateExchangeRequest": {
+      "fields": {
+        "exchange": {
+          "ref": "marketplace.Exchange",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.CreateExchangeResponse": {
+      "fields": {
+        "exchange_id": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.CreateFileRequest": {
+      "fields": {
+        "display_name": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "file_parent": {
+          "ref": "marketplace.FileParent",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "marketplace_file_type": {
+          "ref": "marketplace.MarketplaceFileType",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "mime_type": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.CreateFileResponse": {
+      "fields": {
+        "file_info": {
+          "ref": "marketplace.FileInfo",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "upload_url": {
+          "description": "Pre-signed POST URL to blob storage",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.CreateInstallationRequest": {
+      "fields": {
+        "accepted_consumer_terms": {
+          "ref": "marketplace.ConsumerTerms",
+          "launch_stage": "GA"
+        },
+        "catalog_name": {
+          "launch_stage": "GA"
+        },
+        "recipient_type": {
+          "ref": "marketplace.DeltaSharingRecipientType",
+          "launch_stage": "GA"
+        },
+        "repo_detail": {
+          "description": "for git repo installations",
+          "ref": "marketplace.RepoInstallation",
+          "launch_stage": "GA"
+        },
+        "share_name": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.CreateListingRequest": {
+      "fields": {
+        "listing": {
+          "ref": "marketplace.Listing",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.CreateListingResponse": {
+      "fields": {
+        "listing_id": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.CreatePersonalizationRequest": {
+      "description": "Data request messages\nalso creates a lead (maybe)",
+      "fields": {
+        "accepted_consumer_terms": {
+          "ref": "marketplace.ConsumerTerms",
+          "launch_stage": "GA"
+        },
+        "comment": {
+          "launch_stage": "GA"
+        },
+        "company": {
+          "launch_stage": "GA"
+        },
+        "first_name": {
+          "launch_stage": "GA"
+        },
+        "intended_use": {
+          "launch_stage": "GA"
+        },
+        "is_from_lighthouse": {
+          "launch_stage": "GA"
+        },
+        "last_name": {
+          "launch_stage": "GA"
+        },
+        "recipient_type": {
+          "ref": "marketplace.DeltaSharingRecipientType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.CreatePersonalizationRequestResponse": {
+      "fields": {
+        "id": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.CreateProviderAnalyticsDashboardRequest": {},
+    "marketplace.CreateProviderRequest": {
+      "fields": {
+        "provider": {
+          "ref": "marketplace.ProviderInfo",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.CreateProviderResponse": {
+      "fields": {
+        "id": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.DataRefresh": {
+      "enum": [
+        "NONE",
+        "SECOND",
+        "MINUTE",
+        "HOURLY",
+        "DAILY",
+        "WEEKLY",
+        "MONTHLY",
+        "QUARTERLY",
+        "YEARLY"
+      ],
+      "enum_launch_stages": {
+        "DAILY": "GA",
+        "HOURLY": "GA",
+        "MINUTE": "GA",
+        "MONTHLY": "GA",
+        "NONE": "GA",
+        "QUARTERLY": "GA",
+        "SECOND": "GA",
+        "WEEKLY": "GA",
+        "YEARLY": "GA"
+      }
+    },
+    "marketplace.DataRefreshInfo": {
+      "fields": {
+        "interval": {
+          "launch_stage": "GA"
+        },
+        "unit": {
+          "ref": "marketplace.DataRefresh",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.DeleteExchangeFilterRequest": {},
+    "marketplace.DeleteExchangeFilterResponse": {},
+    "marketplace.DeleteExchangeRequest": {},
+    "marketplace.DeleteExchangeResponse": {},
+    "marketplace.DeleteFileRequest": {},
+    "marketplace.DeleteFileResponse": {},
+    "marketplace.DeleteInstallationRequest": {},
+    "marketplace.DeleteInstallationResponse": {},
+    "marketplace.DeleteListingRequest": {},
+    "marketplace.DeleteListingResponse": {},
+    "marketplace.DeleteProviderRequest": {},
+    "marketplace.DeleteProviderResponse": {},
+    "marketplace.DeltaSharingRecipientType": {
+      "enum": [
+        "DELTA_SHARING_RECIPIENT_TYPE_DATABRICKS",
+        "DELTA_SHARING_RECIPIENT_TYPE_OPEN"
+      ],
+      "enum_launch_stages": {
+        "DELTA_SHARING_RECIPIENT_TYPE_DATABRICKS": "GA",
+        "DELTA_SHARING_RECIPIENT_TYPE_OPEN": "GA"
+      }
+    },
+    "marketplace.Exchange": {
+      "fields": {
+        "comment": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "created_at": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "created_by": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "filters": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "id": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "linked_listings": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "name": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "updated_at": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "updated_by": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.ExchangeFilter": {
+      "fields": {
+        "created_at": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "created_by": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "exchange_id": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "filter_type": {
+          "ref": "marketplace.ExchangeFilterType",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "filter_value": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "id": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "name": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "updated_at": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "updated_by": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.ExchangeFilterType": {
+      "enum": [
+        "GLOBAL_METASTORE_ID"
+      ],
+      "enum_launch_stages": {
+        "GLOBAL_METASTORE_ID": "PUBLIC_PREVIEW"
+      }
+    },
+    "marketplace.ExchangeListing": {
+      "fields": {
+        "created_at": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "created_by": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "exchange_id": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "exchange_name": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "id": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "listing_id": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "listing_name": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.FileInfo": {
+      "fields": {
+        "created_at": {
+          "launch_stage": "GA"
+        },
+        "display_name": {
+          "description": "Name displayed to users for applicable files, e.g. embedded notebooks",
+          "launch_stage": "GA"
+        },
+        "download_link": {
+          "launch_stage": "GA"
+        },
+        "file_parent": {
+          "ref": "marketplace.FileParent",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "launch_stage": "GA"
+        },
+        "marketplace_file_type": {
+          "ref": "marketplace.MarketplaceFileType",
+          "launch_stage": "GA"
+        },
+        "mime_type": {
+          "launch_stage": "GA"
+        },
+        "status": {
+          "ref": "marketplace.FileStatus",
+          "launch_stage": "GA"
+        },
+        "status_message": {
+          "description": "Populated if status is in a failed state with more information on reason for the failure.",
+          "launch_stage": "GA"
+        },
+        "updated_at": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.FileParent": {
+      "fields": {
+        "file_parent_type": {
+          "ref": "marketplace.FileParentType",
+          "launch_stage": "GA"
+        },
+        "parent_id": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.FileParentType": {
+      "enum": [
+        "PROVIDER",
+        "LISTING",
+        "LISTING_RESOURCE"
+      ],
+      "enum_launch_stages": {
+        "LISTING": "GA",
+        "LISTING_RESOURCE": "GA",
+        "PROVIDER": "GA"
+      }
+    },
+    "marketplace.FileStatus": {
+      "enum": [
+        "FILE_STATUS_PUBLISHED",
+        "FILE_STATUS_STAGING",
+        "FILE_STATUS_SANITIZING",
+        "FILE_STATUS_SANITIZATION_FAILED"
+      ],
+      "enum_launch_stages": {
+        "FILE_STATUS_PUBLISHED": "GA",
+        "FILE_STATUS_SANITIZATION_FAILED": "GA",
+        "FILE_STATUS_SANITIZING": "GA",
+        "FILE_STATUS_STAGING": "GA"
+      }
+    },
+    "marketplace.FulfillmentType": {
+      "enum": [
+        "REQUEST_ACCESS",
+        "INSTALL"
+      ],
+      "enum_launch_stages": {
+        "INSTALL": "GA",
+        "REQUEST_ACCESS": "GA"
+      }
+    },
+    "marketplace.GetExchangeRequest": {},
+    "marketplace.GetExchangeResponse": {
+      "fields": {
+        "exchange": {
+          "ref": "marketplace.Exchange",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.GetFileRequest": {},
+    "marketplace.GetFileResponse": {
+      "fields": {
+        "file_info": {
+          "ref": "marketplace.FileInfo",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.GetLatestVersionProviderAnalyticsDashboardRequest": {},
+    "marketplace.GetLatestVersionProviderAnalyticsDashboardResponse": {
+      "fields": {
+        "version": {
+          "description": "version here is latest logical version of the dashboard template",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.GetListingContentMetadataRequest": {
+      "fields": {
+        "page_size": {
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.GetListingContentMetadataResponse": {
+      "fields": {
+        "next_page_token": {
+          "launch_stage": "GA"
+        },
+        "shared_data_objects": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.GetListingRequest": {},
+    "marketplace.GetListingResponse": {
+      "fields": {
+        "listing": {
+          "ref": "marketplace.Listing",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.GetListingsRequest": {
+      "fields": {
+        "page_size": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "page_token": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.GetListingsResponse": {
+      "fields": {
+        "listings": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "next_page_token": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.GetPersonalizationRequestRequest": {},
+    "marketplace.GetPersonalizationRequestResponse": {
+      "fields": {
+        "personalization_requests": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.GetProviderRequest": {},
+    "marketplace.GetProviderResponse": {
+      "fields": {
+        "provider": {
+          "ref": "marketplace.ProviderInfo",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.Installation": {
+      "fields": {
+        "installation": {
+          "ref": "marketplace.InstallationDetail",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.InstallationDetail": {
+      "fields": {
+        "catalog_name": {
+          "launch_stage": "GA"
+        },
+        "error_message": {
+          "launch_stage": "GA"
+        },
+        "id": {
+          "launch_stage": "GA"
+        },
+        "installed_on": {
+          "launch_stage": "GA"
+        },
+        "listing_id": {
+          "launch_stage": "GA"
+        },
+        "listing_name": {
+          "launch_stage": "GA"
+        },
+        "recipient_type": {
+          "ref": "marketplace.DeltaSharingRecipientType",
+          "launch_stage": "GA"
+        },
+        "repo_name": {
+          "launch_stage": "GA"
+        },
+        "repo_path": {
+          "launch_stage": "GA"
+        },
+        "share_name": {
+          "launch_stage": "GA"
+        },
+        "status": {
+          "ref": "marketplace.InstallationStatus",
+          "launch_stage": "GA"
+        },
+        "token_detail": {
+          "ref": "marketplace.TokenDetail",
+          "launch_stage": "GA"
+        },
+        "tokens": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.InstallationStatus": {
+      "enum": [
+        "INSTALLED",
+        "FAILED"
+      ],
+      "enum_launch_stages": {
+        "FAILED": "GA",
+        "INSTALLED": "GA"
+      }
+    },
+    "marketplace.ListAllInstallationsRequest": {
+      "fields": {
+        "page_size": {
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.ListAllInstallationsResponse": {
+      "fields": {
+        "installations": {
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.ListAllPersonalizationRequestsRequest": {
+      "fields": {
+        "page_size": {
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.ListAllPersonalizationRequestsResponse": {
+      "fields": {
+        "next_page_token": {
+          "launch_stage": "GA"
+        },
+        "personalization_requests": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.ListConsumerProvidersRequest": {
+      "fields": {
+        "is_featured": {
+          "launch_stage": "GA"
+        },
+        "page_size": {
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.ListExchangeFiltersRequest": {
+      "fields": {
+        "exchange_id": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "page_size": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "page_token": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.ListExchangeFiltersResponse": {
+      "fields": {
+        "filters": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "next_page_token": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.ListExchangesForListingRequest": {
+      "fields": {
+        "listing_id": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "page_size": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "page_token": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.ListExchangesForListingResponse": {
+      "fields": {
+        "exchange_listing": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "next_page_token": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.ListExchangesRequest": {
+      "fields": {
+        "page_size": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "page_token": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.ListExchangesResponse": {
+      "fields": {
+        "exchanges": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "next_page_token": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.ListFilesRequest": {
+      "fields": {
+        "file_parent": {
+          "ref": "marketplace.FileParent",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "page_size": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "page_token": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.ListFilesResponse": {
+      "fields": {
+        "file_infos": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "next_page_token": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.ListFulfillmentsRequest": {
+      "fields": {
+        "page_size": {
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.ListFulfillmentsResponse": {
+      "fields": {
+        "fulfillments": {
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.ListInstallationsRequest": {
+      "fields": {
+        "page_size": {
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.ListInstallationsResponse": {
+      "fields": {
+        "installations": {
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.ListListingsForExchangeRequest": {
+      "fields": {
+        "exchange_id": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "page_size": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "page_token": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.ListListingsForExchangeResponse": {
+      "fields": {
+        "exchange_listings": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "next_page_token": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.ListListingsRequest": {
+      "fields": {
+        "assets": {
+          "description": "Matches any of the following asset types",
+          "launch_stage": "GA"
+        },
+        "categories": {
+          "description": "Matches any of the following categories",
+          "launch_stage": "GA"
+        },
+        "is_free": {
+          "description": "Filters each listing based on if it is free.",
+          "launch_stage": "GA"
+        },
+        "is_private_exchange": {
+          "description": "Filters each listing based on if it is a private exchange.",
+          "launch_stage": "GA"
+        },
+        "is_staff_pick": {
+          "description": "Filters each listing based on whether it is a staff pick.",
+          "launch_stage": "GA"
+        },
+        "page_size": {
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "launch_stage": "GA"
+        },
+        "provider_ids": {
+          "description": "Matches any of the following provider ids",
+          "launch_stage": "GA"
+        },
+        "tags": {
+          "description": "Matches listings with this tag",
+          "ref": "marketplace.ListingTag",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.ListListingsResponse": {
+      "fields": {
+        "listings": {
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.ListProviderAnalyticsDashboardRequest": {},
+    "marketplace.ListProviderAnalyticsDashboardResponse": {
+      "fields": {
+        "dashboard_id": {
+          "description": "dashboard_id will be used to open Lakeview dashboard.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "id": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "version": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.ListProvidersRequest": {
+      "fields": {
+        "page_size": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "page_token": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.ListProvidersResponse": {
+      "fields": {
+        "next_page_token": {
+          "launch_stage": "GA"
+        },
+        "providers": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.Listing": {
+      "fields": {
+        "detail": {
+          "ref": "marketplace.ListingDetail",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "launch_stage": "GA"
+        },
+        "summary": {
+          "ref": "marketplace.ListingSummary",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.ListingDetail": {
+      "fields": {
+        "assets": {
+          "description": "Type of assets included in the listing. eg. GIT_REPO, DATA_TABLE, MODEL, NOTEBOOK",
+          "launch_stage": "GA"
+        },
+        "collection_date_end": {
+          "description": "The ending date timestamp for when the data spans",
+          "launch_stage": "GA"
+        },
+        "collection_date_start": {
+          "description": "The starting date timestamp for when the data spans",
+          "launch_stage": "GA"
+        },
+        "collection_granularity": {
+          "description": "Smallest unit of time in the dataset",
+          "ref": "marketplace.DataRefreshInfo",
+          "launch_stage": "GA"
+        },
+        "cost": {
+          "description": "Whether the dataset is free or paid",
+          "ref": "marketplace.Cost",
+          "launch_stage": "GA"
+        },
+        "data_source": {
+          "description": "Where/how the data is sourced",
+          "launch_stage": "GA"
+        },
+        "description": {
+          "launch_stage": "GA"
+        },
+        "documentation_link": {
+          "launch_stage": "GA"
+        },
+        "embedded_notebook_file_infos": {
+          "launch_stage": "GA"
+        },
+        "file_ids": {
+          "launch_stage": "GA"
+        },
+        "geographical_coverage": {
+          "description": "Which geo region the listing data is collected from",
+          "launch_stage": "GA"
+        },
+        "license": {
+          "description": "ID 20, 21 removed don't use\nLicense of the data asset - Required for listings with model based assets",
+          "launch_stage": "GA"
+        },
+        "pricing_model": {
+          "description": "What the pricing model is (e.g. paid, subscription, paid upfront); should only be present if cost is paid",
+          "launch_stage": "GA"
+        },
+        "privacy_policy_link": {
+          "launch_stage": "GA"
+        },
+        "size": {
+          "description": "size of the dataset in GB",
+          "launch_stage": "GA"
+        },
+        "support_link": {
+          "launch_stage": "GA"
+        },
+        "tags": {
+          "description": "Listing tags - Simple key value pair to annotate listings.\nWhen should I use tags vs dedicated fields?\nUsing tags avoids the need to add new columns in the database for new annotations.\nHowever, this should be used sparingly since tags are stored as key value pair.\nUse tags only:\n1. If the field is optional and won't need to have NOT NULL integrity check\n2. The value is fairly fixed, static and low cardinality (eg. enums).\n3. The value won't be used in filters or joins with other tables.",
+          "launch_stage": "GA"
+        },
+        "terms_of_service": {
+          "launch_stage": "GA"
+        },
+        "update_frequency": {
+          "description": "How often data is updated",
+          "ref": "marketplace.DataRefreshInfo",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.ListingFulfillment": {
+      "fields": {
+        "fulfillment_type": {
+          "ref": "marketplace.FulfillmentType",
+          "launch_stage": "GA"
+        },
+        "listing_id": {
+          "launch_stage": "GA"
+        },
+        "recipient_type": {
+          "ref": "marketplace.DeltaSharingRecipientType",
+          "launch_stage": "GA"
+        },
+        "repo_info": {
+          "ref": "marketplace.RepoInfo",
+          "launch_stage": "GA"
+        },
+        "share_info": {
+          "ref": "marketplace.ShareInfo",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.ListingSetting": {
+      "fields": {
+        "visibility": {
+          "ref": "marketplace.Visibility",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.ListingShareType": {
+      "enum": [
+        "SAMPLE",
+        "FULL"
+      ],
+      "enum_launch_stages": {
+        "FULL": "GA",
+        "SAMPLE": "GA"
+      }
+    },
+    "marketplace.ListingStatus": {
+      "description": "Enums",
+      "enum": [
+        "DRAFT",
+        "PENDING",
+        "PUBLISHED",
+        "SUSPENDED"
+      ],
+      "enum_launch_stages": {
+        "DRAFT": "GA",
+        "PENDING": "GA",
+        "PUBLISHED": "GA",
+        "SUSPENDED": "GA"
+      }
+    },
+    "marketplace.ListingSummary": {
+      "fields": {
+        "categories": {
+          "launch_stage": "GA"
+        },
+        "created_at": {
+          "launch_stage": "GA"
+        },
+        "created_by": {
+          "launch_stage": "GA"
+        },
+        "created_by_id": {
+          "launch_stage": "GA"
+        },
+        "exchange_ids": {
+          "launch_stage": "GA"
+        },
+        "git_repo": {
+          "description": "if a git repo is being created, a listing will be initialized with this field as opposed to a share",
+          "ref": "marketplace.RepoInfo",
+          "launch_stage": "GA"
+        },
+        "listingType": {
+          "ref": "marketplace.ListingType",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "launch_stage": "GA"
+        },
+        "provider_id": {
+          "launch_stage": "GA"
+        },
+        "provider_region": {
+          "ref": "marketplace.RegionInfo",
+          "launch_stage": "GA"
+        },
+        "published_at": {
+          "launch_stage": "GA"
+        },
+        "published_by": {
+          "launch_stage": "GA"
+        },
+        "setting": {
+          "ref": "marketplace.ListingSetting",
+          "launch_stage": "GA"
+        },
+        "share": {
+          "ref": "marketplace.ShareInfo",
+          "launch_stage": "GA"
+        },
+        "status": {
+          "ref": "marketplace.ListingStatus",
+          "launch_stage": "GA"
+        },
+        "subtitle": {
+          "launch_stage": "GA"
+        },
+        "updated_at": {
+          "launch_stage": "GA"
+        },
+        "updated_by": {
+          "launch_stage": "GA"
+        },
+        "updated_by_id": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.ListingTag": {
+      "fields": {
+        "tag_name": {
+          "description": "Tag name (enum)",
+          "ref": "marketplace.ListingTagType",
+          "launch_stage": "GA"
+        },
+        "tag_values": {
+          "description": "String representation of the tag value. Values should be string literals (no complex types)",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.ListingTagType": {
+      "enum": [
+        "LISTING_TAG_TYPE_LANGUAGE",
+        "LISTING_TAG_TYPE_TASK"
+      ],
+      "enum_launch_stages": {
+        "LISTING_TAG_TYPE_LANGUAGE": "GA",
+        "LISTING_TAG_TYPE_TASK": "GA"
+      }
+    },
+    "marketplace.ListingType": {
+      "enum": [
+        "STANDARD",
+        "PERSONALIZED"
+      ],
+      "enum_launch_stages": {
+        "PERSONALIZED": "GA",
+        "STANDARD": "GA"
+      }
+    },
+    "marketplace.MarketplaceFileType": {
+      "enum": [
+        "PROVIDER_ICON",
+        "EMBEDDED_NOTEBOOK",
+        "APP"
+      ],
+      "enum_launch_stages": {
+        "APP": "GA",
+        "EMBEDDED_NOTEBOOK": "GA",
+        "PROVIDER_ICON": "GA"
+      }
+    },
+    "marketplace.PersonalizationRequest": {
+      "fields": {
+        "comment": {
+          "launch_stage": "GA"
+        },
+        "consumer_region": {
+          "ref": "marketplace.RegionInfo",
+          "launch_stage": "GA"
+        },
+        "contact_info": {
+          "ref": "marketplace.ContactInfo",
+          "launch_stage": "GA"
+        },
+        "created_at": {
+          "launch_stage": "GA"
+        },
+        "id": {
+          "launch_stage": "GA"
+        },
+        "intended_use": {
+          "launch_stage": "GA"
+        },
+        "is_from_lighthouse": {
+          "launch_stage": "GA"
+        },
+        "listing_id": {
+          "launch_stage": "GA"
+        },
+        "listing_name": {
+          "launch_stage": "GA"
+        },
+        "metastore_id": {
+          "launch_stage": "GA"
+        },
+        "provider_id": {
+          "launch_stage": "GA"
+        },
+        "recipient_type": {
+          "ref": "marketplace.DeltaSharingRecipientType",
+          "launch_stage": "GA"
+        },
+        "share": {
+          "description": "Share information is required for data listings\nbut should be empty/ignored for non-data listings (MCP and App).",
+          "ref": "marketplace.ShareInfo",
+          "launch_stage": "GA"
+        },
+        "status": {
+          "ref": "marketplace.PersonalizationRequestStatus",
+          "launch_stage": "GA"
+        },
+        "status_message": {
+          "launch_stage": "GA"
+        },
+        "updated_at": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.PersonalizationRequestStatus": {
+      "enum": [
+        "NEW",
+        "REQUEST_PENDING",
+        "FULFILLED",
+        "DENIED"
+      ],
+      "enum_launch_stages": {
+        "DENIED": "GA",
+        "FULFILLED": "GA",
+        "NEW": "GA",
+        "REQUEST_PENDING": "GA"
+      }
+    },
+    "marketplace.ProviderAnalyticsDashboard": {
+      "fields": {
+        "id": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.ProviderInfo": {
+      "fields": {
+        "business_contact_email": {
+          "launch_stage": "GA"
+        },
+        "company_website_link": {
+          "launch_stage": "GA"
+        },
+        "dark_mode_icon_file_id": {
+          "launch_stage": "GA"
+        },
+        "dark_mode_icon_file_path": {
+          "launch_stage": "GA"
+        },
+        "description": {
+          "launch_stage": "GA"
+        },
+        "icon_file_id": {
+          "launch_stage": "GA"
+        },
+        "icon_file_path": {
+          "launch_stage": "GA"
+        },
+        "id": {
+          "launch_stage": "GA"
+        },
+        "is_featured": {
+          "description": "is_featured is accessible by consumers only",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "launch_stage": "GA"
+        },
+        "privacy_policy_link": {
+          "launch_stage": "GA"
+        },
+        "published_by": {
+          "description": "published_by is only applicable to data aggregators (e.g. Crux)",
+          "launch_stage": "GA"
+        },
+        "support_contact_email": {
+          "launch_stage": "GA"
+        },
+        "term_of_service_link": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.RegionInfo": {
+      "fields": {
+        "cloud": {
+          "launch_stage": "GA"
+        },
+        "region": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.RemoveExchangeForListingRequest": {},
+    "marketplace.RemoveExchangeForListingResponse": {},
+    "marketplace.RepoInfo": {
+      "fields": {
+        "git_repo_url": {
+          "description": "the git repo url e.g. https://github.com/databrickslabs/dolly.git",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.RepoInstallation": {
+      "fields": {
+        "repo_name": {
+          "description": "the user-specified repo name for their installed git repo listing",
+          "launch_stage": "GA"
+        },
+        "repo_path": {
+          "description": "refers to the full url file path that navigates the user to the repo's entrypoint (e.g. a README.md file, or the repo file view in the unified UI)\nshould just be a relative path",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.SearchListingsRequest": {
+      "fields": {
+        "assets": {
+          "description": "Matches any of the following asset types",
+          "launch_stage": "GA"
+        },
+        "categories": {
+          "description": "Matches any of the following categories",
+          "launch_stage": "GA"
+        },
+        "is_free": {
+          "launch_stage": "GA"
+        },
+        "is_private_exchange": {
+          "launch_stage": "GA"
+        },
+        "page_size": {
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "launch_stage": "GA"
+        },
+        "provider_ids": {
+          "description": "Matches any of the following provider ids",
+          "launch_stage": "GA"
+        },
+        "query": {
+          "description": "Fuzzy matches query",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.SearchListingsResponse": {
+      "fields": {
+        "listings": {
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.ShareInfo": {
+      "fields": {
+        "name": {
+          "launch_stage": "GA"
+        },
+        "type": {
+          "ref": "marketplace.ListingShareType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.SharedDataObject": {
+      "fields": {
+        "data_object_type": {
+          "description": "The type of the data object. Could be one of: TABLE, SCHEMA, NOTEBOOK_FILE, MODEL, VOLUME",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of the shared object",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.TokenDetail": {
+      "fields": {
+        "bearerToken": {
+          "launch_stage": "GA"
+        },
+        "endpoint": {
+          "launch_stage": "GA"
+        },
+        "expirationTime": {
+          "launch_stage": "GA"
+        },
+        "shareCredentialsVersion": {
+          "description": "These field names must follow the delta sharing protocol.\nOriginal message: RetrieveToken.Response in managed-catalog/api/messages/recipient.proto",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.TokenInfo": {
+      "fields": {
+        "activation_url": {
+          "description": "Full activation url to retrieve the access token.\nIt will be empty if the token is already retrieved.",
+          "launch_stage": "GA"
+        },
+        "created_at": {
+          "description": "Time at which this Recipient Token was created, in epoch milliseconds.",
+          "launch_stage": "GA"
+        },
+        "created_by": {
+          "description": "Username of Recipient Token creator.",
+          "launch_stage": "GA"
+        },
+        "expiration_time": {
+          "description": "Expiration timestamp of the token in epoch milliseconds.",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "Unique id of the Recipient Token.",
+          "launch_stage": "GA"
+        },
+        "updated_at": {
+          "description": "Time at which this Recipient Token was updated, in epoch milliseconds.",
+          "launch_stage": "GA"
+        },
+        "updated_by": {
+          "description": "Username of Recipient Token updater.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.UpdateExchangeFilterRequest": {
+      "fields": {
+        "filter": {
+          "ref": "marketplace.ExchangeFilter",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.UpdateExchangeFilterResponse": {
+      "fields": {
+        "filter": {
+          "ref": "marketplace.ExchangeFilter",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.UpdateExchangeRequest": {
+      "fields": {
+        "exchange": {
+          "ref": "marketplace.Exchange",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.UpdateExchangeResponse": {
+      "fields": {
+        "exchange": {
+          "ref": "marketplace.Exchange",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.UpdateInstallationRequest": {
+      "fields": {
+        "installation": {
+          "ref": "marketplace.InstallationDetail",
+          "launch_stage": "GA"
+        },
+        "rotate_token": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.UpdateInstallationResponse": {
+      "fields": {
+        "installation": {
+          "ref": "marketplace.InstallationDetail",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "marketplace.UpdateListingRequest": {
+      "fields": {
+        "listing": {
+          "ref": "marketplace.Listing",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.UpdateListingResponse": {
+      "fields": {
+        "listing": {
+          "ref": "marketplace.Listing",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.UpdatePersonalizationRequestRequest": {
+      "fields": {
+        "reason": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "share": {
+          "ref": "marketplace.ShareInfo",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "status": {
+          "ref": "marketplace.PersonalizationRequestStatus",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.UpdatePersonalizationRequestResponse": {
+      "fields": {
+        "request": {
+          "ref": "marketplace.PersonalizationRequest",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.UpdateProviderAnalyticsDashboardRequest": {
+      "fields": {
+        "version": {
+          "description": "this is the version of the dashboard template we want to update our user to\ncurrent expectation is that it should be equal to latest version of the dashboard template",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.UpdateProviderAnalyticsDashboardResponse": {
+      "fields": {
+        "dashboard_id": {
+          "description": "this is newly created Lakeview dashboard for the user",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "id": {
+          "description": "id \u0026 version should be the same as the request",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "version": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.UpdateProviderRequest": {
+      "fields": {
+        "provider": {
+          "ref": "marketplace.ProviderInfo",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.UpdateProviderResponse": {
+      "fields": {
+        "provider": {
+          "ref": "marketplace.ProviderInfo",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "marketplace.Visibility": {
+      "enum": [
+        "PUBLIC",
+        "PRIVATE"
+      ],
+      "enum_launch_stages": {
+        "PRIVATE": "GA",
+        "PUBLIC": "GA"
+      }
+    },
+    "ml.Activity": {
+      "description": "For activities, this contains the activity recorded for the action.\nFor comments, this contains the comment details.\nFor transition requests, this contains the transition request details.",
+      "fields": {
+        "activity_type": {
+          "ref": "ml.ActivityType",
+          "launch_stage": "GA"
+        },
+        "comment": {
+          "description": "User-provided comment associated with the activity, comment, or transition request.",
+          "launch_stage": "GA"
+        },
+        "creation_timestamp": {
+          "description": "Creation time of the object, as a Unix timestamp in milliseconds.",
+          "launch_stage": "GA"
+        },
+        "from_stage": {
+          "description": "Source stage of the transition (if the activity is stage transition related). Valid values are:\n\n* `None`: The initial stage of a model version.\n\n* `Staging`: Staging or pre-production stage.\n\n* `Production`: Production stage.\n\n* `Archived`: Archived stage.",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "Unique identifier for the object.",
+          "launch_stage": "GA"
+        },
+        "last_updated_timestamp": {
+          "description": "Time of the object at last update, as a Unix timestamp in milliseconds.",
+          "launch_stage": "GA"
+        },
+        "system_comment": {
+          "description": "Comment made by system, for example explaining an activity of type `SYSTEM_TRANSITION`. It usually describes a side effect, such as a version being archived as part of another version's stage transition, and may not be returned for some activity types.",
+          "launch_stage": "GA"
+        },
+        "to_stage": {
+          "description": "Target stage of the transition (if the activity is stage transition related). Valid values are:\n\n* `None`: The initial stage of a model version.\n\n* `Staging`: Staging or pre-production stage.\n\n* `Production`: Production stage.\n\n* `Archived`: Archived stage.",
+          "launch_stage": "GA"
+        },
+        "user_id": {
+          "description": "The username of the user that created the object.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.ActivityAction": {
+      "description": "An action that a user (with sufficient permissions) could take on an activity or comment.\n\nFor activities, valid values are:\n* `APPROVE_TRANSITION_REQUEST`: Approve a transition request\n\n* `REJECT_TRANSITION_REQUEST`: Reject a transition request\n\n* `CANCEL_TRANSITION_REQUEST`: Cancel (delete) a transition request\n\nFor comments, valid values are:\n* `EDIT_COMMENT`: Edit the comment\n\n* `DELETE_COMMENT`: Delete the comment",
+      "enum": [
+        "APPROVE_TRANSITION_REQUEST",
+        "REJECT_TRANSITION_REQUEST",
+        "CANCEL_TRANSITION_REQUEST",
+        "EDIT_COMMENT",
+        "DELETE_COMMENT"
+      ],
+      "enum_launch_stages": {
+        "APPROVE_TRANSITION_REQUEST": "GA",
+        "CANCEL_TRANSITION_REQUEST": "GA",
+        "DELETE_COMMENT": "GA",
+        "EDIT_COMMENT": "GA",
+        "REJECT_TRANSITION_REQUEST": "GA"
+      },
+      "enum_descriptions": {
+        "APPROVE_TRANSITION_REQUEST": "Approve a transition request",
+        "CANCEL_TRANSITION_REQUEST": "Cancel (delete) a transition request",
+        "DELETE_COMMENT": "Delete the comment",
+        "EDIT_COMMENT": "Edit the comment",
+        "REJECT_TRANSITION_REQUEST": "Reject a transition request"
+      }
+    },
+    "ml.ActivityType": {
+      "description": "Type of activity. Valid values are:\n* `APPLIED_TRANSITION`: User applied the corresponding stage transition.\n\n* `REQUESTED_TRANSITION`: User requested the corresponding stage transition.\n\n* `CANCELLED_REQUEST`: User cancelled an existing transition request.\n\n* `APPROVED_REQUEST`: User approved the corresponding stage transition.\n\n* `REJECTED_REQUEST`: User rejected the coressponding stage transition.\n\n* `SYSTEM_TRANSITION`: For events performed as a side effect, such as archiving existing model versions in a stage.",
+      "enum": [
+        "APPLIED_TRANSITION",
+        "REQUESTED_TRANSITION",
+        "CANCELLED_REQUEST",
+        "APPROVED_REQUEST",
+        "REJECTED_REQUEST",
+        "NEW_COMMENT",
+        "SYSTEM_TRANSITION"
+      ],
+      "enum_launch_stages": {
+        "APPLIED_TRANSITION": "GA",
+        "APPROVED_REQUEST": "GA",
+        "CANCELLED_REQUEST": "GA",
+        "NEW_COMMENT": "GA",
+        "REJECTED_REQUEST": "GA",
+        "REQUESTED_TRANSITION": "GA",
+        "SYSTEM_TRANSITION": "GA"
+      },
+      "enum_descriptions": {
+        "APPLIED_TRANSITION": "User applied the corresponding stage transition.",
+        "APPROVED_REQUEST": "User approved the corresponding stage transition.",
+        "CANCELLED_REQUEST": "User cancelled an existing transition request.",
+        "REJECTED_REQUEST": "User rejected the coressponding stage transition.",
+        "REQUESTED_TRANSITION": "User requested the corresponding stage transition.",
+        "SYSTEM_TRANSITION": "For events performed as a side effect, such as archiving existing model versions in a stage."
+      }
+    },
+    "ml.AggregationFunction": {
+      "description": "An aggregation function applied over a time window.",
+      "fields": {
+        "approx_count_distinct": {
+          "ref": "ml.ApproxCountDistinctFunction",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "approx_percentile": {
+          "ref": "ml.ApproxPercentileFunction",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "avg": {
+          "ref": "ml.AvgFunction",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "count_function": {
+          "ref": "ml.CountFunction",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "first": {
+          "ref": "ml.FirstFunction",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "first_distinct": {
+          "ref": "ml.FirstDistinctFunction",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "first_n": {
+          "ref": "ml.FirstNFunction",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "last": {
+          "ref": "ml.LastFunction",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "last_distinct": {
+          "ref": "ml.LastDistinctFunction",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "last_n": {
+          "ref": "ml.LastNFunction",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "max": {
+          "ref": "ml.MaxFunction",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "min": {
+          "ref": "ml.MinFunction",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "stddev_pop": {
+          "ref": "ml.StddevPopFunction",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "stddev_samp": {
+          "ref": "ml.StddevSampFunction",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "sum": {
+          "ref": "ml.SumFunction",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "time_window": {
+          "description": "The time window over which the aggregation is computed.",
+          "ref": "ml.TimeWindow",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "var_pop": {
+          "ref": "ml.VarPopFunction",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "var_samp": {
+          "ref": "ml.VarSampFunction",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.ApproveTransitionRequest": {
+      "description": "Details required to identify and approve a model version stage transition request.",
+      "fields": {
+        "archive_existing_versions": {
+          "description": "Specifies whether to archive all current model versions in the target stage.",
+          "launch_stage": "GA"
+        },
+        "comment": {
+          "description": "User-provided comment on the action.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of the model.",
+          "launch_stage": "GA"
+        },
+        "stage": {
+          "description": "Target stage of the transition. Valid values are:\n\n* `None`: The initial stage of a model version.\n\n* `Staging`: Staging or pre-production stage.\n\n* `Production`: Production stage.\n\n* `Archived`: Archived stage.",
+          "launch_stage": "GA"
+        },
+        "version": {
+          "description": "Version of the model.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.ApproveTransitionRequestResponse": {
+      "fields": {
+        "activity": {
+          "description": "New activity generated as a result of this operation.",
+          "ref": "ml.Activity",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.ApproxCountDistinctFunction": {
+      "description": "Computes the approximate count of distinct values.",
+      "fields": {
+        "input": {
+          "description": "The input column from which the approximate count of distinct values is computed.",
+          "launch_stage": "GA"
+        },
+        "relative_sd": {
+          "description": "The maximum relative standard deviation allowed (default defined by Spark).",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.ApproxPercentileFunction": {
+      "description": "Computes the approximate percentile of values.",
+      "fields": {
+        "accuracy": {
+          "description": "The accuracy parameter (higher is more accurate but slower).",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "input": {
+          "description": "The input column from which the approximate percentile is computed.",
+          "launch_stage": "GA"
+        },
+        "percentile": {
+          "description": "The percentile value to compute (between 0 and 1).",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.AuthConfig": {
+      "fields": {
+        "mtls_config": {
+          "description": "Mutual-TLS authentication. See MtlsConfig.",
+          "ref": "ml.MtlsConfig",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "uc_service_credential_name": {
+          "description": "Name of the Unity Catalog service credential. This value will be set under the option databricks.serviceCredential",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.AvgFunction": {
+      "description": "Computes the average of values.",
+      "fields": {
+        "input": {
+          "description": "The input column from which the average is computed. For Kafka sources, use dot-prefixed path\nnotation (e.g., \"value.amount\"). For nested fields, the leaf node name is used.\nColon-prefixed notation (e.g., \"value:amount\") is supported for backwards\ncompatibility but is deprecated; migrate to dot notation.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.BackfillFeaturesRequest": {
+      "fields": {
+        "backfill_ranges": {
+          "description": "Output ranges to backfill.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "budget_policy_id": {
+          "description": "The budget policy ID, in UUID format, used to attribute the serverless compute cost of this\nbackfill. If not specified, a default budget policy may be applied.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "feature_full_names": {
+          "description": "Full names of the features to backfill.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "request_id": {
+          "description": "Idempotency token for the request.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "tags": {
+          "description": "Custom tags to associate with this backfill. They are applied to the backfill job and\nforwarded to the underlying compute as Databricks resource tags, so backfill cost can be\nattributed in the billing system tables. These tags apply only to the backfill compute; they\nare not applied to the Unity Catalog Feature resources themselves, whose tags are managed\nseparately through the Unity Catalog tagging API. A maximum of 25 tags is supported; keys and\nvalues are subject to the same limitations as Databricks resource tags.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.BackfillFeaturesResponse": {
+      "description": "Result of a completed backfill."
+    },
+    "ml.BackfillOperationMetadata": {
+      "description": "Progress and configuration for a backfill.",
+      "fields": {
+        "backfill_ranges": {
+          "description": "Output ranges targeted by the backfill.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "feature_full_names": {
+          "description": "Full names of the features targeted by the backfill.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "state": {
+          "description": "Current state of the backfill.",
+          "ref": "ml.BackfillOperationMetadataState",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "ml.BackfillOperationMetadataState": {
+      "description": "Lifecycle state of a backfill.",
+      "enum": [
+        "PENDING",
+        "RUNNING",
+        "SUCCEEDED",
+        "FAILED",
+        "CANCELLED"
+      ],
+      "enum_launch_stages": {
+        "CANCELLED": "PRIVATE_PREVIEW",
+        "FAILED": "PRIVATE_PREVIEW",
+        "PENDING": "PRIVATE_PREVIEW",
+        "RUNNING": "PRIVATE_PREVIEW",
+        "SUCCEEDED": "PRIVATE_PREVIEW"
+      }
+    },
+    "ml.BackfillRange": {
+      "description": "A time range for a backfill.",
+      "fields": {
+        "end_time": {
+          "description": "End of the backfill range, exclusive. If unset, defaults to the current time.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "start_time": {
+          "description": "Start of the backfill range, inclusive. If unset, defaults to the earliest source timestamp of the feature.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.BackfillSource": {
+      "fields": {
+        "delta_table_name": {
+          "description": "The full three-part name (catalog, schema, name) of the Delta table containing the historical data to backfill.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "delta_table_source": {
+          "description": "Deprecated: Use delta_table_name instead. Kept for backwards compatibility.\nThe Delta table source containing the historical data to backfill.\nOnly the delta table name is used for backfill, other fields are ignored.",
+          "ref": "ml.DeltaTableSource",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.BatchCreateMaterializedFeaturesRequest": {
+      "fields": {
+        "requests": {
+          "description": "The requests to create materialized features.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.BatchCreateMaterializedFeaturesResponse": {
+      "fields": {
+        "materialized_features": {
+          "description": "The created materialized features with assigned IDs.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.CancelOperationRequest": {
+      "description": "The request message for `CancelOperation` method."
+    },
+    "ml.ColumnIdentifier": {
+      "fields": {
+        "variant_expr_path": {
+          "description": "String representation of the column name using dot-prefixed path notation.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "ml.ColumnSelection": {
+      "description": "A ColumnSelection function, equivalent to the LAST() record of an entity over a lifetime window",
+      "fields": {
+        "column": {
+          "description": "Column name from source to select as the feature value.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.CommentActivityAction": {
+      "description": "An action that a user (with sufficient permissions) could take on an activity or comment.\n\nFor activities, valid values are:\n* `APPROVE_TRANSITION_REQUEST`: Approve a transition request\n\n* `REJECT_TRANSITION_REQUEST`: Reject a transition request\n\n* `CANCEL_TRANSITION_REQUEST`: Cancel (delete) a transition request\n\nFor comments, valid values are:\n* `EDIT_COMMENT`: Edit the comment\n\n* `DELETE_COMMENT`: Delete the comment",
+      "enum": [
+        "APPROVE_TRANSITION_REQUEST",
+        "REJECT_TRANSITION_REQUEST",
+        "CANCEL_TRANSITION_REQUEST",
+        "EDIT_COMMENT",
+        "DELETE_COMMENT"
+      ],
+      "enum_launch_stages": {
+        "APPROVE_TRANSITION_REQUEST": "GA",
+        "CANCEL_TRANSITION_REQUEST": "GA",
+        "DELETE_COMMENT": "GA",
+        "EDIT_COMMENT": "GA",
+        "REJECT_TRANSITION_REQUEST": "GA"
+      },
+      "enum_descriptions": {
+        "APPROVE_TRANSITION_REQUEST": "Approve a transition request",
+        "CANCEL_TRANSITION_REQUEST": "Cancel (delete) a transition request",
+        "DELETE_COMMENT": "Delete the comment",
+        "EDIT_COMMENT": "Edit the comment",
+        "REJECT_TRANSITION_REQUEST": "Reject a transition request"
+      }
+    },
+    "ml.CommentObject": {
+      "description": "For activities, this contains the activity recorded for the action.\nFor comments, this contains the comment details.\nFor transition requests, this contains the transition request details.",
+      "fields": {
+        "available_actions": {
+          "description": "Array of actions on the activity allowed for the current viewer.",
+          "launch_stage": "GA"
+        },
+        "comment": {
+          "description": "User-provided comment associated with the activity, comment, or transition request.",
+          "launch_stage": "GA"
+        },
+        "creation_timestamp": {
+          "description": "Creation time of the object, as a Unix timestamp in milliseconds.",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "Unique identifier for the object.",
+          "launch_stage": "GA"
+        },
+        "last_updated_timestamp": {
+          "description": "Time of the object at last update, as a Unix timestamp in milliseconds.",
+          "launch_stage": "GA"
+        },
+        "user_id": {
+          "description": "The username of the user that created the object.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.ContinuousWindow": {
+      "fields": {
+        "offset": {
+          "description": "The offset of the continuous window (must be non-positive).",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "window_duration": {
+          "description": "The duration of the continuous window (must be positive).",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "ml.CountFunction": {
+      "description": "Computes the count of values.",
+      "fields": {
+        "input": {
+          "description": "The input column from which the count is computed. For Kafka sources, use dot-prefixed path\nnotation (e.g., \"value.amount\"). For nested fields, the leaf node name is used.\nColon-prefixed notation (e.g., \"value:amount\") is supported for backwards\ncompatibility but is deprecated; migrate to dot notation.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.CreateComment": {
+      "description": "Details required to create a comment on a model version.",
+      "fields": {
+        "comment": {
+          "description": "User-provided comment on the action.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of the model.",
+          "launch_stage": "GA"
+        },
+        "version": {
+          "description": "Version of the model.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.CreateCommentResponse": {
+      "fields": {
+        "comment": {
+          "description": "New comment object",
+          "ref": "ml.CommentObject",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.CreateExperiment": {
+      "fields": {
+        "artifact_location": {
+          "description": "Location where all artifacts for the experiment are stored.\nIf not provided, the remote server will select an appropriate default.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Experiment name.",
+          "launch_stage": "GA"
+        },
+        "tags": {
+          "description": "A collection of tags to set on the experiment. Maximum tag size and number of tags per request\ndepends on the storage backend. All storage backends are guaranteed to support tag keys up\nto 250 bytes in size and tag values up to 5000 bytes in size. All storage backends are also\nguaranteed to support up to 20 tags per request.",
+          "launch_stage": "GA"
+        },
+        "trace_location": {
+          "description": "The location where the experiment's traces are stored. When set, the\nunderlying storage is provisioned and the experiment's traces are routed\nto it. When unset, traces are stored in the default MLflow backend. This\nfield cannot be updated after the experiment is created.",
+          "ref": "ml.ExperimentTraceLocation",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        }
+      }
+    },
+    "ml.CreateExperimentResponse": {
+      "fields": {
+        "experiment_id": {
+          "description": "Unique identifier for the experiment.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.CreateFeatureRequest": {
+      "fields": {
+        "feature": {
+          "description": "Feature to create.",
+          "ref": "ml.Feature",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.CreateFeatureTagRequest": {
+      "fields": {
+        "feature_tag": {
+          "ref": "ml.FeatureTag",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "ml.CreateForecastingExperimentRequest": {
+      "fields": {
+        "custom_weights_column": {
+          "description": "The column in the training table used to customize weights for each time series.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "experiment_path": {
+          "description": "The path in the workspace to store the created experiment.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "forecast_granularity": {
+          "description": "The time interval between consecutive rows in the time series data.\nPossible values include: '1 second', '1 minute', '5 minutes', '10 minutes', '15 minutes', '30 minutes', 'Hourly', 'Daily', 'Weekly', 'Monthly', 'Quarterly', 'Yearly'.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "forecast_horizon": {
+          "description": "The number of time steps into the future to make predictions, calculated as a multiple of forecast_granularity. This value represents how far ahead the model should forecast.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "future_feature_data_path": {
+          "description": "The fully qualified path of a Unity Catalog table, formatted as catalog_name.schema_name.table_name, used to store future feature data for predictions.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "holiday_regions": {
+          "description": "The region code(s) to automatically add holiday features. Currently supports only one region.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "include_features": {
+          "description": "Specifies the list of feature columns to include in model training. These columns must exist\nin the training data and be of type string, numerical, or boolean. If not specified, no additional\nfeatures will be included.\nNote: Certain columns are automatically handled:\n- Automatically excluded: split_column, target_column, custom_weights_column.\n- Automatically included: time_column.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "max_runtime": {
+          "description": "The maximum duration for the experiment in minutes. The experiment stops automatically if it exceeds this limit.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "prediction_data_path": {
+          "description": "The fully qualified path of a Unity Catalog table, formatted as catalog_name.schema_name.table_name, used to store predictions.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "primary_metric": {
+          "description": "The evaluation metric used to optimize the forecasting model.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "register_to": {
+          "description": "The fully qualified path of a Unity Catalog model, formatted as catalog_name.schema_name.model_name, used to store the best model.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "split_column": {
+          "description": "// The column in the training table used for custom data splits. Values must be 'train', 'validate', or 'test'.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "target_column": {
+          "description": "The column in the input training table used as the prediction target for model training. The values in this column are used as the ground truth for model training.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "time_column": {
+          "description": "The column in the input training table that represents each row's timestamp.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "timeseries_identifier_columns": {
+          "description": "The column in the training table used to group the dataset for predicting individual time series.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "train_data_path": {
+          "description": "The fully qualified path of a Unity Catalog table, formatted as catalog_name.schema_name.table_name, used as training data for the forecasting model.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "training_frameworks": {
+          "description": "List of frameworks to include for model tuning. Possible values are 'Prophet', 'ARIMA', 'DeepAR'. An empty list includes all supported frameworks.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "ml.CreateForecastingExperimentResponse": {
+      "fields": {
+        "experiment_id": {
+          "description": "The unique ID of the created forecasting experiment",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "ml.CreateIssueRequest": {
+      "fields": {
+        "issue": {
+          "description": "Output-only fields are ignored.",
+          "ref": "ml.Issue",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "issue_id": {
+          "description": "Optional client-chosen ID: iss- followed by 32 lowercase hex digits. A retry\nwith the same ID fails with ALREADY_EXISTS rather than making a duplicate.\nThe server generates one if unset.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.CreateKafkaConfigRequest": {
+      "fields": {
+        "kafka_config": {
+          "ref": "ml.KafkaConfig",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "ml.CreateLoggedModelRequest": {
+      "fields": {
+        "experiment_id": {
+          "description": "The ID of the experiment that owns the model.",
+          "launch_stage": "GA"
+        },
+        "model_type": {
+          "description": "The type of the model, such as ``\"Agent\"``, ``\"Classifier\"``, ``\"LLM\"``.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The name of the model (optional). If not specified one will be generated.",
+          "launch_stage": "GA"
+        },
+        "params": {
+          "description": "Parameters attached to the model.",
+          "launch_stage": "GA"
+        },
+        "source_run_id": {
+          "description": "The ID of the run that created the model.",
+          "launch_stage": "GA"
+        },
+        "tags": {
+          "description": "Tags attached to the model.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.CreateLoggedModelResponse": {
+      "fields": {
+        "model": {
+          "description": "The newly created logged model.",
+          "ref": "ml.LoggedModel",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.CreateMaterializedFeatureRequest": {
+      "fields": {
+        "materialized_feature": {
+          "description": "The materialized feature to create.",
+          "ref": "ml.MaterializedFeature",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.CreateModelRequest": {
+      "fields": {
+        "description": {
+          "description": "Optional description for registered model.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Register models under this name",
+          "launch_stage": "GA"
+        },
+        "tags": {
+          "description": "Additional metadata for registered model.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.CreateModelResponse": {
+      "fields": {
+        "registered_model": {
+          "ref": "ml.Model",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.CreateModelVersionRequest": {
+      "fields": {
+        "description": {
+          "description": "Optional description for model version.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Register model under this name",
+          "launch_stage": "GA"
+        },
+        "run_id": {
+          "description": "MLflow run ID for correlation, if `source` was generated by an experiment run in\nMLflow tracking server",
+          "launch_stage": "GA"
+        },
+        "run_link": {
+          "description": "MLflow run link - this is the exact link of the run that generated this model version,\npotentially hosted at another instance of MLflow.",
+          "launch_stage": "GA"
+        },
+        "source": {
+          "description": "URI indicating the location of the model artifacts.",
+          "launch_stage": "GA"
+        },
+        "tags": {
+          "description": "Additional metadata for model version.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.CreateModelVersionResponse": {
+      "fields": {
+        "model_version": {
+          "description": "Return new version number generated for this model in registry.",
+          "ref": "ml.ModelVersion",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.CreateOnlineStoreRequest": {
+      "fields": {
+        "online_store": {
+          "description": "Online store to create.",
+          "ref": "ml.OnlineStore",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "ml.CreateRegistryWebhook": {
+      "description": "Details required to create a registry webhook.",
+      "fields": {
+        "description": {
+          "description": "User-specified description for the webhook.",
+          "launch_stage": "GA"
+        },
+        "events": {
+          "description": "Events that can trigger a registry webhook:\n* `MODEL_VERSION_CREATED`: A new model version was created for the associated model.\n\n* `MODEL_VERSION_TRANSITIONED_STAGE`: A model version’s stage was changed.\n\n* `TRANSITION_REQUEST_CREATED`: A user requested a model version’s stage be transitioned.\n\n* `COMMENT_CREATED`: A user wrote a comment on a registered model.\n\n* `REGISTERED_MODEL_CREATED`: A new registered model was created. This event type can only be specified for a registry-wide webhook, which can be created by not specifying a model name in the create request.\n\n* `MODEL_VERSION_TAG_SET`: A user set a tag on the model version.\n\n* `MODEL_VERSION_TRANSITIONED_TO_STAGING`: A model version was transitioned to staging.\n\n* `MODEL_VERSION_TRANSITIONED_TO_PRODUCTION`: A model version was transitioned to production.\n\n* `MODEL_VERSION_TRANSITIONED_TO_ARCHIVED`: A model version was archived.\n\n* `TRANSITION_REQUEST_TO_STAGING_CREATED`: A user requested a model version be transitioned to staging.\n\n* `TRANSITION_REQUEST_TO_PRODUCTION_CREATED`: A user requested a model version be transitioned to production.\n\n* `TRANSITION_REQUEST_TO_ARCHIVED_CREATED`: A user requested a model version be archived.",
+          "launch_stage": "GA"
+        },
+        "http_url_spec": {
+          "description": "External HTTPS URL called on event trigger (by using a POST request).",
+          "ref": "ml.HttpUrlSpec",
+          "launch_stage": "GA"
+        },
+        "job_spec": {
+          "description": "ID of the job that the webhook runs.",
+          "ref": "ml.JobSpec",
+          "launch_stage": "GA"
+        },
+        "model_name": {
+          "description": "If model name is not specified, a registry-wide webhook is created that listens for the specified events across all versions of all registered models.",
+          "launch_stage": "GA"
+        },
+        "status": {
+          "description": "Enable or disable triggering the webhook, or put the webhook into test mode. The default is `ACTIVE`:\n* `ACTIVE`: Webhook is triggered when an associated event happens.\n\n* `DISABLED`: Webhook is not triggered.\n\n* `TEST_MODE`: Webhook can be triggered through the test endpoint, but is not triggered on a real event.",
+          "ref": "ml.RegistryWebhookStatus",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.CreateRun": {
+      "fields": {
+        "experiment_id": {
+          "description": "ID of the associated experiment.",
+          "launch_stage": "GA"
+        },
+        "run_name": {
+          "description": "The name of the run.",
+          "launch_stage": "GA"
+        },
+        "start_time": {
+          "description": "Unix timestamp in milliseconds of when the run started.",
+          "launch_stage": "GA"
+        },
+        "tags": {
+          "description": "Additional metadata for run.",
+          "launch_stage": "GA"
+        },
+        "user_id": {
+          "description": "ID of the user executing the run.\nThis field is deprecated as of MLflow 1.0, and will be removed in a future\nMLflow release. Use 'mlflow.user' tag instead.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.CreateRunResponse": {
+      "fields": {
+        "run": {
+          "description": "The newly created run.",
+          "ref": "ml.Run",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.CreateStreamRequest": {
+      "fields": {
+        "stream": {
+          "description": "The Stream to create.",
+          "ref": "ml.Stream",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.CreateTransitionRequest": {
+      "description": "Details required to create a model version stage transition request.",
+      "fields": {
+        "comment": {
+          "description": "User-provided comment on the action.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of the model.",
+          "launch_stage": "GA"
+        },
+        "stage": {
+          "description": "Target stage of the transition. Valid values are:\n\n* `None`: The initial stage of a model version.\n\n* `Staging`: Staging or pre-production stage.\n\n* `Production`: Production stage.\n\n* `Archived`: Archived stage.",
+          "launch_stage": "GA"
+        },
+        "version": {
+          "description": "Version of the model.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.CreateTransitionRequestResponse": {
+      "fields": {
+        "request": {
+          "description": "New activity generated for stage transition request.",
+          "ref": "ml.TransitionRequest",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.CreateWebhookResponse": {
+      "fields": {
+        "webhook": {
+          "ref": "ml.RegistryWebhook",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.CronSchedule": {
+      "description": "A cron-based schedule trigger for the materialization pipeline.",
+      "fields": {
+        "cron_expression": {
+          "description": "The cron expression defining the schedule (e.g., \"0 0 * * *\" for daily at midnight). The\nschedule is interpreted in timezone_id (defaults to UTC). Required when mode is MANUAL (or\nunset). Left empty when mode is DERIVED, where the service computes it (aligned to UTC) from\nthe features' window timing and fills it in on the response.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "mode": {
+          "description": "How the schedule is determined. Defaults to MANUAL when unset.",
+          "ref": "ml.CronScheduleMode",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "timezone_id": {
+          "description": "A Java timezone ID. The schedule is resolved with respect to this timezone. Defaults to UTC\nwhen omitted. Can only be configured for MANUAL schedules; DERIVED schedules are always aligned\nto UTC.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.CronScheduleMode": {
+      "description": "The way a materialization schedule is arrived at.",
+      "enum": [
+        "MANUAL",
+        "DERIVED"
+      ],
+      "enum_launch_stages": {
+        "DERIVED": "PRIVATE_PREVIEW",
+        "MANUAL": "PRIVATE_PREVIEW"
+      }
+    },
+    "ml.CustomUdf": {
+      "description": "A CustomUdf function applies a registered Unity Catalog function row-wise to\nsource columns, producing a single output column per row.",
+      "fields": {
+        "function_path": {
+          "description": "Fully qualified 3-part Unity Catalog path of the function to apply.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "input_bindings": {
+          "description": "Binds each UC function parameter to a source column.\nMay be empty for zero-argument functions (e.g. a timestamp generator).",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.DataSource": {
+      "description": "Specifies the data source backing a feature. Exactly one source type must be set.",
+      "fields": {
+        "delta_table_source": {
+          "description": "A Delta table data source.",
+          "ref": "ml.DeltaTableSource",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "feature_view_source": {
+          "description": "A data source composed from registered upstream Features.",
+          "ref": "ml.FeatureViewSource",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "kafka_source": {
+          "description": "A Kafka stream data source.",
+          "ref": "ml.KafkaSource",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "lateness": {
+          "description": "Completeness timing for this Feature's use of the source. This configuration is part of the\nFeature definition; it does not modify the underlying table or stream.",
+          "ref": "ml.SourceLateness",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "request_source": {
+          "description": "A request-time data source.",
+          "ref": "ml.RequestSource",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "stream_source": {
+          "description": "A Stream data source.",
+          "ref": "ml.StreamSource",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.DatabricksServiceExceptionWithDetailsProto": {
+      "description": "Databricks Error that is returned by all Databricks APIs.",
+      "fields": {
+        "details": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "error_code": {
+          "ref": "ml.ErrorCode",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "message": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "stack_trace": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "ml.Dataset": {
+      "description": "Dataset. Represents a reference to data used for training, testing, or evaluation during\nthe model development process.",
+      "fields": {
+        "digest": {
+          "description": "Dataset digest, e.g. an md5 hash of the dataset that uniquely identifies it within datasets of the same name.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The name of the dataset. E.g. “my.uc.table@2” “nyc-taxi-dataset”, “fantastic-elk-3”",
+          "launch_stage": "GA"
+        },
+        "profile": {
+          "description": "The profile of the dataset. Summary statistics for the dataset, such as the number of rows\nin a table, the mean / std / mode of each column in a table, or the number of elements\nin an array.",
+          "launch_stage": "GA"
+        },
+        "schema": {
+          "description": "The schema of the dataset. E.g., MLflow ColSpec JSON for a dataframe, MLflow TensorSpec JSON\nfor an ndarray, or another schema format.",
+          "launch_stage": "GA"
+        },
+        "source": {
+          "description": "Source information for the dataset. Note that the source may not exactly reproduce the\ndataset if it was transformed / modified before use with MLflow.",
+          "launch_stage": "GA"
+        },
+        "source_type": {
+          "description": "The type of the dataset source, e.g. ‘databricks-uc-table’, ‘DBFS’, ‘S3’, ...",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.DatasetInput": {
+      "description": "DatasetInput. Represents a dataset and input tags.",
+      "fields": {
+        "dataset": {
+          "description": "The dataset being used as a Run input.",
+          "ref": "ml.Dataset",
+          "launch_stage": "GA"
+        },
+        "tags": {
+          "description": "A list of tags for the dataset input, e.g. a “context” tag with value “training”",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.DeleteCommentRequest": {
+      "fields": {
+        "id": {
+          "description": "Unique identifier of an activity",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.DeleteCommentResponse": {},
+    "ml.DeleteExperiment": {
+      "fields": {
+        "experiment_id": {
+          "description": "ID of the associated experiment.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.DeleteExperimentResponse": {},
+    "ml.DeleteFeatureRequest": {},
+    "ml.DeleteFeatureTagRequest": {},
+    "ml.DeleteKafkaConfigRequest": {},
+    "ml.DeleteLoggedModelRequest": {},
+    "ml.DeleteLoggedModelResponse": {},
+    "ml.DeleteLoggedModelTagRequest": {},
+    "ml.DeleteLoggedModelTagResponse": {},
+    "ml.DeleteMaterializedFeatureRequest": {},
+    "ml.DeleteModelRequest": {
+      "fields": {
+        "name": {
+          "description": "Registered model unique name identifier.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.DeleteModelResponse": {},
+    "ml.DeleteModelTagRequest": {
+      "fields": {
+        "key": {
+          "description": "Name of the tag. The name must be an exact match; wild-card deletion is not supported. Maximum size is 250 bytes.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of the registered model that the tag was logged under.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.DeleteModelTagResponse": {},
+    "ml.DeleteModelVersionRequest": {
+      "fields": {
+        "name": {
+          "description": "Name of the registered model",
+          "launch_stage": "GA"
+        },
+        "version": {
+          "description": "Model version number",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.DeleteModelVersionResponse": {},
+    "ml.DeleteModelVersionTagRequest": {
+      "fields": {
+        "key": {
+          "description": "Name of the tag. The name must be an exact match; wild-card deletion is not supported. Maximum size is 250 bytes.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of the registered model that the tag was logged under.",
+          "launch_stage": "GA"
+        },
+        "version": {
+          "description": "Model version number that the tag was logged under.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.DeleteModelVersionTagResponse": {},
+    "ml.DeleteOnlineStoreRequest": {},
+    "ml.DeleteOnlineTableRequest": {},
+    "ml.DeleteRun": {
+      "fields": {
+        "run_id": {
+          "description": "ID of the run to delete.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.DeleteRunResponse": {},
+    "ml.DeleteRuns": {
+      "fields": {
+        "experiment_id": {
+          "description": "The ID of the experiment containing the runs to delete.",
+          "launch_stage": "GA"
+        },
+        "max_runs": {
+          "description": "An optional positive integer indicating the maximum number of runs to delete. The maximum allowed value for\nmax_runs is 10000.",
+          "launch_stage": "GA"
+        },
+        "max_timestamp_millis": {
+          "description": "The maximum creation timestamp in milliseconds since the UNIX epoch for deleting runs. Only runs created prior to\nor at this timestamp are deleted.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.DeleteRunsResponse": {
+      "fields": {
+        "runs_deleted": {
+          "description": "The number of runs deleted.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.DeleteStreamRequest": {},
+    "ml.DeleteTag": {
+      "fields": {
+        "key": {
+          "description": "Name of the tag. Maximum size is 255 bytes. Must be provided.",
+          "launch_stage": "GA"
+        },
+        "run_id": {
+          "description": "ID of the run that the tag was logged under. Must be provided.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.DeleteTagResponse": {},
+    "ml.DeleteTransitionRequestRequest": {
+      "fields": {
+        "comment": {
+          "description": "User-provided comment on the action.",
+          "launch_stage": "GA"
+        },
+        "creator": {
+          "description": "Username of the user who created this request. Of the transition requests matching the specified details, only the one transition created by this user will be deleted.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of the model.",
+          "launch_stage": "GA"
+        },
+        "stage": {
+          "description": "Target stage of the transition request. Valid values are:\n\n* `None`: The initial stage of a model version.\n\n* `Staging`: Staging or pre-production stage.\n\n* `Production`: Production stage.\n\n* `Archived`: Archived stage.",
+          "launch_stage": "GA"
+        },
+        "version": {
+          "description": "Version of the model.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.DeleteTransitionRequestResponse": {
+      "fields": {
+        "activity": {
+          "description": "New activity generated as a result of this operation.",
+          "ref": "ml.Activity",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.DeleteWebhookRequest": {
+      "fields": {
+        "id": {
+          "description": "Webhook ID required to delete a registry webhook.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.DeleteWebhookResponse": {},
+    "ml.DeltaTableSource": {
+      "fields": {
+        "dataframe_schema": {
+          "description": "Schema of the resulting dataframe after transformations, in Spark StructType JSON format (from df.schema.json()).\nRequired if transformation_sql is specified.\nExample: {\"type\":\"struct\",\"fields\":[{\"name\":\"col_a\",\"type\":\"integer\",\"nullable\":true,\"metadata\":{}},{\"name\":\"col_c\",\"type\":\"integer\",\"nullable\":true,\"metadata\":{}}]}",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "entity_columns": {
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "filter_condition": {
+          "description": "Single WHERE clause to filter delta table before applying transformations. Will be row-wise evaluated, so should only include conditionals and projections.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "full_name": {
+          "description": "The full three-part (catalog, schema, table) name of the Delta table.",
+          "launch_stage": "GA"
+        },
+        "timeseries_column": {
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "transformation_sql": {
+          "description": "A single SQL SELECT expression applied after filter_condition.\nShould contains all the columns needed (eg. \"SELECT *, col_a + col_b AS col_c FROM x.y.z WHERE col_a \u003e 0\" would have `transformation_sql` \"*, col_a + col_b AS col_c\")\nIf transformation_sql is not provided, all columns of the delta table are present in the DataSource dataframe.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.DirectMtlsConfig": {
+      "description": "Direct connection configs for mTLS, as Kafka Connections do not support mTLS yet.",
+      "fields": {
+        "bootstrap_servers": {
+          "description": "A comma-separated list of host:port pairs for the Kafka bootstrap servers.",
+          "launch_stage": "GA"
+        },
+        "mtls_config": {
+          "description": "Mutual-TLS authentication configuration.",
+          "ref": "ml.MtlsConfig",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.DirectSchemas": {
+      "description": "Schema definitions provided directly on the Stream, as opposed to referencing a schema registry.\nTo resolve schemas from a registry instead, use SchemaRegistryConfig.",
+      "fields": {
+        "key_schema": {
+          "description": "Schema for the message key. This is only used for Kafka streams.\nFor Kafka, at least one of payload_schema or key_schema must be specified.",
+          "ref": "ml.SchemaConfig",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "payload_schema": {
+          "description": "Schema for the message payload. For Kafka, this is the value schema.\nUnless the platform supports another schema (e.g. keys for Kafka), this must be specified.",
+          "ref": "ml.SchemaConfig",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.EntityColumn": {
+      "fields": {
+        "name": {
+          "description": "The name of the entity column. For Kafka sources, use dot-prefixed path notation to reference\nfields within the key or value schema (e.g., \"value.user_id\", \"key.partition_key\"). For nested\nfields, the leaf node name (e.g., \"user_id\" from \"value.trip_details.user_id\") is what will\nbe present in materialized tables and expected to match at query time.\nColon-prefixed notation (e.g., \"value:user_id\") is supported for backwards\ncompatibility but is deprecated; migrate to dot notation.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.ErrorCode": {
+      "description": "Error codes returned by Databricks APIs to indicate specific failure conditions.",
+      "enum": [
+        "UNKNOWN",
+        "INTERNAL_ERROR",
+        "TEMPORARILY_UNAVAILABLE",
+        "IO_ERROR",
+        "BAD_REQUEST",
+        "SERVICE_UNDER_MAINTENANCE",
+        "WORKSPACE_TEMPORARILY_UNAVAILABLE",
+        "DEADLINE_EXCEEDED",
+        "CANCELLED",
+        "RESOURCE_EXHAUSTED",
+        "ABORTED",
+        "NOT_FOUND",
+        "ALREADY_EXISTS",
+        "UNAUTHENTICATED",
+        "UNAVAILABLE",
+        "INVALID_PARAMETER_VALUE",
+        "ENDPOINT_NOT_FOUND",
+        "MALFORMED_REQUEST",
+        "INVALID_STATE",
+        "PERMISSION_DENIED",
+        "FEATURE_DISABLED",
+        "CUSTOMER_UNAUTHORIZED",
+        "REQUEST_LIMIT_EXCEEDED",
+        "RESOURCE_CONFLICT",
+        "UNPARSEABLE_HTTP_ERROR",
+        "NOT_IMPLEMENTED",
+        "DATA_LOSS",
+        "INVALID_STATE_TRANSITION",
+        "COULD_NOT_ACQUIRE_LOCK",
+        "RESOURCE_ALREADY_EXISTS",
+        "RESOURCE_DOES_NOT_EXIST",
+        "QUOTA_EXCEEDED",
+        "MAX_BLOCK_SIZE_EXCEEDED",
+        "MAX_READ_SIZE_EXCEEDED",
+        "PARTIAL_DELETE",
+        "MAX_LIST_SIZE_EXCEEDED",
+        "DRY_RUN_FAILED",
+        "RESOURCE_LIMIT_EXCEEDED",
+        "DIRECTORY_NOT_EMPTY",
+        "DIRECTORY_PROTECTED",
+        "MAX_NOTEBOOK_SIZE_EXCEEDED",
+        "MAX_CHILD_NODE_SIZE_EXCEEDED",
+        "SEARCH_QUERY_TOO_LONG",
+        "SEARCH_QUERY_TOO_SHORT",
+        "MANAGED_RESOURCE_GROUP_DOES_NOT_EXIST",
+        "PERMISSION_NOT_PROPAGATED",
+        "DEPLOYMENT_TIMEOUT",
+        "GIT_CONFLICT",
+        "GIT_UNKNOWN_REF",
+        "GIT_SENSITIVE_TOKEN_DETECTED",
+        "GIT_URL_NOT_ON_ALLOW_LIST",
+        "GIT_REMOTE_ERROR",
+        "PROJECTS_OPERATION_TIMEOUT",
+        "IPYNB_FILE_IN_REPO",
+        "INSECURE_PARTNER_RESPONSE",
+        "MALFORMED_PARTNER_RESPONSE",
+        "METASTORE_DOES_NOT_EXIST",
+        "DAC_DOES_NOT_EXIST",
+        "CATALOG_DOES_NOT_EXIST",
+        "SCHEMA_DOES_NOT_EXIST",
+        "TABLE_DOES_NOT_EXIST",
+        "SHARE_DOES_NOT_EXIST",
+        "RECIPIENT_DOES_NOT_EXIST",
+        "STORAGE_CREDENTIAL_DOES_NOT_EXIST",
+        "EXTERNAL_LOCATION_DOES_NOT_EXIST",
+        "PRINCIPAL_DOES_NOT_EXIST",
+        "PROVIDER_DOES_NOT_EXIST",
+        "METASTORE_ALREADY_EXISTS",
+        "DAC_ALREADY_EXISTS",
+        "CATALOG_ALREADY_EXISTS",
+        "SCHEMA_ALREADY_EXISTS",
+        "TABLE_ALREADY_EXISTS",
+        "SHARE_ALREADY_EXISTS",
+        "RECIPIENT_ALREADY_EXISTS",
+        "STORAGE_CREDENTIAL_ALREADY_EXISTS",
+        "EXTERNAL_LOCATION_ALREADY_EXISTS",
+        "PROVIDER_ALREADY_EXISTS",
+        "CATALOG_NOT_EMPTY",
+        "SCHEMA_NOT_EMPTY",
+        "METASTORE_NOT_EMPTY",
+        "PROVIDER_SHARE_NOT_ACCESSIBLE"
+      ],
+      "enum_launch_stages": {
+        "ABORTED": "PRIVATE_PREVIEW",
+        "ALREADY_EXISTS": "PRIVATE_PREVIEW",
+        "BAD_REQUEST": "PRIVATE_PREVIEW",
+        "CANCELLED": "PRIVATE_PREVIEW",
+        "CATALOG_ALREADY_EXISTS": "PRIVATE_PREVIEW",
+        "CATALOG_DOES_NOT_EXIST": "PRIVATE_PREVIEW",
+        "CATALOG_NOT_EMPTY": "PRIVATE_PREVIEW",
+        "COULD_NOT_ACQUIRE_LOCK": "PRIVATE_PREVIEW",
+        "CUSTOMER_UNAUTHORIZED": "PRIVATE_PREVIEW",
+        "DAC_ALREADY_EXISTS": "PRIVATE_PREVIEW",
+        "DAC_DOES_NOT_EXIST": "PRIVATE_PREVIEW",
+        "DATA_LOSS": "PRIVATE_PREVIEW",
+        "DEADLINE_EXCEEDED": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_TIMEOUT": "PRIVATE_PREVIEW",
+        "DIRECTORY_NOT_EMPTY": "PRIVATE_PREVIEW",
+        "DIRECTORY_PROTECTED": "PRIVATE_PREVIEW",
+        "DRY_RUN_FAILED": "PRIVATE_PREVIEW",
+        "ENDPOINT_NOT_FOUND": "PRIVATE_PREVIEW",
+        "EXTERNAL_LOCATION_ALREADY_EXISTS": "PRIVATE_PREVIEW",
+        "EXTERNAL_LOCATION_DOES_NOT_EXIST": "PRIVATE_PREVIEW",
+        "FEATURE_DISABLED": "PRIVATE_PREVIEW",
+        "GIT_CONFLICT": "PRIVATE_PREVIEW",
+        "GIT_REMOTE_ERROR": "PRIVATE_PREVIEW",
+        "GIT_SENSITIVE_TOKEN_DETECTED": "PRIVATE_PREVIEW",
+        "GIT_UNKNOWN_REF": "PRIVATE_PREVIEW",
+        "GIT_URL_NOT_ON_ALLOW_LIST": "PRIVATE_PREVIEW",
+        "INSECURE_PARTNER_RESPONSE": "PRIVATE_PREVIEW",
+        "INTERNAL_ERROR": "PRIVATE_PREVIEW",
+        "INVALID_PARAMETER_VALUE": "PRIVATE_PREVIEW",
+        "INVALID_STATE": "PRIVATE_PREVIEW",
+        "INVALID_STATE_TRANSITION": "PRIVATE_PREVIEW",
+        "IO_ERROR": "PRIVATE_PREVIEW",
+        "IPYNB_FILE_IN_REPO": "PRIVATE_PREVIEW",
+        "MALFORMED_PARTNER_RESPONSE": "PRIVATE_PREVIEW",
+        "MALFORMED_REQUEST": "PRIVATE_PREVIEW",
+        "MANAGED_RESOURCE_GROUP_DOES_NOT_EXIST": "PRIVATE_PREVIEW",
+        "MAX_BLOCK_SIZE_EXCEEDED": "PRIVATE_PREVIEW",
+        "MAX_CHILD_NODE_SIZE_EXCEEDED": "PRIVATE_PREVIEW",
+        "MAX_LIST_SIZE_EXCEEDED": "PRIVATE_PREVIEW",
+        "MAX_NOTEBOOK_SIZE_EXCEEDED": "PRIVATE_PREVIEW",
+        "MAX_READ_SIZE_EXCEEDED": "PRIVATE_PREVIEW",
+        "METASTORE_ALREADY_EXISTS": "PRIVATE_PREVIEW",
+        "METASTORE_DOES_NOT_EXIST": "PRIVATE_PREVIEW",
+        "METASTORE_NOT_EMPTY": "PRIVATE_PREVIEW",
+        "NOT_FOUND": "PRIVATE_PREVIEW",
+        "NOT_IMPLEMENTED": "PRIVATE_PREVIEW",
+        "PARTIAL_DELETE": "PRIVATE_PREVIEW",
+        "PERMISSION_DENIED": "PRIVATE_PREVIEW",
+        "PERMISSION_NOT_PROPAGATED": "PRIVATE_PREVIEW",
+        "PRINCIPAL_DOES_NOT_EXIST": "PRIVATE_PREVIEW",
+        "PROJECTS_OPERATION_TIMEOUT": "PRIVATE_PREVIEW",
+        "PROVIDER_ALREADY_EXISTS": "PRIVATE_PREVIEW",
+        "PROVIDER_DOES_NOT_EXIST": "PRIVATE_PREVIEW",
+        "PROVIDER_SHARE_NOT_ACCESSIBLE": "PRIVATE_PREVIEW",
+        "QUOTA_EXCEEDED": "PRIVATE_PREVIEW",
+        "RECIPIENT_ALREADY_EXISTS": "PRIVATE_PREVIEW",
+        "RECIPIENT_DOES_NOT_EXIST": "PRIVATE_PREVIEW",
+        "REQUEST_LIMIT_EXCEEDED": "PRIVATE_PREVIEW",
+        "RESOURCE_ALREADY_EXISTS": "PRIVATE_PREVIEW",
+        "RESOURCE_CONFLICT": "PRIVATE_PREVIEW",
+        "RESOURCE_DOES_NOT_EXIST": "PRIVATE_PREVIEW",
+        "RESOURCE_EXHAUSTED": "PRIVATE_PREVIEW",
+        "RESOURCE_LIMIT_EXCEEDED": "PRIVATE_PREVIEW",
+        "SCHEMA_ALREADY_EXISTS": "PRIVATE_PREVIEW",
+        "SCHEMA_DOES_NOT_EXIST": "PRIVATE_PREVIEW",
+        "SCHEMA_NOT_EMPTY": "PRIVATE_PREVIEW",
+        "SEARCH_QUERY_TOO_LONG": "PRIVATE_PREVIEW",
+        "SEARCH_QUERY_TOO_SHORT": "PRIVATE_PREVIEW",
+        "SERVICE_UNDER_MAINTENANCE": "PRIVATE_PREVIEW",
+        "SHARE_ALREADY_EXISTS": "PRIVATE_PREVIEW",
+        "SHARE_DOES_NOT_EXIST": "PRIVATE_PREVIEW",
+        "STORAGE_CREDENTIAL_ALREADY_EXISTS": "PRIVATE_PREVIEW",
+        "STORAGE_CREDENTIAL_DOES_NOT_EXIST": "PRIVATE_PREVIEW",
+        "TABLE_ALREADY_EXISTS": "PRIVATE_PREVIEW",
+        "TABLE_DOES_NOT_EXIST": "PRIVATE_PREVIEW",
+        "TEMPORARILY_UNAVAILABLE": "PRIVATE_PREVIEW",
+        "UNAUTHENTICATED": "PRIVATE_PREVIEW",
+        "UNAVAILABLE": "PRIVATE_PREVIEW",
+        "UNKNOWN": "PRIVATE_PREVIEW",
+        "UNPARSEABLE_HTTP_ERROR": "PRIVATE_PREVIEW",
+        "WORKSPACE_TEMPORARILY_UNAVAILABLE": "PRIVATE_PREVIEW"
+      }
+    },
+    "ml.Experiment": {
+      "description": "An experiment and its metadata.",
+      "fields": {
+        "artifact_location": {
+          "description": "Location where artifacts for the experiment are stored.",
+          "launch_stage": "GA"
+        },
+        "creation_time": {
+          "description": "Creation time",
+          "launch_stage": "GA"
+        },
+        "experiment_id": {
+          "description": "Unique identifier for the experiment.",
+          "launch_stage": "GA"
+        },
+        "last_update_time": {
+          "description": "Last update time",
+          "launch_stage": "GA"
+        },
+        "lifecycle_stage": {
+          "description": "Current life cycle stage of the experiment: \"active\" or \"deleted\".\nDeleted experiments are not returned by APIs.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Human readable name that identifies the experiment.",
+          "launch_stage": "GA"
+        },
+        "tags": {
+          "description": "Tags: Additional metadata key-value pairs.",
+          "launch_stage": "GA"
+        },
+        "trace_location": {
+          "description": "The location where the experiment's traces are stored. Unset when traces\nare stored in the default MLflow backend. This field cannot be updated\nafter the experiment is created.",
+          "ref": "ml.ExperimentTraceLocation",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        }
+      }
+    },
+    "ml.ExperimentAccessControlRequest": {
+      "fields": {
+        "group_name": {
+          "description": "name of the group",
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "ml.ExperimentPermissionLevel",
+          "launch_stage": "GA"
+        },
+        "service_principal_name": {
+          "description": "application ID of a service principal",
+          "launch_stage": "GA"
+        },
+        "user_name": {
+          "description": "name of the user",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.ExperimentAccessControlResponse": {
+      "fields": {
+        "all_permissions": {
+          "description": "All permissions.",
+          "launch_stage": "GA"
+        },
+        "display_name": {
+          "description": "Display name of the user or service principal.",
+          "launch_stage": "GA"
+        },
+        "group_name": {
+          "description": "name of the group",
+          "launch_stage": "GA"
+        },
+        "service_principal_name": {
+          "description": "Name of the service principal.",
+          "launch_stage": "GA"
+        },
+        "user_name": {
+          "description": "name of the user",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.ExperimentPermission": {
+      "fields": {
+        "inherited": {
+          "launch_stage": "GA"
+        },
+        "inherited_from_object": {
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "ml.ExperimentPermissionLevel",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.ExperimentPermissionLevel": {
+      "description": "Permission level",
+      "enum": [
+        "CAN_MANAGE",
+        "CAN_EDIT",
+        "CAN_READ"
+      ]
+    },
+    "ml.ExperimentPermissions": {
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "GA"
+        },
+        "object_id": {
+          "launch_stage": "GA"
+        },
+        "object_type": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.ExperimentPermissionsDescription": {
+      "fields": {
+        "description": {
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "ml.ExperimentPermissionLevel",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.ExperimentPermissionsRequest": {
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.ExperimentTag": {
+      "description": "A tag for an experiment.",
+      "fields": {
+        "key": {
+          "description": "The tag key.",
+          "launch_stage": "GA"
+        },
+        "value": {
+          "description": "The tag value.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.ExperimentTraceLocation": {
+      "description": "The storage location for an experiment's traces.",
+      "fields": {
+        "uc_trace_location": {
+          "description": "A Unity Catalog schema where the experiment's traces are stored as\nDelta tables.",
+          "ref": "ml.UcTraceLocation",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "ml.Feature": {
+      "fields": {
+        "catalog_name": {
+          "description": "Name of parent catalog.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "created_at": {
+          "description": "Time at which this feature was created.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "created_by": {
+          "description": "Username of the feature creator.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "description": {
+          "description": "The description of the feature.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "entities": {
+          "description": "The entity columns for the feature, used as aggregation keys and for query-time lookup.\nOptional since entities are not set for RequestSource features or on-demand calculated features.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE",
+            "OPTIONAL"
+          ]
+        },
+        "filter_condition": {
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE",
+            "OPTIONAL"
+          ]
+        },
+        "full_name": {
+          "description": "The full three-part name (catalog, schema, name) of the feature.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "function": {
+          "description": "The function by which the feature is computed.",
+          "ref": "ml.Function",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "inputs": {
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE",
+            "OPTIONAL"
+          ]
+        },
+        "lineage_context": {
+          "description": "Lineage context information for this feature.\nWARNING: This field is primarily intended for internal use by Databricks systems and\nis automatically populated when features are created through Databricks notebooks or jobs.\nUsers should not manually set this field as incorrect values may lead to inaccurate lineage tracking or unexpected behavior.\nThis field will be set by feature-engineering client and should be left unset by SDK and terraform users.",
+          "ref": "ml.LineageContext",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE",
+            "INPUT_ONLY",
+            "OPTIONAL"
+          ]
+        },
+        "name": {
+          "description": "Name of the feature, extracted from the full three-part name (catalog.schema.name).",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "schema_name": {
+          "description": "Name of parent schema relative to its parent catalog.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "source": {
+          "description": "The data source of the feature.",
+          "ref": "ml.DataSource",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "time_window": {
+          "ref": "ml.TimeWindow",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE",
+            "OPTIONAL"
+          ]
+        },
+        "timeseries_column": {
+          "description": "Column recording time, used for point-in-time joins, backfills, and aggregations.\nOptional since a timeseries column is not set for RequestSource features or on-demand\ncalculated features.",
+          "ref": "ml.TimeseriesColumn",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE",
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.FeatureLineage": {
+      "fields": {
+        "feature_specs": {
+          "description": "List of feature specs that contain this feature.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "models": {
+          "description": "List of Unity Catalog models that were trained on this feature.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "online_features": {
+          "description": "List of online features that use this feature as source.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "ml.FeatureLineageFeatureSpec": {
+      "fields": {
+        "name": {
+          "description": "The full name of the feature spec in Unity Catalog.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "ml.FeatureLineageModel": {
+      "fields": {
+        "name": {
+          "description": "The full name of the model in Unity Catalog.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "version": {
+          "description": "The version of the model.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "ml.FeatureLineageOnlineFeature": {
+      "fields": {
+        "feature_name": {
+          "description": "The name of the online feature (column name).",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "table_name": {
+          "description": "The full name of the online table in Unity Catalog.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "ml.FeatureList": {
+      "description": "Feature list wrap all the features for a model version",
+      "fields": {
+        "features": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.FeatureReference": {
+      "description": "A reference to one registered upstream Feature. A message rather than a bare name so an\nupstream can later be pinned more precisely (e.g. by version) without a breaking type change.",
+      "fields": {
+        "feature": {
+          "description": "The three-part full name of the upstream Feature.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "ml.FeatureTag": {
+      "description": "Represents a tag on a feature in a feature table.",
+      "fields": {
+        "key": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "value": {
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.FeatureViewSource": {
+      "description": "A data source composed from registered upstream Features.",
+      "fields": {
+        "feature_references": {
+          "description": "The upstream Features this source reads. Must include at least one feature.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.FieldDefinition": {
+      "description": "A single field definition within a FlatSchema, specifying the field name and its scalar data type.\nDoes not support nested or complex types (arrays, maps, structs).",
+      "fields": {
+        "data_type": {
+          "description": "The scalar data type of the field.",
+          "ref": "ml.ScalarDataType",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The name of the field.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.FileInfo": {
+      "description": "Metadata of a single artifact file or directory.",
+      "fields": {
+        "file_size": {
+          "description": "The size in bytes of the file. Unset for directories.",
+          "launch_stage": "GA"
+        },
+        "is_dir": {
+          "description": "Whether the path is a directory.",
+          "launch_stage": "GA"
+        },
+        "path": {
+          "description": "The path relative to the root artifact directory run.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.FinalizeLoggedModelRequest": {
+      "fields": {
+        "status": {
+          "description": "Whether or not the model is ready for use. ``\"LOGGED_MODEL_UPLOAD_FAILED\"`` indicates that something went wrong\nwhen logging the model weights / agent code.",
+          "ref": "ml.LoggedModelStatus",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.FinalizeLoggedModelResponse": {
+      "fields": {
+        "model": {
+          "description": "The updated logged model.",
+          "ref": "ml.LoggedModel",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.FirstDistinctFunction": {
+      "description": "Returns the first N distinct values, ordered by the feature's timeseries column.",
+      "fields": {
+        "input": {
+          "description": "The input column from which the first N distinct values are returned.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "n": {
+          "description": "The number of distinct values to return.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "ml.FirstFunction": {
+      "description": "Returns the first value.",
+      "fields": {
+        "input": {
+          "description": "The input column from which the first value is returned.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.FirstNFunction": {
+      "description": "Returns the first N values, ordered by the feature's timeseries column.",
+      "fields": {
+        "input": {
+          "description": "The input column from which the first N values are returned.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "n": {
+          "description": "The number of values to return.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "ml.FlatSchema": {
+      "description": "A flat (non-nested) schema for request-time fields, defined as an ordered list of field definitions.\nThis schema only supports scalar types.",
+      "fields": {
+        "fields": {
+          "description": "The list of fields in this schema.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.ForecastingExperiment": {
+      "description": "Represents a forecasting experiment with its unique identifier, URL, and state.",
+      "fields": {
+        "experiment_id": {
+          "description": "The unique ID for the forecasting experiment.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "experiment_page_url": {
+          "description": "The URL to the forecasting experiment page.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "state": {
+          "description": "The current state of the forecasting experiment.",
+          "ref": "ml.ForecastingExperimentState",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "ml.ForecastingExperimentState": {
+      "enum": [
+        "PENDING",
+        "RUNNING",
+        "SUCCEEDED",
+        "FAILED",
+        "CANCELLED"
+      ],
+      "enum_launch_stages": {
+        "CANCELLED": "PRIVATE_PREVIEW",
+        "FAILED": "PRIVATE_PREVIEW",
+        "PENDING": "PRIVATE_PREVIEW",
+        "RUNNING": "PRIVATE_PREVIEW",
+        "SUCCEEDED": "PRIVATE_PREVIEW"
+      }
+    },
+    "ml.Function": {
+      "fields": {
+        "aggregation_function": {
+          "description": "An aggregation function applied over a time window.",
+          "ref": "ml.AggregationFunction",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "column_selection": {
+          "description": "Selects the latest value of a single column in a data source",
+          "ref": "ml.ColumnSelection",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "custom_udf": {
+          "description": "Applies a registered Unity Catalog function row-wise to source columns.",
+          "ref": "ml.CustomUdf",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "extra_parameters": {
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "function_type": {
+          "ref": "ml.FunctionFunctionType",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.FunctionExtraParameter": {
+      "fields": {
+        "key": {
+          "description": "The name of the parameter.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "value": {
+          "description": "The value of the parameter.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "ml.FunctionFunctionType": {
+      "enum": [
+        "FUNCTION_TYPE_UNSPECIFIED",
+        "AVG",
+        "COUNT",
+        "SUM",
+        "MIN",
+        "MAX",
+        "FIRST",
+        "LAST",
+        "APPROX_COUNT_DISTINCT",
+        "APPROX_PERCENTILE",
+        "STDDEV_POP",
+        "STDDEV_SAMP",
+        "VAR_POP",
+        "VAR_SAMP"
+      ],
+      "enum_launch_stages": {
+        "APPROX_COUNT_DISTINCT": "PRIVATE_PREVIEW",
+        "APPROX_PERCENTILE": "PRIVATE_PREVIEW",
+        "AVG": "PRIVATE_PREVIEW",
+        "COUNT": "PRIVATE_PREVIEW",
+        "FIRST": "PRIVATE_PREVIEW",
+        "FUNCTION_TYPE_UNSPECIFIED": "PRIVATE_PREVIEW",
+        "LAST": "PRIVATE_PREVIEW",
+        "MAX": "PRIVATE_PREVIEW",
+        "MIN": "PRIVATE_PREVIEW",
+        "STDDEV_POP": "PRIVATE_PREVIEW",
+        "STDDEV_SAMP": "PRIVATE_PREVIEW",
+        "SUM": "PRIVATE_PREVIEW",
+        "VAR_POP": "PRIVATE_PREVIEW",
+        "VAR_SAMP": "PRIVATE_PREVIEW"
+      }
+    },
+    "ml.GetByNameRequest": {
+      "fields": {
+        "experiment_name": {
+          "description": "Name of the associated experiment.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.GetExperimentByNameResponse": {
+      "fields": {
+        "experiment": {
+          "description": "Experiment details.",
+          "ref": "ml.Experiment",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.GetExperimentPermissionLevelsRequest": {},
+    "ml.GetExperimentPermissionLevelsResponse": {
+      "fields": {
+        "permission_levels": {
+          "description": "Specific permission levels",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.GetExperimentPermissionsRequest": {},
+    "ml.GetExperimentRequest": {
+      "fields": {
+        "experiment_id": {
+          "description": "ID of the associated experiment.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.GetExperimentResponse": {
+      "fields": {
+        "experiment": {
+          "description": "Experiment details.",
+          "ref": "ml.Experiment",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.GetFeatureLineageRequest": {},
+    "ml.GetFeatureRequest": {},
+    "ml.GetFeatureTagRequest": {},
+    "ml.GetForecastingExperimentRequest": {},
+    "ml.GetHistoryRequest": {
+      "fields": {
+        "max_results": {
+          "description": "Maximum number of Metric records to return per paginated request. Default is set to 25,000. If set higher than\n25,000, a request Exception will be raised.",
+          "launch_stage": "GA"
+        },
+        "metric_key": {
+          "description": "Name of the metric.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Token indicating the page of metric histories to fetch.",
+          "launch_stage": "GA"
+        },
+        "run_id": {
+          "description": "ID of the run from which to fetch metric values. Must be provided.",
+          "launch_stage": "GA"
+        },
+        "run_uuid": {
+          "description": "[Deprecated, use `run_id` instead] ID of the run from which to fetch metric values. This field\nwill be removed in a future MLflow version.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.GetIssueRequest": {},
+    "ml.GetKafkaConfigRequest": {},
+    "ml.GetLatestVersionsRequest": {
+      "fields": {
+        "name": {
+          "description": "Registered model unique name identifier.",
+          "launch_stage": "GA"
+        },
+        "stages": {
+          "description": "List of stages.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.GetLatestVersionsResponse": {
+      "fields": {
+        "model_versions": {
+          "description": "Latest version models for each requests stage. Only return models with current `READY` status.\nIf no `stages` provided, returns the latest version for each stage, including `\"None\"`.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.GetLoggedModelRequest": {},
+    "ml.GetLoggedModelResponse": {
+      "fields": {
+        "model": {
+          "description": "The retrieved logged model.",
+          "ref": "ml.LoggedModel",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.GetMaterializedFeatureRequest": {},
+    "ml.GetMetricHistoryResponse": {
+      "fields": {
+        "metrics": {
+          "description": "All logged values for this metric if `max_results` is not specified in the request or if the total count of\nmetrics returned is less than the service level pagination threshold. Otherwise, this is one page of results.",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "A token that can be used to issue a query for the next page of metric history values. A missing token indicates\nthat no additional metrics are available to fetch.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.GetModelRequest": {
+      "fields": {
+        "name": {
+          "description": "Registered model unique name identifier.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.GetModelResponse": {
+      "fields": {
+        "registered_model_databricks": {
+          "ref": "ml.ModelDatabricks",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.GetModelVersionDownloadUriRequest": {
+      "fields": {
+        "name": {
+          "description": "Name of the registered model",
+          "launch_stage": "GA"
+        },
+        "version": {
+          "description": "Model version number",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.GetModelVersionDownloadUriResponse": {
+      "fields": {
+        "artifact_uri": {
+          "description": "URI corresponding to where artifacts for this model version are stored.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.GetModelVersionRequest": {
+      "fields": {
+        "name": {
+          "description": "Name of the registered model",
+          "launch_stage": "GA"
+        },
+        "version": {
+          "description": "Model version number",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.GetModelVersionResponse": {
+      "fields": {
+        "model_version": {
+          "ref": "ml.ModelVersion",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.GetOnlineStoreRequest": {},
+    "ml.GetOperationRequest": {},
+    "ml.GetRegisteredModelPermissionLevelsRequest": {},
+    "ml.GetRegisteredModelPermissionLevelsResponse": {
+      "fields": {
+        "permission_levels": {
+          "description": "Specific permission levels",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.GetRegisteredModelPermissionsRequest": {},
+    "ml.GetRunRequest": {
+      "fields": {
+        "run_id": {
+          "description": "ID of the run to fetch. Must be provided.",
+          "launch_stage": "GA"
+        },
+        "run_uuid": {
+          "description": "[Deprecated, use `run_id` instead] ID of the run to fetch. This field will\nbe removed in a future MLflow version.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.GetRunResponse": {
+      "fields": {
+        "run": {
+          "description": "Run metadata (name, start time, etc) and data (metrics, params, and tags).",
+          "ref": "ml.Run",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.GetStreamRequest": {},
+    "ml.HttpUrlSpec": {
+      "fields": {
+        "authorization": {
+          "description": "Value of the authorization header that should be sent in the request sent by the wehbook. It should be of the form `\"\u003cauth type\u003e \u003ccredentials\u003e\"`. If set to an empty string, no authorization header will be included in the request.",
+          "launch_stage": "GA"
+        },
+        "enable_ssl_verification": {
+          "description": "Enable/disable SSL certificate validation. Default is true. For self-signed certificates, this field must be false AND the destination server must disable certificate validation as well. For security purposes, it is encouraged to perform secret validation with the HMAC-encoded portion of the payload and acknowledge the risk associated with disabling hostname validation whereby it becomes more likely that requests can be maliciously routed to an unintended host.",
+          "launch_stage": "GA"
+        },
+        "secret": {
+          "description": "Shared secret required for HMAC encoding payload. The HMAC-encoded payload will be sent in the header as: { \"X-Databricks-Signature\": $encoded_payload }.",
+          "launch_stage": "GA"
+        },
+        "url": {
+          "description": "External HTTPS URL called on event trigger (by using a POST request).",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.HttpUrlSpecWithoutSecret": {
+      "fields": {
+        "enable_ssl_verification": {
+          "description": "Enable/disable SSL certificate validation. Default is true. For self-signed certificates, this field must be false AND the destination server must disable certificate validation as well. For security purposes, it is encouraged to perform secret validation with the HMAC-encoded portion of the payload and acknowledge the risk associated with disabling hostname validation whereby it becomes more likely that requests can be maliciously routed to an unintended host.",
+          "launch_stage": "GA"
+        },
+        "url": {
+          "description": "External HTTPS URL called on event trigger (by using a POST request).",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.IngestionConfig": {
+      "description": "Configuration for the Databricks-managed ingestion pipeline.\nGroups the ingestion destination (required) and optional backfill source.",
+      "fields": {
+        "backfill_job_id": {
+          "description": "The ID of the Databricks Job that performs the historical backfill of the ingestion Delta table.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "backfill_source": {
+          "description": "A user-provided source for backfilling data. Historical data is used when creating a training set from streaming features linked to this Stream.\nThe backfill data stored in this location will be copied into the ingestion table for offline querying and training.\nThe schema for this source must match exactly that of the key and payload schemas specified for this Stream,\nexcept that it may omit any columns listed in excluded_columns.",
+          "ref": "ml.BackfillSource",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "budget_policy_id": {
+          "description": "The ID of the budget policy used to attribute the serverless compute cost of this stream's\nmanaged ingestion. If not specified, a default budget policy may be applied.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "deduplication_columns": {
+          "description": "Column paths used to identify duplicate rows during ingestion; only one row per\ndistinct combination of these values is kept. Use dot notation for nested fields\n(e.g. `value.user_id`). Empty list means every column is compared.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "ingestion_destination": {
+          "description": "Destination for the Databricks-managed Delta table that holds an offline copy of the streaming data for querying and training.\nThis table contains both 1) forward-filled data from the Stream and 2) backfilled data from the BackfillSource (if provided).\nThis table is created and managed by Databricks and is deleted when the Stream is deleted.",
+          "ref": "ml.IngestionDestination",
+          "launch_stage": "GA"
+        },
+        "ingestion_job_id": {
+          "description": "The ID of the Databricks Job that performs the forward-fill ingestion.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "ingestion_pipeline_id": {
+          "description": "The ID of the SDP pipeline that continuously copies new events from the streaming source\ninto the ingestion Delta table.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "tags": {
+          "description": "Custom tags to associate with this stream's managed ingestion. They are applied to the\ningestion pipeline and its forward-fill and backfill jobs, and forwarded to the underlying\ncompute as cluster tags, so ingestion cost can be attributed in the billing system tables.\nThese tags apply only to the managed ingestion compute; they are not applied to the Stream\nentity itself, and are distinct from any Unity Catalog tags on the Stream.\nA maximum of 25 tags is supported; keys and values are subject to the same limitations as\ncluster tags.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.IngestionDestination": {
+      "description": "Destination for the Databricks-managed Delta table that holds an offline copy of the streaming data for querying and training.",
+      "fields": {
+        "delta_table_name": {
+          "description": "The full three-part name (catalog, schema, name) of the Delta table to be created for ingestion.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.InputBinding": {
+      "description": "Binds a single UC function parameter to a source column.",
+      "fields": {
+        "column": {
+          "description": "Source column whose value is passed for this parameter at execution time.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "parameter": {
+          "description": "Name of the UC function parameter.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "ml.InputTag": {
+      "description": "Tag for a dataset input.",
+      "fields": {
+        "key": {
+          "description": "The tag key.",
+          "launch_stage": "GA"
+        },
+        "value": {
+          "description": "The tag value.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.Issue": {
+      "description": "A quality or operational problem found in an experiment's traces.",
+      "fields": {
+        "categories": {
+          "description": "At most 10 values of at most 64 UTF-8 bytes each, unique case-insensitively.\nLeading and trailing whitespace is trimmed.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "create_time": {
+          "description": "When the Issue was created.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "created_by": {
+          "description": "The email of the user whose request created the Issue. source_type tells\nwhether issue detection created it.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "description": {
+          "description": "Markdown, at most 32 KiB.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "issue_id": {
+          "description": "The last segment of `name`. Issue assessments on traces reference the Issue\nby this ID.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "last_seen_time": {
+          "description": "The request time of the latest trace the Issue affects. Required, and can't\nbe cleared, unless source_type is MANUAL. A MANUAL Issue without one returns\nits create_time.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "last_updated_by": {
+          "description": "The email of the user whose request last updated the Issue.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "metadata": {
+          "description": "Additional details about the Issue, such as how issue detection observed it.\nNot a stable contract: keys and values can change without notice, so clients\nmust tolerate unknown and missing keys. At most 20 entries, with keys of at\nmost 64 UTF-8 bytes.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "name": {
+          "description": "experiments/{experiment}/issues/{issue}",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "severity": {
+          "description": "Cannot be cleared: an Issue without a severity would match no severity filter.",
+          "ref": "ml.IssueSeverity",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "source_id": {
+          "description": "Set once at create. For ADHOC_RUN and SCHEDULED_RUN, the ID of the issue\ndetection run in the same experiment that created the Issue. Absent for\nMANUAL.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "source_type": {
+          "description": "Set once at create. Defaults to MANUAL.",
+          "ref": "ml.IssueSourceType",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "status": {
+          "description": "Defaults to PENDING on create, and can't be cleared.",
+          "ref": "ml.IssueStatus",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "tags": {
+          "description": "Caller-owned; the server never writes system values here. At most 10\nentries. Keys match ^[A-Za-z0-9_.:/-]+$ and are at most 128 UTF-8 bytes;\nvalues are at most 256 UTF-8 bytes.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "title": {
+          "description": "Non-empty, at most 250 UTF-8 bytes.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "update_time": {
+          "description": "When the Issue was last updated.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "ml.IssueSeverity": {
+      "description": "How serious an Issue is, ordered LOW \u003c MEDIUM \u003c HIGH.",
+      "enum": [
+        "LOW",
+        "MEDIUM",
+        "HIGH"
+      ],
+      "enum_launch_stages": {
+        "HIGH": "PUBLIC_BETA",
+        "LOW": "PUBLIC_BETA",
+        "MEDIUM": "PUBLIC_BETA"
+      }
+    },
+    "ml.IssueSortKey": {
+      "description": "The field that search results are ordered by. SEVERITY breaks ties by\nlast_seen_time, in the same direction. Results are grouped by status first\n(PENDING, RESOLVED, then REJECTED, whatever the sort_order), and remaining\nties are broken by issue ID, so paging is stable.",
+      "enum": [
+        "SEVERITY",
+        "LAST_SEEN_TIME",
+        "UPDATE_TIME",
+        "CREATE_TIME"
+      ],
+      "enum_launch_stages": {
+        "CREATE_TIME": "PUBLIC_BETA",
+        "LAST_SEEN_TIME": "PUBLIC_BETA",
+        "SEVERITY": "PUBLIC_BETA",
+        "UPDATE_TIME": "PUBLIC_BETA"
+      }
+    },
+    "ml.IssueSourceType": {
+      "description": "What created an Issue: ADHOC_RUN, an issue detection run started on demand;\nSCHEDULED_RUN, one started by a schedule; SINGLE_TRACE_ANALYSIS, an analysis\nof a single trace; or MANUAL, a person.",
+      "enum": [
+        "ADHOC_RUN",
+        "SCHEDULED_RUN",
+        "SINGLE_TRACE_ANALYSIS",
+        "MANUAL"
+      ],
+      "enum_launch_stages": {
+        "ADHOC_RUN": "PUBLIC_BETA",
+        "MANUAL": "PUBLIC_BETA",
+        "SCHEDULED_RUN": "PUBLIC_BETA",
+        "SINGLE_TRACE_ANALYSIS": "PUBLIC_BETA"
+      }
+    },
+    "ml.IssueStatus": {
+      "description": "The triage status of an Issue: PENDING means open and awaiting triage,\nRESOLVED means judged real and addressed, and REJECTED means judged not to be\nan issue.",
+      "enum": [
+        "PENDING",
+        "RESOLVED",
+        "REJECTED"
+      ],
+      "enum_launch_stages": {
+        "PENDING": "PUBLIC_BETA",
+        "REJECTED": "PUBLIC_BETA",
+        "RESOLVED": "PUBLIC_BETA"
+      }
+    },
+    "ml.IssueTagFilter": {
+      "description": "One predicate over Issue.tags.",
+      "fields": {
+        "key": {
+          "description": "Matched exactly.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "values": {
+          "description": "Matched exactly, and ORed together. Empty matches any Issue carrying the key.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "ml.IssueView": {
+      "description": "Which fields each search result includes: BASIC has every field except\n`description`, and may omit large `metadata` entries; FULL has every field.",
+      "enum": [
+        "BASIC",
+        "FULL"
+      ],
+      "enum_launch_stages": {
+        "BASIC": "PUBLIC_BETA",
+        "FULL": "PUBLIC_BETA"
+      }
+    },
+    "ml.JobContext": {
+      "fields": {
+        "job_id": {
+          "description": "The job ID where this API invoked.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "job_run_id": {
+          "description": "The job run ID where this API was invoked.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.JobSpec": {
+      "fields": {
+        "access_token": {
+          "description": "The personal access token used to authorize webhook's job runs.",
+          "launch_stage": "GA"
+        },
+        "job_id": {
+          "description": "ID of the job that the webhook runs.",
+          "launch_stage": "GA"
+        },
+        "workspace_url": {
+          "description": "URL of the workspace containing the job that this webhook runs. If not specified, the job’s workspace URL is assumed to be the same as the workspace where the webhook is created.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.JobSpecWithoutSecret": {
+      "fields": {
+        "job_id": {
+          "description": "ID of the job that the webhook runs.",
+          "launch_stage": "GA"
+        },
+        "workspace_url": {
+          "description": "URL of the workspace containing the job that this webhook runs. If not specified, the job’s workspace URL is assumed to be the same as the workspace where the webhook is created.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.KafkaConfig": {
+      "fields": {
+        "auth_config": {
+          "description": "Authentication configuration for connection to topics.",
+          "ref": "ml.AuthConfig",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "backfill_source": {
+          "description": "A user-provided and managed source for backfilling data. Historical data is used when creating a training set from streaming features linked to this Kafka config.\nIn the future, a separate table will be maintained by Databricks for forward filling data.\nThe schema for this source must match exactly that of the key and value schemas specified for this Kafka config.",
+          "ref": "ml.BackfillSource",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "bootstrap_servers": {
+          "description": "A comma-separated list of host/port pairs pointing to Kafka cluster.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "extra_options": {
+          "description": "Catch-all for miscellaneous options. Keys should be source options or Kafka consumer options (kafka.*)",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "ingestion_config": {
+          "description": "Configuration for ingesting Kafka data into a Databricks-managed\nDelta table.",
+          "ref": "ml.IngestionConfig",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "key_schema": {
+          "description": "Schema configuration for extracting message keys from topics. At least one of key_schema and value_schema must be provided.",
+          "ref": "ml.SchemaConfig",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "name": {
+          "description": "Name that uniquely identifies this Kafka config within the metastore. This will be the identifier used from the Feature object to reference these configs for a feature.\nCan be distinct from topic name.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "subscription_mode": {
+          "description": "Options to configure which Kafka topics to pull data from.",
+          "ref": "ml.SubscriptionMode",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "value_schema": {
+          "description": "Schema configuration for extracting message values from topics. At least one of key_schema and value_schema must be provided.",
+          "ref": "ml.SchemaConfig",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.KafkaSource": {
+      "fields": {
+        "entity_column_identifiers": {
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "filter_condition": {
+          "description": "The filter condition applied to the source data before aggregation.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "name": {
+          "description": "Name of the Kafka source, used to identify it. This is used to look up the corresponding KafkaConfig object. Can be distinct from topic name.",
+          "launch_stage": "GA"
+        },
+        "timeseries_column_identifier": {
+          "ref": "ml.ColumnIdentifier",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.KafkaStreamConfig": {
+      "description": "Kafka-specific configuration for a Stream.",
+      "fields": {
+        "extra_options": {
+          "description": "Optional Kafka source or consumer options, validated against a server-side\nallowlist at request time. Allowed keys:\n- `maxOffsetsPerTrigger`\n- `startingOffsets`\n- `includeHeaders`\n- `kafka.request.timeout.ms`\n- `kafka.session.timeout.ms`\n- `kafka.max.partition.fetch.bytes`\nThe following keys are ingestion-only and are stripped before being forwarded to the materialization pipeline:\n- `maxOffsetsPerTrigger`\n- `startingOffsets`\nAuth and connection details belong on the parent Stream's `connection_config`, not here.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "subscription_mode": {
+          "description": "Options to configure which Kafka topics to pull data from.",
+          "ref": "ml.KafkaSubscriptionMode",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.KafkaSubscriptionMode": {
+      "description": "Subscription mode for Kafka topic selection, matching standard Spark Structured Streaming options.",
+      "fields": {
+        "assign": {
+          "description": "A JSON string that contains the specific topic-partitions to consume from.\nFor example, for '{\"topicA\":[0,1],\"topicB\":[2,4]}', topicA's 0'th and 1st partitions will be consumed from.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "subscribe": {
+          "description": "A comma-separated list of Kafka topics to read from. For example, 'topicA,topicB,topicC'.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "subscribe_pattern": {
+          "description": "A regular expression matching topics to subscribe to. For example, 'topic.*' will subscribe to all topics starting with 'topic'.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.KinesisStreamConfig": {
+      "description": "Kinesis-specific configuration for a Stream. For the underlying connector and its source\noptions, see the Databricks documentation on connecting to Amazon Kinesis\n(https://docs.databricks.com/aws/en/connect/streaming/kinesis).",
+      "fields": {
+        "extra_options": {
+          "description": "Optional Kinesis source options, validated against a server-side allowlist at request time.\nAllowed keys:\n- `consumerMode`\n- `consumerNamePrefix`\n- `maxFetchRate`\n- `minFetchPeriod`\n- `maxFetchDuration`\n- `maxRecordsPerFetch`\n- `shardsPerTask`\n- `fetchBufferSize`\n- `shardFetchInterval`\n`consumerMode` must be `efo` or `polling` (case-insensitive).\n`maxRecordsPerFetch` applies only during ingestion and does not affect the materialization pipeline.\nAuth and connection details belong on the parent Stream's `connection_config`, not here.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "stream_arns": {
+          "description": "Kinesis stream ARNs to read from.",
+          "ref": "ml.StreamArnList",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "stream_names": {
+          "description": "Kinesis stream names to read from.",
+          "ref": "ml.StreamNameList",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.LastDistinctFunction": {
+      "description": "Returns the last N distinct values, ordered by the feature's timeseries column.",
+      "fields": {
+        "input": {
+          "description": "The input column from which the last N distinct values are returned.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "n": {
+          "description": "The number of distinct values to return.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "ml.LastFunction": {
+      "description": "Returns the last value.",
+      "fields": {
+        "input": {
+          "description": "The input column from which the last value is returned.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.LastNFunction": {
+      "description": "Returns the last N values, ordered by the feature's timeseries column.",
+      "fields": {
+        "input": {
+          "description": "The input column from which the last N values are returned.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "n": {
+          "description": "The number of values to return.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "ml.LineageContext": {
+      "description": "Lineage context information for tracking where an API was invoked. This will allow us to track lineage, which currently uses caller entity information for use across the Lineage Client and Observability in Lumberjack.",
+      "fields": {
+        "job_context": {
+          "description": "Job context information including job ID and run ID.",
+          "ref": "ml.JobContext",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "notebook_id": {
+          "description": "The notebook ID where this API was invoked.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.LinkedFeature": {
+      "description": "Feature for model version.",
+      "fields": {
+        "feature_name": {
+          "description": "Feature name",
+          "launch_stage": "GA"
+        },
+        "feature_table_id": {
+          "description": "Feature table id",
+          "launch_stage": "GA"
+        },
+        "feature_table_name": {
+          "description": "Feature table name",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.ListArtifactsRequest": {
+      "fields": {
+        "page_token": {
+          "description": "The token indicating the page of artifact results to fetch. `page_token` is not supported when listing artifacts in UC\nVolumes. A maximum of 1000 artifacts will be retrieved for UC Volumes. Please call\n`/api/2.0/fs/directories{directory_path}` for listing artifacts in UC Volumes, which supports pagination. See [List\ndirectory contents | Files API](/api/workspace/files/listdirectorycontents).",
+          "launch_stage": "GA"
+        },
+        "path": {
+          "description": "Filter artifacts matching this path (a relative path from the root artifact directory).",
+          "launch_stage": "GA"
+        },
+        "run_id": {
+          "description": "ID of the run whose artifacts to list. Must be provided.",
+          "launch_stage": "GA"
+        },
+        "run_uuid": {
+          "description": "[Deprecated, use `run_id` instead] ID of the run whose artifacts to list. This field will\nbe removed in a future MLflow version.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.ListArtifactsResponse": {
+      "fields": {
+        "files": {
+          "description": "The file location and metadata for artifacts.",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "The token that can be used to retrieve the next page of artifact results.",
+          "launch_stage": "GA"
+        },
+        "root_uri": {
+          "description": "The root artifact directory for the run.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.ListExperimentsRequest": {
+      "fields": {
+        "max_results": {
+          "description": "Maximum number of experiments desired.\nIf `max_results` is unspecified, return all experiments.\nIf `max_results` is too large, it'll be automatically capped at 1000.\nCallers of this endpoint are encouraged to pass max_results explicitly and leverage\npage_token to iterate through experiments.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Token indicating the page of experiments to fetch",
+          "launch_stage": "GA"
+        },
+        "view_type": {
+          "description": "Qualifier for type of experiments to be returned.\nIf unspecified, return only active experiments.",
+          "ref": "ml.ViewType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.ListExperimentsResponse": {
+      "fields": {
+        "experiments": {
+          "description": "Paginated Experiments beginning with the first item on the requested page.",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "Token that can be used to retrieve the next page of experiments.\nEmpty token means no more experiment is available for retrieval.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.ListFeatureTagsRequest": {
+      "fields": {
+        "page_size": {
+          "description": "The maximum number of results to return.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Pagination token to go to the next page based on a previous query.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.ListFeatureTagsResponse": {
+      "description": "Response message for ListFeatureTag.",
+      "fields": {
+        "feature_tags": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "next_page_token": {
+          "description": "Pagination token to request the next page of results for this query.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "ml.ListFeaturesRequest": {
+      "fields": {
+        "catalog_name": {
+          "description": "Name of parent catalog for features of interest.",
+          "launch_stage": "GA"
+        },
+        "page_size": {
+          "description": "The maximum number of results to return.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Pagination token to go to the next page based on a previous query.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "schema_name": {
+          "description": "Name of parent schema relative to its parent catalog.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.ListFeaturesResponse": {
+      "fields": {
+        "features": {
+          "description": "List of features.",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "Pagination token to request the next page of results for this query.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.ListKafkaConfigsRequest": {
+      "fields": {
+        "page_size": {
+          "description": "The maximum number of results to return.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Pagination token to go to the next page based on a previous query.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.ListKafkaConfigsResponse": {
+      "fields": {
+        "kafka_configs": {
+          "description": "List of Kafka configs. Schemas are not included in the response.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "next_page_token": {
+          "description": "Pagination token to request the next page of results for this query.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "ml.ListMaterializedFeaturesRequest": {
+      "fields": {
+        "feature_name": {
+          "description": "Filter by feature name. If specified, only materialized features materialized from this feature will be returned.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_size": {
+          "description": "The maximum number of results to return. Defaults to 100 if not specified. Cannot be greater than 1000.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Pagination token to go to the next page based on a previous query.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.ListMaterializedFeaturesResponse": {
+      "fields": {
+        "materialized_features": {
+          "description": "List of materialized features.",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "Pagination token to request the next page of results for this query.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.ListModelsRequest": {
+      "fields": {
+        "max_results": {
+          "description": "Maximum number of registered models desired. Max threshold is 1000.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Pagination token to go to the next page based on a previous query.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.ListModelsResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "Pagination token to request next page of models for the same query.",
+          "launch_stage": "GA"
+        },
+        "registered_models": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.ListOnlineStoresRequest": {
+      "fields": {
+        "page_size": {
+          "description": "The maximum number of results to return. Defaults to 100 if not specified.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Pagination token to go to the next page based on a previous query.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.ListOnlineStoresResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "Pagination token to request the next page of results for this query.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "online_stores": {
+          "description": "List of online stores.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "ml.ListRegistryWebhooks": {
+      "fields": {
+        "next_page_token": {
+          "description": "Token that can be used to retrieve the next page of artifact results",
+          "launch_stage": "GA"
+        },
+        "webhooks": {
+          "description": "Array of registry webhooks.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.ListStreamsRequest": {
+      "fields": {
+        "page_size": {
+          "description": "The maximum number of results to return.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Pagination token to go to the next page based on a previous query.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "parent": {
+          "description": "Two-part name (catalog.schema) of the parent under which to list Streams.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.ListStreamsResponse": {
+      "description": "Response to a ListStreamsRequest.\n\nNOTE: Results are post-filtered by access permission on each stream's ingestion\ntable. This means:\n- Returned results may be fewer than page_size (including zero)\n- Page token points to next unfiltered batch, not next filtered batch, and may\npoint to an item that will be filtered out\nCallers should paginate until next_page_token is empty to retrieve all\naccessible streams.",
+      "fields": {
+        "next_page_token": {
+          "description": "Pagination token to request the next page of results for this query.",
+          "launch_stage": "GA"
+        },
+        "streams": {
+          "description": "List of Streams.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.ListTransitionRequestsRequest": {
+      "fields": {
+        "name": {
+          "description": "Name of the registered model.",
+          "launch_stage": "GA"
+        },
+        "version": {
+          "description": "Version of the model.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.ListTransitionRequestsResponse": {
+      "fields": {
+        "requests": {
+          "description": "Array of open transition requests.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.ListWebhooksRequest": {
+      "fields": {
+        "events": {
+          "description": "Events that trigger the webhook.\n* `MODEL_VERSION_CREATED`: A new model version was created for the associated model.\n\n* `MODEL_VERSION_TRANSITIONED_STAGE`: A model version’s stage was changed.\n\n* `TRANSITION_REQUEST_CREATED`: A user requested a model version’s stage be transitioned.\n\n* `COMMENT_CREATED`: A user wrote a comment on a registered model.\n\n* `REGISTERED_MODEL_CREATED`: A new registered model was created. This event type can only be specified for a registry-wide webhook, which can be created by not specifying a model name in the create request.\n\n* `MODEL_VERSION_TAG_SET`: A user set a tag on the model version.\n\n* `MODEL_VERSION_TRANSITIONED_TO_STAGING`: A model version was transitioned to staging.\n\n* `MODEL_VERSION_TRANSITIONED_TO_PRODUCTION`: A model version was transitioned to production.\n\n* `MODEL_VERSION_TRANSITIONED_TO_ARCHIVED`: A model version was archived.\n\n* `TRANSITION_REQUEST_TO_STAGING_CREATED`: A user requested a model version be transitioned to staging.\n\n* `TRANSITION_REQUEST_TO_PRODUCTION_CREATED`: A user requested a model version be transitioned to production.\n\n* `TRANSITION_REQUEST_TO_ARCHIVED_CREATED`: A user requested a model version be archived.\n\nIf `events` is specified, any webhook with one or more of the specified trigger events is included in the output.\nIf `events` is not specified, webhooks of all event types are included in the output.",
+          "launch_stage": "GA"
+        },
+        "max_results": {
+          "launch_stage": "GA"
+        },
+        "model_name": {
+          "description": "Registered model name\nIf not specified, all webhooks associated with the specified events are listed, regardless of their associated model.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Token indicating the page of artifact results to fetch",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.LogBatch": {
+      "fields": {
+        "metrics": {
+          "description": "Metrics to log. A single request can contain up to 1000 metrics, and up to 1000\nmetrics, params, and tags in total.",
+          "launch_stage": "GA"
+        },
+        "params": {
+          "description": "Params to log. A single request can contain up to 100 params, and up to 1000\nmetrics, params, and tags in total.",
+          "launch_stage": "GA"
+        },
+        "run_id": {
+          "description": "ID of the run to log under",
+          "launch_stage": "GA"
+        },
+        "tags": {
+          "description": "Tags to log. A single request can contain up to 100 tags, and up to 1000\nmetrics, params, and tags in total.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.LogBatchResponse": {},
+    "ml.LogInputs": {
+      "fields": {
+        "datasets": {
+          "description": "Dataset inputs",
+          "launch_stage": "GA"
+        },
+        "models": {
+          "description": "Model inputs",
+          "launch_stage": "GA"
+        },
+        "run_id": {
+          "description": "ID of the run to log under",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.LogInputsResponse": {},
+    "ml.LogLoggedModelParamsRequest": {
+      "fields": {
+        "params": {
+          "description": "Parameters to attach to the model.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.LogLoggedModelParamsRequestResponse": {},
+    "ml.LogMetric": {
+      "fields": {
+        "dataset_digest": {
+          "description": "Dataset digest of the dataset associated with the metric,\ne.g. an md5 hash of the dataset that uniquely identifies it\nwithin datasets of the same name.",
+          "launch_stage": "GA"
+        },
+        "dataset_name": {
+          "description": "The name of the dataset associated with the metric.\nE.g. “my.uc.table@2” “nyc-taxi-dataset”, “fantastic-elk-3”",
+          "launch_stage": "GA"
+        },
+        "key": {
+          "description": "Name of the metric.",
+          "launch_stage": "GA"
+        },
+        "model_id": {
+          "description": "ID of the logged model associated with the metric, if applicable",
+          "launch_stage": "GA"
+        },
+        "run_id": {
+          "description": "ID of the run under which to log the metric. Must be provided.",
+          "launch_stage": "GA"
+        },
+        "run_uuid": {
+          "description": "[Deprecated, use `run_id` instead] ID of the run under which to log the metric. This field will\nbe removed in a future MLflow version.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "step": {
+          "description": "Step at which to log the metric",
+          "launch_stage": "GA"
+        },
+        "timestamp": {
+          "description": "Unix timestamp in milliseconds at the time metric was logged.",
+          "launch_stage": "GA"
+        },
+        "value": {
+          "description": "Double value of the metric being logged.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.LogMetricResponse": {},
+    "ml.LogModel": {
+      "fields": {
+        "model_json": {
+          "description": "MLmodel file in json format.",
+          "launch_stage": "GA"
+        },
+        "run_id": {
+          "description": "ID of the run to log under",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.LogModelResponse": {},
+    "ml.LogOutputsRequest": {
+      "fields": {
+        "models": {
+          "description": "The model outputs from the Run.",
+          "launch_stage": "GA"
+        },
+        "run_id": {
+          "description": "The ID of the Run from which to log outputs.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.LogOutputsResponse": {},
+    "ml.LogParam": {
+      "fields": {
+        "key": {
+          "description": "Name of the param. Maximum size is 255 bytes.",
+          "launch_stage": "GA"
+        },
+        "run_id": {
+          "description": "ID of the run under which to log the param. Must be provided.",
+          "launch_stage": "GA"
+        },
+        "run_uuid": {
+          "description": "[Deprecated, use `run_id` instead] ID of the run under which to log the param. This field will\nbe removed in a future MLflow version.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "value": {
+          "description": "String value of the param being logged. Maximum size is 500 bytes.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.LogParamResponse": {},
+    "ml.LoggedModel": {
+      "description": "A logged model message includes logged model attributes,\ntags, registration info, params, and linked run metrics.",
+      "fields": {
+        "data": {
+          "description": "The params and metrics attached to the logged model.",
+          "ref": "ml.LoggedModelData",
+          "launch_stage": "GA"
+        },
+        "info": {
+          "description": "The logged model attributes such as model ID, status, tags, etc.",
+          "ref": "ml.LoggedModelInfo",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.LoggedModelData": {
+      "description": "A LoggedModelData message includes logged model params and linked metrics.",
+      "fields": {
+        "metrics": {
+          "description": "Performance metrics linked to the model.",
+          "launch_stage": "GA"
+        },
+        "params": {
+          "description": "Immutable string key-value pairs of the model.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.LoggedModelInfo": {
+      "description": "A LoggedModelInfo includes logged model attributes,\ntags, and registration info.",
+      "fields": {
+        "artifact_uri": {
+          "description": "The URI of the directory where model artifacts are stored.",
+          "launch_stage": "GA"
+        },
+        "creation_timestamp_ms": {
+          "description": "The timestamp when the model was created in milliseconds since the UNIX epoch.",
+          "launch_stage": "GA"
+        },
+        "creator_id": {
+          "description": "The ID of the user or principal that created the model.",
+          "launch_stage": "GA"
+        },
+        "experiment_id": {
+          "description": "The ID of the experiment that owns the model.",
+          "launch_stage": "GA"
+        },
+        "last_updated_timestamp_ms": {
+          "description": "The timestamp when the model was last updated in milliseconds since the UNIX epoch.",
+          "launch_stage": "GA"
+        },
+        "model_id": {
+          "description": "The unique identifier for the logged model.",
+          "launch_stage": "GA"
+        },
+        "model_type": {
+          "description": "The type of model, such as ``\"Agent\"``, ``\"Classifier\"``, ``\"LLM\"``.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The name of the model.",
+          "launch_stage": "GA"
+        },
+        "source_run_id": {
+          "description": "The ID of the run that created the model.",
+          "launch_stage": "GA"
+        },
+        "status": {
+          "description": "The status of whether or not the model is ready for use.",
+          "ref": "ml.LoggedModelStatus",
+          "launch_stage": "GA"
+        },
+        "status_message": {
+          "description": "Details on the current model status.",
+          "launch_stage": "GA"
+        },
+        "tags": {
+          "description": "Mutable string key-value pairs set on the model.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.LoggedModelParameter": {
+      "description": "Parameter associated with a LoggedModel.",
+      "fields": {
+        "key": {
+          "description": "The key identifying this param.",
+          "launch_stage": "GA"
+        },
+        "value": {
+          "description": "The value of this param.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.LoggedModelStatus": {
+      "description": "A LoggedModelStatus enum value represents the status of a logged\nmodel.",
+      "enum": [
+        "LOGGED_MODEL_PENDING",
+        "LOGGED_MODEL_READY",
+        "LOGGED_MODEL_UPLOAD_FAILED"
+      ],
+      "enum_launch_stages": {
+        "LOGGED_MODEL_PENDING": "GA",
+        "LOGGED_MODEL_READY": "GA",
+        "LOGGED_MODEL_UPLOAD_FAILED": "GA"
+      }
+    },
+    "ml.LoggedModelTag": {
+      "description": "Tag for a LoggedModel.",
+      "fields": {
+        "key": {
+          "description": "The tag key.",
+          "launch_stage": "GA"
+        },
+        "value": {
+          "description": "The tag value.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.MaterializationFailureNotification": {
+      "description": "Recipients to notify when a materialization run fails.",
+      "fields": {
+        "destination_ids": {
+          "description": "IDs of the notification destinations (for example Slack, Microsoft Teams, PagerDuty, or a\ngeneric webhook) to notify. Not supported for streaming materialized features.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "email_addresses": {
+          "description": "Email addresses to notify.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "final_attempt_only": {
+          "description": "If true, notify only when the final attempt of a run fails. If false or unset, notify on\nevery failed attempt, including attempts that will be retried.\n\nBatch materialization does not retry failures that need a fix on your side, such as missing\npermissions or invalid configuration, so the first attempt is the final one. Other batch\nfailures are retried up to twice.\n\nStreaming materialization restarts a failed update indefinitely unless the error cannot be\nretried. With this set, a streaming materialized feature notifies only on errors that cannot\nbe retried, and never on failures that are restarted.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.MaterializationNotifications": {
+      "description": "Notifications for the jobs and pipelines that materialize a feature, one field per trigger.",
+      "fields": {
+        "on_failure": {
+          "description": "Who to notify when a run fails, and on which attempts.",
+          "ref": "ml.MaterializationFailureNotification",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "on_success": {
+          "description": "Who to notify when a run succeeds.",
+          "ref": "ml.MaterializationSuccessNotification",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.MaterializationSuccessNotification": {
+      "description": "Recipients to notify when a materialization run succeeds.",
+      "fields": {
+        "destination_ids": {
+          "description": "IDs of the notification destinations (for example Slack, Microsoft Teams, PagerDuty, or a\ngeneric webhook) to notify. Not supported for streaming materialized features.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "email_addresses": {
+          "description": "Email addresses to notify.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.MaterializedFeature": {
+      "description": "A materialized feature represents a feature that is continuously computed and stored.",
+      "fields": {
+        "budget_policy_id": {
+          "description": "The ID of the budget policy used to attribute the serverless compute cost of this\nmaterialization. If not specified, a default budget policy may be applied.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "cron_schedule": {
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "cron_schedule_trigger": {
+          "description": "A cron-based schedule trigger for the materialization pipeline.",
+          "ref": "ml.CronSchedule",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "feature_name": {
+          "description": "The full name of the feature in Unity Catalog.",
+          "launch_stage": "GA"
+        },
+        "is_online": {
+          "description": "True if this is an online materialized feature. False if it is an offline materialized feature.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "job_id": {
+          "description": "The ID of the job that materializes the feature. This is present for both batch and streaming features.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "last_materialization_time": {
+          "description": "The timestamp when the pipeline last ran and updated the materialized feature values.\nIf the pipeline has not run yet, this field will be null.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "latest_backfill_operation": {
+          "description": "Name of the latest backfill operation on this materialized feature. Format: operations/{operation_id}.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "materialized_feature_id": {
+          "description": "Server-assigned unique identifier for the materialized feature.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "notifications": {
+          "description": "Notification configuration around the materialization job or pipeline lifecycle. They are\napplied to every job and pipeline that materializes this feature. Features which are\nmaterialized in the same pipeline will share the same notification.",
+          "ref": "ml.MaterializationNotifications",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "offline_store_config": {
+          "description": "Destination for writing feature values to an offline Delta table. The resulting table is\nreturned as `table_name`.",
+          "ref": "ml.OfflineStoreConfig",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE",
+            "INPUT_ONLY",
+            "OPTIONAL"
+          ]
+        },
+        "online_store_config": {
+          "description": "Destination for writing feature values to an online Lakebase table. The resulting table is\nreturned as `table_name`.",
+          "ref": "ml.OnlineStoreConfig",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE",
+            "OPTIONAL"
+          ]
+        },
+        "pipeline_id": {
+          "description": "The ID of the pipeline that materializes this feature. This is only present for streaming features.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "pipeline_schedule_state": {
+          "description": "The schedule state of the materialization pipeline.\nHidden from GraphQL: being deprecated, so not exposed to Catalog Explorer.",
+          "ref": "ml.MaterializedFeaturePipelineScheduleState",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "streaming_mode": {
+          "description": "The Structured Streaming trigger mode used for materialization. Real-time mode (RTM) targets\nsub-second latency for operational workloads; micro-batch mode (MBM) favors cost efficiency\nfor ETL and analytics workloads.",
+          "ref": "ml.StreamingMode",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "table_name": {
+          "description": "The fully qualified Unity Catalog path to the table containing the materialized feature (Delta table or Lakebase table). Output only.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "table_trigger": {
+          "description": "A trigger that fires when the upstream source table changes.",
+          "ref": "ml.TableTrigger",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "tags": {
+          "description": "Custom tags to associate with this materialization. They are applied to the materialization\njob (for batch features) or pipeline (for streaming features) and forwarded to the underlying\ncompute as cluster tags, so materialization cost can be attributed in the billing system\ntables. These tags apply only to the materialization compute; they are not applied to the\nUnity Catalog Feature resource itself, whose tags are managed separately through the Unity\nCatalog tagging API. A maximum of 25 tags is supported; keys and values are subject to the\nsame limitations as cluster tags.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.MaterializedFeaturePipelineScheduleState": {
+      "enum": [
+        "SNAPSHOT",
+        "ACTIVE",
+        "PAUSED"
+      ],
+      "enum_launch_stages": {
+        "ACTIVE": "PRIVATE_PREVIEW",
+        "PAUSED": "PRIVATE_PREVIEW",
+        "SNAPSHOT": "PRIVATE_PREVIEW"
+      }
+    },
+    "ml.MaxFunction": {
+      "description": "Computes the maximum value.",
+      "fields": {
+        "input": {
+          "description": "The input column from which the maximum is computed.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.Metric": {
+      "description": "Metric associated with a run, represented as a key-value pair.",
+      "fields": {
+        "dataset_digest": {
+          "description": "The dataset digest of the dataset associated with the metric,\ne.g. an md5 hash of the dataset that uniquely identifies it\nwithin datasets of the same name.",
+          "launch_stage": "GA"
+        },
+        "dataset_name": {
+          "description": "The name of the dataset associated with the metric.\nE.g. “my.uc.table@2” “nyc-taxi-dataset”, “fantastic-elk-3”",
+          "launch_stage": "GA"
+        },
+        "key": {
+          "description": "The key identifying the metric.",
+          "launch_stage": "GA"
+        },
+        "model_id": {
+          "description": "The ID of the logged model or registered model version associated with\nthe metric, if applicable.",
+          "launch_stage": "GA"
+        },
+        "run_id": {
+          "description": "The ID of the run containing the metric.",
+          "launch_stage": "GA"
+        },
+        "step": {
+          "description": "The step at which the metric was logged.",
+          "launch_stage": "GA"
+        },
+        "timestamp": {
+          "description": "The timestamp at which the metric was recorded.",
+          "launch_stage": "GA"
+        },
+        "value": {
+          "description": "The value of the metric.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.MinFunction": {
+      "description": "Computes the minimum value.",
+      "fields": {
+        "input": {
+          "description": "The input column from which the minimum is computed.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.Model": {
+      "fields": {
+        "creation_timestamp": {
+          "description": "Timestamp recorded when this `registered_model` was created.",
+          "launch_stage": "GA"
+        },
+        "description": {
+          "description": "Description of this `registered_model`.",
+          "launch_stage": "GA"
+        },
+        "last_updated_timestamp": {
+          "description": "Timestamp recorded when metadata for this `registered_model` was last updated.",
+          "launch_stage": "GA"
+        },
+        "latest_versions": {
+          "description": "Collection of latest model versions for each stage.\nOnly contains models with current `READY` status.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Unique name for the model.",
+          "launch_stage": "GA"
+        },
+        "tags": {
+          "description": "Tags: Additional metadata key-value pairs for this `registered_model`.",
+          "launch_stage": "GA"
+        },
+        "user_id": {
+          "description": "User that created this `registered_model`",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.ModelDatabricks": {
+      "fields": {
+        "creation_timestamp": {
+          "description": "Creation time of the object, as a Unix timestamp in milliseconds.",
+          "launch_stage": "GA"
+        },
+        "description": {
+          "description": "User-specified description for the object.",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "Unique identifier for the object.",
+          "launch_stage": "GA"
+        },
+        "last_updated_timestamp": {
+          "description": "Last update time of the object, as a Unix timestamp in milliseconds.",
+          "launch_stage": "GA"
+        },
+        "latest_versions": {
+          "description": "Array of model versions, each the latest version for its stage.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of the model.",
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "description": "Permission level granted for the requesting user on this registered model",
+          "ref": "ml.PermissionLevel",
+          "launch_stage": "GA"
+        },
+        "tags": {
+          "description": "Array of tags associated with the model.",
+          "launch_stage": "GA"
+        },
+        "user_id": {
+          "description": "The username of the user that created the object.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.ModelInput": {
+      "description": "Represents a LoggedModel or Registered Model Version input to a Run.",
+      "fields": {
+        "model_id": {
+          "description": "The unique identifier of the model.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.ModelOutput": {
+      "description": "Represents a LoggedModel output of a Run.",
+      "fields": {
+        "model_id": {
+          "description": "The unique identifier of the model.",
+          "launch_stage": "GA"
+        },
+        "step": {
+          "description": "The step at which the model was produced.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.ModelTag": {
+      "description": "Tag for a registered model",
+      "fields": {
+        "key": {
+          "description": "The tag key.",
+          "launch_stage": "GA"
+        },
+        "value": {
+          "description": "The tag value.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.ModelVersion": {
+      "fields": {
+        "creation_timestamp": {
+          "description": "Timestamp recorded when this `model_version` was created.",
+          "launch_stage": "GA"
+        },
+        "current_stage": {
+          "description": "Current stage for this `model_version`.",
+          "launch_stage": "GA"
+        },
+        "description": {
+          "description": "Description of this `model_version`.",
+          "launch_stage": "GA"
+        },
+        "last_updated_timestamp": {
+          "description": "Timestamp recorded when metadata for this `model_version` was last updated.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Unique name of the model",
+          "launch_stage": "GA"
+        },
+        "run_id": {
+          "description": "MLflow run ID used when creating `model_version`, if `source` was generated by an\nexperiment run stored in MLflow tracking server.",
+          "launch_stage": "GA"
+        },
+        "run_link": {
+          "description": "Run Link: Direct link to the run that generated this version",
+          "launch_stage": "GA"
+        },
+        "source": {
+          "description": "URI indicating the location of the source model artifacts, used when creating `model_version`",
+          "launch_stage": "GA"
+        },
+        "status": {
+          "description": "Current status of `model_version`",
+          "ref": "ml.ModelVersionStatus",
+          "launch_stage": "GA"
+        },
+        "status_message": {
+          "description": "Details on current `status`, if it is pending or failed.",
+          "launch_stage": "GA"
+        },
+        "tags": {
+          "description": "Tags: Additional metadata key-value pairs for this `model_version`.",
+          "launch_stage": "GA"
+        },
+        "user_id": {
+          "description": "User that created this `model_version`.",
+          "launch_stage": "GA"
+        },
+        "version": {
+          "description": "Model's version number.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.ModelVersionDatabricks": {
+      "fields": {
+        "creation_timestamp": {
+          "description": "Creation time of the object, as a Unix timestamp in milliseconds.",
+          "launch_stage": "GA"
+        },
+        "current_stage": {
+          "launch_stage": "GA"
+        },
+        "description": {
+          "description": "User-specified description for the object.",
+          "launch_stage": "GA"
+        },
+        "email_subscription_status": {
+          "description": "Email Subscription Status: This is the subscription status of the user to the model version\nUsers get subscribed by interacting with the model version.",
+          "ref": "ml.RegistryEmailSubscriptionType",
+          "launch_stage": "GA"
+        },
+        "feature_list": {
+          "description": "Feature lineage of `model_version`.",
+          "ref": "ml.FeatureList",
+          "launch_stage": "GA"
+        },
+        "last_updated_timestamp": {
+          "description": "Time of the object at last update, as a Unix timestamp in milliseconds.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of the model.",
+          "launch_stage": "GA"
+        },
+        "open_requests": {
+          "description": "Open requests for this `model_versions`.\nGap in sequence number is intentional and is done in order to\nmatch field sequence numbers of `ModelVersion` proto message",
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "ml.PermissionLevel",
+          "launch_stage": "GA"
+        },
+        "run_id": {
+          "description": "Unique identifier for the MLflow tracking run associated with the source model artifacts.",
+          "launch_stage": "GA"
+        },
+        "run_link": {
+          "description": "URL of the run associated with the model artifacts. This field is set at model version creation time only for model versions whose source run is from a tracking server that is different from the registry server.",
+          "launch_stage": "GA"
+        },
+        "source": {
+          "description": "URI that indicates the location of the source model artifacts. This is used when creating the model version.",
+          "launch_stage": "GA"
+        },
+        "status": {
+          "ref": "ml.Status",
+          "launch_stage": "GA"
+        },
+        "status_message": {
+          "description": "Details on the current status, for example why registration failed.",
+          "launch_stage": "GA"
+        },
+        "tags": {
+          "description": "Array of tags that are associated with the model version.",
+          "launch_stage": "GA"
+        },
+        "user_id": {
+          "description": "The username of the user that created the object.",
+          "launch_stage": "GA"
+        },
+        "version": {
+          "description": "Version of the model.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.ModelVersionStatus": {
+      "description": "The status of the model version. Valid values are:\n* `PENDING_REGISTRATION`: Request to register a new model version is pending as server performs background tasks.\n\n* `FAILED_REGISTRATION`: Request to register a new model version has failed.\n\n* `READY`: Model version is ready for use.",
+      "enum": [
+        "PENDING_REGISTRATION",
+        "FAILED_REGISTRATION",
+        "READY"
+      ],
+      "enum_launch_stages": {
+        "FAILED_REGISTRATION": "GA",
+        "PENDING_REGISTRATION": "GA",
+        "READY": "GA"
+      },
+      "enum_descriptions": {
+        "FAILED_REGISTRATION": "Request to register a new model version has failed.",
+        "PENDING_REGISTRATION": "Request to register a new model version is pending as server performs background tasks.",
+        "READY": "Model version is ready for use."
+      }
+    },
+    "ml.ModelVersionTag": {
+      "fields": {
+        "key": {
+          "description": "The tag key.",
+          "launch_stage": "GA"
+        },
+        "value": {
+          "description": "The tag value.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.MtlsConfig": {
+      "description": "Mutual-TLS (mTLS) authentication configuration. The keystore (client certificate +\nprivate key) and truststore (CAs trusted to verify the broker) live as JKS files on\nUnity Catalog volumes, with their passwords stored in Databricks secret scopes. This\nmatches the SSL setup pattern documented at\nhttps://docs.databricks.com/en/connect/streaming/kafka/authentication#use-ssl-to-connect-databricks-to-kafka.",
+      "fields": {
+        "disable_hostname_verification": {
+          "description": "Set to true only when the broker certificate's SAN intentionally does not match\nthe connection endpoint — for example when reaching the cluster through a\nPrivateLink endpoint whose DNS name is not in the broker certificate. Skipping\nthe hostname check removes a defense against man-in-the-middle attacks; do not\nenable casually. mTLS client authentication is unaffected by this option.\n\nSee the Apache Kafka SSL security guide for background on this check:\nhttps://kafka.apache.org/42/security/encryption-and-authentication-using-ssl/#host-name-verification",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "key_password_ref": {
+          "description": "Secret-scope reference for the private key password. Often the same value as the\nkeystore password (keytool's default), but provided as a separate field because\nApache Kafka requires it as a distinct option (kafka.ssl.key.password).",
+          "ref": "ml.SecretScopeReference",
+          "launch_stage": "GA"
+        },
+        "keystore_location": {
+          "description": "Unity Catalog volume path to the JKS keystore file containing the client certificate\nand private key. e.g. \"/Volumes/\u003ccatalog\u003e/\u003cschema\u003e/\u003cvolume\u003e/client.jks\". The\nmaterialization compute must have read permission on this volume.",
+          "launch_stage": "GA"
+        },
+        "keystore_password_ref": {
+          "description": "Secret-scope reference for the JKS keystore password.",
+          "ref": "ml.SecretScopeReference",
+          "launch_stage": "GA"
+        },
+        "truststore_location": {
+          "description": "Unity Catalog volume path to the JKS truststore file containing the CA certificate(s)\ntrusted to verify the Kafka broker's server certificate.\ne.g. \"/Volumes/\u003ccatalog\u003e/\u003cschema\u003e/\u003cvolume\u003e/truststore.jks\".",
+          "launch_stage": "GA"
+        },
+        "truststore_password_ref": {
+          "description": "Secret-scope reference for the JKS truststore password.",
+          "ref": "ml.SecretScopeReference",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.OfflineStoreConfig": {
+      "description": "Configuration for offline store destination.",
+      "fields": {
+        "catalog_name": {
+          "description": "The Unity Catalog catalog name.",
+          "launch_stage": "GA"
+        },
+        "schema_name": {
+          "description": "The Unity Catalog schema name.",
+          "launch_stage": "GA"
+        },
+        "table_name_prefix": {
+          "description": "Prefix for Unity Catalog table name.\nThe materialized feature will be stored in a table with this prefix and a generated postfix.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.OnlineStore": {
+      "description": "An OnlineStore is a logical database instance that stores and serves features online.",
+      "fields": {
+        "capacity": {
+          "description": "The capacity of the online store. Valid values are \"CU_1\", \"CU_2\", \"CU_4\", \"CU_8\".",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "creation_time": {
+          "description": "The timestamp when the online store was created.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "creator": {
+          "description": "The email of the creator of the online store.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "The name of the online store. This is the unique identifier for the online store.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "read_replica_count": {
+          "description": "The number of read replicas for the online store. Defaults to 0.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "state": {
+          "description": "The current state of the online store.",
+          "ref": "ml.OnlineStoreState",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "usage_policy_id": {
+          "description": "The usage policy applied to the online store to track billing.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.OnlineStoreConfig": {
+      "description": "Configuration for online store destination.",
+      "fields": {
+        "catalog_name": {
+          "description": "The Unity Catalog catalog name. This name is also used as the Lakebase logical database name.\nQuoting is handled by the backend where needed, do not pre-quote it.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "INPUT_ONLY"
+          ]
+        },
+        "online_store_name": {
+          "description": "The name of the target online store.",
+          "launch_stage": "GA"
+        },
+        "schema_name": {
+          "description": "The Unity Catalog schema name. This name is also used as the Lakebase schema name under the database.\nQuoting is handled by the backend where needed, do not pre-quote it.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "INPUT_ONLY"
+          ]
+        },
+        "table_name_prefix": {
+          "description": "Prefix for Unity Catalog table name.\nThe materialized feature will be stored in a Lakebase table with this prefix and a generated postfix.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "INPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "ml.OnlineStoreState": {
+      "enum": [
+        "STARTING",
+        "AVAILABLE",
+        "DELETING",
+        "STOPPED",
+        "UPDATING",
+        "FAILING_OVER"
+      ],
+      "enum_launch_stages": {
+        "AVAILABLE": "PRIVATE_PREVIEW",
+        "DELETING": "PRIVATE_PREVIEW",
+        "FAILING_OVER": "PRIVATE_PREVIEW",
+        "STARTING": "PRIVATE_PREVIEW",
+        "STOPPED": "PRIVATE_PREVIEW",
+        "UPDATING": "PRIVATE_PREVIEW"
+      }
+    },
+    "ml.Operation": {
+      "description": "This resource represents a long-running operation that is the result of a\nnetwork API call.",
+      "fields": {
+        "done": {
+          "description": "If the value is `false`, it means the operation is still in progress.\nIf `true`, the operation is completed, and either `error` or `response` is\navailable.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "error": {
+          "description": "The error result of the operation in case of failure or cancellation.",
+          "ref": "ml.DatabricksServiceExceptionWithDetailsProto",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "metadata": {
+          "description": "Service-specific metadata associated with the operation.  It typically\ncontains progress information and common metadata such as create time.\nSome services might not provide such metadata.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "name": {
+          "description": "The server-assigned name, which is only unique within the same service that\noriginally returns it. If you use the default HTTP mapping, the\n`name` should be a resource name ending with `operations/{unique_id}`.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "response": {
+          "description": "The normal, successful response of the operation.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "ml.Param": {
+      "description": "Param associated with a run.",
+      "fields": {
+        "key": {
+          "description": "Key identifying this param.",
+          "launch_stage": "GA"
+        },
+        "value": {
+          "description": "Value associated with this param.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.PermissionLevel": {
+      "description": "Permission level of the requesting user on the object. For what is allowed at each level, see\n[MLflow Model permissions](https://docs.databricks.com/aws/en/machine-learning/manage-model-lifecycle/workspace-model-registry#permissions).",
+      "enum": [
+        "CAN_MANAGE",
+        "CAN_EDIT",
+        "CAN_READ",
+        "CAN_MANAGE_STAGING_VERSIONS",
+        "CAN_MANAGE_PRODUCTION_VERSIONS",
+        "CAN_CREATE_REGISTERED_MODEL"
+      ],
+      "enum_launch_stages": {
+        "CAN_CREATE_REGISTERED_MODEL": "GA",
+        "CAN_EDIT": "GA",
+        "CAN_MANAGE": "GA",
+        "CAN_MANAGE_PRODUCTION_VERSIONS": "GA",
+        "CAN_MANAGE_STAGING_VERSIONS": "GA",
+        "CAN_READ": "GA"
+      }
+    },
+    "ml.ProtoSchemaSpec": {
+      "description": "A Protocol Buffer schema paired with the name of the message within it that describes the\nKafka payload. A .proto file may declare multiple messages; message_name disambiguates.",
+      "fields": {
+        "message_name": {
+          "description": "The fully-qualified name of the message within schema_text that describes the Kafka payload\n(e.g. \"Event\" or \"com.example.Event\" if schema_text declares a package). Identifies which\nmessage is used to decode each Kafka record — a .proto file may declare multiple messages\nbut only one represents the payload. Must not be empty.",
+          "launch_stage": "GA"
+        },
+        "schema_text": {
+          "description": "The raw .proto file text (proto2 and proto3 syntax supported, see\nhttps://protobuf.dev/programming-guides/proto3/ and https://protobuf.dev/programming-guides/proto2/).",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.PublishSpec": {
+      "fields": {
+        "budget_policy_id": {
+          "description": "Budget policy id used to attribute the serverless compute cost of the synced online-table sync\npipeline. Applied only when the sync pipeline is first created (the initial publish of a new\nonline table); republishing to an existing online table does not update it.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "full_feature_name": {
+          "description": "Full Unity Catalog name of one of the features materialized in the source table, used to\nderive the synced online table's entity and timeseries columns. Required for view sources\nwithout a UC PrimaryKeyConstraint; ignored when the source already has one.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "online_store": {
+          "description": "The name of the target online store.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "online_table_name": {
+          "description": "The full three-part (catalog, schema, table) name of the online table.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "publish_mode": {
+          "description": "The publish mode of the pipeline that syncs the online table with the source table.",
+          "ref": "ml.PublishSpecPublishMode",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "tags": {
+          "description": "Custom tags to apply to the synced online-table sync pipeline created for this publish. They\nare forwarded to the pipeline's compute as cluster tags so its cost can be attributed in the\nbilling system tables. Applied only when the sync pipeline is first created (the initial\npublish of a new online table); republishing to an existing online table does not update them.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.PublishSpecPublishMode": {
+      "enum": [
+        "CONTINUOUS",
+        "TRIGGERED",
+        "SNAPSHOT"
+      ],
+      "enum_launch_stages": {
+        "CONTINUOUS": "PRIVATE_PREVIEW",
+        "SNAPSHOT": "PRIVATE_PREVIEW",
+        "TRIGGERED": "PRIVATE_PREVIEW"
+      }
+    },
+    "ml.PublishTableRequest": {
+      "fields": {
+        "publish_spec": {
+          "description": "The specification for publishing the online table from the source table.",
+          "ref": "ml.PublishSpec",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "ml.PublishTableResponse": {
+      "fields": {
+        "online_table_name": {
+          "description": "The full three-part (catalog, schema, table) name of the online table.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "pipeline_id": {
+          "description": "The ID of the pipeline that syncs the online table with the source table.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "ml.PurgeFeatureEntitiesMetadata": {
+      "description": "Progress and configuration for a feature entity purge.",
+      "fields": {
+        "create_time": {
+          "description": "Time at which the purge operation was created.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "entities_table": {
+          "description": "Fully qualified name of the Unity Catalog Delta table containing the entity keys to purge.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "entities_table_version": {
+          "description": "Version of the entities table used by the purge.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "features": {
+          "description": "Fully qualified names of the features targeted by the purge.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "job_id": {
+          "description": "ID of the job that executes this purge.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "state": {
+          "description": "Current state of the purge operation.",
+          "ref": "ml.PurgeFeatureEntitiesMetadataState",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "ml.PurgeFeatureEntitiesMetadataState": {
+      "description": "Lifecycle state of a feature entity purge.",
+      "enum": [
+        "PENDING",
+        "RUNNING",
+        "SUCCEEDED",
+        "FAILED",
+        "CANCELLED"
+      ],
+      "enum_launch_stages": {
+        "CANCELLED": "PRIVATE_PREVIEW",
+        "FAILED": "PRIVATE_PREVIEW",
+        "PENDING": "PRIVATE_PREVIEW",
+        "RUNNING": "PRIVATE_PREVIEW",
+        "SUCCEEDED": "PRIVATE_PREVIEW"
+      }
+    },
+    "ml.PurgeFeatureEntitiesRequest": {
+      "description": "Request to purge materialized feature values for entities listed in a Unity Catalog Delta table.",
+      "fields": {
+        "budget_policy_id": {
+          "description": "The budget policy ID, in UUID format, used to attribute the serverless compute cost of this\npurge. If not specified, a default budget policy may be applied.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "entities_table": {
+          "description": "Fully qualified name of the Unity Catalog Delta table containing the entity keys to purge.\nThe table may contain a subset of each feature's entity-key columns. A partial key match\ndeletes all feature rows matching the provided key values. Non-key columns are rejected;\nnull key values are allowed.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "features": {
+          "description": "Fully qualified names of the features to purge. At least one nonempty feature name is required.\nA request may contain at most 10000 features; submit additional features in separate requests.\nDuplicate features are rejected.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "request_id": {
+          "description": "Optional UUID4 idempotency token for the request.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "tags": {
+          "description": "Custom tags to associate with this purge. They are applied to the purge job and forwarded to\nthe underlying compute as Databricks resource tags, so purge cost can be attributed in the\nbilling system tables. These tags apply only to the purge compute; they are not applied to the\nUnity Catalog Feature resources themselves, whose tags are managed separately through the Unity\nCatalog tagging API. A maximum of 25 tags is supported; keys and values are subject to the same\nlimitations as Databricks resource tags.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.PurgeFeatureEntitiesResponse": {
+      "description": "Result of a completed feature entity purge.",
+      "fields": {
+        "error": {
+          "description": "Operation-level error, if the purge failed outside an individual feature target.",
+          "ref": "ml.DatabricksServiceExceptionWithDetailsProto",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "metadata": {
+          "description": "Metadata about the purge operation.",
+          "ref": "ml.PurgeFeatureEntitiesMetadata",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "results": {
+          "description": "Per-feature purge results.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "state": {
+          "description": "State of the purge operation.",
+          "ref": "ml.PurgeFeatureEntitiesMetadataState",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "ml.PurgeFeatureEntitiesResult": {
+      "description": "Result of purging one feature.",
+      "fields": {
+        "error": {
+          "description": "Error encountered while purging this feature, if any.",
+          "ref": "ml.DatabricksServiceExceptionWithDetailsProto",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "feature": {
+          "description": "Fully qualified name of the feature that was purged.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "offline_state": {
+          "description": "State of the offline purge for this feature.",
+          "ref": "ml.PurgeFeatureEntitiesResultState",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "online_state": {
+          "description": "State of the online purge for this feature.",
+          "ref": "ml.PurgeFeatureEntitiesResultState",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "ml.PurgeFeatureEntitiesResultState": {
+      "description": "Terminal state of a purge for one store type.",
+      "enum": [
+        "SUCCEEDED",
+        "FAILED",
+        "NOT_APPLICABLE"
+      ],
+      "enum_launch_stages": {
+        "FAILED": "PRIVATE_PREVIEW",
+        "NOT_APPLICABLE": "PRIVATE_PREVIEW",
+        "SUCCEEDED": "PRIVATE_PREVIEW"
+      }
+    },
+    "ml.RegisteredModelAccessControlRequest": {
+      "fields": {
+        "group_name": {
+          "description": "name of the group",
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "ml.RegisteredModelPermissionLevel",
+          "launch_stage": "GA"
+        },
+        "service_principal_name": {
+          "description": "application ID of a service principal",
+          "launch_stage": "GA"
+        },
+        "user_name": {
+          "description": "name of the user",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.RegisteredModelAccessControlResponse": {
+      "fields": {
+        "all_permissions": {
+          "description": "All permissions.",
+          "launch_stage": "GA"
+        },
+        "display_name": {
+          "description": "Display name of the user or service principal.",
+          "launch_stage": "GA"
+        },
+        "group_name": {
+          "description": "name of the group",
+          "launch_stage": "GA"
+        },
+        "service_principal_name": {
+          "description": "Name of the service principal.",
+          "launch_stage": "GA"
+        },
+        "user_name": {
+          "description": "name of the user",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.RegisteredModelPermission": {
+      "fields": {
+        "inherited": {
+          "launch_stage": "GA"
+        },
+        "inherited_from_object": {
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "ml.RegisteredModelPermissionLevel",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.RegisteredModelPermissionLevel": {
+      "description": "Permission level",
+      "enum": [
+        "CAN_MANAGE",
+        "CAN_MANAGE_PRODUCTION_VERSIONS",
+        "CAN_MANAGE_STAGING_VERSIONS",
+        "CAN_EDIT",
+        "CAN_READ"
+      ]
+    },
+    "ml.RegisteredModelPermissions": {
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "GA"
+        },
+        "object_id": {
+          "launch_stage": "GA"
+        },
+        "object_type": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.RegisteredModelPermissionsDescription": {
+      "fields": {
+        "description": {
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "ml.RegisteredModelPermissionLevel",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.RegisteredModelPermissionsRequest": {
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.RegistryEmailSubscriptionType": {
+      "description": ".. note::\nExperimental: This entity may change or be removed in a future release without warning.\nEmail subscription types for registry notifications:\n- `ALL_EVENTS`: Subscribed to all events.\n- `DEFAULT`: Default subscription type.\n- `SUBSCRIBED`: Subscribed to notifications.\n- `UNSUBSCRIBED`: Not subscribed to notifications.",
+      "enum": [
+        "ALL_EVENTS",
+        "DEFAULT",
+        "SUBSCRIBED",
+        "UNSUBSCRIBED"
+      ],
+      "enum_launch_stages": {
+        "ALL_EVENTS": "GA",
+        "DEFAULT": "GA",
+        "SUBSCRIBED": "GA",
+        "UNSUBSCRIBED": "GA"
+      },
+      "enum_descriptions": {
+        "ALL_EVENTS": "Subscribed to all events.",
+        "DEFAULT": "Default subscription type.",
+        "SUBSCRIBED": "Subscribed to notifications.",
+        "UNSUBSCRIBED": "Not subscribed to notifications."
+      }
+    },
+    "ml.RegistryWebhook": {
+      "fields": {
+        "creation_timestamp": {
+          "description": "Creation time of the object, as a Unix timestamp in milliseconds.",
+          "launch_stage": "GA"
+        },
+        "description": {
+          "description": "User-specified description for the webhook.",
+          "launch_stage": "GA"
+        },
+        "events": {
+          "description": "Events that can trigger a registry webhook:\n* `MODEL_VERSION_CREATED`: A new model version was created for the associated model.\n\n* `MODEL_VERSION_TRANSITIONED_STAGE`: A model version’s stage was changed.\n\n* `TRANSITION_REQUEST_CREATED`: A user requested a model version’s stage be transitioned.\n\n* `COMMENT_CREATED`: A user wrote a comment on a registered model.\n\n* `REGISTERED_MODEL_CREATED`: A new registered model was created. This event type can only be specified for a registry-wide webhook, which can be created by not specifying a model name in the create request.\n\n* `MODEL_VERSION_TAG_SET`: A user set a tag on the model version.\n\n* `MODEL_VERSION_TRANSITIONED_TO_STAGING`: A model version was transitioned to staging.\n\n* `MODEL_VERSION_TRANSITIONED_TO_PRODUCTION`: A model version was transitioned to production.\n\n* `MODEL_VERSION_TRANSITIONED_TO_ARCHIVED`: A model version was archived.\n\n* `TRANSITION_REQUEST_TO_STAGING_CREATED`: A user requested a model version be transitioned to staging.\n\n* `TRANSITION_REQUEST_TO_PRODUCTION_CREATED`: A user requested a model version be transitioned to production.\n\n* `TRANSITION_REQUEST_TO_ARCHIVED_CREATED`: A user requested a model version be archived.",
+          "launch_stage": "GA"
+        },
+        "http_url_spec": {
+          "ref": "ml.HttpUrlSpecWithoutSecret",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "Webhook ID",
+          "launch_stage": "GA"
+        },
+        "job_spec": {
+          "ref": "ml.JobSpecWithoutSecret",
+          "launch_stage": "GA"
+        },
+        "last_updated_timestamp": {
+          "description": "Time of the object at last update, as a Unix timestamp in milliseconds.",
+          "launch_stage": "GA"
+        },
+        "model_name": {
+          "description": "Name of the model whose events would trigger this webhook.",
+          "launch_stage": "GA"
+        },
+        "status": {
+          "ref": "ml.RegistryWebhookStatus",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.RegistryWebhookEvent": {
+      "enum": [
+        "MODEL_VERSION_CREATED",
+        "MODEL_VERSION_TRANSITIONED_STAGE",
+        "TRANSITION_REQUEST_CREATED",
+        "COMMENT_CREATED",
+        "REGISTERED_MODEL_CREATED",
+        "MODEL_VERSION_TAG_SET",
+        "MODEL_VERSION_TRANSITIONED_TO_STAGING",
+        "MODEL_VERSION_TRANSITIONED_TO_PRODUCTION",
+        "MODEL_VERSION_TRANSITIONED_TO_ARCHIVED",
+        "TRANSITION_REQUEST_TO_STAGING_CREATED",
+        "TRANSITION_REQUEST_TO_PRODUCTION_CREATED",
+        "TRANSITION_REQUEST_TO_ARCHIVED_CREATED"
+      ],
+      "enum_launch_stages": {
+        "COMMENT_CREATED": "GA",
+        "MODEL_VERSION_CREATED": "GA",
+        "MODEL_VERSION_TAG_SET": "GA",
+        "MODEL_VERSION_TRANSITIONED_STAGE": "GA",
+        "MODEL_VERSION_TRANSITIONED_TO_ARCHIVED": "GA",
+        "MODEL_VERSION_TRANSITIONED_TO_PRODUCTION": "GA",
+        "MODEL_VERSION_TRANSITIONED_TO_STAGING": "GA",
+        "REGISTERED_MODEL_CREATED": "GA",
+        "TRANSITION_REQUEST_CREATED": "GA",
+        "TRANSITION_REQUEST_TO_ARCHIVED_CREATED": "GA",
+        "TRANSITION_REQUEST_TO_PRODUCTION_CREATED": "GA",
+        "TRANSITION_REQUEST_TO_STAGING_CREATED": "GA"
+      }
+    },
+    "ml.RegistryWebhookStatus": {
+      "description": "Enable or disable triggering the webhook, or put the webhook into test mode. The default is `ACTIVE`:\n* `ACTIVE`: Webhook is triggered when an associated event happens.\n\n* `DISABLED`: Webhook is not triggered.\n\n* `TEST_MODE`: Webhook can be triggered through the test endpoint, but is not triggered on a real event.",
+      "enum": [
+        "ACTIVE",
+        "DISABLED",
+        "TEST_MODE"
+      ],
+      "enum_launch_stages": {
+        "ACTIVE": "GA",
+        "DISABLED": "GA",
+        "TEST_MODE": "GA"
+      },
+      "enum_descriptions": {
+        "ACTIVE": "Webhook is triggered when an associated event happens.",
+        "DISABLED": "Webhook is not triggered.",
+        "TEST_MODE": "Webhook can be triggered through the test endpoint, but is not triggered on a real event."
+      }
+    },
+    "ml.RejectTransitionRequest": {
+      "description": "Details required to identify and reject a model version stage transition request.",
+      "fields": {
+        "comment": {
+          "description": "User-provided comment on the action.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of the model.",
+          "launch_stage": "GA"
+        },
+        "stage": {
+          "description": "Target stage of the transition. Valid values are:\n\n* `None`: The initial stage of a model version.\n\n* `Staging`: Staging or pre-production stage.\n\n* `Production`: Production stage.\n\n* `Archived`: Archived stage.",
+          "launch_stage": "GA"
+        },
+        "version": {
+          "description": "Version of the model.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.RejectTransitionRequestResponse": {
+      "fields": {
+        "activity": {
+          "description": "New activity generated as a result of this operation.",
+          "ref": "ml.Activity",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.RenameModelRequest": {
+      "fields": {
+        "name": {
+          "description": "Registered model unique name identifier.",
+          "launch_stage": "GA"
+        },
+        "new_name": {
+          "description": "If provided, updates the name for this `registered_model`.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.RenameModelResponse": {
+      "fields": {
+        "registered_model": {
+          "ref": "ml.Model",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.RequestSource": {
+      "description": "A request-time data source whose value is provided at inference time: offline batch scoring or online serving endpoint",
+      "fields": {
+        "dataframe_schema": {
+          "description": "A schema containing scalar or nested fields, in Spark StructType JSON format\n(from df.schema.json()). This preserves field, array-element, and map-value nullability.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "flat_schema": {
+          "description": "A flat schema with scalar-typed fields only.",
+          "ref": "ml.FlatSchema",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.RestoreExperiment": {
+      "fields": {
+        "experiment_id": {
+          "description": "ID of the associated experiment.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.RestoreExperimentResponse": {},
+    "ml.RestoreRun": {
+      "fields": {
+        "run_id": {
+          "description": "ID of the run to restore.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.RestoreRunResponse": {},
+    "ml.RestoreRuns": {
+      "fields": {
+        "experiment_id": {
+          "description": "The ID of the experiment containing the runs to restore.",
+          "launch_stage": "GA"
+        },
+        "max_runs": {
+          "description": "An optional positive integer indicating the maximum number of runs to restore. The maximum allowed value for\nmax_runs is 10000.",
+          "launch_stage": "GA"
+        },
+        "min_timestamp_millis": {
+          "description": "The minimum deletion timestamp in milliseconds since the UNIX epoch for restoring runs. Only runs deleted no\nearlier than this timestamp are restored.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.RestoreRunsResponse": {
+      "fields": {
+        "runs_restored": {
+          "description": "The number of runs restored.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.RollingWindow": {
+      "description": "A rolling time window with an optional non-negative delay.",
+      "fields": {
+        "delay": {
+          "description": "Non-negative analytic lag that evaluates the window this far in the past. Use this for timing\nvariations unrelated to source lateness, such as a 30-day count as of one week ago. If unset,\nthe analytic lag is zero. It composes with source.lateness when both are set.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "window_duration": {
+          "description": "The duration of the rolling window. Must be positive when set; absent means lifetime\n(aggregate over the entity's entire history).",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.Run": {
+      "description": "A single run.",
+      "fields": {
+        "data": {
+          "description": "Run data.",
+          "ref": "ml.RunData",
+          "launch_stage": "GA"
+        },
+        "info": {
+          "description": "Run metadata.",
+          "ref": "ml.RunInfo",
+          "launch_stage": "GA"
+        },
+        "inputs": {
+          "description": "Run inputs.",
+          "ref": "ml.RunInputs",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.RunData": {
+      "description": "Run data (metrics, params, and tags).",
+      "fields": {
+        "metrics": {
+          "description": "Run metrics.",
+          "launch_stage": "GA"
+        },
+        "params": {
+          "description": "Run parameters.",
+          "launch_stage": "GA"
+        },
+        "tags": {
+          "description": "Additional metadata key-value pairs.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.RunInfo": {
+      "description": "Metadata of a single run.",
+      "fields": {
+        "artifact_uri": {
+          "description": "URI of the directory where artifacts should be uploaded.\nThis can be a local path (starting with \"/\"), or a distributed file system (DFS)\npath, like ``s3://bucket/directory`` or ``dbfs:/my/directory``.\nIf not set, the local ``./mlruns`` directory is  chosen.",
+          "launch_stage": "GA"
+        },
+        "end_time": {
+          "description": "Unix timestamp of when the run ended in milliseconds.",
+          "launch_stage": "GA"
+        },
+        "experiment_id": {
+          "description": "The experiment ID.",
+          "launch_stage": "GA"
+        },
+        "lifecycle_stage": {
+          "description": "Current life cycle stage of the experiment : OneOf(\"active\", \"deleted\")",
+          "launch_stage": "GA"
+        },
+        "run_id": {
+          "description": "Unique identifier for the run.",
+          "launch_stage": "GA"
+        },
+        "run_name": {
+          "description": "The name of the run.",
+          "launch_stage": "GA"
+        },
+        "run_uuid": {
+          "description": "[Deprecated, use run_id instead] Unique identifier for the run. This field will\nbe removed in a future MLflow version.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "start_time": {
+          "description": "Unix timestamp of when the run started in milliseconds.",
+          "launch_stage": "GA"
+        },
+        "status": {
+          "description": "Current status of the run.",
+          "ref": "ml.RunInfoStatus",
+          "launch_stage": "GA"
+        },
+        "user_id": {
+          "description": "User who initiated the run.\nThis field is deprecated as of MLflow 1.0, and will be removed in a future\nMLflow release. Use 'mlflow.user' tag instead.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.RunInfoStatus": {
+      "description": "Status of a run.",
+      "enum": [
+        "RUNNING",
+        "SCHEDULED",
+        "FINISHED",
+        "FAILED",
+        "KILLED"
+      ],
+      "enum_launch_stages": {
+        "FAILED": "GA",
+        "FINISHED": "GA",
+        "KILLED": "GA",
+        "RUNNING": "GA",
+        "SCHEDULED": "GA"
+      }
+    },
+    "ml.RunInputs": {
+      "description": "Run inputs.",
+      "fields": {
+        "dataset_inputs": {
+          "description": "Run metrics.",
+          "launch_stage": "GA"
+        },
+        "model_inputs": {
+          "description": "Model inputs to the Run.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.RunTag": {
+      "description": "Tag for a run.",
+      "fields": {
+        "key": {
+          "description": "The tag key.",
+          "launch_stage": "GA"
+        },
+        "value": {
+          "description": "The tag value.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.SawtoothWindow": {
+      "description": "A sawtooth window served via the hybrid batch + streaming path. The batch pipeline maintains\ndaily partial aggregates for the bulk of the window while the streaming pipeline maintains the\nmost recent day(s), and serving merges them on read. Same field shape as RollingWindow, but a\ndistinct type so the control plane can explicitly identify hybrid (sawtooth) features rather\nthan inferring hybrid behavior from window_duration.",
+      "fields": {
+        "delay": {
+          "description": "Delay is not currently supported for Sawtooth windows.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "window_duration": {
+          "description": "The duration of the window. Must be positive and span more than two days when set, so that both\nthe batch (N-1 day) and stale-path (N-2 day) partial aggregates are well defined. The duration\nneed not be a whole number of days (e.g. 3 days 15 minutes is allowed). Absent means lifetime\n(aggregate over the entity's entire history).",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.ScalarDataType": {
+      "description": "Scalar data types for request-time field definitions.\nOnly flat (non-nested) types are supported.",
+      "enum": [
+        "INTEGER",
+        "FLOAT",
+        "BOOLEAN",
+        "STRING",
+        "DOUBLE",
+        "LONG",
+        "TIMESTAMP",
+        "DATE",
+        "SHORT",
+        "BINARY",
+        "DECIMAL"
+      ],
+      "enum_launch_stages": {
+        "BINARY": "GA",
+        "BOOLEAN": "GA",
+        "DATE": "GA",
+        "DECIMAL": "GA",
+        "DOUBLE": "GA",
+        "FLOAT": "GA",
+        "INTEGER": "GA",
+        "LONG": "GA",
+        "SHORT": "GA",
+        "STRING": "GA",
+        "TIMESTAMP": "GA"
+      }
+    },
+    "ml.SchemaConfig": {
+      "fields": {
+        "avro_schema": {
+          "description": "Avro schema in JSON format (https://avro.apache.org/docs/current/specification/).",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "json_schema": {
+          "description": "Schema of the JSON object in standard IETF JSON schema format (https://json-schema.org/).",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "proto_schema": {
+          "description": "Protocol Buffer schema with its payload message name.",
+          "ref": "ml.ProtoSchemaSpec",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.SchemaLocator": {
+      "description": "Schema locator for one side (payload or key) of a message.\nIdentifies which schema to use in the schema registry and the serialization format.",
+      "fields": {
+        "confluent_schema": {
+          "description": "Confluent Schema Registry schema locator.",
+          "ref": "ml.SchemaLocatorConfluentSchema",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "format": {
+          "description": "Serialization format for this schema.",
+          "ref": "ml.SchemaLocatorFormat",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.SchemaLocatorConfluentSchema": {
+      "description": "Confluent Schema Registry schema locator.\nThe value to provide for `subject` depends on the naming strategy configured in your registry:\n- TopicNameStrategy (default): \"{topic}-key\" or \"{topic}-value\"\ne.g. for topic \"transactions\" use \"transactions-value\" for the payload and \"transactions-key\" for the key.\n- RecordNameStrategy: the fully-qualified record name\ne.g. \"com.example.Payment\" for Avro, the bare message name (without package) for Protobuf,\nor the `title` field value for JSON.\n- TopicRecordNameStrategy: \"{topic}-{fully-qualified-record-name}\"\ne.g. \"transactions-com.example.Payment\".",
+      "fields": {
+        "subject": {
+          "description": "The Confluent schema registry subject name.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.SchemaLocatorFormat": {
+      "description": "Supported serialization formats for a schema registry schema.",
+      "enum": [
+        "FORMAT_AVRO",
+        "FORMAT_PROTOBUF",
+        "FORMAT_JSON"
+      ],
+      "enum_launch_stages": {
+        "FORMAT_AVRO": "GA",
+        "FORMAT_JSON": "GA",
+        "FORMAT_PROTOBUF": "GA"
+      }
+    },
+    "ml.SchemaRegistryConfig": {
+      "description": "Configuration for resolving a Stream's schema from an external schema registry (e.g. Confluent).",
+      "fields": {
+        "api_secret_ref": {
+          "description": "Reference to the schema registry API secret in a Databricks secret scope.\nSet this only if required for authentication for the schema registry.",
+          "ref": "ml.SecretScopeReference",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "key_schema_locator": {
+          "description": "Schema locator for the message key. Only used for Kafka streams.\nAt least one of payload_schema_locator or key_schema_locator must be set.",
+          "ref": "ml.SchemaLocator",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "payload_schema_locator": {
+          "description": "Schema locator for the message payload. For Kafka this is the value.\nAt least one of payload_schema_locator or key_schema_locator must be set.",
+          "ref": "ml.SchemaLocator",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "uc_connection": {
+          "description": "A Schema Registry UC Connection object.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.SearchExperiments": {
+      "fields": {
+        "filter": {
+          "description": "String representing a SQL filter condition (e.g. \"name ILIKE 'my-experiment%'\")",
+          "launch_stage": "GA"
+        },
+        "max_results": {
+          "description": "Maximum number of experiments desired. Max threshold is 3000.",
+          "launch_stage": "GA"
+        },
+        "order_by": {
+          "description": "List of columns for ordering search results, which can include experiment name and last updated\ntimestamp with an optional \"DESC\" or \"ASC\" annotation, where \"ASC\" is the default.\nTiebreaks are done by experiment id DESC.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Token indicating the page of experiments to fetch",
+          "launch_stage": "GA"
+        },
+        "view_type": {
+          "description": "Qualifier for type of experiments to be returned.\nIf unspecified, return only active experiments.",
+          "ref": "ml.ViewType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.SearchExperimentsResponse": {
+      "fields": {
+        "experiments": {
+          "description": "Experiments that match the search criteria",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "Token that can be used to retrieve the next page of experiments.\nAn empty token means that no more experiments are available for retrieval.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.SearchIssuesRequest": {
+      "description": "Request for SearchIssues.",
+      "fields": {
+        "categories": {
+          "description": "Matches Issues with any of these categories, case-insensitively.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "page_size": {
+          "description": "Defaults to 20; values above 100 are clamped.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "page_token": {
+          "description": "Expires after 15 minutes. Every other argument except `view` must match the\nrequest that returned the token.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "query": {
+          "description": "Case-insensitive substring match on title.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "severities": {
+          "description": "Matches Issues with any of these severities.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "sort_key": {
+          "description": "Defaults to SEVERITY.",
+          "ref": "ml.IssueSortKey",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "sort_order": {
+          "description": "Defaults to DESCENDING.",
+          "ref": "ml.SortOrder",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "statuses": {
+          "description": "Matches Issues with any of these statuses. Different filters AND together,\nand an empty filter matches every Issue.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "tag_filters": {
+          "description": "Matches Issues that satisfy every filter. At most 10 filters of 20 values\neach.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "view": {
+          "description": "Defaults to BASIC.",
+          "ref": "ml.IssueView",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "ml.SearchIssuesResponse": {
+      "description": "One page of SearchIssues results.",
+      "fields": {
+        "issues": {
+          "description": "The page's Issues, in the requested order.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "next_page_token": {
+          "description": "Absent on the last page.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "total_size": {
+          "description": "Exact number of matching Issues.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "ml.SearchLoggedModelsDataset": {
+      "fields": {
+        "dataset_digest": {
+          "description": "The digest of the dataset.",
+          "launch_stage": "GA"
+        },
+        "dataset_name": {
+          "description": "The name of the dataset.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.SearchLoggedModelsOrderBy": {
+      "fields": {
+        "ascending": {
+          "description": "Whether the search results order is ascending or not.",
+          "launch_stage": "GA"
+        },
+        "dataset_digest": {
+          "description": "If ``field_name`` refers to a metric, this field specifies the digest of the dataset\nassociated with the metric. Only metrics associated with the specified dataset name\nand digest will be considered for ordering. This field may only be set if ``dataset_name``\nis also set.",
+          "launch_stage": "GA"
+        },
+        "dataset_name": {
+          "description": "If ``field_name`` refers to a metric, this field specifies the name of the dataset\nassociated with the metric. Only metrics associated with the specified dataset name will be\nconsidered for ordering. This field may only be set if ``field_name`` refers to a metric.",
+          "launch_stage": "GA"
+        },
+        "field_name": {
+          "description": "The name of the field to order by, e.g. \"metrics.accuracy\".",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.SearchLoggedModelsRequest": {
+      "fields": {
+        "datasets": {
+          "description": "List of datasets on which to apply the metrics filter clauses.\nFor example, a filter with `metrics.accuracy \u003e 0.9` and dataset info with name \"test_dataset\"\nmeans we will return all logged models with accuracy \u003e 0.9 on the test_dataset.\nMetric values from ANY dataset matching the criteria are considered.\nIf no datasets are specified, then metrics across all datasets are considered in the filter.",
+          "launch_stage": "GA"
+        },
+        "experiment_ids": {
+          "description": "The IDs of the experiments in which to search for logged models.",
+          "launch_stage": "GA"
+        },
+        "filter": {
+          "description": "A filter expression over logged model info and data that allows returning a subset of\nlogged models. The syntax is a subset of SQL that supports AND'ing together binary operations.\n\nExample: ``params.alpha \u003c 0.3 AND metrics.accuracy \u003e 0.9``.",
+          "launch_stage": "GA"
+        },
+        "max_results": {
+          "description": "The maximum number of Logged Models to return. The maximum limit is 50.",
+          "launch_stage": "GA"
+        },
+        "order_by": {
+          "description": "The list of columns for ordering the results, with additional fields for sorting criteria.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "The token indicating the page of logged models to fetch.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.SearchLoggedModelsResponse": {
+      "fields": {
+        "models": {
+          "description": "Logged models that match the search criteria.",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "The token that can be used to retrieve the next page of logged models.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.SearchModelVersionsRequest": {
+      "fields": {
+        "filter": {
+          "description": "String filter condition, like \"name='my-model-name'\". Must be a single boolean condition,\nwith string values wrapped in single quotes.",
+          "launch_stage": "GA"
+        },
+        "max_results": {
+          "description": "Maximum number of models desired. Max threshold is 10K.",
+          "launch_stage": "GA"
+        },
+        "order_by": {
+          "description": "List of columns to be ordered by including model name, version, stage with an\noptional \"DESC\" or \"ASC\" annotation, where \"ASC\" is the default.\nTiebreaks are done by latest stage transition timestamp, followed by name ASC, followed by\nversion DESC.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Pagination token to go to next page based on previous search query.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.SearchModelVersionsResponse": {
+      "fields": {
+        "model_versions": {
+          "description": "Models that match the search criteria",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "Pagination token to request next page of models for the same search query.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.SearchModelsRequest": {
+      "fields": {
+        "filter": {
+          "description": "String filter condition, like \"name LIKE 'my-model-name'\".\nInterpreted in the backend automatically as \"name LIKE '%my-model-name%'\".\nSingle boolean condition, with string values wrapped in single quotes.",
+          "launch_stage": "GA"
+        },
+        "max_results": {
+          "description": "Maximum number of models desired. Default is 100. Max threshold is 1000.",
+          "launch_stage": "GA"
+        },
+        "order_by": {
+          "description": "List of columns for ordering search results, which can include model name and last updated\ntimestamp with an optional \"DESC\" or \"ASC\" annotation, where \"ASC\" is the default.\nTiebreaks are done by model name ASC.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Pagination token to go to the next page based on a previous search query.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.SearchModelsResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "Pagination token to request the next page of models.",
+          "launch_stage": "GA"
+        },
+        "registered_models": {
+          "description": "Registered Models that match the search criteria.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.SearchRuns": {
+      "fields": {
+        "experiment_ids": {
+          "description": "List of experiment IDs to search over.",
+          "launch_stage": "GA"
+        },
+        "filter": {
+          "description": "A filter expression over params, metrics, and tags, that allows returning a subset of\nruns. The syntax is a subset of SQL that supports ANDing together binary operations\nbetween a param, metric, or tag and a constant.\n\nExample: `metrics.rmse \u003c 1 and params.model_class = 'LogisticRegression'`\n\nYou can select columns with special characters (hyphen, space, period, etc.) by using double quotes:\n`metrics.\"model class\" = 'LinearRegression' and tags.\"user-name\" = 'Tomas'`\n\nSupported operators are `=`, `!=`, `\u003e`, `\u003e=`, `\u003c`, and `\u003c=`.",
+          "launch_stage": "GA"
+        },
+        "max_results": {
+          "description": "Maximum number of runs desired. Max threshold is 50000",
+          "launch_stage": "GA"
+        },
+        "order_by": {
+          "description": "List of columns to be ordered by, including attributes, params, metrics, and tags with an\noptional `\"DESC\"` or `\"ASC\"` annotation, where `\"ASC\"` is the default.\nExample: `[\"params.input DESC\", \"metrics.alpha ASC\", \"metrics.rmse\"]`.\nTiebreaks are done by start_time `DESC` followed by `run_id` for runs with the same start time\n(and this is the default ordering criterion if order_by is not provided).",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Token for the current page of runs.",
+          "launch_stage": "GA"
+        },
+        "run_view_type": {
+          "description": "Whether to display only active, only deleted, or all runs.\nDefaults to only active runs.",
+          "ref": "ml.ViewType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.SearchRunsResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "Token for the next page of runs.",
+          "launch_stage": "GA"
+        },
+        "runs": {
+          "description": "Runs that match the search criteria.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.SecretScopeReference": {
+      "description": "Reference to an entry in a Databricks secret scope.",
+      "fields": {
+        "key": {
+          "description": "The key within the scope.",
+          "launch_stage": "GA"
+        },
+        "scope": {
+          "description": "The Databricks secret scope name.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.SetExperimentTag": {
+      "fields": {
+        "experiment_id": {
+          "description": "ID of the experiment under which to log the tag. Must be provided.",
+          "launch_stage": "GA"
+        },
+        "key": {
+          "description": "Name of the tag. Keys up to 250 bytes in size are supported.",
+          "launch_stage": "GA"
+        },
+        "value": {
+          "description": "String value of the tag being logged. Values up to 64KB in size are supported.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.SetExperimentTagResponse": {},
+    "ml.SetLoggedModelTagsRequest": {
+      "fields": {
+        "tags": {
+          "description": "The tags to set on the logged model.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.SetLoggedModelTagsResponse": {},
+    "ml.SetModelTagRequest": {
+      "fields": {
+        "key": {
+          "description": "Name of the tag. Maximum size depends on storage backend.\nIf a tag with this name already exists, its preexisting value will be replaced by the specified `value`.\nAll storage backends are guaranteed to support key values up to 250 bytes in size.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Unique name of the model.",
+          "launch_stage": "GA"
+        },
+        "value": {
+          "description": "String value of the tag being logged. Maximum size depends on storage backend.\nAll storage backends are guaranteed to support key values up to 5000 bytes in size.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.SetModelTagResponse": {},
+    "ml.SetModelVersionTagRequest": {
+      "fields": {
+        "key": {
+          "description": "Name of the tag. Maximum size depends on storage backend.\nIf a tag with this name already exists, its preexisting value will be replaced by the specified `value`.\nAll storage backends are guaranteed to support key values up to 250 bytes in size.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Unique name of the model.",
+          "launch_stage": "GA"
+        },
+        "value": {
+          "description": "String value of the tag being logged. Maximum size depends on storage backend.\nAll storage backends are guaranteed to support key values up to 5000 bytes in size.",
+          "launch_stage": "GA"
+        },
+        "version": {
+          "description": "Model version number.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.SetModelVersionTagResponse": {},
+    "ml.SetTag": {
+      "fields": {
+        "key": {
+          "description": "Name of the tag. Keys up to 250 bytes in size are supported.",
+          "launch_stage": "GA"
+        },
+        "run_id": {
+          "description": "ID of the run under which to log the tag. Must be provided.",
+          "launch_stage": "GA"
+        },
+        "run_uuid": {
+          "description": "[Deprecated, use `run_id` instead] ID of the run under which to log the tag. This field will\nbe removed in a future MLflow version.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "value": {
+          "description": "String value of the tag being logged. Values up to 64KB in size are supported.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.SetTagResponse": {},
+    "ml.SlidingWindow": {
+      "fields": {
+        "delay": {
+          "description": "Non-negative analytic lag that evaluates the window this far in the past. Use this for timing\nvariations unrelated to source lateness, such as a 30-day count as of one week ago. If unset,\nthe analytic lag is zero. It composes with source.lateness when both are set.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "offset": {
+          "description": "Non-negative phase shift from the default midnight UTC alignment. For example, offset=22h on\na 24h slide produces boundaries at 22:00 UTC (17:00 New York in standard time) instead of\nmidnight UTC. If unset, the offset is zero. Must be shorter than slide_duration (and therefore\nwindow_duration).",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "slide_duration": {
+          "description": "The slide duration (interval by which windows advance, must be positive and less than duration).",
+          "launch_stage": "GA"
+        },
+        "window_duration": {
+          "description": "The duration of the sliding window. Must be positive when set; absent means lifetime\n(aggregate over the entity's entire history).",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.SortOrder": {
+      "description": "The direction of the ordering.",
+      "enum": [
+        "DESCENDING",
+        "ASCENDING"
+      ],
+      "enum_launch_stages": {
+        "ASCENDING": "PUBLIC_BETA",
+        "DESCENDING": "PUBLIC_BETA"
+      }
+    },
+    "ml.SourceLateness": {
+      "description": "Configures when event-time data from this source is considered complete for a Feature.",
+      "fields": {
+        "settling_delay": {
+          "description": "Non-negative time to wait after a window ends before treating its source data as complete.\nTraining shifts the eligible evaluation time backwards by this duration so it does not join\ndata that would still have been settling online. Materialization waits for the duration to\nelapse before publishing the window. If unset, source data is considered settled immediately.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.Status": {
+      "description": "The status of the model version. Valid values are:\n* `PENDING_REGISTRATION`: Request to register a new model version is pending as server performs background tasks.\n\n* `FAILED_REGISTRATION`: Request to register a new model version has failed.\n\n* `READY`: Model version is ready for use.",
+      "enum": [
+        "PENDING_REGISTRATION",
+        "FAILED_REGISTRATION",
+        "READY"
+      ],
+      "enum_launch_stages": {
+        "FAILED_REGISTRATION": "GA",
+        "PENDING_REGISTRATION": "GA",
+        "READY": "GA"
+      },
+      "enum_descriptions": {
+        "FAILED_REGISTRATION": "Request to register a new model version has failed.",
+        "PENDING_REGISTRATION": "Request to register a new model version is pending as server performs background tasks.",
+        "READY": "Model version is ready for use."
+      }
+    },
+    "ml.StddevPopFunction": {
+      "description": "Computes the population standard deviation.",
+      "fields": {
+        "input": {
+          "description": "The input column from which the population standard deviation is computed. For Kafka sources,\nuse dot-prefixed path notation (e.g., \"value.amount\"). For nested fields, the leaf node name is used.\nColon-prefixed notation (e.g., \"value:amount\") is supported for backwards\ncompatibility but is deprecated; migrate to dot notation.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.StddevSampFunction": {
+      "description": "Computes the sample standard deviation.",
+      "fields": {
+        "input": {
+          "description": "The input column from which the sample standard deviation is computed.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.Stream": {
+      "description": "A Stream is a governed UC entity representing an external streaming data source.\nThe source_config field determines the streaming platform source (e.g. Kafka, Kinesis).",
+      "fields": {
+        "browse_only": {
+          "description": "Indicates whether the principal is limited to retrieving metadata for the\nassociated object through the BROWSE privilege when include_browse is enabled in the request.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "connection_config": {
+          "description": "Specifies how to connect and authenticate to the stream platform.",
+          "ref": "ml.StreamConnectionConfig",
+          "launch_stage": "GA"
+        },
+        "create_time": {
+          "description": "Time at which this Stream was created.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "created_by": {
+          "description": "Username of the Stream creator.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "description": {
+          "description": "User-provided description.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "excluded_columns": {
+          "description": "Column paths (dot notation, e.g. \"value.email\" for Kafka) to drop.\nA path may reference a struct, in which case all of its nested fields are dropped (e.g. \"value.address\" drops \"value.address.city\" and \"value.address.zip\").\nThese columns are not written to the ingestion table and cannot be referenced by any feature.\nThey are dropped from ingestion, backfill, and materialization.\nFor direct schemas, each column must exist in the relevant key or payload schema. With a schema registry, a column can be excluded before it exists.\nA column cannot also be a deduplication column in the ingestion_config.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "ingestion_config": {
+          "description": "Configuration for streaming data ingestion: the managed table storing an offline copy of forward fill data and optional historical backfill.",
+          "ref": "ml.IngestionConfig",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Full three-part (catalog.schema.stream) name of the stream.",
+          "launch_stage": "GA"
+        },
+        "record_type_filter": {
+          "description": "Optional SQL predicate to filter which record types from a streaming channel (e.g. a topic for Kafka) belong to this Stream.\nEvents that do not match are not written to the ingestion table and are not used in materialization.\nExample: \"value.event_type = 'transaction'\".",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "schema_config": {
+          "description": "Schema definitions for the stream, provided either directly on the Stream or\nresolved from an external schema registry through a UC Connection.",
+          "ref": "ml.StreamSchemaConfig",
+          "launch_stage": "GA"
+        },
+        "source_config": {
+          "description": "Source-specific configuration. Determines the streaming platform source.",
+          "ref": "ml.StreamSourceConfig",
+          "launch_stage": "GA"
+        },
+        "update_time": {
+          "description": "Time at which this Stream was last modified.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "updated_by": {
+          "description": "Username of user who last modified the Stream.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "ml.StreamArnList": {
+      "description": "A list of Kinesis stream ARNs to read from.",
+      "fields": {
+        "arns": {
+          "description": "Kinesis stream ARNs to read from. For example,\n'arn:aws:kinesis:us-west-2:111122223333:stream/stream-a'.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.StreamConnectionConfig": {
+      "description": "Specifies how to connect and authenticate to the stream platform.",
+      "fields": {
+        "direct_mtls_config": {
+          "description": "Direct mTLS configuration for stream platform access.",
+          "ref": "ml.DirectMtlsConfig",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "uc_connection_name": {
+          "description": "Name of an existing UC Connection for stream platform access.\nMust be the correct type for the streaming platform (e.g. a Kafka Connection for a Kafka\nStream, or a Kinesis Connection for a Kinesis Stream).",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.StreamNameList": {
+      "description": "A list of Kinesis stream names to read from.",
+      "fields": {
+        "names": {
+          "description": "Kinesis stream names to read from.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.StreamSchemaConfig": {
+      "description": "Schema definitions for the stream.\nFeature store supports both direct schemas and schema registries.",
+      "fields": {
+        "direct_schemas": {
+          "description": "Schema definitions provided directly on the Stream.",
+          "ref": "ml.DirectSchemas",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "schema_registry_config": {
+          "description": "Resolve schemas from an external schema registry.",
+          "ref": "ml.SchemaRegistryConfig",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.StreamSource": {
+      "description": "A Stream entity used as a data source for a feature.",
+      "fields": {
+        "dataframe_schema": {
+          "description": "Schema of the resulting dataframe after transformations, in Spark StructType\nJSON format (from df.schema.json()).\nAny subsequent functions operate against this dataframe.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "filter_condition": {
+          "description": "The filter condition applied to the source data before aggregation.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "full_name": {
+          "description": "Three-part full name of the Stream (catalog.schema.stream).",
+          "launch_stage": "GA"
+        },
+        "transformation_sql": {
+          "description": "The pipeline runs these SQL statements immediately after conversion into\nthe schema specified on the Stream object.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.StreamSourceConfig": {
+      "description": "Source-specific configuration. Determines the streaming platform source.",
+      "fields": {
+        "kafka_stream_config": {
+          "description": "Configuration for Apache Kafka streams.",
+          "ref": "ml.KafkaStreamConfig",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "kinesis_stream_config": {
+          "description": "Configuration for AWS Kinesis Data Streams.",
+          "ref": "ml.KinesisStreamConfig",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.StreamingMode": {
+      "description": "The streaming mode configuration for a streaming materialization pipeline.",
+      "fields": {
+        "freshness_target": {
+          "description": "The desired data freshness for feature materialization, expressed as a\nduration string (e.g. \"1 minute\").",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "mode": {
+          "description": "The type of streaming mode used by the materialization pipeline.",
+          "ref": "ml.StreamingModeStreamingModeType",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "shuffle_partitions": {
+          "description": "Number of shuffle partitions for streaming materialization of this feature.\nHigher values process high-throughput features with more parallelism at higher compute cost.\nMaterialized features which are computed together will use the largest value set among them.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.StreamingModeStreamingModeType": {
+      "enum": [
+        "STREAMING_MODE_TYPE_RTM",
+        "STREAMING_MODE_TYPE_MBM"
+      ],
+      "enum_launch_stages": {
+        "STREAMING_MODE_TYPE_MBM": "GA",
+        "STREAMING_MODE_TYPE_RTM": "GA"
+      }
+    },
+    "ml.SubscriptionMode": {
+      "description": "Deprecated: Use KafkaSubscriptionMode instead.",
+      "fields": {
+        "assign": {
+          "description": "A JSON string that contains the specific topic-partitions to consume from.\nFor example, for '{\"topicA\":[0,1],\"topicB\":[2,4]}', topicA's 0'th and 1st partitions will be consumed from.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "subscribe": {
+          "description": "A comma-separated list of Kafka topics to read from. For example, 'topicA,topicB,topicC'.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "subscribe_pattern": {
+          "description": "A regular expression matching topics to subscribe to. For example, 'topic.*' will subscribe to all topics starting with 'topic'.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.SumFunction": {
+      "description": "Computes the sum of values.",
+      "fields": {
+        "input": {
+          "description": "The input column from which the sum is computed. For Kafka sources, use dot-prefixed path\nnotation (e.g., \"value.amount\"). For nested fields, the leaf node name is used.\nColon-prefixed notation (e.g., \"value:amount\") is supported for backwards\ncompatibility but is deprecated; migrate to dot notation.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.TableTrigger": {
+      "description": "A trigger that fires when the upstream source table changes."
+    },
+    "ml.TestRegistryWebhookRequest": {
+      "description": "Details required to test a registry webhook.",
+      "fields": {
+        "event": {
+          "description": "If `event` is specified, the test trigger uses the specified event. If `event` is not specified, the test trigger uses a randomly chosen event associated with the webhook.",
+          "ref": "ml.RegistryWebhookEvent",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "Webhook ID",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.TestRegistryWebhookResponse": {
+      "fields": {
+        "body": {
+          "description": "Body of the response from the webhook URL",
+          "launch_stage": "GA"
+        },
+        "status_code": {
+          "description": "Status code returned by the webhook URL",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.TimeWindow": {
+      "fields": {
+        "continuous": {
+          "ref": "ml.ContinuousWindow",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "rolling": {
+          "ref": "ml.RollingWindow",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "sawtooth": {
+          "description": "A sawtooth window served via the hybrid batch + streaming path.",
+          "ref": "ml.SawtoothWindow",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "sliding": {
+          "ref": "ml.SlidingWindow",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "start_time": {
+          "description": "Earliest event-time boundary at which the Feature may emit an output. This gates outputs, not\nthe historical inputs read by a window. For example, a 365-day window with\nstart_time=2026-01-01 begins emitting partial-window values on that date instead of waiting\nfor 365 days of data; a lifetime window produces no output before start_time. If unset,\ntumbling and fixed-duration sliding windows first emit at an offset-aligned boundary after a\nfull window can be formed. If unset, lifetime sliding windows and rolling windows emit as soon as\neligible source data exists.\nNot currently supported for sawtooth windows or for Features with a stream source.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "tumbling": {
+          "ref": "ml.TumblingWindow",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.TimeseriesColumn": {
+      "fields": {
+        "name": {
+          "description": "The name of the timeseries column. For Kafka sources, use dot-prefixed path notation to\nreference fields within the key or value schema (e.g., \"value.event_timestamp\"). For nested\nfields, the leaf node name (e.g., \"event_timestamp\" from \"value.event_details.event_timestamp\")\nis what will be present in materialized tables and expected to match at query time.\nColon-prefixed notation (e.g., \"value:event_timestamp\") is supported for\nbackwards compatibility but is deprecated; migrate to dot notation.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.TransitionModelVersionStageDatabricks": {
+      "description": "Details required to transition a model version's stage.",
+      "fields": {
+        "archive_existing_versions": {
+          "description": "Specifies whether to archive all current model versions in the target stage.",
+          "launch_stage": "GA"
+        },
+        "comment": {
+          "description": "User-provided comment on the action.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of the model.",
+          "launch_stage": "GA"
+        },
+        "stage": {
+          "description": "Target stage of the transition. Valid values are:\n\n* `None`: The initial stage of a model version.\n\n* `Staging`: Staging or pre-production stage.\n\n* `Production`: Production stage.\n\n* `Archived`: Archived stage.",
+          "launch_stage": "GA"
+        },
+        "version": {
+          "description": "Version of the model.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.TransitionRequest": {
+      "description": "For activities, this contains the activity recorded for the action.\nFor comments, this contains the comment details.\nFor transition requests, this contains the transition request details.",
+      "fields": {
+        "available_actions": {
+          "description": "Array of actions on the activity allowed for the current viewer.",
+          "launch_stage": "GA"
+        },
+        "comment": {
+          "description": "User-provided comment associated with the activity, comment, or transition request.",
+          "launch_stage": "GA"
+        },
+        "creation_timestamp": {
+          "description": "Creation time of the object, as a Unix timestamp in milliseconds.",
+          "launch_stage": "GA"
+        },
+        "to_stage": {
+          "description": "Target stage of the transition (if the activity is stage transition related). Valid values are:\n\n* `None`: The initial stage of a model version.\n\n* `Staging`: Staging or pre-production stage.\n\n* `Production`: Production stage.\n\n* `Archived`: Archived stage.",
+          "launch_stage": "GA"
+        },
+        "user_id": {
+          "description": "The username of the user that created the object.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.TransitionStageResponse": {
+      "fields": {
+        "model_version_databricks": {
+          "description": "Updated model version",
+          "ref": "ml.ModelVersionDatabricks",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.TumblingWindow": {
+      "fields": {
+        "delay": {
+          "description": "Non-negative analytic lag that evaluates the window this far in the past. Use this for timing\nvariations unrelated to source lateness, such as a 30-day count as of one week ago. If unset,\nthe analytic lag is zero. It composes with source.lateness when both are set.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "offset": {
+          "description": "Non-negative phase shift from the default midnight UTC alignment. For example, offset=22h on\na 24h window produces boundaries at 22:00 UTC (17:00 New York in standard time) instead of\nmidnight UTC. If unset, the offset is zero. Must be shorter than window_duration.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "window_duration": {
+          "description": "The duration of each tumbling window (non-overlapping, fixed-duration windows).",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.UcTraceLocation": {
+      "description": "A Unity Catalog trace storage location. Traces are stored as Delta tables\nin the specified catalog and schema.",
+      "fields": {
+        "catalog": {
+          "description": "The name of the Unity Catalog catalog.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "effective_table_prefix": {
+          "description": "The trace-table prefix actually in effect: `table_prefix` if it was set on\ncreation, otherwise the server-generated default.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "schema": {
+          "description": "The name of the Unity Catalog schema within `catalog`.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "table_prefix": {
+          "description": "The prefix for the trace tables, which are named\n`{catalog}.{schema}.{table_prefix}_otel_*`. May only contain letters,\ndigits, and underscores, and may be at most 238 characters. When unset, a\nserver-generated prefix derived from the experiment ID is used and this\nfield stays empty on read; the resolved value is always available in\n`effective_table_prefix`.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        }
+      }
+    },
+    "ml.UpdateComment": {
+      "description": "Details required to edit a comment on a model version.",
+      "fields": {
+        "comment": {
+          "description": "User-provided comment on the action.",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "Unique identifier of an activity",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.UpdateCommentResponse": {
+      "fields": {
+        "comment": {
+          "description": "Updated comment object",
+          "ref": "ml.CommentObject",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.UpdateExperiment": {
+      "fields": {
+        "experiment_id": {
+          "description": "ID of the associated experiment.",
+          "launch_stage": "GA"
+        },
+        "new_name": {
+          "description": "If provided, the experiment's name is changed to the new name. The new name must be unique.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.UpdateExperimentResponse": {},
+    "ml.UpdateFeatureRequest": {
+      "fields": {
+        "feature": {
+          "description": "Feature whose full_name identifies the target. Only description is mutable.",
+          "ref": "ml.Feature",
+          "launch_stage": "GA"
+        },
+        "update_mask": {
+          "description": "Fields to update. The only supported path is description.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.UpdateFeatureTagRequest": {
+      "fields": {
+        "feature_tag": {
+          "ref": "ml.FeatureTag",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "update_mask": {
+          "description": "The list of fields to update.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "ml.UpdateIssueRequest": {
+      "fields": {
+        "issue": {
+          "description": "`issue.name` identifies the target.",
+          "ref": "ml.Issue",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "update_mask": {
+          "description": "Accepts title, description, status, severity, categories, tags,\nlast_seen_time, and metadata.\u003ckey\u003e. A path with an empty value clears the\nfield, except that title, status, and severity can't be cleared, and\nlast_seen_time can be cleared only when source_type is MANUAL. categories\nand tags are replaced whole. metadata is updated per key: a metadata.\u003ckey\u003e\npath sets that key from issue.metadata, or removes it when issue.metadata\nlacks it, and leaves the other keys alone. A bare metadata path is rejected.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "ml.UpdateKafkaConfigRequest": {
+      "fields": {
+        "kafka_config": {
+          "description": "The Kafka config to update.",
+          "ref": "ml.KafkaConfig",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "update_mask": {
+          "description": "The list of fields to update.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "ml.UpdateMaterializedFeatureRequest": {
+      "fields": {
+        "materialized_feature": {
+          "description": "The materialized feature to update.",
+          "ref": "ml.MaterializedFeature",
+          "launch_stage": "GA"
+        },
+        "update_mask": {
+          "description": "Provide the materialization feature fields which should be updated.\nCurrently, only the pipeline_state field can be updated.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.UpdateModelRequest": {
+      "fields": {
+        "description": {
+          "description": "If provided, updates the description for this `registered_model`.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Registered model unique name identifier.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.UpdateModelResponse": {
+      "fields": {
+        "registered_model": {
+          "ref": "ml.Model",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.UpdateModelVersionRequest": {
+      "fields": {
+        "description": {
+          "description": "If provided, updates the description for this `registered_model`.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of the registered model",
+          "launch_stage": "GA"
+        },
+        "version": {
+          "description": "Model version number",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.UpdateModelVersionResponse": {
+      "fields": {
+        "model_version": {
+          "description": "Return new version number generated for this model in registry.",
+          "ref": "ml.ModelVersion",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.UpdateOnlineStoreRequest": {
+      "fields": {
+        "online_store": {
+          "description": "Online store to update.",
+          "ref": "ml.OnlineStore",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "update_mask": {
+          "description": "The list of fields to update.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "ml.UpdateRegistryWebhook": {
+      "description": "Details required to update a registry webhook. Only the fields that need to be updated should be specified, and both `http_url_spec` and `job_spec` should not be specified in the same request.",
+      "fields": {
+        "description": {
+          "description": "User-specified description for the webhook.",
+          "launch_stage": "GA"
+        },
+        "events": {
+          "description": "Events that can trigger a registry webhook:\n* `MODEL_VERSION_CREATED`: A new model version was created for the associated model.\n\n* `MODEL_VERSION_TRANSITIONED_STAGE`: A model version’s stage was changed.\n\n* `TRANSITION_REQUEST_CREATED`: A user requested a model version’s stage be transitioned.\n\n* `COMMENT_CREATED`: A user wrote a comment on a registered model.\n\n* `REGISTERED_MODEL_CREATED`: A new registered model was created. This event type can only be specified for a registry-wide webhook, which can be created by not specifying a model name in the create request.\n\n* `MODEL_VERSION_TAG_SET`: A user set a tag on the model version.\n\n* `MODEL_VERSION_TRANSITIONED_TO_STAGING`: A model version was transitioned to staging.\n\n* `MODEL_VERSION_TRANSITIONED_TO_PRODUCTION`: A model version was transitioned to production.\n\n* `MODEL_VERSION_TRANSITIONED_TO_ARCHIVED`: A model version was archived.\n\n* `TRANSITION_REQUEST_TO_STAGING_CREATED`: A user requested a model version be transitioned to staging.\n\n* `TRANSITION_REQUEST_TO_PRODUCTION_CREATED`: A user requested a model version be transitioned to production.\n\n* `TRANSITION_REQUEST_TO_ARCHIVED_CREATED`: A user requested a model version be archived.",
+          "launch_stage": "GA"
+        },
+        "http_url_spec": {
+          "ref": "ml.HttpUrlSpec",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "Webhook ID",
+          "launch_stage": "GA"
+        },
+        "job_spec": {
+          "ref": "ml.JobSpec",
+          "launch_stage": "GA"
+        },
+        "status": {
+          "ref": "ml.RegistryWebhookStatus",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.UpdateRun": {
+      "fields": {
+        "end_time": {
+          "description": "Unix timestamp in milliseconds of when the run ended.",
+          "launch_stage": "GA"
+        },
+        "run_id": {
+          "description": "ID of the run to update. Must be provided.",
+          "launch_stage": "GA"
+        },
+        "run_name": {
+          "description": "Updated name of the run.",
+          "launch_stage": "GA"
+        },
+        "run_uuid": {
+          "description": "[Deprecated, use `run_id` instead] ID of the run to update. This field will\nbe removed in a future MLflow version.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "status": {
+          "description": "Updated status of the run.",
+          "ref": "ml.UpdateRunStatus",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.UpdateRunResponse": {
+      "fields": {
+        "run_info": {
+          "description": "Updated metadata of the run.",
+          "ref": "ml.RunInfo",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.UpdateRunStatus": {
+      "description": "Status of a run.",
+      "enum": [
+        "RUNNING",
+        "SCHEDULED",
+        "FINISHED",
+        "FAILED",
+        "KILLED"
+      ],
+      "enum_launch_stages": {
+        "FAILED": "GA",
+        "FINISHED": "GA",
+        "KILLED": "GA",
+        "RUNNING": "GA",
+        "SCHEDULED": "GA"
+      }
+    },
+    "ml.UpdateStreamRequest": {
+      "fields": {
+        "stream": {
+          "description": "The Stream to update.",
+          "ref": "ml.Stream",
+          "launch_stage": "GA"
+        },
+        "update_mask": {
+          "description": "The list of fields to update.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.UpdateWebhookResponse": {
+      "fields": {
+        "webhook": {
+          "ref": "ml.RegistryWebhook",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.VarPopFunction": {
+      "description": "Computes the population variance.",
+      "fields": {
+        "input": {
+          "description": "The input column from which the population variance is computed.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.VarSampFunction": {
+      "description": "Computes the sample variance.",
+      "fields": {
+        "input": {
+          "description": "The input column from which the sample variance is computed.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "ml.ViewType": {
+      "description": "Qualifier for the view type.",
+      "enum": [
+        "ACTIVE_ONLY",
+        "DELETED_ONLY",
+        "ALL"
+      ],
+      "enum_launch_stages": {
+        "ACTIVE_ONLY": "GA",
+        "ALL": "GA",
+        "DELETED_ONLY": "GA"
+      }
+    },
+    "networking.AwsVpcEndpointInfo": {
+      "fields": {
+        "aws_account_id": {
+          "description": "The AWS account ID in which this VPC endpoint lives.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE",
+            "OUTPUT_ONLY"
+          ]
+        },
+        "aws_endpoint_service_id": {
+          "description": "The ID of the Databricks VPC endpoint service that this endpoint connects to.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE",
+            "OUTPUT_ONLY"
+          ]
+        },
+        "aws_vpc_endpoint_id": {
+          "description": "The ID of the underlying VPC endpoint in AWS. Provided by the customer when\nregistering an existing AWS VPC endpoint.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        }
+      }
+    },
+    "networking.AzurePrivateEndpointInfo": {
+      "fields": {
+        "private_endpoint_name": {
+          "description": "The name of the Private Endpoint in the Azure subscription.",
+          "launch_stage": "GA"
+        },
+        "private_endpoint_resource_guid": {
+          "description": "The GUID of the Private Endpoint resource in the Azure subscription.\nThis is assigned by Azure when the user sets up the Private Endpoint.",
+          "launch_stage": "GA"
+        },
+        "private_endpoint_resource_id": {
+          "description": "The full resource ID of the Private Endpoint.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "private_link_service_id": {
+          "description": "The resource ID of the Databricks Private Link Service that this Private Endpoint connects to.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "networking.CreateEndpointRequest": {
+      "fields": {
+        "endpoint": {
+          "ref": "networking.Endpoint",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "networking.CreatePrivateNetworkGatewayRequest": {
+      "fields": {
+        "private_network_gateway": {
+          "description": "The gateway to create.",
+          "ref": "networking.PrivateNetworkGateway",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "request_id": {
+          "description": "A unique identifier for this request. The request is idempotent when this is provided.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "networking.DatabricksServiceExceptionWithDetailsProto": {
+      "description": "Databricks Error that is returned by all Databricks APIs.",
+      "fields": {
+        "details": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "error_code": {
+          "ref": "networking.ErrorCode",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "message": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "stack_trace": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "networking.DeleteEndpointRequest": {},
+    "networking.DeletePrivateNetworkGatewayRequest": {},
+    "networking.Endpoint": {
+      "description": "Endpoint represents a cloud networking resource in a user's cloud account and binds it to the Databricks account.",
+      "fields": {
+        "account_id": {
+          "description": "The Databricks Account in which the endpoint object exists.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE",
+            "OUTPUT_ONLY"
+          ]
+        },
+        "aws_vpc_endpoint_info": {
+          "description": "Info for an AWS VPC endpoint.",
+          "ref": "networking.AwsVpcEndpointInfo",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE",
+            "OPTIONAL"
+          ]
+        },
+        "azure_private_endpoint_info": {
+          "description": "Info for an Azure private endpoint.",
+          "ref": "networking.AzurePrivateEndpointInfo",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE",
+            "OPTIONAL"
+          ]
+        },
+        "create_time": {
+          "description": "The timestamp when the endpoint was created. The timestamp is in RFC 3339 format in UTC timezone.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE",
+            "OUTPUT_ONLY"
+          ]
+        },
+        "display_name": {
+          "description": "The human-readable display name of this endpoint.\nThe input should conform to RFC-1034, which restricts to letters, numbers, and hyphens,\nwith the first character a letter, the last a letter or a number, and a 63 character maximum.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "endpoint_id": {
+          "description": "The unique identifier for this endpoint under the account. This field is a UUID generated by Databricks.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE",
+            "OUTPUT_ONLY"
+          ]
+        },
+        "gcp_psc_endpoint_info": {
+          "description": "Info for a GCP Private Service Connect endpoint.",
+          "ref": "networking.GcpPscEndpointInfo",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE",
+            "OPTIONAL"
+          ]
+        },
+        "name": {
+          "description": "The resource name of the endpoint, which uniquely identifies the endpoint.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE",
+            "OUTPUT_ONLY"
+          ]
+        },
+        "region": {
+          "description": "The cloud provider region where this endpoint is located.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "state": {
+          "description": "The state of the endpoint. The endpoint can only be used if the state is `APPROVED`.",
+          "ref": "networking.EndpointState",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "use_case": {
+          "description": "The use case that determines the type of network connectivity this endpoint provides.\nThis field is automatically determined based on the endpoint configuration and cloud-specific settings.",
+          "ref": "networking.EndpointUseCase",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE",
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "networking.EndpointState": {
+      "enum": [
+        "PENDING",
+        "APPROVED",
+        "FAILED",
+        "DISCONNECTED"
+      ],
+      "enum_launch_stages": {
+        "APPROVED": "GA",
+        "DISCONNECTED": "GA",
+        "FAILED": "GA",
+        "PENDING": "GA"
+      }
+    },
+    "networking.EndpointUseCase": {
+      "enum": [
+        "SERVICE_DIRECT"
+      ],
+      "enum_launch_stages": {
+        "SERVICE_DIRECT": "GA"
+      }
+    },
+    "networking.ErrorCode": {
+      "description": "Error codes returned by Databricks APIs to indicate specific failure conditions.",
+      "enum": [
+        "UNKNOWN",
+        "INTERNAL_ERROR",
+        "TEMPORARILY_UNAVAILABLE",
+        "IO_ERROR",
+        "BAD_REQUEST",
+        "SERVICE_UNDER_MAINTENANCE",
+        "WORKSPACE_TEMPORARILY_UNAVAILABLE",
+        "DEADLINE_EXCEEDED",
+        "CANCELLED",
+        "RESOURCE_EXHAUSTED",
+        "ABORTED",
+        "NOT_FOUND",
+        "ALREADY_EXISTS",
+        "UNAUTHENTICATED",
+        "UNAVAILABLE",
+        "INVALID_PARAMETER_VALUE",
+        "ENDPOINT_NOT_FOUND",
+        "MALFORMED_REQUEST",
+        "INVALID_STATE",
+        "PERMISSION_DENIED",
+        "FEATURE_DISABLED",
+        "CUSTOMER_UNAUTHORIZED",
+        "REQUEST_LIMIT_EXCEEDED",
+        "RESOURCE_CONFLICT",
+        "UNPARSEABLE_HTTP_ERROR",
+        "NOT_IMPLEMENTED",
+        "DATA_LOSS",
+        "INVALID_STATE_TRANSITION",
+        "COULD_NOT_ACQUIRE_LOCK",
+        "RESOURCE_ALREADY_EXISTS",
+        "RESOURCE_DOES_NOT_EXIST",
+        "QUOTA_EXCEEDED",
+        "MAX_BLOCK_SIZE_EXCEEDED",
+        "MAX_READ_SIZE_EXCEEDED",
+        "PARTIAL_DELETE",
+        "MAX_LIST_SIZE_EXCEEDED",
+        "DRY_RUN_FAILED",
+        "RESOURCE_LIMIT_EXCEEDED",
+        "DIRECTORY_NOT_EMPTY",
+        "DIRECTORY_PROTECTED",
+        "MAX_NOTEBOOK_SIZE_EXCEEDED",
+        "MAX_CHILD_NODE_SIZE_EXCEEDED",
+        "SEARCH_QUERY_TOO_LONG",
+        "SEARCH_QUERY_TOO_SHORT",
+        "MANAGED_RESOURCE_GROUP_DOES_NOT_EXIST",
+        "PERMISSION_NOT_PROPAGATED",
+        "DEPLOYMENT_TIMEOUT",
+        "GIT_CONFLICT",
+        "GIT_UNKNOWN_REF",
+        "GIT_SENSITIVE_TOKEN_DETECTED",
+        "GIT_URL_NOT_ON_ALLOW_LIST",
+        "GIT_REMOTE_ERROR",
+        "PROJECTS_OPERATION_TIMEOUT",
+        "IPYNB_FILE_IN_REPO",
+        "INSECURE_PARTNER_RESPONSE",
+        "MALFORMED_PARTNER_RESPONSE",
+        "METASTORE_DOES_NOT_EXIST",
+        "DAC_DOES_NOT_EXIST",
+        "CATALOG_DOES_NOT_EXIST",
+        "SCHEMA_DOES_NOT_EXIST",
+        "TABLE_DOES_NOT_EXIST",
+        "SHARE_DOES_NOT_EXIST",
+        "RECIPIENT_DOES_NOT_EXIST",
+        "STORAGE_CREDENTIAL_DOES_NOT_EXIST",
+        "EXTERNAL_LOCATION_DOES_NOT_EXIST",
+        "PRINCIPAL_DOES_NOT_EXIST",
+        "PROVIDER_DOES_NOT_EXIST",
+        "METASTORE_ALREADY_EXISTS",
+        "DAC_ALREADY_EXISTS",
+        "CATALOG_ALREADY_EXISTS",
+        "SCHEMA_ALREADY_EXISTS",
+        "TABLE_ALREADY_EXISTS",
+        "SHARE_ALREADY_EXISTS",
+        "RECIPIENT_ALREADY_EXISTS",
+        "STORAGE_CREDENTIAL_ALREADY_EXISTS",
+        "EXTERNAL_LOCATION_ALREADY_EXISTS",
+        "PROVIDER_ALREADY_EXISTS",
+        "CATALOG_NOT_EMPTY",
+        "SCHEMA_NOT_EMPTY",
+        "METASTORE_NOT_EMPTY",
+        "PROVIDER_SHARE_NOT_ACCESSIBLE"
+      ],
+      "enum_launch_stages": {
+        "ABORTED": "PRIVATE_PREVIEW",
+        "ALREADY_EXISTS": "PRIVATE_PREVIEW",
+        "BAD_REQUEST": "PRIVATE_PREVIEW",
+        "CANCELLED": "PRIVATE_PREVIEW",
+        "CATALOG_ALREADY_EXISTS": "PRIVATE_PREVIEW",
+        "CATALOG_DOES_NOT_EXIST": "PRIVATE_PREVIEW",
+        "CATALOG_NOT_EMPTY": "PRIVATE_PREVIEW",
+        "COULD_NOT_ACQUIRE_LOCK": "PRIVATE_PREVIEW",
+        "CUSTOMER_UNAUTHORIZED": "PRIVATE_PREVIEW",
+        "DAC_ALREADY_EXISTS": "PRIVATE_PREVIEW",
+        "DAC_DOES_NOT_EXIST": "PRIVATE_PREVIEW",
+        "DATA_LOSS": "PRIVATE_PREVIEW",
+        "DEADLINE_EXCEEDED": "PRIVATE_PREVIEW",
+        "DEPLOYMENT_TIMEOUT": "PRIVATE_PREVIEW",
+        "DIRECTORY_NOT_EMPTY": "PRIVATE_PREVIEW",
+        "DIRECTORY_PROTECTED": "PRIVATE_PREVIEW",
+        "DRY_RUN_FAILED": "PRIVATE_PREVIEW",
+        "ENDPOINT_NOT_FOUND": "PRIVATE_PREVIEW",
+        "EXTERNAL_LOCATION_ALREADY_EXISTS": "PRIVATE_PREVIEW",
+        "EXTERNAL_LOCATION_DOES_NOT_EXIST": "PRIVATE_PREVIEW",
+        "FEATURE_DISABLED": "PRIVATE_PREVIEW",
+        "GIT_CONFLICT": "PRIVATE_PREVIEW",
+        "GIT_REMOTE_ERROR": "PRIVATE_PREVIEW",
+        "GIT_SENSITIVE_TOKEN_DETECTED": "PRIVATE_PREVIEW",
+        "GIT_UNKNOWN_REF": "PRIVATE_PREVIEW",
+        "GIT_URL_NOT_ON_ALLOW_LIST": "PRIVATE_PREVIEW",
+        "INSECURE_PARTNER_RESPONSE": "PRIVATE_PREVIEW",
+        "INTERNAL_ERROR": "PRIVATE_PREVIEW",
+        "INVALID_PARAMETER_VALUE": "PRIVATE_PREVIEW",
+        "INVALID_STATE": "PRIVATE_PREVIEW",
+        "INVALID_STATE_TRANSITION": "PRIVATE_PREVIEW",
+        "IO_ERROR": "PRIVATE_PREVIEW",
+        "IPYNB_FILE_IN_REPO": "PRIVATE_PREVIEW",
+        "MALFORMED_PARTNER_RESPONSE": "PRIVATE_PREVIEW",
+        "MALFORMED_REQUEST": "PRIVATE_PREVIEW",
+        "MANAGED_RESOURCE_GROUP_DOES_NOT_EXIST": "PRIVATE_PREVIEW",
+        "MAX_BLOCK_SIZE_EXCEEDED": "PRIVATE_PREVIEW",
+        "MAX_CHILD_NODE_SIZE_EXCEEDED": "PRIVATE_PREVIEW",
+        "MAX_LIST_SIZE_EXCEEDED": "PRIVATE_PREVIEW",
+        "MAX_NOTEBOOK_SIZE_EXCEEDED": "PRIVATE_PREVIEW",
+        "MAX_READ_SIZE_EXCEEDED": "PRIVATE_PREVIEW",
+        "METASTORE_ALREADY_EXISTS": "PRIVATE_PREVIEW",
+        "METASTORE_DOES_NOT_EXIST": "PRIVATE_PREVIEW",
+        "METASTORE_NOT_EMPTY": "PRIVATE_PREVIEW",
+        "NOT_FOUND": "PRIVATE_PREVIEW",
+        "NOT_IMPLEMENTED": "PRIVATE_PREVIEW",
+        "PARTIAL_DELETE": "PRIVATE_PREVIEW",
+        "PERMISSION_DENIED": "PRIVATE_PREVIEW",
+        "PERMISSION_NOT_PROPAGATED": "PRIVATE_PREVIEW",
+        "PRINCIPAL_DOES_NOT_EXIST": "PRIVATE_PREVIEW",
+        "PROJECTS_OPERATION_TIMEOUT": "PRIVATE_PREVIEW",
+        "PROVIDER_ALREADY_EXISTS": "PRIVATE_PREVIEW",
+        "PROVIDER_DOES_NOT_EXIST": "PRIVATE_PREVIEW",
+        "PROVIDER_SHARE_NOT_ACCESSIBLE": "PRIVATE_PREVIEW",
+        "QUOTA_EXCEEDED": "PRIVATE_PREVIEW",
+        "RECIPIENT_ALREADY_EXISTS": "PRIVATE_PREVIEW",
+        "RECIPIENT_DOES_NOT_EXIST": "PRIVATE_PREVIEW",
+        "REQUEST_LIMIT_EXCEEDED": "PRIVATE_PREVIEW",
+        "RESOURCE_ALREADY_EXISTS": "PRIVATE_PREVIEW",
+        "RESOURCE_CONFLICT": "PRIVATE_PREVIEW",
+        "RESOURCE_DOES_NOT_EXIST": "PRIVATE_PREVIEW",
+        "RESOURCE_EXHAUSTED": "PRIVATE_PREVIEW",
+        "RESOURCE_LIMIT_EXCEEDED": "PRIVATE_PREVIEW",
+        "SCHEMA_ALREADY_EXISTS": "PRIVATE_PREVIEW",
+        "SCHEMA_DOES_NOT_EXIST": "PRIVATE_PREVIEW",
+        "SCHEMA_NOT_EMPTY": "PRIVATE_PREVIEW",
+        "SEARCH_QUERY_TOO_LONG": "PRIVATE_PREVIEW",
+        "SEARCH_QUERY_TOO_SHORT": "PRIVATE_PREVIEW",
+        "SERVICE_UNDER_MAINTENANCE": "PRIVATE_PREVIEW",
+        "SHARE_ALREADY_EXISTS": "PRIVATE_PREVIEW",
+        "SHARE_DOES_NOT_EXIST": "PRIVATE_PREVIEW",
+        "STORAGE_CREDENTIAL_ALREADY_EXISTS": "PRIVATE_PREVIEW",
+        "STORAGE_CREDENTIAL_DOES_NOT_EXIST": "PRIVATE_PREVIEW",
+        "TABLE_ALREADY_EXISTS": "PRIVATE_PREVIEW",
+        "TABLE_DOES_NOT_EXIST": "PRIVATE_PREVIEW",
+        "TEMPORARILY_UNAVAILABLE": "PRIVATE_PREVIEW",
+        "UNAUTHENTICATED": "PRIVATE_PREVIEW",
+        "UNAVAILABLE": "PRIVATE_PREVIEW",
+        "UNKNOWN": "PRIVATE_PREVIEW",
+        "UNPARSEABLE_HTTP_ERROR": "PRIVATE_PREVIEW",
+        "WORKSPACE_TEMPORARILY_UNAVAILABLE": "PRIVATE_PREVIEW"
+      }
+    },
+    "networking.GcpPscEndpointInfo": {
+      "fields": {
+        "endpoint_region": {
+          "description": "The GCP region of the PSC connection endpoint. Provided by the customer when registering an\nexisting PSC endpoint. GCP supports only same-region PSC, so this must match the workspace\nregion.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "project_id": {
+          "description": "The GCP consumer project ID in which this PSC endpoint is created. Provided by the customer\nwhen registering an existing PSC endpoint.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "psc_connection_id": {
+          "description": "The ID of the underlying Private Service Connect connection in the GCP consumer project,\nassigned by GCP when the PSC connection is created.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE",
+            "OUTPUT_ONLY"
+          ]
+        },
+        "psc_endpoint": {
+          "description": "The name of this PSC connection in the GCP consumer project. Provided by the customer when\nregistering an existing PSC endpoint.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "service_attachment_id": {
+          "description": "The ID of the Databricks service attachment this PSC endpoint connects to.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE",
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "networking.GetEndpointRequest": {},
+    "networking.GetOperationRequest": {},
+    "networking.GetPrivateNetworkGatewayRequest": {},
+    "networking.ListEndpointsRequest": {
+      "fields": {
+        "page_size": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "networking.ListEndpointsResponse": {
+      "fields": {
+        "items": {
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "networking.ListPrivateNetworkGatewaysRequest": {
+      "fields": {
+        "page_token": {
+          "description": "An opaque token returned by a previous list request.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "networking.ListPrivateNetworkGatewaysResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "An opaque token for the next page, or empty when there are no more results.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "private_network_gateways": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "networking.Operation": {
+      "description": "This resource represents a long-running operation that is the result of a\nnetwork API call.",
+      "fields": {
+        "done": {
+          "description": "If the value is `false`, it means the operation is still in progress.\nIf `true`, the operation is completed, and either `error` or `response` is\navailable.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "error": {
+          "description": "The error result of the operation in case of failure or cancellation.",
+          "ref": "networking.DatabricksServiceExceptionWithDetailsProto",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "metadata": {
+          "description": "Service-specific metadata associated with the operation.  It typically\ncontains progress information and common metadata such as create time.\nSome services might not provide such metadata.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "name": {
+          "description": "The server-assigned name, which is only unique within the same service that\noriginally returns it. If you use the default HTTP mapping, the\n`name` should be a resource name ending with `operations/{unique_id}`.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "response": {
+          "description": "The normal, successful response of the operation.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "networking.PrivateNetworkGateway": {
+      "description": "A private network gateway connects serverless compute to destinations in a\ncustomer-managed VPC or VNet.",
+      "fields": {
+        "aws_cloud_connection": {
+          "description": "The AWS connection used by the gateway.",
+          "ref": "networking.PrivateNetworkGatewayAwsCloudConnection",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE",
+            "OPTIONAL"
+          ]
+        },
+        "azure_cloud_connection": {
+          "description": "The Azure connection used by the gateway.",
+          "ref": "networking.PrivateNetworkGatewayAzureCloudConnection",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE",
+            "OPTIONAL"
+          ]
+        },
+        "bandwidth_tier_gigabits_per_second": {
+          "description": "The provisioned bandwidth tier for an Azure gateway, in gigabits per second.\nRequired when creating an Azure gateway.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "create_time": {
+          "description": "The time when the gateway was created.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "destinations": {
+          "description": "The destinations routed through this gateway.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "display_name": {
+          "description": "The human-readable name of the gateway.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "error_message": {
+          "description": "The failure reason when the gateway is in the FAILED state.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "The canonical resource name of the gateway, in the form\n`accounts/{account_id}/network-connectivity-configs/{ncc_id}/private-network-gateways/{gateway_id}`.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "private_dns_resolvers": {
+          "description": "The DNS resolvers used for private name resolution.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "state": {
+          "description": "The current lifecycle state of the gateway.",
+          "ref": "networking.PrivateNetworkGatewayGatewayState",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "traffic_mode": {
+          "description": "The traffic routed through this gateway.",
+          "ref": "networking.PrivateNetworkGatewayTrafficMode",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "update_time": {
+          "description": "The time when the gateway was last updated.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "networking.PrivateNetworkGatewayAwsCloudConnection": {
+      "description": "AWS connection configuration.",
+      "fields": {
+        "cross_account_role": {
+          "description": "The IAM role that Databricks assumes to manage gateway resources.",
+          "ref": "networking.PrivateNetworkGatewayAwsCloudConnectionCrossAccountRole",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "gateway_subnets": {
+          "description": "The subnets where the gateway establishes connectivity.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "security_group_ids": {
+          "description": "The security groups attached to the gateway network interface.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "networking.PrivateNetworkGatewayAwsCloudConnectionAwsGatewaySubnet": {
+      "description": "An AWS subnet used by the gateway.",
+      "fields": {
+        "subnet_id": {
+          "description": "The AWS subnet ID.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "networking.PrivateNetworkGatewayAwsCloudConnectionCrossAccountRole": {
+      "description": "A cross-account IAM role used to manage gateway resources.",
+      "fields": {
+        "role_arn": {
+          "description": "The ARN of the IAM role.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "networking.PrivateNetworkGatewayAzureCloudConnection": {
+      "description": "Azure connection configuration.",
+      "fields": {
+        "gateway_subnet": {
+          "description": "The subnet where the gateway establishes connectivity.",
+          "ref": "networking.PrivateNetworkGatewayAzureCloudConnectionAzureGatewaySubnet",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "networking.PrivateNetworkGatewayAzureCloudConnectionAzureGatewaySubnet": {
+      "description": "An Azure subnet used by the gateway.",
+      "fields": {
+        "resource_id": {
+          "description": "The full Azure resource ID of the subnet.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "networking.PrivateNetworkGatewayDestination": {
+      "description": "A destination routed through the gateway.",
+      "fields": {
+        "destination_type": {
+          "description": "The destination type.",
+          "ref": "networking.PrivateNetworkGatewayDestinationDestinationType",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "value": {
+          "description": "The destination value.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "networking.PrivateNetworkGatewayDestinationDestinationType": {
+      "description": "The supported destination types.",
+      "enum": [
+        "DNS_NAME"
+      ],
+      "enum_launch_stages": {
+        "DNS_NAME": "PRIVATE_PREVIEW"
+      }
+    },
+    "networking.PrivateNetworkGatewayGatewayState": {
+      "description": "The lifecycle state of the gateway.",
+      "enum": [
+        "CREATING",
+        "ESTABLISHED",
+        "FAILED",
+        "DELETING"
+      ],
+      "enum_launch_stages": {
+        "CREATING": "PRIVATE_PREVIEW",
+        "DELETING": "PRIVATE_PREVIEW",
+        "ESTABLISHED": "PRIVATE_PREVIEW",
+        "FAILED": "PRIVATE_PREVIEW"
+      }
+    },
+    "networking.PrivateNetworkGatewayOperationMetadata": {
+      "fields": {
+        "operation_type": {
+          "description": "The operation performed on the gateway.",
+          "ref": "networking.PrivateNetworkGatewayOperationMetadataOperationType",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "networking.PrivateNetworkGatewayOperationMetadataOperationType": {
+      "enum": [
+        "CREATE"
+      ],
+      "enum_launch_stages": {
+        "CREATE": "PRIVATE_PREVIEW"
+      }
+    },
+    "networking.PrivateNetworkGatewayPrivateDnsResolver": {
+      "description": "A private DNS resolver used by the gateway.",
+      "fields": {
+        "resolver_type": {
+          "description": "The resolver type.",
+          "ref": "networking.PrivateNetworkGatewayPrivateDnsResolverResolverType",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "value": {
+          "description": "The resolver value.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "networking.PrivateNetworkGatewayPrivateDnsResolverResolverType": {
+      "description": "The supported resolver types.",
+      "enum": [
+        "IP_ADDRESS"
+      ],
+      "enum_launch_stages": {
+        "IP_ADDRESS": "PRIVATE_PREVIEW"
+      }
+    },
+    "networking.PrivateNetworkGatewayTrafficMode": {
+      "description": "The traffic routed through the gateway.",
+      "enum": [
+        "SPECIFIC_DESTINATIONS",
+        "ALL_TRAFFIC"
+      ],
+      "enum_launch_stages": {
+        "ALL_TRAFFIC": "PRIVATE_PREVIEW",
+        "SPECIFIC_DESTINATIONS": "PRIVATE_PREVIEW"
+      }
+    },
+    "networking.UpdatePrivateNetworkGatewayRequest": {
+      "fields": {
+        "private_network_gateway": {
+          "description": "The gateway containing the desired mutable field values.",
+          "ref": "networking.PrivateNetworkGateway",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "update_mask": {
+          "description": "The fields to update.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "oauth2.CreateAccountFederationPolicyRequest": {
+      "fields": {
+        "policy": {
+          "ref": "oauth2.FederationPolicy",
+          "launch_stage": "GA"
+        },
+        "policy_id": {
+          "description": "The identifier for the federation policy. The identifier must contain only lowercase\nalphanumeric characters, numbers, hyphens, and slashes. If unspecified, the id will be\nassigned by Databricks.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "oauth2.CreateCustomAppIntegration": {
+      "fields": {
+        "confidential": {
+          "description": "This field indicates whether an OAuth client secret is required to authenticate this client.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of the custom OAuth app",
+          "launch_stage": "GA"
+        },
+        "redirect_urls": {
+          "description": "List of OAuth redirect urls",
+          "launch_stage": "GA"
+        },
+        "scopes": {
+          "description": "OAuth scopes granted to the application.\nSupported scopes: all-apis, sql, offline_access, openid, profile, email.",
+          "launch_stage": "GA"
+        },
+        "token_access_policy": {
+          "description": "Token access policy",
+          "ref": "oauth2.TokenAccessPolicy",
+          "launch_stage": "GA"
+        },
+        "user_authorized_scopes": {
+          "description": "Scopes that will need to be consented by end user to mint the access token. If the user does\nnot authorize the access token will not be minted.\nMust be a subset of scopes.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "oauth2.CreateCustomAppIntegrationOutput": {
+      "fields": {
+        "client_id": {
+          "description": "OAuth client-id generated by the Databricks",
+          "launch_stage": "GA"
+        },
+        "client_secret": {
+          "description": "OAuth client-secret generated by the Databricks.\nIf this is a confidential OAuth app client-secret will be generated.",
+          "launch_stage": "GA"
+        },
+        "integration_id": {
+          "description": "Unique integration id for the custom OAuth app",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "oauth2.CreatePublishedAppIntegration": {
+      "fields": {
+        "app_id": {
+          "description": "App id of the OAuth published app integration.\nFor example power-bi, tableau-deskop",
+          "launch_stage": "GA"
+        },
+        "token_access_policy": {
+          "description": "Token access policy",
+          "ref": "oauth2.TokenAccessPolicy",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "oauth2.CreatePublishedAppIntegrationOutput": {
+      "fields": {
+        "integration_id": {
+          "description": "Unique integration id for the published OAuth app",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "oauth2.CreateServicePrincipalFederationPolicyRequest": {
+      "fields": {
+        "policy": {
+          "ref": "oauth2.FederationPolicy",
+          "launch_stage": "GA"
+        },
+        "policy_id": {
+          "description": "The identifier for the federation policy. The identifier must contain only lowercase\nalphanumeric characters, numbers, hyphens, and slashes. If unspecified, the id will be\nassigned by Databricks.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "oauth2.CreateServicePrincipalSecretRequest": {
+      "fields": {
+        "lifetime": {
+          "description": "The lifetime of the secret in seconds. If this parameter is not provided, the secret will have a default lifetime of 730 days (63072000s).",
+          "launch_stage": "GA"
+        },
+        "scopes": {
+          "description": "OAuth API scopes to bind to the secret; a minted token cannot exceed them.\nEmpty = unrestricted (all-apis). E.g. all-apis, sql, iam.groups:read.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "oauth2.CreateServicePrincipalSecretResponse": {
+      "fields": {
+        "create_time": {
+          "description": "UTC time when the secret was created",
+          "launch_stage": "GA"
+        },
+        "expire_time": {
+          "description": "UTC time when the secret will expire. If the field is not present, the secret does not expire.",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "ID of the secret",
+          "launch_stage": "GA"
+        },
+        "scopes": {
+          "description": "OAuth API scopes bound to this secret. Empty = unrestricted (all-apis).",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "secret": {
+          "description": "Secret Value",
+          "launch_stage": "GA"
+        },
+        "secret_hash": {
+          "description": "Secret Hash",
+          "launch_stage": "GA"
+        },
+        "status": {
+          "description": "Status of the secret",
+          "launch_stage": "GA"
+        },
+        "update_time": {
+          "description": "UTC time when the secret was updated",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "oauth2.DeleteAccountFederationPolicyRequest": {},
+    "oauth2.DeleteCustomAppIntegrationOutput": {},
+    "oauth2.DeleteCustomAppIntegrationRequest": {},
+    "oauth2.DeletePublishedAppIntegrationOutput": {},
+    "oauth2.DeletePublishedAppIntegrationRequest": {},
+    "oauth2.DeleteServicePrincipalFederationPolicyRequest": {},
+    "oauth2.DeleteServicePrincipalSecretRequest": {},
+    "oauth2.FederationPolicy": {
+      "fields": {
+        "create_time": {
+          "description": "Creation time of the federation policy.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE",
+            "OUTPUT_ONLY"
+          ]
+        },
+        "description": {
+          "description": "Description of the federation policy.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "name": {
+          "description": "Resource name for the federation policy. Example values include\n`accounts/\u003caccount-id\u003e/federationPolicies/my-federation-policy` for Account Federation Policies, and\n`accounts/\u003caccount-id\u003e/servicePrincipals/\u003cservice-principal-id\u003e/federationPolicies/my-federation-policy`\nfor Service Principal Federation Policies. Typically an output parameter, which does not need to be\nspecified in create or update requests. If specified in a request, must match the value in the\nrequest URL.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE",
+            "OUTPUT_ONLY"
+          ]
+        },
+        "oidc_policy": {
+          "description": "audit_mode INCLUDE is required on both this message field and its leaf fields so the OIDC\npolicy configuration is captured in create/update audit logs (see go/auditlogs).",
+          "ref": "oauth2.OidcFederationPolicy",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "policy_id": {
+          "description": "The ID of the federation policy. Output only.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE",
+            "OPTIONAL",
+            "OUTPUT_ONLY"
+          ]
+        },
+        "service_principal_id": {
+          "description": "The service principal ID that this federation policy applies to. Output only. Only set for service principal federation policies.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE",
+            "OPTIONAL",
+            "OUTPUT_ONLY"
+          ]
+        },
+        "uid": {
+          "description": "Unique, immutable id of the federation policy.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE",
+            "OUTPUT_ONLY"
+          ]
+        },
+        "update_time": {
+          "description": "Last update time of the federation policy.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "oauth2.GetAccountFederationPolicyRequest": {},
+    "oauth2.GetCustomAppIntegrationOutput": {
+      "fields": {
+        "client_id": {
+          "description": "The client id of the custom OAuth app",
+          "launch_stage": "GA"
+        },
+        "confidential": {
+          "description": "This field indicates whether an OAuth client secret is required to authenticate this client.",
+          "launch_stage": "GA"
+        },
+        "create_time": {
+          "launch_stage": "GA"
+        },
+        "created_by": {
+          "launch_stage": "GA"
+        },
+        "creator_username": {
+          "launch_stage": "GA"
+        },
+        "integration_id": {
+          "description": "ID of this custom app",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The display name of the custom OAuth app",
+          "launch_stage": "GA"
+        },
+        "redirect_urls": {
+          "description": "List of OAuth redirect urls",
+          "launch_stage": "GA"
+        },
+        "scopes": {
+          "launch_stage": "GA"
+        },
+        "token_access_policy": {
+          "description": "Token access policy",
+          "ref": "oauth2.TokenAccessPolicy",
+          "launch_stage": "GA"
+        },
+        "user_authorized_scopes": {
+          "description": "Scopes that will need to be consented by end user to mint the access token. If the user does\nnot authorize the access token will not be minted.\nMust be a subset of scopes.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "oauth2.GetCustomAppIntegrationRequest": {},
+    "oauth2.GetCustomAppIntegrationsOutput": {
+      "fields": {
+        "apps": {
+          "description": "List of Custom OAuth App Integrations defined for the account.",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "oauth2.GetPublishedAppIntegrationOutput": {
+      "fields": {
+        "app_id": {
+          "description": "App-id of the published app integration",
+          "launch_stage": "GA"
+        },
+        "create_time": {
+          "launch_stage": "GA"
+        },
+        "created_by": {
+          "launch_stage": "GA"
+        },
+        "integration_id": {
+          "description": "Unique integration id for the published OAuth app",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Display name of the published OAuth app",
+          "launch_stage": "GA"
+        },
+        "token_access_policy": {
+          "description": "Token access policy",
+          "ref": "oauth2.TokenAccessPolicy",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "oauth2.GetPublishedAppIntegrationRequest": {},
+    "oauth2.GetPublishedAppIntegrationsOutput": {
+      "fields": {
+        "apps": {
+          "description": "List of Published OAuth App Integrations defined for the account.",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "oauth2.GetPublishedAppsOutput": {
+      "fields": {
+        "apps": {
+          "description": "List of Published OAuth Apps.",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "A token that can be used to get the next page of results. If not present, there are no more results to show.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "oauth2.GetServicePrincipalFederationPolicyRequest": {},
+    "oauth2.ListAccountFederationPoliciesRequest": {
+      "fields": {
+        "page_size": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "oauth2.ListCustomAppIntegrationsRequest": {
+      "fields": {
+        "include_creator_username": {
+          "launch_stage": "GA"
+        },
+        "page_size": {
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "oauth2.ListFederationPoliciesResponse": {
+      "fields": {
+        "next_page_token": {
+          "launch_stage": "GA"
+        },
+        "policies": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "oauth2.ListOAuthPublishedAppsRequest": {
+      "fields": {
+        "page_size": {
+          "description": "The max number of OAuth published apps to return in one page.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "A token that can be used to get the next page of results.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "oauth2.ListPublishedAppIntegrationsRequest": {
+      "fields": {
+        "page_size": {
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "oauth2.ListServicePrincipalFederationPoliciesRequest": {
+      "fields": {
+        "page_size": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "oauth2.ListServicePrincipalSecretsRequest": {
+      "fields": {
+        "page_size": {
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "An opaque page token which was the `next_page_token` in the response of the previous request to list the secrets for this service principal. Provide this token to retrieve the next page of secret entries.\nWhen providing a `page_token`, all other parameters provided to the request must match the previous request.\nTo list all of the secrets for a service principal, it is necessary to continue requesting pages of entries until the response contains no `next_page_token`. Note that the number of entries returned must not be used to determine when the listing is complete.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "oauth2.ListServicePrincipalSecretsResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "A token, which can be sent as `page_token` to retrieve the next page.",
+          "launch_stage": "GA"
+        },
+        "secrets": {
+          "description": "List of the secrets",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "oauth2.OidcFederationPolicy": {
+      "description": "Specifies the policy to use for validating OIDC claims in your federated tokens.",
+      "fields": {
+        "audiences": {
+          "description": "The allowed token audiences, as specified in the 'aud' claim of federated tokens.\nThe audience identifier is intended to represent the recipient of the token.\nCan be any non-empty string value. As long as the audience in the token matches\nat least one audience in the policy, the token is considered a match. If audiences\nis unspecified, defaults to your Databricks account id.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "issuer": {
+          "description": "The required token issuer, as specified in the 'iss' claim of federated tokens.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "jwks_json": {
+          "description": "The public keys used to validate the signature of federated tokens, in JWKS format.\nMost use cases should not need to specify this field. If jwks_uri and jwks_json\nare both unspecified (recommended), Databricks automatically fetches the public\nkeys from your issuer’s well known endpoint. Databricks strongly recommends\nrelying on your issuer’s well known endpoint for discovering public keys.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "jwks_uri": {
+          "description": "URL of the public keys used to validate the signature of federated tokens, in\nJWKS format. Most use cases should not need to specify this field. If jwks_uri\nand jwks_json are both unspecified (recommended), Databricks automatically\nfetches the public keys from your issuer’s well known endpoint. Databricks\nstrongly recommends relying on your issuer’s well known endpoint for discovering\npublic keys.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "subject": {
+          "description": "The required token subject, as specified in the subject claim of federated tokens.\nMust be specified for service principal federation policies. Must not be specified\nfor account federation policies.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "subject_claim": {
+          "description": "The claim that contains the subject of the token. If unspecified, the default value\nis 'sub'.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "oauth2.PublishedAppOutput": {
+      "fields": {
+        "app_id": {
+          "description": "Unique ID of the published OAuth app.",
+          "launch_stage": "GA"
+        },
+        "client_id": {
+          "description": "Client ID of the published OAuth app. It is the client_id in the OAuth flow",
+          "launch_stage": "GA"
+        },
+        "description": {
+          "description": "Description of the published OAuth app.",
+          "launch_stage": "GA"
+        },
+        "is_confidential_client": {
+          "description": "Whether the published OAuth app is a confidential client. It is always false for published OAuth apps.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The display name of the published OAuth app.",
+          "launch_stage": "GA"
+        },
+        "redirect_urls": {
+          "description": "Redirect URLs of the published OAuth app.",
+          "launch_stage": "GA"
+        },
+        "scopes": {
+          "description": "Required scopes for the published OAuth app.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "oauth2.SecretInfo": {
+      "fields": {
+        "create_time": {
+          "description": "UTC time when the secret was created",
+          "launch_stage": "GA"
+        },
+        "expire_time": {
+          "description": "UTC time when the secret will expire. If the field is not present, the secret does not expire.",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "ID of the secret",
+          "launch_stage": "GA"
+        },
+        "scopes": {
+          "description": "OAuth API scopes bound to this secret. Empty = unrestricted (all-apis).",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "secret_hash": {
+          "description": "Secret Hash",
+          "launch_stage": "GA"
+        },
+        "status": {
+          "description": "Status of the secret",
+          "launch_stage": "GA"
+        },
+        "update_time": {
+          "description": "UTC time when the secret was updated",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "oauth2.TokenAccessPolicy": {
+      "fields": {
+        "absolute_session_lifetime_in_minutes": {
+          "description": "Absolute OAuth session TTL in minutes. Effective only when the single-use refresh token feature is enabled.\nThis is the absolute TTL of all refresh tokens issued in one OAuth session. When a new refresh token is issued\nduring refresh token rotation, it will inherit the same absolute TTL as the old refresh token.\nIn other words, this represents the maximum amount of time a user can stay logged in without re-authenticating.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "access_token_ttl_in_minutes": {
+          "description": "access token time to live in minutes",
+          "launch_stage": "GA"
+        },
+        "enable_single_use_refresh_tokens": {
+          "description": "Whether to enable single-use refresh tokens (refresh token rotation).\nIf this feature is enabled, upon successfully getting a new access token using a refresh token, Databricks will\nissue a new refresh token along with the access token in the response and invalidate the old refresh token.\nThe client should use the new refresh token to get access tokens in future requests.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "refresh_token_ttl_in_minutes": {
+          "description": "Refresh token time to live in minutes.\nWhen single-use refresh tokens are enabled, this represents the TTL of an individual refresh token.\nIf the refresh token is used before it expires, a new one is issued with a renewed individual TTL.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "oauth2.UpdateAccountFederationPolicyRequest": {
+      "fields": {
+        "policy": {
+          "ref": "oauth2.FederationPolicy",
+          "launch_stage": "GA"
+        },
+        "update_mask": {
+          "description": "The field mask specifies which fields of the policy to update. To specify multiple fields\nin the field mask, use comma as the separator (no space). The special value '*' indicates\nthat all fields should be updated (full replacement). If unspecified, all fields that are\nset in the policy provided in the update request will overwrite the corresponding fields\nin the existing policy. Example value: 'description,oidc_policy.audiences'.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "oauth2.UpdateCustomAppIntegration": {
+      "fields": {
+        "redirect_urls": {
+          "description": "List of OAuth redirect urls to be updated in the custom OAuth app integration",
+          "launch_stage": "GA"
+        },
+        "scopes": {
+          "description": "List of OAuth scopes to be updated in the custom OAuth app integration, similar to redirect URIs this will fully\nreplace the existing values instead of appending",
+          "launch_stage": "GA"
+        },
+        "token_access_policy": {
+          "description": "Token access policy to be updated in the custom OAuth app integration",
+          "ref": "oauth2.TokenAccessPolicy",
+          "launch_stage": "GA"
+        },
+        "user_authorized_scopes": {
+          "description": "Scopes that will need to be consented by end user to mint the access token. If the user does\nnot authorize the access token will not be minted.\nMust be a subset of scopes.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "oauth2.UpdateCustomAppIntegrationOutput": {},
+    "oauth2.UpdatePublishedAppIntegration": {
+      "fields": {
+        "token_access_policy": {
+          "description": "Token access policy to be updated in the published OAuth app integration",
+          "ref": "oauth2.TokenAccessPolicy",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "oauth2.UpdatePublishedAppIntegrationOutput": {},
+    "oauth2.UpdateServicePrincipalFederationPolicyRequest": {
+      "fields": {
+        "policy": {
+          "ref": "oauth2.FederationPolicy",
+          "launch_stage": "GA"
+        },
+        "update_mask": {
+          "description": "The field mask specifies which fields of the policy to update. To specify multiple fields\nin the field mask, use comma as the separator (no space). The special value '*' indicates\nthat all fields should be updated (full replacement). If unspecified, all fields that are\nset in the policy provided in the update request will overwrite the corresponding fields\nin the existing policy. Example value: 'description,oidc_policy.audiences'.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "pipelines.ApiSourceConnectorConfig": {
+      "description": "Top-level configuration for API Source connectors with arbitrary configuration.",
+      "fields": {
+        "configs": {
+          "description": "Arbitrary key-value configuration values for the API Source connector.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "pipelines.ApiSourceConnectorOptions": {
+      "description": "Options for API Source connectors with arbitrary configuration.",
+      "fields": {
+        "options": {
+          "description": "Arbitrary key-value configuration options for the API Source connector.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "pipelines.ApplyEnvironmentRequest": {},
+    "pipelines.ApplyEnvironmentRequestResponse": {},
+    "pipelines.AutoFullRefreshPolicy": {
+      "description": "Policy for auto full refresh.",
+      "fields": {
+        "enabled": {
+          "description": "(Required, Mutable) Whether to enable auto full refresh or not.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "min_interval_hours": {
+          "description": "(Optional, Mutable) Specify the minimum interval in hours between the timestamp\nat which a table was last full refreshed and the current timestamp for triggering auto full\nIf unspecified and autoFullRefresh is enabled then by default min_interval_hours is 24 hours.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "pipelines.AvroTransformerOptions": {
+      "fields": {
+        "parse_mode": {
+          "description": "(Optional) Parse mode for Avro data.\nValid values: FAILFAST, PERMISSIVE. Defaults to PERMISSIVE.",
+          "ref": "pipelines.ParseMode",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "schema": {
+          "description": "Inline Avro JSON schema string.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "schema_file_path": {
+          "description": "Path to a schema file (.avsc).",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "schema_registry": {
+          "description": "(Optional) Schema registry to resolve the Avro schema at runtime instead of\nproviding it inline or via a file path.",
+          "ref": "pipelines.SchemaRegistryConfig",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "pipelines.CloneMode": {
+      "description": "Enum to specify which mode of clone to execute",
+      "enum": [
+        "MIGRATE_TO_UC"
+      ],
+      "enum_launch_stages": {
+        "MIGRATE_TO_UC": "GA"
+      }
+    },
+    "pipelines.ClonePipelineRequest": {
+      "fields": {
+        "allow_duplicate_names": {
+          "description": "If false, deployment will fail if name conflicts with that of another pipeline.",
+          "launch_stage": "GA"
+        },
+        "budget_policy_id": {
+          "description": "Budget policy of this pipeline.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "catalog": {
+          "description": "A catalog in Unity Catalog to publish data from this pipeline to. If `target` is specified, tables in this pipeline are published to a `target` schema inside `catalog` (for example, `catalog`.`target`.`table`). If `target` is not specified, no data is published to Unity Catalog.",
+          "launch_stage": "GA"
+        },
+        "channel": {
+          "description": "SDP Release Channel that specifies which version to use.",
+          "launch_stage": "GA"
+        },
+        "clone_mode": {
+          "description": "The type of clone to perform. Currently, only deep copies are supported",
+          "ref": "pipelines.CloneMode",
+          "launch_stage": "GA"
+        },
+        "clusters": {
+          "description": "Cluster settings for this pipeline deployment. Applies to classic\n(non-serverless) pipelines. Omit this field when `serverless` is `true`.",
+          "launch_stage": "GA"
+        },
+        "configuration": {
+          "description": "String-String configuration for this pipeline execution.",
+          "launch_stage": "GA"
+        },
+        "continuous": {
+          "description": "Whether the pipeline is continuous or triggered. This replaces `trigger`.\n\nDeprecated: wrap the pipeline in a continuous job instead, which also lets you take advantage\nof job-level settings such as performance mode. When the pipeline is started by a continuous\njob, the job's setting takes precedence and this field is ignored.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "deployment": {
+          "description": "Deployment type of this pipeline.",
+          "ref": "pipelines.PipelineDeployment",
+          "launch_stage": "GA"
+        },
+        "development": {
+          "description": "Whether the pipeline is in Development mode. Defaults to false.\n\nDeprecated: set development mode for each update instead.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "edition": {
+          "description": "Pipeline product edition.",
+          "launch_stage": "GA"
+        },
+        "environment": {
+          "description": "Environment specification for this pipeline used to install dependencies.",
+          "ref": "pipelines.PipelinesEnvironment",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "event_log": {
+          "description": "Event log configuration for this pipeline",
+          "ref": "pipelines.EventLogSpec",
+          "launch_stage": "GA"
+        },
+        "expected_last_modified": {
+          "description": "If present, the last-modified time of the pipeline settings before the clone.\nIf the settings were modified after that time, then the request will fail with\na conflict.",
+          "launch_stage": "GA"
+        },
+        "filters": {
+          "description": "Filters on which Pipeline packages to include in the deployed graph.",
+          "ref": "pipelines.Filters",
+          "launch_stage": "GA"
+        },
+        "gateway_definition": {
+          "description": "The definition of a gateway pipeline to support change data capture.",
+          "ref": "pipelines.IngestionGatewayPipelineDefinition",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "id": {
+          "description": "Unique identifier for this pipeline.",
+          "launch_stage": "GA"
+        },
+        "ingestion_definition": {
+          "description": "The configuration for a managed ingestion pipeline. These settings cannot be used with the 'libraries', 'schema', 'target', or 'catalog' settings.",
+          "ref": "pipelines.IngestionPipelineDefinition",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "libraries": {
+          "description": "Libraries or code needed by this deployment.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Friendly identifier for this pipeline.",
+          "launch_stage": "GA"
+        },
+        "notifications": {
+          "description": "List of notification settings for this pipeline.",
+          "launch_stage": "GA"
+        },
+        "parent_path": {
+          "description": "Path of the pipeline parent folder in workspace file tree.\n\nIf absent, the pipeline doesn't have a workspace object.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "photon": {
+          "description": "Whether Photon is enabled for this pipeline.",
+          "launch_stage": "GA"
+        },
+        "restart_window": {
+          "description": "Restart window of this pipeline.",
+          "ref": "pipelines.RestartWindow",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "root_path": {
+          "description": "Root path for this pipeline.\nThis is used as the root directory when editing the pipeline in the Databricks user interface and it is\nadded to sys.path when executing Python sources during pipeline execution.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "schema": {
+          "description": "The default schema (database) where tables are read from or published to.",
+          "launch_stage": "GA"
+        },
+        "serverless": {
+          "description": "Whether serverless compute is enabled for this pipeline. Serverless is the\nrecommended compute for new pipelines; set this to `true` to run the pipeline\non serverless. For notebook/file pipelines, omitting this field uses classic\ncompute configured through the `clusters` field. When `true`, omit `clusters`;\nPhoton is always enabled.",
+          "launch_stage": "GA"
+        },
+        "serverless_compute_id": {
+          "description": "Serverless compute ID specified by the user for serverless pipelines.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "storage": {
+          "description": "DBFS root directory for storing checkpoints and tables.",
+          "launch_stage": "GA"
+        },
+        "tags": {
+          "description": "A map of tags associated with the pipeline.\nThese are forwarded to the cluster as cluster tags, and are therefore subject to the same limitations.\nA maximum of 25 tags can be added to the pipeline.",
+          "launch_stage": "GA"
+        },
+        "target": {
+          "description": "Target schema (database) to add tables in this pipeline to. Exactly one of `schema` or `target` must be specified. To publish to Unity Catalog, also specify `catalog`. This legacy field is deprecated for pipeline creation in favor of the `schema` field.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "trigger": {
+          "description": "Which pipeline trigger to use. Deprecated: Use `continuous` instead.",
+          "ref": "pipelines.PipelineTrigger",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "usage_policy_id": {
+          "description": "Usage policy of this pipeline.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "pipelines.ClonePipelineResponse": {
+      "fields": {
+        "pipeline_id": {
+          "description": "The pipeline id of the cloned pipeline",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.ConfluenceConnectorOptions": {
+      "description": "Confluence specific options for ingestion",
+      "fields": {
+        "include_confluence_spaces": {
+          "description": "(Optional) Spaces to filter Confluence data on",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "pipelines.ConfluentSchemaRegistryOptions": {
+      "fields": {
+        "subject": {
+          "description": "Required: subject name to resolve in the registry.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "pipelines.ConnectionParameters": {
+      "fields": {
+        "source_catalog": {
+          "description": "Source catalog for initial connection.\nThis is necessary for schema exploration in some database systems like Oracle, and optional but nice-to-have\nin some other database systems like Postgres.\nFor Oracle databases, this maps to a service name.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "pipelines.ConnectorOptions": {
+      "description": "Wrapper message for source-specific options to support multiple connector types",
+      "fields": {
+        "api_source_connector_options": {
+          "description": "Connector-specific options for API Source connectors.",
+          "ref": "pipelines.ApiSourceConnectorOptions",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "confluence_options": {
+          "ref": "pipelines.ConfluenceConnectorOptions",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "gdrive_options": {
+          "ref": "pipelines.GoogleDriveOptions",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "google_ads_options": {
+          "ref": "pipelines.GoogleAdsOptions",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "jira_options": {
+          "ref": "pipelines.JiraConnectorOptions",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "kafka_options": {
+          "ref": "pipelines.KafkaOptions",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "linkedin_ads_options": {
+          "ref": "pipelines.LinkedInAdsOptions",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "marketo_options": {
+          "ref": "pipelines.MarketoOptions",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "meta_ads_options": {
+          "ref": "pipelines.MetaMarketingOptions",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "outlook_options": {
+          "ref": "pipelines.OutlookOptions",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "rabbitmq_options": {
+          "ref": "pipelines.RabbitmqOptions",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "reddit_ads_options": {
+          "ref": "pipelines.RedditAdsOptions",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "sharepoint_options": {
+          "ref": "pipelines.SharepointOptions",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "smartsheet_options": {
+          "ref": "pipelines.SmartsheetOptions",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "tiktok_ads_options": {
+          "ref": "pipelines.TikTokAdsOptions",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "zendesk_support_options": {
+          "ref": "pipelines.ZendeskSupportOptions",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "pipelines.ConnectorType": {
+      "description": "For certain database sources LakeFlow Connect offers both query based and cdc\ningestion, ConnectorType can bse used to convey the type of ingestion.\nIf connection_name is provided for database sources, we default to Query Based ingestion",
+      "enum": [
+        "CDC",
+        "QUERY_BASED"
+      ],
+      "enum_launch_stages": {
+        "CDC": "PUBLIC_PREVIEW",
+        "QUERY_BASED": "PUBLIC_PREVIEW"
+      }
+    },
+    "pipelines.CreatePipeline": {
+      "fields": {
+        "allow_duplicate_names": {
+          "description": "If false, deployment will fail if name conflicts with that of another pipeline.",
+          "launch_stage": "GA"
+        },
+        "budget_policy_id": {
+          "description": "Budget policy of this pipeline.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "catalog": {
+          "description": "A catalog in Unity Catalog to publish data from this pipeline to. If `target` is specified, tables in this pipeline are published to a `target` schema inside `catalog` (for example, `catalog`.`target`.`table`). If `target` is not specified, no data is published to Unity Catalog.",
+          "launch_stage": "GA"
+        },
+        "channel": {
+          "description": "SDP Release Channel that specifies which version to use.",
+          "launch_stage": "GA"
+        },
+        "clusters": {
+          "description": "Cluster settings for this pipeline deployment. Applies to classic\n(non-serverless) pipelines. Omit this field when `serverless` is `true`.",
+          "launch_stage": "GA"
+        },
+        "configuration": {
+          "description": "String-String configuration for this pipeline execution.",
+          "launch_stage": "GA"
+        },
+        "continuous": {
+          "description": "Whether the pipeline is continuous or triggered. This replaces `trigger`.\n\nDeprecated: wrap the pipeline in a continuous job instead, which also lets you take advantage\nof job-level settings such as performance mode. When the pipeline is started by a continuous\njob, the job's setting takes precedence and this field is ignored.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "deployment": {
+          "description": "Deployment type of this pipeline.",
+          "ref": "pipelines.PipelineDeployment",
+          "launch_stage": "GA"
+        },
+        "development": {
+          "description": "Whether the pipeline is in Development mode. Defaults to false.\n\nDeprecated: set development mode for each update instead.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "dry_run": {
+          "launch_stage": "GA"
+        },
+        "edition": {
+          "description": "Pipeline product edition.",
+          "launch_stage": "GA"
+        },
+        "environment": {
+          "description": "Environment specification for this pipeline used to install dependencies.",
+          "ref": "pipelines.PipelinesEnvironment",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "event_log": {
+          "description": "Event log configuration for this pipeline",
+          "ref": "pipelines.EventLogSpec",
+          "launch_stage": "GA"
+        },
+        "filters": {
+          "description": "Filters on which Pipeline packages to include in the deployed graph.",
+          "ref": "pipelines.Filters",
+          "launch_stage": "GA"
+        },
+        "gateway_definition": {
+          "description": "The definition of a gateway pipeline to support change data capture.",
+          "ref": "pipelines.IngestionGatewayPipelineDefinition",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "id": {
+          "description": "Unique identifier for this pipeline.",
+          "launch_stage": "GA"
+        },
+        "ingestion_definition": {
+          "description": "The configuration for a managed ingestion pipeline. These settings cannot be used with the 'libraries', 'schema', 'target', or 'catalog' settings.",
+          "ref": "pipelines.IngestionPipelineDefinition",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "libraries": {
+          "description": "Libraries or code needed by this deployment.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Friendly identifier for this pipeline.",
+          "launch_stage": "GA"
+        },
+        "notifications": {
+          "description": "List of notification settings for this pipeline.",
+          "launch_stage": "GA"
+        },
+        "parameters": {
+          "description": "Key/value map of default parameters to use for pipeline execution.\nMaximum total size: 10k characters (JSON format)",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "parent_path": {
+          "description": "Path of the pipeline parent folder in workspace file tree.\n\nIf absent, the pipeline doesn't have a workspace object.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "photon": {
+          "description": "Whether Photon is enabled for this pipeline.",
+          "launch_stage": "GA"
+        },
+        "restart_window": {
+          "description": "Restart window of this pipeline.",
+          "ref": "pipelines.RestartWindow",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "root_path": {
+          "description": "Root path for this pipeline.\nThis is used as the root directory when editing the pipeline in the Databricks user interface and it is\nadded to sys.path when executing Python sources during pipeline execution.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "run_as": {
+          "ref": "pipelines.RunAs",
+          "launch_stage": "GA"
+        },
+        "schema": {
+          "description": "The default schema (database) where tables are read from or published to.",
+          "launch_stage": "GA"
+        },
+        "serverless": {
+          "description": "Whether serverless compute is enabled for this pipeline. Serverless is the\nrecommended compute for new pipelines; set this to `true` to run the pipeline\non serverless. For notebook/file pipelines, omitting this field uses classic\ncompute configured through the `clusters` field. When `true`, omit `clusters`;\nPhoton is always enabled.",
+          "launch_stage": "GA"
+        },
+        "serverless_compute_id": {
+          "description": "Serverless compute ID specified by the user for serverless pipelines.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "storage": {
+          "description": "DBFS root directory for storing checkpoints and tables.",
+          "launch_stage": "GA"
+        },
+        "tags": {
+          "description": "A map of tags associated with the pipeline.\nThese are forwarded to the cluster as cluster tags, and are therefore subject to the same limitations.\nA maximum of 25 tags can be added to the pipeline.",
+          "launch_stage": "GA"
+        },
+        "target": {
+          "description": "Target schema (database) to add tables in this pipeline to. Exactly one of `schema` or `target` must be specified. To publish to Unity Catalog, also specify `catalog`. This legacy field is deprecated for pipeline creation in favor of the `schema` field.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "trigger": {
+          "description": "Which pipeline trigger to use. Deprecated: Use `continuous` instead.",
+          "ref": "pipelines.PipelineTrigger",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "usage_policy_id": {
+          "description": "Usage policy of this pipeline.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "pipelines.CreatePipelineResponse": {
+      "fields": {
+        "effective_settings": {
+          "description": "Only returned when dry_run is true.",
+          "ref": "pipelines.PipelineSpec",
+          "launch_stage": "GA"
+        },
+        "pipeline_id": {
+          "description": "The unique identifier for the newly created pipeline. Only returned when dry_run is false.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.CronTrigger": {
+      "fields": {
+        "quartz_cron_schedule": {
+          "launch_stage": "GA"
+        },
+        "timezone_id": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.DataPlaneId": {
+      "fields": {
+        "instance": {
+          "description": "The instance name of the data plane emitting an event.",
+          "launch_stage": "GA"
+        },
+        "seq_no": {
+          "description": "A sequence number, unique and increasing within the data plane instance.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.DataStagingOptions": {
+      "description": "Location of staged data storage",
+      "fields": {
+        "catalog_name": {
+          "description": "(Required, Immutable) The name of the catalog for the connector's staging storage location.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "schema_name": {
+          "description": "(Required, Immutable) The name of the schema for the connector's staging storage location.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "volume_name": {
+          "description": "(Optional) The Unity Catalog-compatible name for the storage location.\nThis is the volume to use for the data that is extracted by the connector.\nSpark Declarative Pipelines system will automatically create the volume under the catalog and schema.\nFor Combined Cdc Managed Ingestion pipelines default name for the volume would be :\n__databricks_ingestion_gateway_staging_data-$pipelineId",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "pipelines.DayOfWeek": {
+      "description": "Days of week in which the window is allowed to happen.\nIf not specified all days of the week will be used.",
+      "enum": [
+        "MONDAY",
+        "TUESDAY",
+        "WEDNESDAY",
+        "THURSDAY",
+        "FRIDAY",
+        "SATURDAY",
+        "SUNDAY"
+      ],
+      "enum_launch_stages": {
+        "FRIDAY": "PUBLIC_PREVIEW",
+        "MONDAY": "PUBLIC_PREVIEW",
+        "SATURDAY": "PUBLIC_PREVIEW",
+        "SUNDAY": "PUBLIC_PREVIEW",
+        "THURSDAY": "PUBLIC_PREVIEW",
+        "TUESDAY": "PUBLIC_PREVIEW",
+        "WEDNESDAY": "PUBLIC_PREVIEW"
+      }
+    },
+    "pipelines.DeletePipelineRequest": {
+      "fields": {
+        "cascade": {
+          "description": "If false, pipeline deletion will not cascade to its datasets (MVs, STs, Views).\nBy default, this parameter will be true and all tables will be deleted with the pipeline.",
+          "launch_stage": "GA"
+        },
+        "force": {
+          "description": "If true, deletion will proceed even if resource cleanup fails.\nBy default, deletion will fail if resources cleanup is required but fails.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "pipelines.DeletePipelineResponse": {},
+    "pipelines.DeploymentKind": {
+      "description": "The deployment method that manages the pipeline:\n- BUNDLE: The pipeline is managed by a Databricks Asset Bundle.",
+      "enum": [
+        "BUNDLE"
+      ],
+      "enum_launch_stages": {
+        "BUNDLE": "GA"
+      }
+    },
+    "pipelines.EditPipeline": {
+      "fields": {
+        "allow_duplicate_names": {
+          "description": "If false, deployment will fail if name has changed and conflicts the name of another pipeline.",
+          "launch_stage": "GA"
+        },
+        "budget_policy_id": {
+          "description": "Budget policy of this pipeline.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "catalog": {
+          "description": "A catalog in Unity Catalog to publish data from this pipeline to. If `target` is specified, tables in this pipeline are published to a `target` schema inside `catalog` (for example, `catalog`.`target`.`table`). If `target` is not specified, no data is published to Unity Catalog.",
+          "launch_stage": "GA"
+        },
+        "channel": {
+          "description": "SDP Release Channel that specifies which version to use.",
+          "launch_stage": "GA"
+        },
+        "clusters": {
+          "description": "Cluster settings for this pipeline deployment. Applies to classic\n(non-serverless) pipelines. Omit this field when `serverless` is `true`.",
+          "launch_stage": "GA"
+        },
+        "configuration": {
+          "description": "String-String configuration for this pipeline execution.",
+          "launch_stage": "GA"
+        },
+        "continuous": {
+          "description": "Whether the pipeline is continuous or triggered. This replaces `trigger`.\n\nDeprecated: wrap the pipeline in a continuous job instead, which also lets you take advantage\nof job-level settings such as performance mode. When the pipeline is started by a continuous\njob, the job's setting takes precedence and this field is ignored.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "deployment": {
+          "description": "Deployment type of this pipeline.",
+          "ref": "pipelines.PipelineDeployment",
+          "launch_stage": "GA"
+        },
+        "development": {
+          "description": "Whether the pipeline is in Development mode. Defaults to false.\n\nDeprecated: set development mode for each update instead.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "edition": {
+          "description": "Pipeline product edition.",
+          "launch_stage": "GA"
+        },
+        "environment": {
+          "description": "Environment specification for this pipeline used to install dependencies.",
+          "ref": "pipelines.PipelinesEnvironment",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "event_log": {
+          "description": "Event log configuration for this pipeline",
+          "ref": "pipelines.EventLogSpec",
+          "launch_stage": "GA"
+        },
+        "expected_last_modified": {
+          "description": "If present, the last-modified time of the pipeline settings before the edit.\nIf the settings were modified after that time, then the request will fail with\na conflict.",
+          "launch_stage": "GA"
+        },
+        "filters": {
+          "description": "Filters on which Pipeline packages to include in the deployed graph.",
+          "ref": "pipelines.Filters",
+          "launch_stage": "GA"
+        },
+        "gateway_definition": {
+          "description": "The definition of a gateway pipeline to support change data capture.",
+          "ref": "pipelines.IngestionGatewayPipelineDefinition",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "id": {
+          "description": "Unique identifier for this pipeline.",
+          "launch_stage": "GA"
+        },
+        "ingestion_definition": {
+          "description": "The configuration for a managed ingestion pipeline. These settings cannot be used with the 'libraries', 'schema', 'target', or 'catalog' settings.",
+          "ref": "pipelines.IngestionPipelineDefinition",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "libraries": {
+          "description": "Libraries or code needed by this deployment.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Friendly identifier for this pipeline.",
+          "launch_stage": "GA"
+        },
+        "notifications": {
+          "description": "List of notification settings for this pipeline.",
+          "launch_stage": "GA"
+        },
+        "parameters": {
+          "description": "Key/value map of default parameters to use for pipeline execution.\nMaximum total size: 10k characters (JSON format)",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "parent_path": {
+          "description": "Path of the pipeline parent folder in workspace file tree.\n\nIf absent, the pipeline doesn't have a workspace object.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "photon": {
+          "description": "Whether Photon is enabled for this pipeline.",
+          "launch_stage": "GA"
+        },
+        "restart_window": {
+          "description": "Restart window of this pipeline.",
+          "ref": "pipelines.RestartWindow",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "root_path": {
+          "description": "Root path for this pipeline.\nThis is used as the root directory when editing the pipeline in the Databricks user interface and it is\nadded to sys.path when executing Python sources during pipeline execution.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "run_as": {
+          "ref": "pipelines.RunAs",
+          "launch_stage": "GA"
+        },
+        "schema": {
+          "description": "The default schema (database) where tables are read from or published to.",
+          "launch_stage": "GA"
+        },
+        "serverless": {
+          "description": "Whether serverless compute is enabled for this pipeline. Serverless is the\nrecommended compute for new pipelines; set this to `true` to run the pipeline\non serverless. For notebook/file pipelines, omitting this field uses classic\ncompute configured through the `clusters` field. When `true`, omit `clusters`;\nPhoton is always enabled.",
+          "launch_stage": "GA"
+        },
+        "serverless_compute_id": {
+          "description": "Serverless compute ID specified by the user for serverless pipelines.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "storage": {
+          "description": "DBFS root directory for storing checkpoints and tables.",
+          "launch_stage": "GA"
+        },
+        "tags": {
+          "description": "A map of tags associated with the pipeline.\nThese are forwarded to the cluster as cluster tags, and are therefore subject to the same limitations.\nA maximum of 25 tags can be added to the pipeline.",
+          "launch_stage": "GA"
+        },
+        "target": {
+          "description": "Target schema (database) to add tables in this pipeline to. Exactly one of `schema` or `target` must be specified. To publish to Unity Catalog, also specify `catalog`. This legacy field is deprecated for pipeline creation in favor of the `schema` field.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "trigger": {
+          "description": "Which pipeline trigger to use. Deprecated: Use `continuous` instead.",
+          "ref": "pipelines.PipelineTrigger",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "usage_policy_id": {
+          "description": "Usage policy of this pipeline.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "pipelines.EditPipelineResponse": {},
+    "pipelines.ErrorDetail": {
+      "fields": {
+        "exceptions": {
+          "description": "The exception thrown for this error, with its chain of cause.",
+          "launch_stage": "GA"
+        },
+        "fatal": {
+          "description": "Whether this error is considered fatal, that is, unrecoverable.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.EventLevel": {
+      "description": "The severity level of the event.",
+      "enum": [
+        "INFO",
+        "WARN",
+        "ERROR",
+        "METRICS"
+      ],
+      "enum_launch_stages": {
+        "ERROR": "GA",
+        "INFO": "GA",
+        "METRICS": "GA",
+        "WARN": "GA"
+      }
+    },
+    "pipelines.EventLogSpec": {
+      "description": "Configurable event log parameters.",
+      "fields": {
+        "catalog": {
+          "description": "The UC catalog the event log is published under.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The name the event log is published to in UC.",
+          "launch_stage": "GA"
+        },
+        "schema": {
+          "description": "The UC schema the event log is published under.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.FileFilter": {
+      "fields": {
+        "modified_after": {
+          "description": "Include files with modification times occurring after the specified time.\nTimestamp format: YYYY-MM-DDTHH:mm:ss (e.g. 2020-06-01T13:00:00)\nBased on https://spark.apache.org/docs/latest/sql-data-sources-generic-options.html#modification-time-path-filters",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "modified_before": {
+          "description": "Include files with modification times occurring before the specified time.\nTimestamp format: YYYY-MM-DDTHH:mm:ss (e.g. 2020-06-01T13:00:00)\nBased on https://spark.apache.org/docs/latest/sql-data-sources-generic-options.html#modification-time-path-filters",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "path_filter": {
+          "description": "Include files with file names matching the pattern\nBased on https://spark.apache.org/docs/latest/sql-data-sources-generic-options.html#path-glob-filter",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "pipelines.FileIngestionOptions": {
+      "fields": {
+        "corrupt_record_column": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "file_filters": {
+          "description": "Generic options",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "format": {
+          "description": "required for TableSpec",
+          "ref": "pipelines.FileIngestionOptionsFileFormat",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "format_options": {
+          "description": "Format-specific options\nBased on https://docs.databricks.com/aws/en/ingestion/cloud-object-storage/auto-loader/options#file-format-options",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "ignore_corrupt_files": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "infer_column_types": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "reader_case_sensitive": {
+          "description": "Column name case sensitivity\nhttps://docs.databricks.com/aws/en/ingestion/cloud-object-storage/auto-loader/schema#change-case-sensitive-behavior",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "rescued_data_column": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "schema_evolution_mode": {
+          "ref": "pipelines.FileIngestionOptionsSchemaEvolutionMode",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "schema_hints": {
+          "description": "Override inferred schema of specific columns\nBased on https://docs.databricks.com/aws/en/ingestion/cloud-object-storage/auto-loader/schema#override-schema-inference-with-schema-hints",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "single_variant_column": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "pipelines.FileIngestionOptionsFileFormat": {
+      "enum": [
+        "BINARYFILE",
+        "JSON",
+        "CSV",
+        "XML",
+        "EXCEL",
+        "PARQUET",
+        "AVRO",
+        "ORC"
+      ],
+      "enum_launch_stages": {
+        "AVRO": "PRIVATE_PREVIEW",
+        "BINARYFILE": "PRIVATE_PREVIEW",
+        "CSV": "PRIVATE_PREVIEW",
+        "EXCEL": "PRIVATE_PREVIEW",
+        "JSON": "PRIVATE_PREVIEW",
+        "ORC": "PRIVATE_PREVIEW",
+        "PARQUET": "PRIVATE_PREVIEW",
+        "XML": "PRIVATE_PREVIEW"
+      }
+    },
+    "pipelines.FileIngestionOptionsSchemaEvolutionMode": {
+      "description": "Based on https://docs.databricks.com/aws/en/ingestion/cloud-object-storage/auto-loader/schema#how-does-auto-loader-schema-evolution-work",
+      "enum": [
+        "ADD_NEW_COLUMNS_WITH_TYPE_WIDENING",
+        "ADD_NEW_COLUMNS",
+        "RESCUE",
+        "FAIL_ON_NEW_COLUMNS",
+        "NONE"
+      ],
+      "enum_launch_stages": {
+        "ADD_NEW_COLUMNS": "PUBLIC_BETA",
+        "ADD_NEW_COLUMNS_WITH_TYPE_WIDENING": "PUBLIC_BETA",
+        "FAIL_ON_NEW_COLUMNS": "PUBLIC_BETA",
+        "NONE": "PUBLIC_BETA",
+        "RESCUE": "PUBLIC_BETA"
+      }
+    },
+    "pipelines.FileLibrary": {
+      "fields": {
+        "path": {
+          "description": "The absolute path of the source code.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.Filters": {
+      "fields": {
+        "exclude": {
+          "description": "Paths to exclude.",
+          "launch_stage": "GA"
+        },
+        "include": {
+          "description": "Paths to include.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.GetPipelinePermissionLevelsRequest": {},
+    "pipelines.GetPipelinePermissionLevelsResponse": {
+      "fields": {
+        "permission_levels": {
+          "description": "Specific permission levels",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.GetPipelinePermissionsRequest": {},
+    "pipelines.GetPipelineRequest": {},
+    "pipelines.GetPipelineResponse": {
+      "fields": {
+        "cause": {
+          "description": "An optional message detailing the cause of the pipeline state.",
+          "launch_stage": "GA"
+        },
+        "cluster_id": {
+          "description": "The ID of the cluster that the pipeline is running on.",
+          "launch_stage": "GA"
+        },
+        "creator_user_name": {
+          "description": "The username of the pipeline creator.",
+          "launch_stage": "GA"
+        },
+        "effective_budget_policy_id": {
+          "description": "Serverless budget policy ID of this pipeline.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "effective_publishing_mode": {
+          "description": "Publishing mode of the pipeline",
+          "ref": "pipelines.PublishingMode",
+          "launch_stage": "GA"
+        },
+        "effective_serverless_compute_id": {
+          "description": "Serverless compute ID resolved for the pipeline.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "health": {
+          "description": "The health of a pipeline.",
+          "ref": "pipelines.GetPipelineResponseHealth",
+          "launch_stage": "GA"
+        },
+        "last_modified": {
+          "description": "The last time the pipeline settings were modified or created.",
+          "launch_stage": "GA"
+        },
+        "latest_updates": {
+          "description": "Status of the latest updates for the pipeline. Ordered with the newest update first.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "A human friendly identifier for the pipeline, taken from the `spec`.",
+          "launch_stage": "GA"
+        },
+        "parameters": {
+          "description": "Key/value map of default parameters to use for pipeline execution.\nMaximum total size: 10k characters (JSON format)",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "pipeline_id": {
+          "description": "The ID of the pipeline.",
+          "launch_stage": "GA"
+        },
+        "run_as": {
+          "description": "The user or service principal that the pipeline runs as, if specified in the request.\nThis field indicates the explicit configuration of `run_as` for the pipeline.\nTo find the value in all cases, explicit or implicit, use `run_as_user_name`.",
+          "ref": "pipelines.RunAs",
+          "launch_stage": "GA"
+        },
+        "run_as_user_name": {
+          "description": "Username of the user that the pipeline will run on behalf of.",
+          "launch_stage": "GA"
+        },
+        "spec": {
+          "description": "The pipeline specification. This field is not returned when called by `ListPipelines`.",
+          "ref": "pipelines.PipelineSpec",
+          "launch_stage": "GA"
+        },
+        "state": {
+          "description": "The pipeline state.",
+          "ref": "pipelines.PipelineState",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.GetPipelineResponseHealth": {
+      "description": "The health of a pipeline.",
+      "enum": [
+        "HEALTHY",
+        "UNHEALTHY"
+      ],
+      "enum_launch_stages": {
+        "HEALTHY": "GA",
+        "UNHEALTHY": "GA"
+      }
+    },
+    "pipelines.GetUpdateRequest": {},
+    "pipelines.GetUpdateResponse": {
+      "fields": {
+        "update": {
+          "description": "The current update info.",
+          "ref": "pipelines.UpdateInfo",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.GoogleAdsConfig": {
+      "fields": {
+        "manager_account_id": {
+          "description": "(Required) Manager Account ID (also called MCC Account ID) used to list and access\ncustomer accounts under this manager account. This is required for fetching the list\nof customer accounts during source selection.\nIf the same field is also set in the object-level GoogleAdsOptions (connector_options),\nthe object-level value takes precedence over this top-level config.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "pipelines.GoogleAdsCustomReportOptions": {
+      "description": "User-defined custom report for the Google Ads connector. Mirrors the\nresource + fields + segments + metrics model that Google Ads GAQL exposes.\nThe customer account this report runs against is supplied by the source\nschema (namespace), not by this message. The whole message is gated by\nthe parent GoogleAdsOptions.custom_report_options stage; per-field stage\nannotations are intentionally omitted.\nOnly supported on table-type objects: a custom report requires a\ndestination table, so it cannot be specified at the schema/source level.",
+      "fields": {
+        "metrics": {
+          "description": "(Optional) Metric fields to select (e.g. \"metrics.clicks\",\n\"metrics.cost_micros\"). Multiple values are joined into the GAQL\nSELECT clause.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "resource": {
+          "description": "(Required) Google Ads resource to query (e.g. \"ad_group_ad\",\n\"keyword_view\", \"search_term_view\"). Must be a resource that has\nmetrics. Values are validated against Google Ads' field-service\ncatalog at pipeline plan time.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "resource_fields": {
+          "description": "(Optional) Resource fields to select, in fully-qualified GAQL form\n(e.g. \"ad_group_ad.ad.id\", \"ad_group_ad.status\"). Multiple values are\njoined into the GAQL SELECT clause.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "segments": {
+          "description": "(Optional) Segment fields to select (e.g. \"segments.date\",\n\"segments.device\"). Must include at least one of segments.date,\nsegments.week, or segments.month — that segment is used as the\nincremental cursor for the table.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "pipelines.GoogleAdsOptions": {
+      "description": "Google Ads specific options for ingestion (object-level).\nWhen set, these values override the corresponding fields in GoogleAdsConfig\n(source_configurations).",
+      "fields": {
+        "custom_report_options": {
+          "description": "(Optional) Custom report definition. When set, the table is treated as a\nuser-defined Google Ads custom report: the connector synthesizes a GAQL\nquery from the resource, fields, segments, and metrics specified here.\nWhen unset, the table must match one of the connector's prebuilt sources.",
+          "ref": "pipelines.GoogleAdsCustomReportOptions",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "lookback_window_days": {
+          "description": "(Optional) Number of days to look back for report tables to capture late-arriving data.\nIf not specified, defaults to 30 days.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "manager_account_id": {
+          "description": "(Optional at this level) Manager Account ID (also called MCC Account ID) used to list\nand access customer accounts under this manager account.\nOverrides GoogleAdsConfig.manager_account_id from source_configurations when set.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "sync_start_date": {
+          "description": "(Optional) Start date for the initial sync of report tables in YYYY-MM-DD format.\nThis determines the earliest date from which to sync historical data.\nIf not specified, defaults to 2 years of historical data.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "pipelines.GoogleDriveOptions": {
+      "fields": {
+        "entity_type": {
+          "ref": "pipelines.GoogleDriveOptionsGoogleDriveEntityType",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "file_ingestion_options": {
+          "ref": "pipelines.FileIngestionOptions",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "url": {
+          "description": "Google Drive URL.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "pipelines.GoogleDriveOptionsGoogleDriveEntityType": {
+      "enum": [
+        "FILE",
+        "FILE_METADATA",
+        "PERMISSION"
+      ],
+      "enum_launch_stages": {
+        "FILE": "PRIVATE_PREVIEW",
+        "FILE_METADATA": "PRIVATE_PREVIEW",
+        "PERMISSION": "PRIVATE_PREVIEW"
+      }
+    },
+    "pipelines.IngestionConfig": {
+      "fields": {
+        "report": {
+          "description": "Select a specific source report.",
+          "ref": "pipelines.ReportSpec",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "schema": {
+          "description": "Select all tables from a specific source schema.",
+          "ref": "pipelines.SchemaSpec",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "table": {
+          "description": "Select a specific source table.",
+          "ref": "pipelines.TableSpec",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "pipelines.IngestionGatewayPipelineDefinition": {
+      "fields": {
+        "connection_id": {
+          "description": "[Deprecated, use connection_name instead] Immutable. The Unity Catalog connection that this gateway pipeline uses to communicate with the source.",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "connection_name": {
+          "description": "Immutable. The Unity Catalog connection that this gateway pipeline uses to communicate with the source.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "connection_parameters": {
+          "description": "Optional, Internal. Parameters required to establish an initial connection with the source.",
+          "ref": "pipelines.ConnectionParameters",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "gateway_storage_catalog": {
+          "description": "Required, Immutable. The name of the catalog for the gateway pipeline's storage location.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "gateway_storage_name": {
+          "description": "Optional. The Unity Catalog-compatible name for the gateway storage location.\nThis is the destination to use for the data that is extracted by the gateway.\nSpark Declarative Pipelines system will automatically create the storage location under the catalog and schema.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "gateway_storage_schema": {
+          "description": "Required, Immutable. The name of the schema for the gateway pipelines's storage location.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "pipelines.IngestionPipelineDefinition": {
+      "fields": {
+        "connection_name": {
+          "description": "The Unity Catalog connection that this ingestion pipeline uses to communicate with the source. This is used with\nboth connectors for applications like Salesforce, Workday, and so on, and also database connectors like Oracle,\n(connector_type = QUERY_BASED OR connector_type = CDC).\nIf connection name corresponds to database connectors like Oracle, and connector_type is not provided then\nconnector_type defaults to QUERY_BASED. If connector_type is passed as CDC we use Combined Cdc Managed Ingestion\npipeline.\nUnder certain conditions, this can be replaced with ingestion_gateway_id to change the connector to Cdc Managed\nIngestion Pipeline with Gateway pipeline.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "connector_type": {
+          "description": "(Optional) Connector Type for sources. Ex: CDC, Query Based.",
+          "ref": "pipelines.ConnectorType",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "data_staging_options": {
+          "description": "(Optional) Location of staged data storage. This is required for migration from Cdc Managed Ingestion Pipeline\nwith Gateway pipeline to Combined Cdc Managed Ingestion Pipeline.\nIf not specified, the volume for staged data will be created in catalog and schema/target specified in the\ntop level pipeline definition.",
+          "ref": "pipelines.DataStagingOptions",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "full_refresh_window": {
+          "description": "(Optional) A window that specifies a set of time ranges for snapshot queries in CDC.",
+          "ref": "pipelines.OperationTimeWindow",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "ingest_from_uc_foreign_catalog": {
+          "description": "Immutable. If set to true, the pipeline will ingest tables from the\nUC foreign catalogs directly without the need to specify a UC connection or ingestion gateway.\nThe `source_catalog` fields in objects of IngestionConfig are interpreted as\nthe UC foreign catalogs to ingest from.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "ingestion_gateway_id": {
+          "description": "Identifier for the gateway that is used by this ingestion pipeline to communicate with the source database.\nThis is used with CDC connectors to databases like SQL Server using a gateway pipeline (connector_type = CDC).\nUnder certain conditions, this can be replaced with connection_name to change the connector to Combined Cdc\nManaged Ingestion Pipeline.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "netsuite_jar_path": {
+          "description": "Netsuite only configuration. When the field is set for a netsuite connector,\nthe jar stored in the field will be validated and added to the classpath of\npipeline's cluster.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "objects": {
+          "description": "Required. Settings specifying tables to replicate and the destination for the replicated tables.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "source_configurations": {
+          "description": "Top-level source configurations",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "source_type": {
+          "description": "The type of the foreign source.\nThe source type will be inferred from the source connection or ingestion gateway.\nThis field is output only and will be ignored if provided.",
+          "ref": "pipelines.IngestionSourceType",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "table_configuration": {
+          "description": "Configuration settings to control the ingestion of tables. These settings are applied to all tables in the pipeline.",
+          "ref": "pipelines.TableSpecificConfig",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "pipelines.IngestionPipelineDefinitionFanoutOptions": {
+      "description": "Fanout configuration for multi-table routing from streaming sources.\nRoutes each input record to a destination table based on a routing\nkey derived from the record. The key value becomes the table name\nsuffix: {destination_catalog}.{destination_schema}.{key_value}.",
+      "fields": {
+        "fanout_by": {
+          "description": "Column path or SQL expression whose value determines the destination table.\nSupports dotted paths (e.g. \"value.event_name\") and expressions\n(e.g. \"value:event_name::string\").",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "transforms": {
+          "description": "Optional transforms applied to each route's DataFrame before writing\nto the destination table.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "pipelines.IngestionPipelineDefinitionTableSpecificConfigQueryBasedConnectorConfig": {
+      "description": "Configurations that are only applicable for query-based ingestion connectors.",
+      "fields": {
+        "cursor_columns": {
+          "description": "The names of the monotonically increasing columns in the source table that are used to enable\nthe table to be read and ingested incrementally through structured streaming.\nThe columns are allowed to have repeated values but have to be non-decreasing.\nIf the source data is merged into the destination (e.g., using SCD Type 1 or Type 2), these\ncolumns will implicitly define the `sequence_by` behavior. You can still explicitly set\n`sequence_by` to override this default.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "deletion_condition": {
+          "description": "Specifies a SQL WHERE condition that specifies that the source row has been deleted.\nThis is sometimes referred to as \"soft-deletes\".\nFor example: \"Operation = 'DELETE'\" or \"is_deleted = true\".\nThis field is orthogonal to `hard_deletion_sync_interval_in_seconds`,\none for soft-deletes and the other for hard-deletes.\nSee also the hard_deletion_sync_min_interval_in_seconds field for\nhandling of \"hard deletes\" where the source rows are physically removed from the table.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "hard_deletion_sync_min_interval_in_seconds": {
+          "description": "Specifies the minimum interval (in seconds) between snapshots on primary keys\nfor detecting and synchronizing hard deletions—i.e., rows that have been\nphysically removed from the source table.\nThis interval acts as a lower bound. If ingestion runs less frequently than\nthis value, hard deletion synchronization will align with the actual ingestion\nfrequency instead of happening more often.\nIf not set, hard deletion synchronization via snapshots is disabled.\nThis field is mutable and can be updated without triggering a full snapshot.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "pipelines.IngestionPipelineDefinitionWorkdayReportParameters": {
+      "fields": {
+        "incremental": {
+          "description": "(Optional) Marks the report as incremental.\nThis field is deprecated and should not be used. Use `parameters` instead. The incremental behavior is now\ncontrolled by the `parameters` field.",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "parameters": {
+          "description": "Parameters for the Workday report. Each key represents the parameter name (e.g., \"start_date\", \"end_date\"),\nand the corresponding value is a SQL-like expression used to compute the parameter value at runtime.\nExample:\n{\n\"start_date\": \"{ coalesce(current_offset(), date(\\\"2025-02-01\\\")) }\",\n\"end_date\": \"{ current_date() - INTERVAL 1 DAY }\"\n}",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "report_parameters": {
+          "description": "(Optional) Additional custom parameters for Workday Report\nThis field is deprecated and should not be used. Use `parameters` instead.",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "pipelines.IngestionPipelineDefinitionWorkdayReportParametersQueryKeyValue": {
+      "fields": {
+        "key": {
+          "description": "Key for the report parameter, can be a column name or other metadata",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "value": {
+          "description": "Value for the report parameter.\nPossible values it can take are these sql functions:\n1. coalesce(current_offset(), date(\"YYYY-MM-DD\")) -\u003e if current_offset() is null, then the passed date, else current_offset()\n2. current_date()\n3. date_sub(current_date(), x) -\u003e subtract x (some non-negative integer) days from current date",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "pipelines.IngestionSourceType": {
+      "description": "Type of source system that a managed ingestion pipeline reads from.",
+      "enum": [
+        "MYSQL",
+        "POSTGRESQL",
+        "SQLSERVER",
+        "SALESFORCE",
+        "BIGQUERY",
+        "NETSUITE",
+        "WORKDAY_RAAS",
+        "GA4_RAW_DATA",
+        "SERVICENOW",
+        "MANAGED_POSTGRESQL",
+        "ORACLE",
+        "TERADATA",
+        "SHAREPOINT",
+        "DYNAMICS365",
+        "GOOGLE_DRIVE",
+        "JIRA",
+        "CONFLUENCE",
+        "META_MARKETING",
+        "TIKTOK_ADS",
+        "ZENDESK",
+        "SMARTSHEET",
+        "RABBITMQ",
+        "FOREIGN_CATALOG"
+      ],
+      "enum_launch_stages": {
+        "BIGQUERY": "PUBLIC_PREVIEW",
+        "CONFLUENCE": "PUBLIC_PREVIEW",
+        "DYNAMICS365": "PUBLIC_PREVIEW",
+        "FOREIGN_CATALOG": "PRIVATE_PREVIEW",
+        "GA4_RAW_DATA": "PUBLIC_PREVIEW",
+        "GOOGLE_DRIVE": "PRIVATE_PREVIEW",
+        "JIRA": "PUBLIC_BETA",
+        "MANAGED_POSTGRESQL": "PUBLIC_PREVIEW",
+        "META_MARKETING": "PUBLIC_BETA",
+        "MYSQL": "PUBLIC_PREVIEW",
+        "NETSUITE": "PUBLIC_PREVIEW",
+        "ORACLE": "PUBLIC_PREVIEW",
+        "POSTGRESQL": "PUBLIC_PREVIEW",
+        "RABBITMQ": "PUBLIC_BETA",
+        "SALESFORCE": "PUBLIC_PREVIEW",
+        "SERVICENOW": "PUBLIC_PREVIEW",
+        "SHAREPOINT": "PUBLIC_PREVIEW",
+        "SMARTSHEET": "PUBLIC_PREVIEW",
+        "SQLSERVER": "PUBLIC_PREVIEW",
+        "TERADATA": "PUBLIC_PREVIEW",
+        "TIKTOK_ADS": "PUBLIC_BETA",
+        "WORKDAY_RAAS": "PUBLIC_PREVIEW",
+        "ZENDESK": "PUBLIC_PREVIEW"
+      }
+    },
+    "pipelines.JiraConnectorOptions": {
+      "description": "Jira specific options for ingestion",
+      "fields": {
+        "include_jira_spaces": {
+          "description": "(Optional) Projects to filter Jira data on",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "pipelines.JsonTransformerOptions": {
+      "fields": {
+        "as_variant": {
+          "description": "Parse the entire value as a single Variant column.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "schema": {
+          "description": "Inline schema string for JSON parsing (Spark DDL format).",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "schema_evolution_mode": {
+          "description": "(Optional) Schema evolution mode for schema inference.",
+          "ref": "pipelines.FileIngestionOptionsSchemaEvolutionMode",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "schema_file_path": {
+          "description": "Path to a schema file (.ddl).",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "schema_hints": {
+          "description": "(Optional) Schema hints as a comma-separated string of \"column_name type\" pairs.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "pipelines.KafkaOptions": {
+      "fields": {
+        "client_config": {
+          "description": "Undocumented backdoor mechanism for overriding parameters\nto pass to the Kafka client.\nThis is not supported and may break at any time.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "key_transformer": {
+          "description": "(Optional) Transformer for the message key.\nIf not specified, the key is left as raw bytes.",
+          "ref": "pipelines.Transformer",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "max_offsets_per_trigger": {
+          "description": "Internal option to control the maximum number of offsets to process per trigger.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "starting_offset": {
+          "description": "(Optional) Where to begin reading when no checkpoint exists.\nValid values: \"latest\" and \"earliest\". Defaults to \"latest\".",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "topic_pattern": {
+          "description": "Java regex pattern to subscribe to matching topics.\nOnly one of topics or topic_pattern must be specified.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "topics": {
+          "description": "Topics to subscribe to.\nOnly one of topics or topic_pattern must be specified.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "value_transformer": {
+          "description": "(Optional) Transformer for the message value.\nIf not specified, the value is left as raw bytes.",
+          "ref": "pipelines.Transformer",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "pipelines.LinkedInAdsOptions": {
+      "description": "LinkedIn Ads specific options for ingestion.\nsync_start_date and lookback_window_days apply to both the prebuilt analytics\ntables and custom reports. custom_report_options defines a custom (user-defined)\nadAnalytics report and is only valid on a table object.",
+      "fields": {
+        "custom_report_options": {
+          "description": "(Optional) Custom report definition. Only valid on a table object. When set,\nthe table is synthesized from /rest/adAnalytics using the finder, pivots,\ntime granularity and metrics here. When unset, the table must match one of\nthe connector's prebuilt sources.",
+          "ref": "pipelines.LinkedInAdsOptionsLinkedInAdsCustomReportOptions",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "lookback_window_days": {
+          "description": "(Optional) Days to look back during incremental sync for late-arriving data.\nIf not specified, defaults to 30 days.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "sync_start_date": {
+          "description": "(Optional) Start date for the initial sync of report tables, YYYY-MM-DD.\nEarliest date from which to sync historical data; overrides the default\nwhen set. For finder attributedRevenueMetrics, this must be between 30 and\n366 days before today.\nIf not specified, defaults to 1 year of history.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "pipelines.LinkedInAdsOptionsLinkedInAdsCustomReportOptions": {
+      "description": "User-defined custom report for the LinkedIn Ads connector. The destination\ntable name comes from the enclosing TableSpec.destination_table, the start\ndate from the enclosing LinkedInAdsOptions.sync_start_date, and the account\nit runs against from the source schema (namespace) -- none are repeated here.",
+      "fields": {
+        "entity_granularity": {
+          "description": "(Required) Entity pivots to group by; count/constraints depend on finder.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "finder": {
+          "description": "(Required) adAnalytics finder. See LinkedInAdsFinder.",
+          "ref": "pipelines.LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsFinder",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "metrics": {
+          "description": "(Optional) LinkedIn metric names for the report. Open vocabulary (not an\nenum): the valid set is large (~100) and evolves with the LinkedIn\nadAnalytics API, so values are passed through verbatim. If empty, a\npivot-safe default core set is ingested: impressions, clicks,\ncostInLocalCurrency, externalWebsiteConversions (valid for every pivot).\nIgnored for attributedRevenueMetrics (always returns the full\nRevenueAttributionMetrics struct).",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "time_granularity": {
+          "description": "(Optional) Time aggregation. Defaults to DAILY when unspecified. Used by\nanalytics/statistics; ignored for attributedRevenueMetrics.",
+          "ref": "pipelines.LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsTimeGranularity",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "pipelines.LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsEntityGranularity": {
+      "description": "Entity pivot to group by.",
+      "enum": [
+        "CAMPAIGN",
+        "CREATIVE",
+        "CAMPAIGN_GROUP"
+      ],
+      "enum_launch_stages": {
+        "CAMPAIGN": "PRIVATE_PREVIEW",
+        "CAMPAIGN_GROUP": "PRIVATE_PREVIEW",
+        "CREATIVE": "PRIVATE_PREVIEW"
+      }
+    },
+    "pipelines.LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsFinder": {
+      "description": "adAnalytics finder. Determines call shape, valid pivots, and metric\nrequirements.",
+      "enum": [
+        "ANALYTICS",
+        "STATISTICS",
+        "ATTRIBUTED_REVENUE_METRICS"
+      ],
+      "enum_launch_stages": {
+        "ANALYTICS": "PRIVATE_PREVIEW",
+        "ATTRIBUTED_REVENUE_METRICS": "PRIVATE_PREVIEW",
+        "STATISTICS": "PRIVATE_PREVIEW"
+      }
+    },
+    "pipelines.LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsTimeGranularity": {
+      "description": "Time aggregation. Used by analytics/statistics; ignored for\nattributedRevenueMetrics. Defaults to DAILY when unspecified.",
+      "enum": [
+        "ALL",
+        "DAILY",
+        "MONTHLY",
+        "YEARLY"
+      ],
+      "enum_launch_stages": {
+        "ALL": "PRIVATE_PREVIEW",
+        "DAILY": "PRIVATE_PREVIEW",
+        "MONTHLY": "PRIVATE_PREVIEW",
+        "YEARLY": "PRIVATE_PREVIEW"
+      }
+    },
+    "pipelines.ListPipelineEventsRequest": {
+      "fields": {
+        "filter": {
+          "description": "Criteria to select a subset of results, expressed using a SQL-like syntax.\nThe supported filters are:\n1. level='INFO' (or WARN or ERROR)\n2. level in ('INFO', 'WARN')\n3. id='[event-id]'\n4. timestamp \u003e 'TIMESTAMP' (or \u003e=,\u003c,\u003c=,=)\n\nComposite expressions are supported, for example: level in ('ERROR', 'WARN')\nAND timestamp\u003e '2021-07-22T06:37:33.083Z'",
+          "launch_stage": "GA"
+        },
+        "max_results": {
+          "description": "Max number of entries to return in a single page. The system may return\nfewer than max_results events in a response, even if there are more events\navailable.",
+          "launch_stage": "GA"
+        },
+        "order_by": {
+          "description": "A string indicating a sort order by timestamp for the results, for example, [\"timestamp asc\"].\nThe sort order can be ascending or descending. By default, events are returned\nin descending order by timestamp.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Page token returned by previous call. This field is mutually\nexclusive with all fields in this request except max_results. An error is\nreturned if any fields other than max_results are set when this field is set.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.ListPipelineEventsResponse": {
+      "fields": {
+        "events": {
+          "description": "The list of events matching the request criteria.",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "If present, a token to fetch the next page of events.",
+          "launch_stage": "GA"
+        },
+        "prev_page_token": {
+          "description": "If present, a token to fetch the previous page of events.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.ListPipelinesRequest": {
+      "fields": {
+        "filter": {
+          "description": "Select a subset of results based on the specified criteria.\nThe supported filters are:\n\n* `notebook='\u003cpath\u003e'` to select pipelines that reference the provided notebook path.\n* `name LIKE '[pattern]'` to select pipelines with a name that matches pattern.\nWildcards are supported, for example: `name LIKE '%shopping%'`\n\nComposite filters are not supported. This field is optional.",
+          "launch_stage": "GA"
+        },
+        "max_results": {
+          "description": "The maximum number of entries to return in a single page. The system may\nreturn fewer than max_results pipelines in a response, even if there are\nmore pipelines available. This field is optional. The default value is 25.\nThe maximum value is 100. An error is returned if the value of max_results\nis greater than 100.",
+          "launch_stage": "GA"
+        },
+        "order_by": {
+          "description": "A list of strings specifying the order of results.\nSupported order_by fields are id and name. The default is id asc.\nThis field is optional.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Page token returned by previous call",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.ListPipelinesResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "If present, a token to fetch the next page of pipelines.",
+          "launch_stage": "GA"
+        },
+        "statuses": {
+          "description": "The list of pipelines matching the request criteria.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.ListUpdatesRequest": {
+      "fields": {
+        "max_results": {
+          "description": "Max number of entries to return in a single page.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Page token returned by previous call",
+          "launch_stage": "GA"
+        },
+        "until_update_id": {
+          "description": "If present, returns updates until and including this update_id.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.ListUpdatesResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "If present, then there are more results, and this a token to be used in a subsequent request\nto fetch the next page.",
+          "launch_stage": "GA"
+        },
+        "prev_page_token": {
+          "description": "If present, then this token can be used in a subsequent request to fetch the previous page.",
+          "launch_stage": "GA"
+        },
+        "updates": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.ManualTrigger": {},
+    "pipelines.MarketoOptions": {
+      "description": "Marketo specific options for ingestion",
+      "fields": {
+        "sync_start_date": {
+          "description": "(Optional) Start date for the initial sync in YYYY-MM-DD format.\nThis determines the earliest date from which to sync historical data.\nIf not specified, complete history is ingested.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "pipelines.MaturityLevel": {
+      "description": "Maturity level for EventDetails.",
+      "enum": [
+        "STABLE",
+        "EVOLVING",
+        "DEPRECATED"
+      ],
+      "enum_launch_stages": {
+        "DEPRECATED": "GA",
+        "EVOLVING": "GA",
+        "STABLE": "GA"
+      }
+    },
+    "pipelines.MetaMarketingOptions": {
+      "description": "Meta Marketing (Meta Ads) specific options for ingestion",
+      "fields": {
+        "action_attribution_windows": {
+          "description": "(Optional, DEPRECATED — use custom_report_options.action_attribution_windows) Action attribution\nwindows for insights reporting (e.g. \"28d_click\", \"1d_view\")",
+          "deprecated": true,
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "action_breakdowns": {
+          "description": "(Optional, DEPRECATED — use custom_report_options.action_breakdowns) Action breakdowns",
+          "deprecated": true,
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "action_report_time": {
+          "description": "(Optional, DEPRECATED — use custom_report_options.action_report_time) Timing used to report\naction statistics (impression, conversion, mixed, or lifetime)",
+          "deprecated": true,
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "breakdowns": {
+          "description": "(Optional, DEPRECATED — use custom_report_options.breakdowns) Breakdowns to configure",
+          "deprecated": true,
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "custom_insights_lookback_window": {
+          "description": "(Optional) Window in days to revisit data during sync to capture\nupdated conversion data from the API, shared by prebuilt and custom reports.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "custom_report_options": {
+          "description": "(Optional) Per-table custom report definition. When set, defines the shape of the insights\ncall for this table (level/fields/breakdowns/action_breakdowns/etc.). Supersedes the deprecated\nflat report-shape fields above.",
+          "ref": "pipelines.MetaMarketingOptionsMetaMarketingCustomReportOptions",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "level": {
+          "description": "(Optional, DEPRECATED — use custom_report_options.level) Granularity of data to pull\n(account, ad, adset, campaign)",
+          "deprecated": true,
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "start_date": {
+          "description": "(Optional) Start date in yyyy-MM-dd format (e.g. 2025-01-15). Data added\nafter this date will be ingested, shared by prebuilt and custom reports.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "time_increment": {
+          "description": "(Optional, DEPRECATED — use custom_report_options.time_increment) Value in string by which to\naggregate statistics (can take all_days, monthly or number of days)",
+          "deprecated": true,
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "pipelines.MetaMarketingOptionsMetaMarketingCustomReportOptions": {
+      "description": "Defines the shape of a single Meta Ads custom report (one /insights call shape).\nstart_date, custom_insights_lookback_window live on MetaMarketingOptions, not here.\nMetrics are not customer-selectable; the connector returns a fixed standard metric set.",
+      "fields": {
+        "action_attribution_windows": {
+          "description": "(Optional) Action attribution windows for insights reporting (e.g. \"28d_click\", \"1d_view\")",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "action_breakdowns": {
+          "description": "(Optional) Action breakdowns to configure for data aggregation",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "action_report_time": {
+          "description": "(Optional) Timing used to report action statistics (impression, conversion, mixed, or lifetime)",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "breakdowns": {
+          "description": "(Optional) Breakdowns to configure for data aggregation",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "level": {
+          "description": "(Optional) Granularity of data to pull (account, ad, adset, campaign)",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "time_increment": {
+          "description": "(Optional) Value in string by which to aggregate statistics (all_days, monthly or number of days)",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "pipelines.NotebookLibrary": {
+      "fields": {
+        "path": {
+          "description": "The absolute path of the source code.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.Notifications": {
+      "fields": {
+        "alerts": {
+          "description": "A list of alerts that trigger the sending of notifications to the configured\ndestinations. The supported alerts are:\n\n* `on-update-success`: A pipeline update completes successfully.\n* `on-update-failure`: Each time a pipeline update fails.\n* `on-update-fatal-failure`: A pipeline update fails with a non-retryable (fatal) error.\n* `on-flow-failure`: A single data flow fails.",
+          "launch_stage": "GA"
+        },
+        "email_recipients": {
+          "description": "A list of email addresses notified when a configured alert is triggered.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.OperationTimeWindow": {
+      "description": "Proto representing a window",
+      "fields": {
+        "days_of_week": {
+          "description": "Days of week in which the window is allowed to happen\nIf not specified all days of the week will be used.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "start_hour": {
+          "description": "An integer between 0 and 23 denoting the start hour for the window in the 24-hour day.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "time_zone_id": {
+          "description": "Time zone id of window. See https://docs.databricks.com/sql/language-manual/sql-ref-syntax-aux-conf-mgmt-set-timezone.html for details.\nIf not specified, UTC will be used.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "pipelines.Origin": {
+      "fields": {
+        "batch_id": {
+          "description": "The id of a batch. Unique within a flow.",
+          "launch_stage": "GA"
+        },
+        "cloud": {
+          "description": "The cloud provider, e.g., AWS or Azure.",
+          "launch_stage": "GA"
+        },
+        "cluster_id": {
+          "description": "The id of the cluster where an execution happens. Unique within a region.",
+          "launch_stage": "GA"
+        },
+        "dataset_name": {
+          "description": "The name of a dataset. Unique within a pipeline.",
+          "launch_stage": "GA"
+        },
+        "flow_id": {
+          "description": "The id of the flow. Globally unique. Incremental queries will generally\nreuse the same id while complete queries will have a new id per update.",
+          "launch_stage": "GA"
+        },
+        "flow_name": {
+          "description": "The name of the flow. Not unique.",
+          "launch_stage": "GA"
+        },
+        "host": {
+          "description": "The optional host name where the event was triggered",
+          "launch_stage": "GA"
+        },
+        "ingestion_source_catalog_name": {
+          "description": "The name of the source catalog name (if known) from whose data ingestion is described by this event.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "ingestion_source_connection_name": {
+          "description": "The name of the source UC connection (if known) from whose data ingestion is described by this event.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "ingestion_source_schema_name": {
+          "description": "The name of the source schema name (if known) from whose data ingestion is described by this event.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "ingestion_source_table_name": {
+          "description": "The name of the source table name (if known) from whose data ingestion is described by this event.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "ingestion_source_table_version": {
+          "description": "An optional implementation-defined source table version of a dataset being (re)ingested.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "maintenance_id": {
+          "description": "The id of a maintenance run. Globally unique.",
+          "launch_stage": "GA"
+        },
+        "materialization_name": {
+          "description": "Materialization name.",
+          "launch_stage": "GA"
+        },
+        "org_id": {
+          "description": "The org id of the user. Unique within a cloud.",
+          "launch_stage": "GA"
+        },
+        "pipeline_id": {
+          "description": "The id of the pipeline. Globally unique.",
+          "launch_stage": "GA"
+        },
+        "pipeline_name": {
+          "description": "The name of the pipeline. Not unique.",
+          "launch_stage": "GA"
+        },
+        "region": {
+          "description": "The cloud region.",
+          "launch_stage": "GA"
+        },
+        "request_id": {
+          "description": "The id of the request that caused an update.",
+          "launch_stage": "GA"
+        },
+        "table_id": {
+          "description": "The id of a (delta) table. Globally unique.",
+          "launch_stage": "GA"
+        },
+        "uc_resource_id": {
+          "description": "The Unity Catalog id of the MV or ST being updated.",
+          "launch_stage": "GA"
+        },
+        "update_id": {
+          "description": "The id of an execution. Globally unique.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.OutlookAttachmentMode": {
+      "description": "Attachment behavior mode for Outlook ingestion",
+      "enum": [
+        "ALL",
+        "NON_INLINE_ONLY",
+        "INLINE_ONLY",
+        "NONE"
+      ],
+      "enum_launch_stages": {
+        "ALL": "PRIVATE_PREVIEW",
+        "INLINE_ONLY": "PRIVATE_PREVIEW",
+        "NONE": "PRIVATE_PREVIEW",
+        "NON_INLINE_ONLY": "PRIVATE_PREVIEW"
+      }
+    },
+    "pipelines.OutlookBodyFormat": {
+      "description": "Body format for Outlook email content",
+      "enum": [
+        "TEXT_HTML",
+        "TEXT_PLAIN"
+      ],
+      "enum_launch_stages": {
+        "TEXT_HTML": "PRIVATE_PREVIEW",
+        "TEXT_PLAIN": "PRIVATE_PREVIEW"
+      }
+    },
+    "pipelines.OutlookOptions": {
+      "description": "Outlook specific options for ingestion",
+      "fields": {
+        "attachment_mode": {
+          "description": "(Optional) Controls which attachments to ingest.\nIf not specified, defaults to ALL.",
+          "ref": "pipelines.OutlookAttachmentMode",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "body_format": {
+          "description": "(Optional) Defines how the body_content column is populated.\nTEXT_HTML: Preserves full formatting, links, and styling.\nTEXT_PLAIN: Converts body to plain text. Recommended for AI/RAG pipelines to reduce token usage and noise.",
+          "ref": "pipelines.OutlookBodyFormat",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "folder_filter": {
+          "description": "Deprecated. Use include_folders instead.",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "include_folders": {
+          "description": "(Optional) Filter mail folders to include in the sync.\nIf not specified, all folders will be synced.\nExamples: Inbox, Sent Items, Custom_Folder\nFilter semantics: OR between different folders.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "include_mailboxes": {
+          "description": "(Optional) List of mailboxes to sync (e.g. mailbox email addresses or identifiers).\nIf not specified, all accessible mailboxes are ingested.\nFilter semantics: OR between different mailboxes.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "include_senders": {
+          "description": "(Optional) Filter emails by sender address. Uses exact email match.\nExamples: user@vendor.com, alerts@system.io, noreply@company.com\nIf not specified, emails from all senders will be synced.\nFilter semantics: OR between different senders.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "include_subjects": {
+          "description": "(Optional) Filter emails by subject line. Values ending with \"*\" use prefix match (subject starts with\nthe part before \"*\"); otherwise substring match (subject contains the value).\nExamples: \"Invoice\" (substring), \"Re:*\" (prefix), \"Support Ticket\", \"URGENT*\"\nIf not specified, emails with all subjects will be synced.\nFilter semantics: OR between different subjects.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "sender_filter": {
+          "description": "Deprecated. Use include_senders instead.",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "start_date": {
+          "description": "(Optional) Start date for the initial sync in YYYY-MM-DD format.\nFormat: YYYY-MM-DD (e.g., 2024-01-01)\nThis determines the earliest date from which to sync historical data.\nIf not specified, complete history is ingested.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "subject_filter": {
+          "description": "Deprecated. Use include_subjects instead.",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "pipelines.ParseMode": {
+      "description": "Determines how errors encountered while deserializing records are handled.",
+      "enum": [
+        "FAILFAST",
+        "PERMISSIVE"
+      ],
+      "enum_launch_stages": {
+        "FAILFAST": "PUBLIC_BETA",
+        "PERMISSIVE": "PUBLIC_BETA"
+      }
+    },
+    "pipelines.PathPattern": {
+      "fields": {
+        "include": {
+          "description": "The source code to include for pipelines",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "pipelines.PipelineAccessControlRequest": {
+      "fields": {
+        "group_name": {
+          "description": "name of the group",
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "pipelines.PipelinePermissionLevel",
+          "launch_stage": "GA"
+        },
+        "service_principal_name": {
+          "description": "application ID of a service principal",
+          "launch_stage": "GA"
+        },
+        "user_name": {
+          "description": "name of the user",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.PipelineAccessControlResponse": {
+      "fields": {
+        "all_permissions": {
+          "description": "All permissions.",
+          "launch_stage": "GA"
+        },
+        "display_name": {
+          "description": "Display name of the user or service principal.",
+          "launch_stage": "GA"
+        },
+        "group_name": {
+          "description": "name of the group",
+          "launch_stage": "GA"
+        },
+        "service_principal_name": {
+          "description": "Name of the service principal.",
+          "launch_stage": "GA"
+        },
+        "user_name": {
+          "description": "name of the user",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.PipelineCluster": {
+      "fields": {
+        "apply_policy_default_values": {
+          "description": "Note: This field won't be persisted. Only API users will check this field.",
+          "launch_stage": "GA"
+        },
+        "autoscale": {
+          "description": "Parameters needed in order to automatically scale clusters up and down based on load.\nNote: autoscaling works best with DB runtime versions 3.0 or later.",
+          "ref": "pipelines.PipelineClusterAutoscale",
+          "launch_stage": "GA"
+        },
+        "aws_attributes": {
+          "description": "Attributes related to clusters running on Amazon Web Services.\nIf not specified at cluster creation, a set of default values will be used.",
+          "ref": "compute.AwsAttributes",
+          "launch_stage": "GA"
+        },
+        "azure_attributes": {
+          "description": "Attributes related to clusters running on Microsoft Azure.\nIf not specified at cluster creation, a set of default values will be used.",
+          "ref": "compute.AzureAttributes",
+          "launch_stage": "GA"
+        },
+        "cluster_log_conf": {
+          "description": "The configuration for delivering spark logs to a long-term storage destination.\nOnly dbfs destinations are supported. Only one destination can be specified\nfor one cluster. If the conf is given, the logs will be delivered to the destination every\n`5 mins`. The destination of driver logs is `$destination/$clusterId/driver`, while\nthe destination of executor logs is `$destination/$clusterId/executor`.",
+          "ref": "compute.ClusterLogConf",
+          "launch_stage": "GA"
+        },
+        "custom_tags": {
+          "description": "Additional tags for cluster resources. Databricks will tag all cluster resources (e.g., AWS\ninstances and EBS volumes) with these tags in addition to `default_tags`. Notes:\n\n- Currently, Databricks allows at most 45 custom tags\n\n- Clusters can only reuse cloud resources if the resources' tags are a subset of the cluster tags",
+          "launch_stage": "GA"
+        },
+        "driver_instance_pool_id": {
+          "description": "The optional ID of the instance pool for the driver of the cluster belongs.\nThe pool cluster uses the instance pool with id (instance_pool_id) if the driver pool is not\nassigned.",
+          "launch_stage": "GA"
+        },
+        "driver_node_type_id": {
+          "description": "The node type of the Spark driver.\nNote that this field is optional; if unset, the driver node type will be set as the same value\nas `node_type_id` defined above.",
+          "launch_stage": "GA"
+        },
+        "enable_local_disk_encryption": {
+          "description": "Whether to enable local disk encryption for the cluster.",
+          "launch_stage": "GA"
+        },
+        "gcp_attributes": {
+          "description": "Attributes related to clusters running on Google Cloud Platform.\nIf not specified at cluster creation, a set of default values will be used.",
+          "ref": "compute.GcpAttributes",
+          "launch_stage": "GA"
+        },
+        "init_scripts": {
+          "description": "The configuration for storing init scripts. Any number of destinations can be specified. The scripts are executed sequentially in the order provided. If `cluster_log_conf` is specified, init script logs are sent to `\u003cdestination\u003e/\u003ccluster-ID\u003e/init_scripts`.",
+          "launch_stage": "GA"
+        },
+        "instance_pool_id": {
+          "description": "The optional ID of the instance pool to which the cluster belongs.",
+          "launch_stage": "GA"
+        },
+        "label": {
+          "description": "A label for the cluster specification, either `default` to configure the default cluster settings applied to both the update and maintenance clusters, `updates` to configure the update cluster, or `maintenance` to configure the maintenance cluster. This field is optional. The default value is `default`.",
+          "launch_stage": "GA"
+        },
+        "node_type_id": {
+          "description": "This field encodes, through a single value, the resources available to each of\nthe Spark nodes in this cluster. For example, the Spark nodes can be provisioned\nand optimized for memory or compute intensive workloads. A list of available node\ntypes can be retrieved by using the :method:clusters/listNodeTypes API call.",
+          "launch_stage": "GA"
+        },
+        "num_workers": {
+          "description": "Number of worker nodes that this cluster should have. A cluster has one Spark Driver\nand `num_workers` Executors for a total of `num_workers` + 1 Spark nodes.\n\nNote: When reading the properties of a cluster, this field reflects the desired number\nof workers rather than the actual current number of workers. For instance, if a cluster\nis resized from 5 to 10 workers, this field will immediately be updated to reflect\nthe target size of 10 workers, whereas the workers listed in `spark_info` will gradually\nincrease from 5 to 10 as the new nodes are provisioned.",
+          "launch_stage": "GA"
+        },
+        "policy_id": {
+          "description": "The ID of the cluster policy used to create the cluster if applicable.",
+          "launch_stage": "GA"
+        },
+        "spark_conf": {
+          "description": "An object containing a set of optional, user-specified Spark configuration key-value pairs.\nSee :method:clusters/create for more details.",
+          "launch_stage": "GA"
+        },
+        "spark_env_vars": {
+          "description": "An object containing a set of optional, user-specified environment variable key-value pairs.\nPlease note that key-value pair of the form (X,Y) will be exported as is (i.e.,\n`export X='Y'`) while launching the driver and workers.\n\nIn order to specify an additional set of `SPARK_DAEMON_JAVA_OPTS`, we recommend appending\nthem to `$SPARK_DAEMON_JAVA_OPTS` as shown in the example below. This ensures that all\ndefault databricks managed environmental variables are included as well.\n\nExample Spark environment variables:\n`{\"SPARK_WORKER_MEMORY\": \"28000m\", \"SPARK_LOCAL_DIRS\": \"/local_disk0\"}` or\n`{\"SPARK_DAEMON_JAVA_OPTS\": \"$SPARK_DAEMON_JAVA_OPTS -Dspark.shuffle.service.enabled=true\"}`",
+          "launch_stage": "GA"
+        },
+        "ssh_public_keys": {
+          "description": "SSH public key contents that will be added to each Spark node in this cluster. The\ncorresponding private keys can be used to login with the user name `ubuntu` on port `2200`.\nUp to 10 keys can be specified.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.PipelineClusterAutoscale": {
+      "fields": {
+        "max_workers": {
+          "description": "The maximum number of workers to which the cluster can scale up when overloaded. `max_workers` must be strictly greater than `min_workers`.",
+          "launch_stage": "GA"
+        },
+        "min_workers": {
+          "description": "The minimum number of workers the cluster can scale down to when underutilized.\nIt is also the initial number of workers the cluster will have after creation.",
+          "launch_stage": "GA"
+        },
+        "mode": {
+          "description": "Databricks Enhanced Autoscaling optimizes cluster utilization by automatically\nallocating cluster resources based on workload volume, with minimal impact to\nthe data processing latency of your pipelines. Enhanced Autoscaling is available\nfor `updates` clusters only. The legacy autoscaling feature is used for `maintenance`\nclusters.",
+          "ref": "pipelines.PipelineClusterAutoscaleMode",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.PipelineClusterAutoscaleMode": {
+      "description": "Databricks Enhanced Autoscaling optimizes cluster utilization by automatically\nallocating cluster resources based on workload volume, with minimal impact to\nthe data processing latency of your pipelines. Enhanced Autoscaling is available\nfor `updates` clusters only. The legacy autoscaling feature is used for `maintenance`\nclusters.",
+      "enum": [
+        "ENHANCED",
+        "LEGACY"
+      ],
+      "enum_launch_stages": {
+        "ENHANCED": "GA",
+        "LEGACY": "GA"
+      }
+    },
+    "pipelines.PipelineDeployment": {
+      "fields": {
+        "deployment_id": {
+          "description": "ID of the deployment that manages this pipeline. Only set when `kind` is\n`BUNDLE`. Used to look up deployment metadata from the Deployment\nMetadata service.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "kind": {
+          "description": "The deployment method that manages the pipeline.",
+          "ref": "pipelines.DeploymentKind",
+          "launch_stage": "GA"
+        },
+        "metadata_file_path": {
+          "description": "The path to the file containing metadata about the deployment.",
+          "launch_stage": "GA"
+        },
+        "version_id": {
+          "description": "ID of the version of the deployment that produced this pipeline. Only\nset when `kind` is `BUNDLE`. Identifies a specific snapshot of the\ndeployment in the Deployment Metadata service.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "pipelines.PipelineEvent": {
+      "fields": {
+        "error": {
+          "description": "Information about an error captured by the event.",
+          "ref": "pipelines.ErrorDetail",
+          "launch_stage": "GA"
+        },
+        "event_type": {
+          "description": "The event type. Should always correspond to the details",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "A time-based, globally unique id.",
+          "launch_stage": "GA"
+        },
+        "level": {
+          "description": "The severity level of the event.",
+          "ref": "pipelines.EventLevel",
+          "launch_stage": "GA"
+        },
+        "maturity_level": {
+          "description": "Maturity level for event_type.",
+          "ref": "pipelines.MaturityLevel",
+          "launch_stage": "GA"
+        },
+        "message": {
+          "description": "The display message associated with the event.",
+          "launch_stage": "GA"
+        },
+        "origin": {
+          "description": "Describes where the event originates from.",
+          "ref": "pipelines.Origin",
+          "launch_stage": "GA"
+        },
+        "sequence": {
+          "description": "A sequencing object to identify and order events.",
+          "ref": "pipelines.Sequencing",
+          "launch_stage": "GA"
+        },
+        "timestamp": {
+          "description": "The time of the event.",
+          "launch_stage": "GA"
+        },
+        "truncation": {
+          "description": "Information about which fields were truncated from this event due to size constraints.\nIf empty or absent, no truncation occurred.\nSee https://docs.databricks.com/en/ldp/monitor-event-logs for information on\nretrieving complete event data.",
+          "ref": "pipelines.Truncation",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.PipelineLibrary": {
+      "fields": {
+        "file": {
+          "description": "The path to a file that defines a pipeline and is stored in the Databricks Repos.",
+          "ref": "pipelines.FileLibrary",
+          "launch_stage": "GA"
+        },
+        "glob": {
+          "description": "The unified field to include source codes.\nEach entry can be a notebook path, a file path, or a folder path that ends `/**`.\nThis field cannot be used together with `notebook` or `file`.",
+          "ref": "pipelines.PathPattern",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "jar": {
+          "description": "URI of the jar to be installed. Currently only DBFS is supported.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "maven": {
+          "description": "Specification of a maven library to be installed.",
+          "ref": "compute.MavenLibrary",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "notebook": {
+          "description": "The path to a notebook that defines a pipeline and is stored in the Databricks workspace.",
+          "ref": "pipelines.NotebookLibrary",
+          "launch_stage": "GA"
+        },
+        "whl": {
+          "description": "URI of the whl to be installed.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.PipelinePermission": {
+      "fields": {
+        "inherited": {
+          "launch_stage": "GA"
+        },
+        "inherited_from_object": {
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "pipelines.PipelinePermissionLevel",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.PipelinePermissionLevel": {
+      "description": "Permission level",
+      "enum": [
+        "CAN_MANAGE",
+        "IS_OWNER",
+        "CAN_RUN",
+        "CAN_VIEW"
+      ]
+    },
+    "pipelines.PipelinePermissions": {
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "GA"
+        },
+        "object_id": {
+          "launch_stage": "GA"
+        },
+        "object_type": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.PipelinePermissionsDescription": {
+      "fields": {
+        "description": {
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "pipelines.PipelinePermissionLevel",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.PipelinePermissionsRequest": {
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.PipelineSpec": {
+      "fields": {
+        "budget_policy_id": {
+          "description": "Budget policy of this pipeline.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "catalog": {
+          "description": "A catalog in Unity Catalog to publish data from this pipeline to. If `target` is specified, tables in this pipeline are published to a `target` schema inside `catalog` (for example, `catalog`.`target`.`table`). If `target` is not specified, no data is published to Unity Catalog.",
+          "launch_stage": "GA"
+        },
+        "channel": {
+          "description": "SDP Release Channel that specifies which version to use.",
+          "launch_stage": "GA"
+        },
+        "clusters": {
+          "description": "Cluster settings for this pipeline deployment. Applies to classic\n(non-serverless) pipelines. Omit this field when `serverless` is `true`.",
+          "launch_stage": "GA"
+        },
+        "configuration": {
+          "description": "String-String configuration for this pipeline execution.",
+          "launch_stage": "GA"
+        },
+        "continuous": {
+          "description": "Whether the pipeline is continuous or triggered. This replaces `trigger`.\n\nDeprecated: wrap the pipeline in a continuous job instead, which also lets you take advantage\nof job-level settings such as performance mode. When the pipeline is started by a continuous\njob, the job's setting takes precedence and this field is ignored.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "deployment": {
+          "description": "Deployment type of this pipeline.",
+          "ref": "pipelines.PipelineDeployment",
+          "launch_stage": "GA"
+        },
+        "development": {
+          "description": "Whether the pipeline is in Development mode. Defaults to false.\n\nDeprecated: set development mode for each update instead.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "edition": {
+          "description": "Pipeline product edition.",
+          "launch_stage": "GA"
+        },
+        "environment": {
+          "description": "Environment specification for this pipeline used to install dependencies.",
+          "ref": "pipelines.PipelinesEnvironment",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "event_log": {
+          "description": "Event log configuration for this pipeline",
+          "ref": "pipelines.EventLogSpec",
+          "launch_stage": "GA"
+        },
+        "filters": {
+          "description": "Filters on which Pipeline packages to include in the deployed graph.",
+          "ref": "pipelines.Filters",
+          "launch_stage": "GA"
+        },
+        "gateway_definition": {
+          "description": "The definition of a gateway pipeline to support change data capture.",
+          "ref": "pipelines.IngestionGatewayPipelineDefinition",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "id": {
+          "description": "Unique identifier for this pipeline.",
+          "launch_stage": "GA"
+        },
+        "ingestion_definition": {
+          "description": "The configuration for a managed ingestion pipeline. These settings cannot be used with the 'libraries', 'schema', 'target', or 'catalog' settings.",
+          "ref": "pipelines.IngestionPipelineDefinition",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "libraries": {
+          "description": "Libraries or code needed by this deployment.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Friendly identifier for this pipeline.",
+          "launch_stage": "GA"
+        },
+        "notifications": {
+          "description": "List of notification settings for this pipeline.",
+          "launch_stage": "GA"
+        },
+        "parent_path": {
+          "description": "Path of the pipeline parent folder in workspace file tree.\n\nIf absent, the pipeline doesn't have a workspace object.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "photon": {
+          "description": "Whether Photon is enabled for this pipeline.",
+          "launch_stage": "GA"
+        },
+        "restart_window": {
+          "description": "Restart window of this pipeline.",
+          "ref": "pipelines.RestartWindow",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "root_path": {
+          "description": "Root path for this pipeline.\nThis is used as the root directory when editing the pipeline in the Databricks user interface and it is\nadded to sys.path when executing Python sources during pipeline execution.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "schema": {
+          "description": "The default schema (database) where tables are read from or published to.",
+          "launch_stage": "GA"
+        },
+        "serverless": {
+          "description": "Whether serverless compute is enabled for this pipeline. Serverless is the\nrecommended compute for new pipelines; set this to `true` to run the pipeline\non serverless. For notebook/file pipelines, omitting this field uses classic\ncompute configured through the `clusters` field. When `true`, omit `clusters`;\nPhoton is always enabled.",
+          "launch_stage": "GA"
+        },
+        "serverless_compute_id": {
+          "description": "Serverless compute ID specified by the user for serverless pipelines.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "storage": {
+          "description": "DBFS root directory for storing checkpoints and tables.",
+          "launch_stage": "GA"
+        },
+        "tags": {
+          "description": "A map of tags associated with the pipeline.\nThese are forwarded to the cluster as cluster tags, and are therefore subject to the same limitations.\nA maximum of 25 tags can be added to the pipeline.",
+          "launch_stage": "GA"
+        },
+        "target": {
+          "description": "Target schema (database) to add tables in this pipeline to. Exactly one of `schema` or `target` must be specified. To publish to Unity Catalog, also specify `catalog`. This legacy field is deprecated for pipeline creation in favor of the `schema` field.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "trigger": {
+          "description": "Which pipeline trigger to use. Deprecated: Use `continuous` instead.",
+          "ref": "pipelines.PipelineTrigger",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "usage_policy_id": {
+          "description": "Usage policy of this pipeline.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "pipelines.PipelineState": {
+      "description": "The pipeline state.",
+      "enum": [
+        "DEPLOYING",
+        "STARTING",
+        "RUNNING",
+        "STOPPING",
+        "DELETED",
+        "RECOVERING",
+        "FAILED",
+        "RESETTING",
+        "IDLE"
+      ],
+      "enum_launch_stages": {
+        "DELETED": "GA",
+        "DEPLOYING": "GA",
+        "FAILED": "GA",
+        "IDLE": "GA",
+        "RECOVERING": "GA",
+        "RESETTING": "GA",
+        "RUNNING": "GA",
+        "STARTING": "GA",
+        "STOPPING": "GA"
+      }
+    },
+    "pipelines.PipelineStateInfo": {
+      "fields": {
+        "cluster_id": {
+          "description": "The unique identifier of the cluster running the pipeline.",
+          "launch_stage": "GA"
+        },
+        "creator_user_name": {
+          "description": "The username of the pipeline creator.",
+          "launch_stage": "GA"
+        },
+        "health": {
+          "description": "The health of a pipeline.",
+          "ref": "pipelines.PipelineStateInfoHealth",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "latest_updates": {
+          "description": "Status of the latest updates for the pipeline. Ordered with the newest update first.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The user-friendly name of the pipeline.",
+          "launch_stage": "GA"
+        },
+        "pipeline_id": {
+          "description": "The unique identifier of the pipeline.",
+          "launch_stage": "GA"
+        },
+        "run_as_user_name": {
+          "description": "The username that the pipeline runs as. This is a read only value derived from the pipeline owner.",
+          "launch_stage": "GA"
+        },
+        "state": {
+          "ref": "pipelines.PipelineState",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.PipelineStateInfoHealth": {
+      "description": "The health of a pipeline.",
+      "enum": [
+        "HEALTHY",
+        "UNHEALTHY"
+      ],
+      "enum_launch_stages": {
+        "HEALTHY": "GA",
+        "UNHEALTHY": "GA"
+      }
+    },
+    "pipelines.PipelineTrigger": {
+      "fields": {
+        "cron": {
+          "ref": "pipelines.CronTrigger",
+          "launch_stage": "GA"
+        },
+        "manual": {
+          "ref": "pipelines.ManualTrigger",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.PipelinesEnvironment": {
+      "description": "The environment entity used to preserve serverless environment side panel, jobs' environment for non-notebook task, and SDP's environment for classic and serverless pipelines.\nIn this minimal environment spec, only pip dependencies are supported.",
+      "fields": {
+        "dependencies": {
+          "description": "List of pip dependencies, as supported by the version of pip in this environment.\nEach dependency is a pip requirement file line https://pip.pypa.io/en/stable/reference/requirements-file-format/\nAllowed dependency could be \u003crequirement specifier\u003e, \u003carchive url/path\u003e, \u003clocal project path\u003e(WSFS or Volumes in Databricks), \u003cvcs project url\u003e",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "environment_version": {
+          "description": "The environment version of the serverless Python environment used to execute\ncustomer Python code. Each environment version includes a specific Python\nversion and a curated set of pre-installed libraries with defined versions,\nproviding a stable and reproducible execution environment.\n\nDatabricks supports a three-year lifecycle for each environment version.\nFor available versions and their included packages, see\nhttps://docs.databricks.com/aws/en/release-notes/serverless/environment-version/\n\nThe value should be a string representing the environment version number, for example: `\"4\"`.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "pipelines.PostgresCatalogConfig": {
+      "description": "PG-specific catalog-level configuration parameters",
+      "fields": {
+        "slot_config": {
+          "description": "Optional. The Postgres slot configuration to use for logical replication",
+          "ref": "pipelines.PostgresSlotConfig",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "pipelines.PostgresSlotConfig": {
+      "description": "PostgresSlotConfig contains the configuration for a Postgres logical replication slot",
+      "fields": {
+        "publication_name": {
+          "description": "The name of the publication to use for the Postgres source",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "slot_name": {
+          "description": "The name of the logical replication slot to use for the Postgres source",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "pipelines.ProtobufTransformerOptions": {
+      "fields": {
+        "desc_file_path": {
+          "description": "Required: path to the .desc file (dbfs:/... or /Volumes/...).",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "message_name": {
+          "description": "Required: fully-qualified message type name.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "parse_mode": {
+          "description": "(Optional) Parse mode for Protobuf data.\nValid values: FAILFAST, PERMISSIVE. Defaults to PERMISSIVE.",
+          "ref": "pipelines.ParseMode",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "recursive_fields_max_depth": {
+          "description": "(Optional) Maximum expansion depth for recursive protobuf fields.\nSpark SQL does not natively support recursive types, so recursive\nfields are expanded up to this depth and truncated beyond it.\nValid values: -1 (disallow recursive fields), 0 (drop), 1-10.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "schema_registry": {
+          "description": "(Optional) Schema registry to resolve the Protobuf schema at runtime instead\nof providing it via desc_file_path.",
+          "ref": "pipelines.SchemaRegistryConfig",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "pipelines.PublishingMode": {
+      "description": "Enum representing the publishing mode of a pipeline.",
+      "enum": [
+        "LEGACY_PUBLISHING_MODE",
+        "DEFAULT_PUBLISHING_MODE"
+      ],
+      "enum_launch_stages": {
+        "DEFAULT_PUBLISHING_MODE": "GA",
+        "LEGACY_PUBLISHING_MODE": "GA"
+      }
+    },
+    "pipelines.RabbitmqOptions": {
+      "description": "RabbitMQ specific options for ingestion.\nPerformance tuning options (consumers_per_task, max_messages_per_fetch, etc.)\nare intentionally not exposed in the public API. The managed connector uses\nsensible defaults internally. These can be added later if user demand arises.",
+      "fields": {
+        "queue": {
+          "description": "(Required) RabbitMQ queue name to consume from.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "pipelines.RedditAdsOptions": {
+      "description": "Reddit Ads specific options for ingestion",
+      "fields": {
+        "custom_report_options": {
+          "description": "(Optional) Custom report definition. When set, the table is treated as a\nuser-defined Reddit Ads custom report. When unset, the table must match\none of the connector's prebuilt sources.",
+          "ref": "pipelines.RedditAdsOptionsRedditAdsCustomReportOptions",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "lookback_window_days": {
+          "description": "(Optional) Number of days to look back for report tables during incremental sync\nto capture late-arriving conversions and attribution data.\nIf not specified, defaults to 30 days.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "sync_start_date": {
+          "description": "(Optional) Start date for the initial sync of report tables in YYYY-MM-DD format.\nThis determines the earliest date from which to sync historical data.\nIf not specified, defaults to 2 years ago.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "pipelines.RedditAdsOptionsRedditAdsCustomReportOptions": {
+      "description": "User-defined custom report for the Reddit Ads connector.\nApplies only to the custom_report table — prebuilt tables ignore this.",
+      "fields": {
+        "breakdowns": {
+          "description": "(Optional) Breakdown dimensions to group report data by.\nExamples: CAMPAIGN_ID, DATE, COUNTRY, REGION, AD_ID.\nMust include at least one time dimension (DATE or HOUR).",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "fields": {
+          "description": "(Optional) Fields to include in the report (maps to the Reddit Ads API `fields` parameter).\nExamples: IMPRESSIONS, CLICKS, SPEND, CPC, CTR.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "pipelines.ReplaceWhereOverride": {
+      "description": "Specifies a replace_where predicate override for a replace where flow.",
+      "fields": {
+        "flow_name": {
+          "description": "Name of the flow to apply this override to.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "predicate_override": {
+          "description": "SQL predicate string to use as replace_where condition.\nExample: `date = '2024-10-10' AND city = 'xyz'`",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "pipelines.ReportSpec": {
+      "fields": {
+        "destination_catalog": {
+          "description": "Required. Destination catalog to store table.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "destination_schema": {
+          "description": "Required. Destination schema to store table.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "destination_table": {
+          "description": "Required. Destination table name. The pipeline fails if a table with that name already exists.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "source_url": {
+          "description": "Required. Report URL in the source system.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "table_configuration": {
+          "description": "Configuration settings to control the ingestion of tables. These settings override the table_configuration defined in the IngestionPipelineDefinition object.",
+          "ref": "pipelines.TableSpecificConfig",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "pipelines.RestartWindow": {
+      "fields": {
+        "days_of_week": {
+          "description": "Days of week in which the restart is allowed to happen (within a five-hour window starting at start_hour).\nIf not specified all days of the week will be used.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "start_hour": {
+          "description": "An integer between 0 and 23 denoting the start hour for the restart window in the 24-hour day.\nContinuous pipeline restart is triggered only within a five-hour window starting at this hour.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "time_zone_id": {
+          "description": "Time zone id of restart window. See https://docs.databricks.com/sql/language-manual/sql-ref-syntax-aux-conf-mgmt-set-timezone.html for details.\nIf not specified, UTC will be used.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "pipelines.RewindDatasetSpec": {
+      "description": "Configuration for rewinding a specific dataset.",
+      "fields": {
+        "cascade": {
+          "description": "Whether to cascade the rewind to dependent datasets. Must be specified.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "identifier": {
+          "description": "The identifier of the dataset (e.g., \"main.foo.tbl1\").",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "reset_checkpoints": {
+          "description": "Whether to reset checkpoints for this dataset.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "pipelines.RewindSpec": {
+      "description": "Information about a rewind being requested for this pipeline or some of the datasets in it.",
+      "fields": {
+        "datasets": {
+          "description": "List of datasets to rewind with specific configuration for each. When not specified,\nall datasets will be rewound with cascade = true and reset_checkpoints = true.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "dry_run": {
+          "description": "If true, this is a dry run and we should emit the RewindSummary but not perform the rewind.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "rewind_timestamp": {
+          "description": "The base timestamp to rewind to. Exactly one of rewind_timestamp or rewind_point_id must be\nspecified.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "pipelines.RunAs": {
+      "description": "Write-only setting, available only in Create/Update calls. Specifies the user or service principal that the pipeline runs as. If not specified, the pipeline runs as the user who created the pipeline.\n\nOnly `user_name` or `service_principal_name` can be specified. If both are specified, an error is thrown.",
+      "fields": {
+        "group_name": {
+          "description": "Group name of an account group assigned to the workspace. When set, the pipeline runs as the group and the group's permissions are used for data access. Setting this field requires being a member of the group, or having the `Assume` permission on the group.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "service_principal_name": {
+          "description": "Application ID of an active service principal. Setting this field requires the `servicePrincipal/user` role.",
+          "launch_stage": "GA"
+        },
+        "user_name": {
+          "description": "The email of an active workspace user. Users can only set this field to their own email.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.SchemaRegistryConfig": {
+      "fields": {
+        "confluent_options": {
+          "description": "Required: Confluent-compatible schema registry options.",
+          "ref": "pipelines.ConfluentSchemaRegistryOptions",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "connection_name": {
+          "description": "(Optional) UC connection for registry authentication.\nSpecify if different from the top-level source connection.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "protobuf_message_name": {
+          "description": "(Optional, Protobuf only) Selects a specific message from a schema that\ndefines multiple Protobuf messages. Simple (\"Location\") or fully-qualified\n(\"com.example.protos.Location\"). Defaults to the first message.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "pipelines.SchemaSpec": {
+      "fields": {
+        "connector_options": {
+          "description": "(Optional) Source Specific Connector Options",
+          "ref": "pipelines.ConnectorOptions",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "destination_catalog": {
+          "description": "Required. Destination catalog to store tables.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "destination_schema": {
+          "description": "Required. Destination schema to store tables in. Tables with the same name as the source tables are created in this destination schema. The pipeline fails If a table with the same name already exists.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "fanout_options": {
+          "description": "Fanout options for multi-table routing from streaming sources.\nWhen set, records are routed to destination tables based on a\nper-record routing key. The key value becomes the table name:\n{destination_catalog}.{destination_schema}.{key_value}.",
+          "ref": "pipelines.IngestionPipelineDefinitionFanoutOptions",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "source_catalog": {
+          "description": "The source catalog name. Might be optional depending on the type of source.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "source_schema": {
+          "description": "Schema name in the source database. Optional: some source types (for example streaming or\nmessage-bus connectors) do not use it, so it may be absent from a pipeline's definition.\nClients that assume it is always present should handle its absence.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "table_configuration": {
+          "description": "Configuration settings to control the ingestion of tables. These settings are applied to all tables in this schema and override the table_configuration defined in the IngestionPipelineDefinition object.",
+          "ref": "pipelines.TableSpecificConfig",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "pipelines.Sequencing": {
+      "fields": {
+        "control_plane_seq_no": {
+          "description": "A sequence number, unique and increasing per pipeline.",
+          "launch_stage": "GA"
+        },
+        "data_plane_id": {
+          "description": "the ID assigned by the data plane.",
+          "ref": "pipelines.DataPlaneId",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.SerializedException": {
+      "fields": {
+        "class_name": {
+          "description": "Runtime class of the exception",
+          "launch_stage": "GA"
+        },
+        "message": {
+          "description": "Exception message",
+          "launch_stage": "GA"
+        },
+        "stack": {
+          "description": "Stack trace consisting of a list of stack frames",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.SharepointOptions": {
+      "fields": {
+        "entity_type": {
+          "description": "(Optional) The type of SharePoint entity to ingest.\nIf not specified, defaults to FILE.",
+          "ref": "pipelines.SharepointOptionsSharepointEntityType",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "file_ingestion_options": {
+          "description": "(Optional) File ingestion options for processing files.",
+          "ref": "pipelines.FileIngestionOptions",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "url": {
+          "description": "Required. The SharePoint URL.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "pipelines.SharepointOptionsSharepointEntityType": {
+      "enum": [
+        "FILE",
+        "FILE_METADATA",
+        "PERMISSION",
+        "LIST"
+      ],
+      "enum_launch_stages": {
+        "FILE": "PRIVATE_PREVIEW",
+        "FILE_METADATA": "PRIVATE_PREVIEW",
+        "LIST": "PRIVATE_PREVIEW",
+        "PERMISSION": "PRIVATE_PREVIEW"
+      }
+    },
+    "pipelines.SmartsheetOptions": {
+      "description": "Smartsheet specific options for ingestion",
+      "fields": {
+        "enforce_schema": {
+          "description": "(Optional) When true, maps each column to its Smartsheet-declared type (Text/Number/Date/\nCheckbox/etc.). Cells that do not conform to the declared type are set to NULL.\nWhen false, all columns land as STRING. Use false for sheets with irregular data or columns\nthat frequently violate their own declared type.\nIf not specified, defaults to true.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "pipelines.SourceCatalogConfig": {
+      "description": "SourceCatalogConfig contains catalog-level custom configuration parameters for each source",
+      "fields": {
+        "postgres": {
+          "description": "Postgres-specific catalog-level configuration parameters",
+          "ref": "pipelines.PostgresCatalogConfig",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "source_catalog": {
+          "description": "Source catalog name",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "pipelines.SourceConfig": {
+      "fields": {
+        "api_source_connector_config": {
+          "description": "Connector-specific top-level configuration for API Source connectors.",
+          "ref": "pipelines.ApiSourceConnectorConfig",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "catalog": {
+          "description": "Catalog-level source configuration parameters",
+          "ref": "pipelines.SourceCatalogConfig",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "google_ads_config": {
+          "ref": "pipelines.GoogleAdsConfig",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "pipelines.StackFrame": {
+      "fields": {
+        "declaring_class": {
+          "description": "Class from which the method call originated",
+          "launch_stage": "GA"
+        },
+        "file_name": {
+          "description": "File where the method is defined",
+          "launch_stage": "GA"
+        },
+        "line_number": {
+          "description": "Line from which the method was called",
+          "launch_stage": "GA"
+        },
+        "method_name": {
+          "description": "Name of the method which was called",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.StartUpdate": {
+      "fields": {
+        "cause": {
+          "ref": "pipelines.StartUpdateCause",
+          "launch_stage": "GA"
+        },
+        "development": {
+          "description": "Whether the update is started in the development mode.\nThis is recommended for interactive development and testing.\nReuses compute for faster iteration and disables automatic retries.\nNot recommended for production.",
+          "launch_stage": "GA"
+        },
+        "full_refresh": {
+          "description": "If true, this update will reset all tables before running.",
+          "launch_stage": "GA"
+        },
+        "full_refresh_selection": {
+          "description": "A list of tables to update with fullRefresh. If both refresh_selection and\nfull_refresh_selection are empty, this is a full graph update. Full Refresh on a table means\nthat the states of the table will be reset before the refresh.",
+          "launch_stage": "GA"
+        },
+        "parameters": {
+          "description": "Key/value map of parameters to pass to the pipeline execution",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "refresh_selection": {
+          "description": "A list of tables to update without fullRefresh. If both refresh_selection and\nfull_refresh_selection are empty, this is a full graph update. Full Refresh on a table means\nthat the states of the table will be reset before the refresh.",
+          "launch_stage": "GA"
+        },
+        "replace_where_overrides": {
+          "description": "A list of predicate overrides for replace_where flows in this update.\nOnly replace_where flows may be specified. Flows not listed use their original predicate.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "reset_checkpoint_selection": {
+          "description": "A list of flows for which this update should reset the streaming checkpoint. This selection will not clear\nthe data in the flow's target table. Flows in this list may also appear in refresh_selection and full_refresh_selection.",
+          "launch_stage": "GA"
+        },
+        "rewind_spec": {
+          "description": "The information about the requested rewind operation.\nIf specified this is a rewind mode update.",
+          "ref": "pipelines.RewindSpec",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "validate_only": {
+          "description": "If true, this update only validates the correctness of pipeline source code but does not materialize or publish any datasets.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.StartUpdateCause": {
+      "description": "What triggered this update.",
+      "enum": [
+        "API_CALL",
+        "RETRY_ON_FAILURE",
+        "SERVICE_UPGRADE",
+        "SCHEMA_CHANGE",
+        "JOB_TASK",
+        "USER_ACTION",
+        "INFRASTRUCTURE_MAINTENANCE"
+      ],
+      "enum_launch_stages": {
+        "API_CALL": "GA",
+        "INFRASTRUCTURE_MAINTENANCE": "GA",
+        "JOB_TASK": "GA",
+        "RETRY_ON_FAILURE": "GA",
+        "SCHEMA_CHANGE": "GA",
+        "SERVICE_UPGRADE": "GA",
+        "USER_ACTION": "GA"
+      }
+    },
+    "pipelines.StartUpdateResponse": {
+      "fields": {
+        "update_id": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.StopPipelineResponse": {},
+    "pipelines.StopRequest": {},
+    "pipelines.TableSpec": {
+      "fields": {
+        "connector_options": {
+          "description": "(Optional) Source Specific Connector Options",
+          "ref": "pipelines.ConnectorOptions",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "destination_catalog": {
+          "description": "Required. Destination catalog to store table.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "destination_schema": {
+          "description": "Required. Destination schema to store table.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "destination_table": {
+          "description": "Optional. Destination table name. The pipeline fails if a table with that name already exists. If not set, the source table name is used.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "source_catalog": {
+          "description": "Source catalog name. Might be optional depending on the type of source.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "source_schema": {
+          "description": "Schema name in the source database. Might be optional depending on the type of source.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "source_table": {
+          "description": "Table name in the source database. Optional: some source types (for example streaming or\nmessage-bus connectors) do not use it, so it may be absent from a pipeline's definition.\nClients that assume it is always present should handle its absence.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "table_configuration": {
+          "description": "Configuration settings to control the ingestion of tables. These settings override the table_configuration defined in the IngestionPipelineDefinition object and the SchemaSpec.",
+          "ref": "pipelines.TableSpecificConfig",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "pipelines.TableSpecificConfig": {
+      "fields": {
+        "auto_full_refresh_policy": {
+          "description": "(Optional, Mutable) Policy for auto full refresh, if enabled pipeline will automatically try\nto fix issues by doing a full refresh on the table in the retry run. auto_full_refresh_policy\nin table configuration will override the above level auto_full_refresh_policy.\nFor example,\n{\n\"auto_full_refresh_policy\": {\n\"enabled\": true,\n\"min_interval_hours\": 23,\n}\n}\nIf unspecified, auto full refresh is disabled.",
+          "ref": "pipelines.AutoFullRefreshPolicy",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "clustering_columns": {
+          "description": "List of column names to use for clustering the destination table.\nWhen specified, the destination Delta table will be clustered by these columns.\nThis can improve query performance when filtering on these columns.\nNote: clustering_columns in table specific configuration will override the pipeline definition.\nNote: we can only provide enable_auto_clustering or clustering_columns,\nadded as separate fields as we cannot have repeated field in oneof.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "enable_auto_clustering": {
+          "description": "Whether to enable auto clustering on the destination table.\nWhen enabled, Delta will automatically optimize the data layout\nbased on the clustering columns for improved query performance.\nNote: enable_auto_clustering in table specific configuration will override the pipeline definition.\nNote: we can only provide enable_auto_clustering or clustering_columns,\nadded as separate fields as we cannot have repeated field in oneof.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "exclude_columns": {
+          "description": "A list of column names to be excluded for the ingestion.\nWhen not specified, include_columns fully controls what columns to be ingested.\nWhen specified, all other columns including future ones will be automatically included for ingestion.\nThis field in mutually exclusive with `include_columns`.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "include_columns": {
+          "description": "A list of column names to be included for the ingestion.\nWhen not specified, all columns except ones in exclude_columns will be included. Future\ncolumns will be automatically included.\nWhen specified, all other future columns will be automatically excluded from ingestion.\nThis field in mutually exclusive with `exclude_columns`.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "primary_keys": {
+          "description": "The primary key of the table used to apply changes.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "query_based_connector_config": {
+          "ref": "pipelines.IngestionPipelineDefinitionTableSpecificConfigQueryBasedConnectorConfig",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "row_filter": {
+          "description": "(Optional, Immutable) The row filter condition to be applied to the table.\nIt must not contain the WHERE keyword, only the actual filter condition.\nIt must be in DBSQL format.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "salesforce_include_formula_fields": {
+          "description": "If true, formula fields defined in the table are included in the ingestion. This setting is only valid for the Salesforce connector",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "scd_type": {
+          "ref": "pipelines.TableSpecificConfigScdType",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "sequence_by": {
+          "description": "The column names specifying the logical order of events in the source data. Spark Declarative Pipelines uses this sequencing to handle change events that arrive out of order.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "source_metadata_column": {
+          "description": "(Optional) Name of the struct column added to each ingested record to hold per row source\nmetadata.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "table_properties": {
+          "description": "Table properties to set on the destination table.\nThese are key-value pairs that configure various Delta table behaviors or any user defined properties.\nExample: {\"delta.feature.variantType\": \"supported\", \"delta.enableTypeWidening\": \"true\"}\nNote: table_properties in table specific configuration will override the table_properties of the pipeline definition.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "workday_report_parameters": {
+          "description": "(Optional) Additional custom parameters for Workday Report",
+          "ref": "pipelines.IngestionPipelineDefinitionWorkdayReportParameters",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "pipelines.TableSpecificConfigScdType": {
+      "description": "The SCD type to use to ingest the table.",
+      "enum": [
+        "SCD_TYPE_1",
+        "SCD_TYPE_2",
+        "APPEND_ONLY"
+      ],
+      "enum_launch_stages": {
+        "APPEND_ONLY": "PUBLIC_PREVIEW",
+        "SCD_TYPE_1": "PUBLIC_PREVIEW",
+        "SCD_TYPE_2": "PUBLIC_PREVIEW"
+      }
+    },
+    "pipelines.TikTokAdsOptions": {
+      "description": "TikTok Ads specific options for ingestion",
+      "fields": {
+        "custom_report_options": {
+          "description": "(Optional) Custom report definition. When set, the table is treated as a\nuser-defined TikTok Ads custom report: the connector synthesizes a report\nrequest from the dimensions, metrics, report type, and data level specified\nhere. Supersedes the deprecated top-level dimensions/metrics/report_type/\ndata_level/query_lifetime fields above.",
+          "ref": "pipelines.TikTokAdsOptionsTikTokAdsCustomReportOptions",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "data_level": {
+          "description": "Deprecated. Use custom_report_options.data_level instead.",
+          "ref": "pipelines.TikTokAdsOptionsTikTokDataLevel",
+          "deprecated": true,
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "dimensions": {
+          "description": "Deprecated. Use custom_report_options.dimensions instead.",
+          "deprecated": true,
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "lookback_window_days": {
+          "description": "(Optional) Number of days to look back for report tables during incremental sync\nto capture late-arriving conversions and attribution data.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "metrics": {
+          "description": "Deprecated. Use custom_report_options.metrics instead.",
+          "deprecated": true,
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "query_lifetime": {
+          "description": "Deprecated. Use custom_report_options.query_lifetime instead.",
+          "deprecated": true,
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "report_type": {
+          "description": "Deprecated. Use custom_report_options.report_type instead.",
+          "ref": "pipelines.TikTokAdsOptionsTikTokReportType",
+          "deprecated": true,
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "sync_start_date": {
+          "description": "(Optional) Start date for the initial sync of report tables in YYYY-MM-DD format.\nThis determines the earliest date from which to sync historical data.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "pipelines.TikTokAdsOptionsTikTokAdsCustomReportOptions": {
+      "description": "User-defined custom report for the TikTok Ads connector. Groups the\ndimensions + metrics + report type + data level that define a TikTok Ads\ncustom report request.",
+      "fields": {
+        "data_level": {
+          "description": "(Optional) Data level for the report.\nIf not specified, defaults to AUCTION_CAMPAIGN.",
+          "ref": "pipelines.TikTokAdsOptionsTikTokDataLevel",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "dimensions": {
+          "description": "(Optional) Dimensions to include in the report (e.g. \"campaign_id\",\n\"adgroup_id\", \"ad_id\", \"stat_time_day\", \"stat_time_hour\").",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "metrics": {
+          "description": "(Optional) Metrics to include in the report (e.g. \"spend\", \"impressions\",\n\"clicks\", \"conversion\", \"cpc\").",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "query_lifetime": {
+          "description": "(Optional) Whether to request lifetime metrics (all-time aggregated data).\nWhen true, the report returns all-time data.\nIf not specified, defaults to false.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "report_type": {
+          "description": "(Optional) Report type for the TikTok Ads API.\nIf not specified, defaults to BASIC.",
+          "ref": "pipelines.TikTokAdsOptionsTikTokReportType",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "pipelines.TikTokAdsOptionsTikTokDataLevel": {
+      "description": "Data level for TikTok Ads report aggregation.",
+      "enum": [
+        "AUCTION_ADVERTISER",
+        "AUCTION_CAMPAIGN",
+        "AUCTION_ADGROUP",
+        "AUCTION_AD"
+      ],
+      "enum_launch_stages": {
+        "AUCTION_AD": "PUBLIC_BETA",
+        "AUCTION_ADGROUP": "PUBLIC_BETA",
+        "AUCTION_ADVERTISER": "PUBLIC_BETA",
+        "AUCTION_CAMPAIGN": "PUBLIC_BETA"
+      }
+    },
+    "pipelines.TikTokAdsOptionsTikTokReportType": {
+      "description": "Report type for TikTok Ads API.",
+      "enum": [
+        "BASIC",
+        "AUDIENCE",
+        "PLAYABLE_AD",
+        "DSA",
+        "BUSINESS_CENTER",
+        "GMV_MAX"
+      ],
+      "enum_launch_stages": {
+        "AUDIENCE": "PUBLIC_BETA",
+        "BASIC": "PUBLIC_BETA",
+        "BUSINESS_CENTER": "PUBLIC_BETA",
+        "DSA": "PUBLIC_BETA",
+        "GMV_MAX": "PUBLIC_BETA",
+        "PLAYABLE_AD": "PUBLIC_BETA"
+      }
+    },
+    "pipelines.Transformer": {
+      "description": "Specifies how to transform binary data into structured data.",
+      "fields": {
+        "avro_options": {
+          "ref": "pipelines.AvroTransformerOptions",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "format": {
+          "description": "Required: the wire format of the data.",
+          "ref": "pipelines.TransformerFormat",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "input_column": {
+          "description": "Optional input column to transform. When set, the transformer reads\nfrom this column instead of the default source column.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "json_options": {
+          "ref": "pipelines.JsonTransformerOptions",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "output_column": {
+          "description": "Optional output column name. When set, the transformed result is\nwritten to this column instead of replacing the input column.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "protobuf_options": {
+          "ref": "pipelines.ProtobufTransformerOptions",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "pipelines.TransformerFormat": {
+      "enum": [
+        "STRING",
+        "JSON",
+        "AVRO",
+        "PROTOBUF"
+      ],
+      "enum_launch_stages": {
+        "AVRO": "PUBLIC_BETA",
+        "JSON": "PUBLIC_BETA",
+        "PROTOBUF": "PUBLIC_BETA",
+        "STRING": "PUBLIC_BETA"
+      }
+    },
+    "pipelines.Truncation": {
+      "description": "Information about truncations applied to this event.",
+      "fields": {
+        "truncated_fields": {
+          "description": "List of fields that were truncated from this event. If empty or absent,\nno truncation occurred.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.TruncationTruncationDetail": {
+      "description": "Details about a specific field that was truncated.",
+      "fields": {
+        "field_name": {
+          "description": "The name of the truncated field (e.g., \"error\").\nCorresponds to field names in PipelineEvent.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.UpdateInfo": {
+      "fields": {
+        "cause": {
+          "description": "What triggered this update.",
+          "ref": "pipelines.UpdateInfoCause",
+          "launch_stage": "GA"
+        },
+        "cluster_id": {
+          "description": "The ID of the cluster that the update is running on.",
+          "launch_stage": "GA"
+        },
+        "config": {
+          "description": "The pipeline configuration with system defaults applied where unspecified by the user.\nNot returned by ListUpdates.",
+          "ref": "pipelines.PipelineSpec",
+          "launch_stage": "GA"
+        },
+        "creation_time": {
+          "description": "The time when this update was created.",
+          "launch_stage": "GA"
+        },
+        "full_refresh": {
+          "description": "If true, this update will reset all tables before running.",
+          "launch_stage": "GA"
+        },
+        "full_refresh_selection": {
+          "description": "A list of tables to update with fullRefresh. If both refresh_selection and\nfull_refresh_selection are empty, this is a full graph update. Full Refresh on a table means\nthat the states of the table will be reset before the refresh.",
+          "launch_stage": "GA"
+        },
+        "mode": {
+          "description": "Indicates whether the update is either part of a continuous job run, or running in legacy continuous pipeline mode.\nReturned only for GetUpdate; not populated in ListUpdates responses.",
+          "ref": "pipelines.UpdateMode",
+          "launch_stage": "GA"
+        },
+        "parameters": {
+          "description": "Key/value map of parameters used to initiate the update",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "pipeline_id": {
+          "description": "The ID of the pipeline.",
+          "launch_stage": "GA"
+        },
+        "refresh_selection": {
+          "description": "A list of tables to update without fullRefresh. If both refresh_selection and\nfull_refresh_selection are empty, this is a full graph update. Full Refresh on a table means\nthat the states of the table will be reset before the refresh.",
+          "launch_stage": "GA"
+        },
+        "state": {
+          "description": "The update state.",
+          "ref": "pipelines.UpdateInfoState",
+          "launch_stage": "GA"
+        },
+        "update_id": {
+          "description": "The ID of this update.",
+          "launch_stage": "GA"
+        },
+        "validate_only": {
+          "description": "If true, this update only validates the correctness of pipeline source code but does not materialize or publish any datasets.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.UpdateInfoCause": {
+      "description": "What triggered this update.",
+      "enum": [
+        "API_CALL",
+        "RETRY_ON_FAILURE",
+        "SERVICE_UPGRADE",
+        "SCHEMA_CHANGE",
+        "JOB_TASK",
+        "USER_ACTION",
+        "INFRASTRUCTURE_MAINTENANCE"
+      ],
+      "enum_launch_stages": {
+        "API_CALL": "GA",
+        "INFRASTRUCTURE_MAINTENANCE": "GA",
+        "JOB_TASK": "GA",
+        "RETRY_ON_FAILURE": "GA",
+        "SCHEMA_CHANGE": "GA",
+        "SERVICE_UPGRADE": "GA",
+        "USER_ACTION": "GA"
+      }
+    },
+    "pipelines.UpdateInfoState": {
+      "description": "The update state.",
+      "enum": [
+        "QUEUED",
+        "CREATED",
+        "WAITING_FOR_RESOURCES",
+        "INITIALIZING",
+        "RESETTING",
+        "SETTING_UP_TABLES",
+        "RUNNING",
+        "STOPPING",
+        "COMPLETED",
+        "FAILED",
+        "CANCELED"
+      ],
+      "enum_launch_stages": {
+        "CANCELED": "GA",
+        "COMPLETED": "GA",
+        "CREATED": "GA",
+        "FAILED": "GA",
+        "INITIALIZING": "GA",
+        "QUEUED": "GA",
+        "RESETTING": "GA",
+        "RUNNING": "GA",
+        "SETTING_UP_TABLES": "GA",
+        "STOPPING": "GA",
+        "WAITING_FOR_RESOURCES": "GA"
+      }
+    },
+    "pipelines.UpdateMode": {
+      "enum": [
+        "DEFAULT",
+        "CONTINUOUS"
+      ],
+      "enum_launch_stages": {
+        "CONTINUOUS": "GA",
+        "DEFAULT": "GA"
+      }
+    },
+    "pipelines.UpdateStateInfo": {
+      "fields": {
+        "creation_time": {
+          "launch_stage": "GA"
+        },
+        "state": {
+          "ref": "pipelines.UpdateStateInfoState",
+          "launch_stage": "GA"
+        },
+        "update_id": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "pipelines.UpdateStateInfoState": {
+      "description": "The update state.",
+      "enum": [
+        "QUEUED",
+        "CREATED",
+        "WAITING_FOR_RESOURCES",
+        "INITIALIZING",
+        "RESETTING",
+        "SETTING_UP_TABLES",
+        "RUNNING",
+        "STOPPING",
+        "COMPLETED",
+        "FAILED",
+        "CANCELED"
+      ],
+      "enum_launch_stages": {
+        "CANCELED": "GA",
+        "COMPLETED": "GA",
+        "CREATED": "GA",
+        "FAILED": "GA",
+        "INITIALIZING": "GA",
+        "QUEUED": "GA",
+        "RESETTING": "GA",
+        "RUNNING": "GA",
+        "SETTING_UP_TABLES": "GA",
+        "STOPPING": "GA",
+        "WAITING_FOR_RESOURCES": "GA"
+      }
+    },
+    "pipelines.ZendeskSupportOptions": {
+      "description": "Zendesk Support specific options for ingestion",
+      "fields": {
+        "start_date": {
+          "description": "(Optional) Start date in YYYY-MM-DD format for the initial sync.\nThis determines the earliest date from which to sync historical data.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "postgres.Branch": {
+      "fields": {
+        "branch_id": {
+          "description": "The part of the name, chosen by the user when the resource was created.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "create_time": {
+          "description": "A timestamp indicating when the branch was created.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "Output only. The full resource path of the branch.\nFormat: projects/{project_id}/branches/{branch_id}",
+          "launch_stage": "GA"
+        },
+        "parent": {
+          "description": "The project containing this branch (API resource hierarchy).\nFormat: projects/{project_id}\n\nNote: This field indicates where the branch exists in the resource hierarchy.\nFor point-in-time branching from another branch, see `status.source_branch`.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "spec": {
+          "description": "The spec contains the branch configuration.",
+          "ref": "postgres.BranchSpec",
+          "launch_stage": "GA",
+          "behaviors": [
+            "INPUT_ONLY",
+            "OPTIONAL"
+          ]
+        },
+        "status": {
+          "description": "The current status of a Branch.",
+          "ref": "postgres.BranchStatus",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "uid": {
+          "description": "System-generated unique ID for the branch.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "update_time": {
+          "description": "A timestamp indicating when the branch was last updated.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "postgres.BranchOperationMetadata": {},
+    "postgres.BranchSpec": {
+      "fields": {
+        "expire_time": {
+          "description": "Absolute expiration timestamp. When set, the branch will expire at this time.\nMutually exclusive with `ttl` and `no_expiry`.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "is_protected": {
+          "description": "When set to true, protects the branch from deletion and reset. Associated compute endpoints and the project cannot be deleted while the branch is protected.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "no_expiry": {
+          "description": "Explicitly disable expiration. When set to true, the branch will not expire.\nIf set to false, the request is invalid; provide either ttl or expire_time instead.\nMutually exclusive with `expire_time` and `ttl`.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "source_branch": {
+          "description": "The name of the source branch from which this branch was created (data lineage for point-in-time recovery).\nIf not specified, defaults to the project's default branch.\nFormat: projects/{project_id}/branches/{branch_id}",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE",
+            "OPTIONAL"
+          ]
+        },
+        "source_branch_lsn": {
+          "description": "The Log Sequence Number (LSN) on the source branch from which this branch was created.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE",
+            "OPTIONAL"
+          ]
+        },
+        "source_branch_time": {
+          "description": "The point in time on the source branch from which this branch was created.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE",
+            "OPTIONAL"
+          ]
+        },
+        "source_snapshot": {
+          "description": "The snapshot this branch was created from. When set, the branch's data\ncomes from the snapshot rather than a source branch, so source_branch,\nsource_branch_lsn, and source_branch_time must be empty. The snapshot must\nbe AVAILABLE and belong to this branch's project.\nFormat: projects/{project_id}/snapshots/{snapshot_id}",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "IMMUTABLE",
+            "OPTIONAL"
+          ]
+        },
+        "ttl": {
+          "description": "Relative time-to-live duration. When set, the branch will expire at creation_time + ttl.\nMutually exclusive with `expire_time` and `no_expiry`.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "postgres.BranchStatus": {
+      "fields": {
+        "branch_id": {
+          "description": "Part of the resource name.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "current_state": {
+          "description": "The branch's state, indicating if it is initializing, ready for use, or archived.",
+          "ref": "postgres.BranchStatusState",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "default": {
+          "description": "Whether the branch is the project's default branch.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "delete_time": {
+          "description": "A timestamp indicating when the branch was deleted.\nEmpty if the branch is not deleted.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "expire_time": {
+          "description": "Absolute expiration time for the branch. Empty if expiration is disabled.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "is_protected": {
+          "description": "Whether the branch is protected.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "logical_size_bytes": {
+          "description": "The logical size of the branch.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "pending_state": {
+          "description": "The pending state of the branch, if a state transition is in progress.",
+          "ref": "postgres.BranchStatusState",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "purge_time": {
+          "description": "A timestamp indicating when the branch is scheduled to be purged.\nEmpty if the branch is not deleted, otherwise set to a timestamp in the future.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "source_branch": {
+          "description": "The name of the source branch from which this branch was created.\nFormat: projects/{project_id}/branches/{branch_id}",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "source_branch_lsn": {
+          "description": "The Log Sequence Number (LSN) on the source branch from which this branch was created.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "source_branch_time": {
+          "description": "The point in time on the source branch from which this branch was created.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "source_snapshot": {
+          "description": "The snapshot this branch was restored from. Set only for branches created by\nrestoring a snapshot; unset for all other branches.\nFormat: projects/{project_id}/snapshots/{snapshot_id}",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "state_change_time": {
+          "description": "A timestamp indicating when the `current_state` began.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "postgres.BranchStatusState": {
+      "description": "The state of the branch.",
+      "enum": [
+        "INIT",
+        "IMPORTING",
+        "RESETTING",
+        "READY",
+        "ARCHIVED",
+        "DELETED"
+      ],
+      "enum_launch_stages": {
+        "ARCHIVED": "GA",
+        "DELETED": "PRIVATE_PREVIEW",
+        "IMPORTING": "GA",
+        "INIT": "GA",
+        "READY": "GA",
+        "RESETTING": "GA"
+      }
+    },
+    "postgres.Catalog": {
+      "fields": {
+        "catalog_id": {
+          "description": "The part of the name, chosen by the user when the resource was created.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "create_time": {
+          "description": "A timestamp indicating when the catalog was created.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "Output only. The full resource path of the catalog.\n\nFormat: \"catalogs/{catalog_id}\".",
+          "launch_stage": "GA"
+        },
+        "spec": {
+          "description": "The desired state of the Catalog.",
+          "ref": "postgres.CatalogCatalogSpec",
+          "launch_stage": "GA",
+          "behaviors": [
+            "INPUT_ONLY",
+            "OPTIONAL"
+          ]
+        },
+        "status": {
+          "description": "The observed state of the Catalog.",
+          "ref": "postgres.CatalogCatalogStatus",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "uid": {
+          "description": "System-generated unique identifier for the catalog.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "update_time": {
+          "description": "A timestamp indicating when the catalog was last updated.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "postgres.CatalogCatalogSpec": {
+      "description": "The desired state of the Catalog.",
+      "fields": {
+        "branch": {
+          "description": "The resource path of the branch associated with the catalog.\n\nFormat: projects/{project_id}/branches/{branch_id}.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "create_database_if_missing": {
+          "description": "If set to true, the specified postgres_database is created on behalf of the calling user\nif it does not already exist. In this case, the calling user has a role created for\nthem in Postgres if they do not already have one.\n\nDefaults to false, meaning that the request fails if the specified postgres_database does not already exist.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "postgres_database": {
+          "description": "The name of the Postgres database inside the specified Lakebase project and branch to be associated with the UC catalog.\nThis database must already exist, unless create_database_if_missing is set to true on creation.\n\nA database can only be registered with one UC catalog at a time.\nTo re-register a database with a different catalog, the existing catalog must be deleted first.\n\nA child branch inherits the fact of parent's registration. This means the same-named database\nin a child branch cannot be registered with a second catalog\nwhile the parent's registration exists. To allow registering the database of a child branch,\ndrop and recreate the database on the child branch.\nThis removes the fact of parent's registration from this branch only.\n\nDoing Point In Time Restore (PITR) prior to the moment before the Postgres DB was registered\nin the Catalog drops the fact of registration of the database. So the user should avoid doing so.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        }
+      }
+    },
+    "postgres.CatalogCatalogStatus": {
+      "description": "The observed state of the Catalog.",
+      "fields": {
+        "branch": {
+          "description": "The resource path of the branch associated with the catalog.\n\nFormat: projects/{project_id}/branches/{branch_id}.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "postgres_database": {
+          "description": "The name of the Postgres database associated with the catalog.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "project": {
+          "description": "The resource path of the project associated with the catalog.\n\nFormat: projects/{project_id}.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "postgres.CatalogOperationMetadata": {},
+    "postgres.CdfConfig": {
+      "description": "A Lakebase CDF configuration (CdfConfig): one per Postgres schema per\ndatabase, replicating that schema's tables into a Unity Catalog schema.\nImmutable once created.",
+      "fields": {
+        "catalog": {
+          "description": "The Unity Catalog catalog that replicated tables are written into.\nSet at creation; the CdfConfig is immutable.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "cdf_config_id": {
+          "description": "The user-specified id; equals the final segment of `name`. Defaults to the\nPostgres schema name for configs without an explicit id.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "create_time": {
+          "description": "When the CdfConfig was created.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "Output only. The full resource name of the CdfConfig.\nFormat: projects/{project}/branches/{branch}/databases/{database}/cdf-configs/{cdf_config}",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "postgres_schema": {
+          "description": "The Postgres schema this CdfConfig replicates from. Unique within the\nparent database. Set at creation; the CdfConfig is immutable.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "schema": {
+          "description": "The Unity Catalog schema that replicated tables are written into.\nSet at creation; the CdfConfig is immutable.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        }
+      }
+    },
+    "postgres.CdfConfigOperationMetadata": {
+      "description": "Metadata for CdfConfig long-running operations. Intentionally empty today;\nfields (e.g. progress) may be added as the operation contract grows."
+    },
+    "postgres.CdfState": {
+      "description": "The replication state of a single replicated table (CdfStatus).",
+      "enum": [
+        "CDF_STATE_SNAPSHOTTING",
+        "CDF_STATE_STREAMING",
+        "CDF_STATE_TERMINATED",
+        "CDF_STATE_SKIPPED"
+      ],
+      "enum_launch_stages": {
+        "CDF_STATE_SKIPPED": "PUBLIC_BETA",
+        "CDF_STATE_SNAPSHOTTING": "PUBLIC_BETA",
+        "CDF_STATE_STREAMING": "PUBLIC_BETA",
+        "CDF_STATE_TERMINATED": "PUBLIC_BETA"
+      }
+    },
+    "postgres.CdfStatus": {
+      "description": "The read-only replication status of a single Postgres table replicated\nunder a CdfConfig. One status exists per replicated table.\nIt is created automatically and cannot be modified.",
+      "fields": {
+        "committed_lsn": {
+          "description": "The high-watermark Log Sequence Number (LSN) committed to Delta Lake.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "create_time": {
+          "description": "When replication for this table was first established.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "last_sync_time": {
+          "description": "The last time changes for this table were written to Delta Lake.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "Output only. The full resource name of the CdfStatus.\nFormat: projects/{project}/branches/{branch}/databases/{database}/cdf-configs/{cdf_config}/cdf-statuses/{cdf_status}\nThe {cdf_status} segment is the Postgres table name.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "postgres_table": {
+          "description": "The Postgres table being replicated.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "state": {
+          "description": "The current replication state of this table.",
+          "ref": "postgres.CdfState",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "status_detail": {
+          "description": "Human-readable detail for the current state (e.g. the skip/error reason).\nEmpty for healthy states.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "uc_table": {
+          "description": "The Unity Catalog table receiving replicated data.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "postgres.CreateBranchRequest": {
+      "fields": {
+        "branch": {
+          "description": "The Branch to create.",
+          "ref": "postgres.Branch",
+          "launch_stage": "GA"
+        },
+        "branch_id": {
+          "description": "The ID to use for the Branch. This becomes the final component of the branch's resource name.\nThe ID is required and must be 1-63 characters long, start with a lowercase letter, and contain only lowercase letters, numbers, and hyphens.\nFor example, `development` becomes `projects/my-app/branches/development`.",
+          "launch_stage": "GA"
+        },
+        "replace_existing": {
+          "description": "If true, update the branch if it already exists instead of returning an error.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "INPUT_ONLY",
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "postgres.CreateCatalogRequest": {
+      "fields": {
+        "catalog": {
+          "ref": "postgres.Catalog",
+          "launch_stage": "GA"
+        },
+        "catalog_id": {
+          "description": "The ID in the Unity Catalog.\nIt becomes the full resource name, for example \"my_catalog\" becomes \"catalogs/my_catalog\".",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "postgres.CreateCdfConfigRequest": {
+      "fields": {
+        "cdf_config": {
+          "description": "The CdfConfig to create. The catalog, schema, and postgres_schema fields are\nrequired; service_principal is optional. All other fields are output only\nand ignored on input.",
+          "ref": "postgres.CdfConfig",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "cdf_config_id": {
+          "description": "The user-specified id for the CdfConfig, forming the final segment of its\nresource name. Must match the pattern `[a-z][a-z0-9_]{0,62}`. Defaults to\nthe Postgres schema name when omitted.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "postgres.CreateDataApiRequest": {
+      "fields": {
+        "data_api": {
+          "description": "The Data API configuration to create.",
+          "ref": "postgres.DataApi",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "postgres.CreateDatabaseRequest": {
+      "fields": {
+        "database": {
+          "description": "The desired specification of a Database.",
+          "ref": "postgres.Database",
+          "launch_stage": "GA"
+        },
+        "database_id": {
+          "description": "The ID to use for the Database, which will become the final component of\nthe database's resource name.\nThis ID becomes the database name in postgres.\n\nThis value should be 4-63 characters, and only use characters available in DNS names,\nas defined by RFC-1123\n\nIf database_id is not specified in the request, it is generated automatically.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "replace_existing": {
+          "description": "If true, update the database if it already exists instead of returning an\nerror.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "INPUT_ONLY",
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "postgres.CreateEndpointRequest": {
+      "fields": {
+        "endpoint": {
+          "description": "The Endpoint to create.",
+          "ref": "postgres.Endpoint",
+          "launch_stage": "GA"
+        },
+        "endpoint_id": {
+          "description": "The ID to use for the Endpoint. This becomes the final component of the endpoint's resource name.\nThe ID is required and must be 1-63 characters long, start with a lowercase letter, and contain only lowercase letters, numbers, and hyphens.\nFor example, `primary` becomes `projects/my-app/branches/development/endpoints/primary`.",
+          "launch_stage": "GA"
+        },
+        "replace_existing": {
+          "description": "If true, update the endpoint if it already exists instead of returning an error.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "INPUT_ONLY",
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "postgres.CreateProjectRequest": {
+      "fields": {
+        "project": {
+          "description": "The Project to create.",
+          "ref": "postgres.Project",
+          "launch_stage": "GA"
+        },
+        "project_id": {
+          "description": "The ID to use for the Project. This becomes the final component of the project's resource name.\nThe ID is required and must be 1-63 characters long, start with a lowercase letter, and contain only lowercase letters, numbers, and hyphens.\nFor example, `my-app` becomes `projects/my-app`.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "postgres.CreateRoleRequest": {
+      "fields": {
+        "replace_existing": {
+          "description": "If true, update the role if it already exists instead of returning an\nerror.\n\nWhen the role already exists, the provided `role` spec fully replaces the\nexisting one: `membership_roles` is overwritten, not merged. Leaving\n`membership_roles` empty clears all of the role's existing memberships,\nincluding `DATABRICKS_SUPERUSER`. Always send the complete desired list of\nmemberships when using this field.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "INPUT_ONLY",
+            "OPTIONAL"
+          ]
+        },
+        "role": {
+          "description": "The desired specification of a Role.",
+          "ref": "postgres.Role",
+          "launch_stage": "GA"
+        },
+        "role_id": {
+          "description": "The ID to use for the Role, which will become the final component of\nthe role's resource name.\nThis ID becomes the role in Postgres.\n\nThis value should be 4-63 characters, and valid characters\nare lowercase letters, numbers, and hyphens, as defined by RFC 1123.\n\nIf role_id is not specified in the request, it is generated automatically.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "postgres.CreateSnapshotRequest": {
+      "fields": {
+        "snapshot": {
+          "description": "The snapshot to create.",
+          "ref": "postgres.Snapshot",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "snapshot_id": {
+          "description": "Client-chosen ID for the snapshot. It becomes the final segment of the\nsnapshot resource name and cannot be changed after creation.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "postgres.CreateSyncedTableRequest": {
+      "fields": {
+        "synced_table": {
+          "ref": "postgres.SyncedTable",
+          "launch_stage": "GA"
+        },
+        "synced_table_id": {
+          "description": "The ID to use for the Synced Table. This becomes the final component of the SyncedTable's resource name.\nID is required and is the synced table name, containing (catalog, schema, table) tuple.\nElements of the tuple are the UC entity names.\n\nExample: \"{catalog}.{schema}.{table}\"\n\nsynced_table_id represents both of the following:\n\n1. An online VIEW virtual table in the Unity Catalog accessible via the Lakehouse Federation.\n2. Postgres table named \"{table}\" in schema \"{schema}\" in the connected Postgres database",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "postgres.DailySchedule": {
+      "description": "Take a snapshot once per day, at the configured hour.",
+      "fields": {
+        "hour": {
+          "description": "The hour of the day, in UTC, at which to take the snapshot, in [0, 23].",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "postgres.DataApi": {
+      "description": "DataApi represents the Data API (PostgREST) configuration for a Database.\nAt most one DataApi per database. Create enables Data API, Delete disables it.",
+      "fields": {
+        "create_time": {
+          "description": "A timestamp indicating when the Data API was first enabled.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "Resource name: projects/{project_id}/branches/{branch_id}/databases/{database_id}/data-api",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "parent": {
+          "description": "The database containing this Data API configuration.\nFormat: projects/{project_id}/branches/{branch_id}/databases/{database_id}",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "spec": {
+          "description": "The desired Data API configuration.",
+          "ref": "postgres.DataApiDataApiSpec",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "INPUT_ONLY",
+            "OPTIONAL"
+          ]
+        },
+        "status": {
+          "description": "The observed Data API state (read-only).",
+          "ref": "postgres.DataApiDataApiStatus",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "update_time": {
+          "description": "A timestamp indicating when the Data API configuration was last updated.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "postgres.DataApiDataApiSpec": {
+      "description": "Desired PostgREST configuration (input).",
+      "fields": {
+        "db_aggregates_enabled": {
+          "description": "Enable aggregate functions (count, sum, avg, etc.) in Data API responses.\nDefault: true.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "db_extra_search_path": {
+          "description": "Additional schemas to include in the PostgreSQL search path.\nEach entry must be a valid PostgreSQL schema name.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "db_max_rows": {
+          "description": "Maximum number of rows returned in a single Data API response.\nMust be a positive integer.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "db_schemas": {
+          "description": "Database schemas exposed through the Data API.\nEach entry must be a valid PostgreSQL schema name (1-63 chars, [a-zA-Z_][a-zA-Z0-9_$]*).\nMaximum 100 entries. Default: [\"public\"].",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "jwt_cache_max_lifetime": {
+          "description": "Maximum lifetime for cached JWT tokens. Zero duration disables caching.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "jwt_role_claim_key": {
+          "description": "JSON path to the role claim in JWT tokens (e.g., \".sub\").\nDefault: \".sub\".",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "openapi_mode": {
+          "description": "OpenAPI documentation mode for the Data API endpoint.",
+          "ref": "postgres.OpenApiMode",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "server_cors_allowed_origins": {
+          "description": "Allowed origins for CORS requests.\nEach entry should be a valid origin URL, or use \"*\" to allow all origins.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "server_timing_enabled": {
+          "description": "Enable the Server-Timing header in Data API responses.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "postgres.DataApiDataApiStatus": {
+      "description": "Observed state (output-only).",
+      "fields": {
+        "available_schemas": {
+          "description": "Schemas available in the database (for reference when configuring db_schemas).",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "db_aggregates_enabled": {
+          "description": "Actual aggregate function setting read from the database.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "db_extra_search_path": {
+          "description": "Actual extra search path schemas read from the database.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "db_max_rows": {
+          "description": "Actual max rows setting read from the database.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "db_schemas": {
+          "description": "Actual exposed schemas read from the database.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "jwt_cache_max_lifetime": {
+          "description": "Actual JWT cache max lifetime read from the database.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "jwt_role_claim_key": {
+          "description": "Actual JWT role claim key read from the database.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "openapi_mode": {
+          "description": "Actual OpenAPI mode read from the database.",
+          "ref": "postgres.OpenApiMode",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "server_cors_allowed_origins": {
+          "description": "Actual CORS allowed origins read from the database.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "server_timing_enabled": {
+          "description": "Actual Server-Timing header setting read from the database.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "url": {
+          "description": "Data API endpoint URL.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "postgres.DataApiOperationMetadata": {},
+    "postgres.Database": {
+      "description": "Database represents a Postgres database within a Branch.",
+      "fields": {
+        "create_time": {
+          "description": "A timestamp indicating when the database was created.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "database_id": {
+          "description": "The part of the name, chosen by the user when the resource was created.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "The resource name of the database.\nFormat: projects/{project_id}/branches/{branch_id}/databases/{database_id}",
+          "launch_stage": "GA"
+        },
+        "parent": {
+          "description": "The branch containing this database.\nFormat: projects/{project_id}/branches/{branch_id}",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "spec": {
+          "description": "The desired state of the Database.",
+          "ref": "postgres.DatabaseDatabaseSpec",
+          "launch_stage": "GA",
+          "behaviors": [
+            "INPUT_ONLY",
+            "OPTIONAL"
+          ]
+        },
+        "status": {
+          "description": "The observed state of the Database.",
+          "ref": "postgres.DatabaseDatabaseStatus",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "update_time": {
+          "description": "A timestamp indicating when the database was last updated.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "postgres.DatabaseCredential": {
+      "fields": {
+        "expire_time": {
+          "description": "Timestamp in UTC of when this credential expires.",
+          "launch_stage": "GA"
+        },
+        "token": {
+          "description": "The OAuth token that can be used as a password when connecting to a database.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "postgres.DatabaseDatabaseSpec": {
+      "fields": {
+        "postgres_database": {
+          "description": "The name of the Postgres database.\n\nThis expects a valid Postgres identifier as specified in the link below.\nhttps://www.postgresql.org/docs/current/sql-syntax-lexical.html#SQL-SYNTAX-IDENTIFIERS\nRequired when creating the Database.\n\nTo rename, pass a valid postgres identifier when updating the Database.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "role": {
+          "description": "The name of the role that owns the database.\nFormat: projects/{project_id}/branches/{branch_id}/roles/{role_id}\n\nTo change the owner, pass valid existing Role name when updating the Database\n\nA database always has an owner.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "postgres.DatabaseDatabaseStatus": {
+      "fields": {
+        "database_id": {
+          "description": "Part of the resource name.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "postgres_database": {
+          "description": "The name of the Postgres database.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "role": {
+          "description": "The name of the role that owns the database.\nFormat: projects/{project_id}/branches/{branch_id}/roles/{role_id}",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "postgres.DatabaseOperationMetadata": {},
+    "postgres.DatabricksServiceExceptionWithDetailsProto": {
+      "description": "Databricks Error that is returned by all Databricks APIs.",
+      "fields": {
+        "details": {
+          "launch_stage": "GA"
+        },
+        "error_code": {
+          "ref": "postgres.ErrorCode",
+          "launch_stage": "GA"
+        },
+        "message": {
+          "launch_stage": "GA"
+        },
+        "stack_trace": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "postgres.DayOfWeek": {
+      "description": "The day of the week on which a weekly snapshot is taken.",
+      "enum": [
+        "MONDAY",
+        "TUESDAY",
+        "WEDNESDAY",
+        "THURSDAY",
+        "FRIDAY",
+        "SATURDAY",
+        "SUNDAY"
+      ],
+      "enum_launch_stages": {
+        "FRIDAY": "PUBLIC_BETA",
+        "MONDAY": "PUBLIC_BETA",
+        "SATURDAY": "PUBLIC_BETA",
+        "SUNDAY": "PUBLIC_BETA",
+        "THURSDAY": "PUBLIC_BETA",
+        "TUESDAY": "PUBLIC_BETA",
+        "WEDNESDAY": "PUBLIC_BETA"
+      }
+    },
+    "postgres.DeleteBranchRequest": {
+      "fields": {
+        "purge": {
+          "description": "If true, permanently delete the branch; if false, soft delete.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "postgres.DeleteCatalogRequest": {},
+    "postgres.DeleteCdfConfigRequest": {
+      "fields": {
+        "force": {
+          "description": "When true, also drops the replicated Delta tables in Unity Catalog. When\nfalse (the default), the replicated tables are preserved at their last\nsynced state.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "postgres.DeleteDataApiRequest": {},
+    "postgres.DeleteDatabaseRequest": {},
+    "postgres.DeleteEndpointRequest": {},
+    "postgres.DeleteProjectRequest": {
+      "fields": {
+        "purge": {
+          "description": "If true, permanently deletes the project (hard delete).\nIf false or unset, performs a soft delete.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "postgres.DeleteRoleRequest": {
+      "fields": {
+        "reassign_owned_to": {
+          "description": "Reassign objects. If this is set, all objects owned by the role are\nreassigned to the role specified in this parameter.\n\nNOTE: setting this requires spinning up a compute to succeed, since it involves running\nSQL queries.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "postgres.DeleteSnapshotRequest": {},
+    "postgres.DeleteSyncedTableRequest": {},
+    "postgres.DeltaTableSyncInfo": {
+      "fields": {
+        "delta_commit_time": {
+          "description": "The timestamp when the above Delta version was committed in the source Delta table.\nNote: This is the Delta commit time, not the time the data was written to the synced table.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "delta_commit_version": {
+          "description": "The Delta Lake commit version that was last successfully synced.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "postgres.Endpoint": {
+      "fields": {
+        "create_time": {
+          "description": "A timestamp indicating when the compute endpoint was created.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "endpoint_id": {
+          "description": "The part of the name, chosen by the user when the resource was created.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "Output only. The full resource path of the endpoint.\nFormat: projects/{project_id}/branches/{branch_id}/endpoints/{endpoint_id}",
+          "launch_stage": "GA"
+        },
+        "parent": {
+          "description": "The branch containing this endpoint (API resource hierarchy).\nFormat: projects/{project_id}/branches/{branch_id}",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "spec": {
+          "description": "The spec contains the compute endpoint configuration, including autoscaling limits, suspend timeout, and disabled state.",
+          "ref": "postgres.EndpointSpec",
+          "launch_stage": "GA",
+          "behaviors": [
+            "INPUT_ONLY",
+            "OPTIONAL"
+          ]
+        },
+        "status": {
+          "description": "Current operational status of the compute endpoint.",
+          "ref": "postgres.EndpointStatus",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "uid": {
+          "description": "System-generated unique ID for the endpoint.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "update_time": {
+          "description": "A timestamp indicating when the compute endpoint was last updated.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "postgres.EndpointGroupSpec": {
+      "fields": {
+        "enable_readable_secondaries": {
+          "description": "Whether to allow read-only connections to read-write endpoints. Only relevant for read-write endpoints where\nsize.max \u003e 1.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "max": {
+          "description": "The maximum number of computes in the endpoint group. Currently, this must be equal to min. Set to 1 for single\ncompute endpoints, to disable HA. To manually suspend all computes in an endpoint group, set disabled to\ntrue on the EndpointSpec.",
+          "launch_stage": "GA"
+        },
+        "min": {
+          "description": "The minimum number of computes in the endpoint group. Currently, this must be equal to max. This must be greater\nthan or equal to 1.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "postgres.EndpointGroupStatus": {
+      "fields": {
+        "enable_readable_secondaries": {
+          "description": "Whether read-only connections to read-write endpoints are allowed. Only relevant if read replicas are configured\nby specifying size.max \u003e 1.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "max": {
+          "description": "The maximum number of computes in the endpoint group. Currently, this must be equal to min. Set to 1 for single\ncompute endpoints, to disable HA. To manually suspend all computes in an endpoint group, set disabled to\ntrue on the EndpointSpec.",
+          "launch_stage": "GA"
+        },
+        "min": {
+          "description": "The minimum number of computes in the endpoint group. Currently, this must be equal to max. This must be greater\nthan or equal to 1.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "postgres.EndpointHosts": {
+      "description": "Encapsulates various hostnames (r/w or r/o, pooled or not) for an endpoint.",
+      "fields": {
+        "host": {
+          "description": "The hostname to connect to this endpoint. For read-write endpoints, this is a read-write hostname which connects\nto the primary compute. For read-only endpoints, this is a read-only hostname which allows read-only operations.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "read_only_host": {
+          "description": "An optionally defined read-only host for the endpoint, without pooling. For read-only endpoints,\nthis attribute is always defined and is equivalent to host. For read-write endpoints, this attribute is defined\nif the enclosing endpoint is a group with greater than 1 computes configured, and has readable secondaries enabled.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "read_only_pooled_host": {
+          "description": "The read-only hostname of the compute endpoint, with pooling. This attribute is always defined for read-only endpoints,\nand may be defined for read-write endpoints if configured with read replicas and allow read-only connections.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "read_write_pooled_host": {
+          "description": "The read-write hostname of the compute endpoint, with pooling. This attribute is only defined for read-write endpoints.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "postgres.EndpointOperationMetadata": {},
+    "postgres.EndpointSettings": {
+      "description": "A collection of settings for a compute endpoint.",
+      "fields": {
+        "pg_settings": {
+          "description": "A raw representation of Postgres settings.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "postgres.EndpointSpec": {
+      "fields": {
+        "autoscaling_limit_max_cu": {
+          "description": "The maximum number of Compute Units. The maximum value is 64.\nThe difference between the minimum and maximum Compute Units (max - min) must not exceed 16.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "autoscaling_limit_min_cu": {
+          "description": "The minimum number of Compute Units. Minimum value is 0.5.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "disabled": {
+          "description": "Whether to restrict connections to the compute endpoint.\nEnabling this option schedules a suspend compute operation.\nA disabled compute endpoint cannot be enabled by a connection or\nconsole action.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "endpoint_type": {
+          "description": "The endpoint type. A branch can only have one READ_WRITE endpoint.",
+          "ref": "postgres.EndpointType",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "group": {
+          "description": "Settings for optional HA configuration of the endpoint. If unspecified, the endpoint defaults\nto non HA settings, with a single compute backing the endpoint (and no readable secondaries\nfor Read/Write endpoints).",
+          "ref": "postgres.EndpointGroupSpec",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "no_suspension": {
+          "description": "When set to true, explicitly disables automatic suspension (never suspend).\nShould be set to true when provided.\nMutually exclusive with `suspend_timeout_duration`.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "settings": {
+          "ref": "postgres.EndpointSettings",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "suspend_timeout_duration": {
+          "description": "Duration of inactivity after which the compute endpoint is automatically suspended.\nIf specified should be between 60s and 604800s (1 minute to 1 week).\nMutually exclusive with `no_suspension`.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "postgres.EndpointStatus": {
+      "fields": {
+        "autoscaling_limit_max_cu": {
+          "description": "The maximum number of Compute Units. The maximum value is 64.\nThe difference between the minimum and maximum Compute Units (max - min) must not exceed 16.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "autoscaling_limit_min_cu": {
+          "description": "The minimum number of Compute Units.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "current_state": {
+          "ref": "postgres.EndpointStatusState",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "disabled": {
+          "description": "Whether to restrict connections to the compute endpoint.\nEnabling this option schedules a suspend compute operation.\nA disabled compute endpoint cannot be enabled by a connection or\nconsole action.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "endpoint_id": {
+          "description": "Part of the resource name.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "endpoint_type": {
+          "description": "The endpoint type. A branch can only have one READ_WRITE endpoint.",
+          "ref": "postgres.EndpointType",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "group": {
+          "description": "Details on the HA configuration of the endpoint.",
+          "ref": "postgres.EndpointGroupStatus",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "hosts": {
+          "description": "Contains host information for connecting to the endpoint.",
+          "ref": "postgres.EndpointHosts",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "last_active_time": {
+          "description": "A timestamp indicating when the compute endpoint was last active.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "pending_state": {
+          "ref": "postgres.EndpointStatusState",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "settings": {
+          "ref": "postgres.EndpointSettings",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "suspend_timeout_duration": {
+          "description": "Duration of inactivity after which the compute endpoint is automatically suspended.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "postgres.EndpointStatusState": {
+      "description": "The state of the compute endpoint.",
+      "enum": [
+        "INIT",
+        "ACTIVE",
+        "IDLE",
+        "DEGRADED"
+      ],
+      "enum_launch_stages": {
+        "ACTIVE": "GA",
+        "DEGRADED": "GA",
+        "IDLE": "GA",
+        "INIT": "GA"
+      }
+    },
+    "postgres.EndpointType": {
+      "description": "The compute endpoint type. Either `read_write` or `read_only`.",
+      "enum": [
+        "ENDPOINT_TYPE_READ_WRITE",
+        "ENDPOINT_TYPE_READ_ONLY"
+      ],
+      "enum_launch_stages": {
+        "ENDPOINT_TYPE_READ_ONLY": "GA",
+        "ENDPOINT_TYPE_READ_WRITE": "GA"
+      }
+    },
+    "postgres.ErrorCode": {
+      "description": "Error codes returned by Databricks APIs to indicate specific failure conditions.",
+      "enum": [
+        "UNKNOWN",
+        "INTERNAL_ERROR",
+        "TEMPORARILY_UNAVAILABLE",
+        "IO_ERROR",
+        "BAD_REQUEST",
+        "SERVICE_UNDER_MAINTENANCE",
+        "WORKSPACE_TEMPORARILY_UNAVAILABLE",
+        "DEADLINE_EXCEEDED",
+        "CANCELLED",
+        "RESOURCE_EXHAUSTED",
+        "ABORTED",
+        "NOT_FOUND",
+        "ALREADY_EXISTS",
+        "UNAUTHENTICATED",
+        "UNAVAILABLE",
+        "INVALID_PARAMETER_VALUE",
+        "ENDPOINT_NOT_FOUND",
+        "MALFORMED_REQUEST",
+        "INVALID_STATE",
+        "PERMISSION_DENIED",
+        "FEATURE_DISABLED",
+        "CUSTOMER_UNAUTHORIZED",
+        "REQUEST_LIMIT_EXCEEDED",
+        "RESOURCE_CONFLICT",
+        "UNPARSEABLE_HTTP_ERROR",
+        "NOT_IMPLEMENTED",
+        "DATA_LOSS",
+        "INVALID_STATE_TRANSITION",
+        "COULD_NOT_ACQUIRE_LOCK",
+        "RESOURCE_ALREADY_EXISTS",
+        "RESOURCE_DOES_NOT_EXIST",
+        "QUOTA_EXCEEDED",
+        "MAX_BLOCK_SIZE_EXCEEDED",
+        "MAX_READ_SIZE_EXCEEDED",
+        "PARTIAL_DELETE",
+        "MAX_LIST_SIZE_EXCEEDED",
+        "DRY_RUN_FAILED",
+        "RESOURCE_LIMIT_EXCEEDED",
+        "DIRECTORY_NOT_EMPTY",
+        "DIRECTORY_PROTECTED",
+        "MAX_NOTEBOOK_SIZE_EXCEEDED",
+        "MAX_CHILD_NODE_SIZE_EXCEEDED",
+        "SEARCH_QUERY_TOO_LONG",
+        "SEARCH_QUERY_TOO_SHORT",
+        "MANAGED_RESOURCE_GROUP_DOES_NOT_EXIST",
+        "PERMISSION_NOT_PROPAGATED",
+        "DEPLOYMENT_TIMEOUT",
+        "GIT_CONFLICT",
+        "GIT_UNKNOWN_REF",
+        "GIT_SENSITIVE_TOKEN_DETECTED",
+        "GIT_URL_NOT_ON_ALLOW_LIST",
+        "GIT_REMOTE_ERROR",
+        "PROJECTS_OPERATION_TIMEOUT",
+        "IPYNB_FILE_IN_REPO",
+        "INSECURE_PARTNER_RESPONSE",
+        "MALFORMED_PARTNER_RESPONSE",
+        "METASTORE_DOES_NOT_EXIST",
+        "DAC_DOES_NOT_EXIST",
+        "CATALOG_DOES_NOT_EXIST",
+        "SCHEMA_DOES_NOT_EXIST",
+        "TABLE_DOES_NOT_EXIST",
+        "SHARE_DOES_NOT_EXIST",
+        "RECIPIENT_DOES_NOT_EXIST",
+        "STORAGE_CREDENTIAL_DOES_NOT_EXIST",
+        "EXTERNAL_LOCATION_DOES_NOT_EXIST",
+        "PRINCIPAL_DOES_NOT_EXIST",
+        "PROVIDER_DOES_NOT_EXIST",
+        "METASTORE_ALREADY_EXISTS",
+        "DAC_ALREADY_EXISTS",
+        "CATALOG_ALREADY_EXISTS",
+        "SCHEMA_ALREADY_EXISTS",
+        "TABLE_ALREADY_EXISTS",
+        "SHARE_ALREADY_EXISTS",
+        "RECIPIENT_ALREADY_EXISTS",
+        "STORAGE_CREDENTIAL_ALREADY_EXISTS",
+        "EXTERNAL_LOCATION_ALREADY_EXISTS",
+        "PROVIDER_ALREADY_EXISTS",
+        "CATALOG_NOT_EMPTY",
+        "SCHEMA_NOT_EMPTY",
+        "METASTORE_NOT_EMPTY",
+        "PROVIDER_SHARE_NOT_ACCESSIBLE"
+      ],
+      "enum_launch_stages": {
+        "ABORTED": "GA",
+        "ALREADY_EXISTS": "GA",
+        "BAD_REQUEST": "GA",
+        "CANCELLED": "GA",
+        "CATALOG_ALREADY_EXISTS": "GA",
+        "CATALOG_DOES_NOT_EXIST": "GA",
+        "CATALOG_NOT_EMPTY": "GA",
+        "COULD_NOT_ACQUIRE_LOCK": "GA",
+        "CUSTOMER_UNAUTHORIZED": "GA",
+        "DAC_ALREADY_EXISTS": "GA",
+        "DAC_DOES_NOT_EXIST": "GA",
+        "DATA_LOSS": "GA",
+        "DEADLINE_EXCEEDED": "GA",
+        "DEPLOYMENT_TIMEOUT": "GA",
+        "DIRECTORY_NOT_EMPTY": "GA",
+        "DIRECTORY_PROTECTED": "GA",
+        "DRY_RUN_FAILED": "GA",
+        "ENDPOINT_NOT_FOUND": "GA",
+        "EXTERNAL_LOCATION_ALREADY_EXISTS": "GA",
+        "EXTERNAL_LOCATION_DOES_NOT_EXIST": "GA",
+        "FEATURE_DISABLED": "GA",
+        "GIT_CONFLICT": "GA",
+        "GIT_REMOTE_ERROR": "GA",
+        "GIT_SENSITIVE_TOKEN_DETECTED": "GA",
+        "GIT_UNKNOWN_REF": "GA",
+        "GIT_URL_NOT_ON_ALLOW_LIST": "GA",
+        "INSECURE_PARTNER_RESPONSE": "GA",
+        "INTERNAL_ERROR": "GA",
+        "INVALID_PARAMETER_VALUE": "GA",
+        "INVALID_STATE": "GA",
+        "INVALID_STATE_TRANSITION": "GA",
+        "IO_ERROR": "GA",
+        "IPYNB_FILE_IN_REPO": "GA",
+        "MALFORMED_PARTNER_RESPONSE": "GA",
+        "MALFORMED_REQUEST": "GA",
+        "MANAGED_RESOURCE_GROUP_DOES_NOT_EXIST": "GA",
+        "MAX_BLOCK_SIZE_EXCEEDED": "GA",
+        "MAX_CHILD_NODE_SIZE_EXCEEDED": "GA",
+        "MAX_LIST_SIZE_EXCEEDED": "GA",
+        "MAX_NOTEBOOK_SIZE_EXCEEDED": "GA",
+        "MAX_READ_SIZE_EXCEEDED": "GA",
+        "METASTORE_ALREADY_EXISTS": "GA",
+        "METASTORE_DOES_NOT_EXIST": "GA",
+        "METASTORE_NOT_EMPTY": "GA",
+        "NOT_FOUND": "GA",
+        "NOT_IMPLEMENTED": "GA",
+        "PARTIAL_DELETE": "GA",
+        "PERMISSION_DENIED": "GA",
+        "PERMISSION_NOT_PROPAGATED": "GA",
+        "PRINCIPAL_DOES_NOT_EXIST": "GA",
+        "PROJECTS_OPERATION_TIMEOUT": "GA",
+        "PROVIDER_ALREADY_EXISTS": "GA",
+        "PROVIDER_DOES_NOT_EXIST": "GA",
+        "PROVIDER_SHARE_NOT_ACCESSIBLE": "GA",
+        "QUOTA_EXCEEDED": "GA",
+        "RECIPIENT_ALREADY_EXISTS": "GA",
+        "RECIPIENT_DOES_NOT_EXIST": "GA",
+        "REQUEST_LIMIT_EXCEEDED": "GA",
+        "RESOURCE_ALREADY_EXISTS": "GA",
+        "RESOURCE_CONFLICT": "GA",
+        "RESOURCE_DOES_NOT_EXIST": "GA",
+        "RESOURCE_EXHAUSTED": "GA",
+        "RESOURCE_LIMIT_EXCEEDED": "GA",
+        "SCHEMA_ALREADY_EXISTS": "GA",
+        "SCHEMA_DOES_NOT_EXIST": "GA",
+        "SCHEMA_NOT_EMPTY": "GA",
+        "SEARCH_QUERY_TOO_LONG": "GA",
+        "SEARCH_QUERY_TOO_SHORT": "GA",
+        "SERVICE_UNDER_MAINTENANCE": "GA",
+        "SHARE_ALREADY_EXISTS": "GA",
+        "SHARE_DOES_NOT_EXIST": "GA",
+        "STORAGE_CREDENTIAL_ALREADY_EXISTS": "GA",
+        "STORAGE_CREDENTIAL_DOES_NOT_EXIST": "GA",
+        "TABLE_ALREADY_EXISTS": "GA",
+        "TABLE_DOES_NOT_EXIST": "GA",
+        "TEMPORARILY_UNAVAILABLE": "GA",
+        "UNAUTHENTICATED": "GA",
+        "UNAVAILABLE": "GA",
+        "UNKNOWN": "GA",
+        "UNPARSEABLE_HTTP_ERROR": "GA",
+        "WORKSPACE_TEMPORARILY_UNAVAILABLE": "GA"
+      }
+    },
+    "postgres.GenerateDatabaseCredentialRequest": {
+      "fields": {
+        "claims": {
+          "description": "The returned token will be scoped to UC tables with the specified permissions.",
+          "launch_stage": "GA"
+        },
+        "endpoint": {
+          "description": "The endpoint resource name for which this credential will be generated.\nFormat: projects/{project_id}/branches/{branch_id}/endpoints/{endpoint_id}",
+          "launch_stage": "GA"
+        },
+        "expire_time": {
+          "description": "Timestamp in UTC of when this credential should expire.\nMust be at least 300 seconds (5 minutes) and at most 1 hour from the current time.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "ttl": {
+          "description": "The requested time-to-live for the generated credential token.\nMust be at least 300 seconds (5 minutes) and at most 3600 seconds (1 hour).",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "postgres.GetBranchRequest": {},
+    "postgres.GetCatalogRequest": {},
+    "postgres.GetCdfConfigRequest": {},
+    "postgres.GetCdfStatusRequest": {},
+    "postgres.GetDataApiRequest": {},
+    "postgres.GetDatabaseRequest": {},
+    "postgres.GetEndpointRequest": {},
+    "postgres.GetOperationRequest": {},
+    "postgres.GetProjectRequest": {},
+    "postgres.GetRoleRequest": {},
+    "postgres.GetSnapshotRequest": {},
+    "postgres.GetSnapshotScheduleRequest": {},
+    "postgres.GetSyncedTableRequest": {},
+    "postgres.InitialBranchSpec": {
+      "description": "Configuration for the initial default branch created during project creation.",
+      "fields": {
+        "is_protected": {
+          "description": "Whether the initial default branch should be protected from deletion.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "postgres.InitialEndpointSpec": {
+      "description": "Configuration for the initial Read/Write endpoint created during project creation.",
+      "fields": {
+        "autoscaling_limit_max_cu": {
+          "description": "The maximum number of Compute Units for the initial endpoint.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "autoscaling_limit_min_cu": {
+          "description": "The minimum number of Compute Units for the initial endpoint.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "group": {
+          "description": "Settings for HA configuration of the endpoint.",
+          "ref": "postgres.EndpointGroupSpec",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "no_suspension": {
+          "description": "When set to true, explicitly disables automatic suspension (never suspend).\nShould be set to true when provided.\nMutually exclusive with `suspend_timeout_duration`.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "suspend_timeout_duration": {
+          "description": "Duration of inactivity after which the initial endpoint is automatically suspended.\nIf specified, should be between 60s and 604800s (1 minute to 1 week).\nMutually exclusive with `no_suspension`.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "postgres.ListBranchesRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Upper bound for items returned. Cannot be negative.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Page token from a previous response. If not provided, returns the first page.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "show_deleted": {
+          "description": "Whether to include soft-deleted branches in the response.\nWhen true, deleted branches are included alongside active branches.\nPurged branches are never returned.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "postgres.ListBranchesResponse": {
+      "fields": {
+        "branches": {
+          "description": "List of branches in the project.",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "Token to request the next page of branches.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "postgres.ListCdfConfigsRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Maximum number of CdfConfigs to return.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Pagination token returned by a previous ListCdfConfigs call. Empty on the\nfirst page.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "postgres.ListCdfConfigsResponse": {
+      "description": "Response to a ListCdfConfigs request, containing a page of CdfConfigs and a\ntoken for fetching the next page.",
+      "fields": {
+        "cdf_configs": {
+          "description": "The CdfConfigs under the parent database.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "next_page_token": {
+          "description": "Token to retrieve the next page of results; empty when there are no more.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "postgres.ListCdfStatusesRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Maximum number of CdfStatuses to return.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Pagination token returned by a previous ListCdfStatuses call. Empty on the\nfirst page.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "postgres.ListCdfStatusesResponse": {
+      "description": "Response to a ListCdfStatuses request, containing a page of replicated table\nstatuses and a token for fetching the next page.",
+      "fields": {
+        "cdf_statuses": {
+          "description": "The replicated tables under the parent CdfConfig.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "next_page_token": {
+          "description": "Token to retrieve the next page of results; empty when there are no more.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "postgres.ListDatabasesRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Upper bound for items returned.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Pagination token to go to the next page of Databases. Requests first page if absent.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "postgres.ListDatabasesResponse": {
+      "fields": {
+        "databases": {
+          "description": "List of databases.",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "Pagination token to request the next page of databases.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "postgres.ListEndpointsRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Upper bound for items returned. Cannot be negative.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Page token from a previous response. If not provided, returns the first page.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "postgres.ListEndpointsResponse": {
+      "fields": {
+        "endpoints": {
+          "description": "List of compute endpoints in the branch.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "next_page_token": {
+          "description": "Token to request the next page of compute endpoints.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "postgres.ListProjectsRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Upper bound for items returned. Cannot be negative. The maximum value is 100.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Page token from a previous response. If not provided, returns the first page.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "show_deleted": {
+          "description": "Whether to include soft-deleted projects in the response.\nWhen true, soft-deleted projects are included alongside active projects.\nHard-deleted and already-purged projects are never returned.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "postgres.ListProjectsResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "Token to request the next page of projects.",
+          "launch_stage": "GA"
+        },
+        "projects": {
+          "description": "List of all projects in the workspace that the user has permission to access.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "postgres.ListRolesRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Upper bound for items returned. Cannot be negative.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Page token from a previous response. If not provided, returns the first page.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "postgres.ListRolesResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "Token to request the next page of Postgres roles.",
+          "launch_stage": "GA"
+        },
+        "roles": {
+          "description": "List of Postgres roles in the branch.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "postgres.ListSnapshotsRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Maximum number of snapshots to return per page.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Page token from a previous response; omit for the first page.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "postgres.ListSnapshotsResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "Token to retrieve the next page; empty if there are no more pages.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "snapshots": {
+          "description": "The snapshots in the project.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "postgres.MonthlySchedule": {
+      "description": "Take a snapshot once per month, on the configured day at the configured hour.",
+      "fields": {
+        "day": {
+          "description": "The day of the month on which to take the snapshot, in [1, 31]. In shorter\nmonths the snapshot is taken on the last day instead (day 31 runs on Feb 28\nor 29, and on Apr 30), so every month gets exactly one snapshot.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "hour": {
+          "description": "The hour of the day, in UTC, at which to take the snapshot, in [0, 23].",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "postgres.NewPipelineSpec": {
+      "fields": {
+        "budget_policy_id": {
+          "description": "Budget policy to set on the newly created pipeline.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "pipeline_channel": {
+          "description": "Release channel of the underlying pipeline's runtime.\nSome source table configurations (e.g., read-time CDF) require PREVIEW.\nDefaults to CURRENT if not specified.",
+          "ref": "postgres.NewPipelineSpecPipelineChannel",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "storage_catalog": {
+          "description": "UC catalog for the pipeline to store intermediate files (checkpoints, event logs etc).\nThis needs to be a standard catalog where the user has permissions to create Delta tables.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "storage_schema": {
+          "description": "UC schema for the pipeline to store intermediate files (checkpoints, event logs etc).\nThis needs to be in the standard catalog where the user has permissions to create Delta tables.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "postgres.NewPipelineSpecPipelineChannel": {
+      "description": "Release channel of the underlying pipeline's runtime.\nPREVIEW provides early access to the latest features but may be less stable.\nSome source table configurations (e.g., read-time CDF) require PREVIEW.\nDefaults to CURRENT if not specified.",
+      "enum": [
+        "CURRENT",
+        "PREVIEW"
+      ],
+      "enum_launch_stages": {
+        "CURRENT": "PRIVATE_PREVIEW",
+        "PREVIEW": "PRIVATE_PREVIEW"
+      }
+    },
+    "postgres.OpenApiMode": {
+      "description": "Controls how the Data API exposes the OpenAPI documentation endpoint.\nOnly IGNORE_PRIVILEGES and DISABLED are supported today; \"follow-privileges\"\nis not implemented yet (it may be added later as value 3 — adding new enum\nvalues is backward-compatible).",
+      "enum": [
+        "OPEN_API_MODE_IGNORE_PRIVILEGES",
+        "OPEN_API_MODE_DISABLED"
+      ],
+      "enum_launch_stages": {
+        "OPEN_API_MODE_DISABLED": "PRIVATE_PREVIEW",
+        "OPEN_API_MODE_IGNORE_PRIVILEGES": "PRIVATE_PREVIEW"
+      }
+    },
+    "postgres.Operation": {
+      "description": "This resource represents a long-running operation that is the result of a\nnetwork API call.",
+      "fields": {
+        "done": {
+          "description": "If the value is `false`, it means the operation is still in progress.\nIf `true`, the operation is completed, and either `error` or `response` is\navailable.",
+          "launch_stage": "GA"
+        },
+        "error": {
+          "description": "The error result of the operation in case of failure or cancellation.",
+          "ref": "postgres.DatabricksServiceExceptionWithDetailsProto",
+          "launch_stage": "GA"
+        },
+        "metadata": {
+          "description": "Service-specific metadata associated with the operation.  It typically\ncontains progress information and common metadata such as create time.\nSome services might not provide such metadata.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The server-assigned name, which is only unique within the same service that\noriginally returns it. If you use the default HTTP mapping, the\n`name` should be a resource name ending with `operations/{unique_id}`.",
+          "launch_stage": "GA"
+        },
+        "response": {
+          "description": "The normal, successful response of the operation.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "postgres.Project": {
+      "fields": {
+        "create_time": {
+          "description": "A timestamp indicating when the project was created.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "delete_time": {
+          "description": "A timestamp indicating when the project was soft-deleted.\nEmpty if the project is not deleted, otherwise set to a timestamp in the past.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "initial_branch_spec": {
+          "description": "Configuration for the initial default branch created as part of project creation.\nAllows overriding branch protection. These settings only apply at creation time\nand do not affect resources created after project creation.",
+          "ref": "postgres.InitialBranchSpec",
+          "launch_stage": "GA",
+          "behaviors": [
+            "INPUT_ONLY",
+            "OPTIONAL"
+          ]
+        },
+        "initial_endpoint_spec": {
+          "description": "Configuration settings for the initial Read/Write endpoint created inside the initial branch for a newly\ncreated project. If omitted, the initial endpoint created will have default settings, without high availability\nconfigured. This field does not apply to any endpoints created after project creation. Use\nspec.default_endpoint_settings to configure default settings for endpoints created after project creation.",
+          "ref": "postgres.InitialEndpointSpec",
+          "launch_stage": "GA",
+          "behaviors": [
+            "INPUT_ONLY",
+            "OPTIONAL"
+          ]
+        },
+        "name": {
+          "description": "Output only. The full resource path of the project.\nFormat: projects/{project_id}",
+          "launch_stage": "GA"
+        },
+        "project_id": {
+          "description": "The part of the name, chosen by the user when the resource was created.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "purge_time": {
+          "description": "A timestamp indicating when the project is scheduled for permanent deletion.\nEmpty if the project is not deleted, otherwise set to a timestamp in the future.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "spec": {
+          "description": "The spec contains the project configuration, including display_name, pg_version (Postgres version), history_retention_duration, and default_endpoint_settings.",
+          "ref": "postgres.ProjectSpec",
+          "launch_stage": "GA",
+          "behaviors": [
+            "INPUT_ONLY",
+            "OPTIONAL"
+          ]
+        },
+        "status": {
+          "description": "The current status of a Project.",
+          "ref": "postgres.ProjectStatus",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "uid": {
+          "description": "System-generated unique ID for the project.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "update_time": {
+          "description": "A timestamp indicating when the project was last updated.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "postgres.ProjectCustomTag": {
+      "fields": {
+        "key": {
+          "description": "The key of the custom tag.",
+          "launch_stage": "GA"
+        },
+        "value": {
+          "description": "The value of the custom tag.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "postgres.ProjectDefaultEndpointSettings": {
+      "description": "A collection of settings for a compute endpoint.",
+      "fields": {
+        "autoscaling_limit_max_cu": {
+          "description": "The maximum number of Compute Units. Minimum value is 0.5.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "autoscaling_limit_min_cu": {
+          "description": "The minimum number of Compute Units. Minimum value is 0.5.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "no_suspension": {
+          "description": "When set to true, explicitly disables automatic suspension (never suspend).\nShould be set to true when provided.\nMutually exclusive with `suspend_timeout_duration`.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "pg_settings": {
+          "description": "A raw representation of Postgres settings.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "suspend_timeout_duration": {
+          "description": "Duration of inactivity after which the compute endpoint is automatically suspended.\nIf specified should be between 60s and 604800s (1 minute to 1 week).\nMutually exclusive with `no_suspension`.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "postgres.ProjectOperationMetadata": {},
+    "postgres.ProjectSpec": {
+      "fields": {
+        "budget_policy_id": {
+          "description": "The desired budget policy to associate with the project.\nSee status.budget_policy_id for the policy that is actually applied to the project.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "custom_tags": {
+          "description": "Custom tags to associate with the project. Forwarded to LBM for billing and cost tracking.\nTo update tags, provide the new tag list and include \"spec.custom_tags\" in the update_mask.\nTo clear all tags, provide an empty list and include \"spec.custom_tags\" in the update_mask.\nTo preserve existing tags, omit this field from the update_mask (or use wildcard \"*\" which auto-excludes empty tags).",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "default_branch": {
+          "description": "The full resource path for the default branch of the project\nFormat: projects/{project_id}/branches/{branch_id}",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "default_endpoint_settings": {
+          "ref": "postgres.ProjectDefaultEndpointSettings",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "display_name": {
+          "description": "Human-readable project name. Length should be between 1 and 256 characters.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "enable_pg_native_login": {
+          "description": "Whether to enable PG native password login on all endpoints in this project. Defaults to false.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "history_retention_duration": {
+          "description": "The number of seconds to retain the shared history for point in time recovery for all branches in this project. Value should be between 172800s (2 days) and 3024000s (35 days).",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "pg_version": {
+          "description": "The major Postgres version number. The set of supported versions may vary; consult the API documentation for currently accepted values.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE",
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "postgres.ProjectStatus": {
+      "fields": {
+        "branch_logical_size_limit_bytes": {
+          "description": "The logical size limit for a branch.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "budget_policy_id": {
+          "description": "The budget policy that is applied to the project.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "compute_last_active_time": {
+          "description": "The most recent time when any endpoint of this project was active.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "custom_tags": {
+          "description": "The effective custom tags associated with the project.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "default_branch": {
+          "description": "The full resource path of the default branch of the project",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "default_endpoint_settings": {
+          "description": "The effective default endpoint settings.",
+          "ref": "postgres.ProjectDefaultEndpointSettings",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "display_name": {
+          "description": "The effective human-readable project name.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "enable_pg_native_login": {
+          "description": "Whether to enable PG native password login on all endpoints in this project.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "history_retention_duration": {
+          "description": "The effective number of seconds to retain the shared history for point in time recovery.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "owner": {
+          "description": "The email of the project owner.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "pg_version": {
+          "description": "The effective major Postgres version number.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "project_id": {
+          "description": "Part of the resource name.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "synthetic_storage_size_bytes": {
+          "description": "The current space occupied by the project in storage.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "postgres.ProvisioningInfoState": {
+      "enum": [
+        "PROVISIONING",
+        "ACTIVE",
+        "FAILED",
+        "DELETING",
+        "UPDATING",
+        "DEGRADED"
+      ],
+      "enum_launch_stages": {
+        "ACTIVE": "GA",
+        "DEGRADED": "GA",
+        "DELETING": "GA",
+        "FAILED": "GA",
+        "PROVISIONING": "GA",
+        "UPDATING": "GA"
+      }
+    },
+    "postgres.ProvisioningPhase": {
+      "description": "The current phase of the data synchronization pipeline.",
+      "enum": [
+        "PROVISIONING_PHASE_MAIN",
+        "PROVISIONING_PHASE_INDEX_SCAN",
+        "PROVISIONING_PHASE_INDEX_SORT"
+      ],
+      "enum_launch_stages": {
+        "PROVISIONING_PHASE_INDEX_SCAN": "GA",
+        "PROVISIONING_PHASE_INDEX_SORT": "GA",
+        "PROVISIONING_PHASE_MAIN": "GA"
+      }
+    },
+    "postgres.RequestedClaims": {
+      "fields": {
+        "permission_set": {
+          "ref": "postgres.RequestedClaimsPermissionSet",
+          "launch_stage": "GA"
+        },
+        "resources": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "postgres.RequestedClaimsPermissionSet": {
+      "enum": [
+        "READ_ONLY"
+      ],
+      "enum_launch_stages": {
+        "READ_ONLY": "GA"
+      }
+    },
+    "postgres.RequestedResource": {
+      "fields": {
+        "table_name": {
+          "description": "The full Unity Catalog table name.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "postgres.RevealRolePasswordRequest": {
+      "description": "Request to reveal the current password for a password-authenticated Postgres role."
+    },
+    "postgres.RevealRolePasswordResponse": {
+      "description": "Response containing the password for a password-authenticated Postgres role.",
+      "fields": {
+        "password": {
+          "description": "The current password for the Postgres role.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "postgres.Role": {
+      "description": "Role represents a Postgres role within a Branch.",
+      "fields": {
+        "create_time": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "Output only. The full resource path of the role.\nFormat: projects/{project_id}/branches/{branch_id}/roles/{role_id}",
+          "launch_stage": "GA"
+        },
+        "parent": {
+          "description": "The Branch where this Role exists.\nFormat: projects/{project_id}/branches/{branch_id}",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "role_id": {
+          "description": "The part of the name, chosen by the user when the resource was created.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "spec": {
+          "description": "The spec contains the role configuration, including identity type, authentication method, and role attributes.",
+          "ref": "postgres.RoleRoleSpec",
+          "launch_stage": "GA",
+          "behaviors": [
+            "INPUT_ONLY",
+            "OPTIONAL"
+          ]
+        },
+        "status": {
+          "description": "Current status of the role, including its identity type, authentication method, and role attributes.",
+          "ref": "postgres.RoleRoleStatus",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "update_time": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "postgres.RoleAttributes": {
+      "description": "Attributes that can be granted to a Postgres role. We are only implementing a subset for now, see xref:\nhttps://www.postgresql.org/docs/16/sql-createrole.html\nThe values follow Postgres keyword naming e.g. CREATEDB, BYPASSRLS, etc. which is why they don't include typical\nunderscores between words.",
+      "fields": {
+        "bypassrls": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "createdb": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "createrole": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "postgres.RoleAuthMethod": {
+      "description": "How the role is authenticated when connecting to Postgres.",
+      "enum": [
+        "NO_LOGIN",
+        "PG_PASSWORD_SCRAM_SHA_256",
+        "LAKEBASE_OAUTH_V1"
+      ],
+      "enum_launch_stages": {
+        "LAKEBASE_OAUTH_V1": "GA",
+        "NO_LOGIN": "GA",
+        "PG_PASSWORD_SCRAM_SHA_256": "GA"
+      }
+    },
+    "postgres.RoleIdentityType": {
+      "description": "The type of the Databricks managed identity that this Role represents.\nLeave empty if you wish to create a regular Postgres role not associated with a Databricks identity.",
+      "enum": [
+        "USER",
+        "SERVICE_PRINCIPAL",
+        "GROUP"
+      ],
+      "enum_launch_stages": {
+        "GROUP": "GA",
+        "SERVICE_PRINCIPAL": "GA",
+        "USER": "GA"
+      }
+    },
+    "postgres.RoleMembershipRole": {
+      "description": "Roles that the DatabaseInstanceRole can be a member of.",
+      "enum": [
+        "DATABRICKS_SUPERUSER"
+      ],
+      "enum_launch_stages": {
+        "DATABRICKS_SUPERUSER": "GA"
+      }
+    },
+    "postgres.RoleOperationMetadata": {},
+    "postgres.RoleRoleSpec": {
+      "fields": {
+        "attributes": {
+          "description": "The desired API-exposed Postgres role attribute to associate with the role. Optional.",
+          "ref": "postgres.RoleAttributes",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "auth_method": {
+          "description": "Controls how the Postgres role authenticates when a client opens a database\nconnection. Supported values:\n\n* LAKEBASE_OAUTH_V1: the role authenticates by presenting a Databricks\nOAuth access token derived from the backing managed identity (the\nDatabricks user, service principal, or group named by the role's\n`postgres_role`). No static password exists for roles using this method.\n* PG_PASSWORD_SCRAM_SHA_256: the role authenticates with a Postgres\npassword verified server-side using the SCRAM-SHA-256 mechanism.\nLakebase generates a password for the role.\n* NO_LOGIN: the role cannot open a Postgres session at all. Useful for\nroles that exist only to own objects or to aggregate privileges that\nare then granted to other, loginable roles.\n\nIf auth_method is left unspecified, a meaningful authentication method is derived from the identity_type:\n* For the managed identities, OAUTH is used.\n* For the regular postgres roles, authentication based on postgres passwords is used.\n\nNOTE: for the Databricks identity type GROUP, LAKEBASE_OAUTH_V1\nis the default auth method (group can login as well).",
+          "ref": "postgres.RoleAuthMethod",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "identity_type": {
+          "description": "The type of role.\nWhen specifying a managed-identity, the chosen role_id must be a valid:\n\n* application ID for SERVICE_PRINCIPAL\n* user email for USER\n* group name for GROUP",
+          "ref": "postgres.RoleIdentityType",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "membership_roles": {
+          "description": "An enum value for a standard role that this role is a member of.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "postgres_role": {
+          "description": "The name of the Postgres role.\n\nThis expects a valid Postgres identifier as specified in the link below.\nhttps://www.postgresql.org/docs/current/sql-syntax-lexical.html#SQL-SYNTAX-IDENTIFIERS\n\nRequired when creating the Role.\n\nIf you wish to create a Postgres Role backed by a managed Databricks identity, then postgres_role\nmust be one of the following:\n\n1. user email for IdentityType.USER\n2. app ID for IdentityType.SERVICE_PRINCIPAL\n2. group name for IdentityType.GROUP",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "postgres.RoleRoleStatus": {
+      "fields": {
+        "attributes": {
+          "description": "The PG role attributes associated with the role.",
+          "ref": "postgres.RoleAttributes",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "auth_method": {
+          "ref": "postgres.RoleAuthMethod",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "identity_type": {
+          "description": "The type of the role.",
+          "ref": "postgres.RoleIdentityType",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "membership_roles": {
+          "description": "An enum value for a standard role that this role is a member of.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "postgres_role": {
+          "description": "The name of the Postgres role.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "role_id": {
+          "description": "Part of the resource name.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "postgres.ScheduleCadence": {
+      "description": "One cadence at which automatic snapshots are taken.",
+      "fields": {
+        "daily_schedule": {
+          "description": "Take a snapshot once per day.",
+          "ref": "postgres.DailySchedule",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "monthly_schedule": {
+          "description": "Take a snapshot once per month.",
+          "ref": "postgres.MonthlySchedule",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "retention": {
+          "description": "How long snapshots from this cadence are kept before automatic deletion.\nMust be at least 1 hour. Applied when a snapshot is taken; not retroactive,\nso changing it affects only later snapshots.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "weekly_schedule": {
+          "description": "Take a snapshot once per week.",
+          "ref": "postgres.WeeklySchedule",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "postgres.Snapshot": {
+      "description": "An immutable, point-in-time copy of a branch's data within a project. It\nremains available after the source branch is deleted.",
+      "fields": {
+        "create_time": {
+          "description": "When the snapshot was created.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "The resource name of the snapshot.\nFormat: projects/{project_id}/snapshots/{snapshot_id}",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "snapshot_id": {
+          "description": "The user-chosen ID; the final segment of `name`.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "spec": {
+          "description": "Client-provided configuration of the snapshot.",
+          "ref": "postgres.SnapshotSpec",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "status": {
+          "description": "Server-observed state of the snapshot.",
+          "ref": "postgres.SnapshotStatus",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "uid": {
+          "description": "Unique system-generated ID for the snapshot.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "postgres.SnapshotOperationMetadata": {
+      "description": "Metadata for the long-running snapshot Create and Delete operations."
+    },
+    "postgres.SnapshotSchedule": {
+      "description": "The automatic snapshot cadences for a branch. There is exactly one schedule\nper branch (singleton); it is configured in place, not created or deleted.\n\nName: projects/{project_id}/branches/{branch_id}/snapshot-schedule",
+      "fields": {
+        "name": {
+          "description": "The resource name of the branch's snapshot schedule.\nFormat: projects/{project_id}/branches/{branch_id}/snapshot-schedule",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "schedule": {
+          "description": "The cadences at which automatic snapshots are taken. Update replaces the\nwhole set; an empty set disables automatic snapshots. Order is not\nsignificant. When several cadences fire together, one snapshot is taken,\nretained for the longest of their retentions.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL",
+            "UNORDERED_LIST"
+          ]
+        }
+      }
+    },
+    "postgres.SnapshotScheduleOperationMetadata": {
+      "description": "Metadata for the long-running snapshot schedule Update operation."
+    },
+    "postgres.SnapshotSpec": {
+      "description": "Client-provided configuration of the snapshot.",
+      "fields": {
+        "expire_time": {
+          "description": "Absolute time at which the snapshot is deleted.\nMutually exclusive with `ttl` and `no_expiry`.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "IMMUTABLE",
+            "OPTIONAL"
+          ]
+        },
+        "no_expiry": {
+          "description": "If true, the snapshot never expires.\nMutually exclusive with `ttl` and `expire_time`.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "IMMUTABLE",
+            "OPTIONAL"
+          ]
+        },
+        "source_branch": {
+          "description": "The source branch to snapshot.\nFormat: projects/{project_id}/branches/{branch_id}",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "source_branch_lsn": {
+          "description": "LSN to snapshot from, e.g. `16/B374D848`.\nMutually exclusive with `source_branch_time`.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "IMMUTABLE",
+            "OPTIONAL"
+          ]
+        },
+        "source_branch_time": {
+          "description": "Timestamp to snapshot from.\nMutually exclusive with `source_branch_lsn`.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "IMMUTABLE",
+            "OPTIONAL"
+          ]
+        },
+        "ttl": {
+          "description": "Time-to-live. The snapshot expires this long after it is created.\nMutually exclusive with `expire_time` and `no_expiry`. Reads report the\nresolved absolute `expire_time` instead.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "IMMUTABLE",
+            "INPUT_ONLY",
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "postgres.SnapshotStatus": {
+      "description": "Server-observed state of a snapshot.",
+      "fields": {
+        "diff_size_bytes": {
+          "description": "Incremental storage size in bytes since the previous snapshot. Unset when\nthe snapshot is not billed on incremental usage.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "expire_time": {
+          "description": "Absolute time at which the snapshot is deleted.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "full_size_bytes": {
+          "description": "Full logical size of the snapshot, in bytes.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "no_expiry": {
+          "description": "True if the snapshot never expires.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "source_branch": {
+          "description": "The source branch the snapshot was taken from.\nFormat: projects/{project_id}/branches/{branch_id}",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "postgres.SyncedTable": {
+      "fields": {
+        "create_time": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "Output only. The Full resource name of the synced table in Postgres\nwhere (catalog, schema, table) are the UC entity names.\n\nFormat \"synced_tables/{catalog}.{schema}.{table}\"\n\nFor the corresponding source table in the Unity catalog look for the \"source_table_full_name\" attribute.",
+          "launch_stage": "GA"
+        },
+        "spec": {
+          "description": "Configuration details of the synced table, such as the source table, scheduling policy, etc.\nThis attribute is specified at creation time and most fields are returned as is on subsequent queries.",
+          "ref": "postgres.SyncedTableSyncedTableSpec",
+          "launch_stage": "GA",
+          "behaviors": [
+            "INPUT_ONLY",
+            "OPTIONAL"
+          ]
+        },
+        "status": {
+          "description": "Synced Table data synchronization status.",
+          "ref": "postgres.SyncedTableSyncedTableStatus",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "synced_table_id": {
+          "description": "The part of the name, chosen by the user when the resource was created.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "uid": {
+          "description": "The Unity Catalog table ID for this synced table.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "postgres.SyncedTableOperationMetadata": {
+      "description": "Metadata for SyncedTable long-running operations."
+    },
+    "postgres.SyncedTablePipelineProgress": {
+      "description": "Progress information of the Synced Table data synchronization pipeline.",
+      "fields": {
+        "estimated_completion_time_seconds": {
+          "description": "The estimated time remaining to complete this update in seconds.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "latest_version_currently_processing": {
+          "description": "The source table Delta version that was last processed by the pipeline. The pipeline may not\nhave completely processed this version yet.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "sync_progress_completion": {
+          "description": "The completion ratio of this update. This is a number between 0 and 1.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "synced_row_count": {
+          "description": "The number of rows that have been synced in this update.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "total_row_count": {
+          "description": "The total number of rows that need to be synced in this update. This number may be an estimate.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "postgres.SyncedTablePosition": {
+      "fields": {
+        "delta_table_sync_info": {
+          "ref": "postgres.DeltaTableSyncInfo",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "sync_end_time": {
+          "description": "The end timestamp of the most recent successful synchronization.\nThis is the time when the data is available in the synced table.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "sync_start_time": {
+          "description": "The starting timestamp of the most recent successful synchronization from the source table\nto the destination (synced) table.\nNote this is the starting timestamp of the sync operation, not the end time.\nE.g., for a batch, this is the time when the sync operation started.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "postgres.SyncedTableState": {
+      "description": "The state of a synced table.",
+      "enum": [
+        "SYNCED_TABLE_PROVISIONING",
+        "SYNCED_TABLE_PROVISIONING_PIPELINE_RESOURCES",
+        "SYNCED_TABLE_PROVISIONING_INITIAL_SNAPSHOT",
+        "SYNCED_TABLE_ONLINE",
+        "SYNCED_TABLE_ONLINE_CONTINUOUS_UPDATE",
+        "SYNCED_TABLE_ONLINE_TRIGGERED_UPDATE",
+        "SYNCED_TABLE_ONLINE_NO_PENDING_UPDATE",
+        "SYNCED_TABLE_OFFLINE",
+        "SYNCED_TABLE_OFFLINE_FAILED",
+        "SYNCED_TABLE_ONLINE_PIPELINE_FAILED",
+        "SYNCED_TABLE_ONLINE_UPDATING_PIPELINE_RESOURCES"
+      ],
+      "enum_launch_stages": {
+        "SYNCED_TABLE_OFFLINE": "GA",
+        "SYNCED_TABLE_OFFLINE_FAILED": "GA",
+        "SYNCED_TABLE_ONLINE": "GA",
+        "SYNCED_TABLE_ONLINE_CONTINUOUS_UPDATE": "GA",
+        "SYNCED_TABLE_ONLINE_NO_PENDING_UPDATE": "GA",
+        "SYNCED_TABLE_ONLINE_PIPELINE_FAILED": "GA",
+        "SYNCED_TABLE_ONLINE_TRIGGERED_UPDATE": "GA",
+        "SYNCED_TABLE_ONLINE_UPDATING_PIPELINE_RESOURCES": "GA",
+        "SYNCED_TABLE_PROVISIONING": "GA",
+        "SYNCED_TABLE_PROVISIONING_INITIAL_SNAPSHOT": "GA",
+        "SYNCED_TABLE_PROVISIONING_PIPELINE_RESOURCES": "GA"
+      }
+    },
+    "postgres.SyncedTableSyncedTableSpec": {
+      "fields": {
+        "accelerated_sync": {
+          "description": "When true, enables accelerated sync mode for the initial data load.\nThis significantly improves performance for large tables.\nRequires workspace-level enablement through Lakebase Accelerated Sync preview.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "branch": {
+          "description": "The full resource name the branch associated with the table.\n\nFormat: \"projects/{project_id}/branches/{branch_id}\".",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "create_database_objects_if_missing": {
+          "description": "If true, the synced table's logical database and schema resources in PG\nwill be created if they do not already exist.\nThe request will fail if this is false and the database/schema do not exist.\n\nDefaults to true if omitted.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "existing_pipeline_id": {
+          "description": "ID of an existing pipeline to bin-pack this synced table into.\nAt most one of existing_pipeline_id and new_pipeline_spec should be defined.\n\nThe pipeline used for the synced table is returned via the top level pipeline_id attribute.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "extra_columns": {
+          "description": "Extra PostgreSQL-only columns to add to the synced table.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "new_pipeline_spec": {
+          "description": "Specification for creating a new pipeline.\nAt most one of existing_pipeline_id and new_pipeline_spec should be defined.\n\nThe pipeline used for the synced table is returned via the top level pipeline_id attribute.",
+          "ref": "postgres.NewPipelineSpec",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "postgres_database": {
+          "description": "The Postgres database name where the synced table will be created in.\n\nIf this synced table is created inside a Lakebase Catalog, this attribute can be omitted on creation and is inferred\nfrom the postgres_database associated with the Lakebase Catalog. If specified when inside a Lakebase Catalog, the value must match.\n\nA value must be specified when creating a synced table inside a Standard Catalog.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "primary_key_columns": {
+          "description": "Primary Key columns to be used for data insert/update in the destination.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "scheduling_policy": {
+          "description": "Scheduling policy of the underlying pipeline.",
+          "ref": "postgres.SyncedTableSyncedTableSpecSyncedTableSchedulingPolicy",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "source_table_full_name": {
+          "description": "Three-part (catalog, schema, table) name of the source Delta table.\n\nFor the corresponding destination table, use any of the two:\n\n* synced_table_id used at the creation of the SyncedTable\n* \"name\" consisting of \"synced_tables/\" prefix and the full name of the destination table.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "timeseries_key": {
+          "description": "Time series key to deduplicate (tie-break) rows with the same primary key.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "type_overrides": {
+          "description": "Override the default Delta-\u003ePG type mapping for specific columns.\nA TypeOverride with PG_SPECIFIC_TYPE_UNSPECIFIED is rejected; a valid pg_type must be set.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "postgres.SyncedTableSyncedTableSpecExtraColumn": {
+      "description": "An extra PostgreSQL column to add to the synced table.",
+      "fields": {
+        "column_name": {
+          "description": "Name of the column.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "column_type": {
+          "description": "PostgreSQL type of the column, for example \"tsvector\" or \"vector(1024)\".",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "compute": {
+          "description": "SQL expression used to compute the column's value, for example\n\"to_tsvector('english', content)\".",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "maintenance": {
+          "ref": "postgres.SyncedTableSyncedTableSpecExtraColumnMaintenance",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "postgres.SyncedTableSyncedTableSpecExtraColumnMaintenance": {
+      "description": "How the column's value is populated and kept up to date.",
+      "enum": [
+        "STORED_GENERATED"
+      ],
+      "enum_launch_stages": {
+        "STORED_GENERATED": "PRIVATE_PREVIEW"
+      }
+    },
+    "postgres.SyncedTableSyncedTableSpecPgSpecificType": {
+      "description": "PostgreSQL-specific target types that can override the default Delta-to-PG mapping.",
+      "enum": [
+        "PG_SPECIFIC_TYPE_VECTOR",
+        "PG_SPECIFIC_TYPE_HALFVEC",
+        "PG_SPECIFIC_TYPE_VARCHAR"
+      ],
+      "enum_launch_stages": {
+        "PG_SPECIFIC_TYPE_HALFVEC": "GA",
+        "PG_SPECIFIC_TYPE_VARCHAR": "GA",
+        "PG_SPECIFIC_TYPE_VECTOR": "GA"
+      }
+    },
+    "postgres.SyncedTableSyncedTableSpecSyncedTableSchedulingPolicy": {
+      "description": "Scheduling policy of the synced table's underlying pipeline.",
+      "enum": [
+        "CONTINUOUS",
+        "TRIGGERED",
+        "SNAPSHOT"
+      ],
+      "enum_launch_stages": {
+        "CONTINUOUS": "GA",
+        "SNAPSHOT": "GA",
+        "TRIGGERED": "GA"
+      }
+    },
+    "postgres.SyncedTableSyncedTableSpecTypeOverride": {
+      "description": "Overrides the default Delta-to-PostgreSQL type mapping for a single column.",
+      "fields": {
+        "column_name": {
+          "description": "Name of the source column whose target PostgreSQL type should be overridden.",
+          "launch_stage": "GA"
+        },
+        "pg_type": {
+          "description": "PostgreSQL-specific target type to use for the column.",
+          "ref": "postgres.SyncedTableSyncedTableSpecPgSpecificType",
+          "launch_stage": "GA"
+        },
+        "size": {
+          "description": "Size parameter for the target type, for types that take one (e.g. vector\ndimension, varchar length). Required when the chosen pg_type needs a size.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "postgres.SyncedTableSyncedTableStatus": {
+      "fields": {
+        "detailed_state": {
+          "description": "The state of the synced table.",
+          "ref": "postgres.SyncedTableState",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "last_processed_commit_version": {
+          "description": "The last source table Delta version that was successfully synced to the synced table.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "last_sync": {
+          "description": "Summary of the last successful synchronization from source to destination.",
+          "ref": "postgres.SyncedTablePosition",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "last_sync_time": {
+          "description": "The end timestamp of the last time any data was synchronized from the source table to the synced\ntable. This is when the data is available in the synced table.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "message": {
+          "description": "A text description of the current state of the synced table.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "ongoing_sync_progress": {
+          "ref": "postgres.SyncedTablePipelineProgress",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "pipeline_id": {
+          "description": "ID of the associated pipeline.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "project": {
+          "description": "The full resource name of the project associated with the table.\n\nFormat: \"projects/{project_id}\".",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "provisioning_phase": {
+          "description": "The current phase of the data synchronization pipeline.",
+          "ref": "postgres.ProvisioningPhase",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "unity_catalog_provisioning_state": {
+          "description": "The provisioning state of the synced table entity in Unity Catalog.",
+          "ref": "postgres.ProvisioningInfoState",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "postgres.UndeleteBranchRequest": {},
+    "postgres.UndeleteProjectRequest": {
+      "description": "Request to restore a soft-deleted project within its retention period."
+    },
+    "postgres.UpdateBranchRequest": {
+      "fields": {
+        "branch": {
+          "description": "The Branch to update.\n\nThe branch's `name` field is used to identify the branch to update.\nFormat: projects/{project_id}/branches/{branch_id}",
+          "ref": "postgres.Branch",
+          "launch_stage": "GA"
+        },
+        "update_mask": {
+          "description": "The list of fields to update.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "postgres.UpdateDataApiRequest": {
+      "fields": {
+        "data_api": {
+          "description": "The Data API configuration to update.\nThe data_api's `name` field identifies the resource.",
+          "ref": "postgres.DataApi",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "update_mask": {
+          "description": "The list of fields to update.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "postgres.UpdateDatabaseRequest": {
+      "fields": {
+        "database": {
+          "description": "The Database to update.\n\nThe database's `name` field is used to identify the database to update.\nFormat: projects/{project_id}/branches/{branch_id}/databases/{database_id}",
+          "ref": "postgres.Database",
+          "launch_stage": "GA"
+        },
+        "update_mask": {
+          "description": "The list of fields to update.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "postgres.UpdateEndpointRequest": {
+      "fields": {
+        "endpoint": {
+          "description": "The Endpoint to update.\n\nThe endpoint's `name` field is used to identify the endpoint to update.\nFormat: projects/{project_id}/branches/{branch_id}/endpoints/{endpoint_id}",
+          "ref": "postgres.Endpoint",
+          "launch_stage": "GA"
+        },
+        "update_mask": {
+          "description": "The list of fields to update.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "postgres.UpdateProjectRequest": {
+      "fields": {
+        "project": {
+          "description": "The Project to update.\n\nThe project's `name` field is used to identify the project to update.\nFormat: projects/{project_id}",
+          "ref": "postgres.Project",
+          "launch_stage": "GA"
+        },
+        "update_mask": {
+          "description": "The list of fields to update.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "postgres.UpdateRoleRequest": {
+      "fields": {
+        "role": {
+          "description": "The Postgres Role to update.\n\nThe role's `name` field is used to identify the role to update.\nFormat: projects/{project_id}/branches/{branch_id}/roles/{role_id}",
+          "ref": "postgres.Role",
+          "launch_stage": "GA"
+        },
+        "update_mask": {
+          "description": "The list of fields to update.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "postgres.UpdateSnapshotScheduleRequest": {
+      "fields": {
+        "snapshot_schedule": {
+          "description": "The snapshot schedule to set. Its `name` identifies the branch.\nFormat: projects/{project_id}/branches/{branch_id}/snapshot-schedule",
+          "ref": "postgres.SnapshotSchedule",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "update_mask": {
+          "description": "Fields to update. The only updatable path is `schedule`, which replaces the\nentire set of cadences.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "postgres.WeeklySchedule": {
+      "description": "Take a snapshot once per week, on the configured day at the configured hour.",
+      "fields": {
+        "day_of_week": {
+          "description": "The day of the week on which to take the snapshot.",
+          "ref": "postgres.DayOfWeek",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "hour": {
+          "description": "The hour of the day, in UTC, at which to take the snapshot, in [0, 23].",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "provisioning.AwsCredentials": {
+      "fields": {
+        "sts_role": {
+          "ref": "provisioning.StsRole",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "provisioning.AwsKeyInfo": {
+      "fields": {
+        "key_alias": {
+          "description": "The AWS KMS key alias.",
+          "launch_stage": "GA"
+        },
+        "key_arn": {
+          "description": "The AWS KMS key's Amazon Resource Name (ARN).",
+          "launch_stage": "GA"
+        },
+        "key_region": {
+          "description": "The AWS KMS key region.",
+          "launch_stage": "GA"
+        },
+        "reuse_key_for_cluster_volumes": {
+          "description": "This field applies only if the `use_cases` property includes `STORAGE`. If this is set to true or omitted, the key is also used to encrypt\ncluster EBS volumes. If you do not want to use this key for encrypting EBS volumes, set to false.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "provisioning.AzureKeyInfo": {
+      "fields": {
+        "disk_encryption_set_id": {
+          "description": "The Disk Encryption Set id that is used to represent the key info used for\nManaged Disk BYOK use case",
+          "launch_stage": "GA"
+        },
+        "key_access_configuration": {
+          "description": "The structure to store key access credential\nThis is set if the Managed Identity is being used to access the Azure Key Vault key.",
+          "ref": "provisioning.KeyAccessConfiguration",
+          "launch_stage": "GA"
+        },
+        "key_name": {
+          "description": "The name of the key in KeyVault.",
+          "launch_stage": "GA"
+        },
+        "key_vault_uri": {
+          "description": "The base URI of the KeyVault.",
+          "launch_stage": "GA"
+        },
+        "tenant_id": {
+          "description": "The tenant id where the KeyVault lives.",
+          "launch_stage": "GA"
+        },
+        "version": {
+          "description": "The current key version.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "provisioning.AzureWorkspaceInfo": {
+      "fields": {
+        "resource_group": {
+          "description": "Azure Resource Group name",
+          "launch_stage": "GA"
+        },
+        "subscription_id": {
+          "description": "Azure Subscription ID",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "provisioning.CloudResourceContainer": {
+      "fields": {
+        "gcp": {
+          "ref": "provisioning.CustomerFacingGcpCloudResourceContainer",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "provisioning.CreateAwsKeyInfo": {
+      "fields": {
+        "key_alias": {
+          "description": "The AWS KMS key alias.",
+          "launch_stage": "GA"
+        },
+        "key_arn": {
+          "description": "The AWS KMS key's Amazon Resource Name (ARN).",
+          "launch_stage": "GA"
+        },
+        "key_region": {
+          "description": "The AWS KMS key region.",
+          "launch_stage": "GA"
+        },
+        "reuse_key_for_cluster_volumes": {
+          "description": "This field applies only if the `use_cases` property includes `STORAGE`. If this is set to true or omitted, the key is also used to encrypt\ncluster EBS volumes. If you do not want to use this key for encrypting EBS volumes, set to false.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "provisioning.CreateAzureKeyInfo": {
+      "fields": {
+        "disk_encryption_set_id": {
+          "description": "The Disk Encryption Set id that is used to represent the key info used for\nManaged Disk BYOK use case",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "key_access_configuration": {
+          "description": "The structure to store key access credential\nThis is set if the Managed Identity is being used to access the Azure Key Vault key.",
+          "ref": "provisioning.KeyAccessConfiguration",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "key_name": {
+          "description": "The name of the key in KeyVault.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "key_vault_uri": {
+          "description": "The base URI of the KeyVault.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "tenant_id": {
+          "description": "The tenant id where the KeyVault lives.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "version": {
+          "description": "The current key version.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "provisioning.CreateCredentialAwsCredentials": {
+      "fields": {
+        "sts_role": {
+          "ref": "provisioning.CreateCredentialStsRole",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "provisioning.CreateCredentialRequest": {
+      "fields": {
+        "aws_credentials": {
+          "ref": "provisioning.CreateCredentialAwsCredentials",
+          "launch_stage": "GA"
+        },
+        "credentials_name": {
+          "description": "The human-readable name of the credential configuration object.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "provisioning.CreateCredentialStsRole": {
+      "fields": {
+        "role_arn": {
+          "description": "The Amazon Resource Name (ARN) of the cross account IAM role.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "provisioning.CreateCustomerManagedKeyRequest": {
+      "fields": {
+        "aws_key_info": {
+          "ref": "provisioning.CreateAwsKeyInfo",
+          "launch_stage": "GA"
+        },
+        "azure_key_info": {
+          "ref": "provisioning.CreateAzureKeyInfo",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "gcp_key_info": {
+          "ref": "provisioning.CreateGcpKeyInfo",
+          "launch_stage": "GA"
+        },
+        "use_cases": {
+          "description": "The cases that the key can be used for.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "provisioning.CreateGcpKeyInfo": {
+      "fields": {
+        "gcp_service_account": {
+          "description": "Globally unique service account email that has access to the KMS key.\nThe service account exists within the Databricks CP project.",
+          "ref": "provisioning.GcpServiceAccount",
+          "launch_stage": "GA"
+        },
+        "kms_key_id": {
+          "description": "Globally unique kms key resource id of the form\nprojects/testProjectId/locations/us-east4/keyRings/gcpCmkKeyRing/cryptoKeys/cmk-eastus4",
+          "launch_stage": "GA"
+        },
+        "manual": {
+          "description": "When true, Databricks will not use OAuth to grant the service account\naccess to the KMS key. The customer is responsible for granting access\nmanually.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "provisioning.CreateNetworkRequest": {
+      "fields": {
+        "gcp_network_info": {
+          "ref": "provisioning.GcpNetworkInfo",
+          "launch_stage": "GA"
+        },
+        "network_name": {
+          "description": "The human-readable name of the network configuration.",
+          "launch_stage": "GA"
+        },
+        "security_group_ids": {
+          "description": "IDs of one to five security groups associated with this network. Security group IDs **cannot** be used in multiple network configurations.",
+          "launch_stage": "GA"
+        },
+        "subnet_ids": {
+          "description": "IDs of at least two subnets associated with this network. Subnet IDs **cannot** be used in multiple network configurations.",
+          "launch_stage": "GA"
+        },
+        "vpc_endpoints": {
+          "ref": "provisioning.NetworkVpcEndpoints",
+          "launch_stage": "GA"
+        },
+        "vpc_id": {
+          "description": "The ID of the VPC associated with this network configuration. VPC IDs can be used in multiple networks.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "provisioning.CreatePrivateAccessSettingsRequest": {
+      "fields": {
+        "allowed_vpc_endpoint_ids": {
+          "description": "An array of Databricks VPC endpoint IDs. This is the Databricks ID returned when registering the VPC endpoint configuration in your Databricks account. This is not the ID of the VPC endpoint in AWS.\nOnly used when private_access_level is set to ENDPOINT. This is an allow list of VPC endpoints registered in your Databricks account that can connect to your workspace over AWS PrivateLink.\nNote: If hybrid access to your workspace is enabled by setting public_access_enabled to true, this control only works for PrivateLink connections. To control how your workspace is accessed via public internet, see IP access lists.",
+          "launch_stage": "GA"
+        },
+        "private_access_level": {
+          "description": "The private access level controls which VPC endpoints can connect to the UI or API of any workspace that attaches this private access settings object.\n`ACCOUNT` level access (the default) allows only VPC endpoints that are registered in your Databricks account connect to your workspace.\n`ENDPOINT` level access allows only specified VPC endpoints connect to your workspace. For details, see allowed_vpc_endpoint_ids.",
+          "ref": "provisioning.PrivateAccessLevel",
+          "launch_stage": "GA"
+        },
+        "private_access_settings_name": {
+          "description": "The human-readable name of the private access settings object.",
+          "launch_stage": "GA"
+        },
+        "public_access_enabled": {
+          "description": "Determines if the workspace can be accessed over public internet. For fully private workspaces, you can optionally specify false, but only if you implement both the front-end and the back-end PrivateLink connections. Otherwise, specify true, which means that public access is enabled.",
+          "launch_stage": "GA"
+        },
+        "region": {
+          "description": "The AWS region for workspaces attached to this private access settings object.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "provisioning.CreateStorageConfigurationRequest": {
+      "fields": {
+        "role_arn": {
+          "description": "Optional IAM role that is used to access the workspace catalog which is created during workspace creation\nfor UC by Default. If a storage configuration with this field populated is used to create a workspace,\nthen a workspace catalog is created together with the workspace. The workspace catalog shares the root\nbucket with internal workspace storage (including DBFS root) but uses a dedicated bucket path prefix.",
+          "launch_stage": "GA"
+        },
+        "root_bucket_info": {
+          "description": "Root S3 bucket information.",
+          "ref": "provisioning.RootBucketInfo",
+          "launch_stage": "GA"
+        },
+        "storage_configuration_name": {
+          "description": "The human-readable name of the storage configuration.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "provisioning.CreateVpcEndpointRequest": {
+      "fields": {
+        "aws_vpc_endpoint_id": {
+          "description": "The ID of the VPC endpoint object in AWS.",
+          "launch_stage": "GA"
+        },
+        "gcp_vpc_endpoint_info": {
+          "description": "The cloud info of this vpc endpoint.",
+          "ref": "provisioning.GcpVpcEndpointInfo",
+          "launch_stage": "GA"
+        },
+        "region": {
+          "description": "The region in which this VPC endpoint object exists.",
+          "launch_stage": "GA"
+        },
+        "vpc_endpoint_name": {
+          "description": "The human-readable name of the storage configuration.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "provisioning.CreateWorkspaceRequest": {
+      "fields": {
+        "aws_region": {
+          "launch_stage": "GA"
+        },
+        "cloud": {
+          "description": "DEPRECATED: This field is being ignored by the server and will be removed in the future.\nThe cloud name. This field always has the value `gcp`.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "cloud_resource_container": {
+          "ref": "provisioning.CloudResourceContainer",
+          "launch_stage": "GA"
+        },
+        "compute_mode": {
+          "description": "If the compute mode is `SERVERLESS`, a serverless workspace is created that comes pre-configured with serverless compute and default storage, providing a fully-managed, enterprise-ready SaaS experience. This means you don't need to provide any resources managed by you, such as credentials, storage, or network.\nIf the compute mode is `HYBRID` (which is the default option), a classic workspace is created that uses customer-managed resources.",
+          "ref": "provisioning.CustomerFacingComputeMode",
+          "launch_stage": "GA"
+        },
+        "credentials_id": {
+          "description": "ID of the workspace's credential configuration object.",
+          "launch_stage": "GA"
+        },
+        "custom_tags": {
+          "description": "The custom tags key-value pairing that is attached to this workspace. The key-value pair is a string of utf-8 characters. The\nvalue can be an empty string, with maximum length of 255 characters. The key can be of maximum length of 127 characters, and cannot be empty.",
+          "launch_stage": "GA"
+        },
+        "deployment_name": {
+          "description": "The deployment name defines part of the subdomain for the workspace. The workspace URL for the web application and REST APIs is \u003cworkspace-deployment-name\u003e.cloud.databricks.com. For example, if the deployment name is abcsales, your workspace URL will be https://abcsales.cloud.databricks.com. Hyphens are allowed. This property supports only the set of characters that are allowed in a subdomain.\nTo set this value, you must have a deployment name prefix. Contact your Databricks account team to add an account deployment name prefix to your account.\nWorkspace deployment names follow the account prefix and a hyphen. For example, if your account's deployment prefix is acme and the workspace deployment name is workspace-1, the JSON response for the deployment_name field becomes acme-workspace-1. The workspace URL would be acme-workspace-1.cloud.databricks.com.\nYou can also set the deployment_name to the reserved keyword EMPTY if you want the deployment name to only include the deployment prefix. For example, if your account's deployment prefix is acme and the workspace deployment name is EMPTY, the deployment_name becomes acme only and the workspace URL is acme.cloud.databricks.com.\nThis value must be unique across all non-deleted deployments across all AWS regions.\nIf a new workspace omits this property, the server generates a unique deployment name for you with the pattern dbc-xxxxxxxx-xxxx.",
+          "launch_stage": "GA"
+        },
+        "gcp_managed_network_config": {
+          "ref": "provisioning.GcpManagedNetworkConfig",
+          "launch_stage": "GA"
+        },
+        "gke_config": {
+          "ref": "provisioning.GkeConfig",
+          "launch_stage": "GA"
+        },
+        "location": {
+          "description": "The Google Cloud region of the workspace data plane in your Google account (for example, `us-east4`).",
+          "launch_stage": "GA"
+        },
+        "managed_services_customer_managed_key_id": {
+          "description": "The ID of the workspace's managed services encryption key configuration object. This is used to help protect and control access to the workspace's notebooks, secrets, Databricks SQL queries, and query history. The provided key configuration object property use_cases must contain MANAGED_SERVICES.",
+          "launch_stage": "GA"
+        },
+        "network_connectivity_config_id": {
+          "description": "The object ID of network connectivity config. Once assigned, the workspace serverless compute resources use the same set of stable IP CIDR blocks and optional private link to access your resources.",
+          "launch_stage": "GA"
+        },
+        "network_id": {
+          "description": "The ID of the workspace's network configuration object. To use AWS PrivateLink, this field is required.",
+          "launch_stage": "GA"
+        },
+        "pricing_tier": {
+          "ref": "provisioning.PricingTier",
+          "launch_stage": "GA"
+        },
+        "private_access_settings_id": {
+          "description": "ID of the workspace's private access settings object. Only used for PrivateLink. You must specify this ID if you are using [AWS PrivateLink](https://aws.amazon.com/privatelink/) for either front-end (user-to-workspace connection), back-end (data plane to control plane connection), or both connection types.\nBefore configuring PrivateLink, read the [Databricks article about PrivateLink](https://docs.databricks.com/administration-guide/cloud-configurations/aws/privatelink.html).\",",
+          "launch_stage": "GA"
+        },
+        "storage_configuration_id": {
+          "description": "ID of the workspace's storage configuration object.",
+          "launch_stage": "GA"
+        },
+        "storage_customer_managed_key_id": {
+          "description": "The ID of the workspace's storage encryption key configuration object. This is used to encrypt the workspace's root S3 bucket (root DBFS and system data) and, optionally, cluster EBS volumes. The provided key configuration object property use_cases must contain STORAGE.",
+          "launch_stage": "GA"
+        },
+        "workspace_name": {
+          "description": "The human-readable name of the workspace.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "provisioning.Credential": {
+      "fields": {
+        "account_id": {
+          "description": "The Databricks account ID that hosts the credential.",
+          "launch_stage": "GA"
+        },
+        "aws_credentials": {
+          "ref": "provisioning.AwsCredentials",
+          "launch_stage": "GA"
+        },
+        "creation_time": {
+          "description": "Time in epoch milliseconds when the credential was created.",
+          "launch_stage": "GA"
+        },
+        "credentials_id": {
+          "description": "Databricks credential configuration ID.",
+          "launch_stage": "GA"
+        },
+        "credentials_name": {
+          "description": "The human-readable name of the credential configuration object.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "provisioning.CustomerFacingComputeMode": {
+      "description": "Corresponds to compute mode defined here:\nhttps://src.dev.databricks.com/databricks/universe@9076536b18479afd639d1c1f9dd5a59f72215e69/-/blob/central/api/common.proto?L872",
+      "enum": [
+        "HYBRID",
+        "SERVERLESS"
+      ],
+      "enum_launch_stages": {
+        "HYBRID": "GA",
+        "SERVERLESS": "GA"
+      }
+    },
+    "provisioning.CustomerFacingGcpCloudResourceContainer": {
+      "fields": {
+        "project_id": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "provisioning.CustomerFacingStorageMode": {
+      "enum": [
+        "CUSTOMER_HOSTED",
+        "DEFAULT_STORAGE"
+      ],
+      "enum_launch_stages": {
+        "CUSTOMER_HOSTED": "GA",
+        "DEFAULT_STORAGE": "GA"
+      }
+    },
+    "provisioning.CustomerManagedKey": {
+      "fields": {
+        "account_id": {
+          "description": "The Databricks account ID that holds the customer-managed key.",
+          "launch_stage": "GA"
+        },
+        "aws_key_info": {
+          "ref": "provisioning.AwsKeyInfo",
+          "launch_stage": "GA"
+        },
+        "azure_key_info": {
+          "ref": "provisioning.AzureKeyInfo",
+          "launch_stage": "GA"
+        },
+        "creation_time": {
+          "description": "Time in epoch milliseconds when the customer key was created.",
+          "launch_stage": "GA"
+        },
+        "customer_managed_key_id": {
+          "description": "ID of the encryption key configuration object.",
+          "launch_stage": "GA"
+        },
+        "gcp_key_info": {
+          "ref": "provisioning.GcpKeyInfo",
+          "launch_stage": "GA"
+        },
+        "use_cases": {
+          "description": "The cases that the key can be used for.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "provisioning.DeleteCredentialRequest": {},
+    "provisioning.DeleteEncryptionKeyRequest": {},
+    "provisioning.DeleteNetworkRequest": {},
+    "provisioning.DeletePrivateAccesRequest": {},
+    "provisioning.DeleteStorageRequest": {},
+    "provisioning.DeleteVpcEndpointRequest": {},
+    "provisioning.DeleteWorkspaceRequest": {},
+    "provisioning.EndpointUseCase": {
+      "enum": [
+        "WORKSPACE_ACCESS",
+        "DATAPLANE_RELAY_ACCESS",
+        "GENERAL_ACCESS"
+      ],
+      "enum_launch_stages": {
+        "DATAPLANE_RELAY_ACCESS": "GA",
+        "GENERAL_ACCESS": "PUBLIC_BETA",
+        "WORKSPACE_ACCESS": "GA"
+      }
+    },
+    "provisioning.ErrorType": {
+      "description": "ErrorType and WarningType are used to represent the type of error or warning by NetworkHealth and NetworkWarning defined in central/api/accounts/accounts.proto",
+      "enum": [
+        "credentials",
+        "vpc",
+        "subnet",
+        "securityGroup",
+        "networkAcl"
+      ],
+      "enum_launch_stages": {
+        "credentials": "GA",
+        "networkAcl": "GA",
+        "securityGroup": "GA",
+        "subnet": "GA",
+        "vpc": "GA"
+      }
+    },
+    "provisioning.GcpCommonNetworkConfig": {
+      "description": "The shared network config for GCP workspace.\nThis object has common network configurations that are network attributions of a workspace.\nDEPRECATED. Use GkeConfig instead.",
+      "fields": {
+        "gke_cluster_master_ip_range": {
+          "description": "The IP range that will be used to allocate GKE cluster master resources from.\nThis field must not be set if gke_cluster_type=PUBLIC_NODE_PUBLIC_MASTER.",
+          "launch_stage": "GA"
+        },
+        "gke_connectivity_type": {
+          "description": "The type of network connectivity of the GKE cluster.",
+          "ref": "provisioning.GkeConfigConnectivityType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "provisioning.GcpKeyInfo": {
+      "fields": {
+        "gcp_service_account": {
+          "description": "Globally unique service account email that has access to the KMS key.\nThe service account exists within the Databricks CP project.",
+          "ref": "provisioning.GcpServiceAccount",
+          "launch_stage": "GA"
+        },
+        "kms_key_id": {
+          "description": "Globally unique kms key resource id of the form\nprojects/testProjectId/locations/us-east4/keyRings/gcpCmkKeyRing/cryptoKeys/cmk-eastus4",
+          "launch_stage": "GA"
+        },
+        "manual": {
+          "description": "When true, Databricks will not use OAuth to grant the service account\naccess to the KMS key. The customer is responsible for granting access\nmanually.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "provisioning.GcpManagedNetworkConfig": {
+      "description": "The network configuration for the workspace.",
+      "fields": {
+        "gke_cluster_pod_ip_range": {
+          "description": "The IP range that will be used to allocate GKE cluster Pods from.",
+          "launch_stage": "GA"
+        },
+        "gke_cluster_service_ip_range": {
+          "description": "The IP range that will be used to allocate GKE cluster Services from.",
+          "launch_stage": "GA"
+        },
+        "subnet_cidr": {
+          "description": "The IP range which will be used to allocate GKE cluster nodes from.\nNote: Pods, services and master IP range must be mutually exclusive.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "provisioning.GcpNetworkInfo": {
+      "fields": {
+        "network_project_id": {
+          "description": "The GCP project ID for network resources. This project is where the VPC and subnet resides.",
+          "launch_stage": "GA"
+        },
+        "pod_ip_range_name": {
+          "description": "Name of the secondary range within the subnet that will be used by GKE as Pod IP range.\nThis is BYO VPC specific. DB VPC uses network.getGcpManagedNetworkConfig.getGkeClusterPodIpRange",
+          "launch_stage": "GA"
+        },
+        "service_ip_range_name": {
+          "description": "Name of the secondary range within the subnet that will be used by GKE as Service IP range.",
+          "launch_stage": "GA"
+        },
+        "subnet_id": {
+          "description": "The customer-provided Subnet ID that will be available to Clusters in Workspaces using this\nNetwork.",
+          "launch_stage": "GA"
+        },
+        "subnet_region": {
+          "launch_stage": "GA"
+        },
+        "vpc_id": {
+          "description": "The customer-provided VPC ID.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "provisioning.GcpServiceAccount": {
+      "fields": {
+        "service_account_email": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "provisioning.GcpVpcEndpointInfo": {
+      "fields": {
+        "endpoint_region": {
+          "launch_stage": "GA"
+        },
+        "project_id": {
+          "launch_stage": "GA"
+        },
+        "psc_connection_id": {
+          "launch_stage": "GA"
+        },
+        "psc_endpoint_name": {
+          "launch_stage": "GA"
+        },
+        "service_attachment_id": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "provisioning.GetCredentialRequest": {},
+    "provisioning.GetEncryptionKeyRequest": {},
+    "provisioning.GetNetworkRequest": {},
+    "provisioning.GetPrivateAccesRequest": {},
+    "provisioning.GetStorageRequest": {},
+    "provisioning.GetVpcEndpointRequest": {},
+    "provisioning.GetWorkspaceRequest": {},
+    "provisioning.GkeConfig": {
+      "description": "The configurations of the GKE cluster used by the GCP workspace.",
+      "fields": {
+        "connectivity_type": {
+          "description": "The type of network connectivity of the GKE cluster.",
+          "ref": "provisioning.GkeConfigConnectivityType",
+          "launch_stage": "GA"
+        },
+        "master_ip_range": {
+          "description": "The IP range that will be used to allocate GKE cluster master resources from.\nThis field must not be set if gke_cluster_type=PUBLIC_NODE_PUBLIC_MASTER.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "provisioning.GkeConfigConnectivityType": {
+      "description": "Specifies the network connectivity types for the GKE nodes and the GKE master network.\n\nSet to `PRIVATE_NODE_PUBLIC_MASTER` for a private GKE cluster\nfor the workspace. The GKE nodes will not have public IPs.\n\nSet to `PUBLIC_NODE_PUBLIC_MASTER` for a public GKE cluster.\nThe nodes of a public GKE cluster have public IP addresses.",
+      "enum": [
+        "PRIVATE_NODE_PUBLIC_MASTER",
+        "PUBLIC_NODE_PUBLIC_MASTER"
+      ],
+      "enum_launch_stages": {
+        "PRIVATE_NODE_PUBLIC_MASTER": "GA",
+        "PUBLIC_NODE_PUBLIC_MASTER": "GA"
+      }
+    },
+    "provisioning.KeyAccessConfiguration": {
+      "description": "The credential ID that is used to access the key vault.",
+      "fields": {
+        "credential_id": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "provisioning.KeyUseCase": {
+      "enum": [
+        "MANAGED_SERVICES",
+        "STORAGE"
+      ],
+      "enum_launch_stages": {
+        "MANAGED_SERVICES": "GA",
+        "STORAGE": "GA"
+      }
+    },
+    "provisioning.ListCredentialsRequest": {},
+    "provisioning.ListEncryptionKeysRequest": {},
+    "provisioning.ListNetworksRequest": {},
+    "provisioning.ListPrivateAccessRequest": {},
+    "provisioning.ListStorageRequest": {},
+    "provisioning.ListVpcEndpointsRequest": {},
+    "provisioning.ListWorkspacesRequest": {},
+    "provisioning.Network": {
+      "fields": {
+        "account_id": {
+          "description": "The Databricks account ID associated with this network configuration.",
+          "launch_stage": "GA"
+        },
+        "creation_time": {
+          "description": "Time in epoch milliseconds when the network was created.",
+          "launch_stage": "GA"
+        },
+        "error_messages": {
+          "description": "Array of error messages about the network configuration.",
+          "launch_stage": "GA"
+        },
+        "gcp_network_info": {
+          "ref": "provisioning.GcpNetworkInfo",
+          "launch_stage": "GA"
+        },
+        "network_id": {
+          "description": "The Databricks network configuration ID.",
+          "launch_stage": "GA"
+        },
+        "network_name": {
+          "description": "The human-readable name of the network configuration.",
+          "launch_stage": "GA"
+        },
+        "security_group_ids": {
+          "description": "IDs of one to five security groups associated with this network. Security group IDs **cannot** be used in multiple network configurations.",
+          "launch_stage": "GA"
+        },
+        "subnet_ids": {
+          "description": "IDs of at least two subnets associated with this network. Subnet IDs **cannot** be used in multiple network configurations.",
+          "launch_stage": "GA"
+        },
+        "vpc_endpoints": {
+          "ref": "provisioning.NetworkVpcEndpoints",
+          "launch_stage": "GA"
+        },
+        "vpc_id": {
+          "description": "The ID of the VPC associated with this network configuration. VPC IDs can be used in multiple networks.",
+          "launch_stage": "GA"
+        },
+        "vpc_status": {
+          "ref": "provisioning.VpcStatus",
+          "launch_stage": "GA"
+        },
+        "warning_messages": {
+          "description": "Array of warning messages about the network configuration.",
+          "launch_stage": "GA"
+        },
+        "workspace_id": {
+          "description": "Workspace ID associated with this network configuration.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "provisioning.NetworkHealth": {
+      "fields": {
+        "error_message": {
+          "description": "Details of the error.",
+          "launch_stage": "GA"
+        },
+        "error_type": {
+          "ref": "provisioning.ErrorType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "provisioning.NetworkVpcEndpoints": {
+      "fields": {
+        "dataplane_relay": {
+          "description": "The VPC endpoint ID used by this network to access the Databricks secure cluster connectivity relay.",
+          "launch_stage": "GA"
+        },
+        "rest_api": {
+          "description": "The VPC endpoint ID used by this network to access the Databricks REST API.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "provisioning.NetworkWarning": {
+      "fields": {
+        "warning_message": {
+          "description": "Details of the warning.",
+          "launch_stage": "GA"
+        },
+        "warning_type": {
+          "ref": "provisioning.WarningType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "provisioning.PricingTier": {
+      "enum": [
+        "UNKNOWN",
+        "COMMUNITY_EDITION",
+        "STANDARD",
+        "PREMIUM",
+        "ENTERPRISE",
+        "DEDICATED"
+      ],
+      "enum_launch_stages": {
+        "COMMUNITY_EDITION": "GA",
+        "DEDICATED": "GA",
+        "ENTERPRISE": "GA",
+        "PREMIUM": "GA",
+        "STANDARD": "GA",
+        "UNKNOWN": "GA"
+      }
+    },
+    "provisioning.PrivateAccessLevel": {
+      "enum": [
+        "ENDPOINT",
+        "ACCOUNT"
+      ],
+      "enum_launch_stages": {
+        "ACCOUNT": "GA",
+        "ENDPOINT": "GA"
+      }
+    },
+    "provisioning.PrivateAccessSettings": {
+      "description": "*",
+      "fields": {
+        "account_id": {
+          "description": "The Databricks account ID that hosts the private access settings.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "allowed_vpc_endpoint_ids": {
+          "description": "An array of Databricks VPC endpoint IDs. This is the Databricks ID that is returned when registering the VPC endpoint configuration in your Databricks account. This is not the ID of the VPC endpoint in AWS.\nOnly used when private_access_level is set to ENDPOINT. This is an allow list of VPC endpoints that in your account that can connect to your workspace over AWS PrivateLink.\nIf hybrid access to your workspace is enabled by setting public_access_enabled to true, this control only works for PrivateLink connections. To control how your workspace is accessed via public internet, see IP access lists.",
+          "launch_stage": "GA"
+        },
+        "private_access_level": {
+          "description": "The private access level controls which VPC endpoints can connect to the UI or API of any workspace that attaches this private access settings object.\n`ACCOUNT` level access (the default) allows only VPC endpoints that are registered in your Databricks account connect to your workspace.\n`ENDPOINT` level access allows only specified VPC endpoints connect to your workspace. For details, see allowed_vpc_endpoint_ids.",
+          "ref": "provisioning.PrivateAccessLevel",
+          "launch_stage": "GA"
+        },
+        "private_access_settings_id": {
+          "description": "Databricks private access settings ID.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "private_access_settings_name": {
+          "description": "The human-readable name of the private access settings object.",
+          "launch_stage": "GA"
+        },
+        "public_access_enabled": {
+          "description": "Determines if the workspace can be accessed over public internet. For fully private workspaces, you can optionally specify false, but only if you implement both the front-end and the back-end PrivateLink connections. Otherwise, specify true, which means that public access is enabled.",
+          "launch_stage": "GA"
+        },
+        "region": {
+          "description": "The AWS region for workspaces attached to this private access settings object.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "provisioning.ReplacePrivateAccessSettingsRequest": {
+      "fields": {
+        "customer_facing_private_access_settings": {
+          "description": "Properties of the new private access settings object.",
+          "ref": "provisioning.PrivateAccessSettings",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "provisioning.RootBucketInfo": {
+      "fields": {
+        "bucket_name": {
+          "description": "Name of the S3 bucket",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "provisioning.StorageConfiguration": {
+      "fields": {
+        "account_id": {
+          "description": "The Databricks account ID associated with this storage configuration.",
+          "launch_stage": "GA"
+        },
+        "creation_time": {
+          "description": "Time in epoch milliseconds when the storage configuration was created.",
+          "launch_stage": "GA"
+        },
+        "role_arn": {
+          "description": "Optional IAM role that is used to access the workspace catalog which is created during workspace creation\nfor UC by Default. If a storage configuration with this field populated is used to create a workspace,\nthen a workspace catalog is created together with the workspace. The workspace catalog shares the root\nbucket with internal workspace storage (including DBFS root) but uses a dedicated bucket path prefix.",
+          "launch_stage": "GA"
+        },
+        "root_bucket_info": {
+          "description": "The root bucket information for the storage configuration.",
+          "ref": "provisioning.RootBucketInfo",
+          "launch_stage": "GA"
+        },
+        "storage_configuration_id": {
+          "description": "Databricks storage configuration ID.",
+          "launch_stage": "GA"
+        },
+        "storage_configuration_name": {
+          "description": "The human-readable name of the storage configuration.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "provisioning.StsRole": {
+      "fields": {
+        "role_arn": {
+          "description": "The Amazon Resource Name (ARN) of the cross account IAM role.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "provisioning.UpdateWorkspaceRequest": {
+      "fields": {
+        "customer_facing_workspace": {
+          "ref": "provisioning.Workspace",
+          "launch_stage": "GA"
+        },
+        "update_mask": {
+          "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "provisioning.VpcEndpoint": {
+      "description": "*",
+      "fields": {
+        "account_id": {
+          "description": "The Databricks account ID that hosts the VPC endpoint configuration.",
+          "launch_stage": "GA"
+        },
+        "aws_account_id": {
+          "description": "The AWS Account in which the VPC endpoint object exists.",
+          "launch_stage": "GA"
+        },
+        "aws_endpoint_service_id": {
+          "description": "The ID of the Databricks [endpoint service](https://docs.aws.amazon.com/vpc/latest/privatelink/endpoint-service.html) that this VPC endpoint is connected to. For a list of endpoint service IDs for each supported AWS region, see the [Databricks PrivateLink documentation](https://docs.databricks.com/administration-guide/cloud-configurations/aws/privatelink.html).",
+          "launch_stage": "GA"
+        },
+        "aws_vpc_endpoint_id": {
+          "description": "The ID of the VPC endpoint object in AWS.",
+          "launch_stage": "GA"
+        },
+        "gcp_vpc_endpoint_info": {
+          "description": "The cloud info of this vpc endpoint.\nInfo for a GCP vpc endpoint.",
+          "ref": "provisioning.GcpVpcEndpointInfo",
+          "launch_stage": "GA"
+        },
+        "region": {
+          "description": "The AWS region in which this VPC endpoint object exists.",
+          "launch_stage": "GA"
+        },
+        "state": {
+          "description": "The current state (such as `available` or `rejected`) of the VPC endpoint. Derived from AWS. For the full set of values, see [AWS DescribeVpcEndpoint documentation](https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-vpc-endpoints.html).",
+          "launch_stage": "GA"
+        },
+        "use_case": {
+          "description": "This enumeration represents the type of Databricks VPC endpoint service that was used when creating this VPC endpoint.\nIf the VPC endpoint connects to the Databricks control plane for either the front-end connection or the back-end REST API connection, the value is GENERAL_ACCESS.\nIf the VPC endpoint connects to the Databricks workspace for the back-end secure cluster connectivity relay, the value is DATAPLANE_RELAY_ACCESS.",
+          "ref": "provisioning.EndpointUseCase",
+          "launch_stage": "GA"
+        },
+        "vpc_endpoint_id": {
+          "description": "Databricks VPC endpoint ID. This is the Databricks-specific name of the VPC endpoint. Do not confuse this with the `aws_vpc_endpoint_id`, which is the ID within AWS of the VPC endpoint.",
+          "launch_stage": "GA"
+        },
+        "vpc_endpoint_name": {
+          "description": "The human-readable name of the storage configuration.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "provisioning.VpcStatus": {
+      "enum": [
+        "VALID",
+        "BROKEN",
+        "UNATTACHED",
+        "WARNED"
+      ],
+      "enum_launch_stages": {
+        "BROKEN": "GA",
+        "UNATTACHED": "GA",
+        "VALID": "GA",
+        "WARNED": "GA"
+      }
+    },
+    "provisioning.WarningType": {
+      "enum": [
+        "subnet",
+        "securityGroup"
+      ],
+      "enum_launch_stages": {
+        "securityGroup": "GA",
+        "subnet": "GA"
+      }
+    },
+    "provisioning.Workspace": {
+      "fields": {
+        "account_id": {
+          "description": "Databricks account ID.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "aws_region": {
+          "launch_stage": "GA"
+        },
+        "azure_workspace_info": {
+          "ref": "provisioning.AzureWorkspaceInfo",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "cloud": {
+          "description": "The cloud name. This field can have values like `azure`, `gcp`.",
+          "launch_stage": "GA"
+        },
+        "cloud_resource_container": {
+          "ref": "provisioning.CloudResourceContainer",
+          "launch_stage": "GA"
+        },
+        "compute_mode": {
+          "description": "The compute mode of the workspace.",
+          "ref": "provisioning.CustomerFacingComputeMode",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "creation_time": {
+          "description": "Time in epoch milliseconds when the workspace was created.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "credentials_id": {
+          "description": "ID of the workspace's credential configuration object.",
+          "launch_stage": "GA"
+        },
+        "custom_tags": {
+          "description": "The custom tags key-value pairing that is attached to this workspace. The key-value pair is a string of utf-8 characters. The value can be an empty string,\nwith maximum length of 255 characters. The key can be of maximum length of 127 characters, and cannot be empty.",
+          "launch_stage": "GA"
+        },
+        "deployment_name": {
+          "launch_stage": "GA"
+        },
+        "expected_workspace_status": {
+          "description": "A client owned field used to indicate the workspace status that the client expects to be in.\nFor now this is only used to unblock Temporal workflow for GCP least privileged workspace.",
+          "ref": "provisioning.WorkspaceStatus",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "gcp_managed_network_config": {
+          "ref": "provisioning.GcpManagedNetworkConfig",
+          "launch_stage": "GA"
+        },
+        "gke_config": {
+          "ref": "provisioning.GkeConfig",
+          "launch_stage": "GA"
+        },
+        "location": {
+          "description": "The Google Cloud region of the workspace data plane in your Google account (for example, `us-east4`).",
+          "launch_stage": "GA"
+        },
+        "managed_services_customer_managed_key_id": {
+          "description": "ID of the key configuration for encrypting managed services.",
+          "launch_stage": "GA"
+        },
+        "network": {
+          "description": "The network configuration for the workspace.\n\nDEPRECATED. Use `network_id` instead.",
+          "ref": "provisioning.WorkspaceNetwork",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "network_connectivity_config_id": {
+          "description": "The object ID of network connectivity config.",
+          "launch_stage": "GA"
+        },
+        "network_id": {
+          "description": "If this workspace is BYO VPC, then the network_id will be populated. If this workspace is not\nBYO VPC, then the network_id will be empty.",
+          "launch_stage": "GA"
+        },
+        "pricing_tier": {
+          "ref": "provisioning.PricingTier",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "private_access_settings_id": {
+          "description": "ID of the workspace's private access settings object. Only used for PrivateLink. You must specify this ID if you are using [AWS PrivateLink](https://aws.amazon.com/privatelink/) for either front-end (user-to-workspace connection), back-end (data plane to control plane connection), or both connection types.\n\nBefore configuring PrivateLink, read the [Databricks article about PrivateLink](https://docs.databricks.com/administration-guide/cloud-configurations/aws/privatelink.html).\",",
+          "launch_stage": "GA"
+        },
+        "storage_configuration_id": {
+          "description": "ID of the workspace's storage configuration object.",
+          "launch_stage": "GA"
+        },
+        "storage_customer_managed_key_id": {
+          "description": "ID of the key configuration for encrypting workspace storage.",
+          "launch_stage": "GA"
+        },
+        "storage_mode": {
+          "description": "The storage mode of the workspace.",
+          "ref": "provisioning.CustomerFacingStorageMode",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "workspace_id": {
+          "description": "A unique integer ID for the workspace",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "workspace_name": {
+          "description": "The human-readable name of the workspace.",
+          "launch_stage": "GA"
+        },
+        "workspace_status": {
+          "description": "The status of a workspace",
+          "ref": "provisioning.WorkspaceStatus",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "workspace_status_message": {
+          "description": "Message describing the current workspace status.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "provisioning.WorkspaceNetwork": {
+      "description": "The network configuration for workspaces.",
+      "fields": {
+        "gcp_common_network_config": {
+          "description": "The shared network config for GCP workspace.\nThis object has common network configurations that are network attributions of a workspace.\nThis object is input-only.",
+          "ref": "provisioning.GcpCommonNetworkConfig",
+          "launch_stage": "GA"
+        },
+        "gcp_managed_network_config": {
+          "description": "The mutually exclusive network deployment modes. The option decides which network mode the\nworkspace will use.\nThe network config for GCP workspace with Databricks managed network.\nThis object is input-only and will not be provided when listing workspaces.",
+          "ref": "provisioning.GcpManagedNetworkConfig",
+          "launch_stage": "GA"
+        },
+        "network_id": {
+          "description": "The ID of the network object, if the workspace is a BYOVPC workspace.\nThis should apply to workspaces on all clouds in internal services. In accounts-rest-api, user will use\nworkspace.network_id for input and output instead.\nCurrently (2021-06-19) the network ID is only used by GCP.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "provisioning.WorkspaceStatus": {
+      "description": "The different statuses of a workspace. The following represents the current set of valid\ntransitions from status to status:\nNOT_PROVISIONED\n-\u003e PROVISIONING\n-\u003e CANCELLED\nPROVISIONING\n-\u003e RUNNING\n-\u003e FAILED\n-\u003e CANCELLED (note that this transition is disallowed in the MultiWorkspace Project)\nRUNNING\n-\u003e PROVISIONING\n-\u003e BANNED\n-\u003e CANCELLED\nFAILED\n-\u003e PROVISIONING\n-\u003e CANCELLED\nBANNED\n-\u003e RUNNING\n-\u003e CANCELLED\nNote that a transition from any state to itself is also valid.",
+      "enum": [
+        "NOT_PROVISIONED",
+        "PROVISIONING",
+        "RUNNING",
+        "FAILED",
+        "BANNED",
+        "CANCELLING"
+      ],
+      "enum_launch_stages": {
+        "BANNED": "GA",
+        "CANCELLING": "GA",
+        "FAILED": "GA",
+        "NOT_PROVISIONED": "GA",
+        "PROVISIONING": "GA",
+        "RUNNING": "GA"
+      }
+    },
+    "qualitymonitorv2.AnomalyDetectionConfig": {
+      "fields": {
+        "excluded_table_full_names": {
+          "description": "List of fully qualified table names to exclude from anomaly detection.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "last_run_id": {
+          "description": "Run id of the last run of the workflow",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "latest_run_status": {
+          "description": "The status of the last run of the workflow.",
+          "ref": "qualitymonitorv2.AnomalyDetectionRunStatus",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "qualitymonitorv2.AnomalyDetectionRunStatus": {
+      "description": "Status of Anomaly Detection Job Run",
+      "enum": [
+        "ANOMALY_DETECTION_RUN_STATUS_UNKNOWN",
+        "ANOMALY_DETECTION_RUN_STATUS_RUNNING",
+        "ANOMALY_DETECTION_RUN_STATUS_CANCELED",
+        "ANOMALY_DETECTION_RUN_STATUS_PENDING",
+        "ANOMALY_DETECTION_RUN_STATUS_SUCCESS",
+        "ANOMALY_DETECTION_RUN_STATUS_FAILED",
+        "ANOMALY_DETECTION_RUN_STATUS_JOB_DELETED",
+        "ANOMALY_DETECTION_RUN_STATUS_WORKSPACE_MISMATCH_ERROR"
+      ],
+      "enum_launch_stages": {
+        "ANOMALY_DETECTION_RUN_STATUS_CANCELED": "PUBLIC_BETA",
+        "ANOMALY_DETECTION_RUN_STATUS_FAILED": "PUBLIC_BETA",
+        "ANOMALY_DETECTION_RUN_STATUS_JOB_DELETED": "PUBLIC_BETA",
+        "ANOMALY_DETECTION_RUN_STATUS_PENDING": "PUBLIC_BETA",
+        "ANOMALY_DETECTION_RUN_STATUS_RUNNING": "PUBLIC_BETA",
+        "ANOMALY_DETECTION_RUN_STATUS_SUCCESS": "PUBLIC_BETA",
+        "ANOMALY_DETECTION_RUN_STATUS_UNKNOWN": "PUBLIC_BETA",
+        "ANOMALY_DETECTION_RUN_STATUS_WORKSPACE_MISMATCH_ERROR": "PUBLIC_BETA"
+      }
+    },
+    "qualitymonitorv2.CreateQualityMonitorRequest": {
+      "fields": {
+        "quality_monitor": {
+          "ref": "qualitymonitorv2.QualityMonitor",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "qualitymonitorv2.DeleteQualityMonitorRequest": {},
+    "qualitymonitorv2.GetQualityMonitorRequest": {},
+    "qualitymonitorv2.ListQualityMonitorRequest": {
+      "fields": {
+        "page_size": {
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "qualitymonitorv2.ListQualityMonitorResponse": {
+      "fields": {
+        "next_page_token": {
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "quality_monitors": {
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "qualitymonitorv2.PercentNullValidityCheck": {
+      "fields": {
+        "column_names": {
+          "description": "List of column names to check for null percentage",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "upper_bound": {
+          "description": "Optional upper bound; we should use auto determined bounds for now",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "qualitymonitorv2.QualityMonitor": {
+      "fields": {
+        "anomaly_detection_config": {
+          "ref": "qualitymonitorv2.AnomalyDetectionConfig",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "object_id": {
+          "description": "The uuid of the request object. For example, schema id.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "object_type": {
+          "description": "The type of the monitored object. Can be one of the following: schema.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "validity_check_configurations": {
+          "description": "Validity check configurations for anomaly detection.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "INPUT_ONLY",
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "qualitymonitorv2.RangeValidityCheck": {
+      "fields": {
+        "column_names": {
+          "description": "List of column names to check for range validity",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "lower_bound": {
+          "description": "Lower bound for the range",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "upper_bound": {
+          "description": "Upper bound for the range",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "qualitymonitorv2.UniquenessValidityCheck": {
+      "fields": {
+        "column_names": {
+          "description": "List of column names to check for uniqueness",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "qualitymonitorv2.UpdateQualityMonitorRequest": {
+      "fields": {
+        "quality_monitor": {
+          "ref": "qualitymonitorv2.QualityMonitor",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "qualitymonitorv2.ValidityCheckConfiguration": {
+      "fields": {
+        "name": {
+          "description": "Can be set by system. Does not need to be user facing.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "percent_null_validity_check": {
+          "ref": "qualitymonitorv2.PercentNullValidityCheck",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "range_validity_check": {
+          "ref": "qualitymonitorv2.RangeValidityCheck",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "uniqueness_validity_check": {
+          "ref": "qualitymonitorv2.UniquenessValidityCheck",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "sandbox.Command": {
+      "description": "A single command execution.",
+      "fields": {
+        "args": {
+          "description": "Arguments passed to the program.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "cmd": {
+          "description": "The program that was executed.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "command_id": {
+          "description": "Stable identifier for this command.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "exit_code": {
+          "description": "Process exit code. Only present when finished is true and the process\nexited normally (not killed by signal or failed to start).",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "finished": {
+          "description": "Whether the command has finished executing.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "pid": {
+          "description": "PID of the spawned process. Absent if the process failed to start.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "sandbox.ComputeSpec": {
+      "fields": {
+        "inactivity_timeout": {
+          "description": "Idle duration after which the sandbox is automatically terminated.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "sandbox.CreateDirectoryRequest": {
+      "description": "Selects a sandbox directory to create and whether to create its parents.",
+      "fields": {
+        "parents": {
+          "description": "Defaults to true, which also succeeds when the directory already exists.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "path": {
+          "description": "Absolute UTF-8 path of the directory.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "sandbox.CreateDirectoryResponse": {
+      "description": "Confirms that the requested directory exists."
+    },
+    "sandbox.CreateSandboxRequest": {
+      "fields": {
+        "sandbox": {
+          "description": "The sandbox to create.",
+          "ref": "sandbox.Sandbox",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "sandbox_id": {
+          "description": "Client-supplied ID that becomes the final path segment of the resource name.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "sandbox.DeletePathRequest": {
+      "description": "Selects a sandbox path to delete and whether to delete its contents.",
+      "fields": {
+        "path": {
+          "description": "Absolute UTF-8 path of the entry to delete.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "recursive": {
+          "description": "Required for a non-empty directory.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "sandbox.DeletePathResponse": {
+      "description": "Confirms that the requested path is absent."
+    },
+    "sandbox.DeleteSandboxRequest": {},
+    "sandbox.EnvironmentSpec": {
+      "fields": {
+        "image_uri": {
+          "description": "A Unity Catalog container artifact (e.g. `catalog.schema.folder.image:tag`) to run as the\nsandbox environment. When set, this image is used as the environment instead of resolving a\nmanaged image from `environment_version`.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "sandbox.ExecuteCommandStatus": {
+      "description": "Terminal status of a unary command execution.",
+      "enum": [
+        "EXECUTE_COMMAND_STATUS_COMPLETED",
+        "EXECUTE_COMMAND_STATUS_TIMED_OUT",
+        "EXECUTE_COMMAND_STATUS_FAILED"
+      ],
+      "enum_launch_stages": {
+        "EXECUTE_COMMAND_STATUS_COMPLETED": "PUBLIC_BETA",
+        "EXECUTE_COMMAND_STATUS_FAILED": "PUBLIC_BETA",
+        "EXECUTE_COMMAND_STATUS_TIMED_OUT": "PUBLIC_BETA"
+      }
+    },
+    "sandbox.ExecuteCommandSyncRequest": {
+      "description": "Request to run a command in the given sandbox and wait for it to finish.",
+      "fields": {
+        "args": {
+          "description": "Arguments passed to `cmd`.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "cmd": {
+          "description": "Executable or command to run (e.g. `/bin/echo`, `python3`).",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "envs": {
+          "description": "Extra environment variables for the command's process, merged over the\nsandbox's default environment.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "execution_timeout": {
+          "description": "Maximum time to wait for the command to finish. When it elapses the\ncommand is terminated and the response carries status `TIMED_OUT`. The\nserver applies a default when unset and clamps to an upper bound; negative\nor otherwise invalid durations are rejected with `INVALID_ARGUMENT`.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "sandbox.ExecuteCommandSyncResponse": {
+      "description": "Result of a completed unary command execution: captured output, exit code,\nand terminal status.",
+      "fields": {
+        "command_id": {
+          "description": "Daemon-generated identifier for this command execution, for correlation\n(for example in `ListCommands`).",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "exit_code": {
+          "description": "Process exit code. Unset when the process was terminated by a signal\n(e.g. on `TIMED_OUT`) or never started (`FAILED`) rather than exiting\nnormally.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "status": {
+          "description": "Terminal status of the command execution. Always set on a successful\nresponse; never `EXECUTE_COMMAND_STATUS_UNSPECIFIED`.",
+          "ref": "sandbox.ExecuteCommandStatus",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "stderr": {
+          "description": "Captured standard error, with the same UTF-8 semantics as `stdout`.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "stdout": {
+          "description": "Captured standard output as UTF-8 text. Invalid UTF-8 bytes are replaced\nwith the Unicode replacement character (U+FFFD).",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "truncated": {
+          "description": "True when `stdout` / `stderr` were truncated because the captured output\nexceeded the server's per-response size cap. The dropped output is not\nincluded in this response and is not recoverable through this unary API.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "sandbox.GetMetadataRequest": {
+      "fields": {
+        "path": {
+          "description": "Absolute UTF-8 path of the entry to inspect.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "sandbox.GetMetadataResponse": {
+      "description": "Contains metadata for the requested path without following its final symlink.",
+      "fields": {
+        "file": {
+          "ref": "sandbox.SandboxFileInfo",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "sandbox.GetSandboxRequest": {},
+    "sandbox.ListCommandsRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Maximum number of commands to return. The server may return fewer.\nIf unspecified, the server returns all commands.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Page token returned by a previous ListCommands call. Use this to\nretrieve the next page of results.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "sandbox.ListCommandsResponse": {
+      "description": "Response listing tracked command executions.",
+      "fields": {
+        "commands": {
+          "description": "Commands in this page of results.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "next_page_token": {
+          "description": "Token to retrieve the next page. Empty when there are no more results.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "sandbox.ListDirectoryContentsRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Zero uses the default of 1000; values above 1000 are clamped to 1000.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "page_token": {
+          "description": "The token from a prior response. Keep parent and path unchanged between pages.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "path": {
+          "description": "Absolute UTF-8 path of the directory.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "sandbox.ListDirectoryContentsResponse": {
+      "description": "Contains a page of immediate directory entries and an optional continuation token.\nAn empty token marks the final page. Pages reflect concurrent directory changes.",
+      "fields": {
+        "contents": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "next_page_token": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "sandbox.ListSandboxesRequest": {
+      "fields": {
+        "page_size": {
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "sandbox.ListSandboxesResponse": {
+      "description": "A list of Sandboxes.",
+      "fields": {
+        "next_page_token": {
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "sandboxes": {
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "sandbox.RenamePathRequest": {
+      "description": "Identifies the source and exact destination for a sandbox path rename.",
+      "fields": {
+        "destination": {
+          "description": "Exact absolute UTF-8 destination; it must not already exist.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "source": {
+          "description": "Absolute UTF-8 path to move.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "sandbox.RenamePathResponse": {
+      "description": "Confirms that the sandbox path was renamed."
+    },
+    "sandbox.Sandbox": {
+      "description": "A Sandbox resource representing an execution environment.",
+      "fields": {
+        "create_time": {
+          "description": "Output only. The creation time of the sandbox.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "display_name": {
+          "description": "Human-readable display label for the sandbox. At most 256 characters.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "name": {
+          "description": "The sandbox resource name, in the form `sandboxes/{sandbox_id}`. Derived from\n`sandbox_id`; any value supplied in a create or update request body is ignored.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "spec": {
+          "description": "The desired configuration of the sandbox, supplied by the caller at creation time.",
+          "ref": "sandbox.SandboxSpec",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "status": {
+          "description": "The observed runtime state of the sandbox, populated by the server.",
+          "ref": "sandbox.SandboxStatus",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "update_time": {
+          "description": "Output only. The last update time of the sandbox metadata and spec.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "sandbox.SandboxFileInfo": {
+      "description": "Metadata for a sandbox filesystem entry, describing a final symlink itself.",
+      "fields": {
+        "file_type": {
+          "ref": "sandbox.SandboxFileType",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "group": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "mode": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "modify_time": {
+          "description": "Nanosecond precision is preserved on the wire.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "name": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "owner": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "path": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "permissions": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "size": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "symlink_target": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "sandbox.SandboxFileType": {
+      "description": "Type of a sandbox filesystem entry without following its final symlink.",
+      "enum": [
+        "SANDBOX_FILE_TYPE_FILE",
+        "SANDBOX_FILE_TYPE_DIRECTORY",
+        "SANDBOX_FILE_TYPE_SYMLINK",
+        "SANDBOX_FILE_TYPE_OTHER"
+      ],
+      "enum_launch_stages": {
+        "SANDBOX_FILE_TYPE_DIRECTORY": "PRIVATE_PREVIEW",
+        "SANDBOX_FILE_TYPE_FILE": "PRIVATE_PREVIEW",
+        "SANDBOX_FILE_TYPE_OTHER": "PRIVATE_PREVIEW",
+        "SANDBOX_FILE_TYPE_SYMLINK": "PRIVATE_PREVIEW"
+      }
+    },
+    "sandbox.SandboxSpec": {
+      "fields": {
+        "compute": {
+          "description": "Compute configuration (size, inactivity timeout) requested for the sandbox.",
+          "ref": "sandbox.ComputeSpec",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "environment": {
+          "description": "The execution environment to use for the sandbox.",
+          "ref": "sandbox.EnvironmentSpec",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "sandbox.SandboxState": {
+      "description": "Lifecycle state of a Sandbox resource. STOPPING is the transient state while the\nsandbox is being stopped -- by a Stop request or inactivity auto-termination\n-- and settles to STOPPED once the operation completes.",
+      "enum": [
+        "SANDBOX_STATE_PENDING",
+        "SANDBOX_STATE_RUNNING",
+        "SANDBOX_STATE_STOPPED",
+        "SANDBOX_STATE_STOPPING"
+      ],
+      "enum_launch_stages": {
+        "SANDBOX_STATE_PENDING": "PUBLIC_BETA",
+        "SANDBOX_STATE_RUNNING": "PUBLIC_BETA",
+        "SANDBOX_STATE_STOPPED": "PUBLIC_BETA",
+        "SANDBOX_STATE_STOPPING": "PUBLIC_BETA"
+      }
+    },
+    "sandbox.SandboxStatus": {
+      "fields": {
+        "state": {
+          "description": "Lifecycle state of the sandbox.",
+          "ref": "sandbox.SandboxState",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "sandbox.StartSandboxRequest": {
+      "description": "A request to start a Sandbox."
+    },
+    "sandbox.StopSandboxRequest": {
+      "description": "A request to stop a Sandbox."
+    },
+    "sandbox.UpdateSandboxRequest": {
+      "fields": {
+        "sandbox": {
+          "description": "The Sandbox resource carrying new field values. Only fields named in\n`update_mask` are read; unmasked fields are ignored.",
+          "ref": "sandbox.Sandbox",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "update_mask": {
+          "description": "Field paths to update. Must be a non-empty subset of:\n- display_name\n- spec.compute.inactivity_timeout\nAny other path returns INVALID_PARAMETER_VALUE.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "serving.Ai21LabsConfig": {
+      "fields": {
+        "ai21labs_api_key": {
+          "description": "The Databricks secret key reference for an AI21 Labs API key. If you\nprefer to paste your API key directly, see `ai21labs_api_key_plaintext`.\nYou must provide an API key using one of the following fields:\n`ai21labs_api_key` or `ai21labs_api_key_plaintext`.",
+          "launch_stage": "GA"
+        },
+        "ai21labs_api_key_plaintext": {
+          "description": "An AI21 Labs API key provided as a plaintext string. If you prefer to\nreference your key using Databricks Secrets, see `ai21labs_api_key`. You\nmust provide an API key using one of the following fields:\n`ai21labs_api_key` or `ai21labs_api_key_plaintext`.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "INPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "serving.AiGatewayConfig": {
+      "fields": {
+        "fallback_config": {
+          "description": "Configuration for traffic fallback which auto fallbacks to other served entities if the request to a served\nentity fails with certain error codes, to increase availability.",
+          "ref": "serving.FallbackConfig",
+          "launch_stage": "GA"
+        },
+        "guardrails": {
+          "description": "Configuration for AI Guardrails to prevent unwanted data and unsafe data in requests and responses.",
+          "ref": "serving.AiGatewayGuardrails",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "inference_table_config": {
+          "description": "Configuration for payload logging using inference tables.\nUse these tables to monitor and audit data being sent to and received from model APIs and to improve model quality.",
+          "ref": "serving.AiGatewayInferenceTableConfig",
+          "launch_stage": "GA"
+        },
+        "rate_limits": {
+          "description": "Configuration for rate limits which can be set to limit endpoint traffic.",
+          "launch_stage": "GA"
+        },
+        "usage_tracking_config": {
+          "description": "Configuration to enable usage tracking using system tables.\nThese tables allow you to monitor operational usage on endpoints and their associated costs.",
+          "ref": "serving.AiGatewayUsageTrackingConfig",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.AiGatewayGuardrailParameters": {
+      "fields": {
+        "invalid_keywords": {
+          "description": "List of invalid keywords.\nAI guardrail uses keyword or string matching to decide if the keyword exists in the request or response content.",
+          "deprecated": true,
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "pii": {
+          "description": "Configuration for guardrail PII filter.",
+          "ref": "serving.AiGatewayGuardrailPiiBehavior",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "safety": {
+          "description": "Indicates whether the safety filter is enabled.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "valid_topics": {
+          "description": "The list of allowed topics.\nGiven a chat request, this guardrail flags the request if its topic is not in the allowed topics.",
+          "deprecated": true,
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "serving.AiGatewayGuardrailPiiBehavior": {
+      "fields": {
+        "behavior": {
+          "description": "Configuration for input guardrail filters.",
+          "ref": "serving.AiGatewayGuardrailPiiBehaviorBehavior",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "serving.AiGatewayGuardrailPiiBehaviorBehavior": {
+      "enum": [
+        "NONE",
+        "BLOCK",
+        "MASK"
+      ],
+      "enum_launch_stages": {
+        "BLOCK": "PUBLIC_PREVIEW",
+        "MASK": "PUBLIC_PREVIEW",
+        "NONE": "PUBLIC_PREVIEW"
+      }
+    },
+    "serving.AiGatewayGuardrails": {
+      "fields": {
+        "input": {
+          "description": "Configuration for input guardrail filters.",
+          "ref": "serving.AiGatewayGuardrailParameters",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "output": {
+          "description": "Configuration for output guardrail filters.",
+          "ref": "serving.AiGatewayGuardrailParameters",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "serving.AiGatewayInferenceTableConfig": {
+      "fields": {
+        "catalog_name": {
+          "description": "The name of the catalog in Unity Catalog. Required when enabling inference tables.\nNOTE: On update, you have to disable inference table first in order to change the catalog name.",
+          "launch_stage": "GA"
+        },
+        "enabled": {
+          "description": "Indicates whether the inference table is enabled.",
+          "launch_stage": "GA"
+        },
+        "schema_name": {
+          "description": "The name of the schema in Unity Catalog. Required when enabling inference tables.\nNOTE: On update, you have to disable inference table first in order to change the schema name.",
+          "launch_stage": "GA"
+        },
+        "table_name_prefix": {
+          "description": "The prefix of the table in Unity Catalog.\nNOTE: On update, you have to disable inference table first in order to change the prefix name.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.AiGatewayRateLimit": {
+      "fields": {
+        "calls": {
+          "description": "Used to specify how many calls are allowed for a key within the renewal_period.",
+          "launch_stage": "GA"
+        },
+        "key": {
+          "description": "Key field for a rate limit. Currently, 'user', 'user_group, 'service_principal', and 'endpoint' are supported,\nwith 'endpoint' being the default if not specified.",
+          "ref": "serving.AiGatewayRateLimitKey",
+          "launch_stage": "GA"
+        },
+        "principal": {
+          "description": "Principal field for a user, user group, or service principal to apply rate limiting to. Accepts a user email, group name, or service principal application ID.",
+          "launch_stage": "GA"
+        },
+        "renewal_period": {
+          "description": "Renewal period field for a rate limit. Currently, only 'minute' is supported.",
+          "ref": "serving.AiGatewayRateLimitRenewalPeriod",
+          "launch_stage": "GA"
+        },
+        "tokens": {
+          "description": "Used to specify how many tokens are allowed for a key within the renewal_period.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.AiGatewayRateLimitKey": {
+      "enum": [
+        "user",
+        "endpoint",
+        "user_group",
+        "service_principal"
+      ],
+      "enum_launch_stages": {
+        "endpoint": "PUBLIC_PREVIEW",
+        "service_principal": "PUBLIC_PREVIEW",
+        "user": "PUBLIC_PREVIEW",
+        "user_group": "PUBLIC_PREVIEW"
+      }
+    },
+    "serving.AiGatewayRateLimitRenewalPeriod": {
+      "enum": [
+        "minute"
+      ],
+      "enum_launch_stages": {
+        "minute": "PUBLIC_PREVIEW"
+      }
+    },
+    "serving.AiGatewayUsageTrackingConfig": {
+      "fields": {
+        "enabled": {
+          "description": "Whether to enable usage tracking.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.AmazonBedrockConfig": {
+      "fields": {
+        "aws_access_key_id": {
+          "description": "The Databricks secret key reference for an AWS access key ID with\npermissions to interact with Bedrock services. If you prefer to paste\nyour API key directly, see `aws_access_key_id_plaintext`. You must provide an API\nkey using one of the following fields: `aws_access_key_id` or\n`aws_access_key_id_plaintext`.",
+          "launch_stage": "GA"
+        },
+        "aws_access_key_id_plaintext": {
+          "description": "An AWS access key ID with permissions to interact with Bedrock services\nprovided as a plaintext string. If you prefer to reference your key using\nDatabricks Secrets, see `aws_access_key_id`. You must provide an API key\nusing one of the following fields: `aws_access_key_id` or\n`aws_access_key_id_plaintext`.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "INPUT_ONLY"
+          ]
+        },
+        "aws_region": {
+          "description": "The AWS region to use. Bedrock has to be enabled there.",
+          "launch_stage": "GA"
+        },
+        "aws_secret_access_key": {
+          "description": "The Databricks secret key reference for an AWS secret access key paired\nwith the access key ID, with permissions to interact with Bedrock\nservices. If you prefer to paste your API key directly, see\n`aws_secret_access_key_plaintext`. You must provide an API key using one\nof the following fields: `aws_secret_access_key` or\n`aws_secret_access_key_plaintext`.",
+          "launch_stage": "GA"
+        },
+        "aws_secret_access_key_plaintext": {
+          "description": "An AWS secret access key paired with the access key ID, with permissions\nto interact with Bedrock services provided as a plaintext string. If you\nprefer to reference your key using Databricks Secrets, see\n`aws_secret_access_key`. You must provide an API key using one of the\nfollowing fields: `aws_secret_access_key` or\n`aws_secret_access_key_plaintext`.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "INPUT_ONLY"
+          ]
+        },
+        "bedrock_provider": {
+          "description": "The underlying provider in Amazon Bedrock. Supported values (case\ninsensitive) include: Anthropic, Cohere, AI21Labs, Amazon.",
+          "ref": "serving.AmazonBedrockConfigBedrockProvider",
+          "launch_stage": "GA"
+        },
+        "instance_profile_arn": {
+          "description": "ARN of the instance profile that the external model will use to access AWS resources.\nYou must authenticate using an instance profile or access keys.\nIf you prefer to authenticate using access keys, see `aws_access_key_id`,\n`aws_access_key_id_plaintext`, `aws_secret_access_key` and `aws_secret_access_key_plaintext`.",
+          "launch_stage": "GA"
+        },
+        "uc_service_credential_name": {
+          "description": "The name of the Unity Catalog service credential that the external model uses to access AWS\nresources.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "serving.AmazonBedrockConfigBedrockProvider": {
+      "enum": [
+        "anthropic",
+        "cohere",
+        "ai21labs",
+        "amazon"
+      ],
+      "enum_launch_stages": {
+        "ai21labs": "PUBLIC_PREVIEW",
+        "amazon": "PUBLIC_PREVIEW",
+        "anthropic": "PUBLIC_PREVIEW",
+        "cohere": "PUBLIC_PREVIEW"
+      }
+    },
+    "serving.AnthropicConfig": {
+      "fields": {
+        "anthropic_api_key": {
+          "description": "The Databricks secret key reference for an Anthropic API key. If you\nprefer to paste your API key directly, see `anthropic_api_key_plaintext`.\nYou must provide an API key using one of the following fields:\n`anthropic_api_key` or `anthropic_api_key_plaintext`.",
+          "launch_stage": "GA"
+        },
+        "anthropic_api_key_plaintext": {
+          "description": "The Anthropic API key provided as a plaintext string. If you prefer to\nreference your key using Databricks Secrets, see `anthropic_api_key`. You\nmust provide an API key using one of the following fields:\n`anthropic_api_key` or `anthropic_api_key_plaintext`.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "INPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "serving.ApiKeyAuth": {
+      "fields": {
+        "key": {
+          "description": "The name of the API key parameter used for authentication.",
+          "launch_stage": "GA"
+        },
+        "value": {
+          "description": "The Databricks secret key reference for an API Key.\nIf you prefer to paste your token directly, see `value_plaintext`.",
+          "launch_stage": "GA"
+        },
+        "value_plaintext": {
+          "description": "The API Key provided as a plaintext string. If you prefer to reference your\ntoken using Databricks Secrets, see `value`.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "INPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "serving.AutoCaptureConfigInput": {
+      "description": "Deprecated: legacy inference table configuration. Please use AI Gateway inference tables instead.\nSee https://docs.databricks.com/aws/en/ai-gateway/inference-tables.",
+      "fields": {
+        "catalog_name": {
+          "description": "The name of the catalog in Unity Catalog. NOTE: On update, you cannot change the catalog name if the inference table is already enabled.",
+          "launch_stage": "GA"
+        },
+        "enabled": {
+          "description": "Indicates whether the inference table is enabled.",
+          "launch_stage": "GA"
+        },
+        "schema_name": {
+          "description": "The name of the schema in Unity Catalog. NOTE: On update, you cannot change the schema name if the inference table is already enabled.",
+          "launch_stage": "GA"
+        },
+        "table_name_prefix": {
+          "description": "The prefix of the table in Unity Catalog. NOTE: On update, you cannot change the prefix name if the inference table is already enabled.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.AutoCaptureConfigOutput": {
+      "description": "Deprecated: legacy inference table configuration. Please use AI Gateway inference tables instead.\nSee https://docs.databricks.com/aws/en/ai-gateway/inference-tables.",
+      "fields": {
+        "catalog_name": {
+          "description": "The name of the catalog in Unity Catalog. NOTE: On update, you cannot change the catalog name if the inference table is already enabled.",
+          "launch_stage": "GA"
+        },
+        "enabled": {
+          "description": "Indicates whether the inference table is enabled.",
+          "launch_stage": "GA"
+        },
+        "schema_name": {
+          "description": "The name of the schema in Unity Catalog. NOTE: On update, you cannot change the schema name if the inference table is already enabled.",
+          "launch_stage": "GA"
+        },
+        "state": {
+          "ref": "serving.AutoCaptureState",
+          "launch_stage": "GA"
+        },
+        "table_name_prefix": {
+          "description": "The prefix of the table in Unity Catalog. NOTE: On update, you cannot change the prefix name if the inference table is already enabled.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.AutoCaptureState": {
+      "fields": {
+        "payload_table": {
+          "ref": "serving.PayloadTable",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.BearerTokenAuth": {
+      "fields": {
+        "token": {
+          "description": "The Databricks secret key reference for a token.\nIf you prefer to paste your token directly, see `token_plaintext`.",
+          "launch_stage": "GA"
+        },
+        "token_plaintext": {
+          "description": "The token provided as a plaintext string. If you prefer to reference your\ntoken using Databricks Secrets, see `token`.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "INPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "serving.BuildLogsRequest": {},
+    "serving.BuildLogsResponse": {
+      "fields": {
+        "logs": {
+          "description": "The logs associated with building the served entity's environment.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.ChatMessage": {
+      "fields": {
+        "content": {
+          "description": "The content of the message.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "role": {
+          "description": "The role of the message. One of [system, user, assistant].",
+          "ref": "serving.ChatMessageRole",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "serving.ChatMessageRole": {
+      "description": "The role of the message. One of [system, user, assistant].",
+      "enum": [
+        "system",
+        "user",
+        "assistant"
+      ],
+      "enum_launch_stages": {
+        "assistant": "PUBLIC_PREVIEW",
+        "system": "PUBLIC_PREVIEW",
+        "user": "PUBLIC_PREVIEW"
+      }
+    },
+    "serving.CohereConfig": {
+      "fields": {
+        "cohere_api_base": {
+          "description": "This is an optional field to provide a customized base URL for the Cohere\nAPI. If left unspecified, the standard Cohere base URL is used.",
+          "launch_stage": "GA"
+        },
+        "cohere_api_key": {
+          "description": "The Databricks secret key reference for a Cohere API key. If you prefer\nto paste your API key directly, see `cohere_api_key_plaintext`. You must\nprovide an API key using one of the following fields: `cohere_api_key` or\n`cohere_api_key_plaintext`.",
+          "launch_stage": "GA"
+        },
+        "cohere_api_key_plaintext": {
+          "description": "The Cohere API key provided as a plaintext string. If you prefer to\nreference your key using Databricks Secrets, see `cohere_api_key`. You\nmust provide an API key using one of the following fields:\n`cohere_api_key` or `cohere_api_key_plaintext`.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "INPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "serving.CreatePtEndpointRequest": {
+      "fields": {
+        "ai_gateway": {
+          "description": "The AI Gateway configuration for the serving endpoint.",
+          "ref": "serving.AiGatewayConfig",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "budget_policy_id": {
+          "description": "The budget policy associated with the endpoint.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "config": {
+          "description": "The core config of the serving endpoint.",
+          "ref": "serving.PtEndpointCoreConfig",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "email_notifications": {
+          "description": "Email notification settings.",
+          "ref": "serving.EmailNotifications",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "name": {
+          "description": "The name of the serving endpoint. This field is required and must be unique across a Databricks workspace.\nAn endpoint name can consist of alphanumeric characters, dashes, and underscores.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "tags": {
+          "description": "Tags to be attached to the serving endpoint and automatically propagated to billing logs.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "serving.CreateServingEndpoint": {
+      "fields": {
+        "ai_gateway": {
+          "description": "The AI Gateway configuration for the serving endpoint. NOTE: External model, provisioned throughput, and pay-per-token endpoints are fully supported; agent endpoints currently only support inference tables.",
+          "ref": "serving.AiGatewayConfig",
+          "launch_stage": "GA"
+        },
+        "budget_policy_id": {
+          "description": "The budget policy to be applied to the serving endpoint.",
+          "launch_stage": "GA"
+        },
+        "config": {
+          "description": "The core config of the serving endpoint.",
+          "ref": "serving.EndpointCoreConfigInput",
+          "launch_stage": "GA"
+        },
+        "description": {
+          "launch_stage": "GA"
+        },
+        "email_notifications": {
+          "description": "Email notification settings.",
+          "ref": "serving.EmailNotifications",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The name of the serving endpoint. This field is required and must be unique across a Databricks workspace.\nAn endpoint name can consist of alphanumeric characters, dashes, and underscores.",
+          "launch_stage": "GA"
+        },
+        "rate_limits": {
+          "description": "Rate limits to be applied to the serving endpoint. NOTE: this field is deprecated, please use AI Gateway to manage rate limits.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "route_optimized": {
+          "description": "Enable route optimization for the serving endpoint.",
+          "launch_stage": "GA"
+        },
+        "tags": {
+          "description": "Tags to be attached to the serving endpoint and automatically propagated to billing logs.",
+          "launch_stage": "GA"
+        },
+        "telemetry_config": {
+          "description": "Configuration for persisting endpoint telemetry (logs, traces, and metrics) to Unity Catalog tables.",
+          "ref": "serving.TelemetryConfig",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "serving.CustomProviderConfig": {
+      "description": "Configs needed to create a custom provider model route.",
+      "fields": {
+        "api_key_auth": {
+          "description": "This is a field to provide API key authentication for the custom provider API.\nYou can only specify one authentication method.",
+          "ref": "serving.ApiKeyAuth",
+          "launch_stage": "GA"
+        },
+        "bearer_token_auth": {
+          "description": "This is a field to provide bearer token authentication for the custom provider API.\nYou can only specify one authentication method.",
+          "ref": "serving.BearerTokenAuth",
+          "launch_stage": "GA"
+        },
+        "custom_provider_url": {
+          "description": "This is a field to provide the URL of the custom provider API.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.DataPlaneInfo": {
+      "description": "Details necessary to query this object's API through the DataPlane APIs.",
+      "fields": {
+        "authorization_details": {
+          "description": "Authorization details as a string.",
+          "launch_stage": "GA"
+        },
+        "endpoint_url": {
+          "description": "The URL of the endpoint for this operation in the dataplane.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.DatabricksModelServingConfig": {
+      "fields": {
+        "databricks_api_token": {
+          "description": "The Databricks secret key reference for a Databricks API token that\ncorresponds to a user or service principal with Can Query access to the\nmodel serving endpoint pointed to by this external model. If you prefer\nto paste your API key directly, see `databricks_api_token_plaintext`. You\nmust provide an API key using one of the following fields:\n`databricks_api_token` or `databricks_api_token_plaintext`.",
+          "launch_stage": "GA"
+        },
+        "databricks_api_token_plaintext": {
+          "description": "The Databricks API token that corresponds to a user or service principal\nwith Can Query access to the model serving endpoint pointed to by this\nexternal model provided as a plaintext string. If you prefer to reference\nyour key using Databricks Secrets, see `databricks_api_token`. You must\nprovide an API key using one of the following fields:\n`databricks_api_token` or `databricks_api_token_plaintext`.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "INPUT_ONLY"
+          ]
+        },
+        "databricks_workspace_url": {
+          "description": "The URL of the Databricks workspace containing the model serving endpoint\npointed to by this external model.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.DataframeSplitInput": {
+      "fields": {
+        "columns": {
+          "description": "Columns array for the dataframe",
+          "launch_stage": "GA"
+        },
+        "data": {
+          "description": "Data array for the dataframe",
+          "launch_stage": "GA"
+        },
+        "index": {
+          "description": "Index array for the dataframe",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.DeleteServingEndpointRequest": {},
+    "serving.EmailNotifications": {
+      "fields": {
+        "on_update_failure": {
+          "description": "A list of email addresses to be notified when an endpoint fails to update its configuration or state.",
+          "launch_stage": "GA"
+        },
+        "on_update_success": {
+          "description": "A list of email addresses to be notified when an endpoint successfully updates its configuration or state.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.EmbeddingsV1ResponseEmbeddingElement": {
+      "fields": {
+        "embedding": {
+          "description": "The embedding vector",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "index": {
+          "description": "The index of the embedding in the response.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "object": {
+          "description": "This will always be 'embedding'.",
+          "ref": "serving.EmbeddingsV1ResponseEmbeddingElementObject",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "serving.EmbeddingsV1ResponseEmbeddingElementObject": {
+      "description": "This will always be 'embedding'.",
+      "enum": [
+        "embedding"
+      ],
+      "enum_launch_stages": {
+        "embedding": "PUBLIC_PREVIEW"
+      }
+    },
+    "serving.EndpointCoreConfigInput": {
+      "fields": {
+        "auto_capture_config": {
+          "description": "Configuration for legacy Inference Tables which automatically log requests and responses to Unity\nCatalog.\nDeprecated: please use AI Gateway inference tables instead. See\nhttps://docs.databricks.com/aws/en/ai-gateway/inference-tables.",
+          "ref": "serving.AutoCaptureConfigInput",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "served_entities": {
+          "description": "The list of served entities under the serving endpoint config.",
+          "launch_stage": "GA"
+        },
+        "served_models": {
+          "description": "(Deprecated, use served_entities instead) The list of served models under the serving endpoint config.",
+          "launch_stage": "GA"
+        },
+        "traffic_config": {
+          "description": "The traffic configuration associated with the serving endpoint config.",
+          "ref": "serving.TrafficConfig",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.EndpointCoreConfigOutput": {
+      "fields": {
+        "auto_capture_config": {
+          "description": "Configuration for legacy Inference Tables which automatically log requests and responses to Unity\nCatalog.\nDeprecated: please use AI Gateway inference tables instead. See\nhttps://docs.databricks.com/aws/en/ai-gateway/inference-tables.",
+          "ref": "serving.AutoCaptureConfigOutput",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "config_version": {
+          "description": "The config version that the serving endpoint is currently serving.",
+          "launch_stage": "GA"
+        },
+        "served_entities": {
+          "description": "The list of served entities under the serving endpoint config.",
+          "launch_stage": "GA"
+        },
+        "served_models": {
+          "description": "(Deprecated, use served_entities instead) The list of served models under the serving endpoint config.",
+          "launch_stage": "GA"
+        },
+        "traffic_config": {
+          "description": "The traffic configuration associated with the serving endpoint config.",
+          "ref": "serving.TrafficConfig",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.EndpointCoreConfigSummary": {
+      "fields": {
+        "served_entities": {
+          "description": "The list of served entities under the serving endpoint config.",
+          "launch_stage": "GA"
+        },
+        "served_models": {
+          "description": "(Deprecated, use served_entities instead) The list of served models under the serving endpoint config.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.EndpointPendingConfig": {
+      "fields": {
+        "auto_capture_config": {
+          "description": "Configuration for legacy Inference Tables which automatically log requests and responses to Unity\nCatalog.\nDeprecated: please use AI Gateway inference tables instead. See\nhttps://docs.databricks.com/aws/en/ai-gateway/inference-tables.",
+          "ref": "serving.AutoCaptureConfigOutput",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "config_version": {
+          "description": "The config version that the serving endpoint is currently serving.",
+          "launch_stage": "GA"
+        },
+        "served_entities": {
+          "description": "The list of served entities belonging to the last issued update to the serving endpoint.",
+          "launch_stage": "GA"
+        },
+        "served_models": {
+          "description": "(Deprecated, use served_entities instead) The list of served models belonging to the last issued update to the serving endpoint.",
+          "launch_stage": "GA"
+        },
+        "start_time": {
+          "description": "The timestamp when the update to the pending config started.",
+          "launch_stage": "GA"
+        },
+        "traffic_config": {
+          "description": "The traffic config defining how invocations to the serving endpoint should be routed.",
+          "ref": "serving.TrafficConfig",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.EndpointState": {
+      "fields": {
+        "config_update": {
+          "description": "The state of an endpoint's config update. This informs the user if the pending_config is in progress, if the\nupdate failed, or if there is no update in progress. Note that if the endpoint's config_update state value is\nIN_PROGRESS, another update can not be made until the update completes or fails.",
+          "ref": "serving.EndpointStateConfigUpdate",
+          "launch_stage": "GA"
+        },
+        "ready": {
+          "description": "The state of an endpoint, indicating whether or not the endpoint is queryable. An endpoint is READY if all of\nthe served entities in its active configuration are ready. If any of the actively served entities are in a\nnon-ready state, the endpoint state will be NOT_READY.",
+          "ref": "serving.EndpointStateReady",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.EndpointStateConfigUpdate": {
+      "enum": [
+        "NOT_UPDATING",
+        "IN_PROGRESS",
+        "UPDATE_FAILED",
+        "UPDATE_CANCELED"
+      ],
+      "enum_launch_stages": {
+        "IN_PROGRESS": "GA",
+        "NOT_UPDATING": "GA",
+        "UPDATE_CANCELED": "GA",
+        "UPDATE_FAILED": "GA"
+      }
+    },
+    "serving.EndpointStateReady": {
+      "enum": [
+        "READY",
+        "NOT_READY"
+      ],
+      "enum_launch_stages": {
+        "NOT_READY": "GA",
+        "READY": "GA"
+      }
+    },
+    "serving.EndpointTag": {
+      "fields": {
+        "key": {
+          "description": "Key field for a serving endpoint tag.",
+          "launch_stage": "GA"
+        },
+        "value": {
+          "description": "Optional value field for a serving endpoint tag.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.EndpointTags": {
+      "fields": {
+        "tags": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.ExportMetricsRequest": {},
+    "serving.ExportMetricsResponse": {
+      "fields": {
+        "contents": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.ExternalFunctionRequest": {
+      "description": "Simple Proto message for testing",
+      "fields": {
+        "connection_name": {
+          "description": "The connection name to use. This is required to identify the external connection.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "headers": {
+          "description": "Additional headers for the request. If not provided, only auth headers from connections would be passed.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "json": {
+          "description": "The JSON payload to send in the request body.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "method": {
+          "description": "The HTTP method to use (e.g., 'GET', 'POST').",
+          "ref": "serving.ExternalFunctionRequestHttpMethod",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "params": {
+          "description": "Query parameters for the request.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "path": {
+          "description": "The relative path for the API endpoint. This is required.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "sub_domain": {
+          "description": "Optional subdomain to prepend to the connection URL's host. If provided, this will be\nadded as a prefix to the connection URL's host. For example, if the connection URL is\n`https://api.example.com/v1` and `sub_domain` is `\"custom\"`, the resulting URL will be\n`https://custom.api.example.com/v1`.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "serving.ExternalFunctionRequestHttpMethod": {
+      "enum": [
+        "GET",
+        "POST",
+        "PUT",
+        "DELETE",
+        "PATCH"
+      ],
+      "enum_launch_stages": {
+        "DELETE": "PRIVATE_PREVIEW",
+        "GET": "PRIVATE_PREVIEW",
+        "PATCH": "PRIVATE_PREVIEW",
+        "POST": "PRIVATE_PREVIEW",
+        "PUT": "PRIVATE_PREVIEW"
+      }
+    },
+    "serving.ExternalModel": {
+      "fields": {
+        "ai21labs_config": {
+          "description": "AI21Labs Config. Only required if the provider is 'ai21labs'.",
+          "ref": "serving.Ai21LabsConfig",
+          "launch_stage": "GA"
+        },
+        "amazon_bedrock_config": {
+          "description": "Amazon Bedrock Config. Only required if the provider is 'amazon-bedrock'.",
+          "ref": "serving.AmazonBedrockConfig",
+          "launch_stage": "GA"
+        },
+        "anthropic_config": {
+          "description": "Anthropic Config. Only required if the provider is 'anthropic'.",
+          "ref": "serving.AnthropicConfig",
+          "launch_stage": "GA"
+        },
+        "cohere_config": {
+          "description": "Cohere Config. Only required if the provider is 'cohere'.",
+          "ref": "serving.CohereConfig",
+          "launch_stage": "GA"
+        },
+        "custom_provider_config": {
+          "description": "Custom Provider Config. Only required if the provider is 'custom'.",
+          "ref": "serving.CustomProviderConfig",
+          "launch_stage": "GA"
+        },
+        "databricks_model_serving_config": {
+          "description": "Databricks Model Serving Config. Only required if the provider is 'databricks-model-serving'.",
+          "ref": "serving.DatabricksModelServingConfig",
+          "launch_stage": "GA"
+        },
+        "google_cloud_vertex_ai_config": {
+          "description": "Google Cloud Vertex AI Config. Only required if the provider is 'google-cloud-vertex-ai'.",
+          "ref": "serving.GoogleCloudVertexAiConfig",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The name of the external model.",
+          "launch_stage": "GA"
+        },
+        "openai_config": {
+          "description": "OpenAI Config. Only required if the provider is 'openai'.",
+          "ref": "serving.OpenAiConfig",
+          "launch_stage": "GA"
+        },
+        "palm_config": {
+          "description": "PaLM Config. Only required if the provider is 'palm'.",
+          "ref": "serving.PaLmConfig",
+          "launch_stage": "GA"
+        },
+        "provider": {
+          "description": "The name of the provider for the external model. Currently, the supported providers are 'ai21labs', 'anthropic', 'amazon-bedrock', 'cohere', 'databricks-model-serving', 'google-cloud-vertex-ai', 'openai', 'palm', and 'custom'.",
+          "ref": "serving.ExternalModelProvider",
+          "launch_stage": "GA"
+        },
+        "task": {
+          "description": "The task type of the external model.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.ExternalModelProvider": {
+      "enum": [
+        "ai21labs",
+        "anthropic",
+        "amazon-bedrock",
+        "cohere",
+        "databricks-model-serving",
+        "google-cloud-vertex-ai",
+        "openai",
+        "palm",
+        "custom"
+      ],
+      "enum_launch_stages": {
+        "ai21labs": "PUBLIC_PREVIEW",
+        "amazon-bedrock": "PUBLIC_PREVIEW",
+        "anthropic": "PUBLIC_PREVIEW",
+        "cohere": "PUBLIC_PREVIEW",
+        "custom": "PUBLIC_PREVIEW",
+        "databricks-model-serving": "PUBLIC_PREVIEW",
+        "google-cloud-vertex-ai": "PUBLIC_PREVIEW",
+        "openai": "PUBLIC_PREVIEW",
+        "palm": "PUBLIC_PREVIEW"
+      }
+    },
+    "serving.ExternalModelUsageElement": {
+      "fields": {
+        "completion_tokens": {
+          "description": "The number of tokens in the chat/completions response.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "prompt_tokens": {
+          "description": "The number of tokens in the prompt.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "total_tokens": {
+          "description": "The total number of tokens in the prompt and response.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "serving.FallbackConfig": {
+      "fields": {
+        "enabled": {
+          "description": "Whether to enable traffic fallback. When a served entity in the serving endpoint returns specific error\ncodes (e.g. 500), the request will automatically be round-robin attempted with other served entities in the same\nendpoint, following the order of served entity list, until a successful response is returned.\nIf all attempts fail, return the last response with the error code.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.FoundationModel": {
+      "description": "All fields are not sensitive as they are hard-coded in the system and made available to customers.",
+      "fields": {
+        "description": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "display_name": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "docs": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "name": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "serving.GetOpenApiRequest": {},
+    "serving.GetOpenApiResponse": {
+      "fields": {
+        "contents": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "serving.GetServingEndpointPermissionLevelsRequest": {},
+    "serving.GetServingEndpointPermissionLevelsResponse": {
+      "fields": {
+        "permission_levels": {
+          "description": "Specific permission levels",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.GetServingEndpointPermissionsRequest": {},
+    "serving.GetServingEndpointRequest": {},
+    "serving.GoogleCloudVertexAiConfig": {
+      "fields": {
+        "private_key": {
+          "description": "The Databricks secret key reference for a private key for the service\naccount which has access to the Google Cloud Vertex AI Service. See [Best\npractices for managing service account keys]. If you prefer to paste your\nAPI key directly, see `private_key_plaintext`. You must provide an API\nkey using one of the following fields: `private_key` or\n`private_key_plaintext`\n\n[Best practices for managing service account keys]: https://cloud.google.com/iam/docs/best-practices-for-managing-service-account-keys",
+          "launch_stage": "GA"
+        },
+        "private_key_plaintext": {
+          "description": "The private key for the service account which has access to the Google\nCloud Vertex AI Service provided as a plaintext secret. See [Best\npractices for managing service account keys]. If you prefer to reference\nyour key using Databricks Secrets, see `private_key`. You must provide an\nAPI key using one of the following fields: `private_key` or\n`private_key_plaintext`.\n\n[Best practices for managing service account keys]: https://cloud.google.com/iam/docs/best-practices-for-managing-service-account-keys",
+          "launch_stage": "GA",
+          "behaviors": [
+            "INPUT_ONLY"
+          ]
+        },
+        "project_id": {
+          "description": "This is the Google Cloud project id that the service account is\nassociated with.",
+          "launch_stage": "GA"
+        },
+        "region": {
+          "description": "This is the region for the Google Cloud Vertex AI Service. See [supported\nregions] for more details. Some models are only available in specific\nregions.\n\n[supported regions]: https://cloud.google.com/vertex-ai/docs/general/locations",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.HttpRequestResponse": {
+      "fields": {
+        "contents": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "serving.ListEndpointsResponse": {
+      "fields": {
+        "endpoints": {
+          "description": "The list of endpoints.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.ListServingEndpointsRequest": {},
+    "serving.LogsRequest": {},
+    "serving.ModelDataPlaneInfo": {
+      "description": "A representation of all DataPlaneInfo for operations that can be done on a model through Data Plane APIs.",
+      "fields": {
+        "query_info": {
+          "description": "Information required to query DataPlane API 'query' endpoint.",
+          "ref": "serving.DataPlaneInfo",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.OpenAiConfig": {
+      "description": "Configs needed to create an OpenAI model route.",
+      "fields": {
+        "microsoft_entra_client_id": {
+          "description": "This field is only required for Azure AD OpenAI and is the Microsoft\nEntra Client ID.",
+          "launch_stage": "GA"
+        },
+        "microsoft_entra_client_secret": {
+          "description": "The Databricks secret key reference for a client secret used for\nMicrosoft Entra ID authentication. If you prefer to paste your client\nsecret directly, see `microsoft_entra_client_secret_plaintext`. You must\nprovide an API key using one of the following fields:\n`microsoft_entra_client_secret` or\n`microsoft_entra_client_secret_plaintext`.",
+          "launch_stage": "GA"
+        },
+        "microsoft_entra_client_secret_plaintext": {
+          "description": "The client secret used for Microsoft Entra ID authentication provided as\na plaintext string. If you prefer to reference your key using Databricks\nSecrets, see `microsoft_entra_client_secret`. You must provide an API key\nusing one of the following fields: `microsoft_entra_client_secret` or\n`microsoft_entra_client_secret_plaintext`.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "INPUT_ONLY"
+          ]
+        },
+        "microsoft_entra_tenant_id": {
+          "description": "This field is only required for Azure AD OpenAI and is the Microsoft\nEntra Tenant ID.",
+          "launch_stage": "GA"
+        },
+        "openai_api_base": {
+          "description": "This is a field to provide a customized base URl for the OpenAI API. For\nAzure OpenAI, this field is required, and is the base URL for the Azure\nOpenAI API service provided by Azure. For other OpenAI API types, this\nfield is optional, and if left unspecified, the standard OpenAI base URL\nis used.",
+          "launch_stage": "GA"
+        },
+        "openai_api_key": {
+          "description": "The Databricks secret key reference for an OpenAI API key using the\nOpenAI or Azure service. If you prefer to paste your API key directly,\nsee `openai_api_key_plaintext`. You must provide an API key using one of\nthe following fields: `openai_api_key` or `openai_api_key_plaintext`.",
+          "launch_stage": "GA"
+        },
+        "openai_api_key_plaintext": {
+          "description": "The OpenAI API key using the OpenAI or Azure service provided as a\nplaintext string. If you prefer to reference your key using Databricks\nSecrets, see `openai_api_key`. You must provide an API key using one of\nthe following fields: `openai_api_key` or `openai_api_key_plaintext`.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "INPUT_ONLY"
+          ]
+        },
+        "openai_api_type": {
+          "description": "This is an optional field to specify the type of OpenAI API to use. For\nAzure OpenAI, this field is required, and adjust this parameter to\nrepresent the preferred security access validation protocol. For access\ntoken validation, use azure. For authentication using Azure Active\nDirectory (Azure AD) use, azuread.",
+          "launch_stage": "GA"
+        },
+        "openai_api_version": {
+          "description": "This is an optional field to specify the OpenAI API version. For Azure\nOpenAI, this field is required, and is the version of the Azure OpenAI\nservice to utilize, specified by a date.",
+          "launch_stage": "GA"
+        },
+        "openai_deployment_name": {
+          "description": "This field is only required for Azure OpenAI and is the name of the\ndeployment resource for the Azure OpenAI service.",
+          "launch_stage": "GA"
+        },
+        "openai_organization": {
+          "description": "This is an optional field to specify the organization in OpenAI or Azure\nOpenAI.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.PaLmConfig": {
+      "fields": {
+        "palm_api_key": {
+          "description": "The Databricks secret key reference for a PaLM API key. If you prefer to\npaste your API key directly, see `palm_api_key_plaintext`. You must\nprovide an API key using one of the following fields: `palm_api_key` or\n`palm_api_key_plaintext`.",
+          "launch_stage": "GA"
+        },
+        "palm_api_key_plaintext": {
+          "description": "The PaLM API key provided as a plaintext string. If you prefer to\nreference your key using Databricks Secrets, see `palm_api_key`. You must\nprovide an API key using one of the following fields: `palm_api_key` or\n`palm_api_key_plaintext`.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "INPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "serving.PatchServingEndpointTags": {
+      "fields": {
+        "add_tags": {
+          "description": "List of endpoint tags to add",
+          "launch_stage": "GA"
+        },
+        "delete_tags": {
+          "description": "List of tag keys to delete",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.PatchTelemetryConfigRequest": {
+      "description": "Updates the telemetry configuration of a serving endpoint.",
+      "fields": {
+        "telemetry_config": {
+          "description": "The telemetry configuration to be applied to the serving endpoint.\nCan specify either a telemetry_profile_id to use an existing profile,\nor table_names to create a new profile with the specified Unity Catalog tables.\nIf not provided, the telemetry configuration will be removed from the endpoint.",
+          "ref": "serving.TelemetryConfig",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.PayloadTable": {
+      "fields": {
+        "name": {
+          "launch_stage": "GA"
+        },
+        "status": {
+          "launch_stage": "GA"
+        },
+        "status_message": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.PtEndpointCoreConfig": {
+      "fields": {
+        "served_entities": {
+          "description": "The list of served entities under the serving endpoint config.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "traffic_config": {
+          "ref": "serving.TrafficConfig",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "serving.PtServedModel": {
+      "fields": {
+        "burst_scaling_enabled": {
+          "description": "Whether burst scaling is enabled. When enabled (default), the endpoint can automatically\nscale up beyond provisioned capacity to handle traffic spikes. When disabled, the endpoint\nmaintains fixed capacity at provisioned_model_units.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "entity_name": {
+          "description": "The name of the entity to be served. The entity may be a model in the Databricks Model Registry, a model in the Unity Catalog (UC), or a function of type FEATURE_SPEC in the UC. If it is a UC object, the full name of the object should be given in the form of **catalog_name.schema_name.model_name**.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "entity_version": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "name": {
+          "description": "The name of a served entity. It must be unique across an endpoint. A served entity name can consist of alphanumeric characters, dashes, and underscores. If not specified for an external model, this field defaults to external_model.name, with '.' and ':' replaced with '-', and if not specified for other entities, it defaults to entity_name-entity_version.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "provisioned_model_units": {
+          "description": "The number of model units to be provisioned.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "serving.PutAiGatewayRequest": {
+      "fields": {
+        "fallback_config": {
+          "description": "Configuration for traffic fallback which auto fallbacks to other served entities if the request to a served\nentity fails with certain error codes, to increase availability.",
+          "ref": "serving.FallbackConfig",
+          "launch_stage": "GA"
+        },
+        "guardrails": {
+          "description": "Configuration for AI Guardrails to prevent unwanted data and unsafe data in requests and responses.",
+          "ref": "serving.AiGatewayGuardrails",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "inference_table_config": {
+          "description": "Configuration for payload logging using inference tables.\nUse these tables to monitor and audit data being sent to and received from model APIs and to improve model quality.",
+          "ref": "serving.AiGatewayInferenceTableConfig",
+          "launch_stage": "GA"
+        },
+        "rate_limits": {
+          "description": "Configuration for rate limits which can be set to limit endpoint traffic.",
+          "launch_stage": "GA"
+        },
+        "usage_tracking_config": {
+          "description": "Configuration to enable usage tracking using system tables.\nThese tables allow you to monitor operational usage on endpoints and their associated costs.",
+          "ref": "serving.AiGatewayUsageTrackingConfig",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.PutAiGatewayResponse": {
+      "fields": {
+        "fallback_config": {
+          "description": "Configuration for traffic fallback which auto fallbacks to other served entities if the request to a served\nentity fails with certain error codes, to increase availability.",
+          "ref": "serving.FallbackConfig",
+          "launch_stage": "GA"
+        },
+        "guardrails": {
+          "description": "Configuration for AI Guardrails to prevent unwanted data and unsafe data in requests and responses.",
+          "ref": "serving.AiGatewayGuardrails",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "inference_table_config": {
+          "description": "Configuration for payload logging using inference tables.\nUse these tables to monitor and audit data being sent to and received from model APIs and to improve model quality.",
+          "ref": "serving.AiGatewayInferenceTableConfig",
+          "launch_stage": "GA"
+        },
+        "rate_limits": {
+          "description": "Configuration for rate limits which can be set to limit endpoint traffic.",
+          "launch_stage": "GA"
+        },
+        "usage_tracking_config": {
+          "description": "Configuration to enable usage tracking using system tables.\nThese tables allow you to monitor operational usage on endpoints and their associated costs.",
+          "ref": "serving.AiGatewayUsageTrackingConfig",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.PutRequest": {
+      "fields": {
+        "rate_limits": {
+          "description": "The list of endpoint rate limits.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "serving.PutResponse": {
+      "fields": {
+        "rate_limits": {
+          "description": "The list of endpoint rate limits.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "serving.QueryEndpointInput": {
+      "fields": {
+        "client_request_id": {
+          "description": "Optional user-provided request identifier that will be recorded in the inference table and the usage tracking table.",
+          "launch_stage": "GA"
+        },
+        "dataframe_records": {
+          "description": "Pandas Dataframe input in the records orientation.",
+          "launch_stage": "GA"
+        },
+        "dataframe_split": {
+          "description": "Pandas Dataframe input in the split orientation.",
+          "ref": "serving.DataframeSplitInput",
+          "launch_stage": "GA"
+        },
+        "extra_params": {
+          "description": "The extra parameters field used ONLY for __completions, chat,__ and __embeddings external \u0026 foundation\nmodel__ serving endpoints. This is a map of strings and should only be used with other external/foundation\nmodel query fields.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "input": {
+          "description": "The input string (or array of strings) field used ONLY for __embeddings external \u0026 foundation model__\nserving endpoints and is the only field (along with extra_params if needed) used by embeddings queries.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "inputs": {
+          "description": "Tensor-based input in columnar format.",
+          "launch_stage": "GA"
+        },
+        "instances": {
+          "description": "Tensor-based input in row format.",
+          "launch_stage": "GA"
+        },
+        "max_tokens": {
+          "description": "The max tokens field used ONLY for __completions__ and __chat external \u0026 foundation model__ serving\nendpoints. This is an integer and should only be used with other chat/completions query fields.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "messages": {
+          "description": "The messages field used ONLY for __chat external \u0026 foundation model__ serving endpoints.\nThis is an array of ChatMessage objects and should only be used with other chat query fields.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "n": {
+          "description": "The n (number of candidates) field used ONLY for __completions__ and __chat external \u0026 foundation model__\nserving endpoints. This is an integer between 1 and 5 with a default of 1 and should only be used with\nother chat/completions query fields.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "prompt": {
+          "description": "The prompt string (or array of strings) field used ONLY for __completions external \u0026 foundation model__\nserving endpoints and should only be used with other completions query fields.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "stop": {
+          "description": "The stop sequences field used ONLY for __completions__ and __chat external \u0026 foundation model__ serving\nendpoints. This is a list of strings and should only be used with other chat/completions query fields.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "stream": {
+          "description": "The stream field used ONLY for __completions__ and __chat external \u0026 foundation model__ serving endpoints.\nThis is a boolean defaulting to false and should only be used with other chat/completions query fields.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "temperature": {
+          "description": "The temperature field used ONLY for __completions__ and __chat external \u0026 foundation model__ serving\nendpoints. This is a float between 0.0 and 2.0 with a default of 1.0 and should only be used with other\nchat/completions query fields.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "usage_context": {
+          "description": "Optional user-provided context that will be recorded in the usage tracking table.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.QueryEndpointResponse": {
+      "fields": {
+        "choices": {
+          "description": "The list of choices returned by the __chat or completions external/foundation model__ serving endpoint.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "created": {
+          "description": "The timestamp in seconds when the query was created in Unix time returned by a __completions or chat external/foundation model__ serving endpoint.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "data": {
+          "description": "The list of the embeddings returned by the __embeddings external/foundation model__ serving endpoint.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "id": {
+          "description": "The ID of the query that may be returned by a __completions or chat external/foundation model__ serving endpoint.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "model": {
+          "description": "The name of the __external/foundation model__ used for querying. This is the name of the model that was\nspecified in the endpoint config.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "object": {
+          "description": "The type of object returned by the __external/foundation model__ serving endpoint, one of\n[text_completion, chat.completion, list (of embeddings)].",
+          "ref": "serving.QueryEndpointResponseObject",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "outputs": {
+          "description": "The outputs of the feature serving endpoint.",
+          "launch_stage": "GA"
+        },
+        "predictions": {
+          "description": "The predictions returned by the serving endpoint.",
+          "launch_stage": "GA"
+        },
+        "usage": {
+          "description": "The usage object that may be returned by the __external/foundation model__ serving endpoint. This\ncontains information about the number of tokens used in the prompt and response.",
+          "ref": "serving.ExternalModelUsageElement",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "serving.QueryEndpointResponseObject": {
+      "description": "The type of object returned by the __external/foundation model__ serving endpoint, one of\n[text_completion, chat.completion, list (of embeddings)].",
+      "enum": [
+        "text_completion",
+        "chat.completion",
+        "list"
+      ],
+      "enum_launch_stages": {
+        "chat.completion": "PUBLIC_PREVIEW",
+        "list": "PUBLIC_PREVIEW",
+        "text_completion": "PUBLIC_PREVIEW"
+      }
+    },
+    "serving.RateLimit": {
+      "fields": {
+        "calls": {
+          "description": "Used to specify how many calls are allowed for a key within the renewal_period.",
+          "launch_stage": "GA"
+        },
+        "key": {
+          "description": "Key field for a serving endpoint rate limit. Currently, only 'user' and 'endpoint' are supported, with 'endpoint' being the default if not specified.",
+          "ref": "serving.RateLimitKey",
+          "launch_stage": "GA"
+        },
+        "renewal_period": {
+          "description": "Renewal period field for a serving endpoint rate limit. Currently, only 'minute' is supported.",
+          "ref": "serving.RateLimitRenewalPeriod",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.RateLimitKey": {
+      "enum": [
+        "user",
+        "endpoint"
+      ],
+      "enum_launch_stages": {
+        "endpoint": "PUBLIC_PREVIEW",
+        "user": "PUBLIC_PREVIEW"
+      }
+    },
+    "serving.RateLimitRenewalPeriod": {
+      "enum": [
+        "minute"
+      ],
+      "enum_launch_stages": {
+        "minute": "PUBLIC_PREVIEW"
+      }
+    },
+    "serving.Route": {
+      "fields": {
+        "served_entity_name": {
+          "launch_stage": "GA"
+        },
+        "served_model_name": {
+          "description": "The name of the served model this route configures traffic for.",
+          "launch_stage": "GA"
+        },
+        "traffic_percentage": {
+          "description": "The percentage of endpoint traffic to send to this route. It must be an integer between 0 and 100 inclusive.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.ServedEntityInput": {
+      "fields": {
+        "burst_scaling_enabled": {
+          "description": "Whether burst scaling is enabled. When enabled (default), the endpoint can automatically\nscale up beyond provisioned capacity to handle traffic spikes. When disabled, the endpoint\nmaintains fixed capacity at provisioned_model_units.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "INPUT_ONLY"
+          ]
+        },
+        "entity_name": {
+          "description": "The name of the entity to be served. The entity may be a model in the Databricks Model Registry, a model in the Unity Catalog (UC), or a function of type FEATURE_SPEC in the UC. If it is a UC object, the full name of the object should be given in the form of **catalog_name.schema_name.model_name**.",
+          "launch_stage": "GA"
+        },
+        "entity_version": {
+          "launch_stage": "GA"
+        },
+        "environment_vars": {
+          "description": "An object containing a set of optional, user-specified environment variable key-value pairs used for serving this entity. Note: this is an experimental feature and subject to change. Example entity environment variables that refer to Databricks secrets: `{\"OPENAI_API_KEY\": \"{{secrets/my_scope/my_key}}\", \"DATABRICKS_TOKEN\": \"{{secrets/my_scope2/my_key2}}\"}`",
+          "launch_stage": "GA"
+        },
+        "external_model": {
+          "description": "The external model to be served. NOTE: Only one of external_model and (entity_name, entity_version, workload_size, workload_type, and scale_to_zero_enabled) can be specified with the latter set being used for custom model serving for a Databricks registered model. For an existing endpoint with external_model, it cannot be updated to an endpoint without external_model. If the endpoint is created without external_model, users cannot update it to add external_model later. The task type of all external models within an endpoint must be the same.",
+          "ref": "serving.ExternalModel",
+          "launch_stage": "GA"
+        },
+        "instance_profile_arn": {
+          "description": "ARN of the instance profile that the served entity uses to access AWS resources.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "max_provisioned_concurrency": {
+          "description": "The maximum provisioned concurrency that the endpoint can scale up to. Do not use if workload_size is specified.",
+          "launch_stage": "GA"
+        },
+        "max_provisioned_throughput": {
+          "description": "The maximum tokens per second that the endpoint can scale up to.",
+          "launch_stage": "GA"
+        },
+        "min_provisioned_concurrency": {
+          "description": "The minimum provisioned concurrency that the endpoint can scale down to. Do not use if workload_size is specified.",
+          "launch_stage": "GA"
+        },
+        "min_provisioned_throughput": {
+          "description": "The minimum tokens per second that the endpoint can scale down to.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The name of a served entity. It must be unique across an endpoint. A served entity name can consist of alphanumeric characters, dashes, and underscores. If not specified for an external model, this field defaults to external_model.name, with '.' and ':' replaced with '-', and if not specified for other entities, it defaults to entity_name-entity_version.",
+          "launch_stage": "GA"
+        },
+        "provisioned_model_units": {
+          "description": "The number of model units provisioned.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "scale_to_zero_enabled": {
+          "description": "Whether the compute resources for the served entity should scale down to zero.",
+          "launch_stage": "GA"
+        },
+        "workload_size": {
+          "description": "The workload size of the served entity. The workload size corresponds to a range of provisioned concurrency that the compute autoscales between. A single unit of provisioned concurrency can process one request at a time. Valid workload sizes are \"Small\" (4 - 4 provisioned concurrency), \"Medium\" (8 - 16 provisioned concurrency), and \"Large\" (16 - 64 provisioned concurrency). Additional custom workload sizes can also be used when available in the workspace. If scale-to-zero is enabled, the lower bound of the provisioned concurrency for each workload size is 0. Do not use if min_provisioned_concurrency and max_provisioned_concurrency are specified.",
+          "launch_stage": "GA"
+        },
+        "workload_type": {
+          "description": "The workload type of the served entity. The workload type selects which type of compute to use in the endpoint. The default value for this parameter is \"CPU\". For deep learning workloads, GPU acceleration is available by selecting workload types like GPU_SMALL and others. See the available [GPU types](https://docs.databricks.com/en/machine-learning/model-serving/create-manage-serving-endpoints.html#gpu-workload-types).",
+          "ref": "serving.ServingModelWorkloadType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.ServedEntityOutput": {
+      "fields": {
+        "burst_scaling_enabled": {
+          "description": "Whether burst scaling is enabled. When enabled (default), the endpoint can automatically\nscale up beyond provisioned capacity to handle traffic spikes. When disabled, the endpoint\nmaintains fixed capacity at provisioned_model_units.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "INPUT_ONLY"
+          ]
+        },
+        "creation_timestamp": {
+          "launch_stage": "GA"
+        },
+        "creator": {
+          "launch_stage": "GA"
+        },
+        "entity_name": {
+          "description": "The name of the entity to be served. The entity may be a model in the Databricks Model Registry, a model in the Unity Catalog (UC), or a function of type FEATURE_SPEC in the UC. If it is a UC object, the full name of the object should be given in the form of **catalog_name.schema_name.model_name**.",
+          "launch_stage": "GA"
+        },
+        "entity_version": {
+          "launch_stage": "GA"
+        },
+        "environment_vars": {
+          "description": "An object containing a set of optional, user-specified environment variable key-value pairs used for serving this entity. Note: this is an experimental feature and subject to change. Example entity environment variables that refer to Databricks secrets: `{\"OPENAI_API_KEY\": \"{{secrets/my_scope/my_key}}\", \"DATABRICKS_TOKEN\": \"{{secrets/my_scope2/my_key2}}\"}`",
+          "launch_stage": "GA"
+        },
+        "external_model": {
+          "description": "The external model to be served. NOTE: Only one of external_model and (entity_name, entity_version, workload_size, workload_type, and scale_to_zero_enabled) can be specified with the latter set being used for custom model serving for a Databricks registered model. For an existing endpoint with external_model, it cannot be updated to an endpoint without external_model. If the endpoint is created without external_model, users cannot update it to add external_model later. The task type of all external models within an endpoint must be the same.",
+          "ref": "serving.ExternalModel",
+          "launch_stage": "GA"
+        },
+        "foundation_model": {
+          "ref": "serving.FoundationModel",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "instance_profile_arn": {
+          "description": "ARN of the instance profile that the served entity uses to access AWS resources.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "max_provisioned_concurrency": {
+          "description": "The maximum provisioned concurrency that the endpoint can scale up to. Do not use if workload_size is specified.",
+          "launch_stage": "GA"
+        },
+        "max_provisioned_throughput": {
+          "description": "The maximum tokens per second that the endpoint can scale up to.",
+          "launch_stage": "GA"
+        },
+        "min_provisioned_concurrency": {
+          "description": "The minimum provisioned concurrency that the endpoint can scale down to. Do not use if workload_size is specified.",
+          "launch_stage": "GA"
+        },
+        "min_provisioned_throughput": {
+          "description": "The minimum tokens per second that the endpoint can scale down to.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The name of a served entity. It must be unique across an endpoint. A served entity name can consist of alphanumeric characters, dashes, and underscores. If not specified for an external model, this field defaults to external_model.name, with '.' and ':' replaced with '-', and if not specified for other entities, it defaults to entity_name-entity_version.",
+          "launch_stage": "GA"
+        },
+        "provisioned_model_units": {
+          "description": "The number of model units provisioned.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "scale_to_zero_enabled": {
+          "description": "Whether the compute resources for the served entity should scale down to zero.",
+          "launch_stage": "GA"
+        },
+        "state": {
+          "ref": "serving.ServedModelState",
+          "launch_stage": "GA"
+        },
+        "workload_size": {
+          "description": "The workload size of the served entity. The workload size corresponds to a range of provisioned concurrency that the compute autoscales between. A single unit of provisioned concurrency can process one request at a time. Valid workload sizes are \"Small\" (4 - 4 provisioned concurrency), \"Medium\" (8 - 16 provisioned concurrency), and \"Large\" (16 - 64 provisioned concurrency). Additional custom workload sizes can also be used when available in the workspace. If scale-to-zero is enabled, the lower bound of the provisioned concurrency for each workload size is 0. Do not use if min_provisioned_concurrency and max_provisioned_concurrency are specified.",
+          "launch_stage": "GA"
+        },
+        "workload_type": {
+          "description": "The workload type of the served entity. The workload type selects which type of compute to use in the endpoint. The default value for this parameter is \"CPU\". For deep learning workloads, GPU acceleration is available by selecting workload types like GPU_SMALL and others. See the available [GPU types](https://docs.databricks.com/en/machine-learning/model-serving/create-manage-serving-endpoints.html#gpu-workload-types).",
+          "ref": "serving.ServingModelWorkloadType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.ServedEntitySpec": {
+      "fields": {
+        "entity_name": {
+          "launch_stage": "GA"
+        },
+        "entity_version": {
+          "launch_stage": "GA"
+        },
+        "external_model": {
+          "ref": "serving.ExternalModel",
+          "launch_stage": "GA"
+        },
+        "foundation_model": {
+          "ref": "serving.FoundationModel",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "name": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.ServedModelInput": {
+      "fields": {
+        "burst_scaling_enabled": {
+          "description": "Whether burst scaling is enabled. When enabled (default), the endpoint can automatically\nscale up beyond provisioned capacity to handle traffic spikes. When disabled, the endpoint\nmaintains fixed capacity at provisioned_model_units.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "INPUT_ONLY"
+          ]
+        },
+        "environment_vars": {
+          "description": "An object containing a set of optional, user-specified environment variable key-value pairs used for serving this entity. Note: this is an experimental feature and subject to change. Example entity environment variables that refer to Databricks secrets: `{\"OPENAI_API_KEY\": \"{{secrets/my_scope/my_key}}\", \"DATABRICKS_TOKEN\": \"{{secrets/my_scope2/my_key2}}\"}`",
+          "launch_stage": "GA"
+        },
+        "instance_profile_arn": {
+          "description": "ARN of the instance profile that the served entity uses to access AWS resources.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "max_provisioned_concurrency": {
+          "description": "The maximum provisioned concurrency that the endpoint can scale up to. Do not use if workload_size is specified.",
+          "launch_stage": "GA"
+        },
+        "max_provisioned_throughput": {
+          "description": "The maximum tokens per second that the endpoint can scale up to.",
+          "launch_stage": "GA"
+        },
+        "min_provisioned_concurrency": {
+          "description": "The minimum provisioned concurrency that the endpoint can scale down to. Do not use if workload_size is specified.",
+          "launch_stage": "GA"
+        },
+        "min_provisioned_throughput": {
+          "description": "The minimum tokens per second that the endpoint can scale down to.",
+          "launch_stage": "GA"
+        },
+        "model_name": {
+          "launch_stage": "GA"
+        },
+        "model_version": {
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The name of a served entity. It must be unique across an endpoint. A served entity name can consist of alphanumeric characters, dashes, and underscores. If not specified for an external model, this field defaults to external_model.name, with '.' and ':' replaced with '-', and if not specified for other entities, it defaults to entity_name-entity_version.",
+          "launch_stage": "GA"
+        },
+        "provisioned_model_units": {
+          "description": "The number of model units provisioned.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "scale_to_zero_enabled": {
+          "description": "Whether the compute resources for the served entity should scale down to zero.",
+          "launch_stage": "GA"
+        },
+        "workload_size": {
+          "description": "The workload size of the served entity. The workload size corresponds to a range of provisioned concurrency that the compute autoscales between. A single unit of provisioned concurrency can process one request at a time. Valid workload sizes are \"Small\" (4 - 4 provisioned concurrency), \"Medium\" (8 - 16 provisioned concurrency), and \"Large\" (16 - 64 provisioned concurrency). Additional custom workload sizes can also be used when available in the workspace. If scale-to-zero is enabled, the lower bound of the provisioned concurrency for each workload size is 0. Do not use if min_provisioned_concurrency and max_provisioned_concurrency are specified.",
+          "launch_stage": "GA"
+        },
+        "workload_type": {
+          "description": "The workload type of the served entity. The workload type selects which type of compute to use in the endpoint. The default value for this parameter is \"CPU\". For deep learning workloads, GPU acceleration is available by selecting workload types like GPU_SMALL and others. See the available [GPU types](https://docs.databricks.com/en/machine-learning/model-serving/create-manage-serving-endpoints.html#gpu-workload-types).",
+          "ref": "serving.ServedModelInputWorkloadType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.ServedModelInputWorkloadType": {
+      "description": "Please keep this in sync with workload types in InferenceEndpointEntities.scala.",
+      "enum": [
+        "CPU",
+        "GPU_MEDIUM",
+        "GPU_SMALL",
+        "GPU_LARGE",
+        "MULTIGPU_MEDIUM",
+        "CPU_LARGE",
+        "GPU_XLARGE_8",
+        "GPU_XLARGE",
+        "CPU_MEDIUM"
+      ],
+      "enum_launch_stages": {
+        "CPU": "GA",
+        "CPU_LARGE": "PUBLIC_BETA",
+        "CPU_MEDIUM": "PUBLIC_BETA",
+        "GPU_LARGE": "GA",
+        "GPU_MEDIUM": "GA",
+        "GPU_SMALL": "GA",
+        "GPU_XLARGE": "PUBLIC_BETA",
+        "GPU_XLARGE_8": "PUBLIC_BETA",
+        "MULTIGPU_MEDIUM": "GA"
+      }
+    },
+    "serving.ServedModelOutput": {
+      "fields": {
+        "burst_scaling_enabled": {
+          "description": "Whether burst scaling is enabled. When enabled (default), the endpoint can automatically\nscale up beyond provisioned capacity to handle traffic spikes. When disabled, the endpoint\nmaintains fixed capacity at provisioned_model_units.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "INPUT_ONLY"
+          ]
+        },
+        "creation_timestamp": {
+          "launch_stage": "GA"
+        },
+        "creator": {
+          "launch_stage": "GA"
+        },
+        "environment_vars": {
+          "description": "An object containing a set of optional, user-specified environment variable key-value pairs used for serving this entity. Note: this is an experimental feature and subject to change. Example entity environment variables that refer to Databricks secrets: `{\"OPENAI_API_KEY\": \"{{secrets/my_scope/my_key}}\", \"DATABRICKS_TOKEN\": \"{{secrets/my_scope2/my_key2}}\"}`",
+          "launch_stage": "GA"
+        },
+        "instance_profile_arn": {
+          "description": "ARN of the instance profile that the served entity uses to access AWS resources.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "max_provisioned_concurrency": {
+          "description": "The maximum provisioned concurrency that the endpoint can scale up to. Do not use if workload_size is specified.",
+          "launch_stage": "GA"
+        },
+        "min_provisioned_concurrency": {
+          "description": "The minimum provisioned concurrency that the endpoint can scale down to. Do not use if workload_size is specified.",
+          "launch_stage": "GA"
+        },
+        "model_name": {
+          "launch_stage": "GA"
+        },
+        "model_version": {
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The name of a served entity. It must be unique across an endpoint. A served entity name can consist of alphanumeric characters, dashes, and underscores. If not specified for an external model, this field defaults to external_model.name, with '.' and ':' replaced with '-', and if not specified for other entities, it defaults to entity_name-entity_version.",
+          "launch_stage": "GA"
+        },
+        "provisioned_model_units": {
+          "description": "The number of model units provisioned.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "scale_to_zero_enabled": {
+          "description": "Whether the compute resources for the served entity should scale down to zero.",
+          "launch_stage": "GA"
+        },
+        "state": {
+          "ref": "serving.ServedModelState",
+          "launch_stage": "GA"
+        },
+        "workload_size": {
+          "description": "The workload size of the served entity. The workload size corresponds to a range of provisioned concurrency that the compute autoscales between. A single unit of provisioned concurrency can process one request at a time. Valid workload sizes are \"Small\" (4 - 4 provisioned concurrency), \"Medium\" (8 - 16 provisioned concurrency), and \"Large\" (16 - 64 provisioned concurrency). Additional custom workload sizes can also be used when available in the workspace. If scale-to-zero is enabled, the lower bound of the provisioned concurrency for each workload size is 0. Do not use if min_provisioned_concurrency and max_provisioned_concurrency are specified.",
+          "launch_stage": "GA"
+        },
+        "workload_type": {
+          "description": "The workload type of the served entity. The workload type selects which type of compute to use in the endpoint. The default value for this parameter is \"CPU\". For deep learning workloads, GPU acceleration is available by selecting workload types like GPU_SMALL and others. See the available [GPU types](https://docs.databricks.com/en/machine-learning/model-serving/create-manage-serving-endpoints.html#gpu-workload-types).",
+          "ref": "serving.ServingModelWorkloadType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.ServedModelSpec": {
+      "fields": {
+        "model_name": {
+          "description": "Only one of model_name and entity_name should be populated",
+          "launch_stage": "GA"
+        },
+        "model_version": {
+          "description": "Only one of model_version and entity_version should be populated",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.ServedModelState": {
+      "fields": {
+        "deployment": {
+          "ref": "serving.ServedModelStateDeployment",
+          "launch_stage": "GA"
+        },
+        "deployment_state_message": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.ServedModelStateDeployment": {
+      "enum": [
+        "DEPLOYMENT_CREATING",
+        "DEPLOYMENT_RECOVERING",
+        "DEPLOYMENT_READY",
+        "DEPLOYMENT_FAILED",
+        "DEPLOYMENT_ABORTED"
+      ],
+      "enum_launch_stages": {
+        "DEPLOYMENT_ABORTED": "PUBLIC_PREVIEW",
+        "DEPLOYMENT_CREATING": "PUBLIC_PREVIEW",
+        "DEPLOYMENT_FAILED": "PUBLIC_PREVIEW",
+        "DEPLOYMENT_READY": "PUBLIC_PREVIEW",
+        "DEPLOYMENT_RECOVERING": "PUBLIC_PREVIEW"
+      }
+    },
+    "serving.ServerLogsResponse": {
+      "fields": {
+        "logs": {
+          "description": "The most recent log lines of the model server processing invocation requests.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.ServingEndpoint": {
+      "fields": {
+        "ai_gateway": {
+          "description": "The AI Gateway configuration for the serving endpoint. NOTE: External model, provisioned throughput, and pay-per-token endpoints are fully supported; agent endpoints currently only support inference tables.",
+          "ref": "serving.AiGatewayConfig",
+          "launch_stage": "GA"
+        },
+        "budget_policy_id": {
+          "description": "The budget policy associated with the endpoint.",
+          "launch_stage": "GA"
+        },
+        "config": {
+          "description": "The config that is currently being served by the endpoint.",
+          "ref": "serving.EndpointCoreConfigSummary",
+          "launch_stage": "GA"
+        },
+        "creation_timestamp": {
+          "description": "The timestamp when the endpoint was created in Unix time.",
+          "launch_stage": "GA"
+        },
+        "creator": {
+          "description": "The email of the user who created the serving endpoint.",
+          "launch_stage": "GA"
+        },
+        "description": {
+          "description": "Description of the endpoint",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "System-generated ID of the endpoint, included to be used by the Permissions API.",
+          "launch_stage": "GA"
+        },
+        "last_updated_timestamp": {
+          "description": "The timestamp when the endpoint was last updated by a user in Unix time.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The name of the serving endpoint.",
+          "launch_stage": "GA"
+        },
+        "state": {
+          "description": "Information corresponding to the state of the serving endpoint.",
+          "ref": "serving.EndpointState",
+          "launch_stage": "GA"
+        },
+        "tags": {
+          "description": "Tags attached to the serving endpoint.",
+          "launch_stage": "GA"
+        },
+        "task": {
+          "description": "The task type of the serving endpoint.",
+          "launch_stage": "GA"
+        },
+        "telemetry_config": {
+          "description": "Telemetry configuration for the endpoint, including inference-table payload logging.",
+          "ref": "serving.TelemetryConfig",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "usage_policy_id": {
+          "description": "The usage policy associated with serving endpoint.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.ServingEndpointAccessControlRequest": {
+      "fields": {
+        "group_name": {
+          "description": "name of the group",
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "serving.ServingEndpointPermissionLevel",
+          "launch_stage": "GA"
+        },
+        "service_principal_name": {
+          "description": "application ID of a service principal",
+          "launch_stage": "GA"
+        },
+        "user_name": {
+          "description": "name of the user",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.ServingEndpointAccessControlResponse": {
+      "fields": {
+        "all_permissions": {
+          "description": "All permissions.",
+          "launch_stage": "GA"
+        },
+        "display_name": {
+          "description": "Display name of the user or service principal.",
+          "launch_stage": "GA"
+        },
+        "group_name": {
+          "description": "name of the group",
+          "launch_stage": "GA"
+        },
+        "service_principal_name": {
+          "description": "Name of the service principal.",
+          "launch_stage": "GA"
+        },
+        "user_name": {
+          "description": "name of the user",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.ServingEndpointDetailed": {
+      "fields": {
+        "ai_gateway": {
+          "description": "The AI Gateway configuration for the serving endpoint. NOTE: External model, provisioned throughput, and pay-per-token endpoints are fully supported; agent endpoints currently only support inference tables.",
+          "ref": "serving.AiGatewayConfig",
+          "launch_stage": "GA"
+        },
+        "budget_policy_id": {
+          "description": "The budget policy associated with the endpoint.",
+          "launch_stage": "GA"
+        },
+        "config": {
+          "description": "The config that is currently being served by the endpoint.",
+          "ref": "serving.EndpointCoreConfigOutput",
+          "launch_stage": "GA"
+        },
+        "creation_timestamp": {
+          "description": "The timestamp when the endpoint was created in Unix time.",
+          "launch_stage": "GA"
+        },
+        "creator": {
+          "description": "The email of the user who created the serving endpoint.",
+          "launch_stage": "GA"
+        },
+        "data_plane_info": {
+          "description": "Information required to query DataPlane APIs.",
+          "ref": "serving.ModelDataPlaneInfo",
+          "launch_stage": "GA"
+        },
+        "description": {
+          "description": "Description of the serving model",
+          "launch_stage": "GA"
+        },
+        "email_notifications": {
+          "description": "Email notification settings.",
+          "ref": "serving.EmailNotifications",
+          "launch_stage": "GA"
+        },
+        "endpoint_url": {
+          "description": "Endpoint invocation url if route optimization is enabled for endpoint",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "System-generated ID of the endpoint. This is used to refer to the endpoint in the Permissions API",
+          "launch_stage": "GA"
+        },
+        "last_updated_timestamp": {
+          "description": "The timestamp when the endpoint was last updated by a user in Unix time.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The name of the serving endpoint.",
+          "launch_stage": "GA"
+        },
+        "pending_config": {
+          "description": "The config that the endpoint is attempting to update to.",
+          "ref": "serving.EndpointPendingConfig",
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "description": "The permission level of the principal making the request.",
+          "ref": "serving.ServingEndpointDetailedPermissionLevel",
+          "launch_stage": "GA"
+        },
+        "route_optimized": {
+          "description": "Boolean representing if route optimization has been enabled for the endpoint",
+          "launch_stage": "GA"
+        },
+        "state": {
+          "description": "Information corresponding to the state of the serving endpoint.",
+          "ref": "serving.EndpointState",
+          "launch_stage": "GA"
+        },
+        "tags": {
+          "description": "Tags attached to the serving endpoint.",
+          "launch_stage": "GA"
+        },
+        "task": {
+          "description": "The task type of the serving endpoint.",
+          "launch_stage": "GA"
+        },
+        "telemetry_config": {
+          "description": "Telemetry configuration for the endpoint, including inference-table payload logging.",
+          "ref": "serving.TelemetryConfig",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "serving.ServingEndpointDetailedPermissionLevel": {
+      "enum": [
+        "CAN_MANAGE",
+        "CAN_QUERY",
+        "CAN_VIEW"
+      ],
+      "enum_launch_stages": {
+        "CAN_MANAGE": "GA",
+        "CAN_QUERY": "GA",
+        "CAN_VIEW": "GA"
+      }
+    },
+    "serving.ServingEndpointPermission": {
+      "fields": {
+        "inherited": {
+          "launch_stage": "GA"
+        },
+        "inherited_from_object": {
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "serving.ServingEndpointPermissionLevel",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.ServingEndpointPermissionLevel": {
+      "description": "Permission level",
+      "enum": [
+        "CAN_MANAGE",
+        "CAN_QUERY",
+        "CAN_VIEW"
+      ]
+    },
+    "serving.ServingEndpointPermissions": {
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "GA"
+        },
+        "object_id": {
+          "launch_stage": "GA"
+        },
+        "object_type": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.ServingEndpointPermissionsDescription": {
+      "fields": {
+        "description": {
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "serving.ServingEndpointPermissionLevel",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.ServingEndpointPermissionsRequest": {
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.ServingModelWorkloadType": {
+      "description": "Please keep this in sync with workload types in InferenceEndpointEntities.scala.",
+      "enum": [
+        "CPU",
+        "GPU_MEDIUM",
+        "GPU_SMALL",
+        "GPU_LARGE",
+        "MULTIGPU_MEDIUM",
+        "CPU_LARGE",
+        "GPU_XLARGE_8",
+        "GPU_XLARGE",
+        "CPU_MEDIUM"
+      ],
+      "enum_launch_stages": {
+        "CPU": "GA",
+        "CPU_LARGE": "PUBLIC_BETA",
+        "CPU_MEDIUM": "PUBLIC_BETA",
+        "GPU_LARGE": "GA",
+        "GPU_MEDIUM": "GA",
+        "GPU_SMALL": "GA",
+        "GPU_XLARGE": "PUBLIC_BETA",
+        "GPU_XLARGE_8": "PUBLIC_BETA",
+        "MULTIGPU_MEDIUM": "GA"
+      }
+    },
+    "serving.TelemetryConfig": {
+      "fields": {
+        "enabled_telemetry_features": {
+          "description": "The telemetry signals to enable for this endpoint. If empty or omitted, all signals are\nenabled; otherwise only the listed signals are enabled.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "inference_table_config": {
+          "description": "Configuration for inference table payload logging, including sampling.",
+          "ref": "serving.TelemetryInferenceTableConfig",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "table_names": {
+          "description": "The Unity Catalog tables to which endpoint telemetry (logs, traces, and metrics) is exported.\nProvide this to create a new telemetry profile for the endpoint from the given tables.",
+          "ref": "serving.UnityCatalogTableNames",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "telemetry_profile_id": {
+          "description": "The ID of an existing telemetry profile to apply to this endpoint. Provide this to reuse a\ntelemetry profile that has already been created, instead of specifying table_names.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "serving.TelemetryFeature": {
+      "description": "A telemetry signal that a serving endpoint can export to Unity Catalog. Use these values to\nselect which signals the endpoint exports.",
+      "enum": [
+        "TELEMETRY_FEATURE_LOGS",
+        "TELEMETRY_FEATURE_TRACES",
+        "TELEMETRY_FEATURE_METRICS",
+        "TELEMETRY_FEATURE_INFERENCE_TABLE"
+      ],
+      "enum_launch_stages": {
+        "TELEMETRY_FEATURE_INFERENCE_TABLE": "PUBLIC_PREVIEW",
+        "TELEMETRY_FEATURE_LOGS": "PUBLIC_PREVIEW",
+        "TELEMETRY_FEATURE_METRICS": "PUBLIC_PREVIEW",
+        "TELEMETRY_FEATURE_TRACES": "PUBLIC_PREVIEW"
+      }
+    },
+    "serving.TelemetryInferenceTableConfig": {
+      "description": "Inference table payload logging configuration",
+      "fields": {
+        "name": {
+          "description": "The full name of the inference table created for this endpoint.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "sampling_fraction": {
+          "description": "Fraction of requests sampled for payload logging, in the range [0.0, 1.0], where 1.0 logs all requests.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "serving.TrafficConfig": {
+      "fields": {
+        "routes": {
+          "description": "The list of routes that define traffic to each served entity.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.UnityCatalogTableNames": {
+      "fields": {
+        "annotations_table": {
+          "description": "The full three-level Unity Catalog name (catalog.schema.table) of the table that receives\nexported annotations.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "logs_table": {
+          "description": "The full three-level Unity Catalog name (catalog.schema.table) of the table that receives\nexported logs.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "metrics_table": {
+          "description": "The full three-level Unity Catalog name (catalog.schema.table) of the table that receives\nexported metrics.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "traces_table": {
+          "description": "The full three-level Unity Catalog name (catalog.schema.table) of the table that receives\nexported traces (spans).",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "serving.UpdateInferenceEndpointNotifications": {
+      "fields": {
+        "email_notifications": {
+          "description": "The email notification settings to update. Specify email addresses to notify when endpoint state changes occur.",
+          "ref": "serving.EmailNotifications",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.UpdateInferenceEndpointNotificationsResponse": {
+      "fields": {
+        "email_notifications": {
+          "ref": "serving.EmailNotifications",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "serving.UpdateProvisionedThroughputEndpointConfigRequest": {
+      "fields": {
+        "config": {
+          "ref": "serving.PtEndpointCoreConfig",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "serving.V1ResponseChoiceElement": {
+      "fields": {
+        "finishReason": {
+          "description": "The finish reason returned by the endpoint.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "index": {
+          "description": "The index of the choice in the __chat or completions__ response.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "logprobs": {
+          "description": "The logprobs returned only by the __completions__ endpoint.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "message": {
+          "description": "The message response from the __chat__ endpoint.",
+          "ref": "serving.ChatMessage",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "text": {
+          "description": "The text response from the __completions__ endpoint.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.AccountIpAccessEnable": {
+      "fields": {
+        "acct_ip_acl_enable": {
+          "ref": "settings.BooleanMessage",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag provided.\nThis is used for optimistic concurrency control as a way to help prevent simultaneous\nwrites of a setting overwriting each other. It is strongly suggested that systems\nmake use of the etag in the read -\u003e update pattern to perform setting updates in\norder to avoid race conditions. That is, get an etag from a GET request, and pass it\nwith the PATCH request to identify the setting version you are updating.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "setting_name": {
+          "description": "Name of the corresponding setting. This field is populated in the response, but it will not be respected\neven if it's set in the request body. The setting name in the path parameter will be\nrespected instead. Setting name is required to be 'default' if the setting only has one instance per workspace.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "settings.AccountNetworkPolicy": {
+      "fields": {
+        "account_id": {
+          "description": "The associated account ID for this Network Policy object.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "egress": {
+          "description": "The network policies applying for egress traffic.",
+          "ref": "settings.NetworkPolicyEgress",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "ingress": {
+          "description": "The network policies applying for ingress traffic.",
+          "ref": "settings.CustomerFacingIngressNetworkPolicy",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "ingress_dry_run": {
+          "description": "The ingress policy for dry run mode. Dry run will always run even if the request\nis allowed by the ingress policy. When this field is set, the policy will be evaluated\nand emit logs only without blocking requests.",
+          "ref": "settings.CustomerFacingIngressNetworkPolicy",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "network_policy_id": {
+          "description": "The unique identifier for the network policy.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "settings.AibiDashboardEmbeddingAccessPolicy": {
+      "fields": {
+        "access_policy_type": {
+          "ref": "settings.AibiDashboardEmbeddingAccessPolicyAccessPolicyType",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "settings.AibiDashboardEmbeddingAccessPolicyAccessPolicyType": {
+      "enum": [
+        "ALLOW_ALL_DOMAINS",
+        "ALLOW_APPROVED_DOMAINS",
+        "DENY_ALL_DOMAINS"
+      ],
+      "enum_launch_stages": {
+        "ALLOW_ALL_DOMAINS": "PUBLIC_PREVIEW",
+        "ALLOW_APPROVED_DOMAINS": "PUBLIC_PREVIEW",
+        "DENY_ALL_DOMAINS": "PUBLIC_PREVIEW"
+      }
+    },
+    "settings.AibiDashboardEmbeddingAccessPolicySetting": {
+      "fields": {
+        "aibi_dashboard_embedding_access_policy": {
+          "ref": "settings.AibiDashboardEmbeddingAccessPolicy",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag provided.\nThis is used for optimistic concurrency control as a way to help prevent simultaneous\nwrites of a setting overwriting each other. It is strongly suggested that systems\nmake use of the etag in the read -\u003e update pattern to perform setting updates in\norder to avoid race conditions. That is, get an etag from a GET request, and pass it\nwith the PATCH request to identify the setting version you are updating.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "setting_name": {
+          "description": "Name of the corresponding setting. This field is populated in the response, but it will not be respected\neven if it's set in the request body. The setting name in the path parameter will be\nrespected instead. Setting name is required to be 'default' if the setting only has one instance per workspace.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.AibiDashboardEmbeddingApprovedDomains": {
+      "fields": {
+        "approved_domains": {
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "settings.AibiDashboardEmbeddingApprovedDomainsSetting": {
+      "fields": {
+        "aibi_dashboard_embedding_approved_domains": {
+          "ref": "settings.AibiDashboardEmbeddingApprovedDomains",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag provided.\nThis is used for optimistic concurrency control as a way to help prevent simultaneous\nwrites of a setting overwriting each other. It is strongly suggested that systems\nmake use of the etag in the read -\u003e update pattern to perform setting updates in\norder to avoid race conditions. That is, get an etag from a GET request, and pass it\nwith the PATCH request to identify the setting version you are updating.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "setting_name": {
+          "description": "Name of the corresponding setting. This field is populated in the response, but it will not be respected\neven if it's set in the request body. The setting name in the path parameter will be\nrespected instead. Setting name is required to be 'default' if the setting only has one instance per workspace.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.AutomaticClusterUpdateSetting": {
+      "fields": {
+        "automatic_cluster_update_workspace": {
+          "ref": "settings.ClusterAutoRestartMessage",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag provided.\nThis is used for optimistic concurrency control as a way to help prevent simultaneous\nwrites of a setting overwriting each other. It is strongly suggested that systems\nmake use of the etag in the read -\u003e update pattern to perform setting updates in\norder to avoid race conditions. That is, get an etag from a GET request, and pass it\nwith the PATCH request to identify the setting version you are updating.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "setting_name": {
+          "description": "Name of the corresponding setting. This field is populated in the response, but it will not be respected\neven if it's set in the request body. The setting name in the path parameter will be\nrespected instead. Setting name is required to be 'default' if the setting only has one instance per workspace.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.BooleanMessage": {
+      "fields": {
+        "value": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "settings.ClusterAutoRestartMessage": {
+      "fields": {
+        "can_toggle": {
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "enabled": {
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "enablement_details": {
+          "ref": "settings.ClusterAutoRestartMessageEnablementDetails",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "maintenance_window": {
+          "ref": "settings.ClusterAutoRestartMessageMaintenanceWindow",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "restart_even_if_no_updates_available": {
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "settings.ClusterAutoRestartMessageEnablementDetails": {
+      "description": "Contains an information about the enablement status judging (e.g. whether the enterprise tier\nis enabled)\nThis is only additional information that MUST NOT be used to decide whether the setting is\nenabled or not. This is intended to use only for purposes like showing an error message to\nthe customer with the additional details. For example, using these details we can check\nwhy exactly the feature is disabled for this customer.",
+      "fields": {
+        "forced_for_compliance_mode": {
+          "description": "The feature is force enabled if compliance mode is active",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "unavailable_for_disabled_entitlement": {
+          "description": "The feature is unavailable if the corresponding entitlement disabled (see getShieldEntitlementEnable)",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "unavailable_for_non_enterprise_tier": {
+          "description": "The feature is unavailable if the customer doesn't have enterprise tier",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "settings.ClusterAutoRestartMessageMaintenanceWindow": {
+      "fields": {
+        "week_day_based_schedule": {
+          "ref": "settings.ClusterAutoRestartMessageMaintenanceWindowWeekDayBasedSchedule",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "settings.ClusterAutoRestartMessageMaintenanceWindowDayOfWeek": {
+      "enum": [
+        "MONDAY",
+        "TUESDAY",
+        "WEDNESDAY",
+        "THURSDAY",
+        "FRIDAY",
+        "SATURDAY",
+        "SUNDAY"
+      ],
+      "enum_launch_stages": {
+        "FRIDAY": "PUBLIC_PREVIEW",
+        "MONDAY": "PUBLIC_PREVIEW",
+        "SATURDAY": "PUBLIC_PREVIEW",
+        "SUNDAY": "PUBLIC_PREVIEW",
+        "THURSDAY": "PUBLIC_PREVIEW",
+        "TUESDAY": "PUBLIC_PREVIEW",
+        "WEDNESDAY": "PUBLIC_PREVIEW"
+      }
+    },
+    "settings.ClusterAutoRestartMessageMaintenanceWindowWeekDayBasedSchedule": {
+      "fields": {
+        "day_of_week": {
+          "ref": "settings.ClusterAutoRestartMessageMaintenanceWindowDayOfWeek",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "frequency": {
+          "ref": "settings.ClusterAutoRestartMessageMaintenanceWindowWeekDayFrequency",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "window_start_time": {
+          "ref": "settings.ClusterAutoRestartMessageMaintenanceWindowWindowStartTime",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "settings.ClusterAutoRestartMessageMaintenanceWindowWeekDayFrequency": {
+      "enum": [
+        "FIRST_OF_MONTH",
+        "SECOND_OF_MONTH",
+        "THIRD_OF_MONTH",
+        "FOURTH_OF_MONTH",
+        "FIRST_AND_THIRD_OF_MONTH",
+        "SECOND_AND_FOURTH_OF_MONTH",
+        "EVERY_WEEK"
+      ],
+      "enum_launch_stages": {
+        "EVERY_WEEK": "PUBLIC_PREVIEW",
+        "FIRST_AND_THIRD_OF_MONTH": "PUBLIC_PREVIEW",
+        "FIRST_OF_MONTH": "PUBLIC_PREVIEW",
+        "FOURTH_OF_MONTH": "PUBLIC_PREVIEW",
+        "SECOND_AND_FOURTH_OF_MONTH": "PUBLIC_PREVIEW",
+        "SECOND_OF_MONTH": "PUBLIC_PREVIEW",
+        "THIRD_OF_MONTH": "PUBLIC_PREVIEW"
+      }
+    },
+    "settings.ClusterAutoRestartMessageMaintenanceWindowWindowStartTime": {
+      "fields": {
+        "hours": {
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "minutes": {
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "settings.ComplianceSecurityProfile": {
+      "description": "SHIELD feature: CSP\nCompliance Security Profile (CSP) enables enhanced compliance controls on the workspace.",
+      "fields": {
+        "compliance_standards": {
+          "description": "Compliance standards selected by the customer for this Compliance Security Profile.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "is_enabled": {
+          "description": "Whether Compliance Security Profile (CSP) is enabled on the workspace.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.ComplianceSecurityProfileSetting": {
+      "fields": {
+        "compliance_security_profile_workspace": {
+          "ref": "settings.ComplianceSecurityProfile",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag provided.\nThis is used for optimistic concurrency control as a way to help prevent simultaneous\nwrites of a setting overwriting each other. It is strongly suggested that systems\nmake use of the etag in the read -\u003e update pattern to perform setting updates in\norder to avoid race conditions. That is, get an etag from a GET request, and pass it\nwith the PATCH request to identify the setting version you are updating.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "setting_name": {
+          "description": "Name of the corresponding setting. This field is populated in the response, but it will not be respected\neven if it's set in the request body. The setting name in the path parameter will be\nrespected instead. Setting name is required to be 'default' if the setting only has one instance per workspace.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.ComplianceStandard": {
+      "description": "Compliance standard for SHIELD customers. See README.md for how instructions of how to add new standards.",
+      "enum": [
+        "NONE",
+        "HIPAA",
+        "PCI_DSS",
+        "FEDRAMP_MODERATE",
+        "IRAP_PROTECTED",
+        "FEDRAMP_HIGH",
+        "FEDRAMP_IL5",
+        "ITAR_EAR",
+        "CYBER_ESSENTIAL_PLUS",
+        "CANADA_PROTECTED_B",
+        "ISMAP",
+        "HITRUST",
+        "K_FSI",
+        "GERMANY_C5",
+        "GERMANY_TISAX",
+        "KSA_ECC_CCC_DCC"
+      ],
+      "enum_launch_stages": {
+        "CANADA_PROTECTED_B": "GA",
+        "CYBER_ESSENTIAL_PLUS": "GA",
+        "FEDRAMP_HIGH": "GA",
+        "FEDRAMP_IL5": "GA",
+        "FEDRAMP_MODERATE": "GA",
+        "GERMANY_C5": "GA",
+        "GERMANY_TISAX": "GA",
+        "HIPAA": "GA",
+        "HITRUST": "GA",
+        "IRAP_PROTECTED": "GA",
+        "ISMAP": "GA",
+        "ITAR_EAR": "GA",
+        "KSA_ECC_CCC_DCC": "GA",
+        "K_FSI": "GA",
+        "NONE": "GA",
+        "PCI_DSS": "GA"
+      }
+    },
+    "settings.Config": {
+      "fields": {
+        "databricks_app_slack": {
+          "ref": "settings.DatabricksAppSlackConfig",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "databricks_app_teams": {
+          "ref": "settings.DatabricksAppTeamsConfig",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "email": {
+          "ref": "settings.EmailConfig",
+          "launch_stage": "GA"
+        },
+        "generic_webhook": {
+          "ref": "settings.GenericWebhookConfig",
+          "launch_stage": "GA"
+        },
+        "microsoft_teams": {
+          "ref": "settings.MicrosoftTeamsConfig",
+          "launch_stage": "GA"
+        },
+        "pagerduty": {
+          "ref": "settings.PagerdutyConfig",
+          "launch_stage": "GA"
+        },
+        "slack": {
+          "ref": "settings.SlackConfig",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.CreateIpAccessList": {
+      "description": "Details required to configure a block list or allow list.",
+      "fields": {
+        "ip_addresses": {
+          "launch_stage": "GA"
+        },
+        "label": {
+          "description": "Label for the IP access list. This **cannot** be empty.",
+          "launch_stage": "GA"
+        },
+        "list_type": {
+          "ref": "settings.ListType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.CreateIpAccessListResponse": {
+      "description": "An IP access list was successfully created.",
+      "fields": {
+        "ip_access_list": {
+          "ref": "settings.IpAccessListInfo",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.CreateNetworkConnectivityConfigRequest": {
+      "fields": {
+        "network_connectivity_config": {
+          "ref": "settings.CreateNetworkConnectivityConfiguration",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.CreateNetworkConnectivityConfiguration": {
+      "description": "Properties of the new network connectivity configuration.",
+      "fields": {
+        "name": {
+          "description": "The name of the network connectivity configuration. The name can contain alphanumeric characters, hyphens,\nand underscores. The length must be between 3 and 30 characters. The name must match the regular\nexpression ^[0-9a-zA-Z-_]{3,30}$",
+          "launch_stage": "GA"
+        },
+        "region": {
+          "description": "The region for the network connectivity configuration.\nOnly workspaces in the same region can be attached to the network connectivity configuration.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.CreateNetworkPolicyRequest": {
+      "fields": {
+        "network_policy": {
+          "description": "Network policy configuration details.",
+          "ref": "settings.AccountNetworkPolicy",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.CreateNotificationDestinationRequest": {
+      "fields": {
+        "config": {
+          "description": "The configuration for the notification destination. Must wrap EXACTLY one of the nested configs.",
+          "ref": "settings.Config",
+          "launch_stage": "GA"
+        },
+        "display_name": {
+          "description": "The display name for the notification destination.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.CreateOboTokenRequest": {
+      "description": "Configuration details for creating on-behalf tokens.",
+      "fields": {
+        "application_id": {
+          "description": "Application ID of the service principal.",
+          "launch_stage": "GA"
+        },
+        "autoscope_enabled": {
+          "description": "Whether to enable autoscoping for this token.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "comment": {
+          "description": "Comment that describes the purpose of the token.",
+          "launch_stage": "GA"
+        },
+        "lifetime_seconds": {
+          "description": "The number of seconds before the token expires.",
+          "launch_stage": "GA"
+        },
+        "scopes": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.CreateOboTokenResponse": {
+      "description": "An on-behalf token was successfully created for the service principal.",
+      "fields": {
+        "token_info": {
+          "ref": "settings.TokenInfo",
+          "launch_stage": "GA"
+        },
+        "token_value": {
+          "description": "Value of the token.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.CreatePrivateEndpointRule": {
+      "description": "Properties of the new private endpoint rule.\nNote that you must approve the endpoint in Azure portal after initialization.",
+      "fields": {
+        "domain_names": {
+          "description": "Only used by private endpoints to customer-managed private endpoint services.\n\nDomain names of target private link service.\nWhen updating this field, the full list of target domain_names must be specified.",
+          "launch_stage": "GA"
+        },
+        "endpoint_service": {
+          "description": "The full target AWS endpoint service name that connects to the destination resources of the private endpoint.",
+          "launch_stage": "GA"
+        },
+        "error_message": {
+          "launch_stage": "GA"
+        },
+        "gcp_endpoint": {
+          "ref": "settings.GcpEndpoint",
+          "launch_stage": "GA"
+        },
+        "group_id": {
+          "description": "Not used by customer-managed private endpoint services.\n\nThe sub-resource type (group ID) of the target resource.\nNote that to connect to workspace root storage (root DBFS), you need two endpoints, one for blob and one for dfs.",
+          "launch_stage": "GA"
+        },
+        "resource_id": {
+          "description": "The Azure resource ID of the target resource.",
+          "launch_stage": "GA"
+        },
+        "resource_names": {
+          "description": "Only used by private endpoints towards AWS S3 service.\n\nThe globally unique S3 bucket names that will be accessed via the VPC endpoint.\nThe bucket names must be in the same region as the NCC/endpoint service.\nWhen updating this field, we perform full update on this field. Please ensure a full list of desired\nresource_names is provided.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.CreatePrivateEndpointRuleRequest": {
+      "fields": {
+        "private_endpoint_rule": {
+          "ref": "settings.CreatePrivateEndpointRule",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.CreateTokenRequest": {
+      "fields": {
+        "autoscope_enabled": {
+          "description": "Whether to enable autoscoping for this token. When true, the token will\nautomatically collect inferred API path scopes as it is used.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "comment": {
+          "description": "Optional description to attach to the token.",
+          "launch_stage": "GA"
+        },
+        "lifetime_seconds": {
+          "description": "The lifetime of the token, in seconds.\n\nIf the lifetime is not specified, this token remains valid for 2 years.",
+          "launch_stage": "GA"
+        },
+        "scopes": {
+          "description": "Optional scopes of the token.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.CreateTokenResponse": {
+      "fields": {
+        "token_info": {
+          "description": "The information for the new token.",
+          "ref": "settings.PublicTokenInfo",
+          "launch_stage": "GA"
+        },
+        "token_value": {
+          "description": "The value of the new token.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.CspEnablementAccount": {
+      "description": "Account level policy for CSP",
+      "fields": {
+        "compliance_standards": {
+          "description": "Set by customers when they request Compliance Security Profile (CSP)\nInvariants are enforced in Settings policy.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "is_enforced": {
+          "description": "Enforced = it cannot be overriden at workspace level.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.CspEnablementAccountSetting": {
+      "fields": {
+        "csp_enablement_account": {
+          "ref": "settings.CspEnablementAccount",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag provided.\nThis is used for optimistic concurrency control as a way to help prevent simultaneous\nwrites of a setting overwriting each other. It is strongly suggested that systems\nmake use of the etag in the read -\u003e update pattern to perform setting updates in\norder to avoid race conditions. That is, get an etag from a GET request, and pass it\nwith the PATCH request to identify the setting version you are updating.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "setting_name": {
+          "description": "Name of the corresponding setting. This field is populated in the response, but it will not be respected\neven if it's set in the request body. The setting name in the path parameter will be\nrespected instead. Setting name is required to be 'default' if the setting only has one instance per workspace.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.CustomerFacingIngressNetworkPolicy": {
+      "description": "The network policies applying for ingress traffic.",
+      "fields": {
+        "cross_workspace_access": {
+          "ref": "settings.CustomerFacingIngressNetworkPolicyCrossWorkspaceAccess",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "private_access": {
+          "description": "The network policy restrictions for private access.\nConfigures how requests arriving over private connectivity are governed.",
+          "ref": "settings.CustomerFacingIngressNetworkPolicyPrivateAccess",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "public_access": {
+          "description": "The network policy restrictions for public access to the workspace.\nConfigures how public internet traffic is allowed or denied access.",
+          "ref": "settings.CustomerFacingIngressNetworkPolicyPublicAccess",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "settings.CustomerFacingIngressNetworkPolicyAccountApiDestination": {
+      "description": "Matches account-level Databricks API endpoints for an ingress network policy rule.",
+      "fields": {
+        "scope_qualifier": {
+          "description": "Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.",
+          "ref": "settings.CustomerFacingIngressNetworkPolicyApiScopeQualifier",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "scopes": {
+          "description": "The API scopes to match. Use \"all-apis\" to match any account-level API.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "settings.CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination": {
+      "fields": {
+        "all_destinations": {
+          "description": "Must be set to true.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "settings.CustomerFacingIngressNetworkPolicyAccountUiDestination": {
+      "description": "The account console UI destination.",
+      "fields": {
+        "all_destinations": {
+          "description": "Must be set to true.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "settings.CustomerFacingIngressNetworkPolicyApiScopeQualifier": {
+      "description": "Qualifies the breadth of API access permitted by an ingress network policy rule.\nAPI_SCOPE_QUALIFIER_READ narrows matching to read-only variants of the listed scopes;\nAPI_SCOPE_QUALIFIER_ALL matches any scope. When unset, scopes match exactly as listed.",
+      "enum": [
+        "API_SCOPE_QUALIFIER_READ",
+        "API_SCOPE_QUALIFIER_ALL"
+      ],
+      "enum_launch_stages": {
+        "API_SCOPE_QUALIFIER_ALL": "GA",
+        "API_SCOPE_QUALIFIER_READ": "GA"
+      }
+    },
+    "settings.CustomerFacingIngressNetworkPolicyAppsRuntimeDestination": {
+      "fields": {
+        "all_destinations": {
+          "description": "Must be set to true.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.CustomerFacingIngressNetworkPolicyAuthentication": {
+      "fields": {
+        "identities": {
+          "description": "Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES.",
+          "launch_stage": "GA"
+        },
+        "identity_type": {
+          "ref": "settings.CustomerFacingIngressNetworkPolicyAuthenticationIdentityType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.CustomerFacingIngressNetworkPolicyAuthenticationIdentity": {
+      "fields": {
+        "principal_id": {
+          "launch_stage": "GA"
+        },
+        "principal_type": {
+          "ref": "settings.CustomerFacingIngressNetworkPolicyAuthenticationIdentityPrincipalType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.CustomerFacingIngressNetworkPolicyAuthenticationIdentityPrincipalType": {
+      "enum": [
+        "PRINCIPAL_TYPE_USER",
+        "PRINCIPAL_TYPE_SERVICE_PRINCIPAL"
+      ],
+      "enum_launch_stages": {
+        "PRINCIPAL_TYPE_SERVICE_PRINCIPAL": "GA",
+        "PRINCIPAL_TYPE_USER": "GA"
+      }
+    },
+    "settings.CustomerFacingIngressNetworkPolicyAuthenticationIdentityType": {
+      "enum": [
+        "IDENTITY_TYPE_ALL_USERS",
+        "IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS",
+        "IDENTITY_TYPE_SELECTED_IDENTITIES"
+      ],
+      "enum_launch_stages": {
+        "IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS": "GA",
+        "IDENTITY_TYPE_ALL_USERS": "GA",
+        "IDENTITY_TYPE_SELECTED_IDENTITIES": "GA"
+      }
+    },
+    "settings.CustomerFacingIngressNetworkPolicyCrossWorkspaceAccess": {
+      "fields": {
+        "allow_rules": {
+          "description": "Allow rules are evaluated after deny rules. A request matching any allow rule is\nallowed; a request matching no rule is denied by default. Only applies when\nrestriction_mode is RESTRICTED_ACCESS.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "deny_rules": {
+          "description": "Deny rules are evaluated first. A request matching any deny rule is denied,\nregardless of allow rules. Only applies when restriction_mode is RESTRICTED_ACCESS.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "restriction_mode": {
+          "description": "The restriction mode for cross-workspace access.",
+          "ref": "settings.CustomerFacingIngressNetworkPolicyCrossWorkspaceAccessRestrictionMode",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "settings.CustomerFacingIngressNetworkPolicyCrossWorkspaceAccessRestrictionMode": {
+      "description": "The restriction mode for cross-workspace access. In FULL_ACCESS mode, requests from any\nsource workspace (in any account) are allowed, and deny rules and allow rules cannot be set.\nIn RESTRICTED_ACCESS mode, access is restricted based on deny rules and allow rules;\nrequests that do not match any allow rule are denied. In LEGACY_MODE, cross-workspace\ningress is not governed by this policy.",
+      "enum": [
+        "FULL_ACCESS",
+        "RESTRICTED_ACCESS",
+        "LEGACY_MODE"
+      ],
+      "enum_launch_stages": {
+        "FULL_ACCESS": "PUBLIC_BETA",
+        "LEGACY_MODE": "PUBLIC_BETA",
+        "RESTRICTED_ACCESS": "PUBLIC_BETA"
+      }
+    },
+    "settings.CustomerFacingIngressNetworkPolicyCrossWorkspaceIngressRule": {
+      "description": "An ingress rule is enforced when a request satisfies all\nspecified attributes — including request origin, destination, and authentication.",
+      "fields": {
+        "authentication": {
+          "description": "The authenticated identity the request must match. When unset, the rule matches\nall users and service principals.",
+          "ref": "settings.CustomerFacingIngressNetworkPolicyAuthentication",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "destination": {
+          "description": "The destination the request must match — the resource being accessed, for example\nthe workspace UI or workspace APIs. See RequestDestination.",
+          "ref": "settings.CustomerFacingIngressNetworkPolicyRequestDestination",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "label": {
+          "description": "The label for this ingress rule.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "origin": {
+          "description": "The origin the request must match — the source workspace the request comes from,\neither specific source workspaces or any source workspace in any account. See\nCrossWorkspaceRequestOrigin.",
+          "ref": "settings.CustomerFacingIngressNetworkPolicyCrossWorkspaceRequestOrigin",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "settings.CustomerFacingIngressNetworkPolicyCrossWorkspaceRequestOrigin": {
+      "fields": {
+        "all_source_workspaces": {
+          "description": "Matches all source workspaces.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "selected_workspaces": {
+          "description": "Specific source workspace IDs to match.",
+          "ref": "settings.CustomerFacingIngressNetworkPolicyWorkspaceIdList",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "settings.CustomerFacingIngressNetworkPolicyEndpoints": {
+      "description": "A set of registered endpoints, identified by their endpoint IDs.",
+      "fields": {
+        "endpoint_ids": {
+          "description": "The IDs of the registered endpoints. Must contain at least one endpoint ID.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "settings.CustomerFacingIngressNetworkPolicyIpRanges": {
+      "fields": {
+        "ip_ranges": {
+          "description": "We only support IPv4 and IPv4 CIDR notation for now.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.CustomerFacingIngressNetworkPolicyLakebaseRuntimeDestination": {
+      "fields": {
+        "all_destinations": {
+          "description": "Must be set to true.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.CustomerFacingIngressNetworkPolicyPrivateAccess": {
+      "description": "Configures how requests arriving over private connectivity, such as\nregistered endpoints, are allowed or denied access.",
+      "fields": {
+        "allow_rules": {
+          "description": "Allow rules are evaluated after deny rules. A request matching any allow rule is\nallowed; a request matching no rule is denied by default. Only applies when\nrestriction_mode is RESTRICTED_ACCESS.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "deny_rules": {
+          "description": "Deny rules are evaluated first. A request matching any deny rule is denied,\nregardless of allow rules. Only applies when restriction_mode is RESTRICTED_ACCESS.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "restriction_mode": {
+          "description": "The restriction mode for private access.",
+          "ref": "settings.CustomerFacingIngressNetworkPolicyPrivateAccessRestrictionMode",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "settings.CustomerFacingIngressNetworkPolicyPrivateAccessRestrictionMode": {
+      "description": "The restriction mode for private access. In ALLOW_ALL_REGISTERED_ENDPOINTS mode,\nrequests arriving through any endpoint registered to the account are allowed, and\ndeny rules and allow rules cannot be set. In RESTRICTED_ACCESS mode, access is\nrestricted based on deny rules and allow rules; requests that do not match any\nallow rule are denied.",
+      "enum": [
+        "ALLOW_ALL_REGISTERED_ENDPOINTS",
+        "RESTRICTED_ACCESS"
+      ],
+      "enum_launch_stages": {
+        "ALLOW_ALL_REGISTERED_ENDPOINTS": "PUBLIC_BETA",
+        "RESTRICTED_ACCESS": "PUBLIC_BETA"
+      }
+    },
+    "settings.CustomerFacingIngressNetworkPolicyPrivateIngressRule": {
+      "description": "An ingress rule is enforced when a request satisfies all\nspecified attributes — including request origin, destination, and authentication.",
+      "fields": {
+        "authentication": {
+          "description": "The authenticated identity the request must match. When unset, the rule matches\nall users and service principals.\nOn the account-level network policy, scoping to specific identities is not\ncurrently supported, so this field must be unset (the rule matches all users\nand service principals).",
+          "ref": "settings.CustomerFacingIngressNetworkPolicyAuthentication",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "destination": {
+          "description": "The destination the request must match — the resource being accessed, for example\nthe workspace UI, workspace APIs, or account-level APIs. See RequestDestination.",
+          "ref": "settings.CustomerFacingIngressNetworkPolicyRequestDestination",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "label": {
+          "description": "The label for this ingress rule.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "origin": {
+          "description": "The origin the request must match — the private connectivity the request arrives\nthrough, for example a specific set of registered endpoints or any endpoint\nregistered to the account. See PrivateRequestOrigin.",
+          "ref": "settings.CustomerFacingIngressNetworkPolicyPrivateRequestOrigin",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "settings.CustomerFacingIngressNetworkPolicyPrivateRequestOrigin": {
+      "description": "The origin of a private access request, identified by the endpoint\nthrough which the request arrives.",
+      "fields": {
+        "all_private_access": {
+          "description": "Matches requests arriving over any private connectivity, including registered\nendpoints and the workspace's Azure Private Link (ui-api) endpoints.\nCan only be used in deny rules of workspace-level network policies.\nMust be set to true when specified.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "all_registered_endpoints": {
+          "description": "Matches requests arriving through any endpoint registered to the account.\nMust be set to true when specified.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "azure_workspace_private_link": {
+          "description": "Matches requests arriving through the workspace's Azure Private Link (ui-api)\nendpoints. Can only be used in deny rules of workspace-level network policies.\nMust be set to true when specified.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "endpoints": {
+          "description": "Matches requests arriving through any of the specified registered endpoints.",
+          "ref": "settings.CustomerFacingIngressNetworkPolicyEndpoints",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "settings.CustomerFacingIngressNetworkPolicyPublicAccess": {
+      "fields": {
+        "allow_rules": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "deny_rules": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "restriction_mode": {
+          "ref": "settings.CustomerFacingIngressNetworkPolicyPublicAccessRestrictionMode",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.CustomerFacingIngressNetworkPolicyPublicAccessRestrictionMode": {
+      "enum": [
+        "FULL_ACCESS",
+        "RESTRICTED_ACCESS"
+      ],
+      "enum_launch_stages": {
+        "FULL_ACCESS": "GA",
+        "RESTRICTED_ACCESS": "GA"
+      }
+    },
+    "settings.CustomerFacingIngressNetworkPolicyPublicIngressRule": {
+      "description": "An ingress rule is enforced when a request satisfies all\nspecified attributes — including request origin, destination, and authentication.",
+      "fields": {
+        "authentication": {
+          "ref": "settings.CustomerFacingIngressNetworkPolicyAuthentication",
+          "launch_stage": "GA"
+        },
+        "destination": {
+          "ref": "settings.CustomerFacingIngressNetworkPolicyRequestDestination",
+          "launch_stage": "GA"
+        },
+        "label": {
+          "description": "The label for this ingress rule.",
+          "launch_stage": "GA"
+        },
+        "origin": {
+          "ref": "settings.CustomerFacingIngressNetworkPolicyPublicRequestOrigin",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.CustomerFacingIngressNetworkPolicyPublicRequestOrigin": {
+      "fields": {
+        "all_ip_ranges": {
+          "description": "Matches all IPv4 and IPv6 ranges (both public and private).",
+          "launch_stage": "GA"
+        },
+        "excluded_ip_ranges": {
+          "description": "Excluded means: all public IP ranges except this one.",
+          "ref": "settings.CustomerFacingIngressNetworkPolicyIpRanges",
+          "launch_stage": "GA"
+        },
+        "included_ip_ranges": {
+          "description": "Will not allow IP ranges with private IPs.",
+          "ref": "settings.CustomerFacingIngressNetworkPolicyIpRanges",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.CustomerFacingIngressNetworkPolicyRequestDestination": {
+      "fields": {
+        "account_api": {
+          "description": "Matches requests to account-level APIs.\nCan only be used in the account-level network policy.",
+          "ref": "settings.CustomerFacingIngressNetworkPolicyAccountApiDestination",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "account_databricks_one": {
+          "description": "Account DatabricksOne destination is not supported.",
+          "ref": "settings.CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "account_ui": {
+          "description": "Matches requests to the account console UI.\nCan only be used in the account-level network policy.",
+          "ref": "settings.CustomerFacingIngressNetworkPolicyAccountUiDestination",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "all_destinations": {
+          "description": "When true, match all destinations, no other destination fields can be set.\nWhen not set or false, at least one specific destination must be provided.",
+          "launch_stage": "GA"
+        },
+        "apps_runtime": {
+          "ref": "settings.CustomerFacingIngressNetworkPolicyAppsRuntimeDestination",
+          "launch_stage": "GA"
+        },
+        "lakebase_runtime": {
+          "ref": "settings.CustomerFacingIngressNetworkPolicyLakebaseRuntimeDestination",
+          "launch_stage": "GA"
+        },
+        "workspace_api": {
+          "ref": "settings.CustomerFacingIngressNetworkPolicyWorkspaceApiDestination",
+          "launch_stage": "GA"
+        },
+        "workspace_ui": {
+          "ref": "settings.CustomerFacingIngressNetworkPolicyWorkspaceUiDestination",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.CustomerFacingIngressNetworkPolicyWorkspaceApiDestination": {
+      "description": "Matches workspace-level Databricks API endpoints for an ingress network policy rule.",
+      "fields": {
+        "excluded_scopes": {
+          "description": "Inverse of `scopes`: matches every API scope EXCEPT those listed here\n(\"allow all except\"). Mutually exclusive with `scopes` — a single\ndestination may set at most one of the two.",
+          "launch_stage": "GA"
+        },
+        "scope_qualifier": {
+          "description": "Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.",
+          "ref": "settings.CustomerFacingIngressNetworkPolicyApiScopeQualifier",
+          "launch_stage": "GA"
+        },
+        "scopes": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.CustomerFacingIngressNetworkPolicyWorkspaceIdList": {
+      "fields": {
+        "workspace_ids": {
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "settings.CustomerFacingIngressNetworkPolicyWorkspaceUiDestination": {
+      "fields": {
+        "all_destinations": {
+          "description": "Must be set to true.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.CustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRule": {
+      "description": "Properties of the new private endpoint rule.\nNote that for private endpoints towards a VPC endpoint service behind a customer-managed NLB,\nyou must approve the endpoint in AWS console after initialization.",
+      "fields": {
+        "account_id": {
+          "description": "Databricks account ID. You can find your account ID from the Accounts Console.",
+          "launch_stage": "GA"
+        },
+        "connection_state": {
+          "description": "The current status of this private endpoint. The private endpoint rules are effective only if the connection state\nis ESTABLISHED. Remember that you must approve new endpoints on your resources in the AWS console\nbefore they take effect.\nThe possible values are:\n- PENDING: The endpoint has been created and pending approval.\n- ESTABLISHED: The endpoint has been approved and is ready to use in your serverless compute resources.\n- REJECTED: Connection was rejected by the private link resource owner.\n- DISCONNECTED: Connection was removed by the private link resource owner, the private endpoint becomes informative and should be deleted for clean-up.\n- EXPIRED: If the endpoint is created but not approved in 14 days, it is EXPIRED.",
+          "ref": "settings.CustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRulePrivateLinkConnectionState",
+          "launch_stage": "GA"
+        },
+        "creation_time": {
+          "description": "Time in epoch milliseconds when this object was created.",
+          "launch_stage": "GA"
+        },
+        "deactivated": {
+          "description": "Whether this private endpoint is deactivated.",
+          "launch_stage": "GA"
+        },
+        "deactivated_at": {
+          "description": "Time in epoch milliseconds when this object was deactivated.",
+          "launch_stage": "GA"
+        },
+        "domain_names": {
+          "description": "Only used by private endpoints towards a VPC endpoint service for customer-managed VPC endpoint service.\n\nThe target AWS resource FQDNs accessible via the VPC endpoint service.\nWhen updating this field, we perform full update on this field. Please ensure a full list of desired domain_names is provided.",
+          "launch_stage": "GA"
+        },
+        "enabled": {
+          "description": "Only used by private endpoints towards an AWS S3 service.\n\nUpdate this field to activate/deactivate this private endpoint to allow egress access from serverless compute resources.",
+          "launch_stage": "GA"
+        },
+        "endpoint_service": {
+          "description": "The full target AWS endpoint service name that connects to the destination resources of the private endpoint.",
+          "launch_stage": "GA"
+        },
+        "error_message": {
+          "launch_stage": "GA"
+        },
+        "network_connectivity_config_id": {
+          "description": "The ID of a network connectivity configuration, which is the parent resource of this private endpoint rule object.",
+          "launch_stage": "GA"
+        },
+        "resource_names": {
+          "description": "Only used by private endpoints towards AWS S3 service.\n\nThe globally unique S3 bucket names that will be accessed via the VPC endpoint.\nThe bucket names must be in the same region as the NCC/endpoint service.\nWhen updating this field, we perform full update on this field.\nPlease ensure a full list of desired resource_names is provided.",
+          "launch_stage": "GA"
+        },
+        "rule_id": {
+          "description": "The ID of a private endpoint rule.",
+          "launch_stage": "GA"
+        },
+        "updated_time": {
+          "description": "Time in epoch milliseconds when this object was updated.",
+          "launch_stage": "GA"
+        },
+        "vpc_endpoint_id": {
+          "description": "The AWS VPC endpoint ID. You can use this ID to identify VPC endpoint created by Databricks.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.CustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRulePrivateLinkConnectionState": {
+      "enum": [
+        "ESTABLISHED",
+        "REJECTED",
+        "DISCONNECTED",
+        "EXPIRED",
+        "PENDING",
+        "CREATING",
+        "CREATE_FAILED"
+      ],
+      "enum_launch_stages": {
+        "CREATE_FAILED": "GA",
+        "CREATING": "GA",
+        "DISCONNECTED": "GA",
+        "ESTABLISHED": "GA",
+        "EXPIRED": "GA",
+        "PENDING": "GA",
+        "REJECTED": "GA"
+      }
+    },
+    "settings.DashboardEmailSubscriptions": {
+      "fields": {
+        "boolean_val": {
+          "ref": "settings.BooleanMessage",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag provided.\nThis is used for optimistic concurrency control as a way to help prevent simultaneous\nwrites of a setting overwriting each other. It is strongly suggested that systems\nmake use of the etag in the read -\u003e update pattern to perform setting updates in\norder to avoid race conditions. That is, get an etag from a GET request, and pass it\nwith the PATCH request to identify the setting version you are updating.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "setting_name": {
+          "description": "Name of the corresponding setting. This field is populated in the response, but it will not be respected\neven if it's set in the request body. The setting name in the path parameter will be\nrespected instead. Setting name is required to be 'default' if the setting only has one instance per workspace.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.DatabricksAppSlackConfig": {
+      "description": "Slack channel reached through the Databricks app. The app must already be installed in the\nSlack workspace and connected to this Databricks workspace.",
+      "fields": {
+        "channel_id": {
+          "description": "[Input-Only] Slack channel ID notifications are posted to.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "channel_id_set": {
+          "description": "[Output-Only] Whether channel ID is set.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "team_id": {
+          "description": "[Input-Only] Slack workspace (team) ID the Databricks app is installed in.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "team_id_set": {
+          "description": "[Output-Only] Whether team ID is set.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "settings.DatabricksAppTeamsConfig": {
+      "description": "Microsoft Teams channel reached through the Databricks app. The app must already be installed in\nthe Microsoft 365 tenant and connected to this Databricks workspace.",
+      "fields": {
+        "channel_id": {
+          "description": "[Input-Only] Teams channel ID notifications are posted to.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "channel_id_set": {
+          "description": "[Output-Only] Whether channel ID is set.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "team_id": {
+          "description": "[Input-Only] Microsoft Entra group ID of the team that owns the channel.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "team_id_set": {
+          "description": "[Output-Only] Whether team ID is set.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "tenant_id": {
+          "description": "[Input-Only] Microsoft Entra tenant ID of the Microsoft 365 tenant the app is installed in.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "tenant_id_set": {
+          "description": "[Output-Only] Whether tenant ID is set.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "settings.DefaultNamespaceSetting": {
+      "description": "This represents the setting configuration for the default namespace in the Databricks workspace.\nSetting the default catalog for the workspace determines the catalog that is used when queries do not reference\na fully qualified 3 level name. For example, if the default catalog is set to 'retail_prod' then a query\n'SELECT * FROM myTable' would reference the object 'retail_prod.default.myTable' (the schema\n'default' is always assumed). This setting requires a restart of clusters and SQL warehouses to take effect.\nAdditionally, the default namespace only applies when using Unity Catalog-enabled compute.",
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag provided.\nThis is used for optimistic concurrency control as a way to help prevent simultaneous\nwrites of a setting overwriting each other. It is strongly suggested that systems\nmake use of the etag in the read -\u003e update pattern to perform setting updates in\norder to avoid race conditions. That is, get an etag from a GET request, and pass it\nwith the PATCH request to identify the setting version you are updating.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "namespace": {
+          "ref": "settings.StringMessage",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "setting_name": {
+          "description": "Name of the corresponding setting. This field is populated in the response, but it will not be respected\neven if it's set in the request body. The setting name in the path parameter will be\nrespected instead. Setting name is required to be 'default' if the setting only has one instance per workspace.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.DefaultWarehouseId": {
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag provided.\nThis is used for optimistic concurrency control as a way to help prevent simultaneous\nwrites of a setting overwriting each other. It is strongly suggested that systems\nmake use of the etag in the read -\u003e update pattern to perform setting updates in\norder to avoid race conditions. That is, get an etag from a GET request, and pass it\nwith the PATCH request to identify the setting version you are updating.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "setting_name": {
+          "description": "Name of the corresponding setting. This field is populated in the response, but it will not be respected\neven if it's set in the request body. The setting name in the path parameter will be\nrespected instead. Setting name is required to be 'default' if the setting only has one instance per workspace.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "string_val": {
+          "ref": "settings.StringMessage",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "settings.DeleteAccountIpAccessEnableRequest": {
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "settings.DeleteAccountIpAccessEnableResponse": {
+      "description": "The etag is returned.",
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "settings.DeleteAccountIpAccessListRequest": {},
+    "settings.DeleteAibiDashboardEmbeddingAccessPolicySettingRequest": {
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.DeleteAibiDashboardEmbeddingAccessPolicySettingResponse": {
+      "description": "The etag is returned.",
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.DeleteAibiDashboardEmbeddingApprovedDomainsSettingRequest": {
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.DeleteAibiDashboardEmbeddingApprovedDomainsSettingResponse": {
+      "description": "The etag is returned.",
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.DeleteDashboardEmailSubscriptionsRequest": {
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.DeleteDashboardEmailSubscriptionsResponse": {
+      "description": "The etag is returned.",
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.DeleteDefaultNamespaceSettingRequest": {
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.DeleteDefaultNamespaceSettingResponse": {
+      "description": "The etag is returned.",
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.DeleteDefaultWarehouseIdRequest": {
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "settings.DeleteDefaultWarehouseIdResponse": {
+      "description": "The etag is returned.",
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "settings.DeleteDisableLegacyAccessRequest": {
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.DeleteDisableLegacyAccessResponse": {
+      "description": "The etag is returned.",
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.DeleteDisableLegacyDbfsRequest": {
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.DeleteDisableLegacyDbfsResponse": {
+      "description": "The etag is returned.",
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.DeleteDisableLegacyFeaturesRequest": {
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.DeleteDisableLegacyFeaturesResponse": {
+      "description": "The etag is returned.",
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.DeleteIpAccessListRequest": {},
+    "settings.DeleteLlmProxyPartnerPoweredWorkspaceRequest": {
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "settings.DeleteLlmProxyPartnerPoweredWorkspaceResponse": {
+      "description": "The etag is returned.",
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "settings.DeleteNetworkConnectivityConfigurationRequest": {},
+    "settings.DeleteNetworkPolicyRequest": {},
+    "settings.DeleteNotificationDestinationRequest": {},
+    "settings.DeletePersonalComputeSettingRequest": {
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "settings.DeletePersonalComputeSettingResponse": {
+      "description": "The etag is returned.",
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "settings.DeletePrivateEndpointRuleRequest": {},
+    "settings.DeleteRestrictWorkspaceAdminsSettingRequest": {
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.DeleteRestrictWorkspaceAdminsSettingResponse": {
+      "description": "The etag is returned.",
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.DeleteSqlResultsDownloadRequest": {
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.DeleteSqlResultsDownloadResponse": {
+      "description": "The etag is returned.",
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.DeleteTokenManagementRequest": {},
+    "settings.DestinationType": {
+      "enum": [
+        "SLACK",
+        "EMAIL",
+        "WEBHOOK",
+        "PAGERDUTY",
+        "MICROSOFT_TEAMS",
+        "DATABRICKS_APP_SLACK",
+        "DATABRICKS_APP_TEAMS"
+      ],
+      "enum_launch_stages": {
+        "DATABRICKS_APP_SLACK": "PUBLIC_BETA",
+        "DATABRICKS_APP_TEAMS": "PUBLIC_BETA",
+        "EMAIL": "GA",
+        "MICROSOFT_TEAMS": "GA",
+        "PAGERDUTY": "GA",
+        "SLACK": "GA",
+        "WEBHOOK": "GA"
+      }
+    },
+    "settings.DisableLegacyAccess": {
+      "fields": {
+        "disable_legacy_access": {
+          "ref": "settings.BooleanMessage",
+          "launch_stage": "GA"
+        },
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag provided.\nThis is used for optimistic concurrency control as a way to help prevent simultaneous\nwrites of a setting overwriting each other. It is strongly suggested that systems\nmake use of the etag in the read -\u003e update pattern to perform setting updates in\norder to avoid race conditions. That is, get an etag from a GET request, and pass it\nwith the PATCH request to identify the setting version you are updating.",
+          "launch_stage": "GA"
+        },
+        "setting_name": {
+          "description": "Name of the corresponding setting. This field is populated in the response, but it will not be respected\neven if it's set in the request body. The setting name in the path parameter will be\nrespected instead. Setting name is required to be 'default' if the setting only has one instance per workspace.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.DisableLegacyDbfs": {
+      "fields": {
+        "disable_legacy_dbfs": {
+          "ref": "settings.BooleanMessage",
+          "launch_stage": "GA"
+        },
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag provided.\nThis is used for optimistic concurrency control as a way to help prevent simultaneous\nwrites of a setting overwriting each other. It is strongly suggested that systems\nmake use of the etag in the read -\u003e update pattern to perform setting updates in\norder to avoid race conditions. That is, get an etag from a GET request, and pass it\nwith the PATCH request to identify the setting version you are updating.",
+          "launch_stage": "GA"
+        },
+        "setting_name": {
+          "description": "Name of the corresponding setting. This field is populated in the response, but it will not be respected\neven if it's set in the request body. The setting name in the path parameter will be\nrespected instead. Setting name is required to be 'default' if the setting only has one instance per workspace.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.DisableLegacyFeatures": {
+      "fields": {
+        "disable_legacy_features": {
+          "ref": "settings.BooleanMessage",
+          "launch_stage": "GA"
+        },
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag provided.\nThis is used for optimistic concurrency control as a way to help prevent simultaneous\nwrites of a setting overwriting each other. It is strongly suggested that systems\nmake use of the etag in the read -\u003e update pattern to perform setting updates in\norder to avoid race conditions. That is, get an etag from a GET request, and pass it\nwith the PATCH request to identify the setting version you are updating.",
+          "launch_stage": "GA"
+        },
+        "setting_name": {
+          "description": "Name of the corresponding setting. This field is populated in the response, but it will not be respected\neven if it's set in the request body. The setting name in the path parameter will be\nrespected instead. Setting name is required to be 'default' if the setting only has one instance per workspace.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.EgressNetworkPolicy": {
+      "description": "The network policies applying for egress traffic.\nThis message is used by the UI/REST API. We translate this message to the format expected by the\ndataplane in Lakehouse Network Manager (for the format expected by the dataplane,\nsee networkconfig.textproto).",
+      "fields": {
+        "internet_access": {
+          "description": "The access policy enforced for egress traffic to the internet.",
+          "ref": "settings.EgressNetworkPolicyInternetAccessPolicy",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.EgressNetworkPolicyInternetAccessPolicy": {
+      "fields": {
+        "allowed_internet_destinations": {
+          "launch_stage": "GA"
+        },
+        "allowed_storage_destinations": {
+          "launch_stage": "GA"
+        },
+        "log_only_mode": {
+          "description": "Optional. If not specified, assume the policy is enforced for all workloads.",
+          "ref": "settings.EgressNetworkPolicyInternetAccessPolicyLogOnlyMode",
+          "launch_stage": "GA"
+        },
+        "restriction_mode": {
+          "ref": "settings.EgressNetworkPolicyInternetAccessPolicyRestrictionMode",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.EgressNetworkPolicyInternetAccessPolicyInternetDestination": {
+      "description": "Users can specify accessible internet destinations when outbound access is restricted.\nWe only support domain name (FQDN) destinations for the time being,\nthough going forwards we want to support host names and IP addresses.",
+      "fields": {
+        "destination": {
+          "launch_stage": "GA"
+        },
+        "protocol": {
+          "ref": "settings.EgressNetworkPolicyInternetAccessPolicyInternetDestinationInternetDestinationFilteringProtocol",
+          "launch_stage": "GA"
+        },
+        "type": {
+          "ref": "settings.EgressNetworkPolicyInternetAccessPolicyInternetDestinationInternetDestinationType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.EgressNetworkPolicyInternetAccessPolicyInternetDestinationInternetDestinationFilteringProtocol": {
+      "description": "The filtering protocol used by the DP. For private and public preview, SEG will only\nsupport TCP filtering (i.e. DNS based filtering, filtering by destination IP address),\nso protocol will be set to TCP by default and hidden from the user. In the future, users\nmay be able to select HTTP filtering (i.e. SNI based filtering, filtering by FQDN).",
+      "enum": [
+        "TCP"
+      ],
+      "enum_launch_stages": {
+        "TCP": "GA"
+      }
+    },
+    "settings.EgressNetworkPolicyInternetAccessPolicyInternetDestinationInternetDestinationType": {
+      "enum": [
+        "FQDN"
+      ],
+      "enum_launch_stages": {
+        "FQDN": "GA"
+      }
+    },
+    "settings.EgressNetworkPolicyInternetAccessPolicyLogOnlyMode": {
+      "fields": {
+        "log_only_mode_type": {
+          "ref": "settings.EgressNetworkPolicyInternetAccessPolicyLogOnlyModeLogOnlyModeType",
+          "launch_stage": "GA"
+        },
+        "workloads": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.EgressNetworkPolicyInternetAccessPolicyLogOnlyModeLogOnlyModeType": {
+      "enum": [
+        "ALL_SERVICES",
+        "SELECTED_SERVICES"
+      ],
+      "enum_launch_stages": {
+        "ALL_SERVICES": "GA",
+        "SELECTED_SERVICES": "GA"
+      }
+    },
+    "settings.EgressNetworkPolicyInternetAccessPolicyLogOnlyModeWorkloadType": {
+      "description": "The values should match the list of workloads used in networkconfig.proto",
+      "enum": [
+        "DBSQL",
+        "ML_SERVING"
+      ],
+      "enum_launch_stages": {
+        "DBSQL": "GA",
+        "ML_SERVING": "GA"
+      }
+    },
+    "settings.EgressNetworkPolicyInternetAccessPolicyRestrictionMode": {
+      "description": "At which level can Databricks and Databricks managed compute access Internet.\nFULL_ACCESS: Databricks can access Internet. No blocking rules will apply.\nRESTRICTED_ACCESS: Databricks can only access explicitly allowed internet and storage destinations,\nas well as UC connections and external locations.\nPRIVATE_ACCESS_ONLY (not used): Databricks can only access destinations via private link.",
+      "enum": [
+        "FULL_ACCESS",
+        "PRIVATE_ACCESS_ONLY",
+        "RESTRICTED_ACCESS"
+      ],
+      "enum_launch_stages": {
+        "FULL_ACCESS": "GA",
+        "PRIVATE_ACCESS_ONLY": "GA",
+        "RESTRICTED_ACCESS": "GA"
+      }
+    },
+    "settings.EgressNetworkPolicyInternetAccessPolicyStorageDestination": {
+      "description": "Users can specify accessible storage destinations.",
+      "fields": {
+        "allowed_paths": {
+          "launch_stage": "GA"
+        },
+        "azure_container": {
+          "launch_stage": "GA"
+        },
+        "azure_dns_zone": {
+          "launch_stage": "GA"
+        },
+        "azure_storage_account": {
+          "launch_stage": "GA"
+        },
+        "azure_storage_service": {
+          "launch_stage": "GA"
+        },
+        "bucket_name": {
+          "launch_stage": "GA"
+        },
+        "region": {
+          "launch_stage": "GA"
+        },
+        "type": {
+          "ref": "settings.EgressNetworkPolicyInternetAccessPolicyStorageDestinationStorageDestinationType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.EgressNetworkPolicyInternetAccessPolicyStorageDestinationStorageDestinationType": {
+      "enum": [
+        "AWS_S3",
+        "CLOUDFLARE_R2",
+        "AZURE_STORAGE",
+        "GOOGLE_CLOUD_STORAGE"
+      ],
+      "enum_launch_stages": {
+        "AWS_S3": "GA",
+        "AZURE_STORAGE": "GA",
+        "CLOUDFLARE_R2": "GA",
+        "GOOGLE_CLOUD_STORAGE": "GA"
+      }
+    },
+    "settings.EgressNetworkPolicyNetworkAccessPolicy": {
+      "fields": {
+        "allowed_databricks_destinations": {
+          "description": "List of Databricks workspace destinations that serverless workloads are\nallowed to access when in RESTRICTED_ACCESS mode.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "allowed_internet_destinations": {
+          "description": "List of internet destinations that serverless workloads are allowed to access when in RESTRICTED_ACCESS mode.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "allowed_storage_destinations": {
+          "description": "List of storage destinations that serverless workloads are allowed to access when in RESTRICTED_ACCESS mode.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "blocked_internet_destinations": {
+          "description": "List of internet destinations that serverless workloads are blocked from accessing.\nThese destinations are enforced when restriction mode is RESTRICTED_ACCESS or DRY_RUN.\nCurrently supports DNS_NAME type only; IP_RANGE support is planned.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "policy_enforcement": {
+          "description": "Optional. When policy_enforcement is not provided, we default to ENFORCE_MODE_ALL_SERVICES",
+          "ref": "settings.EgressNetworkPolicyNetworkAccessPolicyPolicyEnforcement",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "restriction_mode": {
+          "description": "The restriction mode that controls how serverless workloads can access the internet.",
+          "ref": "settings.EgressNetworkPolicyNetworkAccessPolicyRestrictionMode",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.EgressNetworkPolicyNetworkAccessPolicyDatabricksDestination": {
+      "fields": {
+        "workspace_ids": {
+          "description": "The workspace IDs to allow egress traffic to.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "settings.EgressNetworkPolicyNetworkAccessPolicyInternetDestination": {
+      "description": "Users can specify accessible internet destinations when outbound access is restricted.\nWe only support DNS_NAME (FQDN format) destinations for the time being.\nGoing forward we may extend support to host names and IP addresses.",
+      "fields": {
+        "destination": {
+          "description": "The internet destination to which access will be allowed. Format dependent on the destination type.",
+          "launch_stage": "GA"
+        },
+        "internet_destination_type": {
+          "description": "The type of internet destination. Currently only DNS_NAME is supported.",
+          "ref": "settings.EgressNetworkPolicyNetworkAccessPolicyInternetDestinationInternetDestinationType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.EgressNetworkPolicyNetworkAccessPolicyInternetDestinationInternetDestinationType": {
+      "enum": [
+        "DNS_NAME"
+      ],
+      "enum_launch_stages": {
+        "DNS_NAME": "GA"
+      }
+    },
+    "settings.EgressNetworkPolicyNetworkAccessPolicyPolicyEnforcement": {
+      "fields": {
+        "dry_run_mode_product_filter": {
+          "description": "When empty, it means dry run for all products.\nWhen non-empty, it means dry run for specific products and for the other products, they will run in enforced mode.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "enforcement_mode": {
+          "description": "The mode of policy enforcement. ENFORCED blocks traffic that violates policy,\nwhile DRY_RUN only logs violations without blocking. When not specified,\ndefaults to ENFORCED.",
+          "ref": "settings.EgressNetworkPolicyNetworkAccessPolicyPolicyEnforcementEnforcementMode",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "settings.EgressNetworkPolicyNetworkAccessPolicyPolicyEnforcementDryRunModeProductFilter": {
+      "description": "The values should match the list of workloads used in networkconfig.proto",
+      "enum": [
+        "DBSQL",
+        "ML_SERVING"
+      ],
+      "enum_launch_stages": {
+        "DBSQL": "GA",
+        "ML_SERVING": "GA"
+      }
+    },
+    "settings.EgressNetworkPolicyNetworkAccessPolicyPolicyEnforcementEnforcementMode": {
+      "enum": [
+        "ENFORCED",
+        "DRY_RUN"
+      ],
+      "enum_launch_stages": {
+        "DRY_RUN": "GA",
+        "ENFORCED": "GA"
+      }
+    },
+    "settings.EgressNetworkPolicyNetworkAccessPolicyRestrictionMode": {
+      "description": "At which level can Databricks and Databricks managed compute access Internet.\nFULL_ACCESS: Databricks can access Internet. No blocking rules will apply.\nRESTRICTED_ACCESS: Databricks can only access explicitly allowed internet and storage destinations,\nas well as UC connections and external locations.",
+      "enum": [
+        "FULL_ACCESS",
+        "RESTRICTED_ACCESS"
+      ],
+      "enum_launch_stages": {
+        "FULL_ACCESS": "GA",
+        "RESTRICTED_ACCESS": "GA"
+      }
+    },
+    "settings.EgressNetworkPolicyNetworkAccessPolicyStorageDestination": {
+      "description": "Users can specify accessible storage destinations.",
+      "fields": {
+        "azure_storage_account": {
+          "description": "The Azure storage account name.",
+          "launch_stage": "GA"
+        },
+        "azure_storage_service": {
+          "description": "The Azure storage service type (blob, dfs, etc.).",
+          "launch_stage": "GA"
+        },
+        "bucket_name": {
+          "launch_stage": "GA"
+        },
+        "region": {
+          "launch_stage": "GA"
+        },
+        "storage_destination_type": {
+          "description": "The type of storage destination.",
+          "ref": "settings.EgressNetworkPolicyNetworkAccessPolicyStorageDestinationStorageDestinationType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.EgressNetworkPolicyNetworkAccessPolicyStorageDestinationStorageDestinationType": {
+      "enum": [
+        "AWS_S3",
+        "AZURE_STORAGE",
+        "GOOGLE_CLOUD_STORAGE"
+      ],
+      "enum_launch_stages": {
+        "AWS_S3": "GA",
+        "AZURE_STORAGE": "GA",
+        "GOOGLE_CLOUD_STORAGE": "GA"
+      }
+    },
+    "settings.EgressResourceType": {
+      "description": "The target resources that are supported by Network Connectivity Config.\nNote: some egress types can support general types that are not defined in EgressResourceType.\nE.g.: Azure private endpoint supports private link enabled Azure services.",
+      "enum": [
+        "AZURE_BLOB_STORAGE"
+      ],
+      "enum_launch_stages": {
+        "AZURE_BLOB_STORAGE": "GA"
+      }
+    },
+    "settings.EmailConfig": {
+      "fields": {
+        "addresses": {
+          "description": "Email addresses to notify.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.Empty": {},
+    "settings.EnableExportNotebook": {
+      "fields": {
+        "boolean_val": {
+          "ref": "settings.BooleanMessage",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "setting_name": {
+          "description": "Name of the corresponding setting. This field is populated in the response, but it will not be respected\neven if it's set in the request body. The setting name in the path parameter will be\nrespected instead. Setting name is required to be 'default' if the setting only has one instance per workspace.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.EnableNotebookTableClipboard": {
+      "fields": {
+        "boolean_val": {
+          "ref": "settings.BooleanMessage",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "setting_name": {
+          "description": "Name of the corresponding setting. This field is populated in the response, but it will not be respected\neven if it's set in the request body. The setting name in the path parameter will be\nrespected instead. Setting name is required to be 'default' if the setting only has one instance per workspace.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.EnableResultsDownloading": {
+      "fields": {
+        "boolean_val": {
+          "ref": "settings.BooleanMessage",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "setting_name": {
+          "description": "Name of the corresponding setting. This field is populated in the response, but it will not be respected\neven if it's set in the request body. The setting name in the path parameter will be\nrespected instead. Setting name is required to be 'default' if the setting only has one instance per workspace.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.EnhancedSecurityMonitoring": {
+      "description": "SHIELD feature: ESM\nEnhanced Security Monitoring (ESM) enables additional security monitoring on the workspace.",
+      "fields": {
+        "is_enabled": {
+          "description": "Whether Enhanced Security Monitoring (ESM) is enabled on the workspace.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.EnhancedSecurityMonitoringSetting": {
+      "fields": {
+        "enhanced_security_monitoring_workspace": {
+          "ref": "settings.EnhancedSecurityMonitoring",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag provided.\nThis is used for optimistic concurrency control as a way to help prevent simultaneous\nwrites of a setting overwriting each other. It is strongly suggested that systems\nmake use of the etag in the read -\u003e update pattern to perform setting updates in\norder to avoid race conditions. That is, get an etag from a GET request, and pass it\nwith the PATCH request to identify the setting version you are updating.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "setting_name": {
+          "description": "Name of the corresponding setting. This field is populated in the response, but it will not be respected\neven if it's set in the request body. The setting name in the path parameter will be\nrespected instead. Setting name is required to be 'default' if the setting only has one instance per workspace.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.EsmEnablementAccount": {
+      "description": "Account level policy for ESM",
+      "fields": {
+        "is_enforced": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.EsmEnablementAccountSetting": {
+      "fields": {
+        "esm_enablement_account": {
+          "ref": "settings.EsmEnablementAccount",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag provided.\nThis is used for optimistic concurrency control as a way to help prevent simultaneous\nwrites of a setting overwriting each other. It is strongly suggested that systems\nmake use of the etag in the read -\u003e update pattern to perform setting updates in\norder to avoid race conditions. That is, get an etag from a GET request, and pass it\nwith the PATCH request to identify the setting version you are updating.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "setting_name": {
+          "description": "Name of the corresponding setting. This field is populated in the response, but it will not be respected\neven if it's set in the request body. The setting name in the path parameter will be\nrespected instead. Setting name is required to be 'default' if the setting only has one instance per workspace.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.ExchangeToken": {
+      "description": "The exchange token is the result of the token exchange with the IdP",
+      "fields": {
+        "credential": {
+          "description": "The requested token.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "credentialEolTime": {
+          "description": "The end-of-life timestamp of the token. The value is in milliseconds since the Unix epoch.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "ownerId": {
+          "description": "User ID of the user that owns this token.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "scopes": {
+          "description": "The scopes of access granted in the token.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "tokenType": {
+          "description": "The type of this exchange token",
+          "ref": "settings.TokenType",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "settings.ExchangeTokenRequest": {
+      "description": "Exchange a token with the IdP",
+      "fields": {
+        "partitionId": {
+          "description": "The partition of Credentials store",
+          "ref": "settings.PartitionId",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "scopes": {
+          "description": "Array of scopes for the token request.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "tokenType": {
+          "description": "A list of token types being requested",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "settings.ExchangeTokenResponse": {
+      "description": "Exhanged tokens were successfully returned.",
+      "fields": {
+        "values": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "settings.FetchIpAccessListResponse": {
+      "description": "An IP access list was successfully returned.",
+      "fields": {
+        "ip_access_list": {
+          "ref": "settings.IpAccessListInfo",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.GcpEndpoint": {
+      "fields": {
+        "all_vpc_sc_services": {
+          "description": "All Google APIs that support VPC Service Controls (a subset of all Google APIs).",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "google_api_endpoints": {
+          "description": "Selected Google API hostnames, e.g. \"storage.googleapis.com\", \"bigquery.googleapis.com\".",
+          "ref": "settings.GoogleApiEndpoints",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "psc_endpoint_uri": {
+          "description": "Output only. The URI of the created PSC endpoint.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "service_attachment": {
+          "description": "The full url of the target service attachment.\nExample:\nprojects/my-gcp-project/regions/us-east4/serviceAttachments/my-service-attachment",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.GenericWebhookConfig": {
+      "fields": {
+        "password": {
+          "description": "[Input-Only][Optional] Password for webhook.",
+          "launch_stage": "GA"
+        },
+        "password_set": {
+          "description": "[Output-Only] Whether password is set.",
+          "launch_stage": "GA"
+        },
+        "url": {
+          "description": "[Input-Only] URL for webhook.",
+          "launch_stage": "GA"
+        },
+        "url_set": {
+          "description": "[Output-Only] Whether URL is set.",
+          "launch_stage": "GA"
+        },
+        "username": {
+          "description": "[Input-Only][Optional] Username for webhook.",
+          "launch_stage": "GA"
+        },
+        "username_set": {
+          "description": "[Output-Only] Whether username is set.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.GetAccountIpAccessEnableRequest": {
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "settings.GetAccountIpAccessListRequest": {},
+    "settings.GetAibiDashboardEmbeddingAccessPolicySettingRequest": {
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.GetAibiDashboardEmbeddingApprovedDomainsSettingRequest": {
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.GetAutomaticClusterUpdateSettingRequest": {
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.GetComplianceSecurityProfileSettingRequest": {
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.GetCspEnablementAccountSettingRequest": {
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.GetDashboardEmailSubscriptionsRequest": {
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.GetDefaultNamespaceSettingRequest": {
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.GetDefaultWarehouseIdRequest": {
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "settings.GetDisableLegacyAccessRequest": {
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.GetDisableLegacyDbfsRequest": {
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.GetDisableLegacyFeaturesRequest": {
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.GetEnableExportNotebookRequest": {},
+    "settings.GetEnableNotebookTableClipboardRequest": {},
+    "settings.GetEnableResultsDownloadingRequest": {},
+    "settings.GetEnhancedSecurityMonitoringSettingRequest": {
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.GetEsmEnablementAccountSettingRequest": {
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.GetIpAccessListRequest": {},
+    "settings.GetIpAccessListResponse": {
+      "fields": {
+        "ip_access_list": {
+          "ref": "settings.IpAccessListInfo",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.GetIpAccessListsResponse": {
+      "description": "IP access lists were successfully returned.",
+      "fields": {
+        "ip_access_lists": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.GetLlmProxyPartnerPoweredAccountRequest": {
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "settings.GetLlmProxyPartnerPoweredEnforceRequest": {
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "settings.GetLlmProxyPartnerPoweredWorkspaceRequest": {
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "settings.GetNetworkConnectivityConfigurationRequest": {},
+    "settings.GetNetworkPolicyRequest": {},
+    "settings.GetNotificationDestinationRequest": {},
+    "settings.GetPersonalComputeSettingRequest": {
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "settings.GetPrivateEndpointRuleRequest": {},
+    "settings.GetRestrictWorkspaceAdminsSettingRequest": {
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.GetSqlResultsDownloadRequest": {
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.GetStatusRequest": {
+      "fields": {
+        "keys": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.GetTokenManagementRequest": {},
+    "settings.GetTokenPermissionLevelsRequest": {},
+    "settings.GetTokenPermissionLevelsResponse": {
+      "fields": {
+        "permission_levels": {
+          "description": "Specific permission levels",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.GetTokenPermissionsRequest": {},
+    "settings.GetTokenResponse": {
+      "description": "Token with specified Token ID was successfully returned.",
+      "fields": {
+        "token_info": {
+          "ref": "settings.TokenInfo",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.GetWorkspaceNetworkOptionRequest": {},
+    "settings.GoogleApiEndpoints": {
+      "description": "Wrapper for a list of Google API hostnames. Wrapped in a message because\nproto3 oneof does not support repeated fields directly.",
+      "fields": {
+        "endpoints": {
+          "description": "Google API hostnames, e.g. \"storage.googleapis.com\",\n\"bigquery.googleapis.com\". Use \"googleapis.com\" to cover all Google APIs.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "settings.IpAccessListInfo": {
+      "description": "Definition of an IP Access list",
+      "fields": {
+        "address_count": {
+          "description": "Total number of IP or CIDR values.",
+          "launch_stage": "GA"
+        },
+        "created_at": {
+          "description": "Creation timestamp in milliseconds.",
+          "launch_stage": "GA"
+        },
+        "created_by": {
+          "description": "User ID of the user who created this list.",
+          "launch_stage": "GA"
+        },
+        "enabled": {
+          "description": "Specifies whether this IP access list is enabled.",
+          "launch_stage": "GA"
+        },
+        "ip_addresses": {
+          "launch_stage": "GA"
+        },
+        "label": {
+          "description": "Label for the IP access list. This **cannot** be empty.",
+          "launch_stage": "GA"
+        },
+        "list_id": {
+          "description": "Universally unique identifier (UUID) of the IP access list.",
+          "launch_stage": "GA"
+        },
+        "list_type": {
+          "ref": "settings.ListType",
+          "launch_stage": "GA"
+        },
+        "updated_at": {
+          "description": "Update timestamp in milliseconds.",
+          "launch_stage": "GA"
+        },
+        "updated_by": {
+          "description": "User ID of the user who updated this list.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.ListIpAccessListResponse": {
+      "description": "IP access lists were successfully returned.",
+      "fields": {
+        "ip_access_lists": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.ListIpAccessLists": {},
+    "settings.ListNetworkConnectivityConfigurationsRequest": {
+      "fields": {
+        "page_token": {
+          "description": "Pagination token to go to next page based on previous query.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.ListNetworkConnectivityConfigurationsResponse": {
+      "description": "The network connectivity configuration list was successfully retrieved.",
+      "fields": {
+        "items": {
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "A token that can be used to get the next page of results. If null, there are no more results to show.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.ListNetworkPoliciesRequest": {
+      "fields": {
+        "page_token": {
+          "description": "Pagination token to go to next page based on previous query.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "settings.ListNetworkPoliciesResponse": {
+      "fields": {
+        "items": {
+          "description": "List of network policies.",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "A token that can be used to get the next page of results. If null, there are no more results to show.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.ListNotificationDestinationsRequest": {
+      "fields": {
+        "page_size": {
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.ListNotificationDestinationsResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "Page token for next of results.",
+          "launch_stage": "GA"
+        },
+        "results": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.ListNotificationDestinationsResult": {
+      "fields": {
+        "destination_type": {
+          "description": "[Output-only] The type of the notification destination. The type can not be changed once set.",
+          "ref": "settings.DestinationType",
+          "launch_stage": "GA"
+        },
+        "display_name": {
+          "description": "The display name for the notification destination.",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "UUID identifying notification destination.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.ListPrivateEndpointRulesRequest": {
+      "fields": {
+        "page_token": {
+          "description": "Pagination token to go to next page based on previous query.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.ListPrivateEndpointRulesResponse": {
+      "description": "The private endpoint rule list was successfully retrieved.",
+      "fields": {
+        "items": {
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "A token that can be used to get the next page of results. If null, there are no more results to show.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.ListPublicTokensResponse": {
+      "fields": {
+        "token_infos": {
+          "description": "The information for each token.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.ListTokenManagementRequest": {
+      "fields": {
+        "created_by_id": {
+          "description": "User ID of the user that created the token.",
+          "launch_stage": "GA"
+        },
+        "created_by_username": {
+          "description": "Username of the user that created the token.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.ListTokens": {},
+    "settings.ListTokensResponse": {
+      "description": "Tokens were successfully returned.",
+      "fields": {
+        "token_infos": {
+          "description": "Token metadata of each user-created token in the workspace",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.ListType": {
+      "description": "Type of IP access list. Valid values are as follows and are case-sensitive:\n\n* `ALLOW`: An allow list. Include this IP or range.\n* `BLOCK`: A block list. Exclude this IP or range. IP addresses in the block list are excluded even if they are included in an allow list.",
+      "enum": [
+        "ALLOW",
+        "BLOCK"
+      ],
+      "enum_launch_stages": {
+        "ALLOW": "GA",
+        "BLOCK": "GA"
+      },
+      "enum_descriptions": {
+        "ALLOW": "An allow list. Include this IP or range.",
+        "BLOCK": "A block list. Exclude this IP or range. IP addresses in the block list are excluded even if they are included in an allow list."
+      }
+    },
+    "settings.LlmProxyPartnerPoweredAccount": {
+      "fields": {
+        "boolean_val": {
+          "ref": "settings.BooleanMessage",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag provided.\nThis is used for optimistic concurrency control as a way to help prevent simultaneous\nwrites of a setting overwriting each other. It is strongly suggested that systems\nmake use of the etag in the read -\u003e update pattern to perform setting updates in\norder to avoid race conditions. That is, get an etag from a GET request, and pass it\nwith the PATCH request to identify the setting version you are updating.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "setting_name": {
+          "description": "Name of the corresponding setting. This field is populated in the response, but it will not be respected\neven if it's set in the request body. The setting name in the path parameter will be\nrespected instead. Setting name is required to be 'default' if the setting only has one instance per workspace.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "settings.LlmProxyPartnerPoweredEnforce": {
+      "fields": {
+        "boolean_val": {
+          "ref": "settings.BooleanMessage",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag provided.\nThis is used for optimistic concurrency control as a way to help prevent simultaneous\nwrites of a setting overwriting each other. It is strongly suggested that systems\nmake use of the etag in the read -\u003e update pattern to perform setting updates in\norder to avoid race conditions. That is, get an etag from a GET request, and pass it\nwith the PATCH request to identify the setting version you are updating.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "setting_name": {
+          "description": "Name of the corresponding setting. This field is populated in the response, but it will not be respected\neven if it's set in the request body. The setting name in the path parameter will be\nrespected instead. Setting name is required to be 'default' if the setting only has one instance per workspace.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "settings.LlmProxyPartnerPoweredWorkspace": {
+      "fields": {
+        "boolean_val": {
+          "ref": "settings.BooleanMessage",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag provided.\nThis is used for optimistic concurrency control as a way to help prevent simultaneous\nwrites of a setting overwriting each other. It is strongly suggested that systems\nmake use of the etag in the read -\u003e update pattern to perform setting updates in\norder to avoid race conditions. That is, get an etag from a GET request, and pass it\nwith the PATCH request to identify the setting version you are updating.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "setting_name": {
+          "description": "Name of the corresponding setting. This field is populated in the response, but it will not be respected\neven if it's set in the request body. The setting name in the path parameter will be\nrespected instead. Setting name is required to be 'default' if the setting only has one instance per workspace.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "settings.MicrosoftTeamsConfig": {
+      "fields": {
+        "app_id": {
+          "description": "[Input-Only] App ID for Microsoft Teams App.",
+          "launch_stage": "GA"
+        },
+        "app_id_set": {
+          "description": "[Output-Only] Whether App ID is set.",
+          "launch_stage": "GA"
+        },
+        "auth_secret": {
+          "description": "[Input-Only] Secret for Microsoft Teams App authentication.",
+          "launch_stage": "GA"
+        },
+        "auth_secret_set": {
+          "description": "[Output-Only] Whether secret is set.",
+          "launch_stage": "GA"
+        },
+        "channel_url": {
+          "description": "[Input-Only] Channel URL for Microsoft Teams App.",
+          "launch_stage": "GA"
+        },
+        "channel_url_set": {
+          "description": "[Output-Only] Whether Channel URL is set.",
+          "launch_stage": "GA"
+        },
+        "tenant_id": {
+          "description": "[Input-Only] Tenant ID for Microsoft Teams App.",
+          "launch_stage": "GA"
+        },
+        "tenant_id_set": {
+          "description": "[Output-Only] Whether Tenant ID is set.",
+          "launch_stage": "GA"
+        },
+        "url": {
+          "description": "[Input-Only] URL for Microsoft Teams webhook.",
+          "launch_stage": "GA"
+        },
+        "url_set": {
+          "description": "[Output-Only] Whether URL is set.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.NccAwsStableIpRule": {
+      "description": "The stable AWS IP CIDR blocks. You can use these to configure the firewall of your resources to allow traffic from your Databricks workspace.",
+      "fields": {
+        "cidr_blocks": {
+          "description": "The list of stable IP CIDR blocks from which Databricks network traffic originates when accessing your resources.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.NccAzurePrivateEndpointRule": {
+      "description": "Properties of the new private endpoint rule.\nNote that you must approve the endpoint in Azure portal after initialization.",
+      "fields": {
+        "connection_state": {
+          "description": "The current status of this private endpoint. The private endpoint rules are effective only if the connection state\nis ESTABLISHED. Remember that you must approve new endpoints on your resources in the Azure portal\nbefore they take effect.\nThe possible values are:\n- INIT: (deprecated) The endpoint has been created and pending approval.\n- PENDING: The endpoint has been created and pending approval.\n- ESTABLISHED: The endpoint has been approved and is ready to use in your serverless compute resources.\n- REJECTED: Connection was rejected by the private link resource owner.\n- DISCONNECTED: Connection was removed by the private link resource owner, the private endpoint becomes informative and should be deleted for clean-up.\n- EXPIRED: If the endpoint was created but not approved in 14 days, it will be EXPIRED.",
+          "ref": "settings.NccAzurePrivateEndpointRuleConnectionState",
+          "launch_stage": "GA"
+        },
+        "creation_time": {
+          "description": "Time in epoch milliseconds when this object was created.",
+          "launch_stage": "GA"
+        },
+        "deactivated": {
+          "description": "Whether this private endpoint is deactivated.",
+          "launch_stage": "GA"
+        },
+        "deactivated_at": {
+          "description": "Time in epoch milliseconds when this object was deactivated.",
+          "launch_stage": "GA"
+        },
+        "domain_names": {
+          "description": "Not used by customer-managed private endpoint services.\n\nDomain names of target private link service.\nWhen updating this field, the full list of target domain_names must be specified.",
+          "launch_stage": "GA"
+        },
+        "endpoint_name": {
+          "description": "The name of the Azure private endpoint resource.",
+          "launch_stage": "GA"
+        },
+        "error_message": {
+          "launch_stage": "GA"
+        },
+        "group_id": {
+          "description": "Only used by private endpoints to Azure first-party services.\n\nThe sub-resource type (group ID) of the target resource.\nNote that to connect to workspace root storage (root DBFS), you need two endpoints, one for blob and one for dfs.",
+          "launch_stage": "GA"
+        },
+        "network_connectivity_config_id": {
+          "description": "The ID of a network connectivity configuration, which is the parent resource of this private endpoint rule object.",
+          "launch_stage": "GA"
+        },
+        "resource_id": {
+          "description": "The Azure resource ID of the target resource.",
+          "launch_stage": "GA"
+        },
+        "rule_id": {
+          "description": "The ID of a private endpoint rule.",
+          "launch_stage": "GA"
+        },
+        "updated_time": {
+          "description": "Time in epoch milliseconds when this object was updated.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.NccAzurePrivateEndpointRuleConnectionState": {
+      "enum": [
+        "INIT",
+        "ESTABLISHED",
+        "REJECTED",
+        "DISCONNECTED",
+        "EXPIRED",
+        "PENDING",
+        "CREATING",
+        "CREATE_FAILED"
+      ],
+      "enum_launch_stages": {
+        "CREATE_FAILED": "GA",
+        "CREATING": "GA",
+        "DISCONNECTED": "GA",
+        "ESTABLISHED": "GA",
+        "EXPIRED": "GA",
+        "INIT": "GA",
+        "PENDING": "GA",
+        "REJECTED": "GA"
+      }
+    },
+    "settings.NccAzureServiceEndpointRule": {
+      "description": "The stable Azure service endpoints. You can configure the firewall of your Azure resources\nto allow traffic from your Databricks serverless compute resources.",
+      "fields": {
+        "subnets": {
+          "description": "The list of subnets from which Databricks network traffic originates when accessing your Azure resources.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "target_region": {
+          "description": "The Azure region in which this service endpoint rule applies..",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "target_services": {
+          "description": "The Azure services to which this service endpoint rule applies to.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.NccEgressConfig": {
+      "fields": {
+        "default_rules": {
+          "description": "The network connectivity rules that are applied by default without resource specific configurations.\nYou can find the stable network information of your serverless compute resources here.",
+          "ref": "settings.NccEgressDefaultRules",
+          "launch_stage": "GA"
+        },
+        "target_rules": {
+          "description": "The network connectivity rules that configured for each destinations. These rules override default rules.",
+          "ref": "settings.NccEgressTargetRules",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.NccEgressDefaultRules": {
+      "description": "Default rules don't have specific targets.",
+      "fields": {
+        "aws_stable_ip_rule": {
+          "ref": "settings.NccAwsStableIpRule",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "azure_service_endpoint_rule": {
+          "ref": "settings.NccAzureServiceEndpointRule",
+          "deprecated": true,
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.NccEgressTargetRules": {
+      "description": "Target rule controls the egress rules that are dedicated to specific resources.",
+      "fields": {
+        "aws_private_endpoint_rules": {
+          "description": "AWS private endpoint rule controls the AWS private endpoint based egress rules.",
+          "launch_stage": "GA"
+        },
+        "azure_private_endpoint_rules": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.NccPrivateEndpointRule": {
+      "description": "Properties of the new private endpoint rule.\nNote that you must approve the endpoint in Azure portal after initialization.",
+      "fields": {
+        "account_id": {
+          "description": "Databricks account ID. You can find your account ID from the Accounts Console.",
+          "launch_stage": "GA"
+        },
+        "connection_state": {
+          "description": "The current status of this private endpoint. The private endpoint rules are effective only if the connection state\nis ESTABLISHED. Remember that you must approve new endpoints on your resources in the Cloud console\nbefore they take effect.\nThe possible values are:\n- PENDING: The endpoint has been created and pending approval.\n- ESTABLISHED: The endpoint has been approved and is ready to use in your serverless compute resources.\n- REJECTED: Connection was rejected by the private link resource owner.\n- DISCONNECTED: Connection was removed by the private link resource owner, the private endpoint becomes informative and should be deleted for clean-up.\n- EXPIRED: If the endpoint was created but not approved in 14 days, it will be EXPIRED.\n- CREATING: The endpoint creation is in progress. Once successfully created, the state will transition to PENDING.\n- CREATE_FAILED: The endpoint creation failed. You can check the error_message field for more details.",
+          "ref": "settings.NccPrivateEndpointRulePrivateLinkConnectionState",
+          "launch_stage": "GA"
+        },
+        "creation_time": {
+          "description": "Time in epoch milliseconds when this object was created.",
+          "launch_stage": "GA"
+        },
+        "deactivated": {
+          "description": "Whether this private endpoint is deactivated.",
+          "launch_stage": "GA"
+        },
+        "deactivated_at": {
+          "description": "Time in epoch milliseconds when this object was deactivated.",
+          "launch_stage": "GA"
+        },
+        "domain_names": {
+          "description": "Only used by private endpoints to customer-managed private endpoint services.\n\nDomain names of target private link service.\nWhen updating this field, the full list of target domain_names must be specified.",
+          "launch_stage": "GA"
+        },
+        "enabled": {
+          "description": "Update this field to activate/deactivate this private endpoint to allow egress access from\nserverless compute resources. Only honored for first-party services on each cloud (e.g. AWS S3).",
+          "launch_stage": "GA"
+        },
+        "endpoint_name": {
+          "description": "The name of the Azure private endpoint resource.",
+          "launch_stage": "GA"
+        },
+        "endpoint_service": {
+          "description": "The full target AWS endpoint service name that connects to the destination resources of the private endpoint.",
+          "launch_stage": "GA"
+        },
+        "error_message": {
+          "launch_stage": "GA"
+        },
+        "gcp_endpoint": {
+          "ref": "settings.GcpEndpoint",
+          "launch_stage": "GA"
+        },
+        "group_id": {
+          "description": "Not used by customer-managed private endpoint services.\n\nThe sub-resource type (group ID) of the target resource.\nNote that to connect to workspace root storage (root DBFS), you need two endpoints, one for blob and one for dfs.",
+          "launch_stage": "GA"
+        },
+        "network_connectivity_config_id": {
+          "description": "The ID of a network connectivity configuration, which is the parent resource of this private endpoint rule object.",
+          "launch_stage": "GA"
+        },
+        "resource_id": {
+          "description": "The Azure resource ID of the target resource.",
+          "launch_stage": "GA"
+        },
+        "resource_names": {
+          "description": "Only used by private endpoints towards AWS S3 service.\n\nThe globally unique S3 bucket names that will be accessed via the VPC endpoint.\nThe bucket names must be in the same region as the NCC/endpoint service.\nWhen updating this field, we perform full update on this field. Please ensure a full list of desired\nresource_names is provided.",
+          "launch_stage": "GA"
+        },
+        "rule_id": {
+          "description": "The ID of a private endpoint rule.",
+          "launch_stage": "GA"
+        },
+        "updated_time": {
+          "description": "Time in epoch milliseconds when this object was updated.",
+          "launch_stage": "GA"
+        },
+        "vpc_endpoint_id": {
+          "description": "The AWS VPC endpoint ID. You can use this ID to identify the VPC endpoint created by Databricks.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.NccPrivateEndpointRulePrivateLinkConnectionState": {
+      "enum": [
+        "ESTABLISHED",
+        "REJECTED",
+        "DISCONNECTED",
+        "EXPIRED",
+        "PENDING",
+        "CREATING",
+        "CREATE_FAILED"
+      ],
+      "enum_launch_stages": {
+        "CREATE_FAILED": "GA",
+        "CREATING": "GA",
+        "DISCONNECTED": "GA",
+        "ESTABLISHED": "GA",
+        "EXPIRED": "GA",
+        "PENDING": "GA",
+        "REJECTED": "GA"
+      }
+    },
+    "settings.NetworkConnectivityConfiguration": {
+      "description": "Properties of the new network connectivity configuration.",
+      "fields": {
+        "account_id": {
+          "description": "Your Databricks account ID. You can find your account ID in your Databricks accounts console.",
+          "launch_stage": "GA"
+        },
+        "creation_time": {
+          "description": "Time in epoch milliseconds when this object was created.",
+          "launch_stage": "GA"
+        },
+        "egress_config": {
+          "description": "The network connectivity rules that apply to network traffic from your serverless compute resources.",
+          "ref": "settings.NccEgressConfig",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The name of the network connectivity configuration. The name can contain alphanumeric characters, hyphens,\nand underscores. The length must be between 3 and 30 characters. The name must match the regular\nexpression ^[0-9a-zA-Z-_]{3,30}$",
+          "launch_stage": "GA"
+        },
+        "network_connectivity_config_id": {
+          "description": "Databricks network connectivity configuration ID.",
+          "launch_stage": "GA"
+        },
+        "region": {
+          "description": "The region for the network connectivity configuration.\nOnly workspaces in the same region can be attached to the network connectivity configuration.",
+          "launch_stage": "GA"
+        },
+        "updated_time": {
+          "description": "Time in epoch milliseconds when this object was updated.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.NetworkPolicyEgress": {
+      "description": "The network policies applying for egress traffic.",
+      "fields": {
+        "network_access": {
+          "description": "The access policy enforced for egress traffic to the internet.",
+          "ref": "settings.EgressNetworkPolicyNetworkAccessPolicy",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "settings.NotificationDestination": {
+      "fields": {
+        "config": {
+          "description": "The configuration for the notification destination. Will be exactly one of the nested configs. Only returns for users with workspace admin permissions.",
+          "ref": "settings.Config",
+          "launch_stage": "GA"
+        },
+        "destination_type": {
+          "description": "[Output-only] The type of the notification destination. The type can not be changed once set.",
+          "ref": "settings.DestinationType",
+          "launch_stage": "GA"
+        },
+        "display_name": {
+          "description": "The display name for the notification destination.",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "UUID identifying notification destination.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.PagerdutyConfig": {
+      "fields": {
+        "integration_key": {
+          "description": "[Input-Only] Integration key for PagerDuty.",
+          "launch_stage": "GA"
+        },
+        "integration_key_set": {
+          "description": "[Output-Only] Whether integration key is set.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.PartitionId": {
+      "description": "Partition by workspace or account",
+      "fields": {
+        "workspaceId": {
+          "description": "The ID of the workspace.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "settings.PersonalComputeMessage": {
+      "fields": {
+        "value": {
+          "ref": "settings.PersonalComputeMessageEnum",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "settings.PersonalComputeMessageEnum": {
+      "description": "ON: Grants all users in all workspaces access to the Personal Compute default policy, allowing all users to create single-machine compute resources.\nDELEGATE: Moves access control for the Personal Compute default policy to individual workspaces and requires a workspace’s users or groups to be added to the ACLs of that workspace’s Personal Compute default policy before they will be able to create compute resources through that policy.",
+      "enum": [
+        "ON",
+        "DELEGATE"
+      ],
+      "enum_launch_stages": {
+        "DELEGATE": "PRIVATE_PREVIEW",
+        "ON": "PRIVATE_PREVIEW"
+      }
+    },
+    "settings.PersonalComputeSetting": {
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag provided.\nThis is used for optimistic concurrency control as a way to help prevent simultaneous\nwrites of a setting overwriting each other. It is strongly suggested that systems\nmake use of the etag in the read -\u003e update pattern to perform setting updates in\norder to avoid race conditions. That is, get an etag from a GET request, and pass it\nwith the PATCH request to identify the setting version you are updating.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "personal_compute": {
+          "ref": "settings.PersonalComputeMessage",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "setting_name": {
+          "description": "Name of the corresponding setting. This field is populated in the response, but it will not be respected\neven if it's set in the request body. The setting name in the path parameter will be\nrespected instead. Setting name is required to be 'default' if the setting only has one instance per workspace.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "settings.PublicTokenInfo": {
+      "fields": {
+        "autoscope_state": {
+          "description": "Output only. The autoscope state of this token.",
+          "ref": "iam.AutoscopeState",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "backfill_scopes": {
+          "description": "Output only. Scopes inferred from offline backfill processing.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "comment": {
+          "description": "Comment the token was created with, if applicable.",
+          "launch_stage": "GA"
+        },
+        "creation_time": {
+          "description": "Server time (in epoch milliseconds) when the token was created.",
+          "launch_stage": "GA"
+        },
+        "expiry_time": {
+          "description": "Server time (in epoch milliseconds) when the token will expire, or -1 if not applicable.",
+          "launch_stage": "GA"
+        },
+        "inferred_scopes": {
+          "description": "Output only. Inferred API path scopes collected for this token when autoscope is enabled.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "scopes": {
+          "description": "Scope of the token was created with, if applicable.",
+          "launch_stage": "GA"
+        },
+        "token_id": {
+          "description": "The ID of this token.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.ReplaceIpAccessList": {
+      "description": "Details required to replace an IP access list.",
+      "fields": {
+        "enabled": {
+          "description": "Specifies whether this IP access list is enabled.",
+          "launch_stage": "GA"
+        },
+        "ip_addresses": {
+          "launch_stage": "GA"
+        },
+        "label": {
+          "description": "Label for the IP access list. This **cannot** be empty.",
+          "launch_stage": "GA"
+        },
+        "list_type": {
+          "ref": "settings.ListType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.RestrictWorkspaceAdminsMessage": {
+      "fields": {
+        "disable_gov_tag_creation": {
+          "description": "When true, workspace admins cannot create governance tags.\nALLOW_ALL status does not override this; they are independent.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "status": {
+          "ref": "settings.RestrictWorkspaceAdminsMessageStatus",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "settings.RestrictWorkspaceAdminsMessageStatus": {
+      "enum": [
+        "ALLOW_ALL",
+        "RESTRICT_TOKENS_AND_JOB_RUN_AS"
+      ],
+      "enum_launch_stages": {
+        "ALLOW_ALL": "PUBLIC_PREVIEW",
+        "RESTRICT_TOKENS_AND_JOB_RUN_AS": "PUBLIC_PREVIEW"
+      }
+    },
+    "settings.RestrictWorkspaceAdminsSetting": {
+      "fields": {
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag provided.\nThis is used for optimistic concurrency control as a way to help prevent simultaneous\nwrites of a setting overwriting each other. It is strongly suggested that systems\nmake use of the etag in the read -\u003e update pattern to perform setting updates in\norder to avoid race conditions. That is, get an etag from a GET request, and pass it\nwith the PATCH request to identify the setting version you are updating.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "restrict_workspace_admins": {
+          "ref": "settings.RestrictWorkspaceAdminsMessage",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "setting_name": {
+          "description": "Name of the corresponding setting. This field is populated in the response, but it will not be respected\neven if it's set in the request body. The setting name in the path parameter will be\nrespected instead. Setting name is required to be 'default' if the setting only has one instance per workspace.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.RevokeTokenRequest": {
+      "fields": {
+        "token_id": {
+          "description": "The ID of the token to be revoked.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.RevokeTokenResponse": {},
+    "settings.SlackConfig": {
+      "fields": {
+        "channel_id": {
+          "description": "[Input-Only] Slack channel ID for notifications.",
+          "launch_stage": "GA"
+        },
+        "channel_id_set": {
+          "description": "[Output-Only] Whether channel ID is set.",
+          "launch_stage": "GA"
+        },
+        "oauth_token": {
+          "description": "[Input-Only] OAuth token for Slack authentication.",
+          "launch_stage": "GA"
+        },
+        "oauth_token_set": {
+          "description": "[Output-Only] Whether OAuth token is set.",
+          "launch_stage": "GA"
+        },
+        "url": {
+          "description": "[Input-Only] URL for Slack destination.",
+          "launch_stage": "GA"
+        },
+        "url_set": {
+          "description": "[Output-Only] Whether URL is set.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.SqlResultsDownload": {
+      "fields": {
+        "boolean_val": {
+          "ref": "settings.BooleanMessage",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "etag": {
+          "description": "etag used for versioning. The response is at least as fresh as the eTag provided.\nThis is used for optimistic concurrency control as a way to help prevent simultaneous\nwrites of a setting overwriting each other. It is strongly suggested that systems\nmake use of the etag in the read -\u003e update pattern to perform setting updates in\norder to avoid race conditions. That is, get an etag from a GET request, and pass it\nwith the PATCH request to identify the setting version you are updating.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "setting_name": {
+          "description": "Name of the corresponding setting. This field is populated in the response, but it will not be respected\neven if it's set in the request body. The setting name in the path parameter will be\nrespected instead. Setting name is required to be 'default' if the setting only has one instance per workspace.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.StringMessage": {
+      "fields": {
+        "value": {
+          "description": "Represents a generic string value.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "settings.TokenAccessControlRequest": {
+      "fields": {
+        "group_name": {
+          "description": "name of the group",
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "settings.TokenPermissionLevel",
+          "launch_stage": "GA"
+        },
+        "service_principal_name": {
+          "description": "application ID of a service principal",
+          "launch_stage": "GA"
+        },
+        "user_name": {
+          "description": "name of the user",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.TokenAccessControlResponse": {
+      "fields": {
+        "all_permissions": {
+          "description": "All permissions.",
+          "launch_stage": "GA"
+        },
+        "display_name": {
+          "description": "Display name of the user or service principal.",
+          "launch_stage": "GA"
+        },
+        "group_name": {
+          "description": "name of the group",
+          "launch_stage": "GA"
+        },
+        "service_principal_name": {
+          "description": "Name of the service principal.",
+          "launch_stage": "GA"
+        },
+        "user_name": {
+          "description": "name of the user",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.TokenInfo": {
+      "fields": {
+        "autoscope_state": {
+          "description": "Output only. The autoscope state of this token.",
+          "ref": "iam.AutoscopeState",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "backfill_scopes": {
+          "description": "Output only. Scopes inferred from offline backfill processing.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "comment": {
+          "description": "Comment that describes the purpose of the token, specified by the token creator.",
+          "launch_stage": "GA"
+        },
+        "created_by_id": {
+          "description": "User ID of the user that created the token.",
+          "launch_stage": "GA"
+        },
+        "created_by_username": {
+          "description": "Username of the user that created the token.",
+          "launch_stage": "GA"
+        },
+        "creation_time": {
+          "description": "Timestamp when the token was created.",
+          "launch_stage": "GA"
+        },
+        "expiry_time": {
+          "description": "Timestamp when the token expires.",
+          "launch_stage": "GA"
+        },
+        "inferred_scopes": {
+          "description": "Output only. Inferred API path scopes collected for this token when autoscope is enabled.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "last_used_day": {
+          "description": "Approximate timestamp for the day the token was last used. Accurate up to 1 day.",
+          "launch_stage": "GA"
+        },
+        "owner_id": {
+          "description": "User ID of the user that owns the token.",
+          "launch_stage": "GA"
+        },
+        "scopes": {
+          "description": "Scope of the token was created with, if applicable.",
+          "launch_stage": "GA"
+        },
+        "token_id": {
+          "description": "ID of the token.",
+          "launch_stage": "GA"
+        },
+        "workspace_id": {
+          "description": "If applicable, the ID of the workspace that the token was created in.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.TokenPermission": {
+      "fields": {
+        "inherited": {
+          "launch_stage": "GA"
+        },
+        "inherited_from_object": {
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "settings.TokenPermissionLevel",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.TokenPermissionLevel": {
+      "description": "Permission level",
+      "enum": [
+        "CAN_USE"
+      ]
+    },
+    "settings.TokenPermissions": {
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "GA"
+        },
+        "object_id": {
+          "launch_stage": "GA"
+        },
+        "object_type": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.TokenPermissionsDescription": {
+      "fields": {
+        "description": {
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "settings.TokenPermissionLevel",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.TokenPermissionsRequest": {
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.TokenType": {
+      "description": "The type of token request. As of now, only `AZURE_ACTIVE_DIRECTORY_TOKEN` is supported.",
+      "enum": [
+        "AZURE_ACTIVE_DIRECTORY_TOKEN",
+        "ARCLIGHT_AZURE_EXCHANGE_TOKEN",
+        "ARCLIGHT_AZURE_EXCHANGE_TOKEN_WITH_USER_DELEGATION_KEY",
+        "ARCLIGHT_MULTI_TENANT_AZURE_EXCHANGE_TOKEN",
+        "ARCLIGHT_MULTI_TENANT_AZURE_EXCHANGE_TOKEN_WITH_USER_DELEGATION_KEY"
+      ],
+      "enum_launch_stages": {
+        "ARCLIGHT_AZURE_EXCHANGE_TOKEN": "PRIVATE_PREVIEW",
+        "ARCLIGHT_AZURE_EXCHANGE_TOKEN_WITH_USER_DELEGATION_KEY": "PRIVATE_PREVIEW",
+        "ARCLIGHT_MULTI_TENANT_AZURE_EXCHANGE_TOKEN": "PRIVATE_PREVIEW",
+        "ARCLIGHT_MULTI_TENANT_AZURE_EXCHANGE_TOKEN_WITH_USER_DELEGATION_KEY": "PRIVATE_PREVIEW",
+        "AZURE_ACTIVE_DIRECTORY_TOKEN": "PRIVATE_PREVIEW"
+      }
+    },
+    "settings.UpdateAccountIpAccessEnableRequest": {
+      "description": "Details required to update a setting.",
+      "fields": {
+        "allow_missing": {
+          "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "field_mask": {
+          "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "setting": {
+          "ref": "settings.AccountIpAccessEnable",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "settings.UpdateAibiDashboardEmbeddingAccessPolicySettingRequest": {
+      "description": "Details required to update a setting.",
+      "fields": {
+        "allow_missing": {
+          "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "field_mask": {
+          "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "setting": {
+          "ref": "settings.AibiDashboardEmbeddingAccessPolicySetting",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.UpdateAibiDashboardEmbeddingApprovedDomainsSettingRequest": {
+      "description": "Details required to update a setting.",
+      "fields": {
+        "allow_missing": {
+          "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "field_mask": {
+          "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "setting": {
+          "ref": "settings.AibiDashboardEmbeddingApprovedDomainsSetting",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.UpdateAutomaticClusterUpdateSettingRequest": {
+      "description": "Details required to update a setting.",
+      "fields": {
+        "allow_missing": {
+          "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "field_mask": {
+          "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "setting": {
+          "ref": "settings.AutomaticClusterUpdateSetting",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.UpdateComplianceSecurityProfileSettingRequest": {
+      "description": "Details required to update a setting.",
+      "fields": {
+        "allow_missing": {
+          "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "field_mask": {
+          "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "setting": {
+          "ref": "settings.ComplianceSecurityProfileSetting",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.UpdateCspEnablementAccountSettingRequest": {
+      "description": "Details required to update a setting.",
+      "fields": {
+        "allow_missing": {
+          "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "field_mask": {
+          "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "setting": {
+          "ref": "settings.CspEnablementAccountSetting",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.UpdateDashboardEmailSubscriptionsRequest": {
+      "description": "Details required to update a setting.",
+      "fields": {
+        "allow_missing": {
+          "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "field_mask": {
+          "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "setting": {
+          "ref": "settings.DashboardEmailSubscriptions",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.UpdateDefaultNamespaceSettingRequest": {
+      "description": "Details required to update a setting.",
+      "fields": {
+        "allow_missing": {
+          "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "field_mask": {
+          "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "setting": {
+          "ref": "settings.DefaultNamespaceSetting",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.UpdateDefaultWarehouseIdRequest": {
+      "description": "Details required to update a setting.",
+      "fields": {
+        "allow_missing": {
+          "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "field_mask": {
+          "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "setting": {
+          "ref": "settings.DefaultWarehouseId",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "settings.UpdateDisableLegacyAccessRequest": {
+      "description": "Details required to update a setting.",
+      "fields": {
+        "allow_missing": {
+          "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+          "launch_stage": "GA"
+        },
+        "field_mask": {
+          "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "GA"
+        },
+        "setting": {
+          "ref": "settings.DisableLegacyAccess",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.UpdateDisableLegacyDbfsRequest": {
+      "description": "Details required to update a setting.",
+      "fields": {
+        "allow_missing": {
+          "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+          "launch_stage": "GA"
+        },
+        "field_mask": {
+          "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "GA"
+        },
+        "setting": {
+          "ref": "settings.DisableLegacyDbfs",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.UpdateDisableLegacyFeaturesRequest": {
+      "description": "Details required to update a setting.",
+      "fields": {
+        "allow_missing": {
+          "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+          "launch_stage": "GA"
+        },
+        "field_mask": {
+          "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "GA"
+        },
+        "setting": {
+          "ref": "settings.DisableLegacyFeatures",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.UpdateEnableExportNotebookRequest": {
+      "description": "Details required to update a setting.",
+      "fields": {
+        "allow_missing": {
+          "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "field_mask": {
+          "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "setting": {
+          "ref": "settings.EnableExportNotebook",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.UpdateEnableNotebookTableClipboardRequest": {
+      "description": "Details required to update a setting.",
+      "fields": {
+        "allow_missing": {
+          "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "field_mask": {
+          "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "setting": {
+          "ref": "settings.EnableNotebookTableClipboard",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.UpdateEnableResultsDownloadingRequest": {
+      "description": "Details required to update a setting.",
+      "fields": {
+        "allow_missing": {
+          "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "field_mask": {
+          "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "setting": {
+          "ref": "settings.EnableResultsDownloading",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.UpdateEnhancedSecurityMonitoringSettingRequest": {
+      "description": "Details required to update a setting.",
+      "fields": {
+        "allow_missing": {
+          "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "field_mask": {
+          "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "setting": {
+          "ref": "settings.EnhancedSecurityMonitoringSetting",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.UpdateEsmEnablementAccountSettingRequest": {
+      "description": "Details required to update a setting.",
+      "fields": {
+        "allow_missing": {
+          "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "field_mask": {
+          "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "setting": {
+          "ref": "settings.EsmEnablementAccountSetting",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.UpdateIpAccessList": {
+      "description": "Details required to update an IP access list.",
+      "fields": {
+        "enabled": {
+          "description": "Specifies whether this IP access list is enabled.",
+          "launch_stage": "GA"
+        },
+        "ip_addresses": {
+          "launch_stage": "GA"
+        },
+        "label": {
+          "description": "Label for the IP access list. This **cannot** be empty.",
+          "launch_stage": "GA"
+        },
+        "list_type": {
+          "ref": "settings.ListType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.UpdateLlmProxyPartnerPoweredAccountRequest": {
+      "description": "Details required to update a setting.",
+      "fields": {
+        "allow_missing": {
+          "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "field_mask": {
+          "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "setting": {
+          "ref": "settings.LlmProxyPartnerPoweredAccount",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "settings.UpdateLlmProxyPartnerPoweredEnforceRequest": {
+      "description": "Details required to update a setting.",
+      "fields": {
+        "allow_missing": {
+          "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "field_mask": {
+          "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "setting": {
+          "ref": "settings.LlmProxyPartnerPoweredEnforce",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "settings.UpdateLlmProxyPartnerPoweredWorkspaceRequest": {
+      "description": "Details required to update a setting.",
+      "fields": {
+        "allow_missing": {
+          "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "field_mask": {
+          "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "setting": {
+          "ref": "settings.LlmProxyPartnerPoweredWorkspace",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "settings.UpdateNccPrivateEndpointRuleRequest": {
+      "fields": {
+        "private_endpoint_rule": {
+          "ref": "settings.UpdatePrivateEndpointRule",
+          "launch_stage": "GA"
+        },
+        "update_mask": {
+          "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.UpdateNetworkPolicyRequest": {
+      "fields": {
+        "network_policy": {
+          "description": "Updated network policy configuration details.",
+          "ref": "settings.AccountNetworkPolicy",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.UpdateNotificationDestinationRequest": {
+      "fields": {
+        "config": {
+          "description": "The configuration for the notification destination. Must wrap EXACTLY one of the nested configs.",
+          "ref": "settings.Config",
+          "launch_stage": "GA"
+        },
+        "display_name": {
+          "description": "The display name for the notification destination.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.UpdatePersonalComputeSettingRequest": {
+      "description": "Details required to update a setting.",
+      "fields": {
+        "allow_missing": {
+          "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "field_mask": {
+          "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "setting": {
+          "ref": "settings.PersonalComputeSetting",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "settings.UpdatePrivateEndpointRule": {
+      "description": "Properties of the new private endpoint rule.\nNote that you must approve the endpoint in Azure portal after initialization.",
+      "fields": {
+        "domain_names": {
+          "description": "Only used by private endpoints to customer-managed private endpoint services.\n\nDomain names of target private link service.\nWhen updating this field, the full list of target domain_names must be specified.",
+          "launch_stage": "GA"
+        },
+        "enabled": {
+          "description": "Update this field to activate/deactivate this private endpoint to allow egress access from\nserverless compute resources. Only honored for first-party services on each cloud (e.g. AWS S3).",
+          "launch_stage": "GA"
+        },
+        "error_message": {
+          "launch_stage": "GA"
+        },
+        "gcp_endpoint": {
+          "ref": "settings.GcpEndpoint",
+          "launch_stage": "GA"
+        },
+        "resource_names": {
+          "description": "Only used by private endpoints towards AWS S3 service.\n\nThe globally unique S3 bucket names that will be accessed via the VPC endpoint.\nThe bucket names must be in the same region as the NCC/endpoint service.\nWhen updating this field, we perform full update on this field. Please ensure a full list of desired\nresource_names is provided.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.UpdateRestrictWorkspaceAdminsSettingRequest": {
+      "description": "Details required to update a setting.",
+      "fields": {
+        "allow_missing": {
+          "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "field_mask": {
+          "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "setting": {
+          "ref": "settings.RestrictWorkspaceAdminsSetting",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.UpdateSqlResultsDownloadRequest": {
+      "description": "Details required to update a setting.",
+      "fields": {
+        "allow_missing": {
+          "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "field_mask": {
+          "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "setting": {
+          "ref": "settings.SqlResultsDownload",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "settings.UpdateTokenManagementRequest": {
+      "description": "For the list of supported token scopes, see\nhttps://docs.databricks.com/api/workspace/api/scopes.",
+      "fields": {
+        "token": {
+          "ref": "settings.TokenInfo",
+          "launch_stage": "GA"
+        },
+        "update_mask": {
+          "description": "A list of field name under token, For example, {\"update_mask\": \"comment,scopes\"}\n\nThe field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.UpdateTokenRequest": {
+      "description": "For the list of supported token scopes, see\nhttps://docs.databricks.com/api/workspace/api/scopes.",
+      "fields": {
+        "token": {
+          "ref": "settings.PublicTokenInfo",
+          "launch_stage": "GA"
+        },
+        "update_mask": {
+          "description": "A list of field name under token, For example, {\"update_mask\": \"comment,scopes\"}\n\nThe field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.UpdateTokenResponse": {},
+    "settings.UpdateWorkspaceNetworkOptionRequest": {
+      "fields": {
+        "workspace_network_option": {
+          "description": "The network option details for the workspace.",
+          "ref": "settings.WorkspaceNetworkOption",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settings.WorkspaceConf": {},
+    "settings.WorkspaceNetworkOption": {
+      "fields": {
+        "network_policy_id": {
+          "description": "The network policy ID to apply to the workspace. This controls the network access rules\nfor all serverless compute resources in the workspace. Each workspace can only be\nlinked to one policy at a time. If no policy is explicitly assigned,\nthe workspace will use 'default-policy'.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "workspace_id": {
+          "description": "The workspace ID.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "settingsv2.AibiDashboardEmbeddingAccessPolicy": {
+      "fields": {
+        "access_policy_type": {
+          "ref": "settingsv2.AibiDashboardEmbeddingAccessPolicyAccessPolicyType",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "settingsv2.AibiDashboardEmbeddingAccessPolicyAccessPolicyType": {
+      "enum": [
+        "ALLOW_ALL_DOMAINS",
+        "ALLOW_APPROVED_DOMAINS",
+        "DENY_ALL_DOMAINS"
+      ],
+      "enum_launch_stages": {
+        "ALLOW_ALL_DOMAINS": "GA",
+        "ALLOW_APPROVED_DOMAINS": "GA",
+        "DENY_ALL_DOMAINS": "GA"
+      }
+    },
+    "settingsv2.AibiDashboardEmbeddingApprovedDomains": {
+      "fields": {
+        "approved_domains": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "settingsv2.AllowedAppsUserApiScopesMessage": {
+      "fields": {
+        "allowed_scopes": {
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "settingsv2.BooleanMessage": {
+      "fields": {
+        "value": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "settingsv2.ClusterAutoRestartMessage": {
+      "fields": {
+        "can_toggle": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "enabled": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "enablement_details": {
+          "ref": "settingsv2.ClusterAutoRestartMessageEnablementDetails",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "maintenance_window": {
+          "ref": "settingsv2.ClusterAutoRestartMessageMaintenanceWindow",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "restart_even_if_no_updates_available": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "settingsv2.ClusterAutoRestartMessageEnablementDetails": {
+      "description": "Contains an information about the enablement status judging (e.g. whether the enterprise tier\nis enabled)\nThis is only additional information that MUST NOT be used to decide whether the setting is\nenabled or not. This is intended to use only for purposes like showing an error message to\nthe customer with the additional details. For example, using these details we can check\nwhy exactly the feature is disabled for this customer.",
+      "fields": {
+        "forced_for_compliance_mode": {
+          "description": "The feature is force enabled if compliance mode is active",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "unavailable_for_disabled_entitlement": {
+          "description": "The feature is unavailable if the corresponding entitlement disabled (see getShieldEntitlementEnable)",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "unavailable_for_non_enterprise_tier": {
+          "description": "The feature is unavailable if the customer doesn't have enterprise tier",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "settingsv2.ClusterAutoRestartMessageMaintenanceWindow": {
+      "fields": {
+        "week_day_based_schedule": {
+          "ref": "settingsv2.ClusterAutoRestartMessageMaintenanceWindowWeekDayBasedSchedule",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "settingsv2.ClusterAutoRestartMessageMaintenanceWindowDayOfWeek": {
+      "enum": [
+        "MONDAY",
+        "TUESDAY",
+        "WEDNESDAY",
+        "THURSDAY",
+        "FRIDAY",
+        "SATURDAY",
+        "SUNDAY"
+      ],
+      "enum_launch_stages": {
+        "FRIDAY": "GA",
+        "MONDAY": "GA",
+        "SATURDAY": "GA",
+        "SUNDAY": "GA",
+        "THURSDAY": "GA",
+        "TUESDAY": "GA",
+        "WEDNESDAY": "GA"
+      }
+    },
+    "settingsv2.ClusterAutoRestartMessageMaintenanceWindowWeekDayBasedSchedule": {
+      "fields": {
+        "day_of_week": {
+          "ref": "settingsv2.ClusterAutoRestartMessageMaintenanceWindowDayOfWeek",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "frequency": {
+          "ref": "settingsv2.ClusterAutoRestartMessageMaintenanceWindowWeekDayFrequency",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "window_start_time": {
+          "ref": "settingsv2.ClusterAutoRestartMessageMaintenanceWindowWindowStartTime",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "settingsv2.ClusterAutoRestartMessageMaintenanceWindowWeekDayFrequency": {
+      "enum": [
+        "FIRST_OF_MONTH",
+        "SECOND_OF_MONTH",
+        "THIRD_OF_MONTH",
+        "FOURTH_OF_MONTH",
+        "FIRST_AND_THIRD_OF_MONTH",
+        "SECOND_AND_FOURTH_OF_MONTH",
+        "EVERY_WEEK"
+      ],
+      "enum_launch_stages": {
+        "EVERY_WEEK": "GA",
+        "FIRST_AND_THIRD_OF_MONTH": "GA",
+        "FIRST_OF_MONTH": "GA",
+        "FOURTH_OF_MONTH": "GA",
+        "SECOND_AND_FOURTH_OF_MONTH": "GA",
+        "SECOND_OF_MONTH": "GA",
+        "THIRD_OF_MONTH": "GA"
+      }
+    },
+    "settingsv2.ClusterAutoRestartMessageMaintenanceWindowWindowStartTime": {
+      "fields": {
+        "hours": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "minutes": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "settingsv2.CollaborationPlatformConnectivityMessage": {
+      "description": "Controls which external collaboration platforms (Slack, Microsoft Teams) can connect\nto a workspace. Defaults to ALLOW_ALL.",
+      "fields": {
+        "connectivity": {
+          "ref": "settingsv2.CollaborationPlatformConnectivityMessageConnectivity",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "settingsv2.CollaborationPlatformConnectivityMessageConnectivity": {
+      "enum": [
+        "ALLOW_ALL",
+        "ALLOW_TEAMS",
+        "ALLOW_SLACK",
+        "DENY_ALL"
+      ],
+      "enum_launch_stages": {
+        "ALLOW_ALL": "PRIVATE_PREVIEW",
+        "ALLOW_SLACK": "PRIVATE_PREVIEW",
+        "ALLOW_TEAMS": "PRIVATE_PREVIEW",
+        "DENY_ALL": "PRIVATE_PREVIEW"
+      }
+    },
+    "settingsv2.GetPublicAccountSettingRequest": {},
+    "settingsv2.GetPublicAccountUserPreferenceRequest": {},
+    "settingsv2.GetPublicWorkspaceSettingRequest": {},
+    "settingsv2.IntegerMessage": {
+      "fields": {
+        "value": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "settingsv2.ListAccountSettingsMetadataRequest": {
+      "fields": {
+        "page_size": {
+          "description": "The maximum number of settings to return. The service may return fewer than this value.\nIf unspecified, at most 200 settings will be returned.\nThe maximum value is 1000; values above 1000 will be coerced to 1000.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "A page token, received from a previous `ListAccountSettingsMetadataRequest` call.\nProvide this to retrieve the subsequent page.\n\nWhen paginating, all other parameters provided to `ListAccountSettingsMetadataRequest` must match\nthe call that provided the page token.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settingsv2.ListAccountSettingsMetadataResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "A token that can be sent as `page_token` to retrieve the next page.\nIf this field is omitted, there are no subsequent pages.",
+          "launch_stage": "GA"
+        },
+        "settings_metadata": {
+          "description": "List of all settings available via public APIs and their metadata",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settingsv2.ListAccountUserPreferencesMetadataRequest": {
+      "fields": {
+        "page_size": {
+          "description": "The maximum number of settings to return. The service may return fewer than this value.\nIf unspecified, at most 200 settings will be returned.\nThe maximum value is 1000; values above 1000 will be coerced to 1000.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "A page token, received from a previous `ListAccountUserPreferencesMetadataRequest` call.\nProvide this to retrieve the subsequent page.\n\nWhen paginating, all other parameters provided to `ListAccountUserPreferencesMetadataRequest` must match\nthe call that provided the page token.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "settingsv2.ListAccountUserPreferencesMetadataResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "A token that can be sent as `page_token` to retrieve the next page.\nIf this field is omitted, there are no subsequent pages.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "settings_metadata": {
+          "description": "List of all settings available via public APIs and their metadata",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "settingsv2.ListWorkspaceSettingsMetadataRequest": {
+      "fields": {
+        "page_size": {
+          "description": "The maximum number of settings to return. The service may return fewer than this value.\nIf unspecified, at most 200 settings will be returned.\nThe maximum value is 1000; values above 1000 will be coerced to 1000.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "A page token, received from a previous `ListWorkspaceSettingsMetadataRequest` call.\nProvide this to retrieve the subsequent page.\n\nWhen paginating, all other parameters provided to `ListWorkspaceSettingsMetadataRequest` must match\nthe call that provided the page token.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settingsv2.ListWorkspaceSettingsMetadataResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "A token that can be sent as `page_token` to retrieve the next page.\nIf this field is omitted, there are no subsequent pages.",
+          "launch_stage": "GA"
+        },
+        "settings_metadata": {
+          "description": "List of all settings available via public APIs and their metadata",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settingsv2.OperationalEmailCustomRecipientMessage": {
+      "fields": {
+        "email": {
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "settingsv2.PatchPublicAccountSettingRequest": {
+      "fields": {
+        "setting": {
+          "ref": "settingsv2.Setting",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settingsv2.PatchPublicAccountUserPreferenceRequest": {
+      "fields": {
+        "setting": {
+          "ref": "settingsv2.UserPreference",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "settingsv2.PatchPublicWorkspaceSettingRequest": {
+      "fields": {
+        "setting": {
+          "ref": "settingsv2.Setting",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settingsv2.PersonalComputeMessage": {
+      "fields": {
+        "value": {
+          "ref": "settingsv2.PersonalComputeMessagePersonalComputeMessageEnum",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "settingsv2.PersonalComputeMessagePersonalComputeMessageEnum": {
+      "description": "ON: Grants all users in all workspaces access to the Personal Compute default policy, allowing all users to create single-machine compute resources.\nDELEGATE: Moves access control for the Personal Compute default policy to individual workspaces and requires a workspace’s users or groups to be added to the ACLs of that workspace’s Personal Compute default policy before they will be able to create compute resources through that policy.",
+      "enum": [
+        "ON",
+        "DELEGATE"
+      ],
+      "enum_launch_stages": {
+        "DELEGATE": "GA",
+        "ON": "GA"
+      }
+    },
+    "settingsv2.PreviewPhase": {
+      "description": "Preview phase for settings that are feature previews.\nFor settings that are not feature previews, the preview_phase field is left unset.\nMirrors only the customer-facing phases surfaced in the UI; internal-only phases\n(DISABLED, DEV, UNDER_MIGRATION, LAUNCHED, etc.) are not exposed here.",
+      "enum": [
+        "PRIVATE_PREVIEW",
+        "PUBLIC_PREVIEW",
+        "BETA",
+        "GA_SOON",
+        "GA"
+      ],
+      "enum_launch_stages": {
+        "BETA": "PUBLIC_BETA",
+        "GA": "PUBLIC_BETA",
+        "GA_SOON": "PUBLIC_BETA",
+        "PRIVATE_PREVIEW": "PUBLIC_BETA",
+        "PUBLIC_PREVIEW": "PUBLIC_BETA"
+      }
+    },
+    "settingsv2.RestrictWorkspaceAdminsMessage": {
+      "fields": {
+        "disable_gov_tag_creation": {
+          "description": "When true, workspace admins cannot create governance tags.\nALLOW_ALL status does not override this; they are independent.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "status": {
+          "ref": "settingsv2.RestrictWorkspaceAdminsMessageStatus",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "settingsv2.RestrictWorkspaceAdminsMessageStatus": {
+      "enum": [
+        "ALLOW_ALL",
+        "RESTRICT_TOKENS_AND_JOB_RUN_AS"
+      ],
+      "enum_launch_stages": {
+        "ALLOW_ALL": "GA",
+        "RESTRICT_TOKENS_AND_JOB_RUN_AS": "GA"
+      }
+    },
+    "settingsv2.Setting": {
+      "fields": {
+        "aibi_dashboard_embedding_access_policy": {
+          "description": "Setting value for aibi_dashboard_embedding_access_policy setting. This is the setting value set by consumers, check effective_aibi_dashboard_embedding_access_policy for final setting value.",
+          "ref": "settingsv2.AibiDashboardEmbeddingAccessPolicy",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "aibi_dashboard_embedding_approved_domains": {
+          "description": "Setting value for aibi_dashboard_embedding_approved_domains setting. This is the setting value set by consumers, check effective_aibi_dashboard_embedding_approved_domains for final setting value.",
+          "ref": "settingsv2.AibiDashboardEmbeddingApprovedDomains",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "allowed_apps_user_api_scopes": {
+          "description": "Setting value for allowed_apps_user_api_scopes setting. This is the setting value set by consumers, check effective_allowed_apps_user_api_scopes for final setting value.",
+          "ref": "settingsv2.AllowedAppsUserApiScopesMessage",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "automatic_cluster_update_workspace": {
+          "description": "Setting value for automatic_cluster_update_workspace setting. This is the setting value set by consumers, check effective_automatic_cluster_update_workspace for final setting value.",
+          "ref": "settingsv2.ClusterAutoRestartMessage",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "boolean_val": {
+          "description": "Setting value for boolean type setting. This is the setting value set by consumers, check effective_boolean_val for final setting value.",
+          "ref": "settingsv2.BooleanMessage",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "collaboration_platform_connectivity": {
+          "description": "Setting value for collaboration_platform_connectivity setting. This is the setting value set by consumers, check effective_collaboration_platform_connectivity for final setting value.",
+          "ref": "settingsv2.CollaborationPlatformConnectivityMessage",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "effective_aibi_dashboard_embedding_access_policy": {
+          "description": "Effective setting value for aibi_dashboard_embedding_access_policy setting. This is the final effective value of setting. To set a value use aibi_dashboard_embedding_access_policy.",
+          "ref": "settingsv2.AibiDashboardEmbeddingAccessPolicy",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "effective_aibi_dashboard_embedding_approved_domains": {
+          "description": "Effective setting value for aibi_dashboard_embedding_approved_domains setting. This is the final effective value of setting. To set a value use aibi_dashboard_embedding_approved_domains.",
+          "ref": "settingsv2.AibiDashboardEmbeddingApprovedDomains",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "effective_allowed_apps_user_api_scopes": {
+          "description": "Effective setting value for allowed_apps_user_api_scopes setting. This is the final effective value of setting. To set a value use allowed_apps_user_api_scopes.",
+          "ref": "settingsv2.AllowedAppsUserApiScopesMessage",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "effective_automatic_cluster_update_workspace": {
+          "description": "Effective setting value for automatic_cluster_update_workspace setting. This is the final effective value of setting. To set a value use automatic_cluster_update_workspace.",
+          "ref": "settingsv2.ClusterAutoRestartMessage",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "effective_boolean_val": {
+          "description": "Effective setting value for boolean type setting. This is the final effective value of setting. To set a value use boolean_val.",
+          "ref": "settingsv2.BooleanMessage",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "effective_collaboration_platform_connectivity": {
+          "description": "Effective setting value for collaboration_platform_connectivity setting. This is the final effective value of setting. To set a value use collaboration_platform_connectivity.",
+          "ref": "settingsv2.CollaborationPlatformConnectivityMessage",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "effective_integer_val": {
+          "description": "Effective setting value for integer type setting. This is the final effective value of setting. To set a value use integer_val.",
+          "ref": "settingsv2.IntegerMessage",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "effective_operational_email_custom_recipient": {
+          "description": "Effective setting value for operational_email_custom_recipient setting. This is the final effective value of setting. To set a value use operational_email_custom_recipient.",
+          "ref": "settingsv2.OperationalEmailCustomRecipientMessage",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "effective_personal_compute": {
+          "description": "Effective setting value for personal_compute setting. This is the final effective value of setting. To set a value use personal_compute.",
+          "ref": "settingsv2.PersonalComputeMessage",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "effective_restrict_workspace_admins": {
+          "description": "Effective setting value for restrict_workspace_admins setting. This is the final effective value of setting. To set a value use restrict_workspace_admins.",
+          "ref": "settingsv2.RestrictWorkspaceAdminsMessage",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "effective_string_val": {
+          "description": "Effective setting value for string type setting. This is the final effective value of setting. To set a value use string_val.",
+          "ref": "settingsv2.StringMessage",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "effective_workspace_label": {
+          "description": "Effective setting value for workspace_label setting. This is the final effective value of setting. To set a value use workspace_label.",
+          "ref": "settingsv2.WorkspaceLabelMessage",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "integer_val": {
+          "description": "Setting value for integer type setting. This is the setting value set by consumers, check effective_integer_val for final setting value.",
+          "ref": "settingsv2.IntegerMessage",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "name": {
+          "description": "Name of the setting.",
+          "launch_stage": "GA"
+        },
+        "operational_email_custom_recipient": {
+          "description": "Setting value for operational_email_custom_recipient setting. This is the setting value set by consumers, check effective_operational_email_custom_recipient for final setting value.",
+          "ref": "settingsv2.OperationalEmailCustomRecipientMessage",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "personal_compute": {
+          "description": "Setting value for personal_compute setting. This is the setting value set by consumers, check effective_personal_compute for final setting value.",
+          "ref": "settingsv2.PersonalComputeMessage",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "restrict_workspace_admins": {
+          "description": "Setting value for restrict_workspace_admins setting. This is the setting value set by consumers, check effective_restrict_workspace_admins for final setting value.",
+          "ref": "settingsv2.RestrictWorkspaceAdminsMessage",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "string_val": {
+          "description": "Setting value for string type setting. This is the setting value set by consumers, check effective_string_val for final setting value.",
+          "ref": "settingsv2.StringMessage",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "workspace_label": {
+          "description": "Setting value for workspace_label setting. This is the setting value set by consumers, check effective_workspace_label for final setting value.",
+          "ref": "settingsv2.WorkspaceLabelMessage",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "settingsv2.SettingsMetadata": {
+      "fields": {
+        "description": {
+          "description": "Setting description for what this setting controls",
+          "launch_stage": "GA"
+        },
+        "display_name": {
+          "description": "Human-readable display name for the setting or feature preview.\nThis field may be unset if no display name is available.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "docs_link": {
+          "description": "Link to databricks documentation for the setting",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of the setting.",
+          "launch_stage": "GA"
+        },
+        "preview_phase": {
+          "description": "Preview phase for feature preview settings. This field is not set for non-preview settings.",
+          "ref": "settingsv2.PreviewPhase",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "type": {
+          "description": "Sample message depicting the type of the setting. To set this setting, the value sent must match this type.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "settingsv2.StringMessage": {
+      "fields": {
+        "value": {
+          "description": "Represents a generic string value.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "settingsv2.UserPreference": {
+      "description": "User Preference represents a user-specific setting scoped to an individual user within an account.\nUnlike workspace or account settings that apply to all users, user preferences allow personal\ncustomization (e.g., UI theme, editor preferences) without affecting other users.",
+      "fields": {
+        "boolean_val": {
+          "ref": "settingsv2.BooleanMessage",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "effective_boolean_val": {
+          "ref": "settingsv2.BooleanMessage",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "effective_string_val": {
+          "ref": "settingsv2.StringMessage",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "Name of the setting.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "string_val": {
+          "ref": "settingsv2.StringMessage",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "user_id": {
+          "description": "User ID of the user.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "settingsv2.WorkspaceLabelMessage": {
+      "description": "Workspace label and color for display (e.g. in account console).",
+      "fields": {
+        "color": {
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "label": {
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "sharing.AuthenticationType": {
+      "description": "The delta sharing authentication type.",
+      "enum": [
+        "TOKEN",
+        "DATABRICKS",
+        "OIDC_FEDERATION",
+        "OAUTH_CLIENT_CREDENTIALS"
+      ],
+      "enum_launch_stages": {
+        "DATABRICKS": "GA",
+        "OAUTH_CLIENT_CREDENTIALS": "GA",
+        "OIDC_FEDERATION": "GA",
+        "TOKEN": "GA"
+      }
+    },
+    "sharing.ColumnTypeName": {
+      "description": "UC supported column types\nCopied from https://src.dev.databricks.com/databricks/universe@23a85902bb58695ab9293adc9f327b0714b55e72/-/blob/managed-catalog/api/messages/table.proto?L68",
+      "enum": [
+        "BOOLEAN",
+        "BYTE",
+        "SHORT",
+        "INT",
+        "LONG",
+        "FLOAT",
+        "DOUBLE",
+        "DATE",
+        "TIMESTAMP",
+        "STRING",
+        "BINARY",
+        "DECIMAL",
+        "INTERVAL",
+        "ARRAY",
+        "STRUCT",
+        "MAP",
+        "CHAR",
+        "NULL",
+        "USER_DEFINED_TYPE",
+        "TIMESTAMP_NTZ",
+        "VARIANT",
+        "TABLE_TYPE"
+      ],
+      "enum_launch_stages": {
+        "ARRAY": "GA",
+        "BINARY": "GA",
+        "BOOLEAN": "GA",
+        "BYTE": "GA",
+        "CHAR": "GA",
+        "DATE": "GA",
+        "DECIMAL": "GA",
+        "DOUBLE": "GA",
+        "FLOAT": "GA",
+        "INT": "GA",
+        "INTERVAL": "GA",
+        "LONG": "GA",
+        "MAP": "GA",
+        "NULL": "GA",
+        "SHORT": "GA",
+        "STRING": "GA",
+        "STRUCT": "GA",
+        "TABLE_TYPE": "GA",
+        "TIMESTAMP": "GA",
+        "TIMESTAMP_NTZ": "GA",
+        "USER_DEFINED_TYPE": "GA",
+        "VARIANT": "GA"
+      }
+    },
+    "sharing.CreateFederationPolicyRequest": {
+      "fields": {
+        "policy": {
+          "description": "Name of the policy. This is the name of the policy to be created.",
+          "ref": "sharing.FederationPolicy",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "sharing.CreateProvider": {
+      "fields": {
+        "authentication_type": {
+          "ref": "sharing.AuthenticationType",
+          "launch_stage": "GA"
+        },
+        "comment": {
+          "description": "Description about the provider.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The name of the Provider.",
+          "launch_stage": "GA"
+        },
+        "recipient_profile_str": {
+          "description": "This field is required when the __authentication_type__ is **TOKEN**, **OAUTH_CLIENT_CREDENTIALS** or not provided.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.CreateRecipient": {
+      "fields": {
+        "authentication_type": {
+          "ref": "sharing.AuthenticationType",
+          "launch_stage": "GA"
+        },
+        "comment": {
+          "description": "Description about the recipient.",
+          "launch_stage": "GA"
+        },
+        "data_recipient_global_metastore_id": {
+          "description": "The global Unity Catalog metastore id provided by the data recipient.\nThis field is only present when the __authentication_type__ is **DATABRICKS**.\nThe identifier is of format __cloud__:__region__:__metastore-uuid__.",
+          "launch_stage": "GA"
+        },
+        "expiration_time": {
+          "description": "Expiration timestamp of the token, in epoch milliseconds.",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "[Create,Update:IGN] common - id of the recipient",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "ip_access_list": {
+          "description": "IP Access List",
+          "ref": "sharing.IpAccessList",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of Recipient.",
+          "launch_stage": "GA"
+        },
+        "owner": {
+          "description": "Username of the recipient owner.",
+          "launch_stage": "GA"
+        },
+        "properties_kvpairs": {
+          "description": "Recipient properties as map of string key-value pairs.\nWhen provided in update request, the specified properties will override the existing\nproperties. To add and remove properties, one would need to perform a read-modify-write.",
+          "ref": "sharing.SecurablePropertiesKvPairs",
+          "launch_stage": "GA"
+        },
+        "sharing_code": {
+          "description": "The one-time sharing code provided by the data recipient. This field is only present when the __authentication_type__ is **DATABRICKS**.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.CreateShare": {
+      "fields": {
+        "comment": {
+          "description": "User-provided free-form text description.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of the share.",
+          "launch_stage": "GA"
+        },
+        "replication_config": {
+          "description": "Configuration for share replication.",
+          "ref": "sharing.ReplicationConfig",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "storage_root": {
+          "description": "Storage root URL for the share.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.DeleteFederationPolicyRequest": {},
+    "sharing.DeleteProviderRequest": {},
+    "sharing.DeleteRecipientRequest": {},
+    "sharing.DeleteShareRequest": {},
+    "sharing.DeltaSharingDependency": {
+      "description": "Represents a UC dependency.",
+      "fields": {
+        "function": {
+          "ref": "sharing.DeltaSharingFunctionDependency",
+          "launch_stage": "GA"
+        },
+        "table": {
+          "ref": "sharing.DeltaSharingTableDependency",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.DeltaSharingDependencyList": {
+      "description": "Represents a list of dependencies.",
+      "fields": {
+        "dependencies": {
+          "description": "An array of Dependency.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.DeltaSharingFunction": {
+      "fields": {
+        "aliases": {
+          "description": "The aliass of registered model.",
+          "launch_stage": "GA"
+        },
+        "comment": {
+          "description": "The comment of the function.",
+          "launch_stage": "GA"
+        },
+        "data_type": {
+          "description": "The data type of the function.",
+          "ref": "sharing.ColumnTypeName",
+          "launch_stage": "GA"
+        },
+        "dependency_list": {
+          "description": "The dependency list of the function.",
+          "ref": "sharing.DeltaSharingDependencyList",
+          "launch_stage": "GA"
+        },
+        "full_data_type": {
+          "description": "The full data type of the function.",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "The id of the function.",
+          "launch_stage": "GA"
+        },
+        "input_params": {
+          "description": "The function parameter information.",
+          "ref": "sharing.FunctionParameterInfos",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The name of the function.",
+          "launch_stage": "GA"
+        },
+        "properties": {
+          "description": "The properties of the function.",
+          "launch_stage": "GA"
+        },
+        "routine_definition": {
+          "description": "The routine definition of the function.",
+          "launch_stage": "GA"
+        },
+        "schema": {
+          "description": "The name of the schema that the function belongs to.",
+          "launch_stage": "GA"
+        },
+        "securable_kind": {
+          "description": "The securable kind of the function.",
+          "ref": "sharing.SharedSecurableKind",
+          "launch_stage": "GA"
+        },
+        "share": {
+          "description": "The name of the share that the function belongs to.",
+          "launch_stage": "GA"
+        },
+        "share_id": {
+          "description": "The id of the share that the function belongs to.",
+          "launch_stage": "GA"
+        },
+        "storage_location": {
+          "description": "The storage location of the function.",
+          "launch_stage": "GA"
+        },
+        "tags": {
+          "description": "The tags of the function.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.DeltaSharingFunctionDependency": {
+      "description": "A Function in UC as a dependency.",
+      "fields": {
+        "function_name": {
+          "launch_stage": "GA"
+        },
+        "schema_name": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.DeltaSharingTableDependency": {
+      "description": "A Table in UC as a dependency.",
+      "fields": {
+        "schema_name": {
+          "launch_stage": "GA"
+        },
+        "table_name": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.FederationPolicy": {
+      "fields": {
+        "comment": {
+          "description": "Description of the policy. This is a user-provided description.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "create_time": {
+          "description": "System-generated timestamp indicating when the policy was created.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE",
+            "OUTPUT_ONLY"
+          ]
+        },
+        "id": {
+          "description": "Unique, immutable system-generated identifier for the federation policy.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "IMMUTABLE",
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "Name of the federation policy. A recipient can have multiple policies with different names.\nThe name must contain only lowercase alphanumeric characters, numbers, and hyphens.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "oidc_policy": {
+          "description": "Specifies the policy to use for validating OIDC claims in the federated tokens.",
+          "ref": "sharing.OidcFederationPolicy",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "update_time": {
+          "description": "System-generated timestamp indicating when the policy was last updated.",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "sharing.FunctionParameterInfo": {
+      "description": "Represents a parameter of a function. The same message is used for both input and output columns.",
+      "fields": {
+        "comment": {
+          "description": "The comment of the parameter.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The name of the parameter.",
+          "launch_stage": "GA"
+        },
+        "parameter_default": {
+          "description": "The default value of the parameter.",
+          "launch_stage": "GA"
+        },
+        "parameter_mode": {
+          "description": "The mode of the function parameter.",
+          "ref": "sharing.FunctionParameterMode",
+          "launch_stage": "GA"
+        },
+        "parameter_type": {
+          "description": "The type of the function parameter.",
+          "ref": "sharing.FunctionParameterType",
+          "launch_stage": "GA"
+        },
+        "position": {
+          "description": "The position of the parameter.",
+          "launch_stage": "GA"
+        },
+        "type_interval_type": {
+          "description": "The interval type of the parameter type.",
+          "launch_stage": "GA"
+        },
+        "type_json": {
+          "description": "The type of the parameter in JSON format.",
+          "launch_stage": "GA"
+        },
+        "type_name": {
+          "description": "The type of the parameter in Enum format.",
+          "ref": "sharing.ColumnTypeName",
+          "launch_stage": "GA"
+        },
+        "type_precision": {
+          "description": "The precision of the parameter type.",
+          "launch_stage": "GA"
+        },
+        "type_scale": {
+          "description": "The scale of the parameter type.",
+          "launch_stage": "GA"
+        },
+        "type_text": {
+          "description": "The type of the parameter in text format.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.FunctionParameterInfos": {
+      "fields": {
+        "parameters": {
+          "description": "The list of parameters of the function.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.FunctionParameterMode": {
+      "enum": [
+        "IN",
+        "OUT",
+        "INOUT"
+      ],
+      "enum_launch_stages": {
+        "IN": "GA",
+        "INOUT": "GA",
+        "OUT": "GA"
+      }
+    },
+    "sharing.FunctionParameterType": {
+      "enum": [
+        "PARAM",
+        "COLUMN"
+      ],
+      "enum_launch_stages": {
+        "COLUMN": "GA",
+        "PARAM": "GA"
+      }
+    },
+    "sharing.GetActivationUrlInfoRequest": {},
+    "sharing.GetActivationUrlInfoResponse": {},
+    "sharing.GetFederationPolicyRequest": {},
+    "sharing.GetProviderRequest": {},
+    "sharing.GetRecipientRequest": {},
+    "sharing.GetRecipientSharePermissionsResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "Opaque token to retrieve the next page of results. Absent if there are no more pages.\n__page_token__ should be set to this value for the next request (for the next page of results).",
+          "launch_stage": "GA"
+        },
+        "permissions_out": {
+          "description": "An array of data share permissions for a recipient.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.GetSharePermissionsResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "Opaque token to retrieve the next page of results. Absent if there are no more pages.\n__page_token__ should be set to this value for the next request (for the next page of results).",
+          "launch_stage": "GA"
+        },
+        "privilege_assignments": {
+          "description": "The privileges assigned to each principal",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.GetShareRequest": {
+      "fields": {
+        "include_shared_data": {
+          "description": "Query for data to include in the share.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.IpAccessList": {
+      "fields": {
+        "allowed_ip_addresses": {
+          "description": "Allowed IP Addresses in CIDR notation. Limit of 100.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.ListFederationPoliciesRequest": {
+      "fields": {
+        "max_results": {
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "sharing.ListFederationPoliciesResponse": {
+      "fields": {
+        "next_page_token": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "policies": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "sharing.ListProviderShareAssetsRequest": {
+      "fields": {
+        "function_max_results": {
+          "description": "Maximum number of functions to return.",
+          "launch_stage": "GA"
+        },
+        "notebook_max_results": {
+          "description": "Maximum number of notebooks to return.",
+          "launch_stage": "GA"
+        },
+        "table_max_results": {
+          "description": "Maximum number of tables to return.",
+          "launch_stage": "GA"
+        },
+        "volume_max_results": {
+          "description": "Maximum number of volumes to return.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.ListProviderShareAssetsResponse": {
+      "description": "Response to ListProviderShareAssets, which contains the list of assets of a share.",
+      "fields": {
+        "functions": {
+          "description": "The list of functions in the share.",
+          "launch_stage": "GA"
+        },
+        "notebooks": {
+          "description": "The list of notebooks in the share.",
+          "launch_stage": "GA"
+        },
+        "share": {
+          "description": "The metadata of the share.",
+          "ref": "sharing.Share",
+          "launch_stage": "GA"
+        },
+        "tables": {
+          "description": "The list of tables in the share.",
+          "launch_stage": "GA"
+        },
+        "volumes": {
+          "description": "The list of volumes in the share.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.ListProviderSharesResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "Opaque token to retrieve the next page of results. Absent if there are no more pages.\n__page_token__ should be set to this value for the next request (for the next page of results).",
+          "launch_stage": "GA"
+        },
+        "shares": {
+          "description": "An array of provider shares.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.ListProvidersRequest": {
+      "fields": {
+        "data_provider_global_metastore_id": {
+          "description": "If not provided, all providers will be returned.\nIf no providers exist with this ID, no results will be returned.",
+          "launch_stage": "GA"
+        },
+        "max_results": {
+          "description": "Maximum number of providers to return.\n- when set to 0, the page length is set to a server configured value (recommended);\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- when set to a value less than 0, an invalid parameter error is returned;\n- If not set, all valid providers are returned (not recommended).\n- Note: The number of returned providers might be less than the specified max_results size, even zero.\nThe only definitive indication that no further providers can be fetched is when the next_page_token is unset from the response.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Opaque pagination token to go to next page based on previous query.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.ListProvidersResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "Opaque token to retrieve the next page of results. Absent if there are no more pages.\n__page_token__ should be set to this value for the next request (for the next page of results).",
+          "launch_stage": "GA"
+        },
+        "providers": {
+          "description": "An array of provider information objects.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.ListRecipientsRequest": {
+      "fields": {
+        "data_recipient_global_metastore_id": {
+          "description": "If not provided, all recipients will be returned.\nIf no recipients exist with this ID, no results will be returned.",
+          "launch_stage": "GA"
+        },
+        "max_results": {
+          "description": "Maximum number of recipients to return.\n- when set to 0, the page length is set to a server configured value (recommended);\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- when set to a value less than 0, an invalid parameter error is returned;\n- If not set, all valid recipients are returned (not recommended).\n- Note: The number of returned recipients might be less than the specified max_results size, even zero.\nThe only definitive indication that no further recipients can be fetched is when the next_page_token is unset from the response.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Opaque pagination token to go to next page based on previous query.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.ListRecipientsResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "Opaque token to retrieve the next page of results. Absent if there are no more pages.\n__page_token__ should be set to this value for the next request (for the next page of results).",
+          "launch_stage": "GA"
+        },
+        "recipients": {
+          "description": "An array of recipient information objects.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.ListSharesRequest": {
+      "fields": {
+        "max_results": {
+          "description": "Maximum number of shares to return.\n- when set to 0, the page length is set to a server configured value (recommended);\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- when set to a value less than 0, an invalid parameter error is returned;\n- If not set, all valid shares are returned (not recommended).\n- Note: The number of returned shares might be less than the specified max_results size, even zero.\nThe only definitive indication that no further shares can be fetched is when the next_page_token is unset from the response.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Opaque pagination token to go to next page based on previous query.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.ListSharesResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "Opaque token to retrieve the next page of results. Absent if there are no more pages.\n__page_token__ should be set to this value for the next request (for the next page of results).",
+          "launch_stage": "GA"
+        },
+        "shares": {
+          "description": "An array of data share information objects.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.NotebookFile": {
+      "fields": {
+        "comment": {
+          "description": "The comment of the notebook file.",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "The id of the notebook file.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of the notebook file.",
+          "launch_stage": "GA"
+        },
+        "share": {
+          "description": "The name of the share that the notebook file belongs to.",
+          "launch_stage": "GA"
+        },
+        "share_id": {
+          "description": "The id of the share that the notebook file belongs to.",
+          "launch_stage": "GA"
+        },
+        "tags": {
+          "description": "The tags of the notebook file.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.OidcFederationPolicy": {
+      "description": "Specifies the policy to use for validating OIDC claims in your federated tokens from Delta Sharing Clients.\nRefer to https://docs.databricks.com/en/delta-sharing/create-recipient-oidc-fed for more details.",
+      "fields": {
+        "audiences": {
+          "description": "The allowed token audiences, as specified in the 'aud' claim of federated tokens.\nThe audience identifier is intended to represent the recipient of the token.\nCan be any non-empty string value. As long as the audience in the token matches at least one audience in the policy,",
+          "launch_stage": "PUBLIC_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "issuer": {
+          "description": "The required token issuer, as specified in the 'iss' claim of federated tokens.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "subject": {
+          "description": "The required token subject, as specified in the subject claim of federated tokens.\nThe subject claim identifies the identity of the user or machine accessing the resource.\nExamples for Entra ID (AAD):\n- U2M flow (group access): If the subject claim is `groups`, this must be the Object ID of the group in Entra ID.\n- U2M flow (user access): If the subject claim is `oid`, this must be the Object ID of the user in Entra ID.\n- M2M flow (OAuth App access): If the subject claim is `azp`, this must be the client ID of the OAuth app registered in Entra ID.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "subject_claim": {
+          "description": "The claim that contains the subject of the token.\nDepending on the identity provider and the use case (U2M or M2M), this can vary:\n- For Entra ID (AAD):\n* U2M flow (group access): Use `groups`.\n* U2M flow (user access): Use `oid`.\n* M2M flow (OAuth App access): Use `azp`.\n- For other IdPs, refer to the specific IdP documentation.\n\nSupported `subject_claim` values are:\n- `oid`: Object ID of the user.\n- `azp`: Client ID of the OAuth app.\n- `groups`: Object ID of the group.\n- `sub`: Subject identifier for other use cases.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "sharing.Partition": {
+      "fields": {
+        "values": {
+          "description": "An array of partition values.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.PartitionValue": {
+      "fields": {
+        "name": {
+          "description": "The name of the partition column.",
+          "launch_stage": "GA"
+        },
+        "op": {
+          "description": "The operator to apply for the value.",
+          "ref": "sharing.PartitionValueOp",
+          "launch_stage": "GA"
+        },
+        "recipient_property_key": {
+          "description": "The key of a Delta Sharing recipient's property. For example \"databricks-account-id\".\nWhen this field is set, field `value` can not be set.",
+          "launch_stage": "GA"
+        },
+        "value": {
+          "description": "The value of the partition column. When this value is not set, it means `null` value.\nWhen this field is set, field `recipient_property_key` can not be set.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.PartitionValueOp": {
+      "enum": [
+        "EQUAL",
+        "LIKE"
+      ],
+      "enum_launch_stages": {
+        "EQUAL": "GA",
+        "LIKE": "GA"
+      }
+    },
+    "sharing.PermissionsChange": {
+      "fields": {
+        "add": {
+          "description": "The set of privileges to add.",
+          "launch_stage": "GA"
+        },
+        "principal": {
+          "description": "The principal whose privileges we are changing.\nOnly one of principal or principal_id should be specified, never both at the same time.",
+          "launch_stage": "GA"
+        },
+        "remove": {
+          "description": "The set of privileges to remove.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.Privilege": {
+      "enum": [
+        "SELECT",
+        "READ_PRIVATE_FILES",
+        "WRITE_PRIVATE_FILES",
+        "CREATE",
+        "USAGE",
+        "USE_CATALOG",
+        "USE_SCHEMA",
+        "CREATE_SCHEMA",
+        "CREATE_VIEW",
+        "CREATE_EXTERNAL_TABLE",
+        "CREATE_MATERIALIZED_VIEW",
+        "CREATE_FUNCTION",
+        "CREATE_MODEL",
+        "CREATE_CATALOG",
+        "CREATE_MANAGED_STORAGE",
+        "CREATE_EXTERNAL_LOCATION",
+        "CREATE_STORAGE_CREDENTIAL",
+        "CREATE_SERVICE_CREDENTIAL",
+        "ACCESS",
+        "CREATE_SHARE",
+        "CREATE_RECIPIENT",
+        "CREATE_PROVIDER",
+        "USE_SHARE",
+        "USE_RECIPIENT",
+        "USE_PROVIDER",
+        "USE_MARKETPLACE_ASSETS",
+        "SET_SHARE_PERMISSION",
+        "MODIFY",
+        "REFRESH",
+        "EXECUTE",
+        "READ_FILES",
+        "WRITE_FILES",
+        "CREATE_TABLE",
+        "ALL_PRIVILEGES",
+        "CREATE_CONNECTION",
+        "USE_CONNECTION",
+        "APPLY_TAG",
+        "CREATE_FOREIGN_CATALOG",
+        "CREATE_FOREIGN_SECURABLE",
+        "MANAGE_ALLOWLIST",
+        "CREATE_VOLUME",
+        "CREATE_EXTERNAL_VOLUME",
+        "READ_VOLUME",
+        "WRITE_VOLUME",
+        "MANAGE"
+      ],
+      "enum_launch_stages": {
+        "ACCESS": "GA",
+        "ALL_PRIVILEGES": "GA",
+        "APPLY_TAG": "GA",
+        "CREATE": "GA",
+        "CREATE_CATALOG": "GA",
+        "CREATE_CONNECTION": "GA",
+        "CREATE_EXTERNAL_LOCATION": "GA",
+        "CREATE_EXTERNAL_TABLE": "GA",
+        "CREATE_EXTERNAL_VOLUME": "GA",
+        "CREATE_FOREIGN_CATALOG": "GA",
+        "CREATE_FOREIGN_SECURABLE": "GA",
+        "CREATE_FUNCTION": "GA",
+        "CREATE_MANAGED_STORAGE": "GA",
+        "CREATE_MATERIALIZED_VIEW": "GA",
+        "CREATE_MODEL": "GA",
+        "CREATE_PROVIDER": "GA",
+        "CREATE_RECIPIENT": "GA",
+        "CREATE_SCHEMA": "GA",
+        "CREATE_SERVICE_CREDENTIAL": "GA",
+        "CREATE_SHARE": "GA",
+        "CREATE_STORAGE_CREDENTIAL": "GA",
+        "CREATE_TABLE": "GA",
+        "CREATE_VIEW": "GA",
+        "CREATE_VOLUME": "GA",
+        "EXECUTE": "GA",
+        "MANAGE": "GA",
+        "MANAGE_ALLOWLIST": "GA",
+        "MODIFY": "GA",
+        "READ_FILES": "GA",
+        "READ_PRIVATE_FILES": "GA",
+        "READ_VOLUME": "GA",
+        "REFRESH": "GA",
+        "SELECT": "GA",
+        "SET_SHARE_PERMISSION": "GA",
+        "USAGE": "GA",
+        "USE_CATALOG": "GA",
+        "USE_CONNECTION": "GA",
+        "USE_MARKETPLACE_ASSETS": "GA",
+        "USE_PROVIDER": "GA",
+        "USE_RECIPIENT": "GA",
+        "USE_SCHEMA": "GA",
+        "USE_SHARE": "GA",
+        "WRITE_FILES": "GA",
+        "WRITE_PRIVATE_FILES": "GA",
+        "WRITE_VOLUME": "GA"
+      }
+    },
+    "sharing.PrivilegeAssignment": {
+      "fields": {
+        "principal": {
+          "description": "The principal (user email address or group name).\nFor deleted principals, `principal` is empty while `principal_id` is populated.",
+          "launch_stage": "GA"
+        },
+        "privileges": {
+          "description": "The privileges assigned to the principal.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.ProviderInfo": {
+      "fields": {
+        "authentication_type": {
+          "ref": "sharing.AuthenticationType",
+          "launch_stage": "GA"
+        },
+        "cloud": {
+          "description": "Cloud vendor of the provider's UC metastore. This field is only present when the __authentication_type__ is **DATABRICKS**.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "comment": {
+          "description": "Description about the provider.",
+          "launch_stage": "GA"
+        },
+        "created_at": {
+          "description": "Time at which this Provider was created, in epoch milliseconds.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "created_by": {
+          "description": "Username of Provider creator.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "data_provider_global_metastore_id": {
+          "description": "The global UC metastore id of the data provider. This field is only present when the __authentication_type__ is **DATABRICKS**. The identifier is of format __cloud__:__region__:__metastore-uuid__.",
+          "launch_stage": "GA"
+        },
+        "metastore_id": {
+          "description": "UUID of the provider's UC metastore. This field is only present when the __authentication_type__ is **DATABRICKS**.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "The name of the Provider.",
+          "launch_stage": "GA"
+        },
+        "owner": {
+          "description": "Username of Provider owner.",
+          "launch_stage": "GA"
+        },
+        "recipient_profile": {
+          "description": "The recipient profile. This field is only present when the authentication_type is `TOKEN` or `OAUTH_CLIENT_CREDENTIALS`.",
+          "ref": "sharing.RecipientProfile",
+          "launch_stage": "GA"
+        },
+        "recipient_profile_str": {
+          "description": "This field is required when the __authentication_type__ is **TOKEN**, **OAUTH_CLIENT_CREDENTIALS** or not provided.",
+          "launch_stage": "GA"
+        },
+        "region": {
+          "description": "Cloud region of the provider's UC metastore. This field is only present when the __authentication_type__ is **DATABRICKS**.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "updated_at": {
+          "description": "Time at which this Provider was created, in epoch milliseconds.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "updated_by": {
+          "description": "Username of user who last modified Provider.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "sharing.ProviderShare": {
+      "fields": {
+        "name": {
+          "description": "The name of the Provider Share.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.RecipientInfo": {
+      "fields": {
+        "activated": {
+          "description": "A boolean status field showing whether the Recipient's activation URL has been exercised or not.",
+          "deprecated": true,
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "activation_url": {
+          "description": "Full activation url to retrieve the access token.\nIt will be empty if the token is already retrieved.",
+          "deprecated": true,
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "authentication_type": {
+          "ref": "sharing.AuthenticationType",
+          "launch_stage": "GA"
+        },
+        "cloud": {
+          "description": "Cloud vendor of the recipient's Unity Catalog Metastore.\nThis field is only present when the __authentication_type__ is **DATABRICKS**.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "comment": {
+          "description": "Description about the recipient.",
+          "launch_stage": "GA"
+        },
+        "created_at": {
+          "description": "Time at which this recipient was created, in epoch milliseconds.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "created_by": {
+          "description": "Username of recipient creator.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "data_recipient_global_metastore_id": {
+          "description": "The global Unity Catalog metastore id provided by the data recipient.\nThis field is only present when the __authentication_type__ is **DATABRICKS**.\nThe identifier is of format __cloud__:__region__:__metastore-uuid__.",
+          "launch_stage": "GA"
+        },
+        "expiration_time": {
+          "description": "Expiration timestamp of the token, in epoch milliseconds.",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "[Create,Update:IGN] common - id of the recipient",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "ip_access_list": {
+          "description": "IP Access List",
+          "ref": "sharing.IpAccessList",
+          "launch_stage": "GA"
+        },
+        "metastore_id": {
+          "description": "Unique identifier of recipient's Unity Catalog Metastore.\nThis field is only present when the __authentication_type__ is **DATABRICKS**.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "Name of Recipient.",
+          "launch_stage": "GA"
+        },
+        "owner": {
+          "description": "Username of the recipient owner.",
+          "launch_stage": "GA"
+        },
+        "properties_kvpairs": {
+          "description": "Recipient properties as map of string key-value pairs.\nWhen provided in update request, the specified properties will override the existing\nproperties. To add and remove properties, one would need to perform a read-modify-write.",
+          "ref": "sharing.SecurablePropertiesKvPairs",
+          "launch_stage": "GA"
+        },
+        "region": {
+          "description": "Cloud region of the recipient's Unity Catalog Metastore.\nThis field is only present when the __authentication_type__ is **DATABRICKS**.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "sharing_code": {
+          "description": "The one-time sharing code provided by the data recipient. This field is only present when the __authentication_type__ is **DATABRICKS**.",
+          "launch_stage": "GA"
+        },
+        "tokens": {
+          "description": "This field is only present when the __authentication_type__ is **TOKEN**.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "updated_at": {
+          "description": "Time at which the recipient was updated, in epoch milliseconds.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "updated_by": {
+          "description": "Username of recipient updater.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "sharing.RecipientProfile": {
+      "fields": {
+        "bearer_token": {
+          "description": "The token used to authorize the recipient.",
+          "launch_stage": "GA"
+        },
+        "endpoint": {
+          "description": "The endpoint for the share to be used by the recipient.",
+          "launch_stage": "GA"
+        },
+        "share_credentials_version": {
+          "description": "The version number of the recipient's credentials on a share.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.RecipientTokenInfo": {
+      "fields": {
+        "activation_url": {
+          "description": "Full activation URL to retrieve the access token. It will be empty if the token is already retrieved.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "created_at": {
+          "description": "Time at which this recipient token was created, in epoch milliseconds.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "created_by": {
+          "description": "Username of recipient token creator.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "expiration_time": {
+          "description": "Expiration timestamp of the token in epoch milliseconds.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "id": {
+          "description": "Unique ID of the recipient token.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "updated_at": {
+          "description": "Time at which this recipient token was updated, in epoch milliseconds.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "updated_by": {
+          "description": "Username of recipient token updater.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "sharing.RegisteredModelAlias": {
+      "fields": {
+        "alias_name": {
+          "description": "Name of the alias.",
+          "launch_stage": "GA"
+        },
+        "version_num": {
+          "description": "Numeric model version that alias will reference.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.ReplicationConfig": {
+      "description": "Configuration for Delta Sharing replication on a share. When enabled, the share's data is\ncopied into each recipient's region so recipients can query the share locally.",
+      "fields": {
+        "enabled": {
+          "description": "Whether replication is enabled for the share.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "sharing.RetrieveTokenRequest": {},
+    "sharing.RetrieveTokenResponse": {
+      "fields": {
+        "bearerToken": {
+          "description": "The token used to authorize the recipient.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "endpoint": {
+          "description": "The endpoint for the share to be used by the recipient.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "expirationTime": {
+          "description": "Expiration timestamp of the token in epoch milliseconds.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "shareCredentialsVersion": {
+          "description": "These field names must follow the delta sharing protocol.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "sharing.RotateRecipientToken": {
+      "fields": {
+        "existing_token_expire_in_seconds": {
+          "description": "The expiration time of the bearer token in ISO 8601 format. This will set the expiration_time\nof existing token only to a smaller timestamp, it cannot extend the expiration_time. Use 0 to\nexpire the existing token immediately, negative number will return an error.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.SecurablePropertiesKvPairs": {
+      "description": "An object with __properties__ containing map of key-value properties attached to the securable.",
+      "fields": {
+        "properties": {
+          "description": "A map of key-value properties attached to the securable.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.Share": {
+      "fields": {
+        "id": {
+          "launch_stage": "GA"
+        },
+        "name": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.ShareInfo": {
+      "fields": {
+        "comment": {
+          "description": "User-provided free-form text description.",
+          "launch_stage": "GA"
+        },
+        "created_at": {
+          "description": "Time at which this share was created, in epoch milliseconds.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "created_by": {
+          "description": "Username of share creator.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "Name of the share.",
+          "launch_stage": "GA"
+        },
+        "objects": {
+          "description": "A list of shared data objects within the share.",
+          "launch_stage": "GA"
+        },
+        "owner": {
+          "description": "Username of current owner of share.",
+          "launch_stage": "GA"
+        },
+        "replication_config": {
+          "description": "Configuration for share replication.",
+          "ref": "sharing.ReplicationConfig",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "storage_location": {
+          "description": "Storage Location URL (full path) for the share.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "storage_root": {
+          "description": "Storage root URL for the share.",
+          "launch_stage": "GA"
+        },
+        "updated_at": {
+          "description": "Time at which this share was updated, in epoch milliseconds.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "updated_by": {
+          "description": "Username of share updater.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "sharing.SharePermissionsRequest": {
+      "fields": {
+        "max_results": {
+          "description": "Maximum number of permissions to return.\n- when set to 0, the page length is set to a server configured value (recommended);\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- when set to a value less than 0, an invalid parameter error is returned;\n- If not set, all valid permissions are returned (not recommended).\n- Note: The number of returned permissions might be less than the specified max_results size, even zero.\nThe only definitive indication that no further permissions can be fetched is when the next_page_token is unset from the response.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Opaque pagination token to go to next page based on previous query.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.ShareToPrivilegeAssignment": {
+      "fields": {
+        "privilege_assignments": {
+          "description": "The privileges assigned to the principal.",
+          "launch_stage": "GA"
+        },
+        "share_name": {
+          "description": "The share name.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.SharedDataObject": {
+      "fields": {
+        "added_at": {
+          "description": "The time when this data object is added to the share, in epoch milliseconds.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "added_by": {
+          "description": "Username of the sharer.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "cdf_enabled": {
+          "description": "Whether to enable cdf or indicate if cdf is enabled on the shared object.",
+          "launch_stage": "GA"
+        },
+        "comment": {
+          "description": "A user-provided comment when adding the data object to the share.",
+          "launch_stage": "GA"
+        },
+        "content": {
+          "description": "The content of the notebook file when the data object type is NOTEBOOK_FILE.\nThis should be base64 encoded.\nRequired for adding a NOTEBOOK_FILE, optional for updating, ignored for other types.",
+          "launch_stage": "GA"
+        },
+        "data_object_type": {
+          "description": "The type of the data object.",
+          "ref": "sharing.SharedDataObjectDataObjectType",
+          "launch_stage": "GA"
+        },
+        "history_data_sharing_status": {
+          "description": "Whether to enable or disable sharing of data history. If not specified, the default is **DISABLED**.",
+          "ref": "sharing.SharedDataObjectHistoryDataSharingStatus",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "A fully qualified name that uniquely identifies a data object.\nFor example, a table's fully qualified name is in the format of `\u003ccatalog\u003e.\u003cschema\u003e.\u003ctable\u003e`,",
+          "launch_stage": "GA"
+        },
+        "partitions": {
+          "description": "Array of partitions for the shared data.",
+          "launch_stage": "GA"
+        },
+        "shared_as": {
+          "description": "A user-provided alias name for table-like data objects within the share.\n\nUse this field for table-like objects (for example: TABLE, VIEW, MATERIALIZED_VIEW, STREAMING_TABLE, FOREIGN_TABLE).\nFor non-table objects (for example: VOLUME, MODEL, NOTEBOOK_FILE, FUNCTION), use `string_shared_as` instead.\n\nImportant: For non-table objects, this field must be omitted entirely.\n\nFormat: Must be a 2-part name `\u003cschema_name\u003e.\u003ctable_name\u003e` (e.g., \"sales_schema.orders_table\")\n- Both schema and table names must contain only alphanumeric characters and underscores\n- No periods, spaces, forward slashes, or control characters are allowed within each part\n- Do not include the catalog name (use 2 parts, not 3)\n\nBehavior:\n- If not provided, the service automatically generates the alias as `\u003cschema\u003e.\u003ctable\u003e` from the object's original name\n- If you don't want to specify this field, omit it entirely from the request (do not pass an empty string)\n- The `shared_as` name must be unique within the share\n\nExamples:\n- Valid: \"analytics_schema.customer_view\"\n- Invalid: \"catalog.analytics_schema.customer_view\" (3 parts not allowed)\n- Invalid: \"analytics-schema.customer-view\" (hyphens not allowed)",
+          "launch_stage": "GA"
+        },
+        "start_version": {
+          "description": "The start version associated with the object.\nThis allows data providers to control the lowest object version that is accessible by clients.\nIf specified, clients can query snapshots or changes for versions \u003e= start_version.\nIf not specified, clients can only query starting from the version of the object at the time\nit was added to the share.\n\nNOTE: The start_version should be \u003c= the `current` version of the object.",
+          "launch_stage": "GA"
+        },
+        "status": {
+          "description": "One of: **ACTIVE**, **PERMISSION_DENIED**.",
+          "ref": "sharing.SharedDataObjectStatus",
+          "launch_stage": "GA"
+        },
+        "string_shared_as": {
+          "description": "A user-provided alias name for non-table data objects within the share.\n\nUse this field for non-table objects (for example: VOLUME, MODEL, NOTEBOOK_FILE, FUNCTION).\nFor table-like objects (for example: TABLE, VIEW, MATERIALIZED_VIEW, STREAMING_TABLE, FOREIGN_TABLE), use `shared_as` instead.\n\nImportant: For table-like objects, this field must be omitted entirely.\n\nFormat:\n- For VOLUME: Must be a 2-part name `\u003cschema_name\u003e.\u003cvolume_name\u003e` (e.g., \"data_schema.ml_models\")\n- For FUNCTION: Must be a 2-part name `\u003cschema_name\u003e.\u003cfunction_name\u003e` (e.g., \"udf_schema.calculate_tax\")\n- For MODEL: Must be a 2-part name `\u003cschema_name\u003e.\u003cmodel_name\u003e` (e.g., \"models.prediction_model\")\n- For NOTEBOOK_FILE: Should be the notebook file name (e.g., \"analysis_notebook.py\")\n- All names must contain only alphanumeric characters and underscores\n- No periods, spaces, forward slashes, or control characters are allowed within each part\n\nBehavior:\n- If not provided, the service automatically generates the alias from the object's original name\n- If you don't want to specify this field, omit it entirely from the request (do not pass an empty string)\n- The `string_shared_as` name must be unique for objects of the same type within the share\n\nExamples:\n- Valid for VOLUME: \"data_schema.training_data\"\n- Valid for FUNCTION: \"analytics.calculate_revenue\"\n- Invalid: \"catalog.data_schema.training_data\" (3 parts not allowed for volumes)\n- Invalid: \"data-schema.training-data\" (hyphens not allowed)",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.SharedDataObjectDataObjectType": {
+      "enum": [
+        "TABLE",
+        "FOREIGN_TABLE",
+        "SCHEMA",
+        "VIEW",
+        "MATERIALIZED_VIEW",
+        "STREAMING_TABLE",
+        "MODEL",
+        "NOTEBOOK_FILE",
+        "FUNCTION",
+        "FEATURE_SPEC",
+        "VOLUME"
+      ],
+      "enum_launch_stages": {
+        "FEATURE_SPEC": "GA",
+        "FOREIGN_TABLE": "GA",
+        "FUNCTION": "GA",
+        "MATERIALIZED_VIEW": "GA",
+        "MODEL": "GA",
+        "NOTEBOOK_FILE": "GA",
+        "SCHEMA": "GA",
+        "STREAMING_TABLE": "GA",
+        "TABLE": "GA",
+        "VIEW": "GA",
+        "VOLUME": "GA"
+      }
+    },
+    "sharing.SharedDataObjectHistoryDataSharingStatus": {
+      "enum": [
+        "DISABLED",
+        "ENABLED"
+      ],
+      "enum_launch_stages": {
+        "DISABLED": "GA",
+        "ENABLED": "GA"
+      }
+    },
+    "sharing.SharedDataObjectStatus": {
+      "enum": [
+        "ACTIVE",
+        "PERMISSION_DENIED"
+      ],
+      "enum_launch_stages": {
+        "ACTIVE": "GA",
+        "PERMISSION_DENIED": "GA"
+      }
+    },
+    "sharing.SharedDataObjectUpdate": {
+      "fields": {
+        "action": {
+          "description": "One of: **ADD**, **REMOVE**, **UPDATE**.",
+          "ref": "sharing.SharedDataObjectUpdateAction",
+          "launch_stage": "GA"
+        },
+        "data_object": {
+          "description": "The data object that is being added, removed, or updated. The maximum number update data objects allowed is a 100.",
+          "ref": "sharing.SharedDataObject",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.SharedDataObjectUpdateAction": {
+      "enum": [
+        "ADD",
+        "REMOVE",
+        "UPDATE"
+      ],
+      "enum_launch_stages": {
+        "ADD": "GA",
+        "REMOVE": "GA",
+        "UPDATE": "GA"
+      }
+    },
+    "sharing.SharedSecurableKind": {
+      "description": "The SecurableKind of a delta-shared object.",
+      "enum": [
+        "FUNCTION_STANDARD",
+        "FUNCTION_REGISTERED_MODEL",
+        "FUNCTION_FEATURE_SPEC"
+      ],
+      "enum_launch_stages": {
+        "FUNCTION_FEATURE_SPEC": "GA",
+        "FUNCTION_REGISTERED_MODEL": "GA",
+        "FUNCTION_STANDARD": "GA"
+      }
+    },
+    "sharing.SharesListRequest": {
+      "fields": {
+        "max_results": {
+          "description": "Maximum number of shares to return.\n- when set to 0, the page length is set to a server configured value (recommended);\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- when set to a value less than 0, an invalid parameter error is returned;\n- If not set, all valid shares are returned (not recommended).\n- Note: The number of returned shares might be less than the specified max_results size, even zero.\nThe only definitive indication that no further shares can be fetched is when the next_page_token is unset from the response.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Opaque pagination token to go to next page based on previous query.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.Table": {
+      "fields": {
+        "comment": {
+          "description": "The comment of the table.",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "The id of the table.",
+          "launch_stage": "GA"
+        },
+        "materialization_namespace": {
+          "description": "The catalog and schema of the materialized table",
+          "launch_stage": "GA"
+        },
+        "materialized_table_name": {
+          "description": "The name of a materialized table.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The name of the table.",
+          "launch_stage": "GA"
+        },
+        "schema": {
+          "description": "The name of the schema that the table belongs to.",
+          "launch_stage": "GA"
+        },
+        "share": {
+          "description": "The name of the share that the table belongs to.",
+          "launch_stage": "GA"
+        },
+        "share_id": {
+          "description": "The id of the share that the table belongs to.",
+          "launch_stage": "GA"
+        },
+        "tags": {
+          "description": "The Tags of the table.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.UpdateProvider": {
+      "fields": {
+        "comment": {
+          "description": "Description about the provider.",
+          "launch_stage": "GA"
+        },
+        "new_name": {
+          "description": "New name for the provider.",
+          "launch_stage": "GA"
+        },
+        "owner": {
+          "description": "Username of Provider owner.",
+          "launch_stage": "GA"
+        },
+        "recipient_profile_str": {
+          "description": "This field is required when the __authentication_type__ is **TOKEN**, **OAUTH_CLIENT_CREDENTIALS** or not provided.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.UpdateRecipient": {
+      "fields": {
+        "comment": {
+          "description": "Description about the recipient.",
+          "launch_stage": "GA"
+        },
+        "expiration_time": {
+          "description": "Expiration timestamp of the token, in epoch milliseconds.",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "[Create,Update:IGN] common - id of the recipient",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "ip_access_list": {
+          "description": "IP Access List",
+          "ref": "sharing.IpAccessList",
+          "launch_stage": "GA"
+        },
+        "new_name": {
+          "description": "New name for the recipient.\n.",
+          "launch_stage": "GA"
+        },
+        "owner": {
+          "description": "Username of the recipient owner.",
+          "launch_stage": "GA"
+        },
+        "properties_kvpairs": {
+          "description": "Recipient properties as map of string key-value pairs.\nWhen provided in update request, the specified properties will override the existing\nproperties. To add and remove properties, one would need to perform a read-modify-write.",
+          "ref": "sharing.SecurablePropertiesKvPairs",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.UpdateShare": {
+      "fields": {
+        "comment": {
+          "description": "User-provided free-form text description.",
+          "launch_stage": "GA"
+        },
+        "new_name": {
+          "description": "New name for the share.",
+          "launch_stage": "GA"
+        },
+        "owner": {
+          "description": "Username of current owner of share.",
+          "launch_stage": "GA"
+        },
+        "storage_root": {
+          "description": "Storage root URL for the share.",
+          "launch_stage": "GA"
+        },
+        "updates": {
+          "description": "Array of shared data object updates.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.UpdateSharePermissions": {
+      "fields": {
+        "changes": {
+          "description": "Array of permissions change objects.",
+          "launch_stage": "GA"
+        },
+        "omit_permissions_list": {
+          "description": "Optional. Whether to return the latest permissions list of the share in the response.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.UpdateSharePermissionsResponse": {
+      "fields": {
+        "privilege_assignments": {
+          "description": "The privileges assigned to each principal",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sharing.Volume": {
+      "fields": {
+        "comment": {
+          "description": "The comment of the volume.",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "This id maps to the shared_volume_id in database\nRecipient needs shared_volume_id for recon\nto check if this volume is already in recipient's DB or not.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The name of the volume.",
+          "launch_stage": "GA"
+        },
+        "schema": {
+          "description": "The name of the schema that the volume belongs to.",
+          "launch_stage": "GA"
+        },
+        "share": {
+          "description": "The name of the share that the volume belongs to.",
+          "launch_stage": "GA"
+        },
+        "share_id": {
+          "description": "/ The id of the share that the volume belongs to.",
+          "launch_stage": "GA"
+        },
+        "tags": {
+          "description": "The tags of the volume.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.AccessControl": {
+      "fields": {
+        "group_name": {
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "description": "* `CAN_VIEW`: Can view the query\n* `CAN_RUN`: Can run the query\n* `CAN_EDIT`: Can edit the query\n* `CAN_MANAGE`: Can manage the query",
+          "ref": "sql.PermissionLevel",
+          "launch_stage": "GA"
+        },
+        "user_name": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.Aggregation": {
+      "enum": [
+        "SUM",
+        "COUNT",
+        "COUNT_DISTINCT",
+        "AVG",
+        "MEDIAN",
+        "MIN",
+        "MAX",
+        "STDDEV"
+      ],
+      "enum_launch_stages": {
+        "AVG": "GA",
+        "COUNT": "GA",
+        "COUNT_DISTINCT": "GA",
+        "MAX": "GA",
+        "MEDIAN": "GA",
+        "MIN": "GA",
+        "STDDEV": "GA",
+        "SUM": "GA"
+      }
+    },
+    "sql.Alert": {
+      "fields": {
+        "condition": {
+          "description": "Trigger conditions of the alert.",
+          "ref": "sql.AlertCondition",
+          "launch_stage": "GA"
+        },
+        "create_time": {
+          "description": "The timestamp indicating when the alert was created.",
+          "launch_stage": "GA"
+        },
+        "custom_body": {
+          "description": "Custom body of alert notification, if it exists. See [here](https://docs.databricks.com/sql/user/alerts/index.html) for custom templating instructions.",
+          "launch_stage": "GA"
+        },
+        "custom_subject": {
+          "description": "Custom subject of alert notification, if it exists. This can include email subject entries and Slack notification headers, for example. See [here](https://docs.databricks.com/sql/user/alerts/index.html) for custom templating instructions.",
+          "launch_stage": "GA"
+        },
+        "display_name": {
+          "description": "The display name of the alert.",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "UUID identifying the alert.",
+          "launch_stage": "GA"
+        },
+        "lifecycle_state": {
+          "description": "The workspace state of the alert. Used for tracking trashed status.",
+          "ref": "sql.LifecycleState",
+          "launch_stage": "GA"
+        },
+        "notify_on_ok": {
+          "description": "Whether to notify alert subscribers when alert returns back to normal.",
+          "launch_stage": "GA"
+        },
+        "owner_user_name": {
+          "description": "The owner's username. This field is set to \"Unavailable\" if the user has been deleted.",
+          "launch_stage": "GA"
+        },
+        "parent_path": {
+          "description": "The workspace path of the folder containing the alert.",
+          "launch_stage": "GA"
+        },
+        "query_id": {
+          "description": "UUID of the query attached to the alert.",
+          "launch_stage": "GA"
+        },
+        "seconds_to_retrigger": {
+          "description": "Number of seconds an alert must wait after being triggered to rearm itself. After rearming, it can be triggered again. If 0 or not specified, the alert will not be triggered again.",
+          "launch_stage": "GA"
+        },
+        "state": {
+          "description": "Current state of the alert's trigger status. This field is set to UNKNOWN if the alert has not yet been evaluated or ran into an error during the last evaluation.",
+          "ref": "sql.AlertState",
+          "launch_stage": "GA"
+        },
+        "trigger_time": {
+          "description": "Timestamp when the alert was last triggered, if the alert has been triggered before.",
+          "launch_stage": "GA"
+        },
+        "update_time": {
+          "description": "The timestamp indicating when the alert was updated.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.AlertCondition": {
+      "fields": {
+        "empty_result_state": {
+          "description": "Alert state if result is empty.",
+          "ref": "sql.AlertState",
+          "launch_stage": "GA"
+        },
+        "op": {
+          "description": "Operator used for comparison in alert evaluation.",
+          "ref": "sql.AlertOperator",
+          "launch_stage": "GA"
+        },
+        "operand": {
+          "description": "Name of the column from the query result to use for comparison in alert evaluation.",
+          "ref": "sql.AlertConditionOperand",
+          "launch_stage": "GA"
+        },
+        "threshold": {
+          "description": "Threshold value used for comparison in alert evaluation.",
+          "ref": "sql.AlertConditionThreshold",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.AlertConditionOperand": {
+      "fields": {
+        "column": {
+          "ref": "sql.AlertOperandColumn",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.AlertConditionThreshold": {
+      "fields": {
+        "value": {
+          "ref": "sql.AlertOperandValue",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.AlertEvaluationState": {
+      "description": "UNSPECIFIED - default unspecify value for proto enum, do not use it in the code\nUNKNOWN - alert not yet evaluated\nTRIGGERED - alert is triggered\nOK - alert is not triggered\nERROR - alert evaluation failed",
+      "enum": [
+        "UNKNOWN",
+        "TRIGGERED",
+        "OK",
+        "ERROR"
+      ],
+      "enum_launch_stages": {
+        "ERROR": "GA",
+        "OK": "GA",
+        "TRIGGERED": "GA",
+        "UNKNOWN": "GA"
+      }
+    },
+    "sql.AlertLifecycleState": {
+      "enum": [
+        "ACTIVE",
+        "DELETED"
+      ],
+      "enum_launch_stages": {
+        "ACTIVE": "GA",
+        "DELETED": "GA"
+      }
+    },
+    "sql.AlertOperandColumn": {
+      "fields": {
+        "name": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.AlertOperandValue": {
+      "fields": {
+        "bool_value": {
+          "launch_stage": "GA"
+        },
+        "double_value": {
+          "launch_stage": "GA"
+        },
+        "string_value": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.AlertOperator": {
+      "enum": [
+        "GREATER_THAN",
+        "GREATER_THAN_OR_EQUAL",
+        "LESS_THAN",
+        "LESS_THAN_OR_EQUAL",
+        "EQUAL",
+        "NOT_EQUAL",
+        "IS_NULL"
+      ],
+      "enum_launch_stages": {
+        "EQUAL": "GA",
+        "GREATER_THAN": "GA",
+        "GREATER_THAN_OR_EQUAL": "GA",
+        "IS_NULL": "GA",
+        "LESS_THAN": "GA",
+        "LESS_THAN_OR_EQUAL": "GA",
+        "NOT_EQUAL": "GA"
+      }
+    },
+    "sql.AlertOptions": {
+      "description": "Alert configuration options.",
+      "fields": {
+        "column": {
+          "description": "Name of column in the query result to compare in alert evaluation.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "custom_body": {
+          "description": "Custom body of alert notification, if it exists. See [here](https://docs.databricks.com/sql/user/alerts/index.html) for custom templating instructions.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "custom_subject": {
+          "description": "Custom subject of alert notification, if it exists. This includes email subject, Slack notification header, etc. See [here](https://docs.databricks.com/sql/user/alerts/index.html) for custom templating instructions.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "empty_result_state": {
+          "description": "State that alert evaluates to when query result is empty.",
+          "ref": "sql.AlertOptionsEmptyResultState",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "muted": {
+          "description": "Whether or not the alert is muted. If an alert is muted, it will not notify users and notification destinations when triggered.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "op": {
+          "description": "Operator used to compare in alert evaluation: `\u003e`, `\u003e=`, `\u003c`, `\u003c=`, `==`, `!=`",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "value": {
+          "description": "Value used to compare in alert evaluation. Supported types include strings (eg. 'foobar'), floats (eg. 123.4), and booleans (true).",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "sql.AlertOptionsEmptyResultState": {
+      "description": "State that alert evaluates to when query result is empty.",
+      "enum": [
+        "ok",
+        "triggered",
+        "unknown"
+      ],
+      "enum_launch_stages": {
+        "ok": "PUBLIC_PREVIEW",
+        "triggered": "PUBLIC_PREVIEW",
+        "unknown": "PUBLIC_PREVIEW"
+      }
+    },
+    "sql.AlertQuery": {
+      "fields": {
+        "created_at": {
+          "description": "The timestamp when this query was created.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "data_source_id": {
+          "description": "Data source ID maps to the ID of the data source used by the resource and is distinct from the warehouse ID. [Learn more](https://docs.databricks.com/api/workspace/datasources/list)",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "description": {
+          "description": "General description that conveys additional information about this query such as usage notes.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "id": {
+          "description": "Query ID.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "is_archived": {
+          "description": "Indicates whether the query is trashed. Trashed queries can't be used in dashboards, or appear in search results. If this boolean is `true`, the `options` property for this query includes a `moved_to_trash_at` timestamp. Trashed queries are permanently deleted after 30 days.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "is_draft": {
+          "description": "Whether the query is a draft. Draft queries only appear in list views for their owners. Visualizations from draft queries cannot appear on dashboards.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "is_safe": {
+          "description": "Text parameter types are not safe from SQL injection for all types of data source. Set this Boolean parameter to `true` if a query either does not use any text type parameters or uses a data source type where text type parameters are handled safely.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "name": {
+          "description": "The title of this query that appears in list views, widget headings, and on the query page.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "options": {
+          "ref": "sql.QueryOptions",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "query": {
+          "description": "The text of the query to be run.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "tags": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "updated_at": {
+          "description": "The timestamp at which this query was last updated.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "user_id": {
+          "description": "The ID of the user who owns the query.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "sql.AlertState": {
+      "enum": [
+        "UNKNOWN",
+        "OK",
+        "TRIGGERED"
+      ],
+      "enum_launch_stages": {
+        "OK": "GA",
+        "TRIGGERED": "GA",
+        "UNKNOWN": "GA"
+      }
+    },
+    "sql.AlertStatementParameter": {
+      "description": "A named parameter bound to the alert query. Only flat, named scalar parameters are\nsupported; complex types such as ARRAY, MAP, and STRUCT are not.",
+      "fields": {
+        "name": {
+          "description": "The name of the parameter. Reference it in the query text as `:name`. Required, must be\nnon-empty, and must be unique across the alert's parameters.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "type": {
+          "description": "The SQL data type of the parameter, for example `STRING`, `INT`, or `DECIMAL(10, 2)`. If no type is given\nthe type is assumed to be `STRING`. Complex types such as `ARRAY`, `MAP`, and `STRUCT` are not supported.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "value": {
+          "description": "The value bound to the parameter, represented as a string. If omitted, the value is interpreted as NULL.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "sql.AlertV2": {
+      "fields": {
+        "create_time": {
+          "description": "The timestamp indicating when the alert was created.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "custom_description": {
+          "description": "Custom description for the alert. support mustache template.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "custom_summary": {
+          "description": "Custom summary for the alert. support mustache template.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "custom_template_format": {
+          "description": "The format used to interpret the `custom_summary` and `custom_description` templates.\n\n`HTML` treats both templates as HTML with Mustache `{{VARIABLE_NAME}}` placeholders.\n`MARKDOWN` treats them as Markdown with allowlisted `@VARIABLE_NAME` placeholders and converts\nthem to the format each notification destination expects, so a single template renders\ncorrectly in email, Slack, and Microsoft Teams.\n\nWhen unset, the API applies no default. Responses omit the field unless a format is stored,\nand a template with no format is rendered as HTML.",
+          "ref": "sql.CustomTemplateFormat",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "display_name": {
+          "description": "The display name of the alert.",
+          "launch_stage": "GA"
+        },
+        "effective_run_as": {
+          "description": "The actual identity that will be used to execute the alert.\nThis is an output-only field that shows the resolved run-as identity after applying\npermissions and defaults.",
+          "ref": "sql.AlertV2RunAs",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "evaluation": {
+          "ref": "sql.AlertV2Evaluation",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "The canonical identifier of the alert to retrieve information about.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "lifecycle_state": {
+          "description": "Indicates whether the query is trashed.",
+          "ref": "sql.AlertLifecycleState",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "owner_user_name": {
+          "description": "The owner's username. This field is set to \"Unavailable\" if the user has been deleted.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "parameters": {
+          "description": "A list of parameters to pass into the alert SQL query statement containing parameter markers. Static values only.\n\nReference a parameter in the query text as `:name`. Each parameter must have a unique, non-empty name.\nEach parameter consists of a name, a value, and optionally a type. To represent a NULL\nvalue, the `value` field may be omitted or set to `null` explicitly. If the `type` field\nis omitted, the value is interpreted as a string.\n\nIf the type is given, parameters will be checked for type correctness according\nto the given type. A value is correct if the provided string can be converted to\nthe requested type using the `cast` function. The exact semantics are described in\nthe section [`cast` function](https://docs.databricks.com/sql/language-manual/functions/cast.html) of the SQL language reference.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL",
+            "UNORDERED_LIST"
+          ]
+        },
+        "parent_path": {
+          "description": "The workspace path of the folder containing the alert. Can only be set on create, and cannot be updated.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "query_text": {
+          "description": "Text of the query to be run.",
+          "launch_stage": "GA"
+        },
+        "run_as": {
+          "description": "Specifies the identity that will be used to run the alert.\nThis field allows you to configure alerts to run as a specific user or service principal.\n- For user identity: Set `user_name` to the email of an active workspace user. Users can only set this to their own email.\n- For service principal: Set `service_principal_name` to the application ID. Requires the `servicePrincipal/user` role.\nIf not specified, the alert will run as the request user.",
+          "ref": "sql.AlertV2RunAs",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "run_as_user_name": {
+          "description": "The run as username or application ID of service principal.\nOn Create and Update, this field can be set to application ID of an active service principal. Setting this field requires the servicePrincipal/user role.\nDeprecated: Use `run_as` field instead. This field will be removed in a future release.",
+          "deprecated": true,
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "schedule": {
+          "ref": "sql.CronSchedule",
+          "launch_stage": "GA"
+        },
+        "update_time": {
+          "description": "The timestamp indicating when the alert was updated.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "warehouse_id": {
+          "description": "ID of the SQL warehouse attached to the alert.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.AlertV2Evaluation": {
+      "fields": {
+        "comparison_operator": {
+          "description": "Operator used for comparison in alert evaluation.",
+          "ref": "sql.ComparisonOperator",
+          "launch_stage": "GA"
+        },
+        "empty_result_state": {
+          "description": "Alert state if result is empty. Please avoid setting this field to be `UNKNOWN` because `UNKNOWN` state is planned to be deprecated.",
+          "ref": "sql.AlertEvaluationState",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "last_evaluated_at": {
+          "description": "Timestamp of the last evaluation.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "notification": {
+          "description": "User or Notification Destination to notify when alert is triggered.",
+          "ref": "sql.AlertV2Notification",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "source": {
+          "description": "Source column from result to use to evaluate alert",
+          "ref": "sql.AlertV2OperandColumn",
+          "launch_stage": "GA"
+        },
+        "state": {
+          "description": "Latest state of alert evaluation.",
+          "ref": "sql.AlertEvaluationState",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "threshold": {
+          "description": "Threshold to user for alert evaluation, can be a column or a value.",
+          "ref": "sql.AlertV2Operand",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "sql.AlertV2Notification": {
+      "fields": {
+        "notify_on_ok": {
+          "description": "Whether to notify alert subscribers when alert returns back to normal.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "retrigger_seconds": {
+          "description": "Number of seconds an alert waits after being triggered before it is allowed to send another notification.\nIf set to 0 or omitted, the alert will not send any further notifications after the first trigger\nSetting this value to 1 allows the alert to send a notification on every evaluation where the condition is met, effectively making it always retrigger for notification purposes.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "subscriptions": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL",
+            "UNORDERED_LIST"
+          ]
+        }
+      }
+    },
+    "sql.AlertV2Operand": {
+      "fields": {
+        "column": {
+          "ref": "sql.AlertV2OperandColumn",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "value": {
+          "ref": "sql.AlertV2OperandValue",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "sql.AlertV2OperandColumn": {
+      "fields": {
+        "aggregation": {
+          "description": "If not set, the behavior is equivalent to using `First row` in the UI.",
+          "ref": "sql.Aggregation",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "display": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "name": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.AlertV2OperandValue": {
+      "fields": {
+        "bool_value": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "double_value": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "string_value": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "sql.AlertV2RunAs": {
+      "fields": {
+        "service_principal_name": {
+          "description": "Application ID of an active service principal. Setting this field requires the `servicePrincipal/user` role.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "user_name": {
+          "description": "The email of an active workspace user. Can only set this field to their own email.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "sql.AlertV2Subscription": {
+      "fields": {
+        "destination_id": {
+          "launch_stage": "GA"
+        },
+        "user_email": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.BaseChunkInfo": {
+      "fields": {
+        "byte_count": {
+          "description": "The number of bytes in the result chunk. This field is not available when using `INLINE`\ndisposition.",
+          "launch_stage": "GA"
+        },
+        "chunk_index": {
+          "description": "The position within the sequence of result set chunks.",
+          "launch_stage": "GA"
+        },
+        "row_count": {
+          "description": "The number of rows within the result chunk.",
+          "launch_stage": "GA"
+        },
+        "row_offset": {
+          "description": "The starting row offset within the result set.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.CancelExecutionRequest": {},
+    "sql.Channel": {
+      "description": "Configures the channel name and DBSQL version of the warehouse. CHANNEL_NAME_CUSTOM should be chosen only when `dbsql_version` is specified.",
+      "fields": {
+        "dbsql_version": {
+          "launch_stage": "GA"
+        },
+        "name": {
+          "ref": "sql.ChannelName",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.ChannelInfo": {
+      "description": "Details about a Channel.",
+      "fields": {
+        "dbsql_version": {
+          "description": "DB SQL Version the Channel is mapped to.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of the channel",
+          "ref": "sql.ChannelName",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.ChannelName": {
+      "enum": [
+        "CHANNEL_NAME_PREVIEW",
+        "CHANNEL_NAME_CURRENT",
+        "CHANNEL_NAME_PREVIOUS",
+        "CHANNEL_NAME_CUSTOM"
+      ],
+      "enum_launch_stages": {
+        "CHANNEL_NAME_CURRENT": "GA",
+        "CHANNEL_NAME_CUSTOM": "GA",
+        "CHANNEL_NAME_PREVIEW": "GA",
+        "CHANNEL_NAME_PREVIOUS": "GA"
+      }
+    },
+    "sql.ClientConfig": {
+      "fields": {
+        "allow_custom_js_visualizations": {
+          "description": "allow_custom_js_visualizations is not supported/implemneted.",
+          "deprecated": true,
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "allow_downloads": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "allow_external_shares": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "allow_subscriptions": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "date_format": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "date_time_format": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "disable_publish": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "enable_legacy_autodetect_types": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "feature_show_permissions_control": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "hide_plotly_mode_bar": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "sql.ColumnInfo": {
+      "fields": {
+        "name": {
+          "description": "The name of the column.",
+          "launch_stage": "GA"
+        },
+        "position": {
+          "description": "The ordinal position of the column (starting at position 0).",
+          "launch_stage": "GA"
+        },
+        "type_interval_type": {
+          "description": "The format of the interval type.",
+          "launch_stage": "GA"
+        },
+        "type_name": {
+          "description": "The name of the base data type. This doesn't include details for complex types such as STRUCT, MAP or ARRAY.",
+          "ref": "sql.ColumnInfoTypeName",
+          "launch_stage": "GA"
+        },
+        "type_precision": {
+          "description": "Specifies the number of digits in a number. This applies to the DECIMAL type.",
+          "launch_stage": "GA"
+        },
+        "type_scale": {
+          "description": "Specifies the number of digits to the right of the decimal point in a number. This applies to the DECIMAL type.",
+          "launch_stage": "GA"
+        },
+        "type_text": {
+          "description": "The full SQL type specification.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.ColumnInfoTypeName": {
+      "description": "The name of the base data type. This doesn't include details for complex types such as STRUCT, MAP or ARRAY.",
+      "enum": [
+        "BOOLEAN",
+        "BYTE",
+        "SHORT",
+        "INT",
+        "LONG",
+        "FLOAT",
+        "DOUBLE",
+        "DATE",
+        "TIMESTAMP",
+        "STRING",
+        "BINARY",
+        "DECIMAL",
+        "INTERVAL",
+        "ARRAY",
+        "STRUCT",
+        "MAP",
+        "CHAR",
+        "NULL",
+        "USER_DEFINED_TYPE"
+      ],
+      "enum_launch_stages": {
+        "ARRAY": "GA",
+        "BINARY": "GA",
+        "BOOLEAN": "GA",
+        "BYTE": "GA",
+        "CHAR": "GA",
+        "DATE": "GA",
+        "DECIMAL": "GA",
+        "DOUBLE": "GA",
+        "FLOAT": "GA",
+        "INT": "GA",
+        "INTERVAL": "GA",
+        "LONG": "GA",
+        "MAP": "GA",
+        "NULL": "GA",
+        "SHORT": "GA",
+        "STRING": "GA",
+        "STRUCT": "GA",
+        "TIMESTAMP": "GA",
+        "USER_DEFINED_TYPE": "GA"
+      }
+    },
+    "sql.ComparisonOperator": {
+      "enum": [
+        "LESS_THAN",
+        "GREATER_THAN",
+        "EQUAL",
+        "NOT_EQUAL",
+        "GREATER_THAN_OR_EQUAL",
+        "LESS_THAN_OR_EQUAL",
+        "IS_NULL",
+        "IS_NOT_NULL"
+      ],
+      "enum_launch_stages": {
+        "EQUAL": "GA",
+        "GREATER_THAN": "GA",
+        "GREATER_THAN_OR_EQUAL": "GA",
+        "IS_NOT_NULL": "GA",
+        "IS_NULL": "GA",
+        "LESS_THAN": "GA",
+        "LESS_THAN_OR_EQUAL": "GA",
+        "NOT_EQUAL": "GA"
+      }
+    },
+    "sql.CreateAlert": {
+      "fields": {
+        "name": {
+          "description": "Name of the alert.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "options": {
+          "description": "Alert configuration options.",
+          "ref": "sql.AlertOptions",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "parent": {
+          "description": "The identifier of the workspace folder containing the object.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "query_id": {
+          "description": "Query ID.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "rearm": {
+          "description": "Number of seconds after being triggered before the alert rearms itself and can be triggered again. If `null`, alert will never be triggered again.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "sql.CreateAlertRequest": {
+      "fields": {
+        "alert": {
+          "ref": "sql.CreateAlertRequestAlert",
+          "launch_stage": "GA"
+        },
+        "auto_resolve_display_name": {
+          "description": "If true, automatically resolve alert display name conflicts. Otherwise, fail the request if the alert's display name conflicts with an existing alert's display name.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.CreateAlertRequestAlert": {
+      "fields": {
+        "condition": {
+          "description": "Trigger conditions of the alert.",
+          "ref": "sql.AlertCondition",
+          "launch_stage": "GA"
+        },
+        "custom_body": {
+          "description": "Custom body of alert notification, if it exists. See [here](https://docs.databricks.com/sql/user/alerts/index.html) for custom templating instructions.",
+          "launch_stage": "GA"
+        },
+        "custom_subject": {
+          "description": "Custom subject of alert notification, if it exists. This can include email subject entries and Slack notification headers, for example. See [here](https://docs.databricks.com/sql/user/alerts/index.html) for custom templating instructions.",
+          "launch_stage": "GA"
+        },
+        "display_name": {
+          "description": "The display name of the alert.",
+          "launch_stage": "GA"
+        },
+        "notify_on_ok": {
+          "description": "Whether to notify alert subscribers when alert returns back to normal.",
+          "launch_stage": "GA"
+        },
+        "parent_path": {
+          "description": "The workspace path of the folder containing the alert.",
+          "launch_stage": "GA"
+        },
+        "query_id": {
+          "description": "UUID of the query attached to the alert.",
+          "launch_stage": "GA"
+        },
+        "seconds_to_retrigger": {
+          "description": "Number of seconds an alert must wait after being triggered to rearm itself. After rearming, it can be triggered again. If 0 or not specified, the alert will not be triggered again.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.CreateAlertV2Request": {
+      "fields": {
+        "alert": {
+          "ref": "sql.AlertV2",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.CreateDefaultWarehouseOverrideRequest": {
+      "fields": {
+        "default_warehouse_override": {
+          "description": "Required. The default warehouse override to create.",
+          "ref": "sql.DefaultWarehouseOverride",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "default_warehouse_override_id": {
+          "description": "Required. The ID to use for the override, which will become the final component\nof the override's resource name.\nCan be a numeric user ID or the literal string \"me\" for the current user.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "sql.CreateQueryRequest": {
+      "fields": {
+        "auto_resolve_display_name": {
+          "description": "If true, automatically resolve query display name conflicts. Otherwise, fail the request if the query's display name conflicts with an existing query's display name.",
+          "launch_stage": "GA"
+        },
+        "query": {
+          "ref": "sql.CreateQueryRequestQuery",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.CreateQueryRequestQuery": {
+      "fields": {
+        "apply_auto_limit": {
+          "description": "Whether to apply a 1000 row limit to the query result.",
+          "launch_stage": "GA"
+        },
+        "catalog": {
+          "description": "Name of the catalog where this query will be executed.",
+          "launch_stage": "GA"
+        },
+        "description": {
+          "description": "General description that conveys additional information about this query such as usage notes.",
+          "launch_stage": "GA"
+        },
+        "display_name": {
+          "description": "Display name of the query that appears in list views, widget headings, and on the query page.",
+          "launch_stage": "GA"
+        },
+        "parameters": {
+          "description": "List of query parameter definitions.",
+          "launch_stage": "GA"
+        },
+        "parent_path": {
+          "description": "Workspace path of the workspace folder containing the object.",
+          "launch_stage": "GA"
+        },
+        "query_text": {
+          "description": "Text of the query to be run.",
+          "launch_stage": "GA"
+        },
+        "run_as_mode": {
+          "description": "Sets the \"Run as\" role for the object.",
+          "ref": "sql.RunAsMode",
+          "launch_stage": "GA"
+        },
+        "schema": {
+          "description": "Name of the schema where this query will be executed.",
+          "launch_stage": "GA"
+        },
+        "tags": {
+          "launch_stage": "GA"
+        },
+        "warehouse_id": {
+          "description": "ID of the SQL warehouse attached to the query.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.CreateQueryVisualizationsLegacyRequest": {
+      "description": "Add visualization to a query",
+      "fields": {
+        "description": {
+          "description": "A short description of this visualization. This is not displayed in the UI.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "name": {
+          "description": "The name of the visualization that appears on dashboards and the query screen.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "options": {
+          "description": "The options object varies widely from one visualization type to the next and is unsupported. Databricks does not recommend modifying visualization settings in JSON.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "query_id": {
+          "description": "The identifier returned by :method:queries/create",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "type": {
+          "description": "The type of visualization: chart, table, pivot table, and so on.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "sql.CreateVisualizationRequest": {
+      "fields": {
+        "visualization": {
+          "ref": "sql.CreateVisualizationRequestVisualization",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "sql.CreateVisualizationRequestVisualization": {
+      "fields": {
+        "display_name": {
+          "description": "The display name of the visualization.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "query_id": {
+          "description": "UUID of the query that the visualization is attached to.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "serialized_options": {
+          "description": "The visualization options varies widely from one visualization type to the next and is unsupported. Databricks does not recommend modifying visualization options directly.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "serialized_query_plan": {
+          "description": "The visualization query plan varies widely from one visualization type to the next and is unsupported. Databricks does not recommend modifying the visualization query plan directly.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "type": {
+          "description": "The type of visualization: counter, table, funnel, and so on.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "sql.CreateWarehouseRequest": {
+      "description": "Creates a new SQL warehouse.",
+      "fields": {
+        "auto_stop_mins": {
+          "description": "The amount of time in minutes that a SQL warehouse must be idle (i.e., no\nRUNNING queries) before it is automatically stopped.\n\nSupported values:\n- Must be == 0 or \u003e= 10 mins\n- 0 indicates no autostop.\n\nDefaults to 120 mins",
+          "launch_stage": "GA"
+        },
+        "channel": {
+          "description": "Channel Details",
+          "ref": "sql.Channel",
+          "launch_stage": "GA"
+        },
+        "cluster_size": {
+          "description": "Size of the clusters allocated for this warehouse.\nIncreasing the size of a spark cluster allows you to run larger queries on\nit. If you want to increase the number of concurrent queries, please tune\nmax_num_clusters.\n\nSupported values:\n- 2X-Small\n- X-Small\n- Small\n- Medium\n- Large\n- X-Large\n- 2X-Large\n- 3X-Large\n- 4X-Large\n- 5X-Large",
+          "launch_stage": "GA"
+        },
+        "creator_name": {
+          "description": "warehouse creator name",
+          "launch_stage": "GA"
+        },
+        "enable_photon": {
+          "description": "Configures whether the warehouse should use Photon optimized clusters.\n\nDefaults to true.",
+          "launch_stage": "GA"
+        },
+        "enable_serverless_compute": {
+          "description": "Configures whether the warehouse should use serverless compute",
+          "launch_stage": "GA"
+        },
+        "instance_profile_arn": {
+          "description": "Deprecated. Instance profile used to pass IAM role to the cluster",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "max_num_clusters": {
+          "description": "Maximum number of clusters that the autoscaler will create to handle\nconcurrent queries.\n\nSupported values:\n- Must be \u003e= min_num_clusters\n- Must be \u003c= 40.\n\nDefaults to min_clusters if unset.",
+          "launch_stage": "GA"
+        },
+        "min_num_clusters": {
+          "description": "Minimum number of available clusters that will be maintained for this SQL\nwarehouse. Increasing this will ensure that a larger number of clusters are\nalways running and therefore may reduce the cold start time for new\nqueries. This is similar to reserved vs. revocable cores in a resource\nmanager.\n\nSupported values:\n- Must be \u003e 0\n- Must be \u003c= min(max_num_clusters, 30)\n\nDefaults to 1",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Logical name for the cluster.\n\nSupported values:\n- Must be unique within an org.\n- Must be less than 100 characters.",
+          "launch_stage": "GA"
+        },
+        "spot_instance_policy": {
+          "description": "Configurations whether the endpoint should use spot instances.",
+          "ref": "sql.SpotInstancePolicy",
+          "launch_stage": "GA"
+        },
+        "statement_timeout": {
+          "description": "Warehouse statement timeout in seconds.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "tags": {
+          "description": "A set of key-value pairs that will be tagged on all resources (e.g., AWS instances and EBS volumes) associated\nwith this SQL warehouse.\n\nSupported values:\n- Number of tags \u003c 45.",
+          "ref": "sql.EndpointTags",
+          "launch_stage": "GA"
+        },
+        "warehouse_type": {
+          "description": "Warehouse type: `PRO` or `CLASSIC`. If you want to use serverless compute,\nyou must set to `PRO` and also set the field `enable_serverless_compute` to `true`.",
+          "ref": "sql.CreateWarehouseRequestWarehouseType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.CreateWarehouseRequestWarehouseType": {
+      "enum": [
+        "TYPE_UNSPECIFIED",
+        "CLASSIC",
+        "PRO",
+        "REALTIME"
+      ],
+      "enum_launch_stages": {
+        "CLASSIC": "GA",
+        "PRO": "GA",
+        "REALTIME": "PRIVATE_PREVIEW",
+        "TYPE_UNSPECIFIED": "GA"
+      }
+    },
+    "sql.CreateWarehouseResponse": {
+      "fields": {
+        "id": {
+          "description": "Id for the SQL warehouse.\nThis value is unique across all SQL warehouses.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.CreateWidget": {
+      "fields": {
+        "dashboard_id": {
+          "description": "Dashboard ID returned by :method:dashboards/create.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "options": {
+          "ref": "sql.WidgetOptions",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "text": {
+          "description": "If this is a textbox widget, the application displays this text. This field is ignored if the widget contains a visualization in the `visualization` field.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "visualization_id": {
+          "description": "Query Visualization ID returned by :method:queryvisualizations/create.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "width": {
+          "description": "Width of a widget",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "sql.CronSchedule": {
+      "fields": {
+        "pause_status": {
+          "description": "Indicate whether this schedule is paused or not.",
+          "ref": "sql.SchedulePauseStatus",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "quartz_cron_schedule": {
+          "description": "A cron expression using quartz syntax that specifies the schedule for this pipeline.\nShould use the quartz format described here: http://www.quartz-scheduler.org/documentation/quartz-2.1.7/tutorials/tutorial-lesson-06.html",
+          "launch_stage": "GA"
+        },
+        "timezone_id": {
+          "description": "A Java timezone id. The schedule will be resolved using this timezone.\nThis will be combined with the quartz_cron_schedule to determine the schedule.\nSee https://docs.databricks.com/sql/language-manual/sql-ref-syntax-aux-conf-mgmt-set-timezone.html for details.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.CustomTemplateFormat": {
+      "description": "Rendering format for the `custom_summary` and `custom_description` templates.",
+      "enum": [
+        "HTML",
+        "MARKDOWN"
+      ],
+      "enum_launch_stages": {
+        "HTML": "PRIVATE_PREVIEW",
+        "MARKDOWN": "PRIVATE_PREVIEW"
+      }
+    },
+    "sql.Dashboard": {
+      "description": "A JSON representing a dashboard containing widgets of visualizations and text boxes.",
+      "fields": {
+        "can_edit": {
+          "description": "Whether the authenticated user can edit the query definition.",
+          "launch_stage": "GA"
+        },
+        "created_at": {
+          "description": "Timestamp when this dashboard was created.",
+          "launch_stage": "GA"
+        },
+        "dashboard_filters_enabled": {
+          "description": "In the web application, query filters that share a name are coupled to a single selection box if this value is `true`.",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "The ID for this dashboard.",
+          "launch_stage": "GA"
+        },
+        "is_archived": {
+          "description": "Indicates whether a dashboard is trashed. Trashed dashboards won't appear in list views.  If this boolean is `true`, the `options` property for this dashboard includes a `moved_to_trash_at` timestamp. Items in trash are permanently deleted after 30 days.",
+          "launch_stage": "GA"
+        },
+        "is_draft": {
+          "description": "Whether a dashboard is a draft. Draft dashboards only appear in list views for their owners.",
+          "launch_stage": "GA"
+        },
+        "is_favorite": {
+          "description": "Indicates whether this query object appears in the current user's favorites list. This flag determines whether the star icon for favorites is selected.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The title of the dashboard that appears in list views and at the top of the dashboard page.",
+          "launch_stage": "GA"
+        },
+        "options": {
+          "ref": "sql.DashboardOptions",
+          "launch_stage": "GA"
+        },
+        "parent": {
+          "description": "The identifier of the workspace folder containing the object.",
+          "launch_stage": "GA"
+        },
+        "permission_tier": {
+          "description": "* `CAN_VIEW`: Can view the query\n* `CAN_RUN`: Can run the query\n* `CAN_EDIT`: Can edit the query\n* `CAN_MANAGE`: Can manage the query",
+          "ref": "sql.PermissionLevel",
+          "launch_stage": "GA"
+        },
+        "slug": {
+          "description": "URL slug. Usually mirrors the query name with dashes (`-`) instead of spaces. Appears in the URL for this query.",
+          "launch_stage": "GA"
+        },
+        "tags": {
+          "launch_stage": "GA"
+        },
+        "updated_at": {
+          "description": "Timestamp when this dashboard was last updated.",
+          "launch_stage": "GA"
+        },
+        "user": {
+          "ref": "sql.User",
+          "launch_stage": "GA"
+        },
+        "user_id": {
+          "description": "The ID of the user who owns the dashboard.",
+          "launch_stage": "GA"
+        },
+        "widgets": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.DashboardEditContent": {
+      "fields": {
+        "name": {
+          "description": "The title of this dashboard that appears in list views and at the top of the dashboard page.",
+          "launch_stage": "GA"
+        },
+        "run_as_role": {
+          "description": "Sets the **Run as** role for the object. Must be set to one of `\"viewer\"` (signifying \"run as viewer\" behavior) or `\"owner\"` (signifying \"run as owner\" behavior)",
+          "ref": "sql.RunAsRole",
+          "launch_stage": "GA"
+        },
+        "tags": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.DashboardOptions": {
+      "fields": {
+        "moved_to_trash_at": {
+          "description": "The timestamp when this dashboard was moved to trash. Only present when the `is_archived` property is `true`. Trashed items are deleted after thirty days.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.DataSource": {
+      "description": "A JSON object representing a DBSQL data source / SQL warehouse.",
+      "fields": {
+        "id": {
+          "description": "Data source ID maps to the ID of the data source used by the resource and is distinct from the warehouse ID. [Learn more](https://docs.databricks.com/api/workspace/datasources/list)",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The string name of this data source / SQL warehouse as it appears in the Databricks SQL web application.",
+          "launch_stage": "GA"
+        },
+        "pause_reason": {
+          "description": "Reserved for internal use.",
+          "launch_stage": "GA"
+        },
+        "paused": {
+          "description": "Reserved for internal use.",
+          "launch_stage": "GA"
+        },
+        "supports_auto_limit": {
+          "description": "Reserved for internal use.",
+          "launch_stage": "GA"
+        },
+        "syntax": {
+          "description": "Reserved for internal use.",
+          "launch_stage": "GA"
+        },
+        "type": {
+          "description": "The type of data source. For SQL warehouses, this will be `databricks_internal`.",
+          "launch_stage": "GA"
+        },
+        "view_only": {
+          "description": "Reserved for internal use.",
+          "launch_stage": "GA"
+        },
+        "warehouse_id": {
+          "description": "The ID of the associated SQL warehouse, if this data source is backed by a SQL warehouse.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.DatePrecision": {
+      "enum": [
+        "DAY_PRECISION",
+        "MINUTE_PRECISION",
+        "SECOND_PRECISION"
+      ],
+      "enum_launch_stages": {
+        "DAY_PRECISION": "GA",
+        "MINUTE_PRECISION": "GA",
+        "SECOND_PRECISION": "GA"
+      }
+    },
+    "sql.DateRange": {
+      "fields": {
+        "end": {
+          "launch_stage": "GA"
+        },
+        "start": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.DateRangeValue": {
+      "fields": {
+        "date_range_value": {
+          "description": "Manually specified date-time range value.",
+          "ref": "sql.DateRange",
+          "launch_stage": "GA"
+        },
+        "dynamic_date_range_value": {
+          "description": "Dynamic date-time range value based on current date-time.",
+          "ref": "sql.DateRangeValueDynamicDateRange",
+          "launch_stage": "GA"
+        },
+        "precision": {
+          "description": "Date-time precision to format the value into when the query is run. Defaults to DAY_PRECISION (YYYY-MM-DD).",
+          "ref": "sql.DatePrecision",
+          "launch_stage": "GA"
+        },
+        "start_day_of_week": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.DateRangeValueDynamicDateRange": {
+      "enum": [
+        "TODAY",
+        "YESTERDAY",
+        "THIS_WEEK",
+        "THIS_MONTH",
+        "THIS_YEAR",
+        "LAST_WEEK",
+        "LAST_MONTH",
+        "LAST_YEAR",
+        "LAST_HOUR",
+        "LAST_8_HOURS",
+        "LAST_24_HOURS",
+        "LAST_7_DAYS",
+        "LAST_14_DAYS",
+        "LAST_30_DAYS",
+        "LAST_60_DAYS",
+        "LAST_90_DAYS",
+        "LAST_12_MONTHS"
+      ],
+      "enum_launch_stages": {
+        "LAST_12_MONTHS": "GA",
+        "LAST_14_DAYS": "GA",
+        "LAST_24_HOURS": "GA",
+        "LAST_30_DAYS": "GA",
+        "LAST_60_DAYS": "GA",
+        "LAST_7_DAYS": "GA",
+        "LAST_8_HOURS": "GA",
+        "LAST_90_DAYS": "GA",
+        "LAST_HOUR": "GA",
+        "LAST_MONTH": "GA",
+        "LAST_WEEK": "GA",
+        "LAST_YEAR": "GA",
+        "THIS_MONTH": "GA",
+        "THIS_WEEK": "GA",
+        "THIS_YEAR": "GA",
+        "TODAY": "GA",
+        "YESTERDAY": "GA"
+      }
+    },
+    "sql.DateValue": {
+      "fields": {
+        "date_value": {
+          "description": "Manually specified date-time value.",
+          "launch_stage": "GA"
+        },
+        "dynamic_date_value": {
+          "description": "Dynamic date-time value based on current date-time.",
+          "ref": "sql.DateValueDynamicDate",
+          "launch_stage": "GA"
+        },
+        "precision": {
+          "description": "Date-time precision to format the value into when the query is run. Defaults to DAY_PRECISION (YYYY-MM-DD).",
+          "ref": "sql.DatePrecision",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.DateValueDynamicDate": {
+      "enum": [
+        "NOW",
+        "YESTERDAY"
+      ],
+      "enum_launch_stages": {
+        "NOW": "GA",
+        "YESTERDAY": "GA"
+      }
+    },
+    "sql.DefaultWarehouseOverride": {
+      "description": "Represents a per-user default warehouse override configuration.\nThis resource allows users or administrators to customize how a user's\ndefault warehouse is selected for SQL operations.\nIf no override exists for a user, the workspace default warehouse will be used.",
+      "fields": {
+        "default_warehouse_override_id": {
+          "description": "The ID component of the resource name (user ID).",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "name": {
+          "description": "The resource name of the default warehouse override.\nFormat: default-warehouse-overrides/{default_warehouse_override_id}",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "type": {
+          "description": "The type of override behavior.",
+          "ref": "sql.DefaultWarehouseOverrideType",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "warehouse_id": {
+          "description": "The specific warehouse ID when type is CUSTOM.\nNot set for LAST_SELECTED type.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "sql.DefaultWarehouseOverrideType": {
+      "description": "Type of default warehouse override behavior.",
+      "enum": [
+        "LAST_SELECTED",
+        "CUSTOM"
+      ],
+      "enum_launch_stages": {
+        "CUSTOM": "PUBLIC_BETA",
+        "LAST_SELECTED": "PUBLIC_BETA"
+      }
+    },
+    "sql.DeleteAlertsLegacyRequest": {},
+    "sql.DeleteDashboardRequest": {},
+    "sql.DeleteDashboardWidgetRequest": {},
+    "sql.DeleteDefaultWarehouseOverrideRequest": {},
+    "sql.DeleteQueriesLegacyRequest": {},
+    "sql.DeleteQueryVisualizationsLegacyRequest": {},
+    "sql.DeleteResponse": {},
+    "sql.DeleteVisualizationRequest": {},
+    "sql.DeleteWarehouseRequest": {},
+    "sql.DeleteWarehouseResponse": {},
+    "sql.Disposition": {
+      "enum": [
+        "INLINE",
+        "EXTERNAL_LINKS"
+      ],
+      "enum_launch_stages": {
+        "EXTERNAL_LINKS": "GA",
+        "INLINE": "GA"
+      }
+    },
+    "sql.EditAlert": {
+      "fields": {
+        "name": {
+          "description": "Name of the alert.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "options": {
+          "description": "Alert configuration options.",
+          "ref": "sql.AlertOptions",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "query_id": {
+          "description": "Query ID.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "rearm": {
+          "description": "Number of seconds after being triggered before the alert rearms itself and can be triggered again. If `null`, alert will never be triggered again.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "sql.EditWarehouseRequest": {
+      "description": "This is an incremental edit functionality, so all fields except id are optional. If a field is set, the corresponding\nconfiguration in the SQL warehouse is modified. If a field is unset, the existing configuration value in the SQL\nwarehouse is retained. Thus, this API is not idempotent.",
+      "fields": {
+        "auto_stop_mins": {
+          "description": "The amount of time in minutes that a SQL warehouse must be idle (i.e., no\nRUNNING queries) before it is automatically stopped.\n\nSupported values:\n- Must be == 0 or \u003e= 10 mins\n- 0 indicates no autostop.\n\nDefaults to 120 mins",
+          "launch_stage": "GA"
+        },
+        "channel": {
+          "description": "Channel Details",
+          "ref": "sql.Channel",
+          "launch_stage": "GA"
+        },
+        "cluster_size": {
+          "description": "Size of the clusters allocated for this warehouse.\nIncreasing the size of a spark cluster allows you to run larger queries on\nit. If you want to increase the number of concurrent queries, please tune\nmax_num_clusters.\n\nSupported values:\n- 2X-Small\n- X-Small\n- Small\n- Medium\n- Large\n- X-Large\n- 2X-Large\n- 3X-Large\n- 4X-Large\n- 5X-Large",
+          "launch_stage": "GA"
+        },
+        "creator_name": {
+          "description": "warehouse creator name",
+          "launch_stage": "GA"
+        },
+        "enable_photon": {
+          "description": "Configures whether the warehouse should use Photon optimized clusters.\n\nDefaults to true.",
+          "launch_stage": "GA"
+        },
+        "enable_serverless_compute": {
+          "description": "Configures whether the warehouse should use serverless compute",
+          "launch_stage": "GA"
+        },
+        "instance_profile_arn": {
+          "description": "Deprecated. Instance profile used to pass IAM role to the cluster",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "max_num_clusters": {
+          "description": "Maximum number of clusters that the autoscaler will create to handle\nconcurrent queries.\n\nSupported values:\n- Must be \u003e= min_num_clusters\n- Must be \u003c= 40.\n\nDefaults to min_clusters if unset.",
+          "launch_stage": "GA"
+        },
+        "min_num_clusters": {
+          "description": "Minimum number of available clusters that will be maintained for this SQL\nwarehouse. Increasing this will ensure that a larger number of clusters are\nalways running and therefore may reduce the cold start time for new\nqueries. This is similar to reserved vs. revocable cores in a resource\nmanager.\n\nSupported values:\n- Must be \u003e 0\n- Must be \u003c= min(max_num_clusters, 30)\n\nDefaults to 1",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Logical name for the cluster.\n\nSupported values:\n- Must be unique within an org.\n- Must be less than 100 characters.",
+          "launch_stage": "GA"
+        },
+        "spot_instance_policy": {
+          "description": "Configurations whether the endpoint should use spot instances.",
+          "ref": "sql.SpotInstancePolicy",
+          "launch_stage": "GA"
+        },
+        "statement_timeout": {
+          "description": "Warehouse statement timeout in seconds.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "tags": {
+          "description": "A set of key-value pairs that will be tagged on all resources (e.g., AWS instances and EBS volumes) associated\nwith this SQL warehouse.\n\nSupported values:\n- Number of tags \u003c 45.",
+          "ref": "sql.EndpointTags",
+          "launch_stage": "GA"
+        },
+        "warehouse_type": {
+          "description": "Warehouse type: `PRO` or `CLASSIC`. If you want to use serverless compute,\nyou must set to `PRO` and also set the field `enable_serverless_compute` to `true`.",
+          "ref": "sql.EditWarehouseRequestWarehouseType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.EditWarehouseRequestWarehouseType": {
+      "enum": [
+        "TYPE_UNSPECIFIED",
+        "CLASSIC",
+        "PRO",
+        "REALTIME"
+      ],
+      "enum_launch_stages": {
+        "CLASSIC": "GA",
+        "PRO": "GA",
+        "REALTIME": "PRIVATE_PREVIEW",
+        "TYPE_UNSPECIFIED": "GA"
+      }
+    },
+    "sql.EditWarehouseResponse": {},
+    "sql.Empty": {
+      "description": "Represents an empty message, similar to google.protobuf.Empty, which is not available in the firm\nright now."
+    },
+    "sql.EndpointConfPair": {
+      "fields": {
+        "key": {
+          "launch_stage": "GA"
+        },
+        "value": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.EndpointHealth": {
+      "fields": {
+        "details": {
+          "description": "Details about errors that are causing current degraded/failed status.",
+          "launch_stage": "GA"
+        },
+        "failure_reason": {
+          "description": "The reason for failure to bring up clusters for this warehouse. This is available when status is 'FAILED' and sometimes when it is DEGRADED.",
+          "ref": "sql.TerminationReason",
+          "launch_stage": "GA"
+        },
+        "message": {
+          "description": "Deprecated. split into summary and details for security",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "status": {
+          "description": "Health status of the endpoint.",
+          "ref": "sql.Status",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "summary": {
+          "description": "A short summary of the health status in case of degraded/failed warehouses.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.EndpointInfo": {
+      "fields": {
+        "auto_stop_mins": {
+          "description": "The amount of time in minutes that a SQL warehouse must be idle (i.e., no\nRUNNING queries) before it is automatically stopped.\n\nSupported values:\n- Must be == 0 or \u003e= 10 mins\n- 0 indicates no autostop.\n\nDefaults to 120 mins",
+          "launch_stage": "GA"
+        },
+        "channel": {
+          "description": "Channel Details",
+          "ref": "sql.Channel",
+          "launch_stage": "GA"
+        },
+        "cluster_size": {
+          "description": "Size of the clusters allocated for this warehouse.\nIncreasing the size of a spark cluster allows you to run larger queries on\nit. If you want to increase the number of concurrent queries, please tune\nmax_num_clusters.\n\nSupported values:\n- 2X-Small\n- X-Small\n- Small\n- Medium\n- Large\n- X-Large\n- 2X-Large\n- 3X-Large\n- 4X-Large\n- 5X-Large",
+          "launch_stage": "GA"
+        },
+        "creator_name": {
+          "description": "warehouse creator name",
+          "launch_stage": "GA"
+        },
+        "enable_photon": {
+          "description": "Configures whether the warehouse should use Photon optimized clusters.\n\nDefaults to true.",
+          "launch_stage": "GA"
+        },
+        "enable_serverless_compute": {
+          "description": "Configures whether the warehouse should use serverless compute",
+          "launch_stage": "GA"
+        },
+        "health": {
+          "description": "Optional health status. Assume the warehouse is healthy if this field is not set.",
+          "ref": "sql.EndpointHealth",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "id": {
+          "description": "unique identifier for warehouse",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "instance_profile_arn": {
+          "description": "Deprecated. Instance profile used to pass IAM role to the cluster",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "jdbc_url": {
+          "description": "the jdbc connection string for this warehouse",
+          "launch_stage": "GA"
+        },
+        "max_num_clusters": {
+          "description": "Maximum number of clusters that the autoscaler will create to handle\nconcurrent queries.\n\nSupported values:\n- Must be \u003e= min_num_clusters\n- Must be \u003c= 40.\n\nDefaults to min_clusters if unset.",
+          "launch_stage": "GA"
+        },
+        "min_num_clusters": {
+          "description": "Minimum number of available clusters that will be maintained for this SQL\nwarehouse. Increasing this will ensure that a larger number of clusters are\nalways running and therefore may reduce the cold start time for new\nqueries. This is similar to reserved vs. revocable cores in a resource\nmanager.\n\nSupported values:\n- Must be \u003e 0\n- Must be \u003c= min(max_num_clusters, 30)\n\nDefaults to 1",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Logical name for the cluster.\n\nSupported values:\n- Must be unique within an org.\n- Must be less than 100 characters.",
+          "launch_stage": "GA"
+        },
+        "num_active_sessions": {
+          "description": "Deprecated. current number of active sessions for the warehouse",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "num_clusters": {
+          "description": "current number of clusters running for the service",
+          "launch_stage": "GA"
+        },
+        "odbc_params": {
+          "description": "ODBC parameters for the SQL warehouse",
+          "ref": "sql.OdbcParams",
+          "launch_stage": "GA"
+        },
+        "spot_instance_policy": {
+          "description": "Configurations whether the endpoint should use spot instances.",
+          "ref": "sql.SpotInstancePolicy",
+          "launch_stage": "GA"
+        },
+        "state": {
+          "description": "state of the endpoint",
+          "ref": "sql.State",
+          "launch_stage": "GA"
+        },
+        "statement_timeout": {
+          "description": "Warehouse statement timeout in seconds.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "tags": {
+          "description": "A set of key-value pairs that will be tagged on all resources (e.g., AWS instances and EBS volumes) associated\nwith this SQL warehouse.\n\nSupported values:\n- Number of tags \u003c 45.",
+          "ref": "sql.EndpointTags",
+          "launch_stage": "GA"
+        },
+        "warehouse_type": {
+          "description": "Warehouse type: `PRO` or `CLASSIC`. If you want to use serverless compute,\nyou must set to `PRO` and also set the field `enable_serverless_compute` to `true`.",
+          "ref": "sql.EndpointInfoWarehouseType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.EndpointInfoWarehouseType": {
+      "enum": [
+        "TYPE_UNSPECIFIED",
+        "CLASSIC",
+        "PRO",
+        "REALTIME"
+      ],
+      "enum_launch_stages": {
+        "CLASSIC": "GA",
+        "PRO": "GA",
+        "REALTIME": "PRIVATE_PREVIEW",
+        "TYPE_UNSPECIFIED": "GA"
+      }
+    },
+    "sql.EndpointTagPair": {
+      "fields": {
+        "key": {
+          "launch_stage": "GA"
+        },
+        "value": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.EndpointTags": {
+      "fields": {
+        "custom_tags": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.EnumValue": {
+      "fields": {
+        "enum_options": {
+          "description": "List of valid query parameter values, newline delimited.",
+          "launch_stage": "GA"
+        },
+        "multi_values_options": {
+          "description": "If specified, allows multiple values to be selected for this parameter.",
+          "ref": "sql.MultiValuesOptions",
+          "launch_stage": "GA"
+        },
+        "values": {
+          "description": "List of selected query parameter values.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.ExecuteStatementRequest": {
+      "fields": {
+        "byte_limit": {
+          "description": "Applies the given byte limit to the statement's result size. Byte counts are based on internal data\nrepresentations and might not match the final size in the requested `format`. If the result was truncated due to\nthe byte limit, then `truncated` in the response is set to `true`.\nWhen using `EXTERNAL_LINKS` disposition, a default `byte_limit` of 100 GiB is applied if `byte_limit` is not\nexplicitly set.",
+          "launch_stage": "GA"
+        },
+        "catalog": {
+          "description": "Sets default catalog for statement execution, similar to\n[`USE CATALOG`](https://docs.databricks.com/sql/language-manual/sql-ref-syntax-ddl-use-catalog.html)\nin SQL.",
+          "launch_stage": "GA"
+        },
+        "disposition": {
+          "description": "The fetch disposition provides two modes of fetching results: `INLINE` and `EXTERNAL_LINKS`.\n\nStatements executed with `INLINE` disposition will return result data inline, in `JSON_ARRAY` format, in a series\nof chunks. If a given statement produces a result set with a size larger than 25 MiB,\nthat statement execution is aborted, and no result set will be available.\n\n**NOTE**\nByte limits are computed based upon internal representations of the result set data, and might not match the sizes\nvisible in JSON responses.\n\nStatements executed with `EXTERNAL_LINKS` disposition will return result data as external links: URLs that point\nto cloud storage internal to the workspace. Using `EXTERNAL_LINKS` disposition allows statements to generate\narbitrarily sized result sets for fetching up to 100 GiB. The resulting links have two important properties:\n\n1. They point to resources _external_ to the Databricks compute; therefore any associated authentication\ninformation (typically a personal access token, OAuth token, or similar) _must be removed_ when fetching from\nthese links.\n\n2. These are short-lived cloud-storage URLs\nwith a specific expiration, indicated in the response. The behavior when attempting to use an expired link is\ncloud specific.",
+          "ref": "sql.Disposition",
+          "launch_stage": "GA"
+        },
+        "format": {
+          "description": "Statement execution supports three result formats: `JSON_ARRAY` (default), `ARROW_STREAM`, and `CSV`.\n\nImportant: The formats `ARROW_STREAM` and `CSV` are supported only with `EXTERNAL_LINKS` disposition.\n`JSON_ARRAY` is supported in `INLINE` and `EXTERNAL_LINKS` disposition.\n\nWhen specifying `format=JSON_ARRAY`, result data will be formatted as an array of arrays of values, where each\nvalue is either the *string representation* of a value, or `null`.\nFor example, the output of `SELECT concat('id-', id) AS strCol, id AS intCol, null AS nullCol FROM range(3)` would\nlook like this:\n\n```\n[\n[ \"id-1\", \"1\", null ],\n[ \"id-2\", \"2\", null ],\n[ \"id-3\", \"3\", null ],\n]\n```\n\nWhen specifying `format=JSON_ARRAY` and `disposition=EXTERNAL_LINKS`, each chunk in the result contains compact\nJSON with no indentation or extra whitespace.\n\nWhen specifying `format=ARROW_STREAM` and `disposition=EXTERNAL_LINKS`, each chunk in the result will be formatted\nas Apache Arrow Stream. See the\n[Apache Arrow streaming format](https://arrow.apache.org/docs/format/Columnar.html#ipc-streaming-format).\n\nWhen specifying `format=CSV` and `disposition=EXTERNAL_LINKS`, each chunk in the result will be a CSV according to\n[RFC 4180](https://www.rfc-editor.org/rfc/rfc4180) standard.\nAll the columns values will have *string representation* similar to the `JSON_ARRAY` format, and `null` values will\nbe encoded as “null”.\nOnly the first chunk in the result would contain a header row with column names.\nFor example, the output of `SELECT concat('id-', id) AS strCol, id AS intCol, null as nullCol FROM range(3)` would\nlook like this:\n\n```\nstrCol,intCol,nullCol\nid-1,1,null\nid-2,2,null\nid-3,3,null\n```",
+          "ref": "sql.Format",
+          "launch_stage": "GA"
+        },
+        "on_wait_timeout": {
+          "description": "When `wait_timeout \u003e 0s`, the call will block up to the specified time. If the statement execution doesn't\nfinish within this time, `on_wait_timeout` determines whether the execution should continue or be canceled.\nWhen set to `CONTINUE`, the statement execution continues asynchronously and the call returns a statement ID\nwhich can be used for polling with :method:statementexecution/getStatement. When set to `CANCEL`,\nthe statement execution is canceled and the call returns with a `CANCELED` state.",
+          "ref": "sql.ExecuteStatementRequestOnWaitTimeout",
+          "launch_stage": "GA"
+        },
+        "parameters": {
+          "description": "A list of parameters to pass into a SQL statement containing parameter markers. A\nparameter consists of a name, a value, and optionally a type. To represent a NULL\nvalue, the `value` field may be omitted or set to `null` explicitly. If the `type` field\nis omitted, the value is interpreted as a string.\n\nIf the type is given, parameters will be checked for type correctness according\nto the given type. A value is correct if the provided string can be converted to\nthe requested type using the `cast` function. The exact semantics are described in\nthe section [`cast` function](https://docs.databricks.com/sql/language-manual/functions/cast.html) of the SQL language reference.\n\nFor example, the following statement contains two parameters, `my_name` and `my_date`:\n\n```\nSELECT * FROM my_table WHERE name = :my_name AND date = :my_date\n```\n\nThe parameters can be passed in the request body as follows:\n\n`\n{\n...,\n\"statement\": \"SELECT * FROM my_table WHERE name = :my_name AND date = :my_date\",\n\"parameters\": [\n{ \"name\": \"my_name\", \"value\": \"the name\" },\n{ \"name\": \"my_date\", \"value\": \"2020-01-01\", \"type\": \"DATE\" }\n]\n}\n`\n\nCurrently, positional parameters denoted by a `?` marker are not supported by the\nDatabricks SQL Statement Execution API.\n\nAlso see the section [Parameter markers](https://docs.databricks.com/sql/language-manual/sql-ref-parameter-marker.html) of the SQL language reference.",
+          "launch_stage": "GA"
+        },
+        "query_tags": {
+          "description": "An array of query tags to annotate a SQL statement. A query tag\nconsists of a non-empty key and, optionally, a value. To represent a NULL\nvalue, either omit the `value` field or manually set it to `null` or white space.\nRefer to the SQL language reference for the format specification of query tags.\nThere's no significance to the order of tags. Only one value per key will be recorded.\nA sequence in excess of 20 query tags will be coerced to 20.\nExample:\n\n{\n...,\n\"query_tags\": [\n{ \"key\": \"team\", \"value\": \"eng\" },\n{ \"key\": \"some key only tag\" }\n]\n}",
+          "launch_stage": "GA"
+        },
+        "row_limit": {
+          "description": "Applies the given row limit to the statement's result set, but unlike the `LIMIT` clause in SQL,\nit also sets the `truncated` field in the response to indicate whether the result was trimmed due to the limit or\nnot.",
+          "launch_stage": "GA"
+        },
+        "schema": {
+          "description": "Sets default schema for statement execution, similar to\n[`USE SCHEMA`](https://docs.databricks.com/sql/language-manual/sql-ref-syntax-ddl-use-schema.html)\nin SQL.",
+          "launch_stage": "GA"
+        },
+        "statement": {
+          "description": "The SQL statement to execute. The statement can optionally be parameterized, see `parameters`.\nThe maximum query text size is 16 MiB.",
+          "launch_stage": "GA"
+        },
+        "wait_timeout": {
+          "description": "The time in seconds the call will wait for the statement's result set as `Ns`, where `N` can be set to 0 or to a\nvalue between 5 and 50.\n\nWhen set to `0s`, the statement will execute in asynchronous mode and the call will not wait for the execution to\nfinish. In this case, the call returns directly with `PENDING` state and a statement ID which can be used for\npolling with :method:statementexecution/getStatement.\n\nWhen set between 5 and 50 seconds, the call will behave synchronously up to this timeout and wait for the statement\nexecution to finish. If the execution finishes within this time, the call returns immediately with a manifest and\nresult data (or a `FAILED` state in case of an execution error). If the statement takes longer to execute,\n`on_wait_timeout` determines what should happen after the timeout is reached.",
+          "launch_stage": "GA"
+        },
+        "warehouse_id": {
+          "description": "Warehouse upon which to execute a statement. See also\n[What are SQL warehouses?](https://docs.databricks.com/sql/admin/warehouse-type.html)",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.ExecuteStatementRequestOnWaitTimeout": {
+      "description": "When `wait_timeout \u003e 0s`, the call will block up to the specified time. If the statement execution doesn't\nfinish within this time, `on_wait_timeout` determines whether the execution should continue or be canceled.\nWhen set to `CONTINUE`, the statement execution continues asynchronously and the call returns a statement ID\nwhich can be used for polling with :method:statementexecution/getStatement. When set to `CANCEL`,\nthe statement execution is canceled and the call returns with a `CANCELED` state.",
+      "enum": [
+        "CONTINUE",
+        "CANCEL"
+      ],
+      "enum_launch_stages": {
+        "CANCEL": "GA",
+        "CONTINUE": "GA"
+      }
+    },
+    "sql.ExternalLink": {
+      "fields": {
+        "byte_count": {
+          "description": "The number of bytes in the result chunk. This field is not available when using `INLINE`\ndisposition.",
+          "launch_stage": "GA"
+        },
+        "chunk_index": {
+          "description": "The position within the sequence of result set chunks.",
+          "launch_stage": "GA"
+        },
+        "expiration": {
+          "description": "Indicates the date-time that the given external link will expire and\nbecomes invalid, after which point a new `external_link` must be requested.",
+          "launch_stage": "GA"
+        },
+        "external_link": {
+          "description": "A short-lived cloud-storage URL pointing to a chunk of result data, hosted by an external service, with a short\nexpiration time (\u003c= 15 minutes). As this URL contains a temporary credential, it should be considered sensitive\nand the client should not expose this URL in a log.",
+          "launch_stage": "GA"
+        },
+        "http_headers": {
+          "description": "HTTP headers that must be included with a GET request to the `external_link`.\nEach header is provided as a key-value pair.\nHeaders are typically used to pass a decryption key to the external service.\nThe values of these headers should be considered sensitive and the client should not expose\nthese values in a log.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "next_chunk_index": {
+          "description": "When fetching, provides the `chunk_index` for the _next_ chunk. If absent, indicates there are no\nmore chunks. The next chunk can be fetched with a\n:method:statementexecution/getstatementresultchunkn request.",
+          "launch_stage": "GA"
+        },
+        "next_chunk_internal_link": {
+          "description": "When fetching, provides a link to fetch the _next_ chunk. If absent, indicates there are no more\nchunks. This link is an absolute `path` to be joined with your `$DATABRICKS_HOST`, and should be\ntreated as an opaque link. This is an alternative to using `next_chunk_index`.",
+          "launch_stage": "GA"
+        },
+        "row_count": {
+          "description": "The number of rows within the result chunk.",
+          "launch_stage": "GA"
+        },
+        "row_offset": {
+          "description": "The starting row offset within the result set.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.ExternalQuerySource": {
+      "fields": {
+        "alert_id": {
+          "description": "The canonical identifier for this SQL alert",
+          "launch_stage": "GA"
+        },
+        "dashboard_id": {
+          "description": "The canonical identifier for this Lakeview dashboard",
+          "launch_stage": "GA"
+        },
+        "genie_space_id": {
+          "description": "The canonical identifier for this Genie space",
+          "launch_stage": "GA"
+        },
+        "job_info": {
+          "ref": "sql.ExternalQuerySourceJobInfo",
+          "launch_stage": "GA"
+        },
+        "legacy_dashboard_id": {
+          "description": "The canonical identifier for this legacy dashboard",
+          "launch_stage": "GA"
+        },
+        "notebook_id": {
+          "description": "The canonical identifier for this notebook",
+          "launch_stage": "GA"
+        },
+        "sql_query_id": {
+          "description": "The canonical identifier for this SQL query",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.ExternalQuerySourceJobInfo": {
+      "fields": {
+        "job_id": {
+          "description": "The canonical identifier for this job.",
+          "launch_stage": "GA"
+        },
+        "job_run_id": {
+          "description": "The canonical identifier of the run. This ID is unique across all runs of all jobs.",
+          "launch_stage": "GA"
+        },
+        "job_task_run_id": {
+          "description": "The canonical identifier of the task run.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.Format": {
+      "enum": [
+        "JSON_ARRAY",
+        "ARROW_STREAM",
+        "CSV"
+      ],
+      "enum_launch_stages": {
+        "ARROW_STREAM": "GA",
+        "CSV": "GA",
+        "JSON_ARRAY": "GA"
+      }
+    },
+    "sql.GetAlertRequest": {},
+    "sql.GetAlertV2Request": {},
+    "sql.GetAlertsLegacyRequest": {},
+    "sql.GetConfigRequest": {},
+    "sql.GetDashboardRequest": {},
+    "sql.GetDbsqlPermissionRequest": {},
+    "sql.GetDefaultWarehouseOverrideRequest": {},
+    "sql.GetQueriesLegacyRequest": {},
+    "sql.GetQueryRequest": {},
+    "sql.GetResponse": {
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "GA"
+        },
+        "object_id": {
+          "description": "An object's type and UUID, separated by a forward slash (/) character.",
+          "launch_stage": "GA"
+        },
+        "object_type": {
+          "description": "A singular noun object type.",
+          "ref": "sql.ObjectType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.GetStatementRequest": {},
+    "sql.GetStatementResultChunkNRequest": {},
+    "sql.GetWarehousePermissionLevelsRequest": {},
+    "sql.GetWarehousePermissionLevelsResponse": {
+      "fields": {
+        "permission_levels": {
+          "description": "Specific permission levels",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.GetWarehousePermissionsRequest": {},
+    "sql.GetWarehouseRequest": {},
+    "sql.GetWarehouseResponse": {
+      "fields": {
+        "auto_stop_mins": {
+          "description": "The amount of time in minutes that a SQL warehouse must be idle (i.e., no\nRUNNING queries) before it is automatically stopped.\n\nSupported values:\n- Must be == 0 or \u003e= 10 mins\n- 0 indicates no autostop.\n\nDefaults to 120 mins",
+          "launch_stage": "GA"
+        },
+        "channel": {
+          "description": "Channel Details",
+          "ref": "sql.Channel",
+          "launch_stage": "GA"
+        },
+        "cluster_size": {
+          "description": "Size of the clusters allocated for this warehouse.\nIncreasing the size of a spark cluster allows you to run larger queries on\nit. If you want to increase the number of concurrent queries, please tune\nmax_num_clusters.\n\nSupported values:\n- 2X-Small\n- X-Small\n- Small\n- Medium\n- Large\n- X-Large\n- 2X-Large\n- 3X-Large\n- 4X-Large\n- 5X-Large",
+          "launch_stage": "GA"
+        },
+        "creator_name": {
+          "description": "warehouse creator name",
+          "launch_stage": "GA"
+        },
+        "enable_photon": {
+          "description": "Configures whether the warehouse should use Photon optimized clusters.\n\nDefaults to true.",
+          "launch_stage": "GA"
+        },
+        "enable_serverless_compute": {
+          "description": "Configures whether the warehouse should use serverless compute",
+          "launch_stage": "GA"
+        },
+        "health": {
+          "description": "Optional health status. Assume the warehouse is healthy if this field is not set.",
+          "ref": "sql.EndpointHealth",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "id": {
+          "description": "unique identifier for warehouse",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "instance_profile_arn": {
+          "description": "Deprecated. Instance profile used to pass IAM role to the cluster",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "jdbc_url": {
+          "description": "the jdbc connection string for this warehouse",
+          "launch_stage": "GA"
+        },
+        "max_num_clusters": {
+          "description": "Maximum number of clusters that the autoscaler will create to handle\nconcurrent queries.\n\nSupported values:\n- Must be \u003e= min_num_clusters\n- Must be \u003c= 40.\n\nDefaults to min_clusters if unset.",
+          "launch_stage": "GA"
+        },
+        "min_num_clusters": {
+          "description": "Minimum number of available clusters that will be maintained for this SQL\nwarehouse. Increasing this will ensure that a larger number of clusters are\nalways running and therefore may reduce the cold start time for new\nqueries. This is similar to reserved vs. revocable cores in a resource\nmanager.\n\nSupported values:\n- Must be \u003e 0\n- Must be \u003c= min(max_num_clusters, 30)\n\nDefaults to 1",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Logical name for the cluster.\n\nSupported values:\n- Must be unique within an org.\n- Must be less than 100 characters.",
+          "launch_stage": "GA"
+        },
+        "num_active_sessions": {
+          "description": "Deprecated. current number of active sessions for the warehouse",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "num_clusters": {
+          "description": "current number of clusters running for the service",
+          "launch_stage": "GA"
+        },
+        "odbc_params": {
+          "description": "ODBC parameters for the SQL warehouse",
+          "ref": "sql.OdbcParams",
+          "launch_stage": "GA"
+        },
+        "spot_instance_policy": {
+          "description": "Configurations whether the endpoint should use spot instances.",
+          "ref": "sql.SpotInstancePolicy",
+          "launch_stage": "GA"
+        },
+        "state": {
+          "description": "state of the endpoint",
+          "ref": "sql.State",
+          "launch_stage": "GA"
+        },
+        "statement_timeout": {
+          "description": "Warehouse statement timeout in seconds.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "tags": {
+          "description": "A set of key-value pairs that will be tagged on all resources (e.g., AWS instances and EBS volumes) associated\nwith this SQL warehouse.\n\nSupported values:\n- Number of tags \u003c 45.",
+          "ref": "sql.EndpointTags",
+          "launch_stage": "GA"
+        },
+        "warehouse_type": {
+          "description": "Warehouse type: `PRO` or `CLASSIC`. If you want to use serverless compute,\nyou must set to `PRO` and also set the field `enable_serverless_compute` to `true`.",
+          "ref": "sql.GetWarehouseResponseWarehouseType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.GetWarehouseResponseWarehouseType": {
+      "enum": [
+        "TYPE_UNSPECIFIED",
+        "CLASSIC",
+        "PRO",
+        "REALTIME"
+      ],
+      "enum_launch_stages": {
+        "CLASSIC": "GA",
+        "PRO": "GA",
+        "REALTIME": "PRIVATE_PREVIEW",
+        "TYPE_UNSPECIFIED": "GA"
+      }
+    },
+    "sql.GetWorkspaceWarehouseConfigRequest": {},
+    "sql.GetWorkspaceWarehouseConfigResponse": {
+      "fields": {
+        "channel": {
+          "description": "Optional: Channel selection details",
+          "ref": "sql.Channel",
+          "launch_stage": "GA"
+        },
+        "config_param": {
+          "description": "Deprecated: Use sql_configuration_parameters",
+          "ref": "sql.RepeatedEndpointConfPairs",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "data_access_config": {
+          "description": "Spark confs for external hive metastore configuration\nJSON serialized size must be less than \u003c= 512K",
+          "launch_stage": "GA"
+        },
+        "enable_serverless_compute": {
+          "description": "Deprecated: only setting this to true is allowed.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "enabled_warehouse_types": {
+          "description": "List of Warehouse Types allowed in this workspace (limits allowed value of\nthe type field in CreateWarehouse and EditWarehouse). Note: Some types\ncannot be disabled, they don't need to be specified\nin SetWorkspaceWarehouseConfig.\nNote: Disabling a type may cause existing warehouses to be converted to\nanother type. Used by frontend to save specific type availability in the\nwarehouse create and edit form UI.",
+          "launch_stage": "GA"
+        },
+        "global_param": {
+          "description": "Deprecated: Use sql_configuration_parameters",
+          "ref": "sql.RepeatedEndpointConfPairs",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "google_service_account": {
+          "description": "GCP only: Google Service Account used to pass to cluster to access Google\nCloud Storage",
+          "launch_stage": "GA"
+        },
+        "instance_profile_arn": {
+          "description": "AWS Only: The instance profile used to pass an IAM role to the SQL\nwarehouses. This configuration is also applied to the workspace's\nserverless compute for notebooks and jobs.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "security_policy": {
+          "description": "Security policy for warehouses",
+          "ref": "sql.GetWorkspaceWarehouseConfigResponseSecurityPolicy",
+          "launch_stage": "GA"
+        },
+        "sql_configuration_parameters": {
+          "description": "SQL configuration parameters",
+          "ref": "sql.RepeatedEndpointConfPairs",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.GetWorkspaceWarehouseConfigResponseSecurityPolicy": {
+      "description": "Security policy to be used for warehouses",
+      "enum": [
+        "NONE",
+        "DATA_ACCESS_CONTROL",
+        "PASSTHROUGH"
+      ],
+      "enum_launch_stages": {
+        "DATA_ACCESS_CONTROL": "GA",
+        "NONE": "GA",
+        "PASSTHROUGH": "GA"
+      }
+    },
+    "sql.LegacyAlert": {
+      "fields": {
+        "created_at": {
+          "description": "Timestamp when the alert was created.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "id": {
+          "description": "Alert ID.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "last_triggered_at": {
+          "description": "Timestamp when the alert was last triggered.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "name": {
+          "description": "Name of the alert.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "options": {
+          "description": "Alert configuration options.",
+          "ref": "sql.AlertOptions",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "parent": {
+          "description": "The identifier of the workspace folder containing the object.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "query": {
+          "ref": "sql.AlertQuery",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "rearm": {
+          "description": "Number of seconds after being triggered before the alert rearms itself and can be triggered again. If `null`, alert will never be triggered again.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "state": {
+          "description": "State of the alert. Possible values are: `unknown` (yet to be evaluated), `triggered` (evaluated and fulfilled trigger conditions), or `ok` (evaluated and did not fulfill trigger conditions).",
+          "ref": "sql.LegacyAlertState",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "updated_at": {
+          "description": "Timestamp when the alert was last updated.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "user": {
+          "ref": "sql.User",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "sql.LegacyAlertState": {
+      "enum": [
+        "ok",
+        "triggered",
+        "unknown"
+      ],
+      "enum_launch_stages": {
+        "ok": "PUBLIC_PREVIEW",
+        "triggered": "PUBLIC_PREVIEW",
+        "unknown": "PUBLIC_PREVIEW"
+      }
+    },
+    "sql.LegacyQuery": {
+      "fields": {
+        "can_edit": {
+          "description": "Describes whether the authenticated user is allowed to edit the definition of this query.",
+          "launch_stage": "GA"
+        },
+        "created_at": {
+          "description": "The timestamp when this query was created.",
+          "launch_stage": "GA"
+        },
+        "data_source_id": {
+          "description": "Data source ID maps to the ID of the data source used by the resource and is distinct from the warehouse ID. [Learn more](https://docs.databricks.com/api/workspace/datasources/list)",
+          "launch_stage": "GA"
+        },
+        "description": {
+          "description": "General description that conveys additional information about this query such as usage notes.",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "Query ID.",
+          "launch_stage": "GA"
+        },
+        "is_archived": {
+          "description": "Indicates whether the query is trashed. Trashed queries can't be used in dashboards, or appear in search results. If this boolean is `true`, the `options` property for this query includes a `moved_to_trash_at` timestamp. Trashed queries are permanently deleted after 30 days.",
+          "launch_stage": "GA"
+        },
+        "is_draft": {
+          "description": "Whether the query is a draft. Draft queries only appear in list views for their owners. Visualizations from draft queries cannot appear on dashboards.",
+          "launch_stage": "GA"
+        },
+        "is_favorite": {
+          "description": "Whether this query object appears in the current user's favorites list. This flag determines whether the star icon for favorites is selected.",
+          "launch_stage": "GA"
+        },
+        "is_safe": {
+          "description": "Text parameter types are not safe from SQL injection for all types of data source. Set this Boolean parameter to `true` if a query either does not use any text type parameters or uses a data source type where text type parameters are handled safely.",
+          "launch_stage": "GA"
+        },
+        "last_modified_by": {
+          "ref": "sql.User",
+          "launch_stage": "GA"
+        },
+        "last_modified_by_id": {
+          "description": "The ID of the user who last saved changes to this query.",
+          "launch_stage": "GA"
+        },
+        "latest_query_data_id": {
+          "description": "If there is a cached result for this query and user, this field includes the query result ID. If this query uses parameters, this field is always null.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The title of this query that appears in list views, widget headings, and on the query page.",
+          "launch_stage": "GA"
+        },
+        "options": {
+          "ref": "sql.QueryOptions",
+          "launch_stage": "GA"
+        },
+        "parent": {
+          "description": "The identifier of the workspace folder containing the object.",
+          "launch_stage": "GA"
+        },
+        "permission_tier": {
+          "description": "* `CAN_VIEW`: Can view the query\n* `CAN_RUN`: Can run the query\n* `CAN_EDIT`: Can edit the query\n* `CAN_MANAGE`: Can manage the query",
+          "ref": "sql.PermissionLevel",
+          "launch_stage": "GA"
+        },
+        "query": {
+          "description": "The text of the query to be run.",
+          "launch_stage": "GA"
+        },
+        "query_hash": {
+          "description": "A SHA-256 hash of the query text along with the authenticated user ID.",
+          "launch_stage": "GA"
+        },
+        "run_as_role": {
+          "description": "Sets the **Run as** role for the object. Must be set to one of `\"viewer\"` (signifying \"run as viewer\" behavior) or `\"owner\"` (signifying \"run as owner\" behavior)",
+          "ref": "sql.RunAsRole",
+          "launch_stage": "GA"
+        },
+        "tags": {
+          "launch_stage": "GA"
+        },
+        "updated_at": {
+          "description": "The timestamp at which this query was last updated.",
+          "launch_stage": "GA"
+        },
+        "user": {
+          "ref": "sql.User",
+          "launch_stage": "GA"
+        },
+        "user_id": {
+          "description": "The ID of the user who owns the query.",
+          "launch_stage": "GA"
+        },
+        "visualizations": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.LegacyVisualization": {
+      "description": "The visualization description API changes frequently and is unsupported. You can duplicate a visualization by copying description objects received _from the API_ and then using them to create a new one with a POST request to the same endpoint. Databricks does not recommend constructing ad-hoc visualizations entirely in JSON.",
+      "fields": {
+        "created_at": {
+          "launch_stage": "GA"
+        },
+        "description": {
+          "description": "A short description of this visualization. This is not displayed in the UI.",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "The UUID for this visualization.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The name of the visualization that appears on dashboards and the query screen.",
+          "launch_stage": "GA"
+        },
+        "options": {
+          "description": "The options object varies widely from one visualization type to the next and is unsupported. Databricks does not recommend modifying visualization settings in JSON.",
+          "launch_stage": "GA"
+        },
+        "query": {
+          "ref": "sql.LegacyQuery",
+          "launch_stage": "GA"
+        },
+        "type": {
+          "description": "The type of visualization: chart, table, pivot table, and so on.",
+          "launch_stage": "GA"
+        },
+        "updated_at": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.LifecycleState": {
+      "enum": [
+        "ACTIVE",
+        "TRASHED"
+      ],
+      "enum_launch_stages": {
+        "ACTIVE": "GA",
+        "TRASHED": "GA"
+      }
+    },
+    "sql.ListAlertsRequest": {
+      "fields": {
+        "page_size": {
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.ListAlertsResponse": {
+      "fields": {
+        "next_page_token": {
+          "launch_stage": "GA"
+        },
+        "results": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.ListAlertsResponseAlert": {
+      "fields": {
+        "condition": {
+          "description": "Trigger conditions of the alert.",
+          "ref": "sql.AlertCondition",
+          "launch_stage": "GA"
+        },
+        "create_time": {
+          "description": "The timestamp indicating when the alert was created.",
+          "launch_stage": "GA"
+        },
+        "custom_body": {
+          "description": "Custom body of alert notification, if it exists. See [here](https://docs.databricks.com/sql/user/alerts/index.html) for custom templating instructions.",
+          "launch_stage": "GA"
+        },
+        "custom_subject": {
+          "description": "Custom subject of alert notification, if it exists. This can include email subject entries and Slack notification headers, for example. See [here](https://docs.databricks.com/sql/user/alerts/index.html) for custom templating instructions.",
+          "launch_stage": "GA"
+        },
+        "display_name": {
+          "description": "The display name of the alert.",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "UUID identifying the alert.",
+          "launch_stage": "GA"
+        },
+        "lifecycle_state": {
+          "description": "The workspace state of the alert. Used for tracking trashed status.",
+          "ref": "sql.LifecycleState",
+          "launch_stage": "GA"
+        },
+        "notify_on_ok": {
+          "description": "Whether to notify alert subscribers when alert returns back to normal.",
+          "launch_stage": "GA"
+        },
+        "owner_user_name": {
+          "description": "The owner's username. This field is set to \"Unavailable\" if the user has been deleted.",
+          "launch_stage": "GA"
+        },
+        "query_id": {
+          "description": "UUID of the query attached to the alert.",
+          "launch_stage": "GA"
+        },
+        "seconds_to_retrigger": {
+          "description": "Number of seconds an alert must wait after being triggered to rearm itself. After rearming, it can be triggered again. If 0 or not specified, the alert will not be triggered again.",
+          "launch_stage": "GA"
+        },
+        "state": {
+          "description": "Current state of the alert's trigger status. This field is set to UNKNOWN if the alert has not yet been evaluated or ran into an error during the last evaluation.",
+          "ref": "sql.AlertState",
+          "launch_stage": "GA"
+        },
+        "trigger_time": {
+          "description": "Timestamp when the alert was last triggered, if the alert has been triggered before.",
+          "launch_stage": "GA"
+        },
+        "update_time": {
+          "description": "The timestamp indicating when the alert was updated.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.ListAlertsV2Request": {
+      "fields": {
+        "page_size": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "sql.ListAlertsV2Response": {
+      "fields": {
+        "alerts": {
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.ListDashboardsRequest": {
+      "fields": {
+        "order": {
+          "description": "Name of dashboard attribute to order by.",
+          "ref": "sql.ListOrder",
+          "launch_stage": "GA"
+        },
+        "page": {
+          "description": "Page number to retrieve.",
+          "launch_stage": "GA"
+        },
+        "page_size": {
+          "description": "Number of dashboards to return per page.",
+          "launch_stage": "GA"
+        },
+        "q": {
+          "description": "Full text search term.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.ListDefaultWarehouseOverridesRequest": {
+      "fields": {
+        "page_size": {
+          "description": "The maximum number of overrides to return. The service may return fewer than\nthis value.\nIf unspecified, at most 100 overrides will be returned.\nThe maximum value is 1000; values above 1000 will be coerced to 1000.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "A page token, received from a previous `ListDefaultWarehouseOverrides` call.\nProvide this to retrieve the subsequent page.\n\nWhen paginating, all other parameters provided to `ListDefaultWarehouseOverrides`\nmust match the call that provided the page token.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "sql.ListDefaultWarehouseOverridesResponse": {
+      "description": "Response message for ListDefaultWarehouseOverrides.",
+      "fields": {
+        "default_warehouse_overrides": {
+          "description": "The default warehouse overrides in the workspace.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "next_page_token": {
+          "description": "A token, which can be sent as `page_token` to retrieve the next page.\nIf this field is omitted, there are no subsequent pages.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "sql.ListOrder": {
+      "enum": [
+        "created_at",
+        "name"
+      ],
+      "enum_launch_stages": {
+        "created_at": "GA",
+        "name": "GA"
+      }
+    },
+    "sql.ListQueriesLegacyRequest": {
+      "fields": {
+        "order": {
+          "description": "Name of query attribute to order by. Default sort order is ascending. Append a dash (`-`) to order descending instead.\n\n- `name`: The name of the query.\n\n- `created_at`: The timestamp the query was created.\n\n- `runtime`: The time it took to run this query. This is blank for parameterized queries. A blank value is treated as the highest value for sorting.\n\n- `executed_at`: The timestamp when the query was last run.\n\n- `created_by`: The user name of the user that created the query.",
+          "launch_stage": "GA"
+        },
+        "page": {
+          "description": "Page number to retrieve.",
+          "launch_stage": "GA"
+        },
+        "page_size": {
+          "description": "Number of queries to return per page.",
+          "launch_stage": "GA"
+        },
+        "q": {
+          "description": "Full text search term",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.ListQueriesRequest": {
+      "fields": {
+        "page_size": {
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.ListQueriesResponse": {
+      "fields": {
+        "has_next_page": {
+          "description": "Whether there is another page of results.",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "A token that can be used to get the next page of results.",
+          "launch_stage": "GA"
+        },
+        "res": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.ListQueryHistoryRequest": {
+      "fields": {
+        "filter_by": {
+          "description": "An optional filter object to limit query history results. Accepts parameters such as user IDs, endpoint IDs, and statuses to narrow the returned data.\nIn a URL, the parameters of this filter are specified with dot notation. For example: `filter_by.statement_ids`.",
+          "ref": "sql.QueryFilter",
+          "launch_stage": "GA"
+        },
+        "include_metrics": {
+          "description": "Whether to include the query metrics with each query.\nOnly use this for a small subset of queries (max_results).\nDefaults to false.",
+          "launch_stage": "GA"
+        },
+        "max_results": {
+          "description": "Limit the number of results returned in one page. Must be less than 1000 and the default is 100.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "A token that can be used to get the next page of results. The token can contains characters that need to be encoded before using it in a URL.\nFor example, the character '+' needs to be replaced by %2B. This field is optional.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.ListQueryObjectsResponse": {
+      "fields": {
+        "next_page_token": {
+          "launch_stage": "GA"
+        },
+        "results": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.ListQueryObjectsResponseQuery": {
+      "fields": {
+        "apply_auto_limit": {
+          "description": "Whether to apply a 1000 row limit to the query result.",
+          "launch_stage": "GA"
+        },
+        "catalog": {
+          "description": "Name of the catalog where this query will be executed.",
+          "launch_stage": "GA"
+        },
+        "create_time": {
+          "description": "Timestamp when this query was created.",
+          "launch_stage": "GA"
+        },
+        "description": {
+          "description": "General description that conveys additional information about this query such as usage notes.",
+          "launch_stage": "GA"
+        },
+        "display_name": {
+          "description": "Display name of the query that appears in list views, widget headings, and on the query page.",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "UUID identifying the query.",
+          "launch_stage": "GA"
+        },
+        "last_modifier_user_name": {
+          "description": "Username of the user who last saved changes to this query.",
+          "launch_stage": "GA"
+        },
+        "lifecycle_state": {
+          "description": "Indicates whether the query is trashed.",
+          "ref": "sql.LifecycleState",
+          "launch_stage": "GA"
+        },
+        "owner_user_name": {
+          "description": "Username of the user that owns the query.",
+          "launch_stage": "GA"
+        },
+        "parameters": {
+          "description": "List of query parameter definitions.",
+          "launch_stage": "GA"
+        },
+        "query_text": {
+          "description": "Text of the query to be run.",
+          "launch_stage": "GA"
+        },
+        "run_as_mode": {
+          "description": "Sets the \"Run as\" role for the object.",
+          "ref": "sql.RunAsMode",
+          "launch_stage": "GA"
+        },
+        "schema": {
+          "description": "Name of the schema where this query will be executed.",
+          "launch_stage": "GA"
+        },
+        "tags": {
+          "launch_stage": "GA"
+        },
+        "update_time": {
+          "description": "Timestamp when this query was last updated.",
+          "launch_stage": "GA"
+        },
+        "warehouse_id": {
+          "description": "ID of the SQL warehouse attached to the query.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.ListRequest": {},
+    "sql.ListResponse": {
+      "fields": {
+        "count": {
+          "description": "The total number of dashboards.",
+          "launch_stage": "GA"
+        },
+        "page": {
+          "description": "The current page being displayed.",
+          "launch_stage": "GA"
+        },
+        "page_size": {
+          "description": "The number of dashboards per page.",
+          "launch_stage": "GA"
+        },
+        "results": {
+          "description": "List of dashboards returned.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.ListVisualizationsForQueryRequest": {
+      "fields": {
+        "page_size": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "page_token": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "sql.ListVisualizationsForQueryResponse": {
+      "fields": {
+        "next_page_token": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "results": {
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "sql.ListWarehousesRequest": {
+      "fields": {
+        "page_size": {
+          "description": "The max number of warehouses to return.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "A page token, received from a previous `ListWarehouses` call.\nProvide this to retrieve the subsequent page; otherwise the first\nwill be retrieved.\n\nWhen paginating, all other parameters provided to `ListWarehouses` must match\nthe call that provided the page token.",
+          "launch_stage": "GA"
+        },
+        "run_as_user_id": {
+          "description": "Deprecated: this field is ignored by the server.\nService Principal which will be used to fetch the list of endpoints.\nIf not specified, SQL Gateway will use the user from the session header.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.ListWarehousesResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "A token, which can be sent as `page_token` to retrieve the next page.\nIf this field is omitted, there are no subsequent pages.",
+          "launch_stage": "GA"
+        },
+        "warehouses": {
+          "description": "A list of warehouses and their configurations.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.MultiValuesOptions": {
+      "fields": {
+        "prefix": {
+          "description": "Character that prefixes each selected parameter value.",
+          "launch_stage": "GA"
+        },
+        "separator": {
+          "description": "Character that separates each selected parameter value. Defaults to a comma.",
+          "launch_stage": "GA"
+        },
+        "suffix": {
+          "description": "Character that suffixes each selected parameter value.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.NumericValue": {
+      "fields": {
+        "value": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.ObjectType": {
+      "description": "A singular noun object type.",
+      "enum": [
+        "alert",
+        "dashboard",
+        "data_source",
+        "query"
+      ],
+      "enum_launch_stages": {
+        "alert": "GA",
+        "dashboard": "GA",
+        "data_source": "GA",
+        "query": "GA"
+      }
+    },
+    "sql.ObjectTypePlural": {
+      "description": "Always a plural of the object type.",
+      "enum": [
+        "alerts",
+        "dashboards",
+        "data_sources",
+        "queries"
+      ],
+      "enum_launch_stages": {
+        "alerts": "GA",
+        "dashboards": "GA",
+        "data_sources": "GA",
+        "queries": "GA"
+      }
+    },
+    "sql.OdbcParams": {
+      "fields": {
+        "hostname": {
+          "launch_stage": "GA"
+        },
+        "path": {
+          "launch_stage": "GA"
+        },
+        "port": {
+          "launch_stage": "GA"
+        },
+        "protocol": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.OwnableObjectType": {
+      "enum": [
+        "alert",
+        "dashboard",
+        "query"
+      ],
+      "enum_launch_stages": {
+        "alert": "GA",
+        "dashboard": "GA",
+        "query": "GA"
+      }
+    },
+    "sql.Parameter": {
+      "fields": {
+        "enumOptions": {
+          "description": "List of valid parameter values, newline delimited. Only applies for dropdown list parameters.",
+          "launch_stage": "GA"
+        },
+        "multiValuesOptions": {
+          "description": "If specified, allows multiple values to be selected for this parameter. Only applies to dropdown list and query-based dropdown list parameters.",
+          "ref": "sql.MultiValuesOptions",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The literal parameter marker that appears between double curly braces in the query text.",
+          "launch_stage": "GA"
+        },
+        "queryId": {
+          "description": "The UUID of the query that provides the parameter values. Only applies for query-based dropdown list parameters.",
+          "launch_stage": "GA"
+        },
+        "title": {
+          "description": "The text displayed in a parameter picking widget.",
+          "launch_stage": "GA"
+        },
+        "type": {
+          "description": "Parameters can have several different types.",
+          "ref": "sql.ParameterType",
+          "launch_stage": "GA"
+        },
+        "value": {
+          "description": "The default value for this parameter.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.ParameterType": {
+      "enum": [
+        "datetime",
+        "enum",
+        "number",
+        "query",
+        "text"
+      ],
+      "enum_launch_stages": {
+        "datetime": "GA",
+        "enum": "GA",
+        "number": "GA",
+        "query": "GA",
+        "text": "GA"
+      }
+    },
+    "sql.PermissionLevel": {
+      "description": "* `CAN_VIEW`: Can view the query\n* `CAN_RUN`: Can run the query\n* `CAN_EDIT`: Can edit the query\n* `CAN_MANAGE`: Can manage the query",
+      "enum": [
+        "CAN_EDIT",
+        "CAN_MANAGE",
+        "CAN_RUN",
+        "CAN_VIEW"
+      ],
+      "enum_launch_stages": {
+        "CAN_EDIT": "GA",
+        "CAN_MANAGE": "GA",
+        "CAN_RUN": "GA",
+        "CAN_VIEW": "GA"
+      },
+      "enum_descriptions": {
+        "CAN_EDIT": "Can edit the query",
+        "CAN_MANAGE": "Can manage the query",
+        "CAN_RUN": "Can run the query",
+        "CAN_VIEW": "Can view the query"
+      }
+    },
+    "sql.PlansState": {
+      "description": "Possible Reasons for which we have not saved plans in the database",
+      "enum": [
+        "IGNORED_SMALL_DURATION",
+        "IGNORED_LARGE_PLANS_SIZE",
+        "EXISTS",
+        "UNKNOWN",
+        "EMPTY",
+        "IGNORED_SPARK_PLAN_TYPE"
+      ],
+      "enum_launch_stages": {
+        "EMPTY": "GA",
+        "EXISTS": "GA",
+        "IGNORED_LARGE_PLANS_SIZE": "GA",
+        "IGNORED_SMALL_DURATION": "GA",
+        "IGNORED_SPARK_PLAN_TYPE": "GA",
+        "UNKNOWN": "GA"
+      }
+    },
+    "sql.Query": {
+      "fields": {
+        "apply_auto_limit": {
+          "description": "Whether to apply a 1000 row limit to the query result.",
+          "launch_stage": "GA"
+        },
+        "catalog": {
+          "description": "Name of the catalog where this query will be executed.",
+          "launch_stage": "GA"
+        },
+        "create_time": {
+          "description": "Timestamp when this query was created.",
+          "launch_stage": "GA"
+        },
+        "description": {
+          "description": "General description that conveys additional information about this query such as usage notes.",
+          "launch_stage": "GA"
+        },
+        "display_name": {
+          "description": "Display name of the query that appears in list views, widget headings, and on the query page.",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "UUID identifying the query.",
+          "launch_stage": "GA"
+        },
+        "last_modifier_user_name": {
+          "description": "Username of the user who last saved changes to this query.",
+          "launch_stage": "GA"
+        },
+        "lifecycle_state": {
+          "description": "Indicates whether the query is trashed.",
+          "ref": "sql.LifecycleState",
+          "launch_stage": "GA"
+        },
+        "owner_user_name": {
+          "description": "Username of the user that owns the query.",
+          "launch_stage": "GA"
+        },
+        "parameters": {
+          "description": "List of query parameter definitions.",
+          "launch_stage": "GA"
+        },
+        "parent_path": {
+          "description": "Workspace path of the workspace folder containing the object.",
+          "launch_stage": "GA"
+        },
+        "query_text": {
+          "description": "Text of the query to be run.",
+          "launch_stage": "GA"
+        },
+        "run_as_mode": {
+          "description": "Sets the \"Run as\" role for the object.",
+          "ref": "sql.RunAsMode",
+          "launch_stage": "GA"
+        },
+        "schema": {
+          "description": "Name of the schema where this query will be executed.",
+          "launch_stage": "GA"
+        },
+        "tags": {
+          "launch_stage": "GA"
+        },
+        "update_time": {
+          "description": "Timestamp when this query was last updated.",
+          "launch_stage": "GA"
+        },
+        "warehouse_id": {
+          "description": "ID of the SQL warehouse attached to the query.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.QueryBackedValue": {
+      "fields": {
+        "multi_values_options": {
+          "description": "If specified, allows multiple values to be selected for this parameter.",
+          "ref": "sql.MultiValuesOptions",
+          "launch_stage": "GA"
+        },
+        "query_id": {
+          "description": "UUID of the query that provides the parameter values.",
+          "launch_stage": "GA"
+        },
+        "values": {
+          "description": "List of selected query parameter values.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.QueryEditContent": {
+      "fields": {
+        "data_source_id": {
+          "description": "Data source ID maps to the ID of the data source used by the resource and is distinct from the warehouse ID. [Learn more](https://docs.databricks.com/api/workspace/datasources/list)",
+          "launch_stage": "GA"
+        },
+        "description": {
+          "description": "General description that conveys additional information about this query such as usage notes.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The title of this query that appears in list views, widget headings, and on the query page.",
+          "launch_stage": "GA"
+        },
+        "options": {
+          "description": "Exclusively used for storing a list parameter definitions. A parameter is an object with `title`, `name`, `type`, and `value` properties. The `value` field here is the default value. It can be overridden at runtime.",
+          "launch_stage": "GA"
+        },
+        "query": {
+          "description": "The text of the query to be run.",
+          "launch_stage": "GA"
+        },
+        "run_as_role": {
+          "description": "Sets the **Run as** role for the object. Must be set to one of `\"viewer\"` (signifying \"run as viewer\" behavior) or `\"owner\"` (signifying \"run as owner\" behavior)",
+          "ref": "sql.RunAsRole",
+          "launch_stage": "GA"
+        },
+        "tags": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.QueryFilter": {
+      "fields": {
+        "query_start_time_range": {
+          "description": "A range filter for query submitted time. The time range must be less than or equal to 30 days.",
+          "ref": "sql.TimeRange",
+          "launch_stage": "GA"
+        },
+        "statement_ids": {
+          "description": "A list of statement IDs.",
+          "launch_stage": "GA"
+        },
+        "statuses": {
+          "description": "A list of statuses (QUEUED, RUNNING, CANCELED, FAILED, FINISHED) to match query results. Corresponds to\nthe `status` field in the response.\nFiltering for multiple statuses is not recommended. Instead, opt to filter by a single status\nmultiple times and then combine the results.",
+          "launch_stage": "GA"
+        },
+        "user_ids": {
+          "description": "A list of user IDs who ran the queries.",
+          "launch_stage": "GA"
+        },
+        "warehouse_ids": {
+          "description": "A list of warehouse IDs.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.QueryInfo": {
+      "fields": {
+        "cache_query_id": {
+          "description": "The ID of the cached query if this result retrieved from cache",
+          "launch_stage": "GA"
+        },
+        "channel_used": {
+          "description": "SQL Warehouse channel information at the time of query execution",
+          "ref": "sql.ChannelInfo",
+          "launch_stage": "GA"
+        },
+        "client_application": {
+          "description": "Client application that ran the statement. For example: Databricks SQL Editor, Tableau, and Power BI.\nThis field is derived from information provided by client applications. While values are expected to\nremain static over time, this cannot be guaranteed.",
+          "launch_stage": "GA"
+        },
+        "duration": {
+          "description": "Total time of the statement execution. This value does not include the time taken to retrieve the results, which\ncan result in a discrepancy between this value and the start-to-finish wall-clock time.",
+          "launch_stage": "GA"
+        },
+        "endpoint_id": {
+          "description": "Alias for `warehouse_id`.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "error_message": {
+          "description": "Message describing why the query could not complete.",
+          "launch_stage": "GA"
+        },
+        "executed_as_user_id": {
+          "description": "The ID of the user whose credentials were used to run the query.",
+          "launch_stage": "GA"
+        },
+        "executed_as_user_name": {
+          "description": "The email address or username of the user whose credentials were used to run the query.",
+          "launch_stage": "GA"
+        },
+        "execution_end_time_ms": {
+          "description": "The time execution of the query ended.",
+          "launch_stage": "GA"
+        },
+        "is_final": {
+          "description": "Whether more updates for the query are expected.",
+          "launch_stage": "GA"
+        },
+        "lookup_key": {
+          "description": "A key that can be used to look up query details.",
+          "launch_stage": "GA"
+        },
+        "metrics": {
+          "description": "Metrics about query execution.",
+          "ref": "sql.QueryMetrics",
+          "launch_stage": "GA"
+        },
+        "plans_state": {
+          "description": "Whether plans exist for the execution, or the reason why they are missing",
+          "ref": "sql.PlansState",
+          "launch_stage": "GA"
+        },
+        "query_end_time_ms": {
+          "description": "The time the query ended.",
+          "launch_stage": "GA"
+        },
+        "query_id": {
+          "description": "The query ID.",
+          "launch_stage": "GA"
+        },
+        "query_source": {
+          "description": "A struct that contains key-value pairs representing Databricks entities that were involved in the execution\nof this statement, such as jobs, notebooks, or dashboards. This field only records Databricks entities.",
+          "ref": "sql.ExternalQuerySource",
+          "launch_stage": "GA"
+        },
+        "query_start_time_ms": {
+          "description": "The time the query started.",
+          "launch_stage": "GA"
+        },
+        "query_tags": {
+          "description": "A query execution can be optionally annotated with query tags",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "query_text": {
+          "description": "The text of the query.",
+          "launch_stage": "GA"
+        },
+        "rows_produced": {
+          "description": "The number of results returned by the query.",
+          "launch_stage": "GA"
+        },
+        "session_id": {
+          "description": "The spark session UUID that query ran on.\nThis is either the Spark Connect, DBSQL, or SDP session ID.",
+          "launch_stage": "GA"
+        },
+        "spark_ui_url": {
+          "description": "URL to the Spark UI query plan.",
+          "launch_stage": "GA"
+        },
+        "statement_type": {
+          "description": "Type of statement for this query",
+          "ref": "sql.QueryStatementType",
+          "launch_stage": "GA"
+        },
+        "status": {
+          "description": "Query status with one the following values:\n\n- `QUEUED`: Query has been received and queued.\n- `RUNNING`: Query has started.\n- `CANCELED`: Query has been cancelled by the user.\n- `FAILED`: Query has failed.\n- `FINISHED`: Query has completed.",
+          "ref": "sql.QueryStatus",
+          "launch_stage": "GA"
+        },
+        "user_id": {
+          "description": "The ID of the user who ran the query.",
+          "launch_stage": "GA"
+        },
+        "user_name": {
+          "description": "The email address or username of the user who ran the query.",
+          "launch_stage": "GA"
+        },
+        "warehouse_id": {
+          "description": "Warehouse ID.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.QueryList": {
+      "fields": {
+        "count": {
+          "description": "The total number of queries.",
+          "launch_stage": "GA"
+        },
+        "page": {
+          "description": "The page number that is currently displayed.",
+          "launch_stage": "GA"
+        },
+        "page_size": {
+          "description": "The number of queries per page.",
+          "launch_stage": "GA"
+        },
+        "results": {
+          "description": "List of queries returned.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.QueryMetrics": {
+      "description": "A query metric that encapsulates a set of measurements for a single query.\nMetrics come from the driver and are stored in the history service database.",
+      "fields": {
+        "compilation_time_ms": {
+          "description": "Time spent loading metadata and optimizing the query, in milliseconds.",
+          "launch_stage": "GA"
+        },
+        "execution_time_ms": {
+          "description": "Time spent executing the query, in milliseconds.",
+          "launch_stage": "GA"
+        },
+        "network_sent_bytes": {
+          "description": "Total amount of data sent over the network between executor nodes during shuffle, in bytes.",
+          "launch_stage": "GA"
+        },
+        "overloading_queue_start_timestamp": {
+          "description": "Timestamp of when the query was enqueued waiting while the warehouse was at max load.\nThis field is optional and will not appear if the query skipped the overloading queue.",
+          "launch_stage": "GA"
+        },
+        "photon_total_time_ms": {
+          "description": "Total execution time for all individual Photon query engine tasks in the query, in milliseconds.",
+          "launch_stage": "GA"
+        },
+        "projected_remaining_task_total_time_ms": {
+          "description": "projected remaining work to be done aggregated across all stages in the query, in milliseconds",
+          "launch_stage": "GA"
+        },
+        "projected_remaining_wallclock_time_ms": {
+          "description": "projected lower bound on remaining total task time based on projected_remaining_task_total_time_ms / maximum concurrency",
+          "launch_stage": "GA"
+        },
+        "provisioning_queue_start_timestamp": {
+          "description": "Timestamp of when the query was enqueued waiting for a cluster to be provisioned for the warehouse.\nThis field is optional and will not appear if the query skipped the provisioning queue.",
+          "launch_stage": "GA"
+        },
+        "pruned_bytes": {
+          "description": "Total number of file bytes in all tables not read due to pruning",
+          "launch_stage": "GA"
+        },
+        "pruned_files_count": {
+          "description": "Total number of files from all tables not read due to pruning",
+          "launch_stage": "GA"
+        },
+        "query_compilation_start_timestamp": {
+          "description": "Timestamp of when the underlying compute started compilation of the query.",
+          "launch_stage": "GA"
+        },
+        "read_bytes": {
+          "description": "Total size of data read by the query, in bytes.",
+          "launch_stage": "GA"
+        },
+        "read_cache_bytes": {
+          "description": "Size of persistent data read from the cache, in bytes.",
+          "launch_stage": "GA"
+        },
+        "read_files_bytes": {
+          "description": "Total number of file bytes in all tables read",
+          "launch_stage": "GA"
+        },
+        "read_files_count": {
+          "description": "Number of files read after pruning",
+          "launch_stage": "GA"
+        },
+        "read_partitions_count": {
+          "description": "Number of partitions read after pruning.",
+          "launch_stage": "GA"
+        },
+        "read_remote_bytes": {
+          "description": "Size of persistent data read from cloud object storage on your cloud tenant, in bytes.",
+          "launch_stage": "GA"
+        },
+        "remaining_task_count": {
+          "description": "number of remaining tasks to complete\nthis is based on the current status and could be bigger or smaller in the future based on future updates",
+          "launch_stage": "GA"
+        },
+        "result_fetch_time_ms": {
+          "description": "Time spent fetching the query results after the execution finished, in milliseconds.",
+          "launch_stage": "GA"
+        },
+        "result_from_cache": {
+          "description": "`true` if the query result was fetched from cache, `false` otherwise.",
+          "launch_stage": "GA"
+        },
+        "rows_produced_count": {
+          "description": "Total number of rows returned by the query.",
+          "launch_stage": "GA"
+        },
+        "rows_read_count": {
+          "description": "Total number of rows read by the query.",
+          "launch_stage": "GA"
+        },
+        "runnable_tasks": {
+          "description": "number of remaining tasks to complete, calculated by autoscaler StatementAnalysis.scala\ndeprecated: use remaining_task_count instead",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "spill_to_disk_bytes": {
+          "description": "Size of data temporarily written to disk while executing the query, in bytes.",
+          "launch_stage": "GA"
+        },
+        "task_time_over_time_range": {
+          "description": "sum of task times completed in a range of wall clock time, approximated to a configurable number of points\naggregated over all stages and jobs in the query (based on task_total_time_ms)",
+          "ref": "sql.TaskTimeOverRange",
+          "launch_stage": "GA"
+        },
+        "task_total_time_ms": {
+          "description": "Sum of execution time for all of the query’s tasks, in milliseconds.",
+          "launch_stage": "GA"
+        },
+        "total_time_ms": {
+          "description": "Total execution time of the query from the client’s point of view, in milliseconds.",
+          "launch_stage": "GA"
+        },
+        "work_to_be_done": {
+          "description": "remaining work to be done across all stages in the query, calculated by autoscaler StatementAnalysis.scala, in milliseconds\ndeprecated: using projected_remaining_task_total_time_ms instead",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "write_remote_bytes": {
+          "description": "Size pf persistent data written to cloud object storage in your cloud tenant, in bytes.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.QueryOptions": {
+      "fields": {
+        "catalog": {
+          "description": "The name of the catalog to execute this query in.",
+          "launch_stage": "GA"
+        },
+        "moved_to_trash_at": {
+          "description": "The timestamp when this query was moved to trash. Only present when the `is_archived` property is `true`. Trashed items are deleted after thirty days.",
+          "launch_stage": "GA"
+        },
+        "parameters": {
+          "launch_stage": "GA"
+        },
+        "schema": {
+          "description": "The name of the schema to execute this query in.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.QueryParameter": {
+      "fields": {
+        "date_range_value": {
+          "description": "Date-range query parameter value. Can only specify one of `dynamic_date_range_value` or `date_range_value`.",
+          "ref": "sql.DateRangeValue",
+          "launch_stage": "GA"
+        },
+        "date_value": {
+          "description": "Date query parameter value. Can only specify one of `dynamic_date_value` or `date_value`.",
+          "ref": "sql.DateValue",
+          "launch_stage": "GA"
+        },
+        "enum_value": {
+          "description": "Dropdown query parameter value.",
+          "ref": "sql.EnumValue",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Literal parameter marker that appears between double curly braces in the query text.",
+          "launch_stage": "GA"
+        },
+        "numeric_value": {
+          "description": "Numeric query parameter value.",
+          "ref": "sql.NumericValue",
+          "launch_stage": "GA"
+        },
+        "query_backed_value": {
+          "description": "Query-based dropdown query parameter value.",
+          "ref": "sql.QueryBackedValue",
+          "launch_stage": "GA"
+        },
+        "text_value": {
+          "description": "Text query parameter value.",
+          "ref": "sql.TextValue",
+          "launch_stage": "GA"
+        },
+        "title": {
+          "description": "Text displayed in the user-facing parameter widget in the UI.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.QueryPostContent": {
+      "fields": {
+        "data_source_id": {
+          "description": "Data source ID maps to the ID of the data source used by the resource and is distinct from the warehouse ID. [Learn more](https://docs.databricks.com/api/workspace/datasources/list)",
+          "launch_stage": "GA"
+        },
+        "description": {
+          "description": "General description that conveys additional information about this query such as usage notes.",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "The title of this query that appears in list views, widget headings, and on the query page.",
+          "launch_stage": "GA"
+        },
+        "options": {
+          "description": "Exclusively used for storing a list parameter definitions. A parameter is an object with `title`, `name`, `type`, and `value` properties. The `value` field here is the default value. It can be overridden at runtime.",
+          "launch_stage": "GA"
+        },
+        "parent": {
+          "description": "The identifier of the workspace folder containing the object.",
+          "launch_stage": "GA"
+        },
+        "query": {
+          "description": "The text of the query to be run.",
+          "launch_stage": "GA"
+        },
+        "run_as_role": {
+          "description": "Sets the **Run as** role for the object. Must be set to one of `\"viewer\"` (signifying \"run as viewer\" behavior) or `\"owner\"` (signifying \"run as owner\" behavior)",
+          "ref": "sql.RunAsRole",
+          "launch_stage": "GA"
+        },
+        "tags": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.QueryStatementType": {
+      "enum": [
+        "OTHER",
+        "ALTER",
+        "ANALYZE",
+        "COPY",
+        "CREATE",
+        "DELETE",
+        "DESCRIBE",
+        "DROP",
+        "EXPLAIN",
+        "GRANT",
+        "INSERT",
+        "MERGE",
+        "OPTIMIZE",
+        "REFRESH",
+        "REPLACE",
+        "REVOKE",
+        "SELECT",
+        "SET",
+        "SHOW",
+        "TRUNCATE",
+        "UPDATE",
+        "USE"
+      ],
+      "enum_launch_stages": {
+        "ALTER": "GA",
+        "ANALYZE": "GA",
+        "COPY": "GA",
+        "CREATE": "GA",
+        "DELETE": "GA",
+        "DESCRIBE": "GA",
+        "DROP": "GA",
+        "EXPLAIN": "GA",
+        "GRANT": "GA",
+        "INSERT": "GA",
+        "MERGE": "GA",
+        "OPTIMIZE": "GA",
+        "OTHER": "GA",
+        "REFRESH": "GA",
+        "REPLACE": "GA",
+        "REVOKE": "GA",
+        "SELECT": "GA",
+        "SET": "GA",
+        "SHOW": "GA",
+        "TRUNCATE": "GA",
+        "UPDATE": "GA",
+        "USE": "GA"
+      }
+    },
+    "sql.QueryStatus": {
+      "description": "Statuses which are also used by OperationStatus in runtime.\nWhen adding a new QueryStatus, make sure to update com.databricks.sqlgateway.history.QueryStatusOrdering",
+      "enum": [
+        "QUEUED",
+        "STARTED",
+        "COMPILING",
+        "COMPILED",
+        "RUNNING",
+        "CANCELED",
+        "FAILED",
+        "FINISHED"
+      ],
+      "enum_launch_stages": {
+        "CANCELED": "GA",
+        "COMPILED": "GA",
+        "COMPILING": "GA",
+        "FAILED": "GA",
+        "FINISHED": "GA",
+        "QUEUED": "GA",
+        "RUNNING": "GA",
+        "STARTED": "GA"
+      }
+    },
+    "sql.QueryTag": {
+      "description": "* A query execution can be annotated with an optional key-value pair to\nallow users to attribute the executions by key and optional value to filter by.\nQueryTag is the user-facing representation.",
+      "fields": {
+        "key": {
+          "launch_stage": "GA"
+        },
+        "value": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.RepeatedEndpointConfPairs": {
+      "fields": {
+        "config_pair": {
+          "description": "Deprecated: Use configuration_pairs",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "configuration_pairs": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.RestoreDashboardRequest": {},
+    "sql.RestoreQueriesLegacyRequest": {},
+    "sql.RestoreResponse": {},
+    "sql.ResultData": {
+      "description": "Contains the result data of a single chunk when using `INLINE` disposition. When using\n`EXTERNAL_LINKS` disposition, the array `external_links` is used instead to provide\nshort-lived cloud-storage URLs to the result data\nin cloud storage. Exactly one of these alternatives is used. (While the `external_links`\narray prepares the API to return multiple links in a single response. Currently only a single\nlink is returned.)",
+      "fields": {
+        "byte_count": {
+          "description": "The number of bytes in the result chunk. This field is not available when using `INLINE`\ndisposition.",
+          "launch_stage": "GA"
+        },
+        "chunk_index": {
+          "description": "The position within the sequence of result set chunks.",
+          "launch_stage": "GA"
+        },
+        "data_array": {
+          "description": "The `JSON_ARRAY` format is an array of arrays of values, where each non-null value is\nformatted as a string. Null values are encoded as JSON `null`.",
+          "launch_stage": "GA"
+        },
+        "external_links": {
+          "launch_stage": "GA"
+        },
+        "next_chunk_index": {
+          "description": "When fetching, provides the `chunk_index` for the _next_ chunk. If absent, indicates there are no\nmore chunks. The next chunk can be fetched with a\n:method:statementexecution/getstatementresultchunkn request.",
+          "launch_stage": "GA"
+        },
+        "next_chunk_internal_link": {
+          "description": "When fetching, provides a link to fetch the _next_ chunk. If absent, indicates there are no more\nchunks. This link is an absolute `path` to be joined with your `$DATABRICKS_HOST`, and should be\ntreated as an opaque link. This is an alternative to using `next_chunk_index`.",
+          "launch_stage": "GA"
+        },
+        "row_count": {
+          "description": "The number of rows within the result chunk.",
+          "launch_stage": "GA"
+        },
+        "row_offset": {
+          "description": "The starting row offset within the result set.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.ResultManifest": {
+      "description": "The result manifest provides schema and metadata for the result set.",
+      "fields": {
+        "chunks": {
+          "description": "Array of result set chunk metadata.",
+          "launch_stage": "GA"
+        },
+        "format": {
+          "ref": "sql.Format",
+          "launch_stage": "GA"
+        },
+        "schema": {
+          "ref": "sql.ResultSchema",
+          "launch_stage": "GA"
+        },
+        "total_byte_count": {
+          "description": "The total number of bytes in the result set. This field is not available when using `INLINE`\ndisposition.",
+          "launch_stage": "GA"
+        },
+        "total_chunk_count": {
+          "description": "The total number of chunks that the result set has been divided into.",
+          "launch_stage": "GA"
+        },
+        "total_row_count": {
+          "description": "The total number of rows in the result set.",
+          "launch_stage": "GA"
+        },
+        "truncated": {
+          "description": "Indicates whether the result is truncated due to `row_limit` or `byte_limit`.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.ResultSchema": {
+      "description": "The schema is an ordered list of column descriptions.",
+      "fields": {
+        "column_count": {
+          "launch_stage": "GA"
+        },
+        "columns": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.RunAsMode": {
+      "enum": [
+        "OWNER",
+        "VIEWER"
+      ],
+      "enum_launch_stages": {
+        "OWNER": "GA",
+        "VIEWER": "GA"
+      }
+    },
+    "sql.RunAsRole": {
+      "enum": [
+        "owner",
+        "viewer"
+      ],
+      "enum_launch_stages": {
+        "owner": "GA",
+        "viewer": "GA"
+      }
+    },
+    "sql.SchedulePauseStatus": {
+      "enum": [
+        "UNPAUSED",
+        "PAUSED"
+      ],
+      "enum_launch_stages": {
+        "PAUSED": "GA",
+        "UNPAUSED": "GA"
+      }
+    },
+    "sql.ServiceError": {
+      "fields": {
+        "error_code": {
+          "ref": "sql.ServiceErrorCode",
+          "launch_stage": "GA"
+        },
+        "message": {
+          "description": "A brief summary of the error condition.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.ServiceErrorCode": {
+      "enum": [
+        "UNKNOWN",
+        "INTERNAL_ERROR",
+        "TEMPORARILY_UNAVAILABLE",
+        "IO_ERROR",
+        "BAD_REQUEST",
+        "SERVICE_UNDER_MAINTENANCE",
+        "WORKSPACE_TEMPORARILY_UNAVAILABLE",
+        "DEADLINE_EXCEEDED",
+        "CANCELLED",
+        "RESOURCE_EXHAUSTED",
+        "ABORTED",
+        "NOT_FOUND",
+        "ALREADY_EXISTS",
+        "UNAUTHENTICATED"
+      ],
+      "enum_launch_stages": {
+        "ABORTED": "GA",
+        "ALREADY_EXISTS": "GA",
+        "BAD_REQUEST": "GA",
+        "CANCELLED": "GA",
+        "DEADLINE_EXCEEDED": "GA",
+        "INTERNAL_ERROR": "GA",
+        "IO_ERROR": "GA",
+        "NOT_FOUND": "GA",
+        "RESOURCE_EXHAUSTED": "GA",
+        "SERVICE_UNDER_MAINTENANCE": "GA",
+        "TEMPORARILY_UNAVAILABLE": "GA",
+        "UNAUTHENTICATED": "GA",
+        "UNKNOWN": "GA",
+        "WORKSPACE_TEMPORARILY_UNAVAILABLE": "GA"
+      }
+    },
+    "sql.SetRequest": {
+      "description": "Set object ACL",
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.SetResponse": {
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "GA"
+        },
+        "object_id": {
+          "description": "An object's type and UUID, separated by a forward slash (/) character.",
+          "launch_stage": "GA"
+        },
+        "object_type": {
+          "description": "A singular noun object type.",
+          "ref": "sql.ObjectType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.SetWorkspaceWarehouseConfigRequest": {
+      "description": "Sets the workspace level warehouse configuration that is shared by all SQL warehouses in this workspace.\n\nThis is idempotent.",
+      "fields": {
+        "channel": {
+          "description": "Optional: Channel selection details",
+          "ref": "sql.Channel",
+          "launch_stage": "GA"
+        },
+        "config_param": {
+          "description": "Deprecated: Use sql_configuration_parameters",
+          "ref": "sql.RepeatedEndpointConfPairs",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "data_access_config": {
+          "description": "Spark confs for external hive metastore configuration\nJSON serialized size must be less than \u003c= 512K",
+          "launch_stage": "GA"
+        },
+        "enable_serverless_compute": {
+          "description": "Deprecated: only setting this to true is allowed.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "enabled_warehouse_types": {
+          "description": "List of Warehouse Types allowed in this workspace (limits allowed value of\nthe type field in CreateWarehouse and EditWarehouse). Note: Some types\ncannot be disabled, they don't need to be specified\nin SetWorkspaceWarehouseConfig.\nNote: Disabling a type may cause existing warehouses to be converted to\nanother type. Used by frontend to save specific type availability in the\nwarehouse create and edit form UI.",
+          "launch_stage": "GA"
+        },
+        "global_param": {
+          "description": "Deprecated: Use sql_configuration_parameters",
+          "ref": "sql.RepeatedEndpointConfPairs",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "google_service_account": {
+          "description": "GCP only: Google Service Account used to pass to cluster to access Google\nCloud Storage",
+          "launch_stage": "GA"
+        },
+        "instance_profile_arn": {
+          "description": "AWS Only: The instance profile used to pass an IAM role to the SQL\nwarehouses. This configuration is also applied to the workspace's\nserverless compute for notebooks and jobs.",
+          "deprecated": true,
+          "launch_stage": "GA"
+        },
+        "security_policy": {
+          "description": "Security policy for warehouses",
+          "ref": "sql.SetWorkspaceWarehouseConfigRequestSecurityPolicy",
+          "launch_stage": "GA"
+        },
+        "sql_configuration_parameters": {
+          "description": "SQL configuration parameters",
+          "ref": "sql.RepeatedEndpointConfPairs",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.SetWorkspaceWarehouseConfigRequestSecurityPolicy": {
+      "description": "Security policy to be used for warehouses",
+      "enum": [
+        "NONE",
+        "DATA_ACCESS_CONTROL",
+        "PASSTHROUGH"
+      ],
+      "enum_launch_stages": {
+        "DATA_ACCESS_CONTROL": "GA",
+        "NONE": "GA",
+        "PASSTHROUGH": "GA"
+      }
+    },
+    "sql.SetWorkspaceWarehouseConfigResponse": {},
+    "sql.SpotInstancePolicy": {
+      "description": "EndpointSpotInstancePolicy configures whether the endpoint should use spot\ninstances.\n\nThe breakdown of how the EndpointSpotInstancePolicy converts to per cloud\nconfigurations is:\n\n- AWS, COST_OPTIMIZED: On Demand Driver with Spot Executors.\n- AWS, RELIABILITY_OPTIMIZED: On Demand Driver and Executors.\n- AZURE, COST_OPTIMIZED: On Demand Driver and Executors.\n- AZURE, RELIABILITY_OPTIMIZED: On Demand Driver and Executors.",
+      "enum": [
+        "POLICY_UNSPECIFIED",
+        "COST_OPTIMIZED",
+        "RELIABILITY_OPTIMIZED"
+      ],
+      "enum_launch_stages": {
+        "COST_OPTIMIZED": "GA",
+        "POLICY_UNSPECIFIED": "GA",
+        "RELIABILITY_OPTIMIZED": "GA"
+      }
+    },
+    "sql.StartRequest": {
+      "description": "Starts a SQL warehouse.\nThis API is idempotent."
+    },
+    "sql.StartWarehouseResponse": {},
+    "sql.State": {
+      "description": "*\nState of a warehouse.",
+      "enum": [
+        "STARTING",
+        "RUNNING",
+        "STOPPING",
+        "STOPPED",
+        "DELETING",
+        "DELETED"
+      ],
+      "enum_launch_stages": {
+        "DELETED": "GA",
+        "DELETING": "GA",
+        "RUNNING": "GA",
+        "STARTING": "GA",
+        "STOPPED": "GA",
+        "STOPPING": "GA"
+      }
+    },
+    "sql.StatementParameterListItem": {
+      "fields": {
+        "name": {
+          "description": "The name of a parameter marker to be substituted in the statement.",
+          "launch_stage": "GA"
+        },
+        "type": {
+          "description": "The data type, given as a string. For example: `INT`, `STRING`, `DECIMAL(10,2)`.\nIf no type is given the type is assumed to be `STRING`. Complex types, such as\n`ARRAY`, `MAP`, and `STRUCT` are not supported. For valid types, refer to the\nsection [Data types](https://docs.databricks.com/sql/language-manual/functions/cast.html) of the SQL language reference.",
+          "launch_stage": "GA"
+        },
+        "value": {
+          "description": "The value to substitute, represented as a string. If omitted, the value is interpreted as NULL.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.StatementResponse": {
+      "fields": {
+        "manifest": {
+          "ref": "sql.ResultManifest",
+          "launch_stage": "GA"
+        },
+        "result": {
+          "ref": "sql.ResultData",
+          "launch_stage": "GA"
+        },
+        "statement_id": {
+          "description": "The statement ID is returned upon successfully submitting a SQL statement, and is a required\nreference for all subsequent calls.",
+          "launch_stage": "GA"
+        },
+        "status": {
+          "ref": "sql.StatementStatus",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.StatementState": {
+      "enum": [
+        "PENDING",
+        "RUNNING",
+        "SUCCEEDED",
+        "FAILED",
+        "CANCELED",
+        "CLOSED"
+      ],
+      "enum_launch_stages": {
+        "CANCELED": "GA",
+        "CLOSED": "GA",
+        "FAILED": "GA",
+        "PENDING": "GA",
+        "RUNNING": "GA",
+        "SUCCEEDED": "GA"
+      }
+    },
+    "sql.StatementStatus": {
+      "description": "The status response includes execution state and if relevant, error information.",
+      "fields": {
+        "error": {
+          "ref": "sql.ServiceError",
+          "launch_stage": "GA"
+        },
+        "sql_state": {
+          "description": "SQLSTATE error code returned when the statement execution fails.\nOnly populated when the statement status is `FAILED`.",
+          "launch_stage": "GA"
+        },
+        "state": {
+          "description": "Statement execution state:\n- `PENDING`: waiting for warehouse\n- `RUNNING`: running\n- `SUCCEEDED`: execution was successful, result data available for fetch\n- `FAILED`: execution failed; reason for failure described in accompanying error message\n- `CANCELED`: user canceled; can come from explicit cancel call, or timeout with\n`on_wait_timeout=CANCEL`\n- `CLOSED`: execution successful, and statement closed; result no longer available for fetch",
+          "ref": "sql.StatementState",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.Status": {
+      "enum": [
+        "HEALTHY",
+        "DEGRADED",
+        "FAILED"
+      ],
+      "enum_launch_stages": {
+        "DEGRADED": "GA",
+        "FAILED": "GA",
+        "HEALTHY": "GA"
+      }
+    },
+    "sql.StopRequest": {
+      "description": "Stops a SQL warehouse.\nThis API is idempotent."
+    },
+    "sql.StopWarehouseResponse": {},
+    "sql.Success": {
+      "fields": {
+        "message": {
+          "ref": "sql.SuccessMessage",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.SuccessMessage": {
+      "enum": [
+        "Success"
+      ],
+      "enum_launch_stages": {
+        "Success": "GA"
+      }
+    },
+    "sql.TaskTimeOverRange": {
+      "fields": {
+        "entries": {
+          "launch_stage": "GA"
+        },
+        "interval": {
+          "description": "interval length for all entries (difference in start time and end time of an entry range)\nthe same for all entries\nstart time of first interval is query_start_time_ms",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.TaskTimeOverRangeEntry": {
+      "fields": {
+        "task_completed_time_ms": {
+          "description": "total task completion time in this time range, aggregated over all stages and jobs in the query",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.TerminationReason": {
+      "fields": {
+        "code": {
+          "description": "status code indicating why the cluster was terminated",
+          "ref": "sql.TerminationReasonCode",
+          "launch_stage": "GA"
+        },
+        "parameters": {
+          "description": "list of parameters that provide additional information about why the cluster was terminated",
+          "launch_stage": "GA"
+        },
+        "type": {
+          "description": "type of the termination",
+          "ref": "sql.TerminationReasonType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.TerminationReasonCode": {
+      "description": "The status code indicating why the cluster was terminated.",
+      "enum": [
+        "UNKNOWN",
+        "USER_REQUEST",
+        "JOB_FINISHED",
+        "INACTIVITY",
+        "CLOUD_PROVIDER_SHUTDOWN",
+        "COMMUNICATION_LOST",
+        "CLOUD_PROVIDER_LAUNCH_FAILURE",
+        "INIT_SCRIPT_FAILURE",
+        "SPARK_STARTUP_FAILURE",
+        "INVALID_ARGUMENT",
+        "UNEXPECTED_LAUNCH_FAILURE",
+        "INTERNAL_ERROR",
+        "INSTANCE_UNREACHABLE",
+        "REQUEST_REJECTED",
+        "TRIAL_EXPIRED",
+        "DRIVER_UNREACHABLE",
+        "SPARK_ERROR",
+        "DRIVER_UNRESPONSIVE",
+        "METASTORE_COMPONENT_UNHEALTHY",
+        "DBFS_COMPONENT_UNHEALTHY",
+        "EXECUTION_COMPONENT_UNHEALTHY",
+        "AZURE_RESOURCE_MANAGER_THROTTLING",
+        "AZURE_RESOURCE_PROVIDER_THROTTLING",
+        "NETWORK_CONFIGURATION_FAILURE",
+        "CONTAINER_LAUNCH_FAILURE",
+        "INSTANCE_POOL_CLUSTER_FAILURE",
+        "SKIPPED_SLOW_NODES",
+        "ATTACH_PROJECT_FAILURE",
+        "UPDATE_INSTANCE_PROFILE_FAILURE",
+        "DATABASE_CONNECTION_FAILURE",
+        "REQUEST_THROTTLED",
+        "SELF_BOOTSTRAP_FAILURE",
+        "GLOBAL_INIT_SCRIPT_FAILURE",
+        "SLOW_IMAGE_DOWNLOAD",
+        "INVALID_SPARK_IMAGE",
+        "NPIP_TUNNEL_TOKEN_FAILURE",
+        "HIVE_METASTORE_PROVISIONING_FAILURE",
+        "AZURE_INVALID_DEPLOYMENT_TEMPLATE",
+        "AZURE_UNEXPECTED_DEPLOYMENT_TEMPLATE_FAILURE",
+        "SUBNET_EXHAUSTED_FAILURE",
+        "BOOTSTRAP_TIMEOUT",
+        "STORAGE_DOWNLOAD_FAILURE",
+        "CONTROL_PLANE_REQUEST_FAILURE",
+        "BOOTSTRAP_TIMEOUT_CLOUD_PROVIDER_EXCEPTION",
+        "AWS_INSUFFICIENT_INSTANCE_CAPACITY_FAILURE",
+        "DOCKER_IMAGE_PULL_FAILURE",
+        "AZURE_VNET_CONFIGURATION_FAILURE",
+        "NPIP_TUNNEL_SETUP_FAILURE",
+        "AWS_AUTHORIZATION_FAILURE",
+        "NEPHOS_RESOURCE_MANAGEMENT",
+        "STS_CLIENT_SETUP_FAILURE",
+        "SECURITY_DAEMON_REGISTRATION_EXCEPTION",
+        "AWS_REQUEST_LIMIT_EXCEEDED",
+        "AWS_INSUFFICIENT_FREE_ADDRESSES_IN_SUBNET_FAILURE",
+        "AWS_UNSUPPORTED_FAILURE",
+        "AZURE_QUOTA_EXCEEDED_EXCEPTION",
+        "AZURE_OPERATION_NOT_ALLOWED_EXCEPTION",
+        "NFS_MOUNT_FAILURE",
+        "K8S_AUTOSCALING_FAILURE",
+        "K8S_DBR_CLUSTER_LAUNCH_TIMEOUT",
+        "SPARK_IMAGE_DOWNLOAD_FAILURE",
+        "AZURE_VM_EXTENSION_FAILURE",
+        "WORKSPACE_CANCELLED_ERROR",
+        "AWS_MAX_SPOT_INSTANCE_COUNT_EXCEEDED_FAILURE",
+        "TEMPORARILY_UNAVAILABLE",
+        "WORKER_SETUP_FAILURE",
+        "IP_EXHAUSTION_FAILURE",
+        "GCP_QUOTA_EXCEEDED",
+        "CLOUD_PROVIDER_RESOURCE_STOCKOUT",
+        "GCP_SERVICE_ACCOUNT_DELETED",
+        "AZURE_BYOK_KEY_PERMISSION_FAILURE",
+        "SPOT_INSTANCE_TERMINATION",
+        "AZURE_EPHEMERAL_DISK_FAILURE",
+        "ABUSE_DETECTED",
+        "IMAGE_PULL_PERMISSION_DENIED",
+        "WORKSPACE_CONFIGURATION_ERROR",
+        "SECRET_RESOLUTION_ERROR",
+        "UNSUPPORTED_INSTANCE_TYPE",
+        "CLOUD_PROVIDER_DISK_SETUP_FAILURE",
+        "SSH_BOOTSTRAP_FAILURE",
+        "AWS_INACCESSIBLE_KMS_KEY_FAILURE",
+        "INIT_CONTAINER_NOT_FINISHED",
+        "SPARK_IMAGE_DOWNLOAD_THROTTLED",
+        "SPARK_IMAGE_NOT_FOUND",
+        "CLUSTER_OPERATION_THROTTLED",
+        "CLUSTER_OPERATION_TIMEOUT",
+        "SERVERLESS_LONG_RUNNING_TERMINATED",
+        "AZURE_PACKED_DEPLOYMENT_PARTIAL_FAILURE",
+        "INVALID_WORKER_IMAGE_FAILURE",
+        "WORKSPACE_UPDATE",
+        "INVALID_AWS_PARAMETER",
+        "DRIVER_OUT_OF_DISK",
+        "DRIVER_OUT_OF_MEMORY",
+        "DRIVER_LAUNCH_TIMEOUT",
+        "DRIVER_UNEXPECTED_FAILURE",
+        "UNEXPECTED_POD_RECREATION",
+        "GCP_INACCESSIBLE_KMS_KEY_FAILURE",
+        "GCP_KMS_KEY_PERMISSION_DENIED",
+        "DRIVER_EVICTION",
+        "USER_INITIATED_VM_TERMINATION",
+        "GCP_IAM_TIMEOUT",
+        "AWS_RESOURCE_QUOTA_EXCEEDED",
+        "CLOUD_ACCOUNT_SETUP_FAILURE",
+        "AWS_INVALID_KEY_PAIR",
+        "DRIVER_POD_CREATION_FAILURE",
+        "MAINTENANCE_MODE",
+        "INTERNAL_CAPACITY_FAILURE",
+        "EXECUTOR_POD_UNSCHEDULED",
+        "STORAGE_DOWNLOAD_FAILURE_SLOW",
+        "STORAGE_DOWNLOAD_FAILURE_THROTTLED",
+        "DYNAMIC_SPARK_CONF_SIZE_EXCEEDED",
+        "AWS_INSTANCE_PROFILE_UPDATE_FAILURE",
+        "INSTANCE_POOL_NOT_FOUND",
+        "INSTANCE_POOL_MAX_CAPACITY_REACHED",
+        "AWS_INVALID_KMS_KEY_STATE",
+        "GCP_INSUFFICIENT_CAPACITY",
+        "GCP_API_RATE_QUOTA_EXCEEDED",
+        "GCP_RESOURCE_QUOTA_EXCEEDED",
+        "GCP_IP_SPACE_EXHAUSTED",
+        "GCP_SERVICE_ACCOUNT_ACCESS_DENIED",
+        "GCP_SERVICE_ACCOUNT_NOT_FOUND",
+        "GCP_FORBIDDEN",
+        "GCP_NOT_FOUND",
+        "RESOURCE_USAGE_BLOCKED",
+        "DATA_ACCESS_CONFIG_CHANGED",
+        "ACCESS_TOKEN_FAILURE",
+        "INVALID_INSTANCE_PLACEMENT_PROTOCOL",
+        "BUDGET_POLICY_RESOLUTION_FAILURE",
+        "IN_PENALTY_BOX",
+        "DISASTER_RECOVERY_REPLICATION",
+        "BOOTSTRAP_TIMEOUT_DUE_TO_MISCONFIG",
+        "INSTANCE_UNREACHABLE_DUE_TO_MISCONFIG",
+        "STORAGE_DOWNLOAD_FAILURE_DUE_TO_MISCONFIG",
+        "CONTROL_PLANE_REQUEST_FAILURE_DUE_TO_MISCONFIG",
+        "CLOUD_PROVIDER_LAUNCH_FAILURE_DUE_TO_MISCONFIG",
+        "GCP_SUBNET_NOT_READY",
+        "CLOUD_OPERATION_CANCELLED",
+        "CLOUD_PROVIDER_INSTANCE_NOT_LAUNCHED",
+        "GCP_TRUSTED_IMAGE_PROJECTS_VIOLATED",
+        "BUDGET_POLICY_LIMIT_ENFORCEMENT_ACTIVATED",
+        "EOS_SPARK_IMAGE",
+        "NO_MATCHED_K8S",
+        "LAZY_ALLOCATION_TIMEOUT",
+        "DRIVER_NODE_UNREACHABLE",
+        "SECRET_CREATION_FAILURE",
+        "POD_SCHEDULING_FAILURE",
+        "POD_ASSIGNMENT_FAILURE",
+        "ALLOCATION_TIMEOUT",
+        "ALLOCATION_TIMEOUT_NO_UNALLOCATED_CLUSTERS",
+        "ALLOCATION_TIMEOUT_NO_MATCHED_CLUSTERS",
+        "ALLOCATION_TIMEOUT_NO_READY_CLUSTERS",
+        "ALLOCATION_TIMEOUT_NO_WARMED_UP_CLUSTERS",
+        "ALLOCATION_TIMEOUT_NODE_DAEMON_NOT_READY",
+        "ALLOCATION_TIMEOUT_NO_HEALTHY_CLUSTERS",
+        "NETVISOR_SETUP_TIMEOUT",
+        "NO_MATCHED_K8S_TESTING_TAG",
+        "CLOUD_PROVIDER_RESOURCE_STOCKOUT_DUE_TO_MISCONFIG",
+        "GKE_BASED_CLUSTER_TERMINATION",
+        "ALLOCATION_TIMEOUT_NO_HEALTHY_AND_WARMED_UP_CLUSTERS",
+        "DOCKER_INVALID_OS_EXCEPTION",
+        "DOCKER_CONTAINER_CREATION_EXCEPTION",
+        "DOCKER_IMAGE_TOO_LARGE_FOR_INSTANCE_EXCEPTION",
+        "DNS_RESOLUTION_ERROR",
+        "GCP_DENIED_BY_ORG_POLICY",
+        "SECRET_PERMISSION_DENIED",
+        "NETWORK_CHECK_NIC_FAILURE",
+        "NETWORK_CHECK_DNS_SERVER_FAILURE",
+        "NETWORK_CHECK_STORAGE_FAILURE",
+        "NETWORK_CHECK_METADATA_ENDPOINT_FAILURE",
+        "NETWORK_CHECK_CONTROL_PLANE_FAILURE",
+        "NETWORK_CHECK_MULTIPLE_COMPONENTS_FAILURE",
+        "DRIVER_UNHEALTHY",
+        "USAGE_POLICY_ENTITLEMENT_DENIED",
+        "K8S_ACTIVE_POD_QUOTA_EXCEEDED",
+        "CLOUD_ACCOUNT_POD_QUOTA_EXCEEDED",
+        "NETWORK_CHECK_NIC_FAILURE_DUE_TO_MISCONFIG",
+        "NETWORK_CHECK_DNS_SERVER_FAILURE_DUE_TO_MISCONFIG",
+        "NETWORK_CHECK_STORAGE_FAILURE_DUE_TO_MISCONFIG",
+        "NETWORK_CHECK_METADATA_ENDPOINT_FAILURE_DUE_TO_MISCONFIG",
+        "NETWORK_CHECK_CONTROL_PLANE_FAILURE_DUE_TO_MISCONFIG",
+        "NETWORK_CHECK_MULTIPLE_COMPONENTS_FAILURE_DUE_TO_MISCONFIG",
+        "DBR_IMAGE_RESOLUTION_FAILURE",
+        "CONTROL_PLANE_CONNECTION_FAILURE",
+        "CONTROL_PLANE_CONNECTION_FAILURE_DUE_TO_MISCONFIG",
+        "RATE_LIMITED",
+        "MTLS_PORT_CONNECTIVITY_FAILURE",
+        "HIVEMETASTORE_CONNECTIVITY_FAILURE"
+      ],
+      "enum_launch_stages": {
+        "ABUSE_DETECTED": "GA",
+        "ACCESS_TOKEN_FAILURE": "GA",
+        "ALLOCATION_TIMEOUT": "GA",
+        "ALLOCATION_TIMEOUT_NODE_DAEMON_NOT_READY": "GA",
+        "ALLOCATION_TIMEOUT_NO_HEALTHY_AND_WARMED_UP_CLUSTERS": "GA",
+        "ALLOCATION_TIMEOUT_NO_HEALTHY_CLUSTERS": "GA",
+        "ALLOCATION_TIMEOUT_NO_MATCHED_CLUSTERS": "GA",
+        "ALLOCATION_TIMEOUT_NO_READY_CLUSTERS": "GA",
+        "ALLOCATION_TIMEOUT_NO_UNALLOCATED_CLUSTERS": "GA",
+        "ALLOCATION_TIMEOUT_NO_WARMED_UP_CLUSTERS": "GA",
+        "ATTACH_PROJECT_FAILURE": "GA",
+        "AWS_AUTHORIZATION_FAILURE": "GA",
+        "AWS_INACCESSIBLE_KMS_KEY_FAILURE": "GA",
+        "AWS_INSTANCE_PROFILE_UPDATE_FAILURE": "GA",
+        "AWS_INSUFFICIENT_FREE_ADDRESSES_IN_SUBNET_FAILURE": "GA",
+        "AWS_INSUFFICIENT_INSTANCE_CAPACITY_FAILURE": "GA",
+        "AWS_INVALID_KEY_PAIR": "GA",
+        "AWS_INVALID_KMS_KEY_STATE": "GA",
+        "AWS_MAX_SPOT_INSTANCE_COUNT_EXCEEDED_FAILURE": "GA",
+        "AWS_REQUEST_LIMIT_EXCEEDED": "GA",
+        "AWS_RESOURCE_QUOTA_EXCEEDED": "GA",
+        "AWS_UNSUPPORTED_FAILURE": "GA",
+        "AZURE_BYOK_KEY_PERMISSION_FAILURE": "GA",
+        "AZURE_EPHEMERAL_DISK_FAILURE": "GA",
+        "AZURE_INVALID_DEPLOYMENT_TEMPLATE": "GA",
+        "AZURE_OPERATION_NOT_ALLOWED_EXCEPTION": "GA",
+        "AZURE_PACKED_DEPLOYMENT_PARTIAL_FAILURE": "GA",
+        "AZURE_QUOTA_EXCEEDED_EXCEPTION": "GA",
+        "AZURE_RESOURCE_MANAGER_THROTTLING": "GA",
+        "AZURE_RESOURCE_PROVIDER_THROTTLING": "GA",
+        "AZURE_UNEXPECTED_DEPLOYMENT_TEMPLATE_FAILURE": "GA",
+        "AZURE_VM_EXTENSION_FAILURE": "GA",
+        "AZURE_VNET_CONFIGURATION_FAILURE": "GA",
+        "BOOTSTRAP_TIMEOUT": "GA",
+        "BOOTSTRAP_TIMEOUT_CLOUD_PROVIDER_EXCEPTION": "GA",
+        "BOOTSTRAP_TIMEOUT_DUE_TO_MISCONFIG": "GA",
+        "BUDGET_POLICY_LIMIT_ENFORCEMENT_ACTIVATED": "GA",
+        "BUDGET_POLICY_RESOLUTION_FAILURE": "GA",
+        "CLOUD_ACCOUNT_POD_QUOTA_EXCEEDED": "GA",
+        "CLOUD_ACCOUNT_SETUP_FAILURE": "GA",
+        "CLOUD_OPERATION_CANCELLED": "GA",
+        "CLOUD_PROVIDER_DISK_SETUP_FAILURE": "GA",
+        "CLOUD_PROVIDER_INSTANCE_NOT_LAUNCHED": "GA",
+        "CLOUD_PROVIDER_LAUNCH_FAILURE": "GA",
+        "CLOUD_PROVIDER_LAUNCH_FAILURE_DUE_TO_MISCONFIG": "GA",
+        "CLOUD_PROVIDER_RESOURCE_STOCKOUT": "GA",
+        "CLOUD_PROVIDER_RESOURCE_STOCKOUT_DUE_TO_MISCONFIG": "GA",
+        "CLOUD_PROVIDER_SHUTDOWN": "GA",
+        "CLUSTER_OPERATION_THROTTLED": "GA",
+        "CLUSTER_OPERATION_TIMEOUT": "GA",
+        "COMMUNICATION_LOST": "GA",
+        "CONTAINER_LAUNCH_FAILURE": "GA",
+        "CONTROL_PLANE_CONNECTION_FAILURE": "GA",
+        "CONTROL_PLANE_CONNECTION_FAILURE_DUE_TO_MISCONFIG": "GA",
+        "CONTROL_PLANE_REQUEST_FAILURE": "GA",
+        "CONTROL_PLANE_REQUEST_FAILURE_DUE_TO_MISCONFIG": "GA",
+        "DATABASE_CONNECTION_FAILURE": "GA",
+        "DATA_ACCESS_CONFIG_CHANGED": "GA",
+        "DBFS_COMPONENT_UNHEALTHY": "GA",
+        "DBR_IMAGE_RESOLUTION_FAILURE": "GA",
+        "DISASTER_RECOVERY_REPLICATION": "GA",
+        "DNS_RESOLUTION_ERROR": "GA",
+        "DOCKER_CONTAINER_CREATION_EXCEPTION": "GA",
+        "DOCKER_IMAGE_PULL_FAILURE": "GA",
+        "DOCKER_IMAGE_TOO_LARGE_FOR_INSTANCE_EXCEPTION": "GA",
+        "DOCKER_INVALID_OS_EXCEPTION": "GA",
+        "DRIVER_EVICTION": "GA",
+        "DRIVER_LAUNCH_TIMEOUT": "GA",
+        "DRIVER_NODE_UNREACHABLE": "GA",
+        "DRIVER_OUT_OF_DISK": "GA",
+        "DRIVER_OUT_OF_MEMORY": "GA",
+        "DRIVER_POD_CREATION_FAILURE": "GA",
+        "DRIVER_UNEXPECTED_FAILURE": "GA",
+        "DRIVER_UNHEALTHY": "GA",
+        "DRIVER_UNREACHABLE": "GA",
+        "DRIVER_UNRESPONSIVE": "GA",
+        "DYNAMIC_SPARK_CONF_SIZE_EXCEEDED": "GA",
+        "EOS_SPARK_IMAGE": "GA",
+        "EXECUTION_COMPONENT_UNHEALTHY": "GA",
+        "EXECUTOR_POD_UNSCHEDULED": "GA",
+        "GCP_API_RATE_QUOTA_EXCEEDED": "GA",
+        "GCP_DENIED_BY_ORG_POLICY": "GA",
+        "GCP_FORBIDDEN": "GA",
+        "GCP_IAM_TIMEOUT": "GA",
+        "GCP_INACCESSIBLE_KMS_KEY_FAILURE": "GA",
+        "GCP_INSUFFICIENT_CAPACITY": "GA",
+        "GCP_IP_SPACE_EXHAUSTED": "GA",
+        "GCP_KMS_KEY_PERMISSION_DENIED": "GA",
+        "GCP_NOT_FOUND": "GA",
+        "GCP_QUOTA_EXCEEDED": "GA",
+        "GCP_RESOURCE_QUOTA_EXCEEDED": "GA",
+        "GCP_SERVICE_ACCOUNT_ACCESS_DENIED": "GA",
+        "GCP_SERVICE_ACCOUNT_DELETED": "GA",
+        "GCP_SERVICE_ACCOUNT_NOT_FOUND": "GA",
+        "GCP_SUBNET_NOT_READY": "GA",
+        "GCP_TRUSTED_IMAGE_PROJECTS_VIOLATED": "GA",
+        "GKE_BASED_CLUSTER_TERMINATION": "GA",
+        "GLOBAL_INIT_SCRIPT_FAILURE": "GA",
+        "HIVEMETASTORE_CONNECTIVITY_FAILURE": "GA",
+        "HIVE_METASTORE_PROVISIONING_FAILURE": "GA",
+        "IMAGE_PULL_PERMISSION_DENIED": "GA",
+        "INACTIVITY": "GA",
+        "INIT_CONTAINER_NOT_FINISHED": "GA",
+        "INIT_SCRIPT_FAILURE": "GA",
+        "INSTANCE_POOL_CLUSTER_FAILURE": "GA",
+        "INSTANCE_POOL_MAX_CAPACITY_REACHED": "GA",
+        "INSTANCE_POOL_NOT_FOUND": "GA",
+        "INSTANCE_UNREACHABLE": "GA",
+        "INSTANCE_UNREACHABLE_DUE_TO_MISCONFIG": "GA",
+        "INTERNAL_CAPACITY_FAILURE": "GA",
+        "INTERNAL_ERROR": "GA",
+        "INVALID_ARGUMENT": "GA",
+        "INVALID_AWS_PARAMETER": "GA",
+        "INVALID_INSTANCE_PLACEMENT_PROTOCOL": "GA",
+        "INVALID_SPARK_IMAGE": "GA",
+        "INVALID_WORKER_IMAGE_FAILURE": "GA",
+        "IN_PENALTY_BOX": "GA",
+        "IP_EXHAUSTION_FAILURE": "GA",
+        "JOB_FINISHED": "GA",
+        "K8S_ACTIVE_POD_QUOTA_EXCEEDED": "GA",
+        "K8S_AUTOSCALING_FAILURE": "GA",
+        "K8S_DBR_CLUSTER_LAUNCH_TIMEOUT": "GA",
+        "LAZY_ALLOCATION_TIMEOUT": "GA",
+        "MAINTENANCE_MODE": "GA",
+        "METASTORE_COMPONENT_UNHEALTHY": "GA",
+        "MTLS_PORT_CONNECTIVITY_FAILURE": "GA",
+        "NEPHOS_RESOURCE_MANAGEMENT": "GA",
+        "NETVISOR_SETUP_TIMEOUT": "GA",
+        "NETWORK_CHECK_CONTROL_PLANE_FAILURE": "GA",
+        "NETWORK_CHECK_CONTROL_PLANE_FAILURE_DUE_TO_MISCONFIG": "GA",
+        "NETWORK_CHECK_DNS_SERVER_FAILURE": "GA",
+        "NETWORK_CHECK_DNS_SERVER_FAILURE_DUE_TO_MISCONFIG": "GA",
+        "NETWORK_CHECK_METADATA_ENDPOINT_FAILURE": "GA",
+        "NETWORK_CHECK_METADATA_ENDPOINT_FAILURE_DUE_TO_MISCONFIG": "GA",
+        "NETWORK_CHECK_MULTIPLE_COMPONENTS_FAILURE": "GA",
+        "NETWORK_CHECK_MULTIPLE_COMPONENTS_FAILURE_DUE_TO_MISCONFIG": "GA",
+        "NETWORK_CHECK_NIC_FAILURE": "GA",
+        "NETWORK_CHECK_NIC_FAILURE_DUE_TO_MISCONFIG": "GA",
+        "NETWORK_CHECK_STORAGE_FAILURE": "GA",
+        "NETWORK_CHECK_STORAGE_FAILURE_DUE_TO_MISCONFIG": "GA",
+        "NETWORK_CONFIGURATION_FAILURE": "GA",
+        "NFS_MOUNT_FAILURE": "GA",
+        "NO_MATCHED_K8S": "GA",
+        "NO_MATCHED_K8S_TESTING_TAG": "GA",
+        "NPIP_TUNNEL_SETUP_FAILURE": "GA",
+        "NPIP_TUNNEL_TOKEN_FAILURE": "GA",
+        "POD_ASSIGNMENT_FAILURE": "GA",
+        "POD_SCHEDULING_FAILURE": "GA",
+        "RATE_LIMITED": "GA",
+        "REQUEST_REJECTED": "GA",
+        "REQUEST_THROTTLED": "GA",
+        "RESOURCE_USAGE_BLOCKED": "GA",
+        "SECRET_CREATION_FAILURE": "GA",
+        "SECRET_PERMISSION_DENIED": "GA",
+        "SECRET_RESOLUTION_ERROR": "GA",
+        "SECURITY_DAEMON_REGISTRATION_EXCEPTION": "GA",
+        "SELF_BOOTSTRAP_FAILURE": "GA",
+        "SERVERLESS_LONG_RUNNING_TERMINATED": "GA",
+        "SKIPPED_SLOW_NODES": "GA",
+        "SLOW_IMAGE_DOWNLOAD": "GA",
+        "SPARK_ERROR": "GA",
+        "SPARK_IMAGE_DOWNLOAD_FAILURE": "GA",
+        "SPARK_IMAGE_DOWNLOAD_THROTTLED": "GA",
+        "SPARK_IMAGE_NOT_FOUND": "GA",
+        "SPARK_STARTUP_FAILURE": "GA",
+        "SPOT_INSTANCE_TERMINATION": "GA",
+        "SSH_BOOTSTRAP_FAILURE": "GA",
+        "STORAGE_DOWNLOAD_FAILURE": "GA",
+        "STORAGE_DOWNLOAD_FAILURE_DUE_TO_MISCONFIG": "GA",
+        "STORAGE_DOWNLOAD_FAILURE_SLOW": "GA",
+        "STORAGE_DOWNLOAD_FAILURE_THROTTLED": "GA",
+        "STS_CLIENT_SETUP_FAILURE": "GA",
+        "SUBNET_EXHAUSTED_FAILURE": "GA",
+        "TEMPORARILY_UNAVAILABLE": "GA",
+        "TRIAL_EXPIRED": "GA",
+        "UNEXPECTED_LAUNCH_FAILURE": "GA",
+        "UNEXPECTED_POD_RECREATION": "GA",
+        "UNKNOWN": "GA",
+        "UNSUPPORTED_INSTANCE_TYPE": "GA",
+        "UPDATE_INSTANCE_PROFILE_FAILURE": "GA",
+        "USAGE_POLICY_ENTITLEMENT_DENIED": "GA",
+        "USER_INITIATED_VM_TERMINATION": "GA",
+        "USER_REQUEST": "GA",
+        "WORKER_SETUP_FAILURE": "GA",
+        "WORKSPACE_CANCELLED_ERROR": "GA",
+        "WORKSPACE_CONFIGURATION_ERROR": "GA",
+        "WORKSPACE_UPDATE": "GA"
+      }
+    },
+    "sql.TerminationReasonType": {
+      "description": "type of the termination",
+      "enum": [
+        "SUCCESS",
+        "CLIENT_ERROR",
+        "SERVICE_FAULT",
+        "CLOUD_FAILURE"
+      ],
+      "enum_launch_stages": {
+        "CLIENT_ERROR": "GA",
+        "CLOUD_FAILURE": "GA",
+        "SERVICE_FAULT": "GA",
+        "SUCCESS": "GA"
+      }
+    },
+    "sql.TextValue": {
+      "fields": {
+        "value": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.TimeRange": {
+      "fields": {
+        "end_time_ms": {
+          "description": "The end time in milliseconds.",
+          "launch_stage": "GA"
+        },
+        "start_time_ms": {
+          "description": "The start time in milliseconds.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.TransferOwnershipObjectId": {
+      "fields": {
+        "new_owner": {
+          "description": "Email address for the new owner, who must exist in the workspace.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.TransferOwnershipRequest": {
+      "fields": {
+        "new_owner": {
+          "description": "Email address for the new owner, who must exist in the workspace.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.TrashAlertRequest": {},
+    "sql.TrashAlertV2Request": {
+      "fields": {
+        "purge": {
+          "description": "Whether to permanently delete the alert. If not set, the alert will only be soft deleted.",
+          "launch_stage": "PRIVATE_PREVIEW",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "sql.TrashQueryRequest": {},
+    "sql.UpdateAlertRequest": {
+      "fields": {
+        "alert": {
+          "ref": "sql.UpdateAlertRequestAlert",
+          "launch_stage": "GA"
+        },
+        "auto_resolve_display_name": {
+          "description": "If true, automatically resolve alert display name conflicts. Otherwise, fail the request if the alert's display name conflicts with an existing alert's display name.",
+          "launch_stage": "GA"
+        },
+        "update_mask": {
+          "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.UpdateAlertRequestAlert": {
+      "fields": {
+        "condition": {
+          "description": "Trigger conditions of the alert.",
+          "ref": "sql.AlertCondition",
+          "launch_stage": "GA"
+        },
+        "custom_body": {
+          "description": "Custom body of alert notification, if it exists. See [here](https://docs.databricks.com/sql/user/alerts/index.html) for custom templating instructions.",
+          "launch_stage": "GA"
+        },
+        "custom_subject": {
+          "description": "Custom subject of alert notification, if it exists. This can include email subject entries and Slack notification headers, for example. See [here](https://docs.databricks.com/sql/user/alerts/index.html) for custom templating instructions.",
+          "launch_stage": "GA"
+        },
+        "display_name": {
+          "description": "The display name of the alert.",
+          "launch_stage": "GA"
+        },
+        "notify_on_ok": {
+          "description": "Whether to notify alert subscribers when alert returns back to normal.",
+          "launch_stage": "GA"
+        },
+        "owner_user_name": {
+          "description": "The owner's username. This field is set to \"Unavailable\" if the user has been deleted.",
+          "launch_stage": "GA"
+        },
+        "query_id": {
+          "description": "UUID of the query attached to the alert.",
+          "launch_stage": "GA"
+        },
+        "seconds_to_retrigger": {
+          "description": "Number of seconds an alert must wait after being triggered to rearm itself. After rearming, it can be triggered again. If 0 or not specified, the alert will not be triggered again.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.UpdateAlertV2Request": {
+      "fields": {
+        "alert": {
+          "ref": "sql.AlertV2",
+          "launch_stage": "GA"
+        },
+        "update_mask": {
+          "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.UpdateDefaultWarehouseOverrideRequest": {
+      "fields": {
+        "allow_missing": {
+          "description": "If set to true, and the override is not found, a new override will be created.\nIn this situation, `update_mask` is ignored and all fields are applied.\nDefaults to false.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "default_warehouse_override": {
+          "description": "Required. The default warehouse override to update.\nThe name field must be set in the format: default-warehouse-overrides/{default_warehouse_override_id}\nThe default_warehouse_override_id can be a numeric user ID or the literal string \"me\" for the current user.",
+          "ref": "sql.DefaultWarehouseOverride",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "update_mask": {
+          "description": "Required. Field mask specifying which fields to update.\nOnly the fields specified in the mask will be updated.\nUse \"*\" to update all fields.\nWhen allow_missing is true, this field is ignored and all fields are applied.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "sql.UpdateQueryRequest": {
+      "fields": {
+        "auto_resolve_display_name": {
+          "description": "If true, automatically resolve alert display name conflicts. Otherwise, fail the request if the alert's display name conflicts with an existing alert's display name.",
+          "launch_stage": "GA"
+        },
+        "query": {
+          "ref": "sql.UpdateQueryRequestQuery",
+          "launch_stage": "GA"
+        },
+        "update_mask": {
+          "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.UpdateQueryRequestQuery": {
+      "fields": {
+        "apply_auto_limit": {
+          "description": "Whether to apply a 1000 row limit to the query result.",
+          "launch_stage": "GA"
+        },
+        "catalog": {
+          "description": "Name of the catalog where this query will be executed.",
+          "launch_stage": "GA"
+        },
+        "description": {
+          "description": "General description that conveys additional information about this query such as usage notes.",
+          "launch_stage": "GA"
+        },
+        "display_name": {
+          "description": "Display name of the query that appears in list views, widget headings, and on the query page.",
+          "launch_stage": "GA"
+        },
+        "owner_user_name": {
+          "description": "Username of the user that owns the query.",
+          "launch_stage": "GA"
+        },
+        "parameters": {
+          "description": "List of query parameter definitions.",
+          "launch_stage": "GA"
+        },
+        "query_text": {
+          "description": "Text of the query to be run.",
+          "launch_stage": "GA"
+        },
+        "run_as_mode": {
+          "description": "Sets the \"Run as\" role for the object.",
+          "ref": "sql.RunAsMode",
+          "launch_stage": "GA"
+        },
+        "schema": {
+          "description": "Name of the schema where this query will be executed.",
+          "launch_stage": "GA"
+        },
+        "tags": {
+          "launch_stage": "GA"
+        },
+        "warehouse_id": {
+          "description": "ID of the SQL warehouse attached to the query.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.UpdateResponse": {},
+    "sql.UpdateVisualizationRequest": {
+      "fields": {
+        "update_mask": {
+          "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "visualization": {
+          "ref": "sql.UpdateVisualizationRequestVisualization",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "sql.UpdateVisualizationRequestVisualization": {
+      "fields": {
+        "display_name": {
+          "description": "The display name of the visualization.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "serialized_options": {
+          "description": "The visualization options varies widely from one visualization type to the next and is unsupported. Databricks does not recommend modifying visualization options directly.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "serialized_query_plan": {
+          "description": "The visualization query plan varies widely from one visualization type to the next and is unsupported. Databricks does not recommend modifying the visualization query plan directly.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "type": {
+          "description": "The type of visualization: counter, table, funnel, and so on.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "sql.UpdateWidgetRequest": {
+      "fields": {
+        "dashboard_id": {
+          "description": "Dashboard ID returned by :method:dashboards/create.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "options": {
+          "ref": "sql.WidgetOptions",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "text": {
+          "description": "If this is a textbox widget, the application displays this text. This field is ignored if the widget contains a visualization in the `visualization` field.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "visualization_id": {
+          "description": "Query Visualization ID returned by :method:queryvisualizations/create.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "width": {
+          "description": "Width of a widget",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "sql.User": {
+      "fields": {
+        "email": {
+          "launch_stage": "GA"
+        },
+        "id": {
+          "launch_stage": "GA"
+        },
+        "name": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.Visualization": {
+      "fields": {
+        "create_time": {
+          "description": "The timestamp indicating when the visualization was created.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "display_name": {
+          "description": "The display name of the visualization.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "id": {
+          "description": "UUID identifying the visualization.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "query_id": {
+          "description": "UUID of the query that the visualization is attached to.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "serialized_options": {
+          "description": "The visualization options varies widely from one visualization type to the next and is unsupported. Databricks does not recommend modifying visualization options directly.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "serialized_query_plan": {
+          "description": "The visualization query plan varies widely from one visualization type to the next and is unsupported. Databricks does not recommend modifying the visualization query plan directly.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "type": {
+          "description": "The type of visualization: counter, table, funnel, and so on.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "update_time": {
+          "description": "The timestamp indicating when the visualization was updated.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "sql.WarehouseAccessControlRequest": {
+      "fields": {
+        "group_name": {
+          "description": "name of the group",
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "sql.WarehousePermissionLevel",
+          "launch_stage": "GA"
+        },
+        "service_principal_name": {
+          "description": "application ID of a service principal",
+          "launch_stage": "GA"
+        },
+        "user_name": {
+          "description": "name of the user",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.WarehouseAccessControlResponse": {
+      "fields": {
+        "all_permissions": {
+          "description": "All permissions.",
+          "launch_stage": "GA"
+        },
+        "display_name": {
+          "description": "Display name of the user or service principal.",
+          "launch_stage": "GA"
+        },
+        "group_name": {
+          "description": "name of the group",
+          "launch_stage": "GA"
+        },
+        "service_principal_name": {
+          "description": "Name of the service principal.",
+          "launch_stage": "GA"
+        },
+        "user_name": {
+          "description": "name of the user",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.WarehousePermission": {
+      "fields": {
+        "inherited": {
+          "launch_stage": "GA"
+        },
+        "inherited_from_object": {
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "sql.WarehousePermissionLevel",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.WarehousePermissionLevel": {
+      "description": "Permission level",
+      "enum": [
+        "CAN_MANAGE",
+        "IS_OWNER",
+        "CAN_USE",
+        "CAN_MONITOR",
+        "CAN_VIEW"
+      ]
+    },
+    "sql.WarehousePermissions": {
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "GA"
+        },
+        "object_id": {
+          "launch_stage": "GA"
+        },
+        "object_type": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.WarehousePermissionsDescription": {
+      "fields": {
+        "description": {
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "sql.WarehousePermissionLevel",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.WarehousePermissionsRequest": {
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.WarehouseTypePair": {
+      "description": "*\nConfiguration values to enable or disable the access to specific warehouse\ntypes in the workspace.",
+      "fields": {
+        "enabled": {
+          "description": "If set to false the specific warehouse type will not be allowed as a\nvalue for warehouse_type in CreateWarehouse and EditWarehouse",
+          "launch_stage": "GA"
+        },
+        "warehouse_type": {
+          "ref": "sql.WarehouseTypePairWarehouseType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.WarehouseTypePairWarehouseType": {
+      "enum": [
+        "TYPE_UNSPECIFIED",
+        "CLASSIC",
+        "PRO",
+        "REALTIME"
+      ],
+      "enum_launch_stages": {
+        "CLASSIC": "GA",
+        "PRO": "GA",
+        "REALTIME": "PRIVATE_PREVIEW",
+        "TYPE_UNSPECIFIED": "GA"
+      }
+    },
+    "sql.Widget": {
+      "fields": {
+        "id": {
+          "description": "The unique ID for this widget.",
+          "launch_stage": "GA"
+        },
+        "options": {
+          "ref": "sql.WidgetOptions",
+          "launch_stage": "GA"
+        },
+        "visualization": {
+          "description": "The visualization description API changes frequently and is unsupported. You can duplicate a visualization by copying description objects received _from the API_ and then using them to create a new one with a POST request to the same endpoint. Databricks does not recommend constructing ad-hoc visualizations entirely in JSON.",
+          "ref": "sql.LegacyVisualization",
+          "launch_stage": "GA"
+        },
+        "width": {
+          "description": "Unused field.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.WidgetOptions": {
+      "fields": {
+        "created_at": {
+          "description": "Timestamp when this object was created",
+          "launch_stage": "GA"
+        },
+        "description": {
+          "description": "Custom description of the widget",
+          "launch_stage": "GA"
+        },
+        "isHidden": {
+          "description": "Whether this widget is hidden on the dashboard.",
+          "launch_stage": "GA"
+        },
+        "parameterMappings": {
+          "description": "How parameters used by the visualization in this widget relate to other widgets on the dashboard. Databricks does not recommend modifying this definition in JSON.",
+          "launch_stage": "GA"
+        },
+        "position": {
+          "description": "Coordinates of this widget on a dashboard. This portion of the API changes frequently and is unsupported.",
+          "ref": "sql.WidgetPosition",
+          "launch_stage": "GA"
+        },
+        "title": {
+          "description": "Custom title of the widget",
+          "launch_stage": "GA"
+        },
+        "updated_at": {
+          "description": "Timestamp of the last time this object was updated.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "sql.WidgetPosition": {
+      "description": "Coordinates of this widget on a dashboard. This portion of the API changes frequently and is unsupported.",
+      "fields": {
+        "autoHeight": {
+          "description": "reserved for internal use",
+          "launch_stage": "GA"
+        },
+        "col": {
+          "description": "column in the dashboard grid. Values start with 0",
+          "launch_stage": "GA"
+        },
+        "row": {
+          "description": "row in the dashboard grid. Values start with 0",
+          "launch_stage": "GA"
+        },
+        "sizeX": {
+          "description": "width of the widget measured in dashboard grid cells",
+          "launch_stage": "GA"
+        },
+        "sizeY": {
+          "description": "height of the widget measured in dashboard grid cells",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "supervisoragents.App": {
+      "description": "Databricks app. Supported app: custom mcp, custom agent.",
+      "fields": {
+        "name": {
+          "description": "App name",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "supervisoragents.CreateExampleRequest": {
+      "fields": {
+        "example": {
+          "description": "The example to create under the parent Supervisor Agent.",
+          "ref": "supervisoragents.Example",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "supervisoragents.CreateSupervisorAgentRequest": {
+      "fields": {
+        "supervisor_agent": {
+          "description": "The Supervisor Agent to create.",
+          "ref": "supervisoragents.SupervisorAgent",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "supervisoragents.CreateToolRequest": {
+      "fields": {
+        "tool": {
+          "ref": "supervisoragents.Tool",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "tool_id": {
+          "description": "The ID to use for the tool, which will become the final component of\nthe tool's resource name.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "supervisoragents.DeleteExampleRequest": {},
+    "supervisoragents.DeleteSupervisorAgentRequest": {},
+    "supervisoragents.DeleteToolRequest": {},
+    "supervisoragents.Example": {
+      "description": "An example associated with a Supervisor Agent.\nContains a question and guidelines for how the agent should respond.",
+      "fields": {
+        "example_id": {
+          "description": "The universally unique identifier (UUID) of the example.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "guidelines": {
+          "description": "Guidelines for answering the question.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "name": {
+          "description": "Full resource name:\nsupervisor-agents/{supervisor_agent_id}/examples/{example_id}",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "question": {
+          "description": "The example question.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "supervisoragents.GenieSpace": {
+      "fields": {
+        "id": {
+          "description": "Deprecated: use space_id instead. Still REQUIRED for backward compatibility\nuntil a future API version removes it.",
+          "deprecated": true,
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "supervisoragents.GetExampleRequest": {},
+    "supervisoragents.GetSupervisorAgentPermissionLevelsRequest": {},
+    "supervisoragents.GetSupervisorAgentPermissionLevelsResponse": {
+      "fields": {
+        "permission_levels": {
+          "description": "Specific permission levels",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "supervisoragents.GetSupervisorAgentPermissionsRequest": {},
+    "supervisoragents.GetSupervisorAgentRequest": {},
+    "supervisoragents.GetToolRequest": {},
+    "supervisoragents.KnowledgeAssistant": {
+      "fields": {
+        "knowledge_assistant_id": {
+          "description": "The ID of the knowledge assistant.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "serving_endpoint_name": {
+          "description": "Deprecated: use knowledge_assistant_id instead.",
+          "deprecated": true,
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "supervisoragents.ListExamplesRequest": {
+      "fields": {
+        "page_size": {
+          "description": "The maximum number of examples to return.\nIf unspecified, at most 100 examples will be returned.\nThe maximum value is 100; values above 100 will be coerced to 100.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "A page token, received from a previous `ListExamples` call.\nProvide this to retrieve the subsequent page.\nIf unspecified, the first page will be returned.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "supervisoragents.ListExamplesResponse": {
+      "description": "A list of Supervisor Agent examples.",
+      "fields": {
+        "examples": {
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "next_page_token": {
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "supervisoragents.ListSupervisorAgentsRequest": {
+      "fields": {
+        "page_size": {
+          "description": "The maximum number of supervisor agents to return.\nIf unspecified, at most 100 supervisor agents will be returned.\nThe maximum value is 100; values above 100 will be coerced to 100.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "A page token, received from a previous `ListSupervisorAgents` call.\nProvide this to retrieve the subsequent page.\nIf unspecified, the first page will be returned.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "supervisoragents.ListSupervisorAgentsResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "A token that can be sent as `page_token` to retrieve the next page.\nIf this field is omitted, there are no subsequent pages.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "supervisor_agents": {
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "supervisoragents.ListToolsRequest": {
+      "fields": {
+        "page_size": {
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "supervisoragents.ListToolsResponse": {
+      "fields": {
+        "next_page_token": {
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "tools": {
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "supervisoragents.SupervisorAgent": {
+      "fields": {
+        "create_time": {
+          "description": "Creation timestamp.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "creator": {
+          "description": "The creator of the Supervisor Agent.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "description": {
+          "description": "Description of what this agent can do (user-facing).",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "display_name": {
+          "description": "The display name of the Supervisor Agent, unique at workspace level.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "endpoint_name": {
+          "description": "The name of the supervisor agent's serving endpoint.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "experiment_id": {
+          "description": "The MLflow experiment ID.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "id": {
+          "description": "Deprecated: Use supervisor_agent_id instead.",
+          "deprecated": true,
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "instructions": {
+          "description": "Optional natural-language instructions for the supervisor agent.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "name": {
+          "description": "The resource name of the SupervisorAgent.\nFormat: supervisor-agents/{supervisor_agent_id}",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "supervisor_agent_id": {
+          "description": "The universally unique identifier (UUID) of the Supervisor Agent.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        }
+      }
+    },
+    "supervisoragents.SupervisorAgentAccessControlRequest": {
+      "fields": {
+        "group_name": {
+          "description": "name of the group",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "permission_level": {
+          "ref": "supervisoragents.SupervisorAgentPermissionLevel",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "service_principal_name": {
+          "description": "application ID of a service principal",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "user_name": {
+          "description": "name of the user",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "supervisoragents.SupervisorAgentAccessControlResponse": {
+      "fields": {
+        "all_permissions": {
+          "description": "All permissions.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "display_name": {
+          "description": "Display name of the user or service principal.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "group_name": {
+          "description": "name of the group",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "service_principal_name": {
+          "description": "Name of the service principal.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "user_name": {
+          "description": "name of the user",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "supervisoragents.SupervisorAgentPermission": {
+      "fields": {
+        "inherited": {
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "inherited_from_object": {
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "permission_level": {
+          "ref": "supervisoragents.SupervisorAgentPermissionLevel",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "supervisoragents.SupervisorAgentPermissionLevel": {
+      "description": "Permission level",
+      "enum": [
+        "CAN_MANAGE",
+        "CAN_QUERY"
+      ]
+    },
+    "supervisoragents.SupervisorAgentPermissions": {
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "object_id": {
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "object_type": {
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "supervisoragents.SupervisorAgentPermissionsDescription": {
+      "fields": {
+        "description": {
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "permission_level": {
+          "ref": "supervisoragents.SupervisorAgentPermissionLevel",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "supervisoragents.SupervisorAgentPermissionsRequest": {
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "supervisoragents.Tool": {
+      "fields": {
+        "app": {
+          "ref": "supervisoragents.App",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "description": {
+          "description": "Description of what this tool does (user-facing).",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "genie_space": {
+          "ref": "supervisoragents.GenieSpace",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "id": {
+          "description": "Deprecated: Use tool_id instead.",
+          "deprecated": true,
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "knowledge_assistant": {
+          "ref": "supervisoragents.KnowledgeAssistant",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "name": {
+          "description": "Full resource name:\nsupervisor-agents/{supervisor_agent_id}/tools/{tool_id}",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "tool_id": {
+          "description": "User specified id of the Tool.",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "tool_type": {
+          "description": "Tool type. Must be one of: \"genie_space\", \"knowledge_assistant\", \"uc_function\", \"uc_connection\", \"uc_mcp\", \"app\", \"volume\", \"dashboard\", \"serving_endpoint\", \"table\", \"vector_search_index\", \"catalog\", \"schema\", \"supervisor_agent\", \"databricks_web_search\", \"skill\". The legacy values \"lakeview_dashboard\", \"uc_table\", and \"web_search\" are also accepted and remain equivalent to \"dashboard\", \"table\", and \"databricks_web_search\" respectively. The \"databricks_web_search\" tool_type maps to the `web_search` spec field.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "uc_connection": {
+          "ref": "supervisoragents.UcConnection",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "uc_function": {
+          "ref": "supervisoragents.UcFunction",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "volume": {
+          "ref": "supervisoragents.Volume",
+          "launch_stage": "PUBLIC_BETA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "supervisoragents.UcConnection": {
+      "description": "Databricks UC connection. Supported connection: external mcp server.",
+      "fields": {
+        "name": {
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "supervisoragents.UcFunction": {
+      "fields": {
+        "name": {
+          "description": "Full uc function name",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "supervisoragents.UpdateExampleRequest": {
+      "fields": {
+        "example": {
+          "ref": "supervisoragents.Example",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "update_mask": {
+          "description": "Comma-delimited list of fields to update on the example.\nAllowed values: `question`, `guidelines`.\nExamples:\n- `question`\n- `question,guidelines`",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "supervisoragents.UpdateSupervisorAgentRequest": {
+      "fields": {
+        "supervisor_agent": {
+          "description": "The SupervisorAgent to update.",
+          "ref": "supervisoragents.SupervisorAgent",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "update_mask": {
+          "description": "Field mask for fields to be updated.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "supervisoragents.UpdateToolRequest": {
+      "fields": {
+        "tool": {
+          "description": "The Tool to update.",
+          "ref": "supervisoragents.Tool",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "update_mask": {
+          "description": "Field mask for fields to be updated.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "supervisoragents.Volume": {
+      "fields": {
+        "name": {
+          "description": "Full uc volume name",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "tags.CreateTagAssignmentRequest": {
+      "fields": {
+        "tag_assignment": {
+          "ref": "tags.TagAssignment",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "tags.CreateTagPolicyRequest": {
+      "fields": {
+        "tag_policy": {
+          "ref": "tags.TagPolicy",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "tags.DeleteTagAssignmentRequest": {},
+    "tags.DeleteTagPolicyRequest": {},
+    "tags.GetTagAssignmentRequest": {},
+    "tags.GetTagPolicyRequest": {},
+    "tags.ListTagAssignmentsRequest": {
+      "fields": {
+        "page_size": {
+          "description": "Optional. Maximum number of tag assignments to return in a single page",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "Pagination token to go to the next page of tag assignments. Requests first page if absent.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "tags.ListTagAssignmentsResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "Pagination token to request the next page of tag assignments",
+          "launch_stage": "GA"
+        },
+        "tag_assignments": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "tags.ListTagPoliciesRequest": {
+      "fields": {
+        "page_size": {
+          "description": "The maximum number of results to return in this request. Fewer results may be returned than requested. If\nunspecified or set to 0, this defaults to 1000. The maximum value is 1000; values above 1000 will be coerced down\nto 1000.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "page_token": {
+          "description": "An optional page token received from a previous list tag policies call.",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "tags.ListTagPoliciesResponse": {
+      "fields": {
+        "next_page_token": {
+          "launch_stage": "GA"
+        },
+        "tag_policies": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "tags.TagAssignment": {
+      "fields": {
+        "entity_id": {
+          "description": "The identifier of the entity to which the tag is assigned. For apps, the entity_id is the app name",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "entity_type": {
+          "description": "The type of entity to which the tag is assigned. Allowed values are apps, dashboards, geniespaces, notebooks",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "tag_key": {
+          "description": "The key of the tag. The characters , . : / - = and leading/trailing spaces are not allowed",
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "tag_value": {
+          "description": "The value of the tag",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        }
+      }
+    },
+    "tags.TagPolicy": {
+      "fields": {
+        "create_time": {
+          "description": "Timestamp when the tag policy was created",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "description": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL"
+          ]
+        },
+        "id": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "tag_key": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "IMMUTABLE"
+          ]
+        },
+        "update_time": {
+          "description": "Timestamp when the tag policy was last updated",
+          "launch_stage": "GA",
+          "behaviors": [
+            "OUTPUT_ONLY"
+          ]
+        },
+        "values": {
+          "launch_stage": "GA",
+          "behaviors": [
+            "OPTIONAL",
+            "UNORDERED_LIST"
+          ]
+        }
+      }
+    },
+    "tags.UpdateTagAssignmentRequest": {
+      "fields": {
+        "tag_assignment": {
+          "ref": "tags.TagAssignment",
+          "launch_stage": "GA"
+        },
+        "update_mask": {
+          "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "tags.UpdateTagPolicyRequest": {
+      "fields": {
+        "tag_policy": {
+          "ref": "tags.TagPolicy",
+          "launch_stage": "GA"
+        },
+        "update_mask": {
+          "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "tags.Value": {
+      "fields": {
+        "name": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.ColumnInfo": {
+      "fields": {
+        "name": {
+          "description": "Name of the column.",
+          "launch_stage": "GA"
+        },
+        "type_text": {
+          "description": "Data type of the column (e.g., \"string\", \"int\", \"array\u003cfloat\u003e\")",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.CreateEndpoint": {
+      "fields": {
+        "budget_policy_id": {
+          "description": "The budget policy id to be applied",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "endpoint_type": {
+          "description": "Type of endpoint",
+          "ref": "vectorsearch.EndpointType",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of the AI Search endpoint",
+          "launch_stage": "GA"
+        },
+        "target_qps": {
+          "description": "Target QPS for the endpoint. Mutually exclusive with num_replicas.\nThe actual replica count is calculated at index creation/sync time based on this value.\nBest-effort target; the system does not guarantee this QPS will be achieved.",
+          "launch_stage": "GA"
+        },
+        "usage_policy_id": {
+          "description": "The usage policy id to be applied once we've migrated to usage policies",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "vectorsearch.CreateVectorIndexRequest": {
+      "fields": {
+        "delta_sync_index_spec": {
+          "description": "Specification for Delta Sync Index. Required if `index_type` is `DELTA_SYNC`.",
+          "ref": "vectorsearch.DeltaSyncVectorIndexSpecRequest",
+          "launch_stage": "GA"
+        },
+        "direct_access_index_spec": {
+          "description": "Specification for Direct Vector Access Index. Required if `index_type` is `DIRECT_ACCESS`.",
+          "ref": "vectorsearch.DirectAccessVectorIndexSpec",
+          "launch_stage": "GA"
+        },
+        "endpoint_name": {
+          "description": "Name of the endpoint to be used for serving the index",
+          "launch_stage": "GA"
+        },
+        "index_subtype": {
+          "description": "The subtype of the index. Use `HYBRID` or `FULL_TEXT`. `VECTOR` is not supported.",
+          "ref": "vectorsearch.IndexSubtype",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "index_type": {
+          "ref": "vectorsearch.VectorIndexType",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of the index",
+          "launch_stage": "GA"
+        },
+        "primary_key": {
+          "description": "Primary key of the index",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.CustomTag": {
+      "fields": {
+        "key": {
+          "description": "Key field for an AI Search endpoint tag.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "value": {
+          "description": "[Optional] Value field for an AI Search endpoint tag.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "vectorsearch.DeleteDataResult": {
+      "fields": {
+        "failed_primary_keys": {
+          "description": "List of primary keys for rows that failed to process.",
+          "launch_stage": "GA"
+        },
+        "success_row_count": {
+          "description": "Count of successfully processed rows.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.DeleteDataStatus": {
+      "enum": [
+        "SUCCESS",
+        "PARTIAL_SUCCESS",
+        "FAILURE"
+      ],
+      "enum_launch_stages": {
+        "FAILURE": "GA",
+        "PARTIAL_SUCCESS": "GA",
+        "SUCCESS": "GA"
+      }
+    },
+    "vectorsearch.DeleteDataVectorIndexRequest": {
+      "fields": {
+        "primary_keys": {
+          "description": "List of primary keys for the data to be deleted.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.DeleteDataVectorIndexResponse": {
+      "fields": {
+        "result": {
+          "description": "Result of the upsert or delete operation.",
+          "ref": "vectorsearch.DeleteDataResult",
+          "launch_stage": "GA"
+        },
+        "status": {
+          "description": "Status of the delete operation.",
+          "ref": "vectorsearch.DeleteDataStatus",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.DeleteEndpointRequest": {},
+    "vectorsearch.DeleteEndpointResponse": {},
+    "vectorsearch.DeleteIndexRequest": {},
+    "vectorsearch.DeleteIndexResponse": {},
+    "vectorsearch.DeltaSyncVectorIndexSpecRequest": {
+      "fields": {
+        "columns_to_index": {
+          "description": "[Optional] Alias for columns_to_sync. Select the columns to include in the vector index.\nIf you leave this field blank, all columns from the source table are included.\nThe primary key column and embedding source column or embedding vector column are always included.\nOnly one of columns_to_sync or columns_to_index may be specified.",
+          "launch_stage": "GA"
+        },
+        "columns_to_sync": {
+          "description": "[Optional] Select the columns to sync with the vector index. If you leave this field blank, all columns\nfrom the source table are synced with the index. The primary key column and embedding source column or\nembedding vector column are always synced.",
+          "launch_stage": "GA"
+        },
+        "embedding_source_columns": {
+          "description": "The columns that contain the embedding source.",
+          "launch_stage": "GA"
+        },
+        "embedding_vector_columns": {
+          "description": "The columns that contain the embedding vectors.",
+          "launch_stage": "GA"
+        },
+        "embedding_writeback_table": {
+          "description": "[Optional] Name of the Delta table to sync the vector index contents and computed embeddings to.",
+          "launch_stage": "GA"
+        },
+        "pipeline_type": {
+          "description": "Pipeline execution mode.\n- `TRIGGERED`: If the pipeline uses the triggered execution mode, the system stops processing after successfully refreshing the source table in the pipeline once, ensuring the table is updated based on the data available when the update started.\n- `CONTINUOUS`: If the pipeline uses continuous execution, the pipeline processes new data as it arrives in the source table to keep vector index fresh.",
+          "ref": "vectorsearch.PipelineType",
+          "launch_stage": "GA"
+        },
+        "source_table": {
+          "description": "The name of the source table.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.DeltaSyncVectorIndexSpecResponse": {
+      "fields": {
+        "columns_to_index": {
+          "description": "[Optional] Alias for columns_to_sync. Select the columns to include in the vector index.\nIf you leave this field blank, all columns from the source table are included.\nThe primary key column and embedding source column or embedding vector column are always included.\nOnly one of columns_to_sync or columns_to_index may be specified.",
+          "launch_stage": "GA"
+        },
+        "columns_to_sync": {
+          "description": "[Optional] Select the columns to sync with the vector index. If you leave this field blank, all columns\nfrom the source table are synced with the index. The primary key column and embedding source column or\nembedding vector column are always synced.",
+          "launch_stage": "GA"
+        },
+        "embedding_source_columns": {
+          "description": "The columns that contain the embedding source.",
+          "launch_stage": "GA"
+        },
+        "embedding_vector_columns": {
+          "description": "The columns that contain the embedding vectors.",
+          "launch_stage": "GA"
+        },
+        "embedding_writeback_table": {
+          "description": "[Optional] Name of the Delta table to sync the vector index contents and computed embeddings to.",
+          "launch_stage": "GA"
+        },
+        "pipeline_id": {
+          "description": "The ID of the pipeline that is used to sync the index.",
+          "launch_stage": "GA"
+        },
+        "pipeline_type": {
+          "description": "Pipeline execution mode.\n- `TRIGGERED`: If the pipeline uses the triggered execution mode, the system stops processing after successfully refreshing the source table in the pipeline once, ensuring the table is updated based on the data available when the update started.\n- `CONTINUOUS`: If the pipeline uses continuous execution, the pipeline processes new data as it arrives in the source table to keep vector index fresh.",
+          "ref": "vectorsearch.PipelineType",
+          "launch_stage": "GA"
+        },
+        "source_table": {
+          "description": "The name of the source table.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.DirectAccessVectorIndexSpec": {
+      "fields": {
+        "embedding_source_columns": {
+          "description": "The columns that contain the embedding source. The format should be array[double].",
+          "launch_stage": "GA"
+        },
+        "embedding_vector_columns": {
+          "description": "The columns that contain the embedding vectors. The format should be array[double].",
+          "launch_stage": "GA"
+        },
+        "schema_json": {
+          "description": "The schema of the index in JSON format.\nSupported types are `integer`, `long`, `float`, `double`, `boolean`, `string`, `date`, `timestamp`.\nSupported types for vector column: `array\u003cfloat\u003e`, `array\u003cdouble\u003e`,`.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.EmbeddingSourceColumn": {
+      "fields": {
+        "embedding_model_endpoint_name": {
+          "description": "Name of the embedding model endpoint, used by default for both ingestion and querying.",
+          "launch_stage": "GA"
+        },
+        "model_endpoint_name_for_query": {
+          "description": "Name of the embedding model endpoint which, if specified, is used for querying (not ingestion).",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of the column",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.EmbeddingVectorColumn": {
+      "fields": {
+        "embedding_dimension": {
+          "description": "Dimension of the embedding vector",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of the column",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.EndpointInfo": {
+      "fields": {
+        "budget_policy_id": {
+          "description": "The user-selected budget policy id for the endpoint.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "creation_timestamp": {
+          "description": "Timestamp of endpoint creation",
+          "launch_stage": "GA"
+        },
+        "creator": {
+          "description": "Creator of the endpoint",
+          "launch_stage": "GA"
+        },
+        "custom_tags": {
+          "description": "The custom tags assigned to the endpoint",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "effective_budget_policy_id": {
+          "description": "The budget policy id applied to the endpoint",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "endpoint_status": {
+          "description": "Current status of the endpoint",
+          "ref": "vectorsearch.EndpointStatus",
+          "launch_stage": "GA"
+        },
+        "endpoint_type": {
+          "description": "Type of endpoint",
+          "ref": "vectorsearch.EndpointType",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "Unique identifier of the endpoint",
+          "launch_stage": "GA"
+        },
+        "last_updated_timestamp": {
+          "description": "Timestamp of last update to the endpoint",
+          "launch_stage": "GA"
+        },
+        "last_updated_user": {
+          "description": "User who last updated the endpoint",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of the AI Search endpoint",
+          "launch_stage": "GA"
+        },
+        "num_indexes": {
+          "description": "Number of indexes on the endpoint",
+          "launch_stage": "GA"
+        },
+        "scaling_info": {
+          "description": "Scaling information for the endpoint",
+          "ref": "vectorsearch.EndpointScalingInfo",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.EndpointScalingInfo": {
+      "description": "Scaling information for a Standard endpoint: the current scaling state, the requested QPS\ntarget, and the progress of an in-progress scaling change.",
+      "fields": {
+        "requested_target_qps": {
+          "description": "The requested QPS target for the endpoint. Best-effort; the system does not\nguarantee this QPS will be achieved.",
+          "launch_stage": "GA"
+        },
+        "state": {
+          "description": "The current state of the scaling change request.",
+          "ref": "vectorsearch.ScalingChangeState",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "vectorsearch.EndpointStatus": {
+      "description": "Status information of an endpoint",
+      "fields": {
+        "message": {
+          "description": "Additional status message",
+          "launch_stage": "GA"
+        },
+        "state": {
+          "description": "Current state of the endpoint",
+          "ref": "vectorsearch.EndpointStatusState",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.EndpointStatusState": {
+      "description": "Current state of the endpoint",
+      "enum": [
+        "PROVISIONING",
+        "ONLINE",
+        "OFFLINE",
+        "RED_STATE",
+        "YELLOW_STATE",
+        "DELETED"
+      ],
+      "enum_launch_stages": {
+        "DELETED": "GA",
+        "OFFLINE": "GA",
+        "ONLINE": "GA",
+        "PROVISIONING": "GA",
+        "RED_STATE": "GA",
+        "YELLOW_STATE": "GA"
+      }
+    },
+    "vectorsearch.EndpointType": {
+      "description": "Type of endpoint.",
+      "enum": [
+        "STORAGE_OPTIMIZED",
+        "STANDARD"
+      ],
+      "enum_launch_stages": {
+        "STANDARD": "GA",
+        "STORAGE_OPTIMIZED": "GA"
+      }
+    },
+    "vectorsearch.FacetResultData": {
+      "description": "Facet aggregation rows returned by a query.",
+      "fields": {
+        "facet_array": {
+          "description": "Facet rows. Each row is `[facet_column_name, value_or_range, count]`.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "facet_row_count": {
+          "description": "Number of facet rows returned.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "vectorsearch.GetEndpointRequest": {},
+    "vectorsearch.GetIndexRequest": {
+      "fields": {
+        "ensure_reranker_compatible": {
+          "description": "If true, the URL returned for the index is guaranteed to be compatible with the reranker.\nCurrently this means we return the CP URL regardless of how the index is being accessed.\nIf not set or set to false, the URL may still be compatible with the reranker depending on\nwhat URL we return.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.GetVectorSearchEndpointPermissionLevelsRequest": {},
+    "vectorsearch.GetVectorSearchEndpointPermissionLevelsResponse": {
+      "fields": {
+        "permission_levels": {
+          "description": "Specific permission levels",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.GetVectorSearchEndpointPermissionsRequest": {},
+    "vectorsearch.IndexSubtype": {
+      "description": "The subtype of the AI Search index, determining the indexing and retrieval strategy.\n- `VECTOR`: Not supported. Use `HYBRID` instead.\n- `FULL_TEXT`: An index that uses full-text search without vector embeddings.\n- `HYBRID`: An index that uses vector embeddings for similarity search and hybrid search.",
+      "enum": [
+        "VECTOR",
+        "FULL_TEXT",
+        "HYBRID"
+      ],
+      "enum_launch_stages": {
+        "FULL_TEXT": "PUBLIC_BETA",
+        "HYBRID": "PUBLIC_BETA",
+        "VECTOR": "PUBLIC_BETA"
+      },
+      "enum_descriptions": {
+        "FULL_TEXT": "An index that uses full-text search without vector embeddings.",
+        "HYBRID": "An index that uses vector embeddings for similarity search and hybrid search.",
+        "VECTOR": "Not supported. Use `HYBRID` instead."
+      }
+    },
+    "vectorsearch.ListEndpointResponse": {
+      "fields": {
+        "endpoints": {
+          "description": "An array of Endpoint objects",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "A token that can be used to get the next page of results. If not present, there are no more results to show.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.ListEndpointsRequest": {
+      "fields": {
+        "page_token": {
+          "description": "Token for pagination",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.ListIndexesRequest": {
+      "fields": {
+        "endpoint_name": {
+          "description": "Name of the endpoint",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Token for pagination",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.ListValue": {
+      "fields": {
+        "values": {
+          "description": "Repeated field of dynamically typed values.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.ListVectorIndexesResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "A token that can be used to get the next page of results. If not present, there are no more results to show.",
+          "launch_stage": "GA"
+        },
+        "vector_indexes": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.MapStringValueEntry": {
+      "description": "Key-value pair.",
+      "fields": {
+        "key": {
+          "description": "Column name.",
+          "launch_stage": "GA"
+        },
+        "value": {
+          "description": "Column value, nullable.",
+          "ref": "vectorsearch.Value",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.Metric": {
+      "description": "Metric specification",
+      "fields": {
+        "labels": {
+          "description": "Metric labels",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Metric name",
+          "launch_stage": "GA"
+        },
+        "percentile": {
+          "description": "Percentile for the metric",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.MetricLabel": {
+      "description": "Label for a metric",
+      "fields": {
+        "name": {
+          "description": "Label name",
+          "launch_stage": "GA"
+        },
+        "value": {
+          "description": "Label value",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.MetricValue": {
+      "description": "Single metric value at a specific timestamp",
+      "fields": {
+        "timestamp": {
+          "description": "Timestamp of the metric value (milliseconds since epoch)",
+          "launch_stage": "GA"
+        },
+        "value": {
+          "description": "Metric value",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.MetricValues": {
+      "description": "Collection of metric values for a specific metric",
+      "fields": {
+        "metric": {
+          "description": "Metric specification",
+          "ref": "vectorsearch.Metric",
+          "launch_stage": "GA"
+        },
+        "values": {
+          "description": "Time series of metric values",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.MiniVectorIndex": {
+      "fields": {
+        "creator": {
+          "description": "The user who created the index.",
+          "launch_stage": "GA"
+        },
+        "endpoint_id": {
+          "description": "ID of the endpoint associated with the index.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "endpoint_name": {
+          "description": "Name of the endpoint associated with the index",
+          "launch_stage": "GA"
+        },
+        "index_subtype": {
+          "description": "The subtype of the index.",
+          "ref": "vectorsearch.IndexSubtype",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "index_type": {
+          "ref": "vectorsearch.VectorIndexType",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of the index",
+          "launch_stage": "GA"
+        },
+        "primary_key": {
+          "description": "Primary key of the index",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.PatchEndpointBudgetPolicyRequest": {
+      "fields": {
+        "budget_policy_id": {
+          "description": "The budget policy id to be applied",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "vectorsearch.PatchEndpointBudgetPolicyResponse": {
+      "fields": {
+        "budget_policy_id": {
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "effective_budget_policy_id": {
+          "description": "The budget policy applied to the AI Search endpoint.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "vectorsearch.PatchEndpointRequest": {
+      "fields": {
+        "target_qps": {
+          "description": "Target QPS for the endpoint. Best-effort; the system does not guarantee this QPS\nwill be achieved.",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "vectorsearch.PipelineType": {
+      "description": "Pipeline execution mode.\n- `TRIGGERED`: If the pipeline uses the triggered execution mode, the system stops processing after successfully refreshing the source table in the pipeline once, ensuring the table is updated based on the data available when the update started.\n- `CONTINUOUS`: If the pipeline uses continuous execution, the pipeline processes new data as it arrives in the source table to keep vector index fresh.",
+      "enum": [
+        "TRIGGERED",
+        "CONTINUOUS"
+      ],
+      "enum_launch_stages": {
+        "CONTINUOUS": "GA",
+        "TRIGGERED": "GA"
+      },
+      "enum_descriptions": {
+        "CONTINUOUS": "If the pipeline uses continuous execution, the pipeline processes new data as it arrives in the source table to keep vector index fresh.",
+        "TRIGGERED": "If the pipeline uses the triggered execution mode, the system stops processing after successfully refreshing the source table in the pipeline once, ensuring the table is updated based on the data available when the update started."
+      }
+    },
+    "vectorsearch.QueryVectorIndexNextPageRequest": {
+      "description": "Request payload for getting next page of results.",
+      "fields": {
+        "endpoint_name": {
+          "description": "Name of the endpoint.",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Page token returned from previous `QueryVectorIndex` or `QueryVectorIndexNextPage` API.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.QueryVectorIndexRequest": {
+      "fields": {
+        "columns": {
+          "description": "List of column names to include in the response.",
+          "launch_stage": "GA"
+        },
+        "columns_to_rerank": {
+          "description": "Column names used to retrieve data to send to the reranker.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "facets": {
+          "description": "Facets to compute over the matched results. Each entry has one of these forms:\n`\"\u003ccolumn\u003e\"`                         - top 10 distinct values by count\n`\"\u003ccolumn\u003e TOP \u003cn\u003e\"`                 - top n distinct values, where n \u003e 0\n`\"\u003ccolumn\u003e BUCKETS [[from,to],...]\"` - inclusive numeric ranges\n`TOP` and `BUCKETS` are case-insensitive. A column may appear at most once.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "filters_json": {
+          "description": "JSON string representing query filters.\n\nExample filters:\n\n- `{\"id \u003c\": 5}`: Filter for id less than 5.\n- `{\"id \u003e\": 5}`: Filter for id greater than 5.\n- `{\"id \u003c=\": 5}`: Filter for id less than equal to 5.\n- `{\"id \u003e=\": 5}`: Filter for id greater than equal to 5.\n- `{\"id\": 5}`: Filter for id equal to 5.",
+          "launch_stage": "GA"
+        },
+        "num_results": {
+          "description": "Number of results to return. Defaults to 10.",
+          "launch_stage": "GA"
+        },
+        "query_columns": {
+          "description": "Text columns to search for `query_text`. When empty, all text columns are searched.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "query_text": {
+          "description": "Query text. Required for Delta Sync Index using model endpoint.",
+          "launch_stage": "GA"
+        },
+        "query_type": {
+          "description": "The query type to use. Choices are `ANN` and `HYBRID` and `FULL_TEXT`. Defaults to `ANN`.",
+          "launch_stage": "GA"
+        },
+        "query_vector": {
+          "description": "Query vector. Required for Direct Vector Access Index and Delta Sync Index using self-managed vectors.",
+          "launch_stage": "GA"
+        },
+        "reranker": {
+          "description": "If set, the top 50 results are reranked with the Databricks Reranker model before returning the `num_results` results to the user.\nThe setting `columns_to_rerank` selects which columns are used for reranking. For each datapoint, the columns selected are concatenated before\nbeing sent to the reranking model. See https://docs.databricks.com/aws/en/vector-search/query-vector-search#rerank for more information.",
+          "ref": "vectorsearch.RerankerConfig",
+          "launch_stage": "GA"
+        },
+        "score_threshold": {
+          "description": "Threshold for the approximate nearest neighbor search. Defaults to 0.0.",
+          "launch_stage": "GA"
+        },
+        "sort_columns": {
+          "description": "Sort results by column values instead of the default relevance ordering.\nEach clause has the form `\"\u003ccolumn\u003e ASC\"` or `\"\u003ccolumn\u003e DESC\"`, for example\n`[\"rating DESC\", \"price ASC\"]`.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "vectorsearch.QueryVectorIndexResponse": {
+      "fields": {
+        "facet_result": {
+          "description": "Facet aggregation rows returned by a query.",
+          "ref": "vectorsearch.FacetResultData",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "manifest": {
+          "description": "Metadata about the result set.",
+          "ref": "vectorsearch.ResultManifest",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "[Optional] Token that can be used in `QueryVectorIndexNextPage` API to get next page of results.\nIf more than 1000 results satisfy the query, they are returned in groups of 1000.\nEmpty value means no more results. The maximum number of results that can be returned is 10,000.",
+          "launch_stage": "GA"
+        },
+        "result": {
+          "description": "Data returned in the query result.",
+          "ref": "vectorsearch.ResultData",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.RerankerConfig": {
+      "fields": {
+        "model": {
+          "description": "Reranker identifier:\n- When model_type=BASE/UNSPECIFIED: must be \"databricks_reranker\".\n- When model_type=FINETUNED: the Model Serving endpoint name hosting a finetuned reranker.",
+          "launch_stage": "GA"
+        },
+        "parameters": {
+          "description": "Parameters that control how the reranker processes the query results.",
+          "ref": "vectorsearch.RerankerConfigRerankerParameters",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.RerankerConfigRerankerParameters": {
+      "fields": {
+        "columns_to_rerank": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.ResultData": {
+      "description": "Data returned in the query result.",
+      "fields": {
+        "data_array": {
+          "description": "Data rows returned in the query.",
+          "launch_stage": "GA"
+        },
+        "row_count": {
+          "description": "Number of rows in the result set.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.ResultManifest": {
+      "description": "Metadata about the result set.",
+      "fields": {
+        "column_count": {
+          "description": "Number of columns in the result set.",
+          "launch_stage": "GA"
+        },
+        "columns": {
+          "description": "Information about each column in the result set.",
+          "launch_stage": "GA"
+        },
+        "facet_column_count": {
+          "description": "Number of columns in `facet_result`.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "facet_columns": {
+          "description": "Information about each column in `facet_result`.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "vectorsearch.RetrieveUserVisibleMetricsRequest": {
+      "description": "Request to retrieve user-visible metrics",
+      "fields": {
+        "end_time": {
+          "description": "End time for metrics query",
+          "launch_stage": "GA"
+        },
+        "granularity_in_seconds": {
+          "description": "Granularity in seconds",
+          "launch_stage": "GA"
+        },
+        "metrics": {
+          "description": "List of metrics to retrieve",
+          "launch_stage": "GA"
+        },
+        "page_token": {
+          "description": "Token for pagination",
+          "launch_stage": "GA"
+        },
+        "start_time": {
+          "description": "Start time for metrics query",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.RetrieveUserVisibleMetricsResponse": {
+      "description": "Response containing user-visible metrics",
+      "fields": {
+        "metric_values": {
+          "description": "Collection of metric values",
+          "launch_stage": "GA"
+        },
+        "next_page_token": {
+          "description": "A token that can be used to get the next page of results. If not present, there are no more results to show.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.ScalingChangeState": {
+      "enum": [
+        "SCALING_CHANGE_UNSPECIFIED",
+        "SCALING_CHANGE_APPLIED",
+        "SCALING_CHANGE_IN_PROGRESS"
+      ],
+      "enum_launch_stages": {
+        "SCALING_CHANGE_APPLIED": "PUBLIC_BETA",
+        "SCALING_CHANGE_IN_PROGRESS": "PUBLIC_BETA",
+        "SCALING_CHANGE_UNSPECIFIED": "PUBLIC_BETA"
+      }
+    },
+    "vectorsearch.ScanVectorIndexRequest": {
+      "fields": {
+        "last_primary_key": {
+          "description": "Primary key of the last entry returned in the previous scan.",
+          "launch_stage": "GA"
+        },
+        "num_results": {
+          "description": "Number of results to return. Defaults to 10.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.ScanVectorIndexResponse": {
+      "description": "Response to a scan vector index request.",
+      "fields": {
+        "data": {
+          "description": "List of data entries",
+          "launch_stage": "GA"
+        },
+        "last_primary_key": {
+          "description": "Primary key of the last entry.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.Struct": {
+      "fields": {
+        "fields": {
+          "description": "Data entry, corresponding to a row in a vector index.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.SyncIndexRequest": {},
+    "vectorsearch.SyncIndexResponse": {},
+    "vectorsearch.UpdateEndpointCustomTagsRequest": {
+      "fields": {
+        "custom_tags": {
+          "description": "The new custom tags for the AI Search endpoint",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "vectorsearch.UpdateEndpointCustomTagsResponse": {
+      "fields": {
+        "custom_tags": {
+          "description": "All the custom tags that are applied to the AI Search endpoint.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "name": {
+          "description": "The name of the AI Search endpoint whose custom tags were updated.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        }
+      }
+    },
+    "vectorsearch.UpsertDataResult": {
+      "fields": {
+        "failed_primary_keys": {
+          "description": "List of primary keys for rows that failed to process.",
+          "launch_stage": "GA"
+        },
+        "success_row_count": {
+          "description": "Count of successfully processed rows.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.UpsertDataStatus": {
+      "enum": [
+        "SUCCESS",
+        "PARTIAL_SUCCESS",
+        "FAILURE"
+      ],
+      "enum_launch_stages": {
+        "FAILURE": "GA",
+        "PARTIAL_SUCCESS": "GA",
+        "SUCCESS": "GA"
+      }
+    },
+    "vectorsearch.UpsertDataVectorIndexRequest": {
+      "fields": {
+        "inputs_json": {
+          "description": "JSON string representing the data to be upserted.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.UpsertDataVectorIndexResponse": {
+      "fields": {
+        "result": {
+          "description": "Result of the upsert or delete operation.",
+          "ref": "vectorsearch.UpsertDataResult",
+          "launch_stage": "GA"
+        },
+        "status": {
+          "description": "Status of the upsert operation.",
+          "ref": "vectorsearch.UpsertDataStatus",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.Value": {
+      "fields": {
+        "bool_value": {
+          "launch_stage": "GA"
+        },
+        "list_value": {
+          "ref": "vectorsearch.ListValue",
+          "launch_stage": "GA"
+        },
+        "number_value": {
+          "launch_stage": "GA"
+        },
+        "string_value": {
+          "launch_stage": "GA"
+        },
+        "struct_value": {
+          "ref": "vectorsearch.Struct",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.VectorIndex": {
+      "fields": {
+        "creator": {
+          "description": "The user who created the index.",
+          "launch_stage": "GA"
+        },
+        "delta_sync_index_spec": {
+          "ref": "vectorsearch.DeltaSyncVectorIndexSpecResponse",
+          "launch_stage": "GA"
+        },
+        "direct_access_index_spec": {
+          "ref": "vectorsearch.DirectAccessVectorIndexSpec",
+          "launch_stage": "GA"
+        },
+        "endpoint_id": {
+          "description": "ID of the endpoint associated with the index.",
+          "launch_stage": "PRIVATE_PREVIEW"
+        },
+        "endpoint_name": {
+          "description": "Name of the endpoint associated with the index",
+          "launch_stage": "GA"
+        },
+        "index_subtype": {
+          "description": "The subtype of the index.",
+          "ref": "vectorsearch.IndexSubtype",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "index_type": {
+          "ref": "vectorsearch.VectorIndexType",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "Name of the index",
+          "launch_stage": "GA"
+        },
+        "primary_key": {
+          "description": "Primary key of the index",
+          "launch_stage": "GA"
+        },
+        "status": {
+          "ref": "vectorsearch.VectorIndexStatus",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.VectorIndexStatus": {
+      "fields": {
+        "index_url": {
+          "description": "Index API Url to be used to perform operations on the index",
+          "launch_stage": "GA"
+        },
+        "indexed_row_count": {
+          "description": "Number of rows indexed",
+          "launch_stage": "GA"
+        },
+        "message": {
+          "description": "Message associated with the index status",
+          "launch_stage": "GA"
+        },
+        "ready": {
+          "description": "Whether the index is ready for search",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.VectorIndexType": {
+      "description": "There are 2 types of AI Search indexes:\n- `DELTA_SYNC`: An index that automatically syncs with a source Delta Table, automatically and incrementally updating the index as the underlying data in the Delta Table changes.\n- `DIRECT_ACCESS`: An index that supports direct read and write of vectors and metadata through our REST and SDK APIs. With this model, the user manages index updates.",
+      "enum": [
+        "DELTA_SYNC",
+        "DIRECT_ACCESS"
+      ],
+      "enum_launch_stages": {
+        "DELTA_SYNC": "GA",
+        "DIRECT_ACCESS": "GA"
+      },
+      "enum_descriptions": {
+        "DELTA_SYNC": "An index that automatically syncs with a source Delta Table, automatically and incrementally updating the index as the underlying data in the Delta Table changes.",
+        "DIRECT_ACCESS": "An index that supports direct read and write of vectors and metadata through our REST and SDK APIs. With this model, the user manages index updates."
+      }
+    },
+    "vectorsearch.VectorSearchEndpointAccessControlRequest": {
+      "fields": {
+        "group_name": {
+          "description": "name of the group",
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "vectorsearch.VectorSearchEndpointPermissionLevel",
+          "launch_stage": "GA"
+        },
+        "service_principal_name": {
+          "description": "application ID of a service principal",
+          "launch_stage": "GA"
+        },
+        "user_name": {
+          "description": "name of the user",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.VectorSearchEndpointAccessControlResponse": {
+      "fields": {
+        "all_permissions": {
+          "description": "All permissions.",
+          "launch_stage": "GA"
+        },
+        "display_name": {
+          "description": "Display name of the user or service principal.",
+          "launch_stage": "GA"
+        },
+        "group_name": {
+          "description": "name of the group",
+          "launch_stage": "GA"
+        },
+        "service_principal_name": {
+          "description": "Name of the service principal.",
+          "launch_stage": "GA"
+        },
+        "user_name": {
+          "description": "name of the user",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.VectorSearchEndpointPermission": {
+      "fields": {
+        "inherited": {
+          "launch_stage": "GA"
+        },
+        "inherited_from_object": {
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "vectorsearch.VectorSearchEndpointPermissionLevel",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.VectorSearchEndpointPermissionLevel": {
+      "description": "Permission level",
+      "enum": [
+        "CAN_CREATE",
+        "CAN_MANAGE",
+        "CAN_USE"
+      ]
+    },
+    "vectorsearch.VectorSearchEndpointPermissions": {
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "GA"
+        },
+        "object_id": {
+          "launch_stage": "GA"
+        },
+        "object_type": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.VectorSearchEndpointPermissionsDescription": {
+      "fields": {
+        "description": {
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "vectorsearch.VectorSearchEndpointPermissionLevel",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "vectorsearch.VectorSearchEndpointPermissionsRequest": {
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.AclItem": {
+      "description": "An item representing an ACL rule applied to the given principal (user or group)\non the associated scope point.",
+      "fields": {
+        "permission": {
+          "description": "The permission level applied to the principal.",
+          "ref": "workspace.AclPermission",
+          "launch_stage": "GA"
+        },
+        "principal": {
+          "description": "The principal in which the permission is applied.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.AclPermission": {
+      "description": "The ACL permission levels for Secret ACLs applied to secret scopes.",
+      "enum": [
+        "READ",
+        "WRITE",
+        "MANAGE"
+      ],
+      "enum_launch_stages": {
+        "MANAGE": "GA",
+        "READ": "GA",
+        "WRITE": "GA"
+      }
+    },
+    "workspace.AzureKeyVaultSecretScopeMetadata": {
+      "description": "The metadata of the Azure KeyVault for a secret scope of type `AZURE_KEYVAULT`",
+      "fields": {
+        "dns_name": {
+          "description": "The DNS of the KeyVault",
+          "launch_stage": "GA"
+        },
+        "resource_id": {
+          "description": "The resource id of the azure KeyVault that user wants to associate the scope with.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.CreateCredentialsRequest": {
+      "fields": {
+        "git_email": {
+          "description": "The authenticating email associated with your Git provider user account.\nUsed for authentication with the remote repository and also sets the author \u0026 committer identity for commits.\nRequired for most Git providers except AWS CodeCommit.\nLearn more at https://docs.databricks.com/aws/en/repos/get-access-tokens-from-git-provider",
+          "launch_stage": "GA"
+        },
+        "git_provider": {
+          "description": "Git provider. This field is case-insensitive. The available Git providers are `gitHub`,\n`bitbucketCloud`, `gitLab`, `azureDevOpsServices` (Azure DevOps Services, including\nMicrosoft Entra ID authentication), `gitHubEnterprise`, `bitbucketServer` (Bitbucket\nData Center), `gitLabEnterpriseEdition` (GitLab Self-Managed), and `awsCodeCommit`.",
+          "launch_stage": "GA"
+        },
+        "git_username": {
+          "description": "The username provided with your Git provider account and associated with the\ncredential. For most Git providers it is only used to set the Git committer \u0026 author names for commits,\nhowever it may be required for authentication depending on your Git provider / token requirements.\nRequired for AWS CodeCommit.",
+          "launch_stage": "GA"
+        },
+        "is_default_for_provider": {
+          "description": "if the credential is the default for the given provider",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "name": {
+          "description": "the name of the git credential, used for identification and ease of lookup",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "personal_access_token": {
+          "description": "The personal access token used to authenticate to the corresponding Git provider.\nFor certain providers, support may exist for other types of scoped access tokens.\n[Learn more](https://docs.databricks.com/repos/get-access-tokens-from-git-provider.html).",
+          "launch_stage": "GA"
+        },
+        "principal_id": {
+          "description": "The ID of the service principal whose credentials will be modified. Only service principal managers can perform this action.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.CreateCredentialsResponse": {
+      "fields": {
+        "credential_id": {
+          "description": "ID of the credential object in the workspace.",
+          "launch_stage": "GA"
+        },
+        "git_email": {
+          "description": "The authenticating email associated with your Git provider user account.\nUsed for authentication with the remote repository and also sets the author \u0026 committer identity for commits.\nRequired for most Git providers except AWS CodeCommit.\nLearn more at https://docs.databricks.com/aws/en/repos/get-access-tokens-from-git-provider",
+          "launch_stage": "GA"
+        },
+        "git_provider": {
+          "description": "The Git provider associated with the credential.",
+          "launch_stage": "GA"
+        },
+        "git_username": {
+          "description": "The username provided with your Git provider account and associated with the\ncredential. For most Git providers it is only used to set the Git committer \u0026 author names for commits,\nhowever it may be required for authentication depending on your Git provider / token requirements.\nRequired for AWS CodeCommit.",
+          "launch_stage": "GA"
+        },
+        "is_default_for_provider": {
+          "description": "if the credential is the default for the given provider",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "name": {
+          "description": "the name of the git credential, used for identification and ease of lookup",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "workspace.CreateRepoRequest": {
+      "fields": {
+        "git_credential_id": {
+          "description": "Git credential ID to use when cloning the repository. The Git credential must be\nconfigured for the current user.",
+          "launch_stage": "GA"
+        },
+        "path": {
+          "description": "Desired path for the repo in the workspace. Almost any path in the workspace can be chosen.\nIf repo is created in `/Repos`, path must be in the format `/Repos/{folder}/{repo-name}`.",
+          "launch_stage": "GA"
+        },
+        "provider": {
+          "description": "Git provider. This field is case-insensitive. The available Git providers are `gitHub`,\n`bitbucketCloud`, `gitLab`, `azureDevOpsServices` (Azure DevOps Services, including\nMicrosoft Entra ID authentication), `gitHubEnterprise`, `bitbucketServer` (Bitbucket\nData Center), `gitLabEnterpriseEdition` (GitLab Self-Managed), and `awsCodeCommit`.",
+          "launch_stage": "GA"
+        },
+        "sparse_checkout": {
+          "description": "If specified, the repo will be created with sparse checkout enabled. You cannot enable/disable\nsparse checkout after the repo is created.",
+          "ref": "workspace.SparseCheckout",
+          "launch_stage": "GA"
+        },
+        "url": {
+          "description": "URL of the Git repository to be linked.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.CreateRepoResponse": {
+      "fields": {
+        "branch": {
+          "description": "Branch that the Git folder (repo) is checked out to.",
+          "launch_stage": "GA"
+        },
+        "head_commit_id": {
+          "description": "SHA-1 hash representing the commit ID of the current HEAD of the Git folder (repo).",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "ID of the Git folder (repo) object in the workspace.",
+          "launch_stage": "GA"
+        },
+        "path": {
+          "description": "Path of the Git folder (repo) in the workspace.",
+          "launch_stage": "GA"
+        },
+        "provider": {
+          "description": "Git provider of the linked Git repository, e.g. `gitHub`, `azureDevOpsServices`,\n`bitbucketServer` (Bitbucket Data Center), `gitLabEnterpriseEdition` (GitLab\nSelf-Managed), or `awsCodeCommit`.",
+          "launch_stage": "GA"
+        },
+        "sparse_checkout": {
+          "description": "Sparse checkout settings for the Git folder (repo).",
+          "ref": "workspace.SparseCheckout",
+          "launch_stage": "GA"
+        },
+        "url": {
+          "description": "URL of the linked Git repository.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.CreateScope": {
+      "fields": {
+        "backend_azure_keyvault": {
+          "description": "The metadata for the secret scope if the type is ``AZURE_KEYVAULT``",
+          "ref": "workspace.AzureKeyVaultSecretScopeMetadata",
+          "launch_stage": "GA"
+        },
+        "initial_manage_principal": {
+          "description": "The principal that is initially granted ``MANAGE`` permission to the created scope.",
+          "launch_stage": "GA"
+        },
+        "scope": {
+          "description": "Scope name requested by the user. Scope names are unique.",
+          "launch_stage": "GA"
+        },
+        "scope_backend_type": {
+          "description": "The backend type the scope will be created with. If not specified, will default to ``DATABRICKS``",
+          "ref": "workspace.ScopeBackendType",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.CredentialInfo": {
+      "fields": {
+        "credential_id": {
+          "description": "ID of the credential object in the workspace.",
+          "launch_stage": "GA"
+        },
+        "git_email": {
+          "description": "The authenticating email associated with your Git provider user account.\nUsed for authentication with the remote repository and also sets the author \u0026 committer identity for commits.\nRequired for most Git providers except AWS CodeCommit.\nLearn more at https://docs.databricks.com/aws/en/repos/get-access-tokens-from-git-provider",
+          "launch_stage": "GA"
+        },
+        "git_provider": {
+          "description": "The Git provider associated with the credential. One of `gitHub`, `bitbucketCloud`,\n`gitLab`, `azureDevOpsServices` (Azure DevOps Services, including Microsoft Entra ID\nauthentication), `gitHubEnterprise`, `bitbucketServer` (Bitbucket Data Center),\n`gitLabEnterpriseEdition` (GitLab Self-Managed), or `awsCodeCommit`.",
+          "launch_stage": "GA"
+        },
+        "git_username": {
+          "description": "The username provided with your Git provider account and associated with the\ncredential. For most Git providers it is only used to set the Git committer \u0026 author names for commits,\nhowever it may be required for authentication depending on your Git provider / token requirements.\nRequired for AWS CodeCommit.",
+          "launch_stage": "GA"
+        },
+        "is_default_for_provider": {
+          "description": "if the credential is the default for the given provider",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "name": {
+          "description": "the name of the git credential, used for identification and ease of lookup",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "workspace.Delete": {
+      "fields": {
+        "path": {
+          "description": "The absolute path of the notebook or directory.",
+          "launch_stage": "GA"
+        },
+        "recursive": {
+          "description": "The flag that specifies whether to delete the object recursively. It is `false` by default.\nPlease note this deleting directory is not atomic. If it fails in the middle, some of objects\nunder this directory may be deleted and cannot be undone.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.DeleteAcl": {
+      "fields": {
+        "principal": {
+          "description": "The principal to remove an existing ACL from.",
+          "launch_stage": "GA"
+        },
+        "scope": {
+          "description": "The name of the scope to remove permissions from.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.DeleteCredentialsRequest": {
+      "fields": {
+        "principal_id": {
+          "description": "The ID of the service principal whose credentials will be modified. Only service principal managers can perform this action.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.DeleteCredentialsResponse": {},
+    "workspace.DeleteRepoRequest": {},
+    "workspace.DeleteRepoResponse": {},
+    "workspace.DeleteResponse": {},
+    "workspace.DeleteScope": {
+      "fields": {
+        "scope": {
+          "description": "Name of the scope to delete.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.DeleteSecret": {
+      "fields": {
+        "key": {
+          "description": "Name of the secret to delete.",
+          "launch_stage": "GA"
+        },
+        "scope": {
+          "description": "The name of the scope that contains the secret to delete.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.DeleteSecretResponse": {},
+    "workspace.DirectoryInfo": {
+      "description": "Additional metadata about a directory.",
+      "fields": {
+        "is_git_folder": {
+          "description": "Whether the directory is a Git folder, whose contents are version-controlled by a remote Git\nrepository. How a Git folder is represented depends on whether it has Git CLI access:\n\n- A Git folder with Git CLI access has an object type of ``DIRECTORY``, with this field set\nto ``true``.\n- A standard Git folder, which does not have Git CLI access, has an object type of ``REPO``\nand does not include this field.\n- A directory that is not Git-backed has this field set to ``false``.\n\nUse this field together with ``object_type`` to identify every Git folder in a workspace.",
+          "launch_stage": "PUBLIC_BETA"
+        }
+      }
+    },
+    "workspace.ExportFormat": {
+      "description": "The format for workspace import and export.",
+      "enum": [
+        "SOURCE",
+        "HTML",
+        "JUPYTER",
+        "DBC",
+        "R_MARKDOWN",
+        "AUTO",
+        "RAW"
+      ],
+      "enum_launch_stages": {
+        "AUTO": "GA",
+        "DBC": "GA",
+        "HTML": "GA",
+        "JUPYTER": "GA",
+        "RAW": "GA",
+        "R_MARKDOWN": "GA",
+        "SOURCE": "GA"
+      }
+    },
+    "workspace.ExportRequest": {
+      "fields": {
+        "format": {
+          "description": "This specifies the format of the exported file. By default, this is `SOURCE`.\n\nThe value is case sensitive.\n\n- `SOURCE`: The notebook is exported as source code. Directory exports will not include non-notebook entries.\n- `HTML`: The notebook is exported as an HTML file.\n- `JUPYTER`: The notebook is exported as a Jupyter/IPython Notebook file.\n- `DBC`: The notebook is exported in Databricks archive format. Directory exports will not include non-notebook entries.\n- `R_MARKDOWN`: The notebook is exported to R Markdown format.\n- `AUTO`: The object or directory is exported depending on the objects type. Directory exports will include notebooks and workspace files.",
+          "ref": "workspace.ExportFormat",
+          "launch_stage": "GA"
+        },
+        "path": {
+          "description": "The absolute path of the object or directory. Exporting a directory is only supported for the `DBC`, `SOURCE`, and `AUTO` format.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.ExportResponse": {
+      "description": "The request field `direct_download` determines whether a JSON response or binary contents are returned by this endpoint.",
+      "fields": {
+        "content": {
+          "description": "The base64-encoded content.\nIf the limit (10MB) is exceeded, exception with error code **MAX_NOTEBOOK_SIZE_EXCEEDED** is thrown.",
+          "launch_stage": "GA"
+        },
+        "file_type": {
+          "description": "The file type of the exported file.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.GetAclRequest": {
+      "fields": {
+        "principal": {
+          "description": "The principal to fetch ACL information for.",
+          "launch_stage": "GA"
+        },
+        "scope": {
+          "description": "The name of the scope to fetch ACL information from.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.GetCredentialsRequest": {
+      "fields": {
+        "principal_id": {
+          "description": "The ID of the service principal whose credentials will be modified. Only service principal managers can perform this action.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.GetCredentialsResponse": {
+      "fields": {
+        "credential_id": {
+          "description": "ID of the credential object in the workspace.",
+          "launch_stage": "GA"
+        },
+        "git_email": {
+          "description": "The authenticating email associated with your Git provider user account.\nUsed for authentication with the remote repository and also sets the author \u0026 committer identity for commits.\nRequired for most Git providers except AWS CodeCommit.\nLearn more at https://docs.databricks.com/aws/en/repos/get-access-tokens-from-git-provider",
+          "launch_stage": "GA"
+        },
+        "git_provider": {
+          "description": "The Git provider associated with the credential.",
+          "launch_stage": "GA"
+        },
+        "git_username": {
+          "description": "The username provided with your Git provider account and associated with the\ncredential. For most Git providers it is only used to set the Git committer \u0026 author names for commits,\nhowever it may be required for authentication depending on your Git provider / token requirements.\nRequired for AWS CodeCommit.",
+          "launch_stage": "GA"
+        },
+        "is_default_for_provider": {
+          "description": "if the credential is the default for the given provider",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "name": {
+          "description": "the name of the git credential, used for identification and ease of lookup",
+          "launch_stage": "PUBLIC_PREVIEW"
+        }
+      }
+    },
+    "workspace.GetRepoPermissionLevelsRequest": {},
+    "workspace.GetRepoPermissionLevelsResponse": {
+      "fields": {
+        "permission_levels": {
+          "description": "Specific permission levels",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.GetRepoPermissionsRequest": {},
+    "workspace.GetRepoRequest": {},
+    "workspace.GetRepoResponse": {
+      "fields": {
+        "branch": {
+          "description": "Branch that the local version of the repo is checked out to.",
+          "launch_stage": "GA"
+        },
+        "git_cli_enabled": {
+          "description": "Whether the Git CLI is enabled for this Git folder (repo). When true, Git commands\ncan be run directly against this Git folder using the Git CLI.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "head_commit_id": {
+          "description": "SHA-1 hash representing the commit ID of the current HEAD of the repo.",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "ID of the Git folder (repo) object in the workspace.",
+          "launch_stage": "GA"
+        },
+        "path": {
+          "description": "Path of the Git folder (repo) in the workspace.",
+          "launch_stage": "GA"
+        },
+        "provider": {
+          "description": "Git provider of the linked Git repository, e.g. `gitHub`, `azureDevOpsServices`,\n`bitbucketServer` (Bitbucket Data Center), `gitLabEnterpriseEdition` (GitLab\nSelf-Managed), or `awsCodeCommit`.",
+          "launch_stage": "GA"
+        },
+        "sparse_checkout": {
+          "description": "Sparse checkout settings for the Git folder (repo).",
+          "ref": "workspace.SparseCheckout",
+          "launch_stage": "GA"
+        },
+        "url": {
+          "description": "URL of the linked Git repository.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.GetSecretRequest": {
+      "fields": {
+        "key": {
+          "description": "Name of the secret to fetch value information.",
+          "launch_stage": "GA"
+        },
+        "scope": {
+          "description": "The name of the scope that contains the secret.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.GetSecretResponse": {
+      "fields": {
+        "key": {
+          "description": "A unique name to identify the secret.",
+          "launch_stage": "GA"
+        },
+        "value": {
+          "description": "The value of the secret in its byte representation.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.GetStatusRequest": {
+      "fields": {
+        "path": {
+          "description": "The absolute path of the notebook or directory.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.GetWorkspaceObjectPermissionLevelsRequest": {},
+    "workspace.GetWorkspaceObjectPermissionLevelsResponse": {
+      "fields": {
+        "permission_levels": {
+          "description": "Specific permission levels",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.GetWorkspaceObjectPermissionsRequest": {},
+    "workspace.Import": {
+      "fields": {
+        "content": {
+          "description": "The base64-encoded content. This has a limit of 10 MB.\n\nIf the limit (10MB) is exceeded, exception with error code **MAX_NOTEBOOK_SIZE_EXCEEDED** is thrown.\nThis parameter might be absent, and instead a posted file is used.",
+          "launch_stage": "GA"
+        },
+        "format": {
+          "description": "This specifies the format of the file to be imported.\n\nThe value is case sensitive.\n\n- `AUTO`: The item is imported depending on an analysis of the item's extension and\nthe header content provided in the request. If the item is imported as a notebook,\nthen the item's extension is automatically removed.\n- `SOURCE`: The notebook or directory is imported as source code.\n- `HTML`: The notebook is imported as an HTML file.\n- `JUPYTER`: The notebook is imported as a Jupyter/IPython Notebook file.\n- `DBC`: The notebook is imported in Databricks archive format. Required for directories.\n- `R_MARKDOWN`: The notebook is imported from R Markdown format.",
+          "ref": "workspace.ImportFormat",
+          "launch_stage": "GA"
+        },
+        "language": {
+          "description": "The language of the object. This value is set only if the object type is `NOTEBOOK`.",
+          "ref": "workspace.Language",
+          "launch_stage": "GA"
+        },
+        "overwrite": {
+          "description": "The flag that specifies whether to overwrite existing object. It is `false` by default.\nFor `DBC` format, `overwrite` is not supported since it may contain a directory.",
+          "launch_stage": "GA"
+        },
+        "path": {
+          "description": "The absolute path of the object or directory. Importing a directory is only supported for the `DBC` and `SOURCE` formats.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.ImportFormat": {
+      "description": "The format for workspace import and export.",
+      "enum": [
+        "SOURCE",
+        "HTML",
+        "JUPYTER",
+        "DBC",
+        "R_MARKDOWN",
+        "AUTO",
+        "RAW"
+      ],
+      "enum_launch_stages": {
+        "AUTO": "GA",
+        "DBC": "GA",
+        "HTML": "GA",
+        "JUPYTER": "GA",
+        "RAW": "GA",
+        "R_MARKDOWN": "GA",
+        "SOURCE": "GA"
+      }
+    },
+    "workspace.ImportResponse": {},
+    "workspace.Language": {
+      "description": "The language of notebook.",
+      "enum": [
+        "SCALA",
+        "PYTHON",
+        "SQL",
+        "R"
+      ],
+      "enum_launch_stages": {
+        "PYTHON": "GA",
+        "R": "GA",
+        "SCALA": "GA",
+        "SQL": "GA"
+      }
+    },
+    "workspace.ListAclsRequest": {
+      "fields": {
+        "scope": {
+          "description": "The name of the scope to fetch ACL information from.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.ListAclsResponse": {
+      "fields": {
+        "items": {
+          "description": "The associated ACLs rule applied to principals in the given scope.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.ListCredentialsRequest": {
+      "fields": {
+        "principal_id": {
+          "description": "The ID of the service principal whose credentials will be listed. Only service principal managers can perform this action.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.ListCredentialsResponse": {
+      "fields": {
+        "credentials": {
+          "description": "List of credentials.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.ListReposRequest": {
+      "fields": {
+        "next_page_token": {
+          "description": "Token used to get the next page of results. If not specified, returns the first page of\nresults as well as a next page token if there are more results.",
+          "launch_stage": "GA"
+        },
+        "path_prefix": {
+          "description": "Filters repos that have paths starting with the given path prefix.\nIf not provided or when provided an effectively empty prefix (`/` or `/Workspace`)\nGit folders (repos) from `/Workspace/Repos` will be served.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.ListReposResponse": {
+      "fields": {
+        "next_page_token": {
+          "description": "Token that can be specified as a query parameter to the `GET /repos` endpoint to retrieve\nthe next page of results.",
+          "launch_stage": "GA"
+        },
+        "repos": {
+          "description": "List of Git folders (repos).",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.ListResponse": {
+      "fields": {
+        "objects": {
+          "description": "List of objects.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.ListScopesRequest": {},
+    "workspace.ListScopesResponse": {
+      "fields": {
+        "scopes": {
+          "description": "The available secret scopes.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.ListSecretsRequest": {
+      "fields": {
+        "scope": {
+          "description": "The name of the scope to list secrets within.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.ListSecretsResponse": {
+      "fields": {
+        "secrets": {
+          "description": "Metadata information of all secrets contained within the given scope.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.ListWorkspaceRequest": {
+      "fields": {
+        "notebooks_modified_after": {
+          "description": "UTC timestamp in milliseconds",
+          "launch_stage": "GA"
+        },
+        "path": {
+          "description": "The absolute path of the notebook or directory.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.Mkdirs": {
+      "fields": {
+        "path": {
+          "description": "The absolute path of the directory. If the parent directories do not exist, it will also create them.\nIf the directory already exists, this command will do nothing and succeed.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.MkdirsResponse": {},
+    "workspace.ObjectInfo": {
+      "description": "The information of the object in workspace. It will be returned by ``list`` and ``get-status``.",
+      "fields": {
+        "created_at": {
+          "description": "Only applicable to files. The creation UTC timestamp.",
+          "launch_stage": "GA"
+        },
+        "directory_info": {
+          "description": "Additional metadata about the directory. Only set for objects of type ``DIRECTORY``.",
+          "ref": "workspace.DirectoryInfo",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "language": {
+          "description": "The language of the object. This value is set only if the object type is ``NOTEBOOK``. For Jupyter (.ipynb) notebooks, this is always ``PYTHON``.",
+          "ref": "workspace.Language",
+          "launch_stage": "GA"
+        },
+        "modified_at": {
+          "description": "Only applicable to files, the last modified UTC timestamp.",
+          "launch_stage": "GA"
+        },
+        "object_id": {
+          "description": "Unique identifier for the object.",
+          "launch_stage": "GA"
+        },
+        "object_type": {
+          "description": "The type of the object in workspace.\n\n- `NOTEBOOK`: document that contains runnable code, visualizations, and explanatory text.\n- `DIRECTORY`: directory\n- `LIBRARY`: library\n- `FILE`: file\n- `REPO`: repository\n- `DASHBOARD`: Lakeview dashboard",
+          "ref": "workspace.ObjectType",
+          "launch_stage": "GA"
+        },
+        "path": {
+          "description": "The absolute path of the object.",
+          "launch_stage": "GA"
+        },
+        "resource_id": {
+          "description": "A unique identifier for the object that is consistent across all Databricks APIs.",
+          "launch_stage": "GA"
+        },
+        "size": {
+          "description": "Only applicable to files. The file size in bytes can be returned.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.ObjectType": {
+      "description": "The type of the object in workspace.",
+      "enum": [
+        "NOTEBOOK",
+        "DIRECTORY",
+        "LIBRARY",
+        "FILE",
+        "REPO",
+        "DASHBOARD"
+      ],
+      "enum_launch_stages": {
+        "DASHBOARD": "GA",
+        "DIRECTORY": "GA",
+        "FILE": "GA",
+        "LIBRARY": "GA",
+        "NOTEBOOK": "GA",
+        "REPO": "GA"
+      }
+    },
+    "workspace.PutAcl": {
+      "fields": {
+        "permission": {
+          "description": "The permission level applied to the principal.",
+          "ref": "workspace.AclPermission",
+          "launch_stage": "GA"
+        },
+        "principal": {
+          "description": "The principal in which the permission is applied.",
+          "launch_stage": "GA"
+        },
+        "scope": {
+          "description": "The name of the scope to apply permissions to.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.PutSecret": {
+      "fields": {
+        "bytes_value": {
+          "description": "If specified, value will be stored as bytes.",
+          "launch_stage": "GA"
+        },
+        "key": {
+          "description": "A unique name to identify the secret.",
+          "launch_stage": "GA"
+        },
+        "scope": {
+          "description": "The name of the scope to which the secret will be associated with.",
+          "launch_stage": "GA"
+        },
+        "string_value": {
+          "description": "If specified, note that the value will be stored in UTF-8 (MB4) form.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.RepoAccessControlRequest": {
+      "fields": {
+        "group_name": {
+          "description": "name of the group",
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "workspace.RepoPermissionLevel",
+          "launch_stage": "GA"
+        },
+        "service_principal_name": {
+          "description": "application ID of a service principal",
+          "launch_stage": "GA"
+        },
+        "user_name": {
+          "description": "name of the user",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.RepoAccessControlResponse": {
+      "fields": {
+        "all_permissions": {
+          "description": "All permissions.",
+          "launch_stage": "GA"
+        },
+        "display_name": {
+          "description": "Display name of the user or service principal.",
+          "launch_stage": "GA"
+        },
+        "group_name": {
+          "description": "name of the group",
+          "launch_stage": "GA"
+        },
+        "service_principal_name": {
+          "description": "Name of the service principal.",
+          "launch_stage": "GA"
+        },
+        "user_name": {
+          "description": "name of the user",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.RepoInfo": {
+      "description": "Git folder (repo) information.",
+      "fields": {
+        "branch": {
+          "description": "Name of the current git branch of the git folder (repo).",
+          "launch_stage": "GA"
+        },
+        "head_commit_id": {
+          "description": "Current git commit id of the git folder (repo).",
+          "launch_stage": "GA"
+        },
+        "id": {
+          "description": "Id of the git folder (repo) in the Workspace.",
+          "launch_stage": "GA"
+        },
+        "path": {
+          "description": "Root path of the git folder (repo) in the Workspace.",
+          "launch_stage": "GA"
+        },
+        "provider": {
+          "description": "Git provider of the remote git repository, e.g. `gitHub`, `azureDevOpsServices`,\n`bitbucketServer` (Bitbucket Data Center), `gitLabEnterpriseEdition` (GitLab\nSelf-Managed), or `awsCodeCommit`.",
+          "launch_stage": "GA"
+        },
+        "sparse_checkout": {
+          "description": "Sparse checkout config for the git folder (repo).",
+          "ref": "workspace.SparseCheckout",
+          "launch_stage": "GA"
+        },
+        "url": {
+          "description": "URL of the remote git repository.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.RepoPermission": {
+      "fields": {
+        "inherited": {
+          "launch_stage": "GA"
+        },
+        "inherited_from_object": {
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "workspace.RepoPermissionLevel",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.RepoPermissionLevel": {
+      "description": "Permission level",
+      "enum": [
+        "CAN_MANAGE",
+        "CAN_EDIT",
+        "CAN_RUN",
+        "CAN_READ"
+      ]
+    },
+    "workspace.RepoPermissions": {
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "GA"
+        },
+        "object_id": {
+          "launch_stage": "GA"
+        },
+        "object_type": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.RepoPermissionsDescription": {
+      "fields": {
+        "description": {
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "workspace.RepoPermissionLevel",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.RepoPermissionsRequest": {
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.ScopeBackendType": {
+      "description": "The types of secret scope backends in the Secret Manager. Azure KeyVault backed secret scopes\nwill be supported in a later release.",
+      "enum": [
+        "DATABRICKS",
+        "AZURE_KEYVAULT"
+      ],
+      "enum_launch_stages": {
+        "AZURE_KEYVAULT": "GA",
+        "DATABRICKS": "GA"
+      }
+    },
+    "workspace.SecretMetadata": {
+      "description": "The metadata about a secret. Returned when listing secrets. Does not contain the\nactual secret value.",
+      "fields": {
+        "key": {
+          "description": "A unique name to identify the secret.",
+          "launch_stage": "GA"
+        },
+        "last_updated_timestamp": {
+          "description": "The last updated timestamp (in milliseconds) for the secret.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.SecretScope": {
+      "description": "An organizational resource for storing secrets. Secret scopes can be\ndifferent types (Databricks-managed, Azure KeyVault backed, etc), and ACLs\ncan be applied to control permissions for all secrets within a scope.",
+      "fields": {
+        "backend_type": {
+          "description": "The type of secret scope backend.",
+          "ref": "workspace.ScopeBackendType",
+          "launch_stage": "GA"
+        },
+        "keyvault_metadata": {
+          "description": "The metadata for the secret scope if the type is ``AZURE_KEYVAULT``",
+          "ref": "workspace.AzureKeyVaultSecretScopeMetadata",
+          "launch_stage": "GA"
+        },
+        "name": {
+          "description": "A unique name to identify the secret scope.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.SparseCheckout": {
+      "description": "Sparse checkout configuration, it contains options like cone patterns.",
+      "fields": {
+        "patterns": {
+          "description": "List of sparse checkout cone patterns, see\n[cone mode handling](https://git-scm.com/docs/git-sparse-checkout#_internalscone_mode_handling)\nfor details.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.SparseCheckoutUpdate": {
+      "description": "Sparse checkout configuration, it contains options like cone patterns.",
+      "fields": {
+        "patterns": {
+          "description": "List of sparse checkout cone patterns, see\n[cone mode handling](https://git-scm.com/docs/git-sparse-checkout#_internalscone_mode_handling)\nfor details.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.UpdateCredentialsRequest": {
+      "fields": {
+        "git_email": {
+          "description": "The authenticating email associated with your Git provider user account.\nUsed for authentication with the remote repository and also sets the author \u0026 committer identity for commits.\nRequired for most Git providers except AWS CodeCommit.\nLearn more at https://docs.databricks.com/aws/en/repos/get-access-tokens-from-git-provider",
+          "launch_stage": "GA"
+        },
+        "git_provider": {
+          "description": "Git provider. This field is case-insensitive. The available Git providers are `gitHub`,\n`bitbucketCloud`, `gitLab`, `azureDevOpsServices` (Azure DevOps Services, including\nMicrosoft Entra ID authentication), `gitHubEnterprise`, `bitbucketServer` (Bitbucket\nData Center), `gitLabEnterpriseEdition` (GitLab Self-Managed), and `awsCodeCommit`.",
+          "launch_stage": "GA"
+        },
+        "git_username": {
+          "description": "The username provided with your Git provider account and associated with the\ncredential. For most Git providers it is only used to set the Git committer \u0026 author names for commits,\nhowever it may be required for authentication depending on your Git provider / token requirements.\nRequired for AWS CodeCommit.",
+          "launch_stage": "GA"
+        },
+        "is_default_for_provider": {
+          "description": "if the credential is the default for the given provider",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "name": {
+          "description": "the name of the git credential, used for identification and ease of lookup",
+          "launch_stage": "PUBLIC_PREVIEW"
+        },
+        "personal_access_token": {
+          "description": "The personal access token used to authenticate to the corresponding Git provider.\nFor certain providers, support may exist for other types of scoped access tokens.\n[Learn more](https://docs.databricks.com/repos/get-access-tokens-from-git-provider.html).",
+          "launch_stage": "GA"
+        },
+        "principal_id": {
+          "description": "The ID of the service principal whose credentials will be modified. Only service principal managers can perform this action.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.UpdateCredentialsResponse": {},
+    "workspace.UpdateRepoRequest": {
+      "fields": {
+        "branch": {
+          "description": "Branch that the local version of the repo is checked out to.",
+          "launch_stage": "GA"
+        },
+        "dangerously_force_discard_all": {
+          "description": "WARNING: DESTRUCTIVE AND IRREVERSIBLE. If true, permanently deletes ALL uncommitted\nchanges in the Git folder — staged, unstaged, and untracked files — before updating.\nLost data CANNOT be recovered.\n\nNEVER use this on Git folders where users author or edit files. This flag is intended\nONLY for automated jobs that treat the Git folder as a read-only mirror of a remote\nbranch and need to force-sync it. If any user has uncommitted work in the Git folder,\nthat work will be permanently destroyed without warning.\n\nLocal commits that have been made but not yet pushed to the remote are preserved.",
+          "launch_stage": "PUBLIC_BETA"
+        },
+        "git_credential_id": {
+          "description": "Git credential ID to use for this update operation. The Git credential must be\nconfigured for the current user.",
+          "launch_stage": "GA"
+        },
+        "sparse_checkout": {
+          "description": "If specified, update the sparse checkout settings. The update will fail if sparse checkout is\nnot enabled for the repo.",
+          "ref": "workspace.SparseCheckoutUpdate",
+          "launch_stage": "GA"
+        },
+        "tag": {
+          "description": "Tag that the local version of the repo is checked out to. Updating the repo to a tag puts\nthe repo in a detached HEAD state. Before committing new changes, you must update the repo to\na branch instead of the detached HEAD.",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.UpdateRepoResponse": {},
+    "workspace.WorkspaceObjectAccessControlRequest": {
+      "fields": {
+        "group_name": {
+          "description": "name of the group",
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "workspace.WorkspaceObjectPermissionLevel",
+          "launch_stage": "GA"
+        },
+        "service_principal_name": {
+          "description": "application ID of a service principal",
+          "launch_stage": "GA"
+        },
+        "user_name": {
+          "description": "name of the user",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.WorkspaceObjectAccessControlResponse": {
+      "fields": {
+        "all_permissions": {
+          "description": "All permissions.",
+          "launch_stage": "GA"
+        },
+        "display_name": {
+          "description": "Display name of the user or service principal.",
+          "launch_stage": "GA"
+        },
+        "group_name": {
+          "description": "name of the group",
+          "launch_stage": "GA"
+        },
+        "service_principal_name": {
+          "description": "Name of the service principal.",
+          "launch_stage": "GA"
+        },
+        "user_name": {
+          "description": "name of the user",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.WorkspaceObjectPermission": {
+      "fields": {
+        "inherited": {
+          "launch_stage": "GA"
+        },
+        "inherited_from_object": {
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "workspace.WorkspaceObjectPermissionLevel",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.WorkspaceObjectPermissionLevel": {
+      "description": "Permission level",
+      "enum": [
+        "CAN_MANAGE",
+        "CAN_EDIT",
+        "CAN_RUN",
+        "CAN_READ"
+      ]
+    },
+    "workspace.WorkspaceObjectPermissions": {
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "GA"
+        },
+        "object_id": {
+          "launch_stage": "GA"
+        },
+        "object_type": {
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.WorkspaceObjectPermissionsDescription": {
+      "fields": {
+        "description": {
+          "launch_stage": "GA"
+        },
+        "permission_level": {
+          "ref": "workspace.WorkspaceObjectPermissionLevel",
+          "launch_stage": "GA"
+        }
+      }
+    },
+    "workspace.WorkspaceObjectPermissionsRequest": {
+      "fields": {
+        "access_control_list": {
+          "launch_stage": "GA"
+        }
+      }
+    }
+  },
+  "commands": {
+    "services": [
+      {
+        "id": "iam.AccessControl",
+        "name": "AccessControl",
+        "description": "Rule based Access Control for Databricks Resources.",
+        "package": {
+          "name": "iam"
+        },
+        "is_hidden_cli": true,
+        "docs_group": "iam",
+        "launch_stage": "PRIVATE_PREVIEW",
+        "cli_launch_stage_display": "Private Preview",
+        "methods": [
+          {
+            "name": "CheckPolicy",
+            "description": "Check access policy to a resource.",
+            "summary": "Check access policy to a resource.",
+            "path": "/api/2.0/access-control/check-policy-v2",
+            "can_use_json": true,
+            "must_use_json": true,
+            "is_crud_read": true,
+            "is_hidden_cli": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "CheckPolicyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "actor",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "pascal_name": "Actor",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "permission",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "resource",
+                  "description": "Ex: (servicePrincipal/use, accounts/\u003caccount-id\u003e/servicePrincipals/\u003csp-id\u003e)\nEx: (servicePrincipal.ruleSet/update, accounts/\u003caccount-id\u003e/servicePrincipals/\u003csp-id\u003e/ruleSets/default)",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "consistency_token",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "pascal_name": "ConsistencyToken",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "authz_identity",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "pascal_name": "RequestAuthzIdentity",
+                    "enum": [
+                      {
+                        "content": "REQUEST_AUTHZ_IDENTITY_SERVICE_IDENTITY"
+                      },
+                      {
+                        "content": "REQUEST_AUTHZ_IDENTITY_USER_CONTEXT"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "actor",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "pascal_name": "Actor",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "permission",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "resource",
+                  "description": "Ex: (servicePrincipal/use, accounts/\u003caccount-id\u003e/servicePrincipals/\u003csp-id\u003e)\nEx: (servicePrincipal.ruleSet/update, accounts/\u003caccount-id\u003e/servicePrincipals/\u003csp-id\u003e/ruleSets/default)",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "consistency_token",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "pascal_name": "ConsistencyToken",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "authz_identity",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "pascal_name": "RequestAuthzIdentity",
+                    "enum": [
+                      {
+                        "content": "REQUEST_AUTHZ_IDENTITY_SERVICE_IDENTITY"
+                      },
+                      {
+                        "content": "REQUEST_AUTHZ_IDENTITY_USER_CONTEXT"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CheckPolicyResponse",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "consistency_token",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ConsistencyToken",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "consistency_token",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ConsistencyToken",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "actor",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "Actor",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "authz_identity",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "RequestAuthzIdentity",
+                  "enum": [
+                    {
+                      "content": "REQUEST_AUTHZ_IDENTITY_SERVICE_IDENTITY"
+                    },
+                    {
+                      "content": "REQUEST_AUTHZ_IDENTITY_USER_CONTEXT"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "consistency_token",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "ConsistencyToken",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "permission",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "resource",
+                "description": "Ex: (servicePrincipal/use, accounts/\u003caccount-id\u003e/servicePrincipals/\u003csp-id\u003e)\nEx: (servicePrincipal.ruleSet/update, accounts/\u003caccount-id\u003e/servicePrincipals/\u003csp-id\u003e/ruleSets/default)",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "resource_info",
+                "is_query": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "ResourceInfo",
+                  "is_object": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "iam.AccountAccessControl",
+        "name": "AccountAccessControl",
+        "description": "These APIs manage access rules on resources in an account. Currently, only grant rules are\nsupported. A grant rule specifies a role assigned to a set of principals. A list of rules\nattached to a resource is called a rule set.",
+        "package": {
+          "name": "iam"
+        },
+        "is_accounts": true,
+        "docs_group": "iam",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "methods": [
+          {
+            "name": "GetAssignableRolesForResource",
+            "description": "Gets all the roles that can be granted on an account level resource. A role is grantable if the rule set on the\nresource can contain an access rule of the role.",
+            "summary": "Get assignable roles for a resource.",
+            "path": "/api/2.0/preview/accounts/{account_id}/access-control/assignable-roles",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetAssignableRolesForResourceRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "resource",
+                  "description": "The resource name for which assignable roles will be listed.\n\nExamples | Summary\n:--- | :---\n`resource=accounts/\u003cACCOUNT_ID\u003e` | A resource name for the account.\n`resource=accounts/\u003cACCOUNT_ID\u003e/groups/\u003cGROUP_ID\u003e` | A resource name for the group.\n`resource=accounts/\u003cACCOUNT_ID\u003e/servicePrincipals/\u003cSP_ID\u003e` | A resource name for the service principal.\n`resource=accounts/\u003cACCOUNT_ID\u003e/tagPolicies/\u003cTAG_POLICY_ID\u003e` | A resource name for the tag policy.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "resource",
+                  "description": "The resource name for which assignable roles will be listed.\n\nExamples | Summary\n:--- | :---\n`resource=accounts/\u003cACCOUNT_ID\u003e` | A resource name for the account.\n`resource=accounts/\u003cACCOUNT_ID\u003e/groups/\u003cGROUP_ID\u003e` | A resource name for the group.\n`resource=accounts/\u003cACCOUNT_ID\u003e/servicePrincipals/\u003cSP_ID\u003e` | A resource name for the service principal.\n`resource=accounts/\u003cACCOUNT_ID\u003e/tagPolicies/\u003cTAG_POLICY_ID\u003e` | A resource name for the tag policy.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetAssignableRolesForResourceResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "resource",
+                "description": "The resource name for which assignable roles will be listed.\n\nExamples | Summary\n:--- | :---\n`resource=accounts/\u003cACCOUNT_ID\u003e` | A resource name for the account.\n`resource=accounts/\u003cACCOUNT_ID\u003e/groups/\u003cGROUP_ID\u003e` | A resource name for the group.\n`resource=accounts/\u003cACCOUNT_ID\u003e/servicePrincipals/\u003cSP_ID\u003e` | A resource name for the service principal.\n`resource=accounts/\u003cACCOUNT_ID\u003e/tagPolicies/\u003cTAG_POLICY_ID\u003e` | A resource name for the tag policy.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "resource",
+                "description": "The resource name for which assignable roles will be listed.\n\nExamples | Summary\n:--- | :---\n`resource=accounts/\u003cACCOUNT_ID\u003e` | A resource name for the account.\n`resource=accounts/\u003cACCOUNT_ID\u003e/groups/\u003cGROUP_ID\u003e` | A resource name for the group.\n`resource=accounts/\u003cACCOUNT_ID\u003e/servicePrincipals/\u003cSP_ID\u003e` | A resource name for the service principal.\n`resource=accounts/\u003cACCOUNT_ID\u003e/tagPolicies/\u003cTAG_POLICY_ID\u003e` | A resource name for the tag policy.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetRuleSet",
+            "description": "Get a rule set by its name. A rule set is always attached to a resource and contains a list of access rules on the\nsaid resource. Currently only a default rule set for each resource is supported.",
+            "summary": "Get a rule set.",
+            "path": "/api/2.0/preview/accounts/{account_id}/access-control/rule-sets",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetRuleSetRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The ruleset name associated with the request.\n\nExamples | Summary\n:--- | :---\n`name=accounts/\u003cACCOUNT_ID\u003e/ruleSets/default` | A name for a rule set on the account.\n`name=accounts/\u003cACCOUNT_ID\u003e/groups/\u003cGROUP_ID\u003e/ruleSets/default` | A name for a rule set on the group.\n`name=accounts/\u003cACCOUNT_ID\u003e/servicePrincipals/\u003cSERVICE_PRINCIPAL_APPLICATION_ID\u003e/ruleSets/default` | A name for a rule set on the service principal.\n`name=accounts/\u003cACCOUNT_ID\u003e/tagPolicies/\u003cTAG_POLICY_ID\u003e/ruleSets/default` | A name for a rule set on the tag policy.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "etag",
+                  "description": "Etag used for versioning. The response is at least as fresh as the eTag provided. Etag is used for optimistic\nconcurrency control as a way to help prevent simultaneous updates of a rule set from overwriting each other. It is\nstrongly suggested that systems make use of the etag in the read -\u003e modify -\u003e write pattern to perform rule set\nupdates in order to avoid race conditions that is get an etag from a GET rule set request, and pass it with the\nPUT update request to identify the rule set version you are updating.\n\nExamples | Summary\n:--- | :---\n`etag=` | An empty etag can only be used in GET to indicate no freshness requirements.\n`etag=RENUAAABhSweA4NvVmmUYdiU717H3Tgy0UJdor3gE4a+mq/oj9NjAf8ZsQ==` | An etag encoded a specific version of the rule set to get or to be updated.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The ruleset name associated with the request.\n\nExamples | Summary\n:--- | :---\n`name=accounts/\u003cACCOUNT_ID\u003e/ruleSets/default` | A name for a rule set on the account.\n`name=accounts/\u003cACCOUNT_ID\u003e/groups/\u003cGROUP_ID\u003e/ruleSets/default` | A name for a rule set on the group.\n`name=accounts/\u003cACCOUNT_ID\u003e/servicePrincipals/\u003cSERVICE_PRINCIPAL_APPLICATION_ID\u003e/ruleSets/default` | A name for a rule set on the service principal.\n`name=accounts/\u003cACCOUNT_ID\u003e/tagPolicies/\u003cTAG_POLICY_ID\u003e/ruleSets/default` | A name for a rule set on the tag policy.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "etag",
+                  "description": "Etag used for versioning. The response is at least as fresh as the eTag provided. Etag is used for optimistic\nconcurrency control as a way to help prevent simultaneous updates of a rule set from overwriting each other. It is\nstrongly suggested that systems make use of the etag in the read -\u003e modify -\u003e write pattern to perform rule set\nupdates in order to avoid race conditions that is get an etag from a GET rule set request, and pass it with the\nPUT update request to identify the rule set version you are updating.\n\nExamples | Summary\n:--- | :---\n`etag=` | An empty etag can only be used in GET to indicate no freshness requirements.\n`etag=RENUAAABhSweA4NvVmmUYdiU717H3Tgy0UJdor3gE4a+mq/oj9NjAf8ZsQ==` | An etag encoded a specific version of the rule set to get or to be updated.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "RuleSetResponse",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the rule set.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "etag",
+                  "description": "Identifies the version of the rule set returned.\nEtag used for versioning. The response is at least as fresh as the eTag provided.\nEtag is used for optimistic concurrency control as a way to help prevent simultaneous\nupdates of a rule set from overwriting each other. It is strongly suggested that systems\nmake use of the etag in the read -\u003e modify -\u003e write pattern to perform rule set updates in\norder to avoid race conditions that is get an etag from a GET rule set request, and pass it\nwith the PUT update request to identify the rule set version you are updating.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the rule set.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "etag",
+                  "description": "Identifies the version of the rule set returned.\nEtag used for versioning. The response is at least as fresh as the eTag provided.\nEtag is used for optimistic concurrency control as a way to help prevent simultaneous\nupdates of a rule set from overwriting each other. It is strongly suggested that systems\nmake use of the etag in the read -\u003e modify -\u003e write pattern to perform rule set updates in\norder to avoid race conditions that is get an etag from a GET rule set request, and pass it\nwith the PUT update request to identify the rule set version you are updating.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "Etag used for versioning. The response is at least as fresh as the eTag provided. Etag is used for optimistic\nconcurrency control as a way to help prevent simultaneous updates of a rule set from overwriting each other. It is\nstrongly suggested that systems make use of the etag in the read -\u003e modify -\u003e write pattern to perform rule set\nupdates in order to avoid race conditions that is get an etag from a GET rule set request, and pass it with the\nPUT update request to identify the rule set version you are updating.\n\nExamples | Summary\n:--- | :---\n`etag=` | An empty etag can only be used in GET to indicate no freshness requirements.\n`etag=RENUAAABhSweA4NvVmmUYdiU717H3Tgy0UJdor3gE4a+mq/oj9NjAf8ZsQ==` | An etag encoded a specific version of the rule set to get or to be updated.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The ruleset name associated with the request.\n\nExamples | Summary\n:--- | :---\n`name=accounts/\u003cACCOUNT_ID\u003e/ruleSets/default` | A name for a rule set on the account.\n`name=accounts/\u003cACCOUNT_ID\u003e/groups/\u003cGROUP_ID\u003e/ruleSets/default` | A name for a rule set on the group.\n`name=accounts/\u003cACCOUNT_ID\u003e/servicePrincipals/\u003cSERVICE_PRINCIPAL_APPLICATION_ID\u003e/ruleSets/default` | A name for a rule set on the service principal.\n`name=accounts/\u003cACCOUNT_ID\u003e/tagPolicies/\u003cTAG_POLICY_ID\u003e/ruleSets/default` | A name for a rule set on the tag policy.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The ruleset name associated with the request.\n\nExamples | Summary\n:--- | :---\n`name=accounts/\u003cACCOUNT_ID\u003e/ruleSets/default` | A name for a rule set on the account.\n`name=accounts/\u003cACCOUNT_ID\u003e/groups/\u003cGROUP_ID\u003e/ruleSets/default` | A name for a rule set on the group.\n`name=accounts/\u003cACCOUNT_ID\u003e/servicePrincipals/\u003cSERVICE_PRINCIPAL_APPLICATION_ID\u003e/ruleSets/default` | A name for a rule set on the service principal.\n`name=accounts/\u003cACCOUNT_ID\u003e/tagPolicies/\u003cTAG_POLICY_ID\u003e/ruleSets/default` | A name for a rule set on the tag policy.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "etag",
+                "description": "Etag used for versioning. The response is at least as fresh as the eTag provided. Etag is used for optimistic\nconcurrency control as a way to help prevent simultaneous updates of a rule set from overwriting each other. It is\nstrongly suggested that systems make use of the etag in the read -\u003e modify -\u003e write pattern to perform rule set\nupdates in order to avoid race conditions that is get an etag from a GET rule set request, and pass it with the\nPUT update request to identify the rule set version you are updating.\n\nExamples | Summary\n:--- | :---\n`etag=` | An empty etag can only be used in GET to indicate no freshness requirements.\n`etag=RENUAAABhSweA4NvVmmUYdiU717H3Tgy0UJdor3gE4a+mq/oj9NjAf8ZsQ==` | An etag encoded a specific version of the rule set to get or to be updated.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateRuleSet",
+            "description": "Replace the rules of a rule set. First, use get to read the current version of the rule set before modifying it.\nThis pattern helps prevent conflicts between concurrent updates.",
+            "summary": "Update a rule set.",
+            "path": "/api/2.0/preview/accounts/{account_id}/access-control/rule-sets",
+            "can_use_json": true,
+            "must_use_json": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "UpdateRuleSetRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the rule set.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "rule_set",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "RuleSetUpdateRequest",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the rule set.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "rule_set",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "RuleSetUpdateRequest",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "RuleSetResponse",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the rule set.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "etag",
+                  "description": "Identifies the version of the rule set returned.\nEtag used for versioning. The response is at least as fresh as the eTag provided.\nEtag is used for optimistic concurrency control as a way to help prevent simultaneous\nupdates of a rule set from overwriting each other. It is strongly suggested that systems\nmake use of the etag in the read -\u003e modify -\u003e write pattern to perform rule set updates in\norder to avoid race conditions that is get an etag from a GET rule set request, and pass it\nwith the PUT update request to identify the rule set version you are updating.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the rule set.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "etag",
+                  "description": "Identifies the version of the rule set returned.\nEtag used for versioning. The response is at least as fresh as the eTag provided.\nEtag is used for optimistic concurrency control as a way to help prevent simultaneous\nupdates of a rule set from overwriting each other. It is strongly suggested that systems\nmake use of the etag in the read -\u003e modify -\u003e write pattern to perform rule set updates in\norder to avoid race conditions that is get an etag from a GET rule set request, and pass it\nwith the PUT update request to identify the rule set version you are updating.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Name of the rule set.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "rule_set",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "RuleSetUpdateRequest",
+                  "is_object": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "iam.AccountAccessControlProxy",
+        "name": "AccountAccessControlProxy",
+        "description": "These APIs manage access rules on resources in an account. Currently, only grant rules are\nsupported. A grant rule specifies a role assigned to a set of principals. A list of rules\nattached to a resource is called a rule set. A workspace must belong to an account for these\nAPIs to work",
+        "package": {
+          "name": "iam"
+        },
+        "docs_group": "iam",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "methods": [
+          {
+            "name": "GetAssignableRolesForResource",
+            "description": "Gets all the roles that can be granted on an account level resource. A role is grantable if the rule set on the\nresource can contain an access rule of the role.",
+            "summary": "Get assignable roles for a resource.",
+            "path": "/api/2.0/preview/accounts/access-control/assignable-roles",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetAssignableRolesForResourceRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "resource",
+                  "description": "The resource name for which assignable roles will be listed.\n\nExamples | Summary\n:--- | :---\n`resource=accounts/\u003cACCOUNT_ID\u003e` | A resource name for the account.\n`resource=accounts/\u003cACCOUNT_ID\u003e/groups/\u003cGROUP_ID\u003e` | A resource name for the group.\n`resource=accounts/\u003cACCOUNT_ID\u003e/servicePrincipals/\u003cSP_ID\u003e` | A resource name for the service principal.\n`resource=accounts/\u003cACCOUNT_ID\u003e/tagPolicies/\u003cTAG_POLICY_ID\u003e` | A resource name for the tag policy.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "resource",
+                  "description": "The resource name for which assignable roles will be listed.\n\nExamples | Summary\n:--- | :---\n`resource=accounts/\u003cACCOUNT_ID\u003e` | A resource name for the account.\n`resource=accounts/\u003cACCOUNT_ID\u003e/groups/\u003cGROUP_ID\u003e` | A resource name for the group.\n`resource=accounts/\u003cACCOUNT_ID\u003e/servicePrincipals/\u003cSP_ID\u003e` | A resource name for the service principal.\n`resource=accounts/\u003cACCOUNT_ID\u003e/tagPolicies/\u003cTAG_POLICY_ID\u003e` | A resource name for the tag policy.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetAssignableRolesForResourceResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "resource",
+                "description": "The resource name for which assignable roles will be listed.\n\nExamples | Summary\n:--- | :---\n`resource=accounts/\u003cACCOUNT_ID\u003e` | A resource name for the account.\n`resource=accounts/\u003cACCOUNT_ID\u003e/groups/\u003cGROUP_ID\u003e` | A resource name for the group.\n`resource=accounts/\u003cACCOUNT_ID\u003e/servicePrincipals/\u003cSP_ID\u003e` | A resource name for the service principal.\n`resource=accounts/\u003cACCOUNT_ID\u003e/tagPolicies/\u003cTAG_POLICY_ID\u003e` | A resource name for the tag policy.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "resource",
+                "description": "The resource name for which assignable roles will be listed.\n\nExamples | Summary\n:--- | :---\n`resource=accounts/\u003cACCOUNT_ID\u003e` | A resource name for the account.\n`resource=accounts/\u003cACCOUNT_ID\u003e/groups/\u003cGROUP_ID\u003e` | A resource name for the group.\n`resource=accounts/\u003cACCOUNT_ID\u003e/servicePrincipals/\u003cSP_ID\u003e` | A resource name for the service principal.\n`resource=accounts/\u003cACCOUNT_ID\u003e/tagPolicies/\u003cTAG_POLICY_ID\u003e` | A resource name for the tag policy.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetRuleSet",
+            "description": "Get a rule set by its name. A rule set is always attached to a resource and contains a list of access rules on the\nsaid resource. Currently only a default rule set for each resource is supported.",
+            "summary": "Get a rule set.",
+            "path": "/api/2.0/preview/accounts/access-control/rule-sets",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetRuleSetRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The ruleset name associated with the request.\n\nExamples | Summary\n:--- | :---\n`name=accounts/\u003cACCOUNT_ID\u003e/ruleSets/default` | A name for a rule set on the account.\n`name=accounts/\u003cACCOUNT_ID\u003e/groups/\u003cGROUP_ID\u003e/ruleSets/default` | A name for a rule set on the group.\n`name=accounts/\u003cACCOUNT_ID\u003e/servicePrincipals/\u003cSERVICE_PRINCIPAL_APPLICATION_ID\u003e/ruleSets/default` | A name for a rule set on the service principal.\n`name=accounts/\u003cACCOUNT_ID\u003e/tagPolicies/\u003cTAG_POLICY_ID\u003e/ruleSets/default` | A name for a rule set on the tag policy.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "etag",
+                  "description": "Etag used for versioning. The response is at least as fresh as the eTag provided. Etag is used for optimistic\nconcurrency control as a way to help prevent simultaneous updates of a rule set from overwriting each other. It is\nstrongly suggested that systems make use of the etag in the read -\u003e modify -\u003e write pattern to perform rule set\nupdates in order to avoid race conditions that is get an etag from a GET rule set request, and pass it with the\nPUT update request to identify the rule set version you are updating.\n\nExamples | Summary\n:--- | :---\n`etag=` | An empty etag can only be used in GET to indicate no freshness requirements.\n`etag=RENUAAABhSweA4NvVmmUYdiU717H3Tgy0UJdor3gE4a+mq/oj9NjAf8ZsQ==` | An etag encoded a specific version of the rule set to get or to be updated.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The ruleset name associated with the request.\n\nExamples | Summary\n:--- | :---\n`name=accounts/\u003cACCOUNT_ID\u003e/ruleSets/default` | A name for a rule set on the account.\n`name=accounts/\u003cACCOUNT_ID\u003e/groups/\u003cGROUP_ID\u003e/ruleSets/default` | A name for a rule set on the group.\n`name=accounts/\u003cACCOUNT_ID\u003e/servicePrincipals/\u003cSERVICE_PRINCIPAL_APPLICATION_ID\u003e/ruleSets/default` | A name for a rule set on the service principal.\n`name=accounts/\u003cACCOUNT_ID\u003e/tagPolicies/\u003cTAG_POLICY_ID\u003e/ruleSets/default` | A name for a rule set on the tag policy.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "etag",
+                  "description": "Etag used for versioning. The response is at least as fresh as the eTag provided. Etag is used for optimistic\nconcurrency control as a way to help prevent simultaneous updates of a rule set from overwriting each other. It is\nstrongly suggested that systems make use of the etag in the read -\u003e modify -\u003e write pattern to perform rule set\nupdates in order to avoid race conditions that is get an etag from a GET rule set request, and pass it with the\nPUT update request to identify the rule set version you are updating.\n\nExamples | Summary\n:--- | :---\n`etag=` | An empty etag can only be used in GET to indicate no freshness requirements.\n`etag=RENUAAABhSweA4NvVmmUYdiU717H3Tgy0UJdor3gE4a+mq/oj9NjAf8ZsQ==` | An etag encoded a specific version of the rule set to get or to be updated.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "RuleSetResponse",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the rule set.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "etag",
+                  "description": "Identifies the version of the rule set returned.\nEtag used for versioning. The response is at least as fresh as the eTag provided.\nEtag is used for optimistic concurrency control as a way to help prevent simultaneous\nupdates of a rule set from overwriting each other. It is strongly suggested that systems\nmake use of the etag in the read -\u003e modify -\u003e write pattern to perform rule set updates in\norder to avoid race conditions that is get an etag from a GET rule set request, and pass it\nwith the PUT update request to identify the rule set version you are updating.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the rule set.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "etag",
+                  "description": "Identifies the version of the rule set returned.\nEtag used for versioning. The response is at least as fresh as the eTag provided.\nEtag is used for optimistic concurrency control as a way to help prevent simultaneous\nupdates of a rule set from overwriting each other. It is strongly suggested that systems\nmake use of the etag in the read -\u003e modify -\u003e write pattern to perform rule set updates in\norder to avoid race conditions that is get an etag from a GET rule set request, and pass it\nwith the PUT update request to identify the rule set version you are updating.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "Etag used for versioning. The response is at least as fresh as the eTag provided. Etag is used for optimistic\nconcurrency control as a way to help prevent simultaneous updates of a rule set from overwriting each other. It is\nstrongly suggested that systems make use of the etag in the read -\u003e modify -\u003e write pattern to perform rule set\nupdates in order to avoid race conditions that is get an etag from a GET rule set request, and pass it with the\nPUT update request to identify the rule set version you are updating.\n\nExamples | Summary\n:--- | :---\n`etag=` | An empty etag can only be used in GET to indicate no freshness requirements.\n`etag=RENUAAABhSweA4NvVmmUYdiU717H3Tgy0UJdor3gE4a+mq/oj9NjAf8ZsQ==` | An etag encoded a specific version of the rule set to get or to be updated.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The ruleset name associated with the request.\n\nExamples | Summary\n:--- | :---\n`name=accounts/\u003cACCOUNT_ID\u003e/ruleSets/default` | A name for a rule set on the account.\n`name=accounts/\u003cACCOUNT_ID\u003e/groups/\u003cGROUP_ID\u003e/ruleSets/default` | A name for a rule set on the group.\n`name=accounts/\u003cACCOUNT_ID\u003e/servicePrincipals/\u003cSERVICE_PRINCIPAL_APPLICATION_ID\u003e/ruleSets/default` | A name for a rule set on the service principal.\n`name=accounts/\u003cACCOUNT_ID\u003e/tagPolicies/\u003cTAG_POLICY_ID\u003e/ruleSets/default` | A name for a rule set on the tag policy.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The ruleset name associated with the request.\n\nExamples | Summary\n:--- | :---\n`name=accounts/\u003cACCOUNT_ID\u003e/ruleSets/default` | A name for a rule set on the account.\n`name=accounts/\u003cACCOUNT_ID\u003e/groups/\u003cGROUP_ID\u003e/ruleSets/default` | A name for a rule set on the group.\n`name=accounts/\u003cACCOUNT_ID\u003e/servicePrincipals/\u003cSERVICE_PRINCIPAL_APPLICATION_ID\u003e/ruleSets/default` | A name for a rule set on the service principal.\n`name=accounts/\u003cACCOUNT_ID\u003e/tagPolicies/\u003cTAG_POLICY_ID\u003e/ruleSets/default` | A name for a rule set on the tag policy.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "etag",
+                "description": "Etag used for versioning. The response is at least as fresh as the eTag provided. Etag is used for optimistic\nconcurrency control as a way to help prevent simultaneous updates of a rule set from overwriting each other. It is\nstrongly suggested that systems make use of the etag in the read -\u003e modify -\u003e write pattern to perform rule set\nupdates in order to avoid race conditions that is get an etag from a GET rule set request, and pass it with the\nPUT update request to identify the rule set version you are updating.\n\nExamples | Summary\n:--- | :---\n`etag=` | An empty etag can only be used in GET to indicate no freshness requirements.\n`etag=RENUAAABhSweA4NvVmmUYdiU717H3Tgy0UJdor3gE4a+mq/oj9NjAf8ZsQ==` | An etag encoded a specific version of the rule set to get or to be updated.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateRuleSet",
+            "description": "Replace the rules of a rule set. First, use get to read the current version of the rule set before modifying it.\nThis pattern helps prevent conflicts between concurrent updates.",
+            "summary": "Update a rule set.",
+            "path": "/api/2.0/preview/accounts/access-control/rule-sets",
+            "can_use_json": true,
+            "must_use_json": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "UpdateRuleSetRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the rule set.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "rule_set",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "RuleSetUpdateRequest",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the rule set.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "rule_set",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "RuleSetUpdateRequest",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "RuleSetResponse",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the rule set.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "etag",
+                  "description": "Identifies the version of the rule set returned.\nEtag used for versioning. The response is at least as fresh as the eTag provided.\nEtag is used for optimistic concurrency control as a way to help prevent simultaneous\nupdates of a rule set from overwriting each other. It is strongly suggested that systems\nmake use of the etag in the read -\u003e modify -\u003e write pattern to perform rule set updates in\norder to avoid race conditions that is get an etag from a GET rule set request, and pass it\nwith the PUT update request to identify the rule set version you are updating.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the rule set.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "etag",
+                  "description": "Identifies the version of the rule set returned.\nEtag used for versioning. The response is at least as fresh as the eTag provided.\nEtag is used for optimistic concurrency control as a way to help prevent simultaneous\nupdates of a rule set from overwriting each other. It is strongly suggested that systems\nmake use of the etag in the read -\u003e modify -\u003e write pattern to perform rule set updates in\norder to avoid race conditions that is get an etag from a GET rule set request, and pass it\nwith the PUT update request to identify the rule set version you are updating.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Name of the rule set.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "rule_set",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "RuleSetUpdateRequest",
+                  "is_object": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "agentbricks.AgentBricks",
+        "name": "AgentBricks",
+        "description": "The Custom LLMs service manages state and powers the UI for the Custom LLM product.",
+        "package": {
+          "name": "agentbricks"
+        },
+        "is_hidden_cli": true,
+        "docs_group": "agentbricks",
+        "launch_stage": "PRIVATE_PREVIEW",
+        "cli_launch_stage_display": "Private Preview",
+        "methods": [
+          {
+            "name": "CancelOptimize",
+            "description": "Cancel a Custom LLM Optimization Run.",
+            "summary": "Cancel a Custom LLM Optimization Run.",
+            "path": "/api/2.0/custom-llms/{id}/optimize/cancel",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "CancelCustomLlmOptimizationRunRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateCustomLlm",
+            "description": "Create a Custom LLM.",
+            "summary": "Create a Custom LLM.",
+            "path": "/api/2.0/custom-llms",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "CreateCustomLlmRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the custom LLM. Only alphanumeric characters and dashes allowed.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "instructions",
+                  "description": "Instructions for the custom LLM to follow",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the custom LLM. Only alphanumeric characters and dashes allowed.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "instructions",
+                  "description": "Instructions for the custom LLM to follow",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CustomLlm",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the custom LLM",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "instructions",
+                  "description": "Instructions for the custom LLM to follow",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the custom LLM",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "instructions",
+                  "description": "Instructions for the custom LLM to follow",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "agent_artifact_path",
+                "description": "This will soon be deprecated!!\nOptional: UC path for agent artifacts. If you are using a dataset that you only have read permissions,\nplease provide a destination path where you have write permissions. Please provide this in catalog.schema format.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "datasets",
+                "description": "Datasets used for training and evaluating the model, not for inference.\nCurrently, only 1 dataset is accepted.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DatasetList",
+                  "array_value": {
+                    "pascal_name": "Dataset",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "guidelines",
+                "description": "Guidelines for the custom LLM to adhere to",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "instructions",
+                "description": "Instructions for the custom LLM to follow",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the custom LLM. Only alphanumeric characters and dashes allowed.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the custom LLM. Only alphanumeric characters and dashes allowed.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "instructions",
+                "description": "Instructions for the custom LLM to follow",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteCustomLlm",
+            "description": "Delete a Custom LLM.",
+            "summary": "Delete a Custom LLM.",
+            "path": "/api/2.0/custom-llms/{id}",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "DeleteCustomLlmRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "The id of the custom llm",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "The id of the custom llm",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "description": "The id of the custom llm",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "The id of the custom llm",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetCustomLlm",
+            "description": "Get a Custom LLM.",
+            "summary": "Get a Custom LLM.",
+            "path": "/api/2.0/custom-llms/{id}",
+            "is_crud_read": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "GetCustomLlmRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "The id of the custom llm",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "The id of the custom llm",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CustomLlm",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the custom LLM",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "instructions",
+                  "description": "Instructions for the custom LLM to follow",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the custom LLM",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "instructions",
+                  "description": "Instructions for the custom LLM to follow",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "description": "The id of the custom llm",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "The id of the custom llm",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "StartOptimize",
+            "description": "Start a Custom LLM Optimization Run.",
+            "summary": "Start a Custom LLM Optimization Run.",
+            "path": "/api/2.0/custom-llms/{id}/optimize",
+            "is_crud_create": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "StartCustomLlmOptimizationRunRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "The Id of the tile.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "The Id of the tile.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CustomLlm",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the custom LLM",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "instructions",
+                  "description": "Instructions for the custom LLM to follow",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the custom LLM",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "instructions",
+                  "description": "Instructions for the custom LLM to follow",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "description": "The Id of the tile.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "The Id of the tile.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateCustomLlm",
+            "description": "Update a Custom LLM.",
+            "summary": "Update a Custom LLM.",
+            "path": "/api/2.0/custom-llms/{id}",
+            "can_use_json": true,
+            "must_use_json": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "UpdateCustomLlmRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "The id of the custom llm",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "custom_llm",
+                  "description": "The CustomLlm containing the fields which should be updated.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CustomLlm",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The list of the CustomLlm fields to update. These should correspond to the values (or lack thereof) present in `custom_llm`.\n\nThe field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "The id of the custom llm",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "custom_llm",
+                  "description": "The CustomLlm containing the fields which should be updated.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CustomLlm",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The list of the CustomLlm fields to update. These should correspond to the values (or lack thereof) present in `custom_llm`.\n\nThe field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CustomLlm",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the custom LLM",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "instructions",
+                  "description": "Instructions for the custom LLM to follow",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the custom LLM",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "instructions",
+                  "description": "Instructions for the custom LLM to follow",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "custom_llm",
+                "description": "The CustomLlm containing the fields which should be updated.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CustomLlm",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "id",
+                "description": "The id of the custom llm",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The list of the CustomLlm fields to update. These should correspond to the values (or lack thereof) present in `custom_llm`.\n\nThe field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "The id of the custom llm",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "agentkit.AgentKit",
+        "name": "AgentKit",
+        "description": "APIs for managing agent memory and durable session state. This interface is under active development and may change.",
+        "package": {
+          "name": "agentkit"
+        },
+        "docs_group": "agentbricks",
+        "launch_stage": "PUBLIC_BETA",
+        "cli_launch_stage_label": "*Beta*",
+        "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+        "cli_launch_stage_display": "Beta",
+        "list": {
+          "request": {
+            "pascal_name": "ListManagedMemoryEntriesRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "AppendSessionItems",
+            "description": "Appends items to a session.",
+            "summary": "Append items to a session.",
+            "path": "/api/2.0/agents/{parent=session-stores/*/sessions/*}/items:append",
+            "can_use_json": true,
+            "must_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "AppendSessionItemsRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "Resource name of the containing session, in the form\n`session-stores/{session_store_id}/sessions/{session_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "items",
+                  "description": "Items to append atomically in request order. Concurrent append requests are serialized into one\ncommitted order without exposing a numeric sequence in the public contract.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "SessionItemList",
+                    "array_value": {
+                      "pascal_name": "SessionItem",
+                      "is_object": true
+                    }
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "Resource name of the containing session, in the form\n`session-stores/{session_store_id}/sessions/{session_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "items",
+                  "description": "Items to append atomically in request order. Concurrent append requests are serialized into one\ncommitted order without exposing a numeric sequence in the public contract.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "SessionItemList",
+                    "array_value": {
+                      "pascal_name": "SessionItem",
+                      "is_object": true
+                    }
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "AppendSessionItemsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "items",
+                "description": "Items to append atomically in request order. Concurrent append requests are serialized into one\ncommitted order without exposing a numeric sequence in the public contract.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "SessionItemList",
+                  "array_value": {
+                    "pascal_name": "SessionItem",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "parent",
+                "description": "Resource name of the containing session, in the form\n`session-stores/{session_store_id}/sessions/{session_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "Resource name of the containing session, in the form\n`session-stores/{session_store_id}/sessions/{session_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ClearSessionItems",
+            "description": "Clears all items from a session.",
+            "summary": "Clear items from a session.",
+            "path": "/api/2.0/agents/{parent=session-stores/*/sessions/*}/items:clear",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ClearSessionItemsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "Resource name of the containing session, in the form\n`session-stores/{session_store_id}/sessions/{session_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "Resource name of the containing session, in the form\n`session-stores/{session_store_id}/sessions/{session_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ClearSessionItemsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "parent",
+                "description": "Resource name of the containing session, in the form\n`session-stores/{session_store_id}/sessions/{session_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "Resource name of the containing session, in the form\n`session-stores/{session_store_id}/sessions/{session_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateMemory",
+            "description": "Creates a memory entry using exclusive-create semantics. Callers may choose the entry\nID; the service generates one when it is omitted. Returns `ALREADY_EXISTS` when an entry with\nthe same actor, session, and path already exists. Omitted `session_id` is its own uniqueness\nkey: two omitted-session entries with the same actor and path conflict, but an omitted-session\nentry does not conflict with a session-scoped entry at the same actor and path.",
+            "summary": "Create a memory entry.",
+            "path": "/api/2.0/agents/{parent=memory-stores/*}/entries",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "CreateManagedMemoryEntryRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "Memory store that will contain the entry, in the form\n`memory-stores/{managed_memory_store_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "managed_memory_entry",
+                  "description": "The memory entry to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ManagedMemoryEntry",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "Memory store that will contain the entry, in the form\n`memory-stores/{managed_memory_store_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "managed_memory_entry",
+                  "description": "The memory entry to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ManagedMemoryEntry",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "managed_memory_entry",
+              "description": "The memory entry to create.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "ManagedMemoryEntry",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "actor_id",
+                    "description": "Customer-provided identifier for the actor whose memory this entry represents.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "path",
+                    "description": "Absolute, case-sensitive path identifying the entry within its actor and optional session.\nPaths must begin with `/` and must not contain empty, `.` or `..` segments.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "actor_id",
+                    "description": "Customer-provided identifier for the actor whose memory this entry represents.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "path",
+                    "description": "Absolute, case-sensitive path identifying the entry within its actor and optional session.\nPaths must begin with `/` and must not contain empty, `.` or `..` segments.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "ManagedMemoryEntry",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "actor_id",
+                  "description": "Customer-provided identifier for the actor whose memory this entry represents.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "path",
+                  "description": "Absolute, case-sensitive path identifying the entry within its actor and optional session.\nPaths must begin with `/` and must not contain empty, `.` or `..` segments.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "actor_id",
+                  "description": "Customer-provided identifier for the actor whose memory this entry represents.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "path",
+                  "description": "Absolute, case-sensitive path identifying the entry within its actor and optional session.\nPaths must begin with `/` and must not contain empty, `.` or `..` segments.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "managed_memory_entry",
+                "description": "The memory entry to create.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ManagedMemoryEntry",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "actor_id",
+                      "description": "Customer-provided identifier for the actor whose memory this entry represents.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "path",
+                      "description": "Absolute, case-sensitive path identifying the entry within its actor and optional session.\nPaths must begin with `/` and must not contain empty, `.` or `..` segments.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "actor_id",
+                      "description": "Customer-provided identifier for the actor whose memory this entry represents.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "path",
+                      "description": "Absolute, case-sensitive path identifying the entry within its actor and optional session.\nPaths must begin with `/` and must not contain empty, `.` or `..` segments.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "managed_memory_entry_id",
+                "description": "Optional caller-selected memory entry ID. The service generates an ID when omitted.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "Memory store that will contain the entry, in the form\n`memory-stores/{managed_memory_store_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "actor_id",
+                "description": "Customer-provided identifier for the actor whose memory this entry represents.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "content",
+                "description": "Optional free-form memory content.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Time when the entry was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "Human-readable description of the memory entry.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name in the form\n`memory-stores/{managed_memory_store_id}/entries/{managed_memory_entry_id}`.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "path",
+                "description": "Absolute, case-sensitive path identifying the entry within its actor and optional session.\nPaths must begin with `/` and must not contain empty, `.` or `..` segments.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "session_id",
+                "description": "Optional identifier for the session associated with this memory entry. When omitted, the\nentry applies across the actor's sessions.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "source_type",
+                "description": "Which writer created this entry. Caller sets this on Create; immutable after creation.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ManagedMemoryEntrySourceType",
+                  "enum": [
+                    {
+                      "content": "MANAGED_MEMORY_ENTRY_SOURCE_TYPE_AGENT"
+                    },
+                    {
+                      "content": "MANAGED_MEMORY_ENTRY_SOURCE_TYPE_DREAMER"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "Time when the entry was last updated.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "Memory store that will contain the entry, in the form\n`memory-stores/{managed_memory_store_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "actor_id",
+                "description": "Customer-provided identifier for the actor whose memory this entry represents.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "path",
+                "description": "Absolute, case-sensitive path identifying the entry within its actor and optional session.\nPaths must begin with `/` and must not contain empty, `.` or `..` segments.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateMemoryStore",
+            "description": "Creates a memory store in the caller's workspace.",
+            "summary": "Create a memory store.",
+            "path": "/api/2.0/agents/memory-stores",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "CreateManagedMemoryStoreRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "managed_memory_store",
+                  "description": "The memory store to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ManagedMemoryStore",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "managed_memory_store_id",
+                  "description": "Caller-provided, workspace-unique memory store ID. It must be 3-56 characters, begin\nwith a lowercase letter, contain only lowercase letters, digits, and hyphens, and end with a\nletter or digit.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "managed_memory_store_id",
+                  "description": "Caller-provided, workspace-unique memory store ID. It must be 3-56 characters, begin\nwith a lowercase letter, contain only lowercase letters, digits, and hyphens, and end with a\nletter or digit.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "managed_memory_store",
+                  "description": "The memory store to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ManagedMemoryStore",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "managed_memory_store",
+              "description": "The memory store to create.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "ManagedMemoryStore",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "ManagedMemoryStore",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "managed_memory_store",
+                "description": "The memory store to create.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ManagedMemoryStore",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "managed_memory_store_id",
+                "description": "Caller-provided, workspace-unique memory store ID. It must be 3-56 characters, begin\nwith a lowercase letter, contain only lowercase letters, digits, and hyphens, and end with a\nletter or digit.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Time when the store was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "creator_user_id",
+                "description": "Workspace-local user ID of the authenticated principal that created the store. This is\nimmutable server-set attribution and does not grant access; authorization is evaluated from\nthe authenticated request context.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "Human-readable description of the memory store.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "Deprecated compatibility alias for the caller-provided memory store ID. Canonical\nclients provide the ID through `CreateMemoryStoreRequest.managed_memory_store_id` and use\n`name` as the resource identifier.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name in the form `memory-stores/{managed_memory_store_id}`.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "owner_user_id",
+                "description": "Deprecated alias for `creator_user_id`. This identifies the original creator, not a\ntransferable owner. Use `creator_user_id` instead.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "storage_backend",
+                "description": "Service-managed storage backing this memory store.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "StorageBackend",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "Time when the store was last updated.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "workspace_id",
+                "description": "Workspace that owns the memory store.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "managed_memory_store_id",
+                "description": "Caller-provided, workspace-unique memory store ID. It must be 3-56 characters, begin\nwith a lowercase letter, contain only lowercase letters, digits, and hyphens, and end with a\nletter or digit.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateSession",
+            "description": "Creates a session within a session store.",
+            "summary": "Create a session.",
+            "path": "/api/2.0/agents/{parent=session-stores/*}/sessions",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "CreateSessionRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "Resource name of the containing session store, in the form\n`session-stores/{session_store_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "session",
+                  "description": "The session to create. `actor_id` is required. A session with `parent_session_id` is a child and\nmust use its parent's `actor_id`. Independent forks are created only through `ForkSession`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Session",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "Resource name of the containing session store, in the form\n`session-stores/{session_store_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "session",
+                  "description": "The session to create. `actor_id` is required. A session with `parent_session_id` is a child and\nmust use its parent's `actor_id`. Independent forks are created only through `ForkSession`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Session",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "session",
+              "description": "The session to create. `actor_id` is required. A session with `parent_session_id` is a child and\nmust use its parent's `actor_id`. Independent forks are created only through `ForkSession`.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Session",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "actor_id",
+                    "description": "Opaque caller-provided identifier for the application actor associated with the session.\n\nThis is application data and has no Databricks authentication or authorization semantics.\nUse the same value as the Managed Memory Entry `actor_id` when storing memories associated\nwith this actor. Every session must set it. A child session must use the same value as its parent.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "actor_id",
+                    "description": "Opaque caller-provided identifier for the application actor associated with the session.\n\nThis is application data and has no Databricks authentication or authorization semantics.\nUse the same value as the Managed Memory Entry `actor_id` when storing memories associated\nwith this actor. Every session must set it. A child session must use the same value as its parent.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "Session",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "actor_id",
+                  "description": "Opaque caller-provided identifier for the application actor associated with the session.\n\nThis is application data and has no Databricks authentication or authorization semantics.\nUse the same value as the Managed Memory Entry `actor_id` when storing memories associated\nwith this actor. Every session must set it. A child session must use the same value as its parent.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "actor_id",
+                  "description": "Opaque caller-provided identifier for the application actor associated with the session.\n\nThis is application data and has no Databricks authentication or authorization semantics.\nUse the same value as the Managed Memory Entry `actor_id` when storing memories associated\nwith this actor. Every session must set it. A child session must use the same value as its parent.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "parent",
+                "description": "Resource name of the containing session store, in the form\n`session-stores/{session_store_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "session",
+                "description": "The session to create. `actor_id` is required. A session with `parent_session_id` is a child and\nmust use its parent's `actor_id`. Independent forks are created only through `ForkSession`.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Session",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "actor_id",
+                      "description": "Opaque caller-provided identifier for the application actor associated with the session.\n\nThis is application data and has no Databricks authentication or authorization semantics.\nUse the same value as the Managed Memory Entry `actor_id` when storing memories associated\nwith this actor. Every session must set it. A child session must use the same value as its parent.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "actor_id",
+                      "description": "Opaque caller-provided identifier for the application actor associated with the session.\n\nThis is application data and has no Databricks authentication or authorization semantics.\nUse the same value as the Managed Memory Entry `actor_id` when storing memories associated\nwith this actor. Every session must set it. A child session must use the same value as its parent.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "session_id",
+                "description": "Optional caller-selected session ID. The service generates a UUID when this field is omitted.\nThe ID must be unique; a collision returns `ALREADY_EXISTS`.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "actor_id",
+                "description": "Opaque caller-provided identifier for the application actor associated with the session.\n\nThis is application data and has no Databricks authentication or authorization semantics.\nUse the same value as the Managed Memory Entry `actor_id` when storing memories associated\nwith this actor. Every session must set it. A child session must use the same value as its parent.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Time when the session was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "last_activity_time",
+                "description": "Time when the session's item history was last mutated.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "metadata",
+                "description": "Mutable caller-defined string labels.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name in the form `session-stores/{session_store_id}/sessions/{session_id}`.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent_session_id",
+                "description": "Immediate parent session ID. Set only at creation for child sessions, immutable thereafter, and\nrestricted to the same store.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "root_session_id",
+                "description": "Top-level session ID in the spawn tree. This equals `session_id` for a root or fork and is\ninherited transitively by child sessions.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "session_id",
+                "description": "Unique session ID. The service generates a UUID unless the caller supplies\n`CreateSessionRequest.session_id`.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "Time when session resource fields last changed.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "Resource name of the containing session store, in the form\n`session-stores/{session_store_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "actor_id",
+                "description": "Opaque caller-provided identifier for the application actor associated with the session.\n\nThis is application data and has no Databricks authentication or authorization semantics.\nUse the same value as the Managed Memory Entry `actor_id` when storing memories associated\nwith this actor. Every session must set it. A child session must use the same value as its parent.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateSessionStore",
+            "description": "Creates a session store.",
+            "summary": "Create a session store.",
+            "path": "/api/2.0/agents/session-stores",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "CreateSessionStoreRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "session_store",
+                  "description": "The session store to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "SessionStore",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "session_store_id",
+                  "description": "Caller-provided, workspace-unique session store ID. It must be 3-55 characters, begin with a\nlowercase letter, and contain only lowercase letters, digits, and hyphens.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "session_store_id",
+                  "description": "Caller-provided, workspace-unique session store ID. It must be 3-55 characters, begin with a\nlowercase letter, and contain only lowercase letters, digits, and hyphens.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "session_store",
+                  "description": "The session store to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "SessionStore",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "session_store",
+              "description": "The session store to create.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "SessionStore",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "SessionStore",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "session_store",
+                "description": "The session store to create.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "SessionStore",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "session_store_id",
+                "description": "Caller-provided, workspace-unique session store ID. It must be 3-55 characters, begin with a\nlowercase letter, and contain only lowercase letters, digits, and hyphens.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Time when the store was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "creator_user_id",
+                "description": "Workspace-local user ID of the authenticated principal that created the store. This is\nimmutable server-set attribution and does not grant access; authorization is evaluated from\nthe authenticated request context.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "Human-readable description of the session store.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "metadata",
+                "description": "Mutable caller-defined string labels.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name in the form `session-stores/{session_store_id}`.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "Time when the store was last updated.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "session_store_id",
+                "description": "Caller-provided, workspace-unique session store ID. It must be 3-55 characters, begin with a\nlowercase letter, and contain only lowercase letters, digits, and hyphens.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteMemory",
+            "description": "Deletes a memory entry by resource name. Returns `NOT_FOUND` when the entry does not\nexist in the caller's workspace.",
+            "summary": "Delete a memory entry by resource name.",
+            "path": "/api/2.0/agents/{name=memory-stores/*/entries/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "DeleteManagedMemoryEntryRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name in the form\n`memory-stores/{managed_memory_store_id}/entries/{managed_memory_entry_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name in the form\n`memory-stores/{managed_memory_store_id}/entries/{managed_memory_entry_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Resource name in the form\n`memory-stores/{managed_memory_store_id}/entries/{managed_memory_entry_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Resource name in the form\n`memory-stores/{managed_memory_store_id}/entries/{managed_memory_entry_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteMemoryStore",
+            "description": "Deletes a memory store by resource name. Returns `NOT_FOUND` when the store does not\nexist in the caller's workspace.",
+            "summary": "Delete a memory store by resource name.",
+            "path": "/api/2.0/agents/{name=memory-stores/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "DeleteManagedMemoryStoreRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name in the form `memory-stores/{managed_memory_store_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name in the form `memory-stores/{managed_memory_store_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Resource name in the form `memory-stores/{managed_memory_store_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Resource name in the form `memory-stores/{managed_memory_store_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteSession",
+            "description": "Deletes a session, its items, and any descendant sessions recursively. Independently retained\nmemory is not deleted.",
+            "summary": "Delete a session.",
+            "path": "/api/2.0/agents/{name=session-stores/*/sessions/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "DeleteSessionRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name in the form\n`session-stores/{session_store_id}/sessions/{session_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name in the form\n`session-stores/{session_store_id}/sessions/{session_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Resource name in the form\n`session-stores/{session_store_id}/sessions/{session_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Resource name in the form\n`session-stores/{session_store_id}/sessions/{session_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteSessionStore",
+            "description": "Deletes a session store, its sessions and items, and its service-managed storage. Memory entries\nretained by a separate Memory Store are not deleted.",
+            "summary": "Delete a session store.",
+            "path": "/api/2.0/agents/{name=session-stores/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "DeleteSessionStoreRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name in the form `session-stores/{session_store_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name in the form `session-stores/{session_store_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Resource name in the form `session-stores/{session_store_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Resource name in the form `session-stores/{session_store_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ExtractMemories",
+            "description": "Synchronously extracts memories from a single session into the given memory store, returning\nthe entries that were written.",
+            "summary": "Extract memories from a session.",
+            "path": "/api/2.0/agents/{session_store=session-stores/*}/sessions/{session_id}/extractions",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ExtractMemoriesRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "session_store",
+                  "description": "Session store containing the session, in the form `session-stores/{session_store_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "session_id",
+                  "description": "Identifier of the session whose transcript is distilled into memories.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "memory_store",
+                  "description": "Memory store the extracted entries are written to, in the form\n`memory-stores/{managed_memory_store_id}`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "session_store",
+                  "description": "Session store containing the session, in the form `session-stores/{session_store_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "session_id",
+                  "description": "Identifier of the session whose transcript is distilled into memories.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "memory_store",
+                  "description": "Memory store the extracted entries are written to, in the form\n`memory-stores/{managed_memory_store_id}`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ExtractMemoriesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "dry_run",
+                "description": "When true, extract and return the entries without writing them to the memory store. Defaults\nto false, which persists the extracted entries and returns them.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "instructions",
+                "description": "Instructions steering what is extracted from the session.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "memory_store",
+                "description": "Memory store the extracted entries are written to, in the form\n`memory-stores/{managed_memory_store_id}`.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "session_id",
+                "description": "Identifier of the session whose transcript is distilled into memories.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "session_store",
+                "description": "Session store containing the session, in the form `session-stores/{session_store_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "session_store",
+                "description": "Session store containing the session, in the form `session-stores/{session_store_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "session_id",
+                "description": "Identifier of the session whose transcript is distilled into memories.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "memory_store",
+                "description": "Memory store the extracted entries are written to, in the form\n`memory-stores/{managed_memory_store_id}`.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ForkSession",
+            "description": "Forks a session into an independent top-level copy.",
+            "summary": "Fork a session.",
+            "path": "/api/2.0/agents/{parent=session-stores/*}/sessions:fork",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ForkSessionRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "Resource name of the containing session store, in the form\n`session-stores/{session_store_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "source_session_id",
+                  "description": "ID of the session to copy.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "actor_id",
+                  "description": "Opaque caller-provided identifier for the application actor associated with the forked session.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "Resource name of the containing session store, in the form\n`session-stores/{session_store_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "source_session_id",
+                  "description": "ID of the session to copy.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "actor_id",
+                  "description": "Opaque caller-provided identifier for the application actor associated with the forked session.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ForkSessionResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "actor_id",
+                "description": "Opaque caller-provided identifier for the application actor associated with the forked session.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "metadata",
+                "description": "Optional metadata for the fork.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "parent",
+                "description": "Resource name of the containing session store, in the form\n`session-stores/{session_store_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "session_id",
+                "description": "Optional unique ID for the forked session. A collision returns `ALREADY_EXISTS`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "source_session_id",
+                "description": "ID of the session to copy.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "up_to_item_id",
+                "description": "Optional last item ID to copy through, inclusively. When omitted, the fork atomically copies\nall items committed before the fork operation begins.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "Resource name of the containing session store, in the form\n`session-stores/{session_store_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "source_session_id",
+                "description": "ID of the session to copy.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "actor_id",
+                "description": "Opaque caller-provided identifier for the application actor associated with the forked session.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetMemory",
+            "description": "Retrieves a memory entry by resource name. `view` controls whether the response\nincludes memory content. Returns `NOT_FOUND` when the entry does not exist in the caller's\nworkspace.",
+            "summary": "Get a memory entry by resource name.",
+            "path": "/api/2.0/agents/{name=memory-stores/*/entries/*}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetManagedMemoryEntryRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name in the form\n`memory-stores/{managed_memory_store_id}/entries/{managed_memory_entry_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name in the form\n`memory-stores/{managed_memory_store_id}/entries/{managed_memory_entry_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ManagedMemoryEntry",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "actor_id",
+                  "description": "Customer-provided identifier for the actor whose memory this entry represents.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "path",
+                  "description": "Absolute, case-sensitive path identifying the entry within its actor and optional session.\nPaths must begin with `/` and must not contain empty, `.` or `..` segments.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "actor_id",
+                  "description": "Customer-provided identifier for the actor whose memory this entry represents.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "path",
+                  "description": "Absolute, case-sensitive path identifying the entry within its actor and optional session.\nPaths must begin with `/` and must not contain empty, `.` or `..` segments.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Resource name in the form\n`memory-stores/{managed_memory_store_id}/entries/{managed_memory_entry_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "view",
+                "description": "Controls whether the response includes memory content. Defaults to `FULL`.",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "ManagedMemoryEntryView",
+                  "enum": [
+                    {
+                      "content": "MANAGED_MEMORY_ENTRY_VIEW_BASIC"
+                    },
+                    {
+                      "content": "MANAGED_MEMORY_ENTRY_VIEW_FULL"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Resource name in the form\n`memory-stores/{managed_memory_store_id}/entries/{managed_memory_entry_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetMemoryStore",
+            "description": "Retrieves a memory store by resource name. Returns `NOT_FOUND` when the store does not\nexist in the caller's workspace.",
+            "summary": "Get a memory store by resource name.",
+            "path": "/api/2.0/agents/{name=memory-stores/*}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetManagedMemoryStoreRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name in the form `memory-stores/{managed_memory_store_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name in the form `memory-stores/{managed_memory_store_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ManagedMemoryStore",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Resource name in the form `memory-stores/{managed_memory_store_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Resource name in the form `memory-stores/{managed_memory_store_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetSession",
+            "description": "Gets a session by resource name.",
+            "summary": "Get a session.",
+            "path": "/api/2.0/agents/{name=session-stores/*/sessions/*}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetSessionRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name in the form\n`session-stores/{session_store_id}/sessions/{session_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name in the form\n`session-stores/{session_store_id}/sessions/{session_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Session",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "actor_id",
+                  "description": "Opaque caller-provided identifier for the application actor associated with the session.\n\nThis is application data and has no Databricks authentication or authorization semantics.\nUse the same value as the Managed Memory Entry `actor_id` when storing memories associated\nwith this actor. Every session must set it. A child session must use the same value as its parent.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "actor_id",
+                  "description": "Opaque caller-provided identifier for the application actor associated with the session.\n\nThis is application data and has no Databricks authentication or authorization semantics.\nUse the same value as the Managed Memory Entry `actor_id` when storing memories associated\nwith this actor. Every session must set it. A child session must use the same value as its parent.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Resource name in the form\n`session-stores/{session_store_id}/sessions/{session_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Resource name in the form\n`session-stores/{session_store_id}/sessions/{session_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetSessionStore",
+            "description": "Gets a session store by resource name.",
+            "summary": "Get a session store.",
+            "path": "/api/2.0/agents/{name=session-stores/*}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetSessionStoreRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name in the form `session-stores/{session_store_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name in the form `session-stores/{session_store_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "SessionStore",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Resource name in the form `session-stores/{session_store_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Resource name in the form `session-stores/{session_store_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListMemories",
+            "description": "Lists memory entries for one actor. An exact `path` filters entries across sessions,\nignoring session metadata. Otherwise, `session_id` and `path_prefix` restrict the actor\npartition. `view` controls whether each returned entry includes memory content.",
+            "summary": "List memory entries.",
+            "path": "/api/2.0/agents/{parent=memory-stores/*}/entries",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ListManagedMemoryEntriesRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "Memory store whose entries are listed, in the form\n`memory-stores/{managed_memory_store_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "actor_id",
+                  "description": "Customer-provided identifier for the actor whose entries are listed.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "Memory store whose entries are listed, in the form\n`memory-stores/{managed_memory_store_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "actor_id",
+                  "description": "Customer-provided identifier for the actor whose entries are listed.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListManagedMemoryEntriesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "actor_id",
+                "description": "Customer-provided identifier for the actor whose entries are listed.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "Maximum number of entries to return. The service may return fewer entries than requested.\nDefaults to 10; must be between 1 and 100.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque pagination token from a previous ListManagedMemoryEntries response.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "Memory store whose entries are listed, in the form\n`memory-stores/{managed_memory_store_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "path_prefix",
+                "description": "Optional path prefix used to restrict entries within the actor partition.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "session_id",
+                "description": "Optional session identifier. When set, only entries with this exact `session_id` are\nreturned. Omitted-session (cross-session) entries are not included. Ignored when path is set.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "view",
+                "description": "Controls whether each returned entry includes memory content. Defaults to `FULL`.",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "ManagedMemoryEntryView",
+                  "enum": [
+                    {
+                      "content": "MANAGED_MEMORY_ENTRY_VIEW_BASIC"
+                    },
+                    {
+                      "content": "MANAGED_MEMORY_ENTRY_VIEW_FULL"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "Memory store whose entries are listed, in the form\n`memory-stores/{managed_memory_store_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "actor_id",
+                "description": "Customer-provided identifier for the actor whose entries are listed.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Opaque pagination token from a previous ListManagedMemoryEntries response.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListMemoryStores",
+            "description": "Lists memory stores in the caller's workspace.",
+            "summary": "List memory stores.",
+            "path": "/api/2.0/agents/memory-stores",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ListManagedMemoryStoresRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListManagedMemoryStoresResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "Maximum number of stores to return. The service may return fewer stores than requested.\nDefaults to 10; must be between 1 and 100.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque pagination token from a previous ListManagedMemoryStores response.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Opaque pagination token from a previous ListManagedMemoryStores response.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListSessionItems",
+            "description": "Lists items in a session.",
+            "summary": "List session items.",
+            "path": "/api/2.0/agents/{parent=session-stores/*/sessions/*}/items",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ListSessionItemsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "Resource name of the containing session, in the form\n`session-stores/{session_store_id}/sessions/{session_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "Resource name of the containing session, in the form\n`session-stores/{session_store_id}/sessions/{session_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListSessionItemsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "order_by",
+                "description": "Sort order. Supported values are `create_time asc` and `create_time desc`. The default is\n`create_time desc`, which returns the most recently appended items first. Equal timestamps are\nresolved by committed append order in the requested direction.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "Maximum number of items to return. Defaults to 10; must be between 1 and 100.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Token returned by a previous list request.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "Resource name of the containing session, in the form\n`session-stores/{session_store_id}/sessions/{session_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "Resource name of the containing session, in the form\n`session-stores/{session_store_id}/sessions/{session_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Token returned by a previous list request.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListSessionStores",
+            "description": "Lists session stores.",
+            "summary": "List session stores.",
+            "path": "/api/2.0/agents/session-stores",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ListSessionStoresRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListSessionStoresResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "Maximum number of session stores to return. Defaults to 10; must be between 1 and 100.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Token returned by a previous list request.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Token returned by a previous list request.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListSessions",
+            "description": "Lists sessions within a session store.",
+            "summary": "List sessions.",
+            "path": "/api/2.0/agents/{parent=session-stores/*}/sessions",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ListSessionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "Resource name of the containing session store, in the form\n`session-stores/{session_store_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "Resource name of the containing session store, in the form\n`session-stores/{session_store_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListSessionsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "filter",
+                "description": "Filter expression. Supported fields include `actor_id` and `metadata`; for example,\n`actor_id = \"support-customer-123\"`.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "order_by",
+                "description": "Sort order. Defaults to `last_activity_time desc`. Page-token continuation is exactly-once when\nordering by `create_time` (immutable); ordering by `last_activity_time` is best-effort, because\nthat value changes as a session gains activity, so a session updated between page requests may\nbe repeated or skipped. To enumerate every session exactly once, order by `create_time`.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "Maximum number of sessions to return. Defaults to 10; must be between 1 and 100.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Token returned by a previous list request.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "Resource name of the containing session store, in the form\n`session-stores/{session_store_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "Resource name of the containing session store, in the form\n`session-stores/{session_store_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Token returned by a previous list request.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "PopSessionItem",
+            "description": "Pops the newest item from a session.",
+            "summary": "Pop an item from a session.",
+            "path": "/api/2.0/agents/{parent=session-stores/*/sessions/*}/items:pop",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "PopSessionItemRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "Resource name of the containing session, in the form\n`session-stores/{session_store_id}/sessions/{session_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "Resource name of the containing session, in the form\n`session-stores/{session_store_id}/sessions/{session_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "PopSessionItemResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "parent",
+                "description": "Resource name of the containing session, in the form\n`session-stores/{session_store_id}/sessions/{session_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "Resource name of the containing session, in the form\n`session-stores/{session_store_id}/sessions/{session_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "SearchMemories",
+            "description": "Searches memory entries by text query for one actor. Returns matching entries and\nscores ranked by relevance; `view` controls whether each returned entry includes content.",
+            "summary": "Search memory entries.",
+            "path": "/api/2.0/agents/{parent=memory-stores/*}/entries:search",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "SearchManagedMemoryEntriesRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "Memory store whose entries are searched, in the form\n`memory-stores/{managed_memory_store_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "actor_id",
+                  "description": "Customer-provided identifier for the actor whose entries are searched.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "query",
+                  "description": "Free-form search query.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "Memory store whose entries are searched, in the form\n`memory-stores/{managed_memory_store_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "actor_id",
+                  "description": "Customer-provided identifier for the actor whose entries are searched.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "query",
+                  "description": "Free-form search query.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "SearchManagedMemoryEntriesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "actor_id",
+                "description": "Customer-provided identifier for the actor whose entries are searched.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "limit",
+                "description": "Deprecated alias for `page_size`. When both fields are set, their values must match.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "Maximum number of relevance-ranked entries to return. Defaults to 10 and must be between 1 and\n100.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Reserved for pagination compatibility. The server currently ignores this field because Search\nreturns a ranked top-N result set.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "Memory store whose entries are searched, in the form\n`memory-stores/{managed_memory_store_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "path_prefix",
+                "description": "Optional absolute, case-sensitive path prefix used to restrict searched entries within the\nactor partition. The prefix must begin with `/` and must not contain empty, `.` or `..`\nsegments.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "query",
+                "description": "Free-form search query.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "session_id",
+                "description": "Optional session identifier. When set, only entries with this exact `session_id` are\nsearched. Omitted-session (cross-session) entries are not included.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "view",
+                "description": "Controls whether each returned entry includes memory content. Search scores are always\nreturned. Defaults to `FULL`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ManagedMemoryEntryView",
+                  "enum": [
+                    {
+                      "content": "MANAGED_MEMORY_ENTRY_VIEW_BASIC"
+                    },
+                    {
+                      "content": "MANAGED_MEMORY_ENTRY_VIEW_FULL"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "Memory store whose entries are searched, in the form\n`memory-stores/{managed_memory_store_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "actor_id",
+                "description": "Customer-provided identifier for the actor whose entries are searched.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "query",
+                "description": "Free-form search query.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Reserved for pagination compatibility. The server currently ignores this field because Search\nreturns a ranked top-N result set.",
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "UpdateMemory",
+            "description": "Updates selected mutable fields on a memory entry. Identity fields are immutable.",
+            "summary": "Update a memory entry.",
+            "path": "/api/2.0/agents/{name=memory-stores/*/entries/*}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "UpdateManagedMemoryEntryRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name in the form\n`memory-stores/{managed_memory_store_id}/entries/{managed_memory_entry_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "is_output_only": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "managed_memory_entry",
+                  "description": "The memory entry to update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ManagedMemoryEntry",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Fields to update. Only `content` and `description` may be updated.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name in the form\n`memory-stores/{managed_memory_store_id}/entries/{managed_memory_entry_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "is_output_only": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Fields to update. Only `content` and `description` may be updated.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "managed_memory_entry",
+                  "description": "The memory entry to update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ManagedMemoryEntry",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "managed_memory_entry",
+              "description": "The memory entry to update.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "ManagedMemoryEntry",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "actor_id",
+                    "description": "Customer-provided identifier for the actor whose memory this entry represents.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "path",
+                    "description": "Absolute, case-sensitive path identifying the entry within its actor and optional session.\nPaths must begin with `/` and must not contain empty, `.` or `..` segments.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "actor_id",
+                    "description": "Customer-provided identifier for the actor whose memory this entry represents.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "path",
+                    "description": "Absolute, case-sensitive path identifying the entry within its actor and optional session.\nPaths must begin with `/` and must not contain empty, `.` or `..` segments.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "ManagedMemoryEntry",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "actor_id",
+                  "description": "Customer-provided identifier for the actor whose memory this entry represents.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "path",
+                  "description": "Absolute, case-sensitive path identifying the entry within its actor and optional session.\nPaths must begin with `/` and must not contain empty, `.` or `..` segments.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "actor_id",
+                  "description": "Customer-provided identifier for the actor whose memory this entry represents.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "path",
+                  "description": "Absolute, case-sensitive path identifying the entry within its actor and optional session.\nPaths must begin with `/` and must not contain empty, `.` or `..` segments.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "managed_memory_entry",
+                "description": "The memory entry to update.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ManagedMemoryEntry",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "actor_id",
+                      "description": "Customer-provided identifier for the actor whose memory this entry represents.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "path",
+                      "description": "Absolute, case-sensitive path identifying the entry within its actor and optional session.\nPaths must begin with `/` and must not contain empty, `.` or `..` segments.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "actor_id",
+                      "description": "Customer-provided identifier for the actor whose memory this entry represents.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "path",
+                      "description": "Absolute, case-sensitive path identifying the entry within its actor and optional session.\nPaths must begin with `/` and must not contain empty, `.` or `..` segments.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name in the form\n`memory-stores/{managed_memory_store_id}/entries/{managed_memory_entry_id}`.",
+                "required": true,
+                "is_path": true,
+                "is_output_only": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Fields to update. Only `content` and `description` may be updated.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "actor_id",
+                "description": "Customer-provided identifier for the actor whose memory this entry represents.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "content",
+                "description": "Optional free-form memory content.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Time when the entry was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "Human-readable description of the memory entry.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name in the form\n`memory-stores/{managed_memory_store_id}/entries/{managed_memory_entry_id}`.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "path",
+                "description": "Absolute, case-sensitive path identifying the entry within its actor and optional session.\nPaths must begin with `/` and must not contain empty, `.` or `..` segments.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "session_id",
+                "description": "Optional identifier for the session associated with this memory entry. When omitted, the\nentry applies across the actor's sessions.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "source_type",
+                "description": "Which writer created this entry. Caller sets this on Create; immutable after creation.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ManagedMemoryEntrySourceType",
+                  "enum": [
+                    {
+                      "content": "MANAGED_MEMORY_ENTRY_SOURCE_TYPE_AGENT"
+                    },
+                    {
+                      "content": "MANAGED_MEMORY_ENTRY_SOURCE_TYPE_DREAMER"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "Time when the entry was last updated.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Resource name in the form\n`memory-stores/{managed_memory_store_id}/entries/{managed_memory_entry_id}`.",
+                "required": true,
+                "is_path": true,
+                "is_output_only": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Fields to update. Only `content` and `description` may be updated.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "actor_id",
+                "description": "Customer-provided identifier for the actor whose memory this entry represents.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "path",
+                "description": "Absolute, case-sensitive path identifying the entry within its actor and optional session.\nPaths must begin with `/` and must not contain empty, `.` or `..` segments.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateMemoryStore",
+            "description": "Updates a memory store's description and metadata.",
+            "summary": "Update a memory store.",
+            "path": "/api/2.0/agents/{name=memory-stores/*}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "UpdateManagedMemoryStoreRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name in the form `memory-stores/{managed_memory_store_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "is_output_only": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "managed_memory_store",
+                  "description": "The memory store to update. `name` is taken from the URL.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ManagedMemoryStore",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Only `description` and `metadata` may be updated. Selecting `metadata` replaces the entire map.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name in the form `memory-stores/{managed_memory_store_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "is_output_only": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Only `description` and `metadata` may be updated. Selecting `metadata` replaces the entire map.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "managed_memory_store",
+                  "description": "The memory store to update. `name` is taken from the URL.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ManagedMemoryStore",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "managed_memory_store",
+              "description": "The memory store to update. `name` is taken from the URL.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "ManagedMemoryStore",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "ManagedMemoryStore",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "managed_memory_store",
+                "description": "The memory store to update. `name` is taken from the URL.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ManagedMemoryStore",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name in the form `memory-stores/{managed_memory_store_id}`.",
+                "required": true,
+                "is_path": true,
+                "is_output_only": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Only `description` and `metadata` may be updated. Selecting `metadata` replaces the entire map.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Time when the store was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "creator_user_id",
+                "description": "Workspace-local user ID of the authenticated principal that created the store. This is\nimmutable server-set attribution and does not grant access; authorization is evaluated from\nthe authenticated request context.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "Human-readable description of the memory store.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "Deprecated compatibility alias for the caller-provided memory store ID. Canonical\nclients provide the ID through `CreateMemoryStoreRequest.managed_memory_store_id` and use\n`name` as the resource identifier.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name in the form `memory-stores/{managed_memory_store_id}`.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "owner_user_id",
+                "description": "Deprecated alias for `creator_user_id`. This identifies the original creator, not a\ntransferable owner. Use `creator_user_id` instead.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "storage_backend",
+                "description": "Service-managed storage backing this memory store.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "StorageBackend",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "Time when the store was last updated.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "workspace_id",
+                "description": "Workspace that owns the memory store.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Resource name in the form `memory-stores/{managed_memory_store_id}`.",
+                "required": true,
+                "is_path": true,
+                "is_output_only": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Only `description` and `metadata` may be updated. Selecting `metadata` replaces the entire map.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateSession",
+            "description": "Updates a session's mutable fields.",
+            "summary": "Update a session.",
+            "path": "/api/2.0/agents/{name=session-stores/*/sessions/*}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "UpdateSessionRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name in the form `session-stores/{session_store_id}/sessions/{session_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "is_output_only": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "session",
+                  "description": "Session to update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Session",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Fields to update. Only `metadata` is mutable; any other path returns\n`INVALID_PARAMETER_VALUE`.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name in the form `session-stores/{session_store_id}/sessions/{session_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "is_output_only": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Fields to update. Only `metadata` is mutable; any other path returns\n`INVALID_PARAMETER_VALUE`.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "session",
+                  "description": "Session to update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Session",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "session",
+              "description": "Session to update.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Session",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "actor_id",
+                    "description": "Opaque caller-provided identifier for the application actor associated with the session.\n\nThis is application data and has no Databricks authentication or authorization semantics.\nUse the same value as the Managed Memory Entry `actor_id` when storing memories associated\nwith this actor. Every session must set it. A child session must use the same value as its parent.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "actor_id",
+                    "description": "Opaque caller-provided identifier for the application actor associated with the session.\n\nThis is application data and has no Databricks authentication or authorization semantics.\nUse the same value as the Managed Memory Entry `actor_id` when storing memories associated\nwith this actor. Every session must set it. A child session must use the same value as its parent.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "Session",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "actor_id",
+                  "description": "Opaque caller-provided identifier for the application actor associated with the session.\n\nThis is application data and has no Databricks authentication or authorization semantics.\nUse the same value as the Managed Memory Entry `actor_id` when storing memories associated\nwith this actor. Every session must set it. A child session must use the same value as its parent.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "actor_id",
+                  "description": "Opaque caller-provided identifier for the application actor associated with the session.\n\nThis is application data and has no Databricks authentication or authorization semantics.\nUse the same value as the Managed Memory Entry `actor_id` when storing memories associated\nwith this actor. Every session must set it. A child session must use the same value as its parent.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Resource name in the form `session-stores/{session_store_id}/sessions/{session_id}`.",
+                "required": true,
+                "is_path": true,
+                "is_output_only": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "session",
+                "description": "Session to update.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Session",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "actor_id",
+                      "description": "Opaque caller-provided identifier for the application actor associated with the session.\n\nThis is application data and has no Databricks authentication or authorization semantics.\nUse the same value as the Managed Memory Entry `actor_id` when storing memories associated\nwith this actor. Every session must set it. A child session must use the same value as its parent.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "actor_id",
+                      "description": "Opaque caller-provided identifier for the application actor associated with the session.\n\nThis is application data and has no Databricks authentication or authorization semantics.\nUse the same value as the Managed Memory Entry `actor_id` when storing memories associated\nwith this actor. Every session must set it. A child session must use the same value as its parent.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Fields to update. Only `metadata` is mutable; any other path returns\n`INVALID_PARAMETER_VALUE`.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "actor_id",
+                "description": "Opaque caller-provided identifier for the application actor associated with the session.\n\nThis is application data and has no Databricks authentication or authorization semantics.\nUse the same value as the Managed Memory Entry `actor_id` when storing memories associated\nwith this actor. Every session must set it. A child session must use the same value as its parent.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Time when the session was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "last_activity_time",
+                "description": "Time when the session's item history was last mutated.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "metadata",
+                "description": "Mutable caller-defined string labels.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name in the form `session-stores/{session_store_id}/sessions/{session_id}`.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent_session_id",
+                "description": "Immediate parent session ID. Set only at creation for child sessions, immutable thereafter, and\nrestricted to the same store.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "root_session_id",
+                "description": "Top-level session ID in the spawn tree. This equals `session_id` for a root or fork and is\ninherited transitively by child sessions.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "session_id",
+                "description": "Unique session ID. The service generates a UUID unless the caller supplies\n`CreateSessionRequest.session_id`.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "Time when session resource fields last changed.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Resource name in the form `session-stores/{session_store_id}/sessions/{session_id}`.",
+                "required": true,
+                "is_path": true,
+                "is_output_only": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Fields to update. Only `metadata` is mutable; any other path returns\n`INVALID_PARAMETER_VALUE`.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "actor_id",
+                "description": "Opaque caller-provided identifier for the application actor associated with the session.\n\nThis is application data and has no Databricks authentication or authorization semantics.\nUse the same value as the Managed Memory Entry `actor_id` when storing memories associated\nwith this actor. Every session must set it. A child session must use the same value as its parent.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateSessionStore",
+            "description": "Updates a session store's description and metadata.",
+            "summary": "Update a session store.",
+            "path": "/api/2.0/agents/{name=session-stores/*}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "UpdateSessionStoreRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name in the form `session-stores/{session_store_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "is_output_only": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "session_store",
+                  "description": "Session store to update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "SessionStore",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Fields to update. Only `description` and `metadata` are mutable; any other\npath returns `INVALID_PARAMETER_VALUE`.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name in the form `session-stores/{session_store_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "is_output_only": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Fields to update. Only `description` and `metadata` are mutable; any other\npath returns `INVALID_PARAMETER_VALUE`.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "session_store",
+                  "description": "Session store to update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "SessionStore",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "session_store",
+              "description": "Session store to update.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "SessionStore",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "SessionStore",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Resource name in the form `session-stores/{session_store_id}`.",
+                "required": true,
+                "is_path": true,
+                "is_output_only": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "session_store",
+                "description": "Session store to update.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "SessionStore",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Fields to update. Only `description` and `metadata` are mutable; any other\npath returns `INVALID_PARAMETER_VALUE`.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Time when the store was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "creator_user_id",
+                "description": "Workspace-local user ID of the authenticated principal that created the store. This is\nimmutable server-set attribution and does not grant access; authorization is evaluated from\nthe authenticated request context.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "Human-readable description of the session store.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "metadata",
+                "description": "Mutable caller-defined string labels.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name in the form `session-stores/{session_store_id}`.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "Time when the store was last updated.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Resource name in the form `session-stores/{session_store_id}`.",
+                "required": true,
+                "is_path": true,
+                "is_output_only": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Fields to update. Only `description` and `metadata` are mutable; any other\npath returns `INVALID_PARAMETER_VALUE`.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "aifunctions.AiFunctions",
+        "name": "AiFunctions",
+        "description": "Transform and enrich data with AI on Databricks.",
+        "package": {
+          "name": "aifunctions"
+        },
+        "docs_group": "aifunctions",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "methods": [
+          {
+            "name": "AiClassify",
+            "description": "Classifies content according to a set of provided labels. For REST API requests, the default rate limit is 1,200 requests per minute per workspace. Contact your Databricks account team to request a higher limit.",
+            "summary": "Classify text into labels.",
+            "path": "/api/2.0/ai-functions/ai-classify",
+            "can_use_json": true,
+            "must_use_json": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "AiClassifyRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "content",
+                  "description": "The content to classify. It accepts a plain string or the response object of [ai_parse_document](:method:AiFunctions/AiParseDocument).",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {}
+                },
+                {
+                  "name": "labels",
+                  "description": "The label set to classify as. Either a JSON array of label strings (e.g. [\"spam\", \"not_spam\"]), or a JSON object mapping each label to a description (e.g. {\"spam\": \"unsolicited bulk message\", \"not_spam\": \"a legitimate message\"}). Accepts 2 to 500 labels, each 1 to 100 characters.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {}
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "content",
+                  "description": "The content to classify. It accepts a plain string or the response object of [ai_parse_document](:method:AiFunctions/AiParseDocument).",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {}
+                },
+                {
+                  "name": "labels",
+                  "description": "The label set to classify as. Either a JSON array of label strings (e.g. [\"spam\", \"not_spam\"]), or a JSON object mapping each label to a description (e.g. {\"spam\": \"unsolicited bulk message\", \"not_spam\": \"a legitimate message\"}). Accepts 2 to 500 labels, each 1 to 100 characters.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {}
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "AiClassifyResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "content",
+                "description": "The content to classify. It accepts a plain string or the response object of [ai_parse_document](:method:AiFunctions/AiParseDocument).",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {}
+              },
+              {
+                "name": "labels",
+                "description": "The label set to classify as. Either a JSON array of label strings (e.g. [\"spam\", \"not_spam\"]), or a JSON object mapping each label to a description (e.g. {\"spam\": \"unsolicited bulk message\", \"not_spam\": \"a legitimate message\"}). Accepts 2 to 500 labels, each 1 to 100 characters.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {}
+              },
+              {
+                "name": "options",
+                "description": "Function options. Omitted fields fall back to their documented defaults.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AiClassifyOptions",
+                  "is_object": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "AiDecide",
+            "description": "Turn text and structured data into decisions your application can use. Define questions and criteria to choose an option, estimate a probability, or assign a score given a provided state.",
+            "summary": "Get fast structured decisions.",
+            "path": "/api/2.0/ai-functions/ai-decide",
+            "can_use_json": true,
+            "must_use_json": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "AiDecideRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "state",
+                  "description": "A string, JSON object, or array containing the content, related context, and examples needed to answer the provided questions. For example, provide a support message, a conversation, or records describing the current state of an application. All questions receive this same state.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {}
+                },
+                {
+                  "name": "questions",
+                  "description": "A JSON object mapping question IDs to their definitions. Each ID must contain non-whitespace text; its answer is returned with the same ID in `response.answers`.\n\nEach definition is an object with the required fields `type` and `instructions`. The `criteria` field is optional for the type `noul` but is required for the types `choice` and `score`.\n\nThe `instructions` field describes the judgment to make and can be a string, object, or array. Use an object or array to include supporting context alongside the instructions.\n\nThe `type` can be one of:\n\n- `choice`: Selects one option from a defined set. Requires `criteria` to be an object mapping 1 to 255 nonempty option names to descriptions. The criteria description can be a string, object, array, or null when the name needs no additional detail. For example:\n\n```json\n{\n\"team\": {\n\"type\": \"choice\",\n\"instructions\": \"Which team should handle this ticket?\",\n\"criteria\": {\n\"billing\": \"Payments, charges, and refunds\",\n\"technical_support\": null\n}\n}\n}\n```\n\n- `noul`: Estimates the probability that the answer to a true-or-false question is true. `criteria` can take the fields `true` or `false`, or both, with descriptions that are strings, objects, or arrays. Omit `criteria` to use the question alone. The instructions or at least one criteria description must contain non-whitespace text, a nonempty object, or a nonempty array. For example, both of the following are valid:\n\n```json\n{\n\"escalate\": {\n\"type\": \"noul\",\n\"instructions\": \"Does this ticket need escalation?\",\n\"criteria\": {\n\"true\": \"Suspected fraud or an exception to standard policy\",\n\"false\": \"A routine issue frontline support can resolve\"\n}\n}\n}\n```\n\nor\n\n```json\n{\n\"escalate\": {\n\"type\": \"noul\",\n\"instructions\": \"Does this ticket need escalation?\"\n}\n}\n```\n\n- `score`: Rates the state on an ordered scale. Requires `criteria` to be an array of 2 to 10 level descriptions, ordered from low to high. Descriptions must contain non-whitespace text, a nonempty object, or a nonempty array. Array positions define levels starting at 0. For example:\n\n```json\n{\n\"urgency\": {\n\"type\": \"score\",\n\"instructions\": \"How urgent is this ticket?\",\n\"criteria\": [\n\"Routine: can wait a few days\",\n\"Time-sensitive: needs attention today\",\n\"Critical: needs immediate action\"\n]\n}\n}\n```",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {}
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "state",
+                  "description": "A string, JSON object, or array containing the content, related context, and examples needed to answer the provided questions. For example, provide a support message, a conversation, or records describing the current state of an application. All questions receive this same state.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {}
+                },
+                {
+                  "name": "questions",
+                  "description": "A JSON object mapping question IDs to their definitions. Each ID must contain non-whitespace text; its answer is returned with the same ID in `response.answers`.\n\nEach definition is an object with the required fields `type` and `instructions`. The `criteria` field is optional for the type `noul` but is required for the types `choice` and `score`.\n\nThe `instructions` field describes the judgment to make and can be a string, object, or array. Use an object or array to include supporting context alongside the instructions.\n\nThe `type` can be one of:\n\n- `choice`: Selects one option from a defined set. Requires `criteria` to be an object mapping 1 to 255 nonempty option names to descriptions. The criteria description can be a string, object, array, or null when the name needs no additional detail. For example:\n\n```json\n{\n\"team\": {\n\"type\": \"choice\",\n\"instructions\": \"Which team should handle this ticket?\",\n\"criteria\": {\n\"billing\": \"Payments, charges, and refunds\",\n\"technical_support\": null\n}\n}\n}\n```\n\n- `noul`: Estimates the probability that the answer to a true-or-false question is true. `criteria` can take the fields `true` or `false`, or both, with descriptions that are strings, objects, or arrays. Omit `criteria` to use the question alone. The instructions or at least one criteria description must contain non-whitespace text, a nonempty object, or a nonempty array. For example, both of the following are valid:\n\n```json\n{\n\"escalate\": {\n\"type\": \"noul\",\n\"instructions\": \"Does this ticket need escalation?\",\n\"criteria\": {\n\"true\": \"Suspected fraud or an exception to standard policy\",\n\"false\": \"A routine issue frontline support can resolve\"\n}\n}\n}\n```\n\nor\n\n```json\n{\n\"escalate\": {\n\"type\": \"noul\",\n\"instructions\": \"Does this ticket need escalation?\"\n}\n}\n```\n\n- `score`: Rates the state on an ordered scale. Requires `criteria` to be an array of 2 to 10 level descriptions, ordered from low to high. Descriptions must contain non-whitespace text, a nonempty object, or a nonempty array. Array positions define levels starting at 0. For example:\n\n```json\n{\n\"urgency\": {\n\"type\": \"score\",\n\"instructions\": \"How urgent is this ticket?\",\n\"criteria\": [\n\"Routine: can wait a few days\",\n\"Time-sensitive: needs attention today\",\n\"Critical: needs immediate action\"\n]\n}\n}\n```",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {}
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "AiDecideResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "options",
+                "description": "Function options. Omitted fields fall back to their documented defaults.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AiDecideOptions",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "questions",
+                "description": "A JSON object mapping question IDs to their definitions. Each ID must contain non-whitespace text; its answer is returned with the same ID in `response.answers`.\n\nEach definition is an object with the required fields `type` and `instructions`. The `criteria` field is optional for the type `noul` but is required for the types `choice` and `score`.\n\nThe `instructions` field describes the judgment to make and can be a string, object, or array. Use an object or array to include supporting context alongside the instructions.\n\nThe `type` can be one of:\n\n- `choice`: Selects one option from a defined set. Requires `criteria` to be an object mapping 1 to 255 nonempty option names to descriptions. The criteria description can be a string, object, array, or null when the name needs no additional detail. For example:\n\n```json\n{\n\"team\": {\n\"type\": \"choice\",\n\"instructions\": \"Which team should handle this ticket?\",\n\"criteria\": {\n\"billing\": \"Payments, charges, and refunds\",\n\"technical_support\": null\n}\n}\n}\n```\n\n- `noul`: Estimates the probability that the answer to a true-or-false question is true. `criteria` can take the fields `true` or `false`, or both, with descriptions that are strings, objects, or arrays. Omit `criteria` to use the question alone. The instructions or at least one criteria description must contain non-whitespace text, a nonempty object, or a nonempty array. For example, both of the following are valid:\n\n```json\n{\n\"escalate\": {\n\"type\": \"noul\",\n\"instructions\": \"Does this ticket need escalation?\",\n\"criteria\": {\n\"true\": \"Suspected fraud or an exception to standard policy\",\n\"false\": \"A routine issue frontline support can resolve\"\n}\n}\n}\n```\n\nor\n\n```json\n{\n\"escalate\": {\n\"type\": \"noul\",\n\"instructions\": \"Does this ticket need escalation?\"\n}\n}\n```\n\n- `score`: Rates the state on an ordered scale. Requires `criteria` to be an array of 2 to 10 level descriptions, ordered from low to high. Descriptions must contain non-whitespace text, a nonempty object, or a nonempty array. Array positions define levels starting at 0. For example:\n\n```json\n{\n\"urgency\": {\n\"type\": \"score\",\n\"instructions\": \"How urgent is this ticket?\",\n\"criteria\": [\n\"Routine: can wait a few days\",\n\"Time-sensitive: needs attention today\",\n\"Critical: needs immediate action\"\n]\n}\n}\n```",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {}
+              },
+              {
+                "name": "state",
+                "description": "A string, JSON object, or array containing the content, related context, and examples needed to answer the provided questions. For example, provide a support message, a conversation, or records describing the current state of an application. All questions receive this same state.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {}
+              }
+            ]
+          },
+          {
+            "name": "AiExtract",
+            "description": "Extracts structured data from text and documents according to a provided schema. For REST API requests, the default rate limit is 120 requests per minute per workspace. Contact your Databricks account team to request a higher limit.",
+            "summary": "Extract structured data from text.",
+            "path": "/api/2.0/ai-functions/ai-extract",
+            "can_use_json": true,
+            "must_use_json": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "AiExtractRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "content",
+                  "description": "The text to extract from. It accepts a plain string or the response object of [ai_parse_document](:method:AiFunctions/AiParseDocument).",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {}
+                },
+                {
+                  "name": "schema",
+                  "description": "The extraction schema defining the fields to extract. Either a JSON array of field names, assumed to be strings (e.g. [\"company\", \"valuation\"]), or a JSON object mapping each field to its type/description/nullability (e.g. {\"company\": {\"type\": \"string\", \"description\": \"the company name\"}}). Accepts up to 256 fields, 12 levels of nesting, and 500 enum values. Supported field types are string, integer, number, boolean, and enum.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {}
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "content",
+                  "description": "The text to extract from. It accepts a plain string or the response object of [ai_parse_document](:method:AiFunctions/AiParseDocument).",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {}
+                },
+                {
+                  "name": "schema",
+                  "description": "The extraction schema defining the fields to extract. Either a JSON array of field names, assumed to be strings (e.g. [\"company\", \"valuation\"]), or a JSON object mapping each field to its type/description/nullability (e.g. {\"company\": {\"type\": \"string\", \"description\": \"the company name\"}}). Accepts up to 256 fields, 12 levels of nesting, and 500 enum values. Supported field types are string, integer, number, boolean, and enum.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {}
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "AiExtractResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "content",
+                "description": "The text to extract from. It accepts a plain string or the response object of [ai_parse_document](:method:AiFunctions/AiParseDocument).",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {}
+              },
+              {
+                "name": "options",
+                "description": "Function options. Omitted fields fall back to their documented defaults.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AiExtractOptions",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "schema",
+                "description": "The extraction schema defining the fields to extract. Either a JSON array of field names, assumed to be strings (e.g. [\"company\", \"valuation\"]), or a JSON object mapping each field to its type/description/nullability (e.g. {\"company\": {\"type\": \"string\", \"description\": \"the company name\"}}). Accepts up to 256 fields, 12 levels of nesting, and 500 enum values. Supported field types are string, integer, number, boolean, and enum.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {}
+              }
+            ]
+          },
+          {
+            "name": "AiParseDocument",
+            "description": "Parse structured content from unstructured documents.",
+            "summary": "Parse documents into structured content.",
+            "path": "/api/2.0/ai-functions/ai-parse-document",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "AiParseDocumentRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "content",
+                  "description": "The document to parse. The REST API accepts a Unity Catalog volume path to the source file or a base64 data URL containing the file bytes (for example, data:application/pdf;base64,\u003cencoded-file-bytes\u003e or data:image/jpeg;base64,\u003cencoded-file-bytes\u003e). Supported formats: PDF, DOCX, DOC, PPTX, PPT, JPG, JPEG, PNG, TIFF. Accepts up to 100 pages and 100 MB per document.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "content",
+                  "description": "The document to parse. The REST API accepts a Unity Catalog volume path to the source file or a base64 data URL containing the file bytes (for example, data:application/pdf;base64,\u003cencoded-file-bytes\u003e or data:image/jpeg;base64,\u003cencoded-file-bytes\u003e). Supported formats: PDF, DOCX, DOC, PPTX, PPT, JPG, JPEG, PNG, TIFF. Accepts up to 100 pages and 100 MB per document.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "AiParseDocumentResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "content",
+                "description": "The document to parse. The REST API accepts a Unity Catalog volume path to the source file or a base64 data URL containing the file bytes (for example, data:application/pdf;base64,\u003cencoded-file-bytes\u003e or data:image/jpeg;base64,\u003cencoded-file-bytes\u003e). Supported formats: PDF, DOCX, DOC, PPTX, PPT, JPG, JPEG, PNG, TIFF. Accepts up to 100 pages and 100 MB per document.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "options",
+                "description": "Function options. Omitted fields fall back to their documented defaults.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AiParseDocumentOptions",
+                  "is_object": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "content",
+                "description": "The document to parse. The REST API accepts a Unity Catalog volume path to the source file or a base64 data URL containing the file bytes (for example, data:application/pdf;base64,\u003cencoded-file-bytes\u003e or data:image/jpeg;base64,\u003cencoded-file-bytes\u003e). Supported formats: PDF, DOCX, DOC, PPTX, PPT, JPG, JPEG, PNG, TIFF. Accepts up to 100 pages and 100 MB per document.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "catalog.AiGateway",
+        "name": "AiGateway",
+        "description": "Govern AI workloads in Unity Catalog. This API manages the Unity Catalog securables that bring centralized access control, lineage, and auditing to AI-serving entities: model services (governed access to foundation models and external LLMs), model provider services (governed resources for external model providers), and MCP services (governed Model Context Protocol servers).",
+        "package": {
+          "name": "catalog"
+        },
+        "docs_group": "catalog",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListMcpServicesRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "CreateMcpService",
+            "description": "Creates an MCP service in a Unity Catalog schema. An MCP (Model Context\nProtocol) service is a governed securable that registers an MCP server and\nexposes its tools for discovery, access control, and invocation. Specify\nits name in `mcp_service_id`.\n\nYou must be the owner of the parent schema or have the `CREATE_SERVICE`\nand `USE_SCHEMA` privileges on the parent schema and `USE_CATALOG` on the\nparent catalog. You also need `USE_CONNECTION` on the connection the MCP\nservice references.",
+            "summary": "Create an MCP service.",
+            "path": "/api/2.1/unity-catalog/mcp-services",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateMcpServiceRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "mcp_service",
+                  "description": "The MCP service to create. Do not set `name`; the server derives it from\n`parent` and `mcp_service_id`. `source_connection` is required.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "McpService",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "parent",
+                  "description": "Name of the parent schema.\nFormat: `schemas/{catalog}.{schema}`.\nEach `{...}` component is capped at 255 characters individually.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "mcp_service_id",
+                  "description": "Name for the MCP service, e.g. \"my_mcp_service\".",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "Name of the parent schema.\nFormat: `schemas/{catalog}.{schema}`.\nEach `{...}` component is capped at 255 characters individually.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "mcp_service_id",
+                  "description": "Name for the MCP service, e.g. \"my_mcp_service\".",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "mcp_service",
+                  "description": "The MCP service to create. Do not set `name`; the server derives it from\n`parent` and `mcp_service_id`. `source_connection` is required.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "McpService",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "mcp_service",
+              "description": "The MCP service to create. Do not set `name`; the server derives it from\n`parent` and `mcp_service_id`. `source_connection` is required.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "McpService",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "McpService",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "mcp_service",
+                "description": "The MCP service to create. Do not set `name`; the server derives it from\n`parent` and `mcp_service_id`. `source_connection` is required.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "McpService",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "mcp_service_id",
+                "description": "Name for the MCP service, e.g. \"my_mcp_service\".",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "Name of the parent schema.\nFormat: `schemas/{catalog}.{schema}`.\nEach `{...}` component is capped at 255 characters individually.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "comment",
+                "description": "User-provided description.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "config",
+                "description": "Connection, tool selectors, and rate limits. Required on Create. On Update,\nprovide this field when `update_mask` contains `config` or one of its\nsubpaths.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "McpServiceConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Time the MCP service was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "created_by",
+                "description": "Creator identity.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_owner",
+                "description": "Owner of the MCP service.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "etag",
+                "description": "Optimistic concurrency token returned on every read. To make an Update or\nDelete conditional, pass the last-read value in that request's `etag`\nfield. In REST responses, this value is a base64 string; URL-encode it when\nsetting the `etag` query parameter.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "metastore_id",
+                "description": "Metastore hosting the MCP service.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name of the MCP service.\nFormat: `mcp-services/{catalog}.{schema}.{mcp_service}`.\nEach `{...}` component is capped at 255 characters individually.\nServer-derived on Create from `parent` +\n`mcp_service_id`; required and immutable on Update/Get/Delete.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "Time the MCP service was last modified.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "updated_by",
+                "description": "Identity of the last updater.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "Name of the parent schema.\nFormat: `schemas/{catalog}.{schema}`.\nEach `{...}` component is capped at 255 characters individually.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "mcp_service_id",
+                "description": "Name for the MCP service, e.g. \"my_mcp_service\".",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateMcpServiceUserMappedCredential",
+            "description": "Logs the caller in to an MCP service: creates their per-user OAuth credential, or\nre-authenticates it if one already exists. The request body carries the OAuth exchange fields.\n\nYou must be the owner of the MCP service or have `EXECUTE` on it, plus `USE_CATALOG` on the\nparent catalog and `USE_SCHEMA` on the parent schema.",
+            "summary": "Create an MCP service user credential.",
+            "path": "/api/2.1/unity-catalog/{name=mcp-services/*}/user-credentials",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "CreateMcpServiceUserMappedCredentialRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the MCP service.\nFormat: `mcp-services/{catalog}.{schema}.{mcp_service}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "login",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "McpServiceUserMappedCredentialLogin",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the MCP service.\nFormat: `mcp-services/{catalog}.{schema}.{mcp_service}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "login",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "McpServiceUserMappedCredentialLogin",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "login",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "McpServiceUserMappedCredentialLogin",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "McpServiceUserMappedCredential",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "login",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "McpServiceUserMappedCredentialLogin",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name of the MCP service.\nFormat: `mcp-services/{catalog}.{schema}.{mcp_service}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "options",
+                "description": "OAuth exchange fields: `pkce_verifier`, `authorization_code`, and `oauth_redirect_uri`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Resource name of the MCP service.\nFormat: `mcp-services/{catalog}.{schema}.{mcp_service}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateModelProviderService",
+            "description": "Creates a model provider service in a Unity Catalog schema. A model\nprovider service stores authentication and request configuration for an\nexternal model provider, such as OpenAI, Azure OpenAI, or Amazon Bedrock.\nModel services reference it to invoke the provider. Specify its name in\n`model_provider_service_id`.\n\nYou must be the owner of the parent schema or have the `CREATE_SERVICE`\nand `USE_SCHEMA` privileges on the parent schema and `USE_CATALOG` on the\nparent catalog. Inline credentials additionally require `CREATE_CONNECTION`\non the parent schema. When using a Unity Catalog service credential, you\nmust have `ACCESS` on that credential.",
+            "summary": "Create a model provider service.",
+            "path": "/api/2.1/unity-catalog/model-provider-services",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateModelProviderServiceRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "model_provider_service",
+                  "description": "The model provider service to create. Do not set `name`; the server derives\nit from `parent` and `model_provider_service_id`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ModelProviderService",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "parent",
+                  "description": "Name of the parent schema.\nFormat: `schemas/{catalog}.{schema}`.\nEach `{...}` component is capped at 255 characters individually.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "model_provider_service_id",
+                  "description": "Name for the model provider service, e.g. \"openai_prod\".",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "Name of the parent schema.\nFormat: `schemas/{catalog}.{schema}`.\nEach `{...}` component is capped at 255 characters individually.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "model_provider_service_id",
+                  "description": "Name for the model provider service, e.g. \"openai_prod\".",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "model_provider_service",
+                  "description": "The model provider service to create. Do not set `name`; the server derives\nit from `parent` and `model_provider_service_id`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ModelProviderService",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "model_provider_service",
+              "description": "The model provider service to create. Do not set `name`; the server derives\nit from `parent` and `model_provider_service_id`.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "ModelProviderService",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "ModelProviderService",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "model_provider_service",
+                "description": "The model provider service to create. Do not set `name`; the server derives\nit from `parent` and `model_provider_service_id`.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ModelProviderService",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "model_provider_service_id",
+                "description": "Name for the model provider service, e.g. \"openai_prod\".",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "Name of the parent schema.\nFormat: `schemas/{catalog}.{schema}`.\nEach `{...}` component is capped at 255 characters individually.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "comment",
+                "description": "User-provided description.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "config",
+                "description": "Provider authentication, exposed models, request-forwarding controls, rate\nlimits, and payload logging. Required on Create. On Update, it is required\nonly when `config` or one of its subpaths appears in `update_mask`.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "ModelProviderServiceConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Time the provider service was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "created_by",
+                "description": "Creator identity.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_owner",
+                "description": "Owner of the model provider service.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "etag",
+                "description": "Optimistic concurrency token returned on every read. To make an Update or\nDelete conditional, pass the last-read value in that request's `etag`\nfield. In REST responses, this value is a base64 string; URL-encode it when\nsetting the `etag` query parameter.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "metastore_id",
+                "description": "Metastore hosting the provider service.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name of the provider service.\nFormat: `model-provider-services/{catalog}.{schema}.{model_provider_service}`.\nEach `{...}` component is capped at 255 characters individually.\nServer-derived on Create from `parent` +\n`model_provider_service_id`; required and immutable on Update/Get/Delete.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "Time the provider service was last modified.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "updated_by",
+                "description": "Identity of the last updater.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "Name of the parent schema.\nFormat: `schemas/{catalog}.{schema}`.\nEach `{...}` component is capped at 255 characters individually.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "model_provider_service_id",
+                "description": "Name for the model provider service, e.g. \"openai_prod\".",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateModelService",
+            "description": "Creates a model service in a Unity Catalog schema. A model service is a\ngoverned AI Gateway endpoint that routes inference requests to one or more\nmodel destinations. Specify its name in `model_service_id`.\n\nYou must be the owner of the parent schema or have the `CREATE_SERVICE`\nand `USE_SCHEMA` privileges on the parent schema and `USE_CATALOG` on the\nparent catalog. For every destination, you also need `USE_CATALOG` and\n`USE_SCHEMA` on its parent and `EXECUTE` on the referenced Unity Catalog\nmodel or model provider service. A provisioned-throughput destination\nadditionally requires `CAN_MANAGE` on its Model Serving endpoint.\nConfiguring an inference table additionally requires `CREATE_TABLE`.",
+            "summary": "Create a model service.",
+            "path": "/api/2.1/unity-catalog/model-services",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateModelServiceRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "model_service",
+                  "description": "The model service to create. Do not set `name`; the server derives it from\n`parent` and `model_service_id`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ModelService",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "parent",
+                  "description": "Name of the parent schema.\nFormat: `schemas/{catalog}.{schema}`.\nEach `{...}` component is capped at 255 characters individually.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "model_service_id",
+                  "description": "Name for the model service, e.g. \"my_model_service\".",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "Name of the parent schema.\nFormat: `schemas/{catalog}.{schema}`.\nEach `{...}` component is capped at 255 characters individually.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "model_service_id",
+                  "description": "Name for the model service, e.g. \"my_model_service\".",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "model_service",
+                  "description": "The model service to create. Do not set `name`; the server derives it from\n`parent` and `model_service_id`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ModelService",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "model_service",
+              "description": "The model service to create. Do not set `name`; the server derives it from\n`parent` and `model_service_id`.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "ModelService",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "ModelService",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "model_service",
+                "description": "The model service to create. Do not set `name`; the server derives it from\n`parent` and `model_service_id`.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ModelService",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "model_service_id",
+                "description": "Name for the model service, e.g. \"my_model_service\".",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "Name of the parent schema.\nFormat: `schemas/{catalog}.{schema}`.\nEach `{...}` component is capped at 255 characters individually.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "comment",
+                "description": "User-provided description.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "config",
+                "description": "Destinations, routing, rate limits, and payload logging configuration.\nRequired on Create. On Update, provide this field when `update_mask`\ncontains `config` or one of its subpaths.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "ModelServiceConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Time the model service was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "created_by",
+                "description": "Creator identity.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_owner",
+                "description": "Owner of the model service.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "etag",
+                "description": "Optimistic concurrency token returned on every read. To make an Update or\nDelete conditional, pass the last-read value in that request's `etag`\nfield. In REST responses, this value is a base64 string; URL-encode it when\nsetting the `etag` query parameter.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "metastore_id",
+                "description": "Metastore hosting the model service.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name of the model service.\nFormat: `model-services/{catalog}.{schema}.{model_service}`.\nEach `{...}` component is capped at 255 characters individually.\nServer-derived on Create from `parent` +\n`model_service_id`; required and immutable on Update/Get/Delete.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "supported_api_types",
+                "description": "API types supported across this service's destinations, such as\n`openai/v1/chat/completions`, `openai/v1/embeddings`, and\n`mlflow/v1/chat/completions`. Derived from the backing models and providers\nat read time.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "Time the model service was last modified.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "updated_by",
+                "description": "Identity of the last updater.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "Name of the parent schema.\nFormat: `schemas/{catalog}.{schema}`.\nEach `{...}` component is capped at 255 characters individually.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "model_service_id",
+                "description": "Name for the model service, e.g. \"my_model_service\".",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateSkill",
+            "description": "Creates a skill in a Unity Catalog schema and provisions its managed bundle\nstorage. Specify its name in `skill_id`. The request contains an optional\ncomment but no bundle bytes. Upload bundle files through the Files API,\nthen call FinalizeSkill.\n\nYou must be the owner of the parent schema or have `CREATE_VOLUME` and\n`USE_SCHEMA` on it, plus `USE_CATALOG` on the parent catalog.",
+            "summary": "Create a skill.",
+            "path": "/api/2.1/unity-catalog/skills",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "CreateSkillRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "skill",
+                  "description": "The skill to create. `comment` is the only accepted client input and may be\nomitted. Do not set `name`; the server derives it from `parent` and\n`skill_id`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Skill",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "parent",
+                  "description": "Name of the parent schema.\nFormat: `schemas/{catalog}.{schema}`.\nEach `{...}` component is capped at 255 characters individually.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "skill_id",
+                  "description": "Name for the skill, e.g. \"basic-math\". The server normalizes this\nidentifier to lowercase. It is independent of the bundle name read from\nSKILL.md.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "Name of the parent schema.\nFormat: `schemas/{catalog}.{schema}`.\nEach `{...}` component is capped at 255 characters individually.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "skill_id",
+                  "description": "Name for the skill, e.g. \"basic-math\". The server normalizes this\nidentifier to lowercase. It is independent of the bundle name read from\nSKILL.md.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "skill",
+                  "description": "The skill to create. `comment` is the only accepted client input and may be\nomitted. Do not set `name`; the server derives it from `parent` and\n`skill_id`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Skill",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "skill",
+              "description": "The skill to create. `comment` is the only accepted client input and may be\nomitted. Do not set `name`; the server derives it from `parent` and\n`skill_id`.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Skill",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "Skill",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "parent",
+                "description": "Name of the parent schema.\nFormat: `schemas/{catalog}.{schema}`.\nEach `{...}` component is capped at 255 characters individually.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "skill",
+                "description": "The skill to create. `comment` is the only accepted client input and may be\nomitted. Do not set `name`; the server derives it from `parent` and\n`skill_id`.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Skill",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "skill_id",
+                "description": "Name for the skill, e.g. \"basic-math\". The server normalizes this\nidentifier to lowercase. It is independent of the bundle name read from\nSKILL.md.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "bundle_name",
+                "description": "Name from the most recently successfully finalized SKILL.md. It may differ\nfrom the final component of the Skill resource name. Unset until\nFinalizeSkill succeeds.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "comment",
+                "description": "User-provided comment for the skill. Free-text, user-editable via\nUpdateSkill (listed in its `update_mask`). DISTINCT from `description`,\nwhich is the server-parsed, OUTPUT_ONLY SKILL.md frontmatter value: `comment`\nis the customer's own annotation and is preserved across bundle re-uploads.\nWhen `comment` is in the update mask, omitting it clears the field, while\nan explicitly empty string is retained.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Time the skill was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "created_by",
+                "description": "Creator identity.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "Description from the most recently successfully finalized SKILL.md. Unset\nuntil FinalizeSkill succeeds.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_owner",
+                "description": "Owner of the skill.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "etag",
+                "description": "Optimistic concurrency token returned on every read. To make an Update or\nDelete conditional, pass the last-read value in that request's `etag`\nfield. In REST responses, this value is a base64 string; URL-encode it when\nsetting the `etag` query parameter.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "finalize_time",
+                "description": "Time of the most recent successful FinalizeSkill. Unset until one succeeds.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "metastore_id",
+                "description": "Metastore hosting the skill.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name of the skill.\nFormat: `skills/{catalog}.{schema}.{skill}`.\nEach `{...}` component is capped at 255 characters individually.\nServer-derived on Create from `parent` +\n`skill_id`; required and immutable on Update/Get/Delete.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "Time of the most recent Skill metadata mutation. Uploading bundle files\nalone does not change this value.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "updated_by",
+                "description": "Identity of the last updater.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "Name of the parent schema.\nFormat: `schemas/{catalog}.{schema}`.\nEach `{...}` component is capped at 255 characters individually.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "skill_id",
+                "description": "Name for the skill, e.g. \"basic-math\". The server normalizes this\nidentifier to lowercase. It is independent of the bundle name read from\nSKILL.md.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteMcpService",
+            "description": "Deletes the MCP service identified by its resource name. Optionally supply\nan `etag` to make the delete conditional on the MCP service not having\nchanged since it was read.\n\nYou must be the owner of the MCP service or have `MANAGE` on it, plus\n`USE_CATALOG` on the parent catalog and `USE_SCHEMA` on the parent schema.",
+            "summary": "Delete an MCP service.",
+            "path": "/api/2.1/unity-catalog/{name=mcp-services/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteMcpServiceRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the MCP service.\nFormat: `mcp-services/{catalog}.{schema}.{mcp_service}`.\nEach `{...}` component is capped at 255 characters individually.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the MCP service.\nFormat: `mcp-services/{catalog}.{schema}.{mcp_service}`.\nEach `{...}` component is capped at 255 characters individually.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "Optimistic concurrency token from the most recent read. When set, the\ndelete succeeds only if the resource has not changed. Leave unset for an\nunconditional delete. For REST requests, URL-encode the base64 string\nreturned by the API when setting the `etag` query parameter.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name of the MCP service.\nFormat: `mcp-services/{catalog}.{schema}.{mcp_service}`.\nEach `{...}` component is capped at 255 characters individually.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Resource name of the MCP service.\nFormat: `mcp-services/{catalog}.{schema}.{mcp_service}`.\nEach `{...}` component is capped at 255 characters individually.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteMcpServiceUserMappedCredential",
+            "description": "Revokes (deletes) the caller's per-user OAuth credential for an MCP service (logout).\n\nYou must be the owner of the MCP service or have `EXECUTE` on it, plus `USE_CATALOG` on the\nparent catalog and `USE_SCHEMA` on the parent schema.",
+            "summary": "Delete an MCP service user credential.",
+            "path": "/api/2.1/unity-catalog/{name=mcp-services/*}/user-credentials",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "DeleteMcpServiceUserMappedCredentialRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the MCP service.\nFormat: `mcp-services/{catalog}.{schema}.{mcp_service}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the MCP service.\nFormat: `mcp-services/{catalog}.{schema}.{mcp_service}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteMcpServiceUserMappedCredentialResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Resource name of the MCP service.\nFormat: `mcp-services/{catalog}.{schema}.{mcp_service}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Resource name of the MCP service.\nFormat: `mcp-services/{catalog}.{schema}.{mcp_service}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteModelProviderService",
+            "description": "Deletes the model provider service identified by its resource name.\nOptionally supply an `etag` to make the delete conditional on the model\nprovider service not having changed since it was read.\n\nYou must be the owner of the model provider service or have `MANAGE` on\nit, plus `USE_CATALOG` on the parent catalog and `USE_SCHEMA` on the\nparent schema.",
+            "summary": "Delete a model provider service.",
+            "path": "/api/2.1/unity-catalog/{name=model-provider-services/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteModelProviderServiceRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the model provider service.\nFormat: `model-provider-services/{catalog}.{schema}.{model_provider_service}`.\nEach `{...}` component is capped at 255 characters individually.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the model provider service.\nFormat: `model-provider-services/{catalog}.{schema}.{model_provider_service}`.\nEach `{...}` component is capped at 255 characters individually.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "Optimistic concurrency token from the most recent read. When set, the\ndelete succeeds only if the resource has not changed. Leave unset for an\nunconditional delete. For REST requests, URL-encode the base64 string\nreturned by the API when setting the `etag` query parameter.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name of the model provider service.\nFormat: `model-provider-services/{catalog}.{schema}.{model_provider_service}`.\nEach `{...}` component is capped at 255 characters individually.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Resource name of the model provider service.\nFormat: `model-provider-services/{catalog}.{schema}.{model_provider_service}`.\nEach `{...}` component is capped at 255 characters individually.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteModelService",
+            "description": "Deletes the model service identified by its resource name. Optionally\nsupply an `etag` to make the delete conditional on the model service not\nhaving changed since it was read.\n\nYou must be the owner of the model service or have `MANAGE` on it, plus\n`USE_CATALOG` on the parent catalog and `USE_SCHEMA` on the parent schema.",
+            "summary": "Delete a model service.",
+            "path": "/api/2.1/unity-catalog/{name=model-services/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteModelServiceRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the model service.\nFormat: `model-services/{catalog}.{schema}.{model_service}`.\nEach `{...}` component is capped at 255 characters individually.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the model service.\nFormat: `model-services/{catalog}.{schema}.{model_service}`.\nEach `{...}` component is capped at 255 characters individually.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "Optimistic concurrency token from the most recent read. When set, the\ndelete succeeds only if the resource has not changed. Leave unset for an\nunconditional delete. For REST requests, URL-encode the base64 string\nreturned by the API when setting the `etag` query parameter.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name of the model service.\nFormat: `model-services/{catalog}.{schema}.{model_service}`.\nEach `{...}` component is capped at 255 characters individually.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Resource name of the model service.\nFormat: `model-services/{catalog}.{schema}.{model_service}`.\nEach `{...}` component is capped at 255 characters individually.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteSkill",
+            "description": "Deletes the skill identified by its resource name and makes its managed\nbundle path unavailable. Managed bundle data is deleted asynchronously.\nOptionally supply an `etag` to make the delete conditional on the skill not\nhaving changed since it was read.\n\nYou must be the owner of the skill or have `MANAGE` on it, plus\n`USE_CATALOG` on the parent catalog and `USE_SCHEMA` on the parent schema.",
+            "summary": "Delete a skill.",
+            "path": "/api/2.1/unity-catalog/{name=skills/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "DeleteSkillRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Full resource name of the skill.\nFormat: `skills/{catalog}.{schema}.{skill}`.\nEach `{...}` component is capped at 255 characters individually.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Full resource name of the skill.\nFormat: `skills/{catalog}.{schema}.{skill}`.\nEach `{...}` component is capped at 255 characters individually.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "Optimistic concurrency token from the most recent read. When set, the\ndelete succeeds only if the resource has not changed. Leave unset for an\nunconditional delete. For REST requests, URL-encode the base64 string\nreturned by the API when setting the `etag` query parameter.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Full resource name of the skill.\nFormat: `skills/{catalog}.{schema}.{skill}`.\nEach `{...}` component is capped at 255 characters individually.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Full resource name of the skill.\nFormat: `skills/{catalog}.{schema}.{skill}`.\nEach `{...}` component is capped at 255 characters individually.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "FinalizeSkill",
+            "description": "Finalizes a skill after its bundle is uploaded. This method reads SKILL.md\nthrough the Files API using the caller's authorization. Its YAML\nfrontmatter must contain an agentskills.io-compliant `name` and a nonblank\n`description` within the configured UTF-8 byte limit. On success, it\nreplaces `bundle_name` and `description`; refreshes `finalize_time`,\n`update_time`, and `updated_by`; and returns the updated skill. `comment` is\npreserved. Re-finalization uses the latest SKILL.md and is last-write-wins\nwithout an etag precondition. Validation failures do not change metadata.\n\nYou must be the owner of the skill or have `READ_VOLUME` on it, plus\n`USE_CATALOG` on the parent catalog and `USE_SCHEMA` on the parent schema.",
+            "summary": "Finalize a skill.",
+            "path": "/api/2.1/unity-catalog/{name=skills/*}/finalize",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "FinalizeSkillRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Full resource name of the skill.\nFormat: `skills/{catalog}.{schema}.{skill}`.\nEach `{...}` component is capped at 255 characters individually.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Full resource name of the skill.\nFormat: `skills/{catalog}.{schema}.{skill}`.\nEach `{...}` component is capped at 255 characters individually.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Skill",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Full resource name of the skill.\nFormat: `skills/{catalog}.{schema}.{skill}`.\nEach `{...}` component is capped at 255 characters individually.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Full resource name of the skill.\nFormat: `skills/{catalog}.{schema}.{skill}`.\nEach `{...}` component is capped at 255 characters individually.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetMcpService",
+            "description": "Returns the MCP service identified by its resource name.\n\nYou must be the owner of the MCP service or have `EXECUTE`,\n`READ_METADATA`, or `MANAGE` on it, plus `USE_CATALOG` on the parent\ncatalog and `USE_SCHEMA` on the parent schema.",
+            "summary": "Get an MCP service.",
+            "path": "/api/2.1/unity-catalog/{name=mcp-services/*}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetMcpServiceRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the MCP service.\nFormat: `mcp-services/{catalog}.{schema}.{mcp_service}`.\nEach `{...}` component is capped at 255 characters individually.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the MCP service.\nFormat: `mcp-services/{catalog}.{schema}.{mcp_service}`.\nEach `{...}` component is capped at 255 characters individually.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "McpService",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Resource name of the MCP service.\nFormat: `mcp-services/{catalog}.{schema}.{mcp_service}`.\nEach `{...}` component is capped at 255 characters individually.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Resource name of the MCP service.\nFormat: `mcp-services/{catalog}.{schema}.{mcp_service}`.\nEach `{...}` component is capped at 255 characters individually.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetMcpServiceUserMappedCredential",
+            "description": "Returns the caller's per-user OAuth login state for an MCP service. Read\n`provisioning_info.state`: `ACTIVE` means the caller is logged in and the credential is\nusable; any other state (for example a failed or still-provisioning login) means the login has\nnot completed and the caller should log in again. If the caller has no credential yet, the RPC\nreturns `NOT_FOUND`.\n\nYou must be the owner of the MCP service or have `EXECUTE` on it, plus `USE_CATALOG` on the\nparent catalog and `USE_SCHEMA` on the parent schema.",
+            "summary": "Get MCP service user credential status.",
+            "path": "/api/2.1/unity-catalog/{name=mcp-services/*}/user-credentials",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetMcpServiceUserMappedCredentialRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the MCP service.\nFormat: `mcp-services/{catalog}.{schema}.{mcp_service}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the MCP service.\nFormat: `mcp-services/{catalog}.{schema}.{mcp_service}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "McpServiceUserMappedCredential",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Resource name of the MCP service.\nFormat: `mcp-services/{catalog}.{schema}.{mcp_service}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Resource name of the MCP service.\nFormat: `mcp-services/{catalog}.{schema}.{mcp_service}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetModelProviderService",
+            "description": "Returns the model provider service identified by its resource name.\n\nYou must be the owner of the model provider service or have `EXECUTE`,\n`READ_METADATA`, or `MANAGE` on it, plus `USE_CATALOG` on the parent\ncatalog and `USE_SCHEMA` on the parent schema.",
+            "summary": "Get a model provider service.",
+            "path": "/api/2.1/unity-catalog/{name=model-provider-services/*}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetModelProviderServiceRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the model provider service.\nFormat: `model-provider-services/{catalog}.{schema}.{model_provider_service}`.\nEach `{...}` component is capped at 255 characters individually.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the model provider service.\nFormat: `model-provider-services/{catalog}.{schema}.{model_provider_service}`.\nEach `{...}` component is capped at 255 characters individually.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ModelProviderService",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Resource name of the model provider service.\nFormat: `model-provider-services/{catalog}.{schema}.{model_provider_service}`.\nEach `{...}` component is capped at 255 characters individually.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Resource name of the model provider service.\nFormat: `model-provider-services/{catalog}.{schema}.{model_provider_service}`.\nEach `{...}` component is capped at 255 characters individually.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetModelService",
+            "description": "Returns the model service identified by its resource name.\n\nYou must be the owner of the model service or have `EXECUTE`,\n`READ_METADATA`, or `MANAGE` on it, plus `USE_CATALOG` on the parent\ncatalog and `USE_SCHEMA` on the parent schema.",
+            "summary": "Get a model service.",
+            "path": "/api/2.1/unity-catalog/{name=model-services/*}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetModelServiceRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the model service.\nFormat: `model-services/{catalog}.{schema}.{model_service}`.\nEach `{...}` component is capped at 255 characters individually.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the model service.\nFormat: `model-services/{catalog}.{schema}.{model_service}`.\nEach `{...}` component is capped at 255 characters individually.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ModelService",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Resource name of the model service.\nFormat: `model-services/{catalog}.{schema}.{model_service}`.\nEach `{...}` component is capped at 255 characters individually.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Resource name of the model service.\nFormat: `model-services/{catalog}.{schema}.{model_service}`.\nEach `{...}` component is capped at 255 characters individually.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetSkill",
+            "description": "Returns the skill identified by its resource name.\n\nYou must be the owner of the skill or have `READ_VOLUME`, `READ_METADATA`,\nor `MANAGE` on it, plus `USE_CATALOG` on the parent catalog and\n`USE_SCHEMA` on the parent schema.",
+            "summary": "Get a skill.",
+            "path": "/api/2.1/unity-catalog/{name=skills/*}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetSkillRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Full resource name of the skill.\nFormat: `skills/{catalog}.{schema}.{skill}`.\nEach `{...}` component is capped at 255 characters individually.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Full resource name of the skill.\nFormat: `skills/{catalog}.{schema}.{skill}`.\nEach `{...}` component is capped at 255 characters individually.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Skill",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Full resource name of the skill.\nFormat: `skills/{catalog}.{schema}.{skill}`.\nEach `{...}` component is capped at 255 characters individually.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Full resource name of the skill.\nFormat: `skills/{catalog}.{schema}.{skill}`.\nEach `{...}` component is capped at 255 characters individually.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListMcpServices",
+            "description": "Lists the MCP services in a Unity Catalog schema. Provide `parent` as\n`schemas/{catalog}.{schema}`. Results are paginated; pass the returned\n`next_page_token` to fetch subsequent pages.\n\nRequires `USE_CATALOG` on the parent catalog and `USE_SCHEMA` on the\nparent schema. Only MCP services the caller can access (as owner or\nthrough `EXECUTE`, `READ_METADATA`, or `MANAGE`) are returned.",
+            "summary": "List MCP services.",
+            "path": "/api/2.1/unity-catalog/mcp-services",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListMcpServicesRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListMcpServicesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "Maximum number of MCP services to return. Defaults to 100 when unset or 0;\nthe maximum is 200. Use `page_token` to retrieve additional pages.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque pagination token from the previous response.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "Parent schema to list within, in the form\n`schemas/{catalog}.{schema}`. Required. Each `{...}` component is capped at\n255 characters individually.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "view",
+                "description": "Fields to return for each service. `FULL` includes source-connection\ndetails and rate-limit principal names. `BASIC` omits the source connection\nand omits principal names from rate limits. Defaults to `BASIC` when unset.",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "ListMcpServicesRequestView",
+                  "enum": [
+                    {
+                      "content": "BASIC"
+                    },
+                    {
+                      "content": "FULL"
+                    }
+                  ]
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Opaque pagination token from the previous response.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListModelProviderServices",
+            "description": "Lists the model provider services in a Unity Catalog schema. Provide\n`parent` as `schemas/{catalog}.{schema}`. Results are paginated; pass the\nreturned `next_page_token` to fetch subsequent pages.\n\nRequires `USE_CATALOG` on the parent catalog and `USE_SCHEMA` on the\nparent schema. Only model provider services the caller can access (as\nowner or through `EXECUTE`, `READ_METADATA`, or `MANAGE`) are returned.",
+            "summary": "List model provider services.",
+            "path": "/api/2.1/unity-catalog/model-provider-services",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListModelProviderServicesRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListModelProviderServicesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "Maximum number of provider services to return. Defaults to 100 when unset or\n0; the maximum is 200. Use `page_token` to retrieve additional pages.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque pagination token from the previous response.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "Parent schema to list within, in the form\n`schemas/{catalog}.{schema}`. Required. Each `{...}` component is capped at\n255 characters individually.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "view",
+                "description": "Fields to return for each service. `FULL` includes resolved\nservice-credential and inference-table details and rate-limit principal\nnames. `BASIC` omits those details and principal names from rate limits.\nDefaults to `BASIC` when unset.",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "ListModelProviderServicesRequestView",
+                  "enum": [
+                    {
+                      "content": "BASIC"
+                    },
+                    {
+                      "content": "FULL"
+                    }
+                  ]
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Opaque pagination token from the previous response.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListModelServices",
+            "description": "Lists the model services in a Unity Catalog schema. Provide `parent` as\n`schemas/{catalog}.{schema}`. Results are paginated; pass the returned\n`next_page_token` to fetch subsequent pages.\n\nRequires `USE_CATALOG` on the parent catalog and `USE_SCHEMA` on the\nparent schema. Only model services the caller can access (as owner or\nthrough `EXECUTE`, `READ_METADATA`, or `MANAGE`) are returned.",
+            "summary": "List model services.",
+            "path": "/api/2.1/unity-catalog/model-services",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListModelServicesRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListModelServicesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "Maximum number of model services to return. Defaults to 100 when unset or 0;\nthe maximum is 200. Use `page_token` to retrieve additional pages.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque pagination token from the previous response.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "Parent schema to list within, in the form\n`schemas/{catalog}.{schema}`. Required. Each `{...}` component is capped at\n255 characters individually.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "view",
+                "description": "Fields to return for each service. `FULL` includes destinations,\ninference-table details, and rate-limit principal names. `BASIC` omits\ndestinations and inference-table details and omits principal names from\nrate limits. Defaults to `BASIC` when unset.",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "ListModelServicesRequestView",
+                  "enum": [
+                    {
+                      "content": "BASIC"
+                    },
+                    {
+                      "content": "FULL"
+                    }
+                  ]
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Opaque pagination token from the previous response.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListSkills",
+            "description": "Lists skills in a Unity Catalog schema. Provide `parent` as\n`schemas/{catalog}.{schema}`. Results are paginated; pass the returned\n`next_page_token` to fetch subsequent pages.\n\nRequires `USE_CATALOG` on the parent catalog and `USE_SCHEMA` on the parent\nschema. Only skills the caller can access as owner or through `READ_VOLUME`,\n`READ_METADATA`, or `MANAGE` are returned.",
+            "summary": "List skills.",
+            "path": "/api/2.1/unity-catalog/skills",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ListSkillsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "Name of the parent schema. Format: `schemas/{catalog}.{schema}`.\nEach `{...}` component is capped at 255 characters individually.\n\nRequired: skill listing is schema-scoped, so `parent` must be set; an unset\nor empty `parent` is rejected with INVALID_PARAMETER_VALUE.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "Name of the parent schema. Format: `schemas/{catalog}.{schema}`.\nEach `{...}` component is capped at 255 characters individually.\n\nRequired: skill listing is schema-scoped, so `parent` must be set; an unset\nor empty `parent` is rejected with INVALID_PARAMETER_VALUE.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListSkillsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "Maximum number of skills to return. Defaults to 100 when unset or 0; the\nmaximum is 200. Use `page_token` to retrieve additional pages.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque pagination token from a previous request.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "Name of the parent schema. Format: `schemas/{catalog}.{schema}`.\nEach `{...}` component is capped at 255 characters individually.\n\nRequired: skill listing is schema-scoped, so `parent` must be set; an unset\nor empty `parent` is rejected with INVALID_PARAMETER_VALUE.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "Name of the parent schema. Format: `schemas/{catalog}.{schema}`.\nEach `{...}` component is capped at 255 characters individually.\n\nRequired: skill listing is schema-scoped, so `parent` must be set; an unset\nor empty `parent` is rejected with INVALID_PARAMETER_VALUE.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Opaque pagination token from a previous request.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "UpdateMcpService",
+            "description": "Updates an MCP service. Only the fields named in `update_mask` are\nchanged; the resource name is immutable. Optionally supply an `etag` to\nmake the update conditional on the MCP service not having changed since it\nwas read.\n\nYou must be the owner of the MCP service or have `MANAGE` on it, plus\n`USE_CATALOG` on the parent catalog and `USE_SCHEMA` on the parent schema.\nWhen changing `config.source_connection.name`, the MCP service owner must\nalso have `USE_CONNECTION` on the new connection.",
+            "summary": "Update an MCP service.",
+            "path": "/api/2.1/unity-catalog/{name=mcp-services/*}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateMcpServiceRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the MCP service.\nFormat: `mcp-services/{catalog}.{schema}.{mcp_service}`.\nEach `{...}` component is capped at 255 characters individually.\nServer-derived on Create from `parent` +\n`mcp_service_id`; required and immutable on Update/Get/Delete.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "mcp_service",
+                  "description": "The MCP service with the updated field values. `name` identifies the\nresource (`mcp-services/{catalog}.{schema}.{mcp_service}`); only fields\nlisted in `update_mask` are applied.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "McpService",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Fields to update. Use `config` to replace the entire configuration. The\nreplacement must include every required field; any optional field you omit\nis cleared. To preserve sibling fields, use one or more granular paths:\n`comment`, `config.source_connection.name`, `config.include_tool_selectors`, or\n`config.rate_limits`.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the MCP service.\nFormat: `mcp-services/{catalog}.{schema}.{mcp_service}`.\nEach `{...}` component is capped at 255 characters individually.\nServer-derived on Create from `parent` +\n`mcp_service_id`; required and immutable on Update/Get/Delete.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Fields to update. Use `config` to replace the entire configuration. The\nreplacement must include every required field; any optional field you omit\nis cleared. To preserve sibling fields, use one or more granular paths:\n`comment`, `config.source_connection.name`, `config.include_tool_selectors`, or\n`config.rate_limits`.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "mcp_service",
+                  "description": "The MCP service with the updated field values. `name` identifies the\nresource (`mcp-services/{catalog}.{schema}.{mcp_service}`); only fields\nlisted in `update_mask` are applied.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "McpService",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "mcp_service",
+              "description": "The MCP service with the updated field values. `name` identifies the\nresource (`mcp-services/{catalog}.{schema}.{mcp_service}`); only fields\nlisted in `update_mask` are applied.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "McpService",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "McpService",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "Optimistic concurrency token from the most recent read. When set, the\nupdate succeeds only if the resource has not changed. Leave unset for an\nunconditional update. For REST requests, URL-encode the base64 string\nreturned by the API when setting the `etag` query parameter.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "mcp_service",
+                "description": "The MCP service with the updated field values. `name` identifies the\nresource (`mcp-services/{catalog}.{schema}.{mcp_service}`); only fields\nlisted in `update_mask` are applied.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "McpService",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name of the MCP service.\nFormat: `mcp-services/{catalog}.{schema}.{mcp_service}`.\nEach `{...}` component is capped at 255 characters individually.\nServer-derived on Create from `parent` +\n`mcp_service_id`; required and immutable on Update/Get/Delete.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Fields to update. Use `config` to replace the entire configuration. The\nreplacement must include every required field; any optional field you omit\nis cleared. To preserve sibling fields, use one or more granular paths:\n`comment`, `config.source_connection.name`, `config.include_tool_selectors`, or\n`config.rate_limits`.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "comment",
+                "description": "User-provided description.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "config",
+                "description": "Connection, tool selectors, and rate limits. Required on Create. On Update,\nprovide this field when `update_mask` contains `config` or one of its\nsubpaths.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "McpServiceConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Time the MCP service was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "created_by",
+                "description": "Creator identity.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_owner",
+                "description": "Owner of the MCP service.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "etag",
+                "description": "Optimistic concurrency token returned on every read. To make an Update or\nDelete conditional, pass the last-read value in that request's `etag`\nfield. In REST responses, this value is a base64 string; URL-encode it when\nsetting the `etag` query parameter.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "metastore_id",
+                "description": "Metastore hosting the MCP service.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name of the MCP service.\nFormat: `mcp-services/{catalog}.{schema}.{mcp_service}`.\nEach `{...}` component is capped at 255 characters individually.\nServer-derived on Create from `parent` +\n`mcp_service_id`; required and immutable on Update/Get/Delete.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "Time the MCP service was last modified.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "updated_by",
+                "description": "Identity of the last updater.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Resource name of the MCP service.\nFormat: `mcp-services/{catalog}.{schema}.{mcp_service}`.\nEach `{...}` component is capped at 255 characters individually.\nServer-derived on Create from `parent` +\n`mcp_service_id`; required and immutable on Update/Get/Delete.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Fields to update. Use `config` to replace the entire configuration. The\nreplacement must include every required field; any optional field you omit\nis cleared. To preserve sibling fields, use one or more granular paths:\n`comment`, `config.source_connection.name`, `config.include_tool_selectors`, or\n`config.rate_limits`.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateModelProviderService",
+            "description": "Updates a model provider service. Only the fields named in `update_mask`\nare changed; the resource name and provider type are immutable. Optionally\nsupply an `etag` to make the update conditional on the model provider\nservice not having changed since it was read.\n\nYou must be the owner of the model provider service or have `MANAGE` on\nit, plus `USE_CATALOG` on the parent catalog and `USE_SCHEMA` on the\nparent schema.\n\nUpdating `config.provider` cannot change the provider type. Authentication\nmode changes require feature availability and support for both modes on the\nselected provider.",
+            "summary": "Update a model provider service.",
+            "path": "/api/2.1/unity-catalog/{name=model-provider-services/*}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateModelProviderServiceRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the provider service.\nFormat: `model-provider-services/{catalog}.{schema}.{model_provider_service}`.\nEach `{...}` component is capped at 255 characters individually.\nServer-derived on Create from `parent` +\n`model_provider_service_id`; required and immutable on Update/Get/Delete.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "model_provider_service",
+                  "description": "The model provider service with the updated field values. `name`\nidentifies the resource\n(`model-provider-services/{catalog}.{schema}.{model_provider_service}`);\nonly fields listed in `update_mask` are applied.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ModelProviderService",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Fields to update. Use `config` to replace the entire configuration. The\nreplacement must include every required field; any optional field you omit\nis cleared. To preserve sibling fields, use one or more granular paths:\n`comment`; `config.provider` to replace the active provider-specific value\n(for example, `config.openai`; the mask path remains `config.provider`);\n`config.allow_all_targets`, `config.targets`, `config.forward_headers`,\n`config.forward_query_parameters`, `config.forward_unmanaged_paths`,\n`config.rate_limits`, `config.pricing.default_discount_basis_points`, or\n`config.inference_table`. For a pricing update, an explicitly empty `pricing`\nobject clears the discount but retains the object; omitting `pricing` clears\nit. `config.pricing` is not a supported mask path. The provider type is\nimmutable. A `config` or `config.provider` replacement that carries no\nauthentication material preserves the existing authentication binding;\ninput-only plaintext does not need to be read back and re-sent.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the provider service.\nFormat: `model-provider-services/{catalog}.{schema}.{model_provider_service}`.\nEach `{...}` component is capped at 255 characters individually.\nServer-derived on Create from `parent` +\n`model_provider_service_id`; required and immutable on Update/Get/Delete.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Fields to update. Use `config` to replace the entire configuration. The\nreplacement must include every required field; any optional field you omit\nis cleared. To preserve sibling fields, use one or more granular paths:\n`comment`; `config.provider` to replace the active provider-specific value\n(for example, `config.openai`; the mask path remains `config.provider`);\n`config.allow_all_targets`, `config.targets`, `config.forward_headers`,\n`config.forward_query_parameters`, `config.forward_unmanaged_paths`,\n`config.rate_limits`, `config.pricing.default_discount_basis_points`, or\n`config.inference_table`. For a pricing update, an explicitly empty `pricing`\nobject clears the discount but retains the object; omitting `pricing` clears\nit. `config.pricing` is not a supported mask path. The provider type is\nimmutable. A `config` or `config.provider` replacement that carries no\nauthentication material preserves the existing authentication binding;\ninput-only plaintext does not need to be read back and re-sent.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "model_provider_service",
+                  "description": "The model provider service with the updated field values. `name`\nidentifies the resource\n(`model-provider-services/{catalog}.{schema}.{model_provider_service}`);\nonly fields listed in `update_mask` are applied.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ModelProviderService",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "model_provider_service",
+              "description": "The model provider service with the updated field values. `name`\nidentifies the resource\n(`model-provider-services/{catalog}.{schema}.{model_provider_service}`);\nonly fields listed in `update_mask` are applied.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "ModelProviderService",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "ModelProviderService",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "Optimistic concurrency token from the most recent read. When set, the\nupdate succeeds only if the resource has not changed. Leave unset for an\nunconditional update. For REST requests, URL-encode the base64 string\nreturned by the API when setting the `etag` query parameter.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "model_provider_service",
+                "description": "The model provider service with the updated field values. `name`\nidentifies the resource\n(`model-provider-services/{catalog}.{schema}.{model_provider_service}`);\nonly fields listed in `update_mask` are applied.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ModelProviderService",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name of the provider service.\nFormat: `model-provider-services/{catalog}.{schema}.{model_provider_service}`.\nEach `{...}` component is capped at 255 characters individually.\nServer-derived on Create from `parent` +\n`model_provider_service_id`; required and immutable on Update/Get/Delete.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Fields to update. Use `config` to replace the entire configuration. The\nreplacement must include every required field; any optional field you omit\nis cleared. To preserve sibling fields, use one or more granular paths:\n`comment`; `config.provider` to replace the active provider-specific value\n(for example, `config.openai`; the mask path remains `config.provider`);\n`config.allow_all_targets`, `config.targets`, `config.forward_headers`,\n`config.forward_query_parameters`, `config.forward_unmanaged_paths`,\n`config.rate_limits`, `config.pricing.default_discount_basis_points`, or\n`config.inference_table`. For a pricing update, an explicitly empty `pricing`\nobject clears the discount but retains the object; omitting `pricing` clears\nit. `config.pricing` is not a supported mask path. The provider type is\nimmutable. A `config` or `config.provider` replacement that carries no\nauthentication material preserves the existing authentication binding;\ninput-only plaintext does not need to be read back and re-sent.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "comment",
+                "description": "User-provided description.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "config",
+                "description": "Provider authentication, exposed models, request-forwarding controls, rate\nlimits, and payload logging. Required on Create. On Update, it is required\nonly when `config` or one of its subpaths appears in `update_mask`.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "ModelProviderServiceConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Time the provider service was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "created_by",
+                "description": "Creator identity.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_owner",
+                "description": "Owner of the model provider service.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "etag",
+                "description": "Optimistic concurrency token returned on every read. To make an Update or\nDelete conditional, pass the last-read value in that request's `etag`\nfield. In REST responses, this value is a base64 string; URL-encode it when\nsetting the `etag` query parameter.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "metastore_id",
+                "description": "Metastore hosting the provider service.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name of the provider service.\nFormat: `model-provider-services/{catalog}.{schema}.{model_provider_service}`.\nEach `{...}` component is capped at 255 characters individually.\nServer-derived on Create from `parent` +\n`model_provider_service_id`; required and immutable on Update/Get/Delete.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "Time the provider service was last modified.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "updated_by",
+                "description": "Identity of the last updater.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Resource name of the provider service.\nFormat: `model-provider-services/{catalog}.{schema}.{model_provider_service}`.\nEach `{...}` component is capped at 255 characters individually.\nServer-derived on Create from `parent` +\n`model_provider_service_id`; required and immutable on Update/Get/Delete.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Fields to update. Use `config` to replace the entire configuration. The\nreplacement must include every required field; any optional field you omit\nis cleared. To preserve sibling fields, use one or more granular paths:\n`comment`; `config.provider` to replace the active provider-specific value\n(for example, `config.openai`; the mask path remains `config.provider`);\n`config.allow_all_targets`, `config.targets`, `config.forward_headers`,\n`config.forward_query_parameters`, `config.forward_unmanaged_paths`,\n`config.rate_limits`, `config.pricing.default_discount_basis_points`, or\n`config.inference_table`. For a pricing update, an explicitly empty `pricing`\nobject clears the discount but retains the object; omitting `pricing` clears\nit. `config.pricing` is not a supported mask path. The provider type is\nimmutable. A `config` or `config.provider` replacement that carries no\nauthentication material preserves the existing authentication binding;\ninput-only plaintext does not need to be read back and re-sent.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateModelService",
+            "description": "Updates a model service. Only the fields named in `update_mask` are\nchanged; the resource name is immutable. Optionally supply an `etag` to\nmake the update conditional on the model service not having changed since\nit was read.\n\nYou must be the owner of the model service or have `MANAGE` on it, plus\n`USE_CATALOG` on the parent catalog and `USE_SCHEMA` on the parent schema.\nWhen changing destinations, both you and the model service owner need\n`USE_CATALOG` and `USE_SCHEMA` on each destination's parent and `EXECUTE`\non the referenced Unity Catalog model or model provider service. A\nprovisioned-throughput destination additionally requires `CAN_MANAGE` for\nyou and `CAN_QUERY` for the model service owner. Adding an inference table\nadditionally requires `CREATE_TABLE`.",
+            "summary": "Update a model service.",
+            "path": "/api/2.1/unity-catalog/{name=model-services/*}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateModelServiceRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the model service.\nFormat: `model-services/{catalog}.{schema}.{model_service}`.\nEach `{...}` component is capped at 255 characters individually.\nServer-derived on Create from `parent` +\n`model_service_id`; required and immutable on Update/Get/Delete.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "model_service",
+                  "description": "The model service with the updated field values. `name` identifies the\nresource (`model-services/{catalog}.{schema}.{model_service}`); only\nfields listed in `update_mask` are applied.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ModelService",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Fields to update. Use `config` to replace the entire configuration. The\nreplacement must include every required field; any optional field you omit\nis cleared. To preserve sibling fields, use one or more granular paths:\n`comment`, `config.routing.destinations`,\n`config.routing.fallback.destinations`,\n`config.rate_limits`, or `config.inference_table`. Intermediate paths such\nas `config.routing` and `config.routing.fallback` are not supported.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the model service.\nFormat: `model-services/{catalog}.{schema}.{model_service}`.\nEach `{...}` component is capped at 255 characters individually.\nServer-derived on Create from `parent` +\n`model_service_id`; required and immutable on Update/Get/Delete.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Fields to update. Use `config` to replace the entire configuration. The\nreplacement must include every required field; any optional field you omit\nis cleared. To preserve sibling fields, use one or more granular paths:\n`comment`, `config.routing.destinations`,\n`config.routing.fallback.destinations`,\n`config.rate_limits`, or `config.inference_table`. Intermediate paths such\nas `config.routing` and `config.routing.fallback` are not supported.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "model_service",
+                  "description": "The model service with the updated field values. `name` identifies the\nresource (`model-services/{catalog}.{schema}.{model_service}`); only\nfields listed in `update_mask` are applied.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ModelService",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "model_service",
+              "description": "The model service with the updated field values. `name` identifies the\nresource (`model-services/{catalog}.{schema}.{model_service}`); only\nfields listed in `update_mask` are applied.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "ModelService",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "ModelService",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "Optimistic concurrency token from the most recent read. When set, the\nupdate succeeds only if the resource has not changed. Leave unset for an\nunconditional update. For REST requests, URL-encode the base64 string\nreturned by the API when setting the `etag` query parameter.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "model_service",
+                "description": "The model service with the updated field values. `name` identifies the\nresource (`model-services/{catalog}.{schema}.{model_service}`); only\nfields listed in `update_mask` are applied.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ModelService",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name of the model service.\nFormat: `model-services/{catalog}.{schema}.{model_service}`.\nEach `{...}` component is capped at 255 characters individually.\nServer-derived on Create from `parent` +\n`model_service_id`; required and immutable on Update/Get/Delete.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Fields to update. Use `config` to replace the entire configuration. The\nreplacement must include every required field; any optional field you omit\nis cleared. To preserve sibling fields, use one or more granular paths:\n`comment`, `config.routing.destinations`,\n`config.routing.fallback.destinations`,\n`config.rate_limits`, or `config.inference_table`. Intermediate paths such\nas `config.routing` and `config.routing.fallback` are not supported.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "comment",
+                "description": "User-provided description.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "config",
+                "description": "Destinations, routing, rate limits, and payload logging configuration.\nRequired on Create. On Update, provide this field when `update_mask`\ncontains `config` or one of its subpaths.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "ModelServiceConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Time the model service was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "created_by",
+                "description": "Creator identity.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_owner",
+                "description": "Owner of the model service.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "etag",
+                "description": "Optimistic concurrency token returned on every read. To make an Update or\nDelete conditional, pass the last-read value in that request's `etag`\nfield. In REST responses, this value is a base64 string; URL-encode it when\nsetting the `etag` query parameter.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "metastore_id",
+                "description": "Metastore hosting the model service.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name of the model service.\nFormat: `model-services/{catalog}.{schema}.{model_service}`.\nEach `{...}` component is capped at 255 characters individually.\nServer-derived on Create from `parent` +\n`model_service_id`; required and immutable on Update/Get/Delete.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "supported_api_types",
+                "description": "API types supported across this service's destinations, such as\n`openai/v1/chat/completions`, `openai/v1/embeddings`, and\n`mlflow/v1/chat/completions`. Derived from the backing models and providers\nat read time.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "Time the model service was last modified.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "updated_by",
+                "description": "Identity of the last updater.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Resource name of the model service.\nFormat: `model-services/{catalog}.{schema}.{model_service}`.\nEach `{...}` component is capped at 255 characters individually.\nServer-derived on Create from `parent` +\n`model_service_id`; required and immutable on Update/Get/Delete.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Fields to update. Use `config` to replace the entire configuration. The\nreplacement must include every required field; any optional field you omit\nis cleared. To preserve sibling fields, use one or more granular paths:\n`comment`, `config.routing.destinations`,\n`config.routing.fallback.destinations`,\n`config.rate_limits`, or `config.inference_table`. Intermediate paths such\nas `config.routing` and `config.routing.fallback` are not supported.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateSkill",
+            "description": "Updates a skill. Only fields named in `update_mask` are changed; currently\nonly `comment` is supported. The resource name is immutable. Optionally\nsupply an `etag` to make the update conditional on the skill not having\nchanged since it was read. Bundle files, grants, tags, and ownership are\nunchanged.\n\nYou must be the owner of the skill or have `MANAGE` on it, plus\n`USE_CATALOG` on the parent catalog and `USE_SCHEMA` on the parent schema.",
+            "summary": "Update a skill.",
+            "path": "/api/2.1/unity-catalog/{name=skills/*}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "UpdateSkillRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the skill.\nFormat: `skills/{catalog}.{schema}.{skill}`.\nEach `{...}` component is capped at 255 characters individually.\nServer-derived on Create from `parent` +\n`skill_id`; required and immutable on Update/Get/Delete.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "skill",
+                  "description": "The skill with the updated field values. `name` identifies the resource\n(`skills/{catalog}.{schema}.{skill}`); only fields listed in `update_mask`\nare applied.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Skill",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Fields to update; validated against `skill`. REQUIRED, matching the sibling\nUpdate RPCs. `comment` is the only mutable field.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the skill.\nFormat: `skills/{catalog}.{schema}.{skill}`.\nEach `{...}` component is capped at 255 characters individually.\nServer-derived on Create from `parent` +\n`skill_id`; required and immutable on Update/Get/Delete.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Fields to update; validated against `skill`. REQUIRED, matching the sibling\nUpdate RPCs. `comment` is the only mutable field.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "skill",
+                  "description": "The skill with the updated field values. `name` identifies the resource\n(`skills/{catalog}.{schema}.{skill}`); only fields listed in `update_mask`\nare applied.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Skill",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "skill",
+              "description": "The skill with the updated field values. `name` identifies the resource\n(`skills/{catalog}.{schema}.{skill}`); only fields listed in `update_mask`\nare applied.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Skill",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "Skill",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "Optimistic concurrency token from the most recent read. When set, the\nupdate succeeds only if the resource has not changed. Leave unset for an\nunconditional update. For REST requests, URL-encode the base64 string\nreturned by the API when setting the `etag` query parameter.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name of the skill.\nFormat: `skills/{catalog}.{schema}.{skill}`.\nEach `{...}` component is capped at 255 characters individually.\nServer-derived on Create from `parent` +\n`skill_id`; required and immutable on Update/Get/Delete.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "skill",
+                "description": "The skill with the updated field values. `name` identifies the resource\n(`skills/{catalog}.{schema}.{skill}`); only fields listed in `update_mask`\nare applied.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Skill",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Fields to update; validated against `skill`. REQUIRED, matching the sibling\nUpdate RPCs. `comment` is the only mutable field.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "bundle_name",
+                "description": "Name from the most recently successfully finalized SKILL.md. It may differ\nfrom the final component of the Skill resource name. Unset until\nFinalizeSkill succeeds.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "comment",
+                "description": "User-provided comment for the skill. Free-text, user-editable via\nUpdateSkill (listed in its `update_mask`). DISTINCT from `description`,\nwhich is the server-parsed, OUTPUT_ONLY SKILL.md frontmatter value: `comment`\nis the customer's own annotation and is preserved across bundle re-uploads.\nWhen `comment` is in the update mask, omitting it clears the field, while\nan explicitly empty string is retained.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Time the skill was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "created_by",
+                "description": "Creator identity.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "Description from the most recently successfully finalized SKILL.md. Unset\nuntil FinalizeSkill succeeds.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_owner",
+                "description": "Owner of the skill.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "etag",
+                "description": "Optimistic concurrency token returned on every read. To make an Update or\nDelete conditional, pass the last-read value in that request's `etag`\nfield. In REST responses, this value is a base64 string; URL-encode it when\nsetting the `etag` query parameter.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "finalize_time",
+                "description": "Time of the most recent successful FinalizeSkill. Unset until one succeeds.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "metastore_id",
+                "description": "Metastore hosting the skill.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name of the skill.\nFormat: `skills/{catalog}.{schema}.{skill}`.\nEach `{...}` component is capped at 255 characters individually.\nServer-derived on Create from `parent` +\n`skill_id`; required and immutable on Update/Get/Delete.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "Time of the most recent Skill metadata mutation. Uploading bundle files\nalone does not change this value.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "updated_by",
+                "description": "Identity of the last updater.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Resource name of the skill.\nFormat: `skills/{catalog}.{schema}.{skill}`.\nEach `{...}` component is capped at 255 characters individually.\nServer-derived on Create from `parent` +\n`skill_id`; required and immutable on Update/Get/Delete.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Fields to update; validated against `skill`. REQUIRED, matching the sibling\nUpdate RPCs. `comment` is the only mutable field.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "aisearch.AiSearch",
+        "name": "AiSearch",
+        "description": "**AI Search Endpoint**: Represents the compute resources to host AI Search indexes. AIP-conformant replacement for the legacy VectorSearchEndpoints API; functionally equivalent.",
+        "package": {
+          "name": "aisearch"
+        },
+        "docs_group": "aisearch",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "list": {
+          "request": {
+            "pascal_name": "ListEndpointsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "CreateEndpoint",
+            "description": "Create a new AI Search endpoint.",
+            "summary": "Create an AI Search endpoint.",
+            "path": "/api/2.0/ai-search/{parent=workspaces/*}/endpoints",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "CreateEndpointRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "The Workspace where this Endpoint will be created.\nFormat: `workspaces/{workspace_id}`",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "endpoint",
+                  "description": "The Endpoint resource to create. Fields other than `endpoint.name` carry the desired\nconfiguration; `endpoint.name` is server-assigned from `parent` and `endpoint_id`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Endpoint",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "The Workspace where this Endpoint will be created.\nFormat: `workspaces/{workspace_id}`",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "endpoint",
+                  "description": "The Endpoint resource to create. Fields other than `endpoint.name` carry the desired\nconfiguration; `endpoint.name` is server-assigned from `parent` and `endpoint_id`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Endpoint",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "endpoint",
+              "description": "The Endpoint resource to create. Fields other than `endpoint.name` carry the desired\nconfiguration; `endpoint.name` is server-assigned from `parent` and `endpoint_id`.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Endpoint",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "endpoint_type",
+                    "description": "Type of endpoint. Required on create and immutable thereafter.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "EndpointType",
+                      "enum": [
+                        {
+                          "content": "STANDARD"
+                        },
+                        {
+                          "content": "STORAGE_OPTIMIZED"
+                        }
+                      ]
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "endpoint_type",
+                    "description": "Type of endpoint. Required on create and immutable thereafter.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "EndpointType",
+                      "enum": [
+                        {
+                          "content": "STANDARD"
+                        },
+                        {
+                          "content": "STORAGE_OPTIMIZED"
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "Endpoint",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "endpoint_type",
+                  "description": "Type of endpoint. Required on create and immutable thereafter.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "EndpointType",
+                    "enum": [
+                      {
+                        "content": "STANDARD"
+                      },
+                      {
+                        "content": "STORAGE_OPTIMIZED"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "endpoint_type",
+                  "description": "Type of endpoint. Required on create and immutable thereafter.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "EndpointType",
+                    "enum": [
+                      {
+                        "content": "STANDARD"
+                      },
+                      {
+                        "content": "STORAGE_OPTIMIZED"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "endpoint",
+                "description": "The Endpoint resource to create. Fields other than `endpoint.name` carry the desired\nconfiguration; `endpoint.name` is server-assigned from `parent` and `endpoint_id`.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Endpoint",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "endpoint_type",
+                      "description": "Type of endpoint. Required on create and immutable thereafter.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "EndpointType",
+                        "enum": [
+                          {
+                            "content": "STANDARD"
+                          },
+                          {
+                            "content": "STORAGE_OPTIMIZED"
+                          }
+                        ]
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "endpoint_type",
+                      "description": "Type of endpoint. Required on create and immutable thereafter.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "EndpointType",
+                        "enum": [
+                          {
+                            "content": "STANDARD"
+                          },
+                          {
+                            "content": "STORAGE_OPTIMIZED"
+                          }
+                        ]
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "endpoint_id",
+                "description": "The user-supplied short name for the Endpoint, per AIP-133. The server composes the\nfull `Endpoint.name` as `{parent}/endpoints/{endpoint_id}`. AIP-133 does not list\n`endpoint_id` as a fields-may-be-required entry, so we annotate it OPTIONAL on the\nwire; the server still rejects empty values with INVALID_PARAMETER_VALUE.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "The Workspace where this Endpoint will be created.\nFormat: `workspaces/{workspace_id}`",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "budget_policy_id",
+                "description": "The user-selected budget policy id for the endpoint.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Time the endpoint was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "creator",
+                "description": "Creator of the endpoint",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "custom_tags",
+                "description": "The custom tags assigned to the endpoint",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CustomTagList",
+                  "array_value": {
+                    "pascal_name": "CustomTag",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "effective_budget_policy_id",
+                "description": "The budget policy id applied to the endpoint",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "endpoint_status",
+                "description": "Current status of the endpoint",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "EndpointStatus",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "endpoint_type",
+                "description": "Type of endpoint. Required on create and immutable thereafter.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EndpointType",
+                  "enum": [
+                    {
+                      "content": "STANDARD"
+                    },
+                    {
+                      "content": "STORAGE_OPTIMIZED"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "id",
+                "description": "Unique identifier of the endpoint",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "index_count",
+                "description": "Number of indexes on the endpoint",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "last_updated_user",
+                "description": "User who last updated the endpoint",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the AI Search endpoint. Server-assigned full resource path\n(`workspaces/{workspace}/endpoints/{endpoint}`) on output. On create, the\nuser-supplied short name is conveyed via `CreateEndpointRequest.endpoint_id`;\nthe server composes the full `name` and returns it on the response.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "replica_count",
+                "description": "The client-supplied desired number of replicas for the endpoint, applied at\ncreate/update time. Mutually exclusive with `target_qps`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "scaling_info",
+                "description": "Scaling information for the endpoint",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "EndpointScalingInfo",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "target_qps",
+                "description": "Target QPS for the endpoint. Mutually exclusive with `replica_count`. Best-effort;\nthe system does not guarantee this QPS will be achieved.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "throughput_info",
+                "description": "Throughput information for the endpoint",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "EndpointThroughputInfo",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "Time the endpoint was last updated.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "usage_policy_id",
+                "description": "The usage policy id applied to the endpoint.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "The Workspace where this Endpoint will be created.\nFormat: `workspaces/{workspace_id}`",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "endpoint_type",
+                "description": "Type of endpoint. Required on create and immutable thereafter.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EndpointType",
+                  "enum": [
+                    {
+                      "content": "STANDARD"
+                    },
+                    {
+                      "content": "STORAGE_OPTIMIZED"
+                    }
+                  ]
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateIndex",
+            "description": "Create a new AI Search index.",
+            "summary": "Create an AI Search index.",
+            "path": "/api/2.0/ai-search/{parent=workspaces/*/endpoints/*}/indexes",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "CreateIndexRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "The Endpoint where this Index will be created.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}`",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "index",
+                  "description": "The Index resource to create. Fields other than `index.name` carry the desired\nconfiguration; `index.name` is server-assigned from `parent` and `index_id`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Index",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "The Endpoint where this Index will be created.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}`",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "index",
+                  "description": "The Index resource to create. Fields other than `index.name` carry the desired\nconfiguration; `index.name` is server-assigned from `parent` and `index_id`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Index",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "index",
+              "description": "The Index resource to create. Fields other than `index.name` carry the desired\nconfiguration; `index.name` is server-assigned from `parent` and `index_id`.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Index",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "primary_key",
+                    "description": "Primary key of the index. Set on create and immutable thereafter.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "index_type",
+                    "description": "Type of index. Required on create and immutable thereafter.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "IndexType",
+                      "enum": [
+                        {
+                          "content": "DELTA_SYNC"
+                        },
+                        {
+                          "content": "DIRECT_ACCESS"
+                        }
+                      ]
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "primary_key",
+                    "description": "Primary key of the index. Set on create and immutable thereafter.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "index_type",
+                    "description": "Type of index. Required on create and immutable thereafter.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "IndexType",
+                      "enum": [
+                        {
+                          "content": "DELTA_SYNC"
+                        },
+                        {
+                          "content": "DIRECT_ACCESS"
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "Index",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "primary_key",
+                  "description": "Primary key of the index. Set on create and immutable thereafter.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "index_type",
+                  "description": "Type of index. Required on create and immutable thereafter.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "IndexType",
+                    "enum": [
+                      {
+                        "content": "DELTA_SYNC"
+                      },
+                      {
+                        "content": "DIRECT_ACCESS"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "primary_key",
+                  "description": "Primary key of the index. Set on create and immutable thereafter.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "index_type",
+                  "description": "Type of index. Required on create and immutable thereafter.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "IndexType",
+                    "enum": [
+                      {
+                        "content": "DELTA_SYNC"
+                      },
+                      {
+                        "content": "DIRECT_ACCESS"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "index",
+                "description": "The Index resource to create. Fields other than `index.name` carry the desired\nconfiguration; `index.name` is server-assigned from `parent` and `index_id`.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Index",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "primary_key",
+                      "description": "Primary key of the index. Set on create and immutable thereafter.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "index_type",
+                      "description": "Type of index. Required on create and immutable thereafter.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "IndexType",
+                        "enum": [
+                          {
+                            "content": "DELTA_SYNC"
+                          },
+                          {
+                            "content": "DIRECT_ACCESS"
+                          }
+                        ]
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "primary_key",
+                      "description": "Primary key of the index. Set on create and immutable thereafter.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "index_type",
+                      "description": "Type of index. Required on create and immutable thereafter.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "IndexType",
+                        "enum": [
+                          {
+                            "content": "DELTA_SYNC"
+                          },
+                          {
+                            "content": "DIRECT_ACCESS"
+                          }
+                        ]
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "index_id",
+                "description": "The user-supplied Unity Catalog table name for the Index, per AIP-133. The server\ncomposes the full `Index.name` as `{parent}/indexes/{index_id}`. AIP-133 does not\nlist `index_id` as a fields-may-be-required entry, so we annotate it OPTIONAL on the\nwire; the server still rejects empty values with INVALID_PARAMETER_VALUE.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "The Endpoint where this Index will be created.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}`",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "creator",
+                "description": "Creator of the index.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "delta_sync_index_spec",
+                "description": "Specification for a Delta Sync index. Set when `index_type` is `DELTA_SYNC`.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "DeltaSyncIndexSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "direct_access_index_spec",
+                "description": "Specification for a Direct Access index. Set when `index_type` is `DIRECT_ACCESS`.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "DirectAccessIndexSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "endpoint",
+                "description": "Name of the endpoint associated with the index. Ignored on create — the endpoint is\ntaken from `CreateIndexRequest.parent`; populated only on output.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "index_subtype",
+                "description": "The subtype of the index. Set on create and immutable thereafter.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "IndexSubtype",
+                  "enum": [
+                    {
+                      "content": "FULL_TEXT"
+                    },
+                    {
+                      "content": "HYBRID"
+                    },
+                    {
+                      "content": "VECTOR"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "index_type",
+                "description": "Type of index. Required on create and immutable thereafter.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "IndexType",
+                  "enum": [
+                    {
+                      "content": "DELTA_SYNC"
+                    },
+                    {
+                      "content": "DIRECT_ACCESS"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the AI Search index. Server-assigned full resource path\n(`workspaces/{workspace}/endpoints/{endpoint}/indexes/{index}`) on output, where\n`{index}` is the index's Unity Catalog table name. On create, the user-supplied UC\ntable name is conveyed via `CreateIndexRequest.index_id`; the server composes the\nfull `name` and returns it on the response.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "primary_key",
+                "description": "Primary key of the index. Set on create and immutable thereafter.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "status",
+                "description": "Current status of the index.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "IndexStatus",
+                  "is_object": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "The Endpoint where this Index will be created.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}`",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "primary_key",
+                "description": "Primary key of the index. Set on create and immutable thereafter.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "index_type",
+                "description": "Type of index. Required on create and immutable thereafter.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "IndexType",
+                  "enum": [
+                    {
+                      "content": "DELTA_SYNC"
+                    },
+                    {
+                      "content": "DIRECT_ACCESS"
+                    }
+                  ]
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteEndpoint",
+            "description": "Delete an AI Search endpoint.",
+            "summary": "Delete an AI Search endpoint.",
+            "path": "/api/2.0/ai-search/{name=workspaces/*/endpoints/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "DeleteEndpointRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Full resource name of the endpoint to delete.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}`",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Full resource name of the endpoint to delete.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}`",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Full resource name of the endpoint to delete.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}`",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Full resource name of the endpoint to delete.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}`",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteIndex",
+            "description": "Delete an AI Search index.",
+            "summary": "Delete an AI Search index.",
+            "path": "/api/2.0/ai-search/{name=workspaces/*/endpoints/*/indexes/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "DeleteIndexRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Full resource name of the index to delete.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}/indexes/{index_id}`",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Full resource name of the index to delete.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}/indexes/{index_id}`",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Full resource name of the index to delete.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}/indexes/{index_id}`",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Full resource name of the index to delete.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}/indexes/{index_id}`",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetEndpoint",
+            "description": "Get details for a single AI Search endpoint.",
+            "summary": "Get an AI Search endpoint.",
+            "path": "/api/2.0/ai-search/{name=workspaces/*/endpoints/*}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetEndpointRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Full resource name of the endpoint.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}`",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Full resource name of the endpoint.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}`",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Endpoint",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "endpoint_type",
+                  "description": "Type of endpoint. Required on create and immutable thereafter.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "EndpointType",
+                    "enum": [
+                      {
+                        "content": "STANDARD"
+                      },
+                      {
+                        "content": "STORAGE_OPTIMIZED"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "endpoint_type",
+                  "description": "Type of endpoint. Required on create and immutable thereafter.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "EndpointType",
+                    "enum": [
+                      {
+                        "content": "STANDARD"
+                      },
+                      {
+                        "content": "STORAGE_OPTIMIZED"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Full resource name of the endpoint.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}`",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Full resource name of the endpoint.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}`",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetIndex",
+            "description": "Get details for a single AI Search index.",
+            "summary": "Get an AI Search index.",
+            "path": "/api/2.0/ai-search/{name=workspaces/*/endpoints/*/indexes/*}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetIndexRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Full resource name of the index.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}/indexes/{index_id}`",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Full resource name of the index.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}/indexes/{index_id}`",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Index",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "primary_key",
+                  "description": "Primary key of the index. Set on create and immutable thereafter.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "index_type",
+                  "description": "Type of index. Required on create and immutable thereafter.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "IndexType",
+                    "enum": [
+                      {
+                        "content": "DELTA_SYNC"
+                      },
+                      {
+                        "content": "DIRECT_ACCESS"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "primary_key",
+                  "description": "Primary key of the index. Set on create and immutable thereafter.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "index_type",
+                  "description": "Type of index. Required on create and immutable thereafter.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "IndexType",
+                    "enum": [
+                      {
+                        "content": "DELTA_SYNC"
+                      },
+                      {
+                        "content": "DIRECT_ACCESS"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Full resource name of the index.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}/indexes/{index_id}`",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Full resource name of the index.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}/indexes/{index_id}`",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListEndpoints",
+            "description": "List AI Search endpoints in a workspace.",
+            "summary": "List AI Search endpoints.",
+            "path": "/api/2.0/ai-search/{parent=workspaces/*}/endpoints",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "ListEndpointsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "The Workspace that owns this collection of endpoints.\nFormat: `workspaces/{workspace_id}`",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "The Workspace that owns this collection of endpoints.\nFormat: `workspaces/{workspace_id}`",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListEndpointsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "Best-effort upper bound on the number of results to return. Honored as an upper\nbound by the shim: `page_size` only narrows the legacy backend's response, never\nwidens it, so the practical cap is `min(page_size, legacy_fixed_page_size)`.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Page token from a previous response. If not provided, returns the first page.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "The Workspace that owns this collection of endpoints.\nFormat: `workspaces/{workspace_id}`",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "The Workspace that owns this collection of endpoints.\nFormat: `workspaces/{workspace_id}`",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Page token from a previous response. If not provided, returns the first page.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListIndexes",
+            "description": "List AI Search indexes on an endpoint.",
+            "summary": "List AI Search indexes.",
+            "path": "/api/2.0/ai-search/{parent=workspaces/*/endpoints/*}/indexes",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "ListIndexesRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "The Endpoint that owns this collection of indexes.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}`",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "The Endpoint that owns this collection of indexes.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}`",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListIndexesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "Best-effort upper bound on the number of results to return. Honored as an upper\nbound by the shim: `page_size` only narrows the legacy backend's response, never\nwidens it, so the practical cap is `min(page_size, legacy_fixed_page_size)`.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Page token from a previous response. If not provided, returns the first page.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "The Endpoint that owns this collection of indexes.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}`",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "The Endpoint that owns this collection of indexes.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}`",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Page token from a previous response. If not provided, returns the first page.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "QueryIndex",
+            "description": "Query (search) an AI Search index. Read-only, so a read-scoped token may invoke it.",
+            "summary": "Query an AI Search index.",
+            "path": "/api/2.0/ai-search/{name=workspaces/*/endpoints/*/indexes/*}:query",
+            "can_use_json": true,
+            "must_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "QueryIndexRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Full resource name of the index to query.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}/indexes/{index_id}`",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "columns",
+                  "description": "Column names to include in each result row.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "List",
+                    "array_value": {
+                      "is_string": true
+                    }
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Full resource name of the index to query.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}/indexes/{index_id}`",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "columns",
+                  "description": "Column names to include in each result row.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "List",
+                    "array_value": {
+                      "is_string": true
+                    }
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "QueryIndexResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "columns",
+                "description": "Column names to include in each result row.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "columns_to_rerank",
+                "description": "Columns whose values are sent to the reranker.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "facets",
+                "description": "Facets to compute over the matched results (e.g. `\"category TOP 5\"`).",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "filters_json",
+                "description": "JSON string describing query filters (e.g. `{\"id \u003e\": 5}`).",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "max_results",
+                "description": "Maximum number of results to return (the legacy `num_results`). Defaults to 10.\nPrefer `page_size`; when both are set, `page_size` takes precedence.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Full resource name of the index to query.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}/indexes/{index_id}`",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "query_columns",
+                "description": "Text columns to search for `query_text`. When empty, all text columns are searched.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "query_text",
+                "description": "Query text. Required for Delta Sync indexes that compute embeddings from a model endpoint.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "query_type",
+                "description": "Query type: `ANN`, `HYBRID`, or `FULL_TEXT`. Defaults to `ANN`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "query_vector",
+                "description": "Query vector. Required for Direct Access indexes and Delta Sync indexes with self-managed\nvectors.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_float64": true
+                  }
+                }
+              },
+              {
+                "name": "reranker",
+                "description": "If set, results are reranked before being returned.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "RerankerConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "score_threshold",
+                "description": "Score threshold for the approximate nearest-neighbor search. Defaults to 0.0.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_float64": true
+                }
+              },
+              {
+                "name": "sort_columns",
+                "description": "Sort clauses, e.g. `[\"rating DESC\", \"price ASC\"]`. Overrides relevance ordering.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Full resource name of the index to query.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}/indexes/{index_id}`",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "RemoveData",
+            "description": "Remove rows by primary key from a Direct Access AI Search index.",
+            "summary": "Remove data from an AI Search index.",
+            "path": "/api/2.0/ai-search/{name=workspaces/*/endpoints/*/indexes/*}:removeData",
+            "can_use_json": true,
+            "must_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "RemoveDataRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Full resource name of the index. Must be a Direct Access index.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}/indexes/{index_id}`",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "primary_keys",
+                  "description": "Primary keys of the rows to remove.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "List",
+                    "array_value": {
+                      "is_string": true
+                    }
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Full resource name of the index. Must be a Direct Access index.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}/indexes/{index_id}`",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "primary_keys",
+                  "description": "Primary keys of the rows to remove.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "List",
+                    "array_value": {
+                      "is_string": true
+                    }
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "RemoveDataResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Full resource name of the index. Must be a Direct Access index.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}/indexes/{index_id}`",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "primary_keys",
+                "description": "Primary keys of the rows to remove.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Full resource name of the index. Must be a Direct Access index.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}/indexes/{index_id}`",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ScanIndex",
+            "description": "Scan (paginate over) the rows of an AI Search index.",
+            "summary": "Scan an AI Search index.",
+            "path": "/api/2.0/ai-search/{name=workspaces/*/endpoints/*/indexes/*}:scan",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "ScanIndexRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Full resource name of the index to scan.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}/indexes/{index_id}`",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Full resource name of the index to scan.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}/indexes/{index_id}`",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ScanIndexResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Full resource name of the index to scan.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}/indexes/{index_id}`",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "Maximum number of rows to return in this page.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Page token from a previous response; if unset, scanning starts from the beginning.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Full resource name of the index to scan.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}/indexes/{index_id}`",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "SyncIndex",
+            "description": "Synchronize a Delta Sync AI Search index with its source Delta table. Applies only to\nDelta Sync indexes; Direct Access indexes are written via the data-plane upsert path.",
+            "summary": "Synchronize an AI Search index.",
+            "path": "/api/2.0/ai-search/{name=workspaces/*/endpoints/*/indexes/*}:sync",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "SyncIndexRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Full resource name of the index to synchronize. Must be a Delta Sync index.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}/indexes/{index_id}`",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Full resource name of the index to synchronize. Must be a Delta Sync index.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}/indexes/{index_id}`",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "SyncIndexResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Full resource name of the index to synchronize. Must be a Delta Sync index.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}/indexes/{index_id}`",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Full resource name of the index to synchronize. Must be a Delta Sync index.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}/indexes/{index_id}`",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateEndpoint",
+            "description": "Update an existing AI Search endpoint. Multi-bucket masks are supported and\ndispatched in deterministic bucket order: budget policy, custom tags, throughput,\nthen scaling/replicas. Per-bucket dispatch is not atomic across buckets — if a\nlater bucket fails, earlier buckets may already have been applied.",
+            "summary": "Update an AI Search endpoint.",
+            "path": "/api/2.0/ai-search/{name=workspaces/*/endpoints/*}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "UpdateEndpointRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the AI Search endpoint. Server-assigned full resource path\n(`workspaces/{workspace}/endpoints/{endpoint}`) on output. On create, the\nuser-supplied short name is conveyed via `CreateEndpointRequest.endpoint_id`;\nthe server composes the full `name` and returns it on the response.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "endpoint",
+                  "description": "The Endpoint resource to update. `endpoint.name` carries the full resource path.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Endpoint",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the AI Search endpoint. Server-assigned full resource path\n(`workspaces/{workspace}/endpoints/{endpoint}`) on output. On create, the\nuser-supplied short name is conveyed via `CreateEndpointRequest.endpoint_id`;\nthe server composes the full `name` and returns it on the response.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "endpoint",
+                  "description": "The Endpoint resource to update. `endpoint.name` carries the full resource path.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Endpoint",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "endpoint",
+              "description": "The Endpoint resource to update. `endpoint.name` carries the full resource path.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Endpoint",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "endpoint_type",
+                    "description": "Type of endpoint. Required on create and immutable thereafter.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "EndpointType",
+                      "enum": [
+                        {
+                          "content": "STANDARD"
+                        },
+                        {
+                          "content": "STORAGE_OPTIMIZED"
+                        }
+                      ]
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "endpoint_type",
+                    "description": "Type of endpoint. Required on create and immutable thereafter.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "EndpointType",
+                      "enum": [
+                        {
+                          "content": "STANDARD"
+                        },
+                        {
+                          "content": "STORAGE_OPTIMIZED"
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "Endpoint",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "endpoint_type",
+                  "description": "Type of endpoint. Required on create and immutable thereafter.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "EndpointType",
+                    "enum": [
+                      {
+                        "content": "STANDARD"
+                      },
+                      {
+                        "content": "STORAGE_OPTIMIZED"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "endpoint_type",
+                  "description": "Type of endpoint. Required on create and immutable thereafter.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "EndpointType",
+                    "enum": [
+                      {
+                        "content": "STANDARD"
+                      },
+                      {
+                        "content": "STORAGE_OPTIMIZED"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "endpoint",
+                "description": "The Endpoint resource to update. `endpoint.name` carries the full resource path.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Endpoint",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "endpoint_type",
+                      "description": "Type of endpoint. Required on create and immutable thereafter.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "EndpointType",
+                        "enum": [
+                          {
+                            "content": "STANDARD"
+                          },
+                          {
+                            "content": "STORAGE_OPTIMIZED"
+                          }
+                        ]
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "endpoint_type",
+                      "description": "Type of endpoint. Required on create and immutable thereafter.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "EndpointType",
+                        "enum": [
+                          {
+                            "content": "STANDARD"
+                          },
+                          {
+                            "content": "STORAGE_OPTIMIZED"
+                          }
+                        ]
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the AI Search endpoint. Server-assigned full resource path\n(`workspaces/{workspace}/endpoints/{endpoint}`) on output. On create, the\nuser-supplied short name is conveyed via `CreateEndpointRequest.endpoint_id`;\nthe server composes the full `name` and returns it on the response.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "budget_policy_id",
+                "description": "The user-selected budget policy id for the endpoint.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Time the endpoint was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "creator",
+                "description": "Creator of the endpoint",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "custom_tags",
+                "description": "The custom tags assigned to the endpoint",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CustomTagList",
+                  "array_value": {
+                    "pascal_name": "CustomTag",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "effective_budget_policy_id",
+                "description": "The budget policy id applied to the endpoint",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "endpoint_status",
+                "description": "Current status of the endpoint",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "EndpointStatus",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "endpoint_type",
+                "description": "Type of endpoint. Required on create and immutable thereafter.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EndpointType",
+                  "enum": [
+                    {
+                      "content": "STANDARD"
+                    },
+                    {
+                      "content": "STORAGE_OPTIMIZED"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "id",
+                "description": "Unique identifier of the endpoint",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "index_count",
+                "description": "Number of indexes on the endpoint",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "last_updated_user",
+                "description": "User who last updated the endpoint",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the AI Search endpoint. Server-assigned full resource path\n(`workspaces/{workspace}/endpoints/{endpoint}`) on output. On create, the\nuser-supplied short name is conveyed via `CreateEndpointRequest.endpoint_id`;\nthe server composes the full `name` and returns it on the response.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "replica_count",
+                "description": "The client-supplied desired number of replicas for the endpoint, applied at\ncreate/update time. Mutually exclusive with `target_qps`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "scaling_info",
+                "description": "Scaling information for the endpoint",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "EndpointScalingInfo",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "target_qps",
+                "description": "Target QPS for the endpoint. Mutually exclusive with `replica_count`. Best-effort;\nthe system does not guarantee this QPS will be achieved.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "throughput_info",
+                "description": "Throughput information for the endpoint",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "EndpointThroughputInfo",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "Time the endpoint was last updated.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "usage_policy_id",
+                "description": "The usage policy id applied to the endpoint.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the AI Search endpoint. Server-assigned full resource path\n(`workspaces/{workspace}/endpoints/{endpoint}`) on output. On create, the\nuser-supplied short name is conveyed via `CreateEndpointRequest.endpoint_id`;\nthe server composes the full `name` and returns it on the response.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "endpoint_type",
+                "description": "Type of endpoint. Required on create and immutable thereafter.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EndpointType",
+                  "enum": [
+                    {
+                      "content": "STANDARD"
+                    },
+                    {
+                      "content": "STORAGE_OPTIMIZED"
+                    }
+                  ]
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpsertData",
+            "description": "Upsert rows into a Direct Access AI Search index.",
+            "summary": "Upsert data into an AI Search index.",
+            "path": "/api/2.0/ai-search/{name=workspaces/*/endpoints/*/indexes/*}:upsertData",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "UpsertDataRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Full resource name of the index. Must be a Direct Access index.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}/indexes/{index_id}`",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "inputs_json",
+                  "description": "JSON document describing the rows to upsert.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Full resource name of the index. Must be a Direct Access index.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}/indexes/{index_id}`",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "inputs_json",
+                  "description": "JSON document describing the rows to upsert.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "UpsertDataResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "inputs_json",
+                "description": "JSON document describing the rows to upsert.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Full resource name of the index. Must be a Direct Access index.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}/indexes/{index_id}`",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Full resource name of the index. Must be a Direct Access index.\nFormat: `workspaces/{workspace_id}/endpoints/{endpoint_id}/indexes/{index_id}`",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "inputs_json",
+                "description": "JSON document describing the rows to upsert.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "settings.AibiDashboardEmbeddingAccessPolicy",
+        "name": "AibiDashboardEmbeddingAccessPolicy",
+        "description": "Controls whether AI/BI published dashboard embedding is enabled, conditionally enabled, or disabled at the workspace level.\nBy default, this setting is conditionally enabled (ALLOW_APPROVED_DOMAINS).",
+        "package": {
+          "name": "settings"
+        },
+        "has_parent": true,
+        "docs_group": "settings",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "parent_service_id": "settings.Settings",
+        "methods": [
+          {
+            "name": "Delete",
+            "description": "Delete the AI/BI dashboard embedding access policy, reverting back to the default.",
+            "summary": "Delete the AI/BI dashboard embedding access policy.",
+            "path": "/api/2.0/settings/types/aibi_dash_embed_ws_acc_policy/names/default",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "DeleteAibiDashboardEmbeddingAccessPolicySettingRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "DeleteAibiDashboardEmbeddingAccessPolicySettingResponse",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "etag",
+                  "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "etag",
+                  "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Retrieves the AI/BI dashboard embedding access policy.\nThe default setting is ALLOW_APPROVED_DOMAINS, permitting AI/BI dashboards to be embedded on approved domains.",
+            "summary": "Retrieve the AI/BI dashboard embedding access policy.",
+            "path": "/api/2.0/settings/types/aibi_dash_embed_ws_acc_policy/names/default",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetAibiDashboardEmbeddingAccessPolicySettingRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "AibiDashboardEmbeddingAccessPolicySetting",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "aibi_dashboard_embedding_access_policy",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AibiDashboardEmbeddingAccessPolicy",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "aibi_dashboard_embedding_access_policy",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AibiDashboardEmbeddingAccessPolicy",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Updates the AI/BI dashboard embedding access policy at the workspace level.",
+            "summary": "Update the AI/BI dashboard embedding access policy.",
+            "path": "/api/2.0/settings/types/aibi_dash_embed_ws_acc_policy/names/default",
+            "can_use_json": true,
+            "must_use_json": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "UpdateAibiDashboardEmbeddingAccessPolicySettingRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AibiDashboardEmbeddingAccessPolicySetting",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AibiDashboardEmbeddingAccessPolicySetting",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "AibiDashboardEmbeddingAccessPolicySetting",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "aibi_dashboard_embedding_access_policy",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AibiDashboardEmbeddingAccessPolicy",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "aibi_dashboard_embedding_access_policy",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AibiDashboardEmbeddingAccessPolicy",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "allow_missing",
+                "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "field_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "setting",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AibiDashboardEmbeddingAccessPolicySetting",
+                  "is_object": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "settings.AibiDashboardEmbeddingApprovedDomains",
+        "name": "AibiDashboardEmbeddingApprovedDomains",
+        "description": "Controls the list of domains approved to host the embedded AI/BI dashboards.\nThe approved domains list can't be mutated when the current access policy is not set to ALLOW_APPROVED_DOMAINS.",
+        "package": {
+          "name": "settings"
+        },
+        "has_parent": true,
+        "docs_group": "settings",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "parent_service_id": "settings.Settings",
+        "methods": [
+          {
+            "name": "Delete",
+            "description": "Delete the list of domains approved to host embedded AI/BI dashboards, reverting back to the default empty list.",
+            "summary": "Delete AI/BI dashboard embedding approved domains.",
+            "path": "/api/2.0/settings/types/aibi_dash_embed_ws_apprvd_domains/names/default",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "DeleteAibiDashboardEmbeddingApprovedDomainsSettingRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "DeleteAibiDashboardEmbeddingApprovedDomainsSettingResponse",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "etag",
+                  "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "etag",
+                  "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Retrieves the list of domains approved to host embedded AI/BI dashboards.",
+            "summary": "Retrieve the list of domains approved to host embedded AI/BI dashboards.",
+            "path": "/api/2.0/settings/types/aibi_dash_embed_ws_apprvd_domains/names/default",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetAibiDashboardEmbeddingApprovedDomainsSettingRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "AibiDashboardEmbeddingApprovedDomainsSetting",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "aibi_dashboard_embedding_approved_domains",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AibiDashboardEmbeddingApprovedDomains",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "aibi_dashboard_embedding_approved_domains",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AibiDashboardEmbeddingApprovedDomains",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Updates the list of domains approved to host embedded AI/BI dashboards.\nThis update will fail if the current workspace access policy is not ALLOW_APPROVED_DOMAINS.",
+            "summary": "Update the list of domains approved to host embedded AI/BI dashboards.",
+            "path": "/api/2.0/settings/types/aibi_dash_embed_ws_apprvd_domains/names/default",
+            "can_use_json": true,
+            "must_use_json": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "UpdateAibiDashboardEmbeddingApprovedDomainsSettingRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AibiDashboardEmbeddingApprovedDomainsSetting",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AibiDashboardEmbeddingApprovedDomainsSetting",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "AibiDashboardEmbeddingApprovedDomainsSetting",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "aibi_dashboard_embedding_approved_domains",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AibiDashboardEmbeddingApprovedDomains",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "aibi_dashboard_embedding_approved_domains",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AibiDashboardEmbeddingApprovedDomains",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "allow_missing",
+                "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "field_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "setting",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AibiDashboardEmbeddingApprovedDomainsSetting",
+                  "is_object": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "sql.Alerts",
+        "name": "Alerts",
+        "description": "The alerts API can be used to perform CRUD operations on alerts. An alert is a Databricks SQL\nobject that periodically runs a query, evaluates a condition of its result, and notifies one\nor more users and/or notification destinations if the condition was met.\nAlerts can be scheduled using the `sql_task` type of the Jobs API, e.g. :method:jobs/create.",
+        "package": {
+          "name": "sql"
+        },
+        "docs_group": "sql",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "named_id_map": {
+            "pascal_name": "ListAlertsResponseAlertDisplayNameToIdMap"
+          },
+          "request": {
+            "pascal_name": "ListAlertsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates an alert.",
+            "summary": "Create an alert.",
+            "path": "/api/2.0/sql/alerts",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateAlertRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "Alert",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "alert",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CreateAlertRequestAlert",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "auto_resolve_display_name",
+                "description": "If true, automatically resolve alert display name conflicts. Otherwise, fail the request if the alert's display name conflicts with an existing alert's display name.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Moves an alert to the trash. Trashed alerts immediately disappear from searches and list views, and can no longer trigger. You can restore a trashed alert through the UI. A trashed alert is permanently deleted after 30 days.",
+            "summary": "Delete an alert.",
+            "path": "/api/2.0/sql/alerts/{id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "TrashAlertRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Empty",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets an alert.",
+            "summary": "Get an alert.",
+            "path": "/api/2.0/sql/alerts/{id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetAlertRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Alert",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Gets a list of alerts accessible to the user, ordered by creation time. **Warning:** Calling this API concurrently 10 or more times could result in throttling, service degradation, or a temporary ban.",
+            "summary": "List alerts.",
+            "path": "/api/2.0/sql/alerts",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListAlertsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListAlertsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "Update",
+            "description": "Updates an alert.",
+            "summary": "Update an alert.",
+            "path": "/api/2.0/sql/alerts/{id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateAlertRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "update_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Alert",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "alert",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "UpdateAlertRequestAlert",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "auto_resolve_display_name",
+                "description": "If true, automatically resolve alert display name conflicts. Otherwise, fail the request if the alert's display name conflicts with an existing alert's display name.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "sql.AlertsLegacy",
+        "name": "AlertsLegacy",
+        "description": "The alerts API can be used to perform CRUD operations on alerts. An alert is a Databricks SQL\nobject that periodically runs a query, evaluates a condition of its result, and notifies one\nor more users and/or notification destinations if the condition was met.\nAlerts can be scheduled using the `sql_task` type of the Jobs API, e.g. :method:jobs/create.\n\n**Warning**: This API is deprecated. Please see the latest version of the Databricks SQL API. [Learn more](https://docs.databricks.com/en/sql/dbsql-api-latest.html)",
+        "package": {
+          "name": "sql"
+        },
+        "docs_group": "sql",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates an alert.\nAn alert is a Databricks SQL object that periodically runs a query, evaluates a condition of its result,\nand notifies users or notification destinations if the condition was met.\n\n**Warning**: This API is deprecated. Please use :method:alerts/create instead. [Learn more](https://docs.databricks.com/en/sql/dbsql-api-latest.html)",
+            "summary": "Create an alert.",
+            "path": "/api/2.0/preview/sql/alerts",
+            "can_use_json": true,
+            "must_use_json": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "CreateAlert",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the alert.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "options",
+                  "description": "Alert configuration options.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AlertOptions",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "query_id",
+                  "description": "Query ID.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the alert.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "options",
+                  "description": "Alert configuration options.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AlertOptions",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "query_id",
+                  "description": "Query ID.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "LegacyAlert",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Name of the alert.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "options",
+                "description": "Alert configuration options.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AlertOptions",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "The identifier of the workspace folder containing the object.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "query_id",
+                "description": "Query ID.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "rearm",
+                "description": "Number of seconds after being triggered before the alert rearms itself and can be triggered again. If `null`, alert will never be triggered again.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes an alert. Deleted alerts are no longer accessible and cannot be restored.\n**Note**: Unlike queries and dashboards, alerts cannot be moved to the trash.\n\n**Warning**: This API is deprecated. Please use :method:alerts/delete instead. [Learn more](https://docs.databricks.com/en/sql/dbsql-api-latest.html)",
+            "summary": "Delete an alert.",
+            "path": "/api/2.0/preview/sql/alerts/{alert_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "DeleteAlertsLegacyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "alert_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "alert_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "alert_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "alert_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets an alert.\n\n**Warning**: This API is deprecated. Please use :method:alerts/get instead. [Learn more](https://docs.databricks.com/en/sql/dbsql-api-latest.html)",
+            "summary": "Get an alert.",
+            "path": "/api/2.0/preview/sql/alerts/{alert_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetAlertsLegacyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "alert_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "alert_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "LegacyAlert",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "alert_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "alert_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Gets a list of alerts.\n\n**Warning**: This API is deprecated. Please use :method:alerts/list instead. [Learn more](https://docs.databricks.com/en/sql/dbsql-api-latest.html)",
+            "summary": "Get alerts.",
+            "path": "/api/2.0/preview/sql/alerts",
+            "is_legacy_empty_request": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "ListRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "LegacyAlertList",
+              "array_value": {
+                "pascal_name": "LegacyAlert",
+                "is_object": true
+              }
+            }
+          },
+          {
+            "name": "Update",
+            "description": "Updates an alert.\n\n**Warning**: This API is deprecated. Please use :method:alerts/update instead. [Learn more](https://docs.databricks.com/en/sql/dbsql-api-latest.html)",
+            "summary": "Update an alert.",
+            "path": "/api/2.0/preview/sql/alerts/{alert_id}",
+            "can_use_json": true,
+            "must_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "EditAlert",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "alert_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "name",
+                  "description": "Name of the alert.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "options",
+                  "description": "Alert configuration options.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AlertOptions",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "query_id",
+                  "description": "Query ID.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "alert_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the alert.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "options",
+                  "description": "Alert configuration options.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AlertOptions",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "query_id",
+                  "description": "Query ID.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "UpdateResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "alert_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the alert.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "options",
+                "description": "Alert configuration options.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AlertOptions",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "query_id",
+                "description": "Query ID.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "rearm",
+                "description": "Number of seconds after being triggered before the alert rearms itself and can be triggered again. If `null`, alert will never be triggered again.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "alert_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "sql.AlertsV2",
+        "name": "AlertsV2",
+        "description": "New version of SQL Alerts",
+        "package": {
+          "name": "sql"
+        },
+        "docs_group": "sql",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "named_id_map": {
+            "pascal_name": "AlertV2DisplayNameToIdMap"
+          },
+          "request": {
+            "pascal_name": "ListAlertsV2Request"
+          }
+        },
+        "methods": [
+          {
+            "name": "CreateAlert",
+            "description": "Create Alert",
+            "summary": "Create an alert.",
+            "path": "/api/2.0/alerts",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateAlertV2Request",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "alert",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AlertV2",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "alert",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AlertV2",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "alert",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "AlertV2",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "display_name",
+                    "description": "The display name of the alert.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "query_text",
+                    "description": "Text of the query to be run.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "warehouse_id",
+                    "description": "ID of the SQL warehouse attached to the alert.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "evaluation",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "AlertV2Evaluation",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "schedule",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "CronSchedule",
+                      "is_object": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "display_name",
+                    "description": "The display name of the alert.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "query_text",
+                    "description": "Text of the query to be run.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "warehouse_id",
+                    "description": "ID of the SQL warehouse attached to the alert.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "evaluation",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "AlertV2Evaluation",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "schedule",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "CronSchedule",
+                      "is_object": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "AlertV2",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "display_name",
+                  "description": "The display name of the alert.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "query_text",
+                  "description": "Text of the query to be run.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "warehouse_id",
+                  "description": "ID of the SQL warehouse attached to the alert.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "evaluation",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AlertV2Evaluation",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "schedule",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CronSchedule",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "display_name",
+                  "description": "The display name of the alert.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "query_text",
+                  "description": "Text of the query to be run.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "warehouse_id",
+                  "description": "ID of the SQL warehouse attached to the alert.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "evaluation",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AlertV2Evaluation",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "schedule",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CronSchedule",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "alert",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AlertV2",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "display_name",
+                      "description": "The display name of the alert.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "query_text",
+                      "description": "Text of the query to be run.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "warehouse_id",
+                      "description": "ID of the SQL warehouse attached to the alert.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "evaluation",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "AlertV2Evaluation",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "schedule",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "CronSchedule",
+                        "is_object": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "display_name",
+                      "description": "The display name of the alert.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "query_text",
+                      "description": "Text of the query to be run.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "warehouse_id",
+                      "description": "ID of the SQL warehouse attached to the alert.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "evaluation",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "AlertV2Evaluation",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "schedule",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "CronSchedule",
+                        "is_object": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "The timestamp indicating when the alert was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "custom_description",
+                "description": "Custom description for the alert. support mustache template.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "custom_summary",
+                "description": "Custom summary for the alert. support mustache template.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "custom_template_format",
+                "description": "The format used to interpret the `custom_summary` and `custom_description` templates.\n\n`HTML` treats both templates as HTML with Mustache `{{VARIABLE_NAME}}` placeholders.\n`MARKDOWN` treats them as Markdown with allowlisted `@VARIABLE_NAME` placeholders and converts\nthem to the format each notification destination expects, so a single template renders\ncorrectly in email, Slack, and Microsoft Teams.\n\nWhen unset, the API applies no default. Responses omit the field unless a format is stored,\nand a template with no format is rendered as HTML.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CustomTemplateFormat",
+                  "enum": [
+                    {
+                      "content": "HTML"
+                    },
+                    {
+                      "content": "MARKDOWN"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "The display name of the alert.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_run_as",
+                "description": "The actual identity that will be used to execute the alert.\nThis is an output-only field that shows the resolved run-as identity after applying\npermissions and defaults.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AlertV2RunAs",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "evaluation",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AlertV2Evaluation",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "id",
+                "description": "The canonical identifier of the alert to retrieve information about.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "lifecycle_state",
+                "description": "Indicates whether the query is trashed.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AlertLifecycleState",
+                  "enum": [
+                    {
+                      "content": "ACTIVE"
+                    },
+                    {
+                      "content": "DELETED"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "owner_user_name",
+                "description": "The owner's username. This field is set to \"Unavailable\" if the user has been deleted.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parameters",
+                "description": "A list of parameters to pass into the alert SQL query statement containing parameter markers. Static values only.\n\nReference a parameter in the query text as `:name`. Each parameter must have a unique, non-empty name.\nEach parameter consists of a name, a value, and optionally a type. To represent a NULL\nvalue, the `value` field may be omitted or set to `null` explicitly. If the `type` field\nis omitted, the value is interpreted as a string.\n\nIf the type is given, parameters will be checked for type correctness according\nto the given type. A value is correct if the provided string can be converted to\nthe requested type using the `cast` function. The exact semantics are described in\nthe section [`cast` function](https://docs.databricks.com/sql/language-manual/functions/cast.html) of the SQL language reference.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AlertStatementParameterList",
+                  "array_value": {
+                    "pascal_name": "AlertStatementParameter",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "parent_path",
+                "description": "The workspace path of the folder containing the alert. Can only be set on create, and cannot be updated.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "query_text",
+                "description": "Text of the query to be run.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "run_as",
+                "description": "Specifies the identity that will be used to run the alert.\nThis field allows you to configure alerts to run as a specific user or service principal.\n- For user identity: Set `user_name` to the email of an active workspace user. Users can only set this to their own email.\n- For service principal: Set `service_principal_name` to the application ID. Requires the `servicePrincipal/user` role.\nIf not specified, the alert will run as the request user.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AlertV2RunAs",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "run_as_user_name",
+                "description": "The run as username or application ID of service principal.\nOn Create and Update, this field can be set to application ID of an active service principal. Setting this field requires the servicePrincipal/user role.\nDeprecated: Use `run_as` field instead. This field will be removed in a future release.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schedule",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CronSchedule",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "The timestamp indicating when the alert was updated.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "warehouse_id",
+                "description": "ID of the SQL warehouse attached to the alert.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "display_name",
+                "description": "The display name of the alert.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "query_text",
+                "description": "Text of the query to be run.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "warehouse_id",
+                "description": "ID of the SQL warehouse attached to the alert.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "evaluation",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AlertV2Evaluation",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "schedule",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CronSchedule",
+                  "is_object": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetAlert",
+            "description": "Gets an alert.",
+            "summary": "Get an alert.",
+            "path": "/api/2.0/alerts/{id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetAlertV2Request",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "AlertV2",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "display_name",
+                  "description": "The display name of the alert.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "query_text",
+                  "description": "Text of the query to be run.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "warehouse_id",
+                  "description": "ID of the SQL warehouse attached to the alert.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "evaluation",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AlertV2Evaluation",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "schedule",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CronSchedule",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "display_name",
+                  "description": "The display name of the alert.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "query_text",
+                  "description": "Text of the query to be run.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "warehouse_id",
+                  "description": "ID of the SQL warehouse attached to the alert.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "evaluation",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AlertV2Evaluation",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "schedule",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CronSchedule",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListAlerts",
+            "description": "Gets a list of alerts accessible to the user, ordered by creation time.",
+            "summary": "List alerts.",
+            "path": "/api/2.0/alerts",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListAlertsV2Request",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListAlertsV2Response",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "TrashAlert",
+            "description": "Moves an alert to the trash. Trashed alerts immediately disappear from list views, and can no longer trigger. You can restore a trashed alert through the UI. A trashed alert is permanently deleted after 30 days.",
+            "summary": "Delete an alert (legacy TrashAlert).",
+            "path": "/api/2.0/alerts/{id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "TrashAlertV2Request",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Empty",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "purge",
+                "description": "Whether to permanently delete the alert. If not set, the alert will only be soft deleted.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateAlert",
+            "description": "Update alert",
+            "summary": "Update an alert.",
+            "path": "/api/2.0/alerts/{id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateAlertV2Request",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "The canonical identifier of the alert to retrieve information about.",
+                  "required": true,
+                  "is_path": true,
+                  "is_output_only": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "alert",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AlertV2",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "The canonical identifier of the alert to retrieve information about.",
+                  "required": true,
+                  "is_path": true,
+                  "is_output_only": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "alert",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AlertV2",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "alert",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "AlertV2",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "display_name",
+                    "description": "The display name of the alert.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "query_text",
+                    "description": "Text of the query to be run.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "warehouse_id",
+                    "description": "ID of the SQL warehouse attached to the alert.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "evaluation",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "AlertV2Evaluation",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "schedule",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "CronSchedule",
+                      "is_object": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "display_name",
+                    "description": "The display name of the alert.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "query_text",
+                    "description": "Text of the query to be run.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "warehouse_id",
+                    "description": "ID of the SQL warehouse attached to the alert.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "evaluation",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "AlertV2Evaluation",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "schedule",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "CronSchedule",
+                      "is_object": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "AlertV2",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "display_name",
+                  "description": "The display name of the alert.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "query_text",
+                  "description": "Text of the query to be run.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "warehouse_id",
+                  "description": "ID of the SQL warehouse attached to the alert.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "evaluation",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AlertV2Evaluation",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "schedule",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CronSchedule",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "display_name",
+                  "description": "The display name of the alert.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "query_text",
+                  "description": "Text of the query to be run.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "warehouse_id",
+                  "description": "ID of the SQL warehouse attached to the alert.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "evaluation",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AlertV2Evaluation",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "schedule",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CronSchedule",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "alert",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AlertV2",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "display_name",
+                      "description": "The display name of the alert.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "query_text",
+                      "description": "Text of the query to be run.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "warehouse_id",
+                      "description": "ID of the SQL warehouse attached to the alert.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "evaluation",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "AlertV2Evaluation",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "schedule",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "CronSchedule",
+                        "is_object": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "display_name",
+                      "description": "The display name of the alert.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "query_text",
+                      "description": "Text of the query to be run.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "warehouse_id",
+                      "description": "ID of the SQL warehouse attached to the alert.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "evaluation",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "AlertV2Evaluation",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "schedule",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "CronSchedule",
+                        "is_object": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "id",
+                "description": "The canonical identifier of the alert to retrieve information about.",
+                "required": true,
+                "is_path": true,
+                "is_output_only": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "The timestamp indicating when the alert was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "custom_description",
+                "description": "Custom description for the alert. support mustache template.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "custom_summary",
+                "description": "Custom summary for the alert. support mustache template.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "custom_template_format",
+                "description": "The format used to interpret the `custom_summary` and `custom_description` templates.\n\n`HTML` treats both templates as HTML with Mustache `{{VARIABLE_NAME}}` placeholders.\n`MARKDOWN` treats them as Markdown with allowlisted `@VARIABLE_NAME` placeholders and converts\nthem to the format each notification destination expects, so a single template renders\ncorrectly in email, Slack, and Microsoft Teams.\n\nWhen unset, the API applies no default. Responses omit the field unless a format is stored,\nand a template with no format is rendered as HTML.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CustomTemplateFormat",
+                  "enum": [
+                    {
+                      "content": "HTML"
+                    },
+                    {
+                      "content": "MARKDOWN"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "The display name of the alert.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_run_as",
+                "description": "The actual identity that will be used to execute the alert.\nThis is an output-only field that shows the resolved run-as identity after applying\npermissions and defaults.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AlertV2RunAs",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "evaluation",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AlertV2Evaluation",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "id",
+                "description": "The canonical identifier of the alert to retrieve information about.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "lifecycle_state",
+                "description": "Indicates whether the query is trashed.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AlertLifecycleState",
+                  "enum": [
+                    {
+                      "content": "ACTIVE"
+                    },
+                    {
+                      "content": "DELETED"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "owner_user_name",
+                "description": "The owner's username. This field is set to \"Unavailable\" if the user has been deleted.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parameters",
+                "description": "A list of parameters to pass into the alert SQL query statement containing parameter markers. Static values only.\n\nReference a parameter in the query text as `:name`. Each parameter must have a unique, non-empty name.\nEach parameter consists of a name, a value, and optionally a type. To represent a NULL\nvalue, the `value` field may be omitted or set to `null` explicitly. If the `type` field\nis omitted, the value is interpreted as a string.\n\nIf the type is given, parameters will be checked for type correctness according\nto the given type. A value is correct if the provided string can be converted to\nthe requested type using the `cast` function. The exact semantics are described in\nthe section [`cast` function](https://docs.databricks.com/sql/language-manual/functions/cast.html) of the SQL language reference.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AlertStatementParameterList",
+                  "array_value": {
+                    "pascal_name": "AlertStatementParameter",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "parent_path",
+                "description": "The workspace path of the folder containing the alert. Can only be set on create, and cannot be updated.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "query_text",
+                "description": "Text of the query to be run.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "run_as",
+                "description": "Specifies the identity that will be used to run the alert.\nThis field allows you to configure alerts to run as a specific user or service principal.\n- For user identity: Set `user_name` to the email of an active workspace user. Users can only set this to their own email.\n- For service principal: Set `service_principal_name` to the application ID. Requires the `servicePrincipal/user` role.\nIf not specified, the alert will run as the request user.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AlertV2RunAs",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "run_as_user_name",
+                "description": "The run as username or application ID of service principal.\nOn Create and Update, this field can be set to application ID of an active service principal. Setting this field requires the servicePrincipal/user role.\nDeprecated: Use `run_as` field instead. This field will be removed in a future release.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schedule",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CronSchedule",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "The timestamp indicating when the alert was updated.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "warehouse_id",
+                "description": "ID of the SQL warehouse attached to the alert.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "The canonical identifier of the alert to retrieve information about.",
+                "required": true,
+                "is_path": true,
+                "is_output_only": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "The display name of the alert.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "query_text",
+                "description": "Text of the query to be run.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "warehouse_id",
+                "description": "ID of the SQL warehouse attached to the alert.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "evaluation",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AlertV2Evaluation",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "schedule",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CronSchedule",
+                  "is_object": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "apps.Apps",
+        "name": "Apps",
+        "description": "Apps run directly on a customer's Databricks instance, integrate with their data, use and extend Databricks services, and enable users to interact through single sign-on.",
+        "package": {
+          "name": "apps"
+        },
+        "docs_group": "apps",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListAppsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a new app.",
+            "summary": "Create an app.",
+            "path": "/api/2.0/apps",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateAppRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "app",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "App",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "app",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "App",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "app",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "App",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "name",
+                    "description": "The name of the app. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "name",
+                    "description": "The name of the app. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "App",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the app. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the app. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "app",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "App",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "name",
+                      "description": "The name of the app. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "name",
+                      "description": "The name of the app. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "no_compute",
+                "description": "If true, the app will not be started after creation.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "active_deployment",
+                "description": "The active deployment of the app. A deployment is considered active when it has been deployed\nto the app compute.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AppDeployment",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "app_status",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "ApplicationStatus",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "budget_policy_id",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "compute_max_instances",
+                "description": "Maximum number of app instances the app is configured to run. Must be set together with `compute_min_instances`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "compute_min_instances",
+                "description": "Minimum number of app instances the app is configured to run. Must be set together with `compute_max_instances`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "compute_size",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ComputeSize",
+                  "enum": [
+                    {
+                      "content": "LARGE"
+                    },
+                    {
+                      "content": "MEDIUM"
+                    },
+                    {
+                      "content": "XLARGE"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "compute_status",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "ComputeStatus",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "The creation time of the app. Formatted timestamp in ISO 6801.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "creator",
+                "description": "The email of the user that created the app.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "default_git_source",
+                "description": "The Git source of the app's most recent active deployment, including the repository\nconfiguration and the resolved reference. Populated by the system after a Git-based\ndeployment and used as the default reference when automatic deployments are enabled.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "GitSource",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "default_source_code_path",
+                "description": "The default workspace file system path of the source code from which app deployment are\ncreated. This field tracks the workspace source code path of the last active deployment.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "The description of the app.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_budget_policy_id",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_usage_policy_id",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_user_api_scopes",
+                "description": "The effective api scopes granted to the user access token.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "forward_user_access_token",
+                "description": "Forward the user's access token to the app. Requires stopping and starting app compute to take effect.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "git_repository",
+                "description": "Git repository configuration for app deployments. When specified, deployments can\nreference code from this repository by providing only the git reference (branch, tag, or commit).",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "GitRepository",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "git_source",
+                "description": "The Git source to deploy from, specifying the reference to check out (branch, tag, or\ncommit) and an optional path to the app source code within the repository configured in\ngit_repository.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "GitSource",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "id",
+                "description": "The unique identifier of the app.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the app. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "oauth2_app_client_id",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "oauth2_app_integration_id",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "pending_deployment",
+                "description": "The pending deployment of the app. A deployment is considered pending when it is being prepared\nfor deployment to the app compute.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AppDeployment",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "resources",
+                "description": "Resources for the app.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AppResourceList",
+                  "array_value": {
+                    "pascal_name": "AppResource",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "service_principal_client_id",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "service_principal_id",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "service_principal_name",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "source_code_path",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "space",
+                "description": "Name of the space this app belongs to.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "telemetry_export_destinations",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "TelemetryExportDestinationList",
+                  "array_value": {
+                    "pascal_name": "TelemetryExportDestination",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "thumbnail_url",
+                "description": "The URL of the thumbnail image for the app.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "The update time of the app. Formatted timestamp in ISO 6801.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "updater",
+                "description": "The email of the user that last updated the app.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "url",
+                "description": "The URL of the app once it is deployed.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "usage_policy_id",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "user_api_scopes",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the app. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "wait": {
+              "success": [
+                {
+                  "content": "ACTIVE"
+                }
+              ],
+              "timeout": 20,
+              "complex_message_path": true,
+              "poll": {
+                "response": {
+                  "pascal_name": "App"
+                }
+              },
+              "status_path": [
+                {
+                  "pascal_name": "ComputeStatus"
+                },
+                {
+                  "pascal_name": "State"
+                }
+              ],
+              "message_path": [
+                {
+                  "pascal_name": "ComputeStatus"
+                },
+                {
+                  "pascal_name": "Message"
+                }
+              ],
+              "message_path_head": {
+                "pascal_name": "ComputeStatus"
+              }
+            }
+          },
+          {
+            "name": "CreateSpace",
+            "description": "Creates a new app space.",
+            "summary": "Create an app space.",
+            "path": "/api/2.0/app-spaces",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "CreateSpaceRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "space",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Space",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "space",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Space",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "space",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Space",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "name",
+                    "description": "The name of the app space. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "name",
+                    "description": "The name of the app space. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "space",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Space",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "name",
+                      "description": "The name of the app space. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "name",
+                      "description": "The name of the app space. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "assume_group_id",
+                "description": "The group whose permissions users assume via Role Authorization for apps in this space. When\nset, user tokens assume the role of this group instead of doing regular obo token downscoping.\nSet only at space creation.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "The creation time of the app space. Formatted timestamp in ISO 6801.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "creator",
+                "description": "The email of the user that created the app space.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "The description of the app space.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_usage_policy_id",
+                "description": "The effective usage policy ID used by apps in the space.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_user_api_scopes",
+                "description": "The effective api scopes granted to the user access token.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "id",
+                "description": "The unique identifier of the app space.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the app space. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "resources",
+                "description": "Resources for the app space. Resources configured at the space level are available to all apps in the space.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AppResourceList",
+                  "array_value": {
+                    "pascal_name": "AppResource",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "service_principal_client_id",
+                "description": "The service principal client ID for the app space.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "service_principal_id",
+                "description": "The service principal ID for the app space.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "service_principal_name",
+                "description": "The service principal name for the app space.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "status",
+                "description": "The status of the app space.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "SpaceStatus",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "The update time of the app space. Formatted timestamp in ISO 6801.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "updater",
+                "description": "The email of the user that last updated the app space.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "usage_policy_id",
+                "description": "The usage policy ID for managing cost at the space level.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "user_api_scopes",
+                "description": "OAuth scopes for apps in the space.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the app space. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "long_running_operation": {
+              "get_operation": {
+                "kebab_name": "get-space-operation",
+                "pascal_name": "GetSpaceOperation",
+                "request": {
+                  "pascal_name": "GetOperationRequest"
+                }
+              },
+              "response_type": {}
+            }
+          },
+          {
+            "name": "CreateUpdate",
+            "description": "Creates an app update and starts the update process. The update process is asynchronous and the status of the update can be checked with the GetAppUpdate method.",
+            "summary": "Create an app update.",
+            "path": "/api/2.0/apps/{app_name}/update",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "AsyncUpdateAppRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "app_name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "app_name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "update_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "AppUpdate",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "app",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "App",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "app_name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "app_name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "wait": {
+              "success": [
+                {
+                  "content": "SUCCEEDED"
+                }
+              ],
+              "timeout": 20,
+              "complex_message_path": true,
+              "poll": {
+                "response": {
+                  "pascal_name": "AppUpdate"
+                }
+              },
+              "status_path": [
+                {
+                  "pascal_name": "Status"
+                },
+                {
+                  "pascal_name": "State"
+                }
+              ],
+              "message_path": [
+                {
+                  "pascal_name": "Status"
+                },
+                {
+                  "pascal_name": "Message"
+                }
+              ],
+              "message_path_head": {
+                "pascal_name": "Status"
+              }
+            }
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes an app.",
+            "summary": "Delete an app.",
+            "path": "/api/2.0/apps/{name}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteAppRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the app.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the app.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "App",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the app. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the app. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The name of the app.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the app.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteAppThumbnail",
+            "description": "Deletes the thumbnail for an app.",
+            "summary": "Delete an app thumbnail.",
+            "path": "/api/2.0/apps/{name}/thumbnail",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteAppThumbnailRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the app.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the app.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The name of the app.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the app.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteSpace",
+            "description": "Deletes an app space.",
+            "summary": "Delete an app space.",
+            "path": "/api/2.0/app-spaces/{name}",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "DeleteSpaceRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the app space.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the app space.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The name of the app space.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the app space.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "long_running_operation": {
+              "get_operation": {
+                "kebab_name": "get-space-operation",
+                "pascal_name": "GetSpaceOperation",
+                "request": {
+                  "pascal_name": "GetOperationRequest"
+                }
+              },
+              "response_type": {
+                "is_empty_response": true
+              }
+            }
+          },
+          {
+            "name": "Deploy",
+            "description": "Creates an app deployment for the app with the supplied name.",
+            "summary": "Create an app deployment.",
+            "path": "/api/2.0/apps/{app_name}/deployments",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateAppDeploymentRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "app_name",
+                  "description": "The name of the app.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "app_deployment",
+                  "description": "The app deployment configuration.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AppDeployment",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "app_name",
+                  "description": "The name of the app.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "app_deployment",
+                  "description": "The app deployment configuration.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AppDeployment",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "app_deployment",
+              "description": "The app deployment configuration.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "AppDeployment",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "AppDeployment",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "app_deployment",
+                "description": "The app deployment configuration.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AppDeployment",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "app_name",
+                "description": "The name of the app.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "command",
+                "description": "The command with which to run the app. This will override the command specified in the app.yaml file.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "The creation time of the deployment. Formatted timestamp in ISO 6801.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "creator",
+                "description": "The email of the user creates the deployment.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "deployment_artifacts",
+                "description": "The deployment artifacts for an app.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AppDeploymentArtifacts",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "deployment_id",
+                "description": "The unique id of the deployment.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "env_vars",
+                "description": "The environment variables to set in the app runtime environment. This will override the environment variables specified in the app.yaml file.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EnvVarList",
+                  "array_value": {
+                    "pascal_name": "EnvVar",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "git_source",
+                "description": "Git repository to use as the source for the app deployment.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "GitSource",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "health_check",
+                "description": "Deploy-time health check for the app. Verifies the app is responding to HTTP requests before considering the deployment successful.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AppHealthCheck",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "mode",
+                "description": "The mode of which the deployment will manage the source code.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AppDeploymentMode",
+                  "enum": [
+                    {
+                      "content": "AUTO_SYNC"
+                    },
+                    {
+                      "content": "SNAPSHOT"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "source_code_path",
+                "description": "The workspace file system path of the source code used to create the app deployment. This is different from\n`deployment_artifacts.source_code_path`, which is the path used by the deployed app. The former refers\nto the original source code location of the app in the workspace during deployment creation, whereas\nthe latter provides a system generated stable snapshotted source code path used by the deployment.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "status",
+                "description": "Status and status message of the deployment",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AppDeploymentStatus",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "The update time of the deployment. Formatted timestamp in ISO 6801.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "app_name",
+                "description": "The name of the app.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "wait": {
+              "success": [
+                {
+                  "content": "SUCCEEDED"
+                }
+              ],
+              "timeout": 20,
+              "complex_message_path": true,
+              "poll": {
+                "response": {
+                  "pascal_name": "AppDeployment"
+                }
+              },
+              "status_path": [
+                {
+                  "pascal_name": "Status"
+                },
+                {
+                  "pascal_name": "State"
+                }
+              ],
+              "message_path": [
+                {
+                  "pascal_name": "Status"
+                },
+                {
+                  "pascal_name": "Message"
+                }
+              ],
+              "message_path_head": {
+                "pascal_name": "Status"
+              }
+            }
+          },
+          {
+            "name": "Get",
+            "description": "Retrieves information for the app with the supplied name.",
+            "summary": "Get an app.",
+            "path": "/api/2.0/apps/{name}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetAppRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the app.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the app.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "App",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the app. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the app. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The name of the app.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the app.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetDeployment",
+            "description": "Retrieves information for the app deployment with the supplied name and deployment id.",
+            "summary": "Get an app deployment.",
+            "path": "/api/2.0/apps/{app_name}/deployments/{deployment_id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetAppDeploymentRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "app_name",
+                  "description": "The name of the app.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "deployment_id",
+                  "description": "The unique id of the deployment.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "app_name",
+                  "description": "The name of the app.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "deployment_id",
+                  "description": "The unique id of the deployment.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "AppDeployment",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "app_name",
+                "description": "The name of the app.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "deployment_id",
+                "description": "The unique id of the deployment.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "app_name",
+                "description": "The name of the app.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "deployment_id",
+                "description": "The unique id of the deployment.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetPermissionLevels",
+            "description": "Gets the permission levels that a user can have on an object.",
+            "summary": "Get app permission levels.",
+            "path": "/api/2.0/permissions/apps/{app_name}/permissionLevels",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetAppPermissionLevelsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "app_name",
+                  "description": "The app for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "app_name",
+                  "description": "The app for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetAppPermissionLevelsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "app_name",
+                "description": "The app for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "app_name",
+                "description": "The app for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetPermissions",
+            "description": "Gets the permissions of an app. Apps can inherit permissions from their root object.",
+            "summary": "Get app permissions.",
+            "path": "/api/2.0/permissions/apps/{app_name}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetAppPermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "app_name",
+                  "description": "The app for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "app_name",
+                  "description": "The app for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "AppPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "app_name",
+                "description": "The app for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "app_name",
+                "description": "The app for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetSpace",
+            "description": "Retrieves information for the app space with the supplied name.",
+            "summary": "Get an app space.",
+            "path": "/api/2.0/app-spaces/{name}",
+            "is_crud_read": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "GetSpaceRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the app space.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the app space.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Space",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the app space. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the app space. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The name of the app space.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the app space.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetSpaceOperation",
+            "description": "Gets the status of an app space update operation.",
+            "summary": "Get the status of an app space operation.",
+            "path": "/api/2.0/app-spaces/{name}/operation",
+            "is_crud_read": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "GetOperationRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the operation resource.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the operation resource.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The name of the operation resource.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the operation resource.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetUpdate",
+            "description": "Gets the status of an app update.",
+            "summary": "Get an app update.",
+            "path": "/api/2.0/apps/{app_name}/update",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetAppUpdateRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "app_name",
+                  "description": "The name of the app.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "app_name",
+                  "description": "The name of the app.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "AppUpdate",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "app_name",
+                "description": "The name of the app.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "app_name",
+                "description": "The name of the app.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Lists all apps in the workspace.",
+            "summary": "List apps.",
+            "path": "/api/2.0/apps",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListAppsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListAppsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "Upper bound for items returned.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Pagination token to go to the next page of apps. Requests first page if absent.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "space",
+                "description": "Filter apps by app space name. When specified, only apps belonging to this space are returned.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Pagination token to go to the next page of apps. Requests first page if absent.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListDeployments",
+            "description": "Lists all app deployments for the app with the supplied name.",
+            "summary": "List app deployments.",
+            "path": "/api/2.0/apps/{app_name}/deployments",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListAppDeploymentsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "app_name",
+                  "description": "The name of the app.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "app_name",
+                  "description": "The name of the app.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListAppDeploymentsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "app_name",
+                "description": "The name of the app.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "Upper bound for items returned.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Pagination token to go to the next page of apps. Requests first page if absent.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "app_name",
+                "description": "The name of the app.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Pagination token to go to the next page of apps. Requests first page if absent.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListSpaces",
+            "description": "Lists all app spaces in the workspace.",
+            "summary": "List app spaces.",
+            "path": "/api/2.0/app-spaces",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "ListSpacesRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListSpacesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "Upper bound for items returned.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Pagination token to go to the next page of app spaces. Requests first page if absent.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Pagination token to go to the next page of app spaces. Requests first page if absent.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "SetPermissions",
+            "description": "Sets permissions on an object, replacing existing permissions if they exist. Deletes all direct permissions if none are specified. Objects can inherit permissions from their root object.",
+            "summary": "Set app permissions.",
+            "path": "/api/2.0/permissions/apps/{app_name}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "AppPermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "app_name",
+                  "description": "The app for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "app_name",
+                  "description": "The app for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "AppPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "access_control_list",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AppAccessControlRequestList",
+                  "array_value": {
+                    "pascal_name": "AppAccessControlRequest",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "app_name",
+                "description": "The app for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "app_name",
+                "description": "The app for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Start",
+            "description": "Start the last active deployment of the app in the workspace.",
+            "summary": "Start an app.",
+            "path": "/api/2.0/apps/{name}/start",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "StartAppRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the app.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the app.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "App",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the app. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the app. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The name of the app.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the app.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "wait": {
+              "success": [
+                {
+                  "content": "ACTIVE"
+                }
+              ],
+              "timeout": 20,
+              "complex_message_path": true,
+              "poll": {
+                "response": {
+                  "pascal_name": "App"
+                }
+              },
+              "status_path": [
+                {
+                  "pascal_name": "ComputeStatus"
+                },
+                {
+                  "pascal_name": "State"
+                }
+              ],
+              "message_path": [
+                {
+                  "pascal_name": "ComputeStatus"
+                },
+                {
+                  "pascal_name": "Message"
+                }
+              ],
+              "message_path_head": {
+                "pascal_name": "ComputeStatus"
+              }
+            }
+          },
+          {
+            "name": "Stop",
+            "description": "Stops the active deployment of the app in the workspace.",
+            "summary": "Stop an app.",
+            "path": "/api/2.0/apps/{name}/stop",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "StopAppRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the app.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the app.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "App",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the app. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the app. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The name of the app.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the app.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "wait": {
+              "success": [
+                {
+                  "content": "STOPPED"
+                }
+              ],
+              "timeout": 20,
+              "complex_message_path": true,
+              "poll": {
+                "response": {
+                  "pascal_name": "App"
+                }
+              },
+              "status_path": [
+                {
+                  "pascal_name": "ComputeStatus"
+                },
+                {
+                  "pascal_name": "State"
+                }
+              ],
+              "message_path": [
+                {
+                  "pascal_name": "ComputeStatus"
+                },
+                {
+                  "pascal_name": "Message"
+                }
+              ],
+              "message_path_head": {
+                "pascal_name": "ComputeStatus"
+              }
+            }
+          },
+          {
+            "name": "Update",
+            "description": "Updates the app with the supplied name. This is a full replacement: fields omitted from the request are cleared, so send the complete app.",
+            "summary": "Update an app.",
+            "path": "/api/2.0/apps/{name}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateAppRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the app. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "app",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "App",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the app. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "app",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "App",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "app",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "App",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "name",
+                    "description": "The name of the app. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "name",
+                    "description": "The name of the app. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "App",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the app. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the app. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "app",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "App",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "name",
+                      "description": "The name of the app. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "name",
+                      "description": "The name of the app. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the app. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "active_deployment",
+                "description": "The active deployment of the app. A deployment is considered active when it has been deployed\nto the app compute.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AppDeployment",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "app_status",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "ApplicationStatus",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "budget_policy_id",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "compute_max_instances",
+                "description": "Maximum number of app instances the app is configured to run. Must be set together with `compute_min_instances`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "compute_min_instances",
+                "description": "Minimum number of app instances the app is configured to run. Must be set together with `compute_max_instances`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "compute_size",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ComputeSize",
+                  "enum": [
+                    {
+                      "content": "LARGE"
+                    },
+                    {
+                      "content": "MEDIUM"
+                    },
+                    {
+                      "content": "XLARGE"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "compute_status",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "ComputeStatus",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "The creation time of the app. Formatted timestamp in ISO 6801.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "creator",
+                "description": "The email of the user that created the app.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "default_git_source",
+                "description": "The Git source of the app's most recent active deployment, including the repository\nconfiguration and the resolved reference. Populated by the system after a Git-based\ndeployment and used as the default reference when automatic deployments are enabled.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "GitSource",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "default_source_code_path",
+                "description": "The default workspace file system path of the source code from which app deployment are\ncreated. This field tracks the workspace source code path of the last active deployment.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "The description of the app.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_budget_policy_id",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_usage_policy_id",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_user_api_scopes",
+                "description": "The effective api scopes granted to the user access token.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "forward_user_access_token",
+                "description": "Forward the user's access token to the app. Requires stopping and starting app compute to take effect.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "git_repository",
+                "description": "Git repository configuration for app deployments. When specified, deployments can\nreference code from this repository by providing only the git reference (branch, tag, or commit).",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "GitRepository",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "git_source",
+                "description": "The Git source to deploy from, specifying the reference to check out (branch, tag, or\ncommit) and an optional path to the app source code within the repository configured in\ngit_repository.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "GitSource",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "id",
+                "description": "The unique identifier of the app.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the app. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "oauth2_app_client_id",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "oauth2_app_integration_id",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "pending_deployment",
+                "description": "The pending deployment of the app. A deployment is considered pending when it is being prepared\nfor deployment to the app compute.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AppDeployment",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "resources",
+                "description": "Resources for the app.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AppResourceList",
+                  "array_value": {
+                    "pascal_name": "AppResource",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "service_principal_client_id",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "service_principal_id",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "service_principal_name",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "source_code_path",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "space",
+                "description": "Name of the space this app belongs to.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "telemetry_export_destinations",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "TelemetryExportDestinationList",
+                  "array_value": {
+                    "pascal_name": "TelemetryExportDestination",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "thumbnail_url",
+                "description": "The URL of the thumbnail image for the app.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "The update time of the app. Formatted timestamp in ISO 6801.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "updater",
+                "description": "The email of the user that last updated the app.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "url",
+                "description": "The URL of the app once it is deployed.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "usage_policy_id",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "user_api_scopes",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the app. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateAppThumbnail",
+            "description": "Updates the thumbnail for an app.",
+            "summary": "Update an app thumbnail.",
+            "path": "/api/2.0/apps/{name}/thumbnail",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateAppThumbnailRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the app.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the app.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "AppThumbnail",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "app_thumbnail",
+                "description": "The app thumbnail to set.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AppThumbnail",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the app.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the app.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdatePermissions",
+            "description": "Updates the permissions on an app. Apps can inherit permissions from their root object.",
+            "summary": "Update app permissions.",
+            "path": "/api/2.0/permissions/apps/{app_name}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "AppPermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "app_name",
+                  "description": "The app for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "app_name",
+                  "description": "The app for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "AppPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "access_control_list",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AppAccessControlRequestList",
+                  "array_value": {
+                    "pascal_name": "AppAccessControlRequest",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "app_name",
+                "description": "The app for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "app_name",
+                "description": "The app for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateSpace",
+            "description": "Updates an app space. The update process is asynchronous and the status of the update can be checked with the GetSpaceOperation method.",
+            "summary": "Update an app space.",
+            "path": "/api/2.0/app-spaces/{name}",
+            "can_use_json": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "UpdateSpaceRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the app space. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "space",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Space",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the app space. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "space",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Space",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "space",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Space",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "name",
+                    "description": "The name of the app space. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "name",
+                    "description": "The name of the app space. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The name of the app space. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "space",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Space",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "name",
+                      "description": "The name of the app space. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "name",
+                      "description": "The name of the app space. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "assume_group_id",
+                "description": "The group whose permissions users assume via Role Authorization for apps in this space. When\nset, user tokens assume the role of this group instead of doing regular obo token downscoping.\nSet only at space creation.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "The creation time of the app space. Formatted timestamp in ISO 6801.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "creator",
+                "description": "The email of the user that created the app space.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "The description of the app space.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_usage_policy_id",
+                "description": "The effective usage policy ID used by apps in the space.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_user_api_scopes",
+                "description": "The effective api scopes granted to the user access token.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "id",
+                "description": "The unique identifier of the app space.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the app space. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "resources",
+                "description": "Resources for the app space. Resources configured at the space level are available to all apps in the space.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AppResourceList",
+                  "array_value": {
+                    "pascal_name": "AppResource",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "service_principal_client_id",
+                "description": "The service principal client ID for the app space.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "service_principal_id",
+                "description": "The service principal ID for the app space.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "service_principal_name",
+                "description": "The service principal name for the app space.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "status",
+                "description": "The status of the app space.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "SpaceStatus",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "The update time of the app space. Formatted timestamp in ISO 6801.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "updater",
+                "description": "The email of the user that last updated the app space.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "usage_policy_id",
+                "description": "The usage policy ID for managing cost at the space level.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "user_api_scopes",
+                "description": "OAuth scopes for apps in the space.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the app space. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              }
+            ],
+            "long_running_operation": {
+              "get_operation": {
+                "kebab_name": "get-space-operation",
+                "pascal_name": "GetSpaceOperation",
+                "request": {
+                  "pascal_name": "GetOperationRequest"
+                }
+              },
+              "response_type": {}
+            }
+          }
+        ]
+      },
+      {
+        "id": "apps.AppsSettings",
+        "name": "AppsSettings",
+        "description": "Apps Settings manage the settings for the Apps service on a customer's Databricks instance.",
+        "package": {
+          "name": "apps"
+        },
+        "is_hidden_cli": true,
+        "docs_group": "apps",
+        "launch_stage": "PRIVATE_PREVIEW",
+        "cli_launch_stage_display": "Private Preview",
+        "list": {
+          "request": {
+            "pascal_name": "ListCustomTemplatesRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "CreateCustomTemplate",
+            "description": "Creates a custom template.",
+            "summary": "Create a template.",
+            "path": "/api/2.0/apps-settings/templates",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "CreateCustomTemplateRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "template",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CustomTemplate",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "template",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CustomTemplate",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "template",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "CustomTemplate",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "name",
+                    "description": "The name of the template. It must contain only alphanumeric characters, hyphens, underscores, and whitespaces.\nIt must be unique within the workspace.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "git_repo",
+                    "description": "The Git repository URL that the template resides in.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "path",
+                    "description": "The path to the template within the Git repository.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "manifest",
+                    "description": "The manifest of the template. It defines fields and default values when installing the template.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "AppManifest",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "git_provider",
+                    "description": "The Git provider of the template.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "name",
+                    "description": "The name of the template. It must contain only alphanumeric characters, hyphens, underscores, and whitespaces.\nIt must be unique within the workspace.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "git_repo",
+                    "description": "The Git repository URL that the template resides in.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "path",
+                    "description": "The path to the template within the Git repository.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "manifest",
+                    "description": "The manifest of the template. It defines fields and default values when installing the template.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "AppManifest",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "git_provider",
+                    "description": "The Git provider of the template.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "CustomTemplate",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the template. It must contain only alphanumeric characters, hyphens, underscores, and whitespaces.\nIt must be unique within the workspace.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "git_repo",
+                  "description": "The Git repository URL that the template resides in.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "path",
+                  "description": "The path to the template within the Git repository.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "manifest",
+                  "description": "The manifest of the template. It defines fields and default values when installing the template.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AppManifest",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "git_provider",
+                  "description": "The Git provider of the template.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the template. It must contain only alphanumeric characters, hyphens, underscores, and whitespaces.\nIt must be unique within the workspace.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "git_repo",
+                  "description": "The Git repository URL that the template resides in.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "path",
+                  "description": "The path to the template within the Git repository.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "manifest",
+                  "description": "The manifest of the template. It defines fields and default values when installing the template.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AppManifest",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "git_provider",
+                  "description": "The Git provider of the template.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "template",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CustomTemplate",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "name",
+                      "description": "The name of the template. It must contain only alphanumeric characters, hyphens, underscores, and whitespaces.\nIt must be unique within the workspace.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "git_repo",
+                      "description": "The Git repository URL that the template resides in.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "path",
+                      "description": "The path to the template within the Git repository.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "manifest",
+                      "description": "The manifest of the template. It defines fields and default values when installing the template.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "AppManifest",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "git_provider",
+                      "description": "The Git provider of the template.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "name",
+                      "description": "The name of the template. It must contain only alphanumeric characters, hyphens, underscores, and whitespaces.\nIt must be unique within the workspace.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "git_repo",
+                      "description": "The Git repository URL that the template resides in.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "path",
+                      "description": "The path to the template within the Git repository.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "manifest",
+                      "description": "The manifest of the template. It defines fields and default values when installing the template.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "AppManifest",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "git_provider",
+                      "description": "The Git provider of the template.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "creator",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "The description of the template.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "git_provider",
+                "description": "The Git provider of the template.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "git_repo",
+                "description": "The Git repository URL that the template resides in.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "manifest",
+                "description": "The manifest of the template. It defines fields and default values when installing the template.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AppManifest",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the template. It must contain only alphanumeric characters, hyphens, underscores, and whitespaces.\nIt must be unique within the workspace.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "path",
+                "description": "The path to the template within the Git repository.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the template. It must contain only alphanumeric characters, hyphens, underscores, and whitespaces.\nIt must be unique within the workspace.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "git_repo",
+                "description": "The Git repository URL that the template resides in.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "path",
+                "description": "The path to the template within the Git repository.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "manifest",
+                "description": "The manifest of the template. It defines fields and default values when installing the template.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AppManifest",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "git_provider",
+                "description": "The Git provider of the template.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteCustomTemplate",
+            "description": "Deletes the custom template with the specified name.",
+            "summary": "Delete a template.",
+            "path": "/api/2.0/apps-settings/templates/{name}",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "DeleteCustomTemplateRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the custom template.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the custom template.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CustomTemplate",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the template. It must contain only alphanumeric characters, hyphens, underscores, and whitespaces.\nIt must be unique within the workspace.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "git_repo",
+                  "description": "The Git repository URL that the template resides in.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "path",
+                  "description": "The path to the template within the Git repository.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "manifest",
+                  "description": "The manifest of the template. It defines fields and default values when installing the template.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AppManifest",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "git_provider",
+                  "description": "The Git provider of the template.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the template. It must contain only alphanumeric characters, hyphens, underscores, and whitespaces.\nIt must be unique within the workspace.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "git_repo",
+                  "description": "The Git repository URL that the template resides in.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "path",
+                  "description": "The path to the template within the Git repository.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "manifest",
+                  "description": "The manifest of the template. It defines fields and default values when installing the template.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AppManifest",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "git_provider",
+                  "description": "The Git provider of the template.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The name of the custom template.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the custom template.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetCustomTemplate",
+            "description": "Gets the custom template with the specified name.",
+            "summary": "Get a template.",
+            "path": "/api/2.0/apps-settings/templates/{name}",
+            "is_crud_read": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "GetCustomTemplateRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the custom template.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the custom template.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CustomTemplate",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the template. It must contain only alphanumeric characters, hyphens, underscores, and whitespaces.\nIt must be unique within the workspace.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "git_repo",
+                  "description": "The Git repository URL that the template resides in.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "path",
+                  "description": "The path to the template within the Git repository.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "manifest",
+                  "description": "The manifest of the template. It defines fields and default values when installing the template.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AppManifest",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "git_provider",
+                  "description": "The Git provider of the template.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the template. It must contain only alphanumeric characters, hyphens, underscores, and whitespaces.\nIt must be unique within the workspace.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "git_repo",
+                  "description": "The Git repository URL that the template resides in.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "path",
+                  "description": "The path to the template within the Git repository.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "manifest",
+                  "description": "The manifest of the template. It defines fields and default values when installing the template.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AppManifest",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "git_provider",
+                  "description": "The Git provider of the template.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The name of the custom template.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the custom template.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListCustomTemplates",
+            "description": "Lists all custom templates in the workspace.",
+            "summary": "List templates.",
+            "path": "/api/2.0/apps-settings/templates",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "ListCustomTemplatesRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListCustomTemplatesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "Upper bound for items returned.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Pagination token to go to the next page of custom templates. Requests first page if absent.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Pagination token to go to the next page of custom templates. Requests first page if absent.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "UpdateCustomTemplate",
+            "description": "Updates the custom template with the specified name. Note that the template name cannot be updated.",
+            "summary": "Update a template.",
+            "path": "/api/2.0/apps-settings/templates/{name}",
+            "can_use_json": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "UpdateCustomTemplateRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the template. It must contain only alphanumeric characters, hyphens, underscores, and whitespaces.\nIt must be unique within the workspace.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "template",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CustomTemplate",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the template. It must contain only alphanumeric characters, hyphens, underscores, and whitespaces.\nIt must be unique within the workspace.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "template",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CustomTemplate",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "template",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "CustomTemplate",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "name",
+                    "description": "The name of the template. It must contain only alphanumeric characters, hyphens, underscores, and whitespaces.\nIt must be unique within the workspace.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "git_repo",
+                    "description": "The Git repository URL that the template resides in.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "path",
+                    "description": "The path to the template within the Git repository.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "manifest",
+                    "description": "The manifest of the template. It defines fields and default values when installing the template.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "AppManifest",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "git_provider",
+                    "description": "The Git provider of the template.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "name",
+                    "description": "The name of the template. It must contain only alphanumeric characters, hyphens, underscores, and whitespaces.\nIt must be unique within the workspace.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "git_repo",
+                    "description": "The Git repository URL that the template resides in.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "path",
+                    "description": "The path to the template within the Git repository.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "manifest",
+                    "description": "The manifest of the template. It defines fields and default values when installing the template.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "AppManifest",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "git_provider",
+                    "description": "The Git provider of the template.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "CustomTemplate",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the template. It must contain only alphanumeric characters, hyphens, underscores, and whitespaces.\nIt must be unique within the workspace.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "git_repo",
+                  "description": "The Git repository URL that the template resides in.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "path",
+                  "description": "The path to the template within the Git repository.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "manifest",
+                  "description": "The manifest of the template. It defines fields and default values when installing the template.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AppManifest",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "git_provider",
+                  "description": "The Git provider of the template.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the template. It must contain only alphanumeric characters, hyphens, underscores, and whitespaces.\nIt must be unique within the workspace.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "git_repo",
+                  "description": "The Git repository URL that the template resides in.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "path",
+                  "description": "The path to the template within the Git repository.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "manifest",
+                  "description": "The manifest of the template. It defines fields and default values when installing the template.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AppManifest",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "git_provider",
+                  "description": "The Git provider of the template.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The name of the template. It must contain only alphanumeric characters, hyphens, underscores, and whitespaces.\nIt must be unique within the workspace.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "template",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CustomTemplate",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "name",
+                      "description": "The name of the template. It must contain only alphanumeric characters, hyphens, underscores, and whitespaces.\nIt must be unique within the workspace.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "git_repo",
+                      "description": "The Git repository URL that the template resides in.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "path",
+                      "description": "The path to the template within the Git repository.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "manifest",
+                      "description": "The manifest of the template. It defines fields and default values when installing the template.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "AppManifest",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "git_provider",
+                      "description": "The Git provider of the template.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "name",
+                      "description": "The name of the template. It must contain only alphanumeric characters, hyphens, underscores, and whitespaces.\nIt must be unique within the workspace.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "git_repo",
+                      "description": "The Git repository URL that the template resides in.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "path",
+                      "description": "The path to the template within the Git repository.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "manifest",
+                      "description": "The manifest of the template. It defines fields and default values when installing the template.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "AppManifest",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "git_provider",
+                      "description": "The Git provider of the template.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "creator",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "The description of the template.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "git_provider",
+                "description": "The Git provider of the template.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "git_repo",
+                "description": "The Git repository URL that the template resides in.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "manifest",
+                "description": "The manifest of the template. It defines fields and default values when installing the template.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AppManifest",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the template. It must contain only alphanumeric characters, hyphens, underscores, and whitespaces.\nIt must be unique within the workspace.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "path",
+                "description": "The path to the template within the Git repository.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the template. It must contain only alphanumeric characters, hyphens, underscores, and whitespaces.\nIt must be unique within the workspace.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "git_repo",
+                "description": "The Git repository URL that the template resides in.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "path",
+                "description": "The path to the template within the Git repository.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "manifest",
+                "description": "The manifest of the template. It defines fields and default values when installing the template.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AppManifest",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "git_provider",
+                "description": "The Git provider of the template.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "catalog.ArtifactAllowlists",
+        "name": "ArtifactAllowlists",
+        "description": "In Databricks Runtime 13.3 and above, you can add libraries and init scripts to the\n`allowlist` in UC so that users can use these artifacts on compute configured with\nshared access mode.",
+        "package": {
+          "name": "catalog"
+        },
+        "docs_group": "catalog",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "methods": [
+          {
+            "name": "Get",
+            "description": "Get the artifact allowlist of a certain artifact type.\nThe caller must be a metastore admin or have the **MANAGE ALLOWLIST** privilege\non the metastore.",
+            "summary": "Get an artifact allowlist.",
+            "path": "/api/2.1/unity-catalog/artifact-allowlists/{artifact_type}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetArtifactAllowlistRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "artifact_type",
+                  "description": "The artifact type of the allowlist.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "pascal_name": "ArtifactType",
+                    "enum": [
+                      {
+                        "content": "INIT_SCRIPT"
+                      },
+                      {
+                        "content": "LIBRARY_JAR"
+                      },
+                      {
+                        "content": "LIBRARY_MAVEN"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "artifact_type",
+                  "description": "The artifact type of the allowlist.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "pascal_name": "ArtifactType",
+                    "enum": [
+                      {
+                        "content": "INIT_SCRIPT"
+                      },
+                      {
+                        "content": "LIBRARY_JAR"
+                      },
+                      {
+                        "content": "LIBRARY_MAVEN"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ArtifactAllowlistInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "artifact_type",
+                "description": "The artifact type of the allowlist.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "pascal_name": "ArtifactType",
+                  "enum": [
+                    {
+                      "content": "INIT_SCRIPT"
+                    },
+                    {
+                      "content": "LIBRARY_JAR"
+                    },
+                    {
+                      "content": "LIBRARY_MAVEN"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "artifact_type",
+                "description": "The artifact type of the allowlist.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "pascal_name": "ArtifactType",
+                  "enum": [
+                    {
+                      "content": "INIT_SCRIPT"
+                    },
+                    {
+                      "content": "LIBRARY_JAR"
+                    },
+                    {
+                      "content": "LIBRARY_MAVEN"
+                    }
+                  ]
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Set the artifact allowlist of a certain artifact type.\nThe whole artifact allowlist is replaced with the new allowlist.\nThe caller must be a metastore admin or have the **MANAGE ALLOWLIST** privilege\non the metastore.",
+            "summary": "Set an artifact allowlist.",
+            "path": "/api/2.1/unity-catalog/artifact-allowlists/{artifact_type}",
+            "can_use_json": true,
+            "must_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "SetArtifactAllowlist",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "artifact_type",
+                  "description": "The artifact type of the allowlist.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "pascal_name": "ArtifactType",
+                    "enum": [
+                      {
+                        "content": "INIT_SCRIPT"
+                      },
+                      {
+                        "content": "LIBRARY_JAR"
+                      },
+                      {
+                        "content": "LIBRARY_MAVEN"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "artifact_matchers",
+                  "description": "A list of allowed artifact match patterns.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ArtifactMatcherList",
+                    "array_value": {
+                      "pascal_name": "ArtifactMatcher",
+                      "is_object": true
+                    }
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "artifact_type",
+                  "description": "The artifact type of the allowlist.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "pascal_name": "ArtifactType",
+                    "enum": [
+                      {
+                        "content": "INIT_SCRIPT"
+                      },
+                      {
+                        "content": "LIBRARY_JAR"
+                      },
+                      {
+                        "content": "LIBRARY_MAVEN"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "artifact_matchers",
+                  "description": "A list of allowed artifact match patterns.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ArtifactMatcherList",
+                    "array_value": {
+                      "pascal_name": "ArtifactMatcher",
+                      "is_object": true
+                    }
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ArtifactAllowlistInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "artifact_matchers",
+                "description": "A list of allowed artifact match patterns.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ArtifactMatcherList",
+                  "array_value": {
+                    "pascal_name": "ArtifactMatcher",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "artifact_type",
+                "description": "The artifact type of the allowlist.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "pascal_name": "ArtifactType",
+                  "enum": [
+                    {
+                      "content": "INIT_SCRIPT"
+                    },
+                    {
+                      "content": "LIBRARY_JAR"
+                    },
+                    {
+                      "content": "LIBRARY_MAVEN"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "created_at",
+                "description": "Time at which this artifact allowlist was set, in epoch milliseconds.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "created_by",
+                "description": "Username of the user who set the artifact allowlist.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "metastore_id",
+                "description": "Unique identifier of parent metastore.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "artifact_type",
+                "description": "The artifact type of the allowlist.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "pascal_name": "ArtifactType",
+                  "enum": [
+                    {
+                      "content": "INIT_SCRIPT"
+                    },
+                    {
+                      "content": "LIBRARY_JAR"
+                    },
+                    {
+                      "content": "LIBRARY_MAVEN"
+                    }
+                  ]
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "settings.AutomaticClusterUpdate",
+        "name": "AutomaticClusterUpdate",
+        "description": "Controls whether automatic cluster update is enabled for the current workspace.\nBy default, it is turned off.",
+        "package": {
+          "name": "settings"
+        },
+        "has_parent": true,
+        "docs_group": "settings",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "parent_service_id": "settings.Settings",
+        "methods": [
+          {
+            "name": "Get",
+            "description": "Gets the automatic cluster update setting.",
+            "summary": "Get the automatic cluster update setting.",
+            "path": "/api/2.0/settings/types/automatic_cluster_update/names/default",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetAutomaticClusterUpdateSettingRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "AutomaticClusterUpdateSetting",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "automatic_cluster_update_workspace",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ClusterAutoRestartMessage",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "automatic_cluster_update_workspace",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ClusterAutoRestartMessage",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Updates the automatic cluster update setting for the workspace. A fresh etag needs to be provided in `PATCH`\nrequests (as part of the setting field). The etag can be retrieved by making a `GET` request before the `PATCH` request.\nIf the setting is updated concurrently, `PATCH` fails with 409 and the request must be retried by using the fresh etag in the 409 response.",
+            "summary": "Update the automatic cluster update setting.",
+            "path": "/api/2.0/settings/types/automatic_cluster_update/names/default",
+            "can_use_json": true,
+            "must_use_json": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "UpdateAutomaticClusterUpdateSettingRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AutomaticClusterUpdateSetting",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AutomaticClusterUpdateSetting",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "AutomaticClusterUpdateSetting",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "automatic_cluster_update_workspace",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ClusterAutoRestartMessage",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "automatic_cluster_update_workspace",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ClusterAutoRestartMessage",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "allow_missing",
+                "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "field_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "setting",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AutomaticClusterUpdateSetting",
+                  "is_object": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "billing.BillableUsage",
+        "name": "BillableUsage",
+        "description": "This API allows you to download billable usage logs for the specified account and date range. This feature works with all account types.",
+        "package": {
+          "name": "billing"
+        },
+        "is_accounts": true,
+        "docs_group": "billing",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "methods": [
+          {
+            "name": "Download",
+            "description": "Returns billable usage logs in CSV format for the specified account and date range.\n\nNote that this method might take multiple minutes to complete.\n\n**Warning**: Depending on the queried date range, the number of workspaces\nin the account, the size of the response and the internet speed of the caller,\nthis API may hit a timeout after a few minutes. If you experience this, try to mitigate\nby calling the API with narrower date ranges.",
+            "summary": "Return billable usage logs.",
+            "path": "/api/2.0/accounts/{account_id}/usage/download",
+            "is_response_byte_stream": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DownloadRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "start_month",
+                  "description": "Format specification for month in the format `YYYY-MM`. This is\nused to specify billable usage `start_month` and `end_month`\nproperties. **Note**: Billable usage logs are unavailable before\nMarch 2019 (`2019-03`).",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "end_month",
+                  "description": "Format: `YYYY-MM`. Last month to return billable usage logs for.\nThis field is required.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "start_month",
+                  "description": "Format specification for month in the format `YYYY-MM`. This is\nused to specify billable usage `start_month` and `end_month`\nproperties. **Note**: Billable usage logs are unavailable before\nMarch 2019 (`2019-03`).",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "end_month",
+                  "description": "Format: `YYYY-MM`. Last month to return billable usage logs for.\nThis field is required.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DownloadResponse",
+              "is_object": true
+            },
+            "response_body_field": {
+              "pascal_name": "Contents"
+            },
+            "all_fields": [
+              {
+                "name": "end_month",
+                "description": "Format: `YYYY-MM`. Last month to return billable usage logs for.\nThis field is required.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "personal_data",
+                "description": "Specify whether to include personally identifiable information in\nthe billable usage logs, for example the email addresses of cluster\ncreators. Handle this information with care. Defaults to false.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "start_month",
+                "description": "Format specification for month in the format `YYYY-MM`. This is\nused to specify billable usage `start_month` and `end_month`\nproperties. **Note**: Billable usage logs are unavailable before\nMarch 2019 (`2019-03`).",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "start_month",
+                "description": "Format specification for month in the format `YYYY-MM`. This is\nused to specify billable usage `start_month` and `end_month`\nproperties. **Note**: Billable usage logs are unavailable before\nMarch 2019 (`2019-03`).",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "end_month",
+                "description": "Format: `YYYY-MM`. Last month to return billable usage logs for.\nThis field is required.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "billing.BudgetPolicy",
+        "name": "BudgetPolicy",
+        "description": "A service serves REST API about Budget policies",
+        "package": {
+          "name": "billing"
+        },
+        "is_accounts": true,
+        "docs_group": "billing",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "list": {
+          "request": {
+            "pascal_name": "ListBudgetPoliciesRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a new policy.",
+            "summary": "Create a budget policy.",
+            "path": "/api/2.1/accounts/{account_id}/budget-policies",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "CreateBudgetPolicyRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "BudgetPolicy",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "policy",
+                "description": "The policy to create. `policy_id` needs to be empty as it will be generated\n`policy_name` must be provided, custom_tags may need to be provided\ndepending on the cloud provider. All other fields are optional.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "BudgetPolicy",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "request_id",
+                "description": "A unique identifier for this request. Restricted to 36 ASCII characters.\nA random UUID is recommended.\nThis request is only idempotent if a `request_id` is provided.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes a policy",
+            "summary": "Delete a budget policy.",
+            "path": "/api/2.1/accounts/{account_id}/budget-policies/{policy_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "DeleteBudgetPolicyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "policy_id",
+                  "description": "The Id of the policy.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "policy_id",
+                  "description": "The Id of the policy.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "policy_id",
+                "description": "The Id of the policy.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "policy_id",
+                "description": "The Id of the policy.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Retrieves a policy by it's ID.",
+            "summary": "Get a budget policy.",
+            "path": "/api/2.1/accounts/{account_id}/budget-policies/{policy_id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetBudgetPolicyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "policy_id",
+                  "description": "The Id of the policy.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "policy_id",
+                  "description": "The Id of the policy.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "BudgetPolicy",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "policy_id",
+                "description": "The Id of the policy.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "policy_id",
+                "description": "The Id of the policy.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Lists all policies. Policies are returned in the alphabetically ascending order of their names.",
+            "summary": "List policies.",
+            "path": "/api/2.1/accounts/{account_id}/budget-policies",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "ListBudgetPoliciesRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListBudgetPoliciesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "filter_by",
+                "description": "A filter to apply to the list of policies.",
+                "is_query": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "Filter",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "The maximum number of budget policies to return.\nIf unspecified, at most 100 budget policies will be returned.\nThe maximum value is 1000; values above 1000 will be coerced to 1000.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "A page token, received from a previous `ListServerlessPolicies` call.\nProvide this to retrieve the subsequent page.\nIf unspecified, the first page will be returned.\n\nWhen paginating, all other parameters provided to `ListServerlessPoliciesRequest` must match\nthe call that provided the page token.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "sort_spec",
+                "description": "The sort specification.",
+                "is_query": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "SortSpec",
+                  "is_object": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "A page token, received from a previous `ListServerlessPolicies` call.\nProvide this to retrieve the subsequent page.\nIf unspecified, the first page will be returned.\n\nWhen paginating, all other parameters provided to `ListServerlessPoliciesRequest` must match\nthe call that provided the page token.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "Update",
+            "description": "Updates a policy",
+            "summary": "Update a budget policy.",
+            "path": "/api/2.1/accounts/{account_id}/budget-policies/{policy_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "UpdateBudgetPolicyRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "policy_id",
+                  "description": "The Id of the policy. This field is generated by Databricks and globally unique.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "policy",
+                  "description": "The policy to update. `creator_user_id` cannot be specified in the request. All other fields\nmust be specified even if not changed. The `policy_id` is used to identify the policy to\nupdate.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BudgetPolicy",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "policy_id",
+                  "description": "The Id of the policy. This field is generated by Databricks and globally unique.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "policy",
+                  "description": "The policy to update. `creator_user_id` cannot be specified in the request. All other fields\nmust be specified even if not changed. The `policy_id` is used to identify the policy to\nupdate.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BudgetPolicy",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "policy",
+              "description": "The policy to update. `creator_user_id` cannot be specified in the request. All other fields\nmust be specified even if not changed. The `policy_id` is used to identify the policy to\nupdate.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "BudgetPolicy",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "BudgetPolicy",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "limit_config",
+                "description": "DEPRECATED. This is redundant field as LimitConfig is part of the BudgetPolicy",
+                "is_query": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "LimitConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "policy",
+                "description": "The policy to update. `creator_user_id` cannot be specified in the request. All other fields\nmust be specified even if not changed. The `policy_id` is used to identify the policy to\nupdate.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "BudgetPolicy",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "policy_id",
+                "description": "The Id of the policy. This field is generated by Databricks and globally unique.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "binding_workspace_ids",
+                "description": "List of workspaces that this budget policy will be exclusively bound to.\nAn empty binding implies that this budget policy is open to any workspace in the account.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_int64": true
+                  }
+                }
+              },
+              {
+                "name": "custom_tags",
+                "description": "A list of tags defined by the customer. At most 20 entries are allowed per policy.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CustomPolicyTagList",
+                  "array_value": {
+                    "pascal_name": "CustomPolicyTag",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "policy_id",
+                "description": "The Id of the policy. This field is generated by Databricks and globally unique.",
+                "is_computed": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "policy_name",
+                "description": "The name of the policy.\n- Must be unique among active policies.\n- Can contain only characters from the ISO 8859-1 (latin1) set.\n- Can't start with reserved keywords such as `databricks:default-policy`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "policy_id",
+                "description": "The Id of the policy. This field is generated by Databricks and globally unique.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "billing.Budgets",
+        "name": "Budgets",
+        "description": "These APIs manage budget configurations for this account. Budgets enable you to monitor usage across your account. You can set up budgets to either track account-wide spending, or apply filters to track the spending of specific teams, projects, or workspaces.",
+        "package": {
+          "name": "billing"
+        },
+        "is_accounts": true,
+        "docs_group": "billing",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Create a new budget configuration for an account. For full details, see https://docs.databricks.com/en/admin/account-settings/budgets.html.",
+            "summary": "Create new budget.",
+            "path": "/api/2.1/accounts/{account_id}/budgets",
+            "can_use_json": true,
+            "must_use_json": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "CreateBudgetConfigurationRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "budget",
+                  "description": "Properties of the new budget configuration.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CreateBudgetConfigurationBudget",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "budget",
+                  "description": "Properties of the new budget configuration.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CreateBudgetConfigurationBudget",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CreateBudgetConfigurationResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "budget",
+                "description": "Properties of the new budget configuration.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CreateBudgetConfigurationBudget",
+                  "is_object": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes a budget configuration for an account. Both account and budget configuration are specified by ID. This cannot be undone.",
+            "summary": "Delete budget.",
+            "path": "/api/2.1/accounts/{account_id}/budgets/{budget_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "DeleteBudgetConfigurationRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "budget_id",
+                  "description": "The Databricks budget configuration ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "budget_id",
+                  "description": "The Databricks budget configuration ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteBudgetConfigurationResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "budget_id",
+                "description": "The Databricks budget configuration ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "budget_id",
+                "description": "The Databricks budget configuration ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets a budget configuration for an account. Both account and budget configuration are specified by ID.",
+            "summary": "Get budget.",
+            "path": "/api/2.1/accounts/{account_id}/budgets/{budget_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetBudgetConfigurationRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "budget_id",
+                  "description": "The budget configuration ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "budget_id",
+                  "description": "The budget configuration ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetBudgetConfigurationResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "budget_id",
+                "description": "The budget configuration ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "budget_id",
+                "description": "The budget configuration ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Gets all budgets associated with this account.",
+            "summary": "Get all budgets.",
+            "path": "/api/2.1/accounts/{account_id}/budgets",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "ListBudgetConfigurationsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListBudgetConfigurationsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_token",
+                "description": "A page token received from a previous get all budget configurations call. This token can be used to retrieve the subsequent page.\nRequests first page if absent.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "A page token received from a previous get all budget configurations call. This token can be used to retrieve the subsequent page.\nRequests first page if absent.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "Update",
+            "description": "Updates a budget configuration for an account. Both account and budget configuration are specified by ID.",
+            "summary": "Modify budget.",
+            "path": "/api/2.1/accounts/{account_id}/budgets/{budget_id}",
+            "can_use_json": true,
+            "must_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "UpdateBudgetConfigurationRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "budget_id",
+                  "description": "The Databricks budget configuration ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "budget",
+                  "description": "The updated budget. This will overwrite the budget specified by the budget ID.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "UpdateBudgetConfigurationBudget",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "budget_id",
+                  "description": "The Databricks budget configuration ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "budget",
+                  "description": "The updated budget. This will overwrite the budget specified by the budget ID.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "UpdateBudgetConfigurationBudget",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "UpdateBudgetConfigurationResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "budget",
+                "description": "The updated budget. This will overwrite the budget specified by the budget ID.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "UpdateBudgetConfigurationBudget",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "budget_id",
+                "description": "The Databricks budget configuration ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "budget_id",
+                "description": "The Databricks budget configuration ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "bundledeployments.BundleDeployments",
+        "name": "BundleDeployments",
+        "description": "Service for managing bundle deployment metadata.",
+        "package": {
+          "name": "bundledeployments"
+        },
+        "is_hidden_cli": true,
+        "docs_group": "bundledeployments",
+        "launch_stage": "PRIVATE_PREVIEW",
+        "cli_launch_stage_display": "Private Preview",
+        "list": {
+          "request": {
+            "pascal_name": "ListDeploymentsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "CompleteVersion",
+            "description": "Marks a version as complete and releases the deployment lock.\n\nThe server atomically:\n1. Sets the version status to the provided terminal status.\n2. Sets `complete_time` to the current server timestamp.\n3. Releases the lock on the parent deployment.\n4. Updates the parent deployment's `status` and `last_version_id`.",
+            "summary": "Complete a version.",
+            "path": "/api/2.0/bundle/{name=deployments/*/versions/*}/complete",
+            "can_use_json": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "CompleteVersionRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the version to complete.\nFormat: deployments/{deployment_id}/versions/{version_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "completion_reason",
+                  "description": "The reason for completing the version. Must be VERSION_COMPLETE_SUCCESS\nor VERSION_COMPLETE_FAILURE.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "VersionComplete",
+                    "enum": [
+                      {
+                        "content": "VERSION_COMPLETE_FAILURE"
+                      },
+                      {
+                        "content": "VERSION_COMPLETE_FORCE_ABORT"
+                      },
+                      {
+                        "content": "VERSION_COMPLETE_LEASE_EXPIRED"
+                      },
+                      {
+                        "content": "VERSION_COMPLETE_SUCCESS"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the version to complete.\nFormat: deployments/{deployment_id}/versions/{version_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "completion_reason",
+                  "description": "The reason for completing the version. Must be VERSION_COMPLETE_SUCCESS\nor VERSION_COMPLETE_FAILURE.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "VersionComplete",
+                    "enum": [
+                      {
+                        "content": "VERSION_COMPLETE_FAILURE"
+                      },
+                      {
+                        "content": "VERSION_COMPLETE_FORCE_ABORT"
+                      },
+                      {
+                        "content": "VERSION_COMPLETE_LEASE_EXPIRED"
+                      },
+                      {
+                        "content": "VERSION_COMPLETE_SUCCESS"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Version",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "cli_version",
+                  "description": "CLI version used to initiate the version.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version_type",
+                  "description": "Type of version (deploy or destroy).",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "VersionType",
+                    "enum": [
+                      {
+                        "content": "VERSION_TYPE_DEPLOY"
+                      },
+                      {
+                        "content": "VERSION_TYPE_DESTROY"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "cli_version",
+                  "description": "CLI version used to initiate the version.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version_type",
+                  "description": "Type of version (deploy or destroy).",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "VersionType",
+                    "enum": [
+                      {
+                        "content": "VERSION_TYPE_DEPLOY"
+                      },
+                      {
+                        "content": "VERSION_TYPE_DESTROY"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "completion_reason",
+                "description": "The reason for completing the version. Must be VERSION_COMPLETE_SUCCESS\nor VERSION_COMPLETE_FAILURE.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "VersionComplete",
+                  "enum": [
+                    {
+                      "content": "VERSION_COMPLETE_FAILURE"
+                    },
+                    {
+                      "content": "VERSION_COMPLETE_FORCE_ABORT"
+                    },
+                    {
+                      "content": "VERSION_COMPLETE_LEASE_EXPIRED"
+                    },
+                    {
+                      "content": "VERSION_COMPLETE_SUCCESS"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "force",
+                "description": "If true, force-completes the version even if the caller is not the\noriginal creator.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the version to complete.\nFormat: deployments/{deployment_id}/versions/{version_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the version to complete.\nFormat: deployments/{deployment_id}/versions/{version_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "completion_reason",
+                "description": "The reason for completing the version. Must be VERSION_COMPLETE_SUCCESS\nor VERSION_COMPLETE_FAILURE.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "VersionComplete",
+                  "enum": [
+                    {
+                      "content": "VERSION_COMPLETE_FAILURE"
+                    },
+                    {
+                      "content": "VERSION_COMPLETE_FORCE_ABORT"
+                    },
+                    {
+                      "content": "VERSION_COMPLETE_LEASE_EXPIRED"
+                    },
+                    {
+                      "content": "VERSION_COMPLETE_SUCCESS"
+                    }
+                  ]
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateDeployment",
+            "description": "Creates a new deployment in the workspace.",
+            "summary": "Create a deployment.",
+            "path": "/api/2.0/bundle/deployments",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "CreateDeploymentRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "deployment",
+                  "description": "The deployment to create. `initial_parent_path` is required. `display_name`, `target_name`,\n`deployment_mode`, and `workspace_info` may be set; every other field is assigned by the\nservice and ignored on input.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Deployment",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "deployment",
+                  "description": "The deployment to create. `initial_parent_path` is required. `display_name`, `target_name`,\n`deployment_mode`, and `workspace_info` may be set; every other field is assigned by the\nservice and ignored on input.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Deployment",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "deployment",
+              "description": "The deployment to create. `initial_parent_path` is required. `display_name`, `target_name`,\n`deployment_mode`, and `workspace_info` may be set; every other field is assigned by the\nservice and ignored on input.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Deployment",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "Deployment",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "deployment",
+                "description": "The deployment to create. `initial_parent_path` is required. `display_name`, `target_name`,\n`deployment_mode`, and `workspace_info` may be set; every other field is assigned by the\nservice and ignored on input.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Deployment",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "When the deployment was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "created_by",
+                "description": "The user who created the deployment (email or principal name). Empty if authoritative\ndeployment metadata does not identify a creator or the principal cannot be resolved.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "deployment_mode",
+                "description": "Bundle target deployment mode (development or production).",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DeploymentMode",
+                  "enum": [
+                    {
+                      "content": "DEPLOYMENT_MODE_DEVELOPMENT"
+                    },
+                    {
+                      "content": "DEPLOYMENT_MODE_PRODUCTION"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "destroy_time",
+                "description": "When deletion was recorded. Unset if deletion has not been recorded.\nThis response metadata does not determine the deployment's lifecycle status.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "destroyed_by",
+                "description": "The user who destroyed the deployment (email or principal name).\nUnset if the deployment has not been destroyed.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "Human-readable name for the deployment, up to 256 characters.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "git_info",
+                "description": "Git provenance of the deployment's source, derived from the latest version.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "GitInfo",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "initial_parent_path",
+                "description": "The workspace path of the existing folder where the deployment is initially created. Must be\nabsolute and canonical, with single separators, no `.` or `..` segments, and no trailing slash\nunless the path is `/`. It may contain at most 24 path segments, excluding an optional leading\n`/Workspace` segment. The complete path may contain up to 1,024 characters, and each segment\nmay contain up to 511 characters. This field is input only and is not returned in create, get,\nor list responses.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "last_successful_version_id",
+                "description": "The version_id of the most recent version that completed successfully.\nUnset until a version has completed successfully. Unlike last_version_id,\nit is not advanced when a version fails, so it always points at the last\nknown-good deployment state (or is unset if there has never been one).",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "last_version_id",
+                "description": "The version_id of the most recent deployment version.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name of the deployment.\nFormat: deployments/{deployment_id}",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "status",
+                "description": "Current status of the deployment.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DeploymentStatus",
+                  "enum": [
+                    {
+                      "content": "DEPLOYMENT_STATUS_ACTIVE"
+                    },
+                    {
+                      "content": "DEPLOYMENT_STATUS_DELETED"
+                    },
+                    {
+                      "content": "DEPLOYMENT_STATUS_FAILED"
+                    },
+                    {
+                      "content": "DEPLOYMENT_STATUS_IN_PROGRESS"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "target_name",
+                "description": "The bundle target name associated with this deployment.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "When the deployment was last updated.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "updated_by",
+                "description": "The user who most recently updated the deployment (email or principal name). Empty if\nauthoritative deployment metadata does not identify a modifier or the principal cannot be\nresolved.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "workspace_info",
+                "description": "Workspace location of the deployment.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "WorkspaceInfo",
+                  "is_object": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateVersion",
+            "description": "Creates a new version under a deployment.\n\nCreating a version acquires an exclusive lock on the deployment,\npreventing concurrent deploys. The caller provides a `version_id`,\na numeric string that must be numerically greater than the\ndeployment's most recent version, and sets the version's\n`previous_version_id` to the deployment's most recent version\n(leaving it unset for the first version), which the server validates\nto detect concurrent deploys.\n\nThe caller also provides the full set of `operations` planned for this\nversion, each identified by a `resource_key` and an `action_type`. The\nserver records one operation per resource in `OPERATION_STATUS_PENDING`\nin the same transaction as the version, so the plan is captured\natomically. The outcome of each operation is recorded later via\nUpdateOperation as the resource is applied; the set of operations cannot\nbe changed after the version is created.",
+            "summary": "Create a version.",
+            "path": "/api/2.0/bundle/{parent=deployments/*}/versions",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "CreateVersionRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "The parent deployment where this version will be created.\nFormat: deployments/{deployment_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version",
+                  "description": "The version to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Version",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "version_id",
+                  "description": "The ID to use for the version, which becomes the final component of\nthe version's resource name. A numeric string (base-10, fits in a\nsigned 64-bit integer) chosen by the caller; must be greater than or\nequal to 1. Must be numerically greater than the deployment's\nmost recent version (see `version.previous_version_id`); it does not\nneed to start at 1 or increase by exactly 1. If the value is not\nnumerically greater, the server returns `INVALID_PARAMETER_VALUE`.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "The parent deployment where this version will be created.\nFormat: deployments/{deployment_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version_id",
+                  "description": "The ID to use for the version, which becomes the final component of\nthe version's resource name. A numeric string (base-10, fits in a\nsigned 64-bit integer) chosen by the caller; must be greater than or\nequal to 1. Must be numerically greater than the deployment's\nmost recent version (see `version.previous_version_id`); it does not\nneed to start at 1 or increase by exactly 1. If the value is not\nnumerically greater, the server returns `INVALID_PARAMETER_VALUE`.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "version",
+                  "description": "The version to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Version",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "version",
+              "description": "The version to create.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Version",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "cli_version",
+                    "description": "CLI version used to initiate the version.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "version_type",
+                    "description": "Type of version (deploy or destroy).",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "VersionType",
+                      "enum": [
+                        {
+                          "content": "VERSION_TYPE_DEPLOY"
+                        },
+                        {
+                          "content": "VERSION_TYPE_DESTROY"
+                        }
+                      ]
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "cli_version",
+                    "description": "CLI version used to initiate the version.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "version_type",
+                    "description": "Type of version (deploy or destroy).",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "VersionType",
+                      "enum": [
+                        {
+                          "content": "VERSION_TYPE_DEPLOY"
+                        },
+                        {
+                          "content": "VERSION_TYPE_DESTROY"
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "Version",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "cli_version",
+                  "description": "CLI version used to initiate the version.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version_type",
+                  "description": "Type of version (deploy or destroy).",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "VersionType",
+                    "enum": [
+                      {
+                        "content": "VERSION_TYPE_DEPLOY"
+                      },
+                      {
+                        "content": "VERSION_TYPE_DESTROY"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "cli_version",
+                  "description": "CLI version used to initiate the version.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version_type",
+                  "description": "Type of version (deploy or destroy).",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "VersionType",
+                    "enum": [
+                      {
+                        "content": "VERSION_TYPE_DEPLOY"
+                      },
+                      {
+                        "content": "VERSION_TYPE_DESTROY"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "parent",
+                "description": "The parent deployment where this version will be created.\nFormat: deployments/{deployment_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version",
+                "description": "The version to create.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Version",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "cli_version",
+                      "description": "CLI version used to initiate the version.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "version_type",
+                      "description": "Type of version (deploy or destroy).",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "VersionType",
+                        "enum": [
+                          {
+                            "content": "VERSION_TYPE_DEPLOY"
+                          },
+                          {
+                            "content": "VERSION_TYPE_DESTROY"
+                          }
+                        ]
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "cli_version",
+                      "description": "CLI version used to initiate the version.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "version_type",
+                      "description": "Type of version (deploy or destroy).",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "VersionType",
+                        "enum": [
+                          {
+                            "content": "VERSION_TYPE_DEPLOY"
+                          },
+                          {
+                            "content": "VERSION_TYPE_DESTROY"
+                          }
+                        ]
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "version_id",
+                "description": "The ID to use for the version, which becomes the final component of\nthe version's resource name. A numeric string (base-10, fits in a\nsigned 64-bit integer) chosen by the caller; must be greater than or\nequal to 1. Must be numerically greater than the deployment's\nmost recent version (see `version.previous_version_id`); it does not\nneed to start at 1 or increase by exactly 1. If the value is not\nnumerically greater, the server returns `INVALID_PARAMETER_VALUE`.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "cli_version",
+                "description": "CLI version used to initiate the version.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "complete_time",
+                "description": "When the version completed. Unset while the version is in progress.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "completed_by",
+                "description": "The user who completed the version (email or principal name).\nMay differ from `created_by` when another user force-completes\nthe version.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "completion_reason",
+                "description": "Why the version was completed. Unset while in progress.\nSet when status transitions to COMPLETED.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "VersionComplete",
+                  "enum": [
+                    {
+                      "content": "VERSION_COMPLETE_FAILURE"
+                    },
+                    {
+                      "content": "VERSION_COMPLETE_FORCE_ABORT"
+                    },
+                    {
+                      "content": "VERSION_COMPLETE_LEASE_EXPIRED"
+                    },
+                    {
+                      "content": "VERSION_COMPLETE_SUCCESS"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "When the version was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "created_by",
+                "description": "The user who created the version (email or principal name).",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "deployment_mode",
+                "description": "Bundle target deployment mode (development or production), captured at the\ntime of this version.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DeploymentMode",
+                  "enum": [
+                    {
+                      "content": "DEPLOYMENT_MODE_DEVELOPMENT"
+                    },
+                    {
+                      "content": "DEPLOYMENT_MODE_PRODUCTION"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "Display name for the deployment, captured at the time of this version. Up to 256 characters.\nWhen present, creating the version updates the deployment display name. An empty value clears\nit; an absent value leaves the current deployment display name unchanged.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "git_info",
+                "description": "Git provenance of the source, captured at the time of this version.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "GitInfo",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name of the version.\nFormat: deployments/{deployment_id}/versions/{version_id}",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "operations",
+                "description": "The full operation plan for this version: one PENDING operation per entry,\nrecorded in the same transaction. Input only -- supplied on create and never\nreturned by create/get/list; read the recorded operations via ListOperations.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "StagedOperationList",
+                  "array_value": {
+                    "pascal_name": "StagedOperation",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "previous_version_id",
+                "description": "The version_id this version was created on top of — the deployment's\nmost recent version at creation time. Leave unset when creating the\nfirst version (the deployment has no prior versions). Set by the\nclient on creation and immutable thereafter.\n\nActs as an optimistic-concurrency precondition: the server requires\nit to equal the deployment's current most-recent version (and to be\nunset when the deployment has no versions) and returns\n`INVALID_PARAMETER_VALUE` on mismatch, so a deploy racing against a\nconcurrent deploy is rejected rather than silently overwriting it.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "status",
+                "description": "Status of the version: IN_PROGRESS or COMPLETED.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "VersionStatus",
+                  "enum": [
+                    {
+                      "content": "VERSION_STATUS_COMPLETED"
+                    },
+                    {
+                      "content": "VERSION_STATUS_IN_PROGRESS"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "target_name",
+                "description": "Target name of the deployment, captured at the time of this version.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version_id",
+                "description": "Version identifier within the parent deployment, assigned by the\nclient on creation. A numeric string (base-10, fits in a signed\n64-bit integer) that is greater than or equal to 1. Version IDs are\nstrictly increasing within a deployment but are not required to\nstart at 1 or to be contiguous.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version_type",
+                "description": "Type of version (deploy or destroy).",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "VersionType",
+                  "enum": [
+                    {
+                      "content": "VERSION_TYPE_DEPLOY"
+                    },
+                    {
+                      "content": "VERSION_TYPE_DESTROY"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "workspace_info",
+                "description": "Workspace location of the deployment, captured at the time of this version.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "WorkspaceInfo",
+                  "is_object": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "The parent deployment where this version will be created.\nFormat: deployments/{deployment_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version_id",
+                "description": "The ID to use for the version, which becomes the final component of\nthe version's resource name. A numeric string (base-10, fits in a\nsigned 64-bit integer) chosen by the caller; must be greater than or\nequal to 1. Must be numerically greater than the deployment's\nmost recent version (see `version.previous_version_id`); it does not\nneed to start at 1 or increase by exactly 1. If the value is not\nnumerically greater, the server returns `INVALID_PARAMETER_VALUE`.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "cli_version",
+                "description": "CLI version used to initiate the version.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version_type",
+                "description": "Type of version (deploy or destroy).",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "VersionType",
+                  "enum": [
+                    {
+                      "content": "VERSION_TYPE_DEPLOY"
+                    },
+                    {
+                      "content": "VERSION_TYPE_DESTROY"
+                    }
+                  ]
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteDeployment",
+            "description": "Deletes a deployment.",
+            "summary": "Delete a deployment.",
+            "path": "/api/2.0/bundle/{name=deployments/*}",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "DeleteDeploymentRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the deployment to delete.\nFormat: deployments/{deployment_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the deployment to delete.\nFormat: deployments/{deployment_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Resource name of the deployment to delete.\nFormat: deployments/{deployment_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Resource name of the deployment to delete.\nFormat: deployments/{deployment_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetDeployment",
+            "description": "Retrieves a deployment by its resource name.",
+            "summary": "Get a deployment.",
+            "path": "/api/2.0/bundle/{name=deployments/*}",
+            "is_crud_read": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "GetDeploymentRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the deployment to retrieve.\nFormat: deployments/{deployment_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the deployment to retrieve.\nFormat: deployments/{deployment_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Deployment",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Resource name of the deployment to retrieve.\nFormat: deployments/{deployment_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Resource name of the deployment to retrieve.\nFormat: deployments/{deployment_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetOperation",
+            "description": "Retrieves a resource operation by its resource name.",
+            "summary": "Get an operation.",
+            "path": "/api/2.0/bundle/{name=deployments/*/versions/*/operations/*}",
+            "is_crud_read": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "GetOperationRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the resource operation to retrieve.\nFormat: deployments/{deployment_id}/versions/{version_id}/operations/{resource_key}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the resource operation to retrieve.\nFormat: deployments/{deployment_id}/versions/{version_id}/operations/{resource_key}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The name of the resource operation to retrieve.\nFormat: deployments/{deployment_id}/versions/{version_id}/operations/{resource_key}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the resource operation to retrieve.\nFormat: deployments/{deployment_id}/versions/{version_id}/operations/{resource_key}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetResource",
+            "description": "Retrieves a deployment resource by its resource name.",
+            "summary": "Get a resource.",
+            "path": "/api/2.0/bundle/{name=deployments/*/resources/*}",
+            "is_crud_read": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "GetResourceRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the resource to retrieve.\nFormat: deployments/{deployment_id}/resources/{resource_key}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the resource to retrieve.\nFormat: deployments/{deployment_id}/resources/{resource_key}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Resource",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "resource_type",
+                  "description": "The type of the deployment resource.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DeploymentResourceType",
+                    "enum": [
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_ALERT"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_APP"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_CATALOG"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_CLUSTER"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_CLUSTER_POLICY"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_DASHBOARD"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_DATABASE_CATALOG"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_DATABASE_INSTANCE"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_EXPERIMENT"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_EXTERNAL_LOCATION"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_GENIE_SPACE"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_INSTANCE_POOL"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_JOB"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_JOB_RUN"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_MODEL"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_MODEL_SERVING_ENDPOINT"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_PIPELINE"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_POSTGRES_BRANCH"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_POSTGRES_CATALOG"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_POSTGRES_DATABASE"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_POSTGRES_ENDPOINT"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_POSTGRES_PROJECT"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_POSTGRES_ROLE"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_POSTGRES_SYNCED_TABLE"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_QUALITY_MONITOR"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_REGISTERED_MODEL"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_SCHEMA"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_SECRET"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_SECRET_SCOPE"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_SQL_WAREHOUSE"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_SYNCED_DATABASE_TABLE"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_VECTOR_SEARCH_ENDPOINT"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_VECTOR_SEARCH_INDEX"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_VOLUME"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "resource_type",
+                  "description": "The type of the deployment resource.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DeploymentResourceType",
+                    "enum": [
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_ALERT"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_APP"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_CATALOG"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_CLUSTER"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_CLUSTER_POLICY"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_DASHBOARD"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_DATABASE_CATALOG"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_DATABASE_INSTANCE"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_EXPERIMENT"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_EXTERNAL_LOCATION"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_GENIE_SPACE"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_INSTANCE_POOL"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_JOB"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_JOB_RUN"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_MODEL"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_MODEL_SERVING_ENDPOINT"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_PIPELINE"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_POSTGRES_BRANCH"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_POSTGRES_CATALOG"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_POSTGRES_DATABASE"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_POSTGRES_ENDPOINT"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_POSTGRES_PROJECT"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_POSTGRES_ROLE"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_POSTGRES_SYNCED_TABLE"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_QUALITY_MONITOR"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_REGISTERED_MODEL"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_SCHEMA"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_SECRET"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_SECRET_SCOPE"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_SQL_WAREHOUSE"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_SYNCED_DATABASE_TABLE"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_VECTOR_SEARCH_ENDPOINT"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_VECTOR_SEARCH_INDEX"
+                      },
+                      {
+                        "content": "DEPLOYMENT_RESOURCE_TYPE_VOLUME"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The name of the resource to retrieve.\nFormat: deployments/{deployment_id}/resources/{resource_key}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the resource to retrieve.\nFormat: deployments/{deployment_id}/resources/{resource_key}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetVersion",
+            "description": "Retrieves a version by its resource name.",
+            "summary": "Get a version.",
+            "path": "/api/2.0/bundle/{name=deployments/*/versions/*}",
+            "is_crud_read": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "GetVersionRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the version to retrieve.\nFormat: deployments/{deployment_id}/versions/{version_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the version to retrieve.\nFormat: deployments/{deployment_id}/versions/{version_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Version",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "cli_version",
+                  "description": "CLI version used to initiate the version.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version_type",
+                  "description": "Type of version (deploy or destroy).",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "VersionType",
+                    "enum": [
+                      {
+                        "content": "VERSION_TYPE_DEPLOY"
+                      },
+                      {
+                        "content": "VERSION_TYPE_DESTROY"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "cli_version",
+                  "description": "CLI version used to initiate the version.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version_type",
+                  "description": "Type of version (deploy or destroy).",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "VersionType",
+                    "enum": [
+                      {
+                        "content": "VERSION_TYPE_DEPLOY"
+                      },
+                      {
+                        "content": "VERSION_TYPE_DESTROY"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The name of the version to retrieve.\nFormat: deployments/{deployment_id}/versions/{version_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the version to retrieve.\nFormat: deployments/{deployment_id}/versions/{version_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Heartbeat",
+            "description": "Sends a heartbeat to renew the lock held by a version.\n\nThe server validates that the version is the active (non-terminal)\nversion on the parent deployment and resets the lock expiry. If the\nlock has already expired or the version is no longer active, the\nserver returns `ABORTED`.",
+            "summary": "Send a version heartbeat.",
+            "path": "/api/2.0/bundle/{name=deployments/*/versions/*}/heartbeat",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "HeartbeatRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The version whose lock to renew.\nFormat: deployments/{deployment_id}/versions/{version_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The version whose lock to renew.\nFormat: deployments/{deployment_id}/versions/{version_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "HeartbeatResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The version whose lock to renew.\nFormat: deployments/{deployment_id}/versions/{version_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The version whose lock to renew.\nFormat: deployments/{deployment_id}/versions/{version_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListDeployments",
+            "description": "Lists deployments in the workspace.",
+            "summary": "List deployments.",
+            "path": "/api/2.0/bundle/deployments",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "ListDeploymentsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListDeploymentsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "The maximum number of deployments to return. The service may return\nfewer than this value.\nIf unspecified, at most 20 deployments will be returned.\nThe maximum value is 1000; values above 1000 will be coerced to 1000.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "A page token, received from a previous `ListDeployments` call.\nProvide this to retrieve the subsequent page.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "show_deleted",
+                "description": "Whether to include soft-deleted deployments in the response. Defaults to\nfalse. When true, returns both live and soft-deleted deployments visible to\nthe caller, subject to the filter. Soft-deleted deployments have status\n`DEPLOYMENT_STATUS_DELETED`.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "A page token, received from a previous `ListDeployments` call.\nProvide this to retrieve the subsequent page.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListOperations",
+            "description": "Lists resource operations under a version.",
+            "summary": "List operations.",
+            "path": "/api/2.0/bundle/{parent=deployments/*/versions/*}/operations",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "ListOperationsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "The parent version.\nFormat: deployments/{deployment_id}/versions/{version_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "The parent version.\nFormat: deployments/{deployment_id}/versions/{version_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListOperationsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "The maximum number of operations to return. The service may return\nfewer than this value.\nIf unspecified, at most 50 operations will be returned.\nThe maximum value is 1000; values above 1000 will be coerced to 1000.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "A page token, received from a previous `ListOperations` call.\nProvide this to retrieve the subsequent page.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "The parent version.\nFormat: deployments/{deployment_id}/versions/{version_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "The parent version.\nFormat: deployments/{deployment_id}/versions/{version_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "A page token, received from a previous `ListOperations` call.\nProvide this to retrieve the subsequent page.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListResources",
+            "description": "Lists resources under a deployment.",
+            "summary": "List resources.",
+            "path": "/api/2.0/bundle/{parent=deployments/*}/resources",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "ListResourcesRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "The parent deployment.\nFormat: deployments/{deployment_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "The parent deployment.\nFormat: deployments/{deployment_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListResourcesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "The maximum number of resources to return. The service may return\nfewer than this value.\nIf unspecified, at most 50 resources will be returned.\nThe maximum value is 1000; values above 1000 will be coerced to 1000.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "A page token, received from a previous `ListResources` call.\nProvide this to retrieve the subsequent page.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "The parent deployment.\nFormat: deployments/{deployment_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "The parent deployment.\nFormat: deployments/{deployment_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "A page token, received from a previous `ListResources` call.\nProvide this to retrieve the subsequent page.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListVersions",
+            "description": "Lists versions under a deployment, ordered numerically by\nversion_id descending (most recent first).",
+            "summary": "List versions.",
+            "path": "/api/2.0/bundle/{parent=deployments/*}/versions",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "ListVersionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "The parent deployment.\nFormat: deployments/{deployment_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "The parent deployment.\nFormat: deployments/{deployment_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListVersionsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "The maximum number of versions to return. The service may return\nfewer than this value.\nIf unspecified, at most 20 versions will be returned.\nThe maximum value is 100; values above 100 will be coerced to 100.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "A page token, received from a previous `ListVersions` call.\nProvide this to retrieve the subsequent page.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "The parent deployment.\nFormat: deployments/{deployment_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "The parent deployment.\nFormat: deployments/{deployment_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "A page token, received from a previous `ListVersions` call.\nProvide this to retrieve the subsequent page.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "UpdateDeployment",
+            "description": "Updates a deployment.",
+            "summary": "Update a deployment.",
+            "path": "/api/2.0/bundle/{name=deployments/*}",
+            "can_use_json": true,
+            "must_use_json": true,
+            "is_json_only": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "UpdateDeploymentRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the deployment.\nFormat: deployments/{deployment_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "deployment",
+                  "description": "The deployment to update. Its `name` selects the deployment; the fields\nnamed in `update_mask` carry the new values. All other fields are ignored.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Deployment",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The fields to update; supported paths are `display_name`, `deployment_mode`, `target_name`,\nand `workspace_info`. An empty mask or any other path returns INVALID_PARAMETER_VALUE.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the deployment.\nFormat: deployments/{deployment_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The fields to update; supported paths are `display_name`, `deployment_mode`, `target_name`,\nand `workspace_info`. An empty mask or any other path returns INVALID_PARAMETER_VALUE.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "deployment",
+                  "description": "The deployment to update. Its `name` selects the deployment; the fields\nnamed in `update_mask` carry the new values. All other fields are ignored.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Deployment",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "deployment",
+              "description": "The deployment to update. Its `name` selects the deployment; the fields\nnamed in `update_mask` carry the new values. All other fields are ignored.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Deployment",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "Deployment",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "deployment",
+                "description": "The deployment to update. Its `name` selects the deployment; the fields\nnamed in `update_mask` carry the new values. All other fields are ignored.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Deployment",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name of the deployment.\nFormat: deployments/{deployment_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The fields to update; supported paths are `display_name`, `deployment_mode`, `target_name`,\nand `workspace_info`. An empty mask or any other path returns INVALID_PARAMETER_VALUE.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "When the deployment was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "created_by",
+                "description": "The user who created the deployment (email or principal name). Empty if authoritative\ndeployment metadata does not identify a creator or the principal cannot be resolved.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "deployment_mode",
+                "description": "Bundle target deployment mode (development or production).",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DeploymentMode",
+                  "enum": [
+                    {
+                      "content": "DEPLOYMENT_MODE_DEVELOPMENT"
+                    },
+                    {
+                      "content": "DEPLOYMENT_MODE_PRODUCTION"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "destroy_time",
+                "description": "When deletion was recorded. Unset if deletion has not been recorded.\nThis response metadata does not determine the deployment's lifecycle status.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "destroyed_by",
+                "description": "The user who destroyed the deployment (email or principal name).\nUnset if the deployment has not been destroyed.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "Human-readable name for the deployment, up to 256 characters.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "git_info",
+                "description": "Git provenance of the deployment's source, derived from the latest version.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "GitInfo",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "initial_parent_path",
+                "description": "The workspace path of the existing folder where the deployment is initially created. Must be\nabsolute and canonical, with single separators, no `.` or `..` segments, and no trailing slash\nunless the path is `/`. It may contain at most 24 path segments, excluding an optional leading\n`/Workspace` segment. The complete path may contain up to 1,024 characters, and each segment\nmay contain up to 511 characters. This field is input only and is not returned in create, get,\nor list responses.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "last_successful_version_id",
+                "description": "The version_id of the most recent version that completed successfully.\nUnset until a version has completed successfully. Unlike last_version_id,\nit is not advanced when a version fails, so it always points at the last\nknown-good deployment state (or is unset if there has never been one).",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "last_version_id",
+                "description": "The version_id of the most recent deployment version.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name of the deployment.\nFormat: deployments/{deployment_id}",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "status",
+                "description": "Current status of the deployment.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DeploymentStatus",
+                  "enum": [
+                    {
+                      "content": "DEPLOYMENT_STATUS_ACTIVE"
+                    },
+                    {
+                      "content": "DEPLOYMENT_STATUS_DELETED"
+                    },
+                    {
+                      "content": "DEPLOYMENT_STATUS_FAILED"
+                    },
+                    {
+                      "content": "DEPLOYMENT_STATUS_IN_PROGRESS"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "target_name",
+                "description": "The bundle target name associated with this deployment.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "When the deployment was last updated.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "updated_by",
+                "description": "The user who most recently updated the deployment (email or principal name). Empty if\nauthoritative deployment metadata does not identify a modifier or the principal cannot be\nresolved.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "workspace_info",
+                "description": "Workspace location of the deployment.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "WorkspaceInfo",
+                  "is_object": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Resource name of the deployment.\nFormat: deployments/{deployment_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateOperation",
+            "description": "Updates a resource operation's mutable fields.\n\n`state`, `error_message`, `resource_id`, `status`, and `dashboard_metadata`\nmay be updated, independently; `update_mask` must contain only those paths.\nAll other fields are immutable. The update is guarded by an\noptimistic-concurrency check: the caller sets `operation.sequence_id` to the\nvalue it last observed, and the server rejects the update with `ABORTED` if\nthe operation has been modified since. On success the server increments\n`sequence_id`; updates to `state`, `resource_id`, and `dashboard_metadata`\nare mirrored onto the corresponding deployment-level resource. Listing\n`state` in `update_mask` with no value clears it, which removes the\nresource, so a delete that is retried until it succeeds must clear `state`.\nThe parent version must be in progress, and after the update is applied a\nsucceeded operation cannot carry an `error_message`. See the `state` and\n`resource_id` fields for the rest.",
+            "summary": "Update an operation.",
+            "path": "/api/2.0/bundle/{name=deployments/*/versions/*/operations/*}",
+            "can_use_json": true,
+            "must_use_json": true,
+            "is_json_only": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "UpdateOperationRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the operation.\nFormat: deployments/{deployment_id}/versions/{version_id}/operations/{resource_key}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "operation",
+                  "description": "The operation to update. Its `name` selects the operation; the fields named\nin `update_mask` carry the new values; and `sequence_id` carries the\noptimistic-concurrency precondition (see the field docs on Operation). All\nother fields are ignored.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Operation",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The set of fields to update. Required; supported paths are `state`,\n`error_message`, `resource_id`, `status`, and `dashboard_metadata`. An empty\nmask or any other path is rejected with INVALID_PARAMETER_VALUE.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the operation.\nFormat: deployments/{deployment_id}/versions/{version_id}/operations/{resource_key}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The set of fields to update. Required; supported paths are `state`,\n`error_message`, `resource_id`, `status`, and `dashboard_metadata`. An empty\nmask or any other path is rejected with INVALID_PARAMETER_VALUE.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "operation",
+                  "description": "The operation to update. Its `name` selects the operation; the fields named\nin `update_mask` carry the new values; and `sequence_id` carries the\noptimistic-concurrency precondition (see the field docs on Operation). All\nother fields are ignored.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Operation",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "operation",
+              "description": "The operation to update. Its `name` selects the operation; the fields named\nin `update_mask` carry the new values; and `sequence_id` carries the\noptimistic-concurrency precondition (see the field docs on Operation). All\nother fields are ignored.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Operation",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Resource name of the operation.\nFormat: deployments/{deployment_id}/versions/{version_id}/operations/{resource_key}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "operation",
+                "description": "The operation to update. Its `name` selects the operation; the fields named\nin `update_mask` carry the new values; and `sequence_id` carries the\noptimistic-concurrency precondition (see the field docs on Operation). All\nother fields are ignored.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Operation",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The set of fields to update. Required; supported paths are `state`,\n`error_message`, `resource_id`, `status`, and `dashboard_metadata`. An empty\nmask or any other path is rejected with INVALID_PARAMETER_VALUE.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "action_type",
+                "description": "The type of operation performed on this resource. Set when the version is\ncreated and immutable thereafter.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "OperationActionType",
+                  "enum": [
+                    {
+                      "content": "OPERATION_ACTION_TYPE_BIND"
+                    },
+                    {
+                      "content": "OPERATION_ACTION_TYPE_BIND_AND_UPDATE"
+                    },
+                    {
+                      "content": "OPERATION_ACTION_TYPE_CREATE"
+                    },
+                    {
+                      "content": "OPERATION_ACTION_TYPE_DELETE"
+                    },
+                    {
+                      "content": "OPERATION_ACTION_TYPE_INITIAL_REGISTER"
+                    },
+                    {
+                      "content": "OPERATION_ACTION_TYPE_RECREATE"
+                    },
+                    {
+                      "content": "OPERATION_ACTION_TYPE_RESIZE"
+                    },
+                    {
+                      "content": "OPERATION_ACTION_TYPE_UPDATE"
+                    },
+                    {
+                      "content": "OPERATION_ACTION_TYPE_UPDATE_WITH_ID"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "When the operation was recorded.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "dashboard_metadata",
+                "description": "Dashboard-specific metadata; set only for dashboard resources. Mutable: may\nbe set or updated via UpdateOperation as the resource is applied, and is\nmirrored onto the corresponding deployment-level resource.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "DashboardMetadata",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "error_message",
+                "description": "Error message if the operation failed. Set when status is\nOPERATION_STATUS_FAILED. Captures the error encountered while applying the\nresource to the workspace. Mutable: may be updated after creation via\nUpdateOperation; setting it to an empty string clears it. After an update\nis applied, an operation whose status is OPERATION_STATUS_SUCCEEDED cannot\ncarry an error_message.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name of the operation.\nFormat: deployments/{deployment_id}/versions/{version_id}/operations/{resource_key}",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "resource_id",
+                "description": "ID of the actual resource in the workspace (e.g. the job ID, pipeline ID).\nRequired whenever `state` is set, because state records a resource that\nexists. A CREATE or RECREATE that has not produced its resource yet records\nneither. Mutable: may be filled in (or corrected) later via UpdateOperation\nonce the ID is known.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "resource_key",
+                "description": "Resource identifier within the bundle (e.g. \"jobs.foo\",\n\"pipelines.bar\", \"jobs.foo.permissions\", \"files.\u003crel-path\u003e\").\nCan be an arbitrary UTF-8 encoded string key. This key links the\noperation to the corresponding deployment-level Resource. Set when the\nversion is created and immutable thereafter.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "resource_type",
+                "description": "The type of the deployment resource this operation applies to. Derived\nfrom the `resource_key` prefix (e.g. \"jobs\" → JOB); the caller does not\nset this field.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DeploymentResourceType",
+                  "enum": [
+                    {
+                      "content": "DEPLOYMENT_RESOURCE_TYPE_ALERT"
+                    },
+                    {
+                      "content": "DEPLOYMENT_RESOURCE_TYPE_APP"
+                    },
+                    {
+                      "content": "DEPLOYMENT_RESOURCE_TYPE_CATALOG"
+                    },
+                    {
+                      "content": "DEPLOYMENT_RESOURCE_TYPE_CLUSTER"
+                    },
+                    {
+                      "content": "DEPLOYMENT_RESOURCE_TYPE_CLUSTER_POLICY"
+                    },
+                    {
+                      "content": "DEPLOYMENT_RESOURCE_TYPE_DASHBOARD"
+                    },
+                    {
+                      "content": "DEPLOYMENT_RESOURCE_TYPE_DATABASE_CATALOG"
+                    },
+                    {
+                      "content": "DEPLOYMENT_RESOURCE_TYPE_DATABASE_INSTANCE"
+                    },
+                    {
+                      "content": "DEPLOYMENT_RESOURCE_TYPE_EXPERIMENT"
+                    },
+                    {
+                      "content": "DEPLOYMENT_RESOURCE_TYPE_EXTERNAL_LOCATION"
+                    },
+                    {
+                      "content": "DEPLOYMENT_RESOURCE_TYPE_GENIE_SPACE"
+                    },
+                    {
+                      "content": "DEPLOYMENT_RESOURCE_TYPE_INSTANCE_POOL"
+                    },
+                    {
+                      "content": "DEPLOYMENT_RESOURCE_TYPE_JOB"
+                    },
+                    {
+                      "content": "DEPLOYMENT_RESOURCE_TYPE_JOB_RUN"
+                    },
+                    {
+                      "content": "DEPLOYMENT_RESOURCE_TYPE_MODEL"
+                    },
+                    {
+                      "content": "DEPLOYMENT_RESOURCE_TYPE_MODEL_SERVING_ENDPOINT"
+                    },
+                    {
+                      "content": "DEPLOYMENT_RESOURCE_TYPE_PIPELINE"
+                    },
+                    {
+                      "content": "DEPLOYMENT_RESOURCE_TYPE_POSTGRES_BRANCH"
+                    },
+                    {
+                      "content": "DEPLOYMENT_RESOURCE_TYPE_POSTGRES_CATALOG"
+                    },
+                    {
+                      "content": "DEPLOYMENT_RESOURCE_TYPE_POSTGRES_DATABASE"
+                    },
+                    {
+                      "content": "DEPLOYMENT_RESOURCE_TYPE_POSTGRES_ENDPOINT"
+                    },
+                    {
+                      "content": "DEPLOYMENT_RESOURCE_TYPE_POSTGRES_PROJECT"
+                    },
+                    {
+                      "content": "DEPLOYMENT_RESOURCE_TYPE_POSTGRES_ROLE"
+                    },
+                    {
+                      "content": "DEPLOYMENT_RESOURCE_TYPE_POSTGRES_SYNCED_TABLE"
+                    },
+                    {
+                      "content": "DEPLOYMENT_RESOURCE_TYPE_QUALITY_MONITOR"
+                    },
+                    {
+                      "content": "DEPLOYMENT_RESOURCE_TYPE_REGISTERED_MODEL"
+                    },
+                    {
+                      "content": "DEPLOYMENT_RESOURCE_TYPE_SCHEMA"
+                    },
+                    {
+                      "content": "DEPLOYMENT_RESOURCE_TYPE_SECRET"
+                    },
+                    {
+                      "content": "DEPLOYMENT_RESOURCE_TYPE_SECRET_SCOPE"
+                    },
+                    {
+                      "content": "DEPLOYMENT_RESOURCE_TYPE_SQL_WAREHOUSE"
+                    },
+                    {
+                      "content": "DEPLOYMENT_RESOURCE_TYPE_SYNCED_DATABASE_TABLE"
+                    },
+                    {
+                      "content": "DEPLOYMENT_RESOURCE_TYPE_VECTOR_SEARCH_ENDPOINT"
+                    },
+                    {
+                      "content": "DEPLOYMENT_RESOURCE_TYPE_VECTOR_SEARCH_INDEX"
+                    },
+                    {
+                      "content": "DEPLOYMENT_RESOURCE_TYPE_VOLUME"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "sequence_id",
+                "description": "Monotonically increasing revision used for optimistic concurrency control\n(the AIP-154 concurrency token for this resource, realized as a sequence\nnumber rather than an opaque etag). The server assigns 0 when the operation\nis created and increments it on every successful UpdateOperation, so a\nnever-updated operation is at 0 and the first successful update makes it 1.\nIt is OPTIONAL rather than OUTPUT_ONLY because it is dual-purpose:\nGetOperation returns the current value, and UpdateOperation reads the\ncaller-supplied value as a precondition. The caller must echo the value it\nlast observed; if it no longer matches the server's value, the update is\nrejected with ABORTED so the caller can re-read and retry.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "state",
+                "description": "Serialized local config state after the operation. Its presence records\nwhether the resource still exists. Explicitly clearing state removes the resource;\nomitting it from the update mask leaves resource state unchanged.\nState is stored only on Resources. UpdateOperation accepts state but omits it\nfrom its response, as do subsequent GetOperation and ListOperations.\n\nMutable: may be updated after creation via UpdateOperation. When updating,\nthe caller must echo the last-observed `sequence_id` as a concurrency\nprecondition.\n\nThe string is not parsed; it is projected onto the corresponding Resource's\nstate. It is deliberately not google.protobuf.Value, whose only numeric case\nis `double number_value`, so parsing the client's JSON into it rewrites every\ninteger as a double - `1` reads back as `1.0`, which no longer deserializes\ninto an integer field - and silently loses precision above 2^53, which is\nwithin range for IDs the client records.\n\nA string rather than bytes: the payload is always UTF-8 JSON, and proto3 JSON\nmaps bytes to base64, which inflates every request and response by a third\nand makes state unreadable in logs and API responses. Both generate the same\nOpenAPI schema (\"type\": \"string\"), so the SDKs are identical either way.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "status",
+                "description": "Status of the operation. Starts as OPERATION_STATUS_PENDING when the version\nis created and moves to a terminal status once the resource is applied.\nMutable: updated via UpdateOperation, e.g. when an operation recorded as\nfailed is retried and eventually succeeds.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "OperationStatus",
+                  "enum": [
+                    {
+                      "content": "OPERATION_STATUS_FAILED"
+                    },
+                    {
+                      "content": "OPERATION_STATUS_PENDING"
+                    },
+                    {
+                      "content": "OPERATION_STATUS_SUCCEEDED"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "When the operation was last updated. Set to `create_time` when the operation is created and\nto the server timestamp on each successful UpdateOperation.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Resource name of the operation.\nFormat: deployments/{deployment_id}/versions/{version_id}/operations/{resource_key}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "catalog.Catalogs",
+        "name": "Catalogs",
+        "description": "A catalog is the first layer of Unity Catalog’s three-level namespace. It’s used to organize\nyour data assets. Users can see all catalogs on which they have been assigned the USE_CATALOG\ndata permission.\n\nIn Unity Catalog, admins and data stewards manage users and their access to data centrally\nacross all of the workspaces in a Databricks account. Users in different workspaces can\nshare access to the same data, depending on privileges granted centrally in Unity Catalog.",
+        "package": {
+          "name": "catalog"
+        },
+        "docs_group": "catalog",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListCatalogsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a new catalog instance in the parent metastore if the caller is a metastore admin or has the **CREATE_CATALOG** privilege.",
+            "summary": "Create a catalog.",
+            "path": "/api/2.1/unity-catalog/catalogs",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateCatalog",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of catalog.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of catalog.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CatalogInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "comment",
+                "description": "User-provided free-form text description.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "connection_name",
+                "description": "The name of the connection to an external data source.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "custom_max_retention_hours",
+                "description": "Custom maximum retention period in hours for the catalog",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "managed_encryption_settings",
+                "description": "Control CMK encryption for managed catalog data",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "EncryptionSettings",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of catalog.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "options",
+                "description": "A map of key-value properties attached to the securable.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "properties",
+                "description": "A map of key-value properties attached to the securable.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "provider_name",
+                "description": "The name of delta sharing provider.\n\nA Delta Sharing catalog is a catalog that is based on a Delta share on a remote sharing server.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "share_name",
+                "description": "The name of the share under the share provider.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "storage_root",
+                "description": "Storage root URL for managed tables within catalog.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of catalog.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes the catalog that matches the supplied name. The caller must be a metastore admin or the owner of the catalog.",
+            "summary": "Delete a catalog.",
+            "path": "/api/2.1/unity-catalog/catalogs/{name}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteCatalogRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the catalog.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the catalog.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "force",
+                "description": "Force deletion even if the catalog is not empty.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the catalog.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the catalog.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets the specified catalog in a metastore.\nThe caller must be a metastore admin, the owner of the catalog, or a user that has the **USE_CATALOG** privilege set for their account.",
+            "summary": "Get a catalog.",
+            "path": "/api/2.1/unity-catalog/catalogs/{name}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetCatalogRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the catalog.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the catalog.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CatalogInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "include_browse",
+                "description": "Whether to include catalogs in the response for which the principal can only access selective metadata for",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the catalog.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the catalog.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Gets an array of catalogs in the metastore.\nIf the caller is the metastore admin, all catalogs will be retrieved.\nOtherwise, only catalogs owned by the caller (or for which the caller has the **USE_CATALOG** privilege) will be retrieved.\nThere is no guarantee of a specific ordering of the elements in the array.\n\nNOTE: we recommend using max_results=0 to use the paginated version of this API. Unpaginated calls will be deprecated soon.\n\nPAGINATION BEHAVIOR: When using pagination (max_results \u003e= 0), a page may contain zero results while still providing a next_page_token.\nClients must continue reading pages until next_page_token is absent, which is the only indication that the end of results has been reached.",
+            "summary": "List catalogs.",
+            "path": "/api/2.1/unity-catalog/catalogs",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListCatalogsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListCatalogsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "include_browse",
+                "description": "Whether to include catalogs in the response for which the principal can only access selective metadata for",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "include_unbound",
+                "description": "Whether to include catalogs not bound to the workspace.\nEffective only if the user has permission to update the catalog–workspace binding.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "max_results",
+                "description": "Maximum number of catalogs to return.\n- when set to 0, the page length is set to a server configured value (recommended);\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- when set to a value less than 0, an invalid parameter error is returned;\n- If not set, all valid catalogs are returned (not recommended).\n- Note: The number of returned catalogs might be less than the specified max_results size, even zero.\nThe only definitive indication that no further catalogs can be fetched is when the next_page_token is unset from the response.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque pagination token to go to next page based on previous query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Opaque pagination token to go to next page based on previous query.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              },
+              "max_results": {
+                "name": "max_results",
+                "description": "Maximum number of catalogs to return.\n- when set to 0, the page length is set to a server configured value (recommended);\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- when set to a value less than 0, an invalid parameter error is returned;\n- If not set, all valid catalogs are returned (not recommended).\n- Note: The number of returned catalogs might be less than the specified max_results size, even zero.\nThe only definitive indication that no further catalogs can be fetched is when the next_page_token is unset from the response.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              }
+            }
+          },
+          {
+            "name": "Update",
+            "description": "Updates the catalog that matches the supplied name.\nThe caller must be either the owner of the catalog, or a metastore admin (when changing the owner field of the catalog).",
+            "summary": "Update a catalog.",
+            "path": "/api/2.1/unity-catalog/catalogs/{name}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateCatalog",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the catalog.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the catalog.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CatalogInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "comment",
+                "description": "User-provided free-form text description.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "custom_max_retention_hours",
+                "description": "Custom maximum retention period in hours for the catalog",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "enable_predictive_optimization",
+                "description": "Whether predictive optimization should be enabled for this object and objects under it.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EnablePredictiveOptimization",
+                  "enum": [
+                    {
+                      "content": "DISABLE"
+                    },
+                    {
+                      "content": "ENABLE"
+                    },
+                    {
+                      "content": "INHERIT"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "isolation_mode",
+                "description": "Whether the current securable is accessible from all workspaces or a specific set of workspaces.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CatalogIsolationMode",
+                  "enum": [
+                    {
+                      "content": "ISOLATED"
+                    },
+                    {
+                      "content": "OPEN"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "managed_encryption_settings",
+                "description": "Control CMK encryption for managed catalog data",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "EncryptionSettings",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the catalog.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "new_name",
+                "description": "New name for the catalog.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "options",
+                "description": "A map of key-value properties attached to the securable.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "owner",
+                "description": "Username of current owner of catalog.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "properties",
+                "description": "A map of key-value properties attached to the securable.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the catalog.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "cleanrooms.CleanRoomAssetRevisions",
+        "name": "CleanRoomAssetRevisions",
+        "description": "Clean Room Asset Revisions denote new versions\nof uploaded assets (e.g. notebooks) in the clean room.",
+        "package": {
+          "name": "cleanrooms"
+        },
+        "docs_group": "cleanrooms",
+        "launch_stage": "PUBLIC_BETA",
+        "cli_launch_stage_label": "*Beta*",
+        "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+        "cli_launch_stage_display": "Beta",
+        "list": {
+          "request": {
+            "pascal_name": "ListCleanRoomAssetRevisionsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Get",
+            "description": "Get a specific revision of an asset",
+            "summary": "Get an asset revision.",
+            "path": "/api/2.0/clean-rooms/{clean_room_name}/assets/{asset_type}/{name}/revisions/{etag}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetCleanRoomAssetRevisionRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "clean_room_name",
+                  "description": "Name of the clean room.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "asset_type",
+                  "description": "Asset type. Only NOTEBOOK_FILE is supported.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "pascal_name": "CleanRoomAssetAssetType",
+                    "enum": [
+                      {
+                        "content": "FOREIGN_TABLE"
+                      },
+                      {
+                        "content": "JAR_ANALYSIS"
+                      },
+                      {
+                        "content": "NOTEBOOK_FILE"
+                      },
+                      {
+                        "content": "TABLE"
+                      },
+                      {
+                        "content": "VIEW"
+                      },
+                      {
+                        "content": "VOLUME"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "name",
+                  "description": "Name of the asset.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "etag",
+                  "description": "Revision etag to fetch. If not provided, the latest revision will be returned.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "clean_room_name",
+                  "description": "Name of the clean room.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "asset_type",
+                  "description": "Asset type. Only NOTEBOOK_FILE is supported.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "pascal_name": "CleanRoomAssetAssetType",
+                    "enum": [
+                      {
+                        "content": "FOREIGN_TABLE"
+                      },
+                      {
+                        "content": "JAR_ANALYSIS"
+                      },
+                      {
+                        "content": "NOTEBOOK_FILE"
+                      },
+                      {
+                        "content": "TABLE"
+                      },
+                      {
+                        "content": "VIEW"
+                      },
+                      {
+                        "content": "VOLUME"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "name",
+                  "description": "Name of the asset.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "etag",
+                  "description": "Revision etag to fetch. If not provided, the latest revision will be returned.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CleanRoomAsset",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "A fully qualified name that uniquely identifies the asset within the clean room.\nThis is also the name displayed in the clean room UI.\n\nFor UC securable assets (tables, volumes, etc.), the format is *shared_catalog*.*shared_schema*.*asset_name*\n\nFor notebooks, the name is the notebook file name.\nFor jar analyses, the name is the jar analysis name.\nFor Genie spaces, the name is derived from the clean room; the caller does not choose it.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "asset_type",
+                  "description": "The type of the asset.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CleanRoomAssetAssetType",
+                    "enum": [
+                      {
+                        "content": "FOREIGN_TABLE"
+                      },
+                      {
+                        "content": "JAR_ANALYSIS"
+                      },
+                      {
+                        "content": "NOTEBOOK_FILE"
+                      },
+                      {
+                        "content": "TABLE"
+                      },
+                      {
+                        "content": "VIEW"
+                      },
+                      {
+                        "content": "VOLUME"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "A fully qualified name that uniquely identifies the asset within the clean room.\nThis is also the name displayed in the clean room UI.\n\nFor UC securable assets (tables, volumes, etc.), the format is *shared_catalog*.*shared_schema*.*asset_name*\n\nFor notebooks, the name is the notebook file name.\nFor jar analyses, the name is the jar analysis name.\nFor Genie spaces, the name is derived from the clean room; the caller does not choose it.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "asset_type",
+                  "description": "The type of the asset.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CleanRoomAssetAssetType",
+                    "enum": [
+                      {
+                        "content": "FOREIGN_TABLE"
+                      },
+                      {
+                        "content": "JAR_ANALYSIS"
+                      },
+                      {
+                        "content": "NOTEBOOK_FILE"
+                      },
+                      {
+                        "content": "TABLE"
+                      },
+                      {
+                        "content": "VIEW"
+                      },
+                      {
+                        "content": "VOLUME"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "asset_type",
+                "description": "Asset type. Only NOTEBOOK_FILE is supported.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAssetAssetType",
+                  "enum": [
+                    {
+                      "content": "FOREIGN_TABLE"
+                    },
+                    {
+                      "content": "JAR_ANALYSIS"
+                    },
+                    {
+                      "content": "NOTEBOOK_FILE"
+                    },
+                    {
+                      "content": "TABLE"
+                    },
+                    {
+                      "content": "VIEW"
+                    },
+                    {
+                      "content": "VOLUME"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "clean_room_name",
+                "description": "Name of the clean room.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "etag",
+                "description": "Revision etag to fetch. If not provided, the latest revision will be returned.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the asset.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "clean_room_name",
+                "description": "Name of the clean room.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "asset_type",
+                "description": "Asset type. Only NOTEBOOK_FILE is supported.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAssetAssetType",
+                  "enum": [
+                    {
+                      "content": "FOREIGN_TABLE"
+                    },
+                    {
+                      "content": "JAR_ANALYSIS"
+                    },
+                    {
+                      "content": "NOTEBOOK_FILE"
+                    },
+                    {
+                      "content": "TABLE"
+                    },
+                    {
+                      "content": "VIEW"
+                    },
+                    {
+                      "content": "VOLUME"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the asset.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "etag",
+                "description": "Revision etag to fetch. If not provided, the latest revision will be returned.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "List revisions for an asset",
+            "summary": "List asset revisions.",
+            "path": "/api/2.0/clean-rooms/{clean_room_name}/assets/{asset_type}/{name}/revisions",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ListCleanRoomAssetRevisionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "clean_room_name",
+                  "description": "Name of the clean room.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "asset_type",
+                  "description": "Asset type. Only NOTEBOOK_FILE is supported.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "pascal_name": "CleanRoomAssetAssetType",
+                    "enum": [
+                      {
+                        "content": "FOREIGN_TABLE"
+                      },
+                      {
+                        "content": "JAR_ANALYSIS"
+                      },
+                      {
+                        "content": "NOTEBOOK_FILE"
+                      },
+                      {
+                        "content": "TABLE"
+                      },
+                      {
+                        "content": "VIEW"
+                      },
+                      {
+                        "content": "VOLUME"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "name",
+                  "description": "Name of the asset.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "clean_room_name",
+                  "description": "Name of the clean room.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "asset_type",
+                  "description": "Asset type. Only NOTEBOOK_FILE is supported.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "pascal_name": "CleanRoomAssetAssetType",
+                    "enum": [
+                      {
+                        "content": "FOREIGN_TABLE"
+                      },
+                      {
+                        "content": "JAR_ANALYSIS"
+                      },
+                      {
+                        "content": "NOTEBOOK_FILE"
+                      },
+                      {
+                        "content": "TABLE"
+                      },
+                      {
+                        "content": "VIEW"
+                      },
+                      {
+                        "content": "VOLUME"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "name",
+                  "description": "Name of the asset.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListCleanRoomAssetRevisionsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "asset_type",
+                "description": "Asset type. Only NOTEBOOK_FILE is supported.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAssetAssetType",
+                  "enum": [
+                    {
+                      "content": "FOREIGN_TABLE"
+                    },
+                    {
+                      "content": "JAR_ANALYSIS"
+                    },
+                    {
+                      "content": "NOTEBOOK_FILE"
+                    },
+                    {
+                      "content": "TABLE"
+                    },
+                    {
+                      "content": "VIEW"
+                    },
+                    {
+                      "content": "VOLUME"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "clean_room_name",
+                "description": "Name of the clean room.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the asset.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "Maximum number of asset revisions to return. Defaults to 10.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque pagination token to go to next page based on the previous query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "clean_room_name",
+                "description": "Name of the clean room.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "asset_type",
+                "description": "Asset type. Only NOTEBOOK_FILE is supported.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAssetAssetType",
+                  "enum": [
+                    {
+                      "content": "FOREIGN_TABLE"
+                    },
+                    {
+                      "content": "JAR_ANALYSIS"
+                    },
+                    {
+                      "content": "NOTEBOOK_FILE"
+                    },
+                    {
+                      "content": "TABLE"
+                    },
+                    {
+                      "content": "VIEW"
+                    },
+                    {
+                      "content": "VOLUME"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the asset.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Opaque pagination token to go to next page based on the previous query.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          }
+        ]
+      },
+      {
+        "id": "cleanrooms.CleanRoomAssets",
+        "name": "CleanRoomAssets",
+        "description": "Clean room assets are data and code objects — Tables, volumes, and notebooks that are shared\nwith the clean room.",
+        "package": {
+          "name": "cleanrooms"
+        },
+        "docs_group": "cleanrooms",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListCleanRoomAssetsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Create a clean room asset —share an asset like a notebook or table into the clean room.\nFor each UC asset that is added through this method, the clean room owner must also have\nenough privilege on the asset to consume it.\nThe privilege must be maintained indefinitely for the clean room to be able to access the asset.\nTypically, you should use a group as the clean room owner.",
+            "summary": "Create an asset.",
+            "path": "/api/2.0/clean-rooms/{clean_room_name}/assets",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateCleanRoomAssetRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "clean_room_name",
+                  "description": "The name of the clean room this asset belongs to.\nThis field is required for create operations and populated by the server for responses.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "asset",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CleanRoomAsset",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "clean_room_name",
+                  "description": "The name of the clean room this asset belongs to.\nThis field is required for create operations and populated by the server for responses.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "asset",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CleanRoomAsset",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "asset",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "CleanRoomAsset",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "name",
+                    "description": "A fully qualified name that uniquely identifies the asset within the clean room.\nThis is also the name displayed in the clean room UI.\n\nFor UC securable assets (tables, volumes, etc.), the format is *shared_catalog*.*shared_schema*.*asset_name*\n\nFor notebooks, the name is the notebook file name.\nFor jar analyses, the name is the jar analysis name.\nFor Genie spaces, the name is derived from the clean room; the caller does not choose it.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "asset_type",
+                    "description": "The type of the asset.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "CleanRoomAssetAssetType",
+                      "enum": [
+                        {
+                          "content": "FOREIGN_TABLE"
+                        },
+                        {
+                          "content": "JAR_ANALYSIS"
+                        },
+                        {
+                          "content": "NOTEBOOK_FILE"
+                        },
+                        {
+                          "content": "TABLE"
+                        },
+                        {
+                          "content": "VIEW"
+                        },
+                        {
+                          "content": "VOLUME"
+                        }
+                      ]
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "name",
+                    "description": "A fully qualified name that uniquely identifies the asset within the clean room.\nThis is also the name displayed in the clean room UI.\n\nFor UC securable assets (tables, volumes, etc.), the format is *shared_catalog*.*shared_schema*.*asset_name*\n\nFor notebooks, the name is the notebook file name.\nFor jar analyses, the name is the jar analysis name.\nFor Genie spaces, the name is derived from the clean room; the caller does not choose it.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "asset_type",
+                    "description": "The type of the asset.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "CleanRoomAssetAssetType",
+                      "enum": [
+                        {
+                          "content": "FOREIGN_TABLE"
+                        },
+                        {
+                          "content": "JAR_ANALYSIS"
+                        },
+                        {
+                          "content": "NOTEBOOK_FILE"
+                        },
+                        {
+                          "content": "TABLE"
+                        },
+                        {
+                          "content": "VIEW"
+                        },
+                        {
+                          "content": "VOLUME"
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "CleanRoomAsset",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "A fully qualified name that uniquely identifies the asset within the clean room.\nThis is also the name displayed in the clean room UI.\n\nFor UC securable assets (tables, volumes, etc.), the format is *shared_catalog*.*shared_schema*.*asset_name*\n\nFor notebooks, the name is the notebook file name.\nFor jar analyses, the name is the jar analysis name.\nFor Genie spaces, the name is derived from the clean room; the caller does not choose it.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "asset_type",
+                  "description": "The type of the asset.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CleanRoomAssetAssetType",
+                    "enum": [
+                      {
+                        "content": "FOREIGN_TABLE"
+                      },
+                      {
+                        "content": "JAR_ANALYSIS"
+                      },
+                      {
+                        "content": "NOTEBOOK_FILE"
+                      },
+                      {
+                        "content": "TABLE"
+                      },
+                      {
+                        "content": "VIEW"
+                      },
+                      {
+                        "content": "VOLUME"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "A fully qualified name that uniquely identifies the asset within the clean room.\nThis is also the name displayed in the clean room UI.\n\nFor UC securable assets (tables, volumes, etc.), the format is *shared_catalog*.*shared_schema*.*asset_name*\n\nFor notebooks, the name is the notebook file name.\nFor jar analyses, the name is the jar analysis name.\nFor Genie spaces, the name is derived from the clean room; the caller does not choose it.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "asset_type",
+                  "description": "The type of the asset.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CleanRoomAssetAssetType",
+                    "enum": [
+                      {
+                        "content": "FOREIGN_TABLE"
+                      },
+                      {
+                        "content": "JAR_ANALYSIS"
+                      },
+                      {
+                        "content": "NOTEBOOK_FILE"
+                      },
+                      {
+                        "content": "TABLE"
+                      },
+                      {
+                        "content": "VIEW"
+                      },
+                      {
+                        "content": "VOLUME"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "asset",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAsset",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "name",
+                      "description": "A fully qualified name that uniquely identifies the asset within the clean room.\nThis is also the name displayed in the clean room UI.\n\nFor UC securable assets (tables, volumes, etc.), the format is *shared_catalog*.*shared_schema*.*asset_name*\n\nFor notebooks, the name is the notebook file name.\nFor jar analyses, the name is the jar analysis name.\nFor Genie spaces, the name is derived from the clean room; the caller does not choose it.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "asset_type",
+                      "description": "The type of the asset.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "CleanRoomAssetAssetType",
+                        "enum": [
+                          {
+                            "content": "FOREIGN_TABLE"
+                          },
+                          {
+                            "content": "JAR_ANALYSIS"
+                          },
+                          {
+                            "content": "NOTEBOOK_FILE"
+                          },
+                          {
+                            "content": "TABLE"
+                          },
+                          {
+                            "content": "VIEW"
+                          },
+                          {
+                            "content": "VOLUME"
+                          }
+                        ]
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "name",
+                      "description": "A fully qualified name that uniquely identifies the asset within the clean room.\nThis is also the name displayed in the clean room UI.\n\nFor UC securable assets (tables, volumes, etc.), the format is *shared_catalog*.*shared_schema*.*asset_name*\n\nFor notebooks, the name is the notebook file name.\nFor jar analyses, the name is the jar analysis name.\nFor Genie spaces, the name is derived from the clean room; the caller does not choose it.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "asset_type",
+                      "description": "The type of the asset.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "CleanRoomAssetAssetType",
+                        "enum": [
+                          {
+                            "content": "FOREIGN_TABLE"
+                          },
+                          {
+                            "content": "JAR_ANALYSIS"
+                          },
+                          {
+                            "content": "NOTEBOOK_FILE"
+                          },
+                          {
+                            "content": "TABLE"
+                          },
+                          {
+                            "content": "VIEW"
+                          },
+                          {
+                            "content": "VOLUME"
+                          }
+                        ]
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "clean_room_name",
+                "description": "The name of the clean room this asset belongs to.\nThis field is required for create operations and populated by the server for responses.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "added_at",
+                "description": "When the asset is added to the clean room, in epoch milliseconds.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "asset_type",
+                "description": "The type of the asset.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAssetAssetType",
+                  "enum": [
+                    {
+                      "content": "FOREIGN_TABLE"
+                    },
+                    {
+                      "content": "JAR_ANALYSIS"
+                    },
+                    {
+                      "content": "NOTEBOOK_FILE"
+                    },
+                    {
+                      "content": "TABLE"
+                    },
+                    {
+                      "content": "VIEW"
+                    },
+                    {
+                      "content": "VOLUME"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "clean_room_name",
+                "description": "The name of the clean room this asset belongs to.\nThis field is required for create operations and populated by the server for responses.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "foreign_table",
+                "description": "Foreign table details available to all collaborators of the clean room.\nPresent if and only if **asset_type** is **FOREIGN_TABLE**",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAssetForeignTable",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "foreign_table_local_details",
+                "description": "Local details for a foreign that are only available to its owner.\nPresent if and only if **asset_type** is **FOREIGN_TABLE**",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAssetForeignTableLocalDetails",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "jar_analysis",
+                "description": "Jar analysis details available to all collaborators of the clean room.\nPresent if and only if **asset_type** is **JAR_ANALYSIS**",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAssetJarAnalysis",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "A fully qualified name that uniquely identifies the asset within the clean room.\nThis is also the name displayed in the clean room UI.\n\nFor UC securable assets (tables, volumes, etc.), the format is *shared_catalog*.*shared_schema*.*asset_name*\n\nFor notebooks, the name is the notebook file name.\nFor jar analyses, the name is the jar analysis name.\nFor Genie spaces, the name is derived from the clean room; the caller does not choose it.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "notebook",
+                "description": "Notebook details available to all collaborators of the clean room.\nPresent if and only if **asset_type** is **NOTEBOOK_FILE**",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAssetNotebook",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "owner_collaborator_alias",
+                "description": "The alias of the collaborator who owns this asset",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "status",
+                "description": "Status of the asset",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAssetStatusEnum",
+                  "enum": [
+                    {
+                      "content": "ACTIVE"
+                    },
+                    {
+                      "content": "PENDING"
+                    },
+                    {
+                      "content": "PERMISSION_DENIED"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "table",
+                "description": "Table details available to all collaborators of the clean room.\nPresent if and only if **asset_type** is **TABLE** or **STREAMING_TABLE**",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAssetTable",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "table_local_details",
+                "description": "Local details for a table that are only available to its owner.\nPresent if and only if **asset_type** is **TABLE** or **STREAMING_TABLE**",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAssetTableLocalDetails",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "view",
+                "description": "View details available to all collaborators of the clean room.\nPresent if and only if **asset_type** is **VIEW** or **METRIC_VIEW**",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAssetView",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "view_local_details",
+                "description": "Local details for a view that are only available to its owner.\nPresent if and only if **asset_type** is **VIEW** or **METRIC_VIEW**",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAssetViewLocalDetails",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "volume_local_details",
+                "description": "Local details for a volume that are only available to its owner.\nPresent if and only if **asset_type** is **VOLUME**",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAssetVolumeLocalDetails",
+                  "is_object": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "clean_room_name",
+                "description": "The name of the clean room this asset belongs to.\nThis field is required for create operations and populated by the server for responses.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "A fully qualified name that uniquely identifies the asset within the clean room.\nThis is also the name displayed in the clean room UI.\n\nFor UC securable assets (tables, volumes, etc.), the format is *shared_catalog*.*shared_schema*.*asset_name*\n\nFor notebooks, the name is the notebook file name.\nFor jar analyses, the name is the jar analysis name.\nFor Genie spaces, the name is derived from the clean room; the caller does not choose it.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "asset_type",
+                "description": "The type of the asset.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAssetAssetType",
+                  "enum": [
+                    {
+                      "content": "FOREIGN_TABLE"
+                    },
+                    {
+                      "content": "JAR_ANALYSIS"
+                    },
+                    {
+                      "content": "NOTEBOOK_FILE"
+                    },
+                    {
+                      "content": "TABLE"
+                    },
+                    {
+                      "content": "VIEW"
+                    },
+                    {
+                      "content": "VOLUME"
+                    }
+                  ]
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateCleanRoomAssetReview",
+            "description": "Submit an asset review",
+            "summary": "Create a review (e.g. approval) for an asset.",
+            "path": "/api/2.0/clean-rooms/{clean_room_name}/assets/{asset_type}/{name}/reviews",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "CreateCleanRoomAssetReviewRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "clean_room_name",
+                  "description": "Name of the clean room",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "asset_type",
+                  "description": "Asset type. Can either be NOTEBOOK_FILE or JAR_ANALYSIS.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "pascal_name": "CleanRoomAssetAssetType",
+                    "enum": [
+                      {
+                        "content": "FOREIGN_TABLE"
+                      },
+                      {
+                        "content": "JAR_ANALYSIS"
+                      },
+                      {
+                        "content": "NOTEBOOK_FILE"
+                      },
+                      {
+                        "content": "TABLE"
+                      },
+                      {
+                        "content": "VIEW"
+                      },
+                      {
+                        "content": "VOLUME"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "name",
+                  "description": "Name of the asset",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "clean_room_name",
+                  "description": "Name of the clean room",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "asset_type",
+                  "description": "Asset type. Can either be NOTEBOOK_FILE or JAR_ANALYSIS.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "pascal_name": "CleanRoomAssetAssetType",
+                    "enum": [
+                      {
+                        "content": "FOREIGN_TABLE"
+                      },
+                      {
+                        "content": "JAR_ANALYSIS"
+                      },
+                      {
+                        "content": "NOTEBOOK_FILE"
+                      },
+                      {
+                        "content": "TABLE"
+                      },
+                      {
+                        "content": "VIEW"
+                      },
+                      {
+                        "content": "VOLUME"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "name",
+                  "description": "Name of the asset",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CreateCleanRoomAssetReviewResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "asset_type",
+                "description": "Asset type. Can either be NOTEBOOK_FILE or JAR_ANALYSIS.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAssetAssetType",
+                  "enum": [
+                    {
+                      "content": "FOREIGN_TABLE"
+                    },
+                    {
+                      "content": "JAR_ANALYSIS"
+                    },
+                    {
+                      "content": "NOTEBOOK_FILE"
+                    },
+                    {
+                      "content": "TABLE"
+                    },
+                    {
+                      "content": "VIEW"
+                    },
+                    {
+                      "content": "VOLUME"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "clean_room_name",
+                "description": "Name of the clean room",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "jar_analysis_review",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "JarAnalysisVersionReview",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the asset",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "notebook_review",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "NotebookVersionReview",
+                  "is_object": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "clean_room_name",
+                "description": "Name of the clean room",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "asset_type",
+                "description": "Asset type. Can either be NOTEBOOK_FILE or JAR_ANALYSIS.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAssetAssetType",
+                  "enum": [
+                    {
+                      "content": "FOREIGN_TABLE"
+                    },
+                    {
+                      "content": "JAR_ANALYSIS"
+                    },
+                    {
+                      "content": "NOTEBOOK_FILE"
+                    },
+                    {
+                      "content": "TABLE"
+                    },
+                    {
+                      "content": "VIEW"
+                    },
+                    {
+                      "content": "VOLUME"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the asset",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Delete a clean room asset - unshare/remove the asset from the clean room",
+            "summary": "Delete an asset.",
+            "path": "/api/2.0/clean-rooms/{clean_room_name}/assets/{asset_type}/{name}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteCleanRoomAssetRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "clean_room_name",
+                  "description": "Name of the clean room.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "asset_type",
+                  "description": "The type of the asset.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "pascal_name": "CleanRoomAssetAssetType",
+                    "enum": [
+                      {
+                        "content": "FOREIGN_TABLE"
+                      },
+                      {
+                        "content": "JAR_ANALYSIS"
+                      },
+                      {
+                        "content": "NOTEBOOK_FILE"
+                      },
+                      {
+                        "content": "TABLE"
+                      },
+                      {
+                        "content": "VIEW"
+                      },
+                      {
+                        "content": "VOLUME"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "name",
+                  "description": "The fully qualified name of the asset, it is same as the name field in CleanRoomAsset.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "clean_room_name",
+                  "description": "Name of the clean room.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "asset_type",
+                  "description": "The type of the asset.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "pascal_name": "CleanRoomAssetAssetType",
+                    "enum": [
+                      {
+                        "content": "FOREIGN_TABLE"
+                      },
+                      {
+                        "content": "JAR_ANALYSIS"
+                      },
+                      {
+                        "content": "NOTEBOOK_FILE"
+                      },
+                      {
+                        "content": "TABLE"
+                      },
+                      {
+                        "content": "VIEW"
+                      },
+                      {
+                        "content": "VOLUME"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "name",
+                  "description": "The fully qualified name of the asset, it is same as the name field in CleanRoomAsset.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteCleanRoomAssetResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "asset_type",
+                "description": "The type of the asset.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAssetAssetType",
+                  "enum": [
+                    {
+                      "content": "FOREIGN_TABLE"
+                    },
+                    {
+                      "content": "JAR_ANALYSIS"
+                    },
+                    {
+                      "content": "NOTEBOOK_FILE"
+                    },
+                    {
+                      "content": "TABLE"
+                    },
+                    {
+                      "content": "VIEW"
+                    },
+                    {
+                      "content": "VOLUME"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "clean_room_name",
+                "description": "Name of the clean room.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The fully qualified name of the asset, it is same as the name field in CleanRoomAsset.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "clean_room_name",
+                "description": "Name of the clean room.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "asset_type",
+                "description": "The type of the asset.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAssetAssetType",
+                  "enum": [
+                    {
+                      "content": "FOREIGN_TABLE"
+                    },
+                    {
+                      "content": "JAR_ANALYSIS"
+                    },
+                    {
+                      "content": "NOTEBOOK_FILE"
+                    },
+                    {
+                      "content": "TABLE"
+                    },
+                    {
+                      "content": "VIEW"
+                    },
+                    {
+                      "content": "VOLUME"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "name",
+                "description": "The fully qualified name of the asset, it is same as the name field in CleanRoomAsset.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Get the details of a clean room asset by its type and full name.",
+            "summary": "Get an asset.",
+            "path": "/api/2.0/clean-rooms/{clean_room_name}/assets/{asset_type}/{name}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetCleanRoomAssetRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "clean_room_name",
+                  "description": "Name of the clean room.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "asset_type",
+                  "description": "The type of the asset.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "pascal_name": "CleanRoomAssetAssetType",
+                    "enum": [
+                      {
+                        "content": "FOREIGN_TABLE"
+                      },
+                      {
+                        "content": "JAR_ANALYSIS"
+                      },
+                      {
+                        "content": "NOTEBOOK_FILE"
+                      },
+                      {
+                        "content": "TABLE"
+                      },
+                      {
+                        "content": "VIEW"
+                      },
+                      {
+                        "content": "VOLUME"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "name",
+                  "description": "The fully qualified name of the asset, it is same as the name field in CleanRoomAsset.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "clean_room_name",
+                  "description": "Name of the clean room.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "asset_type",
+                  "description": "The type of the asset.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "pascal_name": "CleanRoomAssetAssetType",
+                    "enum": [
+                      {
+                        "content": "FOREIGN_TABLE"
+                      },
+                      {
+                        "content": "JAR_ANALYSIS"
+                      },
+                      {
+                        "content": "NOTEBOOK_FILE"
+                      },
+                      {
+                        "content": "TABLE"
+                      },
+                      {
+                        "content": "VIEW"
+                      },
+                      {
+                        "content": "VOLUME"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "name",
+                  "description": "The fully qualified name of the asset, it is same as the name field in CleanRoomAsset.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CleanRoomAsset",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "A fully qualified name that uniquely identifies the asset within the clean room.\nThis is also the name displayed in the clean room UI.\n\nFor UC securable assets (tables, volumes, etc.), the format is *shared_catalog*.*shared_schema*.*asset_name*\n\nFor notebooks, the name is the notebook file name.\nFor jar analyses, the name is the jar analysis name.\nFor Genie spaces, the name is derived from the clean room; the caller does not choose it.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "asset_type",
+                  "description": "The type of the asset.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CleanRoomAssetAssetType",
+                    "enum": [
+                      {
+                        "content": "FOREIGN_TABLE"
+                      },
+                      {
+                        "content": "JAR_ANALYSIS"
+                      },
+                      {
+                        "content": "NOTEBOOK_FILE"
+                      },
+                      {
+                        "content": "TABLE"
+                      },
+                      {
+                        "content": "VIEW"
+                      },
+                      {
+                        "content": "VOLUME"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "A fully qualified name that uniquely identifies the asset within the clean room.\nThis is also the name displayed in the clean room UI.\n\nFor UC securable assets (tables, volumes, etc.), the format is *shared_catalog*.*shared_schema*.*asset_name*\n\nFor notebooks, the name is the notebook file name.\nFor jar analyses, the name is the jar analysis name.\nFor Genie spaces, the name is derived from the clean room; the caller does not choose it.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "asset_type",
+                  "description": "The type of the asset.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CleanRoomAssetAssetType",
+                    "enum": [
+                      {
+                        "content": "FOREIGN_TABLE"
+                      },
+                      {
+                        "content": "JAR_ANALYSIS"
+                      },
+                      {
+                        "content": "NOTEBOOK_FILE"
+                      },
+                      {
+                        "content": "TABLE"
+                      },
+                      {
+                        "content": "VIEW"
+                      },
+                      {
+                        "content": "VOLUME"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "asset_type",
+                "description": "The type of the asset.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAssetAssetType",
+                  "enum": [
+                    {
+                      "content": "FOREIGN_TABLE"
+                    },
+                    {
+                      "content": "JAR_ANALYSIS"
+                    },
+                    {
+                      "content": "NOTEBOOK_FILE"
+                    },
+                    {
+                      "content": "TABLE"
+                    },
+                    {
+                      "content": "VIEW"
+                    },
+                    {
+                      "content": "VOLUME"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "clean_room_name",
+                "description": "Name of the clean room.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The fully qualified name of the asset, it is same as the name field in CleanRoomAsset.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "clean_room_name",
+                "description": "Name of the clean room.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "asset_type",
+                "description": "The type of the asset.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAssetAssetType",
+                  "enum": [
+                    {
+                      "content": "FOREIGN_TABLE"
+                    },
+                    {
+                      "content": "JAR_ANALYSIS"
+                    },
+                    {
+                      "content": "NOTEBOOK_FILE"
+                    },
+                    {
+                      "content": "TABLE"
+                    },
+                    {
+                      "content": "VIEW"
+                    },
+                    {
+                      "content": "VOLUME"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "name",
+                "description": "The fully qualified name of the asset, it is same as the name field in CleanRoomAsset.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "List assets.",
+            "summary": "List assets.",
+            "path": "/api/2.0/clean-rooms/{clean_room_name}/assets",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListCleanRoomAssetsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "clean_room_name",
+                  "description": "Name of the clean room.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "clean_room_name",
+                  "description": "Name of the clean room.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListCleanRoomAssetsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "clean_room_name",
+                "description": "Name of the clean room.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque pagination token to go to next page based on previous query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "clean_room_name",
+                "description": "Name of the clean room.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Opaque pagination token to go to next page based on previous query.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "Update",
+            "description": "Update a clean room asset. For example, updating the content of a notebook;\nchanging the shared partitions of a table; etc.",
+            "summary": "Update an asset.",
+            "path": "/api/2.0/clean-rooms/{clean_room_name}/assets/{asset_type}/{name}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateCleanRoomAssetRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "clean_room_name",
+                  "description": "Name of the clean room.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "asset_type",
+                  "description": "The type of the asset.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "pascal_name": "CleanRoomAssetAssetType",
+                    "enum": [
+                      {
+                        "content": "FOREIGN_TABLE"
+                      },
+                      {
+                        "content": "JAR_ANALYSIS"
+                      },
+                      {
+                        "content": "NOTEBOOK_FILE"
+                      },
+                      {
+                        "content": "TABLE"
+                      },
+                      {
+                        "content": "VIEW"
+                      },
+                      {
+                        "content": "VOLUME"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "name",
+                  "description": "A fully qualified name that uniquely identifies the asset within the clean room.\nThis is also the name displayed in the clean room UI.\n\nFor UC securable assets (tables, volumes, etc.), the format is *shared_catalog*.*shared_schema*.*asset_name*\n\nFor notebooks, the name is the notebook file name.\nFor jar analyses, the name is the jar analysis name.\nFor Genie spaces, the name is derived from the clean room; the caller does not choose it.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "asset",
+                  "description": "The asset to update.\nThe asset's `name` and `asset_type` fields are used to identify the asset to update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CleanRoomAsset",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "clean_room_name",
+                  "description": "Name of the clean room.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "asset_type",
+                  "description": "The type of the asset.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "pascal_name": "CleanRoomAssetAssetType",
+                    "enum": [
+                      {
+                        "content": "FOREIGN_TABLE"
+                      },
+                      {
+                        "content": "JAR_ANALYSIS"
+                      },
+                      {
+                        "content": "NOTEBOOK_FILE"
+                      },
+                      {
+                        "content": "TABLE"
+                      },
+                      {
+                        "content": "VIEW"
+                      },
+                      {
+                        "content": "VOLUME"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "name",
+                  "description": "A fully qualified name that uniquely identifies the asset within the clean room.\nThis is also the name displayed in the clean room UI.\n\nFor UC securable assets (tables, volumes, etc.), the format is *shared_catalog*.*shared_schema*.*asset_name*\n\nFor notebooks, the name is the notebook file name.\nFor jar analyses, the name is the jar analysis name.\nFor Genie spaces, the name is derived from the clean room; the caller does not choose it.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "asset",
+                  "description": "The asset to update.\nThe asset's `name` and `asset_type` fields are used to identify the asset to update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CleanRoomAsset",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "asset",
+              "description": "The asset to update.\nThe asset's `name` and `asset_type` fields are used to identify the asset to update.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "CleanRoomAsset",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "name",
+                    "description": "A fully qualified name that uniquely identifies the asset within the clean room.\nThis is also the name displayed in the clean room UI.\n\nFor UC securable assets (tables, volumes, etc.), the format is *shared_catalog*.*shared_schema*.*asset_name*\n\nFor notebooks, the name is the notebook file name.\nFor jar analyses, the name is the jar analysis name.\nFor Genie spaces, the name is derived from the clean room; the caller does not choose it.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "asset_type",
+                    "description": "The type of the asset.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "CleanRoomAssetAssetType",
+                      "enum": [
+                        {
+                          "content": "FOREIGN_TABLE"
+                        },
+                        {
+                          "content": "JAR_ANALYSIS"
+                        },
+                        {
+                          "content": "NOTEBOOK_FILE"
+                        },
+                        {
+                          "content": "TABLE"
+                        },
+                        {
+                          "content": "VIEW"
+                        },
+                        {
+                          "content": "VOLUME"
+                        }
+                      ]
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "name",
+                    "description": "A fully qualified name that uniquely identifies the asset within the clean room.\nThis is also the name displayed in the clean room UI.\n\nFor UC securable assets (tables, volumes, etc.), the format is *shared_catalog*.*shared_schema*.*asset_name*\n\nFor notebooks, the name is the notebook file name.\nFor jar analyses, the name is the jar analysis name.\nFor Genie spaces, the name is derived from the clean room; the caller does not choose it.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "asset_type",
+                    "description": "The type of the asset.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "CleanRoomAssetAssetType",
+                      "enum": [
+                        {
+                          "content": "FOREIGN_TABLE"
+                        },
+                        {
+                          "content": "JAR_ANALYSIS"
+                        },
+                        {
+                          "content": "NOTEBOOK_FILE"
+                        },
+                        {
+                          "content": "TABLE"
+                        },
+                        {
+                          "content": "VIEW"
+                        },
+                        {
+                          "content": "VOLUME"
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "CleanRoomAsset",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "A fully qualified name that uniquely identifies the asset within the clean room.\nThis is also the name displayed in the clean room UI.\n\nFor UC securable assets (tables, volumes, etc.), the format is *shared_catalog*.*shared_schema*.*asset_name*\n\nFor notebooks, the name is the notebook file name.\nFor jar analyses, the name is the jar analysis name.\nFor Genie spaces, the name is derived from the clean room; the caller does not choose it.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "asset_type",
+                  "description": "The type of the asset.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CleanRoomAssetAssetType",
+                    "enum": [
+                      {
+                        "content": "FOREIGN_TABLE"
+                      },
+                      {
+                        "content": "JAR_ANALYSIS"
+                      },
+                      {
+                        "content": "NOTEBOOK_FILE"
+                      },
+                      {
+                        "content": "TABLE"
+                      },
+                      {
+                        "content": "VIEW"
+                      },
+                      {
+                        "content": "VOLUME"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "A fully qualified name that uniquely identifies the asset within the clean room.\nThis is also the name displayed in the clean room UI.\n\nFor UC securable assets (tables, volumes, etc.), the format is *shared_catalog*.*shared_schema*.*asset_name*\n\nFor notebooks, the name is the notebook file name.\nFor jar analyses, the name is the jar analysis name.\nFor Genie spaces, the name is derived from the clean room; the caller does not choose it.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "asset_type",
+                  "description": "The type of the asset.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CleanRoomAssetAssetType",
+                    "enum": [
+                      {
+                        "content": "FOREIGN_TABLE"
+                      },
+                      {
+                        "content": "JAR_ANALYSIS"
+                      },
+                      {
+                        "content": "NOTEBOOK_FILE"
+                      },
+                      {
+                        "content": "TABLE"
+                      },
+                      {
+                        "content": "VIEW"
+                      },
+                      {
+                        "content": "VOLUME"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "asset",
+                "description": "The asset to update.\nThe asset's `name` and `asset_type` fields are used to identify the asset to update.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAsset",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "name",
+                      "description": "A fully qualified name that uniquely identifies the asset within the clean room.\nThis is also the name displayed in the clean room UI.\n\nFor UC securable assets (tables, volumes, etc.), the format is *shared_catalog*.*shared_schema*.*asset_name*\n\nFor notebooks, the name is the notebook file name.\nFor jar analyses, the name is the jar analysis name.\nFor Genie spaces, the name is derived from the clean room; the caller does not choose it.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "asset_type",
+                      "description": "The type of the asset.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "CleanRoomAssetAssetType",
+                        "enum": [
+                          {
+                            "content": "FOREIGN_TABLE"
+                          },
+                          {
+                            "content": "JAR_ANALYSIS"
+                          },
+                          {
+                            "content": "NOTEBOOK_FILE"
+                          },
+                          {
+                            "content": "TABLE"
+                          },
+                          {
+                            "content": "VIEW"
+                          },
+                          {
+                            "content": "VOLUME"
+                          }
+                        ]
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "name",
+                      "description": "A fully qualified name that uniquely identifies the asset within the clean room.\nThis is also the name displayed in the clean room UI.\n\nFor UC securable assets (tables, volumes, etc.), the format is *shared_catalog*.*shared_schema*.*asset_name*\n\nFor notebooks, the name is the notebook file name.\nFor jar analyses, the name is the jar analysis name.\nFor Genie spaces, the name is derived from the clean room; the caller does not choose it.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "asset_type",
+                      "description": "The type of the asset.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "CleanRoomAssetAssetType",
+                        "enum": [
+                          {
+                            "content": "FOREIGN_TABLE"
+                          },
+                          {
+                            "content": "JAR_ANALYSIS"
+                          },
+                          {
+                            "content": "NOTEBOOK_FILE"
+                          },
+                          {
+                            "content": "TABLE"
+                          },
+                          {
+                            "content": "VIEW"
+                          },
+                          {
+                            "content": "VOLUME"
+                          }
+                        ]
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "asset_type",
+                "description": "The type of the asset.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAssetAssetType",
+                  "enum": [
+                    {
+                      "content": "FOREIGN_TABLE"
+                    },
+                    {
+                      "content": "JAR_ANALYSIS"
+                    },
+                    {
+                      "content": "NOTEBOOK_FILE"
+                    },
+                    {
+                      "content": "TABLE"
+                    },
+                    {
+                      "content": "VIEW"
+                    },
+                    {
+                      "content": "VOLUME"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "clean_room_name",
+                "description": "Name of the clean room.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "A fully qualified name that uniquely identifies the asset within the clean room.\nThis is also the name displayed in the clean room UI.\n\nFor UC securable assets (tables, volumes, etc.), the format is *shared_catalog*.*shared_schema*.*asset_name*\n\nFor notebooks, the name is the notebook file name.\nFor jar analyses, the name is the jar analysis name.\nFor Genie spaces, the name is derived from the clean room; the caller does not choose it.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "added_at",
+                "description": "When the asset is added to the clean room, in epoch milliseconds.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "asset_type",
+                "description": "The type of the asset.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAssetAssetType",
+                  "enum": [
+                    {
+                      "content": "FOREIGN_TABLE"
+                    },
+                    {
+                      "content": "JAR_ANALYSIS"
+                    },
+                    {
+                      "content": "NOTEBOOK_FILE"
+                    },
+                    {
+                      "content": "TABLE"
+                    },
+                    {
+                      "content": "VIEW"
+                    },
+                    {
+                      "content": "VOLUME"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "clean_room_name",
+                "description": "The name of the clean room this asset belongs to.\nThis field is required for create operations and populated by the server for responses.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "foreign_table",
+                "description": "Foreign table details available to all collaborators of the clean room.\nPresent if and only if **asset_type** is **FOREIGN_TABLE**",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAssetForeignTable",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "foreign_table_local_details",
+                "description": "Local details for a foreign that are only available to its owner.\nPresent if and only if **asset_type** is **FOREIGN_TABLE**",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAssetForeignTableLocalDetails",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "jar_analysis",
+                "description": "Jar analysis details available to all collaborators of the clean room.\nPresent if and only if **asset_type** is **JAR_ANALYSIS**",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAssetJarAnalysis",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "A fully qualified name that uniquely identifies the asset within the clean room.\nThis is also the name displayed in the clean room UI.\n\nFor UC securable assets (tables, volumes, etc.), the format is *shared_catalog*.*shared_schema*.*asset_name*\n\nFor notebooks, the name is the notebook file name.\nFor jar analyses, the name is the jar analysis name.\nFor Genie spaces, the name is derived from the clean room; the caller does not choose it.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "notebook",
+                "description": "Notebook details available to all collaborators of the clean room.\nPresent if and only if **asset_type** is **NOTEBOOK_FILE**",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAssetNotebook",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "owner_collaborator_alias",
+                "description": "The alias of the collaborator who owns this asset",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "status",
+                "description": "Status of the asset",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAssetStatusEnum",
+                  "enum": [
+                    {
+                      "content": "ACTIVE"
+                    },
+                    {
+                      "content": "PENDING"
+                    },
+                    {
+                      "content": "PERMISSION_DENIED"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "table",
+                "description": "Table details available to all collaborators of the clean room.\nPresent if and only if **asset_type** is **TABLE** or **STREAMING_TABLE**",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAssetTable",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "table_local_details",
+                "description": "Local details for a table that are only available to its owner.\nPresent if and only if **asset_type** is **TABLE** or **STREAMING_TABLE**",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAssetTableLocalDetails",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "view",
+                "description": "View details available to all collaborators of the clean room.\nPresent if and only if **asset_type** is **VIEW** or **METRIC_VIEW**",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAssetView",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "view_local_details",
+                "description": "Local details for a view that are only available to its owner.\nPresent if and only if **asset_type** is **VIEW** or **METRIC_VIEW**",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAssetViewLocalDetails",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "volume_local_details",
+                "description": "Local details for a volume that are only available to its owner.\nPresent if and only if **asset_type** is **VOLUME**",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAssetVolumeLocalDetails",
+                  "is_object": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "clean_room_name",
+                "description": "Name of the clean room.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "asset_type",
+                "description": "The type of the asset.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAssetAssetType",
+                  "enum": [
+                    {
+                      "content": "FOREIGN_TABLE"
+                    },
+                    {
+                      "content": "JAR_ANALYSIS"
+                    },
+                    {
+                      "content": "NOTEBOOK_FILE"
+                    },
+                    {
+                      "content": "TABLE"
+                    },
+                    {
+                      "content": "VIEW"
+                    },
+                    {
+                      "content": "VOLUME"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "name",
+                "description": "A fully qualified name that uniquely identifies the asset within the clean room.\nThis is also the name displayed in the clean room UI.\n\nFor UC securable assets (tables, volumes, etc.), the format is *shared_catalog*.*shared_schema*.*asset_name*\n\nFor notebooks, the name is the notebook file name.\nFor jar analyses, the name is the jar analysis name.\nFor Genie spaces, the name is derived from the clean room; the caller does not choose it.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "cleanrooms.CleanRoomAutoApprovalRules",
+        "name": "CleanRoomAutoApprovalRules",
+        "description": "Clean room auto-approval rules automatically create an approval on your behalf when an asset (e.g. notebook)\nmeeting specific criteria is shared in a clean room.",
+        "package": {
+          "name": "cleanrooms"
+        },
+        "docs_group": "cleanrooms",
+        "launch_stage": "PUBLIC_BETA",
+        "cli_launch_stage_label": "*Beta*",
+        "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+        "cli_launch_stage_display": "Beta",
+        "list": {
+          "request": {
+            "pascal_name": "ListCleanRoomAutoApprovalRulesRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Create an auto-approval rule",
+            "summary": "Create an auto-approval rule.",
+            "path": "/api/2.0/clean-rooms/{clean_room_name}/auto-approval-rules",
+            "can_use_json": true,
+            "must_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "CreateCleanRoomAutoApprovalRuleRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "clean_room_name",
+                  "description": "The name of the clean room this auto-approval rule belongs to.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "auto_approval_rule",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CleanRoomAutoApprovalRule",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "clean_room_name",
+                  "description": "The name of the clean room this auto-approval rule belongs to.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "auto_approval_rule",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CleanRoomAutoApprovalRule",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CleanRoomAutoApprovalRule",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "auto_approval_rule",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAutoApprovalRule",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "clean_room_name",
+                "description": "The name of the clean room this auto-approval rule belongs to.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "clean_room_name",
+                "description": "The name of the clean room this auto-approval rule belongs to.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Delete a auto-approval rule by rule ID",
+            "summary": "Delete an auto-approval rule.",
+            "path": "/api/2.0/clean-rooms/{clean_room_name}/auto-approval-rules/{rule_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "DeleteCleanRoomAutoApprovalRuleRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "clean_room_name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "rule_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "clean_room_name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "rule_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "clean_room_name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "rule_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "clean_room_name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "rule_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Get a auto-approval rule by rule ID",
+            "summary": "Get an auto-approval rule.",
+            "path": "/api/2.0/clean-rooms/{clean_room_name}/auto-approval-rules/{rule_id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetCleanRoomAutoApprovalRuleRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "clean_room_name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "rule_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "clean_room_name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "rule_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CleanRoomAutoApprovalRule",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "clean_room_name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "rule_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "clean_room_name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "rule_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "List all auto-approval rules for the caller",
+            "summary": "List auto-approval rules.",
+            "path": "/api/2.0/clean-rooms/{clean_room_name}/auto-approval-rules",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ListCleanRoomAutoApprovalRulesRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "clean_room_name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "clean_room_name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListCleanRoomAutoApprovalRulesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "clean_room_name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "Maximum number of auto-approval rules to return. Defaults to 100.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque pagination token to go to next page based on previous query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "clean_room_name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Opaque pagination token to go to next page based on previous query.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "Update",
+            "description": "Update a auto-approval rule by rule ID",
+            "summary": "Update an auto-approval rule.",
+            "path": "/api/2.0/clean-rooms/{clean_room_name}/auto-approval-rules/{rule_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "UpdateCleanRoomAutoApprovalRuleRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "clean_room_name",
+                  "description": "The name of the clean room this auto-approval rule belongs to.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "rule_id",
+                  "description": "A generated UUID identifying the rule.",
+                  "required": true,
+                  "is_path": true,
+                  "is_output_only": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "auto_approval_rule",
+                  "description": "The auto-approval rule to update. The rule_id field is used to identify the rule to update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CleanRoomAutoApprovalRule",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "clean_room_name",
+                  "description": "The name of the clean room this auto-approval rule belongs to.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "rule_id",
+                  "description": "A generated UUID identifying the rule.",
+                  "required": true,
+                  "is_path": true,
+                  "is_output_only": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "auto_approval_rule",
+                  "description": "The auto-approval rule to update. The rule_id field is used to identify the rule to update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CleanRoomAutoApprovalRule",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "auto_approval_rule",
+              "description": "The auto-approval rule to update. The rule_id field is used to identify the rule to update.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "CleanRoomAutoApprovalRule",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "CleanRoomAutoApprovalRule",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "auto_approval_rule",
+                "description": "The auto-approval rule to update. The rule_id field is used to identify the rule to update.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAutoApprovalRule",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "clean_room_name",
+                "description": "The name of the clean room this auto-approval rule belongs to.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "rule_id",
+                "description": "A generated UUID identifying the rule.",
+                "required": true,
+                "is_path": true,
+                "is_output_only": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "author_collaborator_alias",
+                "description": "Collaborator alias of the author covered by the rule.\nOnly one of `author_collaborator_alias` and `author_scope` can be set.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "author_scope",
+                "description": "Scope of authors covered by the rule.\nOnly one of `author_collaborator_alias` and `author_scope` can be set.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAutoApprovalRuleAuthorScope",
+                  "enum": [
+                    {
+                      "content": "ANY_AUTHOR"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "clean_room_name",
+                "description": "The name of the clean room this auto-approval rule belongs to.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "created_at",
+                "description": "Timestamp of when the rule was created, in epoch milliseconds.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "rule_id",
+                "description": "A generated UUID identifying the rule.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "rule_owner_collaborator_alias",
+                "description": "The owner of the rule to whom the rule applies.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "runner_collaborator_alias",
+                "description": "Collaborator alias of the runner covered by the rule.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "clean_room_name",
+                "description": "The name of the clean room this auto-approval rule belongs to.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "rule_id",
+                "description": "A generated UUID identifying the rule.",
+                "required": true,
+                "is_path": true,
+                "is_output_only": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "cleanrooms.CleanRoomTaskRuns",
+        "name": "CleanRoomTaskRuns",
+        "description": "Clean room task runs are the executions of notebooks and JAR analyses in a clean room.",
+        "package": {
+          "name": "cleanrooms"
+        },
+        "docs_group": "cleanrooms",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListCleanRoomNotebookTaskRunsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "List",
+            "description": "List all the historical notebook task runs in a clean room.",
+            "summary": "List notebook task runs.",
+            "path": "/api/2.0/clean-rooms/{clean_room_name}/runs",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListCleanRoomNotebookTaskRunsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "clean_room_name",
+                  "description": "Name of the clean room.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "clean_room_name",
+                  "description": "Name of the clean room.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListCleanRoomNotebookTaskRunsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "clean_room_name",
+                "description": "Name of the clean room.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "notebook_name",
+                "description": "Notebook name",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "The maximum number of task runs to return. Currently ignored - all runs will be returned.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque pagination token to go to next page based on previous query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "clean_room_name",
+                "description": "Name of the clean room.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Opaque pagination token to go to next page based on previous query.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListCleanRoomTaskRunsHandler",
+            "description": "List all the historical task runs in a clean room.",
+            "summary": "List task runs.",
+            "path": "/api/2.0/clean-rooms/{clean_room_name}/task-runs",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListCleanRoomTaskRunsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "clean_room_name",
+                  "description": "Name of the clean room.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "clean_room_name",
+                  "description": "Name of the clean room.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListCleanRoomTaskRunsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "clean_room_name",
+                "description": "Name of the clean room.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Executable name.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "The maximum number of task runs to return. Maximum value of 100.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque pagination token to go to next page based on previous query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "task_type",
+                "description": "Filter by the type of Clean Room task.",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "CleanRoomTaskType",
+                  "enum": [
+                    {
+                      "content": "JAR"
+                    },
+                    {
+                      "content": "NOTEBOOK"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "clean_room_name",
+                "description": "Name of the clean room.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Opaque pagination token to go to next page based on previous query.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          }
+        ]
+      },
+      {
+        "id": "cleanrooms.CleanRooms",
+        "name": "CleanRooms",
+        "description": "A clean room uses Delta Sharing and serverless compute to provide a secure\nand privacy-protecting environment where multiple parties can work together on\nsensitive enterprise data without direct access to each other's data.",
+        "package": {
+          "name": "cleanrooms"
+        },
+        "docs_group": "cleanrooms",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListCleanRoomsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Create a new clean room with the specified collaborators.\nThis method is asynchronous; the returned name field inside the clean_room field can be used to poll the clean room status,\nusing the [cleanrooms/get](https://docs.databricks.com/api/workspace/cleanrooms/get) method.\nWhen this method returns, the clean room will be in a PROVISIONING state, with only name, owner, comment, created_at and status populated.\nThe clean room will be usable once it enters an ACTIVE state.\n\nThe caller must be a metastore admin or have the **CREATE_CLEAN_ROOM** privilege on the\nmetastore.",
+            "summary": "Create a clean room.",
+            "path": "/api/2.0/clean-rooms",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateCleanRoomRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "clean_room",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CleanRoom",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "clean_room",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CleanRoom",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "clean_room",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "CleanRoom",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "CleanRoom",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "clean_room",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CleanRoom",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "access_restricted",
+                "description": "Whether clean room access is restricted due to [CSP](https://docs.databricks.com/en/security/privacy/security-profile.html)",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CleanRoomAccessRestricted",
+                  "enum": [
+                    {
+                      "content": "CSP_MISMATCH"
+                    },
+                    {
+                      "content": "NO_RESTRICTION"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "comment",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "created_at",
+                "description": "When the clean room was created, in epoch milliseconds.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "enable_shared_output",
+                "description": "Whether allow task to write to shared output schema.\nWhen enabled, clean room task runs triggered by the current collaborator\ncan write to the run-scoped shared output schema which is accessible by all collaborators.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "local_collaborator_alias",
+                "description": "The alias of the collaborator tied to the local clean room.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the clean room.\nIt should follow [UC securable naming requirements](https://docs.databricks.com/en/data-governance/unity-catalog/index.html#securable-object-naming-requirements).",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "output_catalog",
+                "description": "Output catalog of the clean room. It is an output only field. Output catalog is manipulated\nusing the separate CreateCleanRoomOutputCatalog API.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CleanRoomOutputCatalog",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "owner",
+                "description": "This is the Databricks username of the owner of the local clean room securable for permission management.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "remote_detailed_info",
+                "description": "Central clean room details. During creation, users need to specify\ncloud_vendor, region, and collaborators.global_metastore_id.\nThis field will not be filled in the ListCleanRooms call.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CleanRoomRemoteDetail",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "status",
+                "description": "Clean room status.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CleanRoomStatusEnum",
+                  "enum": [
+                    {
+                      "content": "ACTIVE"
+                    },
+                    {
+                      "content": "DELETED"
+                    },
+                    {
+                      "content": "FAILED"
+                    },
+                    {
+                      "content": "PROVISIONING"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "updated_at",
+                "description": "When the clean room was last updated, in epoch milliseconds.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "wait": {
+              "success": [
+                {
+                  "content": "ACTIVE"
+                }
+              ],
+              "timeout": 20,
+              "poll": {
+                "response": {
+                  "pascal_name": "CleanRoom"
+                }
+              },
+              "status_path": [
+                {
+                  "pascal_name": "Status"
+                }
+              ]
+            }
+          },
+          {
+            "name": "CreateOutputCatalog",
+            "description": "Create the output catalog of the clean room.",
+            "summary": "Create an output catalog.",
+            "path": "/api/2.0/clean-rooms/{clean_room_name}/output-catalogs",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateCleanRoomOutputCatalogRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "clean_room_name",
+                  "description": "Name of the clean room.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "output_catalog",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CleanRoomOutputCatalog",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "clean_room_name",
+                  "description": "Name of the clean room.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "output_catalog",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CleanRoomOutputCatalog",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "output_catalog",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "CleanRoomOutputCatalog",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "CreateCleanRoomOutputCatalogResponse",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "output_catalog",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CleanRoomOutputCatalog",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "output_catalog",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CleanRoomOutputCatalog",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "clean_room_name",
+                "description": "Name of the clean room.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "output_catalog",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CleanRoomOutputCatalog",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "catalog_name",
+                "description": "The name of the output catalog in UC.\nIt should follow [UC securable naming requirements](https://docs.databricks.com/en/data-governance/unity-catalog/index.html#securable-object-naming-requirements).\nThe field will always exist if status is CREATED.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "status",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CleanRoomOutputCatalogOutputCatalogStatus",
+                  "enum": [
+                    {
+                      "content": "CREATED"
+                    },
+                    {
+                      "content": "NOT_CREATED"
+                    },
+                    {
+                      "content": "NOT_ELIGIBLE"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "clean_room_name",
+                "description": "Name of the clean room.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Delete a clean room. After deletion, the clean room will be removed from the metastore.\nIf the other collaborators have not deleted the clean room, they will still have the clean room\nin their metastore, but it will be in a DELETED state\nand no operations other than deletion can be performed on it.",
+            "summary": "Delete a clean room.",
+            "path": "/api/2.0/clean-rooms/{name}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteCleanRoomRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the clean room.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the clean room.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Name of the clean room.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the clean room.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Get the details of a clean room given its name.",
+            "summary": "Get a clean room.",
+            "path": "/api/2.0/clean-rooms/{name}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetCleanRoomRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CleanRoom",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Get a list of all clean rooms of the metastore. Only clean rooms\nthe caller has access to are returned.",
+            "summary": "List clean rooms.",
+            "path": "/api/2.0/clean-rooms",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListCleanRoomsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListCleanRoomsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "Maximum number of clean rooms to return (i.e., the page length). Defaults to 100.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque pagination token to go to next page based on previous query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Opaque pagination token to go to next page based on previous query.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "Update",
+            "description": "Update a clean room.\nThe caller must be the owner of the clean room, have **MODIFY_CLEAN_ROOM** privilege, or\nbe metastore admin.\n\nWhen the caller is a metastore admin, only the __owner__ field can be updated.",
+            "summary": "Update a clean room.",
+            "path": "/api/2.0/clean-rooms/{name}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateCleanRoomRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the clean room.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the clean room.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CleanRoom",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "clean_room",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CleanRoom",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the clean room.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the clean room.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "compute.ClusterPolicies",
+        "name": "ClusterPolicies",
+        "description": "You can use cluster policies to control users' ability to configure clusters based on a set of rules.\nThese rules specify which attributes or attribute values can be used during cluster creation.\nCluster policies have ACLs that limit their use to specific users and groups.\n\nWith cluster policies, you can:\n- Auto-install cluster libraries on the next restart by listing them in the policy's \"libraries\" field (Public Preview).\n- Limit users to creating clusters with the prescribed settings.\n- Simplify the user interface, enabling more users to create clusters, by fixing and hiding some fields.\n- Manage costs by setting limits on attributes that impact the hourly rate.\n\nCluster policy permissions limit which policies a user can select in the Policy drop-down when the user creates a cluster:\n- A user who has unrestricted cluster create permission can select the Unrestricted policy and create fully-configurable clusters.\n- A user who has both unrestricted cluster create permission and access to cluster policies can select the Unrestricted policy and policies they have access to.\n- A user that has access to only cluster policies, can select the policies they have access to.\n\nIf no policies exist in the workspace, the Policy drop-down doesn't appear.\nOnly admin users can create, edit, and delete policies. Admin users also have access to all policies.",
+        "package": {
+          "name": "compute"
+        },
+        "docs_group": "compute",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "named_id_map": {
+            "pascal_name": "PolicyNameToPolicyIdMap"
+          },
+          "request": {
+            "pascal_name": "ListClusterPoliciesRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a new policy with prescribed settings.",
+            "summary": "Create a new policy.",
+            "path": "/api/2.0/policies/clusters/create",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreatePolicy",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "CreatePolicyResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "definition",
+                "description": "Policy definition document expressed in [Databricks Cluster Policy Definition Language](https://docs.databricks.com/administration-guide/clusters/policy-definition.html).",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "Additional human-readable description of the cluster policy.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "libraries",
+                "description": "A list of libraries to be installed on the next cluster restart that uses this policy. The maximum number of libraries is 500.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "LibraryList",
+                  "array_value": {
+                    "pascal_name": "Library",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "max_clusters_per_user",
+                "description": "Max number of clusters per user that can be active using this policy. If not present, there is no max limit.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Cluster Policy name requested by the user. This has to be unique. Length must be between 1 and 100\ncharacters.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "policy_family_definition_overrides",
+                "description": "Policy definition JSON document expressed in [Databricks Policy Definition Language](https://docs.databricks.com/administration-guide/clusters/policy-definition.html).\nThe JSON document must be passed as a string and cannot be embedded in the requests.\n\nYou can use this to customize the policy definition inherited from the policy family.\nPolicy rules specified here are merged into the inherited policy definition.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "policy_family_id",
+                "description": "ID of the policy family. The cluster policy's policy definition inherits the policy\nfamily's policy definition.\n\nCannot be used with `definition`. Use `policy_family_definition_overrides` instead to\ncustomize the policy definition.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Delete a policy for a cluster. Clusters governed by this policy can still run, but cannot be edited.",
+            "summary": "Delete a cluster policy.",
+            "path": "/api/2.0/policies/clusters/delete",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeletePolicy",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "policy_id",
+                  "description": "The ID of the policy to delete.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "policy_id",
+                  "description": "The ID of the policy to delete.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeletePolicyResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "policy_id",
+                "description": "The ID of the policy to delete.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "policy_id",
+                "description": "The ID of the policy to delete.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Edit",
+            "description": "Update an existing policy for cluster. This operation may make some clusters governed by the previous policy invalid.",
+            "summary": "Update a cluster policy.",
+            "path": "/api/2.0/policies/clusters/edit",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "EditPolicy",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "policy_id",
+                  "description": "The ID of the policy to update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "policy_id",
+                  "description": "The ID of the policy to update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "EditPolicyResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "definition",
+                "description": "Policy definition document expressed in [Databricks Cluster Policy Definition Language](https://docs.databricks.com/administration-guide/clusters/policy-definition.html).",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "Additional human-readable description of the cluster policy.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "libraries",
+                "description": "A list of libraries to be installed on the next cluster restart that uses this policy. The maximum number of libraries is 500.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "LibraryList",
+                  "array_value": {
+                    "pascal_name": "Library",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "max_clusters_per_user",
+                "description": "Max number of clusters per user that can be active using this policy. If not present, there is no max limit.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Cluster Policy name requested by the user. This has to be unique. Length must be between 1 and 100\ncharacters.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "policy_family_definition_overrides",
+                "description": "Policy definition JSON document expressed in [Databricks Policy Definition Language](https://docs.databricks.com/administration-guide/clusters/policy-definition.html).\nThe JSON document must be passed as a string and cannot be embedded in the requests.\n\nYou can use this to customize the policy definition inherited from the policy family.\nPolicy rules specified here are merged into the inherited policy definition.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "policy_family_id",
+                "description": "ID of the policy family. The cluster policy's policy definition inherits the policy\nfamily's policy definition.\n\nCannot be used with `definition`. Use `policy_family_definition_overrides` instead to\ncustomize the policy definition.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "policy_id",
+                "description": "The ID of the policy to update.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "policy_id",
+                "description": "The ID of the policy to update.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Get a cluster policy entity. Creation and editing is available to admins only.",
+            "summary": "Get a cluster policy.",
+            "path": "/api/2.0/policies/clusters/get",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetClusterPolicyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "policy_id",
+                  "description": "Canonical unique identifier for the Cluster Policy.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "policy_id",
+                  "description": "Canonical unique identifier for the Cluster Policy.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Policy",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "policy_id",
+                "description": "Canonical unique identifier for the Cluster Policy.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "policy_id",
+                "description": "Canonical unique identifier for the Cluster Policy.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetPermissionLevels",
+            "description": "Gets the permission levels that a user can have on an object.",
+            "summary": "Get cluster policy permission levels.",
+            "path": "/api/2.0/permissions/cluster-policies/{cluster_policy_id}/permissionLevels",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetClusterPolicyPermissionLevelsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "cluster_policy_id",
+                  "description": "The cluster policy for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "cluster_policy_id",
+                  "description": "The cluster policy for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetClusterPolicyPermissionLevelsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "cluster_policy_id",
+                "description": "The cluster policy for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "cluster_policy_id",
+                "description": "The cluster policy for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetPermissions",
+            "description": "Gets the permissions of a cluster policy. Cluster policies can inherit permissions from their root object.",
+            "summary": "Get cluster policy permissions.",
+            "path": "/api/2.0/permissions/cluster-policies/{cluster_policy_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetClusterPolicyPermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "cluster_policy_id",
+                  "description": "The cluster policy for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "cluster_policy_id",
+                  "description": "The cluster policy for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ClusterPolicyPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "cluster_policy_id",
+                "description": "The cluster policy for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "cluster_policy_id",
+                "description": "The cluster policy for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Returns a list of policies accessible by the requesting user.",
+            "summary": "List cluster policies.",
+            "path": "/api/2.0/policies/clusters/list",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListClusterPoliciesRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListPoliciesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "sort_column",
+                "description": "The cluster policy attribute to sort by.\n* `POLICY_CREATION_TIME` - Sort result list by policy creation time.\n* `POLICY_NAME` - Sort result list by policy name.",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "ListSortColumn",
+                  "enum": [
+                    {
+                      "content": "POLICY_CREATION_TIME"
+                    },
+                    {
+                      "content": "POLICY_NAME"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "sort_order",
+                "description": "The order in which the policies get listed.\n* `DESC` - Sort result list in descending order.\n* `ASC` - Sort result list in ascending order.",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "ListSortOrder",
+                  "enum": [
+                    {
+                      "content": "ASC"
+                    },
+                    {
+                      "content": "DESC"
+                    }
+                  ]
+                }
+              }
+            ],
+            "pagination": {}
+          },
+          {
+            "name": "SetPermissions",
+            "description": "Sets permissions on an object, replacing existing permissions if they exist. Deletes all direct permissions if none are specified. Objects can inherit permissions from their root object.",
+            "summary": "Set cluster policy permissions.",
+            "path": "/api/2.0/permissions/cluster-policies/{cluster_policy_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ClusterPolicyPermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "cluster_policy_id",
+                  "description": "The cluster policy for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "cluster_policy_id",
+                  "description": "The cluster policy for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ClusterPolicyPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "access_control_list",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ClusterPolicyAccessControlRequestList",
+                  "array_value": {
+                    "pascal_name": "ClusterPolicyAccessControlRequest",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "cluster_policy_id",
+                "description": "The cluster policy for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "cluster_policy_id",
+                "description": "The cluster policy for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdatePermissions",
+            "description": "Updates the permissions on a cluster policy. Cluster policies can inherit permissions from their root object.",
+            "summary": "Update cluster policy permissions.",
+            "path": "/api/2.0/permissions/cluster-policies/{cluster_policy_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ClusterPolicyPermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "cluster_policy_id",
+                  "description": "The cluster policy for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "cluster_policy_id",
+                  "description": "The cluster policy for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ClusterPolicyPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "access_control_list",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ClusterPolicyAccessControlRequestList",
+                  "array_value": {
+                    "pascal_name": "ClusterPolicyAccessControlRequest",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "cluster_policy_id",
+                "description": "The cluster policy for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "cluster_policy_id",
+                "description": "The cluster policy for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "compute.Clusters",
+        "name": "Clusters",
+        "description": "The Clusters API allows you to create, start, edit, list, terminate, and delete clusters.\n\nDatabricks maps cluster node instance types to compute units known as DBUs. See the instance\ntype pricing page for a list of the supported instance types and their corresponding DBUs.\n\nA Databricks cluster is a set of computation resources and configurations on which you run\ndata engineering, data science, and data analytics workloads, such as production\nETL pipelines, streaming analytics, ad-hoc analytics, and machine learning.\n\nYou run these workloads as a set of commands in a notebook or as an automated job.\nDatabricks makes a distinction between all-purpose clusters and job clusters. You use\nall-purpose clusters to analyze data collaboratively using interactive notebooks. You use\njob clusters to run fast and robust automated jobs.\n\nYou can create an all-purpose cluster using the UI, CLI, or REST API. You can manually\nterminate and restart an all-purpose cluster. Multiple users can share such clusters to do\ncollaborative interactive analysis.\n\nIMPORTANT: Databricks retains cluster configuration information for terminated clusters for 30 days. To keep an all-purpose cluster configuration even after it has been\nterminated for more than 30 days, an administrator can pin a cluster to the cluster list.",
+        "package": {
+          "name": "compute"
+        },
+        "docs_group": "compute",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "named_id_map": {
+            "pascal_name": "ClusterDetailsClusterNameToClusterIdMap"
+          },
+          "request": {
+            "pascal_name": "ListClustersRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "ChangeOwner",
+            "description": "Change the owner of the cluster. You must be an admin and the cluster must be terminated to perform this operation. The service principal application ID can be supplied as an argument to `owner_username`.",
+            "summary": "Change cluster owner.",
+            "path": "/api/2.1/clusters/change-owner",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ChangeClusterOwner",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "cluster_id",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "owner_username",
+                  "description": "New owner of the cluster_id after this RPC.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "cluster_id",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "owner_username",
+                  "description": "New owner of the cluster_id after this RPC.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ChangeClusterOwnerResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "cluster_id",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "owner_username",
+                "description": "New owner of the cluster_id after this RPC.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "cluster_id",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "owner_username",
+                "description": "New owner of the cluster_id after this RPC.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Create",
+            "description": "Creates a new Spark cluster. This method will acquire new instances from the cloud provider\nif necessary. This method is asynchronous; the returned ``cluster_id`` can be used to poll the\ncluster status. When this method returns, the cluster will be in\na ``PENDING`` state. The cluster will be usable once it enters a ``RUNNING`` state.\nNote: Databricks may not be able to acquire some of the requested nodes, due to cloud provider\nlimitations (account limits, spot price, etc.) or transient network issues.\n\nIf Databricks acquires at least 85% of the requested on-demand nodes, cluster creation will succeed.\nOtherwise the cluster will terminate with an informative error message.\n\nRather than authoring the cluster's JSON definition from scratch, Databricks recommends filling out the\n[create compute UI](https://docs.databricks.com/compute/configure.html) and then copying the generated JSON definition from the UI.",
+            "summary": "Create new cluster.",
+            "path": "/api/2.1/clusters/create",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateCluster",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "spark_version",
+                  "description": "The Spark version of the cluster, e.g. `3.3.x-scala2.11`.\nA list of available Spark versions can be retrieved by using\nthe [clusters/sparkVersions](https://docs.databricks.com/api/workspace/clusters/sparkversions) API call.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "spark_version",
+                  "description": "The Spark version of the cluster, e.g. `3.3.x-scala2.11`.\nA list of available Spark versions can be retrieved by using\nthe [clusters/sparkVersions](https://docs.databricks.com/api/workspace/clusters/sparkversions) API call.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CreateClusterResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "apply_policy_default_values",
+                "description": "When set to true, fixed and default values from the policy will be used for fields that are omitted.\nWhen set to false, only fixed values from the policy will be applied.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "autoscale",
+                "description": "Parameters needed in order to automatically scale clusters up and down based on load.\nNote: autoscaling works best with DB runtime versions 3.0 or later.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AutoScale",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "autotermination_minutes",
+                "description": "Automatically terminates the cluster after it is inactive for this time in minutes. If not set,\nthis cluster will not be automatically terminated. If specified, the threshold must be between\n10 and 10000 minutes.\nUsers can also set this value to 0 to explicitly disable automatic termination.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "aws_attributes",
+                "description": "Attributes related to clusters running on Amazon Web Services.\nIf not specified at cluster creation, a set of default values will be used.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AwsAttributes",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "azure_attributes",
+                "description": "Attributes related to clusters running on Microsoft Azure.\nIf not specified at cluster creation, a set of default values will be used.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AzureAttributes",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "clone_from",
+                "description": "When specified, this clones libraries from a source cluster during the creation of a new cluster.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CloneCluster",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "cluster_log_conf",
+                "description": "The configuration for delivering spark logs to a long-term storage destination.\nThree kinds of destinations (DBFS, S3 and Unity Catalog volumes) are supported. Only one destination can be specified\nfor one cluster. If the conf is given, the logs will be delivered to the destination every\n`5 mins`. The destination of driver logs is `$destination/$clusterId/driver`, while\nthe destination of executor logs is `$destination/$clusterId/executor`.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "ClusterLogConf",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "cluster_name",
+                "description": "Cluster name requested by the user. This doesn't have to be unique.\nIf not specified at creation, the cluster name will be an empty string.\nFor job clusters, the cluster name is automatically set based on the job and job run IDs.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "custom_tags",
+                "description": "Additional tags for cluster resources. Databricks will tag all cluster resources (e.g., AWS\ninstances and EBS volumes) with these tags in addition to `default_tags`. Notes:\n\n- Currently, Databricks allows at most 45 custom tags\n\n- Clusters can only reuse cloud resources if the resources' tags are a subset of the cluster tags",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "data_security_mode",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DataSecurityMode",
+                  "enum": [
+                    {
+                      "content": "DATA_SECURITY_MODE_AUTO"
+                    },
+                    {
+                      "content": "DATA_SECURITY_MODE_DEDICATED"
+                    },
+                    {
+                      "content": "DATA_SECURITY_MODE_STANDARD"
+                    },
+                    {
+                      "content": "LEGACY_PASSTHROUGH"
+                    },
+                    {
+                      "content": "LEGACY_SINGLE_USER"
+                    },
+                    {
+                      "content": "LEGACY_SINGLE_USER_STANDARD"
+                    },
+                    {
+                      "content": "LEGACY_TABLE_ACL"
+                    },
+                    {
+                      "content": "NONE"
+                    },
+                    {
+                      "content": "SINGLE_USER"
+                    },
+                    {
+                      "content": "USER_ISOLATION"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "dependency_mode",
+                "description": "Controls dependency configuration for the cluster.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DependencyMode",
+                  "enum": [
+                    {
+                      "content": "DEPENDENCY_MODE_AUTO"
+                    },
+                    {
+                      "content": "DEPENDENCY_MODE_CLUSTER_LIBRARIES"
+                    },
+                    {
+                      "content": "DEPENDENCY_MODE_ENVIRONMENTS"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "docker_image",
+                "description": "Custom docker image BYOC",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "DockerImage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "driver_instance_pool_id",
+                "description": "The optional ID of the instance pool for the driver of the cluster belongs.\nThe pool cluster uses the instance pool with id (instance_pool_id) if the driver pool is not\nassigned.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "driver_node_type_flexibility",
+                "description": "Flexible node type configuration for the driver node.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "NodeTypeFlexibility",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "driver_node_type_id",
+                "description": "The node type of the Spark driver.\nNote that this field is optional; if unset, the driver node type will be set as the same value\nas `node_type_id` defined above.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "enable_elastic_disk",
+                "description": "Autoscaling Local Storage: when enabled, this cluster will dynamically acquire additional disk\nspace when its Spark workers are running low on disk space.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "enable_local_disk_encryption",
+                "description": "Whether to enable LUKS on cluster VMs' local disks",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "gcp_attributes",
+                "description": "Attributes related to clusters running on Google Cloud Platform.\nIf not specified at cluster creation, a set of default values will be used.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "GcpAttributes",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "init_scripts",
+                "description": "The configuration for storing init scripts. Any number of destinations can be specified.\nThe scripts are executed sequentially in the order provided.\nIf `cluster_log_conf` is specified, init script logs are sent to `\u003cdestination\u003e/\u003ccluster-ID\u003e/init_scripts`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "InitScriptInfoList",
+                  "array_value": {
+                    "pascal_name": "InitScriptInfo",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "instance_pool_id",
+                "description": "The optional ID of the instance pool to which the cluster belongs.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "is_single_node",
+                "description": "This field can only be used when `kind = CLASSIC_PREVIEW`.\n\nWhen set to true, Databricks will automatically set single node related `custom_tags`, `spark_conf`, and `num_workers`",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "kind",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Kind",
+                  "enum": [
+                    {
+                      "content": "CLASSIC_PREVIEW"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "node_type_id",
+                "description": "This field encodes, through a single value, the resources available to each of\nthe Spark nodes in this cluster. For example, the Spark nodes can be provisioned\nand optimized for memory or compute intensive workloads. A list of available node\ntypes can be retrieved by using the [clusters/listNodeTypes](https://docs.databricks.com/api/workspace/clusters/listnodetypes) API call.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "num_workers",
+                "description": "Number of worker nodes that this cluster should have. A cluster has one Spark Driver\nand `num_workers` Executors for a total of `num_workers` + 1 Spark nodes.\n\nNote: When reading the properties of a cluster, this field reflects the desired number\nof workers rather than the actual current number of workers. For instance, if a cluster\nis resized from 5 to 10 workers, this field will immediately be updated to reflect\nthe target size of 10 workers, whereas the workers listed in `spark_info` will gradually\nincrease from 5 to 10 as the new nodes are provisioned.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "policy_id",
+                "description": "The ID of the cluster policy used to create the cluster if applicable.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "remote_disk_throughput",
+                "description": "If set, what the configurable throughput (in Mb/s) for the remote disk is. Currently only supported for GCP HYPERDISK_BALANCED disks.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "runtime_engine",
+                "description": "Determines the cluster's runtime engine, either standard or Photon.\n\nThis field is not compatible with legacy `spark_version` values that contain `-photon-`.\nRemove `-photon-` from the `spark_version` and set `runtime_engine` to `PHOTON`.\n\nIf left unspecified, the runtime engine defaults to standard unless the spark_version\ncontains -photon-, in which case Photon will be used.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "RuntimeEngine",
+                  "enum": [
+                    {
+                      "content": "NULL"
+                    },
+                    {
+                      "content": "PHOTON"
+                    },
+                    {
+                      "content": "STANDARD"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "single_user_name",
+                "description": "Single user name if data_security_mode is `SINGLE_USER`",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "spark_conf",
+                "description": "An object containing a set of optional, user-specified Spark configuration key-value pairs.\nUsers can also pass in a string of extra JVM options to the driver and the executors via\n`spark.driver.extraJavaOptions` and `spark.executor.extraJavaOptions` respectively.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "spark_env_vars",
+                "description": "An object containing a set of optional, user-specified environment variable key-value pairs.\nPlease note that key-value pair of the form (X,Y) will be exported as is (i.e.,\n`export X='Y'`) while launching the driver and workers.\n\nIn order to specify an additional set of `SPARK_DAEMON_JAVA_OPTS`, we recommend appending\nthem to `$SPARK_DAEMON_JAVA_OPTS` as shown in the example below. This ensures that all\ndefault databricks managed environmental variables are included as well.\n\nExample Spark environment variables:\n`{\"SPARK_WORKER_MEMORY\": \"28000m\", \"SPARK_LOCAL_DIRS\": \"/local_disk0\"}` or\n`{\"SPARK_DAEMON_JAVA_OPTS\": \"$SPARK_DAEMON_JAVA_OPTS -Dspark.shuffle.service.enabled=true\"}`",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "spark_version",
+                "description": "The Spark version of the cluster, e.g. `3.3.x-scala2.11`.\nA list of available Spark versions can be retrieved by using\nthe [clusters/sparkVersions](https://docs.databricks.com/api/workspace/clusters/sparkversions) API call.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "ssh_public_keys",
+                "description": "SSH public key contents that will be added to each Spark node in this cluster. The\ncorresponding private keys can be used to login with the user name `ubuntu` on port `2200`.\nUp to 10 keys can be specified.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "total_initial_remote_disk_size",
+                "description": "If set, what the total initial volume size (in GB) of the remote disks should be. Supported for GCP.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "use_ml_runtime",
+                "description": "This field can only be used when `kind = CLASSIC_PREVIEW`.\n\n`effective_spark_version` is determined by `spark_version` (DBR release), this field `use_ml_runtime`, and whether `node_type_id` is gpu node or not.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "worker_node_type_flexibility",
+                "description": "Flexible node type configuration for worker nodes.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "NodeTypeFlexibility",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "workload_type",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "WorkloadType",
+                  "is_object": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "spark_version",
+                "description": "The Spark version of the cluster, e.g. `3.3.x-scala2.11`.\nA list of available Spark versions can be retrieved by using\nthe [clusters/sparkVersions](https://docs.databricks.com/api/workspace/clusters/sparkversions) API call.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "wait": {
+              "success": [
+                {
+                  "content": "RUNNING"
+                }
+              ],
+              "timeout": 20,
+              "poll": {
+                "response": {
+                  "pascal_name": "ClusterDetails"
+                }
+              },
+              "status_path": [
+                {
+                  "pascal_name": "State"
+                }
+              ],
+              "message_path": [
+                {
+                  "pascal_name": "StateMessage"
+                }
+              ],
+              "message_path_head": {
+                "pascal_name": "StateMessage"
+              }
+            }
+          },
+          {
+            "name": "Delete",
+            "description": "Terminates the Spark cluster with the specified ID. The cluster is removed asynchronously.\nOnce the termination has completed, the cluster will be in a `TERMINATED` state.\nIf the cluster is already in a `TERMINATING` or `TERMINATED` state, nothing will happen.",
+            "summary": "Terminate cluster.",
+            "path": "/api/2.1/clusters/delete",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteCluster",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "cluster_id",
+                  "description": "The cluster to be terminated.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "cluster_id",
+                  "description": "The cluster to be terminated.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteClusterResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "cluster_id",
+                "description": "The cluster to be terminated.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "cluster_id",
+                "description": "The cluster to be terminated.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "wait": {
+              "success": [
+                {
+                  "content": "TERMINATED"
+                }
+              ],
+              "timeout": 20,
+              "poll": {
+                "response": {
+                  "pascal_name": "ClusterDetails"
+                }
+              },
+              "status_path": [
+                {
+                  "pascal_name": "State"
+                }
+              ],
+              "message_path": [
+                {
+                  "pascal_name": "StateMessage"
+                }
+              ],
+              "message_path_head": {
+                "pascal_name": "StateMessage"
+              }
+            }
+          },
+          {
+            "name": "Edit",
+            "description": "Updates the configuration of a cluster to match the provided attributes and size.\nA cluster can be updated if it is in a `RUNNING` or `TERMINATED` state.\n\nIf a cluster is updated while in a `RUNNING` state, it will be restarted so that the new attributes can take effect.\n\nIf a cluster is updated while in a `TERMINATED` state, it will remain `TERMINATED`.\nThe next time it is started using the `clusters/start` API, the new attributes will take effect.\nAny attempt to update a cluster in any other state will be rejected with an `INVALID_STATE` error code.\n\nClusters created by the Databricks Jobs service cannot be edited.",
+            "summary": "Update cluster configuration.",
+            "path": "/api/2.1/clusters/edit",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "EditCluster",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "cluster_id",
+                  "description": "ID of the cluster",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "spark_version",
+                  "description": "The Spark version of the cluster, e.g. `3.3.x-scala2.11`.\nA list of available Spark versions can be retrieved by using\nthe [clusters/sparkVersions](https://docs.databricks.com/api/workspace/clusters/sparkversions) API call.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "cluster_id",
+                  "description": "ID of the cluster",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "spark_version",
+                  "description": "The Spark version of the cluster, e.g. `3.3.x-scala2.11`.\nA list of available Spark versions can be retrieved by using\nthe [clusters/sparkVersions](https://docs.databricks.com/api/workspace/clusters/sparkversions) API call.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "EditClusterResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "apply_policy_default_values",
+                "description": "When set to true, fixed and default values from the policy will be used for fields that are omitted. When set to false, only fixed values from the policy will be applied.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "autoscale",
+                "description": "Parameters needed in order to automatically scale clusters up and down based on load.\nNote: autoscaling works best with DB runtime versions 3.0 or later.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AutoScale",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "autotermination_minutes",
+                "description": "Automatically terminates the cluster after it is inactive for this time in minutes. If not set,\nthis cluster will not be automatically terminated. If specified, the threshold must be between\n10 and 10000 minutes.\nUsers can also set this value to 0 to explicitly disable automatic termination.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "aws_attributes",
+                "description": "Attributes related to clusters running on Amazon Web Services.\nIf not specified at cluster creation, a set of default values will be used.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AwsAttributes",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "azure_attributes",
+                "description": "Attributes related to clusters running on Microsoft Azure.\nIf not specified at cluster creation, a set of default values will be used.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AzureAttributes",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "cluster_id",
+                "description": "ID of the cluster",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "cluster_log_conf",
+                "description": "The configuration for delivering spark logs to a long-term storage destination.\nThree kinds of destinations (DBFS, S3 and Unity Catalog volumes) are supported. Only one destination can be specified\nfor one cluster. If the conf is given, the logs will be delivered to the destination every\n`5 mins`. The destination of driver logs is `$destination/$clusterId/driver`, while\nthe destination of executor logs is `$destination/$clusterId/executor`.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "ClusterLogConf",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "cluster_name",
+                "description": "Cluster name requested by the user. This doesn't have to be unique.\nIf not specified at creation, the cluster name will be an empty string.\nFor job clusters, the cluster name is automatically set based on the job and job run IDs.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "custom_tags",
+                "description": "Additional tags for cluster resources. Databricks will tag all cluster resources (e.g., AWS\ninstances and EBS volumes) with these tags in addition to `default_tags`. Notes:\n\n- Currently, Databricks allows at most 45 custom tags\n\n- Clusters can only reuse cloud resources if the resources' tags are a subset of the cluster tags",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "data_security_mode",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DataSecurityMode",
+                  "enum": [
+                    {
+                      "content": "DATA_SECURITY_MODE_AUTO"
+                    },
+                    {
+                      "content": "DATA_SECURITY_MODE_DEDICATED"
+                    },
+                    {
+                      "content": "DATA_SECURITY_MODE_STANDARD"
+                    },
+                    {
+                      "content": "LEGACY_PASSTHROUGH"
+                    },
+                    {
+                      "content": "LEGACY_SINGLE_USER"
+                    },
+                    {
+                      "content": "LEGACY_SINGLE_USER_STANDARD"
+                    },
+                    {
+                      "content": "LEGACY_TABLE_ACL"
+                    },
+                    {
+                      "content": "NONE"
+                    },
+                    {
+                      "content": "SINGLE_USER"
+                    },
+                    {
+                      "content": "USER_ISOLATION"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "dependency_mode",
+                "description": "Controls dependency configuration for the cluster.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DependencyMode",
+                  "enum": [
+                    {
+                      "content": "DEPENDENCY_MODE_AUTO"
+                    },
+                    {
+                      "content": "DEPENDENCY_MODE_CLUSTER_LIBRARIES"
+                    },
+                    {
+                      "content": "DEPENDENCY_MODE_ENVIRONMENTS"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "docker_image",
+                "description": "Custom docker image BYOC",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "DockerImage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "driver_instance_pool_id",
+                "description": "The optional ID of the instance pool for the driver of the cluster belongs.\nThe pool cluster uses the instance pool with id (instance_pool_id) if the driver pool is not\nassigned.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "driver_node_type_flexibility",
+                "description": "Flexible node type configuration for the driver node.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "NodeTypeFlexibility",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "driver_node_type_id",
+                "description": "The node type of the Spark driver.\nNote that this field is optional; if unset, the driver node type will be set as the same value\nas `node_type_id` defined above.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "enable_elastic_disk",
+                "description": "Autoscaling Local Storage: when enabled, this cluster will dynamically acquire additional disk\nspace when its Spark workers are running low on disk space.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "enable_local_disk_encryption",
+                "description": "Whether to enable LUKS on cluster VMs' local disks",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "gcp_attributes",
+                "description": "Attributes related to clusters running on Google Cloud Platform.\nIf not specified at cluster creation, a set of default values will be used.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "GcpAttributes",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "init_scripts",
+                "description": "The configuration for storing init scripts. Any number of destinations can be specified.\nThe scripts are executed sequentially in the order provided.\nIf `cluster_log_conf` is specified, init script logs are sent to `\u003cdestination\u003e/\u003ccluster-ID\u003e/init_scripts`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "InitScriptInfoList",
+                  "array_value": {
+                    "pascal_name": "InitScriptInfo",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "instance_pool_id",
+                "description": "The optional ID of the instance pool to which the cluster belongs.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "is_single_node",
+                "description": "This field can only be used when `kind = CLASSIC_PREVIEW`.\n\nWhen set to true, Databricks will automatically set single node related `custom_tags`, `spark_conf`, and `num_workers`",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "kind",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Kind",
+                  "enum": [
+                    {
+                      "content": "CLASSIC_PREVIEW"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "node_type_id",
+                "description": "This field encodes, through a single value, the resources available to each of\nthe Spark nodes in this cluster. For example, the Spark nodes can be provisioned\nand optimized for memory or compute intensive workloads. A list of available node\ntypes can be retrieved by using the [clusters/listNodeTypes](https://docs.databricks.com/api/workspace/clusters/listnodetypes) API call.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "num_workers",
+                "description": "Number of worker nodes that this cluster should have. A cluster has one Spark Driver\nand `num_workers` Executors for a total of `num_workers` + 1 Spark nodes.\n\nNote: When reading the properties of a cluster, this field reflects the desired number\nof workers rather than the actual current number of workers. For instance, if a cluster\nis resized from 5 to 10 workers, this field will immediately be updated to reflect\nthe target size of 10 workers, whereas the workers listed in `spark_info` will gradually\nincrease from 5 to 10 as the new nodes are provisioned.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "policy_id",
+                "description": "The ID of the cluster policy used to create the cluster if applicable.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "remote_disk_throughput",
+                "description": "If set, what the configurable throughput (in Mb/s) for the remote disk is. Currently only supported for GCP HYPERDISK_BALANCED disks.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "runtime_engine",
+                "description": "Determines the cluster's runtime engine, either standard or Photon.\n\nThis field is not compatible with legacy `spark_version` values that contain `-photon-`.\nRemove `-photon-` from the `spark_version` and set `runtime_engine` to `PHOTON`.\n\nIf left unspecified, the runtime engine defaults to standard unless the spark_version\ncontains -photon-, in which case Photon will be used.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "RuntimeEngine",
+                  "enum": [
+                    {
+                      "content": "NULL"
+                    },
+                    {
+                      "content": "PHOTON"
+                    },
+                    {
+                      "content": "STANDARD"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "single_user_name",
+                "description": "Single user name if data_security_mode is `SINGLE_USER`",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "spark_conf",
+                "description": "An object containing a set of optional, user-specified Spark configuration key-value pairs.\nUsers can also pass in a string of extra JVM options to the driver and the executors via\n`spark.driver.extraJavaOptions` and `spark.executor.extraJavaOptions` respectively.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "spark_env_vars",
+                "description": "An object containing a set of optional, user-specified environment variable key-value pairs.\nPlease note that key-value pair of the form (X,Y) will be exported as is (i.e.,\n`export X='Y'`) while launching the driver and workers.\n\nIn order to specify an additional set of `SPARK_DAEMON_JAVA_OPTS`, we recommend appending\nthem to `$SPARK_DAEMON_JAVA_OPTS` as shown in the example below. This ensures that all\ndefault databricks managed environmental variables are included as well.\n\nExample Spark environment variables:\n`{\"SPARK_WORKER_MEMORY\": \"28000m\", \"SPARK_LOCAL_DIRS\": \"/local_disk0\"}` or\n`{\"SPARK_DAEMON_JAVA_OPTS\": \"$SPARK_DAEMON_JAVA_OPTS -Dspark.shuffle.service.enabled=true\"}`",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "spark_version",
+                "description": "The Spark version of the cluster, e.g. `3.3.x-scala2.11`.\nA list of available Spark versions can be retrieved by using\nthe [clusters/sparkVersions](https://docs.databricks.com/api/workspace/clusters/sparkversions) API call.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "ssh_public_keys",
+                "description": "SSH public key contents that will be added to each Spark node in this cluster. The\ncorresponding private keys can be used to login with the user name `ubuntu` on port `2200`.\nUp to 10 keys can be specified.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "total_initial_remote_disk_size",
+                "description": "If set, what the total initial volume size (in GB) of the remote disks should be. Supported for GCP.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "use_ml_runtime",
+                "description": "This field can only be used when `kind = CLASSIC_PREVIEW`.\n\n`effective_spark_version` is determined by `spark_version` (DBR release), this field `use_ml_runtime`, and whether `node_type_id` is gpu node or not.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "worker_node_type_flexibility",
+                "description": "Flexible node type configuration for worker nodes.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "NodeTypeFlexibility",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "workload_type",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "WorkloadType",
+                  "is_object": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "cluster_id",
+                "description": "ID of the cluster",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "spark_version",
+                "description": "The Spark version of the cluster, e.g. `3.3.x-scala2.11`.\nA list of available Spark versions can be retrieved by using\nthe [clusters/sparkVersions](https://docs.databricks.com/api/workspace/clusters/sparkversions) API call.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "wait": {
+              "success": [
+                {
+                  "content": "RUNNING"
+                }
+              ],
+              "timeout": 20,
+              "poll": {
+                "response": {
+                  "pascal_name": "ClusterDetails"
+                }
+              },
+              "status_path": [
+                {
+                  "pascal_name": "State"
+                }
+              ],
+              "message_path": [
+                {
+                  "pascal_name": "StateMessage"
+                }
+              ],
+              "message_path_head": {
+                "pascal_name": "StateMessage"
+              }
+            }
+          },
+          {
+            "name": "Events",
+            "description": "Retrieves a list of events about the activity of a cluster.\nThis API is paginated. If there are more events to read, the response includes all the\nparameters necessary to request the next page of events.",
+            "summary": "List cluster activity events.",
+            "path": "/api/2.1/clusters/events",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetEvents",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "cluster_id",
+                  "description": "The ID of the cluster to retrieve events about.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "cluster_id",
+                  "description": "The ID of the cluster to retrieve events about.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetEventsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "cluster_id",
+                "description": "The ID of the cluster to retrieve events about.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "end_time",
+                "description": "The end time in epoch milliseconds.\nIf empty, returns events up to the current time.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "event_types",
+                "description": "An optional set of event types to filter on.\nIf empty, all event types are returned.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EventTypeList",
+                  "array_value": {
+                    "pascal_name": "EventType",
+                    "enum": [
+                      {
+                        "content": "ADD_NODES_FAILED"
+                      },
+                      {
+                        "content": "AUTOMATIC_CLUSTER_UPDATE"
+                      },
+                      {
+                        "content": "AUTOSCALING_BACKOFF"
+                      },
+                      {
+                        "content": "AUTOSCALING_FAILED"
+                      },
+                      {
+                        "content": "AUTOSCALING_STATS_REPORT"
+                      },
+                      {
+                        "content": "CLUSTER_MIGRATED"
+                      },
+                      {
+                        "content": "CREATING"
+                      },
+                      {
+                        "content": "DBFS_DOWN"
+                      },
+                      {
+                        "content": "DECOMMISSION_ENDED"
+                      },
+                      {
+                        "content": "DECOMMISSION_STARTED"
+                      },
+                      {
+                        "content": "DEFERRED_POLICY_ENFORCEMENT_FAILED"
+                      },
+                      {
+                        "content": "DEFERRED_POLICY_ENFORCEMENT_SCHEDULED"
+                      },
+                      {
+                        "content": "DID_NOT_EXPAND_DISK"
+                      },
+                      {
+                        "content": "DRIVER_HEALTHY"
+                      },
+                      {
+                        "content": "DRIVER_NOT_RESPONDING"
+                      },
+                      {
+                        "content": "DRIVER_UNAVAILABLE"
+                      },
+                      {
+                        "content": "EDITED"
+                      },
+                      {
+                        "content": "EXPANDED_DISK"
+                      },
+                      {
+                        "content": "FAILED_TO_EXPAND_DISK"
+                      },
+                      {
+                        "content": "INIT_SCRIPTS_FINISHED"
+                      },
+                      {
+                        "content": "INIT_SCRIPTS_STARTED"
+                      },
+                      {
+                        "content": "METASTORE_DOWN"
+                      },
+                      {
+                        "content": "NODES_LOST"
+                      },
+                      {
+                        "content": "NODE_BLACKLISTED"
+                      },
+                      {
+                        "content": "NODE_EXCLUDED_DECOMMISSIONED"
+                      },
+                      {
+                        "content": "PINNED"
+                      },
+                      {
+                        "content": "RESIZING"
+                      },
+                      {
+                        "content": "RESTARTING"
+                      },
+                      {
+                        "content": "RUNNING"
+                      },
+                      {
+                        "content": "SPARK_EXCEPTION"
+                      },
+                      {
+                        "content": "STARTING"
+                      },
+                      {
+                        "content": "TERMINATING"
+                      },
+                      {
+                        "content": "UC_VOLUME_MISCONFIGURED"
+                      },
+                      {
+                        "content": "UNPINNED"
+                      },
+                      {
+                        "content": "UPSIZE_COMPLETED"
+                      }
+                    ]
+                  }
+                }
+              },
+              {
+                "name": "limit",
+                "description": "Deprecated: use page_token in combination with page_size instead.\n\nThe maximum number of events to include in a page of events.\nDefaults to 50, and maximum allowed value is 500.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "offset",
+                "description": "Deprecated: use page_token in combination with page_size instead.\n\nThe offset in the result set. Defaults to 0 (no offset). When an offset is specified\nand the results are requested in descending order, the end_time field is required.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "order",
+                "description": "The order to list events in; either \"ASC\" or \"DESC\". Defaults to \"DESC\".",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "GetEventsOrder",
+                  "enum": [
+                    {
+                      "content": "ASC"
+                    },
+                    {
+                      "content": "DESC"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "The maximum number of events to include in a page of events.\nThe server may further constrain the maximum number of results returned in a single page.\nIf the page_size is empty or 0, the server will decide the number of results to be returned.\nThe field has to be in the range [0,500]. If the value is outside the range, the server enforces 0 or 500.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Use next_page_token or prev_page_token returned from the previous request to list the next or previous page of events respectively.\nIf page_token is empty, the first page is returned.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "start_time",
+                "description": "The start time in epoch milliseconds.\nIf empty, returns events starting from the beginning of time.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "cluster_id",
+                "description": "The ID of the cluster to retrieve events about.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Use next_page_token or prev_page_token returned from the previous request to list the next or previous page of events respectively.\nIf page_token is empty, the first page is returned.",
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "Get",
+            "description": "Retrieves the information for a cluster given its identifier.\nClusters can be described while they are running, or up to 60 days after they are terminated.",
+            "summary": "Get cluster info.",
+            "path": "/api/2.1/clusters/get",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetClusterRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "cluster_id",
+                  "description": "The cluster about which to retrieve information.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "cluster_id",
+                  "description": "The cluster about which to retrieve information.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ClusterDetails",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "cluster_id",
+                "description": "The cluster about which to retrieve information.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "cluster_id",
+                "description": "The cluster about which to retrieve information.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetPermissionLevels",
+            "description": "Gets the permission levels that a user can have on an object.",
+            "summary": "Get cluster permission levels.",
+            "path": "/api/2.0/permissions/clusters/{cluster_id}/permissionLevels",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetClusterPermissionLevelsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "cluster_id",
+                  "description": "The cluster for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "cluster_id",
+                  "description": "The cluster for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetClusterPermissionLevelsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "cluster_id",
+                "description": "The cluster for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "cluster_id",
+                "description": "The cluster for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetPermissions",
+            "description": "Gets the permissions of a cluster. Clusters can inherit permissions from their root object.",
+            "summary": "Get cluster permissions.",
+            "path": "/api/2.0/permissions/clusters/{cluster_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetClusterPermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "cluster_id",
+                  "description": "The cluster for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "cluster_id",
+                  "description": "The cluster for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ClusterPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "cluster_id",
+                "description": "The cluster for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "cluster_id",
+                "description": "The cluster for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Return information about all pinned and active clusters, and all clusters terminated within the last 30 days. Clusters terminated prior to this period are not included.",
+            "summary": "List clusters.",
+            "path": "/api/2.1/clusters/list",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListClustersRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListClustersResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "filter_by",
+                "description": "Filters to apply to the list of clusters.",
+                "is_query": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "ListClustersFilterBy",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "Use this field to specify the maximum number of results to be returned by the server. The server may further constrain the maximum number of results returned in a single page.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Use next_page_token or prev_page_token returned from the previous request to list the next or previous page of clusters respectively.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "sort_by",
+                "description": "Sort the list of clusters by a specific criteria.",
+                "is_query": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "ListClustersSortBy",
+                  "is_object": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Use next_page_token or prev_page_token returned from the previous request to list the next or previous page of clusters respectively.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListNodeTypes",
+            "description": "Returns a list of supported Spark node types. These node types can be used to launch a cluster.",
+            "summary": "List node types.",
+            "path": "/api/2.1/clusters/list-node-types",
+            "is_legacy_empty_request": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListNodeTypesRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListNodeTypesResponse",
+              "is_object": true
+            }
+          },
+          {
+            "name": "ListZones",
+            "description": "Returns a list of availability zones where clusters can be created in (For example, us-west-2a).\nThese zones can be used to launch a cluster.",
+            "summary": "List availability zones.",
+            "path": "/api/2.1/clusters/list-zones",
+            "is_legacy_empty_request": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListZonesRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListAvailableZonesResponse",
+              "is_object": true
+            }
+          },
+          {
+            "name": "PermanentDelete",
+            "description": "Permanently deletes a Spark cluster. This cluster is terminated and resources are asynchronously removed.\n\nIn addition, users will no longer see permanently deleted clusters in the cluster list, and API users can no longer\nperform any action on permanently deleted clusters.",
+            "summary": "Permanently delete cluster.",
+            "path": "/api/2.1/clusters/permanent-delete",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "PermanentDeleteCluster",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "cluster_id",
+                  "description": "The cluster to be deleted.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "cluster_id",
+                  "description": "The cluster to be deleted.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "PermanentDeleteClusterResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "cluster_id",
+                "description": "The cluster to be deleted.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "cluster_id",
+                "description": "The cluster to be deleted.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Pin",
+            "description": "Pinning a cluster ensures that the cluster will always be returned by the ListClusters API.\nPinning a cluster that is already pinned will have no effect.\nThis API can only be called by workspace admins.",
+            "summary": "Pin cluster.",
+            "path": "/api/2.1/clusters/pin",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "PinCluster",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "cluster_id",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "cluster_id",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "PinClusterResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "cluster_id",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "cluster_id",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Resize",
+            "description": "Resizes a cluster to have a desired number of workers. This will fail unless the cluster is in a `RUNNING` state.",
+            "summary": "Resize cluster.",
+            "path": "/api/2.1/clusters/resize",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ResizeCluster",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "cluster_id",
+                  "description": "The cluster to be resized.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "cluster_id",
+                  "description": "The cluster to be resized.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ResizeClusterResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "autoscale",
+                "description": "Parameters needed in order to automatically scale clusters up and down based on load.\nNote: autoscaling works best with DB runtime versions 3.0 or later.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AutoScale",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "cluster_id",
+                "description": "The cluster to be resized.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "num_workers",
+                "description": "Number of worker nodes that this cluster should have. A cluster has one Spark Driver\nand `num_workers` Executors for a total of `num_workers` + 1 Spark nodes.\n\nNote: When reading the properties of a cluster, this field reflects the desired number\nof workers rather than the actual current number of workers. For instance, if a cluster\nis resized from 5 to 10 workers, this field will immediately be updated to reflect\nthe target size of 10 workers, whereas the workers listed in `spark_info` will gradually\nincrease from 5 to 10 as the new nodes are provisioned.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "cluster_id",
+                "description": "The cluster to be resized.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "wait": {
+              "success": [
+                {
+                  "content": "RUNNING"
+                }
+              ],
+              "timeout": 20,
+              "poll": {
+                "response": {
+                  "pascal_name": "ClusterDetails"
+                }
+              },
+              "status_path": [
+                {
+                  "pascal_name": "State"
+                }
+              ],
+              "message_path": [
+                {
+                  "pascal_name": "StateMessage"
+                }
+              ],
+              "message_path_head": {
+                "pascal_name": "StateMessage"
+              }
+            }
+          },
+          {
+            "name": "Restart",
+            "description": "Restarts a Spark cluster with the supplied ID. If the cluster is not currently in a `RUNNING` state, nothing will happen.",
+            "summary": "Restart cluster.",
+            "path": "/api/2.1/clusters/restart",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "RestartCluster",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "cluster_id",
+                  "description": "The cluster to be started.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "cluster_id",
+                  "description": "The cluster to be started.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "RestartClusterResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "cluster_id",
+                "description": "The cluster to be started.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "restart_user",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "cluster_id",
+                "description": "The cluster to be started.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "wait": {
+              "success": [
+                {
+                  "content": "RUNNING"
+                }
+              ],
+              "timeout": 20,
+              "poll": {
+                "response": {
+                  "pascal_name": "ClusterDetails"
+                }
+              },
+              "status_path": [
+                {
+                  "pascal_name": "State"
+                }
+              ],
+              "message_path": [
+                {
+                  "pascal_name": "StateMessage"
+                }
+              ],
+              "message_path_head": {
+                "pascal_name": "StateMessage"
+              }
+            }
+          },
+          {
+            "name": "SetPermissions",
+            "description": "Sets permissions on an object, replacing existing permissions if they exist. Deletes all direct permissions if none are specified. Objects can inherit permissions from their root object.",
+            "summary": "Set cluster permissions.",
+            "path": "/api/2.0/permissions/clusters/{cluster_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ClusterPermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "cluster_id",
+                  "description": "The cluster for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "cluster_id",
+                  "description": "The cluster for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ClusterPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "access_control_list",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ClusterAccessControlRequestList",
+                  "array_value": {
+                    "pascal_name": "ClusterAccessControlRequest",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "cluster_id",
+                "description": "The cluster for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "cluster_id",
+                "description": "The cluster for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "SparkVersions",
+            "description": "Returns the list of available Spark versions. These versions can be used to launch a cluster.",
+            "summary": "List available Spark versions.",
+            "path": "/api/2.1/clusters/spark-versions",
+            "is_legacy_empty_request": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "SparkVersionsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "GetSparkVersionsResponse",
+              "is_object": true
+            }
+          },
+          {
+            "name": "Start",
+            "description": "Starts a terminated Spark cluster with the supplied ID. This works similar to `createCluster` except:\n- The previous cluster id and attributes are preserved.\n- The cluster starts with the last specified cluster size.\n- If the previous cluster was an autoscaling cluster, the current cluster starts with\nthe minimum number of nodes.\n- If the cluster is not currently in a ``TERMINATED`` state, nothing will happen.\n- Clusters launched to run a job cannot be started.",
+            "summary": "Start terminated cluster.",
+            "path": "/api/2.1/clusters/start",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "StartCluster",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "cluster_id",
+                  "description": "The cluster to be started.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "cluster_id",
+                  "description": "The cluster to be started.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "StartClusterResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "cluster_id",
+                "description": "The cluster to be started.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "cluster_id",
+                "description": "The cluster to be started.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "wait": {
+              "success": [
+                {
+                  "content": "RUNNING"
+                }
+              ],
+              "timeout": 20,
+              "poll": {
+                "response": {
+                  "pascal_name": "ClusterDetails"
+                }
+              },
+              "status_path": [
+                {
+                  "pascal_name": "State"
+                }
+              ],
+              "message_path": [
+                {
+                  "pascal_name": "StateMessage"
+                }
+              ],
+              "message_path_head": {
+                "pascal_name": "StateMessage"
+              }
+            }
+          },
+          {
+            "name": "Unpin",
+            "description": "Unpinning a cluster will allow the cluster to eventually be removed from the ListClusters API.\nUnpinning a cluster that is not pinned will have no effect.\nThis API can only be called by workspace admins.",
+            "summary": "Unpin cluster.",
+            "path": "/api/2.1/clusters/unpin",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UnpinCluster",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "cluster_id",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "cluster_id",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "UnpinClusterResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "cluster_id",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "cluster_id",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Updates the configuration of a cluster to match the partial set of attributes and size.\nDenote which fields to update using the `update_mask` field in the request body.\nA cluster can be updated if it is in a `RUNNING` or `TERMINATED` state.\nIf a cluster is updated while in a `RUNNING` state, it will be restarted so that the new attributes can take effect.\nIf a cluster is updated while in a `TERMINATED` state, it will remain `TERMINATED`.\nThe updated attributes will take effect the next time the cluster is started using the `clusters/start` API.\nAttempts to update a cluster in any other state will be rejected with an `INVALID_STATE` error code.\nClusters created by the Databricks Jobs service cannot be updated.",
+            "summary": "Update cluster configuration (partial).",
+            "path": "/api/2.1/clusters/update",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateCluster",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "cluster_id",
+                  "description": "ID of the cluster.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Used to specify which cluster attributes and size fields to update. See https://google.aip.dev/161 for more details.\n\nThe field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "cluster_id",
+                  "description": "ID of the cluster.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Used to specify which cluster attributes and size fields to update. See https://google.aip.dev/161 for more details.\n\nThe field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "UpdateClusterResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "cluster",
+                "description": "The cluster to be updated.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "UpdateClusterResource",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "cluster_id",
+                "description": "ID of the cluster.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Used to specify which cluster attributes and size fields to update. See https://google.aip.dev/161 for more details.\n\nThe field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "cluster_id",
+                "description": "ID of the cluster.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Used to specify which cluster attributes and size fields to update. See https://google.aip.dev/161 for more details.\n\nThe field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "wait": {
+              "success": [
+                {
+                  "content": "RUNNING"
+                }
+              ],
+              "timeout": 20,
+              "poll": {
+                "response": {
+                  "pascal_name": "ClusterDetails"
+                }
+              },
+              "status_path": [
+                {
+                  "pascal_name": "State"
+                }
+              ],
+              "message_path": [
+                {
+                  "pascal_name": "StateMessage"
+                }
+              ],
+              "message_path_head": {
+                "pascal_name": "StateMessage"
+              }
+            }
+          },
+          {
+            "name": "UpdatePermissions",
+            "description": "Updates the permissions on a cluster. Clusters can inherit permissions from their root object.",
+            "summary": "Update cluster permissions.",
+            "path": "/api/2.0/permissions/clusters/{cluster_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ClusterPermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "cluster_id",
+                  "description": "The cluster for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "cluster_id",
+                  "description": "The cluster for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ClusterPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "access_control_list",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ClusterAccessControlRequestList",
+                  "array_value": {
+                    "pascal_name": "ClusterAccessControlRequest",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "cluster_id",
+                "description": "The cluster for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "cluster_id",
+                "description": "The cluster for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "compute.CommandExecution",
+        "name": "CommandExecution",
+        "description": "This API allows execution of Python, Scala, SQL, or R commands on running\nDatabricks Clusters. This API only supports (classic) all-purpose clusters.\nServerless compute is not supported.",
+        "package": {
+          "name": "compute"
+        },
+        "docs_group": "compute",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "methods": [
+          {
+            "name": "Cancel",
+            "description": "Cancels a currently running command within an execution context.\n\nThe command ID is obtained from a prior successful call to __execute__.",
+            "summary": "Cancel a command.",
+            "path": "/api/1.2/commands/cancel",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CancelCommand",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "CancelResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "clusterId",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "commandId",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "contextId",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "wait": {
+              "success": [
+                {
+                  "content": "Cancelled"
+                }
+              ],
+              "timeout": 20,
+              "complex_message_path": true,
+              "poll": {
+                "response": {
+                  "pascal_name": "CommandStatusResponse"
+                }
+              },
+              "status_path": [
+                {
+                  "pascal_name": "Status"
+                }
+              ],
+              "message_path": [
+                {
+                  "pascal_name": "Results"
+                },
+                {
+                  "pascal_name": "Cause"
+                }
+              ],
+              "message_path_head": {
+                "pascal_name": "Results"
+              }
+            }
+          },
+          {
+            "name": "CommandStatus",
+            "description": "Gets the status of and, if available, the results from a currently executing command.\n\nThe command ID is obtained from a prior successful call to __execute__.",
+            "summary": "Get command info.",
+            "path": "/api/1.2/commands/status",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CommandStatusRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "clusterId",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "contextId",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "commandId",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "clusterId",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "contextId",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "commandId",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CommandStatusResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "clusterId",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "commandId",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "contextId",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "clusterId",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "contextId",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "commandId",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ContextStatus",
+            "description": "Gets the status for an execution context.",
+            "summary": "Get status.",
+            "path": "/api/1.2/contexts/status",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ContextStatusRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "clusterId",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "contextId",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "clusterId",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "contextId",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ContextStatusResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "clusterId",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "contextId",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "clusterId",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "contextId",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Create",
+            "description": "Creates an execution context for running cluster commands.\n\nIf successful, this method returns the ID of the new execution context.",
+            "summary": "Create an execution context.",
+            "path": "/api/1.2/contexts/create",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateContext",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "Created",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "clusterId",
+                "description": "Running cluster id",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "language",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Language",
+                  "enum": [
+                    {
+                      "content": "python"
+                    },
+                    {
+                      "content": "r"
+                    },
+                    {
+                      "content": "scala"
+                    },
+                    {
+                      "content": "sql"
+                    }
+                  ]
+                }
+              }
+            ],
+            "wait": {
+              "success": [
+                {
+                  "content": "Running"
+                }
+              ],
+              "timeout": 20,
+              "poll": {
+                "response": {
+                  "pascal_name": "ContextStatusResponse"
+                }
+              },
+              "status_path": [
+                {
+                  "pascal_name": "Status"
+                }
+              ]
+            }
+          },
+          {
+            "name": "Destroy",
+            "description": "Deletes an execution context.",
+            "summary": "Delete an execution context.",
+            "path": "/api/1.2/contexts/destroy",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DestroyContext",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "clusterId",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "contextId",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "clusterId",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "contextId",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DestroyResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "clusterId",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "contextId",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "clusterId",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "contextId",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Execute",
+            "description": "Runs a cluster command in the given execution context, using the provided language.\n\nIf successful, it returns an ID for tracking the status of the command's execution.",
+            "summary": "Run a command.",
+            "path": "/api/1.2/commands/execute",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "Command",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "Created",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "clusterId",
+                "description": "Running cluster id",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "command",
+                "description": "Executable code",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "contextId",
+                "description": "Running context id",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "language",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Language",
+                  "enum": [
+                    {
+                      "content": "python"
+                    },
+                    {
+                      "content": "r"
+                    },
+                    {
+                      "content": "scala"
+                    },
+                    {
+                      "content": "sql"
+                    }
+                  ]
+                }
+              }
+            ],
+            "wait": {
+              "success": [
+                {
+                  "content": "Finished"
+                },
+                {
+                  "content": "Error"
+                }
+              ],
+              "timeout": 20,
+              "poll": {
+                "response": {
+                  "pascal_name": "CommandStatusResponse"
+                }
+              },
+              "status_path": [
+                {
+                  "pascal_name": "Status"
+                }
+              ]
+            }
+          }
+        ]
+      },
+      {
+        "id": "settings.ComplianceSecurityProfile",
+        "name": "ComplianceSecurityProfile",
+        "description": "Controls whether to enable the compliance security profile for the current workspace. Enabling it on a workspace is permanent.\nBy default, it is turned off.\n\nThis settings can NOT be disabled once it is enabled.",
+        "package": {
+          "name": "settings"
+        },
+        "has_parent": true,
+        "docs_group": "settings",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "parent_service_id": "settings.Settings",
+        "methods": [
+          {
+            "name": "Get",
+            "description": "Gets the compliance security profile setting.",
+            "summary": "Get the compliance security profile setting.",
+            "path": "/api/2.0/settings/types/shield_csp_enablement_ws_db/names/default",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetComplianceSecurityProfileSettingRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ComplianceSecurityProfileSetting",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "compliance_security_profile_workspace",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ComplianceSecurityProfile",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "compliance_security_profile_workspace",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ComplianceSecurityProfile",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Updates the compliance security profile setting for the workspace. A fresh etag needs\nto be provided in `PATCH` requests (as part of the setting field). The etag can be retrieved by making a `GET`\nrequest before the `PATCH` request. If the setting is updated concurrently, `PATCH` fails with 409 and the\nrequest must be retried by using the fresh etag in the 409 response.",
+            "summary": "Update the compliance security profile setting.",
+            "path": "/api/2.0/settings/types/shield_csp_enablement_ws_db/names/default",
+            "can_use_json": true,
+            "must_use_json": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "UpdateComplianceSecurityProfileSettingRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ComplianceSecurityProfileSetting",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ComplianceSecurityProfileSetting",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ComplianceSecurityProfileSetting",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "compliance_security_profile_workspace",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ComplianceSecurityProfile",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "compliance_security_profile_workspace",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ComplianceSecurityProfile",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "allow_missing",
+                "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "field_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "setting",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ComplianceSecurityProfileSetting",
+                  "is_object": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "catalog.Connections",
+        "name": "Connections",
+        "description": "A connection represents an external data source for use within Databricks.\n\nCreating a connection object is the first step to managing external data sources within Unity Catalog. The\nsecond step is creating a data object (catalog, schema, or table) using the connection. Data objects\nderived from a connection can be written to or read from similar to other Unity Catalog data objects based on\ncloud storage. You can create different types of connections, and each connection has a unique set of\nconfiguration options to support credential management and other settings.",
+        "package": {
+          "name": "catalog"
+        },
+        "docs_group": "catalog",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "named_id_map": {
+            "pascal_name": "ConnectionInfoNameToFullNameMap"
+          },
+          "request": {
+            "pascal_name": "ListConnectionsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a new connection\n\nCreates a new connection to an external data source. It allows users to specify connection details and\nconfigurations for interaction with the external server.",
+            "summary": "Create a connection.",
+            "path": "/api/2.1/unity-catalog/connections",
+            "can_use_json": true,
+            "must_use_json": true,
+            "is_crud_create": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateConnection",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the connection.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "connection_type",
+                  "description": "The type of connection.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ConnectionType",
+                    "enum": [
+                      {
+                        "content": "AWS_SECRETS_MANAGER"
+                      },
+                      {
+                        "content": "AZURE_KEY_VAULT"
+                      },
+                      {
+                        "content": "BIGQUERY"
+                      },
+                      {
+                        "content": "CONFLUENCE"
+                      },
+                      {
+                        "content": "DATABRICKS"
+                      },
+                      {
+                        "content": "DYNAMICS365"
+                      },
+                      {
+                        "content": "GA4_RAW_DATA"
+                      },
+                      {
+                        "content": "GITHUB"
+                      },
+                      {
+                        "content": "GLUE"
+                      },
+                      {
+                        "content": "HIVE_METASTORE"
+                      },
+                      {
+                        "content": "HTTP"
+                      },
+                      {
+                        "content": "HUBSPOT"
+                      },
+                      {
+                        "content": "JDBC"
+                      },
+                      {
+                        "content": "META_MARKETING"
+                      },
+                      {
+                        "content": "MYSQL"
+                      },
+                      {
+                        "content": "NETSUITE"
+                      },
+                      {
+                        "content": "ORACLE"
+                      },
+                      {
+                        "content": "OUTLOOK"
+                      },
+                      {
+                        "content": "POSTGRESQL"
+                      },
+                      {
+                        "content": "POWER_BI"
+                      },
+                      {
+                        "content": "REDSHIFT"
+                      },
+                      {
+                        "content": "SALESFORCE"
+                      },
+                      {
+                        "content": "SALESFORCE_DATA_CLOUD"
+                      },
+                      {
+                        "content": "SERVICENOW"
+                      },
+                      {
+                        "content": "SMARTSHEET"
+                      },
+                      {
+                        "content": "SNOWFLAKE"
+                      },
+                      {
+                        "content": "SQLDW"
+                      },
+                      {
+                        "content": "SQLSERVER"
+                      },
+                      {
+                        "content": "TERADATA"
+                      },
+                      {
+                        "content": "TIKTOK_ADS"
+                      },
+                      {
+                        "content": "UNKNOWN_CONNECTION_TYPE"
+                      },
+                      {
+                        "content": "WORKDAY_RAAS"
+                      },
+                      {
+                        "content": "ZENDESK"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "options",
+                  "description": "A map of key-value properties attached to the securable.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "map_value": {
+                      "is_string": true
+                    }
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the connection.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "connection_type",
+                  "description": "The type of connection.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ConnectionType",
+                    "enum": [
+                      {
+                        "content": "AWS_SECRETS_MANAGER"
+                      },
+                      {
+                        "content": "AZURE_KEY_VAULT"
+                      },
+                      {
+                        "content": "BIGQUERY"
+                      },
+                      {
+                        "content": "CONFLUENCE"
+                      },
+                      {
+                        "content": "DATABRICKS"
+                      },
+                      {
+                        "content": "DYNAMICS365"
+                      },
+                      {
+                        "content": "GA4_RAW_DATA"
+                      },
+                      {
+                        "content": "GITHUB"
+                      },
+                      {
+                        "content": "GLUE"
+                      },
+                      {
+                        "content": "HIVE_METASTORE"
+                      },
+                      {
+                        "content": "HTTP"
+                      },
+                      {
+                        "content": "HUBSPOT"
+                      },
+                      {
+                        "content": "JDBC"
+                      },
+                      {
+                        "content": "META_MARKETING"
+                      },
+                      {
+                        "content": "MYSQL"
+                      },
+                      {
+                        "content": "NETSUITE"
+                      },
+                      {
+                        "content": "ORACLE"
+                      },
+                      {
+                        "content": "OUTLOOK"
+                      },
+                      {
+                        "content": "POSTGRESQL"
+                      },
+                      {
+                        "content": "POWER_BI"
+                      },
+                      {
+                        "content": "REDSHIFT"
+                      },
+                      {
+                        "content": "SALESFORCE"
+                      },
+                      {
+                        "content": "SALESFORCE_DATA_CLOUD"
+                      },
+                      {
+                        "content": "SERVICENOW"
+                      },
+                      {
+                        "content": "SMARTSHEET"
+                      },
+                      {
+                        "content": "SNOWFLAKE"
+                      },
+                      {
+                        "content": "SQLDW"
+                      },
+                      {
+                        "content": "SQLSERVER"
+                      },
+                      {
+                        "content": "TERADATA"
+                      },
+                      {
+                        "content": "TIKTOK_ADS"
+                      },
+                      {
+                        "content": "UNKNOWN_CONNECTION_TYPE"
+                      },
+                      {
+                        "content": "WORKDAY_RAAS"
+                      },
+                      {
+                        "content": "ZENDESK"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "options",
+                  "description": "A map of key-value properties attached to the securable.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "map_value": {
+                      "is_string": true
+                    }
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ConnectionInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "comment",
+                "description": "User-provided free-form text description.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "connection_type",
+                "description": "The type of connection.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ConnectionType",
+                  "enum": [
+                    {
+                      "content": "AWS_SECRETS_MANAGER"
+                    },
+                    {
+                      "content": "AZURE_KEY_VAULT"
+                    },
+                    {
+                      "content": "BIGQUERY"
+                    },
+                    {
+                      "content": "CONFLUENCE"
+                    },
+                    {
+                      "content": "DATABRICKS"
+                    },
+                    {
+                      "content": "DYNAMICS365"
+                    },
+                    {
+                      "content": "GA4_RAW_DATA"
+                    },
+                    {
+                      "content": "GITHUB"
+                    },
+                    {
+                      "content": "GLUE"
+                    },
+                    {
+                      "content": "HIVE_METASTORE"
+                    },
+                    {
+                      "content": "HTTP"
+                    },
+                    {
+                      "content": "HUBSPOT"
+                    },
+                    {
+                      "content": "JDBC"
+                    },
+                    {
+                      "content": "META_MARKETING"
+                    },
+                    {
+                      "content": "MYSQL"
+                    },
+                    {
+                      "content": "NETSUITE"
+                    },
+                    {
+                      "content": "ORACLE"
+                    },
+                    {
+                      "content": "OUTLOOK"
+                    },
+                    {
+                      "content": "POSTGRESQL"
+                    },
+                    {
+                      "content": "POWER_BI"
+                    },
+                    {
+                      "content": "REDSHIFT"
+                    },
+                    {
+                      "content": "SALESFORCE"
+                    },
+                    {
+                      "content": "SALESFORCE_DATA_CLOUD"
+                    },
+                    {
+                      "content": "SERVICENOW"
+                    },
+                    {
+                      "content": "SMARTSHEET"
+                    },
+                    {
+                      "content": "SNOWFLAKE"
+                    },
+                    {
+                      "content": "SQLDW"
+                    },
+                    {
+                      "content": "SQLSERVER"
+                    },
+                    {
+                      "content": "TERADATA"
+                    },
+                    {
+                      "content": "TIKTOK_ADS"
+                    },
+                    {
+                      "content": "UNKNOWN_CONNECTION_TYPE"
+                    },
+                    {
+                      "content": "WORKDAY_RAAS"
+                    },
+                    {
+                      "content": "ZENDESK"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "environment_settings",
+                "description": "[Create,Update:OPT] Connection environment settings as EnvironmentSettings object.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "EnvironmentSettings",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the connection.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "options",
+                "description": "A map of key-value properties attached to the securable.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "parent",
+                "description": "Parent schema for schema-level connections, in format \"schemas/{catalog}.{schema}\".\nAbsent for metastore-level (L1) connections.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "properties",
+                "description": "A map of key-value properties attached to the securable.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "read_only",
+                "description": "If the connection is read only.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "secrets",
+                "description": "A map of option names to UC Secret references. Keys are connection option names\n(same as in OptionsKVPairs) and values are UC Secret fully qualified names.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes the connection that matches the supplied name.",
+            "summary": "Delete a connection.",
+            "path": "/api/2.1/unity-catalog/connections/{name}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteConnectionRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the connection to be deleted.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the connection to be deleted.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The name of the connection to be deleted.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the connection to be deleted.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets a connection from it's name.",
+            "summary": "Get a connection.",
+            "path": "/api/2.1/unity-catalog/connections/{name}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetConnectionRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the connection.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the connection.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ConnectionInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Name of the connection.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the connection.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "List all connections.\n\nNOTE: we recommend using max_results=0 to use the paginated version of this API. Unpaginated calls will be deprecated soon.\n\nPAGINATION BEHAVIOR: When using pagination (max_results \u003e= 0), a page may contain zero results while still providing a next_page_token.\nClients must continue reading pages until next_page_token is absent, which is the only indication that the end of results has been reached.",
+            "summary": "List connections.",
+            "path": "/api/2.1/unity-catalog/connections",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListConnectionsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListConnectionsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "max_results",
+                "description": "Maximum number of connections to return.\n- If not set, all connections are returned (not recommended).\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- when set to 0, the page length is set to a server configured value (recommended);\n- when set to a value less than 0, an invalid parameter error is returned;",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque pagination token to go to next page based on previous query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "Optional. Parent schema filter for listing schema-level connections, in format \"schemas/{catalog}.{schema}\".",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Opaque pagination token to go to next page based on previous query.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              },
+              "max_results": {
+                "name": "max_results",
+                "description": "Maximum number of connections to return.\n- If not set, all connections are returned (not recommended).\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- when set to 0, the page length is set to a server configured value (recommended);\n- when set to a value less than 0, an invalid parameter error is returned;",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              }
+            }
+          },
+          {
+            "name": "Update",
+            "description": "Updates the connection that matches the supplied name.",
+            "summary": "Update a connection.",
+            "path": "/api/2.1/unity-catalog/connections/{name}",
+            "can_use_json": true,
+            "must_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateConnection",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the connection.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "options",
+                  "description": "A map of key-value properties attached to the securable.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "map_value": {
+                      "is_string": true
+                    }
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the connection.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "options",
+                  "description": "A map of key-value properties attached to the securable.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "map_value": {
+                      "is_string": true
+                    }
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ConnectionInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "environment_settings",
+                "description": "[Create,Update:OPT] Connection environment settings as EnvironmentSettings object.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "EnvironmentSettings",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the connection.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "new_name",
+                "description": "New name for the connection.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "options",
+                "description": "A map of key-value properties attached to the securable.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "owner",
+                "description": "Username of current owner of the connection.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "secrets",
+                "description": "A map of option names to UC Secret references. Keys are connection option names\n(same as in OptionsKVPairs) and values are UC Secret fully qualified names.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the connection.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "marketplace.ConsumerFulfillments",
+        "name": "ConsumerFulfillments",
+        "description": "Fulfillments are entities that allow consumers to preview installations.",
+        "package": {
+          "name": "marketplace"
+        },
+        "docs_group": "marketplace",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "GetListingContentMetadataRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Get",
+            "description": "Get a high level preview of the metadata of listing installable content.",
+            "summary": "Get listing content metadata.",
+            "path": "/api/2.1/marketplace-consumer/listings/{listing_id}/content",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetListingContentMetadataRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "listing_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "listing_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetListingContentMetadataResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "listing_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "listing_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "List",
+            "description": "Get all listings fulfillments associated with a listing. A _fulfillment_ is a potential installation.\nStandard installations contain metadata about the attached share or git repo. Only one of these fields will be present.\nPersonalized installations contain metadata about the attached share or git repo, as well as the Delta Sharing recipient type.",
+            "summary": "List all listing fulfillments.",
+            "path": "/api/2.1/marketplace-consumer/listings/{listing_id}/fulfillments",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListFulfillmentsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "listing_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "listing_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListFulfillmentsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "listing_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "listing_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          }
+        ]
+      },
+      {
+        "id": "marketplace.ConsumerInstallations",
+        "name": "ConsumerInstallations",
+        "description": "Installations are entities that allow consumers to interact with Databricks Marketplace listings.",
+        "package": {
+          "name": "marketplace"
+        },
+        "docs_group": "marketplace",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListAllInstallationsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Install payload associated with a Databricks Marketplace listing.",
+            "summary": "Install from a listing.",
+            "path": "/api/2.1/marketplace-consumer/listings/{listing_id}/installations",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateInstallationRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "listing_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "listing_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Installation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "accepted_consumer_terms",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "ConsumerTerms",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "catalog_name",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "listing_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "recipient_type",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DeltaSharingRecipientType",
+                  "enum": [
+                    {
+                      "content": "DELTA_SHARING_RECIPIENT_TYPE_DATABRICKS"
+                    },
+                    {
+                      "content": "DELTA_SHARING_RECIPIENT_TYPE_OPEN"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "repo_detail",
+                "description": "for git repo installations",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "RepoInstallation",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "share_name",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "listing_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Uninstall an installation associated with a Databricks Marketplace listing.",
+            "summary": "Uninstall from a listing.",
+            "path": "/api/2.1/marketplace-consumer/listings/{listing_id}/installations/{installation_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteInstallationRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "listing_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "installation_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "listing_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "installation_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteInstallationResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "installation_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "listing_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "listing_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "installation_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "List all installations across all listings.",
+            "summary": "List all installations.",
+            "path": "/api/2.1/marketplace-consumer/installations",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListAllInstallationsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListAllInstallationsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListListingInstallations",
+            "description": "List all installations for a particular listing.",
+            "summary": "List installations for a listing.",
+            "path": "/api/2.1/marketplace-consumer/listings/{listing_id}/installations",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListInstallationsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "listing_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "listing_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListInstallationsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "listing_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "listing_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "Update",
+            "description": "This is a update API that will update the part of the fields defined in the installation table as well\nas interact with external services according to the fields not included in the installation table\n1. the token will be rotate if the rotateToken flag is true\n2. the token will be forcibly rotate if the rotateToken flag is true and the tokenInfo field is empty",
+            "summary": "Update an installation.",
+            "path": "/api/2.1/marketplace-consumer/listings/{listing_id}/installations/{installation_id}",
+            "can_use_json": true,
+            "must_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateInstallationRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "listing_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "installation_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "installation",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "InstallationDetail",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "listing_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "installation_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "installation",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "InstallationDetail",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "UpdateInstallationResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "installation",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "InstallationDetail",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "installation_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "listing_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "rotate_token",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "listing_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "installation_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "marketplace.ConsumerListings",
+        "name": "ConsumerListings",
+        "description": "Listings are the core entities in the Marketplace. They represent the products that are available for consumption.",
+        "package": {
+          "name": "marketplace"
+        },
+        "docs_group": "marketplace",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "named_id_map": {
+            "pascal_name": "ListingSummaryNameToIdMap"
+          },
+          "request": {
+            "pascal_name": "ListListingsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "BatchGet",
+            "description": "Batch get a published listing in the Databricks Marketplace that the consumer has access to.",
+            "summary": "Get one batch of listings. One may specify up to 50 IDs per request.",
+            "path": "/api/2.1/marketplace-consumer/listings:batchGet",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "BatchGetListingsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "BatchGetListingsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "ids",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Get a published listing in the Databricks Marketplace that the consumer has access to.",
+            "summary": "Get listing.",
+            "path": "/api/2.1/marketplace-consumer/listings/{id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetListingRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetListingResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "List all published listings in the Databricks Marketplace that the consumer has access to.",
+            "summary": "List listings.",
+            "path": "/api/2.1/marketplace-consumer/listings",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListListingsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListListingsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "assets",
+                "description": "Matches any of the following asset types",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "AssetTypeList",
+                  "array_value": {
+                    "pascal_name": "AssetType",
+                    "enum": [
+                      {
+                        "content": "ASSET_TYPE_APP"
+                      },
+                      {
+                        "content": "ASSET_TYPE_DATA_TABLE"
+                      },
+                      {
+                        "content": "ASSET_TYPE_GIT_REPO"
+                      },
+                      {
+                        "content": "ASSET_TYPE_MCP"
+                      },
+                      {
+                        "content": "ASSET_TYPE_MEDIA"
+                      },
+                      {
+                        "content": "ASSET_TYPE_MODEL"
+                      },
+                      {
+                        "content": "ASSET_TYPE_NOTEBOOK"
+                      },
+                      {
+                        "content": "ASSET_TYPE_PARTNER_INTEGRATION"
+                      }
+                    ]
+                  }
+                }
+              },
+              {
+                "name": "categories",
+                "description": "Matches any of the following categories",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "CategoryList",
+                  "array_value": {
+                    "pascal_name": "Category",
+                    "enum": [
+                      {
+                        "content": "ADVERTISING_AND_MARKETING"
+                      },
+                      {
+                        "content": "CLIMATE_AND_ENVIRONMENT"
+                      },
+                      {
+                        "content": "COMMERCE"
+                      },
+                      {
+                        "content": "DEMOGRAPHICS"
+                      },
+                      {
+                        "content": "ECONOMICS"
+                      },
+                      {
+                        "content": "EDUCATION"
+                      },
+                      {
+                        "content": "ENERGY"
+                      },
+                      {
+                        "content": "FINANCIAL"
+                      },
+                      {
+                        "content": "GAMING"
+                      },
+                      {
+                        "content": "GEOSPATIAL"
+                      },
+                      {
+                        "content": "HEALTH"
+                      },
+                      {
+                        "content": "LOOKUP_TABLES"
+                      },
+                      {
+                        "content": "MANUFACTURING"
+                      },
+                      {
+                        "content": "MEDIA"
+                      },
+                      {
+                        "content": "OTHER"
+                      },
+                      {
+                        "content": "PUBLIC_SECTOR"
+                      },
+                      {
+                        "content": "RETAIL"
+                      },
+                      {
+                        "content": "SCIENCE_AND_RESEARCH"
+                      },
+                      {
+                        "content": "SECURITY"
+                      },
+                      {
+                        "content": "SPORTS"
+                      },
+                      {
+                        "content": "TRANSPORTATION_AND_LOGISTICS"
+                      },
+                      {
+                        "content": "TRAVEL_AND_TOURISM"
+                      }
+                    ]
+                  }
+                }
+              },
+              {
+                "name": "is_free",
+                "description": "Filters each listing based on if it is free.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "is_private_exchange",
+                "description": "Filters each listing based on if it is a private exchange.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "is_staff_pick",
+                "description": "Filters each listing based on whether it is a staff pick.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "page_size",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "provider_ids",
+                "description": "Matches any of the following provider ids",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "tags",
+                "description": "Matches listings with this tag",
+                "is_query": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "ListingTag",
+                  "is_object": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "Search",
+            "description": "Search published listings in the Databricks Marketplace that the consumer has access to.\nThis query supports a variety of different search parameters and performs fuzzy matching.",
+            "summary": "Search listings.",
+            "path": "/api/2.1/marketplace-consumer/search-listings",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "SearchListingsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "query",
+                  "description": "Fuzzy matches query",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "query",
+                  "description": "Fuzzy matches query",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "SearchListingsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "assets",
+                "description": "Matches any of the following asset types",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "AssetTypeList",
+                  "array_value": {
+                    "pascal_name": "AssetType",
+                    "enum": [
+                      {
+                        "content": "ASSET_TYPE_APP"
+                      },
+                      {
+                        "content": "ASSET_TYPE_DATA_TABLE"
+                      },
+                      {
+                        "content": "ASSET_TYPE_GIT_REPO"
+                      },
+                      {
+                        "content": "ASSET_TYPE_MCP"
+                      },
+                      {
+                        "content": "ASSET_TYPE_MEDIA"
+                      },
+                      {
+                        "content": "ASSET_TYPE_MODEL"
+                      },
+                      {
+                        "content": "ASSET_TYPE_NOTEBOOK"
+                      },
+                      {
+                        "content": "ASSET_TYPE_PARTNER_INTEGRATION"
+                      }
+                    ]
+                  }
+                }
+              },
+              {
+                "name": "categories",
+                "description": "Matches any of the following categories",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "CategoryList",
+                  "array_value": {
+                    "pascal_name": "Category",
+                    "enum": [
+                      {
+                        "content": "ADVERTISING_AND_MARKETING"
+                      },
+                      {
+                        "content": "CLIMATE_AND_ENVIRONMENT"
+                      },
+                      {
+                        "content": "COMMERCE"
+                      },
+                      {
+                        "content": "DEMOGRAPHICS"
+                      },
+                      {
+                        "content": "ECONOMICS"
+                      },
+                      {
+                        "content": "EDUCATION"
+                      },
+                      {
+                        "content": "ENERGY"
+                      },
+                      {
+                        "content": "FINANCIAL"
+                      },
+                      {
+                        "content": "GAMING"
+                      },
+                      {
+                        "content": "GEOSPATIAL"
+                      },
+                      {
+                        "content": "HEALTH"
+                      },
+                      {
+                        "content": "LOOKUP_TABLES"
+                      },
+                      {
+                        "content": "MANUFACTURING"
+                      },
+                      {
+                        "content": "MEDIA"
+                      },
+                      {
+                        "content": "OTHER"
+                      },
+                      {
+                        "content": "PUBLIC_SECTOR"
+                      },
+                      {
+                        "content": "RETAIL"
+                      },
+                      {
+                        "content": "SCIENCE_AND_RESEARCH"
+                      },
+                      {
+                        "content": "SECURITY"
+                      },
+                      {
+                        "content": "SPORTS"
+                      },
+                      {
+                        "content": "TRANSPORTATION_AND_LOGISTICS"
+                      },
+                      {
+                        "content": "TRAVEL_AND_TOURISM"
+                      }
+                    ]
+                  }
+                }
+              },
+              {
+                "name": "is_free",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "is_private_exchange",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "page_size",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "provider_ids",
+                "description": "Matches any of the following provider ids",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "query",
+                "description": "Fuzzy matches query",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "query",
+                "description": "Fuzzy matches query",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          }
+        ]
+      },
+      {
+        "id": "marketplace.ConsumerPersonalizationRequests",
+        "name": "ConsumerPersonalizationRequests",
+        "description": "Personalization Requests allow customers to interact with the individualized Marketplace listing flow.",
+        "package": {
+          "name": "marketplace"
+        },
+        "docs_group": "marketplace",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListAllPersonalizationRequestsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Create a personalization request for a listing.",
+            "summary": "Create a personalization request.",
+            "path": "/api/2.1/marketplace-consumer/listings/{listing_id}/personalization-requests",
+            "can_use_json": true,
+            "must_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreatePersonalizationRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "listing_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "intended_use",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "accepted_consumer_terms",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ConsumerTerms",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "listing_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "intended_use",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "accepted_consumer_terms",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ConsumerTerms",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CreatePersonalizationRequestResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "accepted_consumer_terms",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ConsumerTerms",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "comment",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "company",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "first_name",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "intended_use",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "is_from_lighthouse",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "last_name",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "listing_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "recipient_type",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DeltaSharingRecipientType",
+                  "enum": [
+                    {
+                      "content": "DELTA_SHARING_RECIPIENT_TYPE_DATABRICKS"
+                    },
+                    {
+                      "content": "DELTA_SHARING_RECIPIENT_TYPE_OPEN"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "listing_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Get the personalization request for a listing. Each consumer can make at *most* one personalization request for a listing.",
+            "summary": "Get the personalization request for a listing.",
+            "path": "/api/2.1/marketplace-consumer/listings/{listing_id}/personalization-requests",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetPersonalizationRequestRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "listing_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "listing_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetPersonalizationRequestResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "listing_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "listing_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "List personalization requests for a consumer across all listings.",
+            "summary": "List all personalization requests.",
+            "path": "/api/2.1/marketplace-consumer/personalization-requests",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListAllPersonalizationRequestsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListAllPersonalizationRequestsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          }
+        ]
+      },
+      {
+        "id": "marketplace.ConsumerProviders",
+        "name": "ConsumerProviders",
+        "description": "Providers are the entities that publish listings to the Marketplace.",
+        "package": {
+          "name": "marketplace"
+        },
+        "docs_group": "marketplace",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "named_id_map": {
+            "pascal_name": "ProviderInfoNameToIdMap"
+          },
+          "request": {
+            "pascal_name": "ListConsumerProvidersRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "BatchGet",
+            "description": "Batch get a provider in the Databricks Marketplace with at least one visible listing.",
+            "summary": "Get one batch of providers. One may specify up to 50 IDs per request.",
+            "path": "/api/2.1/marketplace-consumer/providers:batchGet",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "BatchGetProvidersRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "BatchGetProvidersResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "ids",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Get a provider in the Databricks Marketplace with at least one visible listing.",
+            "summary": "Get a provider.",
+            "path": "/api/2.1/marketplace-consumer/providers/{id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetProviderRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetProviderResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "List all providers in the Databricks Marketplace with at least one visible listing.",
+            "summary": "List providers.",
+            "path": "/api/2.1/marketplace-consumer/providers",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListConsumerProvidersRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListProvidersResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "is_featured",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "page_size",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          }
+        ]
+      },
+      {
+        "id": "catalog.Credentials",
+        "name": "Credentials",
+        "description": "A credential represents an authentication and authorization mechanism for accessing services on your cloud tenant. Each credential is subject to Unity Catalog access-control policies that control which users and groups can access the credential.\n\nTo create credentials, you must be a Databricks account admin or have the `CREATE SERVICE CREDENTIAL` privilege. The user who creates the credential can delegate ownership to another user or group to manage permissions on it.",
+        "package": {
+          "name": "catalog"
+        },
+        "docs_group": "catalog",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListCredentialsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "CreateCredential",
+            "description": "Creates a new credential. The type of credential to be created is determined by the **purpose** field,\nwhich should be either **SERVICE** or **STORAGE**.\n\nThe caller must be a metastore admin or have the metastore privilege **CREATE_STORAGE_CREDENTIAL** for storage\ncredentials, or **CREATE_SERVICE_CREDENTIAL** for service credentials.",
+            "summary": "Create a credential.",
+            "path": "/api/2.1/unity-catalog/credentials",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateCredentialRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The credential name. The name must be unique among storage and service\ncredentials within the metastore.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "The credential name. The name must be unique among storage and service\ncredentials within the metastore.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CredentialInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "aws_iam_role",
+                "description": "The AWS IAM role configuration.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AwsIamRole",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "azure_managed_identity",
+                "description": "The Azure managed identity configuration.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AzureManagedIdentity",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "azure_service_principal",
+                "description": "The Azure service principal configuration.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AzureServicePrincipal",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "comment",
+                "description": "Comment associated with the credential.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "databricks_gcp_service_account",
+                "description": "The Databricks managed GCP service account configuration.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "DatabricksGcpServiceAccount",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The credential name. The name must be unique among storage and service\ncredentials within the metastore.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "purpose",
+                "description": "Indicates the purpose of the credential.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CredentialPurpose",
+                  "enum": [
+                    {
+                      "content": "SERVICE"
+                    },
+                    {
+                      "content": "STORAGE"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "read_only",
+                "description": "Whether the credential is usable only for read operations. Only applicable\nwhen purpose is **STORAGE**.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "skip_validation",
+                "description": "Optional. Supplying true to this argument skips validation of the created\nset of credentials.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The credential name. The name must be unique among storage and service\ncredentials within the metastore.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteCredential",
+            "description": "Deletes a service or storage credential from the metastore. The caller must be an owner of the credential.",
+            "summary": "Delete a credential.",
+            "path": "/api/2.1/unity-catalog/credentials/{name_arg}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteCredentialRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name_arg",
+                  "description": "Name of the credential.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name_arg",
+                  "description": "Name of the credential.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteCredentialResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "force",
+                "description": "Force an update even if there are dependent services (when purpose is\n**SERVICE**) or dependent external locations and external tables (when\npurpose is **STORAGE**).",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "name_arg",
+                "description": "Name of the credential.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name_arg",
+                "description": "Name of the credential.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GenerateTemporaryServiceCredential",
+            "description": "Returns a set of temporary credentials generated using the specified service credential.\nThe caller must be a metastore admin or have the metastore privilege **ACCESS** on the service credential.",
+            "summary": "Generate a temporary service credential.",
+            "path": "/api/2.1/unity-catalog/temporary-service-credentials",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GenerateTemporaryServiceCredentialRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "credential_name",
+                  "description": "The name of the service credential used to generate a temporary credential",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "credential_name",
+                  "description": "The name of the service credential used to generate a temporary credential",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "TemporaryCredentials",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "azure_options",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "GenerateTemporaryServiceCredentialAzureOptions",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "credential_name",
+                "description": "The name of the service credential used to generate a temporary credential",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "gcp_options",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "GenerateTemporaryServiceCredentialGcpOptions",
+                  "is_object": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "credential_name",
+                "description": "The name of the service credential used to generate a temporary credential",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetCredential",
+            "description": "Gets a service or storage credential from the metastore.\nThe caller must be a metastore admin, the owner of the credential, or have any permission on the credential.",
+            "summary": "Get a credential.",
+            "path": "/api/2.1/unity-catalog/credentials/{name_arg}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetCredentialRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name_arg",
+                  "description": "Name of the credential.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name_arg",
+                  "description": "Name of the credential.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CredentialInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name_arg",
+                "description": "Name of the credential.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name_arg",
+                "description": "Name of the credential.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListCredentials",
+            "description": "Gets an array of credentials (as __CredentialInfo__ objects).\n\nThe array is limited to only the credentials that the caller has permission to access.\nIf the caller is a metastore admin, retrieval of credentials is unrestricted.\nThere is no guarantee of a specific ordering of the elements in the array.\n\nPAGINATION BEHAVIOR: The API is by default paginated, a page may contain zero results while still providing a next_page_token.\nClients must continue reading pages until next_page_token is absent, which is the only indication that the end of results has been reached.",
+            "summary": "List credentials.",
+            "path": "/api/2.1/unity-catalog/credentials",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListCredentialsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListCredentialsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "include_unbound",
+                "description": "Whether to include credentials not bound to the workspace.\nEffective only if the user has permission to update the credential–workspace binding.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "max_results",
+                "description": "Maximum number of credentials to return.\n- If not set, the default max page size is used.\n- When set to a value greater than 0, the page length is the minimum of\nthis value and a server-configured value.\n- When set to 0, the page length is set to a server-configured value\n(recommended).\n- When set to a value less than 0, an invalid parameter error is\nreturned.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque token to retrieve the next page of results.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "purpose",
+                "description": "Return only credentials for the specified purpose.",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "CredentialPurpose",
+                  "enum": [
+                    {
+                      "content": "SERVICE"
+                    },
+                    {
+                      "content": "STORAGE"
+                    }
+                  ]
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Opaque token to retrieve the next page of results.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "UpdateCredential",
+            "description": "Updates a service or storage credential on the metastore.\n\nThe caller must be the owner of the credential or a metastore admin or have the `MANAGE` permission. If the caller is\na metastore admin, only the __owner__ field can be changed.",
+            "summary": "Update a credential.",
+            "path": "/api/2.1/unity-catalog/credentials/{name_arg}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateCredentialRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name_arg",
+                  "description": "Name of the credential.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name_arg",
+                  "description": "Name of the credential.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CredentialInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "aws_iam_role",
+                "description": "The AWS IAM role configuration.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AwsIamRole",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "azure_managed_identity",
+                "description": "The Azure managed identity configuration.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AzureManagedIdentity",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "azure_service_principal",
+                "description": "The Azure service principal configuration.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AzureServicePrincipal",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "comment",
+                "description": "Comment associated with the credential.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "databricks_gcp_service_account",
+                "description": "The Databricks managed GCP service account configuration.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "DatabricksGcpServiceAccount",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "force",
+                "description": "Force an update even if there are dependent services (when purpose is\n**SERVICE**) or dependent external locations and external tables (when\npurpose is **STORAGE**).",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "isolation_mode",
+                "description": "Whether the current securable is accessible from all workspaces or a\nspecific set of workspaces.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "IsolationMode",
+                  "enum": [
+                    {
+                      "content": "ISOLATION_MODE_ISOLATED"
+                    },
+                    {
+                      "content": "ISOLATION_MODE_OPEN"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "name_arg",
+                "description": "Name of the credential.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "new_name",
+                "description": "New name of credential.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "owner",
+                "description": "Username of current owner of credential.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "read_only",
+                "description": "Whether the credential is usable only for read operations. Only applicable\nwhen purpose is **STORAGE**.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "skip_validation",
+                "description": "Supply true to this argument to skip validation of the updated credential.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name_arg",
+                "description": "Name of the credential.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ValidateCredential",
+            "description": "Validates a credential.\n\nFor service credentials (purpose is **SERVICE**), either the __credential_name__ or the cloud-specific credential\nmust be provided.\n\nFor storage credentials (purpose is **STORAGE**), at least one of __external_location_name__ and __url__ need to be\nprovided. If only one of them is provided, it will be used for validation. And if both are provided, the __url__\nwill be used for validation, and __external_location_name__ will be ignored when checking overlapping urls. Either\nthe __credential_name__ or the cloud-specific credential must be provided.\n\nThe caller must be a metastore admin or the credential owner or have the required permission on the metastore and\nthe credential (e.g., **CREATE_EXTERNAL_LOCATION** when purpose is **STORAGE**).",
+            "summary": "Validate a credential.",
+            "path": "/api/2.1/unity-catalog/validate-credentials",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ValidateCredentialRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ValidateCredentialResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "aws_iam_role",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AwsIamRole",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "azure_managed_identity",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AzureManagedIdentity",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "credential_name",
+                "description": "Required. The name of an existing credential or long-lived cloud\ncredential to validate.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "databricks_gcp_service_account",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "DatabricksGcpServiceAccount",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "external_location_name",
+                "description": "The name of an existing external location to validate. Only applicable for\nstorage credentials (purpose is\n**STORAGE**.)",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "purpose",
+                "description": "The purpose of the credential. This should only be used when the credential\nis specified.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CredentialPurpose",
+                  "enum": [
+                    {
+                      "content": "SERVICE"
+                    },
+                    {
+                      "content": "STORAGE"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "read_only",
+                "description": "Whether the credential is only usable for read operations. Only applicable\nfor storage credentials (purpose is\n**STORAGE**.)",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "url",
+                "description": "The external location url to validate. Only applicable when purpose is\n**STORAGE**.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "provisioning.Credentials",
+        "name": "Credentials",
+        "description": "These APIs manage credential configurations for this workspace. Databricks needs access to\na cross-account service IAM role in your AWS account so that Databricks can deploy clusters\nin the appropriate VPC for the new workspace. A credential configuration encapsulates this\nrole information, and its ID is used when creating a new workspace.",
+        "package": {
+          "name": "provisioning"
+        },
+        "is_accounts": true,
+        "docs_group": "provisioning",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a Databricks credential configuration that represents cloud cross-account credentials for a specified account. Databricks uses this to set up network infrastructure properly to host Databricks clusters. For your AWS IAM role, you need to trust the External ID (the Databricks Account API account ID)  in the returned credential object, and configure the required access policy.\n\nSave the response's `credentials_id` field, which is the ID for your new credential configuration object.\n\nFor information about how to create a new workspace with this API, see [Create a new workspace using the Account API](http://docs.databricks.com/administration-guide/account-api/new-workspace.html)",
+            "summary": "Create credential configuration.",
+            "path": "/api/2.0/accounts/{account_id}/credentials",
+            "can_use_json": true,
+            "must_use_json": true,
+            "is_crud_create": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateCredentialRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "credentials_name",
+                  "description": "The human-readable name of the credential configuration object.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "aws_credentials",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CreateCredentialAwsCredentials",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "credentials_name",
+                  "description": "The human-readable name of the credential configuration object.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "aws_credentials",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CreateCredentialAwsCredentials",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Credential",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "aws_credentials",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CreateCredentialAwsCredentials",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "credentials_name",
+                "description": "The human-readable name of the credential configuration object.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes a Databricks credential configuration object for an account, both specified by ID. You cannot delete a credential that is associated with any workspace.",
+            "summary": "Delete credential configuration.",
+            "path": "/api/2.0/accounts/{account_id}/credentials/{credentials_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteCredentialRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "credentials_id",
+                  "description": "Databricks Account API credential configuration ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "credentials_id",
+                  "description": "Databricks Account API credential configuration ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Credential",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "credentials_id",
+                "description": "Databricks Account API credential configuration ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "credentials_id",
+                "description": "Databricks Account API credential configuration ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets a Databricks credential configuration object for an account, both specified by ID.",
+            "summary": "Get credential configuration.",
+            "path": "/api/2.0/accounts/{account_id}/credentials/{credentials_id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetCredentialRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "credentials_id",
+                  "description": "Credential configuration ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "credentials_id",
+                  "description": "Credential configuration ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Credential",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "credentials_id",
+                "description": "Credential configuration ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "credentials_id",
+                "description": "Credential configuration ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "List Databricks credential configuration objects for an account, specified by ID.",
+            "summary": "List credential configuration.",
+            "path": "/api/2.0/accounts/{account_id}/credentials",
+            "is_legacy_empty_request": true,
+            "is_crud_read": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListCredentialsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "CredentialList",
+              "array_value": {
+                "pascal_name": "Credential",
+                "is_object": true
+              }
+            }
+          }
+        ]
+      },
+      {
+        "id": "settings.CredentialsManager",
+        "name": "CredentialsManager",
+        "description": "Credentials manager interacts with with Identity Providers to to perform token exchanges\nusing stored credentials and refresh tokens.",
+        "package": {
+          "name": "settings"
+        },
+        "is_hidden_cli": true,
+        "docs_group": "settings",
+        "launch_stage": "PRIVATE_PREVIEW",
+        "cli_launch_stage_display": "Private Preview",
+        "methods": [
+          {
+            "name": "ExchangeToken",
+            "description": "Exchange tokens with an Identity Provider to get a new access token. It allows\nspecifying scopes to determine token permissions.\n\nPOST /exchange-tokens/token is the documented public form, expressed via\n`google.api.http` below. GET /exchange-tokens/$exchange is a legacy alias\nused by the Spark driver's OAuth refresh path (DBHttpClient#get sends a body\nvia HttpGetWithEntity) and stays on the legacy `option (rpc).endpoints`\nannotation: its path contains a literal `$`, which `google.api.http`'s\nLITERAL grammar does not allow, and `HttpPathParser` does not percent-decode\ntemplate segments (so encoding as `%24exchange` would not match the literal\n`$exchange` path the Spark driver sends). Per-endpoint\n`visibility: PUBLIC_UNDOCUMENTED` preserves the DECO-7732 intent of\nsuppressing the GET alias from the public API spec.",
+            "summary": "Exchange token.",
+            "path": "/api/2.0/credentials-manager/exchange-tokens/token",
+            "can_use_json": true,
+            "must_use_json": true,
+            "is_hidden_cli": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "ExchangeTokenRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "partitionId",
+                  "description": "The partition of Credentials store",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PartitionId",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "tokenType",
+                  "description": "A list of token types being requested",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "TokenTypeList",
+                    "array_value": {
+                      "pascal_name": "TokenType",
+                      "enum": [
+                        {
+                          "content": "ARCLIGHT_AZURE_EXCHANGE_TOKEN"
+                        },
+                        {
+                          "content": "ARCLIGHT_AZURE_EXCHANGE_TOKEN_WITH_USER_DELEGATION_KEY"
+                        },
+                        {
+                          "content": "ARCLIGHT_MULTI_TENANT_AZURE_EXCHANGE_TOKEN"
+                        },
+                        {
+                          "content": "ARCLIGHT_MULTI_TENANT_AZURE_EXCHANGE_TOKEN_WITH_USER_DELEGATION_KEY"
+                        },
+                        {
+                          "content": "AZURE_ACTIVE_DIRECTORY_TOKEN"
+                        }
+                      ]
+                    }
+                  }
+                },
+                {
+                  "name": "scopes",
+                  "description": "Array of scopes for the token request.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "List",
+                    "array_value": {
+                      "is_string": true
+                    }
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "partitionId",
+                  "description": "The partition of Credentials store",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PartitionId",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "tokenType",
+                  "description": "A list of token types being requested",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "TokenTypeList",
+                    "array_value": {
+                      "pascal_name": "TokenType",
+                      "enum": [
+                        {
+                          "content": "ARCLIGHT_AZURE_EXCHANGE_TOKEN"
+                        },
+                        {
+                          "content": "ARCLIGHT_AZURE_EXCHANGE_TOKEN_WITH_USER_DELEGATION_KEY"
+                        },
+                        {
+                          "content": "ARCLIGHT_MULTI_TENANT_AZURE_EXCHANGE_TOKEN"
+                        },
+                        {
+                          "content": "ARCLIGHT_MULTI_TENANT_AZURE_EXCHANGE_TOKEN_WITH_USER_DELEGATION_KEY"
+                        },
+                        {
+                          "content": "AZURE_ACTIVE_DIRECTORY_TOKEN"
+                        }
+                      ]
+                    }
+                  }
+                },
+                {
+                  "name": "scopes",
+                  "description": "Array of scopes for the token request.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "List",
+                    "array_value": {
+                      "is_string": true
+                    }
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ExchangeTokenResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "partitionId",
+                "description": "The partition of Credentials store",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PartitionId",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "scopes",
+                "description": "Array of scopes for the token request.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "tokenType",
+                "description": "A list of token types being requested",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "TokenTypeList",
+                  "array_value": {
+                    "pascal_name": "TokenType",
+                    "enum": [
+                      {
+                        "content": "ARCLIGHT_AZURE_EXCHANGE_TOKEN"
+                      },
+                      {
+                        "content": "ARCLIGHT_AZURE_EXCHANGE_TOKEN_WITH_USER_DELEGATION_KEY"
+                      },
+                      {
+                        "content": "ARCLIGHT_MULTI_TENANT_AZURE_EXCHANGE_TOKEN"
+                      },
+                      {
+                        "content": "ARCLIGHT_MULTI_TENANT_AZURE_EXCHANGE_TOKEN_WITH_USER_DELEGATION_KEY"
+                      },
+                      {
+                        "content": "AZURE_ACTIVE_DIRECTORY_TOKEN"
+                      }
+                    ]
+                  }
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "settings.CspEnablementAccount",
+        "name": "CspEnablementAccount",
+        "description": "The compliance security profile settings at the account level control whether to enable it for new workspaces.\nBy default, this account-level setting is disabled for new workspaces. After workspace creation, account admins can enable the compliance security profile individually for each workspace.\n\nThis settings can be disabled so that new workspaces do not have compliance security profile enabled by default.",
+        "package": {
+          "name": "settings"
+        },
+        "is_accounts": true,
+        "has_parent": true,
+        "docs_group": "settings",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "parent_service_id": "settings.AccountSettings",
+        "methods": [
+          {
+            "name": "Get",
+            "description": "Gets the compliance security profile setting for new workspaces.",
+            "summary": "Get the compliance security profile setting for new workspaces.",
+            "path": "/api/2.0/accounts/{account_id}/settings/types/shield_csp_enablement_ac/names/default",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetCspEnablementAccountSettingRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "CspEnablementAccountSetting",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "csp_enablement_account",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CspEnablementAccount",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "csp_enablement_account",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CspEnablementAccount",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Updates the value of the compliance security profile setting for new workspaces.",
+            "summary": "Update the compliance security profile setting for new workspaces.",
+            "path": "/api/2.0/accounts/{account_id}/settings/types/shield_csp_enablement_ac/names/default",
+            "can_use_json": true,
+            "must_use_json": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "UpdateCspEnablementAccountSettingRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CspEnablementAccountSetting",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CspEnablementAccountSetting",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CspEnablementAccountSetting",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "csp_enablement_account",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CspEnablementAccount",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "csp_enablement_account",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CspEnablementAccount",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "allow_missing",
+                "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "field_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "setting",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CspEnablementAccountSetting",
+                  "is_object": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "iam.CurrentUser",
+        "name": "CurrentUser",
+        "description": "This API allows retrieving information about currently authenticated user or\nservice principal.",
+        "package": {
+          "name": "iam"
+        },
+        "docs_group": "iam",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "methods": [
+          {
+            "name": "Me",
+            "description": "Get details about the current method caller's identity.",
+            "summary": "Get current user info.",
+            "path": "/api/2.0/preview/scim/v2/Me",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "MeRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "User",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "attributes",
+                "description": "Comma-separated list of attributes to return in response.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "excludedAttributes",
+                "description": "Comma-separated list of attributes to exclude in response.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "oauth2.CustomAppIntegration",
+        "name": "CustomAppIntegration",
+        "description": "These APIs enable administrators to manage custom OAuth app integrations, which is required for\nadding/using Custom OAuth App Integration like Tableau Cloud for Databricks in AWS cloud.",
+        "package": {
+          "name": "oauth2"
+        },
+        "is_accounts": true,
+        "docs_group": "oauth2",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListCustomAppIntegrationsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Create Custom OAuth App Integration.\n\nYou can retrieve the custom OAuth app integration via [CustomAppIntegration/get](https://docs.databricks.com/api/account/customappintegration/get).",
+            "summary": "Create Custom OAuth App Integration.",
+            "path": "/api/2.0/accounts/{account_id}/oauth2/custom-app-integrations",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateCustomAppIntegration",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "CreateCustomAppIntegrationOutput",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "confidential",
+                "description": "This field indicates whether an OAuth client secret is required to authenticate this client.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the custom OAuth app",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "redirect_urls",
+                "description": "List of OAuth redirect urls",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "scopes",
+                "description": "OAuth scopes granted to the application.\nSupported scopes: all-apis, sql, offline_access, openid, profile, email.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "token_access_policy",
+                "description": "Token access policy",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "TokenAccessPolicy",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "user_authorized_scopes",
+                "description": "Scopes that will need to be consented by end user to mint the access token. If the user does\nnot authorize the access token will not be minted.\nMust be a subset of scopes.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Delete an existing Custom OAuth App Integration.\nYou can retrieve the custom OAuth app integration via [CustomAppIntegration/get](https://docs.databricks.com/api/account/customappintegration/get).",
+            "summary": "Delete Custom OAuth App Integration.",
+            "path": "/api/2.0/accounts/{account_id}/oauth2/custom-app-integrations/{integration_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteCustomAppIntegrationRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "integration_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "integration_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteCustomAppIntegrationOutput",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "integration_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "integration_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets the Custom OAuth App Integration for the given integration id.",
+            "summary": "Get OAuth Custom App Integration.",
+            "path": "/api/2.0/accounts/{account_id}/oauth2/custom-app-integrations/{integration_id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetCustomAppIntegrationRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "integration_id",
+                  "description": "The OAuth app integration ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "integration_id",
+                  "description": "The OAuth app integration ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetCustomAppIntegrationOutput",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "integration_id",
+                "description": "The OAuth app integration ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "integration_id",
+                "description": "The OAuth app integration ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Get the list of custom OAuth app integrations for the specified Databricks account",
+            "summary": "Get custom oauth app integrations.",
+            "path": "/api/2.0/accounts/{account_id}/oauth2/custom-app-integrations",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListCustomAppIntegrationsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "GetCustomAppIntegrationsOutput",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "include_creator_username",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "page_size",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "Update",
+            "description": "Updates an existing custom OAuth App Integration.\nYou can retrieve the custom OAuth app integration via [CustomAppIntegration/get](https://docs.databricks.com/api/account/customappintegration/get).",
+            "summary": "Updates Custom OAuth App Integration.",
+            "path": "/api/2.0/accounts/{account_id}/oauth2/custom-app-integrations/{integration_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateCustomAppIntegration",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "integration_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "integration_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "UpdateCustomAppIntegrationOutput",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "integration_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "redirect_urls",
+                "description": "List of OAuth redirect urls to be updated in the custom OAuth app integration",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "scopes",
+                "description": "List of OAuth scopes to be updated in the custom OAuth app integration, similar to redirect URIs this will fully\nreplace the existing values instead of appending",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "token_access_policy",
+                "description": "Token access policy to be updated in the custom OAuth app integration",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "TokenAccessPolicy",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "user_authorized_scopes",
+                "description": "Scopes that will need to be consented by end user to mint the access token. If the user does\nnot authorize the access token will not be minted.\nMust be a subset of scopes.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "integration_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "settings.DashboardEmailSubscriptions",
+        "name": "DashboardEmailSubscriptions",
+        "description": "Controls whether schedules or workload tasks for refreshing AI/BI Dashboards in the workspace can send subscription emails containing PDFs and/or images of the dashboard. By default, this setting is enabled (set to `true`)",
+        "package": {
+          "name": "settings"
+        },
+        "has_parent": true,
+        "docs_group": "settings",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "parent_service_id": "settings.Settings",
+        "methods": [
+          {
+            "name": "Delete",
+            "description": "Reverts the Dashboard Email Subscriptions setting to its default value.",
+            "summary": "Delete the Dashboard Email Subscriptions setting.",
+            "path": "/api/2.0/settings/types/dashboard_email_subscriptions/names/default",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "DeleteDashboardEmailSubscriptionsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "DeleteDashboardEmailSubscriptionsResponse",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "etag",
+                  "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "etag",
+                  "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets the Dashboard Email Subscriptions setting.",
+            "summary": "Get the Dashboard Email Subscriptions setting.",
+            "path": "/api/2.0/settings/types/dashboard_email_subscriptions/names/default",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetDashboardEmailSubscriptionsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "DashboardEmailSubscriptions",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "boolean_val",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BooleanMessage",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "boolean_val",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BooleanMessage",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Updates the Dashboard Email Subscriptions setting.",
+            "summary": "Update the Dashboard Email Subscriptions setting.",
+            "path": "/api/2.0/settings/types/dashboard_email_subscriptions/names/default",
+            "can_use_json": true,
+            "must_use_json": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "UpdateDashboardEmailSubscriptionsRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DashboardEmailSubscriptions",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DashboardEmailSubscriptions",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DashboardEmailSubscriptions",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "boolean_val",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BooleanMessage",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "boolean_val",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BooleanMessage",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "allow_missing",
+                "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "field_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "setting",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DashboardEmailSubscriptions",
+                  "is_object": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "sql.DashboardWidgets",
+        "name": "DashboardWidgets",
+        "description": "This is an evolving API that facilitates the addition and removal of widgets from existing\ndashboards within the Databricks Workspace. Data structures may change over time.",
+        "package": {
+          "name": "sql"
+        },
+        "is_hidden_cli": true,
+        "docs_group": "sql",
+        "launch_stage": "PRIVATE_PREVIEW",
+        "cli_launch_stage_display": "Private Preview",
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Adds a widget to a dashboard",
+            "summary": "Add widget to a dashboard.",
+            "path": "/api/2.0/preview/sql/widgets",
+            "can_use_json": true,
+            "must_use_json": true,
+            "is_hidden_cli": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "CreateWidget",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "dashboard_id",
+                  "description": "Dashboard ID returned by :method:dashboards/create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "options",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "WidgetOptions",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "width",
+                  "description": "Width of a widget",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "dashboard_id",
+                  "description": "Dashboard ID returned by :method:dashboards/create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "options",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "WidgetOptions",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "width",
+                  "description": "Width of a widget",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Widget",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "dashboard_id",
+                "description": "Dashboard ID returned by :method:dashboards/create.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "options",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "WidgetOptions",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "text",
+                "description": "If this is a textbox widget, the application displays this text. This field is ignored if the widget contains a visualization in the `visualization` field.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "visualization_id",
+                "description": "Query Visualization ID returned by :method:queryvisualizations/create.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "width",
+                "description": "Width of a widget",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Removes a widget from a dashboard",
+            "summary": "Remove widget.",
+            "path": "/api/2.0/preview/sql/widgets/{id}",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "DeleteDashboardWidgetRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Widget ID returned by :method:dashboardwidgets/create",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "Widget ID returned by :method:dashboardwidgets/create",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "description": "Widget ID returned by :method:dashboardwidgets/create",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Widget ID returned by :method:dashboardwidgets/create",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Updates an existing widget",
+            "summary": "Update existing widget.",
+            "path": "/api/2.0/preview/sql/widgets/{id}",
+            "can_use_json": true,
+            "must_use_json": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "UpdateWidgetRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Widget ID returned by :method:dashboardwidgets/create",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "dashboard_id",
+                  "description": "Dashboard ID returned by :method:dashboards/create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "options",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "WidgetOptions",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "width",
+                  "description": "Width of a widget",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "Widget ID returned by :method:dashboardwidgets/create",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "dashboard_id",
+                  "description": "Dashboard ID returned by :method:dashboards/create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "options",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "WidgetOptions",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "width",
+                  "description": "Width of a widget",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Widget",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "dashboard_id",
+                "description": "Dashboard ID returned by :method:dashboards/create.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "id",
+                "description": "Widget ID returned by :method:dashboardwidgets/create",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "options",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "WidgetOptions",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "text",
+                "description": "If this is a textbox widget, the application displays this text. This field is ignored if the widget contains a visualization in the `visualization` field.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "visualization_id",
+                "description": "Query Visualization ID returned by :method:queryvisualizations/create.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "width",
+                "description": "Width of a widget",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Widget ID returned by :method:dashboardwidgets/create",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "sql.Dashboards",
+        "name": "Dashboards",
+        "description": "In general, there is little need to modify dashboards using the API. However, it can be\nuseful to use dashboard objects to look-up a collection of related query IDs. The API can\nalso be used to duplicate multiple dashboards at once since you can get a dashboard\ndefinition with a GET request and then POST it to create a new one.\nDashboards can be scheduled using the `sql_task` type of the Jobs API, e.g. :method:jobs/create.\n\n**Warning**: This API is deprecated. Please use the AI/BI Dashboards API instead. [Learn more](https://docs.databricks.com/en/dashboards/)",
+        "package": {
+          "name": "sql"
+        },
+        "docs_group": "sql",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "methods": [
+          {
+            "name": "Delete",
+            "description": "Moves a dashboard to the trash. Trashed dashboards do not appear in list views or searches, and cannot be shared.\n\n**Warning**: This API is deprecated. Please use the AI/BI Dashboards API instead. [Learn more](https://docs.databricks.com/en/dashboards/)",
+            "summary": "Remove a dashboard.",
+            "path": "/api/2.0/preview/sql/dashboards/{dashboard_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteDashboardRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "dashboard_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "dashboard_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "dashboard_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "dashboard_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Returns a JSON representation of a dashboard object, including its visualization and query objects.\n\n**Warning**: This API is deprecated. Please use the AI/BI Dashboards API instead. [Learn more](https://docs.databricks.com/en/dashboards/)",
+            "summary": "Retrieve a definition.",
+            "path": "/api/2.0/preview/sql/dashboards/{dashboard_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetDashboardRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "dashboard_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "dashboard_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Dashboard",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "dashboard_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "dashboard_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Fetch a paginated list of dashboard objects.\n\n**Warning**: Calling this API concurrently 10 or more times could result in throttling, service degradation, or a temporary ban.\n\n**Warning**: This API is deprecated. Please use the AI/BI Dashboards API instead. [Learn more](https://docs.databricks.com/en/dashboards/)",
+            "summary": "Get dashboard objects.",
+            "path": "/api/2.0/preview/sql/dashboards",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListDashboardsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "order",
+                "description": "Name of dashboard attribute to order by.",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "ListOrder",
+                  "enum": [
+                    {
+                      "content": "created_at"
+                    },
+                    {
+                      "content": "name"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "page",
+                "description": "Page number to retrieve.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "Number of dashboards to return per page.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "q",
+                "description": "Full text search term.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "offset": {
+                "name": "page",
+                "description": "Page number to retrieve.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              "limit": {
+                "name": "page_size",
+                "description": "Number of dashboards to return per page.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              }
+            }
+          },
+          {
+            "name": "Restore",
+            "description": "A restored dashboard appears in list views and searches and can be shared.\n\n**Warning**: This API is deprecated. Please use the AI/BI Dashboards API instead. [Learn more](https://docs.databricks.com/en/dashboards/)",
+            "summary": "Restore a dashboard.",
+            "path": "/api/2.0/preview/sql/dashboards/trash/{dashboard_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "RestoreDashboardRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "dashboard_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "dashboard_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "RestoreResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "dashboard_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "dashboard_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Modify this dashboard definition. This operation only affects attributes of the dashboard object. It does not add, modify, or remove widgets.\n\n**Note**: You cannot undo this operation.\n\n**Warning**: This API is deprecated. Please use the AI/BI Dashboards API instead. [Learn more](https://docs.databricks.com/en/dashboards/)",
+            "summary": "Change a dashboard definition.",
+            "path": "/api/2.0/preview/sql/dashboards/{dashboard_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DashboardEditContent",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "dashboard_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "dashboard_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Dashboard",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "dashboard_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The title of this dashboard that appears in list views and at the top of the dashboard page.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "run_as_role",
+                "description": "Sets the **Run as** role for the object. Must be set to one of `\"viewer\"` (signifying \"run as viewer\" behavior) or `\"owner\"` (signifying \"run as owner\" behavior)",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "RunAsRole",
+                  "enum": [
+                    {
+                      "content": "owner"
+                    },
+                    {
+                      "content": "viewer"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "tags",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "dashboard_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "dataclassification.DataClassification",
+        "name": "DataClassification",
+        "description": "Manage data classification for Unity Catalog catalogs.\nData classification automatically identifies and tags sensitive data (PII) in Unity Catalog tables.\nEach catalog can have at most one configuration resource that controls scanning behavior and auto-tagging rules.",
+        "package": {
+          "name": "dataclassification"
+        },
+        "docs_group": "dataclassification",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "methods": [
+          {
+            "name": "CreateCatalogConfig",
+            "description": "Create Data Classification configuration for a catalog.\n\nCreates a new config resource, which enables Data Classification\nfor the specified catalog.\n- The config must not already exist for the catalog.",
+            "summary": "Create config for a catalog.",
+            "path": "/api/data-classification/v1/{parent=catalogs/*}/config",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateCatalogConfigRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "Parent resource in the format: catalogs/{catalog_name}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "catalog_config",
+                  "description": "The configuration to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CatalogConfig",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "Parent resource in the format: catalogs/{catalog_name}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "catalog_config",
+                  "description": "The configuration to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CatalogConfig",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "catalog_config",
+              "description": "The configuration to create.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "CatalogConfig",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "CatalogConfig",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "catalog_config",
+                "description": "The configuration to create.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CatalogConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "Parent resource in the format: catalogs/{catalog_name}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "auto_tag_configs",
+                "description": "List of auto-tagging configurations for this catalog.\nEmpty list means no auto-tagging is enabled.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AutoTaggingConfigList",
+                  "array_value": {
+                    "pascal_name": "AutoTaggingConfig",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "excluded_schemas",
+                "description": "Schemas to exclude from the scan, each named relative to the parent catalog.\nIf specified, all schemas except the specified ones will be scanned.\nMutually exclusive with `included_schemas`: only one may be set per request.\nIf neither `included_schemas` nor `excluded_schemas` is set, all schemas are scanned.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CatalogConfigSchemaNames",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "included_schemas",
+                "description": "Schemas to include in the scan, each named relative to the parent catalog.\nIf specified, only listed schemas will be scanned.\nMutually exclusive with `excluded_schemas`: only one may be set per request.\nIf neither `included_schemas` nor `excluded_schemas` is set, all schemas are scanned.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CatalogConfigSchemaNames",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name in the format: catalogs/{catalog_name}/config.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "Parent resource in the format: catalogs/{catalog_name}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteCatalogConfig",
+            "description": "Delete Data Classification configuration for a catalog.",
+            "summary": "Delete config for a catalog.",
+            "path": "/api/data-classification/v1/{name=catalogs/*/config}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteCatalogConfigRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name in the format: catalogs/{catalog_name}/config",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name in the format: catalogs/{catalog_name}/config",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Resource name in the format: catalogs/{catalog_name}/config",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Resource name in the format: catalogs/{catalog_name}/config",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetCatalogConfig",
+            "description": "Get the Data Classification configuration for a catalog.",
+            "summary": "Get config for a catalog.",
+            "path": "/api/data-classification/v1/{name=catalogs/*/config}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetCatalogConfigRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name in the format: catalogs/{catalog_name}/config",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name in the format: catalogs/{catalog_name}/config",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CatalogConfig",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Resource name in the format: catalogs/{catalog_name}/config",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Resource name in the format: catalogs/{catalog_name}/config",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateCatalogConfig",
+            "description": "Update the Data Classification configuration for a catalog.\n- The config must already exist for the catalog.\n- Updates fields specified in the update_mask.  Use update_mask field to perform partial updates of the configuration.",
+            "summary": "Update config for a catalog.",
+            "path": "/api/data-classification/v1/{name=catalogs/*/config}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateCatalogConfigRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name in the format: catalogs/{catalog_name}/config.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "catalog_config",
+                  "description": "The configuration to apply to the catalog.\nThe name field in catalog_config identifies which resource to update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CatalogConfig",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Field mask specifying which fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name in the format: catalogs/{catalog_name}/config.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Field mask specifying which fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "catalog_config",
+                  "description": "The configuration to apply to the catalog.\nThe name field in catalog_config identifies which resource to update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CatalogConfig",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "catalog_config",
+              "description": "The configuration to apply to the catalog.\nThe name field in catalog_config identifies which resource to update.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "CatalogConfig",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "CatalogConfig",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "catalog_config",
+                "description": "The configuration to apply to the catalog.\nThe name field in catalog_config identifies which resource to update.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CatalogConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name in the format: catalogs/{catalog_name}/config.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Field mask specifying which fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "auto_tag_configs",
+                "description": "List of auto-tagging configurations for this catalog.\nEmpty list means no auto-tagging is enabled.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AutoTaggingConfigList",
+                  "array_value": {
+                    "pascal_name": "AutoTaggingConfig",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "excluded_schemas",
+                "description": "Schemas to exclude from the scan, each named relative to the parent catalog.\nIf specified, all schemas except the specified ones will be scanned.\nMutually exclusive with `included_schemas`: only one may be set per request.\nIf neither `included_schemas` nor `excluded_schemas` is set, all schemas are scanned.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CatalogConfigSchemaNames",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "included_schemas",
+                "description": "Schemas to include in the scan, each named relative to the parent catalog.\nIf specified, only listed schemas will be scanned.\nMutually exclusive with `excluded_schemas`: only one may be set per request.\nIf neither `included_schemas` nor `excluded_schemas` is set, all schemas are scanned.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CatalogConfigSchemaNames",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name in the format: catalogs/{catalog_name}/config.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Resource name in the format: catalogs/{catalog_name}/config.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Field mask specifying which fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "dataquality.DataQuality",
+        "name": "DataQuality",
+        "description": "Manage the data quality of Unity Catalog objects (currently support `schema` and `table`)",
+        "package": {
+          "name": "dataquality"
+        },
+        "docs_group": "dataquality",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "list": {
+          "request": {
+            "pascal_name": "ListMonitorRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "CancelRefresh",
+            "description": "Cancels a data quality monitor refresh. Currently only supported for the `table` `object_type`.\nThe call must be made in the same workspace as where the monitor was created.\n\nThe caller must have either of the following sets of permissions:\n1. **MANAGE** and **USE_CATALOG** on the table's parent catalog.\n2. **USE_CATALOG** on the table's parent catalog, and **MANAGE** and **USE_SCHEMA** on the table's parent schema.\n3. **USE_CATALOG** on the table's parent catalog, **USE_SCHEMA** on the table's parent schema, and **MANAGE** on the table.",
+            "summary": "Cancel a refresh.",
+            "path": "/api/data-quality/v1/monitors/{object_type}/{object_id}/refreshes/{refresh_id}/cancel",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "CancelRefreshRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "refresh_id",
+                  "description": "Unique id of the refresh operation.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "refresh_id",
+                  "description": "Unique id of the refresh operation.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CancelRefreshResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "object_id",
+                "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_type",
+                "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "refresh_id",
+                "description": "Unique id of the refresh operation.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "object_type",
+                "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_id",
+                "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "refresh_id",
+                "description": "Unique id of the refresh operation.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateMonitor",
+            "description": "Create a data quality monitor on a Unity Catalog object. The caller must provide either `anomaly_detection_config` for a schema monitor or `data_profiling_config` for a table monitor.\n\nFor the `table` `object_type`, the caller must have either of the following sets of permissions:\n1. **MANAGE** and **USE_CATALOG** on the table's parent catalog, **USE_SCHEMA** on the table's parent schema, and **SELECT** on the table\n2. **USE_CATALOG** on the table's parent catalog, **MANAGE** and **USE_SCHEMA** on the table's parent schema, and **SELECT** on the table.\n3. **USE_CATALOG** on the table's parent catalog, **USE_SCHEMA** on the table's parent schema, and **MANAGE** and **SELECT** on the table.\n\nWorkspace assets, such as the dashboard, will be created in the workspace where this call was made.\n\nFor the `schema` `object_type`, the caller must have either of the following sets of permissions:\n1. **MANAGE** and **USE_CATALOG** on the schema's parent catalog.\n2. **USE_CATALOG** on the schema's parent catalog, and **MANAGE** and **USE_SCHEMA** on the schema.",
+            "summary": "Create a monitor.",
+            "path": "/api/data-quality/v1/monitors",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "CreateMonitorRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "monitor",
+                  "description": "The monitor to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Monitor",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "monitor",
+                  "description": "The monitor to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Monitor",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "monitor",
+              "description": "The monitor to create.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Monitor",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "object_type",
+                    "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "object_id",
+                    "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "object_type",
+                    "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "object_id",
+                    "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "Monitor",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "monitor",
+                "description": "The monitor to create.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Monitor",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "object_type",
+                      "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "object_id",
+                      "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "object_type",
+                      "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "object_id",
+                      "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "anomaly_detection_config",
+                "description": "Anomaly Detection Configuration, applicable to `schema` object types.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AnomalyDetectionConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "data_profiling_config",
+                "description": "Data Profiling Configuration, applicable to `table` object types. Exactly one `Analysis Configuration`\nmust be present.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "DataProfilingConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "object_id",
+                "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_type",
+                "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "object_type",
+                "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_id",
+                "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateRefresh",
+            "description": "Creates a refresh. Currently only supported for the `table` `object_type`.\nThe call must be made in the same workspace as where the monitor was created.\n\nThe caller must have either of the following sets of permissions:\n1. **MANAGE** and **USE_CATALOG** on the table's parent catalog.\n2. **USE_CATALOG** on the table's parent catalog, and **MANAGE** and **USE_SCHEMA** on the table's parent schema.\n3. **USE_CATALOG** on the table's parent catalog, **USE_SCHEMA** on the table's parent schema, and **MANAGE** on the table.",
+            "summary": "Create a refresh.",
+            "path": "/api/data-quality/v1/monitors/{object_type}/{object_id}/refreshes",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "CreateRefreshRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "refresh",
+                  "description": "The refresh to create",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Refresh",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "refresh",
+                  "description": "The refresh to create",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Refresh",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "refresh",
+              "description": "The refresh to create",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Refresh",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "object_type",
+                    "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "object_id",
+                    "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "object_type",
+                    "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "object_id",
+                    "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "Refresh",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "object_id",
+                "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_type",
+                "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "refresh",
+                "description": "The refresh to create",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Refresh",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "object_type",
+                      "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "object_id",
+                      "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "object_type",
+                      "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "object_id",
+                      "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "end_time_ms",
+                "description": "Time when the refresh ended (milliseconds since 1/1/1970 UTC).",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "message",
+                "description": "An optional message to give insight into the current state of the refresh (e.g. FAILURE messages).",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_id",
+                "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_type",
+                "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "refresh_id",
+                "description": "Unique id of the refresh operation.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "start_time_ms",
+                "description": "Time when the refresh started (milliseconds since 1/1/1970 UTC).",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "state",
+                "description": "The current state of the refresh.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "RefreshState",
+                  "enum": [
+                    {
+                      "content": "MONITOR_REFRESH_STATE_CANCELED"
+                    },
+                    {
+                      "content": "MONITOR_REFRESH_STATE_FAILED"
+                    },
+                    {
+                      "content": "MONITOR_REFRESH_STATE_PENDING"
+                    },
+                    {
+                      "content": "MONITOR_REFRESH_STATE_RUNNING"
+                    },
+                    {
+                      "content": "MONITOR_REFRESH_STATE_SUCCESS"
+                    },
+                    {
+                      "content": "MONITOR_REFRESH_STATE_UNKNOWN"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "trigger",
+                "description": "What triggered the refresh.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "RefreshTrigger",
+                  "enum": [
+                    {
+                      "content": "MONITOR_REFRESH_TRIGGER_DATA_CHANGE"
+                    },
+                    {
+                      "content": "MONITOR_REFRESH_TRIGGER_MANUAL"
+                    },
+                    {
+                      "content": "MONITOR_REFRESH_TRIGGER_SCHEDULE"
+                    },
+                    {
+                      "content": "MONITOR_REFRESH_TRIGGER_UNKNOWN"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "object_type",
+                "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_id",
+                "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteMonitor",
+            "description": "Delete a data quality monitor on Unity Catalog object.\n\nFor the `table` `object_type`, the caller must have either of the following sets of permissions:\n**MANAGE** and **USE_CATALOG** on the table's parent catalog.\n**USE_CATALOG** on the table's parent catalog, and **MANAGE** and **USE_SCHEMA** on the table's parent schema.\n**USE_CATALOG** on the table's parent catalog, **USE_SCHEMA** on the table's parent schema, and **MANAGE** on the table.\n\nNote that the metric tables and dashboard will not be deleted as part of this call; those\nassets must be manually cleaned up (if desired).\n\nFor the `schema` `object_type`, the caller must have either of the following sets of permissions:\n1. **MANAGE** and **USE_CATALOG** on the schema's parent catalog.\n2. **USE_CATALOG** on the schema's parent catalog, and **MANAGE** and **USE_SCHEMA** on the schema.",
+            "summary": "Delete a monitor.",
+            "path": "/api/data-quality/v1/monitors/{object_type}/{object_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "DeleteMonitorRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "object_id",
+                "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_type",
+                "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "object_type",
+                "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_id",
+                "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteRefresh",
+            "description": "(Unimplemented) Delete a refresh",
+            "summary": "Delete a refresh.",
+            "path": "/api/data-quality/v1/monitors/{object_type}/{object_id}/refreshes/{refresh_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "DeleteRefreshRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "refresh_id",
+                  "description": "Unique id of the refresh operation.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "refresh_id",
+                  "description": "Unique id of the refresh operation.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "object_id",
+                "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_type",
+                "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "refresh_id",
+                "description": "Unique id of the refresh operation.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "object_type",
+                "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_id",
+                "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "refresh_id",
+                "description": "Unique id of the refresh operation.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetMonitor",
+            "description": "Read a data quality monitor on a Unity Catalog object.\n\nFor the `table` `object_type`, the caller must have either of the following sets of permissions:\n1. **MANAGE** and **USE_CATALOG** on the table's parent catalog.\n2. **USE_CATALOG** on the table's parent catalog, and **MANAGE** and **USE_SCHEMA** on the table's parent schema.\n3. **USE_CATALOG** on the table's parent catalog, **USE_SCHEMA** on the table's parent schema, and **SELECT** on the table.\n\nFor the `schema` `object_type`, the caller must have either of the following sets of permissions:\n1. **MANAGE** and **USE_CATALOG** on the schema's parent catalog.\n2. **USE_CATALOG** on the schema's parent catalog, and **USE_SCHEMA** on the schema.\n\nThe returned information includes configuration values on the entity and parent entity as well as information on\nassets created by the monitor. Some information (e.g. dashboard) may be filtered out\nif the caller is in a different workspace than where the monitor was created.",
+            "summary": "Read a monitor.",
+            "path": "/api/data-quality/v1/monitors/{object_type}/{object_id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetMonitorRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Monitor",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "object_id",
+                "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_type",
+                "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "object_type",
+                "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_id",
+                "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetRefresh",
+            "description": "Get data quality monitor refresh. The call must be made in the same workspace as where the monitor was created.\n\nFor the `table` `object_type`, the caller must have either of the following sets of permissions:\n1. **MANAGE** and **USE_CATALOG** on the table's parent catalog.\n2. **USE_CATALOG** on the table's parent catalog, and **MANAGE** and **USE_SCHEMA** on the table's parent schema.\n3. **USE_CATALOG** on the table's parent catalog, **USE_SCHEMA** on the table's parent schema, and **SELECT** on the table.\n\nFor the `schema` `object_type`, the caller must have either of the following sets of permissions:\n1. **MANAGE** and **USE_CATALOG** on the schema's parent catalog.\n2. **USE_CATALOG** on the schema's parent catalog, and **USE_SCHEMA** on the schema.",
+            "summary": "Get a refresh.",
+            "path": "/api/data-quality/v1/monitors/{object_type}/{object_id}/refreshes/{refresh_id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetRefreshRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "refresh_id",
+                  "description": "Unique id of the refresh operation.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "refresh_id",
+                  "description": "Unique id of the refresh operation.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Refresh",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "object_id",
+                "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_type",
+                "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "refresh_id",
+                "description": "Unique id of the refresh operation.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "object_type",
+                "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_id",
+                "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "refresh_id",
+                "description": "Unique id of the refresh operation.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListMonitor",
+            "description": "(Unimplemented) List data quality monitors.",
+            "summary": "List monitors.",
+            "path": "/api/data-quality/v1/monitors",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "ListMonitorRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListMonitorResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListRefresh",
+            "description": "List data quality monitor refreshes. The call must be made in the same workspace as where the monitor was created.\n\nFor the `table` `object_type`, the caller must have either of the following sets of permissions:\n1. **MANAGE** and **USE_CATALOG** on the table's parent catalog.\n2. **USE_CATALOG** on the table's parent catalog, and **MANAGE** and **USE_SCHEMA** on the table's parent schema.\n3. **USE_CATALOG** on the table's parent catalog, **USE_SCHEMA** on the table's parent schema, and **SELECT** on the table.\n\nFor the `schema` `object_type`, the caller must have either of the following sets of permissions:\n1. **MANAGE** and **USE_CATALOG** on the schema's parent catalog.\n2. **USE_CATALOG** on the schema's parent catalog, and **USE_SCHEMA** on the schema.",
+            "summary": "List refreshes.",
+            "path": "/api/data-quality/v1/monitors/{object_type}/{object_id}/refreshes",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "ListRefreshRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListRefreshResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "object_id",
+                "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_type",
+                "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "object_type",
+                "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_id",
+                "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "UpdateMonitor",
+            "description": "Update a data quality monitor on Unity Catalog object.\n\nFor the `table` `object_type`, the caller must have either of the following sets of permissions:\n1. **MANAGE** and **USE_CATALOG** on the table's parent catalog.\n2. **USE_CATALOG** on the table's parent catalog, and **MANAGE** and **USE_SCHEMA** on the table's parent schema.\n3. **USE_CATALOG** on the table's parent catalog, **USE_SCHEMA** on the table's parent schema, and **MANAGE** on the table.\n\nFor the `schema` `object_type`, the caller must have either of the following sets of permissions:\n1. **MANAGE** and **USE_CATALOG** on the schema's parent catalog.\n2. **USE_CATALOG** on the schema's parent catalog, and **MANAGE** and **USE_SCHEMA** on the schema.",
+            "summary": "Update a monitor.",
+            "path": "/api/data-quality/v1/monitors/{object_type}/{object_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "UpdateMonitorRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "monitor",
+                  "description": "The monitor to update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Monitor",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The field mask to specify which fields to update as a comma-separated list.\nExample value: `data_profiling_config.custom_metrics,data_profiling_config.schedule.quartz_cron_expression`",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The field mask to specify which fields to update as a comma-separated list.\nExample value: `data_profiling_config.custom_metrics,data_profiling_config.schedule.quartz_cron_expression`",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "monitor",
+                  "description": "The monitor to update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Monitor",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "monitor",
+              "description": "The monitor to update.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Monitor",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "object_type",
+                    "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "object_id",
+                    "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "object_type",
+                    "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "object_id",
+                    "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "Monitor",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "monitor",
+                "description": "The monitor to update.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Monitor",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "object_type",
+                      "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "object_id",
+                      "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "object_type",
+                      "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "object_id",
+                      "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "object_id",
+                "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_type",
+                "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The field mask to specify which fields to update as a comma-separated list.\nExample value: `data_profiling_config.custom_metrics,data_profiling_config.schedule.quartz_cron_expression`",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "anomaly_detection_config",
+                "description": "Anomaly Detection Configuration, applicable to `schema` object types.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AnomalyDetectionConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "data_profiling_config",
+                "description": "Data Profiling Configuration, applicable to `table` object types. Exactly one `Analysis Configuration`\nmust be present.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "DataProfilingConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "object_id",
+                "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_type",
+                "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "object_type",
+                "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_id",
+                "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The field mask to specify which fields to update as a comma-separated list.\nExample value: `data_profiling_config.custom_metrics,data_profiling_config.schedule.quartz_cron_expression`",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_type",
+                "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_id",
+                "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateRefresh",
+            "description": "(Unimplemented) Update a refresh",
+            "summary": "Update a refresh.",
+            "path": "/api/data-quality/v1/monitors/{object_type}/{object_id}/refreshes/{refresh_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "UpdateRefreshRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "refresh_id",
+                  "description": "Unique id of the refresh operation.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "refresh",
+                  "description": "The refresh to update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Refresh",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The field mask to specify which fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "refresh_id",
+                  "description": "Unique id of the refresh operation.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The field mask to specify which fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "refresh",
+                  "description": "The refresh to update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Refresh",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "refresh",
+              "description": "The refresh to update.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Refresh",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "object_type",
+                    "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "object_id",
+                    "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "object_type",
+                    "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "object_id",
+                    "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "Refresh",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "object_id",
+                "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_type",
+                "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "refresh",
+                "description": "The refresh to update.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Refresh",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "object_type",
+                      "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "object_id",
+                      "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "object_type",
+                      "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "object_id",
+                      "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "refresh_id",
+                "description": "Unique id of the refresh operation.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The field mask to specify which fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "end_time_ms",
+                "description": "Time when the refresh ended (milliseconds since 1/1/1970 UTC).",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "message",
+                "description": "An optional message to give insight into the current state of the refresh (e.g. FAILURE messages).",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_id",
+                "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_type",
+                "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "refresh_id",
+                "description": "Unique id of the refresh operation.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "start_time_ms",
+                "description": "Time when the refresh started (milliseconds since 1/1/1970 UTC).",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "state",
+                "description": "The current state of the refresh.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "RefreshState",
+                  "enum": [
+                    {
+                      "content": "MONITOR_REFRESH_STATE_CANCELED"
+                    },
+                    {
+                      "content": "MONITOR_REFRESH_STATE_FAILED"
+                    },
+                    {
+                      "content": "MONITOR_REFRESH_STATE_PENDING"
+                    },
+                    {
+                      "content": "MONITOR_REFRESH_STATE_RUNNING"
+                    },
+                    {
+                      "content": "MONITOR_REFRESH_STATE_SUCCESS"
+                    },
+                    {
+                      "content": "MONITOR_REFRESH_STATE_UNKNOWN"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "trigger",
+                "description": "What triggered the refresh.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "RefreshTrigger",
+                  "enum": [
+                    {
+                      "content": "MONITOR_REFRESH_TRIGGER_DATA_CHANGE"
+                    },
+                    {
+                      "content": "MONITOR_REFRESH_TRIGGER_MANUAL"
+                    },
+                    {
+                      "content": "MONITOR_REFRESH_TRIGGER_SCHEDULE"
+                    },
+                    {
+                      "content": "MONITOR_REFRESH_TRIGGER_UNKNOWN"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "object_type",
+                "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_id",
+                "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "refresh_id",
+                "description": "Unique id of the refresh operation.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The field mask to specify which fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_type",
+                "description": "The type of the monitored object. Can be one of the following: `schema` or `table`.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_id",
+                "description": "The UUID of the request object. It is `schema_id` for `schema`, and `table_id` for `table`.\n\nFind the `schema_id` from either:\n1. The [schema_id](https://docs.databricks.com/api/workspace/schemas/get#schema_id) of the `Schemas` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `schema` \u003e go to the `Details` tab \u003e the `Schema ID` field.\n\nFind the `table_id` from either:\n1. The [table_id](https://docs.databricks.com/api/workspace/tables/get#table_id) of the `Tables` resource.\n2. In [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) \u003e select the `table` \u003e go to the `Details` tab \u003e the `Table ID` field.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "sql.DataSources",
+        "name": "DataSources",
+        "description": "This API is provided to assist you in making new query objects. When creating a query object,\nyou may optionally specify a `data_source_id` for the SQL warehouse against which it will run.\nIf you don't already know the `data_source_id` for your desired SQL warehouse, this API will\nhelp you find it.\n\nThis API does not support searches. It returns the full list of SQL warehouses in your\nworkspace. We advise you to use any text editor, REST client, or `grep` to search the\nresponse from this API for the name of your SQL warehouse as it appears in Databricks SQL.\n\n**Warning**: This API is deprecated. Please see the latest version of the Databricks SQL API. [Learn more](https://docs.databricks.com/en/sql/dbsql-api-latest.html)",
+        "package": {
+          "name": "sql"
+        },
+        "docs_group": "sql",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "methods": [
+          {
+            "name": "List",
+            "description": "Retrieves a full list of SQL warehouses available in this workspace.\nAll fields that appear in this API response are enumerated for clarity.\nHowever, you need only a SQL warehouse's `id` to create new queries against it.\n\n**Warning**: This API is deprecated. Please use :method:warehouses/list instead. [Learn more](https://docs.databricks.com/en/sql/dbsql-api-latest.html)",
+            "summary": "Get a list of SQL warehouses.",
+            "path": "/api/2.0/preview/sql/data_sources",
+            "is_legacy_empty_request": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "DataSourceList",
+              "array_value": {
+                "pascal_name": "DataSource",
+                "is_object": true
+              }
+            }
+          }
+        ]
+      },
+      {
+        "id": "database.Database",
+        "name": "Database",
+        "description": "Database Instances provide access to a database via REST API or direct SQL.",
+        "package": {
+          "name": "database"
+        },
+        "docs_group": "database",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "list": {
+          "request": {
+            "pascal_name": "ListDatabaseCatalogsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "CreateDatabaseCatalog",
+            "description": "Create a Database Catalog.",
+            "summary": "Create a Database Catalog.",
+            "path": "/api/2.0/database/catalogs",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "CreateDatabaseCatalogRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "catalog",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DatabaseCatalog",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "catalog",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DatabaseCatalog",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "catalog",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "DatabaseCatalog",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "name",
+                    "description": "The name of the catalog in UC.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "database_instance_name",
+                    "description": "The name of the DatabaseInstance housing the database.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "database_name",
+                    "description": "The name of the database (in an instance) associated with the catalog.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "name",
+                    "description": "The name of the catalog in UC.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "database_instance_name",
+                    "description": "The name of the DatabaseInstance housing the database.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "database_name",
+                    "description": "The name of the database (in an instance) associated with the catalog.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "DatabaseCatalog",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the catalog in UC.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "database_instance_name",
+                  "description": "The name of the DatabaseInstance housing the database.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "database_name",
+                  "description": "The name of the database (in an instance) associated with the catalog.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the catalog in UC.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "database_instance_name",
+                  "description": "The name of the DatabaseInstance housing the database.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "database_name",
+                  "description": "The name of the database (in an instance) associated with the catalog.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "catalog",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DatabaseCatalog",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "name",
+                      "description": "The name of the catalog in UC.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "database_instance_name",
+                      "description": "The name of the DatabaseInstance housing the database.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "database_name",
+                      "description": "The name of the database (in an instance) associated with the catalog.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "name",
+                      "description": "The name of the catalog in UC.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "database_instance_name",
+                      "description": "The name of the DatabaseInstance housing the database.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "database_name",
+                      "description": "The name of the database (in an instance) associated with the catalog.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "create_database_if_not_exists",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "database_instance_name",
+                "description": "The name of the DatabaseInstance housing the database.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "database_name",
+                "description": "The name of the database (in an instance) associated with the catalog.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the catalog in UC.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "uid",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the catalog in UC.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "database_instance_name",
+                "description": "The name of the DatabaseInstance housing the database.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "database_name",
+                "description": "The name of the database (in an instance) associated with the catalog.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateDatabaseInstance",
+            "description": "Create a Database Instance.",
+            "summary": "Create a Database Instance.",
+            "path": "/api/2.0/database/instances",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "CreateDatabaseInstanceRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "database_instance",
+                  "description": "Instance to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DatabaseInstance",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "database_instance",
+                  "description": "Instance to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DatabaseInstance",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "database_instance",
+              "description": "Instance to create.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "DatabaseInstance",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "name",
+                    "description": "The name of the instance. This is the unique identifier for the instance.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "name",
+                    "description": "The name of the instance. This is the unique identifier for the instance.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "DatabaseInstance",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the instance. This is the unique identifier for the instance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the instance. This is the unique identifier for the instance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "database_instance",
+                "description": "Instance to create.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DatabaseInstance",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "name",
+                      "description": "The name of the instance. This is the unique identifier for the instance.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "name",
+                      "description": "The name of the instance. This is the unique identifier for the instance.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "capacity",
+                "description": "The sku of the instance. Valid values are \"CU_1\", \"CU_2\", \"CU_4\", \"CU_8\".",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "child_instance_refs",
+                "description": "The refs of the child instances. This is only available if the instance is\nparent instance.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DatabaseInstanceRefList",
+                  "array_value": {
+                    "pascal_name": "DatabaseInstanceRef",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "creation_time",
+                "description": "The timestamp when the instance was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "creator",
+                "description": "The email of the creator of the instance.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "custom_tags",
+                "description": "Custom tags associated with the instance. This field is only included on create and update responses.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CustomTagList",
+                  "array_value": {
+                    "pascal_name": "CustomTag",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "effective_capacity",
+                "description": "Deprecated. The sku of the instance; this field will always match the value of capacity.\nThis is an output only field that contains the value computed from the input field combined with\nserver side defaults. Use the field without the effective_ prefix to set the value.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_custom_tags",
+                "description": "The recorded custom tags associated with the instance.\nThis is an output only field that contains the value computed from the input field combined with\nserver side defaults. Use the field without the effective_ prefix to set the value.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CustomTagList",
+                  "array_value": {
+                    "pascal_name": "CustomTag",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "effective_enable_pg_native_login",
+                "description": "Whether the instance has PG native password login enabled.\nThis is an output only field that contains the value computed from the input field combined with\nserver side defaults. Use the field without the effective_ prefix to set the value.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "effective_enable_readable_secondaries",
+                "description": "Whether secondaries serving read-only traffic are enabled. Defaults to false.\nThis is an output only field that contains the value computed from the input field combined with\nserver side defaults. Use the field without the effective_ prefix to set the value.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "effective_node_count",
+                "description": "The number of nodes in the instance, composed of 1 primary and 0 or more secondaries. Defaults to\n1 primary and 0 secondaries.\nThis is an output only field that contains the value computed from the input field combined with\nserver side defaults. Use the field without the effective_ prefix to set the value.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "effective_retention_window_in_days",
+                "description": "The retention window for the instance. This is the time window in days\nfor which the historical data is retained.\nThis is an output only field that contains the value computed from the input field combined with\nserver side defaults. Use the field without the effective_ prefix to set the value.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "effective_stopped",
+                "description": "Whether the instance is stopped.\nThis is an output only field that contains the value computed from the input field combined with\nserver side defaults. Use the field without the effective_ prefix to set the value.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "effective_usage_policy_id",
+                "description": "The policy that is applied to the instance.\nThis is an output only field that contains the value computed from the input field combined with\nserver side defaults. Use the field without the effective_ prefix to set the value.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "enable_pg_native_login",
+                "description": "Whether to enable PG native password login on the instance. Defaults to false.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "enable_readable_secondaries",
+                "description": "Whether to enable secondaries to serve read-only traffic. Defaults to false.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the instance. This is the unique identifier for the instance.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "node_count",
+                "description": "The number of nodes in the instance, composed of 1 primary and 0 or more secondaries. Defaults to\n1 primary and 0 secondaries. This field is input only, see effective_node_count for the output.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "parent_instance_ref",
+                "description": "The ref of the parent instance. This is only available if the instance is\nchild instance.\nInput: For specifying the parent instance to create a child instance. Optional.\nOutput: Only populated if provided as input to create a child instance.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "DatabaseInstanceRef",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "pg_version",
+                "description": "The version of Postgres running on the instance.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "read_only_dns",
+                "description": "The DNS endpoint to connect to the instance for read only access. This is only available if\nenable_readable_secondaries is true.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "read_write_dns",
+                "description": "The DNS endpoint to connect to the instance for read+write access.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "retention_window_in_days",
+                "description": "The retention window for the instance. This is the time window in days\nfor which the historical data is retained. The default value is 7 days.\nValid values are 2 to 35 days.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "state",
+                "description": "The current state of the instance.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DatabaseInstanceState",
+                  "enum": [
+                    {
+                      "content": "AVAILABLE"
+                    },
+                    {
+                      "content": "DELETING"
+                    },
+                    {
+                      "content": "FAILING_OVER"
+                    },
+                    {
+                      "content": "STARTING"
+                    },
+                    {
+                      "content": "STOPPED"
+                    },
+                    {
+                      "content": "UPDATING"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "stopped",
+                "description": "Whether to stop the instance. An input only param, see effective_stopped for the output.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "uid",
+                "description": "An immutable UUID identifier for the instance.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "usage_policy_id",
+                "description": "The desired usage policy to associate with the instance.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the instance. This is the unique identifier for the instance.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "wait": {
+              "success": [
+                {
+                  "content": "AVAILABLE"
+                }
+              ],
+              "timeout": 20,
+              "poll": {
+                "response": {
+                  "pascal_name": "DatabaseInstance"
+                }
+              },
+              "status_path": [
+                {
+                  "pascal_name": "State"
+                }
+              ]
+            }
+          },
+          {
+            "name": "CreateDatabaseInstanceRole",
+            "description": "Create a role for a Database Instance.",
+            "summary": "Create a role for a Database Instance.",
+            "path": "/api/2.0/database/instances/{instance_name}/roles",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "CreateDatabaseInstanceRoleRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "instance_name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "database_instance_role",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DatabaseInstanceRole",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "instance_name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "database_instance_role",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DatabaseInstanceRole",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "database_instance_role",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "DatabaseInstanceRole",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "name",
+                    "description": "The name of the role. This is the unique identifier for the role in an instance.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "name",
+                    "description": "The name of the role. This is the unique identifier for the role in an instance.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "DatabaseInstanceRole",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the role. This is the unique identifier for the role in an instance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the role. This is the unique identifier for the role in an instance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "database_instance_name",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "database_instance_role",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DatabaseInstanceRole",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "name",
+                      "description": "The name of the role. This is the unique identifier for the role in an instance.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "name",
+                      "description": "The name of the role. This is the unique identifier for the role in an instance.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "instance_name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "attributes",
+                "description": "The desired API-exposed Postgres role attribute to associate with the role. Optional.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "DatabaseInstanceRoleAttributes",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "effective_attributes",
+                "description": "The attributes that are applied to the role.\nThis is an output only field that contains the value computed from the input field combined with\nserver side defaults. Use the field without the effective_ prefix to set the value.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "DatabaseInstanceRoleAttributes",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "identity_type",
+                "description": "The type of the role.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DatabaseInstanceRoleIdentityType",
+                  "enum": [
+                    {
+                      "content": "GROUP"
+                    },
+                    {
+                      "content": "PG_ONLY"
+                    },
+                    {
+                      "content": "SERVICE_PRINCIPAL"
+                    },
+                    {
+                      "content": "USER"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "instance_name",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "membership_role",
+                "description": "An enum value for a standard role that this role is a member of.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DatabaseInstanceRoleMembershipRole",
+                  "enum": [
+                    {
+                      "content": "DATABRICKS_SUPERUSER"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the role. This is the unique identifier for the role in an instance.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "instance_name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the role. This is the unique identifier for the role in an instance.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateDatabaseTable",
+            "description": "Create a Database Table. Useful for registering pre-existing PG tables in UC.\nSee CreateSyncedDatabaseTable for creating synced tables in PG from a source table in UC.",
+            "summary": "Create a Database Table.",
+            "path": "/api/2.0/database/tables",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "CreateDatabaseTableRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "table",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DatabaseTable",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "table",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DatabaseTable",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "table",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "DatabaseTable",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "name",
+                    "description": "Full three-part (catalog, schema, table) name of the table.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "name",
+                    "description": "Full three-part (catalog, schema, table) name of the table.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "DatabaseTable",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Full three-part (catalog, schema, table) name of the table.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Full three-part (catalog, schema, table) name of the table.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "table",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DatabaseTable",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "name",
+                      "description": "Full three-part (catalog, schema, table) name of the table.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "name",
+                      "description": "Full three-part (catalog, schema, table) name of the table.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "database_instance_name",
+                "description": "Name of the target database instance. This is required when creating database tables in standard catalogs.\nThis is optional when creating database tables in registered catalogs. If this field is specified\nwhen creating database tables in registered catalogs, the database instance name MUST\nmatch that of the registered catalog (or the request will be rejected).",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "logical_database_name",
+                "description": "Target Postgres database object (logical database) name for this table.\n\nWhen creating a table in a standard catalog, this field is required.\nIn this scenario, specifying this field will allow targeting an arbitrary postgres database.\n\nRegistration of database tables via /database/tables is currently only supported in standard catalogs.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Full three-part (catalog, schema, table) name of the table.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Full three-part (catalog, schema, table) name of the table.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateSyncedDatabaseTable",
+            "description": "Create a Synced Database Table.",
+            "summary": "Create a Synced Database Table.",
+            "path": "/api/2.0/database/synced_tables",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "CreateSyncedDatabaseTableRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "synced_table",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "SyncedDatabaseTable",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "synced_table",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "SyncedDatabaseTable",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "synced_table",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "SyncedDatabaseTable",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "name",
+                    "description": "Full three-part (catalog, schema, table) name of the table.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "name",
+                    "description": "Full three-part (catalog, schema, table) name of the table.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "SyncedDatabaseTable",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Full three-part (catalog, schema, table) name of the table.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Full three-part (catalog, schema, table) name of the table.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "synced_table",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "SyncedDatabaseTable",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "name",
+                      "description": "Full three-part (catalog, schema, table) name of the table.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "name",
+                      "description": "Full three-part (catalog, schema, table) name of the table.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "data_synchronization_status",
+                "description": "Synced Table data synchronization status",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "SyncedTableStatus",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "database_instance_name",
+                "description": "Name of the target database instance. This is required when creating synced database tables in standard catalogs.\nThis is optional when creating synced database tables in registered catalogs. If this field is specified\nwhen creating synced database tables in registered catalogs, the database instance name MUST\nmatch that of the registered catalog (or the request will be rejected).",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_database_instance_name",
+                "description": "The name of the database instance that this table is registered to. This field is always returned, and for\ntables inside database catalogs is inferred database instance associated with the catalog.\nThis is an output only field that contains the value computed from the input field combined with\nserver side defaults. Use the field without the effective_ prefix to set the value.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_logical_database_name",
+                "description": "The name of the logical database that this table is registered to.\nThis is an output only field that contains the value computed from the input field combined with\nserver side defaults. Use the field without the effective_ prefix to set the value.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "logical_database_name",
+                "description": "Target Postgres database object (logical database) name for this table.\n\nWhen creating a synced table in a registered Postgres catalog, the\ntarget Postgres database name is inferred to be that of the registered catalog.\nIf this field is specified in this scenario, the Postgres database name MUST\nmatch that of the registered catalog (or the request will be rejected).\n\nWhen creating a synced table in a standard catalog, this field is required.\nIn this scenario, specifying this field will allow targeting an arbitrary postgres database.\nNote that this has implications for the `create_database_objects_is_missing` field in `spec`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Full three-part (catalog, schema, table) name of the table.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "spec",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "SyncedTableSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "unity_catalog_provisioning_state",
+                "description": "The provisioning state of the synced table entity in Unity Catalog. This is distinct from the\nstate of the data synchronization pipeline (i.e. the table may be in \"ACTIVE\" but the pipeline\nmay be in \"PROVISIONING\" as it runs asynchronously).",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ProvisioningInfoState",
+                  "enum": [
+                    {
+                      "content": "ACTIVE"
+                    },
+                    {
+                      "content": "DEGRADED"
+                    },
+                    {
+                      "content": "DELETING"
+                    },
+                    {
+                      "content": "FAILED"
+                    },
+                    {
+                      "content": "PROVISIONING"
+                    },
+                    {
+                      "content": "UPDATING"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Full three-part (catalog, schema, table) name of the table.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteDatabaseCatalog",
+            "description": "Delete a Database Catalog.",
+            "summary": "Delete a Database Catalog.",
+            "path": "/api/2.0/database/catalogs/{name}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "DeleteDatabaseCatalogRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteDatabaseInstance",
+            "description": "Delete a Database Instance.",
+            "summary": "Delete a Database Instance.",
+            "path": "/api/2.0/database/instances/{name}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "DeleteDatabaseInstanceRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the instance to delete.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the instance to delete.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "force",
+                "description": "By default, an instance cannot be deleted if it has descendant instances created via PITR. If\nthis flag is specified as true, all descendent instances will be deleted as well.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the instance to delete.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "purge",
+                "description": "Deprecated. Omitting the field or setting it to true will result in the field being hard deleted. Setting a value\nof false will throw a bad request.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the instance to delete.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteDatabaseInstanceRole",
+            "description": "Deletes a role for a Database Instance.",
+            "summary": "Delete a role for a Database Instance.",
+            "path": "/api/2.0/database/instances/{instance_name}/roles/{name}",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "DeleteDatabaseInstanceRoleRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "instance_name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "instance_name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "allow_missing",
+                "description": "This is the AIP standard name for the equivalent of Postgres' `IF EXISTS` option",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "instance_name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "reassign_owned_to",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "instance_name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteDatabaseTable",
+            "description": "Delete a Database Table.",
+            "summary": "Delete a Database Table.",
+            "path": "/api/2.0/database/tables/{name}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "DeleteDatabaseTableRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteSyncedDatabaseTable",
+            "description": "Delete a Synced Database Table.",
+            "summary": "Delete a Synced Database Table.",
+            "path": "/api/2.0/database/synced_tables/{name}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "DeleteSyncedDatabaseTableRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "purge_data",
+                "description": "Optional. When set to true, the actual PostgreSQL table will be dropped from the database.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "FindDatabaseInstanceByUid",
+            "description": "Find a Database Instance by uid.",
+            "summary": "Find a Database Instance by uid.",
+            "path": "/api/2.0/database/instances:findByUid",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "FindDatabaseInstanceByUidRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "DatabaseInstance",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the instance. This is the unique identifier for the instance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the instance. This is the unique identifier for the instance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "uid",
+                "description": "UID of the cluster to get.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GenerateDatabaseCredential",
+            "description": "Generates a credential that can be used to access database instances.",
+            "summary": "Generates a credential that can be used to access database instances.",
+            "path": "/api/2.0/database/credentials",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GenerateDatabaseCredentialRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "DatabaseCredential",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "claims",
+                "description": "A set of UC permissions to add to the credential. We verify that the caller has the necessary\npermissions in UC and include a reference in the token. Postgres uses that token to give the\nconnecting user additional grants to the Postgres resources that correspond to the UC resources.\nThe UC resources need to be something that have a Postgres counterpart. For example, a synced table or\na table in a UC database catalog.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "RequestedClaimsList",
+                  "array_value": {
+                    "pascal_name": "RequestedClaims",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "instance_names",
+                "description": "Instances to request a credential for. At least one of instance_names or claims must be specified.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "request_id",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetDatabaseCatalog",
+            "description": "Get a Database Catalog.",
+            "summary": "Get a Database Catalog.",
+            "path": "/api/2.0/database/catalogs/{name}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetDatabaseCatalogRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DatabaseCatalog",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the catalog in UC.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "database_instance_name",
+                  "description": "The name of the DatabaseInstance housing the database.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "database_name",
+                  "description": "The name of the database (in an instance) associated with the catalog.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the catalog in UC.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "database_instance_name",
+                  "description": "The name of the DatabaseInstance housing the database.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "database_name",
+                  "description": "The name of the database (in an instance) associated with the catalog.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetDatabaseInstance",
+            "description": "Get a Database Instance.",
+            "summary": "Get a Database Instance.",
+            "path": "/api/2.0/database/instances/{name}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetDatabaseInstanceRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the cluster to get.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the cluster to get.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DatabaseInstance",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the instance. This is the unique identifier for the instance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the instance. This is the unique identifier for the instance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Name of the cluster to get.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the cluster to get.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetDatabaseInstanceRole",
+            "description": "Gets a role for a Database Instance.",
+            "summary": "Get a role for a Database Instance.",
+            "path": "/api/2.0/database/instances/{instance_name}/roles/{name}",
+            "is_crud_read": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "GetDatabaseInstanceRoleRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "instance_name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "instance_name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DatabaseInstanceRole",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the role. This is the unique identifier for the role in an instance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the role. This is the unique identifier for the role in an instance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "instance_name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "instance_name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetDatabaseTable",
+            "description": "Get a Database Table.",
+            "summary": "Get a Database Table.",
+            "path": "/api/2.0/database/tables/{name}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetDatabaseTableRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DatabaseTable",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Full three-part (catalog, schema, table) name of the table.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Full three-part (catalog, schema, table) name of the table.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetSyncedDatabaseTable",
+            "description": "Get a Synced Database Table.",
+            "summary": "Get a Synced Database Table.",
+            "path": "/api/2.0/database/synced_tables/{name}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetSyncedDatabaseTableRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "SyncedDatabaseTable",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Full three-part (catalog, schema, table) name of the table.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Full three-part (catalog, schema, table) name of the table.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListDatabaseCatalogs",
+            "description": "This API is currently unimplemented, but exposed for Terraform support.",
+            "summary": "List all Database Catalogs in a Database Instance.",
+            "path": "/api/2.0/database/instances/{instance_name}/catalogs",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "ListDatabaseCatalogsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "instance_name",
+                  "description": "Name of the instance to get database catalogs for.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "instance_name",
+                  "description": "Name of the instance to get database catalogs for.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListDatabaseCatalogsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "instance_name",
+                "description": "Name of the instance to get database catalogs for.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "Upper bound for items returned.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Pagination token to go to the next page of synced database tables. Requests first page if absent.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "instance_name",
+                "description": "Name of the instance to get database catalogs for.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Pagination token to go to the next page of synced database tables. Requests first page if absent.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListDatabaseInstanceRoles",
+            "description": "START OF PG ROLE APIs Section\nThese APIs are marked a PUBLIC with stage \u003c PUBLIC_PREVIEW. With more recent Lakebase V2 plans, we don't plan to\never advance these to PUBLIC_PREVIEW. These APIs will remain effectively undocumented/UI-only and we'll aim for a\nnew public roles API as part of V2 PuPr.",
+            "summary": "List roles for a Database Instance.",
+            "path": "/api/2.0/database/instances/{instance_name}/roles",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "ListDatabaseInstanceRolesRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "instance_name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "instance_name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListDatabaseInstanceRolesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "instance_name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "Upper bound for items returned.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Pagination token to go to the next page of Database Instances. Requests first page if absent.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "instance_name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Pagination token to go to the next page of Database Instances. Requests first page if absent.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListDatabaseInstances",
+            "description": "List Database Instances.",
+            "summary": "List Database Instances.",
+            "path": "/api/2.0/database/instances",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "ListDatabaseInstancesRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListDatabaseInstancesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "Upper bound for items returned. The maximum value is 100.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Pagination token to go to the next page of Database Instances. Requests first page if absent.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Pagination token to go to the next page of Database Instances. Requests first page if absent.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListSyncedDatabaseTables",
+            "description": "List synced database tables in a Database Instance.",
+            "summary": "List all synced database tables in a Database Instance.",
+            "path": "/api/2.0/database/instances/{instance_name}/synced_tables",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "ListSyncedDatabaseTablesRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "instance_name",
+                  "description": "Name of the instance to get synced tables for.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "instance_name",
+                  "description": "Name of the instance to get synced tables for.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListSyncedDatabaseTablesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "instance_name",
+                "description": "Name of the instance to get synced tables for.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "Upper bound for items returned.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Pagination token to go to the next page of synced database tables. Requests first page if absent.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "instance_name",
+                "description": "Name of the instance to get synced tables for.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Pagination token to go to the next page of synced database tables. Requests first page if absent.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "UpdateDatabaseCatalog",
+            "description": "This API is currently unimplemented, but exposed for Terraform support.",
+            "summary": "Update a Database Catalog.",
+            "path": "/api/2.0/database/catalogs/{name}",
+            "can_use_json": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "UpdateDatabaseCatalogRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the catalog in UC.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "database_catalog",
+                  "description": "Note that updating a database catalog is not yet supported.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DatabaseCatalog",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The list of fields to update. Setting this field is not yet supported.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the catalog in UC.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The list of fields to update. Setting this field is not yet supported.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "database_catalog",
+                  "description": "Note that updating a database catalog is not yet supported.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DatabaseCatalog",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "database_catalog",
+              "description": "Note that updating a database catalog is not yet supported.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "DatabaseCatalog",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "name",
+                    "description": "The name of the catalog in UC.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "database_instance_name",
+                    "description": "The name of the DatabaseInstance housing the database.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "database_name",
+                    "description": "The name of the database (in an instance) associated with the catalog.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "name",
+                    "description": "The name of the catalog in UC.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "database_instance_name",
+                    "description": "The name of the DatabaseInstance housing the database.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "database_name",
+                    "description": "The name of the database (in an instance) associated with the catalog.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "DatabaseCatalog",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the catalog in UC.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "database_instance_name",
+                  "description": "The name of the DatabaseInstance housing the database.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "database_name",
+                  "description": "The name of the database (in an instance) associated with the catalog.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the catalog in UC.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "database_instance_name",
+                  "description": "The name of the DatabaseInstance housing the database.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "database_name",
+                  "description": "The name of the database (in an instance) associated with the catalog.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "database_catalog",
+                "description": "Note that updating a database catalog is not yet supported.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DatabaseCatalog",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "name",
+                      "description": "The name of the catalog in UC.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "database_instance_name",
+                      "description": "The name of the DatabaseInstance housing the database.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "database_name",
+                      "description": "The name of the database (in an instance) associated with the catalog.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "name",
+                      "description": "The name of the catalog in UC.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "database_instance_name",
+                      "description": "The name of the DatabaseInstance housing the database.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "database_name",
+                      "description": "The name of the database (in an instance) associated with the catalog.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the catalog in UC.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The list of fields to update. Setting this field is not yet supported.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "create_database_if_not_exists",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "database_instance_name",
+                "description": "The name of the DatabaseInstance housing the database.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "database_name",
+                "description": "The name of the database (in an instance) associated with the catalog.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the catalog in UC.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "uid",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the catalog in UC.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The list of fields to update. Setting this field is not yet supported.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "database_instance_name",
+                "description": "The name of the DatabaseInstance housing the database.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "database_name",
+                "description": "The name of the database (in an instance) associated with the catalog.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateDatabaseInstance",
+            "description": "Update a Database Instance.",
+            "summary": "Update a Database Instance.",
+            "path": "/api/2.0/database/instances/{name}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "UpdateDatabaseInstanceRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the instance. This is the unique identifier for the instance.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "database_instance",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DatabaseInstance",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The list of fields to update. If unspecified, all fields will be updated when possible. To wipe out custom_tags,\nspecify custom_tags in the update_mask with an empty custom_tags map.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the instance. This is the unique identifier for the instance.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The list of fields to update. If unspecified, all fields will be updated when possible. To wipe out custom_tags,\nspecify custom_tags in the update_mask with an empty custom_tags map.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "database_instance",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DatabaseInstance",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "database_instance",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "DatabaseInstance",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "name",
+                    "description": "The name of the instance. This is the unique identifier for the instance.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "name",
+                    "description": "The name of the instance. This is the unique identifier for the instance.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "DatabaseInstance",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the instance. This is the unique identifier for the instance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the instance. This is the unique identifier for the instance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "database_instance",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DatabaseInstance",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "name",
+                      "description": "The name of the instance. This is the unique identifier for the instance.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "name",
+                      "description": "The name of the instance. This is the unique identifier for the instance.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the instance. This is the unique identifier for the instance.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The list of fields to update. If unspecified, all fields will be updated when possible. To wipe out custom_tags,\nspecify custom_tags in the update_mask with an empty custom_tags map.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "capacity",
+                "description": "The sku of the instance. Valid values are \"CU_1\", \"CU_2\", \"CU_4\", \"CU_8\".",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "child_instance_refs",
+                "description": "The refs of the child instances. This is only available if the instance is\nparent instance.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DatabaseInstanceRefList",
+                  "array_value": {
+                    "pascal_name": "DatabaseInstanceRef",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "creation_time",
+                "description": "The timestamp when the instance was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "creator",
+                "description": "The email of the creator of the instance.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "custom_tags",
+                "description": "Custom tags associated with the instance. This field is only included on create and update responses.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CustomTagList",
+                  "array_value": {
+                    "pascal_name": "CustomTag",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "effective_capacity",
+                "description": "Deprecated. The sku of the instance; this field will always match the value of capacity.\nThis is an output only field that contains the value computed from the input field combined with\nserver side defaults. Use the field without the effective_ prefix to set the value.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_custom_tags",
+                "description": "The recorded custom tags associated with the instance.\nThis is an output only field that contains the value computed from the input field combined with\nserver side defaults. Use the field without the effective_ prefix to set the value.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CustomTagList",
+                  "array_value": {
+                    "pascal_name": "CustomTag",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "effective_enable_pg_native_login",
+                "description": "Whether the instance has PG native password login enabled.\nThis is an output only field that contains the value computed from the input field combined with\nserver side defaults. Use the field without the effective_ prefix to set the value.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "effective_enable_readable_secondaries",
+                "description": "Whether secondaries serving read-only traffic are enabled. Defaults to false.\nThis is an output only field that contains the value computed from the input field combined with\nserver side defaults. Use the field without the effective_ prefix to set the value.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "effective_node_count",
+                "description": "The number of nodes in the instance, composed of 1 primary and 0 or more secondaries. Defaults to\n1 primary and 0 secondaries.\nThis is an output only field that contains the value computed from the input field combined with\nserver side defaults. Use the field without the effective_ prefix to set the value.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "effective_retention_window_in_days",
+                "description": "The retention window for the instance. This is the time window in days\nfor which the historical data is retained.\nThis is an output only field that contains the value computed from the input field combined with\nserver side defaults. Use the field without the effective_ prefix to set the value.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "effective_stopped",
+                "description": "Whether the instance is stopped.\nThis is an output only field that contains the value computed from the input field combined with\nserver side defaults. Use the field without the effective_ prefix to set the value.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "effective_usage_policy_id",
+                "description": "The policy that is applied to the instance.\nThis is an output only field that contains the value computed from the input field combined with\nserver side defaults. Use the field without the effective_ prefix to set the value.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "enable_pg_native_login",
+                "description": "Whether to enable PG native password login on the instance. Defaults to false.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "enable_readable_secondaries",
+                "description": "Whether to enable secondaries to serve read-only traffic. Defaults to false.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the instance. This is the unique identifier for the instance.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "node_count",
+                "description": "The number of nodes in the instance, composed of 1 primary and 0 or more secondaries. Defaults to\n1 primary and 0 secondaries. This field is input only, see effective_node_count for the output.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "parent_instance_ref",
+                "description": "The ref of the parent instance. This is only available if the instance is\nchild instance.\nInput: For specifying the parent instance to create a child instance. Optional.\nOutput: Only populated if provided as input to create a child instance.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "DatabaseInstanceRef",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "pg_version",
+                "description": "The version of Postgres running on the instance.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "read_only_dns",
+                "description": "The DNS endpoint to connect to the instance for read only access. This is only available if\nenable_readable_secondaries is true.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "read_write_dns",
+                "description": "The DNS endpoint to connect to the instance for read+write access.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "retention_window_in_days",
+                "description": "The retention window for the instance. This is the time window in days\nfor which the historical data is retained. The default value is 7 days.\nValid values are 2 to 35 days.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "state",
+                "description": "The current state of the instance.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DatabaseInstanceState",
+                  "enum": [
+                    {
+                      "content": "AVAILABLE"
+                    },
+                    {
+                      "content": "DELETING"
+                    },
+                    {
+                      "content": "FAILING_OVER"
+                    },
+                    {
+                      "content": "STARTING"
+                    },
+                    {
+                      "content": "STOPPED"
+                    },
+                    {
+                      "content": "UPDATING"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "stopped",
+                "description": "Whether to stop the instance. An input only param, see effective_stopped for the output.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "uid",
+                "description": "An immutable UUID identifier for the instance.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "usage_policy_id",
+                "description": "The desired usage policy to associate with the instance.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the instance. This is the unique identifier for the instance.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The list of fields to update. If unspecified, all fields will be updated when possible. To wipe out custom_tags,\nspecify custom_tags in the update_mask with an empty custom_tags map.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateSyncedDatabaseTable",
+            "description": "This API is currently unimplemented, but exposed for Terraform support.",
+            "summary": "Update a Synced Database Table.",
+            "path": "/api/2.0/database/synced_tables/{name}",
+            "can_use_json": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "UpdateSyncedDatabaseTableRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Full three-part (catalog, schema, table) name of the table.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "synced_table",
+                  "description": "Note that updating a synced database table is not yet supported.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "SyncedDatabaseTable",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The list of fields to update. Setting this field is not yet supported.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Full three-part (catalog, schema, table) name of the table.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The list of fields to update. Setting this field is not yet supported.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "synced_table",
+                  "description": "Note that updating a synced database table is not yet supported.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "SyncedDatabaseTable",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "synced_table",
+              "description": "Note that updating a synced database table is not yet supported.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "SyncedDatabaseTable",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "name",
+                    "description": "Full three-part (catalog, schema, table) name of the table.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "name",
+                    "description": "Full three-part (catalog, schema, table) name of the table.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "SyncedDatabaseTable",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Full three-part (catalog, schema, table) name of the table.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Full three-part (catalog, schema, table) name of the table.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Full three-part (catalog, schema, table) name of the table.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "synced_table",
+                "description": "Note that updating a synced database table is not yet supported.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "SyncedDatabaseTable",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "name",
+                      "description": "Full three-part (catalog, schema, table) name of the table.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "name",
+                      "description": "Full three-part (catalog, schema, table) name of the table.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The list of fields to update. Setting this field is not yet supported.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "data_synchronization_status",
+                "description": "Synced Table data synchronization status",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "SyncedTableStatus",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "database_instance_name",
+                "description": "Name of the target database instance. This is required when creating synced database tables in standard catalogs.\nThis is optional when creating synced database tables in registered catalogs. If this field is specified\nwhen creating synced database tables in registered catalogs, the database instance name MUST\nmatch that of the registered catalog (or the request will be rejected).",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_database_instance_name",
+                "description": "The name of the database instance that this table is registered to. This field is always returned, and for\ntables inside database catalogs is inferred database instance associated with the catalog.\nThis is an output only field that contains the value computed from the input field combined with\nserver side defaults. Use the field without the effective_ prefix to set the value.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_logical_database_name",
+                "description": "The name of the logical database that this table is registered to.\nThis is an output only field that contains the value computed from the input field combined with\nserver side defaults. Use the field without the effective_ prefix to set the value.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "logical_database_name",
+                "description": "Target Postgres database object (logical database) name for this table.\n\nWhen creating a synced table in a registered Postgres catalog, the\ntarget Postgres database name is inferred to be that of the registered catalog.\nIf this field is specified in this scenario, the Postgres database name MUST\nmatch that of the registered catalog (or the request will be rejected).\n\nWhen creating a synced table in a standard catalog, this field is required.\nIn this scenario, specifying this field will allow targeting an arbitrary postgres database.\nNote that this has implications for the `create_database_objects_is_missing` field in `spec`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Full three-part (catalog, schema, table) name of the table.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "spec",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "SyncedTableSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "unity_catalog_provisioning_state",
+                "description": "The provisioning state of the synced table entity in Unity Catalog. This is distinct from the\nstate of the data synchronization pipeline (i.e. the table may be in \"ACTIVE\" but the pipeline\nmay be in \"PROVISIONING\" as it runs asynchronously).",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ProvisioningInfoState",
+                  "enum": [
+                    {
+                      "content": "ACTIVE"
+                    },
+                    {
+                      "content": "DEGRADED"
+                    },
+                    {
+                      "content": "DELETING"
+                    },
+                    {
+                      "content": "FAILED"
+                    },
+                    {
+                      "content": "PROVISIONING"
+                    },
+                    {
+                      "content": "UPDATING"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Full three-part (catalog, schema, table) name of the table.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The list of fields to update. Setting this field is not yet supported.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "files.Dbfs",
+        "name": "Dbfs",
+        "description": "DBFS API makes it simple to interact with various data sources without having to include\na users credentials every time to read a file.",
+        "package": {
+          "name": "files"
+        },
+        "docs_group": "files",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListDbfsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "AddBlock",
+            "description": "Appends a block of data to the stream specified by the input handle. If the handle does not\nexist, this call will throw an exception with ``RESOURCE_DOES_NOT_EXIST``.\n\nIf the block of data exceeds 1 MB, this call will throw an exception with ``MAX_BLOCK_SIZE_EXCEEDED``.",
+            "summary": "Append data block.",
+            "path": "/api/2.0/dbfs/add-block",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "AddBlock",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "handle",
+                  "description": "The handle on an open stream.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "data",
+                  "description": "The base64-encoded data to append to the stream. This has a limit of 1 MB.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "handle",
+                  "description": "The handle on an open stream.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "data",
+                  "description": "The base64-encoded data to append to the stream. This has a limit of 1 MB.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "AddBlockResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "data",
+                "description": "The base64-encoded data to append to the stream. This has a limit of 1 MB.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "handle",
+                "description": "The handle on an open stream.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "handle",
+                "description": "The handle on an open stream.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "data",
+                "description": "The base64-encoded data to append to the stream. This has a limit of 1 MB.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Close",
+            "description": "Closes the stream specified by the input handle. If the handle does not exist, this call\nthrows an exception with ``RESOURCE_DOES_NOT_EXIST``.",
+            "summary": "Close the stream.",
+            "path": "/api/2.0/dbfs/close",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "Close",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "handle",
+                  "description": "The handle on an open stream.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "handle",
+                  "description": "The handle on an open stream.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CloseResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "handle",
+                "description": "The handle on an open stream.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "handle",
+                "description": "The handle on an open stream.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Create",
+            "description": "Opens a stream to write to a file and returns a handle to this stream.\nThere is a 10 minute idle timeout on this handle. If a file or directory already exists on the given path\nand __overwrite__ is set to false, this call will throw an exception with ``RESOURCE_ALREADY_EXISTS``.\n\nA typical workflow for file upload would be:\n\n1. Issue a ``create`` call and get a handle.\n2. Issue one or more ``add-block`` calls with the handle you have.\n3. Issue a ``close`` call with the handle you have.",
+            "summary": "Open a stream.",
+            "path": "/api/2.0/dbfs/create",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "Create",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "path",
+                  "description": "The path of the new file. The path should be the absolute DBFS path.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "path",
+                  "description": "The path of the new file. The path should be the absolute DBFS path.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CreateResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "overwrite",
+                "description": "The flag that specifies whether to overwrite existing file/files.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "path",
+                "description": "The path of the new file. The path should be the absolute DBFS path.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "path",
+                "description": "The path of the new file. The path should be the absolute DBFS path.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Delete the file or directory (optionally recursively delete all files in the directory).\nThis call throws an exception with `IO_ERROR` if the path is a non-empty directory and `recursive` is set to\n`false` or on other similar errors.\n\nWhen you delete a large number of files, the delete operation is done in increments. The call returns\na response after approximately 45 seconds with an error message (503 Service Unavailable) asking you to\nre-invoke the delete operation until the directory structure is fully deleted.\n\nFor operations that delete more than 10K files, we discourage using the DBFS REST API, but advise you to\nperform such operations in the context of a cluster, using\nthe [File system utility (dbutils.fs)](/dev-tools/databricks-utils.html#dbutils-fs). `dbutils.fs`\ncovers the functional scope of the DBFS REST API, but from notebooks. Running such operations using notebooks\nprovides better control and manageability, such as selective deletes, and the possibility to automate periodic\ndelete jobs.",
+            "summary": "Delete a file/directory.",
+            "path": "/api/2.0/dbfs/delete",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "Delete",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "path",
+                  "description": "The path of the file or directory to delete. The path should be the absolute DBFS path.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "path",
+                  "description": "The path of the file or directory to delete. The path should be the absolute DBFS path.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "path",
+                "description": "The path of the file or directory to delete. The path should be the absolute DBFS path.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "recursive",
+                "description": "Whether or not to recursively delete the directory's contents. Deleting empty directories can be done without providing the recursive flag.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "path",
+                "description": "The path of the file or directory to delete. The path should be the absolute DBFS path.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetStatus",
+            "description": "Gets the file information for a file or directory.\nIf the file or directory does not exist, this call throws an exception with `RESOURCE_DOES_NOT_EXIST`.",
+            "summary": "Get the information of a file or directory.",
+            "path": "/api/2.0/dbfs/get-status",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetStatusRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "path",
+                  "description": "The path of the file or directory. The path should be the absolute DBFS path.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "path",
+                  "description": "The path of the file or directory. The path should be the absolute DBFS path.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "FileInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "path",
+                "description": "The path of the file or directory. The path should be the absolute DBFS path.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "path",
+                "description": "The path of the file or directory. The path should be the absolute DBFS path.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "List the contents of a directory, or details of the file. If the file or directory does not exist, this call\nthrows an exception with `RESOURCE_DOES_NOT_EXIST`.\n\nWhen calling list on a large directory, the list operation will time out after approximately 60 seconds.\nWe strongly recommend using list only on directories containing less than 10K files and discourage using\nthe DBFS REST API for operations that list more than 10K files. Instead, we recommend that you perform such\noperations in the context of a cluster, using\nthe [File system utility (dbutils.fs)](/dev-tools/databricks-utils.html#dbutils-fs), which provides the same\nfunctionality without timing out.",
+            "summary": "List directory contents or file details.",
+            "path": "/api/2.0/dbfs/list",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListDbfsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "path",
+                  "description": "The path of the file or directory. The path should be the absolute DBFS path.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "path",
+                  "description": "The path of the file or directory. The path should be the absolute DBFS path.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListStatusResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "path",
+                "description": "The path of the file or directory. The path should be the absolute DBFS path.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "path",
+                "description": "The path of the file or directory. The path should be the absolute DBFS path.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {}
+          },
+          {
+            "name": "Mkdirs",
+            "description": "Creates the given directory and necessary parent directories if they do not exist.\nIf a file (not a directory) exists at any prefix of the input path, this call throws an exception with `RESOURCE_ALREADY_EXISTS`.\n**Note**: If this operation fails, it might have succeeded in creating some of the necessary parent directories.",
+            "summary": "Create a directory.",
+            "path": "/api/2.0/dbfs/mkdirs",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "MkDirs",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "path",
+                  "description": "The path of the new directory. The path should be the absolute DBFS path.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "path",
+                  "description": "The path of the new directory. The path should be the absolute DBFS path.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "MkDirsResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "path",
+                "description": "The path of the new directory. The path should be the absolute DBFS path.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "path",
+                "description": "The path of the new directory. The path should be the absolute DBFS path.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Move",
+            "description": "Moves a file from one location to another location within DBFS.\nIf the source file does not exist, this call throws an exception with `RESOURCE_DOES_NOT_EXIST`.\nIf a file already exists in the destination path, this call throws an exception with `RESOURCE_ALREADY_EXISTS`.\nIf the given source path is a directory, this call always recursively moves all files.",
+            "summary": "Move a file.",
+            "path": "/api/2.0/dbfs/move",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "Move",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "source_path",
+                  "description": "The source path of the file or directory. The path should be the absolute DBFS path.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "destination_path",
+                  "description": "The destination path of the file or directory. The path should be the absolute DBFS path.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "source_path",
+                  "description": "The source path of the file or directory. The path should be the absolute DBFS path.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "destination_path",
+                  "description": "The destination path of the file or directory. The path should be the absolute DBFS path.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "MoveResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "destination_path",
+                "description": "The destination path of the file or directory. The path should be the absolute DBFS path.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "source_path",
+                "description": "The source path of the file or directory. The path should be the absolute DBFS path.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "source_path",
+                "description": "The source path of the file or directory. The path should be the absolute DBFS path.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "destination_path",
+                "description": "The destination path of the file or directory. The path should be the absolute DBFS path.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Put",
+            "description": "Uploads a file through the use of multipart form post.\nIt is mainly used for streaming uploads, but can also be used as a convenient single call for data upload.\n\nAlternatively you can pass contents as base64 string.\n\nThe amount of data that can be passed (when not streaming) using the __contents__  parameter is limited to 1 MB.\n`MAX_BLOCK_SIZE_EXCEEDED` will be thrown if this limit is exceeded.\n\nIf you want to upload large files, use the streaming upload. For details, see :method:dbfs/create,\n:method:dbfs/addBlock, :method:dbfs/close.",
+            "summary": "Upload a file.",
+            "path": "/api/2.0/dbfs/put",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "Put",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "path",
+                  "description": "The path of the new file. The path should be the absolute DBFS path.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "path",
+                  "description": "The path of the new file. The path should be the absolute DBFS path.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "PutResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "contents",
+                "description": "This parameter might be absent, and instead a posted file will be used.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "overwrite",
+                "description": "The flag that specifies whether to overwrite existing file/files.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "path",
+                "description": "The path of the new file. The path should be the absolute DBFS path.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "path",
+                "description": "The path of the new file. The path should be the absolute DBFS path.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Read",
+            "description": "Returns the contents of a file. If the file does not exist, this call throws an exception with `RESOURCE_DOES_NOT_EXIST`.\nIf the path is a directory, the read length is negative, or if the offset is negative, this call throws an exception with\n`INVALID_PARAMETER_VALUE`. If the read length exceeds 1 MB, this call throws an\nexception with `MAX_READ_SIZE_EXCEEDED`.\n\nIf `offset + length` exceeds the number of bytes in a file, it reads the contents until the end of file.",
+            "summary": "Get the contents of a file.",
+            "path": "/api/2.0/dbfs/read",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ReadDbfsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "path",
+                  "description": "The path of the file to read. The path should be the absolute DBFS path.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "path",
+                  "description": "The path of the file to read. The path should be the absolute DBFS path.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ReadResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "length",
+                "description": "The number of bytes to read starting from the offset. This has a limit of 1 MB, and a default\nvalue of 0.5 MB.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "offset",
+                "description": "The offset to read from in bytes.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "path",
+                "description": "The path of the file to read. The path should be the absolute DBFS path.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "path",
+                "description": "The path of the file to read. The path should be the absolute DBFS path.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "sql.DbsqlPermissions",
+        "name": "DbsqlPermissions",
+        "description": "The SQL Permissions API is similar to the endpoints of the :method:permissions/set. However, this\nexposes only one endpoint, which gets the Access Control List for a given object. You cannot\nmodify any permissions using this API.\n\nThere are three levels of permission:\n\n- `CAN_VIEW`: Allows read-only access\n\n- `CAN_RUN`: Allows read access and run access (superset of `CAN_VIEW`)\n\n- `CAN_MANAGE`: Allows all actions: read, run, edit, delete, modify permissions (superset of `CAN_RUN`)\n\n**Warning**: This API is deprecated. Please see the latest version of the Databricks SQL API. [Learn more](https://docs.databricks.com/en/sql/dbsql-api-latest.html)",
+        "package": {
+          "name": "sql"
+        },
+        "docs_group": "sql",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "methods": [
+          {
+            "name": "Get",
+            "description": "Gets a JSON representation of the access control list (ACL) for a specified object.\n\n**Warning**: This API is deprecated. Please use :method:workspace/getpermissions instead. [Learn more](https://docs.databricks.com/en/sql/dbsql-api-latest.html)",
+            "summary": "Get object ACL.",
+            "path": "/api/2.0/preview/sql/permissions/{objectType}/{objectId}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetDbsqlPermissionRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "objectType",
+                  "description": "The type of object permissions to check.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "pascal_name": "ObjectTypePlural",
+                    "enum": [
+                      {
+                        "content": "alerts"
+                      },
+                      {
+                        "content": "dashboards"
+                      },
+                      {
+                        "content": "data_sources"
+                      },
+                      {
+                        "content": "queries"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "objectId",
+                  "description": "Object ID. An ACL is returned for the object with this UUID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "objectType",
+                  "description": "The type of object permissions to check.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "pascal_name": "ObjectTypePlural",
+                    "enum": [
+                      {
+                        "content": "alerts"
+                      },
+                      {
+                        "content": "dashboards"
+                      },
+                      {
+                        "content": "data_sources"
+                      },
+                      {
+                        "content": "queries"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "objectId",
+                  "description": "Object ID. An ACL is returned for the object with this UUID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "objectId",
+                "description": "Object ID. An ACL is returned for the object with this UUID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "objectType",
+                "description": "The type of object permissions to check.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "pascal_name": "ObjectTypePlural",
+                  "enum": [
+                    {
+                      "content": "alerts"
+                    },
+                    {
+                      "content": "dashboards"
+                    },
+                    {
+                      "content": "data_sources"
+                    },
+                    {
+                      "content": "queries"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "objectType",
+                "description": "The type of object permissions to check.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "pascal_name": "ObjectTypePlural",
+                  "enum": [
+                    {
+                      "content": "alerts"
+                    },
+                    {
+                      "content": "dashboards"
+                    },
+                    {
+                      "content": "data_sources"
+                    },
+                    {
+                      "content": "queries"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "objectId",
+                "description": "Object ID. An ACL is returned for the object with this UUID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Set",
+            "description": "Sets the access control list (ACL) for a specified object. This operation will complete rewrite the ACL.\n\n**Warning**: This API is deprecated. Please use :method:workspace/setpermissions instead. [Learn more](https://docs.databricks.com/en/sql/dbsql-api-latest.html)",
+            "summary": "Set object ACL.",
+            "path": "/api/2.0/preview/sql/permissions/{objectType}/{objectId}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "SetRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "objectType",
+                  "description": "The type of object permission to set.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "pascal_name": "ObjectTypePlural",
+                    "enum": [
+                      {
+                        "content": "alerts"
+                      },
+                      {
+                        "content": "dashboards"
+                      },
+                      {
+                        "content": "data_sources"
+                      },
+                      {
+                        "content": "queries"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "objectId",
+                  "description": "Object ID. The ACL for the object with this UUID is overwritten by this request's POST content.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "objectType",
+                  "description": "The type of object permission to set.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "pascal_name": "ObjectTypePlural",
+                    "enum": [
+                      {
+                        "content": "alerts"
+                      },
+                      {
+                        "content": "dashboards"
+                      },
+                      {
+                        "content": "data_sources"
+                      },
+                      {
+                        "content": "queries"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "objectId",
+                  "description": "Object ID. The ACL for the object with this UUID is overwritten by this request's POST content.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "SetResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "access_control_list",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AccessControlList",
+                  "array_value": {
+                    "pascal_name": "AccessControl",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "objectId",
+                "description": "Object ID. The ACL for the object with this UUID is overwritten by this request's POST content.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "objectType",
+                "description": "The type of object permission to set.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "pascal_name": "ObjectTypePlural",
+                  "enum": [
+                    {
+                      "content": "alerts"
+                    },
+                    {
+                      "content": "dashboards"
+                    },
+                    {
+                      "content": "data_sources"
+                    },
+                    {
+                      "content": "queries"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "objectType",
+                "description": "The type of object permission to set.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "pascal_name": "ObjectTypePlural",
+                  "enum": [
+                    {
+                      "content": "alerts"
+                    },
+                    {
+                      "content": "dashboards"
+                    },
+                    {
+                      "content": "data_sources"
+                    },
+                    {
+                      "content": "queries"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "objectId",
+                "description": "Object ID. The ACL for the object with this UUID is overwritten by this request's POST content.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "TransferOwnership",
+            "description": "Transfers ownership of a dashboard, query, or alert to an active user. Requires an admin API key.\n\n**Warning**: This API is deprecated. For queries and alerts, please use :method:queries/update and :method:alerts/update respectively instead. [Learn more](https://docs.databricks.com/en/sql/dbsql-api-latest.html)",
+            "summary": "Transfer object ownership.",
+            "path": "/api/2.0/preview/sql/permissions/{objectType}/{objectId}/transfer",
+            "can_use_json": true,
+            "must_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "TransferOwnershipRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "objectType",
+                  "description": "The type of object on which to change ownership.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "pascal_name": "OwnableObjectType",
+                    "enum": [
+                      {
+                        "content": "alert"
+                      },
+                      {
+                        "content": "dashboard"
+                      },
+                      {
+                        "content": "query"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "objectId",
+                  "description": "The ID of the object on which to change ownership.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "pascal_name": "TransferOwnershipObjectId",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "objectType",
+                  "description": "The type of object on which to change ownership.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "pascal_name": "OwnableObjectType",
+                    "enum": [
+                      {
+                        "content": "alert"
+                      },
+                      {
+                        "content": "dashboard"
+                      },
+                      {
+                        "content": "query"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "objectId",
+                  "description": "The ID of the object on which to change ownership.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "pascal_name": "TransferOwnershipObjectId",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Success",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "new_owner",
+                "description": "Email address for the new owner, who must exist in the workspace.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "objectId",
+                "description": "The ID of the object on which to change ownership.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "pascal_name": "TransferOwnershipObjectId",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "objectType",
+                "description": "The type of object on which to change ownership.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "pascal_name": "OwnableObjectType",
+                  "enum": [
+                    {
+                      "content": "alert"
+                    },
+                    {
+                      "content": "dashboard"
+                    },
+                    {
+                      "content": "query"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "objectType",
+                "description": "The type of object on which to change ownership.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "pascal_name": "OwnableObjectType",
+                  "enum": [
+                    {
+                      "content": "alert"
+                    },
+                    {
+                      "content": "dashboard"
+                    },
+                    {
+                      "content": "query"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "objectId",
+                "description": "The ID of the object on which to change ownership.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "pascal_name": "TransferOwnershipObjectId",
+                  "is_object": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "settings.DefaultNamespace",
+        "name": "DefaultNamespace",
+        "description": "The default namespace setting API allows users to configure the default namespace for a Databricks workspace.\n\nThrough this API, users can retrieve, set, or modify the default namespace used when queries do not reference\na fully qualified three-level name. For example, if you use the API to set 'retail_prod' as the default catalog, then a query\n'SELECT * FROM myTable' would reference the object 'retail_prod.default.myTable' (the schema 'default' is always assumed).\n\nThis setting requires a restart of clusters and SQL warehouses to take effect. Additionally, the default namespace only applies when using Unity Catalog-enabled compute.",
+        "package": {
+          "name": "settings"
+        },
+        "has_parent": true,
+        "docs_group": "settings",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "parent_service_id": "settings.Settings",
+        "methods": [
+          {
+            "name": "Delete",
+            "description": "Deletes the default namespace setting for the workspace. A fresh etag needs to be provided in `DELETE`\nrequests (as a query parameter). The etag can be retrieved by making a `GET` request before the `DELETE` request.\nIf the setting is updated/deleted concurrently, `DELETE` fails with 409 and the\nrequest must be retried by using the fresh etag in the 409 response.",
+            "summary": "Delete the default namespace setting.",
+            "path": "/api/2.0/settings/types/default_namespace_ws/names/default",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "DeleteDefaultNamespaceSettingRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "DeleteDefaultNamespaceSettingResponse",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "etag",
+                  "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "etag",
+                  "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets the default namespace setting.",
+            "summary": "Get the default namespace setting.",
+            "path": "/api/2.0/settings/types/default_namespace_ws/names/default",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetDefaultNamespaceSettingRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "DefaultNamespaceSetting",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "namespace",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "StringMessage",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "namespace",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "StringMessage",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Updates the default namespace setting for the workspace. A fresh etag needs to be provided in `PATCH`\nrequests (as part of the setting field). The etag can be retrieved by making a `GET` request before the `PATCH` request.\nNote that if the setting does not exist, `GET` returns a NOT_FOUND error and the etag is present in the error response,\nwhich should be set in the `PATCH` request. If the setting is updated concurrently, `PATCH` fails with 409 and the request\nmust be retried by using the fresh etag in the 409 response.",
+            "summary": "Update the default namespace setting.",
+            "path": "/api/2.0/settings/types/default_namespace_ws/names/default",
+            "can_use_json": true,
+            "must_use_json": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "UpdateDefaultNamespaceSettingRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DefaultNamespaceSetting",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DefaultNamespaceSetting",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DefaultNamespaceSetting",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "namespace",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "StringMessage",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "namespace",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "StringMessage",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "allow_missing",
+                "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "field_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "setting",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DefaultNamespaceSetting",
+                  "is_object": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "settings.DefaultWarehouseId",
+        "name": "DefaultWarehouseId",
+        "description": "Warehouse to be selected by default for users in this workspace. Covers SQL workloads only and can be overridden by users.",
+        "package": {
+          "name": "settings"
+        },
+        "has_parent": true,
+        "is_hidden_cli": true,
+        "docs_group": "settings",
+        "launch_stage": "PRIVATE_PREVIEW",
+        "cli_launch_stage_display": "Private Preview",
+        "parent_service_id": "settings.Settings",
+        "methods": [
+          {
+            "name": "Delete",
+            "description": "Reverts the Default Warehouse Id setting to its default value.",
+            "summary": "Delete the Default Warehouse Id setting.",
+            "path": "/api/2.0/settings/types/default_warehouse_id/names/default",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "DeleteDefaultWarehouseIdRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "DeleteDefaultWarehouseIdResponse",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "etag",
+                  "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "etag",
+                  "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets the Default Warehouse Id setting.",
+            "summary": "Get the Default Warehouse Id setting.",
+            "path": "/api/2.0/settings/types/default_warehouse_id/names/default",
+            "is_crud_read": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "GetDefaultWarehouseIdRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "DefaultWarehouseId",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "string_val",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "StringMessage",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "string_val",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "StringMessage",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Updates the Default Warehouse Id setting.",
+            "summary": "Update the Default Warehouse Id setting.",
+            "path": "/api/2.0/settings/types/default_warehouse_id/names/default",
+            "can_use_json": true,
+            "must_use_json": true,
+            "is_hidden_cli": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "UpdateDefaultWarehouseIdRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DefaultWarehouseId",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DefaultWarehouseId",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DefaultWarehouseId",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "string_val",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "StringMessage",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "string_val",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "StringMessage",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "allow_missing",
+                "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "field_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "setting",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DefaultWarehouseId",
+                  "is_object": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "settings.DisableLegacyAccess",
+        "name": "DisableLegacyAccess",
+        "description": "'Disabling legacy access' has the following impacts:\n\n1. Disables direct access to Hive Metastores from the workspace. However, you can still access a Hive Metastore through Hive Metastore federation.\n2. Disables fallback mode on external location access from the workspace.\n3. Disables Databricks Runtime versions prior to 13.3LTS.",
+        "package": {
+          "name": "settings"
+        },
+        "has_parent": true,
+        "docs_group": "settings",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "parent_service_id": "settings.Settings",
+        "methods": [
+          {
+            "name": "Delete",
+            "description": "Deletes legacy access disablement status.",
+            "summary": "Delete Legacy Access Disablement Status.",
+            "path": "/api/2.0/settings/types/disable_legacy_access/names/default",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteDisableLegacyAccessRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "DeleteDisableLegacyAccessResponse",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "etag",
+                  "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "etag",
+                  "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Retrieves legacy access disablement Status.",
+            "summary": "Retrieve Legacy Access Disablement Status.",
+            "path": "/api/2.0/settings/types/disable_legacy_access/names/default",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetDisableLegacyAccessRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "DisableLegacyAccess",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "disable_legacy_access",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BooleanMessage",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "disable_legacy_access",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BooleanMessage",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Updates legacy access disablement status.",
+            "summary": "Update Legacy Access Disablement Status.",
+            "path": "/api/2.0/settings/types/disable_legacy_access/names/default",
+            "can_use_json": true,
+            "must_use_json": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateDisableLegacyAccessRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DisableLegacyAccess",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DisableLegacyAccess",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DisableLegacyAccess",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "disable_legacy_access",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BooleanMessage",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "disable_legacy_access",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BooleanMessage",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "allow_missing",
+                "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "field_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "setting",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DisableLegacyAccess",
+                  "is_object": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "settings.DisableLegacyDbfs",
+        "name": "DisableLegacyDbfs",
+        "description": "Disabling legacy DBFS has the following implications:\n\n1. Access to DBFS root and DBFS mounts is disallowed (as well as the creation of new mounts).\n2. Disables Databricks Runtime versions prior to 13.3LTS.\n\nWhen the setting is off, all DBFS functionality is enabled and no restrictions are imposed on Databricks Runtime versions.\nThis setting can take up to 20 minutes to take effect and requires a manual restart of all-purpose compute clusters and SQL warehouses.",
+        "package": {
+          "name": "settings"
+        },
+        "has_parent": true,
+        "docs_group": "settings",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "parent_service_id": "settings.Settings",
+        "methods": [
+          {
+            "name": "Delete",
+            "description": "Deletes the disable legacy DBFS setting for a workspace, reverting back to the default.",
+            "summary": "Delete the disable legacy DBFS setting.",
+            "path": "/api/2.0/settings/types/disable_legacy_dbfs/names/default",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteDisableLegacyDbfsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "DeleteDisableLegacyDbfsResponse",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "etag",
+                  "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "etag",
+                  "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets the disable legacy DBFS setting.",
+            "summary": "Get the disable legacy DBFS setting.",
+            "path": "/api/2.0/settings/types/disable_legacy_dbfs/names/default",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetDisableLegacyDbfsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "DisableLegacyDbfs",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "disable_legacy_dbfs",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BooleanMessage",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "disable_legacy_dbfs",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BooleanMessage",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Updates the disable legacy DBFS setting for the workspace.",
+            "summary": "Update the disable legacy DBFS setting.",
+            "path": "/api/2.0/settings/types/disable_legacy_dbfs/names/default",
+            "can_use_json": true,
+            "must_use_json": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateDisableLegacyDbfsRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DisableLegacyDbfs",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DisableLegacyDbfs",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DisableLegacyDbfs",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "disable_legacy_dbfs",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BooleanMessage",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "disable_legacy_dbfs",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BooleanMessage",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "allow_missing",
+                "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "field_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "setting",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DisableLegacyDbfs",
+                  "is_object": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "settings.DisableLegacyFeatures",
+        "name": "DisableLegacyFeatures",
+        "description": "Disable legacy features for new Databricks workspaces.\n\nFor newly created workspaces:\n1. Disables the use of DBFS root and mounts.\n2. Hive Metastore will not be provisioned.\n3. Disables the use of ‘No-isolation clusters’.\n4. Disables Databricks Runtime versions prior to 13.3LTS.",
+        "package": {
+          "name": "settings"
+        },
+        "is_accounts": true,
+        "has_parent": true,
+        "docs_group": "settings",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "parent_service_id": "settings.AccountSettings",
+        "methods": [
+          {
+            "name": "Delete",
+            "description": "Deletes the disable legacy features setting.",
+            "summary": "Delete the disable legacy features setting.",
+            "path": "/api/2.0/accounts/{account_id}/settings/types/disable_legacy_features/names/default",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteDisableLegacyFeaturesRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "DeleteDisableLegacyFeaturesResponse",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "etag",
+                  "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "etag",
+                  "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets the value of the disable legacy features setting.",
+            "summary": "Get the disable legacy features setting.",
+            "path": "/api/2.0/accounts/{account_id}/settings/types/disable_legacy_features/names/default",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetDisableLegacyFeaturesRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "DisableLegacyFeatures",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "disable_legacy_features",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BooleanMessage",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "disable_legacy_features",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BooleanMessage",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Updates the value of the disable legacy features setting.",
+            "summary": "Update the disable legacy features setting.",
+            "path": "/api/2.0/accounts/{account_id}/settings/types/disable_legacy_features/names/default",
+            "can_use_json": true,
+            "must_use_json": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateDisableLegacyFeaturesRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DisableLegacyFeatures",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DisableLegacyFeatures",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DisableLegacyFeatures",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "disable_legacy_features",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BooleanMessage",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "disable_legacy_features",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BooleanMessage",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "allow_missing",
+                "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "field_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "setting",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DisableLegacyFeatures",
+                  "is_object": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "disasterrecovery.DisasterRecovery",
+        "name": "DisasterRecovery",
+        "description": "Manage disaster recovery configurations and execute failover operations.",
+        "package": {
+          "name": "disasterrecovery"
+        },
+        "is_accounts": true,
+        "docs_group": "disasterrecovery",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListFailoverGroupsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "CreateFailoverGroup",
+            "description": "Create a new failover group.",
+            "summary": "Create a Failover Group.",
+            "path": "/api/disaster-recovery/v1/{parent=accounts/*}/failover-groups",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateFailoverGroupRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "The parent resource. Format: accounts/{account_id}.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "failover_group",
+                  "description": "The failover group to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "FailoverGroup",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "failover_group_id",
+                  "description": "Client-provided identifier for the failover group. Used to construct the\nresource name as {parent}/failover-groups/{failover_group_id}.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "The parent resource. Format: accounts/{account_id}.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "failover_group_id",
+                  "description": "Client-provided identifier for the failover group. Used to construct the\nresource name as {parent}/failover-groups/{failover_group_id}.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "failover_group",
+                  "description": "The failover group to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "FailoverGroup",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "failover_group",
+              "description": "The failover group to create.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "FailoverGroup",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "regions",
+                    "description": "List of all regions participating in this failover group.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "List",
+                      "array_value": {
+                        "is_string": true
+                      }
+                    }
+                  },
+                  {
+                    "name": "workspace_sets",
+                    "description": "Workspace sets, each containing workspaces that replicate to each other.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "WorkspaceSetList",
+                      "array_value": {
+                        "pascal_name": "WorkspaceSet",
+                        "is_object": true
+                      }
+                    }
+                  },
+                  {
+                    "name": "initial_primary_region",
+                    "description": "Initial primary region. Used only in Create requests to set the starting\nprimary region. Not returned in responses.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "regions",
+                    "description": "List of all regions participating in this failover group.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "List",
+                      "array_value": {
+                        "is_string": true
+                      }
+                    }
+                  },
+                  {
+                    "name": "workspace_sets",
+                    "description": "Workspace sets, each containing workspaces that replicate to each other.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "WorkspaceSetList",
+                      "array_value": {
+                        "pascal_name": "WorkspaceSet",
+                        "is_object": true
+                      }
+                    }
+                  },
+                  {
+                    "name": "initial_primary_region",
+                    "description": "Initial primary region. Used only in Create requests to set the starting\nprimary region. Not returned in responses.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "FailoverGroup",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "regions",
+                  "description": "List of all regions participating in this failover group.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "List",
+                    "array_value": {
+                      "is_string": true
+                    }
+                  }
+                },
+                {
+                  "name": "workspace_sets",
+                  "description": "Workspace sets, each containing workspaces that replicate to each other.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "WorkspaceSetList",
+                    "array_value": {
+                      "pascal_name": "WorkspaceSet",
+                      "is_object": true
+                    }
+                  }
+                },
+                {
+                  "name": "initial_primary_region",
+                  "description": "Initial primary region. Used only in Create requests to set the starting\nprimary region. Not returned in responses.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "regions",
+                  "description": "List of all regions participating in this failover group.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "List",
+                    "array_value": {
+                      "is_string": true
+                    }
+                  }
+                },
+                {
+                  "name": "workspace_sets",
+                  "description": "Workspace sets, each containing workspaces that replicate to each other.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "WorkspaceSetList",
+                    "array_value": {
+                      "pascal_name": "WorkspaceSet",
+                      "is_object": true
+                    }
+                  }
+                },
+                {
+                  "name": "initial_primary_region",
+                  "description": "Initial primary region. Used only in Create requests to set the starting\nprimary region. Not returned in responses.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "failover_group",
+                "description": "The failover group to create.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "FailoverGroup",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "regions",
+                      "description": "List of all regions participating in this failover group.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "List",
+                        "array_value": {
+                          "is_string": true
+                        }
+                      }
+                    },
+                    {
+                      "name": "workspace_sets",
+                      "description": "Workspace sets, each containing workspaces that replicate to each other.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "WorkspaceSetList",
+                        "array_value": {
+                          "pascal_name": "WorkspaceSet",
+                          "is_object": true
+                        }
+                      }
+                    },
+                    {
+                      "name": "initial_primary_region",
+                      "description": "Initial primary region. Used only in Create requests to set the starting\nprimary region. Not returned in responses.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "regions",
+                      "description": "List of all regions participating in this failover group.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "List",
+                        "array_value": {
+                          "is_string": true
+                        }
+                      }
+                    },
+                    {
+                      "name": "workspace_sets",
+                      "description": "Workspace sets, each containing workspaces that replicate to each other.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "WorkspaceSetList",
+                        "array_value": {
+                          "pascal_name": "WorkspaceSet",
+                          "is_object": true
+                        }
+                      }
+                    },
+                    {
+                      "name": "initial_primary_region",
+                      "description": "Initial primary region. Used only in Create requests to set the starting\nprimary region. Not returned in responses.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "failover_group_id",
+                "description": "Client-provided identifier for the failover group. Used to construct the\nresource name as {parent}/failover-groups/{failover_group_id}.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "The parent resource. Format: accounts/{account_id}.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "validate_only",
+                "description": "When true, validates the request without creating the failover group.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Time at which this failover group was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "effective_primary_region",
+                "description": "Current effective primary region. Replication flows FROM workspaces in this region.\nChanges after a successful failover.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "etag",
+                "description": "Opaque version string for optimistic locking. Server-generated and returned in responses.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "has_replication_point_blocking_errors",
+                "description": "True if errors currently block the replication point.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "initial_primary_region",
+                "description": "Initial primary region. Used only in Create requests to set the starting\nprimary region. Not returned in responses.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "initial_replication_progress",
+                "description": "Initial replication progress of all in-scope assets. Set only when the FailoverGroup is in INITIAL_REPLICATION state.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "InitialReplicationProgress",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Fully qualified resource name in the format\naccounts/{account_id}/failover-groups/{failover_group_id}.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "regions",
+                "description": "List of all regions participating in this failover group.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "replication_point",
+                "description": "The latest point in time to which data has been replicated.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "state",
+                "description": "Aggregate state of the failover group.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "FailoverGroupState",
+                  "enum": [
+                    {
+                      "content": "ACTIVE"
+                    },
+                    {
+                      "content": "CREATING"
+                    },
+                    {
+                      "content": "CREATION_FAILED"
+                    },
+                    {
+                      "content": "DELETING"
+                    },
+                    {
+                      "content": "DELETION_FAILED"
+                    },
+                    {
+                      "content": "FAILING_OVER"
+                    },
+                    {
+                      "content": "FAILOVER_FAILED"
+                    },
+                    {
+                      "content": "INITIAL_REPLICATION"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "unity_catalog_assets",
+                "description": "Unity Catalog replication configuration.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "UcReplicationConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "Time at which this failover group was last modified.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "workspace_sets",
+                "description": "Workspace sets, each containing workspaces that replicate to each other.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "WorkspaceSetList",
+                  "array_value": {
+                    "pascal_name": "WorkspaceSet",
+                    "is_object": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "The parent resource. Format: accounts/{account_id}.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "failover_group_id",
+                "description": "Client-provided identifier for the failover group. Used to construct the\nresource name as {parent}/failover-groups/{failover_group_id}.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "regions",
+                "description": "List of all regions participating in this failover group.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "workspace_sets",
+                "description": "Workspace sets, each containing workspaces that replicate to each other.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "WorkspaceSetList",
+                  "array_value": {
+                    "pascal_name": "WorkspaceSet",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "initial_primary_region",
+                "description": "Initial primary region. Used only in Create requests to set the starting\nprimary region. Not returned in responses.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateStableUrl",
+            "description": "Create a new stable URL.",
+            "summary": "Create a Stable URL.",
+            "path": "/api/disaster-recovery/v1/{parent=accounts/*}/stable-urls",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateStableUrlRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "The parent resource. Format: accounts/{account_id}.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "stable_url",
+                  "description": "The stable URL to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "StableUrl",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "stable_url_id",
+                  "description": "Client-provided identifier for the stable URL. Used to construct the\nresource name as {parent}/stable-urls/{stable_url_id}.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "The parent resource. Format: accounts/{account_id}.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "stable_url_id",
+                  "description": "Client-provided identifier for the stable URL. Used to construct the\nresource name as {parent}/stable-urls/{stable_url_id}.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "stable_url",
+                  "description": "The stable URL to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "StableUrl",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "stable_url",
+              "description": "The stable URL to create.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "StableUrl",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "initial_workspace_id",
+                    "description": "The workspace this stable URL is initially bound to. Used only in Create\nrequests to associate the stable URL with a workspace. Not returned in\nresponses.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "initial_workspace_id",
+                    "description": "The workspace this stable URL is initially bound to. Used only in Create\nrequests to associate the stable URL with a workspace. Not returned in\nresponses.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "StableUrl",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "initial_workspace_id",
+                  "description": "The workspace this stable URL is initially bound to. Used only in Create\nrequests to associate the stable URL with a workspace. Not returned in\nresponses.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "initial_workspace_id",
+                  "description": "The workspace this stable URL is initially bound to. Used only in Create\nrequests to associate the stable URL with a workspace. Not returned in\nresponses.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "parent",
+                "description": "The parent resource. Format: accounts/{account_id}.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "stable_url",
+                "description": "The stable URL to create.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "StableUrl",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "initial_workspace_id",
+                      "description": "The workspace this stable URL is initially bound to. Used only in Create\nrequests to associate the stable URL with a workspace. Not returned in\nresponses.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "initial_workspace_id",
+                      "description": "The workspace this stable URL is initially bound to. Used only in Create\nrequests to associate the stable URL with a workspace. Not returned in\nresponses.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "stable_url_id",
+                "description": "Client-provided identifier for the stable URL. Used to construct the\nresource name as {parent}/stable-urls/{stable_url_id}.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "validate_only",
+                "description": "When true, validates the request without creating the stable URL.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "effective_workspace_id",
+                "description": "The workspace this stable URL currently routes to. Set to\n`initial_workspace_id` at creation, advanced to the failover group's primary\nwhile attached (including across a failover), and preserved when the stable\nURL is detached from its failover group. Read this to see where an unattached\nstable URL points: after a failover followed by a detach it reflects the\npost-failover primary, not `initial_workspace_id`.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "failover_group_name",
+                "description": "Fully qualified resource name of the FailoverGroup this stable URL is\ncurrently linked to, in the format\n`accounts/{account_id}/failover-groups/{failover_group_id}`. Empty when\nthe stable URL is not attached to any failover group.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "initial_workspace_id",
+                "description": "The workspace this stable URL is initially bound to. Used only in Create\nrequests to associate the stable URL with a workspace. Not returned in\nresponses.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Fully qualified resource name.\nFormat: accounts/{account_id}/stable-urls/{stable_url_id}.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "stable_workspace_id",
+                "description": "The stable workspace ID for this stable URL. Generated on creation and\nimmutable thereafter; identifies the URL across failovers and is the same\nvalue embedded in the `url` (as the `w=` query parameter for SPOG URLs,\nor in the `conn-\u003cid\u003e` hostname for Private-Link URLs).",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "url",
+                "description": "The stable URL endpoint. Generated on creation and\nimmutable thereafter. For non-Private-Link workspaces this is\n`https://\u003cspog_host\u003e/?w=\u003cconnection_id\u003e`. For Private-Link workspaces\nthis is the per-connection hostname.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "The parent resource. Format: accounts/{account_id}.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "stable_url_id",
+                "description": "Client-provided identifier for the stable URL. Used to construct the\nresource name as {parent}/stable-urls/{stable_url_id}.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "initial_workspace_id",
+                "description": "The workspace this stable URL is initially bound to. Used only in Create\nrequests to associate the stable URL with a workspace. Not returned in\nresponses.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteFailoverGroup",
+            "description": "Delete a failover group.",
+            "summary": "Delete a Failover Group.",
+            "path": "/api/disaster-recovery/v1/{name=accounts/*/failover-groups/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteFailoverGroupRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The fully qualified resource name of the failover group to delete.\nFormat: accounts/{account_id}/failover-groups/{failover_group_id}.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The fully qualified resource name of the failover group to delete.\nFormat: accounts/{account_id}/failover-groups/{failover_group_id}.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "Opaque version string for optimistic locking. If provided, must match the\ncurrent etag. If omitted, the delete proceeds without an etag check.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The fully qualified resource name of the failover group to delete.\nFormat: accounts/{account_id}/failover-groups/{failover_group_id}.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The fully qualified resource name of the failover group to delete.\nFormat: accounts/{account_id}/failover-groups/{failover_group_id}.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteStableUrl",
+            "description": "Delete a stable URL.",
+            "summary": "Delete a Stable URL.",
+            "path": "/api/disaster-recovery/v1/{name=accounts/*/stable-urls/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteStableUrlRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The fully qualified resource name.\nFormat: accounts/{account_id}/stable-urls/{stable_url_id}.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The fully qualified resource name.\nFormat: accounts/{account_id}/stable-urls/{stable_url_id}.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The fully qualified resource name.\nFormat: accounts/{account_id}/stable-urls/{stable_url_id}.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The fully qualified resource name.\nFormat: accounts/{account_id}/stable-urls/{stable_url_id}.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "FailoverFailoverGroup",
+            "description": "Initiate a failover to a new primary region.",
+            "summary": "Failover a Failover Group to a new primary region.",
+            "path": "/api/disaster-recovery/v1/{name=accounts/*/failover-groups/*}/failover",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "FailoverFailoverGroupRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The fully qualified resource name of the failover group to failover.\nFormat: accounts/{account_id}/failover-groups/{failover_group_id}.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "target_primary_region",
+                  "description": "The target primary region. Must be one of the participating regions and different\nfrom the current effective_primary_region. Serves as an idempotency check.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "failover_type",
+                  "description": "The type of failover to perform.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "FailoverFailoverGroupRequestFailoverType",
+                    "enum": [
+                      {
+                        "content": "FORCED"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The fully qualified resource name of the failover group to failover.\nFormat: accounts/{account_id}/failover-groups/{failover_group_id}.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "target_primary_region",
+                  "description": "The target primary region. Must be one of the participating regions and different\nfrom the current effective_primary_region. Serves as an idempotency check.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "failover_type",
+                  "description": "The type of failover to perform.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "FailoverFailoverGroupRequestFailoverType",
+                    "enum": [
+                      {
+                        "content": "FORCED"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "FailoverGroup",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "regions",
+                  "description": "List of all regions participating in this failover group.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "List",
+                    "array_value": {
+                      "is_string": true
+                    }
+                  }
+                },
+                {
+                  "name": "workspace_sets",
+                  "description": "Workspace sets, each containing workspaces that replicate to each other.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "WorkspaceSetList",
+                    "array_value": {
+                      "pascal_name": "WorkspaceSet",
+                      "is_object": true
+                    }
+                  }
+                },
+                {
+                  "name": "initial_primary_region",
+                  "description": "Initial primary region. Used only in Create requests to set the starting\nprimary region. Not returned in responses.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "regions",
+                  "description": "List of all regions participating in this failover group.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "List",
+                    "array_value": {
+                      "is_string": true
+                    }
+                  }
+                },
+                {
+                  "name": "workspace_sets",
+                  "description": "Workspace sets, each containing workspaces that replicate to each other.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "WorkspaceSetList",
+                    "array_value": {
+                      "pascal_name": "WorkspaceSet",
+                      "is_object": true
+                    }
+                  }
+                },
+                {
+                  "name": "initial_primary_region",
+                  "description": "Initial primary region. Used only in Create requests to set the starting\nprimary region. Not returned in responses.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "Opaque version string for optimistic locking. If provided, must match the\ncurrent etag. If omitted, the failover proceeds regardless of current state.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "failover_type",
+                "description": "The type of failover to perform.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "FailoverFailoverGroupRequestFailoverType",
+                  "enum": [
+                    {
+                      "content": "FORCED"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "name",
+                "description": "The fully qualified resource name of the failover group to failover.\nFormat: accounts/{account_id}/failover-groups/{failover_group_id}.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "target_primary_region",
+                "description": "The target primary region. Must be one of the participating regions and different\nfrom the current effective_primary_region. Serves as an idempotency check.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The fully qualified resource name of the failover group to failover.\nFormat: accounts/{account_id}/failover-groups/{failover_group_id}.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "target_primary_region",
+                "description": "The target primary region. Must be one of the participating regions and different\nfrom the current effective_primary_region. Serves as an idempotency check.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "failover_type",
+                "description": "The type of failover to perform.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "FailoverFailoverGroupRequestFailoverType",
+                  "enum": [
+                    {
+                      "content": "FORCED"
+                    }
+                  ]
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetFailoverGroup",
+            "description": "Get a failover group.",
+            "summary": "Get a Failover Group.",
+            "path": "/api/disaster-recovery/v1/{name=accounts/*/failover-groups/*}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetFailoverGroupRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The fully qualified resource name of the failover group.\nFormat: accounts/{account_id}/failover-groups/{failover_group_id}.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The fully qualified resource name of the failover group.\nFormat: accounts/{account_id}/failover-groups/{failover_group_id}.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "FailoverGroup",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "regions",
+                  "description": "List of all regions participating in this failover group.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "List",
+                    "array_value": {
+                      "is_string": true
+                    }
+                  }
+                },
+                {
+                  "name": "workspace_sets",
+                  "description": "Workspace sets, each containing workspaces that replicate to each other.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "WorkspaceSetList",
+                    "array_value": {
+                      "pascal_name": "WorkspaceSet",
+                      "is_object": true
+                    }
+                  }
+                },
+                {
+                  "name": "initial_primary_region",
+                  "description": "Initial primary region. Used only in Create requests to set the starting\nprimary region. Not returned in responses.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "regions",
+                  "description": "List of all regions participating in this failover group.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "List",
+                    "array_value": {
+                      "is_string": true
+                    }
+                  }
+                },
+                {
+                  "name": "workspace_sets",
+                  "description": "Workspace sets, each containing workspaces that replicate to each other.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "WorkspaceSetList",
+                    "array_value": {
+                      "pascal_name": "WorkspaceSet",
+                      "is_object": true
+                    }
+                  }
+                },
+                {
+                  "name": "initial_primary_region",
+                  "description": "Initial primary region. Used only in Create requests to set the starting\nprimary region. Not returned in responses.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The fully qualified resource name of the failover group.\nFormat: accounts/{account_id}/failover-groups/{failover_group_id}.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The fully qualified resource name of the failover group.\nFormat: accounts/{account_id}/failover-groups/{failover_group_id}.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetStableUrl",
+            "description": "Get a stable URL.",
+            "summary": "Get a Stable URL.",
+            "path": "/api/disaster-recovery/v1/{name=accounts/*/stable-urls/*}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetStableUrlRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The fully qualified resource name.\nFormat: accounts/{account_id}/stable-urls/{stable_url_id}.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The fully qualified resource name.\nFormat: accounts/{account_id}/stable-urls/{stable_url_id}.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "StableUrl",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "initial_workspace_id",
+                  "description": "The workspace this stable URL is initially bound to. Used only in Create\nrequests to associate the stable URL with a workspace. Not returned in\nresponses.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "initial_workspace_id",
+                  "description": "The workspace this stable URL is initially bound to. Used only in Create\nrequests to associate the stable URL with a workspace. Not returned in\nresponses.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The fully qualified resource name.\nFormat: accounts/{account_id}/stable-urls/{stable_url_id}.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The fully qualified resource name.\nFormat: accounts/{account_id}/stable-urls/{stable_url_id}.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListFailoverGroups",
+            "description": "List failover groups.\n\nList entries are abbreviated: `state` and `replication_point` are not\npopulated. Call GetFailoverGroup to retrieve the full resource.",
+            "summary": "List Failover Groups.",
+            "path": "/api/disaster-recovery/v1/{parent=accounts/*}/failover-groups",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListFailoverGroupsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "The parent resource. Format: accounts/{account_id}.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "The parent resource. Format: accounts/{account_id}.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListFailoverGroupsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "Maximum number of failover groups to return per page:\n- when set to a value greater than 0, the page length is the minimum of this value\nand a server configured value;\n- when set to 0 or unset, the page length is set to a server configured value\n(recommended);\n- when set to a value less than 0, an invalid parameter error is returned.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Page token received from a previous ListFailoverGroups call.\nProvide this to retrieve the subsequent page.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "The parent resource. Format: accounts/{account_id}.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "The parent resource. Format: accounts/{account_id}.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Page token received from a previous ListFailoverGroups call.\nProvide this to retrieve the subsequent page.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListStableUrls",
+            "description": "List stable URLs for an account.",
+            "summary": "List Stable URLs.",
+            "path": "/api/disaster-recovery/v1/{parent=accounts/*}/stable-urls",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListStableUrlsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "The parent resource. Format: accounts/{account_id}.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "The parent resource. Format: accounts/{account_id}.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListStableUrlsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "Maximum number of stable URLs to return per page:\n- when set to a value greater than 0, the page length is the minimum of this value\nand a server configured value;\n- when set to 0 or unset, the page length is set to a server configured value\n(recommended);\n- when set to a value less than 0, an invalid parameter error is returned.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Page token received from a previous ListStableUrls call.\nProvide this to retrieve the subsequent page.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "The parent resource. Format: accounts/{account_id}.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "The parent resource. Format: accounts/{account_id}.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Page token received from a previous ListStableUrls call.\nProvide this to retrieve the subsequent page.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "UpdateFailoverGroup",
+            "description": "Update a failover group.",
+            "summary": "Update a Failover Group.",
+            "path": "/api/disaster-recovery/v1/{name=accounts/*/failover-groups/*}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateFailoverGroupRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Fully qualified resource name in the format\naccounts/{account_id}/failover-groups/{failover_group_id}.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "failover_group",
+                  "description": "The failover group with updated fields. The name field identifies the resource\nand is populated from the URL path.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "FailoverGroup",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Comma-separated list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Fully qualified resource name in the format\naccounts/{account_id}/failover-groups/{failover_group_id}.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Comma-separated list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "failover_group",
+                  "description": "The failover group with updated fields. The name field identifies the resource\nand is populated from the URL path.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "FailoverGroup",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "failover_group",
+              "description": "The failover group with updated fields. The name field identifies the resource\nand is populated from the URL path.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "FailoverGroup",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "regions",
+                    "description": "List of all regions participating in this failover group.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "List",
+                      "array_value": {
+                        "is_string": true
+                      }
+                    }
+                  },
+                  {
+                    "name": "workspace_sets",
+                    "description": "Workspace sets, each containing workspaces that replicate to each other.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "WorkspaceSetList",
+                      "array_value": {
+                        "pascal_name": "WorkspaceSet",
+                        "is_object": true
+                      }
+                    }
+                  },
+                  {
+                    "name": "initial_primary_region",
+                    "description": "Initial primary region. Used only in Create requests to set the starting\nprimary region. Not returned in responses.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "regions",
+                    "description": "List of all regions participating in this failover group.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "List",
+                      "array_value": {
+                        "is_string": true
+                      }
+                    }
+                  },
+                  {
+                    "name": "workspace_sets",
+                    "description": "Workspace sets, each containing workspaces that replicate to each other.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "WorkspaceSetList",
+                      "array_value": {
+                        "pascal_name": "WorkspaceSet",
+                        "is_object": true
+                      }
+                    }
+                  },
+                  {
+                    "name": "initial_primary_region",
+                    "description": "Initial primary region. Used only in Create requests to set the starting\nprimary region. Not returned in responses.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "FailoverGroup",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "regions",
+                  "description": "List of all regions participating in this failover group.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "List",
+                    "array_value": {
+                      "is_string": true
+                    }
+                  }
+                },
+                {
+                  "name": "workspace_sets",
+                  "description": "Workspace sets, each containing workspaces that replicate to each other.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "WorkspaceSetList",
+                    "array_value": {
+                      "pascal_name": "WorkspaceSet",
+                      "is_object": true
+                    }
+                  }
+                },
+                {
+                  "name": "initial_primary_region",
+                  "description": "Initial primary region. Used only in Create requests to set the starting\nprimary region. Not returned in responses.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "regions",
+                  "description": "List of all regions participating in this failover group.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "List",
+                    "array_value": {
+                      "is_string": true
+                    }
+                  }
+                },
+                {
+                  "name": "workspace_sets",
+                  "description": "Workspace sets, each containing workspaces that replicate to each other.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "WorkspaceSetList",
+                    "array_value": {
+                      "pascal_name": "WorkspaceSet",
+                      "is_object": true
+                    }
+                  }
+                },
+                {
+                  "name": "initial_primary_region",
+                  "description": "Initial primary region. Used only in Create requests to set the starting\nprimary region. Not returned in responses.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "Optional opaque version string for optimistic locking, obtained from a prior read of\nthe failover group. If provided, the update is rejected unless it matches the failover\ngroup's current etag. If omitted, the update proceeds without an optimistic-lock check.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "failover_group",
+                "description": "The failover group with updated fields. The name field identifies the resource\nand is populated from the URL path.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "FailoverGroup",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "regions",
+                      "description": "List of all regions participating in this failover group.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "List",
+                        "array_value": {
+                          "is_string": true
+                        }
+                      }
+                    },
+                    {
+                      "name": "workspace_sets",
+                      "description": "Workspace sets, each containing workspaces that replicate to each other.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "WorkspaceSetList",
+                        "array_value": {
+                          "pascal_name": "WorkspaceSet",
+                          "is_object": true
+                        }
+                      }
+                    },
+                    {
+                      "name": "initial_primary_region",
+                      "description": "Initial primary region. Used only in Create requests to set the starting\nprimary region. Not returned in responses.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "regions",
+                      "description": "List of all regions participating in this failover group.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "List",
+                        "array_value": {
+                          "is_string": true
+                        }
+                      }
+                    },
+                    {
+                      "name": "workspace_sets",
+                      "description": "Workspace sets, each containing workspaces that replicate to each other.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "WorkspaceSetList",
+                        "array_value": {
+                          "pascal_name": "WorkspaceSet",
+                          "is_object": true
+                        }
+                      }
+                    },
+                    {
+                      "name": "initial_primary_region",
+                      "description": "Initial primary region. Used only in Create requests to set the starting\nprimary region. Not returned in responses.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "name",
+                "description": "Fully qualified resource name in the format\naccounts/{account_id}/failover-groups/{failover_group_id}.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Comma-separated list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Time at which this failover group was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "effective_primary_region",
+                "description": "Current effective primary region. Replication flows FROM workspaces in this region.\nChanges after a successful failover.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "etag",
+                "description": "Opaque version string for optimistic locking. Server-generated and returned in responses.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "has_replication_point_blocking_errors",
+                "description": "True if errors currently block the replication point.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "initial_primary_region",
+                "description": "Initial primary region. Used only in Create requests to set the starting\nprimary region. Not returned in responses.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "initial_replication_progress",
+                "description": "Initial replication progress of all in-scope assets. Set only when the FailoverGroup is in INITIAL_REPLICATION state.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "InitialReplicationProgress",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Fully qualified resource name in the format\naccounts/{account_id}/failover-groups/{failover_group_id}.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "regions",
+                "description": "List of all regions participating in this failover group.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "replication_point",
+                "description": "The latest point in time to which data has been replicated.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "state",
+                "description": "Aggregate state of the failover group.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "FailoverGroupState",
+                  "enum": [
+                    {
+                      "content": "ACTIVE"
+                    },
+                    {
+                      "content": "CREATING"
+                    },
+                    {
+                      "content": "CREATION_FAILED"
+                    },
+                    {
+                      "content": "DELETING"
+                    },
+                    {
+                      "content": "DELETION_FAILED"
+                    },
+                    {
+                      "content": "FAILING_OVER"
+                    },
+                    {
+                      "content": "FAILOVER_FAILED"
+                    },
+                    {
+                      "content": "INITIAL_REPLICATION"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "unity_catalog_assets",
+                "description": "Unity Catalog replication configuration.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "UcReplicationConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "Time at which this failover group was last modified.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "workspace_sets",
+                "description": "Workspace sets, each containing workspaces that replicate to each other.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "WorkspaceSetList",
+                  "array_value": {
+                    "pascal_name": "WorkspaceSet",
+                    "is_object": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Fully qualified resource name in the format\naccounts/{account_id}/failover-groups/{failover_group_id}.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Comma-separated list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "regions",
+                "description": "List of all regions participating in this failover group.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "workspace_sets",
+                "description": "Workspace sets, each containing workspaces that replicate to each other.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "WorkspaceSetList",
+                  "array_value": {
+                    "pascal_name": "WorkspaceSet",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "initial_primary_region",
+                "description": "Initial primary region. Used only in Create requests to set the starting\nprimary region. Not returned in responses.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "domains.Domains",
+        "name": "Domains",
+        "description": "Manage domains for organizing and discovering data assets.",
+        "package": {
+          "name": "domains"
+        },
+        "docs_group": "domains",
+        "launch_stage": "PUBLIC_BETA",
+        "cli_launch_stage_label": "*Beta*",
+        "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+        "cli_launch_stage_display": "Beta",
+        "list": {
+          "request": {
+            "pascal_name": "ListDomainsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "CreateDomain",
+            "description": "Create a domain. If `domain_id` is omitted, the server generates one.",
+            "summary": "Create a domain.",
+            "path": "/api/2.0/domains",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "CreateDomainRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "domain",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Domain",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "domain",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Domain",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "domain",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Domain",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "tag_key",
+                    "description": "Governed tag key associated with this domain.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "tag_key",
+                    "description": "Governed tag key associated with this domain.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "Domain",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "tag_key",
+                  "description": "Governed tag key associated with this domain.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "tag_key",
+                  "description": "Governed tag key associated with this domain.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "domain",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Domain",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "tag_key",
+                      "description": "Governed tag key associated with this domain.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "tag_key",
+                      "description": "Governed tag key associated with this domain.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "domain_id",
+                "description": "Client-supplied resource ID for the new domain. If omitted, the server\ngenerates one.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "business_owner_ids",
+                "description": "Principal IDs of the business owners (users, groups, or service principals).",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_int64": true
+                  }
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Timestamp when the domain was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "Full description (max 4096 chars)",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "domain_id",
+                "description": "Unique identifier for the domain. If omitted at Create, the server\ngenerates one.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "draft",
+                "description": "Whether to mark the domain as a draft. If omitted on Create, the server\napplies a default; the resolved value is returned in `effective_draft`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "effective_draft",
+                "description": "Resolved draft state of the domain.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "icon",
+                "description": "Icon to display for the domain.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "DomainIcon",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Full resource name of the domain. The primary identifier for this resource.\nFormat: `domains/{domain_id}`\nIdentifies the domain on get, update, and delete. Not an input on\ncreate — to choose the id, set `CreateDomainRequest.domain_id`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent_domain_id",
+                "description": "Domain ID of the parent. If absent, this is a top-level domain.\nIf present, this domain is a subdomain of the specified parent.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "subtitle",
+                "description": "Short description (max 280 chars)",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tag_key",
+                "description": "Governed tag key associated with this domain.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "technical_owner_ids",
+                "description": "Principal IDs of the technical owners (users, groups, or service principals).",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_int64": true
+                  }
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "Timestamp when the domain was last updated.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "tag_key",
+                "description": "Governed tag key associated with this domain.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteDomain",
+            "description": "Delete a domain. By default the request fails if the domain still has\nGlossary pages; set `force` to delete those pages along with the domain.",
+            "summary": "Delete a domain.",
+            "path": "/api/2.0/{name=domains/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "DeleteDomainRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Full resource name of the domain to delete.\nFormat: `domains/{domain_id}`",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Full resource name of the domain to delete.\nFormat: `domains/{domain_id}`",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "force",
+                "description": "When false (default), DeleteDomain is rejected with FAILED_PRECONDITION if\nthe domain still has Glossary pages. When true, those pages are deleted\nfirst and then the domain is removed.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Full resource name of the domain to delete.\nFormat: `domains/{domain_id}`",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Full resource name of the domain to delete.\nFormat: `domains/{domain_id}`",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetDomain",
+            "description": "Get a domain by resource name.\n\nAuthorization: external callers must have the `MANAGE DISCOVER` permission.",
+            "summary": "Get a domain.",
+            "path": "/api/2.0/{name=domains/*}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetDomainRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Full resource name of the domain to retrieve.\nFormat: `domains/{domain_id}`",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Full resource name of the domain to retrieve.\nFormat: `domains/{domain_id}`",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Domain",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "tag_key",
+                  "description": "Governed tag key associated with this domain.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "tag_key",
+                  "description": "Governed tag key associated with this domain.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Full resource name of the domain to retrieve.\nFormat: `domains/{domain_id}`",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Full resource name of the domain to retrieve.\nFormat: `domains/{domain_id}`",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListDomains",
+            "description": "List domains in the account. Set `parent_domain_id` to return only the\ndirect subdomains of a given domain.\n\nAuthorization: external callers must have the `MANAGE DISCOVER` permission;\nonly domains the caller is authorized to read are returned.",
+            "summary": "List domains.",
+            "path": "/api/2.0/domains",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ListDomainsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListDomainsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent_domain_id",
+                "description": "Filter by parent domain.\n- Absent: return all domains regardless of hierarchy.\n- Present: return only direct children of the specified domain.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "UpdateDomain",
+            "description": "Update a domain. `update_mask` selects which fields to modify; the domain\nis identified by its resource `name`.",
+            "summary": "Update a domain.",
+            "path": "/api/2.0/{name=domains/*}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "UpdateDomainRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Full resource name of the domain. The primary identifier for this resource.\nFormat: `domains/{domain_id}`\nIdentifies the domain on get, update, and delete. Not an input on\ncreate — to choose the id, set `CreateDomainRequest.domain_id`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "domain",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Domain",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Full resource name of the domain. The primary identifier for this resource.\nFormat: `domains/{domain_id}`\nIdentifies the domain on get, update, and delete. Not an input on\ncreate — to choose the id, set `CreateDomainRequest.domain_id`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "domain",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Domain",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "domain",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Domain",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "tag_key",
+                    "description": "Governed tag key associated with this domain.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "tag_key",
+                    "description": "Governed tag key associated with this domain.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "Domain",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "tag_key",
+                  "description": "Governed tag key associated with this domain.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "tag_key",
+                  "description": "Governed tag key associated with this domain.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "domain",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Domain",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "tag_key",
+                      "description": "Governed tag key associated with this domain.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "tag_key",
+                      "description": "Governed tag key associated with this domain.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "name",
+                "description": "Full resource name of the domain. The primary identifier for this resource.\nFormat: `domains/{domain_id}`\nIdentifies the domain on get, update, and delete. Not an input on\ncreate — to choose the id, set `CreateDomainRequest.domain_id`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "business_owner_ids",
+                "description": "Principal IDs of the business owners (users, groups, or service principals).",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_int64": true
+                  }
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Timestamp when the domain was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "Full description (max 4096 chars)",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "domain_id",
+                "description": "Unique identifier for the domain. If omitted at Create, the server\ngenerates one.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "draft",
+                "description": "Whether to mark the domain as a draft. If omitted on Create, the server\napplies a default; the resolved value is returned in `effective_draft`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "effective_draft",
+                "description": "Resolved draft state of the domain.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "icon",
+                "description": "Icon to display for the domain.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "DomainIcon",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Full resource name of the domain. The primary identifier for this resource.\nFormat: `domains/{domain_id}`\nIdentifies the domain on get, update, and delete. Not an input on\ncreate — to choose the id, set `CreateDomainRequest.domain_id`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent_domain_id",
+                "description": "Domain ID of the parent. If absent, this is a top-level domain.\nIf present, this domain is a subdomain of the specified parent.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "subtitle",
+                "description": "Short description (max 280 chars)",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tag_key",
+                "description": "Governed tag key associated with this domain.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "technical_owner_ids",
+                "description": "Principal IDs of the technical owners (users, groups, or service principals).",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_int64": true
+                  }
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "Timestamp when the domain was last updated.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Full resource name of the domain. The primary identifier for this resource.\nFormat: `domains/{domain_id}`\nIdentifies the domain on get, update, and delete. Not an input on\ncreate — to choose the id, set `CreateDomainRequest.domain_id`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "tag_key",
+                "description": "Governed tag key associated with this domain.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "settings.EnableExportNotebook",
+        "name": "EnableExportNotebook",
+        "description": "Controls whether users can export notebooks and files from the Workspace UI. By default, this setting is enabled.",
+        "package": {
+          "name": "settings"
+        },
+        "has_parent": true,
+        "docs_group": "settings",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "parent_service_id": "settings.Settings",
+        "methods": [
+          {
+            "name": "GetEnableExportNotebook",
+            "description": "Gets the Notebook and File exporting setting.",
+            "summary": "Get the Notebook and File exporting setting.",
+            "path": "/api/2.0/settings/types/enable-export-notebook/names/default",
+            "is_legacy_empty_request": true,
+            "is_crud_read": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetEnableExportNotebookRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "EnableExportNotebook",
+              "is_object": true
+            }
+          },
+          {
+            "name": "PatchEnableExportNotebook",
+            "description": "Updates the Notebook and File exporting setting. The model follows eventual consistency, which means the get after the update operation might receive stale values for some time.",
+            "summary": "Update the Notebook and File exporting setting.",
+            "path": "/api/2.0/settings/types/enable-export-notebook/names/default",
+            "can_use_json": true,
+            "must_use_json": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "UpdateEnableExportNotebookRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "EnableExportNotebook",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "EnableExportNotebook",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "EnableExportNotebook",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "allow_missing",
+                "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "field_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "setting",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EnableExportNotebook",
+                  "is_object": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "settings.EnableIpAccessLists",
+        "name": "EnableIpAccessLists",
+        "description": "Controls the enforcement of IP access lists for accessing the account console.\nAllowing you to enable or disable restricted access based on IP addresses.",
+        "package": {
+          "name": "settings"
+        },
+        "is_accounts": true,
+        "has_parent": true,
+        "is_hidden_cli": true,
+        "docs_group": "settings",
+        "launch_stage": "PRIVATE_PREVIEW",
+        "cli_launch_stage_display": "Private Preview",
+        "parent_service_id": "settings.AccountSettings",
+        "methods": [
+          {
+            "name": "Delete",
+            "description": "Reverts the value of the account IP access toggle setting to default (ON)",
+            "summary": "Delete the account IP access toggle setting.",
+            "path": "/api/2.0/accounts/{account_id}/settings/types/acct_ip_acl_enable/names/default",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "DeleteAccountIpAccessEnableRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "DeleteAccountIpAccessEnableResponse",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "etag",
+                  "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "etag",
+                  "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets the value of the account IP access toggle setting.",
+            "summary": "Get the account IP access toggle setting.",
+            "path": "/api/2.0/accounts/{account_id}/settings/types/acct_ip_acl_enable/names/default",
+            "is_crud_read": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "GetAccountIpAccessEnableRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "AccountIpAccessEnable",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "acct_ip_acl_enable",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BooleanMessage",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "acct_ip_acl_enable",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BooleanMessage",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Updates the value of the account IP access toggle setting.",
+            "summary": "Update the account IP access toggle setting.",
+            "path": "/api/2.0/accounts/{account_id}/settings/types/acct_ip_acl_enable/names/default",
+            "can_use_json": true,
+            "must_use_json": true,
+            "is_hidden_cli": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "UpdateAccountIpAccessEnableRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AccountIpAccessEnable",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AccountIpAccessEnable",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "AccountIpAccessEnable",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "acct_ip_acl_enable",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BooleanMessage",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "acct_ip_acl_enable",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BooleanMessage",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "allow_missing",
+                "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "field_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "setting",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AccountIpAccessEnable",
+                  "is_object": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "settings.EnableNotebookTableClipboard",
+        "name": "EnableNotebookTableClipboard",
+        "description": "Controls whether users can copy tabular data to the clipboard via the UI. By default, this setting is enabled.",
+        "package": {
+          "name": "settings"
+        },
+        "has_parent": true,
+        "docs_group": "settings",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "parent_service_id": "settings.Settings",
+        "methods": [
+          {
+            "name": "GetEnableNotebookTableClipboard",
+            "description": "Gets the Results Table Clipboard features setting.",
+            "summary": "Get the Results Table Clipboard features setting.",
+            "path": "/api/2.0/settings/types/enable-notebook-table-clipboard/names/default",
+            "is_legacy_empty_request": true,
+            "is_crud_read": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetEnableNotebookTableClipboardRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "EnableNotebookTableClipboard",
+              "is_object": true
+            }
+          },
+          {
+            "name": "PatchEnableNotebookTableClipboard",
+            "description": "Updates the Results Table Clipboard features setting. The model follows eventual consistency, which means the get after the update operation might receive stale values for some time.",
+            "summary": "Update the Results Table Clipboard features setting.",
+            "path": "/api/2.0/settings/types/enable-notebook-table-clipboard/names/default",
+            "can_use_json": true,
+            "must_use_json": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "UpdateEnableNotebookTableClipboardRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "EnableNotebookTableClipboard",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "EnableNotebookTableClipboard",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "EnableNotebookTableClipboard",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "allow_missing",
+                "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "field_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "setting",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EnableNotebookTableClipboard",
+                  "is_object": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "settings.EnableResultsDownloading",
+        "name": "EnableResultsDownloading",
+        "description": "Controls whether users can download notebook results. By default, this setting is enabled.",
+        "package": {
+          "name": "settings"
+        },
+        "has_parent": true,
+        "docs_group": "settings",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "parent_service_id": "settings.Settings",
+        "methods": [
+          {
+            "name": "GetEnableResultsDownloading",
+            "description": "Gets the Notebook results download setting.",
+            "summary": "Get the Notebook results download setting.",
+            "path": "/api/2.0/settings/types/enable-results-downloading/names/default",
+            "is_legacy_empty_request": true,
+            "is_crud_read": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetEnableResultsDownloadingRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "EnableResultsDownloading",
+              "is_object": true
+            }
+          },
+          {
+            "name": "PatchEnableResultsDownloading",
+            "description": "Updates the Notebook results download setting. The model follows eventual consistency, which means the get after the update operation might receive stale values for some time.",
+            "summary": "Update the Notebook results download setting.",
+            "path": "/api/2.0/settings/types/enable-results-downloading/names/default",
+            "can_use_json": true,
+            "must_use_json": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "UpdateEnableResultsDownloadingRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "EnableResultsDownloading",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "EnableResultsDownloading",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "EnableResultsDownloading",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "allow_missing",
+                "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "field_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "setting",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EnableResultsDownloading",
+                  "is_object": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "provisioning.EncryptionKeys",
+        "name": "EncryptionKeys",
+        "description": "These APIs manage encryption key configurations for this workspace (optional). A key\nconfiguration encapsulates the AWS KMS key information and some information about how\nthe key configuration can be used. There are two possible uses for key configurations:\n\n* Managed services: A key configuration can be used to encrypt a workspace's notebook and\nsecret data in the control plane, as well as Databricks SQL queries and query history.\n* Storage: A key configuration can be used to encrypt a workspace's DBFS and EBS data in\nthe data plane.\n\nIn both of these cases, the key configuration's ID is used when creating a new workspace.\nThis Preview feature is available if your account is on the E2 version of the platform.\nUpdating a running workspace with workspace storage encryption requires that the workspace\nis on the E2 version of the platform. If you have an older workspace, it might not be on\nthe E2 version of the platform. If you are not sure, contact your Databricks representative.",
+        "package": {
+          "name": "provisioning"
+        },
+        "is_accounts": true,
+        "docs_group": "provisioning",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a customer-managed key configuration object for an account, specified by ID.\nThis operation uploads a reference to a customer-managed key to Databricks.\nIf the key is assigned as a workspace's customer-managed key for managed services,\nDatabricks uses the key to encrypt the workspaces notebooks and secrets in the control plane,\nin addition to Databricks SQL queries and query history. If it is specified as a\nworkspace's customer-managed key for workspace storage, the key encrypts the\nworkspace's root S3 bucket (which contains the workspace's root DBFS and system data)\nand, optionally, cluster EBS volume data.\n\n**Important**: Customer-managed keys are supported only for some deployment types,\nsubscription types, and AWS regions that currently support creation of Databricks workspaces.\n\nThis operation is available only if your account is on the E2 version of the\nplatform or on a select custom plan that allows multiple workspaces per account.\n\n**GCP only**: To create a customer-managed key on GCP, you must include the\n`X-Databricks-GCP-SA-Access-Token` HTTP header in your request. This header must contain\na Google Cloud OAuth access token with the `cloud-platform` scope. The Google identity\nassociated with the token must also have the `setIamPermissions` and `getIamPermissions`\nIAM permissions on the key resource. For details on obtaining this token, see\n[Authenticate with Google ID tokens](https://docs.databricks.com/gcp/en/dev-tools/auth/authentication-google-id.html).",
+            "summary": "Create encryption key configuration.",
+            "path": "/api/2.0/accounts/{account_id}/customer-managed-keys",
+            "can_use_json": true,
+            "must_use_json": true,
+            "is_crud_create": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateCustomerManagedKeyRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "use_cases",
+                  "description": "The cases that the key can be used for.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "KeyUseCaseList",
+                    "array_value": {
+                      "pascal_name": "KeyUseCase",
+                      "enum": [
+                        {
+                          "content": "MANAGED_SERVICES"
+                        },
+                        {
+                          "content": "STORAGE"
+                        }
+                      ]
+                    }
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "use_cases",
+                  "description": "The cases that the key can be used for.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "KeyUseCaseList",
+                    "array_value": {
+                      "pascal_name": "KeyUseCase",
+                      "enum": [
+                        {
+                          "content": "MANAGED_SERVICES"
+                        },
+                        {
+                          "content": "STORAGE"
+                        }
+                      ]
+                    }
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CustomerManagedKey",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "aws_key_info",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CreateAwsKeyInfo",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "azure_key_info",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CreateAzureKeyInfo",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "gcp_key_info",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CreateGcpKeyInfo",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "use_cases",
+                "description": "The cases that the key can be used for.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "KeyUseCaseList",
+                  "array_value": {
+                    "pascal_name": "KeyUseCase",
+                    "enum": [
+                      {
+                        "content": "MANAGED_SERVICES"
+                      },
+                      {
+                        "content": "STORAGE"
+                      }
+                    ]
+                  }
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes a customer-managed key configuration object for an account. You cannot delete a configuration that is associated with a running workspace.",
+            "summary": "Delete encryption key configuration.",
+            "path": "/api/2.0/accounts/{account_id}/customer-managed-keys/{customer_managed_key_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteEncryptionKeyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "customer_managed_key_id",
+                  "description": "Databricks encryption key configuration ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "customer_managed_key_id",
+                  "description": "Databricks encryption key configuration ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CustomerManagedKey",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "customer_managed_key_id",
+                "description": "Databricks encryption key configuration ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "customer_managed_key_id",
+                "description": "Databricks encryption key configuration ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets a customer-managed key configuration object for an account, specified by ID.\nThis operation uploads a reference to a customer-managed key to Databricks.\nIf assigned as a workspace's customer-managed key for managed services, Databricks uses the\nkey to encrypt the workspaces notebooks and secrets in the control plane, in addition to\nDatabricks SQL queries and query history. If it is specified as a workspace's\ncustomer-managed key for storage, the key encrypts the workspace's root S3 bucket\n(which contains the workspace's root DBFS and system data) and, optionally, cluster EBS volume data.\n\n**Important**: Customer-managed keys are supported only for some deployment types,\nsubscription types, and AWS regions.\n\nThis operation is available only if your account is on the E2 version of the platform.\",",
+            "summary": "Get encryption key configuration.",
+            "path": "/api/2.0/accounts/{account_id}/customer-managed-keys/{customer_managed_key_id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetEncryptionKeyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "customer_managed_key_id",
+                  "description": "Databricks encryption key configuration ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "customer_managed_key_id",
+                  "description": "Databricks encryption key configuration ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CustomerManagedKey",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "customer_managed_key_id",
+                "description": "Databricks encryption key configuration ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "customer_managed_key_id",
+                "description": "Databricks encryption key configuration ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Lists Databricks customer-managed key configurations for an account.",
+            "summary": "List encryption key configuration.",
+            "path": "/api/2.0/accounts/{account_id}/customer-managed-keys",
+            "is_legacy_empty_request": true,
+            "is_crud_read": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListEncryptionKeysRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "CustomerManagedKeyList",
+              "array_value": {
+                "pascal_name": "CustomerManagedKey",
+                "is_object": true
+              }
+            }
+          }
+        ]
+      },
+      {
+        "id": "networking.Endpoints",
+        "name": "Endpoints",
+        "description": "These APIs manage endpoint configurations for this account.",
+        "package": {
+          "name": "networking"
+        },
+        "is_accounts": true,
+        "docs_group": "provisioning",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListEndpointsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "CreateEndpoint",
+            "description": "Creates a new network connectivity endpoint that enables private connectivity\nbetween your network resources and Databricks services.\n\nAfter creation, the endpoint is initially in the PENDING state. The Databricks\nendpoint service automatically reviews and approves the endpoint within a few\nminutes. Use the GET method to retrieve the latest endpoint state.\n\nAn endpoint can be used only after it reaches the APPROVED state.",
+            "summary": "Create a network endpoint.",
+            "path": "/api/networking/v1/{parent=accounts/*}/endpoints",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateEndpointRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "The parent resource name of the account under which the endpoint is created.\nFormat: `accounts/{account_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "endpoint",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Endpoint",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "The parent resource name of the account under which the endpoint is created.\nFormat: `accounts/{account_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "endpoint",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Endpoint",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "endpoint",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Endpoint",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "display_name",
+                    "description": "The human-readable display name of this endpoint.\nThe input should conform to RFC-1034, which restricts to letters, numbers, and hyphens,\nwith the first character a letter, the last a letter or a number, and a 63 character maximum.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "region",
+                    "description": "The cloud provider region where this endpoint is located.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "display_name",
+                    "description": "The human-readable display name of this endpoint.\nThe input should conform to RFC-1034, which restricts to letters, numbers, and hyphens,\nwith the first character a letter, the last a letter or a number, and a 63 character maximum.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "region",
+                    "description": "The cloud provider region where this endpoint is located.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "Endpoint",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "display_name",
+                  "description": "The human-readable display name of this endpoint.\nThe input should conform to RFC-1034, which restricts to letters, numbers, and hyphens,\nwith the first character a letter, the last a letter or a number, and a 63 character maximum.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "region",
+                  "description": "The cloud provider region where this endpoint is located.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "display_name",
+                  "description": "The human-readable display name of this endpoint.\nThe input should conform to RFC-1034, which restricts to letters, numbers, and hyphens,\nwith the first character a letter, the last a letter or a number, and a 63 character maximum.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "region",
+                  "description": "The cloud provider region where this endpoint is located.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "endpoint",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Endpoint",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "display_name",
+                      "description": "The human-readable display name of this endpoint.\nThe input should conform to RFC-1034, which restricts to letters, numbers, and hyphens,\nwith the first character a letter, the last a letter or a number, and a 63 character maximum.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "region",
+                      "description": "The cloud provider region where this endpoint is located.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "display_name",
+                      "description": "The human-readable display name of this endpoint.\nThe input should conform to RFC-1034, which restricts to letters, numbers, and hyphens,\nwith the first character a letter, the last a letter or a number, and a 63 character maximum.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "region",
+                      "description": "The cloud provider region where this endpoint is located.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "parent",
+                "description": "The parent resource name of the account under which the endpoint is created.\nFormat: `accounts/{account_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "account_id",
+                "description": "The Databricks Account in which the endpoint object exists.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "aws_vpc_endpoint_info",
+                "description": "Info for an AWS VPC endpoint.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AwsVpcEndpointInfo",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "azure_private_endpoint_info",
+                "description": "Info for an Azure private endpoint.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AzurePrivateEndpointInfo",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "The timestamp when the endpoint was created. The timestamp is in RFC 3339 format in UTC timezone.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "The human-readable display name of this endpoint.\nThe input should conform to RFC-1034, which restricts to letters, numbers, and hyphens,\nwith the first character a letter, the last a letter or a number, and a 63 character maximum.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "endpoint_id",
+                "description": "The unique identifier for this endpoint under the account. This field is a UUID generated by Databricks.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "gcp_psc_endpoint_info",
+                "description": "Info for a GCP Private Service Connect endpoint.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "GcpPscEndpointInfo",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The resource name of the endpoint, which uniquely identifies the endpoint.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "region",
+                "description": "The cloud provider region where this endpoint is located.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "state",
+                "description": "The state of the endpoint. The endpoint can only be used if the state is `APPROVED`.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EndpointState",
+                  "enum": [
+                    {
+                      "content": "APPROVED"
+                    },
+                    {
+                      "content": "DISCONNECTED"
+                    },
+                    {
+                      "content": "FAILED"
+                    },
+                    {
+                      "content": "PENDING"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "use_case",
+                "description": "The use case that determines the type of network connectivity this endpoint provides.\nThis field is automatically determined based on the endpoint configuration and cloud-specific settings.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EndpointUseCase",
+                  "enum": [
+                    {
+                      "content": "SERVICE_DIRECT"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "The parent resource name of the account under which the endpoint is created.\nFormat: `accounts/{account_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "The human-readable display name of this endpoint.\nThe input should conform to RFC-1034, which restricts to letters, numbers, and hyphens,\nwith the first character a letter, the last a letter or a number, and a 63 character maximum.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "region",
+                "description": "The cloud provider region where this endpoint is located.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteEndpoint",
+            "description": "Deletes a network endpoint. This will remove the endpoint configuration from Databricks.\nDepending on the endpoint type and use case, you may also need to delete corresponding network resources\nin your cloud provider account.",
+            "summary": "Delete a network endpoint.",
+            "path": "/api/networking/v1/{name=accounts/*/endpoints/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteEndpointRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetEndpoint",
+            "description": "Gets details of a specific network endpoint.",
+            "summary": "Get a network endpoint.",
+            "path": "/api/networking/v1/{name=accounts/*/endpoints/*}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetEndpointRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Endpoint",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "display_name",
+                  "description": "The human-readable display name of this endpoint.\nThe input should conform to RFC-1034, which restricts to letters, numbers, and hyphens,\nwith the first character a letter, the last a letter or a number, and a 63 character maximum.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "region",
+                  "description": "The cloud provider region where this endpoint is located.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "display_name",
+                  "description": "The human-readable display name of this endpoint.\nThe input should conform to RFC-1034, which restricts to letters, numbers, and hyphens,\nwith the first character a letter, the last a letter or a number, and a 63 character maximum.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "region",
+                  "description": "The cloud provider region where this endpoint is located.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListEndpoints",
+            "description": "Lists all network connectivity endpoints for the account.",
+            "summary": "List network endpoints.",
+            "path": "/api/networking/v1/{parent=accounts/*}/endpoints",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListEndpointsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "The parent resource name of the account to list endpoints for.\nFormat: `accounts/{account_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "The parent resource name of the account to list endpoints for.\nFormat: `accounts/{account_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListEndpointsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "The parent resource name of the account to list endpoints for.\nFormat: `accounts/{account_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "The parent resource name of the account to list endpoints for.\nFormat: `accounts/{account_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          }
+        ]
+      },
+      {
+        "id": "settings.EnhancedSecurityMonitoring",
+        "name": "EnhancedSecurityMonitoring",
+        "description": "Controls whether enhanced security monitoring is enabled for the current workspace. If the compliance security profile is enabled, this is automatically enabled.\nBy default, it is disabled. However, if the compliance security profile is enabled, this is automatically enabled.\n\nIf the compliance security profile is disabled, you can enable or disable this setting and it is not permanent.",
+        "package": {
+          "name": "settings"
+        },
+        "has_parent": true,
+        "docs_group": "settings",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "parent_service_id": "settings.Settings",
+        "methods": [
+          {
+            "name": "Get",
+            "description": "Gets the enhanced security monitoring setting.",
+            "summary": "Get the enhanced security monitoring setting.",
+            "path": "/api/2.0/settings/types/shield_esm_enablement_ws_db/names/default",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetEnhancedSecurityMonitoringSettingRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "EnhancedSecurityMonitoringSetting",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "enhanced_security_monitoring_workspace",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "EnhancedSecurityMonitoring",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "enhanced_security_monitoring_workspace",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "EnhancedSecurityMonitoring",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Updates the enhanced security monitoring setting for the workspace. A fresh etag needs\nto be provided in `PATCH` requests (as part of the setting field). The etag can be retrieved by making a `GET`\nrequest before the `PATCH` request. If the setting is updated concurrently, `PATCH` fails with 409 and the\nrequest must be retried by using the fresh etag in the 409 response.",
+            "summary": "Update the enhanced security monitoring setting.",
+            "path": "/api/2.0/settings/types/shield_esm_enablement_ws_db/names/default",
+            "can_use_json": true,
+            "must_use_json": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "UpdateEnhancedSecurityMonitoringSettingRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "EnhancedSecurityMonitoringSetting",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "EnhancedSecurityMonitoringSetting",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "EnhancedSecurityMonitoringSetting",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "enhanced_security_monitoring_workspace",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "EnhancedSecurityMonitoring",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "enhanced_security_monitoring_workspace",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "EnhancedSecurityMonitoring",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "allow_missing",
+                "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "field_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "setting",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EnhancedSecurityMonitoringSetting",
+                  "is_object": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "catalog.EntityTagAssignments",
+        "name": "EntityTagAssignments",
+        "description": "Tags are attributes that include keys and optional values that you can use to organize and categorize entities in Unity Catalog. Entity tagging is supported on catalogs, schemas, tables (including views), columns, and volumes.\nWith these APIs, you can create, update, delete, and list tag assignments across Unity Catalog entities.",
+        "package": {
+          "name": "catalog"
+        },
+        "docs_group": "catalog",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListEntityTagAssignmentsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a tag assignment for an Unity Catalog entity.\n\nTo add tags to Unity Catalog entities, you must own the entity or have the following privileges:\n- **APPLY TAG** on the entity\n- **USE SCHEMA** on the entity's parent schema\n- **USE CATALOG** on the entity's parent catalog\n\nTo add a governed tag to Unity Catalog entities, you must also have the **ASSIGN** or **MANAGE** permission on the tag policy. See [Manage tag policy permissions](https://docs.databricks.com/aws/en/admin/tag-policies/manage-permissions).",
+            "summary": "Create an entity tag assignment.",
+            "path": "/api/2.1/unity-catalog/entity-tag-assignments",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateEntityTagAssignmentRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "tag_assignment",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "EntityTagAssignment",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "tag_assignment",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "EntityTagAssignment",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "tag_assignment",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "EntityTagAssignment",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "entity_name",
+                    "description": "The fully qualified name of the entity to which the tag is assigned",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "tag_key",
+                    "description": "The key of the tag",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "entity_type",
+                    "description": "The type of the entity to which the tag is assigned.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "entity_name",
+                    "description": "The fully qualified name of the entity to which the tag is assigned",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "tag_key",
+                    "description": "The key of the tag",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "entity_type",
+                    "description": "The type of the entity to which the tag is assigned.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "EntityTagAssignment",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "entity_name",
+                  "description": "The fully qualified name of the entity to which the tag is assigned",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "tag_key",
+                  "description": "The key of the tag",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "entity_type",
+                  "description": "The type of the entity to which the tag is assigned.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "entity_name",
+                  "description": "The fully qualified name of the entity to which the tag is assigned",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "tag_key",
+                  "description": "The key of the tag",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "entity_type",
+                  "description": "The type of the entity to which the tag is assigned.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "tag_assignment",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EntityTagAssignment",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "entity_name",
+                      "description": "The fully qualified name of the entity to which the tag is assigned",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "tag_key",
+                      "description": "The key of the tag",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "entity_type",
+                      "description": "The type of the entity to which the tag is assigned.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "entity_name",
+                      "description": "The fully qualified name of the entity to which the tag is assigned",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "tag_key",
+                      "description": "The key of the tag",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "entity_type",
+                      "description": "The type of the entity to which the tag is assigned.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "entity_name",
+                "description": "The fully qualified name of the entity to which the tag is assigned",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "entity_type",
+                "description": "The type of the entity to which the tag is assigned.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "source_type",
+                "description": "The source type of the tag assignment, e.g., user-assigned or system-assigned",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "TagAssignmentSourceType",
+                  "enum": [
+                    {
+                      "content": "TAG_ASSIGNMENT_SOURCE_TYPE_SYSTEM_DATA_CLASSIFICATION"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "tag_key",
+                "description": "The key of the tag",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tag_value",
+                "description": "The value of the tag",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "The timestamp when the tag assignment was last updated",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "updated_by",
+                "description": "The user or principal who updated the tag assignment",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "entity_name",
+                "description": "The fully qualified name of the entity to which the tag is assigned",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tag_key",
+                "description": "The key of the tag",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "entity_type",
+                "description": "The type of the entity to which the tag is assigned.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes a tag assignment for an Unity Catalog entity by its key.\n\nTo delete tags from Unity Catalog entities, you must own the entity or have the following privileges:\n- **APPLY TAG** on the entity\n- **USE_SCHEMA** on the entity's parent schema\n- **USE_CATALOG** on the entity's parent catalog\n\nTo delete a governed tag from Unity Catalog entities, you must also have the **ASSIGN** or **MANAGE** permission on the tag policy. See [Manage tag policy permissions](https://docs.databricks.com/aws/en/admin/tag-policies/manage-permissions).",
+            "summary": "Delete an entity tag assignment.",
+            "path": "/api/2.1/unity-catalog/entity-tag-assignments/{entity_type}/{entity_name}/tags/{tag_key}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteEntityTagAssignmentRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "entity_type",
+                  "description": "The type of the entity to which the tag is assigned.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "entity_name",
+                  "description": "The fully qualified name of the entity to which the tag is assigned",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "tag_key",
+                  "description": "Required. The key of the tag to delete",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "entity_type",
+                  "description": "The type of the entity to which the tag is assigned.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "entity_name",
+                  "description": "The fully qualified name of the entity to which the tag is assigned",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "tag_key",
+                  "description": "Required. The key of the tag to delete",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "entity_name",
+                "description": "The fully qualified name of the entity to which the tag is assigned",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "entity_type",
+                "description": "The type of the entity to which the tag is assigned.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tag_key",
+                "description": "Required. The key of the tag to delete",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "entity_type",
+                "description": "The type of the entity to which the tag is assigned.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "entity_name",
+                "description": "The fully qualified name of the entity to which the tag is assigned",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tag_key",
+                "description": "Required. The key of the tag to delete",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets a tag assignment for an Unity Catalog entity by tag key.",
+            "summary": "Get an entity tag assignment.",
+            "path": "/api/2.1/unity-catalog/entity-tag-assignments/{entity_type}/{entity_name}/tags/{tag_key}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetEntityTagAssignmentRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "entity_type",
+                  "description": "The type of the entity to which the tag is assigned.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "entity_name",
+                  "description": "The fully qualified name of the entity to which the tag is assigned",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "tag_key",
+                  "description": "Required. The key of the tag",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "entity_type",
+                  "description": "The type of the entity to which the tag is assigned.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "entity_name",
+                  "description": "The fully qualified name of the entity to which the tag is assigned",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "tag_key",
+                  "description": "Required. The key of the tag",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "EntityTagAssignment",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "entity_name",
+                  "description": "The fully qualified name of the entity to which the tag is assigned",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "tag_key",
+                  "description": "The key of the tag",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "entity_type",
+                  "description": "The type of the entity to which the tag is assigned.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "entity_name",
+                  "description": "The fully qualified name of the entity to which the tag is assigned",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "tag_key",
+                  "description": "The key of the tag",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "entity_type",
+                  "description": "The type of the entity to which the tag is assigned.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "entity_name",
+                "description": "The fully qualified name of the entity to which the tag is assigned",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "entity_type",
+                "description": "The type of the entity to which the tag is assigned.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tag_key",
+                "description": "Required. The key of the tag",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "entity_type",
+                "description": "The type of the entity to which the tag is assigned.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "entity_name",
+                "description": "The fully qualified name of the entity to which the tag is assigned",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tag_key",
+                "description": "Required. The key of the tag",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "List tag assignments for an Unity Catalog entity\n\nPAGINATION BEHAVIOR: The API is by default paginated, a page may contain zero results while still providing a next_page_token.\nClients must continue reading pages until next_page_token is absent, which is the only indication that the end of results has been reached.",
+            "summary": "List entity tag assignments.",
+            "path": "/api/2.1/unity-catalog/entity-tag-assignments/{entity_type}/{entity_name}/tags",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListEntityTagAssignmentsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "entity_type",
+                  "description": "The type of the entity to which the tag is assigned.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "entity_name",
+                  "description": "The fully qualified name of the entity to which the tag is assigned",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "entity_type",
+                  "description": "The type of the entity to which the tag is assigned.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "entity_name",
+                  "description": "The fully qualified name of the entity to which the tag is assigned",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListEntityTagAssignmentsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "entity_name",
+                "description": "The fully qualified name of the entity to which the tag is assigned",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "entity_type",
+                "description": "The type of the entity to which the tag is assigned.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "max_results",
+                "description": "Optional. Maximum number of tag assignments to return in a single page",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Optional. Pagination token to retrieve the next page of results",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "entity_type",
+                "description": "The type of the entity to which the tag is assigned.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "entity_name",
+                "description": "The fully qualified name of the entity to which the tag is assigned",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Optional. Pagination token to retrieve the next page of results",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "Update",
+            "description": "Updates an existing tag assignment for an Unity Catalog entity.\n\nTo update tags to Unity Catalog entities, you must own the entity or have the following privileges:\n- **APPLY TAG** on the entity\n- **USE SCHEMA** on the entity's parent schema\n- **USE CATALOG** on the entity's parent catalog\n\nTo update a governed tag to Unity Catalog entities, you must also have the **ASSIGN** or **MANAGE** permission on the tag policy. See [Manage tag policy permissions](https://docs.databricks.com/aws/en/admin/tag-policies/manage-permissions).",
+            "summary": "Update an entity tag assignment.",
+            "path": "/api/2.1/unity-catalog/entity-tag-assignments/{entity_type}/{entity_name}/tags/{tag_key}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateEntityTagAssignmentRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "entity_type",
+                  "description": "The type of the entity to which the tag is assigned.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "entity_name",
+                  "description": "The fully qualified name of the entity to which the tag is assigned",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "tag_key",
+                  "description": "The key of the tag",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "tag_assignment",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "EntityTagAssignment",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "entity_type",
+                  "description": "The type of the entity to which the tag is assigned.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "entity_name",
+                  "description": "The fully qualified name of the entity to which the tag is assigned",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "tag_key",
+                  "description": "The key of the tag",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "tag_assignment",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "EntityTagAssignment",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "tag_assignment",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "EntityTagAssignment",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "entity_name",
+                    "description": "The fully qualified name of the entity to which the tag is assigned",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "tag_key",
+                    "description": "The key of the tag",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "entity_type",
+                    "description": "The type of the entity to which the tag is assigned.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "entity_name",
+                    "description": "The fully qualified name of the entity to which the tag is assigned",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "tag_key",
+                    "description": "The key of the tag",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "entity_type",
+                    "description": "The type of the entity to which the tag is assigned.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "EntityTagAssignment",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "entity_name",
+                  "description": "The fully qualified name of the entity to which the tag is assigned",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "tag_key",
+                  "description": "The key of the tag",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "entity_type",
+                  "description": "The type of the entity to which the tag is assigned.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "entity_name",
+                  "description": "The fully qualified name of the entity to which the tag is assigned",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "tag_key",
+                  "description": "The key of the tag",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "entity_type",
+                  "description": "The type of the entity to which the tag is assigned.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "entity_name",
+                "description": "The fully qualified name of the entity to which the tag is assigned",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "entity_type",
+                "description": "The type of the entity to which the tag is assigned.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tag_assignment",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EntityTagAssignment",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "entity_name",
+                      "description": "The fully qualified name of the entity to which the tag is assigned",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "tag_key",
+                      "description": "The key of the tag",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "entity_type",
+                      "description": "The type of the entity to which the tag is assigned.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "entity_name",
+                      "description": "The fully qualified name of the entity to which the tag is assigned",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "tag_key",
+                      "description": "The key of the tag",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "entity_type",
+                      "description": "The type of the entity to which the tag is assigned.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "tag_key",
+                "description": "The key of the tag",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "entity_name",
+                "description": "The fully qualified name of the entity to which the tag is assigned",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "entity_type",
+                "description": "The type of the entity to which the tag is assigned.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "source_type",
+                "description": "The source type of the tag assignment, e.g., user-assigned or system-assigned",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "TagAssignmentSourceType",
+                  "enum": [
+                    {
+                      "content": "TAG_ASSIGNMENT_SOURCE_TYPE_SYSTEM_DATA_CLASSIFICATION"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "tag_key",
+                "description": "The key of the tag",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tag_value",
+                "description": "The value of the tag",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "The timestamp when the tag assignment was last updated",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "updated_by",
+                "description": "The user or principal who updated the tag assignment",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "entity_type",
+                "description": "The type of the entity to which the tag is assigned.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "entity_name",
+                "description": "The fully qualified name of the entity to which the tag is assigned",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tag_key",
+                "description": "The key of the tag",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "environments.Environments",
+        "name": "Environments",
+        "description": "APIs to manage environment resources.\n\nThe Environments API provides management capabilities for different types of environments\nincluding workspace-level base environments that define the environment version and\ndependencies to be used in serverless notebooks and jobs.",
+        "package": {
+          "name": "environments"
+        },
+        "docs_group": "environments",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListWorkspaceBaseEnvironmentsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "CreateWorkspaceBaseEnvironment",
+            "description": "Creates a new WorkspaceBaseEnvironment.\nThis is a long-running operation. The operation will asynchronously generate a materialized environment\nto optimize dependency resolution and is only marked as done when the materialized environment has been\nsuccessfully generated or has failed.",
+            "summary": "Create a workspace base environment.",
+            "path": "/api/environments/v1/workspace-base-environments",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateWorkspaceBaseEnvironmentRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "workspace_base_environment",
+                  "description": "Required. The workspace base environment to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "WorkspaceBaseEnvironment",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "workspace_base_environment",
+                  "description": "Required. The workspace base environment to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "WorkspaceBaseEnvironment",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "workspace_base_environment",
+              "description": "Required. The workspace base environment to create.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "WorkspaceBaseEnvironment",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "display_name",
+                    "description": "Human-readable display name for the workspace base environment.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "display_name",
+                    "description": "Human-readable display name for the workspace base environment.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "request_id",
+                "description": "A unique identifier for this request. A random UUID is recommended.\nThis request is only idempotent if a request_id is provided.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "workspace_base_environment",
+                "description": "Required. The workspace base environment to create.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "WorkspaceBaseEnvironment",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "display_name",
+                      "description": "Human-readable display name for the workspace base environment.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "display_name",
+                      "description": "Human-readable display name for the workspace base environment.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "workspace_base_environment_id",
+                "description": "The ID to use for the workspace base environment, which will become the final component of\nthe resource name.\nThis value should be 4-63 characters, and valid characters are /[a-z][0-9]-/.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "base_environment_type",
+                "description": "The type of base environment (CPU or GPU).",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "BaseEnvironmentType",
+                  "enum": [
+                    {
+                      "content": "CPU"
+                    },
+                    {
+                      "content": "GPU"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Timestamp when the environment was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "creator_user_id",
+                "description": "User ID of the creator.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "Human-readable display name for the workspace base environment.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "filepath",
+                "description": "The WSFS or UC Volumes path to the environment YAML file.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "is_default",
+                "description": "Whether this is the default environment for the workspace.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "last_updated_user_id",
+                "description": "User ID of the last user who updated the environment.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "message",
+                "description": "Status message providing additional details about the environment status.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The resource name of the workspace base environment.\nFormat: workspace-base-environments/{workspace-base-environment}",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "spec",
+                "description": "The environment specification containing version and dependencies.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "EnvironmentSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "status",
+                "description": "The status of the materialized workspace base environment.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "WorkspaceBaseEnvironmentCacheStatus",
+                  "enum": [
+                    {
+                      "content": "CREATED"
+                    },
+                    {
+                      "content": "EXPIRED"
+                    },
+                    {
+                      "content": "FAILED"
+                    },
+                    {
+                      "content": "INVALID"
+                    },
+                    {
+                      "content": "PENDING"
+                    },
+                    {
+                      "content": "REFRESHING"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "Timestamp when the environment was last updated.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "display_name",
+                "description": "Human-readable display name for the workspace base environment.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "long_running_operation": {
+              "get_operation": {
+                "kebab_name": "get-operation",
+                "pascal_name": "GetOperation",
+                "request": {
+                  "pascal_name": "GetOperationRequest"
+                }
+              },
+              "response_type": {}
+            }
+          },
+          {
+            "name": "DeleteWorkspaceBaseEnvironment",
+            "description": "Deletes a WorkspaceBaseEnvironment.\nDeleting a base environment may impact linked notebooks and jobs.\nThis operation is irreversible and should be performed only when you are certain the environment is no longer needed.",
+            "summary": "Delete a workspace base environment.",
+            "path": "/api/environments/v1/{name=workspace-base-environments/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteWorkspaceBaseEnvironmentRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Required. The resource name of the workspace base environment to delete.\nFormat: workspace-base-environments/{workspace_base_environment}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Required. The resource name of the workspace base environment to delete.\nFormat: workspace-base-environments/{workspace_base_environment}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Required. The resource name of the workspace base environment to delete.\nFormat: workspace-base-environments/{workspace_base_environment}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Required. The resource name of the workspace base environment to delete.\nFormat: workspace-base-environments/{workspace_base_environment}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetDefaultWorkspaceBaseEnvironment",
+            "description": "Gets the default WorkspaceBaseEnvironment configuration for the workspace.\nReturns the current default base environment settings for both CPU and GPU compute.",
+            "summary": "Get the default workspace base environment configuration.",
+            "path": "/api/environments/v1/{name=default-workspace-base-environment}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetDefaultWorkspaceBaseEnvironmentRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "A static resource name of the default workspace base environment.\nFormat: default-workspace-base-environment",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "A static resource name of the default workspace base environment.\nFormat: default-workspace-base-environment",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DefaultWorkspaceBaseEnvironment",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "A static resource name of the default workspace base environment.\nFormat: default-workspace-base-environment",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "A static resource name of the default workspace base environment.\nFormat: default-workspace-base-environment",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetOperation",
+            "description": "Gets the status of a long-running operation.\nClients can use this method to poll the operation result.",
+            "summary": "Get the status of a long-running operation.",
+            "path": "/api/environments/v1/{name=operations/*}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetOperationRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the operation resource.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the operation resource.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The name of the operation resource.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the operation resource.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetWorkspaceBaseEnvironment",
+            "description": "Retrieves a WorkspaceBaseEnvironment by its name.",
+            "summary": "Get a workspace base environment.",
+            "path": "/api/environments/v1/{name=workspace-base-environments/*}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetWorkspaceBaseEnvironmentRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Required. The resource name of the workspace base environment to retrieve.\nFormat: workspace-base-environments/{workspace_base_environment}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Required. The resource name of the workspace base environment to retrieve.\nFormat: workspace-base-environments/{workspace_base_environment}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "WorkspaceBaseEnvironment",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "display_name",
+                  "description": "Human-readable display name for the workspace base environment.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "display_name",
+                  "description": "Human-readable display name for the workspace base environment.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Required. The resource name of the workspace base environment to retrieve.\nFormat: workspace-base-environments/{workspace_base_environment}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Required. The resource name of the workspace base environment to retrieve.\nFormat: workspace-base-environments/{workspace_base_environment}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListWorkspaceBaseEnvironments",
+            "description": "Lists all WorkspaceBaseEnvironments in the workspace.\n\nDatabricks provides the following base environments:\n\n- `workspace-base-environments/databricks_ai_...`: includes popular AI and deep learning packages for serverless GPU compute.\n\n- `workspace-base-environments/databricks_ml_...`: includes popular ML packages for serverless compute.\n\nDatabricks-provided base environments are versioned. For example, `workspace-base-environments/databricks_ml_v5` corresponds to the ML environment built on environment version 5.",
+            "summary": "List workspace base environments.",
+            "path": "/api/environments/v1/workspace-base-environments",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListWorkspaceBaseEnvironmentsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListWorkspaceBaseEnvironmentsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "The maximum number of environments to return per page.\nDefault is 1000.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Page token for pagination. Received from a previous ListWorkspaceBaseEnvironments call.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Page token for pagination. Received from a previous ListWorkspaceBaseEnvironments call.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "RefreshWorkspaceBaseEnvironment",
+            "description": "Refreshes the materialized environment for a WorkspaceBaseEnvironment.\nThis is a long-running operation. The operation will asynchronously regenerate the materialized environment\nand is only marked as done when the materialized environment has been successfully generated or has failed.\nThe existing materialized environment remains available until it expires.",
+            "summary": "Refresh materialized workspace base environment.",
+            "path": "/api/environments/v1/{name=workspace-base-environments/*}/refresh",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "RefreshWorkspaceBaseEnvironmentRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Required. The resource name of the workspace base environment to delete.\nFormat: workspace-base-environments/{workspace_base_environment}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Required. The resource name of the workspace base environment to delete.\nFormat: workspace-base-environments/{workspace_base_environment}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Required. The resource name of the workspace base environment to delete.\nFormat: workspace-base-environments/{workspace_base_environment}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Required. The resource name of the workspace base environment to delete.\nFormat: workspace-base-environments/{workspace_base_environment}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "long_running_operation": {
+              "get_operation": {
+                "kebab_name": "get-operation",
+                "pascal_name": "GetOperation",
+                "request": {
+                  "pascal_name": "GetOperationRequest"
+                }
+              },
+              "response_type": {}
+            }
+          },
+          {
+            "name": "UpdateDefaultWorkspaceBaseEnvironment",
+            "description": "Updates the default WorkspaceBaseEnvironment configuration for the workspace.\nSets the specified base environments as the workspace defaults for CPU and/or GPU compute.",
+            "summary": "Update the default workspace base environment configuration.",
+            "path": "/api/environments/v1/{name=default-workspace-base-environment}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateDefaultWorkspaceBaseEnvironmentRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of this singleton resource.\nFormat: default-workspace-base-environment",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "default_workspace_base_environment",
+                  "description": "Required. The default workspace base environment configuration to update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DefaultWorkspaceBaseEnvironment",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Field mask specifying which fields to update. Use comma as the separator for multiple fields (no space).\nThe special value '*' indicates that all fields should be updated (full replacement).\nValid field paths: cpu_workspace_base_environment, gpu_workspace_base_environment\n\nTo unset one or both defaults, include the field path(s) in the mask and omit them from the request body.\nTo unset both, you must list both paths explicitly — the wildcard '*' cannot be used to unset fields.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of this singleton resource.\nFormat: default-workspace-base-environment",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Field mask specifying which fields to update. Use comma as the separator for multiple fields (no space).\nThe special value '*' indicates that all fields should be updated (full replacement).\nValid field paths: cpu_workspace_base_environment, gpu_workspace_base_environment\n\nTo unset one or both defaults, include the field path(s) in the mask and omit them from the request body.\nTo unset both, you must list both paths explicitly — the wildcard '*' cannot be used to unset fields.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "default_workspace_base_environment",
+                  "description": "Required. The default workspace base environment configuration to update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DefaultWorkspaceBaseEnvironment",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "default_workspace_base_environment",
+              "description": "Required. The default workspace base environment configuration to update.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "DefaultWorkspaceBaseEnvironment",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "DefaultWorkspaceBaseEnvironment",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "default_workspace_base_environment",
+                "description": "Required. The default workspace base environment configuration to update.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DefaultWorkspaceBaseEnvironment",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The resource name of this singleton resource.\nFormat: default-workspace-base-environment",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Field mask specifying which fields to update. Use comma as the separator for multiple fields (no space).\nThe special value '*' indicates that all fields should be updated (full replacement).\nValid field paths: cpu_workspace_base_environment, gpu_workspace_base_environment\n\nTo unset one or both defaults, include the field path(s) in the mask and omit them from the request body.\nTo unset both, you must list both paths explicitly — the wildcard '*' cannot be used to unset fields.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "cpu_workspace_base_environment",
+                "description": "The default workspace base environment for CPU compute.\nFormat: workspace-base-environments/{workspace_base_environment}",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "gpu_workspace_base_environment",
+                "description": "The default workspace base environment for GPU compute.\nFormat: workspace-base-environments/{workspace_base_environment}",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The resource name of this singleton resource.\nFormat: default-workspace-base-environment",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The resource name of this singleton resource.\nFormat: default-workspace-base-environment",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Field mask specifying which fields to update. Use comma as the separator for multiple fields (no space).\nThe special value '*' indicates that all fields should be updated (full replacement).\nValid field paths: cpu_workspace_base_environment, gpu_workspace_base_environment\n\nTo unset one or both defaults, include the field path(s) in the mask and omit them from the request body.\nTo unset both, you must list both paths explicitly — the wildcard '*' cannot be used to unset fields.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateWorkspaceBaseEnvironment",
+            "description": "Updates an existing WorkspaceBaseEnvironment.\nThis is a long-running operation. The operation will asynchronously regenerate the materialized environment\nand is only marked as done when the materialized environment has been successfully generated or has failed.\nThe existing materialized environment remains available until it expires.",
+            "summary": "Update a workspace base environment.",
+            "path": "/api/environments/v1/{name=workspace-base-environments/*}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateWorkspaceBaseEnvironmentRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "workspace_base_environment",
+                  "description": "Required. The workspace base environment with updated fields.\nThe name field is used to identify the environment to update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "WorkspaceBaseEnvironment",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "workspace_base_environment",
+                  "description": "Required. The workspace base environment with updated fields.\nThe name field is used to identify the environment to update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "WorkspaceBaseEnvironment",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "workspace_base_environment",
+              "description": "Required. The workspace base environment with updated fields.\nThe name field is used to identify the environment to update.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "WorkspaceBaseEnvironment",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "display_name",
+                    "description": "Human-readable display name for the workspace base environment.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "display_name",
+                    "description": "Human-readable display name for the workspace base environment.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "workspace_base_environment",
+                "description": "Required. The workspace base environment with updated fields.\nThe name field is used to identify the environment to update.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "WorkspaceBaseEnvironment",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "display_name",
+                      "description": "Human-readable display name for the workspace base environment.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "display_name",
+                      "description": "Human-readable display name for the workspace base environment.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "base_environment_type",
+                "description": "The type of base environment (CPU or GPU).",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "BaseEnvironmentType",
+                  "enum": [
+                    {
+                      "content": "CPU"
+                    },
+                    {
+                      "content": "GPU"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Timestamp when the environment was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "creator_user_id",
+                "description": "User ID of the creator.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "Human-readable display name for the workspace base environment.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "filepath",
+                "description": "The WSFS or UC Volumes path to the environment YAML file.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "is_default",
+                "description": "Whether this is the default environment for the workspace.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "last_updated_user_id",
+                "description": "User ID of the last user who updated the environment.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "message",
+                "description": "Status message providing additional details about the environment status.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The resource name of the workspace base environment.\nFormat: workspace-base-environments/{workspace-base-environment}",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "spec",
+                "description": "The environment specification containing version and dependencies.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "EnvironmentSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "status",
+                "description": "The status of the materialized workspace base environment.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "WorkspaceBaseEnvironmentCacheStatus",
+                  "enum": [
+                    {
+                      "content": "CREATED"
+                    },
+                    {
+                      "content": "EXPIRED"
+                    },
+                    {
+                      "content": "FAILED"
+                    },
+                    {
+                      "content": "INVALID"
+                    },
+                    {
+                      "content": "PENDING"
+                    },
+                    {
+                      "content": "REFRESHING"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "Timestamp when the environment was last updated.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "Human-readable display name for the workspace base environment.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "long_running_operation": {
+              "get_operation": {
+                "kebab_name": "get-operation",
+                "pascal_name": "GetOperation",
+                "request": {
+                  "pascal_name": "GetOperationRequest"
+                }
+              },
+              "response_type": {}
+            }
+          }
+        ]
+      },
+      {
+        "id": "settings.EsmEnablementAccount",
+        "name": "EsmEnablementAccount",
+        "description": "The enhanced security monitoring setting at the account level controls whether to enable the feature on new workspaces.\nBy default, this account-level setting is disabled for new workspaces. After workspace creation, account admins can enable enhanced security monitoring individually for each workspace.",
+        "package": {
+          "name": "settings"
+        },
+        "is_accounts": true,
+        "has_parent": true,
+        "docs_group": "settings",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "parent_service_id": "settings.AccountSettings",
+        "methods": [
+          {
+            "name": "Get",
+            "description": "Gets the enhanced security monitoring setting for new workspaces.",
+            "summary": "Get the enhanced security monitoring setting for new workspaces.",
+            "path": "/api/2.0/accounts/{account_id}/settings/types/shield_esm_enablement_ac/names/default",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetEsmEnablementAccountSettingRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "EsmEnablementAccountSetting",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "esm_enablement_account",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "EsmEnablementAccount",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "esm_enablement_account",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "EsmEnablementAccount",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Updates the value of the enhanced security monitoring setting for new workspaces.",
+            "summary": "Update the enhanced security monitoring setting for new workspaces.",
+            "path": "/api/2.0/accounts/{account_id}/settings/types/shield_esm_enablement_ac/names/default",
+            "can_use_json": true,
+            "must_use_json": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "UpdateEsmEnablementAccountSettingRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "EsmEnablementAccountSetting",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "EsmEnablementAccountSetting",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "EsmEnablementAccountSetting",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "esm_enablement_account",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "EsmEnablementAccount",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "esm_enablement_account",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "EsmEnablementAccount",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "allow_missing",
+                "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "field_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "setting",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EsmEnablementAccountSetting",
+                  "is_object": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "ml.Experiments",
+        "name": "Experiments",
+        "description": "Experiments are the primary unit of organization in MLflow; all MLflow runs belong to an experiment. Each experiment lets you visualize, search, and compare runs, as well as download run artifacts or metadata for analysis in other tools. Experiments are maintained in a Databricks hosted MLflow tracking server.\n\nExperiments are located in the workspace file tree. You manage experiments using the same tools you use to manage other workspace objects such as folders, notebooks, and libraries.",
+        "package": {
+          "name": "ml"
+        },
+        "docs_group": "ml",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "GetHistoryRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "CreateExperiment",
+            "description": "Creates an experiment with a name. Returns the ID of the newly created experiment.\nValidates that another experiment with the same name does not already exist and fails\nif another experiment with the same name already exists.\n\nThrows `RESOURCE_ALREADY_EXISTS` if an experiment with the given name exists.\nNote: In some contexts, this error may be remapped to `ALREADY_EXISTS`.\nTo be safe, clients should check for both error codes.",
+            "summary": "Create experiment.",
+            "path": "/api/2.0/mlflow/experiments/create",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateExperiment",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Experiment name.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Experiment name.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CreateExperimentResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "artifact_location",
+                "description": "Location where all artifacts for the experiment are stored.\nIf not provided, the remote server will select an appropriate default.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Experiment name.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tags",
+                "description": "A collection of tags to set on the experiment. Maximum tag size and number of tags per request\ndepends on the storage backend. All storage backends are guaranteed to support tag keys up\nto 250 bytes in size and tag values up to 5000 bytes in size. All storage backends are also\nguaranteed to support up to 20 tags per request.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ExperimentTagList",
+                  "array_value": {
+                    "pascal_name": "ExperimentTag",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "trace_location",
+                "description": "The location where the experiment's traces are stored. When set, the\nunderlying storage is provisioned and the experiment's traces are routed\nto it. When unset, traces are stored in the default MLflow backend. This\nfield cannot be updated after the experiment is created.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "ExperimentTraceLocation",
+                  "is_object": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Experiment name.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateIssue",
+            "description": "Creates an issue in an experiment.",
+            "summary": "Create an issue.",
+            "path": "/api/2.0/mlflow/{parent=experiments/*}/issues",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "CreateIssueRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "experiments/{experiment}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "issue",
+                  "description": "Output-only fields are ignored.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Issue",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "experiments/{experiment}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "issue",
+                  "description": "Output-only fields are ignored.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Issue",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "issue",
+              "description": "Output-only fields are ignored.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Issue",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "title",
+                    "description": "Non-empty, at most 250 UTF-8 bytes.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "severity",
+                    "description": "Cannot be cleared: an Issue without a severity would match no severity filter.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "IssueSeverity",
+                      "enum": [
+                        {
+                          "content": "HIGH"
+                        },
+                        {
+                          "content": "LOW"
+                        },
+                        {
+                          "content": "MEDIUM"
+                        }
+                      ]
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "title",
+                    "description": "Non-empty, at most 250 UTF-8 bytes.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "severity",
+                    "description": "Cannot be cleared: an Issue without a severity would match no severity filter.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "IssueSeverity",
+                      "enum": [
+                        {
+                          "content": "HIGH"
+                        },
+                        {
+                          "content": "LOW"
+                        },
+                        {
+                          "content": "MEDIUM"
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "Issue",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "title",
+                  "description": "Non-empty, at most 250 UTF-8 bytes.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "severity",
+                  "description": "Cannot be cleared: an Issue without a severity would match no severity filter.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "IssueSeverity",
+                    "enum": [
+                      {
+                        "content": "HIGH"
+                      },
+                      {
+                        "content": "LOW"
+                      },
+                      {
+                        "content": "MEDIUM"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "title",
+                  "description": "Non-empty, at most 250 UTF-8 bytes.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "severity",
+                  "description": "Cannot be cleared: an Issue without a severity would match no severity filter.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "IssueSeverity",
+                    "enum": [
+                      {
+                        "content": "HIGH"
+                      },
+                      {
+                        "content": "LOW"
+                      },
+                      {
+                        "content": "MEDIUM"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "issue",
+                "description": "Output-only fields are ignored.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Issue",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "title",
+                      "description": "Non-empty, at most 250 UTF-8 bytes.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "severity",
+                      "description": "Cannot be cleared: an Issue without a severity would match no severity filter.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "IssueSeverity",
+                        "enum": [
+                          {
+                            "content": "HIGH"
+                          },
+                          {
+                            "content": "LOW"
+                          },
+                          {
+                            "content": "MEDIUM"
+                          }
+                        ]
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "title",
+                      "description": "Non-empty, at most 250 UTF-8 bytes.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "severity",
+                      "description": "Cannot be cleared: an Issue without a severity would match no severity filter.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "IssueSeverity",
+                        "enum": [
+                          {
+                            "content": "HIGH"
+                          },
+                          {
+                            "content": "LOW"
+                          },
+                          {
+                            "content": "MEDIUM"
+                          }
+                        ]
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "issue_id",
+                "description": "Optional client-chosen ID: iss- followed by 32 lowercase hex digits. A retry\nwith the same ID fails with ALREADY_EXISTS rather than making a duplicate.\nThe server generates one if unset.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "experiments/{experiment}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "categories",
+                "description": "At most 10 values of at most 64 UTF-8 bytes each, unique case-insensitively.\nLeading and trailing whitespace is trimmed.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "When the Issue was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "created_by",
+                "description": "The email of the user whose request created the Issue. source_type tells\nwhether issue detection created it.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "Markdown, at most 32 KiB.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "issue_id",
+                "description": "The last segment of `name`. Issue assessments on traces reference the Issue\nby this ID.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "last_seen_time",
+                "description": "The request time of the latest trace the Issue affects. Required, and can't\nbe cleared, unless source_type is MANUAL. A MANUAL Issue without one returns\nits create_time.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "last_updated_by",
+                "description": "The email of the user whose request last updated the Issue.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "metadata",
+                "description": "Additional details about the Issue, such as how issue detection observed it.\nNot a stable contract: keys and values can change without notice, so clients\nmust tolerate unknown and missing keys. At most 20 entries, with keys of at\nmost 64 UTF-8 bytes.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "name",
+                "description": "experiments/{experiment}/issues/{issue}",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "severity",
+                "description": "Cannot be cleared: an Issue without a severity would match no severity filter.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "IssueSeverity",
+                  "enum": [
+                    {
+                      "content": "HIGH"
+                    },
+                    {
+                      "content": "LOW"
+                    },
+                    {
+                      "content": "MEDIUM"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "source_id",
+                "description": "Set once at create. For ADHOC_RUN and SCHEDULED_RUN, the ID of the issue\ndetection run in the same experiment that created the Issue. Absent for\nMANUAL.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "source_type",
+                "description": "Set once at create. Defaults to MANUAL.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "IssueSourceType",
+                  "enum": [
+                    {
+                      "content": "ADHOC_RUN"
+                    },
+                    {
+                      "content": "MANUAL"
+                    },
+                    {
+                      "content": "SCHEDULED_RUN"
+                    },
+                    {
+                      "content": "SINGLE_TRACE_ANALYSIS"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "status",
+                "description": "Defaults to PENDING on create, and can't be cleared.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "IssueStatus",
+                  "enum": [
+                    {
+                      "content": "PENDING"
+                    },
+                    {
+                      "content": "REJECTED"
+                    },
+                    {
+                      "content": "RESOLVED"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "tags",
+                "description": "Caller-owned; the server never writes system values here. At most 10\nentries. Keys match ^[A-Za-z0-9_.:/-]+$ and are at most 128 UTF-8 bytes;\nvalues are at most 256 UTF-8 bytes.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "title",
+                "description": "Non-empty, at most 250 UTF-8 bytes.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "When the Issue was last updated.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "experiments/{experiment}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "title",
+                "description": "Non-empty, at most 250 UTF-8 bytes.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "severity",
+                "description": "Cannot be cleared: an Issue without a severity would match no severity filter.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "IssueSeverity",
+                  "enum": [
+                    {
+                      "content": "HIGH"
+                    },
+                    {
+                      "content": "LOW"
+                    },
+                    {
+                      "content": "MEDIUM"
+                    }
+                  ]
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateLoggedModel",
+            "description": "Create a logged model.",
+            "summary": "Create a logged model.",
+            "path": "/api/2.0/mlflow/logged-models",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateLoggedModelRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "experiment_id",
+                  "description": "The ID of the experiment that owns the model.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "experiment_id",
+                  "description": "The ID of the experiment that owns the model.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CreateLoggedModelResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "experiment_id",
+                "description": "The ID of the experiment that owns the model.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "model_type",
+                "description": "The type of the model, such as ``\"Agent\"``, ``\"Classifier\"``, ``\"LLM\"``.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the model (optional). If not specified one will be generated.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "params",
+                "description": "Parameters attached to the model.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "LoggedModelParameterList",
+                  "array_value": {
+                    "pascal_name": "LoggedModelParameter",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "source_run_id",
+                "description": "The ID of the run that created the model.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tags",
+                "description": "Tags attached to the model.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "LoggedModelTagList",
+                  "array_value": {
+                    "pascal_name": "LoggedModelTag",
+                    "is_object": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "experiment_id",
+                "description": "The ID of the experiment that owns the model.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateRun",
+            "description": "Creates a new run within an experiment. A run is usually a single execution of a\nmachine learning or data ETL pipeline. MLflow uses runs to track the `mlflowParam`,\n`mlflowMetric`, and `mlflowRunTag` associated with a single execution.",
+            "summary": "Create a run.",
+            "path": "/api/2.0/mlflow/runs/create",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateRun",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "CreateRunResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "experiment_id",
+                "description": "ID of the associated experiment.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "run_name",
+                "description": "The name of the run.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "start_time",
+                "description": "Unix timestamp in milliseconds of when the run started.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "tags",
+                "description": "Additional metadata for run.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "RunTagList",
+                  "array_value": {
+                    "pascal_name": "RunTag",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "user_id",
+                "description": "ID of the user executing the run.\nThis field is deprecated as of MLflow 1.0, and will be removed in a future\nMLflow release. Use 'mlflow.user' tag instead.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteExperiment",
+            "description": "Marks an experiment and associated metadata, runs, metrics, params, and tags for deletion.\nIf the experiment uses FileStore, artifacts associated with the experiment are also deleted.",
+            "summary": "Delete an experiment.",
+            "path": "/api/2.0/mlflow/experiments/delete",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteExperiment",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "experiment_id",
+                  "description": "ID of the associated experiment.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "experiment_id",
+                  "description": "ID of the associated experiment.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteExperimentResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "experiment_id",
+                "description": "ID of the associated experiment.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "experiment_id",
+                "description": "ID of the associated experiment.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteLoggedModel",
+            "description": "Delete a logged model.",
+            "summary": "Delete a logged model.",
+            "path": "/api/2.0/mlflow/logged-models/{model_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteLoggedModelRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "model_id",
+                  "description": "The ID of the logged model to delete.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "model_id",
+                  "description": "The ID of the logged model to delete.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteLoggedModelResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "model_id",
+                "description": "The ID of the logged model to delete.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "model_id",
+                "description": "The ID of the logged model to delete.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteLoggedModelTag",
+            "description": "Delete a tag on a logged model.",
+            "summary": "Delete a tag on a logged model.",
+            "path": "/api/2.0/mlflow/logged-models/{model_id}/tags/{tag_key}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteLoggedModelTagRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "model_id",
+                  "description": "The ID of the logged model to delete the tag from.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "tag_key",
+                  "description": "The tag key.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "model_id",
+                  "description": "The ID of the logged model to delete the tag from.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "tag_key",
+                  "description": "The tag key.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteLoggedModelTagResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "model_id",
+                "description": "The ID of the logged model to delete the tag from.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tag_key",
+                "description": "The tag key.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "model_id",
+                "description": "The ID of the logged model to delete the tag from.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tag_key",
+                "description": "The tag key.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteRun",
+            "description": "Marks a run for deletion.",
+            "summary": "Delete a run.",
+            "path": "/api/2.0/mlflow/runs/delete",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteRun",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "run_id",
+                  "description": "ID of the run to delete.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "run_id",
+                  "description": "ID of the run to delete.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteRunResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "run_id",
+                "description": "ID of the run to delete.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "run_id",
+                "description": "ID of the run to delete.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteRuns",
+            "description": "Bulk delete runs in an experiment that were created prior to or at the specified timestamp. Deletes at most\nmax_runs per request. See the cloud-specific MLflow runs documentation for a Python client example.",
+            "summary": "Delete runs by creation time.",
+            "path": "/api/2.0/mlflow/databricks/runs/delete-runs",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteRuns",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "experiment_id",
+                  "description": "The ID of the experiment containing the runs to delete.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "max_timestamp_millis",
+                  "description": "The maximum creation timestamp in milliseconds since the UNIX epoch for deleting runs. Only runs created prior to\nor at this timestamp are deleted.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "experiment_id",
+                  "description": "The ID of the experiment containing the runs to delete.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "max_timestamp_millis",
+                  "description": "The maximum creation timestamp in milliseconds since the UNIX epoch for deleting runs. Only runs created prior to\nor at this timestamp are deleted.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteRunsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "experiment_id",
+                "description": "The ID of the experiment containing the runs to delete.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "max_runs",
+                "description": "An optional positive integer indicating the maximum number of runs to delete. The maximum allowed value for\nmax_runs is 10000.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "max_timestamp_millis",
+                "description": "The maximum creation timestamp in milliseconds since the UNIX epoch for deleting runs. Only runs created prior to\nor at this timestamp are deleted.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "experiment_id",
+                "description": "The ID of the experiment containing the runs to delete.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "max_timestamp_millis",
+                "description": "The maximum creation timestamp in milliseconds since the UNIX epoch for deleting runs. Only runs created prior to\nor at this timestamp are deleted.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteTag",
+            "description": "Deletes a tag on a run. Tags are run metadata that can be updated during a run and after\na run completes.",
+            "summary": "Delete a tag on a run.",
+            "path": "/api/2.0/mlflow/runs/delete-tag",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteTag",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "run_id",
+                  "description": "ID of the run that the tag was logged under. Must be provided.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "key",
+                  "description": "Name of the tag. Maximum size is 255 bytes. Must be provided.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "run_id",
+                  "description": "ID of the run that the tag was logged under. Must be provided.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "key",
+                  "description": "Name of the tag. Maximum size is 255 bytes. Must be provided.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteTagResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "key",
+                "description": "Name of the tag. Maximum size is 255 bytes. Must be provided.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "run_id",
+                "description": "ID of the run that the tag was logged under. Must be provided.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "run_id",
+                "description": "ID of the run that the tag was logged under. Must be provided.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "key",
+                "description": "Name of the tag. Maximum size is 255 bytes. Must be provided.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "FinalizeLoggedModel",
+            "description": "Finalize a logged model.",
+            "summary": "Finalize a logged model.",
+            "path": "/api/2.0/mlflow/logged-models/{model_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "FinalizeLoggedModelRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "model_id",
+                  "description": "The ID of the logged model to finalize.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "status",
+                  "description": "Whether or not the model is ready for use. ``\"LOGGED_MODEL_UPLOAD_FAILED\"`` indicates that something went wrong\nwhen logging the model weights / agent code.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "LoggedModelStatus",
+                    "enum": [
+                      {
+                        "content": "LOGGED_MODEL_PENDING"
+                      },
+                      {
+                        "content": "LOGGED_MODEL_READY"
+                      },
+                      {
+                        "content": "LOGGED_MODEL_UPLOAD_FAILED"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "model_id",
+                  "description": "The ID of the logged model to finalize.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "status",
+                  "description": "Whether or not the model is ready for use. ``\"LOGGED_MODEL_UPLOAD_FAILED\"`` indicates that something went wrong\nwhen logging the model weights / agent code.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "LoggedModelStatus",
+                    "enum": [
+                      {
+                        "content": "LOGGED_MODEL_PENDING"
+                      },
+                      {
+                        "content": "LOGGED_MODEL_READY"
+                      },
+                      {
+                        "content": "LOGGED_MODEL_UPLOAD_FAILED"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "FinalizeLoggedModelResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "model_id",
+                "description": "The ID of the logged model to finalize.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "status",
+                "description": "Whether or not the model is ready for use. ``\"LOGGED_MODEL_UPLOAD_FAILED\"`` indicates that something went wrong\nwhen logging the model weights / agent code.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "LoggedModelStatus",
+                  "enum": [
+                    {
+                      "content": "LOGGED_MODEL_PENDING"
+                    },
+                    {
+                      "content": "LOGGED_MODEL_READY"
+                    },
+                    {
+                      "content": "LOGGED_MODEL_UPLOAD_FAILED"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "model_id",
+                "description": "The ID of the logged model to finalize.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "status",
+                "description": "Whether or not the model is ready for use. ``\"LOGGED_MODEL_UPLOAD_FAILED\"`` indicates that something went wrong\nwhen logging the model weights / agent code.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "LoggedModelStatus",
+                  "enum": [
+                    {
+                      "content": "LOGGED_MODEL_PENDING"
+                    },
+                    {
+                      "content": "LOGGED_MODEL_READY"
+                    },
+                    {
+                      "content": "LOGGED_MODEL_UPLOAD_FAILED"
+                    }
+                  ]
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetByName",
+            "description": "Gets metadata for an experiment.\n\nThis endpoint will return deleted experiments, but prefers the active experiment\nif an active and deleted experiment share the same name. If multiple deleted\nexperiments share the same name, the API will return one of them.\n\nThrows `RESOURCE_DOES_NOT_EXIST` if no experiment with the specified name exists.",
+            "summary": "Get an experiment by name.",
+            "path": "/api/2.0/mlflow/experiments/get-by-name",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetByNameRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "experiment_name",
+                  "description": "Name of the associated experiment.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "experiment_name",
+                  "description": "Name of the associated experiment.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetExperimentByNameResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "experiment_name",
+                "description": "Name of the associated experiment.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "experiment_name",
+                "description": "Name of the associated experiment.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetExperiment",
+            "description": "Gets metadata for an experiment. This method works on deleted experiments.",
+            "summary": "Get an experiment.",
+            "path": "/api/2.0/mlflow/experiments/get",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetExperimentRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "experiment_id",
+                  "description": "ID of the associated experiment.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "experiment_id",
+                  "description": "ID of the associated experiment.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetExperimentResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "experiment_id",
+                "description": "ID of the associated experiment.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "experiment_id",
+                "description": "ID of the associated experiment.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetHistory",
+            "description": "Gets a list of all values for the specified metric for a given run.",
+            "summary": "Get metric history for a run.",
+            "path": "/api/2.0/mlflow/metrics/get-history",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetHistoryRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "metric_key",
+                  "description": "Name of the metric.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "metric_key",
+                  "description": "Name of the metric.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetMetricHistoryResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "max_results",
+                "description": "Maximum number of Metric records to return per paginated request. Default is set to 25,000. If set higher than\n25,000, a request Exception will be raised.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "metric_key",
+                "description": "Name of the metric.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Token indicating the page of metric histories to fetch.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "run_id",
+                "description": "ID of the run from which to fetch metric values. Must be provided.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "run_uuid",
+                "description": "[Deprecated, use `run_id` instead] ID of the run from which to fetch metric values. This field\nwill be removed in a future MLflow version.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "metric_key",
+                "description": "Name of the metric.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Token indicating the page of metric histories to fetch.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "GetIssue",
+            "description": "Gets an issue.",
+            "summary": "Get an issue.",
+            "path": "/api/2.0/mlflow/{name=experiments/*/issues/*}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetIssueRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "experiments/{experiment}/issues/{issue}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "experiments/{experiment}/issues/{issue}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Issue",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "title",
+                  "description": "Non-empty, at most 250 UTF-8 bytes.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "severity",
+                  "description": "Cannot be cleared: an Issue without a severity would match no severity filter.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "IssueSeverity",
+                    "enum": [
+                      {
+                        "content": "HIGH"
+                      },
+                      {
+                        "content": "LOW"
+                      },
+                      {
+                        "content": "MEDIUM"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "title",
+                  "description": "Non-empty, at most 250 UTF-8 bytes.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "severity",
+                  "description": "Cannot be cleared: an Issue without a severity would match no severity filter.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "IssueSeverity",
+                    "enum": [
+                      {
+                        "content": "HIGH"
+                      },
+                      {
+                        "content": "LOW"
+                      },
+                      {
+                        "content": "MEDIUM"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "experiments/{experiment}/issues/{issue}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "experiments/{experiment}/issues/{issue}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetLoggedModel",
+            "description": "Get a logged model.",
+            "summary": "Get a logged model.",
+            "path": "/api/2.0/mlflow/logged-models/{model_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetLoggedModelRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "model_id",
+                  "description": "The ID of the logged model to retrieve.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "model_id",
+                  "description": "The ID of the logged model to retrieve.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetLoggedModelResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "model_id",
+                "description": "The ID of the logged model to retrieve.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "model_id",
+                "description": "The ID of the logged model to retrieve.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetPermissionLevels",
+            "description": "Gets the permission levels that a user can have on an object.",
+            "summary": "Get experiment permission levels.",
+            "path": "/api/2.0/permissions/experiments/{experiment_id}/permissionLevels",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetExperimentPermissionLevelsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "experiment_id",
+                  "description": "The experiment for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "experiment_id",
+                  "description": "The experiment for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetExperimentPermissionLevelsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "experiment_id",
+                "description": "The experiment for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "experiment_id",
+                "description": "The experiment for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetPermissions",
+            "description": "Gets the permissions of an experiment. Experiments can inherit permissions from their root object.",
+            "summary": "Get experiment permissions.",
+            "path": "/api/2.0/permissions/experiments/{experiment_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetExperimentPermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "experiment_id",
+                  "description": "The experiment for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "experiment_id",
+                  "description": "The experiment for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ExperimentPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "experiment_id",
+                "description": "The experiment for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "experiment_id",
+                "description": "The experiment for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetRun",
+            "description": "Gets the metadata, metrics, params, and tags for a run. In the case where multiple metrics with the same key are\nlogged for a run, return only the value with the latest timestamp.\n\nIf there are multiple values with the latest timestamp, return the maximum of these values.",
+            "summary": "Get a run.",
+            "path": "/api/2.0/mlflow/runs/get",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetRunRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "run_id",
+                  "description": "ID of the run to fetch. Must be provided.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "run_id",
+                  "description": "ID of the run to fetch. Must be provided.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetRunResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "run_id",
+                "description": "ID of the run to fetch. Must be provided.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "run_uuid",
+                "description": "[Deprecated, use `run_id` instead] ID of the run to fetch. This field will\nbe removed in a future MLflow version.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "run_id",
+                "description": "ID of the run to fetch. Must be provided.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListArtifacts",
+            "description": "List artifacts for a run. Takes an optional `artifact_path` prefix which if specified,\nthe response contains only artifacts with the specified prefix.\nA maximum of 1000 artifacts will be retrieved for UC Volumes. Please call\n`/api/2.0/fs/directories{directory_path}` for listing artifacts in UC Volumes, which supports pagination. See [List\ndirectory contents | Files API](/api/workspace/files/listdirectorycontents).",
+            "summary": "List artifacts.",
+            "path": "/api/2.0/mlflow/artifacts/list",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListArtifactsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListArtifactsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_token",
+                "description": "The token indicating the page of artifact results to fetch. `page_token` is not supported when listing artifacts in UC\nVolumes. A maximum of 1000 artifacts will be retrieved for UC Volumes. Please call\n`/api/2.0/fs/directories{directory_path}` for listing artifacts in UC Volumes, which supports pagination. See [List\ndirectory contents | Files API](/api/workspace/files/listdirectorycontents).",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "path",
+                "description": "Filter artifacts matching this path (a relative path from the root artifact directory).",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "run_id",
+                "description": "ID of the run whose artifacts to list. Must be provided.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "run_uuid",
+                "description": "[Deprecated, use `run_id` instead] ID of the run whose artifacts to list. This field will\nbe removed in a future MLflow version.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "The token indicating the page of artifact results to fetch. `page_token` is not supported when listing artifacts in UC\nVolumes. A maximum of 1000 artifacts will be retrieved for UC Volumes. Please call\n`/api/2.0/fs/directories{directory_path}` for listing artifacts in UC Volumes, which supports pagination. See [List\ndirectory contents | Files API](/api/workspace/files/listdirectorycontents).",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListExperiments",
+            "description": "Gets a list of all experiments.",
+            "summary": "List experiments.",
+            "path": "/api/2.0/mlflow/experiments/list",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListExperimentsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListExperimentsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "max_results",
+                "description": "Maximum number of experiments desired.\nIf `max_results` is unspecified, return all experiments.\nIf `max_results` is too large, it'll be automatically capped at 1000.\nCallers of this endpoint are encouraged to pass max_results explicitly and leverage\npage_token to iterate through experiments.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Token indicating the page of experiments to fetch",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "view_type",
+                "description": "Qualifier for type of experiments to be returned.\nIf unspecified, return only active experiments.",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "ViewType",
+                  "enum": [
+                    {
+                      "content": "ACTIVE_ONLY"
+                    },
+                    {
+                      "content": "ALL"
+                    },
+                    {
+                      "content": "DELETED_ONLY"
+                    }
+                  ]
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Token indicating the page of experiments to fetch",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "LogBatch",
+            "description": "Logs a batch of metrics, params, and tags for a run. If any data failed to be persisted, the server will respond\nwith an error (non-200 status code).\n\nIn case of error (due to internal server error or an invalid request), partial data may be written.\n\nYou can write metrics, params, and tags in interleaving fashion, but within a given entity type are guaranteed to\nfollow the order specified in the request body.\n\nThe overwrite behavior for metrics,  params, and tags is as follows:\n\n* Metrics: metric values are never overwritten. Logging a metric (key, value, timestamp) appends to the set of values\nfor the metric with the provided key.\n\n* Tags: tag values can be overwritten by successive writes to the same tag key. That is, if multiple tag values\nwith the same key are provided in the same API request, the last-provided tag value is written. Logging the same\ntag (key, value) is permitted. Specifically, logging a tag is idempotent.\n\n* Parameters: once written, param values cannot be changed (attempting to overwrite a param value will result in an\nerror). However, logging the same param (key, value) is permitted. Specifically, logging a param is idempotent.\n\nRequest Limits\n-------------------------------\nA single JSON-serialized API request may be up to 1 MB in size and contain:\n\n* No more than 1000 metrics,  params, and tags in total\n\n* Up to 1000 metrics\n\n* Up to 100  params\n\n* Up to 100 tags\n\nFor example, a valid request might contain 900 metrics, 50 params, and 50 tags, but logging 900 metrics, 50 params,\nand 51 tags is invalid.\n\nThe following limits also apply to metric, param, and tag keys and values:\n\n* Metric keys, param keys, and tag keys can be up to 250 characters in length\n\n* Parameter and tag values can be up to 250 characters in length",
+            "summary": "Log a batch of metrics/params/tags for a run.",
+            "path": "/api/2.0/mlflow/runs/log-batch",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "LogBatch",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "LogBatchResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "metrics",
+                "description": "Metrics to log. A single request can contain up to 1000 metrics, and up to 1000\nmetrics, params, and tags in total.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "MetricList",
+                  "array_value": {
+                    "pascal_name": "Metric",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "params",
+                "description": "Params to log. A single request can contain up to 100 params, and up to 1000\nmetrics, params, and tags in total.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ParamList",
+                  "array_value": {
+                    "pascal_name": "Param",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "run_id",
+                "description": "ID of the run to log under",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tags",
+                "description": "Tags to log. A single request can contain up to 100 tags, and up to 1000\nmetrics, params, and tags in total.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "RunTagList",
+                  "array_value": {
+                    "pascal_name": "RunTag",
+                    "is_object": true
+                  }
+                }
+              }
+            ]
+          },
+          {
+            "name": "LogInputs",
+            "description": "Logs inputs, such as datasets and models, to an MLflow Run.",
+            "summary": "Log inputs to a run.",
+            "path": "/api/2.0/mlflow/runs/log-inputs",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "LogInputs",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "run_id",
+                  "description": "ID of the run to log under",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "run_id",
+                  "description": "ID of the run to log under",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "LogInputsResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "datasets",
+                "description": "Dataset inputs",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DatasetInputList",
+                  "array_value": {
+                    "pascal_name": "DatasetInput",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "models",
+                "description": "Model inputs",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ModelInputList",
+                  "array_value": {
+                    "pascal_name": "ModelInput",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "run_id",
+                "description": "ID of the run to log under",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "run_id",
+                "description": "ID of the run to log under",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "LogLoggedModelParams",
+            "description": "Logs params for a logged model. A param is a key-value pair (string key, string value). Examples include\nhyperparameters used for ML model training. A param can be logged only once for a logged model, and\nattempting to overwrite an existing param with a different value will result in an error",
+            "summary": "Log params for a logged model.",
+            "path": "/api/2.0/mlflow/logged-models/{model_id}/params",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "LogLoggedModelParamsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "model_id",
+                  "description": "The ID of the logged model to log params for.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "model_id",
+                  "description": "The ID of the logged model to log params for.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "LogLoggedModelParamsRequestResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "model_id",
+                "description": "The ID of the logged model to log params for.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "params",
+                "description": "Parameters to attach to the model.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "LoggedModelParameterList",
+                  "array_value": {
+                    "pascal_name": "LoggedModelParameter",
+                    "is_object": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "model_id",
+                "description": "The ID of the logged model to log params for.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "LogMetric",
+            "description": "Log a metric for a run. A metric is a key-value pair (string key, float value) with an\nassociated timestamp. Examples include the various metrics that represent ML model accuracy.\nA metric can be logged multiple times.",
+            "summary": "Log a metric for a run.",
+            "path": "/api/2.0/mlflow/runs/log-metric",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "LogMetric",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "key",
+                  "description": "Name of the metric.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "value",
+                  "description": "Double value of the metric being logged.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_float64": true
+                  }
+                },
+                {
+                  "name": "timestamp",
+                  "description": "Unix timestamp in milliseconds at the time metric was logged.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "key",
+                  "description": "Name of the metric.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "value",
+                  "description": "Double value of the metric being logged.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_float64": true
+                  }
+                },
+                {
+                  "name": "timestamp",
+                  "description": "Unix timestamp in milliseconds at the time metric was logged.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "LogMetricResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "dataset_digest",
+                "description": "Dataset digest of the dataset associated with the metric,\ne.g. an md5 hash of the dataset that uniquely identifies it\nwithin datasets of the same name.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "dataset_name",
+                "description": "The name of the dataset associated with the metric.\nE.g. “my.uc.table@2” “nyc-taxi-dataset”, “fantastic-elk-3”",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "key",
+                "description": "Name of the metric.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "model_id",
+                "description": "ID of the logged model associated with the metric, if applicable",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "run_id",
+                "description": "ID of the run under which to log the metric. Must be provided.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "run_uuid",
+                "description": "[Deprecated, use `run_id` instead] ID of the run under which to log the metric. This field will\nbe removed in a future MLflow version.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "step",
+                "description": "Step at which to log the metric",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "timestamp",
+                "description": "Unix timestamp in milliseconds at the time metric was logged.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "value",
+                "description": "Double value of the metric being logged.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_float64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "key",
+                "description": "Name of the metric.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "value",
+                "description": "Double value of the metric being logged.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_float64": true
+                }
+              },
+              {
+                "name": "timestamp",
+                "description": "Unix timestamp in milliseconds at the time metric was logged.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "LogModel",
+            "description": "**Note:** the [Create a logged model](/api/workspace/experiments/createloggedmodel) API replaces this endpoint.\n\nLog a model to an MLflow Run.",
+            "summary": "Log a model.",
+            "path": "/api/2.0/mlflow/runs/log-model",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "LogModel",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "LogModelResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "model_json",
+                "description": "MLmodel file in json format.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "run_id",
+                "description": "ID of the run to log under",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "LogOutputs",
+            "description": "Logs outputs, such as models, from an MLflow Run.",
+            "summary": "Log outputs from a run.",
+            "path": "/api/2.0/mlflow/runs/outputs",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "LogOutputsRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "run_id",
+                  "description": "The ID of the Run from which to log outputs.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "run_id",
+                  "description": "The ID of the Run from which to log outputs.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "LogOutputsResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "models",
+                "description": "The model outputs from the Run.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ModelOutputList",
+                  "array_value": {
+                    "pascal_name": "ModelOutput",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "run_id",
+                "description": "The ID of the Run from which to log outputs.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "run_id",
+                "description": "The ID of the Run from which to log outputs.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "LogParam",
+            "description": "Logs a param used for a run. A param is a key-value pair (string key,\nstring value). Examples include hyperparameters used for ML model training and\nconstant dates and values used in an ETL pipeline. A param can be logged only once for a run.",
+            "summary": "Log a param for a run.",
+            "path": "/api/2.0/mlflow/runs/log-parameter",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "LogParam",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "key",
+                  "description": "Name of the param. Maximum size is 255 bytes.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "value",
+                  "description": "String value of the param being logged. Maximum size is 500 bytes.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "key",
+                  "description": "Name of the param. Maximum size is 255 bytes.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "value",
+                  "description": "String value of the param being logged. Maximum size is 500 bytes.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "LogParamResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "key",
+                "description": "Name of the param. Maximum size is 255 bytes.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "run_id",
+                "description": "ID of the run under which to log the param. Must be provided.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "run_uuid",
+                "description": "[Deprecated, use `run_id` instead] ID of the run under which to log the param. This field will\nbe removed in a future MLflow version.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "value",
+                "description": "String value of the param being logged. Maximum size is 500 bytes.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "key",
+                "description": "Name of the param. Maximum size is 255 bytes.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "value",
+                "description": "String value of the param being logged. Maximum size is 500 bytes.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "RestoreExperiment",
+            "description": "Restore an experiment marked for deletion. This also restores\nassociated metadata, runs, metrics, params, and tags. If experiment uses FileStore, underlying\nartifacts associated with experiment are also restored.\n\nThrows `RESOURCE_DOES_NOT_EXIST` if experiment was never created or was permanently deleted.",
+            "summary": "Restore an experiment.",
+            "path": "/api/2.0/mlflow/experiments/restore",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "RestoreExperiment",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "experiment_id",
+                  "description": "ID of the associated experiment.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "experiment_id",
+                  "description": "ID of the associated experiment.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "RestoreExperimentResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "experiment_id",
+                "description": "ID of the associated experiment.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "experiment_id",
+                "description": "ID of the associated experiment.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "RestoreRun",
+            "description": "Restores a deleted run. This also restores associated metadata, runs, metrics, params, and tags.\n\nThrows `RESOURCE_DOES_NOT_EXIST` if the run was never created or was permanently deleted.",
+            "summary": "Restore a run.",
+            "path": "/api/2.0/mlflow/runs/restore",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "RestoreRun",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "run_id",
+                  "description": "ID of the run to restore.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "run_id",
+                  "description": "ID of the run to restore.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "RestoreRunResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "run_id",
+                "description": "ID of the run to restore.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "run_id",
+                "description": "ID of the run to restore.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "RestoreRuns",
+            "description": "Bulk restore runs in an experiment that were deleted no earlier than the specified timestamp. Restores at most\nmax_runs per request. See the cloud-specific MLflow runs documentation for a Python client example.",
+            "summary": "Restore runs by deletion time.",
+            "path": "/api/2.0/mlflow/databricks/runs/restore-runs",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "RestoreRuns",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "experiment_id",
+                  "description": "The ID of the experiment containing the runs to restore.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "min_timestamp_millis",
+                  "description": "The minimum deletion timestamp in milliseconds since the UNIX epoch for restoring runs. Only runs deleted no\nearlier than this timestamp are restored.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "experiment_id",
+                  "description": "The ID of the experiment containing the runs to restore.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "min_timestamp_millis",
+                  "description": "The minimum deletion timestamp in milliseconds since the UNIX epoch for restoring runs. Only runs deleted no\nearlier than this timestamp are restored.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "RestoreRunsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "experiment_id",
+                "description": "The ID of the experiment containing the runs to restore.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "max_runs",
+                "description": "An optional positive integer indicating the maximum number of runs to restore. The maximum allowed value for\nmax_runs is 10000.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "min_timestamp_millis",
+                "description": "The minimum deletion timestamp in milliseconds since the UNIX epoch for restoring runs. Only runs deleted no\nearlier than this timestamp are restored.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "experiment_id",
+                "description": "The ID of the experiment containing the runs to restore.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "min_timestamp_millis",
+                "description": "The minimum deletion timestamp in milliseconds since the UNIX epoch for restoring runs. Only runs deleted no\nearlier than this timestamp are restored.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "SearchExperiments",
+            "description": "Searches for experiments that satisfy specified search criteria.",
+            "summary": "Search experiments.",
+            "path": "/api/2.0/mlflow/experiments/search",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "SearchExperiments",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "SearchExperimentsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "filter",
+                "description": "String representing a SQL filter condition (e.g. \"name ILIKE 'my-experiment%'\")",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "max_results",
+                "description": "Maximum number of experiments desired. Max threshold is 3000.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "order_by",
+                "description": "List of columns for ordering search results, which can include experiment name and last updated\ntimestamp with an optional \"DESC\" or \"ASC\" annotation, where \"ASC\" is the default.\nTiebreaks are done by experiment id DESC.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Token indicating the page of experiments to fetch",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "view_type",
+                "description": "Qualifier for type of experiments to be returned.\nIf unspecified, return only active experiments.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ViewType",
+                  "enum": [
+                    {
+                      "content": "ACTIVE_ONLY"
+                    },
+                    {
+                      "content": "ALL"
+                    },
+                    {
+                      "content": "DELETED_ONLY"
+                    }
+                  ]
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Token indicating the page of experiments to fetch",
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "SearchIssues",
+            "description": "Searches the issues in an experiment, filtered and sorted.",
+            "summary": "Search issues in an experiment.",
+            "path": "/api/2.0/mlflow/{parent=experiments/*}/issues:search",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "SearchIssuesRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "experiments/{experiment}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "experiments/{experiment}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "SearchIssuesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "categories",
+                "description": "Matches Issues with any of these categories, case-insensitively.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "Defaults to 20; values above 100 are clamped.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Expires after 15 minutes. Every other argument except `view` must match the\nrequest that returned the token.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "experiments/{experiment}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "query",
+                "description": "Case-insensitive substring match on title.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "severities",
+                "description": "Matches Issues with any of these severities.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "IssueSeverityList",
+                  "array_value": {
+                    "pascal_name": "IssueSeverity",
+                    "enum": [
+                      {
+                        "content": "HIGH"
+                      },
+                      {
+                        "content": "LOW"
+                      },
+                      {
+                        "content": "MEDIUM"
+                      }
+                    ]
+                  }
+                }
+              },
+              {
+                "name": "sort_key",
+                "description": "Defaults to SEVERITY.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "IssueSortKey",
+                  "enum": [
+                    {
+                      "content": "CREATE_TIME"
+                    },
+                    {
+                      "content": "LAST_SEEN_TIME"
+                    },
+                    {
+                      "content": "SEVERITY"
+                    },
+                    {
+                      "content": "UPDATE_TIME"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "sort_order",
+                "description": "Defaults to DESCENDING.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "SortOrder",
+                  "enum": [
+                    {
+                      "content": "ASCENDING"
+                    },
+                    {
+                      "content": "DESCENDING"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "statuses",
+                "description": "Matches Issues with any of these statuses. Different filters AND together,\nand an empty filter matches every Issue.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "IssueStatusList",
+                  "array_value": {
+                    "pascal_name": "IssueStatus",
+                    "enum": [
+                      {
+                        "content": "PENDING"
+                      },
+                      {
+                        "content": "REJECTED"
+                      },
+                      {
+                        "content": "RESOLVED"
+                      }
+                    ]
+                  }
+                }
+              },
+              {
+                "name": "tag_filters",
+                "description": "Matches Issues that satisfy every filter. At most 10 filters of 20 values\neach.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "IssueTagFilterList",
+                  "array_value": {
+                    "pascal_name": "IssueTagFilter",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "view",
+                "description": "Defaults to BASIC.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "IssueView",
+                  "enum": [
+                    {
+                      "content": "BASIC"
+                    },
+                    {
+                      "content": "FULL"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "experiments/{experiment}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Expires after 15 minutes. Every other argument except `view` must match the\nrequest that returned the token.",
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "SearchLoggedModels",
+            "description": "Search for Logged Models that satisfy specified search criteria.",
+            "summary": "Search logged models.",
+            "path": "/api/2.0/mlflow/logged-models/search",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "SearchLoggedModelsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "SearchLoggedModelsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "datasets",
+                "description": "List of datasets on which to apply the metrics filter clauses.\nFor example, a filter with `metrics.accuracy \u003e 0.9` and dataset info with name \"test_dataset\"\nmeans we will return all logged models with accuracy \u003e 0.9 on the test_dataset.\nMetric values from ANY dataset matching the criteria are considered.\nIf no datasets are specified, then metrics across all datasets are considered in the filter.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "SearchLoggedModelsDatasetList",
+                  "array_value": {
+                    "pascal_name": "SearchLoggedModelsDataset",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "experiment_ids",
+                "description": "The IDs of the experiments in which to search for logged models.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "filter",
+                "description": "A filter expression over logged model info and data that allows returning a subset of\nlogged models. The syntax is a subset of SQL that supports AND'ing together binary operations.\n\nExample: ``params.alpha \u003c 0.3 AND metrics.accuracy \u003e 0.9``.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "max_results",
+                "description": "The maximum number of Logged Models to return. The maximum limit is 50.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "order_by",
+                "description": "The list of columns for ordering the results, with additional fields for sorting criteria.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "SearchLoggedModelsOrderByList",
+                  "array_value": {
+                    "pascal_name": "SearchLoggedModelsOrderBy",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "The token indicating the page of logged models to fetch.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "SearchRuns",
+            "description": "Searches for runs that satisfy expressions.\n\nSearch expressions can use `mlflowMetric` and `mlflowParam` keys.",
+            "summary": "Search for runs.",
+            "path": "/api/2.0/mlflow/runs/search",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "SearchRuns",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "SearchRunsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "experiment_ids",
+                "description": "List of experiment IDs to search over.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "filter",
+                "description": "A filter expression over params, metrics, and tags, that allows returning a subset of\nruns. The syntax is a subset of SQL that supports ANDing together binary operations\nbetween a param, metric, or tag and a constant.\n\nExample: `metrics.rmse \u003c 1 and params.model_class = 'LogisticRegression'`\n\nYou can select columns with special characters (hyphen, space, period, etc.) by using double quotes:\n`metrics.\"model class\" = 'LinearRegression' and tags.\"user-name\" = 'Tomas'`\n\nSupported operators are `=`, `!=`, `\u003e`, `\u003e=`, `\u003c`, and `\u003c=`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "max_results",
+                "description": "Maximum number of runs desired. Max threshold is 50000",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "order_by",
+                "description": "List of columns to be ordered by, including attributes, params, metrics, and tags with an\noptional `\"DESC\"` or `\"ASC\"` annotation, where `\"ASC\"` is the default.\nExample: `[\"params.input DESC\", \"metrics.alpha ASC\", \"metrics.rmse\"]`.\nTiebreaks are done by start_time `DESC` followed by `run_id` for runs with the same start time\n(and this is the default ordering criterion if order_by is not provided).",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Token for the current page of runs.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "run_view_type",
+                "description": "Whether to display only active, only deleted, or all runs.\nDefaults to only active runs.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ViewType",
+                  "enum": [
+                    {
+                      "content": "ACTIVE_ONLY"
+                    },
+                    {
+                      "content": "ALL"
+                    },
+                    {
+                      "content": "DELETED_ONLY"
+                    }
+                  ]
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Token for the current page of runs.",
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "SetExperimentTag",
+            "description": "Sets a tag on an experiment. Experiment tags are metadata that can be updated.",
+            "summary": "Set a tag for an experiment.",
+            "path": "/api/2.0/mlflow/experiments/set-experiment-tag",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "SetExperimentTag",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "experiment_id",
+                  "description": "ID of the experiment under which to log the tag. Must be provided.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "key",
+                  "description": "Name of the tag. Keys up to 250 bytes in size are supported.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "value",
+                  "description": "String value of the tag being logged. Values up to 64KB in size are supported.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "experiment_id",
+                  "description": "ID of the experiment under which to log the tag. Must be provided.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "key",
+                  "description": "Name of the tag. Keys up to 250 bytes in size are supported.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "value",
+                  "description": "String value of the tag being logged. Values up to 64KB in size are supported.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "SetExperimentTagResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "experiment_id",
+                "description": "ID of the experiment under which to log the tag. Must be provided.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "key",
+                "description": "Name of the tag. Keys up to 250 bytes in size are supported.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "value",
+                "description": "String value of the tag being logged. Values up to 64KB in size are supported.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "experiment_id",
+                "description": "ID of the experiment under which to log the tag. Must be provided.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "key",
+                "description": "Name of the tag. Keys up to 250 bytes in size are supported.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "value",
+                "description": "String value of the tag being logged. Values up to 64KB in size are supported.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "SetLoggedModelTags",
+            "description": "Set tags for a logged model.",
+            "summary": "Set tags for a logged model.",
+            "path": "/api/2.0/mlflow/logged-models/{model_id}/tags",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "SetLoggedModelTagsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "model_id",
+                  "description": "The ID of the logged model to set the tags on.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "model_id",
+                  "description": "The ID of the logged model to set the tags on.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "SetLoggedModelTagsResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "model_id",
+                "description": "The ID of the logged model to set the tags on.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tags",
+                "description": "The tags to set on the logged model.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "LoggedModelTagList",
+                  "array_value": {
+                    "pascal_name": "LoggedModelTag",
+                    "is_object": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "model_id",
+                "description": "The ID of the logged model to set the tags on.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "SetPermissions",
+            "description": "Sets permissions on an object, replacing existing permissions if they exist. Deletes all direct permissions if none are specified. Objects can inherit permissions from their root object.",
+            "summary": "Set experiment permissions.",
+            "path": "/api/2.0/permissions/experiments/{experiment_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ExperimentPermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "experiment_id",
+                  "description": "The experiment for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "experiment_id",
+                  "description": "The experiment for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ExperimentPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "access_control_list",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ExperimentAccessControlRequestList",
+                  "array_value": {
+                    "pascal_name": "ExperimentAccessControlRequest",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "experiment_id",
+                "description": "The experiment for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "experiment_id",
+                "description": "The experiment for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "SetTag",
+            "description": "Sets a tag on a run. Tags are run metadata that can be updated during a run and after\na run completes.",
+            "summary": "Set a tag for a run.",
+            "path": "/api/2.0/mlflow/runs/set-tag",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "SetTag",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "key",
+                  "description": "Name of the tag. Keys up to 250 bytes in size are supported.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "value",
+                  "description": "String value of the tag being logged. Values up to 64KB in size are supported.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "key",
+                  "description": "Name of the tag. Keys up to 250 bytes in size are supported.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "value",
+                  "description": "String value of the tag being logged. Values up to 64KB in size are supported.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "SetTagResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "key",
+                "description": "Name of the tag. Keys up to 250 bytes in size are supported.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "run_id",
+                "description": "ID of the run under which to log the tag. Must be provided.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "run_uuid",
+                "description": "[Deprecated, use `run_id` instead] ID of the run under which to log the tag. This field will\nbe removed in a future MLflow version.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "value",
+                "description": "String value of the tag being logged. Values up to 64KB in size are supported.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "key",
+                "description": "Name of the tag. Keys up to 250 bytes in size are supported.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "value",
+                "description": "String value of the tag being logged. Values up to 64KB in size are supported.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateExperiment",
+            "description": "Updates experiment metadata.",
+            "summary": "Update an experiment.",
+            "path": "/api/2.0/mlflow/experiments/update",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateExperiment",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "experiment_id",
+                  "description": "ID of the associated experiment.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "experiment_id",
+                  "description": "ID of the associated experiment.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "UpdateExperimentResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "experiment_id",
+                "description": "ID of the associated experiment.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "new_name",
+                "description": "If provided, the experiment's name is changed to the new name. The new name must be unique.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "experiment_id",
+                "description": "ID of the associated experiment.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateIssue",
+            "description": "Updates the fields of an issue named in `update_mask`.",
+            "summary": "Update an issue.",
+            "path": "/api/2.0/mlflow/{name=experiments/*/issues/*}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "UpdateIssueRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "experiments/{experiment}/issues/{issue}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "issue",
+                  "description": "`issue.name` identifies the target.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Issue",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Accepts title, description, status, severity, categories, tags,\nlast_seen_time, and metadata.\u003ckey\u003e. A path with an empty value clears the\nfield, except that title, status, and severity can't be cleared, and\nlast_seen_time can be cleared only when source_type is MANUAL. categories\nand tags are replaced whole. metadata is updated per key: a metadata.\u003ckey\u003e\npath sets that key from issue.metadata, or removes it when issue.metadata\nlacks it, and leaves the other keys alone. A bare metadata path is rejected.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "experiments/{experiment}/issues/{issue}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Accepts title, description, status, severity, categories, tags,\nlast_seen_time, and metadata.\u003ckey\u003e. A path with an empty value clears the\nfield, except that title, status, and severity can't be cleared, and\nlast_seen_time can be cleared only when source_type is MANUAL. categories\nand tags are replaced whole. metadata is updated per key: a metadata.\u003ckey\u003e\npath sets that key from issue.metadata, or removes it when issue.metadata\nlacks it, and leaves the other keys alone. A bare metadata path is rejected.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "issue",
+                  "description": "`issue.name` identifies the target.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Issue",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "issue",
+              "description": "`issue.name` identifies the target.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Issue",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "title",
+                    "description": "Non-empty, at most 250 UTF-8 bytes.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "severity",
+                    "description": "Cannot be cleared: an Issue without a severity would match no severity filter.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "IssueSeverity",
+                      "enum": [
+                        {
+                          "content": "HIGH"
+                        },
+                        {
+                          "content": "LOW"
+                        },
+                        {
+                          "content": "MEDIUM"
+                        }
+                      ]
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "title",
+                    "description": "Non-empty, at most 250 UTF-8 bytes.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "severity",
+                    "description": "Cannot be cleared: an Issue without a severity would match no severity filter.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "IssueSeverity",
+                      "enum": [
+                        {
+                          "content": "HIGH"
+                        },
+                        {
+                          "content": "LOW"
+                        },
+                        {
+                          "content": "MEDIUM"
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "Issue",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "title",
+                  "description": "Non-empty, at most 250 UTF-8 bytes.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "severity",
+                  "description": "Cannot be cleared: an Issue without a severity would match no severity filter.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "IssueSeverity",
+                    "enum": [
+                      {
+                        "content": "HIGH"
+                      },
+                      {
+                        "content": "LOW"
+                      },
+                      {
+                        "content": "MEDIUM"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "title",
+                  "description": "Non-empty, at most 250 UTF-8 bytes.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "severity",
+                  "description": "Cannot be cleared: an Issue without a severity would match no severity filter.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "IssueSeverity",
+                    "enum": [
+                      {
+                        "content": "HIGH"
+                      },
+                      {
+                        "content": "LOW"
+                      },
+                      {
+                        "content": "MEDIUM"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "issue",
+                "description": "`issue.name` identifies the target.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Issue",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "title",
+                      "description": "Non-empty, at most 250 UTF-8 bytes.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "severity",
+                      "description": "Cannot be cleared: an Issue without a severity would match no severity filter.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "IssueSeverity",
+                        "enum": [
+                          {
+                            "content": "HIGH"
+                          },
+                          {
+                            "content": "LOW"
+                          },
+                          {
+                            "content": "MEDIUM"
+                          }
+                        ]
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "title",
+                      "description": "Non-empty, at most 250 UTF-8 bytes.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "severity",
+                      "description": "Cannot be cleared: an Issue without a severity would match no severity filter.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "IssueSeverity",
+                        "enum": [
+                          {
+                            "content": "HIGH"
+                          },
+                          {
+                            "content": "LOW"
+                          },
+                          {
+                            "content": "MEDIUM"
+                          }
+                        ]
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "name",
+                "description": "experiments/{experiment}/issues/{issue}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Accepts title, description, status, severity, categories, tags,\nlast_seen_time, and metadata.\u003ckey\u003e. A path with an empty value clears the\nfield, except that title, status, and severity can't be cleared, and\nlast_seen_time can be cleared only when source_type is MANUAL. categories\nand tags are replaced whole. metadata is updated per key: a metadata.\u003ckey\u003e\npath sets that key from issue.metadata, or removes it when issue.metadata\nlacks it, and leaves the other keys alone. A bare metadata path is rejected.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "categories",
+                "description": "At most 10 values of at most 64 UTF-8 bytes each, unique case-insensitively.\nLeading and trailing whitespace is trimmed.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "When the Issue was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "created_by",
+                "description": "The email of the user whose request created the Issue. source_type tells\nwhether issue detection created it.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "Markdown, at most 32 KiB.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "issue_id",
+                "description": "The last segment of `name`. Issue assessments on traces reference the Issue\nby this ID.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "last_seen_time",
+                "description": "The request time of the latest trace the Issue affects. Required, and can't\nbe cleared, unless source_type is MANUAL. A MANUAL Issue without one returns\nits create_time.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "last_updated_by",
+                "description": "The email of the user whose request last updated the Issue.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "metadata",
+                "description": "Additional details about the Issue, such as how issue detection observed it.\nNot a stable contract: keys and values can change without notice, so clients\nmust tolerate unknown and missing keys. At most 20 entries, with keys of at\nmost 64 UTF-8 bytes.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "name",
+                "description": "experiments/{experiment}/issues/{issue}",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "severity",
+                "description": "Cannot be cleared: an Issue without a severity would match no severity filter.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "IssueSeverity",
+                  "enum": [
+                    {
+                      "content": "HIGH"
+                    },
+                    {
+                      "content": "LOW"
+                    },
+                    {
+                      "content": "MEDIUM"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "source_id",
+                "description": "Set once at create. For ADHOC_RUN and SCHEDULED_RUN, the ID of the issue\ndetection run in the same experiment that created the Issue. Absent for\nMANUAL.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "source_type",
+                "description": "Set once at create. Defaults to MANUAL.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "IssueSourceType",
+                  "enum": [
+                    {
+                      "content": "ADHOC_RUN"
+                    },
+                    {
+                      "content": "MANUAL"
+                    },
+                    {
+                      "content": "SCHEDULED_RUN"
+                    },
+                    {
+                      "content": "SINGLE_TRACE_ANALYSIS"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "status",
+                "description": "Defaults to PENDING on create, and can't be cleared.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "IssueStatus",
+                  "enum": [
+                    {
+                      "content": "PENDING"
+                    },
+                    {
+                      "content": "REJECTED"
+                    },
+                    {
+                      "content": "RESOLVED"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "tags",
+                "description": "Caller-owned; the server never writes system values here. At most 10\nentries. Keys match ^[A-Za-z0-9_.:/-]+$ and are at most 128 UTF-8 bytes;\nvalues are at most 256 UTF-8 bytes.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "title",
+                "description": "Non-empty, at most 250 UTF-8 bytes.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "When the Issue was last updated.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "experiments/{experiment}/issues/{issue}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Accepts title, description, status, severity, categories, tags,\nlast_seen_time, and metadata.\u003ckey\u003e. A path with an empty value clears the\nfield, except that title, status, and severity can't be cleared, and\nlast_seen_time can be cleared only when source_type is MANUAL. categories\nand tags are replaced whole. metadata is updated per key: a metadata.\u003ckey\u003e\npath sets that key from issue.metadata, or removes it when issue.metadata\nlacks it, and leaves the other keys alone. A bare metadata path is rejected.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "title",
+                "description": "Non-empty, at most 250 UTF-8 bytes.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "severity",
+                "description": "Cannot be cleared: an Issue without a severity would match no severity filter.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "IssueSeverity",
+                  "enum": [
+                    {
+                      "content": "HIGH"
+                    },
+                    {
+                      "content": "LOW"
+                    },
+                    {
+                      "content": "MEDIUM"
+                    }
+                  ]
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdatePermissions",
+            "description": "Updates the permissions on an experiment. Experiments can inherit permissions from their root object.",
+            "summary": "Update experiment permissions.",
+            "path": "/api/2.0/permissions/experiments/{experiment_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ExperimentPermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "experiment_id",
+                  "description": "The experiment for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "experiment_id",
+                  "description": "The experiment for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ExperimentPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "access_control_list",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ExperimentAccessControlRequestList",
+                  "array_value": {
+                    "pascal_name": "ExperimentAccessControlRequest",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "experiment_id",
+                "description": "The experiment for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "experiment_id",
+                "description": "The experiment for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateRun",
+            "description": "Updates run metadata.",
+            "summary": "Update a run.",
+            "path": "/api/2.0/mlflow/runs/update",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateRun",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "UpdateRunResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "end_time",
+                "description": "Unix timestamp in milliseconds of when the run ended.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "run_id",
+                "description": "ID of the run to update. Must be provided.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "run_name",
+                "description": "Updated name of the run.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "run_uuid",
+                "description": "[Deprecated, use `run_id` instead] ID of the run to update. This field will\nbe removed in a future MLflow version.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "status",
+                "description": "Updated status of the run.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "UpdateRunStatus",
+                  "enum": [
+                    {
+                      "content": "FAILED"
+                    },
+                    {
+                      "content": "FINISHED"
+                    },
+                    {
+                      "content": "KILLED"
+                    },
+                    {
+                      "content": "RUNNING"
+                    },
+                    {
+                      "content": "SCHEDULED"
+                    }
+                  ]
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "catalog.ExternalLineage",
+        "name": "ExternalLineage",
+        "description": "External Lineage APIs enable defining and managing lineage relationships between Databricks objects and external systems. These APIs allow users to capture data flows connecting Databricks tables, models, and file paths with external metadata objects.\n\nWith these APIs, users can create, update, delete, and list lineage relationships with support for column-level mappings and custom properties.",
+        "package": {
+          "name": "catalog"
+        },
+        "docs_group": "catalog",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "list": {
+          "request": {
+            "pascal_name": "ListExternalLineageRelationshipsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "CreateExternalLineageRelationship",
+            "description": "Creates an external lineage relationship between a Databricks or external metadata object and another external metadata object.",
+            "summary": "Create an external lineage relationship.",
+            "path": "/api/2.0/lineage-tracking/external-lineage",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "CreateExternalLineageRelationshipRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "external_lineage_relationship",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CreateRequestExternalLineage",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "external_lineage_relationship",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CreateRequestExternalLineage",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "external_lineage_relationship",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "CreateRequestExternalLineage",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "source",
+                    "description": "Source object of the external lineage relationship.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "ExternalLineageObject",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "target",
+                    "description": "Target object of the external lineage relationship.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "ExternalLineageObject",
+                      "is_object": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "source",
+                    "description": "Source object of the external lineage relationship.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "ExternalLineageObject",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "target",
+                    "description": "Target object of the external lineage relationship.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "ExternalLineageObject",
+                      "is_object": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "ExternalLineageRelationship",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "source",
+                  "description": "Source object of the external lineage relationship.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ExternalLineageObject",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "target",
+                  "description": "Target object of the external lineage relationship.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ExternalLineageObject",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "source",
+                  "description": "Source object of the external lineage relationship.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ExternalLineageObject",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "target",
+                  "description": "Target object of the external lineage relationship.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ExternalLineageObject",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "external_lineage_relationship",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CreateRequestExternalLineage",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "source",
+                      "description": "Source object of the external lineage relationship.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "ExternalLineageObject",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "target",
+                      "description": "Target object of the external lineage relationship.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "ExternalLineageObject",
+                        "is_object": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "source",
+                      "description": "Source object of the external lineage relationship.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "ExternalLineageObject",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "target",
+                      "description": "Target object of the external lineage relationship.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "ExternalLineageObject",
+                        "is_object": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "columns",
+                "description": "List of column relationships between source and target objects.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ColumnRelationshipList",
+                  "array_value": {
+                    "pascal_name": "ColumnRelationship",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "id",
+                "description": "Unique identifier of the external lineage relationship.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "properties",
+                "description": "Key-value properties associated with the external lineage relationship.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "source",
+                "description": "Source object of the external lineage relationship.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ExternalLineageObject",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "target",
+                "description": "Target object of the external lineage relationship.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ExternalLineageObject",
+                  "is_object": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "source",
+                "description": "Source object of the external lineage relationship.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ExternalLineageObject",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "target",
+                "description": "Target object of the external lineage relationship.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ExternalLineageObject",
+                  "is_object": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteExternalLineageRelationship",
+            "description": "Deletes an external lineage relationship between a Databricks or external metadata object and another external metadata object.",
+            "summary": "Delete an external lineage relationship.",
+            "path": "/api/2.0/lineage-tracking/external-lineage",
+            "can_use_json": true,
+            "must_use_json": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "DeleteExternalLineageRelationshipRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "external_lineage_relationship",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "pascal_name": "DeleteRequestExternalLineage",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "external_lineage_relationship",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "pascal_name": "DeleteRequestExternalLineage",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "external_lineage_relationship",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "DeleteRequestExternalLineage",
+                  "is_object": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListExternalLineageRelationships",
+            "description": "Lists external lineage relationships of a Databricks object or external metadata given a supplied direction.",
+            "summary": "List external lineage relationships.",
+            "path": "/api/2.0/lineage-tracking/external-lineage",
+            "can_use_json": true,
+            "must_use_json": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "ListExternalLineageRelationshipsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "object_info",
+                  "description": "The object to query external lineage relationships for.\nSince this field is a query parameter, please flatten the nested fields. For example, if the object is a table, the query parameter should look like:\n`object_info.table.name=main.sales.customers`",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "pascal_name": "ExternalLineageObject",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "lineage_direction",
+                  "description": "The lineage direction to filter on.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "pascal_name": "LineageDirection",
+                    "enum": [
+                      {
+                        "content": "DOWNSTREAM"
+                      },
+                      {
+                        "content": "UPSTREAM"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "object_info",
+                  "description": "The object to query external lineage relationships for.\nSince this field is a query parameter, please flatten the nested fields. For example, if the object is a table, the query parameter should look like:\n`object_info.table.name=main.sales.customers`",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "pascal_name": "ExternalLineageObject",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "lineage_direction",
+                  "description": "The lineage direction to filter on.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "pascal_name": "LineageDirection",
+                    "enum": [
+                      {
+                        "content": "DOWNSTREAM"
+                      },
+                      {
+                        "content": "UPSTREAM"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListExternalLineageRelationshipsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "lineage_direction",
+                "description": "The lineage direction to filter on.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "LineageDirection",
+                  "enum": [
+                    {
+                      "content": "DOWNSTREAM"
+                    },
+                    {
+                      "content": "UPSTREAM"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "object_info",
+                "description": "The object to query external lineage relationships for.\nSince this field is a query parameter, please flatten the nested fields. For example, if the object is a table, the query parameter should look like:\n`object_info.table.name=main.sales.customers`",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "ExternalLineageObject",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "Specifies the maximum number of external lineage relationships to return in a single response.\nThe value must be less than or equal to 1000.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque pagination token to go to next page based on previous query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Opaque pagination token to go to next page based on previous query.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "UpdateExternalLineageRelationship",
+            "description": "Updates an external lineage relationship between a Databricks or external metadata object and another external metadata object.",
+            "summary": "Update an external lineage relationship.",
+            "path": "/api/2.0/lineage-tracking/external-lineage",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "UpdateExternalLineageRelationshipRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "external_lineage_relationship",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "UpdateRequestExternalLineage",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "update_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "external_lineage_relationship",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "UpdateRequestExternalLineage",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "external_lineage_relationship",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "UpdateRequestExternalLineage",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "source",
+                    "description": "Source object of the external lineage relationship.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "ExternalLineageObject",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "target",
+                    "description": "Target object of the external lineage relationship.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "ExternalLineageObject",
+                      "is_object": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "source",
+                    "description": "Source object of the external lineage relationship.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "ExternalLineageObject",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "target",
+                    "description": "Target object of the external lineage relationship.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "ExternalLineageObject",
+                      "is_object": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "ExternalLineageRelationship",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "source",
+                  "description": "Source object of the external lineage relationship.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ExternalLineageObject",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "target",
+                  "description": "Target object of the external lineage relationship.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ExternalLineageObject",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "source",
+                  "description": "Source object of the external lineage relationship.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ExternalLineageObject",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "target",
+                  "description": "Target object of the external lineage relationship.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ExternalLineageObject",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "external_lineage_relationship",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "UpdateRequestExternalLineage",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "source",
+                      "description": "Source object of the external lineage relationship.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "ExternalLineageObject",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "target",
+                      "description": "Target object of the external lineage relationship.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "ExternalLineageObject",
+                        "is_object": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "source",
+                      "description": "Source object of the external lineage relationship.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "ExternalLineageObject",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "target",
+                      "description": "Target object of the external lineage relationship.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "ExternalLineageObject",
+                        "is_object": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "columns",
+                "description": "List of column relationships between source and target objects.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ColumnRelationshipList",
+                  "array_value": {
+                    "pascal_name": "ColumnRelationship",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "id",
+                "description": "Unique identifier of the external lineage relationship.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "properties",
+                "description": "Key-value properties associated with the external lineage relationship.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "source",
+                "description": "Source object of the external lineage relationship.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ExternalLineageObject",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "target",
+                "description": "Target object of the external lineage relationship.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ExternalLineageObject",
+                  "is_object": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "update_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "source",
+                "description": "Source object of the external lineage relationship.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ExternalLineageObject",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "target",
+                "description": "Target object of the external lineage relationship.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ExternalLineageObject",
+                  "is_object": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "catalog.ExternalLocations",
+        "name": "ExternalLocations",
+        "description": "An external location is an object that combines a cloud storage path with a storage\ncredential that authorizes access to the cloud storage path. Each external location is\nsubject to Unity Catalog access-control policies that control which users and groups can\naccess the credential. If a user does not have access to an external location in Unity\nCatalog, the request fails and Unity Catalog does not attempt to authenticate to your cloud\ntenant on the user’s behalf.\n\nDatabricks recommends using external locations rather than using storage credentials\ndirectly.\n\nTo create external locations, you must be a metastore admin or a user with the\n**CREATE_EXTERNAL_LOCATION** privilege.",
+        "package": {
+          "name": "catalog"
+        },
+        "docs_group": "catalog",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListExternalLocationsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a new external location entry in the metastore.\nThe caller must be a metastore admin or have the **CREATE_EXTERNAL_LOCATION** privilege on both the metastore and the associated storage credential.",
+            "summary": "Create an external location.",
+            "path": "/api/2.1/unity-catalog/external-locations",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateExternalLocation",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the external location.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "url",
+                  "description": "Path URL of the external location.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "credential_name",
+                  "description": "Name of the storage credential used with this location.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the external location.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "url",
+                  "description": "Path URL of the external location.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "credential_name",
+                  "description": "Name of the storage credential used with this location.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ExternalLocationInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "comment",
+                "description": "User-provided free-form text description.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "credential_name",
+                "description": "Name of the storage credential used with this location.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_enable_file_events",
+                "description": "The effective value of `enable_file_events` after applying server-side defaults.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "effective_file_event_queue",
+                "description": "The effective file event queue configuration after applying server-side defaults.\nAlways populated when a queue is provisioned, regardless of whether the user explicitly\nset `enable_file_events`. Use this field instead of `file_event_queue` for reading\nthe actual queue state.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "FileEventQueue",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "enable_file_events",
+                "description": "Whether to enable file events on this external location. Default to `true`. Set to `false` to disable file events.\nThe actual applied value may differ due to server-side defaults; check `effective_enable_file_events` for the effective state.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "encryption_details",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "EncryptionDetails",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "fallback",
+                "description": "Indicates whether fallback mode is enabled for this external location. When fallback mode is enabled, the access to the location falls back to cluster credentials if UC credentials are not sufficient.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "file_event_queue",
+                "description": "File event queue settings. If `enable_file_events` is not `false`, must be defined and have exactly one of the documented properties.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "FileEventQueue",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the external location.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "read_only",
+                "description": "Indicates whether the external location is read-only.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "skip_validation",
+                "description": "Skips validation of the storage credential associated with the external location.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "url",
+                "description": "Path URL of the external location.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the external location.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "url",
+                "description": "Path URL of the external location.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "credential_name",
+                "description": "Name of the storage credential used with this location.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes the specified external location from the metastore. The caller must be the owner of the external location.",
+            "summary": "Delete an external location.",
+            "path": "/api/2.1/unity-catalog/external-locations/{name}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteExternalLocationRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the external location.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the external location.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "force",
+                "description": "Force deletion even if there are dependent external tables or mounts.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the external location.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the external location.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets an external location from the metastore.\nThe caller must be either a metastore admin, the owner of the external location, or a user that has some privilege on the external location.",
+            "summary": "Get an external location.",
+            "path": "/api/2.1/unity-catalog/external-locations/{name}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetExternalLocationRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the external location.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the external location.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ExternalLocationInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "include_browse",
+                "description": "Whether to include external locations in the response for which the principal can only access selective metadata for",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the external location.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the external location.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Gets an array of external locations (__ExternalLocationInfo__ objects) from the metastore.\nThe caller must be a metastore admin, the owner of the external location, or a user that has some privilege on the external location.\nThere is no guarantee of a specific ordering of the elements in the array.\n\nNOTE: we recommend using max_results=0 to use the paginated version of this API. Unpaginated calls will be deprecated soon.\n\nPAGINATION BEHAVIOR: When using pagination (max_results \u003e= 0), a page may contain zero results while still providing a next_page_token.\nClients must continue reading pages until next_page_token is absent, which is the only indication that the end of results has been reached.",
+            "summary": "List external locations.",
+            "path": "/api/2.1/unity-catalog/external-locations",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListExternalLocationsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListExternalLocationsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "include_browse",
+                "description": "Whether to include external locations in the response for which the principal can only access selective metadata for",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "include_unbound",
+                "description": "Whether to include external locations not bound to the workspace.\nEffective only if the user has permission to update the location–workspace binding.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "max_results",
+                "description": "Maximum number of external locations to return.\nIf not set, all the external locations are returned (not recommended).\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- when set to 0, the page length is set to a server configured value (recommended);\n- when set to a value less than 0, an invalid parameter error is returned;",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque pagination token to go to next page based on previous query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Opaque pagination token to go to next page based on previous query.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              },
+              "max_results": {
+                "name": "max_results",
+                "description": "Maximum number of external locations to return.\nIf not set, all the external locations are returned (not recommended).\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- when set to 0, the page length is set to a server configured value (recommended);\n- when set to a value less than 0, an invalid parameter error is returned;",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              }
+            }
+          },
+          {
+            "name": "Update",
+            "description": "Updates an external location in the metastore. The caller must be the owner of the external location, or be a metastore admin.\nIn the second case, the admin can only update the name of the external location.",
+            "summary": "Update an external location.",
+            "path": "/api/2.1/unity-catalog/external-locations/{name}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateExternalLocation",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the external location.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the external location.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ExternalLocationInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "comment",
+                "description": "User-provided free-form text description.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "credential_name",
+                "description": "Name of the storage credential used with this location.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_enable_file_events",
+                "description": "The effective value of `enable_file_events` after applying server-side defaults.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "effective_file_event_queue",
+                "description": "The effective file event queue configuration after applying server-side defaults.\nAlways populated when a queue is provisioned, regardless of whether the user explicitly\nset `enable_file_events`. Use this field instead of `file_event_queue` for reading\nthe actual queue state.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "FileEventQueue",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "enable_file_events",
+                "description": "Whether to enable file events on this external location. Default to `true`. Set to `false` to disable file events.\nThe actual applied value may differ due to server-side defaults; check `effective_enable_file_events` for the effective state.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "encryption_details",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "EncryptionDetails",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "fallback",
+                "description": "Indicates whether fallback mode is enabled for this external location. When fallback mode is enabled, the access to the location falls back to cluster credentials if UC credentials are not sufficient.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "file_event_queue",
+                "description": "File event queue settings. If `enable_file_events` is not `false`, must be defined and have exactly one of the documented properties.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "FileEventQueue",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "force",
+                "description": "Force update even if changing url invalidates dependent external tables or mounts.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "isolation_mode",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "IsolationMode",
+                  "enum": [
+                    {
+                      "content": "ISOLATION_MODE_ISOLATED"
+                    },
+                    {
+                      "content": "ISOLATION_MODE_OPEN"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the external location.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "new_name",
+                "description": "New name for the external location.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "owner",
+                "description": "The owner of the external location.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "read_only",
+                "description": "Indicates whether the external location is read-only.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "skip_validation",
+                "description": "Skips validation of the storage credential associated with the external location.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "url",
+                "description": "Path URL of the external location.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the external location.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "catalog.ExternalMetadata",
+        "name": "ExternalMetadata",
+        "description": "External Metadata objects enable customers to register and manage metadata about external systems within Unity Catalog.\n\nThese APIs provide a standardized way to create, update, retrieve, list, and delete external metadata objects. Fine-grained authorization ensures that only users with appropriate permissions can view and manage external metadata objects.",
+        "package": {
+          "name": "catalog"
+        },
+        "docs_group": "catalog",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "list": {
+          "request": {
+            "pascal_name": "ListExternalMetadataRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "CreateExternalMetadata",
+            "description": "Creates a new external metadata object in the parent metastore if the caller is a metastore admin or has the **CREATE_EXTERNAL_METADATA** privilege.\nGrants **BROWSE** to all account users upon creation by default.",
+            "summary": "Create an external metadata object.",
+            "path": "/api/2.0/lineage-tracking/external-metadata",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "CreateExternalMetadataRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "external_metadata",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ExternalMetadata",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "external_metadata",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ExternalMetadata",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "external_metadata",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "ExternalMetadata",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "name",
+                    "description": "Name of the external metadata object.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "system_type",
+                    "description": "Type of external system.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "SystemType",
+                      "enum": [
+                        {
+                          "content": "AMAZON_REDSHIFT"
+                        },
+                        {
+                          "content": "AZURE_SYNAPSE"
+                        },
+                        {
+                          "content": "CONFLUENT"
+                        },
+                        {
+                          "content": "DATABRICKS"
+                        },
+                        {
+                          "content": "GOOGLE_BIGQUERY"
+                        },
+                        {
+                          "content": "KAFKA"
+                        },
+                        {
+                          "content": "LOOKER"
+                        },
+                        {
+                          "content": "MICROSOFT_FABRIC"
+                        },
+                        {
+                          "content": "MICROSOFT_SQL_SERVER"
+                        },
+                        {
+                          "content": "MONGODB"
+                        },
+                        {
+                          "content": "MYSQL"
+                        },
+                        {
+                          "content": "ORACLE"
+                        },
+                        {
+                          "content": "OTHER"
+                        },
+                        {
+                          "content": "POSTGRESQL"
+                        },
+                        {
+                          "content": "POWER_BI"
+                        },
+                        {
+                          "content": "SALESFORCE"
+                        },
+                        {
+                          "content": "SAP"
+                        },
+                        {
+                          "content": "SERVICENOW"
+                        },
+                        {
+                          "content": "SNOWFLAKE"
+                        },
+                        {
+                          "content": "STREAM_NATIVE"
+                        },
+                        {
+                          "content": "TABLEAU"
+                        },
+                        {
+                          "content": "TERADATA"
+                        },
+                        {
+                          "content": "WORKDAY"
+                        }
+                      ]
+                    }
+                  },
+                  {
+                    "name": "entity_type",
+                    "description": "Type of entity within the external system.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "name",
+                    "description": "Name of the external metadata object.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "system_type",
+                    "description": "Type of external system.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "SystemType",
+                      "enum": [
+                        {
+                          "content": "AMAZON_REDSHIFT"
+                        },
+                        {
+                          "content": "AZURE_SYNAPSE"
+                        },
+                        {
+                          "content": "CONFLUENT"
+                        },
+                        {
+                          "content": "DATABRICKS"
+                        },
+                        {
+                          "content": "GOOGLE_BIGQUERY"
+                        },
+                        {
+                          "content": "KAFKA"
+                        },
+                        {
+                          "content": "LOOKER"
+                        },
+                        {
+                          "content": "MICROSOFT_FABRIC"
+                        },
+                        {
+                          "content": "MICROSOFT_SQL_SERVER"
+                        },
+                        {
+                          "content": "MONGODB"
+                        },
+                        {
+                          "content": "MYSQL"
+                        },
+                        {
+                          "content": "ORACLE"
+                        },
+                        {
+                          "content": "OTHER"
+                        },
+                        {
+                          "content": "POSTGRESQL"
+                        },
+                        {
+                          "content": "POWER_BI"
+                        },
+                        {
+                          "content": "SALESFORCE"
+                        },
+                        {
+                          "content": "SAP"
+                        },
+                        {
+                          "content": "SERVICENOW"
+                        },
+                        {
+                          "content": "SNOWFLAKE"
+                        },
+                        {
+                          "content": "STREAM_NATIVE"
+                        },
+                        {
+                          "content": "TABLEAU"
+                        },
+                        {
+                          "content": "TERADATA"
+                        },
+                        {
+                          "content": "WORKDAY"
+                        }
+                      ]
+                    }
+                  },
+                  {
+                    "name": "entity_type",
+                    "description": "Type of entity within the external system.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "ExternalMetadata",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the external metadata object.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "system_type",
+                  "description": "Type of external system.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "SystemType",
+                    "enum": [
+                      {
+                        "content": "AMAZON_REDSHIFT"
+                      },
+                      {
+                        "content": "AZURE_SYNAPSE"
+                      },
+                      {
+                        "content": "CONFLUENT"
+                      },
+                      {
+                        "content": "DATABRICKS"
+                      },
+                      {
+                        "content": "GOOGLE_BIGQUERY"
+                      },
+                      {
+                        "content": "KAFKA"
+                      },
+                      {
+                        "content": "LOOKER"
+                      },
+                      {
+                        "content": "MICROSOFT_FABRIC"
+                      },
+                      {
+                        "content": "MICROSOFT_SQL_SERVER"
+                      },
+                      {
+                        "content": "MONGODB"
+                      },
+                      {
+                        "content": "MYSQL"
+                      },
+                      {
+                        "content": "ORACLE"
+                      },
+                      {
+                        "content": "OTHER"
+                      },
+                      {
+                        "content": "POSTGRESQL"
+                      },
+                      {
+                        "content": "POWER_BI"
+                      },
+                      {
+                        "content": "SALESFORCE"
+                      },
+                      {
+                        "content": "SAP"
+                      },
+                      {
+                        "content": "SERVICENOW"
+                      },
+                      {
+                        "content": "SNOWFLAKE"
+                      },
+                      {
+                        "content": "STREAM_NATIVE"
+                      },
+                      {
+                        "content": "TABLEAU"
+                      },
+                      {
+                        "content": "TERADATA"
+                      },
+                      {
+                        "content": "WORKDAY"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "entity_type",
+                  "description": "Type of entity within the external system.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the external metadata object.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "system_type",
+                  "description": "Type of external system.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "SystemType",
+                    "enum": [
+                      {
+                        "content": "AMAZON_REDSHIFT"
+                      },
+                      {
+                        "content": "AZURE_SYNAPSE"
+                      },
+                      {
+                        "content": "CONFLUENT"
+                      },
+                      {
+                        "content": "DATABRICKS"
+                      },
+                      {
+                        "content": "GOOGLE_BIGQUERY"
+                      },
+                      {
+                        "content": "KAFKA"
+                      },
+                      {
+                        "content": "LOOKER"
+                      },
+                      {
+                        "content": "MICROSOFT_FABRIC"
+                      },
+                      {
+                        "content": "MICROSOFT_SQL_SERVER"
+                      },
+                      {
+                        "content": "MONGODB"
+                      },
+                      {
+                        "content": "MYSQL"
+                      },
+                      {
+                        "content": "ORACLE"
+                      },
+                      {
+                        "content": "OTHER"
+                      },
+                      {
+                        "content": "POSTGRESQL"
+                      },
+                      {
+                        "content": "POWER_BI"
+                      },
+                      {
+                        "content": "SALESFORCE"
+                      },
+                      {
+                        "content": "SAP"
+                      },
+                      {
+                        "content": "SERVICENOW"
+                      },
+                      {
+                        "content": "SNOWFLAKE"
+                      },
+                      {
+                        "content": "STREAM_NATIVE"
+                      },
+                      {
+                        "content": "TABLEAU"
+                      },
+                      {
+                        "content": "TERADATA"
+                      },
+                      {
+                        "content": "WORKDAY"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "entity_type",
+                  "description": "Type of entity within the external system.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "external_metadata",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ExternalMetadata",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "name",
+                      "description": "Name of the external metadata object.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "system_type",
+                      "description": "Type of external system.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "SystemType",
+                        "enum": [
+                          {
+                            "content": "AMAZON_REDSHIFT"
+                          },
+                          {
+                            "content": "AZURE_SYNAPSE"
+                          },
+                          {
+                            "content": "CONFLUENT"
+                          },
+                          {
+                            "content": "DATABRICKS"
+                          },
+                          {
+                            "content": "GOOGLE_BIGQUERY"
+                          },
+                          {
+                            "content": "KAFKA"
+                          },
+                          {
+                            "content": "LOOKER"
+                          },
+                          {
+                            "content": "MICROSOFT_FABRIC"
+                          },
+                          {
+                            "content": "MICROSOFT_SQL_SERVER"
+                          },
+                          {
+                            "content": "MONGODB"
+                          },
+                          {
+                            "content": "MYSQL"
+                          },
+                          {
+                            "content": "ORACLE"
+                          },
+                          {
+                            "content": "OTHER"
+                          },
+                          {
+                            "content": "POSTGRESQL"
+                          },
+                          {
+                            "content": "POWER_BI"
+                          },
+                          {
+                            "content": "SALESFORCE"
+                          },
+                          {
+                            "content": "SAP"
+                          },
+                          {
+                            "content": "SERVICENOW"
+                          },
+                          {
+                            "content": "SNOWFLAKE"
+                          },
+                          {
+                            "content": "STREAM_NATIVE"
+                          },
+                          {
+                            "content": "TABLEAU"
+                          },
+                          {
+                            "content": "TERADATA"
+                          },
+                          {
+                            "content": "WORKDAY"
+                          }
+                        ]
+                      }
+                    },
+                    {
+                      "name": "entity_type",
+                      "description": "Type of entity within the external system.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "name",
+                      "description": "Name of the external metadata object.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "system_type",
+                      "description": "Type of external system.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "SystemType",
+                        "enum": [
+                          {
+                            "content": "AMAZON_REDSHIFT"
+                          },
+                          {
+                            "content": "AZURE_SYNAPSE"
+                          },
+                          {
+                            "content": "CONFLUENT"
+                          },
+                          {
+                            "content": "DATABRICKS"
+                          },
+                          {
+                            "content": "GOOGLE_BIGQUERY"
+                          },
+                          {
+                            "content": "KAFKA"
+                          },
+                          {
+                            "content": "LOOKER"
+                          },
+                          {
+                            "content": "MICROSOFT_FABRIC"
+                          },
+                          {
+                            "content": "MICROSOFT_SQL_SERVER"
+                          },
+                          {
+                            "content": "MONGODB"
+                          },
+                          {
+                            "content": "MYSQL"
+                          },
+                          {
+                            "content": "ORACLE"
+                          },
+                          {
+                            "content": "OTHER"
+                          },
+                          {
+                            "content": "POSTGRESQL"
+                          },
+                          {
+                            "content": "POWER_BI"
+                          },
+                          {
+                            "content": "SALESFORCE"
+                          },
+                          {
+                            "content": "SAP"
+                          },
+                          {
+                            "content": "SERVICENOW"
+                          },
+                          {
+                            "content": "SNOWFLAKE"
+                          },
+                          {
+                            "content": "STREAM_NATIVE"
+                          },
+                          {
+                            "content": "TABLEAU"
+                          },
+                          {
+                            "content": "TERADATA"
+                          },
+                          {
+                            "content": "WORKDAY"
+                          }
+                        ]
+                      }
+                    },
+                    {
+                      "name": "entity_type",
+                      "description": "Type of entity within the external system.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "columns",
+                "description": "List of columns associated with the external metadata object.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Time at which this external metadata object was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "created_by",
+                "description": "Username of external metadata object creator.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "User-provided free-form text description.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "entity_type",
+                "description": "Type of entity within the external system.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "id",
+                "description": "Unique identifier of the external metadata object.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "metastore_id",
+                "description": "Unique identifier of parent metastore.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the external metadata object.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "owner",
+                "description": "Owner of the external metadata object.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "properties",
+                "description": "A map of key-value properties attached to the external metadata object.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "system_type",
+                "description": "Type of external system.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "SystemType",
+                  "enum": [
+                    {
+                      "content": "AMAZON_REDSHIFT"
+                    },
+                    {
+                      "content": "AZURE_SYNAPSE"
+                    },
+                    {
+                      "content": "CONFLUENT"
+                    },
+                    {
+                      "content": "DATABRICKS"
+                    },
+                    {
+                      "content": "GOOGLE_BIGQUERY"
+                    },
+                    {
+                      "content": "KAFKA"
+                    },
+                    {
+                      "content": "LOOKER"
+                    },
+                    {
+                      "content": "MICROSOFT_FABRIC"
+                    },
+                    {
+                      "content": "MICROSOFT_SQL_SERVER"
+                    },
+                    {
+                      "content": "MONGODB"
+                    },
+                    {
+                      "content": "MYSQL"
+                    },
+                    {
+                      "content": "ORACLE"
+                    },
+                    {
+                      "content": "OTHER"
+                    },
+                    {
+                      "content": "POSTGRESQL"
+                    },
+                    {
+                      "content": "POWER_BI"
+                    },
+                    {
+                      "content": "SALESFORCE"
+                    },
+                    {
+                      "content": "SAP"
+                    },
+                    {
+                      "content": "SERVICENOW"
+                    },
+                    {
+                      "content": "SNOWFLAKE"
+                    },
+                    {
+                      "content": "STREAM_NATIVE"
+                    },
+                    {
+                      "content": "TABLEAU"
+                    },
+                    {
+                      "content": "TERADATA"
+                    },
+                    {
+                      "content": "WORKDAY"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "Time at which this external metadata object was last modified.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "updated_by",
+                "description": "Username of user who last modified external metadata object.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "url",
+                "description": "URL associated with the external metadata object.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the external metadata object.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "system_type",
+                "description": "Type of external system.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "SystemType",
+                  "enum": [
+                    {
+                      "content": "AMAZON_REDSHIFT"
+                    },
+                    {
+                      "content": "AZURE_SYNAPSE"
+                    },
+                    {
+                      "content": "CONFLUENT"
+                    },
+                    {
+                      "content": "DATABRICKS"
+                    },
+                    {
+                      "content": "GOOGLE_BIGQUERY"
+                    },
+                    {
+                      "content": "KAFKA"
+                    },
+                    {
+                      "content": "LOOKER"
+                    },
+                    {
+                      "content": "MICROSOFT_FABRIC"
+                    },
+                    {
+                      "content": "MICROSOFT_SQL_SERVER"
+                    },
+                    {
+                      "content": "MONGODB"
+                    },
+                    {
+                      "content": "MYSQL"
+                    },
+                    {
+                      "content": "ORACLE"
+                    },
+                    {
+                      "content": "OTHER"
+                    },
+                    {
+                      "content": "POSTGRESQL"
+                    },
+                    {
+                      "content": "POWER_BI"
+                    },
+                    {
+                      "content": "SALESFORCE"
+                    },
+                    {
+                      "content": "SAP"
+                    },
+                    {
+                      "content": "SERVICENOW"
+                    },
+                    {
+                      "content": "SNOWFLAKE"
+                    },
+                    {
+                      "content": "STREAM_NATIVE"
+                    },
+                    {
+                      "content": "TABLEAU"
+                    },
+                    {
+                      "content": "TERADATA"
+                    },
+                    {
+                      "content": "WORKDAY"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "entity_type",
+                "description": "Type of entity within the external system.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteExternalMetadata",
+            "description": "Deletes the external metadata object that matches the supplied name.\nThe caller must be a metastore admin, the owner of the external metadata object, or a user that has the **MANAGE** privilege.",
+            "summary": "Delete an external metadata object.",
+            "path": "/api/2.0/lineage-tracking/external-metadata/{name}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "DeleteExternalMetadataRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetExternalMetadata",
+            "description": "Gets the specified external metadata object in a metastore.\nThe caller must be a metastore admin, the owner of the external metadata object, or a user that has the **BROWSE** privilege.",
+            "summary": "Get an external metadata object.",
+            "path": "/api/2.0/lineage-tracking/external-metadata/{name}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetExternalMetadataRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ExternalMetadata",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the external metadata object.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "system_type",
+                  "description": "Type of external system.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "SystemType",
+                    "enum": [
+                      {
+                        "content": "AMAZON_REDSHIFT"
+                      },
+                      {
+                        "content": "AZURE_SYNAPSE"
+                      },
+                      {
+                        "content": "CONFLUENT"
+                      },
+                      {
+                        "content": "DATABRICKS"
+                      },
+                      {
+                        "content": "GOOGLE_BIGQUERY"
+                      },
+                      {
+                        "content": "KAFKA"
+                      },
+                      {
+                        "content": "LOOKER"
+                      },
+                      {
+                        "content": "MICROSOFT_FABRIC"
+                      },
+                      {
+                        "content": "MICROSOFT_SQL_SERVER"
+                      },
+                      {
+                        "content": "MONGODB"
+                      },
+                      {
+                        "content": "MYSQL"
+                      },
+                      {
+                        "content": "ORACLE"
+                      },
+                      {
+                        "content": "OTHER"
+                      },
+                      {
+                        "content": "POSTGRESQL"
+                      },
+                      {
+                        "content": "POWER_BI"
+                      },
+                      {
+                        "content": "SALESFORCE"
+                      },
+                      {
+                        "content": "SAP"
+                      },
+                      {
+                        "content": "SERVICENOW"
+                      },
+                      {
+                        "content": "SNOWFLAKE"
+                      },
+                      {
+                        "content": "STREAM_NATIVE"
+                      },
+                      {
+                        "content": "TABLEAU"
+                      },
+                      {
+                        "content": "TERADATA"
+                      },
+                      {
+                        "content": "WORKDAY"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "entity_type",
+                  "description": "Type of entity within the external system.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the external metadata object.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "system_type",
+                  "description": "Type of external system.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "SystemType",
+                    "enum": [
+                      {
+                        "content": "AMAZON_REDSHIFT"
+                      },
+                      {
+                        "content": "AZURE_SYNAPSE"
+                      },
+                      {
+                        "content": "CONFLUENT"
+                      },
+                      {
+                        "content": "DATABRICKS"
+                      },
+                      {
+                        "content": "GOOGLE_BIGQUERY"
+                      },
+                      {
+                        "content": "KAFKA"
+                      },
+                      {
+                        "content": "LOOKER"
+                      },
+                      {
+                        "content": "MICROSOFT_FABRIC"
+                      },
+                      {
+                        "content": "MICROSOFT_SQL_SERVER"
+                      },
+                      {
+                        "content": "MONGODB"
+                      },
+                      {
+                        "content": "MYSQL"
+                      },
+                      {
+                        "content": "ORACLE"
+                      },
+                      {
+                        "content": "OTHER"
+                      },
+                      {
+                        "content": "POSTGRESQL"
+                      },
+                      {
+                        "content": "POWER_BI"
+                      },
+                      {
+                        "content": "SALESFORCE"
+                      },
+                      {
+                        "content": "SAP"
+                      },
+                      {
+                        "content": "SERVICENOW"
+                      },
+                      {
+                        "content": "SNOWFLAKE"
+                      },
+                      {
+                        "content": "STREAM_NATIVE"
+                      },
+                      {
+                        "content": "TABLEAU"
+                      },
+                      {
+                        "content": "TERADATA"
+                      },
+                      {
+                        "content": "WORKDAY"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "entity_type",
+                  "description": "Type of entity within the external system.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListExternalMetadata",
+            "description": "Gets an array of external metadata objects in the metastore.\nIf the caller is the metastore admin, all external metadata objects will be retrieved.\nOtherwise, only external metadata objects that the caller has **BROWSE** on will be retrieved.\nThere is no guarantee of a specific ordering of the elements in the array.",
+            "summary": "List external metadata objects.",
+            "path": "/api/2.0/lineage-tracking/external-metadata",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "ListExternalMetadataRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListExternalMetadataResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "Specifies the maximum number of external metadata objects to return in a single response.\nThe value must be less than or equal to 1000.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque pagination token to go to next page based on previous query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Opaque pagination token to go to next page based on previous query.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "UpdateExternalMetadata",
+            "description": "Updates the external metadata object that matches the supplied name. The caller can only update either the owner or other metadata fields in one request.\nThe caller must be a metastore admin, the owner of the external metadata object, or a user that has the **MODIFY** privilege.\nIf the caller is updating the owner, they must also have the **MANAGE** privilege.",
+            "summary": "Update an external metadata object.",
+            "path": "/api/2.0/lineage-tracking/external-metadata/{name}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "UpdateExternalMetadataRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the external metadata object.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "external_metadata",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ExternalMetadata",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the external metadata object.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "external_metadata",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ExternalMetadata",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "external_metadata",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "ExternalMetadata",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "name",
+                    "description": "Name of the external metadata object.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "system_type",
+                    "description": "Type of external system.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "SystemType",
+                      "enum": [
+                        {
+                          "content": "AMAZON_REDSHIFT"
+                        },
+                        {
+                          "content": "AZURE_SYNAPSE"
+                        },
+                        {
+                          "content": "CONFLUENT"
+                        },
+                        {
+                          "content": "DATABRICKS"
+                        },
+                        {
+                          "content": "GOOGLE_BIGQUERY"
+                        },
+                        {
+                          "content": "KAFKA"
+                        },
+                        {
+                          "content": "LOOKER"
+                        },
+                        {
+                          "content": "MICROSOFT_FABRIC"
+                        },
+                        {
+                          "content": "MICROSOFT_SQL_SERVER"
+                        },
+                        {
+                          "content": "MONGODB"
+                        },
+                        {
+                          "content": "MYSQL"
+                        },
+                        {
+                          "content": "ORACLE"
+                        },
+                        {
+                          "content": "OTHER"
+                        },
+                        {
+                          "content": "POSTGRESQL"
+                        },
+                        {
+                          "content": "POWER_BI"
+                        },
+                        {
+                          "content": "SALESFORCE"
+                        },
+                        {
+                          "content": "SAP"
+                        },
+                        {
+                          "content": "SERVICENOW"
+                        },
+                        {
+                          "content": "SNOWFLAKE"
+                        },
+                        {
+                          "content": "STREAM_NATIVE"
+                        },
+                        {
+                          "content": "TABLEAU"
+                        },
+                        {
+                          "content": "TERADATA"
+                        },
+                        {
+                          "content": "WORKDAY"
+                        }
+                      ]
+                    }
+                  },
+                  {
+                    "name": "entity_type",
+                    "description": "Type of entity within the external system.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "name",
+                    "description": "Name of the external metadata object.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "system_type",
+                    "description": "Type of external system.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "SystemType",
+                      "enum": [
+                        {
+                          "content": "AMAZON_REDSHIFT"
+                        },
+                        {
+                          "content": "AZURE_SYNAPSE"
+                        },
+                        {
+                          "content": "CONFLUENT"
+                        },
+                        {
+                          "content": "DATABRICKS"
+                        },
+                        {
+                          "content": "GOOGLE_BIGQUERY"
+                        },
+                        {
+                          "content": "KAFKA"
+                        },
+                        {
+                          "content": "LOOKER"
+                        },
+                        {
+                          "content": "MICROSOFT_FABRIC"
+                        },
+                        {
+                          "content": "MICROSOFT_SQL_SERVER"
+                        },
+                        {
+                          "content": "MONGODB"
+                        },
+                        {
+                          "content": "MYSQL"
+                        },
+                        {
+                          "content": "ORACLE"
+                        },
+                        {
+                          "content": "OTHER"
+                        },
+                        {
+                          "content": "POSTGRESQL"
+                        },
+                        {
+                          "content": "POWER_BI"
+                        },
+                        {
+                          "content": "SALESFORCE"
+                        },
+                        {
+                          "content": "SAP"
+                        },
+                        {
+                          "content": "SERVICENOW"
+                        },
+                        {
+                          "content": "SNOWFLAKE"
+                        },
+                        {
+                          "content": "STREAM_NATIVE"
+                        },
+                        {
+                          "content": "TABLEAU"
+                        },
+                        {
+                          "content": "TERADATA"
+                        },
+                        {
+                          "content": "WORKDAY"
+                        }
+                      ]
+                    }
+                  },
+                  {
+                    "name": "entity_type",
+                    "description": "Type of entity within the external system.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "ExternalMetadata",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the external metadata object.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "system_type",
+                  "description": "Type of external system.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "SystemType",
+                    "enum": [
+                      {
+                        "content": "AMAZON_REDSHIFT"
+                      },
+                      {
+                        "content": "AZURE_SYNAPSE"
+                      },
+                      {
+                        "content": "CONFLUENT"
+                      },
+                      {
+                        "content": "DATABRICKS"
+                      },
+                      {
+                        "content": "GOOGLE_BIGQUERY"
+                      },
+                      {
+                        "content": "KAFKA"
+                      },
+                      {
+                        "content": "LOOKER"
+                      },
+                      {
+                        "content": "MICROSOFT_FABRIC"
+                      },
+                      {
+                        "content": "MICROSOFT_SQL_SERVER"
+                      },
+                      {
+                        "content": "MONGODB"
+                      },
+                      {
+                        "content": "MYSQL"
+                      },
+                      {
+                        "content": "ORACLE"
+                      },
+                      {
+                        "content": "OTHER"
+                      },
+                      {
+                        "content": "POSTGRESQL"
+                      },
+                      {
+                        "content": "POWER_BI"
+                      },
+                      {
+                        "content": "SALESFORCE"
+                      },
+                      {
+                        "content": "SAP"
+                      },
+                      {
+                        "content": "SERVICENOW"
+                      },
+                      {
+                        "content": "SNOWFLAKE"
+                      },
+                      {
+                        "content": "STREAM_NATIVE"
+                      },
+                      {
+                        "content": "TABLEAU"
+                      },
+                      {
+                        "content": "TERADATA"
+                      },
+                      {
+                        "content": "WORKDAY"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "entity_type",
+                  "description": "Type of entity within the external system.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the external metadata object.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "system_type",
+                  "description": "Type of external system.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "SystemType",
+                    "enum": [
+                      {
+                        "content": "AMAZON_REDSHIFT"
+                      },
+                      {
+                        "content": "AZURE_SYNAPSE"
+                      },
+                      {
+                        "content": "CONFLUENT"
+                      },
+                      {
+                        "content": "DATABRICKS"
+                      },
+                      {
+                        "content": "GOOGLE_BIGQUERY"
+                      },
+                      {
+                        "content": "KAFKA"
+                      },
+                      {
+                        "content": "LOOKER"
+                      },
+                      {
+                        "content": "MICROSOFT_FABRIC"
+                      },
+                      {
+                        "content": "MICROSOFT_SQL_SERVER"
+                      },
+                      {
+                        "content": "MONGODB"
+                      },
+                      {
+                        "content": "MYSQL"
+                      },
+                      {
+                        "content": "ORACLE"
+                      },
+                      {
+                        "content": "OTHER"
+                      },
+                      {
+                        "content": "POSTGRESQL"
+                      },
+                      {
+                        "content": "POWER_BI"
+                      },
+                      {
+                        "content": "SALESFORCE"
+                      },
+                      {
+                        "content": "SAP"
+                      },
+                      {
+                        "content": "SERVICENOW"
+                      },
+                      {
+                        "content": "SNOWFLAKE"
+                      },
+                      {
+                        "content": "STREAM_NATIVE"
+                      },
+                      {
+                        "content": "TABLEAU"
+                      },
+                      {
+                        "content": "TERADATA"
+                      },
+                      {
+                        "content": "WORKDAY"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "entity_type",
+                  "description": "Type of entity within the external system.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "external_metadata",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ExternalMetadata",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "name",
+                      "description": "Name of the external metadata object.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "system_type",
+                      "description": "Type of external system.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "SystemType",
+                        "enum": [
+                          {
+                            "content": "AMAZON_REDSHIFT"
+                          },
+                          {
+                            "content": "AZURE_SYNAPSE"
+                          },
+                          {
+                            "content": "CONFLUENT"
+                          },
+                          {
+                            "content": "DATABRICKS"
+                          },
+                          {
+                            "content": "GOOGLE_BIGQUERY"
+                          },
+                          {
+                            "content": "KAFKA"
+                          },
+                          {
+                            "content": "LOOKER"
+                          },
+                          {
+                            "content": "MICROSOFT_FABRIC"
+                          },
+                          {
+                            "content": "MICROSOFT_SQL_SERVER"
+                          },
+                          {
+                            "content": "MONGODB"
+                          },
+                          {
+                            "content": "MYSQL"
+                          },
+                          {
+                            "content": "ORACLE"
+                          },
+                          {
+                            "content": "OTHER"
+                          },
+                          {
+                            "content": "POSTGRESQL"
+                          },
+                          {
+                            "content": "POWER_BI"
+                          },
+                          {
+                            "content": "SALESFORCE"
+                          },
+                          {
+                            "content": "SAP"
+                          },
+                          {
+                            "content": "SERVICENOW"
+                          },
+                          {
+                            "content": "SNOWFLAKE"
+                          },
+                          {
+                            "content": "STREAM_NATIVE"
+                          },
+                          {
+                            "content": "TABLEAU"
+                          },
+                          {
+                            "content": "TERADATA"
+                          },
+                          {
+                            "content": "WORKDAY"
+                          }
+                        ]
+                      }
+                    },
+                    {
+                      "name": "entity_type",
+                      "description": "Type of entity within the external system.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "name",
+                      "description": "Name of the external metadata object.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "system_type",
+                      "description": "Type of external system.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "SystemType",
+                        "enum": [
+                          {
+                            "content": "AMAZON_REDSHIFT"
+                          },
+                          {
+                            "content": "AZURE_SYNAPSE"
+                          },
+                          {
+                            "content": "CONFLUENT"
+                          },
+                          {
+                            "content": "DATABRICKS"
+                          },
+                          {
+                            "content": "GOOGLE_BIGQUERY"
+                          },
+                          {
+                            "content": "KAFKA"
+                          },
+                          {
+                            "content": "LOOKER"
+                          },
+                          {
+                            "content": "MICROSOFT_FABRIC"
+                          },
+                          {
+                            "content": "MICROSOFT_SQL_SERVER"
+                          },
+                          {
+                            "content": "MONGODB"
+                          },
+                          {
+                            "content": "MYSQL"
+                          },
+                          {
+                            "content": "ORACLE"
+                          },
+                          {
+                            "content": "OTHER"
+                          },
+                          {
+                            "content": "POSTGRESQL"
+                          },
+                          {
+                            "content": "POWER_BI"
+                          },
+                          {
+                            "content": "SALESFORCE"
+                          },
+                          {
+                            "content": "SAP"
+                          },
+                          {
+                            "content": "SERVICENOW"
+                          },
+                          {
+                            "content": "SNOWFLAKE"
+                          },
+                          {
+                            "content": "STREAM_NATIVE"
+                          },
+                          {
+                            "content": "TABLEAU"
+                          },
+                          {
+                            "content": "TERADATA"
+                          },
+                          {
+                            "content": "WORKDAY"
+                          }
+                        ]
+                      }
+                    },
+                    {
+                      "name": "entity_type",
+                      "description": "Type of entity within the external system.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the external metadata object.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "columns",
+                "description": "List of columns associated with the external metadata object.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Time at which this external metadata object was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "created_by",
+                "description": "Username of external metadata object creator.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "User-provided free-form text description.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "entity_type",
+                "description": "Type of entity within the external system.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "id",
+                "description": "Unique identifier of the external metadata object.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "metastore_id",
+                "description": "Unique identifier of parent metastore.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the external metadata object.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "owner",
+                "description": "Owner of the external metadata object.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "properties",
+                "description": "A map of key-value properties attached to the external metadata object.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "system_type",
+                "description": "Type of external system.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "SystemType",
+                  "enum": [
+                    {
+                      "content": "AMAZON_REDSHIFT"
+                    },
+                    {
+                      "content": "AZURE_SYNAPSE"
+                    },
+                    {
+                      "content": "CONFLUENT"
+                    },
+                    {
+                      "content": "DATABRICKS"
+                    },
+                    {
+                      "content": "GOOGLE_BIGQUERY"
+                    },
+                    {
+                      "content": "KAFKA"
+                    },
+                    {
+                      "content": "LOOKER"
+                    },
+                    {
+                      "content": "MICROSOFT_FABRIC"
+                    },
+                    {
+                      "content": "MICROSOFT_SQL_SERVER"
+                    },
+                    {
+                      "content": "MONGODB"
+                    },
+                    {
+                      "content": "MYSQL"
+                    },
+                    {
+                      "content": "ORACLE"
+                    },
+                    {
+                      "content": "OTHER"
+                    },
+                    {
+                      "content": "POSTGRESQL"
+                    },
+                    {
+                      "content": "POWER_BI"
+                    },
+                    {
+                      "content": "SALESFORCE"
+                    },
+                    {
+                      "content": "SAP"
+                    },
+                    {
+                      "content": "SERVICENOW"
+                    },
+                    {
+                      "content": "SNOWFLAKE"
+                    },
+                    {
+                      "content": "STREAM_NATIVE"
+                    },
+                    {
+                      "content": "TABLEAU"
+                    },
+                    {
+                      "content": "TERADATA"
+                    },
+                    {
+                      "content": "WORKDAY"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "Time at which this external metadata object was last modified.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "updated_by",
+                "description": "Username of user who last modified external metadata object.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "url",
+                "description": "URL associated with the external metadata object.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the external metadata object.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "system_type",
+                "description": "Type of external system.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "SystemType",
+                  "enum": [
+                    {
+                      "content": "AMAZON_REDSHIFT"
+                    },
+                    {
+                      "content": "AZURE_SYNAPSE"
+                    },
+                    {
+                      "content": "CONFLUENT"
+                    },
+                    {
+                      "content": "DATABRICKS"
+                    },
+                    {
+                      "content": "GOOGLE_BIGQUERY"
+                    },
+                    {
+                      "content": "KAFKA"
+                    },
+                    {
+                      "content": "LOOKER"
+                    },
+                    {
+                      "content": "MICROSOFT_FABRIC"
+                    },
+                    {
+                      "content": "MICROSOFT_SQL_SERVER"
+                    },
+                    {
+                      "content": "MONGODB"
+                    },
+                    {
+                      "content": "MYSQL"
+                    },
+                    {
+                      "content": "ORACLE"
+                    },
+                    {
+                      "content": "OTHER"
+                    },
+                    {
+                      "content": "POSTGRESQL"
+                    },
+                    {
+                      "content": "POWER_BI"
+                    },
+                    {
+                      "content": "SALESFORCE"
+                    },
+                    {
+                      "content": "SAP"
+                    },
+                    {
+                      "content": "SERVICENOW"
+                    },
+                    {
+                      "content": "SNOWFLAKE"
+                    },
+                    {
+                      "content": "STREAM_NATIVE"
+                    },
+                    {
+                      "content": "TABLEAU"
+                    },
+                    {
+                      "content": "TERADATA"
+                    },
+                    {
+                      "content": "WORKDAY"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "entity_type",
+                "description": "Type of entity within the external system.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "ml.FeatureEngineering",
+        "name": "FeatureEngineering",
+        "description": "Feature Engineering provides APIs for managing features and materialized features.",
+        "package": {
+          "name": "ml"
+        },
+        "docs_group": "ml",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListFeaturesRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "BackfillFeatures",
+            "description": "Backfill features.",
+            "summary": "Backfill features.",
+            "path": "/api/2.0/feature-engineering/features:backfill",
+            "can_use_json": true,
+            "must_use_json": true,
+            "is_hidden_cli": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "BackfillFeaturesRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "feature_full_names",
+                  "description": "Full names of the features to backfill.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "List",
+                    "array_value": {
+                      "is_string": true
+                    }
+                  }
+                },
+                {
+                  "name": "backfill_ranges",
+                  "description": "Output ranges to backfill.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BackfillRangeList",
+                    "array_value": {
+                      "pascal_name": "BackfillRange",
+                      "is_object": true
+                    }
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "feature_full_names",
+                  "description": "Full names of the features to backfill.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "List",
+                    "array_value": {
+                      "is_string": true
+                    }
+                  }
+                },
+                {
+                  "name": "backfill_ranges",
+                  "description": "Output ranges to backfill.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BackfillRangeList",
+                    "array_value": {
+                      "pascal_name": "BackfillRange",
+                      "is_object": true
+                    }
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "backfill_ranges",
+                "description": "Output ranges to backfill.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "BackfillRangeList",
+                  "array_value": {
+                    "pascal_name": "BackfillRange",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "budget_policy_id",
+                "description": "The budget policy ID, in UUID format, used to attribute the serverless compute cost of this\nbackfill. If not specified, a default budget policy may be applied.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "feature_full_names",
+                "description": "Full names of the features to backfill.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "request_id",
+                "description": "Idempotency token for the request.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tags",
+                "description": "Custom tags to associate with this backfill. They are applied to the backfill job and\nforwarded to the underlying compute as Databricks resource tags, so backfill cost can be\nattributed in the billing system tables. These tags apply only to the backfill compute; they\nare not applied to the Unity Catalog Feature resources themselves, whose tags are managed\nseparately through the Unity Catalog tagging API. A maximum of 25 tags is supported; keys and\nvalues are subject to the same limitations as Databricks resource tags.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              }
+            ],
+            "long_running_operation": {
+              "get_operation": {
+                "kebab_name": "get-operation",
+                "pascal_name": "GetOperation",
+                "request": {
+                  "pascal_name": "GetOperationRequest"
+                }
+              },
+              "response_type": {}
+            }
+          },
+          {
+            "name": "CancelOperation",
+            "description": "Cancel an operation.",
+            "summary": "Cancel an operation.",
+            "path": "/api/2.0/feature-engineering/{name=operations/*}:cancel",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "CancelOperationRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the operation resource to be cancelled.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the operation resource to be cancelled.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The name of the operation resource to be cancelled.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the operation resource to be cancelled.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateFeature",
+            "description": "Create a Feature.",
+            "summary": "Create a feature.",
+            "path": "/api/2.0/feature-engineering/features",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateFeatureRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "feature",
+                  "description": "Feature to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Feature",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "feature",
+                  "description": "Feature to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Feature",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "feature",
+              "description": "Feature to create.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Feature",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "full_name",
+                    "description": "The full three-part name (catalog, schema, name) of the feature.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "source",
+                    "description": "The data source of the feature.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "DataSource",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "function",
+                    "description": "The function by which the feature is computed.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "Function",
+                      "is_object": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "full_name",
+                    "description": "The full three-part name (catalog, schema, name) of the feature.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "source",
+                    "description": "The data source of the feature.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "DataSource",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "function",
+                    "description": "The function by which the feature is computed.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "Function",
+                      "is_object": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "Feature",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "full_name",
+                  "description": "The full three-part name (catalog, schema, name) of the feature.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "source",
+                  "description": "The data source of the feature.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DataSource",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "function",
+                  "description": "The function by which the feature is computed.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Function",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "full_name",
+                  "description": "The full three-part name (catalog, schema, name) of the feature.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "source",
+                  "description": "The data source of the feature.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DataSource",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "function",
+                  "description": "The function by which the feature is computed.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Function",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "feature",
+                "description": "Feature to create.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Feature",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "full_name",
+                      "description": "The full three-part name (catalog, schema, name) of the feature.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "source",
+                      "description": "The data source of the feature.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "DataSource",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "function",
+                      "description": "The function by which the feature is computed.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "Function",
+                        "is_object": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "full_name",
+                      "description": "The full three-part name (catalog, schema, name) of the feature.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "source",
+                      "description": "The data source of the feature.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "DataSource",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "function",
+                      "description": "The function by which the feature is computed.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "Function",
+                        "is_object": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "catalog_name",
+                "description": "Name of parent catalog.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "created_at",
+                "description": "Time at which this feature was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "created_by",
+                "description": "Username of the feature creator.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "The description of the feature.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "entities",
+                "description": "The entity columns for the feature, used as aggregation keys and for query-time lookup.\nOptional since entities are not set for RequestSource features or on-demand calculated features.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EntityColumnList",
+                  "array_value": {
+                    "pascal_name": "EntityColumn",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "filter_condition",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "full_name",
+                "description": "The full three-part name (catalog, schema, name) of the feature.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "function",
+                "description": "The function by which the feature is computed.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Function",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "inputs",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "lineage_context",
+                "description": "Lineage context information for this feature.\nWARNING: This field is primarily intended for internal use by Databricks systems and\nis automatically populated when features are created through Databricks notebooks or jobs.\nUsers should not manually set this field as incorrect values may lead to inaccurate lineage tracking or unexpected behavior.\nThis field will be set by feature-engineering client and should be left unset by SDK and terraform users.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "LineageContext",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the feature, extracted from the full three-part name (catalog.schema.name).",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schema_name",
+                "description": "Name of parent schema relative to its parent catalog.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "source",
+                "description": "The data source of the feature.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DataSource",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "time_window",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "TimeWindow",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "timeseries_column",
+                "description": "Column recording time, used for point-in-time joins, backfills, and aggregations.\nOptional since a timeseries column is not set for RequestSource features or on-demand\ncalculated features.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "TimeseriesColumn",
+                  "is_object": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "full_name",
+                "description": "The full three-part name (catalog, schema, name) of the feature.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "source",
+                "description": "The data source of the feature.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DataSource",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "function",
+                "description": "The function by which the feature is computed.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Function",
+                  "is_object": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateKafkaConfig",
+            "description": "Create a Kafka config.\nDuring PrPr, Kafka configs can be read and used when creating features under the entire metastore.\nOnly the creator of the Kafka config can delete it.",
+            "summary": "Create a Kafka config.",
+            "path": "/api/2.0/feature-engineering/features/kafka-configs",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "CreateKafkaConfigRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "kafka_config",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "KafkaConfig",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "kafka_config",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "KafkaConfig",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "kafka_config",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "KafkaConfig",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "name",
+                    "description": "Name that uniquely identifies this Kafka config within the metastore. This will be the identifier used from the Feature object to reference these configs for a feature.\nCan be distinct from topic name.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "bootstrap_servers",
+                    "description": "A comma-separated list of host/port pairs pointing to Kafka cluster.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "subscription_mode",
+                    "description": "Options to configure which Kafka topics to pull data from.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "SubscriptionMode",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "auth_config",
+                    "description": "Authentication configuration for connection to topics.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "AuthConfig",
+                      "is_object": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "name",
+                    "description": "Name that uniquely identifies this Kafka config within the metastore. This will be the identifier used from the Feature object to reference these configs for a feature.\nCan be distinct from topic name.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "bootstrap_servers",
+                    "description": "A comma-separated list of host/port pairs pointing to Kafka cluster.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "subscription_mode",
+                    "description": "Options to configure which Kafka topics to pull data from.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "SubscriptionMode",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "auth_config",
+                    "description": "Authentication configuration for connection to topics.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "AuthConfig",
+                      "is_object": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "KafkaConfig",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name that uniquely identifies this Kafka config within the metastore. This will be the identifier used from the Feature object to reference these configs for a feature.\nCan be distinct from topic name.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "bootstrap_servers",
+                  "description": "A comma-separated list of host/port pairs pointing to Kafka cluster.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "subscription_mode",
+                  "description": "Options to configure which Kafka topics to pull data from.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "SubscriptionMode",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "auth_config",
+                  "description": "Authentication configuration for connection to topics.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AuthConfig",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Name that uniquely identifies this Kafka config within the metastore. This will be the identifier used from the Feature object to reference these configs for a feature.\nCan be distinct from topic name.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "bootstrap_servers",
+                  "description": "A comma-separated list of host/port pairs pointing to Kafka cluster.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "subscription_mode",
+                  "description": "Options to configure which Kafka topics to pull data from.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "SubscriptionMode",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "auth_config",
+                  "description": "Authentication configuration for connection to topics.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AuthConfig",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "kafka_config",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "KafkaConfig",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "name",
+                      "description": "Name that uniquely identifies this Kafka config within the metastore. This will be the identifier used from the Feature object to reference these configs for a feature.\nCan be distinct from topic name.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "bootstrap_servers",
+                      "description": "A comma-separated list of host/port pairs pointing to Kafka cluster.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "subscription_mode",
+                      "description": "Options to configure which Kafka topics to pull data from.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "SubscriptionMode",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "auth_config",
+                      "description": "Authentication configuration for connection to topics.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "AuthConfig",
+                        "is_object": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "name",
+                      "description": "Name that uniquely identifies this Kafka config within the metastore. This will be the identifier used from the Feature object to reference these configs for a feature.\nCan be distinct from topic name.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "bootstrap_servers",
+                      "description": "A comma-separated list of host/port pairs pointing to Kafka cluster.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "subscription_mode",
+                      "description": "Options to configure which Kafka topics to pull data from.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "SubscriptionMode",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "auth_config",
+                      "description": "Authentication configuration for connection to topics.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "AuthConfig",
+                        "is_object": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "auth_config",
+                "description": "Authentication configuration for connection to topics.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AuthConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "backfill_source",
+                "description": "A user-provided and managed source for backfilling data. Historical data is used when creating a training set from streaming features linked to this Kafka config.\nIn the future, a separate table will be maintained by Databricks for forward filling data.\nThe schema for this source must match exactly that of the key and value schemas specified for this Kafka config.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "BackfillSource",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "bootstrap_servers",
+                "description": "A comma-separated list of host/port pairs pointing to Kafka cluster.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "extra_options",
+                "description": "Catch-all for miscellaneous options. Keys should be source options or Kafka consumer options (kafka.*)",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "ingestion_config",
+                "description": "Configuration for ingesting Kafka data into a Databricks-managed\nDelta table.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "IngestionConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "key_schema",
+                "description": "Schema configuration for extracting message keys from topics. At least one of key_schema and value_schema must be provided.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "SchemaConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name that uniquely identifies this Kafka config within the metastore. This will be the identifier used from the Feature object to reference these configs for a feature.\nCan be distinct from topic name.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "subscription_mode",
+                "description": "Options to configure which Kafka topics to pull data from.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "SubscriptionMode",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "value_schema",
+                "description": "Schema configuration for extracting message values from topics. At least one of key_schema and value_schema must be provided.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "SchemaConfig",
+                  "is_object": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name that uniquely identifies this Kafka config within the metastore. This will be the identifier used from the Feature object to reference these configs for a feature.\nCan be distinct from topic name.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "bootstrap_servers",
+                "description": "A comma-separated list of host/port pairs pointing to Kafka cluster.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "subscription_mode",
+                "description": "Options to configure which Kafka topics to pull data from.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "SubscriptionMode",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "auth_config",
+                "description": "Authentication configuration for connection to topics.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AuthConfig",
+                  "is_object": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateMaterializedFeature",
+            "description": "Create a materialized feature.",
+            "summary": "Create a materialized feature.",
+            "path": "/api/2.0/feature-engineering/materialized-features",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateMaterializedFeatureRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "materialized_feature",
+                  "description": "The materialized feature to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "MaterializedFeature",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "materialized_feature",
+                  "description": "The materialized feature to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "MaterializedFeature",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "materialized_feature",
+              "description": "The materialized feature to create.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "MaterializedFeature",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "feature_name",
+                    "description": "The full name of the feature in Unity Catalog.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "feature_name",
+                    "description": "The full name of the feature in Unity Catalog.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "MaterializedFeature",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "feature_name",
+                  "description": "The full name of the feature in Unity Catalog.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "feature_name",
+                  "description": "The full name of the feature in Unity Catalog.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "materialized_feature",
+                "description": "The materialized feature to create.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "MaterializedFeature",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "feature_name",
+                      "description": "The full name of the feature in Unity Catalog.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "feature_name",
+                      "description": "The full name of the feature in Unity Catalog.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "budget_policy_id",
+                "description": "The ID of the budget policy used to attribute the serverless compute cost of this\nmaterialization. If not specified, a default budget policy may be applied.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "cron_schedule",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "cron_schedule_trigger",
+                "description": "A cron-based schedule trigger for the materialization pipeline.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CronSchedule",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "feature_name",
+                "description": "The full name of the feature in Unity Catalog.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "is_online",
+                "description": "True if this is an online materialized feature. False if it is an offline materialized feature.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "job_id",
+                "description": "The ID of the job that materializes the feature. This is present for both batch and streaming features.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "last_materialization_time",
+                "description": "The timestamp when the pipeline last ran and updated the materialized feature values.\nIf the pipeline has not run yet, this field will be null.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "latest_backfill_operation",
+                "description": "Name of the latest backfill operation on this materialized feature. Format: operations/{operation_id}.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "materialized_feature_id",
+                "description": "Server-assigned unique identifier for the materialized feature.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "notifications",
+                "description": "Notification configuration around the materialization job or pipeline lifecycle. They are\napplied to every job and pipeline that materializes this feature. Features which are\nmaterialized in the same pipeline will share the same notification.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "MaterializationNotifications",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "offline_store_config",
+                "description": "Destination for writing feature values to an offline Delta table. The resulting table is\nreturned as `table_name`.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "OfflineStoreConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "online_store_config",
+                "description": "Destination for writing feature values to an online Lakebase table. The resulting table is\nreturned as `table_name`.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "OnlineStoreConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "pipeline_id",
+                "description": "The ID of the pipeline that materializes this feature. This is only present for streaming features.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "pipeline_schedule_state",
+                "description": "The schedule state of the materialization pipeline.\nHidden from GraphQL: being deprecated, so not exposed to Catalog Explorer.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "MaterializedFeaturePipelineScheduleState",
+                  "enum": [
+                    {
+                      "content": "ACTIVE"
+                    },
+                    {
+                      "content": "PAUSED"
+                    },
+                    {
+                      "content": "SNAPSHOT"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "streaming_mode",
+                "description": "The Structured Streaming trigger mode used for materialization. Real-time mode (RTM) targets\nsub-second latency for operational workloads; micro-batch mode (MBM) favors cost efficiency\nfor ETL and analytics workloads.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "StreamingMode",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "table_name",
+                "description": "The fully qualified Unity Catalog path to the table containing the materialized feature (Delta table or Lakebase table). Output only.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "table_trigger",
+                "description": "A trigger that fires when the upstream source table changes.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "TableTrigger",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "tags",
+                "description": "Custom tags to associate with this materialization. They are applied to the materialization\njob (for batch features) or pipeline (for streaming features) and forwarded to the underlying\ncompute as cluster tags, so materialization cost can be attributed in the billing system\ntables. These tags apply only to the materialization compute; they are not applied to the\nUnity Catalog Feature resource itself, whose tags are managed separately through the Unity\nCatalog tagging API. A maximum of 25 tags is supported; keys and values are subject to the\nsame limitations as cluster tags.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "feature_name",
+                "description": "The full name of the feature in Unity Catalog.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateStream",
+            "description": "Create a Stream, a governed UC entity representing an external streaming data source.",
+            "summary": "Create a Stream.",
+            "path": "/api/2.0/feature-engineering/streams",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateStreamRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "stream",
+                  "description": "The Stream to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Stream",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "stream",
+                  "description": "The Stream to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Stream",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "stream",
+              "description": "The Stream to create.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Stream",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "name",
+                    "description": "Full three-part (catalog.schema.stream) name of the stream.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "source_config",
+                    "description": "Source-specific configuration. Determines the streaming platform source.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "StreamSourceConfig",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "connection_config",
+                    "description": "Specifies how to connect and authenticate to the stream platform.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "StreamConnectionConfig",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "schema_config",
+                    "description": "Schema definitions for the stream, provided either directly on the Stream or\nresolved from an external schema registry through a UC Connection.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "StreamSchemaConfig",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "ingestion_config",
+                    "description": "Configuration for streaming data ingestion: the managed table storing an offline copy of forward fill data and optional historical backfill.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "IngestionConfig",
+                      "is_object": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "name",
+                    "description": "Full three-part (catalog.schema.stream) name of the stream.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "source_config",
+                    "description": "Source-specific configuration. Determines the streaming platform source.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "StreamSourceConfig",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "connection_config",
+                    "description": "Specifies how to connect and authenticate to the stream platform.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "StreamConnectionConfig",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "schema_config",
+                    "description": "Schema definitions for the stream, provided either directly on the Stream or\nresolved from an external schema registry through a UC Connection.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "StreamSchemaConfig",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "ingestion_config",
+                    "description": "Configuration for streaming data ingestion: the managed table storing an offline copy of forward fill data and optional historical backfill.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "IngestionConfig",
+                      "is_object": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "Stream",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Full three-part (catalog.schema.stream) name of the stream.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "source_config",
+                  "description": "Source-specific configuration. Determines the streaming platform source.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "StreamSourceConfig",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "connection_config",
+                  "description": "Specifies how to connect and authenticate to the stream platform.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "StreamConnectionConfig",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "schema_config",
+                  "description": "Schema definitions for the stream, provided either directly on the Stream or\nresolved from an external schema registry through a UC Connection.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "StreamSchemaConfig",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "ingestion_config",
+                  "description": "Configuration for streaming data ingestion: the managed table storing an offline copy of forward fill data and optional historical backfill.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "IngestionConfig",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Full three-part (catalog.schema.stream) name of the stream.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "source_config",
+                  "description": "Source-specific configuration. Determines the streaming platform source.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "StreamSourceConfig",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "connection_config",
+                  "description": "Specifies how to connect and authenticate to the stream platform.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "StreamConnectionConfig",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "schema_config",
+                  "description": "Schema definitions for the stream, provided either directly on the Stream or\nresolved from an external schema registry through a UC Connection.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "StreamSchemaConfig",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "ingestion_config",
+                  "description": "Configuration for streaming data ingestion: the managed table storing an offline copy of forward fill data and optional historical backfill.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "IngestionConfig",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "stream",
+                "description": "The Stream to create.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Stream",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "name",
+                      "description": "Full three-part (catalog.schema.stream) name of the stream.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "source_config",
+                      "description": "Source-specific configuration. Determines the streaming platform source.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "StreamSourceConfig",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "connection_config",
+                      "description": "Specifies how to connect and authenticate to the stream platform.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "StreamConnectionConfig",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "schema_config",
+                      "description": "Schema definitions for the stream, provided either directly on the Stream or\nresolved from an external schema registry through a UC Connection.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "StreamSchemaConfig",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "ingestion_config",
+                      "description": "Configuration for streaming data ingestion: the managed table storing an offline copy of forward fill data and optional historical backfill.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "IngestionConfig",
+                        "is_object": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "name",
+                      "description": "Full three-part (catalog.schema.stream) name of the stream.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "source_config",
+                      "description": "Source-specific configuration. Determines the streaming platform source.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "StreamSourceConfig",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "connection_config",
+                      "description": "Specifies how to connect and authenticate to the stream platform.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "StreamConnectionConfig",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "schema_config",
+                      "description": "Schema definitions for the stream, provided either directly on the Stream or\nresolved from an external schema registry through a UC Connection.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "StreamSchemaConfig",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "ingestion_config",
+                      "description": "Configuration for streaming data ingestion: the managed table storing an offline copy of forward fill data and optional historical backfill.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "IngestionConfig",
+                        "is_object": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "browse_only",
+                "description": "Indicates whether the principal is limited to retrieving metadata for the\nassociated object through the BROWSE privilege when include_browse is enabled in the request.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "connection_config",
+                "description": "Specifies how to connect and authenticate to the stream platform.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "StreamConnectionConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Time at which this Stream was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "created_by",
+                "description": "Username of the Stream creator.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "User-provided description.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "excluded_columns",
+                "description": "Column paths (dot notation, e.g. \"value.email\" for Kafka) to drop.\nA path may reference a struct, in which case all of its nested fields are dropped (e.g. \"value.address\" drops \"value.address.city\" and \"value.address.zip\").\nThese columns are not written to the ingestion table and cannot be referenced by any feature.\nThey are dropped from ingestion, backfill, and materialization.\nFor direct schemas, each column must exist in the relevant key or payload schema. With a schema registry, a column can be excluded before it exists.\nA column cannot also be a deduplication column in the ingestion_config.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "ingestion_config",
+                "description": "Configuration for streaming data ingestion: the managed table storing an offline copy of forward fill data and optional historical backfill.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "IngestionConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Full three-part (catalog.schema.stream) name of the stream.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "record_type_filter",
+                "description": "Optional SQL predicate to filter which record types from a streaming channel (e.g. a topic for Kafka) belong to this Stream.\nEvents that do not match are not written to the ingestion table and are not used in materialization.\nExample: \"value.event_type = 'transaction'\".",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schema_config",
+                "description": "Schema definitions for the stream, provided either directly on the Stream or\nresolved from an external schema registry through a UC Connection.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "StreamSchemaConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "source_config",
+                "description": "Source-specific configuration. Determines the streaming platform source.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "StreamSourceConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "Time at which this Stream was last modified.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "updated_by",
+                "description": "Username of user who last modified the Stream.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Full three-part (catalog.schema.stream) name of the stream.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "source_config",
+                "description": "Source-specific configuration. Determines the streaming platform source.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "StreamSourceConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "connection_config",
+                "description": "Specifies how to connect and authenticate to the stream platform.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "StreamConnectionConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "schema_config",
+                "description": "Schema definitions for the stream, provided either directly on the Stream or\nresolved from an external schema registry through a UC Connection.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "StreamSchemaConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "ingestion_config",
+                "description": "Configuration for streaming data ingestion: the managed table storing an offline copy of forward fill data and optional historical backfill.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "IngestionConfig",
+                  "is_object": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteFeature",
+            "description": "Delete a Feature.",
+            "summary": "Delete a feature.",
+            "path": "/api/2.0/feature-engineering/features/{full_name}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteFeatureRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "full_name",
+                  "description": "Name of the feature to delete.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "full_name",
+                  "description": "Name of the feature to delete.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "full_name",
+                "description": "Name of the feature to delete.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "full_name",
+                "description": "Name of the feature to delete.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteKafkaConfig",
+            "description": "Delete a Kafka config.\nDuring PrPr, Kafka configs can be read and used when creating features under the entire metastore.\nOnly the creator of the Kafka config can delete it.",
+            "summary": "Delete a Kafka config.",
+            "path": "/api/2.0/feature-engineering/features/kafka-configs/{name}",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "DeleteKafkaConfigRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the Kafka config to delete.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the Kafka config to delete.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Name of the Kafka config to delete.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the Kafka config to delete.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteMaterializedFeature",
+            "description": "Delete a materialized feature.",
+            "summary": "Delete a materialized feature.",
+            "path": "/api/2.0/feature-engineering/materialized-features/{materialized_feature_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteMaterializedFeatureRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "materialized_feature_id",
+                  "description": "The ID of the materialized feature to delete.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "materialized_feature_id",
+                  "description": "The ID of the materialized feature to delete.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "materialized_feature_id",
+                "description": "The ID of the materialized feature to delete.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "materialized_feature_id",
+                "description": "The ID of the materialized feature to delete.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteStream",
+            "description": "Delete a Stream by its full three-part name (catalog.schema.stream).",
+            "summary": "Delete a Stream.",
+            "path": "/api/2.0/feature-engineering/streams/{name}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteStreamRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Full three-part name (catalog.schema.stream) of the Stream to delete.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Full three-part name (catalog.schema.stream) of the Stream to delete.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Full three-part name (catalog.schema.stream) of the Stream to delete.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Full three-part name (catalog.schema.stream) of the Stream to delete.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetFeature",
+            "description": "Get a Feature.",
+            "summary": "Get a feature.",
+            "path": "/api/2.0/feature-engineering/features/{full_name}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetFeatureRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "full_name",
+                  "description": "Name of the feature to get.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "full_name",
+                  "description": "Name of the feature to get.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Feature",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "full_name",
+                  "description": "The full three-part name (catalog, schema, name) of the feature.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "source",
+                  "description": "The data source of the feature.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DataSource",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "function",
+                  "description": "The function by which the feature is computed.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Function",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "full_name",
+                  "description": "The full three-part name (catalog, schema, name) of the feature.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "source",
+                  "description": "The data source of the feature.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DataSource",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "function",
+                  "description": "The function by which the feature is computed.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Function",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "full_name",
+                "description": "Name of the feature to get.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "full_name",
+                "description": "Name of the feature to get.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetKafkaConfig",
+            "description": "Get a Kafka config.\nDuring PrPr, Kafka configs can be read and used when creating features under the entire metastore.\nOnly the creator of the Kafka config can delete it.",
+            "summary": "Get a Kafka config.",
+            "path": "/api/2.0/feature-engineering/features/kafka-configs/{name}",
+            "is_crud_read": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "GetKafkaConfigRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the Kafka config to get.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the Kafka config to get.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "KafkaConfig",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name that uniquely identifies this Kafka config within the metastore. This will be the identifier used from the Feature object to reference these configs for a feature.\nCan be distinct from topic name.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "bootstrap_servers",
+                  "description": "A comma-separated list of host/port pairs pointing to Kafka cluster.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "subscription_mode",
+                  "description": "Options to configure which Kafka topics to pull data from.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "SubscriptionMode",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "auth_config",
+                  "description": "Authentication configuration for connection to topics.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AuthConfig",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Name that uniquely identifies this Kafka config within the metastore. This will be the identifier used from the Feature object to reference these configs for a feature.\nCan be distinct from topic name.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "bootstrap_servers",
+                  "description": "A comma-separated list of host/port pairs pointing to Kafka cluster.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "subscription_mode",
+                  "description": "Options to configure which Kafka topics to pull data from.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "SubscriptionMode",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "auth_config",
+                  "description": "Authentication configuration for connection to topics.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AuthConfig",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Name of the Kafka config to get.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the Kafka config to get.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetMaterializedFeature",
+            "description": "Get a materialized feature.",
+            "summary": "Get a materialized feature.",
+            "path": "/api/2.0/feature-engineering/materialized-features/{materialized_feature_id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetMaterializedFeatureRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "materialized_feature_id",
+                  "description": "The ID of the materialized feature.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "materialized_feature_id",
+                  "description": "The ID of the materialized feature.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "MaterializedFeature",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "feature_name",
+                  "description": "The full name of the feature in Unity Catalog.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "feature_name",
+                  "description": "The full name of the feature in Unity Catalog.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "materialized_feature_id",
+                "description": "The ID of the materialized feature.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "materialized_feature_id",
+                "description": "The ID of the materialized feature.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetOperation",
+            "description": "Get an operation.",
+            "summary": "Get an operation.",
+            "path": "/api/2.0/feature-engineering/{name=operations/*}",
+            "is_crud_read": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "GetOperationRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the operation resource.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the operation resource.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The name of the operation resource.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the operation resource.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetStream",
+            "description": "Get a Stream by its full three-part name (catalog.schema.stream).",
+            "summary": "Get a Stream.",
+            "path": "/api/2.0/feature-engineering/streams/{name}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetStreamRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Full three-part name (catalog.schema.stream) of the Stream to get.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Full three-part name (catalog.schema.stream) of the Stream to get.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Stream",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Full three-part (catalog.schema.stream) name of the stream.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "source_config",
+                  "description": "Source-specific configuration. Determines the streaming platform source.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "StreamSourceConfig",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "connection_config",
+                  "description": "Specifies how to connect and authenticate to the stream platform.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "StreamConnectionConfig",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "schema_config",
+                  "description": "Schema definitions for the stream, provided either directly on the Stream or\nresolved from an external schema registry through a UC Connection.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "StreamSchemaConfig",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "ingestion_config",
+                  "description": "Configuration for streaming data ingestion: the managed table storing an offline copy of forward fill data and optional historical backfill.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "IngestionConfig",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Full three-part (catalog.schema.stream) name of the stream.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "source_config",
+                  "description": "Source-specific configuration. Determines the streaming platform source.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "StreamSourceConfig",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "connection_config",
+                  "description": "Specifies how to connect and authenticate to the stream platform.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "StreamConnectionConfig",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "schema_config",
+                  "description": "Schema definitions for the stream, provided either directly on the Stream or\nresolved from an external schema registry through a UC Connection.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "StreamSchemaConfig",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "ingestion_config",
+                  "description": "Configuration for streaming data ingestion: the managed table storing an offline copy of forward fill data and optional historical backfill.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "IngestionConfig",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Full three-part name (catalog.schema.stream) of the Stream to get.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Full three-part name (catalog.schema.stream) of the Stream to get.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListFeatures",
+            "description": "List Features.",
+            "summary": "List features.",
+            "path": "/api/2.0/feature-engineering/features",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListFeaturesRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "catalog_name",
+                  "description": "Name of parent catalog for features of interest.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schema_name",
+                  "description": "Name of parent schema relative to its parent catalog.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "catalog_name",
+                  "description": "Name of parent catalog for features of interest.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schema_name",
+                  "description": "Name of parent schema relative to its parent catalog.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListFeaturesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "catalog_name",
+                "description": "Name of parent catalog for features of interest.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "The maximum number of results to return.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Pagination token to go to the next page based on a previous query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schema_name",
+                "description": "Name of parent schema relative to its parent catalog.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "catalog_name",
+                "description": "Name of parent catalog for features of interest.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schema_name",
+                "description": "Name of parent schema relative to its parent catalog.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Pagination token to go to the next page based on a previous query.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListKafkaConfigs",
+            "description": "List Kafka configs.\nDuring PrPr, Kafka configs can be read and used when creating features under the entire metastore.\nOnly the creator of the Kafka config can delete it.",
+            "summary": "List Kafka configs.",
+            "path": "/api/2.0/feature-engineering/features/kafka-configs",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "ListKafkaConfigsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListKafkaConfigsResponse",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "kafka_configs",
+                  "description": "List of Kafka configs. Schemas are not included in the response.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "KafkaConfigList",
+                    "array_value": {
+                      "pascal_name": "KafkaConfig",
+                      "is_object": true
+                    }
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "kafka_configs",
+                  "description": "List of Kafka configs. Schemas are not included in the response.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "KafkaConfigList",
+                    "array_value": {
+                      "pascal_name": "KafkaConfig",
+                      "is_object": true
+                    }
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "The maximum number of results to return.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Pagination token to go to the next page based on a previous query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Pagination token to go to the next page based on a previous query.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListMaterializedFeatures",
+            "description": "List materialized features.",
+            "summary": "List materialized features.",
+            "path": "/api/2.0/feature-engineering/materialized-features",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListMaterializedFeaturesRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListMaterializedFeaturesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "feature_name",
+                "description": "Filter by feature name. If specified, only materialized features materialized from this feature will be returned.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "The maximum number of results to return. Defaults to 100 if not specified. Cannot be greater than 1000.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Pagination token to go to the next page based on a previous query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Pagination token to go to the next page based on a previous query.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListStreams",
+            "description": "List Streams under a given catalog.schema parent.",
+            "summary": "List Streams.",
+            "path": "/api/2.0/feature-engineering/streams",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListStreamsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListStreamsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "The maximum number of results to return.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Pagination token to go to the next page based on a previous query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "Two-part name (catalog.schema) of the parent under which to list Streams.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Pagination token to go to the next page based on a previous query.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "PurgeFeatureEntities",
+            "description": "Purge materialized feature values for specified entities.",
+            "summary": "Purge feature values for entities.",
+            "path": "/api/2.0/feature-engineering/features:purgeFeatureEntities",
+            "can_use_json": true,
+            "must_use_json": true,
+            "is_hidden_cli": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "PurgeFeatureEntitiesRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "features",
+                  "description": "Fully qualified names of the features to purge. At least one nonempty feature name is required.\nA request may contain at most 10000 features; submit additional features in separate requests.\nDuplicate features are rejected.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "List",
+                    "array_value": {
+                      "is_string": true
+                    }
+                  }
+                },
+                {
+                  "name": "entities_table",
+                  "description": "Fully qualified name of the Unity Catalog Delta table containing the entity keys to purge.\nThe table may contain a subset of each feature's entity-key columns. A partial key match\ndeletes all feature rows matching the provided key values. Non-key columns are rejected;\nnull key values are allowed.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "features",
+                  "description": "Fully qualified names of the features to purge. At least one nonempty feature name is required.\nA request may contain at most 10000 features; submit additional features in separate requests.\nDuplicate features are rejected.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "List",
+                    "array_value": {
+                      "is_string": true
+                    }
+                  }
+                },
+                {
+                  "name": "entities_table",
+                  "description": "Fully qualified name of the Unity Catalog Delta table containing the entity keys to purge.\nThe table may contain a subset of each feature's entity-key columns. A partial key match\ndeletes all feature rows matching the provided key values. Non-key columns are rejected;\nnull key values are allowed.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "budget_policy_id",
+                "description": "The budget policy ID, in UUID format, used to attribute the serverless compute cost of this\npurge. If not specified, a default budget policy may be applied.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "entities_table",
+                "description": "Fully qualified name of the Unity Catalog Delta table containing the entity keys to purge.\nThe table may contain a subset of each feature's entity-key columns. A partial key match\ndeletes all feature rows matching the provided key values. Non-key columns are rejected;\nnull key values are allowed.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "features",
+                "description": "Fully qualified names of the features to purge. At least one nonempty feature name is required.\nA request may contain at most 10000 features; submit additional features in separate requests.\nDuplicate features are rejected.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "request_id",
+                "description": "Optional UUID4 idempotency token for the request.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tags",
+                "description": "Custom tags to associate with this purge. They are applied to the purge job and forwarded to\nthe underlying compute as Databricks resource tags, so purge cost can be attributed in the\nbilling system tables. These tags apply only to the purge compute; they are not applied to the\nUnity Catalog Feature resources themselves, whose tags are managed separately through the Unity\nCatalog tagging API. A maximum of 25 tags is supported; keys and values are subject to the same\nlimitations as Databricks resource tags.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              }
+            ],
+            "long_running_operation": {
+              "get_operation": {
+                "kebab_name": "get-operation",
+                "pascal_name": "GetOperation",
+                "request": {
+                  "pascal_name": "GetOperationRequest"
+                }
+              },
+              "response_type": {}
+            }
+          },
+          {
+            "name": "UpdateFeature",
+            "description": "Update a Feature.",
+            "summary": "Update a feature's description (all other fields are immutable).",
+            "path": "/api/2.0/feature-engineering/features/{full_name}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateFeatureRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "full_name",
+                  "description": "The full three-part name (catalog, schema, name) of the feature.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "feature",
+                  "description": "Feature whose full_name identifies the target. Only description is mutable.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Feature",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Fields to update. The only supported path is description.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "full_name",
+                  "description": "The full three-part name (catalog, schema, name) of the feature.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Fields to update. The only supported path is description.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "feature",
+                  "description": "Feature whose full_name identifies the target. Only description is mutable.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Feature",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "feature",
+              "description": "Feature whose full_name identifies the target. Only description is mutable.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Feature",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "full_name",
+                    "description": "The full three-part name (catalog, schema, name) of the feature.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "source",
+                    "description": "The data source of the feature.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "DataSource",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "function",
+                    "description": "The function by which the feature is computed.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "Function",
+                      "is_object": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "full_name",
+                    "description": "The full three-part name (catalog, schema, name) of the feature.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "source",
+                    "description": "The data source of the feature.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "DataSource",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "function",
+                    "description": "The function by which the feature is computed.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "Function",
+                      "is_object": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "Feature",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "full_name",
+                  "description": "The full three-part name (catalog, schema, name) of the feature.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "source",
+                  "description": "The data source of the feature.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DataSource",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "function",
+                  "description": "The function by which the feature is computed.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Function",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "full_name",
+                  "description": "The full three-part name (catalog, schema, name) of the feature.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "source",
+                  "description": "The data source of the feature.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DataSource",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "function",
+                  "description": "The function by which the feature is computed.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Function",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "feature",
+                "description": "Feature whose full_name identifies the target. Only description is mutable.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Feature",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "full_name",
+                      "description": "The full three-part name (catalog, schema, name) of the feature.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "source",
+                      "description": "The data source of the feature.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "DataSource",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "function",
+                      "description": "The function by which the feature is computed.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "Function",
+                        "is_object": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "full_name",
+                      "description": "The full three-part name (catalog, schema, name) of the feature.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "source",
+                      "description": "The data source of the feature.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "DataSource",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "function",
+                      "description": "The function by which the feature is computed.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "Function",
+                        "is_object": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "full_name",
+                "description": "The full three-part name (catalog, schema, name) of the feature.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Fields to update. The only supported path is description.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "catalog_name",
+                "description": "Name of parent catalog.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "created_at",
+                "description": "Time at which this feature was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "created_by",
+                "description": "Username of the feature creator.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "The description of the feature.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "entities",
+                "description": "The entity columns for the feature, used as aggregation keys and for query-time lookup.\nOptional since entities are not set for RequestSource features or on-demand calculated features.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EntityColumnList",
+                  "array_value": {
+                    "pascal_name": "EntityColumn",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "filter_condition",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "full_name",
+                "description": "The full three-part name (catalog, schema, name) of the feature.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "function",
+                "description": "The function by which the feature is computed.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Function",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "inputs",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "lineage_context",
+                "description": "Lineage context information for this feature.\nWARNING: This field is primarily intended for internal use by Databricks systems and\nis automatically populated when features are created through Databricks notebooks or jobs.\nUsers should not manually set this field as incorrect values may lead to inaccurate lineage tracking or unexpected behavior.\nThis field will be set by feature-engineering client and should be left unset by SDK and terraform users.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "LineageContext",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the feature, extracted from the full three-part name (catalog.schema.name).",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schema_name",
+                "description": "Name of parent schema relative to its parent catalog.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "source",
+                "description": "The data source of the feature.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DataSource",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "time_window",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "TimeWindow",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "timeseries_column",
+                "description": "Column recording time, used for point-in-time joins, backfills, and aggregations.\nOptional since a timeseries column is not set for RequestSource features or on-demand\ncalculated features.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "TimeseriesColumn",
+                  "is_object": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "full_name",
+                "description": "The full three-part name (catalog, schema, name) of the feature.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Fields to update. The only supported path is description.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "source",
+                "description": "The data source of the feature.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DataSource",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "function",
+                "description": "The function by which the feature is computed.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Function",
+                  "is_object": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateKafkaConfig",
+            "description": "Update a Kafka config.\nDuring PrPr, Kafka configs can be read and used when creating features under the entire metastore.\nOnly the creator of the Kafka config can delete it.",
+            "summary": "Update a Kafka config.",
+            "path": "/api/2.0/feature-engineering/features/kafka-configs/{name}",
+            "can_use_json": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "UpdateKafkaConfigRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name that uniquely identifies this Kafka config within the metastore. This will be the identifier used from the Feature object to reference these configs for a feature.\nCan be distinct from topic name.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "kafka_config",
+                  "description": "The Kafka config to update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "KafkaConfig",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Name that uniquely identifies this Kafka config within the metastore. This will be the identifier used from the Feature object to reference these configs for a feature.\nCan be distinct from topic name.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "kafka_config",
+                  "description": "The Kafka config to update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "KafkaConfig",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "kafka_config",
+              "description": "The Kafka config to update.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "KafkaConfig",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "name",
+                    "description": "Name that uniquely identifies this Kafka config within the metastore. This will be the identifier used from the Feature object to reference these configs for a feature.\nCan be distinct from topic name.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "bootstrap_servers",
+                    "description": "A comma-separated list of host/port pairs pointing to Kafka cluster.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "subscription_mode",
+                    "description": "Options to configure which Kafka topics to pull data from.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "SubscriptionMode",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "auth_config",
+                    "description": "Authentication configuration for connection to topics.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "AuthConfig",
+                      "is_object": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "name",
+                    "description": "Name that uniquely identifies this Kafka config within the metastore. This will be the identifier used from the Feature object to reference these configs for a feature.\nCan be distinct from topic name.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "bootstrap_servers",
+                    "description": "A comma-separated list of host/port pairs pointing to Kafka cluster.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "subscription_mode",
+                    "description": "Options to configure which Kafka topics to pull data from.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "SubscriptionMode",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "auth_config",
+                    "description": "Authentication configuration for connection to topics.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "AuthConfig",
+                      "is_object": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "KafkaConfig",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name that uniquely identifies this Kafka config within the metastore. This will be the identifier used from the Feature object to reference these configs for a feature.\nCan be distinct from topic name.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "bootstrap_servers",
+                  "description": "A comma-separated list of host/port pairs pointing to Kafka cluster.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "subscription_mode",
+                  "description": "Options to configure which Kafka topics to pull data from.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "SubscriptionMode",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "auth_config",
+                  "description": "Authentication configuration for connection to topics.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AuthConfig",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Name that uniquely identifies this Kafka config within the metastore. This will be the identifier used from the Feature object to reference these configs for a feature.\nCan be distinct from topic name.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "bootstrap_servers",
+                  "description": "A comma-separated list of host/port pairs pointing to Kafka cluster.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "subscription_mode",
+                  "description": "Options to configure which Kafka topics to pull data from.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "SubscriptionMode",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "auth_config",
+                  "description": "Authentication configuration for connection to topics.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AuthConfig",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "kafka_config",
+                "description": "The Kafka config to update.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "KafkaConfig",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "name",
+                      "description": "Name that uniquely identifies this Kafka config within the metastore. This will be the identifier used from the Feature object to reference these configs for a feature.\nCan be distinct from topic name.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "bootstrap_servers",
+                      "description": "A comma-separated list of host/port pairs pointing to Kafka cluster.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "subscription_mode",
+                      "description": "Options to configure which Kafka topics to pull data from.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "SubscriptionMode",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "auth_config",
+                      "description": "Authentication configuration for connection to topics.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "AuthConfig",
+                        "is_object": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "name",
+                      "description": "Name that uniquely identifies this Kafka config within the metastore. This will be the identifier used from the Feature object to reference these configs for a feature.\nCan be distinct from topic name.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "bootstrap_servers",
+                      "description": "A comma-separated list of host/port pairs pointing to Kafka cluster.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "subscription_mode",
+                      "description": "Options to configure which Kafka topics to pull data from.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "SubscriptionMode",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "auth_config",
+                      "description": "Authentication configuration for connection to topics.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "AuthConfig",
+                        "is_object": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name that uniquely identifies this Kafka config within the metastore. This will be the identifier used from the Feature object to reference these configs for a feature.\nCan be distinct from topic name.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "auth_config",
+                "description": "Authentication configuration for connection to topics.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AuthConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "backfill_source",
+                "description": "A user-provided and managed source for backfilling data. Historical data is used when creating a training set from streaming features linked to this Kafka config.\nIn the future, a separate table will be maintained by Databricks for forward filling data.\nThe schema for this source must match exactly that of the key and value schemas specified for this Kafka config.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "BackfillSource",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "bootstrap_servers",
+                "description": "A comma-separated list of host/port pairs pointing to Kafka cluster.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "extra_options",
+                "description": "Catch-all for miscellaneous options. Keys should be source options or Kafka consumer options (kafka.*)",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "ingestion_config",
+                "description": "Configuration for ingesting Kafka data into a Databricks-managed\nDelta table.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "IngestionConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "key_schema",
+                "description": "Schema configuration for extracting message keys from topics. At least one of key_schema and value_schema must be provided.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "SchemaConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name that uniquely identifies this Kafka config within the metastore. This will be the identifier used from the Feature object to reference these configs for a feature.\nCan be distinct from topic name.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "subscription_mode",
+                "description": "Options to configure which Kafka topics to pull data from.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "SubscriptionMode",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "value_schema",
+                "description": "Schema configuration for extracting message values from topics. At least one of key_schema and value_schema must be provided.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "SchemaConfig",
+                  "is_object": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name that uniquely identifies this Kafka config within the metastore. This will be the identifier used from the Feature object to reference these configs for a feature.\nCan be distinct from topic name.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "bootstrap_servers",
+                "description": "A comma-separated list of host/port pairs pointing to Kafka cluster.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "subscription_mode",
+                "description": "Options to configure which Kafka topics to pull data from.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "SubscriptionMode",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "auth_config",
+                "description": "Authentication configuration for connection to topics.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AuthConfig",
+                  "is_object": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateMaterializedFeature",
+            "description": "Update a materialized feature (pause/resume).",
+            "summary": "Update a materialized feature.",
+            "path": "/api/2.0/feature-engineering/materialized-features/{materialized_feature_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateMaterializedFeatureRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "materialized_feature_id",
+                  "description": "Server-assigned unique identifier for the materialized feature.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "materialized_feature",
+                  "description": "The materialized feature to update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "MaterializedFeature",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Provide the materialization feature fields which should be updated.\nCurrently, only the pipeline_state field can be updated.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "materialized_feature_id",
+                  "description": "Server-assigned unique identifier for the materialized feature.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Provide the materialization feature fields which should be updated.\nCurrently, only the pipeline_state field can be updated.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "materialized_feature",
+                  "description": "The materialized feature to update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "MaterializedFeature",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "materialized_feature",
+              "description": "The materialized feature to update.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "MaterializedFeature",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "feature_name",
+                    "description": "The full name of the feature in Unity Catalog.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "feature_name",
+                    "description": "The full name of the feature in Unity Catalog.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "MaterializedFeature",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "feature_name",
+                  "description": "The full name of the feature in Unity Catalog.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "feature_name",
+                  "description": "The full name of the feature in Unity Catalog.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "materialized_feature",
+                "description": "The materialized feature to update.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "MaterializedFeature",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "feature_name",
+                      "description": "The full name of the feature in Unity Catalog.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "feature_name",
+                      "description": "The full name of the feature in Unity Catalog.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "materialized_feature_id",
+                "description": "Server-assigned unique identifier for the materialized feature.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Provide the materialization feature fields which should be updated.\nCurrently, only the pipeline_state field can be updated.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "budget_policy_id",
+                "description": "The ID of the budget policy used to attribute the serverless compute cost of this\nmaterialization. If not specified, a default budget policy may be applied.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "cron_schedule",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "cron_schedule_trigger",
+                "description": "A cron-based schedule trigger for the materialization pipeline.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CronSchedule",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "feature_name",
+                "description": "The full name of the feature in Unity Catalog.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "is_online",
+                "description": "True if this is an online materialized feature. False if it is an offline materialized feature.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "job_id",
+                "description": "The ID of the job that materializes the feature. This is present for both batch and streaming features.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "last_materialization_time",
+                "description": "The timestamp when the pipeline last ran and updated the materialized feature values.\nIf the pipeline has not run yet, this field will be null.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "latest_backfill_operation",
+                "description": "Name of the latest backfill operation on this materialized feature. Format: operations/{operation_id}.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "materialized_feature_id",
+                "description": "Server-assigned unique identifier for the materialized feature.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "notifications",
+                "description": "Notification configuration around the materialization job or pipeline lifecycle. They are\napplied to every job and pipeline that materializes this feature. Features which are\nmaterialized in the same pipeline will share the same notification.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "MaterializationNotifications",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "offline_store_config",
+                "description": "Destination for writing feature values to an offline Delta table. The resulting table is\nreturned as `table_name`.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "OfflineStoreConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "online_store_config",
+                "description": "Destination for writing feature values to an online Lakebase table. The resulting table is\nreturned as `table_name`.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "OnlineStoreConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "pipeline_id",
+                "description": "The ID of the pipeline that materializes this feature. This is only present for streaming features.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "pipeline_schedule_state",
+                "description": "The schedule state of the materialization pipeline.\nHidden from GraphQL: being deprecated, so not exposed to Catalog Explorer.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "MaterializedFeaturePipelineScheduleState",
+                  "enum": [
+                    {
+                      "content": "ACTIVE"
+                    },
+                    {
+                      "content": "PAUSED"
+                    },
+                    {
+                      "content": "SNAPSHOT"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "streaming_mode",
+                "description": "The Structured Streaming trigger mode used for materialization. Real-time mode (RTM) targets\nsub-second latency for operational workloads; micro-batch mode (MBM) favors cost efficiency\nfor ETL and analytics workloads.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "StreamingMode",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "table_name",
+                "description": "The fully qualified Unity Catalog path to the table containing the materialized feature (Delta table or Lakebase table). Output only.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "table_trigger",
+                "description": "A trigger that fires when the upstream source table changes.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "TableTrigger",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "tags",
+                "description": "Custom tags to associate with this materialization. They are applied to the materialization\njob (for batch features) or pipeline (for streaming features) and forwarded to the underlying\ncompute as cluster tags, so materialization cost can be attributed in the billing system\ntables. These tags apply only to the materialization compute; they are not applied to the\nUnity Catalog Feature resource itself, whose tags are managed separately through the Unity\nCatalog tagging API. A maximum of 25 tags is supported; keys and values are subject to the\nsame limitations as cluster tags.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "materialized_feature_id",
+                "description": "Server-assigned unique identifier for the materialized feature.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Provide the materialization feature fields which should be updated.\nCurrently, only the pipeline_state field can be updated.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "feature_name",
+                "description": "The full name of the feature in Unity Catalog.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateStream",
+            "description": "Update a Stream. Only fields listed in `update_mask` are mutated.",
+            "summary": "Update a Stream.",
+            "path": "/api/2.0/feature-engineering/streams/{name}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateStreamRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Full three-part (catalog.schema.stream) name of the stream.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "stream",
+                  "description": "The Stream to update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Stream",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Full three-part (catalog.schema.stream) name of the stream.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "stream",
+                  "description": "The Stream to update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Stream",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "stream",
+              "description": "The Stream to update.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Stream",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "name",
+                    "description": "Full three-part (catalog.schema.stream) name of the stream.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "source_config",
+                    "description": "Source-specific configuration. Determines the streaming platform source.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "StreamSourceConfig",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "connection_config",
+                    "description": "Specifies how to connect and authenticate to the stream platform.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "StreamConnectionConfig",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "schema_config",
+                    "description": "Schema definitions for the stream, provided either directly on the Stream or\nresolved from an external schema registry through a UC Connection.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "StreamSchemaConfig",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "ingestion_config",
+                    "description": "Configuration for streaming data ingestion: the managed table storing an offline copy of forward fill data and optional historical backfill.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "IngestionConfig",
+                      "is_object": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "name",
+                    "description": "Full three-part (catalog.schema.stream) name of the stream.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "source_config",
+                    "description": "Source-specific configuration. Determines the streaming platform source.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "StreamSourceConfig",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "connection_config",
+                    "description": "Specifies how to connect and authenticate to the stream platform.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "StreamConnectionConfig",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "schema_config",
+                    "description": "Schema definitions for the stream, provided either directly on the Stream or\nresolved from an external schema registry through a UC Connection.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "StreamSchemaConfig",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "ingestion_config",
+                    "description": "Configuration for streaming data ingestion: the managed table storing an offline copy of forward fill data and optional historical backfill.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "IngestionConfig",
+                      "is_object": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "Stream",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Full three-part (catalog.schema.stream) name of the stream.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "source_config",
+                  "description": "Source-specific configuration. Determines the streaming platform source.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "StreamSourceConfig",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "connection_config",
+                  "description": "Specifies how to connect and authenticate to the stream platform.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "StreamConnectionConfig",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "schema_config",
+                  "description": "Schema definitions for the stream, provided either directly on the Stream or\nresolved from an external schema registry through a UC Connection.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "StreamSchemaConfig",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "ingestion_config",
+                  "description": "Configuration for streaming data ingestion: the managed table storing an offline copy of forward fill data and optional historical backfill.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "IngestionConfig",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Full three-part (catalog.schema.stream) name of the stream.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "source_config",
+                  "description": "Source-specific configuration. Determines the streaming platform source.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "StreamSourceConfig",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "connection_config",
+                  "description": "Specifies how to connect and authenticate to the stream platform.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "StreamConnectionConfig",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "schema_config",
+                  "description": "Schema definitions for the stream, provided either directly on the Stream or\nresolved from an external schema registry through a UC Connection.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "StreamSchemaConfig",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "ingestion_config",
+                  "description": "Configuration for streaming data ingestion: the managed table storing an offline copy of forward fill data and optional historical backfill.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "IngestionConfig",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Full three-part (catalog.schema.stream) name of the stream.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "stream",
+                "description": "The Stream to update.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Stream",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "name",
+                      "description": "Full three-part (catalog.schema.stream) name of the stream.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "source_config",
+                      "description": "Source-specific configuration. Determines the streaming platform source.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "StreamSourceConfig",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "connection_config",
+                      "description": "Specifies how to connect and authenticate to the stream platform.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "StreamConnectionConfig",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "schema_config",
+                      "description": "Schema definitions for the stream, provided either directly on the Stream or\nresolved from an external schema registry through a UC Connection.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "StreamSchemaConfig",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "ingestion_config",
+                      "description": "Configuration for streaming data ingestion: the managed table storing an offline copy of forward fill data and optional historical backfill.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "IngestionConfig",
+                        "is_object": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "name",
+                      "description": "Full three-part (catalog.schema.stream) name of the stream.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "source_config",
+                      "description": "Source-specific configuration. Determines the streaming platform source.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "StreamSourceConfig",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "connection_config",
+                      "description": "Specifies how to connect and authenticate to the stream platform.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "StreamConnectionConfig",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "schema_config",
+                      "description": "Schema definitions for the stream, provided either directly on the Stream or\nresolved from an external schema registry through a UC Connection.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "StreamSchemaConfig",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "ingestion_config",
+                      "description": "Configuration for streaming data ingestion: the managed table storing an offline copy of forward fill data and optional historical backfill.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "IngestionConfig",
+                        "is_object": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "browse_only",
+                "description": "Indicates whether the principal is limited to retrieving metadata for the\nassociated object through the BROWSE privilege when include_browse is enabled in the request.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "connection_config",
+                "description": "Specifies how to connect and authenticate to the stream platform.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "StreamConnectionConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Time at which this Stream was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "created_by",
+                "description": "Username of the Stream creator.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "User-provided description.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "excluded_columns",
+                "description": "Column paths (dot notation, e.g. \"value.email\" for Kafka) to drop.\nA path may reference a struct, in which case all of its nested fields are dropped (e.g. \"value.address\" drops \"value.address.city\" and \"value.address.zip\").\nThese columns are not written to the ingestion table and cannot be referenced by any feature.\nThey are dropped from ingestion, backfill, and materialization.\nFor direct schemas, each column must exist in the relevant key or payload schema. With a schema registry, a column can be excluded before it exists.\nA column cannot also be a deduplication column in the ingestion_config.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "ingestion_config",
+                "description": "Configuration for streaming data ingestion: the managed table storing an offline copy of forward fill data and optional historical backfill.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "IngestionConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Full three-part (catalog.schema.stream) name of the stream.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "record_type_filter",
+                "description": "Optional SQL predicate to filter which record types from a streaming channel (e.g. a topic for Kafka) belong to this Stream.\nEvents that do not match are not written to the ingestion table and are not used in materialization.\nExample: \"value.event_type = 'transaction'\".",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schema_config",
+                "description": "Schema definitions for the stream, provided either directly on the Stream or\nresolved from an external schema registry through a UC Connection.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "StreamSchemaConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "source_config",
+                "description": "Source-specific configuration. Determines the streaming platform source.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "StreamSourceConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "Time at which this Stream was last modified.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "updated_by",
+                "description": "Username of user who last modified the Stream.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Full three-part (catalog.schema.stream) name of the stream.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "source_config",
+                "description": "Source-specific configuration. Determines the streaming platform source.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "StreamSourceConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "connection_config",
+                "description": "Specifies how to connect and authenticate to the stream platform.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "StreamConnectionConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "schema_config",
+                "description": "Schema definitions for the stream, provided either directly on the Stream or\nresolved from an external schema registry through a UC Connection.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "StreamSchemaConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "ingestion_config",
+                "description": "Configuration for streaming data ingestion: the managed table storing an offline copy of forward fill data and optional historical backfill.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "IngestionConfig",
+                  "is_object": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "ml.FeatureStore",
+        "name": "FeatureStore",
+        "description": "A feature store is a centralized repository that enables data scientists to find and share features. Using a feature store also ensures that the code used to compute feature values is the same during model training and when the model is used for inference.\n\nAn online store is a low-latency database used for feature lookup during real-time model inference or serve feature for real-time applications.",
+        "package": {
+          "name": "ml"
+        },
+        "is_hidden_cli": true,
+        "docs_group": "ml",
+        "launch_stage": "PRIVATE_PREVIEW",
+        "cli_launch_stage_display": "Private Preview",
+        "list": {
+          "request": {
+            "pascal_name": "ListOnlineStoresRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "CreateOnlineStore",
+            "description": "Create an Online Feature Store.",
+            "summary": "Create an Online Feature Store.",
+            "path": "/api/2.0/feature-store/online-stores",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "CreateOnlineStoreRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "online_store",
+                  "description": "Online store to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "OnlineStore",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "online_store",
+                  "description": "Online store to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "OnlineStore",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "online_store",
+              "description": "Online store to create.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "OnlineStore",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "name",
+                    "description": "The name of the online store. This is the unique identifier for the online store.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "capacity",
+                    "description": "The capacity of the online store. Valid values are \"CU_1\", \"CU_2\", \"CU_4\", \"CU_8\".",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "name",
+                    "description": "The name of the online store. This is the unique identifier for the online store.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "capacity",
+                    "description": "The capacity of the online store. Valid values are \"CU_1\", \"CU_2\", \"CU_4\", \"CU_8\".",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "OnlineStore",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the online store. This is the unique identifier for the online store.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "capacity",
+                  "description": "The capacity of the online store. Valid values are \"CU_1\", \"CU_2\", \"CU_4\", \"CU_8\".",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the online store. This is the unique identifier for the online store.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "capacity",
+                  "description": "The capacity of the online store. Valid values are \"CU_1\", \"CU_2\", \"CU_4\", \"CU_8\".",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "online_store",
+                "description": "Online store to create.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "OnlineStore",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "name",
+                      "description": "The name of the online store. This is the unique identifier for the online store.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "capacity",
+                      "description": "The capacity of the online store. Valid values are \"CU_1\", \"CU_2\", \"CU_4\", \"CU_8\".",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "name",
+                      "description": "The name of the online store. This is the unique identifier for the online store.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "capacity",
+                      "description": "The capacity of the online store. Valid values are \"CU_1\", \"CU_2\", \"CU_4\", \"CU_8\".",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "capacity",
+                "description": "The capacity of the online store. Valid values are \"CU_1\", \"CU_2\", \"CU_4\", \"CU_8\".",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "creation_time",
+                "description": "The timestamp when the online store was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "creator",
+                "description": "The email of the creator of the online store.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the online store. This is the unique identifier for the online store.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "read_replica_count",
+                "description": "The number of read replicas for the online store. Defaults to 0.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "state",
+                "description": "The current state of the online store.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "OnlineStoreState",
+                  "enum": [
+                    {
+                      "content": "AVAILABLE"
+                    },
+                    {
+                      "content": "DELETING"
+                    },
+                    {
+                      "content": "FAILING_OVER"
+                    },
+                    {
+                      "content": "STARTING"
+                    },
+                    {
+                      "content": "STOPPED"
+                    },
+                    {
+                      "content": "UPDATING"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "usage_policy_id",
+                "description": "The usage policy applied to the online store to track billing.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the online store. This is the unique identifier for the online store.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "capacity",
+                "description": "The capacity of the online store. Valid values are \"CU_1\", \"CU_2\", \"CU_4\", \"CU_8\".",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteOnlineStore",
+            "description": "Delete an Online Feature Store.",
+            "summary": "Delete an Online Feature Store.",
+            "path": "/api/2.0/feature-store/online-stores/{name}",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "DeleteOnlineStoreRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the online store to delete.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the online store to delete.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Name of the online store to delete.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the online store to delete.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteOnlineTable",
+            "description": "Delete online table.",
+            "summary": "Delete an online table.",
+            "path": "/api/2.0/feature-store/online-tables/{online_table_name}",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "DeleteOnlineTableRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "online_table_name",
+                  "description": "The full three-part (catalog, schema, table) name of the online table.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "online_table_name",
+                  "description": "The full three-part (catalog, schema, table) name of the online table.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "online_table_name",
+                "description": "The full three-part (catalog, schema, table) name of the online table.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "online_table_name",
+                "description": "The full three-part (catalog, schema, table) name of the online table.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetOnlineStore",
+            "description": "Get an Online Feature Store.",
+            "summary": "Get an Online Feature Store.",
+            "path": "/api/2.0/feature-store/online-stores/{name}",
+            "is_crud_read": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "GetOnlineStoreRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the online store to get.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the online store to get.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "OnlineStore",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the online store. This is the unique identifier for the online store.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "capacity",
+                  "description": "The capacity of the online store. Valid values are \"CU_1\", \"CU_2\", \"CU_4\", \"CU_8\".",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the online store. This is the unique identifier for the online store.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "capacity",
+                  "description": "The capacity of the online store. Valid values are \"CU_1\", \"CU_2\", \"CU_4\", \"CU_8\".",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Name of the online store to get.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the online store to get.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListOnlineStores",
+            "description": "List Online Feature Stores.",
+            "summary": "List Online Feature Stores.",
+            "path": "/api/2.0/feature-store/online-stores",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "ListOnlineStoresRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListOnlineStoresResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "The maximum number of results to return. Defaults to 100 if not specified.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Pagination token to go to the next page based on a previous query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Pagination token to go to the next page based on a previous query.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "PublishTable",
+            "description": "Publish features.",
+            "summary": "Publish features.",
+            "path": "/api/2.0/feature-store/tables/{source_table_name}/publish",
+            "can_use_json": true,
+            "must_use_json": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "PublishTableRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "source_table_name",
+                  "description": "The full three-part (catalog, schema, table) name of the source table.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "publish_spec",
+                  "description": "The specification for publishing the online table from the source table.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PublishSpec",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "source_table_name",
+                  "description": "The full three-part (catalog, schema, table) name of the source table.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "publish_spec",
+                  "description": "The specification for publishing the online table from the source table.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PublishSpec",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "PublishTableResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "publish_spec",
+                "description": "The specification for publishing the online table from the source table.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PublishSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "source_table_name",
+                "description": "The full three-part (catalog, schema, table) name of the source table.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "source_table_name",
+                "description": "The full three-part (catalog, schema, table) name of the source table.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateOnlineStore",
+            "description": "Update an Online Feature Store.\n\nThis update is not guaranteed to be atomic: when a request changes multiple fields, some may\nbe applied while others fail. On a failed response, treat the update as partially applied and\nretry until it succeeds.",
+            "summary": "Update an Online Feature Store.",
+            "path": "/api/2.0/feature-store/online-stores/{name}",
+            "can_use_json": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "UpdateOnlineStoreRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the online store. This is the unique identifier for the online store.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "online_store",
+                  "description": "Online store to update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "OnlineStore",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the online store. This is the unique identifier for the online store.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "online_store",
+                  "description": "Online store to update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "OnlineStore",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "online_store",
+              "description": "Online store to update.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "OnlineStore",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "name",
+                    "description": "The name of the online store. This is the unique identifier for the online store.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "capacity",
+                    "description": "The capacity of the online store. Valid values are \"CU_1\", \"CU_2\", \"CU_4\", \"CU_8\".",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "name",
+                    "description": "The name of the online store. This is the unique identifier for the online store.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "capacity",
+                    "description": "The capacity of the online store. Valid values are \"CU_1\", \"CU_2\", \"CU_4\", \"CU_8\".",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "OnlineStore",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the online store. This is the unique identifier for the online store.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "capacity",
+                  "description": "The capacity of the online store. Valid values are \"CU_1\", \"CU_2\", \"CU_4\", \"CU_8\".",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the online store. This is the unique identifier for the online store.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "capacity",
+                  "description": "The capacity of the online store. Valid values are \"CU_1\", \"CU_2\", \"CU_4\", \"CU_8\".",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The name of the online store. This is the unique identifier for the online store.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "online_store",
+                "description": "Online store to update.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "OnlineStore",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "name",
+                      "description": "The name of the online store. This is the unique identifier for the online store.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "capacity",
+                      "description": "The capacity of the online store. Valid values are \"CU_1\", \"CU_2\", \"CU_4\", \"CU_8\".",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "name",
+                      "description": "The name of the online store. This is the unique identifier for the online store.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "capacity",
+                      "description": "The capacity of the online store. Valid values are \"CU_1\", \"CU_2\", \"CU_4\", \"CU_8\".",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "capacity",
+                "description": "The capacity of the online store. Valid values are \"CU_1\", \"CU_2\", \"CU_4\", \"CU_8\".",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "creation_time",
+                "description": "The timestamp when the online store was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "creator",
+                "description": "The email of the creator of the online store.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the online store. This is the unique identifier for the online store.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "read_replica_count",
+                "description": "The number of read replicas for the online store. Defaults to 0.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "state",
+                "description": "The current state of the online store.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "OnlineStoreState",
+                  "enum": [
+                    {
+                      "content": "AVAILABLE"
+                    },
+                    {
+                      "content": "DELETING"
+                    },
+                    {
+                      "content": "FAILING_OVER"
+                    },
+                    {
+                      "content": "STARTING"
+                    },
+                    {
+                      "content": "STOPPED"
+                    },
+                    {
+                      "content": "UPDATING"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "usage_policy_id",
+                "description": "The usage policy applied to the online store to track billing.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the online store. This is the unique identifier for the online store.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "capacity",
+                "description": "The capacity of the online store. Valid values are \"CU_1\", \"CU_2\", \"CU_4\", \"CU_8\".",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "oauth2.AccountFederationPolicy",
+        "name": "AccountFederationPolicy",
+        "description": "These APIs manage account federation policies.\n\nAccount federation policies allow users and service principals in your Databricks account to securely access Databricks APIs using tokens from your trusted identity providers (IdPs).\n\nWith token federation, your users and service principals can exchange tokens from your IdP for Databricks OAuth tokens, which can be used to access Databricks APIs. Token federation eliminates the need to manage Databricks secrets, and allows you to centralize management of token issuance policies in your IdP. Databricks token federation is typically used in combination with [SCIM](https://docs.databricks.com/admin/users-groups/scim/index.html), so users in your IdP are synchronized into your Databricks account.\n\nToken federation is configured in your Databricks account using an account federation policy. An account federation policy specifies:\n* which IdP, or issuer, your Databricks account should accept tokens from\n* how to determine which Databricks user, or subject, a token is issued for\n\nTo configure a federation policy, you provide the following:\n* The required token __issuer__, as specified in the “iss” claim of your tokens. The issuer is an https URL that identifies your IdP.\n* The allowed token __audiences__, as specified in the “aud” claim of your tokens. This identifier is intended to represent the recipient of the token. As long as the audience in the token matches at least one audience in the policy, the token is considered a match. If unspecified, the default value is your Databricks account id.\n* The __subject claim__, which indicates which token claim contains the Databricks username of the user the token was issued for. If unspecified, the default value is “sub”.\n* Optionally, the public keys used to validate the signature of your tokens, in JWKS format. If unspecified (recommended), Databricks automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys.\n\nAn example federation policy is:\n```\nissuer: \"https://idp.mycompany.com/oidc\"\naudiences: [\"databricks\"]\nsubject_claim: \"sub\"\n```\n\nAn example JWT token body that matches this policy and could be used to authenticate to Databricks as user `username@mycompany.com` is:\n```\n{\n\"iss\": \"https://idp.mycompany.com/oidc\",\n\"aud\": \"databricks\",\n\"sub\": \"username@mycompany.com\"\n}\n```\n\nYou may also need to configure your IdP to generate tokens for your users to exchange with Databricks, if your users do not already have the ability to generate tokens that are compatible with your federation policy.\n\nYou do not need to configure an OAuth application in Databricks to use token federation.",
+        "package": {
+          "name": "oauth2"
+        },
+        "is_accounts": true,
+        "docs_group": "oauth2",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListAccountFederationPoliciesRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Create account federation policy.",
+            "summary": "Create account federation policy.",
+            "path": "/api/2.0/accounts/{account_id}/federationPolicies",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateAccountFederationPolicyRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "policy",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "FederationPolicy",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "policy",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "FederationPolicy",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "policy",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "FederationPolicy",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "FederationPolicy",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "policy",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "FederationPolicy",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "policy_id",
+                "description": "The identifier for the federation policy. The identifier must contain only lowercase\nalphanumeric characters, numbers, hyphens, and slashes. If unspecified, the id will be\nassigned by Databricks.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Creation time of the federation policy.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "Description of the federation policy.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name for the federation policy. Example values include\n`accounts/\u003caccount-id\u003e/federationPolicies/my-federation-policy` for Account Federation Policies, and\n`accounts/\u003caccount-id\u003e/servicePrincipals/\u003cservice-principal-id\u003e/federationPolicies/my-federation-policy`\nfor Service Principal Federation Policies. Typically an output parameter, which does not need to be\nspecified in create or update requests. If specified in a request, must match the value in the\nrequest URL.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "oidc_policy",
+                "description": "audit_mode INCLUDE is required on both this message field and its leaf fields so the OIDC\npolicy configuration is captured in create/update audit logs (see go/auditlogs).",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "OidcFederationPolicy",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "policy_id",
+                "description": "The ID of the federation policy. Output only.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "service_principal_id",
+                "description": "The service principal ID that this federation policy applies to. Output only. Only set for service principal federation policies.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "uid",
+                "description": "Unique, immutable id of the federation policy.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "Last update time of the federation policy.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Delete account federation policy.",
+            "summary": "Delete account federation policy.",
+            "path": "/api/2.0/accounts/{account_id}/federationPolicies/{policy_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteAccountFederationPolicyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "policy_id",
+                  "description": "The identifier for the federation policy.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "policy_id",
+                  "description": "The identifier for the federation policy.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "policy_id",
+                "description": "The identifier for the federation policy.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "policy_id",
+                "description": "The identifier for the federation policy.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Get account federation policy.",
+            "summary": "Get account federation policy.",
+            "path": "/api/2.0/accounts/{account_id}/federationPolicies/{policy_id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetAccountFederationPolicyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "policy_id",
+                  "description": "The identifier for the federation policy.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "policy_id",
+                  "description": "The identifier for the federation policy.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "FederationPolicy",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "policy_id",
+                "description": "The identifier for the federation policy.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "policy_id",
+                "description": "The identifier for the federation policy.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "List account federation policies.",
+            "summary": "List account federation policies.",
+            "path": "/api/2.0/accounts/{account_id}/federationPolicies",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListAccountFederationPoliciesRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListFederationPoliciesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "Update",
+            "description": "Update account federation policy.",
+            "summary": "Update account federation policy.",
+            "path": "/api/2.0/accounts/{account_id}/federationPolicies/{policy_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateAccountFederationPolicyRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "policy_id",
+                  "description": "The identifier for the federation policy.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "policy",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "FederationPolicy",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "policy_id",
+                  "description": "The identifier for the federation policy.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "policy",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "FederationPolicy",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "policy",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "FederationPolicy",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "FederationPolicy",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "policy",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "FederationPolicy",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "policy_id",
+                "description": "The identifier for the federation policy.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The field mask specifies which fields of the policy to update. To specify multiple fields\nin the field mask, use comma as the separator (no space). The special value '*' indicates\nthat all fields should be updated (full replacement). If unspecified, all fields that are\nset in the policy provided in the update request will overwrite the corresponding fields\nin the existing policy. Example value: 'description,oidc_policy.audiences'.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Creation time of the federation policy.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "Description of the federation policy.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name for the federation policy. Example values include\n`accounts/\u003caccount-id\u003e/federationPolicies/my-federation-policy` for Account Federation Policies, and\n`accounts/\u003caccount-id\u003e/servicePrincipals/\u003cservice-principal-id\u003e/federationPolicies/my-federation-policy`\nfor Service Principal Federation Policies. Typically an output parameter, which does not need to be\nspecified in create or update requests. If specified in a request, must match the value in the\nrequest URL.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "oidc_policy",
+                "description": "audit_mode INCLUDE is required on both this message field and its leaf fields so the OIDC\npolicy configuration is captured in create/update audit logs (see go/auditlogs).",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "OidcFederationPolicy",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "policy_id",
+                "description": "The ID of the federation policy. Output only.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "service_principal_id",
+                "description": "The service principal ID that this federation policy applies to. Output only. Only set for service principal federation policies.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "uid",
+                "description": "Unique, immutable id of the federation policy.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "Last update time of the federation policy.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "policy_id",
+                "description": "The identifier for the federation policy.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "files.Files",
+        "name": "Files",
+        "description": "The Files API is a standard HTTP API that allows you to read, write, list, and delete files and directories by\nreferring to their URI. The API makes working with file content as raw bytes easier and more efficient.\n\nThe API supports [Unity Catalog volumes](https://docs.databricks.com/en/connect/unity-catalog/volumes.html), where files and directories to operate on are specified using their\nvolume URI path, which follows the format /Volumes/\u0026lt;catalog_name\u0026gt;/\u0026lt;schema_name\u0026gt;/\u0026lt;volume_name\u0026gt;/\u0026lt;path_to_file\u0026gt;.\n\nThe Files API has two distinct endpoints, one for working with files (`/fs/files`) and another one for working\nwith directories (`/fs/directories`). Both endpoints use the standard HTTP methods GET, HEAD, PUT, and DELETE to\nmanage files and directories specified using their URI path. The path is always absolute.\n\nUse of Files API may incur Databricks data transfer charges.",
+        "package": {
+          "name": "files"
+        },
+        "docs_group": "files",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "list": {
+          "request": {
+            "pascal_name": "ListDirectoryContentsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "CreateDirectory",
+            "description": "Creates an empty directory. If necessary, also creates any parent directories of the\nnew, empty directory (like the shell command `mkdir -p`). If called on an existing\ndirectory, returns a success response; this method is idempotent (it will succeed if the directory already\nexists).",
+            "summary": "Create a directory.",
+            "path": "/api/2.0/fs/directories{directory_path}",
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "CreateDirectoryRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "directory_path",
+                  "description": "The absolute path of a directory.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "directory_path",
+                  "description": "The absolute path of a directory.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "directory_path",
+                "description": "The absolute path of a directory.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "directory_path",
+                "description": "The absolute path of a directory.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes a file. If the request is successful, there is no response body.",
+            "summary": "Delete a file.",
+            "path": "/api/2.0/fs/files{file_path}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "DeleteFileRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "file_path",
+                  "description": "The absolute path of the file.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "file_path",
+                  "description": "The absolute path of the file.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "file_path",
+                "description": "The absolute path of the file.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "file_path",
+                "description": "The absolute path of the file.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteDirectory",
+            "description": "Deletes an empty directory.\n\nTo delete a non-empty directory, first delete all of its contents. This can be done\nby listing the directory contents and deleting each file and subdirectory recursively.",
+            "summary": "Delete a directory.",
+            "path": "/api/2.0/fs/directories{directory_path}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "DeleteDirectoryRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "directory_path",
+                  "description": "The absolute path of a directory.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "directory_path",
+                  "description": "The absolute path of a directory.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "directory_path",
+                "description": "The absolute path of a directory.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "directory_path",
+                "description": "The absolute path of a directory.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Download",
+            "description": "Downloads a file. The file contents are the response body. This is a\nstandard HTTP file download, not a JSON RPC. It supports the\nRange and If-Unmodified-Since HTTP headers.",
+            "summary": "Download a file.",
+            "path": "/api/2.0/fs/files{file_path}",
+            "is_crud_read": true,
+            "is_response_byte_stream": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "DownloadRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "file_path",
+                  "description": "The absolute path of the file.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "file_path",
+                  "description": "The absolute path of the file.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DownloadResponse",
+              "is_object": true
+            },
+            "response_body_field": {
+              "pascal_name": "Contents"
+            },
+            "all_fields": [
+              {
+                "name": "file_path",
+                "description": "The absolute path of the file.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "file_path",
+                "description": "The absolute path of the file.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetDirectoryMetadata",
+            "description": "Get the metadata of a directory. The response HTTP headers contain the metadata.\nThere is no response body.\n\nThis method is useful to check if a directory exists and the caller has access to it.\n\nIf you wish to ensure the directory exists, you can instead use `PUT`, which will create\nthe directory if it does not exist, and is idempotent (it will succeed if the directory\nalready exists).",
+            "summary": "Get directory metadata.",
+            "path": "/api/2.0/fs/directories{directory_path}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetDirectoryMetadataRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "directory_path",
+                  "description": "The absolute path of a directory.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "directory_path",
+                  "description": "The absolute path of a directory.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "directory_path",
+                "description": "The absolute path of a directory.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "directory_path",
+                "description": "The absolute path of a directory.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetMetadata",
+            "description": "Get the metadata of a file. The response HTTP headers contain the metadata. There is no\nresponse body.",
+            "summary": "Get file metadata.",
+            "path": "/api/2.0/fs/files{file_path}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetMetadataRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "file_path",
+                  "description": "The absolute path of the file.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "file_path",
+                  "description": "The absolute path of the file.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetMetadataResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "file_path",
+                "description": "The absolute path of the file.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "file_path",
+                "description": "The absolute path of the file.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListDirectoryContents",
+            "description": "Returns the contents of a directory.\nIf there is no directory at the specified path, the API returns an HTTP 404 error.",
+            "summary": "List directory contents.",
+            "path": "/api/2.0/fs/directories{directory_path}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "ListDirectoryContentsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "directory_path",
+                  "description": "The absolute path of a directory.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "directory_path",
+                  "description": "The absolute path of a directory.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListDirectoryResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "directory_path",
+                "description": "The absolute path of a directory.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "The maximum number of directory entries to return. The response may contain fewer\nentries. If the response contains a `next_page_token`, there may be more entries,\neven if fewer than `page_size` entries are in the response.\n\nWe recommend not to set this value unless you are intentionally listing less than\nthe complete directory contents.\n\nIf unspecified, at most 1000 directory entries will be returned.\nThe maximum value is 1000. Values above 1000 will be coerced to 1000.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "An opaque page token which was the `next_page_token` in the response of the previous\nrequest to list the contents of this directory. Provide this token to retrieve the\nnext page of directory entries.\nWhen providing a `page_token`, all other parameters provided to the request must match\nthe previous request.\nTo list all of the entries in a directory, it is necessary to continue requesting\npages of entries until the response contains no `next_page_token`. Note that the\nnumber of entries returned must not be used to determine when the listing is complete.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "directory_path",
+                "description": "The absolute path of a directory.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "An opaque page token which was the `next_page_token` in the response of the previous\nrequest to list the contents of this directory. Provide this token to retrieve the\nnext page of directory entries.\nWhen providing a `page_token`, all other parameters provided to the request must match\nthe previous request.\nTo list all of the entries in a directory, it is necessary to continue requesting\npages of entries until the response contains no `next_page_token`. Note that the\nnumber of entries returned must not be used to determine when the listing is complete.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "Upload",
+            "description": "Uploads a file of up to 5 GiB. The file contents should be sent as the request body as\nraw bytes (an octet stream); do not encode or otherwise modify the bytes before sending.\nThe contents of the resulting file will be exactly the bytes sent in the request body.\nIf the request is successful, there is no response body.",
+            "summary": "Upload a file.",
+            "path": "/api/2.0/fs/files{file_path}",
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "UploadRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "file_path",
+                  "description": "The absolute path of the file.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "contents",
+                  "required": true,
+                  "entity": {}
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "file_path",
+                  "description": "The absolute path of the file.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "contents",
+              "required": true,
+              "entity": {}
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "contents",
+                "required": true,
+                "entity": {}
+              },
+              {
+                "name": "file_path",
+                "description": "The absolute path of the file.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "overwrite",
+                "description": "If true or unspecified, an existing file will be overwritten. If false, an error will be returned if the path points to an existing file.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "file_path",
+                "description": "The absolute path of the file.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "ml.Forecasting",
+        "name": "Forecasting",
+        "description": "The Forecasting API allows you to create and get serverless forecasting experiments",
+        "package": {
+          "name": "ml"
+        },
+        "is_hidden_cli": true,
+        "docs_group": "ml",
+        "launch_stage": "PRIVATE_PREVIEW",
+        "cli_launch_stage_display": "Private Preview",
+        "methods": [
+          {
+            "name": "CreateExperiment",
+            "description": "Creates a serverless forecasting experiment. Returns the experiment ID.",
+            "summary": "Create a forecasting experiment.",
+            "path": "/api/2.0/automl/create-forecasting-experiment",
+            "can_use_json": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "CreateForecastingExperimentRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "train_data_path",
+                  "description": "The fully qualified path of a Unity Catalog table, formatted as catalog_name.schema_name.table_name, used as training data for the forecasting model.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "target_column",
+                  "description": "The column in the input training table used as the prediction target for model training. The values in this column are used as the ground truth for model training.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "time_column",
+                  "description": "The column in the input training table that represents each row's timestamp.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "forecast_granularity",
+                  "description": "The time interval between consecutive rows in the time series data.\nPossible values include: '1 second', '1 minute', '5 minutes', '10 minutes', '15 minutes', '30 minutes', 'Hourly', 'Daily', 'Weekly', 'Monthly', 'Quarterly', 'Yearly'.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "forecast_horizon",
+                  "description": "The number of time steps into the future to make predictions, calculated as a multiple of forecast_granularity. This value represents how far ahead the model should forecast.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "train_data_path",
+                  "description": "The fully qualified path of a Unity Catalog table, formatted as catalog_name.schema_name.table_name, used as training data for the forecasting model.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "target_column",
+                  "description": "The column in the input training table used as the prediction target for model training. The values in this column are used as the ground truth for model training.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "time_column",
+                  "description": "The column in the input training table that represents each row's timestamp.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "forecast_granularity",
+                  "description": "The time interval between consecutive rows in the time series data.\nPossible values include: '1 second', '1 minute', '5 minutes', '10 minutes', '15 minutes', '30 minutes', 'Hourly', 'Daily', 'Weekly', 'Monthly', 'Quarterly', 'Yearly'.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "forecast_horizon",
+                  "description": "The number of time steps into the future to make predictions, calculated as a multiple of forecast_granularity. This value represents how far ahead the model should forecast.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CreateForecastingExperimentResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "custom_weights_column",
+                "description": "The column in the training table used to customize weights for each time series.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "experiment_path",
+                "description": "The path in the workspace to store the created experiment.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "forecast_granularity",
+                "description": "The time interval between consecutive rows in the time series data.\nPossible values include: '1 second', '1 minute', '5 minutes', '10 minutes', '15 minutes', '30 minutes', 'Hourly', 'Daily', 'Weekly', 'Monthly', 'Quarterly', 'Yearly'.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "forecast_horizon",
+                "description": "The number of time steps into the future to make predictions, calculated as a multiple of forecast_granularity. This value represents how far ahead the model should forecast.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "future_feature_data_path",
+                "description": "The fully qualified path of a Unity Catalog table, formatted as catalog_name.schema_name.table_name, used to store future feature data for predictions.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "holiday_regions",
+                "description": "The region code(s) to automatically add holiday features. Currently supports only one region.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "include_features",
+                "description": "Specifies the list of feature columns to include in model training. These columns must exist\nin the training data and be of type string, numerical, or boolean. If not specified, no additional\nfeatures will be included.\nNote: Certain columns are automatically handled:\n- Automatically excluded: split_column, target_column, custom_weights_column.\n- Automatically included: time_column.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "max_runtime",
+                "description": "The maximum duration for the experiment in minutes. The experiment stops automatically if it exceeds this limit.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "prediction_data_path",
+                "description": "The fully qualified path of a Unity Catalog table, formatted as catalog_name.schema_name.table_name, used to store predictions.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "primary_metric",
+                "description": "The evaluation metric used to optimize the forecasting model.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "register_to",
+                "description": "The fully qualified path of a Unity Catalog model, formatted as catalog_name.schema_name.model_name, used to store the best model.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "split_column",
+                "description": "// The column in the training table used for custom data splits. Values must be 'train', 'validate', or 'test'.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "target_column",
+                "description": "The column in the input training table used as the prediction target for model training. The values in this column are used as the ground truth for model training.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "time_column",
+                "description": "The column in the input training table that represents each row's timestamp.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "timeseries_identifier_columns",
+                "description": "The column in the training table used to group the dataset for predicting individual time series.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "train_data_path",
+                "description": "The fully qualified path of a Unity Catalog table, formatted as catalog_name.schema_name.table_name, used as training data for the forecasting model.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "training_frameworks",
+                "description": "List of frameworks to include for model tuning. Possible values are 'Prophet', 'ARIMA', 'DeepAR'. An empty list includes all supported frameworks.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "train_data_path",
+                "description": "The fully qualified path of a Unity Catalog table, formatted as catalog_name.schema_name.table_name, used as training data for the forecasting model.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "target_column",
+                "description": "The column in the input training table used as the prediction target for model training. The values in this column are used as the ground truth for model training.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "time_column",
+                "description": "The column in the input training table that represents each row's timestamp.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "forecast_granularity",
+                "description": "The time interval between consecutive rows in the time series data.\nPossible values include: '1 second', '1 minute', '5 minutes', '10 minutes', '15 minutes', '30 minutes', 'Hourly', 'Daily', 'Weekly', 'Monthly', 'Quarterly', 'Yearly'.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "forecast_horizon",
+                "description": "The number of time steps into the future to make predictions, calculated as a multiple of forecast_granularity. This value represents how far ahead the model should forecast.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "wait": {
+              "success": [
+                {
+                  "content": "SUCCEEDED"
+                }
+              ],
+              "timeout": 120,
+              "poll": {
+                "response": {
+                  "pascal_name": "ForecastingExperiment"
+                }
+              },
+              "status_path": [
+                {
+                  "pascal_name": "State"
+                }
+              ]
+            }
+          },
+          {
+            "name": "GetExperiment",
+            "description": "Public RPC to get forecasting experiment",
+            "summary": "Get a forecasting experiment.",
+            "path": "/api/2.0/automl/get-forecasting-experiment/{experiment_id}",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "GetForecastingExperimentRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "experiment_id",
+                  "description": "The unique ID of a forecasting experiment",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "experiment_id",
+                  "description": "The unique ID of a forecasting experiment",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ForecastingExperiment",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "experiment_id",
+                "description": "The unique ID of a forecasting experiment",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "experiment_id",
+                "description": "The unique ID of a forecasting experiment",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "catalog.Functions",
+        "name": "Functions",
+        "description": "Functions implement User-Defined Functions (UDFs) in Unity Catalog.\n\nThe function implementation can be any SQL expression or Query, and it can be invoked wherever a table reference is allowed in a query.\nIn Unity Catalog, a function resides at the same level as a table, so it can be referenced with the form __catalog_name__.__schema_name__.__function_name__.",
+        "package": {
+          "name": "catalog"
+        },
+        "docs_group": "catalog",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "named_id_map": {
+            "pascal_name": "FunctionInfoNameToFullNameMap"
+          },
+          "request": {
+            "pascal_name": "ListFunctionsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "**WARNING: This API is experimental and will change in future versions**\n\nCreates a new function\n\nThe user must have the following permissions in order for the function to be created:\n- **USE_CATALOG** on the function's parent catalog\n- **USE_SCHEMA** and **CREATE_FUNCTION** on the function's parent schema",
+            "summary": "Create a function.",
+            "path": "/api/2.1/unity-catalog/functions",
+            "can_use_json": true,
+            "must_use_json": true,
+            "is_crud_create": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateFunctionRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "function_info",
+                  "description": "Partial __FunctionInfo__ specifying the function to be created.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CreateFunction",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "function_info",
+                  "description": "Partial __FunctionInfo__ specifying the function to be created.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CreateFunction",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "FunctionInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "function_info",
+                "description": "Partial __FunctionInfo__ specifying the function to be created.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CreateFunction",
+                  "is_object": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes the function that matches the supplied name.\nFor the deletion to succeed, the user must satisfy one of the following conditions:\n- Is the owner of the function's parent catalog\n- Is the owner of the function's parent schema and have the **USE_CATALOG** privilege on its parent catalog\n- Is the owner of the function itself and have both the **USE_CATALOG** privilege on its parent catalog and the **USE_SCHEMA** privilege on its parent schema",
+            "summary": "Delete a function.",
+            "path": "/api/2.1/unity-catalog/functions/{name}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteFunctionRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The fully-qualified name of the function (of the form __catalog_name__.__schema_name__.__function__name__) .",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The fully-qualified name of the function (of the form __catalog_name__.__schema_name__.__function__name__) .",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "force",
+                "description": "Force deletion even if the function is notempty.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The fully-qualified name of the function (of the form __catalog_name__.__schema_name__.__function__name__) .",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The fully-qualified name of the function (of the form __catalog_name__.__schema_name__.__function__name__) .",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets a function from within a parent catalog and schema.\nFor the fetch to succeed, the user must satisfy one of the following requirements:\n- Is a metastore admin\n- Is an owner of the function's parent catalog\n- Have the **USE_CATALOG** privilege on the function's parent catalog and be the owner of the function\n- Have the **USE_CATALOG** privilege on the function's parent catalog, the **USE_SCHEMA** privilege on the function's parent schema, and the **EXECUTE** privilege on the function itself",
+            "summary": "Get a function.",
+            "path": "/api/2.1/unity-catalog/functions/{name}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetFunctionRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The fully-qualified name of the function (of the form __catalog_name__.__schema_name__.__function__name__).",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The fully-qualified name of the function (of the form __catalog_name__.__schema_name__.__function__name__).",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "FunctionInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "include_browse",
+                "description": "Whether to include functions in the response for which the principal can only access selective metadata for",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The fully-qualified name of the function (of the form __catalog_name__.__schema_name__.__function__name__).",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The fully-qualified name of the function (of the form __catalog_name__.__schema_name__.__function__name__).",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "List functions within the specified parent catalog and schema.\nIf the user is a metastore admin, all functions are returned in the output list.\nOtherwise, the user must have the **USE_CATALOG** privilege on the catalog and the **USE_SCHEMA** privilege on the schema, and the output list contains only functions for which either the user has the **EXECUTE** privilege or the user is the owner.\nThere is no guarantee of a specific ordering of the elements in the array.\n\nNOTE: we recommend using max_results=0 to use the paginated version of this API. Unpaginated calls will be deprecated soon.\n\nPAGINATION BEHAVIOR: When using pagination (max_results \u003e= 0), a page may contain zero results while still providing a next_page_token.\nClients must continue reading pages until next_page_token is absent, which is the only indication that the end of results has been reached.",
+            "summary": "List functions.",
+            "path": "/api/2.1/unity-catalog/functions",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListFunctionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "catalog_name",
+                  "description": "Name of parent catalog for functions of interest.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schema_name",
+                  "description": "Parent schema of functions.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "catalog_name",
+                  "description": "Name of parent catalog for functions of interest.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schema_name",
+                  "description": "Parent schema of functions.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListFunctionsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "catalog_name",
+                "description": "Name of parent catalog for functions of interest.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "include_browse",
+                "description": "Whether to include functions in the response for which the principal can only access selective metadata for",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "max_results",
+                "description": "Maximum number of functions to return.\nIf not set, all the functions are returned (not recommended).\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- when set to 0, the page length is set to a server configured value (recommended);\n- when set to a value less than 0, an invalid parameter error is returned;",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque pagination token to go to next page based on previous query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schema_name",
+                "description": "Parent schema of functions.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "catalog_name",
+                "description": "Name of parent catalog for functions of interest.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schema_name",
+                "description": "Parent schema of functions.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Opaque pagination token to go to next page based on previous query.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              },
+              "max_results": {
+                "name": "max_results",
+                "description": "Maximum number of functions to return.\nIf not set, all the functions are returned (not recommended).\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- when set to 0, the page length is set to a server configured value (recommended);\n- when set to a value less than 0, an invalid parameter error is returned;",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              }
+            }
+          },
+          {
+            "name": "Update",
+            "description": "Updates the function that matches the supplied name.\nOnly the owner of the function can be updated. If the user is not a metastore admin, the user must be a member of the group that is the new function owner.\n- Is a metastore admin\n- Is the owner of the function's parent catalog\n- Is the owner of the function's parent schema and has the **USE_CATALOG** privilege on its parent catalog\n- Is the owner of the function itself and has the **USE_CATALOG** privilege on its parent catalog as well as the **USE_SCHEMA** privilege on the function's parent schema.",
+            "summary": "Update a function.",
+            "path": "/api/2.1/unity-catalog/functions/{name}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateFunction",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The fully-qualified name of the function (of the form __catalog_name__.__schema_name__.__function__name__).",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The fully-qualified name of the function (of the form __catalog_name__.__schema_name__.__function__name__).",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "FunctionInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The fully-qualified name of the function (of the form __catalog_name__.__schema_name__.__function__name__).",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "owner",
+                "description": "Username of current owner of the function.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The fully-qualified name of the function (of the form __catalog_name__.__schema_name__.__function__name__).",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "dashboards.Genie",
+        "name": "Genie",
+        "description": "Genie provides a no-code experience for business users, powered by AI/BI. Analysts set up spaces that business users can use to ask questions using natural language. Genie uses data registered to Unity Catalog and requires at least CAN USE permission on a Pro or Serverless SQL warehouse. Also, Databricks Assistant must be enabled.",
+        "package": {
+          "name": "dashboards"
+        },
+        "docs_group": "dashboards",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "methods": [
+          {
+            "name": "CreateMessage",
+            "description": "Sends a new message in a chat-mode [conversation](:method:genie/startconversation).\nThe AI response uses all previously created messages in the conversation to respond.",
+            "summary": "Chat mode: Send a message.",
+            "path": "/api/2.0/genie/spaces/{space_id}/conversations/{conversation_id}/messages",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GenieCreateConversationMessageRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "space_id",
+                  "description": "The ID associated with the Genie space where the conversation is started.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "The ID associated with the conversation.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "content",
+                  "description": "User message content.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "space_id",
+                  "description": "The ID associated with the Genie space where the conversation is started.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "The ID associated with the conversation.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "content",
+                  "description": "User message content.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GenieMessage",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "space_id",
+                  "description": "Genie space ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "Conversation ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "content",
+                  "description": "User message content",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "message_id",
+                  "description": "Message ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "space_id",
+                  "description": "Genie space ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "Conversation ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "content",
+                  "description": "User message content",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "message_id",
+                  "description": "Message ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "content",
+                "description": "User message content.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "conversation_id",
+                "description": "The ID associated with the conversation.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "enable_visualization",
+                "description": "Enable visualization generation.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "space_id",
+                "description": "The ID associated with the Genie space where the conversation is started.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "space_id",
+                "description": "The ID associated with the Genie space where the conversation is started.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "conversation_id",
+                "description": "The ID associated with the conversation.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "content",
+                "description": "User message content.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "wait": {
+              "success": [
+                {
+                  "content": "COMPLETED"
+                }
+              ],
+              "timeout": 20,
+              "poll": {
+                "response": {
+                  "pascal_name": "GenieMessage"
+                }
+              },
+              "status_path": [
+                {
+                  "pascal_name": "Status"
+                }
+              ]
+            }
+          },
+          {
+            "name": "CreateMessageComment",
+            "description": "Create a comment on a conversation message.",
+            "summary": "Add a comment to a message.",
+            "path": "/api/2.0/genie/spaces/{space_id}/conversations/{conversation_id}/messages/{message_id}/comments",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GenieCreateMessageCommentRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "space_id",
+                  "description": "The ID associated with the Genie space.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "The ID associated with the conversation.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "message_id",
+                  "description": "The ID associated with the message.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "content",
+                  "description": "Comment text content.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "space_id",
+                  "description": "The ID associated with the Genie space.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "The ID associated with the conversation.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "message_id",
+                  "description": "The ID associated with the message.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "content",
+                  "description": "Comment text content.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GenieMessageComment",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "space_id",
+                  "description": "Genie space ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "Conversation ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "message_id",
+                  "description": "Message ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "message_comment_id",
+                  "description": "Comment ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "content",
+                  "description": "Comment text content",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "space_id",
+                  "description": "Genie space ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "Conversation ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "message_id",
+                  "description": "Message ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "message_comment_id",
+                  "description": "Comment ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "content",
+                  "description": "Comment text content",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "content",
+                "description": "Comment text content.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "conversation_id",
+                "description": "The ID associated with the conversation.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "message_id",
+                "description": "The ID associated with the message.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "space_id",
+                "description": "The ID associated with the Genie space.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "space_id",
+                "description": "The ID associated with the Genie space.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "conversation_id",
+                "description": "The ID associated with the conversation.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "message_id",
+                "description": "The ID associated with the message.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "content",
+                "description": "Comment text content.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateSpace",
+            "description": "Creates a Genie space from a serialized payload.",
+            "summary": "Create a Genie space.",
+            "path": "/api/2.0/genie/spaces",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GenieCreateSpaceRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "warehouse_id",
+                  "description": "Warehouse to associate with the new space",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "serialized_space",
+                  "description": "The contents of the Genie Space in serialized string form.\nUse the [Get Genie Space](:method:genie/getspace) API to retrieve an example response, which includes the `serialized_space` field.\nThis field provides the structure of the JSON string that represents the space's layout and components.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "warehouse_id",
+                  "description": "Warehouse to associate with the new space",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "serialized_space",
+                  "description": "The contents of the Genie Space in serialized string form.\nUse the [Get Genie Space](:method:genie/getspace) API to retrieve an example response, which includes the `serialized_space` field.\nThis field provides the structure of the JSON string that represents the space's layout and components.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GenieSpace",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "space_id",
+                  "description": "Genie space ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "title",
+                  "description": "Title of the Genie Space",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "space_id",
+                  "description": "Genie space ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "title",
+                  "description": "Title of the Genie Space",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "description",
+                "description": "Optional description",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent_path",
+                "description": "Parent folder path where the space will be registered",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "serialized_space",
+                "description": "The contents of the Genie Space in serialized string form.\nUse the [Get Genie Space](:method:genie/getspace) API to retrieve an example response, which includes the `serialized_space` field.\nThis field provides the structure of the JSON string that represents the space's layout and components.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "title",
+                "description": "Optional title override",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "warehouse_id",
+                "description": "Warehouse to associate with the new space",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "warehouse_id",
+                "description": "Warehouse to associate with the new space",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "serialized_space",
+                "description": "The contents of the Genie Space in serialized string form.\nUse the [Get Genie Space](:method:genie/getspace) API to retrieve an example response, which includes the `serialized_space` field.\nThis field provides the structure of the JSON string that represents the space's layout and components.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteConversation",
+            "description": "Delete a conversation.",
+            "summary": "Delete a conversation.",
+            "path": "/api/2.0/genie/spaces/{space_id}/conversations/{conversation_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GenieDeleteConversationRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "space_id",
+                  "description": "The ID associated with the Genie space where the conversation is located.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "The ID of the conversation to delete.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "space_id",
+                  "description": "The ID associated with the Genie space where the conversation is located.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "The ID of the conversation to delete.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "conversation_id",
+                "description": "The ID of the conversation to delete.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "space_id",
+                "description": "The ID associated with the Genie space where the conversation is located.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "space_id",
+                "description": "The ID associated with the Genie space where the conversation is located.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "conversation_id",
+                "description": "The ID of the conversation to delete.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteConversationMessage",
+            "description": "Delete a conversation message.",
+            "summary": "Delete a conversation message.",
+            "path": "/api/2.0/genie/spaces/{space_id}/conversations/{conversation_id}/messages/{message_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GenieDeleteConversationMessageRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "space_id",
+                  "description": "The ID associated with the Genie space where the message is located.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "The ID associated with the conversation.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "message_id",
+                  "description": "The ID associated with the message to delete.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "space_id",
+                  "description": "The ID associated with the Genie space where the message is located.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "The ID associated with the conversation.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "message_id",
+                  "description": "The ID associated with the message to delete.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "conversation_id",
+                "description": "The ID associated with the conversation.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "message_id",
+                "description": "The ID associated with the message to delete.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "space_id",
+                "description": "The ID associated with the Genie space where the message is located.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "space_id",
+                "description": "The ID associated with the Genie space where the message is located.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "conversation_id",
+                "description": "The ID associated with the conversation.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "message_id",
+                "description": "The ID associated with the message to delete.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DownloadMessageAttachmentVisualization",
+            "description": "Download a rendered image of a message visualization attachment.\nThe response body is the raw PNG image, not a JSON payload.\nThis is only available if the attachment is a visualization and the message status is `COMPLETED`.",
+            "summary": "Download an attachment visualization.",
+            "path": "/api/2.0/genie/{name=spaces/*/conversations/*/messages/*/attachments/*}/download-visualization",
+            "is_crud_read": true,
+            "is_response_byte_stream": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DownloadMessageAttachmentVisualizationRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the attachment to render, in the format\n`spaces/{space_id}/conversations/{conversation_id}/messages/{message_id}/attachments/{attachment_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the attachment to render, in the format\n`spaces/{space_id}/conversations/{conversation_id}/messages/{message_id}/attachments/{attachment_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DownloadMessageAttachmentVisualizationResponse",
+              "is_object": true
+            },
+            "response_body_field": {
+              "pascal_name": "Contents"
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The resource name of the attachment to render, in the format\n`spaces/{space_id}/conversations/{conversation_id}/messages/{message_id}/attachments/{attachment_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The resource name of the attachment to render, in the format\n`spaces/{space_id}/conversations/{conversation_id}/messages/{message_id}/attachments/{attachment_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ExecuteMessageAttachmentQuery",
+            "description": "Execute the SQL for a message query attachment. Use this API when the query attachment has expired and needs to be re-executed.",
+            "summary": "Execute an attachment SQL query.",
+            "path": "/api/2.0/genie/spaces/{space_id}/conversations/{conversation_id}/messages/{message_id}/attachments/{attachment_id}/execute-query",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GenieExecuteMessageAttachmentQueryRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "space_id",
+                  "description": "Genie space ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "Conversation ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "message_id",
+                  "description": "Message ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "attachment_id",
+                  "description": "Attachment ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "space_id",
+                  "description": "Genie space ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "Conversation ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "message_id",
+                  "description": "Message ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "attachment_id",
+                  "description": "Attachment ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GenieGetMessageQueryResultResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "attachment_id",
+                "description": "Attachment ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "conversation_id",
+                "description": "Conversation ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "message_id",
+                "description": "Message ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "space_id",
+                "description": "Genie space ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "space_id",
+                "description": "Genie space ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "conversation_id",
+                "description": "Conversation ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "message_id",
+                "description": "Message ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "attachment_id",
+                "description": "Attachment ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ExecuteMessageQuery",
+            "description": "DEPRECATED: Use [Execute Message Attachment Query](:method:genie/executemessageattachmentquery) instead.",
+            "summary": "[Deprecated] Execute SQL query in a conversation message.",
+            "path": "/api/2.0/genie/spaces/{space_id}/conversations/{conversation_id}/messages/{message_id}/execute-query",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "GenieExecuteMessageQueryRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "space_id",
+                  "description": "Genie space ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "Conversation ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "message_id",
+                  "description": "Message ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "space_id",
+                  "description": "Genie space ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "Conversation ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "message_id",
+                  "description": "Message ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GenieGetMessageQueryResultResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "conversation_id",
+                "description": "Conversation ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "message_id",
+                "description": "Message ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "space_id",
+                "description": "Genie space ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "space_id",
+                "description": "Genie space ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "conversation_id",
+                "description": "Conversation ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "message_id",
+                "description": "Message ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GenerateDownloadFullQueryResult",
+            "description": "Initiates a new SQL execution and returns a `download_id` and `download_id_signature` that you can use to track the progress of the download.\nThe query result is stored in an external link and can be retrieved using the [Get Download Full Query Result](:method:genie/getdownloadfullqueryresult) API.\nBoth `download_id` and `download_id_signature` must be provided when calling the Get endpoint.\n\n----\n\n### **Warning: Databricks strongly recommends that you protect the URLs that are returned by the `EXTERNAL_LINKS` disposition.**\n\nWhen you use the `EXTERNAL_LINKS` disposition, a short-lived cloud-storage URL is generated to download the\nresults. The URL contains temporary access credentials, so protect it and do not set an `Authorization` header in\nthe download request.\n\nSee [Execute Statement](:method:statementexecution/executestatement) for more details.\n\n----",
+            "summary": "Start a full query-result download.",
+            "path": "/api/2.0/genie/spaces/{space_id}/conversations/{conversation_id}/messages/{message_id}/attachments/{attachment_id}/downloads",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GenieGenerateDownloadFullQueryResultRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "space_id",
+                  "description": "Genie space ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "Conversation ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "message_id",
+                  "description": "Message ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "attachment_id",
+                  "description": "Attachment ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "space_id",
+                  "description": "Genie space ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "Conversation ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "message_id",
+                  "description": "Message ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "attachment_id",
+                  "description": "Attachment ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GenieGenerateDownloadFullQueryResultResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "attachment_id",
+                "description": "Attachment ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "conversation_id",
+                "description": "Conversation ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "message_id",
+                "description": "Message ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "space_id",
+                "description": "Genie space ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "space_id",
+                "description": "Genie space ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "conversation_id",
+                "description": "Conversation ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "message_id",
+                "description": "Message ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "attachment_id",
+                "description": "Attachment ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GenieCancelResponse",
+            "description": "Cancels an in-flight agent-mode response. `response_id` is the id returned in the\n`response.created` event from the agent-mode responses endpoint. The response stops at\nthe next agent boundary and its terminal state is returned.",
+            "summary": "Agent mode: Cancel a response.",
+            "path": "/api/2.0/genie/agents/{agent_id}/conversations/{conversation_id}/responses/{response_id}/cancel",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GenieCancelResponseRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "agent_id",
+                  "description": "The ID of the Genie agent (synonymous with the Genie space ID).",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "The ID of the conversation containing the response.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "response_id",
+                  "description": "The ID of the response to cancel (the id from the `response.created` event).",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "agent_id",
+                  "description": "The ID of the Genie agent (synonymous with the Genie space ID).",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "The ID of the conversation containing the response.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "response_id",
+                  "description": "The ID of the response to cancel (the id from the `response.created` event).",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GenieMessage",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "space_id",
+                  "description": "Genie space ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "Conversation ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "content",
+                  "description": "User message content",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "message_id",
+                  "description": "Message ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "space_id",
+                  "description": "Genie space ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "Conversation ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "content",
+                  "description": "User message content",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "message_id",
+                  "description": "Message ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "agent_id",
+                "description": "The ID of the Genie agent (synonymous with the Genie space ID).",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "conversation_id",
+                "description": "The ID of the conversation containing the response.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "response_id",
+                "description": "The ID of the response to cancel (the id from the `response.created` event).",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "agent_id",
+                "description": "The ID of the Genie agent (synonymous with the Genie space ID).",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "conversation_id",
+                "description": "The ID of the conversation containing the response.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "response_id",
+                "description": "The ID of the response to cancel (the id from the `response.created` event).",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GenieCreateEvalRun",
+            "description": "Creates and runs chat-mode evaluations for multiple benchmark questions in a Genie space.",
+            "summary": "Start a benchmark evaluation run.",
+            "path": "/api/2.0/genie/spaces/{space_id}/eval-runs",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GenieCreateEvalRunRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "space_id",
+                  "description": "The ID associated with the Genie space where the evaluations will be executed.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "space_id",
+                  "description": "The ID associated with the Genie space where the evaluations will be executed.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GenieEvalRunResponse",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "eval_run_id",
+                  "description": "The unique identifier for the evaluation run.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "eval_run_id",
+                  "description": "The unique identifier for the evaluation run.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "benchmark_question_ids",
+                "description": "List of benchmark question IDs to evaluate. These questions must exist in the specified Genie space. If none are specified, then all benchmark questions are evaluated.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "space_id",
+                "description": "The ID associated with the Genie space where the evaluations will be executed.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "space_id",
+                "description": "The ID associated with the Genie space where the evaluations will be executed.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GenieGetEvalResultDetails",
+            "description": "Get details for evaluation results.",
+            "summary": "Get benchmark evaluation result details.",
+            "path": "/api/2.0/genie/spaces/{space_id}/eval-runs/{eval_run_id}/results/{result_id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GenieGetEvalResultDetailsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "space_id",
+                  "description": "The ID associated with the Genie space where the evaluation run is located.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "eval_run_id",
+                  "description": "The unique identifier for the evaluation run.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "result_id",
+                  "description": "The unique identifier for the evaluation result.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "space_id",
+                  "description": "The ID associated with the Genie space where the evaluation run is located.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "eval_run_id",
+                  "description": "The unique identifier for the evaluation run.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "result_id",
+                  "description": "The unique identifier for the evaluation result.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GenieEvalResultDetails",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "result_id",
+                  "description": "The unique identifier for the evaluation result.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "space_id",
+                  "description": "The ID of the space the evaluation result belongs to.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "benchmark_question_id",
+                  "description": "The ID of the benchmark question that was evaluated.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "result_id",
+                  "description": "The unique identifier for the evaluation result.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "space_id",
+                  "description": "The ID of the space the evaluation result belongs to.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "benchmark_question_id",
+                  "description": "The ID of the benchmark question that was evaluated.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "eval_run_id",
+                "description": "The unique identifier for the evaluation run.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "result_id",
+                "description": "The unique identifier for the evaluation result.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "space_id",
+                "description": "The ID associated with the Genie space where the evaluation run is located.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "space_id",
+                "description": "The ID associated with the Genie space where the evaluation run is located.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "eval_run_id",
+                "description": "The unique identifier for the evaluation run.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "result_id",
+                "description": "The unique identifier for the evaluation result.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GenieGetEvalRun",
+            "description": "Get evaluation run details.",
+            "summary": "Get a benchmark evaluation run.",
+            "path": "/api/2.0/genie/spaces/{space_id}/eval-runs/{eval_run_id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GenieGetEvalRunRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "space_id",
+                  "description": "The ID associated with the Genie space where the evaluation run is located.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "eval_run_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "space_id",
+                  "description": "The ID associated with the Genie space where the evaluation run is located.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "eval_run_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GenieEvalRunResponse",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "eval_run_id",
+                  "description": "The unique identifier for the evaluation run.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "eval_run_id",
+                  "description": "The unique identifier for the evaluation run.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "eval_run_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "space_id",
+                "description": "The ID associated with the Genie space where the evaluation run is located.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "space_id",
+                "description": "The ID associated with the Genie space where the evaluation run is located.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "eval_run_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GenieListEvalResults",
+            "description": "List evaluation results for a specific evaluation run.",
+            "summary": "List results for a benchmark evaluation run.",
+            "path": "/api/2.0/genie/spaces/{space_id}/eval-runs/{eval_run_id}/results",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GenieListEvalResultsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "space_id",
+                  "description": "The ID associated with the Genie space where the evaluation run is located.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "eval_run_id",
+                  "description": "The unique identifier for the evaluation run.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "space_id",
+                  "description": "The ID associated with the Genie space where the evaluation run is located.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "eval_run_id",
+                  "description": "The unique identifier for the evaluation run.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GenieListEvalResultsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "eval_run_id",
+                "description": "The unique identifier for the evaluation run.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "Maximum number of eval results to return per page.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque token to retrieve the next page of results.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "space_id",
+                "description": "The ID associated with the Genie space where the evaluation run is located.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "space_id",
+                "description": "The ID associated with the Genie space where the evaluation run is located.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "eval_run_id",
+                "description": "The unique identifier for the evaluation run.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GenieListEvalRuns",
+            "description": "Lists all evaluation runs in a space.",
+            "summary": "List benchmark evaluation runs.",
+            "path": "/api/2.0/genie/spaces/{space_id}/eval-runs",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GenieListEvalRunsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "space_id",
+                  "description": "The ID associated with the Genie space where the evaluation run is located.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "space_id",
+                  "description": "The ID associated with the Genie space where the evaluation run is located.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GenieListEvalRunsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "Maximum number of evaluation runs to return per page",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Token to get the next page of results",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "space_id",
+                "description": "The ID associated with the Genie space where the evaluation run is located.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "space_id",
+                "description": "The ID associated with the Genie space where the evaluation run is located.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetDownloadFullQueryResult",
+            "description": "After [Generating a Full Query Result Download](:method:genie/generatedownloadfullqueryresult) and successfully receiving a `download_id` and `download_id_signature`, use this API to poll the download progress.\nBoth `download_id` and `download_id_signature` are required to call this endpoint.\nWhen the download is complete, the API returns the result in the `EXTERNAL_LINKS` disposition, containing one or more external links to the query result files.\n\n----\n\n### **Warning: Databricks strongly recommends that you protect the URLs that are returned by the `EXTERNAL_LINKS` disposition.**\n\nWhen you use the `EXTERNAL_LINKS` disposition, a short-lived cloud-storage URL is generated to download the\nresults. The URL contains temporary access credentials, so protect it and do not set an `Authorization` header in\nthe download request.\n\nSee [Execute Statement](:method:statementexecution/executestatement) for more details.\n\n----",
+            "summary": "Get full query-result download status.",
+            "path": "/api/2.0/genie/spaces/{space_id}/conversations/{conversation_id}/messages/{message_id}/attachments/{attachment_id}/downloads/{download_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GenieGetDownloadFullQueryResultRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "space_id",
+                  "description": "Genie space ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "Conversation ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "message_id",
+                  "description": "Message ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "attachment_id",
+                  "description": "Attachment ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "download_id",
+                  "description": "Download ID. This ID is provided by the [Generate Download endpoint](:method:genie/generateDownloadFullQueryResult)",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "download_id_signature",
+                  "description": "JWT signature for the download_id to ensure secure access to query results",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "space_id",
+                  "description": "Genie space ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "Conversation ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "message_id",
+                  "description": "Message ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "attachment_id",
+                  "description": "Attachment ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "download_id",
+                  "description": "Download ID. This ID is provided by the [Generate Download endpoint](:method:genie/generateDownloadFullQueryResult)",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "download_id_signature",
+                  "description": "JWT signature for the download_id to ensure secure access to query results",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GenieGetDownloadFullQueryResultResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "attachment_id",
+                "description": "Attachment ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "conversation_id",
+                "description": "Conversation ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "download_id",
+                "description": "Download ID. This ID is provided by the [Generate Download endpoint](:method:genie/generateDownloadFullQueryResult)",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "download_id_signature",
+                "description": "JWT signature for the download_id to ensure secure access to query results",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "message_id",
+                "description": "Message ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "space_id",
+                "description": "Genie space ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "space_id",
+                "description": "Genie space ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "conversation_id",
+                "description": "Conversation ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "message_id",
+                "description": "Message ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "attachment_id",
+                "description": "Attachment ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "download_id",
+                "description": "Download ID. This ID is provided by the [Generate Download endpoint](:method:genie/generateDownloadFullQueryResult)",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "download_id_signature",
+                "description": "JWT signature for the download_id to ensure secure access to query results",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetMessage",
+            "description": "Gets a message from a chat-mode or agent-mode conversation.\nFor a complete agent-mode transcript, use the List conversation items endpoint.",
+            "summary": "Get a conversation message.",
+            "path": "/api/2.0/genie/spaces/{space_id}/conversations/{conversation_id}/messages/{message_id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GenieGetConversationMessageRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "space_id",
+                  "description": "The ID associated with the Genie space where the target conversation is located.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "The ID associated with the target conversation.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "message_id",
+                  "description": "The ID associated with the target message from the identified conversation.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "space_id",
+                  "description": "The ID associated with the Genie space where the target conversation is located.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "The ID associated with the target conversation.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "message_id",
+                  "description": "The ID associated with the target message from the identified conversation.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GenieMessage",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "space_id",
+                  "description": "Genie space ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "Conversation ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "content",
+                  "description": "User message content",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "message_id",
+                  "description": "Message ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "space_id",
+                  "description": "Genie space ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "Conversation ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "content",
+                  "description": "User message content",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "message_id",
+                  "description": "Message ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "conversation_id",
+                "description": "The ID associated with the target conversation.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "message_id",
+                "description": "The ID associated with the target message from the identified conversation.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "space_id",
+                "description": "The ID associated with the Genie space where the target conversation is located.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "space_id",
+                "description": "The ID associated with the Genie space where the target conversation is located.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "conversation_id",
+                "description": "The ID associated with the target conversation.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "message_id",
+                "description": "The ID associated with the target message from the identified conversation.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetMessageAttachmentQueryResult",
+            "description": "Get the result of SQL query if the message has a query attachment.\nThis is only available if a message has a query attachment and the message status is `EXECUTING_QUERY` OR `COMPLETED`.",
+            "summary": "Get an attachment SQL result.",
+            "path": "/api/2.0/genie/spaces/{space_id}/conversations/{conversation_id}/messages/{message_id}/attachments/{attachment_id}/query-result",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GenieGetMessageAttachmentQueryResultRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "space_id",
+                  "description": "Genie space ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "Conversation ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "message_id",
+                  "description": "Message ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "attachment_id",
+                  "description": "Attachment ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "space_id",
+                  "description": "Genie space ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "Conversation ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "message_id",
+                  "description": "Message ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "attachment_id",
+                  "description": "Attachment ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GenieGetMessageQueryResultResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "attachment_id",
+                "description": "Attachment ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "conversation_id",
+                "description": "Conversation ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "message_id",
+                "description": "Message ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "space_id",
+                "description": "Genie space ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "space_id",
+                "description": "Genie space ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "conversation_id",
+                "description": "Conversation ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "message_id",
+                "description": "Message ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "attachment_id",
+                "description": "Attachment ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetMessageQueryResult",
+            "description": "DEPRECATED: Use [Get Message Attachment Query Result](:method:genie/getmessageattachmentqueryresult) instead.",
+            "summary": "[Deprecated] Get conversation message SQL query result.",
+            "path": "/api/2.0/genie/spaces/{space_id}/conversations/{conversation_id}/messages/{message_id}/query-result",
+            "is_crud_read": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "GenieGetMessageQueryResultRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "space_id",
+                  "description": "Genie space ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "Conversation ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "message_id",
+                  "description": "Message ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "space_id",
+                  "description": "Genie space ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "Conversation ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "message_id",
+                  "description": "Message ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GenieGetMessageQueryResultResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "conversation_id",
+                "description": "Conversation ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "message_id",
+                "description": "Message ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "space_id",
+                "description": "Genie space ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "space_id",
+                "description": "Genie space ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "conversation_id",
+                "description": "Conversation ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "message_id",
+                "description": "Message ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetMessageQueryResultByAttachment",
+            "description": "DEPRECATED: Use [Get Message Attachment Query Result](:method:genie/getmessageattachmentqueryresult) instead.",
+            "summary": "[Deprecated] Get conversation message SQL query result.",
+            "path": "/api/2.0/genie/spaces/{space_id}/conversations/{conversation_id}/messages/{message_id}/query-result/{attachment_id}",
+            "is_crud_read": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "GenieGetQueryResultByAttachmentRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "space_id",
+                  "description": "Genie space ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "Conversation ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "message_id",
+                  "description": "Message ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "attachment_id",
+                  "description": "Attachment ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "space_id",
+                  "description": "Genie space ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "Conversation ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "message_id",
+                  "description": "Message ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "attachment_id",
+                  "description": "Attachment ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GenieGetMessageQueryResultResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "attachment_id",
+                "description": "Attachment ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "conversation_id",
+                "description": "Conversation ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "message_id",
+                "description": "Message ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "space_id",
+                "description": "Genie space ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "space_id",
+                "description": "Genie space ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "conversation_id",
+                "description": "Conversation ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "message_id",
+                "description": "Message ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "attachment_id",
+                "description": "Attachment ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetSpace",
+            "description": "Get details of a Genie Space.",
+            "summary": "Get a Genie space.",
+            "path": "/api/2.0/genie/spaces/{space_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GenieGetSpaceRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "space_id",
+                  "description": "The ID associated with the Genie space",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "space_id",
+                  "description": "The ID associated with the Genie space",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GenieSpace",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "space_id",
+                  "description": "Genie space ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "title",
+                  "description": "Title of the Genie Space",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "space_id",
+                  "description": "Genie space ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "title",
+                  "description": "Title of the Genie Space",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "include_serialized_space",
+                "description": "Whether to include the serialized space export in the response.\nRequires at least CAN EDIT permission on the space.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "space_id",
+                "description": "The ID associated with the Genie space",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "space_id",
+                "description": "The ID associated with the Genie space",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListConversationComments",
+            "description": "List all comments across all messages in a conversation.",
+            "summary": "List all comments in a conversation.",
+            "path": "/api/2.0/genie/spaces/{space_id}/conversations/{conversation_id}/list-comments",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GenieListConversationCommentsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "space_id",
+                  "description": "The ID associated with the Genie space.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "The ID associated with the conversation.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "space_id",
+                  "description": "The ID associated with the Genie space.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "The ID associated with the conversation.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GenieListConversationCommentsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "conversation_id",
+                "description": "The ID associated with the conversation.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "Maximum number of comments to return per page.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Pagination token for getting the next page of results.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "space_id",
+                "description": "The ID associated with the Genie space.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "space_id",
+                "description": "The ID associated with the Genie space.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "conversation_id",
+                "description": "The ID associated with the conversation.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListConversationMessages",
+            "description": "Lists messages in a chat-mode or agent-mode conversation.\nAgent-mode messages are returned as GenieMessage projections. Use the List conversation items\nendpoint for the complete reasoning and tool-call history.",
+            "summary": "List conversation messages.",
+            "path": "/api/2.0/genie/spaces/{space_id}/conversations/{conversation_id}/messages",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GenieListConversationMessagesRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "space_id",
+                  "description": "The ID associated with the Genie space where the conversation is located",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "The ID of the conversation to list messages from",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "space_id",
+                  "description": "The ID associated with the Genie space where the conversation is located",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "The ID of the conversation to list messages from",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GenieListConversationMessagesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "conversation_id",
+                "description": "The ID of the conversation to list messages from",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "Maximum number of messages to return per page",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Token to get the next page of results",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "space_id",
+                "description": "The ID associated with the Genie space where the conversation is located",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "space_id",
+                "description": "The ID associated with the Genie space where the conversation is located",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "conversation_id",
+                "description": "The ID of the conversation to list messages from",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListConversations",
+            "description": "Get a list of conversations in a Genie Space.",
+            "summary": "List conversations.",
+            "path": "/api/2.0/genie/spaces/{space_id}/conversations",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GenieListConversationsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "space_id",
+                  "description": "The ID of the Genie space to retrieve conversations from.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "space_id",
+                  "description": "The ID of the Genie space to retrieve conversations from.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GenieListConversationsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "include_all",
+                "description": "Include all conversations in the space across all users.\nRequires at least CAN MANAGE permission on the space.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "Maximum number of conversations to return per page",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Token to get the next page of results",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "space_id",
+                "description": "The ID of the Genie space to retrieve conversations from.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "space_id",
+                "description": "The ID of the Genie space to retrieve conversations from.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListMessageComments",
+            "description": "List comments on a specific conversation message.",
+            "summary": "List comments on a message.",
+            "path": "/api/2.0/genie/spaces/{space_id}/conversations/{conversation_id}/messages/{message_id}/comments",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GenieListMessageCommentsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "space_id",
+                  "description": "The ID associated with the Genie space.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "The ID associated with the conversation.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "message_id",
+                  "description": "The ID associated with the message.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "space_id",
+                  "description": "The ID associated with the Genie space.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "The ID associated with the conversation.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "message_id",
+                  "description": "The ID associated with the message.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GenieListMessageCommentsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "conversation_id",
+                "description": "The ID associated with the conversation.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "message_id",
+                "description": "The ID associated with the message.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "Maximum number of comments to return per page.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Pagination token for getting the next page of results.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "space_id",
+                "description": "The ID associated with the Genie space.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "space_id",
+                "description": "The ID associated with the Genie space.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "conversation_id",
+                "description": "The ID associated with the conversation.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "message_id",
+                "description": "The ID associated with the message.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListSpaces",
+            "description": "Get list of Genie Spaces.",
+            "summary": "List Genie spaces.",
+            "path": "/api/2.0/genie/spaces",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GenieListSpacesRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "GenieListSpacesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "Maximum number of spaces to return per page",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Pagination token for getting the next page of results",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "SendMessageFeedback",
+            "description": "Sends feedback for a message in a chat-mode or agent-mode conversation.",
+            "summary": "Send feedback on a message.",
+            "path": "/api/2.0/genie/spaces/{space_id}/conversations/{conversation_id}/messages/{message_id}/feedback",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GenieSendMessageFeedbackRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "space_id",
+                  "description": "The ID associated with the Genie space where the message is located.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "The ID associated with the conversation.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "message_id",
+                  "description": "The ID associated with the message to provide feedback for.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "rating",
+                  "description": "The rating (POSITIVE, NEGATIVE, or NONE).",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "GenieFeedbackRating",
+                    "enum": [
+                      {
+                        "content": "NEGATIVE"
+                      },
+                      {
+                        "content": "NONE"
+                      },
+                      {
+                        "content": "POSITIVE"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "space_id",
+                  "description": "The ID associated with the Genie space where the message is located.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "The ID associated with the conversation.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "message_id",
+                  "description": "The ID associated with the message to provide feedback for.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "rating",
+                  "description": "The rating (POSITIVE, NEGATIVE, or NONE).",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "GenieFeedbackRating",
+                    "enum": [
+                      {
+                        "content": "NEGATIVE"
+                      },
+                      {
+                        "content": "NONE"
+                      },
+                      {
+                        "content": "POSITIVE"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "comment",
+                "description": "Optional text feedback that will be stored as a comment.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "conversation_id",
+                "description": "The ID associated with the conversation.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "message_id",
+                "description": "The ID associated with the message to provide feedback for.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "rating",
+                "description": "The rating (POSITIVE, NEGATIVE, or NONE).",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "GenieFeedbackRating",
+                  "enum": [
+                    {
+                      "content": "NEGATIVE"
+                    },
+                    {
+                      "content": "NONE"
+                    },
+                    {
+                      "content": "POSITIVE"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "space_id",
+                "description": "The ID associated with the Genie space where the message is located.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "space_id",
+                "description": "The ID associated with the Genie space where the message is located.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "conversation_id",
+                "description": "The ID associated with the conversation.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "message_id",
+                "description": "The ID associated with the message to provide feedback for.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "rating",
+                "description": "The rating (POSITIVE, NEGATIVE, or NONE).",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "GenieFeedbackRating",
+                  "enum": [
+                    {
+                      "content": "NEGATIVE"
+                    },
+                    {
+                      "content": "NONE"
+                    },
+                    {
+                      "content": "POSITIVE"
+                    }
+                  ]
+                }
+              }
+            ]
+          },
+          {
+            "name": "StartConversation",
+            "description": "Starts a new chat-mode conversation and sends its first message.",
+            "summary": "Chat mode: Start a conversation.",
+            "path": "/api/2.0/genie/spaces/{space_id}/start-conversation",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GenieStartConversationMessageRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "space_id",
+                  "description": "The ID associated with the Genie space where you want to start a conversation.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "content",
+                  "description": "The text of the message that starts the conversation.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "space_id",
+                  "description": "The ID associated with the Genie space where you want to start a conversation.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "content",
+                  "description": "The text of the message that starts the conversation.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GenieStartConversationResponse",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "message_id",
+                  "description": "Message ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "Conversation ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "message_id",
+                  "description": "Message ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "conversation_id",
+                  "description": "Conversation ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "content",
+                "description": "The text of the message that starts the conversation.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "enable_visualization",
+                "description": "Enable visualization generation.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "space_id",
+                "description": "The ID associated with the Genie space where you want to start a conversation.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "space_id",
+                "description": "The ID associated with the Genie space where you want to start a conversation.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "content",
+                "description": "The text of the message that starts the conversation.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "wait": {
+              "success": [
+                {
+                  "content": "COMPLETED"
+                }
+              ],
+              "timeout": 20,
+              "poll": {
+                "response": {
+                  "pascal_name": "GenieMessage"
+                }
+              },
+              "status_path": [
+                {
+                  "pascal_name": "Status"
+                }
+              ]
+            }
+          },
+          {
+            "name": "TrashSpace",
+            "description": "Move a Genie Space to the trash.",
+            "summary": "Trash a Genie space.",
+            "path": "/api/2.0/genie/spaces/{space_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GenieTrashSpaceRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "space_id",
+                  "description": "The ID associated with the Genie space to be sent to the trash.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "space_id",
+                  "description": "The ID associated with the Genie space to be sent to the trash.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "space_id",
+                "description": "The ID associated with the Genie space to be sent to the trash.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "space_id",
+                "description": "The ID associated with the Genie space to be sent to the trash.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateSpace",
+            "description": "Updates a Genie space with a serialized payload.",
+            "summary": "Update a Genie space.",
+            "path": "/api/2.0/genie/spaces/{space_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GenieUpdateSpaceRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "space_id",
+                  "description": "Genie space ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "space_id",
+                  "description": "Genie space ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GenieSpace",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "space_id",
+                  "description": "Genie space ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "title",
+                  "description": "Title of the Genie Space",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "space_id",
+                  "description": "Genie space ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "title",
+                  "description": "Title of the Genie Space",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "description",
+                "description": "Optional description",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "etag",
+                "description": "ETag returned by a previous GET or UPDATE. When set, the update will fail if the space\nhas been modified since. Omit to apply the update unconditionally.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent_path",
+                "description": "Parent workspace folder path to move this Genie space under.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "serialized_space",
+                "description": "The contents of the Genie Space in serialized string form (full replacement).\nUse the [Get Genie Space](:method:genie/getspace) API to retrieve an example response, which includes the `serialized_space` field.\nThis field provides the structure of the JSON string that represents the space's layout and components.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "space_id",
+                "description": "Genie space ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "title",
+                "description": "Optional title override",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "warehouse_id",
+                "description": "Optional warehouse override",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "space_id",
+                "description": "Genie space ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "workspace.GitCredentials",
+        "name": "GitCredentials",
+        "description": "Registers personal access token for Databricks to do operations on behalf of the user.\n\nSee [more info](https://docs.databricks.com/repos/get-access-tokens-from-git-provider.html).",
+        "package": {
+          "name": "workspace"
+        },
+        "docs_group": "workspace",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "named_id_map": {
+            "pascal_name": "CredentialInfoGitProviderToCredentialIdMap"
+          },
+          "request": {
+            "pascal_name": "ListCredentialsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a Git credential entry for the user.\nUse the PATCH endpoint to update existing credentials, or the DELETE endpoint to\ndelete existing credentials.",
+            "summary": "Create a credential entry.",
+            "path": "/api/2.0/git-credentials",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateCredentialsRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "git_provider",
+                  "description": "Git provider. This field is case-insensitive. The available Git providers are `gitHub`,\n`bitbucketCloud`, `gitLab`, `azureDevOpsServices` (Azure DevOps Services, including\nMicrosoft Entra ID authentication), `gitHubEnterprise`, `bitbucketServer` (Bitbucket\nData Center), `gitLabEnterpriseEdition` (GitLab Self-Managed), and `awsCodeCommit`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "git_provider",
+                  "description": "Git provider. This field is case-insensitive. The available Git providers are `gitHub`,\n`bitbucketCloud`, `gitLab`, `azureDevOpsServices` (Azure DevOps Services, including\nMicrosoft Entra ID authentication), `gitHubEnterprise`, `bitbucketServer` (Bitbucket\nData Center), `gitLabEnterpriseEdition` (GitLab Self-Managed), and `awsCodeCommit`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CreateCredentialsResponse",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "credential_id",
+                  "description": "ID of the credential object in the workspace.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "git_provider",
+                  "description": "The Git provider associated with the credential.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "credential_id",
+                  "description": "ID of the credential object in the workspace.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "git_provider",
+                  "description": "The Git provider associated with the credential.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "git_email",
+                "description": "The authenticating email associated with your Git provider user account.\nUsed for authentication with the remote repository and also sets the author \u0026 committer identity for commits.\nRequired for most Git providers except AWS CodeCommit.\nLearn more at https://docs.databricks.com/aws/en/repos/get-access-tokens-from-git-provider",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "git_provider",
+                "description": "Git provider. This field is case-insensitive. The available Git providers are `gitHub`,\n`bitbucketCloud`, `gitLab`, `azureDevOpsServices` (Azure DevOps Services, including\nMicrosoft Entra ID authentication), `gitHubEnterprise`, `bitbucketServer` (Bitbucket\nData Center), `gitLabEnterpriseEdition` (GitLab Self-Managed), and `awsCodeCommit`.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "git_username",
+                "description": "The username provided with your Git provider account and associated with the\ncredential. For most Git providers it is only used to set the Git committer \u0026 author names for commits,\nhowever it may be required for authentication depending on your Git provider / token requirements.\nRequired for AWS CodeCommit.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "is_default_for_provider",
+                "description": "if the credential is the default for the given provider",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "the name of the git credential, used for identification and ease of lookup",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "personal_access_token",
+                "description": "The personal access token used to authenticate to the corresponding Git provider.\nFor certain providers, support may exist for other types of scoped access tokens.\n[Learn more](https://docs.databricks.com/repos/get-access-tokens-from-git-provider.html).",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "The ID of the service principal whose credentials will be modified. Only service principal managers can perform this action.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "git_provider",
+                "description": "Git provider. This field is case-insensitive. The available Git providers are `gitHub`,\n`bitbucketCloud`, `gitLab`, `azureDevOpsServices` (Azure DevOps Services, including\nMicrosoft Entra ID authentication), `gitHubEnterprise`, `bitbucketServer` (Bitbucket\nData Center), `gitLabEnterpriseEdition` (GitLab Self-Managed), and `awsCodeCommit`.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes the specified Git credential.",
+            "summary": "Delete a credential.",
+            "path": "/api/2.0/git-credentials/{credential_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteCredentialsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "credential_id",
+                  "description": "The ID for the corresponding credential to access.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "credential_id",
+                  "description": "The ID for the corresponding credential to access.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteCredentialsResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "credential_id",
+                "description": "The ID for the corresponding credential to access.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "The ID of the service principal whose credentials will be modified. Only service principal managers can perform this action.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "credential_id",
+                "description": "The ID for the corresponding credential to access.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets the Git credential with the specified credential ID.",
+            "summary": "Get a credential entry.",
+            "path": "/api/2.0/git-credentials/{credential_id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetCredentialsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "credential_id",
+                  "description": "The ID for the corresponding credential to access.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "credential_id",
+                  "description": "The ID for the corresponding credential to access.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetCredentialsResponse",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "credential_id",
+                  "description": "ID of the credential object in the workspace.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "credential_id",
+                  "description": "ID of the credential object in the workspace.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "credential_id",
+                "description": "The ID for the corresponding credential to access.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "The ID of the service principal whose credentials will be modified. Only service principal managers can perform this action.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "credential_id",
+                "description": "The ID for the corresponding credential to access.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Lists the calling user's Git credentials.",
+            "summary": "Get Git credentials.",
+            "path": "/api/2.0/git-credentials",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListCredentialsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListCredentialsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "principal_id",
+                "description": "The ID of the service principal whose credentials will be listed. Only service principal managers can perform this action.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "pagination": {}
+          },
+          {
+            "name": "Update",
+            "description": "Updates the specified Git credential.",
+            "summary": "Update a credential.",
+            "path": "/api/2.0/git-credentials/{credential_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateCredentialsRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "credential_id",
+                  "description": "The ID for the corresponding credential to access.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "git_provider",
+                  "description": "Git provider. This field is case-insensitive. The available Git providers are `gitHub`,\n`bitbucketCloud`, `gitLab`, `azureDevOpsServices` (Azure DevOps Services, including\nMicrosoft Entra ID authentication), `gitHubEnterprise`, `bitbucketServer` (Bitbucket\nData Center), `gitLabEnterpriseEdition` (GitLab Self-Managed), and `awsCodeCommit`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "credential_id",
+                  "description": "The ID for the corresponding credential to access.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "git_provider",
+                  "description": "Git provider. This field is case-insensitive. The available Git providers are `gitHub`,\n`bitbucketCloud`, `gitLab`, `azureDevOpsServices` (Azure DevOps Services, including\nMicrosoft Entra ID authentication), `gitHubEnterprise`, `bitbucketServer` (Bitbucket\nData Center), `gitLabEnterpriseEdition` (GitLab Self-Managed), and `awsCodeCommit`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "UpdateCredentialsResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "credential_id",
+                "description": "The ID for the corresponding credential to access.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "git_email",
+                "description": "The authenticating email associated with your Git provider user account.\nUsed for authentication with the remote repository and also sets the author \u0026 committer identity for commits.\nRequired for most Git providers except AWS CodeCommit.\nLearn more at https://docs.databricks.com/aws/en/repos/get-access-tokens-from-git-provider",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "git_provider",
+                "description": "Git provider. This field is case-insensitive. The available Git providers are `gitHub`,\n`bitbucketCloud`, `gitLab`, `azureDevOpsServices` (Azure DevOps Services, including\nMicrosoft Entra ID authentication), `gitHubEnterprise`, `bitbucketServer` (Bitbucket\nData Center), `gitLabEnterpriseEdition` (GitLab Self-Managed), and `awsCodeCommit`.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "git_username",
+                "description": "The username provided with your Git provider account and associated with the\ncredential. For most Git providers it is only used to set the Git committer \u0026 author names for commits,\nhowever it may be required for authentication depending on your Git provider / token requirements.\nRequired for AWS CodeCommit.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "is_default_for_provider",
+                "description": "if the credential is the default for the given provider",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "the name of the git credential, used for identification and ease of lookup",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "personal_access_token",
+                "description": "The personal access token used to authenticate to the corresponding Git provider.\nFor certain providers, support may exist for other types of scoped access tokens.\n[Learn more](https://docs.databricks.com/repos/get-access-tokens-from-git-provider.html).",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "The ID of the service principal whose credentials will be modified. Only service principal managers can perform this action.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "credential_id",
+                "description": "The ID for the corresponding credential to access.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "git_provider",
+                "description": "Git provider. This field is case-insensitive. The available Git providers are `gitHub`,\n`bitbucketCloud`, `gitLab`, `azureDevOpsServices` (Azure DevOps Services, including\nMicrosoft Entra ID authentication), `gitHubEnterprise`, `bitbucketServer` (Bitbucket\nData Center), `gitLabEnterpriseEdition` (GitLab Self-Managed), and `awsCodeCommit`.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "compute.GlobalInitScripts",
+        "name": "GlobalInitScripts",
+        "description": "The Global Init Scripts API enables Workspace administrators to configure global\ninitialization scripts for their workspace. These scripts run on every node in every cluster\nin the workspace.\n\n**Important:** Existing clusters must be restarted to pick up any changes made to global\ninit scripts.\nGlobal init scripts are run in order. If the init script returns with a bad exit code,\nthe Apache Spark container fails to launch and init scripts with later position are skipped.\nIf enough containers fail, the entire cluster fails with a `GLOBAL_INIT_SCRIPT_FAILURE`\nerror code.",
+        "package": {
+          "name": "compute"
+        },
+        "docs_group": "compute",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "named_id_map": {
+            "pascal_name": "GlobalInitScriptDetailsNameToScriptIdMap"
+          },
+          "is_legacy_empty_request": true,
+          "request": {
+            "pascal_name": "ListGlobalInitScriptsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a new global init script in this workspace.",
+            "summary": "Create init script.",
+            "path": "/api/2.0/global-init-scripts",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GlobalInitScriptCreateRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the script",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "script",
+                  "description": "The Base64-encoded content of the script.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the script",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "script",
+                  "description": "The Base64-encoded content of the script.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CreateResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "enabled",
+                "description": "Specifies whether the script is enabled. The script runs only if enabled.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the script",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "position",
+                "description": "The position of a global init script, where 0 represents the first script to run, 1 is the second script to run, in ascending order.\n\nIf you omit the numeric position for a new global init script, it defaults to last position. It will run after all current scripts.\nSetting any value greater than the position of the last script is equivalent to the last position. Example: Take three existing scripts with positions 0, 1, and 2. Any position of (3) or greater puts the script in the last position.\nIf an explicit position value conflicts with an existing script value, your request succeeds, but the original script at that position and all later scripts have their positions incremented by 1.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "script",
+                "description": "The Base64-encoded content of the script.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the script",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "script",
+                "description": "The Base64-encoded content of the script.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes a global init script.",
+            "summary": "Delete init script.",
+            "path": "/api/2.0/global-init-scripts/{script_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteGlobalInitScriptRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "script_id",
+                  "description": "The ID of the global init script.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "script_id",
+                  "description": "The ID of the global init script.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "script_id",
+                "description": "The ID of the global init script.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "script_id",
+                "description": "The ID of the global init script.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets all the details of a script, including its Base64-encoded contents.",
+            "summary": "Get an init script.",
+            "path": "/api/2.0/global-init-scripts/{script_id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetGlobalInitScriptRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "script_id",
+                  "description": "The ID of the global init script.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "script_id",
+                  "description": "The ID of the global init script.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GlobalInitScriptDetailsWithContent",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "script_id",
+                "description": "The ID of the global init script.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "script_id",
+                "description": "The ID of the global init script.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Get a list of all global init scripts for this workspace. This returns all properties for each script but **not** the script contents.\nTo retrieve the contents of a script, use the [get a global init script](:method:globalinitscripts/get) operation.",
+            "summary": "Get init scripts.",
+            "path": "/api/2.0/global-init-scripts",
+            "is_legacy_empty_request": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListGlobalInitScriptsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListGlobalInitScriptsResponse",
+              "is_object": true
+            },
+            "pagination": {}
+          },
+          {
+            "name": "Update",
+            "description": "Updates a global init script, specifying only the fields to change. All fields are optional.\nUnspecified fields retain their current value.",
+            "summary": "Update init script.",
+            "path": "/api/2.0/global-init-scripts/{script_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GlobalInitScriptUpdateRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "script_id",
+                  "description": "The ID of the global init script.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "name",
+                  "description": "The name of the script",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "script",
+                  "description": "The Base64-encoded content of the script.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "script_id",
+                  "description": "The ID of the global init script.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the script",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "script",
+                  "description": "The Base64-encoded content of the script.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "UpdateResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "enabled",
+                "description": "Specifies whether the script is enabled. The script runs only if enabled.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the script",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "position",
+                "description": "The position of a script, where 0 represents the first script to run,\n1 is the second script to run, in ascending order.\nTo move the script to run first, set its position to 0.\n\nTo move the script to the end, set its position to any value\ngreater or equal to the position of the last script.\nExample, three existing scripts with positions 0, 1, and 2.\nAny position value of 2 or greater puts the script in the last position (2).\n\nIf an explicit position value conflicts with an existing script, your request succeeds,\nbut the original script at that position and all later scripts have their positions\nincremented by 1.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "script",
+                "description": "The Base64-encoded content of the script.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "script_id",
+                "description": "The ID of the global init script.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "script_id",
+                "description": "The ID of the global init script.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the script",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "script",
+                "description": "The Base64-encoded content of the script.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "catalog.Grants",
+        "name": "Grants",
+        "description": "In Unity Catalog, data is secure by default. Initially, users have no access to data in\na metastore. Access can be granted by either a metastore admin, the owner of an object, or\nthe owner of the catalog or schema that contains the object. Securable objects in Unity\nCatalog are hierarchical and privileges are inherited downward.\n\nThis means that granting a privilege on the catalog automatically grants the privilege to\nall current and future objects within the catalog. Similarly, privileges granted on a schema\nare inherited by all current and future objects within that schema.",
+        "package": {
+          "name": "catalog"
+        },
+        "docs_group": "catalog",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListPrivilegeAssignmentsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Get",
+            "description": "Gets the permissions for a securable. Does not include inherited permissions.\n\nNOTE: we recommend using max_results=0 to use the paginated version of this API. Unpaginated calls will be deprecated soon.\n\nPAGINATION BEHAVIOR: When using pagination (max_results \u003e= 0), a page may contain zero results while still providing a next_page_token.\nClients must continue reading pages until next_page_token is absent, which is the only indication that the end of results has been reached.",
+            "summary": "Get permissions.",
+            "path": "/api/2.1/unity-catalog/permissions/{securable_type}/{full_name}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetGrantRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "securable_type",
+                  "description": "Type of securable.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "full_name",
+                  "description": "Full name of securable.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "securable_type",
+                  "description": "Type of securable.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "full_name",
+                  "description": "Full name of securable.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetPermissionsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "full_name",
+                "description": "Full name of securable.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "max_results",
+                "description": "Specifies the maximum number of privileges to return (page length).\nEvery PrivilegeAssignment present in a single page response is guaranteed to contain all the privileges granted on\nthe requested Securable for the respective principal.\n\nIf not set, all the permissions are returned.\nIf set to\n- lesser than 0: invalid parameter error\n- 0: page length is set to a server configured value\n- lesser than 150 but greater than 0: invalid parameter error (this is to ensure that server is able to return at\nleast one complete PrivilegeAssignment in a single page response)\n- greater than (or equal to) 150: page length is the minimum of this value and a server configured value",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque pagination token to go to next page based on previous query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "principal",
+                "description": "If provided, only the permissions for the specified principal (user or group) are returned.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "securable_type",
+                "description": "Type of securable.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "securable_type",
+                "description": "Type of securable.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "full_name",
+                "description": "Full name of securable.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetEffective",
+            "description": "Gets the effective permissions for a securable. Includes inherited permissions from any parent securables.\n\nNOTE: we recommend using max_results=0 to use the paginated version of this API. Unpaginated calls will be deprecated soon.\n\nPAGINATION BEHAVIOR: When using pagination (max_results \u003e= 0), a page may contain zero results while still providing a next_page_token.\nClients must continue reading pages until next_page_token is absent, which is the only indication that the end of results has been reached.",
+            "summary": "Get effective permissions.",
+            "path": "/api/2.1/unity-catalog/effective-permissions/{securable_type}/{full_name}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetEffectiveRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "securable_type",
+                  "description": "Type of securable.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "full_name",
+                  "description": "Full name of securable.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "securable_type",
+                  "description": "Type of securable.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "full_name",
+                  "description": "Full name of securable.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "EffectivePermissionsList",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "full_name",
+                "description": "Full name of securable.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "max_results",
+                "description": "Specifies the maximum number of privileges to return (page length).\nEvery EffectivePrivilegeAssignment present in a single page response is guaranteed to contain all the effective\nprivileges granted on (or inherited by) the requested Securable for the respective principal.\n\nIf not set, all the effective permissions are returned.\nIf set to\n- lesser than 0: invalid parameter error\n- 0: page length is set to a server configured value\n- lesser than 150 but greater than 0: invalid parameter error (this is to ensure that server is able to return at\nleast one complete EffectivePrivilegeAssignment in a single page response)\n- greater than (or equal to) 150: page length is the minimum of this value and a server configured value",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque token for the next page of results (pagination).",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "principal",
+                "description": "If provided, only the effective permissions for the specified principal (user or group) are returned.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "securable_type",
+                "description": "Type of securable.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "securable_type",
+                "description": "Type of securable.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "full_name",
+                "description": "Full name of securable.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Lists the privilege assignments for a securable. Does not include inherited privileges.\nPaginated version of Get Permissions API.",
+            "summary": "List permissions.",
+            "path": "/api/2.1/unity-catalog/privilege-assignments/{securable_type}/{full_name}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListPrivilegeAssignmentsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "securable_type",
+                  "description": "Type of securable.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "full_name",
+                  "description": "Full name of securable.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "securable_type",
+                  "description": "Type of securable.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "full_name",
+                  "description": "Full name of securable.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListPrivilegeAssignmentsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "full_name",
+                "description": "Full name of securable.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "Specifies the maximum number of privilege assignments to return (page length).\nEvery PrivilegeAssignment present in a single page response is guaranteed to contain all the privileges granted on\nthe requested Securable for the respective principal.\n\nIf not set, page length is the server configured value.\nIf set to\n- lesser than 0: invalid parameter error\n- 0: page length is set to a server configured value\n- lesser than 150 but greater than 0: invalid parameter error (this is to ensure that server is able to return at\nleast one complete PrivilegeAssignment in a single page response)\n- greater than (or equal to) 150: page length is the minimum of this value and a server configured value",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque pagination token to go to next page based on previous query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "principal",
+                "description": "If provided, only the permissions for the specified principal (user or group) are returned.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "securable_type",
+                "description": "Type of securable.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "securable_type",
+                "description": "Type of securable.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "full_name",
+                "description": "Full name of securable.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Opaque pagination token to go to next page based on previous query.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListEffective",
+            "description": "Lists the effective privilege assignments for a securable. Includes inherited privileges.\nPaginated version of Get Effective Permissions API.",
+            "summary": "List effective permissions.",
+            "path": "/api/2.1/unity-catalog/effective-privilege-assignments/{securable_type}/{full_name}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListEffectivePrivilegeAssignmentsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "securable_type",
+                  "description": "Type of securable.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "full_name",
+                  "description": "Full name of securable.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "securable_type",
+                  "description": "Type of securable.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "full_name",
+                  "description": "Full name of securable.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListEffectivePrivilegeAssignmentsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "full_name",
+                "description": "Full name of securable.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "Specifies the maximum number of privilege assignments to return (page length).\nEvery EffectivePrivilegeAssignment present in a single page response is guaranteed to contain all the effective\nprivileges granted on (or inherited by) the requested Securable for the respective principal.\n\nIf not set, a server-configured default is used.\nIf set to\n- lesser than 0: invalid parameter error\n- 0: page length is set to a server configured value\n- lesser than 150 but greater than 0: invalid parameter error (this is to ensure that server is able to return at\nleast one complete EffectivePrivilegeAssignment in a single page response)\n- greater than (or equal to) 150: page length is the minimum of this value and a server configured value",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque pagination token to go to next page based on previous query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "principal",
+                "description": "If provided, only the effective permissions for the specified principal (user or group) are returned.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "securable_type",
+                "description": "Type of securable.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "securable_type",
+                "description": "Type of securable.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "full_name",
+                "description": "Full name of securable.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Opaque pagination token to go to next page based on previous query.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "Update",
+            "description": "Updates the permissions for a securable.",
+            "summary": "Update permissions.",
+            "path": "/api/2.1/unity-catalog/permissions/{securable_type}/{full_name}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdatePermissions",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "securable_type",
+                  "description": "Type of securable.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "full_name",
+                  "description": "Full name of securable.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "securable_type",
+                  "description": "Type of securable.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "full_name",
+                  "description": "Full name of securable.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "UpdatePermissionsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "changes",
+                "description": "Array of permissions change objects.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PermissionsChangeList",
+                  "array_value": {
+                    "pascal_name": "PermissionsChange",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "full_name",
+                "description": "Full name of securable.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "omit_permissions_in_response",
+                "description": "Optional, default false. Specifies whether all the permissions should be returned in the response.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "securable_type",
+                "description": "Type of securable.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "securable_type",
+                "description": "Type of securable.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "full_name",
+                "description": "Full name of securable.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "iam.GroupsV2",
+        "name": "GroupsV2",
+        "description": "Groups simplify identity management, making it easier to assign access to Databricks workspace, data,\nand other securable objects.\n\nIt is best practice to assign access to workspaces and access-control policies in\nUnity Catalog to groups, instead of to users individually. All Databricks workspace identities can be\nassigned as members of groups, and members inherit permissions that are assigned to their\ngroup.",
+        "package": {
+          "name": "iam"
+        },
+        "docs_group": "iam",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "list": {
+          "request": {
+            "pascal_name": "ListGroupsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a group in the Databricks workspace with a unique name, using the supplied group details.",
+            "summary": "Create a new group.",
+            "path": "/api/2.0/preview/scim/v2/Groups",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "CreateGroupRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "Group",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "displayName",
+                "description": "String that represents a human-readable group name",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "entitlements",
+                "description": "Entitlements assigned to the group. See [assigning entitlements](https://docs.databricks.com/administration-guide/users-groups/index.html#assigning-entitlements) for a full list of supported values.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ComplexValueList",
+                  "array_value": {
+                    "pascal_name": "ComplexValue",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "externalId",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "groups",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ComplexValueList",
+                  "array_value": {
+                    "pascal_name": "ComplexValue",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "id",
+                "description": "Databricks group ID",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "members",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ComplexValueList",
+                  "array_value": {
+                    "pascal_name": "ComplexValue",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "meta",
+                "description": "Container  for the group identifier. Workspace local versus account.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "ResourceMeta",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "roles",
+                "description": "Corresponds to AWS instance profile/arn role.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ComplexValueList",
+                  "array_value": {
+                    "pascal_name": "ComplexValue",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "schemas",
+                "description": "The schema of the group.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "GroupSchemaList",
+                  "array_value": {
+                    "pascal_name": "GroupSchema",
+                    "enum": [
+                      {
+                        "content": "urn:ietf:params:scim:schemas:core:2.0:Group"
+                      }
+                    ]
+                  }
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes a group from the Databricks workspace.",
+            "summary": "Delete a group.",
+            "path": "/api/2.0/preview/scim/v2/Groups/{id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "DeleteGroupRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID for a group in the Databricks workspace.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID for a group in the Databricks workspace.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "description": "Unique ID for a group in the Databricks workspace.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Unique ID for a group in the Databricks workspace.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets the information for a specific group in the Databricks workspace.",
+            "summary": "Get group details.",
+            "path": "/api/2.0/preview/scim/v2/Groups/{id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetGroupRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID for a group in the Databricks workspace.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID for a group in the Databricks workspace.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Group",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "description": "Unique ID for a group in the Databricks workspace.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Unique ID for a group in the Databricks workspace.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Gets all details of the groups associated with the Databricks workspace.",
+            "summary": "List group details.",
+            "path": "/api/2.0/preview/scim/v2/Groups",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "ListGroupsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListGroupsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "attributes",
+                "description": "Comma-separated list of attributes to return in response.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "count",
+                "description": "Desired number of results per page.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "excludedAttributes",
+                "description": "Comma-separated list of attributes to exclude in response.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "filter",
+                "description": "Query by which the results have to be filtered. Supported operators are equals(`eq`), contains(`co`), starts with(`sw`) and not equals(`ne`). Additionally, simple expressions can be formed using logical operators - `and` and `or`. The [SCIM RFC](https://tools.ietf.org/html/rfc7644#section-3.4.2.2) has more details but we currently only support simple expressions.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "sortBy",
+                "description": "Attribute to sort the results.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "sortOrder",
+                "description": "The order to sort the results.",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "ListSortOrder",
+                  "enum": [
+                    {
+                      "content": "ascending"
+                    },
+                    {
+                      "content": "descending"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "startIndex",
+                "description": "Specifies the index of the first result. First item is number 1.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "pagination": {
+              "offset": {
+                "name": "startIndex",
+                "description": "Specifies the index of the first result. First item is number 1.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              "limit": {
+                "name": "count",
+                "description": "Desired number of results per page.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            }
+          },
+          {
+            "name": "Patch",
+            "description": "Partially updates the details of a group.",
+            "summary": "Update group details.",
+            "path": "/api/2.0/preview/scim/v2/Groups/{id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "PatchGroupRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID in the Databricks workspace.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID in the Databricks workspace.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "description": "Unique ID in the Databricks workspace.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "Operations",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PatchList",
+                  "array_value": {
+                    "pascal_name": "Patch",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "schemas",
+                "description": "The schema of the patch request. Must be [\"urn:ietf:params:scim:api:messages:2.0:PatchOp\"].",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PatchSchemaList",
+                  "array_value": {
+                    "pascal_name": "PatchSchema",
+                    "enum": [
+                      {
+                        "content": "urn:ietf:params:scim:api:messages:2.0:PatchOp"
+                      }
+                    ]
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Unique ID in the Databricks workspace.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Updates the details of a group by replacing the entire group entity.",
+            "summary": "Replace a group.",
+            "path": "/api/2.0/preview/scim/v2/Groups/{id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "UpdateGroupRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Databricks group ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "Databricks group ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "displayName",
+                "description": "String that represents a human-readable group name",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "entitlements",
+                "description": "Entitlements assigned to the group. See [assigning entitlements](https://docs.databricks.com/administration-guide/users-groups/index.html#assigning-entitlements) for a full list of supported values.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ComplexValueList",
+                  "array_value": {
+                    "pascal_name": "ComplexValue",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "externalId",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "groups",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ComplexValueList",
+                  "array_value": {
+                    "pascal_name": "ComplexValue",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "id",
+                "description": "Databricks group ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "members",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ComplexValueList",
+                  "array_value": {
+                    "pascal_name": "ComplexValue",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "meta",
+                "description": "Container  for the group identifier. Workspace local versus account.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "ResourceMeta",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "roles",
+                "description": "Corresponds to AWS instance profile/arn role.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ComplexValueList",
+                  "array_value": {
+                    "pascal_name": "ComplexValue",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "schemas",
+                "description": "The schema of the group.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "GroupSchemaList",
+                  "array_value": {
+                    "pascal_name": "GroupSchema",
+                    "enum": [
+                      {
+                        "content": "urn:ietf:params:scim:schemas:core:2.0:Group"
+                      }
+                    ]
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Databricks group ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "iam.AccountGroupsV2",
+        "name": "AccountGroupsV2",
+        "description": "Groups simplify identity management, making it easier to assign access to Databricks account, data,\nand other securable objects.\n\nIt is best practice to assign access to workspaces and access-control policies in\nUnity Catalog to groups, instead of to users individually. All Databricks account identities can be\nassigned as members of groups, and members inherit permissions that are assigned to their\ngroup.",
+        "package": {
+          "name": "iam"
+        },
+        "is_accounts": true,
+        "docs_group": "iam",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListAccountGroupsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a group in the Databricks account with a unique name, using the supplied group details.",
+            "summary": "Create a new group.",
+            "path": "/api/2.0/accounts/{account_id}/scim/v2/Groups",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateAccountGroupRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "AccountGroup",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "displayName",
+                "description": "String that represents a human-readable group name",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "externalId",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "id",
+                "description": "Databricks group ID",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "members",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ComplexValueList",
+                  "array_value": {
+                    "pascal_name": "ComplexValue",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "meta",
+                "description": "Container  for the group identifier. Workspace local versus account.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "ResourceMeta",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "roles",
+                "description": "Indicates if the group has the admin role.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ComplexValueList",
+                  "array_value": {
+                    "pascal_name": "ComplexValue",
+                    "is_object": true
+                  }
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes a group from the Databricks account.",
+            "summary": "Delete a group.",
+            "path": "/api/2.0/accounts/{account_id}/scim/v2/Groups/{id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteAccountGroupRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID for a group in the Databricks account.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID for a group in the Databricks account.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "description": "Unique ID for a group in the Databricks account.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Unique ID for a group in the Databricks account.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets the information for a specific group in the Databricks account.",
+            "summary": "Get group details.",
+            "path": "/api/2.0/accounts/{account_id}/scim/v2/Groups/{id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetAccountGroupRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID for a group in the Databricks account.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID for a group in the Databricks account.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "AccountGroup",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "description": "Unique ID for a group in the Databricks account.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Unique ID for a group in the Databricks account.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Gets all details of the groups associated with the Databricks account. As of 08/22/2025,\nthis endpoint will no longer return members. Instead, members should be retrieved by\niterating through `Get group details`. Existing accounts that rely on this attribute\nwill not be impacted and will continue receiving member data as before.",
+            "summary": "List group details.",
+            "path": "/api/2.0/accounts/{account_id}/scim/v2/Groups",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListAccountGroupsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListAccountGroupsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "attributes",
+                "description": "Comma-separated list of attributes to return in response.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "count",
+                "description": "Desired number of results per page. Default is 10000.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "excludedAttributes",
+                "description": "Comma-separated list of attributes to exclude in response.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "filter",
+                "description": "Query by which the results have to be filtered. Supported operators are equals(`eq`), contains(`co`), starts with(`sw`) and not equals(`ne`). Additionally, simple expressions can be formed using logical operators - `and` and `or`. The [SCIM RFC](https://tools.ietf.org/html/rfc7644#section-3.4.2.2) has more details but we currently only support simple expressions.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "sortBy",
+                "description": "Attribute to sort the results.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "sortOrder",
+                "description": "The order to sort the results.",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "ListSortOrder",
+                  "enum": [
+                    {
+                      "content": "ascending"
+                    },
+                    {
+                      "content": "descending"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "startIndex",
+                "description": "Specifies the index of the first result. First item is number 1.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "pagination": {
+              "offset": {
+                "name": "startIndex",
+                "description": "Specifies the index of the first result. First item is number 1.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              "limit": {
+                "name": "count",
+                "description": "Desired number of results per page. Default is 10000.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            }
+          },
+          {
+            "name": "Patch",
+            "description": "Partially updates the details of a group.",
+            "summary": "Update group details.",
+            "path": "/api/2.0/accounts/{account_id}/scim/v2/Groups/{id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "PatchAccountGroupRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID in the Databricks workspace.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID in the Databricks workspace.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "description": "Unique ID in the Databricks workspace.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "Operations",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PatchList",
+                  "array_value": {
+                    "pascal_name": "Patch",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "schemas",
+                "description": "The schema of the patch request. Must be [\"urn:ietf:params:scim:api:messages:2.0:PatchOp\"].",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PatchSchemaList",
+                  "array_value": {
+                    "pascal_name": "PatchSchema",
+                    "enum": [
+                      {
+                        "content": "urn:ietf:params:scim:api:messages:2.0:PatchOp"
+                      }
+                    ]
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Unique ID in the Databricks workspace.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Updates the details of a group by replacing the entire group entity.",
+            "summary": "Replace a group.",
+            "path": "/api/2.0/accounts/{account_id}/scim/v2/Groups/{id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateAccountGroupRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Databricks group ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "Databricks group ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "displayName",
+                "description": "String that represents a human-readable group name",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "externalId",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "id",
+                "description": "Databricks group ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "members",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ComplexValueList",
+                  "array_value": {
+                    "pascal_name": "ComplexValue",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "meta",
+                "description": "Container  for the group identifier. Workspace local versus account.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "ResourceMeta",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "roles",
+                "description": "Indicates if the group has the admin role.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ComplexValueList",
+                  "array_value": {
+                    "pascal_name": "ComplexValue",
+                    "is_object": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Databricks group ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "iamv2.AccountIamV2",
+        "name": "AccountIamV2",
+        "description": "These APIs are used to manage identities and the workspace access of these identities in Databricks.",
+        "package": {
+          "name": "iamv2"
+        },
+        "is_accounts": true,
+        "docs_group": "iam",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "methods": [
+          {
+            "name": "CreateDirectGroupMember",
+            "description": "Creates a group membership (assigns a principal to a group).\n\nAuthorization: the caller must be an account admin or a manager of the group (holds the\n`roles/group.manager` role on it).",
+            "summary": "Create a direct group membership.",
+            "path": "/api/2.0/identity/accounts/{account_id}/groups/{group_id}/direct-members",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "CreateDirectGroupMemberRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "group_id",
+                  "description": "Required. Internal ID of the group in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "direct_group_member",
+                  "description": "Required. The direct group member to be added to the group.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DirectGroupMember",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "group_id",
+                  "description": "Required. Internal ID of the group in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "direct_group_member",
+                  "description": "Required. The direct group member to be added to the group.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DirectGroupMember",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "direct_group_member",
+              "description": "Required. The direct group member to be added to the group.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "DirectGroupMember",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "principal_id",
+                    "description": "Internal ID of the principal in Databricks.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_int64": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "principal_id",
+                    "description": "Internal ID of the principal in Databricks.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_int64": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "DirectGroupMember",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "Internal ID of the principal in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "Internal ID of the principal in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "direct_group_member",
+                "description": "Required. The direct group member to be added to the group.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DirectGroupMember",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "principal_id",
+                      "description": "Internal ID of the principal in Databricks.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_int64": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "principal_id",
+                      "description": "Internal ID of the principal in Databricks.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_int64": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "group_id",
+                "description": "Required. Internal ID of the group in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "Display name of the principal.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "external_id",
+                "description": "The external ID of the principal in Databricks.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "group_id",
+                "description": "The internal ID of the group this member belongs to.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "membership_source",
+                "description": "The source of group membership (internal or from identity provider).",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "GroupMembershipSource",
+                  "enum": [
+                    {
+                      "content": "IDENTITY_PROVIDER"
+                    },
+                    {
+                      "content": "INTERNAL"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "Internal ID of the principal in Databricks.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "principal_type",
+                "description": "The type of the principal (user/service principal/group).",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PrincipalType",
+                  "enum": [
+                    {
+                      "content": "GROUP"
+                    },
+                    {
+                      "content": "SERVICE_PRINCIPAL"
+                    },
+                    {
+                      "content": "USER"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "group_id",
+                "description": "Required. Internal ID of the group in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "Internal ID of the principal in Databricks.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateGroup",
+            "description": "Creates a local group in the Databricks account and returns the created group. A local group\nis one that is not synced from the customer's identity provider, and can be created whether or\nnot Account Identity Management (AIM) is enabled.\n\nWhen AIM is enabled, supplying an external ID returns an error. To provision the identity from\nyour identity provider, resolve it by its external ID with ResolveGroup; to read an existing\nexternal identity, use the ExternalGroup resource.",
+            "summary": "Create a group in the account.",
+            "path": "/api/2.0/identity/accounts/{account_id}/groups",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "CreateGroupRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "group",
+                  "description": "Required. Group to be created in Databricks",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Group",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "group",
+                  "description": "Required. Group to be created in Databricks",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Group",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "group",
+              "description": "Required. Group to be created in Databricks",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Group",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "Group",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "group",
+                "description": "Required. Group to be created in Databricks",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Group",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "account_id",
+                "description": "The parent account ID for group in Databricks.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "external_id",
+                "description": "ExternalId of the group in the customer's IdP.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "group_id",
+                "description": "Internal group ID of the group in Databricks.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "group_name",
+                "description": "Display name of the group.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateIdentityVisibilityFilter",
+            "description": "Creates a group visibility filter in the account. Requires account admin privileges.\nSet `principal_type` to `GROUP` and specify exactly one of `exact` (external ID) or `prefix`\n(display-name starts with). The filter applies across all workspaces in the account.\nA duplicate filter ID or an existing rule with the same type and match value returns\n`ALREADY_EXISTS`. Filters are immutable; to change a rule, delete it and create a new one.",
+            "summary": "Create an identity-visibility filter in the account.",
+            "path": "/api/2.0/identity/{parent=accounts/*}/identity-visibility-filters",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateIdentityVisibilityFilterRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "Required. The parent account. Format: accounts/{account_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "identity_visibility_filter",
+                  "description": "Required. The filter to create. Set `principal_type` to `GROUP` and specify exactly one of\n`exact` or `prefix`. The server assigns the resource name; any supplied `name` is ignored.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "IdentityVisibilityFilter",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "Required. The parent account. Format: accounts/{account_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "identity_visibility_filter",
+                  "description": "Required. The filter to create. Set `principal_type` to `GROUP` and specify exactly one of\n`exact` or `prefix`. The server assigns the resource name; any supplied `name` is ignored.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "IdentityVisibilityFilter",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "identity_visibility_filter",
+              "description": "Required. The filter to create. Set `principal_type` to `GROUP` and specify exactly one of\n`exact` or `prefix`. The server assigns the resource name; any supplied `name` is ignored.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "IdentityVisibilityFilter",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "principal_type",
+                    "description": "The type of principal this rule applies to. Set to `GROUP` when creating a filter.\nOther principal types are not supported for creation.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "PrincipalType",
+                      "enum": [
+                        {
+                          "content": "GROUP"
+                        },
+                        {
+                          "content": "SERVICE_PRINCIPAL"
+                        },
+                        {
+                          "content": "USER"
+                        }
+                      ]
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "principal_type",
+                    "description": "The type of principal this rule applies to. Set to `GROUP` when creating a filter.\nOther principal types are not supported for creation.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "PrincipalType",
+                      "enum": [
+                        {
+                          "content": "GROUP"
+                        },
+                        {
+                          "content": "SERVICE_PRINCIPAL"
+                        },
+                        {
+                          "content": "USER"
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "IdentityVisibilityFilter",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "principal_type",
+                  "description": "The type of principal this rule applies to. Set to `GROUP` when creating a filter.\nOther principal types are not supported for creation.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PrincipalType",
+                    "enum": [
+                      {
+                        "content": "GROUP"
+                      },
+                      {
+                        "content": "SERVICE_PRINCIPAL"
+                      },
+                      {
+                        "content": "USER"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "principal_type",
+                  "description": "The type of principal this rule applies to. Set to `GROUP` when creating a filter.\nOther principal types are not supported for creation.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PrincipalType",
+                    "enum": [
+                      {
+                        "content": "GROUP"
+                      },
+                      {
+                        "content": "SERVICE_PRINCIPAL"
+                      },
+                      {
+                        "content": "USER"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "identity_visibility_filter",
+                "description": "Required. The filter to create. Set `principal_type` to `GROUP` and specify exactly one of\n`exact` or `prefix`. The server assigns the resource name; any supplied `name` is ignored.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "IdentityVisibilityFilter",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "principal_type",
+                      "description": "The type of principal this rule applies to. Set to `GROUP` when creating a filter.\nOther principal types are not supported for creation.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "PrincipalType",
+                        "enum": [
+                          {
+                            "content": "GROUP"
+                          },
+                          {
+                            "content": "SERVICE_PRINCIPAL"
+                          },
+                          {
+                            "content": "USER"
+                          }
+                        ]
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "principal_type",
+                      "description": "The type of principal this rule applies to. Set to `GROUP` when creating a filter.\nOther principal types are not supported for creation.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "PrincipalType",
+                        "enum": [
+                          {
+                            "content": "GROUP"
+                          },
+                          {
+                            "content": "SERVICE_PRINCIPAL"
+                          },
+                          {
+                            "content": "USER"
+                          }
+                        ]
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "identity_visibility_filter_id",
+                "description": "Optional. The ID to use for the filter, which becomes the final component of its resource name.\nIf not specified or empty, the server generates one. Must not contain `/`.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "Required. The parent account. Format: accounts/{account_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "exact",
+                "description": "Exact match on the group's external ID from the identity provider.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "ExactMatchRule",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The resource name of the identity-visibility filter.\nFormat: accounts/{account_id}/identity-visibility-filters/{identity_visibility_filter_id}",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "prefix",
+                "description": "Case-sensitive starts-with match on the group's display name.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "PrefixMatchRule",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "principal_type",
+                "description": "The type of principal this rule applies to. Set to `GROUP` when creating a filter.\nOther principal types are not supported for creation.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PrincipalType",
+                  "enum": [
+                    {
+                      "content": "GROUP"
+                    },
+                    {
+                      "content": "SERVICE_PRINCIPAL"
+                    },
+                    {
+                      "content": "USER"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "Required. The parent account. Format: accounts/{account_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "principal_type",
+                "description": "The type of principal this rule applies to. Set to `GROUP` when creating a filter.\nOther principal types are not supported for creation.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PrincipalType",
+                  "enum": [
+                    {
+                      "content": "GROUP"
+                    },
+                    {
+                      "content": "SERVICE_PRINCIPAL"
+                    },
+                    {
+                      "content": "USER"
+                    }
+                  ]
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateServicePrincipal",
+            "description": "Creates a local service principal in the Databricks account and returns the created service\nprincipal. A local service principal is one that is not synced from the customer's identity\nprovider, and can be created whether or not Account Identity Management (AIM) is enabled.\n\nWhen AIM is enabled, supplying an external ID returns an error. To provision the identity from\nyour identity provider, resolve it by its external ID with ResolveServicePrincipal; to read an\nexisting external identity, use the ExternalServicePrincipal resource.",
+            "summary": "Create a service principal in the account.",
+            "path": "/api/2.0/identity/accounts/{account_id}/service-principals",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "CreateServicePrincipalRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "service_principal",
+                  "description": "Required. Service principal to be created in Databricks",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ServicePrincipal",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "service_principal",
+                  "description": "Required. Service principal to be created in Databricks",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ServicePrincipal",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "service_principal",
+              "description": "Required. Service principal to be created in Databricks",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "ServicePrincipal",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "display_name",
+                    "description": "Display name of the service principal.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "account_sp_status",
+                    "description": "The activity status of a service principal in a Databricks account.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "State",
+                      "enum": [
+                        {
+                          "content": "ACTIVE"
+                        },
+                        {
+                          "content": "INACTIVE"
+                        }
+                      ]
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "display_name",
+                    "description": "Display name of the service principal.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "account_sp_status",
+                    "description": "The activity status of a service principal in a Databricks account.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "State",
+                      "enum": [
+                        {
+                          "content": "ACTIVE"
+                        },
+                        {
+                          "content": "INACTIVE"
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "ServicePrincipal",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "display_name",
+                  "description": "Display name of the service principal.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "account_sp_status",
+                  "description": "The activity status of a service principal in a Databricks account.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "State",
+                    "enum": [
+                      {
+                        "content": "ACTIVE"
+                      },
+                      {
+                        "content": "INACTIVE"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "display_name",
+                  "description": "Display name of the service principal.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "account_sp_status",
+                  "description": "The activity status of a service principal in a Databricks account.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "State",
+                    "enum": [
+                      {
+                        "content": "ACTIVE"
+                      },
+                      {
+                        "content": "INACTIVE"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "service_principal",
+                "description": "Required. Service principal to be created in Databricks",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ServicePrincipal",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "display_name",
+                      "description": "Display name of the service principal.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "account_sp_status",
+                      "description": "The activity status of a service principal in a Databricks account.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "State",
+                        "enum": [
+                          {
+                            "content": "ACTIVE"
+                          },
+                          {
+                            "content": "INACTIVE"
+                          }
+                        ]
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "display_name",
+                      "description": "Display name of the service principal.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "account_sp_status",
+                      "description": "The activity status of a service principal in a Databricks account.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "State",
+                        "enum": [
+                          {
+                            "content": "ACTIVE"
+                          },
+                          {
+                            "content": "INACTIVE"
+                          }
+                        ]
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "account_id",
+                "description": "The parent account ID for the service principal in Databricks.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "account_sp_status",
+                "description": "The activity status of a service principal in a Databricks account.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "State",
+                  "enum": [
+                    {
+                      "content": "ACTIVE"
+                    },
+                    {
+                      "content": "INACTIVE"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "application_id",
+                "description": "Application ID of the service principal. Set at creation time and cannot be changed\nafterwards; when omitted, the server generates one.",
+                "is_computed": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "Display name of the service principal.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "external_id",
+                "description": "ExternalId of the service principal in the customer's IdP.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "service_principal_id",
+                "description": "Internal service principal ID of the service principal in Databricks.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "display_name",
+                "description": "Display name of the service principal.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "account_sp_status",
+                "description": "The activity status of a service principal in a Databricks account.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "State",
+                  "enum": [
+                    {
+                      "content": "ACTIVE"
+                    },
+                    {
+                      "content": "INACTIVE"
+                    }
+                  ]
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateUser",
+            "description": "Creates a local user in the Databricks account and returns the created user. A local user is\none that is not synced from the customer's identity provider, and can be created whether or not\nAccount Identity Management (AIM) is enabled.\n\nWhen AIM is enabled, supplying an external ID returns an error. To provision the identity from\nyour identity provider, resolve it by its external ID with ResolveUser; to read an existing\nexternal identity, use the ExternalUser resource.",
+            "summary": "Create a user in the account.",
+            "path": "/api/2.0/identity/accounts/{account_id}/users",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "CreateUserRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "user",
+                  "description": "Required. User to be created in Databricks",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "User",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "user",
+                  "description": "Required. User to be created in Databricks",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "User",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "user",
+              "description": "Required. User to be created in Databricks",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "User",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "username",
+                    "description": "Username/email of the user.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "full_name",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "UserFullName",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "account_user_status",
+                    "description": "The activity status of a user in a Databricks account.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "State",
+                      "enum": [
+                        {
+                          "content": "ACTIVE"
+                        },
+                        {
+                          "content": "INACTIVE"
+                        }
+                      ]
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "username",
+                    "description": "Username/email of the user.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "full_name",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "UserFullName",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "account_user_status",
+                    "description": "The activity status of a user in a Databricks account.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "State",
+                      "enum": [
+                        {
+                          "content": "ACTIVE"
+                        },
+                        {
+                          "content": "INACTIVE"
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "User",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "username",
+                  "description": "Username/email of the user.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "full_name",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "UserFullName",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "account_user_status",
+                  "description": "The activity status of a user in a Databricks account.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "State",
+                    "enum": [
+                      {
+                        "content": "ACTIVE"
+                      },
+                      {
+                        "content": "INACTIVE"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "username",
+                  "description": "Username/email of the user.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "full_name",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "UserFullName",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "account_user_status",
+                  "description": "The activity status of a user in a Databricks account.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "State",
+                    "enum": [
+                      {
+                        "content": "ACTIVE"
+                      },
+                      {
+                        "content": "INACTIVE"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "user",
+                "description": "Required. User to be created in Databricks",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "User",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "username",
+                      "description": "Username/email of the user.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "full_name",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "UserFullName",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "account_user_status",
+                      "description": "The activity status of a user in a Databricks account.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "State",
+                        "enum": [
+                          {
+                            "content": "ACTIVE"
+                          },
+                          {
+                            "content": "INACTIVE"
+                          }
+                        ]
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "username",
+                      "description": "Username/email of the user.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "full_name",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "UserFullName",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "account_user_status",
+                      "description": "The activity status of a user in a Databricks account.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "State",
+                        "enum": [
+                          {
+                            "content": "ACTIVE"
+                          },
+                          {
+                            "content": "INACTIVE"
+                          }
+                        ]
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "account_id",
+                "description": "The accountId parent of the user in Databricks.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "account_user_status",
+                "description": "The activity status of a user in a Databricks account.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "State",
+                  "enum": [
+                    {
+                      "content": "ACTIVE"
+                    },
+                    {
+                      "content": "INACTIVE"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "external_id",
+                "description": "ExternalId of the user in the customer's IdP.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "full_name",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "UserFullName",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "user_id",
+                "description": "Internal userId of the user in Databricks.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "username",
+                "description": "Username/email of the user.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "username",
+                "description": "Username/email of the user.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "full_name",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "UserFullName",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "account_user_status",
+                "description": "The activity status of a user in a Databricks account.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "State",
+                  "enum": [
+                    {
+                      "content": "ACTIVE"
+                    },
+                    {
+                      "content": "INACTIVE"
+                    }
+                  ]
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateWorkspaceAssignment",
+            "description": "Creates a workspace assignment for a principal. Entitlements are granted one at a time\nrather than atomically. If the request fails partway through, the principal stays assigned to\nthe workspace with only some of the requested entitlements. Get the assignment\nafterwards to confirm which entitlements were granted.",
+            "summary": "Create a workspace assignment.",
+            "path": "/api/2.0/identity/accounts/{account_id}/workspaces/{workspace_id}/workspace-assignments",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "CreateWorkspaceAssignmentRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "Required. The workspace ID for which the workspace assignment is being created.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "workspace_assignment",
+                  "description": "Required. Workspace assignment to be created in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "WorkspaceAssignment",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "Required. The workspace ID for which the workspace assignment is being created.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "workspace_assignment",
+                  "description": "Required. Workspace assignment to be created in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "WorkspaceAssignment",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "workspace_assignment",
+              "description": "Required. Workspace assignment to be created in Databricks.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "WorkspaceAssignment",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "principal_id",
+                    "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_int64": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "principal_id",
+                    "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_int64": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "WorkspaceAssignment",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "workspace_assignment",
+                "description": "Required. Workspace assignment to be created in Databricks.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "WorkspaceAssignment",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "principal_id",
+                      "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_int64": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "principal_id",
+                      "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_int64": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "workspace_id",
+                "description": "Required. The workspace ID for which the workspace assignment is being created.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "account_id",
+                "description": "The account ID parent of the workspace where the principal is assigned",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_entitlements",
+                "description": "Every entitlement the principal holds in this workspace, whether granted directly or through\ngroup membership. Get responses populate this field. List responses leave it empty.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EntitlementList",
+                  "array_value": {
+                    "pascal_name": "Entitlement",
+                    "enum": [
+                      {
+                        "content": "ALLOW_CLUSTER_CREATE"
+                      },
+                      {
+                        "content": "ALLOW_INSTANCE_POOL_CREATE"
+                      },
+                      {
+                        "content": "DATABRICKS_SQL_ACCESS"
+                      },
+                      {
+                        "content": "WORKSPACE_ACCESS"
+                      },
+                      {
+                        "content": "WORKSPACE_ADMIN"
+                      },
+                      {
+                        "content": "WORKSPACE_CONSUME"
+                      }
+                    ]
+                  }
+                }
+              },
+              {
+                "name": "entitlements",
+                "description": "Entitlements granted directly to the principal on this workspace. This is the only\nclient-settable field. Create and update manage exactly this set, including entitlements the\nprincipal also holds through a group.\nList responses leave this field empty. Get a single principal to read its entitlements.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EntitlementList",
+                  "array_value": {
+                    "pascal_name": "Entitlement",
+                    "enum": [
+                      {
+                        "content": "ALLOW_CLUSTER_CREATE"
+                      },
+                      {
+                        "content": "ALLOW_INSTANCE_POOL_CREATE"
+                      },
+                      {
+                        "content": "DATABRICKS_SQL_ACCESS"
+                      },
+                      {
+                        "content": "WORKSPACE_ACCESS"
+                      },
+                      {
+                        "content": "WORKSPACE_ADMIN"
+                      },
+                      {
+                        "content": "WORKSPACE_CONSUME"
+                      }
+                    ]
+                  }
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "principal_type",
+                "description": "The type of the principal (user/service principal/group) that is assigned.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PrincipalType",
+                  "enum": [
+                    {
+                      "content": "GROUP"
+                    },
+                    {
+                      "content": "SERVICE_PRINCIPAL"
+                    },
+                    {
+                      "content": "USER"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "workspace_id",
+                "description": "The workspace ID where the principal is assigned.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "workspace_id",
+                "description": "Required. The workspace ID for which the workspace assignment is being created.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateWorkspaceAssignmentDetail",
+            "description": "Creates a workspace assignment detail for a principal.",
+            "summary": "Create a workspace assignment detail.",
+            "path": "/api/2.0/identity/accounts/{account_id}/workspaces/{workspace_id}/workspace-assignment-details",
+            "can_use_json": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "CreateWorkspaceAssignmentDetailRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "Required. The workspace ID for which the workspace assignment detail is being created.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "workspace_assignment_detail",
+                  "description": "Required. Workspace assignment detail to be created in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "WorkspaceAssignmentDetail",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "Required. The workspace ID for which the workspace assignment detail is being created.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "workspace_assignment_detail",
+                  "description": "Required. Workspace assignment detail to be created in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "WorkspaceAssignmentDetail",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "workspace_assignment_detail",
+              "description": "Required. Workspace assignment detail to be created in Databricks.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "WorkspaceAssignmentDetail",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "principal_id",
+                    "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_int64": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "principal_id",
+                    "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_int64": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "WorkspaceAssignmentDetail",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "workspace_assignment_detail",
+                "description": "Required. Workspace assignment detail to be created in Databricks.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "WorkspaceAssignmentDetail",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "principal_id",
+                      "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_int64": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "principal_id",
+                      "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_int64": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "workspace_id",
+                "description": "Required. The workspace ID for which the workspace assignment detail is being created.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "account_id",
+                "description": "The account ID parent of the workspace where the principal is assigned",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_entitlements",
+                "description": "Every entitlement the principal holds in this workspace, whether granted directly or through\ngroup membership. Get responses populate this field. List responses leave it empty.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EntitlementList",
+                  "array_value": {
+                    "pascal_name": "Entitlement",
+                    "enum": [
+                      {
+                        "content": "ALLOW_CLUSTER_CREATE"
+                      },
+                      {
+                        "content": "ALLOW_INSTANCE_POOL_CREATE"
+                      },
+                      {
+                        "content": "DATABRICKS_SQL_ACCESS"
+                      },
+                      {
+                        "content": "WORKSPACE_ACCESS"
+                      },
+                      {
+                        "content": "WORKSPACE_ADMIN"
+                      },
+                      {
+                        "content": "WORKSPACE_CONSUME"
+                      }
+                    ]
+                  }
+                }
+              },
+              {
+                "name": "entitlements",
+                "description": "Entitlements granted directly to the principal on this workspace. This is the only\nclient-settable field. Create and update manage exactly this set, including entitlements the\nprincipal also holds through a group.\nList responses leave this field empty. Get a single principal to read its entitlements.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EntitlementList",
+                  "array_value": {
+                    "pascal_name": "Entitlement",
+                    "enum": [
+                      {
+                        "content": "ALLOW_CLUSTER_CREATE"
+                      },
+                      {
+                        "content": "ALLOW_INSTANCE_POOL_CREATE"
+                      },
+                      {
+                        "content": "DATABRICKS_SQL_ACCESS"
+                      },
+                      {
+                        "content": "WORKSPACE_ACCESS"
+                      },
+                      {
+                        "content": "WORKSPACE_ADMIN"
+                      },
+                      {
+                        "content": "WORKSPACE_CONSUME"
+                      }
+                    ]
+                  }
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "principal_type",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PrincipalType",
+                  "enum": [
+                    {
+                      "content": "GROUP"
+                    },
+                    {
+                      "content": "SERVICE_PRINCIPAL"
+                    },
+                    {
+                      "content": "USER"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "workspace_id",
+                "description": "The workspace ID where the principal is assigned.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "workspace_id",
+                "description": "Required. The workspace ID for which the workspace assignment detail is being created.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteDirectGroupMember",
+            "description": "Deletes a group membership (unassigns a principal from a group).\n\nAuthorization: the caller must be an account admin or a manager of the group (holds the\n`roles/group.manager` role on it).",
+            "summary": "Delete a direct group membership.",
+            "path": "/api/2.0/identity/accounts/{account_id}/groups/{group_id}/direct-members/{principal_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "DeleteDirectGroupMemberRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "group_id",
+                  "description": "Required. Internal ID of the group in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "principal_id",
+                  "description": "Required. Internal ID of the principal to be unassigned from the group.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "group_id",
+                  "description": "Required. Internal ID of the group in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "principal_id",
+                  "description": "Required. Internal ID of the principal to be unassigned from the group.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "group_id",
+                "description": "Required. Internal ID of the group in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "Required. Internal ID of the principal to be unassigned from the group.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "group_id",
+                "description": "Required. Internal ID of the group in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "Required. Internal ID of the principal to be unassigned from the group.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteGroup",
+            "description": "Deletes a group from the Databricks account by its internal ID.\n\nAuthorization: the caller must be an account admin or a manager of the group (holds the\n`roles/group.manager` role on it).",
+            "summary": "Delete a group in the account.",
+            "path": "/api/2.0/identity/accounts/{account_id}/groups/{group_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "DeleteGroupRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "group_id",
+                  "description": "Required. Internal ID of the group in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "group_id",
+                  "description": "Required. Internal ID of the group in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "group_id",
+                "description": "Required. Internal ID of the group in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "group_id",
+                "description": "Required. Internal ID of the group in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteIdentityVisibilityFilter",
+            "description": "Deletes a group visibility filter by its resource name. Requires account admin privileges.\nDeleting a filter does not delete groups or revoke access. Groups covered only by this rule\nstop being discoverable unless they or a transitive parent are already provisioned in the\naccount. If no group filters remain, all groups become visible again.\nDeleting a filter that does not exist succeeds without making any changes.",
+            "summary": "Delete an identity-visibility filter.",
+            "path": "/api/2.0/identity/{name=accounts/*/identity-visibility-filters/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteIdentityVisibilityFilterRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Required. The resource name of the filter.\nFormat: accounts/{account_id}/identity-visibility-filters/{identity_visibility_filter_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Required. The resource name of the filter.\nFormat: accounts/{account_id}/identity-visibility-filters/{identity_visibility_filter_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Required. The resource name of the filter.\nFormat: accounts/{account_id}/identity-visibility-filters/{identity_visibility_filter_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Required. The resource name of the filter.\nFormat: accounts/{account_id}/identity-visibility-filters/{identity_visibility_filter_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteServicePrincipal",
+            "description": "Deletes a service principal from the Databricks account by its internal ID.",
+            "summary": "Delete a service principal in the account.",
+            "path": "/api/2.0/identity/accounts/{account_id}/service-principals/{service_principal_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "DeleteServicePrincipalRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "service_principal_id",
+                  "description": "Required. Internal ID of the service principal in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "service_principal_id",
+                  "description": "Required. Internal ID of the service principal in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "service_principal_id",
+                "description": "Required. Internal ID of the service principal in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "service_principal_id",
+                "description": "Required. Internal ID of the service principal in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteUser",
+            "description": "Deletes a user from the Databricks account by its internal ID.",
+            "summary": "Delete a user in the account.",
+            "path": "/api/2.0/identity/accounts/{account_id}/users/{user_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "DeleteUserRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "user_id",
+                  "description": "Required. Internal ID of the user in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "user_id",
+                  "description": "Required. Internal ID of the user in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "user_id",
+                "description": "Required. Internal ID of the user in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "user_id",
+                "description": "Required. Internal ID of the user in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteWorkspaceAssignment",
+            "description": "Deletes a workspace assignment for a principal, revoking all of its entitlements.\nEntitlements are revoked one at a time rather than atomically. If the request fails partway\nthrough, the principal stays assigned with some of its original entitlements. Retrying is safe.",
+            "summary": "Delete a workspace assignment.",
+            "path": "/api/2.0/identity/accounts/{account_id}/workspaces/{workspace_id}/workspace-assignments/{principal_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "DeleteWorkspaceAssignmentRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "The workspace ID where the principal has access.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "principal_id",
+                  "description": "Required. ID of the principal in Databricks to delete workspace assignment for.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "The workspace ID where the principal has access.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "principal_id",
+                  "description": "Required. ID of the principal in Databricks to delete workspace assignment for.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "principal_id",
+                "description": "Required. ID of the principal in Databricks to delete workspace assignment for.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "workspace_id",
+                "description": "The workspace ID where the principal has access.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "workspace_id",
+                "description": "The workspace ID where the principal has access.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "Required. ID of the principal in Databricks to delete workspace assignment for.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteWorkspaceAssignmentDetail",
+            "description": "Deletes a workspace assignment detail for a principal, revoking all of its entitlements.\nEntitlements are revoked one at a time rather than atomically. If the request fails partway\nthrough, the principal stays assigned with some of its original entitlements. Retrying is safe.",
+            "summary": "Delete a workspace assignment detail.",
+            "path": "/api/2.0/identity/accounts/{account_id}/workspaces/{workspace_id}/workspace-assignment-details/{principal_id}",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "DeleteWorkspaceAssignmentDetailRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "The workspace ID where the principal has access.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "principal_id",
+                  "description": "Required. ID of the principal in Databricks to delete workspace assignment for.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "The workspace ID where the principal has access.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "principal_id",
+                  "description": "Required. ID of the principal in Databricks to delete workspace assignment for.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "principal_id",
+                "description": "Required. ID of the principal in Databricks to delete workspace assignment for.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "workspace_id",
+                "description": "The workspace ID where the principal has access.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "workspace_id",
+                "description": "The workspace ID where the principal has access.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "Required. ID of the principal in Databricks to delete workspace assignment for.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetDirectGroupMember",
+            "description": "Gets a provisioned direct member of a group.",
+            "summary": "Get a direct group member.",
+            "path": "/api/2.0/identity/accounts/{account_id}/groups/{group_id}/direct-members/{principal_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetDirectGroupMemberRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "group_id",
+                  "description": "Required. Internal ID of the group in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "principal_id",
+                  "description": "Required. Internal ID of the principal belonging to the group in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "group_id",
+                  "description": "Required. Internal ID of the group in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "principal_id",
+                  "description": "Required. Internal ID of the principal belonging to the group in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DirectGroupMember",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "Internal ID of the principal in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "Internal ID of the principal in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "group_id",
+                "description": "Required. Internal ID of the group in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "Required. Internal ID of the principal belonging to the group in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "group_id",
+                "description": "Required. Internal ID of the group in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "Required. Internal ID of the principal belonging to the group in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetExternalGroup",
+            "description": "Retrieves an external group with the given external ID from the customer's\nIdP. If the group does not exist, it will be created in the account. If the\ncustomer is not onboarded onto Automatic Identity Management (AIM), this will\nreturn an error.",
+            "summary": "Get an external group in the account.",
+            "path": "/api/2.0/identity/{name=accounts/*/external-groups/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetExternalGroupRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Required. The resource name of the external group.\nFormat: accounts/{account_id}/external-groups/{external_group_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Required. The resource name of the external group.\nFormat: accounts/{account_id}/external-groups/{external_group_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ExternalGroup",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Required. The resource name of the external group.\nFormat: accounts/{account_id}/external-groups/{external_group_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Required. The resource name of the external group.\nFormat: accounts/{account_id}/external-groups/{external_group_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetExternalServicePrincipal",
+            "description": "Retrieves an external service principal with the given external ID from the\ncustomer's IdP. If the service principal does not exist, it will be created.\nIf the customer is not onboarded onto Automatic Identity Management (AIM),\nthis will return an error.",
+            "summary": "Get an external service principal in the account.",
+            "path": "/api/2.0/identity/{name=accounts/*/external-service-principals/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetExternalServicePrincipalRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Required. The resource name of the external service principal.\nFormat: accounts/{account_id}/external-service-principals/{external_service_principal_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Required. The resource name of the external service principal.\nFormat: accounts/{account_id}/external-service-principals/{external_service_principal_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ExternalServicePrincipal",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Required. The resource name of the external service principal.\nFormat: accounts/{account_id}/external-service-principals/{external_service_principal_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Required. The resource name of the external service principal.\nFormat: accounts/{account_id}/external-service-principals/{external_service_principal_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetExternalUser",
+            "description": "Retrieves an external user with the given external ID from the customer's\nIdP. If the user does not exist, it will be created. If the customer is not\nonboarded onto Automatic Identity Management (AIM), this will return an error.",
+            "summary": "Get an external user in the account.",
+            "path": "/api/2.0/identity/{name=accounts/*/external-users/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetExternalUserRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Required. The resource name of the external user.\nFormat: accounts/{account_id}/external-users/{external_user_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Required. The resource name of the external user.\nFormat: accounts/{account_id}/external-users/{external_user_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ExternalUser",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Required. The resource name of the external user.\nFormat: accounts/{account_id}/external-users/{external_user_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Required. The resource name of the external user.\nFormat: accounts/{account_id}/external-users/{external_user_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetGroup",
+            "description": "Fetches a group from the Databricks account by its internal ID.",
+            "summary": "Get a group in the account.",
+            "path": "/api/2.0/identity/accounts/{account_id}/groups/{group_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetGroupRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "group_id",
+                  "description": "Required. Internal ID of the group in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "group_id",
+                  "description": "Required. Internal ID of the group in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Group",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "group_id",
+                "description": "Required. Internal ID of the group in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "group_id",
+                "description": "Required. Internal ID of the group in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetIdentityVisibilityFilter",
+            "description": "Gets a group visibility filter by its resource name. Requires account admin privileges.\nReturns the filter rule, not the groups matched by the rule.",
+            "summary": "Get an identity-visibility filter.",
+            "path": "/api/2.0/identity/{name=accounts/*/identity-visibility-filters/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetIdentityVisibilityFilterRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Required. The resource name of the filter.\nFormat: accounts/{account_id}/identity-visibility-filters/{identity_visibility_filter_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Required. The resource name of the filter.\nFormat: accounts/{account_id}/identity-visibility-filters/{identity_visibility_filter_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "IdentityVisibilityFilter",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "principal_type",
+                  "description": "The type of principal this rule applies to. Set to `GROUP` when creating a filter.\nOther principal types are not supported for creation.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PrincipalType",
+                    "enum": [
+                      {
+                        "content": "GROUP"
+                      },
+                      {
+                        "content": "SERVICE_PRINCIPAL"
+                      },
+                      {
+                        "content": "USER"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "principal_type",
+                  "description": "The type of principal this rule applies to. Set to `GROUP` when creating a filter.\nOther principal types are not supported for creation.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PrincipalType",
+                    "enum": [
+                      {
+                        "content": "GROUP"
+                      },
+                      {
+                        "content": "SERVICE_PRINCIPAL"
+                      },
+                      {
+                        "content": "USER"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Required. The resource name of the filter.\nFormat: accounts/{account_id}/identity-visibility-filters/{identity_visibility_filter_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Required. The resource name of the filter.\nFormat: accounts/{account_id}/identity-visibility-filters/{identity_visibility_filter_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetServicePrincipal",
+            "description": "Fetches a service principal from the Databricks account by its internal ID.",
+            "summary": "Get a service principal in the account.",
+            "path": "/api/2.0/identity/accounts/{account_id}/service-principals/{service_principal_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetServicePrincipalRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "service_principal_id",
+                  "description": "Required. Internal ID of the service principal in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "service_principal_id",
+                  "description": "Required. Internal ID of the service principal in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ServicePrincipal",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "display_name",
+                  "description": "Display name of the service principal.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "account_sp_status",
+                  "description": "The activity status of a service principal in a Databricks account.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "State",
+                    "enum": [
+                      {
+                        "content": "ACTIVE"
+                      },
+                      {
+                        "content": "INACTIVE"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "display_name",
+                  "description": "Display name of the service principal.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "account_sp_status",
+                  "description": "The activity status of a service principal in a Databricks account.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "State",
+                    "enum": [
+                      {
+                        "content": "ACTIVE"
+                      },
+                      {
+                        "content": "INACTIVE"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "service_principal_id",
+                "description": "Required. Internal ID of the service principal in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "service_principal_id",
+                "description": "Required. Internal ID of the service principal in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetUser",
+            "description": "Fetches a user from the Databricks account by its internal ID.",
+            "summary": "Get a user in the account.",
+            "path": "/api/2.0/identity/accounts/{account_id}/users/{user_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetUserRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "user_id",
+                  "description": "Required. Internal ID of the user in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "user_id",
+                  "description": "Required. Internal ID of the user in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "User",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "username",
+                  "description": "Username/email of the user.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "full_name",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "UserFullName",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "account_user_status",
+                  "description": "The activity status of a user in a Databricks account.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "State",
+                    "enum": [
+                      {
+                        "content": "ACTIVE"
+                      },
+                      {
+                        "content": "INACTIVE"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "username",
+                  "description": "Username/email of the user.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "full_name",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "UserFullName",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "account_user_status",
+                  "description": "The activity status of a user in a Databricks account.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "State",
+                    "enum": [
+                      {
+                        "content": "ACTIVE"
+                      },
+                      {
+                        "content": "INACTIVE"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "user_id",
+                "description": "Required. Internal ID of the user in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "user_id",
+                "description": "Required. Internal ID of the user in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetWorkspaceAccessDetail",
+            "description": "Returns the access details for a principal in a workspace. Allows for checking access details for any\nprovisioned principal (user, service principal, or group) in a workspace.\n* Provisioned principal here refers to one that has been synced into Databricks from the customer's IdP or\nadded explicitly to Databricks via SCIM/UI.\nAllows for passing in a \"view\" parameter to control what fields are returned (BASIC by default or FULL).",
+            "summary": "Get workspace access details for a principal.",
+            "path": "/api/2.0/identity/accounts/{account_id}/workspaces/{workspace_id}/workspace-access-details/{principal_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetWorkspaceAccessDetailRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "Required. The workspace ID for which the access details are being requested.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "principal_id",
+                  "description": "Required. The internal ID of the principal (user/sp/group) for which the access details are being requested.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "Required. The workspace ID for which the access details are being requested.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "principal_id",
+                  "description": "Required. The internal ID of the principal (user/sp/group) for which the access details are being requested.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "WorkspaceAccessDetail",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "principal_id",
+                "description": "Required. The internal ID of the principal (user/sp/group) for which the access details are being requested.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "view",
+                "description": "Controls what fields are returned.",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "WorkspaceAccessDetailView",
+                  "enum": [
+                    {
+                      "content": "BASIC"
+                    },
+                    {
+                      "content": "FULL"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "workspace_id",
+                "description": "Required. The workspace ID for which the access details are being requested.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "workspace_id",
+                "description": "Required. The workspace ID for which the access details are being requested.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "Required. The internal ID of the principal (user/sp/group) for which the access details are being requested.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetWorkspaceAssignment",
+            "description": "Returns the assignment for a principal in a workspace.",
+            "summary": "Get a workspace assignment for a principal.",
+            "path": "/api/2.0/identity/accounts/{account_id}/workspaces/{workspace_id}/workspace-assignments/{principal_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetWorkspaceAssignmentRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "Required. The workspace ID for which the assignment is being requested.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "principal_id",
+                  "description": "Required. The internal ID of the principal (user/sp/group) for which the assignment is being requested.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "Required. The workspace ID for which the assignment is being requested.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "principal_id",
+                  "description": "Required. The internal ID of the principal (user/sp/group) for which the assignment is being requested.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "WorkspaceAssignment",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "principal_id",
+                "description": "Required. The internal ID of the principal (user/sp/group) for which the assignment is being requested.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "workspace_id",
+                "description": "Required. The workspace ID for which the assignment is being requested.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "workspace_id",
+                "description": "Required. The workspace ID for which the assignment is being requested.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "Required. The internal ID of the principal (user/sp/group) for which the assignment is being requested.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetWorkspaceAssignmentDetail",
+            "description": "Returns the assignment details for a principal in a workspace.",
+            "summary": "Get workspace assignment details for a principal.",
+            "path": "/api/2.0/identity/accounts/{account_id}/workspaces/{workspace_id}/workspace-assignment-details/{principal_id}",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "GetWorkspaceAssignmentDetailRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "Required. The workspace ID for which the assignment details are being requested.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "principal_id",
+                  "description": "Required. The internal ID of the principal (user/sp/group) for which the assignment details are being requested.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "Required. The workspace ID for which the assignment details are being requested.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "principal_id",
+                  "description": "Required. The internal ID of the principal (user/sp/group) for which the assignment details are being requested.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "WorkspaceAssignmentDetail",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "principal_id",
+                "description": "Required. The internal ID of the principal (user/sp/group) for which the assignment details are being requested.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "workspace_id",
+                "description": "Required. The workspace ID for which the assignment details are being requested.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "workspace_id",
+                "description": "Required. The workspace ID for which the assignment details are being requested.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "Required. The internal ID of the principal (user/sp/group) for which the assignment details are being requested.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListDirectGroupMembers",
+            "description": "Lists provisioned direct members of a group with their membership source (internal or from identity provider).",
+            "summary": "List direct group members.",
+            "path": "/api/2.0/identity/accounts/{account_id}/groups/{group_id}/direct-members",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ListDirectGroupMembersRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "group_id",
+                  "description": "Required. Internal ID of the group in Databricks whose direct members are being listed.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "group_id",
+                  "description": "Required. Internal ID of the group in Databricks whose direct members are being listed.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListDirectGroupMembersResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "group_id",
+                "description": "Required. Internal ID of the group in Databricks whose direct members are being listed.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "The maximum number of members to return. The service may return fewer than this value.\nIf not provided, defaults to 1000, which is also the maximum allowed. Requests for more than the maximum are clamped to 1000.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "A page token, received from a previous ListDirectGroupMembers call. Provide this to retrieve the subsequent page.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "group_id",
+                "description": "Required. Internal ID of the group in Databricks whose direct members are being listed.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "A page token, received from a previous ListDirectGroupMembers call. Provide this to retrieve the subsequent page.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListGroups",
+            "description": "Lists the groups in the Databricks account, returning one page per call. Supports filtering by\ngroup name or external ID.",
+            "summary": "List groups in the account.",
+            "path": "/api/2.0/identity/accounts/{account_id}/groups",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ListGroupsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListGroupsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "filter",
+                "description": "Optional. Allows filtering groups by group name or external id.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "The maximum number of groups to return. The service may return fewer than this value.\nIf not provided, defaults to 1000, which is also the maximum allowed. Requests for more than the maximum are clamped to 1000.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "A page token, received from a previous ListGroups call. Provide this to retrieve the subsequent page.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "A page token, received from a previous ListGroups call. Provide this to retrieve the subsequent page.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListIdentityVisibilityFilters",
+            "description": "Lists group visibility filters in the account, returning one page per call. Requires account\nadmin privileges. Returns filter rules, not the groups matched by those rules.\nTo retrieve the next page, pass the response's `next_page_token` as `page_token` in the next\nrequest. If `next_page_token` is omitted, there are no more pages.",
+            "summary": "List the identity-visibility filters in the account.",
+            "path": "/api/2.0/identity/{parent=accounts/*}/identity-visibility-filters",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListIdentityVisibilityFiltersRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "Required. The parent account. Format: accounts/{account_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "Required. The parent account. Format: accounts/{account_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListIdentityVisibilityFiltersResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "The maximum number of filters to return. The service may return fewer than this value.\nIf omitted or non-positive, defaults to 100. Values above 1000 are reduced to 1000.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "A page token, received from a previous ListIdentityVisibilityFilters call. Provide this to retrieve the subsequent page.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "Required. The parent account. Format: accounts/{account_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "Required. The parent account. Format: accounts/{account_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "A page token, received from a previous ListIdentityVisibilityFilters call. Provide this to retrieve the subsequent page.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListServicePrincipals",
+            "description": "Lists the service principals in the Databricks account, returning one page per call. Supports\nfiltering by application ID or external ID.",
+            "summary": "List service principals in the account.",
+            "path": "/api/2.0/identity/accounts/{account_id}/service-principals",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ListServicePrincipalsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListServicePrincipalsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "filter",
+                "description": "Optional. Allows filtering service principals by application id or external id.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "The maximum number of service principals to return. The service may return fewer than this value.\nIf not provided, defaults to 1000, which is also the maximum allowed. Requests for more than the maximum are clamped to 1000.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "A page token, received from a previous ListServicePrincipals call. Provide this to retrieve the subsequent page.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "A page token, received from a previous ListServicePrincipals call. Provide this to retrieve the subsequent page.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListTransitiveParentGroups",
+            "description": "Lists all transitive parent groups of a principal.",
+            "summary": "List all transitive parent groups of a principal.",
+            "path": "/api/2.0/identity/accounts/{account_id}/principals/{principal_id}/transitive-parent-groups",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ListTransitiveParentGroupsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "Required. Internal ID of the principal in Databricks whose transitive parent groups are being listed.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "Required. Internal ID of the principal in Databricks whose transitive parent groups are being listed.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListTransitiveParentGroupsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "The maximum number of parent groups to return. The service may return fewer than this value.\nIf not provided, defaults to 1000, which is also the maximum allowed. Requests for more than the maximum are clamped to 1000.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "A page token, received from a previous ListTransitiveParentGroups call. Provide this to retrieve the subsequent page.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "Required. Internal ID of the principal in Databricks whose transitive parent groups are being listed.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "principal_id",
+                "description": "Required. Internal ID of the principal in Databricks whose transitive parent groups are being listed.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListUsers",
+            "description": "Lists the users in the Databricks account, returning one page per call. Supports filtering by\nusername or external ID.",
+            "summary": "List users in the account.",
+            "path": "/api/2.0/identity/accounts/{account_id}/users",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ListUsersRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListUsersResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "filter",
+                "description": "Optional. Allows filtering users by username or external id.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "The maximum number of users to return. The service may return fewer than this value.\nIf not provided, defaults to 1000, which is also the maximum allowed. Requests for more than the maximum are clamped to 1000.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "A page token, received from a previous ListUsers call. Provide this to retrieve the subsequent page.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "A page token, received from a previous ListUsers call. Provide this to retrieve the subsequent page.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListWorkspaceAssignmentDetails",
+            "description": "Lists workspace assignment details for a workspace. The response omits the per-principal\nentitlement fields (`entitlements` and `effective_entitlements`). To read the entitlements for\na single principal, get that principal's assignment detail.",
+            "summary": "List workspace assignment details for a workspace.",
+            "path": "/api/2.0/identity/accounts/{account_id}/workspaces/{workspace_id}/workspace-assignment-details",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "ListWorkspaceAssignmentDetailsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "Required. The workspace ID for which the workspace assignment details are being fetched.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "Required. The workspace ID for which the workspace assignment details are being fetched.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListWorkspaceAssignmentDetailsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "The maximum number of workspace assignment details to return. The service may return fewer than this value.\nIf not provided, defaults to 1000, which is also the maximum allowed. Requests for more than the maximum are clamped to 1000.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "A page token, received from a previous ListWorkspaceAssignmentDetails call. Provide this to retrieve the subsequent page.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "workspace_id",
+                "description": "Required. The workspace ID for which the workspace assignment details are being fetched.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "workspace_id",
+                "description": "Required. The workspace ID for which the workspace assignment details are being fetched.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "A page token, received from a previous ListWorkspaceAssignmentDetails call. Provide this to retrieve the subsequent page.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListWorkspaceAssignments",
+            "description": "Lists workspace assignments for a workspace. The response omits the per-principal\nentitlement fields (`entitlements` and `effective_entitlements`). To read the entitlements for\na single principal, get that principal's assignment.",
+            "summary": "List workspace assignments for a workspace.",
+            "path": "/api/2.0/identity/accounts/{account_id}/workspaces/{workspace_id}/workspace-assignments",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ListWorkspaceAssignmentsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "Required. The workspace ID for which the workspace assignments are being fetched.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "Required. The workspace ID for which the workspace assignments are being fetched.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListWorkspaceAssignmentsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "The maximum number of workspace assignments to return. The service may return fewer than this value.\nIf not provided, defaults to 1000, which is also the maximum allowed. Requests for more than the maximum are clamped to 1000.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "A page token, received from a previous ListWorkspaceAssignments call. Provide this to retrieve the subsequent page.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "workspace_id",
+                "description": "Required. The workspace ID for which the workspace assignments are being fetched.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "workspace_id",
+                "description": "Required. The workspace ID for which the workspace assignments are being fetched.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "A page token, received from a previous ListWorkspaceAssignments call. Provide this to retrieve the subsequent page.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ResolveGroup",
+            "description": "Resolves a group with the given external ID from the customer's IdP. If the group does not exist, it will be created in the account.\nIf the customer is not onboarded onto Automatic Identity Management (AIM), this will return an error.",
+            "summary": "Resolve an external group in the Databricks account.",
+            "path": "/api/2.0/identity/accounts/{account_id}/groups/resolve-by-external-id",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ResolveGroupRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "external_id",
+                  "description": "Required. The external ID of the group in the customer's IdP.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "external_id",
+                  "description": "Required. The external ID of the group in the customer's IdP.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ResolveGroupResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "external_id",
+                "description": "Required. The external ID of the group in the customer's IdP.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "external_id",
+                "description": "Required. The external ID of the group in the customer's IdP.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ResolveServicePrincipal",
+            "description": "Resolves a service principal with the given external ID from the customer's IdP. If the service\nprincipal does not exist, it will be created.\nIf the customer is not onboarded onto Automatic Identity Management (AIM), this will return an error.",
+            "summary": "Resolve an external service principal in the Databricks account.",
+            "path": "/api/2.0/identity/accounts/{account_id}/service-principals/resolve-by-external-id",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ResolveServicePrincipalRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "external_id",
+                  "description": "Required. The external ID of the service principal in the customer's IdP.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "external_id",
+                  "description": "Required. The external ID of the service principal in the customer's IdP.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ResolveServicePrincipalResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "external_id",
+                "description": "Required. The external ID of the service principal in the customer's IdP.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "external_id",
+                "description": "Required. The external ID of the service principal in the customer's IdP.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ResolveUser",
+            "description": "Resolves a user with the given external ID from the customer's IdP. If the user does not exist, it will be created.\nIf the customer is not onboarded onto Automatic Identity Management (AIM), this will return an error.",
+            "summary": "Resolve an external user in the Databricks account.",
+            "path": "/api/2.0/identity/accounts/{account_id}/users/resolve-by-external-id",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ResolveUserRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "external_id",
+                  "description": "Required. The external ID of the user in the customer's IdP.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "external_id",
+                  "description": "Required. The external ID of the user in the customer's IdP.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ResolveUserResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "external_id",
+                "description": "Required. The external ID of the user in the customer's IdP.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "external_id",
+                "description": "Required. The external ID of the user in the customer's IdP.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateGroup",
+            "description": "Updates an existing group in the Databricks account. Only the fields named in the update mask\nare modified. Returns the updated Group resource.\n\nWhen AIM is enabled and the group is an external identity (its external_id is set), only\nexternal_id can be updated; its other fields are sourced from your identity provider.\nWith AIM and group visibility filters, a new nonempty external_id must identify a visible group.\nClearing external_id is allowed.\n\nAuthorization: the caller must be an account admin or a manager of the group (holds the\n`roles/group.manager` role on it).",
+            "summary": "Update a group in the account.",
+            "path": "/api/2.0/identity/accounts/{account_id}/groups/{group_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "UpdateGroupRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "group_id",
+                  "description": "Required. Internal ID of the group in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "group",
+                  "description": "Required. Group to be updated in Databricks",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Group",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Optional. The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "group_id",
+                  "description": "Required. Internal ID of the group in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Optional. The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "group",
+                  "description": "Required. Group to be updated in Databricks",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Group",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "group",
+              "description": "Required. Group to be updated in Databricks",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Group",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "Group",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "group",
+                "description": "Required. Group to be updated in Databricks",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Group",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "group_id",
+                "description": "Required. Internal ID of the group in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Optional. The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "account_id",
+                "description": "The parent account ID for group in Databricks.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "external_id",
+                "description": "ExternalId of the group in the customer's IdP.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "group_id",
+                "description": "Internal group ID of the group in Databricks.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "group_name",
+                "description": "Display name of the group.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "group_id",
+                "description": "Required. Internal ID of the group in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Optional. The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateServicePrincipal",
+            "description": "Updates an existing service principal in the Databricks account. Only the fields named in the\nupdate mask are modified. Returns the updated ServicePrincipal resource.\n\nWhen AIM is enabled and the service principal is an external identity (its external_id is set),\nonly external_id can be updated; its other fields are sourced from your identity provider.",
+            "summary": "Update a service principal in the account.",
+            "path": "/api/2.0/identity/accounts/{account_id}/service-principals/{service_principal_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "UpdateServicePrincipalRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "service_principal_id",
+                  "description": "Required. Internal ID of the service principal in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "service_principal",
+                  "description": "Required. Service Principal to be updated in Databricks",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ServicePrincipal",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Optional. The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "service_principal_id",
+                  "description": "Required. Internal ID of the service principal in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Optional. The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "service_principal",
+                  "description": "Required. Service Principal to be updated in Databricks",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ServicePrincipal",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "service_principal",
+              "description": "Required. Service Principal to be updated in Databricks",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "ServicePrincipal",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "display_name",
+                    "description": "Display name of the service principal.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "account_sp_status",
+                    "description": "The activity status of a service principal in a Databricks account.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "State",
+                      "enum": [
+                        {
+                          "content": "ACTIVE"
+                        },
+                        {
+                          "content": "INACTIVE"
+                        }
+                      ]
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "display_name",
+                    "description": "Display name of the service principal.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "account_sp_status",
+                    "description": "The activity status of a service principal in a Databricks account.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "State",
+                      "enum": [
+                        {
+                          "content": "ACTIVE"
+                        },
+                        {
+                          "content": "INACTIVE"
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "ServicePrincipal",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "display_name",
+                  "description": "Display name of the service principal.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "account_sp_status",
+                  "description": "The activity status of a service principal in a Databricks account.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "State",
+                    "enum": [
+                      {
+                        "content": "ACTIVE"
+                      },
+                      {
+                        "content": "INACTIVE"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "display_name",
+                  "description": "Display name of the service principal.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "account_sp_status",
+                  "description": "The activity status of a service principal in a Databricks account.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "State",
+                    "enum": [
+                      {
+                        "content": "ACTIVE"
+                      },
+                      {
+                        "content": "INACTIVE"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "service_principal",
+                "description": "Required. Service Principal to be updated in Databricks",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ServicePrincipal",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "display_name",
+                      "description": "Display name of the service principal.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "account_sp_status",
+                      "description": "The activity status of a service principal in a Databricks account.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "State",
+                        "enum": [
+                          {
+                            "content": "ACTIVE"
+                          },
+                          {
+                            "content": "INACTIVE"
+                          }
+                        ]
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "display_name",
+                      "description": "Display name of the service principal.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "account_sp_status",
+                      "description": "The activity status of a service principal in a Databricks account.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "State",
+                        "enum": [
+                          {
+                            "content": "ACTIVE"
+                          },
+                          {
+                            "content": "INACTIVE"
+                          }
+                        ]
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "service_principal_id",
+                "description": "Required. Internal ID of the service principal in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Optional. The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "account_id",
+                "description": "The parent account ID for the service principal in Databricks.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "account_sp_status",
+                "description": "The activity status of a service principal in a Databricks account.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "State",
+                  "enum": [
+                    {
+                      "content": "ACTIVE"
+                    },
+                    {
+                      "content": "INACTIVE"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "application_id",
+                "description": "Application ID of the service principal. Set at creation time and cannot be changed\nafterwards; when omitted, the server generates one.",
+                "is_computed": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "Display name of the service principal.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "external_id",
+                "description": "ExternalId of the service principal in the customer's IdP.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "service_principal_id",
+                "description": "Internal service principal ID of the service principal in Databricks.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "service_principal_id",
+                "description": "Required. Internal ID of the service principal in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Optional. The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "Display name of the service principal.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "account_sp_status",
+                "description": "The activity status of a service principal in a Databricks account.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "State",
+                  "enum": [
+                    {
+                      "content": "ACTIVE"
+                    },
+                    {
+                      "content": "INACTIVE"
+                    }
+                  ]
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateUser",
+            "description": "Updates an existing user in the Databricks account and returns the updated user. Only the\nfields named in the update mask are modified. The updatable fields are fullName.givenName,\nfullName.familyName, status, and externalId.\n\nWhen AIM is enabled and the user is an external identity (its external_id is set), only\nexternal_id can be updated; its other fields are sourced from your identity provider.",
+            "summary": "Update a user in the account.",
+            "path": "/api/2.0/identity/accounts/{account_id}/users/{user_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "UpdateUserRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "user_id",
+                  "description": "Required. Internal ID of the user in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "user",
+                  "description": "Required. User to be updated in Databricks",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "User",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Optional. The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "user_id",
+                  "description": "Required. Internal ID of the user in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Optional. The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "user",
+                  "description": "Required. User to be updated in Databricks",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "User",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "user",
+              "description": "Required. User to be updated in Databricks",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "User",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "username",
+                    "description": "Username/email of the user.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "full_name",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "UserFullName",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "account_user_status",
+                    "description": "The activity status of a user in a Databricks account.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "State",
+                      "enum": [
+                        {
+                          "content": "ACTIVE"
+                        },
+                        {
+                          "content": "INACTIVE"
+                        }
+                      ]
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "username",
+                    "description": "Username/email of the user.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "full_name",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "UserFullName",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "account_user_status",
+                    "description": "The activity status of a user in a Databricks account.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "State",
+                      "enum": [
+                        {
+                          "content": "ACTIVE"
+                        },
+                        {
+                          "content": "INACTIVE"
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "User",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "username",
+                  "description": "Username/email of the user.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "full_name",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "UserFullName",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "account_user_status",
+                  "description": "The activity status of a user in a Databricks account.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "State",
+                    "enum": [
+                      {
+                        "content": "ACTIVE"
+                      },
+                      {
+                        "content": "INACTIVE"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "username",
+                  "description": "Username/email of the user.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "full_name",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "UserFullName",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "account_user_status",
+                  "description": "The activity status of a user in a Databricks account.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "State",
+                    "enum": [
+                      {
+                        "content": "ACTIVE"
+                      },
+                      {
+                        "content": "INACTIVE"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "update_mask",
+                "description": "Optional. The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "user",
+                "description": "Required. User to be updated in Databricks",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "User",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "username",
+                      "description": "Username/email of the user.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "full_name",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "UserFullName",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "account_user_status",
+                      "description": "The activity status of a user in a Databricks account.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "State",
+                        "enum": [
+                          {
+                            "content": "ACTIVE"
+                          },
+                          {
+                            "content": "INACTIVE"
+                          }
+                        ]
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "username",
+                      "description": "Username/email of the user.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "full_name",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "UserFullName",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "account_user_status",
+                      "description": "The activity status of a user in a Databricks account.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "State",
+                        "enum": [
+                          {
+                            "content": "ACTIVE"
+                          },
+                          {
+                            "content": "INACTIVE"
+                          }
+                        ]
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "user_id",
+                "description": "Required. Internal ID of the user in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "account_id",
+                "description": "The accountId parent of the user in Databricks.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "account_user_status",
+                "description": "The activity status of a user in a Databricks account.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "State",
+                  "enum": [
+                    {
+                      "content": "ACTIVE"
+                    },
+                    {
+                      "content": "INACTIVE"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "external_id",
+                "description": "ExternalId of the user in the customer's IdP.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "full_name",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "UserFullName",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "user_id",
+                "description": "Internal userId of the user in Databricks.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "username",
+                "description": "Username/email of the user.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "user_id",
+                "description": "Required. Internal ID of the user in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Optional. The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "username",
+                "description": "Username/email of the user.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "full_name",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "UserFullName",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "account_user_status",
+                "description": "The activity status of a user in a Databricks account.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "State",
+                  "enum": [
+                    {
+                      "content": "ACTIVE"
+                    },
+                    {
+                      "content": "INACTIVE"
+                    }
+                  ]
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateWorkspaceAssignment",
+            "description": "Updates the entitlements of a directly assigned principal in a workspace. Changes are applied\none at a time rather than atomically. If the request fails partway through, only some of the\nrequested changes take effect. Get the assignment afterwards to confirm the final state.",
+            "summary": "Update a workspace assignment.",
+            "path": "/api/2.0/identity/accounts/{account_id}/workspaces/{workspace_id}/workspace-assignments/{principal_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "UpdateWorkspaceAssignmentRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "Required. The workspace ID for which the workspace assignment is being updated.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "principal_id",
+                  "description": "Required. ID of the principal in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "workspace_assignment",
+                  "description": "Required. Workspace assignment to be updated in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "WorkspaceAssignment",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Required. The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "Required. The workspace ID for which the workspace assignment is being updated.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "principal_id",
+                  "description": "Required. ID of the principal in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Required. The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "workspace_assignment",
+                  "description": "Required. Workspace assignment to be updated in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "WorkspaceAssignment",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "workspace_assignment",
+              "description": "Required. Workspace assignment to be updated in Databricks.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "WorkspaceAssignment",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "principal_id",
+                    "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_int64": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "principal_id",
+                    "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_int64": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "WorkspaceAssignment",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "principal_id",
+                "description": "Required. ID of the principal in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Required. The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "workspace_assignment",
+                "description": "Required. Workspace assignment to be updated in Databricks.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "WorkspaceAssignment",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "principal_id",
+                      "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_int64": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "principal_id",
+                      "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_int64": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "workspace_id",
+                "description": "Required. The workspace ID for which the workspace assignment is being updated.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "account_id",
+                "description": "The account ID parent of the workspace where the principal is assigned",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_entitlements",
+                "description": "Every entitlement the principal holds in this workspace, whether granted directly or through\ngroup membership. Get responses populate this field. List responses leave it empty.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EntitlementList",
+                  "array_value": {
+                    "pascal_name": "Entitlement",
+                    "enum": [
+                      {
+                        "content": "ALLOW_CLUSTER_CREATE"
+                      },
+                      {
+                        "content": "ALLOW_INSTANCE_POOL_CREATE"
+                      },
+                      {
+                        "content": "DATABRICKS_SQL_ACCESS"
+                      },
+                      {
+                        "content": "WORKSPACE_ACCESS"
+                      },
+                      {
+                        "content": "WORKSPACE_ADMIN"
+                      },
+                      {
+                        "content": "WORKSPACE_CONSUME"
+                      }
+                    ]
+                  }
+                }
+              },
+              {
+                "name": "entitlements",
+                "description": "Entitlements granted directly to the principal on this workspace. This is the only\nclient-settable field. Create and update manage exactly this set, including entitlements the\nprincipal also holds through a group.\nList responses leave this field empty. Get a single principal to read its entitlements.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EntitlementList",
+                  "array_value": {
+                    "pascal_name": "Entitlement",
+                    "enum": [
+                      {
+                        "content": "ALLOW_CLUSTER_CREATE"
+                      },
+                      {
+                        "content": "ALLOW_INSTANCE_POOL_CREATE"
+                      },
+                      {
+                        "content": "DATABRICKS_SQL_ACCESS"
+                      },
+                      {
+                        "content": "WORKSPACE_ACCESS"
+                      },
+                      {
+                        "content": "WORKSPACE_ADMIN"
+                      },
+                      {
+                        "content": "WORKSPACE_CONSUME"
+                      }
+                    ]
+                  }
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "principal_type",
+                "description": "The type of the principal (user/service principal/group) that is assigned.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PrincipalType",
+                  "enum": [
+                    {
+                      "content": "GROUP"
+                    },
+                    {
+                      "content": "SERVICE_PRINCIPAL"
+                    },
+                    {
+                      "content": "USER"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "workspace_id",
+                "description": "The workspace ID where the principal is assigned.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "workspace_id",
+                "description": "Required. The workspace ID for which the workspace assignment is being updated.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "Required. ID of the principal in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Required. The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateWorkspaceAssignmentDetail",
+            "description": "Updates the entitlements of a directly assigned principal in a workspace. Changes are applied\none at a time rather than atomically. If the request fails partway through, only some of the\nrequested changes take effect. Get the assignment detail afterwards to confirm the final state.",
+            "summary": "Update a workspace assignment detail.",
+            "path": "/api/2.0/identity/accounts/{account_id}/workspaces/{workspace_id}/workspace-assignment-details/{principal_id}",
+            "can_use_json": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "UpdateWorkspaceAssignmentDetailRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "Required. The workspace ID for which the workspace assignment detail is being updated.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "principal_id",
+                  "description": "Required. ID of the principal in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "workspace_assignment_detail",
+                  "description": "Required. Workspace assignment detail to be updated in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "WorkspaceAssignmentDetail",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Required. The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "Required. The workspace ID for which the workspace assignment detail is being updated.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "principal_id",
+                  "description": "Required. ID of the principal in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Required. The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "workspace_assignment_detail",
+                  "description": "Required. Workspace assignment detail to be updated in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "WorkspaceAssignmentDetail",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "workspace_assignment_detail",
+              "description": "Required. Workspace assignment detail to be updated in Databricks.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "WorkspaceAssignmentDetail",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "principal_id",
+                    "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_int64": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "principal_id",
+                    "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_int64": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "WorkspaceAssignmentDetail",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "principal_id",
+                "description": "Required. ID of the principal in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Required. The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "workspace_assignment_detail",
+                "description": "Required. Workspace assignment detail to be updated in Databricks.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "WorkspaceAssignmentDetail",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "principal_id",
+                      "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_int64": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "principal_id",
+                      "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_int64": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "workspace_id",
+                "description": "Required. The workspace ID for which the workspace assignment detail is being updated.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "account_id",
+                "description": "The account ID parent of the workspace where the principal is assigned",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_entitlements",
+                "description": "Every entitlement the principal holds in this workspace, whether granted directly or through\ngroup membership. Get responses populate this field. List responses leave it empty.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EntitlementList",
+                  "array_value": {
+                    "pascal_name": "Entitlement",
+                    "enum": [
+                      {
+                        "content": "ALLOW_CLUSTER_CREATE"
+                      },
+                      {
+                        "content": "ALLOW_INSTANCE_POOL_CREATE"
+                      },
+                      {
+                        "content": "DATABRICKS_SQL_ACCESS"
+                      },
+                      {
+                        "content": "WORKSPACE_ACCESS"
+                      },
+                      {
+                        "content": "WORKSPACE_ADMIN"
+                      },
+                      {
+                        "content": "WORKSPACE_CONSUME"
+                      }
+                    ]
+                  }
+                }
+              },
+              {
+                "name": "entitlements",
+                "description": "Entitlements granted directly to the principal on this workspace. This is the only\nclient-settable field. Create and update manage exactly this set, including entitlements the\nprincipal also holds through a group.\nList responses leave this field empty. Get a single principal to read its entitlements.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EntitlementList",
+                  "array_value": {
+                    "pascal_name": "Entitlement",
+                    "enum": [
+                      {
+                        "content": "ALLOW_CLUSTER_CREATE"
+                      },
+                      {
+                        "content": "ALLOW_INSTANCE_POOL_CREATE"
+                      },
+                      {
+                        "content": "DATABRICKS_SQL_ACCESS"
+                      },
+                      {
+                        "content": "WORKSPACE_ACCESS"
+                      },
+                      {
+                        "content": "WORKSPACE_ADMIN"
+                      },
+                      {
+                        "content": "WORKSPACE_CONSUME"
+                      }
+                    ]
+                  }
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "principal_type",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PrincipalType",
+                  "enum": [
+                    {
+                      "content": "GROUP"
+                    },
+                    {
+                      "content": "SERVICE_PRINCIPAL"
+                    },
+                    {
+                      "content": "USER"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "workspace_id",
+                "description": "The workspace ID where the principal is assigned.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "workspace_id",
+                "description": "Required. The workspace ID for which the workspace assignment detail is being updated.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "Required. ID of the principal in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Required. The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "compute.InstancePools",
+        "name": "InstancePools",
+        "description": "Instance Pools API are used to create, edit, delete and list instance pools by using\nready-to-use cloud instances which reduces a cluster start and auto-scaling times.\n\nDatabricks pools reduce cluster start and auto-scaling times by maintaining a set of idle,\nready-to-use instances. When a cluster is attached to a pool, cluster nodes are created using\nthe pool’s idle instances. If the pool has no idle instances, the pool expands by allocating\na new instance from the instance provider in order to accommodate the cluster’s request.\nWhen a cluster releases an instance, it returns to the pool and is free for another cluster\nto use. Only clusters attached to a pool can use that pool’s idle instances.\n\nYou can specify a different pool for the driver node and worker nodes, or use the same pool\nfor both.\n\nDatabricks does not charge DBUs while instances are idle in the pool. Instance provider\nbilling does apply. See pricing.",
+        "package": {
+          "name": "compute"
+        },
+        "docs_group": "compute",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "named_id_map": {
+            "pascal_name": "InstancePoolAndStatsInstancePoolNameToInstancePoolIdMap"
+          },
+          "is_legacy_empty_request": true,
+          "request": {
+            "pascal_name": "ListInstancePoolsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a new instance pool using idle and ready-to-use cloud instances.",
+            "summary": "Create a new instance pool.",
+            "path": "/api/2.0/instance-pools/create",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateInstancePool",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "instance_pool_name",
+                  "description": "Pool name requested by the user. Pool name must be unique. Length must be between 1 and 100\ncharacters.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "node_type_id",
+                  "description": "This field encodes, through a single value, the resources available to each of\nthe Spark nodes in this cluster. For example, the Spark nodes can be provisioned\nand optimized for memory or compute intensive workloads. A list of available node\ntypes can be retrieved by using the [clusters/listNodeTypes](https://docs.databricks.com/api/workspace/clusters/listnodetypes) API call.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "instance_pool_name",
+                  "description": "Pool name requested by the user. Pool name must be unique. Length must be between 1 and 100\ncharacters.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "node_type_id",
+                  "description": "This field encodes, through a single value, the resources available to each of\nthe Spark nodes in this cluster. For example, the Spark nodes can be provisioned\nand optimized for memory or compute intensive workloads. A list of available node\ntypes can be retrieved by using the [clusters/listNodeTypes](https://docs.databricks.com/api/workspace/clusters/listnodetypes) API call.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CreateInstancePoolResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "aws_attributes",
+                "description": "Attributes related to instance pools running on Amazon Web Services.\nIf not specified at pool creation, a set of default values will be used.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "InstancePoolAwsAttributes",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "azure_attributes",
+                "description": "Attributes related to instance pools running on Azure.\nIf not specified at pool creation, a set of default values will be used.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "InstancePoolAzureAttributes",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "custom_tags",
+                "description": "Additional tags for pool resources. Databricks will tag all pool resources (e.g., AWS\ninstances and EBS volumes) with these tags in addition to `default_tags`. Notes:\n\n- Currently, Databricks allows at most 45 custom tags",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "disk_spec",
+                "description": "Defines the specification of the disks that will be attached to all spark containers.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "DiskSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "enable_elastic_disk",
+                "description": "Autoscaling Local Storage: when enabled, this instances in this pool will dynamically acquire\nadditional disk space when its Spark workers are running low on disk space. In AWS, this\nfeature requires specific AWS permissions to function correctly - refer to the User Guide for\nmore details.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "gcp_attributes",
+                "description": "Attributes related to instance pools running on Google Cloud Platform.\nIf not specified at pool creation, a set of default values will be used.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "InstancePoolGcpAttributes",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "idle_instance_autotermination_minutes",
+                "description": "Automatically terminates the extra instances in the pool cache after they are inactive for this\ntime in minutes if min_idle_instances requirement is already met. If not set, the extra pool\ninstances will be automatically terminated after a default timeout. If specified, the\nthreshold must be between 0 and 10000 minutes.\nUsers can also set this value to 0 to instantly remove idle instances from the cache if\nmin cache size could still hold.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "instance_pool_name",
+                "description": "Pool name requested by the user. Pool name must be unique. Length must be between 1 and 100\ncharacters.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "max_capacity",
+                "description": "Maximum number of outstanding instances to keep in the pool, including both instances used by\nclusters and idle instances. Clusters that require further instance provisioning will fail during\nupsize requests.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "min_idle_instances",
+                "description": "Minimum number of idle instances to keep in the instance pool",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "node_type_flexibility",
+                "description": "Flexible node type configuration for the pool.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "NodeTypeFlexibility",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "node_type_id",
+                "description": "This field encodes, through a single value, the resources available to each of\nthe Spark nodes in this cluster. For example, the Spark nodes can be provisioned\nand optimized for memory or compute intensive workloads. A list of available node\ntypes can be retrieved by using the [clusters/listNodeTypes](https://docs.databricks.com/api/workspace/clusters/listnodetypes) API call.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "preloaded_docker_images",
+                "description": "Custom Docker Image BYOC",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DockerImageList",
+                  "array_value": {
+                    "pascal_name": "DockerImage",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "preloaded_spark_versions",
+                "description": "A list containing at most one preloaded Spark image version for the pool. Pool-backed clusters started\nwith the preloaded Spark version will start faster. A list of available Spark versions\ncan be retrieved by using the [clusters/sparkVersions](https://docs.databricks.com/api/workspace/clusters/sparkversions) API call.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "remote_disk_throughput",
+                "description": "If set, what the configurable throughput (in Mb/s) for the remote disk is. Currently only supported for GCP HYPERDISK_BALANCED types.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "total_initial_remote_disk_size",
+                "description": "If set, what the total initial volume size (in GB) of the remote disks should be. Currently only supported for GCP HYPERDISK_BALANCED types.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "instance_pool_name",
+                "description": "Pool name requested by the user. Pool name must be unique. Length must be between 1 and 100\ncharacters.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "node_type_id",
+                "description": "This field encodes, through a single value, the resources available to each of\nthe Spark nodes in this cluster. For example, the Spark nodes can be provisioned\nand optimized for memory or compute intensive workloads. A list of available node\ntypes can be retrieved by using the [clusters/listNodeTypes](https://docs.databricks.com/api/workspace/clusters/listnodetypes) API call.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes the instance pool permanently. The idle instances in the pool are terminated asynchronously.",
+            "summary": "Delete an instance pool.",
+            "path": "/api/2.0/instance-pools/delete",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteInstancePool",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "instance_pool_id",
+                  "description": "The instance pool to be terminated.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "instance_pool_id",
+                  "description": "The instance pool to be terminated.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteInstancePoolResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "instance_pool_id",
+                "description": "The instance pool to be terminated.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "instance_pool_id",
+                "description": "The instance pool to be terminated.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Edit",
+            "description": "Modifies the configuration of an existing instance pool.",
+            "summary": "Edit an existing instance pool.",
+            "path": "/api/2.0/instance-pools/edit",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "EditInstancePool",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "instance_pool_id",
+                  "description": "Instance pool ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "instance_pool_name",
+                  "description": "Pool name requested by the user. Pool name must be unique. Length must be between 1 and 100\ncharacters.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "node_type_id",
+                  "description": "This field encodes, through a single value, the resources available to each of\nthe Spark nodes in this cluster. For example, the Spark nodes can be provisioned\nand optimized for memory or compute intensive workloads. A list of available node\ntypes can be retrieved by using the [clusters/listNodeTypes](https://docs.databricks.com/api/workspace/clusters/listnodetypes) API call.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "instance_pool_id",
+                  "description": "Instance pool ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "instance_pool_name",
+                  "description": "Pool name requested by the user. Pool name must be unique. Length must be between 1 and 100\ncharacters.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "node_type_id",
+                  "description": "This field encodes, through a single value, the resources available to each of\nthe Spark nodes in this cluster. For example, the Spark nodes can be provisioned\nand optimized for memory or compute intensive workloads. A list of available node\ntypes can be retrieved by using the [clusters/listNodeTypes](https://docs.databricks.com/api/workspace/clusters/listnodetypes) API call.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "EditInstancePoolResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "custom_tags",
+                "description": "Additional tags for pool resources. Databricks will tag all pool resources (e.g., AWS\ninstances and EBS volumes) with these tags in addition to `default_tags`. Notes:\n\n- Currently, Databricks allows at most 45 custom tags",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "idle_instance_autotermination_minutes",
+                "description": "Automatically terminates the extra instances in the pool cache after they are inactive for this\ntime in minutes if min_idle_instances requirement is already met. If not set, the extra pool\ninstances will be automatically terminated after a default timeout. If specified, the\nthreshold must be between 0 and 10000 minutes.\nUsers can also set this value to 0 to instantly remove idle instances from the cache if\nmin cache size could still hold.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "instance_pool_id",
+                "description": "Instance pool ID",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "instance_pool_name",
+                "description": "Pool name requested by the user. Pool name must be unique. Length must be between 1 and 100\ncharacters.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "max_capacity",
+                "description": "Maximum number of outstanding instances to keep in the pool, including both instances used by\nclusters and idle instances. Clusters that require further instance provisioning will fail during\nupsize requests.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "min_idle_instances",
+                "description": "Minimum number of idle instances to keep in the instance pool",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "node_type_id",
+                "description": "This field encodes, through a single value, the resources available to each of\nthe Spark nodes in this cluster. For example, the Spark nodes can be provisioned\nand optimized for memory or compute intensive workloads. A list of available node\ntypes can be retrieved by using the [clusters/listNodeTypes](https://docs.databricks.com/api/workspace/clusters/listnodetypes) API call.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "remote_disk_throughput",
+                "description": "If set, what the configurable throughput (in Mb/s) for the remote disk is. Currently only supported for GCP HYPERDISK_BALANCED types.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "total_initial_remote_disk_size",
+                "description": "If set, what the total initial volume size (in GB) of the remote disks should be. Currently only supported for GCP HYPERDISK_BALANCED types.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "instance_pool_id",
+                "description": "Instance pool ID",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "instance_pool_name",
+                "description": "Pool name requested by the user. Pool name must be unique. Length must be between 1 and 100\ncharacters.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "node_type_id",
+                "description": "This field encodes, through a single value, the resources available to each of\nthe Spark nodes in this cluster. For example, the Spark nodes can be provisioned\nand optimized for memory or compute intensive workloads. A list of available node\ntypes can be retrieved by using the [clusters/listNodeTypes](https://docs.databricks.com/api/workspace/clusters/listnodetypes) API call.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Retrieve the information for an instance pool based on its identifier.",
+            "summary": "Get instance pool information.",
+            "path": "/api/2.0/instance-pools/get",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetInstancePoolRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "instance_pool_id",
+                  "description": "The canonical unique identifier for the instance pool.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "instance_pool_id",
+                  "description": "The canonical unique identifier for the instance pool.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetInstancePool",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "instance_pool_id",
+                  "description": "Canonical unique identifier for the pool.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "instance_pool_id",
+                  "description": "Canonical unique identifier for the pool.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "instance_pool_id",
+                "description": "The canonical unique identifier for the instance pool.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "instance_pool_id",
+                "description": "The canonical unique identifier for the instance pool.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetPermissionLevels",
+            "description": "Gets the permission levels that a user can have on an object.",
+            "summary": "Get instance pool permission levels.",
+            "path": "/api/2.0/permissions/instance-pools/{instance_pool_id}/permissionLevels",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetInstancePoolPermissionLevelsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "instance_pool_id",
+                  "description": "The instance pool for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "instance_pool_id",
+                  "description": "The instance pool for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetInstancePoolPermissionLevelsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "instance_pool_id",
+                "description": "The instance pool for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "instance_pool_id",
+                "description": "The instance pool for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetPermissions",
+            "description": "Gets the permissions of an instance pool. Instance pools can inherit permissions from their root object.",
+            "summary": "Get instance pool permissions.",
+            "path": "/api/2.0/permissions/instance-pools/{instance_pool_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetInstancePoolPermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "instance_pool_id",
+                  "description": "The instance pool for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "instance_pool_id",
+                  "description": "The instance pool for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "InstancePoolPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "instance_pool_id",
+                "description": "The instance pool for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "instance_pool_id",
+                "description": "The instance pool for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Gets a list of instance pools with their statistics.",
+            "summary": "List instance pool info.",
+            "path": "/api/2.0/instance-pools/list",
+            "is_legacy_empty_request": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListInstancePoolsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListInstancePools",
+              "is_object": true
+            },
+            "pagination": {}
+          },
+          {
+            "name": "SetPermissions",
+            "description": "Sets permissions on an object, replacing existing permissions if they exist. Deletes all direct permissions if none are specified. Objects can inherit permissions from their root object.",
+            "summary": "Set instance pool permissions.",
+            "path": "/api/2.0/permissions/instance-pools/{instance_pool_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "InstancePoolPermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "instance_pool_id",
+                  "description": "The instance pool for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "instance_pool_id",
+                  "description": "The instance pool for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "InstancePoolPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "access_control_list",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "InstancePoolAccessControlRequestList",
+                  "array_value": {
+                    "pascal_name": "InstancePoolAccessControlRequest",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "instance_pool_id",
+                "description": "The instance pool for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "instance_pool_id",
+                "description": "The instance pool for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdatePermissions",
+            "description": "Updates the permissions on an instance pool. Instance pools can inherit permissions from their root object.",
+            "summary": "Update instance pool permissions.",
+            "path": "/api/2.0/permissions/instance-pools/{instance_pool_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "InstancePoolPermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "instance_pool_id",
+                  "description": "The instance pool for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "instance_pool_id",
+                  "description": "The instance pool for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "InstancePoolPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "access_control_list",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "InstancePoolAccessControlRequestList",
+                  "array_value": {
+                    "pascal_name": "InstancePoolAccessControlRequest",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "instance_pool_id",
+                "description": "The instance pool for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "instance_pool_id",
+                "description": "The instance pool for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "compute.InstanceProfiles",
+        "name": "InstanceProfiles",
+        "description": "The Instance Profiles API allows admins to add, list, and remove instance profiles that users can launch\nclusters with. Regular users can list the instance profiles available to them.\nSee [Secure access to S3 buckets](https://docs.databricks.com/administration-guide/cloud-configurations/aws/instance-profiles.html) using\ninstance profiles for more information.",
+        "package": {
+          "name": "compute"
+        },
+        "docs_group": "compute",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "is_legacy_empty_request": true,
+          "request": {
+            "pascal_name": "ListInstanceProfilesRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Add",
+            "description": "Registers an instance profile in Databricks. In the UI, you can then give users the permission\nto use this instance profile when launching clusters.\n\nThis API is only available to admin users.",
+            "summary": "Register an instance profile.",
+            "path": "/api/2.0/instance-profiles/add",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "AddInstanceProfile",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "instance_profile_arn",
+                  "description": "The AWS ARN of the instance profile to register with Databricks. This field is required.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "instance_profile_arn",
+                  "description": "The AWS ARN of the instance profile to register with Databricks. This field is required.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "AddResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "iam_role_arn",
+                "description": "The AWS IAM role ARN of the role associated with the instance profile.\nThis field is required if your role name and instance profile name do\nnot match and you want to use the instance profile with\n[Databricks SQL Serverless](https://docs.databricks.com/sql/admin/serverless.html).\n\nOtherwise, this field is optional.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "instance_profile_arn",
+                "description": "The AWS ARN of the instance profile to register with Databricks. This field is required.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "is_meta_instance_profile",
+                "description": "Boolean flag indicating whether the instance profile should only be used in credential\npassthrough scenarios. If true, it means the instance profile contains an meta IAM role\nwhich could assume a wide range of roles. Therefore it should always be used with\nauthorization.\nThis field is optional, the default value is `false`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "skip_validation",
+                "description": "By default, Databricks validates that it has sufficient permissions to launch\ninstances with the instance profile. This validation uses AWS dry-run mode for\nthe RunInstances API. If validation fails with an error message that does not\nindicate an IAM related permission issue,\n(e.g. “Your requested instance type is not supported in your requested availability zone”),\nyou can pass this flag to skip the validation and forcibly add the instance profile.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "instance_profile_arn",
+                "description": "The AWS ARN of the instance profile to register with Databricks. This field is required.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Edit",
+            "description": "The only supported field to change is the optional IAM role ARN associated with\nthe instance profile. It is required to specify the IAM role ARN if both of\nthe following are true:\n\n* Your role name and instance profile name do not match. The name is the part\nafter the last slash in each ARN.\n* You want to use the instance profile with [Databricks SQL Serverless](https://docs.databricks.com/sql/admin/serverless.html).\n\nTo understand where these fields are in the AWS console, see\n[Enable serverless SQL warehouses](https://docs.databricks.com/sql/admin/serverless.html).\n\nThis API is only available to admin users.",
+            "summary": "Edit an instance profile.",
+            "path": "/api/2.0/instance-profiles/edit",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "InstanceProfile",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "instance_profile_arn",
+                  "description": "The AWS ARN of the instance profile to register with Databricks. This field is required.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "instance_profile_arn",
+                  "description": "The AWS ARN of the instance profile to register with Databricks. This field is required.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "EditResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "iam_role_arn",
+                "description": "The AWS IAM role ARN of the role associated with the instance profile.\nThis field is required if your role name and instance profile name do\nnot match and you want to use the instance profile with\n[Databricks SQL Serverless](https://docs.databricks.com/sql/admin/serverless.html).\n\nOtherwise, this field is optional.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "instance_profile_arn",
+                "description": "The AWS ARN of the instance profile to register with Databricks. This field is required.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "is_meta_instance_profile",
+                "description": "Boolean flag indicating whether the instance profile should only be used in credential\npassthrough scenarios. If true, it means the instance profile contains an meta IAM role\nwhich could assume a wide range of roles. Therefore it should always be used with\nauthorization.\nThis field is optional, the default value is `false`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "instance_profile_arn",
+                "description": "The AWS ARN of the instance profile to register with Databricks. This field is required.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "List the instance profiles that the calling user can use to launch a cluster.\n\nThis API is available to all users.",
+            "summary": "List available instance profiles.",
+            "path": "/api/2.0/instance-profiles/list",
+            "is_legacy_empty_request": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListInstanceProfilesRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListInstanceProfilesResponse",
+              "is_object": true
+            },
+            "pagination": {}
+          },
+          {
+            "name": "Remove",
+            "description": "Remove the instance profile with the provided ARN.\nExisting clusters with this instance profile will continue to function.\n\nThis API is only accessible to admin users.",
+            "summary": "Remove the instance profile.",
+            "path": "/api/2.0/instance-profiles/remove",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "RemoveInstanceProfile",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "instance_profile_arn",
+                  "description": "The ARN of the instance profile to remove. This field is required.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "instance_profile_arn",
+                  "description": "The ARN of the instance profile to remove. This field is required.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "RemoveResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "instance_profile_arn",
+                "description": "The ARN of the instance profile to remove. This field is required.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "instance_profile_arn",
+                "description": "The ARN of the instance profile to remove. This field is required.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "settings.IpAccessLists",
+        "name": "IpAccessLists",
+        "description": "IP Access List enables admins to configure IP access lists.\n\nIP access lists affect web application access and REST API access to this workspace only.\nIf the feature is disabled for a workspace, all access is allowed for this workspace.\nThere is support for allow lists (inclusion) and block lists (exclusion).\n\nWhen a connection is attempted:\n1. **First, all block lists are checked.** If the connection IP address matches any block list, the connection is rejected.\n2. **If the connection was not rejected by block lists**, the IP address is compared with the allow lists.\n\nIf there is at least one allow list for the workspace, the connection is allowed only if the IP address matches an allow list.\nIf there are no allow lists for the workspace, all IP addresses are allowed.\n\nFor all allow lists and block lists combined, the workspace supports a maximum of 1000 IP/CIDR values, where one CIDR counts as a single value.\n\nAfter changes to the IP access list feature, it can take a few minutes for changes to take effect.",
+        "package": {
+          "name": "settings"
+        },
+        "docs_group": "settings",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "named_id_map": {
+            "pascal_name": "IpAccessListInfoLabelToListIdMap"
+          },
+          "is_legacy_empty_request": true,
+          "request": {
+            "pascal_name": "ListIpAccessLists"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates an IP access list for this workspace.\n\nA list can be an allow list or a block list.\nSee the top of this file for a description of how the server treats allow lists and block lists at runtime.\n\nWhen creating or updating an IP access list:\n\n* For all allow lists and block lists combined, the API supports a maximum of 1000 IP/CIDR values,\nwhere one CIDR counts as a single value. Attempts to exceed that number return error 400 with `error_code` value `QUOTA_EXCEEDED`.\n* If the new list would block the calling user's current IP, error 400 is returned with `error_code` value `INVALID_STATE`.\n\nIt can take a few minutes for the changes to take effect. **Note**: Your new IP access list has no effect until you enable the feature. See [workspaceconf/setStatus](https://docs.databricks.com/api/workspace/workspaceconf/setstatus)",
+            "summary": "Create access list.",
+            "path": "/api/2.0/ip-access-lists",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateIpAccessList",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "label",
+                  "description": "Label for the IP access list. This **cannot** be empty.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "list_type",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ListType",
+                    "enum": [
+                      {
+                        "content": "ALLOW"
+                      },
+                      {
+                        "content": "BLOCK"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "label",
+                  "description": "Label for the IP access list. This **cannot** be empty.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "list_type",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ListType",
+                    "enum": [
+                      {
+                        "content": "ALLOW"
+                      },
+                      {
+                        "content": "BLOCK"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CreateIpAccessListResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "ip_addresses",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "label",
+                "description": "Label for the IP access list. This **cannot** be empty.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "list_type",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ListType",
+                  "enum": [
+                    {
+                      "content": "ALLOW"
+                    },
+                    {
+                      "content": "BLOCK"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "label",
+                "description": "Label for the IP access list. This **cannot** be empty.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "list_type",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ListType",
+                  "enum": [
+                    {
+                      "content": "ALLOW"
+                    },
+                    {
+                      "content": "BLOCK"
+                    }
+                  ]
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes an IP access list, specified by its list ID.",
+            "summary": "Delete access list.",
+            "path": "/api/2.0/ip-access-lists/{ip_access_list_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteIpAccessListRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "ip_access_list_id",
+                  "description": "The ID for the corresponding IP access list",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "ip_access_list_id",
+                  "description": "The ID for the corresponding IP access list",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "ip_access_list_id",
+                "description": "The ID for the corresponding IP access list",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "ip_access_list_id",
+                "description": "The ID for the corresponding IP access list",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets an IP access list, specified by its list ID.",
+            "summary": "Get access list.",
+            "path": "/api/2.0/ip-access-lists/{ip_access_list_id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetIpAccessListRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "ip_access_list_id",
+                  "description": "The ID for the corresponding IP access list",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "ip_access_list_id",
+                  "description": "The ID for the corresponding IP access list",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "FetchIpAccessListResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "ip_access_list_id",
+                "description": "The ID for the corresponding IP access list",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "ip_access_list_id",
+                "description": "The ID for the corresponding IP access list",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Gets all IP access lists for the specified workspace.",
+            "summary": "Get access lists.",
+            "path": "/api/2.0/ip-access-lists",
+            "is_legacy_empty_request": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListIpAccessLists",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListIpAccessListResponse",
+              "is_object": true
+            },
+            "pagination": {}
+          },
+          {
+            "name": "Replace",
+            "description": "Replaces an IP access list, specified by its ID.\n\nA list can include allow lists and block lists. See the top\nof this file for a description of how the server treats allow lists and block lists at run time. When\nreplacing an IP access list:\n* For all allow lists and block lists combined, the API supports a maximum of 1000 IP/CIDR values,\nwhere one CIDR counts as a single value. Attempts to exceed that number return error 400 with `error_code`\nvalue `QUOTA_EXCEEDED`.\n* If the resulting list would block the calling user's current IP, error 400 is returned with `error_code`\nvalue `INVALID_STATE`.\nIt can take a few minutes for the changes to take effect. Note that your resulting IP access list has no\neffect until you enable the feature. See [workspaceconf/setStatus](https://docs.databricks.com/api/workspace/workspaceconf/setstatus).",
+            "summary": "Replace access list.",
+            "path": "/api/2.0/ip-access-lists/{ip_access_list_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ReplaceIpAccessList",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "ip_access_list_id",
+                  "description": "The ID for the corresponding IP access list",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "label",
+                  "description": "Label for the IP access list. This **cannot** be empty.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "list_type",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ListType",
+                    "enum": [
+                      {
+                        "content": "ALLOW"
+                      },
+                      {
+                        "content": "BLOCK"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "enabled",
+                  "description": "Specifies whether this IP access list is enabled.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "ip_access_list_id",
+                  "description": "The ID for the corresponding IP access list",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "label",
+                  "description": "Label for the IP access list. This **cannot** be empty.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "list_type",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ListType",
+                    "enum": [
+                      {
+                        "content": "ALLOW"
+                      },
+                      {
+                        "content": "BLOCK"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "enabled",
+                  "description": "Specifies whether this IP access list is enabled.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "enabled",
+                "description": "Specifies whether this IP access list is enabled.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "ip_access_list_id",
+                "description": "The ID for the corresponding IP access list",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "ip_addresses",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "label",
+                "description": "Label for the IP access list. This **cannot** be empty.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "list_type",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ListType",
+                  "enum": [
+                    {
+                      "content": "ALLOW"
+                    },
+                    {
+                      "content": "BLOCK"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "ip_access_list_id",
+                "description": "The ID for the corresponding IP access list",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "label",
+                "description": "Label for the IP access list. This **cannot** be empty.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "list_type",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ListType",
+                  "enum": [
+                    {
+                      "content": "ALLOW"
+                    },
+                    {
+                      "content": "BLOCK"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "enabled",
+                "description": "Specifies whether this IP access list is enabled.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Updates an existing IP access list, specified by its ID.\n\nA list can include allow lists and block lists.\nSee the top of this file for a description of how the server treats allow lists and block lists at run time.\n\nWhen updating an IP access list:\n\n* For all allow lists and block lists combined, the API supports a maximum of 1000 IP/CIDR values,\nwhere one CIDR counts as a single value. Attempts to exceed that number return error 400 with `error_code` value `QUOTA_EXCEEDED`.\n* If the updated list would block the calling user's current IP, error 400 is returned with `error_code` value `INVALID_STATE`.\n\nIt can take a few minutes for the changes to take effect. Note that your resulting IP access list has no effect until you enable\nthe feature. See [workspaceconf/setStatus](https://docs.databricks.com/api/workspace/workspaceconf/setstatus).",
+            "summary": "Update access list.",
+            "path": "/api/2.0/ip-access-lists/{ip_access_list_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateIpAccessList",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "ip_access_list_id",
+                  "description": "The ID for the corresponding IP access list",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "ip_access_list_id",
+                  "description": "The ID for the corresponding IP access list",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "enabled",
+                "description": "Specifies whether this IP access list is enabled.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "ip_access_list_id",
+                "description": "The ID for the corresponding IP access list",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "ip_addresses",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "label",
+                "description": "Label for the IP access list. This **cannot** be empty.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "list_type",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ListType",
+                  "enum": [
+                    {
+                      "content": "ALLOW"
+                    },
+                    {
+                      "content": "BLOCK"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "ip_access_list_id",
+                "description": "The ID for the corresponding IP access list",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "settings.AccountIpAccessLists",
+        "name": "AccountIpAccessLists",
+        "description": "The Accounts IP Access List API enables account admins to configure IP access lists for\naccess to the account console.\n\nAccount IP Access Lists affect web application access and REST API access to the account\nconsole and account APIs. If the feature is disabled for the account, all access is allowed\nfor this account. There is support for allow lists (inclusion) and block lists (exclusion).\n\nWhen a connection is attempted:\n1. **First, all block lists are checked.** If the connection IP address matches any block\nlist, the connection is rejected.\n2. **If the connection was not rejected by block lists**, the IP address is compared with\nthe allow lists.\n\nIf there is at least one allow list for the account, the connection is allowed only if the\nIP address matches an allow list. If there are no allow lists for the account, all IP\naddresses are allowed.\n\nFor all allow lists and block lists combined, the account supports a maximum of 1000 IP/CIDR\nvalues, where one CIDR counts as a single value.\n\nAfter changes to the account-level IP access lists, it can take a few minutes for changes\nto take effect.",
+        "package": {
+          "name": "settings"
+        },
+        "is_accounts": true,
+        "docs_group": "settings",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "named_id_map": {
+            "pascal_name": "IpAccessListInfoLabelToListIdMap"
+          },
+          "is_legacy_empty_request": true,
+          "request": {
+            "pascal_name": "ListIpAccessLists"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates an IP access list for the account.\n\nA list can be an allow list or a block list. See the top of this file for a description of\nhow the server treats allow lists and block lists at runtime.\n\nWhen creating or updating an IP access list:\n\n* For all allow lists and block lists combined, the API supports a maximum of 1000\nIP/CIDR values, where one CIDR counts as a single value. Attempts to exceed that number\nreturn error 400 with `error_code` value `QUOTA_EXCEEDED`.\n* If the new list would block the calling user's current IP, error 400 is returned with\n`error_code` value `INVALID_STATE`.\n\nIt can take a few minutes for the changes to take effect.",
+            "summary": "Create access list.",
+            "path": "/api/2.0/accounts/{account_id}/ip-access-lists",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateIpAccessList",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "label",
+                  "description": "Label for the IP access list. This **cannot** be empty.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "list_type",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ListType",
+                    "enum": [
+                      {
+                        "content": "ALLOW"
+                      },
+                      {
+                        "content": "BLOCK"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "label",
+                  "description": "Label for the IP access list. This **cannot** be empty.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "list_type",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ListType",
+                    "enum": [
+                      {
+                        "content": "ALLOW"
+                      },
+                      {
+                        "content": "BLOCK"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CreateIpAccessListResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "ip_addresses",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "label",
+                "description": "Label for the IP access list. This **cannot** be empty.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "list_type",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ListType",
+                  "enum": [
+                    {
+                      "content": "ALLOW"
+                    },
+                    {
+                      "content": "BLOCK"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "label",
+                "description": "Label for the IP access list. This **cannot** be empty.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "list_type",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ListType",
+                  "enum": [
+                    {
+                      "content": "ALLOW"
+                    },
+                    {
+                      "content": "BLOCK"
+                    }
+                  ]
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes an IP access list, specified by its list ID.",
+            "summary": "Delete access list.",
+            "path": "/api/2.0/accounts/{account_id}/ip-access-lists/{ip_access_list_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteAccountIpAccessListRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "ip_access_list_id",
+                  "description": "The ID for the corresponding IP access list",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "ip_access_list_id",
+                  "description": "The ID for the corresponding IP access list",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "ip_access_list_id",
+                "description": "The ID for the corresponding IP access list",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "ip_access_list_id",
+                "description": "The ID for the corresponding IP access list",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets an IP access list, specified by its list ID.",
+            "summary": "Get IP access list.",
+            "path": "/api/2.0/accounts/{account_id}/ip-access-lists/{ip_access_list_id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetAccountIpAccessListRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "ip_access_list_id",
+                  "description": "The ID for the corresponding IP access list",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "ip_access_list_id",
+                  "description": "The ID for the corresponding IP access list",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetIpAccessListResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "ip_access_list_id",
+                "description": "The ID for the corresponding IP access list",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "ip_access_list_id",
+                "description": "The ID for the corresponding IP access list",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Gets all IP access lists for the specified account.",
+            "summary": "Get access lists.",
+            "path": "/api/2.0/accounts/{account_id}/ip-access-lists",
+            "is_legacy_empty_request": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListIpAccessLists",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "GetIpAccessListsResponse",
+              "is_object": true
+            },
+            "pagination": {}
+          },
+          {
+            "name": "Replace",
+            "description": "Replaces an IP access list, specified by its ID.\n\nA list can include allow lists and block lists. See the top of this file for a description\nof how the server treats allow lists and block lists at run time. When replacing an IP\naccess list:\n* For all allow lists and block lists combined, the API supports a maximum of 1000 IP/CIDR values,\nwhere one CIDR counts as a single value. Attempts to exceed that number return error 400 with `error_code`\nvalue `QUOTA_EXCEEDED`.\n* If the resulting list would block the calling user's current IP, error 400 is returned with `error_code`\nvalue `INVALID_STATE`.\nIt can take a few minutes for the changes to take effect.",
+            "summary": "Replace access list.",
+            "path": "/api/2.0/accounts/{account_id}/ip-access-lists/{ip_access_list_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ReplaceIpAccessList",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "ip_access_list_id",
+                  "description": "The ID for the corresponding IP access list",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "label",
+                  "description": "Label for the IP access list. This **cannot** be empty.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "list_type",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ListType",
+                    "enum": [
+                      {
+                        "content": "ALLOW"
+                      },
+                      {
+                        "content": "BLOCK"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "enabled",
+                  "description": "Specifies whether this IP access list is enabled.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "ip_access_list_id",
+                  "description": "The ID for the corresponding IP access list",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "label",
+                  "description": "Label for the IP access list. This **cannot** be empty.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "list_type",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ListType",
+                    "enum": [
+                      {
+                        "content": "ALLOW"
+                      },
+                      {
+                        "content": "BLOCK"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "enabled",
+                  "description": "Specifies whether this IP access list is enabled.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "enabled",
+                "description": "Specifies whether this IP access list is enabled.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "ip_access_list_id",
+                "description": "The ID for the corresponding IP access list",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "ip_addresses",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "label",
+                "description": "Label for the IP access list. This **cannot** be empty.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "list_type",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ListType",
+                  "enum": [
+                    {
+                      "content": "ALLOW"
+                    },
+                    {
+                      "content": "BLOCK"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "ip_access_list_id",
+                "description": "The ID for the corresponding IP access list",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "label",
+                "description": "Label for the IP access list. This **cannot** be empty.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "list_type",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ListType",
+                  "enum": [
+                    {
+                      "content": "ALLOW"
+                    },
+                    {
+                      "content": "BLOCK"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "enabled",
+                "description": "Specifies whether this IP access list is enabled.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Updates an existing IP access list, specified by its ID.\n\nA list can include allow lists and block lists. See the top of this file for a description\nof how the server treats allow lists and block lists at run time.\n\nWhen updating an IP access list:\n\n* For all allow lists and block lists combined, the API supports a maximum of 1000\nIP/CIDR values, where one CIDR counts as a single value. Attempts to exceed that number\nreturn error 400 with `error_code` value `QUOTA_EXCEEDED`.\n* If the updated list would block the calling user's current IP, error 400 is returned\nwith `error_code` value `INVALID_STATE`.\n\nIt can take a few minutes for the changes to take effect.",
+            "summary": "Update access list.",
+            "path": "/api/2.0/accounts/{account_id}/ip-access-lists/{ip_access_list_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateIpAccessList",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "ip_access_list_id",
+                  "description": "The ID for the corresponding IP access list",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "ip_access_list_id",
+                  "description": "The ID for the corresponding IP access list",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "enabled",
+                "description": "Specifies whether this IP access list is enabled.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "ip_access_list_id",
+                "description": "The ID for the corresponding IP access list",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "ip_addresses",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "label",
+                "description": "Label for the IP access list. This **cannot** be empty.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "list_type",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ListType",
+                  "enum": [
+                    {
+                      "content": "ALLOW"
+                    },
+                    {
+                      "content": "BLOCK"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "ip_access_list_id",
+                "description": "The ID for the corresponding IP access list",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "jobs.Jobs",
+        "name": "Jobs",
+        "description": "The Jobs API allows you to create, edit, and delete jobs.\n\nYou can use a Databricks job to run a data processing or data analysis task in a Databricks\ncluster with scalable resources. Your job can consist of a single task or can be a large,\nmulti-task workflow with complex dependencies. Databricks manages the task orchestration,\ncluster management, monitoring, and error reporting for all of your jobs. You can run your jobs\nimmediately or periodically through an easy-to-use scheduling system. You can implement\njob tasks using notebooks, JARS, Spark Declarative Pipelines, or Python, Scala, Spark\nsubmit, and Java applications.\n\nYou should never hard code secrets or store them in plain text. Use the [Secrets CLI](https://docs.databricks.com/dev-tools/cli/secrets-cli.html)\nto manage secrets in the [Databricks CLI](https://docs.databricks.com/dev-tools/cli/index.html).\nUse the [Secrets utility](https://docs.databricks.com/dev-tools/databricks-utils.html#dbutils-secrets) to reference secrets in notebooks and jobs.",
+        "package": {
+          "name": "jobs"
+        },
+        "docs_group": "lakeflow",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "named_id_map": {
+            "pascal_name": "BaseJobSettingsNameToJobIdMap"
+          },
+          "request": {
+            "pascal_name": "ListJobsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "CancelAllRuns",
+            "description": "Cancels all active runs of a job. The runs are canceled asynchronously, so it doesn't\nprevent new runs from being started.",
+            "summary": "Cancel all runs of a job.",
+            "path": "/api/2.2/jobs/runs/cancel-all",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CancelAllRuns",
+              "is_object": true
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "all_queued_runs",
+                "description": "Optional boolean parameter to cancel all queued runs. If no job_id is provided, all queued runs in the workspace are canceled.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "job_id",
+                "description": "The canonical identifier of the job to cancel all runs of.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CancelRun",
+            "description": "Cancels a job run or a task run. The run is canceled asynchronously, so it may still be running when\nthis request completes.",
+            "summary": "Cancel a run.",
+            "path": "/api/2.2/jobs/runs/cancel",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CancelRun",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "run_id",
+                  "description": "This field is required.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "run_id",
+                  "description": "This field is required.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "run_id",
+                "description": "This field is required.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "run_id",
+                "description": "This field is required.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "wait": {
+              "success": [
+                {
+                  "content": "TERMINATED"
+                },
+                {
+                  "content": "SKIPPED"
+                }
+              ],
+              "timeout": 20,
+              "complex_message_path": true,
+              "poll": {
+                "response": {
+                  "pascal_name": "Run"
+                }
+              },
+              "status_path": [
+                {
+                  "pascal_name": "State"
+                },
+                {
+                  "pascal_name": "LifeCycleState"
+                }
+              ],
+              "message_path": [
+                {
+                  "pascal_name": "State"
+                },
+                {
+                  "pascal_name": "StateMessage"
+                }
+              ],
+              "message_path_head": {
+                "pascal_name": "State"
+              }
+            }
+          },
+          {
+            "name": "Create",
+            "description": "Create a new job.",
+            "summary": "Create a new job.",
+            "path": "/api/2.2/jobs/create",
+            "can_use_json": true,
+            "must_use_json": true,
+            "is_json_only": true,
+            "is_crud_create": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateJob",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "CreateResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "access_control_list",
+                "description": "List of permissions to set on the job.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "JobAccessControlRequestList",
+                  "array_value": {
+                    "pascal_name": "JobAccessControlRequest",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "budget_policy_id",
+                "description": "The id of the user specified budget policy to use for this job.\nIf not specified, a default budget policy may be applied when creating or modifying the job.\nSee `effective_budget_policy_id` for the budget policy used by this workload.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "continuous",
+                "description": "An optional continuous property for this job. The continuous property will ensure that there is always one run executing. Only one of `schedule` and `continuous` can be used.\n\nPipelines started by a continuous job also run continuously, regardless of their own pipeline mode setting.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "Continuous",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "deployment",
+                "description": "Deployment information for jobs managed by external sources.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "JobDeployment",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "An optional description for the job. The maximum length is 27700 characters in UTF-8 encoding.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "duration_target",
+                "description": "The window the run aims to finish within, in hours, for a Cost-optimized serverless run.\nRequired only when `performance_target` is `COST_OPTIMIZED`. Must be one of the\nsupported values: `NO_FLEXIBILITY`, `4h`, `12h`, `24h`, `72h`. `NO_FLEXIBILITY` means the run\nuses the default cost-optimized performance level without additional cost-saving optimizations.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "edit_mode",
+                "description": "Edit mode of the job.\n\n* `UI_LOCKED`: The job is in a locked UI state and cannot be modified.\n* `EDITABLE`: The job is in an editable state and can be modified.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "JobEditMode",
+                  "enum": [
+                    {
+                      "content": "EDITABLE"
+                    },
+                    {
+                      "content": "UI_LOCKED"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "email_notifications",
+                "description": "An optional set of email addresses that is notified when runs of this job begin or complete as well as when this job is deleted.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "JobEmailNotifications",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "environment_variables",
+                "description": "Named environment-variable entries that tasks can reference by key from\n`TaskSettings.environment_variables_key`. Each entry's `spec` holds inline\n`variables` and optional `.env` `files`. Maximum 10 entries per job. A task\ncan reference at most one entry from this list.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "JobEnvironmentVariablesList",
+                  "array_value": {
+                    "pascal_name": "JobEnvironmentVariables",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "environments",
+                "description": "A list of task execution environment specifications that can be referenced by tasks that use serverless compute or a compute resource that uses Environments mode.\n\nFor notebook tasks that use serverless compute or a compute resource that uses Environments mode, if the environment_key is not specified, the notebook environment will be used if present. If a jobs environment is specified, it will override the notebook environment.\nFor other tasks that use serverless compute or a compute resource that uses Environments mode, the task environment is required to be specified using environment_key in the task settings.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "JobEnvironmentList",
+                  "array_value": {
+                    "pascal_name": "JobEnvironment",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "format",
+                "description": "Used to tell what is the format of the job. This field is ignored in Create/Update/Reset calls. When using the Jobs API 2.1 this value is always set to `\"MULTI_TASK\"`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Format",
+                  "enum": [
+                    {
+                      "content": "MULTI_TASK"
+                    },
+                    {
+                      "content": "SINGLE_TASK"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "git_source",
+                "description": "An optional specification for a remote Git repository containing the source code used by tasks. Version-controlled source code is supported by notebook, dbt, Python script, and SQL File tasks.\n\nIf `git_source` is set, these tasks retrieve the file from the remote repository by default. However, this behavior can be overridden by setting `source` to `WORKSPACE` on the task.\n\nNote: dbt and SQL File tasks support only version-controlled sources. If dbt or SQL File tasks are used, `git_source` must be defined on the job.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "GitSource",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "health",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "JobsHealthRules",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "job_clusters",
+                "description": "A list of job cluster specifications that can be shared and reused by tasks of this job. Libraries cannot be declared in a shared job cluster. You must declare dependent libraries in task settings.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "JobClusterList",
+                  "array_value": {
+                    "pascal_name": "JobCluster",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "max_concurrent_runs",
+                "description": "An optional maximum allowed number of concurrent runs of the job.\nSet this value if you want to be able to execute multiple runs of the same job concurrently.\nThis is useful for example if you trigger your job on a frequent schedule and want to allow consecutive runs to overlap with each other, or if you want to trigger multiple runs which differ by their input parameters.\nThis setting affects only new runs. For example, suppose the job’s concurrency is 4 and there are 4 concurrent active runs. Then setting the concurrency to 3 won’t kill any of the active runs.\nHowever, from then on, new runs are skipped unless there are fewer than 3 active runs.\nThis value cannot exceed 1000. Setting this value to `0` causes all new runs to be skipped.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "An optional name for the job. The maximum length is 4096 bytes in UTF-8 encoding.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "notification_settings",
+                "description": "Optional notification settings that are used when sending notifications to each of the `email_notifications` and `webhook_notifications` for this job.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "JobNotificationSettings",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "parameters",
+                "description": "Job-level parameter definitions",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "JobParameterDefinitionList",
+                  "array_value": {
+                    "pascal_name": "JobParameterDefinition",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "parent_path",
+                "description": "Path of the job parent folder in workspace file tree. If absent, the job doesn't have a workspace object.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "performance_target",
+                "description": "The performance mode on a serverless job. This field determines the level of compute performance or cost-efficiency for the run.\nThe performance target does not apply to tasks that run on Serverless GPU compute.\n\n* `PERFORMANCE_OPTIMIZED`: Prioritizes fast startup and execution times through rapid scaling and optimized cluster performance.\n* `STANDARD`: Enables cost-efficient execution of serverless workloads.\n* `COST_OPTIMIZED`: Enables lower job costs by optimizing compute for your selected target duration time. Must provide a duration target.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PerformanceTarget",
+                  "enum": [
+                    {
+                      "content": "PERFORMANCE_OPTIMIZED"
+                    },
+                    {
+                      "content": "STANDARD"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "queue",
+                "description": "The queue settings of the job.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "QueueSettings",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "run_as",
+                "description": "The user or service principal that the job runs as, if specified in the request.\nThis field indicates the explicit configuration of `run_as` for the job.\nTo find the value in all cases, explicit or implicit, use `run_as_user_name`.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "JobRunAs",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "schedule",
+                "description": "An optional periodic schedule for this job. The default behavior is that the job only runs when triggered by clicking “Run Now” in the Jobs UI or sending an API request to `runNow`.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CronSchedule",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "tags",
+                "description": "A map of tags associated with the job. These are forwarded to the cluster as cluster tags for jobs clusters, and are subject to the same limitations as cluster tags. A maximum of 25 tags can be added to the job.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "tasks",
+                "description": "A list of task specifications to be executed by this job.\nIt supports up to 1000 elements in write endpoints (:method:jobs/create, :method:jobs/reset, :method:jobs/update, :method:jobs/submit).\nRead endpoints return only 100 tasks. If more than 100 tasks are available, you can paginate through them using :method:jobs/get. Use the `next_page_token` field at the object root to determine if more results are available.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "TaskList",
+                  "array_value": {
+                    "pascal_name": "Task",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "timeout_seconds",
+                "description": "An optional timeout applied to each run of this job. A value of `0` means no timeout.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "trigger",
+                "description": "A configuration to trigger a run when certain conditions are met. The default behavior is that the job runs only when triggered by clicking “Run Now” in the Jobs UI or sending an API request to `runNow`.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "TriggerSettings",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "triggers",
+                "description": "List of triggers attached to this job. A run starts when any active trigger evaluates to true. Cannot be set in\nthe same request as the legacy `schedule`, `trigger`, or `continuous` fields. Gated behind the \"Multiple Triggers\" feature preview.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "TriggerConfigurationList",
+                  "array_value": {
+                    "pascal_name": "TriggerConfiguration",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "usage_policy_id",
+                "description": "The id of the user specified usage policy to use for this job.\nIf not specified, a default usage policy may be applied when creating or modifying the job.\nSee `effective_usage_policy_id` for the usage policy used by this workload.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "webhook_notifications",
+                "description": "A collection of system notification IDs to notify when runs of this job begin or complete.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "WebhookNotifications",
+                  "is_object": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes a job.",
+            "summary": "Delete a job.",
+            "path": "/api/2.2/jobs/delete",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteJob",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "job_id",
+                  "description": "The canonical identifier of the job to delete. This field is required.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "job_id",
+                  "description": "The canonical identifier of the job to delete. This field is required.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "job_id",
+                "description": "The canonical identifier of the job to delete. This field is required.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "job_id",
+                "description": "The canonical identifier of the job to delete. This field is required.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteRun",
+            "description": "Deletes a non-active run. Returns an error if the run is active.",
+            "summary": "Delete a job run.",
+            "path": "/api/2.2/jobs/runs/delete",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteRun",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "run_id",
+                  "description": "ID of the run to delete.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "run_id",
+                  "description": "ID of the run to delete.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "run_id",
+                "description": "ID of the run to delete.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "run_id",
+                "description": "ID of the run to delete.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ExportRun",
+            "description": "Export and retrieve the job run task.",
+            "summary": "Export and retrieve a job run.",
+            "path": "/api/2.2/jobs/runs/export",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ExportRunRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "run_id",
+                  "description": "The canonical identifier for the run. This field is required.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "run_id",
+                  "description": "The canonical identifier for the run. This field is required.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ExportRunOutput",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "run_id",
+                "description": "The canonical identifier for the run. This field is required.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "views_to_export",
+                "description": "Which views to export (CODE, DASHBOARDS, or ALL). Defaults to CODE.",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "ViewsToExport",
+                  "enum": [
+                    {
+                      "content": "ALL"
+                    },
+                    {
+                      "content": "CODE"
+                    },
+                    {
+                      "content": "DASHBOARDS"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "run_id",
+                "description": "The canonical identifier for the run. This field is required.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Retrieves the details for a single job.\n\nLarge arrays in the results will be paginated when they exceed 100 elements.\nA request for a single job will return all properties for that job, and the first 100 elements of array properties (`tasks`, `job_clusters`, `environments` and `parameters`).\nUse the `next_page_token` field to check for more results and pass its value as the `page_token` in subsequent requests.\nIf any array properties have more than 100 elements, additional results will be returned on subsequent requests. Arrays without additional results will be empty on later pages.",
+            "summary": "Get a single job.",
+            "path": "/api/2.2/jobs/get",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetJobRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "job_id",
+                  "description": "The canonical identifier of the job to retrieve information about. This field is required.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "job_id",
+                  "description": "The canonical identifier of the job to retrieve information about. This field is required.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Job",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "include_trigger_state",
+                "description": "Flag that indicates that trigger state should be included in the response.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "job_id",
+                "description": "The canonical identifier of the job to retrieve information about. This field is required.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Use `next_page_token` returned from the previous GetJob response to request the next page of the job's array properties.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "job_id",
+                "description": "The canonical identifier of the job to retrieve information about. This field is required.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetPermissionLevels",
+            "description": "Gets the permission levels that a user can have on an object.",
+            "summary": "Get job permission levels.",
+            "path": "/api/2.0/permissions/jobs/{job_id}/permissionLevels",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetJobPermissionLevelsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "job_id",
+                  "description": "The job for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "job_id",
+                  "description": "The job for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetJobPermissionLevelsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "job_id",
+                "description": "The job for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "job_id",
+                "description": "The job for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetPermissions",
+            "description": "Gets the permissions of a job. Jobs can inherit permissions from their root object.",
+            "summary": "Get job permissions.",
+            "path": "/api/2.0/permissions/jobs/{job_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetJobPermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "job_id",
+                  "description": "The job for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "job_id",
+                  "description": "The job for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "JobPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "job_id",
+                "description": "The job for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "job_id",
+                "description": "The job for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetRun",
+            "description": "Retrieves the metadata of a run.\n\nLarge arrays in the results will be paginated when they exceed 100 elements.\nA request for a single run will return all properties for that run, and the first 100 elements of array properties (`tasks`, `job_clusters`, `job_parameters` and `repair_history`).\nUse the next_page_token field to check for more results and pass its value as the page_token in subsequent requests.\nIf any array properties have more than 100 elements, additional results will be returned on subsequent requests. Arrays without additional results will be empty on later pages.",
+            "summary": "Get a single job run.",
+            "path": "/api/2.2/jobs/runs/get",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetRunRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "run_id",
+                  "description": "The canonical identifier of the run for which to retrieve the metadata.\nThis field is required.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "run_id",
+                  "description": "The canonical identifier of the run for which to retrieve the metadata.\nThis field is required.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Run",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "include_history",
+                "description": "Whether to include the repair history in the response.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "include_resolved_values",
+                "description": "Whether to include resolved parameter values in the response.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Use `next_page_token` returned from the previous GetRun response to request the next page of the run's array properties.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "run_id",
+                "description": "The canonical identifier of the run for which to retrieve the metadata.\nThis field is required.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "run_id",
+                "description": "The canonical identifier of the run for which to retrieve the metadata.\nThis field is required.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetRunOutput",
+            "description": "Retrieve the output and metadata of a single task run. When a notebook task returns\na value through the `dbutils.notebook.exit()` call, you can use this endpoint to retrieve\nthat value. Databricks restricts this API to returning the first 5 MB of the output.\nTo return a larger result, you can store job results in a cloud storage service.\n\nThis endpoint validates that the __run_id__ parameter is valid and returns an HTTP status\ncode 400 if the __run_id__ parameter is invalid. Runs are automatically removed after\n60 days. If you to want to reference them beyond 60 days, you must save old run results\nbefore they expire.",
+            "summary": "Get the output for a single run.",
+            "path": "/api/2.2/jobs/runs/get-output",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetRunOutputRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "run_id",
+                  "description": "The canonical identifier for the run.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "run_id",
+                  "description": "The canonical identifier for the run.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "RunOutput",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "run_id",
+                "description": "The canonical identifier for the run.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "run_id",
+                "description": "The canonical identifier for the run.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Retrieves a list of jobs.",
+            "summary": "List jobs.",
+            "path": "/api/2.2/jobs/list",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListJobsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListJobsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "expand_tasks",
+                "description": "Whether to include task and cluster details in the response. Note that only the first 100 elements will be shown.\nUse :method:jobs/get to paginate through all tasks and clusters.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "limit",
+                "description": "The number of jobs to return. This value must be greater than 0 and less or equal to 100. The default value is 20.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "A filter on the list based on the exact (case insensitive) job name.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "offset",
+                "description": "The offset of the first job to return, relative to the most recently created job.\nDeprecated since June 2023. Use `page_token` to iterate through the pages instead.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Use `next_page_token` or `prev_page_token` returned from the previous request to list the next or previous page of jobs respectively.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Use `next_page_token` or `prev_page_token` returned from the previous request to list the next or previous page of jobs respectively.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListRuns",
+            "description": "List runs in descending order by start time.",
+            "summary": "List job runs.",
+            "path": "/api/2.2/jobs/runs/list",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListRunsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListRunsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "active_only",
+                "description": "If active_only is `true`, only active runs are included in the results; otherwise,\nlists both active and completed runs. An active run is a run in the `QUEUED`, `PENDING`,\n`RUNNING`, or `TERMINATING`. This field cannot be `true` when completed_only is `true`.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "completed_only",
+                "description": "If completed_only is `true`, only completed runs are included in the results;\notherwise, lists both active and completed runs. This field cannot be `true` when\nactive_only is `true`.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "expand_tasks",
+                "description": "Whether to include task and cluster details in the response. Note that only the first 100 elements will be shown.\nUse :method:jobs/getrun to paginate through all tasks and clusters.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "job_id",
+                "description": "The job for which to list runs. If omitted, the Jobs service lists runs from all jobs.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "limit",
+                "description": "The number of runs to return. This value must be greater than 0 and less than 25.\nThe default value is 20. If a request specifies a limit of 0, the service instead\nuses the maximum limit.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "offset",
+                "description": "The offset of the first run to return, relative to the most recent run.\nDeprecated since June 2023. Use `page_token` to iterate through the pages instead.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Use `next_page_token` or `prev_page_token` returned from the previous request to list the next or previous page of runs respectively.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "run_type",
+                "description": "The type of runs to return. For a description of run types, see :method:jobs/getRun.",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "RunType",
+                  "enum": [
+                    {
+                      "content": "JOB_RUN"
+                    },
+                    {
+                      "content": "SUBMIT_RUN"
+                    },
+                    {
+                      "content": "WORKFLOW_RUN"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "start_time_from",
+                "description": "Show runs that started _at or after_ this value. The value must be a UTC timestamp\nin milliseconds. Can be combined with _start_time_to_ to filter by a time range.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "start_time_to",
+                "description": "Show runs that started _at or before_ this value. The value must be a UTC timestamp\nin milliseconds. Can be combined with _start_time_from_ to filter by a time range.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Use `next_page_token` or `prev_page_token` returned from the previous request to list the next or previous page of runs respectively.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "RepairRun",
+            "description": "Re-run one or more tasks. Tasks are re-run as part of the original job run.\nThey use the current job and task settings, and can be viewed in the history for the\noriginal job run.",
+            "summary": "Repair a job run.",
+            "path": "/api/2.2/jobs/runs/repair",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "RepairRun",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "run_id",
+                  "description": "The job run ID of the run to repair. The run must not be in progress.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "run_id",
+                  "description": "The job run ID of the run to repair. The run must not be in progress.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "RepairRunResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "dbt_commands",
+                "description": "An array of commands to execute for jobs with the dbt task, for example `\"dbt_commands\": [\"dbt deps\", \"dbt seed\", \"dbt deps\", \"dbt seed\", \"dbt run\"]`\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "duration_target",
+                "description": "The window the run aims to finish within, in hours, for a Cost-optimized serverless run.\nRequired only when `performance_target` is `COST_OPTIMIZED`. Must be one of the\nsupported values: `NO_FLEXIBILITY`, `4h`, `12h`, `24h`, `72h`. `NO_FLEXIBILITY` means the run\nuses the default cost-optimized performance level without additional cost-saving optimizations.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "jar_params",
+                "description": "A list of parameters for jobs with Spark JAR tasks, for example `\"jar_params\": [\"john doe\", \"35\"]`.\nThe parameters are used to invoke the main function of the main class specified in the Spark JAR task.\nIf not specified upon `run-now`, it defaults to an empty list.\njar_params cannot be specified in conjunction with notebook_params.\nThe JSON representation of this field (for example `{\"jar_params\":[\"john doe\",\"35\"]}`) cannot exceed 10,000 bytes.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "job_parameters",
+                "description": "Job-level parameters used in the run. for example `\"param\": \"overriding_val\"`",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "latest_repair_id",
+                "description": "The ID of the latest repair. This parameter is not required when repairing a run for the first time, but must be provided on subsequent requests to repair the same run.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "notebook_params",
+                "description": "A map from keys to values for jobs with notebook task, for example `\"notebook_params\": {\"name\": \"john doe\", \"age\": \"35\"}`.\nThe map is passed to the notebook and is accessible through the [dbutils.widgets.get](https://docs.databricks.com/dev-tools/databricks-utils.html) function.\n\nIf not specified upon `run-now`, the triggered run uses the job’s base parameters.\n\nnotebook_params cannot be specified in conjunction with jar_params.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.\n\nThe JSON representation of this field (for example `{\"notebook_params\":{\"name\":\"john doe\",\"age\":\"35\"}}`) cannot exceed 10,000 bytes.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "performance_target",
+                "description": "The performance mode on a serverless job. The performance target determines the level of compute performance or cost-efficiency for the run. This field overrides the performance target defined on the job level.\n\n* `PERFORMANCE_OPTIMIZED`: Prioritizes fast startup and execution times through rapid scaling and optimized cluster performance.\n* `STANDARD`: Enables cost-efficient execution of serverless workloads.\n* `COST_OPTIMIZED`: Enables lower job costs by optimizing compute for your selected target duration time. Must provide a duration target.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PerformanceTarget",
+                  "enum": [
+                    {
+                      "content": "PERFORMANCE_OPTIMIZED"
+                    },
+                    {
+                      "content": "STANDARD"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "pipeline_params",
+                "description": "Controls whether the pipeline should perform a full refresh",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "PipelineParams",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "python_named_params",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "python_params",
+                "description": "A list of parameters for jobs with Python tasks, for example `\"python_params\": [\"john doe\", \"35\"]`.\nThe parameters are passed to Python file as command-line parameters. If specified upon `run-now`, it would overwrite\nthe parameters specified in job setting. The JSON representation of this field (for example `{\"python_params\":[\"john doe\",\"35\"]}`)\ncannot exceed 10,000 bytes.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.\n\nImportant\n\nThese parameters accept only Latin characters (ASCII character set). Using non-ASCII characters returns an error.\nExamples of invalid, non-ASCII characters are Chinese, Japanese kanjis, and emojis.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "rerun_all_failed_tasks",
+                "description": "If true, repair all failed tasks. Only one of `rerun_tasks` or `rerun_all_failed_tasks` can be used.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "rerun_dependent_tasks",
+                "description": "If true, repair all tasks that depend on the tasks in `rerun_tasks`, even if they were previously successful. Can be also used in combination with `rerun_all_failed_tasks`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "rerun_tasks",
+                "description": "The task keys of the task runs to repair.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "run_id",
+                "description": "The job run ID of the run to repair. The run must not be in progress.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "spark_submit_params",
+                "description": "A list of parameters for jobs with spark submit task, for example `\"spark_submit_params\": [\"--class\", \"org.apache.spark.examples.SparkPi\"]`.\nThe parameters are passed to spark-submit script as command-line parameters. If specified upon `run-now`, it would overwrite the\nparameters specified in job setting. The JSON representation of this field (for example `{\"python_params\":[\"john doe\",\"35\"]}`)\ncannot exceed 10,000 bytes.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.\n\nImportant\n\nThese parameters accept only Latin characters (ASCII character set). Using non-ASCII characters returns an error.\nExamples of invalid, non-ASCII characters are Chinese, Japanese kanjis, and emojis.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "sql_params",
+                "description": "A map from keys to values for jobs with SQL task, for example `\"sql_params\": {\"name\": \"john doe\", \"age\": \"35\"}`. The SQL alert task does not support custom parameters.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "run_id",
+                "description": "The job run ID of the run to repair. The run must not be in progress.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "wait": {
+              "success": [
+                {
+                  "content": "TERMINATED"
+                },
+                {
+                  "content": "SKIPPED"
+                }
+              ],
+              "timeout": 20,
+              "complex_message_path": true,
+              "poll": {
+                "response": {
+                  "pascal_name": "Run"
+                }
+              },
+              "status_path": [
+                {
+                  "pascal_name": "State"
+                },
+                {
+                  "pascal_name": "LifeCycleState"
+                }
+              ],
+              "message_path": [
+                {
+                  "pascal_name": "State"
+                },
+                {
+                  "pascal_name": "StateMessage"
+                }
+              ],
+              "message_path_head": {
+                "pascal_name": "State"
+              }
+            }
+          },
+          {
+            "name": "Reset",
+            "description": "Overwrite all settings for the given job. Use the [_Update_ endpoint](:method:jobs/update) to update job settings partially.",
+            "summary": "Update all job settings (reset).",
+            "path": "/api/2.2/jobs/reset",
+            "can_use_json": true,
+            "must_use_json": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ResetJob",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "job_id",
+                  "description": "The canonical identifier of the job to reset. This field is required.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "new_settings",
+                  "description": "The new settings of the job. These settings completely replace the old settings.\n\nChanges to the field `JobBaseSettings.timeout_seconds` are applied to active runs. Changes to other fields are applied to future runs only.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "JobSettings",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "job_id",
+                  "description": "The canonical identifier of the job to reset. This field is required.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "new_settings",
+                  "description": "The new settings of the job. These settings completely replace the old settings.\n\nChanges to the field `JobBaseSettings.timeout_seconds` are applied to active runs. Changes to other fields are applied to future runs only.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "JobSettings",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "job_id",
+                "description": "The canonical identifier of the job to reset. This field is required.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "new_settings",
+                "description": "The new settings of the job. These settings completely replace the old settings.\n\nChanges to the field `JobBaseSettings.timeout_seconds` are applied to active runs. Changes to other fields are applied to future runs only.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "JobSettings",
+                  "is_object": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "RunNow",
+            "description": "Run a job and return the `run_id` of the triggered run.",
+            "summary": "Trigger a new job run.",
+            "path": "/api/2.2/jobs/run-now",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "RunNow",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "job_id",
+                  "description": "The ID of the job to be executed",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "job_id",
+                  "description": "The ID of the job to be executed",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "RunNowResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "dbt_commands",
+                "description": "An array of commands to execute for jobs with the dbt task, for example `\"dbt_commands\": [\"dbt deps\", \"dbt seed\", \"dbt deps\", \"dbt seed\", \"dbt run\"]`\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "duration_target",
+                "description": "The window the run aims to finish within, in hours, for a Cost-optimized serverless run.\nRequired only when `performance_target` is `COST_OPTIMIZED`. Must be one of the\nsupported values: `NO_FLEXIBILITY`, `4h`, `12h`, `24h`, `72h`. `NO_FLEXIBILITY` means the run\nuses the default cost-optimized performance level without additional cost-saving optimizations.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "idempotency_token",
+                "description": "An optional token to guarantee the idempotency of job run requests. If a run with the provided token already exists,\nthe request does not create a new run but returns the ID of the existing run instead. If a run with the provided token is deleted,\nan error is returned.\n\nIf you specify the idempotency token, upon failure you can retry until the request succeeds. Databricks guarantees that exactly one run\nis launched with that idempotency token.\n\nThis token must have at most 64 characters.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "jar_params",
+                "description": "A list of parameters for jobs with Spark JAR tasks, for example `\"jar_params\": [\"john doe\", \"35\"]`.\nThe parameters are used to invoke the main function of the main class specified in the Spark JAR task.\nIf not specified upon `run-now`, it defaults to an empty list.\njar_params cannot be specified in conjunction with notebook_params.\nThe JSON representation of this field (for example `{\"jar_params\":[\"john doe\",\"35\"]}`) cannot exceed 10,000 bytes.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "job_id",
+                "description": "The ID of the job to be executed",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "job_parameters",
+                "description": "Job-level parameters used in the run. for example `\"param\": \"overriding_val\"`",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "notebook_params",
+                "description": "A map from keys to values for jobs with notebook task, for example `\"notebook_params\": {\"name\": \"john doe\", \"age\": \"35\"}`.\nThe map is passed to the notebook and is accessible through the [dbutils.widgets.get](https://docs.databricks.com/dev-tools/databricks-utils.html) function.\n\nIf not specified upon `run-now`, the triggered run uses the job’s base parameters.\n\nnotebook_params cannot be specified in conjunction with jar_params.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.\n\nThe JSON representation of this field (for example `{\"notebook_params\":{\"name\":\"john doe\",\"age\":\"35\"}}`) cannot exceed 10,000 bytes.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "only",
+                "description": "A list of task keys to run inside of the job. If this field is not provided, all tasks in the job will be run.\n\nPrefix a task key with `+` to also run its upstream tasks, or suffix it with `+` to also run its downstream tasks.\nFor example, `+my_task` runs `my_task` and everything upstream of it, `my_task+` runs `my_task` and everything\ndownstream of it, and `+my_task+` runs both. A task key with no `+` runs only that task.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "performance_target",
+                "description": "The performance mode on a serverless job. The performance target determines the level of compute performance or cost-efficiency for the run. This field overrides the performance target defined on the job level.\n\n* `PERFORMANCE_OPTIMIZED`: Prioritizes fast startup and execution times through rapid scaling and optimized cluster performance.\n* `STANDARD`: Enables cost-efficient execution of serverless workloads.\n* `COST_OPTIMIZED`: Enables lower job costs by optimizing compute for your selected target duration time. Must provide a duration target.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PerformanceTarget",
+                  "enum": [
+                    {
+                      "content": "PERFORMANCE_OPTIMIZED"
+                    },
+                    {
+                      "content": "STANDARD"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "pipeline_params",
+                "description": "Controls whether the pipeline should perform a full refresh",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "PipelineParams",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "python_named_params",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "python_params",
+                "description": "A list of parameters for jobs with Python tasks, for example `\"python_params\": [\"john doe\", \"35\"]`.\nThe parameters are passed to Python file as command-line parameters. If specified upon `run-now`, it would overwrite\nthe parameters specified in job setting. The JSON representation of this field (for example `{\"python_params\":[\"john doe\",\"35\"]}`)\ncannot exceed 10,000 bytes.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.\n\nImportant\n\nThese parameters accept only Latin characters (ASCII character set). Using non-ASCII characters returns an error.\nExamples of invalid, non-ASCII characters are Chinese, Japanese kanjis, and emojis.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "queue",
+                "description": "The queue settings of the run.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "QueueSettings",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "spark_submit_params",
+                "description": "A list of parameters for jobs with spark submit task, for example `\"spark_submit_params\": [\"--class\", \"org.apache.spark.examples.SparkPi\"]`.\nThe parameters are passed to spark-submit script as command-line parameters. If specified upon `run-now`, it would overwrite the\nparameters specified in job setting. The JSON representation of this field (for example `{\"python_params\":[\"john doe\",\"35\"]}`)\ncannot exceed 10,000 bytes.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.\n\nImportant\n\nThese parameters accept only Latin characters (ASCII character set). Using non-ASCII characters returns an error.\nExamples of invalid, non-ASCII characters are Chinese, Japanese kanjis, and emojis.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "sql_params",
+                "description": "A map from keys to values for jobs with SQL task, for example `\"sql_params\": {\"name\": \"john doe\", \"age\": \"35\"}`. The SQL alert task does not support custom parameters.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "job_id",
+                "description": "The ID of the job to be executed",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "wait": {
+              "success": [
+                {
+                  "content": "TERMINATED"
+                },
+                {
+                  "content": "SKIPPED"
+                }
+              ],
+              "timeout": 20,
+              "complex_message_path": true,
+              "poll": {
+                "response": {
+                  "pascal_name": "Run"
+                }
+              },
+              "status_path": [
+                {
+                  "pascal_name": "State"
+                },
+                {
+                  "pascal_name": "LifeCycleState"
+                }
+              ],
+              "message_path": [
+                {
+                  "pascal_name": "State"
+                },
+                {
+                  "pascal_name": "StateMessage"
+                }
+              ],
+              "message_path_head": {
+                "pascal_name": "State"
+              }
+            }
+          },
+          {
+            "name": "SetPermissions",
+            "description": "Sets permissions on an object, replacing existing permissions if they exist. Deletes all direct permissions if none are specified. Objects can inherit permissions from their root object.",
+            "summary": "Set job permissions.",
+            "path": "/api/2.0/permissions/jobs/{job_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "JobPermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "job_id",
+                  "description": "The job for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "job_id",
+                  "description": "The job for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "JobPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "access_control_list",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "JobAccessControlRequestList",
+                  "array_value": {
+                    "pascal_name": "JobAccessControlRequest",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "job_id",
+                "description": "The job for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "job_id",
+                "description": "The job for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Submit",
+            "description": "Submit a one-time run. This endpoint allows you to submit a workload directly\nwithout creating a job. Runs submitted using this endpoint don’t display in\nthe UI. Use the `jobs/runs/get` API to check the run state after the job is\nsubmitted.\n\n**Important:** Jobs submitted using this endpoint are not saved as a job.\nThey do not show up in the Jobs UI, and do not retry when they fail. Because\nthey are not saved, Databricks cannot auto-optimize serverless compute in case\nof failure. If your job fails, you may want to use classic compute to specify\nthe compute needs for the job. Alternatively, use the `POST /jobs/create` and\n`POST /jobs/run-now` endpoints to create and run a saved job.",
+            "summary": "Create and trigger a one-time run.",
+            "path": "/api/2.2/jobs/runs/submit",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "SubmitRun",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "SubmitRunResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "access_control_list",
+                "description": "List of permissions to set on the job.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "JobAccessControlRequestList",
+                  "array_value": {
+                    "pascal_name": "JobAccessControlRequest",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "budget_policy_id",
+                "description": "The user specified id of the budget policy to use for this one-time run.\nIf not specified, the run will be not be attributed to any budget policy.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "duration_target",
+                "description": "The window the run aims to finish within, in hours, for a Cost-optimized serverless run.\nRequired only when `performance_target` is `COST_OPTIMIZED`. Must be one of the\nsupported values: `NO_FLEXIBILITY`, `4h`, `12h`, `24h`, `72h`. `NO_FLEXIBILITY` means the run\nuses the default cost-optimized performance level without additional cost-saving optimizations.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "email_notifications",
+                "description": "An optional set of email addresses notified when the run begins or completes.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "JobEmailNotifications",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "environment_variables",
+                "description": "Named environment-variable entries that tasks of this one-time run can\nreference by key from `RunTaskSettings.environment_variables_key`. Each\nentry's `spec` holds inline `variables` and optional `.env` `files`.\nHandled identically to `JobSettings.environment_variables`. Maximum 10 entries.\nEntries are independent of one another — there is no cross-entry merging.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "JobEnvironmentVariablesList",
+                  "array_value": {
+                    "pascal_name": "JobEnvironmentVariables",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "environments",
+                "description": "A list of task execution environment specifications that can be referenced by tasks of this run.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "JobEnvironmentList",
+                  "array_value": {
+                    "pascal_name": "JobEnvironment",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "git_source",
+                "description": "An optional specification for a remote Git repository containing the source code used by tasks. Version-controlled source code is supported by notebook, dbt, Python script, and SQL File tasks.\n\nIf `git_source` is set, these tasks retrieve the file from the remote repository by default. However, this behavior can be overridden by setting `source` to `WORKSPACE` on the task.\n\nNote: dbt and SQL File tasks support only version-controlled sources. If dbt or SQL File tasks are used, `git_source` must be defined on the job.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "GitSource",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "health",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "JobsHealthRules",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "idempotency_token",
+                "description": "An optional token that can be used to guarantee the idempotency of job run requests. If a run with the provided token already exists,\nthe request does not create a new run but returns the ID of the existing run instead. If a run with the provided token is deleted,\nan error is returned.\n\nIf you specify the idempotency token, upon failure you can retry until the request succeeds. Databricks guarantees that exactly\none run is launched with that idempotency token.\n\nThis token must have at most 64 characters.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "notification_settings",
+                "description": "Optional notification settings that are used when sending notifications to each of the `email_notifications` and `webhook_notifications` for this run.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "JobNotificationSettings",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "performance_target",
+                "description": "The performance mode on a serverless one-time run. This field determines the level of compute performance or cost-efficiency for the run.\nThe performance target does not apply to tasks that run on Serverless GPU compute.\n\n* `PERFORMANCE_OPTIMIZED`: Prioritizes fast startup and execution times through rapid scaling and optimized cluster performance.\n* `STANDARD`: Enables cost-efficient execution of serverless workloads.\n* `COST_OPTIMIZED`: Enables lower job costs by optimizing compute for your selected target duration time. Must provide a duration target.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PerformanceTarget",
+                  "enum": [
+                    {
+                      "content": "PERFORMANCE_OPTIMIZED"
+                    },
+                    {
+                      "content": "STANDARD"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "queue",
+                "description": "The queue settings of the one-time run.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "QueueSettings",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "run_as",
+                "description": "Specifies the user or service principal that the job runs as. If not specified, the job runs as the user who submits the request.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "JobRunAs",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "run_name",
+                "description": "An optional name for the run. The default value is `Untitled`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tasks",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "SubmitTaskList",
+                  "array_value": {
+                    "pascal_name": "SubmitTask",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "timeout_seconds",
+                "description": "An optional timeout applied to each run of this job. A value of `0` means no timeout.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "usage_policy_id",
+                "description": "The user specified id of the usage policy to use for this one-time run.\nIf not specified, a default usage policy may be applied when creating or modifying the job.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "webhook_notifications",
+                "description": "A collection of system notification IDs to notify when the run begins or completes.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "WebhookNotifications",
+                  "is_object": true
+                }
+              }
+            ],
+            "wait": {
+              "success": [
+                {
+                  "content": "TERMINATED"
+                },
+                {
+                  "content": "SKIPPED"
+                }
+              ],
+              "timeout": 20,
+              "complex_message_path": true,
+              "poll": {
+                "response": {
+                  "pascal_name": "Run"
+                }
+              },
+              "status_path": [
+                {
+                  "pascal_name": "State"
+                },
+                {
+                  "pascal_name": "LifeCycleState"
+                }
+              ],
+              "message_path": [
+                {
+                  "pascal_name": "State"
+                },
+                {
+                  "pascal_name": "StateMessage"
+                }
+              ],
+              "message_path_head": {
+                "pascal_name": "State"
+              }
+            }
+          },
+          {
+            "name": "Update",
+            "description": "Add, update, or remove specific settings of an existing job. Use the [_Reset_ endpoint](:method:jobs/reset) to overwrite all job settings.",
+            "summary": "Update job settings partially.",
+            "path": "/api/2.2/jobs/update",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateJob",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "job_id",
+                  "description": "The canonical identifier of the job to update. This field is required.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "job_id",
+                  "description": "The canonical identifier of the job to update. This field is required.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "fields_to_remove",
+                "description": "Remove top-level fields in the job settings. Removing nested fields is not supported, except for tasks and job clusters (`tasks/task_1`). This field is optional.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "job_id",
+                "description": "The canonical identifier of the job to update. This field is required.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "new_settings",
+                "description": "The new settings for the job.\n\nTop-level fields specified in `new_settings` are completely replaced, except for arrays which are merged. That is, new and existing entries are completely replaced based on the respective key fields, i.e. `task_key` or `job_cluster_key`, while previous entries are kept.\n\nPartially updating nested fields is not supported.\n\nChanges to the field `JobSettings.timeout_seconds` are applied to active runs. Changes to other fields are applied to future runs only.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "JobSettings",
+                  "is_object": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "job_id",
+                "description": "The canonical identifier of the job to update. This field is required.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdatePermissions",
+            "description": "Updates the permissions on a job. Jobs can inherit permissions from their root object.",
+            "summary": "Update job permissions.",
+            "path": "/api/2.0/permissions/jobs/{job_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "JobPermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "job_id",
+                  "description": "The job for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "job_id",
+                  "description": "The job for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "JobPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "access_control_list",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "JobAccessControlRequestList",
+                  "array_value": {
+                    "pascal_name": "JobAccessControlRequest",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "job_id",
+                "description": "The job for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "job_id",
+                "description": "The job for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "knowledgeassistants.KnowledgeAssistants",
+        "name": "KnowledgeAssistants",
+        "description": "Manage legacy Knowledge Assistants and related resources.",
+        "package": {
+          "name": "knowledgeassistants"
+        },
+        "docs_group": "agentbricks",
+        "launch_stage": "PUBLIC_BETA",
+        "cli_launch_stage_label": "*Beta*",
+        "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+        "cli_launch_stage_display": "Beta",
+        "list": {
+          "request": {
+            "pascal_name": "ListExamplesRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "CreateExample",
+            "description": "Creates an example for a Knowledge Assistant.",
+            "summary": "Create an example for a Knowledge Assistant.",
+            "path": "/api/2.1/{parent=knowledge-assistants/*}/examples",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "CreateExampleRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "Parent resource where this example will be created.\nFormat: knowledge-assistants/{knowledge_assistant_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "example",
+                  "description": "The example to create under the parent Knowledge Assistant.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Example",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "Parent resource where this example will be created.\nFormat: knowledge-assistants/{knowledge_assistant_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "example",
+                  "description": "The example to create under the parent Knowledge Assistant.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Example",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "example",
+              "description": "The example to create under the parent Knowledge Assistant.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Example",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "question",
+                    "description": "The example question.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "question",
+                    "description": "The example question.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "Example",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "question",
+                  "description": "The example question.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "question",
+                  "description": "The example question.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "example",
+                "description": "The example to create under the parent Knowledge Assistant.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Example",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "question",
+                      "description": "The example question.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "question",
+                      "description": "The example question.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "parent",
+                "description": "Parent resource where this example will be created.\nFormat: knowledge-assistants/{knowledge_assistant_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Timestamp when this example was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "example_id",
+                "description": "The universally unique identifier (UUID) of the example.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "guidelines",
+                "description": "Guidelines for answering the question. Optional — examples may be created\nwith just a question; the front-end form does not require guidelines.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "name",
+                "description": "Full resource name:\nknowledge-assistants/{knowledge_assistant_id}/examples/{example_id}",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "question",
+                "description": "The example question.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "Timestamp when this example was last updated.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "Parent resource where this example will be created.\nFormat: knowledge-assistants/{knowledge_assistant_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "question",
+                "description": "The example question.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateKnowledgeAssistant",
+            "description": "Creates a Knowledge Assistant.",
+            "summary": "Create a Knowledge Assistant.",
+            "path": "/api/2.1/knowledge-assistants",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "CreateKnowledgeAssistantRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "knowledge_assistant",
+                  "description": "The Knowledge Assistant to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "KnowledgeAssistant",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "knowledge_assistant",
+                  "description": "The Knowledge Assistant to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "KnowledgeAssistant",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "knowledge_assistant",
+              "description": "The Knowledge Assistant to create.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "KnowledgeAssistant",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "display_name",
+                    "description": "The display name of the Knowledge Assistant, unique at workspace level.\nRequired when creating a Knowledge Assistant.\nWhen updating a Knowledge Assistant, optional unless included in\nupdate_mask.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "description",
+                    "description": "Description of what this agent can do (user-facing).\nRequired when creating a Knowledge Assistant.\nWhen updating a Knowledge Assistant, optional unless included in\nupdate_mask.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "display_name",
+                    "description": "The display name of the Knowledge Assistant, unique at workspace level.\nRequired when creating a Knowledge Assistant.\nWhen updating a Knowledge Assistant, optional unless included in\nupdate_mask.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "description",
+                    "description": "Description of what this agent can do (user-facing).\nRequired when creating a Knowledge Assistant.\nWhen updating a Knowledge Assistant, optional unless included in\nupdate_mask.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "KnowledgeAssistant",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "display_name",
+                  "description": "The display name of the Knowledge Assistant, unique at workspace level.\nRequired when creating a Knowledge Assistant.\nWhen updating a Knowledge Assistant, optional unless included in\nupdate_mask.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "description",
+                  "description": "Description of what this agent can do (user-facing).\nRequired when creating a Knowledge Assistant.\nWhen updating a Knowledge Assistant, optional unless included in\nupdate_mask.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "display_name",
+                  "description": "The display name of the Knowledge Assistant, unique at workspace level.\nRequired when creating a Knowledge Assistant.\nWhen updating a Knowledge Assistant, optional unless included in\nupdate_mask.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "description",
+                  "description": "Description of what this agent can do (user-facing).\nRequired when creating a Knowledge Assistant.\nWhen updating a Knowledge Assistant, optional unless included in\nupdate_mask.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "knowledge_assistant",
+                "description": "The Knowledge Assistant to create.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "KnowledgeAssistant",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "display_name",
+                      "description": "The display name of the Knowledge Assistant, unique at workspace level.\nRequired when creating a Knowledge Assistant.\nWhen updating a Knowledge Assistant, optional unless included in\nupdate_mask.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "description",
+                      "description": "Description of what this agent can do (user-facing).\nRequired when creating a Knowledge Assistant.\nWhen updating a Knowledge Assistant, optional unless included in\nupdate_mask.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "display_name",
+                      "description": "The display name of the Knowledge Assistant, unique at workspace level.\nRequired when creating a Knowledge Assistant.\nWhen updating a Knowledge Assistant, optional unless included in\nupdate_mask.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "description",
+                      "description": "Description of what this agent can do (user-facing).\nRequired when creating a Knowledge Assistant.\nWhen updating a Knowledge Assistant, optional unless included in\nupdate_mask.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Creation timestamp.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "creator",
+                "description": "The creator of the Knowledge Assistant.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "Description of what this agent can do (user-facing).\nRequired when creating a Knowledge Assistant.\nWhen updating a Knowledge Assistant, optional unless included in\nupdate_mask.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "The display name of the Knowledge Assistant, unique at workspace level.\nRequired when creating a Knowledge Assistant.\nWhen updating a Knowledge Assistant, optional unless included in\nupdate_mask.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "endpoint_name",
+                "description": "The name of the knowledge assistant agent endpoint.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "error_info",
+                "description": "Error details when the Knowledge Assistant is in FAILED state.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "experiment_id",
+                "description": "The MLflow experiment ID.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "id",
+                "description": "Deprecated: use knowledge_assistant_id instead.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "instructions",
+                "description": "Additional global instructions on how the agent should generate answers.\nOptional on create and update.\nWhen updating a Knowledge Assistant, include this field in update_mask to\nmodify it.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The resource name of the Knowledge Assistant.\nFormat: knowledge-assistants/{knowledge_assistant_id}",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "state",
+                "description": "State of the Knowledge Assistant. Not returned in List responses.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "KnowledgeAssistantState",
+                  "enum": [
+                    {
+                      "content": "ACTIVE"
+                    },
+                    {
+                      "content": "CREATING"
+                    },
+                    {
+                      "content": "FAILED"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "display_name",
+                "description": "The display name of the Knowledge Assistant, unique at workspace level.\nRequired when creating a Knowledge Assistant.\nWhen updating a Knowledge Assistant, optional unless included in\nupdate_mask.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "Description of what this agent can do (user-facing).\nRequired when creating a Knowledge Assistant.\nWhen updating a Knowledge Assistant, optional unless included in\nupdate_mask.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateKnowledgeSource",
+            "description": "Creates a Knowledge Source under a Knowledge Assistant.",
+            "summary": "Create a Knowledge Source.",
+            "path": "/api/2.1/{parent=knowledge-assistants/*}/knowledge-sources",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "CreateKnowledgeSourceRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "Parent resource where this source will be created.\nFormat: knowledge-assistants/{knowledge_assistant_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "knowledge_source",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "KnowledgeSource",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "Parent resource where this source will be created.\nFormat: knowledge-assistants/{knowledge_assistant_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "knowledge_source",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "KnowledgeSource",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "knowledge_source",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "KnowledgeSource",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "display_name",
+                    "description": "Human-readable display name of the knowledge source.\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, optional unless included in update_mask.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "description",
+                    "description": "Description of the knowledge source.\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, optional unless included in update_mask.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "source_type",
+                    "description": "The type of the source: \"index\", \"files\", or \"file_table\".\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, this field is ignored.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "display_name",
+                    "description": "Human-readable display name of the knowledge source.\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, optional unless included in update_mask.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "description",
+                    "description": "Description of the knowledge source.\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, optional unless included in update_mask.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "source_type",
+                    "description": "The type of the source: \"index\", \"files\", or \"file_table\".\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, this field is ignored.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "KnowledgeSource",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "display_name",
+                  "description": "Human-readable display name of the knowledge source.\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, optional unless included in update_mask.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "description",
+                  "description": "Description of the knowledge source.\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, optional unless included in update_mask.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "source_type",
+                  "description": "The type of the source: \"index\", \"files\", or \"file_table\".\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, this field is ignored.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "display_name",
+                  "description": "Human-readable display name of the knowledge source.\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, optional unless included in update_mask.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "description",
+                  "description": "Description of the knowledge source.\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, optional unless included in update_mask.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "source_type",
+                  "description": "The type of the source: \"index\", \"files\", or \"file_table\".\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, this field is ignored.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "knowledge_source",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "KnowledgeSource",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "display_name",
+                      "description": "Human-readable display name of the knowledge source.\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, optional unless included in update_mask.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "description",
+                      "description": "Description of the knowledge source.\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, optional unless included in update_mask.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "source_type",
+                      "description": "The type of the source: \"index\", \"files\", or \"file_table\".\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, this field is ignored.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "display_name",
+                      "description": "Human-readable display name of the knowledge source.\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, optional unless included in update_mask.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "description",
+                      "description": "Description of the knowledge source.\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, optional unless included in update_mask.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "source_type",
+                      "description": "The type of the source: \"index\", \"files\", or \"file_table\".\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, this field is ignored.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "parent",
+                "description": "Parent resource where this source will be created.\nFormat: knowledge-assistants/{knowledge_assistant_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Timestamp when this knowledge source was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "Description of the knowledge source.\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, optional unless included in update_mask.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "Human-readable display name of the knowledge source.\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, optional unless included in update_mask.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "file_table",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "FileTableSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "files",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "FilesSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "id",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "index",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "IndexSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "knowledge_cutoff_time",
+                "description": "Timestamp representing the cutoff before which content in this knowledge source is being ingested.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Full resource name:\nknowledge-assistants/{knowledge_assistant_id}/knowledge-sources/{knowledge_source_id}",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "source_type",
+                "description": "The type of the source: \"index\", \"files\", or \"file_table\".\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, this field is ignored.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "state",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "KnowledgeSourceState",
+                  "enum": [
+                    {
+                      "content": "FAILED_UPDATE"
+                    },
+                    {
+                      "content": "UPDATED"
+                    },
+                    {
+                      "content": "UPDATING"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "Parent resource where this source will be created.\nFormat: knowledge-assistants/{knowledge_assistant_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "Human-readable display name of the knowledge source.\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, optional unless included in update_mask.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "Description of the knowledge source.\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, optional unless included in update_mask.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "source_type",
+                "description": "The type of the source: \"index\", \"files\", or \"file_table\".\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, this field is ignored.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteExample",
+            "description": "Deletes an example from a Knowledge Assistant.",
+            "summary": "Delete an example from a Knowledge Assistant.",
+            "path": "/api/2.1/{name=knowledge-assistants/*/examples/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "DeleteExampleRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the example to delete.\nFormat: knowledge-assistants/{knowledge_assistant_id}/examples/{example_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the example to delete.\nFormat: knowledge-assistants/{knowledge_assistant_id}/examples/{example_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The resource name of the example to delete.\nFormat: knowledge-assistants/{knowledge_assistant_id}/examples/{example_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The resource name of the example to delete.\nFormat: knowledge-assistants/{knowledge_assistant_id}/examples/{example_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteKnowledgeAssistant",
+            "description": "Deletes a Knowledge Assistant.",
+            "summary": "Delete a Knowledge Assistant.",
+            "path": "/api/2.1/{name=knowledge-assistants/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "DeleteKnowledgeAssistantRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the knowledge assistant to be deleted.\nFormat: knowledge-assistants/{knowledge_assistant_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the knowledge assistant to be deleted.\nFormat: knowledge-assistants/{knowledge_assistant_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The resource name of the knowledge assistant to be deleted.\nFormat: knowledge-assistants/{knowledge_assistant_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The resource name of the knowledge assistant to be deleted.\nFormat: knowledge-assistants/{knowledge_assistant_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteKnowledgeSource",
+            "description": "Deletes a Knowledge Source.",
+            "summary": "Delete a Knowledge Source.",
+            "path": "/api/2.1/{name=knowledge-assistants/*/knowledge-sources/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "DeleteKnowledgeSourceRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the Knowledge Source to delete.\nFormat: knowledge-assistants/{knowledge_assistant_id}/knowledge-sources/{knowledge_source_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the Knowledge Source to delete.\nFormat: knowledge-assistants/{knowledge_assistant_id}/knowledge-sources/{knowledge_source_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The resource name of the Knowledge Source to delete.\nFormat: knowledge-assistants/{knowledge_assistant_id}/knowledge-sources/{knowledge_source_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The resource name of the Knowledge Source to delete.\nFormat: knowledge-assistants/{knowledge_assistant_id}/knowledge-sources/{knowledge_source_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetExample",
+            "description": "Gets an example from a Knowledge Assistant.",
+            "summary": "Get an example from a Knowledge Assistant.",
+            "path": "/api/2.1/{name=knowledge-assistants/*/examples/*}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetExampleRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the example.\nFormat: knowledge-assistants/{knowledge_assistant_id}/examples/{example_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the example.\nFormat: knowledge-assistants/{knowledge_assistant_id}/examples/{example_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Example",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "question",
+                  "description": "The example question.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "question",
+                  "description": "The example question.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The resource name of the example.\nFormat: knowledge-assistants/{knowledge_assistant_id}/examples/{example_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The resource name of the example.\nFormat: knowledge-assistants/{knowledge_assistant_id}/examples/{example_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetKnowledgeAssistant",
+            "description": "Gets a Knowledge Assistant.",
+            "summary": "Get a Knowledge Assistant.",
+            "path": "/api/2.1/{name=knowledge-assistants/*}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetKnowledgeAssistantRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the knowledge assistant.\nFormat: knowledge-assistants/{knowledge_assistant_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the knowledge assistant.\nFormat: knowledge-assistants/{knowledge_assistant_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "KnowledgeAssistant",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "display_name",
+                  "description": "The display name of the Knowledge Assistant, unique at workspace level.\nRequired when creating a Knowledge Assistant.\nWhen updating a Knowledge Assistant, optional unless included in\nupdate_mask.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "description",
+                  "description": "Description of what this agent can do (user-facing).\nRequired when creating a Knowledge Assistant.\nWhen updating a Knowledge Assistant, optional unless included in\nupdate_mask.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "display_name",
+                  "description": "The display name of the Knowledge Assistant, unique at workspace level.\nRequired when creating a Knowledge Assistant.\nWhen updating a Knowledge Assistant, optional unless included in\nupdate_mask.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "description",
+                  "description": "Description of what this agent can do (user-facing).\nRequired when creating a Knowledge Assistant.\nWhen updating a Knowledge Assistant, optional unless included in\nupdate_mask.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The resource name of the knowledge assistant.\nFormat: knowledge-assistants/{knowledge_assistant_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The resource name of the knowledge assistant.\nFormat: knowledge-assistants/{knowledge_assistant_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetKnowledgeSource",
+            "description": "Gets a Knowledge Source.",
+            "summary": "Get a Knowledge Source.",
+            "path": "/api/2.1/{name=knowledge-assistants/*/knowledge-sources/*}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetKnowledgeSourceRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the Knowledge Source.\nFormat: knowledge-assistants/{knowledge_assistant_id}/knowledge-sources/{knowledge_source_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the Knowledge Source.\nFormat: knowledge-assistants/{knowledge_assistant_id}/knowledge-sources/{knowledge_source_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "KnowledgeSource",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "display_name",
+                  "description": "Human-readable display name of the knowledge source.\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, optional unless included in update_mask.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "description",
+                  "description": "Description of the knowledge source.\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, optional unless included in update_mask.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "source_type",
+                  "description": "The type of the source: \"index\", \"files\", or \"file_table\".\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, this field is ignored.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "display_name",
+                  "description": "Human-readable display name of the knowledge source.\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, optional unless included in update_mask.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "description",
+                  "description": "Description of the knowledge source.\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, optional unless included in update_mask.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "source_type",
+                  "description": "The type of the source: \"index\", \"files\", or \"file_table\".\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, this field is ignored.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The resource name of the Knowledge Source.\nFormat: knowledge-assistants/{knowledge_assistant_id}/knowledge-sources/{knowledge_source_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The resource name of the Knowledge Source.\nFormat: knowledge-assistants/{knowledge_assistant_id}/knowledge-sources/{knowledge_source_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetPermissionLevels",
+            "description": "Gets the permission levels that a user can have on an object.",
+            "summary": "Get knowledge assistant permission levels.",
+            "path": "/api/2.0/permissions/knowledge-assistants/{knowledge_assistant_id}/permissionLevels",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetKnowledgeAssistantPermissionLevelsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "knowledge_assistant_id",
+                  "description": "The knowledge assistant for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "knowledge_assistant_id",
+                  "description": "The knowledge assistant for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetKnowledgeAssistantPermissionLevelsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "knowledge_assistant_id",
+                "description": "The knowledge assistant for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "knowledge_assistant_id",
+                "description": "The knowledge assistant for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetPermissions",
+            "description": "Gets the permissions of a knowledge assistant. Knowledge assistants can inherit permissions from their root object.",
+            "summary": "Get knowledge assistant permissions.",
+            "path": "/api/2.0/permissions/knowledge-assistants/{knowledge_assistant_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetKnowledgeAssistantPermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "knowledge_assistant_id",
+                  "description": "The knowledge assistant for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "knowledge_assistant_id",
+                  "description": "The knowledge assistant for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "KnowledgeAssistantPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "knowledge_assistant_id",
+                "description": "The knowledge assistant for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "knowledge_assistant_id",
+                "description": "The knowledge assistant for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListExamples",
+            "description": "Lists examples under a Knowledge Assistant.",
+            "summary": "List examples for a Knowledge Assistant.",
+            "path": "/api/2.1/{parent=knowledge-assistants/*}/examples",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ListExamplesRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "Parent resource to list from.\nFormat: knowledge-assistants/{knowledge_assistant_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "Parent resource to list from.\nFormat: knowledge-assistants/{knowledge_assistant_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListExamplesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "The maximum number of examples to return.\nIf unspecified, at most 100 examples will be returned.\nThe maximum value is 100; values above 100 will be coerced to 100.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "A page token, received from a previous `ListExamples` call.\nProvide this to retrieve the subsequent page.\nIf unspecified, the first page will be returned.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "Parent resource to list from.\nFormat: knowledge-assistants/{knowledge_assistant_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "Parent resource to list from.\nFormat: knowledge-assistants/{knowledge_assistant_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "A page token, received from a previous `ListExamples` call.\nProvide this to retrieve the subsequent page.\nIf unspecified, the first page will be returned.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListKnowledgeAssistants",
+            "description": "List Knowledge Assistants",
+            "summary": "List Knowledge Assistants.",
+            "path": "/api/2.1/knowledge-assistants",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ListKnowledgeAssistantsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListKnowledgeAssistantsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "The maximum number of knowledge assistants to return.\nIf unspecified, at most 100 knowledge assistants will be returned.\nThe maximum value is 100; values above 100 will be coerced to 100.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "A page token, received from a previous `ListKnowledgeAssistants` call.\nProvide this to retrieve the subsequent page.\nIf unspecified, the first page will be returned.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "A page token, received from a previous `ListKnowledgeAssistants` call.\nProvide this to retrieve the subsequent page.\nIf unspecified, the first page will be returned.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListKnowledgeSources",
+            "description": "Lists Knowledge Sources under a Knowledge Assistant.",
+            "summary": "List Knowledge Sources.",
+            "path": "/api/2.1/{parent=knowledge-assistants/*}/knowledge-sources",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ListKnowledgeSourcesRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "Parent resource to list from.\nFormat: knowledge-assistants/{knowledge_assistant_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "Parent resource to list from.\nFormat: knowledge-assistants/{knowledge_assistant_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListKnowledgeSourcesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "Parent resource to list from.\nFormat: knowledge-assistants/{knowledge_assistant_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "Parent resource to list from.\nFormat: knowledge-assistants/{knowledge_assistant_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "SetPermissions",
+            "description": "Sets permissions on an object, replacing existing permissions if they exist. Deletes all direct permissions if none are specified. Objects can inherit permissions from their root object.",
+            "summary": "Set knowledge assistant permissions.",
+            "path": "/api/2.0/permissions/knowledge-assistants/{knowledge_assistant_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "KnowledgeAssistantPermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "knowledge_assistant_id",
+                  "description": "The knowledge assistant for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "knowledge_assistant_id",
+                  "description": "The knowledge assistant for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "KnowledgeAssistantPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "access_control_list",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "KnowledgeAssistantAccessControlRequestList",
+                  "array_value": {
+                    "pascal_name": "KnowledgeAssistantAccessControlRequest",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "knowledge_assistant_id",
+                "description": "The knowledge assistant for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "knowledge_assistant_id",
+                "description": "The knowledge assistant for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "SyncKnowledgeSources",
+            "description": "Sync all non-index Knowledge Sources for a Knowledge Assistant (index sources do not require sync)",
+            "summary": "Syncs all Knowledge Sources for a Knowledge Assistant.",
+            "path": "/api/2.1/{name=knowledge-assistants/*}/knowledge-sources:sync",
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "SyncKnowledgeSourcesRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the Knowledge Assistant.\nFormat: knowledge-assistants/{knowledge_assistant_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the Knowledge Assistant.\nFormat: knowledge-assistants/{knowledge_assistant_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The resource name of the Knowledge Assistant.\nFormat: knowledge-assistants/{knowledge_assistant_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The resource name of the Knowledge Assistant.\nFormat: knowledge-assistants/{knowledge_assistant_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateExample",
+            "description": "Updates an example in a Knowledge Assistant.",
+            "summary": "Update an example in a Knowledge Assistant.",
+            "path": "/api/2.1/{name=knowledge-assistants/*/examples/*}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "UpdateExampleRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the example to update.\nFormat: knowledge-assistants/{knowledge_assistant_id}/examples/{example_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "example",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Example",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Comma-delimited list of fields to update on the example.\nAllowed values: `question`, `guidelines`.\nExamples:\n- `question`\n- `question,guidelines`",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the example to update.\nFormat: knowledge-assistants/{knowledge_assistant_id}/examples/{example_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Comma-delimited list of fields to update on the example.\nAllowed values: `question`, `guidelines`.\nExamples:\n- `question`\n- `question,guidelines`",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "example",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Example",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "example",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Example",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "question",
+                    "description": "The example question.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "question",
+                    "description": "The example question.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "Example",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "question",
+                  "description": "The example question.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "question",
+                  "description": "The example question.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "example",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Example",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "question",
+                      "description": "The example question.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "question",
+                      "description": "The example question.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "name",
+                "description": "The resource name of the example to update.\nFormat: knowledge-assistants/{knowledge_assistant_id}/examples/{example_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Comma-delimited list of fields to update on the example.\nAllowed values: `question`, `guidelines`.\nExamples:\n- `question`\n- `question,guidelines`",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Timestamp when this example was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "example_id",
+                "description": "The universally unique identifier (UUID) of the example.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "guidelines",
+                "description": "Guidelines for answering the question. Optional — examples may be created\nwith just a question; the front-end form does not require guidelines.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "name",
+                "description": "Full resource name:\nknowledge-assistants/{knowledge_assistant_id}/examples/{example_id}",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "question",
+                "description": "The example question.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "Timestamp when this example was last updated.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The resource name of the example to update.\nFormat: knowledge-assistants/{knowledge_assistant_id}/examples/{example_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Comma-delimited list of fields to update on the example.\nAllowed values: `question`, `guidelines`.\nExamples:\n- `question`\n- `question,guidelines`",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "question",
+                "description": "The example question.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateKnowledgeAssistant",
+            "description": "Updates a Knowledge Assistant.",
+            "summary": "Update a Knowledge Assistant.",
+            "path": "/api/2.1/{name=knowledge-assistants/*}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "UpdateKnowledgeAssistantRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the Knowledge Assistant.\nFormat: knowledge-assistants/{knowledge_assistant_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "knowledge_assistant",
+                  "description": "The Knowledge Assistant update payload.\nOnly fields listed in update_mask are updated.\nREQUIRED annotations on Knowledge Assistant fields describe create-time\nrequirements and do not mean all those fields are required for update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "KnowledgeAssistant",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Comma-delimited list of fields to update on the Knowledge Assistant.\nAllowed values: `display_name`, `description`, `instructions`.\nExamples:\n- `display_name`\n- `description,instructions`",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the Knowledge Assistant.\nFormat: knowledge-assistants/{knowledge_assistant_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Comma-delimited list of fields to update on the Knowledge Assistant.\nAllowed values: `display_name`, `description`, `instructions`.\nExamples:\n- `display_name`\n- `description,instructions`",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "knowledge_assistant",
+                  "description": "The Knowledge Assistant update payload.\nOnly fields listed in update_mask are updated.\nREQUIRED annotations on Knowledge Assistant fields describe create-time\nrequirements and do not mean all those fields are required for update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "KnowledgeAssistant",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "knowledge_assistant",
+              "description": "The Knowledge Assistant update payload.\nOnly fields listed in update_mask are updated.\nREQUIRED annotations on Knowledge Assistant fields describe create-time\nrequirements and do not mean all those fields are required for update.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "KnowledgeAssistant",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "display_name",
+                    "description": "The display name of the Knowledge Assistant, unique at workspace level.\nRequired when creating a Knowledge Assistant.\nWhen updating a Knowledge Assistant, optional unless included in\nupdate_mask.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "description",
+                    "description": "Description of what this agent can do (user-facing).\nRequired when creating a Knowledge Assistant.\nWhen updating a Knowledge Assistant, optional unless included in\nupdate_mask.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "display_name",
+                    "description": "The display name of the Knowledge Assistant, unique at workspace level.\nRequired when creating a Knowledge Assistant.\nWhen updating a Knowledge Assistant, optional unless included in\nupdate_mask.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "description",
+                    "description": "Description of what this agent can do (user-facing).\nRequired when creating a Knowledge Assistant.\nWhen updating a Knowledge Assistant, optional unless included in\nupdate_mask.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "KnowledgeAssistant",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "display_name",
+                  "description": "The display name of the Knowledge Assistant, unique at workspace level.\nRequired when creating a Knowledge Assistant.\nWhen updating a Knowledge Assistant, optional unless included in\nupdate_mask.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "description",
+                  "description": "Description of what this agent can do (user-facing).\nRequired when creating a Knowledge Assistant.\nWhen updating a Knowledge Assistant, optional unless included in\nupdate_mask.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "display_name",
+                  "description": "The display name of the Knowledge Assistant, unique at workspace level.\nRequired when creating a Knowledge Assistant.\nWhen updating a Knowledge Assistant, optional unless included in\nupdate_mask.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "description",
+                  "description": "Description of what this agent can do (user-facing).\nRequired when creating a Knowledge Assistant.\nWhen updating a Knowledge Assistant, optional unless included in\nupdate_mask.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "knowledge_assistant",
+                "description": "The Knowledge Assistant update payload.\nOnly fields listed in update_mask are updated.\nREQUIRED annotations on Knowledge Assistant fields describe create-time\nrequirements and do not mean all those fields are required for update.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "KnowledgeAssistant",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "display_name",
+                      "description": "The display name of the Knowledge Assistant, unique at workspace level.\nRequired when creating a Knowledge Assistant.\nWhen updating a Knowledge Assistant, optional unless included in\nupdate_mask.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "description",
+                      "description": "Description of what this agent can do (user-facing).\nRequired when creating a Knowledge Assistant.\nWhen updating a Knowledge Assistant, optional unless included in\nupdate_mask.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "display_name",
+                      "description": "The display name of the Knowledge Assistant, unique at workspace level.\nRequired when creating a Knowledge Assistant.\nWhen updating a Knowledge Assistant, optional unless included in\nupdate_mask.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "description",
+                      "description": "Description of what this agent can do (user-facing).\nRequired when creating a Knowledge Assistant.\nWhen updating a Knowledge Assistant, optional unless included in\nupdate_mask.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "name",
+                "description": "The resource name of the Knowledge Assistant.\nFormat: knowledge-assistants/{knowledge_assistant_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Comma-delimited list of fields to update on the Knowledge Assistant.\nAllowed values: `display_name`, `description`, `instructions`.\nExamples:\n- `display_name`\n- `description,instructions`",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Creation timestamp.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "creator",
+                "description": "The creator of the Knowledge Assistant.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "Description of what this agent can do (user-facing).\nRequired when creating a Knowledge Assistant.\nWhen updating a Knowledge Assistant, optional unless included in\nupdate_mask.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "The display name of the Knowledge Assistant, unique at workspace level.\nRequired when creating a Knowledge Assistant.\nWhen updating a Knowledge Assistant, optional unless included in\nupdate_mask.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "endpoint_name",
+                "description": "The name of the knowledge assistant agent endpoint.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "error_info",
+                "description": "Error details when the Knowledge Assistant is in FAILED state.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "experiment_id",
+                "description": "The MLflow experiment ID.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "id",
+                "description": "Deprecated: use knowledge_assistant_id instead.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "instructions",
+                "description": "Additional global instructions on how the agent should generate answers.\nOptional on create and update.\nWhen updating a Knowledge Assistant, include this field in update_mask to\nmodify it.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The resource name of the Knowledge Assistant.\nFormat: knowledge-assistants/{knowledge_assistant_id}",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "state",
+                "description": "State of the Knowledge Assistant. Not returned in List responses.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "KnowledgeAssistantState",
+                  "enum": [
+                    {
+                      "content": "ACTIVE"
+                    },
+                    {
+                      "content": "CREATING"
+                    },
+                    {
+                      "content": "FAILED"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The resource name of the Knowledge Assistant.\nFormat: knowledge-assistants/{knowledge_assistant_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Comma-delimited list of fields to update on the Knowledge Assistant.\nAllowed values: `display_name`, `description`, `instructions`.\nExamples:\n- `display_name`\n- `description,instructions`",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "The display name of the Knowledge Assistant, unique at workspace level.\nRequired when creating a Knowledge Assistant.\nWhen updating a Knowledge Assistant, optional unless included in\nupdate_mask.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "Description of what this agent can do (user-facing).\nRequired when creating a Knowledge Assistant.\nWhen updating a Knowledge Assistant, optional unless included in\nupdate_mask.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateKnowledgeSource",
+            "description": "Updates a Knowledge Source.",
+            "summary": "Update a Knowledge Source.",
+            "path": "/api/2.1/{name=knowledge-assistants/*/knowledge-sources/*}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "UpdateKnowledgeSourceRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the Knowledge Source to update.\nFormat: knowledge-assistants/{knowledge_assistant_id}/knowledge-sources/{knowledge_source_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "knowledge_source",
+                  "description": "The Knowledge Source update payload.\nOnly fields listed in update_mask are updated.\nREQUIRED annotations on Knowledge Source fields describe create-time\nrequirements and do not mean all those fields are required for update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "KnowledgeSource",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Comma-delimited list of fields to update on the Knowledge Source.\nAllowed values: `display_name`, `description`.\nExamples:\n- `display_name`\n- `display_name,description`",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the Knowledge Source to update.\nFormat: knowledge-assistants/{knowledge_assistant_id}/knowledge-sources/{knowledge_source_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Comma-delimited list of fields to update on the Knowledge Source.\nAllowed values: `display_name`, `description`.\nExamples:\n- `display_name`\n- `display_name,description`",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "knowledge_source",
+                  "description": "The Knowledge Source update payload.\nOnly fields listed in update_mask are updated.\nREQUIRED annotations on Knowledge Source fields describe create-time\nrequirements and do not mean all those fields are required for update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "KnowledgeSource",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "knowledge_source",
+              "description": "The Knowledge Source update payload.\nOnly fields listed in update_mask are updated.\nREQUIRED annotations on Knowledge Source fields describe create-time\nrequirements and do not mean all those fields are required for update.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "KnowledgeSource",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "display_name",
+                    "description": "Human-readable display name of the knowledge source.\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, optional unless included in update_mask.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "description",
+                    "description": "Description of the knowledge source.\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, optional unless included in update_mask.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "source_type",
+                    "description": "The type of the source: \"index\", \"files\", or \"file_table\".\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, this field is ignored.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "display_name",
+                    "description": "Human-readable display name of the knowledge source.\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, optional unless included in update_mask.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "description",
+                    "description": "Description of the knowledge source.\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, optional unless included in update_mask.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "source_type",
+                    "description": "The type of the source: \"index\", \"files\", or \"file_table\".\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, this field is ignored.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "KnowledgeSource",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "display_name",
+                  "description": "Human-readable display name of the knowledge source.\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, optional unless included in update_mask.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "description",
+                  "description": "Description of the knowledge source.\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, optional unless included in update_mask.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "source_type",
+                  "description": "The type of the source: \"index\", \"files\", or \"file_table\".\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, this field is ignored.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "display_name",
+                  "description": "Human-readable display name of the knowledge source.\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, optional unless included in update_mask.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "description",
+                  "description": "Description of the knowledge source.\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, optional unless included in update_mask.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "source_type",
+                  "description": "The type of the source: \"index\", \"files\", or \"file_table\".\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, this field is ignored.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "knowledge_source",
+                "description": "The Knowledge Source update payload.\nOnly fields listed in update_mask are updated.\nREQUIRED annotations on Knowledge Source fields describe create-time\nrequirements and do not mean all those fields are required for update.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "KnowledgeSource",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "display_name",
+                      "description": "Human-readable display name of the knowledge source.\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, optional unless included in update_mask.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "description",
+                      "description": "Description of the knowledge source.\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, optional unless included in update_mask.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "source_type",
+                      "description": "The type of the source: \"index\", \"files\", or \"file_table\".\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, this field is ignored.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "display_name",
+                      "description": "Human-readable display name of the knowledge source.\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, optional unless included in update_mask.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "description",
+                      "description": "Description of the knowledge source.\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, optional unless included in update_mask.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "source_type",
+                      "description": "The type of the source: \"index\", \"files\", or \"file_table\".\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, this field is ignored.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "name",
+                "description": "The resource name of the Knowledge Source to update.\nFormat: knowledge-assistants/{knowledge_assistant_id}/knowledge-sources/{knowledge_source_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Comma-delimited list of fields to update on the Knowledge Source.\nAllowed values: `display_name`, `description`.\nExamples:\n- `display_name`\n- `display_name,description`",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Timestamp when this knowledge source was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "Description of the knowledge source.\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, optional unless included in update_mask.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "Human-readable display name of the knowledge source.\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, optional unless included in update_mask.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "file_table",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "FileTableSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "files",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "FilesSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "id",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "index",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "IndexSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "knowledge_cutoff_time",
+                "description": "Timestamp representing the cutoff before which content in this knowledge source is being ingested.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Full resource name:\nknowledge-assistants/{knowledge_assistant_id}/knowledge-sources/{knowledge_source_id}",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "source_type",
+                "description": "The type of the source: \"index\", \"files\", or \"file_table\".\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, this field is ignored.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "state",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "KnowledgeSourceState",
+                  "enum": [
+                    {
+                      "content": "FAILED_UPDATE"
+                    },
+                    {
+                      "content": "UPDATED"
+                    },
+                    {
+                      "content": "UPDATING"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The resource name of the Knowledge Source to update.\nFormat: knowledge-assistants/{knowledge_assistant_id}/knowledge-sources/{knowledge_source_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Comma-delimited list of fields to update on the Knowledge Source.\nAllowed values: `display_name`, `description`.\nExamples:\n- `display_name`\n- `display_name,description`",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "Human-readable display name of the knowledge source.\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, optional unless included in update_mask.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "Description of the knowledge source.\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, optional unless included in update_mask.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "source_type",
+                "description": "The type of the source: \"index\", \"files\", or \"file_table\".\nRequired when creating a Knowledge Source.\nWhen updating a Knowledge Source, this field is ignored.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdatePermissions",
+            "description": "Updates the permissions on a knowledge assistant. Knowledge assistants can inherit permissions from their root object.",
+            "summary": "Update knowledge assistant permissions.",
+            "path": "/api/2.0/permissions/knowledge-assistants/{knowledge_assistant_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "KnowledgeAssistantPermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "knowledge_assistant_id",
+                  "description": "The knowledge assistant for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "knowledge_assistant_id",
+                  "description": "The knowledge assistant for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "KnowledgeAssistantPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "access_control_list",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "KnowledgeAssistantAccessControlRequestList",
+                  "array_value": {
+                    "pascal_name": "KnowledgeAssistantAccessControlRequest",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "knowledge_assistant_id",
+                "description": "The knowledge assistant for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "knowledge_assistant_id",
+                "description": "The knowledge assistant for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "dashboards.Lakeview",
+        "name": "Lakeview",
+        "description": "These APIs provide specific management operations for Lakeview dashboards. Generic resource management can be done with Workspace API (import, export, get-status, list, delete).",
+        "package": {
+          "name": "dashboards"
+        },
+        "docs_group": "dashboards",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListDashboardsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Create a draft dashboard.\n\nRequires the [Databricks SQL access](https://docs.databricks.com/security/auth/entitlements)\nentitlement. Grant Databricks SQL access in addition to Workspace access.",
+            "summary": "Create dashboard.",
+            "path": "/api/2.0/lakeview/dashboards",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateDashboardRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "dashboard",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Dashboard",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "dashboard",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Dashboard",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "dashboard",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Dashboard",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "Dashboard",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "dashboard",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Dashboard",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "dataset_catalog",
+                "description": "Sets the default catalog for all datasets in this dashboard.\nDoes not impact table references that use fully qualified catalog names (ex: samples.nyctaxi.trips).\nLeave blank to keep each dataset’s existing configuration.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "dataset_schema",
+                "description": "Sets the default schema for all datasets in this dashboard.\nDoes not impact table references that use fully qualified schema names (ex: nyctaxi.trips).\nLeave blank to keep each dataset’s existing configuration.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "The timestamp of when the dashboard was created.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "dashboard_id",
+                "description": "UUID identifying the dashboard.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "The display name of the dashboard.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "etag",
+                "description": "The etag for the dashboard. Can be optionally provided on updates to ensure that the dashboard\nhas not been modified since the last read.\nThis field is excluded in List Dashboards responses.",
+                "is_computed": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "lifecycle_state",
+                "description": "The state of the dashboard resource. Used for tracking trashed status.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "LifecycleState",
+                  "enum": [
+                    {
+                      "content": "ACTIVE"
+                    },
+                    {
+                      "content": "TRASHED"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "parent_path",
+                "description": "The workspace path of the folder containing the dashboard. Includes leading slash and no\ntrailing slash.\nThis field is excluded in List Dashboards responses.",
+                "is_computed": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "path",
+                "description": "The workspace path of the dashboard asset, including the file name.\nExported dashboards always have the file extension `.lvdash.json`.\nThis field is excluded in List Dashboards responses.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "serialized_dashboard",
+                "description": "The contents of the dashboard in serialized string form.\nThis field is excluded in List Dashboards responses.\nUse the [get dashboard API](https://docs.databricks.com/api/workspace/lakeview/get)\nto retrieve an example response, which includes the `serialized_dashboard` field.\nThis field provides the structure of the JSON string that represents the dashboard's\nlayout and components.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "The timestamp of when the dashboard was last updated by the user.\nThis field is excluded in List Dashboards responses.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "warehouse_id",
+                "description": "The warehouse ID used to run the dashboard.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateSchedule",
+            "description": "Create dashboard schedule.\n\nRequires the [Databricks SQL access](https://docs.databricks.com/security/auth/entitlements)\nentitlement. Grant Databricks SQL access in addition to Workspace access.",
+            "summary": "Create dashboard schedule.",
+            "path": "/api/2.0/lakeview/dashboards/{dashboard_id}/schedules",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateScheduleRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "dashboard_id",
+                  "description": "UUID identifying the dashboard to which the schedule belongs.",
+                  "required": true,
+                  "is_path": true,
+                  "is_output_only": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schedule",
+                  "description": "The schedule to create. A dashboard is limited to 10 schedules.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Schedule",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "dashboard_id",
+                  "description": "UUID identifying the dashboard to which the schedule belongs.",
+                  "required": true,
+                  "is_path": true,
+                  "is_output_only": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "schedule",
+                  "description": "The schedule to create. A dashboard is limited to 10 schedules.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Schedule",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "schedule",
+              "description": "The schedule to create. A dashboard is limited to 10 schedules.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Schedule",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "cron_schedule",
+                    "description": "The cron expression describing the frequency of the periodic refresh for this schedule.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "CronSchedule",
+                      "is_object": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "cron_schedule",
+                    "description": "The cron expression describing the frequency of the periodic refresh for this schedule.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "CronSchedule",
+                      "is_object": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "Schedule",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "cron_schedule",
+                  "description": "The cron expression describing the frequency of the periodic refresh for this schedule.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CronSchedule",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "cron_schedule",
+                  "description": "The cron expression describing the frequency of the periodic refresh for this schedule.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CronSchedule",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "dashboard_id",
+                "description": "UUID identifying the dashboard to which the schedule belongs.",
+                "required": true,
+                "is_path": true,
+                "is_output_only": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schedule",
+                "description": "The schedule to create. A dashboard is limited to 10 schedules.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Schedule",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "cron_schedule",
+                      "description": "The cron expression describing the frequency of the periodic refresh for this schedule.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "CronSchedule",
+                        "is_object": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "cron_schedule",
+                      "description": "The cron expression describing the frequency of the periodic refresh for this schedule.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "CronSchedule",
+                        "is_object": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "A timestamp indicating when the schedule was created.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "cron_schedule",
+                "description": "The cron expression describing the frequency of the periodic refresh for this schedule.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CronSchedule",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "dashboard_id",
+                "description": "UUID identifying the dashboard to which the schedule belongs.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "The display name for schedule.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "etag",
+                "description": "The etag for the schedule. Must be left empty on create, must be provided on updates to ensure\nthat the schedule has not been modified since the last read, and can be optionally provided on delete.",
+                "is_computed": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "pause_status",
+                "description": "The status indicates whether this schedule is paused or not.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "SchedulePauseStatus",
+                  "enum": [
+                    {
+                      "content": "PAUSED"
+                    },
+                    {
+                      "content": "UNPAUSED"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "schedule_id",
+                "description": "UUID identifying the schedule.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "A timestamp indicating when the schedule was last updated.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "warehouse_id",
+                "description": "The warehouse id to run the dashboard with for the schedule.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "dashboard_id",
+                "description": "UUID identifying the dashboard to which the schedule belongs.",
+                "required": true,
+                "is_path": true,
+                "is_output_only": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "cron_schedule",
+                "description": "The cron expression describing the frequency of the periodic refresh for this schedule.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CronSchedule",
+                  "is_object": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateSubscription",
+            "description": "Create schedule subscription.\n\nThe caller must be a workspace user with one of the following\n[entitlements](https://docs.databricks.com/security/auth/entitlements):\nWorkspace access, Databricks SQL access, or Consumer access.\n\nAccount-level users who are not members of the workspace cannot call this\nendpoint, even if the dashboard has been shared with them.",
+            "summary": "Create schedule subscription.",
+            "path": "/api/2.0/lakeview/dashboards/{dashboard_id}/schedules/{schedule_id}/subscriptions",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateSubscriptionRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "dashboard_id",
+                  "description": "UUID identifying the dashboard to which the subscription belongs.",
+                  "required": true,
+                  "is_path": true,
+                  "is_output_only": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schedule_id",
+                  "description": "UUID identifying the schedule to which the subscription belongs.",
+                  "required": true,
+                  "is_path": true,
+                  "is_output_only": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "subscription",
+                  "description": "The subscription to create. A schedule is limited to 100 subscriptions.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Subscription",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "dashboard_id",
+                  "description": "UUID identifying the dashboard to which the subscription belongs.",
+                  "required": true,
+                  "is_path": true,
+                  "is_output_only": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schedule_id",
+                  "description": "UUID identifying the schedule to which the subscription belongs.",
+                  "required": true,
+                  "is_path": true,
+                  "is_output_only": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "subscription",
+                  "description": "The subscription to create. A schedule is limited to 100 subscriptions.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Subscription",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "subscription",
+              "description": "The subscription to create. A schedule is limited to 100 subscriptions.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Subscription",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "subscriber",
+                    "description": "Subscriber details for users and destinations to be added as subscribers to the schedule.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "Subscriber",
+                      "is_object": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "subscriber",
+                    "description": "Subscriber details for users and destinations to be added as subscribers to the schedule.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "Subscriber",
+                      "is_object": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "Subscription",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "subscriber",
+                  "description": "Subscriber details for users and destinations to be added as subscribers to the schedule.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Subscriber",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "subscriber",
+                  "description": "Subscriber details for users and destinations to be added as subscribers to the schedule.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Subscriber",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "dashboard_id",
+                "description": "UUID identifying the dashboard to which the subscription belongs.",
+                "required": true,
+                "is_path": true,
+                "is_output_only": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schedule_id",
+                "description": "UUID identifying the schedule to which the subscription belongs.",
+                "required": true,
+                "is_path": true,
+                "is_output_only": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "subscription",
+                "description": "The subscription to create. A schedule is limited to 100 subscriptions.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Subscription",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "subscriber",
+                      "description": "Subscriber details for users and destinations to be added as subscribers to the schedule.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "Subscriber",
+                        "is_object": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "subscriber",
+                      "description": "Subscriber details for users and destinations to be added as subscribers to the schedule.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "Subscriber",
+                        "is_object": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "A timestamp indicating when the subscription was created.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "created_by_user_id",
+                "description": "UserId of the user who adds subscribers (users or notification destinations) to the dashboard's schedule.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "dashboard_id",
+                "description": "UUID identifying the dashboard to which the subscription belongs.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "etag",
+                "description": "The etag for the subscription. Must be left empty on create, can be optionally provided on delete\nto ensure that the subscription has not been deleted since the last read.",
+                "is_computed": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schedule_id",
+                "description": "UUID identifying the schedule to which the subscription belongs.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "skip_notify",
+                "description": "Controls whether notifications are sent to the subscriber for scheduled dashboard refreshes.\nIf not defined, defaults to false in the backend to match the current behavior (refresh and notify)",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "subscriber",
+                "description": "Subscriber details for users and destinations to be added as subscribers to the schedule.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Subscriber",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "subscription_id",
+                "description": "UUID identifying the subscription.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "A timestamp indicating when the subscription was last updated.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "dashboard_id",
+                "description": "UUID identifying the dashboard to which the subscription belongs.",
+                "required": true,
+                "is_path": true,
+                "is_output_only": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schedule_id",
+                "description": "UUID identifying the schedule to which the subscription belongs.",
+                "required": true,
+                "is_path": true,
+                "is_output_only": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "subscriber",
+                "description": "Subscriber details for users and destinations to be added as subscribers to the schedule.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Subscriber",
+                  "is_object": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteSchedule",
+            "description": "Delete dashboard schedule.\n\nRequires the [Databricks SQL access](https://docs.databricks.com/security/auth/entitlements)\nentitlement. Grant Databricks SQL access in addition to Workspace access.",
+            "summary": "Delete dashboard schedule.",
+            "path": "/api/2.0/lakeview/dashboards/{dashboard_id}/schedules/{schedule_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteScheduleRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "dashboard_id",
+                  "description": "UUID identifying the dashboard to which the schedule belongs.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schedule_id",
+                  "description": "UUID identifying the schedule.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "dashboard_id",
+                  "description": "UUID identifying the dashboard to which the schedule belongs.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schedule_id",
+                  "description": "UUID identifying the schedule.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "dashboard_id",
+                "description": "UUID identifying the dashboard to which the schedule belongs.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "etag",
+                "description": "The etag for the schedule. Optionally, it can be provided to verify that the schedule has not\nbeen modified from its last retrieval.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schedule_id",
+                "description": "UUID identifying the schedule.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "dashboard_id",
+                "description": "UUID identifying the dashboard to which the schedule belongs.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schedule_id",
+                "description": "UUID identifying the schedule.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteSubscription",
+            "description": "Delete schedule subscription.\n\nThe caller must be a workspace user with one of the following\n[entitlements](https://docs.databricks.com/security/auth/entitlements):\nWorkspace access, Databricks SQL access, or Consumer access.\n\nAccount-level users who are not members of the workspace cannot call this\nendpoint, even if the dashboard has been shared with them.",
+            "summary": "Delete schedule subscription.",
+            "path": "/api/2.0/lakeview/dashboards/{dashboard_id}/schedules/{schedule_id}/subscriptions/{subscription_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteSubscriptionRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "dashboard_id",
+                  "description": "UUID identifying the dashboard which the subscription belongs.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schedule_id",
+                  "description": "UUID identifying the schedule which the subscription belongs.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "subscription_id",
+                  "description": "UUID identifying the subscription.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "dashboard_id",
+                  "description": "UUID identifying the dashboard which the subscription belongs.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schedule_id",
+                  "description": "UUID identifying the schedule which the subscription belongs.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "subscription_id",
+                  "description": "UUID identifying the subscription.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "dashboard_id",
+                "description": "UUID identifying the dashboard which the subscription belongs.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "etag",
+                "description": "The etag for the subscription. Can be optionally provided to ensure that the subscription has not been\nmodified since the last read.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schedule_id",
+                "description": "UUID identifying the schedule which the subscription belongs.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "subscription_id",
+                "description": "UUID identifying the subscription.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "dashboard_id",
+                "description": "UUID identifying the dashboard which the subscription belongs.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schedule_id",
+                "description": "UUID identifying the schedule which the subscription belongs.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "subscription_id",
+                "description": "UUID identifying the subscription.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Get a draft dashboard.\n\nRequires the [Databricks SQL access](https://docs.databricks.com/security/auth/entitlements)\nentitlement. Grant Databricks SQL access in addition to Workspace access.",
+            "summary": "Get dashboard.",
+            "path": "/api/2.0/lakeview/dashboards/{dashboard_id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetDashboardRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "dashboard_id",
+                  "description": "UUID identifying the dashboard.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "dashboard_id",
+                  "description": "UUID identifying the dashboard.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Dashboard",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "dashboard_id",
+                "description": "UUID identifying the dashboard.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "dashboard_id",
+                "description": "UUID identifying the dashboard.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetPublished",
+            "description": "Get the current published dashboard.\n\nThe caller must be a workspace user with one of the following entitlements:\nWorkspace access, Databricks SQL access, or Consumer access.\n\nAccount-level users who are not members of the workspace cannot call this\nendpoint, even if the dashboard has been shared with them.",
+            "summary": "Get published dashboard.",
+            "path": "/api/2.0/lakeview/dashboards/{dashboard_id}/published",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetPublishedDashboardRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "dashboard_id",
+                  "description": "UUID identifying the published dashboard.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "dashboard_id",
+                  "description": "UUID identifying the published dashboard.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "PublishedDashboard",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "dashboard_id",
+                "description": "UUID identifying the published dashboard.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "dashboard_id",
+                "description": "UUID identifying the published dashboard.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetSchedule",
+            "description": "Get dashboard schedule.\n\nThe caller must be a workspace user with one of the following\n[entitlements](https://docs.databricks.com/security/auth/entitlements):\nWorkspace access, Databricks SQL access, or Consumer access.\n\nAccount-level users who are not members of the workspace cannot call this\nendpoint, even if the dashboard has been shared with them.",
+            "summary": "Get dashboard schedule.",
+            "path": "/api/2.0/lakeview/dashboards/{dashboard_id}/schedules/{schedule_id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetScheduleRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "dashboard_id",
+                  "description": "UUID identifying the dashboard to which the schedule belongs.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schedule_id",
+                  "description": "UUID identifying the schedule.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "dashboard_id",
+                  "description": "UUID identifying the dashboard to which the schedule belongs.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schedule_id",
+                  "description": "UUID identifying the schedule.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Schedule",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "cron_schedule",
+                  "description": "The cron expression describing the frequency of the periodic refresh for this schedule.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CronSchedule",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "cron_schedule",
+                  "description": "The cron expression describing the frequency of the periodic refresh for this schedule.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CronSchedule",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "dashboard_id",
+                "description": "UUID identifying the dashboard to which the schedule belongs.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schedule_id",
+                "description": "UUID identifying the schedule.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "dashboard_id",
+                "description": "UUID identifying the dashboard to which the schedule belongs.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schedule_id",
+                "description": "UUID identifying the schedule.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetSubscription",
+            "description": "Get schedule subscription.\n\nThe caller must be a workspace user with one of the following\n[entitlements](https://docs.databricks.com/security/auth/entitlements):\nWorkspace access, Databricks SQL access, or Consumer access.\n\nAccount-level users who are not members of the workspace cannot call this\nendpoint, even if the dashboard has been shared with them.",
+            "summary": "Get schedule subscription.",
+            "path": "/api/2.0/lakeview/dashboards/{dashboard_id}/schedules/{schedule_id}/subscriptions/{subscription_id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetSubscriptionRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "dashboard_id",
+                  "description": "UUID identifying the dashboard which the subscription belongs.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schedule_id",
+                  "description": "UUID identifying the schedule which the subscription belongs.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "subscription_id",
+                  "description": "UUID identifying the subscription.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "dashboard_id",
+                  "description": "UUID identifying the dashboard which the subscription belongs.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schedule_id",
+                  "description": "UUID identifying the schedule which the subscription belongs.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "subscription_id",
+                  "description": "UUID identifying the subscription.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Subscription",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "subscriber",
+                  "description": "Subscriber details for users and destinations to be added as subscribers to the schedule.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Subscriber",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "subscriber",
+                  "description": "Subscriber details for users and destinations to be added as subscribers to the schedule.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Subscriber",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "dashboard_id",
+                "description": "UUID identifying the dashboard which the subscription belongs.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schedule_id",
+                "description": "UUID identifying the schedule which the subscription belongs.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "subscription_id",
+                "description": "UUID identifying the subscription.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "dashboard_id",
+                "description": "UUID identifying the dashboard which the subscription belongs.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schedule_id",
+                "description": "UUID identifying the schedule which the subscription belongs.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "subscription_id",
+                "description": "UUID identifying the subscription.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "List dashboards.\n\nRequires the [Databricks SQL access](https://docs.databricks.com/security/auth/entitlements)\nentitlement. Grant Databricks SQL access in addition to Workspace access.",
+            "summary": "List dashboards.",
+            "path": "/api/2.0/lakeview/dashboards",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListDashboardsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListDashboardsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "The number of dashboards to return per page.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "A page token, received from a previous `ListDashboards` call.\nThis token can be used to retrieve the subsequent page.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "show_trashed",
+                "description": "The flag to include dashboards located in the trash.\nIf unspecified, only active dashboards will be returned.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "view",
+                "description": "`DASHBOARD_VIEW_BASIC` only includes summary metadata from the dashboard.",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "DashboardView",
+                  "enum": [
+                    {
+                      "content": "DASHBOARD_VIEW_BASIC"
+                    }
+                  ]
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "A page token, received from a previous `ListDashboards` call.\nThis token can be used to retrieve the subsequent page.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListSchedules",
+            "description": "List dashboard schedules.\n\nThe caller must be a workspace user with one of the following\n[entitlements](https://docs.databricks.com/security/auth/entitlements):\nWorkspace access, Databricks SQL access, or Consumer access.\n\nAccount-level users who are not members of the workspace cannot call this\nendpoint, even if the dashboard has been shared with them.",
+            "summary": "List dashboard schedules.",
+            "path": "/api/2.0/lakeview/dashboards/{dashboard_id}/schedules",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListSchedulesRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "dashboard_id",
+                  "description": "UUID identifying the dashboard to which the schedules belongs.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "dashboard_id",
+                  "description": "UUID identifying the dashboard to which the schedules belongs.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListSchedulesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "dashboard_id",
+                "description": "UUID identifying the dashboard to which the schedules belongs.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "The number of schedules to return per page.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "A page token, received from a previous `ListSchedules` call.\nUse this to retrieve the subsequent page.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "dashboard_id",
+                "description": "UUID identifying the dashboard to which the schedules belongs.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "A page token, received from a previous `ListSchedules` call.\nUse this to retrieve the subsequent page.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListSubscriptions",
+            "description": "List schedule subscriptions.\n\nThe caller must be a workspace user with one of the following\n[entitlements](https://docs.databricks.com/security/auth/entitlements):\nWorkspace access, Databricks SQL access, or Consumer access.\n\nAccount-level users who are not members of the workspace cannot call this\nendpoint, even if the dashboard has been shared with them.",
+            "summary": "List schedule subscriptions.",
+            "path": "/api/2.0/lakeview/dashboards/{dashboard_id}/schedules/{schedule_id}/subscriptions",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListSubscriptionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "dashboard_id",
+                  "description": "UUID identifying the dashboard which the subscriptions belongs.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schedule_id",
+                  "description": "UUID identifying the schedule which the subscriptions belongs.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "dashboard_id",
+                  "description": "UUID identifying the dashboard which the subscriptions belongs.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schedule_id",
+                  "description": "UUID identifying the schedule which the subscriptions belongs.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListSubscriptionsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "dashboard_id",
+                "description": "UUID identifying the dashboard which the subscriptions belongs.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "The number of subscriptions to return per page.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "A page token, received from a previous `ListSubscriptions` call.\nUse this to retrieve the subsequent page.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schedule_id",
+                "description": "UUID identifying the schedule which the subscriptions belongs.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "dashboard_id",
+                "description": "UUID identifying the dashboard which the subscriptions belongs.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schedule_id",
+                "description": "UUID identifying the schedule which the subscriptions belongs.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "A page token, received from a previous `ListSubscriptions` call.\nUse this to retrieve the subsequent page.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "Migrate",
+            "description": "Deprecated: Legacy dashboard migration is no longer supported. Use Lakeview (AI/BI)\ndashboards instead.",
+            "summary": "Migrate dashboard.",
+            "path": "/api/2.0/lakeview/dashboards/migrate",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "MigrateDashboardRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "source_dashboard_id",
+                  "description": "UUID of the dashboard to be migrated.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "source_dashboard_id",
+                  "description": "UUID of the dashboard to be migrated.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Dashboard",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "display_name",
+                "description": "Display name for the new Lakeview dashboard.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent_path",
+                "description": "The workspace path of the folder to contain the migrated Lakeview dashboard.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "source_dashboard_id",
+                "description": "UUID of the dashboard to be migrated.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_parameter_syntax",
+                "description": "Flag to indicate if mustache parameter syntax ({{ param }}) should be auto-updated\nto named syntax (:param) when converting datasets in the dashboard.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "source_dashboard_id",
+                "description": "UUID of the dashboard to be migrated.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Publish",
+            "description": "Publish the current draft dashboard.\n\nRequires the [Databricks SQL access](https://docs.databricks.com/security/auth/entitlements)\nentitlement. Grant Databricks SQL access in addition to Workspace access.",
+            "summary": "Publish dashboard.",
+            "path": "/api/2.0/lakeview/dashboards/{dashboard_id}/published",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "PublishRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "dashboard_id",
+                  "description": "UUID identifying the dashboard to be published.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "dashboard_id",
+                  "description": "UUID identifying the dashboard to be published.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "PublishedDashboard",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "dashboard_id",
+                "description": "UUID identifying the dashboard to be published.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "embed_credentials",
+                "description": "Flag to indicate if the publisher's credentials should be embedded in the\npublished dashboard. These embedded credentials will be used to execute the\npublished dashboard's queries.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "warehouse_id",
+                "description": "The ID of the warehouse that can be used to override the warehouse which\nwas set in the draft.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "dashboard_id",
+                "description": "UUID identifying the dashboard to be published.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Revert",
+            "description": "Revert a dashboard's definition in draft mode to the last published version.\n\nRequires the [Databricks SQL access](https://docs.databricks.com/security/auth/entitlements)\nentitlement. Grant Databricks SQL access in addition to Workspace access.",
+            "summary": "Revert dashboard.",
+            "path": "/api/2.0/lakeview/dashboards/{dashboard_id}/revert",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "RevertDashboardRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "dashboard_id",
+                  "description": "UUID identifying the dashboard.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "dashboard_id",
+                  "description": "UUID identifying the dashboard.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "RevertDashboardResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "dashboard_id",
+                "description": "UUID identifying the dashboard.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "etag",
+                "description": "The etag for the dashboard. Optionally, it can be provided to verify that the dashboard\nhas not been modified from its last retrieval.",
+                "is_computed": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "dashboard_id",
+                "description": "UUID identifying the dashboard.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Trash",
+            "description": "Trash a dashboard.\n\nRequires the [Databricks SQL access](https://docs.databricks.com/security/auth/entitlements)\nentitlement. Grant Databricks SQL access in addition to Workspace access.",
+            "summary": "Trash dashboard.",
+            "path": "/api/2.0/lakeview/dashboards/{dashboard_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "TrashDashboardRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "dashboard_id",
+                  "description": "UUID identifying the dashboard.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "dashboard_id",
+                  "description": "UUID identifying the dashboard.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "TrashDashboardResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "dashboard_id",
+                "description": "UUID identifying the dashboard.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "dashboard_id",
+                "description": "UUID identifying the dashboard.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Unpublish",
+            "description": "Unpublish the dashboard.\n\nRequires the [Databricks SQL access](https://docs.databricks.com/security/auth/entitlements)\nentitlement. Grant Databricks SQL access in addition to Workspace access.",
+            "summary": "Unpublish dashboard.",
+            "path": "/api/2.0/lakeview/dashboards/{dashboard_id}/published",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UnpublishDashboardRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "dashboard_id",
+                  "description": "UUID identifying the published dashboard.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "dashboard_id",
+                  "description": "UUID identifying the published dashboard.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "UnpublishDashboardResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "dashboard_id",
+                "description": "UUID identifying the published dashboard.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "dashboard_id",
+                "description": "UUID identifying the published dashboard.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Update a draft dashboard.\n\nRequires the [Databricks SQL access](https://docs.databricks.com/security/auth/entitlements)\nentitlement. Grant Databricks SQL access in addition to Workspace access.",
+            "summary": "Update dashboard.",
+            "path": "/api/2.0/lakeview/dashboards/{dashboard_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateDashboardRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "dashboard_id",
+                  "description": "UUID identifying the dashboard.",
+                  "required": true,
+                  "is_path": true,
+                  "is_output_only": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "dashboard",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Dashboard",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "dashboard_id",
+                  "description": "UUID identifying the dashboard.",
+                  "required": true,
+                  "is_path": true,
+                  "is_output_only": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "dashboard",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Dashboard",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "dashboard",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Dashboard",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "Dashboard",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "dashboard",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Dashboard",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "dashboard_id",
+                "description": "UUID identifying the dashboard.",
+                "required": true,
+                "is_path": true,
+                "is_output_only": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "dataset_catalog",
+                "description": "Sets the default catalog for all datasets in this dashboard.\nDoes not impact table references that use fully qualified catalog names (ex: samples.nyctaxi.trips).\nLeave blank to keep each dataset’s existing configuration.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "dataset_schema",
+                "description": "Sets the default schema for all datasets in this dashboard.\nDoes not impact table references that use fully qualified schema names (ex: nyctaxi.trips).\nLeave blank to keep each dataset’s existing configuration.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "The timestamp of when the dashboard was created.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "dashboard_id",
+                "description": "UUID identifying the dashboard.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "The display name of the dashboard.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "etag",
+                "description": "The etag for the dashboard. Can be optionally provided on updates to ensure that the dashboard\nhas not been modified since the last read.\nThis field is excluded in List Dashboards responses.",
+                "is_computed": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "lifecycle_state",
+                "description": "The state of the dashboard resource. Used for tracking trashed status.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "LifecycleState",
+                  "enum": [
+                    {
+                      "content": "ACTIVE"
+                    },
+                    {
+                      "content": "TRASHED"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "parent_path",
+                "description": "The workspace path of the folder containing the dashboard. Includes leading slash and no\ntrailing slash.\nThis field is excluded in List Dashboards responses.",
+                "is_computed": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "path",
+                "description": "The workspace path of the dashboard asset, including the file name.\nExported dashboards always have the file extension `.lvdash.json`.\nThis field is excluded in List Dashboards responses.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "serialized_dashboard",
+                "description": "The contents of the dashboard in serialized string form.\nThis field is excluded in List Dashboards responses.\nUse the [get dashboard API](https://docs.databricks.com/api/workspace/lakeview/get)\nto retrieve an example response, which includes the `serialized_dashboard` field.\nThis field provides the structure of the JSON string that represents the dashboard's\nlayout and components.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "The timestamp of when the dashboard was last updated by the user.\nThis field is excluded in List Dashboards responses.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "warehouse_id",
+                "description": "The warehouse ID used to run the dashboard.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "dashboard_id",
+                "description": "UUID identifying the dashboard.",
+                "required": true,
+                "is_path": true,
+                "is_output_only": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateSchedule",
+            "description": "Update dashboard schedule.\n\nRequires the [Databricks SQL access](https://docs.databricks.com/security/auth/entitlements)\nentitlement. Grant Databricks SQL access in addition to Workspace access.",
+            "summary": "Update dashboard schedule.",
+            "path": "/api/2.0/lakeview/dashboards/{dashboard_id}/schedules/{schedule_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateScheduleRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "dashboard_id",
+                  "description": "UUID identifying the dashboard to which the schedule belongs.",
+                  "required": true,
+                  "is_path": true,
+                  "is_output_only": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schedule_id",
+                  "description": "UUID identifying the schedule.",
+                  "required": true,
+                  "is_path": true,
+                  "is_output_only": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schedule",
+                  "description": "The schedule to update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Schedule",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "dashboard_id",
+                  "description": "UUID identifying the dashboard to which the schedule belongs.",
+                  "required": true,
+                  "is_path": true,
+                  "is_output_only": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schedule_id",
+                  "description": "UUID identifying the schedule.",
+                  "required": true,
+                  "is_path": true,
+                  "is_output_only": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "schedule",
+                  "description": "The schedule to update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Schedule",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "schedule",
+              "description": "The schedule to update.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Schedule",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "cron_schedule",
+                    "description": "The cron expression describing the frequency of the periodic refresh for this schedule.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "CronSchedule",
+                      "is_object": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "cron_schedule",
+                    "description": "The cron expression describing the frequency of the periodic refresh for this schedule.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "CronSchedule",
+                      "is_object": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "Schedule",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "cron_schedule",
+                  "description": "The cron expression describing the frequency of the periodic refresh for this schedule.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CronSchedule",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "cron_schedule",
+                  "description": "The cron expression describing the frequency of the periodic refresh for this schedule.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CronSchedule",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "dashboard_id",
+                "description": "UUID identifying the dashboard to which the schedule belongs.",
+                "required": true,
+                "is_path": true,
+                "is_output_only": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schedule",
+                "description": "The schedule to update.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Schedule",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "cron_schedule",
+                      "description": "The cron expression describing the frequency of the periodic refresh for this schedule.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "CronSchedule",
+                        "is_object": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "cron_schedule",
+                      "description": "The cron expression describing the frequency of the periodic refresh for this schedule.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "CronSchedule",
+                        "is_object": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "schedule_id",
+                "description": "UUID identifying the schedule.",
+                "required": true,
+                "is_path": true,
+                "is_output_only": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "A timestamp indicating when the schedule was created.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "cron_schedule",
+                "description": "The cron expression describing the frequency of the periodic refresh for this schedule.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CronSchedule",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "dashboard_id",
+                "description": "UUID identifying the dashboard to which the schedule belongs.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "The display name for schedule.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "etag",
+                "description": "The etag for the schedule. Must be left empty on create, must be provided on updates to ensure\nthat the schedule has not been modified since the last read, and can be optionally provided on delete.",
+                "is_computed": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "pause_status",
+                "description": "The status indicates whether this schedule is paused or not.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "SchedulePauseStatus",
+                  "enum": [
+                    {
+                      "content": "PAUSED"
+                    },
+                    {
+                      "content": "UNPAUSED"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "schedule_id",
+                "description": "UUID identifying the schedule.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "A timestamp indicating when the schedule was last updated.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "warehouse_id",
+                "description": "The warehouse id to run the dashboard with for the schedule.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "dashboard_id",
+                "description": "UUID identifying the dashboard to which the schedule belongs.",
+                "required": true,
+                "is_path": true,
+                "is_output_only": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schedule_id",
+                "description": "UUID identifying the schedule.",
+                "required": true,
+                "is_path": true,
+                "is_output_only": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "cron_schedule",
+                "description": "The cron expression describing the frequency of the periodic refresh for this schedule.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CronSchedule",
+                  "is_object": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "dashboards.LakeviewEmbedded",
+        "name": "LakeviewEmbedded",
+        "description": "Token-based Lakeview APIs for embedding dashboards in external applications.",
+        "package": {
+          "name": "dashboards"
+        },
+        "docs_group": "dashboards",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "methods": [
+          {
+            "name": "GetPublishedDashboardTokenInfo",
+            "description": "Get a required authorization details and scopes of a published dashboard to mint an OAuth token.\n\nThe caller must be a workspace user with one of the following entitlements:\nWorkspace access, Databricks SQL access, or Consumer access.\n\nAccount-level users who are not members of the workspace cannot call this\nendpoint, even if the dashboard has been shared with them.",
+            "summary": "Read information of a published dashboard to mint an OAuth token.",
+            "path": "/api/2.0/lakeview/dashboards/{dashboard_id}/published/tokeninfo",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetPublishedDashboardTokenInfoRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "dashboard_id",
+                  "description": "UUID identifying the published dashboard.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "dashboard_id",
+                  "description": "UUID identifying the published dashboard.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetPublishedDashboardTokenInfoResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "dashboard_id",
+                "description": "UUID identifying the published dashboard.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "external_value",
+                "description": "Provided external value to be included in the custom claim.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "external_viewer_id",
+                "description": "Provided external viewer id to be included in the custom claim.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "dashboard_id",
+                "description": "UUID identifying the published dashboard.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "compute.Libraries",
+        "name": "Libraries",
+        "description": "The Libraries API allows you to install and uninstall libraries and get the status of libraries on a cluster.\n\nTo make third-party or custom code available to notebooks and jobs running on your clusters, you can install a library.\nLibraries can be written in Python, Java, Scala, and R. You can upload Python, Java, Scala and R libraries and\npoint to external packages in PyPI, Maven, and CRAN repositories.\n\nCluster libraries can be used by all notebooks running on a cluster. You can install a cluster library directly\nfrom a public repository such as PyPI or Maven, using a previously installed workspace library, or using an init script.\n\nWhen you uninstall a library from a cluster, the library is removed only when you restart the cluster.\nUntil you restart the cluster, the status of the uninstalled library appears as Uninstall pending restart.",
+        "package": {
+          "name": "compute"
+        },
+        "docs_group": "compute",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ClusterStatus"
+          }
+        },
+        "methods": [
+          {
+            "name": "AllClusterStatuses",
+            "description": "Get the status of all libraries on all clusters. A status is returned for all libraries installed on this cluster\nvia the API or the libraries UI.",
+            "summary": "Get all statuses.",
+            "path": "/api/2.0/libraries/all-cluster-statuses",
+            "is_legacy_empty_request": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListAllClusterLibraryStatuses",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListAllClusterLibraryStatusesResponse",
+              "is_object": true
+            },
+            "pagination": {}
+          },
+          {
+            "name": "ClusterStatus",
+            "description": "Get the status of libraries on a cluster. A status is returned for all libraries installed on this cluster via the API\nor the libraries UI.\nThe order of returned libraries is as follows:\n1. Libraries set to be installed on this cluster, in the order that the libraries were added\nto the cluster, are returned first.\n2. Libraries that were previously requested to be installed on this cluster or,\nbut are now marked for removal, in no particular order, are returned last.",
+            "summary": "Get status.",
+            "path": "/api/2.0/libraries/cluster-status",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ClusterStatus",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "cluster_id",
+                  "description": "Unique identifier of the cluster whose status should be retrieved.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "cluster_id",
+                  "description": "Unique identifier of the cluster whose status should be retrieved.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ClusterLibraryStatuses",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "cluster_id",
+                "description": "Unique identifier of the cluster whose status should be retrieved.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "cluster_id",
+                "description": "Unique identifier of the cluster whose status should be retrieved.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {}
+          },
+          {
+            "name": "Install",
+            "description": "Add libraries to install on a cluster. The installation is asynchronous; it happens in\nthe background after the completion of this request.",
+            "summary": "Add a library.",
+            "path": "/api/2.0/libraries/install",
+            "can_use_json": true,
+            "must_use_json": true,
+            "is_crud_create": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "InstallLibraries",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "cluster_id",
+                  "description": "Unique identifier for the cluster on which to install these libraries.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "libraries",
+                  "description": "The libraries to install.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "LibraryList",
+                    "array_value": {
+                      "pascal_name": "Library",
+                      "is_object": true
+                    }
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "cluster_id",
+                  "description": "Unique identifier for the cluster on which to install these libraries.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "libraries",
+                  "description": "The libraries to install.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "LibraryList",
+                    "array_value": {
+                      "pascal_name": "Library",
+                      "is_object": true
+                    }
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "InstallLibrariesResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "cluster_id",
+                "description": "Unique identifier for the cluster on which to install these libraries.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "libraries",
+                "description": "The libraries to install.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "LibraryList",
+                  "array_value": {
+                    "pascal_name": "Library",
+                    "is_object": true
+                  }
+                }
+              }
+            ]
+          },
+          {
+            "name": "Uninstall",
+            "description": "Set libraries to uninstall from a cluster. The libraries won't be uninstalled until\nthe cluster is restarted. A request to uninstall a library that is not currently installed is ignored.",
+            "summary": "Uninstall libraries.",
+            "path": "/api/2.0/libraries/uninstall",
+            "can_use_json": true,
+            "must_use_json": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UninstallLibraries",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "cluster_id",
+                  "description": "Unique identifier for the cluster on which to uninstall these libraries.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "libraries",
+                  "description": "The libraries to uninstall.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "LibraryList",
+                    "array_value": {
+                      "pascal_name": "Library",
+                      "is_object": true
+                    }
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "cluster_id",
+                  "description": "Unique identifier for the cluster on which to uninstall these libraries.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "libraries",
+                  "description": "The libraries to uninstall.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "LibraryList",
+                    "array_value": {
+                      "pascal_name": "Library",
+                      "is_object": true
+                    }
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "UninstallLibrariesResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "cluster_id",
+                "description": "Unique identifier for the cluster on which to uninstall these libraries.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "libraries",
+                "description": "The libraries to uninstall.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "LibraryList",
+                  "array_value": {
+                    "pascal_name": "Library",
+                    "is_object": true
+                  }
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "settings.LlmProxyPartnerPoweredAccount",
+        "name": "LlmProxyPartnerPoweredAccount",
+        "description": "Determines if partner powered models are enabled or not for a specific account",
+        "package": {
+          "name": "settings"
+        },
+        "is_accounts": true,
+        "has_parent": true,
+        "is_hidden_cli": true,
+        "docs_group": "settings",
+        "launch_stage": "PRIVATE_PREVIEW",
+        "cli_launch_stage_display": "Private Preview",
+        "parent_service_id": "settings.AccountSettings",
+        "methods": [
+          {
+            "name": "Get",
+            "description": "Gets the enable partner powered AI features account setting.",
+            "summary": "Get the enable partner powered AI features account setting.",
+            "path": "/api/2.0/accounts/{account_id}/settings/types/llm_proxy_partner_powered/names/default",
+            "is_crud_read": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "GetLlmProxyPartnerPoweredAccountRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "LlmProxyPartnerPoweredAccount",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "boolean_val",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BooleanMessage",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "boolean_val",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BooleanMessage",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Updates the enable partner powered AI features account setting.",
+            "summary": "Update the enable partner powered AI features account setting.",
+            "path": "/api/2.0/accounts/{account_id}/settings/types/llm_proxy_partner_powered/names/default",
+            "can_use_json": true,
+            "must_use_json": true,
+            "is_hidden_cli": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "UpdateLlmProxyPartnerPoweredAccountRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "LlmProxyPartnerPoweredAccount",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "LlmProxyPartnerPoweredAccount",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "LlmProxyPartnerPoweredAccount",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "boolean_val",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BooleanMessage",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "boolean_val",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BooleanMessage",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "allow_missing",
+                "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "field_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "setting",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "LlmProxyPartnerPoweredAccount",
+                  "is_object": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "settings.LlmProxyPartnerPoweredEnforce",
+        "name": "LlmProxyPartnerPoweredEnforce",
+        "description": "Determines if the account-level partner-powered setting value is enforced upon the workspace-level partner-powered setting",
+        "package": {
+          "name": "settings"
+        },
+        "is_accounts": true,
+        "has_parent": true,
+        "is_hidden_cli": true,
+        "docs_group": "settings",
+        "launch_stage": "PRIVATE_PREVIEW",
+        "cli_launch_stage_display": "Private Preview",
+        "parent_service_id": "settings.AccountSettings",
+        "methods": [
+          {
+            "name": "Get",
+            "description": "Gets the enforcement status of partner powered AI features account setting.",
+            "summary": "Get the enforcement status of partner powered AI features account setting.",
+            "path": "/api/2.0/accounts/{account_id}/settings/types/llm_proxy_partner_powered_enforce/names/default",
+            "is_crud_read": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "GetLlmProxyPartnerPoweredEnforceRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "LlmProxyPartnerPoweredEnforce",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "boolean_val",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BooleanMessage",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "boolean_val",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BooleanMessage",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Updates the enable enforcement status of partner powered AI features account setting.",
+            "summary": "Update the enforcement status of partner powered AI features account setting.",
+            "path": "/api/2.0/accounts/{account_id}/settings/types/llm_proxy_partner_powered_enforce/names/default",
+            "can_use_json": true,
+            "must_use_json": true,
+            "is_hidden_cli": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "UpdateLlmProxyPartnerPoweredEnforceRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "LlmProxyPartnerPoweredEnforce",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "LlmProxyPartnerPoweredEnforce",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "LlmProxyPartnerPoweredEnforce",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "boolean_val",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BooleanMessage",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "boolean_val",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BooleanMessage",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "allow_missing",
+                "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "field_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "setting",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "LlmProxyPartnerPoweredEnforce",
+                  "is_object": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "settings.LlmProxyPartnerPoweredWorkspace",
+        "name": "LlmProxyPartnerPoweredWorkspace",
+        "description": "Determines if partner powered models are enabled or not for a specific workspace",
+        "package": {
+          "name": "settings"
+        },
+        "has_parent": true,
+        "is_hidden_cli": true,
+        "docs_group": "settings",
+        "launch_stage": "PRIVATE_PREVIEW",
+        "cli_launch_stage_display": "Private Preview",
+        "parent_service_id": "settings.Settings",
+        "methods": [
+          {
+            "name": "Delete",
+            "description": "Reverts the enable partner powered AI features workspace setting to its default value.",
+            "summary": "Delete the enable partner powered AI features workspace setting.",
+            "path": "/api/2.0/settings/types/llm_proxy_partner_powered/names/default",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "DeleteLlmProxyPartnerPoweredWorkspaceRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "DeleteLlmProxyPartnerPoweredWorkspaceResponse",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "etag",
+                  "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "etag",
+                  "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets the enable partner powered AI features workspace setting.",
+            "summary": "Get the enable partner powered AI features workspace setting.",
+            "path": "/api/2.0/settings/types/llm_proxy_partner_powered/names/default",
+            "is_crud_read": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "GetLlmProxyPartnerPoweredWorkspaceRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "LlmProxyPartnerPoweredWorkspace",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "boolean_val",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BooleanMessage",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "boolean_val",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BooleanMessage",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Updates the enable partner powered AI features workspace setting.",
+            "summary": "Update the enable partner powered AI features workspace setting.",
+            "path": "/api/2.0/settings/types/llm_proxy_partner_powered/names/default",
+            "can_use_json": true,
+            "must_use_json": true,
+            "is_hidden_cli": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "UpdateLlmProxyPartnerPoweredWorkspaceRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "LlmProxyPartnerPoweredWorkspace",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "LlmProxyPartnerPoweredWorkspace",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "LlmProxyPartnerPoweredWorkspace",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "boolean_val",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BooleanMessage",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "boolean_val",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BooleanMessage",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "allow_missing",
+                "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "field_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "setting",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "LlmProxyPartnerPoweredWorkspace",
+                  "is_object": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "billing.LogDelivery",
+        "name": "LogDelivery",
+        "description": "These APIs manage log delivery configurations for this account. The two supported log types for this API are _billable usage logs_ (AWS only) and _audit logs_ (AWS and GCP). This feature is in Public Preview. This feature works with all account ID types.\n\nLog delivery works with all account types. However, if your account is on the E2 version of the platform or on a select custom plan that allows multiple workspaces per account, you can optionally configure different storage destinations for each workspace. Log delivery status is also provided to know the latest status of log delivery attempts.\n\nThe high-level flow of billable usage delivery (AWS only):\n\n1. **Create storage**: In AWS, [create a new AWS S3 bucket](https://docs.databricks.com/administration-guide/account-api/aws-storage.html) with a specific bucket policy. Using Databricks APIs, call the Account API to create a [storage configuration object](:method:Storage/Create) that uses the bucket name.\n\n2. **Create credentials**: In AWS, create the appropriate AWS IAM role. For full details, including the required IAM role policies and trust relationship, see [Billable usage log delivery](https://docs.databricks.com/administration-guide/account-settings/billable-usage-delivery.html). Using Databricks APIs, call the Account API to create a [credential configuration object](:method:Credentials/Create) that uses the IAM role's ARN.\n\n3. **Create log delivery configuration**: Using Databricks APIs, call the Account API to [create a log delivery configuration](:method:LogDelivery/Create) that uses the credential and storage configuration objects from previous steps. You can specify if the logs should include all events of that log type in your account (_Account level_ delivery) or only events for a specific set of workspaces (_workspace level_ delivery). Account level log delivery applies to all current and future workspaces plus account level logs, while workspace level log delivery solely delivers logs related to the specified workspaces. You can create multiple types of delivery configurations per account.\n\nFor billable usage delivery (AWS only):\n* For more information about billable usage logs, see [Billable usage log delivery](https://docs.databricks.com/administration-guide/account-settings/billable-usage-delivery.html). For the CSV schema, see the [Usage page](https://docs.databricks.com/administration-guide/account-settings/usage.html).\n* The delivery location is `\u003cbucket-name\u003e/\u003cprefix\u003e/billable-usage/csv/`, where `\u003cprefix\u003e` is the name of the optional delivery path prefix you set up during log delivery configuration. Files are named `workspaceId=\u003cworkspace-id\u003e-usageMonth=\u003cmonth\u003e.csv`.\n* All billable usage logs apply to specific workspaces (_workspace level_ logs). You can aggregate usage for your entire account by creating an _account level_ delivery configuration that delivers logs for all current and future workspaces in your account.\n* The files are delivered daily by overwriting the month's CSV file for each workspace.\n\nFor audit log delivery (AWS and GCP):\n* For more information about about audit log delivery, see Audit log delivery [AWS](https://docs.databricks.com/administration-guide/account-settings/audit-logs.html) or [GCP](https://docs.databricks.com/gcp/en/admin/account-settings/audit-logs), which includes information about the used JSON schema.\n* The delivery location is `\u003cbucket-name\u003e/\u003cdelivery-path-prefix\u003e/workspaceId=\u003cworkspaceId\u003e/date=\u003cyyyy-mm-dd\u003e/auditlogs_\u003cinternal-id\u003e.json`. Files may get overwritten with the same content multiple times to achieve exactly-once delivery.\n* If the audit log delivery configuration included specific workspace IDs, only _workspace-level_ audit logs for those workspaces are delivered. If the log delivery configuration applies to the entire account (_account level_ delivery configuration), the audit log delivery includes workspace-level audit logs for all workspaces in the account as well as account-level audit logs. See Audit log delivery [AWS](https://docs.databricks.com/administration-guide/account-settings/audit-logs.html) or [GCP](https://docs.databricks.com/gcp/en/admin/account-settings/audit-logs) for details.\n* Auditable events are typically available in logs within 15 minutes.",
+        "package": {
+          "name": "billing"
+        },
+        "is_accounts": true,
+        "docs_group": "billing",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "named_id_map": {
+            "pascal_name": "LogDeliveryConfigurationConfigNameToConfigIdMap"
+          },
+          "request": {
+            "pascal_name": "ListLogDeliveryRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a new Databricks log delivery configuration to enable delivery of the specified type of logs to your storage location.\nThis requires that you already created a [credential object](:method:Credentials/Create) (which encapsulates a cross-account service IAM role)\nand a [storage configuration object](:method:Storage/Create) (which encapsulates an S3 bucket).\n\nFor full details, including the required IAM role policies and bucket policies,\nsee [Deliver and access billable usage logs](https://docs.databricks.com/administration-guide/account-settings/billable-usage-delivery.html)\nor [Configure audit logging](https://docs.databricks.com/administration-guide/account-settings/audit-logs.html).\n\n**Note**: There is a limit on the number of log delivery configurations available per account (each limit applies separately to each log type including billable usage and audit logs).\nYou can create a maximum of two enabled account-level delivery configurations (configurations without a workspace filter) per type.\nAdditionally, you can create two enabled workspace-level delivery configurations per workspace for each log type, which means that the same workspace ID can occur in the workspace filter for no more than two delivery configurations per log type.\n\nYou cannot delete a log delivery configuration, but you can disable it (see [Enable or disable log delivery configuration](:method:LogDelivery/PatchStatus)).",
+            "summary": "Create a new log delivery configuration.",
+            "path": "/api/2.0/accounts/{account_id}/log-delivery",
+            "can_use_json": true,
+            "must_use_json": true,
+            "is_crud_create": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "WrappedCreateLogDeliveryConfiguration",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "log_delivery_configuration",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CreateLogDeliveryConfigurationParams",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "log_delivery_configuration",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CreateLogDeliveryConfigurationParams",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "WrappedLogDeliveryConfiguration",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "log_delivery_configuration",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CreateLogDeliveryConfigurationParams",
+                  "is_object": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets a Databricks log delivery configuration object for an account, both specified by ID.",
+            "summary": "Get log delivery configuration.",
+            "path": "/api/2.0/accounts/{account_id}/log-delivery/{log_delivery_configuration_id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetLogDeliveryRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "log_delivery_configuration_id",
+                  "description": "The log delivery configuration id of customer",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "log_delivery_configuration_id",
+                  "description": "The log delivery configuration id of customer",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetLogDeliveryConfigurationResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "log_delivery_configuration_id",
+                "description": "The log delivery configuration id of customer",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "log_delivery_configuration_id",
+                "description": "The log delivery configuration id of customer",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Gets all Databricks log delivery configurations associated with an account specified by ID.",
+            "summary": "Get all log delivery configurations.",
+            "path": "/api/2.0/accounts/{account_id}/log-delivery",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListLogDeliveryRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "WrappedLogDeliveryConfigurations",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "credentials_id",
+                "description": "The Credentials id to filter the search results with",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "A page token received from a previous get all budget configurations call. This token can be used to retrieve the subsequent page.\nRequests first page if absent.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "status",
+                "description": "The log delivery status to filter the search results with",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "LogDeliveryConfigStatus",
+                  "enum": [
+                    {
+                      "content": "DISABLED"
+                    },
+                    {
+                      "content": "ENABLED"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "storage_configuration_id",
+                "description": "The Storage Configuration id to filter the search results with",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "A page token received from a previous get all budget configurations call. This token can be used to retrieve the subsequent page.\nRequests first page if absent.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "PatchStatus",
+            "description": "Enables or disables a log delivery configuration.\nDeletion of delivery configurations is not supported, so disable log delivery configurations that are no longer needed.\nNote that you can't re-enable a delivery configuration if this would violate the delivery configuration limits described under [Create log delivery](:method:LogDelivery/Create).",
+            "summary": "Enable or disable log delivery configuration.",
+            "path": "/api/2.0/accounts/{account_id}/log-delivery/{log_delivery_configuration_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateLogDeliveryConfigurationStatusRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "log_delivery_configuration_id",
+                  "description": "The log delivery configuration id of customer",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "status",
+                  "description": "Status of log delivery configuration. Set to `ENABLED` (enabled) or `DISABLED` (disabled). Defaults to `ENABLED`. You can [enable or disable the configuration](#operation/patch-log-delivery-config-status) later. Deletion of a configuration is not supported, so disable a log delivery configuration that is no longer needed.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "LogDeliveryConfigStatus",
+                    "enum": [
+                      {
+                        "content": "DISABLED"
+                      },
+                      {
+                        "content": "ENABLED"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "log_delivery_configuration_id",
+                  "description": "The log delivery configuration id of customer",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "status",
+                  "description": "Status of log delivery configuration. Set to `ENABLED` (enabled) or `DISABLED` (disabled). Defaults to `ENABLED`. You can [enable or disable the configuration](#operation/patch-log-delivery-config-status) later. Deletion of a configuration is not supported, so disable a log delivery configuration that is no longer needed.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "LogDeliveryConfigStatus",
+                    "enum": [
+                      {
+                        "content": "DISABLED"
+                      },
+                      {
+                        "content": "ENABLED"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "PatchStatusResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "log_delivery_configuration_id",
+                "description": "The log delivery configuration id of customer",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "status",
+                "description": "Status of log delivery configuration. Set to `ENABLED` (enabled) or `DISABLED` (disabled). Defaults to `ENABLED`. You can [enable or disable the configuration](#operation/patch-log-delivery-config-status) later. Deletion of a configuration is not supported, so disable a log delivery configuration that is no longer needed.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "LogDeliveryConfigStatus",
+                  "enum": [
+                    {
+                      "content": "DISABLED"
+                    },
+                    {
+                      "content": "ENABLED"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "log_delivery_configuration_id",
+                "description": "The log delivery configuration id of customer",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "status",
+                "description": "Status of log delivery configuration. Set to `ENABLED` (enabled) or `DISABLED` (disabled). Defaults to `ENABLED`. You can [enable or disable the configuration](#operation/patch-log-delivery-config-status) later. Deletion of a configuration is not supported, so disable a log delivery configuration that is no longer needed.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "LogDeliveryConfigStatus",
+                  "enum": [
+                    {
+                      "content": "DISABLED"
+                    },
+                    {
+                      "content": "ENABLED"
+                    }
+                  ]
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "ml.MaterializedFeatures",
+        "name": "MaterializedFeatures",
+        "description": "Materialized Features are columns in tables and views that can be directly used as features to train and serve ML models.",
+        "package": {
+          "name": "ml"
+        },
+        "is_hidden_cli": true,
+        "docs_group": "ml",
+        "launch_stage": "PRIVATE_PREVIEW",
+        "cli_launch_stage_display": "Private Preview",
+        "list": {
+          "request": {
+            "pascal_name": "ListFeatureTagsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "CreateFeatureTag",
+            "description": "Creates a FeatureTag.",
+            "summary": "Create a feature tag.",
+            "path": "/api/2.0/feature-store/feature-tables/{table_name}/features/{feature_name}/tags",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "CreateFeatureTagRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "table_name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "feature_name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "feature_tag",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "FeatureTag",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "table_name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "feature_name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "feature_tag",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "FeatureTag",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "feature_tag",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "FeatureTag",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "key",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "key",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "FeatureTag",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "key",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "key",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "feature_name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "feature_tag",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "FeatureTag",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "key",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "key",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "table_name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "key",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "value",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "table_name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "feature_name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "key",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteFeatureTag",
+            "description": "Deletes a FeatureTag.",
+            "summary": "Delete a feature tag.",
+            "path": "/api/2.0/feature-store/feature-tables/{table_name}/features/{feature_name}/tags/{key}",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "DeleteFeatureTagRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "table_name",
+                  "description": "The name of the feature table.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "feature_name",
+                  "description": "The name of the feature within the feature table.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "key",
+                  "description": "The key of the tag to delete.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "table_name",
+                  "description": "The name of the feature table.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "feature_name",
+                  "description": "The name of the feature within the feature table.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "key",
+                  "description": "The key of the tag to delete.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "feature_name",
+                "description": "The name of the feature within the feature table.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "key",
+                "description": "The key of the tag to delete.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "table_name",
+                "description": "The name of the feature table.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "table_name",
+                "description": "The name of the feature table.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "feature_name",
+                "description": "The name of the feature within the feature table.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "key",
+                "description": "The key of the tag to delete.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetFeatureLineage",
+            "description": "Get Feature Lineage.",
+            "summary": "Get Feature Lineage.",
+            "path": "/api/2.0/feature-store/feature-tables/{table_name}/features/{feature_name}/lineage",
+            "is_crud_read": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "GetFeatureLineageRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "table_name",
+                  "description": "The full name of the feature table in Unity Catalog.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "feature_name",
+                  "description": "The name of the feature.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "table_name",
+                  "description": "The full name of the feature table in Unity Catalog.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "feature_name",
+                  "description": "The name of the feature.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "FeatureLineage",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "feature_name",
+                "description": "The name of the feature.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "table_name",
+                "description": "The full name of the feature table in Unity Catalog.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "table_name",
+                "description": "The full name of the feature table in Unity Catalog.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "feature_name",
+                "description": "The name of the feature.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetFeatureTag",
+            "description": "Gets a FeatureTag.",
+            "summary": "Get a feature tag.",
+            "path": "/api/2.0/feature-store/feature-tables/{table_name}/features/{feature_name}/tags/{key}",
+            "is_crud_read": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "GetFeatureTagRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "table_name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "feature_name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "key",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "table_name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "feature_name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "key",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "FeatureTag",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "key",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "key",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "feature_name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "key",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "table_name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "table_name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "feature_name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "key",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListFeatureTags",
+            "description": "Lists FeatureTags.",
+            "summary": "List all feature tags.",
+            "path": "/api/2.0/feature-store/feature-tables/{table_name}/features/{feature_name}/tags",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "ListFeatureTagsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "table_name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "feature_name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "table_name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "feature_name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListFeatureTagsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "feature_name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "The maximum number of results to return.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Pagination token to go to the next page based on a previous query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "table_name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "table_name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "feature_name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Pagination token to go to the next page based on a previous query.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "UpdateFeatureTag",
+            "description": "Updates a FeatureTag.",
+            "summary": "Update a feature tag.",
+            "path": "/api/2.0/feature-store/feature-tables/{table_name}/features/{feature_name}/tags/{key}",
+            "can_use_json": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "UpdateFeatureTagRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "table_name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "feature_name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "key",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "feature_tag",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "FeatureTag",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "table_name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "feature_name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "key",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "feature_tag",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "FeatureTag",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "feature_tag",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "FeatureTag",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "key",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "key",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "FeatureTag",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "key",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "key",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "feature_name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "feature_tag",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "FeatureTag",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "key",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "key",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "key",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "table_name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The list of fields to update.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "key",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "value",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "table_name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "feature_name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "key",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "catalog.AccountMetastoreAssignments",
+        "name": "AccountMetastoreAssignments",
+        "description": "These APIs manage metastore assignments to a workspace.",
+        "package": {
+          "name": "catalog"
+        },
+        "is_accounts": true,
+        "docs_group": "catalog",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListAccountMetastoreAssignmentsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates an assignment to a metastore for a workspace",
+            "summary": "Assigns a workspace to a metastore.",
+            "path": "/api/2.0/accounts/{account_id}/workspaces/{workspace_id}/metastores/{metastore_id}",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "AccountsCreateMetastoreAssignment",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "Workspace ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "metastore_id",
+                  "description": "Unity Catalog metastore ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "Workspace ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "metastore_id",
+                  "description": "Unity Catalog metastore ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "AccountsCreateMetastoreAssignmentResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "metastore_assignment",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CreateMetastoreAssignment",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "metastore_id",
+                "description": "Unity Catalog metastore ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "workspace_id",
+                "description": "Workspace ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "workspace_id",
+                "description": "Workspace ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "metastore_id",
+                "description": "Unity Catalog metastore ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes a metastore assignment to a workspace, leaving the workspace with no metastore.",
+            "summary": "Delete a metastore assignment.",
+            "path": "/api/2.0/accounts/{account_id}/workspaces/{workspace_id}/metastores/{metastore_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteAccountMetastoreAssignmentRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "Workspace ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "metastore_id",
+                  "description": "Unity Catalog metastore ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "Workspace ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "metastore_id",
+                  "description": "Unity Catalog metastore ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "AccountsDeleteMetastoreAssignmentResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "metastore_id",
+                "description": "Unity Catalog metastore ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "workspace_id",
+                "description": "Workspace ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "workspace_id",
+                "description": "Workspace ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "metastore_id",
+                "description": "Unity Catalog metastore ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets the metastore assignment, if any, for the workspace specified by ID.\nIf the workspace is assigned a metastore, the mapping will be returned.\nIf no metastore is assigned to the workspace, the assignment will not be\nfound and a 404 returned.",
+            "summary": "Gets the metastore assignment for a workspace.",
+            "path": "/api/2.0/accounts/{account_id}/workspaces/{workspace_id}/metastore",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetAccountMetastoreAssignmentRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "Workspace ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "Workspace ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "AccountsMetastoreAssignment",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "workspace_id",
+                "description": "Workspace ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "workspace_id",
+                "description": "Workspace ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Gets a list of all Databricks workspace IDs that have been assigned to given metastore.",
+            "summary": "Get all workspaces assigned to a metastore.",
+            "path": "/api/2.0/accounts/{account_id}/metastores/{metastore_id}/workspaces",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListAccountMetastoreAssignmentsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "metastore_id",
+                  "description": "Unity Catalog metastore ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "metastore_id",
+                  "description": "Unity Catalog metastore ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListAccountMetastoreAssignmentsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "metastore_id",
+                "description": "Unity Catalog metastore ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "metastore_id",
+                "description": "Unity Catalog metastore ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {}
+          },
+          {
+            "name": "Update",
+            "description": "Updates an assignment to a metastore for a workspace. Currently, only the default catalog may be updated.",
+            "summary": "Updates a metastore assignment to a workspace.",
+            "path": "/api/2.0/accounts/{account_id}/workspaces/{workspace_id}/metastores/{metastore_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "AccountsUpdateMetastoreAssignment",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "Workspace ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "metastore_id",
+                  "description": "Unity Catalog metastore ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "Workspace ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "metastore_id",
+                  "description": "Unity Catalog metastore ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "AccountsUpdateMetastoreAssignmentResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "metastore_assignment",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "UpdateMetastoreAssignment",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "metastore_id",
+                "description": "Unity Catalog metastore ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "workspace_id",
+                "description": "Workspace ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "workspace_id",
+                "description": "Workspace ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "metastore_id",
+                "description": "Unity Catalog metastore ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "catalog.Metastores",
+        "name": "Metastores",
+        "description": "A metastore is the top-level container of objects in Unity Catalog. It stores data assets\n(tables and views) and the permissions that govern access to them. Databricks account admins\ncan create metastores and assign them to Databricks workspaces to control which workloads\nuse each metastore. For a workspace to use Unity Catalog, it must have a Unity Catalog\nmetastore attached.\n\nEach metastore is configured with a root storage location in a cloud storage account.\nThis storage location is used for metadata and managed tables data.\n\nNOTE: This metastore is distinct from the metastore included in Databricks workspaces\ncreated before Unity Catalog was released. If your workspace includes a legacy Hive\nmetastore, the data in that metastore is available in a catalog named hive_metastore.",
+        "package": {
+          "name": "catalog"
+        },
+        "docs_group": "catalog",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListMetastoresRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Assign",
+            "description": "Creates a new metastore assignment.\nIf an assignment for the same __workspace_id__ exists, it will be overwritten by the new __metastore_id__ and\n__default_catalog_name__. The caller must be an account admin.",
+            "summary": "Create an assignment.",
+            "path": "/api/2.1/unity-catalog/workspaces/{workspace_id}/metastore",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateMetastoreAssignment",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "A workspace ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "metastore_id",
+                  "description": "The unique ID of the metastore.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "default_catalog_name",
+                  "description": "The name of the default catalog in the metastore.\nThis field is deprecated. Please use \"Default Namespace API\" to\nconfigure the default catalog for a Databricks workspace.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "A workspace ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "metastore_id",
+                  "description": "The unique ID of the metastore.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "default_catalog_name",
+                  "description": "The name of the default catalog in the metastore.\nThis field is deprecated. Please use \"Default Namespace API\" to\nconfigure the default catalog for a Databricks workspace.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "AssignResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "default_catalog_name",
+                "description": "The name of the default catalog in the metastore.\nThis field is deprecated. Please use \"Default Namespace API\" to\nconfigure the default catalog for a Databricks workspace.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "metastore_id",
+                "description": "The unique ID of the metastore.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "workspace_id",
+                "description": "A workspace ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "workspace_id",
+                "description": "A workspace ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "metastore_id",
+                "description": "The unique ID of the metastore.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "default_catalog_name",
+                "description": "The name of the default catalog in the metastore.\nThis field is deprecated. Please use \"Default Namespace API\" to\nconfigure the default catalog for a Databricks workspace.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Create",
+            "description": "Creates a new metastore based on a provided name and optional storage root path.\nBy default (if the __owner__ field is not set), the owner of the new metastore is the user calling\nthe __createMetastore__ API.  If the __owner__ field is set to the empty string (**\"\"**), the ownership is\nassigned to the System User instead.",
+            "summary": "Create a metastore.",
+            "path": "/api/2.1/unity-catalog/metastores",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateMetastore",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The user-specified name of the metastore.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "The user-specified name of the metastore.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "MetastoreInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "external_access_enabled",
+                "description": "Whether to allow non-DBR clients to directly access entities under the metastore.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The user-specified name of the metastore.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "region",
+                "description": "Cloud region which the metastore serves (e.g., `us-west-2`, `westus`).",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "storage_root",
+                "description": "The storage root URL for metastore",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The user-specified name of the metastore.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Current",
+            "description": "Gets the metastore assignment for the workspace being accessed.",
+            "summary": "Get metastore assignment for workspace.",
+            "path": "/api/2.1/unity-catalog/current-metastore-assignment",
+            "is_legacy_empty_request": true,
+            "is_crud_read": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CurrentRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "MetastoreAssignment",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "The unique ID of the Databricks workspace.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "metastore_id",
+                  "description": "The unique ID of the metastore.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "The unique ID of the Databricks workspace.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "metastore_id",
+                  "description": "The unique ID of the metastore.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            }
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes a metastore. The caller must be a metastore admin.",
+            "summary": "Delete a metastore.",
+            "path": "/api/2.1/unity-catalog/metastores/{id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteMetastoreRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID of the metastore.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID of the metastore.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "force",
+                "description": "Force deletion even if the metastore is not empty. Default is false.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "id",
+                "description": "Unique ID of the metastore.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Unique ID of the metastore.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets a metastore that matches the supplied ID. The caller must be a metastore admin to retrieve this info.",
+            "summary": "Get a metastore.",
+            "path": "/api/2.1/unity-catalog/metastores/{id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetMetastoreRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID of the metastore.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID of the metastore.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "MetastoreInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "description": "Unique ID of the metastore.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Unique ID of the metastore.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Gets an array of the available metastores (as __MetastoreInfo__ objects). The caller must be an admin to retrieve this info.\nThere is no guarantee of a specific ordering of the elements in the array.\n\nNOTE: we recommend using max_results=0 to use the paginated version of this API. Unpaginated calls will be deprecated soon.\n\nPAGINATION BEHAVIOR: When using pagination (max_results \u003e= 0), a page may contain zero results while still providing a next_page_token.\nClients must continue reading pages until next_page_token is absent, which is the only indication that the end of results has been reached.",
+            "summary": "List metastores.",
+            "path": "/api/2.1/unity-catalog/metastores",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListMetastoresRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListMetastoresResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "max_results",
+                "description": "Maximum number of metastores to return.\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- when set to 0, the page length is set to a server configured value (recommended);\n- when set to a value less than 0, an invalid parameter error is returned;\n- If not set, all the metastores are returned (not recommended).\n- Note: The number of returned metastores might be less than the specified max_results size, even zero.\nThe only definitive indication that no further metastores can be fetched is when the next_page_token is unset from the response.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque pagination token to go to next page based on previous query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Opaque pagination token to go to next page based on previous query.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              },
+              "max_results": {
+                "name": "max_results",
+                "description": "Maximum number of metastores to return.\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- when set to 0, the page length is set to a server configured value (recommended);\n- when set to a value less than 0, an invalid parameter error is returned;\n- If not set, all the metastores are returned (not recommended).\n- Note: The number of returned metastores might be less than the specified max_results size, even zero.\nThe only definitive indication that no further metastores can be fetched is when the next_page_token is unset from the response.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              }
+            }
+          },
+          {
+            "name": "Summary",
+            "description": "Gets information about a metastore.\nThis summary includes the storage credential, the cloud vendor, the cloud region, and the global metastore ID.",
+            "summary": "Get a metastore summary.",
+            "path": "/api/2.1/unity-catalog/metastore_summary",
+            "is_legacy_empty_request": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "SummaryRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "GetMetastoreSummaryResponse",
+              "is_object": true
+            }
+          },
+          {
+            "name": "Unassign",
+            "description": "Deletes a metastore assignment. The caller must be an account administrator.",
+            "summary": "Delete an assignment.",
+            "path": "/api/2.1/unity-catalog/workspaces/{workspace_id}/metastore",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UnassignRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "A workspace ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "metastore_id",
+                  "description": "Query for the ID of the metastore to delete.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "A workspace ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "metastore_id",
+                  "description": "Query for the ID of the metastore to delete.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "UnassignResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "metastore_id",
+                "description": "Query for the ID of the metastore to delete.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "workspace_id",
+                "description": "A workspace ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "workspace_id",
+                "description": "A workspace ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "metastore_id",
+                "description": "Query for the ID of the metastore to delete.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Updates information for a specific metastore. The caller must be a metastore admin.\nIf the __owner__ field is set to the empty string (**\"\"**), the ownership is updated\nto the System User.",
+            "summary": "Update a metastore.",
+            "path": "/api/2.1/unity-catalog/metastores/{id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateMetastore",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID of the metastore.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID of the metastore.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "MetastoreInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "delta_sharing_organization_name",
+                "description": "The organization name of a Delta Sharing entity, to be used in Databricks-to-Databricks Delta Sharing as the official name.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "delta_sharing_recipient_token_lifetime_in_seconds",
+                "description": "The lifetime of delta sharing recipient token in seconds.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "delta_sharing_scope",
+                "description": "The scope of Delta Sharing enabled for the metastore.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DeltaSharingScopeEnum",
+                  "enum": [
+                    {
+                      "content": "INTERNAL"
+                    },
+                    {
+                      "content": "INTERNAL_AND_EXTERNAL"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "external_access_enabled",
+                "description": "Whether to allow non-DBR clients to directly access entities under the metastore.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "id",
+                "description": "Unique ID of the metastore.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "new_name",
+                "description": "New name for the metastore.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "owner",
+                "description": "The owner of the metastore.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "privilege_model_version",
+                "description": "Privilege model version of the metastore, of the form `major.minor` (e.g., `1.0`).",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "storage_root_credential_id",
+                "description": "UUID of storage credential to access the metastore storage_root.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Unique ID of the metastore.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateAssignment",
+            "description": "Updates a metastore assignment. This operation can be used to update __metastore_id__ or __default_catalog_name__\nfor a specified Workspace, if the Workspace is already assigned a metastore.\nThe caller must be an account admin to update __metastore_id__; otherwise, the caller can be a Workspace admin.",
+            "summary": "Update an assignment.",
+            "path": "/api/2.1/unity-catalog/workspaces/{workspace_id}/metastore",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateMetastoreAssignment",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "A workspace ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "A workspace ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "UpdateAssignmentResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "default_catalog_name",
+                "description": "The name of the default catalog in the metastore.\nThis field is deprecated. Please use \"Default Namespace API\" to\nconfigure the default catalog for a Databricks workspace.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "metastore_id",
+                "description": "The unique ID of the metastore.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "workspace_id",
+                "description": "A workspace ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "workspace_id",
+                "description": "A workspace ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "catalog.AccountMetastores",
+        "name": "AccountMetastores",
+        "description": "These APIs manage Unity Catalog metastores for an account. A metastore contains catalogs that can be associated with workspaces",
+        "package": {
+          "name": "catalog"
+        },
+        "is_accounts": true,
+        "docs_group": "catalog",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "is_legacy_empty_request": true,
+          "request": {
+            "pascal_name": "ListAccountMetastoresRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a Unity Catalog metastore.",
+            "summary": "Create Metastore.",
+            "path": "/api/2.0/accounts/{account_id}/metastores",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "AccountsCreateMetastore",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "AccountsCreateMetastoreResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "metastore_info",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CreateAccountsMetastore",
+                  "is_object": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes a Unity Catalog metastore for an account, both specified by ID.",
+            "summary": "Delete a metastore.",
+            "path": "/api/2.0/accounts/{account_id}/metastores/{metastore_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteAccountMetastoreRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "metastore_id",
+                  "description": "Unity Catalog metastore ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "metastore_id",
+                  "description": "Unity Catalog metastore ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "AccountsDeleteMetastoreResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "force",
+                "description": "Force deletion even if the metastore is not empty. Default is false.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "metastore_id",
+                "description": "Unity Catalog metastore ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "metastore_id",
+                "description": "Unity Catalog metastore ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets a Unity Catalog metastore from an account, both specified by ID.",
+            "summary": "Get a metastore.",
+            "path": "/api/2.0/accounts/{account_id}/metastores/{metastore_id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetAccountMetastoreRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "metastore_id",
+                  "description": "Unity Catalog metastore ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "metastore_id",
+                  "description": "Unity Catalog metastore ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "AccountsGetMetastoreResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "metastore_id",
+                "description": "Unity Catalog metastore ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "metastore_id",
+                "description": "Unity Catalog metastore ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Gets all Unity Catalog metastores associated with an account specified by ID.",
+            "summary": "Get all metastores associated with an account.",
+            "path": "/api/2.0/accounts/{account_id}/metastores",
+            "is_legacy_empty_request": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListAccountMetastoresRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "AccountsListMetastoresResponse",
+              "is_object": true
+            },
+            "pagination": {}
+          },
+          {
+            "name": "Update",
+            "description": "Updates an existing Unity Catalog metastore.",
+            "summary": "Update a metastore.",
+            "path": "/api/2.0/accounts/{account_id}/metastores/{metastore_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "AccountsUpdateMetastore",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "metastore_id",
+                  "description": "Unity Catalog metastore ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "metastore_id",
+                  "description": "Unity Catalog metastore ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "AccountsUpdateMetastoreResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "metastore_id",
+                "description": "Unity Catalog metastore ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "metastore_info",
+                "description": "Properties of the metastore to change.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "UpdateAccountsMetastore",
+                  "is_object": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "metastore_id",
+                "description": "Unity Catalog metastore ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "ml.ModelRegistry",
+        "name": "ModelRegistry",
+        "description": "Note: This API reference documents APIs for the Workspace Model Registry. Databricks recommends using\n[Models in Unity Catalog](/api/workspace/registeredmodels) instead. Models in Unity Catalog provides\ncentralized model governance, cross-workspace access, lineage, and deployment. Workspace Model Registry\nwill be deprecated in the future.\n\nThe Workspace Model Registry is a centralized model repository and a UI and set of APIs that enable\nyou to manage the full lifecycle of MLflow Models.",
+        "package": {
+          "name": "ml"
+        },
+        "docs_group": "ml",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListModelsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "ApproveTransitionRequest",
+            "description": "Approves a model version stage transition request.",
+            "summary": "Approve transition request.",
+            "path": "/api/2.0/mlflow/transition-requests/approve",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ApproveTransitionRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the model.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version",
+                  "description": "Version of the model.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "stage",
+                  "description": "Target stage of the transition. Valid values are:\n\n* `None`: The initial stage of a model version.\n\n* `Staging`: Staging or pre-production stage.\n\n* `Production`: Production stage.\n\n* `Archived`: Archived stage.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "archive_existing_versions",
+                  "description": "Specifies whether to archive all current model versions in the target stage.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the model.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version",
+                  "description": "Version of the model.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "stage",
+                  "description": "Target stage of the transition. Valid values are:\n\n* `None`: The initial stage of a model version.\n\n* `Staging`: Staging or pre-production stage.\n\n* `Production`: Production stage.\n\n* `Archived`: Archived stage.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "archive_existing_versions",
+                  "description": "Specifies whether to archive all current model versions in the target stage.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ApproveTransitionRequestResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "archive_existing_versions",
+                "description": "Specifies whether to archive all current model versions in the target stage.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "comment",
+                "description": "User-provided comment on the action.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the model.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "stage",
+                "description": "Target stage of the transition. Valid values are:\n\n* `None`: The initial stage of a model version.\n\n* `Staging`: Staging or pre-production stage.\n\n* `Production`: Production stage.\n\n* `Archived`: Archived stage.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version",
+                "description": "Version of the model.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the model.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version",
+                "description": "Version of the model.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "stage",
+                "description": "Target stage of the transition. Valid values are:\n\n* `None`: The initial stage of a model version.\n\n* `Staging`: Staging or pre-production stage.\n\n* `Production`: Production stage.\n\n* `Archived`: Archived stage.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "archive_existing_versions",
+                "description": "Specifies whether to archive all current model versions in the target stage.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateComment",
+            "description": "Posts a comment on a model version. A comment can be submitted either by a user or programmatically to display\nrelevant information about the model. For example, test results or deployment errors.",
+            "summary": "Post a comment.",
+            "path": "/api/2.0/mlflow/comments/create",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateComment",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the model.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version",
+                  "description": "Version of the model.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "comment",
+                  "description": "User-provided comment on the action.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the model.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version",
+                  "description": "Version of the model.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "comment",
+                  "description": "User-provided comment on the action.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CreateCommentResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "comment",
+                "description": "User-provided comment on the action.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the model.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version",
+                "description": "Version of the model.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the model.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version",
+                "description": "Version of the model.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "comment",
+                "description": "User-provided comment on the action.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateModel",
+            "description": "Creates a new registered model with the name specified in the request body.\nThrows `RESOURCE_ALREADY_EXISTS` if a registered model with the given name exists.",
+            "summary": "Create a model.",
+            "path": "/api/2.0/mlflow/registered-models/create",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateModelRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Register models under this name",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Register models under this name",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CreateModelResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "description",
+                "description": "Optional description for registered model.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Register models under this name",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tags",
+                "description": "Additional metadata for registered model.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ModelTagList",
+                  "array_value": {
+                    "pascal_name": "ModelTag",
+                    "is_object": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Register models under this name",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateModelVersion",
+            "description": "Creates a model version.",
+            "summary": "Create a model version.",
+            "path": "/api/2.0/mlflow/model-versions/create",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateModelVersionRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Register model under this name",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "source",
+                  "description": "URI indicating the location of the model artifacts.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Register model under this name",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "source",
+                  "description": "URI indicating the location of the model artifacts.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CreateModelVersionResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "description",
+                "description": "Optional description for model version.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Register model under this name",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "run_id",
+                "description": "MLflow run ID for correlation, if `source` was generated by an experiment run in\nMLflow tracking server",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "run_link",
+                "description": "MLflow run link - this is the exact link of the run that generated this model version,\npotentially hosted at another instance of MLflow.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "source",
+                "description": "URI indicating the location of the model artifacts.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tags",
+                "description": "Additional metadata for model version.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ModelVersionTagList",
+                  "array_value": {
+                    "pascal_name": "ModelVersionTag",
+                    "is_object": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Register model under this name",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "source",
+                "description": "URI indicating the location of the model artifacts.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateTransitionRequest",
+            "description": "Creates a model version stage transition request.",
+            "summary": "Make a transition request.",
+            "path": "/api/2.0/mlflow/transition-requests/create",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateTransitionRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the model.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version",
+                  "description": "Version of the model.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "stage",
+                  "description": "Target stage of the transition. Valid values are:\n\n* `None`: The initial stage of a model version.\n\n* `Staging`: Staging or pre-production stage.\n\n* `Production`: Production stage.\n\n* `Archived`: Archived stage.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the model.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version",
+                  "description": "Version of the model.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "stage",
+                  "description": "Target stage of the transition. Valid values are:\n\n* `None`: The initial stage of a model version.\n\n* `Staging`: Staging or pre-production stage.\n\n* `Production`: Production stage.\n\n* `Archived`: Archived stage.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CreateTransitionRequestResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "comment",
+                "description": "User-provided comment on the action.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the model.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "stage",
+                "description": "Target stage of the transition. Valid values are:\n\n* `None`: The initial stage of a model version.\n\n* `Staging`: Staging or pre-production stage.\n\n* `Production`: Production stage.\n\n* `Archived`: Archived stage.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version",
+                "description": "Version of the model.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the model.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version",
+                "description": "Version of the model.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "stage",
+                "description": "Target stage of the transition. Valid values are:\n\n* `None`: The initial stage of a model version.\n\n* `Staging`: Staging or pre-production stage.\n\n* `Production`: Production stage.\n\n* `Archived`: Archived stage.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateWebhook",
+            "description": "**NOTE:** This endpoint is in Public Preview.\nCreates a registry webhook.",
+            "summary": "Create a webhook.",
+            "path": "/api/2.0/mlflow/registry-webhooks/create",
+            "can_use_json": true,
+            "must_use_json": true,
+            "is_crud_create": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateRegistryWebhook",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "events",
+                  "description": "Events that can trigger a registry webhook:\n* `MODEL_VERSION_CREATED`: A new model version was created for the associated model.\n\n* `MODEL_VERSION_TRANSITIONED_STAGE`: A model version’s stage was changed.\n\n* `TRANSITION_REQUEST_CREATED`: A user requested a model version’s stage be transitioned.\n\n* `COMMENT_CREATED`: A user wrote a comment on a registered model.\n\n* `REGISTERED_MODEL_CREATED`: A new registered model was created. This event type can only be specified for a registry-wide webhook, which can be created by not specifying a model name in the create request.\n\n* `MODEL_VERSION_TAG_SET`: A user set a tag on the model version.\n\n* `MODEL_VERSION_TRANSITIONED_TO_STAGING`: A model version was transitioned to staging.\n\n* `MODEL_VERSION_TRANSITIONED_TO_PRODUCTION`: A model version was transitioned to production.\n\n* `MODEL_VERSION_TRANSITIONED_TO_ARCHIVED`: A model version was archived.\n\n* `TRANSITION_REQUEST_TO_STAGING_CREATED`: A user requested a model version be transitioned to staging.\n\n* `TRANSITION_REQUEST_TO_PRODUCTION_CREATED`: A user requested a model version be transitioned to production.\n\n* `TRANSITION_REQUEST_TO_ARCHIVED_CREATED`: A user requested a model version be archived.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "RegistryWebhookEventList",
+                    "array_value": {
+                      "pascal_name": "RegistryWebhookEvent",
+                      "enum": [
+                        {
+                          "content": "COMMENT_CREATED"
+                        },
+                        {
+                          "content": "MODEL_VERSION_CREATED"
+                        },
+                        {
+                          "content": "MODEL_VERSION_TAG_SET"
+                        },
+                        {
+                          "content": "MODEL_VERSION_TRANSITIONED_STAGE"
+                        },
+                        {
+                          "content": "MODEL_VERSION_TRANSITIONED_TO_ARCHIVED"
+                        },
+                        {
+                          "content": "MODEL_VERSION_TRANSITIONED_TO_PRODUCTION"
+                        },
+                        {
+                          "content": "MODEL_VERSION_TRANSITIONED_TO_STAGING"
+                        },
+                        {
+                          "content": "REGISTERED_MODEL_CREATED"
+                        },
+                        {
+                          "content": "TRANSITION_REQUEST_CREATED"
+                        },
+                        {
+                          "content": "TRANSITION_REQUEST_TO_ARCHIVED_CREATED"
+                        },
+                        {
+                          "content": "TRANSITION_REQUEST_TO_PRODUCTION_CREATED"
+                        },
+                        {
+                          "content": "TRANSITION_REQUEST_TO_STAGING_CREATED"
+                        }
+                      ]
+                    }
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "events",
+                  "description": "Events that can trigger a registry webhook:\n* `MODEL_VERSION_CREATED`: A new model version was created for the associated model.\n\n* `MODEL_VERSION_TRANSITIONED_STAGE`: A model version’s stage was changed.\n\n* `TRANSITION_REQUEST_CREATED`: A user requested a model version’s stage be transitioned.\n\n* `COMMENT_CREATED`: A user wrote a comment on a registered model.\n\n* `REGISTERED_MODEL_CREATED`: A new registered model was created. This event type can only be specified for a registry-wide webhook, which can be created by not specifying a model name in the create request.\n\n* `MODEL_VERSION_TAG_SET`: A user set a tag on the model version.\n\n* `MODEL_VERSION_TRANSITIONED_TO_STAGING`: A model version was transitioned to staging.\n\n* `MODEL_VERSION_TRANSITIONED_TO_PRODUCTION`: A model version was transitioned to production.\n\n* `MODEL_VERSION_TRANSITIONED_TO_ARCHIVED`: A model version was archived.\n\n* `TRANSITION_REQUEST_TO_STAGING_CREATED`: A user requested a model version be transitioned to staging.\n\n* `TRANSITION_REQUEST_TO_PRODUCTION_CREATED`: A user requested a model version be transitioned to production.\n\n* `TRANSITION_REQUEST_TO_ARCHIVED_CREATED`: A user requested a model version be archived.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "RegistryWebhookEventList",
+                    "array_value": {
+                      "pascal_name": "RegistryWebhookEvent",
+                      "enum": [
+                        {
+                          "content": "COMMENT_CREATED"
+                        },
+                        {
+                          "content": "MODEL_VERSION_CREATED"
+                        },
+                        {
+                          "content": "MODEL_VERSION_TAG_SET"
+                        },
+                        {
+                          "content": "MODEL_VERSION_TRANSITIONED_STAGE"
+                        },
+                        {
+                          "content": "MODEL_VERSION_TRANSITIONED_TO_ARCHIVED"
+                        },
+                        {
+                          "content": "MODEL_VERSION_TRANSITIONED_TO_PRODUCTION"
+                        },
+                        {
+                          "content": "MODEL_VERSION_TRANSITIONED_TO_STAGING"
+                        },
+                        {
+                          "content": "REGISTERED_MODEL_CREATED"
+                        },
+                        {
+                          "content": "TRANSITION_REQUEST_CREATED"
+                        },
+                        {
+                          "content": "TRANSITION_REQUEST_TO_ARCHIVED_CREATED"
+                        },
+                        {
+                          "content": "TRANSITION_REQUEST_TO_PRODUCTION_CREATED"
+                        },
+                        {
+                          "content": "TRANSITION_REQUEST_TO_STAGING_CREATED"
+                        }
+                      ]
+                    }
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CreateWebhookResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "description",
+                "description": "User-specified description for the webhook.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "events",
+                "description": "Events that can trigger a registry webhook:\n* `MODEL_VERSION_CREATED`: A new model version was created for the associated model.\n\n* `MODEL_VERSION_TRANSITIONED_STAGE`: A model version’s stage was changed.\n\n* `TRANSITION_REQUEST_CREATED`: A user requested a model version’s stage be transitioned.\n\n* `COMMENT_CREATED`: A user wrote a comment on a registered model.\n\n* `REGISTERED_MODEL_CREATED`: A new registered model was created. This event type can only be specified for a registry-wide webhook, which can be created by not specifying a model name in the create request.\n\n* `MODEL_VERSION_TAG_SET`: A user set a tag on the model version.\n\n* `MODEL_VERSION_TRANSITIONED_TO_STAGING`: A model version was transitioned to staging.\n\n* `MODEL_VERSION_TRANSITIONED_TO_PRODUCTION`: A model version was transitioned to production.\n\n* `MODEL_VERSION_TRANSITIONED_TO_ARCHIVED`: A model version was archived.\n\n* `TRANSITION_REQUEST_TO_STAGING_CREATED`: A user requested a model version be transitioned to staging.\n\n* `TRANSITION_REQUEST_TO_PRODUCTION_CREATED`: A user requested a model version be transitioned to production.\n\n* `TRANSITION_REQUEST_TO_ARCHIVED_CREATED`: A user requested a model version be archived.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "RegistryWebhookEventList",
+                  "array_value": {
+                    "pascal_name": "RegistryWebhookEvent",
+                    "enum": [
+                      {
+                        "content": "COMMENT_CREATED"
+                      },
+                      {
+                        "content": "MODEL_VERSION_CREATED"
+                      },
+                      {
+                        "content": "MODEL_VERSION_TAG_SET"
+                      },
+                      {
+                        "content": "MODEL_VERSION_TRANSITIONED_STAGE"
+                      },
+                      {
+                        "content": "MODEL_VERSION_TRANSITIONED_TO_ARCHIVED"
+                      },
+                      {
+                        "content": "MODEL_VERSION_TRANSITIONED_TO_PRODUCTION"
+                      },
+                      {
+                        "content": "MODEL_VERSION_TRANSITIONED_TO_STAGING"
+                      },
+                      {
+                        "content": "REGISTERED_MODEL_CREATED"
+                      },
+                      {
+                        "content": "TRANSITION_REQUEST_CREATED"
+                      },
+                      {
+                        "content": "TRANSITION_REQUEST_TO_ARCHIVED_CREATED"
+                      },
+                      {
+                        "content": "TRANSITION_REQUEST_TO_PRODUCTION_CREATED"
+                      },
+                      {
+                        "content": "TRANSITION_REQUEST_TO_STAGING_CREATED"
+                      }
+                    ]
+                  }
+                }
+              },
+              {
+                "name": "http_url_spec",
+                "description": "External HTTPS URL called on event trigger (by using a POST request).",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "HttpUrlSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "job_spec",
+                "description": "ID of the job that the webhook runs.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "JobSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "model_name",
+                "description": "If model name is not specified, a registry-wide webhook is created that listens for the specified events across all versions of all registered models.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "status",
+                "description": "Enable or disable triggering the webhook, or put the webhook into test mode. The default is `ACTIVE`:\n* `ACTIVE`: Webhook is triggered when an associated event happens.\n\n* `DISABLED`: Webhook is not triggered.\n\n* `TEST_MODE`: Webhook can be triggered through the test endpoint, but is not triggered on a real event.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "RegistryWebhookStatus",
+                  "enum": [
+                    {
+                      "content": "ACTIVE"
+                    },
+                    {
+                      "content": "DISABLED"
+                    },
+                    {
+                      "content": "TEST_MODE"
+                    }
+                  ]
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteComment",
+            "description": "Deletes a comment on a model version.",
+            "summary": "Delete a comment.",
+            "path": "/api/2.0/mlflow/comments/delete",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteCommentRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique identifier of an activity",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique identifier of an activity",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteCommentResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "description": "Unique identifier of an activity",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Unique identifier of an activity",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteModel",
+            "description": "Deletes a registered model.",
+            "summary": "Delete a model.",
+            "path": "/api/2.0/mlflow/registered-models/delete",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteModelRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Registered model unique name identifier.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Registered model unique name identifier.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteModelResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Registered model unique name identifier.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Registered model unique name identifier.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteModelTag",
+            "description": "Deletes the tag for a registered model.",
+            "summary": "Delete a model tag.",
+            "path": "/api/2.0/mlflow/registered-models/delete-tag",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteModelTagRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the registered model that the tag was logged under.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "key",
+                  "description": "Name of the tag. The name must be an exact match; wild-card deletion is not supported. Maximum size is 250 bytes.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the registered model that the tag was logged under.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "key",
+                  "description": "Name of the tag. The name must be an exact match; wild-card deletion is not supported. Maximum size is 250 bytes.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteModelTagResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "key",
+                "description": "Name of the tag. The name must be an exact match; wild-card deletion is not supported. Maximum size is 250 bytes.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the registered model that the tag was logged under.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the registered model that the tag was logged under.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "key",
+                "description": "Name of the tag. The name must be an exact match; wild-card deletion is not supported. Maximum size is 250 bytes.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteModelVersion",
+            "description": "Deletes a model version.",
+            "summary": "Delete a model version.",
+            "path": "/api/2.0/mlflow/model-versions/delete",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteModelVersionRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the registered model",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version",
+                  "description": "Model version number",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the registered model",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version",
+                  "description": "Model version number",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteModelVersionResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Name of the registered model",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version",
+                "description": "Model version number",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the registered model",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version",
+                "description": "Model version number",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteModelVersionTag",
+            "description": "Deletes a model version tag.",
+            "summary": "Delete a model version tag.",
+            "path": "/api/2.0/mlflow/model-versions/delete-tag",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteModelVersionTagRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the registered model that the tag was logged under.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version",
+                  "description": "Model version number that the tag was logged under.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "key",
+                  "description": "Name of the tag. The name must be an exact match; wild-card deletion is not supported. Maximum size is 250 bytes.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the registered model that the tag was logged under.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version",
+                  "description": "Model version number that the tag was logged under.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "key",
+                  "description": "Name of the tag. The name must be an exact match; wild-card deletion is not supported. Maximum size is 250 bytes.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteModelVersionTagResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "key",
+                "description": "Name of the tag. The name must be an exact match; wild-card deletion is not supported. Maximum size is 250 bytes.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the registered model that the tag was logged under.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version",
+                "description": "Model version number that the tag was logged under.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the registered model that the tag was logged under.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version",
+                "description": "Model version number that the tag was logged under.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "key",
+                "description": "Name of the tag. The name must be an exact match; wild-card deletion is not supported. Maximum size is 250 bytes.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteTransitionRequest",
+            "description": "Cancels a model version stage transition request.",
+            "summary": "Delete a transition request.",
+            "path": "/api/2.0/mlflow/transition-requests/delete",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteTransitionRequestRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the model.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version",
+                  "description": "Version of the model.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "stage",
+                  "description": "Target stage of the transition request. Valid values are:\n\n* `None`: The initial stage of a model version.\n\n* `Staging`: Staging or pre-production stage.\n\n* `Production`: Production stage.\n\n* `Archived`: Archived stage.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "creator",
+                  "description": "Username of the user who created this request. Of the transition requests matching the specified details, only the one transition created by this user will be deleted.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the model.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version",
+                  "description": "Version of the model.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "stage",
+                  "description": "Target stage of the transition request. Valid values are:\n\n* `None`: The initial stage of a model version.\n\n* `Staging`: Staging or pre-production stage.\n\n* `Production`: Production stage.\n\n* `Archived`: Archived stage.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "creator",
+                  "description": "Username of the user who created this request. Of the transition requests matching the specified details, only the one transition created by this user will be deleted.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteTransitionRequestResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "comment",
+                "description": "User-provided comment on the action.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "creator",
+                "description": "Username of the user who created this request. Of the transition requests matching the specified details, only the one transition created by this user will be deleted.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the model.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "stage",
+                "description": "Target stage of the transition request. Valid values are:\n\n* `None`: The initial stage of a model version.\n\n* `Staging`: Staging or pre-production stage.\n\n* `Production`: Production stage.\n\n* `Archived`: Archived stage.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version",
+                "description": "Version of the model.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the model.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version",
+                "description": "Version of the model.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "stage",
+                "description": "Target stage of the transition request. Valid values are:\n\n* `None`: The initial stage of a model version.\n\n* `Staging`: Staging or pre-production stage.\n\n* `Production`: Production stage.\n\n* `Archived`: Archived stage.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "creator",
+                "description": "Username of the user who created this request. Of the transition requests matching the specified details, only the one transition created by this user will be deleted.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteWebhook",
+            "description": "**NOTE:** This endpoint is in Public Preview.\nDeletes a registry webhook.",
+            "summary": "Delete a webhook.",
+            "path": "/api/2.0/mlflow/registry-webhooks/delete",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteWebhookRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Webhook ID required to delete a registry webhook.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "Webhook ID required to delete a registry webhook.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteWebhookResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "description": "Webhook ID required to delete a registry webhook.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Webhook ID required to delete a registry webhook.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetLatestVersions",
+            "description": "Gets the latest version of a registered model.",
+            "summary": "Get the latest version.",
+            "path": "/api/2.0/mlflow/registered-models/get-latest-versions",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetLatestVersionsRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Registered model unique name identifier.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Registered model unique name identifier.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetLatestVersionsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Registered model unique name identifier.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "stages",
+                "description": "List of stages.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Registered model unique name identifier.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {}
+          },
+          {
+            "name": "GetModel",
+            "description": "Get the details of a model.\nThis is a Databricks workspace version of the [MLflow endpoint](https://www.mlflow.org/docs/latest/rest-api.html#get-registeredmodel)\nthat also returns the model's Databricks workspace ID and the permission level of the requesting user on the model.",
+            "summary": "Get model.",
+            "path": "/api/2.0/mlflow/databricks/registered-models/get",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetModelRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Registered model unique name identifier.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Registered model unique name identifier.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetModelResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Registered model unique name identifier.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Registered model unique name identifier.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetModelVersion",
+            "description": "Get a model version.",
+            "summary": "Get a model version.",
+            "path": "/api/2.0/mlflow/model-versions/get",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetModelVersionRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the registered model",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version",
+                  "description": "Model version number",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the registered model",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version",
+                  "description": "Model version number",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetModelVersionResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Name of the registered model",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version",
+                "description": "Model version number",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the registered model",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version",
+                "description": "Model version number",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetModelVersionDownloadUri",
+            "description": "Gets a URI to download the model version.",
+            "summary": "Get a model version URI.",
+            "path": "/api/2.0/mlflow/model-versions/get-download-uri",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetModelVersionDownloadUriRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the registered model",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version",
+                  "description": "Model version number",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the registered model",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version",
+                  "description": "Model version number",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetModelVersionDownloadUriResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Name of the registered model",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version",
+                "description": "Model version number",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the registered model",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version",
+                "description": "Model version number",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetPermissionLevels",
+            "description": "Gets the permission levels that a user can have on an object.",
+            "summary": "Get registered model permission levels.",
+            "path": "/api/2.0/permissions/registered-models/{registered_model_id}/permissionLevels",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetRegisteredModelPermissionLevelsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "registered_model_id",
+                  "description": "The registered model for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "registered_model_id",
+                  "description": "The registered model for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetRegisteredModelPermissionLevelsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "registered_model_id",
+                "description": "The registered model for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "registered_model_id",
+                "description": "The registered model for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetPermissions",
+            "description": "Gets the permissions of a registered model. Registered models can inherit permissions from their root object.",
+            "summary": "Get registered model permissions.",
+            "path": "/api/2.0/permissions/registered-models/{registered_model_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetRegisteredModelPermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "registered_model_id",
+                  "description": "The registered model for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "registered_model_id",
+                  "description": "The registered model for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "RegisteredModelPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "registered_model_id",
+                "description": "The registered model for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "registered_model_id",
+                "description": "The registered model for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListModels",
+            "description": "Lists all available registered models, up to the limit specified in __max_results__.",
+            "summary": "List models.",
+            "path": "/api/2.0/mlflow/registered-models/list",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListModelsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListModelsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "max_results",
+                "description": "Maximum number of registered models desired. Max threshold is 1000.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Pagination token to go to the next page based on a previous query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Pagination token to go to the next page based on a previous query.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListTransitionRequests",
+            "description": "Gets a list of all open stage transition requests for the model version.",
+            "summary": "List transition requests.",
+            "path": "/api/2.0/mlflow/transition-requests/list",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListTransitionRequestsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the registered model.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version",
+                  "description": "Version of the model.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the registered model.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version",
+                  "description": "Version of the model.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListTransitionRequestsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Name of the registered model.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version",
+                "description": "Version of the model.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the registered model.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version",
+                "description": "Version of the model.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {}
+          },
+          {
+            "name": "ListWebhooks",
+            "description": "**NOTE:** This endpoint is in Public Preview.\nLists all registry webhooks.",
+            "summary": "List registry webhooks.",
+            "path": "/api/2.0/mlflow/registry-webhooks/list",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListWebhooksRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListRegistryWebhooks",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "events",
+                "description": "Events that trigger the webhook.\n* `MODEL_VERSION_CREATED`: A new model version was created for the associated model.\n\n* `MODEL_VERSION_TRANSITIONED_STAGE`: A model version’s stage was changed.\n\n* `TRANSITION_REQUEST_CREATED`: A user requested a model version’s stage be transitioned.\n\n* `COMMENT_CREATED`: A user wrote a comment on a registered model.\n\n* `REGISTERED_MODEL_CREATED`: A new registered model was created. This event type can only be specified for a registry-wide webhook, which can be created by not specifying a model name in the create request.\n\n* `MODEL_VERSION_TAG_SET`: A user set a tag on the model version.\n\n* `MODEL_VERSION_TRANSITIONED_TO_STAGING`: A model version was transitioned to staging.\n\n* `MODEL_VERSION_TRANSITIONED_TO_PRODUCTION`: A model version was transitioned to production.\n\n* `MODEL_VERSION_TRANSITIONED_TO_ARCHIVED`: A model version was archived.\n\n* `TRANSITION_REQUEST_TO_STAGING_CREATED`: A user requested a model version be transitioned to staging.\n\n* `TRANSITION_REQUEST_TO_PRODUCTION_CREATED`: A user requested a model version be transitioned to production.\n\n* `TRANSITION_REQUEST_TO_ARCHIVED_CREATED`: A user requested a model version be archived.\n\nIf `events` is specified, any webhook with one or more of the specified trigger events is included in the output.\nIf `events` is not specified, webhooks of all event types are included in the output.",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "RegistryWebhookEventList",
+                  "array_value": {
+                    "pascal_name": "RegistryWebhookEvent",
+                    "enum": [
+                      {
+                        "content": "COMMENT_CREATED"
+                      },
+                      {
+                        "content": "MODEL_VERSION_CREATED"
+                      },
+                      {
+                        "content": "MODEL_VERSION_TAG_SET"
+                      },
+                      {
+                        "content": "MODEL_VERSION_TRANSITIONED_STAGE"
+                      },
+                      {
+                        "content": "MODEL_VERSION_TRANSITIONED_TO_ARCHIVED"
+                      },
+                      {
+                        "content": "MODEL_VERSION_TRANSITIONED_TO_PRODUCTION"
+                      },
+                      {
+                        "content": "MODEL_VERSION_TRANSITIONED_TO_STAGING"
+                      },
+                      {
+                        "content": "REGISTERED_MODEL_CREATED"
+                      },
+                      {
+                        "content": "TRANSITION_REQUEST_CREATED"
+                      },
+                      {
+                        "content": "TRANSITION_REQUEST_TO_ARCHIVED_CREATED"
+                      },
+                      {
+                        "content": "TRANSITION_REQUEST_TO_PRODUCTION_CREATED"
+                      },
+                      {
+                        "content": "TRANSITION_REQUEST_TO_STAGING_CREATED"
+                      }
+                    ]
+                  }
+                }
+              },
+              {
+                "name": "max_results",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "model_name",
+                "description": "Registered model name\nIf not specified, all webhooks associated with the specified events are listed, regardless of their associated model.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Token indicating the page of artifact results to fetch",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Token indicating the page of artifact results to fetch",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "RejectTransitionRequest",
+            "description": "Rejects a model version stage transition request.",
+            "summary": "Reject a transition request.",
+            "path": "/api/2.0/mlflow/transition-requests/reject",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "RejectTransitionRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the model.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version",
+                  "description": "Version of the model.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "stage",
+                  "description": "Target stage of the transition. Valid values are:\n\n* `None`: The initial stage of a model version.\n\n* `Staging`: Staging or pre-production stage.\n\n* `Production`: Production stage.\n\n* `Archived`: Archived stage.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the model.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version",
+                  "description": "Version of the model.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "stage",
+                  "description": "Target stage of the transition. Valid values are:\n\n* `None`: The initial stage of a model version.\n\n* `Staging`: Staging or pre-production stage.\n\n* `Production`: Production stage.\n\n* `Archived`: Archived stage.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "RejectTransitionRequestResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "comment",
+                "description": "User-provided comment on the action.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the model.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "stage",
+                "description": "Target stage of the transition. Valid values are:\n\n* `None`: The initial stage of a model version.\n\n* `Staging`: Staging or pre-production stage.\n\n* `Production`: Production stage.\n\n* `Archived`: Archived stage.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version",
+                "description": "Version of the model.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the model.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version",
+                "description": "Version of the model.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "stage",
+                "description": "Target stage of the transition. Valid values are:\n\n* `None`: The initial stage of a model version.\n\n* `Staging`: Staging or pre-production stage.\n\n* `Production`: Production stage.\n\n* `Archived`: Archived stage.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "RenameModel",
+            "description": "Renames a registered model.",
+            "summary": "Rename a model.",
+            "path": "/api/2.0/mlflow/registered-models/rename",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "RenameModelRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Registered model unique name identifier.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Registered model unique name identifier.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "RenameModelResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Registered model unique name identifier.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "new_name",
+                "description": "If provided, updates the name for this `registered_model`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Registered model unique name identifier.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "SearchModelVersions",
+            "description": "Searches for specific model versions based on the supplied __filter__.",
+            "summary": "Search model versions.",
+            "path": "/api/2.0/mlflow/model-versions/search",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "SearchModelVersionsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "SearchModelVersionsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "filter",
+                "description": "String filter condition, like \"name='my-model-name'\". Must be a single boolean condition,\nwith string values wrapped in single quotes.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "max_results",
+                "description": "Maximum number of models desired. Max threshold is 10K.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "order_by",
+                "description": "List of columns to be ordered by including model name, version, stage with an\noptional \"DESC\" or \"ASC\" annotation, where \"ASC\" is the default.\nTiebreaks are done by latest stage transition timestamp, followed by name ASC, followed by\nversion DESC.",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Pagination token to go to next page based on previous search query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Pagination token to go to next page based on previous search query.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "SearchModels",
+            "description": "Search for registered models based on the specified __filter__.",
+            "summary": "Search models.",
+            "path": "/api/2.0/mlflow/registered-models/search",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "SearchModelsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "SearchModelsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "filter",
+                "description": "String filter condition, like \"name LIKE 'my-model-name'\".\nInterpreted in the backend automatically as \"name LIKE '%my-model-name%'\".\nSingle boolean condition, with string values wrapped in single quotes.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "max_results",
+                "description": "Maximum number of models desired. Default is 100. Max threshold is 1000.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "order_by",
+                "description": "List of columns for ordering search results, which can include model name and last updated\ntimestamp with an optional \"DESC\" or \"ASC\" annotation, where \"ASC\" is the default.\nTiebreaks are done by model name ASC.",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Pagination token to go to the next page based on a previous search query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Pagination token to go to the next page based on a previous search query.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "SetModelTag",
+            "description": "Sets a tag on a registered model.",
+            "summary": "Set a tag.",
+            "path": "/api/2.0/mlflow/registered-models/set-tag",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "SetModelTagRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Unique name of the model.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "key",
+                  "description": "Name of the tag. Maximum size depends on storage backend.\nIf a tag with this name already exists, its preexisting value will be replaced by the specified `value`.\nAll storage backends are guaranteed to support key values up to 250 bytes in size.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "value",
+                  "description": "String value of the tag being logged. Maximum size depends on storage backend.\nAll storage backends are guaranteed to support key values up to 5000 bytes in size.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Unique name of the model.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "key",
+                  "description": "Name of the tag. Maximum size depends on storage backend.\nIf a tag with this name already exists, its preexisting value will be replaced by the specified `value`.\nAll storage backends are guaranteed to support key values up to 250 bytes in size.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "value",
+                  "description": "String value of the tag being logged. Maximum size depends on storage backend.\nAll storage backends are guaranteed to support key values up to 5000 bytes in size.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "SetModelTagResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "key",
+                "description": "Name of the tag. Maximum size depends on storage backend.\nIf a tag with this name already exists, its preexisting value will be replaced by the specified `value`.\nAll storage backends are guaranteed to support key values up to 250 bytes in size.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Unique name of the model.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "value",
+                "description": "String value of the tag being logged. Maximum size depends on storage backend.\nAll storage backends are guaranteed to support key values up to 5000 bytes in size.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Unique name of the model.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "key",
+                "description": "Name of the tag. Maximum size depends on storage backend.\nIf a tag with this name already exists, its preexisting value will be replaced by the specified `value`.\nAll storage backends are guaranteed to support key values up to 250 bytes in size.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "value",
+                "description": "String value of the tag being logged. Maximum size depends on storage backend.\nAll storage backends are guaranteed to support key values up to 5000 bytes in size.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "SetModelVersionTag",
+            "description": "Sets a model version tag.",
+            "summary": "Set a version tag.",
+            "path": "/api/2.0/mlflow/model-versions/set-tag",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "SetModelVersionTagRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Unique name of the model.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version",
+                  "description": "Model version number.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "key",
+                  "description": "Name of the tag. Maximum size depends on storage backend.\nIf a tag with this name already exists, its preexisting value will be replaced by the specified `value`.\nAll storage backends are guaranteed to support key values up to 250 bytes in size.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "value",
+                  "description": "String value of the tag being logged. Maximum size depends on storage backend.\nAll storage backends are guaranteed to support key values up to 5000 bytes in size.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Unique name of the model.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version",
+                  "description": "Model version number.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "key",
+                  "description": "Name of the tag. Maximum size depends on storage backend.\nIf a tag with this name already exists, its preexisting value will be replaced by the specified `value`.\nAll storage backends are guaranteed to support key values up to 250 bytes in size.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "value",
+                  "description": "String value of the tag being logged. Maximum size depends on storage backend.\nAll storage backends are guaranteed to support key values up to 5000 bytes in size.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "SetModelVersionTagResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "key",
+                "description": "Name of the tag. Maximum size depends on storage backend.\nIf a tag with this name already exists, its preexisting value will be replaced by the specified `value`.\nAll storage backends are guaranteed to support key values up to 250 bytes in size.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Unique name of the model.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "value",
+                "description": "String value of the tag being logged. Maximum size depends on storage backend.\nAll storage backends are guaranteed to support key values up to 5000 bytes in size.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version",
+                "description": "Model version number.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Unique name of the model.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version",
+                "description": "Model version number.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "key",
+                "description": "Name of the tag. Maximum size depends on storage backend.\nIf a tag with this name already exists, its preexisting value will be replaced by the specified `value`.\nAll storage backends are guaranteed to support key values up to 250 bytes in size.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "value",
+                "description": "String value of the tag being logged. Maximum size depends on storage backend.\nAll storage backends are guaranteed to support key values up to 5000 bytes in size.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "SetPermissions",
+            "description": "Sets permissions on an object, replacing existing permissions if they exist. Deletes all direct permissions if none are specified. Objects can inherit permissions from their root object.",
+            "summary": "Set registered model permissions.",
+            "path": "/api/2.0/permissions/registered-models/{registered_model_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "RegisteredModelPermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "registered_model_id",
+                  "description": "The registered model for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "registered_model_id",
+                  "description": "The registered model for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "RegisteredModelPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "access_control_list",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "RegisteredModelAccessControlRequestList",
+                  "array_value": {
+                    "pascal_name": "RegisteredModelAccessControlRequest",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "registered_model_id",
+                "description": "The registered model for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "registered_model_id",
+                "description": "The registered model for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "TestRegistryWebhook",
+            "description": "**NOTE:** This endpoint is in Public Preview.\nTests a registry webhook.",
+            "summary": "Test a webhook.",
+            "path": "/api/2.0/mlflow/registry-webhooks/test",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "TestRegistryWebhookRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Webhook ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "id",
+                  "description": "Webhook ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "TestRegistryWebhookResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "event",
+                "description": "If `event` is specified, the test trigger uses the specified event. If `event` is not specified, the test trigger uses a randomly chosen event associated with the webhook.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "RegistryWebhookEvent",
+                  "enum": [
+                    {
+                      "content": "COMMENT_CREATED"
+                    },
+                    {
+                      "content": "MODEL_VERSION_CREATED"
+                    },
+                    {
+                      "content": "MODEL_VERSION_TAG_SET"
+                    },
+                    {
+                      "content": "MODEL_VERSION_TRANSITIONED_STAGE"
+                    },
+                    {
+                      "content": "MODEL_VERSION_TRANSITIONED_TO_ARCHIVED"
+                    },
+                    {
+                      "content": "MODEL_VERSION_TRANSITIONED_TO_PRODUCTION"
+                    },
+                    {
+                      "content": "MODEL_VERSION_TRANSITIONED_TO_STAGING"
+                    },
+                    {
+                      "content": "REGISTERED_MODEL_CREATED"
+                    },
+                    {
+                      "content": "TRANSITION_REQUEST_CREATED"
+                    },
+                    {
+                      "content": "TRANSITION_REQUEST_TO_ARCHIVED_CREATED"
+                    },
+                    {
+                      "content": "TRANSITION_REQUEST_TO_PRODUCTION_CREATED"
+                    },
+                    {
+                      "content": "TRANSITION_REQUEST_TO_STAGING_CREATED"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "id",
+                "description": "Webhook ID",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Webhook ID",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "TransitionStage",
+            "description": "Transition a model version's stage.\nThis is a Databricks workspace version of the [MLflow endpoint](https://www.mlflow.org/docs/latest/rest-api.html#transition-modelversion-stage)\nthat also accepts a comment associated with the transition to be recorded.",
+            "summary": "Transition a stage.",
+            "path": "/api/2.0/mlflow/databricks/model-versions/transition-stage",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "TransitionModelVersionStageDatabricks",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the model.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version",
+                  "description": "Version of the model.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "stage",
+                  "description": "Target stage of the transition. Valid values are:\n\n* `None`: The initial stage of a model version.\n\n* `Staging`: Staging or pre-production stage.\n\n* `Production`: Production stage.\n\n* `Archived`: Archived stage.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "archive_existing_versions",
+                  "description": "Specifies whether to archive all current model versions in the target stage.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the model.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version",
+                  "description": "Version of the model.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "stage",
+                  "description": "Target stage of the transition. Valid values are:\n\n* `None`: The initial stage of a model version.\n\n* `Staging`: Staging or pre-production stage.\n\n* `Production`: Production stage.\n\n* `Archived`: Archived stage.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "archive_existing_versions",
+                  "description": "Specifies whether to archive all current model versions in the target stage.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "TransitionStageResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "archive_existing_versions",
+                "description": "Specifies whether to archive all current model versions in the target stage.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "comment",
+                "description": "User-provided comment on the action.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the model.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "stage",
+                "description": "Target stage of the transition. Valid values are:\n\n* `None`: The initial stage of a model version.\n\n* `Staging`: Staging or pre-production stage.\n\n* `Production`: Production stage.\n\n* `Archived`: Archived stage.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version",
+                "description": "Version of the model.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the model.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version",
+                "description": "Version of the model.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "stage",
+                "description": "Target stage of the transition. Valid values are:\n\n* `None`: The initial stage of a model version.\n\n* `Staging`: Staging or pre-production stage.\n\n* `Production`: Production stage.\n\n* `Archived`: Archived stage.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "archive_existing_versions",
+                "description": "Specifies whether to archive all current model versions in the target stage.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateComment",
+            "description": "Post an edit to a comment on a model version.",
+            "summary": "Update a comment.",
+            "path": "/api/2.0/mlflow/comments/update",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateComment",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique identifier of an activity",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "comment",
+                  "description": "User-provided comment on the action.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique identifier of an activity",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "comment",
+                  "description": "User-provided comment on the action.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "UpdateCommentResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "comment",
+                "description": "User-provided comment on the action.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "id",
+                "description": "Unique identifier of an activity",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Unique identifier of an activity",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "comment",
+                "description": "User-provided comment on the action.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateModel",
+            "description": "Updates a registered model.",
+            "summary": "Update model.",
+            "path": "/api/2.0/mlflow/registered-models/update",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateModelRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Registered model unique name identifier.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Registered model unique name identifier.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "UpdateModelResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "description",
+                "description": "If provided, updates the description for this `registered_model`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Registered model unique name identifier.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Registered model unique name identifier.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateModelVersion",
+            "description": "Updates the model version.",
+            "summary": "Update model version.",
+            "path": "/api/2.0/mlflow/model-versions/update",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateModelVersionRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the registered model",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version",
+                  "description": "Model version number",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the registered model",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version",
+                  "description": "Model version number",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "UpdateModelVersionResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "description",
+                "description": "If provided, updates the description for this `registered_model`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the registered model",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version",
+                "description": "Model version number",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the registered model",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version",
+                "description": "Model version number",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdatePermissions",
+            "description": "Updates the permissions on a registered model. Registered models can inherit permissions from their root object.",
+            "summary": "Update registered model permissions.",
+            "path": "/api/2.0/permissions/registered-models/{registered_model_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "RegisteredModelPermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "registered_model_id",
+                  "description": "The registered model for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "registered_model_id",
+                  "description": "The registered model for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "RegisteredModelPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "access_control_list",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "RegisteredModelAccessControlRequestList",
+                  "array_value": {
+                    "pascal_name": "RegisteredModelAccessControlRequest",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "registered_model_id",
+                "description": "The registered model for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "registered_model_id",
+                "description": "The registered model for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateWebhook",
+            "description": "**NOTE:** This endpoint is in Public Preview.\nUpdates a registry webhook.",
+            "summary": "Update a webhook.",
+            "path": "/api/2.0/mlflow/registry-webhooks/update",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateRegistryWebhook",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Webhook ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "id",
+                  "description": "Webhook ID",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "UpdateWebhookResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "description",
+                "description": "User-specified description for the webhook.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "events",
+                "description": "Events that can trigger a registry webhook:\n* `MODEL_VERSION_CREATED`: A new model version was created for the associated model.\n\n* `MODEL_VERSION_TRANSITIONED_STAGE`: A model version’s stage was changed.\n\n* `TRANSITION_REQUEST_CREATED`: A user requested a model version’s stage be transitioned.\n\n* `COMMENT_CREATED`: A user wrote a comment on a registered model.\n\n* `REGISTERED_MODEL_CREATED`: A new registered model was created. This event type can only be specified for a registry-wide webhook, which can be created by not specifying a model name in the create request.\n\n* `MODEL_VERSION_TAG_SET`: A user set a tag on the model version.\n\n* `MODEL_VERSION_TRANSITIONED_TO_STAGING`: A model version was transitioned to staging.\n\n* `MODEL_VERSION_TRANSITIONED_TO_PRODUCTION`: A model version was transitioned to production.\n\n* `MODEL_VERSION_TRANSITIONED_TO_ARCHIVED`: A model version was archived.\n\n* `TRANSITION_REQUEST_TO_STAGING_CREATED`: A user requested a model version be transitioned to staging.\n\n* `TRANSITION_REQUEST_TO_PRODUCTION_CREATED`: A user requested a model version be transitioned to production.\n\n* `TRANSITION_REQUEST_TO_ARCHIVED_CREATED`: A user requested a model version be archived.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "RegistryWebhookEventList",
+                  "array_value": {
+                    "pascal_name": "RegistryWebhookEvent",
+                    "enum": [
+                      {
+                        "content": "COMMENT_CREATED"
+                      },
+                      {
+                        "content": "MODEL_VERSION_CREATED"
+                      },
+                      {
+                        "content": "MODEL_VERSION_TAG_SET"
+                      },
+                      {
+                        "content": "MODEL_VERSION_TRANSITIONED_STAGE"
+                      },
+                      {
+                        "content": "MODEL_VERSION_TRANSITIONED_TO_ARCHIVED"
+                      },
+                      {
+                        "content": "MODEL_VERSION_TRANSITIONED_TO_PRODUCTION"
+                      },
+                      {
+                        "content": "MODEL_VERSION_TRANSITIONED_TO_STAGING"
+                      },
+                      {
+                        "content": "REGISTERED_MODEL_CREATED"
+                      },
+                      {
+                        "content": "TRANSITION_REQUEST_CREATED"
+                      },
+                      {
+                        "content": "TRANSITION_REQUEST_TO_ARCHIVED_CREATED"
+                      },
+                      {
+                        "content": "TRANSITION_REQUEST_TO_PRODUCTION_CREATED"
+                      },
+                      {
+                        "content": "TRANSITION_REQUEST_TO_STAGING_CREATED"
+                      }
+                    ]
+                  }
+                }
+              },
+              {
+                "name": "http_url_spec",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "HttpUrlSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "id",
+                "description": "Webhook ID",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "job_spec",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "JobSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "status",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "RegistryWebhookStatus",
+                  "enum": [
+                    {
+                      "content": "ACTIVE"
+                    },
+                    {
+                      "content": "DISABLED"
+                    },
+                    {
+                      "content": "TEST_MODE"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Webhook ID",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "catalog.ModelVersions",
+        "name": "ModelVersions",
+        "description": "Databricks provides a hosted version of MLflow Model Registry in Unity Catalog.\nModels in Unity Catalog provide centralized access control, auditing, lineage, and discovery of\nML models across Databricks workspaces.\n\nThis API reference documents the REST endpoints for managing model versions in Unity Catalog. For\nmore details, see the [registered models API docs](/api/workspace/registeredmodels).",
+        "package": {
+          "name": "catalog"
+        },
+        "docs_group": "catalog",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListModelVersionsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Delete",
+            "description": "Deletes a model version from the specified registered model. Any aliases assigned to the\nmodel version will also be deleted.\n\nThe caller must be a metastore admin or an owner of the parent registered model.\nFor the latter case, the caller must also be the owner or have the **USE_CATALOG**\nprivilege on the parent catalog and the **USE_SCHEMA** privilege on the parent schema.",
+            "summary": "Delete a Model Version.",
+            "path": "/api/2.1/unity-catalog/models/{full_name}/versions/{version}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteModelVersionRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "full_name",
+                  "description": "The three-level (fully qualified) name of the model version",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version",
+                  "description": "The integer version number of the model version",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "full_name",
+                  "description": "The three-level (fully qualified) name of the model version",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version",
+                  "description": "The integer version number of the model version",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "full_name",
+                "description": "The three-level (fully qualified) name of the model version",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version",
+                "description": "The integer version number of the model version",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "full_name",
+                "description": "The three-level (fully qualified) name of the model version",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version",
+                "description": "The integer version number of the model version",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Get a model version.\n\nThe caller must be a metastore admin or an owner of (or have the **EXECUTE**\nprivilege on) the parent registered model. For the latter case, the caller must also be the owner\nor have the **USE_CATALOG** privilege on the parent catalog and the **USE_SCHEMA** privilege\non the parent schema.",
+            "summary": "Get a Model Version.",
+            "path": "/api/2.1/unity-catalog/models/{full_name}/versions/{version}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetModelVersionRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "full_name",
+                  "description": "The three-level (fully qualified) name of the model version",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version",
+                  "description": "The integer version number of the model version",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "full_name",
+                  "description": "The three-level (fully qualified) name of the model version",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version",
+                  "description": "The integer version number of the model version",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ModelVersionInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "full_name",
+                "description": "The three-level (fully qualified) name of the model version",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "include_aliases",
+                "description": "Whether to include aliases associated with the model version in the response",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "include_browse",
+                "description": "Whether to include model versions in the response for which the principal can only access selective metadata for",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "version",
+                "description": "The integer version number of the model version",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "full_name",
+                "description": "The three-level (fully qualified) name of the model version",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version",
+                "description": "The integer version number of the model version",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetByAlias",
+            "description": "Get a model version by alias.\n\nThe caller must be a metastore admin or an owner of (or have the **EXECUTE**\nprivilege on) the registered model. For the latter case, the caller must also be the owner\nor have the **USE_CATALOG** privilege on the parent catalog and the **USE_SCHEMA** privilege\non the parent schema.",
+            "summary": "Get Model Version By Alias.",
+            "path": "/api/2.1/unity-catalog/models/{full_name}/aliases/{alias}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetByAliasRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "full_name",
+                  "description": "The three-level (fully qualified) name of the registered model",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "alias",
+                  "description": "The name of the alias",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "full_name",
+                  "description": "The three-level (fully qualified) name of the registered model",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "alias",
+                  "description": "The name of the alias",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ModelVersionInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "alias",
+                "description": "The name of the alias",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "full_name",
+                "description": "The three-level (fully qualified) name of the registered model",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "include_aliases",
+                "description": "Whether to include aliases associated with the model version in the response",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "full_name",
+                "description": "The three-level (fully qualified) name of the registered model",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "alias",
+                "description": "The name of the alias",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "List the model versions of the specified registered model, identified by its\nfull three-level name (catalog.schema.model).\n\nThe returned models are filtered based on the privileges of the calling user.\nFor example, the metastore admin is able to list all the model versions.\nA regular user needs to be the owner or have the **EXECUTE** privilege\non the parent registered model to receive the model versions in the response.\nFor the latter case, the caller must also be the owner or have the **USE_CATALOG**\nprivilege on the parent catalog and the **USE_SCHEMA** privilege on the parent schema.\n\nThere is no guarantee of a specific ordering of the elements in the response. The\nelements in the response will not contain any aliases or tags.\n\nPAGINATION BEHAVIOR: The API is by default paginated, a page may contain zero results while still providing a next_page_token.\nClients must continue reading pages until next_page_token is absent, which is the only indication that the end of results has been reached.",
+            "summary": "List Model Versions.",
+            "path": "/api/2.1/unity-catalog/models/{full_name}/versions",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListModelVersionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "full_name",
+                  "description": "The full three-level name of the registered model under which to list model versions",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "full_name",
+                  "description": "The full three-level name of the registered model under which to list model versions",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListModelVersionsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "full_name",
+                "description": "The full three-level name of the registered model under which to list model versions",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "include_browse",
+                "description": "Whether to include model versions in the response for which the principal can only access selective metadata for",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "max_results",
+                "description": "Maximum number of model versions to return.\nIf not set, the page length is set to a server configured value (100, as of 1/3/2024).\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value(1000, as of 1/3/2024);\n- when set to 0, the page length is set to a server configured value (100, as of 1/3/2024) (recommended);\n- when set to a value less than 0, an invalid parameter error is returned;",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque pagination token to go to next page based on previous query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "full_name",
+                "description": "The full three-level name of the registered model under which to list model versions",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Opaque pagination token to go to next page based on previous query.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "Update",
+            "description": "Updates the specified model version.\n\nThe caller must be a metastore admin or an owner of the parent registered model.\nFor the latter case, the caller must also be the owner or have the **USE_CATALOG**\nprivilege on the parent catalog and the **USE_SCHEMA** privilege on the parent schema.\n\nCurrently only the comment of the model version can be updated.",
+            "summary": "Update a Model Version.",
+            "path": "/api/2.1/unity-catalog/models/{full_name}/versions/{version}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateModelVersionRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "full_name",
+                  "description": "The three-level (fully qualified) name of the model version",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version",
+                  "description": "The integer version number of the model version",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "full_name",
+                  "description": "The three-level (fully qualified) name of the model version",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version",
+                  "description": "The integer version number of the model version",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ModelVersionInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "aliases",
+                "description": "List of aliases associated with the model version",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "RegisteredModelAliasList",
+                  "array_value": {
+                    "pascal_name": "RegisteredModelAlias",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "catalog_name",
+                "description": "The name of the catalog containing the model version",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "comment",
+                "description": "The comment attached to the model version",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "created_at",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "created_by",
+                "description": "The identifier of the user who created the model version",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "full_name",
+                "description": "The three-level (fully qualified) name of the model version",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "id",
+                "description": "The unique identifier of the model version",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "metastore_id",
+                "description": "The unique identifier of the metastore containing the model version",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "model_name",
+                "description": "The name of the parent registered model of the model version, relative to parent schema",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "model_version_dependencies",
+                "description": "Model version dependencies, for feature-store packaged models",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "DependencyList",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "run_id",
+                "description": "MLflow run ID used when creating the model version, if ``source`` was generated by an\nexperiment run stored in an MLflow tracking server",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "run_workspace_id",
+                "description": "ID of the Databricks workspace containing the MLflow run that generated this model\nversion, if applicable",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "schema_name",
+                "description": "The name of the schema containing the model version, relative to parent catalog",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "source",
+                "description": "URI indicating the location of the source artifacts (files) for the model version",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "status",
+                "description": "Current status of the model version. Newly created model versions start in\nPENDING_REGISTRATION status, then move to READY status once the model version files are uploaded and\nthe model version is finalized. Only model versions in READY status can be loaded for inference or\nserved.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ModelVersionInfoStatus",
+                  "enum": [
+                    {
+                      "content": "FAILED_REGISTRATION"
+                    },
+                    {
+                      "content": "MODEL_VERSION_STATUS_UNKNOWN"
+                    },
+                    {
+                      "content": "PENDING_REGISTRATION"
+                    },
+                    {
+                      "content": "READY"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "storage_location",
+                "description": "The storage location on the cloud under which model version data files are stored",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "updated_at",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "updated_by",
+                "description": "The identifier of the user who updated the model version last time",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version",
+                "description": "The integer version number of the model version",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "full_name",
+                "description": "The three-level (fully qualified) name of the model version",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version",
+                "description": "The integer version number of the model version",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "settings.NetworkConnectivity",
+        "name": "NetworkConnectivity",
+        "description": "These APIs provide configurations for the network connectivity of your workspaces for serverless compute resources. This API provides stable subnets for your workspace so that you can configure your firewalls on your Azure Storage accounts to allow access from Databricks. You can also use the API to provision private endpoints for Databricks to privately connect serverless compute resources to your Azure resources using Azure Private Link. See [configure serverless secure connectivity](https://learn.microsoft.com/azure/databricks/security/network/serverless-network-security).",
+        "package": {
+          "name": "settings"
+        },
+        "is_accounts": true,
+        "docs_group": "settings",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "methods": [
+          {
+            "name": "CreateNetworkConnectivityConfiguration",
+            "description": "Creates a network connectivity configuration (NCC), which provides stable Azure service\nsubnets when accessing your Azure Storage accounts. You can also use a network connectivity configuration to create\nDatabricks managed private endpoints so that Databricks serverless compute resources privately access your\nresources.\n\n**IMPORTANT**: After you create the network connectivity configuration, you must assign one or more workspaces to the new network connectivity configuration.\nYou can share one network connectivity configuration with multiple workspaces from the same Azure region within\nthe same Databricks account.\nSee [configure serverless secure connectivity](https://learn.microsoft.com/azure/databricks/security/network/serverless-network-security).",
+            "summary": "Create a network connectivity configuration.",
+            "path": "/api/2.0/accounts/{account_id}/network-connectivity-configs",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateNetworkConnectivityConfigRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "network_connectivity_config",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CreateNetworkConnectivityConfiguration",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "network_connectivity_config",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CreateNetworkConnectivityConfiguration",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "network_connectivity_config",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "CreateNetworkConnectivityConfiguration",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "name",
+                    "description": "The name of the network connectivity configuration. The name can contain alphanumeric characters, hyphens,\nand underscores. The length must be between 3 and 30 characters. The name must match the regular\nexpression ^[0-9a-zA-Z-_]{3,30}$",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "region",
+                    "description": "The region for the network connectivity configuration.\nOnly workspaces in the same region can be attached to the network connectivity configuration.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "name",
+                    "description": "The name of the network connectivity configuration. The name can contain alphanumeric characters, hyphens,\nand underscores. The length must be between 3 and 30 characters. The name must match the regular\nexpression ^[0-9a-zA-Z-_]{3,30}$",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "region",
+                    "description": "The region for the network connectivity configuration.\nOnly workspaces in the same region can be attached to the network connectivity configuration.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "NetworkConnectivityConfiguration",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "network_connectivity_config",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CreateNetworkConnectivityConfiguration",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "name",
+                      "description": "The name of the network connectivity configuration. The name can contain alphanumeric characters, hyphens,\nand underscores. The length must be between 3 and 30 characters. The name must match the regular\nexpression ^[0-9a-zA-Z-_]{3,30}$",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "region",
+                      "description": "The region for the network connectivity configuration.\nOnly workspaces in the same region can be attached to the network connectivity configuration.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "name",
+                      "description": "The name of the network connectivity configuration. The name can contain alphanumeric characters, hyphens,\nand underscores. The length must be between 3 and 30 characters. The name must match the regular\nexpression ^[0-9a-zA-Z-_]{3,30}$",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "region",
+                      "description": "The region for the network connectivity configuration.\nOnly workspaces in the same region can be attached to the network connectivity configuration.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the network connectivity configuration. The name can contain alphanumeric characters, hyphens,\nand underscores. The length must be between 3 and 30 characters. The name must match the regular\nexpression ^[0-9a-zA-Z-_]{3,30}$",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "region",
+                "description": "The region for the network connectivity configuration.\nOnly workspaces in the same region can be attached to the network connectivity configuration.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the network connectivity configuration. The name can contain alphanumeric characters, hyphens,\nand underscores. The length must be between 3 and 30 characters. The name must match the regular\nexpression ^[0-9a-zA-Z-_]{3,30}$",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "region",
+                "description": "The region for the network connectivity configuration.\nOnly workspaces in the same region can be attached to the network connectivity configuration.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreatePrivateEndpointRule",
+            "description": "Create a private endpoint rule for the specified network connectivity config object.\nOnce the object is created, Databricks asynchronously provisions a new Azure private endpoint to your\nspecified Azure resource.\n\n**IMPORTANT**: You must use Azure portal or other Azure tools to approve the private endpoint to complete the\nconnection. To get the information of the private endpoint created, make a `GET` request on the new private\nendpoint rule. See [serverless private link](https://learn.microsoft.com/azure/databricks/security/network/serverless-network-security/serverless-private-link).",
+            "summary": "Create a private endpoint rule.",
+            "path": "/api/2.0/accounts/{account_id}/network-connectivity-configs/{network_connectivity_config_id}/private-endpoint-rules",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreatePrivateEndpointRuleRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "network_connectivity_config_id",
+                  "description": "Your Network Connectivity Configuration ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "private_endpoint_rule",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CreatePrivateEndpointRule",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "network_connectivity_config_id",
+                  "description": "Your Network Connectivity Configuration ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "private_endpoint_rule",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CreatePrivateEndpointRule",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "private_endpoint_rule",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "CreatePrivateEndpointRule",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "NccPrivateEndpointRule",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "network_connectivity_config_id",
+                "description": "Your Network Connectivity Configuration ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "private_endpoint_rule",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CreatePrivateEndpointRule",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "domain_names",
+                "description": "Only used by private endpoints to customer-managed private endpoint services.\n\nDomain names of target private link service.\nWhen updating this field, the full list of target domain_names must be specified.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "endpoint_service",
+                "description": "The full target AWS endpoint service name that connects to the destination resources of the private endpoint.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "error_message",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "gcp_endpoint",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "GcpEndpoint",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "group_id",
+                "description": "Not used by customer-managed private endpoint services.\n\nThe sub-resource type (group ID) of the target resource.\nNote that to connect to workspace root storage (root DBFS), you need two endpoints, one for blob and one for dfs.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "resource_id",
+                "description": "The Azure resource ID of the target resource.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "resource_names",
+                "description": "Only used by private endpoints towards AWS S3 service.\n\nThe globally unique S3 bucket names that will be accessed via the VPC endpoint.\nThe bucket names must be in the same region as the NCC/endpoint service.\nWhen updating this field, we perform full update on this field. Please ensure a full list of desired\nresource_names is provided.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "network_connectivity_config_id",
+                "description": "Your Network Connectivity Configuration ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteNetworkConnectivityConfiguration",
+            "description": "Deletes a network connectivity configuration.",
+            "summary": "Delete a network connectivity configuration.",
+            "path": "/api/2.0/accounts/{account_id}/network-connectivity-configs/{network_connectivity_config_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteNetworkConnectivityConfigurationRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "network_connectivity_config_id",
+                  "description": "Your Network Connectivity Configuration ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "network_connectivity_config_id",
+                  "description": "Your Network Connectivity Configuration ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "network_connectivity_config_id",
+                "description": "Your Network Connectivity Configuration ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "network_connectivity_config_id",
+                "description": "Your Network Connectivity Configuration ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeletePrivateEndpointRule",
+            "description": "Initiates deleting a private endpoint rule. If the connection state is PENDING or EXPIRED,\nthe private endpoint is immediately deleted. Otherwise, the private endpoint is deactivated\nand will be deleted after one day of deactivation. When a private endpoint is deactivated,\nthe `deactivated` field is set to `true` and the private endpoint is not\navailable to your serverless compute resources.",
+            "summary": "Delete a private endpoint rule.",
+            "path": "/api/2.0/accounts/{account_id}/network-connectivity-configs/{network_connectivity_config_id}/private-endpoint-rules/{private_endpoint_rule_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeletePrivateEndpointRuleRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "network_connectivity_config_id",
+                  "description": "Your Network Connectvity Configuration ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "private_endpoint_rule_id",
+                  "description": "Your private endpoint rule ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "network_connectivity_config_id",
+                  "description": "Your Network Connectvity Configuration ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "private_endpoint_rule_id",
+                  "description": "Your private endpoint rule ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "NccPrivateEndpointRule",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "network_connectivity_config_id",
+                "description": "Your Network Connectvity Configuration ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "private_endpoint_rule_id",
+                "description": "Your private endpoint rule ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "network_connectivity_config_id",
+                "description": "Your Network Connectvity Configuration ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "private_endpoint_rule_id",
+                "description": "Your private endpoint rule ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetNetworkConnectivityConfiguration",
+            "description": "Gets a network connectivity configuration.",
+            "summary": "Get a network connectivity configuration.",
+            "path": "/api/2.0/accounts/{account_id}/network-connectivity-configs/{network_connectivity_config_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetNetworkConnectivityConfigurationRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "network_connectivity_config_id",
+                  "description": "Your Network Connectivity Configuration ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "network_connectivity_config_id",
+                  "description": "Your Network Connectivity Configuration ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "NetworkConnectivityConfiguration",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "network_connectivity_config_id",
+                "description": "Your Network Connectivity Configuration ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "network_connectivity_config_id",
+                "description": "Your Network Connectivity Configuration ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetPrivateEndpointRule",
+            "description": "Gets the private endpoint rule.",
+            "summary": "Gets a private endpoint rule.",
+            "path": "/api/2.0/accounts/{account_id}/network-connectivity-configs/{network_connectivity_config_id}/private-endpoint-rules/{private_endpoint_rule_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetPrivateEndpointRuleRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "network_connectivity_config_id",
+                  "description": "Your Network Connectvity Configuration ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "private_endpoint_rule_id",
+                  "description": "Your private endpoint rule ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "network_connectivity_config_id",
+                  "description": "Your Network Connectvity Configuration ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "private_endpoint_rule_id",
+                  "description": "Your private endpoint rule ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "NccPrivateEndpointRule",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "network_connectivity_config_id",
+                "description": "Your Network Connectvity Configuration ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "private_endpoint_rule_id",
+                "description": "Your private endpoint rule ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "network_connectivity_config_id",
+                "description": "Your Network Connectvity Configuration ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "private_endpoint_rule_id",
+                "description": "Your private endpoint rule ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListNetworkConnectivityConfigurations",
+            "description": "Gets an array of network connectivity configurations.",
+            "summary": "List network connectivity configurations.",
+            "path": "/api/2.0/accounts/{account_id}/network-connectivity-configs",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListNetworkConnectivityConfigurationsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListNetworkConnectivityConfigurationsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_token",
+                "description": "Pagination token to go to next page based on previous query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Pagination token to go to next page based on previous query.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListPrivateEndpointRules",
+            "description": "Gets an array of private endpoint rules.",
+            "summary": "List private endpoint rules.",
+            "path": "/api/2.0/accounts/{account_id}/network-connectivity-configs/{network_connectivity_config_id}/private-endpoint-rules",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListPrivateEndpointRulesRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "network_connectivity_config_id",
+                  "description": "Your Network Connectvity Configuration ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "network_connectivity_config_id",
+                  "description": "Your Network Connectvity Configuration ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListPrivateEndpointRulesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "network_connectivity_config_id",
+                "description": "Your Network Connectvity Configuration ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Pagination token to go to next page based on previous query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "network_connectivity_config_id",
+                "description": "Your Network Connectvity Configuration ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Pagination token to go to next page based on previous query.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "UpdatePrivateEndpointRule",
+            "description": "Updates a private endpoint rule. Currently only a private endpoint rule to customer-managed resources is allowed to be updated.",
+            "summary": "Update a private endpoint rule.",
+            "path": "/api/2.0/accounts/{account_id}/network-connectivity-configs/{network_connectivity_config_id}/private-endpoint-rules/{private_endpoint_rule_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateNccPrivateEndpointRuleRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "network_connectivity_config_id",
+                  "description": "The ID of a network connectivity configuration, which is the parent resource of this private endpoint rule object.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "private_endpoint_rule_id",
+                  "description": "Your private endpoint rule ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "private_endpoint_rule",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "UpdatePrivateEndpointRule",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "network_connectivity_config_id",
+                  "description": "The ID of a network connectivity configuration, which is the parent resource of this private endpoint rule object.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "private_endpoint_rule_id",
+                  "description": "Your private endpoint rule ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "private_endpoint_rule",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "UpdatePrivateEndpointRule",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "private_endpoint_rule",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "UpdatePrivateEndpointRule",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "NccPrivateEndpointRule",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "network_connectivity_config_id",
+                "description": "The ID of a network connectivity configuration, which is the parent resource of this private endpoint rule object.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "private_endpoint_rule",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "UpdatePrivateEndpointRule",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "private_endpoint_rule_id",
+                "description": "Your private endpoint rule ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "domain_names",
+                "description": "Only used by private endpoints to customer-managed private endpoint services.\n\nDomain names of target private link service.\nWhen updating this field, the full list of target domain_names must be specified.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "enabled",
+                "description": "Update this field to activate/deactivate this private endpoint to allow egress access from\nserverless compute resources. Only honored for first-party services on each cloud (e.g. AWS S3).",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "error_message",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "gcp_endpoint",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "GcpEndpoint",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "resource_names",
+                "description": "Only used by private endpoints towards AWS S3 service.\n\nThe globally unique S3 bucket names that will be accessed via the VPC endpoint.\nThe bucket names must be in the same region as the NCC/endpoint service.\nWhen updating this field, we perform full update on this field. Please ensure a full list of desired\nresource_names is provided.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "network_connectivity_config_id",
+                "description": "The ID of a network connectivity configuration, which is the parent resource of this private endpoint rule object.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "private_endpoint_rule_id",
+                "description": "Your private endpoint rule ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "settings.NetworkPolicies",
+        "name": "NetworkPolicies",
+        "description": "These APIs manage network policies for this account. Network policies control which network destinations can be accessed from the Databricks environment. Each Databricks account includes a default policy named 'default-policy'. 'default-policy' is associated with any workspace lacking an explicit network policy assignment, and is automatically associated with each newly created workspace. 'default-policy' is reserved and cannot be deleted, but it can be updated to customize the default network access rules for your account.",
+        "package": {
+          "name": "settings"
+        },
+        "is_accounts": true,
+        "docs_group": "settings",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "methods": [
+          {
+            "name": "CreateNetworkPolicyRpc",
+            "description": "Creates a new network policy to manage which network destinations can be accessed from the Databricks\nenvironment.",
+            "summary": "Create a network policy.",
+            "path": "/api/2.0/accounts/{account_id}/network-policies",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateNetworkPolicyRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "network_policy",
+                  "description": "Network policy configuration details.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AccountNetworkPolicy",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "network_policy",
+                  "description": "Network policy configuration details.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AccountNetworkPolicy",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "network_policy",
+              "description": "Network policy configuration details.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "AccountNetworkPolicy",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "AccountNetworkPolicy",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "network_policy",
+                "description": "Network policy configuration details.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AccountNetworkPolicy",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "account_id",
+                "description": "The associated account ID for this Network Policy object.",
+                "is_computed": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "egress",
+                "description": "The network policies applying for egress traffic.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "NetworkPolicyEgress",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "ingress",
+                "description": "The network policies applying for ingress traffic.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CustomerFacingIngressNetworkPolicy",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "ingress_dry_run",
+                "description": "The ingress policy for dry run mode. Dry run will always run even if the request\nis allowed by the ingress policy. When this field is set, the policy will be evaluated\nand emit logs only without blocking requests.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CustomerFacingIngressNetworkPolicy",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "network_policy_id",
+                "description": "The unique identifier for the network policy.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteNetworkPolicyRpc",
+            "description": "Deletes a network policy. Cannot be called on 'default-policy'.",
+            "summary": "Delete a network policy.",
+            "path": "/api/2.0/accounts/{account_id}/network-policies/{network_policy_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteNetworkPolicyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "network_policy_id",
+                  "description": "The unique identifier of the network policy to delete.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "network_policy_id",
+                  "description": "The unique identifier of the network policy to delete.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "network_policy_id",
+                "description": "The unique identifier of the network policy to delete.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "network_policy_id",
+                "description": "The unique identifier of the network policy to delete.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetNetworkPolicyRpc",
+            "description": "Gets a network policy.",
+            "summary": "Get a network policy.",
+            "path": "/api/2.0/accounts/{account_id}/network-policies/{network_policy_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetNetworkPolicyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "network_policy_id",
+                  "description": "The unique identifier of the network policy to retrieve.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "network_policy_id",
+                  "description": "The unique identifier of the network policy to retrieve.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "AccountNetworkPolicy",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "network_policy_id",
+                "description": "The unique identifier of the network policy to retrieve.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "network_policy_id",
+                "description": "The unique identifier of the network policy to retrieve.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListNetworkPoliciesRpc",
+            "description": "Gets an array of network policies.",
+            "summary": "List network policies.",
+            "path": "/api/2.0/accounts/{account_id}/network-policies",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListNetworkPoliciesRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListNetworkPoliciesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_token",
+                "description": "Pagination token to go to next page based on previous query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Pagination token to go to next page based on previous query.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "UpdateNetworkPolicyRpc",
+            "description": "Updates a network policy. This allows you to modify the configuration of a network policy.",
+            "summary": "Update a network policy.",
+            "path": "/api/2.0/accounts/{account_id}/network-policies/{network_policy_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateNetworkPolicyRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "network_policy_id",
+                  "description": "The unique identifier for the network policy.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "network_policy",
+                  "description": "Updated network policy configuration details.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AccountNetworkPolicy",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "network_policy_id",
+                  "description": "The unique identifier for the network policy.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "network_policy",
+                  "description": "Updated network policy configuration details.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AccountNetworkPolicy",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "network_policy",
+              "description": "Updated network policy configuration details.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "AccountNetworkPolicy",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "AccountNetworkPolicy",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "network_policy",
+                "description": "Updated network policy configuration details.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AccountNetworkPolicy",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "network_policy_id",
+                "description": "The unique identifier for the network policy.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "account_id",
+                "description": "The associated account ID for this Network Policy object.",
+                "is_computed": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "egress",
+                "description": "The network policies applying for egress traffic.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "NetworkPolicyEgress",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "ingress",
+                "description": "The network policies applying for ingress traffic.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CustomerFacingIngressNetworkPolicy",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "ingress_dry_run",
+                "description": "The ingress policy for dry run mode. Dry run will always run even if the request\nis allowed by the ingress policy. When this field is set, the policy will be evaluated\nand emit logs only without blocking requests.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CustomerFacingIngressNetworkPolicy",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "network_policy_id",
+                "description": "The unique identifier for the network policy.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "network_policy_id",
+                "description": "The unique identifier for the network policy.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "provisioning.Networks",
+        "name": "Networks",
+        "description": "These APIs manage network configurations for customer-managed VPCs (optional). Its ID is\nused when creating a new workspace if you use customer-managed VPCs.",
+        "package": {
+          "name": "provisioning"
+        },
+        "is_accounts": true,
+        "docs_group": "provisioning",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a Databricks network configuration that represents an VPC and its resources. The VPC will be used for new Databricks clusters. This requires a pre-existing VPC and subnets.",
+            "summary": "Create network configuration.",
+            "path": "/api/2.0/accounts/{account_id}/networks",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateNetworkRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "Network",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "gcp_network_info",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "GcpNetworkInfo",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "network_name",
+                "description": "The human-readable name of the network configuration.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "security_group_ids",
+                "description": "IDs of one to five security groups associated with this network. Security group IDs **cannot** be used in multiple network configurations.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "subnet_ids",
+                "description": "IDs of at least two subnets associated with this network. Subnet IDs **cannot** be used in multiple network configurations.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "vpc_endpoints",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "NetworkVpcEndpoints",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "vpc_id",
+                "description": "The ID of the VPC associated with this network configuration. VPC IDs can be used in multiple networks.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes a Databricks network configuration, which represents a cloud VPC and its resources. You cannot delete a network that is associated with a workspace.\n\nThis operation is available only if your account is on the E2 version of the platform.",
+            "summary": "Delete a network configuration.",
+            "path": "/api/2.0/accounts/{account_id}/networks/{network_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteNetworkRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "network_id",
+                  "description": "Databricks Account API network configuration ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "network_id",
+                  "description": "Databricks Account API network configuration ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Network",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "network_id",
+                "description": "Databricks Account API network configuration ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "network_id",
+                "description": "Databricks Account API network configuration ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets a Databricks network configuration, which represents a cloud VPC and its resources.",
+            "summary": "Get a network configuration.",
+            "path": "/api/2.0/accounts/{account_id}/networks/{network_id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetNetworkRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "network_id",
+                  "description": "Databricks Account API network configuration ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "network_id",
+                  "description": "Databricks Account API network configuration ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Network",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "network_id",
+                "description": "Databricks Account API network configuration ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "network_id",
+                "description": "Databricks Account API network configuration ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Lists Databricks network configurations for an account.",
+            "summary": "List network configurations.",
+            "path": "/api/2.0/accounts/{account_id}/networks",
+            "is_legacy_empty_request": true,
+            "is_crud_read": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListNetworksRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "NetworkList",
+              "array_value": {
+                "pascal_name": "Network",
+                "is_object": true
+              }
+            }
+          }
+        ]
+      },
+      {
+        "id": "settings.NotificationDestinations",
+        "name": "NotificationDestinations",
+        "description": "The notification destinations API lets you programmatically manage a workspace's notification destinations.\nNotification destinations are used to send notifications for query alerts and jobs to destinations outside of Databricks.\nOnly workspace admins can create, update, and delete notification destinations.",
+        "package": {
+          "name": "settings"
+        },
+        "docs_group": "settings",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListNotificationDestinationsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a notification destination. Requires workspace admin permissions.",
+            "summary": "Create a notification destination.",
+            "path": "/api/2.0/notification-destinations",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateNotificationDestinationRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "NotificationDestination",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "config",
+                "description": "The configuration for the notification destination. Must wrap EXACTLY one of the nested configs.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "Config",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "The display name for the notification destination.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes a notification destination. Requires workspace admin permissions.",
+            "summary": "Delete a notification destination.",
+            "path": "/api/2.0/notification-destinations/{id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteNotificationDestinationRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Empty",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets a notification destination.",
+            "summary": "Get a notification destination.",
+            "path": "/api/2.0/notification-destinations/{id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetNotificationDestinationRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "NotificationDestination",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Lists notification destinations.",
+            "summary": "List notification destinations.",
+            "path": "/api/2.0/notification-destinations",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListNotificationDestinationsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListNotificationDestinationsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "page_token",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "Update",
+            "description": "Updates a notification destination. Requires workspace admin permissions. At least one field is required in the request body.",
+            "summary": "Update a notification destination.",
+            "path": "/api/2.0/notification-destinations/{id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateNotificationDestinationRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "UUID identifying notification destination.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "UUID identifying notification destination.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "NotificationDestination",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "config",
+                "description": "The configuration for the notification destination. Must wrap EXACTLY one of the nested configs.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "Config",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "The display name for the notification destination.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "id",
+                "description": "UUID identifying notification destination.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "UUID identifying notification destination.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "oauth2.OAuthPublishedApps",
+        "name": "OAuthPublishedApps",
+        "description": "These APIs enable administrators to view all the available published OAuth applications in Databricks.\nAdministrators can add the published OAuth applications to their account through the OAuth Published App Integration APIs.",
+        "package": {
+          "name": "oauth2"
+        },
+        "is_accounts": true,
+        "docs_group": "oauth2",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListOAuthPublishedAppsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "List",
+            "description": "Get all the available published OAuth apps in Databricks.",
+            "summary": "Get all the published OAuth apps.",
+            "path": "/api/2.0/accounts/{account_id}/oauth2/published-apps",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListOAuthPublishedAppsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "GetPublishedAppsOutput",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "The max number of OAuth published apps to return in one page.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "A token that can be used to get the next page of results.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "A token that can be used to get the next page of results.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          }
+        ]
+      },
+      {
+        "id": "catalog.OnlineTables",
+        "name": "OnlineTables",
+        "description": "Online tables provide lower latency and higher QPS access to data from Delta tables.",
+        "package": {
+          "name": "catalog"
+        },
+        "docs_group": "catalog",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Create a new Online Table.",
+            "summary": "Create an Online Table.",
+            "path": "/api/2.0/online-tables",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "CreateOnlineTableRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "table",
+                  "description": "Specification of the online table to be created.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "OnlineTable",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "table",
+                  "description": "Specification of the online table to be created.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "OnlineTable",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "table",
+              "description": "Specification of the online table to be created.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "OnlineTable",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "OnlineTable",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "table",
+                "description": "Specification of the online table to be created.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "OnlineTable",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Full three-part (catalog, schema, table) name of the table.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "spec",
+                "description": "Specification of the online table.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "OnlineTableSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "status",
+                "description": "Online Table data synchronization status",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "OnlineTableStatus",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "table_serving_url",
+                "description": "Data serving REST API URL for this table",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "unity_catalog_provisioning_state",
+                "description": "The provisioning state of the online table entity in Unity Catalog. This is distinct from the\nstate of the data synchronization pipeline (i.e. the table may be in \"ACTIVE\" but the pipeline\nmay be in \"PROVISIONING\" as it runs asynchronously).",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ProvisioningInfoState",
+                  "enum": [
+                    {
+                      "content": "ACTIVE"
+                    },
+                    {
+                      "content": "DEGRADED"
+                    },
+                    {
+                      "content": "DELETING"
+                    },
+                    {
+                      "content": "FAILED"
+                    },
+                    {
+                      "content": "PROVISIONING"
+                    },
+                    {
+                      "content": "UPDATING"
+                    }
+                  ]
+                }
+              }
+            ],
+            "wait": {
+              "success": [
+                {
+                  "content": "ACTIVE"
+                }
+              ],
+              "timeout": 20,
+              "poll": {
+                "response": {
+                  "pascal_name": "OnlineTable"
+                }
+              },
+              "status_path": [
+                {
+                  "pascal_name": "UnityCatalogProvisioningState"
+                }
+              ]
+            }
+          },
+          {
+            "name": "Delete",
+            "description": "Delete an online table.\nWarning: This will delete all the data in the online table. If the source Delta table was\ndeleted or modified since this Online Table was created, this will lose the data forever!",
+            "summary": "Delete an Online Table.",
+            "path": "/api/2.0/online-tables/{name}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "DeleteOnlineTableRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Full three-part (catalog, schema, table) name of the table.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Full three-part (catalog, schema, table) name of the table.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Full three-part (catalog, schema, table) name of the table.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Full three-part (catalog, schema, table) name of the table.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Get information about an existing online table and its status.",
+            "summary": "Get an Online Table.",
+            "path": "/api/2.0/online-tables/{name}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetOnlineTableRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Full three-part (catalog, schema, table) name of the table.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Full three-part (catalog, schema, table) name of the table.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "OnlineTable",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Full three-part (catalog, schema, table) name of the table.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Full three-part (catalog, schema, table) name of the table.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "iam.PermissionMigration",
+        "name": "PermissionMigration",
+        "description": "APIs for migrating acl permissions, used only by the ucx tool:  https://github.com/databrickslabs/ucx",
+        "package": {
+          "name": "iam"
+        },
+        "is_hidden_cli": true,
+        "docs_group": "iam",
+        "launch_stage": "PRIVATE_PREVIEW",
+        "cli_launch_stage_display": "Private Preview",
+        "methods": [
+          {
+            "name": "MigratePermissions",
+            "description": "Migrate Permissions.",
+            "summary": "Migrate Permissions.",
+            "path": "/api/2.0/permissionmigration",
+            "can_use_json": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "MigratePermissionsRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "WorkspaceId of the associated workspace where the permission migration will occur.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "from_workspace_group_name",
+                  "description": "The name of the workspace group that permissions will be migrated from.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "to_account_group_name",
+                  "description": "The name of the account group that permissions will be migrated to.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "WorkspaceId of the associated workspace where the permission migration will occur.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "from_workspace_group_name",
+                  "description": "The name of the workspace group that permissions will be migrated from.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "to_account_group_name",
+                  "description": "The name of the account group that permissions will be migrated to.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "MigratePermissionsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "from_workspace_group_name",
+                "description": "The name of the workspace group that permissions will be migrated from.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "size",
+                "description": "The maximum number of permissions that will be migrated.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "to_account_group_name",
+                "description": "The name of the account group that permissions will be migrated to.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "workspace_id",
+                "description": "WorkspaceId of the associated workspace where the permission migration will occur.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "workspace_id",
+                "description": "WorkspaceId of the associated workspace where the permission migration will occur.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "from_workspace_group_name",
+                "description": "The name of the workspace group that permissions will be migrated from.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "to_account_group_name",
+                "description": "The name of the account group that permissions will be migrated to.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "iam.Permissions",
+        "name": "Permissions",
+        "description": "Permissions API are used to create read, write, edit, update and manage access for various users on different objects and endpoints.\n* **[Apps permissions](:service:apps)** — Manage which users can manage or use apps.\n* **[Cluster permissions](:service:clusters)** — Manage which users can manage, restart, or attach to clusters.\n* **[Cluster policy permissions](:service:clusterpolicies)** — Manage which users can use cluster policies.\n* **[Spark Declarative Pipelines permissions](:service:pipelines)** — Manage which users can view, manage, run, cancel, or own a Spark Declarative Pipeline.\n* **[Job permissions](:service:jobs)** — Manage which users can view, manage, trigger, cancel, or own a job.\n* **[MLflow experiment permissions](:service:experiments)** — Manage which users can read, edit, or manage MLflow experiments.\n* **[MLflow registered model permissions](:service:modelregistry)** — Manage which users can read, edit, or manage MLflow registered models.\n* **[Instance Pool permissions](:service:instancepools)** — Manage which users can manage or attach to pools.\n* **[Repo permissions](repos)** — Manage which users can read, run, edit, or manage a repo.\n* **[Serving endpoint permissions](:service:servingendpoints)** — Manage which users can view, query, or manage a serving endpoint.\n* **[SQL warehouse permissions](:service:warehouses)** — Manage which users can use or manage SQL warehouses.\n* **[Token permissions](:service:tokenmanagement)** — Manage which users can create or use tokens.\n* **[Workspace object permissions](:service:workspace)** — Manage which users can read, run, edit, or manage alerts, dbsql-dashboards, directories, files, notebooks and queries.\nFor the mapping of the required permissions for specific actions or abilities and other important information, see [Access Control](https://docs.databricks.com/security/auth-authz/access-control/index.html).\nNote that to manage access control on service principals, use **[Account Access Control Proxy](:service:accountaccesscontrolproxy)**.",
+        "package": {
+          "name": "iam"
+        },
+        "docs_group": "iam",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "methods": [
+          {
+            "name": "Get",
+            "description": "Gets the permissions of an object. Objects can inherit permissions from their parent objects or root object.",
+            "summary": "Get object permissions.",
+            "path": "/api/2.0/permissions/{request_object_type}/{request_object_id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetPermissionRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "request_object_type",
+                  "description": "The type of the request object. Can be one of the following: alerts, alertsv2, authorization, clusters, cluster-policies, dashboards, database-projects, dbsql-dashboards, directories, experiments, files, genie, instance-pools, jobs, knowledge-assistants, notebooks, pipelines, queries, registered-models, repos, serving-endpoints, supervisor-agents, vector-search-endpoints, or warehouses.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "request_object_id",
+                  "description": "The id of the request object.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "request_object_type",
+                  "description": "The type of the request object. Can be one of the following: alerts, alertsv2, authorization, clusters, cluster-policies, dashboards, database-projects, dbsql-dashboards, directories, experiments, files, genie, instance-pools, jobs, knowledge-assistants, notebooks, pipelines, queries, registered-models, repos, serving-endpoints, supervisor-agents, vector-search-endpoints, or warehouses.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "request_object_id",
+                  "description": "The id of the request object.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ObjectPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "request_object_id",
+                "description": "The id of the request object.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "request_object_type",
+                "description": "The type of the request object. Can be one of the following: alerts, alertsv2, authorization, clusters, cluster-policies, dashboards, database-projects, dbsql-dashboards, directories, experiments, files, genie, instance-pools, jobs, knowledge-assistants, notebooks, pipelines, queries, registered-models, repos, serving-endpoints, supervisor-agents, vector-search-endpoints, or warehouses.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "request_object_type",
+                "description": "The type of the request object. Can be one of the following: alerts, alertsv2, authorization, clusters, cluster-policies, dashboards, database-projects, dbsql-dashboards, directories, experiments, files, genie, instance-pools, jobs, knowledge-assistants, notebooks, pipelines, queries, registered-models, repos, serving-endpoints, supervisor-agents, vector-search-endpoints, or warehouses.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "request_object_id",
+                "description": "The id of the request object.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetPermissionLevels",
+            "description": "Gets the permission levels that a user can have on an object.",
+            "summary": "Get object permission levels.",
+            "path": "/api/2.0/permissions/{request_object_type}/{request_object_id}/permissionLevels",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetPermissionLevelsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "request_object_type",
+                  "description": "The type of the request object. Can be one of the following: alerts, alertsv2, authorization, clusters, cluster-policies, dashboards, database-projects, dbsql-dashboards, directories, experiments, files, genie, instance-pools, jobs, knowledge-assistants, notebooks, pipelines, queries, registered-models, repos, serving-endpoints, supervisor-agents, vector-search-endpoints, or warehouses.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "request_object_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "request_object_type",
+                  "description": "The type of the request object. Can be one of the following: alerts, alertsv2, authorization, clusters, cluster-policies, dashboards, database-projects, dbsql-dashboards, directories, experiments, files, genie, instance-pools, jobs, knowledge-assistants, notebooks, pipelines, queries, registered-models, repos, serving-endpoints, supervisor-agents, vector-search-endpoints, or warehouses.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "request_object_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetPermissionLevelsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "request_object_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "request_object_type",
+                "description": "The type of the request object. Can be one of the following: alerts, alertsv2, authorization, clusters, cluster-policies, dashboards, database-projects, dbsql-dashboards, directories, experiments, files, genie, instance-pools, jobs, knowledge-assistants, notebooks, pipelines, queries, registered-models, repos, serving-endpoints, supervisor-agents, vector-search-endpoints, or warehouses.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "request_object_type",
+                "description": "The type of the request object. Can be one of the following: alerts, alertsv2, authorization, clusters, cluster-policies, dashboards, database-projects, dbsql-dashboards, directories, experiments, files, genie, instance-pools, jobs, knowledge-assistants, notebooks, pipelines, queries, registered-models, repos, serving-endpoints, supervisor-agents, vector-search-endpoints, or warehouses.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "request_object_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Set",
+            "description": "Sets permissions on an object, replacing existing permissions if they exist. Deletes all direct permissions if none are specified. Objects can inherit permissions from their parent objects or root object.",
+            "summary": "Set object permissions.",
+            "path": "/api/2.0/permissions/{request_object_type}/{request_object_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "SetObjectPermissions",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "request_object_type",
+                  "description": "The type of the request object. Can be one of the following: alerts, alertsv2, authorization, clusters, cluster-policies, dashboards, database-projects, dbsql-dashboards, directories, experiments, files, genie, instance-pools, jobs, knowledge-assistants, notebooks, pipelines, queries, registered-models, repos, serving-endpoints, supervisor-agents, vector-search-endpoints, or warehouses.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "request_object_id",
+                  "description": "The id of the request object.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "request_object_type",
+                  "description": "The type of the request object. Can be one of the following: alerts, alertsv2, authorization, clusters, cluster-policies, dashboards, database-projects, dbsql-dashboards, directories, experiments, files, genie, instance-pools, jobs, knowledge-assistants, notebooks, pipelines, queries, registered-models, repos, serving-endpoints, supervisor-agents, vector-search-endpoints, or warehouses.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "request_object_id",
+                  "description": "The id of the request object.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ObjectPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "access_control_list",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AccessControlRequestList",
+                  "array_value": {
+                    "pascal_name": "AccessControlRequest",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "request_object_id",
+                "description": "The id of the request object.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "request_object_type",
+                "description": "The type of the request object. Can be one of the following: alerts, alertsv2, authorization, clusters, cluster-policies, dashboards, database-projects, dbsql-dashboards, directories, experiments, files, genie, instance-pools, jobs, knowledge-assistants, notebooks, pipelines, queries, registered-models, repos, serving-endpoints, supervisor-agents, vector-search-endpoints, or warehouses.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "request_object_type",
+                "description": "The type of the request object. Can be one of the following: alerts, alertsv2, authorization, clusters, cluster-policies, dashboards, database-projects, dbsql-dashboards, directories, experiments, files, genie, instance-pools, jobs, knowledge-assistants, notebooks, pipelines, queries, registered-models, repos, serving-endpoints, supervisor-agents, vector-search-endpoints, or warehouses.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "request_object_id",
+                "description": "The id of the request object.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Updates the permissions on an object. Objects can inherit permissions from their parent objects or root object.",
+            "summary": "Update object permissions.",
+            "path": "/api/2.0/permissions/{request_object_type}/{request_object_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateObjectPermissions",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "request_object_type",
+                  "description": "The type of the request object. Can be one of the following: alerts, alertsv2, authorization, clusters, cluster-policies, dashboards, database-projects, dbsql-dashboards, directories, experiments, files, genie, instance-pools, jobs, knowledge-assistants, notebooks, pipelines, queries, registered-models, repos, serving-endpoints, supervisor-agents, vector-search-endpoints, or warehouses.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "request_object_id",
+                  "description": "The id of the request object.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "request_object_type",
+                  "description": "The type of the request object. Can be one of the following: alerts, alertsv2, authorization, clusters, cluster-policies, dashboards, database-projects, dbsql-dashboards, directories, experiments, files, genie, instance-pools, jobs, knowledge-assistants, notebooks, pipelines, queries, registered-models, repos, serving-endpoints, supervisor-agents, vector-search-endpoints, or warehouses.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "request_object_id",
+                  "description": "The id of the request object.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ObjectPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "access_control_list",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AccessControlRequestList",
+                  "array_value": {
+                    "pascal_name": "AccessControlRequest",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "request_object_id",
+                "description": "The id of the request object.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "request_object_type",
+                "description": "The type of the request object. Can be one of the following: alerts, alertsv2, authorization, clusters, cluster-policies, dashboards, database-projects, dbsql-dashboards, directories, experiments, files, genie, instance-pools, jobs, knowledge-assistants, notebooks, pipelines, queries, registered-models, repos, serving-endpoints, supervisor-agents, vector-search-endpoints, or warehouses.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "request_object_type",
+                "description": "The type of the request object. Can be one of the following: alerts, alertsv2, authorization, clusters, cluster-policies, dashboards, database-projects, dbsql-dashboards, directories, experiments, files, genie, instance-pools, jobs, knowledge-assistants, notebooks, pipelines, queries, registered-models, repos, serving-endpoints, supervisor-agents, vector-search-endpoints, or warehouses.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "request_object_id",
+                "description": "The id of the request object.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "settings.PersonalCompute",
+        "name": "PersonalCompute",
+        "description": "The Personal Compute enablement setting lets you control which users can use the Personal Compute default policy to create compute resources.\nBy default all users in all workspaces have access (ON), but you can change the setting to instead let individual workspaces configure access control (DELEGATE).\n\nThere is only one instance of this setting per account.\nSince this setting has a default value, this setting is present on all accounts even though it's never set on a given account.\nDeletion reverts the value of the setting back to the default value.",
+        "package": {
+          "name": "settings"
+        },
+        "is_accounts": true,
+        "has_parent": true,
+        "is_hidden_cli": true,
+        "docs_group": "settings",
+        "launch_stage": "PRIVATE_PREVIEW",
+        "cli_launch_stage_display": "Private Preview",
+        "parent_service_id": "settings.AccountSettings",
+        "methods": [
+          {
+            "name": "Delete",
+            "description": "Reverts back the Personal Compute setting value to default (ON)",
+            "summary": "Delete Personal Compute setting.",
+            "path": "/api/2.0/accounts/{account_id}/settings/types/dcp_acct_enable/names/default",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "DeletePersonalComputeSettingRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "DeletePersonalComputeSettingResponse",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "etag",
+                  "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "etag",
+                  "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets the value of the Personal Compute setting.",
+            "summary": "Get Personal Compute setting.",
+            "path": "/api/2.0/accounts/{account_id}/settings/types/dcp_acct_enable/names/default",
+            "is_crud_read": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "GetPersonalComputeSettingRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "PersonalComputeSetting",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "personal_compute",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PersonalComputeMessage",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "personal_compute",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PersonalComputeMessage",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Updates the value of the Personal Compute setting.",
+            "summary": "Update Personal Compute setting.",
+            "path": "/api/2.0/accounts/{account_id}/settings/types/dcp_acct_enable/names/default",
+            "can_use_json": true,
+            "must_use_json": true,
+            "is_hidden_cli": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "UpdatePersonalComputeSettingRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PersonalComputeSetting",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PersonalComputeSetting",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "PersonalComputeSetting",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "personal_compute",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PersonalComputeMessage",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "personal_compute",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PersonalComputeMessage",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "allow_missing",
+                "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "field_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "setting",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PersonalComputeSetting",
+                  "is_object": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "pipelines.Pipelines",
+        "name": "Pipelines",
+        "description": "The Lakeflow Spark Declarative Pipelines API allows you to create, edit, delete, start, and view details about pipelines.\n\nSpark Declarative Pipelines is a framework for building reliable, maintainable, and testable data processing pipelines. You define the transformations to perform on your data, and Spark Declarative Pipelines manages task orchestration, cluster management, monitoring, data quality, and error handling.\n\nInstead of defining your data pipelines using a series of separate Apache Spark tasks, Spark Declarative Pipelines manages how your data is transformed based on a target schema you define for each processing step. You can also enforce data quality with Spark Declarative Pipelines expectations. Expectations allow you to define expected data quality and specify how to handle records that fail those expectations.",
+        "package": {
+          "name": "pipelines"
+        },
+        "docs_group": "lakeflow",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "named_id_map": {
+            "pascal_name": "PipelineStateInfoNameToPipelineIdMap"
+          },
+          "request": {
+            "pascal_name": "ListPipelinesRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "ApplyEnvironment",
+            "description": "Applies the current pipeline environment onto the pipeline compute. The environment applied can be used by subsequent\ndev-mode updates.",
+            "summary": "Apply the latest environment to the pipeline.",
+            "path": "/api/2.0/pipelines/{pipeline_id}/environment/apply",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "ApplyEnvironmentRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "pipeline_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "pipeline_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ApplyEnvironmentRequestResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "pipeline_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "pipeline_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Clone",
+            "description": "Creates a new pipeline using Unity Catalog from a pipeline using Hive Metastore.\nThis method returns the ID of the newly created clone.\nAdditionally, this method starts an update for the newly created pipeline.",
+            "summary": "Clone a pipeline.",
+            "path": "/api/2.0/pipelines/{pipeline_id}/clone",
+            "can_use_json": true,
+            "must_use_json": true,
+            "is_json_only": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ClonePipelineRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "pipeline_id",
+                  "description": "Source pipeline to clone from",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "pipeline_id",
+                  "description": "Source pipeline to clone from",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ClonePipelineResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "allow_duplicate_names",
+                "description": "If false, deployment will fail if name conflicts with that of another pipeline.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "budget_policy_id",
+                "description": "Budget policy of this pipeline.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "catalog",
+                "description": "A catalog in Unity Catalog to publish data from this pipeline to. If `target` is specified, tables in this pipeline are published to a `target` schema inside `catalog` (for example, `catalog`.`target`.`table`). If `target` is not specified, no data is published to Unity Catalog.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "channel",
+                "description": "SDP Release Channel that specifies which version to use.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "clone_mode",
+                "description": "The type of clone to perform. Currently, only deep copies are supported",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CloneMode",
+                  "enum": [
+                    {
+                      "content": "MIGRATE_TO_UC"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "clusters",
+                "description": "Cluster settings for this pipeline deployment. Applies to classic\n(non-serverless) pipelines. Omit this field when `serverless` is `true`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PipelineClusterList",
+                  "array_value": {
+                    "pascal_name": "PipelineCluster",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "configuration",
+                "description": "String-String configuration for this pipeline execution.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "continuous",
+                "description": "Whether the pipeline is continuous or triggered. This replaces `trigger`.\n\nDeprecated: wrap the pipeline in a continuous job instead, which also lets you take advantage\nof job-level settings such as performance mode. When the pipeline is started by a continuous\njob, the job's setting takes precedence and this field is ignored.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "deployment",
+                "description": "Deployment type of this pipeline.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "PipelineDeployment",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "development",
+                "description": "Whether the pipeline is in Development mode. Defaults to false.\n\nDeprecated: set development mode for each update instead.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "edition",
+                "description": "Pipeline product edition.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "environment",
+                "description": "Environment specification for this pipeline used to install dependencies.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "PipelinesEnvironment",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "event_log",
+                "description": "Event log configuration for this pipeline",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "EventLogSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "expected_last_modified",
+                "description": "If present, the last-modified time of the pipeline settings before the clone.\nIf the settings were modified after that time, then the request will fail with\na conflict.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "filters",
+                "description": "Filters on which Pipeline packages to include in the deployed graph.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "Filters",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "gateway_definition",
+                "description": "The definition of a gateway pipeline to support change data capture.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "IngestionGatewayPipelineDefinition",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "id",
+                "description": "Unique identifier for this pipeline.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "ingestion_definition",
+                "description": "The configuration for a managed ingestion pipeline. These settings cannot be used with the 'libraries', 'schema', 'target', or 'catalog' settings.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "IngestionPipelineDefinition",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "libraries",
+                "description": "Libraries or code needed by this deployment.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PipelineLibraryList",
+                  "array_value": {
+                    "pascal_name": "PipelineLibrary",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "name",
+                "description": "Friendly identifier for this pipeline.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "notifications",
+                "description": "List of notification settings for this pipeline.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "NotificationsList",
+                  "array_value": {
+                    "pascal_name": "Notifications",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "parent_path",
+                "description": "Path of the pipeline parent folder in workspace file tree.\n\nIf absent, the pipeline doesn't have a workspace object.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "photon",
+                "description": "Whether Photon is enabled for this pipeline.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "pipeline_id",
+                "description": "Source pipeline to clone from",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "restart_window",
+                "description": "Restart window of this pipeline.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "RestartWindow",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "root_path",
+                "description": "Root path for this pipeline.\nThis is used as the root directory when editing the pipeline in the Databricks user interface and it is\nadded to sys.path when executing Python sources during pipeline execution.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schema",
+                "description": "The default schema (database) where tables are read from or published to.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "serverless",
+                "description": "Whether serverless compute is enabled for this pipeline. Serverless is the\nrecommended compute for new pipelines; set this to `true` to run the pipeline\non serverless. For notebook/file pipelines, omitting this field uses classic\ncompute configured through the `clusters` field. When `true`, omit `clusters`;\nPhoton is always enabled.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "serverless_compute_id",
+                "description": "Serverless compute ID specified by the user for serverless pipelines.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "storage",
+                "description": "DBFS root directory for storing checkpoints and tables.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tags",
+                "description": "A map of tags associated with the pipeline.\nThese are forwarded to the cluster as cluster tags, and are therefore subject to the same limitations.\nA maximum of 25 tags can be added to the pipeline.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "target",
+                "description": "Target schema (database) to add tables in this pipeline to. Exactly one of `schema` or `target` must be specified. To publish to Unity Catalog, also specify `catalog`. This legacy field is deprecated for pipeline creation in favor of the `schema` field.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "trigger",
+                "description": "Which pipeline trigger to use. Deprecated: Use `continuous` instead.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "PipelineTrigger",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "usage_policy_id",
+                "description": "Usage policy of this pipeline.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "pipeline_id",
+                "description": "Source pipeline to clone from",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Create",
+            "description": "Creates a new data processing pipeline based on the requested configuration. If successful, this method returns\nthe ID of the new pipeline.",
+            "summary": "Create a pipeline.",
+            "path": "/api/2.0/pipelines",
+            "can_use_json": true,
+            "must_use_json": true,
+            "is_json_only": true,
+            "is_crud_create": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreatePipeline",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "CreatePipelineResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "allow_duplicate_names",
+                "description": "If false, deployment will fail if name conflicts with that of another pipeline.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "budget_policy_id",
+                "description": "Budget policy of this pipeline.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "catalog",
+                "description": "A catalog in Unity Catalog to publish data from this pipeline to. If `target` is specified, tables in this pipeline are published to a `target` schema inside `catalog` (for example, `catalog`.`target`.`table`). If `target` is not specified, no data is published to Unity Catalog.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "channel",
+                "description": "SDP Release Channel that specifies which version to use.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "clusters",
+                "description": "Cluster settings for this pipeline deployment. Applies to classic\n(non-serverless) pipelines. Omit this field when `serverless` is `true`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PipelineClusterList",
+                  "array_value": {
+                    "pascal_name": "PipelineCluster",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "configuration",
+                "description": "String-String configuration for this pipeline execution.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "continuous",
+                "description": "Whether the pipeline is continuous or triggered. This replaces `trigger`.\n\nDeprecated: wrap the pipeline in a continuous job instead, which also lets you take advantage\nof job-level settings such as performance mode. When the pipeline is started by a continuous\njob, the job's setting takes precedence and this field is ignored.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "deployment",
+                "description": "Deployment type of this pipeline.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "PipelineDeployment",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "development",
+                "description": "Whether the pipeline is in Development mode. Defaults to false.\n\nDeprecated: set development mode for each update instead.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "dry_run",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "edition",
+                "description": "Pipeline product edition.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "environment",
+                "description": "Environment specification for this pipeline used to install dependencies.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "PipelinesEnvironment",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "event_log",
+                "description": "Event log configuration for this pipeline",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "EventLogSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "filters",
+                "description": "Filters on which Pipeline packages to include in the deployed graph.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "Filters",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "gateway_definition",
+                "description": "The definition of a gateway pipeline to support change data capture.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "IngestionGatewayPipelineDefinition",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "id",
+                "description": "Unique identifier for this pipeline.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "ingestion_definition",
+                "description": "The configuration for a managed ingestion pipeline. These settings cannot be used with the 'libraries', 'schema', 'target', or 'catalog' settings.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "IngestionPipelineDefinition",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "libraries",
+                "description": "Libraries or code needed by this deployment.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PipelineLibraryList",
+                  "array_value": {
+                    "pascal_name": "PipelineLibrary",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "name",
+                "description": "Friendly identifier for this pipeline.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "notifications",
+                "description": "List of notification settings for this pipeline.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "NotificationsList",
+                  "array_value": {
+                    "pascal_name": "Notifications",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "parameters",
+                "description": "Key/value map of default parameters to use for pipeline execution.\nMaximum total size: 10k characters (JSON format)",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "parent_path",
+                "description": "Path of the pipeline parent folder in workspace file tree.\n\nIf absent, the pipeline doesn't have a workspace object.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "photon",
+                "description": "Whether Photon is enabled for this pipeline.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "restart_window",
+                "description": "Restart window of this pipeline.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "RestartWindow",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "root_path",
+                "description": "Root path for this pipeline.\nThis is used as the root directory when editing the pipeline in the Databricks user interface and it is\nadded to sys.path when executing Python sources during pipeline execution.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "run_as",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "RunAs",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "schema",
+                "description": "The default schema (database) where tables are read from or published to.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "serverless",
+                "description": "Whether serverless compute is enabled for this pipeline. Serverless is the\nrecommended compute for new pipelines; set this to `true` to run the pipeline\non serverless. For notebook/file pipelines, omitting this field uses classic\ncompute configured through the `clusters` field. When `true`, omit `clusters`;\nPhoton is always enabled.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "serverless_compute_id",
+                "description": "Serverless compute ID specified by the user for serverless pipelines.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "storage",
+                "description": "DBFS root directory for storing checkpoints and tables.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tags",
+                "description": "A map of tags associated with the pipeline.\nThese are forwarded to the cluster as cluster tags, and are therefore subject to the same limitations.\nA maximum of 25 tags can be added to the pipeline.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "target",
+                "description": "Target schema (database) to add tables in this pipeline to. Exactly one of `schema` or `target` must be specified. To publish to Unity Catalog, also specify `catalog`. This legacy field is deprecated for pipeline creation in favor of the `schema` field.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "trigger",
+                "description": "Which pipeline trigger to use. Deprecated: Use `continuous` instead.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "PipelineTrigger",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "usage_policy_id",
+                "description": "Usage policy of this pipeline.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes a pipeline. If the pipeline publishes to Unity Catalog, pipeline deletion will cascade to\nall pipeline tables. Please reach out to Databricks support for assistance to undo this action.",
+            "summary": "Delete a pipeline.",
+            "path": "/api/2.0/pipelines/{pipeline_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeletePipelineRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "pipeline_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "pipeline_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeletePipelineResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "cascade",
+                "description": "If false, pipeline deletion will not cascade to its datasets (MVs, STs, Views).\nBy default, this parameter will be true and all tables will be deleted with the pipeline.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "force",
+                "description": "If true, deletion will proceed even if resource cleanup fails.\nBy default, deletion will fail if resources cleanup is required but fails.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "pipeline_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "pipeline_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Get a pipeline.",
+            "summary": "Get a pipeline.",
+            "path": "/api/2.0/pipelines/{pipeline_id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetPipelineRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "pipeline_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "pipeline_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetPipelineResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "pipeline_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "pipeline_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetPermissionLevels",
+            "description": "Gets the permission levels that a user can have on an object.",
+            "summary": "Get pipeline permission levels.",
+            "path": "/api/2.0/permissions/pipelines/{pipeline_id}/permissionLevels",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetPipelinePermissionLevelsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "pipeline_id",
+                  "description": "The pipeline for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "pipeline_id",
+                  "description": "The pipeline for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetPipelinePermissionLevelsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "pipeline_id",
+                "description": "The pipeline for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "pipeline_id",
+                "description": "The pipeline for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetPermissions",
+            "description": "Gets the permissions of a pipeline. Pipelines can inherit permissions from their root object.",
+            "summary": "Get pipeline permissions.",
+            "path": "/api/2.0/permissions/pipelines/{pipeline_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetPipelinePermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "pipeline_id",
+                  "description": "The pipeline for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "pipeline_id",
+                  "description": "The pipeline for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "PipelinePermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "pipeline_id",
+                "description": "The pipeline for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "pipeline_id",
+                "description": "The pipeline for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetUpdate",
+            "description": "Gets an update from an active pipeline.",
+            "summary": "Get a pipeline update.",
+            "path": "/api/2.0/pipelines/{pipeline_id}/updates/{update_id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetUpdateRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "pipeline_id",
+                  "description": "The ID of the pipeline.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_id",
+                  "description": "The ID of the update.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "pipeline_id",
+                  "description": "The ID of the pipeline.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_id",
+                  "description": "The ID of the update.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetUpdateResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "pipeline_id",
+                "description": "The ID of the pipeline.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_id",
+                "description": "The ID of the update.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "pipeline_id",
+                "description": "The ID of the pipeline.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_id",
+                "description": "The ID of the update.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListPipelineEvents",
+            "description": "Retrieves events for a pipeline.",
+            "summary": "List pipeline events.",
+            "path": "/api/2.0/pipelines/{pipeline_id}/events",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListPipelineEventsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "pipeline_id",
+                  "description": "The pipeline to return events for.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "pipeline_id",
+                  "description": "The pipeline to return events for.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListPipelineEventsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "filter",
+                "description": "Criteria to select a subset of results, expressed using a SQL-like syntax.\nThe supported filters are:\n1. level='INFO' (or WARN or ERROR)\n2. level in ('INFO', 'WARN')\n3. id='[event-id]'\n4. timestamp \u003e 'TIMESTAMP' (or \u003e=,\u003c,\u003c=,=)\n\nComposite expressions are supported, for example: level in ('ERROR', 'WARN')\nAND timestamp\u003e '2021-07-22T06:37:33.083Z'",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "max_results",
+                "description": "Max number of entries to return in a single page. The system may return\nfewer than max_results events in a response, even if there are more events\navailable.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "order_by",
+                "description": "A string indicating a sort order by timestamp for the results, for example, [\"timestamp asc\"].\nThe sort order can be ascending or descending. By default, events are returned\nin descending order by timestamp.",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Page token returned by previous call. This field is mutually\nexclusive with all fields in this request except max_results. An error is\nreturned if any fields other than max_results are set when this field is set.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "pipeline_id",
+                "description": "The pipeline to return events for.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "pipeline_id",
+                "description": "The pipeline to return events for.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Page token returned by previous call. This field is mutually\nexclusive with all fields in this request except max_results. An error is\nreturned if any fields other than max_results are set when this field is set.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListPipelines",
+            "description": "Lists pipelines defined in the Spark Declarative Pipelines system.",
+            "summary": "List pipelines.",
+            "path": "/api/2.0/pipelines",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListPipelinesRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListPipelinesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "filter",
+                "description": "Select a subset of results based on the specified criteria.\nThe supported filters are:\n\n* `notebook='\u003cpath\u003e'` to select pipelines that reference the provided notebook path.\n* `name LIKE '[pattern]'` to select pipelines with a name that matches pattern.\nWildcards are supported, for example: `name LIKE '%shopping%'`\n\nComposite filters are not supported. This field is optional.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "max_results",
+                "description": "The maximum number of entries to return in a single page. The system may\nreturn fewer than max_results pipelines in a response, even if there are\nmore pipelines available. This field is optional. The default value is 25.\nThe maximum value is 100. An error is returned if the value of max_results\nis greater than 100.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "order_by",
+                "description": "A list of strings specifying the order of results.\nSupported order_by fields are id and name. The default is id asc.\nThis field is optional.",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Page token returned by previous call",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Page token returned by previous call",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListUpdates",
+            "description": "List updates for an active pipeline.",
+            "summary": "List pipeline updates.",
+            "path": "/api/2.0/pipelines/{pipeline_id}/updates",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListUpdatesRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "pipeline_id",
+                  "description": "The pipeline to return updates for.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "pipeline_id",
+                  "description": "The pipeline to return updates for.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListUpdatesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "max_results",
+                "description": "Max number of entries to return in a single page.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Page token returned by previous call",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "pipeline_id",
+                "description": "The pipeline to return updates for.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "until_update_id",
+                "description": "If present, returns updates until and including this update_id.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "pipeline_id",
+                "description": "The pipeline to return updates for.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "SetPermissions",
+            "description": "Sets permissions on an object, replacing existing permissions if they exist. Deletes all direct permissions if none are specified. Objects can inherit permissions from their root object.",
+            "summary": "Set pipeline permissions.",
+            "path": "/api/2.0/permissions/pipelines/{pipeline_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "PipelinePermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "pipeline_id",
+                  "description": "The pipeline for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "pipeline_id",
+                  "description": "The pipeline for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "PipelinePermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "access_control_list",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PipelineAccessControlRequestList",
+                  "array_value": {
+                    "pascal_name": "PipelineAccessControlRequest",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "pipeline_id",
+                "description": "The pipeline for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "pipeline_id",
+                "description": "The pipeline for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "StartUpdate",
+            "description": "Starts a new update for the pipeline. If there is already an active update for the pipeline, the request will fail and the active update will remain running.",
+            "summary": "Start a pipeline.",
+            "path": "/api/2.0/pipelines/{pipeline_id}/updates",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "StartUpdate",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "pipeline_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "pipeline_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "StartUpdateResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "cause",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "StartUpdateCause",
+                  "enum": [
+                    {
+                      "content": "API_CALL"
+                    },
+                    {
+                      "content": "INFRASTRUCTURE_MAINTENANCE"
+                    },
+                    {
+                      "content": "JOB_TASK"
+                    },
+                    {
+                      "content": "RETRY_ON_FAILURE"
+                    },
+                    {
+                      "content": "SCHEMA_CHANGE"
+                    },
+                    {
+                      "content": "SERVICE_UPGRADE"
+                    },
+                    {
+                      "content": "USER_ACTION"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "development",
+                "description": "Whether the update is started in the development mode.\nThis is recommended for interactive development and testing.\nReuses compute for faster iteration and disables automatic retries.\nNot recommended for production.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "full_refresh",
+                "description": "If true, this update will reset all tables before running.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "full_refresh_selection",
+                "description": "A list of tables to update with fullRefresh. If both refresh_selection and\nfull_refresh_selection are empty, this is a full graph update. Full Refresh on a table means\nthat the states of the table will be reset before the refresh.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "parameters",
+                "description": "Key/value map of parameters to pass to the pipeline execution",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "pipeline_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "refresh_selection",
+                "description": "A list of tables to update without fullRefresh. If both refresh_selection and\nfull_refresh_selection are empty, this is a full graph update. Full Refresh on a table means\nthat the states of the table will be reset before the refresh.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "replace_where_overrides",
+                "description": "A list of predicate overrides for replace_where flows in this update.\nOnly replace_where flows may be specified. Flows not listed use their original predicate.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ReplaceWhereOverrideList",
+                  "array_value": {
+                    "pascal_name": "ReplaceWhereOverride",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "reset_checkpoint_selection",
+                "description": "A list of flows for which this update should reset the streaming checkpoint. This selection will not clear\nthe data in the flow's target table. Flows in this list may also appear in refresh_selection and full_refresh_selection.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "rewind_spec",
+                "description": "The information about the requested rewind operation.\nIf specified this is a rewind mode update.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "RewindSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "validate_only",
+                "description": "If true, this update only validates the correctness of pipeline source code but does not materialize or publish any datasets.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "pipeline_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Stop",
+            "description": "Stops the pipeline by canceling the active update. If there is no active update for the pipeline, this request is a no-op.",
+            "summary": "Stop a pipeline.",
+            "path": "/api/2.0/pipelines/{pipeline_id}/stop",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "StopRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "pipeline_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "pipeline_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "StopPipelineResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "pipeline_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "pipeline_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "wait": {
+              "success": [
+                {
+                  "content": "IDLE"
+                }
+              ],
+              "timeout": 20,
+              "poll": {
+                "response": {
+                  "pascal_name": "GetPipelineResponse"
+                }
+              },
+              "status_path": [
+                {
+                  "pascal_name": "State"
+                }
+              ],
+              "message_path": [
+                {
+                  "pascal_name": "Cause"
+                }
+              ],
+              "message_path_head": {
+                "pascal_name": "Cause"
+              }
+            }
+          },
+          {
+            "name": "Update",
+            "description": "Updates a pipeline with the supplied configuration.",
+            "summary": "Edit a pipeline.",
+            "path": "/api/2.0/pipelines/{pipeline_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "EditPipeline",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "pipeline_id",
+                  "description": "Unique identifier for this pipeline.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "pipeline_id",
+                  "description": "Unique identifier for this pipeline.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "EditPipelineResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "allow_duplicate_names",
+                "description": "If false, deployment will fail if name has changed and conflicts the name of another pipeline.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "budget_policy_id",
+                "description": "Budget policy of this pipeline.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "catalog",
+                "description": "A catalog in Unity Catalog to publish data from this pipeline to. If `target` is specified, tables in this pipeline are published to a `target` schema inside `catalog` (for example, `catalog`.`target`.`table`). If `target` is not specified, no data is published to Unity Catalog.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "channel",
+                "description": "SDP Release Channel that specifies which version to use.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "clusters",
+                "description": "Cluster settings for this pipeline deployment. Applies to classic\n(non-serverless) pipelines. Omit this field when `serverless` is `true`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PipelineClusterList",
+                  "array_value": {
+                    "pascal_name": "PipelineCluster",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "configuration",
+                "description": "String-String configuration for this pipeline execution.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "continuous",
+                "description": "Whether the pipeline is continuous or triggered. This replaces `trigger`.\n\nDeprecated: wrap the pipeline in a continuous job instead, which also lets you take advantage\nof job-level settings such as performance mode. When the pipeline is started by a continuous\njob, the job's setting takes precedence and this field is ignored.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "deployment",
+                "description": "Deployment type of this pipeline.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "PipelineDeployment",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "development",
+                "description": "Whether the pipeline is in Development mode. Defaults to false.\n\nDeprecated: set development mode for each update instead.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "edition",
+                "description": "Pipeline product edition.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "environment",
+                "description": "Environment specification for this pipeline used to install dependencies.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "PipelinesEnvironment",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "event_log",
+                "description": "Event log configuration for this pipeline",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "EventLogSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "expected_last_modified",
+                "description": "If present, the last-modified time of the pipeline settings before the edit.\nIf the settings were modified after that time, then the request will fail with\na conflict.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "filters",
+                "description": "Filters on which Pipeline packages to include in the deployed graph.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "Filters",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "gateway_definition",
+                "description": "The definition of a gateway pipeline to support change data capture.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "IngestionGatewayPipelineDefinition",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "id",
+                "description": "Unique identifier for this pipeline.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "ingestion_definition",
+                "description": "The configuration for a managed ingestion pipeline. These settings cannot be used with the 'libraries', 'schema', 'target', or 'catalog' settings.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "IngestionPipelineDefinition",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "libraries",
+                "description": "Libraries or code needed by this deployment.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PipelineLibraryList",
+                  "array_value": {
+                    "pascal_name": "PipelineLibrary",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "name",
+                "description": "Friendly identifier for this pipeline.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "notifications",
+                "description": "List of notification settings for this pipeline.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "NotificationsList",
+                  "array_value": {
+                    "pascal_name": "Notifications",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "parameters",
+                "description": "Key/value map of default parameters to use for pipeline execution.\nMaximum total size: 10k characters (JSON format)",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "parent_path",
+                "description": "Path of the pipeline parent folder in workspace file tree.\n\nIf absent, the pipeline doesn't have a workspace object.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "photon",
+                "description": "Whether Photon is enabled for this pipeline.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "pipeline_id",
+                "description": "Unique identifier for this pipeline.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "restart_window",
+                "description": "Restart window of this pipeline.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "RestartWindow",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "root_path",
+                "description": "Root path for this pipeline.\nThis is used as the root directory when editing the pipeline in the Databricks user interface and it is\nadded to sys.path when executing Python sources during pipeline execution.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "run_as",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "RunAs",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "schema",
+                "description": "The default schema (database) where tables are read from or published to.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "serverless",
+                "description": "Whether serverless compute is enabled for this pipeline. Serverless is the\nrecommended compute for new pipelines; set this to `true` to run the pipeline\non serverless. For notebook/file pipelines, omitting this field uses classic\ncompute configured through the `clusters` field. When `true`, omit `clusters`;\nPhoton is always enabled.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "serverless_compute_id",
+                "description": "Serverless compute ID specified by the user for serverless pipelines.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "storage",
+                "description": "DBFS root directory for storing checkpoints and tables.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tags",
+                "description": "A map of tags associated with the pipeline.\nThese are forwarded to the cluster as cluster tags, and are therefore subject to the same limitations.\nA maximum of 25 tags can be added to the pipeline.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "target",
+                "description": "Target schema (database) to add tables in this pipeline to. Exactly one of `schema` or `target` must be specified. To publish to Unity Catalog, also specify `catalog`. This legacy field is deprecated for pipeline creation in favor of the `schema` field.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "trigger",
+                "description": "Which pipeline trigger to use. Deprecated: Use `continuous` instead.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "PipelineTrigger",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "usage_policy_id",
+                "description": "Usage policy of this pipeline.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "pipeline_id",
+                "description": "Unique identifier for this pipeline.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdatePermissions",
+            "description": "Updates the permissions on a pipeline. Pipelines can inherit permissions from their root object.",
+            "summary": "Update pipeline permissions.",
+            "path": "/api/2.0/permissions/pipelines/{pipeline_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "PipelinePermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "pipeline_id",
+                  "description": "The pipeline for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "pipeline_id",
+                  "description": "The pipeline for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "PipelinePermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "access_control_list",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PipelineAccessControlRequestList",
+                  "array_value": {
+                    "pascal_name": "PipelineAccessControlRequest",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "pipeline_id",
+                "description": "The pipeline for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "pipeline_id",
+                "description": "The pipeline for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "catalog.Policies",
+        "name": "Policies",
+        "description": "Attribute-Based Access Control (ABAC) provides high leverage governance for enforcing compliance policies in Unity Catalog. With ABAC policies, access is controlled in a hierarchical and scalable manner, based on data attributes rather than specific resources, enabling more flexible and comprehensive access control. ABAC policies in Unity Catalog support conditions on securable properties, governance tags, and environment contexts. Callers must have the `MANAGE` privilege on a securable to view, create, update, or delete ABAC policies.",
+        "package": {
+          "name": "catalog"
+        },
+        "docs_group": "catalog",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListPoliciesRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "CreatePolicy",
+            "description": "Creates a new policy on a securable.\nThe new policy applies to the securable and all its descendants.",
+            "summary": "Create an ABAC policy.",
+            "path": "/api/2.1/unity-catalog/policies",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreatePolicyRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "policy_info",
+                  "description": "Required. The policy to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PolicyInfo",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "policy_info",
+                  "description": "Required. The policy to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PolicyInfo",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "policy_info",
+              "description": "Required. The policy to create.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "PolicyInfo",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "to_principals",
+                    "description": "List of user or group names that the policy applies to.\nRequired on create and optional on update.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "List",
+                      "array_value": {
+                        "is_string": true
+                      }
+                    }
+                  },
+                  {
+                    "name": "for_securable_type",
+                    "description": "Type of securables that the policy should take effect on.\nRequired on create and optional on update.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "SecurableType",
+                      "enum": [
+                        {
+                          "content": "AGENT_SERVICE"
+                        },
+                        {
+                          "content": "CATALOG"
+                        },
+                        {
+                          "content": "CLEAN_ROOM"
+                        },
+                        {
+                          "content": "CONNECTION"
+                        },
+                        {
+                          "content": "CREDENTIAL"
+                        },
+                        {
+                          "content": "EXTERNAL_LOCATION"
+                        },
+                        {
+                          "content": "EXTERNAL_METADATA"
+                        },
+                        {
+                          "content": "FUNCTION"
+                        },
+                        {
+                          "content": "MCP_SERVICE"
+                        },
+                        {
+                          "content": "METASTORE"
+                        },
+                        {
+                          "content": "MODEL"
+                        },
+                        {
+                          "content": "MODEL_PROVIDER_SERVICE"
+                        },
+                        {
+                          "content": "MODEL_SERVICE"
+                        },
+                        {
+                          "content": "PIPELINE"
+                        },
+                        {
+                          "content": "PROVIDER"
+                        },
+                        {
+                          "content": "RECIPIENT"
+                        },
+                        {
+                          "content": "SCHEMA"
+                        },
+                        {
+                          "content": "SHARE"
+                        },
+                        {
+                          "content": "SKILL"
+                        },
+                        {
+                          "content": "STAGING_TABLE"
+                        },
+                        {
+                          "content": "STORAGE_CREDENTIAL"
+                        },
+                        {
+                          "content": "TABLE"
+                        },
+                        {
+                          "content": "VOLUME"
+                        }
+                      ]
+                    }
+                  },
+                  {
+                    "name": "policy_type",
+                    "description": "Type of the policy. Required on create.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "PolicyType",
+                      "enum": [
+                        {
+                          "content": "POLICY_TYPE_COLUMN_MASK"
+                        },
+                        {
+                          "content": "POLICY_TYPE_DENY"
+                        },
+                        {
+                          "content": "POLICY_TYPE_GRANT"
+                        },
+                        {
+                          "content": "POLICY_TYPE_ROW_FILTER"
+                        }
+                      ]
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "to_principals",
+                    "description": "List of user or group names that the policy applies to.\nRequired on create and optional on update.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "List",
+                      "array_value": {
+                        "is_string": true
+                      }
+                    }
+                  },
+                  {
+                    "name": "for_securable_type",
+                    "description": "Type of securables that the policy should take effect on.\nRequired on create and optional on update.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "SecurableType",
+                      "enum": [
+                        {
+                          "content": "AGENT_SERVICE"
+                        },
+                        {
+                          "content": "CATALOG"
+                        },
+                        {
+                          "content": "CLEAN_ROOM"
+                        },
+                        {
+                          "content": "CONNECTION"
+                        },
+                        {
+                          "content": "CREDENTIAL"
+                        },
+                        {
+                          "content": "EXTERNAL_LOCATION"
+                        },
+                        {
+                          "content": "EXTERNAL_METADATA"
+                        },
+                        {
+                          "content": "FUNCTION"
+                        },
+                        {
+                          "content": "MCP_SERVICE"
+                        },
+                        {
+                          "content": "METASTORE"
+                        },
+                        {
+                          "content": "MODEL"
+                        },
+                        {
+                          "content": "MODEL_PROVIDER_SERVICE"
+                        },
+                        {
+                          "content": "MODEL_SERVICE"
+                        },
+                        {
+                          "content": "PIPELINE"
+                        },
+                        {
+                          "content": "PROVIDER"
+                        },
+                        {
+                          "content": "RECIPIENT"
+                        },
+                        {
+                          "content": "SCHEMA"
+                        },
+                        {
+                          "content": "SHARE"
+                        },
+                        {
+                          "content": "SKILL"
+                        },
+                        {
+                          "content": "STAGING_TABLE"
+                        },
+                        {
+                          "content": "STORAGE_CREDENTIAL"
+                        },
+                        {
+                          "content": "TABLE"
+                        },
+                        {
+                          "content": "VOLUME"
+                        }
+                      ]
+                    }
+                  },
+                  {
+                    "name": "policy_type",
+                    "description": "Type of the policy. Required on create.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "PolicyType",
+                      "enum": [
+                        {
+                          "content": "POLICY_TYPE_COLUMN_MASK"
+                        },
+                        {
+                          "content": "POLICY_TYPE_DENY"
+                        },
+                        {
+                          "content": "POLICY_TYPE_GRANT"
+                        },
+                        {
+                          "content": "POLICY_TYPE_ROW_FILTER"
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "PolicyInfo",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "to_principals",
+                  "description": "List of user or group names that the policy applies to.\nRequired on create and optional on update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "List",
+                    "array_value": {
+                      "is_string": true
+                    }
+                  }
+                },
+                {
+                  "name": "for_securable_type",
+                  "description": "Type of securables that the policy should take effect on.\nRequired on create and optional on update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "SecurableType",
+                    "enum": [
+                      {
+                        "content": "AGENT_SERVICE"
+                      },
+                      {
+                        "content": "CATALOG"
+                      },
+                      {
+                        "content": "CLEAN_ROOM"
+                      },
+                      {
+                        "content": "CONNECTION"
+                      },
+                      {
+                        "content": "CREDENTIAL"
+                      },
+                      {
+                        "content": "EXTERNAL_LOCATION"
+                      },
+                      {
+                        "content": "EXTERNAL_METADATA"
+                      },
+                      {
+                        "content": "FUNCTION"
+                      },
+                      {
+                        "content": "MCP_SERVICE"
+                      },
+                      {
+                        "content": "METASTORE"
+                      },
+                      {
+                        "content": "MODEL"
+                      },
+                      {
+                        "content": "MODEL_PROVIDER_SERVICE"
+                      },
+                      {
+                        "content": "MODEL_SERVICE"
+                      },
+                      {
+                        "content": "PIPELINE"
+                      },
+                      {
+                        "content": "PROVIDER"
+                      },
+                      {
+                        "content": "RECIPIENT"
+                      },
+                      {
+                        "content": "SCHEMA"
+                      },
+                      {
+                        "content": "SHARE"
+                      },
+                      {
+                        "content": "SKILL"
+                      },
+                      {
+                        "content": "STAGING_TABLE"
+                      },
+                      {
+                        "content": "STORAGE_CREDENTIAL"
+                      },
+                      {
+                        "content": "TABLE"
+                      },
+                      {
+                        "content": "VOLUME"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "policy_type",
+                  "description": "Type of the policy. Required on create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PolicyType",
+                    "enum": [
+                      {
+                        "content": "POLICY_TYPE_COLUMN_MASK"
+                      },
+                      {
+                        "content": "POLICY_TYPE_DENY"
+                      },
+                      {
+                        "content": "POLICY_TYPE_GRANT"
+                      },
+                      {
+                        "content": "POLICY_TYPE_ROW_FILTER"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "to_principals",
+                  "description": "List of user or group names that the policy applies to.\nRequired on create and optional on update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "List",
+                    "array_value": {
+                      "is_string": true
+                    }
+                  }
+                },
+                {
+                  "name": "for_securable_type",
+                  "description": "Type of securables that the policy should take effect on.\nRequired on create and optional on update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "SecurableType",
+                    "enum": [
+                      {
+                        "content": "AGENT_SERVICE"
+                      },
+                      {
+                        "content": "CATALOG"
+                      },
+                      {
+                        "content": "CLEAN_ROOM"
+                      },
+                      {
+                        "content": "CONNECTION"
+                      },
+                      {
+                        "content": "CREDENTIAL"
+                      },
+                      {
+                        "content": "EXTERNAL_LOCATION"
+                      },
+                      {
+                        "content": "EXTERNAL_METADATA"
+                      },
+                      {
+                        "content": "FUNCTION"
+                      },
+                      {
+                        "content": "MCP_SERVICE"
+                      },
+                      {
+                        "content": "METASTORE"
+                      },
+                      {
+                        "content": "MODEL"
+                      },
+                      {
+                        "content": "MODEL_PROVIDER_SERVICE"
+                      },
+                      {
+                        "content": "MODEL_SERVICE"
+                      },
+                      {
+                        "content": "PIPELINE"
+                      },
+                      {
+                        "content": "PROVIDER"
+                      },
+                      {
+                        "content": "RECIPIENT"
+                      },
+                      {
+                        "content": "SCHEMA"
+                      },
+                      {
+                        "content": "SHARE"
+                      },
+                      {
+                        "content": "SKILL"
+                      },
+                      {
+                        "content": "STAGING_TABLE"
+                      },
+                      {
+                        "content": "STORAGE_CREDENTIAL"
+                      },
+                      {
+                        "content": "TABLE"
+                      },
+                      {
+                        "content": "VOLUME"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "policy_type",
+                  "description": "Type of the policy. Required on create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PolicyType",
+                    "enum": [
+                      {
+                        "content": "POLICY_TYPE_COLUMN_MASK"
+                      },
+                      {
+                        "content": "POLICY_TYPE_DENY"
+                      },
+                      {
+                        "content": "POLICY_TYPE_GRANT"
+                      },
+                      {
+                        "content": "POLICY_TYPE_ROW_FILTER"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "policy_info",
+                "description": "Required. The policy to create.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PolicyInfo",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "to_principals",
+                      "description": "List of user or group names that the policy applies to.\nRequired on create and optional on update.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "List",
+                        "array_value": {
+                          "is_string": true
+                        }
+                      }
+                    },
+                    {
+                      "name": "for_securable_type",
+                      "description": "Type of securables that the policy should take effect on.\nRequired on create and optional on update.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "SecurableType",
+                        "enum": [
+                          {
+                            "content": "AGENT_SERVICE"
+                          },
+                          {
+                            "content": "CATALOG"
+                          },
+                          {
+                            "content": "CLEAN_ROOM"
+                          },
+                          {
+                            "content": "CONNECTION"
+                          },
+                          {
+                            "content": "CREDENTIAL"
+                          },
+                          {
+                            "content": "EXTERNAL_LOCATION"
+                          },
+                          {
+                            "content": "EXTERNAL_METADATA"
+                          },
+                          {
+                            "content": "FUNCTION"
+                          },
+                          {
+                            "content": "MCP_SERVICE"
+                          },
+                          {
+                            "content": "METASTORE"
+                          },
+                          {
+                            "content": "MODEL"
+                          },
+                          {
+                            "content": "MODEL_PROVIDER_SERVICE"
+                          },
+                          {
+                            "content": "MODEL_SERVICE"
+                          },
+                          {
+                            "content": "PIPELINE"
+                          },
+                          {
+                            "content": "PROVIDER"
+                          },
+                          {
+                            "content": "RECIPIENT"
+                          },
+                          {
+                            "content": "SCHEMA"
+                          },
+                          {
+                            "content": "SHARE"
+                          },
+                          {
+                            "content": "SKILL"
+                          },
+                          {
+                            "content": "STAGING_TABLE"
+                          },
+                          {
+                            "content": "STORAGE_CREDENTIAL"
+                          },
+                          {
+                            "content": "TABLE"
+                          },
+                          {
+                            "content": "VOLUME"
+                          }
+                        ]
+                      }
+                    },
+                    {
+                      "name": "policy_type",
+                      "description": "Type of the policy. Required on create.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "PolicyType",
+                        "enum": [
+                          {
+                            "content": "POLICY_TYPE_COLUMN_MASK"
+                          },
+                          {
+                            "content": "POLICY_TYPE_DENY"
+                          },
+                          {
+                            "content": "POLICY_TYPE_GRANT"
+                          },
+                          {
+                            "content": "POLICY_TYPE_ROW_FILTER"
+                          }
+                        ]
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "to_principals",
+                      "description": "List of user or group names that the policy applies to.\nRequired on create and optional on update.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "List",
+                        "array_value": {
+                          "is_string": true
+                        }
+                      }
+                    },
+                    {
+                      "name": "for_securable_type",
+                      "description": "Type of securables that the policy should take effect on.\nRequired on create and optional on update.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "SecurableType",
+                        "enum": [
+                          {
+                            "content": "AGENT_SERVICE"
+                          },
+                          {
+                            "content": "CATALOG"
+                          },
+                          {
+                            "content": "CLEAN_ROOM"
+                          },
+                          {
+                            "content": "CONNECTION"
+                          },
+                          {
+                            "content": "CREDENTIAL"
+                          },
+                          {
+                            "content": "EXTERNAL_LOCATION"
+                          },
+                          {
+                            "content": "EXTERNAL_METADATA"
+                          },
+                          {
+                            "content": "FUNCTION"
+                          },
+                          {
+                            "content": "MCP_SERVICE"
+                          },
+                          {
+                            "content": "METASTORE"
+                          },
+                          {
+                            "content": "MODEL"
+                          },
+                          {
+                            "content": "MODEL_PROVIDER_SERVICE"
+                          },
+                          {
+                            "content": "MODEL_SERVICE"
+                          },
+                          {
+                            "content": "PIPELINE"
+                          },
+                          {
+                            "content": "PROVIDER"
+                          },
+                          {
+                            "content": "RECIPIENT"
+                          },
+                          {
+                            "content": "SCHEMA"
+                          },
+                          {
+                            "content": "SHARE"
+                          },
+                          {
+                            "content": "SKILL"
+                          },
+                          {
+                            "content": "STAGING_TABLE"
+                          },
+                          {
+                            "content": "STORAGE_CREDENTIAL"
+                          },
+                          {
+                            "content": "TABLE"
+                          },
+                          {
+                            "content": "VOLUME"
+                          }
+                        ]
+                      }
+                    },
+                    {
+                      "name": "policy_type",
+                      "description": "Type of the policy. Required on create.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "PolicyType",
+                        "enum": [
+                          {
+                            "content": "POLICY_TYPE_COLUMN_MASK"
+                          },
+                          {
+                            "content": "POLICY_TYPE_DENY"
+                          },
+                          {
+                            "content": "POLICY_TYPE_GRANT"
+                          },
+                          {
+                            "content": "POLICY_TYPE_ROW_FILTER"
+                          }
+                        ]
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "column_mask",
+                "description": "Options for column mask policies. Valid only if `policy_type` is `POLICY_TYPE_COLUMN_MASK`.\nRequired on create and optional on update. When specified on update,\nthe new options will replace the existing options as a whole.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "ColumnMaskOptions",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "comment",
+                "description": "Optional description of the policy.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "created_at",
+                "description": "Time at which the policy was created, in epoch milliseconds. Output only.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "created_by",
+                "description": "Username of the user who created the policy. Output only.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "deny",
+                "description": "Options for deny policies. Valid only if `policy_type` is `POLICY_TYPE_DENY`.\nRequired on create and optional on update. When specified on update,\nthe new options will replace the existing options as a whole.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "DenyOptions",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "except_principals",
+                "description": "Optional list of user or group names that should be excluded from the policy.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "for_securable_type",
+                "description": "Type of securables that the policy should take effect on.\nRequired on create and optional on update.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "SecurableType",
+                  "enum": [
+                    {
+                      "content": "AGENT_SERVICE"
+                    },
+                    {
+                      "content": "CATALOG"
+                    },
+                    {
+                      "content": "CLEAN_ROOM"
+                    },
+                    {
+                      "content": "CONNECTION"
+                    },
+                    {
+                      "content": "CREDENTIAL"
+                    },
+                    {
+                      "content": "EXTERNAL_LOCATION"
+                    },
+                    {
+                      "content": "EXTERNAL_METADATA"
+                    },
+                    {
+                      "content": "FUNCTION"
+                    },
+                    {
+                      "content": "MCP_SERVICE"
+                    },
+                    {
+                      "content": "METASTORE"
+                    },
+                    {
+                      "content": "MODEL"
+                    },
+                    {
+                      "content": "MODEL_PROVIDER_SERVICE"
+                    },
+                    {
+                      "content": "MODEL_SERVICE"
+                    },
+                    {
+                      "content": "PIPELINE"
+                    },
+                    {
+                      "content": "PROVIDER"
+                    },
+                    {
+                      "content": "RECIPIENT"
+                    },
+                    {
+                      "content": "SCHEMA"
+                    },
+                    {
+                      "content": "SHARE"
+                    },
+                    {
+                      "content": "SKILL"
+                    },
+                    {
+                      "content": "STAGING_TABLE"
+                    },
+                    {
+                      "content": "STORAGE_CREDENTIAL"
+                    },
+                    {
+                      "content": "TABLE"
+                    },
+                    {
+                      "content": "VOLUME"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "governed_tags",
+                "description": "Governed tag keys and values referenced by this policy's conditions and function arguments. Output only.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "GovernedTagReferenceList",
+                  "array_value": {
+                    "pascal_name": "GovernedTagReference",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "grant",
+                "description": "Options for grant policies. Valid only if `policy_type` is `POLICY_TYPE_GRANT`.\nRequired on create and optional on update. When specified on update,\nthe new options will replace the existing options as a whole.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "GrantOptions",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "id",
+                "description": "Unique identifier of the policy. This field is output only and is generated by the system.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "match_columns",
+                "description": "Optional list of condition expressions used to match table columns.\nOnly valid when `for_securable_type` is `TABLE`.\nWhen specified, the policy only applies to tables whose columns satisfy all match conditions.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "MatchColumnList",
+                  "array_value": {
+                    "pascal_name": "MatchColumn",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the policy. Required on create and optional on update.\nTo rename the policy, set `name` to a different value on update.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "on_securable_fullname",
+                "description": "Full name of the securable on which the policy is defined.\nRequired on create.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "on_securable_type",
+                "description": "Type of the securable on which the policy is defined.\nOnly `CATALOG`, `SCHEMA` and `TABLE` are supported at this moment.\nRequired on create.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "SecurableType",
+                  "enum": [
+                    {
+                      "content": "AGENT_SERVICE"
+                    },
+                    {
+                      "content": "CATALOG"
+                    },
+                    {
+                      "content": "CLEAN_ROOM"
+                    },
+                    {
+                      "content": "CONNECTION"
+                    },
+                    {
+                      "content": "CREDENTIAL"
+                    },
+                    {
+                      "content": "EXTERNAL_LOCATION"
+                    },
+                    {
+                      "content": "EXTERNAL_METADATA"
+                    },
+                    {
+                      "content": "FUNCTION"
+                    },
+                    {
+                      "content": "MCP_SERVICE"
+                    },
+                    {
+                      "content": "METASTORE"
+                    },
+                    {
+                      "content": "MODEL"
+                    },
+                    {
+                      "content": "MODEL_PROVIDER_SERVICE"
+                    },
+                    {
+                      "content": "MODEL_SERVICE"
+                    },
+                    {
+                      "content": "PIPELINE"
+                    },
+                    {
+                      "content": "PROVIDER"
+                    },
+                    {
+                      "content": "RECIPIENT"
+                    },
+                    {
+                      "content": "SCHEMA"
+                    },
+                    {
+                      "content": "SHARE"
+                    },
+                    {
+                      "content": "SKILL"
+                    },
+                    {
+                      "content": "STAGING_TABLE"
+                    },
+                    {
+                      "content": "STORAGE_CREDENTIAL"
+                    },
+                    {
+                      "content": "TABLE"
+                    },
+                    {
+                      "content": "VOLUME"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "policy_type",
+                "description": "Type of the policy. Required on create.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PolicyType",
+                  "enum": [
+                    {
+                      "content": "POLICY_TYPE_COLUMN_MASK"
+                    },
+                    {
+                      "content": "POLICY_TYPE_DENY"
+                    },
+                    {
+                      "content": "POLICY_TYPE_GRANT"
+                    },
+                    {
+                      "content": "POLICY_TYPE_ROW_FILTER"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "row_filter",
+                "description": "Options for row filter policies. Valid only if `policy_type` is `POLICY_TYPE_ROW_FILTER`.\nRequired on create and optional on update. When specified on update,\nthe new options will replace the existing options as a whole.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "RowFilterOptions",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "to_principals",
+                "description": "List of user or group names that the policy applies to.\nRequired on create and optional on update.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "updated_at",
+                "description": "Time at which the policy was last modified, in epoch milliseconds. Output only.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "updated_by",
+                "description": "Username of the user who last modified the policy. Output only.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "when_condition",
+                "description": "Optional condition when the policy should take effect.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "to_principals",
+                "description": "List of user or group names that the policy applies to.\nRequired on create and optional on update.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "for_securable_type",
+                "description": "Type of securables that the policy should take effect on.\nRequired on create and optional on update.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "SecurableType",
+                  "enum": [
+                    {
+                      "content": "AGENT_SERVICE"
+                    },
+                    {
+                      "content": "CATALOG"
+                    },
+                    {
+                      "content": "CLEAN_ROOM"
+                    },
+                    {
+                      "content": "CONNECTION"
+                    },
+                    {
+                      "content": "CREDENTIAL"
+                    },
+                    {
+                      "content": "EXTERNAL_LOCATION"
+                    },
+                    {
+                      "content": "EXTERNAL_METADATA"
+                    },
+                    {
+                      "content": "FUNCTION"
+                    },
+                    {
+                      "content": "MCP_SERVICE"
+                    },
+                    {
+                      "content": "METASTORE"
+                    },
+                    {
+                      "content": "MODEL"
+                    },
+                    {
+                      "content": "MODEL_PROVIDER_SERVICE"
+                    },
+                    {
+                      "content": "MODEL_SERVICE"
+                    },
+                    {
+                      "content": "PIPELINE"
+                    },
+                    {
+                      "content": "PROVIDER"
+                    },
+                    {
+                      "content": "RECIPIENT"
+                    },
+                    {
+                      "content": "SCHEMA"
+                    },
+                    {
+                      "content": "SHARE"
+                    },
+                    {
+                      "content": "SKILL"
+                    },
+                    {
+                      "content": "STAGING_TABLE"
+                    },
+                    {
+                      "content": "STORAGE_CREDENTIAL"
+                    },
+                    {
+                      "content": "TABLE"
+                    },
+                    {
+                      "content": "VOLUME"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "policy_type",
+                "description": "Type of the policy. Required on create.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PolicyType",
+                  "enum": [
+                    {
+                      "content": "POLICY_TYPE_COLUMN_MASK"
+                    },
+                    {
+                      "content": "POLICY_TYPE_DENY"
+                    },
+                    {
+                      "content": "POLICY_TYPE_GRANT"
+                    },
+                    {
+                      "content": "POLICY_TYPE_ROW_FILTER"
+                    }
+                  ]
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeletePolicy",
+            "description": "Delete an ABAC policy defined on a securable.",
+            "summary": "Delete an ABAC policy.",
+            "path": "/api/2.1/unity-catalog/policies/{on_securable_type}/{on_securable_fullname}/{name}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeletePolicyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "on_securable_type",
+                  "description": "Required. The type of the securable to delete the policy from.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "on_securable_fullname",
+                  "description": "Required. The fully qualified name of the securable to delete the policy from.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "name",
+                  "description": "Required. The name of the policy to delete",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "on_securable_type",
+                  "description": "Required. The type of the securable to delete the policy from.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "on_securable_fullname",
+                  "description": "Required. The fully qualified name of the securable to delete the policy from.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "name",
+                  "description": "Required. The name of the policy to delete",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeletePolicyResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Required. The name of the policy to delete",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "on_securable_fullname",
+                "description": "Required. The fully qualified name of the securable to delete the policy from.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "on_securable_type",
+                "description": "Required. The type of the securable to delete the policy from.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "on_securable_type",
+                "description": "Required. The type of the securable to delete the policy from.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "on_securable_fullname",
+                "description": "Required. The fully qualified name of the securable to delete the policy from.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Required. The name of the policy to delete",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetPolicy",
+            "description": "Get the policy definition on a securable",
+            "summary": "Get an ABAC policy.",
+            "path": "/api/2.1/unity-catalog/policies/{on_securable_type}/{on_securable_fullname}/{name}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetPolicyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "on_securable_type",
+                  "description": "Required. The type of the securable to retrieve the policy for.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "on_securable_fullname",
+                  "description": "Required. The fully qualified name of securable to retrieve policy for.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "name",
+                  "description": "Required. The name of the policy to retrieve.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "on_securable_type",
+                  "description": "Required. The type of the securable to retrieve the policy for.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "on_securable_fullname",
+                  "description": "Required. The fully qualified name of securable to retrieve policy for.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "name",
+                  "description": "Required. The name of the policy to retrieve.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "PolicyInfo",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "to_principals",
+                  "description": "List of user or group names that the policy applies to.\nRequired on create and optional on update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "List",
+                    "array_value": {
+                      "is_string": true
+                    }
+                  }
+                },
+                {
+                  "name": "for_securable_type",
+                  "description": "Type of securables that the policy should take effect on.\nRequired on create and optional on update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "SecurableType",
+                    "enum": [
+                      {
+                        "content": "AGENT_SERVICE"
+                      },
+                      {
+                        "content": "CATALOG"
+                      },
+                      {
+                        "content": "CLEAN_ROOM"
+                      },
+                      {
+                        "content": "CONNECTION"
+                      },
+                      {
+                        "content": "CREDENTIAL"
+                      },
+                      {
+                        "content": "EXTERNAL_LOCATION"
+                      },
+                      {
+                        "content": "EXTERNAL_METADATA"
+                      },
+                      {
+                        "content": "FUNCTION"
+                      },
+                      {
+                        "content": "MCP_SERVICE"
+                      },
+                      {
+                        "content": "METASTORE"
+                      },
+                      {
+                        "content": "MODEL"
+                      },
+                      {
+                        "content": "MODEL_PROVIDER_SERVICE"
+                      },
+                      {
+                        "content": "MODEL_SERVICE"
+                      },
+                      {
+                        "content": "PIPELINE"
+                      },
+                      {
+                        "content": "PROVIDER"
+                      },
+                      {
+                        "content": "RECIPIENT"
+                      },
+                      {
+                        "content": "SCHEMA"
+                      },
+                      {
+                        "content": "SHARE"
+                      },
+                      {
+                        "content": "SKILL"
+                      },
+                      {
+                        "content": "STAGING_TABLE"
+                      },
+                      {
+                        "content": "STORAGE_CREDENTIAL"
+                      },
+                      {
+                        "content": "TABLE"
+                      },
+                      {
+                        "content": "VOLUME"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "policy_type",
+                  "description": "Type of the policy. Required on create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PolicyType",
+                    "enum": [
+                      {
+                        "content": "POLICY_TYPE_COLUMN_MASK"
+                      },
+                      {
+                        "content": "POLICY_TYPE_DENY"
+                      },
+                      {
+                        "content": "POLICY_TYPE_GRANT"
+                      },
+                      {
+                        "content": "POLICY_TYPE_ROW_FILTER"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "to_principals",
+                  "description": "List of user or group names that the policy applies to.\nRequired on create and optional on update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "List",
+                    "array_value": {
+                      "is_string": true
+                    }
+                  }
+                },
+                {
+                  "name": "for_securable_type",
+                  "description": "Type of securables that the policy should take effect on.\nRequired on create and optional on update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "SecurableType",
+                    "enum": [
+                      {
+                        "content": "AGENT_SERVICE"
+                      },
+                      {
+                        "content": "CATALOG"
+                      },
+                      {
+                        "content": "CLEAN_ROOM"
+                      },
+                      {
+                        "content": "CONNECTION"
+                      },
+                      {
+                        "content": "CREDENTIAL"
+                      },
+                      {
+                        "content": "EXTERNAL_LOCATION"
+                      },
+                      {
+                        "content": "EXTERNAL_METADATA"
+                      },
+                      {
+                        "content": "FUNCTION"
+                      },
+                      {
+                        "content": "MCP_SERVICE"
+                      },
+                      {
+                        "content": "METASTORE"
+                      },
+                      {
+                        "content": "MODEL"
+                      },
+                      {
+                        "content": "MODEL_PROVIDER_SERVICE"
+                      },
+                      {
+                        "content": "MODEL_SERVICE"
+                      },
+                      {
+                        "content": "PIPELINE"
+                      },
+                      {
+                        "content": "PROVIDER"
+                      },
+                      {
+                        "content": "RECIPIENT"
+                      },
+                      {
+                        "content": "SCHEMA"
+                      },
+                      {
+                        "content": "SHARE"
+                      },
+                      {
+                        "content": "SKILL"
+                      },
+                      {
+                        "content": "STAGING_TABLE"
+                      },
+                      {
+                        "content": "STORAGE_CREDENTIAL"
+                      },
+                      {
+                        "content": "TABLE"
+                      },
+                      {
+                        "content": "VOLUME"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "policy_type",
+                  "description": "Type of the policy. Required on create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PolicyType",
+                    "enum": [
+                      {
+                        "content": "POLICY_TYPE_COLUMN_MASK"
+                      },
+                      {
+                        "content": "POLICY_TYPE_DENY"
+                      },
+                      {
+                        "content": "POLICY_TYPE_GRANT"
+                      },
+                      {
+                        "content": "POLICY_TYPE_ROW_FILTER"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Required. The name of the policy to retrieve.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "on_securable_fullname",
+                "description": "Required. The fully qualified name of securable to retrieve policy for.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "on_securable_type",
+                "description": "Required. The type of the securable to retrieve the policy for.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "on_securable_type",
+                "description": "Required. The type of the securable to retrieve the policy for.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "on_securable_fullname",
+                "description": "Required. The fully qualified name of securable to retrieve policy for.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Required. The name of the policy to retrieve.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListPolicies",
+            "description": "List all policies defined on a securable.\nOptionally, the list can include inherited policies defined on the securable's parent schema or catalog.\n\nPAGINATION BEHAVIOR: The API is by default paginated, a page may contain zero results while still providing a next_page_token.\nClients must continue reading pages until next_page_token is absent, which is the only indication that the end of results has been reached.",
+            "summary": "List ABAC policies.",
+            "path": "/api/2.1/unity-catalog/policies/{on_securable_type}/{on_securable_fullname}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListPoliciesRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "on_securable_type",
+                  "description": "Required. The type of the securable to list policies for.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "on_securable_fullname",
+                  "description": "Required. The fully qualified name of securable to list policies for.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "on_securable_type",
+                  "description": "Required. The type of the securable to list policies for.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "on_securable_fullname",
+                  "description": "Required. The fully qualified name of securable to list policies for.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListPoliciesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "include_inherited",
+                "description": "Optional. Whether to include policies defined on parent securables.\nBy default, the inherited policies are not included.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "max_results",
+                "description": "Optional.  Maximum number of policies to return on a single page (page length).\n- When not set or set to 0, the page length is set to a server configured value (recommended);\n- When set to a value greater than 0, the page length is the minimum of this value and a server configured value;",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "on_securable_fullname",
+                "description": "Required. The fully qualified name of securable to list policies for.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "on_securable_type",
+                "description": "Required. The type of the securable to list policies for.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Optional. Opaque pagination token to go to next page based on previous query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "on_securable_type",
+                "description": "Required. The type of the securable to list policies for.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "on_securable_fullname",
+                "description": "Required. The fully qualified name of securable to list policies for.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Optional. Opaque pagination token to go to next page based on previous query.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "UpdatePolicy",
+            "description": "Update an ABAC policy on a securable.",
+            "summary": "Update an ABAC policy.",
+            "path": "/api/2.1/unity-catalog/policies/{on_securable_type}/{on_securable_fullname}/{name}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdatePolicyRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "on_securable_type",
+                  "description": "Required. The type of the securable to update the policy for.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "on_securable_fullname",
+                  "description": "Required. The fully qualified name of the securable to update the policy for.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "name",
+                  "description": "Required. The name of the policy to update.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "policy_info",
+                  "description": "Optional fields to update. This is the request body for updating a policy.\nUse `update_mask` field to specify which fields in the request is to be updated.\n- If `update_mask` is empty or \"*\", all specified fields will be updated.\n- If `update_mask` is specified, only the fields specified in the `update_mask` will be updated.\nIf a field is specified in `update_mask` and not set in the request, the field will be cleared.\nUsers can use the update mask to explicitly unset optional fields such as\n`exception_principals` and `when_condition`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PolicyInfo",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "on_securable_type",
+                  "description": "Required. The type of the securable to update the policy for.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "on_securable_fullname",
+                  "description": "Required. The fully qualified name of the securable to update the policy for.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "name",
+                  "description": "Required. The name of the policy to update.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "policy_info",
+                  "description": "Optional fields to update. This is the request body for updating a policy.\nUse `update_mask` field to specify which fields in the request is to be updated.\n- If `update_mask` is empty or \"*\", all specified fields will be updated.\n- If `update_mask` is specified, only the fields specified in the `update_mask` will be updated.\nIf a field is specified in `update_mask` and not set in the request, the field will be cleared.\nUsers can use the update mask to explicitly unset optional fields such as\n`exception_principals` and `when_condition`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PolicyInfo",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "policy_info",
+              "description": "Optional fields to update. This is the request body for updating a policy.\nUse `update_mask` field to specify which fields in the request is to be updated.\n- If `update_mask` is empty or \"*\", all specified fields will be updated.\n- If `update_mask` is specified, only the fields specified in the `update_mask` will be updated.\nIf a field is specified in `update_mask` and not set in the request, the field will be cleared.\nUsers can use the update mask to explicitly unset optional fields such as\n`exception_principals` and `when_condition`.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "PolicyInfo",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "to_principals",
+                    "description": "List of user or group names that the policy applies to.\nRequired on create and optional on update.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "List",
+                      "array_value": {
+                        "is_string": true
+                      }
+                    }
+                  },
+                  {
+                    "name": "for_securable_type",
+                    "description": "Type of securables that the policy should take effect on.\nRequired on create and optional on update.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "SecurableType",
+                      "enum": [
+                        {
+                          "content": "AGENT_SERVICE"
+                        },
+                        {
+                          "content": "CATALOG"
+                        },
+                        {
+                          "content": "CLEAN_ROOM"
+                        },
+                        {
+                          "content": "CONNECTION"
+                        },
+                        {
+                          "content": "CREDENTIAL"
+                        },
+                        {
+                          "content": "EXTERNAL_LOCATION"
+                        },
+                        {
+                          "content": "EXTERNAL_METADATA"
+                        },
+                        {
+                          "content": "FUNCTION"
+                        },
+                        {
+                          "content": "MCP_SERVICE"
+                        },
+                        {
+                          "content": "METASTORE"
+                        },
+                        {
+                          "content": "MODEL"
+                        },
+                        {
+                          "content": "MODEL_PROVIDER_SERVICE"
+                        },
+                        {
+                          "content": "MODEL_SERVICE"
+                        },
+                        {
+                          "content": "PIPELINE"
+                        },
+                        {
+                          "content": "PROVIDER"
+                        },
+                        {
+                          "content": "RECIPIENT"
+                        },
+                        {
+                          "content": "SCHEMA"
+                        },
+                        {
+                          "content": "SHARE"
+                        },
+                        {
+                          "content": "SKILL"
+                        },
+                        {
+                          "content": "STAGING_TABLE"
+                        },
+                        {
+                          "content": "STORAGE_CREDENTIAL"
+                        },
+                        {
+                          "content": "TABLE"
+                        },
+                        {
+                          "content": "VOLUME"
+                        }
+                      ]
+                    }
+                  },
+                  {
+                    "name": "policy_type",
+                    "description": "Type of the policy. Required on create.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "PolicyType",
+                      "enum": [
+                        {
+                          "content": "POLICY_TYPE_COLUMN_MASK"
+                        },
+                        {
+                          "content": "POLICY_TYPE_DENY"
+                        },
+                        {
+                          "content": "POLICY_TYPE_GRANT"
+                        },
+                        {
+                          "content": "POLICY_TYPE_ROW_FILTER"
+                        }
+                      ]
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "to_principals",
+                    "description": "List of user or group names that the policy applies to.\nRequired on create and optional on update.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "List",
+                      "array_value": {
+                        "is_string": true
+                      }
+                    }
+                  },
+                  {
+                    "name": "for_securable_type",
+                    "description": "Type of securables that the policy should take effect on.\nRequired on create and optional on update.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "SecurableType",
+                      "enum": [
+                        {
+                          "content": "AGENT_SERVICE"
+                        },
+                        {
+                          "content": "CATALOG"
+                        },
+                        {
+                          "content": "CLEAN_ROOM"
+                        },
+                        {
+                          "content": "CONNECTION"
+                        },
+                        {
+                          "content": "CREDENTIAL"
+                        },
+                        {
+                          "content": "EXTERNAL_LOCATION"
+                        },
+                        {
+                          "content": "EXTERNAL_METADATA"
+                        },
+                        {
+                          "content": "FUNCTION"
+                        },
+                        {
+                          "content": "MCP_SERVICE"
+                        },
+                        {
+                          "content": "METASTORE"
+                        },
+                        {
+                          "content": "MODEL"
+                        },
+                        {
+                          "content": "MODEL_PROVIDER_SERVICE"
+                        },
+                        {
+                          "content": "MODEL_SERVICE"
+                        },
+                        {
+                          "content": "PIPELINE"
+                        },
+                        {
+                          "content": "PROVIDER"
+                        },
+                        {
+                          "content": "RECIPIENT"
+                        },
+                        {
+                          "content": "SCHEMA"
+                        },
+                        {
+                          "content": "SHARE"
+                        },
+                        {
+                          "content": "SKILL"
+                        },
+                        {
+                          "content": "STAGING_TABLE"
+                        },
+                        {
+                          "content": "STORAGE_CREDENTIAL"
+                        },
+                        {
+                          "content": "TABLE"
+                        },
+                        {
+                          "content": "VOLUME"
+                        }
+                      ]
+                    }
+                  },
+                  {
+                    "name": "policy_type",
+                    "description": "Type of the policy. Required on create.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "PolicyType",
+                      "enum": [
+                        {
+                          "content": "POLICY_TYPE_COLUMN_MASK"
+                        },
+                        {
+                          "content": "POLICY_TYPE_DENY"
+                        },
+                        {
+                          "content": "POLICY_TYPE_GRANT"
+                        },
+                        {
+                          "content": "POLICY_TYPE_ROW_FILTER"
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "PolicyInfo",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "to_principals",
+                  "description": "List of user or group names that the policy applies to.\nRequired on create and optional on update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "List",
+                    "array_value": {
+                      "is_string": true
+                    }
+                  }
+                },
+                {
+                  "name": "for_securable_type",
+                  "description": "Type of securables that the policy should take effect on.\nRequired on create and optional on update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "SecurableType",
+                    "enum": [
+                      {
+                        "content": "AGENT_SERVICE"
+                      },
+                      {
+                        "content": "CATALOG"
+                      },
+                      {
+                        "content": "CLEAN_ROOM"
+                      },
+                      {
+                        "content": "CONNECTION"
+                      },
+                      {
+                        "content": "CREDENTIAL"
+                      },
+                      {
+                        "content": "EXTERNAL_LOCATION"
+                      },
+                      {
+                        "content": "EXTERNAL_METADATA"
+                      },
+                      {
+                        "content": "FUNCTION"
+                      },
+                      {
+                        "content": "MCP_SERVICE"
+                      },
+                      {
+                        "content": "METASTORE"
+                      },
+                      {
+                        "content": "MODEL"
+                      },
+                      {
+                        "content": "MODEL_PROVIDER_SERVICE"
+                      },
+                      {
+                        "content": "MODEL_SERVICE"
+                      },
+                      {
+                        "content": "PIPELINE"
+                      },
+                      {
+                        "content": "PROVIDER"
+                      },
+                      {
+                        "content": "RECIPIENT"
+                      },
+                      {
+                        "content": "SCHEMA"
+                      },
+                      {
+                        "content": "SHARE"
+                      },
+                      {
+                        "content": "SKILL"
+                      },
+                      {
+                        "content": "STAGING_TABLE"
+                      },
+                      {
+                        "content": "STORAGE_CREDENTIAL"
+                      },
+                      {
+                        "content": "TABLE"
+                      },
+                      {
+                        "content": "VOLUME"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "policy_type",
+                  "description": "Type of the policy. Required on create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PolicyType",
+                    "enum": [
+                      {
+                        "content": "POLICY_TYPE_COLUMN_MASK"
+                      },
+                      {
+                        "content": "POLICY_TYPE_DENY"
+                      },
+                      {
+                        "content": "POLICY_TYPE_GRANT"
+                      },
+                      {
+                        "content": "POLICY_TYPE_ROW_FILTER"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "to_principals",
+                  "description": "List of user or group names that the policy applies to.\nRequired on create and optional on update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "List",
+                    "array_value": {
+                      "is_string": true
+                    }
+                  }
+                },
+                {
+                  "name": "for_securable_type",
+                  "description": "Type of securables that the policy should take effect on.\nRequired on create and optional on update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "SecurableType",
+                    "enum": [
+                      {
+                        "content": "AGENT_SERVICE"
+                      },
+                      {
+                        "content": "CATALOG"
+                      },
+                      {
+                        "content": "CLEAN_ROOM"
+                      },
+                      {
+                        "content": "CONNECTION"
+                      },
+                      {
+                        "content": "CREDENTIAL"
+                      },
+                      {
+                        "content": "EXTERNAL_LOCATION"
+                      },
+                      {
+                        "content": "EXTERNAL_METADATA"
+                      },
+                      {
+                        "content": "FUNCTION"
+                      },
+                      {
+                        "content": "MCP_SERVICE"
+                      },
+                      {
+                        "content": "METASTORE"
+                      },
+                      {
+                        "content": "MODEL"
+                      },
+                      {
+                        "content": "MODEL_PROVIDER_SERVICE"
+                      },
+                      {
+                        "content": "MODEL_SERVICE"
+                      },
+                      {
+                        "content": "PIPELINE"
+                      },
+                      {
+                        "content": "PROVIDER"
+                      },
+                      {
+                        "content": "RECIPIENT"
+                      },
+                      {
+                        "content": "SCHEMA"
+                      },
+                      {
+                        "content": "SHARE"
+                      },
+                      {
+                        "content": "SKILL"
+                      },
+                      {
+                        "content": "STAGING_TABLE"
+                      },
+                      {
+                        "content": "STORAGE_CREDENTIAL"
+                      },
+                      {
+                        "content": "TABLE"
+                      },
+                      {
+                        "content": "VOLUME"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "policy_type",
+                  "description": "Type of the policy. Required on create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PolicyType",
+                    "enum": [
+                      {
+                        "content": "POLICY_TYPE_COLUMN_MASK"
+                      },
+                      {
+                        "content": "POLICY_TYPE_DENY"
+                      },
+                      {
+                        "content": "POLICY_TYPE_GRANT"
+                      },
+                      {
+                        "content": "POLICY_TYPE_ROW_FILTER"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Required. The name of the policy to update.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "on_securable_fullname",
+                "description": "Required. The fully qualified name of the securable to update the policy for.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "on_securable_type",
+                "description": "Required. The type of the securable to update the policy for.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "policy_info",
+                "description": "Optional fields to update. This is the request body for updating a policy.\nUse `update_mask` field to specify which fields in the request is to be updated.\n- If `update_mask` is empty or \"*\", all specified fields will be updated.\n- If `update_mask` is specified, only the fields specified in the `update_mask` will be updated.\nIf a field is specified in `update_mask` and not set in the request, the field will be cleared.\nUsers can use the update mask to explicitly unset optional fields such as\n`exception_principals` and `when_condition`.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PolicyInfo",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "to_principals",
+                      "description": "List of user or group names that the policy applies to.\nRequired on create and optional on update.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "List",
+                        "array_value": {
+                          "is_string": true
+                        }
+                      }
+                    },
+                    {
+                      "name": "for_securable_type",
+                      "description": "Type of securables that the policy should take effect on.\nRequired on create and optional on update.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "SecurableType",
+                        "enum": [
+                          {
+                            "content": "AGENT_SERVICE"
+                          },
+                          {
+                            "content": "CATALOG"
+                          },
+                          {
+                            "content": "CLEAN_ROOM"
+                          },
+                          {
+                            "content": "CONNECTION"
+                          },
+                          {
+                            "content": "CREDENTIAL"
+                          },
+                          {
+                            "content": "EXTERNAL_LOCATION"
+                          },
+                          {
+                            "content": "EXTERNAL_METADATA"
+                          },
+                          {
+                            "content": "FUNCTION"
+                          },
+                          {
+                            "content": "MCP_SERVICE"
+                          },
+                          {
+                            "content": "METASTORE"
+                          },
+                          {
+                            "content": "MODEL"
+                          },
+                          {
+                            "content": "MODEL_PROVIDER_SERVICE"
+                          },
+                          {
+                            "content": "MODEL_SERVICE"
+                          },
+                          {
+                            "content": "PIPELINE"
+                          },
+                          {
+                            "content": "PROVIDER"
+                          },
+                          {
+                            "content": "RECIPIENT"
+                          },
+                          {
+                            "content": "SCHEMA"
+                          },
+                          {
+                            "content": "SHARE"
+                          },
+                          {
+                            "content": "SKILL"
+                          },
+                          {
+                            "content": "STAGING_TABLE"
+                          },
+                          {
+                            "content": "STORAGE_CREDENTIAL"
+                          },
+                          {
+                            "content": "TABLE"
+                          },
+                          {
+                            "content": "VOLUME"
+                          }
+                        ]
+                      }
+                    },
+                    {
+                      "name": "policy_type",
+                      "description": "Type of the policy. Required on create.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "PolicyType",
+                        "enum": [
+                          {
+                            "content": "POLICY_TYPE_COLUMN_MASK"
+                          },
+                          {
+                            "content": "POLICY_TYPE_DENY"
+                          },
+                          {
+                            "content": "POLICY_TYPE_GRANT"
+                          },
+                          {
+                            "content": "POLICY_TYPE_ROW_FILTER"
+                          }
+                        ]
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "to_principals",
+                      "description": "List of user or group names that the policy applies to.\nRequired on create and optional on update.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "List",
+                        "array_value": {
+                          "is_string": true
+                        }
+                      }
+                    },
+                    {
+                      "name": "for_securable_type",
+                      "description": "Type of securables that the policy should take effect on.\nRequired on create and optional on update.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "SecurableType",
+                        "enum": [
+                          {
+                            "content": "AGENT_SERVICE"
+                          },
+                          {
+                            "content": "CATALOG"
+                          },
+                          {
+                            "content": "CLEAN_ROOM"
+                          },
+                          {
+                            "content": "CONNECTION"
+                          },
+                          {
+                            "content": "CREDENTIAL"
+                          },
+                          {
+                            "content": "EXTERNAL_LOCATION"
+                          },
+                          {
+                            "content": "EXTERNAL_METADATA"
+                          },
+                          {
+                            "content": "FUNCTION"
+                          },
+                          {
+                            "content": "MCP_SERVICE"
+                          },
+                          {
+                            "content": "METASTORE"
+                          },
+                          {
+                            "content": "MODEL"
+                          },
+                          {
+                            "content": "MODEL_PROVIDER_SERVICE"
+                          },
+                          {
+                            "content": "MODEL_SERVICE"
+                          },
+                          {
+                            "content": "PIPELINE"
+                          },
+                          {
+                            "content": "PROVIDER"
+                          },
+                          {
+                            "content": "RECIPIENT"
+                          },
+                          {
+                            "content": "SCHEMA"
+                          },
+                          {
+                            "content": "SHARE"
+                          },
+                          {
+                            "content": "SKILL"
+                          },
+                          {
+                            "content": "STAGING_TABLE"
+                          },
+                          {
+                            "content": "STORAGE_CREDENTIAL"
+                          },
+                          {
+                            "content": "TABLE"
+                          },
+                          {
+                            "content": "VOLUME"
+                          }
+                        ]
+                      }
+                    },
+                    {
+                      "name": "policy_type",
+                      "description": "Type of the policy. Required on create.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "PolicyType",
+                        "enum": [
+                          {
+                            "content": "POLICY_TYPE_COLUMN_MASK"
+                          },
+                          {
+                            "content": "POLICY_TYPE_DENY"
+                          },
+                          {
+                            "content": "POLICY_TYPE_GRANT"
+                          },
+                          {
+                            "content": "POLICY_TYPE_ROW_FILTER"
+                          }
+                        ]
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Optional. The update mask field for specifying user intentions on which\nfields to update in the request.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "column_mask",
+                "description": "Options for column mask policies. Valid only if `policy_type` is `POLICY_TYPE_COLUMN_MASK`.\nRequired on create and optional on update. When specified on update,\nthe new options will replace the existing options as a whole.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "ColumnMaskOptions",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "comment",
+                "description": "Optional description of the policy.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "created_at",
+                "description": "Time at which the policy was created, in epoch milliseconds. Output only.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "created_by",
+                "description": "Username of the user who created the policy. Output only.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "deny",
+                "description": "Options for deny policies. Valid only if `policy_type` is `POLICY_TYPE_DENY`.\nRequired on create and optional on update. When specified on update,\nthe new options will replace the existing options as a whole.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "DenyOptions",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "except_principals",
+                "description": "Optional list of user or group names that should be excluded from the policy.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "for_securable_type",
+                "description": "Type of securables that the policy should take effect on.\nRequired on create and optional on update.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "SecurableType",
+                  "enum": [
+                    {
+                      "content": "AGENT_SERVICE"
+                    },
+                    {
+                      "content": "CATALOG"
+                    },
+                    {
+                      "content": "CLEAN_ROOM"
+                    },
+                    {
+                      "content": "CONNECTION"
+                    },
+                    {
+                      "content": "CREDENTIAL"
+                    },
+                    {
+                      "content": "EXTERNAL_LOCATION"
+                    },
+                    {
+                      "content": "EXTERNAL_METADATA"
+                    },
+                    {
+                      "content": "FUNCTION"
+                    },
+                    {
+                      "content": "MCP_SERVICE"
+                    },
+                    {
+                      "content": "METASTORE"
+                    },
+                    {
+                      "content": "MODEL"
+                    },
+                    {
+                      "content": "MODEL_PROVIDER_SERVICE"
+                    },
+                    {
+                      "content": "MODEL_SERVICE"
+                    },
+                    {
+                      "content": "PIPELINE"
+                    },
+                    {
+                      "content": "PROVIDER"
+                    },
+                    {
+                      "content": "RECIPIENT"
+                    },
+                    {
+                      "content": "SCHEMA"
+                    },
+                    {
+                      "content": "SHARE"
+                    },
+                    {
+                      "content": "SKILL"
+                    },
+                    {
+                      "content": "STAGING_TABLE"
+                    },
+                    {
+                      "content": "STORAGE_CREDENTIAL"
+                    },
+                    {
+                      "content": "TABLE"
+                    },
+                    {
+                      "content": "VOLUME"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "governed_tags",
+                "description": "Governed tag keys and values referenced by this policy's conditions and function arguments. Output only.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "GovernedTagReferenceList",
+                  "array_value": {
+                    "pascal_name": "GovernedTagReference",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "grant",
+                "description": "Options for grant policies. Valid only if `policy_type` is `POLICY_TYPE_GRANT`.\nRequired on create and optional on update. When specified on update,\nthe new options will replace the existing options as a whole.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "GrantOptions",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "id",
+                "description": "Unique identifier of the policy. This field is output only and is generated by the system.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "match_columns",
+                "description": "Optional list of condition expressions used to match table columns.\nOnly valid when `for_securable_type` is `TABLE`.\nWhen specified, the policy only applies to tables whose columns satisfy all match conditions.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "MatchColumnList",
+                  "array_value": {
+                    "pascal_name": "MatchColumn",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the policy. Required on create and optional on update.\nTo rename the policy, set `name` to a different value on update.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "on_securable_fullname",
+                "description": "Full name of the securable on which the policy is defined.\nRequired on create.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "on_securable_type",
+                "description": "Type of the securable on which the policy is defined.\nOnly `CATALOG`, `SCHEMA` and `TABLE` are supported at this moment.\nRequired on create.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "SecurableType",
+                  "enum": [
+                    {
+                      "content": "AGENT_SERVICE"
+                    },
+                    {
+                      "content": "CATALOG"
+                    },
+                    {
+                      "content": "CLEAN_ROOM"
+                    },
+                    {
+                      "content": "CONNECTION"
+                    },
+                    {
+                      "content": "CREDENTIAL"
+                    },
+                    {
+                      "content": "EXTERNAL_LOCATION"
+                    },
+                    {
+                      "content": "EXTERNAL_METADATA"
+                    },
+                    {
+                      "content": "FUNCTION"
+                    },
+                    {
+                      "content": "MCP_SERVICE"
+                    },
+                    {
+                      "content": "METASTORE"
+                    },
+                    {
+                      "content": "MODEL"
+                    },
+                    {
+                      "content": "MODEL_PROVIDER_SERVICE"
+                    },
+                    {
+                      "content": "MODEL_SERVICE"
+                    },
+                    {
+                      "content": "PIPELINE"
+                    },
+                    {
+                      "content": "PROVIDER"
+                    },
+                    {
+                      "content": "RECIPIENT"
+                    },
+                    {
+                      "content": "SCHEMA"
+                    },
+                    {
+                      "content": "SHARE"
+                    },
+                    {
+                      "content": "SKILL"
+                    },
+                    {
+                      "content": "STAGING_TABLE"
+                    },
+                    {
+                      "content": "STORAGE_CREDENTIAL"
+                    },
+                    {
+                      "content": "TABLE"
+                    },
+                    {
+                      "content": "VOLUME"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "policy_type",
+                "description": "Type of the policy. Required on create.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PolicyType",
+                  "enum": [
+                    {
+                      "content": "POLICY_TYPE_COLUMN_MASK"
+                    },
+                    {
+                      "content": "POLICY_TYPE_DENY"
+                    },
+                    {
+                      "content": "POLICY_TYPE_GRANT"
+                    },
+                    {
+                      "content": "POLICY_TYPE_ROW_FILTER"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "row_filter",
+                "description": "Options for row filter policies. Valid only if `policy_type` is `POLICY_TYPE_ROW_FILTER`.\nRequired on create and optional on update. When specified on update,\nthe new options will replace the existing options as a whole.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "RowFilterOptions",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "to_principals",
+                "description": "List of user or group names that the policy applies to.\nRequired on create and optional on update.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "updated_at",
+                "description": "Time at which the policy was last modified, in epoch milliseconds. Output only.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "updated_by",
+                "description": "Username of the user who last modified the policy. Output only.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "when_condition",
+                "description": "Optional condition when the policy should take effect.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "on_securable_type",
+                "description": "Required. The type of the securable to update the policy for.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "on_securable_fullname",
+                "description": "Required. The fully qualified name of the securable to update the policy for.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Required. The name of the policy to update.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "to_principals",
+                "description": "List of user or group names that the policy applies to.\nRequired on create and optional on update.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "for_securable_type",
+                "description": "Type of securables that the policy should take effect on.\nRequired on create and optional on update.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "SecurableType",
+                  "enum": [
+                    {
+                      "content": "AGENT_SERVICE"
+                    },
+                    {
+                      "content": "CATALOG"
+                    },
+                    {
+                      "content": "CLEAN_ROOM"
+                    },
+                    {
+                      "content": "CONNECTION"
+                    },
+                    {
+                      "content": "CREDENTIAL"
+                    },
+                    {
+                      "content": "EXTERNAL_LOCATION"
+                    },
+                    {
+                      "content": "EXTERNAL_METADATA"
+                    },
+                    {
+                      "content": "FUNCTION"
+                    },
+                    {
+                      "content": "MCP_SERVICE"
+                    },
+                    {
+                      "content": "METASTORE"
+                    },
+                    {
+                      "content": "MODEL"
+                    },
+                    {
+                      "content": "MODEL_PROVIDER_SERVICE"
+                    },
+                    {
+                      "content": "MODEL_SERVICE"
+                    },
+                    {
+                      "content": "PIPELINE"
+                    },
+                    {
+                      "content": "PROVIDER"
+                    },
+                    {
+                      "content": "RECIPIENT"
+                    },
+                    {
+                      "content": "SCHEMA"
+                    },
+                    {
+                      "content": "SHARE"
+                    },
+                    {
+                      "content": "SKILL"
+                    },
+                    {
+                      "content": "STAGING_TABLE"
+                    },
+                    {
+                      "content": "STORAGE_CREDENTIAL"
+                    },
+                    {
+                      "content": "TABLE"
+                    },
+                    {
+                      "content": "VOLUME"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "policy_type",
+                "description": "Type of the policy. Required on create.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PolicyType",
+                  "enum": [
+                    {
+                      "content": "POLICY_TYPE_COLUMN_MASK"
+                    },
+                    {
+                      "content": "POLICY_TYPE_DENY"
+                    },
+                    {
+                      "content": "POLICY_TYPE_GRANT"
+                    },
+                    {
+                      "content": "POLICY_TYPE_ROW_FILTER"
+                    }
+                  ]
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "compute.PolicyComplianceForClusters",
+        "name": "PolicyComplianceForClusters",
+        "description": "The policy compliance APIs allow you to view and manage the policy compliance status\nof clusters in your workspace.\n\nA cluster is compliant with its policy if its configuration satisfies all its policy rules.\nClusters could be out of compliance if their policy was updated after the cluster was last edited.\n\nThe get and list compliance APIs allow you to view the policy compliance status of a cluster.\nThe enforce compliance API allows you to update a cluster to be compliant with the current version\nof its policy.",
+        "package": {
+          "name": "compute"
+        },
+        "docs_group": "compute",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "methods": [
+          {
+            "name": "CancelPendingClusterEnforcement",
+            "description": "Cancels a pending enforcement on a cluster. After canceling the pending enforcement,\nthe cluster will no longer update on the next termination or restart.\nPending enforcements cannot be canceled when a cluster is in `TERMINATING` state.\nOnly workspace admins can cancel pending enforcements.",
+            "summary": "Cancel pending policy enforcement for a cluster.",
+            "path": "/api/2.0/policies/clusters:cancelPendingClusterEnforcement",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CancelPendingClusterEnforcementRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "cluster_id",
+                  "description": "The ID of the cluster to cancel the pending enforcement for.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "cluster_id",
+                  "description": "The ID of the cluster to cancel the pending enforcement for.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CancelPendingClusterEnforcementResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "allow_missing",
+                "description": "If true and no pending enforcement exists, the request will succeed but no action\nwill be taken.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "cluster_id",
+                "description": "The ID of the cluster to cancel the pending enforcement for.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "cluster_id",
+                "description": "The ID of the cluster to cancel the pending enforcement for.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "EnforceCompliance",
+            "description": "Updates a cluster to be compliant with the current version of its policy.\n\nIf a cluster is updated while in a `TERMINATED` state, it will remain `TERMINATED`.\nThe next time the cluster is started, the new attributes will take effect.\n\nFor clusters in other states, the behavior depends on the `enforce_mode` used.\n\nClusters created by the Databricks Jobs, SDP, or Models services cannot be enforced by this API.\nInstead, use the \"Enforce job policy compliance\" API to enforce policy compliance on jobs.",
+            "summary": "Enforce cluster policy compliance.",
+            "path": "/api/2.0/policies/clusters/enforce-compliance",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "EnforceClusterComplianceRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "cluster_id",
+                  "description": "The ID of the cluster you want to enforce policy compliance on.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "cluster_id",
+                  "description": "The ID of the cluster you want to enforce policy compliance on.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "EnforceClusterComplianceResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "cluster_id",
+                "description": "The ID of the cluster you want to enforce policy compliance on.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "enforce_mode",
+                "description": "Determines how changes should be made to clusters that are not in `TERMINATED` state.\n\n- `ENFORCE_IMMEDIATELY`: If the cluster is in a `RUNNING` state, it will be restarted so\nthat the new attributes can take effect. For other states aside from `TERMINATED` state,\nthe request will be rejected.\n- `WAIT_FOR_TERMINATION`: The cluster is not immediately edited. Instead, a pending enforcement\nis scheduled to update the cluster when it terminates or restarts. When this occurs,\n`enforce_result` will contain `DEFERRED`. Only workspace admins can use this mode.\n\nRegardless of the enforce mode, clusters in `TERMINATED` state are immediately edited.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EnforcePolicyComplianceForClusterEnforceMode",
+                  "enum": [
+                    {
+                      "content": "ENFORCE_IMMEDIATELY"
+                    },
+                    {
+                      "content": "WAIT_FOR_TERMINATION"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "validate_only",
+                "description": "If set, previews the changes that would be made to a cluster\nto enforce compliance but does not update the cluster.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "cluster_id",
+                "description": "The ID of the cluster you want to enforce policy compliance on.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetCompliance",
+            "description": "Returns the policy compliance status of a cluster. Clusters could be out\nof compliance if their policy was updated after the cluster was last edited.",
+            "summary": "Get cluster policy compliance.",
+            "path": "/api/2.0/policies/clusters/get-compliance",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetClusterComplianceRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "cluster_id",
+                  "description": "The ID of the cluster to get the compliance status",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "cluster_id",
+                  "description": "The ID of the cluster to get the compliance status",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetClusterComplianceResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "cluster_id",
+                "description": "The ID of the cluster to get the compliance status",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "cluster_id",
+                "description": "The ID of the cluster to get the compliance status",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListCompliance",
+            "description": "Returns the policy compliance status of all clusters that use a\ngiven policy. Clusters could be out of compliance if their policy was\nupdated after the cluster was last edited.",
+            "summary": "List cluster policy compliance.",
+            "path": "/api/2.0/policies/clusters/list-compliance",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListClusterCompliancesRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "policy_id",
+                  "description": "Canonical unique identifier for the cluster policy.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "policy_id",
+                  "description": "Canonical unique identifier for the cluster policy.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListClusterCompliancesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "Use this field to specify the maximum number of results to be returned by the server.\nThe server may further constrain the maximum number of results returned in a\nsingle page.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "A page token that can be used to navigate to the next page or previous page as\nreturned by `next_page_token` or `prev_page_token`.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "policy_id",
+                "description": "Canonical unique identifier for the cluster policy.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "policy_id",
+                "description": "Canonical unique identifier for the cluster policy.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "A page token that can be used to navigate to the next page or previous page as\nreturned by `next_page_token` or `prev_page_token`.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          }
+        ]
+      },
+      {
+        "id": "jobs.PolicyComplianceForJobs",
+        "name": "PolicyComplianceForJobs",
+        "description": "The compliance APIs allow you to view and manage the policy compliance status of jobs\nin your workspace. This API currently only supports compliance controls for cluster policies.\n\nA job is in compliance if its cluster configurations satisfy the rules of all their respective\ncluster policies. A job could be out of compliance if a cluster policy it uses was updated after\nthe job was last edited. The job is considered out of compliance if any of its clusters no longer\ncomply with their updated policies.\n\nThe get and list compliance APIs allow you to view the policy compliance status of a job.\nThe enforce compliance API allows you to update a job so that it becomes compliant with all of its policies.",
+        "package": {
+          "name": "jobs"
+        },
+        "docs_group": "lakeflow",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "methods": [
+          {
+            "name": "EnforceCompliance",
+            "description": "Updates a job so the job clusters that are created when running\nthe job (specified in `new_cluster`) are compliant with the\ncurrent versions of their respective cluster policies.\nAll-purpose clusters used in the job will not be updated.",
+            "summary": "Enforce job policy compliance.",
+            "path": "/api/2.0/policies/jobs/enforce-compliance",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "EnforcePolicyComplianceRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "job_id",
+                  "description": "The ID of the job you want to enforce policy compliance on.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "job_id",
+                  "description": "The ID of the job you want to enforce policy compliance on.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "EnforcePolicyComplianceResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "job_id",
+                "description": "The ID of the job you want to enforce policy compliance on.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "validate_only",
+                "description": "If set, previews changes made to the job to comply with its policy, but\ndoes not update the job.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "job_id",
+                "description": "The ID of the job you want to enforce policy compliance on.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetCompliance",
+            "description": "Returns the policy compliance status of a job. Jobs could be out of\ncompliance if a cluster policy they use was updated after the job was\nlast edited and some of its job clusters no longer comply with\ntheir updated policies.",
+            "summary": "Get job policy compliance.",
+            "path": "/api/2.0/policies/jobs/get-compliance",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetPolicyComplianceRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "job_id",
+                  "description": "The ID of the job whose compliance status you are requesting.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "job_id",
+                  "description": "The ID of the job whose compliance status you are requesting.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetPolicyComplianceResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "job_id",
+                "description": "The ID of the job whose compliance status you are requesting.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "job_id",
+                "description": "The ID of the job whose compliance status you are requesting.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListCompliance",
+            "description": "Returns the policy compliance status of all jobs that use a\ngiven policy. Jobs could be out of compliance if a cluster policy they\nuse was updated after the job was last edited and its job\nclusters no longer comply with the updated policy.",
+            "summary": "List job policy compliance.",
+            "path": "/api/2.0/policies/jobs/list-compliance",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListJobComplianceRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "policy_id",
+                  "description": "Canonical unique identifier for the cluster policy.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "policy_id",
+                  "description": "Canonical unique identifier for the cluster policy.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListJobComplianceForPolicyResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "Use this field to specify the maximum number of results to be returned by the server.\nThe server may further constrain the maximum number of results returned in a\nsingle page.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "A page token that can be used to navigate to the next page or previous page as\nreturned by `next_page_token` or `prev_page_token`.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "policy_id",
+                "description": "Canonical unique identifier for the cluster policy.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "policy_id",
+                "description": "Canonical unique identifier for the cluster policy.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "A page token that can be used to navigate to the next page or previous page as\nreturned by `next_page_token` or `prev_page_token`.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          }
+        ]
+      },
+      {
+        "id": "compute.PolicyFamilies",
+        "name": "PolicyFamilies",
+        "description": "View available policy families. A policy family contains a policy definition providing best\npractices for configuring clusters for a particular use case.\n\nDatabricks manages and provides policy families for several common cluster use cases. You\ncannot create, edit, or delete policy families.\n\nPolicy families cannot be used directly to create clusters. Instead, you create cluster\npolicies using a policy family. Cluster policies created using a policy family inherit the\npolicy family's policy definition.",
+        "package": {
+          "name": "compute"
+        },
+        "docs_group": "compute",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListPolicyFamiliesRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Get",
+            "description": "Retrieve the information for an policy family based on its identifier and version",
+            "summary": "Get policy family information.",
+            "path": "/api/2.0/policy-families/{policy_family_id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetPolicyFamilyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "policy_family_id",
+                  "description": "The family ID about which to retrieve information.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "policy_family_id",
+                  "description": "The family ID about which to retrieve information.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "PolicyFamily",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "policy_family_id",
+                "description": "The family ID about which to retrieve information.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version",
+                "description": "The version number for the family to fetch. Defaults to the latest version.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "policy_family_id",
+                "description": "The family ID about which to retrieve information.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Returns the list of policy definition types available to use at their latest version. This API is paginated.",
+            "summary": "List policy families.",
+            "path": "/api/2.0/policy-families",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListPolicyFamiliesRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListPolicyFamiliesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "max_results",
+                "description": "Maximum number of policy families to return.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "A token that can be used to get the next page of results.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "A token that can be used to get the next page of results.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          }
+        ]
+      },
+      {
+        "id": "postgres.Postgres",
+        "name": "Postgres",
+        "description": "Use the Postgres API to create and manage Lakebase Autoscaling Postgres infrastructure, including projects, branches, compute endpoints, and roles.\n\nThis API manages database infrastructure only. To query or modify data, use the Data API or direct SQL connections.\n\n**About resource IDs and names**\n\nResources are identified by hierarchical resource names like `projects/{project_id}/branches/{branch_id}/endpoints/{endpoint_id}`. The `name` field on each resource contains this full path and is output-only. Note that `name` refers to this resource path, not the user-visible `display_name`.",
+        "package": {
+          "name": "postgres"
+        },
+        "docs_group": "postgres",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListBranchesRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "CreateBranch",
+            "description": "Creates a new database branch in the project.",
+            "summary": "Create a Branch.",
+            "path": "/api/2.0/postgres/{parent=projects/*}/branches",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateBranchRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "The Project where this Branch will be created.\nFormat: projects/{project_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "branch",
+                  "description": "The Branch to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Branch",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "branch_id",
+                  "description": "The ID to use for the Branch. This becomes the final component of the branch's resource name.\nThe ID is required and must be 1-63 characters long, start with a lowercase letter, and contain only lowercase letters, numbers, and hyphens.\nFor example, `development` becomes `projects/my-app/branches/development`.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "The Project where this Branch will be created.\nFormat: projects/{project_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "branch_id",
+                  "description": "The ID to use for the Branch. This becomes the final component of the branch's resource name.\nThe ID is required and must be 1-63 characters long, start with a lowercase letter, and contain only lowercase letters, numbers, and hyphens.\nFor example, `development` becomes `projects/my-app/branches/development`.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "branch",
+                  "description": "The Branch to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Branch",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "branch",
+              "description": "The Branch to create.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Branch",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "branch",
+                "description": "The Branch to create.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Branch",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "branch_id",
+                "description": "The ID to use for the Branch. This becomes the final component of the branch's resource name.\nThe ID is required and must be 1-63 characters long, start with a lowercase letter, and contain only lowercase letters, numbers, and hyphens.\nFor example, `development` becomes `projects/my-app/branches/development`.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "The Project where this Branch will be created.\nFormat: projects/{project_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "replace_existing",
+                "description": "If true, update the branch if it already exists instead of returning an error.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "branch_id",
+                "description": "The part of the name, chosen by the user when the resource was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "A timestamp indicating when the branch was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Output only. The full resource path of the branch.\nFormat: projects/{project_id}/branches/{branch_id}",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "The project containing this branch (API resource hierarchy).\nFormat: projects/{project_id}\n\nNote: This field indicates where the branch exists in the resource hierarchy.\nFor point-in-time branching from another branch, see `status.source_branch`.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "spec",
+                "description": "The spec contains the branch configuration.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "BranchSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "status",
+                "description": "The current status of a Branch.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "BranchStatus",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "uid",
+                "description": "System-generated unique ID for the branch.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "A timestamp indicating when the branch was last updated.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "The Project where this Branch will be created.\nFormat: projects/{project_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "branch_id",
+                "description": "The ID to use for the Branch. This becomes the final component of the branch's resource name.\nThe ID is required and must be 1-63 characters long, start with a lowercase letter, and contain only lowercase letters, numbers, and hyphens.\nFor example, `development` becomes `projects/my-app/branches/development`.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "long_running_operation": {
+              "get_operation": {
+                "kebab_name": "get-operation",
+                "pascal_name": "GetOperation",
+                "request": {
+                  "pascal_name": "GetOperationRequest"
+                }
+              },
+              "response_type": {}
+            }
+          },
+          {
+            "name": "CreateCatalog",
+            "description": "Register a Postgres database in the Unity Catalog.",
+            "summary": "Register a Database in UC.",
+            "path": "/api/2.0/postgres/catalogs",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateCatalogRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "catalog",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Catalog",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "catalog_id",
+                  "description": "The ID in the Unity Catalog.\nIt becomes the full resource name, for example \"my_catalog\" becomes \"catalogs/my_catalog\".",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "catalog_id",
+                  "description": "The ID in the Unity Catalog.\nIt becomes the full resource name, for example \"my_catalog\" becomes \"catalogs/my_catalog\".",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "catalog",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Catalog",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "catalog",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Catalog",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "catalog",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Catalog",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "catalog_id",
+                "description": "The ID in the Unity Catalog.\nIt becomes the full resource name, for example \"my_catalog\" becomes \"catalogs/my_catalog\".",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "catalog_id",
+                "description": "The part of the name, chosen by the user when the resource was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "A timestamp indicating when the catalog was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Output only. The full resource path of the catalog.\n\nFormat: \"catalogs/{catalog_id}\".",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "spec",
+                "description": "The desired state of the Catalog.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CatalogCatalogSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "status",
+                "description": "The observed state of the Catalog.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CatalogCatalogStatus",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "uid",
+                "description": "System-generated unique identifier for the catalog.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "A timestamp indicating when the catalog was last updated.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "catalog_id",
+                "description": "The ID in the Unity Catalog.\nIt becomes the full resource name, for example \"my_catalog\" becomes \"catalogs/my_catalog\".",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "long_running_operation": {
+              "get_operation": {
+                "kebab_name": "get-operation",
+                "pascal_name": "GetOperation",
+                "request": {
+                  "pascal_name": "GetOperationRequest"
+                }
+              },
+              "response_type": {}
+            }
+          },
+          {
+            "name": "CreateCdfConfig",
+            "description": "Create a CDF configuration that materializes the change data feed for all\ntables in a Postgres schema as open-format Delta tables in Unity Catalog.\nOnce created, each table's change history is continuously written to its\ncorresponding Lakehouse table.",
+            "summary": "Create a change data feed configuration.",
+            "path": "/api/2.0/postgres/{parent=projects/*/branches/*/databases/*}/cdf-configs",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "CreateCdfConfigRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "The parent database under which to create the CdfConfig.\nFormat: projects/{project}/branches/{branch}/databases/{database}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "cdf_config",
+                  "description": "The CdfConfig to create. The catalog, schema, and postgres_schema fields are\nrequired; service_principal is optional. All other fields are output only\nand ignored on input.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CdfConfig",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "The parent database under which to create the CdfConfig.\nFormat: projects/{project}/branches/{branch}/databases/{database}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "cdf_config",
+                  "description": "The CdfConfig to create. The catalog, schema, and postgres_schema fields are\nrequired; service_principal is optional. All other fields are output only\nand ignored on input.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CdfConfig",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "cdf_config",
+              "description": "The CdfConfig to create. The catalog, schema, and postgres_schema fields are\nrequired; service_principal is optional. All other fields are output only\nand ignored on input.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "CdfConfig",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "catalog",
+                    "description": "The Unity Catalog catalog that replicated tables are written into.\nSet at creation; the CdfConfig is immutable.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "schema",
+                    "description": "The Unity Catalog schema that replicated tables are written into.\nSet at creation; the CdfConfig is immutable.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "postgres_schema",
+                    "description": "The Postgres schema this CdfConfig replicates from. Unique within the\nparent database. Set at creation; the CdfConfig is immutable.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "catalog",
+                    "description": "The Unity Catalog catalog that replicated tables are written into.\nSet at creation; the CdfConfig is immutable.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "schema",
+                    "description": "The Unity Catalog schema that replicated tables are written into.\nSet at creation; the CdfConfig is immutable.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "postgres_schema",
+                    "description": "The Postgres schema this CdfConfig replicates from. Unique within the\nparent database. Set at creation; the CdfConfig is immutable.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "cdf_config",
+                "description": "The CdfConfig to create. The catalog, schema, and postgres_schema fields are\nrequired; service_principal is optional. All other fields are output only\nand ignored on input.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CdfConfig",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "catalog",
+                      "description": "The Unity Catalog catalog that replicated tables are written into.\nSet at creation; the CdfConfig is immutable.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "schema",
+                      "description": "The Unity Catalog schema that replicated tables are written into.\nSet at creation; the CdfConfig is immutable.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "postgres_schema",
+                      "description": "The Postgres schema this CdfConfig replicates from. Unique within the\nparent database. Set at creation; the CdfConfig is immutable.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "catalog",
+                      "description": "The Unity Catalog catalog that replicated tables are written into.\nSet at creation; the CdfConfig is immutable.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "schema",
+                      "description": "The Unity Catalog schema that replicated tables are written into.\nSet at creation; the CdfConfig is immutable.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "postgres_schema",
+                      "description": "The Postgres schema this CdfConfig replicates from. Unique within the\nparent database. Set at creation; the CdfConfig is immutable.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "cdf_config_id",
+                "description": "The user-specified id for the CdfConfig, forming the final segment of its\nresource name. Must match the pattern `[a-z][a-z0-9_]{0,62}`. Defaults to\nthe Postgres schema name when omitted.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "The parent database under which to create the CdfConfig.\nFormat: projects/{project}/branches/{branch}/databases/{database}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "catalog",
+                "description": "The Unity Catalog catalog that replicated tables are written into.\nSet at creation; the CdfConfig is immutable.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "cdf_config_id",
+                "description": "The user-specified id; equals the final segment of `name`. Defaults to the\nPostgres schema name for configs without an explicit id.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "When the CdfConfig was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Output only. The full resource name of the CdfConfig.\nFormat: projects/{project}/branches/{branch}/databases/{database}/cdf-configs/{cdf_config}",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "postgres_schema",
+                "description": "The Postgres schema this CdfConfig replicates from. Unique within the\nparent database. Set at creation; the CdfConfig is immutable.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schema",
+                "description": "The Unity Catalog schema that replicated tables are written into.\nSet at creation; the CdfConfig is immutable.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "The parent database under which to create the CdfConfig.\nFormat: projects/{project}/branches/{branch}/databases/{database}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "catalog",
+                "description": "The Unity Catalog catalog that replicated tables are written into.\nSet at creation; the CdfConfig is immutable.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schema",
+                "description": "The Unity Catalog schema that replicated tables are written into.\nSet at creation; the CdfConfig is immutable.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "postgres_schema",
+                "description": "The Postgres schema this CdfConfig replicates from. Unique within the\nparent database. Set at creation; the CdfConfig is immutable.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "long_running_operation": {
+              "get_operation": {
+                "kebab_name": "get-operation",
+                "pascal_name": "GetOperation",
+                "request": {
+                  "pascal_name": "GetOperationRequest"
+                }
+              },
+              "response_type": {}
+            }
+          },
+          {
+            "name": "CreateDataApi",
+            "description": "Enable Data API for a database.",
+            "summary": "Enable Data API for a database.",
+            "path": "/api/2.0/postgres/{parent=projects/*/branches/*/databases/*}/data-api",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "CreateDataApiRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "Parent database: projects/{project_id}/branches/{branch_id}/databases/{database_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "data_api",
+                  "description": "The Data API configuration to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DataApi",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "Parent database: projects/{project_id}/branches/{branch_id}/databases/{database_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "data_api",
+                  "description": "The Data API configuration to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DataApi",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "data_api",
+              "description": "The Data API configuration to create.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "DataApi",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "data_api",
+                "description": "The Data API configuration to create.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DataApi",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "Parent database: projects/{project_id}/branches/{branch_id}/databases/{database_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "A timestamp indicating when the Data API was first enabled.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name: projects/{project_id}/branches/{branch_id}/databases/{database_id}/data-api",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "The database containing this Data API configuration.\nFormat: projects/{project_id}/branches/{branch_id}/databases/{database_id}",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "spec",
+                "description": "The desired Data API configuration.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "DataApiDataApiSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "status",
+                "description": "The observed Data API state (read-only).",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "DataApiDataApiStatus",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "A timestamp indicating when the Data API configuration was last updated.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "Parent database: projects/{project_id}/branches/{branch_id}/databases/{database_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "long_running_operation": {
+              "get_operation": {
+                "kebab_name": "get-operation",
+                "pascal_name": "GetOperation",
+                "request": {
+                  "pascal_name": "GetOperationRequest"
+                }
+              },
+              "response_type": {}
+            }
+          },
+          {
+            "name": "CreateDatabase",
+            "description": "Create a Database.\n\nCreates a database in the specified branch. A branch can have multiple databases.",
+            "summary": "Create a Database.",
+            "path": "/api/2.0/postgres/{parent=projects/*/branches/*}/databases",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateDatabaseRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "The Branch where this Database will be created.\nFormat: projects/{project_id}/branches/{branch_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "database",
+                  "description": "The desired specification of a Database.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Database",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "The Branch where this Database will be created.\nFormat: projects/{project_id}/branches/{branch_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "database",
+                  "description": "The desired specification of a Database.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Database",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "database",
+              "description": "The desired specification of a Database.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Database",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "database",
+                "description": "The desired specification of a Database.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Database",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "database_id",
+                "description": "The ID to use for the Database, which will become the final component of\nthe database's resource name.\nThis ID becomes the database name in postgres.\n\nThis value should be 4-63 characters, and only use characters available in DNS names,\nas defined by RFC-1123\n\nIf database_id is not specified in the request, it is generated automatically.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "The Branch where this Database will be created.\nFormat: projects/{project_id}/branches/{branch_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "replace_existing",
+                "description": "If true, update the database if it already exists instead of returning an\nerror.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "A timestamp indicating when the database was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "database_id",
+                "description": "The part of the name, chosen by the user when the resource was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The resource name of the database.\nFormat: projects/{project_id}/branches/{branch_id}/databases/{database_id}",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "The branch containing this database.\nFormat: projects/{project_id}/branches/{branch_id}",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "spec",
+                "description": "The desired state of the Database.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "DatabaseDatabaseSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "status",
+                "description": "The observed state of the Database.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "DatabaseDatabaseStatus",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "A timestamp indicating when the database was last updated.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "The Branch where this Database will be created.\nFormat: projects/{project_id}/branches/{branch_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "long_running_operation": {
+              "get_operation": {
+                "kebab_name": "get-operation",
+                "pascal_name": "GetOperation",
+                "request": {
+                  "pascal_name": "GetOperationRequest"
+                }
+              },
+              "response_type": {}
+            }
+          },
+          {
+            "name": "CreateEndpoint",
+            "description": "Creates a new compute endpoint in the branch.",
+            "summary": "Create an Endpoint.",
+            "path": "/api/2.0/postgres/{parent=projects/*/branches/*}/endpoints",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateEndpointRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "The Branch where this Endpoint will be created.\nFormat: projects/{project_id}/branches/{branch_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "endpoint",
+                  "description": "The Endpoint to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Endpoint",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "endpoint_id",
+                  "description": "The ID to use for the Endpoint. This becomes the final component of the endpoint's resource name.\nThe ID is required and must be 1-63 characters long, start with a lowercase letter, and contain only lowercase letters, numbers, and hyphens.\nFor example, `primary` becomes `projects/my-app/branches/development/endpoints/primary`.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "The Branch where this Endpoint will be created.\nFormat: projects/{project_id}/branches/{branch_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "endpoint_id",
+                  "description": "The ID to use for the Endpoint. This becomes the final component of the endpoint's resource name.\nThe ID is required and must be 1-63 characters long, start with a lowercase letter, and contain only lowercase letters, numbers, and hyphens.\nFor example, `primary` becomes `projects/my-app/branches/development/endpoints/primary`.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "endpoint",
+                  "description": "The Endpoint to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Endpoint",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "endpoint",
+              "description": "The Endpoint to create.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Endpoint",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "endpoint",
+                "description": "The Endpoint to create.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Endpoint",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "endpoint_id",
+                "description": "The ID to use for the Endpoint. This becomes the final component of the endpoint's resource name.\nThe ID is required and must be 1-63 characters long, start with a lowercase letter, and contain only lowercase letters, numbers, and hyphens.\nFor example, `primary` becomes `projects/my-app/branches/development/endpoints/primary`.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "The Branch where this Endpoint will be created.\nFormat: projects/{project_id}/branches/{branch_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "replace_existing",
+                "description": "If true, update the endpoint if it already exists instead of returning an error.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "A timestamp indicating when the compute endpoint was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "endpoint_id",
+                "description": "The part of the name, chosen by the user when the resource was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Output only. The full resource path of the endpoint.\nFormat: projects/{project_id}/branches/{branch_id}/endpoints/{endpoint_id}",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "The branch containing this endpoint (API resource hierarchy).\nFormat: projects/{project_id}/branches/{branch_id}",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "spec",
+                "description": "The spec contains the compute endpoint configuration, including autoscaling limits, suspend timeout, and disabled state.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "EndpointSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "status",
+                "description": "Current operational status of the compute endpoint.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "EndpointStatus",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "uid",
+                "description": "System-generated unique ID for the endpoint.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "A timestamp indicating when the compute endpoint was last updated.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "The Branch where this Endpoint will be created.\nFormat: projects/{project_id}/branches/{branch_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "endpoint_id",
+                "description": "The ID to use for the Endpoint. This becomes the final component of the endpoint's resource name.\nThe ID is required and must be 1-63 characters long, start with a lowercase letter, and contain only lowercase letters, numbers, and hyphens.\nFor example, `primary` becomes `projects/my-app/branches/development/endpoints/primary`.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "long_running_operation": {
+              "get_operation": {
+                "kebab_name": "get-operation",
+                "pascal_name": "GetOperation",
+                "request": {
+                  "pascal_name": "GetOperationRequest"
+                }
+              },
+              "response_type": {}
+            }
+          },
+          {
+            "name": "CreateProject",
+            "description": "Creates a new Lakebase Autoscaling Postgres database project, which contains branches and compute endpoints.",
+            "summary": "Create a Project.",
+            "path": "/api/2.0/postgres/projects",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateProjectRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "project",
+                  "description": "The Project to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Project",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "project_id",
+                  "description": "The ID to use for the Project. This becomes the final component of the project's resource name.\nThe ID is required and must be 1-63 characters long, start with a lowercase letter, and contain only lowercase letters, numbers, and hyphens.\nFor example, `my-app` becomes `projects/my-app`.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "project_id",
+                  "description": "The ID to use for the Project. This becomes the final component of the project's resource name.\nThe ID is required and must be 1-63 characters long, start with a lowercase letter, and contain only lowercase letters, numbers, and hyphens.\nFor example, `my-app` becomes `projects/my-app`.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "project",
+                  "description": "The Project to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Project",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "project",
+              "description": "The Project to create.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Project",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "project",
+                "description": "The Project to create.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Project",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "project_id",
+                "description": "The ID to use for the Project. This becomes the final component of the project's resource name.\nThe ID is required and must be 1-63 characters long, start with a lowercase letter, and contain only lowercase letters, numbers, and hyphens.\nFor example, `my-app` becomes `projects/my-app`.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "A timestamp indicating when the project was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "delete_time",
+                "description": "A timestamp indicating when the project was soft-deleted.\nEmpty if the project is not deleted, otherwise set to a timestamp in the past.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "initial_branch_spec",
+                "description": "Configuration for the initial default branch created as part of project creation.\nAllows overriding branch protection. These settings only apply at creation time\nand do not affect resources created after project creation.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "InitialBranchSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "initial_endpoint_spec",
+                "description": "Configuration settings for the initial Read/Write endpoint created inside the initial branch for a newly\ncreated project. If omitted, the initial endpoint created will have default settings, without high availability\nconfigured. This field does not apply to any endpoints created after project creation. Use\nspec.default_endpoint_settings to configure default settings for endpoints created after project creation.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "InitialEndpointSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Output only. The full resource path of the project.\nFormat: projects/{project_id}",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "project_id",
+                "description": "The part of the name, chosen by the user when the resource was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "purge_time",
+                "description": "A timestamp indicating when the project is scheduled for permanent deletion.\nEmpty if the project is not deleted, otherwise set to a timestamp in the future.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "spec",
+                "description": "The spec contains the project configuration, including display_name, pg_version (Postgres version), history_retention_duration, and default_endpoint_settings.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "ProjectSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "status",
+                "description": "The current status of a Project.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "ProjectStatus",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "uid",
+                "description": "System-generated unique ID for the project.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "A timestamp indicating when the project was last updated.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "project_id",
+                "description": "The ID to use for the Project. This becomes the final component of the project's resource name.\nThe ID is required and must be 1-63 characters long, start with a lowercase letter, and contain only lowercase letters, numbers, and hyphens.\nFor example, `my-app` becomes `projects/my-app`.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "long_running_operation": {
+              "get_operation": {
+                "kebab_name": "get-operation",
+                "pascal_name": "GetOperation",
+                "request": {
+                  "pascal_name": "GetOperationRequest"
+                }
+              },
+              "response_type": {}
+            }
+          },
+          {
+            "name": "CreateRole",
+            "description": "Creates a new Postgres role in the branch.",
+            "summary": "Create a Postgres Role for a Branch.",
+            "path": "/api/2.0/postgres/{parent=projects/*/branches/*}/roles",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateRoleRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "The Branch where this Role is created.\nFormat: projects/{project_id}/branches/{branch_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "role",
+                  "description": "The desired specification of a Role.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Role",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "The Branch where this Role is created.\nFormat: projects/{project_id}/branches/{branch_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "role",
+                  "description": "The desired specification of a Role.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Role",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "role",
+              "description": "The desired specification of a Role.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Role",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "parent",
+                "description": "The Branch where this Role is created.\nFormat: projects/{project_id}/branches/{branch_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "replace_existing",
+                "description": "If true, update the role if it already exists instead of returning an\nerror.\n\nWhen the role already exists, the provided `role` spec fully replaces the\nexisting one: `membership_roles` is overwritten, not merged. Leaving\n`membership_roles` empty clears all of the role's existing memberships,\nincluding `DATABRICKS_SUPERUSER`. Always send the complete desired list of\nmemberships when using this field.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "role",
+                "description": "The desired specification of a Role.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Role",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "role_id",
+                "description": "The ID to use for the Role, which will become the final component of\nthe role's resource name.\nThis ID becomes the role in Postgres.\n\nThis value should be 4-63 characters, and valid characters\nare lowercase letters, numbers, and hyphens, as defined by RFC 1123.\n\nIf role_id is not specified in the request, it is generated automatically.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "create_time",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Output only. The full resource path of the role.\nFormat: projects/{project_id}/branches/{branch_id}/roles/{role_id}",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "The Branch where this Role exists.\nFormat: projects/{project_id}/branches/{branch_id}",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "role_id",
+                "description": "The part of the name, chosen by the user when the resource was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "spec",
+                "description": "The spec contains the role configuration, including identity type, authentication method, and role attributes.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "RoleRoleSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "status",
+                "description": "Current status of the role, including its identity type, authentication method, and role attributes.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "RoleRoleStatus",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "update_time",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "The Branch where this Role is created.\nFormat: projects/{project_id}/branches/{branch_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "long_running_operation": {
+              "get_operation": {
+                "kebab_name": "get-operation",
+                "pascal_name": "GetOperation",
+                "request": {
+                  "pascal_name": "GetOperationRequest"
+                }
+              },
+              "response_type": {}
+            }
+          },
+          {
+            "name": "CreateSnapshot",
+            "description": "Creates a snapshot, an immutable point-in-time copy of a branch's data, within the project.",
+            "summary": "Create a Snapshot.",
+            "path": "/api/2.0/postgres/{parent=projects/*}/snapshots",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "CreateSnapshotRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "The project in which to create the snapshot.\nFormat: projects/{project_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "snapshot",
+                  "description": "The snapshot to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Snapshot",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "snapshot_id",
+                  "description": "Client-chosen ID for the snapshot. It becomes the final segment of the\nsnapshot resource name and cannot be changed after creation.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "The project in which to create the snapshot.\nFormat: projects/{project_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "snapshot_id",
+                  "description": "Client-chosen ID for the snapshot. It becomes the final segment of the\nsnapshot resource name and cannot be changed after creation.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "snapshot",
+                  "description": "The snapshot to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Snapshot",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "snapshot",
+              "description": "The snapshot to create.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Snapshot",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "parent",
+                "description": "The project in which to create the snapshot.\nFormat: projects/{project_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "snapshot",
+                "description": "The snapshot to create.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Snapshot",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "snapshot_id",
+                "description": "Client-chosen ID for the snapshot. It becomes the final segment of the\nsnapshot resource name and cannot be changed after creation.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "When the snapshot was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The resource name of the snapshot.\nFormat: projects/{project_id}/snapshots/{snapshot_id}",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "snapshot_id",
+                "description": "The user-chosen ID; the final segment of `name`.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "spec",
+                "description": "Client-provided configuration of the snapshot.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "SnapshotSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "status",
+                "description": "Server-observed state of the snapshot.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "SnapshotStatus",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "uid",
+                "description": "Unique system-generated ID for the snapshot.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "The project in which to create the snapshot.\nFormat: projects/{project_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "snapshot_id",
+                "description": "Client-chosen ID for the snapshot. It becomes the final segment of the\nsnapshot resource name and cannot be changed after creation.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "long_running_operation": {
+              "get_operation": {
+                "kebab_name": "get-operation",
+                "pascal_name": "GetOperation",
+                "request": {
+                  "pascal_name": "GetOperationRequest"
+                }
+              },
+              "response_type": {}
+            }
+          },
+          {
+            "name": "CreateSyncedTable",
+            "description": "Create a Synced Table.",
+            "summary": "Create a Synced Database Table.",
+            "path": "/api/2.0/postgres/synced_tables",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateSyncedTableRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "synced_table",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "SyncedTable",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "synced_table_id",
+                  "description": "The ID to use for the Synced Table. This becomes the final component of the SyncedTable's resource name.\nID is required and is the synced table name, containing (catalog, schema, table) tuple.\nElements of the tuple are the UC entity names.\n\nExample: \"{catalog}.{schema}.{table}\"\n\nsynced_table_id represents both of the following:\n\n1. An online VIEW virtual table in the Unity Catalog accessible via the Lakehouse Federation.\n2. Postgres table named \"{table}\" in schema \"{schema}\" in the connected Postgres database",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "synced_table_id",
+                  "description": "The ID to use for the Synced Table. This becomes the final component of the SyncedTable's resource name.\nID is required and is the synced table name, containing (catalog, schema, table) tuple.\nElements of the tuple are the UC entity names.\n\nExample: \"{catalog}.{schema}.{table}\"\n\nsynced_table_id represents both of the following:\n\n1. An online VIEW virtual table in the Unity Catalog accessible via the Lakehouse Federation.\n2. Postgres table named \"{table}\" in schema \"{schema}\" in the connected Postgres database",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "synced_table",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "SyncedTable",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "synced_table",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "SyncedTable",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "synced_table",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "SyncedTable",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "synced_table_id",
+                "description": "The ID to use for the Synced Table. This becomes the final component of the SyncedTable's resource name.\nID is required and is the synced table name, containing (catalog, schema, table) tuple.\nElements of the tuple are the UC entity names.\n\nExample: \"{catalog}.{schema}.{table}\"\n\nsynced_table_id represents both of the following:\n\n1. An online VIEW virtual table in the Unity Catalog accessible via the Lakehouse Federation.\n2. Postgres table named \"{table}\" in schema \"{schema}\" in the connected Postgres database",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "create_time",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Output only. The Full resource name of the synced table in Postgres\nwhere (catalog, schema, table) are the UC entity names.\n\nFormat \"synced_tables/{catalog}.{schema}.{table}\"\n\nFor the corresponding source table in the Unity catalog look for the \"source_table_full_name\" attribute.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "spec",
+                "description": "Configuration details of the synced table, such as the source table, scheduling policy, etc.\nThis attribute is specified at creation time and most fields are returned as is on subsequent queries.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "SyncedTableSyncedTableSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "status",
+                "description": "Synced Table data synchronization status.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "SyncedTableSyncedTableStatus",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "synced_table_id",
+                "description": "The part of the name, chosen by the user when the resource was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "uid",
+                "description": "The Unity Catalog table ID for this synced table.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "synced_table_id",
+                "description": "The ID to use for the Synced Table. This becomes the final component of the SyncedTable's resource name.\nID is required and is the synced table name, containing (catalog, schema, table) tuple.\nElements of the tuple are the UC entity names.\n\nExample: \"{catalog}.{schema}.{table}\"\n\nsynced_table_id represents both of the following:\n\n1. An online VIEW virtual table in the Unity Catalog accessible via the Lakehouse Federation.\n2. Postgres table named \"{table}\" in schema \"{schema}\" in the connected Postgres database",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "long_running_operation": {
+              "get_operation": {
+                "kebab_name": "get-operation",
+                "pascal_name": "GetOperation",
+                "request": {
+                  "pascal_name": "GetOperationRequest"
+                }
+              },
+              "response_type": {}
+            }
+          },
+          {
+            "name": "DeleteBranch",
+            "description": "Deletes the specified database branch.",
+            "summary": "Delete a Branch.",
+            "path": "/api/2.0/postgres/{name=projects/*/branches/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteBranchRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The full resource path of the branch to delete.\nFormat: projects/{project_id}/branches/{branch_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The full resource path of the branch to delete.\nFormat: projects/{project_id}/branches/{branch_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The full resource path of the branch to delete.\nFormat: projects/{project_id}/branches/{branch_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "purge",
+                "description": "If true, permanently delete the branch; if false, soft delete.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The full resource path of the branch to delete.\nFormat: projects/{project_id}/branches/{branch_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "long_running_operation": {
+              "get_operation": {
+                "kebab_name": "get-operation",
+                "pascal_name": "GetOperation",
+                "request": {
+                  "pascal_name": "GetOperationRequest"
+                }
+              },
+              "response_type": {
+                "is_empty_response": true
+              }
+            }
+          },
+          {
+            "name": "DeleteCatalog",
+            "description": "Delete a Database Catalog.",
+            "summary": "Delete a Database Catalog.",
+            "path": "/api/2.0/postgres/{name=catalogs/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteCatalogRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The full resource path of the catalog to delete.\n\nFormat: \"catalogs/{catalog_id}\".",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The full resource path of the catalog to delete.\n\nFormat: \"catalogs/{catalog_id}\".",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The full resource path of the catalog to delete.\n\nFormat: \"catalogs/{catalog_id}\".",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The full resource path of the catalog to delete.\n\nFormat: \"catalogs/{catalog_id}\".",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "long_running_operation": {
+              "get_operation": {
+                "kebab_name": "get-operation",
+                "pascal_name": "GetOperation",
+                "request": {
+                  "pascal_name": "GetOperationRequest"
+                }
+              },
+              "response_type": {
+                "is_empty_response": true
+              }
+            }
+          },
+          {
+            "name": "DeleteCdfConfig",
+            "description": "Delete a CDF configuration and stop materializing the change data feed. When\nforce=true, also drops the Delta tables in Unity Catalog. When force=false\n(default), the existing tables are preserved at their last state.",
+            "summary": "Delete a change data feed configuration.",
+            "path": "/api/2.0/postgres/{name=projects/*/branches/*/databases/*/cdf-configs/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "DeleteCdfConfigRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the CdfConfig to delete.\nFormat: projects/{project}/branches/{branch}/databases/{database}/cdf-configs/{cdf_config}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the CdfConfig to delete.\nFormat: projects/{project}/branches/{branch}/databases/{database}/cdf-configs/{cdf_config}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "force",
+                "description": "When true, also drops the replicated Delta tables in Unity Catalog. When\nfalse (the default), the replicated tables are preserved at their last\nsynced state.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The resource name of the CdfConfig to delete.\nFormat: projects/{project}/branches/{branch}/databases/{database}/cdf-configs/{cdf_config}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The resource name of the CdfConfig to delete.\nFormat: projects/{project}/branches/{branch}/databases/{database}/cdf-configs/{cdf_config}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "long_running_operation": {
+              "get_operation": {
+                "kebab_name": "get-operation",
+                "pascal_name": "GetOperation",
+                "request": {
+                  "pascal_name": "GetOperationRequest"
+                }
+              },
+              "response_type": {
+                "is_empty_response": true
+              }
+            }
+          },
+          {
+            "name": "DeleteDataApi",
+            "description": "Disable Data API for a database.",
+            "summary": "Disable Data API for a database.",
+            "path": "/api/2.0/postgres/{name=projects/*/branches/*/databases/*/data-api}",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "DeleteDataApiRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name: projects/{project_id}/branches/{branch_id}/databases/{database_id}/data-api",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name: projects/{project_id}/branches/{branch_id}/databases/{database_id}/data-api",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Resource name: projects/{project_id}/branches/{branch_id}/databases/{database_id}/data-api",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Resource name: projects/{project_id}/branches/{branch_id}/databases/{database_id}/data-api",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "long_running_operation": {
+              "get_operation": {
+                "kebab_name": "get-operation",
+                "pascal_name": "GetOperation",
+                "request": {
+                  "pascal_name": "GetOperationRequest"
+                }
+              },
+              "response_type": {
+                "is_empty_response": true
+              }
+            }
+          },
+          {
+            "name": "DeleteDatabase",
+            "description": "Delete a Database.",
+            "summary": "Delete a Database.",
+            "path": "/api/2.0/postgres/{name=projects/*/branches/*/databases/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteDatabaseRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the postgres database.\nFormat: projects/{project_id}/branches/{branch_id}/databases/{database_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the postgres database.\nFormat: projects/{project_id}/branches/{branch_id}/databases/{database_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The resource name of the postgres database.\nFormat: projects/{project_id}/branches/{branch_id}/databases/{database_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The resource name of the postgres database.\nFormat: projects/{project_id}/branches/{branch_id}/databases/{database_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "long_running_operation": {
+              "get_operation": {
+                "kebab_name": "get-operation",
+                "pascal_name": "GetOperation",
+                "request": {
+                  "pascal_name": "GetOperationRequest"
+                }
+              },
+              "response_type": {
+                "is_empty_response": true
+              }
+            }
+          },
+          {
+            "name": "DeleteEndpoint",
+            "description": "Deletes the specified compute endpoint.",
+            "summary": "Delete an Endpoint.",
+            "path": "/api/2.0/postgres/{name=projects/*/branches/*/endpoints/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteEndpointRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The full resource path of the endpoint to delete.\nFormat: projects/{project_id}/branches/{branch_id}/endpoints/{endpoint_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The full resource path of the endpoint to delete.\nFormat: projects/{project_id}/branches/{branch_id}/endpoints/{endpoint_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The full resource path of the endpoint to delete.\nFormat: projects/{project_id}/branches/{branch_id}/endpoints/{endpoint_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The full resource path of the endpoint to delete.\nFormat: projects/{project_id}/branches/{branch_id}/endpoints/{endpoint_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "long_running_operation": {
+              "get_operation": {
+                "kebab_name": "get-operation",
+                "pascal_name": "GetOperation",
+                "request": {
+                  "pascal_name": "GetOperationRequest"
+                }
+              },
+              "response_type": {
+                "is_empty_response": true
+              }
+            }
+          },
+          {
+            "name": "DeleteProject",
+            "description": "Deletes the specified database project.",
+            "summary": "Delete a Project.",
+            "path": "/api/2.0/postgres/{name=projects/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteProjectRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The full resource path of the project to delete.\nFormat: projects/{project_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The full resource path of the project to delete.\nFormat: projects/{project_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The full resource path of the project to delete.\nFormat: projects/{project_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "purge",
+                "description": "If true, permanently deletes the project (hard delete).\nIf false or unset, performs a soft delete.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The full resource path of the project to delete.\nFormat: projects/{project_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "long_running_operation": {
+              "get_operation": {
+                "kebab_name": "get-operation",
+                "pascal_name": "GetOperation",
+                "request": {
+                  "pascal_name": "GetOperationRequest"
+                }
+              },
+              "response_type": {
+                "is_empty_response": true
+              }
+            }
+          },
+          {
+            "name": "DeleteRole",
+            "description": "Deletes the specified Postgres role.",
+            "summary": "Delete a Postgres Role from a Branch.",
+            "path": "/api/2.0/postgres/{name=projects/*/branches/*/roles/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteRoleRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The full resource path of the role to delete.\nFormat: projects/{project_id}/branches/{branch_id}/roles/{role_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The full resource path of the role to delete.\nFormat: projects/{project_id}/branches/{branch_id}/roles/{role_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The full resource path of the role to delete.\nFormat: projects/{project_id}/branches/{branch_id}/roles/{role_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "reassign_owned_to",
+                "description": "Reassign objects. If this is set, all objects owned by the role are\nreassigned to the role specified in this parameter.\n\nNOTE: setting this requires spinning up a compute to succeed, since it involves running\nSQL queries.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The full resource path of the role to delete.\nFormat: projects/{project_id}/branches/{branch_id}/roles/{role_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "long_running_operation": {
+              "get_operation": {
+                "kebab_name": "get-operation",
+                "pascal_name": "GetOperation",
+                "request": {
+                  "pascal_name": "GetOperationRequest"
+                }
+              },
+              "response_type": {
+                "is_empty_response": true
+              }
+            }
+          },
+          {
+            "name": "DeleteSnapshot",
+            "description": "Deletes the specified snapshot.",
+            "summary": "Delete a Snapshot.",
+            "path": "/api/2.0/postgres/{name=projects/*/snapshots/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "DeleteSnapshotRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the snapshot to delete.\nFormat: projects/{project_id}/snapshots/{snapshot_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the snapshot to delete.\nFormat: projects/{project_id}/snapshots/{snapshot_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The resource name of the snapshot to delete.\nFormat: projects/{project_id}/snapshots/{snapshot_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The resource name of the snapshot to delete.\nFormat: projects/{project_id}/snapshots/{snapshot_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "long_running_operation": {
+              "get_operation": {
+                "kebab_name": "get-operation",
+                "pascal_name": "GetOperation",
+                "request": {
+                  "pascal_name": "GetOperationRequest"
+                }
+              },
+              "response_type": {
+                "is_empty_response": true
+              }
+            }
+          },
+          {
+            "name": "DeleteSyncedTable",
+            "description": "Delete a Synced Table.",
+            "summary": "Delete a Synced Database Table.",
+            "path": "/api/2.0/postgres/{name=synced_tables/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteSyncedTableRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The Full resource name of the synced table, of the format \"synced_tables/{catalog}.{schema}.{table}\",\nwhere (catalog, schema, table) are the UC entity names.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The Full resource name of the synced table, of the format \"synced_tables/{catalog}.{schema}.{table}\",\nwhere (catalog, schema, table) are the UC entity names.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The Full resource name of the synced table, of the format \"synced_tables/{catalog}.{schema}.{table}\",\nwhere (catalog, schema, table) are the UC entity names.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The Full resource name of the synced table, of the format \"synced_tables/{catalog}.{schema}.{table}\",\nwhere (catalog, schema, table) are the UC entity names.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "long_running_operation": {
+              "get_operation": {
+                "kebab_name": "get-operation",
+                "pascal_name": "GetOperation",
+                "request": {
+                  "pascal_name": "GetOperationRequest"
+                }
+              },
+              "response_type": {
+                "is_empty_response": true
+              }
+            }
+          },
+          {
+            "name": "GenerateDatabaseCredential",
+            "description": "Generate OAuth credentials for a Postgres database.",
+            "summary": "Generate OAuth credentials for a Postgres database.",
+            "path": "/api/2.0/postgres/credentials",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GenerateDatabaseCredentialRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "endpoint",
+                  "description": "The endpoint resource name for which this credential will be generated.\nFormat: projects/{project_id}/branches/{branch_id}/endpoints/{endpoint_id}",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "endpoint",
+                  "description": "The endpoint resource name for which this credential will be generated.\nFormat: projects/{project_id}/branches/{branch_id}/endpoints/{endpoint_id}",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DatabaseCredential",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "claims",
+                "description": "The returned token will be scoped to UC tables with the specified permissions.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "RequestedClaimsList",
+                  "array_value": {
+                    "pascal_name": "RequestedClaims",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "endpoint",
+                "description": "The endpoint resource name for which this credential will be generated.\nFormat: projects/{project_id}/branches/{branch_id}/endpoints/{endpoint_id}",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "expire_time",
+                "description": "Timestamp in UTC of when this credential should expire.\nMust be at least 300 seconds (5 minutes) and at most 1 hour from the current time.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "ttl",
+                "description": "The requested time-to-live for the generated credential token.\nMust be at least 300 seconds (5 minutes) and at most 3600 seconds (1 hour).",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_duration": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "endpoint",
+                "description": "The endpoint resource name for which this credential will be generated.\nFormat: projects/{project_id}/branches/{branch_id}/endpoints/{endpoint_id}",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetBranch",
+            "description": "Retrieves information about the specified database branch.",
+            "summary": "Get a Branch.",
+            "path": "/api/2.0/postgres/{name=projects/*/branches/*}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetBranchRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The full resource path of the branch to retrieve.\nFormat: projects/{project_id}/branches/{branch_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The full resource path of the branch to retrieve.\nFormat: projects/{project_id}/branches/{branch_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Branch",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The full resource path of the branch to retrieve.\nFormat: projects/{project_id}/branches/{branch_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The full resource path of the branch to retrieve.\nFormat: projects/{project_id}/branches/{branch_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetCatalog",
+            "description": "Get a Database Catalog.",
+            "summary": "Get a Database Catalog.",
+            "path": "/api/2.0/postgres/{name=catalogs/*}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetCatalogRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The full resource path of the catalog to retrieve.\n\nFormat: \"catalogs/{catalog_id}\".",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The full resource path of the catalog to retrieve.\n\nFormat: \"catalogs/{catalog_id}\".",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Catalog",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The full resource path of the catalog to retrieve.\n\nFormat: \"catalogs/{catalog_id}\".",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The full resource path of the catalog to retrieve.\n\nFormat: \"catalogs/{catalog_id}\".",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetCdfConfig",
+            "description": "Get a single Lakebase CDF configuration, including the source Postgres\nschema and target Unity Catalog schema.",
+            "summary": "Get a change data feed configuration.",
+            "path": "/api/2.0/postgres/{name=projects/*/branches/*/databases/*/cdf-configs/*}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetCdfConfigRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the CdfConfig to retrieve.\nFormat: projects/{project}/branches/{branch}/databases/{database}/cdf-configs/{cdf_config}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the CdfConfig to retrieve.\nFormat: projects/{project}/branches/{branch}/databases/{database}/cdf-configs/{cdf_config}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CdfConfig",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "catalog",
+                  "description": "The Unity Catalog catalog that replicated tables are written into.\nSet at creation; the CdfConfig is immutable.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schema",
+                  "description": "The Unity Catalog schema that replicated tables are written into.\nSet at creation; the CdfConfig is immutable.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "postgres_schema",
+                  "description": "The Postgres schema this CdfConfig replicates from. Unique within the\nparent database. Set at creation; the CdfConfig is immutable.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "catalog",
+                  "description": "The Unity Catalog catalog that replicated tables are written into.\nSet at creation; the CdfConfig is immutable.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schema",
+                  "description": "The Unity Catalog schema that replicated tables are written into.\nSet at creation; the CdfConfig is immutable.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "postgres_schema",
+                  "description": "The Postgres schema this CdfConfig replicates from. Unique within the\nparent database. Set at creation; the CdfConfig is immutable.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The resource name of the CdfConfig to retrieve.\nFormat: projects/{project}/branches/{branch}/databases/{database}/cdf-configs/{cdf_config}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The resource name of the CdfConfig to retrieve.\nFormat: projects/{project}/branches/{branch}/databases/{database}/cdf-configs/{cdf_config}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetCdfStatus",
+            "description": "Get the CDF status of a single table within a Lakebase CDF configuration,\nincluding its current state and the last committed position in the feed.",
+            "summary": "Get a change data feed status.",
+            "path": "/api/2.0/postgres/{name=projects/*/branches/*/databases/*/cdf-configs/*/cdf-statuses/*}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetCdfStatusRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the CdfStatus to retrieve.\nFormat: projects/{project}/branches/{branch}/databases/{database}/cdf-configs/{cdf_config}/cdf-statuses/{cdf_status}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the CdfStatus to retrieve.\nFormat: projects/{project}/branches/{branch}/databases/{database}/cdf-configs/{cdf_config}/cdf-statuses/{cdf_status}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CdfStatus",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The resource name of the CdfStatus to retrieve.\nFormat: projects/{project}/branches/{branch}/databases/{database}/cdf-configs/{cdf_config}/cdf-statuses/{cdf_status}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The resource name of the CdfStatus to retrieve.\nFormat: projects/{project}/branches/{branch}/databases/{database}/cdf-configs/{cdf_config}/cdf-statuses/{cdf_status}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetDataApi",
+            "description": "Get Data API configuration for a database.",
+            "summary": "Get Data API configuration.",
+            "path": "/api/2.0/postgres/{name=projects/*/branches/*/databases/*/data-api}",
+            "is_crud_read": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "GetDataApiRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name: projects/{project_id}/branches/{branch_id}/databases/{database_id}/data-api",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name: projects/{project_id}/branches/{branch_id}/databases/{database_id}/data-api",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DataApi",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Resource name: projects/{project_id}/branches/{branch_id}/databases/{database_id}/data-api",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Resource name: projects/{project_id}/branches/{branch_id}/databases/{database_id}/data-api",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetDatabase",
+            "description": "Get a Database.",
+            "summary": "Get a Database.",
+            "path": "/api/2.0/postgres/{name=projects/*/branches/*/databases/*}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetDatabaseRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the Database to retrieve.\nFormat: projects/{project_id}/branches/{branch_id}/databases/{database_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the Database to retrieve.\nFormat: projects/{project_id}/branches/{branch_id}/databases/{database_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Database",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The name of the Database to retrieve.\nFormat: projects/{project_id}/branches/{branch_id}/databases/{database_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the Database to retrieve.\nFormat: projects/{project_id}/branches/{branch_id}/databases/{database_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetEndpoint",
+            "description": "Retrieves information about the specified compute endpoint, including its connection details and operational state.",
+            "summary": "Get an Endpoint.",
+            "path": "/api/2.0/postgres/{name=projects/*/branches/*/endpoints/*}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetEndpointRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The full resource path of the endpoint to retrieve.\nFormat: projects/{project_id}/branches/{branch_id}/endpoints/{endpoint_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The full resource path of the endpoint to retrieve.\nFormat: projects/{project_id}/branches/{branch_id}/endpoints/{endpoint_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Endpoint",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The full resource path of the endpoint to retrieve.\nFormat: projects/{project_id}/branches/{branch_id}/endpoints/{endpoint_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The full resource path of the endpoint to retrieve.\nFormat: projects/{project_id}/branches/{branch_id}/endpoints/{endpoint_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetOperation",
+            "description": "Retrieves the status of a long-running operation.",
+            "summary": "Get an Operation.",
+            "path": "/api/2.0/postgres/{name=projects/*/operations/*}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetOperationRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the operation resource.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the operation resource.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The name of the operation resource.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the operation resource.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetProject",
+            "description": "Retrieves information about the specified database project.",
+            "summary": "Get a Project.",
+            "path": "/api/2.0/postgres/{name=projects/*}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetProjectRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The full resource path of the project to retrieve.\nFormat: projects/{project_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The full resource path of the project to retrieve.\nFormat: projects/{project_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Project",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The full resource path of the project to retrieve.\nFormat: projects/{project_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The full resource path of the project to retrieve.\nFormat: projects/{project_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetRole",
+            "description": "Retrieves information about the specified Postgres role, including its authentication method and permissions.",
+            "summary": "Get a Postgres Role for a Branch.",
+            "path": "/api/2.0/postgres/{name=projects/*/branches/*/roles/*}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetRoleRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The full resource path of the role to retrieve.\nFormat: projects/{project_id}/branches/{branch_id}/roles/{role_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The full resource path of the role to retrieve.\nFormat: projects/{project_id}/branches/{branch_id}/roles/{role_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Role",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The full resource path of the role to retrieve.\nFormat: projects/{project_id}/branches/{branch_id}/roles/{role_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The full resource path of the role to retrieve.\nFormat: projects/{project_id}/branches/{branch_id}/roles/{role_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetSnapshot",
+            "description": "Retrieves information about the specified snapshot.",
+            "summary": "Get a Snapshot.",
+            "path": "/api/2.0/postgres/{name=projects/*/snapshots/*}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetSnapshotRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the snapshot to retrieve.\nFormat: projects/{project_id}/snapshots/{snapshot_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the snapshot to retrieve.\nFormat: projects/{project_id}/snapshots/{snapshot_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Snapshot",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The resource name of the snapshot to retrieve.\nFormat: projects/{project_id}/snapshots/{snapshot_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The resource name of the snapshot to retrieve.\nFormat: projects/{project_id}/snapshots/{snapshot_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetSnapshotSchedule",
+            "description": "Retrieves the snapshot schedule for a branch. A branch with no configured\nschedule returns an empty schedule (not NOT_FOUND).",
+            "summary": "Get a Snapshot Schedule.",
+            "path": "/api/2.0/postgres/{name=projects/*/branches/*/snapshot-schedule}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetSnapshotScheduleRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the branch's snapshot schedule.\nFormat: projects/{project_id}/branches/{branch_id}/snapshot-schedule",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the branch's snapshot schedule.\nFormat: projects/{project_id}/branches/{branch_id}/snapshot-schedule",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "SnapshotSchedule",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The resource name of the branch's snapshot schedule.\nFormat: projects/{project_id}/branches/{branch_id}/snapshot-schedule",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The resource name of the branch's snapshot schedule.\nFormat: projects/{project_id}/branches/{branch_id}/snapshot-schedule",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetSyncedTable",
+            "description": "Get a Synced Table.",
+            "summary": "Get a Synced Database Table.",
+            "path": "/api/2.0/postgres/{name=synced_tables/*}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetSyncedTableRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The Full resource name of the synced table.\nFormat: \"synced_tables/{catalog}.{schema}.{table}\",\nwhere (catalog, schema, table) are the entity names in the Unity Catalog.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The Full resource name of the synced table.\nFormat: \"synced_tables/{catalog}.{schema}.{table}\",\nwhere (catalog, schema, table) are the entity names in the Unity Catalog.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "SyncedTable",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The Full resource name of the synced table.\nFormat: \"synced_tables/{catalog}.{schema}.{table}\",\nwhere (catalog, schema, table) are the entity names in the Unity Catalog.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The Full resource name of the synced table.\nFormat: \"synced_tables/{catalog}.{schema}.{table}\",\nwhere (catalog, schema, table) are the entity names in the Unity Catalog.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListBranches",
+            "description": "Returns a paginated list of database branches in the project.",
+            "summary": "List Branches.",
+            "path": "/api/2.0/postgres/{parent=projects/*}/branches",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListBranchesRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "The Project that owns this collection of branches.\nFormat: projects/{project_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "The Project that owns this collection of branches.\nFormat: projects/{project_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListBranchesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "Upper bound for items returned. Cannot be negative.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Page token from a previous response. If not provided, returns the first page.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "The Project that owns this collection of branches.\nFormat: projects/{project_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "show_deleted",
+                "description": "Whether to include soft-deleted branches in the response.\nWhen true, deleted branches are included alongside active branches.\nPurged branches are never returned.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "The Project that owns this collection of branches.\nFormat: projects/{project_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Page token from a previous response. If not provided, returns the first page.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListCdfConfigs",
+            "description": "List all CDF configurations for a Lakebase database. Each configuration maps\na Postgres schema to a Unity Catalog schema where the change data feed is\nmaterialized.",
+            "summary": "List change data feed configurations.",
+            "path": "/api/2.0/postgres/{parent=projects/*/branches/*/databases/*}/cdf-configs",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ListCdfConfigsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "The parent database to list CdfConfigs for.\nFormat: projects/{project}/branches/{branch}/databases/{database}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "The parent database to list CdfConfigs for.\nFormat: projects/{project}/branches/{branch}/databases/{database}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListCdfConfigsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "Maximum number of CdfConfigs to return.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Pagination token returned by a previous ListCdfConfigs call. Empty on the\nfirst page.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "The parent database to list CdfConfigs for.\nFormat: projects/{project}/branches/{branch}/databases/{database}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "The parent database to list CdfConfigs for.\nFormat: projects/{project}/branches/{branch}/databases/{database}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Pagination token returned by a previous ListCdfConfigs call. Empty on the\nfirst page.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListCdfStatuses",
+            "description": "List the per-table CDF statuses within a Lakebase CDF configuration. Each\nstatus shows whether a table's change data feed is snapshotting, streaming,\nor skipped.",
+            "summary": "List change data feed statuses.",
+            "path": "/api/2.0/postgres/{parent=projects/*/branches/*/databases/*/cdf-configs/*}/cdf-statuses",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ListCdfStatusesRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "The parent CdfConfig to list CdfStatuses for.\nFormat: projects/{project}/branches/{branch}/databases/{database}/cdf-configs/{cdf_config}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "The parent CdfConfig to list CdfStatuses for.\nFormat: projects/{project}/branches/{branch}/databases/{database}/cdf-configs/{cdf_config}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListCdfStatusesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "Maximum number of CdfStatuses to return.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Pagination token returned by a previous ListCdfStatuses call. Empty on the\nfirst page.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "The parent CdfConfig to list CdfStatuses for.\nFormat: projects/{project}/branches/{branch}/databases/{database}/cdf-configs/{cdf_config}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "The parent CdfConfig to list CdfStatuses for.\nFormat: projects/{project}/branches/{branch}/databases/{database}/cdf-configs/{cdf_config}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Pagination token returned by a previous ListCdfStatuses call. Empty on the\nfirst page.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListDatabases",
+            "description": "List Databases.",
+            "summary": "List postgres databases in a branch.",
+            "path": "/api/2.0/postgres/{parent=projects/*/branches/*}/databases",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListDatabasesRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "The Branch that owns this collection of databases.\nFormat: projects/{project_id}/branches/{branch_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "The Branch that owns this collection of databases.\nFormat: projects/{project_id}/branches/{branch_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListDatabasesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "Upper bound for items returned.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Pagination token to go to the next page of Databases. Requests first page if absent.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "The Branch that owns this collection of databases.\nFormat: projects/{project_id}/branches/{branch_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "The Branch that owns this collection of databases.\nFormat: projects/{project_id}/branches/{branch_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Pagination token to go to the next page of Databases. Requests first page if absent.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListEndpoints",
+            "description": "Returns a paginated list of compute endpoints in the branch.",
+            "summary": "List Endpoints.",
+            "path": "/api/2.0/postgres/{parent=projects/*/branches/*}/endpoints",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListEndpointsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "The Branch that owns this collection of endpoints.\nFormat: projects/{project_id}/branches/{branch_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "The Branch that owns this collection of endpoints.\nFormat: projects/{project_id}/branches/{branch_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListEndpointsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "Upper bound for items returned. Cannot be negative.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Page token from a previous response. If not provided, returns the first page.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "The Branch that owns this collection of endpoints.\nFormat: projects/{project_id}/branches/{branch_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "The Branch that owns this collection of endpoints.\nFormat: projects/{project_id}/branches/{branch_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Page token from a previous response. If not provided, returns the first page.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListProjects",
+            "description": "Returns a paginated list of database projects in the workspace that the user has permission to access.",
+            "summary": "List Projects.",
+            "path": "/api/2.0/postgres/projects",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListProjectsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListProjectsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "Upper bound for items returned. Cannot be negative. The maximum value is 100.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Page token from a previous response. If not provided, returns the first page.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "show_deleted",
+                "description": "Whether to include soft-deleted projects in the response.\nWhen true, soft-deleted projects are included alongside active projects.\nHard-deleted and already-purged projects are never returned.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Page token from a previous response. If not provided, returns the first page.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListRoles",
+            "description": "Returns a paginated list of Postgres roles in the branch.",
+            "summary": "List Postgres Roles for a Branch.",
+            "path": "/api/2.0/postgres/{parent=projects/*/branches/*}/roles",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListRolesRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "The Branch that owns this collection of roles.\nFormat: projects/{project_id}/branches/{branch_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "The Branch that owns this collection of roles.\nFormat: projects/{project_id}/branches/{branch_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListRolesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "Upper bound for items returned. Cannot be negative.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Page token from a previous response. If not provided, returns the first page.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "The Branch that owns this collection of roles.\nFormat: projects/{project_id}/branches/{branch_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "The Branch that owns this collection of roles.\nFormat: projects/{project_id}/branches/{branch_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Page token from a previous response. If not provided, returns the first page.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListSnapshots",
+            "description": "Returns a paginated list of snapshots in the project.",
+            "summary": "List Snapshots.",
+            "path": "/api/2.0/postgres/{parent=projects/*}/snapshots",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ListSnapshotsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "The project that owns the snapshots.\nFormat: projects/{project_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "The project that owns the snapshots.\nFormat: projects/{project_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListSnapshotsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "Maximum number of snapshots to return per page.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Page token from a previous response; omit for the first page.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "The project that owns the snapshots.\nFormat: projects/{project_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "The project that owns the snapshots.\nFormat: projects/{project_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Page token from a previous response; omit for the first page.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "RevealRolePassword",
+            "description": "Reveals the current password for a password-authenticated Postgres role.",
+            "summary": "Reveal a Postgres Role password.",
+            "path": "/api/2.0/postgres/{name=projects/*/branches/*/roles/*}/password",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "RevealRolePasswordRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The full resource path of the role whose password should be revealed.\nFormat: projects/{project_id}/branches/{branch_id}/roles/{role_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The full resource path of the role whose password should be revealed.\nFormat: projects/{project_id}/branches/{branch_id}/roles/{role_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "RevealRolePasswordResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The full resource path of the role whose password should be revealed.\nFormat: projects/{project_id}/branches/{branch_id}/roles/{role_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The full resource path of the role whose password should be revealed.\nFormat: projects/{project_id}/branches/{branch_id}/roles/{role_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UndeleteBranch",
+            "description": "Undeletes the specified database branch.",
+            "summary": "Undelete a Branch.",
+            "path": "/api/2.0/postgres/{name=projects/*/branches/*}/undelete",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "UndeleteBranchRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The full resource path of the branch to undelete.\nFormat: projects/{project_id}/branches/{branch_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The full resource path of the branch to undelete.\nFormat: projects/{project_id}/branches/{branch_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The full resource path of the branch to undelete.\nFormat: projects/{project_id}/branches/{branch_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The full resource path of the branch to undelete.\nFormat: projects/{project_id}/branches/{branch_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "long_running_operation": {
+              "get_operation": {
+                "kebab_name": "get-operation",
+                "pascal_name": "GetOperation",
+                "request": {
+                  "pascal_name": "GetOperationRequest"
+                }
+              },
+              "response_type": {
+                "is_empty_response": true
+              }
+            }
+          },
+          {
+            "name": "UndeleteProject",
+            "description": "Undeletes a soft-deleted project.",
+            "summary": "Undelete a Project.",
+            "path": "/api/2.0/postgres/{name=projects/*}/undelete",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "UndeleteProjectRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The full resource path of the project to undelete.\nFormat: projects/{project_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The full resource path of the project to undelete.\nFormat: projects/{project_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The full resource path of the project to undelete.\nFormat: projects/{project_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The full resource path of the project to undelete.\nFormat: projects/{project_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "long_running_operation": {
+              "get_operation": {
+                "kebab_name": "get-operation",
+                "pascal_name": "GetOperation",
+                "request": {
+                  "pascal_name": "GetOperationRequest"
+                }
+              },
+              "response_type": {
+                "is_empty_response": true
+              }
+            }
+          },
+          {
+            "name": "UpdateBranch",
+            "description": "Updates the specified database branch. You can set this branch as the project's default branch, or protect/unprotect it.",
+            "summary": "Update a Branch.",
+            "path": "/api/2.0/postgres/{name=projects/*/branches/*}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateBranchRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Output only. The full resource path of the branch.\nFormat: projects/{project_id}/branches/{branch_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "branch",
+                  "description": "The Branch to update.\n\nThe branch's `name` field is used to identify the branch to update.\nFormat: projects/{project_id}/branches/{branch_id}",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Branch",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Output only. The full resource path of the branch.\nFormat: projects/{project_id}/branches/{branch_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "branch",
+                  "description": "The Branch to update.\n\nThe branch's `name` field is used to identify the branch to update.\nFormat: projects/{project_id}/branches/{branch_id}",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Branch",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "branch",
+              "description": "The Branch to update.\n\nThe branch's `name` field is used to identify the branch to update.\nFormat: projects/{project_id}/branches/{branch_id}",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Branch",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "branch",
+                "description": "The Branch to update.\n\nThe branch's `name` field is used to identify the branch to update.\nFormat: projects/{project_id}/branches/{branch_id}",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Branch",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Output only. The full resource path of the branch.\nFormat: projects/{project_id}/branches/{branch_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "branch_id",
+                "description": "The part of the name, chosen by the user when the resource was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "A timestamp indicating when the branch was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Output only. The full resource path of the branch.\nFormat: projects/{project_id}/branches/{branch_id}",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "The project containing this branch (API resource hierarchy).\nFormat: projects/{project_id}\n\nNote: This field indicates where the branch exists in the resource hierarchy.\nFor point-in-time branching from another branch, see `status.source_branch`.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "spec",
+                "description": "The spec contains the branch configuration.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "BranchSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "status",
+                "description": "The current status of a Branch.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "BranchStatus",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "uid",
+                "description": "System-generated unique ID for the branch.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "A timestamp indicating when the branch was last updated.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Output only. The full resource path of the branch.\nFormat: projects/{project_id}/branches/{branch_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              }
+            ],
+            "long_running_operation": {
+              "get_operation": {
+                "kebab_name": "get-operation",
+                "pascal_name": "GetOperation",
+                "request": {
+                  "pascal_name": "GetOperationRequest"
+                }
+              },
+              "response_type": {}
+            }
+          },
+          {
+            "name": "UpdateDataApi",
+            "description": "Update Data API configuration for a database.",
+            "summary": "Update Data API configuration.",
+            "path": "/api/2.0/postgres/{name=projects/*/branches/*/databases/*/data-api}",
+            "can_use_json": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "UpdateDataApiRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name: projects/{project_id}/branches/{branch_id}/databases/{database_id}/data-api",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "data_api",
+                  "description": "The Data API configuration to update.\nThe data_api's `name` field identifies the resource.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DataApi",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name: projects/{project_id}/branches/{branch_id}/databases/{database_id}/data-api",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "data_api",
+                  "description": "The Data API configuration to update.\nThe data_api's `name` field identifies the resource.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DataApi",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "data_api",
+              "description": "The Data API configuration to update.\nThe data_api's `name` field identifies the resource.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "DataApi",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "data_api",
+                "description": "The Data API configuration to update.\nThe data_api's `name` field identifies the resource.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DataApi",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name: projects/{project_id}/branches/{branch_id}/databases/{database_id}/data-api",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "A timestamp indicating when the Data API was first enabled.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name: projects/{project_id}/branches/{branch_id}/databases/{database_id}/data-api",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "The database containing this Data API configuration.\nFormat: projects/{project_id}/branches/{branch_id}/databases/{database_id}",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "spec",
+                "description": "The desired Data API configuration.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "DataApiDataApiSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "status",
+                "description": "The observed Data API state (read-only).",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "DataApiDataApiStatus",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "A timestamp indicating when the Data API configuration was last updated.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Resource name: projects/{project_id}/branches/{branch_id}/databases/{database_id}/data-api",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              }
+            ],
+            "long_running_operation": {
+              "get_operation": {
+                "kebab_name": "get-operation",
+                "pascal_name": "GetOperation",
+                "request": {
+                  "pascal_name": "GetOperationRequest"
+                }
+              },
+              "response_type": {}
+            }
+          },
+          {
+            "name": "UpdateDatabase",
+            "description": "Update a Database.",
+            "summary": "Update a Database.",
+            "path": "/api/2.0/postgres/{name=projects/*/branches/*/databases/*}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateDatabaseRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the database.\nFormat: projects/{project_id}/branches/{branch_id}/databases/{database_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "database",
+                  "description": "The Database to update.\n\nThe database's `name` field is used to identify the database to update.\nFormat: projects/{project_id}/branches/{branch_id}/databases/{database_id}",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Database",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the database.\nFormat: projects/{project_id}/branches/{branch_id}/databases/{database_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "database",
+                  "description": "The Database to update.\n\nThe database's `name` field is used to identify the database to update.\nFormat: projects/{project_id}/branches/{branch_id}/databases/{database_id}",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Database",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "database",
+              "description": "The Database to update.\n\nThe database's `name` field is used to identify the database to update.\nFormat: projects/{project_id}/branches/{branch_id}/databases/{database_id}",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Database",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "database",
+                "description": "The Database to update.\n\nThe database's `name` field is used to identify the database to update.\nFormat: projects/{project_id}/branches/{branch_id}/databases/{database_id}",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Database",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The resource name of the database.\nFormat: projects/{project_id}/branches/{branch_id}/databases/{database_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "A timestamp indicating when the database was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "database_id",
+                "description": "The part of the name, chosen by the user when the resource was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The resource name of the database.\nFormat: projects/{project_id}/branches/{branch_id}/databases/{database_id}",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "The branch containing this database.\nFormat: projects/{project_id}/branches/{branch_id}",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "spec",
+                "description": "The desired state of the Database.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "DatabaseDatabaseSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "status",
+                "description": "The observed state of the Database.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "DatabaseDatabaseStatus",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "A timestamp indicating when the database was last updated.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The resource name of the database.\nFormat: projects/{project_id}/branches/{branch_id}/databases/{database_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              }
+            ],
+            "long_running_operation": {
+              "get_operation": {
+                "kebab_name": "get-operation",
+                "pascal_name": "GetOperation",
+                "request": {
+                  "pascal_name": "GetOperationRequest"
+                }
+              },
+              "response_type": {}
+            }
+          },
+          {
+            "name": "UpdateEndpoint",
+            "description": "Updates the specified compute endpoint. You can update autoscaling limits, suspend timeout, or enable/disable the compute endpoint.",
+            "summary": "Update an Endpoint.",
+            "path": "/api/2.0/postgres/{name=projects/*/branches/*/endpoints/*}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateEndpointRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Output only. The full resource path of the endpoint.\nFormat: projects/{project_id}/branches/{branch_id}/endpoints/{endpoint_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "endpoint",
+                  "description": "The Endpoint to update.\n\nThe endpoint's `name` field is used to identify the endpoint to update.\nFormat: projects/{project_id}/branches/{branch_id}/endpoints/{endpoint_id}",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Endpoint",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Output only. The full resource path of the endpoint.\nFormat: projects/{project_id}/branches/{branch_id}/endpoints/{endpoint_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "endpoint",
+                  "description": "The Endpoint to update.\n\nThe endpoint's `name` field is used to identify the endpoint to update.\nFormat: projects/{project_id}/branches/{branch_id}/endpoints/{endpoint_id}",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Endpoint",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "endpoint",
+              "description": "The Endpoint to update.\n\nThe endpoint's `name` field is used to identify the endpoint to update.\nFormat: projects/{project_id}/branches/{branch_id}/endpoints/{endpoint_id}",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Endpoint",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "endpoint",
+                "description": "The Endpoint to update.\n\nThe endpoint's `name` field is used to identify the endpoint to update.\nFormat: projects/{project_id}/branches/{branch_id}/endpoints/{endpoint_id}",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Endpoint",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Output only. The full resource path of the endpoint.\nFormat: projects/{project_id}/branches/{branch_id}/endpoints/{endpoint_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "A timestamp indicating when the compute endpoint was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "endpoint_id",
+                "description": "The part of the name, chosen by the user when the resource was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Output only. The full resource path of the endpoint.\nFormat: projects/{project_id}/branches/{branch_id}/endpoints/{endpoint_id}",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "The branch containing this endpoint (API resource hierarchy).\nFormat: projects/{project_id}/branches/{branch_id}",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "spec",
+                "description": "The spec contains the compute endpoint configuration, including autoscaling limits, suspend timeout, and disabled state.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "EndpointSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "status",
+                "description": "Current operational status of the compute endpoint.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "EndpointStatus",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "uid",
+                "description": "System-generated unique ID for the endpoint.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "A timestamp indicating when the compute endpoint was last updated.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Output only. The full resource path of the endpoint.\nFormat: projects/{project_id}/branches/{branch_id}/endpoints/{endpoint_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              }
+            ],
+            "long_running_operation": {
+              "get_operation": {
+                "kebab_name": "get-operation",
+                "pascal_name": "GetOperation",
+                "request": {
+                  "pascal_name": "GetOperationRequest"
+                }
+              },
+              "response_type": {}
+            }
+          },
+          {
+            "name": "UpdateProject",
+            "description": "Updates the specified database project.",
+            "summary": "Update a Project.",
+            "path": "/api/2.0/postgres/{name=projects/*}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateProjectRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Output only. The full resource path of the project.\nFormat: projects/{project_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "project",
+                  "description": "The Project to update.\n\nThe project's `name` field is used to identify the project to update.\nFormat: projects/{project_id}",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Project",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Output only. The full resource path of the project.\nFormat: projects/{project_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "project",
+                  "description": "The Project to update.\n\nThe project's `name` field is used to identify the project to update.\nFormat: projects/{project_id}",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Project",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "project",
+              "description": "The Project to update.\n\nThe project's `name` field is used to identify the project to update.\nFormat: projects/{project_id}",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Project",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Output only. The full resource path of the project.\nFormat: projects/{project_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "project",
+                "description": "The Project to update.\n\nThe project's `name` field is used to identify the project to update.\nFormat: projects/{project_id}",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Project",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "A timestamp indicating when the project was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "delete_time",
+                "description": "A timestamp indicating when the project was soft-deleted.\nEmpty if the project is not deleted, otherwise set to a timestamp in the past.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "initial_branch_spec",
+                "description": "Configuration for the initial default branch created as part of project creation.\nAllows overriding branch protection. These settings only apply at creation time\nand do not affect resources created after project creation.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "InitialBranchSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "initial_endpoint_spec",
+                "description": "Configuration settings for the initial Read/Write endpoint created inside the initial branch for a newly\ncreated project. If omitted, the initial endpoint created will have default settings, without high availability\nconfigured. This field does not apply to any endpoints created after project creation. Use\nspec.default_endpoint_settings to configure default settings for endpoints created after project creation.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "InitialEndpointSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Output only. The full resource path of the project.\nFormat: projects/{project_id}",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "project_id",
+                "description": "The part of the name, chosen by the user when the resource was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "purge_time",
+                "description": "A timestamp indicating when the project is scheduled for permanent deletion.\nEmpty if the project is not deleted, otherwise set to a timestamp in the future.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "spec",
+                "description": "The spec contains the project configuration, including display_name, pg_version (Postgres version), history_retention_duration, and default_endpoint_settings.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "ProjectSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "status",
+                "description": "The current status of a Project.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "ProjectStatus",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "uid",
+                "description": "System-generated unique ID for the project.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "A timestamp indicating when the project was last updated.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Output only. The full resource path of the project.\nFormat: projects/{project_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              }
+            ],
+            "long_running_operation": {
+              "get_operation": {
+                "kebab_name": "get-operation",
+                "pascal_name": "GetOperation",
+                "request": {
+                  "pascal_name": "GetOperationRequest"
+                }
+              },
+              "response_type": {}
+            }
+          },
+          {
+            "name": "UpdateRole",
+            "description": "Update a role for a branch.",
+            "summary": "Update a Postgres Role for a Branch.",
+            "path": "/api/2.0/postgres/{name=projects/*/branches/*/roles/*}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateRoleRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Output only. The full resource path of the role.\nFormat: projects/{project_id}/branches/{branch_id}/roles/{role_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "role",
+                  "description": "The Postgres Role to update.\n\nThe role's `name` field is used to identify the role to update.\nFormat: projects/{project_id}/branches/{branch_id}/roles/{role_id}",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Role",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Output only. The full resource path of the role.\nFormat: projects/{project_id}/branches/{branch_id}/roles/{role_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "role",
+                  "description": "The Postgres Role to update.\n\nThe role's `name` field is used to identify the role to update.\nFormat: projects/{project_id}/branches/{branch_id}/roles/{role_id}",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Role",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "role",
+              "description": "The Postgres Role to update.\n\nThe role's `name` field is used to identify the role to update.\nFormat: projects/{project_id}/branches/{branch_id}/roles/{role_id}",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Role",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Output only. The full resource path of the role.\nFormat: projects/{project_id}/branches/{branch_id}/roles/{role_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "role",
+                "description": "The Postgres Role to update.\n\nThe role's `name` field is used to identify the role to update.\nFormat: projects/{project_id}/branches/{branch_id}/roles/{role_id}",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Role",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "create_time",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Output only. The full resource path of the role.\nFormat: projects/{project_id}/branches/{branch_id}/roles/{role_id}",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "The Branch where this Role exists.\nFormat: projects/{project_id}/branches/{branch_id}",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "role_id",
+                "description": "The part of the name, chosen by the user when the resource was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "spec",
+                "description": "The spec contains the role configuration, including identity type, authentication method, and role attributes.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "RoleRoleSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "status",
+                "description": "Current status of the role, including its identity type, authentication method, and role attributes.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "RoleRoleStatus",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "update_time",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Output only. The full resource path of the role.\nFormat: projects/{project_id}/branches/{branch_id}/roles/{role_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              }
+            ],
+            "long_running_operation": {
+              "get_operation": {
+                "kebab_name": "get-operation",
+                "pascal_name": "GetOperation",
+                "request": {
+                  "pascal_name": "GetOperationRequest"
+                }
+              },
+              "response_type": {}
+            }
+          },
+          {
+            "name": "UpdateSnapshotSchedule",
+            "description": "Sets the snapshot schedule for a branch. The `schedule` field is replaced\nwholesale; an empty schedule disables automatic snapshots.",
+            "summary": "Update a Snapshot Schedule.",
+            "path": "/api/2.0/postgres/{name=projects/*/branches/*/snapshot-schedule}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "UpdateSnapshotScheduleRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the branch's snapshot schedule.\nFormat: projects/{project_id}/branches/{branch_id}/snapshot-schedule",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "snapshot_schedule",
+                  "description": "The snapshot schedule to set. Its `name` identifies the branch.\nFormat: projects/{project_id}/branches/{branch_id}/snapshot-schedule",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "SnapshotSchedule",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Fields to update. The only updatable path is `schedule`, which replaces the\nentire set of cadences.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the branch's snapshot schedule.\nFormat: projects/{project_id}/branches/{branch_id}/snapshot-schedule",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Fields to update. The only updatable path is `schedule`, which replaces the\nentire set of cadences.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "snapshot_schedule",
+                  "description": "The snapshot schedule to set. Its `name` identifies the branch.\nFormat: projects/{project_id}/branches/{branch_id}/snapshot-schedule",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "SnapshotSchedule",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "snapshot_schedule",
+              "description": "The snapshot schedule to set. Its `name` identifies the branch.\nFormat: projects/{project_id}/branches/{branch_id}/snapshot-schedule",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "SnapshotSchedule",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The resource name of the branch's snapshot schedule.\nFormat: projects/{project_id}/branches/{branch_id}/snapshot-schedule",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "snapshot_schedule",
+                "description": "The snapshot schedule to set. Its `name` identifies the branch.\nFormat: projects/{project_id}/branches/{branch_id}/snapshot-schedule",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "SnapshotSchedule",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Fields to update. The only updatable path is `schedule`, which replaces the\nentire set of cadences.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The resource name of the branch's snapshot schedule.\nFormat: projects/{project_id}/branches/{branch_id}/snapshot-schedule",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schedule",
+                "description": "The cadences at which automatic snapshots are taken. Update replaces the\nwhole set; an empty set disables automatic snapshots. Order is not\nsignificant. When several cadences fire together, one snapshot is taken,\nretained for the longest of their retentions.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ScheduleCadenceList",
+                  "array_value": {
+                    "pascal_name": "ScheduleCadence",
+                    "is_object": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The resource name of the branch's snapshot schedule.\nFormat: projects/{project_id}/branches/{branch_id}/snapshot-schedule",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Fields to update. The only updatable path is `schedule`, which replaces the\nentire set of cadences.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              }
+            ],
+            "long_running_operation": {
+              "get_operation": {
+                "kebab_name": "get-operation",
+                "pascal_name": "GetOperation",
+                "request": {
+                  "pascal_name": "GetOperationRequest"
+                }
+              },
+              "response_type": {}
+            }
+          }
+        ]
+      },
+      {
+        "id": "provisioning.PrivateAccess",
+        "name": "PrivateAccess",
+        "description": "These APIs manage private access settings for this account.",
+        "package": {
+          "name": "provisioning"
+        },
+        "is_accounts": true,
+        "docs_group": "provisioning",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a private access settings configuration, which represents\nnetwork access restrictions for workspace resources. Private access\nsettings configure whether workspaces can be accessed from the public\ninternet or only from private endpoints.",
+            "summary": "Create private access settings.",
+            "path": "/api/2.0/accounts/{account_id}/private-access-settings",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreatePrivateAccessSettingsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "PrivateAccessSettings",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "allowed_vpc_endpoint_ids",
+                "description": "An array of Databricks VPC endpoint IDs. This is the Databricks ID returned when registering the VPC endpoint configuration in your Databricks account. This is not the ID of the VPC endpoint in AWS.\nOnly used when private_access_level is set to ENDPOINT. This is an allow list of VPC endpoints registered in your Databricks account that can connect to your workspace over AWS PrivateLink.\nNote: If hybrid access to your workspace is enabled by setting public_access_enabled to true, this control only works for PrivateLink connections. To control how your workspace is accessed via public internet, see IP access lists.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "private_access_level",
+                "description": "The private access level controls which VPC endpoints can connect to the UI or API of any workspace that attaches this private access settings object.\n`ACCOUNT` level access (the default) allows only VPC endpoints that are registered in your Databricks account connect to your workspace.\n`ENDPOINT` level access allows only specified VPC endpoints connect to your workspace. For details, see allowed_vpc_endpoint_ids.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PrivateAccessLevel",
+                  "enum": [
+                    {
+                      "content": "ACCOUNT"
+                    },
+                    {
+                      "content": "ENDPOINT"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "private_access_settings_name",
+                "description": "The human-readable name of the private access settings object.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "public_access_enabled",
+                "description": "Determines if the workspace can be accessed over public internet. For fully private workspaces, you can optionally specify false, but only if you implement both the front-end and the back-end PrivateLink connections. Otherwise, specify true, which means that public access is enabled.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "region",
+                "description": "The AWS region for workspaces attached to this private access settings object.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes a Databricks private access settings configuration, both specified by ID.",
+            "summary": "Delete private access settings.",
+            "path": "/api/2.0/accounts/{account_id}/private-access-settings/{private_access_settings_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeletePrivateAccesRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "private_access_settings_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "private_access_settings_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "PrivateAccessSettings",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "private_access_settings_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "private_access_settings_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets a Databricks private access settings configuration, both specified by ID.",
+            "summary": "Get private access settings.",
+            "path": "/api/2.0/accounts/{account_id}/private-access-settings/{private_access_settings_id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetPrivateAccesRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "private_access_settings_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "private_access_settings_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "PrivateAccessSettings",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "private_access_settings_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "private_access_settings_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Lists Databricks private access settings for an account.",
+            "summary": "List private access settings.",
+            "path": "/api/2.0/accounts/{account_id}/private-access-settings",
+            "is_legacy_empty_request": true,
+            "is_crud_read": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListPrivateAccessRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "PrivateAccessSettingsList",
+              "array_value": {
+                "pascal_name": "PrivateAccessSettings",
+                "is_object": true
+              }
+            }
+          },
+          {
+            "name": "Replace",
+            "description": "Updates an existing private access settings object, which specifies how your workspace is accessed over AWS PrivateLink. To use AWS PrivateLink, a workspace must have a private access settings object referenced by ID in the workspace's private_access_settings_id property.\nThis operation completely overwrites your existing private access settings object attached to your workspaces. All workspaces attached to the private access settings are affected by any change. If public_access_enabled, private_access_level, or allowed_vpc_endpoint_ids are updated, effects of these changes might take several minutes to propagate to the workspace API.\nYou can share one private access settings object with multiple workspaces in a single account. However, private access settings are specific to AWS regions, so only workspaces in the same AWS region can use a given private access settings object.\nBefore configuring PrivateLink, read the Databricks article about PrivateLink.",
+            "summary": "Update private access settings.",
+            "path": "/api/2.0/accounts/{account_id}/private-access-settings/{private_access_settings_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ReplacePrivateAccessSettingsRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "private_access_settings_id",
+                  "description": "Databricks private access settings ID.",
+                  "required": true,
+                  "is_path": true,
+                  "is_output_only": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "customer_facing_private_access_settings",
+                  "description": "Properties of the new private access settings object.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PrivateAccessSettings",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "private_access_settings_id",
+                  "description": "Databricks private access settings ID.",
+                  "required": true,
+                  "is_path": true,
+                  "is_output_only": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "customer_facing_private_access_settings",
+                  "description": "Properties of the new private access settings object.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PrivateAccessSettings",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "customer_facing_private_access_settings",
+              "description": "Properties of the new private access settings object.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "PrivateAccessSettings",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "PrivateAccessSettings",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "customer_facing_private_access_settings",
+                "description": "Properties of the new private access settings object.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PrivateAccessSettings",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "private_access_settings_id",
+                "description": "Databricks private access settings ID.",
+                "required": true,
+                "is_path": true,
+                "is_output_only": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "account_id",
+                "description": "The Databricks account ID that hosts the private access settings.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "allowed_vpc_endpoint_ids",
+                "description": "An array of Databricks VPC endpoint IDs. This is the Databricks ID that is returned when registering the VPC endpoint configuration in your Databricks account. This is not the ID of the VPC endpoint in AWS.\nOnly used when private_access_level is set to ENDPOINT. This is an allow list of VPC endpoints that in your account that can connect to your workspace over AWS PrivateLink.\nIf hybrid access to your workspace is enabled by setting public_access_enabled to true, this control only works for PrivateLink connections. To control how your workspace is accessed via public internet, see IP access lists.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "private_access_level",
+                "description": "The private access level controls which VPC endpoints can connect to the UI or API of any workspace that attaches this private access settings object.\n`ACCOUNT` level access (the default) allows only VPC endpoints that are registered in your Databricks account connect to your workspace.\n`ENDPOINT` level access allows only specified VPC endpoints connect to your workspace. For details, see allowed_vpc_endpoint_ids.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PrivateAccessLevel",
+                  "enum": [
+                    {
+                      "content": "ACCOUNT"
+                    },
+                    {
+                      "content": "ENDPOINT"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "private_access_settings_id",
+                "description": "Databricks private access settings ID.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "private_access_settings_name",
+                "description": "The human-readable name of the private access settings object.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "public_access_enabled",
+                "description": "Determines if the workspace can be accessed over public internet. For fully private workspaces, you can optionally specify false, but only if you implement both the front-end and the back-end PrivateLink connections. Otherwise, specify true, which means that public access is enabled.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "region",
+                "description": "The AWS region for workspaces attached to this private access settings object.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "private_access_settings_id",
+                "description": "Databricks private access settings ID.",
+                "required": true,
+                "is_path": true,
+                "is_output_only": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "networking.PrivateNetworkGateways",
+        "name": "PrivateNetworkGateways",
+        "description": "These APIs manage private network gateways under network connectivity configurations.",
+        "package": {
+          "name": "networking"
+        },
+        "is_accounts": true,
+        "is_hidden_cli": true,
+        "docs_group": "provisioning",
+        "launch_stage": "PRIVATE_PREVIEW",
+        "cli_launch_stage_display": "Private Preview",
+        "list": {
+          "request": {
+            "pascal_name": "ListPrivateNetworkGatewaysRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "CreatePrivateNetworkGateway",
+            "description": "Creates a private network gateway.",
+            "summary": "Create a private network gateway.",
+            "path": "/api/networking/v1/{parent=accounts/*/network-connectivity-configs/*}/private-network-gateways",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "CreatePrivateNetworkGatewayRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "The network connectivity configuration that will contain the gateway.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "private_network_gateway",
+                  "description": "The gateway to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PrivateNetworkGateway",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "The network connectivity configuration that will contain the gateway.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "private_network_gateway",
+                  "description": "The gateway to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PrivateNetworkGateway",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "private_network_gateway",
+              "description": "The gateway to create.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "PrivateNetworkGateway",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "display_name",
+                    "description": "The human-readable name of the gateway.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "traffic_mode",
+                    "description": "The traffic routed through this gateway.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "PrivateNetworkGatewayTrafficMode",
+                      "enum": [
+                        {
+                          "content": "ALL_TRAFFIC"
+                        },
+                        {
+                          "content": "SPECIFIC_DESTINATIONS"
+                        }
+                      ]
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "display_name",
+                    "description": "The human-readable name of the gateway.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "traffic_mode",
+                    "description": "The traffic routed through this gateway.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "PrivateNetworkGatewayTrafficMode",
+                      "enum": [
+                        {
+                          "content": "ALL_TRAFFIC"
+                        },
+                        {
+                          "content": "SPECIFIC_DESTINATIONS"
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "parent",
+                "description": "The network connectivity configuration that will contain the gateway.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "private_network_gateway",
+                "description": "The gateway to create.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PrivateNetworkGateway",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "display_name",
+                      "description": "The human-readable name of the gateway.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "traffic_mode",
+                      "description": "The traffic routed through this gateway.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "PrivateNetworkGatewayTrafficMode",
+                        "enum": [
+                          {
+                            "content": "ALL_TRAFFIC"
+                          },
+                          {
+                            "content": "SPECIFIC_DESTINATIONS"
+                          }
+                        ]
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "display_name",
+                      "description": "The human-readable name of the gateway.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "traffic_mode",
+                      "description": "The traffic routed through this gateway.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "PrivateNetworkGatewayTrafficMode",
+                        "enum": [
+                          {
+                            "content": "ALL_TRAFFIC"
+                          },
+                          {
+                            "content": "SPECIFIC_DESTINATIONS"
+                          }
+                        ]
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "request_id",
+                "description": "A unique identifier for this request. The request is idempotent when this is provided.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "aws_cloud_connection",
+                "description": "The AWS connection used by the gateway.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "PrivateNetworkGatewayAwsCloudConnection",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "azure_cloud_connection",
+                "description": "The Azure connection used by the gateway.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "PrivateNetworkGatewayAzureCloudConnection",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "bandwidth_tier_gigabits_per_second",
+                "description": "The provisioned bandwidth tier for an Azure gateway, in gigabits per second.\nRequired when creating an Azure gateway.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "The time when the gateway was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "destinations",
+                "description": "The destinations routed through this gateway.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PrivateNetworkGatewayDestinationList",
+                  "array_value": {
+                    "pascal_name": "PrivateNetworkGatewayDestination",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "The human-readable name of the gateway.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "error_message",
+                "description": "The failure reason when the gateway is in the FAILED state.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The canonical resource name of the gateway, in the form\n`accounts/{account_id}/network-connectivity-configs/{ncc_id}/private-network-gateways/{gateway_id}`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "private_dns_resolvers",
+                "description": "The DNS resolvers used for private name resolution.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PrivateNetworkGatewayPrivateDnsResolverList",
+                  "array_value": {
+                    "pascal_name": "PrivateNetworkGatewayPrivateDnsResolver",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "state",
+                "description": "The current lifecycle state of the gateway.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PrivateNetworkGatewayGatewayState",
+                  "enum": [
+                    {
+                      "content": "CREATING"
+                    },
+                    {
+                      "content": "DELETING"
+                    },
+                    {
+                      "content": "ESTABLISHED"
+                    },
+                    {
+                      "content": "FAILED"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "traffic_mode",
+                "description": "The traffic routed through this gateway.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PrivateNetworkGatewayTrafficMode",
+                  "enum": [
+                    {
+                      "content": "ALL_TRAFFIC"
+                    },
+                    {
+                      "content": "SPECIFIC_DESTINATIONS"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "The time when the gateway was last updated.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "The network connectivity configuration that will contain the gateway.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "The human-readable name of the gateway.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "traffic_mode",
+                "description": "The traffic routed through this gateway.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PrivateNetworkGatewayTrafficMode",
+                  "enum": [
+                    {
+                      "content": "ALL_TRAFFIC"
+                    },
+                    {
+                      "content": "SPECIFIC_DESTINATIONS"
+                    }
+                  ]
+                }
+              }
+            ],
+            "long_running_operation": {
+              "get_operation": {
+                "kebab_name": "get-private-network-gateway-operation",
+                "pascal_name": "GetPrivateNetworkGatewayOperation",
+                "request": {
+                  "pascal_name": "GetOperationRequest"
+                }
+              },
+              "response_type": {}
+            }
+          },
+          {
+            "name": "DeletePrivateNetworkGateway",
+            "description": "Permanently deletes a private network gateway.",
+            "summary": "Delete a private network gateway.",
+            "path": "/api/networking/v1/{name=accounts/*/network-connectivity-configs/*/private-network-gateways/*}",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "DeletePrivateNetworkGatewayRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The canonical resource name of the gateway.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The canonical resource name of the gateway.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The canonical resource name of the gateway.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The canonical resource name of the gateway.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetPrivateNetworkGateway",
+            "description": "Gets a private network gateway.",
+            "summary": "Get a private network gateway.",
+            "path": "/api/networking/v1/{name=accounts/*/network-connectivity-configs/*/private-network-gateways/*}",
+            "is_crud_read": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "GetPrivateNetworkGatewayRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The canonical resource name of the gateway.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The canonical resource name of the gateway.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "PrivateNetworkGateway",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "display_name",
+                  "description": "The human-readable name of the gateway.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "traffic_mode",
+                  "description": "The traffic routed through this gateway.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PrivateNetworkGatewayTrafficMode",
+                    "enum": [
+                      {
+                        "content": "ALL_TRAFFIC"
+                      },
+                      {
+                        "content": "SPECIFIC_DESTINATIONS"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "display_name",
+                  "description": "The human-readable name of the gateway.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "traffic_mode",
+                  "description": "The traffic routed through this gateway.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PrivateNetworkGatewayTrafficMode",
+                    "enum": [
+                      {
+                        "content": "ALL_TRAFFIC"
+                      },
+                      {
+                        "content": "SPECIFIC_DESTINATIONS"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The canonical resource name of the gateway.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The canonical resource name of the gateway.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetPrivateNetworkGatewayOperation",
+            "description": "Gets the status of a private network gateway create operation.",
+            "summary": "Get a private network gateway operation.",
+            "path": "/api/networking/v1/{name=accounts/*/network-connectivity-configs/*/private-network-gateways/*/operations/*}",
+            "is_crud_read": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "GetOperationRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the operation resource.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the operation resource.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Operation",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The name of the operation resource.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the operation resource.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListPrivateNetworkGateways",
+            "description": "Lists private network gateways under a network connectivity configuration.",
+            "summary": "List private network gateways.",
+            "path": "/api/networking/v1/{parent=accounts/*/network-connectivity-configs/*}/private-network-gateways",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "ListPrivateNetworkGatewaysRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "The network connectivity configuration containing the gateways.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "The network connectivity configuration containing the gateways.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListPrivateNetworkGatewaysResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_token",
+                "description": "An opaque token returned by a previous list request.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "The network connectivity configuration containing the gateways.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "The network connectivity configuration containing the gateways.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "An opaque token returned by a previous list request.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "UpdatePrivateNetworkGateway",
+            "description": "Updates a private network gateway.",
+            "summary": "Update a private network gateway.",
+            "path": "/api/networking/v1/{name=accounts/*/network-connectivity-configs/*/private-network-gateways/*}",
+            "can_use_json": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "UpdatePrivateNetworkGatewayRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The canonical resource name of the gateway, in the form\n`accounts/{account_id}/network-connectivity-configs/{ncc_id}/private-network-gateways/{gateway_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "private_network_gateway",
+                  "description": "The gateway containing the desired mutable field values.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PrivateNetworkGateway",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The canonical resource name of the gateway, in the form\n`accounts/{account_id}/network-connectivity-configs/{ncc_id}/private-network-gateways/{gateway_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "private_network_gateway",
+                  "description": "The gateway containing the desired mutable field values.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PrivateNetworkGateway",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "private_network_gateway",
+              "description": "The gateway containing the desired mutable field values.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "PrivateNetworkGateway",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "display_name",
+                    "description": "The human-readable name of the gateway.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "traffic_mode",
+                    "description": "The traffic routed through this gateway.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "PrivateNetworkGatewayTrafficMode",
+                      "enum": [
+                        {
+                          "content": "ALL_TRAFFIC"
+                        },
+                        {
+                          "content": "SPECIFIC_DESTINATIONS"
+                        }
+                      ]
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "display_name",
+                    "description": "The human-readable name of the gateway.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "traffic_mode",
+                    "description": "The traffic routed through this gateway.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "PrivateNetworkGatewayTrafficMode",
+                      "enum": [
+                        {
+                          "content": "ALL_TRAFFIC"
+                        },
+                        {
+                          "content": "SPECIFIC_DESTINATIONS"
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "PrivateNetworkGateway",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "display_name",
+                  "description": "The human-readable name of the gateway.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "traffic_mode",
+                  "description": "The traffic routed through this gateway.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PrivateNetworkGatewayTrafficMode",
+                    "enum": [
+                      {
+                        "content": "ALL_TRAFFIC"
+                      },
+                      {
+                        "content": "SPECIFIC_DESTINATIONS"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "display_name",
+                  "description": "The human-readable name of the gateway.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "traffic_mode",
+                  "description": "The traffic routed through this gateway.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PrivateNetworkGatewayTrafficMode",
+                    "enum": [
+                      {
+                        "content": "ALL_TRAFFIC"
+                      },
+                      {
+                        "content": "SPECIFIC_DESTINATIONS"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The canonical resource name of the gateway, in the form\n`accounts/{account_id}/network-connectivity-configs/{ncc_id}/private-network-gateways/{gateway_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "private_network_gateway",
+                "description": "The gateway containing the desired mutable field values.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PrivateNetworkGateway",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "display_name",
+                      "description": "The human-readable name of the gateway.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "traffic_mode",
+                      "description": "The traffic routed through this gateway.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "PrivateNetworkGatewayTrafficMode",
+                        "enum": [
+                          {
+                            "content": "ALL_TRAFFIC"
+                          },
+                          {
+                            "content": "SPECIFIC_DESTINATIONS"
+                          }
+                        ]
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "display_name",
+                      "description": "The human-readable name of the gateway.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "traffic_mode",
+                      "description": "The traffic routed through this gateway.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "PrivateNetworkGatewayTrafficMode",
+                        "enum": [
+                          {
+                            "content": "ALL_TRAFFIC"
+                          },
+                          {
+                            "content": "SPECIFIC_DESTINATIONS"
+                          }
+                        ]
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "aws_cloud_connection",
+                "description": "The AWS connection used by the gateway.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "PrivateNetworkGatewayAwsCloudConnection",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "azure_cloud_connection",
+                "description": "The Azure connection used by the gateway.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "PrivateNetworkGatewayAzureCloudConnection",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "bandwidth_tier_gigabits_per_second",
+                "description": "The provisioned bandwidth tier for an Azure gateway, in gigabits per second.\nRequired when creating an Azure gateway.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "The time when the gateway was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "destinations",
+                "description": "The destinations routed through this gateway.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PrivateNetworkGatewayDestinationList",
+                  "array_value": {
+                    "pascal_name": "PrivateNetworkGatewayDestination",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "The human-readable name of the gateway.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "error_message",
+                "description": "The failure reason when the gateway is in the FAILED state.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The canonical resource name of the gateway, in the form\n`accounts/{account_id}/network-connectivity-configs/{ncc_id}/private-network-gateways/{gateway_id}`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "private_dns_resolvers",
+                "description": "The DNS resolvers used for private name resolution.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PrivateNetworkGatewayPrivateDnsResolverList",
+                  "array_value": {
+                    "pascal_name": "PrivateNetworkGatewayPrivateDnsResolver",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "state",
+                "description": "The current lifecycle state of the gateway.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PrivateNetworkGatewayGatewayState",
+                  "enum": [
+                    {
+                      "content": "CREATING"
+                    },
+                    {
+                      "content": "DELETING"
+                    },
+                    {
+                      "content": "ESTABLISHED"
+                    },
+                    {
+                      "content": "FAILED"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "traffic_mode",
+                "description": "The traffic routed through this gateway.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PrivateNetworkGatewayTrafficMode",
+                  "enum": [
+                    {
+                      "content": "ALL_TRAFFIC"
+                    },
+                    {
+                      "content": "SPECIFIC_DESTINATIONS"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "The time when the gateway was last updated.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The canonical resource name of the gateway, in the form\n`accounts/{account_id}/network-connectivity-configs/{ncc_id}/private-network-gateways/{gateway_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "The human-readable name of the gateway.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "traffic_mode",
+                "description": "The traffic routed through this gateway.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PrivateNetworkGatewayTrafficMode",
+                  "enum": [
+                    {
+                      "content": "ALL_TRAFFIC"
+                    },
+                    {
+                      "content": "SPECIFIC_DESTINATIONS"
+                    }
+                  ]
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "marketplace.ProviderExchangeFilters",
+        "name": "ProviderExchangeFilters",
+        "description": "Marketplace exchanges filters curate which groups can access an exchange.",
+        "package": {
+          "name": "marketplace"
+        },
+        "docs_group": "marketplace",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "list": {
+          "named_id_map": {
+            "pascal_name": "ExchangeFilterNameToIdMap"
+          },
+          "request": {
+            "pascal_name": "ListExchangeFiltersRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Add an exchange filter.",
+            "summary": "Create a new exchange filter.",
+            "path": "/api/2.0/marketplace-exchange/filters",
+            "can_use_json": true,
+            "must_use_json": true,
+            "is_crud_create": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "CreateExchangeFilterRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "filter",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ExchangeFilter",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "filter",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ExchangeFilter",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CreateExchangeFilterResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "filter",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ExchangeFilter",
+                  "is_object": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Delete an exchange filter",
+            "summary": "Delete an exchange filter.",
+            "path": "/api/2.0/marketplace-exchange/filters/{id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "DeleteExchangeFilterRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteExchangeFilterResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "List exchange filter",
+            "summary": "List exchange filters.",
+            "path": "/api/2.0/marketplace-exchange/filters",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "ListExchangeFiltersRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "exchange_id",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "exchange_id",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListExchangeFiltersResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "exchange_id",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "exchange_id",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "Update",
+            "description": "Update an exchange filter.",
+            "summary": "Update exchange filter.",
+            "path": "/api/2.0/marketplace-exchange/filters/{id}",
+            "can_use_json": true,
+            "must_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "UpdateExchangeFilterRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "filter",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ExchangeFilter",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "filter",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ExchangeFilter",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "UpdateExchangeFilterResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "filter",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ExchangeFilter",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "marketplace.ProviderExchanges",
+        "name": "ProviderExchanges",
+        "description": "Marketplace exchanges allow providers to share their listings with a curated set of customers.",
+        "package": {
+          "name": "marketplace"
+        },
+        "docs_group": "marketplace",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "list": {
+          "named_id_map": {
+            "pascal_name": "ExchangeNameToIdMap"
+          },
+          "request": {
+            "pascal_name": "ListExchangesRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "AddListingToExchange",
+            "description": "Associate an exchange with a listing",
+            "summary": "Add an exchange for listing.",
+            "path": "/api/2.0/marketplace-exchange/exchanges-for-listing",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "AddExchangeForListingRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "listing_id",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "exchange_id",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "listing_id",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "exchange_id",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "AddExchangeForListingResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "exchange_id",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "listing_id",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "listing_id",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "exchange_id",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Create",
+            "description": "Create an exchange",
+            "summary": "Create an exchange.",
+            "path": "/api/2.0/marketplace-exchange/exchanges",
+            "can_use_json": true,
+            "must_use_json": true,
+            "is_crud_create": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "CreateExchangeRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "exchange",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Exchange",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "exchange",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Exchange",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CreateExchangeResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "exchange",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Exchange",
+                  "is_object": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "This removes a listing from marketplace.",
+            "summary": "Delete an exchange.",
+            "path": "/api/2.0/marketplace-exchange/exchanges/{id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "DeleteExchangeRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteExchangeResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteListingFromExchange",
+            "description": "Disassociate an exchange with a listing",
+            "summary": "Remove an exchange for listing.",
+            "path": "/api/2.0/marketplace-exchange/exchanges-for-listing/{id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "RemoveExchangeForListingRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "RemoveExchangeForListingResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Get an exchange.",
+            "summary": "Get an exchange.",
+            "path": "/api/2.0/marketplace-exchange/exchanges/{id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetExchangeRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetExchangeResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "List exchanges visible to provider",
+            "summary": "List exchanges.",
+            "path": "/api/2.0/marketplace-exchange/exchanges",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "ListExchangesRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListExchangesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListExchangesForListing",
+            "description": "List exchanges associated with a listing",
+            "summary": "List exchanges for listing.",
+            "path": "/api/2.0/marketplace-exchange/exchanges-for-listing",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "ListExchangesForListingRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "listing_id",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "listing_id",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListExchangesForListingResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "listing_id",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "listing_id",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListListingsForExchange",
+            "description": "List listings associated with an exchange",
+            "summary": "List listings for exchange.",
+            "path": "/api/2.0/marketplace-exchange/listings-for-exchange",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "ListListingsForExchangeRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "exchange_id",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "exchange_id",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListListingsForExchangeResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "exchange_id",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "exchange_id",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "Update",
+            "description": "Update an exchange",
+            "summary": "Update exchange.",
+            "path": "/api/2.0/marketplace-exchange/exchanges/{id}",
+            "can_use_json": true,
+            "must_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "UpdateExchangeRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "exchange",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Exchange",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "exchange",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Exchange",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "UpdateExchangeResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "exchange",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Exchange",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "marketplace.ProviderFiles",
+        "name": "ProviderFiles",
+        "description": "Marketplace offers a set of file APIs for various purposes such as preview notebooks and provider icons.",
+        "package": {
+          "name": "marketplace"
+        },
+        "docs_group": "marketplace",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "list": {
+          "named_id_map": {
+            "pascal_name": "FileInfoDisplayNameToIdMap"
+          },
+          "request": {
+            "pascal_name": "ListFilesRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Create a file. Currently, only provider icons and attached notebooks are supported.",
+            "summary": "Create a file.",
+            "path": "/api/2.0/marketplace-provider/files",
+            "can_use_json": true,
+            "must_use_json": true,
+            "is_crud_create": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "CreateFileRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "file_parent",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "FileParent",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "marketplace_file_type",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "MarketplaceFileType",
+                    "enum": [
+                      {
+                        "content": "APP"
+                      },
+                      {
+                        "content": "EMBEDDED_NOTEBOOK"
+                      },
+                      {
+                        "content": "PROVIDER_ICON"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "mime_type",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "file_parent",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "FileParent",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "marketplace_file_type",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "MarketplaceFileType",
+                    "enum": [
+                      {
+                        "content": "APP"
+                      },
+                      {
+                        "content": "EMBEDDED_NOTEBOOK"
+                      },
+                      {
+                        "content": "PROVIDER_ICON"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "mime_type",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CreateFileResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "display_name",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "file_parent",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "FileParent",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "marketplace_file_type",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "MarketplaceFileType",
+                  "enum": [
+                    {
+                      "content": "APP"
+                    },
+                    {
+                      "content": "EMBEDDED_NOTEBOOK"
+                    },
+                    {
+                      "content": "PROVIDER_ICON"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "mime_type",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Delete a file",
+            "summary": "Delete a file.",
+            "path": "/api/2.0/marketplace-provider/files/{file_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "DeleteFileRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "file_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "file_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteFileResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "file_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "file_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Get a file",
+            "summary": "Get a file.",
+            "path": "/api/2.0/marketplace-provider/files/{file_id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetFileRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "file_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "file_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetFileResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "file_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "file_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "List files attached to a parent entity.",
+            "summary": "List files.",
+            "path": "/api/2.0/marketplace-provider/files",
+            "can_use_json": true,
+            "must_use_json": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "ListFilesRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "file_parent",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "pascal_name": "FileParent",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "file_parent",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "pascal_name": "FileParent",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListFilesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "file_parent",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "FileParent",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "page_size",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          }
+        ]
+      },
+      {
+        "id": "marketplace.ProviderListings",
+        "name": "ProviderListings",
+        "description": "Listings are the core entities in the Marketplace. They represent the products that are available for consumption.",
+        "package": {
+          "name": "marketplace"
+        },
+        "docs_group": "marketplace",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "list": {
+          "named_id_map": {
+            "pascal_name": "ListingSummaryNameToIdMap"
+          },
+          "request": {
+            "pascal_name": "GetListingsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Create a new listing",
+            "summary": "Create a listing.",
+            "path": "/api/2.0/marketplace-provider/listing",
+            "can_use_json": true,
+            "must_use_json": true,
+            "is_crud_create": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "CreateListingRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "listing",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Listing",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "listing",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Listing",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CreateListingResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "listing",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Listing",
+                  "is_object": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Delete a listing",
+            "summary": "Delete a listing.",
+            "path": "/api/2.0/marketplace-provider/listings/{id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "DeleteListingRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteListingResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Get a listing",
+            "summary": "Get a listing.",
+            "path": "/api/2.0/marketplace-provider/listings/{id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetListingRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetListingResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "List listings owned by this provider",
+            "summary": "List listings.",
+            "path": "/api/2.0/marketplace-provider/listings",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetListingsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "GetListingsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "Update",
+            "description": "Update a listing",
+            "summary": "Update listing.",
+            "path": "/api/2.0/marketplace-provider/listings/{id}",
+            "can_use_json": true,
+            "must_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "UpdateListingRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "listing",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Listing",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "listing",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Listing",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "UpdateListingResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "listing",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Listing",
+                  "is_object": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "marketplace.ProviderPersonalizationRequests",
+        "name": "ProviderPersonalizationRequests",
+        "description": "Personalization requests are an alternate to instantly available listings. Control the lifecycle of personalized solutions.",
+        "package": {
+          "name": "marketplace"
+        },
+        "docs_group": "marketplace",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "list": {
+          "request": {
+            "pascal_name": "ListAllPersonalizationRequestsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "List",
+            "description": "List personalization requests to this provider.\nThis will return all personalization requests, regardless of which listing they are for.",
+            "summary": "All personalization requests across all listings.",
+            "path": "/api/2.0/marketplace-provider/personalization-requests",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "ListAllPersonalizationRequestsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListAllPersonalizationRequestsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "Update",
+            "description": "Update personalization request. This method only permits updating the status of the request.",
+            "summary": "Update personalization request status.",
+            "path": "/api/2.0/marketplace-provider/listings/{listing_id}/personalization-requests/{request_id}/request-status",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "UpdatePersonalizationRequestRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "listing_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "request_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "status",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PersonalizationRequestStatus",
+                    "enum": [
+                      {
+                        "content": "DENIED"
+                      },
+                      {
+                        "content": "FULFILLED"
+                      },
+                      {
+                        "content": "NEW"
+                      },
+                      {
+                        "content": "REQUEST_PENDING"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "listing_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "request_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "status",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PersonalizationRequestStatus",
+                    "enum": [
+                      {
+                        "content": "DENIED"
+                      },
+                      {
+                        "content": "FULFILLED"
+                      },
+                      {
+                        "content": "NEW"
+                      },
+                      {
+                        "content": "REQUEST_PENDING"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "UpdatePersonalizationRequestResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "listing_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "reason",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "request_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "share",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "ShareInfo",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "status",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PersonalizationRequestStatus",
+                  "enum": [
+                    {
+                      "content": "DENIED"
+                    },
+                    {
+                      "content": "FULFILLED"
+                    },
+                    {
+                      "content": "NEW"
+                    },
+                    {
+                      "content": "REQUEST_PENDING"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "listing_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "request_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "status",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PersonalizationRequestStatus",
+                  "enum": [
+                    {
+                      "content": "DENIED"
+                    },
+                    {
+                      "content": "FULFILLED"
+                    },
+                    {
+                      "content": "NEW"
+                    },
+                    {
+                      "content": "REQUEST_PENDING"
+                    }
+                  ]
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "marketplace.ProviderProviderAnalyticsDashboards",
+        "name": "ProviderProviderAnalyticsDashboards",
+        "description": "Manage templated analytics solution for providers.",
+        "package": {
+          "name": "marketplace"
+        },
+        "docs_group": "marketplace",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Create provider analytics dashboard. Returns Marketplace specific `id`. Not to be confused with the Lakeview dashboard id.",
+            "summary": "Create provider analytics dashboard.",
+            "path": "/api/2.0/marketplace-provider/analytics_dashboard",
+            "is_legacy_empty_request": true,
+            "is_crud_create": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "CreateProviderAnalyticsDashboardRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ProviderAnalyticsDashboard",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            }
+          },
+          {
+            "name": "Get",
+            "description": "Get provider analytics dashboard.",
+            "summary": "Get provider analytics dashboard.",
+            "path": "/api/2.0/marketplace-provider/analytics_dashboard",
+            "is_legacy_empty_request": true,
+            "is_crud_read": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "ListProviderAnalyticsDashboardRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListProviderAnalyticsDashboardResponse",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "dashboard_id",
+                  "description": "dashboard_id will be used to open Lakeview dashboard.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "dashboard_id",
+                  "description": "dashboard_id will be used to open Lakeview dashboard.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            }
+          },
+          {
+            "name": "GetLatestVersion",
+            "description": "Get latest version of provider analytics dashboard.",
+            "summary": "Get latest version of provider analytics dashboard.",
+            "path": "/api/2.0/marketplace-provider/analytics_dashboard/latest",
+            "is_legacy_empty_request": true,
+            "is_crud_read": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetLatestVersionProviderAnalyticsDashboardRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "GetLatestVersionProviderAnalyticsDashboardResponse",
+              "is_object": true
+            }
+          },
+          {
+            "name": "Update",
+            "description": "Update provider analytics dashboard.",
+            "summary": "Update provider analytics dashboard.",
+            "path": "/api/2.0/marketplace-provider/analytics_dashboard/{id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "UpdateProviderAnalyticsDashboardRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "id is immutable property and can't be updated.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "id is immutable property and can't be updated.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "UpdateProviderAnalyticsDashboardResponse",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "id \u0026 version should be the same as the request",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "dashboard_id",
+                  "description": "this is newly created Lakeview dashboard for the user",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "id",
+                  "description": "id \u0026 version should be the same as the request",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "dashboard_id",
+                  "description": "this is newly created Lakeview dashboard for the user",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "description": "id is immutable property and can't be updated.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version",
+                "description": "this is the version of the dashboard template we want to update our user to\ncurrent expectation is that it should be equal to latest version of the dashboard template",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "id is immutable property and can't be updated.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "marketplace.ProviderProviders",
+        "name": "ProviderProviders",
+        "description": "Providers are entities that manage assets in Marketplace.",
+        "package": {
+          "name": "marketplace"
+        },
+        "docs_group": "marketplace",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "list": {
+          "named_id_map": {
+            "pascal_name": "ProviderInfoNameToIdMap"
+          },
+          "request": {
+            "pascal_name": "ListProvidersRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Create a provider",
+            "summary": "Create a provider.",
+            "path": "/api/2.0/marketplace-provider/provider",
+            "can_use_json": true,
+            "must_use_json": true,
+            "is_crud_create": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "CreateProviderRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "provider",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ProviderInfo",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "provider",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ProviderInfo",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CreateProviderResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "provider",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ProviderInfo",
+                  "is_object": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Delete provider",
+            "summary": "Delete provider.",
+            "path": "/api/2.0/marketplace-provider/providers/{id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "DeleteProviderRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteProviderResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Get provider profile",
+            "summary": "Get provider.",
+            "path": "/api/2.0/marketplace-provider/providers/{id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetProviderRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetProviderResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "List provider profiles for account.",
+            "summary": "List providers.",
+            "path": "/api/2.0/marketplace-provider/providers",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "ListProvidersRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListProvidersResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "Update",
+            "description": "Update provider profile",
+            "summary": "Update provider.",
+            "path": "/api/2.0/marketplace-provider/providers/{id}",
+            "can_use_json": true,
+            "must_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "UpdateProviderRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "provider",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ProviderInfo",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "provider",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ProviderInfo",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "UpdateProviderResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "provider",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ProviderInfo",
+                  "is_object": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "sharing.Providers",
+        "name": "Providers",
+        "description": "A data provider is an object representing the organization in the real world who shares the\ndata. A provider contains shares which further contain the shared data.",
+        "package": {
+          "name": "sharing"
+        },
+        "docs_group": "sharing",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "named_id_map": {
+            "pascal_name": "ProviderInfoNameToMetastoreIdMap"
+          },
+          "request": {
+            "pascal_name": "ListProvidersRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a new authentication provider minimally based on a name and authentication type.\nThe caller must be an admin on the metastore.",
+            "summary": "Create an auth provider.",
+            "path": "/api/2.1/unity-catalog/providers",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateProvider",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the Provider.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "authentication_type",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AuthenticationType",
+                    "enum": [
+                      {
+                        "content": "DATABRICKS"
+                      },
+                      {
+                        "content": "OAUTH_CLIENT_CREDENTIALS"
+                      },
+                      {
+                        "content": "OIDC_FEDERATION"
+                      },
+                      {
+                        "content": "TOKEN"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the Provider.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "authentication_type",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AuthenticationType",
+                    "enum": [
+                      {
+                        "content": "DATABRICKS"
+                      },
+                      {
+                        "content": "OAUTH_CLIENT_CREDENTIALS"
+                      },
+                      {
+                        "content": "OIDC_FEDERATION"
+                      },
+                      {
+                        "content": "TOKEN"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ProviderInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "authentication_type",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AuthenticationType",
+                  "enum": [
+                    {
+                      "content": "DATABRICKS"
+                    },
+                    {
+                      "content": "OAUTH_CLIENT_CREDENTIALS"
+                    },
+                    {
+                      "content": "OIDC_FEDERATION"
+                    },
+                    {
+                      "content": "TOKEN"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "comment",
+                "description": "Description about the provider.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the Provider.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "recipient_profile_str",
+                "description": "This field is required when the __authentication_type__ is **TOKEN**, **OAUTH_CLIENT_CREDENTIALS** or not provided.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the Provider.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "authentication_type",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AuthenticationType",
+                  "enum": [
+                    {
+                      "content": "DATABRICKS"
+                    },
+                    {
+                      "content": "OAUTH_CLIENT_CREDENTIALS"
+                    },
+                    {
+                      "content": "OIDC_FEDERATION"
+                    },
+                    {
+                      "content": "TOKEN"
+                    }
+                  ]
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes an authentication provider, if the caller is a metastore admin or is the owner of the provider.",
+            "summary": "Delete a provider.",
+            "path": "/api/2.1/unity-catalog/providers/{name}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteProviderRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the provider.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the provider.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Name of the provider.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the provider.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets a specific authentication provider.\nThe caller must supply the name of the provider, and must either be a metastore admin or the owner of the provider.",
+            "summary": "Get a provider.",
+            "path": "/api/2.1/unity-catalog/providers/{name}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetProviderRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the provider.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the provider.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ProviderInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Name of the provider.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the provider.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Gets an array of available authentication providers.\nThe caller must either be a metastore admin, have the **USE_PROVIDER** privilege on the providers,\nor be the owner of the providers. Providers not owned by the caller and for which the caller does\nnot have the **USE_PROVIDER** privilege are not included in the response.\nThere is no guarantee of a specific ordering of the elements in the array.",
+            "summary": "List providers.",
+            "path": "/api/2.1/unity-catalog/providers",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListProvidersRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListProvidersResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "data_provider_global_metastore_id",
+                "description": "If not provided, all providers will be returned.\nIf no providers exist with this ID, no results will be returned.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "max_results",
+                "description": "Maximum number of providers to return.\n- when set to 0, the page length is set to a server configured value (recommended);\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- when set to a value less than 0, an invalid parameter error is returned;\n- If not set, all valid providers are returned (not recommended).\n- Note: The number of returned providers might be less than the specified max_results size, even zero.\nThe only definitive indication that no further providers can be fetched is when the next_page_token is unset from the response.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque pagination token to go to next page based on previous query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Opaque pagination token to go to next page based on previous query.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              },
+              "max_results": {
+                "name": "max_results",
+                "description": "Maximum number of providers to return.\n- when set to 0, the page length is set to a server configured value (recommended);\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- when set to a value less than 0, an invalid parameter error is returned;\n- If not set, all valid providers are returned (not recommended).\n- Note: The number of returned providers might be less than the specified max_results size, even zero.\nThe only definitive indication that no further providers can be fetched is when the next_page_token is unset from the response.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              }
+            }
+          },
+          {
+            "name": "ListProviderShareAssets",
+            "description": "Get arrays of assets associated with a specified provider's share.\nThe caller is the recipient of the share.",
+            "summary": "List assets by provider share.",
+            "path": "/api/2.1/data-sharing/providers/{provider_name}/shares/{share_name}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListProviderShareAssetsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "provider_name",
+                  "description": "The name of the provider who owns the share.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "share_name",
+                  "description": "The name of the share.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "provider_name",
+                  "description": "The name of the provider who owns the share.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "share_name",
+                  "description": "The name of the share.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListProviderShareAssetsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "function_max_results",
+                "description": "Maximum number of functions to return.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "notebook_max_results",
+                "description": "Maximum number of notebooks to return.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "provider_name",
+                "description": "The name of the provider who owns the share.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "share_name",
+                "description": "The name of the share.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "table_max_results",
+                "description": "Maximum number of tables to return.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "volume_max_results",
+                "description": "Maximum number of volumes to return.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "provider_name",
+                "description": "The name of the provider who owns the share.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "share_name",
+                "description": "The name of the share.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListShares",
+            "description": "Gets an array of a specified provider's shares within the metastore where:\n\n* the caller is a metastore admin, or\n* the caller is the owner.",
+            "summary": "List shares by Provider.",
+            "path": "/api/2.1/unity-catalog/providers/{name}/shares",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListSharesRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the provider in which to list shares.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the provider in which to list shares.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListProviderSharesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "max_results",
+                "description": "Maximum number of shares to return.\n- when set to 0, the page length is set to a server configured value (recommended);\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- when set to a value less than 0, an invalid parameter error is returned;\n- If not set, all valid shares are returned (not recommended).\n- Note: The number of returned shares might be less than the specified max_results size, even zero.\nThe only definitive indication that no further shares can be fetched is when the next_page_token is unset from the response.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the provider in which to list shares.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque pagination token to go to next page based on previous query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the provider in which to list shares.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Opaque pagination token to go to next page based on previous query.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              },
+              "max_results": {
+                "name": "max_results",
+                "description": "Maximum number of shares to return.\n- when set to 0, the page length is set to a server configured value (recommended);\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- when set to a value less than 0, an invalid parameter error is returned;\n- If not set, all valid shares are returned (not recommended).\n- Note: The number of returned shares might be less than the specified max_results size, even zero.\nThe only definitive indication that no further shares can be fetched is when the next_page_token is unset from the response.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              }
+            }
+          },
+          {
+            "name": "Update",
+            "description": "Updates the information for an authentication provider, if the caller is a metastore admin or is the owner of the provider.\nIf the update changes the provider name, the caller must be both a metastore admin and the owner of the provider.",
+            "summary": "Update a provider.",
+            "path": "/api/2.1/unity-catalog/providers/{name}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateProvider",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the provider.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the provider.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ProviderInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "comment",
+                "description": "Description about the provider.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the provider.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "new_name",
+                "description": "New name for the provider.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "owner",
+                "description": "Username of Provider owner.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "recipient_profile_str",
+                "description": "This field is required when the __authentication_type__ is **TOKEN**, **OAUTH_CLIENT_CREDENTIALS** or not provided.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the provider.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "oauth2.PublishedAppIntegration",
+        "name": "PublishedAppIntegration",
+        "description": "These APIs enable administrators to manage published OAuth app integrations, which is required for\nadding/using Published OAuth App Integration like Tableau Desktop for Databricks in AWS cloud.",
+        "package": {
+          "name": "oauth2"
+        },
+        "is_accounts": true,
+        "docs_group": "oauth2",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListPublishedAppIntegrationsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Create Published OAuth App Integration.\n\nYou can retrieve the published OAuth app integration via [PublishedAppIntegration/get](https://docs.databricks.com/api/account/publishedappintegration/get).",
+            "summary": "Create Published OAuth App Integration.",
+            "path": "/api/2.0/accounts/{account_id}/oauth2/published-app-integrations",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreatePublishedAppIntegration",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "CreatePublishedAppIntegrationOutput",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "app_id",
+                "description": "App id of the OAuth published app integration.\nFor example power-bi, tableau-deskop",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "token_access_policy",
+                "description": "Token access policy",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "TokenAccessPolicy",
+                  "is_object": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Delete an existing Published OAuth App Integration.\nYou can retrieve the published OAuth app integration via [PublishedAppIntegration/get](https://docs.databricks.com/api/account/publishedappintegration/get).",
+            "summary": "Delete Published OAuth App Integration.",
+            "path": "/api/2.0/accounts/{account_id}/oauth2/published-app-integrations/{integration_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeletePublishedAppIntegrationRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "integration_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "integration_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeletePublishedAppIntegrationOutput",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "integration_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "integration_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets the Published OAuth App Integration for the given integration id.",
+            "summary": "Get OAuth Published App Integration.",
+            "path": "/api/2.0/accounts/{account_id}/oauth2/published-app-integrations/{integration_id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetPublishedAppIntegrationRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "integration_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "integration_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetPublishedAppIntegrationOutput",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "integration_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "integration_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Get the list of published OAuth app integrations for the specified Databricks account",
+            "summary": "Get published oauth app integrations.",
+            "path": "/api/2.0/accounts/{account_id}/oauth2/published-app-integrations",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListPublishedAppIntegrationsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "GetPublishedAppIntegrationsOutput",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "Update",
+            "description": "Updates an existing published OAuth App Integration.\nYou can retrieve the published OAuth app integration via [PublishedAppIntegration/get](https://docs.databricks.com/api/account/publishedappintegration/get).",
+            "summary": "Updates Published OAuth App Integration.",
+            "path": "/api/2.0/accounts/{account_id}/oauth2/published-app-integrations/{integration_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdatePublishedAppIntegration",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "integration_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "integration_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "UpdatePublishedAppIntegrationOutput",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "integration_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "token_access_policy",
+                "description": "Token access policy to be updated in the published OAuth app integration",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "TokenAccessPolicy",
+                  "is_object": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "integration_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "qualitymonitorv2.QualityMonitorV2",
+        "name": "QualityMonitorV2",
+        "description": "Deprecated: Please use the Data Quality Monitoring API instead (REST: /api/data-quality/v1/monitors). Manage data quality of UC objects (currently support `schema`).",
+        "package": {
+          "name": "qualitymonitorv2"
+        },
+        "docs_group": "qualitymonitor",
+        "launch_stage": "PUBLIC_BETA",
+        "cli_launch_stage_label": "*Beta*",
+        "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+        "cli_launch_stage_display": "Beta",
+        "list": {
+          "request": {
+            "pascal_name": "ListQualityMonitorRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "CreateQualityMonitor",
+            "description": "Deprecated: Use Data Quality Monitoring API instead (/api/data-quality/v1/monitors).\nCreate a quality monitor on UC object.",
+            "summary": "Create a quality monitor.",
+            "path": "/api/2.0/quality-monitors",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "CreateQualityMonitorRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "quality_monitor",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "QualityMonitor",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "quality_monitor",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "QualityMonitor",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "quality_monitor",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "QualityMonitor",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "object_type",
+                    "description": "The type of the monitored object. Can be one of the following: schema.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "object_id",
+                    "description": "The uuid of the request object. For example, schema id.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "object_type",
+                    "description": "The type of the monitored object. Can be one of the following: schema.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "object_id",
+                    "description": "The uuid of the request object. For example, schema id.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "QualityMonitor",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: schema.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The uuid of the request object. For example, schema id.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: schema.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The uuid of the request object. For example, schema id.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "quality_monitor",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "QualityMonitor",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "object_type",
+                      "description": "The type of the monitored object. Can be one of the following: schema.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "object_id",
+                      "description": "The uuid of the request object. For example, schema id.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "object_type",
+                      "description": "The type of the monitored object. Can be one of the following: schema.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "object_id",
+                      "description": "The uuid of the request object. For example, schema id.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "anomaly_detection_config",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AnomalyDetectionConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "object_id",
+                "description": "The uuid of the request object. For example, schema id.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_type",
+                "description": "The type of the monitored object. Can be one of the following: schema.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "validity_check_configurations",
+                "description": "Validity check configurations for anomaly detection.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ValidityCheckConfigurationList",
+                  "array_value": {
+                    "pascal_name": "ValidityCheckConfiguration",
+                    "is_object": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "object_type",
+                "description": "The type of the monitored object. Can be one of the following: schema.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_id",
+                "description": "The uuid of the request object. For example, schema id.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteQualityMonitor",
+            "description": "Deprecated: Use Data Quality Monitoring API instead (/api/data-quality/v1/monitors).\nDelete a quality monitor on UC object.",
+            "summary": "Delete a quality monitor.",
+            "path": "/api/2.0/quality-monitors/{object_type}/{object_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "DeleteQualityMonitorRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: schema.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The uuid of the request object. For example, schema id.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: schema.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The uuid of the request object. For example, schema id.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "object_id",
+                "description": "The uuid of the request object. For example, schema id.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_type",
+                "description": "The type of the monitored object. Can be one of the following: schema.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "object_type",
+                "description": "The type of the monitored object. Can be one of the following: schema.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_id",
+                "description": "The uuid of the request object. For example, schema id.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetQualityMonitor",
+            "description": "Deprecated: Use Data Quality Monitoring API instead (/api/data-quality/v1/monitors).\nRead a quality monitor on UC object.",
+            "summary": "Read a quality monitor.",
+            "path": "/api/2.0/quality-monitors/{object_type}/{object_id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetQualityMonitorRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: schema.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The uuid of the request object. For example, schema id.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: schema.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The uuid of the request object. For example, schema id.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "QualityMonitor",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: schema.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The uuid of the request object. For example, schema id.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: schema.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The uuid of the request object. For example, schema id.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "object_id",
+                "description": "The uuid of the request object. For example, schema id.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_type",
+                "description": "The type of the monitored object. Can be one of the following: schema.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "object_type",
+                "description": "The type of the monitored object. Can be one of the following: schema.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_id",
+                "description": "The uuid of the request object. For example, schema id.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListQualityMonitor",
+            "description": "Deprecated: Use Data Quality Monitoring API instead (/api/data-quality/v1/monitors).\n(Unimplemented) List quality monitors.",
+            "summary": "List quality monitors.",
+            "path": "/api/2.0/quality-monitors",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ListQualityMonitorRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListQualityMonitorResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "UpdateQualityMonitor",
+            "description": "Deprecated: Use Data Quality Monitoring API instead (/api/data-quality/v1/monitors).\n(Unimplemented) Update a quality monitor on UC object.",
+            "summary": "Update a quality monitor.",
+            "path": "/api/2.0/quality-monitors/{object_type}/{object_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "UpdateQualityMonitorRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: schema.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The uuid of the request object. For example, schema id.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "quality_monitor",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "QualityMonitor",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: schema.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The uuid of the request object. For example, schema id.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "quality_monitor",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "QualityMonitor",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "quality_monitor",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "QualityMonitor",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "object_type",
+                    "description": "The type of the monitored object. Can be one of the following: schema.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "object_id",
+                    "description": "The uuid of the request object. For example, schema id.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "object_type",
+                    "description": "The type of the monitored object. Can be one of the following: schema.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "object_id",
+                    "description": "The uuid of the request object. For example, schema id.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "QualityMonitor",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: schema.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The uuid of the request object. For example, schema id.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "object_type",
+                  "description": "The type of the monitored object. Can be one of the following: schema.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "object_id",
+                  "description": "The uuid of the request object. For example, schema id.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "object_id",
+                "description": "The uuid of the request object. For example, schema id.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_type",
+                "description": "The type of the monitored object. Can be one of the following: schema.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "quality_monitor",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "QualityMonitor",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "object_type",
+                      "description": "The type of the monitored object. Can be one of the following: schema.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "object_id",
+                      "description": "The uuid of the request object. For example, schema id.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "object_type",
+                      "description": "The type of the monitored object. Can be one of the following: schema.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "object_id",
+                      "description": "The uuid of the request object. For example, schema id.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "anomaly_detection_config",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AnomalyDetectionConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "object_id",
+                "description": "The uuid of the request object. For example, schema id.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_type",
+                "description": "The type of the monitored object. Can be one of the following: schema.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "validity_check_configurations",
+                "description": "Validity check configurations for anomaly detection.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ValidityCheckConfigurationList",
+                  "array_value": {
+                    "pascal_name": "ValidityCheckConfiguration",
+                    "is_object": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "object_type",
+                "description": "The type of the monitored object. Can be one of the following: schema.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_id",
+                "description": "The uuid of the request object. For example, schema id.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_type",
+                "description": "The type of the monitored object. Can be one of the following: schema.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "object_id",
+                "description": "The uuid of the request object. For example, schema id.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "catalog.QualityMonitors",
+        "name": "QualityMonitors",
+        "description": "Deprecated: Please use the Data Quality Monitors API instead (REST: /api/data-quality/v1/monitors), which manages both Data Profiling and Anomaly Detection.\n\nA monitor computes and monitors data or model quality metrics for a table over time.\nIt generates metrics tables and a dashboard that you can use to monitor table health and set alerts.\nMost write operations require the user to be the owner of the table (or its parent schema or parent catalog).\nViewing the dashboard, computed metrics, or monitor configuration only requires the user to have **SELECT**\nprivileges on the table (along with **USE_SCHEMA** and **USE_CATALOG**).",
+        "package": {
+          "name": "catalog"
+        },
+        "docs_group": "catalog",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "methods": [
+          {
+            "name": "CancelRefresh",
+            "description": "Deprecated: Use Data Quality Monitors API instead (/api/data-quality/v1/monitors).\nCancels an already-initiated refresh job.",
+            "summary": "Cancel refresh.",
+            "path": "/api/2.1/unity-catalog/tables/{table_name}/monitor/refreshes/{refresh_id}/cancel",
+            "is_crud_create": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "CancelRefreshRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "table_name",
+                  "description": "UC table name in format `catalog.schema.table_name`.\ntable_name is case insensitive and spaces are disallowed.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "refresh_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "table_name",
+                  "description": "UC table name in format `catalog.schema.table_name`.\ntable_name is case insensitive and spaces are disallowed.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "refresh_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CancelRefreshResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "refresh_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "table_name",
+                "description": "UC table name in format `catalog.schema.table_name`.\ntable_name is case insensitive and spaces are disallowed.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "table_name",
+                "description": "UC table name in format `catalog.schema.table_name`.\ntable_name is case insensitive and spaces are disallowed.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "refresh_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Create",
+            "description": "Deprecated: Use Data Quality Monitors API instead (/api/data-quality/v1/monitors).\nCreates a new monitor for the specified table.\n\nThe caller must either:\n1. be an owner of the table's parent catalog, have **USE_SCHEMA** on the table's parent schema, and have **SELECT** access on the table\n2. have **USE_CATALOG** on the table's parent catalog, be an owner of the table's parent schema, and have **SELECT** access on the table.\n3. have the following permissions:\n- **USE_CATALOG** on the table's parent catalog\n- **USE_SCHEMA** on the table's parent schema\n- be an owner of the table.\n\nWorkspace assets, such as the dashboard, will be created in the workspace where\nthis call was made.",
+            "summary": "Create a table monitor.",
+            "path": "/api/2.1/unity-catalog/tables/{table_name}/monitor",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateMonitor",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "table_name",
+                  "description": "UC table name in format `catalog.schema.table_name`.\nThis field corresponds to the {full_table_name_arg} arg in the endpoint path.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "output_schema_name",
+                  "description": "[Create:REQ Update:REQ] Schema where output tables are created. Needs to be in 2-level format {catalog}.{schema}",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "assets_dir",
+                  "description": "[Create:REQ Update:IGN] Field for specifying the absolute path to a custom directory to store data-monitoring\nassets. Normally prepopulated to a default user location via UI and Python APIs.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "table_name",
+                  "description": "UC table name in format `catalog.schema.table_name`.\nThis field corresponds to the {full_table_name_arg} arg in the endpoint path.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "output_schema_name",
+                  "description": "[Create:REQ Update:REQ] Schema where output tables are created. Needs to be in 2-level format {catalog}.{schema}",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "assets_dir",
+                  "description": "[Create:REQ Update:IGN] Field for specifying the absolute path to a custom directory to store data-monitoring\nassets. Normally prepopulated to a default user location via UI and Python APIs.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "MonitorInfo",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "output_schema_name",
+                  "description": "[Create:REQ Update:REQ] Schema where output tables are created. Needs to be in 2-level format {catalog}.{schema}",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "table_name",
+                  "description": "[Create:ERR Update:IGN] UC table to monitor. Format: `catalog.schema.table_name`",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "status",
+                  "description": "[Create:ERR Update:IGN] The monitor status.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "MonitorInfoStatus",
+                    "enum": [
+                      {
+                        "content": "MONITOR_STATUS_ACTIVE"
+                      },
+                      {
+                        "content": "MONITOR_STATUS_DELETE_PENDING"
+                      },
+                      {
+                        "content": "MONITOR_STATUS_ERROR"
+                      },
+                      {
+                        "content": "MONITOR_STATUS_FAILED"
+                      },
+                      {
+                        "content": "MONITOR_STATUS_PENDING"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "profile_metrics_table_name",
+                  "description": "[Create:ERR Update:IGN] Table that stores profile metrics data. Format: `catalog.schema.table_name`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "drift_metrics_table_name",
+                  "description": "[Create:ERR Update:IGN] Table that stores drift metrics data. Format: `catalog.schema.table_name`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "monitor_version",
+                  "description": "[Create:ERR Update:IGN] Represents the current monitor configuration version in use. The version will be represented in a\nnumeric fashion (1,2,3...). The field has flexibility to take on negative values, which can indicate corrupted\nmonitor_version numbers.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "output_schema_name",
+                  "description": "[Create:REQ Update:REQ] Schema where output tables are created. Needs to be in 2-level format {catalog}.{schema}",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "table_name",
+                  "description": "[Create:ERR Update:IGN] UC table to monitor. Format: `catalog.schema.table_name`",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "status",
+                  "description": "[Create:ERR Update:IGN] The monitor status.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "MonitorInfoStatus",
+                    "enum": [
+                      {
+                        "content": "MONITOR_STATUS_ACTIVE"
+                      },
+                      {
+                        "content": "MONITOR_STATUS_DELETE_PENDING"
+                      },
+                      {
+                        "content": "MONITOR_STATUS_ERROR"
+                      },
+                      {
+                        "content": "MONITOR_STATUS_FAILED"
+                      },
+                      {
+                        "content": "MONITOR_STATUS_PENDING"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "profile_metrics_table_name",
+                  "description": "[Create:ERR Update:IGN] Table that stores profile metrics data. Format: `catalog.schema.table_name`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "drift_metrics_table_name",
+                  "description": "[Create:ERR Update:IGN] Table that stores drift metrics data. Format: `catalog.schema.table_name`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "monitor_version",
+                  "description": "[Create:ERR Update:IGN] Represents the current monitor configuration version in use. The version will be represented in a\nnumeric fashion (1,2,3...). The field has flexibility to take on negative values, which can indicate corrupted\nmonitor_version numbers.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "assets_dir",
+                "description": "[Create:REQ Update:IGN] Field for specifying the absolute path to a custom directory to store data-monitoring\nassets. Normally prepopulated to a default user location via UI and Python APIs.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "baseline_table_name",
+                "description": "[Create:OPT Update:OPT] Baseline table name.\nBaseline data is used to compute drift from the data in the monitored `table_name`.\nThe baseline table and the monitored table shall have the same schema.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "custom_metrics",
+                "description": "[Create:OPT Update:OPT] Custom metrics.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "MonitorMetricList",
+                  "array_value": {
+                    "pascal_name": "MonitorMetric",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "data_classification_config",
+                "description": "[Create:OPT Update:OPT] Data classification related config.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "MonitorDataClassificationConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "inference_log",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "MonitorInferenceLog",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "latest_monitor_failure_msg",
+                "description": "[Create:ERR Update:IGN] The latest error message for a monitor failure.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "notifications",
+                "description": "[Create:OPT Update:OPT] Field for specifying notification settings.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "MonitorNotifications",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "output_schema_name",
+                "description": "[Create:REQ Update:REQ] Schema where output tables are created. Needs to be in 2-level format {catalog}.{schema}",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schedule",
+                "description": "[Create:OPT Update:OPT] The monitor schedule.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "MonitorCronSchedule",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "skip_builtin_dashboard",
+                "description": "Whether to skip creating a default dashboard summarizing data quality metrics.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "slicing_exprs",
+                "description": "[Create:OPT Update:OPT] List of column expressions to slice data with for targeted analysis. The data is grouped by\neach expression independently, resulting in a separate slice for each predicate and its\ncomplements. For example `slicing_exprs=[“col_1”, “col_2 \u003e 10”]` will generate the following\nslices: two slices for `col_2 \u003e 10` (True and False), and one slice per unique value in\n`col1`. For high-cardinality columns, only the top 100 unique values by frequency will\ngenerate slices.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "snapshot",
+                "description": "Configuration for monitoring snapshot tables.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "MonitorSnapshot",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "table_name",
+                "description": "UC table name in format `catalog.schema.table_name`.\nThis field corresponds to the {full_table_name_arg} arg in the endpoint path.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "time_series",
+                "description": "Configuration for monitoring time series tables.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "MonitorTimeSeries",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "warehouse_id",
+                "description": "Optional argument to specify the warehouse for dashboard creation. If not specified, the first running\nwarehouse will be used.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "table_name",
+                "description": "UC table name in format `catalog.schema.table_name`.\nThis field corresponds to the {full_table_name_arg} arg in the endpoint path.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "output_schema_name",
+                "description": "[Create:REQ Update:REQ] Schema where output tables are created. Needs to be in 2-level format {catalog}.{schema}",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "assets_dir",
+                "description": "[Create:REQ Update:IGN] Field for specifying the absolute path to a custom directory to store data-monitoring\nassets. Normally prepopulated to a default user location via UI and Python APIs.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deprecated: Use Data Quality Monitors API instead (/api/data-quality/v1/monitors).\nDeletes a monitor for the specified table.\n\nThe caller must either:\n1. be an owner of the table's parent catalog\n2. have **USE_CATALOG** on the table's parent catalog and be an owner of the table's parent schema\n3. have the following permissions:\n- **USE_CATALOG** on the table's parent catalog\n- **USE_SCHEMA** on the table's parent schema\n- be an owner of the table.\n\nAdditionally, the call must be made from the workspace where the monitor was created.\n\nNote that the metric tables and dashboard will not be deleted as part of this call; those\nassets must be manually cleaned up (if desired).",
+            "summary": "Delete a table monitor.",
+            "path": "/api/2.1/unity-catalog/tables/{table_name}/monitor",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteQualityMonitorRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "table_name",
+                  "description": "UC table name in format `catalog.schema.table_name`.\nThis field corresponds to the {full_table_name_arg} arg in the endpoint path.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "table_name",
+                  "description": "UC table name in format `catalog.schema.table_name`.\nThis field corresponds to the {full_table_name_arg} arg in the endpoint path.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteMonitorResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "table_name",
+                "description": "UC table name in format `catalog.schema.table_name`.\nThis field corresponds to the {full_table_name_arg} arg in the endpoint path.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "table_name",
+                "description": "UC table name in format `catalog.schema.table_name`.\nThis field corresponds to the {full_table_name_arg} arg in the endpoint path.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Deprecated: Use Data Quality Monitors API instead (/api/data-quality/v1/monitors).\nGets a monitor for the specified table.\n\nThe caller must either:\n1. be an owner of the table's parent catalog\n2. have **USE_CATALOG** on the table's parent catalog and be an owner of the table's parent schema.\n3. have the following permissions:\n- **USE_CATALOG** on the table's parent catalog\n- **USE_SCHEMA** on the table's parent schema\n- **SELECT** privilege on the table.\n\nThe returned information includes configuration values, as well as information on\nassets created by the monitor. Some information (e.g., dashboard) may be filtered out\nif the caller is in a different workspace than where the monitor was created.",
+            "summary": "Get a table monitor.",
+            "path": "/api/2.1/unity-catalog/tables/{table_name}/monitor",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetQualityMonitorRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "table_name",
+                  "description": "UC table name in format `catalog.schema.table_name`.\nThis field corresponds to the {full_table_name_arg} arg in the endpoint path.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "table_name",
+                  "description": "UC table name in format `catalog.schema.table_name`.\nThis field corresponds to the {full_table_name_arg} arg in the endpoint path.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "MonitorInfo",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "output_schema_name",
+                  "description": "[Create:REQ Update:REQ] Schema where output tables are created. Needs to be in 2-level format {catalog}.{schema}",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "table_name",
+                  "description": "[Create:ERR Update:IGN] UC table to monitor. Format: `catalog.schema.table_name`",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "status",
+                  "description": "[Create:ERR Update:IGN] The monitor status.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "MonitorInfoStatus",
+                    "enum": [
+                      {
+                        "content": "MONITOR_STATUS_ACTIVE"
+                      },
+                      {
+                        "content": "MONITOR_STATUS_DELETE_PENDING"
+                      },
+                      {
+                        "content": "MONITOR_STATUS_ERROR"
+                      },
+                      {
+                        "content": "MONITOR_STATUS_FAILED"
+                      },
+                      {
+                        "content": "MONITOR_STATUS_PENDING"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "profile_metrics_table_name",
+                  "description": "[Create:ERR Update:IGN] Table that stores profile metrics data. Format: `catalog.schema.table_name`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "drift_metrics_table_name",
+                  "description": "[Create:ERR Update:IGN] Table that stores drift metrics data. Format: `catalog.schema.table_name`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "monitor_version",
+                  "description": "[Create:ERR Update:IGN] Represents the current monitor configuration version in use. The version will be represented in a\nnumeric fashion (1,2,3...). The field has flexibility to take on negative values, which can indicate corrupted\nmonitor_version numbers.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "output_schema_name",
+                  "description": "[Create:REQ Update:REQ] Schema where output tables are created. Needs to be in 2-level format {catalog}.{schema}",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "table_name",
+                  "description": "[Create:ERR Update:IGN] UC table to monitor. Format: `catalog.schema.table_name`",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "status",
+                  "description": "[Create:ERR Update:IGN] The monitor status.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "MonitorInfoStatus",
+                    "enum": [
+                      {
+                        "content": "MONITOR_STATUS_ACTIVE"
+                      },
+                      {
+                        "content": "MONITOR_STATUS_DELETE_PENDING"
+                      },
+                      {
+                        "content": "MONITOR_STATUS_ERROR"
+                      },
+                      {
+                        "content": "MONITOR_STATUS_FAILED"
+                      },
+                      {
+                        "content": "MONITOR_STATUS_PENDING"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "profile_metrics_table_name",
+                  "description": "[Create:ERR Update:IGN] Table that stores profile metrics data. Format: `catalog.schema.table_name`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "drift_metrics_table_name",
+                  "description": "[Create:ERR Update:IGN] Table that stores drift metrics data. Format: `catalog.schema.table_name`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "monitor_version",
+                  "description": "[Create:ERR Update:IGN] Represents the current monitor configuration version in use. The version will be represented in a\nnumeric fashion (1,2,3...). The field has flexibility to take on negative values, which can indicate corrupted\nmonitor_version numbers.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "table_name",
+                "description": "UC table name in format `catalog.schema.table_name`.\nThis field corresponds to the {full_table_name_arg} arg in the endpoint path.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "table_name",
+                "description": "UC table name in format `catalog.schema.table_name`.\nThis field corresponds to the {full_table_name_arg} arg in the endpoint path.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetRefresh",
+            "description": "Deprecated: Use Data Quality Monitors API instead (/api/data-quality/v1/monitors).\nGets info about a specific monitor refresh using the given refresh ID.\n\nThe caller must either:\n1. be an owner of the table's parent catalog\n2. have **USE_CATALOG** on the table's parent catalog and be an owner of the table's parent schema\n3. have the following permissions:\n- **USE_CATALOG** on the table's parent catalog\n- **USE_SCHEMA** on the table's parent schema\n- **SELECT** privilege on the table.\n\nAdditionally, the call must be made from the workspace where the monitor was created.",
+            "summary": "Get refresh.",
+            "path": "/api/2.1/unity-catalog/tables/{table_name}/monitor/refreshes/{refresh_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetRefreshRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "table_name",
+                  "description": "Full name of the table.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "refresh_id",
+                  "description": "ID of the refresh.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "table_name",
+                  "description": "Full name of the table.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "refresh_id",
+                  "description": "ID of the refresh.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "MonitorRefreshInfo",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "refresh_id",
+                  "description": "Unique id of the refresh operation.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "state",
+                  "description": "The current state of the refresh.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "MonitorRefreshInfoState",
+                    "enum": [
+                      {
+                        "content": "CANCELED"
+                      },
+                      {
+                        "content": "FAILED"
+                      },
+                      {
+                        "content": "PENDING"
+                      },
+                      {
+                        "content": "RUNNING"
+                      },
+                      {
+                        "content": "SUCCESS"
+                      },
+                      {
+                        "content": "UNKNOWN"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "start_time_ms",
+                  "description": "Time at which refresh operation was initiated (milliseconds since 1/1/1970 UTC).",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "refresh_id",
+                  "description": "Unique id of the refresh operation.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "state",
+                  "description": "The current state of the refresh.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "MonitorRefreshInfoState",
+                    "enum": [
+                      {
+                        "content": "CANCELED"
+                      },
+                      {
+                        "content": "FAILED"
+                      },
+                      {
+                        "content": "PENDING"
+                      },
+                      {
+                        "content": "RUNNING"
+                      },
+                      {
+                        "content": "SUCCESS"
+                      },
+                      {
+                        "content": "UNKNOWN"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "start_time_ms",
+                  "description": "Time at which refresh operation was initiated (milliseconds since 1/1/1970 UTC).",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "refresh_id",
+                "description": "ID of the refresh.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "table_name",
+                "description": "Full name of the table.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "table_name",
+                "description": "Full name of the table.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "refresh_id",
+                "description": "ID of the refresh.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListRefreshes",
+            "description": "Deprecated: Use Data Quality Monitors API instead (/api/data-quality/v1/monitors).\nGets an array containing the history of the most recent refreshes (up to 25) for this table.\n\nThe caller must either:\n1. be an owner of the table's parent catalog\n2. have **USE_CATALOG** on the table's parent catalog and be an owner of the table's parent schema\n3. have the following permissions:\n- **USE_CATALOG** on the table's parent catalog\n- **USE_SCHEMA** on the table's parent schema\n- **SELECT** privilege on the table.\n\nAdditionally, the call must be made from the workspace where the monitor was created.",
+            "summary": "List refreshes.",
+            "path": "/api/2.1/unity-catalog/tables/{table_name}/monitor/refreshes",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListRefreshesRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "table_name",
+                  "description": "UC table name in format `catalog.schema.table_name`.\ntable_name is case insensitive and spaces are disallowed.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "table_name",
+                  "description": "UC table name in format `catalog.schema.table_name`.\ntable_name is case insensitive and spaces are disallowed.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "MonitorRefreshListResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "table_name",
+                "description": "UC table name in format `catalog.schema.table_name`.\ntable_name is case insensitive and spaces are disallowed.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "table_name",
+                "description": "UC table name in format `catalog.schema.table_name`.\ntable_name is case insensitive and spaces are disallowed.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "RegenerateDashboard",
+            "description": "Deprecated: Use Data Quality Monitors API instead (/api/data-quality/v1/monitors).\nRegenerates the monitoring dashboard for the specified table.\n\nThe caller must either:\n1. be an owner of the table's parent catalog\n2. have **USE_CATALOG** on the table's parent catalog and be an owner of the table's parent schema\n3. have the following permissions:\n- **USE_CATALOG** on the table's parent catalog\n- **USE_SCHEMA** on the table's parent schema\n- be an owner of the table\n\nThe call must be made from the workspace where the monitor was created. The dashboard will be regenerated in\nthe assets directory that was specified when the monitor was created.",
+            "summary": "Regenerate a monitoring dashboard.",
+            "path": "/api/2.1/quality-monitoring/tables/{table_name}/monitor/dashboard",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "RegenerateDashboardRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "table_name",
+                  "description": "UC table name in format `catalog.schema.table_name`.\nThis field corresponds to the {full_table_name_arg} arg in the endpoint path.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "table_name",
+                  "description": "UC table name in format `catalog.schema.table_name`.\nThis field corresponds to the {full_table_name_arg} arg in the endpoint path.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "RegenerateDashboardResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "table_name",
+                "description": "UC table name in format `catalog.schema.table_name`.\nThis field corresponds to the {full_table_name_arg} arg in the endpoint path.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "warehouse_id",
+                "description": "Optional argument to specify the warehouse for dashboard regeneration. If not specified, the first running\nwarehouse will be used.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "table_name",
+                "description": "UC table name in format `catalog.schema.table_name`.\nThis field corresponds to the {full_table_name_arg} arg in the endpoint path.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "RunRefresh",
+            "description": "Deprecated: Use Data Quality Monitors API instead (/api/data-quality/v1/monitors).\nQueues a metric refresh on the monitor for the specified table.\nThe refresh will execute in the background.\n\nThe caller must either:\n1. be an owner of the table's parent catalog\n2. have **USE_CATALOG** on the table's parent catalog and be an owner of the table's parent schema\n3. have the following permissions:\n- **USE_CATALOG** on the table's parent catalog\n- **USE_SCHEMA** on the table's parent schema\n- be an owner of the table\n\nAdditionally, the call must be made from the workspace where the monitor was created.",
+            "summary": "Run refresh.",
+            "path": "/api/2.1/unity-catalog/tables/{table_name}/monitor/refreshes",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "RunRefreshRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "table_name",
+                  "description": "UC table name in format `catalog.schema.table_name`.\ntable_name is case insensitive and spaces are disallowed.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "table_name",
+                  "description": "UC table name in format `catalog.schema.table_name`.\ntable_name is case insensitive and spaces are disallowed.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "MonitorRefreshInfo",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "refresh_id",
+                  "description": "Unique id of the refresh operation.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "state",
+                  "description": "The current state of the refresh.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "MonitorRefreshInfoState",
+                    "enum": [
+                      {
+                        "content": "CANCELED"
+                      },
+                      {
+                        "content": "FAILED"
+                      },
+                      {
+                        "content": "PENDING"
+                      },
+                      {
+                        "content": "RUNNING"
+                      },
+                      {
+                        "content": "SUCCESS"
+                      },
+                      {
+                        "content": "UNKNOWN"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "start_time_ms",
+                  "description": "Time at which refresh operation was initiated (milliseconds since 1/1/1970 UTC).",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "refresh_id",
+                  "description": "Unique id of the refresh operation.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "state",
+                  "description": "The current state of the refresh.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "MonitorRefreshInfoState",
+                    "enum": [
+                      {
+                        "content": "CANCELED"
+                      },
+                      {
+                        "content": "FAILED"
+                      },
+                      {
+                        "content": "PENDING"
+                      },
+                      {
+                        "content": "RUNNING"
+                      },
+                      {
+                        "content": "SUCCESS"
+                      },
+                      {
+                        "content": "UNKNOWN"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "start_time_ms",
+                  "description": "Time at which refresh operation was initiated (milliseconds since 1/1/1970 UTC).",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "table_name",
+                "description": "UC table name in format `catalog.schema.table_name`.\ntable_name is case insensitive and spaces are disallowed.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "table_name",
+                "description": "UC table name in format `catalog.schema.table_name`.\ntable_name is case insensitive and spaces are disallowed.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Deprecated: Use Data Quality Monitors API instead (/api/data-quality/v1/monitors).\nUpdates a monitor for the specified table.\n\nThe caller must either:\n1. be an owner of the table's parent catalog\n2. have **USE_CATALOG** on the table's parent catalog and be an owner of the table's parent schema\n3. have the following permissions:\n- **USE_CATALOG** on the table's parent catalog\n- **USE_SCHEMA** on the table's parent schema\n- be an owner of the table.\n\nAdditionally, the call must be made from the workspace where the monitor was created, and the caller must be\nthe original creator of the monitor.\n\nCertain configuration fields, such as output asset identifiers, cannot be updated.",
+            "summary": "Update a table monitor.",
+            "path": "/api/2.1/unity-catalog/tables/{table_name}/monitor",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateMonitor",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "table_name",
+                  "description": "UC table name in format `catalog.schema.table_name`.\nThis field corresponds to the {full_table_name_arg} arg in the endpoint path.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "output_schema_name",
+                  "description": "[Create:REQ Update:REQ] Schema where output tables are created. Needs to be in 2-level format {catalog}.{schema}",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "table_name",
+                  "description": "UC table name in format `catalog.schema.table_name`.\nThis field corresponds to the {full_table_name_arg} arg in the endpoint path.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "output_schema_name",
+                  "description": "[Create:REQ Update:REQ] Schema where output tables are created. Needs to be in 2-level format {catalog}.{schema}",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "MonitorInfo",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "output_schema_name",
+                  "description": "[Create:REQ Update:REQ] Schema where output tables are created. Needs to be in 2-level format {catalog}.{schema}",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "table_name",
+                  "description": "[Create:ERR Update:IGN] UC table to monitor. Format: `catalog.schema.table_name`",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "status",
+                  "description": "[Create:ERR Update:IGN] The monitor status.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "MonitorInfoStatus",
+                    "enum": [
+                      {
+                        "content": "MONITOR_STATUS_ACTIVE"
+                      },
+                      {
+                        "content": "MONITOR_STATUS_DELETE_PENDING"
+                      },
+                      {
+                        "content": "MONITOR_STATUS_ERROR"
+                      },
+                      {
+                        "content": "MONITOR_STATUS_FAILED"
+                      },
+                      {
+                        "content": "MONITOR_STATUS_PENDING"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "profile_metrics_table_name",
+                  "description": "[Create:ERR Update:IGN] Table that stores profile metrics data. Format: `catalog.schema.table_name`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "drift_metrics_table_name",
+                  "description": "[Create:ERR Update:IGN] Table that stores drift metrics data. Format: `catalog.schema.table_name`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "monitor_version",
+                  "description": "[Create:ERR Update:IGN] Represents the current monitor configuration version in use. The version will be represented in a\nnumeric fashion (1,2,3...). The field has flexibility to take on negative values, which can indicate corrupted\nmonitor_version numbers.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "output_schema_name",
+                  "description": "[Create:REQ Update:REQ] Schema where output tables are created. Needs to be in 2-level format {catalog}.{schema}",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "table_name",
+                  "description": "[Create:ERR Update:IGN] UC table to monitor. Format: `catalog.schema.table_name`",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "status",
+                  "description": "[Create:ERR Update:IGN] The monitor status.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "MonitorInfoStatus",
+                    "enum": [
+                      {
+                        "content": "MONITOR_STATUS_ACTIVE"
+                      },
+                      {
+                        "content": "MONITOR_STATUS_DELETE_PENDING"
+                      },
+                      {
+                        "content": "MONITOR_STATUS_ERROR"
+                      },
+                      {
+                        "content": "MONITOR_STATUS_FAILED"
+                      },
+                      {
+                        "content": "MONITOR_STATUS_PENDING"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "profile_metrics_table_name",
+                  "description": "[Create:ERR Update:IGN] Table that stores profile metrics data. Format: `catalog.schema.table_name`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "drift_metrics_table_name",
+                  "description": "[Create:ERR Update:IGN] Table that stores drift metrics data. Format: `catalog.schema.table_name`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "monitor_version",
+                  "description": "[Create:ERR Update:IGN] Represents the current monitor configuration version in use. The version will be represented in a\nnumeric fashion (1,2,3...). The field has flexibility to take on negative values, which can indicate corrupted\nmonitor_version numbers.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "baseline_table_name",
+                "description": "[Create:OPT Update:OPT] Baseline table name.\nBaseline data is used to compute drift from the data in the monitored `table_name`.\nThe baseline table and the monitored table shall have the same schema.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "custom_metrics",
+                "description": "[Create:OPT Update:OPT] Custom metrics.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "MonitorMetricList",
+                  "array_value": {
+                    "pascal_name": "MonitorMetric",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "dashboard_id",
+                "description": "[Create:ERR Update:OPT] Id of dashboard that visualizes the computed metrics.\nThis can be empty if the monitor is in PENDING state.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "data_classification_config",
+                "description": "[Create:OPT Update:OPT] Data classification related config.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "MonitorDataClassificationConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "inference_log",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "MonitorInferenceLog",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "latest_monitor_failure_msg",
+                "description": "[Create:ERR Update:IGN] The latest error message for a monitor failure.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "notifications",
+                "description": "[Create:OPT Update:OPT] Field for specifying notification settings.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "MonitorNotifications",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "output_schema_name",
+                "description": "[Create:REQ Update:REQ] Schema where output tables are created. Needs to be in 2-level format {catalog}.{schema}",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schedule",
+                "description": "[Create:OPT Update:OPT] The monitor schedule.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "MonitorCronSchedule",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "slicing_exprs",
+                "description": "[Create:OPT Update:OPT] List of column expressions to slice data with for targeted analysis. The data is grouped by\neach expression independently, resulting in a separate slice for each predicate and its\ncomplements. For example `slicing_exprs=[“col_1”, “col_2 \u003e 10”]` will generate the following\nslices: two slices for `col_2 \u003e 10` (True and False), and one slice per unique value in\n`col1`. For high-cardinality columns, only the top 100 unique values by frequency will\ngenerate slices.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "snapshot",
+                "description": "Configuration for monitoring snapshot tables.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "MonitorSnapshot",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "table_name",
+                "description": "UC table name in format `catalog.schema.table_name`.\nThis field corresponds to the {full_table_name_arg} arg in the endpoint path.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "time_series",
+                "description": "Configuration for monitoring time series tables.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "MonitorTimeSeries",
+                  "is_object": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "table_name",
+                "description": "UC table name in format `catalog.schema.table_name`.\nThis field corresponds to the {full_table_name_arg} arg in the endpoint path.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "output_schema_name",
+                "description": "[Create:REQ Update:REQ] Schema where output tables are created. Needs to be in 2-level format {catalog}.{schema}",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "sql.Queries",
+        "name": "Queries",
+        "description": "The queries API can be used to perform CRUD operations on queries. A query is a Databricks SQL\nobject that includes the target SQL warehouse, query text, name, description, tags, and parameters.\nQueries can be scheduled using the `sql_task` type of the Jobs API, e.g. :method:jobs/create.",
+        "package": {
+          "name": "sql"
+        },
+        "docs_group": "sql",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "named_id_map": {
+            "pascal_name": "ListQueryObjectsResponseQueryDisplayNameToIdMap"
+          },
+          "request": {
+            "pascal_name": "ListQueriesRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a query.",
+            "summary": "Create a query.",
+            "path": "/api/2.0/sql/queries",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateQueryRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "Query",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "auto_resolve_display_name",
+                "description": "If true, automatically resolve query display name conflicts. Otherwise, fail the request if the query's display name conflicts with an existing query's display name.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "query",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CreateQueryRequestQuery",
+                  "is_object": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Moves a query to the trash. Trashed queries immediately disappear from searches and list views, and cannot be used for alerts. You can restore a trashed query through the UI. A trashed query is permanently deleted after 30 days.",
+            "summary": "Delete a query.",
+            "path": "/api/2.0/sql/queries/{id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "TrashQueryRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Empty",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets a query.",
+            "summary": "Get a query.",
+            "path": "/api/2.0/sql/queries/{id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetQueryRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Query",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Gets a list of queries accessible to the user, ordered by creation time. **Warning:** Calling this API concurrently 10 or more times could result in throttling, service degradation, or a temporary ban.",
+            "summary": "List queries.",
+            "path": "/api/2.0/sql/queries",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListQueriesRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListQueryObjectsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListVisualizations",
+            "description": "Gets a list of visualizations on a query.",
+            "summary": "List visualizations on a query.",
+            "path": "/api/2.0/sql/queries/{id}/visualizations",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "ListVisualizationsForQueryRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListVisualizationsForQueryResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "Update",
+            "description": "Updates a query.",
+            "summary": "Update a query.",
+            "path": "/api/2.0/sql/queries/{id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateQueryRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "update_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Query",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "auto_resolve_display_name",
+                "description": "If true, automatically resolve alert display name conflicts. Otherwise, fail the request if the alert's display name conflicts with an existing alert's display name.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "query",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "UpdateQueryRequestQuery",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "sql.QueriesLegacy",
+        "name": "QueriesLegacy",
+        "description": "These endpoints are used for CRUD operations on query definitions. Query definitions include\nthe target SQL warehouse, query text, name, description, tags, parameters, and visualizations.\nQueries can be scheduled using the `sql_task` type of the Jobs API, e.g. :method:jobs/create.\n\n**Warning**: This API is deprecated. Please see the latest version of the Databricks SQL API. [Learn more](https://docs.databricks.com/en/sql/dbsql-api-latest.html)",
+        "package": {
+          "name": "sql"
+        },
+        "docs_group": "sql",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a new query definition. Queries created with this endpoint belong to the authenticated user making the request.\n\nThe `data_source_id` field specifies the ID of the SQL warehouse to run this query against. You can use the Data Sources API to see a complete list of available SQL warehouses. Or you can copy the `data_source_id` from an existing query.\n\n**Note**: You cannot add a visualization until you create the query.\n\n**Warning**: This API is deprecated. Please use :method:queries/create instead. [Learn more](https://docs.databricks.com/en/sql/dbsql-api-latest.html)",
+            "summary": "Create a new query definition.",
+            "path": "/api/2.0/preview/sql/queries",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "QueryPostContent",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "LegacyQuery",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "data_source_id",
+                "description": "Data source ID maps to the ID of the data source used by the resource and is distinct from the warehouse ID. [Learn more](https://docs.databricks.com/api/workspace/datasources/list)",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "General description that conveys additional information about this query such as usage notes.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The title of this query that appears in list views, widget headings, and on the query page.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "options",
+                "description": "Exclusively used for storing a list parameter definitions. A parameter is an object with `title`, `name`, `type`, and `value` properties. The `value` field here is the default value. It can be overridden at runtime.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_any": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "The identifier of the workspace folder containing the object.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "query",
+                "description": "The text of the query to be run.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "run_as_role",
+                "description": "Sets the **Run as** role for the object. Must be set to one of `\"viewer\"` (signifying \"run as viewer\" behavior) or `\"owner\"` (signifying \"run as owner\" behavior)",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "RunAsRole",
+                  "enum": [
+                    {
+                      "content": "owner"
+                    },
+                    {
+                      "content": "viewer"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "tags",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Moves a query to the trash.\nTrashed queries immediately disappear from searches and list views, and they cannot be used for alerts.\nThe trash is deleted after 30 days.\n\n**Warning**: This API is deprecated. Please use :method:queries/delete instead. [Learn more](https://docs.databricks.com/en/sql/dbsql-api-latest.html)",
+            "summary": "Delete a query.",
+            "path": "/api/2.0/preview/sql/queries/{query_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteQueriesLegacyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "query_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "query_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "query_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "query_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Retrieve a query object definition along with contextual permissions information about the currently authenticated user.\n\n**Warning**: This API is deprecated. Please use :method:queries/get instead. [Learn more](https://docs.databricks.com/en/sql/dbsql-api-latest.html)",
+            "summary": "Get a query definition.",
+            "path": "/api/2.0/preview/sql/queries/{query_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetQueriesLegacyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "query_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "query_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "LegacyQuery",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "query_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "query_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Gets a list of queries. Optionally, this list can be filtered by a search term.\n\n**Warning**: Calling this API concurrently 10 or more times could result in throttling, service degradation, or a temporary ban.\n\n**Warning**: This API is deprecated. Please use :method:queries/list instead. [Learn more](https://docs.databricks.com/en/sql/dbsql-api-latest.html)",
+            "summary": "Get a list of queries.",
+            "path": "/api/2.0/preview/sql/queries",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListQueriesLegacyRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "QueryList",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "order",
+                "description": "Name of query attribute to order by. Default sort order is ascending. Append a dash (`-`) to order descending instead.\n\n- `name`: The name of the query.\n\n- `created_at`: The timestamp the query was created.\n\n- `runtime`: The time it took to run this query. This is blank for parameterized queries. A blank value is treated as the highest value for sorting.\n\n- `executed_at`: The timestamp when the query was last run.\n\n- `created_by`: The user name of the user that created the query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page",
+                "description": "Page number to retrieve.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "Number of queries to return per page.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "q",
+                "description": "Full text search term",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "offset": {
+                "name": "page",
+                "description": "Page number to retrieve.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              "limit": {
+                "name": "page_size",
+                "description": "Number of queries to return per page.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              }
+            }
+          },
+          {
+            "name": "Restore",
+            "description": "Restore a query that has been moved to the trash.\nA restored query appears in list views and searches. You can use restored queries for alerts.\n\n**Warning**: This API is deprecated. Please see the latest version. [Learn more](https://docs.databricks.com/en/sql/dbsql-api-latest.html)",
+            "summary": "Restore a query.",
+            "path": "/api/2.0/preview/sql/queries/trash/{query_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "RestoreQueriesLegacyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "query_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "query_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "RestoreResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "query_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "query_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Modify this query definition.\n\n**Note**: You cannot undo this operation.\n\n**Warning**: This API is deprecated. Please use :method:queries/update instead. [Learn more](https://docs.databricks.com/en/sql/dbsql-api-latest.html)",
+            "summary": "Change a query definition.",
+            "path": "/api/2.0/preview/sql/queries/{query_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "QueryEditContent",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "query_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "query_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "LegacyQuery",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "data_source_id",
+                "description": "Data source ID maps to the ID of the data source used by the resource and is distinct from the warehouse ID. [Learn more](https://docs.databricks.com/api/workspace/datasources/list)",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "General description that conveys additional information about this query such as usage notes.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The title of this query that appears in list views, widget headings, and on the query page.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "options",
+                "description": "Exclusively used for storing a list parameter definitions. A parameter is an object with `title`, `name`, `type`, and `value` properties. The `value` field here is the default value. It can be overridden at runtime.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_any": true
+                }
+              },
+              {
+                "name": "query",
+                "description": "The text of the query to be run.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "query_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "run_as_role",
+                "description": "Sets the **Run as** role for the object. Must be set to one of `\"viewer\"` (signifying \"run as viewer\" behavior) or `\"owner\"` (signifying \"run as owner\" behavior)",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "RunAsRole",
+                  "enum": [
+                    {
+                      "content": "owner"
+                    },
+                    {
+                      "content": "viewer"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "tags",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "query_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "sql.QueryHistory",
+        "name": "QueryHistory",
+        "description": "A service responsible for storing and retrieving the list of queries run against SQL endpoints and serverless compute.",
+        "package": {
+          "name": "sql"
+        },
+        "docs_group": "sql",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "methods": [
+          {
+            "name": "List",
+            "description": "List the history of queries through SQL warehouses, and serverless compute.\n\nYou can filter by user ID, warehouse ID, status, and time range.\nMost recently started queries are returned first (up to max_results in request).\nThe pagination token returned in response can be used to list subsequent query statuses.",
+            "summary": "List Queries.",
+            "path": "/api/2.0/sql/history/queries",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListQueryHistoryRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListQueriesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "filter_by",
+                "description": "An optional filter object to limit query history results. Accepts parameters such as user IDs, endpoint IDs, and statuses to narrow the returned data.\nIn a URL, the parameters of this filter are specified with dot notation. For example: `filter_by.statement_ids`.",
+                "is_query": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "QueryFilter",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "include_metrics",
+                "description": "Whether to include the query metrics with each query.\nOnly use this for a small subset of queries (max_results).\nDefaults to false.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "max_results",
+                "description": "Limit the number of results returned in one page. Must be less than 1000 and the default is 100.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "A token that can be used to get the next page of results. The token can contains characters that need to be encoded before using it in a URL.\nFor example, the character '+' needs to be replaced by %2B. This field is optional.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "sql.QueryVisualizations",
+        "name": "QueryVisualizations",
+        "description": "This is an evolving API that facilitates the addition and removal of visualizations from existing queries in the Databricks Workspace. Data structures can change over time.",
+        "package": {
+          "name": "sql"
+        },
+        "is_hidden_cli": true,
+        "docs_group": "sql",
+        "launch_stage": "PRIVATE_PREVIEW",
+        "cli_launch_stage_display": "Private Preview",
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Adds a visualization to a query.",
+            "summary": "Add a visualization to a query.",
+            "path": "/api/2.0/sql/visualizations",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "CreateVisualizationRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "Visualization",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "visualization",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CreateVisualizationRequestVisualization",
+                  "is_object": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Removes a visualization.",
+            "summary": "Remove a visualization.",
+            "path": "/api/2.0/sql/visualizations/{id}",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "DeleteVisualizationRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Empty",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Updates a visualization.",
+            "summary": "Update a visualization.",
+            "path": "/api/2.0/sql/visualizations/{id}",
+            "can_use_json": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "UpdateVisualizationRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "update_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Visualization",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "visualization",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "UpdateVisualizationRequestVisualization",
+                  "is_object": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "sql.QueryVisualizationsLegacy",
+        "name": "QueryVisualizationsLegacy",
+        "description": "This is an evolving API that facilitates the addition and removal of visualizations from existing\nqueries within the Databricks Workspace. Data structures may change over time.\n\n**Warning**: This API is deprecated. Please see the latest version of the Databricks SQL API. [Learn more](https://docs.databricks.com/en/sql/dbsql-api-latest.html)",
+        "package": {
+          "name": "sql"
+        },
+        "is_hidden_cli": true,
+        "docs_group": "sql",
+        "launch_stage": "PRIVATE_PREVIEW",
+        "cli_launch_stage_display": "Private Preview",
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates visualization in the query.\n\n**Warning**: This API is deprecated. Please use :method:queryvisualizations/create instead. [Learn more](https://docs.databricks.com/en/sql/dbsql-api-latest.html)",
+            "summary": "Add visualization to a query.",
+            "path": "/api/2.0/preview/sql/visualizations",
+            "can_use_json": true,
+            "must_use_json": true,
+            "is_hidden_cli": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "CreateQueryVisualizationsLegacyRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "options",
+                  "description": "The options object varies widely from one visualization type to the next and is unsupported. Databricks does not recommend modifying visualization settings in JSON.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_any": true
+                  }
+                },
+                {
+                  "name": "query_id",
+                  "description": "The identifier returned by :method:queries/create",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "type",
+                  "description": "The type of visualization: chart, table, pivot table, and so on.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "options",
+                  "description": "The options object varies widely from one visualization type to the next and is unsupported. Databricks does not recommend modifying visualization settings in JSON.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_any": true
+                  }
+                },
+                {
+                  "name": "query_id",
+                  "description": "The identifier returned by :method:queries/create",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "type",
+                  "description": "The type of visualization: chart, table, pivot table, and so on.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "LegacyVisualization",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "description",
+                "description": "A short description of this visualization. This is not displayed in the UI.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the visualization that appears on dashboards and the query screen.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "options",
+                "description": "The options object varies widely from one visualization type to the next and is unsupported. Databricks does not recommend modifying visualization settings in JSON.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_any": true
+                }
+              },
+              {
+                "name": "query_id",
+                "description": "The identifier returned by :method:queries/create",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "type",
+                "description": "The type of visualization: chart, table, pivot table, and so on.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Removes a visualization from the query.\n\n**Warning**: This API is deprecated. Please use :method:queryvisualizations/delete instead. [Learn more](https://docs.databricks.com/en/sql/dbsql-api-latest.html)",
+            "summary": "Remove visualization.",
+            "path": "/api/2.0/preview/sql/visualizations/{id}",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "DeleteQueryVisualizationsLegacyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Widget ID returned by :method:queryvisualizations/create",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "Widget ID returned by :method:queryvisualizations/create",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "description": "Widget ID returned by :method:queryvisualizations/create",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Widget ID returned by :method:queryvisualizations/create",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Updates visualization in the query.\n\n**Warning**: This API is deprecated. Please use :method:queryvisualizations/update instead. [Learn more](https://docs.databricks.com/en/sql/dbsql-api-latest.html)",
+            "summary": "Edit existing visualization.",
+            "path": "/api/2.0/preview/sql/visualizations/{id}",
+            "can_use_json": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "LegacyVisualization",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "LegacyVisualization",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "created_at",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "A short description of this visualization. This is not displayed in the UI.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "id",
+                "description": "The UUID for this visualization.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the visualization that appears on dashboards and the query screen.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "options",
+                "description": "The options object varies widely from one visualization type to the next and is unsupported. Databricks does not recommend modifying visualization settings in JSON.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_any": true
+                }
+              },
+              {
+                "name": "query",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "LegacyQuery",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "type",
+                "description": "The type of visualization: chart, table, pivot table, and so on.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "updated_at",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "sharing.RecipientActivation",
+        "name": "RecipientActivation",
+        "description": "The Recipient Activation API is only applicable in the open sharing model where the\nrecipient object has the authentication type of `TOKEN`. The data recipient follows\nthe activation link shared by the data provider to download the credential file that\nincludes the access token. The recipient will then use the credential file to establish\na secure connection with the provider to receive the shared data.\n\nNote that you can download the credential file only once. Recipients should treat the\ndownloaded credential as a secret and must not share it outside of their organization.",
+        "package": {
+          "name": "sharing"
+        },
+        "docs_group": "sharing",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "methods": [
+          {
+            "name": "GetActivationUrlInfo",
+            "description": "Gets an activation URL for a share.",
+            "summary": "Get a share activation URL.",
+            "path": "/api/2.1/unity-catalog/public/data_sharing_activation_info/{activation_url}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetActivationUrlInfoRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "activation_url",
+                  "description": "The one time activation url. It also accepts activation token.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "activation_url",
+                  "description": "The one time activation url. It also accepts activation token.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetActivationUrlInfoResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "activation_url",
+                "description": "The one time activation url. It also accepts activation token.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "activation_url",
+                "description": "The one time activation url. It also accepts activation token.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "RetrieveToken",
+            "description": "Retrieve access token with an activation url.\nThis is a public API without any authentication.",
+            "summary": "Get an access token.",
+            "path": "/api/2.1/unity-catalog/public/data_sharing_activation/{activation_url}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "RetrieveTokenRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "activation_url",
+                  "description": "The one time activation url. It also accepts activation token.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "activation_url",
+                  "description": "The one time activation url. It also accepts activation token.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "RetrieveTokenResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "activation_url",
+                "description": "The one time activation url. It also accepts activation token.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "activation_url",
+                "description": "The one time activation url. It also accepts activation token.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "sharing.RecipientFederationPolicies",
+        "name": "RecipientFederationPolicies",
+        "description": "The Recipient Federation Policies APIs are only applicable in the open sharing model where the recipient object has the authentication type of `OIDC_RECIPIENT`, enabling data sharing from Databricks to non-Databricks recipients.\nOIDC Token Federation enables secure, secret-less authentication for accessing Delta Sharing servers. Users and applications authenticate using short-lived OIDC tokens issued by their own Identity Provider (IdP), such as Azure Entra ID or Okta, without the need for managing static credentials or client secrets.\nA federation policy defines how non-Databricks recipients authenticate using OIDC tokens. It validates the OIDC claims in federated tokens and is set at the recipient level. The caller must be the owner of the recipient to create or manage a federation policy.\nFederation policies support the following scenarios:\n- User-to-Machine (U2M) flow: A user accesses Delta Shares using their own identity, such as connecting through PowerBI Delta Sharing Client.\n- Machine-to-Machine (M2M) flow: An application accesses Delta Shares using its own identity, typically for automation tasks like nightly jobs through Python Delta Sharing Client.\nOIDC Token Federation enables fine-grained access control, supports Multi-Factor Authentication (MFA), and enhances security by minimizing the risk of credential leakage through the use of short-lived, expiring tokens. It is designed for strong identity governance, secure cross-platform data sharing, and reduced operational overhead for credential management.\n\nFor more information, see https://www.databricks.com/blog/announcing-oidc-token-federation-enhanced-delta-sharing-security and https://docs.databricks.com/en/delta-sharing/create-recipient-oidc-fed",
+        "package": {
+          "name": "sharing"
+        },
+        "docs_group": "sharing",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "list": {
+          "request": {
+            "pascal_name": "ListFederationPoliciesRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Create a federation policy for an OIDC_FEDERATION recipient for sharing data from Databricks to non-Databricks recipients.\nThe caller must be the owner of the recipient.\nWhen sharing data from Databricks to non-Databricks clients,\nyou can define a federation policy to authenticate non-Databricks recipients.\nThe federation policy validates OIDC claims in federated tokens and is defined at the recipient level.\nThis enables secretless sharing clients to authenticate using OIDC tokens.\n\nSupported scenarios for federation policies:\n1. **User-to-Machine (U2M) flow** (e.g., PowerBI): A user accesses a resource using their own identity.\n2. **Machine-to-Machine (M2M) flow** (e.g., OAuth App): An OAuth App accesses a resource using its own identity,\ntypically for tasks like running nightly jobs.\n\nFor an overview, refer to:\n- Blog post: Overview of feature: https://www.databricks.com/blog/announcing-oidc-token-federation-enhanced-delta-sharing-security\n\nFor detailed configuration guides based on your use case:\n- Creating a Federation Policy as a provider: https://docs.databricks.com/en/delta-sharing/create-recipient-oidc-fed\n- Configuration and usage for Machine-to-Machine (M2M) applications (e.g., Python Delta Sharing Client): https://docs.databricks.com/aws/en/delta-sharing/sharing-over-oidc-m2m\n- Configuration and usage for User-to-Machine (U2M) applications (e.g., PowerBI): https://docs.databricks.com/aws/en/delta-sharing/sharing-over-oidc-u2m",
+            "summary": "Create recipient federation policy.",
+            "path": "/api/2.0/data-sharing/recipients/{recipient_name}/federation-policies",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "CreateFederationPolicyRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "recipient_name",
+                  "description": "Name of the recipient. This is the name of the recipient for which the policy is being created.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "policy",
+                  "description": "Name of the policy. This is the name of the policy to be created.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "FederationPolicy",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "recipient_name",
+                  "description": "Name of the recipient. This is the name of the recipient for which the policy is being created.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "policy",
+                  "description": "Name of the policy. This is the name of the policy to be created.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "FederationPolicy",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "policy",
+              "description": "Name of the policy. This is the name of the policy to be created.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "FederationPolicy",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "FederationPolicy",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "policy",
+                "description": "Name of the policy. This is the name of the policy to be created.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "FederationPolicy",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "recipient_name",
+                "description": "Name of the recipient. This is the name of the recipient for which the policy is being created.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "comment",
+                "description": "Description of the policy. This is a user-provided description.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "System-generated timestamp indicating when the policy was created.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "id",
+                "description": "Unique, immutable system-generated identifier for the federation policy.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the federation policy. A recipient can have multiple policies with different names.\nThe name must contain only lowercase alphanumeric characters, numbers, and hyphens.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "oidc_policy",
+                "description": "Specifies the policy to use for validating OIDC claims in the federated tokens.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "OidcFederationPolicy",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "System-generated timestamp indicating when the policy was last updated.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "recipient_name",
+                "description": "Name of the recipient. This is the name of the recipient for which the policy is being created.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes an existing federation policy for an OIDC_FEDERATION recipient.\nThe caller must be the owner of the recipient.",
+            "summary": "Delete recipient federation policy.",
+            "path": "/api/2.0/data-sharing/recipients/{recipient_name}/federation-policies/{name}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "DeleteFederationPolicyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "recipient_name",
+                  "description": "Name of the recipient. This is the name of the recipient for which the policy is being deleted.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "name",
+                  "description": "Name of the policy. This is the name of the policy to be deleted.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "recipient_name",
+                  "description": "Name of the recipient. This is the name of the recipient for which the policy is being deleted.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "name",
+                  "description": "Name of the policy. This is the name of the policy to be deleted.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Name of the policy. This is the name of the policy to be deleted.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "recipient_name",
+                "description": "Name of the recipient. This is the name of the recipient for which the policy is being deleted.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "recipient_name",
+                "description": "Name of the recipient. This is the name of the recipient for which the policy is being deleted.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the policy. This is the name of the policy to be deleted.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetFederationPolicy",
+            "description": "Reads an existing federation policy for an OIDC_FEDERATION recipient for sharing data from Databricks to non-Databricks recipients.\nThe caller must have read access to the recipient.",
+            "summary": "Get recipient federation policy.",
+            "path": "/api/2.0/data-sharing/recipients/{recipient_name}/federation-policies/{name}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetFederationPolicyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "recipient_name",
+                  "description": "Name of the recipient. This is the name of the recipient for which the policy is being retrieved.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "name",
+                  "description": "Name of the policy. This is the name of the policy to be retrieved.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "recipient_name",
+                  "description": "Name of the recipient. This is the name of the recipient for which the policy is being retrieved.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "name",
+                  "description": "Name of the policy. This is the name of the policy to be retrieved.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "FederationPolicy",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Name of the policy. This is the name of the policy to be retrieved.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "recipient_name",
+                "description": "Name of the recipient. This is the name of the recipient for which the policy is being retrieved.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "recipient_name",
+                "description": "Name of the recipient. This is the name of the recipient for which the policy is being retrieved.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the policy. This is the name of the policy to be retrieved.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Lists federation policies for an OIDC_FEDERATION recipient for sharing data from Databricks to non-Databricks recipients.\nThe caller must have read access to the recipient.",
+            "summary": "List recipient federation policies.",
+            "path": "/api/2.0/data-sharing/recipients/{recipient_name}/federation-policies",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "ListFederationPoliciesRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "recipient_name",
+                  "description": "Name of the recipient. This is the name of the recipient for which the policies are being listed.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "recipient_name",
+                  "description": "Name of the recipient. This is the name of the recipient for which the policies are being listed.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListFederationPoliciesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "max_results",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "recipient_name",
+                "description": "Name of the recipient. This is the name of the recipient for which the policies are being listed.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "recipient_name",
+                "description": "Name of the recipient. This is the name of the recipient for which the policies are being listed.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          }
+        ]
+      },
+      {
+        "id": "sharing.Recipients",
+        "name": "Recipients",
+        "description": "A recipient is an object you create using :method:recipients/create to represent an\norganization which you want to allow access shares. The way how sharing works differs\ndepending on whether or not your recipient has access to a Databricks workspace that is\nenabled for Unity Catalog:\n\n- For recipients with access to a Databricks workspace that is enabled for Unity Catalog,\nyou can create a recipient object along with a unique sharing identifier you get from the\nrecipient. The sharing identifier is the key identifier that enables the secure connection.\nThis sharing mode is called **Databricks-to-Databricks sharing**.\n\n- For recipients without access to a Databricks workspace that is enabled for Unity Catalog,\nwhen you create a recipient object, Databricks generates an activation link you can send\nto the recipient. The recipient follows the activation link to download the credential file,\nand then uses the credential file to establish a secure connection to receive the shared data.\nThis sharing mode is called **open sharing**.",
+        "package": {
+          "name": "sharing"
+        },
+        "docs_group": "sharing",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListRecipientsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a new recipient with the delta sharing authentication type in the metastore.\nThe caller must be a metastore admin or have the **CREATE_RECIPIENT** privilege on the metastore.",
+            "summary": "Create a share recipient.",
+            "path": "/api/2.1/unity-catalog/recipients",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateRecipient",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of Recipient.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "authentication_type",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AuthenticationType",
+                    "enum": [
+                      {
+                        "content": "DATABRICKS"
+                      },
+                      {
+                        "content": "OAUTH_CLIENT_CREDENTIALS"
+                      },
+                      {
+                        "content": "OIDC_FEDERATION"
+                      },
+                      {
+                        "content": "TOKEN"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of Recipient.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "authentication_type",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AuthenticationType",
+                    "enum": [
+                      {
+                        "content": "DATABRICKS"
+                      },
+                      {
+                        "content": "OAUTH_CLIENT_CREDENTIALS"
+                      },
+                      {
+                        "content": "OIDC_FEDERATION"
+                      },
+                      {
+                        "content": "TOKEN"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "RecipientInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "authentication_type",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AuthenticationType",
+                  "enum": [
+                    {
+                      "content": "DATABRICKS"
+                    },
+                    {
+                      "content": "OAUTH_CLIENT_CREDENTIALS"
+                    },
+                    {
+                      "content": "OIDC_FEDERATION"
+                    },
+                    {
+                      "content": "TOKEN"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "comment",
+                "description": "Description about the recipient.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "data_recipient_global_metastore_id",
+                "description": "The global Unity Catalog metastore id provided by the data recipient.\nThis field is only present when the __authentication_type__ is **DATABRICKS**.\nThe identifier is of format __cloud__:__region__:__metastore-uuid__.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "expiration_time",
+                "description": "Expiration timestamp of the token, in epoch milliseconds.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "id",
+                "description": "[Create,Update:IGN] common - id of the recipient",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "ip_access_list",
+                "description": "IP Access List",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "IpAccessList",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of Recipient.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "owner",
+                "description": "Username of the recipient owner.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "properties_kvpairs",
+                "description": "Recipient properties as map of string key-value pairs.\nWhen provided in update request, the specified properties will override the existing\nproperties. To add and remove properties, one would need to perform a read-modify-write.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "SecurablePropertiesKvPairs",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "sharing_code",
+                "description": "The one-time sharing code provided by the data recipient. This field is only present when the __authentication_type__ is **DATABRICKS**.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of Recipient.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "authentication_type",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AuthenticationType",
+                  "enum": [
+                    {
+                      "content": "DATABRICKS"
+                    },
+                    {
+                      "content": "OAUTH_CLIENT_CREDENTIALS"
+                    },
+                    {
+                      "content": "OIDC_FEDERATION"
+                    },
+                    {
+                      "content": "TOKEN"
+                    }
+                  ]
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes the specified recipient from the metastore. The caller must be the owner of the recipient.",
+            "summary": "Delete a share recipient.",
+            "path": "/api/2.1/unity-catalog/recipients/{name}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteRecipientRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the recipient.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the recipient.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Name of the recipient.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the recipient.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets a share recipient from the metastore. The caller must be one of:\n* A user with **USE_RECIPIENT** privilege on the metastore\n* The owner of the share recipient\n* A metastore admin",
+            "summary": "Get a share recipient.",
+            "path": "/api/2.1/unity-catalog/recipients/{name}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetRecipientRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the recipient.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the recipient.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "RecipientInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Name of the recipient.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the recipient.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Gets an array of all share recipients within the current metastore where:\n\n* the caller is a metastore admin, or\n* the caller is the owner.\nThere is no guarantee of a specific ordering of the elements in the array.",
+            "summary": "List share recipients.",
+            "path": "/api/2.1/unity-catalog/recipients",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListRecipientsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListRecipientsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "data_recipient_global_metastore_id",
+                "description": "If not provided, all recipients will be returned.\nIf no recipients exist with this ID, no results will be returned.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "max_results",
+                "description": "Maximum number of recipients to return.\n- when set to 0, the page length is set to a server configured value (recommended);\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- when set to a value less than 0, an invalid parameter error is returned;\n- If not set, all valid recipients are returned (not recommended).\n- Note: The number of returned recipients might be less than the specified max_results size, even zero.\nThe only definitive indication that no further recipients can be fetched is when the next_page_token is unset from the response.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque pagination token to go to next page based on previous query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Opaque pagination token to go to next page based on previous query.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              },
+              "max_results": {
+                "name": "max_results",
+                "description": "Maximum number of recipients to return.\n- when set to 0, the page length is set to a server configured value (recommended);\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- when set to a value less than 0, an invalid parameter error is returned;\n- If not set, all valid recipients are returned (not recommended).\n- Note: The number of returned recipients might be less than the specified max_results size, even zero.\nThe only definitive indication that no further recipients can be fetched is when the next_page_token is unset from the response.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              }
+            }
+          },
+          {
+            "name": "RotateToken",
+            "description": "Refreshes the specified recipient's delta sharing authentication token with the provided token info.\nThe caller must be the owner of the recipient.",
+            "summary": "Rotate a token.",
+            "path": "/api/2.1/unity-catalog/recipients/{name}/rotate-token",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "RotateRecipientToken",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the Recipient.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "existing_token_expire_in_seconds",
+                  "description": "The expiration time of the bearer token in ISO 8601 format. This will set the expiration_time\nof existing token only to a smaller timestamp, it cannot extend the expiration_time. Use 0 to\nexpire the existing token immediately, negative number will return an error.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the Recipient.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "existing_token_expire_in_seconds",
+                  "description": "The expiration time of the bearer token in ISO 8601 format. This will set the expiration_time\nof existing token only to a smaller timestamp, it cannot extend the expiration_time. Use 0 to\nexpire the existing token immediately, negative number will return an error.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "RecipientInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "existing_token_expire_in_seconds",
+                "description": "The expiration time of the bearer token in ISO 8601 format. This will set the expiration_time\nof existing token only to a smaller timestamp, it cannot extend the expiration_time. Use 0 to\nexpire the existing token immediately, negative number will return an error.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the Recipient.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the Recipient.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "existing_token_expire_in_seconds",
+                "description": "The expiration time of the bearer token in ISO 8601 format. This will set the expiration_time\nof existing token only to a smaller timestamp, it cannot extend the expiration_time. Use 0 to\nexpire the existing token immediately, negative number will return an error.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "SharePermissions",
+            "description": "Gets the share permissions for the specified Recipient. The caller must have the **USE_RECIPIENT** privilege on the metastore or be the owner of the Recipient.",
+            "summary": "Get recipient share permissions.",
+            "path": "/api/2.1/unity-catalog/recipients/{name}/share-permissions",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "SharePermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the Recipient.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the Recipient.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetRecipientSharePermissionsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "max_results",
+                "description": "Maximum number of permissions to return.\n- when set to 0, the page length is set to a server configured value (recommended);\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- when set to a value less than 0, an invalid parameter error is returned;\n- If not set, all valid permissions are returned (not recommended).\n- Note: The number of returned permissions might be less than the specified max_results size, even zero.\nThe only definitive indication that no further permissions can be fetched is when the next_page_token is unset from the response.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the Recipient.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque pagination token to go to next page based on previous query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the Recipient.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Updates an existing recipient in the metastore. The caller must be a metastore admin or the owner of the recipient.\nIf the recipient name will be updated, the user must be both a metastore admin and the owner of the recipient.",
+            "summary": "Update a share recipient.",
+            "path": "/api/2.1/unity-catalog/recipients/{name}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateRecipient",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the recipient.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the recipient.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "RecipientInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "comment",
+                "description": "Description about the recipient.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "expiration_time",
+                "description": "Expiration timestamp of the token, in epoch milliseconds.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "id",
+                "description": "[Create,Update:IGN] common - id of the recipient",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "ip_access_list",
+                "description": "IP Access List",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "IpAccessList",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the recipient.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "new_name",
+                "description": "New name for the recipient.\n.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "owner",
+                "description": "Username of the recipient owner.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "properties_kvpairs",
+                "description": "Recipient properties as map of string key-value pairs.\nWhen provided in update request, the specified properties will override the existing\nproperties. To add and remove properties, one would need to perform a read-modify-write.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "SecurablePropertiesKvPairs",
+                  "is_object": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the recipient.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "sql.RedashConfig",
+        "name": "RedashConfig",
+        "description": "Redash V2 service for workspace configurations (internal)",
+        "package": {
+          "name": "sql"
+        },
+        "is_hidden_cli": true,
+        "docs_group": "sql",
+        "launch_stage": "PRIVATE_PREVIEW",
+        "cli_launch_stage_display": "Private Preview",
+        "methods": [
+          {
+            "name": "GetConfig",
+            "description": "Read workspace configuration for Redash-v2.",
+            "summary": "Read workspace configuration for Redash-v2.",
+            "path": "/api/2.0/redash-v2/config",
+            "is_legacy_empty_request": true,
+            "is_crud_read": true,
+            "is_hidden_cli": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "GetConfigRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ClientConfig",
+              "is_object": true
+            }
+          }
+        ]
+      },
+      {
+        "id": "catalog.RegisteredModels",
+        "name": "RegisteredModels",
+        "description": "Databricks provides a hosted version of MLflow Model Registry in Unity Catalog.\nModels in Unity Catalog provide centralized access control, auditing, lineage, and discovery of\nML models across Databricks workspaces.\n\nAn MLflow registered model resides in the third layer of Unity Catalog’s three-level namespace.\nRegistered models contain model versions, which correspond to actual ML models (MLflow models). Creating new\nmodel versions requires use of the MLflow Python client. After model versions are created, you can\nload them for batch inference using MLflow Python client APIs, or deploy them for real-time serving using\nDatabricks Model Serving.\n\nAll operations on registered models and model versions require USE_CATALOG permissions on the enclosing catalog\nand USE_SCHEMA permissions on the enclosing schema. In addition, the following additional privileges are\nrequired for various operations:\n\n* To create a registered model, users must additionally have the CREATE_MODEL permission on the target schema.\n* To view registered model or model version metadata, model version data files, or invoke a model version,\nusers must additionally have the EXECUTE permission on the registered model\n* To update registered model or model version tags, users must additionally have APPLY TAG permissions on the registered model\n* To update other registered model or model version metadata (comments, aliases)\ncreate a new model version, or update permissions on the registered model, users must be owners of the\nregistered model.\n\nNote: The securable type for models is FUNCTION. When using REST APIs (for example, tagging, grants) that specify\na securable type, use FUNCTION as the securable type.",
+        "package": {
+          "name": "catalog"
+        },
+        "docs_group": "catalog",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "named_id_map": {
+            "pascal_name": "RegisteredModelInfoNameToFullNameMap"
+          },
+          "request": {
+            "pascal_name": "ListRegisteredModelsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a new registered model in Unity Catalog.\n\nFile storage for model versions in the registered model\nwill be located in the default location which is specified by the parent schema,\nor the parent catalog, or the Metastore.\n\nFor registered model creation to succeed, the user must satisfy the following conditions:\n- The caller must be a metastore admin, or be the owner of the parent catalog and schema,\nor have the **USE_CATALOG** privilege on the parent catalog\nand the **USE_SCHEMA** privilege on the parent schema.\n- The caller must have the **CREATE MODEL** or **CREATE FUNCTION** privilege on the parent schema.",
+            "summary": "Create a Registered Model.",
+            "path": "/api/2.1/unity-catalog/models",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateRegisteredModelRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "RegisteredModelInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "aliases",
+                "description": "List of aliases associated with the registered model",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "RegisteredModelAliasList",
+                  "array_value": {
+                    "pascal_name": "RegisteredModelAlias",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "browse_only",
+                "description": "Indicates whether the principal is limited to retrieving metadata for the associated object through the BROWSE privilege when include_browse is enabled in the request.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "catalog_name",
+                "description": "The name of the catalog where the schema and the registered model reside",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "comment",
+                "description": "The comment attached to the registered model",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "created_at",
+                "description": "Creation timestamp of the registered model in milliseconds since the Unix epoch",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "created_by",
+                "description": "The identifier of the user who created the registered model",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "full_name",
+                "description": "The three-level (fully qualified) name of the registered model",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "metastore_id",
+                "description": "The unique identifier of the metastore",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the registered model",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "owner",
+                "description": "The identifier of the user who owns the registered model",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schema_name",
+                "description": "The name of the schema where the registered model resides",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "storage_location",
+                "description": "The storage location on the cloud under which model version data files are stored",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "updated_at",
+                "description": "Last-update timestamp of the registered model in milliseconds since the Unix epoch",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "updated_by",
+                "description": "The identifier of the user who updated the registered model last time",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes a registered model and all its model versions from the specified parent catalog and schema.\n\nThe caller must be a metastore admin or an owner of the registered model.\nFor the latter case, the caller must also be the owner or have the **USE_CATALOG**\nprivilege on the parent catalog and the **USE_SCHEMA** privilege on the parent schema.",
+            "summary": "Delete a Registered Model.",
+            "path": "/api/2.1/unity-catalog/models/{full_name}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteRegisteredModelRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "full_name",
+                  "description": "The three-level (fully qualified) name of the registered model",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "full_name",
+                  "description": "The three-level (fully qualified) name of the registered model",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "full_name",
+                "description": "The three-level (fully qualified) name of the registered model",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "full_name",
+                "description": "The three-level (fully qualified) name of the registered model",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteAlias",
+            "description": "Deletes a registered model alias.\n\nThe caller must be a metastore admin or an owner of the registered model.\nFor the latter case, the caller must also be the owner or have the **USE_CATALOG**\nprivilege on the parent catalog and the **USE_SCHEMA** privilege on the parent schema.",
+            "summary": "Delete a Registered Model Alias.",
+            "path": "/api/2.1/unity-catalog/models/{full_name}/aliases/{alias}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteAliasRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "full_name",
+                  "description": "The three-level (fully qualified) name of the registered model",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "alias",
+                  "description": "The name of the alias",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "full_name",
+                  "description": "The three-level (fully qualified) name of the registered model",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "alias",
+                  "description": "The name of the alias",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "alias",
+                "description": "The name of the alias",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "full_name",
+                "description": "The three-level (fully qualified) name of the registered model",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "full_name",
+                "description": "The three-level (fully qualified) name of the registered model",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "alias",
+                "description": "The name of the alias",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Get a registered model.\n\nThe caller must be a metastore admin or an owner of (or have the **EXECUTE**\nprivilege on) the registered model. For the latter case, the caller must also be the owner\nor have the **USE_CATALOG** privilege on the parent catalog and the **USE_SCHEMA** privilege\non the parent schema.",
+            "summary": "Get a Registered Model.",
+            "path": "/api/2.1/unity-catalog/models/{full_name}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetRegisteredModelRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "full_name",
+                  "description": "The three-level (fully qualified) name of the registered model",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "full_name",
+                  "description": "The three-level (fully qualified) name of the registered model",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "RegisteredModelInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "full_name",
+                "description": "The three-level (fully qualified) name of the registered model",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "include_aliases",
+                "description": "Whether to include registered model aliases in the response",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "include_browse",
+                "description": "Whether to include registered models in the response for which the principal can only access selective metadata for",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "full_name",
+                "description": "The three-level (fully qualified) name of the registered model",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "List registered models. You can list registered models under a particular schema,\nor list all registered models in the current metastore.\n\nThe returned models are filtered based on the privileges of the calling user.\nFor example, the metastore admin is able to list all the registered models.\nA regular user needs to be the owner or have the **EXECUTE** privilege\non the registered model to receive the registered models in the response.\nFor the latter case, the caller must also be the owner or have the **USE_CATALOG**\nprivilege on the parent catalog and the **USE_SCHEMA** privilege on the parent schema.\n\nThere is no guarantee of a specific ordering of the elements in the response.\n\nPAGINATION BEHAVIOR: The API is by default paginated, a page may contain zero results while still providing a next_page_token.\nClients must continue reading pages until next_page_token is absent, which is the only indication that the end of results has been reached.",
+            "summary": "List Registered Models.",
+            "path": "/api/2.1/unity-catalog/models",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListRegisteredModelsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListRegisteredModelsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "catalog_name",
+                "description": "The identifier of the catalog under which to list registered models.\nIf specified, schema_name must be specified.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "include_browse",
+                "description": "Whether to include registered models in the response for which the principal can only access selective metadata for",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "max_results",
+                "description": "Max number of registered models to return.\n\nIf both catalog and schema are specified:\n- when max_results is not specified, the page length is set to a server configured value (10000, as of 4/2/2024).\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value (10000, as of 4/2/2024);\n- when set to 0, the page length is set to a server configured value (10000, as of 4/2/2024);\n- when set to a value less than 0, an invalid parameter error is returned;\n\nIf neither schema nor catalog is specified:\n- when max_results is not specified, the page length is set to a server configured value (100, as of 4/2/2024).\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value (1000, as of 4/2/2024);\n- when set to 0, the page length is set to a server configured value (100, as of 4/2/2024);\n- when set to a value less than 0, an invalid parameter error is returned;",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque token to send for the next page of results (pagination).",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schema_name",
+                "description": "The identifier of the schema under which to list registered models.\nIf specified, catalog_name must be specified.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Opaque token to send for the next page of results (pagination).",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "SetAlias",
+            "description": "Set an alias on the specified registered model.\n\nThe caller must be a metastore admin or an owner of the registered model.\nFor the latter case, the caller must also be the owner or have the **USE_CATALOG**\nprivilege on the parent catalog and the **USE_SCHEMA** privilege on the parent schema.",
+            "summary": "Set a Registered Model Alias.",
+            "path": "/api/2.1/unity-catalog/models/{full_name}/aliases/{alias}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "SetRegisteredModelAliasRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "full_name",
+                  "description": "The three-level (fully qualified) name of the registered model",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "alias",
+                  "description": "The name of the alias",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "version_num",
+                  "description": "The version number of the model version to which the alias points",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "full_name",
+                  "description": "The three-level (fully qualified) name of the registered model",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "alias",
+                  "description": "The name of the alias",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "version_num",
+                  "description": "The version number of the model version to which the alias points",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "RegisteredModelAlias",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "alias",
+                "description": "The name of the alias",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "full_name",
+                "description": "The three-level (fully qualified) name of the registered model",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version_num",
+                "description": "The version number of the model version to which the alias points",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "full_name",
+                "description": "The three-level (fully qualified) name of the registered model",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "alias",
+                "description": "The name of the alias",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "version_num",
+                "description": "The version number of the model version to which the alias points",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Updates the specified registered model.\n\nThe caller must be a metastore admin or an owner of the registered model.\nFor the latter case, the caller must also be the owner or have the **USE_CATALOG**\nprivilege on the parent catalog and the **USE_SCHEMA** privilege on the parent schema.\n\nCurrently only the name, the owner or the comment of the registered model can be updated.",
+            "summary": "Update a Registered Model.",
+            "path": "/api/2.1/unity-catalog/models/{full_name}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateRegisteredModelRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "full_name",
+                  "description": "The three-level (fully qualified) name of the registered model",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "full_name",
+                  "description": "The three-level (fully qualified) name of the registered model",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "RegisteredModelInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "aliases",
+                "description": "List of aliases associated with the registered model",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "RegisteredModelAliasList",
+                  "array_value": {
+                    "pascal_name": "RegisteredModelAlias",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "browse_only",
+                "description": "Indicates whether the principal is limited to retrieving metadata for the associated object through the BROWSE privilege when include_browse is enabled in the request.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "catalog_name",
+                "description": "The name of the catalog where the schema and the registered model reside",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "comment",
+                "description": "The comment attached to the registered model",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "created_at",
+                "description": "Creation timestamp of the registered model in milliseconds since the Unix epoch",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "created_by",
+                "description": "The identifier of the user who created the registered model",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "full_name",
+                "description": "The three-level (fully qualified) name of the registered model",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "metastore_id",
+                "description": "The unique identifier of the metastore",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the registered model",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "new_name",
+                "description": "New name for the registered model.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "owner",
+                "description": "The identifier of the user who owns the registered model",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schema_name",
+                "description": "The name of the schema where the registered model resides",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "storage_location",
+                "description": "The storage location on the cloud under which model version data files are stored",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "updated_at",
+                "description": "Last-update timestamp of the registered model in milliseconds since the Unix epoch",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "updated_by",
+                "description": "The identifier of the user who updated the registered model last time",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "full_name",
+                "description": "The three-level (fully qualified) name of the registered model",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "workspace.Repos",
+        "name": "Repos",
+        "description": "The Repos API allows users to manage their git repos. Users can use the API to access all\nrepos that they have manage permissions on.\n\nDatabricks Repos is a visual Git client in Databricks. It supports common Git operations\nsuch a cloning a repository, committing and pushing, pulling, branch management, and visual\ncomparison of diffs when committing.\n\nWithin Repos you can develop code in notebooks or other files and follow data science and\nengineering code development best practices using Git for version control, collaboration,\nand CI/CD.",
+        "package": {
+          "name": "workspace"
+        },
+        "docs_group": "workspace",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "named_id_map": {
+            "pascal_name": "RepoInfoPathToIdMap"
+          },
+          "request": {
+            "pascal_name": "ListReposRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a repo in the workspace and links it to the remote Git repo specified.\nNote that repos created programmatically must be linked to a remote Git repo, unlike repos\ncreated in the browser.",
+            "summary": "Create a repo.",
+            "path": "/api/2.0/repos",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateRepoRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "url",
+                  "description": "URL of the Git repository to be linked.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "provider",
+                  "description": "Git provider. This field is case-insensitive. The available Git providers are `gitHub`,\n`bitbucketCloud`, `gitLab`, `azureDevOpsServices` (Azure DevOps Services, including\nMicrosoft Entra ID authentication), `gitHubEnterprise`, `bitbucketServer` (Bitbucket\nData Center), `gitLabEnterpriseEdition` (GitLab Self-Managed), and `awsCodeCommit`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "url",
+                  "description": "URL of the Git repository to be linked.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "provider",
+                  "description": "Git provider. This field is case-insensitive. The available Git providers are `gitHub`,\n`bitbucketCloud`, `gitLab`, `azureDevOpsServices` (Azure DevOps Services, including\nMicrosoft Entra ID authentication), `gitHubEnterprise`, `bitbucketServer` (Bitbucket\nData Center), `gitLabEnterpriseEdition` (GitLab Self-Managed), and `awsCodeCommit`.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CreateRepoResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "git_credential_id",
+                "description": "Git credential ID to use when cloning the repository. The Git credential must be\nconfigured for the current user.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "path",
+                "description": "Desired path for the repo in the workspace. Almost any path in the workspace can be chosen.\nIf repo is created in `/Repos`, path must be in the format `/Repos/{folder}/{repo-name}`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "provider",
+                "description": "Git provider. This field is case-insensitive. The available Git providers are `gitHub`,\n`bitbucketCloud`, `gitLab`, `azureDevOpsServices` (Azure DevOps Services, including\nMicrosoft Entra ID authentication), `gitHubEnterprise`, `bitbucketServer` (Bitbucket\nData Center), `gitLabEnterpriseEdition` (GitLab Self-Managed), and `awsCodeCommit`.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "sparse_checkout",
+                "description": "If specified, the repo will be created with sparse checkout enabled. You cannot enable/disable\nsparse checkout after the repo is created.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "SparseCheckout",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "url",
+                "description": "URL of the Git repository to be linked.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "url",
+                "description": "URL of the Git repository to be linked.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "provider",
+                "description": "Git provider. This field is case-insensitive. The available Git providers are `gitHub`,\n`bitbucketCloud`, `gitLab`, `azureDevOpsServices` (Azure DevOps Services, including\nMicrosoft Entra ID authentication), `gitHubEnterprise`, `bitbucketServer` (Bitbucket\nData Center), `gitLabEnterpriseEdition` (GitLab Self-Managed), and `awsCodeCommit`.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes the specified repo.",
+            "summary": "Delete a repo.",
+            "path": "/api/2.0/repos/{repo_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteRepoRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "repo_id",
+                  "description": "The ID for the corresponding repo to delete.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "repo_id",
+                  "description": "The ID for the corresponding repo to delete.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteRepoResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "repo_id",
+                "description": "The ID for the corresponding repo to delete.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "repo_id",
+                "description": "The ID for the corresponding repo to delete.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Returns the repo with the given repo ID.",
+            "summary": "Get a repo.",
+            "path": "/api/2.0/repos/{repo_id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetRepoRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "repo_id",
+                  "description": "ID of the Git folder (repo) object in the workspace.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "repo_id",
+                  "description": "ID of the Git folder (repo) object in the workspace.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetRepoResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "repo_id",
+                "description": "ID of the Git folder (repo) object in the workspace.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "repo_id",
+                "description": "ID of the Git folder (repo) object in the workspace.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetPermissionLevels",
+            "description": "Gets the permission levels that a user can have on an object.",
+            "summary": "Get repo permission levels.",
+            "path": "/api/2.0/permissions/repos/{repo_id}/permissionLevels",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetRepoPermissionLevelsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "repo_id",
+                  "description": "The repo for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "repo_id",
+                  "description": "The repo for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetRepoPermissionLevelsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "repo_id",
+                "description": "The repo for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "repo_id",
+                "description": "The repo for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetPermissions",
+            "description": "Gets the permissions of a repo. Repos can inherit permissions from their root object.",
+            "summary": "Get repo permissions.",
+            "path": "/api/2.0/permissions/repos/{repo_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetRepoPermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "repo_id",
+                  "description": "The repo for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "repo_id",
+                  "description": "The repo for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "RepoPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "repo_id",
+                "description": "The repo for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "repo_id",
+                "description": "The repo for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Returns repos that the calling user has Manage permissions on.\nUse `next_page_token` to iterate through additional pages.\n\nDeprecated: This operation does not return a complete list of the repos in the workspace, because\nrepos with the Git CLI enabled are not included in its results. Instead, use the Repos and\nWorkspace APIs to find repos and their associated metadata in the workspace.",
+            "summary": "Get repos.",
+            "path": "/api/2.0/repos",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListReposRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListReposResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "next_page_token",
+                "description": "Token used to get the next page of results. If not specified, returns the first page of\nresults as well as a next page token if there are more results.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "path_prefix",
+                "description": "Filters repos that have paths starting with the given path prefix.\nIf not provided or when provided an effectively empty prefix (`/` or `/Workspace`)\nGit folders (repos) from `/Workspace/Repos` will be served.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "next_page_token",
+                  "description": "Token used to get the next page of results. If not specified, returns the first page of\nresults as well as a next page token if there are more results.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "SetPermissions",
+            "description": "Sets permissions on an object, replacing existing permissions if they exist. Deletes all direct permissions if none are specified. Objects can inherit permissions from their root object.",
+            "summary": "Set repo permissions.",
+            "path": "/api/2.0/permissions/repos/{repo_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "RepoPermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "repo_id",
+                  "description": "The repo for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "repo_id",
+                  "description": "The repo for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "RepoPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "access_control_list",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "RepoAccessControlRequestList",
+                  "array_value": {
+                    "pascal_name": "RepoAccessControlRequest",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "repo_id",
+                "description": "The repo for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "repo_id",
+                "description": "The repo for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Updates the repo to a different branch or tag, or updates the repo to the latest commit on\nthe same branch.",
+            "summary": "Update a repo.",
+            "path": "/api/2.0/repos/{repo_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateRepoRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "repo_id",
+                  "description": "ID of the Git folder (repo) object in the workspace.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "repo_id",
+                  "description": "ID of the Git folder (repo) object in the workspace.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "UpdateRepoResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "branch",
+                "description": "Branch that the local version of the repo is checked out to.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "dangerously_force_discard_all",
+                "description": "WARNING: DESTRUCTIVE AND IRREVERSIBLE. If true, permanently deletes ALL uncommitted\nchanges in the Git folder — staged, unstaged, and untracked files — before updating.\nLost data CANNOT be recovered.\n\nNEVER use this on Git folders where users author or edit files. This flag is intended\nONLY for automated jobs that treat the Git folder as a read-only mirror of a remote\nbranch and need to force-sync it. If any user has uncommitted work in the Git folder,\nthat work will be permanently destroyed without warning.\n\nLocal commits that have been made but not yet pushed to the remote are preserved.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "git_credential_id",
+                "description": "Git credential ID to use for this update operation. The Git credential must be\nconfigured for the current user.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "repo_id",
+                "description": "ID of the Git folder (repo) object in the workspace.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "sparse_checkout",
+                "description": "If specified, update the sparse checkout settings. The update will fail if sparse checkout is\nnot enabled for the repo.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "SparseCheckoutUpdate",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "tag",
+                "description": "Tag that the local version of the repo is checked out to. Updating the repo to a tag puts\nthe repo in a detached HEAD state. Before committing new changes, you must update the repo to\na branch instead of the detached HEAD.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "repo_id",
+                "description": "ID of the Git folder (repo) object in the workspace.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdatePermissions",
+            "description": "Updates the permissions on a repo. Repos can inherit permissions from their root object.",
+            "summary": "Update repo permissions.",
+            "path": "/api/2.0/permissions/repos/{repo_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "RepoPermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "repo_id",
+                  "description": "The repo for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "repo_id",
+                  "description": "The repo for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "RepoPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "access_control_list",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "RepoAccessControlRequestList",
+                  "array_value": {
+                    "pascal_name": "RepoAccessControlRequest",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "repo_id",
+                "description": "The repo for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "repo_id",
+                "description": "The repo for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "catalog.ResourceQuotas",
+        "name": "ResourceQuotas",
+        "description": "Unity Catalog enforces resource quotas on all securable objects, which limits the number of resources that can be created. Quotas are expressed in terms of a resource type and a parent (for example, tables per metastore or schemas per catalog). The resource quota APIs enable you to monitor your current usage and limits. For more information on resource quotas see the [Unity Catalog documentation](https://docs.databricks.com/en/data-governance/unity-catalog/index.html#resource-quotas).",
+        "package": {
+          "name": "catalog"
+        },
+        "docs_group": "catalog",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListQuotasRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "GetQuota",
+            "description": "The GetQuota API returns usage information for a single resource quota, defined as a\nchild-parent pair. This API also refreshes the quota count if it is out of date.\nRefreshes are triggered asynchronously. The updated count might not be returned in the first call.",
+            "summary": "Get information for a single resource quota.",
+            "path": "/api/2.1/unity-catalog/resource-quotas/{parent_securable_type}/{parent_full_name}/{quota_name}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetQuotaRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "parent_securable_type",
+                  "description": "Securable type of the quota parent.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "parent_full_name",
+                  "description": "Full name of the parent resource. Provide the metastore ID if the parent is a metastore.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "quota_name",
+                  "description": "Name of the quota. Follows the pattern of the quota type, with \"-quota\" added as a suffix.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent_securable_type",
+                  "description": "Securable type of the quota parent.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "parent_full_name",
+                  "description": "Full name of the parent resource. Provide the metastore ID if the parent is a metastore.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "quota_name",
+                  "description": "Name of the quota. Follows the pattern of the quota type, with \"-quota\" added as a suffix.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetQuotaResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "parent_full_name",
+                "description": "Full name of the parent resource. Provide the metastore ID if the parent is a metastore.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent_securable_type",
+                "description": "Securable type of the quota parent.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "quota_name",
+                "description": "Name of the quota. Follows the pattern of the quota type, with \"-quota\" added as a suffix.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent_securable_type",
+                "description": "Securable type of the quota parent.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent_full_name",
+                "description": "Full name of the parent resource. Provide the metastore ID if the parent is a metastore.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "quota_name",
+                "description": "Name of the quota. Follows the pattern of the quota type, with \"-quota\" added as a suffix.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListQuotas",
+            "description": "ListQuotas returns all quota values under the metastore. There are no SLAs on the freshness of the counts\nreturned. This API does not trigger a refresh of quota counts.\n\nPAGINATION BEHAVIOR: The API is by default paginated, a page may contain zero results while still providing a next_page_token.\nClients must continue reading pages until next_page_token is absent, which is the only indication that the end of results has been reached.",
+            "summary": "List all resource quotas under a metastore.",
+            "path": "/api/2.1/unity-catalog/resource-quotas/all-resource-quotas",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListQuotasRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListQuotasResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "max_results",
+                "description": "The number of quotas to return.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque token for the next page of results.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Opaque token for the next page of results.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          }
+        ]
+      },
+      {
+        "id": "settings.RestrictWorkspaceAdmins",
+        "name": "RestrictWorkspaceAdmins",
+        "description": "The Restrict Workspace Admins setting lets you control the capabilities of workspace admins.\nWith the setting status set to ALLOW_ALL, workspace admins can create service principal personal access\ntokens on behalf of any service principal in their workspace. Workspace admins can also change a job owner to\nany user in their workspace. And they can change the job run_as setting to any user in their workspace or to a\nservice principal on which they have the Service Principal User role. With the setting status set to RESTRICT_TOKENS_AND_JOB_RUN_AS,\nworkspace admins can only create personal access tokens on behalf of service principals they have the\nService Principal User role on. They can also only change a job owner to themselves. And they can change the job\nrun_as setting to themselves or to a service principal on which they have the Service Principal User role.",
+        "package": {
+          "name": "settings"
+        },
+        "has_parent": true,
+        "docs_group": "settings",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "parent_service_id": "settings.Settings",
+        "methods": [
+          {
+            "name": "Delete",
+            "description": "Reverts the restrict workspace admins setting status for the workspace. A fresh etag needs\nto be provided in `DELETE` requests (as a query parameter). The etag can be retrieved by making a `GET` request\nbefore the DELETE request. If the setting is updated/deleted concurrently, `DELETE` fails with 409 and the\nrequest must be retried by using the fresh etag in the 409 response.",
+            "summary": "Delete the restrict workspace admins setting.",
+            "path": "/api/2.0/settings/types/restrict_workspace_admins/names/default",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "DeleteRestrictWorkspaceAdminsSettingRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "DeleteRestrictWorkspaceAdminsSettingResponse",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "etag",
+                  "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "etag",
+                  "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets the restrict workspace admins setting.",
+            "summary": "Get the restrict workspace admins setting.",
+            "path": "/api/2.0/settings/types/restrict_workspace_admins/names/default",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetRestrictWorkspaceAdminsSettingRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "RestrictWorkspaceAdminsSetting",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "restrict_workspace_admins",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "RestrictWorkspaceAdminsMessage",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "restrict_workspace_admins",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "RestrictWorkspaceAdminsMessage",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Updates the restrict workspace admins setting for the workspace. A fresh etag needs\nto be provided in `PATCH` requests (as part of the setting field). The etag can be retrieved by making a GET\nrequest before the `PATCH` request. If the setting is updated concurrently, `PATCH` fails with 409 and the\nrequest must be retried by using the fresh etag in the 409 response.",
+            "summary": "Update the restrict workspace admins setting.",
+            "path": "/api/2.0/settings/types/restrict_workspace_admins/names/default",
+            "can_use_json": true,
+            "must_use_json": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "UpdateRestrictWorkspaceAdminsSettingRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "RestrictWorkspaceAdminsSetting",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "RestrictWorkspaceAdminsSetting",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "RestrictWorkspaceAdminsSetting",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "restrict_workspace_admins",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "RestrictWorkspaceAdminsMessage",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "restrict_workspace_admins",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "RestrictWorkspaceAdminsMessage",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "allow_missing",
+                "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "field_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "setting",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "RestrictWorkspaceAdminsSetting",
+                  "is_object": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "catalog.Rfa",
+        "name": "Rfa",
+        "description": "Request for Access enables users to request access for Unity Catalog securables.\n\nThese APIs provide a standardized way for securable owners (or users with MANAGE privileges) to manage access request destinations.",
+        "package": {
+          "name": "catalog"
+        },
+        "docs_group": "catalog",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "methods": [
+          {
+            "name": "BatchCreateAccessRequests",
+            "description": "Creates access requests for Unity Catalog permissions for a specified principal on a securable object.\nThis Batch API can take in multiple principals, securable objects,\nand permissions as the input and returns the access request destinations for each.\nPrincipals must be unique across the API call.\n\nThe supported securable types are: \"metastore\", \"catalog\", \"schema\", \"table\",\n\"external_location\", \"connection\", \"credential\", \"function\", \"registered_model\", and \"volume\".",
+            "summary": "Create Access Requests.",
+            "path": "/api/3.0/rfa/requests",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "BatchCreateAccessRequestsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "BatchCreateAccessRequestsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "requests",
+                "description": "A list of individual access requests, where each request corresponds to\na set of permissions being requested on a list of securables for a specified principal.\n\nAt most 30 requests per API call.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CreateAccessRequestList",
+                  "array_value": {
+                    "pascal_name": "CreateAccessRequest",
+                    "is_object": true
+                  }
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetAccessRequestDestinations",
+            "description": "Gets an array of access request destinations for the specified securable.\nAny caller can see URL destinations or the destinations on the metastore.\nOtherwise, only those with **BROWSE** permissions on the securable can see destinations.\n\nThe supported securable types are: \"metastore\", \"catalog\", \"schema\", \"table\",\n\"external_location\", \"connection\", \"credential\", \"function\", \"registered_model\", and \"volume\".",
+            "summary": "Get Access Request Destinations.",
+            "path": "/api/3.0/rfa/destinations/{securable_type}/{full_name}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetAccessRequestDestinationsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "securable_type",
+                  "description": "The type of the securable.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "full_name",
+                  "description": "The full name of the securable.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "securable_type",
+                  "description": "The type of the securable.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "full_name",
+                  "description": "The full name of the securable.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "AccessRequestDestinations",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "securable",
+                  "description": "The securable for which the access request destinations are being modified or read.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Securable",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "securable",
+                  "description": "The securable for which the access request destinations are being modified or read.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Securable",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "full_name",
+                "description": "The full name of the securable.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "securable_type",
+                "description": "The type of the securable.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "securable_type",
+                "description": "The type of the securable.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "full_name",
+                "description": "The full name of the securable.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateAccessRequestDestinations",
+            "description": "Updates the access request destinations for the given securable.\nThe caller must be a metastore admin, the owner of the securable, or a user that has the **MANAGE** privilege on the securable in order to assign destinations.\nA maximum of 5 emails and 5 external notification destinations (Slack, Microsoft Teams, Generic Webhook, and Databricks App Slack/Teams destinations) can be assigned to a securable.\nIf a URL destination is assigned, no other destinations can be set.\n\nThe supported securable types are: \"metastore\", \"catalog\", \"schema\", \"table\",\n\"external_location\", \"connection\", \"credential\", \"function\", \"registered_model\", and \"volume\".",
+            "summary": "Update Access Request Destinations.",
+            "path": "/api/3.0/rfa/destinations",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "UpdateAccessRequestDestinationsRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "access_request_destinations",
+                  "description": "The access request destinations to assign to the securable.\nFor each destination, a **destination_id** and **destination_type** must be defined.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AccessRequestDestinations",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "update_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "access_request_destinations",
+                  "description": "The access request destinations to assign to the securable.\nFor each destination, a **destination_id** and **destination_type** must be defined.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AccessRequestDestinations",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "access_request_destinations",
+              "description": "The access request destinations to assign to the securable.\nFor each destination, a **destination_id** and **destination_type** must be defined.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "AccessRequestDestinations",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "securable",
+                    "description": "The securable for which the access request destinations are being modified or read.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "Securable",
+                      "is_object": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "securable",
+                    "description": "The securable for which the access request destinations are being modified or read.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "Securable",
+                      "is_object": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "AccessRequestDestinations",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "securable",
+                  "description": "The securable for which the access request destinations are being modified or read.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Securable",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "securable",
+                  "description": "The securable for which the access request destinations are being modified or read.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Securable",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "access_request_destinations",
+                "description": "The access request destinations to assign to the securable.\nFor each destination, a **destination_id** and **destination_type** must be defined.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AccessRequestDestinations",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "securable",
+                      "description": "The securable for which the access request destinations are being modified or read.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "Securable",
+                        "is_object": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "securable",
+                      "description": "The securable for which the access request destinations are being modified or read.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "Securable",
+                        "is_object": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "are_any_destinations_hidden",
+                "description": "Indicates whether any destinations are hidden from the caller due to a lack of permissions.\nThis value is true if the caller does not have permission to see all destinations.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "destination_source_securable",
+                "description": "The source securable from which the destinations are inherited. Either the same value as securable (if destination\nis set directly on the securable) or the nearest parent securable with destinations set.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "Securable",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "destinations",
+                "description": "The access request destinations for the securable.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "NotificationDestinationList",
+                  "array_value": {
+                    "pascal_name": "NotificationDestination",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "full_name",
+                "description": "The full name of the securable. Redundant with the name in the securable object, but necessary for Terraform integration",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "securable",
+                "description": "The securable for which the access request destinations are being modified or read.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Securable",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "securable_type",
+                "description": "The type of the securable. Redundant with the type in the securable object, but necessary for Terraform integration",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "update_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "securable",
+                "description": "The securable for which the access request destinations are being modified or read.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Securable",
+                  "is_object": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "sandbox.Sandbox",
+        "name": "Sandbox",
+        "description": "Create, manage, and control the lifecycle of sandboxes -- isolated, pre-configured, low-latency Serverless compute environments for running code.",
+        "package": {
+          "name": "sandbox"
+        },
+        "docs_group": "sandbox",
+        "launch_stage": "PUBLIC_BETA",
+        "cli_launch_stage_label": "*Beta*",
+        "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+        "cli_launch_stage_display": "Beta",
+        "list": {
+          "request": {
+            "pascal_name": "ListDirectoryContentsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "CreateDirectory",
+            "description": "Creates a directory in a sandbox, including missing parents by default.",
+            "summary": ".",
+            "path": "/api/2.0/sandbox-files/{parent=sandboxes/*}/directories:make",
+            "can_use_json": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "CreateDirectoryRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "path",
+                  "description": "Absolute UTF-8 path of the directory.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "path",
+                  "description": "Absolute UTF-8 path of the directory.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CreateDirectoryResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "parent",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parents",
+                "description": "Defaults to true, which also succeeds when the directory already exists.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "path",
+                "description": "Absolute UTF-8 path of the directory.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "path",
+                "description": "Absolute UTF-8 path of the directory.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateSandbox",
+            "description": "Creates a new Sandbox.",
+            "summary": "Create a sandbox.",
+            "path": "/api/2.0/sandboxes",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "CreateSandboxRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "sandbox",
+                  "description": "The sandbox to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Sandbox",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "sandbox_id",
+                  "description": "Client-supplied ID that becomes the final path segment of the resource name.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "sandbox_id",
+                  "description": "Client-supplied ID that becomes the final path segment of the resource name.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "sandbox",
+                  "description": "The sandbox to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Sandbox",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "sandbox",
+              "description": "The sandbox to create.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Sandbox",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "Sandbox",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "sandbox",
+                "description": "The sandbox to create.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Sandbox",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "sandbox_id",
+                "description": "Client-supplied ID that becomes the final path segment of the resource name.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Output only. The creation time of the sandbox.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "Human-readable display label for the sandbox. At most 256 characters.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The sandbox resource name, in the form `sandboxes/{sandbox_id}`. Derived from\n`sandbox_id`; any value supplied in a create or update request body is ignored.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "spec",
+                "description": "The desired configuration of the sandbox, supplied by the caller at creation time.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "SandboxSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "status",
+                "description": "The observed runtime state of the sandbox, populated by the server.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "SandboxStatus",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "Output only. The last update time of the sandbox metadata and spec.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "sandbox_id",
+                "description": "Client-supplied ID that becomes the final path segment of the resource name.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeletePath",
+            "description": "Deletes a file, symlink, or empty directory, with an option for recursive deletion.\nSucceeds if the path is already absent.",
+            "summary": ".",
+            "path": "/api/2.0/sandbox-files/{parent=sandboxes/*}/paths:remove",
+            "can_use_json": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "DeletePathRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "path",
+                  "description": "Absolute UTF-8 path of the entry to delete.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "path",
+                  "description": "Absolute UTF-8 path of the entry to delete.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeletePathResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "parent",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "path",
+                "description": "Absolute UTF-8 path of the entry to delete.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "recursive",
+                "description": "Required for a non-empty directory.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "path",
+                "description": "Absolute UTF-8 path of the entry to delete.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteSandbox",
+            "description": "Deletes a Sandbox.",
+            "summary": "Delete a sandbox.",
+            "path": "/api/2.0/{name=sandboxes/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "DeleteSandboxRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ExecuteCommandSync",
+            "description": "Runs a command in the sandbox and blocks until it exits, returning the\ncaptured stdout, stderr and exit code in a single response.",
+            "summary": "Run a command in a sandbox and wait for its result.",
+            "path": "/api/2.0/sandbox-exec/{name=sandboxes/*}/exec-sync",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ExecuteCommandSyncRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the sandbox to run the command in, in the form\n`sandboxes/{sandbox_id}`. Bound from the URL path.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "cmd",
+                  "description": "Executable or command to run (e.g. `/bin/echo`, `python3`).",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the sandbox to run the command in, in the form\n`sandboxes/{sandbox_id}`. Bound from the URL path.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "cmd",
+                  "description": "Executable or command to run (e.g. `/bin/echo`, `python3`).",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ExecuteCommandSyncResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "args",
+                "description": "Arguments passed to `cmd`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "cmd",
+                "description": "Executable or command to run (e.g. `/bin/echo`, `python3`).",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "envs",
+                "description": "Extra environment variables for the command's process, merged over the\nsandbox's default environment.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "execution_timeout",
+                "description": "Maximum time to wait for the command to finish. When it elapses the\ncommand is terminated and the response carries status `TIMED_OUT`. The\nserver applies a default when unset and clamps to an upper bound; negative\nor otherwise invalid durations are rejected with `INVALID_ARGUMENT`.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_duration": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name of the sandbox to run the command in, in the form\n`sandboxes/{sandbox_id}`. Bound from the URL path.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Resource name of the sandbox to run the command in, in the form\n`sandboxes/{sandbox_id}`. Bound from the URL path.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "cmd",
+                "description": "Executable or command to run (e.g. `/bin/echo`, `python3`).",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetMetadata",
+            "description": "Returns metadata for a path without following its final symlink.",
+            "summary": ".",
+            "path": "/api/2.0/sandbox-files/{parent=sandboxes/*}/paths:describe",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "GetMetadataRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "path",
+                  "description": "Absolute UTF-8 path of the entry to inspect.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "path",
+                  "description": "Absolute UTF-8 path of the entry to inspect.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetMetadataResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "parent",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "path",
+                "description": "Absolute UTF-8 path of the entry to inspect.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "path",
+                "description": "Absolute UTF-8 path of the entry to inspect.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetSandbox",
+            "description": "Retrieves a Sandbox by name.",
+            "summary": "Get a sandbox.",
+            "path": "/api/2.0/{name=sandboxes/*}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetSandboxRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Sandbox",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListCommands",
+            "description": "Lists the tracked command executions (running and completed) in a sandbox.",
+            "summary": "List the tracked command executions in a sandbox.",
+            "path": "/api/2.0/sandbox-exec/{parent=sandboxes/*}/commands",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ListCommandsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "The sandbox whose commands to list, in the form `sandboxes/{sandbox_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "The sandbox whose commands to list, in the form `sandboxes/{sandbox_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListCommandsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "Maximum number of commands to return. The server may return fewer.\nIf unspecified, the server returns all commands.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Page token returned by a previous ListCommands call. Use this to\nretrieve the next page of results.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "The sandbox whose commands to list, in the form `sandboxes/{sandbox_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "The sandbox whose commands to list, in the form `sandboxes/{sandbox_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListDirectoryContents",
+            "description": "Lists a directory's immediate children in UTF-8 name order. Later pages may reflect concurrent changes.",
+            "summary": ".",
+            "path": "/api/2.0/sandbox-files/{parent=sandboxes/*}/directory-entries",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "ListDirectoryContentsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "path",
+                  "description": "Absolute UTF-8 path of the directory.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "path",
+                  "description": "Absolute UTF-8 path of the directory.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListDirectoryContentsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "Zero uses the default of 1000; values above 1000 are clamped to 1000.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "The token from a prior response. Keep parent and path unchanged between pages.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "path",
+                "description": "Absolute UTF-8 path of the directory.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "path",
+                "description": "Absolute UTF-8 path of the directory.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "The token from a prior response. Keep parent and path unchanged between pages.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListSandboxes",
+            "description": "Lists all Sandboxes.",
+            "summary": "List sandboxes.",
+            "path": "/api/2.0/sandboxes",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ListSandboxesRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListSandboxesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "RenamePath",
+            "description": "Renames a path within a sandbox. The destination must be absent and on the same filesystem.",
+            "summary": ".",
+            "path": "/api/2.0/sandbox-files/{parent=sandboxes/*}/paths:rename",
+            "can_use_json": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "RenamePathRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "Sandbox resource name, for example `sandboxes/my-sandbox`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "source",
+                  "description": "Absolute UTF-8 path to move.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "destination",
+                  "description": "Exact absolute UTF-8 destination; it must not already exist.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "Sandbox resource name, for example `sandboxes/my-sandbox`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "source",
+                  "description": "Absolute UTF-8 path to move.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "destination",
+                  "description": "Exact absolute UTF-8 destination; it must not already exist.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "RenamePathResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "destination",
+                "description": "Exact absolute UTF-8 destination; it must not already exist.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "Sandbox resource name, for example `sandboxes/my-sandbox`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "source",
+                "description": "Absolute UTF-8 path to move.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "Sandbox resource name, for example `sandboxes/my-sandbox`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "source",
+                "description": "Absolute UTF-8 path to move.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "destination",
+                "description": "Exact absolute UTF-8 destination; it must not already exist.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "StartSandbox",
+            "description": "Starts a previously stopped Sandbox under the same sandbox name.\nReturns NOT_FOUND if there is no stopped sandbox to start for\nthe given name.",
+            "summary": "Start a sandbox.",
+            "path": "/api/2.0/{name=sandboxes/*}/start",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "StartSandboxRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the sandbox to start, in the form `sandboxes/{sandbox_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the sandbox to start, in the form `sandboxes/{sandbox_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Sandbox",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Resource name of the sandbox to start, in the form `sandboxes/{sandbox_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Resource name of the sandbox to start, in the form `sandboxes/{sandbox_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "StopSandbox",
+            "description": "Stops a running Sandbox, preserving it so it can later be restarted with\na Start request.",
+            "summary": "Stop a sandbox.",
+            "path": "/api/2.0/{name=sandboxes/*}/stop",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "StopSandboxRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the sandbox to stop, in the form `sandboxes/{sandbox_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the sandbox to stop, in the form `sandboxes/{sandbox_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Sandbox",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Resource name of the sandbox to stop, in the form `sandboxes/{sandbox_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Resource name of the sandbox to stop, in the form `sandboxes/{sandbox_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateSandbox",
+            "description": "Updates mutable fields on an existing Sandbox. Allowlisted update_mask\npaths today: display_name, spec.compute.inactivity_timeout.\nReturns INVALID_PARAMETER_VALUE for empty masks or unknown paths;\nNOT_FOUND if the sandbox does not exist.",
+            "summary": "Update a sandbox.",
+            "path": "/api/2.0/{name=sandboxes/*}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "UpdateSandboxRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the sandbox to update, in the form `sandboxes/{sandbox_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "sandbox",
+                  "description": "The Sandbox resource carrying new field values. Only fields named in\n`update_mask` are read; unmasked fields are ignored.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Sandbox",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Field paths to update. Must be a non-empty subset of:\n- display_name\n- spec.compute.inactivity_timeout\nAny other path returns INVALID_PARAMETER_VALUE.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Resource name of the sandbox to update, in the form `sandboxes/{sandbox_id}`.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Field paths to update. Must be a non-empty subset of:\n- display_name\n- spec.compute.inactivity_timeout\nAny other path returns INVALID_PARAMETER_VALUE.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "sandbox",
+                  "description": "The Sandbox resource carrying new field values. Only fields named in\n`update_mask` are read; unmasked fields are ignored.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Sandbox",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "sandbox",
+              "description": "The Sandbox resource carrying new field values. Only fields named in\n`update_mask` are read; unmasked fields are ignored.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Sandbox",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "Sandbox",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Resource name of the sandbox to update, in the form `sandboxes/{sandbox_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "sandbox",
+                "description": "The Sandbox resource carrying new field values. Only fields named in\n`update_mask` are read; unmasked fields are ignored.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Sandbox",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Field paths to update. Must be a non-empty subset of:\n- display_name\n- spec.compute.inactivity_timeout\nAny other path returns INVALID_PARAMETER_VALUE.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Output only. The creation time of the sandbox.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "Human-readable display label for the sandbox. At most 256 characters.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The sandbox resource name, in the form `sandboxes/{sandbox_id}`. Derived from\n`sandbox_id`; any value supplied in a create or update request body is ignored.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "spec",
+                "description": "The desired configuration of the sandbox, supplied by the caller at creation time.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "SandboxSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "status",
+                "description": "The observed runtime state of the sandbox, populated by the server.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "SandboxStatus",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "Output only. The last update time of the sandbox metadata and spec.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Resource name of the sandbox to update, in the form `sandboxes/{sandbox_id}`.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Field paths to update. Must be a non-empty subset of:\n- display_name\n- spec.compute.inactivity_timeout\nAny other path returns INVALID_PARAMETER_VALUE.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "catalog.Schemas",
+        "name": "Schemas",
+        "description": "A schema (also called a database) is the second layer of Unity Catalog’s three-level\nnamespace. A schema organizes tables, views, and functions. To access (or list) a table or view in\na schema, users must have the USE_SCHEMA data permission on the schema and its parent catalog,\nand they must have the SELECT permission on the table or view.",
+        "package": {
+          "name": "catalog"
+        },
+        "docs_group": "catalog",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListSchemasRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a new schema for catalog in the Metastore.\nThe caller must be a metastore admin, or have the **CREATE_SCHEMA** privilege in the parent catalog.",
+            "summary": "Create a schema.",
+            "path": "/api/2.1/unity-catalog/schemas",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateSchema",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of schema, relative to parent catalog.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "catalog_name",
+                  "description": "Name of parent catalog.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of schema, relative to parent catalog.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "catalog_name",
+                  "description": "Name of parent catalog.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "SchemaInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "catalog_name",
+                "description": "Name of parent catalog.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "comment",
+                "description": "User-provided free-form text description.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "custom_max_retention_hours",
+                "description": "Custom maximum retention period in hours for the schema.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of schema, relative to parent catalog.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "properties",
+                "description": "A map of key-value properties attached to the securable.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "storage_root",
+                "description": "Storage root URL for managed tables within schema.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of schema, relative to parent catalog.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "catalog_name",
+                "description": "Name of parent catalog.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes the specified schema from the parent catalog.\nThe caller must be the owner of the schema or an owner of the parent catalog.",
+            "summary": "Delete a schema.",
+            "path": "/api/2.1/unity-catalog/schemas/{full_name}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteSchemaRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "full_name",
+                  "description": "Full name of the schema.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "full_name",
+                  "description": "Full name of the schema.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "force",
+                "description": "Force deletion even if the schema is not empty.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "full_name",
+                "description": "Full name of the schema.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "full_name",
+                "description": "Full name of the schema.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets the specified schema within the metastore.\nThe caller must be a metastore admin, the owner of the schema, or a user that has the **USE_SCHEMA** privilege on the schema.",
+            "summary": "Get a schema.",
+            "path": "/api/2.1/unity-catalog/schemas/{full_name}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetSchemaRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "full_name",
+                  "description": "Full name of the schema.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "full_name",
+                  "description": "Full name of the schema.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "SchemaInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "full_name",
+                "description": "Full name of the schema.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "include_browse",
+                "description": "Whether to include schemas in the response for which the principal can only access selective metadata for",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "full_name",
+                "description": "Full name of the schema.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Gets an array of schemas for a catalog in the metastore.\nIf the caller is the metastore admin or the owner of the parent catalog, all schemas for the catalog will be retrieved.\nOtherwise, only schemas owned by the caller (or for which the caller has the **USE_SCHEMA** privilege) will be retrieved.\nThere is no guarantee of a specific ordering of the elements in the array.\n\nNOTE: we recommend using max_results=0 to use the paginated version of this API. Unpaginated calls will be deprecated soon.\n\nPAGINATION BEHAVIOR: When using pagination (max_results \u003e= 0), a page may contain zero results while still providing a next_page_token.\nClients must continue reading pages until next_page_token is absent, which is the only indication that the end of results has been reached.",
+            "summary": "List schemas.",
+            "path": "/api/2.1/unity-catalog/schemas",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListSchemasRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "catalog_name",
+                  "description": "Parent catalog for schemas of interest.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "catalog_name",
+                  "description": "Parent catalog for schemas of interest.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListSchemasResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "catalog_name",
+                "description": "Parent catalog for schemas of interest.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "include_browse",
+                "description": "Whether to include schemas in the response for which the principal can only access selective metadata for",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "max_results",
+                "description": "Maximum number of schemas to return.\nIf not set, all the schemas are returned (not recommended).\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- when set to 0, the page length is set to a server configured value (recommended);\n- when set to a value less than 0, an invalid parameter error is returned;",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque pagination token to go to next page based on previous query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "catalog_name",
+                "description": "Parent catalog for schemas of interest.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Opaque pagination token to go to next page based on previous query.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              },
+              "max_results": {
+                "name": "max_results",
+                "description": "Maximum number of schemas to return.\nIf not set, all the schemas are returned (not recommended).\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- when set to 0, the page length is set to a server configured value (recommended);\n- when set to a value less than 0, an invalid parameter error is returned;",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              }
+            }
+          },
+          {
+            "name": "Update",
+            "description": "Updates a schema for a catalog. The caller must be the owner of the schema or a metastore admin.\nIf the caller is a metastore admin, only the __owner__ field can be changed in the update.\nIf the __name__ field must be updated, the caller must be a metastore admin or have the **CREATE_SCHEMA** privilege on the parent catalog.",
+            "summary": "Update a schema.",
+            "path": "/api/2.1/unity-catalog/schemas/{full_name}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateSchema",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "full_name",
+                  "description": "Full name of the schema.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "full_name",
+                  "description": "Full name of the schema.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "SchemaInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "comment",
+                "description": "User-provided free-form text description.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "custom_max_retention_hours",
+                "description": "Custom maximum retention period in hours for the schema.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "enable_predictive_optimization",
+                "description": "Whether predictive optimization should be enabled for this object and objects under it.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EnablePredictiveOptimization",
+                  "enum": [
+                    {
+                      "content": "DISABLE"
+                    },
+                    {
+                      "content": "ENABLE"
+                    },
+                    {
+                      "content": "INHERIT"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "full_name",
+                "description": "Full name of the schema.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "new_name",
+                "description": "New name for the schema.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "owner",
+                "description": "Username of current owner of schema.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "properties",
+                "description": "A map of key-value properties attached to the securable.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "full_name",
+                "description": "Full name of the schema.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "workspace.Secrets",
+        "name": "Secrets",
+        "description": "The Secrets API allows you to manage secrets, secret scopes, and access permissions.\n\nSometimes accessing data requires that you authenticate to external data sources through JDBC.\nInstead of directly entering your credentials into a notebook, use Databricks secrets to store\nyour credentials and reference them in notebooks and jobs.\n\nAdministrators, secret creators, and users granted permission can read Databricks secrets.\nWhile Databricks makes an effort to redact secret values that might be displayed in notebooks,\nit is not possible to prevent such users from reading secrets.",
+        "package": {
+          "name": "workspace"
+        },
+        "docs_group": "workspace",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListSecretsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "CreateScope",
+            "description": "Creates a new secret scope.\n\nThe scope name must consist of alphanumeric characters, dashes, underscores, and\nperiods, and may not exceed 128 characters.\n\nExample request:\n\n.. code::\n\n{\n\"scope\": \"my-simple-databricks-scope\",\n\"initial_manage_principal\": \"users\"\n\"scope_backend_type\": \"databricks|azure_keyvault\",\n# below is only required if scope type is azure_keyvault\n\"backend_azure_keyvault\": {\n\"resource_id\": \"/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/xxxx/providers/Microsoft.KeyVault/vaults/xxxx\",\n\"tenant_id\": \"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx\",\n\"dns_name\": \"https://xxxx.vault.azure.net/\",\n}\n}\n\nIf ``initial_manage_principal`` is specified, the initial ACL applied to the scope is\napplied to the supplied principal (user or group) with ``MANAGE`` permissions.\nThe only supported principal for this option is the group ``users``, which\ncontains all users in the workspace. If ``initial_manage_principal`` is not specified,\nthe initial ACL with ``MANAGE`` permission applied to the scope is assigned to the\nAPI request issuer's user identity.\n\nIf ``scope_backend_type`` is ``azure_keyvault``, a secret scope is created with secrets\nfrom a given Azure KeyVault. The caller must provide the keyvault_resource_id and the tenant_id\nfor the key vault. If ``scope_backend_type`` is ``databricks`` or is unspecified, an empty\nsecret scope is created and stored in Databricks's own storage.\n\nThrows ``RESOURCE_ALREADY_EXISTS`` if a scope with the given name already exists.\nThrows ``RESOURCE_LIMIT_EXCEEDED`` if maximum number of scopes in the workspace is exceeded.\nThrows ``INVALID_PARAMETER_VALUE`` if the scope name is invalid.\nThrows ``BAD_REQUEST`` if request violated constraints.\nThrows ``CUSTOMER_UNAUTHORIZED`` if normal user attempts to create a scope with name reserved for databricks internal usage.\nThrows ``UNAUTHENTICATED`` if unable to verify user access permission on Azure KeyVault",
+            "summary": "Create a new secret scope.",
+            "path": "/api/2.0/secrets/scopes/create",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateScope",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "scope",
+                  "description": "Scope name requested by the user. Scope names are unique.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "scope",
+                  "description": "Scope name requested by the user. Scope names are unique.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "backend_azure_keyvault",
+                "description": "The metadata for the secret scope if the type is ``AZURE_KEYVAULT``",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AzureKeyVaultSecretScopeMetadata",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "initial_manage_principal",
+                "description": "The principal that is initially granted ``MANAGE`` permission to the created scope.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "scope",
+                "description": "Scope name requested by the user. Scope names are unique.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "scope_backend_type",
+                "description": "The backend type the scope will be created with. If not specified, will default to ``DATABRICKS``",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ScopeBackendType",
+                  "enum": [
+                    {
+                      "content": "AZURE_KEYVAULT"
+                    },
+                    {
+                      "content": "DATABRICKS"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "scope",
+                "description": "Scope name requested by the user. Scope names are unique.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteAcl",
+            "description": "Deletes the given ACL on the given scope.\n\nUsers must have the ``MANAGE`` permission to invoke this API.\n\nExample request:\n\n.. code::\n\n{\n\"scope\": \"my-secret-scope\",\n\"principal\": \"data-scientists\"\n}\n\nThrows ``RESOURCE_DOES_NOT_EXIST`` if no such secret scope, principal, or ACL exists.\nThrows ``PERMISSION_DENIED`` if the user does not have permission to make this API call.\nThrows ``INVALID_PARAMETER_VALUE`` if the permission or principal is invalid.",
+            "summary": "Delete an ACL.",
+            "path": "/api/2.0/secrets/acls/delete",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteAcl",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "scope",
+                  "description": "The name of the scope to remove permissions from.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "principal",
+                  "description": "The principal to remove an existing ACL from.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "scope",
+                  "description": "The name of the scope to remove permissions from.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "principal",
+                  "description": "The principal to remove an existing ACL from.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "principal",
+                "description": "The principal to remove an existing ACL from.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "scope",
+                "description": "The name of the scope to remove permissions from.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "scope",
+                "description": "The name of the scope to remove permissions from.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "principal",
+                "description": "The principal to remove an existing ACL from.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteScope",
+            "description": "Deletes a secret scope.\n\nExample request:\n\n.. code::\n\n{\n\"scope\": \"my-secret-scope\"\n}\n\nThrows ``RESOURCE_DOES_NOT_EXIST`` if the scope does not exist.\nThrows ``PERMISSION_DENIED`` if the user does not have permission to make this API call.\nThrows ``BAD_REQUEST`` if system user attempts to delete internal secret scope.",
+            "summary": "Delete a secret scope.",
+            "path": "/api/2.0/secrets/scopes/delete",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteScope",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "scope",
+                  "description": "Name of the scope to delete.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "scope",
+                  "description": "Name of the scope to delete.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "scope",
+                "description": "Name of the scope to delete.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "scope",
+                "description": "Name of the scope to delete.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteSecret",
+            "description": "Deletes the secret stored in this secret scope. You must have ``WRITE`` or ``MANAGE``\npermission on the Secret Scope.\n\nExample request:\n\n.. code::\n\n{\n\"scope\": \"my-secret-scope\",\n\"key\": \"my-secret-key\"\n}\n\nThrows ``RESOURCE_DOES_NOT_EXIST`` if no such secret scope or secret exists.\nThrows ``PERMISSION_DENIED`` if the user does not have permission to make this API call.\nThrows ``BAD_REQUEST`` if system user attempts to delete an internal secret, or request is made against Azure KeyVault backed scope.",
+            "summary": "Delete a secret.",
+            "path": "/api/2.0/secrets/delete",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteSecret",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "scope",
+                  "description": "The name of the scope that contains the secret to delete.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "key",
+                  "description": "Name of the secret to delete.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "scope",
+                  "description": "The name of the scope that contains the secret to delete.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "key",
+                  "description": "Name of the secret to delete.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteSecretResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "key",
+                "description": "Name of the secret to delete.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "scope",
+                "description": "The name of the scope that contains the secret to delete.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "scope",
+                "description": "The name of the scope that contains the secret to delete.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "key",
+                "description": "Name of the secret to delete.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetAcl",
+            "description": "Describes the details about the given ACL, such as the group and permission.\n\nUsers must have the ``MANAGE`` permission to invoke this API.\n\nExample response:\n\n.. code::\n\n{\n\"principal\": \"data-scientists\",\n\"permission\": \"READ\"\n}\n\nThrows ``RESOURCE_DOES_NOT_EXIST`` if no such secret scope exists.\nThrows ``PERMISSION_DENIED`` if the user does not have permission to make this API call.\nThrows ``INVALID_PARAMETER_VALUE`` if the permission or principal is invalid.",
+            "summary": "Get secret ACL details.",
+            "path": "/api/2.0/secrets/acls/get",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetAclRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "scope",
+                  "description": "The name of the scope to fetch ACL information from.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "principal",
+                  "description": "The principal to fetch ACL information for.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "scope",
+                  "description": "The name of the scope to fetch ACL information from.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "principal",
+                  "description": "The principal to fetch ACL information for.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "AclItem",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "principal",
+                  "description": "The principal in which the permission is applied.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "permission",
+                  "description": "The permission level applied to the principal.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AclPermission",
+                    "enum": [
+                      {
+                        "content": "MANAGE"
+                      },
+                      {
+                        "content": "READ"
+                      },
+                      {
+                        "content": "WRITE"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "principal",
+                  "description": "The principal in which the permission is applied.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "permission",
+                  "description": "The permission level applied to the principal.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AclPermission",
+                    "enum": [
+                      {
+                        "content": "MANAGE"
+                      },
+                      {
+                        "content": "READ"
+                      },
+                      {
+                        "content": "WRITE"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "principal",
+                "description": "The principal to fetch ACL information for.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "scope",
+                "description": "The name of the scope to fetch ACL information from.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "scope",
+                "description": "The name of the scope to fetch ACL information from.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "principal",
+                "description": "The principal to fetch ACL information for.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetSecret",
+            "description": "Gets a secret for a given key and scope. This API can only be called from the DBUtils\ninterface. Users need the READ permission to make this call.\n\nExample response:\n\n.. code::\n\n{\n\"key\": \"my-string-key\",\n\"value\": \u003cbytes of the secret value\u003e\n}\n\nNote that the secret value returned is in bytes. The interpretation of the bytes\nis determined by the caller in DBUtils and the type the data is decoded into.\n\nThrows ``RESOURCE_DOES_NOT_EXIST`` if no such secret or secret scope exists.\nThrows ``PERMISSION_DENIED`` if the user does not have permission to make this API call.\n\nNote: This is explicitly an undocumented API. It also doesn't need to be supported\nfor the /preview prefix, because it's not a customer-facing API (i.e. only used\nfor DBUtils SecretUtils to fetch secrets).\n\nThrows ``RESOURCE_DOES_NOT_EXIST`` if no such secret scope or secret exists.\nThrows ``BAD_REQUEST`` if normal user calls get secret outside of a notebook.\nAKV specific errors:\nThrows ``INVALID_PARAMETER_VALUE`` if secret name is not alphanumeric or too long.\nThrows ``PERMISSION_DENIED`` if secret manager cannot access AKV with 403 error\nThrows ``MALFORMED_REQUEST`` if secret manager cannot access AKV with any other 4xx error",
+            "summary": "Get a secret.",
+            "path": "/api/2.0/secrets/get",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetSecretRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "scope",
+                  "description": "The name of the scope that contains the secret.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "key",
+                  "description": "Name of the secret to fetch value information.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "scope",
+                  "description": "The name of the scope that contains the secret.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "key",
+                  "description": "Name of the secret to fetch value information.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetSecretResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "key",
+                "description": "Name of the secret to fetch value information.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "scope",
+                "description": "The name of the scope that contains the secret.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "scope",
+                "description": "The name of the scope that contains the secret.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "key",
+                "description": "Name of the secret to fetch value information.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListAcls",
+            "description": "Lists the ACLs set on the given scope.\n\nUsers must have the ``MANAGE`` permission to invoke this API.\n\nExample response:\n\n.. code::\n\n{\n\"acls\": [{\n\"principal\": \"admins\",\n\"permission\": \"MANAGE\"\n},{\n\"principal\": \"data-scientists\",\n\"permission\": \"READ\"\n}]\n}\n\nThrows ``RESOURCE_DOES_NOT_EXIST`` if no such secret scope exists.\nThrows ``PERMISSION_DENIED`` if the user does not have permission to make this API call.",
+            "summary": "Lists ACLs.",
+            "path": "/api/2.0/secrets/acls/list",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListAclsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "scope",
+                  "description": "The name of the scope to fetch ACL information from.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "scope",
+                  "description": "The name of the scope to fetch ACL information from.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListAclsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "scope",
+                "description": "The name of the scope to fetch ACL information from.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "scope",
+                "description": "The name of the scope to fetch ACL information from.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {}
+          },
+          {
+            "name": "ListScopes",
+            "description": "Lists all secret scopes available in the workspace.\n\nExample response:\n\n.. code::\n\n{\n\"scopes\": [{\n\"name\": \"my-databricks-scope\",\n\"backend_type\": \"DATABRICKS\"\n},{\n\"name\": \"mount-points\",\n\"backend_type\": \"DATABRICKS\"\n}]\n}\n\nThrows ``PERMISSION_DENIED`` if the user does not have permission to make this API call.",
+            "summary": "List all scopes.",
+            "path": "/api/2.0/secrets/scopes/list",
+            "is_legacy_empty_request": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListScopesRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListScopesResponse",
+              "is_object": true
+            },
+            "pagination": {}
+          },
+          {
+            "name": "ListSecrets",
+            "description": "Lists the secret keys that are stored at this scope. This is a metadata-only\noperation; secret data cannot be retrieved using this API. Users need the READ\npermission to make this call.\n\nExample response:\n\n.. code::\n\n{\n\"secrets\": [\n{\n\"key\": \"my-string-key\"\",\n\"last_updated_timestamp\": \"1520467595000\"\n},\n{\n\"key\": \"my-byte-key\",\n\"last_updated_timestamp\": \"1520467595000\"\n},\n]\n}\n\nThe lastUpdatedTimestamp returned is in milliseconds since epoch.\n\nThrows ``RESOURCE_DOES_NOT_EXIST`` if no such secret scope exists.\nThrows ``PERMISSION_DENIED`` if the user does not have permission to make this API call.",
+            "summary": "List secret keys.",
+            "path": "/api/2.0/secrets/list",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListSecretsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "scope",
+                  "description": "The name of the scope to list secrets within.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "scope",
+                  "description": "The name of the scope to list secrets within.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListSecretsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "scope",
+                "description": "The name of the scope to list secrets within.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "scope",
+                "description": "The name of the scope to list secrets within.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {}
+          },
+          {
+            "name": "PutAcl",
+            "description": "Creates or overwrites the ACL associated with the given principal (user or group) on the\nspecified scope point. In general, a user or group will use the most powerful\npermission available to them, and permissions are ordered as follows:\n\n* ``MANAGE`` - Allowed to change ACLs, and read and write to this secret scope.\n* ``WRITE`` - Allowed to read and write to this secret scope.\n* ``READ`` - Allowed to read this secret scope and list what secrets are available.\n\nNote that in general, secret values can only be read from within a command\non a cluster (for example, through a notebook). There is no API to read the actual\nsecret value material outside of a cluster. However, the user's permission will be\napplied based on who is executing the command, and they must have at least READ permission.\n\nUsers must have the ``MANAGE`` permission to invoke this API.\n\nExample request:\n\n.. code::\n\n{\n\"scope\": \"my-secret-scope\",\n\"principal\": \"data-scientists\",\n\"permission\": \"READ\"\n}\n\nThe principal is a user or group name corresponding to an existing Databricks\nprincipal to be granted or revoked access.\n\nThrows ``RESOURCE_DOES_NOT_EXIST`` if no such secret scope exists.\nThrows ``RESOURCE_ALREADY_EXISTS`` if a permission for the principal already exists.\nThrows ``INVALID_PARAMETER_VALUE`` if the permission or principal is invalid.\nThrows ``PERMISSION_DENIED`` if the user does not have permission to make this API call.",
+            "summary": "Create/update an ACL.",
+            "path": "/api/2.0/secrets/acls/put",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "PutAcl",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "scope",
+                  "description": "The name of the scope to apply permissions to.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "principal",
+                  "description": "The principal in which the permission is applied.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "permission",
+                  "description": "The permission level applied to the principal.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AclPermission",
+                    "enum": [
+                      {
+                        "content": "MANAGE"
+                      },
+                      {
+                        "content": "READ"
+                      },
+                      {
+                        "content": "WRITE"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "scope",
+                  "description": "The name of the scope to apply permissions to.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "principal",
+                  "description": "The principal in which the permission is applied.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "permission",
+                  "description": "The permission level applied to the principal.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "AclPermission",
+                    "enum": [
+                      {
+                        "content": "MANAGE"
+                      },
+                      {
+                        "content": "READ"
+                      },
+                      {
+                        "content": "WRITE"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "permission",
+                "description": "The permission level applied to the principal.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AclPermission",
+                  "enum": [
+                    {
+                      "content": "MANAGE"
+                    },
+                    {
+                      "content": "READ"
+                    },
+                    {
+                      "content": "WRITE"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "principal",
+                "description": "The principal in which the permission is applied.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "scope",
+                "description": "The name of the scope to apply permissions to.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "scope",
+                "description": "The name of the scope to apply permissions to.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "principal",
+                "description": "The principal in which the permission is applied.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "permission",
+                "description": "The permission level applied to the principal.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AclPermission",
+                  "enum": [
+                    {
+                      "content": "MANAGE"
+                    },
+                    {
+                      "content": "READ"
+                    },
+                    {
+                      "content": "WRITE"
+                    }
+                  ]
+                }
+              }
+            ]
+          },
+          {
+            "name": "PutSecret",
+            "description": "Inserts a secret under the provided scope with the given name. If a secret already\nexists with the same name, this command overwrites the existing secret's value.\nThe server encrypts the secret using the secret scope's encryption settings before\nstoring it. You must have ``WRITE`` or ``MANAGE`` permission on the secret scope.\n\nThe secret key must consist of alphanumeric characters, dashes, underscores,\nand periods, and cannot exceed 128 characters. The maximum allowed secret\nvalue size is 128 KB. The maximum number of secrets in a given scope is\n1000.\n\nExample request:\n\n.. code::\n\n{\n\"scope\": \"my-databricks-scope\",\n\"key\": \"my-string-key\",\n\"string_value\": \"foobar\"\n}\n\nThe input fields \"string_value\" or \"bytes_value\"\nspecify the type of the secret, which will determine the value returned when\nthe secret value is requested. Exactly one must be specified.\n\nThrows ``RESOURCE_DOES_NOT_EXIST`` if no such secret scope exists.\nThrows ``RESOURCE_LIMIT_EXCEEDED`` if maximum number of secrets in scope is exceeded.\nThrows ``INVALID_PARAMETER_VALUE`` if the request parameters are invalid.\nThrows ``PERMISSION_DENIED`` if the user does not have permission to make this API call.\nThrows ``MALFORMED_REQUEST`` if request is incorrectly formatted or conflicting.\nThrows ``BAD_REQUEST`` if request is made against Azure KeyVault backed scope.",
+            "summary": "Add a secret.",
+            "path": "/api/2.0/secrets/put",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "PutSecret",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "scope",
+                  "description": "The name of the scope to which the secret will be associated with.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "key",
+                  "description": "A unique name to identify the secret.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "scope",
+                  "description": "The name of the scope to which the secret will be associated with.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "key",
+                  "description": "A unique name to identify the secret.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "bytes_value",
+                "description": "If specified, value will be stored as bytes.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "key",
+                "description": "A unique name to identify the secret.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "scope",
+                "description": "The name of the scope to which the secret will be associated with.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "string_value",
+                "description": "If specified, note that the value will be stored in UTF-8 (MB4) form.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "scope",
+                "description": "The name of the scope to which the secret will be associated with.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "key",
+                "description": "A unique name to identify the secret.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "catalog.SecretsUc",
+        "name": "SecretsUc",
+        "description": "A secret is a Unity Catalog securable object that stores sensitive credential data (such as passwords, tokens, and keys) within a three-level namespace (**catalog_name.schema_name.secret_name**).\n\nSecrets can be managed using standard Unity Catalog permissions and are scoped to a schema within a catalog.",
+        "package": {
+          "name": "catalog"
+        },
+        "docs_group": "catalog",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListSecretsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "CreateSecret",
+            "description": "Creates a new secret in Unity Catalog.\n\nYou must be the owner of the parent schema or have the **CREATE_SECRET** and **USE SCHEMA**\nprivileges on the parent schema and **USE CATALOG** on the parent catalog.\n\nThe secret is stored in the specified catalog and schema, and the **value** field\ncontains the sensitive data to be securely stored.",
+            "summary": "Create a secret.",
+            "path": "/api/2.1/unity-catalog/secrets",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateSecretRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "secret",
+                  "description": "The secret object to create. The **name**, **catalog_name**, **schema_name**, and **value**\nfields are required.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Secret",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "secret",
+                  "description": "The secret object to create. The **name**, **catalog_name**, **schema_name**, and **value**\nfields are required.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Secret",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "secret",
+              "description": "The secret object to create. The **name**, **catalog_name**, **schema_name**, and **value**\nfields are required.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Secret",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "name",
+                    "description": "The name of the secret, relative to its parent schema.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "catalog_name",
+                    "description": "The name of the catalog where the schema and the secret reside.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "schema_name",
+                    "description": "The name of the schema where the secret resides.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "value",
+                    "description": "The secret value to store. This field is input-only and is not returned in responses — use\nthe **effective_value** field (via GetSecret with **include_value** set to true) to read the\nsecret value. The maximum size is 60 KiB (pre-encryption). Accepted content includes\npasswords, tokens, keys, and other sensitive credential data.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "name",
+                    "description": "The name of the secret, relative to its parent schema.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "catalog_name",
+                    "description": "The name of the catalog where the schema and the secret reside.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "schema_name",
+                    "description": "The name of the schema where the secret resides.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "value",
+                    "description": "The secret value to store. This field is input-only and is not returned in responses — use\nthe **effective_value** field (via GetSecret with **include_value** set to true) to read the\nsecret value. The maximum size is 60 KiB (pre-encryption). Accepted content includes\npasswords, tokens, keys, and other sensitive credential data.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "Secret",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the secret, relative to its parent schema.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "catalog_name",
+                  "description": "The name of the catalog where the schema and the secret reside.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schema_name",
+                  "description": "The name of the schema where the secret resides.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "value",
+                  "description": "The secret value to store. This field is input-only and is not returned in responses — use\nthe **effective_value** field (via GetSecret with **include_value** set to true) to read the\nsecret value. The maximum size is 60 KiB (pre-encryption). Accepted content includes\npasswords, tokens, keys, and other sensitive credential data.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the secret, relative to its parent schema.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "catalog_name",
+                  "description": "The name of the catalog where the schema and the secret reside.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schema_name",
+                  "description": "The name of the schema where the secret resides.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "value",
+                  "description": "The secret value to store. This field is input-only and is not returned in responses — use\nthe **effective_value** field (via GetSecret with **include_value** set to true) to read the\nsecret value. The maximum size is 60 KiB (pre-encryption). Accepted content includes\npasswords, tokens, keys, and other sensitive credential data.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "secret",
+                "description": "The secret object to create. The **name**, **catalog_name**, **schema_name**, and **value**\nfields are required.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Secret",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "name",
+                      "description": "The name of the secret, relative to its parent schema.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "catalog_name",
+                      "description": "The name of the catalog where the schema and the secret reside.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "schema_name",
+                      "description": "The name of the schema where the secret resides.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "value",
+                      "description": "The secret value to store. This field is input-only and is not returned in responses — use\nthe **effective_value** field (via GetSecret with **include_value** set to true) to read the\nsecret value. The maximum size is 60 KiB (pre-encryption). Accepted content includes\npasswords, tokens, keys, and other sensitive credential data.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "name",
+                      "description": "The name of the secret, relative to its parent schema.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "catalog_name",
+                      "description": "The name of the catalog where the schema and the secret reside.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "schema_name",
+                      "description": "The name of the schema where the secret resides.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "value",
+                      "description": "The secret value to store. This field is input-only and is not returned in responses — use\nthe **effective_value** field (via GetSecret with **include_value** set to true) to read the\nsecret value. The maximum size is 60 KiB (pre-encryption). Accepted content includes\npasswords, tokens, keys, and other sensitive credential data.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "catalog_name",
+                "description": "The name of the catalog where the schema and the secret reside.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "comment",
+                "description": "User-provided free-form text description of the secret.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "The time at which this secret was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "created_by",
+                "description": "The principal that created the secret.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_owner",
+                "description": "The effective owner of the secret, which may differ from the directly-set **owner** due to\ninheritance.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_value",
+                "description": "The secret value. Only populated in responses when you have the **READ_SECRET**\nprivilege and **include_value** is set to true in the request. The maximum size is 60 KiB.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "expire_time",
+                "description": "User-provided expiration time of the secret. This field indicates when the secret should no\nlonger be used and may be displayed as a warning in the UI. It is purely informational and\ndoes not trigger any automatic actions or affect the secret's lifecycle.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "full_name",
+                "description": "The three-level (fully qualified) name of the secret, in the form of **catalog_name.schema_name.secret_name**.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "metastore_id",
+                "description": "Unique identifier of the metastore hosting the secret.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the secret, relative to its parent schema.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "owner",
+                "description": "The owner of the secret. Defaults to the creating principal on creation. Can be updated to\ntransfer ownership of the secret to another principal.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schema_name",
+                "description": "The name of the schema where the secret resides.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "The time at which this secret was last updated.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "updated_by",
+                "description": "The principal that last updated the secret.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "value",
+                "description": "The secret value to store. This field is input-only and is not returned in responses — use\nthe **effective_value** field (via GetSecret with **include_value** set to true) to read the\nsecret value. The maximum size is 60 KiB (pre-encryption). Accepted content includes\npasswords, tokens, keys, and other sensitive credential data.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the secret, relative to its parent schema.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "catalog_name",
+                "description": "The name of the catalog where the schema and the secret reside.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schema_name",
+                "description": "The name of the schema where the secret resides.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "value",
+                "description": "The secret value to store. This field is input-only and is not returned in responses — use\nthe **effective_value** field (via GetSecret with **include_value** set to true) to read the\nsecret value. The maximum size is 60 KiB (pre-encryption). Accepted content includes\npasswords, tokens, keys, and other sensitive credential data.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteSecret",
+            "description": "Deletes a secret by its three-level (fully qualified) name.\n\nYou must be the owner of the secret or a metastore admin.",
+            "summary": "Delete a secret.",
+            "path": "/api/2.1/unity-catalog/secrets/{full_name}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteSecretRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "full_name",
+                  "description": "The three-level (fully qualified) name of the secret\n(for example, **catalog_name.schema_name.secret_name**).",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "full_name",
+                  "description": "The three-level (fully qualified) name of the secret\n(for example, **catalog_name.schema_name.secret_name**).",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "full_name",
+                "description": "The three-level (fully qualified) name of the secret\n(for example, **catalog_name.schema_name.secret_name**).",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "full_name",
+                "description": "The three-level (fully qualified) name of the secret\n(for example, **catalog_name.schema_name.secret_name**).",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetSecret",
+            "description": "Gets a secret by its three-level (fully qualified) name.\n\nYou must be a metastore admin, the owner of the secret, or have the **MANAGE**\nprivilege on the secret.\n\nThe secret value isn't returned by default. To retrieve it, you must also have the\n**READ_SECRET** privilege and set **include_value** to true in the request.",
+            "summary": "Get a secret.",
+            "path": "/api/2.1/unity-catalog/secrets/{full_name}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetSecretRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "full_name",
+                  "description": "The three-level (fully qualified) name of the secret\n(for example, **catalog_name.schema_name.secret_name**).",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "full_name",
+                  "description": "The three-level (fully qualified) name of the secret\n(for example, **catalog_name.schema_name.secret_name**).",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Secret",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the secret, relative to its parent schema.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "catalog_name",
+                  "description": "The name of the catalog where the schema and the secret reside.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schema_name",
+                  "description": "The name of the schema where the secret resides.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "value",
+                  "description": "The secret value to store. This field is input-only and is not returned in responses — use\nthe **effective_value** field (via GetSecret with **include_value** set to true) to read the\nsecret value. The maximum size is 60 KiB (pre-encryption). Accepted content includes\npasswords, tokens, keys, and other sensitive credential data.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the secret, relative to its parent schema.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "catalog_name",
+                  "description": "The name of the catalog where the schema and the secret reside.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schema_name",
+                  "description": "The name of the schema where the secret resides.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "value",
+                  "description": "The secret value to store. This field is input-only and is not returned in responses — use\nthe **effective_value** field (via GetSecret with **include_value** set to true) to read the\nsecret value. The maximum size is 60 KiB (pre-encryption). Accepted content includes\npasswords, tokens, keys, and other sensitive credential data.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "full_name",
+                "description": "The three-level (fully qualified) name of the secret\n(for example, **catalog_name.schema_name.secret_name**).",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "include_value",
+                "description": "Whether to include the secret value in the response. Defaults to false. Requires the\n**READ_SECRET** privilege.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "full_name",
+                "description": "The three-level (fully qualified) name of the secret\n(for example, **catalog_name.schema_name.secret_name**).",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListSecrets",
+            "description": "Lists secrets in Unity Catalog.\n\nYou must be a metastore admin, the owner of the secret, or have the\n**MANAGE** privilege on the secret.\n\nBoth **catalog_name** and **schema_name** must be specified together to filter secrets within\na specific schema. Results are paginated; use the **page_token** field from the response\nto retrieve subsequent pages.",
+            "summary": "List secrets.",
+            "path": "/api/2.1/unity-catalog/secrets",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListSecretsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListSecretsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "catalog_name",
+                "description": "The name of the catalog under which to list secrets. Both **catalog_name** and\n**schema_name** must be specified together.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "Maximum number of secrets to return.\n\n- If not specified, at most 1000 secrets are returned.\n- If set to a value greater than 0, the page length is the minimum of this value and 1000.\n- If set to 0, the page length is set to 1000.\n- If set to a value less than 0, an invalid parameter error is returned.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque pagination token to go to the next page based on previous query. The maximum page length\nis determined by a server configured value.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schema_name",
+                "description": "The name of the schema under which to list secrets. Both **catalog_name** and\n**schema_name** must be specified together.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Opaque pagination token to go to the next page based on previous query. The maximum page length\nis determined by a server configured value.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "UpdateSecret",
+            "description": "Updates an existing secret in Unity Catalog.\n\nYou must be the owner of the secret or a metastore admin. If you are a metastore\nadmin, only the **owner** field can be changed.\n\nUse the **update_mask** field to specify which fields to update. Supported updatable fields\ninclude **value**, **comment**, **owner**, and **expire_time**.",
+            "summary": "Update a secret.",
+            "path": "/api/2.1/unity-catalog/secrets/{full_name}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateSecretRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "full_name",
+                  "description": "The three-level (fully qualified) name of the secret\n(for example, **catalog_name.schema_name.secret_name**).",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "secret",
+                  "description": "The secret object containing the fields to update. Only fields specified in **update_mask**\nwill be updated.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Secret",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The field mask specifying which fields of the secret to update.\n- If **update_mask** is **\"*\"**, all fields specified in **secret** are updated.\n- If **update_mask** specifies one or more fields, only those fields are updated.\nEach specified field must be set in **secret**.\nSupported fields: **value**, **comment**, **owner**, **expire_time**. To change the secret\nname, delete and recreate the secret.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "full_name",
+                  "description": "The three-level (fully qualified) name of the secret\n(for example, **catalog_name.schema_name.secret_name**).",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The field mask specifying which fields of the secret to update.\n- If **update_mask** is **\"*\"**, all fields specified in **secret** are updated.\n- If **update_mask** specifies one or more fields, only those fields are updated.\nEach specified field must be set in **secret**.\nSupported fields: **value**, **comment**, **owner**, **expire_time**. To change the secret\nname, delete and recreate the secret.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "secret",
+                  "description": "The secret object containing the fields to update. Only fields specified in **update_mask**\nwill be updated.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Secret",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "secret",
+              "description": "The secret object containing the fields to update. Only fields specified in **update_mask**\nwill be updated.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Secret",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "name",
+                    "description": "The name of the secret, relative to its parent schema.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "catalog_name",
+                    "description": "The name of the catalog where the schema and the secret reside.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "schema_name",
+                    "description": "The name of the schema where the secret resides.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "value",
+                    "description": "The secret value to store. This field is input-only and is not returned in responses — use\nthe **effective_value** field (via GetSecret with **include_value** set to true) to read the\nsecret value. The maximum size is 60 KiB (pre-encryption). Accepted content includes\npasswords, tokens, keys, and other sensitive credential data.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "name",
+                    "description": "The name of the secret, relative to its parent schema.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "catalog_name",
+                    "description": "The name of the catalog where the schema and the secret reside.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "schema_name",
+                    "description": "The name of the schema where the secret resides.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "value",
+                    "description": "The secret value to store. This field is input-only and is not returned in responses — use\nthe **effective_value** field (via GetSecret with **include_value** set to true) to read the\nsecret value. The maximum size is 60 KiB (pre-encryption). Accepted content includes\npasswords, tokens, keys, and other sensitive credential data.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "Secret",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the secret, relative to its parent schema.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "catalog_name",
+                  "description": "The name of the catalog where the schema and the secret reside.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schema_name",
+                  "description": "The name of the schema where the secret resides.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "value",
+                  "description": "The secret value to store. This field is input-only and is not returned in responses — use\nthe **effective_value** field (via GetSecret with **include_value** set to true) to read the\nsecret value. The maximum size is 60 KiB (pre-encryption). Accepted content includes\npasswords, tokens, keys, and other sensitive credential data.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the secret, relative to its parent schema.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "catalog_name",
+                  "description": "The name of the catalog where the schema and the secret reside.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schema_name",
+                  "description": "The name of the schema where the secret resides.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "value",
+                  "description": "The secret value to store. This field is input-only and is not returned in responses — use\nthe **effective_value** field (via GetSecret with **include_value** set to true) to read the\nsecret value. The maximum size is 60 KiB (pre-encryption). Accepted content includes\npasswords, tokens, keys, and other sensitive credential data.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "full_name",
+                "description": "The three-level (fully qualified) name of the secret\n(for example, **catalog_name.schema_name.secret_name**).",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "secret",
+                "description": "The secret object containing the fields to update. Only fields specified in **update_mask**\nwill be updated.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Secret",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "name",
+                      "description": "The name of the secret, relative to its parent schema.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "catalog_name",
+                      "description": "The name of the catalog where the schema and the secret reside.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "schema_name",
+                      "description": "The name of the schema where the secret resides.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "value",
+                      "description": "The secret value to store. This field is input-only and is not returned in responses — use\nthe **effective_value** field (via GetSecret with **include_value** set to true) to read the\nsecret value. The maximum size is 60 KiB (pre-encryption). Accepted content includes\npasswords, tokens, keys, and other sensitive credential data.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "name",
+                      "description": "The name of the secret, relative to its parent schema.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "catalog_name",
+                      "description": "The name of the catalog where the schema and the secret reside.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "schema_name",
+                      "description": "The name of the schema where the secret resides.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "value",
+                      "description": "The secret value to store. This field is input-only and is not returned in responses — use\nthe **effective_value** field (via GetSecret with **include_value** set to true) to read the\nsecret value. The maximum size is 60 KiB (pre-encryption). Accepted content includes\npasswords, tokens, keys, and other sensitive credential data.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The field mask specifying which fields of the secret to update.\n- If **update_mask** is **\"*\"**, all fields specified in **secret** are updated.\n- If **update_mask** specifies one or more fields, only those fields are updated.\nEach specified field must be set in **secret**.\nSupported fields: **value**, **comment**, **owner**, **expire_time**. To change the secret\nname, delete and recreate the secret.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "catalog_name",
+                "description": "The name of the catalog where the schema and the secret reside.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "comment",
+                "description": "User-provided free-form text description of the secret.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "The time at which this secret was created.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "created_by",
+                "description": "The principal that created the secret.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_owner",
+                "description": "The effective owner of the secret, which may differ from the directly-set **owner** due to\ninheritance.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_value",
+                "description": "The secret value. Only populated in responses when you have the **READ_SECRET**\nprivilege and **include_value** is set to true in the request. The maximum size is 60 KiB.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "expire_time",
+                "description": "User-provided expiration time of the secret. This field indicates when the secret should no\nlonger be used and may be displayed as a warning in the UI. It is purely informational and\ndoes not trigger any automatic actions or affect the secret's lifecycle.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "full_name",
+                "description": "The three-level (fully qualified) name of the secret, in the form of **catalog_name.schema_name.secret_name**.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "metastore_id",
+                "description": "Unique identifier of the metastore hosting the secret.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the secret, relative to its parent schema.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "owner",
+                "description": "The owner of the secret. Defaults to the creating principal on creation. Can be updated to\ntransfer ownership of the secret to another principal.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schema_name",
+                "description": "The name of the schema where the secret resides.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "The time at which this secret was last updated.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "updated_by",
+                "description": "The principal that last updated the secret.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "value",
+                "description": "The secret value to store. This field is input-only and is not returned in responses — use\nthe **effective_value** field (via GetSecret with **include_value** set to true) to read the\nsecret value. The maximum size is 60 KiB (pre-encryption). Accepted content includes\npasswords, tokens, keys, and other sensitive credential data.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "full_name",
+                "description": "The three-level (fully qualified) name of the secret\n(for example, **catalog_name.schema_name.secret_name**).",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The field mask specifying which fields of the secret to update.\n- If **update_mask** is **\"*\"**, all fields specified in **secret** are updated.\n- If **update_mask** specifies one or more fields, only those fields are updated.\nEach specified field must be set in **secret**.\nSupported fields: **value**, **comment**, **owner**, **expire_time**. To change the secret\nname, delete and recreate the secret.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the secret, relative to its parent schema.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "catalog_name",
+                "description": "The name of the catalog where the schema and the secret reside.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schema_name",
+                "description": "The name of the schema where the secret resides.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "value",
+                "description": "The secret value to store. This field is input-only and is not returned in responses — use\nthe **effective_value** field (via GetSecret with **include_value** set to true) to read the\nsecret value. The maximum size is 60 KiB (pre-encryption). Accepted content includes\npasswords, tokens, keys, and other sensitive credential data.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "oauth2.ServicePrincipalFederationPolicy",
+        "name": "ServicePrincipalFederationPolicy",
+        "description": "These APIs manage service principal federation policies.\n\nService principal federation, also known as Workload Identity Federation, allows your automated workloads running outside of Databricks to securely access Databricks APIs without the need for Databricks secrets. With Workload Identity Federation, your application (or workload) authenticates to Databricks as a Databricks service principal, using tokens provided by the workload runtime.\n\nDatabricks strongly recommends using Workload Identity Federation to authenticate to Databricks from automated workloads, over alternatives such as OAuth client secrets or Personal Access Tokens, whenever possible. Workload Identity Federation is supported by many popular services, including Github Actions, Azure DevOps, GitLab, Terraform Cloud, and Kubernetes clusters, among others.\n\nWorkload identity federation is configured in your Databricks account using a service principal federation policy. A service principal federation policy specifies:\n* which IdP, or issuer, the service principal is allowed to authenticate from\n* which workload identity, or subject, is allowed to authenticate as the Databricks service principal\n\nTo configure a federation policy, you provide the following:\n* The required token __issuer__, as specified in the “iss” claim of workload identity tokens. The issuer is an https URL that identifies the workload identity provider.\n* The required token __subject__, as specified in the “sub” claim of workload identity tokens. The subject uniquely identifies the workload in the workload runtime environment.\n* The allowed token __audiences__, as specified in the “aud” claim of workload identity tokens. The audience is intended to represent the recipient of the token. As long as the audience in the token matches at least one audience in the policy, the token is considered a match. If unspecified, the default value is your Databricks account id.\n* Optionally, the public keys used to validate the signature of the workload identity tokens, in JWKS format. If unspecified (recommended), Databricks automatically fetches the public keys from the issuer’s well known endpoint. Databricks strongly recommends relying on the issuer’s well known endpoint for discovering public keys.\n\nAn example service principal federation policy, for a Github Actions workload, is:\n```\nissuer: \"https://token.actions.githubusercontent.com\"\naudiences: [\"https://github.com/my-github-org\"]\nsubject: \"repo:my-github-org/my-repo:environment:prod\"\n```\n\nAn example JWT token body that matches this policy and could be used to authenticate to Databricks is:\n```\n{\n\"iss\": \"https://token.actions.githubusercontent.com\",\n\"aud\": \"https://github.com/my-github-org\",\n\"sub\": \"repo:my-github-org/my-repo:environment:prod\"\n}\n```\n\nYou may also need to configure the workload runtime to generate tokens for your workloads.\n\nYou do not need to configure an OAuth application in Databricks to use token federation.",
+        "package": {
+          "name": "oauth2"
+        },
+        "is_accounts": true,
+        "docs_group": "oauth2",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListServicePrincipalFederationPoliciesRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Create account federation policy.",
+            "summary": "Create service principal federation policy.",
+            "path": "/api/2.0/accounts/{account_id}/servicePrincipals/{service_principal_id}/federationPolicies",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateServicePrincipalFederationPolicyRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "service_principal_id",
+                  "description": "The service principal id for the federation policy.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "policy",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "FederationPolicy",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "service_principal_id",
+                  "description": "The service principal id for the federation policy.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "policy",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "FederationPolicy",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "policy",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "FederationPolicy",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "FederationPolicy",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "policy",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "FederationPolicy",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "policy_id",
+                "description": "The identifier for the federation policy. The identifier must contain only lowercase\nalphanumeric characters, numbers, hyphens, and slashes. If unspecified, the id will be\nassigned by Databricks.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "service_principal_id",
+                "description": "The service principal id for the federation policy.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Creation time of the federation policy.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "Description of the federation policy.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name for the federation policy. Example values include\n`accounts/\u003caccount-id\u003e/federationPolicies/my-federation-policy` for Account Federation Policies, and\n`accounts/\u003caccount-id\u003e/servicePrincipals/\u003cservice-principal-id\u003e/federationPolicies/my-federation-policy`\nfor Service Principal Federation Policies. Typically an output parameter, which does not need to be\nspecified in create or update requests. If specified in a request, must match the value in the\nrequest URL.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "oidc_policy",
+                "description": "audit_mode INCLUDE is required on both this message field and its leaf fields so the OIDC\npolicy configuration is captured in create/update audit logs (see go/auditlogs).",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "OidcFederationPolicy",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "policy_id",
+                "description": "The ID of the federation policy. Output only.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "service_principal_id",
+                "description": "The service principal ID that this federation policy applies to. Output only. Only set for service principal federation policies.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "uid",
+                "description": "Unique, immutable id of the federation policy.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "Last update time of the federation policy.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "service_principal_id",
+                "description": "The service principal id for the federation policy.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Delete account federation policy.",
+            "summary": "Delete service principal federation policy.",
+            "path": "/api/2.0/accounts/{account_id}/servicePrincipals/{service_principal_id}/federationPolicies/{policy_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteServicePrincipalFederationPolicyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "service_principal_id",
+                  "description": "The service principal id for the federation policy.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "policy_id",
+                  "description": "The identifier for the federation policy.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "service_principal_id",
+                  "description": "The service principal id for the federation policy.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "policy_id",
+                  "description": "The identifier for the federation policy.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "policy_id",
+                "description": "The identifier for the federation policy.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "service_principal_id",
+                "description": "The service principal id for the federation policy.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "service_principal_id",
+                "description": "The service principal id for the federation policy.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "policy_id",
+                "description": "The identifier for the federation policy.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Get account federation policy.",
+            "summary": "Get service principal federation policy.",
+            "path": "/api/2.0/accounts/{account_id}/servicePrincipals/{service_principal_id}/federationPolicies/{policy_id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetServicePrincipalFederationPolicyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "service_principal_id",
+                  "description": "The service principal id for the federation policy.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "policy_id",
+                  "description": "The identifier for the federation policy.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "service_principal_id",
+                  "description": "The service principal id for the federation policy.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "policy_id",
+                  "description": "The identifier for the federation policy.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "FederationPolicy",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "policy_id",
+                "description": "The identifier for the federation policy.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "service_principal_id",
+                "description": "The service principal id for the federation policy.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "service_principal_id",
+                "description": "The service principal id for the federation policy.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "policy_id",
+                "description": "The identifier for the federation policy.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "List account federation policies.",
+            "summary": "List service principal federation policies.",
+            "path": "/api/2.0/accounts/{account_id}/servicePrincipals/{service_principal_id}/federationPolicies",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListServicePrincipalFederationPoliciesRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "service_principal_id",
+                  "description": "The service principal id for the federation policy.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "service_principal_id",
+                  "description": "The service principal id for the federation policy.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListFederationPoliciesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "service_principal_id",
+                "description": "The service principal id for the federation policy.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "service_principal_id",
+                "description": "The service principal id for the federation policy.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "Update",
+            "description": "Update account federation policy.",
+            "summary": "Update service principal federation policy.",
+            "path": "/api/2.0/accounts/{account_id}/servicePrincipals/{service_principal_id}/federationPolicies/{policy_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateServicePrincipalFederationPolicyRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "service_principal_id",
+                  "description": "The service principal id for the federation policy.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "policy_id",
+                  "description": "The identifier for the federation policy.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "policy",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "FederationPolicy",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "service_principal_id",
+                  "description": "The service principal id for the federation policy.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "policy_id",
+                  "description": "The identifier for the federation policy.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "policy",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "FederationPolicy",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "policy",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "FederationPolicy",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "FederationPolicy",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "policy",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "FederationPolicy",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "policy_id",
+                "description": "The identifier for the federation policy.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "service_principal_id",
+                "description": "The service principal id for the federation policy.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The field mask specifies which fields of the policy to update. To specify multiple fields\nin the field mask, use comma as the separator (no space). The special value '*' indicates\nthat all fields should be updated (full replacement). If unspecified, all fields that are\nset in the policy provided in the update request will overwrite the corresponding fields\nin the existing policy. Example value: 'description,oidc_policy.audiences'.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Creation time of the federation policy.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "Description of the federation policy.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Resource name for the federation policy. Example values include\n`accounts/\u003caccount-id\u003e/federationPolicies/my-federation-policy` for Account Federation Policies, and\n`accounts/\u003caccount-id\u003e/servicePrincipals/\u003cservice-principal-id\u003e/federationPolicies/my-federation-policy`\nfor Service Principal Federation Policies. Typically an output parameter, which does not need to be\nspecified in create or update requests. If specified in a request, must match the value in the\nrequest URL.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "oidc_policy",
+                "description": "audit_mode INCLUDE is required on both this message field and its leaf fields so the OIDC\npolicy configuration is captured in create/update audit logs (see go/auditlogs).",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "OidcFederationPolicy",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "policy_id",
+                "description": "The ID of the federation policy. Output only.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "service_principal_id",
+                "description": "The service principal ID that this federation policy applies to. Output only. Only set for service principal federation policies.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "uid",
+                "description": "Unique, immutable id of the federation policy.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "Last update time of the federation policy.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "service_principal_id",
+                "description": "The service principal id for the federation policy.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "policy_id",
+                "description": "The identifier for the federation policy.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "oauth2.ServicePrincipalSecrets",
+        "name": "ServicePrincipalSecrets",
+        "description": "These APIs enable administrators to manage service principal secrets.\n\nYou can use the generated secrets to obtain OAuth access tokens for a service principal, which can then be used to access Databricks Accounts and Workspace APIs. For more information, see [Authentication using OAuth tokens for service principals](https://docs.databricks.com/dev-tools/authentication-oauth.html).\n\nIn addition, the generated secrets can be used to configure the Databricks Terraform Provider to authenticate with the service principal. For more information, see [Databricks Terraform Provider](https://github.com/databricks/terraform-provider-databricks/blob/master/docs/index.md#authenticating-with-service-principal).",
+        "package": {
+          "name": "oauth2"
+        },
+        "is_accounts": true,
+        "docs_group": "oauth2",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListServicePrincipalSecretsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Create a secret for the given service principal.",
+            "summary": "Create service principal secret.",
+            "path": "/api/2.0/accounts/{account_id}/servicePrincipals/{service_principal_id}/credentials/secrets",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateServicePrincipalSecretRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "service_principal_id",
+                  "description": "The service principal ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "service_principal_id",
+                  "description": "The service principal ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CreateServicePrincipalSecretResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "lifetime",
+                "description": "The lifetime of the secret in seconds. If this parameter is not provided, the secret will have a default lifetime of 730 days (63072000s).",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "scopes",
+                "description": "OAuth API scopes to bind to the secret; a minted token cannot exceed them.\nEmpty = unrestricted (all-apis). E.g. all-apis, sql, iam.groups:read.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "service_principal_id",
+                "description": "The service principal ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "service_principal_id",
+                "description": "The service principal ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Delete a secret from the given service principal.",
+            "summary": "Delete service principal secret.",
+            "path": "/api/2.0/accounts/{account_id}/servicePrincipals/{service_principal_id}/credentials/secrets/{secret_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteServicePrincipalSecretRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "service_principal_id",
+                  "description": "The service principal ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "secret_id",
+                  "description": "The secret ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "service_principal_id",
+                  "description": "The service principal ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "secret_id",
+                  "description": "The secret ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "secret_id",
+                "description": "The secret ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "service_principal_id",
+                "description": "The service principal ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "service_principal_id",
+                "description": "The service principal ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "secret_id",
+                "description": "The secret ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "List all secrets associated with the given service principal. This operation only returns information about the secrets themselves and does not include the secret values.",
+            "summary": "List service principal secrets.",
+            "path": "/api/2.0/accounts/{account_id}/servicePrincipals/{service_principal_id}/credentials/secrets",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListServicePrincipalSecretsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "service_principal_id",
+                  "description": "The service principal ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "service_principal_id",
+                  "description": "The service principal ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListServicePrincipalSecretsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "An opaque page token which was the `next_page_token` in the response of the previous request to list the secrets for this service principal. Provide this token to retrieve the next page of secret entries.\nWhen providing a `page_token`, all other parameters provided to the request must match the previous request.\nTo list all of the secrets for a service principal, it is necessary to continue requesting pages of entries until the response contains no `next_page_token`. Note that the number of entries returned must not be used to determine when the listing is complete.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "service_principal_id",
+                "description": "The service principal ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "service_principal_id",
+                "description": "The service principal ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "An opaque page token which was the `next_page_token` in the response of the previous request to list the secrets for this service principal. Provide this token to retrieve the next page of secret entries.\nWhen providing a `page_token`, all other parameters provided to the request must match the previous request.\nTo list all of the secrets for a service principal, it is necessary to continue requesting pages of entries until the response contains no `next_page_token`. Note that the number of entries returned must not be used to determine when the listing is complete.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          }
+        ]
+      },
+      {
+        "id": "oauth2.ServicePrincipalSecretsProxy",
+        "name": "ServicePrincipalSecretsProxy",
+        "description": "These APIs enable administrators to manage service principal secrets at the workspace level. To use these APIs, the service principal must be first added to the current workspace.\n\nYou can use the generated secrets to obtain OAuth access tokens for a service principal, which can then be used to access Databricks Accounts and Workspace APIs. For more information, see [Authentication using OAuth tokens for service principals](https://docs.databricks.com/dev-tools/authentication-oauth.html).\n\nIn addition, the generated secrets can be used to configure the Databricks Terraform Providerto authenticate with the service principal. For more information, see [Databricks Terraform Provider](https://github.com/databricks/terraform-provider-databricks/blob/master/docs/index.md#authenticating-with-service-principal).",
+        "package": {
+          "name": "oauth2"
+        },
+        "docs_group": "oauth2",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListServicePrincipalSecretsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Create a secret for the given service principal.",
+            "summary": "Create service principal secret.",
+            "path": "/api/2.0/accounts/servicePrincipals/{service_principal_id}/credentials/secrets",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateServicePrincipalSecretRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "service_principal_id",
+                  "description": "The service principal ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "service_principal_id",
+                  "description": "The service principal ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CreateServicePrincipalSecretResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "lifetime",
+                "description": "The lifetime of the secret in seconds. If this parameter is not provided, the secret will have a default lifetime of 730 days (63072000s).",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "scopes",
+                "description": "OAuth API scopes to bind to the secret; a minted token cannot exceed them.\nEmpty = unrestricted (all-apis). E.g. all-apis, sql, iam.groups:read.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "service_principal_id",
+                "description": "The service principal ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "service_principal_id",
+                "description": "The service principal ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Delete a secret from the given service principal.",
+            "summary": "Delete service principal secret.",
+            "path": "/api/2.0/accounts/servicePrincipals/{service_principal_id}/credentials/secrets/{secret_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteServicePrincipalSecretRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "service_principal_id",
+                  "description": "The service principal ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "secret_id",
+                  "description": "The secret ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "service_principal_id",
+                  "description": "The service principal ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "secret_id",
+                  "description": "The secret ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "secret_id",
+                "description": "The secret ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "service_principal_id",
+                "description": "The service principal ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "service_principal_id",
+                "description": "The service principal ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "secret_id",
+                "description": "The secret ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "List all secrets associated with the given service principal. This operation only returns information about the secrets themselves and does not include the secret values.",
+            "summary": "List service principal secrets.",
+            "path": "/api/2.0/accounts/servicePrincipals/{service_principal_id}/credentials/secrets",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListServicePrincipalSecretsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "service_principal_id",
+                  "description": "The service principal ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "service_principal_id",
+                  "description": "The service principal ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListServicePrincipalSecretsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "An opaque page token which was the `next_page_token` in the response of the previous request to list the secrets for this service principal. Provide this token to retrieve the next page of secret entries.\nWhen providing a `page_token`, all other parameters provided to the request must match the previous request.\nTo list all of the secrets for a service principal, it is necessary to continue requesting pages of entries until the response contains no `next_page_token`. Note that the number of entries returned must not be used to determine when the listing is complete.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "service_principal_id",
+                "description": "The service principal ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "service_principal_id",
+                "description": "The service principal ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "An opaque page token which was the `next_page_token` in the response of the previous request to list the secrets for this service principal. Provide this token to retrieve the next page of secret entries.\nWhen providing a `page_token`, all other parameters provided to the request must match the previous request.\nTo list all of the secrets for a service principal, it is necessary to continue requesting pages of entries until the response contains no `next_page_token`. Note that the number of entries returned must not be used to determine when the listing is complete.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          }
+        ]
+      },
+      {
+        "id": "iam.ServicePrincipalsV2",
+        "name": "ServicePrincipalsV2",
+        "description": "Identities for use with jobs, automated tools, and systems such as scripts, apps, and\nCI/CD platforms. Databricks recommends creating service principals to run production jobs\nor modify production data. If all processes that act on production data run with service\nprincipals, interactive users do not need any write, delete, or modify privileges in\nproduction. This eliminates the risk of a user overwriting production data by accident.",
+        "package": {
+          "name": "iam"
+        },
+        "docs_group": "iam",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "list": {
+          "request": {
+            "pascal_name": "ListServicePrincipalsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a new service principal in the Databricks workspace.",
+            "summary": "Create a service principal.",
+            "path": "/api/2.0/preview/scim/v2/ServicePrincipals",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "CreateServicePrincipalRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ServicePrincipal",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "active",
+                "description": "If this user is active",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "applicationId",
+                "description": "UUID relating to the service principal",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "displayName",
+                "description": "String that represents a concatenation of given and family names.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "entitlements",
+                "description": "Entitlements assigned to the service principal. See [assigning entitlements](https://docs.databricks.com/administration-guide/users-groups/index.html#assigning-entitlements) for a full list of supported values.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ComplexValueList",
+                  "array_value": {
+                    "pascal_name": "ComplexValue",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "externalId",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "groups",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ComplexValueList",
+                  "array_value": {
+                    "pascal_name": "ComplexValue",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "id",
+                "description": "Databricks service principal ID.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "roles",
+                "description": "Corresponds to AWS instance profile/arn role.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ComplexValueList",
+                  "array_value": {
+                    "pascal_name": "ComplexValue",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "schemas",
+                "description": "The schema of the List response.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ServicePrincipalSchemaList",
+                  "array_value": {
+                    "pascal_name": "ServicePrincipalSchema",
+                    "enum": [
+                      {
+                        "content": "urn:ietf:params:scim:schemas:core:2.0:ServicePrincipal"
+                      }
+                    ]
+                  }
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Delete a single service principal in the Databricks workspace.",
+            "summary": "Delete a service principal.",
+            "path": "/api/2.0/preview/scim/v2/ServicePrincipals/{id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "DeleteServicePrincipalRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID for a service principal in the Databricks workspace.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID for a service principal in the Databricks workspace.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "description": "Unique ID for a service principal in the Databricks workspace.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Unique ID for a service principal in the Databricks workspace.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets the details for a single service principal define in the Databricks workspace.",
+            "summary": "Get service principal details.",
+            "path": "/api/2.0/preview/scim/v2/ServicePrincipals/{id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetServicePrincipalRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID for a service principal in the Databricks workspace.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID for a service principal in the Databricks workspace.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ServicePrincipal",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "description": "Unique ID for a service principal in the Databricks workspace.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Unique ID for a service principal in the Databricks workspace.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Gets the set of service principals associated with a Databricks workspace.",
+            "summary": "List service principals.",
+            "path": "/api/2.0/preview/scim/v2/ServicePrincipals",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "ListServicePrincipalsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListServicePrincipalResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "attributes",
+                "description": "Comma-separated list of attributes to return in response.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "count",
+                "description": "Desired number of results per page.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "excludedAttributes",
+                "description": "Comma-separated list of attributes to exclude in response.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "filter",
+                "description": "Query by which the results have to be filtered. Supported operators are equals(`eq`), contains(`co`), starts with(`sw`) and not equals(`ne`). Additionally, simple expressions can be formed using logical operators - `and` and `or`. The [SCIM RFC](https://tools.ietf.org/html/rfc7644#section-3.4.2.2) has more details but we currently only support simple expressions.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "sortBy",
+                "description": "Attribute to sort the results.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "sortOrder",
+                "description": "The order to sort the results.",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "ListSortOrder",
+                  "enum": [
+                    {
+                      "content": "ascending"
+                    },
+                    {
+                      "content": "descending"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "startIndex",
+                "description": "Specifies the index of the first result. First item is number 1.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "pagination": {
+              "offset": {
+                "name": "startIndex",
+                "description": "Specifies the index of the first result. First item is number 1.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              "limit": {
+                "name": "count",
+                "description": "Desired number of results per page.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            }
+          },
+          {
+            "name": "Patch",
+            "description": "Partially updates the details of a single service principal in the Databricks workspace.",
+            "summary": "Update service principal details.",
+            "path": "/api/2.0/preview/scim/v2/ServicePrincipals/{id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "PatchServicePrincipalRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID in the Databricks workspace.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID in the Databricks workspace.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "description": "Unique ID in the Databricks workspace.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "Operations",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PatchList",
+                  "array_value": {
+                    "pascal_name": "Patch",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "schemas",
+                "description": "The schema of the patch request. Must be [\"urn:ietf:params:scim:api:messages:2.0:PatchOp\"].",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PatchSchemaList",
+                  "array_value": {
+                    "pascal_name": "PatchSchema",
+                    "enum": [
+                      {
+                        "content": "urn:ietf:params:scim:api:messages:2.0:PatchOp"
+                      }
+                    ]
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Unique ID in the Databricks workspace.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Updates the details of a single service principal.\n\nThis action replaces the existing service principal with the same name.",
+            "summary": "Replace service principal.",
+            "path": "/api/2.0/preview/scim/v2/ServicePrincipals/{id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "UpdateServicePrincipalRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Databricks service principal ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "Databricks service principal ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "active",
+                "description": "If this user is active",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "applicationId",
+                "description": "UUID relating to the service principal",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "displayName",
+                "description": "String that represents a concatenation of given and family names.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "entitlements",
+                "description": "Entitlements assigned to the service principal. See [assigning entitlements](https://docs.databricks.com/administration-guide/users-groups/index.html#assigning-entitlements) for a full list of supported values.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ComplexValueList",
+                  "array_value": {
+                    "pascal_name": "ComplexValue",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "externalId",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "groups",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ComplexValueList",
+                  "array_value": {
+                    "pascal_name": "ComplexValue",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "id",
+                "description": "Databricks service principal ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "roles",
+                "description": "Corresponds to AWS instance profile/arn role.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ComplexValueList",
+                  "array_value": {
+                    "pascal_name": "ComplexValue",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "schemas",
+                "description": "The schema of the List response.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ServicePrincipalSchemaList",
+                  "array_value": {
+                    "pascal_name": "ServicePrincipalSchema",
+                    "enum": [
+                      {
+                        "content": "urn:ietf:params:scim:schemas:core:2.0:ServicePrincipal"
+                      }
+                    ]
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Databricks service principal ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "iam.AccountServicePrincipalsV2",
+        "name": "AccountServicePrincipalsV2",
+        "description": "Identities for use with jobs, automated tools, and systems such as scripts, apps, and\nCI/CD platforms. Databricks recommends creating service principals to run production jobs\nor modify production data. If all processes that act on production data run with service\nprincipals, interactive users do not need any write, delete, or modify privileges in\nproduction. This eliminates the risk of a user overwriting production data by accident.",
+        "package": {
+          "name": "iam"
+        },
+        "is_accounts": true,
+        "docs_group": "iam",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListAccountServicePrincipalsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a new service principal in the Databricks account.",
+            "summary": "Create a service principal.",
+            "path": "/api/2.0/accounts/{account_id}/scim/v2/ServicePrincipals",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateAccountServicePrincipalRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "AccountServicePrincipal",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "active",
+                "description": "If this user is active",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "applicationId",
+                "description": "UUID relating to the service principal",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "displayName",
+                "description": "String that represents a concatenation of given and family names.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "externalId",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "id",
+                "description": "Databricks service principal ID.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "roles",
+                "description": "Indicates if the group has the admin role.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ComplexValueList",
+                  "array_value": {
+                    "pascal_name": "ComplexValue",
+                    "is_object": true
+                  }
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Delete a single service principal in the Databricks account.",
+            "summary": "Delete a service principal.",
+            "path": "/api/2.0/accounts/{account_id}/scim/v2/ServicePrincipals/{id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteAccountServicePrincipalRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID for a service principal in the Databricks account.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID for a service principal in the Databricks account.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "description": "Unique ID for a service principal in the Databricks account.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Unique ID for a service principal in the Databricks account.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets the details for a single service principal define in the Databricks account.",
+            "summary": "Get service principal details.",
+            "path": "/api/2.0/accounts/{account_id}/scim/v2/ServicePrincipals/{id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetAccountServicePrincipalRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID for a service principal in the Databricks account.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID for a service principal in the Databricks account.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "AccountServicePrincipal",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "description": "Unique ID for a service principal in the Databricks account.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Unique ID for a service principal in the Databricks account.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Gets the set of service principals associated with a Databricks account.",
+            "summary": "List service principals.",
+            "path": "/api/2.0/accounts/{account_id}/scim/v2/ServicePrincipals",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListAccountServicePrincipalsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListAccountServicePrincipalsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "attributes",
+                "description": "Comma-separated list of attributes to return in response.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "count",
+                "description": "Desired number of results per page. Default is 10000.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "excludedAttributes",
+                "description": "Comma-separated list of attributes to exclude in response.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "filter",
+                "description": "Query by which the results have to be filtered. Supported operators are equals(`eq`), contains(`co`), starts with(`sw`) and not equals(`ne`). Additionally, simple expressions can be formed using logical operators - `and` and `or`. The [SCIM RFC](https://tools.ietf.org/html/rfc7644#section-3.4.2.2) has more details but we currently only support simple expressions.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "sortBy",
+                "description": "Attribute to sort the results.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "sortOrder",
+                "description": "The order to sort the results.",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "ListSortOrder",
+                  "enum": [
+                    {
+                      "content": "ascending"
+                    },
+                    {
+                      "content": "descending"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "startIndex",
+                "description": "Specifies the index of the first result. First item is number 1.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "pagination": {
+              "offset": {
+                "name": "startIndex",
+                "description": "Specifies the index of the first result. First item is number 1.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              "limit": {
+                "name": "count",
+                "description": "Desired number of results per page. Default is 10000.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            }
+          },
+          {
+            "name": "Patch",
+            "description": "Partially updates the details of a single service principal in the Databricks account.",
+            "summary": "Update service principal details.",
+            "path": "/api/2.0/accounts/{account_id}/scim/v2/ServicePrincipals/{id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "PatchAccountServicePrincipalRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID in the Databricks workspace.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID in the Databricks workspace.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "description": "Unique ID in the Databricks workspace.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "Operations",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PatchList",
+                  "array_value": {
+                    "pascal_name": "Patch",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "schemas",
+                "description": "The schema of the patch request. Must be [\"urn:ietf:params:scim:api:messages:2.0:PatchOp\"].",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PatchSchemaList",
+                  "array_value": {
+                    "pascal_name": "PatchSchema",
+                    "enum": [
+                      {
+                        "content": "urn:ietf:params:scim:api:messages:2.0:PatchOp"
+                      }
+                    ]
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Unique ID in the Databricks workspace.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Updates the details of a single service principal.\n\nThis action replaces the existing service principal with the same name.",
+            "summary": "Replace service principal.",
+            "path": "/api/2.0/accounts/{account_id}/scim/v2/ServicePrincipals/{id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateAccountServicePrincipalRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Databricks service principal ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "Databricks service principal ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "active",
+                "description": "If this user is active",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "applicationId",
+                "description": "UUID relating to the service principal",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "displayName",
+                "description": "String that represents a concatenation of given and family names.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "externalId",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "id",
+                "description": "Databricks service principal ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "roles",
+                "description": "Indicates if the group has the admin role.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ComplexValueList",
+                  "array_value": {
+                    "pascal_name": "ComplexValue",
+                    "is_object": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Databricks service principal ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "serving.ServingEndpoints",
+        "name": "ServingEndpoints",
+        "description": "The Serving Endpoints API allows you to create, update, and delete model serving endpoints.\n\nYou can use a serving endpoint to serve models from the Databricks Model Registry or from Unity Catalog.\nEndpoints expose the underlying models as scalable REST API endpoints using serverless compute. This means\nthe endpoints and associated compute resources are fully managed by Databricks and will not appear in\nyour cloud account. A serving endpoint can consist of one or more MLflow models from the Databricks\nModel Registry, called served entities. A serving endpoint can have at most ten served entities. You can configure\ntraffic settings to define how requests should be routed to your served entities behind an endpoint.\nAdditionally, you can configure the scale of resources that should be applied to each served entity.",
+        "package": {
+          "name": "serving"
+        },
+        "docs_group": "serving",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "is_legacy_empty_request": true,
+          "request": {
+            "pascal_name": "ListServingEndpointsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "BuildLogs",
+            "description": "Retrieves the build logs associated with the provided served model.",
+            "summary": "Get build logs for a served model.",
+            "path": "/api/2.0/serving-endpoints/{name}/served-models/{served_model_name}/build-logs",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "BuildLogsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the serving endpoint that the served model belongs to. This field is required.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "served_model_name",
+                  "description": "The name of the served model that build logs will be retrieved for. This field is required.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the serving endpoint that the served model belongs to. This field is required.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "served_model_name",
+                  "description": "The name of the served model that build logs will be retrieved for. This field is required.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "BuildLogsResponse",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "logs",
+                  "description": "The logs associated with building the served entity's environment.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "logs",
+                  "description": "The logs associated with building the served entity's environment.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The name of the serving endpoint that the served model belongs to. This field is required.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "served_model_name",
+                "description": "The name of the served model that build logs will be retrieved for. This field is required.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the serving endpoint that the served model belongs to. This field is required.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "served_model_name",
+                "description": "The name of the served model that build logs will be retrieved for. This field is required.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Create",
+            "description": "Create a new serving endpoint.",
+            "summary": "Create a new serving endpoint.",
+            "path": "/api/2.0/serving-endpoints",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateServingEndpoint",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the serving endpoint. This field is required and must be unique across a Databricks workspace.\nAn endpoint name can consist of alphanumeric characters, dashes, and underscores.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the serving endpoint. This field is required and must be unique across a Databricks workspace.\nAn endpoint name can consist of alphanumeric characters, dashes, and underscores.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ServingEndpointDetailed",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "ai_gateway",
+                "description": "The AI Gateway configuration for the serving endpoint. NOTE: External model, provisioned throughput, and pay-per-token endpoints are fully supported; agent endpoints currently only support inference tables.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AiGatewayConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "budget_policy_id",
+                "description": "The budget policy to be applied to the serving endpoint.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "config",
+                "description": "The core config of the serving endpoint.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "EndpointCoreConfigInput",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "description",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "email_notifications",
+                "description": "Email notification settings.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "EmailNotifications",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the serving endpoint. This field is required and must be unique across a Databricks workspace.\nAn endpoint name can consist of alphanumeric characters, dashes, and underscores.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "rate_limits",
+                "description": "Rate limits to be applied to the serving endpoint. NOTE: this field is deprecated, please use AI Gateway to manage rate limits.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "RateLimitList",
+                  "array_value": {
+                    "pascal_name": "RateLimit",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "route_optimized",
+                "description": "Enable route optimization for the serving endpoint.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "tags",
+                "description": "Tags to be attached to the serving endpoint and automatically propagated to billing logs.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EndpointTagList",
+                  "array_value": {
+                    "pascal_name": "EndpointTag",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "telemetry_config",
+                "description": "Configuration for persisting endpoint telemetry (logs, traces, and metrics) to Unity Catalog tables.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "TelemetryConfig",
+                  "is_object": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the serving endpoint. This field is required and must be unique across a Databricks workspace.\nAn endpoint name can consist of alphanumeric characters, dashes, and underscores.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "wait": {
+              "success": [
+                {
+                  "content": "NOT_UPDATING"
+                }
+              ],
+              "timeout": 20,
+              "poll": {
+                "response": {
+                  "pascal_name": "ServingEndpointDetailed"
+                }
+              },
+              "status_path": [
+                {
+                  "pascal_name": "State"
+                },
+                {
+                  "pascal_name": "ConfigUpdate"
+                }
+              ]
+            }
+          },
+          {
+            "name": "CreateProvisionedThroughputEndpoint",
+            "description": "Create a new PT serving endpoint.",
+            "summary": "Create a new PT serving endpoint.",
+            "path": "/api/2.0/serving-endpoints/pt",
+            "can_use_json": true,
+            "must_use_json": true,
+            "is_crud_create": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "CreatePtEndpointRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the serving endpoint. This field is required and must be unique across a Databricks workspace.\nAn endpoint name can consist of alphanumeric characters, dashes, and underscores.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "config",
+                  "description": "The core config of the serving endpoint.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PtEndpointCoreConfig",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the serving endpoint. This field is required and must be unique across a Databricks workspace.\nAn endpoint name can consist of alphanumeric characters, dashes, and underscores.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "config",
+                  "description": "The core config of the serving endpoint.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PtEndpointCoreConfig",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ServingEndpointDetailed",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "ai_gateway",
+                "description": "The AI Gateway configuration for the serving endpoint.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AiGatewayConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "budget_policy_id",
+                "description": "The budget policy associated with the endpoint.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "config",
+                "description": "The core config of the serving endpoint.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PtEndpointCoreConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "email_notifications",
+                "description": "Email notification settings.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "EmailNotifications",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the serving endpoint. This field is required and must be unique across a Databricks workspace.\nAn endpoint name can consist of alphanumeric characters, dashes, and underscores.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tags",
+                "description": "Tags to be attached to the serving endpoint and automatically propagated to billing logs.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EndpointTagList",
+                  "array_value": {
+                    "pascal_name": "EndpointTag",
+                    "is_object": true
+                  }
+                }
+              }
+            ],
+            "wait": {
+              "success": [
+                {
+                  "content": "NOT_UPDATING"
+                }
+              ],
+              "timeout": 20,
+              "poll": {
+                "response": {
+                  "pascal_name": "ServingEndpointDetailed"
+                }
+              },
+              "status_path": [
+                {
+                  "pascal_name": "State"
+                },
+                {
+                  "pascal_name": "ConfigUpdate"
+                }
+              ]
+            }
+          },
+          {
+            "name": "Delete",
+            "description": "Delete a serving endpoint.",
+            "summary": "Delete a serving endpoint.",
+            "path": "/api/2.0/serving-endpoints/{name}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteServingEndpointRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ExportMetrics",
+            "description": "Retrieves the metrics associated with the provided serving endpoint in either Prometheus or OpenMetrics exposition format.",
+            "summary": "Get metrics of a serving endpoint.",
+            "path": "/api/2.0/serving-endpoints/{name}/metrics",
+            "is_crud_read": true,
+            "is_response_byte_stream": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ExportMetricsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the serving endpoint to retrieve metrics for. This field is required.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the serving endpoint to retrieve metrics for. This field is required.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ExportMetricsResponse",
+              "is_object": true
+            },
+            "response_body_field": {
+              "pascal_name": "Contents"
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The name of the serving endpoint to retrieve metrics for. This field is required.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the serving endpoint to retrieve metrics for. This field is required.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Retrieves the details for a single serving endpoint.",
+            "summary": "Get a single serving endpoint.",
+            "path": "/api/2.0/serving-endpoints/{name}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetServingEndpointRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the serving endpoint. This field is required.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the serving endpoint. This field is required.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ServingEndpointDetailed",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The name of the serving endpoint. This field is required.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the serving endpoint. This field is required.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetOpenApi",
+            "description": "Get the query schema of the serving endpoint in OpenAPI format. The schema contains information for the supported paths, input and output format and datatypes.",
+            "summary": "Get the schema for a serving endpoint.",
+            "path": "/api/2.0/serving-endpoints/{name}/openapi",
+            "is_crud_read": true,
+            "is_response_byte_stream": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetOpenApiRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the serving endpoint that the served model belongs to. This field is required.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the serving endpoint that the served model belongs to. This field is required.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetOpenApiResponse",
+              "is_object": true
+            },
+            "response_body_field": {
+              "pascal_name": "Contents"
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The name of the serving endpoint that the served model belongs to. This field is required.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the serving endpoint that the served model belongs to. This field is required.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetPermissionLevels",
+            "description": "Gets the permission levels that a user can have on an object.",
+            "summary": "Get serving endpoint permission levels.",
+            "path": "/api/2.0/permissions/serving-endpoints/{serving_endpoint_id}/permissionLevels",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetServingEndpointPermissionLevelsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "serving_endpoint_id",
+                  "description": "The serving endpoint for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "serving_endpoint_id",
+                  "description": "The serving endpoint for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetServingEndpointPermissionLevelsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "serving_endpoint_id",
+                "description": "The serving endpoint for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "serving_endpoint_id",
+                "description": "The serving endpoint for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetPermissions",
+            "description": "Gets the permissions of a serving endpoint. Serving endpoints can inherit permissions from their root object.",
+            "summary": "Get serving endpoint permissions.",
+            "path": "/api/2.0/permissions/serving-endpoints/{serving_endpoint_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetServingEndpointPermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "serving_endpoint_id",
+                  "description": "The serving endpoint for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "serving_endpoint_id",
+                  "description": "The serving endpoint for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ServingEndpointPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "serving_endpoint_id",
+                "description": "The serving endpoint for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "serving_endpoint_id",
+                "description": "The serving endpoint for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "HttpRequest",
+            "description": "Make external services call using the credentials stored in UC Connection.",
+            "summary": "Make external services call using the credentials stored in UC Connection.",
+            "path": "/api/2.0/external-function",
+            "can_use_json": true,
+            "is_hidden_cli": true,
+            "is_response_byte_stream": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "ExternalFunctionRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "connection_name",
+                  "description": "The connection name to use. This is required to identify the external connection.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "method",
+                  "description": "The HTTP method to use (e.g., 'GET', 'POST').",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ExternalFunctionRequestHttpMethod",
+                    "enum": [
+                      {
+                        "content": "DELETE"
+                      },
+                      {
+                        "content": "GET"
+                      },
+                      {
+                        "content": "PATCH"
+                      },
+                      {
+                        "content": "POST"
+                      },
+                      {
+                        "content": "PUT"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "path",
+                  "description": "The relative path for the API endpoint. This is required.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "connection_name",
+                  "description": "The connection name to use. This is required to identify the external connection.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "method",
+                  "description": "The HTTP method to use (e.g., 'GET', 'POST').",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ExternalFunctionRequestHttpMethod",
+                    "enum": [
+                      {
+                        "content": "DELETE"
+                      },
+                      {
+                        "content": "GET"
+                      },
+                      {
+                        "content": "PATCH"
+                      },
+                      {
+                        "content": "POST"
+                      },
+                      {
+                        "content": "PUT"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "path",
+                  "description": "The relative path for the API endpoint. This is required.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "HttpRequestResponse",
+              "is_object": true
+            },
+            "response_body_field": {
+              "pascal_name": "Contents"
+            },
+            "all_fields": [
+              {
+                "name": "connection_name",
+                "description": "The connection name to use. This is required to identify the external connection.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "headers",
+                "description": "Additional headers for the request. If not provided, only auth headers from connections would be passed.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "json",
+                "description": "The JSON payload to send in the request body.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "method",
+                "description": "The HTTP method to use (e.g., 'GET', 'POST').",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ExternalFunctionRequestHttpMethod",
+                  "enum": [
+                    {
+                      "content": "DELETE"
+                    },
+                    {
+                      "content": "GET"
+                    },
+                    {
+                      "content": "PATCH"
+                    },
+                    {
+                      "content": "POST"
+                    },
+                    {
+                      "content": "PUT"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "params",
+                "description": "Query parameters for the request.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "path",
+                "description": "The relative path for the API endpoint. This is required.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "sub_domain",
+                "description": "Optional subdomain to prepend to the connection URL's host. If provided, this will be\nadded as a prefix to the connection URL's host. For example, if the connection URL is\n`https://api.example.com/v1` and `sub_domain` is `\"custom\"`, the resulting URL will be\n`https://custom.api.example.com/v1`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "connection_name",
+                "description": "The connection name to use. This is required to identify the external connection.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "method",
+                "description": "The HTTP method to use (e.g., 'GET', 'POST').",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ExternalFunctionRequestHttpMethod",
+                  "enum": [
+                    {
+                      "content": "DELETE"
+                    },
+                    {
+                      "content": "GET"
+                    },
+                    {
+                      "content": "PATCH"
+                    },
+                    {
+                      "content": "POST"
+                    },
+                    {
+                      "content": "PUT"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "path",
+                "description": "The relative path for the API endpoint. This is required.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Get all serving endpoints.",
+            "summary": "Get all serving endpoints.",
+            "path": "/api/2.0/serving-endpoints",
+            "is_legacy_empty_request": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListServingEndpointsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListEndpointsResponse",
+              "is_object": true
+            },
+            "pagination": {}
+          },
+          {
+            "name": "Logs",
+            "description": "Retrieves the service logs associated with the provided served model.",
+            "summary": "Get the latest logs for a served model.",
+            "path": "/api/2.0/serving-endpoints/{name}/served-models/{served_model_name}/logs",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "LogsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the serving endpoint that the served model belongs to. This field is required.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "served_model_name",
+                  "description": "The name of the served model that logs will be retrieved for. This field is required.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the serving endpoint that the served model belongs to. This field is required.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "served_model_name",
+                  "description": "The name of the served model that logs will be retrieved for. This field is required.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ServerLogsResponse",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "logs",
+                  "description": "The most recent log lines of the model server processing invocation requests.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "logs",
+                  "description": "The most recent log lines of the model server processing invocation requests.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The name of the serving endpoint that the served model belongs to. This field is required.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "served_model_name",
+                "description": "The name of the served model that logs will be retrieved for. This field is required.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the serving endpoint that the served model belongs to. This field is required.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "served_model_name",
+                "description": "The name of the served model that logs will be retrieved for. This field is required.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Patch",
+            "description": "Used to batch add and delete tags from a serving endpoint with a single API call.",
+            "summary": "Update tags of a serving endpoint.",
+            "path": "/api/2.0/serving-endpoints/{name}/tags",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "PatchServingEndpointTags",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the serving endpoint who's tags to patch. This field is required.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the serving endpoint who's tags to patch. This field is required.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "EndpointTags",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "add_tags",
+                "description": "List of endpoint tags to add",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EndpointTagList",
+                  "array_value": {
+                    "pascal_name": "EndpointTag",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "delete_tags",
+                "description": "List of tag keys to delete",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the serving endpoint who's tags to patch. This field is required.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the serving endpoint who's tags to patch. This field is required.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "PatchTelemetryConfig",
+            "description": "Updates the telemetry configuration of a serving endpoint.",
+            "summary": "Update the telemetry config of a serving endpoint.",
+            "path": "/api/2.0/serving-endpoints/{name}/telemetry-config",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "PatchTelemetryConfigRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the serving endpoint whose telemetry configuration is being updated. This field is required.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the serving endpoint whose telemetry configuration is being updated. This field is required.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ServingEndpointDetailed",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The name of the serving endpoint whose telemetry configuration is being updated. This field is required.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "telemetry_config",
+                "description": "The telemetry configuration to be applied to the serving endpoint.\nCan specify either a telemetry_profile_id to use an existing profile,\nor table_names to create a new profile with the specified Unity Catalog tables.\nIf not provided, the telemetry configuration will be removed from the endpoint.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "TelemetryConfig",
+                  "is_object": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the serving endpoint whose telemetry configuration is being updated. This field is required.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Put",
+            "description": "Deprecated: Please use AI Gateway to manage rate limits instead.",
+            "summary": "Update rate limits of a serving endpoint.",
+            "path": "/api/2.0/serving-endpoints/{name}/rate-limits",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "PutRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the serving endpoint whose rate limits are being updated. This field is required.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the serving endpoint whose rate limits are being updated. This field is required.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "PutResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The name of the serving endpoint whose rate limits are being updated. This field is required.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "rate_limits",
+                "description": "The list of endpoint rate limits.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "RateLimitList",
+                  "array_value": {
+                    "pascal_name": "RateLimit",
+                    "is_object": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the serving endpoint whose rate limits are being updated. This field is required.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "PutAiGateway",
+            "description": "Used to update the AI Gateway of a serving endpoint. NOTE: External model, provisioned throughput, and pay-per-token endpoints are fully supported; agent endpoints currently only support inference tables.",
+            "summary": "Update AI Gateway of a serving endpoint.",
+            "path": "/api/2.0/serving-endpoints/{name}/ai-gateway",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "PutAiGatewayRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the serving endpoint whose AI Gateway is being updated. This field is required.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the serving endpoint whose AI Gateway is being updated. This field is required.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "PutAiGatewayResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "fallback_config",
+                "description": "Configuration for traffic fallback which auto fallbacks to other served entities if the request to a served\nentity fails with certain error codes, to increase availability.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "FallbackConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "guardrails",
+                "description": "Configuration for AI Guardrails to prevent unwanted data and unsafe data in requests and responses.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AiGatewayGuardrails",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "inference_table_config",
+                "description": "Configuration for payload logging using inference tables.\nUse these tables to monitor and audit data being sent to and received from model APIs and to improve model quality.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AiGatewayInferenceTableConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the serving endpoint whose AI Gateway is being updated. This field is required.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "rate_limits",
+                "description": "Configuration for rate limits which can be set to limit endpoint traffic.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "AiGatewayRateLimitList",
+                  "array_value": {
+                    "pascal_name": "AiGatewayRateLimit",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "usage_tracking_config",
+                "description": "Configuration to enable usage tracking using system tables.\nThese tables allow you to monitor operational usage on endpoints and their associated costs.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AiGatewayUsageTrackingConfig",
+                  "is_object": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the serving endpoint whose AI Gateway is being updated. This field is required.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Query",
+            "description": "Query a serving endpoint",
+            "summary": "Query a serving endpoint.",
+            "path": "/serving-endpoints/{name}/invocations",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "QueryEndpointInput",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the serving endpoint. This field is required and is provided via the path parameter.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the serving endpoint. This field is required and is provided via the path parameter.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "QueryEndpointResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "client_request_id",
+                "description": "Optional user-provided request identifier that will be recorded in the inference table and the usage tracking table.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "dataframe_records",
+                "description": "Pandas Dataframe input in the records orientation.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_any": true
+                  }
+                }
+              },
+              {
+                "name": "dataframe_split",
+                "description": "Pandas Dataframe input in the split orientation.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "DataframeSplitInput",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "extra_params",
+                "description": "The extra parameters field used ONLY for __completions, chat,__ and __embeddings external \u0026 foundation\nmodel__ serving endpoints. This is a map of strings and should only be used with other external/foundation\nmodel query fields.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "input",
+                "description": "The input string (or array of strings) field used ONLY for __embeddings external \u0026 foundation model__\nserving endpoints and is the only field (along with extra_params if needed) used by embeddings queries.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_any": true
+                }
+              },
+              {
+                "name": "inputs",
+                "description": "Tensor-based input in columnar format.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_any": true
+                }
+              },
+              {
+                "name": "instances",
+                "description": "Tensor-based input in row format.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_any": true
+                  }
+                }
+              },
+              {
+                "name": "max_tokens",
+                "description": "The max tokens field used ONLY for __completions__ and __chat external \u0026 foundation model__ serving\nendpoints. This is an integer and should only be used with other chat/completions query fields.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "messages",
+                "description": "The messages field used ONLY for __chat external \u0026 foundation model__ serving endpoints.\nThis is an array of ChatMessage objects and should only be used with other chat query fields.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ChatMessageList",
+                  "array_value": {
+                    "pascal_name": "ChatMessage",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "n",
+                "description": "The n (number of candidates) field used ONLY for __completions__ and __chat external \u0026 foundation model__\nserving endpoints. This is an integer between 1 and 5 with a default of 1 and should only be used with\nother chat/completions query fields.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the serving endpoint. This field is required and is provided via the path parameter.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "prompt",
+                "description": "The prompt string (or array of strings) field used ONLY for __completions external \u0026 foundation model__\nserving endpoints and should only be used with other completions query fields.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_any": true
+                }
+              },
+              {
+                "name": "stop",
+                "description": "The stop sequences field used ONLY for __completions__ and __chat external \u0026 foundation model__ serving\nendpoints. This is a list of strings and should only be used with other chat/completions query fields.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "stream",
+                "description": "The stream field used ONLY for __completions__ and __chat external \u0026 foundation model__ serving endpoints.\nThis is a boolean defaulting to false and should only be used with other chat/completions query fields.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "temperature",
+                "description": "The temperature field used ONLY for __completions__ and __chat external \u0026 foundation model__ serving\nendpoints. This is a float between 0.0 and 2.0 with a default of 1.0 and should only be used with other\nchat/completions query fields.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_float64": true
+                }
+              },
+              {
+                "name": "usage_context",
+                "description": "Optional user-provided context that will be recorded in the usage tracking table.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the serving endpoint. This field is required and is provided via the path parameter.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "SetPermissions",
+            "description": "Sets permissions on an object, replacing existing permissions if they exist. Deletes all direct permissions if none are specified. Objects can inherit permissions from their root object.",
+            "summary": "Set serving endpoint permissions.",
+            "path": "/api/2.0/permissions/serving-endpoints/{serving_endpoint_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ServingEndpointPermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "serving_endpoint_id",
+                  "description": "The serving endpoint for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "serving_endpoint_id",
+                  "description": "The serving endpoint for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ServingEndpointPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "access_control_list",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ServingEndpointAccessControlRequestList",
+                  "array_value": {
+                    "pascal_name": "ServingEndpointAccessControlRequest",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "serving_endpoint_id",
+                "description": "The serving endpoint for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "serving_endpoint_id",
+                "description": "The serving endpoint for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateConfig",
+            "description": "Updates any combination of the serving endpoint's served entities, the compute configuration of those served entities, and the endpoint's traffic config. An endpoint that already has an update in progress can not be updated until the current update completes or fails.",
+            "summary": "Update config of a serving endpoint.",
+            "path": "/api/2.0/serving-endpoints/{name}/config",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "EndpointCoreConfigInput",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the serving endpoint to update. This field is required.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the serving endpoint to update. This field is required.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ServingEndpointDetailed",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "auto_capture_config",
+                "description": "Configuration for legacy Inference Tables which automatically log requests and responses to Unity\nCatalog.\nDeprecated: please use AI Gateway inference tables instead. See\nhttps://docs.databricks.com/aws/en/ai-gateway/inference-tables.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AutoCaptureConfigInput",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the serving endpoint to update. This field is required.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "served_entities",
+                "description": "The list of served entities under the serving endpoint config.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ServedEntityInputList",
+                  "array_value": {
+                    "pascal_name": "ServedEntityInput",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "served_models",
+                "description": "(Deprecated, use served_entities instead) The list of served models under the serving endpoint config.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ServedModelInputList",
+                  "array_value": {
+                    "pascal_name": "ServedModelInput",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "traffic_config",
+                "description": "The traffic configuration associated with the serving endpoint config.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "TrafficConfig",
+                  "is_object": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the serving endpoint to update. This field is required.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "wait": {
+              "success": [
+                {
+                  "content": "NOT_UPDATING"
+                }
+              ],
+              "timeout": 20,
+              "poll": {
+                "response": {
+                  "pascal_name": "ServingEndpointDetailed"
+                }
+              },
+              "status_path": [
+                {
+                  "pascal_name": "State"
+                },
+                {
+                  "pascal_name": "ConfigUpdate"
+                }
+              ]
+            }
+          },
+          {
+            "name": "UpdateNotifications",
+            "description": "Updates the email and webhook notification settings for an endpoint.",
+            "summary": "Update the email and webhook notification settings for an endpoint.",
+            "path": "/api/2.0/serving-endpoints/{name}/notifications",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateInferenceEndpointNotifications",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the serving endpoint whose notifications are being updated. This field is required.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the serving endpoint whose notifications are being updated. This field is required.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "UpdateInferenceEndpointNotificationsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "email_notifications",
+                "description": "The email notification settings to update. Specify email addresses to notify when endpoint state changes occur.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "EmailNotifications",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the serving endpoint whose notifications are being updated. This field is required.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the serving endpoint whose notifications are being updated. This field is required.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdatePermissions",
+            "description": "Updates the permissions on a serving endpoint. Serving endpoints can inherit permissions from their root object.",
+            "summary": "Update serving endpoint permissions.",
+            "path": "/api/2.0/permissions/serving-endpoints/{serving_endpoint_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ServingEndpointPermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "serving_endpoint_id",
+                  "description": "The serving endpoint for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "serving_endpoint_id",
+                  "description": "The serving endpoint for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ServingEndpointPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "access_control_list",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ServingEndpointAccessControlRequestList",
+                  "array_value": {
+                    "pascal_name": "ServingEndpointAccessControlRequest",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "serving_endpoint_id",
+                "description": "The serving endpoint for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "serving_endpoint_id",
+                "description": "The serving endpoint for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateProvisionedThroughputEndpointConfig",
+            "description": "Updates any combination of the pt endpoint's served entities, the compute configuration of those served entities, and the endpoint's traffic config. Updates are instantaneous and endpoint should be updated instantly",
+            "summary": "Update config of a PT serving endpoint.",
+            "path": "/api/2.0/serving-endpoints/pt/{name}/config",
+            "can_use_json": true,
+            "must_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "UpdateProvisionedThroughputEndpointConfigRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the pt endpoint to update. This field is required.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "config",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PtEndpointCoreConfig",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the pt endpoint to update. This field is required.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "config",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PtEndpointCoreConfig",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ServingEndpointDetailed",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "config",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PtEndpointCoreConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the pt endpoint to update. This field is required.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the pt endpoint to update. This field is required.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "wait": {
+              "success": [
+                {
+                  "content": "NOT_UPDATING"
+                }
+              ],
+              "timeout": 20,
+              "poll": {
+                "response": {
+                  "pascal_name": "ServingEndpointDetailed"
+                }
+              },
+              "status_path": [
+                {
+                  "pascal_name": "State"
+                },
+                {
+                  "pascal_name": "ConfigUpdate"
+                }
+              ]
+            }
+          }
+        ]
+      },
+      {
+        "id": "serving.ServingEndpointsDataPlane",
+        "name": "ServingEndpointsDataPlane",
+        "description": "Serving endpoints DataPlane provides a set of operations to interact with data plane endpoints for Serving endpoints service.",
+        "package": {
+          "name": "serving"
+        },
+        "is_data_plane": true,
+        "docs_group": "serving",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "methods": [
+          {
+            "name": "Query",
+            "description": "Query a serving endpoint",
+            "summary": "Query a serving endpoint.",
+            "path": "/serving-endpoints/{name}/invocations",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "QueryEndpointInput",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the serving endpoint. This field is required and is provided via the path parameter.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the serving endpoint. This field is required and is provided via the path parameter.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "QueryEndpointResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "client_request_id",
+                "description": "Optional user-provided request identifier that will be recorded in the inference table and the usage tracking table.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "dataframe_records",
+                "description": "Pandas Dataframe input in the records orientation.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_any": true
+                  }
+                }
+              },
+              {
+                "name": "dataframe_split",
+                "description": "Pandas Dataframe input in the split orientation.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "DataframeSplitInput",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "extra_params",
+                "description": "The extra parameters field used ONLY for __completions, chat,__ and __embeddings external \u0026 foundation\nmodel__ serving endpoints. This is a map of strings and should only be used with other external/foundation\nmodel query fields.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "input",
+                "description": "The input string (or array of strings) field used ONLY for __embeddings external \u0026 foundation model__\nserving endpoints and is the only field (along with extra_params if needed) used by embeddings queries.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_any": true
+                }
+              },
+              {
+                "name": "inputs",
+                "description": "Tensor-based input in columnar format.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_any": true
+                }
+              },
+              {
+                "name": "instances",
+                "description": "Tensor-based input in row format.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_any": true
+                  }
+                }
+              },
+              {
+                "name": "max_tokens",
+                "description": "The max tokens field used ONLY for __completions__ and __chat external \u0026 foundation model__ serving\nendpoints. This is an integer and should only be used with other chat/completions query fields.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "messages",
+                "description": "The messages field used ONLY for __chat external \u0026 foundation model__ serving endpoints.\nThis is an array of ChatMessage objects and should only be used with other chat query fields.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ChatMessageList",
+                  "array_value": {
+                    "pascal_name": "ChatMessage",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "n",
+                "description": "The n (number of candidates) field used ONLY for __completions__ and __chat external \u0026 foundation model__\nserving endpoints. This is an integer between 1 and 5 with a default of 1 and should only be used with\nother chat/completions query fields.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the serving endpoint. This field is required and is provided via the path parameter.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "prompt",
+                "description": "The prompt string (or array of strings) field used ONLY for __completions external \u0026 foundation model__\nserving endpoints and should only be used with other completions query fields.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_any": true
+                }
+              },
+              {
+                "name": "stop",
+                "description": "The stop sequences field used ONLY for __completions__ and __chat external \u0026 foundation model__ serving\nendpoints. This is a list of strings and should only be used with other chat/completions query fields.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "stream",
+                "description": "The stream field used ONLY for __completions__ and __chat external \u0026 foundation model__ serving endpoints.\nThis is a boolean defaulting to false and should only be used with other chat/completions query fields.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "temperature",
+                "description": "The temperature field used ONLY for __completions__ and __chat external \u0026 foundation model__ serving\nendpoints. This is a float between 0.0 and 2.0 with a default of 1.0 and should only be used with other\nchat/completions query fields.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_float64": true
+                }
+              },
+              {
+                "name": "usage_context",
+                "description": "Optional user-provided context that will be recorded in the usage tracking table.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the serving endpoint. This field is required and is provided via the path parameter.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "settings.Settings",
+        "name": "Settings",
+        "description": "Workspace Settings API allows users to manage settings at the workspace level.",
+        "package": {
+          "name": "settings"
+        },
+        "has_subservices": true,
+        "docs_group": "settings",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "subservice_ids": [
+          "settings.AibiDashboardEmbeddingAccessPolicy",
+          "settings.AibiDashboardEmbeddingApprovedDomains",
+          "settings.AutomaticClusterUpdate",
+          "settings.ComplianceSecurityProfile",
+          "settings.DashboardEmailSubscriptions",
+          "settings.DefaultNamespace",
+          "settings.DefaultWarehouseId",
+          "settings.DisableLegacyAccess",
+          "settings.DisableLegacyDbfs",
+          "settings.EnableExportNotebook",
+          "settings.EnableNotebookTableClipboard",
+          "settings.EnableResultsDownloading",
+          "settings.EnhancedSecurityMonitoring",
+          "settings.LlmProxyPartnerPoweredWorkspace",
+          "settings.RestrictWorkspaceAdmins",
+          "settings.SqlResultsDownload"
+        ]
+      },
+      {
+        "id": "settings.AccountSettings",
+        "name": "AccountSettings",
+        "description": "Accounts Settings API allows users to manage settings at the account level.",
+        "package": {
+          "name": "settings"
+        },
+        "is_accounts": true,
+        "has_subservices": true,
+        "docs_group": "settings",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "subservice_ids": [
+          "settings.CspEnablementAccount",
+          "settings.DisableLegacyFeatures",
+          "settings.EnableIpAccessLists",
+          "settings.EsmEnablementAccount",
+          "settings.LlmProxyPartnerPoweredAccount",
+          "settings.LlmProxyPartnerPoweredEnforce",
+          "settings.PersonalCompute"
+        ]
+      },
+      {
+        "id": "settingsv2.AccountSettingsV2",
+        "name": "AccountSettingsV2",
+        "description": "APIs to manage account level settings",
+        "package": {
+          "name": "settingsv2"
+        },
+        "is_accounts": true,
+        "docs_group": "settings",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListAccountSettingsMetadataRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "GetPublicAccountSetting",
+            "description": "Get a setting value at account level. See :method:settingsv2/listaccountsettingsmetadata for list of setting available via public APIs at account level.",
+            "summary": "Get an account setting.",
+            "path": "/api/2.1/accounts/{account_id}/settings/{name}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetPublicAccountSettingRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Setting",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetPublicAccountUserPreference",
+            "description": "Get a user preference for a specific user.\nUser preferences are personal settings that allow individual customization without affecting other users.\nSee :method:settingsv2/listaccountuserpreferencesmetadata for list of user preferences available via public APIs.",
+            "summary": "Get a user preference.",
+            "path": "/api/2.1/accounts/{account_id}/users/{user_id}/settings/{name}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetPublicAccountUserPreferenceRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "user_id",
+                  "description": "User ID of the user whose setting is being retrieved.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "name",
+                  "description": "User Setting name.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "user_id",
+                  "description": "User ID of the user whose setting is being retrieved.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "name",
+                  "description": "User Setting name.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "UserPreference",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "User Setting name.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "user_id",
+                "description": "User ID of the user whose setting is being retrieved.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "user_id",
+                "description": "User ID of the user whose setting is being retrieved.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "User Setting name.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListAccountSettingsMetadata",
+            "description": "List valid setting keys and metadata. These settings are available to be referenced via\nGET :method:settingsv2/getpublicaccountsetting and\nPATCH :method:settingsv2/patchpublicaccountsetting APIs",
+            "summary": "List valid setting keys and their metadata.",
+            "path": "/api/2.1/accounts/{account_id}/settings-metadata",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListAccountSettingsMetadataRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListAccountSettingsMetadataResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "The maximum number of settings to return. The service may return fewer than this value.\nIf unspecified, at most 200 settings will be returned.\nThe maximum value is 1000; values above 1000 will be coerced to 1000.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "A page token, received from a previous `ListAccountSettingsMetadataRequest` call.\nProvide this to retrieve the subsequent page.\n\nWhen paginating, all other parameters provided to `ListAccountSettingsMetadataRequest` must match\nthe call that provided the page token.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "A page token, received from a previous `ListAccountSettingsMetadataRequest` call.\nProvide this to retrieve the subsequent page.\n\nWhen paginating, all other parameters provided to `ListAccountSettingsMetadataRequest` must match\nthe call that provided the page token.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListAccountUserPreferencesMetadata",
+            "description": "List valid user preferences and their metadata for a specific user.\nUser preferences are personal settings that allow individual customization without affecting other users.\nThese settings are available to be referenced via\nGET :method:settingsv2/getpublicaccountuserpreference and\nPATCH :method:settingsv2/patchpublicaccountuserpreference APIs",
+            "summary": "List user preferences and their metadata.",
+            "path": "/api/2.1/accounts/{account_id}/users/{user_id}/settings-metadata",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ListAccountUserPreferencesMetadataRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "user_id",
+                  "description": "User ID of the user whose settings metadata is being retrieved.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "user_id",
+                  "description": "User ID of the user whose settings metadata is being retrieved.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListAccountUserPreferencesMetadataResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "The maximum number of settings to return. The service may return fewer than this value.\nIf unspecified, at most 200 settings will be returned.\nThe maximum value is 1000; values above 1000 will be coerced to 1000.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "A page token, received from a previous `ListAccountUserPreferencesMetadataRequest` call.\nProvide this to retrieve the subsequent page.\n\nWhen paginating, all other parameters provided to `ListAccountUserPreferencesMetadataRequest` must match\nthe call that provided the page token.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "user_id",
+                "description": "User ID of the user whose settings metadata is being retrieved.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "user_id",
+                "description": "User ID of the user whose settings metadata is being retrieved.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "A page token, received from a previous `ListAccountUserPreferencesMetadataRequest` call.\nProvide this to retrieve the subsequent page.\n\nWhen paginating, all other parameters provided to `ListAccountUserPreferencesMetadataRequest` must match\nthe call that provided the page token.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "PatchPublicAccountSetting",
+            "description": "Patch a setting value at account level. See :method:settingsv2/listaccountsettingsmetadata for list of setting available via public APIs at account level.\nTo determine the correct field to include in a patch request, refer to the type field of the setting returned in the :method:settingsv2/listaccountsettingsmetadata response.\n\nNote: Page refresh is required for changes to take effect in UI.",
+            "summary": "Update an account setting.",
+            "path": "/api/2.1/accounts/{account_id}/settings/{name}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "PatchPublicAccountSettingRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Setting",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Setting",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "setting",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Setting",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "Setting",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "setting",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Setting",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "aibi_dashboard_embedding_access_policy",
+                "description": "Setting value for aibi_dashboard_embedding_access_policy setting. This is the setting value set by consumers, check effective_aibi_dashboard_embedding_access_policy for final setting value.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AibiDashboardEmbeddingAccessPolicy",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "aibi_dashboard_embedding_approved_domains",
+                "description": "Setting value for aibi_dashboard_embedding_approved_domains setting. This is the setting value set by consumers, check effective_aibi_dashboard_embedding_approved_domains for final setting value.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AibiDashboardEmbeddingApprovedDomains",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "allowed_apps_user_api_scopes",
+                "description": "Setting value for allowed_apps_user_api_scopes setting. This is the setting value set by consumers, check effective_allowed_apps_user_api_scopes for final setting value.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AllowedAppsUserApiScopesMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "automatic_cluster_update_workspace",
+                "description": "Setting value for automatic_cluster_update_workspace setting. This is the setting value set by consumers, check effective_automatic_cluster_update_workspace for final setting value.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "ClusterAutoRestartMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "boolean_val",
+                "description": "Setting value for boolean type setting. This is the setting value set by consumers, check effective_boolean_val for final setting value.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "BooleanMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "collaboration_platform_connectivity",
+                "description": "Setting value for collaboration_platform_connectivity setting. This is the setting value set by consumers, check effective_collaboration_platform_connectivity for final setting value.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CollaborationPlatformConnectivityMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "effective_aibi_dashboard_embedding_access_policy",
+                "description": "Effective setting value for aibi_dashboard_embedding_access_policy setting. This is the final effective value of setting. To set a value use aibi_dashboard_embedding_access_policy.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AibiDashboardEmbeddingAccessPolicy",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "effective_aibi_dashboard_embedding_approved_domains",
+                "description": "Effective setting value for aibi_dashboard_embedding_approved_domains setting. This is the final effective value of setting. To set a value use aibi_dashboard_embedding_approved_domains.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AibiDashboardEmbeddingApprovedDomains",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "effective_allowed_apps_user_api_scopes",
+                "description": "Effective setting value for allowed_apps_user_api_scopes setting. This is the final effective value of setting. To set a value use allowed_apps_user_api_scopes.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AllowedAppsUserApiScopesMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "effective_automatic_cluster_update_workspace",
+                "description": "Effective setting value for automatic_cluster_update_workspace setting. This is the final effective value of setting. To set a value use automatic_cluster_update_workspace.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "ClusterAutoRestartMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "effective_boolean_val",
+                "description": "Effective setting value for boolean type setting. This is the final effective value of setting. To set a value use boolean_val.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "BooleanMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "effective_collaboration_platform_connectivity",
+                "description": "Effective setting value for collaboration_platform_connectivity setting. This is the final effective value of setting. To set a value use collaboration_platform_connectivity.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CollaborationPlatformConnectivityMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "effective_integer_val",
+                "description": "Effective setting value for integer type setting. This is the final effective value of setting. To set a value use integer_val.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "IntegerMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "effective_operational_email_custom_recipient",
+                "description": "Effective setting value for operational_email_custom_recipient setting. This is the final effective value of setting. To set a value use operational_email_custom_recipient.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "OperationalEmailCustomRecipientMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "effective_personal_compute",
+                "description": "Effective setting value for personal_compute setting. This is the final effective value of setting. To set a value use personal_compute.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "PersonalComputeMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "effective_restrict_workspace_admins",
+                "description": "Effective setting value for restrict_workspace_admins setting. This is the final effective value of setting. To set a value use restrict_workspace_admins.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "RestrictWorkspaceAdminsMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "effective_string_val",
+                "description": "Effective setting value for string type setting. This is the final effective value of setting. To set a value use string_val.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "StringMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "effective_workspace_label",
+                "description": "Effective setting value for workspace_label setting. This is the final effective value of setting. To set a value use workspace_label.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "WorkspaceLabelMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "integer_val",
+                "description": "Setting value for integer type setting. This is the setting value set by consumers, check effective_integer_val for final setting value.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "IntegerMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the setting.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "operational_email_custom_recipient",
+                "description": "Setting value for operational_email_custom_recipient setting. This is the setting value set by consumers, check effective_operational_email_custom_recipient for final setting value.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "OperationalEmailCustomRecipientMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "personal_compute",
+                "description": "Setting value for personal_compute setting. This is the setting value set by consumers, check effective_personal_compute for final setting value.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "PersonalComputeMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "restrict_workspace_admins",
+                "description": "Setting value for restrict_workspace_admins setting. This is the setting value set by consumers, check effective_restrict_workspace_admins for final setting value.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "RestrictWorkspaceAdminsMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "string_val",
+                "description": "Setting value for string type setting. This is the setting value set by consumers, check effective_string_val for final setting value.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "StringMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "workspace_label",
+                "description": "Setting value for workspace_label setting. This is the setting value set by consumers, check effective_workspace_label for final setting value.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "WorkspaceLabelMessage",
+                  "is_object": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "PatchPublicAccountUserPreference",
+            "description": "Update a user preference for a specific user.\nUser preferences are personal settings that allow individual customization without affecting other users.\nSee :method:settingsv2/listaccountuserpreferencesmetadata for list of user preferences available via public APIs.\n\nNote: Page refresh is required for changes to take effect in UI.",
+            "summary": "Update a user preference.",
+            "path": "/api/2.1/accounts/{account_id}/users/{user_id}/settings/{name}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "PatchPublicAccountUserPreferenceRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "user_id",
+                  "description": "User ID of the user whose setting is being updated.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "UserPreference",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "user_id",
+                  "description": "User ID of the user whose setting is being updated.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "UserPreference",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "setting",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "UserPreference",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "UserPreference",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "setting",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "UserPreference",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "user_id",
+                "description": "User ID of the user whose setting is being updated.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "boolean_val",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "BooleanMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "effective_boolean_val",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "BooleanMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "effective_string_val",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "StringMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the setting.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "string_val",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "StringMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "user_id",
+                "description": "User ID of the user.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "user_id",
+                "description": "User ID of the user whose setting is being updated.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "sharing.Shares",
+        "name": "Shares",
+        "description": "A share is a container instantiated with :method:shares/create. Once created you can\niteratively register a collection of existing data assets defined within the metastore\nusing :method:shares/update. You can register data assets under their original name,\nqualified by their original schema, or provide alternate exposed names.",
+        "package": {
+          "name": "sharing"
+        },
+        "docs_group": "sharing",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "SharesListRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a new share for data objects. Data objects can be added after creation with **update**.\nThe caller must be a metastore admin or have the **CREATE_SHARE** privilege on the metastore.",
+            "summary": "Create a share.",
+            "path": "/api/2.1/unity-catalog/shares",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateShare",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the share.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the share.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ShareInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "comment",
+                "description": "User-provided free-form text description.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the share.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "replication_config",
+                "description": "Configuration for share replication.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "ReplicationConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "storage_root",
+                "description": "Storage root URL for the share.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the share.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes a data object share from the metastore. The caller must be an owner of the share.",
+            "summary": "Delete a share.",
+            "path": "/api/2.1/unity-catalog/shares/{name}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteShareRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the share.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the share.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The name of the share.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the share.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets a data object share from the metastore. The caller must have the USE_SHARE privilege on the metastore or be the owner of the share.",
+            "summary": "Get a share.",
+            "path": "/api/2.1/unity-catalog/shares/{name}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetShareRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the share.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the share.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ShareInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "include_shared_data",
+                "description": "Query for data to include in the share.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the share.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the share.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListShares",
+            "description": "Gets an array of data object shares from the metastore. If the caller has the USE_SHARE privilege on the metastore, all shares are returned. Otherwise, only shares owned by the caller are returned.\nThere is no guarantee of a specific ordering of the elements in the array.",
+            "summary": "List shares.",
+            "path": "/api/2.1/unity-catalog/shares",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "SharesListRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListSharesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "max_results",
+                "description": "Maximum number of shares to return.\n- when set to 0, the page length is set to a server configured value (recommended);\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- when set to a value less than 0, an invalid parameter error is returned;\n- If not set, all valid shares are returned (not recommended).\n- Note: The number of returned shares might be less than the specified max_results size, even zero.\nThe only definitive indication that no further shares can be fetched is when the next_page_token is unset from the response.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque pagination token to go to next page based on previous query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Opaque pagination token to go to next page based on previous query.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              },
+              "max_results": {
+                "name": "max_results",
+                "description": "Maximum number of shares to return.\n- when set to 0, the page length is set to a server configured value (recommended);\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- when set to a value less than 0, an invalid parameter error is returned;\n- If not set, all valid shares are returned (not recommended).\n- Note: The number of returned shares might be less than the specified max_results size, even zero.\nThe only definitive indication that no further shares can be fetched is when the next_page_token is unset from the response.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              }
+            }
+          },
+          {
+            "name": "SharePermissions",
+            "description": "Gets the permissions for a data share from the metastore.\nThe caller must have the USE_SHARE privilege on the metastore or be the owner of the share.",
+            "summary": "Get permissions.",
+            "path": "/api/2.1/unity-catalog/shares/{name}/permissions",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "SharePermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the Recipient.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the Recipient.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetSharePermissionsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "max_results",
+                "description": "Maximum number of permissions to return.\n- when set to 0, the page length is set to a server configured value (recommended);\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- when set to a value less than 0, an invalid parameter error is returned;\n- If not set, all valid permissions are returned (not recommended).\n- Note: The number of returned permissions might be less than the specified max_results size, even zero.\nThe only definitive indication that no further permissions can be fetched is when the next_page_token is unset from the response.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the Recipient.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque pagination token to go to next page based on previous query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the Recipient.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Updates the share with the changes and data objects in the request.\nThe caller must be the owner of the share or a metastore admin.\n\nWhen the caller is a metastore admin, only the __owner__ field can be updated.\n\nIn the case the share name is changed, **updateShare** requires that the caller is the owner of the share\nand has the CREATE_SHARE privilege.\n\nIf there are notebook files in the share, the __storage_root__ field cannot be updated.\n\nFor each table that is added through this method, the share owner must also have **SELECT** privilege on the table.\nThis privilege must be maintained indefinitely for recipients to be able to access the table.\nTypically, you should use a group as the share owner.\n\nTable removals through **update** do not require additional privileges.",
+            "summary": "Update a share.",
+            "path": "/api/2.1/unity-catalog/shares/{name}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateShare",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the share.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the share.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ShareInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "comment",
+                "description": "User-provided free-form text description.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the share.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "new_name",
+                "description": "New name for the share.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "owner",
+                "description": "Username of current owner of share.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "storage_root",
+                "description": "Storage root URL for the share.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "updates",
+                "description": "Array of shared data object updates.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "SharedDataObjectUpdateList",
+                  "array_value": {
+                    "pascal_name": "SharedDataObjectUpdate",
+                    "is_object": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the share.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdatePermissions",
+            "description": "Updates the permissions for a data share in the metastore.\nThe caller must have both the USE_SHARE and SET_SHARE_PERMISSION privileges on the metastore,\nor be the owner of the share.\n\nFor new recipient grants, the user must also be the owner of the recipients.\nrecipient revocations do not require additional privileges.",
+            "summary": "Update permissions.",
+            "path": "/api/2.1/unity-catalog/shares/{name}/permissions",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateSharePermissions",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the share.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the share.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "UpdateSharePermissionsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "changes",
+                "description": "Array of permissions change objects.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PermissionsChangeList",
+                  "array_value": {
+                    "pascal_name": "PermissionsChange",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the share.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "omit_permissions_list",
+                "description": "Optional. Whether to return the latest permissions list of the share in the response.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the share.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "settings.SqlResultsDownload",
+        "name": "SqlResultsDownload",
+        "description": "Controls whether users within the workspace are allowed to download results from the SQL Editor and AI/BI Dashboards UIs. By default, this setting is enabled (set to `true`)",
+        "package": {
+          "name": "settings"
+        },
+        "has_parent": true,
+        "docs_group": "settings",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "parent_service_id": "settings.Settings",
+        "methods": [
+          {
+            "name": "Delete",
+            "description": "Reverts the SQL Results Download setting to its default value.",
+            "summary": "Delete the SQL Results Download setting.",
+            "path": "/api/2.0/settings/types/sql_results_download/names/default",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "DeleteSqlResultsDownloadRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "DeleteSqlResultsDownloadResponse",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "etag",
+                  "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "etag",
+                  "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets the SQL Results Download setting.",
+            "summary": "Get the SQL Results Download setting.",
+            "path": "/api/2.0/settings/types/sql_results_download/names/default",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetSqlResultsDownloadRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "SqlResultsDownload",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "boolean_val",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BooleanMessage",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "boolean_val",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BooleanMessage",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "etag",
+                "description": "etag used for versioning. The response is at least as fresh as the eTag\nprovided. This is used for optimistic concurrency control as a way to\nhelp prevent simultaneous writes of a setting overwriting each other. It\nis strongly suggested that systems make use of the etag in the read -\u003e\ndelete pattern to perform setting deletions in order to avoid race\nconditions. That is, get an etag from a GET request, and pass it with the\nDELETE request to identify the rule set version you are deleting.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Updates the SQL Results Download setting.",
+            "summary": "Update the SQL Results Download setting.",
+            "path": "/api/2.0/settings/types/sql_results_download/names/default",
+            "can_use_json": true,
+            "must_use_json": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "UpdateSqlResultsDownloadRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "SqlResultsDownload",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "allow_missing",
+                  "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "SqlResultsDownload",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "field_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "SqlResultsDownload",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "boolean_val",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BooleanMessage",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "boolean_val",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "BooleanMessage",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "allow_missing",
+                "description": "This should always be set to true for Settings API. Added for AIP compliance.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "field_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "setting",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "SqlResultsDownload",
+                  "is_object": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "sql.StatementExecution",
+        "name": "StatementExecution",
+        "description": "The Databricks SQL Statement Execution API can be used to execute SQL statements on a SQL warehouse and fetch the result.\n\n**Getting started**\n\nWe suggest beginning with the [Databricks SQL Statement Execution API tutorial](https://docs.databricks.com/sql/api/sql-execution-tutorial.html).\n\n**Overview of statement execution and result fetching**\n\nStatement execution begins by issuing a :method:statementexecution/executeStatement request with a valid\nSQL statement and warehouse ID, along with optional parameters such as the data catalog and output format.\nIf no other parameters are specified, the server will wait for up to 10s before returning a response.\nIf the statement has completed within this timespan, the response will include the result data as a JSON\narray and metadata.\nOtherwise, if no result is available after the 10s timeout expired, the response will provide the\nstatement ID that can be used to poll for results by using a :method:statementexecution/getStatement\nrequest.\n\nYou can specify whether the call should behave synchronously, asynchronously\nor start synchronously with a fallback to asynchronous execution.\nThis is controlled with the `wait_timeout` and `on_wait_timeout` settings.\nIf `wait_timeout` is set between 5-50 seconds (default:\n10s), the call waits for results up to\nthe specified timeout; when set to `0s`, the call is asynchronous and responds immediately with a\nstatement ID. The `on_wait_timeout` setting specifies what should happen when the timeout is reached while\nthe statement execution has not yet finished. This can be set to either `CONTINUE`, to fallback to\nasynchronous mode, or it can be set to `CANCEL`, which cancels the statement.\n\nIn summary:\n- **Synchronous mode** (`wait_timeout=30s` and `on_wait_timeout=CANCEL`):\nThe call waits up to 30 seconds; if the statement execution finishes within this time,\nthe result data is returned directly in the response. If the execution takes longer than 30 seconds,\nthe execution is canceled and the call returns with a `CANCELED` state.\n- **Asynchronous mode** (`wait_timeout=0s` and `on_wait_timeout` is ignored):\nThe call doesn't wait for the statement to finish but returns directly with a statement ID.\nThe status of the statement execution can be polled by issuing :method:statementexecution/getStatement with the statement ID.\nOnce the execution has succeeded, this call also returns the result and metadata in the response.\n- **[Default] Hybrid mode** (`wait_timeout=10s` and `on_wait_timeout=CONTINUE`):\nThe call waits for up to 10 seconds; if the statement execution finishes within this time,\nthe result data is returned directly in the response. If the execution takes longer than 10\nseconds, a statement ID is returned. The statement ID can be used to fetch status and results in\nthe same way as in the asynchronous mode.\n\nDepending on the size, the result can be split into multiple chunks. If the statement execution is\nsuccessful, the statement response contains a manifest and the first chunk of the result. The manifest\ncontains schema information and provides metadata for each chunk in the result. Result chunks can be\nretrieved by index with :method:statementexecution/getStatementResultChunkN which may be called in any\norder and in parallel. For sequential fetching, each chunk, apart from the last, also contains a\n`next_chunk_index` and `next_chunk_internal_link` that point to the next chunk.\n\nA statement can be canceled with :method:statementexecution/cancelExecution.\n\n**Fetching result data: format and disposition**\n\nTo specify the format of the result data, use the `format` field, which can be set to one of the following\noptions: `JSON_ARRAY` (JSON), `ARROW_STREAM`\n([Apache Arrow Columnar](https://arrow.apache.org/overview/)), or `CSV`.\n\nThere are two ways to receive statement results, controlled by the `disposition` setting,\nwhich can be either `INLINE` or `EXTERNAL_LINKS`:\n\n- `INLINE`: In this mode, the result data is directly included in the response. It's best suited for smaller results.\nThis mode can only be used with the `JSON_ARRAY` format.\n\n- `EXTERNAL_LINKS`: In this mode, the response provides links that can be used to download the result data in chunks separately.\nThis approach is ideal for larger results and offers higher throughput.\nThis mode can be used with all the formats: `JSON_ARRAY`, `ARROW_STREAM`, and `CSV`.\n\nBy default, the API uses `format=JSON_ARRAY` and `disposition=INLINE`.\n\n**Limits and limitations**\n\nNote: The byte limit for INLINE disposition is based on internal storage metrics and will not exactly match the byte count of the actual payload.\n\n- Statements with `disposition=INLINE` are limited to 25 MiB and will fail when this limit is\nexceeded.\n- Statements with `disposition=EXTERNAL_LINKS` are limited to 100 GiB. Result sets larger than\nthis limit will be truncated. Truncation is indicated by the `truncated` field in the result manifest.\n- The maximum query text size is 16 MiB.\n- Cancelation might silently fail. A successful response from a cancel request indicates that the cancel request\nwas successfully received and sent to the processing engine. However, an outstanding statement\nmight have already completed execution when the cancel request arrives. Polling\nfor status until a terminal state is reached is a reliable way to determine the final state.\n- Wait timeouts are approximate, occur server-side, and cannot account for things such as caller delays and network latency from caller to service.\n- To keep a statement alive, poll for its status at least once every 15 minutes. Regular polling guarantees the statement stays alive.\n- To stop a statement you no longer need, cancel it explicitly with :method:statementexecution/cancelExecution. Stopping polling does not cancel a statement. Explicit cancellation is the only way to end statement execution on demand.\n- The results are only available for one hour after success; polling does not extend this.\n- The SQL Execution API must be used for the entire lifecycle of the statement. For example, you cannot use the Jobs API to execute the command, and then the SQL Execution API to cancel it.",
+        "package": {
+          "name": "sql"
+        },
+        "docs_group": "sql",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "methods": [
+          {
+            "name": "CancelExecution",
+            "description": "Requests that an executing statement be canceled. Callers must poll for status to see the\nterminal state. Cancel response is empty; receiving response indicates successful receipt.",
+            "summary": "Cancel statement execution.",
+            "path": "/api/2.0/sql/statements/{statement_id}/cancel",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CancelExecutionRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "statement_id",
+                  "description": "The statement ID is returned upon successfully submitting a SQL statement, and is a required\nreference for all subsequent calls.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "statement_id",
+                  "description": "The statement ID is returned upon successfully submitting a SQL statement, and is a required\nreference for all subsequent calls.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "statement_id",
+                "description": "The statement ID is returned upon successfully submitting a SQL statement, and is a required\nreference for all subsequent calls.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "statement_id",
+                "description": "The statement ID is returned upon successfully submitting a SQL statement, and is a required\nreference for all subsequent calls.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ExecuteStatement",
+            "description": "Execute a SQL statement and optionally await its results for a specified time.\n\n**Use case: small result sets with INLINE + JSON_ARRAY**\n\nFor flows that generate small and predictable result sets (\u003c= 25 MiB), `INLINE` responses of `JSON_ARRAY` result\ndata are typically the simplest way to execute and fetch result data.\n\n**Use case: large result sets with EXTERNAL_LINKS**\n\nUsing `EXTERNAL_LINKS` to fetch result data allows you to fetch large result sets efficiently.\nThe main differences from using `INLINE` disposition are that the result data is accessed\nwith short-lived cloud-storage URLs, and\nthat there are 3 supported formats: `JSON_ARRAY`, `ARROW_STREAM` and `CSV` compared to only `JSON_ARRAY` with\n`INLINE`.\n\n**External-link URLs**\n\nExternal links point to data stored within your workspace's internal cloud storage. The URLs are valid for only a\nshort period, \u003c= 15 minutes. Alongside each `external_link` is an expiration field indicating the time at which the URL\nis no longer valid. In `EXTERNAL_LINKS` mode, chunks can be resolved and fetched multiple times and in parallel.\n\n----\n\n### **Warning: Databricks strongly recommends that you protect the URLs that are returned by the `EXTERNAL_LINKS` disposition.**\n\nWhen you use the `EXTERNAL_LINKS` disposition, a short-lived cloud-storage URL is generated to download the\nresults. The URL contains temporary access credentials, so protect it and do not set an `Authorization` header in\nthe download request.\n\nThe `EXTERNAL_LINKS` disposition can be disabled upon request by creating a [support case](https://docs.databricks.com/resources/support.html).\n\nSee also [Security best practices](https://docs.databricks.com/sql/admin/sql-execution-tutorial.html#security-best-practices).\n\n----\n\nStatementResponse contains `statement_id` and `status`; other fields might be absent or present depending on\ncontext. If the SQL warehouse fails to execute the provided statement, a 200 response is returned with\n`status.state` set to `FAILED` (in contrast to a failure when accepting the request, which results in a non-200\nresponse). Details of the error can be found at `status.error` in case of execution failures.",
+            "summary": "Execute a SQL statement.",
+            "path": "/api/2.0/sql/statements",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ExecuteStatementRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "statement",
+                  "description": "The SQL statement to execute. The statement can optionally be parameterized, see `parameters`.\nThe maximum query text size is 16 MiB.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "warehouse_id",
+                  "description": "Warehouse upon which to execute a statement. See also\n[What are SQL warehouses?](https://docs.databricks.com/sql/admin/warehouse-type.html)",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "statement",
+                  "description": "The SQL statement to execute. The statement can optionally be parameterized, see `parameters`.\nThe maximum query text size is 16 MiB.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "warehouse_id",
+                  "description": "Warehouse upon which to execute a statement. See also\n[What are SQL warehouses?](https://docs.databricks.com/sql/admin/warehouse-type.html)",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "StatementResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "byte_limit",
+                "description": "Applies the given byte limit to the statement's result size. Byte counts are based on internal data\nrepresentations and might not match the final size in the requested `format`. If the result was truncated due to\nthe byte limit, then `truncated` in the response is set to `true`.\nWhen using `EXTERNAL_LINKS` disposition, a default `byte_limit` of 100 GiB is applied if `byte_limit` is not\nexplicitly set.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "catalog",
+                "description": "Sets default catalog for statement execution, similar to\n[`USE CATALOG`](https://docs.databricks.com/sql/language-manual/sql-ref-syntax-ddl-use-catalog.html)\nin SQL.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "disposition",
+                "description": "The fetch disposition provides two modes of fetching results: `INLINE` and `EXTERNAL_LINKS`.\n\nStatements executed with `INLINE` disposition will return result data inline, in `JSON_ARRAY` format, in a series\nof chunks. If a given statement produces a result set with a size larger than 25 MiB,\nthat statement execution is aborted, and no result set will be available.\n\n**NOTE**\nByte limits are computed based upon internal representations of the result set data, and might not match the sizes\nvisible in JSON responses.\n\nStatements executed with `EXTERNAL_LINKS` disposition will return result data as external links: URLs that point\nto cloud storage internal to the workspace. Using `EXTERNAL_LINKS` disposition allows statements to generate\narbitrarily sized result sets for fetching up to 100 GiB. The resulting links have two important properties:\n\n1. They point to resources _external_ to the Databricks compute; therefore any associated authentication\ninformation (typically a personal access token, OAuth token, or similar) _must be removed_ when fetching from\nthese links.\n\n2. These are short-lived cloud-storage URLs\nwith a specific expiration, indicated in the response. The behavior when attempting to use an expired link is\ncloud specific.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Disposition",
+                  "enum": [
+                    {
+                      "content": "EXTERNAL_LINKS"
+                    },
+                    {
+                      "content": "INLINE"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "format",
+                "description": "Statement execution supports three result formats: `JSON_ARRAY` (default), `ARROW_STREAM`, and `CSV`.\n\nImportant: The formats `ARROW_STREAM` and `CSV` are supported only with `EXTERNAL_LINKS` disposition.\n`JSON_ARRAY` is supported in `INLINE` and `EXTERNAL_LINKS` disposition.\n\nWhen specifying `format=JSON_ARRAY`, result data will be formatted as an array of arrays of values, where each\nvalue is either the *string representation* of a value, or `null`.\nFor example, the output of `SELECT concat('id-', id) AS strCol, id AS intCol, null AS nullCol FROM range(3)` would\nlook like this:\n\n```\n[\n[ \"id-1\", \"1\", null ],\n[ \"id-2\", \"2\", null ],\n[ \"id-3\", \"3\", null ],\n]\n```\n\nWhen specifying `format=JSON_ARRAY` and `disposition=EXTERNAL_LINKS`, each chunk in the result contains compact\nJSON with no indentation or extra whitespace.\n\nWhen specifying `format=ARROW_STREAM` and `disposition=EXTERNAL_LINKS`, each chunk in the result will be formatted\nas Apache Arrow Stream. See the\n[Apache Arrow streaming format](https://arrow.apache.org/docs/format/Columnar.html#ipc-streaming-format).\n\nWhen specifying `format=CSV` and `disposition=EXTERNAL_LINKS`, each chunk in the result will be a CSV according to\n[RFC 4180](https://www.rfc-editor.org/rfc/rfc4180) standard.\nAll the columns values will have *string representation* similar to the `JSON_ARRAY` format, and `null` values will\nbe encoded as “null”.\nOnly the first chunk in the result would contain a header row with column names.\nFor example, the output of `SELECT concat('id-', id) AS strCol, id AS intCol, null as nullCol FROM range(3)` would\nlook like this:\n\n```\nstrCol,intCol,nullCol\nid-1,1,null\nid-2,2,null\nid-3,3,null\n```",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Format",
+                  "enum": [
+                    {
+                      "content": "ARROW_STREAM"
+                    },
+                    {
+                      "content": "CSV"
+                    },
+                    {
+                      "content": "JSON_ARRAY"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "on_wait_timeout",
+                "description": "When `wait_timeout \u003e 0s`, the call will block up to the specified time. If the statement execution doesn't\nfinish within this time, `on_wait_timeout` determines whether the execution should continue or be canceled.\nWhen set to `CONTINUE`, the statement execution continues asynchronously and the call returns a statement ID\nwhich can be used for polling with :method:statementexecution/getStatement. When set to `CANCEL`,\nthe statement execution is canceled and the call returns with a `CANCELED` state.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ExecuteStatementRequestOnWaitTimeout",
+                  "enum": [
+                    {
+                      "content": "CANCEL"
+                    },
+                    {
+                      "content": "CONTINUE"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "parameters",
+                "description": "A list of parameters to pass into a SQL statement containing parameter markers. A\nparameter consists of a name, a value, and optionally a type. To represent a NULL\nvalue, the `value` field may be omitted or set to `null` explicitly. If the `type` field\nis omitted, the value is interpreted as a string.\n\nIf the type is given, parameters will be checked for type correctness according\nto the given type. A value is correct if the provided string can be converted to\nthe requested type using the `cast` function. The exact semantics are described in\nthe section [`cast` function](https://docs.databricks.com/sql/language-manual/functions/cast.html) of the SQL language reference.\n\nFor example, the following statement contains two parameters, `my_name` and `my_date`:\n\n```\nSELECT * FROM my_table WHERE name = :my_name AND date = :my_date\n```\n\nThe parameters can be passed in the request body as follows:\n\n`\n{\n...,\n\"statement\": \"SELECT * FROM my_table WHERE name = :my_name AND date = :my_date\",\n\"parameters\": [\n{ \"name\": \"my_name\", \"value\": \"the name\" },\n{ \"name\": \"my_date\", \"value\": \"2020-01-01\", \"type\": \"DATE\" }\n]\n}\n`\n\nCurrently, positional parameters denoted by a `?` marker are not supported by the\nDatabricks SQL Statement Execution API.\n\nAlso see the section [Parameter markers](https://docs.databricks.com/sql/language-manual/sql-ref-parameter-marker.html) of the SQL language reference.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "StatementParameterListItemList",
+                  "array_value": {
+                    "pascal_name": "StatementParameterListItem",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "query_tags",
+                "description": "An array of query tags to annotate a SQL statement. A query tag\nconsists of a non-empty key and, optionally, a value. To represent a NULL\nvalue, either omit the `value` field or manually set it to `null` or white space.\nRefer to the SQL language reference for the format specification of query tags.\nThere's no significance to the order of tags. Only one value per key will be recorded.\nA sequence in excess of 20 query tags will be coerced to 20.\nExample:\n\n{\n...,\n\"query_tags\": [\n{ \"key\": \"team\", \"value\": \"eng\" },\n{ \"key\": \"some key only tag\" }\n]\n}",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "QueryTagList",
+                  "array_value": {
+                    "pascal_name": "QueryTag",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "row_limit",
+                "description": "Applies the given row limit to the statement's result set, but unlike the `LIMIT` clause in SQL,\nit also sets the `truncated` field in the response to indicate whether the result was trimmed due to the limit or\nnot.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "schema",
+                "description": "Sets default schema for statement execution, similar to\n[`USE SCHEMA`](https://docs.databricks.com/sql/language-manual/sql-ref-syntax-ddl-use-schema.html)\nin SQL.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "statement",
+                "description": "The SQL statement to execute. The statement can optionally be parameterized, see `parameters`.\nThe maximum query text size is 16 MiB.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "wait_timeout",
+                "description": "The time in seconds the call will wait for the statement's result set as `Ns`, where `N` can be set to 0 or to a\nvalue between 5 and 50.\n\nWhen set to `0s`, the statement will execute in asynchronous mode and the call will not wait for the execution to\nfinish. In this case, the call returns directly with `PENDING` state and a statement ID which can be used for\npolling with :method:statementexecution/getStatement.\n\nWhen set between 5 and 50 seconds, the call will behave synchronously up to this timeout and wait for the statement\nexecution to finish. If the execution finishes within this time, the call returns immediately with a manifest and\nresult data (or a `FAILED` state in case of an execution error). If the statement takes longer to execute,\n`on_wait_timeout` determines what should happen after the timeout is reached.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "warehouse_id",
+                "description": "Warehouse upon which to execute a statement. See also\n[What are SQL warehouses?](https://docs.databricks.com/sql/admin/warehouse-type.html)",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "statement",
+                "description": "The SQL statement to execute. The statement can optionally be parameterized, see `parameters`.\nThe maximum query text size is 16 MiB.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "warehouse_id",
+                "description": "Warehouse upon which to execute a statement. See also\n[What are SQL warehouses?](https://docs.databricks.com/sql/admin/warehouse-type.html)",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetStatement",
+            "description": "This request can be used to poll for the statement's status. StatementResponse contains\n`statement_id` and `status`; other fields might be absent or present depending on context.\nWhen the `status.state` field is `SUCCEEDED` it will also return the result manifest and the\nfirst chunk of the result data. When the statement is in the terminal states `CANCELED`,\n`CLOSED` or `FAILED`, it returns HTTP 200 with the state set. After at least 12 hours in\nterminal state, the statement is removed from the warehouse and further calls will receive an\nHTTP 404 response.\n\n**NOTE**\nThis call currently might take up to 5 seconds to get the latest status and result.",
+            "summary": "Get status, manifest, and result first chunk.",
+            "path": "/api/2.0/sql/statements/{statement_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetStatementRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "statement_id",
+                  "description": "The statement ID is returned upon successfully submitting a SQL statement, and is a required\nreference for all subsequent calls.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "statement_id",
+                  "description": "The statement ID is returned upon successfully submitting a SQL statement, and is a required\nreference for all subsequent calls.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "StatementResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "statement_id",
+                "description": "The statement ID is returned upon successfully submitting a SQL statement, and is a required\nreference for all subsequent calls.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "statement_id",
+                "description": "The statement ID is returned upon successfully submitting a SQL statement, and is a required\nreference for all subsequent calls.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetStatementResultChunkN",
+            "description": "After the statement execution has `SUCCEEDED`, this request can be used to fetch any chunk by\nindex. Whereas the first chunk with `chunk_index=0` is typically fetched with\n:method:statementexecution/executeStatement or :method:statementexecution/getStatement, this\nrequest can be used to fetch subsequent chunks. The response structure is identical to the\nnested `result` element described in the :method:statementexecution/getStatement request, and\nsimilarly includes the `next_chunk_index` and `next_chunk_internal_link` fields for simple\niteration through the result set. Depending on `disposition`, the response returns chunks of\ndata either inline, or as links.",
+            "summary": "Get result chunk by index.",
+            "path": "/api/2.0/sql/statements/{statement_id}/result/chunks/{chunk_index}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetStatementResultChunkNRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "statement_id",
+                  "description": "The statement ID is returned upon successfully submitting a SQL statement, and is a required\nreference for all subsequent calls.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "chunk_index",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "statement_id",
+                  "description": "The statement ID is returned upon successfully submitting a SQL statement, and is a required\nreference for all subsequent calls.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "chunk_index",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ResultData",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "chunk_index",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "statement_id",
+                "description": "The statement ID is returned upon successfully submitting a SQL statement, and is a required\nreference for all subsequent calls.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "statement_id",
+                "description": "The statement ID is returned upon successfully submitting a SQL statement, and is a required\nreference for all subsequent calls.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "chunk_index",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "provisioning.Storage",
+        "name": "Storage",
+        "description": "These APIs manage storage configurations for this workspace. A root storage S3 bucket in\nyour account is required to store objects like cluster logs, notebook revisions, and job\nresults. You can also use the root storage S3 bucket for storage of non-production DBFS\ndata. A storage configuration encapsulates this bucket information, and its ID is used when\ncreating a new workspace.",
+        "package": {
+          "name": "provisioning"
+        },
+        "is_accounts": true,
+        "docs_group": "provisioning",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a Databricks storage configuration for an account.",
+            "summary": "Create a storage configuration.",
+            "path": "/api/2.0/accounts/{account_id}/storage-configurations",
+            "can_use_json": true,
+            "must_use_json": true,
+            "is_crud_create": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateStorageConfigurationRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "storage_configuration_name",
+                  "description": "The human-readable name of the storage configuration.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "root_bucket_info",
+                  "description": "Root S3 bucket information.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "RootBucketInfo",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "storage_configuration_name",
+                  "description": "The human-readable name of the storage configuration.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "root_bucket_info",
+                  "description": "Root S3 bucket information.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "RootBucketInfo",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "StorageConfiguration",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "role_arn",
+                "description": "Optional IAM role that is used to access the workspace catalog which is created during workspace creation\nfor UC by Default. If a storage configuration with this field populated is used to create a workspace,\nthen a workspace catalog is created together with the workspace. The workspace catalog shares the root\nbucket with internal workspace storage (including DBFS root) but uses a dedicated bucket path prefix.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "root_bucket_info",
+                "description": "Root S3 bucket information.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "RootBucketInfo",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "storage_configuration_name",
+                "description": "The human-readable name of the storage configuration.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes a Databricks storage configuration. You cannot delete a storage configuration that is associated with any workspace.",
+            "summary": "Delete a storage configuration.",
+            "path": "/api/2.0/accounts/{account_id}/storage-configurations/{storage_configuration_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteStorageRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "storage_configuration_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "storage_configuration_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "StorageConfiguration",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "storage_configuration_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "storage_configuration_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets a Databricks storage configuration for an account, both specified by ID.",
+            "summary": "Get a storage configuration.",
+            "path": "/api/2.0/accounts/{account_id}/storage-configurations/{storage_configuration_id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetStorageRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "storage_configuration_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "storage_configuration_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "StorageConfiguration",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "storage_configuration_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "storage_configuration_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Lists Databricks storage configurations for an account, specified by ID.",
+            "summary": "List storage configurations.",
+            "path": "/api/2.0/accounts/{account_id}/storage-configurations",
+            "is_legacy_empty_request": true,
+            "is_crud_read": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListStorageRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "StorageConfigurationList",
+              "array_value": {
+                "pascal_name": "StorageConfiguration",
+                "is_object": true
+              }
+            }
+          }
+        ]
+      },
+      {
+        "id": "catalog.StorageCredentials",
+        "name": "StorageCredentials",
+        "description": "A storage credential represents an authentication and authorization mechanism for accessing\ndata stored on your cloud tenant. Each storage credential is subject to\nUnity Catalog access-control policies that control which users and groups can access\nthe credential. If a user does not have access to a storage credential in Unity Catalog,\nthe request fails and Unity Catalog does not attempt to authenticate to your cloud tenant\non the user’s behalf.\n\nDatabricks recommends using external locations rather than using storage credentials\ndirectly.\n\nTo create storage credentials, you must be a Databricks account admin. The account admin\nwho creates the storage credential can delegate ownership to another user or group to\nmanage permissions on it.",
+        "package": {
+          "name": "catalog"
+        },
+        "docs_group": "catalog",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListStorageCredentialsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a new storage credential.\n\nThe caller must be a metastore admin or have the **CREATE_STORAGE_CREDENTIAL** privilege on the metastore.",
+            "summary": "Create a storage credential.",
+            "path": "/api/2.1/unity-catalog/storage-credentials",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateStorageCredential",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The credential name. The name must be unique among storage and service\ncredentials within the metastore.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "The credential name. The name must be unique among storage and service\ncredentials within the metastore.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "StorageCredentialInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "aws_iam_role",
+                "description": "The AWS IAM role configuration.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AwsIamRoleRequest",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "azure_managed_identity",
+                "description": "The Azure managed identity configuration.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AzureManagedIdentityRequest",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "azure_service_principal",
+                "description": "The Azure service principal configuration.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AzureServicePrincipal",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "cloudflare_api_token",
+                "description": "The Cloudflare API token configuration.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CloudflareApiToken",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "comment",
+                "description": "Comment associated with the credential.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "databricks_gcp_service_account",
+                "description": "The Databricks managed GCP service account configuration.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "DatabricksGcpServiceAccountRequest",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The credential name. The name must be unique among storage and service\ncredentials within the metastore.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "read_only",
+                "description": "Whether the credential is usable only for read operations. Only applicable\nwhen purpose is **STORAGE**.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "skip_validation",
+                "description": "Supplying true to this argument skips validation of the created credential.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The credential name. The name must be unique among storage and service\ncredentials within the metastore.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes a storage credential from the metastore. The caller must be an owner of the storage credential.",
+            "summary": "Delete a credential.",
+            "path": "/api/2.1/unity-catalog/storage-credentials/{name}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteStorageCredentialRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the storage credential.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the storage credential.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "force",
+                "description": "Force an update even if there are dependent external locations or external\ntables (when purpose is **STORAGE**) or dependent services (when purpose is\n**SERVICE**).",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the storage credential.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the storage credential.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets a storage credential from the metastore.\nThe caller must be a metastore admin, the owner of the storage credential, or have some permission on the storage credential.",
+            "summary": "Get a credential.",
+            "path": "/api/2.1/unity-catalog/storage-credentials/{name}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetStorageCredentialRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the storage credential.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the storage credential.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "StorageCredentialInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Name of the storage credential.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the storage credential.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Gets an array of storage credentials (as __StorageCredentialInfo__ objects).\nThe array is limited to only those storage credentials the caller has permission to access.\nIf the caller is a metastore admin, retrieval of credentials is unrestricted.\nThere is no guarantee of a specific ordering of the elements in the array.\n\nNOTE: we recommend using max_results=0 to use the paginated version of this API. Unpaginated calls will be deprecated soon.\n\nPAGINATION BEHAVIOR: When using pagination (max_results \u003e= 0), a page may contain zero results while still providing a next_page_token.\nClients must continue reading pages until next_page_token is absent, which is the only indication that the end of results has been reached.",
+            "summary": "List credentials.",
+            "path": "/api/2.1/unity-catalog/storage-credentials",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListStorageCredentialsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListStorageCredentialsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "include_unbound",
+                "description": "Whether to include credentials not bound to the workspace.\nEffective only if the user has permission to update the credential–workspace binding.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "max_results",
+                "description": "Maximum number of storage credentials to return.\nIf not set, all the storage credentials are returned (not recommended).\n- when set to a value greater than 0, the page length is the minimum of\nthis value and a server configured value;\n- when set to 0, the page length is set to a server configured value\n(recommended);\n- when set to a value less than 0, an invalid parameter error is returned;",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque pagination token to go to next page based on previous query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Opaque pagination token to go to next page based on previous query.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              },
+              "max_results": {
+                "name": "max_results",
+                "description": "Maximum number of storage credentials to return.\nIf not set, all the storage credentials are returned (not recommended).\n- when set to a value greater than 0, the page length is the minimum of\nthis value and a server configured value;\n- when set to 0, the page length is set to a server configured value\n(recommended);\n- when set to a value less than 0, an invalid parameter error is returned;",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              }
+            }
+          },
+          {
+            "name": "Update",
+            "description": "Updates a storage credential on the metastore.\n\nThe caller must be the owner of the storage credential or a metastore admin.\nIf the caller is a metastore admin, only the **owner** field can be changed.",
+            "summary": "Update a credential.",
+            "path": "/api/2.1/unity-catalog/storage-credentials/{name}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateStorageCredential",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the storage credential.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the storage credential.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "StorageCredentialInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "aws_iam_role",
+                "description": "The AWS IAM role configuration.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AwsIamRoleRequest",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "azure_managed_identity",
+                "description": "The Azure managed identity configuration.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AzureManagedIdentityResponse",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "azure_service_principal",
+                "description": "The Azure service principal configuration.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AzureServicePrincipal",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "cloudflare_api_token",
+                "description": "The Cloudflare API token configuration.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CloudflareApiToken",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "comment",
+                "description": "Comment associated with the credential.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "databricks_gcp_service_account",
+                "description": "The Databricks managed GCP service account configuration.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "DatabricksGcpServiceAccountRequest",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "force",
+                "description": "Force update even if there are dependent external locations or external\ntables.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "isolation_mode",
+                "description": "Whether the current securable is accessible from all workspaces or a\nspecific set of workspaces.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "IsolationMode",
+                  "enum": [
+                    {
+                      "content": "ISOLATION_MODE_ISOLATED"
+                    },
+                    {
+                      "content": "ISOLATION_MODE_OPEN"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the storage credential.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "new_name",
+                "description": "New name for the storage credential.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "owner",
+                "description": "Username of current owner of credential.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "read_only",
+                "description": "Whether the credential is usable only for read operations. Only applicable\nwhen purpose is **STORAGE**.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "skip_validation",
+                "description": "Supplying true to this argument skips validation of the updated credential.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the storage credential.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Validate",
+            "description": "Validates a storage credential.\nAt least one of __external_location_name__ and __url__ need to be provided. If only one of them is\nprovided, it will be used for validation. And if both are provided, the __url__ will be used for\nvalidation, and __external_location_name__ will be ignored when checking overlapping urls.\n\nEither the __storage_credential_name__ or the cloud-specific credential must be provided.\n\nThe caller must be a metastore admin or the storage credential owner or\nhave the **CREATE_EXTERNAL_LOCATION** privilege on the metastore and the storage credential.",
+            "summary": "Validate a storage credential.",
+            "path": "/api/2.1/unity-catalog/validate-storage-credentials",
+            "can_use_json": true,
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ValidateStorageCredential",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ValidateStorageCredentialResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "aws_iam_role",
+                "description": "The AWS IAM role configuration.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AwsIamRoleRequest",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "azure_managed_identity",
+                "description": "The Azure managed identity configuration.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AzureManagedIdentityRequest",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "azure_service_principal",
+                "description": "The Azure service principal configuration.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AzureServicePrincipal",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "cloudflare_api_token",
+                "description": "The Cloudflare API token configuration.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CloudflareApiToken",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "databricks_gcp_service_account",
+                "description": "The Databricks created GCP service account configuration.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "DatabricksGcpServiceAccountRequest",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "external_location_name",
+                "description": "The name of an existing external location to validate.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "read_only",
+                "description": "Whether the storage credential is only usable for read operations.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "storage_credential_name",
+                "description": "Required. The name of an existing credential or long-lived cloud\ncredential to validate.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "url",
+                "description": "The external location url to validate.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "catalog.AccountStorageCredentials",
+        "name": "AccountStorageCredentials",
+        "description": "These APIs manage storage credentials for a particular metastore.",
+        "package": {
+          "name": "catalog"
+        },
+        "is_accounts": true,
+        "docs_group": "catalog",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListAccountStorageCredentialsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a new storage credential. The request object is specific to the cloud:\n- **AwsIamRole** for AWS credentials\n- **AzureServicePrincipal** for Azure credentials\n- **GcpServiceAccountKey** for GCP credentials\n\nThe caller must be a metastore admin and have the `CREATE_STORAGE_CREDENTIAL` privilege on the metastore.",
+            "summary": "Create a storage credential.",
+            "path": "/api/2.0/accounts/{account_id}/metastores/{metastore_id}/storage-credentials",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "AccountsCreateStorageCredential",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "metastore_id",
+                  "description": "Unity Catalog metastore ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "metastore_id",
+                  "description": "Unity Catalog metastore ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "AccountsCreateStorageCredentialInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "credential_info",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CreateAccountsStorageCredential",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "metastore_id",
+                "description": "Unity Catalog metastore ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "skip_validation",
+                "description": "Optional, default false.\nSupplying true to this argument skips validation of the created set of credentials.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "metastore_id",
+                "description": "Unity Catalog metastore ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes a storage credential from the metastore. The caller must be an owner of the storage credential.",
+            "summary": "Delete a storage credential.",
+            "path": "/api/2.0/accounts/{account_id}/metastores/{metastore_id}/storage-credentials/{storage_credential_name}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteAccountStorageCredentialRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "metastore_id",
+                  "description": "Unity Catalog metastore ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "storage_credential_name",
+                  "description": "Name of the storage credential.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "metastore_id",
+                  "description": "Unity Catalog metastore ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "storage_credential_name",
+                  "description": "Name of the storage credential.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "AccountsDeleteStorageCredentialResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "force",
+                "description": "Force deletion even if the Storage Credential is not empty. Default is false.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "metastore_id",
+                "description": "Unity Catalog metastore ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "storage_credential_name",
+                "description": "Name of the storage credential.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "metastore_id",
+                "description": "Unity Catalog metastore ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "storage_credential_name",
+                "description": "Name of the storage credential.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets a storage credential from the metastore. The caller must be a metastore admin, the owner of the\nstorage credential, or have a level of privilege on the storage credential.",
+            "summary": "Gets the named storage credential.",
+            "path": "/api/2.0/accounts/{account_id}/metastores/{metastore_id}/storage-credentials/{storage_credential_name}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetAccountStorageCredentialRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "metastore_id",
+                  "description": "Unity Catalog metastore ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "storage_credential_name",
+                  "description": "Required. Name of the storage credential.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "metastore_id",
+                  "description": "Unity Catalog metastore ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "storage_credential_name",
+                  "description": "Required. Name of the storage credential.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "AccountsStorageCredentialInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "metastore_id",
+                "description": "Unity Catalog metastore ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "storage_credential_name",
+                "description": "Required. Name of the storage credential.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "metastore_id",
+                "description": "Unity Catalog metastore ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "storage_credential_name",
+                "description": "Required. Name of the storage credential.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Gets a list of all storage credentials that have been assigned to given metastore.",
+            "summary": "Get all storage credentials assigned to a metastore.",
+            "path": "/api/2.0/accounts/{account_id}/metastores/{metastore_id}/storage-credentials",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListAccountStorageCredentialsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "metastore_id",
+                  "description": "Unity Catalog metastore ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "metastore_id",
+                  "description": "Unity Catalog metastore ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListAccountStorageCredentialsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "metastore_id",
+                "description": "Unity Catalog metastore ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "metastore_id",
+                "description": "Unity Catalog metastore ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {}
+          },
+          {
+            "name": "Update",
+            "description": "Updates a storage credential on the metastore. The caller must be the owner of the storage credential.\nIf the caller is a metastore admin, only the **owner** credential can be changed.",
+            "summary": "Updates a storage credential.",
+            "path": "/api/2.0/accounts/{account_id}/metastores/{metastore_id}/storage-credentials/{storage_credential_name}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "AccountsUpdateStorageCredential",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "metastore_id",
+                  "description": "Unity Catalog metastore ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "storage_credential_name",
+                  "description": "Name of the storage credential.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "metastore_id",
+                  "description": "Unity Catalog metastore ID",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "storage_credential_name",
+                  "description": "Name of the storage credential.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "AccountsUpdateStorageCredentialResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "credential_info",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "UpdateAccountsStorageCredential",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "metastore_id",
+                "description": "Unity Catalog metastore ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "skip_validation",
+                "description": "Optional. Supplying true to this argument skips validation of the updated set of credentials.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "storage_credential_name",
+                "description": "Name of the storage credential.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "metastore_id",
+                "description": "Unity Catalog metastore ID",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "storage_credential_name",
+                "description": "Name of the storage credential.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "supervisoragents.SupervisorAgents",
+        "name": "SupervisorAgents",
+        "description": "Manage legacy Supervisor Agents and related resources.",
+        "package": {
+          "name": "supervisoragents"
+        },
+        "docs_group": "agentbricks",
+        "launch_stage": "PUBLIC_BETA",
+        "cli_launch_stage_label": "*Beta*",
+        "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+        "cli_launch_stage_display": "Beta",
+        "list": {
+          "request": {
+            "pascal_name": "ListExamplesRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "CreateExample",
+            "description": "Creates an example for a Supervisor Agent.",
+            "summary": "Create an example for a Supervisor Agent.",
+            "path": "/api/2.1/{parent=supervisor-agents/*}/examples",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "CreateExampleRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "Parent resource where this example will be created.\nFormat: supervisor-agents/{supervisor_agent_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "example",
+                  "description": "The example to create under the parent Supervisor Agent.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Example",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "Parent resource where this example will be created.\nFormat: supervisor-agents/{supervisor_agent_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "example",
+                  "description": "The example to create under the parent Supervisor Agent.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Example",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "example",
+              "description": "The example to create under the parent Supervisor Agent.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Example",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "question",
+                    "description": "The example question.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "guidelines",
+                    "description": "Guidelines for answering the question.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "List",
+                      "array_value": {
+                        "is_string": true
+                      }
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "question",
+                    "description": "The example question.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "guidelines",
+                    "description": "Guidelines for answering the question.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "List",
+                      "array_value": {
+                        "is_string": true
+                      }
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "Example",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "question",
+                  "description": "The example question.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "guidelines",
+                  "description": "Guidelines for answering the question.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "List",
+                    "array_value": {
+                      "is_string": true
+                    }
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "question",
+                  "description": "The example question.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "guidelines",
+                  "description": "Guidelines for answering the question.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "List",
+                    "array_value": {
+                      "is_string": true
+                    }
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "example",
+                "description": "The example to create under the parent Supervisor Agent.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Example",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "question",
+                      "description": "The example question.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "guidelines",
+                      "description": "Guidelines for answering the question.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "List",
+                        "array_value": {
+                          "is_string": true
+                        }
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "question",
+                      "description": "The example question.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "guidelines",
+                      "description": "Guidelines for answering the question.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "List",
+                        "array_value": {
+                          "is_string": true
+                        }
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "parent",
+                "description": "Parent resource where this example will be created.\nFormat: supervisor-agents/{supervisor_agent_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "example_id",
+                "description": "The universally unique identifier (UUID) of the example.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "guidelines",
+                "description": "Guidelines for answering the question.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "name",
+                "description": "Full resource name:\nsupervisor-agents/{supervisor_agent_id}/examples/{example_id}",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "question",
+                "description": "The example question.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "Parent resource where this example will be created.\nFormat: supervisor-agents/{supervisor_agent_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "question",
+                "description": "The example question.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "guidelines",
+                "description": "Guidelines for answering the question.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateSupervisorAgent",
+            "description": "Creates a new Supervisor Agent.",
+            "summary": "Create a Supervisor Agent.",
+            "path": "/api/2.1/supervisor-agents",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "CreateSupervisorAgentRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "supervisor_agent",
+                  "description": "The Supervisor Agent to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "SupervisorAgent",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "supervisor_agent",
+                  "description": "The Supervisor Agent to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "SupervisorAgent",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "supervisor_agent",
+              "description": "The Supervisor Agent to create.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "SupervisorAgent",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "display_name",
+                    "description": "The display name of the Supervisor Agent, unique at workspace level.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "display_name",
+                    "description": "The display name of the Supervisor Agent, unique at workspace level.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "SupervisorAgent",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "display_name",
+                  "description": "The display name of the Supervisor Agent, unique at workspace level.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "display_name",
+                  "description": "The display name of the Supervisor Agent, unique at workspace level.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "supervisor_agent",
+                "description": "The Supervisor Agent to create.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "SupervisorAgent",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "display_name",
+                      "description": "The display name of the Supervisor Agent, unique at workspace level.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "display_name",
+                      "description": "The display name of the Supervisor Agent, unique at workspace level.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Creation timestamp.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "creator",
+                "description": "The creator of the Supervisor Agent.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "Description of what this agent can do (user-facing).",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "The display name of the Supervisor Agent, unique at workspace level.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "endpoint_name",
+                "description": "The name of the supervisor agent's serving endpoint.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "experiment_id",
+                "description": "The MLflow experiment ID.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "id",
+                "description": "Deprecated: Use supervisor_agent_id instead.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "instructions",
+                "description": "Optional natural-language instructions for the supervisor agent.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The resource name of the SupervisorAgent.\nFormat: supervisor-agents/{supervisor_agent_id}",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "supervisor_agent_id",
+                "description": "The universally unique identifier (UUID) of the Supervisor Agent.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "display_name",
+                "description": "The display name of the Supervisor Agent, unique at workspace level.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateTool",
+            "description": "Creates a Tool under a Supervisor Agent. Specify one of \"genie_space\", \"knowledge_assistant\", \"uc_function\", \"uc_connection\", \"app\", \"volume\", \"dashboard\", \"table\", \"vector_search_index\", \"catalog\", \"schema\", \"supervisor_agent\", \"databricks_web_search\", \"skill\" in the request body. The legacy values \"lakeview_dashboard\", \"uc_table\", and \"web_search\" are also accepted and remain equivalent to \"dashboard\", \"table\", and \"databricks_web_search\" respectively. The \"databricks_web_search\" tool_type maps to the `web_search` spec field.",
+            "summary": "Create a Tool.",
+            "path": "/api/2.1/{parent=supervisor-agents/*}/tools",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "CreateToolRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "Parent resource where this tool will be created.\nFormat: supervisor-agents/{supervisor_agent_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "tool",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Tool",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "tool_id",
+                  "description": "The ID to use for the tool, which will become the final component of\nthe tool's resource name.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "Parent resource where this tool will be created.\nFormat: supervisor-agents/{supervisor_agent_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "tool_id",
+                  "description": "The ID to use for the tool, which will become the final component of\nthe tool's resource name.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "tool",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Tool",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "tool",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Tool",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "tool_type",
+                    "description": "Tool type. Must be one of: \"genie_space\", \"knowledge_assistant\", \"uc_function\", \"uc_connection\", \"uc_mcp\", \"app\", \"volume\", \"dashboard\", \"serving_endpoint\", \"table\", \"vector_search_index\", \"catalog\", \"schema\", \"supervisor_agent\", \"databricks_web_search\", \"skill\". The legacy values \"lakeview_dashboard\", \"uc_table\", and \"web_search\" are also accepted and remain equivalent to \"dashboard\", \"table\", and \"databricks_web_search\" respectively. The \"databricks_web_search\" tool_type maps to the `web_search` spec field.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "tool_type",
+                    "description": "Tool type. Must be one of: \"genie_space\", \"knowledge_assistant\", \"uc_function\", \"uc_connection\", \"uc_mcp\", \"app\", \"volume\", \"dashboard\", \"serving_endpoint\", \"table\", \"vector_search_index\", \"catalog\", \"schema\", \"supervisor_agent\", \"databricks_web_search\", \"skill\". The legacy values \"lakeview_dashboard\", \"uc_table\", and \"web_search\" are also accepted and remain equivalent to \"dashboard\", \"table\", and \"databricks_web_search\" respectively. The \"databricks_web_search\" tool_type maps to the `web_search` spec field.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "Tool",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "tool_type",
+                  "description": "Tool type. Must be one of: \"genie_space\", \"knowledge_assistant\", \"uc_function\", \"uc_connection\", \"uc_mcp\", \"app\", \"volume\", \"dashboard\", \"serving_endpoint\", \"table\", \"vector_search_index\", \"catalog\", \"schema\", \"supervisor_agent\", \"databricks_web_search\", \"skill\". The legacy values \"lakeview_dashboard\", \"uc_table\", and \"web_search\" are also accepted and remain equivalent to \"dashboard\", \"table\", and \"databricks_web_search\" respectively. The \"databricks_web_search\" tool_type maps to the `web_search` spec field.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "tool_type",
+                  "description": "Tool type. Must be one of: \"genie_space\", \"knowledge_assistant\", \"uc_function\", \"uc_connection\", \"uc_mcp\", \"app\", \"volume\", \"dashboard\", \"serving_endpoint\", \"table\", \"vector_search_index\", \"catalog\", \"schema\", \"supervisor_agent\", \"databricks_web_search\", \"skill\". The legacy values \"lakeview_dashboard\", \"uc_table\", and \"web_search\" are also accepted and remain equivalent to \"dashboard\", \"table\", and \"databricks_web_search\" respectively. The \"databricks_web_search\" tool_type maps to the `web_search` spec field.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "parent",
+                "description": "Parent resource where this tool will be created.\nFormat: supervisor-agents/{supervisor_agent_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tool",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Tool",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "tool_type",
+                      "description": "Tool type. Must be one of: \"genie_space\", \"knowledge_assistant\", \"uc_function\", \"uc_connection\", \"uc_mcp\", \"app\", \"volume\", \"dashboard\", \"serving_endpoint\", \"table\", \"vector_search_index\", \"catalog\", \"schema\", \"supervisor_agent\", \"databricks_web_search\", \"skill\". The legacy values \"lakeview_dashboard\", \"uc_table\", and \"web_search\" are also accepted and remain equivalent to \"dashboard\", \"table\", and \"databricks_web_search\" respectively. The \"databricks_web_search\" tool_type maps to the `web_search` spec field.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "tool_type",
+                      "description": "Tool type. Must be one of: \"genie_space\", \"knowledge_assistant\", \"uc_function\", \"uc_connection\", \"uc_mcp\", \"app\", \"volume\", \"dashboard\", \"serving_endpoint\", \"table\", \"vector_search_index\", \"catalog\", \"schema\", \"supervisor_agent\", \"databricks_web_search\", \"skill\". The legacy values \"lakeview_dashboard\", \"uc_table\", and \"web_search\" are also accepted and remain equivalent to \"dashboard\", \"table\", and \"databricks_web_search\" respectively. The \"databricks_web_search\" tool_type maps to the `web_search` spec field.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "tool_id",
+                "description": "The ID to use for the tool, which will become the final component of\nthe tool's resource name.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "app",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "App",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "Description of what this tool does (user-facing).",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "genie_space",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "GenieSpace",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "id",
+                "description": "Deprecated: Use tool_id instead.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "knowledge_assistant",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "KnowledgeAssistant",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Full resource name:\nsupervisor-agents/{supervisor_agent_id}/tools/{tool_id}",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tool_id",
+                "description": "User specified id of the Tool.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tool_type",
+                "description": "Tool type. Must be one of: \"genie_space\", \"knowledge_assistant\", \"uc_function\", \"uc_connection\", \"uc_mcp\", \"app\", \"volume\", \"dashboard\", \"serving_endpoint\", \"table\", \"vector_search_index\", \"catalog\", \"schema\", \"supervisor_agent\", \"databricks_web_search\", \"skill\". The legacy values \"lakeview_dashboard\", \"uc_table\", and \"web_search\" are also accepted and remain equivalent to \"dashboard\", \"table\", and \"databricks_web_search\" respectively. The \"databricks_web_search\" tool_type maps to the `web_search` spec field.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "uc_connection",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "UcConnection",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "uc_function",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "UcFunction",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "volume",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "Volume",
+                  "is_object": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "Parent resource where this tool will be created.\nFormat: supervisor-agents/{supervisor_agent_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tool_id",
+                "description": "The ID to use for the tool, which will become the final component of\nthe tool's resource name.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tool_type",
+                "description": "Tool type. Must be one of: \"genie_space\", \"knowledge_assistant\", \"uc_function\", \"uc_connection\", \"uc_mcp\", \"app\", \"volume\", \"dashboard\", \"serving_endpoint\", \"table\", \"vector_search_index\", \"catalog\", \"schema\", \"supervisor_agent\", \"databricks_web_search\", \"skill\". The legacy values \"lakeview_dashboard\", \"uc_table\", and \"web_search\" are also accepted and remain equivalent to \"dashboard\", \"table\", and \"databricks_web_search\" respectively. The \"databricks_web_search\" tool_type maps to the `web_search` spec field.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteExample",
+            "description": "Deletes an example from a Supervisor Agent.",
+            "summary": "Delete an example from a Supervisor Agent.",
+            "path": "/api/2.1/{name=supervisor-agents/*/examples/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "DeleteExampleRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the example to delete.\nFormat: supervisor-agents/{supervisor_agent_id}/examples/{example_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the example to delete.\nFormat: supervisor-agents/{supervisor_agent_id}/examples/{example_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The resource name of the example to delete.\nFormat: supervisor-agents/{supervisor_agent_id}/examples/{example_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The resource name of the example to delete.\nFormat: supervisor-agents/{supervisor_agent_id}/examples/{example_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteSupervisorAgent",
+            "description": "Deletes a Supervisor Agent.",
+            "summary": "Delete a Supervisor Agent.",
+            "path": "/api/2.1/{name=supervisor-agents/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "DeleteSupervisorAgentRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the Supervisor Agent.\nFormat: supervisor-agents/{supervisor_agent_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the Supervisor Agent.\nFormat: supervisor-agents/{supervisor_agent_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The resource name of the Supervisor Agent.\nFormat: supervisor-agents/{supervisor_agent_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The resource name of the Supervisor Agent.\nFormat: supervisor-agents/{supervisor_agent_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteTool",
+            "description": "Deletes a Tool.",
+            "summary": "Delete a Tool.",
+            "path": "/api/2.1/{name=supervisor-agents/*/tools/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "DeleteToolRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the Tool.\nFormat: supervisor-agents/{supervisor_agent_id}/tools/{tool_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the Tool.\nFormat: supervisor-agents/{supervisor_agent_id}/tools/{tool_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The resource name of the Tool.\nFormat: supervisor-agents/{supervisor_agent_id}/tools/{tool_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The resource name of the Tool.\nFormat: supervisor-agents/{supervisor_agent_id}/tools/{tool_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetExample",
+            "description": "Gets an example from a Supervisor Agent.",
+            "summary": "Get an example from a Supervisor Agent.",
+            "path": "/api/2.1/{name=supervisor-agents/*/examples/*}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetExampleRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the example.\nFormat: supervisor-agents/{supervisor_agent_id}/examples/{example_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the example.\nFormat: supervisor-agents/{supervisor_agent_id}/examples/{example_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Example",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "question",
+                  "description": "The example question.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "guidelines",
+                  "description": "Guidelines for answering the question.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "List",
+                    "array_value": {
+                      "is_string": true
+                    }
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "question",
+                  "description": "The example question.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "guidelines",
+                  "description": "Guidelines for answering the question.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "List",
+                    "array_value": {
+                      "is_string": true
+                    }
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The resource name of the example.\nFormat: supervisor-agents/{supervisor_agent_id}/examples/{example_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The resource name of the example.\nFormat: supervisor-agents/{supervisor_agent_id}/examples/{example_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetPermissionLevels",
+            "description": "Gets the permission levels that a user can have on an object.",
+            "summary": "Get supervisor agent permission levels.",
+            "path": "/api/2.0/permissions/supervisor-agents/{supervisor_agent_id}/permissionLevels",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetSupervisorAgentPermissionLevelsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "supervisor_agent_id",
+                  "description": "The supervisor agent for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "supervisor_agent_id",
+                  "description": "The supervisor agent for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetSupervisorAgentPermissionLevelsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "supervisor_agent_id",
+                "description": "The supervisor agent for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "supervisor_agent_id",
+                "description": "The supervisor agent for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetPermissions",
+            "description": "Gets the permissions of a supervisor agent. Supervisor agents can inherit permissions from their root object.",
+            "summary": "Get supervisor agent permissions.",
+            "path": "/api/2.0/permissions/supervisor-agents/{supervisor_agent_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetSupervisorAgentPermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "supervisor_agent_id",
+                  "description": "The supervisor agent for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "supervisor_agent_id",
+                  "description": "The supervisor agent for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "SupervisorAgentPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "supervisor_agent_id",
+                "description": "The supervisor agent for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "supervisor_agent_id",
+                "description": "The supervisor agent for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetSupervisorAgent",
+            "description": "Gets a Supervisor Agent.",
+            "summary": "Get a Supervisor Agent.",
+            "path": "/api/2.1/{name=supervisor-agents/*}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetSupervisorAgentRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the Supervisor Agent.\nFormat: supervisor-agents/{supervisor_agent_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the Supervisor Agent.\nFormat: supervisor-agents/{supervisor_agent_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "SupervisorAgent",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "display_name",
+                  "description": "The display name of the Supervisor Agent, unique at workspace level.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "display_name",
+                  "description": "The display name of the Supervisor Agent, unique at workspace level.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The resource name of the Supervisor Agent.\nFormat: supervisor-agents/{supervisor_agent_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The resource name of the Supervisor Agent.\nFormat: supervisor-agents/{supervisor_agent_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetTool",
+            "description": "Gets a Tool.",
+            "summary": "Get a Tool.",
+            "path": "/api/2.1/{name=supervisor-agents/*/tools/*}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetToolRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the Tool.\nFormat: supervisor-agents/{supervisor_agent_id}/tools/{tool_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the Tool.\nFormat: supervisor-agents/{supervisor_agent_id}/tools/{tool_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Tool",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "tool_type",
+                  "description": "Tool type. Must be one of: \"genie_space\", \"knowledge_assistant\", \"uc_function\", \"uc_connection\", \"uc_mcp\", \"app\", \"volume\", \"dashboard\", \"serving_endpoint\", \"table\", \"vector_search_index\", \"catalog\", \"schema\", \"supervisor_agent\", \"databricks_web_search\", \"skill\". The legacy values \"lakeview_dashboard\", \"uc_table\", and \"web_search\" are also accepted and remain equivalent to \"dashboard\", \"table\", and \"databricks_web_search\" respectively. The \"databricks_web_search\" tool_type maps to the `web_search` spec field.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "tool_type",
+                  "description": "Tool type. Must be one of: \"genie_space\", \"knowledge_assistant\", \"uc_function\", \"uc_connection\", \"uc_mcp\", \"app\", \"volume\", \"dashboard\", \"serving_endpoint\", \"table\", \"vector_search_index\", \"catalog\", \"schema\", \"supervisor_agent\", \"databricks_web_search\", \"skill\". The legacy values \"lakeview_dashboard\", \"uc_table\", and \"web_search\" are also accepted and remain equivalent to \"dashboard\", \"table\", and \"databricks_web_search\" respectively. The \"databricks_web_search\" tool_type maps to the `web_search` spec field.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The resource name of the Tool.\nFormat: supervisor-agents/{supervisor_agent_id}/tools/{tool_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The resource name of the Tool.\nFormat: supervisor-agents/{supervisor_agent_id}/tools/{tool_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListExamples",
+            "description": "Lists examples under a Supervisor Agent.",
+            "summary": "List examples for a Supervisor Agent.",
+            "path": "/api/2.1/{parent=supervisor-agents/*}/examples",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ListExamplesRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "Parent resource to list from.\nFormat: supervisor-agents/{supervisor_agent_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "Parent resource to list from.\nFormat: supervisor-agents/{supervisor_agent_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListExamplesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "The maximum number of examples to return.\nIf unspecified, at most 100 examples will be returned.\nThe maximum value is 100; values above 100 will be coerced to 100.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "A page token, received from a previous `ListExamples` call.\nProvide this to retrieve the subsequent page.\nIf unspecified, the first page will be returned.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "Parent resource to list from.\nFormat: supervisor-agents/{supervisor_agent_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "Parent resource to list from.\nFormat: supervisor-agents/{supervisor_agent_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "A page token, received from a previous `ListExamples` call.\nProvide this to retrieve the subsequent page.\nIf unspecified, the first page will be returned.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListSupervisorAgents",
+            "description": "Lists Supervisor Agents.",
+            "summary": "List Supervisor Agents.",
+            "path": "/api/2.1/supervisor-agents",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ListSupervisorAgentsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListSupervisorAgentsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "The maximum number of supervisor agents to return.\nIf unspecified, at most 100 supervisor agents will be returned.\nThe maximum value is 100; values above 100 will be coerced to 100.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "A page token, received from a previous `ListSupervisorAgents` call.\nProvide this to retrieve the subsequent page.\nIf unspecified, the first page will be returned.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "A page token, received from a previous `ListSupervisorAgents` call.\nProvide this to retrieve the subsequent page.\nIf unspecified, the first page will be returned.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListTools",
+            "description": "Lists Tools under a Supervisor Agent.",
+            "summary": "List Tools.",
+            "path": "/api/2.1/{parent=supervisor-agents/*}/tools",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ListToolsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "parent",
+                  "description": "Parent resource to list from.\nFormat: supervisor-agents/{supervisor_agent_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "parent",
+                  "description": "Parent resource to list from.\nFormat: supervisor-agents/{supervisor_agent_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListToolsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "parent",
+                "description": "Parent resource to list from.\nFormat: supervisor-agents/{supervisor_agent_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "parent",
+                "description": "Parent resource to list from.\nFormat: supervisor-agents/{supervisor_agent_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "SetPermissions",
+            "description": "Sets permissions on an object, replacing existing permissions if they exist. Deletes all direct permissions if none are specified. Objects can inherit permissions from their root object.",
+            "summary": "Set supervisor agent permissions.",
+            "path": "/api/2.0/permissions/supervisor-agents/{supervisor_agent_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "SupervisorAgentPermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "supervisor_agent_id",
+                  "description": "The supervisor agent for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "supervisor_agent_id",
+                  "description": "The supervisor agent for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "SupervisorAgentPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "access_control_list",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "SupervisorAgentAccessControlRequestList",
+                  "array_value": {
+                    "pascal_name": "SupervisorAgentAccessControlRequest",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "supervisor_agent_id",
+                "description": "The supervisor agent for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "supervisor_agent_id",
+                "description": "The supervisor agent for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateExample",
+            "description": "Updates an example in a Supervisor Agent.",
+            "summary": "Update an example in a Supervisor Agent.",
+            "path": "/api/2.1/{name=supervisor-agents/*/examples/*}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "UpdateExampleRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the example to update.\nFormat: supervisor-agents/{supervisor_agent_id}/examples/{example_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "example",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Example",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Comma-delimited list of fields to update on the example.\nAllowed values: `question`, `guidelines`.\nExamples:\n- `question`\n- `question,guidelines`",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the example to update.\nFormat: supervisor-agents/{supervisor_agent_id}/examples/{example_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Comma-delimited list of fields to update on the example.\nAllowed values: `question`, `guidelines`.\nExamples:\n- `question`\n- `question,guidelines`",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "example",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Example",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "example",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Example",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "question",
+                    "description": "The example question.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "guidelines",
+                    "description": "Guidelines for answering the question.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "List",
+                      "array_value": {
+                        "is_string": true
+                      }
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "question",
+                    "description": "The example question.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "guidelines",
+                    "description": "Guidelines for answering the question.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "List",
+                      "array_value": {
+                        "is_string": true
+                      }
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "Example",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "question",
+                  "description": "The example question.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "guidelines",
+                  "description": "Guidelines for answering the question.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "List",
+                    "array_value": {
+                      "is_string": true
+                    }
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "question",
+                  "description": "The example question.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "guidelines",
+                  "description": "Guidelines for answering the question.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "List",
+                    "array_value": {
+                      "is_string": true
+                    }
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "example",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Example",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "question",
+                      "description": "The example question.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "guidelines",
+                      "description": "Guidelines for answering the question.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "List",
+                        "array_value": {
+                          "is_string": true
+                        }
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "question",
+                      "description": "The example question.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "guidelines",
+                      "description": "Guidelines for answering the question.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "List",
+                        "array_value": {
+                          "is_string": true
+                        }
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "name",
+                "description": "The resource name of the example to update.\nFormat: supervisor-agents/{supervisor_agent_id}/examples/{example_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Comma-delimited list of fields to update on the example.\nAllowed values: `question`, `guidelines`.\nExamples:\n- `question`\n- `question,guidelines`",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "example_id",
+                "description": "The universally unique identifier (UUID) of the example.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "guidelines",
+                "description": "Guidelines for answering the question.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "name",
+                "description": "Full resource name:\nsupervisor-agents/{supervisor_agent_id}/examples/{example_id}",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "question",
+                "description": "The example question.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The resource name of the example to update.\nFormat: supervisor-agents/{supervisor_agent_id}/examples/{example_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Comma-delimited list of fields to update on the example.\nAllowed values: `question`, `guidelines`.\nExamples:\n- `question`\n- `question,guidelines`",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "question",
+                "description": "The example question.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "guidelines",
+                "description": "Guidelines for answering the question.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdatePermissions",
+            "description": "Updates the permissions on a supervisor agent. Supervisor agents can inherit permissions from their root object.",
+            "summary": "Update supervisor agent permissions.",
+            "path": "/api/2.0/permissions/supervisor-agents/{supervisor_agent_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "SupervisorAgentPermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "supervisor_agent_id",
+                  "description": "The supervisor agent for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "supervisor_agent_id",
+                  "description": "The supervisor agent for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "SupervisorAgentPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "access_control_list",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "SupervisorAgentAccessControlRequestList",
+                  "array_value": {
+                    "pascal_name": "SupervisorAgentAccessControlRequest",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "supervisor_agent_id",
+                "description": "The supervisor agent for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "supervisor_agent_id",
+                "description": "The supervisor agent for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateSupervisorAgent",
+            "description": "Updates a Supervisor Agent. The fields that are required depend on the paths specified in `update_mask`.\nOnly fields included in the mask will be updated.",
+            "summary": "Update a Supervisor Agent.",
+            "path": "/api/2.1/{name=supervisor-agents/*}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "UpdateSupervisorAgentRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the SupervisorAgent.\nFormat: supervisor-agents/{supervisor_agent_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "supervisor_agent",
+                  "description": "The SupervisorAgent to update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "SupervisorAgent",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Field mask for fields to be updated.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the SupervisorAgent.\nFormat: supervisor-agents/{supervisor_agent_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Field mask for fields to be updated.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "supervisor_agent",
+                  "description": "The SupervisorAgent to update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "SupervisorAgent",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "supervisor_agent",
+              "description": "The SupervisorAgent to update.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "SupervisorAgent",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "display_name",
+                    "description": "The display name of the Supervisor Agent, unique at workspace level.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "display_name",
+                    "description": "The display name of the Supervisor Agent, unique at workspace level.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "SupervisorAgent",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "display_name",
+                  "description": "The display name of the Supervisor Agent, unique at workspace level.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "display_name",
+                  "description": "The display name of the Supervisor Agent, unique at workspace level.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The resource name of the SupervisorAgent.\nFormat: supervisor-agents/{supervisor_agent_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "supervisor_agent",
+                "description": "The SupervisorAgent to update.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "SupervisorAgent",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "display_name",
+                      "description": "The display name of the Supervisor Agent, unique at workspace level.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "display_name",
+                      "description": "The display name of the Supervisor Agent, unique at workspace level.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Field mask for fields to be updated.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Creation timestamp.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "is_timestamp": true
+                }
+              },
+              {
+                "name": "creator",
+                "description": "The creator of the Supervisor Agent.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "Description of what this agent can do (user-facing).",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "The display name of the Supervisor Agent, unique at workspace level.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "endpoint_name",
+                "description": "The name of the supervisor agent's serving endpoint.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "experiment_id",
+                "description": "The MLflow experiment ID.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "id",
+                "description": "Deprecated: Use supervisor_agent_id instead.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "instructions",
+                "description": "Optional natural-language instructions for the supervisor agent.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The resource name of the SupervisorAgent.\nFormat: supervisor-agents/{supervisor_agent_id}",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "supervisor_agent_id",
+                "description": "The universally unique identifier (UUID) of the Supervisor Agent.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The resource name of the SupervisorAgent.\nFormat: supervisor-agents/{supervisor_agent_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Field mask for fields to be updated.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "The display name of the Supervisor Agent, unique at workspace level.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateTool",
+            "description": "Updates a Tool. Only the `description` field can be updated.\nTo change immutable fields such as tool type, spec, or tool ID, delete the tool and recreate it.",
+            "summary": "Update a Tool.",
+            "path": "/api/2.1/{name=supervisor-agents/*/tools/*}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "UpdateToolRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Full resource name:\nsupervisor-agents/{supervisor_agent_id}/tools/{tool_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "tool",
+                  "description": "The Tool to update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Tool",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Field mask for fields to be updated.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Full resource name:\nsupervisor-agents/{supervisor_agent_id}/tools/{tool_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Field mask for fields to be updated.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "tool",
+                  "description": "The Tool to update.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Tool",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "tool",
+              "description": "The Tool to update.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Tool",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "tool_type",
+                    "description": "Tool type. Must be one of: \"genie_space\", \"knowledge_assistant\", \"uc_function\", \"uc_connection\", \"uc_mcp\", \"app\", \"volume\", \"dashboard\", \"serving_endpoint\", \"table\", \"vector_search_index\", \"catalog\", \"schema\", \"supervisor_agent\", \"databricks_web_search\", \"skill\". The legacy values \"lakeview_dashboard\", \"uc_table\", and \"web_search\" are also accepted and remain equivalent to \"dashboard\", \"table\", and \"databricks_web_search\" respectively. The \"databricks_web_search\" tool_type maps to the `web_search` spec field.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "tool_type",
+                    "description": "Tool type. Must be one of: \"genie_space\", \"knowledge_assistant\", \"uc_function\", \"uc_connection\", \"uc_mcp\", \"app\", \"volume\", \"dashboard\", \"serving_endpoint\", \"table\", \"vector_search_index\", \"catalog\", \"schema\", \"supervisor_agent\", \"databricks_web_search\", \"skill\". The legacy values \"lakeview_dashboard\", \"uc_table\", and \"web_search\" are also accepted and remain equivalent to \"dashboard\", \"table\", and \"databricks_web_search\" respectively. The \"databricks_web_search\" tool_type maps to the `web_search` spec field.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "Tool",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "tool_type",
+                  "description": "Tool type. Must be one of: \"genie_space\", \"knowledge_assistant\", \"uc_function\", \"uc_connection\", \"uc_mcp\", \"app\", \"volume\", \"dashboard\", \"serving_endpoint\", \"table\", \"vector_search_index\", \"catalog\", \"schema\", \"supervisor_agent\", \"databricks_web_search\", \"skill\". The legacy values \"lakeview_dashboard\", \"uc_table\", and \"web_search\" are also accepted and remain equivalent to \"dashboard\", \"table\", and \"databricks_web_search\" respectively. The \"databricks_web_search\" tool_type maps to the `web_search` spec field.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "tool_type",
+                  "description": "Tool type. Must be one of: \"genie_space\", \"knowledge_assistant\", \"uc_function\", \"uc_connection\", \"uc_mcp\", \"app\", \"volume\", \"dashboard\", \"serving_endpoint\", \"table\", \"vector_search_index\", \"catalog\", \"schema\", \"supervisor_agent\", \"databricks_web_search\", \"skill\". The legacy values \"lakeview_dashboard\", \"uc_table\", and \"web_search\" are also accepted and remain equivalent to \"dashboard\", \"table\", and \"databricks_web_search\" respectively. The \"databricks_web_search\" tool_type maps to the `web_search` spec field.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Full resource name:\nsupervisor-agents/{supervisor_agent_id}/tools/{tool_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tool",
+                "description": "The Tool to update.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Tool",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "tool_type",
+                      "description": "Tool type. Must be one of: \"genie_space\", \"knowledge_assistant\", \"uc_function\", \"uc_connection\", \"uc_mcp\", \"app\", \"volume\", \"dashboard\", \"serving_endpoint\", \"table\", \"vector_search_index\", \"catalog\", \"schema\", \"supervisor_agent\", \"databricks_web_search\", \"skill\". The legacy values \"lakeview_dashboard\", \"uc_table\", and \"web_search\" are also accepted and remain equivalent to \"dashboard\", \"table\", and \"databricks_web_search\" respectively. The \"databricks_web_search\" tool_type maps to the `web_search` spec field.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "tool_type",
+                      "description": "Tool type. Must be one of: \"genie_space\", \"knowledge_assistant\", \"uc_function\", \"uc_connection\", \"uc_mcp\", \"app\", \"volume\", \"dashboard\", \"serving_endpoint\", \"table\", \"vector_search_index\", \"catalog\", \"schema\", \"supervisor_agent\", \"databricks_web_search\", \"skill\". The legacy values \"lakeview_dashboard\", \"uc_table\", and \"web_search\" are also accepted and remain equivalent to \"dashboard\", \"table\", and \"databricks_web_search\" respectively. The \"databricks_web_search\" tool_type maps to the `web_search` spec field.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Field mask for fields to be updated.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "app",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "App",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "description",
+                "description": "Description of what this tool does (user-facing).",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "genie_space",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "GenieSpace",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "id",
+                "description": "Deprecated: Use tool_id instead.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "knowledge_assistant",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "KnowledgeAssistant",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Full resource name:\nsupervisor-agents/{supervisor_agent_id}/tools/{tool_id}",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tool_id",
+                "description": "User specified id of the Tool.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tool_type",
+                "description": "Tool type. Must be one of: \"genie_space\", \"knowledge_assistant\", \"uc_function\", \"uc_connection\", \"uc_mcp\", \"app\", \"volume\", \"dashboard\", \"serving_endpoint\", \"table\", \"vector_search_index\", \"catalog\", \"schema\", \"supervisor_agent\", \"databricks_web_search\", \"skill\". The legacy values \"lakeview_dashboard\", \"uc_table\", and \"web_search\" are also accepted and remain equivalent to \"dashboard\", \"table\", and \"databricks_web_search\" respectively. The \"databricks_web_search\" tool_type maps to the `web_search` spec field.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "uc_connection",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "UcConnection",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "uc_function",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "UcFunction",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "volume",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "Volume",
+                  "is_object": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Full resource name:\nsupervisor-agents/{supervisor_agent_id}/tools/{tool_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Field mask for fields to be updated.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "tool_type",
+                "description": "Tool type. Must be one of: \"genie_space\", \"knowledge_assistant\", \"uc_function\", \"uc_connection\", \"uc_mcp\", \"app\", \"volume\", \"dashboard\", \"serving_endpoint\", \"table\", \"vector_search_index\", \"catalog\", \"schema\", \"supervisor_agent\", \"databricks_web_search\", \"skill\". The legacy values \"lakeview_dashboard\", \"uc_table\", and \"web_search\" are also accepted and remain equivalent to \"dashboard\", \"table\", and \"databricks_web_search\" respectively. The \"databricks_web_search\" tool_type maps to the `web_search` spec field.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "catalog.SystemSchemas",
+        "name": "SystemSchemas",
+        "description": "A system schema is a schema that lives within the system catalog. A system schema may contain\ninformation about customer usage of Unity Catalog such as audit logs, billing logs,\nand lineage information.",
+        "package": {
+          "name": "catalog"
+        },
+        "docs_group": "catalog",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "list": {
+          "request": {
+            "pascal_name": "ListSystemSchemasRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Disable",
+            "description": "Disables the system schema and removes it from the system catalog.\nThe caller must be an account admin or a metastore admin.",
+            "summary": "Disable a system schema.",
+            "path": "/api/2.1/unity-catalog/metastores/{metastore_id}/systemschemas/{schema_name}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "DisableRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "metastore_id",
+                  "description": "The metastore ID under which the system schema lives.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schema_name",
+                  "description": "Full name of the system schema.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "metastore_id",
+                  "description": "The metastore ID under which the system schema lives.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schema_name",
+                  "description": "Full name of the system schema.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DisableResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "metastore_id",
+                "description": "The metastore ID under which the system schema lives.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schema_name",
+                "description": "Full name of the system schema.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "metastore_id",
+                "description": "The metastore ID under which the system schema lives.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schema_name",
+                "description": "Full name of the system schema.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Enable",
+            "description": "Enables the system schema and adds it to the system catalog.\nThe caller must be an account admin or a metastore admin.",
+            "summary": "Enable a system schema.",
+            "path": "/api/2.1/unity-catalog/metastores/{metastore_id}/systemschemas/{schema_name}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "EnableRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "metastore_id",
+                  "description": "The metastore ID under which the system schema lives.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schema_name",
+                  "description": "Full name of the system schema.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "metastore_id",
+                  "description": "The metastore ID under which the system schema lives.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schema_name",
+                  "description": "Full name of the system schema.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "EnableResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "catalog_name",
+                "description": "the catalog for which the system schema is to enabled in",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "metastore_id",
+                "description": "The metastore ID under which the system schema lives.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schema_name",
+                "description": "Full name of the system schema.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "metastore_id",
+                "description": "The metastore ID under which the system schema lives.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schema_name",
+                "description": "Full name of the system schema.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Gets an array of system schemas for a metastore.\nThe caller must be an account admin or a metastore admin.\n\nNOTE: we recommend using max_results=0 to use the paginated version of this API. Unpaginated calls will be deprecated soon.\n\nPAGINATION BEHAVIOR: When using pagination (max_results \u003e= 0), a page may contain zero results while still providing a next_page_token.\nClients must continue reading pages until next_page_token is absent, which is the only indication that the end of results has been reached.",
+            "summary": "List system schemas.",
+            "path": "/api/2.1/unity-catalog/metastores/{metastore_id}/systemschemas",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "ListSystemSchemasRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "metastore_id",
+                  "description": "The ID for the metastore in which the system schema resides.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "metastore_id",
+                  "description": "The ID for the metastore in which the system schema resides.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListSystemSchemasResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "max_results",
+                "description": "Maximum number of schemas to return.\n- When set to 0, the page length is set to a server configured value (recommended);\n- When set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- When set to a value less than 0, an invalid parameter error is returned;\n- If not set, all the schemas are returned (not recommended).",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "metastore_id",
+                "description": "The ID for the metastore in which the system schema resides.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque pagination token to go to next page based on previous query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "metastore_id",
+                "description": "The ID for the metastore in which the system schema resides.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Opaque pagination token to go to next page based on previous query.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              },
+              "max_results": {
+                "name": "max_results",
+                "description": "Maximum number of schemas to return.\n- When set to 0, the page length is set to a server configured value (recommended);\n- When set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- When set to a value less than 0, an invalid parameter error is returned;\n- If not set, all the schemas are returned (not recommended).",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              }
+            }
+          }
+        ]
+      },
+      {
+        "id": "catalog.TableConstraints",
+        "name": "TableConstraints",
+        "description": "Primary key and foreign key constraints encode relationships between fields in tables.\n\nPrimary and foreign keys are informational only and are not enforced. Foreign keys must reference a primary key in another table.\nThis primary key is the parent constraint of the foreign key, and the table this primary key is on is the parent table of the foreign key.\nSimilarly, the foreign key is the child constraint of its referenced primary key. The table of the foreign key is the child table of the primary key.\n\nYou can declare primary keys and foreign keys as part of the table specification during table creation.\nYou can also add or drop constraints on existing tables.",
+        "package": {
+          "name": "catalog"
+        },
+        "docs_group": "catalog",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a new table constraint.\n\nFor the table constraint creation to succeed, the user must satisfy both of these conditions:\n- the user must have the **USE_CATALOG** privilege on the table's parent catalog,\nthe **USE_SCHEMA** privilege on the table's parent schema, and be the owner of the table.\n- if the new constraint is a __ForeignKeyConstraint__,\nthe user must have the **USE_CATALOG** privilege on the referenced parent table's catalog,\nthe **USE_SCHEMA** privilege on the referenced parent table's schema,\nand be the owner of the referenced parent table.",
+            "summary": "Create a table constraint.",
+            "path": "/api/2.1/unity-catalog/constraints",
+            "can_use_json": true,
+            "must_use_json": true,
+            "is_crud_create": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateTableConstraint",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "full_name_arg",
+                  "description": "The full name of the table referenced by the constraint.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "constraint",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "TableConstraint",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "full_name_arg",
+                  "description": "The full name of the table referenced by the constraint.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "constraint",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "TableConstraint",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "TableConstraint",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "constraint",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "TableConstraint",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "full_name_arg",
+                "description": "The full name of the table referenced by the constraint.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes a table constraint.\n\nFor the table constraint deletion to succeed, the user must satisfy both of these conditions:\n- the user must have the **USE_CATALOG** privilege on the table's parent catalog,\nthe **USE_SCHEMA** privilege on the table's parent schema, and be the owner of the table.\n- if __cascade__ argument is **true**, the user must have the following permissions on all of the child tables:\nthe **USE_CATALOG** privilege on the table's catalog,\nthe **USE_SCHEMA** privilege on the table's schema,\nand be the owner of the table.",
+            "summary": "Delete a table constraint.",
+            "path": "/api/2.1/unity-catalog/constraints/{full_name}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteTableConstraintRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "full_name",
+                  "description": "Full name of the table referenced by the constraint.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "constraint_name",
+                  "description": "The name of the constraint to delete.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "cascade",
+                  "description": "If true, try deleting all child constraints of the current constraint.\nIf false, reject this operation if the current constraint has any child constraints.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "full_name",
+                  "description": "Full name of the table referenced by the constraint.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "constraint_name",
+                  "description": "The name of the constraint to delete.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "cascade",
+                  "description": "If true, try deleting all child constraints of the current constraint.\nIf false, reject this operation if the current constraint has any child constraints.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_bool": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteTableConstraintResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "cascade",
+                "description": "If true, try deleting all child constraints of the current constraint.\nIf false, reject this operation if the current constraint has any child constraints.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "constraint_name",
+                "description": "The name of the constraint to delete.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "full_name",
+                "description": "Full name of the table referenced by the constraint.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "full_name",
+                "description": "Full name of the table referenced by the constraint.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "constraint_name",
+                "description": "The name of the constraint to delete.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "cascade",
+                "description": "If true, try deleting all child constraints of the current constraint.\nIf false, reject this operation if the current constraint has any child constraints.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "catalog.Tables",
+        "name": "Tables",
+        "description": "A table resides in the third layer of Unity Catalog’s three-level namespace. It contains\nrows of data. To create a table, users must have CREATE_TABLE and USE_SCHEMA permissions on the schema,\nand they must have the USE_CATALOG permission on its parent catalog. To query a table, users must\nhave the SELECT permission on the table, and they must have the USE_CATALOG permission on its\nparent catalog and the USE_SCHEMA permission on its parent schema.\n\nA table can be managed or external.\nFrom an API perspective, a __VIEW__ is a particular kind of table (rather than a managed or external table).",
+        "package": {
+          "name": "catalog"
+        },
+        "docs_group": "catalog",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListTablesRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a new table in the specified catalog and schema.\n\nTo create an external delta table, the caller must have the **EXTERNAL_USE_SCHEMA** privilege on the parent schema\nand the **EXTERNAL_USE_LOCATION** privilege on the external location. These privileges must always be granted explicitly,\nand cannot be inherited through ownership or **ALL_PRIVILEGES**.\n\nStandard UC permissions needed to create tables still apply: **USE_CATALOG** on the parent catalog (or ownership of\nthe parent catalog), **CREATE_TABLE** and **USE_SCHEMA** on the parent schema (or ownership of the parent schema),\nand **CREATE_EXTERNAL_TABLE** on external location.\n\nThe **columns** field needs to be in a Spark compatible format, so we recommend you use Spark to create these tables.\nThe API itself does not validate the correctness of the column spec. If the spec is not Spark compatible,\nthe tables may not be readable by Databricks Runtime.\n\nNOTE: The Create Table API for external clients only supports creating **external delta tables**. The values shown\nin the respective enums are all values supported by Databricks, however for this specific Create Table API,\nonly **table_type** **EXTERNAL** and **data_source_format** **DELTA** are supported. Additionally, column masks\nare not supported when creating tables through this API.",
+            "summary": "Create a table.",
+            "path": "/api/2.1/unity-catalog/tables",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "CreateTableRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of table, relative to parent schema.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "catalog_name",
+                  "description": "Name of parent catalog.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schema_name",
+                  "description": "Name of parent schema relative to its parent catalog.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "table_type",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "TableType",
+                    "enum": [
+                      {
+                        "content": "EXTERNAL"
+                      },
+                      {
+                        "content": "EXTERNAL_SHALLOW_CLONE"
+                      },
+                      {
+                        "content": "FOREIGN"
+                      },
+                      {
+                        "content": "MANAGED"
+                      },
+                      {
+                        "content": "MANAGED_SHALLOW_CLONE"
+                      },
+                      {
+                        "content": "MATERIALIZED_VIEW"
+                      },
+                      {
+                        "content": "METRIC_VIEW"
+                      },
+                      {
+                        "content": "STREAMING_TABLE"
+                      },
+                      {
+                        "content": "VIEW"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "data_source_format",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DataSourceFormat",
+                    "enum": [
+                      {
+                        "content": "AVRO"
+                      },
+                      {
+                        "content": "BIGQUERY_FORMAT"
+                      },
+                      {
+                        "content": "CSV"
+                      },
+                      {
+                        "content": "DATABRICKS_FORMAT"
+                      },
+                      {
+                        "content": "DATABRICKS_ROW_STORE_FORMAT"
+                      },
+                      {
+                        "content": "DELTA"
+                      },
+                      {
+                        "content": "DELTASHARING"
+                      },
+                      {
+                        "content": "DELTA_UNIFORM_HUDI"
+                      },
+                      {
+                        "content": "DELTA_UNIFORM_ICEBERG"
+                      },
+                      {
+                        "content": "HIVE"
+                      },
+                      {
+                        "content": "ICEBERG"
+                      },
+                      {
+                        "content": "JSON"
+                      },
+                      {
+                        "content": "MONGODB_FORMAT"
+                      },
+                      {
+                        "content": "MYSQL_FORMAT"
+                      },
+                      {
+                        "content": "NETSUITE_FORMAT"
+                      },
+                      {
+                        "content": "ORACLE_FORMAT"
+                      },
+                      {
+                        "content": "ORC"
+                      },
+                      {
+                        "content": "PARQUET"
+                      },
+                      {
+                        "content": "POSTGRESQL_FORMAT"
+                      },
+                      {
+                        "content": "REDSHIFT_FORMAT"
+                      },
+                      {
+                        "content": "SALESFORCE_DATA_CLOUD_FORMAT"
+                      },
+                      {
+                        "content": "SALESFORCE_FORMAT"
+                      },
+                      {
+                        "content": "SNOWFLAKE_FORMAT"
+                      },
+                      {
+                        "content": "SQLDW_FORMAT"
+                      },
+                      {
+                        "content": "SQLSERVER_FORMAT"
+                      },
+                      {
+                        "content": "TERADATA_FORMAT"
+                      },
+                      {
+                        "content": "TEXT"
+                      },
+                      {
+                        "content": "UNITY_CATALOG"
+                      },
+                      {
+                        "content": "VECTOR_INDEX_FORMAT"
+                      },
+                      {
+                        "content": "WORKDAY_RAAS_FORMAT"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "storage_location",
+                  "description": "Storage root URL for table (for **MANAGED**, **EXTERNAL** tables).",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of table, relative to parent schema.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "catalog_name",
+                  "description": "Name of parent catalog.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schema_name",
+                  "description": "Name of parent schema relative to its parent catalog.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "table_type",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "TableType",
+                    "enum": [
+                      {
+                        "content": "EXTERNAL"
+                      },
+                      {
+                        "content": "EXTERNAL_SHALLOW_CLONE"
+                      },
+                      {
+                        "content": "FOREIGN"
+                      },
+                      {
+                        "content": "MANAGED"
+                      },
+                      {
+                        "content": "MANAGED_SHALLOW_CLONE"
+                      },
+                      {
+                        "content": "MATERIALIZED_VIEW"
+                      },
+                      {
+                        "content": "METRIC_VIEW"
+                      },
+                      {
+                        "content": "STREAMING_TABLE"
+                      },
+                      {
+                        "content": "VIEW"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "data_source_format",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DataSourceFormat",
+                    "enum": [
+                      {
+                        "content": "AVRO"
+                      },
+                      {
+                        "content": "BIGQUERY_FORMAT"
+                      },
+                      {
+                        "content": "CSV"
+                      },
+                      {
+                        "content": "DATABRICKS_FORMAT"
+                      },
+                      {
+                        "content": "DATABRICKS_ROW_STORE_FORMAT"
+                      },
+                      {
+                        "content": "DELTA"
+                      },
+                      {
+                        "content": "DELTASHARING"
+                      },
+                      {
+                        "content": "DELTA_UNIFORM_HUDI"
+                      },
+                      {
+                        "content": "DELTA_UNIFORM_ICEBERG"
+                      },
+                      {
+                        "content": "HIVE"
+                      },
+                      {
+                        "content": "ICEBERG"
+                      },
+                      {
+                        "content": "JSON"
+                      },
+                      {
+                        "content": "MONGODB_FORMAT"
+                      },
+                      {
+                        "content": "MYSQL_FORMAT"
+                      },
+                      {
+                        "content": "NETSUITE_FORMAT"
+                      },
+                      {
+                        "content": "ORACLE_FORMAT"
+                      },
+                      {
+                        "content": "ORC"
+                      },
+                      {
+                        "content": "PARQUET"
+                      },
+                      {
+                        "content": "POSTGRESQL_FORMAT"
+                      },
+                      {
+                        "content": "REDSHIFT_FORMAT"
+                      },
+                      {
+                        "content": "SALESFORCE_DATA_CLOUD_FORMAT"
+                      },
+                      {
+                        "content": "SALESFORCE_FORMAT"
+                      },
+                      {
+                        "content": "SNOWFLAKE_FORMAT"
+                      },
+                      {
+                        "content": "SQLDW_FORMAT"
+                      },
+                      {
+                        "content": "SQLSERVER_FORMAT"
+                      },
+                      {
+                        "content": "TERADATA_FORMAT"
+                      },
+                      {
+                        "content": "TEXT"
+                      },
+                      {
+                        "content": "UNITY_CATALOG"
+                      },
+                      {
+                        "content": "VECTOR_INDEX_FORMAT"
+                      },
+                      {
+                        "content": "WORKDAY_RAAS_FORMAT"
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "storage_location",
+                  "description": "Storage root URL for table (for **MANAGED**, **EXTERNAL** tables).",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "TableInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "catalog_name",
+                "description": "Name of parent catalog.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "columns",
+                "description": "The array of __ColumnInfo__ definitions of the table's columns.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ColumnInfoList",
+                  "array_value": {
+                    "pascal_name": "ColumnInfo",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "data_source_format",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DataSourceFormat",
+                  "enum": [
+                    {
+                      "content": "AVRO"
+                    },
+                    {
+                      "content": "BIGQUERY_FORMAT"
+                    },
+                    {
+                      "content": "CSV"
+                    },
+                    {
+                      "content": "DATABRICKS_FORMAT"
+                    },
+                    {
+                      "content": "DATABRICKS_ROW_STORE_FORMAT"
+                    },
+                    {
+                      "content": "DELTA"
+                    },
+                    {
+                      "content": "DELTASHARING"
+                    },
+                    {
+                      "content": "DELTA_UNIFORM_HUDI"
+                    },
+                    {
+                      "content": "DELTA_UNIFORM_ICEBERG"
+                    },
+                    {
+                      "content": "HIVE"
+                    },
+                    {
+                      "content": "ICEBERG"
+                    },
+                    {
+                      "content": "JSON"
+                    },
+                    {
+                      "content": "MONGODB_FORMAT"
+                    },
+                    {
+                      "content": "MYSQL_FORMAT"
+                    },
+                    {
+                      "content": "NETSUITE_FORMAT"
+                    },
+                    {
+                      "content": "ORACLE_FORMAT"
+                    },
+                    {
+                      "content": "ORC"
+                    },
+                    {
+                      "content": "PARQUET"
+                    },
+                    {
+                      "content": "POSTGRESQL_FORMAT"
+                    },
+                    {
+                      "content": "REDSHIFT_FORMAT"
+                    },
+                    {
+                      "content": "SALESFORCE_DATA_CLOUD_FORMAT"
+                    },
+                    {
+                      "content": "SALESFORCE_FORMAT"
+                    },
+                    {
+                      "content": "SNOWFLAKE_FORMAT"
+                    },
+                    {
+                      "content": "SQLDW_FORMAT"
+                    },
+                    {
+                      "content": "SQLSERVER_FORMAT"
+                    },
+                    {
+                      "content": "TERADATA_FORMAT"
+                    },
+                    {
+                      "content": "TEXT"
+                    },
+                    {
+                      "content": "UNITY_CATALOG"
+                    },
+                    {
+                      "content": "VECTOR_INDEX_FORMAT"
+                    },
+                    {
+                      "content": "WORKDAY_RAAS_FORMAT"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of table, relative to parent schema.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "properties",
+                "description": "A map of key-value properties attached to the securable.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "schema_name",
+                "description": "Name of parent schema relative to its parent catalog.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "storage_location",
+                "description": "Storage root URL for table (for **MANAGED**, **EXTERNAL** tables).",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "table_type",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "TableType",
+                  "enum": [
+                    {
+                      "content": "EXTERNAL"
+                    },
+                    {
+                      "content": "EXTERNAL_SHALLOW_CLONE"
+                    },
+                    {
+                      "content": "FOREIGN"
+                    },
+                    {
+                      "content": "MANAGED"
+                    },
+                    {
+                      "content": "MANAGED_SHALLOW_CLONE"
+                    },
+                    {
+                      "content": "MATERIALIZED_VIEW"
+                    },
+                    {
+                      "content": "METRIC_VIEW"
+                    },
+                    {
+                      "content": "STREAMING_TABLE"
+                    },
+                    {
+                      "content": "VIEW"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of table, relative to parent schema.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "catalog_name",
+                "description": "Name of parent catalog.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schema_name",
+                "description": "Name of parent schema relative to its parent catalog.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "table_type",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "TableType",
+                  "enum": [
+                    {
+                      "content": "EXTERNAL"
+                    },
+                    {
+                      "content": "EXTERNAL_SHALLOW_CLONE"
+                    },
+                    {
+                      "content": "FOREIGN"
+                    },
+                    {
+                      "content": "MANAGED"
+                    },
+                    {
+                      "content": "MANAGED_SHALLOW_CLONE"
+                    },
+                    {
+                      "content": "MATERIALIZED_VIEW"
+                    },
+                    {
+                      "content": "METRIC_VIEW"
+                    },
+                    {
+                      "content": "STREAMING_TABLE"
+                    },
+                    {
+                      "content": "VIEW"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "data_source_format",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DataSourceFormat",
+                  "enum": [
+                    {
+                      "content": "AVRO"
+                    },
+                    {
+                      "content": "BIGQUERY_FORMAT"
+                    },
+                    {
+                      "content": "CSV"
+                    },
+                    {
+                      "content": "DATABRICKS_FORMAT"
+                    },
+                    {
+                      "content": "DATABRICKS_ROW_STORE_FORMAT"
+                    },
+                    {
+                      "content": "DELTA"
+                    },
+                    {
+                      "content": "DELTASHARING"
+                    },
+                    {
+                      "content": "DELTA_UNIFORM_HUDI"
+                    },
+                    {
+                      "content": "DELTA_UNIFORM_ICEBERG"
+                    },
+                    {
+                      "content": "HIVE"
+                    },
+                    {
+                      "content": "ICEBERG"
+                    },
+                    {
+                      "content": "JSON"
+                    },
+                    {
+                      "content": "MONGODB_FORMAT"
+                    },
+                    {
+                      "content": "MYSQL_FORMAT"
+                    },
+                    {
+                      "content": "NETSUITE_FORMAT"
+                    },
+                    {
+                      "content": "ORACLE_FORMAT"
+                    },
+                    {
+                      "content": "ORC"
+                    },
+                    {
+                      "content": "PARQUET"
+                    },
+                    {
+                      "content": "POSTGRESQL_FORMAT"
+                    },
+                    {
+                      "content": "REDSHIFT_FORMAT"
+                    },
+                    {
+                      "content": "SALESFORCE_DATA_CLOUD_FORMAT"
+                    },
+                    {
+                      "content": "SALESFORCE_FORMAT"
+                    },
+                    {
+                      "content": "SNOWFLAKE_FORMAT"
+                    },
+                    {
+                      "content": "SQLDW_FORMAT"
+                    },
+                    {
+                      "content": "SQLSERVER_FORMAT"
+                    },
+                    {
+                      "content": "TERADATA_FORMAT"
+                    },
+                    {
+                      "content": "TEXT"
+                    },
+                    {
+                      "content": "UNITY_CATALOG"
+                    },
+                    {
+                      "content": "VECTOR_INDEX_FORMAT"
+                    },
+                    {
+                      "content": "WORKDAY_RAAS_FORMAT"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "storage_location",
+                "description": "Storage root URL for table (for **MANAGED**, **EXTERNAL** tables).",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes a table from the specified parent catalog and schema.\nThe caller must be the owner of the parent catalog, have the **USE_CATALOG** privilege on the parent catalog and be the owner of the parent schema,\nor be the owner of the table and have the **USE_CATALOG** privilege on the parent catalog and the **USE_SCHEMA** privilege on the parent schema.",
+            "summary": "Delete a table.",
+            "path": "/api/2.1/unity-catalog/tables/{full_name}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteTableRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "full_name",
+                  "description": "Full name of the table.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "full_name",
+                  "description": "Full name of the table.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "full_name",
+                "description": "Full name of the table.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "full_name",
+                "description": "Full name of the table.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Exists",
+            "description": "Gets if a table exists in the metastore for a specific catalog and schema.\nThe caller must satisfy one of the following requirements:\n* Be a metastore admin\n* Be the owner of the parent catalog\n* Be the owner of the parent schema and have the **USE_CATALOG** privilege on the parent catalog\n* Have the **USE_CATALOG** privilege on the parent catalog and the **USE_SCHEMA** privilege on the parent schema,\nand either be the table owner or have the **SELECT** privilege on the table.\n* Have **BROWSE** privilege on the parent catalog\n* Have **BROWSE** privilege on the parent schema",
+            "summary": "Get boolean reflecting if table exists.",
+            "path": "/api/2.1/unity-catalog/tables/{full_name}/exists",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ExistsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "full_name",
+                  "description": "Full name of the table.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "full_name",
+                  "description": "Full name of the table.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "TableExistsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "full_name",
+                "description": "Full name of the table.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "full_name",
+                "description": "Full name of the table.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets a table from the metastore for a specific catalog and schema.\nThe caller must satisfy one of the following requirements:\n* Be a metastore admin\n* Be the owner of the parent catalog\n* Be the owner of the parent schema and have the **USE_CATALOG** privilege on the parent catalog\n* Have the **USE_CATALOG** privilege on the parent catalog and the **USE_SCHEMA** privilege on the parent schema,\nand either be the table owner or have the **SELECT** privilege on the table.",
+            "summary": "Get a table.",
+            "path": "/api/2.1/unity-catalog/tables/{full_name}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetTableRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "full_name",
+                  "description": "Full name of the table.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "full_name",
+                  "description": "Full name of the table.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "TableInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "full_name",
+                "description": "Full name of the table.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "include_browse",
+                "description": "Whether to include tables in the response for which the principal can only access selective metadata for.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "include_delta_metadata",
+                "description": "Whether delta metadata should be included in the response.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "include_manifest_capabilities",
+                "description": "Whether to include a manifest containing table capabilities in the response.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "full_name",
+                "description": "Full name of the table.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Gets an array of all tables for the current metastore under the parent catalog and schema.\nThe caller must be a metastore admin or an owner of (or have the **SELECT** privilege on) the table.\nFor the latter case, the caller must also be the owner or have the **USE_CATALOG** privilege on the parent catalog and the **USE_SCHEMA** privilege on the parent schema.\nThere is no guarantee of a specific ordering of the elements in the array.\n\nNOTE: **view_dependencies** and **table_constraints** are not returned by ListTables queries.\n\nNOTE: we recommend using max_results=0 to use the paginated version of this API. Unpaginated calls will be deprecated soon.\n\nPAGINATION BEHAVIOR: When using pagination (max_results \u003e= 0), a page may contain zero results while still providing a next_page_token.\nClients must continue reading pages until next_page_token is absent, which is the only indication that the end of results has been reached.",
+            "summary": "List tables.",
+            "path": "/api/2.1/unity-catalog/tables",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListTablesRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "catalog_name",
+                  "description": "Name of parent catalog for tables of interest.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schema_name",
+                  "description": "Parent schema of tables.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "catalog_name",
+                  "description": "Name of parent catalog for tables of interest.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schema_name",
+                  "description": "Parent schema of tables.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListTablesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "catalog_name",
+                "description": "Name of parent catalog for tables of interest.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "include_browse",
+                "description": "Whether to include tables in the response for which the principal can only access selective metadata for.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "include_manifest_capabilities",
+                "description": "Whether to include a manifest containing table capabilities in the response.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "max_results",
+                "description": "Maximum number of tables to return.\nIf not set, all the tables are returned (not recommended).\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- when set to 0, the page length is set to a server configured value (recommended);\n- when set to a value less than 0, an invalid parameter error is returned;",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "omit_columns",
+                "description": "Whether to omit the columns of the table from the response or not.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "omit_properties",
+                "description": "Whether to omit the properties of the table from the response or not.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "omit_username",
+                "description": "Whether to omit the username of the table (e.g. owner, updated_by, created_by) from the response or not.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque token to send for the next page of results (pagination).",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schema_name",
+                "description": "Parent schema of tables.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "catalog_name",
+                "description": "Name of parent catalog for tables of interest.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schema_name",
+                "description": "Parent schema of tables.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Opaque token to send for the next page of results (pagination).",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              },
+              "max_results": {
+                "name": "max_results",
+                "description": "Maximum number of tables to return.\nIf not set, all the tables are returned (not recommended).\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- when set to 0, the page length is set to a server configured value (recommended);\n- when set to a value less than 0, an invalid parameter error is returned;",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              }
+            }
+          },
+          {
+            "name": "ListSummaries",
+            "description": "Gets an array of summaries for tables for a schema and catalog within the metastore. The table summaries returned are either:\n\n* summaries for tables (within the current metastore and parent catalog and schema), when the user is a metastore admin, or:\n* summaries for tables and schemas (within the current metastore and parent catalog)\nfor which the user has ownership or the **SELECT** privilege on the table and ownership or **USE_SCHEMA** privilege on the schema,\nprovided that the user also has ownership or the **USE_CATALOG** privilege on the parent catalog.\n\nThere is no guarantee of a specific ordering of the elements in the array.\n\nPAGINATION BEHAVIOR: The API is by default paginated, a page may contain zero results while still providing a next_page_token.\nClients must continue reading pages until next_page_token is absent, which is the only indication that the end of results has been reached.",
+            "summary": "List table summaries.",
+            "path": "/api/2.1/unity-catalog/table-summaries",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListSummariesRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "catalog_name",
+                  "description": "Name of parent catalog for tables of interest.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "catalog_name",
+                  "description": "Name of parent catalog for tables of interest.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListTableSummariesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "catalog_name",
+                "description": "Name of parent catalog for tables of interest.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "include_manifest_capabilities",
+                "description": "Whether to include a manifest containing table capabilities in the response.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "max_results",
+                "description": "Maximum number of summaries for tables to return.\nIf not set, the page length is set to a server configured value (10000, as of 1/5/2024).\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value (10000, as of 1/5/2024);\n- when set to 0, the page length is set to a server configured value (10000, as of 1/5/2024) (recommended);\n- when set to a value less than 0, an invalid parameter error is returned;",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque pagination token to go to next page based on previous query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schema_name_pattern",
+                "description": "A sql LIKE pattern (% and _) for schema names.\nAll schemas will be returned if not set or empty.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "table_name_pattern",
+                "description": "A sql LIKE pattern (% and _) for table names.\nAll tables will be returned if not set or empty.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "catalog_name",
+                "description": "Name of parent catalog for tables of interest.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Opaque pagination token to go to next page based on previous query.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "Update",
+            "description": "Change the owner of the table.\nThe caller must be the owner of the parent catalog, have the **USE_CATALOG** privilege on the parent catalog and be the owner of the parent schema,\nor be the owner of the table and have the **USE_CATALOG** privilege on the parent catalog and the **USE_SCHEMA** privilege on the parent schema.",
+            "summary": "Update a table owner.",
+            "path": "/api/2.1/unity-catalog/tables/{full_name}",
+            "can_use_json": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "UpdateTableRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "full_name",
+                  "description": "Full name of the table.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "full_name",
+                  "description": "Full name of the table.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "UpdateResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "full_name",
+                "description": "Full name of the table.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "owner",
+                "description": "Username of current owner of table.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "full_name",
+                "description": "Full name of the table.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "tags.TagPolicies",
+        "name": "TagPolicies",
+        "description": "The Tag Policy API allows you to manage policies for governed tags in Databricks. For Terraform usage, see the [Tag Policy Terraform documentation](https://registry.terraform.io/providers/databricks/databricks/latest/docs/resources/tag_policy). Permissions for tag policies can be managed using the [Account Access Control Proxy API](https://docs.databricks.com/api/workspace/accountaccesscontrolproxy).",
+        "package": {
+          "name": "tags"
+        },
+        "docs_group": "tags",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListTagPoliciesRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "CreateTagPolicy",
+            "description": "Creates a new tag policy, making the associated tag key governed. For Terraform usage, see the [Tag Policy Terraform documentation](https://registry.terraform.io/providers/databricks/databricks/latest/docs/resources/tag_policy). To manage permissions for tag policies, use the [Account Access Control Proxy API](https://docs.databricks.com/api/workspace/accountaccesscontrolproxy).",
+            "summary": "Create a new tag policy.",
+            "path": "/api/2.1/tag-policies",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateTagPolicyRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "tag_policy",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "TagPolicy",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "tag_policy",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "TagPolicy",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "tag_policy",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "TagPolicy",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "tag_key",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "tag_key",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "TagPolicy",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "tag_key",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "tag_key",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "tag_policy",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "TagPolicy",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "tag_key",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "tag_key",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Timestamp when the tag policy was created",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "description",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "id",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tag_key",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "Timestamp when the tag policy was last updated",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "values",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ValueList",
+                  "array_value": {
+                    "pascal_name": "Value",
+                    "is_object": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "tag_key",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteTagPolicy",
+            "description": "Deletes a tag policy by its associated governed tag's key, leaving that tag key ungoverned. For Terraform usage, see the [Tag Policy Terraform documentation](https://registry.terraform.io/providers/databricks/databricks/latest/docs/resources/tag_policy).",
+            "summary": "Delete a tag policy.",
+            "path": "/api/2.1/tag-policies/{tag_key}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteTagPolicyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "tag_key",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "tag_key",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "tag_key",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "tag_key",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetTagPolicy",
+            "description": "Gets a single tag policy by its associated governed tag's key. For Terraform usage, see the [Tag Policy Terraform documentation](https://registry.terraform.io/providers/databricks/databricks/latest/docs/data-sources/tag_policy). To list granted permissions for tag policies, use the [Account Access Control Proxy API](https://docs.databricks.com/api/workspace/accountaccesscontrolproxy).",
+            "summary": "Get a tag policy.",
+            "path": "/api/2.1/tag-policies/{tag_key}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetTagPolicyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "tag_key",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "tag_key",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "TagPolicy",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "tag_key",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "tag_key",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "tag_key",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "tag_key",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListTagPolicies",
+            "description": "Lists the tag policies for all governed tags in the account. For Terraform usage, see the [Tag Policy Terraform documentation](https://registry.terraform.io/providers/databricks/databricks/latest/docs/data-sources/tag_policies). To list granted permissions for tag policies, use the [Account Access Control Proxy API](https://docs.databricks.com/api/workspace/accountaccesscontrolproxy).",
+            "summary": "List tag policies.",
+            "path": "/api/2.1/tag-policies",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListTagPoliciesRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListTagPoliciesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "The maximum number of results to return in this request. Fewer results may be returned than requested. If\nunspecified or set to 0, this defaults to 1000. The maximum value is 1000; values above 1000 will be coerced down\nto 1000.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "An optional page token received from a previous list tag policies call.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "An optional page token received from a previous list tag policies call.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "UpdateTagPolicy",
+            "description": "Updates an existing tag policy for a single governed tag. For Terraform usage, see the [Tag Policy Terraform documentation](https://registry.terraform.io/providers/databricks/databricks/latest/docs/resources/tag_policy). To manage permissions for tag policies, use the [Account Access Control Proxy API](https://docs.databricks.com/api/workspace/accountaccesscontrolproxy).",
+            "summary": "Update an existing tag policy.",
+            "path": "/api/2.1/tag-policies/{tag_key}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateTagPolicyRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "tag_key",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "tag_policy",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "TagPolicy",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "tag_key",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "tag_policy",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "TagPolicy",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "tag_policy",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "TagPolicy",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "tag_key",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "tag_key",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "TagPolicy",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "tag_key",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "tag_key",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "tag_key",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tag_policy",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "TagPolicy",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "tag_key",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "tag_key",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "create_time",
+                "description": "Timestamp when the tag policy was created",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "description",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "id",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tag_key",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_time",
+                "description": "Timestamp when the tag policy was last updated",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "values",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ValueList",
+                  "array_value": {
+                    "pascal_name": "Value",
+                    "is_object": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "tag_key",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "catalog.TemporaryPathCredentials",
+        "name": "TemporaryPathCredentials",
+        "description": "Temporary Path Credentials are short-lived, downscoped credentials used to access external cloud storage locations registered in Databricks. These credentials provide secure and time-limited access to data in cloud environments such as AWS, Azure, and Google Cloud. Each cloud provider has its own type of credentials: AWS uses temporary session tokens through AWS Security Token Service (STS), Azure uses Shared Access Signatures (SAS) for its data storage services, and Google Cloud supports temporary credentials through OAuth 2.0.\n\nTemporary path credentials ensure that data access is limited in scope and duration, reducing the risk of unauthorized access or misuse. To use the temporary path credentials API, a metastore admin must enable the external_access_enabled flag (off by default) at the metastore level. A user must be granted the EXTERNAL USE LOCATION permission by the external location owner. For requests on existing external tables and external volumes, the user must also be granted the EXTERNAL USE SCHEMA permission at the schema level by the catalog owner.\n\nNote that EXTERNAL USE SCHEMA is a schema level permission that can only be granted by the catalog owner explicitly and is not included in schema ownership or ALL PRIVILEGES on the schema for security reasons. Similarly, EXTERNAL USE LOCATION is an external location level permission that can only be granted by the external location owner explicitly and is not included in external location ownership or ALL PRIVILEGES on the external location for security reasons.",
+        "package": {
+          "name": "catalog"
+        },
+        "docs_group": "catalog",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "methods": [
+          {
+            "name": "GenerateTemporaryPathCredentials",
+            "description": "Get a short-lived credential for directly accessing cloud storage locations registered in Databricks.\nThe Generate Temporary Path Credentials API is only supported for external storage paths, specifically external\nlocations and external tables. Managed tables are not supported by this API.\nThe metastore must have **external_access_enabled** flag set to true (default false).\nThe caller must have the **EXTERNAL_USE_LOCATION** privilege on the external location; this privilege can only be granted\nby external location owners.\nFor requests on existing external tables, the caller must also have the **EXTERNAL_USE_SCHEMA** privilege on the parent schema;\nthis privilege can only be granted by catalog owners.",
+            "summary": "Generate a temporary path credential.",
+            "path": "/api/2.0/unity-catalog/temporary-path-credentials",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GenerateTemporaryPathCredentialRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "url",
+                  "description": "URL for path-based access.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "operation",
+                  "description": "The operation being performed on the path.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PathOperation",
+                    "enum": [
+                      {
+                        "content": "PATH_CREATE_TABLE"
+                      },
+                      {
+                        "content": "PATH_READ"
+                      },
+                      {
+                        "content": "PATH_READ_WRITE"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "url",
+                  "description": "URL for path-based access.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "operation",
+                  "description": "The operation being performed on the path.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PathOperation",
+                    "enum": [
+                      {
+                        "content": "PATH_CREATE_TABLE"
+                      },
+                      {
+                        "content": "PATH_READ"
+                      },
+                      {
+                        "content": "PATH_READ_WRITE"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GenerateTemporaryPathCredentialResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "dry_run",
+                "description": "Optional. When set to true, the service will not validate that the generated\ncredentials can perform write operations, therefore no new paths will be created\nand the response will not contain valid credentials. Defaults to false.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "operation",
+                "description": "The operation being performed on the path.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PathOperation",
+                  "enum": [
+                    {
+                      "content": "PATH_CREATE_TABLE"
+                    },
+                    {
+                      "content": "PATH_READ"
+                    },
+                    {
+                      "content": "PATH_READ_WRITE"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "url",
+                "description": "URL for path-based access.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "url",
+                "description": "URL for path-based access.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "operation",
+                "description": "The operation being performed on the path.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PathOperation",
+                  "enum": [
+                    {
+                      "content": "PATH_CREATE_TABLE"
+                    },
+                    {
+                      "content": "PATH_READ"
+                    },
+                    {
+                      "content": "PATH_READ_WRITE"
+                    }
+                  ]
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "catalog.TemporaryTableCredentials",
+        "name": "TemporaryTableCredentials",
+        "description": "Temporary Table Credentials are short-lived, downscoped credentials used to access cloud storage locations where table data is stored in Databricks. These credentials provide secure and time-limited access to data in cloud environments such as AWS, Azure, and Google Cloud. Each cloud provider has its own type of credentials: AWS uses temporary session tokens through AWS Security Token Service (STS), Azure uses Shared Access Signatures (SAS) for its data storage services, and Google Cloud supports temporary credentials through OAuth 2.0.\n\nTemporary table credentials ensure that data access is limited in scope and duration, reducing the risk of unauthorized access or misuse. To use the temporary table credentials API, a metastore admin must enable the external_access_enabled flag (off by default) at the metastore level, and the user must be granted the EXTERNAL USE SCHEMA permission at the schema level by the catalog owner. Note that EXTERNAL USE SCHEMA is a schema level permission that can only be granted by the catalog owner explicitly and is not included in schema ownership or ALL PRIVILEGES on the schema for security reasons.",
+        "package": {
+          "name": "catalog"
+        },
+        "docs_group": "catalog",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "methods": [
+          {
+            "name": "GenerateTemporaryTableCredentials",
+            "description": "Get a short-lived credential for directly accessing the table data on cloud storage.\nThe metastore must have **external_access_enabled** flag set to true (default false).\nThe caller must have the **EXTERNAL_USE_SCHEMA** privilege on the parent schema and this privilege can only be granted\nby catalog owners.",
+            "summary": "Generate a temporary table credential.",
+            "path": "/api/2.0/unity-catalog/temporary-table-credentials",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GenerateTemporaryTableCredentialRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "GenerateTemporaryTableCredentialResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "operation",
+                "description": "The operation performed against the table data, either READ or READ_WRITE. If READ_WRITE is specified,\nthe credentials returned will have write permissions, otherwise, it will be read only.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "TableOperation",
+                  "enum": [
+                    {
+                      "content": "READ"
+                    },
+                    {
+                      "content": "READ_WRITE"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "table_id",
+                "description": "UUID of the table to read or write.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "catalog.TemporaryVolumeCredentials",
+        "name": "TemporaryVolumeCredentials",
+        "description": "Temporary Volume Credentials are short-lived, downscoped credentials used to access cloud storage locations where volume data is stored in Databricks. These credentials provide secure and time-limited access to data in cloud environments such as AWS, Azure, and Google Cloud. Each cloud provider has its own type of credentials: AWS uses temporary session tokens through AWS Security Token Service (STS), Azure uses Shared Access Signatures (SAS) for its data storage services, and Google Cloud supports temporary credentials through OAuth 2.0.\n\nTemporary volume credentials ensure that data access is limited in scope and duration, reducing the risk of unauthorized access or misuse. To use the temporary volume credentials API, a metastore admin must enable the external_access_enabled flag (off by default) at the metastore level, and the user must be granted the EXTERNAL USE SCHEMA permission at the schema level by the catalog owner. Note that EXTERNAL USE SCHEMA is a schema level permission that can only be granted by the catalog owner explicitly and is not included in schema ownership or ALL PRIVILEGES on the schema for security reasons.",
+        "package": {
+          "name": "catalog"
+        },
+        "docs_group": "catalog",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "methods": [
+          {
+            "name": "GenerateTemporaryVolumeCredentials",
+            "description": "Get a short-lived credential for directly accessing the volume data on cloud storage.\nThe metastore must have **external_access_enabled** flag set to true (default false).\nThe caller must have the **EXTERNAL_USE_SCHEMA** privilege on the parent schema and this privilege can only be granted\nby catalog owners.",
+            "summary": "Generate a temporary volume credential.",
+            "path": "/api/2.0/unity-catalog/temporary-volume-credentials",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GenerateTemporaryVolumeCredentialRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "GenerateTemporaryVolumeCredentialResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "operation",
+                "description": "The operation performed against the volume data, either READ_VOLUME or WRITE_VOLUME. If WRITE_VOLUME is specified,\nthe credentials returned will have write permissions, otherwise, it will be read only.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "VolumeOperation",
+                  "enum": [
+                    {
+                      "content": "READ_VOLUME"
+                    },
+                    {
+                      "content": "WRITE_VOLUME"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "volume_id",
+                "description": "Id of the volume to read or write.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "settings.TokenManagement",
+        "name": "TokenManagement",
+        "description": "Enables administrators to get all tokens and delete tokens for other users. Admins can\neither get every token, get a specific token by ID, or get all tokens for a particular user.",
+        "package": {
+          "name": "settings"
+        },
+        "docs_group": "settings",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "named_id_map": {
+            "pascal_name": "TokenInfoCommentToTokenIdMap"
+          },
+          "request": {
+            "pascal_name": "ListTokenManagementRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "CreateOboToken",
+            "description": "Creates a token on behalf of a service principal.",
+            "summary": "Create on-behalf token.",
+            "path": "/api/2.0/token-management/on-behalf-of/tokens",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateOboTokenRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "application_id",
+                  "description": "Application ID of the service principal.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "application_id",
+                  "description": "Application ID of the service principal.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "CreateOboTokenResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "application_id",
+                "description": "Application ID of the service principal.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "autoscope_enabled",
+                "description": "Whether to enable autoscoping for this token.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "comment",
+                "description": "Comment that describes the purpose of the token.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "lifetime_seconds",
+                "description": "The number of seconds before the token expires.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "scopes",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "application_id",
+                "description": "Application ID of the service principal.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes a token, specified by its ID.",
+            "summary": "Delete a token.",
+            "path": "/api/2.0/token-management/tokens/{token_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteTokenManagementRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "token_id",
+                  "description": "The ID of the token to revoke.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "token_id",
+                  "description": "The ID of the token to revoke.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "token_id",
+                "description": "The ID of the token to revoke.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "token_id",
+                "description": "The ID of the token to revoke.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets information about a token, specified by its ID.",
+            "summary": "Get token info.",
+            "path": "/api/2.0/token-management/tokens/{token_id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetTokenManagementRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "token_id",
+                  "description": "The ID of the token to get.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "token_id",
+                  "description": "The ID of the token to get.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetTokenResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "token_id",
+                "description": "The ID of the token to get.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "token_id",
+                "description": "The ID of the token to get.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetPermissionLevels",
+            "description": "Gets the permission levels that a user can have on an object.",
+            "summary": "Get token permission levels.",
+            "path": "/api/2.0/permissions/authorization/tokens/permissionLevels",
+            "is_legacy_empty_request": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetTokenPermissionLevelsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "GetTokenPermissionLevelsResponse",
+              "is_object": true
+            }
+          },
+          {
+            "name": "GetPermissions",
+            "description": "Gets the permissions of all tokens. Tokens can inherit permissions from their root object.",
+            "summary": "Get token permissions.",
+            "path": "/api/2.0/permissions/authorization/tokens",
+            "is_legacy_empty_request": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetTokenPermissionsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "TokenPermissions",
+              "is_object": true
+            }
+          },
+          {
+            "name": "List",
+            "description": "Lists all tokens associated with the specified workspace or user.",
+            "summary": "List all tokens.",
+            "path": "/api/2.0/token-management/tokens",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListTokenManagementRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListTokensResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "created_by_id",
+                "description": "User ID of the user that created the token.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "created_by_username",
+                "description": "Username of the user that created the token.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {}
+          },
+          {
+            "name": "SetPermissions",
+            "description": "Sets permissions on an object, replacing existing permissions if they exist. Deletes all direct permissions if none are specified. Objects can inherit permissions from their root object.",
+            "summary": "Set token permissions.",
+            "path": "/api/2.0/permissions/authorization/tokens",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "TokenPermissionsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "TokenPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "access_control_list",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "TokenAccessControlRequestList",
+                  "array_value": {
+                    "pascal_name": "TokenAccessControlRequest",
+                    "is_object": true
+                  }
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdatePermissions",
+            "description": "Updates the permissions on all tokens. Tokens can inherit permissions from their root object.",
+            "summary": "Update token permissions.",
+            "path": "/api/2.0/permissions/authorization/tokens",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "TokenPermissionsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "TokenPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "access_control_list",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "TokenAccessControlRequestList",
+                  "array_value": {
+                    "pascal_name": "TokenAccessControlRequest",
+                    "is_object": true
+                  }
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateTokenManagement",
+            "description": "Updates a token, specified by its ID.",
+            "summary": "Update an on-behalf token.",
+            "path": "/api/2.0/token-management/tokens/{token_id}",
+            "can_use_json": true,
+            "must_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateTokenManagementRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "token_id",
+                  "description": "ID of the token.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "token",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "TokenInfo",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "A list of field name under token, For example, {\"update_mask\": \"comment,scopes\"}\n\nThe field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "token_id",
+                  "description": "ID of the token.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "token",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "TokenInfo",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "A list of field name under token, For example, {\"update_mask\": \"comment,scopes\"}\n\nThe field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "TokenInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "token",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "TokenInfo",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "token_id",
+                "description": "ID of the token.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "A list of field name under token, For example, {\"update_mask\": \"comment,scopes\"}\n\nThe field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "token_id",
+                "description": "ID of the token.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "settings.Tokens",
+        "name": "Tokens",
+        "description": "The Token API allows you to create, list, and revoke tokens that can be used to authenticate and access Databricks REST APIs.",
+        "package": {
+          "name": "settings"
+        },
+        "docs_group": "settings",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "named_id_map": {
+            "pascal_name": "PublicTokenInfoCommentToTokenIdMap"
+          },
+          "is_legacy_empty_request": true,
+          "request": {
+            "pascal_name": "ListTokens"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates and returns a token for a user. If this call is made through token authentication, it creates\na token with the same client ID as the authenticated token. If the user's token quota is exceeded, this call\nreturns an error **QUOTA_EXCEEDED**.",
+            "summary": "Create a user token.",
+            "path": "/api/2.0/token/create",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateTokenRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "CreateTokenResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "autoscope_enabled",
+                "description": "Whether to enable autoscoping for this token. When true, the token will\nautomatically collect inferred API path scopes as it is used.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "comment",
+                "description": "Optional description to attach to the token.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "lifetime_seconds",
+                "description": "The lifetime of the token, in seconds.\n\nIf the lifetime is not specified, this token remains valid for 2 years.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "scopes",
+                "description": "Optional scopes of the token.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Revokes an access token.\n\nIf a token with the specified ID is not valid, this call returns an error **RESOURCE_DOES_NOT_EXIST**.",
+            "summary": "Revoke token.",
+            "path": "/api/2.0/token/delete",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "RevokeTokenRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "token_id",
+                  "description": "The ID of the token to be revoked.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "token_id",
+                  "description": "The ID of the token to be revoked.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "RevokeTokenResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "token_id",
+                "description": "The ID of the token to be revoked.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "token_id",
+                "description": "The ID of the token to be revoked.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Lists all the valid tokens for a user-workspace pair.",
+            "summary": "List tokens.",
+            "path": "/api/2.0/token/list",
+            "is_legacy_empty_request": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListTokens",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListPublicTokensResponse",
+              "is_object": true
+            },
+            "pagination": {}
+          },
+          {
+            "name": "Update",
+            "description": "Updates the comment or scopes of a token.\n\nIf a token with the specified ID is not valid, this call returns an error **NOT_FOUND**.",
+            "summary": "Update a user token.",
+            "path": "/api/2.0/token/{token_id}",
+            "can_use_json": true,
+            "must_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateTokenRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "token_id",
+                  "description": "The SHA-256 hash of the token to be updated.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "token",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PublicTokenInfo",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "A list of field name under token, For example, {\"update_mask\": \"comment,scopes\"}\n\nThe field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "token_id",
+                  "description": "The SHA-256 hash of the token to be updated.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "token",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "PublicTokenInfo",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "A list of field name under token, For example, {\"update_mask\": \"comment,scopes\"}\n\nThe field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "UpdateTokenResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "token",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PublicTokenInfo",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "token_id",
+                "description": "The SHA-256 hash of the token to be updated.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "A list of field name under token, For example, {\"update_mask\": \"comment,scopes\"}\n\nThe field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "token_id",
+                "description": "The SHA-256 hash of the token to be updated.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "billing.UsageDashboards",
+        "name": "UsageDashboards",
+        "description": "These APIs manage usage dashboards for this account. Usage dashboards enable you to gain insights into your usage with pre-built dashboards: visualize breakdowns, analyze tag attributions, and identify cost drivers.",
+        "package": {
+          "name": "billing"
+        },
+        "is_accounts": true,
+        "docs_group": "billing",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Create a usage dashboard specified by workspaceId, accountId, and dashboard type.",
+            "summary": "Create new usage dashboard.",
+            "path": "/api/2.0/accounts/{account_id}/dashboard",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateBillingUsageDashboardRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "CreateBillingUsageDashboardResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "dashboard_type",
+                "description": "Workspace level usage dashboard shows usage data for the specified workspace ID. Global level usage dashboard shows usage data for all workspaces in the account.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "UsageDashboardType",
+                  "enum": [
+                    {
+                      "content": "USAGE_DASHBOARD_TYPE_GLOBAL"
+                    },
+                    {
+                      "content": "USAGE_DASHBOARD_TYPE_WORKSPACE"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "major_version",
+                "description": "The major version of the usage dashboard template to use. Defaults to VERSION_1.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "UsageDashboardMajorVersion",
+                  "enum": [
+                    {
+                      "content": "USAGE_DASHBOARD_MAJOR_VERSION_1"
+                    },
+                    {
+                      "content": "USAGE_DASHBOARD_MAJOR_VERSION_2"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "workspace_id",
+                "description": "The workspace ID of the workspace in which the usage dashboard is created.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Get a usage dashboard specified by workspaceId, accountId, and dashboard type.",
+            "summary": "Get usage dashboard.",
+            "path": "/api/2.0/accounts/{account_id}/dashboard",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetBillingUsageDashboardRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "GetBillingUsageDashboardResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "dashboard_type",
+                "description": "Workspace level usage dashboard shows usage data for the specified workspace ID. Global level usage dashboard shows usage data for all workspaces in the account.",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "UsageDashboardType",
+                  "enum": [
+                    {
+                      "content": "USAGE_DASHBOARD_TYPE_GLOBAL"
+                    },
+                    {
+                      "content": "USAGE_DASHBOARD_TYPE_WORKSPACE"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "workspace_id",
+                "description": "The workspace ID of the workspace in which the usage dashboard is created.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "iam.UsersV2",
+        "name": "UsersV2",
+        "description": "User identities recognized by Databricks and represented by email addresses.\n\nDatabricks recommends using SCIM provisioning to sync users and groups automatically from\nyour identity provider to your Databricks workspace. SCIM streamlines onboarding a new\nemployee or team by using your identity provider to create users and groups in Databricks workspace\nand give them the proper level of access. When a user leaves your organization or no longer\nneeds access to Databricks workspace, admins can terminate the user in your identity provider and that\nuser’s account will also be removed from Databricks workspace. This ensures a consistent offboarding\nprocess and prevents unauthorized users from accessing sensitive data.",
+        "package": {
+          "name": "iam"
+        },
+        "docs_group": "iam",
+        "launch_stage": "PUBLIC_PREVIEW",
+        "cli_launch_stage_label": "*Public Preview*",
+        "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+        "cli_launch_stage_display": "Public Preview",
+        "list": {
+          "request": {
+            "pascal_name": "ListUsersRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a new user in the Databricks workspace. This new user will also be added to the Databricks account.",
+            "summary": "Create a new user.",
+            "path": "/api/2.0/preview/scim/v2/Users",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "CreateUserRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "User",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "active",
+                "description": "If this user is active",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "displayName",
+                "description": "String that represents a concatenation of given and family names. For example `John Smith`. This field cannot be updated through the Workspace SCIM APIs when [identity federation is enabled](https://docs.databricks.com/administration-guide/users-groups/best-practices.html#enable-identity-federation). Use Account SCIM APIs to update `displayName`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "emails",
+                "description": "All the emails associated with the Databricks user.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ComplexValueList",
+                  "array_value": {
+                    "pascal_name": "ComplexValue",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "entitlements",
+                "description": "Entitlements assigned to the user. See [assigning entitlements](https://docs.databricks.com/administration-guide/users-groups/index.html#assigning-entitlements) for a full list of supported values.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ComplexValueList",
+                  "array_value": {
+                    "pascal_name": "ComplexValue",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "externalId",
+                "description": "External ID is not currently supported. It is reserved for future use.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "groups",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ComplexValueList",
+                  "array_value": {
+                    "pascal_name": "ComplexValue",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "id",
+                "description": "Databricks user ID.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "Name",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "roles",
+                "description": "Corresponds to AWS instance profile/arn role.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ComplexValueList",
+                  "array_value": {
+                    "pascal_name": "ComplexValue",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "schemas",
+                "description": "The schema of the user.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "UserSchemaList",
+                  "array_value": {
+                    "pascal_name": "UserSchema",
+                    "enum": [
+                      {
+                        "content": "urn:ietf:params:scim:schemas:core:2.0:User"
+                      },
+                      {
+                        "content": "urn:ietf:params:scim:schemas:extension:workspace:2.0:User"
+                      }
+                    ]
+                  }
+                }
+              },
+              {
+                "name": "userName",
+                "description": "Email address of the Databricks user.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes a user. Deleting a user from a Databricks workspace also removes objects associated with the user.",
+            "summary": "Delete a user.",
+            "path": "/api/2.0/preview/scim/v2/Users/{id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "DeleteUserRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID for a user in the Databricks workspace.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID for a user in the Databricks workspace.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "description": "Unique ID for a user in the Databricks workspace.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Unique ID for a user in the Databricks workspace.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets information for a specific user in Databricks workspace.",
+            "summary": "Get user details.",
+            "path": "/api/2.0/preview/scim/v2/Users/{id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetUserRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID for a user in the Databricks workspace.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID for a user in the Databricks workspace.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "User",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "attributes",
+                "description": "Comma-separated list of attributes to return in response.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "count",
+                "description": "Desired number of results per page.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "excludedAttributes",
+                "description": "Comma-separated list of attributes to exclude in response.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "filter",
+                "description": "Query by which the results have to be filtered. Supported operators are equals(`eq`), contains(`co`), starts with(`sw`) and not equals(`ne`). Additionally, simple expressions can be formed using logical operators - `and` and `or`. The [SCIM RFC](https://tools.ietf.org/html/rfc7644#section-3.4.2.2) has more details but we currently only support simple expressions.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "id",
+                "description": "Unique ID for a user in the Databricks workspace.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "sortBy",
+                "description": "Attribute to sort the results. Multi-part paths are supported. For example, `userName`, `name.givenName`, and `emails`.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "sortOrder",
+                "description": "The order to sort the results.",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "GetSortOrder",
+                  "enum": [
+                    {
+                      "content": "ascending"
+                    },
+                    {
+                      "content": "descending"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "startIndex",
+                "description": "Specifies the index of the first result. First item is number 1.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Unique ID for a user in the Databricks workspace.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetPermissionLevels",
+            "description": "Gets the permission levels that a user can have on an object.",
+            "summary": "Get password permission levels.",
+            "path": "/api/2.0/permissions/authorization/passwords/permissionLevels",
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetPasswordPermissionLevelsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "GetPasswordPermissionLevelsResponse",
+              "is_object": true
+            }
+          },
+          {
+            "name": "GetPermissions",
+            "description": "Gets the permissions of all passwords. Passwords can inherit permissions from their root object.",
+            "summary": "Get password permissions.",
+            "path": "/api/2.0/permissions/authorization/passwords",
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "GetPasswordPermissionsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "PasswordPermissions",
+              "is_object": true
+            }
+          },
+          {
+            "name": "List",
+            "description": "Gets details for all the users associated with a Databricks workspace.",
+            "summary": "List users.",
+            "path": "/api/2.0/preview/scim/v2/Users",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "ListUsersRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListUsersResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "attributes",
+                "description": "Comma-separated list of attributes to return in response.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "count",
+                "description": "Desired number of results per page.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "excludedAttributes",
+                "description": "Comma-separated list of attributes to exclude in response.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "filter",
+                "description": "Query by which the results have to be filtered. Supported operators are equals(`eq`), contains(`co`), starts with(`sw`) and not equals(`ne`). Additionally, simple expressions can be formed using logical operators - `and` and `or`. The [SCIM RFC](https://tools.ietf.org/html/rfc7644#section-3.4.2.2) has more details but we currently only support simple expressions.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "sortBy",
+                "description": "Attribute to sort the results. Multi-part paths are supported. For example, `userName`, `name.givenName`, and `emails`.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "sortOrder",
+                "description": "The order to sort the results.",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "ListSortOrder",
+                  "enum": [
+                    {
+                      "content": "ascending"
+                    },
+                    {
+                      "content": "descending"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "startIndex",
+                "description": "Specifies the index of the first result. First item is number 1.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "pagination": {
+              "offset": {
+                "name": "startIndex",
+                "description": "Specifies the index of the first result. First item is number 1.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              "limit": {
+                "name": "count",
+                "description": "Desired number of results per page.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            }
+          },
+          {
+            "name": "Patch",
+            "description": "Partially updates a user resource by applying the supplied operations on specific user attributes.\nThe `userName` and `emails` attributes cannot be updated through this API; any supplied changes to them are ignored (no-op).",
+            "summary": "Update user details.",
+            "path": "/api/2.0/preview/scim/v2/Users/{id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "PatchUserRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID in the Databricks workspace.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID in the Databricks workspace.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "description": "Unique ID in the Databricks workspace.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "Operations",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PatchList",
+                  "array_value": {
+                    "pascal_name": "Patch",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "schemas",
+                "description": "The schema of the patch request. Must be [\"urn:ietf:params:scim:api:messages:2.0:PatchOp\"].",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PatchSchemaList",
+                  "array_value": {
+                    "pascal_name": "PatchSchema",
+                    "enum": [
+                      {
+                        "content": "urn:ietf:params:scim:api:messages:2.0:PatchOp"
+                      }
+                    ]
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Unique ID in the Databricks workspace.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "SetPermissions",
+            "description": "Sets permissions on an object, replacing existing permissions if they exist. Deletes all direct permissions if none are specified. Objects can inherit permissions from their root object.",
+            "summary": "Set password permissions.",
+            "path": "/api/2.0/permissions/authorization/passwords",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "PasswordPermissionsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "PasswordPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "access_control_list",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PasswordAccessControlRequestList",
+                  "array_value": {
+                    "pascal_name": "PasswordAccessControlRequest",
+                    "is_object": true
+                  }
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Replaces a user's information with the data supplied in request.\nThe `userName` and `emails` attributes cannot be updated through this API; any supplied changes to them are ignored (no-op).",
+            "summary": "Replace a user.",
+            "path": "/api/2.0/preview/scim/v2/Users/{id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "UpdateUserRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Databricks user ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "Databricks user ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "active",
+                "description": "If this user is active",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "displayName",
+                "description": "String that represents a concatenation of given and family names. For example `John Smith`. This field cannot be updated through the Workspace SCIM APIs when [identity federation is enabled](https://docs.databricks.com/administration-guide/users-groups/best-practices.html#enable-identity-federation). Use Account SCIM APIs to update `displayName`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "emails",
+                "description": "All the emails associated with the Databricks user. This attribute cannot be updated through the SCIM PATCH or PUT APIs; any supplied change is ignored.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ComplexValueList",
+                  "array_value": {
+                    "pascal_name": "ComplexValue",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "entitlements",
+                "description": "Entitlements assigned to the user. See [assigning entitlements](https://docs.databricks.com/administration-guide/users-groups/index.html#assigning-entitlements) for a full list of supported values.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ComplexValueList",
+                  "array_value": {
+                    "pascal_name": "ComplexValue",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "externalId",
+                "description": "External ID is not currently supported. It is reserved for future use.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "groups",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ComplexValueList",
+                  "array_value": {
+                    "pascal_name": "ComplexValue",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "id",
+                "description": "Databricks user ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "Name",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "roles",
+                "description": "Corresponds to AWS instance profile/arn role.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ComplexValueList",
+                  "array_value": {
+                    "pascal_name": "ComplexValue",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "schemas",
+                "description": "The schema of the user.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "UserSchemaList",
+                  "array_value": {
+                    "pascal_name": "UserSchema",
+                    "enum": [
+                      {
+                        "content": "urn:ietf:params:scim:schemas:core:2.0:User"
+                      },
+                      {
+                        "content": "urn:ietf:params:scim:schemas:extension:workspace:2.0:User"
+                      }
+                    ]
+                  }
+                }
+              },
+              {
+                "name": "userName",
+                "description": "Email address of the Databricks user. This attribute cannot be updated through the SCIM PATCH or PUT APIs; any supplied change is ignored.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Databricks user ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdatePermissions",
+            "description": "Updates the permissions on all passwords. Passwords can inherit permissions from their root object.",
+            "summary": "Update password permissions.",
+            "path": "/api/2.0/permissions/authorization/passwords",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "PasswordPermissionsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "PasswordPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "access_control_list",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PasswordAccessControlRequestList",
+                  "array_value": {
+                    "pascal_name": "PasswordAccessControlRequest",
+                    "is_object": true
+                  }
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "iam.AccountUsersV2",
+        "name": "AccountUsersV2",
+        "description": "User identities recognized by Databricks and represented by email addresses.\n\nDatabricks recommends using SCIM provisioning to sync users and groups automatically from\nyour identity provider to your Databricks account. SCIM streamlines onboarding a new\nemployee or team by using your identity provider to create users and groups in Databricks account\nand give them the proper level of access. When a user leaves your organization or no longer\nneeds access to Databricks account, admins can terminate the user in your identity provider and that\nuser’s account will also be removed from Databricks account. This ensures a consistent offboarding\nprocess and prevents unauthorized users from accessing sensitive data.",
+        "package": {
+          "name": "iam"
+        },
+        "is_accounts": true,
+        "docs_group": "iam",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListAccountUsersRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a new user in the Databricks account. This new user will also be added to the Databricks account.",
+            "summary": "Create a new user.",
+            "path": "/api/2.0/accounts/{account_id}/scim/v2/Users",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateAccountUserRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "AccountUser",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "active",
+                "description": "If this user is active",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "displayName",
+                "description": "String that represents a concatenation of given and family names. For example `John Smith`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "emails",
+                "description": "All the emails associated with the Databricks user.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ComplexValueList",
+                  "array_value": {
+                    "pascal_name": "ComplexValue",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "externalId",
+                "description": "External ID is not currently supported. It is reserved for future use.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "id",
+                "description": "Databricks user ID.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "Name",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "roles",
+                "description": "Indicates if the group has the admin role.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ComplexValueList",
+                  "array_value": {
+                    "pascal_name": "ComplexValue",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "userName",
+                "description": "Email address of the Databricks user.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes a user. Deleting a user from a Databricks account also removes objects associated with the user.",
+            "summary": "Delete a user.",
+            "path": "/api/2.0/accounts/{account_id}/scim/v2/Users/{id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteAccountUserRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID for a user in the Databricks account.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID for a user in the Databricks account.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "description": "Unique ID for a user in the Databricks account.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Unique ID for a user in the Databricks account.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets information for a specific user in Databricks account.",
+            "summary": "Get user details.",
+            "path": "/api/2.0/accounts/{account_id}/scim/v2/Users/{id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetAccountUserRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID for a user in the Databricks account.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID for a user in the Databricks account.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "AccountUser",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "attributes",
+                "description": "Comma-separated list of attributes to return in response.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "count",
+                "description": "Desired number of results per page. Default is 10000.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "excludedAttributes",
+                "description": "Comma-separated list of attributes to exclude in response.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "filter",
+                "description": "Query by which the results have to be filtered. Supported operators are equals(`eq`), contains(`co`), starts with(`sw`) and not equals(`ne`). Additionally, simple expressions can be formed using logical operators - `and` and `or`. The [SCIM RFC](https://tools.ietf.org/html/rfc7644#section-3.4.2.2) has more details but we currently only support simple expressions.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "id",
+                "description": "Unique ID for a user in the Databricks account.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "sortBy",
+                "description": "Attribute to sort the results. Multi-part paths are supported. For example, `userName`, `name.givenName`, and `emails`.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "sortOrder",
+                "description": "The order to sort the results.",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "GetSortOrder",
+                  "enum": [
+                    {
+                      "content": "ascending"
+                    },
+                    {
+                      "content": "descending"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "startIndex",
+                "description": "Specifies the index of the first result. First item is number 1.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Unique ID for a user in the Databricks account.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Gets details for all the users associated with a Databricks account.",
+            "summary": "List users.",
+            "path": "/api/2.0/accounts/{account_id}/scim/v2/Users",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListAccountUsersRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListAccountUsersResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "attributes",
+                "description": "Comma-separated list of attributes to return in response.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "count",
+                "description": "Desired number of results per page. Default is 10000.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "excludedAttributes",
+                "description": "Comma-separated list of attributes to exclude in response.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "filter",
+                "description": "Query by which the results have to be filtered. Supported operators are equals(`eq`), contains(`co`), starts with(`sw`) and not equals(`ne`). Additionally, simple expressions can be formed using logical operators - `and` and `or`. The [SCIM RFC](https://tools.ietf.org/html/rfc7644#section-3.4.2.2) has more details but we currently only support simple expressions.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "sortBy",
+                "description": "Attribute to sort the results. Multi-part paths are supported. For example, `userName`, `name.givenName`, and `emails`.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "sortOrder",
+                "description": "The order to sort the results.",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "ListSortOrder",
+                  "enum": [
+                    {
+                      "content": "ascending"
+                    },
+                    {
+                      "content": "descending"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "startIndex",
+                "description": "Specifies the index of the first result. First item is number 1.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "pagination": {
+              "offset": {
+                "name": "startIndex",
+                "description": "Specifies the index of the first result. First item is number 1.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              "limit": {
+                "name": "count",
+                "description": "Desired number of results per page. Default is 10000.",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            }
+          },
+          {
+            "name": "Patch",
+            "description": "Partially updates a user resource by applying the supplied operations on specific user attributes.\nThe `userName` and `emails` attributes cannot be updated through this API; any supplied changes to them are ignored (no-op).",
+            "summary": "Update user details.",
+            "path": "/api/2.0/accounts/{account_id}/scim/v2/Users/{id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "PatchAccountUserRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID in the Databricks workspace.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "Unique ID in the Databricks workspace.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "description": "Unique ID in the Databricks workspace.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "Operations",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PatchList",
+                  "array_value": {
+                    "pascal_name": "Patch",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "schemas",
+                "description": "The schema of the patch request. Must be [\"urn:ietf:params:scim:api:messages:2.0:PatchOp\"].",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PatchSchemaList",
+                  "array_value": {
+                    "pascal_name": "PatchSchema",
+                    "enum": [
+                      {
+                        "content": "urn:ietf:params:scim:api:messages:2.0:PatchOp"
+                      }
+                    ]
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Unique ID in the Databricks workspace.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Replaces a user's information with the data supplied in request.\nThe `userName` and `emails` attributes cannot be updated through this API; any supplied changes to them are ignored (no-op).",
+            "summary": "Replace a user.",
+            "path": "/api/2.0/accounts/{account_id}/scim/v2/Users/{id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateAccountUserRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Databricks user ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "Databricks user ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "active",
+                "description": "If this user is active",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "displayName",
+                "description": "String that represents a concatenation of given and family names. For example `John Smith`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "emails",
+                "description": "All the emails associated with the Databricks user. This attribute cannot be updated through the SCIM PATCH or PUT APIs; any supplied change is ignored.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ComplexValueList",
+                  "array_value": {
+                    "pascal_name": "ComplexValue",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "externalId",
+                "description": "External ID is not currently supported. It is reserved for future use.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "id",
+                "description": "Databricks user ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "Name",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "roles",
+                "description": "Indicates if the group has the admin role.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ComplexValueList",
+                  "array_value": {
+                    "pascal_name": "ComplexValue",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "userName",
+                "description": "Email address of the Databricks user. This attribute cannot be updated through the SCIM PATCH or PUT APIs; any supplied change is ignored.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Databricks user ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "vectorsearch.VectorSearchEndpoints",
+        "name": "VectorSearchEndpoints",
+        "description": "**Endpoint**: Represents the compute resources to host AI Search indexes.",
+        "package": {
+          "name": "vectorsearch"
+        },
+        "docs_group": "vectorsearch",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListEndpointsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "CreateEndpoint",
+            "description": "Create a new endpoint.",
+            "summary": "Create an endpoint.",
+            "path": "/api/2.0/vector-search/endpoints",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateEndpoint",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the AI Search endpoint",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "endpoint_type",
+                  "description": "Type of endpoint",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "EndpointType",
+                    "enum": [
+                      {
+                        "content": "STANDARD"
+                      },
+                      {
+                        "content": "STORAGE_OPTIMIZED"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the AI Search endpoint",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "endpoint_type",
+                  "description": "Type of endpoint",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "EndpointType",
+                    "enum": [
+                      {
+                        "content": "STANDARD"
+                      },
+                      {
+                        "content": "STORAGE_OPTIMIZED"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "EndpointInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "budget_policy_id",
+                "description": "The budget policy id to be applied",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "endpoint_type",
+                "description": "Type of endpoint",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EndpointType",
+                  "enum": [
+                    {
+                      "content": "STANDARD"
+                    },
+                    {
+                      "content": "STORAGE_OPTIMIZED"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the AI Search endpoint",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "target_qps",
+                "description": "Target QPS for the endpoint. Mutually exclusive with num_replicas.\nThe actual replica count is calculated at index creation/sync time based on this value.\nBest-effort target; the system does not guarantee this QPS will be achieved.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "usage_policy_id",
+                "description": "The usage policy id to be applied once we've migrated to usage policies",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the AI Search endpoint",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "endpoint_type",
+                "description": "Type of endpoint",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EndpointType",
+                  "enum": [
+                    {
+                      "content": "STANDARD"
+                    },
+                    {
+                      "content": "STORAGE_OPTIMIZED"
+                    }
+                  ]
+                }
+              }
+            ],
+            "wait": {
+              "success": [
+                {
+                  "content": "ONLINE"
+                }
+              ],
+              "timeout": 20,
+              "complex_message_path": true,
+              "poll": {
+                "response": {
+                  "pascal_name": "EndpointInfo"
+                }
+              },
+              "status_path": [
+                {
+                  "pascal_name": "EndpointStatus"
+                },
+                {
+                  "pascal_name": "State"
+                }
+              ],
+              "message_path": [
+                {
+                  "pascal_name": "EndpointStatus"
+                },
+                {
+                  "pascal_name": "Message"
+                }
+              ],
+              "message_path_head": {
+                "pascal_name": "EndpointStatus"
+              }
+            }
+          },
+          {
+            "name": "DeleteEndpoint",
+            "description": "Delete an AI Search endpoint.",
+            "summary": "Delete an endpoint.",
+            "path": "/api/2.0/vector-search/endpoints/{endpoint_name}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteEndpointRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "endpoint_name",
+                  "description": "Name of the AI Search endpoint",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "endpoint_name",
+                  "description": "Name of the AI Search endpoint",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteEndpointResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "endpoint_name",
+                "description": "Name of the AI Search endpoint",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "endpoint_name",
+                "description": "Name of the AI Search endpoint",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetEndpoint",
+            "description": "Get details for a single AI Search endpoint.",
+            "summary": "Get an endpoint.",
+            "path": "/api/2.0/vector-search/endpoints/{endpoint_name}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetEndpointRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "endpoint_name",
+                  "description": "Name of the endpoint",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "endpoint_name",
+                  "description": "Name of the endpoint",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "EndpointInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "endpoint_name",
+                "description": "Name of the endpoint",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "endpoint_name",
+                "description": "Name of the endpoint",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetPermissionLevels",
+            "description": "Gets the permission levels that a user can have on an object.",
+            "summary": "Get vector search endpoint permission levels.",
+            "path": "/api/2.0/permissions/vector-search-endpoints/{endpoint_id}/permissionLevels",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetVectorSearchEndpointPermissionLevelsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "endpoint_id",
+                  "description": "The vector search endpoint for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "endpoint_id",
+                  "description": "The vector search endpoint for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetVectorSearchEndpointPermissionLevelsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "endpoint_id",
+                "description": "The vector search endpoint for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "endpoint_id",
+                "description": "The vector search endpoint for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetPermissions",
+            "description": "Gets the permissions of a vector search endpoint. Vector search endpoints can inherit permissions from their root object.",
+            "summary": "Get vector search endpoint permissions.",
+            "path": "/api/2.0/permissions/vector-search-endpoints/{endpoint_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetVectorSearchEndpointPermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "endpoint_id",
+                  "description": "The vector search endpoint for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "endpoint_id",
+                  "description": "The vector search endpoint for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "VectorSearchEndpointPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "endpoint_id",
+                "description": "The vector search endpoint for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "endpoint_id",
+                "description": "The vector search endpoint for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListEndpoints",
+            "description": "List all AI Search endpoints in the workspace.",
+            "summary": "List all endpoints.",
+            "path": "/api/2.0/vector-search/endpoints",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListEndpointsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListEndpointResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_token",
+                "description": "Token for pagination",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Token for pagination",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "PatchEndpoint",
+            "description": "Update an endpoint",
+            "summary": "Update an endpoint.",
+            "path": "/api/2.0/vector-search/endpoints/{endpoint_name}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "PatchEndpointRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "endpoint_name",
+                  "description": "Name of the AI Search endpoint",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "endpoint_name",
+                  "description": "Name of the AI Search endpoint",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "EndpointInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "endpoint_name",
+                "description": "Name of the AI Search endpoint",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "target_qps",
+                "description": "Target QPS for the endpoint. Best-effort; the system does not guarantee this QPS\nwill be achieved.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "endpoint_name",
+                "description": "Name of the AI Search endpoint",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "RetrieveUserVisibleMetrics",
+            "description": "Retrieve user-visible metrics for an endpoint",
+            "summary": "Retrieve user-visible metrics for an endpoint.",
+            "path": "/api/2.0/vector-search/endpoints/{name}/metrics",
+            "can_use_json": true,
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "RetrieveUserVisibleMetricsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "AI Search endpoint name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "AI Search endpoint name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "RetrieveUserVisibleMetricsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "end_time",
+                "description": "End time for metrics query",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "granularity_in_seconds",
+                "description": "Granularity in seconds",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "metrics",
+                "description": "List of metrics to retrieve",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "MetricList",
+                  "array_value": {
+                    "pascal_name": "Metric",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "name",
+                "description": "AI Search endpoint name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Token for pagination",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "start_time",
+                "description": "Start time for metrics query",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "AI Search endpoint name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "SetPermissions",
+            "description": "Sets permissions on an object, replacing existing permissions if they exist. Deletes all direct permissions if none are specified. Objects can inherit permissions from their root object.",
+            "summary": "Set vector search endpoint permissions.",
+            "path": "/api/2.0/permissions/vector-search-endpoints/{endpoint_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "VectorSearchEndpointPermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "endpoint_id",
+                  "description": "The vector search endpoint for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "endpoint_id",
+                  "description": "The vector search endpoint for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "VectorSearchEndpointPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "access_control_list",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "VectorSearchEndpointAccessControlRequestList",
+                  "array_value": {
+                    "pascal_name": "VectorSearchEndpointAccessControlRequest",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "endpoint_id",
+                "description": "The vector search endpoint for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "endpoint_id",
+                "description": "The vector search endpoint for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateEndpointBudgetPolicy",
+            "description": "Update the budget policy of an endpoint",
+            "summary": "Update the budget policy of an endpoint.",
+            "path": "/api/2.0/vector-search/endpoints/{endpoint_name}/budget-policy",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_PREVIEW",
+            "cli_launch_stage_label": "*Public Preview*",
+            "cli_launch_stage_banner": "This command is in Public Preview and may change without notice.",
+            "cli_launch_stage_display": "Public Preview",
+            "request": {
+              "pascal_name": "PatchEndpointBudgetPolicyRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "endpoint_name",
+                  "description": "Name of the AI Search endpoint",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "budget_policy_id",
+                  "description": "The budget policy id to be applied",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "endpoint_name",
+                  "description": "Name of the AI Search endpoint",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "budget_policy_id",
+                  "description": "The budget policy id to be applied",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "PatchEndpointBudgetPolicyResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "budget_policy_id",
+                "description": "The budget policy id to be applied",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "endpoint_name",
+                "description": "Name of the AI Search endpoint",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "endpoint_name",
+                "description": "Name of the AI Search endpoint",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "budget_policy_id",
+                "description": "The budget policy id to be applied",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateEndpointCustomTags",
+            "description": "Update the custom tags of an endpoint.",
+            "summary": "Update the custom tags of an endpoint.",
+            "path": "/api/2.0/vector-search/endpoints/{endpoint_name}/tags",
+            "can_use_json": true,
+            "must_use_json": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "UpdateEndpointCustomTagsRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "endpoint_name",
+                  "description": "Name of the AI Search endpoint",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "custom_tags",
+                  "description": "The new custom tags for the AI Search endpoint",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CustomTagList",
+                    "array_value": {
+                      "pascal_name": "CustomTag",
+                      "is_object": true
+                    }
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "endpoint_name",
+                  "description": "Name of the AI Search endpoint",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "custom_tags",
+                  "description": "The new custom tags for the AI Search endpoint",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "CustomTagList",
+                    "array_value": {
+                      "pascal_name": "CustomTag",
+                      "is_object": true
+                    }
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "UpdateEndpointCustomTagsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "custom_tags",
+                "description": "The new custom tags for the AI Search endpoint",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CustomTagList",
+                  "array_value": {
+                    "pascal_name": "CustomTag",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "endpoint_name",
+                "description": "Name of the AI Search endpoint",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "endpoint_name",
+                "description": "Name of the AI Search endpoint",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdatePermissions",
+            "description": "Updates the permissions on a vector search endpoint. Vector search endpoints can inherit permissions from their root object.",
+            "summary": "Update vector search endpoint permissions.",
+            "path": "/api/2.0/permissions/vector-search-endpoints/{endpoint_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "VectorSearchEndpointPermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "endpoint_id",
+                  "description": "The vector search endpoint for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "endpoint_id",
+                  "description": "The vector search endpoint for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "VectorSearchEndpointPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "access_control_list",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "VectorSearchEndpointAccessControlRequestList",
+                  "array_value": {
+                    "pascal_name": "VectorSearchEndpointAccessControlRequest",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "endpoint_id",
+                "description": "The vector search endpoint for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "endpoint_id",
+                "description": "The vector search endpoint for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "vectorsearch.VectorSearchIndexes",
+        "name": "VectorSearchIndexes",
+        "description": "**Index**: An efficient representation of your embedding vectors that supports real-time and\nefficient approximate nearest neighbor (ANN) search queries.\n\nThere are 2 types of AI Search indexes:\n- **Delta Sync Index**: An index that automatically syncs with a source Delta Table, automatically\nand incrementally updating the index as the underlying data in the Delta Table changes.\n- **Direct Vector Access Index**: An index that supports direct read and write of vectors and metadata\nthrough our REST and SDK APIs. With this model, the user manages index updates.",
+        "package": {
+          "name": "vectorsearch"
+        },
+        "docs_group": "vectorsearch",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListIndexesRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "CreateIndex",
+            "description": "Create a new index.",
+            "summary": "Create an index.",
+            "path": "/api/2.0/vector-search/indexes",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateVectorIndexRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the index",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "endpoint_name",
+                  "description": "Name of the endpoint to be used for serving the index",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "primary_key",
+                  "description": "Primary key of the index",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "index_type",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "VectorIndexType",
+                    "enum": [
+                      {
+                        "content": "DELTA_SYNC"
+                      },
+                      {
+                        "content": "DIRECT_ACCESS"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the index",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "endpoint_name",
+                  "description": "Name of the endpoint to be used for serving the index",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "primary_key",
+                  "description": "Primary key of the index",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "index_type",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "VectorIndexType",
+                    "enum": [
+                      {
+                        "content": "DELTA_SYNC"
+                      },
+                      {
+                        "content": "DIRECT_ACCESS"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "VectorIndex",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "delta_sync_index_spec",
+                "description": "Specification for Delta Sync Index. Required if `index_type` is `DELTA_SYNC`.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "DeltaSyncVectorIndexSpecRequest",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "direct_access_index_spec",
+                "description": "Specification for Direct Vector Access Index. Required if `index_type` is `DIRECT_ACCESS`.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "DirectAccessVectorIndexSpec",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "endpoint_name",
+                "description": "Name of the endpoint to be used for serving the index",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "index_subtype",
+                "description": "The subtype of the index. Use `HYBRID` or `FULL_TEXT`. `VECTOR` is not supported.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "IndexSubtype",
+                  "enum": [
+                    {
+                      "content": "FULL_TEXT"
+                    },
+                    {
+                      "content": "HYBRID"
+                    },
+                    {
+                      "content": "VECTOR"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "index_type",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "VectorIndexType",
+                  "enum": [
+                    {
+                      "content": "DELTA_SYNC"
+                    },
+                    {
+                      "content": "DIRECT_ACCESS"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the index",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "primary_key",
+                "description": "Primary key of the index",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the index",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "endpoint_name",
+                "description": "Name of the endpoint to be used for serving the index",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "primary_key",
+                "description": "Primary key of the index",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "index_type",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "VectorIndexType",
+                  "enum": [
+                    {
+                      "content": "DELTA_SYNC"
+                    },
+                    {
+                      "content": "DIRECT_ACCESS"
+                    }
+                  ]
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteDataVectorIndex",
+            "description": "Handles the deletion of data from a specified vector index.",
+            "summary": "Delete data from index.",
+            "path": "/api/2.0/vector-search/indexes/{index_name}/delete-data",
+            "can_use_json": true,
+            "must_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteDataVectorIndexRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "index_name",
+                  "description": "Name of the vector index where data is to be deleted. Must be a Direct Vector Access Index.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "primary_keys",
+                  "description": "List of primary keys for the data to be deleted.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "pascal_name": "List",
+                    "array_value": {
+                      "is_string": true
+                    }
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "index_name",
+                  "description": "Name of the vector index where data is to be deleted. Must be a Direct Vector Access Index.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "primary_keys",
+                  "description": "List of primary keys for the data to be deleted.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "pascal_name": "List",
+                    "array_value": {
+                      "is_string": true
+                    }
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteDataVectorIndexResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "index_name",
+                "description": "Name of the vector index where data is to be deleted. Must be a Direct Vector Access Index.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "primary_keys",
+                "description": "List of primary keys for the data to be deleted.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "index_name",
+                "description": "Name of the vector index where data is to be deleted. Must be a Direct Vector Access Index.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteIndex",
+            "description": "Delete an index.",
+            "summary": "Delete an index.",
+            "path": "/api/2.0/vector-search/indexes/{index_name}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteIndexRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "index_name",
+                  "description": "Name of the index",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "index_name",
+                  "description": "Name of the index",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteIndexResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "index_name",
+                "description": "Name of the index",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "index_name",
+                "description": "Name of the index",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetIndex",
+            "description": "Get an index.",
+            "summary": "Get an index.",
+            "path": "/api/2.0/vector-search/indexes/{index_name}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetIndexRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "index_name",
+                  "description": "Name of the index",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "index_name",
+                  "description": "Name of the index",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "VectorIndex",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "ensure_reranker_compatible",
+                "description": "If true, the URL returned for the index is guaranteed to be compatible with the reranker.\nCurrently this means we return the CP URL regardless of how the index is being accessed.\nIf not set or set to false, the URL may still be compatible with the reranker depending on\nwhat URL we return.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "index_name",
+                "description": "Name of the index",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "index_name",
+                "description": "Name of the index",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListIndexes",
+            "description": "List all indexes in the given endpoint.",
+            "summary": "List indexes.",
+            "path": "/api/2.0/vector-search/indexes",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListIndexesRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "endpoint_name",
+                  "description": "Name of the endpoint",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "endpoint_name",
+                  "description": "Name of the endpoint",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListVectorIndexesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "endpoint_name",
+                "description": "Name of the endpoint",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Token for pagination",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "endpoint_name",
+                "description": "Name of the endpoint",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Token for pagination",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "QueryIndex",
+            "description": "Query the specified vector index.",
+            "summary": "Query an index.",
+            "path": "/api/2.0/vector-search/indexes/{index_name}/query",
+            "can_use_json": true,
+            "must_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "QueryVectorIndexRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "index_name",
+                  "description": "Name of the vector index to query.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "columns",
+                  "description": "List of column names to include in the response.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "List",
+                    "array_value": {
+                      "is_string": true
+                    }
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "index_name",
+                  "description": "Name of the vector index to query.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "columns",
+                  "description": "List of column names to include in the response.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "List",
+                    "array_value": {
+                      "is_string": true
+                    }
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "QueryVectorIndexResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "columns",
+                "description": "List of column names to include in the response.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "columns_to_rerank",
+                "description": "Column names used to retrieve data to send to the reranker.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "facets",
+                "description": "Facets to compute over the matched results. Each entry has one of these forms:\n`\"\u003ccolumn\u003e\"`                         - top 10 distinct values by count\n`\"\u003ccolumn\u003e TOP \u003cn\u003e\"`                 - top n distinct values, where n \u003e 0\n`\"\u003ccolumn\u003e BUCKETS [[from,to],...]\"` - inclusive numeric ranges\n`TOP` and `BUCKETS` are case-insensitive. A column may appear at most once.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "filters_json",
+                "description": "JSON string representing query filters.\n\nExample filters:\n\n- `{\"id \u003c\": 5}`: Filter for id less than 5.\n- `{\"id \u003e\": 5}`: Filter for id greater than 5.\n- `{\"id \u003c=\": 5}`: Filter for id less than equal to 5.\n- `{\"id \u003e=\": 5}`: Filter for id greater than equal to 5.\n- `{\"id\": 5}`: Filter for id equal to 5.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "index_name",
+                "description": "Name of the vector index to query.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "num_results",
+                "description": "Number of results to return. Defaults to 10.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "query_columns",
+                "description": "Text columns to search for `query_text`. When empty, all text columns are searched.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "query_text",
+                "description": "Query text. Required for Delta Sync Index using model endpoint.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "query_type",
+                "description": "The query type to use. Choices are `ANN` and `HYBRID` and `FULL_TEXT`. Defaults to `ANN`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "query_vector",
+                "description": "Query vector. Required for Direct Vector Access Index and Delta Sync Index using self-managed vectors.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_float64": true
+                  }
+                }
+              },
+              {
+                "name": "reranker",
+                "description": "If set, the top 50 results are reranked with the Databricks Reranker model before returning the `num_results` results to the user.\nThe setting `columns_to_rerank` selects which columns are used for reranking. For each datapoint, the columns selected are concatenated before\nbeing sent to the reranking model. See https://docs.databricks.com/aws/en/vector-search/query-vector-search#rerank for more information.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "RerankerConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "score_threshold",
+                "description": "Threshold for the approximate nearest neighbor search. Defaults to 0.0.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_float64": true
+                }
+              },
+              {
+                "name": "sort_columns",
+                "description": "Sort results by column values instead of the default relevance ordering.\nEach clause has the form `\"\u003ccolumn\u003e ASC\"` or `\"\u003ccolumn\u003e DESC\"`, for example\n`[\"rating DESC\", \"price ASC\"]`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_string": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "index_name",
+                "description": "Name of the vector index to query.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "QueryNextPage",
+            "description": "Use `next_page_token` returned from previous `QueryVectorIndex` or `QueryVectorIndexNextPage` request to fetch next page of results.",
+            "summary": "Query next page.",
+            "path": "/api/2.0/vector-search/indexes/{index_name}/query-next-page",
+            "can_use_json": true,
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "QueryVectorIndexNextPageRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "index_name",
+                  "description": "Name of the vector index to query.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "index_name",
+                  "description": "Name of the vector index to query.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "QueryVectorIndexResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "endpoint_name",
+                "description": "Name of the endpoint.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "index_name",
+                "description": "Name of the vector index to query.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Page token returned from previous `QueryVectorIndex` or `QueryVectorIndexNextPage` API.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "index_name",
+                "description": "Name of the vector index to query.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ScanIndex",
+            "description": "Scan the specified vector index and return the first `num_results` entries after the exclusive `primary_key`.",
+            "summary": "Scan an index.",
+            "path": "/api/2.0/vector-search/indexes/{index_name}/scan",
+            "can_use_json": true,
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ScanVectorIndexRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "index_name",
+                  "description": "Name of the vector index to scan.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "index_name",
+                  "description": "Name of the vector index to scan.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ScanVectorIndexResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "index_name",
+                "description": "Name of the vector index to scan.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "last_primary_key",
+                "description": "Primary key of the last entry returned in the previous scan.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "num_results",
+                "description": "Number of results to return. Defaults to 10.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "index_name",
+                "description": "Name of the vector index to scan.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "SyncIndex",
+            "description": "Triggers a synchronization process for a specified vector index.",
+            "summary": "Synchronize an index.",
+            "path": "/api/2.0/vector-search/indexes/{index_name}/sync",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "SyncIndexRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "index_name",
+                  "description": "Name of the vector index to synchronize. Must be a Delta Sync Index.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "index_name",
+                  "description": "Name of the vector index to synchronize. Must be a Delta Sync Index.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "SyncIndexResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "index_name",
+                "description": "Name of the vector index to synchronize. Must be a Delta Sync Index.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "index_name",
+                "description": "Name of the vector index to synchronize. Must be a Delta Sync Index.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpsertDataVectorIndex",
+            "description": "Handles the upserting of data into a specified vector index.",
+            "summary": "Upsert data into an index.",
+            "path": "/api/2.0/vector-search/indexes/{index_name}/upsert-data",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpsertDataVectorIndexRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "index_name",
+                  "description": "Name of the vector index where data is to be upserted. Must be a Direct Vector Access Index.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "inputs_json",
+                  "description": "JSON string representing the data to be upserted.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "index_name",
+                  "description": "Name of the vector index where data is to be upserted. Must be a Direct Vector Access Index.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "inputs_json",
+                  "description": "JSON string representing the data to be upserted.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "UpsertDataVectorIndexResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "index_name",
+                "description": "Name of the vector index where data is to be upserted. Must be a Direct Vector Access Index.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "inputs_json",
+                "description": "JSON string representing the data to be upserted.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "index_name",
+                "description": "Name of the vector index where data is to be upserted. Must be a Direct Vector Access Index.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "inputs_json",
+                "description": "JSON string representing the data to be upserted.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "catalog.Volumes",
+        "name": "Volumes",
+        "description": "Volumes are a Unity Catalog (UC) capability for accessing, storing, governing,\norganizing, and processing files. Use cases include running machine learning\non unstructured data such as image, audio, video, or PDF files, organizing data sets\nduring the data exploration stages in data science, working with libraries\nthat require access to the local file system on cluster machines, storing library\nand config files of arbitrary formats such as .whl or .txt centrally\nand providing secure access to those files across workspaces,\nor transforming and querying non-tabular data files in ETL.",
+        "package": {
+          "name": "catalog"
+        },
+        "docs_group": "catalog",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "named_id_map": {
+            "pascal_name": "VolumeInfoNameToVolumeIdMap"
+          },
+          "request": {
+            "pascal_name": "ListVolumesRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a new volume.\n\nThe user could create either an external volume or a managed volume. An external volume\nwill be created in the specified external location, while a managed volume\nwill be located in the default location which is specified by the parent schema,\nor the parent catalog, or the Metastore.\n\nFor the volume creation to succeed, the user must satisfy following conditions:\n- The caller must be a metastore admin, or be the owner of the parent catalog and schema,\nor have the **USE_CATALOG** privilege on the parent catalog\nand the **USE_SCHEMA** privilege on the parent schema.\n- The caller must have **CREATE VOLUME** privilege on the parent schema.\n\nFor an external volume, following conditions also need to satisfy\n- The caller must have **CREATE EXTERNAL VOLUME** privilege on the external location.\n- There are no other tables, nor volumes existing in the specified storage location.\n- The specified storage location is not under the location of other tables, nor volumes,\nor catalogs or schemas.",
+            "summary": "Create a Volume.",
+            "path": "/api/2.1/unity-catalog/volumes",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateVolumeRequestContent",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "catalog_name",
+                  "description": "The name of the catalog where the schema and the volume are",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schema_name",
+                  "description": "The name of the schema where the volume is",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "name",
+                  "description": "The name of the volume",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "volume_type",
+                  "description": "The type of the volume. An external volume is located in the specified external location.\nA managed volume is located in the default location which is specified by the parent schema, or the parent catalog, or the Metastore.\n[Learn more](https://docs.databricks.com/aws/en/volumes/managed-vs-external)",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "VolumeType",
+                    "enum": [
+                      {
+                        "content": "EXTERNAL"
+                      },
+                      {
+                        "content": "MANAGED"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "catalog_name",
+                  "description": "The name of the catalog where the schema and the volume are",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schema_name",
+                  "description": "The name of the schema where the volume is",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "name",
+                  "description": "The name of the volume",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "volume_type",
+                  "description": "The type of the volume. An external volume is located in the specified external location.\nA managed volume is located in the default location which is specified by the parent schema, or the parent catalog, or the Metastore.\n[Learn more](https://docs.databricks.com/aws/en/volumes/managed-vs-external)",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "VolumeType",
+                    "enum": [
+                      {
+                        "content": "EXTERNAL"
+                      },
+                      {
+                        "content": "MANAGED"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "VolumeInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "catalog_name",
+                "description": "The name of the catalog where the schema and the volume are",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "comment",
+                "description": "The comment attached to the volume",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the volume",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schema_name",
+                "description": "The name of the schema where the volume is",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "storage_location",
+                "description": "The storage location on the cloud",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "volume_type",
+                "description": "The type of the volume. An external volume is located in the specified external location.\nA managed volume is located in the default location which is specified by the parent schema, or the parent catalog, or the Metastore.\n[Learn more](https://docs.databricks.com/aws/en/volumes/managed-vs-external)",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "VolumeType",
+                  "enum": [
+                    {
+                      "content": "EXTERNAL"
+                    },
+                    {
+                      "content": "MANAGED"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "catalog_name",
+                "description": "The name of the catalog where the schema and the volume are",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schema_name",
+                "description": "The name of the schema where the volume is",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the volume",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "volume_type",
+                "description": "The type of the volume. An external volume is located in the specified external location.\nA managed volume is located in the default location which is specified by the parent schema, or the parent catalog, or the Metastore.\n[Learn more](https://docs.databricks.com/aws/en/volumes/managed-vs-external)",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "VolumeType",
+                  "enum": [
+                    {
+                      "content": "EXTERNAL"
+                    },
+                    {
+                      "content": "MANAGED"
+                    }
+                  ]
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes a volume from the specified parent catalog and schema.\n\nThe caller must be a metastore admin or an owner of the volume.\nFor the latter case, the caller must also be the owner or have the **USE_CATALOG**\nprivilege on the parent catalog and the **USE_SCHEMA** privilege on the parent schema.",
+            "summary": "Delete a Volume.",
+            "path": "/api/2.1/unity-catalog/volumes/{name}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteVolumeRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The three-level (fully qualified) name of the volume",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The three-level (fully qualified) name of the volume",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The three-level (fully qualified) name of the volume",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The three-level (fully qualified) name of the volume",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Gets an array of volumes for the current metastore\nunder the parent catalog and schema.\n\nThe returned volumes are filtered based on the privileges of the calling user.\nFor example, the metastore admin is able to list all the volumes.\nA regular user needs to be the owner or have the **READ VOLUME** privilege\non the volume to receive the volumes in the response.\nFor the latter case, the caller must also be the owner or have the **USE_CATALOG**\nprivilege on the parent catalog and the **USE_SCHEMA** privilege on the parent schema.\n\nThere is no guarantee of a specific ordering of the elements in the array.\n\nPAGINATION BEHAVIOR: The API is by default paginated, a page may contain zero results while still providing a next_page_token.\nClients must continue reading pages until next_page_token is absent, which is the only indication that the end of results has been reached.",
+            "summary": "List Volumes.",
+            "path": "/api/2.1/unity-catalog/volumes",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListVolumesRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "catalog_name",
+                  "description": "The identifier of the catalog",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schema_name",
+                  "description": "The identifier of the schema",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "catalog_name",
+                  "description": "The identifier of the catalog",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "schema_name",
+                  "description": "The identifier of the schema",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListVolumesResponseContent",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "catalog_name",
+                "description": "The identifier of the catalog",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "include_browse",
+                "description": "Whether to include volumes in the response for which the principal can only access selective metadata for",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "max_results",
+                "description": "Maximum number of volumes to return (page length).\n\nIf not set, the page length is set to a server configured value (10000, as of 1/29/2024).\n- when set to a value greater than 0, the page length is the minimum of this value and a server configured value (10000, as of 1/29/2024);\n- when set to 0, the page length is set to a server configured value (10000, as of 1/29/2024) (recommended);\n- when set to a value less than 0, an invalid parameter error is returned;\n\nNote: this parameter controls only the maximum number of volumes to return. The actual number of volumes returned in a page\nmay be smaller than this value, including 0, even if there are more pages.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque token returned by a previous request. It must be included in the request to retrieve the next page of results (pagination).",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schema_name",
+                "description": "The identifier of the schema",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "catalog_name",
+                "description": "The identifier of the catalog",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "schema_name",
+                "description": "The identifier of the schema",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Opaque token returned by a previous request. It must be included in the request to retrieve the next page of results (pagination).",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "Read",
+            "description": "Gets a volume from the metastore for a specific catalog and schema.\n\nThe caller must be a metastore admin or an owner of (or have the **READ VOLUME**\nprivilege on) the volume.\nFor the latter case, the caller must also be the owner or have the **USE_CATALOG**\nprivilege on the parent catalog and the **USE_SCHEMA** privilege on the parent schema.",
+            "summary": "Get a Volume.",
+            "path": "/api/2.1/unity-catalog/volumes/{name}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ReadVolumeRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The three-level (fully qualified) name of the volume",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The three-level (fully qualified) name of the volume",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "VolumeInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "include_browse",
+                "description": "Whether to include volumes in the response for which the principal can only access selective metadata for",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The three-level (fully qualified) name of the volume",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The three-level (fully qualified) name of the volume",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Update",
+            "description": "Updates the specified volume under the specified parent catalog and schema.\n\nThe caller must be a metastore admin or an owner of the volume.\nFor the latter case, the caller must also be the owner or have the **USE_CATALOG**\nprivilege on the parent catalog and the **USE_SCHEMA** privilege on the parent schema.\n\nCurrently only the name, the owner or the comment of the volume could be updated.",
+            "summary": "Update a Volume.",
+            "path": "/api/2.1/unity-catalog/volumes/{name}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateVolumeRequestContent",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The three-level (fully qualified) name of the volume",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The three-level (fully qualified) name of the volume",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "VolumeInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "comment",
+                "description": "The comment attached to the volume",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The three-level (fully qualified) name of the volume",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "new_name",
+                "description": "New name for the volume.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "owner",
+                "description": "The identifier of the user who owns the volume",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The three-level (fully qualified) name of the volume",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "provisioning.VpcEndpoints",
+        "name": "VpcEndpoints",
+        "description": "These APIs manage VPC endpoint configurations for this account.",
+        "package": {
+          "name": "provisioning"
+        },
+        "is_accounts": true,
+        "docs_group": "provisioning",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a VPC endpoint configuration, which represents a\n[VPC endpoint](https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints.html)\nobject in AWS used to communicate privately with Databricks over\n[AWS PrivateLink](https://aws.amazon.com/privatelink).\n\nAfter you create the VPC endpoint configuration, the Databricks\n[endpoint service](https://docs.aws.amazon.com/vpc/latest/privatelink/privatelink-share-your-services.html)\nautomatically accepts the VPC endpoint.\n\nBefore configuring PrivateLink, read the\n[Databricks article about PrivateLink](https://docs.databricks.com/administration-guide/cloud-configurations/aws/privatelink.html).",
+            "summary": "Create a VPC endpoint configuration.",
+            "path": "/api/2.0/accounts/{account_id}/vpc-endpoints",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateVpcEndpointRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "VpcEndpoint",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "aws_vpc_endpoint_id",
+                "description": "The ID of the VPC endpoint object in AWS.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "gcp_vpc_endpoint_info",
+                "description": "The cloud info of this vpc endpoint.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "GcpVpcEndpointInfo",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "region",
+                "description": "The region in which this VPC endpoint object exists.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "vpc_endpoint_name",
+                "description": "The human-readable name of the storage configuration.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes a Databricks VPC endpoint configuration. You cannot delete a VPC endpoint configuration that is associated with any workspace.",
+            "summary": "Delete a VPC endpoint configuration.",
+            "path": "/api/2.0/accounts/{account_id}/vpc-endpoints/{vpc_endpoint_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteVpcEndpointRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "vpc_endpoint_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "vpc_endpoint_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "VpcEndpoint",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "vpc_endpoint_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "vpc_endpoint_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets a VPC endpoint configuration, which represents\na [VPC endpoint](https://docs.aws.amazon.com/vpc/latest/privatelink/concepts.html)\nobject in AWS used to communicate privately with Databricks over\n[AWS PrivateLink](https://aws.amazon.com/privatelink).",
+            "summary": "Get a VPC endpoint configuration.",
+            "path": "/api/2.0/accounts/{account_id}/vpc-endpoints/{vpc_endpoint_id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetVpcEndpointRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "vpc_endpoint_id",
+                  "description": "Databricks VPC endpoint ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "vpc_endpoint_id",
+                  "description": "Databricks VPC endpoint ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "VpcEndpoint",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "vpc_endpoint_id",
+                "description": "Databricks VPC endpoint ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "vpc_endpoint_id",
+                "description": "Databricks VPC endpoint ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Lists Databricks VPC endpoint configurations for an account.",
+            "summary": "List VPC endpoint configurations.",
+            "path": "/api/2.0/accounts/{account_id}/vpc-endpoints",
+            "is_legacy_empty_request": true,
+            "is_crud_read": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListVpcEndpointsRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "VpcEndpointList",
+              "array_value": {
+                "pascal_name": "VpcEndpoint",
+                "is_object": true
+              }
+            }
+          }
+        ]
+      },
+      {
+        "id": "sql.Warehouses",
+        "name": "Warehouses",
+        "description": "A SQL warehouse is a compute resource that lets you run SQL commands on data objects within Databricks SQL. Compute resources are infrastructure resources that provide processing capabilities in the cloud.",
+        "package": {
+          "name": "sql"
+        },
+        "docs_group": "sql",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "named_id_map": {
+            "pascal_name": "EndpointInfoNameToIdMap"
+          },
+          "request": {
+            "pascal_name": "ListWarehousesRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a new SQL warehouse.",
+            "summary": "Create a warehouse.",
+            "path": "/api/2.0/sql/warehouses",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateWarehouseRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "CreateWarehouseResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "auto_stop_mins",
+                "description": "The amount of time in minutes that a SQL warehouse must be idle (i.e., no\nRUNNING queries) before it is automatically stopped.\n\nSupported values:\n- Must be == 0 or \u003e= 10 mins\n- 0 indicates no autostop.\n\nDefaults to 120 mins",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "channel",
+                "description": "Channel Details",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "Channel",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "cluster_size",
+                "description": "Size of the clusters allocated for this warehouse.\nIncreasing the size of a spark cluster allows you to run larger queries on\nit. If you want to increase the number of concurrent queries, please tune\nmax_num_clusters.\n\nSupported values:\n- 2X-Small\n- X-Small\n- Small\n- Medium\n- Large\n- X-Large\n- 2X-Large\n- 3X-Large\n- 4X-Large\n- 5X-Large",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "creator_name",
+                "description": "warehouse creator name",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "enable_photon",
+                "description": "Configures whether the warehouse should use Photon optimized clusters.\n\nDefaults to true.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "enable_serverless_compute",
+                "description": "Configures whether the warehouse should use serverless compute",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "instance_profile_arn",
+                "description": "Deprecated. Instance profile used to pass IAM role to the cluster",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "max_num_clusters",
+                "description": "Maximum number of clusters that the autoscaler will create to handle\nconcurrent queries.\n\nSupported values:\n- Must be \u003e= min_num_clusters\n- Must be \u003c= 40.\n\nDefaults to min_clusters if unset.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "min_num_clusters",
+                "description": "Minimum number of available clusters that will be maintained for this SQL\nwarehouse. Increasing this will ensure that a larger number of clusters are\nalways running and therefore may reduce the cold start time for new\nqueries. This is similar to reserved vs. revocable cores in a resource\nmanager.\n\nSupported values:\n- Must be \u003e 0\n- Must be \u003c= min(max_num_clusters, 30)\n\nDefaults to 1",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Logical name for the cluster.\n\nSupported values:\n- Must be unique within an org.\n- Must be less than 100 characters.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "spot_instance_policy",
+                "description": "Configurations whether the endpoint should use spot instances.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "SpotInstancePolicy",
+                  "enum": [
+                    {
+                      "content": "COST_OPTIMIZED"
+                    },
+                    {
+                      "content": "POLICY_UNSPECIFIED"
+                    },
+                    {
+                      "content": "RELIABILITY_OPTIMIZED"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "statement_timeout",
+                "description": "Warehouse statement timeout in seconds.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "tags",
+                "description": "A set of key-value pairs that will be tagged on all resources (e.g., AWS instances and EBS volumes) associated\nwith this SQL warehouse.\n\nSupported values:\n- Number of tags \u003c 45.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "EndpointTags",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "warehouse_type",
+                "description": "Warehouse type: `PRO` or `CLASSIC`. If you want to use serverless compute,\nyou must set to `PRO` and also set the field `enable_serverless_compute` to `true`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CreateWarehouseRequestWarehouseType",
+                  "enum": [
+                    {
+                      "content": "CLASSIC"
+                    },
+                    {
+                      "content": "PRO"
+                    },
+                    {
+                      "content": "REALTIME"
+                    },
+                    {
+                      "content": "TYPE_UNSPECIFIED"
+                    }
+                  ]
+                }
+              }
+            ],
+            "wait": {
+              "success": [
+                {
+                  "content": "RUNNING"
+                }
+              ],
+              "timeout": 20,
+              "complex_message_path": true,
+              "poll": {
+                "response": {
+                  "pascal_name": "GetWarehouseResponse"
+                }
+              },
+              "status_path": [
+                {
+                  "pascal_name": "State"
+                }
+              ],
+              "message_path": [
+                {
+                  "pascal_name": "Health"
+                },
+                {
+                  "pascal_name": "Summary"
+                }
+              ],
+              "message_path_head": {
+                "pascal_name": "Health"
+              }
+            }
+          },
+          {
+            "name": "CreateDefaultWarehouseOverride",
+            "description": "Creates a new default warehouse override for a user.\nUsers can create their own override. Admins can create overrides for any user.",
+            "summary": "Create default warehouse override.",
+            "path": "/api/warehouses/v1/default-warehouse-overrides",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "CreateDefaultWarehouseOverrideRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "default_warehouse_override",
+                  "description": "Required. The default warehouse override to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DefaultWarehouseOverride",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "default_warehouse_override_id",
+                  "description": "Required. The ID to use for the override, which will become the final component\nof the override's resource name.\nCan be a numeric user ID or the literal string \"me\" for the current user.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "default_warehouse_override_id",
+                  "description": "Required. The ID to use for the override, which will become the final component\nof the override's resource name.\nCan be a numeric user ID or the literal string \"me\" for the current user.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "default_warehouse_override",
+                  "description": "Required. The default warehouse override to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DefaultWarehouseOverride",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "default_warehouse_override",
+              "description": "Required. The default warehouse override to create.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "DefaultWarehouseOverride",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "type",
+                    "description": "The type of override behavior.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "DefaultWarehouseOverrideType",
+                      "enum": [
+                        {
+                          "content": "CUSTOM"
+                        },
+                        {
+                          "content": "LAST_SELECTED"
+                        }
+                      ]
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "type",
+                    "description": "The type of override behavior.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "DefaultWarehouseOverrideType",
+                      "enum": [
+                        {
+                          "content": "CUSTOM"
+                        },
+                        {
+                          "content": "LAST_SELECTED"
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "DefaultWarehouseOverride",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "type",
+                  "description": "The type of override behavior.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DefaultWarehouseOverrideType",
+                    "enum": [
+                      {
+                        "content": "CUSTOM"
+                      },
+                      {
+                        "content": "LAST_SELECTED"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "type",
+                  "description": "The type of override behavior.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DefaultWarehouseOverrideType",
+                    "enum": [
+                      {
+                        "content": "CUSTOM"
+                      },
+                      {
+                        "content": "LAST_SELECTED"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "default_warehouse_override",
+                "description": "Required. The default warehouse override to create.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DefaultWarehouseOverride",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "type",
+                      "description": "The type of override behavior.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "DefaultWarehouseOverrideType",
+                        "enum": [
+                          {
+                            "content": "CUSTOM"
+                          },
+                          {
+                            "content": "LAST_SELECTED"
+                          }
+                        ]
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "type",
+                      "description": "The type of override behavior.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "DefaultWarehouseOverrideType",
+                        "enum": [
+                          {
+                            "content": "CUSTOM"
+                          },
+                          {
+                            "content": "LAST_SELECTED"
+                          }
+                        ]
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "default_warehouse_override_id",
+                "description": "Required. The ID to use for the override, which will become the final component\nof the override's resource name.\nCan be a numeric user ID or the literal string \"me\" for the current user.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "default_warehouse_override_id",
+                "description": "The ID component of the resource name (user ID).",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The resource name of the default warehouse override.\nFormat: default-warehouse-overrides/{default_warehouse_override_id}",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "type",
+                "description": "The type of override behavior.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DefaultWarehouseOverrideType",
+                  "enum": [
+                    {
+                      "content": "CUSTOM"
+                    },
+                    {
+                      "content": "LAST_SELECTED"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "warehouse_id",
+                "description": "The specific warehouse ID when type is CUSTOM.\nNot set for LAST_SELECTED type.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "default_warehouse_override_id",
+                "description": "Required. The ID to use for the override, which will become the final component\nof the override's resource name.\nCan be a numeric user ID or the literal string \"me\" for the current user.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "type",
+                "description": "The type of override behavior.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DefaultWarehouseOverrideType",
+                  "enum": [
+                    {
+                      "content": "CUSTOM"
+                    },
+                    {
+                      "content": "LAST_SELECTED"
+                    }
+                  ]
+                }
+              }
+            ]
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes a SQL warehouse.",
+            "summary": "Delete a warehouse.",
+            "path": "/api/2.0/sql/warehouses/{id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteWarehouseRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Required. Id of the SQL warehouse.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "Required. Id of the SQL warehouse.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteWarehouseResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "description": "Required. Id of the SQL warehouse.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Required. Id of the SQL warehouse.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteDefaultWarehouseOverride",
+            "description": "Deletes the default warehouse override for a user.\nUsers can delete their own override. Admins can delete overrides for any user.\nAfter deletion, the workspace default warehouse will be used.",
+            "summary": "Delete default warehouse override.",
+            "path": "/api/warehouses/v1/{name=default-warehouse-overrides/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "DeleteDefaultWarehouseOverrideRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Required. The resource name of the default warehouse override to delete.\nFormat: default-warehouse-overrides/{default_warehouse_override_id}\nThe default_warehouse_override_id can be a numeric user ID or the literal string \"me\" for the current user.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Required. The resource name of the default warehouse override to delete.\nFormat: default-warehouse-overrides/{default_warehouse_override_id}\nThe default_warehouse_override_id can be a numeric user ID or the literal string \"me\" for the current user.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Required. The resource name of the default warehouse override to delete.\nFormat: default-warehouse-overrides/{default_warehouse_override_id}\nThe default_warehouse_override_id can be a numeric user ID or the literal string \"me\" for the current user.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Required. The resource name of the default warehouse override to delete.\nFormat: default-warehouse-overrides/{default_warehouse_override_id}\nThe default_warehouse_override_id can be a numeric user ID or the literal string \"me\" for the current user.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Edit",
+            "description": "Updates the configuration for a SQL warehouse.",
+            "summary": "Update a warehouse.",
+            "path": "/api/2.0/sql/warehouses/{id}/edit",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "EditWarehouseRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Required. Id of the warehouse to configure.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "Required. Id of the warehouse to configure.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "EditWarehouseResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "auto_stop_mins",
+                "description": "The amount of time in minutes that a SQL warehouse must be idle (i.e., no\nRUNNING queries) before it is automatically stopped.\n\nSupported values:\n- Must be == 0 or \u003e= 10 mins\n- 0 indicates no autostop.\n\nDefaults to 120 mins",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "channel",
+                "description": "Channel Details",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "Channel",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "cluster_size",
+                "description": "Size of the clusters allocated for this warehouse.\nIncreasing the size of a spark cluster allows you to run larger queries on\nit. If you want to increase the number of concurrent queries, please tune\nmax_num_clusters.\n\nSupported values:\n- 2X-Small\n- X-Small\n- Small\n- Medium\n- Large\n- X-Large\n- 2X-Large\n- 3X-Large\n- 4X-Large\n- 5X-Large",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "creator_name",
+                "description": "warehouse creator name",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "enable_photon",
+                "description": "Configures whether the warehouse should use Photon optimized clusters.\n\nDefaults to true.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "enable_serverless_compute",
+                "description": "Configures whether the warehouse should use serverless compute",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "id",
+                "description": "Required. Id of the warehouse to configure.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "instance_profile_arn",
+                "description": "Deprecated. Instance profile used to pass IAM role to the cluster",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "max_num_clusters",
+                "description": "Maximum number of clusters that the autoscaler will create to handle\nconcurrent queries.\n\nSupported values:\n- Must be \u003e= min_num_clusters\n- Must be \u003c= 40.\n\nDefaults to min_clusters if unset.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "min_num_clusters",
+                "description": "Minimum number of available clusters that will be maintained for this SQL\nwarehouse. Increasing this will ensure that a larger number of clusters are\nalways running and therefore may reduce the cold start time for new\nqueries. This is similar to reserved vs. revocable cores in a resource\nmanager.\n\nSupported values:\n- Must be \u003e 0\n- Must be \u003c= min(max_num_clusters, 30)\n\nDefaults to 1",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Logical name for the cluster.\n\nSupported values:\n- Must be unique within an org.\n- Must be less than 100 characters.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "spot_instance_policy",
+                "description": "Configurations whether the endpoint should use spot instances.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "SpotInstancePolicy",
+                  "enum": [
+                    {
+                      "content": "COST_OPTIMIZED"
+                    },
+                    {
+                      "content": "POLICY_UNSPECIFIED"
+                    },
+                    {
+                      "content": "RELIABILITY_OPTIMIZED"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "statement_timeout",
+                "description": "Warehouse statement timeout in seconds.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "tags",
+                "description": "A set of key-value pairs that will be tagged on all resources (e.g., AWS instances and EBS volumes) associated\nwith this SQL warehouse.\n\nSupported values:\n- Number of tags \u003c 45.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "EndpointTags",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "warehouse_type",
+                "description": "Warehouse type: `PRO` or `CLASSIC`. If you want to use serverless compute,\nyou must set to `PRO` and also set the field `enable_serverless_compute` to `true`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EditWarehouseRequestWarehouseType",
+                  "enum": [
+                    {
+                      "content": "CLASSIC"
+                    },
+                    {
+                      "content": "PRO"
+                    },
+                    {
+                      "content": "REALTIME"
+                    },
+                    {
+                      "content": "TYPE_UNSPECIFIED"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Required. Id of the warehouse to configure.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "wait": {
+              "success": [
+                {
+                  "content": "RUNNING"
+                }
+              ],
+              "timeout": 20,
+              "complex_message_path": true,
+              "poll": {
+                "response": {
+                  "pascal_name": "GetWarehouseResponse"
+                }
+              },
+              "status_path": [
+                {
+                  "pascal_name": "State"
+                }
+              ],
+              "message_path": [
+                {
+                  "pascal_name": "Health"
+                },
+                {
+                  "pascal_name": "Summary"
+                }
+              ],
+              "message_path_head": {
+                "pascal_name": "Health"
+              }
+            }
+          },
+          {
+            "name": "Get",
+            "description": "Gets the information for a single SQL warehouse.",
+            "summary": "Get warehouse info.",
+            "path": "/api/2.0/sql/warehouses/{id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetWarehouseRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Required. Id of the SQL warehouse.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "Required. Id of the SQL warehouse.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetWarehouseResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "description": "Required. Id of the SQL warehouse.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Required. Id of the SQL warehouse.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetDefaultWarehouseOverride",
+            "description": "Returns the default warehouse override for a user.\nUsers can fetch their own override. Admins can fetch overrides for any user.\nIf no override exists, the UI will fallback to the workspace default warehouse.",
+            "summary": "Get default warehouse override.",
+            "path": "/api/warehouses/v1/{name=default-warehouse-overrides/*}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetDefaultWarehouseOverrideRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Required. The resource name of the default warehouse override to retrieve.\nFormat: default-warehouse-overrides/{default_warehouse_override_id}\nThe default_warehouse_override_id can be a numeric user ID or the literal string \"me\" for the current user.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Required. The resource name of the default warehouse override to retrieve.\nFormat: default-warehouse-overrides/{default_warehouse_override_id}\nThe default_warehouse_override_id can be a numeric user ID or the literal string \"me\" for the current user.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DefaultWarehouseOverride",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "type",
+                  "description": "The type of override behavior.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DefaultWarehouseOverrideType",
+                    "enum": [
+                      {
+                        "content": "CUSTOM"
+                      },
+                      {
+                        "content": "LAST_SELECTED"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "type",
+                  "description": "The type of override behavior.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DefaultWarehouseOverrideType",
+                    "enum": [
+                      {
+                        "content": "CUSTOM"
+                      },
+                      {
+                        "content": "LAST_SELECTED"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Required. The resource name of the default warehouse override to retrieve.\nFormat: default-warehouse-overrides/{default_warehouse_override_id}\nThe default_warehouse_override_id can be a numeric user ID or the literal string \"me\" for the current user.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Required. The resource name of the default warehouse override to retrieve.\nFormat: default-warehouse-overrides/{default_warehouse_override_id}\nThe default_warehouse_override_id can be a numeric user ID or the literal string \"me\" for the current user.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetPermissionLevels",
+            "description": "Gets the permission levels that a user can have on an object.",
+            "summary": "Get SQL warehouse permission levels.",
+            "path": "/api/2.0/permissions/warehouses/{warehouse_id}/permissionLevels",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetWarehousePermissionLevelsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "warehouse_id",
+                  "description": "The SQL warehouse for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "warehouse_id",
+                  "description": "The SQL warehouse for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetWarehousePermissionLevelsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "warehouse_id",
+                "description": "The SQL warehouse for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "warehouse_id",
+                "description": "The SQL warehouse for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetPermissions",
+            "description": "Gets the permissions of a SQL warehouse. SQL warehouses can inherit permissions from their root object.",
+            "summary": "Get SQL warehouse permissions.",
+            "path": "/api/2.0/permissions/warehouses/{warehouse_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetWarehousePermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "warehouse_id",
+                  "description": "The SQL warehouse for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "warehouse_id",
+                  "description": "The SQL warehouse for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "WarehousePermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "warehouse_id",
+                "description": "The SQL warehouse for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "warehouse_id",
+                "description": "The SQL warehouse for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetWorkspaceWarehouseConfig",
+            "description": "Gets the workspace level configuration that is shared by all SQL warehouses in a workspace.",
+            "summary": "Get the workspace configuration.",
+            "path": "/api/2.0/sql/config/warehouses",
+            "is_legacy_empty_request": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetWorkspaceWarehouseConfigRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "GetWorkspaceWarehouseConfigResponse",
+              "is_object": true
+            }
+          },
+          {
+            "name": "List",
+            "description": "Lists all SQL warehouses that a user has access to.",
+            "summary": "List warehouses.",
+            "path": "/api/2.0/sql/warehouses",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListWarehousesRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListWarehousesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "The max number of warehouses to return.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "A page token, received from a previous `ListWarehouses` call.\nProvide this to retrieve the subsequent page; otherwise the first\nwill be retrieved.\n\nWhen paginating, all other parameters provided to `ListWarehouses` must match\nthe call that provided the page token.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "run_as_user_id",
+                "description": "Deprecated: this field is ignored by the server.\nService Principal which will be used to fetch the list of endpoints.\nIf not specified, SQL Gateway will use the user from the session header.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "A page token, received from a previous `ListWarehouses` call.\nProvide this to retrieve the subsequent page; otherwise the first\nwill be retrieved.\n\nWhen paginating, all other parameters provided to `ListWarehouses` must match\nthe call that provided the page token.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListDefaultWarehouseOverrides",
+            "description": "Lists all default warehouse overrides in the workspace.\nOnly workspace administrators can list all overrides.",
+            "summary": "List default warehouse overrides.",
+            "path": "/api/warehouses/v1/default-warehouse-overrides",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ListDefaultWarehouseOverridesRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListDefaultWarehouseOverridesResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "The maximum number of overrides to return. The service may return fewer than\nthis value.\nIf unspecified, at most 100 overrides will be returned.\nThe maximum value is 1000; values above 1000 will be coerced to 1000.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "A page token, received from a previous `ListDefaultWarehouseOverrides` call.\nProvide this to retrieve the subsequent page.\n\nWhen paginating, all other parameters provided to `ListDefaultWarehouseOverrides`\nmust match the call that provided the page token.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "A page token, received from a previous `ListDefaultWarehouseOverrides` call.\nProvide this to retrieve the subsequent page.\n\nWhen paginating, all other parameters provided to `ListDefaultWarehouseOverrides`\nmust match the call that provided the page token.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "SetPermissions",
+            "description": "Sets permissions on an object, replacing existing permissions if they exist. Deletes all direct permissions if none are specified. Objects can inherit permissions from their root object.",
+            "summary": "Set SQL warehouse permissions.",
+            "path": "/api/2.0/permissions/warehouses/{warehouse_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "WarehousePermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "warehouse_id",
+                  "description": "The SQL warehouse for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "warehouse_id",
+                  "description": "The SQL warehouse for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "WarehousePermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "access_control_list",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "WarehouseAccessControlRequestList",
+                  "array_value": {
+                    "pascal_name": "WarehouseAccessControlRequest",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "warehouse_id",
+                "description": "The SQL warehouse for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "warehouse_id",
+                "description": "The SQL warehouse for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "SetWorkspaceWarehouseConfig",
+            "description": "Sets the workspace level configuration that is shared by all SQL warehouses in a workspace.",
+            "summary": "Set the workspace configuration.",
+            "path": "/api/2.0/sql/config/warehouses",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "SetWorkspaceWarehouseConfigRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "SetWorkspaceWarehouseConfigResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "channel",
+                "description": "Optional: Channel selection details",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "Channel",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "config_param",
+                "description": "Deprecated: Use sql_configuration_parameters",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "RepeatedEndpointConfPairs",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "data_access_config",
+                "description": "Spark confs for external hive metastore configuration\nJSON serialized size must be less than \u003c= 512K",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EndpointConfPairList",
+                  "array_value": {
+                    "pascal_name": "EndpointConfPair",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "enable_serverless_compute",
+                "description": "Deprecated: only setting this to true is allowed.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "enabled_warehouse_types",
+                "description": "List of Warehouse Types allowed in this workspace (limits allowed value of\nthe type field in CreateWarehouse and EditWarehouse). Note: Some types\ncannot be disabled, they don't need to be specified\nin SetWorkspaceWarehouseConfig.\nNote: Disabling a type may cause existing warehouses to be converted to\nanother type. Used by frontend to save specific type availability in the\nwarehouse create and edit form UI.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "WarehouseTypePairList",
+                  "array_value": {
+                    "pascal_name": "WarehouseTypePair",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "global_param",
+                "description": "Deprecated: Use sql_configuration_parameters",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "RepeatedEndpointConfPairs",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "google_service_account",
+                "description": "GCP only: Google Service Account used to pass to cluster to access Google\nCloud Storage",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "instance_profile_arn",
+                "description": "AWS Only: The instance profile used to pass an IAM role to the SQL\nwarehouses. This configuration is also applied to the workspace's\nserverless compute for notebooks and jobs.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "security_policy",
+                "description": "Security policy for warehouses",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "SetWorkspaceWarehouseConfigRequestSecurityPolicy",
+                  "enum": [
+                    {
+                      "content": "DATA_ACCESS_CONTROL"
+                    },
+                    {
+                      "content": "NONE"
+                    },
+                    {
+                      "content": "PASSTHROUGH"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "sql_configuration_parameters",
+                "description": "SQL configuration parameters",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "RepeatedEndpointConfPairs",
+                  "is_object": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Start",
+            "description": "Starts a SQL warehouse.",
+            "summary": "Start a warehouse.",
+            "path": "/api/2.0/sql/warehouses/{id}/start",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "StartRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Required. Id of the SQL warehouse.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "Required. Id of the SQL warehouse.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "StartWarehouseResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "description": "Required. Id of the SQL warehouse.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Required. Id of the SQL warehouse.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "wait": {
+              "success": [
+                {
+                  "content": "RUNNING"
+                }
+              ],
+              "timeout": 20,
+              "complex_message_path": true,
+              "poll": {
+                "response": {
+                  "pascal_name": "GetWarehouseResponse"
+                }
+              },
+              "status_path": [
+                {
+                  "pascal_name": "State"
+                }
+              ],
+              "message_path": [
+                {
+                  "pascal_name": "Health"
+                },
+                {
+                  "pascal_name": "Summary"
+                }
+              ],
+              "message_path_head": {
+                "pascal_name": "Health"
+              }
+            }
+          },
+          {
+            "name": "Stop",
+            "description": "Stops a SQL warehouse.",
+            "summary": "Stop a warehouse.",
+            "path": "/api/2.0/sql/warehouses/{id}/stop",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "StopRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "id",
+                  "description": "Required. Id of the SQL warehouse.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "id",
+                  "description": "Required. Id of the SQL warehouse.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "StopWarehouseResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "id",
+                "description": "Required. Id of the SQL warehouse.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "id",
+                "description": "Required. Id of the SQL warehouse.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "wait": {
+              "success": [
+                {
+                  "content": "STOPPED"
+                }
+              ],
+              "timeout": 20,
+              "complex_message_path": true,
+              "poll": {
+                "response": {
+                  "pascal_name": "GetWarehouseResponse"
+                }
+              },
+              "status_path": [
+                {
+                  "pascal_name": "State"
+                }
+              ],
+              "message_path": [
+                {
+                  "pascal_name": "Health"
+                },
+                {
+                  "pascal_name": "Summary"
+                }
+              ],
+              "message_path_head": {
+                "pascal_name": "Health"
+              }
+            }
+          },
+          {
+            "name": "UpdateDefaultWarehouseOverride",
+            "description": "Updates an existing default warehouse override for a user.\nUsers can update their own override. Admins can update overrides for any user.",
+            "summary": "Update default warehouse override.",
+            "path": "/api/warehouses/v1/{name=default-warehouse-overrides/*}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "UpdateDefaultWarehouseOverrideRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the default warehouse override.\nFormat: default-warehouse-overrides/{default_warehouse_override_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "default_warehouse_override",
+                  "description": "Required. The default warehouse override to update.\nThe name field must be set in the format: default-warehouse-overrides/{default_warehouse_override_id}\nThe default_warehouse_override_id can be a numeric user ID or the literal string \"me\" for the current user.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DefaultWarehouseOverride",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Required. Field mask specifying which fields to update.\nOnly the fields specified in the mask will be updated.\nUse \"*\" to update all fields.\nWhen allow_missing is true, this field is ignored and all fields are applied.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The resource name of the default warehouse override.\nFormat: default-warehouse-overrides/{default_warehouse_override_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Required. Field mask specifying which fields to update.\nOnly the fields specified in the mask will be updated.\nUse \"*\" to update all fields.\nWhen allow_missing is true, this field is ignored and all fields are applied.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "default_warehouse_override",
+                  "description": "Required. The default warehouse override to update.\nThe name field must be set in the format: default-warehouse-overrides/{default_warehouse_override_id}\nThe default_warehouse_override_id can be a numeric user ID or the literal string \"me\" for the current user.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DefaultWarehouseOverride",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "default_warehouse_override",
+              "description": "Required. The default warehouse override to update.\nThe name field must be set in the format: default-warehouse-overrides/{default_warehouse_override_id}\nThe default_warehouse_override_id can be a numeric user ID or the literal string \"me\" for the current user.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "DefaultWarehouseOverride",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "type",
+                    "description": "The type of override behavior.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "DefaultWarehouseOverrideType",
+                      "enum": [
+                        {
+                          "content": "CUSTOM"
+                        },
+                        {
+                          "content": "LAST_SELECTED"
+                        }
+                      ]
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "type",
+                    "description": "The type of override behavior.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "DefaultWarehouseOverrideType",
+                      "enum": [
+                        {
+                          "content": "CUSTOM"
+                        },
+                        {
+                          "content": "LAST_SELECTED"
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "DefaultWarehouseOverride",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "type",
+                  "description": "The type of override behavior.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DefaultWarehouseOverrideType",
+                    "enum": [
+                      {
+                        "content": "CUSTOM"
+                      },
+                      {
+                        "content": "LAST_SELECTED"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "type",
+                  "description": "The type of override behavior.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DefaultWarehouseOverrideType",
+                    "enum": [
+                      {
+                        "content": "CUSTOM"
+                      },
+                      {
+                        "content": "LAST_SELECTED"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "allow_missing",
+                "description": "If set to true, and the override is not found, a new override will be created.\nIn this situation, `update_mask` is ignored and all fields are applied.\nDefaults to false.",
+                "is_query": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "default_warehouse_override",
+                "description": "Required. The default warehouse override to update.\nThe name field must be set in the format: default-warehouse-overrides/{default_warehouse_override_id}\nThe default_warehouse_override_id can be a numeric user ID or the literal string \"me\" for the current user.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DefaultWarehouseOverride",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "type",
+                      "description": "The type of override behavior.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "DefaultWarehouseOverrideType",
+                        "enum": [
+                          {
+                            "content": "CUSTOM"
+                          },
+                          {
+                            "content": "LAST_SELECTED"
+                          }
+                        ]
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "type",
+                      "description": "The type of override behavior.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "DefaultWarehouseOverrideType",
+                        "enum": [
+                          {
+                            "content": "CUSTOM"
+                          },
+                          {
+                            "content": "LAST_SELECTED"
+                          }
+                        ]
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "name",
+                "description": "The resource name of the default warehouse override.\nFormat: default-warehouse-overrides/{default_warehouse_override_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Required. Field mask specifying which fields to update.\nOnly the fields specified in the mask will be updated.\nUse \"*\" to update all fields.\nWhen allow_missing is true, this field is ignored and all fields are applied.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "default_warehouse_override_id",
+                "description": "The ID component of the resource name (user ID).",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "The resource name of the default warehouse override.\nFormat: default-warehouse-overrides/{default_warehouse_override_id}",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "type",
+                "description": "The type of override behavior.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DefaultWarehouseOverrideType",
+                  "enum": [
+                    {
+                      "content": "CUSTOM"
+                    },
+                    {
+                      "content": "LAST_SELECTED"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "warehouse_id",
+                "description": "The specific warehouse ID when type is CUSTOM.\nNot set for LAST_SELECTED type.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The resource name of the default warehouse override.\nFormat: default-warehouse-overrides/{default_warehouse_override_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Required. Field mask specifying which fields to update.\nOnly the fields specified in the mask will be updated.\nUse \"*\" to update all fields.\nWhen allow_missing is true, this field is ignored and all fields are applied.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "type",
+                "description": "The type of override behavior.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DefaultWarehouseOverrideType",
+                  "enum": [
+                    {
+                      "content": "CUSTOM"
+                    },
+                    {
+                      "content": "LAST_SELECTED"
+                    }
+                  ]
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdatePermissions",
+            "description": "Updates the permissions on a SQL warehouse. SQL warehouses can inherit permissions from their root object.",
+            "summary": "Update SQL warehouse permissions.",
+            "path": "/api/2.0/permissions/warehouses/{warehouse_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "WarehousePermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "warehouse_id",
+                  "description": "The SQL warehouse for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "warehouse_id",
+                  "description": "The SQL warehouse for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "WarehousePermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "access_control_list",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "WarehouseAccessControlRequestList",
+                  "array_value": {
+                    "pascal_name": "WarehouseAccessControlRequest",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "warehouse_id",
+                "description": "The SQL warehouse for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "warehouse_id",
+                "description": "The SQL warehouse for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "workspace.Workspace",
+        "name": "Workspace",
+        "description": "The Workspace API allows you to list, import, export, and delete workspace objects such as\nnotebooks, files, folders, and dashboards. Additionally, it provides endpoints to manage\npermissions for any workspace object.\n\nA notebook is a web-based interface to a document that contains runnable code,\nvisualizations, and explanatory text.",
+        "package": {
+          "name": "workspace"
+        },
+        "docs_group": "workspace",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "named_id_map": {
+            "pascal_name": "ObjectInfoPathToObjectIdMap"
+          },
+          "request": {
+            "pascal_name": "ListWorkspaceRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Delete",
+            "description": "Deletes an object or a directory (and optionally recursively deletes all objects in the directory).\n* If `path` does not exist, this call returns an error `RESOURCE_DOES_NOT_EXIST`.\n* If `path` is a non-empty directory and `recursive` is set to `false`, this call returns an error `DIRECTORY_NOT_EMPTY`.\n\nObject deletion cannot be undone and deleting a directory recursively is not atomic.",
+            "summary": "Delete a workspace object.",
+            "path": "/api/2.0/workspace/delete",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "Delete",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "path",
+                  "description": "The absolute path of the notebook or directory.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "path",
+                  "description": "The absolute path of the notebook or directory.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "path",
+                "description": "The absolute path of the notebook or directory.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "recursive",
+                "description": "The flag that specifies whether to delete the object recursively. It is `false` by default.\nPlease note this deleting directory is not atomic. If it fails in the middle, some of objects\nunder this directory may be deleted and cannot be undone.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "path",
+                "description": "The absolute path of the notebook or directory.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Export",
+            "description": "Exports an object or the contents of an entire directory.\n\nIf `path` does not exist, this call returns an error `RESOURCE_DOES_NOT_EXIST`.\n\nIf the exported data would exceed size limit, this call returns `MAX_NOTEBOOK_SIZE_EXCEEDED`.\nCurrently, this API does not support exporting a library.",
+            "summary": "Export a workspace object.",
+            "path": "/api/2.0/workspace/export",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ExportRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "path",
+                  "description": "The absolute path of the object or directory. Exporting a directory is only supported for the `DBC`, `SOURCE`, and `AUTO` format.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "path",
+                  "description": "The absolute path of the object or directory. Exporting a directory is only supported for the `DBC`, `SOURCE`, and `AUTO` format.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ExportResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "format",
+                "description": "This specifies the format of the exported file. By default, this is `SOURCE`.\n\nThe value is case sensitive.\n\n- `SOURCE`: The notebook is exported as source code. Directory exports will not include non-notebook entries.\n- `HTML`: The notebook is exported as an HTML file.\n- `JUPYTER`: The notebook is exported as a Jupyter/IPython Notebook file.\n- `DBC`: The notebook is exported in Databricks archive format. Directory exports will not include non-notebook entries.\n- `R_MARKDOWN`: The notebook is exported to R Markdown format.\n- `AUTO`: The object or directory is exported depending on the objects type. Directory exports will include notebooks and workspace files.",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "ExportFormat",
+                  "enum": [
+                    {
+                      "content": "AUTO"
+                    },
+                    {
+                      "content": "DBC"
+                    },
+                    {
+                      "content": "HTML"
+                    },
+                    {
+                      "content": "JUPYTER"
+                    },
+                    {
+                      "content": "RAW"
+                    },
+                    {
+                      "content": "R_MARKDOWN"
+                    },
+                    {
+                      "content": "SOURCE"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "path",
+                "description": "The absolute path of the object or directory. Exporting a directory is only supported for the `DBC`, `SOURCE`, and `AUTO` format.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "path",
+                "description": "The absolute path of the object or directory. Exporting a directory is only supported for the `DBC`, `SOURCE`, and `AUTO` format.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetPermissionLevels",
+            "description": "Gets the permission levels that a user can have on an object.",
+            "summary": "Get workspace object permission levels.",
+            "path": "/api/2.0/permissions/{workspace_object_type}/{workspace_object_id}/permissionLevels",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetWorkspaceObjectPermissionLevelsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "workspace_object_type",
+                  "description": "The workspace object type for which to get or manage permissions. Could be one of the following: alerts, alertsv2, dashboards, dbsql-dashboards, directories, experiments, files, genie, notebooks, queries",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "workspace_object_id",
+                  "description": "The workspace object for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "workspace_object_type",
+                  "description": "The workspace object type for which to get or manage permissions. Could be one of the following: alerts, alertsv2, dashboards, dbsql-dashboards, directories, experiments, files, genie, notebooks, queries",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "workspace_object_id",
+                  "description": "The workspace object for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetWorkspaceObjectPermissionLevelsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "workspace_object_id",
+                "description": "The workspace object for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "workspace_object_type",
+                "description": "The workspace object type for which to get or manage permissions. Could be one of the following: alerts, alertsv2, dashboards, dbsql-dashboards, directories, experiments, files, genie, notebooks, queries",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "workspace_object_type",
+                "description": "The workspace object type for which to get or manage permissions. Could be one of the following: alerts, alertsv2, dashboards, dbsql-dashboards, directories, experiments, files, genie, notebooks, queries",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "workspace_object_id",
+                "description": "The workspace object for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetPermissions",
+            "description": "Gets the permissions of a workspace object. Workspace objects can inherit permissions from their parent objects or root object.",
+            "summary": "Get workspace object permissions.",
+            "path": "/api/2.0/permissions/{workspace_object_type}/{workspace_object_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetWorkspaceObjectPermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "workspace_object_type",
+                  "description": "The workspace object type for which to get or manage permissions. Could be one of the following: alerts, alertsv2, dashboards, dbsql-dashboards, directories, experiments, files, genie, notebooks, queries",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "workspace_object_id",
+                  "description": "The workspace object for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "workspace_object_type",
+                  "description": "The workspace object type for which to get or manage permissions. Could be one of the following: alerts, alertsv2, dashboards, dbsql-dashboards, directories, experiments, files, genie, notebooks, queries",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "workspace_object_id",
+                  "description": "The workspace object for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "WorkspaceObjectPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "workspace_object_id",
+                "description": "The workspace object for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "workspace_object_type",
+                "description": "The workspace object type for which to get or manage permissions. Could be one of the following: alerts, alertsv2, dashboards, dbsql-dashboards, directories, experiments, files, genie, notebooks, queries",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "workspace_object_type",
+                "description": "The workspace object type for which to get or manage permissions. Could be one of the following: alerts, alertsv2, dashboards, dbsql-dashboards, directories, experiments, files, genie, notebooks, queries",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "workspace_object_id",
+                "description": "The workspace object for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetStatus",
+            "description": "Gets the status of an object or a directory.\nIf `path` does not exist, this call returns an error `RESOURCE_DOES_NOT_EXIST`.",
+            "summary": "Get status.",
+            "path": "/api/2.0/workspace/get-status",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetStatusRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "path",
+                  "description": "The absolute path of the notebook or directory.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "path",
+                  "description": "The absolute path of the notebook or directory.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ObjectInfo",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "path",
+                "description": "The absolute path of the notebook or directory.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "path",
+                "description": "The absolute path of the notebook or directory.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Import",
+            "description": "Imports a workspace object (for example, a notebook or file) or the contents of an entire directory.\nIf `path` already exists and `overwrite` is set to `false`, this call returns an error `RESOURCE_ALREADY_EXISTS`.\nTo import a directory, you can use either the `DBC` format or the `SOURCE` format with the `language` field unset.\nTo import a single file as `SOURCE`, you must set the `language` field.\nZip files within directories are not supported.",
+            "summary": "Import a workspace object.",
+            "path": "/api/2.0/workspace/import",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "Import",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "path",
+                  "description": "The absolute path of the object or directory. Importing a directory is only supported for the `DBC` and `SOURCE` formats.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "path",
+                  "description": "The absolute path of the object or directory. Importing a directory is only supported for the `DBC` and `SOURCE` formats.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ImportResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "content",
+                "description": "The base64-encoded content. This has a limit of 10 MB.\n\nIf the limit (10MB) is exceeded, exception with error code **MAX_NOTEBOOK_SIZE_EXCEEDED** is thrown.\nThis parameter might be absent, and instead a posted file is used.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "format",
+                "description": "This specifies the format of the file to be imported.\n\nThe value is case sensitive.\n\n- `AUTO`: The item is imported depending on an analysis of the item's extension and\nthe header content provided in the request. If the item is imported as a notebook,\nthen the item's extension is automatically removed.\n- `SOURCE`: The notebook or directory is imported as source code.\n- `HTML`: The notebook is imported as an HTML file.\n- `JUPYTER`: The notebook is imported as a Jupyter/IPython Notebook file.\n- `DBC`: The notebook is imported in Databricks archive format. Required for directories.\n- `R_MARKDOWN`: The notebook is imported from R Markdown format.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ImportFormat",
+                  "enum": [
+                    {
+                      "content": "AUTO"
+                    },
+                    {
+                      "content": "DBC"
+                    },
+                    {
+                      "content": "HTML"
+                    },
+                    {
+                      "content": "JUPYTER"
+                    },
+                    {
+                      "content": "RAW"
+                    },
+                    {
+                      "content": "R_MARKDOWN"
+                    },
+                    {
+                      "content": "SOURCE"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "language",
+                "description": "The language of the object. This value is set only if the object type is `NOTEBOOK`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Language",
+                  "enum": [
+                    {
+                      "content": "PYTHON"
+                    },
+                    {
+                      "content": "R"
+                    },
+                    {
+                      "content": "SCALA"
+                    },
+                    {
+                      "content": "SQL"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "overwrite",
+                "description": "The flag that specifies whether to overwrite existing object. It is `false` by default.\nFor `DBC` format, `overwrite` is not supported since it may contain a directory.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_bool": true
+                }
+              },
+              {
+                "name": "path",
+                "description": "The absolute path of the object or directory. Importing a directory is only supported for the `DBC` and `SOURCE` formats.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "path",
+                "description": "The absolute path of the object or directory. Importing a directory is only supported for the `DBC` and `SOURCE` formats.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Lists the contents of a directory, or the object if it is not a directory.\nIf the input path does not exist, this call returns an error `RESOURCE_DOES_NOT_EXIST`.",
+            "summary": "List contents.",
+            "path": "/api/2.0/workspace/list",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListWorkspaceRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "path",
+                  "description": "The absolute path of the notebook or directory.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "path",
+                  "description": "The absolute path of the notebook or directory.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "notebooks_modified_after",
+                "description": "UTC timestamp in milliseconds",
+                "is_query": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "path",
+                "description": "The absolute path of the notebook or directory.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "path",
+                "description": "The absolute path of the notebook or directory.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {}
+          },
+          {
+            "name": "Mkdirs",
+            "description": "Creates the specified directory (and necessary parent directories if they do not exist).\nIf there is an object (not a directory) at any prefix of the input path, this call returns\nan error `RESOURCE_ALREADY_EXISTS`.\n\nNote that if this operation fails it may have succeeded in creating some of the necessary parent directories.",
+            "summary": "Create a directory.",
+            "path": "/api/2.0/workspace/mkdirs",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "Mkdirs",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "path",
+                  "description": "The absolute path of the directory. If the parent directories do not exist, it will also create them.\nIf the directory already exists, this command will do nothing and succeed.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "path",
+                  "description": "The absolute path of the directory. If the parent directories do not exist, it will also create them.\nIf the directory already exists, this command will do nothing and succeed.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "MkdirsResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "path",
+                "description": "The absolute path of the directory. If the parent directories do not exist, it will also create them.\nIf the directory already exists, this command will do nothing and succeed.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "path",
+                "description": "The absolute path of the directory. If the parent directories do not exist, it will also create them.\nIf the directory already exists, this command will do nothing and succeed.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "SetPermissions",
+            "description": "Sets permissions on an object, replacing existing permissions if they exist. Deletes all direct permissions if none are specified. Objects can inherit permissions from their parent objects or root object.",
+            "summary": "Set workspace object permissions.",
+            "path": "/api/2.0/permissions/{workspace_object_type}/{workspace_object_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "WorkspaceObjectPermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "workspace_object_type",
+                  "description": "The workspace object type for which to get or manage permissions. Could be one of the following: alerts, alertsv2, dashboards, dbsql-dashboards, directories, experiments, files, genie, notebooks, queries",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "workspace_object_id",
+                  "description": "The workspace object for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "workspace_object_type",
+                  "description": "The workspace object type for which to get or manage permissions. Could be one of the following: alerts, alertsv2, dashboards, dbsql-dashboards, directories, experiments, files, genie, notebooks, queries",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "workspace_object_id",
+                  "description": "The workspace object for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "WorkspaceObjectPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "access_control_list",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "WorkspaceObjectAccessControlRequestList",
+                  "array_value": {
+                    "pascal_name": "WorkspaceObjectAccessControlRequest",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "workspace_object_id",
+                "description": "The workspace object for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "workspace_object_type",
+                "description": "The workspace object type for which to get or manage permissions. Could be one of the following: alerts, alertsv2, dashboards, dbsql-dashboards, directories, experiments, files, genie, notebooks, queries",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "workspace_object_type",
+                "description": "The workspace object type for which to get or manage permissions. Could be one of the following: alerts, alertsv2, dashboards, dbsql-dashboards, directories, experiments, files, genie, notebooks, queries",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "workspace_object_id",
+                "description": "The workspace object for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdatePermissions",
+            "description": "Updates the permissions on a workspace object. Workspace objects can inherit permissions from their parent objects or root object.",
+            "summary": "Update workspace object permissions.",
+            "path": "/api/2.0/permissions/{workspace_object_type}/{workspace_object_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "WorkspaceObjectPermissionsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "workspace_object_type",
+                  "description": "The workspace object type for which to get or manage permissions. Could be one of the following: alerts, alertsv2, dashboards, dbsql-dashboards, directories, experiments, files, genie, notebooks, queries",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "workspace_object_id",
+                  "description": "The workspace object for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "workspace_object_type",
+                  "description": "The workspace object type for which to get or manage permissions. Could be one of the following: alerts, alertsv2, dashboards, dbsql-dashboards, directories, experiments, files, genie, notebooks, queries",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "workspace_object_id",
+                  "description": "The workspace object for which to get or manage permissions.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "WorkspaceObjectPermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "access_control_list",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "WorkspaceObjectAccessControlRequestList",
+                  "array_value": {
+                    "pascal_name": "WorkspaceObjectAccessControlRequest",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "workspace_object_id",
+                "description": "The workspace object for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "workspace_object_type",
+                "description": "The workspace object type for which to get or manage permissions. Could be one of the following: alerts, alertsv2, dashboards, dbsql-dashboards, directories, experiments, files, genie, notebooks, queries",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "workspace_object_type",
+                "description": "The workspace object type for which to get or manage permissions. Could be one of the following: alerts, alertsv2, dashboards, dbsql-dashboards, directories, experiments, files, genie, notebooks, queries",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "workspace_object_id",
+                "description": "The workspace object for which to get or manage permissions.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "iam.WorkspaceAssignment",
+        "name": "WorkspaceAssignment",
+        "description": "The Workspace Permission Assignment API allows you to manage workspace permissions for principals in your account.",
+        "package": {
+          "name": "iam"
+        },
+        "is_accounts": true,
+        "docs_group": "iam",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListWorkspaceAssignmentRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "Delete",
+            "description": "Deletes the workspace permissions assignment in a given account and workspace for the specified principal.",
+            "summary": "Delete permissions assignment.",
+            "path": "/api/2.0/accounts/{account_id}/workspaces/{workspace_id}/permissionassignments/principals/{principal_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteWorkspaceAssignmentRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "The workspace ID for the account.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "principal_id",
+                  "description": "The ID of the user, service principal, or group.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "The workspace ID for the account.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "principal_id",
+                  "description": "The ID of the user, service principal, or group.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DeleteWorkspacePermissionAssignmentResponse",
+              "is_object": true,
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "principal_id",
+                "description": "The ID of the user, service principal, or group.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "workspace_id",
+                "description": "The workspace ID for the account.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "workspace_id",
+                "description": "The workspace ID for the account.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "The ID of the user, service principal, or group.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Get an array of workspace permissions for the specified account and workspace.",
+            "summary": "List workspace permissions.",
+            "path": "/api/2.0/accounts/{account_id}/workspaces/{workspace_id}/permissionassignments/permissions",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetWorkspaceAssignmentRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "The workspace ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "The workspace ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "WorkspacePermissions",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "workspace_id",
+                "description": "The workspace ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "workspace_id",
+                "description": "The workspace ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Get the permission assignments for the specified Databricks account and Databricks workspace.",
+            "summary": "Get permission assignments.",
+            "path": "/api/2.0/accounts/{account_id}/workspaces/{workspace_id}/permissionassignments",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListWorkspaceAssignmentRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "The workspace ID for the account.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "The workspace ID for the account.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "PermissionAssignments",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "workspace_id",
+                "description": "The workspace ID for the account.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "workspace_id",
+                "description": "The workspace ID for the account.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "pagination": {}
+          },
+          {
+            "name": "Update",
+            "description": "Creates or updates the workspace permissions assignment in a given account and workspace for the specified principal.",
+            "summary": "Create or update permissions assignment.",
+            "path": "/api/2.0/accounts/{account_id}/workspaces/{workspace_id}/permissionassignments/principals/{principal_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateWorkspaceAssignments",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "The workspace ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "principal_id",
+                  "description": "The ID of the user, service principal, or group.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "The workspace ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "principal_id",
+                  "description": "The ID of the user, service principal, or group.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "PermissionAssignment",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "permissions",
+                "description": "Array of permissions assignments to update on the workspace.\nValid values are \"USER\" and \"ADMIN\" (case-sensitive).\nIf both \"USER\" and \"ADMIN\" are provided, \"ADMIN\" takes precedence.\nOther values will be ignored.\nNote that excluding this field, or providing unsupported values, will have the same effect as providing an empty list, which will result in the deletion of all permissions for the principal.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "WorkspacePermissionList",
+                  "array_value": {
+                    "pascal_name": "WorkspacePermission",
+                    "enum": [
+                      {
+                        "content": "ADMIN"
+                      },
+                      {
+                        "content": "UNKNOWN"
+                      },
+                      {
+                        "content": "USER"
+                      }
+                    ]
+                  }
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "The ID of the user, service principal, or group.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "workspace_id",
+                "description": "The workspace ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "workspace_id",
+                "description": "The workspace ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "The ID of the user, service principal, or group.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "catalog.WorkspaceBindings",
+        "name": "WorkspaceBindings",
+        "description": "A securable in Databricks can be configured as __OPEN__ or __ISOLATED__. An __OPEN__ securable can\nbe accessed from any workspace, while an __ISOLATED__ securable can only be accessed from a configured\nlist of workspaces. This API allows you to configure (bind) securables to workspaces.\n\nNOTE:\nThe __isolation_mode__ is configured for the securable itself (using its Update method) and\nthe workspace bindings are only consulted when the securable's __isolation_mode__ is set to __ISOLATED__.\n\nA securable's workspace bindings can be configured by a metastore admin or the owner of the securable.\n\nThe original path (/api/2.1/unity-catalog/workspace-bindings/catalogs/{name}) is deprecated.\nUse the new path (/api/2.1/unity-catalog/bindings/{securable_type}/{securable_name}),\nwhich introduces the ability to bind a securable in READ_ONLY mode (catalogs only).\n\nSecurable types that support binding:\n- catalog\n- storage_credential\n- credential\n- external_location",
+        "package": {
+          "name": "catalog"
+        },
+        "docs_group": "catalog",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "methods": [
+          {
+            "name": "Get",
+            "description": "Gets workspace bindings of the catalog.\nThe caller must be a metastore admin or an owner of the catalog.",
+            "summary": "Get catalog workspace bindings.",
+            "path": "/api/2.1/unity-catalog/workspace-bindings/catalogs/{name}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetWorkspaceBindingRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the catalog.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the catalog.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetCatalogWorkspaceBindingsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "The name of the catalog.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the catalog.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetBindings",
+            "description": "Gets workspace bindings of the securable.\nThe caller must be a metastore admin or an owner of the securable.\n\nNOTE: we recommend using max_results=0 to use the paginated version of this API. Unpaginated calls will be deprecated soon.\n\nPAGINATION BEHAVIOR: When using pagination (max_results \u003e= 0), a page may contain zero results while still providing a next_page_token.\nClients must continue reading pages until next_page_token is absent, which is the only indication that the end of results has been reached.",
+            "summary": "Get securable workspace bindings.",
+            "path": "/api/2.1/unity-catalog/bindings/{securable_type}/{securable_name}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetBindingsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "securable_type",
+                  "description": "The type of the securable to bind to a workspace (catalog, storage_credential, credential, or external_location).",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "securable_name",
+                  "description": "The name of the securable.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "securable_type",
+                  "description": "The type of the securable to bind to a workspace (catalog, storage_credential, credential, or external_location).",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "securable_name",
+                  "description": "The name of the securable.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "GetWorkspaceBindingsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "max_results",
+                "description": "Maximum number of workspace bindings to return.\n- When set to 0, the page length is set to a server configured value (recommended);\n- When set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- When set to a value less than 0, an invalid parameter error is returned;\n- If not set, all the workspace bindings are returned (not recommended).",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Opaque pagination token to go to next page based on previous query.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "securable_name",
+                "description": "The name of the securable.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "securable_type",
+                "description": "The type of the securable to bind to a workspace (catalog, storage_credential, credential, or external_location).",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "securable_type",
+                "description": "The type of the securable to bind to a workspace (catalog, storage_credential, credential, or external_location).",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "securable_name",
+                "description": "The name of the securable.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Opaque pagination token to go to next page based on previous query.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              },
+              "max_results": {
+                "name": "max_results",
+                "description": "Maximum number of workspace bindings to return.\n- When set to 0, the page length is set to a server configured value (recommended);\n- When set to a value greater than 0, the page length is the minimum of this value and a server configured value;\n- When set to a value less than 0, an invalid parameter error is returned;\n- If not set, all the workspace bindings are returned (not recommended).",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              }
+            }
+          },
+          {
+            "name": "Update",
+            "description": "Updates workspace bindings of the catalog.\nThe caller must be a metastore admin or an owner of the catalog.",
+            "summary": "Update catalog workspace bindings.",
+            "path": "/api/2.1/unity-catalog/workspace-bindings/catalogs/{name}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateWorkspaceBindings",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the catalog.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "The name of the catalog.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "UpdateCatalogWorkspaceBindingsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "assign_workspaces",
+                "description": "A list of workspace IDs.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_int64": true
+                  }
+                }
+              },
+              {
+                "name": "name",
+                "description": "The name of the catalog.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "unassign_workspaces",
+                "description": "A list of workspace IDs.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "List",
+                  "array_value": {
+                    "is_int64": true
+                  }
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "The name of the catalog.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateBindings",
+            "description": "Updates workspace bindings of the securable.\nThe caller must be a metastore admin or an owner of the securable.",
+            "summary": "Update securable workspace bindings.",
+            "path": "/api/2.1/unity-catalog/bindings/{securable_type}/{securable_name}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateWorkspaceBindingsParameters",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "securable_type",
+                  "description": "The type of the securable to bind to a workspace (catalog, storage_credential, credential, or external_location).",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "securable_name",
+                  "description": "The name of the securable.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "securable_type",
+                  "description": "The type of the securable to bind to a workspace (catalog, storage_credential, credential, or external_location).",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "securable_name",
+                  "description": "The name of the securable.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "UpdateWorkspaceBindingsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "add",
+                "description": "List of workspace bindings to add. If a binding for the workspace already exists with a\ndifferent binding_type, adding it again with a new binding_type will update the existing\nbinding (e.g., from READ_WRITE to READ_ONLY).",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "WorkspaceBindingList",
+                  "array_value": {
+                    "pascal_name": "WorkspaceBinding",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "remove",
+                "description": "List of workspace bindings to remove.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "WorkspaceBindingList",
+                  "array_value": {
+                    "pascal_name": "WorkspaceBinding",
+                    "is_object": true
+                  }
+                }
+              },
+              {
+                "name": "securable_name",
+                "description": "The name of the securable.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "securable_type",
+                "description": "The type of the securable to bind to a workspace (catalog, storage_credential, credential, or external_location).",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "securable_type",
+                "description": "The type of the securable to bind to a workspace (catalog, storage_credential, credential, or external_location).",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "securable_name",
+                "description": "The name of the securable.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "settings.WorkspaceConf",
+        "name": "WorkspaceConf",
+        "description": "This API allows updating known workspace settings for advanced users.",
+        "package": {
+          "name": "settings"
+        },
+        "docs_group": "settings",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "methods": [
+          {
+            "name": "GetStatus",
+            "description": "Gets the configuration status for a workspace.",
+            "summary": "Check configuration status.",
+            "path": "/api/2.0/workspace-conf",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetStatusRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "keys",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "keys",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "WorkspaceConf",
+              "map_value": {
+                "is_string": true
+              }
+            },
+            "all_fields": [
+              {
+                "name": "keys",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "keys",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "SetStatus",
+            "description": "Sets the configuration status for a workspace, including enabling or disabling it.",
+            "summary": "Enable/disable features.",
+            "path": "/api/2.0/workspace-conf",
+            "can_use_json": true,
+            "must_use_json": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "WorkspaceConf",
+              "map_value": {
+                "is_string": true
+              }
+            },
+            "response": {
+              "is_empty_response": true
+            }
+          }
+        ]
+      },
+      {
+        "id": "tags.WorkspaceEntityTagAssignments",
+        "name": "WorkspaceEntityTagAssignments",
+        "description": "Manage tag assignments on workspace-scoped objects.",
+        "package": {
+          "name": "tags"
+        },
+        "docs_group": "tags",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListTagAssignmentsRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "CreateTagAssignment",
+            "description": "Create a tag assignment",
+            "summary": "Create a tag assignment for an entity.",
+            "path": "/api/2.0/entity-tag-assignments",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateTagAssignmentRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "tag_assignment",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "TagAssignment",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "tag_assignment",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "TagAssignment",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "tag_assignment",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "TagAssignment",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "entity_type",
+                    "description": "The type of entity to which the tag is assigned. Allowed values are apps, dashboards, geniespaces, notebooks",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "entity_id",
+                    "description": "The identifier of the entity to which the tag is assigned. For apps, the entity_id is the app name",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "tag_key",
+                    "description": "The key of the tag. The characters , . : / - = and leading/trailing spaces are not allowed",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "entity_type",
+                    "description": "The type of entity to which the tag is assigned. Allowed values are apps, dashboards, geniespaces, notebooks",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "entity_id",
+                    "description": "The identifier of the entity to which the tag is assigned. For apps, the entity_id is the app name",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "tag_key",
+                    "description": "The key of the tag. The characters , . : / - = and leading/trailing spaces are not allowed",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "TagAssignment",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "entity_type",
+                  "description": "The type of entity to which the tag is assigned. Allowed values are apps, dashboards, geniespaces, notebooks",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "entity_id",
+                  "description": "The identifier of the entity to which the tag is assigned. For apps, the entity_id is the app name",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "tag_key",
+                  "description": "The key of the tag. The characters , . : / - = and leading/trailing spaces are not allowed",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "entity_type",
+                  "description": "The type of entity to which the tag is assigned. Allowed values are apps, dashboards, geniespaces, notebooks",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "entity_id",
+                  "description": "The identifier of the entity to which the tag is assigned. For apps, the entity_id is the app name",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "tag_key",
+                  "description": "The key of the tag. The characters , . : / - = and leading/trailing spaces are not allowed",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "tag_assignment",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "TagAssignment",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "entity_type",
+                      "description": "The type of entity to which the tag is assigned. Allowed values are apps, dashboards, geniespaces, notebooks",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "entity_id",
+                      "description": "The identifier of the entity to which the tag is assigned. For apps, the entity_id is the app name",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "tag_key",
+                      "description": "The key of the tag. The characters , . : / - = and leading/trailing spaces are not allowed",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "entity_type",
+                      "description": "The type of entity to which the tag is assigned. Allowed values are apps, dashboards, geniespaces, notebooks",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "entity_id",
+                      "description": "The identifier of the entity to which the tag is assigned. For apps, the entity_id is the app name",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "tag_key",
+                      "description": "The key of the tag. The characters , . : / - = and leading/trailing spaces are not allowed",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "entity_id",
+                "description": "The identifier of the entity to which the tag is assigned. For apps, the entity_id is the app name",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "entity_type",
+                "description": "The type of entity to which the tag is assigned. Allowed values are apps, dashboards, geniespaces, notebooks",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tag_key",
+                "description": "The key of the tag. The characters , . : / - = and leading/trailing spaces are not allowed",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tag_value",
+                "description": "The value of the tag",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "entity_type",
+                "description": "The type of entity to which the tag is assigned. Allowed values are apps, dashboards, geniespaces, notebooks",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "entity_id",
+                "description": "The identifier of the entity to which the tag is assigned. For apps, the entity_id is the app name",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tag_key",
+                "description": "The key of the tag. The characters , . : / - = and leading/trailing spaces are not allowed",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteTagAssignment",
+            "description": "Delete a tag assignment",
+            "summary": "Delete a tag assignment for an entity.",
+            "path": "/api/2.0/entity-tag-assignments/{entity_type}/{entity_id}/tags/{tag_key}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteTagAssignmentRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "entity_type",
+                  "description": "The type of entity to which the tag is assigned. Allowed values are apps, dashboards, geniespaces, notebooks",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "entity_id",
+                  "description": "The identifier of the entity to which the tag is assigned. For apps, the entity_id is the app name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "tag_key",
+                  "description": "The key of the tag. The characters , . : / - = and leading/trailing spaces are not allowed",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "entity_type",
+                  "description": "The type of entity to which the tag is assigned. Allowed values are apps, dashboards, geniespaces, notebooks",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "entity_id",
+                  "description": "The identifier of the entity to which the tag is assigned. For apps, the entity_id is the app name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "tag_key",
+                  "description": "The key of the tag. The characters , . : / - = and leading/trailing spaces are not allowed",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "entity_id",
+                "description": "The identifier of the entity to which the tag is assigned. For apps, the entity_id is the app name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "entity_type",
+                "description": "The type of entity to which the tag is assigned. Allowed values are apps, dashboards, geniespaces, notebooks",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tag_key",
+                "description": "The key of the tag. The characters , . : / - = and leading/trailing spaces are not allowed",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "entity_type",
+                "description": "The type of entity to which the tag is assigned. Allowed values are apps, dashboards, geniespaces, notebooks",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "entity_id",
+                "description": "The identifier of the entity to which the tag is assigned. For apps, the entity_id is the app name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tag_key",
+                "description": "The key of the tag. The characters , . : / - = and leading/trailing spaces are not allowed",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetTagAssignment",
+            "description": "Get a tag assignment",
+            "summary": "Get a tag assignment for an entity.",
+            "path": "/api/2.0/entity-tag-assignments/{entity_type}/{entity_id}/tags/{tag_key}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetTagAssignmentRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "entity_type",
+                  "description": "The type of entity to which the tag is assigned. Allowed values are apps, dashboards, geniespaces, notebooks",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "entity_id",
+                  "description": "The identifier of the entity to which the tag is assigned. For apps, the entity_id is the app name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "tag_key",
+                  "description": "The key of the tag. The characters , . : / - = and leading/trailing spaces are not allowed",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "entity_type",
+                  "description": "The type of entity to which the tag is assigned. Allowed values are apps, dashboards, geniespaces, notebooks",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "entity_id",
+                  "description": "The identifier of the entity to which the tag is assigned. For apps, the entity_id is the app name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "tag_key",
+                  "description": "The key of the tag. The characters , . : / - = and leading/trailing spaces are not allowed",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "TagAssignment",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "entity_type",
+                  "description": "The type of entity to which the tag is assigned. Allowed values are apps, dashboards, geniespaces, notebooks",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "entity_id",
+                  "description": "The identifier of the entity to which the tag is assigned. For apps, the entity_id is the app name",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "tag_key",
+                  "description": "The key of the tag. The characters , . : / - = and leading/trailing spaces are not allowed",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "entity_type",
+                  "description": "The type of entity to which the tag is assigned. Allowed values are apps, dashboards, geniespaces, notebooks",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "entity_id",
+                  "description": "The identifier of the entity to which the tag is assigned. For apps, the entity_id is the app name",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "tag_key",
+                  "description": "The key of the tag. The characters , . : / - = and leading/trailing spaces are not allowed",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "entity_id",
+                "description": "The identifier of the entity to which the tag is assigned. For apps, the entity_id is the app name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "entity_type",
+                "description": "The type of entity to which the tag is assigned. Allowed values are apps, dashboards, geniespaces, notebooks",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tag_key",
+                "description": "The key of the tag. The characters , . : / - = and leading/trailing spaces are not allowed",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "entity_type",
+                "description": "The type of entity to which the tag is assigned. Allowed values are apps, dashboards, geniespaces, notebooks",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "entity_id",
+                "description": "The identifier of the entity to which the tag is assigned. For apps, the entity_id is the app name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tag_key",
+                "description": "The key of the tag. The characters , . : / - = and leading/trailing spaces are not allowed",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListTagAssignments",
+            "description": "List the tag assignments for an entity",
+            "summary": "List tag assignments for an entity.",
+            "path": "/api/2.0/entity-tag-assignments/{entity_type}/{entity_id}/tags",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListTagAssignmentsRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "entity_type",
+                  "description": "The type of entity to which the tag is assigned. Allowed values are apps, dashboards, geniespaces, notebooks",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "entity_id",
+                  "description": "The identifier of the entity to which the tag is assigned. For apps, the entity_id is the app name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "entity_type",
+                  "description": "The type of entity to which the tag is assigned. Allowed values are apps, dashboards, geniespaces, notebooks",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "entity_id",
+                  "description": "The identifier of the entity to which the tag is assigned. For apps, the entity_id is the app name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListTagAssignmentsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "entity_id",
+                "description": "The identifier of the entity to which the tag is assigned. For apps, the entity_id is the app name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "entity_type",
+                "description": "The type of entity to which the tag is assigned. Allowed values are apps, dashboards, geniespaces, notebooks",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "Optional. Maximum number of tag assignments to return in a single page",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "Pagination token to go to the next page of tag assignments. Requests first page if absent.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "entity_type",
+                "description": "The type of entity to which the tag is assigned. Allowed values are apps, dashboards, geniespaces, notebooks",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "entity_id",
+                "description": "The identifier of the entity to which the tag is assigned. For apps, the entity_id is the app name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "Pagination token to go to the next page of tag assignments. Requests first page if absent.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "UpdateTagAssignment",
+            "description": "Update a tag assignment",
+            "summary": "Update a tag assignment for an entity.",
+            "path": "/api/2.0/entity-tag-assignments/{entity_type}/{entity_id}/tags/{tag_key}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateTagAssignmentRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "entity_type",
+                  "description": "The type of entity to which the tag is assigned. Allowed values are apps, dashboards, geniespaces, notebooks",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "entity_id",
+                  "description": "The identifier of the entity to which the tag is assigned. For apps, the entity_id is the app name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "tag_key",
+                  "description": "The key of the tag. The characters , . : / - = and leading/trailing spaces are not allowed",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "tag_assignment",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "TagAssignment",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "entity_type",
+                  "description": "The type of entity to which the tag is assigned. Allowed values are apps, dashboards, geniespaces, notebooks",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "entity_id",
+                  "description": "The identifier of the entity to which the tag is assigned. For apps, the entity_id is the app name",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "tag_key",
+                  "description": "The key of the tag. The characters , . : / - = and leading/trailing spaces are not allowed",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "tag_assignment",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "TagAssignment",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "tag_assignment",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "TagAssignment",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "entity_type",
+                    "description": "The type of entity to which the tag is assigned. Allowed values are apps, dashboards, geniespaces, notebooks",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "entity_id",
+                    "description": "The identifier of the entity to which the tag is assigned. For apps, the entity_id is the app name",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "tag_key",
+                    "description": "The key of the tag. The characters , . : / - = and leading/trailing spaces are not allowed",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "entity_type",
+                    "description": "The type of entity to which the tag is assigned. Allowed values are apps, dashboards, geniespaces, notebooks",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "entity_id",
+                    "description": "The identifier of the entity to which the tag is assigned. For apps, the entity_id is the app name",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "tag_key",
+                    "description": "The key of the tag. The characters , . : / - = and leading/trailing spaces are not allowed",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "TagAssignment",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "entity_type",
+                  "description": "The type of entity to which the tag is assigned. Allowed values are apps, dashboards, geniespaces, notebooks",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "entity_id",
+                  "description": "The identifier of the entity to which the tag is assigned. For apps, the entity_id is the app name",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "tag_key",
+                  "description": "The key of the tag. The characters , . : / - = and leading/trailing spaces are not allowed",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "entity_type",
+                  "description": "The type of entity to which the tag is assigned. Allowed values are apps, dashboards, geniespaces, notebooks",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "entity_id",
+                  "description": "The identifier of the entity to which the tag is assigned. For apps, the entity_id is the app name",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "tag_key",
+                  "description": "The key of the tag. The characters , . : / - = and leading/trailing spaces are not allowed",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "entity_id",
+                "description": "The identifier of the entity to which the tag is assigned. For apps, the entity_id is the app name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "entity_type",
+                "description": "The type of entity to which the tag is assigned. Allowed values are apps, dashboards, geniespaces, notebooks",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tag_assignment",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "TagAssignment",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "entity_type",
+                      "description": "The type of entity to which the tag is assigned. Allowed values are apps, dashboards, geniespaces, notebooks",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "entity_id",
+                      "description": "The identifier of the entity to which the tag is assigned. For apps, the entity_id is the app name",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "tag_key",
+                      "description": "The key of the tag. The characters , . : / - = and leading/trailing spaces are not allowed",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "entity_type",
+                      "description": "The type of entity to which the tag is assigned. Allowed values are apps, dashboards, geniespaces, notebooks",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "entity_id",
+                      "description": "The identifier of the entity to which the tag is assigned. For apps, the entity_id is the app name",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "tag_key",
+                      "description": "The key of the tag. The characters , . : / - = and leading/trailing spaces are not allowed",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "tag_key",
+                "description": "The key of the tag. The characters , . : / - = and leading/trailing spaces are not allowed",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "entity_id",
+                "description": "The identifier of the entity to which the tag is assigned. For apps, the entity_id is the app name",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "entity_type",
+                "description": "The type of entity to which the tag is assigned. Allowed values are apps, dashboards, geniespaces, notebooks",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tag_key",
+                "description": "The key of the tag. The characters , . : / - = and leading/trailing spaces are not allowed",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tag_value",
+                "description": "The value of the tag",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "entity_type",
+                "description": "The type of entity to which the tag is assigned. Allowed values are apps, dashboards, geniespaces, notebooks",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "entity_id",
+                "description": "The identifier of the entity to which the tag is assigned. For apps, the entity_id is the app name",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "tag_key",
+                "description": "The key of the tag. The characters , . : / - = and leading/trailing spaces are not allowed",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "iamv2.WorkspaceIamV2",
+        "name": "WorkspaceIamV2",
+        "description": "These APIs are used to manage identities and the workspace access of these identities in Databricks.",
+        "package": {
+          "name": "iamv2"
+        },
+        "docs_group": "iam",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "methods": [
+          {
+            "name": "CreateDirectGroupMemberProxy",
+            "description": "Creates a group membership (assigns a principal to a group).",
+            "summary": "Create a direct group membership.",
+            "path": "/api/2.0/identity/groups/{group_id}/direct-members",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "CreateDirectGroupMemberProxyRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "group_id",
+                  "description": "Required. Internal ID of the group in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "direct_group_member",
+                  "description": "Required. The group membership to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DirectGroupMember",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "group_id",
+                  "description": "Required. Internal ID of the group in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "direct_group_member",
+                  "description": "Required. The group membership to create.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "DirectGroupMember",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "direct_group_member",
+              "description": "Required. The group membership to create.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "DirectGroupMember",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "principal_id",
+                    "description": "Internal ID of the principal in Databricks.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_int64": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "principal_id",
+                    "description": "Internal ID of the principal in Databricks.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_int64": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "DirectGroupMember",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "Internal ID of the principal in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "Internal ID of the principal in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "direct_group_member",
+                "description": "Required. The group membership to create.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "DirectGroupMember",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "principal_id",
+                      "description": "Internal ID of the principal in Databricks.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_int64": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "principal_id",
+                      "description": "Internal ID of the principal in Databricks.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_int64": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "group_id",
+                "description": "Required. Internal ID of the group in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "Display name of the principal.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "external_id",
+                "description": "The external ID of the principal in Databricks.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "group_id",
+                "description": "The internal ID of the group this member belongs to.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "membership_source",
+                "description": "The source of group membership (internal or from identity provider).",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "GroupMembershipSource",
+                  "enum": [
+                    {
+                      "content": "IDENTITY_PROVIDER"
+                    },
+                    {
+                      "content": "INTERNAL"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "Internal ID of the principal in Databricks.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "principal_type",
+                "description": "The type of the principal (user/service principal/group).",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PrincipalType",
+                  "enum": [
+                    {
+                      "content": "GROUP"
+                    },
+                    {
+                      "content": "SERVICE_PRINCIPAL"
+                    },
+                    {
+                      "content": "USER"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "group_id",
+                "description": "Required. Internal ID of the group in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "Internal ID of the principal in Databricks.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateGroupProxy",
+            "description": "Creates a local group in the Databricks account that parents the calling workspace and returns\nthe created group. A local group is one that is not synced from the customer's identity\nprovider, and can be created whether or not Account Identity Management (AIM) is enabled.\n\nWhen AIM is enabled, supplying an external ID returns an error. To provision the identity from\nyour identity provider, resolve it by its external ID with ResolveGroup; to read an existing\nexternal identity, use the ExternalGroup resource.",
+            "summary": "Create a group in the account.",
+            "path": "/api/2.0/identity/groups",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "CreateGroupProxyRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "group",
+                  "description": "Required. Group to be created in Databricks",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Group",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "group",
+                  "description": "Required. Group to be created in Databricks",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Group",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "group",
+              "description": "Required. Group to be created in Databricks",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Group",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "Group",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "group",
+                "description": "Required. Group to be created in Databricks",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Group",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "account_id",
+                "description": "The parent account ID for group in Databricks.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "external_id",
+                "description": "ExternalId of the group in the customer's IdP.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "group_id",
+                "description": "Internal group ID of the group in Databricks.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "group_name",
+                "description": "Display name of the group.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateServicePrincipalProxy",
+            "description": "Creates a local service principal in the Databricks account that parents the calling workspace\nand returns the created service principal. A local service principal is one that is not synced\nfrom the customer's identity provider, and can be created whether or not Account Identity\nManagement (AIM) is enabled.\n\nWhen AIM is enabled, supplying an external ID returns an error. To provision the identity from\nyour identity provider, resolve it by its external ID with ResolveServicePrincipal; to read an\nexisting external identity, use the ExternalServicePrincipal resource.",
+            "summary": "Create a service principal in the account.",
+            "path": "/api/2.0/identity/service-principals",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "CreateServicePrincipalProxyRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "service_principal",
+                  "description": "Required. Service principal to be created in Databricks",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ServicePrincipal",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "service_principal",
+                  "description": "Required. Service principal to be created in Databricks",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ServicePrincipal",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "service_principal",
+              "description": "Required. Service principal to be created in Databricks",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "ServicePrincipal",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "display_name",
+                    "description": "Display name of the service principal.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "account_sp_status",
+                    "description": "The activity status of a service principal in a Databricks account.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "State",
+                      "enum": [
+                        {
+                          "content": "ACTIVE"
+                        },
+                        {
+                          "content": "INACTIVE"
+                        }
+                      ]
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "display_name",
+                    "description": "Display name of the service principal.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "account_sp_status",
+                    "description": "The activity status of a service principal in a Databricks account.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "State",
+                      "enum": [
+                        {
+                          "content": "ACTIVE"
+                        },
+                        {
+                          "content": "INACTIVE"
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "ServicePrincipal",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "display_name",
+                  "description": "Display name of the service principal.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "account_sp_status",
+                  "description": "The activity status of a service principal in a Databricks account.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "State",
+                    "enum": [
+                      {
+                        "content": "ACTIVE"
+                      },
+                      {
+                        "content": "INACTIVE"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "display_name",
+                  "description": "Display name of the service principal.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "account_sp_status",
+                  "description": "The activity status of a service principal in a Databricks account.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "State",
+                    "enum": [
+                      {
+                        "content": "ACTIVE"
+                      },
+                      {
+                        "content": "INACTIVE"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "service_principal",
+                "description": "Required. Service principal to be created in Databricks",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ServicePrincipal",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "display_name",
+                      "description": "Display name of the service principal.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "account_sp_status",
+                      "description": "The activity status of a service principal in a Databricks account.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "State",
+                        "enum": [
+                          {
+                            "content": "ACTIVE"
+                          },
+                          {
+                            "content": "INACTIVE"
+                          }
+                        ]
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "display_name",
+                      "description": "Display name of the service principal.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "account_sp_status",
+                      "description": "The activity status of a service principal in a Databricks account.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "State",
+                        "enum": [
+                          {
+                            "content": "ACTIVE"
+                          },
+                          {
+                            "content": "INACTIVE"
+                          }
+                        ]
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "account_id",
+                "description": "The parent account ID for the service principal in Databricks.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "account_sp_status",
+                "description": "The activity status of a service principal in a Databricks account.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "State",
+                  "enum": [
+                    {
+                      "content": "ACTIVE"
+                    },
+                    {
+                      "content": "INACTIVE"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "application_id",
+                "description": "Application ID of the service principal. Set at creation time and cannot be changed\nafterwards; when omitted, the server generates one.",
+                "is_computed": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "Display name of the service principal.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "external_id",
+                "description": "ExternalId of the service principal in the customer's IdP.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "service_principal_id",
+                "description": "Internal service principal ID of the service principal in Databricks.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "display_name",
+                "description": "Display name of the service principal.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "account_sp_status",
+                "description": "The activity status of a service principal in a Databricks account.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "State",
+                  "enum": [
+                    {
+                      "content": "ACTIVE"
+                    },
+                    {
+                      "content": "INACTIVE"
+                    }
+                  ]
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateUserProxy",
+            "description": "Creates a local user in the Databricks account that parents the calling workspace and returns\nthe created user. A local user is one that is not synced from the customer's identity provider,\nand can be created whether or not Account Identity Management (AIM) is enabled.\n\nWhen AIM is enabled, supplying an external ID returns an error. To provision the identity from\nyour identity provider, resolve it by its external ID with ResolveUser; to read an existing\nexternal identity, use the ExternalUser resource.",
+            "summary": "Create a user in the account.",
+            "path": "/api/2.0/identity/users",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "CreateUserProxyRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "user",
+                  "description": "Required. User to be created in Databricks",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "User",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "user",
+                  "description": "Required. User to be created in Databricks",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "User",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "user",
+              "description": "Required. User to be created in Databricks",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "User",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "username",
+                    "description": "Username/email of the user.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "full_name",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "UserFullName",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "account_user_status",
+                    "description": "The activity status of a user in a Databricks account.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "State",
+                      "enum": [
+                        {
+                          "content": "ACTIVE"
+                        },
+                        {
+                          "content": "INACTIVE"
+                        }
+                      ]
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "username",
+                    "description": "Username/email of the user.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "full_name",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "UserFullName",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "account_user_status",
+                    "description": "The activity status of a user in a Databricks account.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "State",
+                      "enum": [
+                        {
+                          "content": "ACTIVE"
+                        },
+                        {
+                          "content": "INACTIVE"
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "User",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "username",
+                  "description": "Username/email of the user.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "full_name",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "UserFullName",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "account_user_status",
+                  "description": "The activity status of a user in a Databricks account.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "State",
+                    "enum": [
+                      {
+                        "content": "ACTIVE"
+                      },
+                      {
+                        "content": "INACTIVE"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "username",
+                  "description": "Username/email of the user.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "full_name",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "UserFullName",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "account_user_status",
+                  "description": "The activity status of a user in a Databricks account.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "State",
+                    "enum": [
+                      {
+                        "content": "ACTIVE"
+                      },
+                      {
+                        "content": "INACTIVE"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "user",
+                "description": "Required. User to be created in Databricks",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "User",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "username",
+                      "description": "Username/email of the user.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "full_name",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "UserFullName",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "account_user_status",
+                      "description": "The activity status of a user in a Databricks account.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "State",
+                        "enum": [
+                          {
+                            "content": "ACTIVE"
+                          },
+                          {
+                            "content": "INACTIVE"
+                          }
+                        ]
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "username",
+                      "description": "Username/email of the user.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "full_name",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "UserFullName",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "account_user_status",
+                      "description": "The activity status of a user in a Databricks account.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "State",
+                        "enum": [
+                          {
+                            "content": "ACTIVE"
+                          },
+                          {
+                            "content": "INACTIVE"
+                          }
+                        ]
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "account_id",
+                "description": "The accountId parent of the user in Databricks.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "account_user_status",
+                "description": "The activity status of a user in a Databricks account.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "State",
+                  "enum": [
+                    {
+                      "content": "ACTIVE"
+                    },
+                    {
+                      "content": "INACTIVE"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "external_id",
+                "description": "ExternalId of the user in the customer's IdP.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "full_name",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "UserFullName",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "user_id",
+                "description": "Internal userId of the user in Databricks.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "username",
+                "description": "Username/email of the user.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "username",
+                "description": "Username/email of the user.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "full_name",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "UserFullName",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "account_user_status",
+                "description": "The activity status of a user in a Databricks account.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "State",
+                  "enum": [
+                    {
+                      "content": "ACTIVE"
+                    },
+                    {
+                      "content": "INACTIVE"
+                    }
+                  ]
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateWorkspaceAssignmentDetailProxy",
+            "description": "Creates a workspace assignment detail for a principal in the calling workspace.",
+            "summary": "Create a workspace assignment detail for a workspace.",
+            "path": "/api/2.0/identity/workspace-assignment-details",
+            "can_use_json": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "CreateWorkspaceAssignmentDetailProxyRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "workspace_assignment_detail",
+                  "description": "Required. Workspace assignment detail to be created in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "WorkspaceAssignmentDetail",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "workspace_assignment_detail",
+                  "description": "Required. Workspace assignment detail to be created in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "WorkspaceAssignmentDetail",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "workspace_assignment_detail",
+              "description": "Required. Workspace assignment detail to be created in Databricks.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "WorkspaceAssignmentDetail",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "principal_id",
+                    "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_int64": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "principal_id",
+                    "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_int64": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "WorkspaceAssignmentDetail",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "workspace_assignment_detail",
+                "description": "Required. Workspace assignment detail to be created in Databricks.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "WorkspaceAssignmentDetail",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "principal_id",
+                      "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_int64": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "principal_id",
+                      "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_int64": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "account_id",
+                "description": "The account ID parent of the workspace where the principal is assigned",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_entitlements",
+                "description": "Every entitlement the principal holds in this workspace, whether granted directly or through\ngroup membership. Get responses populate this field. List responses leave it empty.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EntitlementList",
+                  "array_value": {
+                    "pascal_name": "Entitlement",
+                    "enum": [
+                      {
+                        "content": "ALLOW_CLUSTER_CREATE"
+                      },
+                      {
+                        "content": "ALLOW_INSTANCE_POOL_CREATE"
+                      },
+                      {
+                        "content": "DATABRICKS_SQL_ACCESS"
+                      },
+                      {
+                        "content": "WORKSPACE_ACCESS"
+                      },
+                      {
+                        "content": "WORKSPACE_ADMIN"
+                      },
+                      {
+                        "content": "WORKSPACE_CONSUME"
+                      }
+                    ]
+                  }
+                }
+              },
+              {
+                "name": "entitlements",
+                "description": "Entitlements granted directly to the principal on this workspace. This is the only\nclient-settable field. Create and update manage exactly this set, including entitlements the\nprincipal also holds through a group.\nList responses leave this field empty. Get a single principal to read its entitlements.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EntitlementList",
+                  "array_value": {
+                    "pascal_name": "Entitlement",
+                    "enum": [
+                      {
+                        "content": "ALLOW_CLUSTER_CREATE"
+                      },
+                      {
+                        "content": "ALLOW_INSTANCE_POOL_CREATE"
+                      },
+                      {
+                        "content": "DATABRICKS_SQL_ACCESS"
+                      },
+                      {
+                        "content": "WORKSPACE_ACCESS"
+                      },
+                      {
+                        "content": "WORKSPACE_ADMIN"
+                      },
+                      {
+                        "content": "WORKSPACE_CONSUME"
+                      }
+                    ]
+                  }
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "principal_type",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PrincipalType",
+                  "enum": [
+                    {
+                      "content": "GROUP"
+                    },
+                    {
+                      "content": "SERVICE_PRINCIPAL"
+                    },
+                    {
+                      "content": "USER"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "workspace_id",
+                "description": "The workspace ID where the principal is assigned.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "principal_id",
+                "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "CreateWorkspaceAssignmentProxy",
+            "description": "Creates a workspace assignment for a principal in the calling workspace. Entitlements\nare granted one at a time rather than atomically. If the request fails partway through, the\nprincipal stays assigned to the workspace with only some of the requested entitlements. Get the\nassignment afterwards to confirm which entitlements were granted.",
+            "summary": "Create a workspace assignment for a workspace.",
+            "path": "/api/2.0/identity/workspace-assignments",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "CreateWorkspaceAssignmentProxyRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "workspace_assignment",
+                  "description": "Required. Workspace assignment to be created in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "WorkspaceAssignment",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "workspace_assignment",
+                  "description": "Required. Workspace assignment to be created in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "WorkspaceAssignment",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "workspace_assignment",
+              "description": "Required. Workspace assignment to be created in Databricks.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "WorkspaceAssignment",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "principal_id",
+                    "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_int64": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "principal_id",
+                    "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_int64": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "WorkspaceAssignment",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "workspace_assignment",
+                "description": "Required. Workspace assignment to be created in Databricks.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "WorkspaceAssignment",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "principal_id",
+                      "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_int64": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "principal_id",
+                      "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_int64": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "account_id",
+                "description": "The account ID parent of the workspace where the principal is assigned",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_entitlements",
+                "description": "Every entitlement the principal holds in this workspace, whether granted directly or through\ngroup membership. Get responses populate this field. List responses leave it empty.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EntitlementList",
+                  "array_value": {
+                    "pascal_name": "Entitlement",
+                    "enum": [
+                      {
+                        "content": "ALLOW_CLUSTER_CREATE"
+                      },
+                      {
+                        "content": "ALLOW_INSTANCE_POOL_CREATE"
+                      },
+                      {
+                        "content": "DATABRICKS_SQL_ACCESS"
+                      },
+                      {
+                        "content": "WORKSPACE_ACCESS"
+                      },
+                      {
+                        "content": "WORKSPACE_ADMIN"
+                      },
+                      {
+                        "content": "WORKSPACE_CONSUME"
+                      }
+                    ]
+                  }
+                }
+              },
+              {
+                "name": "entitlements",
+                "description": "Entitlements granted directly to the principal on this workspace. This is the only\nclient-settable field. Create and update manage exactly this set, including entitlements the\nprincipal also holds through a group.\nList responses leave this field empty. Get a single principal to read its entitlements.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EntitlementList",
+                  "array_value": {
+                    "pascal_name": "Entitlement",
+                    "enum": [
+                      {
+                        "content": "ALLOW_CLUSTER_CREATE"
+                      },
+                      {
+                        "content": "ALLOW_INSTANCE_POOL_CREATE"
+                      },
+                      {
+                        "content": "DATABRICKS_SQL_ACCESS"
+                      },
+                      {
+                        "content": "WORKSPACE_ACCESS"
+                      },
+                      {
+                        "content": "WORKSPACE_ADMIN"
+                      },
+                      {
+                        "content": "WORKSPACE_CONSUME"
+                      }
+                    ]
+                  }
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "principal_type",
+                "description": "The type of the principal (user/service principal/group) that is assigned.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PrincipalType",
+                  "enum": [
+                    {
+                      "content": "GROUP"
+                    },
+                    {
+                      "content": "SERVICE_PRINCIPAL"
+                    },
+                    {
+                      "content": "USER"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "workspace_id",
+                "description": "The workspace ID where the principal is assigned.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "principal_id",
+                "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteDirectGroupMemberProxy",
+            "description": "Deletes a group membership (unassigns a principal from a group).",
+            "summary": "Delete a direct group membership.",
+            "path": "/api/2.0/identity/groups/{group_id}/direct-members/{principal_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "DeleteDirectGroupMemberProxyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "group_id",
+                  "description": "Required. Internal ID of the group in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "principal_id",
+                  "description": "Required. Internal ID of the principal to be unassigned from the group.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "group_id",
+                  "description": "Required. Internal ID of the group in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "principal_id",
+                  "description": "Required. Internal ID of the principal to be unassigned from the group.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "group_id",
+                "description": "Required. Internal ID of the group in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "Required. Internal ID of the principal to be unassigned from the group.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "group_id",
+                "description": "Required. Internal ID of the group in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "Required. Internal ID of the principal to be unassigned from the group.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteGroupProxy",
+            "description": "Deletes a group by its internal ID from the Databricks\naccount that parents the calling workspace.",
+            "summary": "Delete a group in the account.",
+            "path": "/api/2.0/identity/groups/{group_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "DeleteGroupProxyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "group_id",
+                  "description": "Required. Internal ID of the group in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "group_id",
+                  "description": "Required. Internal ID of the group in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "group_id",
+                "description": "Required. Internal ID of the group in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "group_id",
+                "description": "Required. Internal ID of the group in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteServicePrincipalProxy",
+            "description": "Deletes a service principal by its internal ID\nfrom the Databricks account that parents the calling workspace.",
+            "summary": "Delete a service principal in the account.",
+            "path": "/api/2.0/identity/service-principals/{service_principal_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "DeleteServicePrincipalProxyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "service_principal_id",
+                  "description": "Required. Internal ID of the service principal in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "service_principal_id",
+                  "description": "Required. Internal ID of the service principal in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "service_principal_id",
+                "description": "Required. Internal ID of the service principal in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "service_principal_id",
+                "description": "Required. Internal ID of the service principal in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteUserProxy",
+            "description": "Deletes a user by its internal ID from the Databricks\naccount that parents the calling workspace.",
+            "summary": "Delete a user in the account.",
+            "path": "/api/2.0/identity/users/{user_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "DeleteUserProxyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "user_id",
+                  "description": "Required. Internal ID of the user in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "user_id",
+                  "description": "Required. Internal ID of the user in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "user_id",
+                "description": "Required. Internal ID of the user in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "user_id",
+                "description": "Required. Internal ID of the user in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteWorkspaceAssignmentDetailProxy",
+            "description": "Deletes a workspace assignment detail for a principal in the calling workspace, revoking all of\nits entitlements. Entitlements are revoked one at a time rather than atomically. If the request\nfails partway through, the principal stays assigned with some of its original entitlements.\nRetrying is safe.",
+            "summary": "Delete a workspace assignment detail for a workspace.",
+            "path": "/api/2.0/identity/workspace-assignment-details/{principal_id}",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "DeleteWorkspaceAssignmentDetailProxyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "Required. ID of the principal in Databricks to delete workspace assignment for.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "Required. ID of the principal in Databricks to delete workspace assignment for.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "principal_id",
+                "description": "Required. ID of the principal in Databricks to delete workspace assignment for.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "principal_id",
+                "description": "Required. ID of the principal in Databricks to delete workspace assignment for.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "DeleteWorkspaceAssignmentProxy",
+            "description": "Deletes a workspace assignment for a principal in the calling workspace, revoking all of\nits entitlements. Entitlements are revoked one at a time rather than atomically. If the request\nfails partway through, the principal stays assigned with some of its original entitlements.\nRetrying is safe.",
+            "summary": "Delete a workspace assignment for a workspace.",
+            "path": "/api/2.0/identity/workspace-assignments/{principal_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "DeleteWorkspaceAssignmentProxyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "Required. ID of the principal in Databricks to delete workspace assignment for.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "Required. ID of the principal in Databricks to delete workspace assignment for.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "is_empty_response": true
+            },
+            "all_fields": [
+              {
+                "name": "principal_id",
+                "description": "Required. ID of the principal in Databricks to delete workspace assignment for.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "principal_id",
+                "description": "Required. ID of the principal in Databricks to delete workspace assignment for.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetDirectGroupMemberProxy",
+            "description": "Gets a provisioned direct member of a group.",
+            "summary": "Get a direct group member.",
+            "path": "/api/2.0/identity/groups/{group_id}/direct-members/{principal_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetDirectGroupMemberProxyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "group_id",
+                  "description": "Required. Internal ID of the group in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "principal_id",
+                  "description": "Required. Internal ID of the principal belonging to the group in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "group_id",
+                  "description": "Required. Internal ID of the group in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "principal_id",
+                  "description": "Required. Internal ID of the principal belonging to the group in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "DirectGroupMember",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "Internal ID of the principal in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "Internal ID of the principal in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "group_id",
+                "description": "Required. Internal ID of the group in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "Required. Internal ID of the principal belonging to the group in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "group_id",
+                "description": "Required. Internal ID of the group in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "Required. Internal ID of the principal belonging to the group in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetExternalGroupProxy",
+            "description": "Retrieves an external group with the given external ID from the customer's\nIdP. If the group does not exist, it will be created in the account. If the\ncustomer is not onboarded onto Automatic Identity Management (AIM), this will\nreturn an error. Workspace-scoped variant for workspace-authenticated callers.",
+            "summary": "Get an external group in the account.",
+            "path": "/api/2.0/identity/{name=external-groups/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetExternalGroupProxyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Required. The resource name of the external group.\nFormat: external-groups/{external_group_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Required. The resource name of the external group.\nFormat: external-groups/{external_group_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ExternalGroup",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Required. The resource name of the external group.\nFormat: external-groups/{external_group_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Required. The resource name of the external group.\nFormat: external-groups/{external_group_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetExternalServicePrincipalProxy",
+            "description": "Retrieves an external service principal with the given external ID from the\ncustomer's IdP. If the service principal does not exist, it will be created.\nIf the customer is not onboarded onto Automatic Identity Management (AIM),\nthis will return an error. Workspace-scoped variant for workspace-authenticated\ncallers.",
+            "summary": "Get an external service principal in the account.",
+            "path": "/api/2.0/identity/{name=external-service-principals/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetExternalServicePrincipalProxyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Required. The resource name of the external service principal.\nFormat: external-service-principals/{external_service_principal_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Required. The resource name of the external service principal.\nFormat: external-service-principals/{external_service_principal_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ExternalServicePrincipal",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Required. The resource name of the external service principal.\nFormat: external-service-principals/{external_service_principal_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Required. The resource name of the external service principal.\nFormat: external-service-principals/{external_service_principal_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetExternalUserProxy",
+            "description": "Retrieves an external user with the given external ID from the customer's\nIdP. If the user does not exist, it will be created. If the customer is not\nonboarded onto Automatic Identity Management (AIM), this will return an error.\nWorkspace-scoped variant for workspace-authenticated callers.",
+            "summary": "Get an external user in the account.",
+            "path": "/api/2.0/identity/{name=external-users/*}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetExternalUserProxyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Required. The resource name of the external user.\nFormat: external-users/{external_user_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Required. The resource name of the external user.\nFormat: external-users/{external_user_id}",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ExternalUser",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Required. The resource name of the external user.\nFormat: external-users/{external_user_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Required. The resource name of the external user.\nFormat: external-users/{external_user_id}",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetGroupProxy",
+            "description": "Fetches a group by its internal ID from the Databricks\naccount that parents the calling workspace.",
+            "summary": "Get a group in the account.",
+            "path": "/api/2.0/identity/groups/{group_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetGroupProxyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "group_id",
+                  "description": "Required. Internal ID of the group in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "group_id",
+                  "description": "Required. Internal ID of the group in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Group",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "group_id",
+                "description": "Required. Internal ID of the group in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "group_id",
+                "description": "Required. Internal ID of the group in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetServicePrincipalProxy",
+            "description": "Fetches a service principal by its internal ID\nfrom the Databricks account that parents the calling workspace.",
+            "summary": "Get a service principal in the account.",
+            "path": "/api/2.0/identity/service-principals/{service_principal_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetServicePrincipalProxyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "service_principal_id",
+                  "description": "Required. Internal ID of the service principal in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "service_principal_id",
+                  "description": "Required. Internal ID of the service principal in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ServicePrincipal",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "display_name",
+                  "description": "Display name of the service principal.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "account_sp_status",
+                  "description": "The activity status of a service principal in a Databricks account.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "State",
+                    "enum": [
+                      {
+                        "content": "ACTIVE"
+                      },
+                      {
+                        "content": "INACTIVE"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "display_name",
+                  "description": "Display name of the service principal.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "account_sp_status",
+                  "description": "The activity status of a service principal in a Databricks account.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "State",
+                    "enum": [
+                      {
+                        "content": "ACTIVE"
+                      },
+                      {
+                        "content": "INACTIVE"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "service_principal_id",
+                "description": "Required. Internal ID of the service principal in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "service_principal_id",
+                "description": "Required. Internal ID of the service principal in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetUserProxy",
+            "description": "Fetches a user by its internal ID from the Databricks account\nthat parents the calling workspace.",
+            "summary": "Get a user in the account.",
+            "path": "/api/2.0/identity/users/{user_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetUserProxyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "user_id",
+                  "description": "Required. Internal ID of the user in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "user_id",
+                  "description": "Required. Internal ID of the user in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "User",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "username",
+                  "description": "Username/email of the user.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "full_name",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "UserFullName",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "account_user_status",
+                  "description": "The activity status of a user in a Databricks account.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "State",
+                    "enum": [
+                      {
+                        "content": "ACTIVE"
+                      },
+                      {
+                        "content": "INACTIVE"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "username",
+                  "description": "Username/email of the user.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "full_name",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "UserFullName",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "account_user_status",
+                  "description": "The activity status of a user in a Databricks account.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "State",
+                    "enum": [
+                      {
+                        "content": "ACTIVE"
+                      },
+                      {
+                        "content": "INACTIVE"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "user_id",
+                "description": "Required. Internal ID of the user in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "user_id",
+                "description": "Required. Internal ID of the user in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetWorkspaceAccessDetailLocal",
+            "description": "Returns the access details for a principal in the current workspace. Allows for checking access details for any\nprovisioned principal (user, service principal, or group) in the current workspace.\n* Provisioned principal here refers to one that has been synced into Databricks from the customer's IdP or\nadded explicitly to Databricks via SCIM/UI.\nAllows for passing in a \"view\" parameter to control what fields are returned (BASIC by default or FULL).",
+            "summary": "Get workspace access details for a principal.",
+            "path": "/api/2.0/identity/workspace-access-details/{principal_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetWorkspaceAccessDetailLocalRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "Required. The internal ID of the principal (user/sp/group) for which the access details are being requested.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "Required. The internal ID of the principal (user/sp/group) for which the access details are being requested.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "WorkspaceAccessDetail",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "principal_id",
+                "description": "Required. The internal ID of the principal (user/sp/group) for which the access details are being requested.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "view",
+                "description": "Controls what fields are returned.",
+                "is_query": true,
+                "entity": {
+                  "pascal_name": "WorkspaceAccessDetailView",
+                  "enum": [
+                    {
+                      "content": "BASIC"
+                    },
+                    {
+                      "content": "FULL"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "principal_id",
+                "description": "Required. The internal ID of the principal (user/sp/group) for which the access details are being requested.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetWorkspaceAssignmentDetailProxy",
+            "description": "Returns the assignment details for a principal in the calling workspace.",
+            "summary": "Get workspace assignment details for a principal.",
+            "path": "/api/2.0/identity/workspace-assignment-details/{principal_id}",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "GetWorkspaceAssignmentDetailProxyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "Required. The internal ID of the principal (user/sp/group) for which the assignment details are being requested.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "Required. The internal ID of the principal (user/sp/group) for which the assignment details are being requested.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "WorkspaceAssignmentDetail",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "principal_id",
+                "description": "Required. The internal ID of the principal (user/sp/group) for which the assignment details are being requested.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "principal_id",
+                "description": "Required. The internal ID of the principal (user/sp/group) for which the assignment details are being requested.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetWorkspaceAssignmentProxy",
+            "description": "Returns the assignment for a principal in the calling workspace.",
+            "summary": "Get a workspace assignment for a principal.",
+            "path": "/api/2.0/identity/workspace-assignments/{principal_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetWorkspaceAssignmentProxyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "Required. The internal ID of the principal (user/sp/group) for which the assignment is being requested.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "Required. The internal ID of the principal (user/sp/group) for which the assignment is being requested.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "WorkspaceAssignment",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "principal_id",
+                "description": "Required. The internal ID of the principal (user/sp/group) for which the assignment is being requested.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "principal_id",
+                "description": "Required. The internal ID of the principal (user/sp/group) for which the assignment is being requested.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "GetWorkspaceIdentityDetail",
+            "description": "Returns the identity details for a principal in a workspace.",
+            "summary": "Get workspace identity details for a principal.",
+            "path": "/api/2.0/identity/workspace-identity-details/{principal_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "GetWorkspaceIdentityDetailRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "Required. The internal ID of the principal (user/sp/group) for which the identity details are being requested.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "Required. The internal ID of the principal (user/sp/group) for which the identity details are being requested.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "WorkspaceIdentityDetail",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "principal_id",
+                "description": "Required. The internal ID of the principal (user/sp/group) for which the identity details are being requested.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "principal_id",
+                "description": "Required. The internal ID of the principal (user/sp/group) for which the identity details are being requested.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListDirectGroupMembersProxy",
+            "description": "Lists provisioned direct members of a group with their membership source (internal or from identity provider).",
+            "summary": "List direct group members.",
+            "path": "/api/2.0/identity/groups/{group_id}/direct-members",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ListDirectGroupMembersProxyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "group_id",
+                  "description": "Required. Internal ID of the group in Databricks whose direct members are being listed.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "group_id",
+                  "description": "Required. Internal ID of the group in Databricks whose direct members are being listed.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListDirectGroupMembersResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "group_id",
+                "description": "Required. Internal ID of the group in Databricks whose direct members are being listed.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "The maximum number of members to return. The service may return fewer than this value.\nIf not provided, defaults to 1000, which is also the maximum allowed. Requests for more than the maximum are clamped to 1000.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "A page token from a previous list call. Provide this to retrieve the subsequent page.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "group_id",
+                "description": "Required. Internal ID of the group in Databricks whose direct members are being listed.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "A page token from a previous list call. Provide this to retrieve the subsequent page.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListGroupsProxy",
+            "description": "Lists the groups in the Databricks account that parents\nthe calling workspace, returning one page per call. Supports filtering by group name or external ID.",
+            "summary": "List groups in the account.",
+            "path": "/api/2.0/identity/groups",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ListGroupsProxyRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListGroupsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "filter",
+                "description": "Optional. Allows filtering groups by group name or external id.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "The maximum number of groups to return. The service may return fewer than this value.\nIf not provided, defaults to 1000, which is also the maximum allowed. Requests for more than the maximum are clamped to 1000.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "A page token, received from a previous ListGroups call. Provide this to retrieve the subsequent page.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "A page token, received from a previous ListGroups call. Provide this to retrieve the subsequent page.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListServicePrincipalsProxy",
+            "description": "Lists the service principals in the Databricks\naccount that parents the calling workspace, returning one page per call. Supports filtering by\napplication ID or external ID.",
+            "summary": "List service principals in the account.",
+            "path": "/api/2.0/identity/service-principals",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ListServicePrincipalsProxyRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListServicePrincipalsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "filter",
+                "description": "Optional. Allows filtering service principals by application id or external id.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "The maximum number of SPs to return. The service may return fewer than this value.\nIf not provided, defaults to 1000, which is also the maximum allowed. Requests for more than the maximum are clamped to 1000.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "A page token, received from a previous ListServicePrincipals call. Provide this to retrieve the subsequent page.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "A page token, received from a previous ListServicePrincipals call. Provide this to retrieve the subsequent page.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListTransitiveParentGroupsProxy",
+            "description": "Lists all transitive parent groups of a principal.",
+            "summary": "List all transitive parent groups of a principal.",
+            "path": "/api/2.0/identity/principals/{principal_id}/transitive-parent-groups",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ListTransitiveParentGroupsProxyRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "Required. Internal ID of the principal in Databricks whose transitive parent groups are being listed.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "Required. Internal ID of the principal in Databricks whose transitive parent groups are being listed.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ListTransitiveParentGroupsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "The maximum number of parent groups to return. The service may return fewer than this value.\nIf not provided, defaults to 1000, which is also the maximum allowed. Requests for more than the maximum are clamped to 1000.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "A page token, received from a previous ListTransitiveParentGroups call. Provide this to retrieve the subsequent page.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "Required. Internal ID of the principal in Databricks whose transitive parent groups are being listed.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "principal_id",
+                "description": "Required. Internal ID of the principal in Databricks whose transitive parent groups are being listed.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListUsersProxy",
+            "description": "Lists the users in the Databricks account that parents the\ncalling workspace, returning one page per call. Supports filtering by username or external ID.",
+            "summary": "List users in the account.",
+            "path": "/api/2.0/identity/users",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ListUsersProxyRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListUsersResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "filter",
+                "description": "Optional. Allows filtering users by username or external id.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "page_size",
+                "description": "The maximum number of users to return. The service may return fewer than this value.\nIf not provided, defaults to 1000, which is also the maximum allowed. Requests for more than the maximum are clamped to 1000.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "A page token, received from a previous ListUsers call. Provide this to retrieve the subsequent page.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "A page token, received from a previous ListUsers call. Provide this to retrieve the subsequent page.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListWorkspaceAssignmentDetailsProxy",
+            "description": "Lists workspace assignment details for the calling workspace. The response omits the\nper-principal entitlement fields (`entitlements` and `effective_entitlements`). To read the\nentitlements for a single principal, get that principal's assignment detail.",
+            "summary": "List workspace assignment details for a workspace.",
+            "path": "/api/2.0/identity/workspace-assignment-details",
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "ListWorkspaceAssignmentDetailsProxyRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListWorkspaceAssignmentDetailsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "The maximum number of workspace assignment details to return. The service may return fewer than this value.\nIf not provided, defaults to 1000, which is also the maximum allowed. Requests for more than the maximum are clamped to 1000.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "A page token from a previous list call. Provide this to retrieve the subsequent page.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "A page token from a previous list call. Provide this to retrieve the subsequent page.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ListWorkspaceAssignmentsProxy",
+            "description": "Lists workspace assignments for the calling workspace. The response omits the\nper-principal entitlement fields (`entitlements` and `effective_entitlements`). To read the\nentitlements for a single principal, get that principal's assignment.",
+            "summary": "List workspace assignments for a workspace.",
+            "path": "/api/2.0/identity/workspace-assignments",
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ListWorkspaceAssignmentsProxyRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListWorkspaceAssignmentsResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "The maximum number of workspace assignments to return. The service may return fewer than this value.\nIf not provided, defaults to 1000, which is also the maximum allowed. Requests for more than the maximum are clamped to 1000.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "A page token from a previous list call. Provide this to retrieve the subsequent page.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "A page token from a previous list call. Provide this to retrieve the subsequent page.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "ResolveGroupProxy",
+            "description": "Resolves a group with the given external ID from the customer's IdP. If the group does not exist, it will be created in the account.\nIf the customer is not onboarded onto Automatic Identity Management (AIM), this will return an error.",
+            "summary": "Resolve an external group in the Databricks account.",
+            "path": "/api/2.0/identity/groups/resolve-by-external-id",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ResolveGroupProxyRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "external_id",
+                  "description": "Required. The external ID of the group in the customer's IdP.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "external_id",
+                  "description": "Required. The external ID of the group in the customer's IdP.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ResolveGroupResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "external_id",
+                "description": "Required. The external ID of the group in the customer's IdP.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "external_id",
+                "description": "Required. The external ID of the group in the customer's IdP.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ResolveServicePrincipalProxy",
+            "description": "Resolves a service principal with the given external ID from the customer's IdP. If the service\nprincipal does not exist, it will be created.\nIf the customer is not onboarded onto Automatic Identity Management (AIM), this will return an error.",
+            "summary": "Resolve an external service principal in the Databricks account.",
+            "path": "/api/2.0/identity/service-principals/resolve-by-external-id",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ResolveServicePrincipalProxyRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "external_id",
+                  "description": "Required. The external ID of the service principal in the customer's IdP.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "external_id",
+                  "description": "Required. The external ID of the service principal in the customer's IdP.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ResolveServicePrincipalResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "external_id",
+                "description": "Required. The external ID of the service principal in the customer's IdP.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "external_id",
+                "description": "Required. The external ID of the service principal in the customer's IdP.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ResolveUserProxy",
+            "description": "Resolves a user with the given external ID from the customer's IdP. If the user does not exist, it will be created.\nIf the customer is not onboarded onto Automatic Identity Management (AIM), this will return an error.",
+            "summary": "Resolve an external user in the Databricks account.",
+            "path": "/api/2.0/identity/users/resolve-by-external-id",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "ResolveUserProxyRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "external_id",
+                  "description": "Required. The external ID of the user in the customer's IdP.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "external_id",
+                  "description": "Required. The external ID of the user in the customer's IdP.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "ResolveUserResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "external_id",
+                "description": "Required. The external ID of the user in the customer's IdP.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "external_id",
+                "description": "Required. The external ID of the user in the customer's IdP.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateGroupProxy",
+            "description": "Updates an existing group in the Databricks account that\nparents the calling workspace. Only the fields named in the update mask are modified. Returns\nthe updated Group resource.\n\nWhen AIM is enabled and the group is an external identity (its external_id is set), only\nexternal_id can be updated; its other fields are sourced from your identity provider.\nWith AIM and group visibility filters, a new nonempty external_id must identify a visible group.\nClearing external_id is allowed.",
+            "summary": "Update a group in the account.",
+            "path": "/api/2.0/identity/groups/{group_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "UpdateGroupProxyRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "group_id",
+                  "description": "Required. Internal ID of the group in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "group",
+                  "description": "Required. Group to be updated in Databricks",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Group",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Optional. The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "group_id",
+                  "description": "Required. Internal ID of the group in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Optional. The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "group",
+                  "description": "Required. Group to be updated in Databricks",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Group",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "group",
+              "description": "Required. Group to be updated in Databricks",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Group",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "Group",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "group",
+                "description": "Required. Group to be updated in Databricks",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Group",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "group_id",
+                "description": "Required. Internal ID of the group in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Optional. The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "account_id",
+                "description": "The parent account ID for group in Databricks.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "external_id",
+                "description": "ExternalId of the group in the customer's IdP.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "group_id",
+                "description": "Internal group ID of the group in Databricks.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "group_name",
+                "description": "Display name of the group.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "group_id",
+                "description": "Required. Internal ID of the group in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Optional. The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateServicePrincipalProxy",
+            "description": "Updates an existing service principal in the\nDatabricks account that parents the calling workspace. Only the fields named in the update mask\nare modified. Returns the updated ServicePrincipal resource.\n\nWhen AIM is enabled and the service principal is an external identity (its external_id is set),\nonly external_id can be updated; its other fields are sourced from your identity provider.",
+            "summary": "Update a service principal in the account.",
+            "path": "/api/2.0/identity/service-principals/{service_principal_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "UpdateServicePrincipalProxyRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "service_principal_id",
+                  "description": "Required. Internal ID of the service principal in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "service_principal",
+                  "description": "Required. Service principal to be updated in Databricks",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ServicePrincipal",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Optional. The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "service_principal_id",
+                  "description": "Required. Internal ID of the service principal in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Optional. The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "service_principal",
+                  "description": "Required. Service principal to be updated in Databricks",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "ServicePrincipal",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "service_principal",
+              "description": "Required. Service principal to be updated in Databricks",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "ServicePrincipal",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "display_name",
+                    "description": "Display name of the service principal.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "account_sp_status",
+                    "description": "The activity status of a service principal in a Databricks account.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "State",
+                      "enum": [
+                        {
+                          "content": "ACTIVE"
+                        },
+                        {
+                          "content": "INACTIVE"
+                        }
+                      ]
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "display_name",
+                    "description": "Display name of the service principal.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "account_sp_status",
+                    "description": "The activity status of a service principal in a Databricks account.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "State",
+                      "enum": [
+                        {
+                          "content": "ACTIVE"
+                        },
+                        {
+                          "content": "INACTIVE"
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "ServicePrincipal",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "display_name",
+                  "description": "Display name of the service principal.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "account_sp_status",
+                  "description": "The activity status of a service principal in a Databricks account.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "State",
+                    "enum": [
+                      {
+                        "content": "ACTIVE"
+                      },
+                      {
+                        "content": "INACTIVE"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "display_name",
+                  "description": "Display name of the service principal.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "account_sp_status",
+                  "description": "The activity status of a service principal in a Databricks account.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "State",
+                    "enum": [
+                      {
+                        "content": "ACTIVE"
+                      },
+                      {
+                        "content": "INACTIVE"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "service_principal",
+                "description": "Required. Service principal to be updated in Databricks",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "ServicePrincipal",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "display_name",
+                      "description": "Display name of the service principal.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "account_sp_status",
+                      "description": "The activity status of a service principal in a Databricks account.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "State",
+                        "enum": [
+                          {
+                            "content": "ACTIVE"
+                          },
+                          {
+                            "content": "INACTIVE"
+                          }
+                        ]
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "display_name",
+                      "description": "Display name of the service principal.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "account_sp_status",
+                      "description": "The activity status of a service principal in a Databricks account.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "State",
+                        "enum": [
+                          {
+                            "content": "ACTIVE"
+                          },
+                          {
+                            "content": "INACTIVE"
+                          }
+                        ]
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "service_principal_id",
+                "description": "Required. Internal ID of the service principal in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Optional. The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "account_id",
+                "description": "The parent account ID for the service principal in Databricks.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "account_sp_status",
+                "description": "The activity status of a service principal in a Databricks account.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "State",
+                  "enum": [
+                    {
+                      "content": "ACTIVE"
+                    },
+                    {
+                      "content": "INACTIVE"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "application_id",
+                "description": "Application ID of the service principal. Set at creation time and cannot be changed\nafterwards; when omitted, the server generates one.",
+                "is_computed": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "Display name of the service principal.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "external_id",
+                "description": "ExternalId of the service principal in the customer's IdP.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "service_principal_id",
+                "description": "Internal service principal ID of the service principal in Databricks.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "service_principal_id",
+                "description": "Required. Internal ID of the service principal in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Optional. The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "display_name",
+                "description": "Display name of the service principal.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "account_sp_status",
+                "description": "The activity status of a service principal in a Databricks account.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "State",
+                  "enum": [
+                    {
+                      "content": "ACTIVE"
+                    },
+                    {
+                      "content": "INACTIVE"
+                    }
+                  ]
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateUserProxy",
+            "description": "Updates an existing user in the Databricks account that parents the calling workspace and\nreturns the updated user. Only the fields named in the update mask are modified. The updatable\nfields are fullName.givenName, fullName.familyName, status, and externalId.\n\nWhen AIM is enabled and the user is an external identity (its external_id is set), only\nexternal_id can be updated; its other fields are sourced from your identity provider.",
+            "summary": "Update a user in the account.",
+            "path": "/api/2.0/identity/users/{user_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "UpdateUserProxyRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "user_id",
+                  "description": "Required. Internal ID of the user in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "user",
+                  "description": "Required. User to be updated in Databricks",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "User",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Optional. The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "user_id",
+                  "description": "Required. Internal ID of the user in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Optional. The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "user",
+                  "description": "Required. User to be updated in Databricks",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "User",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "user",
+              "description": "Required. User to be updated in Databricks",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "User",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "username",
+                    "description": "Username/email of the user.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "full_name",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "UserFullName",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "account_user_status",
+                    "description": "The activity status of a user in a Databricks account.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "State",
+                      "enum": [
+                        {
+                          "content": "ACTIVE"
+                        },
+                        {
+                          "content": "INACTIVE"
+                        }
+                      ]
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "username",
+                    "description": "Username/email of the user.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_string": true
+                    }
+                  },
+                  {
+                    "name": "full_name",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "UserFullName",
+                      "is_object": true
+                    }
+                  },
+                  {
+                    "name": "account_user_status",
+                    "description": "The activity status of a user in a Databricks account.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "pascal_name": "State",
+                      "enum": [
+                        {
+                          "content": "ACTIVE"
+                        },
+                        {
+                          "content": "INACTIVE"
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "User",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "username",
+                  "description": "Username/email of the user.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "full_name",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "UserFullName",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "account_user_status",
+                  "description": "The activity status of a user in a Databricks account.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "State",
+                    "enum": [
+                      {
+                        "content": "ACTIVE"
+                      },
+                      {
+                        "content": "INACTIVE"
+                      }
+                    ]
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "username",
+                  "description": "Username/email of the user.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "full_name",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "UserFullName",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "account_user_status",
+                  "description": "The activity status of a user in a Databricks account.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "State",
+                    "enum": [
+                      {
+                        "content": "ACTIVE"
+                      },
+                      {
+                        "content": "INACTIVE"
+                      }
+                    ]
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "update_mask",
+                "description": "Optional. The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "user",
+                "description": "Required. User to be updated in Databricks",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "User",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "username",
+                      "description": "Username/email of the user.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "full_name",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "UserFullName",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "account_user_status",
+                      "description": "The activity status of a user in a Databricks account.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "State",
+                        "enum": [
+                          {
+                            "content": "ACTIVE"
+                          },
+                          {
+                            "content": "INACTIVE"
+                          }
+                        ]
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "username",
+                      "description": "Username/email of the user.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_string": true
+                      }
+                    },
+                    {
+                      "name": "full_name",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "UserFullName",
+                        "is_object": true
+                      }
+                    },
+                    {
+                      "name": "account_user_status",
+                      "description": "The activity status of a user in a Databricks account.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "pascal_name": "State",
+                        "enum": [
+                          {
+                            "content": "ACTIVE"
+                          },
+                          {
+                            "content": "INACTIVE"
+                          }
+                        ]
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "user_id",
+                "description": "Required. Internal ID of the user in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "account_id",
+                "description": "The accountId parent of the user in Databricks.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "account_user_status",
+                "description": "The activity status of a user in a Databricks account.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "State",
+                  "enum": [
+                    {
+                      "content": "ACTIVE"
+                    },
+                    {
+                      "content": "INACTIVE"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "external_id",
+                "description": "ExternalId of the user in the customer's IdP.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "full_name",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "UserFullName",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "user_id",
+                "description": "Internal userId of the user in Databricks.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "username",
+                "description": "Username/email of the user.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "user_id",
+                "description": "Required. Internal ID of the user in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Optional. The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "username",
+                "description": "Username/email of the user.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "full_name",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "UserFullName",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "account_user_status",
+                "description": "The activity status of a user in a Databricks account.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "State",
+                  "enum": [
+                    {
+                      "content": "ACTIVE"
+                    },
+                    {
+                      "content": "INACTIVE"
+                    }
+                  ]
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateWorkspaceAssignmentDetailProxy",
+            "description": "Updates the entitlements of a directly assigned principal in the calling workspace. Changes are\napplied one at a time rather than atomically. If the request fails partway through, only some of\nthe requested changes take effect. Get the assignment detail afterwards to confirm the final\nstate.",
+            "summary": "Update a workspace assignment detail for a workspace.",
+            "path": "/api/2.0/identity/workspace-assignment-details/{principal_id}",
+            "can_use_json": true,
+            "is_hidden_cli": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PRIVATE_PREVIEW",
+            "cli_launch_stage_display": "Private Preview",
+            "request": {
+              "pascal_name": "UpdateWorkspaceAssignmentDetailProxyRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "Required. ID of the principal in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "workspace_assignment_detail",
+                  "description": "Required. Workspace assignment detail to be updated in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "WorkspaceAssignmentDetail",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Required. The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "Required. ID of the principal in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Required. The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "workspace_assignment_detail",
+                  "description": "Required. Workspace assignment detail to be updated in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "WorkspaceAssignmentDetail",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "workspace_assignment_detail",
+              "description": "Required. Workspace assignment detail to be updated in Databricks.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "WorkspaceAssignmentDetail",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "principal_id",
+                    "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_int64": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "principal_id",
+                    "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_int64": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "WorkspaceAssignmentDetail",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "principal_id",
+                "description": "Required. ID of the principal in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Required. The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "workspace_assignment_detail",
+                "description": "Required. Workspace assignment detail to be updated in Databricks.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "WorkspaceAssignmentDetail",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "principal_id",
+                      "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_int64": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "principal_id",
+                      "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_int64": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "account_id",
+                "description": "The account ID parent of the workspace where the principal is assigned",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_entitlements",
+                "description": "Every entitlement the principal holds in this workspace, whether granted directly or through\ngroup membership. Get responses populate this field. List responses leave it empty.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EntitlementList",
+                  "array_value": {
+                    "pascal_name": "Entitlement",
+                    "enum": [
+                      {
+                        "content": "ALLOW_CLUSTER_CREATE"
+                      },
+                      {
+                        "content": "ALLOW_INSTANCE_POOL_CREATE"
+                      },
+                      {
+                        "content": "DATABRICKS_SQL_ACCESS"
+                      },
+                      {
+                        "content": "WORKSPACE_ACCESS"
+                      },
+                      {
+                        "content": "WORKSPACE_ADMIN"
+                      },
+                      {
+                        "content": "WORKSPACE_CONSUME"
+                      }
+                    ]
+                  }
+                }
+              },
+              {
+                "name": "entitlements",
+                "description": "Entitlements granted directly to the principal on this workspace. This is the only\nclient-settable field. Create and update manage exactly this set, including entitlements the\nprincipal also holds through a group.\nList responses leave this field empty. Get a single principal to read its entitlements.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EntitlementList",
+                  "array_value": {
+                    "pascal_name": "Entitlement",
+                    "enum": [
+                      {
+                        "content": "ALLOW_CLUSTER_CREATE"
+                      },
+                      {
+                        "content": "ALLOW_INSTANCE_POOL_CREATE"
+                      },
+                      {
+                        "content": "DATABRICKS_SQL_ACCESS"
+                      },
+                      {
+                        "content": "WORKSPACE_ACCESS"
+                      },
+                      {
+                        "content": "WORKSPACE_ADMIN"
+                      },
+                      {
+                        "content": "WORKSPACE_CONSUME"
+                      }
+                    ]
+                  }
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "principal_type",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PrincipalType",
+                  "enum": [
+                    {
+                      "content": "GROUP"
+                    },
+                    {
+                      "content": "SERVICE_PRINCIPAL"
+                    },
+                    {
+                      "content": "USER"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "workspace_id",
+                "description": "The workspace ID where the principal is assigned.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "principal_id",
+                "description": "Required. ID of the principal in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Required. The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateWorkspaceAssignmentProxy",
+            "description": "Updates the entitlements of a directly assigned principal in the calling workspace. Changes are\napplied one at a time rather than atomically. If the request fails partway through, only some of\nthe requested changes take effect. Get the assignment afterwards to confirm the final\nstate.",
+            "summary": "Update a workspace assignment for a workspace.",
+            "path": "/api/2.0/identity/workspace-assignments/{principal_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "UpdateWorkspaceAssignmentProxyRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "Required. ID of the principal in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "workspace_assignment",
+                  "description": "Required. Workspace assignment to be updated in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "WorkspaceAssignment",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Required. The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "Required. ID of the principal in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Required. The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "workspace_assignment",
+                  "description": "Required. Workspace assignment to be updated in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "WorkspaceAssignment",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "workspace_assignment",
+              "description": "Required. Workspace assignment to be updated in Databricks.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "WorkspaceAssignment",
+                "is_object": true,
+                "has_required_request_body_fields": true,
+                "required_fields": [
+                  {
+                    "name": "principal_id",
+                    "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_int64": true
+                    }
+                  }
+                ],
+                "required_request_body_fields": [
+                  {
+                    "name": "principal_id",
+                    "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                    "required": true,
+                    "is_request_body_field": true,
+                    "entity": {
+                      "is_int64": true
+                    }
+                  }
+                ]
+              }
+            },
+            "response": {
+              "pascal_name": "WorkspaceAssignment",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "all_fields": [
+              {
+                "name": "principal_id",
+                "description": "Required. ID of the principal in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Required. The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "workspace_assignment",
+                "description": "Required. Workspace assignment to be updated in Databricks.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "WorkspaceAssignment",
+                  "is_object": true,
+                  "has_required_request_body_fields": true,
+                  "required_fields": [
+                    {
+                      "name": "principal_id",
+                      "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_int64": true
+                      }
+                    }
+                  ],
+                  "required_request_body_fields": [
+                    {
+                      "name": "principal_id",
+                      "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                      "required": true,
+                      "is_request_body_field": true,
+                      "entity": {
+                        "is_int64": true
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "account_id",
+                "description": "The account ID parent of the workspace where the principal is assigned",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "effective_entitlements",
+                "description": "Every entitlement the principal holds in this workspace, whether granted directly or through\ngroup membership. Get responses populate this field. List responses leave it empty.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EntitlementList",
+                  "array_value": {
+                    "pascal_name": "Entitlement",
+                    "enum": [
+                      {
+                        "content": "ALLOW_CLUSTER_CREATE"
+                      },
+                      {
+                        "content": "ALLOW_INSTANCE_POOL_CREATE"
+                      },
+                      {
+                        "content": "DATABRICKS_SQL_ACCESS"
+                      },
+                      {
+                        "content": "WORKSPACE_ACCESS"
+                      },
+                      {
+                        "content": "WORKSPACE_ADMIN"
+                      },
+                      {
+                        "content": "WORKSPACE_CONSUME"
+                      }
+                    ]
+                  }
+                }
+              },
+              {
+                "name": "entitlements",
+                "description": "Entitlements granted directly to the principal on this workspace. This is the only\nclient-settable field. Create and update manage exactly this set, including entitlements the\nprincipal also holds through a group.\nList responses leave this field empty. Get a single principal to read its entitlements.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "EntitlementList",
+                  "array_value": {
+                    "pascal_name": "Entitlement",
+                    "enum": [
+                      {
+                        "content": "ALLOW_CLUSTER_CREATE"
+                      },
+                      {
+                        "content": "ALLOW_INSTANCE_POOL_CREATE"
+                      },
+                      {
+                        "content": "DATABRICKS_SQL_ACCESS"
+                      },
+                      {
+                        "content": "WORKSPACE_ACCESS"
+                      },
+                      {
+                        "content": "WORKSPACE_ADMIN"
+                      },
+                      {
+                        "content": "WORKSPACE_CONSUME"
+                      }
+                    ]
+                  }
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "principal_type",
+                "description": "The type of the principal (user/service principal/group) that is assigned.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PrincipalType",
+                  "enum": [
+                    {
+                      "content": "GROUP"
+                    },
+                    {
+                      "content": "SERVICE_PRINCIPAL"
+                    },
+                    {
+                      "content": "USER"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "workspace_id",
+                "description": "The workspace ID where the principal is assigned.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "principal_id",
+                "description": "Required. ID of the principal in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Required. The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateWorkspaceIdentityDetail",
+            "description": "Updates a workspace identity detail for a principal.",
+            "summary": "Update workspace identity details for a principal.",
+            "path": "/api/2.0/identity/workspace-identity-details/{principal_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "PUBLIC_BETA",
+            "cli_launch_stage_label": "*Beta*",
+            "cli_launch_stage_banner": "This command is in Beta and may change without notice.",
+            "cli_launch_stage_display": "Beta",
+            "request": {
+              "pascal_name": "UpdateWorkspaceIdentityDetailRequest",
+              "is_object": true,
+              "has_field_mask": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "Required. ID of the principal in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "workspace_identity_detail",
+                  "description": "Required. Workspace identity detail to be updated in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "WorkspaceIdentityDetail",
+                    "is_object": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Required. The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "principal_id",
+                  "description": "Required. ID of the principal in Databricks.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "update_mask",
+                  "description": "Required. The list of fields to update.",
+                  "required": true,
+                  "is_query": true,
+                  "entity": {
+                    "is_field_mask": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "workspace_identity_detail",
+                  "description": "Required. Workspace identity detail to be updated in Databricks.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "WorkspaceIdentityDetail",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "workspace_identity_detail",
+              "description": "Required. Workspace identity detail to be updated in Databricks.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "WorkspaceIdentityDetail",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "WorkspaceIdentityDetail",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "principal_id",
+                "description": "Required. ID of the principal in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Required. The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              },
+              {
+                "name": "workspace_identity_detail",
+                "description": "Required. Workspace identity detail to be updated in Databricks.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "WorkspaceIdentityDetail",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "assignment_type",
+                "description": "The type of assignment the principal has to the workspace (direct or indirect).",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "WorkspaceIdentityDetailAssignmentType",
+                  "enum": [
+                    {
+                      "content": "DIRECT"
+                    },
+                    {
+                      "content": "INDIRECT"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "principal_id",
+                "description": "The internal ID of the principal (user/sp/group) in Databricks.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "principal_type",
+                "description": "The type of the principal (user/service principal/group).",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PrincipalType",
+                  "enum": [
+                    {
+                      "content": "GROUP"
+                    },
+                    {
+                      "content": "SERVICE_PRINCIPAL"
+                    },
+                    {
+                      "content": "USER"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "workspace_identity_status",
+                "description": "The activity status of an identity in a Databricks workspace.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "State",
+                  "enum": [
+                    {
+                      "content": "ACTIVE"
+                    },
+                    {
+                      "content": "INACTIVE"
+                    }
+                  ]
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "principal_id",
+                "description": "Required. ID of the principal in Databricks.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "Required. The list of fields to update.",
+                "required": true,
+                "is_query": true,
+                "entity": {
+                  "is_field_mask": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "settings.WorkspaceNetworkConfiguration",
+        "name": "WorkspaceNetworkConfiguration",
+        "description": "These APIs allow configuration of network settings for Databricks workspaces by selecting which network policy to associate with the workspace. Each workspace is always associated with exactly one network policy that controls which network destinations can be accessed from the Databricks environment. By default, workspaces are associated with the 'default-policy' network policy. You cannot create or delete a workspace's network option, only update it to associate the workspace with a different policy",
+        "package": {
+          "name": "settings"
+        },
+        "is_accounts": true,
+        "docs_group": "settings",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "methods": [
+          {
+            "name": "GetWorkspaceNetworkOptionRpc",
+            "description": "Gets the network option for a workspace. Every workspace has exactly one network policy binding,\nwith 'default-policy' used if no explicit assignment exists.",
+            "summary": "Get workspace network option.",
+            "path": "/api/2.0/accounts/{account_id}/workspaces/{workspace_id}/network",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetWorkspaceNetworkOptionRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "The workspace ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "The workspace ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "WorkspaceNetworkOption",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "workspace_id",
+                "description": "The workspace ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "workspace_id",
+                "description": "The workspace ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "UpdateWorkspaceNetworkOptionRpc",
+            "description": "Updates the network option for a workspace. This operation associates the workspace with the specified network policy.\nTo revert to the default policy, specify 'default-policy' as the network_policy_id.",
+            "summary": "Update workspace network option.",
+            "path": "/api/2.0/accounts/{account_id}/workspaces/{workspace_id}/network",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateWorkspaceNetworkOptionRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "The workspace ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "workspace_network_option",
+                  "description": "The network option details for the workspace.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "WorkspaceNetworkOption",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "The workspace ID.",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "workspace_network_option",
+                  "description": "The network option details for the workspace.",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "WorkspaceNetworkOption",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "workspace_network_option",
+              "description": "The network option details for the workspace.",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "WorkspaceNetworkOption",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "WorkspaceNetworkOption",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "workspace_id",
+                "description": "The workspace ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "workspace_network_option",
+                "description": "The network option details for the workspace.",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "WorkspaceNetworkOption",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "network_policy_id",
+                "description": "The network policy ID to apply to the workspace. This controls the network access rules\nfor all serverless compute resources in the workspace. Each workspace can only be\nlinked to one policy at a time. If no policy is explicitly assigned,\nthe workspace will use 'default-policy'.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "workspace_id",
+                "description": "The workspace ID.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "workspace_id",
+                "description": "The workspace ID.",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "settingsv2.WorkspaceSettingsV2",
+        "name": "WorkspaceSettingsV2",
+        "description": "APIs to manage workspace level settings",
+        "package": {
+          "name": "settingsv2"
+        },
+        "docs_group": "settings",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "list": {
+          "request": {
+            "pascal_name": "ListWorkspaceSettingsMetadataRequest"
+          }
+        },
+        "methods": [
+          {
+            "name": "GetPublicWorkspaceSetting",
+            "description": "Get a setting value at workspace level. See :method:settingsv2/listworkspacesettingsmetadata for list of setting available via public APIs.",
+            "summary": "Get a workspace setting.",
+            "path": "/api/2.1/settings/{name}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetPublicWorkspaceSettingRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the setting",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the setting",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Setting",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Name of the setting",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the setting",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "ListWorkspaceSettingsMetadata",
+            "description": "List valid setting keys and metadata. These settings are available to be referenced via\nGET :method:settingsv2/getpublicworkspacesetting and\nPATCH :method:settingsv2/patchpublicworkspacesetting APIs",
+            "summary": "List valid setting keys and their metadata.",
+            "path": "/api/2.1/settings-metadata",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListWorkspaceSettingsMetadataRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "ListWorkspaceSettingsMetadataResponse",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "page_size",
+                "description": "The maximum number of settings to return. The service may return fewer than this value.\nIf unspecified, at most 200 settings will be returned.\nThe maximum value is 1000; values above 1000 will be coerced to 1000.",
+                "is_query": true,
+                "entity": {
+                  "is_int": true
+                }
+              },
+              {
+                "name": "page_token",
+                "description": "A page token, received from a previous `ListWorkspaceSettingsMetadataRequest` call.\nProvide this to retrieve the subsequent page.\n\nWhen paginating, all other parameters provided to `ListWorkspaceSettingsMetadataRequest` must match\nthe call that provided the page token.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "pagination": {
+              "token": {
+                "poll_field": {
+                  "name": "page_token",
+                  "description": "A page token, received from a previous `ListWorkspaceSettingsMetadataRequest` call.\nProvide this to retrieve the subsequent page.\n\nWhen paginating, all other parameters provided to `ListWorkspaceSettingsMetadataRequest` must match\nthe call that provided the page token.",
+                  "is_query": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              }
+            }
+          },
+          {
+            "name": "PatchPublicWorkspaceSetting",
+            "description": "Patch a setting value at workspace level. See :method:settingsv2/listworkspacesettingsmetadata for list of setting available via public APIs at workspace level.\nTo determine the correct field to include in a patch request, refer to the type field of the setting returned in the :method:settingsv2/listworkspacesettingsmetadata response.\n\nNote: Page refresh is required for changes to take effect in UI.",
+            "summary": "Update a workspace setting.",
+            "path": "/api/2.1/settings/{name}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "PatchPublicWorkspaceSettingRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the setting",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                },
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Setting",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "name",
+                  "description": "Name of the setting",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_string": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "setting",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Setting",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "setting",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Setting",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "Setting",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "name",
+                "description": "Name of the setting",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "setting",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Setting",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "aibi_dashboard_embedding_access_policy",
+                "description": "Setting value for aibi_dashboard_embedding_access_policy setting. This is the setting value set by consumers, check effective_aibi_dashboard_embedding_access_policy for final setting value.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AibiDashboardEmbeddingAccessPolicy",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "aibi_dashboard_embedding_approved_domains",
+                "description": "Setting value for aibi_dashboard_embedding_approved_domains setting. This is the setting value set by consumers, check effective_aibi_dashboard_embedding_approved_domains for final setting value.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AibiDashboardEmbeddingApprovedDomains",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "allowed_apps_user_api_scopes",
+                "description": "Setting value for allowed_apps_user_api_scopes setting. This is the setting value set by consumers, check effective_allowed_apps_user_api_scopes for final setting value.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AllowedAppsUserApiScopesMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "automatic_cluster_update_workspace",
+                "description": "Setting value for automatic_cluster_update_workspace setting. This is the setting value set by consumers, check effective_automatic_cluster_update_workspace for final setting value.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "ClusterAutoRestartMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "boolean_val",
+                "description": "Setting value for boolean type setting. This is the setting value set by consumers, check effective_boolean_val for final setting value.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "BooleanMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "collaboration_platform_connectivity",
+                "description": "Setting value for collaboration_platform_connectivity setting. This is the setting value set by consumers, check effective_collaboration_platform_connectivity for final setting value.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CollaborationPlatformConnectivityMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "effective_aibi_dashboard_embedding_access_policy",
+                "description": "Effective setting value for aibi_dashboard_embedding_access_policy setting. This is the final effective value of setting. To set a value use aibi_dashboard_embedding_access_policy.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AibiDashboardEmbeddingAccessPolicy",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "effective_aibi_dashboard_embedding_approved_domains",
+                "description": "Effective setting value for aibi_dashboard_embedding_approved_domains setting. This is the final effective value of setting. To set a value use aibi_dashboard_embedding_approved_domains.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AibiDashboardEmbeddingApprovedDomains",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "effective_allowed_apps_user_api_scopes",
+                "description": "Effective setting value for allowed_apps_user_api_scopes setting. This is the final effective value of setting. To set a value use allowed_apps_user_api_scopes.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AllowedAppsUserApiScopesMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "effective_automatic_cluster_update_workspace",
+                "description": "Effective setting value for automatic_cluster_update_workspace setting. This is the final effective value of setting. To set a value use automatic_cluster_update_workspace.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "ClusterAutoRestartMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "effective_boolean_val",
+                "description": "Effective setting value for boolean type setting. This is the final effective value of setting. To set a value use boolean_val.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "BooleanMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "effective_collaboration_platform_connectivity",
+                "description": "Effective setting value for collaboration_platform_connectivity setting. This is the final effective value of setting. To set a value use collaboration_platform_connectivity.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CollaborationPlatformConnectivityMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "effective_integer_val",
+                "description": "Effective setting value for integer type setting. This is the final effective value of setting. To set a value use integer_val.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "IntegerMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "effective_operational_email_custom_recipient",
+                "description": "Effective setting value for operational_email_custom_recipient setting. This is the final effective value of setting. To set a value use operational_email_custom_recipient.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "OperationalEmailCustomRecipientMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "effective_personal_compute",
+                "description": "Effective setting value for personal_compute setting. This is the final effective value of setting. To set a value use personal_compute.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "PersonalComputeMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "effective_restrict_workspace_admins",
+                "description": "Effective setting value for restrict_workspace_admins setting. This is the final effective value of setting. To set a value use restrict_workspace_admins.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "RestrictWorkspaceAdminsMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "effective_string_val",
+                "description": "Effective setting value for string type setting. This is the final effective value of setting. To set a value use string_val.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "StringMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "effective_workspace_label",
+                "description": "Effective setting value for workspace_label setting. This is the final effective value of setting. To set a value use workspace_label.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "WorkspaceLabelMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "integer_val",
+                "description": "Setting value for integer type setting. This is the setting value set by consumers, check effective_integer_val for final setting value.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "IntegerMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "name",
+                "description": "Name of the setting.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "operational_email_custom_recipient",
+                "description": "Setting value for operational_email_custom_recipient setting. This is the setting value set by consumers, check effective_operational_email_custom_recipient for final setting value.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "OperationalEmailCustomRecipientMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "personal_compute",
+                "description": "Setting value for personal_compute setting. This is the setting value set by consumers, check effective_personal_compute for final setting value.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "PersonalComputeMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "restrict_workspace_admins",
+                "description": "Setting value for restrict_workspace_admins setting. This is the setting value set by consumers, check effective_restrict_workspace_admins for final setting value.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "RestrictWorkspaceAdminsMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "string_val",
+                "description": "Setting value for string type setting. This is the setting value set by consumers, check effective_string_val for final setting value.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "StringMessage",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "workspace_label",
+                "description": "Setting value for workspace_label setting. This is the setting value set by consumers, check effective_workspace_label for final setting value.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "WorkspaceLabelMessage",
+                  "is_object": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "name",
+                "description": "Name of the setting",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ]
+          }
+        ]
+      },
+      {
+        "id": "provisioning.Workspaces",
+        "name": "Workspaces",
+        "description": "These APIs manage workspaces for this account. A Databricks workspace is an environment for\naccessing all of your Databricks assets. The workspace organizes objects (notebooks,\nlibraries, and experiments) into folders, and provides access to data and computational\nresources such as clusters and jobs.\n\nThese endpoints are available if your account is on the E2 version of the platform or on\na select custom plan that allows multiple workspaces per account.",
+        "package": {
+          "name": "provisioning"
+        },
+        "is_accounts": true,
+        "docs_group": "provisioning",
+        "launch_stage": "GA",
+        "cli_launch_stage_display": "GA",
+        "methods": [
+          {
+            "name": "Create",
+            "description": "Creates a new workspace using a credential configuration and a storage configuration, an optional network configuration (if using a customer-managed VPC), an optional managed services key configuration (if using customer-managed keys for managed services), and an optional storage key configuration (if using customer-managed keys for storage). The key configurations used for managed services and storage encryption can be the same or different.\n\nImportant: This operation is asynchronous. A response with HTTP status code 200 means the request has been accepted and is in progress, but does not mean that the workspace deployed successfully and is running. The initial workspace status is typically PROVISIONING. Use the workspace ID (workspace_id) field in the response to identify the new workspace and make repeated GET requests with the workspace ID and check its status. The workspace becomes available when the status changes to RUNNING.\n\nYou can share one customer-managed VPC with multiple workspaces in a single account. It is not required to create a new VPC for each workspace. However, you cannot reuse subnets or Security Groups between workspaces. If you plan to share one VPC with multiple workspaces, make sure you size your VPC and subnets accordingly. Because a Databricks Account API network configuration encapsulates this information, you cannot reuse a Databricks Account API network configuration across workspaces.\n\nFor information about how to create a new workspace with this API including error handling, see [Create a new workspace using the Account API](http://docs.databricks.com/administration-guide/account-api/new-workspace.html).\n\nImportant: Customer-managed VPCs, PrivateLink, and customer-managed keys are supported on a limited set of deployment and subscription types. If you have questions about availability, contact your Databricks representative.\n\nThis operation is available only if your account is on the E2 version of the platform or on a select custom plan that allows multiple workspaces per account.",
+            "summary": "Create a workspace.",
+            "path": "/api/2.0/accounts/{account_id}/workspaces",
+            "can_use_json": true,
+            "is_crud_create": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "CreateWorkspaceRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "Workspace",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "aws_region",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "cloud",
+                "description": "DEPRECATED: This field is being ignored by the server and will be removed in the future.\nThe cloud name. This field always has the value `gcp`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "cloud_resource_container",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CloudResourceContainer",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "compute_mode",
+                "description": "If the compute mode is `SERVERLESS`, a serverless workspace is created that comes pre-configured with serverless compute and default storage, providing a fully-managed, enterprise-ready SaaS experience. This means you don't need to provide any resources managed by you, such as credentials, storage, or network.\nIf the compute mode is `HYBRID` (which is the default option), a classic workspace is created that uses customer-managed resources.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CustomerFacingComputeMode",
+                  "enum": [
+                    {
+                      "content": "HYBRID"
+                    },
+                    {
+                      "content": "SERVERLESS"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "credentials_id",
+                "description": "ID of the workspace's credential configuration object.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "custom_tags",
+                "description": "The custom tags key-value pairing that is attached to this workspace. The key-value pair is a string of utf-8 characters. The\nvalue can be an empty string, with maximum length of 255 characters. The key can be of maximum length of 127 characters, and cannot be empty.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "deployment_name",
+                "description": "The deployment name defines part of the subdomain for the workspace. The workspace URL for the web application and REST APIs is \u003cworkspace-deployment-name\u003e.cloud.databricks.com. For example, if the deployment name is abcsales, your workspace URL will be https://abcsales.cloud.databricks.com. Hyphens are allowed. This property supports only the set of characters that are allowed in a subdomain.\nTo set this value, you must have a deployment name prefix. Contact your Databricks account team to add an account deployment name prefix to your account.\nWorkspace deployment names follow the account prefix and a hyphen. For example, if your account's deployment prefix is acme and the workspace deployment name is workspace-1, the JSON response for the deployment_name field becomes acme-workspace-1. The workspace URL would be acme-workspace-1.cloud.databricks.com.\nYou can also set the deployment_name to the reserved keyword EMPTY if you want the deployment name to only include the deployment prefix. For example, if your account's deployment prefix is acme and the workspace deployment name is EMPTY, the deployment_name becomes acme only and the workspace URL is acme.cloud.databricks.com.\nThis value must be unique across all non-deleted deployments across all AWS regions.\nIf a new workspace omits this property, the server generates a unique deployment name for you with the pattern dbc-xxxxxxxx-xxxx.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "gcp_managed_network_config",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "GcpManagedNetworkConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "gke_config",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "GkeConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "location",
+                "description": "The Google Cloud region of the workspace data plane in your Google account (for example, `us-east4`).",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "managed_services_customer_managed_key_id",
+                "description": "The ID of the workspace's managed services encryption key configuration object. This is used to help protect and control access to the workspace's notebooks, secrets, Databricks SQL queries, and query history. The provided key configuration object property use_cases must contain MANAGED_SERVICES.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "network_connectivity_config_id",
+                "description": "The object ID of network connectivity config. Once assigned, the workspace serverless compute resources use the same set of stable IP CIDR blocks and optional private link to access your resources.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "network_id",
+                "description": "The ID of the workspace's network configuration object. To use AWS PrivateLink, this field is required.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "pricing_tier",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PricingTier",
+                  "enum": [
+                    {
+                      "content": "COMMUNITY_EDITION"
+                    },
+                    {
+                      "content": "DEDICATED"
+                    },
+                    {
+                      "content": "ENTERPRISE"
+                    },
+                    {
+                      "content": "PREMIUM"
+                    },
+                    {
+                      "content": "STANDARD"
+                    },
+                    {
+                      "content": "UNKNOWN"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "private_access_settings_id",
+                "description": "ID of the workspace's private access settings object. Only used for PrivateLink. You must specify this ID if you are using [AWS PrivateLink](https://aws.amazon.com/privatelink/) for either front-end (user-to-workspace connection), back-end (data plane to control plane connection), or both connection types.\nBefore configuring PrivateLink, read the [Databricks article about PrivateLink](https://docs.databricks.com/administration-guide/cloud-configurations/aws/privatelink.html).\",",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "storage_configuration_id",
+                "description": "ID of the workspace's storage configuration object.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "storage_customer_managed_key_id",
+                "description": "The ID of the workspace's storage encryption key configuration object. This is used to encrypt the workspace's root S3 bucket (root DBFS and system data) and, optionally, cluster EBS volumes. The provided key configuration object property use_cases must contain STORAGE.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "workspace_name",
+                "description": "The human-readable name of the workspace.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "wait": {
+              "success": [
+                {
+                  "content": "RUNNING"
+                }
+              ],
+              "timeout": 20,
+              "poll": {
+                "response": {
+                  "pascal_name": "Workspace"
+                }
+              },
+              "status_path": [
+                {
+                  "pascal_name": "WorkspaceStatus"
+                }
+              ],
+              "message_path": [
+                {
+                  "pascal_name": "WorkspaceStatusMessage"
+                }
+              ],
+              "message_path_head": {
+                "pascal_name": "WorkspaceStatusMessage"
+              }
+            }
+          },
+          {
+            "name": "Delete",
+            "description": "Deletes a Databricks workspace, both specified by ID.",
+            "summary": "Delete a workspace.",
+            "path": "/api/2.0/accounts/{account_id}/workspaces/{workspace_id}",
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "DeleteWorkspaceRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "workspace_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "workspace_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Workspace",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "workspace_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "workspace_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "Get",
+            "description": "Gets information including status for a Databricks workspace, specified by ID. In the response, the `workspace_status` field indicates the current status. After initial workspace creation (which is asynchronous), make repeated `GET` requests with the workspace ID and check its status. The workspace becomes available when the status changes to `RUNNING`.\nFor information about how to create a new workspace with this API **including error handling**, see [Create a new workspace using the Account API](http://docs.databricks.com/administration-guide/account-api/new-workspace.html).",
+            "summary": "Get a workspace.",
+            "path": "/api/2.0/accounts/{account_id}/workspaces/{workspace_id}",
+            "is_crud_read": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "GetWorkspaceRequest",
+              "is_object": true,
+              "required_fields": [
+                {
+                  "name": "workspace_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "workspace_id",
+                  "required": true,
+                  "is_path": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ]
+            },
+            "response": {
+              "pascal_name": "Workspace",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "workspace_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "workspace_id",
+                "required": true,
+                "is_path": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ]
+          },
+          {
+            "name": "List",
+            "description": "Lists Databricks workspaces for an account.",
+            "summary": "List workspaces.",
+            "path": "/api/2.0/accounts/{account_id}/workspaces",
+            "is_legacy_empty_request": true,
+            "is_crud_read": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "ListWorkspacesRequest",
+              "is_object": true
+            },
+            "response": {
+              "pascal_name": "WorkspaceList",
+              "array_value": {
+                "pascal_name": "Workspace",
+                "is_object": true
+              }
+            }
+          },
+          {
+            "name": "Update",
+            "description": "Updates a workspace.",
+            "summary": "Update a workspace.",
+            "path": "/api/2.0/accounts/{account_id}/workspaces/{workspace_id}",
+            "can_use_json": true,
+            "has_required_positional_arguments": true,
+            "launch_stage": "GA",
+            "cli_launch_stage_display": "GA",
+            "request": {
+              "pascal_name": "UpdateWorkspaceRequest",
+              "is_object": true,
+              "has_required_request_body_fields": true,
+              "required_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "A unique integer ID for the workspace",
+                  "required": true,
+                  "is_path": true,
+                  "is_output_only": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                },
+                {
+                  "name": "customer_facing_workspace",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Workspace",
+                    "is_object": true
+                  }
+                }
+              ],
+              "required_in_url_fields": [
+                {
+                  "name": "workspace_id",
+                  "description": "A unique integer ID for the workspace",
+                  "required": true,
+                  "is_path": true,
+                  "is_output_only": true,
+                  "entity": {
+                    "is_int64": true
+                  }
+                }
+              ],
+              "required_request_body_fields": [
+                {
+                  "name": "customer_facing_workspace",
+                  "required": true,
+                  "is_request_body_field": true,
+                  "entity": {
+                    "pascal_name": "Workspace",
+                    "is_object": true
+                  }
+                }
+              ]
+            },
+            "request_body_field": {
+              "name": "customer_facing_workspace",
+              "required": true,
+              "is_request_body_field": true,
+              "entity": {
+                "pascal_name": "Workspace",
+                "is_object": true
+              }
+            },
+            "response": {
+              "pascal_name": "Workspace",
+              "is_object": true
+            },
+            "all_fields": [
+              {
+                "name": "customer_facing_workspace",
+                "required": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "Workspace",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "update_mask",
+                "description": "The field mask must be a single string, with multiple fields separated by commas (no spaces). The field path is relative to the resource object, using a dot (`.`) to navigate sub-fields (e.g., `author.given_name`). Specification of elements in sequence or map fields is not allowed, as only the entire collection field can be specified. Field names must exactly match the resource field names.\n\nA field mask of `*` indicates full replacement. It’s recommended to always explicitly list the fields being updated and avoid using `*` wildcards, as it can lead to unintended results if the API changes in the future.",
+                "is_query": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "workspace_id",
+                "description": "A unique integer ID for the workspace",
+                "required": true,
+                "is_path": true,
+                "is_output_only": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "account_id",
+                "description": "Databricks account ID.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "aws_region",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "azure_workspace_info",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "AzureWorkspaceInfo",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "cloud",
+                "description": "The cloud name. This field can have values like `azure`, `gcp`.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "cloud_resource_container",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "CloudResourceContainer",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "compute_mode",
+                "description": "The compute mode of the workspace.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CustomerFacingComputeMode",
+                  "enum": [
+                    {
+                      "content": "HYBRID"
+                    },
+                    {
+                      "content": "SERVERLESS"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "creation_time",
+                "description": "Time in epoch milliseconds when the workspace was created.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "credentials_id",
+                "description": "ID of the workspace's credential configuration object.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "custom_tags",
+                "description": "The custom tags key-value pairing that is attached to this workspace. The key-value pair is a string of utf-8 characters. The value can be an empty string,\nwith maximum length of 255 characters. The key can be of maximum length of 127 characters, and cannot be empty.",
+                "is_request_body_field": true,
+                "entity": {
+                  "map_value": {
+                    "is_string": true
+                  }
+                }
+              },
+              {
+                "name": "deployment_name",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "expected_workspace_status",
+                "description": "A client owned field used to indicate the workspace status that the client expects to be in.\nFor now this is only used to unblock Temporal workflow for GCP least privileged workspace.",
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "WorkspaceStatus",
+                  "enum": [
+                    {
+                      "content": "BANNED"
+                    },
+                    {
+                      "content": "CANCELLING"
+                    },
+                    {
+                      "content": "FAILED"
+                    },
+                    {
+                      "content": "NOT_PROVISIONED"
+                    },
+                    {
+                      "content": "PROVISIONING"
+                    },
+                    {
+                      "content": "RUNNING"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "gcp_managed_network_config",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "GcpManagedNetworkConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "gke_config",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "GkeConfig",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "location",
+                "description": "The Google Cloud region of the workspace data plane in your Google account (for example, `us-east4`).",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "managed_services_customer_managed_key_id",
+                "description": "ID of the key configuration for encrypting managed services.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "network",
+                "description": "The network configuration for the workspace.\n\nDEPRECATED. Use `network_id` instead.",
+                "is_request_body_field": true,
+                "is_optional_object": true,
+                "entity": {
+                  "pascal_name": "WorkspaceNetwork",
+                  "is_object": true
+                }
+              },
+              {
+                "name": "network_connectivity_config_id",
+                "description": "The object ID of network connectivity config.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "network_id",
+                "description": "If this workspace is BYO VPC, then the network_id will be populated. If this workspace is not\nBYO VPC, then the network_id will be empty.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "pricing_tier",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "PricingTier",
+                  "enum": [
+                    {
+                      "content": "COMMUNITY_EDITION"
+                    },
+                    {
+                      "content": "DEDICATED"
+                    },
+                    {
+                      "content": "ENTERPRISE"
+                    },
+                    {
+                      "content": "PREMIUM"
+                    },
+                    {
+                      "content": "STANDARD"
+                    },
+                    {
+                      "content": "UNKNOWN"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "private_access_settings_id",
+                "description": "ID of the workspace's private access settings object. Only used for PrivateLink. You must specify this ID if you are using [AWS PrivateLink](https://aws.amazon.com/privatelink/) for either front-end (user-to-workspace connection), back-end (data plane to control plane connection), or both connection types.\n\nBefore configuring PrivateLink, read the [Databricks article about PrivateLink](https://docs.databricks.com/administration-guide/cloud-configurations/aws/privatelink.html).\",",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "storage_configuration_id",
+                "description": "ID of the workspace's storage configuration object.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "storage_customer_managed_key_id",
+                "description": "ID of the key configuration for encrypting workspace storage.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "storage_mode",
+                "description": "The storage mode of the workspace.",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "CustomerFacingStorageMode",
+                  "enum": [
+                    {
+                      "content": "CUSTOMER_HOSTED"
+                    },
+                    {
+                      "content": "DEFAULT_STORAGE"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "workspace_id",
+                "description": "A unique integer ID for the workspace",
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_int64": true
+                }
+              },
+              {
+                "name": "workspace_name",
+                "description": "The human-readable name of the workspace.",
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              },
+              {
+                "name": "workspace_status",
+                "description": "The status of a workspace",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "pascal_name": "WorkspaceStatus",
+                  "enum": [
+                    {
+                      "content": "BANNED"
+                    },
+                    {
+                      "content": "CANCELLING"
+                    },
+                    {
+                      "content": "FAILED"
+                    },
+                    {
+                      "content": "NOT_PROVISIONED"
+                    },
+                    {
+                      "content": "PROVISIONING"
+                    },
+                    {
+                      "content": "RUNNING"
+                    }
+                  ]
+                }
+              },
+              {
+                "name": "workspace_status_message",
+                "description": "Message describing the current workspace status.",
+                "is_computed": true,
+                "is_output_only": true,
+                "is_request_body_field": true,
+                "entity": {
+                  "is_string": true
+                }
+              }
+            ],
+            "required_positional_arguments": [
+              {
+                "name": "workspace_id",
+                "description": "A unique integer ID for the workspace",
+                "required": true,
+                "is_path": true,
+                "is_output_only": true,
+                "entity": {
+                  "is_int64": true
+                }
+              }
+            ],
+            "wait": {
+              "success": [
+                {
+                  "content": "RUNNING"
+                }
+              ],
+              "timeout": 20,
+              "poll": {
+                "response": {
+                  "pascal_name": "Workspace"
+                }
+              },
+              "status_path": [
+                {
+                  "pascal_name": "WorkspaceStatus"
+                }
+              ],
+              "message_path": [
+                {
+                  "pascal_name": "WorkspaceStatusMessage"
+                }
+              ],
+              "message_path_head": {
+                "pascal_name": "WorkspaceStatusMessage"
+              }
+            }
+          }
+        ]
+      }
+    ],
+    "workspace_docs_groups": [
+      {
+        "key": "workspace",
+        "display_name": "Databricks Workspace"
+      },
+      {
+        "key": "compute",
+        "display_name": "Compute"
+      },
+      {
+        "key": "sandbox",
+        "display_name": "Sandbox"
+      },
+      {
+        "key": "lakeflow",
+        "display_name": "Lakeflow"
+      },
+      {
+        "key": "files",
+        "display_name": "File Management"
+      },
+      {
+        "key": "ml",
+        "display_name": "Machine Learning"
+      },
+      {
+        "key": "serving",
+        "display_name": "Real-time Serving"
+      },
+      {
+        "key": "apps",
+        "display_name": "Apps"
+      },
+      {
+        "key": "vectorsearch",
+        "display_name": "Vector Search"
+      },
+      {
+        "key": "aisearch",
+        "display_name": "AI Search"
+      },
+      {
+        "key": "iam",
+        "display_name": "Identity and Access Management"
+      },
+      {
+        "key": "sql",
+        "display_name": "Databricks SQL"
+      },
+      {
+        "key": "dashboards",
+        "display_name": "AI/BI"
+      },
+      {
+        "key": "catalog",
+        "display_name": "Unity Catalog"
+      },
+      {
+        "key": "sharing",
+        "display_name": "Open Sharing"
+      },
+      {
+        "key": "settings",
+        "display_name": "Settings"
+      },
+      {
+        "key": "oauth2",
+        "display_name": "OAuth"
+      },
+      {
+        "key": "marketplace",
+        "display_name": "Marketplace"
+      },
+      {
+        "key": "cleanrooms",
+        "display_name": "Clean Rooms"
+      },
+      {
+        "key": "qualitymonitor",
+        "display_name": "Quality Monitor"
+      },
+      {
+        "key": "dataclassification",
+        "display_name": "Data Classification"
+      },
+      {
+        "key": "dataquality",
+        "display_name": "Data Quality Monitoring"
+      },
+      {
+        "key": "database",
+        "display_name": "Database Instances"
+      },
+      {
+        "key": "agentbricks",
+        "display_name": "Agent Bricks"
+      },
+      {
+        "key": "aifunctions",
+        "display_name": "AI Functions"
+      },
+      {
+        "key": "tags",
+        "display_name": "Tags"
+      },
+      {
+        "key": "postgres",
+        "display_name": "Postgres"
+      },
+      {
+        "key": "environments",
+        "display_name": "Environments"
+      },
+      {
+        "key": "bundledeployments",
+        "display_name": "Bundle Deployments"
+      },
+      {
+        "key": "domains",
+        "display_name": "Domains"
+      }
+    ],
+    "account_docs_groups": [
+      {
+        "key": "iam",
+        "display_name": "Identity and Access Management"
+      },
+      {
+        "key": "catalog",
+        "display_name": "Unity Catalog"
+      },
+      {
+        "key": "settings",
+        "display_name": "Settings"
+      },
+      {
+        "key": "provisioning",
+        "display_name": "Provisioning"
+      },
+      {
+        "key": "billing",
+        "display_name": "Billing"
+      },
+      {
+        "key": "oauth2",
+        "display_name": "OAuth"
+      },
+      {
+        "key": "disasterrecovery",
+        "display_name": "Disaster Recovery"
+      }
+    ]
+  }
+}
diff --git a/.cursor/rules/auto-generated-files.mdc b/.cursor/rules/auto-generated-files.mdc
index 6f28623d01b..2971297fd7c 120000
--- a/.cursor/rules/auto-generated-files.mdc
+++ b/.cursor/rules/auto-generated-files.mdc
@@ -1 +1 @@
-../../.agent/rules/auto-generated-files.md
\ No newline at end of file
+../../.agents/rules/auto-generated-files.md
\ No newline at end of file
diff --git a/.cursor/rules/changelog.mdc b/.cursor/rules/changelog.mdc
new file mode 120000
index 00000000000..82fc9ab3331
--- /dev/null
+++ b/.cursor/rules/changelog.mdc
@@ -0,0 +1 @@
+../../.agents/rules/changelog.md
\ No newline at end of file
diff --git a/.cursor/rules/comments.mdc b/.cursor/rules/comments.mdc
new file mode 120000
index 00000000000..826ee0baceb
--- /dev/null
+++ b/.cursor/rules/comments.mdc
@@ -0,0 +1 @@
+../../.agents/rules/comments.md
\ No newline at end of file
diff --git a/.cursor/rules/databricks-template-schema-json.mdc b/.cursor/rules/databricks-template-schema-json.mdc
index a37f2750593..88fc109a7a8 120000
--- a/.cursor/rules/databricks-template-schema-json.mdc
+++ b/.cursor/rules/databricks-template-schema-json.mdc
@@ -1 +1 @@
-../../.agent/rules/databricks-template-schema-json.md
\ No newline at end of file
+../../.agents/rules/databricks-template-schema-json.md
\ No newline at end of file
diff --git a/.cursor/rules/dresources.mdc b/.cursor/rules/dresources.mdc
new file mode 120000
index 00000000000..e7481ead102
--- /dev/null
+++ b/.cursor/rules/dresources.mdc
@@ -0,0 +1 @@
+../../.agents/rules/dresources.md
\ No newline at end of file
diff --git a/.cursor/rules/pydabs-acceptance-tests.mdc b/.cursor/rules/pydabs-acceptance-tests.mdc
new file mode 120000
index 00000000000..ffe41d4bbea
--- /dev/null
+++ b/.cursor/rules/pydabs-acceptance-tests.mdc
@@ -0,0 +1 @@
+../../.agents/rules/pydabs-acceptance-tests.md
\ No newline at end of file
diff --git a/.cursor/rules/style-guide-go.mdc b/.cursor/rules/style-guide-go.mdc
index 7f6d9d0c954..9976b59f44a 120000
--- a/.cursor/rules/style-guide-go.mdc
+++ b/.cursor/rules/style-guide-go.mdc
@@ -1 +1 @@
-../../.agent/rules/style-guide-go.md
\ No newline at end of file
+../../.agents/rules/style-guide-go.md
\ No newline at end of file
diff --git a/.cursor/rules/style-guide-py.mdc b/.cursor/rules/style-guide-py.mdc
index c61aa329bb9..3e5b4a4ab5a 120000
--- a/.cursor/rules/style-guide-py.mdc
+++ b/.cursor/rules/style-guide-py.mdc
@@ -1 +1 @@
-../../.agent/rules/style-guide-py.md
\ No newline at end of file
+../../.agents/rules/style-guide-py.md
\ No newline at end of file
diff --git a/.cursor/rules/telemetry.mdc b/.cursor/rules/telemetry.mdc
new file mode 120000
index 00000000000..831640bfe9b
--- /dev/null
+++ b/.cursor/rules/telemetry.mdc
@@ -0,0 +1 @@
+../../.agents/rules/telemetry.md
\ No newline at end of file
diff --git a/.cursor/rules/template-versions.mdc b/.cursor/rules/template-versions.mdc
new file mode 120000
index 00000000000..7ad1818ffe4
--- /dev/null
+++ b/.cursor/rules/template-versions.mdc
@@ -0,0 +1 @@
+../../.agents/rules/template-versions.md
\ No newline at end of file
diff --git a/.cursor/rules/testing.mdc b/.cursor/rules/testing.mdc
index 528df968ae8..057b0a403ba 120000
--- a/.cursor/rules/testing.mdc
+++ b/.cursor/rules/testing.mdc
@@ -1 +1 @@
-../../.agent/rules/testing.md
\ No newline at end of file
+../../.agents/rules/testing.md
\ No newline at end of file
diff --git a/.cursor/skills b/.cursor/skills
deleted file mode 120000
index 9b058317d13..00000000000
--- a/.cursor/skills
+++ /dev/null
@@ -1 +0,0 @@
-../.agent/skills
\ No newline at end of file
diff --git a/.gitattributes b/.gitattributes
index ffe19eb43c4..19fa804e1c0 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -8,6 +8,7 @@ cmd/account/credentials/credentials.go linguist-generated=true
 cmd/account/csp-enablement-account/csp-enablement-account.go linguist-generated=true
 cmd/account/custom-app-integration/custom-app-integration.go linguist-generated=true
 cmd/account/disable-legacy-features/disable-legacy-features.go linguist-generated=true
+cmd/account/disaster-recovery/disaster-recovery.go linguist-generated=true
 cmd/account/enable-ip-access-lists/enable-ip-access-lists.go linguist-generated=true
 cmd/account/encryption-keys/encryption-keys.go linguist-generated=true
 cmd/account/endpoints/endpoints.go linguist-generated=true
@@ -28,6 +29,7 @@ cmd/account/networks/networks.go linguist-generated=true
 cmd/account/o-auth-published-apps/o-auth-published-apps.go linguist-generated=true
 cmd/account/personal-compute/personal-compute.go linguist-generated=true
 cmd/account/private-access/private-access.go linguist-generated=true
+cmd/account/private-network-gateways/private-network-gateways.go linguist-generated=true
 cmd/account/published-app-integration/published-app-integration.go linguist-generated=true
 cmd/account/service-principal-federation-policy/service-principal-federation-policy.go linguist-generated=true
 cmd/account/service-principal-secrets/service-principal-secrets.go linguist-generated=true
@@ -44,6 +46,10 @@ cmd/account/workspace-network-configuration/workspace-network-configuration.go l
 cmd/account/workspaces/workspaces.go linguist-generated=true
 cmd/workspace/access-control/access-control.go linguist-generated=true
 cmd/workspace/agent-bricks/agent-bricks.go linguist-generated=true
+cmd/workspace/agent-kit/agent-kit.go linguist-generated=true
+cmd/workspace/ai-functions/ai-functions.go linguist-generated=true
+cmd/workspace/ai-gateway/ai-gateway.go linguist-generated=true
+cmd/workspace/ai-search/ai-search.go linguist-generated=true
 cmd/workspace/aibi-dashboard-embedding-access-policy/aibi-dashboard-embedding-access-policy.go linguist-generated=true
 cmd/workspace/aibi-dashboard-embedding-approved-domains/aibi-dashboard-embedding-approved-domains.go linguist-generated=true
 cmd/workspace/alerts-legacy/alerts-legacy.go linguist-generated=true
@@ -53,6 +59,7 @@ cmd/workspace/apps-settings/apps-settings.go linguist-generated=true
 cmd/workspace/apps/apps.go linguist-generated=true
 cmd/workspace/artifact-allowlists/artifact-allowlists.go linguist-generated=true
 cmd/workspace/automatic-cluster-update/automatic-cluster-update.go linguist-generated=true
+cmd/workspace/bundle-deployments/bundle-deployments.go linguist-generated=true
 cmd/workspace/catalogs/catalogs.go linguist-generated=true
 cmd/workspace/clean-room-asset-revisions/clean-room-asset-revisions.go linguist-generated=true
 cmd/workspace/clean-room-assets/clean-room-assets.go linguist-generated=true
@@ -83,6 +90,7 @@ cmd/workspace/default-namespace/default-namespace.go linguist-generated=true
 cmd/workspace/default-warehouse-id/default-warehouse-id.go linguist-generated=true
 cmd/workspace/disable-legacy-access/disable-legacy-access.go linguist-generated=true
 cmd/workspace/disable-legacy-dbfs/disable-legacy-dbfs.go linguist-generated=true
+cmd/workspace/domains/domains.go linguist-generated=true
 cmd/workspace/enable-export-notebook/enable-export-notebook.go linguist-generated=true
 cmd/workspace/enable-notebook-table-clipboard/enable-notebook-table-clipboard.go linguist-generated=true
 cmd/workspace/enable-results-downloading/enable-results-downloading.go linguist-generated=true
@@ -150,7 +158,9 @@ cmd/workspace/repos/repos.go linguist-generated=true
 cmd/workspace/resource-quotas/resource-quotas.go linguist-generated=true
 cmd/workspace/restrict-workspace-admins/restrict-workspace-admins.go linguist-generated=true
 cmd/workspace/rfa/rfa.go linguist-generated=true
+cmd/workspace/sandbox/sandbox.go linguist-generated=true
 cmd/workspace/schemas/schemas.go linguist-generated=true
+cmd/workspace/secrets-uc/secrets-uc.go linguist-generated=true
 cmd/workspace/secrets/secrets.go linguist-generated=true
 cmd/workspace/service-principal-secrets-proxy/service-principal-secrets-proxy.go linguist-generated=true
 cmd/workspace/service-principals-v2/service-principals-v2.go linguist-generated=true
@@ -159,12 +169,14 @@ cmd/workspace/settings/settings.go linguist-generated=true
 cmd/workspace/shares/shares.go linguist-generated=true
 cmd/workspace/sql-results-download/sql-results-download.go linguist-generated=true
 cmd/workspace/storage-credentials/storage-credentials.go linguist-generated=true
+cmd/workspace/supervisor-agents/supervisor-agents.go linguist-generated=true
 cmd/workspace/system-schemas/system-schemas.go linguist-generated=true
 cmd/workspace/table-constraints/table-constraints.go linguist-generated=true
 cmd/workspace/tables/tables.go linguist-generated=true
 cmd/workspace/tag-policies/tag-policies.go linguist-generated=true
 cmd/workspace/temporary-path-credentials/temporary-path-credentials.go linguist-generated=true
 cmd/workspace/temporary-table-credentials/temporary-table-credentials.go linguist-generated=true
+cmd/workspace/temporary-volume-credentials/temporary-volume-credentials.go linguist-generated=true
 cmd/workspace/token-management/token-management.go linguist-generated=true
 cmd/workspace/tokens/tokens.go linguist-generated=true
 cmd/workspace/users-v2/users-v2.go linguist-generated=true
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 00000000000..4522db78089
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,100 @@
+# Maintainers can approve any PR. Keep them on every rule because GitHub uses
+# only the last matching rule, and any owner on that line can approve.
+*                                       @databricks/eng-deco-cli
+
+# Bundles
+/bundle/                                @databricks/eng-deco-cli @databricks/eng-deco-dabs
+/cmd/bundle/                            @databricks/eng-deco-cli @databricks/eng-deco-dabs
+/acceptance/bundle/                     @databricks/eng-deco-cli @databricks/eng-deco-dabs
+/libs/template/                         @databricks/eng-deco-cli @databricks/eng-deco-dabs
+/python/                                @databricks/eng-deco-cli @databricks/eng-deco-dabs
+
+# Pipelines
+/cmd/pipelines/                         @databricks/eng-deco-cli @jefferycheng1 @kanterov @lennartkats-db
+/acceptance/pipelines/                  @databricks/eng-deco-cli @jefferycheng1 @kanterov @lennartkats-db
+
+# Labs
+/cmd/labs/                              @databricks/eng-deco-cli @alexott @asnare
+
+# Local environments / DB Connect
+/libs/localenv/                         @databricks/eng-deco-cli @databricks/eng-deco-ax
+/cmd/environments/                      @databricks/eng-deco-cli @databricks/eng-deco-ax
+/acceptance/localenv/                   @databricks/eng-deco-cli @databricks/eng-deco-ax
+
+# SSH tunnel
+/experimental/ssh/                      @databricks/eng-deco-cli @databricks/eng-deco-ax
+/acceptance/ssh/                        @databricks/eng-deco-cli @databricks/eng-deco-ax
+
+# Apps
+/cmd/apps/                              @databricks/eng-deco-cli @databricks/eng-apps-devex
+/cmd/workspace/apps/                    @databricks/eng-deco-cli @databricks/eng-apps-devex
+/libs/apps/                             @databricks/eng-deco-cli @databricks/eng-apps-devex
+/acceptance/apps/                       @databricks/eng-deco-cli @databricks/eng-apps-devex
+/.nextchanges/cli/apps-*.md             @databricks/eng-deco-cli @databricks/eng-apps-devex
+
+# Sandbox
+/cmd/sandbox/                           @databricks/eng-deco-cli @databricks/eng-sandbox
+/acceptance/cmd/sandbox/                @databricks/eng-deco-cli @databricks/eng-sandbox
+
+# Auth
+/cmd/auth/                              @databricks/eng-deco-cli @databricks/eng-deco-platform
+/libs/auth/                             @databricks/eng-deco-cli @databricks/eng-deco-platform
+/acceptance/auth/                       @databricks/eng-deco-cli @databricks/eng-deco-platform
+/.nextchanges/cli/auth-*.md             @databricks/eng-deco-cli @databricks/eng-deco-platform
+
+# Artifact Registry / Docker credentials
+/cmd/auth/docker/                       @databricks/eng-deco-cli @databricks/eng-artifact-registry
+/libs/dockercredentials/                @databricks/eng-deco-cli @databricks/eng-artifact-registry
+/acceptance/cmd/auth/docker/            @databricks/eng-deco-cli @databricks/eng-artifact-registry
+/.nextchanges/cli/docker-*.md           @databricks/eng-deco-cli @databricks/eng-artifact-registry
+
+# Filesystem & sync
+/cmd/fs/                                @databricks/eng-deco-cli @databricks/eng-deco-platform
+/cmd/sync/                              @databricks/eng-deco-cli @databricks/eng-deco-platform
+/libs/filer/                            @databricks/eng-deco-cli @databricks/eng-deco-platform
+/libs/sync/                             @databricks/eng-deco-cli @databricks/eng-deco-platform
+
+# Core CLI infrastructure
+/cmd/root/                              @databricks/eng-deco-cli @databricks/eng-deco-platform
+/cmd/version/                           @databricks/eng-deco-cli @databricks/eng-deco-platform
+/cmd/completion/                        @databricks/eng-deco-cli @databricks/eng-deco-platform
+/cmd/configure/                         @databricks/eng-deco-cli @databricks/eng-deco-platform
+/cmd/cache/                             @databricks/eng-deco-cli @databricks/eng-deco-platform
+/cmd/api/                               @databricks/eng-deco-cli @databricks/eng-deco-platform
+/cmd/selftest/                          @databricks/eng-deco-cli @databricks/eng-deco-platform
+/cmd/psql/                              @databricks/eng-deco-cli @databricks/eng-deco-platform
+/libs/psql/                             @databricks/eng-deco-cli @databricks/eng-deco-platform
+
+# Libs (general)
+/libs/databrickscfg/                    @databricks/eng-deco-cli @databricks/eng-deco-platform
+/libs/env/                              @databricks/eng-deco-cli @databricks/eng-deco-platform
+/libs/flags/                            @databricks/eng-deco-cli @databricks/eng-deco-platform
+/libs/cmdio/                            @databricks/eng-deco-cli @databricks/eng-deco-platform
+/libs/log/                              @databricks/eng-deco-cli @databricks/eng-deco-platform
+/libs/telemetry/                        @databricks/eng-deco-cli @databricks/eng-deco-platform
+/libs/process/                          @databricks/eng-deco-cli @databricks/eng-deco-platform
+/libs/git/                              @databricks/eng-deco-cli @databricks/eng-deco-platform
+
+# Integration tests
+/integration/                           @databricks/eng-deco-cli @databricks/eng-deco-platform
+
+/integration/cmd/environments/          @databricks/eng-deco-cli @databricks/eng-deco-ax
+
+# Internal
+/internal/                              @databricks/eng-deco-cli @databricks/eng-deco-platform
+
+# AI tools
+/cmd/aitools/                           @databricks/eng-deco-cli @databricks/eng-apps-devex @databricks/eng-deco-ax @lennartkats-db
+/libs/aitools/                          @databricks/eng-deco-cli @databricks/eng-apps-devex @databricks/eng-deco-ax @lennartkats-db
+
+# AI Runtime
+/cmd/air/                               @databricks/eng-deco-cli @databricks/eng-ai-custom-training
+/acceptance/air/                        @databricks/eng-deco-cli @databricks/eng-ai-custom-training
+/.nextchanges/air/                      @databricks/eng-deco-cli @databricks/eng-ai-custom-training
+
+# CLI compatibility manifest
+/internal/build/cli-compat.json         @databricks/eng-deco-cli @databricks/eng-apps-devex @databricks/eng-deco-platform
+/libs/clicompat/                        @databricks/eng-deco-cli @databricks/eng-apps-devex @databricks/eng-deco-platform
+
+# Experimental
+/experimental/aitools/                  @databricks/eng-deco-cli @databricks/eng-apps-devex @lennartkats-db
diff --git a/.github/OWNERS b/.github/OWNERS
deleted file mode 100644
index 7cae525465a..00000000000
--- a/.github/OWNERS
+++ /dev/null
@@ -1,63 +0,0 @@
-# Maintainers (can approve any PR)
-*                           @andrewnester @anton-107 @denik @pietern @shreyas-goenka @simonfaltum @renaudhartert-db
-
-# Bundles
-/bundle/                    team:bundle @lennartkats-db
-/cmd/bundle/                team:bundle @lennartkats-db
-/acceptance/bundle/         team:bundle @lennartkats-db
-/libs/template/             team:bundle @lennartkats-db
-
-# Pipelines
-/cmd/pipelines/             @jefferycheng1 @kanterov @lennartkats-db
-/acceptance/pipelines/      @jefferycheng1 @kanterov @lennartkats-db
-
-# Labs
-/cmd/labs/                  @alexott @asnare
-/acceptance/labs/           @alexott @asnare
-
-# Apps
-/cmd/apps/                  team:eng-apps-devex
-/cmd/workspace/apps/        team:eng-apps-devex
-/libs/apps/                 team:eng-apps-devex
-/acceptance/apps/           team:eng-apps-devex
-
-# Auth
-/cmd/auth/                  team:platform
-/libs/auth/                 team:platform
-/acceptance/auth/           team:platform
-
-# Filesystem & sync
-/cmd/fs/                    team:platform
-/cmd/sync/                  team:platform
-/libs/filer/                team:platform
-/libs/sync/                 team:platform
-
-# Core CLI infrastructure
-/cmd/root/                  team:platform
-/cmd/version/               team:platform
-/cmd/completion/            team:platform
-/cmd/configure/             team:platform
-/cmd/cache/                 team:platform
-/cmd/api/                   team:platform
-/cmd/selftest/              team:platform
-/cmd/psql/                  team:platform
-/libs/psql/                 team:platform
-
-# Libs (general)
-/libs/databrickscfg/        team:platform
-/libs/env/                  team:platform
-/libs/flags/                team:platform
-/libs/cmdio/                team:platform
-/libs/log/                  team:platform
-/libs/telemetry/            team:platform
-/libs/process/              team:platform
-/libs/git/                  team:platform
-
-# Integration tests
-/integration/               team:platform
-
-# Internal
-/internal/                  team:platform
-
-# Experimental
-/experimental/aitools/      team:eng-apps-devex @lennartkats-db
diff --git a/.github/OWNERTEAMS b/.github/OWNERTEAMS
deleted file mode 100644
index 9bcab6116e9..00000000000
--- a/.github/OWNERTEAMS
+++ /dev/null
@@ -1,16 +0,0 @@
-# Team aliases for OWNERS file.
-# Use "team:<name>" in OWNERS to reference a team defined here.
-# Format: team:<name>  @member1 @member2 ...
-#
-# Keep these in sync with actual GitHub team rosters. GITHUB_TOKEN can't
-# resolve org team membership via the API, so this file is the source of
-# truth for the maintainer-approval workflow.
-#
-# GitHub team pages:
-#   bundle:          https://github.com/orgs/databricks/teams/cli-maintainers
-#   platform:        https://github.com/orgs/databricks/teams/cli-platform
-#   eng-apps-devex:  https://github.com/orgs/databricks/teams/eng-apps-devex
-
-team:bundle     @andrewnester @anton-107 @denik @janniklasrose @pietern @shreyas-goenka
-team:platform   @simonfaltum @renaudhartert-db @hectorcast-db @parthban-db @tanmay-db @Divyansh-db @tejaskochar-db @mihaimitrea-db @chrisst @rauchy
-team:eng-apps-devex @fjakobs @jamesbroadhead @Shridhad @atilafassina @keugenek @arsenyinfo @igrekun @pkosiec @MarioCadenas @pffigueiredo @ditadi @calvarjorge
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index 2b6289b935b..21bad8efd76 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -9,4 +9,5 @@ For example, were there any decisions behind the change that are not reflected i
 <!-- How have you tested the changes? -->
 
 <!-- If your PR needs to be included in the release notes for next release,
-add a separate entry in NEXT_CHANGELOG.md as part of your PR. -->
+add a changelog fragment: create .nextchanges/<section>/<name>.md with a
+one-line description (e.g. .nextchanges/cli/quickstart.md). See .nextchanges/README.md. -->
diff --git a/.github/actions/setup-build-environment/action.yml b/.github/actions/setup-build-environment/action.yml
index 3fd492c70f6..e3e5f737fe7 100644
--- a/.github/actions/setup-build-environment/action.yml
+++ b/.github/actions/setup-build-environment/action.yml
@@ -10,30 +10,68 @@ runs:
   using: 'composite'
   steps:
     - name: Checkout repository and submodules
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Setup JFrog
       uses: ./.github/actions/setup-jfrog
 
-    - name: Create cache identifier
-      run: echo "${{ inputs.cache-key }}" > cache.txt
+    - id: setup-go
+      name: Setup Go
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+      with:
+        go-version-file: go.mod
+        # Disable setup-go's built-in cache; the steps below manage the
+        # cache so that only push-to-main runs save it. PR / merge_group /
+        # schedule saves are scoped to refs no other run can read, and
+        # they evict main's caches from the 10 GB GHA cache quota via LRU.
+        #
+        # See: https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching
+        cache: false
+
+    - name: Resolve Go cache paths
+      id: go-paths
       shell: bash
+      run: |
+        echo "build=$(go env GOCACHE)" >> "$GITHUB_OUTPUT"
+        echo "mod=$(go env GOMODCACHE)" >> "$GITHUB_OUTPUT"
 
-    - name: Setup Go
-      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+    # On runs against main (push + the scheduled wipe-and-repopulate
+    # cron added in #2092): restore now, save at job end via the
+    # unified action's post-step (which fires at the calling job's
+    # end, even when invoked from a composite).
+    - name: Restore and save Go cache (main)
+      if: github.ref == 'refs/heads/main'
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
-        go-version-file: go.mod
-        cache-dependency-path: |
-          go.sum
-          cache.txt
+        path: |
+          ${{ steps.go-paths.outputs.mod }}
+          ${{ steps.go-paths.outputs.build }}
+        key: setup-go-${{ inputs.cache-key }}-${{ runner.os }}-go${{ steps.setup-go.outputs.go-version }}-${{ hashFiles('go.sum') }}
+        restore-keys: |
+          setup-go-${{ inputs.cache-key }}-${{ runner.os }}-go${{ steps.setup-go.outputs.go-version }}-
+
+    # On every other ref (PR / merge_group): restore only. Prefix
+    # fallback via restore-keys means runs whose go.sum differs from
+    # main still restore main's most recent cache and rebuild only
+    # the delta.
+    - name: Restore Go cache (non-main)
+      if: github.ref != 'refs/heads/main'
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: |
+          ${{ steps.go-paths.outputs.mod }}
+          ${{ steps.go-paths.outputs.build }}
+        key: setup-go-${{ inputs.cache-key }}-${{ runner.os }}-go${{ steps.setup-go.outputs.go-version }}-${{ hashFiles('go.sum') }}
+        restore-keys: |
+          setup-go-${{ inputs.cache-key }}-${{ runner.os }}-go${{ steps.setup-go.outputs.go-version }}-
 
     - name: Setup Python
-      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
         python-version: '3.13'
 
     - name: Install uv
-      uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+      uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
       with:
         version: "0.8.9"
 
@@ -42,7 +80,7 @@ runs:
       shell: bash
 
     - name: Install ruff (Python linter and formatter)
-      uses: astral-sh/ruff-action@0ce1b0bf8b818ef400413f810f8a11cdbda0034b # v4.0.0
+      uses: astral-sh/ruff-action@278981a28ce3188b1e39527901f38254bf3aac89 # v4.1.0
       with:
         version: "0.9.1"
         args: "--version"
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 4072e543b65..87ae745dc07 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -6,6 +6,20 @@ updates:
       interval: "weekly"
     cooldown:
       default-days: 14
+    groups:
+      # The new Databricks Go SDK ships as ~100 per-service submodules under
+      # github.com/databricks/sdk-go. Bumping them individually would open one PR
+      # per submodule; group them into a single PR.
+      databricks-sdk-go:
+        patterns:
+          - github.com/databricks/sdk-go/*
+      # The golang.org/x/* modules are released in lockstep and each bump pulls
+      # the others in transitively (e.g. x/net requires matching x/crypto and
+      # x/term). As separate PRs they all edit adjacent go.mod/go.sum lines and
+      # evict each other from the merge queue with a conflict, so group them.
+      golang-x:
+        patterns:
+          - golang.org/x/*
     ignore:
       # Ignore Databricks Go SDK because its upgrade requires code generation
       - dependency-name: github.com/databricks/databricks-sdk-go
@@ -15,6 +29,32 @@ updates:
       interval: "weekly"
     cooldown:
       default-days: 14
+  # acceptance/ holds generated template output and test fixtures, not real
+  # project dependencies. Some pin a placeholder version (e.g.
+  # databricks-bundles==x.y.z, produced by a test.toml Repls rule) that is not
+  # valid PEP 440 and aborts the whole dependency-graph submission for the
+  # ecosystem. cmd/labs/project/testdata/ is vendored test data. The pip and uv
+  # graph jobs both scan pyproject.toml, so both need the exclusion.
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 14
+    exclude-paths:
+      - "acceptance/**"
+      - "cmd/labs/project/testdata/**"
+      - "python/codegen/**"
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 14
+    exclude-paths:
+      - "acceptance/**"
+      - "cmd/labs/project/testdata/**"
+      - "python/codegen/**"
   # https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#directories
   - package-ecosystem: "github-actions"
     directories:
diff --git a/.github/labeler.yml b/.github/labeler.yml
new file mode 100644
index 00000000000..6408c26b78d
--- /dev/null
+++ b/.github/labeler.yml
@@ -0,0 +1,56 @@
+# Configuration for the "PR Labeler" workflow (.github/workflows/labeler.yml).
+#
+# Maps a label to the file globs that, when matched by a PR's diff, cause the
+# label to be applied. Uses the actions/labeler v7 config format, documented at
+# https://github.com/actions/labeler/blob/v7.0.0/README.md
+#
+# To add a new mapping, copy the block below. The label MUST already exist in
+# the repository (labeler does not create labels), and globs use minimatch
+# syntax where `**` matches nested paths:
+#
+#   <LABEL>:
+#     - changed-files:
+#         - any-glob-to-any-file:
+#             - 'some/path/**'
+#             - 'another/path/**'
+
+AIR:
+  - changed-files:
+      - any-glob-to-any-file:
+          # Current (experimental) location.
+          - 'experimental/air/**'
+          - 'acceptance/experimental/air/**'
+          # Post-graduation location (see #6722): commands move to cmd/air,
+          # acceptance tests to acceptance/air. Kept alongside the experimental
+          # globs so labeling survives the move.
+          - 'cmd/air/**'
+          - 'acceptance/air/**'
+
+DABs:
+  - changed-files:
+      - any-glob-to-any-file:
+          - 'bundle/**'
+          - 'cmd/bundle/**'
+          - 'acceptance/bundle/**'
+
+PyDABs:
+  - any:
+      - changed-files:
+          # The PyDABs (databricks-bundles) Python package. Requires at least one
+          # hand-written file, so DABs PRs that only regenerate PyDABs code are
+          # not labeled. Mirrors python/databricks/bundles/.gitattributes and
+          # python/databricks_tests/.gitattributes.
+          - all-globs-to-any-file:
+              - 'python/**'
+              - '!python/databricks/bundles/*/_models/**'
+              - '!python/databricks/bundles/*/__init__.py'
+              - '!python/databricks/bundles/core/_generated/**'
+              - '!python/databricks_tests/core/_generated/**'
+      - changed-files:
+          - any-glob-to-any-file:
+              # The Go side of PyDABs: the mutator that runs the Python subprocess.
+              # Also matches 'bundle/**', so these PRs get the DABs label too.
+              - 'bundle/config/mutator/python/**'
+              # Acceptance tests that exercise PyDABs specifically.
+              - 'acceptance/bundle/python/**'
+              - 'acceptance/bundle/templates/pydabs/**'
diff --git a/.github/scripts/owners.js b/.github/scripts/owners.js
deleted file mode 100644
index a158fa4af5a..00000000000
--- a/.github/scripts/owners.js
+++ /dev/null
@@ -1,140 +0,0 @@
-const fs = require("fs");
-const path = require("path");
-
-/**
- * Read a file and return non-empty, non-comment lines split by whitespace.
- * Returns [] if the file does not exist.
- *
- * @param {string} filePath
- * @returns {string[][]} array of whitespace-split tokens per line
- */
-function readDataLines(filePath) {
-  let content;
-  try {
-    content = fs.readFileSync(filePath, "utf-8");
-  } catch (e) {
-    if (e.code === "ENOENT") return [];
-    throw e;
-  }
-  const result = [];
-  for (const raw of content.split("\n")) {
-    const line = raw.trim();
-    if (!line || line.startsWith("#")) continue;
-    const parts = line.split(/\s+/);
-    if (parts.length >= 2) result.push(parts);
-  }
-  return result;
-}
-
-/**
- * Parse an OWNERTEAMS file into a map of team aliases.
- * Format: "team:<name>  @member1 @member2 ..."
- * Returns Map<string, string[]> where key is "team:<name>" and value is member logins.
- *
- * @param {string} filePath - absolute path to the OWNERTEAMS file
- * @returns {Map<string, string[]>}
- */
-function parseOwnerTeams(filePath) {
-  const teams = new Map();
-  for (const parts of readDataLines(filePath)) {
-    if (!parts[0].startsWith("team:")) continue;
-    const members = parts.slice(1).filter((p) => p.startsWith("@")).map((p) => p.slice(1));
-    teams.set(parts[0], members);
-  }
-  return teams;
-}
-
-/**
- * Parse an OWNERS file (same format as CODEOWNERS).
- * Returns array of { pattern, owners } rules.
- *
- * If an OWNERTEAMS file exists alongside the OWNERS file, "team:<name>"
- * tokens are expanded to their member lists.
- *
- * By default, team refs (org/team) are filtered out and @ is stripped.
- * Pass { includeTeams: true } to keep team refs (with @ stripped).
- *
- * @param {string} filePath - absolute path to the OWNERS file
- * @param {{ includeTeams?: boolean }} [opts]
- * @returns {Array<{pattern: string, owners: string[]}>}
- */
-function parseOwnersFile(filePath, opts) {
-  const includeTeams = opts && opts.includeTeams;
-  const teamsPath = path.join(path.dirname(filePath), "OWNERTEAMS");
-  const teams = parseOwnerTeams(teamsPath);
-  const rules = [];
-  for (const parts of readDataLines(filePath)) {
-    const pattern = parts[0];
-    const owners = [];
-    for (const p of parts.slice(1)) {
-      if (p.startsWith("team:") && teams.has(p)) {
-        owners.push(...teams.get(p));
-      } else if (p.startsWith("@") && (includeTeams || !p.includes("/"))) {
-        owners.push(p.slice(1));
-      }
-    }
-    rules.push({ pattern, owners });
-  }
-  return rules;
-}
-
-/**
- * Match a filepath against an OWNERS pattern.
- * Supports: "*" (catch-all), "/dir/" (prefix), "/path/file" (exact).
- */
-function ownersMatch(pattern, filepath) {
-  if (pattern === "*") return true;
-  let p = pattern;
-  if (p.startsWith("/")) p = p.slice(1);
-  if (p.endsWith("/")) return filepath.startsWith(p);
-  return filepath === p;
-}
-
-/**
- * Find owners for a file. Last match wins, like CODEOWNERS.
- * @returns {string[]} owner logins
- */
-function findOwners(filepath, rules) {
-  let matched = [];
-  for (const rule of rules) {
-    if (ownersMatch(rule.pattern, filepath)) {
-      matched = rule.owners;
-    }
-  }
-  return matched;
-}
-
-/**
- * Get maintainers from the * catch-all rule.
- * @returns {string[]} logins
- */
-function getMaintainers(rules) {
-  const catchAll = rules.find((r) => r.pattern === "*");
-  return catchAll ? catchAll.owners : [];
-}
-
-/**
- * Group files by their matched OWNERS rule (last-match-wins).
- * Returns Map<pattern, { owners: string[], files: string[] }>
- */
-function getOwnershipGroups(filenames, rules) {
-  const groups = new Map();
-  for (const filepath of filenames) {
-    let matchedPattern = null;
-    let matchedOwners = [];
-    for (const rule of rules) {
-      if (ownersMatch(rule.pattern, filepath)) {
-        matchedPattern = rule.pattern;
-        matchedOwners = rule.owners;
-      }
-    }
-    if (!matchedPattern) continue;
-    if (!groups.has(matchedPattern)) {
-      groups.set(matchedPattern, { owners: [...matchedOwners], files: [] });
-    }
-    groups.get(matchedPattern).files.push(filepath);
-  }
-  return groups;
-}
-
-module.exports = { parseOwnerTeams, parseOwnersFile, ownersMatch, findOwners, getMaintainers, getOwnershipGroups };
diff --git a/.github/scripts/owners.test.js b/.github/scripts/owners.test.js
deleted file mode 100644
index 5594d297505..00000000000
--- a/.github/scripts/owners.test.js
+++ /dev/null
@@ -1,350 +0,0 @@
-const { describe, it, before, after } = require("node:test");
-const assert = require("node:assert/strict");
-const fs = require("fs");
-const os = require("os");
-const path = require("path");
-
-const {
-  parseOwnerTeams,
-  ownersMatch,
-  parseOwnersFile,
-  findOwners,
-  getMaintainers,
-  getOwnershipGroups,
-} = require("./owners");
-
-// --- ownersMatch ---
-
-describe("ownersMatch", () => {
-  it("* matches everything", () => {
-    assert.ok(ownersMatch("*", "any/file/path.go"));
-    assert.ok(ownersMatch("*", "README.md"));
-    assert.ok(ownersMatch("*", ""));
-  });
-
-  it("/dir/ prefix matches files under that directory", () => {
-    assert.ok(ownersMatch("/cmd/pipelines/", "cmd/pipelines/foo.go"));
-    assert.ok(ownersMatch("/cmd/pipelines/", "cmd/pipelines/sub/bar.go"));
-  });
-
-  it("/dir/ does NOT match files in other directories", () => {
-    assert.ok(!ownersMatch("/cmd/pipelines/", "cmd/other/foo.go"));
-    assert.ok(!ownersMatch("/cmd/pipelines/", "cmd/pipeline/foo.go"));
-    assert.ok(!ownersMatch("/cmd/pipelines/", "bundle/pipelines/foo.go"));
-  });
-
-  it("exact file match", () => {
-    assert.ok(ownersMatch("/some/file.go", "some/file.go"));
-    assert.ok(!ownersMatch("/some/file.go", "some/other.go"));
-    assert.ok(!ownersMatch("/some/file.go", "some/file.go/extra"));
-  });
-
-  it("leading / is stripped for matching", () => {
-    assert.ok(ownersMatch("/bundle/", "bundle/config.go"));
-    assert.ok(ownersMatch("/README.md", "README.md"));
-  });
-});
-
-// --- parseOwnersFile ---
-
-describe("parseOwnersFile", () => {
-  let tmpDir;
-  let ownersPath;
-
-  before(() => {
-    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "owners-test-"));
-    ownersPath = path.join(tmpDir, "OWNERS");
-  });
-
-  after(() => {
-    fs.rmSync(tmpDir, { recursive: true });
-  });
-
-  it("parses rules with owners", () => {
-    fs.writeFileSync(
-      ownersPath,
-      [
-        "* @alice @bob",
-        "/cmd/pipelines/ @carol",
-      ].join("\n")
-    );
-    const rules = parseOwnersFile(ownersPath);
-    assert.equal(rules.length, 2);
-    assert.equal(rules[0].pattern, "*");
-    assert.deepEqual(rules[0].owners, ["alice", "bob"]);
-    assert.equal(rules[1].pattern, "/cmd/pipelines/");
-    assert.deepEqual(rules[1].owners, ["carol"]);
-  });
-
-  it("filters out team refs by default", () => {
-    fs.writeFileSync(
-      ownersPath,
-      "/cmd/apps/ @databricks/eng-apps-devex @alice\n"
-    );
-    const rules = parseOwnersFile(ownersPath);
-    assert.equal(rules.length, 1);
-    assert.deepEqual(rules[0].owners, ["alice"]);
-  });
-
-  it("includes team refs with includeTeams option", () => {
-    fs.writeFileSync(
-      ownersPath,
-      "/cmd/apps/ @databricks/eng-apps-devex @alice\n"
-    );
-    const rules = parseOwnersFile(ownersPath, { includeTeams: true });
-    assert.equal(rules.length, 1);
-    assert.deepEqual(rules[0].owners, ["databricks/eng-apps-devex", "alice"]);
-  });
-
-  it("skips comments and blank lines", () => {
-    fs.writeFileSync(
-      ownersPath,
-      [
-        "# This is a comment",
-        "",
-        "  # indented comment",
-        "* @alice",
-        "",
-        "/cmd/ @bob",
-      ].join("\n")
-    );
-    const rules = parseOwnersFile(ownersPath);
-    assert.equal(rules.length, 2);
-  });
-
-  it("strips @ prefix from owners", () => {
-    fs.writeFileSync(ownersPath, "* @alice @bob\n");
-    const rules = parseOwnersFile(ownersPath);
-    assert.deepEqual(rules[0].owners, ["alice", "bob"]);
-  });
-
-  it("skips lines with only a pattern and no owners", () => {
-    fs.writeFileSync(ownersPath, "/lonely/\n* @alice\n");
-    const rules = parseOwnersFile(ownersPath);
-    assert.equal(rules.length, 1);
-    assert.equal(rules[0].pattern, "*");
-  });
-});
-
-// --- parseOwnerTeams ---
-
-describe("parseOwnerTeams", () => {
-  let tmpDir;
-
-  before(() => {
-    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "ownerteams-test-"));
-  });
-
-  after(() => {
-    fs.rmSync(tmpDir, { recursive: true });
-  });
-
-  it("parses team definitions", () => {
-    const teamsPath = path.join(tmpDir, "OWNERTEAMS");
-    fs.writeFileSync(teamsPath, "team:platform @alice @bob @carol\n");
-    const teams = parseOwnerTeams(teamsPath);
-    assert.equal(teams.size, 1);
-    assert.deepEqual(teams.get("team:platform"), ["alice", "bob", "carol"]);
-  });
-
-  it("parses multiple teams", () => {
-    const teamsPath = path.join(tmpDir, "OWNERTEAMS");
-    fs.writeFileSync(teamsPath, "team:platform @alice @bob\nteam:bundle @carol @dave\n");
-    const teams = parseOwnerTeams(teamsPath);
-    assert.equal(teams.size, 2);
-    assert.deepEqual(teams.get("team:platform"), ["alice", "bob"]);
-    assert.deepEqual(teams.get("team:bundle"), ["carol", "dave"]);
-  });
-
-  it("skips comments and blank lines", () => {
-    const teamsPath = path.join(tmpDir, "OWNERTEAMS");
-    fs.writeFileSync(teamsPath, "# comment\n\nteam:platform @alice\n");
-    const teams = parseOwnerTeams(teamsPath);
-    assert.equal(teams.size, 1);
-  });
-
-  it("returns empty map if file does not exist", () => {
-    const teams = parseOwnerTeams(path.join(tmpDir, "NONEXISTENT"));
-    assert.equal(teams.size, 0);
-  });
-});
-
-// --- parseOwnersFile with team aliases ---
-
-describe("parseOwnersFile with OWNERTEAMS", () => {
-  let tmpDir;
-  let ownersPath;
-  let teamsPath;
-
-  before(() => {
-    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "owners-teams-test-"));
-    ownersPath = path.join(tmpDir, "OWNERS");
-    teamsPath = path.join(tmpDir, "OWNERTEAMS");
-  });
-
-  after(() => {
-    fs.rmSync(tmpDir, { recursive: true });
-  });
-
-  it("expands team aliases to members", () => {
-    fs.writeFileSync(teamsPath, "team:platform @alice @bob\n");
-    fs.writeFileSync(ownersPath, "/cmd/auth/ team:platform\n");
-    const rules = parseOwnersFile(ownersPath);
-    assert.equal(rules.length, 1);
-    assert.deepEqual(rules[0].owners, ["alice", "bob"]);
-  });
-
-  it("mixes team aliases with individual owners", () => {
-    fs.writeFileSync(teamsPath, "team:platform @alice @bob\n");
-    fs.writeFileSync(ownersPath, "/cmd/auth/ team:platform @carol\n");
-    const rules = parseOwnersFile(ownersPath);
-    assert.equal(rules.length, 1);
-    assert.deepEqual(rules[0].owners, ["alice", "bob", "carol"]);
-  });
-
-  it("unknown team alias is ignored", () => {
-    fs.writeFileSync(teamsPath, "team:platform @alice\n");
-    fs.writeFileSync(ownersPath, "/cmd/auth/ team:unknown @bob\n");
-    const rules = parseOwnersFile(ownersPath);
-    assert.deepEqual(rules[0].owners, ["bob"]);
-  });
-
-  it("works without OWNERTEAMS file", () => {
-    const tmpDir2 = fs.mkdtempSync(path.join(os.tmpdir(), "owners-noteams-"));
-    const ownersPath2 = path.join(tmpDir2, "OWNERS");
-    fs.writeFileSync(ownersPath2, "* @alice\n");
-    const rules = parseOwnersFile(ownersPath2);
-    assert.deepEqual(rules[0].owners, ["alice"]);
-    fs.rmSync(tmpDir2, { recursive: true });
-  });
-});
-
-// --- findOwners ---
-
-describe("findOwners", () => {
-  const rules = [
-    { pattern: "*", owners: ["maintainer1", "maintainer2"] },
-    { pattern: "/cmd/pipelines/", owners: ["pipelinesOwner"] },
-    { pattern: "/cmd/apps/", owners: ["appsOwner"] },
-  ];
-
-  it("last match wins", () => {
-    const owners = findOwners("cmd/pipelines/foo.go", rules);
-    assert.deepEqual(owners, ["pipelinesOwner"]);
-  });
-
-  it("file matching only * returns catch-all owners", () => {
-    const owners = findOwners("README.md", rules);
-    assert.deepEqual(owners, ["maintainer1", "maintainer2"]);
-  });
-
-  it("file matching specific rule returns that rule's owners", () => {
-    const owners = findOwners("cmd/apps/main.go", rules);
-    assert.deepEqual(owners, ["appsOwner"]);
-  });
-
-  it("returns empty array when no rules match", () => {
-    const noWildcard = [{ pattern: "/cmd/pipelines/", owners: ["owner1"] }];
-    const owners = findOwners("bundle/config.go", noWildcard);
-    assert.deepEqual(owners, []);
-  });
-});
-
-// --- getMaintainers ---
-
-describe("getMaintainers", () => {
-  it("returns owners from * rule", () => {
-    const rules = [
-      { pattern: "*", owners: ["alice", "bob"] },
-      { pattern: "/cmd/", owners: ["carol"] },
-    ];
-    assert.deepEqual(getMaintainers(rules), ["alice", "bob"]);
-  });
-
-  it("returns empty array if no * rule", () => {
-    const rules = [{ pattern: "/cmd/", owners: ["carol"] }];
-    assert.deepEqual(getMaintainers(rules), []);
-  });
-});
-
-// --- getOwnershipGroups ---
-
-describe("getOwnershipGroups", () => {
-  const rules = [
-    { pattern: "*", owners: ["maintainer"] },
-    { pattern: "/cmd/pipelines/", owners: ["pipelinesOwner"] },
-    { pattern: "/cmd/apps/", owners: ["appsOwner"] },
-    { pattern: "/bundle/", owners: ["bundleOwner"] },
-  ];
-
-  it("single file matching one rule -> one group", () => {
-    const groups = getOwnershipGroups(["cmd/pipelines/foo.go"], rules);
-    assert.equal(groups.size, 1);
-    assert.ok(groups.has("/cmd/pipelines/"));
-    assert.deepEqual(groups.get("/cmd/pipelines/").owners, ["pipelinesOwner"]);
-    assert.deepEqual(groups.get("/cmd/pipelines/").files, ["cmd/pipelines/foo.go"]);
-  });
-
-  it("multiple files matching same rule -> grouped together", () => {
-    const groups = getOwnershipGroups(
-      ["cmd/pipelines/foo.go", "cmd/pipelines/bar.go"],
-      rules
-    );
-    assert.equal(groups.size, 1);
-    assert.deepEqual(groups.get("/cmd/pipelines/").files, [
-      "cmd/pipelines/foo.go",
-      "cmd/pipelines/bar.go",
-    ]);
-  });
-
-  it("files matching different rules -> separate groups", () => {
-    const groups = getOwnershipGroups(
-      ["cmd/pipelines/foo.go", "cmd/apps/bar.go"],
-      rules
-    );
-    assert.equal(groups.size, 2);
-    assert.ok(groups.has("/cmd/pipelines/"));
-    assert.ok(groups.has("/cmd/apps/"));
-  });
-
-  it("file matching only * -> group with * key", () => {
-    const groups = getOwnershipGroups(["README.md"], rules);
-    assert.equal(groups.size, 1);
-    assert.ok(groups.has("*"));
-    assert.deepEqual(groups.get("*").owners, ["maintainer"]);
-    assert.deepEqual(groups.get("*").files, ["README.md"]);
-  });
-
-  it("file matching no rule -> skipped", () => {
-    const noWildcard = [{ pattern: "/cmd/pipelines/", owners: ["owner1"] }];
-    const groups = getOwnershipGroups(["unrelated/file.go"], noWildcard);
-    assert.equal(groups.size, 0);
-  });
-
-  it("cross-domain: /cmd/pipelines/ and /cmd/apps/ -> two groups", () => {
-    const groups = getOwnershipGroups(
-      [
-        "cmd/pipelines/a.go",
-        "cmd/pipelines/b.go",
-        "cmd/apps/c.go",
-      ],
-      rules
-    );
-    assert.equal(groups.size, 2);
-    assert.deepEqual(groups.get("/cmd/pipelines/").files, [
-      "cmd/pipelines/a.go",
-      "cmd/pipelines/b.go",
-    ]);
-    assert.deepEqual(groups.get("/cmd/apps/").files, ["cmd/apps/c.go"]);
-  });
-
-  it("mixed: domain files + *-only files -> both groups present", () => {
-    const groups = getOwnershipGroups(
-      ["cmd/pipelines/a.go", "README.md"],
-      rules
-    );
-    assert.equal(groups.size, 2);
-    assert.ok(groups.has("/cmd/pipelines/"));
-    assert.ok(groups.has("*"));
-  });
-});
diff --git a/.github/workflows/bump-go-toolchain.yml b/.github/workflows/bump-go-toolchain.yml
index 080a15e5f9f..eee8d4afb57 100644
--- a/.github/workflows/bump-go-toolchain.yml
+++ b/.github/workflows/bump-go-toolchain.yml
@@ -24,7 +24,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Determine current toolchain version
         id: current
@@ -71,7 +71,7 @@ jobs:
 
       - name: Setup Go
         if: steps.check.outputs.needed == 'true'
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
 
@@ -92,6 +92,7 @@ jobs:
         run: git diff
 
       - name: Create pull request
+        id: cpr
         if: steps.check.outputs.needed == 'true' && inputs.version == ''
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
@@ -104,3 +105,23 @@ jobs:
             Release notes: https://go.dev/doc/devel/release#${{ steps.latest.outputs.toolchain }}
           reviewers: simonfaltum,andrewnester,anton-107,denik,janniklasrose,pietern,shreyas-goenka
           labels: dependencies
+
+      # Add the changelog fragment as a follow-up commit on the PR branch: the
+      # fragment references the PR number, which only exists once the PR above
+      # has been created.
+      - name: Add changelog fragment
+        if: steps.cpr.outputs.pull-request-number
+        env:
+          TOOLCHAIN: ${{ steps.latest.outputs.toolchain }}
+          BRANCH: ${{ steps.cpr.outputs.pull-request-branch }}
+          PR: ${{ steps.cpr.outputs.pull-request-number }}
+        run: |-
+          git fetch origin "$BRANCH"
+          git checkout -f -B "$BRANCH" FETCH_HEAD
+          fragment=".nextchanges/dependency-updates/go-toolchain-${TOOLCHAIN}.md"
+          echo "* Bump Go toolchain to ${TOOLCHAIN#go}. ([#${PR}](https://github.com/databricks/cli/pull/${PR}))" > "$fragment"
+          git add "$fragment"
+          git -c user.name='github-actions[bot]' \
+              -c user.email='41898282+github-actions[bot]@users.noreply.github.com' \
+              commit -m "Add changelog fragment"
+          git push origin "HEAD:$BRANCH"
diff --git a/.github/workflows/bump-vuln-deps.yml b/.github/workflows/bump-vuln-deps.yml
new file mode 100644
index 00000000000..05fd08a6d6c
--- /dev/null
+++ b/.github/workflows/bump-vuln-deps.yml
@@ -0,0 +1,122 @@
+name: Bump vulnerable dependencies
+
+on:
+  schedule:
+    # Run daily at 05:30 UTC, just after the Go toolchain bumper.
+    - cron: "30 5 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+  # Required by setup-jfrog (GOPROXY exchange).
+  id-token: write
+
+jobs:
+  bump-vuln-deps:
+    runs-on:
+      group: databricks-protected-runner-group-large
+      labels: linux-ubuntu-latest-large
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Setup JFrog
+        uses: ./.github/actions/setup-jfrog
+
+      - name: Setup Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          # vulnbump lives in the tools module, which is what this job compiles.
+          go-version-file: tools/go.mod
+
+      - name: Build vulnbump
+        run: go -C tools/vulnbump build -o "$RUNNER_TEMP/vulnbump" .
+
+      - name: Bump vulnerable dependencies
+        id: bump
+        run: |
+          set -euo pipefail
+
+          # govulncheck is pinned as a tool dependency in tools/go.mod; -modfile
+          # resolves it from there while it scans the root module (the working
+          # directory). Only the root module ships; tools/ is build- and
+          # CI-only, so it is not scanned. Its vulnerability database is fetched from vuln.go.dev at
+          # runtime, so the pinned binary still uses the latest advisories.
+          #
+          # -scan module reports every advisory affecting a required module,
+          # regardless of whether the vulnerable symbol is reachable. In JSON
+          # mode govulncheck exits 0 on success whether or not it finds anything,
+          # and non-zero only on a real error; a failure must abort the job
+          # rather than be silently mistaken for "no vulnerabilities".
+          scan="$(mktemp)"
+          go tool -modfile=tools/go.mod govulncheck -scan module -format json > "$scan"
+
+          summary_file="$(mktemp)"
+          "$RUNNER_TEMP/vulnbump" . < "$scan" > "$summary_file"
+
+          if git diff --quiet; then
+            echo "No vulnerable dependencies to bump."
+            echo "needed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "needed=true" >> "$GITHUB_OUTPUT"
+            {
+              echo "summary<<SUMMARY_EOF"
+              cat "$summary_file"
+              echo "SUMMARY_EOF"
+            } >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Show diff
+        if: steps.bump.outputs.needed == 'true'
+        run: git diff
+
+      - name: Create pull request
+        id: cpr
+        if: steps.bump.outputs.needed == 'true'
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          # A fixed branch means a daily run updates the existing open PR in
+          # place rather than opening a new one; no branch-suffix is needed.
+          branch: auto/bump-vuln-deps
+          commit-message: "Bump dependencies with known vulnerabilities"
+          title: "Bump dependencies with known vulnerabilities"
+          body: |
+            Bump dependencies flagged by `govulncheck -scan module` to their fixed versions.
+
+            Each CVE links to its Go advisory page.
+
+            ${{ steps.bump.outputs.summary }}
+
+            Vulnerabilities in the Go standard library are left to the `Bump Go toolchain` workflow.
+
+            If a bump promotes a new direct dependency, double-check its license annotation in `go.mod` and `NOTICE`.
+          reviewers: simonfaltum,andrewnester,anton-107,denik,janniklasrose,pietern,shreyas-goenka
+          labels: dependencies
+
+      # Add the changelog fragment as a follow-up commit on the PR branch: the
+      # fragment references the PR number, which only exists once the PR above
+      # has been created. The fixed branch is re-checked out on each daily run,
+      # so guard against re-committing when the fragment already exists.
+      - name: Add changelog fragment
+        if: steps.cpr.outputs.pull-request-number
+        env:
+          BRANCH: ${{ steps.cpr.outputs.pull-request-branch }}
+          PR: ${{ steps.cpr.outputs.pull-request-number }}
+        run: |-
+          git fetch origin "$BRANCH"
+          git checkout -f -B "$BRANCH" FETCH_HEAD
+          fragment=".nextchanges/dependency-updates/${PR}.md"
+          echo "* Bump dependencies with known vulnerabilities. ([#${PR}](https://github.com/databricks/cli/pull/${PR}))" > "$fragment"
+          git add "$fragment"
+          # Skip commit if nothing changed (fragment already present on this branch).
+          if git diff --cached --quiet; then
+            echo "fragment already present"
+            exit 0
+          fi
+          git -c user.name='github-actions[bot]' \
+              -c user.email='41898282+github-actions[bot]@users.noreply.github.com' \
+              commit -m "Add changelog fragment"
+          git push origin "HEAD:$BRANCH"
diff --git a/.github/workflows/changelog-guard.yml b/.github/workflows/changelog-guard.yml
index 73969171d4f..849bdfb17bc 100644
--- a/.github/workflows/changelog-guard.yml
+++ b/.github/workflows/changelog-guard.yml
@@ -2,6 +2,7 @@ name: Changelog Guard
 
 on:
   pull_request:
+    types: [opened, synchronize, reopened, labeled, unlabeled]
     paths:
       - CHANGELOG.md
 
@@ -13,6 +14,6 @@ jobs:
         if: "!contains(github.event.pull_request.labels.*.name, 'override-changelog-guard')"
         run: |-
           echo "::error::CHANGELOG.md should not be modified directly by PRs."
-          echo "The release workflow manages CHANGELOG.md automatically from NEXT_CHANGELOG.md."
+          echo "The release workflow manages CHANGELOG.md automatically from .nextchanges/ fragments."
           echo "If this is intentional, add the 'override-changelog-guard' label to this PR."
           exit 1
diff --git a/.github/workflows/changelog-preview.yml b/.github/workflows/changelog-preview.yml
new file mode 100644
index 00000000000..9e3062485f3
--- /dev/null
+++ b/.github/workflows/changelog-preview.yml
@@ -0,0 +1,75 @@
+name: Changelog Preview
+
+# Renders the CHANGELOG.md section the next release would generate from the
+# .nextchanges/ fragments into this check's job summary, so reviewers see the
+# rendered changelog without cutting a release. Fails the check if a fragment
+# is misplaced (so it can't be silently skipped by the renderer).
+#
+# Runs on pull requests (rendering the PR's own .nextchanges/ content) and on
+# pushes to main (so anyone can view the preview for any commit on main). Uses
+# a read-only token: it only reads .nextchanges/ and never needs write
+# credentials.
+on:
+  pull_request:
+    types: [opened, reopened, synchronize]
+    paths:
+      - ".nextchanges/**"
+      - "internal/genkit/**"
+      - "tools/validate_nextchanges.py"
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  preview:
+    runs-on: ubuntu-latest
+    env:
+      NEXTCHANGES_DIR: '.nextchanges'
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # Full history so the validator can infer each fragment's PR from the
+          # squash-merge commit that added it (see tools/validate_nextchanges.py).
+          fetch-depth: 0
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          version: "0.8.9"
+
+      # Fail the check on a misplaced/unexpected file under .nextchanges/ so it
+      # can't slip through as a silently-skipped (unrendered) fragment. Running in
+      # CI (GITHUB_ACTIONS) makes the trailing PR link mandatory and checks it
+      # names the right PR. PR_NUMBER is the authoritative event PR (empty on push
+      # to main, where each fragment's PR is inferred from its squash-merge
+      # commit); it must have full history to attribute fragments, hence the
+      # fetch-depth: 0 checkout above. BASE_REF is the PR's base branch, so a
+      # gh-stacked PR's inherited fragments (which already carry the earlier PR's
+      # link) aren't attributed to this PR.
+      - name: Validate .nextchanges placement
+        env:
+          PR_NUMBER: ${{ github.event.number }}
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+        run: uv run tools/validate_nextchanges.py
+
+      - name: Render changelog preview
+        run: |-
+          # Render into a variable first so a renderer error fails this step
+          # (rather than being swallowed by a pipe), then emit the .md directly
+          # into the job summary so GitHub renders it as the changelog.
+          preview=$(uv run --locked internal/genkit/tagging.py --preview)
+          {
+            echo '## Changelog preview'
+            echo ''
+            echo 'This is a preview of what the next release would add to CHANGELOG.md based on `.nextchanges/`.'
+            echo ''
+            echo '_NOTE: the date and version are computed at release time._'
+            echo ''
+            echo '---'
+            echo ''
+            echo "$preview"
+          } >> "$GITHUB_STEP_SUMMARY"
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 5bff4cf9935..7035d574372 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -19,9 +19,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           # Use different schema from regular job, to avoid overwriting the same key
@@ -35,22 +35,19 @@ jobs:
       - name: Fail if go.mod/go.sum changed
         run: git diff --exit-code
 
-      - name: Run Go lint checks (does not include formatting checks)
-        run: go tool -modfile=tools/task/go.mod task lint
-
-      - name: Run ruff (Python linter and formatter)
-        uses: astral-sh/ruff-action@0ce1b0bf8b818ef400413f810f8a11cdbda0034b # v4.0.0
-        with:
-          version: "0.9.1"
-          args: "format --check"
-
       - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
         with:
           version: "0.8.9"
 
-      - name: "task fmt: Python and Go formatting"
-        # Python formatting is already checked above, but this also checks Go and YAML formatting
+      - name: Run Go and Python lint checks (does not include formatting checks)
+        # `task lint` runs golangci-lint and `ruff check` (lint-python). ruff is
+        # provided by uvx, installed above; formatting is checked by `task fmt` below.
+        run: go tool -modfile=tools/task/go.mod task lint
+
+      - name: "task fmt: Python, Go and YAML formatting"
+        # `task fmt` runs ruff format (Python) plus Go and YAML formatters; the diff
+        # check fails the build if anything was left unformatted.
         run: |
           go tool -modfile=tools/task/go.mod task fmt
           git diff --exit-code
diff --git a/.github/workflows/cli-contrib-membership.yml b/.github/workflows/cli-contrib-membership.yml
new file mode 100644
index 00000000000..1977152f446
--- /dev/null
+++ b/.github/workflows/cli-contrib-membership.yml
@@ -0,0 +1,58 @@
+name: Fork Contribution Notice
+
+# WARNING:
+# THIS WORKFLOW ALWAYS RUNS FOR EXTERNAL CONTRIBUTORS WITHOUT ANY APPROVAL.
+# THIS WORKFLOW RUNS FROM MAIN BRANCH, NOT FROM THE PR BRANCH.
+# DO NOT PULL THE PR OR EXECUTE ANY CODE FROM THE PR.
+
+on:
+  pull_request_target:
+    types: [opened, reopened]
+    branches:
+      - main
+
+jobs:
+  fork-contribution-notice:
+    runs-on:
+      group: databricks-deco-testing-runner-group
+      labels: ubuntu-latest-deco
+
+    permissions:
+      pull-requests: write
+
+    # Only run this job for PRs from forks. Databricks org members should
+    # contribute from a branch in this repository instead (see the notice).
+    if: "${{ github.event.pull_request.head.repo.fork }}"
+
+    # No checkout: the job only talks to the GitHub API via gh, so it never
+    # pulls or runs code from the PR. GH_REPO gives gh the repo context that a
+    # checkout would otherwise provide.
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      GH_REPO: ${{ github.repository }}
+
+    steps:
+      - name: Check for existing notice
+        id: check
+        run: |
+          # Skip posting if the notice is already present, so a close/reopen
+          # doesn't add a duplicate comment.
+          existing=$(gh api "repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/comments" \
+            --jq '.[] | select(.body | startswith("<!-- CLI_CONTRIB_FORK_NOTICE -->")) | .id')
+          if [ -n "$existing" ]; then
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Post contribution notice
+        if: steps.check.outputs.exists == 'false'
+        run: |-
+          gh pr comment ${{ github.event.pull_request.number }} --body \
+          "<!-- CLI_CONTRIB_FORK_NOTICE -->
+          Thanks for the contribution! This pull request was opened from a fork.
+
+          If you're a member of the Databricks organization, please request access to the [\`cli-contrib\` team](https://github.com/orgs/databricks/teams/cli-contrib) and open your pull request from a branch in this repository instead of a fork — fork PRs don't run integration tests automatically and have reduced CI access.
+
+          If you're an external contributor, no action is needed; a maintainer will review your pull request.
+          "
diff --git a/.github/workflows/close-stale-issues.yml b/.github/workflows/close-stale-issues.yml
index a3793304167..ed66650894e 100644
--- a/.github/workflows/close-stale-issues.yml
+++ b/.github/workflows/close-stale-issues.yml
@@ -18,7 +18,7 @@ jobs:
       pull-requests: write
 
     steps:
-      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
+      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
         with:
           stale-issue-message: This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.
           stale-pr-message: This PR has not received an update in a while. If you want to keep this PR open, please leave a comment below or push a new commit and auto-close will be canceled.
diff --git a/.github/workflows/conftest.yml b/.github/workflows/conftest.yml
index 0f5deda45c6..89959b5d2fd 100644
--- a/.github/workflows/conftest.yml
+++ b/.github/workflows/conftest.yml
@@ -19,7 +19,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install conftest
         run: |-
diff --git a/.github/workflows/external-message.yml b/.github/workflows/external-message.yml
index 9a6d12d5202..fe674b6a7ce 100644
--- a/.github/workflows/external-message.yml
+++ b/.github/workflows/external-message.yml
@@ -25,7 +25,7 @@ jobs:
     if: "${{ github.event.pull_request.head.repo.fork }}"
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Delete old comments
         env:
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
new file mode 100644
index 00000000000..cba79c172bd
--- /dev/null
+++ b/.github/workflows/labeler.yml
@@ -0,0 +1,34 @@
+name: PR Labeler
+
+# Applies labels to PRs based on the files they touch, using the glob->label
+# mapping in .github/labeler.yml.
+#
+# WARNING:
+# This workflow uses pull_request_target so it can label PRs from forks (the
+# default GITHUB_TOKEN only has write access under pull_request_target, not
+# pull_request). It does NOT check out or execute any code from the PR: the
+# labeler action reads the changed-file list and the config from the base
+# branch via the API only. Do not add a checkout of the PR ref here.
+
+on:
+  pull_request_target:
+    types: [opened, reopened, synchronize]
+    branches:
+      - main
+
+jobs:
+  label:
+    runs-on:
+      group: databricks-deco-testing-runner-group
+      labels: ubuntu-latest-deco
+
+    permissions:
+      contents: read
+      pull-requests: write
+
+    steps:
+      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          # Only add labels; never remove labels that were applied manually or by other automation.
+          sync-labels: false
diff --git a/.github/workflows/maintainer-approval.js b/.github/workflows/maintainer-approval.js
deleted file mode 100644
index 38371f8cdcb..00000000000
--- a/.github/workflows/maintainer-approval.js
+++ /dev/null
@@ -1,597 +0,0 @@
-const path = require("path");
-const { execSync } = require("child_process");
-const {
-  parseOwnersFile,
-  findOwners,
-  getMaintainers,
-  getOwnershipGroups,
-} = require("../scripts/owners");
-
-// --- Approval helpers ---
-
-/**
- * Check if an approver is a member of a GitHub team.
- * Requires org read access on the token; falls back to false if unavailable.
- */
-async function isTeamMember(github, org, teamSlug, login, core) {
-  try {
-    const { data } = await github.rest.teams.getMembershipForUserInOrg({
-      org,
-      team_slug: teamSlug,
-      username: login,
-    });
-    return data.state === "active";
-  } catch (err) {
-    if (err.status === 404) {
-      return false;
-    }
-    if (core) {
-      core.warning(
-        `Could not verify team membership for ${login} in ${org}/${teamSlug} ` +
-        `(HTTP ${err.status || "unknown"}). Team-based approval may not work ` +
-        `without a token with org:read scope.`
-      );
-    }
-    return false;
-  }
-}
-
-/**
- * Find which approver (if any) satisfies a group's ownership requirement.
- * Returns the login of the first matching approver, or null.
- */
-async function findGroupApprover(owners, approverLogins, github, org, core) {
-  const approverSet = new Set(approverLogins.map(l => l.toLowerCase()));
-  for (const owner of owners) {
-    if (owner.includes("/")) {
-      const teamSlug = owner.split("/")[1];
-      for (const approver of approverLogins) {
-        if (await isTeamMember(github, org, teamSlug, approver, core)) {
-          return approver;
-        }
-      }
-    } else if (approverSet.has(owner.toLowerCase())) {
-      return owner;
-    }
-  }
-  return null;
-}
-
-/**
- * Per-path approval check. Each ownership group needs at least one
- * approval from its owners. Files matching only "*" require a maintainer.
- * Returns groups, approvedBy map, and coverage info.
- */
-async function checkPerPathApproval(files, rulesWithTeams, approverLogins, github, org, core) {
-  const groups = getOwnershipGroups(files.map(f => f.filename), rulesWithTeams);
-  const approvedBy = new Map();
-
-  if (groups.has("*")) {
-    // Still check non-wildcard groups for comment building
-    for (const [pattern, { owners }] of groups) {
-      if (pattern === "*") continue;
-      const approver = await findGroupApprover(owners, approverLogins, github, org, core);
-      if (approver) approvedBy.set(pattern, approver);
-    }
-    return {
-      allCovered: false,
-      hasWildcardFiles: true,
-      wildcardFiles: groups.get("*").files,
-      groups,
-      approvedBy,
-    };
-  }
-
-  const uncovered = [];
-  for (const [pattern, { owners }] of groups) {
-    const approver = await findGroupApprover(owners, approverLogins, github, org, core);
-    if (approver) {
-      approvedBy.set(pattern, approver);
-    } else {
-      uncovered.push({ pattern, owners });
-    }
-  }
-  return { allCovered: uncovered.length === 0, uncovered, groups, approvedBy };
-}
-
-// --- Git history & scoring helpers ---
-
-const MENTION_REVIEWERS = false;
-const OWNERS_LINK = "[OWNERS](.github/OWNERS)";
-const MARKER = "<!-- MAINTAINER_APPROVAL -->";
-const STATUS_CONTEXT = "maintainer-approval";
-
-const loginCache = {};
-
-function classifyFile(filepath, totalFiles) {
-  const base = path.basename(filepath);
-  if (base.startsWith("out.") || base === "output.txt") {
-    return 0.01 / Math.max(totalFiles, 1);
-  }
-  if (filepath.startsWith("acceptance/") || filepath.startsWith("integration/")) {
-    return 0.2;
-  }
-  if (filepath.endsWith("_test.go")) return 0.3;
-  return filepath.endsWith(".go") ? 1.0 : 0.5;
-}
-
-function gitLog(filepath) {
-  try {
-    const out = execSync(
-      `git log -50 --no-merges --since="12 months ago" --format="%H|%an|%aI" -- "${filepath}"`,
-      { encoding: "utf-8" }
-    );
-    const entries = [];
-    for (const line of out.split("\n")) {
-      const trimmed = line.trim();
-      if (!trimmed) continue;
-      const parts = trimmed.split("|", 3);
-      if (parts.length !== 3) continue;
-      const date = new Date(parts[2]);
-      if (isNaN(date.getTime())) continue;
-      entries.push({ sha: parts[0], name: parts[1], date });
-    }
-    return entries;
-  } catch {
-    return [];
-  }
-}
-
-async function resolveLogin(github, owner, repo, sha, authorName) {
-  if (authorName in loginCache) return loginCache[authorName];
-  try {
-    const { data } = await github.rest.repos.getCommit({ owner, repo, ref: sha });
-    const login = data.author?.login || null;
-    loginCache[authorName] = login;
-    return login;
-  } catch {
-    loginCache[authorName] = null;
-    return null;
-  }
-}
-
-function parseOwnersForFiles(changedFiles, ownersPath) {
-  const rules = parseOwnersFile(ownersPath, { includeTeams: true });
-  const allOwners = new Set();
-  for (const filepath of changedFiles) {
-    for (const o of findOwners(filepath, rules)) allOwners.add(o);
-  }
-  return Array.from(allOwners).sort();
-}
-
-async function scoreContributors(files, prAuthor, now, github, owner, repo) {
-  const scores = {};
-  const dirScores = {};
-  let scoredCount = 0;
-  const authorLogin = (prAuthor || "").toLowerCase();
-  const totalFiles = files.length;
-
-  for (const filepath of files) {
-    const weight = classifyFile(filepath, totalFiles);
-    let history = gitLog(filepath);
-    if (history.length === 0) {
-      const parent = path.dirname(filepath);
-      if (parent && parent !== ".") {
-        history = gitLog(parent);
-      }
-    }
-    if (history.length === 0) continue;
-
-    const topDir = path.dirname(filepath) || ".";
-    let fileContributed = false;
-    for (const { sha, name, date } of history) {
-      if (name.endsWith("[bot]")) continue;
-      const login = await resolveLogin(github, owner, repo, sha, name);
-      if (!login || login.toLowerCase() === authorLogin) continue;
-      const daysAgo = Math.max(0, (now - date) / 86400000);
-      const s = weight * Math.pow(0.5, daysAgo / 150);
-      scores[login] = (scores[login] || 0) + s;
-      if (!dirScores[login]) dirScores[login] = {};
-      dirScores[login][topDir] = (dirScores[login][topDir] || 0) + s;
-      fileContributed = true;
-    }
-    if (fileContributed) scoredCount++;
-  }
-  return { scores, dirScores, scoredCount };
-}
-
-function topDirs(ds, n = 3) {
-  return Object.entries(ds || {})
-    .sort((a, b) => b[1] - a[1])
-    .slice(0, n)
-    .map(([d]) => d);
-}
-
-function fmtReviewer(login, dirs) {
-  const dirList = dirs.map((d) => `\`${d}/\``).join(", ");
-  return `- ${fmtLogin(login)} -- recent work in ${dirList}`;
-}
-
-function selectReviewers(ss) {
-  if (ss.length === 0) return [];
-  const out = [ss[0]];
-  if (ss.length >= 2 && ss[0][1] < 1.5 * ss[1][1]) {
-    out.push(ss[1]);
-    if (ss.length >= 3 && ss[1][1] < 1.5 * ss[2][1]) {
-      out.push(ss[2]);
-    }
-  }
-  return out;
-}
-
-function fmtEligible(owners) {
-  return owners.map((o) => fmtLogin(o)).join(", ");
-}
-
-function fmtLogin(login) {
-  if (MENTION_REVIEWERS) return `@${login}`;
-  return `\`@${login}\``;
-}
-
-async function countRecentReviews(github, owner, repo, logins, days = 30) {
-  const since = new Date(Date.now() - days * 86400000)
-    .toISOString()
-    .slice(0, 10);
-  const counts = {};
-  for (const login of logins) {
-    try {
-      const { data } = await github.rest.search.issuesAndPullRequests({
-        q: `repo:${owner}/${repo} reviewed-by:${login} is:pr created:>${since}`,
-      });
-      counts[login] = data.total_count;
-    } catch {
-      // skip on error
-    }
-  }
-  return counts;
-}
-
-async function selectRoundRobin(github, owner, repo, eligibleOwners, prAuthor) {
-  const candidates = eligibleOwners
-    .filter((o) => !o.includes("/") && o.toLowerCase() !== (prAuthor || "").toLowerCase());
-  if (candidates.length === 0) return null;
-  const counts = await countRecentReviews(github, owner, repo, candidates);
-  if (Object.keys(counts).length === 0) {
-    return candidates[Math.floor(Math.random() * candidates.length)];
-  }
-  return candidates.reduce((best, c) =>
-    (counts[c] || 0) < (counts[best] || 0) ? c : best
-  );
-}
-
-// --- Comment builders ---
-
-function fmtFileList(files) {
-  if (files.length < 4) {
-    return `Files: ${files.map(f => `\`${f}\``).join(", ")}`;
-  }
-  return `${files.length} files changed`;
-}
-
-function buildPendingPerGroupComment(groups, scores, dirScores, approvedBy, maintainers, prAuthor) {
-  const authorLower = (prAuthor || "").toLowerCase();
-  const lines = [MARKER, "## Approval status: pending", ""];
-
-  for (const [pattern, { owners, files }] of groups) {
-    if (pattern === "*") continue;
-
-    const approver = approvedBy.get(pattern);
-    if (approver) {
-      lines.push(`### \`${pattern}\` - approved by ${fmtLogin(approver)}`);
-    } else {
-      lines.push(`### \`${pattern}\` - needs approval`);
-    }
-    lines.push(fmtFileList(files));
-
-    const teams = owners.filter(o => o.includes("/"));
-    const individuals = owners.filter(o => !o.includes("/") && o.toLowerCase() !== authorLower);
-
-    if (teams.length > 0) {
-      lines.push(`Teams: ${teams.map(t => fmtLogin(t)).join(", ")}`);
-    }
-
-    if (!approver && individuals.length > 0) {
-      const scored = individuals.map(o => [o, scores[o] || 0]).sort((a, b) => b[1] - a[1]);
-      if (scored[0][1] > 0) {
-        lines.push(`Suggested: ${fmtLogin(scored[0][0])}`);
-        const rest = scored.slice(1).map(([o]) => o);
-        if (rest.length > 0) {
-          lines.push(`Also eligible: ${fmtEligible(rest)}`);
-        }
-      } else {
-        lines.push(`Eligible: ${fmtEligible(individuals)}`);
-      }
-    }
-    lines.push("");
-  }
-
-  const starGroup = groups.get("*");
-  if (starGroup) {
-    lines.push("### General files (require maintainer)");
-    lines.push(fmtFileList(starGroup.files));
-
-    const maintainerSet = new Set(maintainers.map(m => m.toLowerCase()));
-    const maintainerScores = Object.entries(scores)
-      .filter(([login]) =>
-        login.toLowerCase() !== authorLower && maintainerSet.has(login.toLowerCase())
-      )
-      .sort((a, b) => b[1] - a[1]);
-
-    if (maintainerScores.length > 0 && maintainerScores[0][1] > 0) {
-      const [login] = maintainerScores[0];
-      const dirs = topDirs(dirScores[login]);
-      lines.push("Based on git history:");
-      lines.push(fmtReviewer(login, dirs));
-    } else {
-      lines.push(`Pick a maintainer from ${OWNERS_LINK}.`);
-    }
-    lines.push("");
-  }
-
-  const maintainerList = maintainers
-    .filter(m => m.toLowerCase() !== authorLower)
-    .map(m => fmtLogin(m))
-    .join(", ");
-
-  lines.push(
-    `<sub>Any maintainer (${maintainerList}) can approve all areas.`,
-    `See ${OWNERS_LINK} for ownership rules.</sub>`
-  );
-
-  return lines.join("\n") + "\n";
-}
-
-function buildSingleDomainPendingComment(sortedScores, dirScores, scoredCount, eligibleOwners, prAuthor, roundRobinReviewer) {
-  const reviewers = selectReviewers(sortedScores);
-  const suggestedLogins = new Set(reviewers.map(([login]) => login.toLowerCase()));
-  const eligible = eligibleOwners.filter(
-    o => o.toLowerCase() !== (prAuthor || "").toLowerCase() && !suggestedLogins.has(o.toLowerCase())
-  );
-
-  const lines = [MARKER, "## Waiting for approval", ""];
-
-  if (reviewers.length > 0) {
-    lines.push("Based on git history, these people are best suited to review:", "");
-    for (const [login] of reviewers) {
-      lines.push(fmtReviewer(login, topDirs(dirScores[login])));
-    }
-    lines.push("");
-  } else if (roundRobinReviewer) {
-    lines.push(
-      "Could not determine reviewers from git history.",
-      `Round-robin suggestion: ${fmtLogin(roundRobinReviewer)}`,
-      ""
-    );
-  }
-
-  if (eligible.length > 0) {
-    lines.push(`Eligible reviewers: ${fmtEligible(eligible)}`, "");
-  }
-
-  lines.push(`<sub>Suggestions based on git history. See ${OWNERS_LINK} for ownership rules.</sub>`);
-  return lines.join("\n") + "\n";
-}
-
-// --- Comment management ---
-
-const LEGACY_MARKER = "<!-- REVIEWER_SUGGESTION -->";
-
-/**
- * Delete all marker and legacy marker comments from the PR.
- * Used on success paths to clean up stale pending comments.
- */
-async function deleteMarkerComments(github, owner, repo, prNumber) {
-  const comments = await github.paginate(github.rest.issues.listComments, {
-    owner, repo, issue_number: prNumber,
-  });
-  for (const c of comments) {
-    if (c.body && (c.body.includes(MARKER) || c.body.includes(LEGACY_MARKER))) {
-      await github.rest.issues.deleteComment({
-        owner, repo, comment_id: c.id,
-      });
-    }
-  }
-}
-
-/**
- * Create or edit the marker comment. Skips the edit if the body is unchanged.
- * Cleans up duplicate or legacy marker comments, keeping only the first one.
- */
-async function upsertComment(github, owner, repo, prNumber, newBody) {
-  const comments = await github.paginate(github.rest.issues.listComments, {
-    owner, repo, issue_number: prNumber,
-  });
-  const markerComments = comments.filter(c =>
-    c.body && (c.body.includes(MARKER) || c.body.includes(LEGACY_MARKER))
-  );
-
-  if (markerComments.length > 0) {
-    const existing = markerComments[0];
-
-    // Clean up duplicates (legacy or accidental), keep the first.
-    for (const c of markerComments.slice(1)) {
-      await github.rest.issues.deleteComment({
-        owner, repo, comment_id: c.id,
-      });
-    }
-
-    // Skip if body is unchanged.
-    if (existing.body === newBody) return;
-
-    await github.rest.issues.updateComment({
-      owner, repo, comment_id: existing.id, body: newBody,
-    });
-    return;
-  }
-
-  await github.rest.issues.createComment({
-    owner, repo, issue_number: prNumber, body: newBody,
-  });
-}
-
-// --- Main ---
-
-module.exports = async ({ github, context, core }) => {
-  const ownersPath = path.join(
-    process.env.GITHUB_WORKSPACE,
-    ".github",
-    "OWNERS"
-  );
-  const rulesWithTeams = parseOwnersFile(ownersPath, { includeTeams: true });
-  const maintainers = getMaintainers(rulesWithTeams);
-
-  if (maintainers.length === 0) {
-    core.setFailed(
-      "Could not determine maintainers from .github/OWNERS (no * rule found)."
-    );
-    return;
-  }
-
-  const { pull_request: pr } = context.payload;
-  const owner = context.repo.owner;
-  const repo = context.repo.repo;
-  const prNumber = context.issue.number;
-  const authorLogin = pr?.user?.login;
-  const sha = pr.head.sha;
-  const checkParams = {
-    owner: context.repo.owner,
-    repo: context.repo.repo,
-    head_sha: sha,
-    name: STATUS_CONTEXT,
-  };
-
-  const reviews = await github.paginate(github.rest.pulls.listReviews, {
-    owner: context.repo.owner,
-    repo: context.repo.repo,
-    pull_number: context.issue.number,
-  });
-
-  // Maintainer approval -> success with simple comment
-  const maintainerApproval = reviews.find(
-    ({ state, user }) =>
-      state === "APPROVED" && user && maintainers.includes(user.login)
-  );
-  if (maintainerApproval) {
-    const approver = maintainerApproval.user.login;
-    core.info(`Maintainer approval from @${approver}`);
-    await github.rest.checks.create({
-      ...checkParams,
-      status: "completed",
-      conclusion: "success",
-      output: { title: STATUS_CONTEXT, summary: `Approved by @${approver}` },
-    });
-    await deleteMarkerComments(github, owner, repo, prNumber);
-    return;
-  }
-
-  // Maintainer-authored PR with any approval -> success
-  if (authorLogin && maintainers.includes(authorLogin)) {
-    const hasAnyApproval = reviews.some(
-      ({ state, user }) =>
-        state === "APPROVED" && user && user.login !== authorLogin
-    );
-    if (hasAnyApproval) {
-      core.info(`Maintainer-authored PR approved by a reviewer.`);
-      await github.rest.checks.create({
-        ...checkParams,
-        status: "completed",
-        conclusion: "success",
-        output: { title: STATUS_CONTEXT, summary: "Approved (maintainer-authored PR)" },
-      });
-      await deleteMarkerComments(github, owner, repo, prNumber);
-      return;
-    }
-  }
-
-  // Gather approved logins (excluding the PR author).
-  const approverLogins = reviews
-    .filter(
-      ({ state, user }) =>
-        state === "APPROVED" && user && user.login !== authorLogin
-    )
-    .map(({ user }) => user.login);
-
-  const files = await github.paginate(github.rest.pulls.listFiles, {
-    owner: context.repo.owner,
-    repo: context.repo.repo,
-    pull_number: context.issue.number,
-  });
-
-  const result = await checkPerPathApproval(
-    files,
-    rulesWithTeams,
-    approverLogins,
-    github,
-    context.repo.owner,
-    core
-  );
-
-  // Approved PRs get a success check run and return early.
-  // Pending PRs intentionally create NO check run or status. The required
-  // status check "maintainer-approval" stays as "Expected" (yellow dot) in
-  // the GitHub UI, which blocks the merge until approval is granted.
-  if (result.allCovered && approverLogins.length > 0) {
-    core.info("All ownership groups have per-path approval.");
-    await github.rest.checks.create({
-      ...checkParams,
-      status: "completed",
-      conclusion: "success",
-      output: { title: STATUS_CONTEXT, summary: "All ownership groups approved" },
-    });
-    await deleteMarkerComments(github, owner, repo, prNumber);
-    return;
-  }
-
-  if (result.hasWildcardFiles) {
-    const fileList = result.wildcardFiles.join(", ");
-    core.info(
-      `Files need maintainer review: ${fileList}. ` +
-      `Maintainers: ${maintainers.join(", ")}`
-    );
-  } else if (result.uncovered && result.uncovered.length > 0) {
-    const groupList = result.uncovered
-      .map(({ pattern, owners }) => `${pattern} (needs: ${owners.join(", ")})`)
-      .join("; ");
-    core.info(
-      `Needs approval: ${groupList}. ` +
-      `Alternatively, any maintainer can approve: ${maintainers.join(", ")}.`
-    );
-  } else {
-    core.info(`Waiting for maintainer approval: ${maintainers.join(", ")}`);
-  }
-
-  // Score contributors via git history
-  const fileNames = files.map(f => f.filename);
-  const now = new Date();
-  const { scores, dirScores, scoredCount } = await scoreContributors(
-    fileNames,
-    authorLogin,
-    now,
-    github,
-    owner,
-    repo
-  );
-  const sortedScores = Object.entries(scores).sort((a, b) => b[1] - a[1]);
-
-  // Build pending comment with reviewer suggestions.
-  let comment;
-  const groups = result.groups;
-
-  if (groups.size >= 2) {
-    comment = buildPendingPerGroupComment(
-      groups, scores, dirScores, result.approvedBy, maintainers, authorLogin
-    );
-  } else {
-    const eligible = parseOwnersForFiles(fileNames, ownersPath);
-    let roundRobin = null;
-    if (selectReviewers(sortedScores).length === 0 && eligible.length > 0) {
-      roundRobin = await selectRoundRobin(github, owner, repo, eligible, authorLogin);
-    }
-    comment = buildSingleDomainPendingComment(
-      sortedScores, dirScores, scoredCount, eligible, authorLogin, roundRobin
-    );
-  }
-
-  core.info(comment);
-  await upsertComment(github, owner, repo, prNumber, comment);
-};
diff --git a/.github/workflows/maintainer-approval.test.js b/.github/workflows/maintainer-approval.test.js
deleted file mode 100644
index 2866dc9d3d7..00000000000
--- a/.github/workflows/maintainer-approval.test.js
+++ /dev/null
@@ -1,561 +0,0 @@
-const { describe, it, before, after } = require("node:test");
-const assert = require("node:assert/strict");
-const fs = require("fs");
-const os = require("os");
-const path = require("path");
-
-const runModule = require("./maintainer-approval");
-
-// --- Test helpers ---
-
-function makeTmpOwners(content, ownerTeamsContent) {
-  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "approval-test-"));
-  const ghDir = path.join(tmpDir, ".github");
-  fs.mkdirSync(ghDir);
-  fs.writeFileSync(path.join(ghDir, "OWNERS"), content);
-  if (ownerTeamsContent) {
-    fs.writeFileSync(path.join(ghDir, "OWNERTEAMS"), ownerTeamsContent);
-  }
-  return tmpDir;
-}
-
-const OWNERTEAMS_CONTENT = "team:eng-apps-devex @teamdev1 @teamdev2\n";
-
-const OWNERS_CONTENT = [
-  "* @maintainer1 @maintainer2",
-  "/cmd/pipelines/ @jefferycheng1 @kanterov",
-  "/cmd/apps/ team:eng-apps-devex",
-  "/bundle/ @bundleowner",
-].join("\n");
-
-function makeContext({ author = "someuser", sha = "abc123", prNumber = 42 } = {}) {
-  return {
-    repo: { owner: "databricks", repo: "cli" },
-    issue: { number: prNumber },
-    payload: {
-      pull_request: {
-        number: prNumber,
-        user: { login: author },
-        head: { sha },
-      },
-    },
-  };
-}
-
-function makeCore() {
-  const log = { info: [], warning: [], failed: [] };
-  return {
-    info: (msg) => log.info.push(msg),
-    warning: (msg) => log.warning.push(msg),
-    setFailed: (msg) => log.failed.push(msg),
-    _log: log,
-  };
-}
-
-/**
- * Build a mock GitHub API object.
- *
- * @param {Object} opts
- * @param {Array} opts.reviews - PR reviews to return
- * @param {Array} opts.files - PR files to return (objects with .filename)
- * @param {Object} opts.teamMembers - { teamSlug: [logins] }
- * @param {Array} opts.existingComments - Existing PR comments to return
- */
-function makeGithub({ reviews = [], files = [], teamMembers = {}, existingComments = [] } = {}) {
-  const listReviews = Symbol("listReviews");
-  const listFiles = Symbol("listFiles");
-  const listComments = Symbol("listComments");
-  const checkRuns = [];
-  const createdComments = [];
-  const updatedComments = [];
-  const deletedCommentIds = [];
-
-  const github = {
-    paginate: async (endpoint, _opts) => {
-      if (endpoint === listReviews) return reviews;
-      if (endpoint === listFiles) return files;
-      if (endpoint === listComments) return existingComments;
-      return [];
-    },
-    rest: {
-      pulls: {
-        listReviews,
-        listFiles,
-      },
-      checks: {
-        create: async (params) => {
-          checkRuns.push(params);
-        },
-      },
-      issues: {
-        listComments,
-        deleteComment: async (params) => {
-          deletedCommentIds.push(params.comment_id);
-        },
-        createComment: async (params) => {
-          createdComments.push(params);
-        },
-        updateComment: async (params) => {
-          updatedComments.push(params);
-        },
-      },
-      teams: {
-        getMembershipForUserInOrg: async ({ team_slug, username }) => {
-          if (teamMembers[team_slug]?.includes(username)) {
-            return { data: { state: "active" } };
-          }
-          const err = new Error("Not found");
-          err.status = 404;
-          throw err;
-        },
-      },
-    },
-    _checkRuns: checkRuns,
-    _comments: createdComments,
-    _updatedComments: updatedComments,
-    _deletedCommentIds: deletedCommentIds,
-  };
-  return github;
-}
-
-// --- Tests ---
-
-describe("maintainer-approval", () => {
-  let tmpDir;
-  let originalWorkspace;
-
-  before(() => {
-    originalWorkspace = process.env.GITHUB_WORKSPACE;
-    tmpDir = makeTmpOwners(OWNERS_CONTENT, OWNERTEAMS_CONTENT);
-    process.env.GITHUB_WORKSPACE = tmpDir;
-  });
-
-  after(() => {
-    if (originalWorkspace !== undefined) {
-      process.env.GITHUB_WORKSPACE = originalWorkspace;
-    } else {
-      delete process.env.GITHUB_WORKSPACE;
-    }
-    fs.rmSync(tmpDir, { recursive: true });
-  });
-
-  it("maintainer approved -> success, no comment", async () => {
-    const github = makeGithub({
-      reviews: [
-        { state: "APPROVED", user: { login: "maintainer1" } },
-      ],
-      files: [{ filename: "cmd/pipelines/foo.go" }],
-    });
-    const core = makeCore();
-    const context = makeContext();
-
-    await runModule({ github, context, core });
-
-    assert.equal(github._checkRuns.length, 1);
-    assert.equal(github._checkRuns[0].conclusion, "success");
-    assert.ok(github._checkRuns[0].output.summary.includes("maintainer1"));
-    assert.equal(github._comments.length, 0);
-    assert.equal(github._updatedComments.length, 0);
-  });
-
-  it("approval cleans up stale pending comment", async () => {
-    const github = makeGithub({
-      reviews: [
-        { state: "APPROVED", user: { login: "maintainer1" } },
-      ],
-      files: [{ filename: "cmd/pipelines/foo.go" }],
-      existingComments: [
-        { id: 500, body: "<!-- MAINTAINER_APPROVAL -->\n## Waiting for approval\n..." },
-      ],
-    });
-    const core = makeCore();
-    const context = makeContext();
-
-    await runModule({ github, context, core });
-
-    assert.equal(github._checkRuns[0].conclusion, "success");
-    assert.deepEqual(github._deletedCommentIds, [500]);
-    assert.equal(github._comments.length, 0);
-    assert.equal(github._updatedComments.length, 0);
-  });
-
-  it("maintainer-authored PR with any approval -> success, no comment", async () => {
-    const github = makeGithub({
-      reviews: [
-        { state: "APPROVED", user: { login: "randomreviewer" } },
-      ],
-      files: [{ filename: "cmd/pipelines/foo.go" }],
-    });
-    const core = makeCore();
-    const context = makeContext({ author: "maintainer1" });
-
-    await runModule({ github, context, core });
-
-    assert.equal(github._checkRuns.length, 1);
-    assert.equal(github._checkRuns[0].conclusion, "success");
-    assert.ok(github._checkRuns[0].output.summary.includes("maintainer-authored"));
-    assert.equal(github._comments.length, 0);
-    assert.equal(github._updatedComments.length, 0);
-  });
-
-  it("single domain, owner approved -> success, no comment", async () => {
-    const github = makeGithub({
-      reviews: [
-        { state: "APPROVED", user: { login: "jefferycheng1" } },
-      ],
-      files: [
-        { filename: "cmd/pipelines/foo.go" },
-        { filename: "cmd/pipelines/bar.go" },
-      ],
-    });
-    const core = makeCore();
-    const context = makeContext();
-
-    await runModule({ github, context, core });
-
-    assert.equal(github._checkRuns.length, 1);
-    assert.equal(github._checkRuns[0].conclusion, "success");
-    assert.equal(github._comments.length, 0);
-    assert.equal(github._updatedComments.length, 0);
-  });
-
-  it("cross-domain, both approved -> success, no comment", async () => {
-    const github = makeGithub({
-      reviews: [
-        { state: "APPROVED", user: { login: "jefferycheng1" } },
-        { state: "APPROVED", user: { login: "bundleowner" } },
-      ],
-      files: [
-        { filename: "cmd/pipelines/foo.go" },
-        { filename: "bundle/config.go" },
-      ],
-    });
-    const core = makeCore();
-    const context = makeContext();
-
-    await runModule({ github, context, core });
-
-    assert.equal(github._checkRuns.length, 1);
-    assert.equal(github._checkRuns[0].conclusion, "success");
-    assert.equal(github._comments.length, 0);
-    assert.equal(github._updatedComments.length, 0);
-  });
-
-  it("cross-domain, one missing -> pending", async () => {
-    const github = makeGithub({
-      reviews: [
-        { state: "APPROVED", user: { login: "jefferycheng1" } },
-      ],
-      files: [
-        { filename: "cmd/pipelines/foo.go" },
-        { filename: "bundle/config.go" },
-      ],
-    });
-    const core = makeCore();
-    const context = makeContext();
-
-    await runModule({ github, context, core });
-
-    // No check run created; the required check stays as "Expected" (yellow dot).
-    assert.equal(github._checkRuns.length, 0);
-  });
-
-  it("wildcard files present -> pending, no check run", async () => {
-    const github = makeGithub({
-      reviews: [
-        { state: "APPROVED", user: { login: "randomreviewer" } },
-      ],
-      files: [{ filename: "README.md" }],
-    });
-    const core = makeCore();
-    const context = makeContext();
-
-    await runModule({ github, context, core });
-
-    assert.equal(github._checkRuns.length, 0);
-  });
-
-  it("no approvals at all -> pending, no check run", async () => {
-    const github = makeGithub({
-      reviews: [],
-      files: [{ filename: "cmd/pipelines/foo.go" }],
-    });
-    const core = makeCore();
-    const context = makeContext();
-
-    await runModule({ github, context, core });
-
-    assert.equal(github._checkRuns.length, 0);
-  });
-
-  it("OWNERTEAMS member approved -> success for team-owned path", async () => {
-    const github = makeGithub({
-      reviews: [
-        { state: "APPROVED", user: { login: "teamdev1" } },
-      ],
-      files: [{ filename: "cmd/apps/main.go" }],
-    });
-    const core = makeCore();
-    const context = makeContext();
-
-    await runModule({ github, context, core });
-
-    assert.equal(github._checkRuns.length, 1);
-    assert.equal(github._checkRuns[0].conclusion, "success");
-  });
-
-  it("non-OWNERTEAMS-member approval for team-owned path -> pending", async () => {
-    const github = makeGithub({
-      reviews: [
-        { state: "APPROVED", user: { login: "outsider" } },
-      ],
-      files: [{ filename: "cmd/apps/main.go" }],
-    });
-    const core = makeCore();
-    const context = makeContext();
-
-    await runModule({ github, context, core });
-
-    assert.equal(github._checkRuns.length, 0);
-  });
-
-  it("CHANGES_REQUESTED does not count as approval", async () => {
-    const github = makeGithub({
-      reviews: [
-        { state: "CHANGES_REQUESTED", user: { login: "jefferycheng1" } },
-      ],
-      files: [{ filename: "cmd/pipelines/foo.go" }],
-    });
-    const core = makeCore();
-    const context = makeContext();
-
-    await runModule({ github, context, core });
-
-    assert.equal(github._checkRuns.length, 0);
-  });
-
-  it("self-approval by PR author is excluded", async () => {
-    const github = makeGithub({
-      reviews: [
-        { state: "APPROVED", user: { login: "jefferycheng1" } },
-      ],
-      files: [{ filename: "cmd/pipelines/foo.go" }],
-    });
-    const core = makeCore();
-    const context = makeContext({ author: "jefferycheng1" });
-
-    await runModule({ github, context, core });
-
-    assert.equal(github._checkRuns.length, 0);
-  });
-
-  it("no * rule in OWNERS -> setFailed", async () => {
-    const noWildcardDir = makeTmpOwners("/cmd/pipelines/ @jefferycheng1\n");
-    const oldWorkspace = process.env.GITHUB_WORKSPACE;
-    process.env.GITHUB_WORKSPACE = noWildcardDir;
-
-    const github = makeGithub({ reviews: [], files: [] });
-    const core = makeCore();
-    const context = makeContext();
-
-    await runModule({ github, context, core });
-
-    assert.equal(core._log.failed.length, 1);
-    assert.ok(core._log.failed[0].includes("maintainers"));
-
-    process.env.GITHUB_WORKSPACE = oldWorkspace;
-    fs.rmSync(noWildcardDir, { recursive: true });
-  });
-
-  // --- Comment upsert tests ---
-
-  it("creates comment with MARKER when none exists", async () => {
-    const github = makeGithub({
-      reviews: [],
-      files: [{ filename: "cmd/pipelines/foo.go" }],
-    });
-    const core = makeCore();
-    const context = makeContext();
-
-    await runModule({ github, context, core });
-
-    assert.equal(github._comments.length, 1);
-    assert.ok(github._comments[0].body.includes("<!-- MAINTAINER_APPROVAL -->"));
-    assert.equal(github._updatedComments.length, 0);
-    assert.equal(github._deletedCommentIds.length, 0);
-  });
-
-  it("edits existing comment in place when body changes", async () => {
-    const github = makeGithub({
-      reviews: [],
-      files: [{ filename: "cmd/pipelines/foo.go" }],
-      existingComments: [
-        { id: 999, body: "<!-- MAINTAINER_APPROVAL -->\nOld comment" },
-      ],
-    });
-    const core = makeCore();
-    const context = makeContext();
-
-    await runModule({ github, context, core });
-
-    assert.equal(github._updatedComments.length, 1);
-    assert.equal(github._updatedComments[0].comment_id, 999);
-    assert.ok(github._updatedComments[0].body.includes("<!-- MAINTAINER_APPROVAL -->"));
-    assert.equal(github._comments.length, 0);
-    assert.equal(github._deletedCommentIds.length, 0);
-  });
-
-  it("skips edit when comment body is unchanged", async () => {
-    // Stub Math.random so selectRoundRobin is deterministic across runs.
-    const origRandom = Math.random;
-    Math.random = () => 0.5;
-    try {
-      // First, run once to capture the comment body.
-      const github1 = makeGithub({
-        reviews: [],
-        files: [{ filename: "cmd/pipelines/foo.go" }],
-      });
-      const core1 = makeCore();
-      await runModule({ github: github1, context: makeContext(), core: core1 });
-      const expectedBody = github1._comments[0].body;
-
-      // Second run with that body as the existing comment.
-      const github2 = makeGithub({
-        reviews: [],
-        files: [{ filename: "cmd/pipelines/foo.go" }],
-        existingComments: [
-          { id: 100, body: expectedBody },
-        ],
-      });
-      const core2 = makeCore();
-      await runModule({ github: github2, context: makeContext(), core: core2 });
-
-      assert.equal(github2._comments.length, 0);
-      assert.equal(github2._updatedComments.length, 0);
-      assert.equal(github2._deletedCommentIds.length, 0);
-    } finally {
-      Math.random = origRandom;
-    }
-  });
-
-  it("cleans up duplicate marker comments, keeps the first", async () => {
-    const github = makeGithub({
-      reviews: [],
-      files: [{ filename: "cmd/pipelines/foo.go" }],
-      existingComments: [
-        { id: 100, body: "<!-- MAINTAINER_APPROVAL -->\nFirst" },
-        { id: 200, body: "<!-- MAINTAINER_APPROVAL -->\nDuplicate" },
-        { id: 300, body: "<!-- REVIEWER_SUGGESTION -->\nLegacy" },
-      ],
-    });
-    const core = makeCore();
-    const context = makeContext();
-
-    await runModule({ github, context, core });
-
-    // Duplicates deleted, first one edited.
-    assert.deepEqual(github._deletedCommentIds.sort(), [200, 300]);
-    assert.equal(github._updatedComments.length, 1);
-    assert.equal(github._updatedComments[0].comment_id, 100);
-    assert.equal(github._comments.length, 0);
-  });
-
-  it("does not touch comments without the marker", async () => {
-    const github = makeGithub({
-      reviews: [],
-      files: [{ filename: "cmd/pipelines/foo.go" }],
-      existingComments: [
-        { id: 888, body: "Some unrelated comment" },
-      ],
-    });
-    const core = makeCore();
-    const context = makeContext();
-
-    await runModule({ github, context, core });
-
-    assert.equal(github._deletedCommentIds.length, 0);
-    assert.equal(github._updatedComments.length, 0);
-    assert.equal(github._comments.length, 1);
-  });
-
-  it("pending single-domain comment includes waiting header", async () => {
-    const github = makeGithub({
-      reviews: [],
-      files: [{ filename: "cmd/pipelines/foo.go" }],
-    });
-    const core = makeCore();
-    const context = makeContext();
-
-    await runModule({ github, context, core });
-
-    assert.equal(github._comments.length, 1);
-    assert.ok(github._comments[0].body.includes("## Waiting for approval"));
-  });
-
-  it("pending cross-domain comment includes per-group sections", async () => {
-    const github = makeGithub({
-      reviews: [
-        { state: "APPROVED", user: { login: "jefferycheng1" } },
-      ],
-      files: [
-        { filename: "cmd/pipelines/foo.go" },
-        { filename: "bundle/config.go" },
-      ],
-    });
-    const core = makeCore();
-    const context = makeContext();
-
-    await runModule({ github, context, core });
-
-    assert.equal(github._comments.length, 1);
-    const body = github._comments[0].body;
-    assert.ok(body.includes("## Approval status: pending"));
-    assert.ok(body.includes("`/cmd/pipelines/`"));
-    assert.ok(body.includes("`/bundle/`"));
-    assert.ok(body.includes("approved by `@jefferycheng1`"));
-    assert.ok(body.includes("needs approval"));
-  });
-
-  it("lists individual files when fewer than 4 in a group", async () => {
-    const github = makeGithub({
-      reviews: [],
-      files: [
-        { filename: "cmd/pipelines/foo.go" },
-        { filename: "bundle/config.go" },
-        { filename: "bundle/deploy.go" },
-      ],
-    });
-    const core = makeCore();
-    const context = makeContext();
-
-    await runModule({ github, context, core });
-
-    assert.equal(github._comments.length, 1);
-    const body = github._comments[0].body;
-    assert.ok(body.includes("Files:"), "should list individual files");
-    assert.ok(body.includes("`bundle/config.go`"));
-    assert.ok(body.includes("`bundle/deploy.go`"));
-  });
-
-  it("shows file count instead of listing when 4 or more files in a group", async () => {
-    const github = makeGithub({
-      reviews: [],
-      files: [
-        { filename: "cmd/pipelines/foo.go" },
-        { filename: "bundle/a.go" },
-        { filename: "bundle/b.go" },
-        { filename: "bundle/c.go" },
-        { filename: "bundle/d.go" },
-      ],
-    });
-    const core = makeCore();
-    const context = makeContext();
-
-    await runModule({ github, context, core });
-
-    assert.equal(github._comments.length, 1);
-    const body = github._comments[0].body;
-    assert.ok(body.includes("4 files changed"), "should show count for bundle group");
-    assert.ok(!body.includes("`bundle/a.go`"), "should not list individual bundle files");
-  });
-});
diff --git a/.github/workflows/maintainer-approval.yml b/.github/workflows/maintainer-approval.yml
deleted file mode 100644
index b9f0b6e3053..00000000000
--- a/.github/workflows/maintainer-approval.yml
+++ /dev/null
@@ -1,70 +0,0 @@
-name: PR approval
-
-on:
-  pull_request_target:
-    types: [opened, synchronize, reopened, ready_for_review]
-  pull_request_review:
-    types: [submitted, dismissed]
-  merge_group:
-    types: [checks_requested]
-
-concurrency:
-  group: pr-approval-${{ github.event.pull_request.number || github.event.merge_group.head_sha }}
-  cancel-in-progress: true
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  # Auto-approve maintainer-approval for merge queue entries.
-  # PRs are already approved before entering the merge queue,
-  # so we just need to set the status on the merge queue commit.
-  merge-queue-approval:
-    if: ${{ github.event_name == 'merge_group' }}
-    runs-on:
-      group: databricks-deco-testing-runner-group
-      labels: ubuntu-latest-deco
-    permissions:
-      checks: write
-    steps:
-      - name: Auto-approve for merge queue
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            await github.rest.checks.create({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              head_sha: context.sha,
-              name: 'maintainer-approval',
-              status: 'completed',
-              conclusion: 'success',
-              output: {
-                title: 'maintainer-approval',
-                summary: 'Auto-approved (merge queue)',
-              },
-            });
-
-  check:
-    runs-on:
-      group: databricks-deco-testing-runner-group
-      labels: ubuntu-latest-deco
-    if: ${{ github.event_name != 'merge_group' && !github.event.pull_request.draft }}
-    timeout-minutes: 5
-    permissions:
-      pull-requests: write
-      checks: write
-      contents: read
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: ${{ github.event.pull_request.base.sha }}
-          persist-credentials: false
-          fetch-depth: 0
-      - name: Check approval and suggest reviewers
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          retries: 3
-          script: |-
-            const script = require('./.github/workflows/maintainer-approval.js');
-            await script({ context, github, core });
diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index 2be5811c93c..b0e084950c2 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -14,7 +14,7 @@ on:
     branches:
       - main
   schedule:
-    - cron: '0 0,12 * * *' # Runs at 00:00 and 12:00 UTC daily
+    - cron: '0 0 * * *' # Runs at 00:00 UTC daily
 
 env:
   GOTESTSUM_FORMAT: github-actions
@@ -37,12 +37,12 @@ jobs:
       targets: ${{ steps.mask1.outputs.targets || steps.mask2.outputs.targets || steps.mask3.outputs.targets }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
       - name: Setup Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: tools/go.mod
 
@@ -77,7 +77,7 @@ jobs:
 
     # Only run if the target is in the list of targets from testmask
     if: ${{ contains(fromJSON(needs.testmask.outputs.targets), 'test') }}
-    name: "task test (${{matrix.os.name}}, ${{matrix.deployment}})"
+    name: "task test (${{matrix.os.name}}, ${{matrix.deployment.name}})"
     runs-on: ${{ matrix.os.runner }}
 
     defaults:
@@ -111,9 +111,14 @@ jobs:
             runner:
               labels: macos-latest
 
+        # Each cell runs the suite once. envfilter picks the variants it covers: the plain
+        # cell excludes the deployment-history recording variant (DMS=true), which the
+        # directdms cell covers, so bundle/test.toml's DMS matrix does not run every test twice.
         deployment:
-          - "terraform"
-          - "direct"
+          - name: "direct"
+            envfilter: "DMS="
+          - name: "directdms"
+            envfilter: "DMS=true"
 
         # Include "event_name" in the matrix so we can include/exclude based on it.
         event:
@@ -130,43 +135,68 @@ jobs:
 
     steps:
       - name: Checkout repository and submodules
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup build environment
         uses: ./.github/actions/setup-build-environment
         with:
-          cache-key: test-${{ matrix.deployment }}
+          cache-key: test-${{ matrix.deployment.name }}
+
+      # Make origin/main available with enough history for `git diff --merge-base
+      # origin/main`, which the acceptance subset selector uses to always run the
+      # tests this PR adds/changes on the windows/macOS cells. actions/checkout does
+      # a shallow single-ref clone by default, so origin/main is otherwise absent and
+      # the diff fails, silently disabling change detection. This must run AFTER
+      # setup-build-environment, whose own checkout would re-shallow the repo. Only
+      # PRs subset tests, so the fetch is unnecessary elsewhere.
+      - name: Fetch origin/main for change detection
+        if: ${{ github.event_name == 'pull_request' }}
+        run: |
+          git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main
+          if [ "$(git rev-parse --is-shallow-repository)" = "true" ]; then
+            git fetch --no-tags --unshallow origin
+          fi
 
-      - name: Run tests without coverage
-        # We run tests without coverage on PR, merge_group, and schedule because we don't make use of coverage information
-        # and would like to run the tests as fast as possible. We run it on schedule as well, because that is what
-        # populates the cache and cache may include test results.
-        if: ${{ github.event_name == 'pull_request' || github.event_name == 'merge_group' || github.event_name == 'schedule' }}
+      - name: Run tests
         env:
-          ENVFILTER: DATABRICKS_BUNDLE_ENGINE=${{ matrix.deployment }}
+          ENVFILTER: ${{ matrix.deployment.envfilter }}
+          # On pull requests, run only a subset of acceptance subtests on the slower
+          # windows/macOS cells so neither lands on the critical path to merge. An
+          # empty percentage disables subsetting, so Linux PRs and push-to-main run
+          # the full suite (full coverage on every OS). The percentages are fixed and
+          # tuned to keep windows/macOS under the Linux wall-clock time. The seed is
+          # the head commit, so a re-run of the same commit repeats the subset while a
+          # new commit reshuffles it.
+          TESTS_SELECT_SUBSET_SEED: ${{ github.event.pull_request.head.sha }}
+          TESTS_SELECT_SUBSET_PCT: ${{ github.event_name == 'pull_request' && (matrix.os.name == 'windows' && '10' || matrix.os.name == 'macos' && '60') || '' }}
         run: go tool -modfile=tools/task/go.mod task test
 
-      - name: Run tests with coverage
-        # Only run 'task cover' on push to main to make sure it does not get broken.
-        if: ${{ github.event_name == 'push' }}
-        env:
-          ENVFILTER: DATABRICKS_BUNDLE_ENGINE=${{ matrix.deployment }}
-        run: go tool -modfile=tools/task/go.mod task cover
-
       - name: Upload gotestsum JSON output
         # Always upload so we can inspect timing even if tests fail.
         if: ${{ always() }}
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: test-output-${{ matrix.os.name }}-${{ matrix.deployment }}
+          name: test-output-${{ matrix.os.name }}-${{ matrix.deployment.name }}
           path: test-output.json
           if-no-files-found: warn
           retention-days: 7
 
-      - name: Check out.test.toml files are up to date
+      # `task test` prints a lot of output that GitHub is slow to render, so
+      # surface just the failed test names on the job summary page (and in this
+      # step's log) for a quick read of what broke.
+      - name: Summarize failed tests
+        if: ${{ failure() }}
+        run: uv run tools/summarize_failed_tests.py test-output.json | tee -a "$GITHUB_STEP_SUMMARY"
+
+      - name: Check no files changed or appeared after running tests
         run: |
+          # Register untracked files with intent-to-add so `git diff` reports them
+          # too; a plain `git diff` ignores new files, which is how a missing
+          # out.test.toml previously slipped through. Ignored test artifacts are
+          # unaffected because intent-to-add respects .gitignore.
+          git add --intent-to-add .
           if ! git diff --exit-code; then
-            echo "ERROR: detected changed files in the repository; Most likely you have out.test.toml files that are out of date. Run 'go test ./acceptance -run \"^TestAccept$\" -only-out-test-toml' to update."
+            echo "ERROR: detected changed or new files in the repository; Most likely you have out.test.toml files that are out of date. Run 'go test ./acceptance -run \"^TestAccept$\" -only-out-test-toml' to update."
             exit 1
           fi
 
@@ -209,7 +239,7 @@ jobs:
 
     steps:
       - name: Checkout repository and submodules
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup build environment
         uses: ./.github/actions/setup-build-environment
@@ -261,13 +291,20 @@ jobs:
 
     steps:
       - name: Checkout repository and submodules
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup build environment
         uses: ./.github/actions/setup-build-environment
         with:
           cache-key: test-exp-ssh
 
+      # The ssh acceptance test drives a real sshd behind the tunnel; the runner
+      # ships only the client. Install it on Linux (the OS the test is gated to);
+      # elsewhere and in the general test job it skips via SKIP_TEST.
+      - name: Install OpenSSH server
+        if: runner.os == 'Linux'
+        run: sudo apt-get update && sudo apt-get install -y openssh-server
+
       - name: Run tests
         run: |
           go tool -modfile=tools/task/go.mod task test-exp-ssh
@@ -313,7 +350,7 @@ jobs:
 
     steps:
       - name: Checkout repository and submodules
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup build environment
         uses: ./.github/actions/setup-build-environment
@@ -324,6 +361,58 @@ jobs:
         run: |
           go tool -modfile=tools/task/go.mod task test-pipelines
 
+  test-sandbox:
+    needs:
+      - cleanups
+      - testmask
+
+    # Only run if the target is in the list of targets from testmask
+    if: ${{ contains(fromJSON(needs.testmask.outputs.targets), 'test-sandbox') }}
+    name: "task test-sandbox (${{matrix.os.name}})"
+    runs-on: ${{ matrix.os.runner }}
+
+    defaults:
+      run:
+        shell: bash
+
+    permissions:
+      id-token: write
+      contents: read
+
+    env:
+      TASK_CONCURRENCY: ${{ matrix.os.name == 'windows' && '1' || '' }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - name: linux
+            runner:
+              group: databricks-protected-runner-group-large
+              labels: linux-ubuntu-latest-large
+
+          - name: windows
+            runner:
+              group: databricks-protected-runner-group-large
+              labels: windows-server-latest-large
+
+          - name: macos
+            runner:
+              labels: macos-latest
+
+    steps:
+      - name: Checkout repository and submodules
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Setup build environment
+        uses: ./.github/actions/setup-build-environment
+        with:
+          cache-key: test-sandbox
+
+      - name: Run tests
+        run: |
+          go tool -modfile=tools/task/go.mod task test-sandbox
+
   # This job groups the result of all the above test jobs.
   # It is a required check, so it blocks auto-merge and the merge queue.
   #
@@ -339,6 +428,7 @@ jobs:
       - test-exp-aitools
       - test-exp-ssh
       - test-pipelines
+      - test-sandbox
 
     if: ${{ always() }}
     name: test-result
@@ -352,62 +442,37 @@ jobs:
           fi
           echo "All tests passed ✅"
 
-  validate-generated-is-up-to-date:
+  validate-generated:
     needs: cleanups
     runs-on: ubuntu-latest
 
-    steps:
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Setup Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
-        with:
-          go-version-file: go.mod
-          # Use different schema from regular job, to avoid overwriting the same key
-          cache-dependency-path: |
-            go.sum
-            bundle/internal/schema/*.*
-
-      - name: Verify that the schema is up to date
-        run: |
-          if ! ( go tool -modfile=tools/task/go.mod task --force generate-schema && git diff --exit-code ); then
-            echo "The schema is not up to date. Please run './task generate-schema' and commit the changes."
-            exit 1
-          fi
-
-      - name: Verify that the generated enum and required fields are up to date
-        run: |
-          if ! ( go tool -modfile=tools/task/go.mod task --force generate-validation && git diff --exit-code ); then
-            echo "The generated enum and required fields are not up to date. Please run './task generate-validation' and commit the changes."
-            exit 1
-          fi
-
-  validate-python-codegen:
-    needs: cleanups
-    runs-on: ubuntu-latest
+    # Required by setup-jfrog (GOPROXY exchange) inside setup-build-environment.
+    permissions:
+      id-token: write
+      contents: read
 
     steps:
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Setup Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
-        with:
-          go-version-file: go.mod
+      - name: Checkout repository and submodules
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+      # Dedicated cache-key so this job's Go cache doesn't evict the primary
+      # test caches from the 10 GB GHA quota.
+      - name: Setup build environment
+        uses: ./.github/actions/setup-build-environment
         with:
-          version: "0.6.5"
-
-      - name: Verify that python/codegen is up to date
-        run: |-
-          go tool -modfile=tools/task/go.mod task pydabs-codegen
+          cache-key: validate-generated
 
-          if ! ( git diff --exit-code ); then
-            echo "Generated Python code is not up-to-date. Please run './task pydabs-codegen' and commit the changes."
+      - name: Download Go modules
+        run: go mod download
 
+      - name: Verify that generated files are up to date
+        run: |
+          go tool -modfile=tools/task/go.mod task --force generate-check
+          # Register untracked files with intent-to-add so `git diff` reports new
+          # files (e.g. a newly generated command) too, not just modifications.
+          git add --intent-to-add .
+          if ! git diff --exit-code; then
+            echo "Generated files are not up to date. Please run './task generate-check' and commit the changes."
             exit 1
           fi
 
@@ -432,7 +497,13 @@ jobs:
       checks: write
       contents: read
 
-    environment: "test-trigger-is"
+    # Use the environment only to gate its secrets; skip creating a deployment
+    # object so these runs don't post "deployed to test-trigger-is" items on the
+    # pull request timeline. See:
+    # https://docs.github.com/en/actions/how-tos/deploy/configure-and-manage-deployments/control-deployments#using-environments-without-deployments
+    environment:
+      name: "test-trigger-is"
+      deployment: false
 
     steps:
       - name: Generate GitHub App Token (check runs)
@@ -440,7 +511,7 @@ jobs:
           (github.event_name == 'merge_group') ||
           (github.event_name == 'pull_request' && !contains(fromJSON(needs.testmask.outputs.targets), 'test') && !contains(fromJSON(needs.testmask.outputs.targets), 'test-exp-ssh'))
         id: generate-check-token
-        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           app-id: ${{ secrets.DECO_TEST_APPROVAL_APP_ID }}
           private-key: ${{ secrets.DECO_TEST_APPROVAL_PRIVATE_KEY }}
@@ -507,12 +578,18 @@ jobs:
     permissions:
       contents: read
 
-    environment: "test-trigger-is"
+    # Use the environment only to gate its secrets; skip creating a deployment
+    # object so these runs don't post "deployed to test-trigger-is" items on the
+    # pull request timeline. See:
+    # https://docs.github.com/en/actions/how-tos/deploy/configure-and-manage-deployments/control-deployments#using-environments-without-deployments
+    environment:
+      name: "test-trigger-is"
+      deployment: false
 
     steps:
       - name: Generate GitHub App Token
         id: generate-token
-        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           app-id: ${{ secrets.DECO_WORKFLOW_TRIGGER_APP_ID }}
           private-key: ${{ secrets.DECO_WORKFLOW_TRIGGER_PRIVATE_KEY }}
@@ -529,6 +606,10 @@ jobs:
             -f pull_request_number=${{ github.event.pull_request.number }} \
             -f commit_sha=${{ github.event.pull_request.head.sha }}
 
+      # Dispatch the nightly workflow; as a workflow_dispatch event it runs
+      # integration-short (CloudSlow still skips via -short, but the whole acceptance
+      # suite runs against real clouds, unlike the PR task which only runs the
+      # acceptance tests the PR touches).
       - name: Trigger integration tests (push to main)
         if: ${{ github.event_name == 'push' }}
         env:
diff --git a/.github/workflows/python_push.yml b/.github/workflows/python_push.yml
index be62bcd22be..1a391719665 100644
--- a/.github/workflows/python_push.yml
+++ b/.github/workflows/python_push.yml
@@ -1,25 +1,57 @@
 name: python build
 
 on:
+  # Keep workflow triggers unrestricted so skipped jobs satisfy required checks.
+  # The change filter includes the shared fixture consumed by Python tests.
   pull_request:
     types: [opened, synchronize]
-    paths:
-      - python/**
   merge_group:
     types: [checks_requested]
-    paths:
-      - python/**
   push:
-    # Always run on push to main. The build cache can only be reused
-    # if it was saved by a run from the repository's default branch.
-    # The run result will be identical to that from the merge queue
-    # because the commit is identical, yet we need to perform it to
-    # seed the build cache.
+    # Run relevant Python jobs on main to seed build caches that can be reused
+    # by pull request and merge queue runs.
     branches:
       - main
 
 jobs:
+  changes:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    outputs:
+      python: ${{ steps.changes.outputs.python }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Detect Python changes
+        id: changes
+        shell: bash
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha || github.event.before }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.event.merge_group.head_sha || github.event.after }}
+        run: |
+          changed_files=$(git diff --name-only "$BASE_SHA...$HEAD_SHA" -- \
+            .github/workflows/python_push.yml \
+            Taskfile.yml \
+            acceptance/bundle/python/ \
+            go.mod \
+            go.sum \
+            libs/dyn/dynvar/testdata/reference_vectors.json \
+            python/ \
+            tools/task/ \
+          )
+          if [[ -n "$changed_files" ]]; then
+            echo "python=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "python=false" >> "$GITHUB_OUTPUT"
+          fi
+
   python_tests:
+    needs: changes
+    if: ${{ always() && (needs.changes.result != 'success' || needs.changes.outputs.python == 'true') }}
     name: tests
     runs-on: ubuntu-latest
 
@@ -29,16 +61,22 @@ jobs:
         pyVersion: ['3.10', '3.11', '3.12', '3.13']
 
     steps:
+      - name: Fail if change detection did not succeed
+        if: ${{ needs.changes.result != 'success' }}
+        run: |
+          echo "Python change detection did not succeed"
+          exit 1
+
       - name: Checkout repository and submodules
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
 
       - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
         with:
           python-version: ${{ matrix.pyVersion }}
           version: "0.6.5"
@@ -47,20 +85,28 @@ jobs:
         run: go tool -modfile=tools/task/go.mod task pydabs-test
 
   python_linters:
+    needs: changes
+    if: ${{ always() && (needs.changes.result != 'success' || needs.changes.outputs.python == 'true') }}
     name: lint
     runs-on: ubuntu-latest
 
     steps:
+      - name: Fail if change detection did not succeed
+        if: ${{ needs.changes.result != 'success' }}
+        run: |
+          echo "Python change detection did not succeed"
+          exit 1
+
       - name: Checkout repository and submodules
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
 
       - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
         with:
           version: "0.6.5"
 
@@ -68,20 +114,28 @@ jobs:
         run: go tool -modfile=tools/task/go.mod task pydabs-lint
 
   python_docs:
+    needs: changes
+    if: ${{ always() && (needs.changes.result != 'success' || needs.changes.outputs.python == 'true') }}
     name: docs
     runs-on: ubuntu-latest
 
     steps:
+      - name: Fail if change detection did not succeed
+        if: ${{ needs.changes.result != 'success' }}
+        run: |
+          echo "Python change detection did not succeed"
+          exit 1
+
       - name: Checkout repository and submodules
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
 
       - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
         with:
           version: "0.6.5"
 
diff --git a/.github/workflows/regression-report.yml b/.github/workflows/regression-report.yml
new file mode 100644
index 00000000000..7b69e2680c6
--- /dev/null
+++ b/.github/workflows/regression-report.yml
@@ -0,0 +1,168 @@
+name: Regression report
+
+# Runs the acceptance tests a PR changed against main and the latest release, and posts the
+# result as a PR comment (see `./task regr`). A new commit updates the same comment.
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+# A newer commit supersedes the run in progress, so an old report never overwrites a new one.
+concurrency:
+  group: regression-report-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  # The tests are selected from changes under acceptance/ (see acceptance/internal/selection),
+  # so a PR without any skips the expensive job. A comment left by an earlier commit that did
+  # change them is deleted here, as the expensive job no longer runs to do it.
+  changes:
+    # Fork PRs get a read-only token and cannot comment.
+    if: >-
+      !github.event.pull_request.head.repo.fork &&
+      github.actor != 'dependabot[bot]'
+
+    # The org's IP allow list only lets this runner group call the GitHub API.
+    runs-on:
+      group: databricks-deco-testing-runner-group
+      labels: ubuntu-latest-deco
+
+    permissions:
+      contents: read
+      pull-requests: write
+
+    outputs:
+      acceptance: ${{ steps.changes.outputs.acceptance }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      # The same diff the selection makes (see selection.FromGit): the merge commit GitHub checks
+      # out for the PR against its merge base with origin/main.
+      - name: Detect acceptance test changes
+        id: changes
+        run: |
+          if [[ -n "$(git diff --name-only --merge-base origin/main HEAD -- acceptance/)" ]]; then
+            echo "acceptance=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "acceptance=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Delete the report comment of an earlier commit
+        if: ${{ steps.changes.outputs.acceptance == 'false' }}
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |-
+            const { owner, repo } = context.repo;
+            const comments = await github.paginate(github.rest.issues.listComments, {
+              owner, repo, issue_number: context.issue.number,
+            });
+            const existing = comments.find(c =>
+              c.user.login === 'github-actions[bot]' && c.body && c.body.startsWith('<!-- regression-test-report -->'));
+            if (existing) {
+              await github.rest.issues.deleteComment({ owner, repo, comment_id: existing.id });
+            }
+
+  regression-report:
+    needs: changes
+    if: ${{ needs.changes.outputs.acceptance == 'true' }}
+
+    runs-on:
+      group: databricks-deco-testing-runner-group
+      labels: ubuntu-latest-deco
+
+    permissions:
+      id-token: write
+      contents: read
+      pull-requests: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Setup build environment
+        uses: ./.github/actions/setup-build-environment
+        with:
+          # The Go cache is only saved by runs on main, and this workflow never runs there,
+          # so it reuses the key push.yml saves for its Linux test job.
+          cache-key: test-direct
+
+      # `git diff --merge-base origin/main` needs origin/main and enough history. This must run
+      # AFTER setup-build-environment, whose own checkout would re-shallow the repo.
+      - name: Fetch origin/main
+        run: |
+          git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main
+          if [ "$(git rev-parse --is-shallow-repository)" = "true" ]; then
+            git fetch --no-tags --unshallow origin
+          fi
+
+      - name: Run regression tests
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: go tool -modfile=tools/task/go.mod task regr
+
+      - name: Upload report
+        if: ${{ always() }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: regression-report
+          path: regression_report.md
+          if-no-files-found: ignore
+          retention-days: 7
+
+      # No report means no acceptance tests are changed (anymore), so there is nothing to
+      # comment: drop the comment of an earlier commit instead of leaving it stale.
+      - name: Post, update or delete PR comment
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |-
+            const fs = require('fs');
+            const path = process.env.GITHUB_WORKSPACE + '/regression_report.md';
+
+            // Other comments by the same bot are left alone: ours is found by this marker.
+            const MARKER = '<!-- regression-test-report -->';
+            const { owner, repo } = context.repo;
+            const issue_number = context.issue.number;
+            const comments = await github.paginate(github.rest.issues.listComments, {
+              owner, repo, issue_number,
+            });
+            const existing = comments.find(c =>
+              c.user.login === 'github-actions[bot]' && c.body && c.body.startsWith(MARKER));
+
+            if (!fs.existsSync(path)) {
+              if (existing) {
+                await github.rest.issues.deleteComment({ owner, repo, comment_id: existing.id });
+              }
+              return;
+            }
+
+            const sha = context.payload.pull_request.head.sha;
+            const runUrl = `${context.serverUrl}/${owner}/${repo}/actions/runs/${context.runId}`;
+            const commitUrl = `${context.serverUrl}/${owner}/${repo}/commit/${sha}`;
+
+            // Comments are limited to 65536 characters; the artifact holds the full report. The table
+            // comes first, then one <details> block per failure: drop whole blocks that do not fit,
+            // as cutting one in the middle would leave its markup open.
+            const MAX_REPORT = 60000;
+            let report = fs.readFileSync(path, 'utf8');
+            if (report.length > MAX_REPORT) {
+              const [head, ...blocks] = report.split('<details>\n');
+              let kept = head;
+              let shown = 0;
+              for (const block of blocks) {
+                if (kept.length + block.length > MAX_REPORT) break;
+                kept += '<details>\n' + block;
+                shown++;
+              }
+              report = kept + `_${blocks.length - shown} more failure details omitted, see the full report in the [run](${runUrl})._\n`;
+            }
+
+            const body = `${MARKER}\nCommit: [\`${sha.slice(0, 9)}\`](${commitUrl}) | [Workflow run](${runUrl})\n\n${report}`;
+
+            if (existing) {
+              await github.rest.issues.updateComment({ owner, repo, comment_id: existing.id, body });
+            } else {
+              await github.rest.issues.createComment({ owner, repo, issue_number, body });
+            }
diff --git a/.github/workflows/release-build.yml b/.github/workflows/release-build.yml
index 1ebbf6f1859..1c6e38bfa62 100644
--- a/.github/workflows/release-build.yml
+++ b/.github/workflows/release-build.yml
@@ -35,7 +35,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           fetch-tags: true
@@ -45,7 +45,7 @@ jobs:
       # composite actions (e.g. setup-jfrog) and the goreleaser config are
       # available even when the built ref is an older tag that predates them.
       - name: Checkout workflow ref for local actions
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.sha }}
           path: .workflow-actions
@@ -57,7 +57,7 @@ jobs:
         uses: ./.workflow-actions/.github/actions/setup-jfrog
 
       - name: Setup Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache-dependency-path: |
@@ -68,7 +68,7 @@ jobs:
         run: go mod download
 
       - name: Setup Java
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           distribution: temurin
           java-version: '21'
@@ -107,7 +107,7 @@ jobs:
 
       # Use --snapshot for branch builds (non-tag refs).
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@e24998b8b67b290c2fa8b7c14fcfa7de2c5c9b8c # v7.1.0
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
         with:
           version: v2.14.3
           args: release ${{ !inputs.publish && '--skip=publish' || '' }} --config .workflow-actions/.goreleaser.yaml --skip=docker ${{ (!startsWith(github.ref, 'refs/tags/') && !inputs.tag) && '--snapshot' || '' }}
@@ -148,7 +148,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           fetch-tags: true
@@ -158,7 +158,7 @@ jobs:
       # composite actions (e.g. setup-jfrog) and the goreleaser config are
       # available even when the built ref is an older tag that predates them.
       - name: Checkout workflow ref for local actions
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.sha }}
           path: .workflow-actions
@@ -170,7 +170,7 @@ jobs:
         uses: ./.workflow-actions/.github/actions/setup-jfrog
 
       - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
         with:
           version: "0.6.5"
 
diff --git a/.github/workflows/release-docker.yml b/.github/workflows/release-docker.yml
index 45d05bc7ae1..d16d6bfdb64 100644
--- a/.github/workflows/release-docker.yml
+++ b/.github/workflows/release-docker.yml
@@ -37,18 +37,18 @@ jobs:
 
     steps:
       - name: Checkout repository at release tag
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.tag }}
 
       - name: Set up QEMU for cross-platform builds
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
 
       - name: Create a buildx builder with multi-platform support
         run: docker buildx create --use --driver docker-container
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -77,7 +77,6 @@ jobs:
           cp /tmp/cli_amd64/databricks ./databricks
           docker buildx build \
             --platform linux/amd64 \
-            --build-arg ARCH=amd64 \
             --tag "ghcr.io/databricks/cli:${{ steps.version.outputs.version }}-amd64" \
             --push .
           rm databricks
@@ -87,7 +86,6 @@ jobs:
           cp /tmp/cli_arm64/databricks ./databricks
           docker buildx build \
             --platform linux/arm64 \
-            --build-arg ARCH=arm64 \
             --tag "ghcr.io/databricks/cli:${{ steps.version.outputs.version }}-arm64" \
             --push .
           rm databricks
diff --git a/.github/workflows/release-prs.yml b/.github/workflows/release-prs.yml
index c7f41dcb375..f42b9d07670 100644
--- a/.github/workflows/release-prs.yml
+++ b/.github/workflows/release-prs.yml
@@ -230,6 +230,16 @@ jobs:
         if: ${{ !inputs.dry_run }}
         run: echo "$RUNNER_TEMP/komac" >> $GITHUB_PATH
 
+      # komac creates the winget PR branch in the fork at upstream's HEAD commit; when
+      # the fork's default branch drifts far behind, GitHub rejects the branch creation
+      # with a misleading CreateRef permissions error. Fast-forward the fork first.
+      - name: Sync winget-pkgs fork with upstream
+        if: ${{ !inputs.dry_run }}
+        run: komac sync-fork
+        env:
+          KOMAC_FORK_OWNER: eng-dev-ecosystem-bot
+          GITHUB_TOKEN: ${{ secrets.ENG_DEV_ECOSYSTEM_BOT_TOKEN }}
+
       - name: Publish to Winget
         if: ${{ !inputs.dry_run }}
         run: |
diff --git a/.github/workflows/release-pydabs-docs.yml b/.github/workflows/release-pydabs-docs.yml
new file mode 100644
index 00000000000..e073331cb57
--- /dev/null
+++ b/.github/workflows/release-pydabs-docs.yml
@@ -0,0 +1,102 @@
+name: release-pydabs-docs
+
+# Rebuild the PyDABs Python reference docs after every release and publish the
+# HTML to the `gh-pages` branch (served at https://databricks.github.io/cli/python/).
+# The docs are NOT kept on main — `gh-pages` is their published home, and until
+# now it was refreshed by hand. The generated `.rst` pages live on main; this
+# workflow just runs the Sphinx build and copies the output onto `gh-pages`.
+
+on:
+  push:
+    tags:
+      - "v[0-9]+.[0-9]+.[0-9]+*"
+
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  # Required by setup-jfrog (GOPROXY exchange).
+  id-token: write
+
+jobs:
+  update-pydabs-docs:
+    runs-on:
+      group: databricks-protected-runner-group
+      labels: linux-ubuntu-latest
+
+    steps:
+      - name: Checkout main
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # Build runs against `main`. fetch-tags lets the workflow_dispatch path
+          # below resolve the most recent release tag for the commit message.
+          ref: main
+          fetch-tags: true
+
+      - name: Setup JFrog
+        uses: ./.github/actions/setup-jfrog
+
+      - name: Setup Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          version: "0.6.5"
+
+      - name: Determine release tag
+        id: tag
+        env:
+          REF_TYPE: ${{ github.ref_type }}
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          if [ "$REF_TYPE" = "tag" ]; then
+            tag="$REF_NAME"
+          else
+            # git tag --list uses fnmatch (no `+`), so post-filter with grep
+            # to match the same shape as the trigger above.
+            tag=$(git tag --list 'v*' --sort=-version:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+' | head -n 1)
+          fi
+          if [ -z "$tag" ]; then
+            echo "Could not determine a release tag to publish for." >&2
+            exit 1
+          fi
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
+          echo "Publishing for tag $tag"
+
+      - name: Check out gh-pages worktree
+        run: |
+          git fetch origin gh-pages
+          git worktree add "$RUNNER_TEMP/ghpages" origin/gh-pages
+
+      - name: Build the PyDABs docs
+        run: go tool -modfile=tools/task/go.mod task pydabs-docs
+
+      # gh-pages holds the Sphinx output under python/; replace it wholesale so a
+      # dropped resource loses its page. Only python/ is touched — the top-level
+      # .nojekyll, index.html, and experimental/ are left as-is.
+      - name: Copy built docs into the gh-pages worktree
+        run: |
+          rm -rf "$RUNNER_TEMP/ghpages/python"
+          mkdir -p "$RUNNER_TEMP/ghpages/python"
+          cp -R python/docs/_output/. "$RUNNER_TEMP/ghpages/python/"
+
+      - name: Stage regenerated docs on gh-pages
+        working-directory: ${{ runner.temp }}/ghpages
+        run: git add -A python
+
+      - name: Commit and push to gh-pages
+        working-directory: ${{ runner.temp }}/ghpages
+        env:
+          TAG: ${{ steps.tag.outputs.tag }}
+        run: |-
+          if git diff --cached --quiet; then
+            echo "gh-pages already up to date for ${TAG}; nothing to commit."
+            exit 0
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git commit -m "Update PyDABs reference docs for ${TAG}"
+          git push origin HEAD:gh-pages
diff --git a/.github/workflows/start-integration-tests.yml b/.github/workflows/start-integration-tests.yml
index 22a39916113..2a01d623a4b 100644
--- a/.github/workflows/start-integration-tests.yml
+++ b/.github/workflows/start-integration-tests.yml
@@ -13,12 +13,18 @@ jobs:
       group: databricks-deco-testing-runner-group
       labels: ubuntu-latest-deco
 
-    environment: "test-trigger-is"
+    # Use the environment only to gate its secrets; skip creating a deployment
+    # object so these runs don't post "deployed to test-trigger-is" items on the
+    # pull request timeline. See:
+    # https://docs.github.com/en/actions/how-tos/deploy/configure-and-manage-deployments/control-deployments#using-environments-without-deployments
+    environment:
+      name: "test-trigger-is"
+      deployment: false
 
     steps:
       - name: Generate GitHub App Token for Workflow Trigger
         id: generate-token
-        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           app-id: ${{ secrets.DECO_WORKFLOW_TRIGGER_APP_ID }}
           private-key: ${{ secrets.DECO_WORKFLOW_TRIGGER_PRIVATE_KEY }}
@@ -27,7 +33,7 @@ jobs:
 
       - name: Generate GitHub App Token for Check Updates
         id: generate-check-token
-        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           app-id: ${{ secrets.DECO_TEST_APPROVAL_APP_ID }}
           private-key: ${{ secrets.DECO_TEST_APPROVAL_PRIVATE_KEY }}
diff --git a/.github/workflows/tagging.yml b/.github/workflows/tagging.yml
index cbb9cfb591c..73b3ca2d662 100644
--- a/.github/workflows/tagging.yml
+++ b/.github/workflows/tagging.yml
@@ -4,7 +4,12 @@ name: tagging
 on:
   # Manual dispatch.
   workflow_dispatch:
-  # No inputs are required for the manual dispatch.
+    inputs:
+      packages:
+        description: 'Comma-separated list of packages to tag (e.g. "pkg1,pkg2"). Leave empty to tag all packages with pending releases.'
+        required: false
+        type: string
+        default: ''
 
   # NOTE: Temporarily disable automated releases.
   #
@@ -29,10 +34,26 @@ jobs:
       github.repository == 'databricks/databricks-sdk-go' ||
       github.repository == 'databricks/databricks-sdk-py' ||
       github.repository == 'databricks/databricks-sdk-java'
+    env:
+      # Ref the release is cut from. Releasing from a branch is currently
+      # supported in the terraform-provider-databricks and cli repositories:
+      # for those two this follows the dispatched branch
+      # (``github.ref_name``), so a release can be cut from a branch other
+      # than main; every other synced repo (SDK go/py/java, …) stays pinned
+      # to main, preserving the pre-existing hardcoded-main behaviour and
+      # blocking branch releases even via a manual non-main dispatch.
+      RELEASE_REF: ${{ (github.repository == 'databricks/terraform-provider-databricks' || github.repository == 'databricks/cli') && github.ref_name || 'main' }}
+      # Changelog source. databricks/cli builds the release changelog from
+      # per-PR ``.nextchanges/<section>/*.md`` fragments and a
+      # ``.nextchanges/version`` file rather than a single hand-maintained
+      # ``NEXT_CHANGELOG.md`` (see internal/genkit/tagging.py's nextchanges mode). Setting this
+      # to the fragment directory name opts that repo in; every other synced
+      # repo leaves it empty and keeps the ``NEXT_CHANGELOG.md`` flow unchanged.
+      NEXTCHANGES_DIR: ${{ github.repository == 'databricks/cli' && '.nextchanges' || '' }}
     environment: "release-is"
     runs-on:
-      group: databricks-deco-testing-runner-group
-      labels: ubuntu-latest-deco
+      group: databricks-protected-runner-group
+      labels: linux-ubuntu-latest
     steps:
       - name: Generate GitHub App Token
         id: generate-token
@@ -44,6 +65,19 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          # Check out the release ref. ``RELEASE_REF`` is the dispatched
+          # branch for terraform-provider-databricks and cli, and ``main`` for every
+          # other repo (see the job-level ``env``). For scheduled runs and
+          # manual dispatches left at defaults this is the default branch
+          # (main); dispatching terraform or cli with ``--ref <branch>`` cuts the
+          # release from that branch instead.
+          #
+          # Naming the ref explicitly (rather than omitting ``ref:``)
+          # forces re-resolution of the branch head at step time. Without
+          # it, checkout pins to ``github.sha`` — the SHA frozen at
+          # workflow_dispatch time — so re-running a stale dispatch would
+          # check out an older commit even when newer ones exist.
+          ref: ${{ env.RELEASE_REF }}
           fetch-depth: 0
           token: ${{ steps.generate-token.outputs.token }}
 
@@ -54,10 +88,34 @@ jobs:
           git config user.email "DECO-SDK-Tagging[bot]@users.noreply.github.com"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
 
       - name: Run script
         env:
           GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
           GITHUB_REPOSITORY: ${{ github.repository }}
-        run: uv run --locked internal/genkit/tagging.py
+          PACKAGES: ${{ inputs.packages }}
+          # Branch the release is cut from. internal/genkit/tagging.py commits the
+          # changelog bump and creates the tag on this branch, and its
+          # concurrent-advance guard checks this branch. Matches the ref
+          # checked out above (``RELEASE_REF``): the dispatched branch for
+          # terraform and cli, main everywhere else.
+          DECO_TAGGING_REF: ${{ env.RELEASE_REF }}
+          # Non-empty only for databricks/cli (see job-level env). When set,
+          # internal/genkit/tagging.py renders the changelog from ``$NEXTCHANGES_DIR/`` fragments
+          # instead of ``NEXT_CHANGELOG.md``.
+          NEXTCHANGES_DIR: ${{ env.NEXTCHANGES_DIR }}
+        run: |
+          if [ -n "$PACKAGES" ]; then
+            uv run --locked internal/genkit/tagging.py --package "$PACKAGES"
+          else
+            uv run --locked internal/genkit/tagging.py
+          fi
+
+      - name: Upload created tags artifact
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: created-tags
+          path: created_tags.json
+          if-no-files-found: ignore
diff --git a/.github/workflows/test-owners-scripts.yml b/.github/workflows/test-owners-scripts.yml
deleted file mode 100644
index 14acbb6df0d..00000000000
--- a/.github/workflows/test-owners-scripts.yml
+++ /dev/null
@@ -1,25 +0,0 @@
-name: Test OWNERS scripts
-
-on:
-  pull_request:
-    paths:
-      - '.github/scripts/**'
-      - '.github/workflows/maintainer-approval.js'
-      - '.github/workflows/maintainer-approval.test.js'
-      - '.github/OWNERS'
-
-jobs:
-  test:
-    runs-on:
-      group: databricks-deco-testing-runner-group
-      labels: ubuntu-latest-deco
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          sparse-checkout: |
-            .github/scripts
-            .github/workflows
-            .github/OWNERS
-      - name: Run OWNERS script tests
-        run: node --test .github/scripts/owners.test.js .github/workflows/maintainer-approval.test.js
diff --git a/.github/workflows/update-schema-docs.yml b/.github/workflows/update-schema-docs.yml
new file mode 100644
index 00000000000..268187a2ec6
--- /dev/null
+++ b/.github/workflows/update-schema-docs.yml
@@ -0,0 +1,103 @@
+name: update-schema-docs
+
+# Regenerate the bundle docs JSON schema after every release and publish it to
+# the `docgen` branch. The docs schema is NOT kept on main — `docgen` is its
+# only home (downstream docs tooling reads it from there).
+#
+# bundle/internal/schema/since_version.go derives `x-since-version` annotations
+# from the list of `v*` git tags that exist when the schema is generated. The
+# `docgen` branch is therefore stale by one release as soon as the next tag is
+# pushed; this workflow keeps it current.
+
+on:
+  push:
+    tags:
+      - "v[0-9]+.[0-9]+.[0-9]+*"
+
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  # Required by setup-jfrog (GOPROXY exchange).
+  id-token: write
+
+jobs:
+  update-schema-docs:
+    runs-on:
+      group: databricks-protected-runner-group-large
+      labels: linux-ubuntu-latest-large
+
+    steps:
+      - name: Checkout main
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # Regen runs against `main`. fetch-depth: 0 + fetch-tags: true ensure
+          # since_version.go can resolve `git show <tag>:bundle/schema/jsonschema.json`
+          # for every historical release.
+          ref: main
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: Setup JFrog
+        uses: ./.github/actions/setup-jfrog
+
+      - name: Setup Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+          cache-dependency-path: |
+            go.sum
+            bundle/internal/schema/*.*
+
+      - name: Determine release tag
+        id: tag
+        env:
+          REF_TYPE: ${{ github.ref_type }}
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          if [ "$REF_TYPE" = "tag" ]; then
+            tag="$REF_NAME"
+          else
+            # git tag --list uses fnmatch (no `+`), so post-filter with grep
+            # to match the same shape as the trigger above.
+            tag=$(git tag --list 'v*' --sort=-version:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+' | head -n 1)
+          fi
+          if [ -z "$tag" ]; then
+            echo "Could not determine a release tag to publish for." >&2
+            exit 1
+          fi
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
+          echo "Publishing for tag $tag"
+
+      - name: Check out docgen worktree
+        run: |
+          git fetch origin docgen
+          git worktree add "$RUNNER_TEMP/docgen" origin/docgen
+
+      # The docs schema is not kept on main; generate it straight into the docgen
+      # worktree and publish from there. since_version.go reads `git tag --list
+      # 'v*'` to stamp x-since-version; the tags are provided by the checkout
+      # above (fetch-depth: 0 + fetch-tags: true).
+      - name: Regenerate docs schema into the docgen worktree
+        run: |
+          mkdir -p "$RUNNER_TEMP/docgen/bundle/schema"
+          go run ./bundle/internal/schema ./bundle/internal/schema \
+            "$RUNNER_TEMP/docgen/bundle/schema/jsonschema_for_docs.json" .codegen/cli.json --docs
+
+      - name: Stage regenerated file on docgen
+        working-directory: ${{ runner.temp }}/docgen
+        run: git add bundle/schema/jsonschema_for_docs.json
+
+      - name: Commit and push to docgen
+        working-directory: ${{ runner.temp }}/docgen
+        env:
+          TAG: ${{ steps.tag.outputs.tag }}
+        run: |-
+          if git diff --cached --quiet; then
+            echo "docgen already up to date for ${TAG}; nothing to commit."
+            exit 0
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git commit -m "Update jsonschema_for_docs.json for ${TAG}"
+          git push origin HEAD:docgen
diff --git a/.gitignore b/.gitignore
index 7a2606681fe..fbf05b54389 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,7 +6,10 @@
 *.dll
 *.so
 *.dylib
-cli
+# Root binary from a bare `go build`; anchored so it doesn't also ignore
+# nested paths like .nextchanges/cli/.
+/cli
+/cleanup
 
 # Test binary, built with `go test -c`
 *.test
@@ -33,7 +36,6 @@ test-output.json
 test-output-unit.json
 test-output-unit-root.json
 test-output-unit-tools.json
-test-output-unit-codegen.json
 test-output-acc.json
 
 # Taskfile cache
@@ -69,11 +71,11 @@ dist/
 go.work
 go.work.sum
 
-# Fetched based on recorded hash
-.codegen/openapi.json
-
 .claude/settings.local.json
+.claude/scheduled_tasks.lock
 .cursor/cli.json
 tools/gofumpt
 .claude/worktrees/
 .worktrees/
+.isaac/
+/regression_report.md
diff --git a/.golangci.yaml b/.golangci.yaml
index 6f41b1cee22..f05060c41ae 100644
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -7,7 +7,6 @@ linters:
     - gocritic
     - govet
     - ineffassign
-    - intrange
     - mirror
     - perfsprint
     - revive
@@ -15,7 +14,7 @@ linters:
     - testifylint
     - unconvert
     - unused
-    - exhaustruct
+    - exhaustruct_v5
     - exhaustive
     - copyloopvar
     - forbidigo
@@ -35,7 +34,14 @@ linters:
     - asciicheck
     - reassign
     - modernize
+    - makezero
+    - errorlint
   settings:
+    errorlint:
+      # errorf is on: switching %v to %w changes which errors callers can
+      # match with errors.Is/As, so keep %v with a nolint reason where the
+      # cause must not be visible to callers.
+      errorf: true
     modernize:
       # omitzero changes JSON wire format for nested structs (unlike omitempty),
       # so each site needs per-site review rather than a bulk rewrite.
@@ -62,10 +68,9 @@ linters:
         no-stdlib-log:
           files:
             - "**"
-            - "!**/bundle/docsgen/**"
             - "!**/bundle/internal/schema/**"
-            - "!**/bundle/internal/tf/codegen/**"
             - "!**/bundle/internal/validation/**"
+            - "!**/internal/cligen/**"
           deny:
             - pkg: "log$"
               desc: "use libs/log instead of the standard library log package"
@@ -99,7 +104,20 @@ linters:
           msg: Use errors.Is(err, fs.ErrPermission) instead.
         - pattern: 'sync\.Once\b($|[^FV])'
           msg: Use sync.OnceFunc, sync.OnceValue, or sync.OnceValues instead.
+        - pattern: 'errors\.As\b'
+          msg: 'Use errors.AsType[T](err) for type-safe error unwrapping (Go 1.26+).'
       analyze-types: true
+    recvcheck:
+      # recvcheck v0.3 switched its built-in exclusions from Marshal* to
+      # Unmarshal*. Value-receiver MarshalJSON paired with pointer-receiver
+      # UnmarshalJSON is the idiomatic pattern, so keep excluding both.
+      exclusions:
+        - "*.MarshalText"
+        - "*.MarshalJSON"
+        - "*.MarshalYAML"
+        - "*.MarshalXML"
+        - "*.MarshalBinary"
+        - "*.GobEncode"
     copyloopvar:
       check-alias: true
     errcheck:
@@ -119,11 +137,8 @@ linters:
             - "**/internal/testutil/**"
             - "**/libs/testdiff/**"
             - "**/libs/python/pythontest/**"
-        - name: context-keys-type
         - name: error-return
         - name: errorf
-        - name: range-val-in-closure
-        - name: waitgroup-by-value
         - name: unconditional-recursion
         - name: use-waitgroup-go
     gocritic:
@@ -156,9 +171,6 @@ linters:
       enable-all: true
       disable:
         - require-error # good check, but we have too many assert.(No)?Errorf? so excluding for now
-        - empty
-        - len
-        - equal-values
         - encoded-compare # Always replaces Equal() with JSONEq, but sometimes exact string match is wanted for JSON
     exhaustive:
       default-signifies-exhaustive: true
@@ -172,18 +184,14 @@ linters:
     rules:
       - path-except: bundle/direct/dresources|bundle/config/mutator/load_dbalert_files.go
         linters:
-          - exhaustruct
+          - exhaustruct_v5
       - path: bundle/direct/dresources/.*_test.go
         linters:
-          - exhaustruct
+          - exhaustruct_v5
       - text: "Use env\\.Get"
         path: "_test\\.go$"
         linters:
           - forbidigo
-      # TODO: remove these exceptions by moving the dependency out of experimental/.
-      - path: cmd/apps/init.go
-        linters:
-          - depguard
 issues:
   max-issues-per-linter: 1000
   max-same-issues: 1000
@@ -201,6 +209,7 @@ formatters:
           replacement: any
     gofumpt:
       module-path: github.com/databricks/cli
-      extra-rules: true
+      extra:
+        group-params: true
   exclusions:
     generated: lax
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 751151a74a1..197f42da958 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -7,6 +7,13 @@ before:
 builds:
   - env:
       - CGO_ENABLED=0
+      # Link the Go Cryptographic Module and default FIPS 140-3 mode on. Pinned to
+      # a frozen version rather than an alias: only v1.0.0 carries a CMVP
+      # certificate, "latest" tracks the in-tree source with no fixed artifact to
+      # cite, and "certified" is resolved by the toolchain so it moves on upgrade.
+      # Callers who need the previous behaviour can start the binary with
+      # GODEBUG=fips140=off.
+      - GOFIPS140=v1.0.0
     mod_timestamp: '{{ .CommitTimestamp }}'
     flags:
       - -trimpath
diff --git a/.nextchanges/README.md b/.nextchanges/README.md
new file mode 100644
index 00000000000..679211f0b40
--- /dev/null
+++ b/.nextchanges/README.md
@@ -0,0 +1,65 @@
+# Changelog fragments
+
+Add a changelog entry by creating a **new file** in the section folder under
+`.nextchanges/` that fits your change. Each PR adds its own file, so two PRs
+never touch the same path — no merge conflicts, unlike everyone editing one
+shared changelog file.
+
+## How to add an entry (takes 10 seconds)
+
+Create `.nextchanges/<section>/<name>.md` and write what changed:
+
+```
+* Add the `databricks quickstart` command.
+```
+
+You can do this straight from the GitHub UI: **Add file → Create new file**,
+type the path (e.g. `.nextchanges/cli/quickstart.md`), write the entry, commit.
+
+- `<name>` is arbitrary — a feature name (`quickstart.md`) or your PR number
+  (`5464.md`), whatever you like, as long as it's unique.
+- One file is exactly one entry: a single line that starts with a `* ` bullet
+  marker and ends with a period. `task check-changelog` (and CI) enforces this.
+- A trailing PR link is required whenever the change is associated with a PR,
+  and the PR that introduces the entry must be among the linked ones — the
+  checker infers that PR (from the squash-merge commit that added the fragment,
+  or your open branch PR) and fails if it isn't listed. CI enforces this on
+  every PR and on `main`, and `task check-changelog` enforces it locally too
+  once your branch has an open PR (detected best-effort via `gh`; skipped before
+  the PR exists or when `gh` is unavailable). Write the full markdown link at the
+  very end, after the period:
+  `([#5464](https://github.com/databricks/cli/pull/5464))` (your PR number). For
+  an entry spanning several PRs, list them comma-separated:
+  `([#5464](…), [#5500](…))`, as long as the introducing PR is included.
+- Every `#5464` reference — inline or trailing — must be a full markdown link.
+  A bare or paren-wrapped `#5464` is rejected: GitHub would render it as an
+  unintended auto-link in `CHANGELOG.md`. Nothing rewrites links, so the
+  fragment must already be correct when it lands.
+
+### Sections
+
+| Folder | Section in the released changelog |
+| --- | --- |
+| `.nextchanges/notable-changes/` | Notable Changes (prominent, called out at the top) |
+| `.nextchanges/cli/` | CLI |
+| `.nextchanges/air/` | AI Runtime |
+| `.nextchanges/bundles/` | Bundles |
+| `.nextchanges/dependency-updates/` | Dependency Updates |
+| `.nextchanges/api-changes/` | API Changes |
+
+See [`.agents/skills/pr-checklist/SKILL.md`](../.agents/skills/pr-checklist/SKILL.md)
+for when an entry is warranted.
+
+## How it's released
+
+You don't run anything. At release time the tagging workflow renders every
+fragment into the matching section of `CHANGELOG.md`, deletes the consumed
+fragments, and bumps `version` to the next minor (see
+`internal/genkit/tagging.py`). `./task check-changelog` validates fragment
+placement and the `version` file on every PR.
+
+### `version`
+
+`.nextchanges/version` holds the version of the next release (e.g. `1.4.0`).
+It's bumped to the next minor automatically after each release — edit it in a
+PR only to cut a patch or major release instead.
diff --git a/.nextchanges/air/README.md b/.nextchanges/air/README.md
new file mode 100644
index 00000000000..ade85d47f04
--- /dev/null
+++ b/.nextchanges/air/README.md
@@ -0,0 +1,6 @@
+# AI Runtime
+
+Fragments here render under **AI Runtime** in the released changelog. Add a
+<name>.md file describing your change.
+
+See [`../README.md`](../README.md) for how fragments are written and released.
diff --git a/.nextchanges/api-changes/README.md b/.nextchanges/api-changes/README.md
new file mode 100644
index 00000000000..2a775835e62
--- /dev/null
+++ b/.nextchanges/api-changes/README.md
@@ -0,0 +1,6 @@
+# API Changes
+
+Fragments here render under **API Changes** in the released changelog. Add a
+`<name>.md` file describing your change.
+
+See [`../README.md`](../README.md) for how fragments are written and released.
diff --git a/.nextchanges/bundles/README.md b/.nextchanges/bundles/README.md
new file mode 100644
index 00000000000..f275abbcfbf
--- /dev/null
+++ b/.nextchanges/bundles/README.md
@@ -0,0 +1,6 @@
+# Bundles
+
+Fragments here render under **Bundles** in the released changelog. Add a
+`<name>.md` file describing your change.
+
+See [`../README.md`](../README.md) for how fragments are written and released.
diff --git a/.nextchanges/cli/README.md b/.nextchanges/cli/README.md
new file mode 100644
index 00000000000..02c2b99c89f
--- /dev/null
+++ b/.nextchanges/cli/README.md
@@ -0,0 +1,6 @@
+# CLI
+
+Fragments here render under **CLI** in the released changelog. Add a `<name>.md`
+file describing your change.
+
+See [`../README.md`](../README.md) for how fragments are written and released.
diff --git a/.nextchanges/dependency-updates/README.md b/.nextchanges/dependency-updates/README.md
new file mode 100644
index 00000000000..04d255fd19b
--- /dev/null
+++ b/.nextchanges/dependency-updates/README.md
@@ -0,0 +1,6 @@
+# Dependency Updates
+
+Fragments here render under **Dependency Updates** in the released changelog. Add
+a `<name>.md` file describing your change.
+
+See [`../README.md`](../README.md) for how fragments are written and released.
diff --git a/.nextchanges/nextversion.go b/.nextchanges/nextversion.go
new file mode 100644
index 00000000000..d939c9b42f2
--- /dev/null
+++ b/.nextchanges/nextversion.go
@@ -0,0 +1,21 @@
+// Package nextchanges exposes the next release version to the build.
+//
+// It lives in this directory because go:embed cannot reach a parent directory:
+// embedding the version file from internal/build would require a second copy of
+// the value, which could then drift from this one.
+package nextchanges
+
+import (
+	_ "embed"
+	"strings"
+)
+
+// versionFile is the raw contents of the version file. It has a trailing newline
+// (the whitespace linter requires one), so it is not exported directly.
+//
+//go:embed version
+var versionFile string
+
+// Version is the next release version, e.g. "1.12.0". The release tooling bumps
+// the embedded file after each release; see README.md.
+var Version = strings.TrimSpace(versionFile)
diff --git a/.nextchanges/notable-changes/README.md b/.nextchanges/notable-changes/README.md
new file mode 100644
index 00000000000..73008ba92d8
--- /dev/null
+++ b/.nextchanges/notable-changes/README.md
@@ -0,0 +1,6 @@
+# Notable Changes
+
+Fragments here render under **Notable Changes** — prominent entries called out at
+the top of the released changelog. Add a `<name>.md` file describing your change.
+
+See [`../README.md`](../README.md) for how fragments are written and released.
diff --git a/.nextchanges/version b/.nextchanges/version
new file mode 100644
index 00000000000..a6c2798a482
--- /dev/null
+++ b/.nextchanges/version
@@ -0,0 +1 @@
+1.23.0
diff --git a/.release_metadata.json b/.release_metadata.json
index a17521e3b54..603294d5f77 100644
--- a/.release_metadata.json
+++ b/.release_metadata.json
@@ -1,3 +1,3 @@
 {
-    "timestamp": "2026-04-29 13:09:01+0000"
+    "timestamp": "2026-10-22 13:18:35+0000"
 }
\ No newline at end of file
diff --git a/.vscode/settings.json b/.vscode/settings.json
index a0f74f88ac1..b393450c80d 100644
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -22,5 +22,11 @@
         "script": "shellscript",
         "script.prepare": "shellscript",
         "script.cleanup": "shellscript"
+    },
+    "yaml.schemas": {
+        "./bundle/schema/jsonschema.json": [
+            "databricks.yml",
+            "databricks.yaml",
+        ]
     }
 }
diff --git a/.wsignore b/.wsignore
index bea28485827..58d4349dd45 100644
--- a/.wsignore
+++ b/.wsignore
@@ -3,7 +3,6 @@
 .codegen/_openapi_sha
 .release_metadata.json
 bundle/schema/jsonschema.json
-bundle/schema/jsonschema_for_docs.json
 python/docs/images/databricks-logo.svg
 **/*.dist-info/METADATA
 **/*.dist-info/WHEEL
@@ -27,7 +26,5 @@ python/databricks/bundles/*/_models/*.py
 # Developed elsewhere:
 internal/genkit/tagging.py
 
-# Docsgen:
-bundle/docsgen/output/resources.md
-bundle/docsgen/output/reference.md
-bundle/docsgen/testdata/anchors.md
+# Vendored from https://github.com/databricks/mlops-stacks:
+acceptance/bundle/deploy/mlops-stacks/template/**
diff --git a/AGENTS.md b/AGENTS.md
index 3cdcc3406ad..02b63df8169 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,6 +1,6 @@
 This file provides guidance to AI assistants when working with code in this repository.
 
-Rules prefixed `**RULE:**` are mandatory. `GOOD:` and `BAD:` labels on code snippets mark patterns to follow and patterns to avoid. This convention is a common best practice for AI-assistant rule files and is used consistently across `AGENTS.md` and `.agent/rules/*.md`.
+Rules prefixed `**RULE:**` are mandatory. `GOOD:` and `BAD:` labels on code snippets mark patterns to follow and patterns to avoid. This convention is a common best practice for AI-assistant rule files and is used consistently across `AGENTS.md` and `.agents/rules/*.md`.
 
 # Project Overview
 
@@ -10,8 +10,6 @@ This is the Databricks CLI, a command-line interface for interacting with Databr
 
 **RULE: When moving code from one place to another, don't unnecessarily change or omit parts.** Keep refactors separate from content changes so reviewers can tell them apart.
 
-**RULE: Do not modify or remove existing comments in code you didn't write.** Comments often encode non-obvious context (a bug reference, a workaround, a reason the code is shaped a certain way) that is lost if rewritten. Leave them alone unless the user explicitly asks for a change.
-
 **RULE: Prefer simplicity over cleverness. Avoid speculative fallbacks and default values.** If you catch yourself adding a fallback branch "just in case," identify the correct path and use only that one. Reviewers in this repo reject speculative flexibility.
 
 **RULE: Keep each PR focused on one change.** If you notice an unrelated cleanup, bug fix, or refactor while making your primary change, leave it alone or put it in a separate PR. Reviewers consistently ask to split mixed PRs, especially when a dependency bump or schema diff rides along with a feature change.
@@ -23,11 +21,13 @@ This is the Databricks CLI, a command-line interface for interacting with Databr
 ### Building and Testing
 
 - `./task build` - Build the CLI binary
-- `./task test` - Run unit and acceptance tests for all packages
+- `./task test` - Run unit and acceptance tests for all packages. This runs the *entire* acceptance suite locally against the fake server in `libs/testserver`.
 - `go test ./acceptance -run TestAccept/bundle/<path>/<to>/<folder> -tail -test.v` - run a single acceptance test
-- `./task integration` - Run integration tests (requires environment variables)
+- `./task integration` - Run integration tests (requires environment variables). The `integration/` tree is deprecated; new coverage that needs a real workspace goes into an acceptance test with `Cloud = true`.
 - `./task cover` - Generate test coverage reports
 
+Every acceptance test runs locally. `Cloud = true` in a `test.toml` means the test *also* runs against a real workspace when `CLOUD_ENV` is set — never that it skips the local run. See `.agents/rules/testing.md`.
+
 ### Code Quality
 
 - `./task lint` - Run full linter across all Go modules (root, tools, codegen)
@@ -40,8 +40,8 @@ This is the Databricks CLI, a command-line interface for interacting with Databr
 ### Specialized Commands
 
 - `./task generate-schema` - Generate bundle JSON schema
-- `./task generate-docs` - Generate bundle documentation
-- `./task generate-genkit` - Run genkit to generate CLI commands and tagging workflow (requires universe repo)
+- `./task generate-cligen` - Regenerate CLI command stubs from the checked-in .codegen/cli.json
+- `./task generate-clijson` - Refresh .codegen/cli.json from the OpenAPI spec via genkit (requires universe repo)
 - `./task generate` - Run all generators
 
 ### Git Commands
@@ -68,7 +68,7 @@ GIT_EDITOR=true GIT_SEQUENCE_EDITOR=true VISUAL=true GIT_PAGER=cat git rebase or
 **bundle/** - Core bundle functionality for Declarative Automation Bundles
 - `bundle/bundle.go` - Main Bundle struct and lifecycle management
 - `bundle/config/` - Configuration loading, validation, and schema
-- `bundle/deploy/` - Deployment logic (Terraform and direct modes)
+- `bundle/deploy/` - Deployment logic (file upload, locking, state)
 - `bundle/mutator/` - Configuration transformation pipeline
 - `bundle/phases/` - High-level deployment phases
 
@@ -84,31 +84,17 @@ GIT_EDITOR=true GIT_SEQUENCE_EDITOR=true VISUAL=true GIT_PAGER=cat git rebase or
 
 **Mutators**: Transform bundle configuration through a pipeline. Located in `bundle/config/mutator/` and `bundle/mutator/`. Each mutator implements the `Mutator` interface.
 
-**Direct vs Terraform Deployment**: The CLI supports two deployment modes controlled by `DATABRICKS_BUNDLE_ENGINE` environment variable:
-- `terraform` (default) - Uses Terraform for resource management
-- `direct` - Direct API calls without Terraform
+**Direct deployment engine**: Bundles are deployed by the direct engine (`bundle/direct/`), which calls the APIs without Terraform. The Terraform engine was removed in v1.20.0: `bundle.engine: terraform` and `DATABRICKS_BUNDLE_ENGINE=terraform` are rejected, and existing Terraform state is migrated to the direct engine before the command runs.
 
 # Development Tips
 
 - Use `./task test-update` to regenerate acceptance test outputs after changes.
 - The CLI binary supports both `databricks` and `pipelines` command modes based on executable name.
 
-**RULE: Comments should explain "why", not "what".** Reviewers consistently reject comments that merely restate the code.
-
-**RULE: When code relies on a non-obvious invariant, workaround, or backend quirk, add a short comment stating the reason.** The inverse of the rule above: noise comments are bad, but missing comments are the single most common thing reviewers catch. Triggers include: API quirks (PATCH-like semantics, no get-by-name, stripped prefixes), fields intentionally included or excluded (output-only, etag, `ForceSendFields`), branches that look dead but are kept as guards, and tests where the expectation isn't obvious from the assertions.
-
-GOOD:
-
-```go
-// The Workspace API strips the "/Workspace" prefix from parent_path on GET,
-// so we re-add it here to match the local configuration.
-parentPath = "/Workspace" + parentPath
-```
-
-BAD:
+**Stale golangci-lint cache across worktrees.** Triggered by `task lint` or a direct `go tool ... golangci-lint` run reporting issues in files under a *different* or deleted worktree, often with `no such file or directory` warnings. Fix — clear the cache and re-run, don't investigate the reported issues:
 
-```go
-parentPath = "/Workspace" + parentPath
+```sh
+go tool -modfile=tools/go.mod golangci-lint cache clean
 ```
 
 # Common Mistakes
@@ -127,6 +113,16 @@ parentPath = "/Workspace" + parentPath
 
 Where a panic is genuinely possible (e.g. `reflect.Type.Elem()` on a non-pointer, division by an empty slice's length), validate at the entry point and return an error.
 
+**RULE: Never copy a `config.Config` by value.** It embeds a `sync.Mutex`, so `go vet` copylocks fails and CI lint blocks it (govet runs with enable-all). Pass it by pointer, or mutate the resolved config in place (e.g. set `HTTPTimeoutSeconds` on it before `client.New`; there is no per-request option).
+
+**RULE: Open URLs through `libs/browser`, never `github.com/pkg/browser` directly.** `pkg/browser` ignores the `BROWSER` env var, so `BROWSER=none` and custom browser commands break. `browser.Open(ctx, url)` handles empty/none/custom in one path; branch on `browser.IsDisabled(ctx)` first if you need custom messaging. For a custom `BROWSER=<command>`, launch via `libs/exec`, not an inline `cmd /c` (that broke Windows OAuth URLs via `%...%` expansion).
+
+**RULE: For hand-written workspace-routed raw API calls (`client.Do` / `apiClient.Do`), set routing headers via `libs/auth.WorkspaceIDHeaders`.** It emits `X-Databricks-Workspace-Id` and suppresses the legacy `workspace_id = none` sentinel. Grepping only for old header names misses calls that never set any routing header but still need one.
+
+**RULE: To keep an intentionally-unreferenced exported function, mark it `//deadcode:allow <reason>` within 6 lines above the `func`.** CI runs `deadcode -test ./...`; a func reachable only from a `*_test.go` is not flagged, so unwiring a feature can leave a sibling entry point dead. (`gofmt` inserts a blank `//` line between the directive and the doc comment; that's expected and still detected.)
+
+**RULE: Write platform agnostic code.** Avoid test logic that runs only on the operating system you are using. Do not forget about Windows!
+
 # Error Handling
 
 **RULE: Wrap errors with context using `%w`.** Preserves the error chain so `errors.Is` and `errors.As` keep working upstream.
@@ -169,6 +165,8 @@ if err != nil && strings.Contains(err.Error(), "does not exist") {
 }
 ```
 
+**RULE: Error strings must not end with punctuation or a newline (golangci-lint ST1005).** Applies to `fmt.Errorf` / `errors.New`: when appending a multi-sentence hint to an error, drop the final period (mid-string periods and newlines are fine). Keep `Error()` methods unpunctuated at the end too, for consistency.
+
 # CLI UX and validation
 
 **RULE: Reject incompatible inputs early with an actionable error. Never silently ignore a flag or config field the current mode can't honor.** If a flag is incompatible with another flag or with a mode, return an error at flag-parse or validation time that tells the user which flag pair is at fault and what to do. If a config field applies only to certain resource types or engines, return a validation error, not a warning that gets lost in log output.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index fe3ff24965c..196353570b7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,699 @@
 # Version changelog
 
+## Release v1.22.1 (2026-10-22)
+
+### CLI
+
+ * Fix GitHub API rate limit errors in `aitools list` and plugin installs by pinning skills to `0.2.32`. ([#7159](https://github.com/databricks/cli/pull/7159))
+
+
+## Release v1.22.0 (2026-10-22)
+
+### CLI
+
+ * Fix `databricks aitools install` overwriting newer raw skills with an older pinned release. CLI 1.22.0 and newer now install the latest published skills and prevent automatic downgrades. ([#7069](https://github.com/databricks/cli/pull/7069))
+ * Fix `auth login --timeout` not applying to the browser login, which waited for the OAuth redirect indefinitely. ([#7103](https://github.com/databricks/cli/pull/7103))
+ * Remove the 50-workspace limit in `auth login` and support searching workspaces by name or ID. ([#7071](https://github.com/databricks/cli/pull/7071))
+ * `databricks ssh connect` now fails right away with the workspace's reason when port forwarding to serverless compute is disabled, instead of waiting out the server start timeout. ([#7057](https://github.com/databricks/cli/pull/7057))
+
+### AI Runtime
+
+ * `air run` now spends less time before submitting: it fetches only the user name from SCIM. ([#7153](https://github.com/databricks/cli/pull/7153))
+ * Align multi-image container name validation with backend services: allow hyphens and up to 32 characters, and reject uppercase letters and underscores. ([#7154](https://github.com/databricks/cli/pull/7154))
+
+### Bundles
+
+ * The `compute_id` deprecation warning for a target now shows the full path (`targets.<name>.compute_id`). ([#7048](https://github.com/databricks/cli/pull/7048))
+ * Add `DATABRICKS_BUNDLE_STRICT_PROFILE_MATCH`, which requires a target's host and workspace ID to match exactly one profile in the config file before authenticating. Targets without a host or workspace ID are not affected. ([#7109](https://github.com/databricks/cli/pull/7109))
+ * Zero-value overrides of `presets`, `lifecycle.prevent_destroy` and `deployment` settings in includes now replace non-zero base values, and `bundle validate -o json` shows explicit zero presets. ([#7117](https://github.com/databricks/cli/pull/7117))
+ * `bundle deployment bind` and `unbind` now accept a resource as `type.key`, e.g. `jobs.foo`. ([#7128](https://github.com/databricks/cli/pull/7128))
+ * Retry more transient server errors during `bundle deploy` and `bundle destroy`, including when releasing the deploy lock and reading state. ([#7129](https://github.com/databricks/cli/pull/7129))
+ * Fix migration from Terraform failing when a deployed resource references a resource that was never deployed. ([#7157](https://github.com/databricks/cli/pull/7157))
+ * Add `app-appkit` to bundle templates to simplify starting a Databricks Apps project. ([#7004](https://github.com/databricks/cli/pull/7004), [#7007](https://github.com/databricks/cli/pull/7007))
+ * Add support for the `features` resource type. ([#6952](https://github.com/databricks/cli/pull/6952))
+ * Fix `bundle validate` warning that `sync.include` and `sync.exclude` patterns do not match any files when `sync.paths` includes a directory outside the bundle root. ([#7122](https://github.com/databricks/cli/pull/7122))
+
+### Dependency Updates
+
+ * Bump dependencies with known vulnerabilities. ([#7083](https://github.com/databricks/cli/pull/7083))
+ * Bump Go to 1.27.2. Release binaries now require macOS 13 Ventura or later. ([#7052](https://github.com/databricks/cli/pull/7052))
+ * Update the Go SDK to [v0.189.0](https://github.com/databricks/databricks-sdk-go/releases/tag/v0.189.0). ([#7138](https://github.com/databricks/cli/pull/7138))
+ * Bump Go toolchain to 1.27.3. ([#7116](https://github.com/databricks/cli/pull/7116))
+
+
+## Release v1.21.0 (2026-10-14)
+
+### CLI
+
+ * Support pipeline IDs in `pipelines history`. ([#6995](https://github.com/databricks/cli/pull/6995))
+ * Show a hint for previewing more rows in `pipelines show`. ([#6995](https://github.com/databricks/cli/pull/6995))
+ * `databricks environments setup-local` now uses the environment in `UV_PROJECT_ENVIRONMENT` when it is set, as `uv sync` does. ([#7026](https://github.com/databricks/cli/pull/7026))
+ * `databricks environments setup-local` now supports uv workspace members: it uses the shared `.venv` at the workspace root and writes the dependency constraints to the root `pyproject.toml`. ([#7018](https://github.com/databricks/cli/pull/7018))
+
+### AI Runtime
+
+ * Limit `databricks air run` submission preflight validation to one five-second attempt before continuing when the service is unavailable. ([#6994](https://github.com/databricks/cli/pull/6994))
+
+### Bundles
+
+ * Bundle file uploads now use the multipart `POST /api/2.0/workspace/import` endpoint instead of the deprecated `POST /api/2.0/workspace-files/import-file`, raising the per-workspace upload rate limit and improving deploy throughput under concurrency. ([#6149](https://github.com/databricks/cli/pull/6149))
+ * Diagnostic paths now quote map keys that are not identifiers, e.g. `resources.jobs['${var.env}_job']`. ([#6980](https://github.com/databricks/cli/pull/6980))
+ * No longer include `CLAUDE.md` in the bundle templates, now that Claude supports `AGENTS.md`. ([#7000](https://github.com/databricks/cli/pull/7000))
+ * Fix `bundle deployment bind` silently binding over a deployment state it could not read, which could take over a resource that was already managed by the bundle. ([#6331](https://github.com/databricks/cli/pull/6331))
+ * `databricks bundle deploy`, `databricks bundle sync` and `databricks sync` now retry file, library, state and metadata uploads that fail with a transient server error (5xx or 408), instead of failing. ([#7014](https://github.com/databricks/cli/pull/7014))
+ * `databricks bundle deploy`, `databricks bundle sync` and `databricks sync` now retry the workspace path check (`workspace/get-status`) when it fails with a transient server error (5xx or 408) or an HTTP/2 `REFUSED_STREAM`, instead of failing. ([#7044](https://github.com/databricks/cli/pull/7044))
+ * Fixed `experimental.immutable_folder` failing validation for targets with `mode: development` ("file_path must start with '~/' or contain the current username"). ([#7027](https://github.com/databricks/cli/pull/7027))
+ * Fixed `experimental.immutable_folder` failing with `experimental.deployment_history` ("workspace_info.file_path must be an absolute workspace path") and failing `bundle validate` when top-level `permissions` are set. ([#7001](https://github.com/databricks/cli/pull/7001))
+ * Translate relative `.env` file paths in a job's `environment_variables[].spec.files` to their deployed workspace locations. ([#6985](https://github.com/databricks/cli/pull/6985))
+ * Resolve job `project_environment` paths relative to the YAML file that defines them. ([#6983](https://github.com/databricks/cli/pull/6983))
+
+### Dependency Updates
+
+ * Bump Go toolchain to 1.26.9. ([#6996](https://github.com/databricks/cli/pull/6996))
+ * Update Go SDK to 0.188.0. ([#7038](https://github.com/databricks/cli/pull/7038))
+
+
+## Release v1.20.0 (2026-10-07)
+
+### Notable Changes
+
+ * Remove the Terraform deployment engine. `bundle.engine: terraform` and `DATABRICKS_BUNDLE_ENGINE=terraform` now error, and a failed migration of existing Terraform state is reported as an error instead of falling back to Terraform. To keep deploying with Terraform, use Databricks CLI v1.19.x. ([#6888](https://github.com/databricks/cli/pull/6888), [#6889](https://github.com/databricks/cli/pull/6889))
+
+### CLI
+
+ * `databricks aitools install` now supports Kiro, installing Databricks agent skills into its skills directory. ([#6908](https://github.com/databricks/cli/pull/6908))
+ * Fixed `databricks api` corrupting integers larger than 2^53 (such as job and pipeline ids) — request bodies and responses now preserve them exactly. ([#6884](https://github.com/databricks/cli/pull/6884))
+ * Added `--auth-mode` and `--set <plugin>.<resourceKey>.authMode=obo|sp|both` to `databricks apps init` so AppKit resources can be accessed on behalf of the user, by the service principal, or both. The default stays service principal. ([#6886](https://github.com/databricks/cli/pull/6886))
+ * `databricks apps init` now requires a value for every field a service principal resource binding references, prompting for missing values in an interactive terminal and otherwise failing with the `--set` key to use, instead of creating a project with unset variables. ([#6903](https://github.com/databricks/cli/pull/6903))
+ * Add `databricks apps init --package-manager <npm|pnpm>` to select the package manager for Node.js templates. Infer the default quietly from template lockfiles and AppKit version, check prerequisites before creating files, and preserve template formatting and pnpm version pins. ([#6902](https://github.com/databricks/cli/pull/6902))
+ * Select npm or pnpm from `packageManager` declarations and lockfiles for `apps validate` and project validation during `apps deploy`. ([#6892](https://github.com/databricks/cli/pull/6892))
+ * Fix `auth docker host` reporting the credential helper as configured when its executable is missing from `PATH`. ([#6880](https://github.com/databricks/cli/pull/6880))
+ * Warn when the CLI binary was built more than 6 months ago and recommend updating. ([#6898](https://github.com/databricks/cli/pull/6898))
+
+### AI Runtime
+
+ * Add an experimental rank-partitioned container images to AI Runtime jobs. ([#6841](https://github.com/databricks/cli/pull/6841))
+ * Support snapshot fields directly under `code_source` without requiring `type` or a nested `snapshot` block. ([#6927](https://github.com/databricks/cli/pull/6927))
+ * Map AIR priority and Unity Catalog image fields when converting run configurations to bundles. ([#6905](https://github.com/databricks/cli/pull/6905))
+ * Add workspace backend validation to `air run --dry-run`. ([#6934](https://github.com/databricks/cli/pull/6934))
+
+### Bundles
+
+ * Warn that `bundle.terraform` is deprecated and has no effect since the Terraform deployment engine was removed. ([#6940](https://github.com/databricks/cli/pull/6940))
+ * Direct engine now detects and applies an explicitly configured zero-value boolean or float (e.g. `gcp_attributes.use_preemptible_executors: false`, `azure_attributes.spot_bid_max_price: 0`) added to a resource first deployed without the field, matching the existing handling of an explicit integer zero. ([#6882](https://github.com/databricks/cli/pull/6882))
+ * Fix `bundle deployment migrate` failing with "no such file or directory" when the Terraform state has no resources or the configuration no longer declares any of them. ([#6958](https://github.com/databricks/cli/pull/6958))
+ * `bundle run` and `pipelines run` now send the per-update `development` parameter for pipelines in development mode targets. Setting `development` on a pipeline is deprecated and now emits a warning; use `mode: development` instead. ([#6863](https://github.com/databricks/cli/pull/6863))
+ * Remove the hidden `bundle debug terraform` command. ([#6933](https://github.com/databricks/cli/pull/6933))
+ * Add support for `run_as.group_name` at the bundle and target levels for jobs and pipelines. ([#6676](https://github.com/databricks/cli/pull/6676))
+ * Fix recreating a secret scope that was deleted outside of the bundle with the direct deployment engine. ([#6970](https://github.com/databricks/cli/pull/6970))
+ * Accept title-case booleans (`True`/`False`, as rendered by Azure Pipelines) for boolean variables, and accept the same boolean strings (`yes`/`no`, `on`/`off`, ...) in Python bundles as in YAML. ([#6942](https://github.com/databricks/cli/pull/6942))
+
+### Dependency Updates
+
+ * Bump `github.com/databricks/databricks-sdk-go` from v0.182.0 to v0.185.0. ([#6928](https://github.com/databricks/cli/pull/6928))
+
+
+## Release v1.19.0 (2026-09-30)
+
+### CLI
+
+ * Honor `CLAUDE_CONFIG_DIR` in `aitools` commands. ([#6838](https://github.com/databricks/cli/pull/6838))
+ * Added `--ttl` and `--no-expiry` flags to `databricks postgres create-branch` so a branch's expiration can be set without hand-writing a `--json` spec. `--ttl` accepts the REST API duration form (`604800s`), a Go duration (`168h`), or day/week units (`7d`, `3w`); `--no-expiry` creates a branch that never expires. One of `--ttl`, `--no-expiry`, or a spec expiration in `--json` is required. ([#6313](https://github.com/databricks/cli/pull/6313))
+ * `databricks ssh connect` serverless sessions now provide Claude Code and Codex configured with Unity Gateway out of the box. ([#6885](https://github.com/databricks/cli/pull/6885))
+
+### AI Runtime
+
+ * Add `databricks air images push` (Preview) to configure Docker authentication and push container images to Databricks Artifact Registry. ([#6869](https://github.com/databricks/cli/pull/6869))
+ * `air run` now grants the configured `permissions` on the MLflow experiment as well as the job. ([#6870](https://github.com/databricks/cli/pull/6870))
+
+### Bundles
+
+ * Add libraries field to clusters. ([#6831](https://github.com/databricks/cli/pull/6831))
+ * Error out when a configured `workspace_id` does not match the connected workspace, instead of silently using it in resource URLs emitted by `bundle summary`. ([#6754](https://github.com/databricks/cli/pull/6754))
+ * Fix spurious recreation of Lakebase (Postgres) branches, roles, and catalogs when the referenced project is updated in place: an in-place project change (e.g. `display_name`) no longer forces a delete + create of resources that reference the project's or branch's `name`. ([#6865](https://github.com/databricks/cli/pull/6865))
+ * Direct engine now detects and applies an explicitly configured integer zero (e.g. `gcp_attributes.local_ssd_count: 0`) added to a resource first deployed without the field. ([#6867](https://github.com/databricks/cli/pull/6867))
+ * Migrate existing Terraform deployment state to the direct engine before deploying (previously done after a Terraform deploy), so the deploy runs on the direct engine. ([#6749](https://github.com/databricks/cli/pull/6749))
+ * The `postgres_snapshot_schedules` resource (introduced in [v1.16.0](https://github.com/databricks/cli/releases/tag/v1.16.0)) is now marked Beta and is no longer available in PyDABs, matching the other `postgres_*` resources; configure it in YAML instead. ([#6887](https://github.com/databricks/cli/pull/6887))
+
+
+## Release v1.18.0 (2026-09-24)
+
+### CLI
+
+ * The AI Runtime commands have moved to `databricks air`. The previous `databricks experimental air` path now directs users to the new command. ([#6722](https://github.com/databricks/cli/pull/6722))
+ * Write local state, cache, and config files atomically so an interrupted or concurrent write cannot corrupt them. ([#6708](https://github.com/databricks/cli/pull/6708))
+ * Deprecate `--region` in `databricks auth docker configure` ahead of its removal in the next release, infer the Artifact Registry region when it is omitted, and add `databricks auth docker host --profile <name>` to show the profile's registry host and credential-helper status. ([#6782](https://github.com/databricks/cli/pull/6782))
+ * Return `UNAUTHENTICATED` instead of `INVALID_REFRESH_TOKEN` when `databricks auth token --output json` cannot refresh a cached U2M token. ([#6731](https://github.com/databricks/cli/pull/6731))
+ * Retry the current-user (SCIM `Me`) lookup on transient HTTP 500 responses so a temporarily-unavailable backend no longer fails bundle commands outright. ([#6766](https://github.com/databricks/cli/pull/6766))
+ * Preserve workspace-file and volume access for SSH server descendants when the bootstrap notebook exits and the server survives. ([#6645](https://github.com/databricks/cli/pull/6645))
+ * `ssh connect` and `ssh setup` now accept a `--keep-detached-processes` flag to keep processes detached from the SSH session (`tmux`, `setsid`, `nohup`) running after the tunnel shuts down. Teardown then terminates only the tunnel's own process group, and the bootstrap job run is held open while any detached process is still running, so the survivors keep their `/Workspace` and `/Volumes` access. A held-open run also suppresses cluster autotermination, so the flag is off by default, is bounded by `--server-timeout`, and is dedicated-cluster only. Without it, the server now logs a warning naming the detached processes it is about to destroy, instead of sweeping them silently. ([#6387](https://github.com/databricks/cli/pull/6387))
+
+### Bundles
+
+ * direct: Allow clearing a catalog's or schema's `custom_max_retention_hours` by removing it from configuration. ([#6792](https://github.com/databricks/cli/pull/6792))
+ * direct: Allow clearing a genie space's `description` and a secret's `comment` by removing them from configuration. ([#6789](https://github.com/databricks/cli/pull/6789))
+ * Fix direct-engine deploy recreating an MLflow experiment on every deploy when its `trace_location` was set out-of-band. ([#6787](https://github.com/databricks/cli/pull/6787))
+ * direct: Store a Genie space's `serialized_space` in state as a content hash instead of its full contents. ([#6707](https://github.com/databricks/cli/pull/6707))
+ * Fix `bundle deploy` failing with "Invalid python file reference" for jobs that use `git_source` with a `spark_python_task` on the direct engine. ([#6751](https://github.com/databricks/cli/pull/6751))
+ * Fixed the direct engine mishandling UC grants that combine `ALL_PRIVILEGES` with a privilege it does not imply (`MANAGE`, `READ_METADATA`, `EXTERNAL_USE_SCHEMA`, `EXTERNAL_USE_LOCATION`): such privileges were dropped when granted and left behind when revoked, so the deployment never converged. ([#6733](https://github.com/databricks/cli/pull/6733), [#6743](https://github.com/databricks/cli/pull/6743))
+ * Don't fail migration if clean up actions fail. ([#6772](https://github.com/databricks/cli/pull/6772))
+ * Ignore the backend-provided `spark.sql.ansi.enabled: "true"` pipeline configuration default when detecting direct-engine drift. ([#6816](https://github.com/databricks/cli/pull/6816))
+ * Fix recreating a postgres synced table sometimes failing with a 409 ALREADY_EXISTS error while the previous table is still being deleted. ([#6728](https://github.com/databricks/cli/pull/6728))
+ * Direct engine no longer recreates a resource when an immutable field the config omits was populated by the backend. ([#6790](https://github.com/databricks/cli/pull/6790))
+
+### Dependency Updates
+
+ * Bump dependencies with known vulnerabilities. ([#6723](https://github.com/databricks/cli/pull/6723))
+ * Bump `github.com/databricks/databricks-sdk-go` from v0.178.0 to v0.182.0. ([#6817](https://github.com/databricks/cli/pull/6817))
+ * Bump the Databricks Terraform provider from v1.132.0 to v1.134.0. ([#6818](https://github.com/databricks/cli/pull/6818))
+
+
+## Release v1.17.0 (2026-09-16)
+
+### Notable Changes
+
+ * Bump the direct deployment state version to 3. Clients older than v1.8.0 will reject bundles deployed with this release. ([#6713](https://github.com/databricks/cli/pull/6713))
+
+### CLI
+
+ * Add an `INVALID_REFRESH_TOKEN` error code to `databricks auth token --output json` failures. ([#6684](https://github.com/databricks/cli/pull/6684))
+ * Add experimental `databricks auth docker configure` to configure Docker credential helper access for Databricks Artifact Registry. ([#6700](https://github.com/databricks/cli/pull/6700))
+ * Add experimental `databricks auth docker token` to generate Docker credentials for Databricks Artifact Registry. ([#6699](https://github.com/databricks/cli/pull/6699))
+ * `databricks environments setup-local` now reports the `E_PROVISION_CONFLICT` error code instead of the generic `E_PROVISION` when `uv sync` fails to resolve a dependency conflict. ([#6666](https://github.com/databricks/cli/pull/6666))
+ * Preserve SSH sessions across temporary tunnel disconnects, with bounded replay and backpressure for large transfers. ([#6650](https://github.com/databricks/cli/pull/6650))
+ * Allow OAuth U2M logins to override the CLI client ID with `--client-id`, profile `client_id`, or `DATABRICKS_CLIENT_ID`. ([#6594](https://github.com/databricks/cli/pull/6594))
+
+### Bundles
+
+ * direct: Store a dashboard's `serialized_dashboard` in state as a content hash instead of its full contents. ([#6105](https://github.com/databricks/cli/pull/6105))
+ * direct: Fix pipelines recreation when the whole `ingestion_definition` block is added or removed. ([#6589](https://github.com/databricks/cli/pull/6589))
+ * `bundle plan`, `deploy`, and `destroy` no longer report removing `permissions`, `grants`, or secret scope ACLs from a bundle as a deletion, since it leaves the resource untouched. ([#6647](https://github.com/databricks/cli/pull/6647))
+ * `bundle plan` and `deploy` no longer list or count a resource that was already deleted remotely as a deletion, matching `bundle destroy`; applying still cleans up its stale state entry. ([#6675](https://github.com/databricks/cli/pull/6675))
+ * Fix `bundle run` failing with `expected an int, found a string` when an unrelated resource references another resource that is not deployed. `bundle run` now resolves `${resources.*}` references only within the resource being run. ([#6690](https://github.com/databricks/cli/pull/6690))
+ * Add grants support for the AI Gateway `model_service`, `mcp_service`, and `model_provider_service` resources (direct engine). ([#6635](https://github.com/databricks/cli/pull/6635))
+ * Add bundle support for the AI Gateway `mcp_service` resource (direct engine). ([#6633](https://github.com/databricks/cli/pull/6633))
+ * Add bundle support for the AI Gateway `model_provider_service` resource (direct engine). ([#6634](https://github.com/databricks/cli/pull/6634))
+ * Add bundle support for the AI Gateway `model_service` resource (direct engine). ([#6525](https://github.com/databricks/cli/pull/6525))
+ * Prevent resource drift on catalogs if `storage_root` contained a trailing slash in the URL. ([#6622](https://github.com/databricks/cli/pull/6622))
+ * Fixed a "lineage mismatch in state files" error that could occur after destroying a bundle and redeploying it from another machine. `bundle destroy` now removes the local state file so no stale lineage is left behind, and prunes the state directories it leaves empty (such as `.internal/` and `sync-snapshots/`). ([#6210](https://github.com/databricks/cli/pull/6210), [#6685](https://github.com/databricks/cli/pull/6685))
+ * direct: `bundle plan` no longer reports a permanent update on a cluster that uses a cluster policy: when the cluster spec sets `policy_id`, a field present in the remote but absent from the bundle config is not treated as drift. ([#6531](https://github.com/databricks/cli/pull/6531))
+ * `bundle deploy` on the direct engine now reports each resource as soon as it is deployed, instead of listing them all after the deployment finishes. A deploy that fails part way through now reports the resources it did apply. ([#6361](https://github.com/databricks/cli/pull/6361))
+ * Direct-engine bundles no longer flag phantom drift on server-populated nested fields under reused config types (e.g. `external_locations` file-event-queue resource IDs, `database_instances` parent-instance refs, `apps` git credential ID). ([#6618](https://github.com/databricks/cli/pull/6618))
+ * `databricks bundle generate app` now reproduces a git-backed app's `git_repository` and `git_source` configuration instead of emitting a workspace `source_code_path`, so generating from a Git-deployed app no longer silently converts it to workspace source. ([#6656](https://github.com/databricks/cli/pull/6656))
+ * Improved configuration load time for bundles with many included files. ([#6195](https://github.com/databricks/cli/pull/6195))
+ * `bundle destroy` no longer deletes triggered job runs, leaving them untouched on the backend. ([#6672](https://github.com/databricks/cli/pull/6672))
+ * direct: resources.job\_runs: new lifecycle.triggers.on\_file\_change setting to restart the run when monitored files change. Can be set to a series of paths or globs. ([#6309](https://github.com/databricks/cli/pull/6309))
+ * Bundle summary now shows a name for Postgres branches, endpoints, databases, and roles instead of a blank Name field. ([#6663](https://github.com/databricks/cli/pull/6663))
+ * Added PyDABs (Python) support for cluster policies, dashboards, and Genie spaces. ([#6585](https://github.com/databricks/cli/pull/6585))
+ * CLI commands no longer imply that a resource whose type has no workspace URL is merely not deployed yet. ([#6583](https://github.com/databricks/cli/pull/6583))
+ * Capture the implicit dependency a vector search index has on a catalog or schema defined in the same bundle, so the catalog and schema are deployed first. ([#6655](https://github.com/databricks/cli/pull/6655))
+
+### Dependency Updates
+
+ * Bump dependencies with known vulnerabilities. ([#6695](https://github.com/databricks/cli/pull/6695))
+ * Bump `github.com/databricks/databricks-sdk-go` from v0.177.0 to v0.178.0. ([#6673](https://github.com/databricks/cli/pull/6673))
+ * Bump Terraform provider from v1.131.0 to v1.132.0. ([#6671](https://github.com/databricks/cli/pull/6671))
+
+
+## Release v1.16.1 (2026-09-10)
+
+### CLI
+
+ * Revert tunnel resume layer to fix SSH transfer regression in v1.16.0 affecting transfers larger than 1 MiB. ([#6608](https://github.com/databricks/cli/pull/6608), [#6612](https://github.com/databricks/cli/pull/6612))
+
+
+## Release v1.16.0 (2026-09-09)
+
+### CLI
+
+ * `aitools install` now registers the official Claude marketplace if it is missing before installing the Databricks Claude plugin. ([#6485](https://github.com/databricks/cli/pull/6485))
+ * `databricks aitools install --output json` now reports an `error_category` for a failed or skipped install (per agent, and at the top level for a failure with no per-agent entry), giving coding agents and CI a stable classification of why an install did not complete. ([#6482](https://github.com/databricks/cli/pull/6482))
+ * `databricks aitools install` honors `--output json`, emitting a structured `{scope, agents[...]}` document that reports each agent's delivery and install status so coding agents and CI can consume the result without scraping the text output. JSON mode requires `--scope` and `--agents` so the command runs without interactive prompts. ([#6481](https://github.com/databricks/cli/pull/6481))
+ * `databricks bundle sync` now prints sync progress (`Action: PUT`, `Uploaded ...`) by default, matching `databricks sync`. Previously it was silent unless `--output` was passed. Use `--output json` for machine-readable output. ([#6568](https://github.com/databricks/cli/pull/6568))
+ * Support major-only DBR runtime versions such as `19.x-scala2.13` in the cluster picker used by `databricks auth login --configure-cluster` and `databricks labs`. ([#6574](https://github.com/databricks/cli/pull/6574))
+ * Deprecated the `databricks environments setup-local --constraints-only` flag in favour of the orthogonal `--no-dbconnect`; the flag still works as a hidden alias but is hidden from `--help` and prints a one-line deprecation notice, and will be removed in a later release. ([#6470](https://github.com/databricks/cli/pull/6470))
+ * Add orthogonal `--no-constraints` and `--no-dbconnect` flags to `databricks environments setup-local`: `--no-constraints` skips writing the remote Python-version and dependency pins, and `--no-dbconnect` skips the databricks-connect dependency. ([#6464](https://github.com/databricks/cli/pull/6464))
+ * `databricks environments setup-local` now reports a distinct `E_PROVISION_CONFLICT` error code in `--output json` when the project's dependencies conflict with the pins written for the target environment, making the requirements unsatisfiable (the same conflict surfaced as a `W_USER_CONSTRAINT_CONFLICT` warning); it is reported after the project files are written, without attempting the doomed provisioning, while other provisioning failures continue to report `E_PROVISION`. ([#6479](https://github.com/databricks/cli/pull/6479))
+ * `databricks ssh connect` and `ssh setup` now verify the tunnel's SSH host key against the key the workspace published for the connection, recorded in `~/.databricks/ssh-tunnel-known-hosts/<name>` instead of `~/.ssh/known_hosts`. Reconnecting with a name used before no longer fails with `Host key verification failed` when the compute behind that name changed, and no longer needs a manual `ssh-keygen -R`; host blocks written by an earlier `databricks ssh setup` pick this up once you re-run it. ([#6557](https://github.com/databricks/cli/pull/6557))
+ * Stop `databricks ssh connect --ide` from adding a duplicate entry to the IDE's Remote Explorer on every connect: the remote authority is now the SSH host alias alone, instead of embedding the per-instance remote OS user. ([#6550](https://github.com/databricks/cli/pull/6550))
+ * Add `--max-clients` and `--server-timeout` flags to `databricks ssh setup`, and `--server-timeout` to `databricks ssh connect`. Both are fixed when the SSH tunnel server job is submitted, so `ssh setup` now serializes them into the generated `ProxyCommand` instead of falling back to the built-in defaults. ([#6547](https://github.com/databricks/cli/pull/6547))
+ * `ssh connect` sessions no longer end when the tunnel's websocket connection is lost. The CLI reattaches to the running session and replays the bytes that were missed, so the shell and everything running in it stay intact, and a transient failure to open a replacement connection for the periodic auth refresh is retried rather than ending the session. Reattaching requires an SSH server started by a CLI that supports it; against an older server the connection behaves as before. ([#6558](https://github.com/databricks/cli/pull/6558))
+
+### Bundles
+
+ * Added PyDABs (Python) support for secrets: `Resources.add_secret` and the `secret_mutator` decorator. ([#6553](https://github.com/databricks/cli/pull/6553))
+ * Fix job and pipeline environment dependencies with a `*` version wildcard (e.g. `numpy==2.5.*`) being treated as local file paths. ([#6555](https://github.com/databricks/cli/pull/6555))
+ * Add the `postgres_snapshot_schedules` bundle resource for managing a Lakebase Postgres branch's automatic-snapshot schedule (direct deployment engine only). ([#6449](https://github.com/databricks/cli/pull/6449))
+
+### Dependency Updates
+
+ * Bump `github.com/databricks/databricks-sdk-go` from v0.175.0 to v0.177.0. ([#6448](https://github.com/databricks/cli/pull/6448))
+ * Bump Terraform provider from v1.128.0 to v1.131.0. ([#6544](https://github.com/databricks/cli/pull/6544))
+
+
+## Release v1.15.0 (2026-09-03)
+
+### CLI
+
+ * When `uv python install` fails, `databricks environments setup-local` now falls back to a compatible Python interpreter already installed on the machine. ([#6457](https://github.com/databricks/cli/pull/6457))
+ * Allow `databricks environments setup-local` to update `pyproject.toml` files containing TOML multi-line strings. ([#6445](https://github.com/databricks/cli/pull/6445))
+
+### Bundles
+
+ * Before committing the automatic terraform→direct migration, run a deployment plan against the converted state; if the plan fails the migration is abandoned. ([#6486](https://github.com/databricks/cli/pull/6486))
+ * The `dbt-sql` bundle template now uses Databricks Runtime 16.4 LTS (up from 15.4 LTS) for classic (non-serverless) compute. ([#6418](https://github.com/databricks/cli/pull/6418))
+ * Fixed the direct engine silently ignoring edits to duration and timestamp fields, such as a Lakebase endpoint's `suspend_timeout_duration`. Such a change planned `0 to change` and was never applied. ([#6377](https://github.com/databricks/cli/pull/6377))
+ * Fixed `$${...}` not escaping a literal `${...}` on the direct engine, which failed with an `invalid dependency` error. ([#6484](https://github.com/databricks/cli/pull/6484), [#6489](https://github.com/databricks/cli/pull/6489))
+ * Remove forward_user_access_token from update_mask for Apps because it's not supported. Fixes regression in 1.14.1. ([#6510](https://github.com/databricks/cli/pull/6510))
+ * direct: Fix deploying an update to `postgres_projects.default_endpoint_settings`. ([#6440](https://github.com/databricks/cli/pull/6440))
+ * direct: Fix deploying an update to `postgres_endpoints.settings.pg_settings`. ([#6441](https://github.com/databricks/cli/pull/6441))
+ * direct: Fix deploying an update to `expire_time`, `ttl` or `suspend_timeout_duration` on Lakebase resources. ([#6443](https://github.com/databricks/cli/pull/6443))
+ * Added PyDABs (Python) support for catalogs: `Resources.add_catalog` and the `catalog_mutator` decorator. ([#6408](https://github.com/databricks/cli/pull/6408))
+ * Bundle templates now use serverless [environment version 5](https://docs.databricks.com/aws/en/release-notes/serverless/environment-version/five), which offers better performance, and `databricks-connect` 16.4. ([#6378](https://github.com/databricks/cli/pull/6378))
+ * Fixed a job with a `table_update` trigger never converging on the direct engine. ([#6442](https://github.com/databricks/cli/pull/6442))
+
+### Dependency Updates
+
+ * Bump Go toolchain to 1.26.8. ([#6476](https://github.com/databricks/cli/pull/6476))
+
+
+## Release v1.14.1 (2026-08-28)
+
+### Bundles
+
+ * Fix `bundle deploy` failing with `deployment_source.source_code_path cannot be set on UpdateApp` (400) when updating an app that has an active deployment ([#6401](https://github.com/databricks/cli/issues/6401)).
+ * Fixed `${resources...}` references to resource keys starting with an underscore (e.g. `_my_job`). On the direct engine, deploying such a resource with `permissions` or `grants` failed with `cannot parse "/jobs/${resources.jobs._my_job.id}"`, and user-written references to it were silently left unresolved.
+
+
+## Release v1.14.0 (2026-08-26)
+
+### Notable Changes
+
+ * Bundles still on Terraform state are now migrated to the direct engine automatically, after a deploy whose dry-run conversion comes back clean. To opt out, set `engine: terraform` under `bundle` or `DATABRICKS_BUNDLE_ENGINE=terraform`. See https://docs.databricks.com/aws/en/dev-tools/bundles/direct
+
+### CLI
+
+ * Fixed idle `databricks ssh connect` sessions disconnecting after a few minutes, on dedicated clusters and on serverless. The tunnel now keeps itself warm: the SSH client and the SSH server on the compute exchange keepalives every 30 seconds, and the CLI's proxy pings the tunnel's websocket every 20 seconds. A session nobody is typing into stays connected, with no need to set `ServerAliveInterval` by hand.
+
+### Bundles
+
+ * `bundle plan` no longer reports a permanent, unconvergeable update on `securable_kind` for Unity Catalog `TABLE` securables declared under an app's `resources`. The field is computed by the backend (output-only), so it is now ignored during drift detection. Direct engine only ([#6342](https://github.com/databricks/cli/issues/6342)).
+ * Add support for the `cluster_policies` resource type in Declarative Automation Bundles. Cluster policies are only supported in direct deployment mode.
+ * `bundle destroy` no longer counts resources that are already gone remotely in its `Destroy: N deleted` summary. Such deletes only clean up stale state and are not listed under the deletion prompt, so they are now excluded from the count as well, matching the terraform engine.
+ * `bundle destroy` now also removes the directory named after the bundle, not just the target directory beneath it, when `workspace.root_path` ends in `${bundle.name}/${bundle.target}` — which includes the default root path. It is removed non-recursively, so it stays in place while another target of the same bundle is still deployed there. Previously every destroy left an empty directory behind ([#6317](https://github.com/databricks/cli/pull/6317)).
+ * `job_runs` now plans skip for a run that is still in progress and when `on_bundle_deploy` is removed, instead of treating either case as an update. ([#6357](https://github.com/databricks/cli/pull/6357))
+ * Added `DATABRICKS_BUNDLE_RESOURCE_MAX_WAIT` (in seconds) to cap how long deploy and destroy wait for a resource. Direct engine only.
+ * Fixed `bundle deploy` on the direct engine failing with `Nothing to update`, or reporting a change it never applied, when a schema, catalog, volume, registered model or external location field was removed from the configuration or set outside the bundle. The update now sends the fields the plan reports as cleared instead of dropping them.
+
+### Dependency Updates
+
+ * Bump `github.com/databricks/databricks-sdk-go` from v0.171.0 to v0.175.0 ([#6322](https://github.com/databricks/cli/pull/6322)).
+ * Bump Terraform provider from v1.127.0 to v1.128.0 ([#6323](https://github.com/databricks/cli/pull/6323)).
+
+
+## Release v1.13.0 (2026-08-20)
+
+### Notable Changes
+
+ * `bundle deploy` now reports the per-resource actions it took, how many files it synced, and a summary of created/changed/deleted/unchanged resources; `bundle destroy` reports how many resources it deleted. `-q` prints only the summaries, `-qq` only warnings and errors. ([#5720](https://github.com/databricks/cli/pull/5720))
+
+### CLI
+
+ * `databricks aitools install` now supports Goose, installing Databricks agent skills into its skills directory.
+ * Error messages for failed key lookups and variable references now suggest the closest matching key if one is found. ([#6208](https://github.com/databricks/cli/pull/6208))
+ * Released binaries are now built against the FIPS 140-3 validated Go Cryptographic Module, with FIPS 140-3 mode enabled by default. TLS connections negotiate only FIPS-approved cipher suites, which drops ChaCha20 and CBC from what the client offers. FIPS mode can be disabled at startup with `GODEBUG=fips140=off`, which restores the previous TLS behaviour ([#6262](https://github.com/databricks/cli/pull/6262)).
+ * `databricks environments setup-local` now removes a `databricks-connect` pin from `[project].dependencies`, an optional-dependency extra, or a dependency group when its version range conflicts with the compute target's `databricks-connect` version, so `uv sync` no longer fails with an unsatisfiable resolution when a template ships a conflicting pin. A pin that co-resolves, carries no version, or is marker-gated is left untouched, and each removed pin is reported with the new `W_DBCONNECT_CONSOLIDATED` warning. Wildcard version pins such as `==15.1.*` are now also checked for conflicts with the environment's constraints.
+
+### Bundles
+
+ * Allow dashes in the catalog and schema names prompted by `databricks bundle init`, and backtick-quote the catalog and schema identifiers in the SQL generated by the built-in templates so names with dashes work at runtime.
+ * Fixed `bundle.git.branch`, `bundle.git.commit`, and `bundle.git.origin_url` being empty for bundles deployed from a workspace Git folder that has Git CLI access. The workspace API does not report git metadata for those folders, so it is now read from the Repos API instead.
+ * direct: job_runs deploy progress lines now include the resource key (e.g. `Output from job_runs.foo: id=123: ...`) so concurrent runs are easier to tell apart.
+ * direct: `resources.job_runs` can set `lifecycle.triggers.on_bundle_deploy: true` to re-fire the run on every bundle deploy. Removing the trigger does not recreate the existing run.
+ * When migrating a bundle to the direct deployment engine, resources that only the direct engine supports (e.g. instance pools, catalogs) are now skipped by the deploy that migrates the state instead of failing it. They are created by the next deploy, which runs on the migrated state.
+ * Warn on invalid `secret_scopes` permission levels (`READ`, `WRITE`, `MANAGE`); fail under `bundle validate --strict`.
+ * Reject secret scope permissions that name no principal, instead of failing after the scope is created.
+ * Write the deployment state atomically so an interrupted save cannot leave a state file that the CLI refuses to read.
+ * Warn when the deployment state was last written by a newer CLI version than the one running.
+ * Support pip extras (e.g. `[train]`) on local wheels in a job environment's `dependencies` ([#1602](https://github.com/databricks/cli/issues/1602)).
+
+### Dependency Updates
+
+ * Bump `github.com/databricks/databricks-sdk-go` from v0.170.0 to v0.171.0 ([#6320](https://github.com/databricks/cli/pull/6320)).
+ * Bump the Databricks Terraform provider to 1.127.0 ([#6319](https://github.com/databricks/cli/pull/6319)).
+ * Bump Go toolchain to 1.26.6 ([#6266](https://github.com/databricks/cli/pull/6266)).
+ * Bump Go toolchain to 1.26.7 ([#6325](https://github.com/databricks/cli/pull/6325)).
+
+
+## Release v1.12.1 (2026-08-12)
+
+### Dependency Updates
+
+ * Bump `github.com/databricks/databricks-sdk-go` from v0.166.0 to v0.170.0 ([#6251](https://github.com/databricks/cli/pull/6251)).
+
+
+## Release v1.12.0 (2026-08-12)
+
+### CLI
+
+ * `databricks aitools install` now supports Gemini CLI, installing Databricks agent skills into its skills directory.
+ * `databricks aitools install` now supports Pi, installing Databricks agent skills into its skills directory.
+ * A locally built CLI (`go build`, without release flags) now reports the next release version with a `-dev` prerelease, e.g. `1.12.0-dev+abcdef123456`, instead of `0.0.0-dev+abcdef123456`. The old string sorted below every published release even though a local build is newer than the latest release; the new one sorts above the latest release and below the release it will become, matching what goreleaser already produces for snapshot builds.
+ * Added the `databricks environments setup-local` command, which provisions (or updates) a local Python environment matched to a Databricks compute target. It resolves the target to an environment key, fetches the pinned Python version, databricks-connect version, and dependency constraints published for that key, then provisions a matched `.venv` with uv.
+
+### Bundles
+
+ * Added a `cascade_on_destroy` field to the pipeline resource to control whether destroying a pipeline also deletes its datasets (MVs, STs, Views). When unset, the server default applies; set `cascade_on_destroy: false` to retain the datasets on destroy. Supported with the direct deployment engine ([#5846](https://github.com/databricks/cli/pull/5846)).
+ * Fix `bundle.deployment.lock.force` being ignored. The `--force-lock` flag's default value overwrote the value configured in `databricks.yml`, so setting the field had no effect and a stale deployment lock could only be overridden with the flag. ([#6188](https://github.com/databricks/cli/pull/6188))
+ * direct: experimental `job_runs` now sends a CLI-managed idempotency token on every run-now, so an SDK retry after a lost response returns the same run. Configured `idempotency_token` values are rejected.
+ * direct: the experimental `job_runs` resource now waits for the triggered run to finish, so other resources can reference its outcome (e.g. `${resources.job_runs.nightly.state.result_state}`). A run that does not succeed fails the deploy, naming the failed task, and is run again on the next deploy. If a deploy is interrupted while waiting, the next one resumes waiting on the same run.
+ * direct: Fixed model serving `telemetry_config` drift and applied planned telemetry updates. Unsupported endpoint types now fail when telemetry is applied; create may still succeed because it drops the field ([#6106](https://github.com/databricks/cli/pull/6106)).
+ * The `cli_version` field in the direct engine's deployment state (`resources.json`) now records the CLI version that last wrote the state. Previously it kept the version of the CLI that first created the state.
+ * Add support for UC secrets resource ([#5861](https://github.com/databricks/cli/pull/5861))
+
+### Dependency Updates
+
+ * Bump `github.com/databricks/databricks-sdk-go` from v0.166.0 to v0.169.0.
+ * Bump Terraform provider from v1.124.0 to v1.126.0 ([#6250](https://github.com/databricks/cli/pull/6250)).
+
+
+## Release v1.11.0 (2026-08-06)
+
+### CLI
+
+ * Fixed `databricks repos get/update/delete` failing with `object at path "..." is not a repo` for Git-CLI-enabled folders (currently in preview), which the workspace API reports as directories rather than repos ([#6181](https://github.com/databricks/cli/pull/6181)).
+ * Support `dbfs:/Skills/...` paths in `databricks fs` commands, routed to the Files API. ([#6147](https://github.com/databricks/cli/pull/6147))
+
+### Bundles
+
+ * For jobs where `ai_runtime_task.code_source_path` is a relative path to a local directory, the directory is now packaged into a tarball (honoring `.gitignore` and `sync.include`/`sync.exclude`), uploaded during deployment, and `code_source_path` is rewritten to the uploaded workspace path. ([#6110](https://github.com/databricks/cli/pull/6110))
+ * Added JSON output to `bundle init`. Running `databricks bundle init <template> -o json` now reports the files the template wrote, relative to the output directory. This lets callers that pass `--output-dir` learn where the template materialized instead of assuming the output is a single directory named after the project. The default text output is unchanged. ([#6161](https://github.com/databricks/cli/pull/6161))
+ * The terraform deployment engine is deprecated and will stop working in a future version of the CLI. Setting `bundle.engine: terraform` now emits a deprecation warning. See https://docs.databricks.com/aws/en/dev-tools/bundles/direct for how to migrate to the direct deployment engine. ([#6099](https://github.com/databricks/cli/pull/6099))
+ * Fixed the direct deployment engine planning a spurious `create` for an empty `grants: []` list. Terraform records no grants resource for such a list, so `bundle plan` after `bundle deployment migrate` no longer reports an action for it. Emptying a previously deployed list still revokes the grants, after which the node is dropped from the deployment state instead of being reported as unchanged forever. ([#6039](https://github.com/databricks/cli/pull/6039))
+ * Fixed `bundle generate` downloading notebooks found inside a folder without their file extension. They are now exported like top-level notebooks, so a Python notebook lands as `notebook.py` instead of an extensionless file ([#6144](https://github.com/databricks/cli/pull/6144)).
+ * direct: `webhook_notifications.on_*` destinations on jobs, tasks, and `for_each_task` are now compared as unordered sets. Previously the Jobs API returning these lists in a different order than submitted produced a phantom diff that `bundle plan` and `bundle deploy` could never converge past, reporting `1 to change` on every run ([#6060](https://github.com/databricks/cli/pull/6060)).
+ * Fixed a pipeline with `allow_duplicate_names: true` never converging on the direct engine: the field is only accepted on create/update and is never returned by the pipelines GET API, so every subsequent `bundle plan` reported the pipeline as a perpetual update. ([#6076](https://github.com/databricks/cli/pull/6076))
+ * direct: A local change to an input-only field (one the API accepts on write but never returns on read, e.g. pipelines' `run_as` or external locations' `skip_validation`) is no longer silently skipped when the new value coincidentally matches the field's fabricated remote value. Previously such a change could hit the `remote_already_set` shortcut and be dropped from the plan. ([#6112](https://github.com/databricks/cli/pull/6112))
+ * Revert usage of RedactiveSenstiveFields (added in [#5896](https://github.com/databricks/cli/pull/5896), released in 1.10.0) which lead to incorrect behaviour (permanent drift) for duration field in Postgres resources ([#6179](https://github.com/databricks/cli/pull/6179)).
+ * Document postgres resource fields in the json schema ([#6164](https://github.com/databricks/cli/pull/6164), [#6163](https://github.com/databricks/cli/pull/6163)).
+ * direct: Recreating a `vector_search_indexes` resource no longer fails with "Index ... is currently pending deletion" when the backend has not yet released the index name. The create is now retried until the name becomes available. ([#6143](https://github.com/databricks/cli/pull/6143))
+
+### Dependency Updates
+
+ * Bump `github.com/databricks/databricks-sdk-go` from v0.165.0 to v0.166.0. ([#6175](https://github.com/databricks/cli/pull/6175))
+ * Upgrade Terraform provider to 1.124.0. ([#6174](https://github.com/databricks/cli/pull/6174))
+
+
+## Release v1.10.0 (2026-07-29)
+
+### CLI
+
+ * `ssh connect` now supports specifying a serverless usage policy with `--usage-policy-id`
+
+### Bundles
+
+ * Fixed `bundle deploy`/`bundle destroy` failing when an app enters the transient DELETING state between plan and apply (e.g. with a saved plan); the delete is now treated as complete instead of erroring (direct engine only).
+ * Fixed `bundle deploy`/`bundle destroy` failing when an app is still in the transient DELETING state; the delete is now treated as complete instead of erroring (direct engine only).
+ * `bundle destroy --force-lock` now proceeds without a deployment lock when the workspace directory is at its child-node limit and cannot accept the lock file, so a deployment can still be torn down when the workspace is full.
+ * Empty-string values on optional (omitempty) resource fields are now dropped before deployment instead of being sent to the backend. This fixes deploys failing with errors like `'' is not a valid cluster policy ID` when a field such as `policy_id` was set to `""` (often via a variable that resolved to an empty string). The behavior now matches between the terraform and direct engines and is reflected in `bundle validate -o json`.
+ * `bundle validate` and `bundle deploy` now reject a grant that is missing a `principal` with an error instead of a warning. Previously the deploy would start and, on the direct engine, create the securable before the grants PATCH failed (`400 INVALID_PARAMETER_VALUE`), leaving a partially-applied deployment.
+ * `bundle validate` and `bundle deploy` now reject a grant with an empty `privileges` list with an error. Previously, on the direct engine, such a grant never converged: the backend drops principals with no privileges, so every subsequent `bundle plan` reported the grant as a perpetual update.
+ * Fixes [#6030](https://github.com/databricks/cli/issues/6030): spurious `update` on catalog/schema/volume grants (direct engine); a principal granted `ALL_PRIVILEGES` no longer drifts when the backend also reports the concrete privileges it implies ([#6064](https://github.com/databricks/cli/pull/6064)).
+ * Use vector search endpoint permission types that are supported by the backend ([#6022](https://github.com/databricks/cli/pull/6022)).
+
+### Dependency Updates
+
+ * Bump `github.com/databricks/databricks-sdk-go` from v0.160.0 to v0.165.0.
+ * Upgrade Terraform provider to 1.123.0
+
+
+## Release v1.9.0 (2026-07-22)
+
+### CLI
+
+ * `databricks auth profiles` no longer stalls on an unreachable workspace and instead fails validation after 5 seconds per host ([#5928](https://github.com/databricks/cli/pull/5928)).
+ * Fixed `databricks fs rm -r` failing on UC Volumes backed by GCS when a directory becomes empty during recursive deletion ([#5958](https://github.com/databricks/cli/pull/5958)).
+ * You can now ask questions about your data directly from the CLI with `databricks genie ask "..."`. Genie answers natural-language questions ("what were total sales last month?", "which tables are in the sales catalog?"), runs the query inside Databricks, and renders the answer in the terminal. This promotes the former `databricks experimental genie ask` command; the experimental alias still works but is deprecated and will be removed in a future release ([#6010](https://github.com/databricks/cli/pull/6010)).
+
+### Bundles
+
+ * `bundle validate` now reports a clear error when a `sql_warehouse` is missing a `name` (including whitespace-only names), and a warning when a grant is missing a `principal` ([#5818](https://github.com/databricks/cli/pull/5818)).
+ * Bundle templates now scaffold an `AGENTS.md` that points coding agents at Databricks AI Tools, alongside a minimal `CLAUDE.md` that includes it via `@AGENTS.md` ([#5996](https://github.com/databricks/cli/pull/5996)).
+ * `bundle generate job` can now download workspace files referenced by `spark_python_task`, rewriting them to a relative path like it already does for notebooks. This is opt-in via the `--download-spark-python-files` flag ([#5799](https://github.com/databricks/cli/pull/5799)).
+ * Simplified the `default-minimal` bundle template and added an alias `databricks bundle init empty` ([#5899](https://github.com/databricks/cli/pull/5899)).
+ * Add support for the `instance_pools` resource type in Declarative Automation Bundles. Instance pools are only supported in direct deployment mode.
+ * Do not emit "unknown field" warnings for YAML anchors grouped in a list or map, matching the existing suppression for standalone anchors ([#5975](https://github.com/databricks/cli/pull/5975)).
+ * Provide an actionable error message if databricks.yml is missing or DATABRICKS_BUNDLE_ROOT is invalid ([#5953](https://github.com/databricks/cli/pull/5953)).
+
+### Dependency Updates
+
+ * Bump `github.com/databricks/databricks-sdk-go` from v0.154.0 to v0.160.0 ([#5982](https://github.com/databricks/cli/pull/5982)).
+ * Bump Terraform provider from v1.121.0 to v1.122.0 ([#5977](https://github.com/databricks/cli/pull/5977)).
+
+
+## Release v1.8.0 (2026-07-15)
+
+### Notable Changes
+
+ * Auto-migrate a bundle from terraform to the direct engine when `bundle.engine` is `"direct"` (or `DATABRICKS_BUNDLE_ENGINE=direct`) and the post-deploy dry-run migration is clean; a warning is emitted if the dry-run surfaces errors or warnings so the automatic migration is skipped.
+
+### CLI
+
+ * experimental `ssh connect`: bare `python`/`pip` in an interactive session now resolve to the environment interpreter (`$DATABRICKS_VIRTUAL_ENV`) instead of the system or cluster-libraries interpreter, so packages installed in the environment are importable without extra setup. The interactive shell is now non-login (`bash -i`) and the server seeds a `~/.bashrc` snippet that re-prepends the environment's bin directory to `PATH` ([#5888](https://github.com/databricks/cli/pull/5888)).
+ * When Claude Code runs the CLI without the Databricks AI tooling installed, the CLI now prints a one-line recommendation on stderr to run `databricks aitools install`. The recommendation is shown at most once per hour per Claude session, and never for human callers or `aitools` commands.
+ * Fixed `databricks auth describe` misattributing a profile selected via `DATABRICKS_CONFIG_PROFILE` as `(from bundle)` when run inside a bundle root ([#5904](https://github.com/databricks/cli/pull/5904)).
+
+### Bundles
+
+ * `bundle generate` now warns when the generated configuration file is not matched by any pattern in the `include` section of `databricks.yml` ([#5868](https://github.com/databricks/cli/pull/5868)).
+ * direct: Match UC Auto Upgrade managed property defaults with a wildcard pattern instead of enumerating each key ([#5877](https://github.com/databricks/cli/pull/5877)).
+ * Recognize `ssh://` template URLs in `databricks bundle init` ([#5891](https://github.com/databricks/cli/pull/5891)).
+ * `databricks bundle init` now reports an actionable error when given a template URL with an unsupported protocol (`http://`, `git://`, `ftp://`, `ftps://`) instead of failing with a confusing "not a bundle template" message ([#5902](https://github.com/databricks/cli/pull/5902)).
+ * Added an `env:` section to `scripts.<name>` for declaring environment variables that may reference `${bundle.*}`, `${workspace.*}`, and `${var.*}` ([#4179](https://github.com/databricks/cli/issues/4179), [#5299](https://github.com/databricks/cli/pull/5299)).
+
+
+## Release v1.7.0 (2026-07-09)
+
+### CLI
+
+* An explicitly selected profile (`--profile` or a bundle's `workspace.profile`) now takes precedence over auth environment variables (`DATABRICKS_HOST`, `DATABRICKS_TOKEN`, etc.) instead of being silently shadowed by them; env vars still fill auth fields the profile leaves empty ([#5096](https://github.com/databricks/cli/issues/5096)).
+* Fix intermittent crashes when processing pages from API calls ([#5815](https://github.com/databricks/cli/pull/5815)).
+
+### Bundles
+
+* direct: add basic version of job_runs resource (experimental) ([#5603](https://github.com/databricks/cli/pull/5603)).
+* Fix permissions added to a job or pipeline by a Python (PyDABs) mutator failing to deploy with "must have exactly one owner"; the deploying identity is now set as owner, matching resources whose permissions are declared in YAML ([#5821](https://github.com/databricks/cli/pull/5821)).
+* Remove duplicate enum values for jsonschema.json ([#5839](https://github.com/databricks/cli/pull/5839)).
+* direct: volumes: support `volume_path` property ([#5550](https://github.com/databricks/cli/pull/5550)).
+* direct: Fix deploy bug when a `postgres_projects`, `postgres_branches`, or `postgres_endpoints` field is set to its zero value (e.g. `enable_pg_native_login: false`, `replace_existing: false`) ([#5782](https://github.com/databricks/cli/pull/5782)).
+* `bundle run --only` help now documents the `+` modifier syntax: prefix a task key with `+` to also run its upstream tasks, or suffix it with `+` for downstream tasks ([#5760](https://github.com/databricks/cli/pull/5760)).
+* direct: Recognize UC-managed catalog and schema property defaults to avoid unnecessary drift ([#5865](https://github.com/databricks/cli/pull/5865) & [#5870](https://github.com/databricks/cli/pull/5870)).
+* Fix `bundle deploy --select <resource>` skipping the resource's grants and permissions; they are now applied as part of the selected resource ([#5852](https://github.com/databricks/cli/pull/5852)).
+* Support `purge_on_delete: true` on `postgres_branches` so bundles can hard-delete a Lakebase branch on destroy (skipping the soft-delete retention window) ([#5801](https://github.com/databricks/cli/pull/5801)).
+* Support `replace_existing: true` on `postgres_databases` and `postgres_roles` so bundles can take over a database or role that already exists on a Lakebase branch instead of failing with `ALREADY_EXISTS` ([#5803](https://github.com/databricks/cli/pull/5803)).
+
+### Dependency updates
+
+* Bump databricks-sdk-go to v0.154.0 ([#5855](https://github.com/databricks/cli/pull/5855)).
+* Bump terraform-provider to 1.121.0 ([#5857](https://github.com/databricks/cli/pull/5857)).
+* Bump OpenTelemetry dependencies to v1.44.0 to address [CVE-2026-41178](https://github.com/advisories/GHSA-5wrp-cwcj-q835) ([#5873](https://github.com/databricks/cli/pull/5873)).
+
+
+## Release v1.6.0 (2026-07-02)
+
+### CLI
+
+ * `ssh connect` now accepts a `--base-environment` flag to run a serverless session on a custom base environment. It takes an `env.yaml` path, a `workspace-base-environments/...` resource ID, or a base environment display name, and is rejected together with `--environment-version` or `--cluster` ([#5706](https://github.com/databricks/cli/pull/5706)).
+ * `databricks aitools install` is now plugin-first: it installs the Databricks plugin through each agent's own CLI (Claude Code, Codex, GitHub Copilot) instead of copying raw skill files. Agents without a plugin (OpenCode, Antigravity) still get skill files, and Cursor prints the `/add-plugin databricks` step. Use `--skills-only` to force raw skill files for every agent, or `--path <dir>` to write skills to a directory ([#5738](https://github.com/databricks/cli/pull/5738)).
+ * `databricks labs list` now only shows projects that can be installed ([#5560](https://github.com/databricks/cli/pull/5560)).
+
+### Bundles
+
+ * direct: Fixed persistent drift on `model_serving_endpoints` caused by the `traffic_config` field ([#5708](https://github.com/databricks/cli/pull/5708)).
+ * direct: Fix spurious update when `apply_policy_default_values: true` is set on job task, for-each-task, or job cluster new_cluster ([#5731](https://github.com/databricks/cli/pull/5731)). Also fix spurious updates for for-each-task clusters due to missing backend defaults for `data_security_mode`, `node_type_id`, `driver_node_type_id`, `driver_instance_pool_id`, `enable_elastic_disk`, and `enable_local_disk_encryption`.
+ * direct: Cluster resize now falls back to regular update if resize fails due to `INVALID_STATE` ([#5716](https://github.com/databricks/cli/pull/5716)).
+ * `bundle generate dashboard` now honors the `--key` flag when naming the generated resource, and rejects combining `--existing-path`, `--existing-id`, and `--resource` instead of silently ignoring all but one ([#5492](https://github.com/databricks/cli/pull/5492)).
+ * Fixed `bundle deployment migrate` failing on `model_serving_endpoints`/`database_instances` with permissions (regression since v1.5.0) ([#5775](https://github.com/databricks/cli/pull/5775)).
+ * After a terraform deploy, the CLI now dry-runs a migration to the direct engine (writing nothing locally or remotely) and reports the outcome via telemetry, warning if the migration could not be completed ([#5797](https://github.com/databricks/cli/pull/5797)).
+
+### Dependency updates
+ * Bump `github.com/databricks/databricks-sdk-go` from v0.147.0 to v0.152.0 ([#5773](https://github.com/databricks/cli/pull/5773)).
+ * Bump Terraform provider from v1.118.0 to v1.120.0 ([#5792](https://github.com/databricks/cli/pull/5792)).
+
+
+## Release v1.5.0 (2026-06-24)
+
+### CLI
+* `workspace export-dir` no longer aborts when a workspace object's name is not a legal local filename (e.g. a notebook named `New Notebook 2026-05-04 13:54:24` whose `:` is illegal on Windows). Such files are now exported under a sanitized name with a warning and the export completes ([#5171](https://github.com/databricks/cli/issues/5171)).
+* `ssh connect` now opens an interactive `bash` login shell by default instead of the compute image's default `/bin/sh`, falling back gracefully when `bash` is unavailable. Passing an explicit remote command (`-- <cmd>`) is unaffected ([#5687](https://github.com/databricks/cli/pull/5687)).
+* `ssh connect` interactive sessions now start in the user's workspace home folder (`/Workspace/Users/<email>`) instead of the OS home directory, falling back to the OS home when that folder is unavailable ([#5688](https://github.com/databricks/cli/pull/5688)).
+
+### Bundles
+* Add documentation for the common bundle resource fields `permissions`, `lifecycle`, and `grants` in the JSON schema, so they surface in editor completions and the docs.
+* `bundle run` now prints the modern job run URL (`/jobs/<id>/runs/<id>`) so that non-admin users permitted to view the run are taken to the run instead of the workspace homepage.
+* References to a registered model's `registered_model_id` now resolve under the direct engine, matching Terraform behavior ([#5621](https://github.com/databricks/cli/pull/5621)).
+* Fix missing field descriptions in the bundle JSON schema for fields whose upstream API docs arrived after the field was first annotated (e.g. `vector_search_endpoints.*.target_qps`); stale placeholder markers no longer hide them ([#5588](https://github.com/databricks/cli/pull/5588)).
+* Fix `bundle deploy --plan` dropping a `postgres_role`'s `role_id`, which caused the role to be recreated on the next deploy ([#5672](https://github.com/databricks/cli/pull/5672)).
+* direct: Fix spurious cluster recreate when `apply_policy_default_values: true` is set ([#5693](https://github.com/databricks/cli/pull/5693)).
+* direct: New 'deployment migrate' implementation that parses terraform state instead of fetching resources state from the backend ([#5399](https://github.com/databricks/cli/pull/5399)).
+
+### Dependency updates
+* Bump `github.com/databricks/databricks-sdk-go` from v0.141.0 to v0.147.0 ([#5636](https://github.com/databricks/cli/pull/5636)).
+* Bump Terraform provider from v1.117.0 to v1.118.0 ([#5637](https://github.com/databricks/cli/pull/5637)).
+
+
+## Release v1.4.0 (2026-06-17)
+
+### CLI
+* Improved error messages for `ssh connect`: when an SSH connection attempt fails, the client now fetches and prints the server's recent error logs ([#5555](https://github.com/databricks/cli/pull/5555)).
+* Increase the SSH server startup timeout from 10 to 45 minutes when a GPU accelerator is requested via `databricks ssh connect --accelerator` ([#5569](https://github.com/databricks/cli/pull/5569)).
+* Fix authentication falling back to the default profile in `.databrickscfg` when a host is already configured via the environment (e.g. `DATABRICKS_HOST` with `DATABRICKS_TOKEN`) ([#5616](https://github.com/databricks/cli/pull/5616)).
+* ssh: fix opening remote environment in Cursor, which previously hung on default-extension install and never opened the editor ([#5619](https://github.com/databricks/cli/pull/5619)).
+* Improve the error shown when `databricks labs install` cannot find a project's `labs.yml`: the message now explains that either the requested version does not exist or the project is not installable with the CLI, and links to the repository ([#5559](https://github.com/databricks/cli/pull/5559)).
+
+### Bundles
+* Remove API enum values and types that are still in development from the `databricks-bundles` Python package; these were never accepted by the backend ([#5484](https://github.com/databricks/cli/pull/5484)).
+* direct: Fix resolving a resource reference that is used more than once within the same field ([#5558](https://github.com/databricks/cli/pull/5558)).
+* Bundle variable references now accept Unicode letters in path segments (e.g. `${var.变量}`). ([#5532](https://github.com/databricks/cli/pull/5532))
+* Ignore remote changes for vector search direct_access_index_spec.schema_json to prevent drift when the backend normalizes the schema ([#5481](https://github.com/databricks/cli/pull/5481)).
+* Remove hidden, never-functional `--existing-dashboard-id`, `--existing-dashboard-path`, `--existing-alert-id`, and `--existing-genie-space-id` alias flags from `bundle generate`; use the documented `--existing-id` / `--existing-path` flags instead ([#5591](https://github.com/databricks/cli/pull/5591)).
+* engine/direct: Fix WAL corruption after two consecutive failed deploys ([#5606](https://github.com/databricks/cli/pull/5606)).
+* engine/direct: Don't open the deployment state WAL when a deploy's plan fails ([#5607](https://github.com/databricks/cli/pull/5607)).
+* Ignore unity catalog managed schema property defaults to avoid unnecessary drift ([#5195](https://github.com/databricks/cli/pull/5195)).
+* Add `postgres_roles` and `postgres_databases` resources to create Postgres roles and databases on a Lakebase branch ([#5467](https://github.com/databricks/cli/pull/5467), [#5627](https://github.com/databricks/cli/pull/5627)).
+* direct: Stop spurious recreate/rename on redeploy when the backend normalizes a resource's name-based ID (e.g. Unity Catalog lowercasing a schema or volume name) ([#5599](https://github.com/databricks/cli/pull/5599)).
+* Fix the generated pipeline README to suggest `databricks bundle run <pipeline> --refresh <table>` for running a single transformation; the previously documented `--select` flag is not supported by `bundle run` ([#5252](https://github.com/databricks/cli/issues/5252)).
+
+
+## Release v1.3.0 (2026-06-10)
+
+### Notable Changes
+* The `direct` deployment engine is now Generally Available and the default for new deployments. To opt out, set `engine: terraform` under `bundle` in your `databricks.yml` or set `DATABRICKS_BUNDLE_ENGINE=terraform`. Existing deployments keep their current engine; see https://docs.databricks.com/aws/en/dev-tools/bundles/direct to migrate.
+
+### CLI
+* Added the `databricks quickstart` command, a short introduction to the CLI that prints a human-friendly guide interactively and an agent-oriented version when run non-interactively ([#5464](https://github.com/databricks/cli/pull/5464)).
+* Add `databricks version --check` to report whether a newer CLI version is available and print the upgrade command for the detected install method ([#5469](https://github.com/databricks/cli/pull/5469)).
+* `databricks auth describe` now verifies credentials against both the workspace and account endpoints before reporting a failure, fixing false "Unable to authenticate" errors for account console profiles ([#5479](https://github.com/databricks/cli/issues/5479)).
+* `databricks auth login` no longer prompts for workspace selection when logging in to an account console host (`https://accounts.*`). Pass `--workspace-id` explicitly to store a workspace ID on such a profile ([#5504](https://github.com/databricks/cli/pull/5504)).
+* `databricks auth profiles --skip-validate` no longer makes any network calls; the host metadata fetch is skipped along with validation ([#5530](https://github.com/databricks/cli/pull/5530)).
+
+### Bundles
+* Set the default `data_security_mode` to `DATA_SECURITY_MODE_AUTO` in bundle templates ([#5452](https://github.com/databricks/cli/pull/5452)).
+* Mark vector search index index_subtype as backend_default to prevent drift after deployment ([#5454](https://github.com/databricks/cli/pull/5454)).
+* `bundle deployment migrate`: handle resources added to or removed from `databricks.yml` since the last Terraform deploy ([#5463](https://github.com/databricks/cli/pull/5463)).
+* Add the `genie_spaces` bundle resource for managing Databricks Genie spaces as code, plus `bundle generate genie-space` to import an existing space. Direct deployment engine only ([#5282](https://github.com/databricks/cli/pull/5282)).
+* Fix spurious recreate of schemas and volumes whose names use mixed case ([#5531](https://github.com/databricks/cli/pull/5531)).
+
+
+## Release v1.2.1 (2026-06-04)
+
+### Bundles
+* direct: Fix updating the apps after the Go SDK upgrade ([#5444](https://github.com/databricks/cli/pull/5444))
+
+
+## Release v1.2.0 (2026-06-04)
+
+### CLI
+* `experimental open` now opens every DABs resource type that has a workspace URL, picking up `catalogs`, `schemas`, `volumes`, `database_instances`, `database_catalogs`, `synced_database_tables`, `postgres_catalogs`, `postgres_synced_tables`, `quality_monitors`, `vector_search_endpoints`, and `vector_search_indexes` ([#5346](https://github.com/databricks/cli/pull/5346)).
+
+### Bundles
+* Retry transient HTTP 5xx and 408 errors in direct deployment engine ([#5349](https://github.com/databricks/cli/pull/5349), [#5364](https://github.com/databricks/cli/pull/5364)).
+* Preserve `.designer.ipynb` suffix when translating notebook task paths so Lakeflow Designer files referenced from a `notebook_task` resolve correctly in the workspace ([#5370](https://github.com/databricks/cli/pull/5370)).
+* Fix script output dropping last line without trailing newline ([#4995](https://github.com/databricks/cli/pull/4995)).
+* engine/direct: Add `--select` flag to `bundle plan` and `bundle deploy` to plan/deploy a subset of resources (e.g. `--select my_job` or `--select jobs.my_job`); resources referenced by the selection are included transitively ([#5413](https://github.com/databricks/cli/pull/5413)).
+* Support `purge_on_delete: true` on `postgres_projects` so bundles can hard-delete a Lakebase project on destroy (skipping the soft-delete retention window) ([#5414](https://github.com/databricks/cli/pull/5414)).
+* Support terraform references in direct engine ([#5392](https://github.com/databricks/cli/pull/5392))
+* Support lifecycle.started for SQL warehouses ([#5348](https://github.com/databricks/cli/pull/5348))
+
+### Dependency updates
+* Bump Go toolchain to 1.26.4 ([#5420](https://github.com/databricks/cli/pull/5420)).
+* Bump `github.com/databricks/databricks-sdk-go` from v0.136.0 to v0.141.0 ([#5361](https://github.com/databricks/cli/pull/5361))
+* Bump Terraform provider from v1.115.0 to v1.117.0 ([#5421](https://github.com/databricks/cli/pull/5421))
+
+
+## Release v1.1.0 (2026-05-27)
+
+### Bundles
+* The error reported when a direct-only resource (catalogs, external locations, vector search endpoints) is used with the terraform engine now also suggests setting `bundle.engine: direct` in `databricks.yml`, in addition to the `DATABRICKS_BUNDLE_ENGINE` environment variable ([#5295](https://github.com/databricks/cli/pull/5295)).
+
+* Added `vector_search_indexes` as a bundle resource (direct engine only). Supports UC grants and prompts for confirmation on recreate or delete since both are destructive ([#5123](https://github.com/databricks/cli/pull/5123)).
+
+### Dependency updates
+
+* Bump Go toolchain to 1.26.3 ([#5302](https://github.com/databricks/cli/pull/5302)).
+* Bump `github.com/databricks/databricks-sdk-go` from v0.132.0 to v0.136.0.
+
+
+## Release v1.0.0 (2026-05-21)
+
+### Notable Changes
+
+* The Databricks CLI is now generally available with version v1.0.0 as the first major release 🚀. From this version on, the CLI follows semantic versioning (see [README](README.md)). This change does not impact DABs or other existing commands beyond the changes listed below.
+* The 0.299.x line continues to receive security-critical patches through May 20, 2027; see [SECURITY](SECURITY.md) for the support policy.
+* Starting with v1.0.0, the CLI will use [immutable release tags](https://docs.github.com/en/code-security/concepts/supply-chain-security/immutable-releases) to increase security against supply chain attacks.
+* Breaking change: OAuth tokens for interactive logins (`auth_type = databricks-cli`) are now stored in the OS-native secure store by default (Keychain on macOS, Credential Manager on Windows, Secret Service on Linux) instead of `~/.databricks/token-cache.json`. After upgrading, run `databricks auth login` once per profile to re-authenticate; cached tokens from older versions are not migrated. To keep the previous file-backed storage, set `DATABRICKS_AUTH_STORAGE=plaintext` or add `auth_storage = plaintext` under `[__settings__]` in `~/.databrickscfg` (the env var takes precedence over the config setting), then re-run `databricks auth login`. On systems where the OS keyring is not reachable (e.g. Linux containers without a D-Bus session bus), the CLI transparently falls back to the file cache when reading tokens so legacy `token-cache.json` entries remain accessible without manual configuration.
+
+### CLI
+
+* Added `databricks aitools` command group for installing Databricks skills into your coding agents (Claude Code, Cursor, Codex CLI, OpenCode, GitHub Copilot, Antigravity). Skills are fetched from [github.com/databricks/databricks-agent-skills](https://github.com/databricks/databricks-agent-skills) and either symlinked into each agent's skills directory or copied into the current project. Use `databricks aitools install` to set up, `update` to pull newer versions, `list` to see what's available, and `uninstall` to remove them. Pick where they go with `--scope=project|global` (`--scope=both` is accepted on `update` and `list`).
+* `[__settings__].default_profile` is now consulted as a fallback by `databricks api`, `databricks auth token`, and bundle commands when neither `--profile` nor `DATABRICKS_CONFIG_PROFILE` is set. `databricks auth token` continues to give precedence to `DATABRICKS_HOST` over `default_profile`. For bundle commands, `default_profile` only applies when the bundle does not pin its own `workspace.host`.
+* Fixed bug where auth commands did not load the DEFAULT profile properly during auth where type is `databricks-cli`.
+* `databricks workspace import-dir` now skips `.git`, `.databricks`, and `node_modules` directories during recursive imports. To import one of these directories deliberately, pass it as `SOURCE_PATH` ([#5118](https://github.com/databricks/cli/pull/5118)).
+* `databricks postgres create-role --help` now documents the `--json` body shape and rejects the common mistake of wrapping the body in `{"role": ...}` client-side with a hint pointing at the correct shape ([#5111](https://github.com/databricks/cli/pull/5111)).
+* `databricks aitools list` honors `--output json`, emitting a structured `{release, skills[...], summary{}}` document so coding agents and CI can consume the skill/version/installation matrix without scraping the tabular text output ([#5233](https://github.com/databricks/cli/pull/5233)).
+
+### Bundles
+* Make sure warnings asking for approval are understood by agents ([#5239](https://github.com/databricks/cli/pull/5239))
+* Support `replace_existing: true` on `postgres_branches` and `postgres_endpoints` so bundles can manage the implicitly-created production branch and primary read-write endpoint of a Lakebase project.
+* Add `postgres_catalogs` resource to bind a Unity Catalog catalog to a Postgres database on a Lakebase Autoscaling branch ([#5265](https://github.com/databricks/cli/pull/5265)).
+* Add `postgres_synced_tables` resource to sync a Unity Catalog Delta table into a Postgres table on a Lakebase Autoscaling branch ([#5268](https://github.com/databricks/cli/pull/5268)).
+* engine/direct: Changes to state file now persisted to .wal file right away instead of being saved in the end ([#5149](https://github.com/databricks/cli/pull/5149))
+
+
+## Release v0.299.2 (2026-05-13)
+
+### Notable Changes
+* Breaking change: `vector_search_endpoints` renamed `min_qps` to `target_qps` in DABs configuration and the `vector-search-endpoints` commands, following the SDK rename in v0.131.0. Update any `databricks.yml` using `min_qps:` to `target_qps:` and any CLI invocations using `--min-qps` to `--target-qps`.
+
+### CLI
+
+* `auth login` no longer falls back to plaintext when the OS keyring is reachable but locked. The unlock prompt shown by the probe now runs in parallel with the OAuth flow, and the token is stored in the keyring once the user has typed their password.
+* `databricks auth describe` now reports where U2M (`databricks-cli`) tokens are stored: `plaintext` (`~/.databricks/token-cache.json`) or `secure` (OS keyring), and the source of the choice (env var, config setting, or default).
+* Marked the default profile in the interactive pickers shown by `databricks auth switch`, `databricks auth logout`, `databricks auth token`, and `databricks auth login`, and moved it to the top of the list. `databricks auth login` and `databricks auth logout` now offer the same selectors as `databricks auth token` and `databricks auth switch` respectively.
+* The interactive auth profile pickers now start in search mode so typing immediately filters the list, and the action entries (`+ Create a new profile`, `→ Enter a host URL manually`) are visually distinct from real profiles and stay visible regardless of the search query.
+* Shortened the host prompt label shown after `→ Enter a host URL manually` in `databricks auth login` so the prompt no longer leaves stale lines on screen when typing or pasting a host URL.
+
+### Bundles
+* Stop applying `presets.name_prefix` (and the dev-mode `[dev <user>]` rename) to `vector_search_endpoints` ([#5209](https://github.com/databricks/cli/pull/5209)).
+
+* Fix `bundle generate` job to preserve nested notebook directory structure ([#4596](https://github.com/databricks/cli/pull/4596))
+* Propagate authentication environment (including `DATABRICKS_CONFIG_PROFILE`) to the `experimental.python` subprocess so bundle validate/deploy no longer fails with a multi-profile host ambiguity error when several profiles in `~/.databrickscfg` share the same host.
+* Fixed `--force-pull` on `bundle summary` and `bundle open` so the flag bypasses the local state cache and reads state from the workspace.
+
+### Dependency updates
+
+* Bump Go toolchain to 1.25.10 ([#5213](https://github.com/databricks/cli/pull/5213)).
+* Bump `github.com/databricks/databricks-sdk-go` from v0.128.0 to v0.132.0.
+* Bump Terraform provider to v1.115.0.
+
+
+## Release v0.299.1 (2026-05-07)
+
+### CLI
+
+* `databricks api` now works against unified hosts. Adds `--account` to scope a call to the account API and `--workspace-id` to override the workspace routing identifier per call. A `?o=<workspace-id>` query parameter on the path (the SPOG URL convention used by the Databricks UI) is also recognized as a per-call workspace override, so URLs pasted from the browser route correctly.
+* JSON output for single objects now uses standard `"key": "value"` spacing (matching list output and `encoding/json` defaults).
+
+### Bundles
+* Validate that resource keys do not contain variable references ([#5169](https://github.com/databricks/cli/pull/5169))
+* engine/direct: Drop the deployment state entry on a recreate before the follow-up `Create`, so a `Create` failure no longer leaves a broken state with `invalid state: empty id` on the next `bundle plan` ([#5173](https://github.com/databricks/cli/pull/5173)).
+* `bundle debug list-targets`: skip nil entries in the targets map instead of panicking when a target is declared with a null value ([#5203](https://github.com/databricks/cli/pull/5203)).
+
+### Dependency updates
+
+* Added `github.com/jackc/pgx/v5` v5.9.1 (MIT) as a new dependency. Used by an experimental Postgres command added in this release; the package is dormant for users who do not invoke that command.
+
+
 ## Release v0.299.0 (2026-04-29)
 
 ### CLI
diff --git a/CLAUDE.md b/CLAUDE.md
deleted file mode 120000
index 47dc3e3d863..00000000000
--- a/CLAUDE.md
+++ /dev/null
@@ -1 +0,0 @@
-AGENTS.md
\ No newline at end of file
diff --git a/Dockerfile b/Dockerfile
index 09456802999..8f5ca87f2bd 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,25 +1,8 @@
-FROM alpine:3.22@sha256:55ae5d250caebc548793f321534bc6a8ef1d116f334f18f4ada1b2daad3251b2 as builder
-
-RUN ["apk", "add", "jq"]
-RUN ["apk", "add", "bash"]
-
-WORKDIR /build
-
-COPY ./docker/setup.sh /build/docker/setup.sh
-COPY ./databricks /app/databricks
-COPY ./docker/config.tfrc /app/config/config.tfrc
-
-ARG ARCH
-RUN /build/docker/setup.sh
-
-# Start from a fresh base image, to remove any build artifacts and scripts.
 FROM alpine:3.22@sha256:55ae5d250caebc548793f321534bc6a8ef1d116f334f18f4ada1b2daad3251b2
 
-ENV DATABRICKS_TF_EXEC_PATH "/app/bin/terraform"
-ENV DATABRICKS_TF_CLI_CONFIG_FILE "/app/config/config.tfrc"
 ENV PATH="/app:${PATH}"
 
-COPY --from=builder /app /app
+COPY ./databricks /app/databricks
 
 ENTRYPOINT ["/app/databricks"]
 CMD ["-h"]
diff --git a/NEXT_CHANGELOG.md b/NEXT_CHANGELOG.md
deleted file mode 100644
index 99a11d8ae84..00000000000
--- a/NEXT_CHANGELOG.md
+++ /dev/null
@@ -1,16 +0,0 @@
-# NEXT CHANGELOG
-
-## Release v0.299.1
-
-### CLI
-
-* `databricks api` now works against unified hosts. Adds `--account` to scope a call to the account API and `--workspace-id` to override the workspace routing identifier per call. A `?o=<workspace-id>` query parameter on the path (the SPOG URL convention used by the Databricks UI) is also recognized as a per-call workspace override, so URLs pasted from the browser route correctly.
-* JSON output for single objects now uses standard `"key": "value"` spacing (matching list output and `encoding/json` defaults).
-
-### Bundles
-* Validate that resource keys do not contain variable references ([#5169](https://github.com/databricks/cli/pull/5169))
-* engine/direct: Drop the deployment state entry on a recreate before the follow-up `Create`, so a `Create` failure no longer leaves a broken state with `invalid state: empty id` on the next `bundle plan` ([#5173](https://github.com/databricks/cli/pull/5173)).
-
-### Dependency updates
-
-* Added `github.com/jackc/pgx/v5` v5.9.1 (MIT) as a new dependency. Used by an experimental Postgres command added in this release; the package is dormant for users who do not invoke that command.
diff --git a/NOTICE b/NOTICE
index 2c90b58f2d3..fb51e5c0914 100644
--- a/NOTICE
+++ b/NOTICE
@@ -19,30 +19,6 @@ License - https://github.com/yaml/go-yaml/blob/v3/LICENSE
 
 ---
 
-This Software contains code from the following open source projects, licensed under the MPL 2.0 license:
-
-hashicorp/go-version - https://github.com/hashicorp/go-version
-Copyright 2014 HashiCorp, Inc.
-License - https://github.com/hashicorp/go-version/blob/main/LICENSE
-
-hashicorp/hc-install - https://github.com/hashicorp/hc-install
-Copyright 2020 HashiCorp, Inc.
-License - https://github.com/hashicorp/hc-install/blob/main/LICENSE
-
-hashicorp/terraform-exec - https://github.com/hashicorp/terraform-exec
-Copyright 2020 HashiCorp, Inc.
-License - https://github.com/hashicorp/terraform-exec/blob/main/LICENSE
-
-hashicorp/terraform-json - https://github.com/hashicorp/terraform-json
-Copyright 2019 HashiCorp, Inc.
-License - https://github.com/hashicorp/terraform-json/blob/main/LICENSE
-
-hashicorp/terraform - https://github.com/hashicorp/terraform
-Copyright 2014 HashiCorp, Inc.
-License - https://github.com/hashicorp/terraform/blob/v1.5.5/LICENSE
-
----
-
 This Software contains code from the following open source projects, licensed under the BSD (2-clause) license:
 
 pkg/browser - https://github.com/pkg/browser
@@ -62,14 +38,6 @@ Copyright (c) 2012 Alex Ogier. All rights reserved.
 Copyright (c) 2012 The Go Authors. All rights reserved.
 License - https://github.com/spf13/pflag/blob/master/LICENSE
 
-google/uuid - https://github.com/google/uuid
-Copyright (c) 2009,2014 Google Inc. All rights reserved.
-License - https://github.com/google/uuid/blob/master/LICENSE
-
-manifoldco/promptui - https://github.com/manifoldco/promptui
-Copyright (c) 2017, Arigato Machine Inc. All rights reserved.
-License - https://github.com/manifoldco/promptui/blob/master/LICENSE.md
-
 hexops/gotextdiff - https://github.com/hexops/gotextdiff
 Copyright (c) 2009 The Go Authors. All rights reserved.
 License - https://github.com/hexops/gotextdiff/blob/main/LICENSE
@@ -99,6 +67,10 @@ golang.org/x/mod - https://github.com/golang/mod
 Copyright 2009 The Go Authors.
 License - https://github.com/golang/mod/blob/master/LICENSE
 
+golang.org/x/net - https://github.com/golang/net
+Copyright 2009 The Go Authors.
+License - https://github.com/golang/net/blob/master/LICENSE
+
 golang.org/x/oauth2 - https://github.com/golang/oauth2
 Copyright 2009 The Go Authors.
 License - https://github.com/golang/oauth2/blob/master/LICENSE
@@ -111,6 +83,10 @@ golang.org/x/sys - https://github.com/golang/sys
 Copyright 2009 The Go Authors.
 License - https://github.com/golang/sys/blob/master/LICENSE
 
+golang.org/x/term - https://github.com/golang/term
+Copyright 2009 The Go Authors.
+License - https://github.com/golang/term/blob/master/LICENSE
+
 golang.org/x/text - https://github.com/golang/text
 Copyright 2009 The Go Authors.
 License - https://github.com/golang/text/blob/master/LICENSE
@@ -127,6 +103,10 @@ jackc/pgx - https://github.com/jackc/pgx
 Copyright (c) 2013-2021 Jack Christensen
 License - https://github.com/jackc/pgx/blob/master/LICENSE
 
+klauspost/pgzip - https://github.com/klauspost/pgzip
+Copyright (c) 2014 Klaus Post
+License - https://github.com/klauspost/pgzip/blob/master/LICENSE
+
 charmbracelet/bubbles - https://github.com/charmbracelet/bubbles
 Copyright (c) 2020-2025 Charmbracelet, Inc
 License - https://github.com/charmbracelet/bubbles/blob/master/LICENSE
@@ -143,6 +123,10 @@ charmbracelet/lipgloss - https://github.com/charmbracelet/lipgloss
 Copyright (c) 2021-2025 Charmbracelet, Inc
 License - https://github.com/charmbracelet/lipgloss/blob/master/LICENSE
 
+charmbracelet/x/ansi - https://github.com/charmbracelet/x
+Copyright (c) 2023-2025 Charmbracelet, Inc
+License - https://github.com/charmbracelet/x/blob/main/ansi/LICENSE
+
 Masterminds/semver - https://github.com/Masterminds/semver
 Copyright (C) 2014-2019, Matt Butcher and Matt Farina
 License - https://github.com/Masterminds/semver/blob/master/LICENSE.txt
@@ -151,6 +135,10 @@ mattn/go-isatty - https://github.com/mattn/go-isatty
 Copyright (c) Yasuhiro MATSUMOTO <mattn.jp@gmail.com>
 License - https://github.com/mattn/go-isatty/blob/master/LICENSE
 
+muesli/termenv - https://github.com/muesli/termenv
+Copyright (c) 2019 Christian Muehlhaeuser
+License - https://github.com/muesli/termenv/blob/master/LICENSE
+
 sabhiram/go-gitignore - https://github.com/sabhiram/go-gitignore
 Copyright (c) 2015 Shaba Abhiram
 License - https://github.com/sabhiram/go-gitignore/blob/master/LICENSE
diff --git a/README.md b/README.md
index 3c238702cf2..46b9556a7da 100644
--- a/README.md
+++ b/README.md
@@ -1,8 +1,7 @@
 # Databricks CLI
 
-[![build](https://github.com/databricks/cli/workflows/build/badge.svg?branch=main)](https://github.com/databricks/cli/actions?query=workflow%3Abuild+branch%3Amain)
-
-This project is in Public Preview.
+[![build](https://github.com/databricks/cli/actions/workflows/push.yml/badge.svg?branch=main)](https://github.com/databricks/cli/actions?query=workflow%3Abuild+branch%3Amain)
+![downloads](https://img.shields.io/github/downloads/databricks/cli/total.svg)
 
 Documentation is available at https://docs.databricks.com/dev-tools/cli/databricks-cli.html.
 
@@ -36,5 +35,30 @@ This CLI follows the Databricks Unified Authentication principles.
 
 You can find a detailed description at https://github.com/databricks/databricks-sdk-go#authentication.
 
+## Stability Policy
+
+### Feature stability
+
+Commands and flags are stable by default and will not break within a major version.
+
+Some features are unstable and may change in any MINOR release:
+
+- Commands and flags marked **Beta** or **Private Preview** in their `--help` output.
+- Commands in the `databricks experimental` group.
+
+### Versioning
+
+The CLI follows [Semantic Versioning](https://semver.org) (`MAJOR.MINOR.PATCH`):
+
+- `MAJOR` is incremented for breaking changes to **stable** features.
+- `MINOR` is incremented for new features and for breaking changes to **unstable** features.
+- `PATCH` is incremented for backward-compatible bug fixes, security fixes, and dependency updates.
+
+Databricks may ship a breaking change to a stable feature without a major version bump in exceptional circumstances where waiting for the next major version would itself cause greater harm: an active security incident, a legal or compliance requirement, or a regression introduced in the current major version. Any such exceptional change is announced in the release notes.
+
+### Security patches
+
+Security patches ship on the current release, and on specific older versions listed in [`SECURITY.md`](./SECURITY.md). The CLI does not currently offer a broader long-term support commitment.
+
 ## Privacy Notice
 Databricks CLI use is subject to the [Databricks License](https://github.com/databricks/cli/blob/main/LICENSE) and [Databricks Privacy Notice](https://www.databricks.com/legal/privacynotice), including any Usage Data provisions.
diff --git a/SECURITY.md b/SECURITY.md
index 54ee11213af..9471ff46657 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,4 +1,14 @@
 ## Reporting a Vulnerability
 
-We appreciate any security concerns brought to our attention and encourage you to notify us of any potential vulnerabilities discovered in our systems or products.
-If you believe you have found a security vulnerability, please report it to us at [security@databricks.com](mailto:security@databricks.com).
+We appreciate any security concerns brought to our attention and encourage you to notify us of any potential vulnerabilities discovered in our systems or products. If you believe you have found a security vulnerability, please report it to us at [security@databricks.com](mailto:security@databricks.com).
+
+## Supported Versions
+
+The following versions receive security patches:
+
+| Version | Notes |
+| :---- | :---- |
+| Latest release | Active development line. |
+| `v0.299.x` | Extended security support until 2027-05-20. |
+
+Other versions of the CLI do not receive patches.
diff --git a/Taskfile.yml b/Taskfile.yml
index 38f690bd56a..b41178fbe61 100644
--- a/Taskfile.yml
+++ b/Taskfile.yml
@@ -1,9 +1,12 @@
 version: '3'
 
 vars:
-  # Absolute path so tasks with `dir:` (lint-go-tools, lint-go-codegen) can use it.
+  # Absolute path so tasks with `dir:` (lint-go-tools) can use it.
   GO_TOOL: go tool -modfile={{.ROOT_DIR}}/tools/go.mod
   EXE_EXT: '{{if eq OS "windows"}}.exe{{end}}'
+  # Pinned ruff (linter + formatter). Keep in sync with the version in
+  # .github/workflows/check.yml and python/Taskfile.yml.
+  RUFF: uvx ruff@0.15.17
   TEST_PACKAGES: ./acceptance/internal ./libs/... ./internal/... ./cmd/... ./bundle/... ./experimental/ssh/... .
   ACCEPTANCE_TEST_FILTER: ""
   # Single brace-expansion glob covering every //go:embed target in the repo,
@@ -12,8 +15,13 @@ vars:
   # a separate static `**/testdata/**` glob, not this script.
   # Limitation: git grep only scans tracked files; new //go:embed directives in
   # untracked files are missed until the file is staged or committed.
+  # Run via uv with a pinned interpreter floor so the helper works on hosts whose
+  # default python3 is older than the 3.11 this repo's scripts target.
   EMBED_SOURCES:
-    sh: 'python3 tools/list_embeds.py'
+    sh: 'uv run -p ">=3.11" --no-project python tools/list_embeds.py'
+
+env:
+  GOFIPS140: v1.0.0
 
 # pydabs-* tasks live in python/Taskfile.yml so `task pydabs-foo` works when
 # run from python/. Flattened so they keep their `pydabs-` names at the root.
@@ -47,15 +55,13 @@ tasks:
       - task: test-update
 
   all:
-    desc: Run regeneration (except for genkit), all checks, lints and test updates
+    desc: Run regeneration (except cligen), all checks, lints and test updates
     cmds:
-      # Skips generate-genkit (expensive, requires universe checkout, outputs are
-      # committed). Run `./task generate` explicitly when codegen inputs change.
+      # Skips generate-cligen (outputs are committed). Run `./task generate`
+      # explicitly when codegen inputs change.
       - task: generate-refschema
       - task: generate-schema
-      - task: generate-schema-docs
       - task: generate-validation
-      - task: generate-docs
       - task: generate-direct
       - task: pydabs-codegen
       - task: pydabs-lint
@@ -73,88 +79,77 @@ tasks:
   # speed; `./task all` uses the full variants.
 
   lint:
-    desc: Lint all Go files (root + tools + codegen modules)
+    desc: Lint all Go files (root + tools modules) and Python scripts
     cmds:
       - task: lint-go
+      - task: lint-python
 
   lint-q:
-    desc: Lint changed Go files in root module (diff vs main, with --fix)
+    desc: Lint changed Go files in root module (diff vs main, with --fix) and Python scripts
     cmds:
       - task: lint-q-go-root
+      - task: lint-python
+
+  lint-python:
+    desc: Lint first-party Python scripts with ruff
+    sources:
+      - "**/*.py"
+      - ruff.toml
+    cmds:
+      # Lints the whole repo; fixtures and generated outputs are skipped via
+      # `lint.exclude` / `extend-exclude` in ruff.toml. --no-cache: some excluded
+      # acceptance fixtures carry their own pyproject.toml/ruff.toml (config
+      # roots), so without it ruff writes a .ruff_cache into those checked-in
+      # dirs, polluting the goldens and breaking the acceptance tests.
+      - "{{.RUFF}} check --no-cache ."
 
   # `golangci-lint run` typechecks, so it stops at go.mod boundaries. We have
   # one task per Go module; `lint-go` composes them to cover the whole repo.
-  # Children run in parallel — each uses its own TMPDIR (set inline on the
-  # golangci-lint command below) to avoid the shared /tmp lock that serializes
-  # concurrent golangci-lint invocations. This matters in two scenarios:
-  #   1. siblings of `lint-go` running in parallel on subprojects here, and
-  #   2. `lint-go` invocations in sibling worktrees running at the same time.
-  # The TMPDIR must live under the repo but NOT equal {{.ROOT_DIR}} itself
-  # (the Go toolchain refuses a go.mod inside os.TempDir, which would break
-  # golangci-lint's typechecker).
+  #
+  # Flags on every invocation:
+  #   --allow-parallel-runners — by default golangci-lint takes a system-wide
+  #     lock and refuses to start if another copy is already running. This
+  #     flag opts out so parallel runs (e.g. `lint-go`'s two sub-lints, or
+  #     two worktrees linting at once) don't block each other.
+  #   -j=4 — cap analyzer concurrency; higher values use more CPU without
+  #     reducing wall time on this codebase.
+  #
+  # Cross-worktree concurrency relies on content-addressable cache keys added
+  # in golangci-lint v2.12.0; keep the binary at v2.12.0+ in tools/go.mod.
   lint-go:
-    desc: Lint Go files across all modules (root, tools, codegen)
-    deps: ['lint-go-root', 'lint-go-tools', 'lint-go-codegen']
+    desc: Lint Go files across all modules (root, tools)
+    deps: ['lint-go-root', 'lint-go-tools']
 
   lint-go-root:
     desc: Lint Go files in the root module
-    vars:
-      TMPDIR: '{{.ROOT_DIR}}/.tmp/golangci-lint-root'
     sources: &ROOT_LINT_SOURCES
       - "**/*.go"
       - exclude: tools/**
-      - exclude: bundle/internal/tf/codegen/**
       - .golangci.yaml
       - go.mod
       - go.sum
       - "{{.EMBED_SOURCES}}"
     cmds:
-      - cmd: mkdir -p "{{.TMPDIR}}"
-        silent: true
-      - TMPDIR="{{.TMPDIR}}" {{.GO_TOOL}} golangci-lint run ./...
+      - "{{.GO_TOOL}} golangci-lint run --allow-parallel-runners -j=4 ./..."
 
   lint-go-tools:
     desc: Lint Go files in tools/ module
     dir: tools
-    vars:
-      TMPDIR: '{{.ROOT_DIR}}/.tmp/golangci-lint-tools'
-    sources:
-      - "**/*.go"
-      - '{{.ROOT_DIR}}/.golangci.yaml'
-      - go.mod
-      - go.sum
-    cmds:
-      - cmd: mkdir -p "{{.TMPDIR}}"
-        silent: true
-      # gocritic is disabled because root's ruleguard rules path is cwd-relative
-      # and cannot be resolved from this nested module.
-      - TMPDIR="{{.TMPDIR}}" {{.GO_TOOL}} golangci-lint run --disable gocritic ./...
-
-  lint-go-codegen:
-    desc: Lint Go files in bundle/internal/tf/codegen module
-    dir: bundle/internal/tf/codegen
-    vars:
-      TMPDIR: '{{.ROOT_DIR}}/.tmp/golangci-lint-codegen'
     sources:
       - "**/*.go"
       - '{{.ROOT_DIR}}/.golangci.yaml'
       - go.mod
       - go.sum
     cmds:
-      - cmd: mkdir -p "{{.TMPDIR}}"
-        silent: true
       # gocritic is disabled because root's ruleguard rules path is cwd-relative
       # and cannot be resolved from this nested module.
-      - TMPDIR="{{.TMPDIR}}" {{.GO_TOOL}} golangci-lint run --disable gocritic ./...
+      - "{{.GO_TOOL}} golangci-lint run --allow-parallel-runners -j=4 --disable gocritic ./..."
 
   lint-q-go-root:
-    desc: Lint changed Go files in root module (diff vs main, with --fix). Does not check tools/ or bundle/internal/tf/codegen — use `lint` for full coverage.
-    vars:
-      TMPDIR: '{{.ROOT_DIR}}/.tmp/golangci-lint-root'
+    desc: Lint changed Go files in root module (diff vs main, with --fix). Does not check tools/ — use `lint` for full coverage.
     sources:
       - "**/*.go"
       - exclude: tools/**
-      - exclude: bundle/internal/tf/codegen/**
       - .golangci.yaml
       - go.mod
       - go.sum
@@ -162,9 +157,7 @@ tasks:
       - "{{.EMBED_SOURCES}}"
       - "**/testdata/**"
     cmds:
-      - cmd: mkdir -p "{{.TMPDIR}}"
-        silent: true
-      - TMPDIR="{{.TMPDIR}}" ./tools/lintdiff.py {{.GO_TOOL}} golangci-lint run --fix
+      - "uv run --script tools/lintdiff.py {{.GO_TOOL}} golangci-lint run --allow-parallel-runners -j=4 --fix"
 
   # --- Formatting ---
 
@@ -177,18 +170,23 @@ tasks:
     deps: ['fmt-python', 'fmt-q-go', 'fmt-yaml']
 
   fmt-python:
-    desc: Format Python files
+    desc: Lint-fix and format Python files
     sources:
       - "**/*.py"
+      - ruff.toml
     cmds:
-      # Pinned to match the version used by the `ruff format --check` step in
+      # Auto-fix the lint issues that ruff can fix (whole repo, minus lint.exclude);
+      # `|| true` so unfixable findings don't abort fmt (lint-python reports them).
+      # --no-cache: see lint-python (avoids polluting acceptance fixture goldens).
+      - "{{.RUFF}} check --no-cache --fix . || true"
+      # Pinned (via the RUFF var) to match the `ruff format --check` step in
       # .github/workflows/check.yml — newer ruff versions reformat files that
       # CI considers already formatted.
-      - "uvx ruff@0.9.1 format -n"
+      - "{{.RUFF}} format -n"
 
   # `golangci-lint fmt` walks the filesystem and doesn't typecheck, so it
-  # formats files across all nested modules (tools/, bundle/internal/tf/codegen/)
-  # in a single invocation.
+  # formats files across all nested modules (tools/) in a single
+  # invocation.
   fmt-go:
     desc: Format all Go files
     sources: &FMT_GO_SOURCES
@@ -210,7 +208,7 @@ tasks:
       - tools/lintdiff.py
       - "{{.EMBED_SOURCES}}"
     cmds:
-      - "./tools/lintdiff.py {{.GO_TOOL}} golangci-lint fmt"
+      - "uv run --script tools/lintdiff.py {{.GO_TOOL}} golangci-lint fmt"
 
   fmt-yaml:
     desc: Format YAML files
@@ -226,8 +224,8 @@ tasks:
   # --- Code checks ---
 
   tidy:
-    desc: Run go mod tidy across all Go modules (root, tools, codegen)
-    deps: ['tidy-root', 'tidy-tools', 'tidy-codegen']
+    desc: Run go mod tidy across all Go modules (root, tools)
+    deps: ['tidy-root', 'tidy-tools']
 
   tidy-root:
     desc: Run go mod tidy in root module
@@ -236,7 +234,6 @@ tasks:
       - go.sum
       - "**/*.go"
       - exclude: tools/**
-      - exclude: bundle/internal/tf/codegen/**
       - "{{.EMBED_SOURCES}}"
     cmds:
       - "go mod tidy"
@@ -251,28 +248,35 @@ tasks:
     cmds:
       - "go mod tidy"
 
-  tidy-codegen:
-    desc: Run go mod tidy in bundle/internal/tf/codegen module
-    dir: bundle/internal/tf/codegen
-    sources:
-      - go.mod
-      - go.sum
-      - "**/*.go"
-    cmds:
-      - "go mod tidy"
-
   ws:
     desc: Fix whitespace issues
     cmds:
-      - "./tools/validate_whitespace.py --fix"
+      - "uv run --script tools/validate_whitespace.py --fix"
 
-  links:
-    desc: Update GitHub links in docs
-    sources:
-      - "**/*.md"
-      - tools/update_github_links.py
+  check-changelog:
+    desc: Validate .nextchanges fragment placement and links
+    cmds:
+      - "uv run --script tools/validate_nextchanges.py"
+
+  check-codeowners:
+    desc: Check that CLI maintainers are the first owner on every CODEOWNERS rule
+    cmds:
+      - 'uv run -p ">=3.11" --no-project python tools/validate_codeowners.py'
+
+  changelog-preview:
+    desc: Print the CHANGELOG.md section the next release would add from .nextchanges/
+    env:
+      NEXTCHANGES_DIR: .nextchanges/
     cmds:
-      - "./tools/update_github_links.py"
+      # Validate placement first so a misplaced fragment fails loudly instead of
+      # being silently skipped by the renderer (see validate_nextchanges.py).
+      - task: check-changelog
+      # --frozen renders from the committed tagging.py.lock as-is. Re-resolving (what
+      # --locked does) hits the package index, which breaks under a newer local uv or the
+      # internal PyPI proxy index and rewrites the lock; CI keeps --locked (pinned uv +
+      # pypi.org) in changelog-preview.yml. --python 3.12 satisfies the lock's
+      # requires-python >=3.12, which the script omits (so uv would otherwise pick 3.9).
+      - "uv run --python 3.12 --frozen --script internal/genkit/tagging.py --preview"
 
   deadcode:
     desc: Check for dead code
@@ -281,17 +285,33 @@ tasks:
       - go.mod
       - go.sum
     cmds:
-      - ./tools/check_deadcode.py
+      - "uv run --script tools/check_deadcode.py"
+
+  check-lockfiles:
+    desc: Fail if a Databricks PyPI proxy URL leaked into a uv.lock or .py.lock
+    # pydabs-codegen reverts this proxy-URL churn after regenerating, and
+    # generate-clijson scrubs it from the genkit tagging locks; this is a
+    # backstop against a proxy URL reaching a committed lock any other way.
+    cmds:
+      - "! git grep -lF databricks.com -- '*uv.lock' '*.py.lock'"
+
+  check-agents-setup:
+    desc: Check every agent's config setup is in sync with AGENTS.md/.agents; fails if anything was out of sync
+    cmds:
+      - "uv run --script tools/validate_agents_setup.py"
 
   checks:
-    desc: Run quick checks (tidy, whitespace, links, deadcode)
+    desc: Run quick checks (tidy, whitespace, deadcode, changelog, codeowners, lockfiles, agent setup)
     # Sequential: `tidy` rewrites go.mod/go.sum and any future tidy work
-    # touching more paths should not race with whitespace/link scanners.
+    # touching more paths should not race with the whitespace scanner.
     cmds:
       - task: tidy
       - task: ws
-      - task: links
       - task: deadcode
+      - task: check-changelog
+      - task: check-codeowners
+      - task: check-lockfiles
+      - task: check-agents-setup
 
   install-pythons:
     desc: Install Python 3.9-3.13 via uv
@@ -302,7 +322,7 @@ tasks:
 
   # The root binary only imports bundle/, cmd/, experimental/, internal/, libs/,
   # so changes to test-only trees (acceptance/, integration/), separate modules
-  # (tools/, bundle/internal/tf/codegen/), and _test.go files don't affect the build.
+  # (tools/), and _test.go files don't affect the build.
   build-yamlfmt:
     desc: Build the yamlfmt binary used by acceptance tests
     dir: tools
@@ -323,7 +343,6 @@ tasks:
       - exclude: acceptance/**
       - exclude: integration/**
       - exclude: tools/**
-      - exclude: bundle/internal/tf/codegen/**
       - go.mod
       - go.sum
       - "{{.EMBED_SOURCES}}"
@@ -350,7 +369,6 @@ tasks:
       - exclude: acceptance/**
       - exclude: integration/**
       - exclude: tools/**
-      - exclude: bundle/internal/tf/codegen/**
       - go.mod
       - go.sum
       - .goreleaser.yaml
@@ -364,38 +382,48 @@ tasks:
   # --- Testing ---
 
   test:
-    desc: Run unit and acceptance tests
-    deps:
-      - task: test-unit
-      - task: test-acc
-        vars:
-          ACCEPTANCE_TEST_FILTER: "{{.ACCEPTANCE_TEST_FILTER}}"
+    desc: Run unit, acceptance, and doctests
+    # Run the legs as sequential cmds (not parallel deps) so the concatenating
+    # cat can be a `defer`, which runs even when a leg fails. When the legs are
+    # deps, the cat in cmds is skipped on failure, so test-output.json is never
+    # produced for a failed run and CI has no gotestsum output to upload.
     sources:
       - test-output-unit.json
       - test-output-acc.json
     generates:
       - test-output.json
     cmds:
-      - cat test-output-unit.json test-output-acc.json > test-output.json
+      - defer: cat test-output-unit.json test-output-acc.json > test-output.json
+      - task: doctest
+      - task: test-unit
+      - task: test-acc
+        vars:
+          ACCEPTANCE_TEST_FILTER: "{{.ACCEPTANCE_TEST_FILTER}}"
+
+  doctest:
+    desc: Run doctests for all Python files in the repo
+    sources:
+      - "**/*.py"
+    cmds:
+      - 'uv run -p ">=3.11" --no-project python tools/run_doctests.py'
 
   test-unit:
-    desc: Run unit tests across all Go modules (root, tools, codegen)
-    deps: ['test-unit-root', 'test-unit-tools', 'test-unit-codegen']
+    desc: Run unit tests across all Go modules (root, tools)
     sources:
       - test-output-unit-root.json
       - tools/test-output-unit-tools.json
-      - bundle/internal/tf/codegen/test-output-unit-codegen.json
     generates:
       - test-output-unit.json
     cmds:
-      - cat test-output-unit-root.json tools/test-output-unit-tools.json bundle/internal/tf/codegen/test-output-unit-codegen.json > test-output-unit.json
+      - defer: cat test-output-unit-root.json tools/test-output-unit-tools.json > test-output-unit.json
+      - task: test-unit-root
+      - task: test-unit-tools
 
   test-unit-root:
     desc: Run unit tests in root module
     sources:
       - "**/*.go"
       - exclude: tools/**
-      - exclude: bundle/internal/tf/codegen/**
       - exclude: integration/**
       - exclude: acceptance/**
       - acceptance/internal/**
@@ -417,6 +445,11 @@ tasks:
     generates:
       - test-output-unit-root.json
     cmds:
+      # Unit packages default to a far shorter per-package timeout than the acceptance
+      # suite (test-acc keeps 60m for the single, legitimately long ./acceptance binary).
+      # The slowest unit package observed across Linux/macOS/Windows is ~83s, so 10m is
+      # ample headroom while a hung package (e.g. a wedged goroutine) fails in minutes
+      # instead of burning the full hour. LOCAL_TIMEOUT still overrides when needed.
       - |
         {{.GO_TOOL}} gotestsum \
           --format ${GOTESTSUM_FORMAT:-pkgname-and-test-fails} \
@@ -424,7 +457,7 @@ tasks:
           --jsonfile test-output-unit-root.json \
           --rerun-fails \
           --packages "{{.TEST_PACKAGES}}" \
-          -- -timeout=${LOCAL_TIMEOUT:-30m}
+          -- -timeout=${LOCAL_TIMEOUT:-10m}
 
   test-unit-tools:
     desc: Run unit tests in tools/ module
@@ -448,27 +481,7 @@ tasks:
           --jsonfile test-output-unit-tools.json \
           --rerun-fails \
           --packages ./... \
-          -- -timeout=${LOCAL_TIMEOUT:-30m}
-
-  test-unit-codegen:
-    desc: Run unit tests in bundle/internal/tf/codegen module
-    dir: bundle/internal/tf/codegen
-    sources:
-      - "**/*.go"
-      - go.mod
-      - go.sum
-    generates:
-      # See comment on test-unit-tools' generates.
-      - test-output-unit-codegen.json
-    cmds:
-      - |
-        {{.GO_TOOL}} gotestsum \
-          --format ${GOTESTSUM_FORMAT:-pkgname-and-test-fails} \
-          --no-summary=skipped \
-          --jsonfile test-output-unit-codegen.json \
-          --rerun-fails \
-          --packages ./... \
-          -- -timeout=${LOCAL_TIMEOUT:-30m}
+          -- -timeout=${LOCAL_TIMEOUT:-10m}
 
   test-acc:
     desc: Run acceptance tests
@@ -481,14 +494,11 @@ tasks:
       - exclude: "**/*_test.go"
       - exclude: integration/**
       - exclude: tools/**
-      - exclude: bundle/internal/tf/codegen/**
-      # acceptance/install_terraform.py parses the provider version from this file.
-      - bundle/internal/tf/codegen/schema/version.go
       - acceptance/**
-      # Pydabs wheel is built in-process by TestInprocessMode (cd python && uv build).
+      # Pydabs wheel is built in-process by TestAccept (cd python && uv build).
       - python/**
       - libs/vendored_py_packages/**
-      # TestInprocessMode builds yamlfmt via tools/go.mod.
+      # TestAccept builds yamlfmt via tools/go.mod.
       - tools/go.mod
       - tools/go.sum
       - go.mod
@@ -507,7 +517,32 @@ tasks:
           --jsonfile test-output-acc.json \
           --rerun-fails \
           --packages ./acceptance/... \
-          -- -timeout=${LOCAL_TIMEOUT:-30m}{{if .ACCEPTANCE_TEST_FILTER}} -run "{{.ACCEPTANCE_TEST_FILTER}}"{{end}}
+          -- -timeout=${LOCAL_TIMEOUT:-60m}{{if .ACCEPTANCE_TEST_FILTER}} -run "{{.ACCEPTANCE_TEST_FILTER}}"{{end}}
+
+  local-select:
+    desc: Run selection of local tests (tests changed in this branch)
+    # Local counterpart of cloud-select: the same DATABRICKS_TEST_SELECT_CHANGED selection,
+    # against the testserver instead of a real workspace. -v to show the selection summary
+    # and the tests that ran; no sources/generates because the selection depends on the git
+    # diff, which Task cannot checksum.
+    cmds:
+      - "DATABRICKS_TEST_SELECT_CHANGED=${DATABRICKS_TEST_SELECT_CHANGED:-50} go test ./acceptance -run '^TestAccept$' -v -timeout=${LOCAL_TIMEOUT:-60m}"
+
+  regr:
+    desc: Run acceptance tests changed in this branch against main and the latest release, write regression_report.md
+    # No sources/generates: like local-select, the selection depends on the git diff.
+    cmds:
+      - "go test ./acceptance -run '^TestAccept$' -v -regr-main -regr-release -timeout=${LOCAL_TIMEOUT:-60m}"
+
+  regr-main:
+    desc: Run acceptance tests changed in this branch against a CLI built from main, write regression_report.md
+    cmds:
+      - "go test ./acceptance -run '^TestAccept$' -v -regr-main -timeout=${LOCAL_TIMEOUT:-60m}"
+
+  regr-release:
+    desc: Run acceptance tests changed in this branch against the latest release, write regression_report.md
+    cmds:
+      - "go test ./acceptance -run '^TestAccept$' -v -regr-release -timeout=${LOCAL_TIMEOUT:-60m}"
 
   test-update:
     desc: Update acceptance test output (local)
@@ -520,8 +555,6 @@ tasks:
       - exclude: "**/*_test.go"
       - exclude: integration/**
       - exclude: tools/**
-      - exclude: bundle/internal/tf/codegen/**
-      - bundle/internal/tf/codegen/schema/version.go
       - acceptance/**
       - python/**
       - libs/vendored_py_packages/**
@@ -534,28 +567,28 @@ tasks:
     generates: &ACC_GENERATES_UPDATE
       - acceptance/**/out*
     cmds:
-      - "go test ./acceptance -run '^TestAccept$' -update -timeout=${LOCAL_TIMEOUT:-30m}"
+      - "go test ./acceptance -run '^TestAccept$' -update -timeout=${LOCAL_TIMEOUT:-60m}"
 
   test-update-templates:
     desc: Update acceptance test template output
     sources: *ACC_SOURCES_UPDATE
     generates: *ACC_GENERATES_UPDATE
     cmds:
-      - "go test ./acceptance -run '^TestAccept/bundle/templates' -update -timeout=${LOCAL_TIMEOUT:-30m}"
-
-  test-update-aws:
-    desc: Update acceptance test output (integration, requires deco access)
-    sources: *ACC_SOURCES_UPDATE
-    generates: *ACC_GENERATES_UPDATE
-    cmds:
-      - "deco env run -i -n aws-prod-ucws -- env DATABRICKS_TEST_SKIPLOCAL=1 go test ./acceptance -run ^TestAccept$ -update -timeout=1h -v"
+      - "go test ./acceptance -run '^TestAccept/bundle/templates' -update -timeout=${LOCAL_TIMEOUT:-60m}"
 
   test-update-all:
     desc: Update all acceptance test outputs
-    # Sequential: both tasks overwrite the same acceptance output files.
     cmds:
       - task: test-update
-      - task: test-update-aws
+
+  # Follows upstream HEAD, so its result changes over time: keep it out of
+  # `generate-check`, which requires byte-for-byte reproducible output.
+  bump-mlops-stacks:
+    desc: Bump the vendored mlops-stacks acceptance template to github.com/databricks/mlops-stacks HEAD
+    cmds:
+      - 'uv run -p ">=3.11" --no-project python tools/bump_mlops_stacks.py'
+      # The bump rewrites a test input, so refresh that test's golden output.
+      - "go test ./acceptance -run '^TestAccept/bundle/deploy/mlops-stacks' -update -timeout=${LOCAL_TIMEOUT:-60m}"
 
   slowest:
     desc: Show 50 slowest tests from last run
@@ -575,7 +608,7 @@ tasks:
           --jsonfile test-output-unit.json \
           --rerun-fails \
           --packages "{{.TEST_PACKAGES}}" \
-          -- -coverprofile=coverage.txt -timeout=${LOCAL_TIMEOUT:-30m}
+          -- -coverprofile=coverage.txt -timeout=${LOCAL_TIMEOUT:-60m}
       - |
         VERBOSE_TEST=1 CLI_GOCOVERDIR=build/cover {{.GO_TOOL}} gotestsum \
           --format ${GOTESTSUM_FORMAT:-pkgname-and-test-fails} \
@@ -583,7 +616,7 @@ tasks:
           --jsonfile test-output-acc.json \
           --rerun-fails \
           --packages ./acceptance/... \
-          -- -timeout=${LOCAL_TIMEOUT:-30m}{{if .ACCEPTANCE_TEST_FILTER}} -run "{{.ACCEPTANCE_TEST_FILTER}}"{{end}}
+          -- -timeout=${LOCAL_TIMEOUT:-60m}{{if .ACCEPTANCE_TEST_FILTER}} -run "{{.ACCEPTANCE_TEST_FILTER}}"{{end}}
       - cat test-output-unit.json test-output-acc.json > test-output.json
       - rm -fr ./acceptance/build/cover-merged/
       - mkdir -p acceptance/build/cover-merged/
@@ -609,24 +642,27 @@ tasks:
   # generic `test` target (the catch-all) instead.
 
   test-exp-aitools:
-    desc: Run experimental aitools unit and acceptance tests
+    desc: Run aitools (top-level + experimental) unit and acceptance tests.
     sources:
+      - cmd/aitools/**
+      - libs/aitools/**
       - experimental/aitools/**
       - acceptance/apps/**
+      - acceptance/experimental/aitools/**
       - "{{.EMBED_SOURCES}}"
     cmds:
       - |
         {{.GO_TOOL}} gotestsum \
           --format ${GOTESTSUM_FORMAT:-pkgname-and-test-fails} \
           --no-summary=skipped \
-          --packages ./experimental/aitools/... \
-          -- -timeout=${LOCAL_TIMEOUT:-30m}
+          --packages "./cmd/aitools/... ./libs/aitools/... ./experimental/aitools/..." \
+          -- -timeout=${LOCAL_TIMEOUT:-60m}
       - |
         {{.GO_TOOL}} gotestsum \
           --format ${GOTESTSUM_FORMAT:-pkgname-and-test-fails} \
           --no-summary=skipped \
           --packages ./acceptance/... \
-          -- -timeout=${LOCAL_TIMEOUT:-30m} -run "TestAccept/apps"
+          -- -timeout=${LOCAL_TIMEOUT:-60m} -run "TestAccept/(apps|experimental/aitools)"
 
   test-exp-ssh:
     desc: Run experimental SSH unit and acceptance tests
@@ -640,13 +676,13 @@ tasks:
           --format ${GOTESTSUM_FORMAT:-pkgname-and-test-fails} \
           --no-summary=skipped \
           --packages ./experimental/ssh/... \
-          -- -timeout=${LOCAL_TIMEOUT:-30m}
+          -- -timeout=${LOCAL_TIMEOUT:-60m}
       - |
         {{.GO_TOOL}} gotestsum \
           --format ${GOTESTSUM_FORMAT:-pkgname-and-test-fails} \
           --no-summary=skipped \
           --packages ./acceptance/... \
-          -- -timeout=${LOCAL_TIMEOUT:-30m} -run "TestAccept/ssh"
+          -- -timeout=${LOCAL_TIMEOUT:-60m} -run "TestAccept/ssh"
 
   test-pipelines:
     desc: Run pipelines unit and acceptance tests
@@ -659,13 +695,32 @@ tasks:
           --format ${GOTESTSUM_FORMAT:-pkgname-and-test-fails} \
           --no-summary=skipped \
           --packages ./cmd/pipelines/... \
-          -- -timeout=${LOCAL_TIMEOUT:-30m}
+          -- -timeout=${LOCAL_TIMEOUT:-60m}
+      - |
+        {{.GO_TOOL}} gotestsum \
+          --format ${GOTESTSUM_FORMAT:-pkgname-and-test-fails} \
+          --no-summary=skipped \
+          --packages ./acceptance/... \
+          -- -timeout=${LOCAL_TIMEOUT:-60m} -run "TestAccept/pipelines"
+
+  test-sandbox:
+    desc: Run sandbox unit and acceptance tests
+    sources:
+      - cmd/sandbox/**
+      - acceptance/cmd/sandbox/**
+    cmds:
+      - |
+        {{.GO_TOOL}} gotestsum \
+          --format ${GOTESTSUM_FORMAT:-pkgname-and-test-fails} \
+          --no-summary=skipped \
+          --packages ./cmd/sandbox/... \
+          -- -timeout=${LOCAL_TIMEOUT:-60m}
       - |
         {{.GO_TOOL}} gotestsum \
           --format ${GOTESTSUM_FORMAT:-pkgname-and-test-fails} \
           --no-summary=skipped \
           --packages ./acceptance/... \
-          -- -timeout=${LOCAL_TIMEOUT:-30m} -run "TestAccept/pipelines"
+          -- -timeout=${LOCAL_TIMEOUT:-60m} -run "TestAccept/cmd/sandbox"
 
   # --- Integration tests ---
 
@@ -680,14 +735,32 @@ tasks:
           --rerun-fails \
           --jsonfile output.json \
           --packages "./acceptance ./integration/..." \
-          -- -parallel 4 -timeout=2h
+          -- -parallel 4 -timeout=12h
 
   integration-short:
-    desc: Run short integration tests
+    desc: Run integration tests except the slow ones (skips CloudSlow via -short)
     deps: [install-pythons]
     cmds:
       - |
-        DATABRICKS_TEST_SKIPLOCAL=1 VERBOSE_TEST=1 \
+        VERBOSE_TEST=1 \
+        go run -modfile=tools/go.mod ./tools/testrunner/main.go \
+          {{.GO_TOOL}} gotestsum \
+          --format github-actions \
+          --rerun-fails \
+          --jsonfile output.json \
+          --packages "./acceptance ./integration/..." \
+          -- -parallel 4 -timeout=12h -short
+
+  cloud-select:
+    desc: Run selection of integration tests (tests changed in this branch)
+    # The alias is the name the eng-dev-ecosystem CI job dispatches (cli-isolated-pr.yml
+    # passes it as integration_task, and cli-isolated-tests.yml greps Taskfile.yml for it
+    # and falls back to integration-short, the full cloud suite, if it is missing).
+    aliases: [integration-short-skiplocal]
+    deps: [install-pythons]
+    cmds:
+      - |
+        DATABRICKS_TEST_SELECT_CHANGED=50 VERBOSE_TEST=1 \
         go run -modfile=tools/go.mod ./tools/testrunner/main.go \
           {{.GO_TOOL}} gotestsum \
           --format github-actions \
@@ -700,7 +773,7 @@ tasks:
     desc: Run DBR acceptance tests on Databricks Runtime
     deps: [install-pythons]
     cmds:
-      - "DBR_ENABLED=true go test -v -timeout 4h -run TestDbrAcceptance$ ./acceptance"
+      - "DBR_ENABLED=true go test -v -timeout 12h -run TestDbrAcceptance$ ./acceptance"
 
   dbr-test:
     desc: Run DBR tests via deco env (requires deco + aws-prod-ucws access)
@@ -716,68 +789,182 @@ tasks:
   # can be invoked standalone.
 
   generate:
-    desc: Run all generators (genkit, refschema, schema, docs, validation, direct, pydabs)
+    desc: Run all generators (cligen, refschema, schema, validation, direct, pydabs)
     cmds:
-      # Runs first: regenerates CLI command stubs from the OpenAPI spec at
-      # .codegen/_openapi_sha. SDK version bumps (go.mod/go.sum) are a manual
-      # step outside this task; TestConsistentDatabricksSdkVersion (run inside
-      # generate-genkit) asserts the two stay in sync.
-      - task: generate-genkit
+      # Runs first: regenerates CLI command stubs from the checked-in
+      # .codegen/cli.json (no universe checkout needed). Refreshing cli.json
+      # itself from the OpenAPI spec is the separate `generate-clijson` task.
+      - task: generate-cligen
       # Refreshes acceptance/bundle/refschema/out.fields.txt, which feeds
       # generate-direct-apitypes and generate-direct-resources below.
       - task: generate-refschema
       - task: generate-schema
-      - task: generate-schema-docs
       - task: generate-validation
-      - task: generate-docs
       - task: generate-direct
       - task: pydabs-codegen
 
-  # Drives genkit from a universe checkout. Genkit writes CLI command files into
-  # cmd/workspace and cmd/account, refreshes .gitattributes and
-  # .codegen/_openapi_sha, and emits .github/workflows/tagging.yml +
-  # tagging.py (+ lock) in the repo root plus a next-changelog workflow we
-  # don't keep. Genkit does NOT modify go.mod/go.sum — SDK bumps are a manual
-  # `go get` step before running this task. The cmds below then post-process
-  # genkit's output: assert the SDK version matches the OpenAPI SHA, drop the
-  # next-changelog workflow, relocate tagging.py under internal/genkit/ and
-  # rewrite the tagging.yml workflow to match, then yamlfmt + whitespace fix
-  # so the tree is clean.
-  generate-genkit:
-    desc: Run genkit to generate CLI commands and tagging workflow (requires universe repo)
+  # Generators of `generate` that reproduce byte-for-byte on a clean checkout. The
+  # validate-generated-is-up-to-date CI job runs this followed by
+  # `git diff --exit-code` to catch committed artifacts drifting from their
+  # generators.
+  # The docs schema (jsonschema_for_docs.json) is not generated here or on main
+  # at all — it is built and published to the docgen branch by
+  # .github/workflows/update-schema-docs.yml.
+  # Keep this list in sync with `generate` when adding or removing generators.
+  generate-check:
+    desc: Run the reproducible generators (CI drift subset of `generate`)
+    cmds:
+      - task: generate-cligen
+      - task: generate-refschema
+      - task: generate-schema
+      - task: generate-validation
+      - task: generate-direct
+      - task: pydabs-codegen
+
+  # Regenerates the CLI command stubs (cmd/workspace/**, cmd/account/**) and
+  # .gitattributes from the checked-in .codegen/cli.json. No universe checkout,
+  # no spec download, no network: cli.json is the self-describing spec
+  # produced upstream by `generate-clijson`. internal/cligen renders the
+  # templates derived from genkit's cli_v0 generator and formats the output
+  # in-process (whitespace normalization, unused-import pruning, gofmt), so
+  # the result matches the committed files byte-for-byte.
+  generate-cligen:
+    desc: Regenerate CLI command stubs from .codegen/cli.json
     sources:
-      - .codegen/_openapi_sha
+      - .codegen/cli.json
       - .gitattributes.manual
-      - go.mod
-      - go.sum
+      - internal/cligen/**/*.go
+      - internal/cligen/templates/*.tmpl
+    generates:
+      - cmd/workspace/**/*.go
+      - cmd/account/**/*.go
+      - .gitattributes
+    cmds:
+      - go run ./internal/cligen --input .codegen/cli.json --output .
+
+  # Refreshes .codegen/cli.json from the Universe commit pinned in
+  # .codegen/_openapi_sha.
+  # cli.json is a genkit SDK target like any other (mode cli_v1 in .codegen.json):
+  # Genkit and the spec are built from the same Universe commit so their schema
+  # dialects cannot drift. The build runs in a temporary shared clone, leaving
+  # the developer's Universe checkout untouched. The commit SHA is passed
+  # alongside the built file; update-sdk keeps the previous
+  # .codegen/_openapi_sha available during generation and writes the same SHA
+  # afterwards. `task generate` then consumes the committed cli.json. SDK
+  # version bumps (go.mod/go.sum) are a manual `go get` step beforehand;
+  # TestConsistentDatabricksSdkVersion asserts the two stay in sync.
+  #
+  # No `sources:`/`generates:`: this task deliberately refreshes cli.json from
+  # an external Universe checkout whenever it is invoked.
+  generate-clijson:
+    desc: Produce .codegen/cli.json from its pinned Universe commit via genkit
     vars:
       UNIVERSE_DIR:
         sh: echo "${UNIVERSE_DIR:-$HOME/universe}"
     cmds:
       - |
-        echo "Checking out universe at SHA: $(cat .codegen/_openapi_sha)"
-        cd {{.UNIVERSE_DIR}}
-        if ! git cat-file -e $(cat {{.ROOT_DIR}}/.codegen/_openapi_sha) 2>/dev/null; then
-          git fetch --filter=blob:none origin master
+        OPENAPI_SHA="$(tr -d '[:space:]' < "{{.ROOT_DIR}}/.codegen/_openapi_sha")"
+        BUILD_DIR="$(mktemp -d "${TMPDIR:-/tmp}/databricks-cli-universe.XXXXXX")"
+        # go-task's embedded shell (mvdan.cc/sh) only accepts EXIT/ERR in trap,
+        # not signal names, so cleanup is on normal/errexit exit only.
+        trap 'rm -rf -- "$BUILD_DIR"' EXIT
+
+        echo "Creating temporary Universe checkout at ${OPENAPI_SHA}..."
+        git clone --quiet --shared --no-checkout "{{.UNIVERSE_DIR}}" "$BUILD_DIR/universe"
+
+        # `git clone --shared` does not carry over partial-clone/promisor config.
+        # If UNIVERSE_DIR is a blobless (filter=blob:none) clone, the shared
+        # object store lacks the file blobs the checkout below needs, and the
+        # temp clone has no promisor remote to fetch them on demand. Mirror the
+        # source's promisor config onto origin (pointed at the upstream remote)
+        # so missing blobs are lazily fetched during checkout. No-op for a full
+        # clone, where nothing is missing.
+        UNIVERSE_REMOTE="$(git -C "{{.UNIVERSE_DIR}}" remote get-url origin)"
+        UNIVERSE_FILTER="$(git -C "{{.UNIVERSE_DIR}}" config --get remote.origin.partialclonefilter || true)"
+        if [ -n "$UNIVERSE_FILTER" ]; then
+          git -C "$BUILD_DIR/universe" remote set-url origin "$UNIVERSE_REMOTE"
+          git -C "$BUILD_DIR/universe" config remote.origin.promisor true
+          git -C "$BUILD_DIR/universe" config remote.origin.partialclonefilter "$UNIVERSE_FILTER"
+          git -C "$BUILD_DIR/universe" config extensions.partialClone origin
+        fi
+
+        if ! git -C "$BUILD_DIR/universe" cat-file -e "${OPENAPI_SHA}^{commit}" 2>/dev/null; then
+          echo "Fetching the missing Universe commit from the upstream remote..."
+          git -C "$BUILD_DIR/universe" fetch --no-tags "$UNIVERSE_REMOTE" master
         fi
-        git checkout $(cat {{.ROOT_DIR}}/.codegen/_openapi_sha)
-      - echo "Building genkit..."
-      - cd {{.UNIVERSE_DIR}} && bazel build //openapi/genkit
-      - echo "Generating CLI code..."
-      - "{{.UNIVERSE_DIR}}/bazel-bin/openapi/genkit/genkit_/genkit update-sdk"
-      - "cat .gitattributes.manual .gitattributes > .gitattributes.tmp && mv .gitattributes.tmp .gitattributes"
+        git -C "$BUILD_DIR/universe" checkout --quiet --detach "$OPENAPI_SHA"
+
+        echo "Building genkit and OpenAPI spec at ${OPENAPI_SHA}..."
+        cd "$BUILD_DIR/universe"
+        ./tools/bazel build //deco/genkit //openapi:all-internal.json
+
+        echo "Generating CLI code..."
+        "$BUILD_DIR/universe/bazel-bin/deco/genkit/genkit_/genkit" update-sdk \
+          --dir "{{.ROOT_DIR}}" \
+          --openapi-spec-file "$BUILD_DIR/universe/bazel-bin/openapi/all-internal.json" \
+          --openapi-spec-sha "$OPENAPI_SHA"
+      # The SDK-version consistency check runs here for fast feedback when
+      # generate-clijson is invoked manually. Cleanup of genkit's output is
+      # delegated to generate-clijson-post so the SDK bumper can reuse it.
       - go test -timeout 240s -run TestConsistentDatabricksSdkVersion github.com/databricks/cli/internal/build
+      - task: generate-clijson-post
+
+  # Post-processing for genkit's `update-sdk` output, factored out of
+  # generate-clijson so the SDK bumper can run the same cleanup after its own
+  # update-sdk invocation.
+  generate-clijson-post:
+    desc: Clean up genkit update-sdk output, then run bump-sdk-post (shared by generate-clijson and the SDK bumper)
+    cmds:
+      # genkit also writes .gitattributes, but that file is owned by
+      # generate-cligen (which derives it from .gitattributes.manual plus the
+      # rendered file list), so discard genkit's copy.
+      - git checkout -- .gitattributes
       - rm .github/workflows/next-changelog.yml
       - mv tagging.py internal/genkit/tagging.py
       - mv tagging.py.lock internal/genkit/tagging.py.lock
+      # The release workflow tagging.yml expects tagging.py in a different location
+      # so we rewrite via sed
       - |
         if [ "$(uname)" = "Darwin" ]; then
           sed -i '' 's|tagging.py|internal/genkit/tagging.py|g' .github/workflows/tagging.yml
         else
           sed -i 's|tagging.py|internal/genkit/tagging.py|g' .github/workflows/tagging.yml
         fi
+      # In an environment configured with the internal PyPI proxy, uv bakes the
+      # proxy URL into the resolved locks. Unlike pydabs (which blind-reverts its
+      # locks because codegen never wants to change them), these locks legitimately
+      # track the synced producer's deps, so rewrite only the proxy URL back to the
+      # public registry and preserve any real dependency changes. Glob the lock
+      # files so a future genkit lock is scrubbed without editing this task. The
+      # trailing slash is optional so both proxy URL forms are matched.
+      # check-lockfiles is the backstop if this ever misses.
+      - |
+        if [ "$(uname)" = "Darwin" ]; then
+          sed -i '' 's|https://pypi-proxy.cloud.databricks.com/simple/\{0,1\}|https://pypi.org/simple|g' internal/genkit/*.py.lock
+        else
+          sed -i 's|https://pypi-proxy.cloud.databricks.com/simple/\{0,1\}|https://pypi.org/simple|g' internal/genkit/*.py.lock
+        fi
       - "{{.GO_TOOL}} yamlfmt .github/workflows/tagging.yml"
       - task: ws
+      # Last, so generate-cligen rewrites the .gitattributes restored above.
+      # The SDK bumper aborts before opening a PR on any error from this task,
+      # and bump-sdk-post fails whenever the bump needs hand fixes, so ignore
+      # its error: the PR then carries what was regenerated.
+      - task: bump-sdk-post
+        ignore_error: true
+
+  # The mechanical rest of an SDK bump once go.mod, .codegen/_openapi_sha and
+  # .codegen/cli.json are updated: regenerate every artifact derived from them,
+  # then refresh the acceptance goldens. generate-clijson-post runs it last;
+  # run it directly to redo it, e.g. after hand fixes. generate-refschema and
+  # test-update build the CLI, so it fails while the bump breaks compilation
+  # (code using a removed SDK field). Those fixes, exhaustruct wiring and the
+  # changelog PR link stay manual (.agents/skills/bump-sdk).
+  bump-sdk-post:
+    desc: Regenerate everything downstream of an SDK bump and refresh acceptance goldens
+    cmds:
+      - task: generate-check
+      - task: test-update
 
   # Refreshes out.fields.txt, which records the field paths / types emitted by
   # `bundle debug refschema` (see cmd/bundle/debug/refschema.go). It reflects
@@ -796,13 +983,20 @@ tasks:
     generates:
       - acceptance/bundle/refschema/out.fields.txt
     cmds:
-      - go test ./acceptance -run TestAccept/bundle/refschema -update &> /dev/null
-
+      - go test ./acceptance -run TestAccept/bundle/refschema -update
+
+  # Upstream field documentation comes from the checked-in .codegen/cli.json;
+  # bundle/internal/schema/annotations.yml carries the CLI-owned docs and
+  # overrides and is rewritten in place (synced with the config structure).
+  # Editing either input and running `task generate` percolates into
+  # jsonschema.json and pydabs. (The docs schema is built only on release by
+  # .github/workflows/update-schema-docs.yml and published to the docgen branch.)
   generate-schema:
     desc: Generate bundle JSON schema
     sources: &SCHEMA_SOURCES
       - "**/*.go"
-      - bundle/internal/schema/annotations*.yml
+      - .codegen/cli.json
+      - bundle/internal/schema/annotations.yml
       - exclude: "**/*_test.go"
       - go.mod
       - go.sum
@@ -811,37 +1005,7 @@ tasks:
       - bundle/schema/jsonschema.json
       - bundle/internal/schema/annotations.yml
     cmds:
-      - "go run ./bundle/internal/schema ./bundle/internal/schema ./bundle/schema/jsonschema.json"
-
-  generate-schema-docs:
-    desc: Generate bundle JSON schema for documentation
-    sources: *SCHEMA_SOURCES
-    generates:
-      - bundle/schema/jsonschema_for_docs.json
-      - bundle/internal/schema/annotations.yml
-    cmds:
-      # since_version.go reads `git tag --list 'v*'` to compute sinceVersion
-      # annotations. Without tags (e.g. shallow clone), those annotations are
-      # silently dropped from the output. Restore the fetch that lived in the
-      # old tools/post-generate.sh.
-      - git fetch origin 'refs/tags/v*:refs/tags/v*'
-      - "go run ./bundle/internal/schema ./bundle/internal/schema ./bundle/schema/jsonschema_for_docs.json --docs"
-
-  generate-docs:
-    desc: Generate bundle documentation
-    sources:
-      - "**/*.go"
-      - bundle/docsgen/templates/**
-      - bundle/internal/schema/annotations*.yml
-      - exclude: "**/*_test.go"
-      - go.mod
-      - go.sum
-      - "{{.EMBED_SOURCES}}"
-    generates:
-      - bundle/docsgen/output/reference.md
-      - bundle/docsgen/output/resources.md
-    cmds:
-      - "go run ./bundle/docsgen ./bundle/internal/schema ./bundle/docsgen"
+      - "go run ./bundle/internal/schema ./bundle/internal/schema ./bundle/schema/jsonschema.json .codegen/cli.json"
 
   generate-validation:
     desc: Generate enum and required field validation code
@@ -858,42 +1022,37 @@ tasks:
 
   generate-direct:
     desc: Generate direct engine config (apitypes + resources)
-    deps: ['generate-direct-apitypes', 'generate-direct-resources']
+    # Depend only on generate-direct-resources; it already pulls in
+    # generate-direct-apitypes transitively. Listing both as parallel deps
+    # races: resources reads apitypes.generated.yml while the apitypes step's
+    # `>` redirect is truncating it, silently dropping every resource whose
+    # type comes from that file. Keep this chain linear.
+    deps: ['generate-direct-resources']
 
   generate-direct-apitypes:
     desc: Generate direct engine API types YAML
-    deps: ['generate-openapi-json']
     sources:
       - bundle/direct/tools/generate_apitypes.py
-      - .codegen/openapi.json
+      - .codegen/cli.json
       - acceptance/bundle/refschema/out.fields.txt
     generates:
       - bundle/direct/dresources/apitypes.generated.yml
     cmds:
-      - "sh -c 'python3 bundle/direct/tools/generate_apitypes.py .codegen/openapi.json acceptance/bundle/refschema/out.fields.txt > bundle/direct/dresources/apitypes.generated.yml'"
+      - "sh -c 'uv run -p \">=3.11\" --no-project python bundle/direct/tools/generate_apitypes.py .codegen/cli.json acceptance/bundle/refschema/out.fields.txt > bundle/direct/dresources/apitypes.generated.yml'"
 
   generate-direct-resources:
     desc: Generate direct engine resources YAML
     deps: ['generate-direct-apitypes']
     sources:
       - bundle/direct/tools/generate_resources.py
-      - .codegen/openapi.json
+      - .codegen/cli.json
       - bundle/direct/dresources/apitypes.generated.yml
       - bundle/direct/dresources/apitypes.yml
       - acceptance/bundle/refschema/out.fields.txt
     generates:
-      - bundle/direct/dresources/resources.generated.yml
-    cmds:
-      - "sh -c 'python3 bundle/direct/tools/generate_resources.py .codegen/openapi.json bundle/direct/dresources/apitypes.generated.yml bundle/direct/dresources/apitypes.yml acceptance/bundle/refschema/out.fields.txt > bundle/direct/dresources/resources.generated.yml'"
-
-  generate-openapi-json:
-    desc: Download OpenAPI spec (triggered by _openapi_sha change)
-    sources:
-      - .codegen/_openapi_sha
-    generates:
-      - .codegen/openapi.json
+      - bundle/direct/dresources/configs/*.generated.yml
     cmds:
-      - "wget -O .codegen/openapi.json.tmp \"https://openapi.dev.databricks.com/$(cat .codegen/_openapi_sha)/specs/all-internal.json\" && mv .codegen/openapi.json.tmp .codegen/openapi.json"
+      - "uv run --script bundle/direct/tools/generate_resources.py .codegen/cli.json bundle/direct/dresources/apitypes.generated.yml bundle/direct/dresources/apitypes.yml acceptance/bundle/refschema/out.fields.txt bundle/direct/dresources/configs"
 
   # pydabs-* tasks are defined in python/Taskfile.yml (included above).
 
@@ -918,16 +1077,16 @@ tasks:
     desc: Run 1k benchmark and print summary
     cmds:
       - task: bench-1k
-      - ./tools/bench_parse.py bench1k.log
+      - 'uv run -p ">=3.11" --no-project python tools/bench_parse.py bench1k.log'
 
   bench-100-summary:
     desc: Run 100 benchmark and print summary
     cmds:
       - task: bench-100
-      - ./tools/bench_parse.py bench100.log
+      - 'uv run -p ">=3.11" --no-project python tools/bench_parse.py bench100.log'
 
   bench-10-summary:
     desc: Run 10 benchmark and print summary
     cmds:
       - task: bench-10
-      - ./tools/bench_parse.py bench10.log
+      - 'uv run -p ">=3.11" --no-project python tools/bench_parse.py bench10.log'
diff --git a/acceptance/.gitattributes b/acceptance/.gitattributes
index 8d48122750e..f54139ab770 100644
--- a/acceptance/.gitattributes
+++ b/acceptance/.gitattributes
@@ -4,10 +4,15 @@
 # uploading the file's content to a workspace.
 *.txt text eol=lf
 *.lvdash.json text eol=lf
-
-# The out.test.toml file is autogenerated based on the merged test.toml view.
-out.test.toml linguist-generated=true
+*.geniespace.json text eol=lf
 
 # Do not mark generated files as conflicted, they should simply be regenerated.
 # Note, you need top run .gitconfig.install to enable 'ours' driver
 out* merge=ours
+
+# Acceptance test scripts have no file extension and most have no shebang, so
+# GitHub's linguist treats them as plain text. Force Shell so they get syntax
+# highlighting in blob and diff views, which makes reviewing them easier.
+script linguist-language=Shell
+script.prepare linguist-language=Shell
+script.cleanup linguist-language=Shell
diff --git a/acceptance/README.md b/acceptance/README.md
index 8e33d273a70..9cd4d2ed0a0 100644
--- a/acceptance/README.md
+++ b/acceptance/README.md
@@ -1,6 +1,21 @@
 Acceptance tests are blackbox tests that are run against compiled binary.
 
-Currently these tests are run against "fake" HTTP server pretending to be Databricks API. However, they will be extended to run against real environment as regular integration tests.
+## Where tests run
+
+**Every test runs locally**, against a "fake" HTTP server pretending to be Databricks API (`libs/testserver`). This is what `./task test` does and it covers the whole `acceptance` tree.
+
+A test can *additionally* opt into running against a real workspace by setting `Cloud = true` in its `test.toml`. That is an extra run, not a different one: `Cloud = true` never means "this test does not run locally". Related settings:
+
+- `CloudSlow = true` only narrows a `Cloud = true` test: its cloud run is skipped when `-short` is passed. On its own (without `Cloud = true`) it does not enable the cloud run.
+- `CloudEnvs` only narrows the cloud run further. It is ignored locally.
+- `Cloud` is inherited from parent `test.toml` files, so a whole subtree can be opted in at once. The root `acceptance/test.toml` defaults it to `Cloud = false`, i.e. local only.
+- Each test's effective settings are visible in its generated `out.test.toml`.
+
+The cloud run is keyed off `CLOUD_ENV`; see `getSkipReason` in `acceptance/acceptance_test.go` for the exact gating. What skips a test *locally* is a different set of settings entirely: `GOOS`, `RunsOnDbr`, and `DATABRICKS_TEST_SELECT_CHANGED` (used by cloud PR runs to cover only the tests the branch touches).
+
+To run tests against a real workspace: `deco env run -i -n aws-prod-ucws -- <go test command>` (requires the `deco` tool and access to a test env).
+
+## Authoring
 
 To author a test,
  - Add a new directory under `acceptance`. Any level of nesting is supported.
@@ -15,9 +30,13 @@ The scripts are run with `bash -e` so any errors will be propagated. They are ca
 
 For more complex tests one can also use:
 - `errcode` helper: if the command fails with non-zero code, it appends `Exit code: N` to the output but returns success to caller (bash), allowing continuation of script.
+- `musterr` helper: runs the command and fails the test if it *succeeds*; on the expected failure the script continues. Use it to assert a command must error.
 - `trace` helper: prints the arguments before executing the command.
+- `title` helper: prints a `=== <text>` section header to label a phase of the script.
 - custom output files: redirect output to custom file (it must start with `out`), e.g. `$CLI bundle validate > out.txt 2> out.error.txt`.
 
+The complete set of shell helpers (the above plus `withdir`, `git-repo-init`, `uuid`, `sethome`, and others) is defined in `acceptance/script.prepare`.
+
 Any file starting with "LOG" will be logged to test log (visible with go test -v).
 
 See [selftest](./selftest) for more examples.
diff --git a/acceptance/acceptance_test.go b/acceptance/acceptance_test.go
index 67ec78ffded..b5f7eec71a5 100644
--- a/acceptance/acceptance_test.go
+++ b/acceptance/acceptance_test.go
@@ -10,8 +10,8 @@ import (
 	"flag"
 	"fmt"
 	"io"
-	"io/fs"
 	"maps"
+	"math/rand/v2"
 	"net/http"
 	"os"
 	"os/exec"
@@ -25,15 +25,18 @@ import (
 	"testing"
 	"time"
 	"unicode/utf8"
-
-	"github.com/google/uuid"
+	"uuid"
 
 	"github.com/databricks/cli/acceptance/internal"
+	"github.com/databricks/cli/acceptance/internal/selection"
+	"github.com/databricks/cli/internal/build"
 	"github.com/databricks/cli/internal/testutil"
 	"github.com/databricks/cli/libs/auth"
 	"github.com/databricks/cli/libs/testdiff"
 	"github.com/databricks/cli/libs/testserver"
 	"github.com/stretchr/testify/require"
+	"go.yaml.in/yaml/v3"
+	"golang.org/x/sync/errgroup"
 )
 
 var (
@@ -45,9 +48,11 @@ var (
 	LogRequests     bool
 	LogConfig       bool
 	UseVersion      string
+	CLIPath         string
 	WorkspaceTmpDir bool
 	OnlyOutTestToml bool
 	Subset          bool
+	DebugSandbox    bool
 )
 
 // In order to debug CLI running under acceptance test, search for TestInprocessMode and update
@@ -74,21 +79,21 @@ func init() {
 	flag.BoolVar(&LogRequests, "logrequests", false, "Log request and responses from testserver")
 	flag.BoolVar(&LogConfig, "logconfig", false, "Log merged for each test case")
 	flag.StringVar(&UseVersion, "useversion", "", "Download previously released version of CLI and use it to run the tests")
+	flag.StringVar(&CLIPath, "clipath", "", "Use the CLI binary at this path instead of building from source (e.g. a CLI built from main for regression comparison)")
 
 	// DABs in the workspace runs on the workspace file system. This flags does the same for acceptance tests
 	// to simulate an identical environment.
 	flag.BoolVar(&WorkspaceTmpDir, "workspace-tmp-dir", false, "Run tests on the workspace file system (For DBR testing).")
 	flag.BoolVar(&OnlyOutTestToml, "only-out-test-toml", false, "Only regenerate out.test.toml files without running tests")
 	flag.BoolVar(&Subset, "subset", false, "Select a subset of EnvMatrix variants that cover all output files. Auto-enabled on -update (unless -run specifies a variant with '=').")
+	flag.BoolVar(&DebugSandbox, "debugsandbox", false, "Use a per-test blocking proxy instead of a shared one; shows exactly which test caused unexpected internet access (slower)")
 }
 
 const (
-	EntryPointScript = "script"
+	EntryPointScript = selection.EntryPointScript
 	CleanupScript    = "script.cleanup"
 	PrepareScript    = "script.prepare"
 	MaxFileSize      = 1_000_000
-	// Filename to save replacements to (used by diff.py)
-	ReplsFile = "repls.json"
 	// Filename for materialized config (used as golden file)
 	MaterializedConfigFile = "out.test.toml"
 
@@ -97,14 +102,40 @@ const (
 	// The tests the don't set SERVERLESS variable or set to empty string will also be run.
 	EnvFilterVar = "ENVFILTER"
 
-	// File where scripts can output custom replacements
-	// export $job_id=100200300
-	// $ echo "$job_id:MY_JOB" >> ACC_REPLS  # This will replace 100200300 with [MY_JOB] in the output
-	// TODO: this should be merged with repls.json functionality, currently these replacements are not parsed by diff.py
-	userReplacementsFilename = "ACC_REPLS"
+	// Env var with the path to the file holding all replacements applied to the output.
+	// It is kept outside of the test directory, otherwise "bundle deploy" uploads it.
+	//
+	// Every line is one replacement encoded as a JSON object: "Old" is a regular expression
+	// (written by the harness), "Literal" is a value to replace verbatim (appended by
+	// add_repl.py). The harness writes its own replacements first, then the scripts add theirs:
+	//
+	//   $ job_id=100200300
+	//   $ add_repl "$job_id" MY_JOB   # replaces 100200300 with [MY_JOB] in the output
+	//
+	// The file is read back here (see loadScriptReplacements) and by the python helpers
+	// (see bin/repls.py).
+	ReplsEnvVar = "ACC_REPLS"
 )
 
-var ApplyCITimeoutMultipler = os.Getenv("GITHUB_WORKFLOW") != ""
+var IsRunningOnCI = os.Getenv("GITHUB_WORKFLOW") != ""
+
+// MaxLogLines caps how many lines of each LOG.* file the harness echoes into the test
+// log. Some invariant tests write very large LOG.planjson files that otherwise drown out
+// the rest of the logs and overflow log viewers. Override with DATABRICKS_CLI_TEST_MAX_LOG;
+// a value <= 0 disables the limit.
+var MaxLogLines = func() int {
+	if v := os.Getenv("DATABRICKS_CLI_TEST_MAX_LOG"); v != "" {
+		n, err := strconv.Atoi(v)
+		if err != nil {
+			panic("invalid DATABRICKS_CLI_TEST_MAX_LOG=" + v + ": " + err.Error())
+		}
+		return n
+	}
+	if IsRunningOnCI {
+		return 100
+	}
+	return 1000
+}()
 
 var exeSuffix = func() string {
 	if runtime.GOOS == "windows" {
@@ -119,13 +150,12 @@ var Scripts = map[string]bool{
 	PrepareScript:    true,
 }
 
-var Ignored = map[string]bool{
-	ReplsFile:                true,
-	userReplacementsFilename: true,
-}
-
 func TestAccept(t *testing.T) {
-	testAccept(t, InprocessMode, "")
+	if RegrMain || RegrRelease {
+		runRegression(t)
+		return
+	}
+	testAccept(t, InprocessMode, nil, false)
 }
 
 func TestInprocessMode(t *testing.T) {
@@ -135,13 +165,23 @@ func TestInprocessMode(t *testing.T) {
 	if os.Getenv("CLOUD_ENV") != "" {
 		t.Skip("No need to run this as integration test.")
 	}
+	if os.Getenv(selection.EnvVar) != "" {
+		// The two selftests below only run if this branch changed them, so the
+		// assertions on the returned count do not hold under test selection.
+		t.Skip("Disabled via " + selection.EnvVar)
+	}
 
 	// Uncomment to load  ~/.databricks/debug-env.json to debug integration tests
 	// testutil.LoadDebugEnvIfRunFromIDE(t, "workspace")
 	// Run the "deco env flip workspace" command to configure a workspace.
 
-	require.Equal(t, 1, testAccept(t, true, "selftest/basic"))
-	require.Equal(t, 1, testAccept(t, true, "selftest/server"))
+	// Keep this to a single cheap test: it only needs to catch in-process mode
+	// rotting, and every testAccept call redoes the whole setup. This used to run
+	// selftest/server too, which meant a second setup after StartDefaultServer had
+	// pointed HOME at an empty temp dir, so building yamlfmt there re-downloaded the
+	// entire module cache: 44s on Linux CI, 140s on Windows. Tool builds are skipped
+	// for the same reason - selftest/basic uses neither the wheel nor yamlfmt.
+	require.Equal(t, 1, testAccept(t, true, []string{"selftest/basic"}, true))
 }
 
 // Configure replacements for environment variables we read from test environments.
@@ -158,35 +198,47 @@ func setReplsForTestEnvVars(t *testing.T, repls *testdiff.ReplacementsContext) {
 	}
 }
 
-// helperScriptUsesEngineCache caches whether a _script helper in a given directory
-// (or any of its ancestors) references $DATABRICKS_BUNDLE_ENGINE.
-// Since _script helpers are shared across many tests, caching avoids redundant reads.
-var helperScriptUsesEngineCache sync.Map
-
-// anyHelperScriptUsesEngine returns true if any _script helper in dir or its ancestors
-// contains $DATABRICKS_BUNDLE_ENGINE.
-func anyHelperScriptUsesEngine(dir string) bool {
-	if dir == "" || dir == "." {
-		return false
-	}
-	if v, ok := helperScriptUsesEngineCache.Load(dir); ok {
-		return v.(bool)
-	}
-	content, err := os.ReadFile(filepath.Join(dir, "_script"))
-	result := (err == nil && strings.Contains(string(content), "$DATABRICKS_BUNDLE_ENGINE")) ||
-		anyHelperScriptUsesEngine(filepath.Dir(dir))
-	helperScriptUsesEngineCache.Store(dir, result)
-	return result
-}
-
 // hasRunFilter returns true if the -run flag contains '=', indicating a specific
-// EnvMatrix variant was requested (e.g. DATABRICKS_BUNDLE_ENGINE=direct).
+// EnvMatrix variant was requested (e.g. DMS=true).
 func hasRunFilter() bool {
 	f := flag.Lookup("test.run")
 	return f != nil && strings.Contains(f.Value.String(), "=")
 }
 
-func testAccept(t *testing.T, inprocessMode bool, singleTest string) int {
+// requirePrerequisites verifies external tool prerequisites before doing any
+// work, so a stale toolchain fails fast with an actionable message instead of
+// producing confusing diffs deep into the run.
+//
+// It reports whether all checks passed; a failure surfaces as
+// TestAccept/prerequisites rather than a bare TestAccept.
+//
+// On DBR the serverless image only provides what the test archive ships, so
+// every tool required here must also be bundled in internal/testarchive. When
+// adding a new RequireX prerequisite, add a matching downloader there too, or
+// DBR runs will fail this check before any test runs.
+func requirePrerequisites(t *testing.T) bool {
+	return t.Run("prerequisites", func(t *testing.T) {
+		// A stray .git above the temp dir makes the CLI believe all temporary
+		// directories are git repositories; catch it here rather than chasing diffs.
+		internal.RequireTempDirNotInGitRepo(t)
+		// Scripts use jq 1.7 features (the pick/1 builtin and the `.foo.[]` iteration syntax).
+		internal.RequireJQ(t, "1.7")
+		// uv builds the databricks-bundles wheel and provides the test interpreter
+		// via `uv python find`, which landed in the 0.3 line.
+		internal.RequireUV(t, "0.4")
+		// ruff 0.9.1 is pinned across the repo (python/pyproject.toml, Taskfile.yml);
+		// the check-formatting test's golden output assumes its formatter behavior.
+		internal.RequireRuff(t, "0.9.1")
+		// Acceptance scripts import the stdlib tomllib module, added in Python 3.11.
+		internal.RequirePython(t, "3.11")
+	})
+}
+
+// selectedTests, when non-empty, limits the run to those test directories.
+// skipToolBuilds skips building the tools that the selected tests do not use
+// (the databricks-bundles wheel, yamlfmt); it must stay false for a
+// full run.
+func testAccept(t *testing.T, inprocessMode bool, selectedTests []string, skipToolBuilds bool) int {
 	if testdiff.OverwriteMode && !hasRunFilter() {
 		Subset = true
 	}
@@ -198,11 +250,69 @@ func testAccept(t *testing.T, inprocessMode bool, singleTest string) int {
 	// Consistent behavior of locale-dependent tools, such as 'sort'
 	t.Setenv("LC_ALL", "C")
 
+	// Unset AI-agent detection env vars so the SDK's user-agent does not
+	// pick up the host's agent. Setting these to "" via test.toml is not
+	// enough: the SDK (since v0.132.0) treats empty values as a truthy
+	// signal because os.LookupEnv reports them as present.
+	// Keep this list in sync with listKnownAgents() in
+	// github.com/databricks/databricks-sdk-go/useragent/agent.go
+	// plus the AGENT and AI_AGENT generic fallbacks and the CLI's own
+	// AIDEVKIT_HOME detection override.
+	for _, v := range []string{
+		"AGENT",
+		"AI_AGENT",
+		"AIDEVKIT_HOME",
+		"AMP_CURRENT_THREAD_ID",
+		"ANTIGRAVITY_AGENT",
+		"AUGMENT_AGENT",
+		"CLAUDECODE",
+		"CLINE_ACTIVE",
+		"CODEX_CI",
+		"COPILOT_CLI",
+		"CURSOR_AGENT",
+		"GEMINI_CLI",
+		"GOOSE_TERMINAL",
+		"KIRO",
+		"OPENCLAW_SHELL",
+		"OPENCODE",
+		"VSCODE_AGENT",
+		"WINDSURF_AGENT",
+	} {
+		os.Unsetenv(v) //nolint:usetesting // t.Setenv cannot unset
+	}
+
+	// environments setup-local follows uv's UV_PROJECT_ENVIRONMENT, so a value
+	// from the host shell would move the venv the localenv tests expect.
+	os.Unsetenv("UV_PROJECT_ENVIRONMENT") //nolint:usetesting // t.Setenv cannot unset
+
+	if !requirePrerequisites(t) {
+		// Don't run the suite against a stale toolchain; the failed subtest
+		// has already marked the parent test as failed.
+		return 0
+	}
+	// Run after the version check passed; must use the top-level t so the PATH
+	// change survives for the rest of the run.
+	internal.ConfigurePython(t, "3.11")
+
 	buildDir := getBuildDir(t, cwd, runtime.GOOS, runtime.GOARCH)
 
-	// Set up terraform for tests. Skip on DBR - tests with RunsOnDbr only use direct deployment.
-	if !WorkspaceTmpDir {
-		setupTerraform(t, cwd, buildDir, &repls)
+	// Download old CLI versions in parallel, overlapping with the builds below.
+	var cli293Path, cli18Path, cli1161Path string
+	var oldCLIs errgroup.Group
+	if !inprocessMode {
+		oldCLIs.Go(func() (err error) {
+			cli293Path, err = downloadCLI(buildDir, "0.293.0")
+			return err
+		})
+		oldCLIs.Go(func() (err error) {
+			cli18Path, err = downloadCLI(buildDir, "1.8.0")
+			return err
+		})
+		// CLI version that predates the hashed_fields feature. Used by acceptance/bundle/hashing
+		oldCLIs.Go(func() (err error) {
+			cli1161Path, err = downloadCLI(buildDir, "1.16.1")
+			return err
+		})
 	}
 
 	vendoredPyPackages, err := filepath.Abs("../libs/vendored_py_packages")
@@ -214,7 +324,10 @@ func testAccept(t *testing.T, inprocessMode bool, singleTest string) int {
 	t.Setenv("UV_FIND_LINKS", vendoredPyPackages)
 	t.Setenv("UV_OFFLINE", "true")
 
-	wheelPath := buildDatabricksBundlesWheel(t, buildDir)
+	wheelPath := ""
+	if !skipToolBuilds {
+		wheelPath = buildDatabricksBundlesWheel(t, buildDir)
+	}
 	if wheelPath != "" {
 		t.Setenv("DATABRICKS_BUNDLES_WHEEL", wheelPath)
 		repls.SetPath(wheelPath, "[DATABRICKS_BUNDLES_WHEEL]")
@@ -229,38 +342,76 @@ func testAccept(t *testing.T, inprocessMode bool, singleTest string) int {
 		t.Logf("Writing coverage to %s", coverDir)
 	}
 
+	// Build the CLI with the FIPS toolchain so a plain `go test` produces the
+	// same FIPS binary as `task` (which sets GOFIPS140 in its env) and the
+	// release pipeline; without it acceptance/fips fails outside `task`. The
+	// build below inherits os.Environ(), so setting it here is enough.
+	t.Setenv("GOFIPS140", readGOFIPS140(t, cwd))
+
 	execPath := ""
+	cliVersion := ""
 
 	if inprocessMode {
 		cmdServer := internal.StartCmdServer(t)
 		t.Setenv("CMD_SERVER_URL", cmdServer.URL)
 		execPath = filepath.Join(cwd, "bin", "callserver.py")
+		// In-process mode runs the CLI code directly; the test binary's own build
+		// info is the correct version.
+		cliVersion = build.GetInfo().Version
 	} else {
-		if UseVersion != "" {
+		if CLIPath != "" {
+			// Use a prebuilt binary (e.g. a CLI built from main) instead of building
+			// from the current source, so the test infra and tests stay on this branch.
+			execPath = CLIPath
+		} else if UseVersion != "" {
 			version := UseVersion
 			if version == "latest" {
 				version = resolveLatestVersion(t, buildDir)
 			}
+			// Wait for the old CLI downloads so the same version isn't downloaded concurrently.
+			require.NoError(t, oldCLIs.Wait())
 			execPath = DownloadCLI(t, buildDir, version)
+			// For a downloaded release the version string is already known.
+			cliVersion = version
 		} else {
 			execPath = BuildCLI(t, buildDir, coverDir, runtime.GOOS, runtime.GOARCH)
 		}
+		if cliVersion == "" {
+			// Run the binary to get its version: the test binary itself is compiled
+			// by "go test" in a tmpdir where VCS stamps are unavailable, so
+			// build.GetInfo().Version returns bare "0.0.0-dev" rather than
+			// "0.0.0-dev+<commit>". The built CLI binary includes VCS stamps.
+			cliVersion = getBinaryVersion(t, execPath)
+		}
 	}
 
 	// Skip building yamlfmt when running on workspace filesystem (DBR).
 	// This fails today on DBR. Can be looked into and fixed as a follow-up
 	// as and when needed.
-	if !WorkspaceTmpDir {
+	if !WorkspaceTmpDir && !skipToolBuilds {
 		BuildYamlfmt(t)
 	}
 
 	t.Setenv("CLI", execPath)
 	repls.SetPath(execPath, "[CLI]")
 
+	// Built here rather than run with "go run" from a test: tests run with a sandboxed
+	// HOME, which has no module cache, so building inside one fails to resolve imports.
+	selectionPath := buildSelectionCmd(t, buildDir)
+	t.Setenv("SELECTION", selectionPath)
+	repls.SetPath(selectionPath, "[SELECTION]")
+
 	if !inprocessMode {
-		cli293Path := DownloadCLI(t, buildDir, "0.293.0")
+		require.NoError(t, oldCLIs.Wait())
+
 		t.Setenv("CLI_293", cli293Path)
 		repls.SetPath(cli293Path, "[CLI_293]")
+
+		t.Setenv("CLI_1_8", cli18Path)
+		repls.SetPath(cli18Path, "[CLI_1_8]")
+
+		t.Setenv("CLI_1_16_1", cli1161Path)
+		repls.SetPath(cli1161Path, "[CLI_1_16_1]")
 	}
 
 	paths := []string{
@@ -299,6 +450,12 @@ func testAccept(t *testing.T, inprocessMode bool, singleTest string) int {
 		}
 	}
 
+	const sharedProxyHint = "; re-run with -debugsandbox to see which test caused this"
+	sandboxProxyURL := ""
+	if cloudEnv == "" && !DebugSandbox {
+		sandboxProxyURL = internal.StartRejectingProxy(t, sharedProxyHint)
+	}
+
 	setReplsForTestEnvVars(t, &repls)
 
 	if cloudEnv != "" && UseVersion == "" {
@@ -310,8 +467,19 @@ func testAccept(t *testing.T, inprocessMode bool, singleTest string) int {
 	// do it last so that full paths match first:
 	repls.SetPath(buildDir, "[BUILD_DIR]")
 
-	testdiff.PrepareReplacementsDevVersion(t, &repls)
+	repls.Set(cliVersion, "[CLI_VERSION]")
+	// Also replace the base version without build metadata (e.g. "0.0.0-dev" when
+	// cliVersion is "0.0.0-dev+abc123"), so fixture data that stores a bare version
+	// string is also normalized.
+	if base, _, found := strings.Cut(cliVersion, "+"); found {
+		repls.Set(base, "[CLI_VERSION]")
+	}
+	// A dev build may embed a +<git-sha> that the base-version replacement above leaves
+	// behind (e.g. "[CLI_VERSION]+abc123def456"), which would otherwise bake into a
+	// regenerated golden. Strip any such trailing suffix so goldens stay sha-independent.
+	repls.Repls = append(repls.Repls, testdiff.Replacement{Old: regexp.MustCompile(`\[CLI_VERSION\]\+[0-9a-f]{7,40}`), New: "[CLI_VERSION]"})
 	testdiff.PrepareReplacementSdkVersion(t, &repls)
+	testdiff.PrepareReplacementTfProviderVersion(t, &repls)
 	testdiff.PrepareReplacementsGoVersion(t, &repls)
 
 	t.Setenv("TESTROOT", cwd)
@@ -326,14 +494,60 @@ func testAccept(t *testing.T, inprocessMode bool, singleTest string) int {
 	t.Setenv("NODE_TYPE_ID", nodeTypeID)
 	repls.Set(nodeTypeID, "[NODE_TYPE_ID]")
 
+	// On cloud, tag every $UNIQUE_NAME with a per-run prefix (see newBundleNamePrefix)
+	// so this run's bundles can be attributed and swept by the post-run cleanup step
+	// (TestCleanupLeakedBundles) after every matrix leg finishes. Off cloud names need
+	// no attribution: each local test gets a throwaway in-memory fake workspace.
+	if cloudEnv != "" {
+		bundleNamePrefix = newBundleNamePrefix()
+	}
+
 	testDirs := getTests(t)
 	require.NotEmpty(t, testDirs)
 
-	if singleTest != "" {
+	testDirsSet := make(map[string]bool, len(testDirs))
+	for _, d := range testDirs {
+		testDirsSet[d] = true
+	}
+
+	subset := newSubsetSelector(t, testdiff.OverwriteMode, Forcerun)
+
+	changedLimit, err := selection.ParseLimit(os.Getenv(selection.EnvVar))
+	require.NoError(t, err)
+	selectChanged := changedLimit > 0
+	if !selectChanged && subset.enabled {
+		changedLimit = subsetChangedLimit
+	}
+
+	// changedTests maps test dir to extra env filters for changed tests; nil filters
+	// means all variants of that dir changed. Both selection.EnvVar and the subset
+	// selector keep these tests, so detect them at most once here.
+	var changedTests map[string][]string
+	if changedLimit > 0 {
+		// A failed selection (e.g. no origin/main in a shallow checkout) must fail the
+		// run: treating it as "nothing changed" would silently skip new tests.
+		result, err := selection.FromGit(".", testDirsSet, changedLimit)
+		require.NoError(t, err)
+		t.Log(result.Summary())
+		changedTests = result.Tests()
+	}
+	subset.changed = changedTests
+
+	// Drop the tests that were not selected instead of skipping them per dir: a skip
+	// per dir buries the run in a thousand SKIP lines and hides the selection summary.
+	// Their out.test.toml is left alone, which is what a partial run should do.
+	if selectChanged {
+		testDirs = slices.DeleteFunc(testDirs, func(dir string) bool {
+			_, ok := changedTests[dir]
+			return !ok
+		})
+	}
+
+	if len(selectedTests) > 0 {
 		testDirs = slices.DeleteFunc(testDirs, func(n string) bool {
-			return n != singleTest
+			return !slices.Contains(selectedTests, n)
 		})
-		require.NotEmpty(t, testDirs, "singleTest=%#v did not match any tests\n%#v", singleTest, testDirs)
+		require.Len(t, testDirs, len(selectedTests), "selectedTests=%#v did not match all tests\n%#v", selectedTests, testDirs)
 	}
 
 	skippedDirs := 0
@@ -364,12 +578,6 @@ func testAccept(t *testing.T, inprocessMode bool, singleTest string) int {
 				t.Fatalf("Invalid config %s: %s", configPath, err)
 			}
 
-			// Apply default: CloudSlow implies Cloud. Do this before generating
-			// the materialized config so the implication is visible in out.test.toml.
-			if isTruePtr(config.CloudSlow) {
-				config.Cloud = config.CloudSlow
-			}
-
 			// Generate materialized config for this test.
 			// We do this before skipping the test, so the configs are generated for all tests.
 			materializedConfig := internal.GenerateMaterializedConfig(&config)
@@ -417,16 +625,16 @@ func testAccept(t *testing.T, inprocessMode bool, singleTest string) int {
 
 			expanded := internal.ExpandEnvMatrix(config.EnvMatrix, config.EnvMatrixExclude, extraVars)
 			if Subset {
-				scriptContent, _ := os.ReadFile(filepath.Join(dir, EntryPointScript))
-				scriptUsesEngine := strings.Contains(string(scriptContent), "$DATABRICKS_BUNDLE_ENGINE") ||
-					anyHelperScriptUsesEngine(dir)
-				expanded = internal.SubsetExpanded(expanded, dir, scriptUsesEngine)
+				expanded = internal.SubsetExpanded(expanded, dir)
 			}
 
 			// If the matrix expands to a single empty envset, run the test directly
 			// without creating a subtest (avoids the "#00" dummy subtest name).
 			if len(expanded) == 1 && len(expanded[0]) == 0 {
-				runTest(t, dir, 0, coverDir, repls.Clone(), config, nil, envFilters)
+				if reason := subset.skipReason(dir, nil); reason != "" {
+					t.Skip(reason)
+				}
+				runTest(t, dir, 0, coverDir, repls.Clone(), config, nil, envFilters, sandboxProxyURL)
 			} else {
 				for ind, envset := range expanded {
 					envname := strings.Join(envset, "/")
@@ -434,7 +642,17 @@ func testAccept(t *testing.T, inprocessMode bool, singleTest string) int {
 						if runParallel {
 							t.Parallel()
 						}
-						runTest(t, dir, ind, coverDir, repls.Clone(), config, envset, envFilters)
+						// Under selection.EnvVar, an invariant dir re-enabled by a
+						// specific config change runs only its matching variants.
+						if selectChanged {
+							if variantFilters := changedTests[dir]; variantFilters != nil {
+								checkEnvFilters(t, envset, variantFilters)
+							}
+						}
+						if reason := subset.skipReason(dir, envset); reason != "" {
+							t.Skip(reason)
+						}
+						runTest(t, dir, ind, coverDir, repls.Clone(), config, envset, envFilters, sandboxProxyURL)
 					})
 				}
 			}
@@ -460,7 +678,7 @@ func getEnvFilters(t *testing.T) []string {
 	}
 
 	filters := strings.Split(envFilterValue, ",")
-	outFilters := make([]string, len(filters))
+	outFilters := make([]string, 0, len(filters))
 
 	for _, filter := range filters {
 		items := strings.Split(filter, "=")
@@ -477,23 +695,9 @@ func getEnvFilters(t *testing.T) []string {
 }
 
 func getTests(t *testing.T) []string {
-	testDirs := make([]string, 0, 128)
-
-	err := filepath.Walk(".", func(path string, info os.FileInfo, err error) error {
-		if err != nil {
-			return err
-		}
-		name := filepath.Base(path)
-		if name == EntryPointScript {
-			// Presence of 'script' marks a test case in this directory
-			testName := filepath.ToSlash(filepath.Dir(path))
-			testDirs = append(testDirs, testName)
-		}
-		return nil
-	})
+	// Tests are discovered relative to the acceptance dir, which is the working directory.
+	testDirs, err := selection.FindTestDirs(".")
 	require.NoError(t, err)
-
-	slices.Sort(testDirs)
 	return testDirs
 }
 
@@ -507,10 +711,6 @@ func validateTestPhase(phase int) error {
 
 // Return a reason to skip the test. Empty string means "don't skip".
 func getSkipReason(config *internal.TestConfig, configPath string) string {
-	if os.Getenv("DATABRICKS_TEST_SKIPLOCAL") != "" && isTruePtr(config.Local) {
-		return "Disabled via DATABRICKS_TEST_SKIPLOCAL environment variable in " + configPath
-	}
-
 	if Forcerun {
 		return ""
 	}
@@ -534,42 +734,80 @@ func getSkipReason(config *internal.TestConfig, configPath string) string {
 			return fmt.Sprintf("Disabled via CloudEnvs.%s setting in %s (CLOUD_ENV=%s)", cloudEnvBase, configPath, cloudEnv)
 		}
 
-		if isTruePtr(config.CloudSlow) {
-			if testing.Short() {
-				return fmt.Sprintf("Disabled via CloudSlow setting in %s (CLOUD_ENV=%s, Short=%v)", configPath, cloudEnv, testing.Short())
-			}
-		}
-
-		isCloudEnabled := isTruePtr(config.Cloud) || isTruePtr(config.CloudSlow)
-		if !isCloudEnabled {
-			return fmt.Sprintf("Disabled via Cloud/CloudSlow setting in %s (CLOUD_ENV=%s, Cloud=%v, CloudSlow=%v)",
-				configPath,
-				cloudEnv,
-				isTruePtr(config.Cloud),
-				isTruePtr(config.CloudSlow),
-			)
+		if !isTruePtr(config.Cloud) {
+			return fmt.Sprintf("Disabled via Cloud setting in %s (CLOUD_ENV=%s)", configPath, cloudEnv)
 		}
 
-		if isTruePtr(config.RequiresUnityCatalog) && os.Getenv("TEST_METASTORE_ID") == "" {
-			return fmt.Sprintf("Disabled via RequiresUnityCatalog setting in %s (TEST_METASTORE_ID is empty)", configPath)
+		// CloudSlow only narrows an already-enabled cloud run: skip it under -short.
+		if isTruePtr(config.CloudSlow) && testing.Short() {
+			return fmt.Sprintf("Disabled via CloudSlow setting in %s (CLOUD_ENV=%s, Short=%v)", configPath, cloudEnv, testing.Short())
 		}
+	}
 
-		if isTruePtr(config.RequiresWarehouse) && os.Getenv("TEST_DEFAULT_WAREHOUSE_ID") == "" {
-			return fmt.Sprintf("Disabled via RequiresWarehouse setting in %s (TEST_DEFAULT_WAREHOUSE_ID is empty)", configPath)
-		}
+	return ""
+}
 
-		if isTruePtr(config.RequiresCluster) && os.Getenv("TEST_DEFAULT_CLUSTER_ID") == "" {
-			return fmt.Sprintf("Disabled via RequiresCluster setting in %s (TEST_DEFAULT_CLUSTER_ID is empty)", configPath)
-		}
+// Cap at 11 digits: the prefix "ci<runID>x<suffix>" plus the 8-char random
+// minimum must fit the 26-char unique name (26 - 8 - len("ci")-len("x") -
+// bundleLegSuffixLen = 11), so a longer GITHUB_RUN_ID is treated as absent
+// rather than building a prefix ciUniqueName would silently drop.
+var ciRunID = regexp.MustCompile(`^[0-9]{1,11}$`)
+
+// bundleLegSuffixLen is the length of the per-process random suffix that keeps
+// each matrix leg's bundle names distinct within a run (useful when eyeballing
+// leaked deployments). The run-wide cleanup matches on the "ci<runID>x" prefix
+// alone, so it sweeps every leg regardless of the suffix.
+const bundleLegSuffixLen = 4
+
+// bundleNamePrefix is the sweepable prefix embedded into every $UNIQUE_NAME on
+// cloud runs (see newBundleNamePrefix / ciUniqueName). Set once in testAccept,
+// empty off cloud where names need no attribution.
+var bundleNamePrefix string
+
+// ciRunPrefix returns the run-wide "ci<runID>x" prefix that attributes every
+// bundle a cloud run deploys to its GitHub run, so they can be swept by
+// acceptance/cleanup and tools/sweep_test_resources.py. The run id (all digits)
+// is delimited by "x" so the prefix stays collision-free between runs whose ids
+// share a leading substring. Returns "" when GITHUB_RUN_ID is unset or not a
+// valid numeric id (e.g. a local `deco env run`).
+func ciRunPrefix() string {
+	runID := os.Getenv("GITHUB_RUN_ID")
+	if !ciRunID.MatchString(runID) {
+		return ""
+	}
+	return "ci" + runID + "x"
+}
 
-	} else {
-		// Local run
-		if !isTruePtr(config.Local) {
-			return fmt.Sprintf("Disabled via Local setting in %s (CLOUD_ENV=%s)", configPath, cloudEnv)
-		}
+// newBundleNamePrefix builds the "ci<runID>x<suffix>" prefix that ciUniqueName
+// stamps into every $UNIQUE_NAME so deployed bundles can be attributed and swept.
+// Returns "" on non-CI runs (no GITHUB_RUN_ID), where cleanup is not automatic.
+func newBundleNamePrefix() string {
+	prefix := ciRunPrefix()
+	if prefix == "" {
+		return ""
 	}
+	const alphabet = "0123456789abcdefghijklmnopqrstuvwxyz"
+	suffix := make([]byte, bundleLegSuffixLen)
+	for i := range suffix {
+		suffix[i] = alphabet[rand.IntN(len(alphabet))]
+	}
+	return prefix + string(suffix)
+}
 
-	return ""
+// ciUniqueName prepends prefix to the random unique name, preserving its length
+// (e.g. "app-$UNIQUE_NAME" is exactly the 30-char app name maximum) and its
+// lowercase-alphanumeric shape so it stays valid everywhere $UNIQUE_NAME is used
+// (app names, Python and Unity Catalog identifiers). Returns random unchanged
+// when prefix is empty or too long to leave at least 8 random characters.
+func ciUniqueName(prefix, random string) string {
+	// newBundleNamePrefix keeps the prefix short enough to leave at least this
+	// many random characters (empty prefix trivially fits); a longer one is a bug.
+	const minRandom = 8
+	cut := len(random) - len(prefix)
+	if cut < minRandom {
+		panic(fmt.Sprintf("bundle name prefix %q leaves only %d of %d random chars, need %d", prefix, cut, len(random), minRandom))
+	}
+	return prefix + random[:cut]
 }
 
 func runTest(t *testing.T,
@@ -580,6 +818,7 @@ func runTest(t *testing.T,
 	config internal.TestConfig,
 	customEnv []string,
 	envFilters []string,
+	sharedProxyURL string,
 ) {
 	// Check env filters early, before creating any resources like directories on the file system.
 	// Creating / deleting too many directories causes this error on the workspace FUSE mount:
@@ -605,6 +844,8 @@ func runTest(t *testing.T,
 
 	id := uuid.New()
 	uniqueName := strings.ToLower(strings.Trim(base32.StdEncoding.EncodeToString(id[:]), "="))
+	// Embed the run prefix, when present, so leaked resources can be attributed to this leg and swept.
+	uniqueName = ciUniqueName(bundleNamePrefix, uniqueName)
 	repls.Set(uniqueName, "[UNIQUE_NAME]")
 
 	var tmpDir string
@@ -628,10 +869,21 @@ func runTest(t *testing.T,
 		tmpDir = t.TempDir()
 	}
 
+	// Harness-owned files (the merged entry-point script, output.txt, out.requests.txt)
+	// live outside the test dir so the bundle sync doesn't upload them as bundle sources.
+	// Otherwise they land in the deploy and skew the synced "Files: N" set.
+	// Register this repl before [TEST_TMP_DIR] so it wins: outputDir is a sibling of
+	// tmpDir, so the [TEST_TMP_DIR]_PARENT repl would otherwise match it first.
+	outputDir := t.TempDir()
+	repls.SetPath(outputDir, "[OUTPUT_DIR]")
+
 	repls.SetPathWithParents(tmpDir, "[TEST_TMP_DIR]")
 
-	scriptContents := readMergedScriptContents(t, dir)
-	testutil.WriteFile(t, filepath.Join(tmpDir, EntryPointScript), scriptContents)
+	// The merged script lives in outputDir (see above), and is run from there (cmd.Dir
+	// below). It cd's into the bundle dir first so relative paths inside the script
+	// resolve there, while $0 stays "script" (no temp path leaks into error output).
+	scriptContents := "cd \"$TEST_TMP_DIR\"\n" + readMergedScriptContents(t, dir)
+	testutil.WriteFile(t, filepath.Join(outputDir, EntryPointScript), scriptContents)
 
 	// Generate materialized config for this test
 	inputs := make(map[string]bool, 2)
@@ -654,7 +906,7 @@ func runTest(t *testing.T,
 		timeout = max(timeout, config.TimeoutCloud)
 	}
 
-	if ApplyCITimeoutMultipler {
+	if IsRunningOnCI {
 		timeout = time.Duration(float64(timeout) * config.TimeoutCIMultiplier)
 	}
 
@@ -663,9 +915,10 @@ func runTest(t *testing.T,
 	args := []string{"bash", "-euo", "pipefail", EntryPointScript}
 	cmd := exec.CommandContext(ctx, args[0], args[1:]...)
 
-	cfg, user := internal.PrepareServerAndClient(t, config, LogRequests, tmpDir)
+	cfg, user, workspaceID := internal.PrepareServerAndClient(t, config, LogRequests, outputDir, testEnv)
 	testdiff.PrepareReplacementsUser(t, &repls, user)
 	testdiff.PrepareReplacementsWorkspaceConfig(t, &repls, cfg)
+	repls.Set(workspaceID, "[WORKSPACE_ID]")
 
 	cmd.Env = auth.ProcessEnv(cfg)
 
@@ -680,6 +933,12 @@ func runTest(t *testing.T,
 	cmd.Env = append(cmd.Env, "DATABRICKS_RATE_LIMIT="+rateLimit)
 	cmd.Env = append(cmd.Env, "UNIQUE_NAME="+uniqueName)
 	cmd.Env = append(cmd.Env, "TEST_TMP_DIR="+tmpDir)
+	// Forward slashes: scripts pass $OUT_REQUESTS straight to bash tools, and a
+	// backslash Windows path would be mangled inside double quotes in Git Bash.
+	cmd.Env = append(cmd.Env, "OUT_REQUESTS="+filepath.ToSlash(filepath.Join(outputDir, "out.requests.txt")))
+
+	replsPath := filepath.Join(t.TempDir(), ReplsEnvVar)
+	cmd.Env = append(cmd.Env, ReplsEnvVar+"="+replsPath)
 
 	// populate CLOUD_ENV_BASE
 	envBase := getCloudEnvBase(cloudEnv)
@@ -691,10 +950,17 @@ func runTest(t *testing.T,
 	// User replacements:
 	repls.Repls = append(repls.Repls, config.Repls...)
 
-	// Save replacements to temp test directory so that it can be read by diff.py
-	replsJson, err := json.MarshalIndent(repls.Repls, "", "  ")
-	require.NoError(t, err)
-	testutil.WriteFile(t, filepath.Join(tmpDir, ReplsFile), string(replsJson))
+	// Save replacements so that they can be read by the scripts (diff.py, sort_lines.py).
+	// One JSON object per line, because scripts append their own replacements to this file.
+	var replsLines strings.Builder
+	for _, repl := range repls.Repls {
+		line, err := json.Marshal(repl)
+		require.NoError(t, err)
+		replsLines.Write(line)
+		replsLines.WriteByte('\n')
+	}
+	testutil.WriteFile(t, replsPath, replsLines.String())
+	replsWritten := len(repls.Repls)
 
 	if coverDir != "" {
 		// Creating individual coverage directory for each test, because writing to the same one
@@ -715,6 +981,27 @@ func runTest(t *testing.T,
 	uniqueCacheDir := filepath.Join(t.TempDir(), ".cache")
 	cmd.Env = append(cmd.Env, "DATABRICKS_CACHE_DIR="+uniqueCacheDir)
 
+	// Disable the passive update notice explicitly. It is already suppressed
+	// implicitly (dev builds, non-TTY stderr, CI), but tests that run released
+	// binaries (e.g. -useversion) must never reach GitHub or print the notice
+	// into compared output. Tests can override this via Env.* in test.toml.
+	cmd.Env = append(cmd.Env, "DATABRICKS_CLI_DISABLE_UPDATE_CHECK=true")
+
+	// Neutralize Databricks-internal development-environment interference so
+	// acceptance tests behave the same as on CI (which has none of this). Two
+	// sources both reach the blocking proxy on every git invocation:
+	//
+	//  1. A command-timing shim that wraps git (ahead of the real binary on
+	//     PATH) and POSTs per-command metrics over the network.
+	//     COMMAND_TIMER_DISABLE=1 makes it pass through without the beacon.
+	//  2. A managed global git config installs a core.hooksPath whose hooks
+	//     (secret scanning, etc.) also beacon metrics. Ignoring the global and
+	//     system git config disables those hooks and keeps tests hermetic; tests
+	//     configure the repos they create via git-repo-init locally.
+	cmd.Env = append(cmd.Env, "COMMAND_TIMER_DISABLE=1")
+	cmd.Env = append(cmd.Env, "GIT_CONFIG_GLOBAL="+os.DevNull)
+	cmd.Env = append(cmd.Env, "GIT_CONFIG_SYSTEM="+os.DevNull)
+
 	for _, kv := range testEnv {
 		key, value, _ := strings.Cut(kv, "=")
 		// Only add replacement by default if value is part of EnvMatrix with more than 1 option and length is 4 or more chars
@@ -725,12 +1012,42 @@ func runTest(t *testing.T,
 
 	absDir, err := filepath.Abs(dir)
 	require.NoError(t, err)
-	cmd.Env = append(cmd.Env, "TESTDIR="+absDir)
+	// Use forward slashes so paths built from $TESTDIR (e.g. echoed in trace
+	// output) are stable across OSes and don't need per-test slash replacements.
+	cmd.Env = append(cmd.Env, "TESTDIR="+filepath.ToSlash(absDir))
 	cmd.Env = append(cmd.Env, "CLOUD_ENV="+cloudEnv)
 	cmd.Env = append(cmd.Env, "CURRENT_USER_NAME="+user.UserName)
-	cmd.Dir = tmpDir
+	if !isRunningOnCloud {
+		// Expose a guest token for the as-test-sp helper: the guest prefix plus
+		// the primary identity's uuid suffix make it share the same fake
+		// workspace. On cloud TEST_SP_TOKEN comes from the real environment.
+		suffix := cfg.Token
+		for _, prefix := range []string{testserver.UserNameTokenPrefix, testserver.ServicePrincipalTokenPrefix} {
+			suffix = strings.TrimPrefix(suffix, prefix)
+		}
+		cmd.Env = append(cmd.Env, "TEST_SP_TOKEN="+testserver.GuestServicePrincipalTokenPrefix+suffix)
 
-	outputPath := filepath.Join(tmpDir, "output.txt")
+		proxyURL := sharedProxyURL
+		if DebugSandbox {
+			// Per-test proxy: errors are attributed to this subtest's t, making
+			// it immediately clear which test caused the internet access.
+			proxyURL = internal.StartRejectingProxy(t, "")
+		}
+		// Block both HTTP and HTTPS external traffic. NO_PROXY below exempts the
+		// local test server (http://127.0.0.1:PORT) so its traffic is not intercepted.
+		cmd.Env = append(cmd.Env, "HTTP_PROXY="+proxyURL)
+		cmd.Env = append(cmd.Env, "HTTPS_PROXY="+proxyURL)
+		// Python's urllib does not automatically bypass the proxy for loopback
+		// addresses the way Go does, so the test-server helper scripts
+		// (kill_after.py, callserver.py, …) would route their requests through
+		// the blocking proxy. NO_PROXY exempts them.
+		cmd.Env = append(cmd.Env, "NO_PROXY=127.0.0.1,localhost")
+	}
+	// Run from outputDir so the entry-point script isn't a bundle source; the script
+	// cd's into tmpDir (the bundle dir) as its first line.
+	cmd.Dir = outputDir
+
+	outputPath := filepath.Join(outputDir, "output.txt")
 	out, err := os.Create(outputPath)
 	require.NoError(t, err)
 	defer out.Close()
@@ -745,19 +1062,31 @@ func runTest(t *testing.T,
 	formatOutput(out, err)
 	require.NoError(t, out.Close())
 
-	loadUserReplacements(t, &repls, tmpDir)
+	loadScriptReplacements(t, &repls, replsPath, replsWritten)
 
 	printedRepls := false
 
 	pathFilter := preparePathFilter(config, customEnv)
+	sortLines := compileSortLines(t, config)
+
+	// output.txt lives in outputDir, not tmpDir, so the bundle sync never uploads it;
+	// compare it from there. Every run produces it, so compare it explicitly rather
+	// than relying on it turning up in the tmpDir scan below. out.requests.txt also
+	// stays in outputDir and is never compared: tests assert on recorded requests
+	// through print_requests.py, not by committing the raw recording.
+	doComparison(t, repls, sortLines, dir, outputDir, "output.txt", &printedRepls)
 
 	// Compare expected outputs
 	for relPath := range outputs {
+		if relPath == "output.txt" {
+			// Handled above: it is produced in outputDir, not tmpDir.
+			continue
+		}
 		if shouldSkip(pathFilter, relPath) {
 			continue
 		}
 
-		doComparison(t, repls, dir, tmpDir, relPath, &printedRepls)
+		doComparison(t, repls, sortLines, dir, tmpDir, relPath, &printedRepls)
 	}
 
 	// Make sure there are not unaccounted for new files
@@ -770,9 +1099,6 @@ func runTest(t *testing.T,
 		if _, ok := outputs[relPath]; ok {
 			continue
 		}
-		if _, ok := Ignored[relPath]; ok {
-			continue
-		}
 		if config.CompiledIgnoreObject.MatchesPath(relPath) && !strings.HasPrefix(relPath, "out") {
 			continue
 		}
@@ -780,6 +1106,7 @@ func runTest(t *testing.T,
 			prefix := relPath + ": "
 			messages := testutil.ReadFile(t, filepath.Join(tmpDir, relPath))
 			messages = strings.TrimRight(messages, "\r\n \t")
+			messages = truncateLines(messages, MaxLogLines)
 			messages = prefix + strings.ReplaceAll(messages, "\n", "\n"+prefix)
 			if strings.Contains(messages, "\n") {
 				messages = "\n" + messages
@@ -791,7 +1118,7 @@ func runTest(t *testing.T,
 		if strings.HasPrefix(relPath, "out") {
 			// We have a new file starting with "out"
 			// Show the contents & support overwrite mode for it:
-			doComparison(t, repls, dir, tmpDir, relPath, &printedRepls)
+			doComparison(t, repls, sortLines, dir, tmpDir, relPath, &printedRepls)
 		}
 	}
 
@@ -800,21 +1127,38 @@ func runTest(t *testing.T,
 	}
 }
 
-// checkEnvFilters skips the test if any env filter doesn't match testEnv.
-func checkEnvFilters(t *testing.T, testEnv, envFilters []string) {
-	envMap := make(map[string]string, len(testEnv))
-	for _, kv := range testEnv {
-		key, value, _ := strings.Cut(kv, "=")
-		envMap[key] = value
+// truncateLines keeps at most maxLines lines of s, appending a note about how many were
+// dropped. maxLines <= 0 disables truncation.
+func truncateLines(s string, maxLines int) string {
+	if maxLines <= 0 {
+		return s
 	}
-	for i, filter := range envFilters {
-		key, expected, _ := strings.Cut(filter, "=")
-		if actual, ok := envMap[key]; ok && actual != expected {
-			t.Skipf("Skipping because test environment %s=%s does not match ENVFILTER#%d: %s", key, actual, i, filter)
-		}
+	lines := strings.Split(s, "\n")
+	if len(lines) <= maxLines {
+		return s
+	}
+	dropped := len(lines) - maxLines
+	kept := strings.Join(lines[:maxLines], "\n")
+	return fmt.Sprintf("%s\n... (%d more lines truncated, raise DATABRICKS_CLI_TEST_MAX_LOG to see more)", kept, dropped)
+}
+
+// checkEnvFilters skips the test if any env filter doesn't match testEnv. Filters that
+// share a key are alternatives, so INPUT_CONFIG=a together with INPUT_CONFIG=b runs both
+// variants rather than neither (see selection.MatchesFilters).
+func checkEnvFilters(t *testing.T, testEnv, envFilters []string) {
+	if !selection.MatchesFilters(testEnv, envFilters) {
+		t.Skipf("Skipping because test environment (%s) does not match filters (%s)",
+			strings.Join(testEnv, " "), strings.Join(envFilters, " "))
 	}
 }
 
+// envAliases are short EnvMatrix keys, expanded here into the variable the CLI reads. Every
+// matrix key ends up in the variant's test name, so a long one makes every name that carries
+// it hard to read. Tests may still name the variable itself; the alias is only shorter.
+var envAliases = map[string]string{
+	"DMS": "DATABRICKS_BUNDLE_DEPLOYMENT_HISTORY",
+}
+
 // buildTestEnv builds the test environment from config.Env and customEnv.
 // customEnv (from EnvMatrix) takes precedence over config.Env.
 func buildTestEnv(configEnv map[string]string, customEnv []string) []string {
@@ -831,6 +1175,16 @@ func buildTestEnv(configEnv map[string]string, customEnv []string) []string {
 	// Add customEnv second (takes precedence)
 	env = append(env, customEnv...)
 
+	// An alias sets the variable it stands for, unless the test set that itself.
+	for _, kv := range customEnv {
+		key, value, _ := strings.Cut(kv, "=")
+		full, ok := envAliases[key]
+		if !ok || hasKey(env, full) {
+			continue
+		}
+		env = append(env, full+"="+value)
+	}
+
 	return env
 }
 
@@ -864,7 +1218,24 @@ func addEnvVar(t *testing.T, env []string, repls *testdiff.ReplacementsContext,
 	return append(env, key+"="+newValue)
 }
 
-func doComparison(t *testing.T, repls testdiff.ReplacementsContext, dirRef, dirNew, relPath string, printedRepls *bool) {
+// compileSortLines compiles the enabled SortLines patterns from the test config.
+// Patterns are returned in name order so the result does not depend on map iteration.
+func compileSortLines(t *testing.T, config internal.TestConfig) []*regexp.Regexp {
+	result := make([]*regexp.Regexp, 0, len(config.SortLines))
+	for _, name := range slices.Sorted(maps.Keys(config.SortLines)) {
+		if on, ok := config.SortLinesOn[name]; ok && !on {
+			continue
+		}
+		re, err := regexp.Compile(config.SortLines[name])
+		if err != nil {
+			t.Fatalf("Invalid SortLines pattern %s = %#v: %s", name, config.SortLines[name], err)
+		}
+		result = append(result, re)
+	}
+	return result
+}
+
+func doComparison(t *testing.T, repls testdiff.ReplacementsContext, sortLines []*regexp.Regexp, dirRef, dirNew, relPath string, printedRepls *bool) {
 	pathRef := filepath.Join(dirRef, relPath)
 	pathNew := filepath.Join(dirNew, relPath)
 	bufRef, okRef := tryReading(t, pathRef)
@@ -883,24 +1254,50 @@ func doComparison(t *testing.T, repls testdiff.ReplacementsContext, dirRef, dirN
 		valueNew = repls.Replace(valueNew)
 	}
 
+	// Canonicalize line runs whose order the command does not guarantee. Applied to
+	// the reference too so a hand-edited golden compares the same way; sorting is
+	// idempotent, so a stored reference is unaffected.
+	for _, re := range sortLines {
+		valueRef = testdiff.SortLineRuns(valueRef, re)
+		valueNew = testdiff.SortLineRuns(valueNew, re)
+	}
+
+	// In update mode, regenerating the reference files is the goal: each branch below
+	// writes or removes the reference and returns without failing the test. Genuine
+	// problems still fail — read errors (via tryReading above), write errors (via
+	// require/testutil), and the both-missing case above.
+
 	// The test did not produce an expected output file.
 	if okRef && !okNew {
-		t.Errorf("Missing output file: %s", relPath)
 		if testdiff.OverwriteMode {
+			// The test no longer produces this output; drop the stale reference.
 			t.Logf("Removing output file: %s", relPath)
 			require.NoError(t, os.Remove(pathRef))
+			return
 		}
+		t.Errorf("Missing output file: %s", relPath)
 		return
 	}
 
 	// The test produced an unexpected output file.
 	if !okRef && okNew {
+		if testdiff.OverwriteMode {
+			t.Logf("Writing output file: %s", relPath)
+			testutil.WriteFile(t, pathRef, valueNew)
+			return
+		}
 		t.Errorf("Unexpected output file: %s\npathRef: %s\npathNew: %s", relPath, pathRef, pathNew)
 		if shouldShowDiff(pathNew, valueNew) {
 			testdiff.AssertEqualTexts(t, pathRef, pathNew, valueRef, valueNew)
 		}
-		if testdiff.OverwriteMode {
-			t.Logf("Writing output file: %s", relPath)
+		return
+	}
+
+	// In update mode, overwrite on any difference rather than calling
+	// AssertEqualTexts, which would mark the test failed.
+	if testdiff.OverwriteMode {
+		if valueRef != valueNew {
+			t.Logf("Overwriting existing output file: %s", relPath)
 			testutil.WriteFile(t, pathRef, valueNew)
 		}
 		return
@@ -908,10 +1305,6 @@ func doComparison(t *testing.T, repls testdiff.ReplacementsContext, dirRef, dirN
 
 	// Compare the reference and new values.
 	equal := testdiff.AssertEqualTexts(t, pathRef, pathNew, valueRef, valueNew)
-	if !equal && testdiff.OverwriteMode {
-		t.Logf("Overwriting existing output file: %s", relPath)
-		testutil.WriteFile(t, pathRef, valueNew)
-	}
 
 	if VerboseTest && !equal && printedRepls != nil && !*printedRepls {
 		*printedRepls = true
@@ -985,6 +1378,17 @@ func getBuildDir(t *testing.T, cwd, osName, arch string) string {
 	return buildDir
 }
 
+// getBinaryVersion runs `<path> version` and parses out the version string (e.g. "0.293.0").
+func getBinaryVersion(t *testing.T, path string) string {
+	t.Helper()
+	out, err := exec.Command(path, "version").Output()
+	require.NoError(t, err)
+	// Output is "Databricks CLI v<version>\n"; strip the prefix.
+	line := strings.TrimSpace(string(out))
+	line = strings.TrimPrefix(line, "Databricks CLI v")
+	return line
+}
+
 func BuildCLI(t *testing.T, buildDir, coverDir, osName, arch string) string {
 	execPath := filepath.Join(buildDir, "databricks")
 	if osName == "windows" {
@@ -1010,6 +1414,41 @@ func BuildCLI(t *testing.T, buildDir, coverDir, osName, arch string) string {
 	return execPath
 }
 
+// buildSelectionCmd builds the test selection command, so a test can run it the way a
+// developer does.
+func buildSelectionCmd(t *testing.T, buildDir string) string {
+	execPath := filepath.Join(buildDir, "selection"+exeSuffix)
+
+	args := []string{"go", "build", "-o", execPath}
+	if runtime.GOOS == "windows" {
+		// See BuildCLI: VCS stamping fails on Windows.
+		args = append(args, "-buildvcs=false")
+	}
+	// The package path goes last: go build reads anything after it as another package.
+	args = append(args, "./internal/selection/cmd")
+	RunCommand(t, args, ".", nil)
+
+	return execPath
+}
+
+// readGOFIPS140 returns the GOFIPS140 version the Taskfile pins for `task`
+// builds; the release pipeline pins the same value independently in
+// .goreleaser.yaml.
+func readGOFIPS140(t *testing.T, cwd string) string {
+	path := filepath.Join(cwd, "..", "Taskfile.yml")
+	data, err := os.ReadFile(path)
+	require.NoError(t, err)
+
+	var taskfile struct {
+		Env struct {
+			GOFIPS140 string `yaml:"GOFIPS140"`
+		} `yaml:"env"`
+	}
+	require.NoError(t, yaml.Unmarshal(data, &taskfile))
+	require.NotEmpty(t, taskfile.Env.GOFIPS140, "GOFIPS140 not set in Taskfile.yml")
+	return taskfile.Env.GOFIPS140
+}
+
 // CreateReleaseArtifacts builds release artifacts for the given OS using amd64 and arm64 architectures,
 // archives them into zip files, and returns the directory containing the release artifacts.
 func CreateReleaseArtifacts(t *testing.T, cwd, coverDir, osName string) string {
@@ -1068,7 +1507,13 @@ func resolveLatestVersion(t *testing.T, buildDir string) string {
 	}
 
 	const url = "https://api.github.com/repos/databricks/cli/releases/latest"
-	resp, err := http.Get(url)
+	req, err := http.NewRequestWithContext(t.Context(), http.MethodGet, url, nil)
+	require.NoError(t, err)
+	// Unauthenticated requests from shared CI runner IPs hit the GitHub API rate limit.
+	if token := os.Getenv("GITHUB_TOKEN"); token != "" {
+		req.Header.Set("Authorization", "Bearer "+token)
+	}
+	resp, err := http.DefaultClient.Do(req)
 	require.NoError(t, err)
 	defer resp.Body.Close()
 	require.Equal(t, http.StatusOK, resp.StatusCode, "failed to fetch %s: %s", url, resp.Status)
@@ -1087,9 +1532,19 @@ func resolveLatestVersion(t *testing.T, buildDir string) string {
 // DownloadCLI downloads a released CLI binary archive for the given version,
 // extracts the executable, and returns its path.
 func DownloadCLI(t *testing.T, buildDir, version string) string {
+	execPath, err := downloadCLI(buildDir, version)
+	require.NoError(t, err)
+	return execPath
+}
+
+// downloadCLI is the error-returning version of [DownloadCLI], safe to call
+// from goroutines other than the test goroutine.
+func downloadCLI(buildDir, version string) (string, error) {
 	// Prepare target directory for this version
 	versionDir := filepath.Join(buildDir, version)
-	require.NoError(t, os.MkdirAll(versionDir, 0o755))
+	if err := os.MkdirAll(versionDir, 0o755); err != nil {
+		return "", err
+	}
 
 	execName := "databricks"
 	if runtime.GOOS == "windows" {
@@ -1099,7 +1554,7 @@ func DownloadCLI(t *testing.T, buildDir, version string) string {
 
 	// If already downloaded, reuse
 	if _, err := os.Stat(execPath); err == nil {
-		return execPath
+		return execPath, nil
 	}
 
 	osName := runtime.GOOS
@@ -1110,55 +1565,70 @@ func DownloadCLI(t *testing.T, buildDir, version string) string {
 	url := fmt.Sprintf("https://github.com/databricks/cli/releases/download/v%s/%s", version, archiveName)
 	zipPath := filepath.Join(versionDir, archiveName)
 
-	downloadToFile(t, url, zipPath)
-	extractFileFromZip(t, zipPath, execName, versionDir)
+	if err := downloadToFile(url, zipPath); err != nil {
+		return "", err
+	}
+	if err := extractFileFromZip(zipPath, execName, versionDir); err != nil {
+		return "", err
+	}
 
-	return execPath
+	return execPath, nil
 }
 
 // downloadToFile downloads contents from url into the given destination path
-func downloadToFile(t *testing.T, url, destPath string) {
-	require.NoError(t, os.MkdirAll(filepath.Dir(destPath), 0o755))
+func downloadToFile(url, destPath string) error {
+	if err := os.MkdirAll(filepath.Dir(destPath), 0o755); err != nil {
+		return err
+	}
 	out, err := os.Create(destPath)
-	require.NoError(t, err)
+	if err != nil {
+		return err
+	}
 	defer out.Close()
 
 	resp, err := http.Get(url)
-	require.NoError(t, err)
+	if err != nil {
+		return err
+	}
 	defer resp.Body.Close()
-	require.Equal(t, http.StatusOK, resp.StatusCode, "failed to download %s: %s", url, resp.Status)
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("failed to download %s: %s", url, resp.Status)
+	}
 
 	_, err = io.Copy(out, resp.Body)
-	require.NoError(t, err)
+	return err
 }
 
 // extractFileFromZip finds a file by name inside a zip archive and writes it
-// into destDir using the file's base name. Fails the test if not found.
-func extractFileFromZip(t *testing.T, zipPath, fileName, destDir string) {
+// into destDir using the file's base name. Returns an error if not found.
+func extractFileFromZip(zipPath, fileName, destDir string) error {
 	r, err := zip.OpenReader(zipPath)
-	require.NoError(t, err)
+	if err != nil {
+		return err
+	}
 	defer r.Close()
 
 	targetBase := filepath.Base(fileName)
 	destPath := filepath.Join(destDir, targetBase)
-	var found bool
 	for _, f := range r.File {
 		if filepath.Base(f.Name) != targetBase {
 			continue
 		}
 		rc, err := f.Open()
-		require.NoError(t, err)
+		if err != nil {
+			return err
+		}
 		defer rc.Close()
 
 		out, err := os.OpenFile(destPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o755)
-		require.NoError(t, err)
+		if err != nil {
+			return err
+		}
 		_, err = io.Copy(out, rc)
 		_ = out.Close()
-		require.NoError(t, err)
-		found = true
-		break
+		return err
 	}
-	require.True(t, found, "file %s not found in archive %s", targetBase, zipPath)
+	return fmt.Errorf("file %s not found in archive %s", targetBase, zipPath)
 }
 
 func copyFile(src, dst string) error {
@@ -1187,7 +1657,7 @@ func formatOutput(w io.Writer, err error) {
 	if err == nil {
 		return
 	}
-	if exiterr, ok := err.(*exec.ExitError); ok {
+	if exiterr, ok := errors.AsType[*exec.ExitError](err); ok {
 		exitCode := exiterr.ExitCode()
 		fmt.Fprintf(w, "\nExit code: %d\n", exitCode)
 	} else {
@@ -1252,6 +1722,12 @@ func CopyDir(src, dst string, inputs, outputs map[string]bool) error {
 			return nil
 		}
 
+		// test.toml is harness config, not a bundle source; copying it into the test
+		// dir would upload it during "bundle deploy" and skew the synced file set.
+		if name == internal.ConfigFilename {
+			return nil
+		}
+
 		destPath := filepath.Join(dst, relPath)
 
 		if info.IsDir() {
@@ -1392,7 +1868,7 @@ func runWithLog(t *testing.T, cmd *exec.Cmd, out *os.File, tail bool, timeout ti
 				require.NoError(t, err)
 			}
 		}
-		if err == io.EOF {
+		if errors.Is(err, io.EOF) {
 			break
 		}
 		require.NoError(t, err)
@@ -1511,49 +1987,39 @@ func BuildYamlfmt(t *testing.T) {
 	RunCommand(t, []string{"go", "tool", "-modfile=tools/task/go.mod", "task", "build-yamlfmt"}, "..", []string{})
 }
 
-// setupTerraform installs terraform and configures environment variables for tests.
-func setupTerraform(t *testing.T, cwd, buildDir string, repls *testdiff.ReplacementsContext) {
-	RunCommand(t, []string{"python3", filepath.Join(cwd, "install_terraform.py"), "--targetdir", buildDir}, ".", []string{})
-
-	terraformrcPath := filepath.Join(buildDir, ".terraformrc")
-	terraformExecPath := filepath.Join(buildDir, "terraform") + exeSuffix
-
-	t.Setenv("TF_CLI_CONFIG_FILE", terraformrcPath)
-	t.Setenv("DATABRICKS_TF_CLI_CONFIG_FILE", terraformrcPath)
-	t.Setenv("DATABRICKS_TF_EXEC_PATH", terraformExecPath)
-	t.Setenv("TERRAFORM", terraformExecPath)
-
-	repls.SetPath(terraformrcPath, "[DATABRICKS_TF_CLI_CONFIG_FILE]")
-	repls.SetPath(terraformExecPath, "[TERRAFORM]")
-}
-
-func loadUserReplacements(t *testing.T, repls *testdiff.ReplacementsContext, tmpDir string) {
-	b, err := os.ReadFile(filepath.Join(tmpDir, userReplacementsFilename))
-	if errors.Is(err, fs.ErrNotExist) {
-		return
-	}
+// loadScriptReplacements adds the replacements appended to replsPath by the scripts.
+// The first offset lines were written by the harness itself and are already in repls.
+func loadScriptReplacements(t *testing.T, repls *testdiff.ReplacementsContext, replsPath string, offset int) {
+	b, err := os.ReadFile(replsPath)
 	require.NoError(t, err)
-	lines := strings.SplitSeq(string(b), "\n")
-	for line := range lines {
+	lines := strings.Split(string(b), "\n")
+	for _, line := range lines[min(offset, len(lines)):] {
 		line = strings.TrimSpace(line)
 		if len(line) == 0 {
 			continue
 		}
-		items := strings.Split(line, ":")
-		if len(items) <= 1 {
-			t.Errorf("Error parsing %s: %#v", userReplacementsFilename, line)
+		// Scripts only add literal replacements; regular expressions come from the harness.
+		var entry struct {
+			Literal string
+			New     string
+			Order   int
+		}
+		if err := json.Unmarshal([]byte(line), &entry); err != nil {
+			t.Errorf("Error parsing %s: %#v: %s", ReplsEnvVar, line, err)
+			continue
+		}
+		if entry.Literal == "" || entry.New == "" {
+			t.Errorf("Incomplete entry in %s: %#v", ReplsEnvVar, line)
 			continue
 		}
-		repl := items[len(items)-1]
-		old := line[:len(line)-len(repl)-1]
-		repls.SetWithOrder(old, "["+repl+"]", -100)
+		repls.SetWithOrder(entry.Literal, entry.New, entry.Order)
 	}
 }
 
 type pathFilter struct {
 	// contains substrings from the variants other than current.
-	// E.g. if EnvVaryOutput is DATABRICKS_BUNDLE_ENGINE and current test running DATABRICKS_BUNDLE_ENGINE="terraform" then
-	// notSelected contains ".direct." meaning if filename contains that (e.g. out.deploy.direct.txt) then we ignore it here.
+	// E.g. if EnvVaryOutput is MODE = ["a", "b"] and current test running MODE="a" then
+	// notSelected contains ".b." meaning if filename contains that (e.g. out.deploy.b.txt) then we ignore it here.
 	notSelected []string
 }
 
diff --git a/acceptance/bundle/paths/fallback/src/dbt_project/.gitkeep b/acceptance/air/.gitkeep
similarity index 100%
rename from acceptance/bundle/paths/fallback/src/dbt_project/.gitkeep
rename to acceptance/air/.gitkeep
diff --git a/acceptance/bundle/resources/vector_search_endpoints/drift/min_qps/test.toml b/acceptance/air/cancel/out.test.toml
similarity index 100%
rename from acceptance/bundle/resources/vector_search_endpoints/drift/min_qps/test.toml
rename to acceptance/air/cancel/out.test.toml
diff --git a/acceptance/air/cancel/output.txt b/acceptance/air/cancel/output.txt
new file mode 100644
index 00000000000..58a33d92bea
--- /dev/null
+++ b/acceptance/air/cancel/output.txt
@@ -0,0 +1,29 @@
+
+=== cancel by id (text)
+>>> [CLI] air cancel 123
+Successfully requested cancellation for run 123
+
+=== cancel by id (json)
+>>> [CLI] air cancel 123 -o json
+{
+  "v": 1,
+  "ts": "[TIMESTAMP]",
+  "data": {
+    "cancelled": [
+      "123"
+    ]
+  }
+}
+
+=== cancel multiple ids
+>>> [CLI] air cancel 123 456
+Successfully requested cancellation for run 123
+Successfully requested cancellation for run 456
+Successfully requested cancellation for 2 run(s).
+
+=== cancel --all
+>>> [CLI] air cancel --all -y
+Searching active runs for [USERNAME] in [DATABRICKS_URL]...
+Successfully requested cancellation for run 334747067049496
+Successfully requested cancellation for run 566001814929041
+Successfully requested cancellation for 2 run(s).
diff --git a/acceptance/air/cancel/script b/acceptance/air/cancel/script
new file mode 100644
index 00000000000..d121b4d8e3b
--- /dev/null
+++ b/acceptance/air/cancel/script
@@ -0,0 +1,11 @@
+title "cancel by id (text)"
+trace $CLI air cancel 123
+
+title "cancel by id (json)"
+trace $CLI air cancel 123 -o json
+
+title "cancel multiple ids"
+trace $CLI air cancel 123 456
+
+title "cancel --all"
+trace $CLI air cancel --all -y
diff --git a/acceptance/air/cancel/test.toml b/acceptance/air/cancel/test.toml
new file mode 100644
index 00000000000..14a54ccb754
--- /dev/null
+++ b/acceptance/air/cancel/test.toml
@@ -0,0 +1,49 @@
+# The SDK occasionally probes host reachability with a HEAD request; stub it so
+# the test is deterministic.
+[[Server]]
+Pattern = "HEAD /"
+Response.Body = ''
+
+# CancelRun accepts the request and returns an empty body.
+[[Server]]
+Pattern = "POST /api/2.2/jobs/runs/cancel"
+Response.Body = '{}'
+
+# Jobs runs/list backs `cancel --all`: two active AIR runs for the current user
+# (tester@databricks.com, from the built-in scim/v2/Me handler).
+[[Server]]
+Pattern = "GET /api/2.2/jobs/runs/list"
+Response.Body = '''
+{
+  "runs": [
+    {
+      "run_id": 334747067049496,
+      "run_name": "qwen-train",
+      "creator_user_name": "tester@databricks.com",
+      "start_time": 1717608759000,
+      "state": {"life_cycle_state": "RUNNING"},
+      "tasks": [{
+        "run_id": 334747067049497,
+        "ai_runtime_task": {
+          "experiment": "/Users/tester@databricks.com/qwen-train",
+          "deployments": [{"compute": {"accelerator_type": "GPU_1xA10", "accelerator_count": 1}}]
+        }
+      }]
+    },
+    {
+      "run_id": 566001814929041,
+      "run_name": "llama-train",
+      "creator_user_name": "tester@databricks.com",
+      "start_time": 1717612404000,
+      "state": {"life_cycle_state": "RUNNING"},
+      "tasks": [{
+        "run_id": 566001814929042,
+        "ai_runtime_task": {
+          "experiment": "/Users/tester@databricks.com/llama-train",
+          "deployments": [{"compute": {"accelerator_type": "GPU_1xA10", "accelerator_count": 1}}]
+        }
+      }]
+    }
+  ]
+}
+'''
diff --git a/acceptance/air/config-help/out.test.toml b/acceptance/air/config-help/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/air/config-help/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/air/config-help/output.txt b/acceptance/air/config-help/output.txt
new file mode 100644
index 00000000000..f73f9618530
--- /dev/null
+++ b/acceptance/air/config-help/output.txt
@@ -0,0 +1,174 @@
+
+=== command help
+>>> [CLI] air run --help
+Submit a training workload to Databricks serverless GPU compute.
+
+The workload is described by a YAML config file (see --file).
+
+To look up a config field, pass its path to -h:
+
+  databricks air run -h config
+  databricks air run -h config.compute
+  databricks air run -h config.compute.accelerator_type
+
+The path must be a separate argument: cobra reserves -h as a boolean, so
+-h=config.compute and -hconfig.compute are not accepted.
+
+Usage:
+  databricks air run [flags]
+
+Flags:
+      --dry-run                  Validate the config against the workspace without submitting a run
+  -f, --file string              Path to the workload YAML config
+  -h, --help                     help for run
+      --idempotency-key string   Return the existing run if this key was already used
+      --override stringArray     Override a YAML field, e.g. compute.num_accelerators=8 (repeatable)
+      --watch                    Stream logs until the run completes
+
+Global Flags:
+      --debug            enable debug logging
+  -o, --output type      output type: text or json (default text)
+  -p, --profile string   ~/.databrickscfg profile
+  -t, --target string    bundle target to use (if applicable)
+
+=== schema overview
+>>> [CLI] air run -h config
+config
+  The run YAML schema. Pass a field path for details, e.g. config.compute.accelerator_type.
+
+  AI coding agents can use the databricks-ai-runtime skill to write workload
+  YAML, submit runs, and monitor progress.
+
+  Install the skill locally for your coding agent:
+
+    databricks aitools install --skills-only --skills databricks-ai-runtime --experimental
+
+  Follow the prompts to choose your coding agent and installation scope.
+  Use --scope project to install into the current project.
+  See: https://github.com/databricks/databricks-agent-skills/tree/main/experimental/databricks-ai-runtime
+
+  Fields:
+    experiment_name              (required) Name of the experiment.
+    compute                      (required) Which accelerators to run on and how many.
+    environment                  Python dependencies, runtime version, or a Unity Catalog image for a single-command run.
+    command                      Shell command that starts the workload.
+    containers                   Rank-partitioned containers for heterogeneous workloads.
+    env_variables                Plain environment variables, as NAME: value.
+    secrets                      Environment variables sourced from secrets, as NAME: scope/key.
+    code_source                  Local code to upload and make available to the run.
+    max_retries                  How many times to retry a failed run.
+    timeout_minutes              Wall-clock limit for the run in minutes.
+    idempotency_token            Reuse token: a repeat submission with the same token returns the existing run instead of starting another.
+    parameters                   Free-form values passed through to the workload.
+    mlflow_run_name              Name for the MLflow run.
+    mlflow_experiment_directory  Workspace directory holding the MLflow experiment.
+    mlflow_artifact_location     DBFS location where MLflow artifacts are written.
+    permissions                  Who may view or manage the run, as a list of principal plus level grants.
+    usage_policy_name            Usage policy to bill the run to, by name.
+    usage_policy_id              Usage policy to bill the run to, by id.
+
+Use "-h config.<field>" for details on a field.
+
+=== nested object lists its fields
+>>> [CLI] air run -h config.compute
+config.compute
+  Which accelerators to run on and how many.
+
+  Fields:
+    num_accelerators  Total number of GPUs to allocate.
+    accelerator_type  Which accelerator to run on, e.g. GPU_1xA10.
+    pool_id           GPU pool to run on, by id.
+    priority_class    Scheduling priority within the pool: BEST_EFFORT (lowest, preemptable), NORMAL, or CRITICAL (highest).
+
+Use "-h config.compute.<field>" for details on a field.
+
+=== new submission fields are documented
+>>> [CLI] air run -h config.mlflow_artifact_location
+config.mlflow_artifact_location
+  DBFS location where MLflow artifacts are written. A /Volumes path is normalized to dbfs:/Volumes/... .
+
+  Type:     string
+  Required: no
+
+>>> [CLI] air run -h config.compute.pool_id
+config.compute.pool_id
+  GPU pool to run on, by id. A GPU pool is a pre-provisioned accelerator reservation; contact your Databricks account team to provision one. Must be 1-255 characters. List available pools with 'air pools list'.
+
+  Type:     string
+  Required: no
+
+>>> [CLI] air run -h config.compute.priority_class
+config.compute.priority_class
+  Scheduling priority within the pool: BEST_EFFORT (lowest, preemptable), NORMAL, or CRITICAL (highest). Requires pool_id.
+
+  Type:     string
+  Required: no
+
+>>> [CLI] air run -h config.environment.dependencies
+config.environment.dependencies
+  Inline list of packages to install. Not allowed alongside unity_catalog_image.
+
+  Type:     list of strings
+  Required: no
+
+>>> [CLI] air run -h config.environment.version
+config.environment.version
+  Client image version to pin (default: 6). See environment version release notes: https://docs.databricks.com/aws/en/release-notes/serverless/environment-version/
+
+  Type:     string or int
+  Required: no
+
+=== leaf field
+>>> [CLI] air run -h config.compute.accelerator_type
+config.compute.accelerator_type
+  Which accelerator to run on, e.g. GPU_1xA10. See https://docs.databricks.com/aws/en/machine-learning/ai-runtime/cli/yaml-config#reference for the current list of supported GPU types. Matched case-sensitively.
+
+  Type:     string
+  Required: no
+
+=== code source fields
+>>> [CLI] air run -h config.code_source
+config.code_source
+  Local code to upload and make available to the run.
+
+  Fields:
+    root_path      Root of the code source to archive.
+    remote_volume  Volume to upload the archive to.
+    git            Pin the snapshot to a specific git revision.
+    include_paths  Restrict the archive to these paths, relative to root_path and without "..".
+
+Use "-h config.code_source.<field>" for details on a field.
+
+=== union field
+>>> [CLI] air run -h config.code_source.git.remote
+config.code_source.git.remote
+  No longer supported: the snapshot archives your local copy. Only false is accepted; use commit to pin a revision.
+
+  Type:     bool or string
+  Required: no
+
+=== git-pinned subdirectory documents root_path scoping
+>>> [CLI] air run -h config.code_source.root_path
+config.code_source.root_path
+  Root of the code source to archive. A git-pinned subdirectory packages only that subtree.
+
+  Type:     string
+  Required: when code_source is set
+
+=== the config. prefix is optional
+>>> [CLI] air run -h compute.num_accelerators
+config.compute.num_accelerators
+  Total number of GPUs to allocate. Must be a positive multiple of the accelerator type's per-node GPU count. See https://docs.databricks.com/aws/en/machine-learning/ai-runtime/cli/yaml-config#reference for supported GPU types.
+
+  Type:     int
+  Required: no
+
+=== unknown field suggests the near match
+>>> [CLI] air run -h config.compute.acclerator_type
+Error: unknown config field "config.compute.acclerator_type"; did you mean "accelerator_type"?
+
+fields under "config.compute" are: accelerator_type, num_accelerators, pool_id, priority_class
+
+=== free-form map keys are not schema fields
+>>> [CLI] air run -h config.parameters.learning_rate
+Error: "config.parameters" holds user-defined keys, so "learning_rate" is not part of the schema; see "config.parameters" instead
diff --git a/acceptance/air/config-help/script b/acceptance/air/config-help/script
new file mode 100644
index 00000000000..4f76006eeec
--- /dev/null
+++ b/acceptance/air/config-help/script
@@ -0,0 +1,41 @@
+# Pin the rendered config field help. Any change to a `help:` struct tag on the
+# run YAML schema shows up as a diff here.
+
+# Plain -h must keep documenting the command itself, and advertise the config
+# path syntax so the feature is discoverable.
+title "command help"
+trace $CLI air run --help
+
+title "schema overview"
+trace $CLI air run -h config
+
+title "nested object lists its fields"
+trace $CLI air run -h config.compute
+
+title "new submission fields are documented"
+trace $CLI air run -h config.mlflow_artifact_location
+trace $CLI air run -h config.compute.pool_id
+trace $CLI air run -h config.compute.priority_class
+trace $CLI air run -h config.environment.dependencies
+trace $CLI air run -h config.environment.version
+
+title "leaf field"
+trace $CLI air run -h config.compute.accelerator_type
+
+title "code source fields"
+trace $CLI air run -h config.code_source
+
+title "union field"
+trace $CLI air run -h config.code_source.git.remote
+
+title "git-pinned subdirectory documents root_path scoping"
+trace $CLI air run -h config.code_source.root_path
+
+title "the config. prefix is optional"
+trace $CLI air run -h compute.num_accelerators
+
+title "unknown field suggests the near match"
+trace $CLI air run -h config.compute.acclerator_type
+
+title "free-form map keys are not schema fields"
+trace $CLI air run -h config.parameters.learning_rate
diff --git a/acceptance/air/convert-to-dabs/b300.yaml b/acceptance/air/convert-to-dabs/b300.yaml
new file mode 100644
index 00000000000..7a91f98c757
--- /dev/null
+++ b/acceptance/air/convert-to-dabs/b300.yaml
@@ -0,0 +1,8 @@
+experiment_name: b300-smoke-test
+command: nvidia-smi
+compute:
+  accelerator_type: GPU_8xB300
+  num_accelerators: 8
+environment:
+  version: 6
+  dependencies: []
diff --git a/acceptance/air/convert-to-dabs/databricks-ai.yaml b/acceptance/air/convert-to-dabs/databricks-ai.yaml
new file mode 100644
index 00000000000..f42bed8a6ce
--- /dev/null
+++ b/acceptance/air/convert-to-dabs/databricks-ai.yaml
@@ -0,0 +1,7 @@
+experiment_name: databricks-ai-v5-smoke-test
+command: python train.py
+compute:
+  accelerator_type: GPU_1xA10
+  num_accelerators: 1
+environment:
+  version: databricks_ai_v5
diff --git a/acceptance/air/convert-to-dabs/out.test.toml b/acceptance/air/convert-to-dabs/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/air/convert-to-dabs/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/air/convert-to-dabs/output.txt b/acceptance/air/convert-to-dabs/output.txt
new file mode 100644
index 00000000000..a37e97d3c3f
--- /dev/null
+++ b/acceptance/air/convert-to-dabs/output.txt
@@ -0,0 +1,202 @@
+
+=== convert an AIR run YAML into a DABs bundle (in place, next to the source)
+>>> [CLI] air convert-to-dabs train.yaml
+Wrote a Databricks Asset Bundle to .:
+  databricks.yml
+  generated_artifacts/training_config.yaml
+  generated_artifacts/command.sh
+
+To deploy and run this workload as a bundle:
+  1. [CLI] bundle validate
+  2. [CLI] bundle deploy
+  3. [CLI] bundle run torchrun-a10-smoke-test --no-wait
+
+bundle deploy uploads the code source and launch scripts automatically.
+To see what it deployed and where: [CLI] bundle summary
+
+Unlike `air run` (which submits an ephemeral run), bundle deploy creates a
+persistent job that is not garbage-collected. When you are done, remove the
+job and its uploaded files with:
+  [CLI] bundle destroy
+
+=== emitted databricks.yml (code_source packaged as a tgz artifact; no code is copied)
+>>> cat databricks.yml
+bundle:
+  name: torchrun-a10-smoke-test
+sync:
+  paths:
+    - generated_artifacts
+artifacts:
+  code_source:
+    type: tgz
+    path: .
+    include:
+      - src
+    files:
+      - source: ./dist/code_source.tgz
+targets:
+  dev:
+    mode: development
+    default: true
+resources:
+  jobs:
+    torchrun-a10-smoke-test:
+      name: torchrun-a10-smoke-test
+      tasks:
+        - task_key: torchrun-a10-smoke-test
+          environment_key: default
+          max_retries: 3
+          retry_on_timeout: true
+          ai_runtime_task:
+            experiment: torchrun-a10-smoke-test
+            deployments:
+              - command_path: ./generated_artifacts/command.sh
+                compute:
+                  accelerator_type: GPU_1xA10
+                  accelerator_count: 1
+                  provisioned_capacity_id: capacity-1
+            code_source_path: ./dist/code_source.tgz
+            mlflow_artifact_location: dbfs:/Volumes/main/default/artifacts
+            priority_class: CRITICAL
+            unity_catalog_image_path: main.air.training:prod
+      environments:
+        - environment_key: default
+          spec:
+            environment_version: "6"
+
+=== the generated command.sh carries the run command
+>>> cat generated_artifacts/command.sh
+cd $CODE_SOURCE_PATH
+torchrun --nproc_per_node=1 train.py
+
+=== the emitted bundle validates
+>>> [CLI] bundle validate
+Name: torchrun-a10-smoke-test
+Target: dev
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/torchrun-a10-smoke-test/dev
+
+Validation OK!
+
+=== re-converting refuses to clobber the generated bundle
+>>> [CLI] air convert-to-dabs train.yaml
+Error: databricks.yml already exists in .; pass --force to overwrite or remove it
+
+Exit code: 1
+
+=== --force overwrites it
+>>> [CLI] air convert-to-dabs train.yaml --force
+Wrote a Databricks Asset Bundle to .:
+  databricks.yml
+  generated_artifacts/training_config.yaml
+  generated_artifacts/command.sh
+
+To deploy and run this workload as a bundle:
+  1. [CLI] bundle validate
+  2. [CLI] bundle deploy
+  3. [CLI] bundle run torchrun-a10-smoke-test --no-wait
+
+bundle deploy uploads the code source and launch scripts automatically.
+To see what it deployed and where: [CLI] bundle summary
+
+Unlike `air run` (which submits an ephemeral run), bundle deploy creates a
+persistent job that is not garbage-collected. When you are done, remove the
+job and its uploaded files with:
+  [CLI] bundle destroy
+
+=== convert a B300 run using the current SDK
+>>> [CLI] air convert-to-dabs b300.yaml --output-dir generated-b300
+Wrote a Databricks Asset Bundle to generated-b300:
+  databricks.yml
+  generated_artifacts/training_config.yaml
+  generated_artifacts/command.sh
+
+To deploy and run this workload as a bundle:
+  1. cd generated-b300
+  2. [CLI] bundle validate
+  3. [CLI] bundle deploy
+  4. [CLI] bundle run b300-smoke-test --no-wait
+
+bundle deploy uploads the code source and launch scripts automatically.
+To see what it deployed and where: [CLI] bundle summary
+
+Unlike `air run` (which submits an ephemeral run), bundle deploy creates a
+persistent job that is not garbage-collected. When you are done, remove the
+job and its uploaded files with:
+  [CLI] bundle destroy
+
+=== the B300 bundle preserves its accelerator and AI Runtime version
+>>> cat generated-b300/databricks.yml
+bundle:
+  name: b300-smoke-test
+sync:
+  paths:
+    - generated_artifacts
+targets:
+  dev:
+    mode: development
+    default: true
+resources:
+  jobs:
+    b300-smoke-test:
+      name: b300-smoke-test
+      tasks:
+        - task_key: b300-smoke-test
+          environment_key: default
+          max_retries: 3
+          retry_on_timeout: true
+          ai_runtime_task:
+            experiment: b300-smoke-test
+            deployments:
+              - command_path: ./generated_artifacts/command.sh
+                compute:
+                  accelerator_type: GPU_8xB300
+                  accelerator_count: 8
+      environments:
+        - environment_key: default
+          spec:
+            environment_version: "6"
+
+=== the current SDK recognizes B300 so bundle validation is clean
+>>> [CLI] bundle validate
+Name: b300-smoke-test
+Target: dev
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/b300-smoke-test/dev
+
+Validation OK!
+
+=== databricks_ai versions use a base environment
+>>> [CLI] air convert-to-dabs databricks-ai.yaml --force
+Wrote a Databricks Asset Bundle to .:
+  databricks.yml
+  generated_artifacts/training_config.yaml
+  generated_artifacts/command.sh
+
+To deploy and run this workload as a bundle:
+  1. [CLI] bundle validate
+  2. [CLI] bundle deploy
+  3. [CLI] bundle run databricks-ai-v5-smoke-test --no-wait
+
+bundle deploy uploads the code source and launch scripts automatically.
+To see what it deployed and where: [CLI] bundle summary
+
+Unlike `air run` (which submits an ephemeral run), bundle deploy creates a
+persistent job that is not garbage-collected. When you are done, remove the
+job and its uploaded files with:
+  [CLI] bundle destroy
+
+>>> grep -E environment_version|base_environment databricks.yml
+            base_environment: workspace-base-environments/databricks_ai_v5
+
+=== the Databricks AI bundle validates
+>>> [CLI] bundle validate
+Name: databricks-ai-v5-smoke-test
+Target: dev
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/databricks-ai-v5-smoke-test/dev
+
+Validation OK!
diff --git a/acceptance/air/convert-to-dabs/script b/acceptance/air/convert-to-dabs/script
new file mode 100644
index 00000000000..5dea9e8ae3b
--- /dev/null
+++ b/acceptance/air/convert-to-dabs/script
@@ -0,0 +1,33 @@
+title "convert an AIR run YAML into a DABs bundle (in place, next to the source)"
+trace $CLI air convert-to-dabs train.yaml
+
+title "emitted databricks.yml (code_source packaged as a tgz artifact; no code is copied)"
+trace cat databricks.yml
+
+title "the generated command.sh carries the run command"
+trace cat generated_artifacts/command.sh
+
+title "the emitted bundle validates"
+trace $CLI bundle validate
+
+title "re-converting refuses to clobber the generated bundle"
+errcode trace $CLI air convert-to-dabs train.yaml
+
+title "--force overwrites it"
+trace $CLI air convert-to-dabs train.yaml --force
+
+title "convert a B300 run using the current SDK"
+trace $CLI air convert-to-dabs b300.yaml --output-dir generated-b300
+
+title "the B300 bundle preserves its accelerator and AI Runtime version"
+trace cat generated-b300/databricks.yml
+
+title "the current SDK recognizes B300 so bundle validation is clean"
+(cd generated-b300 && trace $CLI bundle validate)
+
+title "databricks_ai versions use a base environment"
+trace $CLI air convert-to-dabs databricks-ai.yaml --force
+trace grep -E 'environment_version|base_environment' databricks.yml
+
+title "the Databricks AI bundle validates"
+trace $CLI bundle validate
diff --git a/acceptance/air/convert-to-dabs/src/train.py b/acceptance/air/convert-to-dabs/src/train.py
new file mode 100644
index 00000000000..c859094afdf
--- /dev/null
+++ b/acceptance/air/convert-to-dabs/src/train.py
@@ -0,0 +1 @@
+print("train")
diff --git a/acceptance/air/convert-to-dabs/test.toml b/acceptance/air/convert-to-dabs/test.toml
new file mode 100644
index 00000000000..956c8efc16e
--- /dev/null
+++ b/acceptance/air/convert-to-dabs/test.toml
@@ -0,0 +1,3 @@
+# convert-to-dabs writes the bundle in place (next to train.yaml + src/). These are
+# generated artifacts, not committed inputs, so exclude them from the repo-diff check.
+Ignore = ["databricks.yml", "generated_artifacts", "generated-b300", "generated-docker"]
diff --git a/acceptance/air/convert-to-dabs/train.yaml b/acceptance/air/convert-to-dabs/train.yaml
new file mode 100644
index 00000000000..fd0ba90f1e5
--- /dev/null
+++ b/acceptance/air/convert-to-dabs/train.yaml
@@ -0,0 +1,16 @@
+experiment_name: torchrun-a10-smoke-test
+command: |
+  cd $CODE_SOURCE_PATH
+  torchrun --nproc_per_node=1 train.py
+compute:
+  accelerator_type: GPU_1xA10
+  num_accelerators: 1
+  pool_id: capacity-1
+  priority_class: CRITICAL
+mlflow_artifact_location: dbfs:/Volumes/main/default/artifacts
+environment:
+  unity_catalog_image: main.air.training:prod
+code_source:
+  type: snapshot
+  snapshot:
+    root_path: ./src
diff --git a/acceptance/air/get-ai-runtime/out.test.toml b/acceptance/air/get-ai-runtime/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/air/get-ai-runtime/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/air/get-ai-runtime/output.txt b/acceptance/air/get-ai-runtime/output.txt
new file mode 100644
index 00000000000..096b127a6f1
--- /dev/null
+++ b/acceptance/air/get-ai-runtime/output.txt
@@ -0,0 +1,54 @@
+
+=== get (text)
+>>> [CLI] air get 123
+
+╭─ Configuration ────────────────────────────────────────────────╮
+│                                                                │
+│  experiment_name: my-exp                                       │
+│  compute:                                                      │
+│    accelerator_type: a10                                       │
+│    num_accelerators: 1                                         │
+│  command: |-                                                   │
+│    for i in $(seq 1 10); do                                    │
+│      echo "step $i"                                            │
+│    done                                                        │
+│                                                                │
+╰────────────────────────────────────────────────────────────────╯
+
+╭─ Metadata ─────────────────────────────────────────────────────╮
+│                                                                │
+│  Run ID        123                                             │
+│  Status        ● SUCCESS                                       │
+│  Submitted     2023-11-14 22:13 UTC                            │
+│  Retries       0                                               │
+│  Max Retries   3                                               │
+│  Duration      12s                                             │
+│  Experiment    my-exp                                          │
+│  MLflow Run    my-run                                          │
+│  User          user@example.com                                │
+│  Accelerators  1x A10                                          │
+│  Environment   4                                               │
+│                                                                │
+╰────────────────────────────────────────────────────────────────╯
+
+Run URL:    [DATABRICKS_URL]/jobs/runs/123?o=[WORKSPACE_ID]
+MLflow URL: [DATABRICKS_URL]/ml/experiments/exp1/runs/run1
+
+=== get (json)
+>>> [CLI] air get 123 -o json
+{
+  "v": 1,
+  "ts": "[TIMESTAMP]",
+  "data": {
+    "run_id": "123",
+    "status": "SUCCESS",
+    "started_at": "[TIMESTAMP]",
+    "duration_seconds": 12,
+    "attempt_number": 0,
+    "experiment_name": "my-exp",
+    "dashboard_url": "[DATABRICKS_URL]/jobs/runs/123?o=[WORKSPACE_ID]",
+    "mlflow_url": "[DATABRICKS_URL]/ml/experiments/exp1/runs/run1/artifacts/logs/node_0",
+    "est_remaining_seconds": null,
+    "est_percent_complete": null
+  }
+}
diff --git a/acceptance/air/get-ai-runtime/script b/acceptance/air/get-ai-runtime/script
new file mode 100644
index 00000000000..7a98ebac655
--- /dev/null
+++ b/acceptance/air/get-ai-runtime/script
@@ -0,0 +1,11 @@
+# Seed the run's training_config.yaml next to command.sh so `air get` can
+# download and render it in the Configuration box. The import API does not
+# create missing parents, so mkdirs the containing folder first.
+$CLI workspace mkdirs "/Workspace/Users/user@example.com/.air/cli_launch/my-exp/my-exp_abc" &> LOG.mkdirs
+$CLI workspace import "/Workspace/Users/user@example.com/.air/cli_launch/my-exp/my-exp_abc/training_config.yaml" --file training_config.yaml --format AUTO &> LOG.import
+
+title "get (text)"
+trace $CLI air get 123
+
+title "get (json)"
+trace $CLI air get 123 -o json
diff --git a/acceptance/air/get-ai-runtime/test.toml b/acceptance/air/get-ai-runtime/test.toml
new file mode 100644
index 00000000000..5aa909e6e1b
--- /dev/null
+++ b/acceptance/air/get-ai-runtime/test.toml
@@ -0,0 +1,61 @@
+# On Windows, Git Bash rewrites the leading-/ workspace paths passed to
+# `workspace mkdirs`/`import` into C:/... paths; disable that conversion.
+Env.MSYS_NO_PATHCONV = "1"
+# The SDK occasionally probes host reachability with a HEAD request; stub it so
+# the test is deterministic.
+
+[[Server]]
+Pattern = "HEAD /"
+Response.Body = ''
+
+# The GetRun response for an ai_runtime_task run. It has no gen_ai_compute_task,
+# so the Environment cell instead comes from the run's environments[].spec (keyed
+# by the task's environment_key), which the typed SDK Run drops — `air get` reads
+# it with a raw request, so this route is hit twice (typed GetRun + that request).
+[[Server]]
+Pattern = "GET /api/2.2/jobs/runs/get"
+Response.Body = '''
+{
+  "run_id": 123,
+  "run_page_url": "https://my-workspace.cloud.databricks.test/jobs/runs/123",
+  "creator_user_name": "user@example.com",
+  "start_time": 1700000000000,
+  "end_time": 1700000012000,
+  "state": {"life_cycle_state": "TERMINATED", "result_state": "SUCCESS"},
+  "environments": [
+    {"environment_key": "default", "spec": {"environment_version": "4"}}
+  ],
+  "tasks": [
+    {
+      "task_key": "train",
+      "run_id": 456,
+      "attempt_number": 0,
+      "max_retries": 3,
+      "environment_key": "default",
+      "ai_runtime_task": {
+        "experiment": "my-exp",
+        "deployments": [
+          {
+            "command_path": "/Workspace/Users/user@example.com/.air/cli_launch/my-exp/my-exp_abc/command.sh",
+            "compute": {"accelerator_type": "GPU_1xA10", "accelerator_count": 1}
+          }
+        ]
+      }
+    }
+  ]
+}
+'''
+
+# MLflow identifiers for the deep-link, under ai_runtime_task_output.
+[[Server]]
+Pattern = "GET /api/2.2/jobs/runs/get-output"
+Response.Body = '''
+{"ai_runtime_task_output": {"mlflow_experiment_id": "exp1", "mlflow_run_id": "run1"}}
+'''
+
+# The MLflow Run cell shows the run's name, fetched from the MLflow REST API.
+[[Server]]
+Pattern = "GET /api/2.0/mlflow/runs/get"
+Response.Body = '''
+{"run": {"info": {"run_name": "my-run"}}}
+'''
diff --git a/acceptance/air/get-ai-runtime/training_config.yaml b/acceptance/air/get-ai-runtime/training_config.yaml
new file mode 100644
index 00000000000..5f6060ecbbc
--- /dev/null
+++ b/acceptance/air/get-ai-runtime/training_config.yaml
@@ -0,0 +1,8 @@
+experiment_name: my-exp
+compute:
+  accelerator_type: a10
+  num_accelerators: 1
+command: |-
+  for i in $(seq 1 10); do
+    echo "step $i"
+  done
diff --git a/acceptance/air/get/out.test.toml b/acceptance/air/get/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/air/get/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/air/get/output.txt b/acceptance/air/get/output.txt
new file mode 100644
index 00000000000..2a2809cf255
--- /dev/null
+++ b/acceptance/air/get/output.txt
@@ -0,0 +1,75 @@
+
+=== get (text)
+>>> [CLI] air get 123
+
+╭─ Configuration ────────────────────────────────────────────────╮
+│                                                                │
+│  experiment_name: my-exp                                       │
+│  compute:                                                      │
+│    accelerator_type: a10                                       │
+│    num_accelerators: 1                                         │
+│  command: |                                                    │
+│    for i in $(seq 1 10); do                                    │
+│      echo "step $i"                                            │
+│    done                                                        │
+│                                                                │
+╰────────────────────────────────────────────────────────────────╯
+
+╭─ Metadata ─────────────────────────────────────────────────────╮
+│                                                                │
+│  Run ID        123                                             │
+│  Status        ● SUCCESS                                       │
+│  Submitted     2023-11-14 22:13 UTC                            │
+│  Retries       0                                               │
+│  Max Retries   3                                               │
+│  Duration      12s                                             │
+│  Experiment    my-exp                                          │
+│  MLflow Run    my-run                                          │
+│  User          user@example.com                                │
+│  Accelerators  1x A10                                          │
+│  Environment   N/A                                             │
+│                                                                │
+╰────────────────────────────────────────────────────────────────╯
+
+Run URL:    [DATABRICKS_URL]/jobs/runs/123?o=[WORKSPACE_ID]
+MLflow URL: [DATABRICKS_URL]/ml/experiments/exp1/runs/run1
+
+=== get (json)
+>>> [CLI] air get 123 -o json
+{
+  "v": 1,
+  "ts": "[TIMESTAMP]",
+  "data": {
+    "run_id": "123",
+    "status": "SUCCESS",
+    "started_at": "[TIMESTAMP]",
+    "duration_seconds": 12,
+    "attempt_number": 0,
+    "experiment_name": "my-exp",
+    "dashboard_url": "[DATABRICKS_URL]/jobs/runs/123?o=[WORKSPACE_ID]",
+    "mlflow_url": "[DATABRICKS_URL]/ml/experiments/exp1/runs/run1/artifacts/logs/node_0",
+    "est_remaining_seconds": null,
+    "est_percent_complete": null
+  }
+}
+
+=== invalid run id
+>>> [CLI] air get notanumber
+Error: invalid JOB_RUN_ID "notanumber": must be a positive integer
+
+Exit code: 1
+
+=== invalid run id (json)
+>>> [CLI] air get notanumber -o json
+{
+  "v": 1,
+  "ts": "[TIMESTAMP]",
+  "error": {
+    "code": "INVALID_ARGS",
+    "kind": "PERMANENT",
+    "message": "invalid JOB_RUN_ID \"notanumber\": must be a positive integer",
+    "retryable": false
+  }
+}
+
+Exit code: 1
diff --git a/acceptance/air/get/script b/acceptance/air/get/script
new file mode 100644
index 00000000000..40910baa7fa
--- /dev/null
+++ b/acceptance/air/get/script
@@ -0,0 +1,11 @@
+title "get (text)"
+trace $CLI air get 123
+
+title "get (json)"
+trace $CLI air get 123 -o json
+
+title "invalid run id"
+errcode trace $CLI air get notanumber
+
+title "invalid run id (json)"
+errcode trace $CLI air get notanumber -o json
diff --git a/acceptance/air/get/test.toml b/acceptance/air/get/test.toml
new file mode 100644
index 00000000000..3545a34616e
--- /dev/null
+++ b/acceptance/air/get/test.toml
@@ -0,0 +1,47 @@
+# The SDK occasionally probes host reachability with a HEAD request; stub it so
+# the test is deterministic.
+[[Server]]
+Pattern = "HEAD /"
+Response.Body = ''
+
+# A single GenAI-compute run with an experiment, GPUs, and a creator.
+[[Server]]
+Pattern = "GET /api/2.2/jobs/runs/get"
+Response.Body = '''
+{
+  "run_id": 123,
+  "run_page_url": "https://my-workspace.cloud.databricks.test/jobs/runs/123",
+  "creator_user_name": "user@example.com",
+  "start_time": 1700000000000,
+  "end_time": 1700000012000,
+  "state": {"life_cycle_state": "TERMINATED", "result_state": "SUCCESS"},
+  "tasks": [
+    {
+      "task_key": "train",
+      "run_id": 456,
+      "attempt_number": 0,
+      "max_retries": 3,
+      "gen_ai_compute_task": {
+        "mlflow_experiment_name": "/Users/user@example.com/my-exp",
+        "compute": {"gpu_type": "GPU_1xA10", "num_gpus": 1},
+        "dl_runtime_image": "ml-runtime-gpu:1.0",
+        "yaml_parameters": "experiment_name: my-exp\ncompute:\n  accelerator_type: a10\n  num_accelerators: 1\ncommand: |\n  for i in $(seq 1 10); do\n    echo \"step $i\"\n  done\n"
+      }
+    }
+  ]
+}
+'''
+
+# MLflow identifiers for the deep-link, under ai_runtime_task_output.
+[[Server]]
+Pattern = "GET /api/2.2/jobs/runs/get-output"
+Response.Body = '''
+{"ai_runtime_task_output": {"mlflow_experiment_id": "exp1", "mlflow_run_id": "run1"}}
+'''
+
+# The MLflow Run cell shows the run's name, fetched from the MLflow REST API.
+[[Server]]
+Pattern = "GET /api/2.0/mlflow/runs/get"
+Response.Body = '''
+{"run": {"info": {"run_name": "my-run"}}}
+'''
diff --git a/acceptance/air/help/out.test.toml b/acceptance/air/help/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/air/help/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/air/help/output.txt b/acceptance/air/help/output.txt
new file mode 100644
index 00000000000..d95166bf83d
--- /dev/null
+++ b/acceptance/air/help/output.txt
@@ -0,0 +1,208 @@
+
+=== help
+>>> [CLI] air --help
+Run and manage AI Runtime training workloads on Databricks serverless GPU compute.
+
+These commands are under active development.
+
+Usage:
+  databricks air [command]
+
+Available Commands:
+  cancel          Cancel one or more runs
+  convert-to-dabs Convert an AIR run YAML into a Databricks Asset Bundle
+  get             Show status, configuration, and timing details for a specified run
+  images          Manage container images for AI Runtime
+  list            List active runs for the current user
+  logs            Stream or fetch logs for a run
+  pools           View provisioned GPU pools
+  run             Submit a training workload from a YAML config
+
+Flags:
+  -h, --help   help for air
+
+Global Flags:
+      --debug            enable debug logging
+  -o, --output type      output type: text or json (default text)
+  -p, --profile string   ~/.databrickscfg profile
+  -t, --target string    bundle target to use (if applicable)
+
+Use "databricks air [command] --help" for more information about a command.
+
+=== list help
+>>> [CLI] air list --help
+List active runs for the current user.
+
+Filters:
+  Use --filter KEY=VALUE per condition. A run must match every condition.
+
+  accelerator_type  Accelerator type, such as A10 or H100.
+  experiment        Case-insensitive glob matched against the experiment name.
+  num_accelerators  Total GPU count.
+  user              Run creator identifier.
+
+Usage:
+  databricks air list [flags]
+
+Examples:
+  databricks air list --filter accelerator_type=H100
+
+  databricks air list --all-status \
+    --filter 'experiment=qwen*' \
+    --filter num_accelerators=8 \
+    --filter user=person@example.com
+
+Flags:
+      --all-status           Show runs in all states (default: active only)
+      --all-users            Show runs from all users
+      --filter stringArray   Filter runs by KEY=VALUE (repeatable)
+  -h, --help                 help for list
+      --limit int            Maximum number of runs to show (default 20)
+
+Global Flags:
+      --debug            enable debug logging
+  -o, --output type      output type: text or json (default text)
+  -p, --profile string   ~/.databrickscfg profile
+  -t, --target string    bundle target to use (if applicable)
+
+=== get help
+>>> [CLI] air get --help
+Show status, configuration, and timing details for a specified run.
+
+JOB_RUN_ID is the job run ID returned by "air run".
+
+Usage:
+  databricks air get JOB_RUN_ID [flags]
+
+Flags:
+  -h, --help   help for get
+
+Global Flags:
+      --debug            enable debug logging
+  -o, --output type      output type: text or json (default text)
+  -p, --profile string   ~/.databrickscfg profile
+  -t, --target string    bundle target to use (if applicable)
+
+=== pools help
+>>> [CLI] air pools --help
+View provisioned GPU pools
+
+Usage:
+  databricks air pools [flags]
+  databricks air pools [command]
+
+Available Commands:
+  get         Show a GPU pool, including its accelerator usage (POOL_ID may be omitted when the workspace has exactly one pool)
+  list        List the GPU pools available to the current workspace
+
+Flags:
+  -h, --help   help for pools
+
+Global Flags:
+      --debug            enable debug logging
+  -o, --output type      output type: text or json (default text)
+  -p, --profile string   ~/.databrickscfg profile
+  -t, --target string    bundle target to use (if applicable)
+
+Use "databricks air pools [command] --help" for more information about a command.
+
+=== images help
+>>> [CLI] air images --help
+Manage container images for AI Runtime
+
+Usage:
+  databricks air images [flags]
+  databricks air images [command]
+
+Available Commands:
+  push        Push a container image to Databricks Artifact Registry
+
+Flags:
+  -h, --help   help for images
+
+Global Flags:
+      --debug            enable debug logging
+  -o, --output type      output type: text or json (default text)
+  -p, --profile string   ~/.databrickscfg profile
+  -t, --target string    bundle target to use (if applicable)
+
+Use "databricks air images [command] --help" for more information about a command.
+
+=== images push help
+>>> [CLI] air images push --help
+Push a container image to Databricks Artifact Registry under the specified Unity Catalog catalog and schema.
+
+The command configures Docker's Databricks credential helper, automatically detects
+the registry region, and pushes the source image to catalog.schema.artifact:tag.
+Omitted image details are prompted for when the terminal is interactive.
+
+AIR requires linux/amd64 images. A compatible local image is reused; missing images
+are pulled for linux/amd64. Use --pull to refresh an existing local image.
+The destination --artifact ARTIFACT[:TAG] defaults to the source image name and tag.
+
+Usage:
+  databricks air images push [flags]
+
+Flags:
+      --artifact string   Destination ARTIFACT[:TAG]; defaults to the source image name and tag (latest if untagged); maximum 255 characters for catalog.schema.artifact and 128 for the tag
+      --catalog string    Destination Unity Catalog catalog; use lowercase letters and digits separated by one or two underscores or one or more hyphens
+  -h, --help              help for push
+      --pull              Pull the source image even when it is already available locally
+      --schema string     Destination Unity Catalog schema; use lowercase letters and digits separated by one or two underscores or one or more hyphens
+  -s, --source string     Source container image to push (NAME[:TAG] or NAME@DIGEST)
+
+Global Flags:
+      --debug            enable debug logging
+  -o, --output type      output type: text or json (default text)
+  -p, --profile string   ~/.databrickscfg profile
+  -t, --target string    bundle target to use (if applicable)
+
+=== logs help
+>>> [CLI] air logs --help
+Stream logs from an active run until it completes, or fetch logs from a
+completed run.
+
+JOB_RUN_ID is the job run ID returned by "air run".
+
+Usage:
+  databricks air logs JOB_RUN_ID [flags]
+
+Examples:
+  databricks air logs 123456789
+  databricks air logs 123456789 --node 1 --retry 0
+  databricks air logs 123456789 --download-to ./logs
+
+Flags:
+      --download-to string   Download all logs to this directory instead of printing
+  -h, --help                 help for logs
+      --minutes int          Fetch only logs from the last N minutes
+      --node int             Fetch logs from this node
+      --retry int            View logs from a specific retry attempt; -1 means latest (default -1)
+      --tail int             Print the last N existing lines before following, or from a completed run (default 10000)
+
+Global Flags:
+      --debug            enable debug logging
+  -o, --output type      output type: text or json (default text)
+  -p, --profile string   ~/.databrickscfg profile
+  -t, --target string    bundle target to use (if applicable)
+
+=== cancel help
+>>> [CLI] air cancel --help
+Cancel one or more runs by job run ID, or use --all to cancel
+all active runs submitted by the current user.
+
+--all prompts for confirmation. Use --yes to skip the prompt.
+
+Usage:
+  databricks air cancel [JOB_RUN_ID...] [flags]
+
+Flags:
+      --all    Cancel all of your active runs
+  -h, --help   help for cancel
+  -y, --yes    Skip the confirmation prompt
+
+Global Flags:
+      --debug            enable debug logging
+  -o, --output type      output type: text or json (default text)
+  -p, --profile string   ~/.databrickscfg profile
+  -t, --target string    bundle target to use (if applicable)
diff --git a/acceptance/air/help/script b/acceptance/air/help/script
new file mode 100644
index 00000000000..fd1ae1514ea
--- /dev/null
+++ b/acceptance/air/help/script
@@ -0,0 +1,26 @@
+# Pin the command tree so any change to a subcommand or its short description
+# shows up as a diff here.
+
+title "help"
+trace $CLI air --help
+
+title "list help"
+trace $CLI air list --help
+
+title "get help"
+trace $CLI air get --help
+
+title "pools help"
+trace $CLI air pools --help
+
+title "images help"
+trace $CLI air images --help
+
+title "images push help"
+trace $CLI air images push --help
+
+title "logs help"
+trace $CLI air logs --help
+
+title "cancel help"
+trace $CLI air cancel --help
diff --git a/acceptance/air/image-push/docker b/acceptance/air/image-push/docker
new file mode 100644
index 00000000000..0303d011bdf
--- /dev/null
+++ b/acceptance/air/image-push/docker
@@ -0,0 +1,42 @@
+#!/bin/sh
+
+printf '%s\n' "$*" >> "$DOCKER_LOG"
+
+case "$1 $2" in
+  "image ls")
+    if [ "$DOCKER_TEST_MODE" = daemon-error ]; then
+      printf 'Cannot connect to the Docker daemon\n' >&2
+      exit 1
+    fi
+    if [ "$DOCKER_TEST_MODE" != missing ]; then
+      printf 'image-id\n'
+    fi
+    ;;
+  "image inspect")
+    case "$DOCKER_TEST_MODE" in
+      inspect-error)
+        printf 'Docker inspect failed\n' >&2
+        exit 1
+        ;;
+      arm64) printf 'linux/arm64\n' ;;
+      *) printf 'linux/amd64\n' ;;
+    esac
+    ;;
+  pull\ *)
+    if [ "$DOCKER_TEST_MODE" = pull-error ]; then
+      printf 'Docker pull failed\n' >&2
+      exit 1
+    fi
+    printf 'Docker pull progress\n'
+    ;;
+  tag\ *)
+    exit 0
+    ;;
+  push\ *)
+    printf 'Docker push progress\n'
+    ;;
+  *)
+    printf 'unexpected docker command: %s\n' "$*" >&2
+    exit 1
+    ;;
+esac
diff --git a/acceptance/air/image-push/out.test.toml b/acceptance/air/image-push/out.test.toml
new file mode 100644
index 00000000000..2e1543aa802
--- /dev/null
+++ b/acceptance/air/image-push/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+GOOS.windows = false
diff --git a/acceptance/air/image-push/output.txt b/acceptance/air/image-push/output.txt
new file mode 100644
index 00000000000..03c49f36d40
--- /dev/null
+++ b/acceptance/air/image-push/output.txt
@@ -0,0 +1,205 @@
+
+=== push image
+>>> databricks air images push -p docker-test -s nvidia/cuda:13.4.1 --catalog my-catalog --schema my-schema --artifact cuda:13.4.1-cudnn-devel-ubuntu26.04
+Warning: This feature is in Preview. APIs may change, and the workspace must enable the Preview features.
+Pushing nvidia/cuda:13.4.1 as my-catalog.my-schema.cuda:13.4.1-cudnn-devel-ubuntu26.04 using profile docker-test
+Configured Docker credential helper for [WORKSPACE_ID].container.us-west-2.localhost
+Updated Docker config: [TEST_TMP_DIR]/home/docker/config.json
+Installed Docker credential helper: [TEST_TMP_DIR]/home/bin/docker-credential-databricks
+Using local source image nvidia/cuda:13.4.1
+Tagging image as [WORKSPACE_ID].container.us-west-2.localhost/my-catalog.my-schema.cuda:13.4.1-cudnn-devel-ubuntu26.04
+Pushing image to [WORKSPACE_ID].container.us-west-2.localhost/my-catalog.my-schema.cuda:13.4.1-cudnn-devel-ubuntu26.04
+Docker push progress
+Pushed image.
+Now you can set `environment.unity_catalog_image = my-catalog.my-schema.cuda:13.4.1-cudnn-devel-ubuntu26.04` in your YAML config and create a workload with `databricks air run -f config.yaml`.
+
+=== inferred region and workspace ID requests
+
+>>> print_requests.py --get //api
+{
+  "method": "GET",
+  "path": "/api/2.0/preview/scim/v2/Me",
+  "q": {
+    "excludedAttributes": "entitlements"
+  }
+}
+{
+  "method": "GET",
+  "path": "/api/2.1/unity-catalog/metastore_summary"
+}
+
+=== docker commands
+image ls --quiet nvidia/cuda:13.4.1
+image inspect --format {{.Os}}/{{.Architecture}} nvidia/cuda:13.4.1
+tag nvidia/cuda:13.4.1 [WORKSPACE_ID].container.us-west-2.localhost/my-catalog.my-schema.cuda:13.4.1-cudnn-devel-ubuntu26.04
+push [WORKSPACE_ID].container.us-west-2.localhost/my-catalog.my-schema.cuda:13.4.1-cudnn-devel-ubuntu26.04
+
+=== missing image is pulled for AIR; destination defaults to source
+>>> databricks air images push -p docker-test -s example/image:v1 --catalog main --schema training
+Warning: This feature is in Preview. APIs may change, and the workspace must enable the Preview features.
+Pushing example/image:v1 as main.training.image:v1 using profile docker-test
+Configured Docker credential helper for [WORKSPACE_ID].container.us-west-2.localhost
+Updated Docker config: [TEST_TMP_DIR]/home/docker/config.json
+Installed Docker credential helper: [TEST_TMP_DIR]/home/bin/docker-credential-databricks
+Pulling source image example/image:v1 for linux/amd64
+Docker pull progress
+Tagging image as [WORKSPACE_ID].container.us-west-2.localhost/main.training.image:v1
+Pushing image to [WORKSPACE_ID].container.us-west-2.localhost/main.training.image:v1
+Docker push progress
+Pushed image.
+Now you can set `environment.unity_catalog_image = main.training.image:v1` in your YAML config and create a workload with `databricks air run -f config.yaml`.
+
+=== forced pull and JSON output
+>>> databricks air images push -p docker-test -s example/image:v1 --catalog main --schema training --pull -o json
+Warning: This feature is in Preview. APIs may change, and the workspace must enable the Preview features.
+Pushing example/image:v1 as main.training.image:v1 using profile docker-test
+Configured Docker credential helper for [WORKSPACE_ID].container.us-west-2.localhost
+Updated Docker config: [TEST_TMP_DIR]/home/docker/config.json
+Installed Docker credential helper: [TEST_TMP_DIR]/home/bin/docker-credential-databricks
+Pulling source image example/image:v1 for linux/amd64
+Docker pull progress
+Tagging image as [WORKSPACE_ID].container.us-west-2.localhost/main.training.image:v1
+Pushing image to [WORKSPACE_ID].container.us-west-2.localhost/main.training.image:v1
+Docker push progress
+Pushed image.
+
+>>> jq -e {v, data} [TEST_TMP_DIR]/home/result.json
+{
+  "v": 1,
+  "data": {
+    "unity_catalog_image": "main.training.image:v1",
+    "registry_image": "[WORKSPACE_ID].container.us-west-2.localhost/main.training.image:v1"
+  }
+}
+
+=== daemon failure must not pull
+>>> musterr databricks air images push -p docker-test -s example/image:v1 --catalog main --schema training
+Warning: This feature is in Preview. APIs may change, and the workspace must enable the Preview features.
+Pushing example/image:v1 as main.training.image:v1 using profile docker-test
+Configured Docker credential helper for [WORKSPACE_ID].container.us-west-2.localhost
+Updated Docker config: [TEST_TMP_DIR]/home/docker/config.json
+Installed Docker credential helper: [TEST_TMP_DIR]/home/bin/docker-credential-databricks
+Cannot connect to the Docker daemon
+Error: check local source image example/image:v1 (ensure Docker is running and accessible): exit status 1
+
+=== inspect failure must not pull
+>>> musterr databricks air images push -p docker-test -s example/image:v1 --catalog main --schema training
+Warning: This feature is in Preview. APIs may change, and the workspace must enable the Preview features.
+Pushing example/image:v1 as main.training.image:v1 using profile docker-test
+Configured Docker credential helper for [WORKSPACE_ID].container.us-west-2.localhost
+Updated Docker config: [TEST_TMP_DIR]/home/docker/config.json
+Installed Docker credential helper: [TEST_TMP_DIR]/home/bin/docker-credential-databricks
+Using local source image example/image:v1
+Docker inspect failed
+Error: inspect source image example/image:v1: exit status 1
+
+=== incompatible local image must not be pushed
+>>> musterr databricks air images push -p docker-test -s example/image:v1 --catalog main --schema training
+Warning: This feature is in Preview. APIs may change, and the workspace must enable the Preview features.
+Pushing example/image:v1 as main.training.image:v1 using profile docker-test
+Configured Docker credential helper for [WORKSPACE_ID].container.us-west-2.localhost
+Updated Docker config: [TEST_TMP_DIR]/home/docker/config.json
+Installed Docker credential helper: [TEST_TMP_DIR]/home/bin/docker-credential-databricks
+Using local source image example/image:v1
+Error: source image example/image:v1 has platform "linux/arm64"; AIR requires linux/amd64: use --pull to fetch a compatible image, or rebuild the source for linux/amd64
+
+=== incompatible pulled image must not be pushed
+>>> musterr databricks air images push -p docker-test -s example/image:v1 --catalog main --schema training --pull
+Warning: This feature is in Preview. APIs may change, and the workspace must enable the Preview features.
+Pushing example/image:v1 as main.training.image:v1 using profile docker-test
+Configured Docker credential helper for [WORKSPACE_ID].container.us-west-2.localhost
+Updated Docker config: [TEST_TMP_DIR]/home/docker/config.json
+Installed Docker credential helper: [TEST_TMP_DIR]/home/bin/docker-credential-databricks
+Pulling source image example/image:v1 for linux/amd64
+Docker pull progress
+Error: source image example/image:v1 has platform "linux/arm64"; AIR requires linux/amd64: use --pull to fetch a compatible image, or rebuild the source for linux/amd64
+
+=== pull failure must not be pushed
+>>> musterr databricks air images push -p docker-test -s example/image:v1 --catalog main --schema training --pull
+Warning: This feature is in Preview. APIs may change, and the workspace must enable the Preview features.
+Pushing example/image:v1 as main.training.image:v1 using profile docker-test
+Configured Docker credential helper for [WORKSPACE_ID].container.us-west-2.localhost
+Updated Docker config: [TEST_TMP_DIR]/home/docker/config.json
+Installed Docker credential helper: [TEST_TMP_DIR]/home/bin/docker-credential-databricks
+Pulling source image example/image:v1 for linux/amd64
+Docker pull failed
+Error: pull source image example/image:v1: exit status 1
+
+=== invalid destination and removed flags
+>>> musterr databricks air images push -p docker-test -s example/image:v1 --catalog main --schema training --artifact invalid.name
+Warning: This feature is in Preview. APIs may change, and the workspace must enable the Preview features.
+Error: invalid artifact name "invalid.name": use lowercase letters and digits separated by one or two underscores or one or more hyphens
+
+>>> musterr databricks air images push -p docker-test -s example/image:v1 --catalog main --schema team_-training
+Warning: This feature is in Preview. APIs may change, and the workspace must enable the Preview features.
+Error: invalid schema "team_-training": use lowercase letters and digits separated by one or two underscores or one or more hyphens
+
+>>> musterr databricks air images push --region us-west-2
+Error: unknown flag: --region
+
+Usage:
+  databricks air images push [flags]
+
+Flags:
+      --artifact string   Destination ARTIFACT[:TAG]; defaults to the source image name and tag (latest if untagged); maximum 255 characters for catalog.schema.artifact and 128 for the tag
+      --catalog string    Destination Unity Catalog catalog; use lowercase letters and digits separated by one or two underscores or one or more hyphens
+  -h, --help              help for push
+      --pull              Pull the source image even when it is already available locally
+      --schema string     Destination Unity Catalog schema; use lowercase letters and digits separated by one or two underscores or one or more hyphens
+  -s, --source string     Source container image to push (NAME[:TAG] or NAME@DIGEST)
+
+Global Flags:
+      --debug            enable debug logging
+  -o, --output type      output type: text or json (default text)
+  -p, --profile string   ~/.databrickscfg profile
+  -t, --target string    bundle target to use (if applicable)
+
+
+>>> musterr databricks air images push --image artifact
+Error: unknown flag: --image
+
+Usage:
+  databricks air images push [flags]
+
+Flags:
+      --artifact string   Destination ARTIFACT[:TAG]; defaults to the source image name and tag (latest if untagged); maximum 255 characters for catalog.schema.artifact and 128 for the tag
+      --catalog string    Destination Unity Catalog catalog; use lowercase letters and digits separated by one or two underscores or one or more hyphens
+  -h, --help              help for push
+      --pull              Pull the source image even when it is already available locally
+      --schema string     Destination Unity Catalog schema; use lowercase letters and digits separated by one or two underscores or one or more hyphens
+  -s, --source string     Source container image to push (NAME[:TAG] or NAME@DIGEST)
+
+Global Flags:
+      --debug            enable debug logging
+  -o, --output type      output type: text or json (default text)
+  -p, --profile string   ~/.databrickscfg profile
+  -t, --target string    bundle target to use (if applicable)
+
+
+=== reject oversized catalog.schema.artifact before Docker operations
+>>> musterr databricks air images push -p docker-test -s example/image:v1 --catalog main --schema training --artifact aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+Warning: This feature is in Preview. APIs may change, and the workspace must enable the Preview features.
+Error: invalid image repository name: catalog.schema.artifact must be 255 characters or less
+
+=== all docker commands
+image ls --quiet nvidia/cuda:13.4.1
+image inspect --format {{.Os}}/{{.Architecture}} nvidia/cuda:13.4.1
+tag nvidia/cuda:13.4.1 [WORKSPACE_ID].container.us-west-2.localhost/my-catalog.my-schema.cuda:13.4.1-cudnn-devel-ubuntu26.04
+push [WORKSPACE_ID].container.us-west-2.localhost/my-catalog.my-schema.cuda:13.4.1-cudnn-devel-ubuntu26.04
+image ls --quiet example/image:v1
+pull --platform linux/amd64 example/image:v1
+image inspect --format {{.Os}}/{{.Architecture}} example/image:v1
+tag example/image:v1 [WORKSPACE_ID].container.us-west-2.localhost/main.training.image:v1
+push [WORKSPACE_ID].container.us-west-2.localhost/main.training.image:v1
+pull --platform linux/amd64 example/image:v1
+image inspect --format {{.Os}}/{{.Architecture}} example/image:v1
+tag example/image:v1 [WORKSPACE_ID].container.us-west-2.localhost/main.training.image:v1
+push [WORKSPACE_ID].container.us-west-2.localhost/main.training.image:v1
+image ls --quiet example/image:v1
+image ls --quiet example/image:v1
+image inspect --format {{.Os}}/{{.Architecture}} example/image:v1
+image ls --quiet example/image:v1
+image inspect --format {{.Os}}/{{.Architecture}} example/image:v1
+pull --platform linux/amd64 example/image:v1
+image inspect --format {{.Os}}/{{.Architecture}} example/image:v1
+pull --platform linux/amd64 example/image:v1
diff --git a/acceptance/air/image-push/oversized-artifact.txt b/acceptance/air/image-push/oversized-artifact.txt
new file mode 100644
index 00000000000..44c39c91b93
--- /dev/null
+++ b/acceptance/air/image-push/oversized-artifact.txt
@@ -0,0 +1 @@
+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
diff --git a/acceptance/air/image-push/script b/acceptance/air/image-push/script
new file mode 100644
index 00000000000..bd641b65d9e
--- /dev/null
+++ b/acceptance/air/image-push/script
@@ -0,0 +1,63 @@
+export DOCKER_CONFIG="$HOME/docker"
+export DOCKER_LOG="$HOME/docker.log"
+mkdir -p "$DOCKER_CONFIG"
+cp "$TESTDIR/docker" "$HOME/bin/docker"
+chmod +x "$HOME/bin/docker"
+
+title "push image"
+trace databricks air images push \
+  -p docker-test \
+  -s nvidia/cuda:13.4.1 \
+  --catalog my-catalog \
+  --schema my-schema \
+  --artifact cuda:13.4.1-cudnn-devel-ubuntu26.04
+
+title "inferred region and workspace ID requests\n"
+trace print_requests.py --get //api
+
+title "docker commands\n"
+cat "$DOCKER_LOG"
+
+title "missing image is pulled for AIR; destination defaults to source"
+export DOCKER_TEST_MODE=missing
+trace databricks air images push -p docker-test -s example/image:v1 --catalog main --schema training
+
+title "forced pull and JSON output"
+unset DOCKER_TEST_MODE
+trace databricks air images push -p docker-test -s example/image:v1 --catalog main --schema training --pull -o json > "$HOME/result.json"
+# Parsing the complete stdout fails if Docker progress or human-readable text leaks into it.
+trace jq -e '{v, data}' "$HOME/result.json"
+
+title "daemon failure must not pull"
+export DOCKER_TEST_MODE=daemon-error
+trace musterr databricks air images push -p docker-test -s example/image:v1 --catalog main --schema training
+
+title "inspect failure must not pull"
+export DOCKER_TEST_MODE=inspect-error
+trace musterr databricks air images push -p docker-test -s example/image:v1 --catalog main --schema training
+
+title "incompatible local image must not be pushed"
+export DOCKER_TEST_MODE=arm64
+trace musterr databricks air images push -p docker-test -s example/image:v1 --catalog main --schema training
+
+title "incompatible pulled image must not be pushed"
+trace musterr databricks air images push -p docker-test -s example/image:v1 --catalog main --schema training --pull
+
+title "pull failure must not be pushed"
+export DOCKER_TEST_MODE=pull-error
+trace musterr databricks air images push -p docker-test -s example/image:v1 --catalog main --schema training --pull
+
+title "invalid destination and removed flags"
+unset DOCKER_TEST_MODE
+trace musterr databricks air images push -p docker-test -s example/image:v1 --catalog main --schema training --artifact invalid.name
+trace musterr databricks air images push -p docker-test -s example/image:v1 --catalog main --schema team_-training
+trace musterr databricks air images push --region us-west-2
+trace musterr databricks air images push --image artifact
+
+title "reject oversized catalog.schema.artifact before Docker operations"
+cp "$DOCKER_LOG" "$HOME/docker.before-length.log"
+trace musterr databricks air images push -p docker-test -s example/image:v1 --catalog main --schema training --artifact "$(cat oversized-artifact.txt)"
+cmp "$DOCKER_LOG" "$HOME/docker.before-length.log"
+
+title "all docker commands\n"
+cat "$DOCKER_LOG"
diff --git a/acceptance/air/image-push/script.prepare b/acceptance/air/image-push/script.prepare
new file mode 100644
index 00000000000..ccfbf28593d
--- /dev/null
+++ b/acceptance/air/image-push/script.prepare
@@ -0,0 +1,36 @@
+export DATABRICKS_HOST_ORIG="$DATABRICKS_HOST"
+sethome "./home"
+
+unset DATABRICKS_ACCOUNT_ID
+unset DATABRICKS_AUTH_TYPE
+unset DATABRICKS_CLIENT_ID
+unset DATABRICKS_CLIENT_SECRET
+unset DATABRICKS_CONFIG_FILE
+unset DATABRICKS_CONFIG_PROFILE
+unset DATABRICKS_DISCOVERY_URL
+unset DATABRICKS_HOST
+unset DATABRICKS_TOKEN
+unset DATABRICKS_WORKSPACE_ID
+
+export DATABRICKS_AUTH_STORAGE=plaintext
+export DATABRICKS_LOG_LEVEL=error
+
+cat > "$HOME/.databrickscfg" <<ENDCFG
+[docker-test]
+host = $DATABRICKS_HOST_ORIG
+auth_type = databricks-cli
+ENDCFG
+
+mkdir -p "$HOME/.databricks"
+cp "$TESTDIR/token-cache.json" "$HOME/.databricks/token-cache.json"
+
+# configure installs docker-credential-databricks next to the running CLI, so run a copy outside the shared build directory.
+mkdir -p "$HOME/bin"
+if [[ "$OSTYPE" == "msys" || "$OSTYPE" == "cygwin" || "$OSTYPE" == "win32" ]]; then
+    cp "$(cygpath -u "$CLI")" "$HOME/bin/databricks.exe"
+    export PATH="$(cygpath -u "$HOME/bin"):$PATH"
+else
+    cp "$CLI" "$HOME/bin/databricks"
+    chmod +x "$HOME/bin/databricks"
+    export PATH="$HOME/bin:$PATH"
+fi
diff --git a/acceptance/air/image-push/test.toml b/acceptance/air/image-push/test.toml
new file mode 100644
index 00000000000..274dc16d42d
--- /dev/null
+++ b/acceptance/air/image-push/test.toml
@@ -0,0 +1,8 @@
+Ignore = ["home"]
+RecordRequests = true
+
+Timeout = "30s"
+
+# The Docker credential-helper installation path is covered separately on
+# Windows; this test focuses on the complete air images push workflow.
+GOOS.windows = false
diff --git a/acceptance/air/image-push/token-cache.json b/acceptance/air/image-push/token-cache.json
new file mode 100644
index 00000000000..92aff621332
--- /dev/null
+++ b/acceptance/air/image-push/token-cache.json
@@ -0,0 +1,11 @@
+{
+  "version": 1,
+  "tokens": {
+    "docker-test": {
+      "access_token": "cached-access-token",
+      "token_type": "Bearer",
+      "refresh_token": "test-refresh-token",
+      "expiry": "2099-01-01T00:00:00Z"
+    }
+  }
+}
diff --git a/acceptance/air/list/out.test.toml b/acceptance/air/list/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/air/list/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/air/list/output.txt b/acceptance/air/list/output.txt
new file mode 100644
index 00000000000..9dfa0b22f24
--- /dev/null
+++ b/acceptance/air/list/output.txt
@@ -0,0 +1,48 @@
+
+=== list (text)
+>>> [CLI] air list
+   Run ID           Experiment  Status     Started              Duration  Progress  MLflow                  User                   Accelerators
+   334747067049496  qwen-train  ● SUCCESS  [TIMESTAMP]       12s         -  qwen-train-001          [USERNAME]  8x H100
+
+=== list (json)
+>>> [CLI] air list -o json
+{
+  "v": 1,
+  "ts": "[TIMESTAMP]",
+  "data": {
+    "runs": [
+      {
+        "run_id": "334747067049496",
+        "run_name": "qwen-train",
+        "user": "[USERNAME]",
+        "status": "SUCCESS",
+        "started_at": "[TIMESTAMP]",
+        "is_sweep": false
+      }
+    ]
+  }
+}
+
+=== list --all-status (text, via AiTrainingService index)
+>>> [CLI] air list --all-status
+   Run ID           Experiment  Status     Started              Duration  Progress  MLflow                  User                   Accelerators
+   334747067049496  qwen-train  ● SUCCESS  [TIMESTAMP]       12s         -  qwen-train-001          [USERNAME]  8x H100
+
+=== list --all-status (json)
+>>> [CLI] air list --all-status -o json
+{
+  "v": 1,
+  "ts": "[TIMESTAMP]",
+  "data": {
+    "runs": [
+      {
+        "run_id": "334747067049496",
+        "run_name": "qwen-train",
+        "user": "[USERNAME]",
+        "status": "SUCCESS",
+        "started_at": "[TIMESTAMP]",
+        "is_sweep": false
+      }
+    ]
+  }
+}
diff --git a/acceptance/air/list/script b/acceptance/air/list/script
new file mode 100644
index 00000000000..449b2a936e0
--- /dev/null
+++ b/acceptance/air/list/script
@@ -0,0 +1,11 @@
+title "list (text)"
+trace $CLI air list
+
+title "list (json)"
+trace $CLI air list -o json
+
+title "list --all-status (text, via AiTrainingService index)"
+trace $CLI air list --all-status
+
+title "list --all-status (json)"
+trace $CLI air list --all-status -o json
diff --git a/acceptance/air/list/test.toml b/acceptance/air/list/test.toml
new file mode 100644
index 00000000000..9d5ca13df25
--- /dev/null
+++ b/acceptance/air/list/test.toml
@@ -0,0 +1,95 @@
+# Disable the on-disk run cache so --all-status output is deterministic across runs.
+Env.DATABRICKS_CACHE_ENABLED = "false"
+# The SDK occasionally probes host reachability with a HEAD request; stub it so
+# the test is deterministic.
+
+[[Server]]
+Pattern = "HEAD /"
+Response.Body = ''
+
+# `air list` reads Jobs runs/list directly (expand_tasks), filtering to AIR runs.
+# The current runs carry an ai_runtime_task (not modeled by the typed SDK), which
+# is why the CLI parses the response raw. Both runs belong to the default user
+# (tester@databricks.com, from the built-in scim/v2/Me handler). The second run
+# has no AI task and must be filtered out.
+[[Server]]
+Pattern = "GET /api/2.2/jobs/runs/list"
+Response.Body = '''
+{
+  "runs": [
+    {
+      "run_id": 334747067049496,
+      "run_name": "qwen-train",
+      "creator_user_name": "tester@databricks.com",
+      "start_time": 1717608759000,
+      "end_time": 1717608771000,
+      "state": {"life_cycle_state": "TERMINATED", "result_state": "SUCCESS"},
+      "tasks": [{
+        "run_id": 334747067049497,
+        "ai_runtime_task": {
+          "experiment": "/Users/tester@databricks.com/qwen-train",
+          "deployments": [{"compute": {"accelerator_type": "GPU_8xH100", "accelerator_count": 8}}]
+        }
+      }]
+    },
+    {
+      "run_id": 999000999000,
+      "run_name": "not-an-air-run",
+      "creator_user_name": "tester@databricks.com",
+      "state": {"life_cycle_state": "RUNNING"},
+      "tasks": [{"notebook_task": {"notebook_path": "/x"}}]
+    }
+  ]
+}
+'''
+
+# MLflow IDs for the deep link, fetched per AIR run (text mode). The current
+# task type resolves them under ai_runtime_task_output.
+[[Server]]
+Pattern = "GET /api/2.2/jobs/runs/get-output"
+Response.Body = '''
+{"ai_runtime_task_output": {"mlflow_experiment_id": "exp1", "mlflow_run_id": "run1"}}
+'''
+
+# `air list --all-status` scoped to the current user is served by the
+# AiTrainingService index: it returns cheap (job_run_id, submit_time) pairs, which
+# the CLI orders and then hydrates into full runs via runs/get.
+[[Server]]
+Pattern = "GET /api/2.0/ai-training/workflows"
+Response.Body = '''
+{"training_workflows": [{"job_run_id": "334747067049496", "submit_time": "2024-06-05T17:32:39Z"}]}
+'''
+
+# MLflow run names (for the MLflow column label) are fetched per AIR run (text mode).
+[[Server]]
+Pattern = "GET /api/2.0/mlflow/runs/get"
+Response.Body = '''
+{
+  "run": {
+    "info": {
+      "run_name": "qwen-train-001"
+    }
+  }
+}
+'''
+
+# runs/get hydrates one index id into the same shape as a runs/list element.
+[[Server]]
+Pattern = "GET /api/2.2/jobs/runs/get"
+Response.Body = '''
+{
+  "run_id": 334747067049496,
+  "run_name": "qwen-train",
+  "creator_user_name": "tester@databricks.com",
+  "start_time": 1717608759000,
+  "end_time": 1717608771000,
+  "state": {"life_cycle_state": "TERMINATED", "result_state": "SUCCESS"},
+  "tasks": [{
+    "run_id": 334747067049497,
+    "ai_runtime_task": {
+      "experiment": "/Users/tester@databricks.com/qwen-train",
+      "deployments": [{"compute": {"accelerator_type": "GPU_8xH100", "accelerator_count": 8}}]
+    }
+  }]
+}
+'''
diff --git a/acceptance/air/logs-download/out.test.toml b/acceptance/air/logs-download/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/air/logs-download/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/air/logs-download/output.txt b/acceptance/air/logs-download/output.txt
new file mode 100644
index 00000000000..4dedd822aa2
--- /dev/null
+++ b/acceptance/air/logs-download/output.txt
@@ -0,0 +1,16 @@
+
+=== download-to reports no logs when none are available
+>>> [CLI] air logs 123 --download-to dl-logs
+No logs available for run 123. Run terminated in state SUCCESS
+
+=== download-to with an out-of-range node is rejected
+>>> [CLI] air logs 123 --download-to dl-logs --node 5
+Error: invalid --node 5: run has 2 node(s), indexed 0 to 1
+
+Exit code: 1
+
+=== download-to cannot be combined with --tail
+>>> [CLI] air logs 123 --download-to dl-logs --tail 50
+Error: --download-to writes complete logs, so it cannot be combined with --tail or --minutes
+
+Exit code: 1
diff --git a/acceptance/air/logs-download/script b/acceptance/air/logs-download/script
new file mode 100644
index 00000000000..324c35f2a85
--- /dev/null
+++ b/acceptance/air/logs-download/script
@@ -0,0 +1,12 @@
+# --download-to resolves the run's node count, then downloads each node's logs.
+# This run resolves no MLflow run id, so it reports no logs (the full byte
+# download is covered by unit tests, since the pre-signed URL host is dynamic).
+
+title "download-to reports no logs when none are available"
+errcode trace $CLI air logs 123 --download-to dl-logs
+
+title "download-to with an out-of-range node is rejected"
+errcode trace $CLI air logs 123 --download-to dl-logs --node 5
+
+title "download-to cannot be combined with --tail"
+errcode trace $CLI air logs 123 --download-to dl-logs --tail 50
diff --git a/acceptance/air/logs-download/test.toml b/acceptance/air/logs-download/test.toml
new file mode 100644
index 00000000000..1fd40b58e2b
--- /dev/null
+++ b/acceptance/air/logs-download/test.toml
@@ -0,0 +1,40 @@
+# The command creates this download directory; don't treat it as test output.
+Ignore = ["dl-logs"]
+
+# The SDK occasionally probes host reachability with a HEAD request; stub it so
+# the test is deterministic.
+[[Server]]
+Pattern = "HEAD /"
+Response.Body = ''
+
+# A completed 2-node run (GPU_1xA10 x 2 = 2 nodes).
+[[Server]]
+Pattern = "GET /api/2.2/jobs/runs/get"
+Response.Body = '''
+{
+  "run_id": 123,
+  "start_time": 1700000000000,
+  "end_time": 1700000012000,
+  "state": {"life_cycle_state": "TERMINATED", "result_state": "SUCCESS"},
+  "tasks": [
+    {
+      "task_key": "train",
+      "run_id": 456,
+      "attempt_number": 0,
+      "ai_runtime_task": {
+        "experiment": "dl-exp",
+        "deployments": [
+          {"command_path": "/x/command.sh", "compute": {"accelerator_type": "GPU_1xA10", "accelerator_count": 2}}
+        ]
+      }
+    }
+  ]
+}
+'''
+
+# No MLflow run id resolvable, so the download reports no logs rather than
+# attempting a (host-dynamic) pre-signed artifact fetch. The full download path
+# is covered by unit tests.
+[[Server]]
+Pattern = "GET /api/2.2/jobs/runs/get-output"
+Response.Body = '{}'
diff --git a/acceptance/air/logs-mlflow-fallback/out.test.toml b/acceptance/air/logs-mlflow-fallback/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/air/logs-mlflow-fallback/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/air/logs-mlflow-fallback/output.txt b/acceptance/air/logs-mlflow-fallback/output.txt
new file mode 100644
index 00000000000..e783e9a1ba7
--- /dev/null
+++ b/acceptance/air/logs-mlflow-fallback/output.txt
@@ -0,0 +1,8 @@
+
+=== logs falls back to mlflow (no logs)
+>>> [CLI] air logs 123
+No logs available for run 123. Run terminated in state SUCCESS
+
+=== logs falls back to mlflow (json)
+>>> [CLI] air logs 123 -o json
+{"type":"ERROR","ts":"[TIMESTAMP]","node":0,"line":"No logs available for run 123. Run terminated in state SUCCESS"}
diff --git a/acceptance/air/logs-mlflow-fallback/script b/acceptance/air/logs-mlflow-fallback/script
new file mode 100644
index 00000000000..d8c52588bd2
--- /dev/null
+++ b/acceptance/air/logs-mlflow-fallback/script
@@ -0,0 +1,9 @@
+# Bricklens is gated off (FEATURE_DISABLED), so the command falls back to the
+# MLflow log path. With no MLflow run id resolvable, the fallback reports no
+# logs and exits non-zero — proving the try/catch routes to MLflow.
+
+title "logs falls back to mlflow (no logs)"
+errcode trace $CLI air logs 123
+
+title "logs falls back to mlflow (json)"
+errcode trace $CLI air logs 123 -o json
diff --git a/acceptance/air/logs-mlflow-fallback/test.toml b/acceptance/air/logs-mlflow-fallback/test.toml
new file mode 100644
index 00000000000..9b9bcab8e68
--- /dev/null
+++ b/acceptance/air/logs-mlflow-fallback/test.toml
@@ -0,0 +1,32 @@
+# The SDK occasionally probes host reachability with a HEAD request; stub it so
+# the test is deterministic.
+[[Server]]
+Pattern = "HEAD /"
+Response.Body = ''
+
+# A completed run.
+[[Server]]
+Pattern = "GET /api/2.2/jobs/runs/get"
+Response.Body = '''
+{
+  "run_id": 123,
+  "start_time": 1700000000000,
+  "end_time": 1700000012000,
+  "state": {"life_cycle_state": "TERMINATED", "result_state": "SUCCESS"},
+  "tasks": [{"task_key": "train", "run_id": 456, "attempt_number": 0}]
+}
+'''
+
+# Bricklens is gated off by the backend SAFE flag, forcing the MLflow fallback.
+[[Server]]
+Pattern = "GET /api/2.0/ai-training/workflows/by-run-id/123/logs"
+Response.StatusCode = 403
+Response.Body = '''
+{"error_code": "FEATURE_DISABLED", "message": "training log streaming is not enabled"}
+'''
+
+# The MLflow fallback has no run output to resolve an MLflow run id from, so it
+# reports no logs rather than failing — exercising the fallback wiring end to end.
+[[Server]]
+Pattern = "GET /api/2.2/jobs/runs/get-output"
+Response.Body = '{}'
diff --git a/acceptance/air/logs/out.test.toml b/acceptance/air/logs/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/air/logs/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/air/logs/output.txt b/acceptance/air/logs/output.txt
new file mode 100644
index 00000000000..da16c857ad6
--- /dev/null
+++ b/acceptance/air/logs/output.txt
@@ -0,0 +1,68 @@
+
+=== logs (text, completed run)
+>>> [CLI] air logs 123
+step 1
+step 2
+CUDA out of memory
+
+=== logs (json)
+>>> [CLI] air logs 123 -o json
+{"type":"LOG","ts":"[TIMESTAMP]","node":0,"line":"step 1"}
+{"type":"LOG","ts":"[TIMESTAMP]","node":0,"line":"step 2"}
+{"type":"ALERT","ts":"[TIMESTAMP]","node":0,"line":"CUDA out of memory"}
+{"type":"LOG","ts":"[TIMESTAMP]","node":0,"line":"CUDA out of memory"}
+
+=== logs with --minutes
+>>> [CLI] air logs 123 --minutes 30
+step 1
+step 2
+CUDA out of memory
+
+=== logs with --tail
+>>> [CLI] air logs 123 --tail 1
+CUDA out of memory
+
+=== logs with --tail 0 is rejected
+>>> [CLI] air logs 123 --tail 0
+Error: invalid --tail 0: must be positive
+
+Exit code: 1
+
+=== logs from a specific retry
+>>> [CLI] air logs 123 --retry 0
+step 1
+step 2
+CUDA out of memory
+
+=== logs --tail and --minutes are mutually exclusive
+>>> [CLI] air logs 123 --tail 100 --minutes 30
+Error: cannot combine --tail with --minutes: --tail selects by line count, --minutes by time window
+
+Exit code: 1
+
+=== logs --tail and --minutes are mutually exclusive (json)
+>>> [CLI] air logs 123 --tail 100 --minutes 30 -o json
+{
+  "v": 1,
+  "ts": "[TIMESTAMP]",
+  "error": {
+    "code": "INVALID_ARGS",
+    "kind": "PERMANENT",
+    "message": "cannot combine --tail with --minutes: --tail selects by line count, --minutes by time window",
+    "retryable": false
+  }
+}
+
+Exit code: 1
+
+=== invalid run id
+>>> [CLI] air logs notanumber
+Error: invalid JOB_RUN_ID "notanumber": must be a positive integer
+
+Exit code: 1
+
+=== negative node
+>>> [CLI] air logs 123 --node -1
+Error: invalid --node -1: must not be negative
+
+Exit code: 1
diff --git a/acceptance/air/logs/script b/acceptance/air/logs/script
new file mode 100644
index 00000000000..9060c674a74
--- /dev/null
+++ b/acceptance/air/logs/script
@@ -0,0 +1,29 @@
+title "logs (text, completed run)"
+trace $CLI air logs 123
+
+title "logs (json)"
+trace $CLI air logs 123 -o json
+
+title "logs with --minutes"
+trace $CLI air logs 123 --minutes 30
+
+title "logs with --tail"
+trace $CLI air logs 123 --tail 1
+
+title "logs with --tail 0 is rejected"
+errcode trace $CLI air logs 123 --tail 0
+
+title "logs from a specific retry"
+trace $CLI air logs 123 --retry 0
+
+title "logs --tail and --minutes are mutually exclusive"
+errcode trace $CLI air logs 123 --tail 100 --minutes 30
+
+title "logs --tail and --minutes are mutually exclusive (json)"
+errcode trace $CLI air logs 123 --tail 100 --minutes 30 -o json
+
+title "invalid run id"
+errcode trace $CLI air logs notanumber
+
+title "negative node"
+errcode trace $CLI air logs 123 --node -1
diff --git a/acceptance/air/logs/test.toml b/acceptance/air/logs/test.toml
new file mode 100644
index 00000000000..31e95adc8c1
--- /dev/null
+++ b/acceptance/air/logs/test.toml
@@ -0,0 +1,30 @@
+# The SDK occasionally probes host reachability with a HEAD request; stub it so
+# the test is deterministic.
+[[Server]]
+Pattern = "HEAD /"
+Response.Body = ''
+
+# A completed run: Bricklens serves its logs via the tail drain.
+[[Server]]
+Pattern = "GET /api/2.2/jobs/runs/get"
+Response.Body = '''
+{
+  "run_id": 123,
+  "start_time": 1700000000000,
+  "end_time": 1700000012000,
+  "state": {"life_cycle_state": "TERMINATED", "result_state": "SUCCESS"},
+  "tasks": [{"task_key": "train", "run_id": 456, "attempt_number": 0}]
+}
+'''
+
+# Bricklens log records, returned newest-first (as the tail fetch requests);
+# printed oldest-first.
+[[Server]]
+Pattern = "GET /api/2.0/ai-training/workflows/by-run-id/123/logs"
+Response.Body = '''
+{"log_records": [
+  {"time_unix_nano": 1700000003000000000, "body": "CUDA out of memory", "node_index": 0},
+  {"time_unix_nano": 1700000002000000000, "body": "step 2", "node_index": 0},
+  {"time_unix_nano": 1700000001000000000, "body": "step 1", "node_index": 0}
+]}
+'''
diff --git a/acceptance/air/pools/out.test.toml b/acceptance/air/pools/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/air/pools/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/air/pools/output.txt b/acceptance/air/pools/output.txt
new file mode 100644
index 00000000000..d2064b55703
--- /dev/null
+++ b/acceptance/air/pools/output.txt
@@ -0,0 +1,49 @@
+
+=== list pools (text)
+>>> [CLI] air pools list
+ID                                       ACCELERATOR    RESERVED
+pool-8xh100-alpha                        GPU_8xH100     64
+pool-1xh100-beta                         GPU_1xH100     8
+
+=== list pools (json)
+>>> [CLI] air pools list -o json
+{
+  "v": 1,
+  "ts": "[TIMESTAMP]",
+  "data": {
+    "pools": [
+      {
+        "pool_id": "pool-8xh100-alpha",
+        "accelerator_type": "GPU_8xH100",
+        "reserved_accelerators": 64
+      },
+      {
+        "pool_id": "pool-1xh100-beta",
+        "accelerator_type": "GPU_1xH100",
+        "reserved_accelerators": 8
+      }
+    ]
+  }
+}
+
+=== get pool (text)
+>>> [CLI] air pools get pool-8xh100-alpha
+Pool ID:                 pool-8xh100-alpha
+Accelerator Type:        GPU_8xH100
+Reserved Accelerators:   64
+Used Accelerators:       40
+Idle Accelerators:       24
+
+=== get pool (json)
+>>> [CLI] air pools get pool-8xh100-alpha -o json
+{
+  "v": 1,
+  "ts": "[TIMESTAMP]",
+  "data": {
+    "pool_id": "pool-8xh100-alpha",
+    "accelerator_type": "GPU_8xH100",
+    "reserved_accelerators": 64,
+    "used_accelerators": 40,
+    "idle_accelerators": 24
+  }
+}
diff --git a/acceptance/air/pools/script b/acceptance/air/pools/script
new file mode 100644
index 00000000000..4ddd2f2408e
--- /dev/null
+++ b/acceptance/air/pools/script
@@ -0,0 +1,11 @@
+title "list pools (text)"
+trace $CLI air pools list
+
+title "list pools (json)"
+trace $CLI air pools list -o json
+
+title "get pool (text)"
+trace $CLI air pools get pool-8xh100-alpha
+
+title "get pool (json)"
+trace $CLI air pools get pool-8xh100-alpha -o json
diff --git a/acceptance/air/pools/test.toml b/acceptance/air/pools/test.toml
new file mode 100644
index 00000000000..d9c211aee84
--- /dev/null
+++ b/acceptance/air/pools/test.toml
@@ -0,0 +1,29 @@
+# The SDK occasionally probes host reachability with a HEAD request; stub it so
+# the test is deterministic.
+[[Server]]
+Pattern = "HEAD /"
+Response.Body = ''
+
+# List returns the workspace's GPU pools. usage is intentionally absent here:
+# the real endpoint populates it only on Get. name is the AIP resource name.
+[[Server]]
+Pattern = "GET /api/2.0/ai-training/provisioned-capacities"
+Response.Body = '''
+{
+  "provisioned_capacities": [
+    {"name": "provisioned-capacities/pool-8xh100-alpha", "spec": {"accelerator_type": "GPU_8xH100", "accelerator_count": 64}},
+    {"name": "provisioned-capacities/pool-1xh100-beta", "spec": {"accelerator_type": "GPU_1xH100", "accelerator_count": 8}}
+  ]
+}
+'''
+
+# Get returns one pool with its usage summary populated.
+[[Server]]
+Pattern = "GET /api/2.0/ai-training/provisioned-capacities/pool-8xh100-alpha"
+Response.Body = '''
+{
+  "name": "provisioned-capacities/pool-8xh100-alpha",
+  "spec": {"accelerator_type": "GPU_8xH100", "accelerator_count": 64},
+  "status": {"usage": {"used_accelerator_count": 40, "idle_accelerator_count": 24}}
+}
+'''
diff --git a/acceptance/air/run-backend-error/out.test.toml b/acceptance/air/run-backend-error/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/air/run-backend-error/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/air/run-backend-error/output.txt b/acceptance/air/run-backend-error/output.txt
new file mode 100644
index 00000000000..43871d8188c
--- /dev/null
+++ b/acceptance/air/run-backend-error/output.txt
@@ -0,0 +1,9 @@
+
+=== backend field errors fail dry-run
+>>> [CLI] air run -f valid.yaml --dry-run
+Error: config validation failed:
+  deployments[0].compute.accelerator_count: accelerator_count must be at most 1024, but was 1032.
+  env_variables[1INVALID]: env_variables[1INVALID] contains characters that are not allowed.
+
+Tip: use the --debug flag to see more details and a trace of this error:
+  databricks --debug air run …
diff --git a/acceptance/air/run-backend-error/script b/acceptance/air/run-backend-error/script
new file mode 100644
index 00000000000..6b211207ba9
--- /dev/null
+++ b/acceptance/air/run-backend-error/script
@@ -0,0 +1,2 @@
+title "backend field errors fail dry-run"
+musterr trace $CLI air run -f valid.yaml --dry-run
diff --git a/acceptance/air/run-backend-error/test.toml b/acceptance/air/run-backend-error/test.toml
new file mode 100644
index 00000000000..55c9dfa9007
--- /dev/null
+++ b/acceptance/air/run-backend-error/test.toml
@@ -0,0 +1,18 @@
+[[Server]]
+Pattern = "POST /api/2.0/ai-training/config:validate"
+Response.Body = '''
+{
+  "errors": [
+    {
+      "path": "deployments[0].compute.accelerator_count",
+      "message": "accelerator_count must be at most 1024, but was 1032.",
+      "code": "OUT_OF_RANGE"
+    },
+    {
+      "path": "env_variables[1INVALID]",
+      "message": "env_variables[1INVALID] contains characters that are not allowed.",
+      "code": "DISALLOWED_CHARACTERS"
+    }
+  ]
+}
+'''
diff --git a/acceptance/air/run-backend-error/valid.yaml b/acceptance/air/run-backend-error/valid.yaml
new file mode 100644
index 00000000000..b717585c0bc
--- /dev/null
+++ b/acceptance/air/run-backend-error/valid.yaml
@@ -0,0 +1,7 @@
+experiment_name: smoke-test
+command: python train.py
+compute:
+  accelerator_type: GPU_8xH100
+  num_accelerators: 1032
+env_variables:
+  1INVALID: value
diff --git a/acceptance/air/run-submit-databricks-ai/out.test.toml b/acceptance/air/run-submit-databricks-ai/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/air/run-submit-databricks-ai/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/air/run-submit-databricks-ai/output.txt b/acceptance/air/run-submit-databricks-ai/output.txt
new file mode 100644
index 00000000000..dbc134d186b
--- /dev/null
+++ b/acceptance/air/run-submit-databricks-ai/output.txt
@@ -0,0 +1,50 @@
+
+=== submit with a Databricks AI environment and no dependencies
+>>> [CLI] air run -f run.yaml
+Submitting experiment: databricks-ai-v5-smoke
+Submitted workload with Job Run ID: 555
+View job run at: [DATABRICKS_URL]/jobs/runs/555
+
+Tip: use --watch when submitting a run to stream logs to your terminal.
+Stream logs after submission using:
+  databricks air logs 555
+
+=== submit includes the Databricks AI environment version and omits dependencies
+>>> print_requests.py //api/2.2/jobs/runs/submit
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/runs/submit",
+  "body": {
+    "environments": [
+      {
+        "environment_key": "default",
+        "spec": {
+          "base_environment": "workspace-base-environments/databricks_ai_v5"
+        }
+      }
+    ],
+    "idempotency_token": "[UUID]",
+    "run_name": "databricks-ai-v5-smoke",
+    "tasks": [
+      {
+        "ai_runtime_task": {
+          "deployments": [
+            {
+              "command_path": "/Workspace/Users/[USERNAME]/.air/cli_launch/databricks-ai-v5-smoke/databricks-ai-v5-smoke_[RUN_ID]/command.sh",
+              "compute": {
+                "accelerator_count": 1,
+                "accelerator_type": "GPU_1xA10"
+              }
+            }
+          ],
+          "experiment": "databricks-ai-v5-smoke"
+        },
+        "environment_key": "default",
+        "max_retries": 3,
+        "retry_on_timeout": true,
+        "run_if": "ALL_SUCCESS",
+        "task_key": "databricks-ai-v5-smoke"
+      }
+    ]
+  }
+}
diff --git a/acceptance/air/run-submit-databricks-ai/run.yaml b/acceptance/air/run-submit-databricks-ai/run.yaml
new file mode 100644
index 00000000000..d2450730890
--- /dev/null
+++ b/acceptance/air/run-submit-databricks-ai/run.yaml
@@ -0,0 +1,7 @@
+experiment_name: databricks-ai-v5-smoke
+command: python train.py
+compute:
+  accelerator_type: GPU_1xA10
+  num_accelerators: 1
+environment:
+  version: databricks_ai_v5
diff --git a/acceptance/air/run-submit-databricks-ai/script b/acceptance/air/run-submit-databricks-ai/script
new file mode 100644
index 00000000000..94f2ef5250f
--- /dev/null
+++ b/acceptance/air/run-submit-databricks-ai/script
@@ -0,0 +1,5 @@
+title "submit with a Databricks AI environment and no dependencies"
+trace $CLI air run -f run.yaml
+
+title "submit includes the Databricks AI environment version and omits dependencies"
+trace print_requests.py //api/2.2/jobs/runs/submit
diff --git a/acceptance/air/run-submit-databricks-ai/test.toml b/acceptance/air/run-submit-databricks-ai/test.toml
new file mode 100644
index 00000000000..d4e06f111c5
--- /dev/null
+++ b/acceptance/air/run-submit-databricks-ai/test.toml
@@ -0,0 +1,20 @@
+# Verify that a Databricks AI environment version is accepted for submission.
+RecordRequests = true
+
+[[Server]]
+Pattern = "HEAD /"
+Response.Body = ''
+
+[[Server]]
+Pattern = "POST /api/2.0/ai-training/config:validate"
+Response.Body = '{}'
+
+[[Server]]
+Pattern = "POST /api/2.2/jobs/runs/submit"
+Response.Body = '''
+{"run_id": 555}
+'''
+
+[[Repls]]
+Old = 'databricks-ai-v5-smoke_[0-9a-f]{16}'
+New = 'databricks-ai-v5-smoke_[RUN_ID]'
diff --git a/acceptance/air/run-submit-deps/.gitattributes b/acceptance/air/run-submit-deps/.gitattributes
new file mode 100644
index 00000000000..3c92a7ca7ab
--- /dev/null
+++ b/acceptance/air/run-submit-deps/.gitattributes
@@ -0,0 +1,3 @@
+# run.yaml's contents are uploaded verbatim (as training_config.yaml), so its line
+# endings must stay \n on every OS — a Windows \r would change the recorded payload.
+run.yaml text eol=lf
diff --git a/acceptance/air/run-submit-deps/databricks.yml b/acceptance/air/run-submit-deps/databricks.yml
new file mode 100644
index 00000000000..a073ec04b4f
--- /dev/null
+++ b/acceptance/air/run-submit-deps/databricks.yml
@@ -0,0 +1,2 @@
+bundle:
+  name: air-run-submit-deps
diff --git a/acceptance/air/run-submit-deps/out.test.toml b/acceptance/air/run-submit-deps/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/air/run-submit-deps/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/air/run-submit-deps/output.txt b/acceptance/air/run-submit-deps/output.txt
new file mode 100644
index 00000000000..44f1ae35d86
--- /dev/null
+++ b/acceptance/air/run-submit-deps/output.txt
@@ -0,0 +1,68 @@
+
+=== submit with inline dependencies
+>>> [CLI] air run -f run.yaml
+Submitting experiment: deps-smoke
+Submitted workload with Job Run ID: 555
+View job run at: [DATABRICKS_URL]/jobs/runs/555
+
+Tip: use --watch when submitting a run to stream logs to your terminal.
+Stream logs after submission using:
+  databricks air logs 555
+
+=== only config + command are uploaded; no requirements.yaml
+>>> print_requests.py //api/2.0/workspace/import --oneline --sort --unique --keep
+{"method": "POST", "path": "/api/2.0/workspace/import", "body": {"multipart_form": {"content": "experiment_name: deps-smoke\ncommand: python train.py\ncompute:\n    accelerator_type: GPU_1xH100\n    num_accelerators: 1\n    pool_id: capacity-123\nenvironment:\n    version: 5\n    dependencies:\n        - numpy\n        - torch==2.3.0\nmlflow_artifact_location: /Volumes/main/default/air-artifacts\n", "format": "RAW", "overwrite": "true", "path": "/Workspace/Users/[USERNAME]/.air/cli_launch/deps-smoke/deps-smoke_[RUN_ID]/training_config.yaml"}}}
+{"method": "POST", "path": "/api/2.0/workspace/import", "body": {"multipart_form": {"content": "python train.py", "format": "RAW", "overwrite": "true", "path": "/Workspace/Users/[USERNAME]/.air/cli_launch/deps-smoke/deps-smoke_[RUN_ID]/command.sh"}}}
+
+=== inline deps, artifact location, and capacity id reach the submit payload
+>>> print_requests.py //api/2.2/jobs/runs/submit
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/runs/submit",
+  "body": {
+    "environments": [
+      {
+        "environment_key": "default",
+        "spec": {
+          "dependencies": [
+            "numpy",
+            "torch==2.3.0"
+          ],
+          "environment_version": "5"
+        }
+      }
+    ],
+    "idempotency_token": "[UUID]",
+    "run_name": "deps-smoke",
+    "tasks": [
+      {
+        "ai_runtime_task": {
+          "deployments": [
+            {
+              "command_path": "/Workspace/Users/[USERNAME]/.air/cli_launch/deps-smoke/deps-smoke_[RUN_ID]/command.sh",
+              "compute": {
+                "accelerator_count": 1,
+                "accelerator_type": "GPU_1xH100",
+                "provisioned_capacity_id": "capacity-123"
+              }
+            }
+          ],
+          "experiment": "deps-smoke",
+          "mlflow_artifact_location": "dbfs:/Volumes/main/default/air-artifacts"
+        },
+        "environment_key": "default",
+        "max_retries": 3,
+        "retry_on_timeout": true,
+        "run_if": "ALL_SUCCESS",
+        "task_key": "deps-smoke"
+      }
+    ]
+  }
+}
+
+=== a requirements.yaml file path is rejected; deps must be inline
+>>> [CLI] air run -f run-file.yaml
+Error: invalid config run-file.yaml: environment.dependencies must be a list of packages or reference a requirements.txt (see https://docs.databricks.com/aws/en/machine-learning/ai-runtime/cli/yaml-config#reference). A direct file reference is not supported
+
+Tip: use the --debug flag to see more details and a trace of this error:
+  databricks --debug air run …
diff --git a/acceptance/air/run-submit-deps/reqs.yaml b/acceptance/air/run-submit-deps/reqs.yaml
new file mode 100644
index 00000000000..da4b89534c2
--- /dev/null
+++ b/acceptance/air/run-submit-deps/reqs.yaml
@@ -0,0 +1,4 @@
+version: 5
+dependencies:
+  - numpy
+  - torch==2.3.0
diff --git a/acceptance/air/run-submit-deps/run-file.yaml b/acceptance/air/run-submit-deps/run-file.yaml
new file mode 100644
index 00000000000..3e5fe54b7b0
--- /dev/null
+++ b/acceptance/air/run-submit-deps/run-file.yaml
@@ -0,0 +1,7 @@
+experiment_name: deps-file-smoke
+command: python train.py
+compute:
+  accelerator_type: GPU_1xH100
+  num_accelerators: 1
+environment:
+  dependencies: ./reqs.yaml
diff --git a/acceptance/air/run-submit-deps/run.yaml b/acceptance/air/run-submit-deps/run.yaml
new file mode 100644
index 00000000000..deb17acf080
--- /dev/null
+++ b/acceptance/air/run-submit-deps/run.yaml
@@ -0,0 +1,12 @@
+experiment_name: deps-smoke
+command: python train.py
+compute:
+  accelerator_type: GPU_1xH100
+  num_accelerators: 1
+  pool_id: capacity-123
+environment:
+  version: 5
+  dependencies:
+    - numpy
+    - torch==2.3.0
+mlflow_artifact_location: /Volumes/main/default/air-artifacts
diff --git a/acceptance/air/run-submit-deps/script b/acceptance/air/run-submit-deps/script
new file mode 100644
index 00000000000..0e8951cae0f
--- /dev/null
+++ b/acceptance/air/run-submit-deps/script
@@ -0,0 +1,14 @@
+title "submit with inline dependencies"
+trace $CLI air run -f run.yaml
+
+title "only config + command are uploaded; no requirements.yaml"
+# Uploads go to POST /workspace/import, which carries the target filename in the
+# multipart body rather than the URL, so each uploaded path shows up under
+# body.multipart_form.path instead of in the request path.
+trace print_requests.py //api/2.0/workspace/import --oneline --sort --unique --keep
+
+title "inline deps, artifact location, and capacity id reach the submit payload"
+trace print_requests.py //api/2.2/jobs/runs/submit
+
+title "a requirements.yaml file path is rejected; deps must be inline"
+musterr trace $CLI air run -f run-file.yaml
diff --git a/acceptance/air/run-submit-deps/test.toml b/acceptance/air/run-submit-deps/test.toml
new file mode 100644
index 00000000000..097eb39d8c9
--- /dev/null
+++ b/acceptance/air/run-submit-deps/test.toml
@@ -0,0 +1,27 @@
+# A non-dry-run submit with inline dependencies (no code_source): asserts the deps
+# land on spec.dependencies and that requirements.yaml is not uploaded.
+RecordRequests = true
+
+# The SDK probes host reachability with a HEAD request; stub it for determinism.
+[[Server]]
+Pattern = "HEAD /"
+Response.Body = ''
+
+[[Server]]
+Pattern = "POST /api/2.0/ai-training/config:validate"
+Response.Body = '{}'
+
+[[Server]]
+Pattern = "POST /api/2.2/jobs/runs/submit"
+Response.Body = '''
+{"run_id": 555}
+'''
+
+# The per-run launch directory ends in <run>_<16 hex>; the random suffix varies.
+[[Repls]]
+Old = 'deps-smoke_[0-9a-f]{16}'
+New = 'deps-smoke_[RUN_ID]'
+
+[[Repls]]
+Old = 'deps-file-smoke_[0-9a-f]{16}'
+New = 'deps-file-smoke_[RUN_ID]'
diff --git a/acceptance/air/run-submit-overrides/.gitattributes b/acceptance/air/run-submit-overrides/.gitattributes
new file mode 100644
index 00000000000..397b0d1049a
--- /dev/null
+++ b/acceptance/air/run-submit-overrides/.gitattributes
@@ -0,0 +1 @@
+run.yaml text eol=lf
diff --git a/acceptance/air/run-submit-overrides/databricks.yml b/acceptance/air/run-submit-overrides/databricks.yml
new file mode 100644
index 00000000000..63f3b133274
--- /dev/null
+++ b/acceptance/air/run-submit-overrides/databricks.yml
@@ -0,0 +1,2 @@
+bundle:
+  name: air-run-submit-overrides
diff --git a/acceptance/air/run-submit-overrides/out.test.toml b/acceptance/air/run-submit-overrides/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/air/run-submit-overrides/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/air/run-submit-overrides/output.txt b/acceptance/air/run-submit-overrides/output.txt
new file mode 100644
index 00000000000..5ab207a7e3b
--- /dev/null
+++ b/acceptance/air/run-submit-overrides/output.txt
@@ -0,0 +1,19 @@
+
+=== submit with nested overrides
+>>> [CLI] air run -f run.yaml --override compute.num_accelerators=2 --override parameters.model.hidden_size=2048 --override parameters.optimizer.learning_rate=0.001
+Override: changing compute.num_accelerators from 1 to 2
+Override: changing parameters.model.hidden_size from 1024 to 2048
+Override: setting parameters.optimizer.learning_rate to 0.001
+Submitting experiment: overrides-smoke
+Submitted workload with Job Run ID: 555
+View job run at: [DATABRICKS_URL]/jobs/runs/555
+
+Tip: use --watch when submitting a run to stream logs to your terminal.
+Stream logs after submission using:
+  databricks air logs 555
+
+=== the uploaded config preserves source order and contains overrides
+>>> print_requests.py //api/2.0/workspace/import --oneline --sort --unique
+{"method": "POST", "path": "/api/2.0/workspace/import", "body": {"multipart_form": {"content": "experiment_name: overrides-smoke\ncommand: python train.py\ncompute:\n    accelerator_type: GPU_1xH100\n    num_accelerators: 2\nparameters:\n    model:\n        hidden_size: 2048\n    optimizer:\n        name: adamw\n        learning_rate: 0.001\nmlflow_artifact_location: /Volumes/main/default/air-artifacts\n", "format": "RAW", "overwrite": "true", "path": "/Workspace/Users/[USERNAME]/.air/cli_launch/overrides-smoke/overrides-smoke_[RUN_ID]/training_config.yaml"}}}
+{"method": "POST", "path": "/api/2.0/workspace/import", "body": {"multipart_form": {"content": "model:\n    hidden_size: 2048\noptimizer:\n    learning_rate: 0.001\n    name: adamw\n", "format": "RAW", "overwrite": "true", "path": "/Workspace/Users/[USERNAME]/.air/cli_launch/overrides-smoke/overrides-smoke_[RUN_ID]/hyperparameters.yaml"}}}
+{"method": "POST", "path": "/api/2.0/workspace/import", "body": {"multipart_form": {"content": "python train.py", "format": "RAW", "overwrite": "true", "path": "/Workspace/Users/[USERNAME]/.air/cli_launch/overrides-smoke/overrides-smoke_[RUN_ID]/command.sh"}}}
diff --git a/acceptance/air/run-submit-overrides/run.yaml b/acceptance/air/run-submit-overrides/run.yaml
new file mode 100644
index 00000000000..4a380c4903e
--- /dev/null
+++ b/acceptance/air/run-submit-overrides/run.yaml
@@ -0,0 +1,11 @@
+experiment_name: overrides-smoke
+command: python train.py
+compute:
+  accelerator_type: GPU_1xH100
+  num_accelerators: 1
+parameters:
+  model:
+    hidden_size: 1024
+  optimizer:
+    name: adamw
+mlflow_artifact_location: /Volumes/main/default/air-artifacts
diff --git a/acceptance/air/run-submit-overrides/script b/acceptance/air/run-submit-overrides/script
new file mode 100644
index 00000000000..59234b5e874
--- /dev/null
+++ b/acceptance/air/run-submit-overrides/script
@@ -0,0 +1,8 @@
+title "submit with nested overrides"
+trace $CLI air run -f run.yaml \
+  --override compute.num_accelerators=2 \
+  --override parameters.model.hidden_size=2048 \
+  --override parameters.optimizer.learning_rate=0.001
+
+title "the uploaded config preserves source order and contains overrides"
+trace print_requests.py //api/2.0/workspace/import --oneline --sort --unique
diff --git a/acceptance/air/run-submit-overrides/test.toml b/acceptance/air/run-submit-overrides/test.toml
new file mode 100644
index 00000000000..da8c9be0f7d
--- /dev/null
+++ b/acceptance/air/run-submit-overrides/test.toml
@@ -0,0 +1,21 @@
+# A non-dry-run submit that verifies training_config.yaml preserves source order
+# and contains nested command-line overrides.
+RecordRequests = true
+
+[[Server]]
+Pattern = "HEAD /"
+Response.Body = ''
+
+[[Server]]
+Pattern = "POST /api/2.0/ai-training/config:validate"
+Response.Body = '{}'
+
+[[Server]]
+Pattern = "POST /api/2.2/jobs/runs/submit"
+Response.Body = '''
+{"run_id": 555}
+'''
+
+[[Repls]]
+Old = 'overrides-smoke_[0-9a-f]{16}'
+New = 'overrides-smoke_[RUN_ID]'
diff --git a/acceptance/air/run-submit/b300.yaml b/acceptance/air/run-submit/b300.yaml
new file mode 100644
index 00000000000..c69924cbcde
--- /dev/null
+++ b/acceptance/air/run-submit/b300.yaml
@@ -0,0 +1,9 @@
+experiment_name: b300-submit-smoke
+command: nvidia-smi
+compute:
+  accelerator_type: GPU_8xB300
+  num_accelerators: 8
+environment:
+  version: 6
+  dependencies: []
+max_retries: 0
diff --git a/acceptance/air/run-submit/databricks.yml b/acceptance/air/run-submit/databricks.yml
new file mode 100644
index 00000000000..4a1c612d600
--- /dev/null
+++ b/acceptance/air/run-submit/databricks.yml
@@ -0,0 +1,2 @@
+bundle:
+  name: air-run-submit
diff --git a/acceptance/air/run-submit/out.test.toml b/acceptance/air/run-submit/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/air/run-submit/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/air/run-submit/output.txt b/acceptance/air/run-submit/output.txt
new file mode 100644
index 00000000000..516c4f122d7
--- /dev/null
+++ b/acceptance/air/run-submit/output.txt
@@ -0,0 +1,155 @@
+
+=== submit with a git code_source
+>>> [CLI] air run -f run.yaml
+Submitting experiment: submit-smoke
+Uploading [SNAPSHOT_TARBALL]...
+Submitted workload with Job Run ID: 555
+View job run at: [DATABRICKS_URL]/jobs/runs/555
+
+Tip: use --watch when submitting a run to stream logs to your terminal.
+Stream logs after submission using:
+  databricks air logs 555
+
+=== the ai_runtime_task and additive job + experiment permission grants
+>>> print_requests.py --get //api/2.2/jobs/runs/submit //api/2.2/jobs/runs/get //api/2.0/permissions //api/2.0/mlflow --sort --unique
+{
+  "method": "GET",
+  "path": "/api/2.2/jobs/runs/get",
+  "q": {
+    "run_id": "555"
+  }
+}
+{
+  "method": "GET",
+  "path": "/api/2.2/jobs/runs/get-output",
+  "q": {
+    "run_id": "456"
+  }
+}
+{
+  "method": "PATCH",
+  "path": "/api/2.0/permissions/experiments/42",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "CAN_MANAGE",
+        "user_name": "alice@example.com"
+      },
+      {
+        "group_name": "data-team",
+        "permission_level": "CAN_READ"
+      },
+      {
+        "permission_level": "CAN_EDIT",
+        "service_principal_name": "training-sp"
+      }
+    ]
+  }
+}
+{
+  "method": "PATCH",
+  "path": "/api/2.0/permissions/jobs/123",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "CAN_MANAGE",
+        "user_name": "alice@example.com"
+      },
+      {
+        "group_name": "data-team",
+        "permission_level": "CAN_VIEW"
+      },
+      {
+        "permission_level": "CAN_MANAGE_RUN",
+        "service_principal_name": "training-sp"
+      }
+    ]
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/runs/submit",
+  "body": {
+    "environments": [
+      {
+        "environment_key": "default",
+        "spec": {
+          "environment_version": "6"
+        }
+      }
+    ],
+    "idempotency_token": "[UUID]",
+    "run_name": "submit-smoke",
+    "tasks": [
+      {
+        "ai_runtime_task": {
+          "code_source_path": "/Workspace/Users/[USERNAME]/.air/repo_snapshots/.internal/[SNAPSHOT_TARBALL]",
+          "deployments": [
+            {
+              "command_path": "/Workspace/Users/[USERNAME]/.air/cli_launch/submit-smoke/submit-smoke_[RUN_ID]/command.sh",
+              "compute": {
+                "accelerator_count": 1,
+                "accelerator_type": "GPU_1xH100"
+              }
+            }
+          ],
+          "experiment": "submit-smoke"
+        },
+        "environment_key": "default",
+        "max_retries": 3,
+        "retry_on_timeout": true,
+        "run_if": "ALL_SUCCESS",
+        "task_key": "submit-smoke"
+      }
+    ]
+  }
+}
+
+=== submit a B300 workload with AI Runtime 6
+>>> [CLI] air run -f b300.yaml
+Submitting experiment: b300-submit-smoke
+Submitted workload with Job Run ID: 555
+View job run at: [DATABRICKS_URL]/jobs/runs/555
+
+Tip: use --watch when submitting a run to stream logs to your terminal.
+Stream logs after submission using:
+  databricks air logs 555
+
+=== the B300 accelerator and runtime reach the submit payload
+>>> print_requests.py //api/2.2/jobs/runs/submit
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/runs/submit",
+  "body": {
+    "environments": [
+      {
+        "environment_key": "default",
+        "spec": {
+          "environment_version": "6"
+        }
+      }
+    ],
+    "idempotency_token": "[UUID]",
+    "run_name": "b300-submit-smoke",
+    "tasks": [
+      {
+        "ai_runtime_task": {
+          "deployments": [
+            {
+              "command_path": "/Workspace/Users/[USERNAME]/.air/cli_launch/b300-submit-smoke/b300-submit-smoke_[RUN_ID]/command.sh",
+              "compute": {
+                "accelerator_count": 8,
+                "accelerator_type": "GPU_8xB300"
+              }
+            }
+          ],
+          "experiment": "b300-submit-smoke"
+        },
+        "environment_key": "default",
+        "max_retries": 0,
+        "run_if": "ALL_SUCCESS",
+        "task_key": "b300-submit-smoke"
+      }
+    ]
+  }
+}
diff --git a/acceptance/air/run-submit/run.yaml.tmpl b/acceptance/air/run-submit/run.yaml.tmpl
new file mode 100644
index 00000000000..aab6a868e63
--- /dev/null
+++ b/acceptance/air/run-submit/run.yaml.tmpl
@@ -0,0 +1,18 @@
+experiment_name: submit-smoke
+command: python train.py
+compute:
+  accelerator_type: GPU_1xH100
+  num_accelerators: 1
+permissions:
+  - user_name: alice@example.com
+    level: CAN_MANAGE
+  - group_name: data-team
+    level: CAN_VIEW
+  - service_principal_name: training-sp
+    level: CAN_MANAGE_RUN
+code_source:
+  type: snapshot
+  snapshot:
+    root_path: .
+    git:
+      commit: COMMIT_SHA
diff --git a/acceptance/air/run-submit/script b/acceptance/air/run-submit/script
new file mode 100644
index 00000000000..50627f98b21
--- /dev/null
+++ b/acceptance/air/run-submit/script
@@ -0,0 +1,27 @@
+# Pinned commit dates keep the resolved HEAD SHA — and thus the snapshot cache key
+# baked into the tarball name — stable across runs.
+export GIT_AUTHOR_DATE="2020-01-01T00:00:00Z"
+export GIT_COMMITTER_DATE="2020-01-01T00:00:00Z"
+git-repo-init
+
+# Pin the config to the committed HEAD. git.commit tolerates a dirty working tree
+# (the pinned revision is what gets archived), which matters here because this
+# script generates run.yaml in the working dir after the commit.
+sed "s/COMMIT_SHA/$(git rev-parse HEAD)/" run.yaml.tmpl > run.yaml
+
+title "submit with a git code_source"
+trace $CLI air run -f run.yaml
+
+title "the ai_runtime_task and additive job + experiment permission grants"
+# Job permissions are set remotely; the run's experiment id comes from
+# runs/get-output and gets the same grants client-side, with job levels mapped to
+# experiment levels.
+trace print_requests.py --get //api/2.2/jobs/runs/submit //api/2.2/jobs/runs/get //api/2.0/permissions //api/2.0/mlflow --sort --unique
+
+title "submit a B300 workload with AI Runtime 6"
+trace $CLI air run -f b300.yaml
+
+title "the B300 accelerator and runtime reach the submit payload"
+trace print_requests.py //api/2.2/jobs/runs/submit
+
+rm -fr .git
diff --git a/acceptance/air/run-submit/test.toml b/acceptance/air/run-submit/test.toml
new file mode 100644
index 00000000000..07c481e24b5
--- /dev/null
+++ b/acceptance/air/run-submit/test.toml
@@ -0,0 +1,56 @@
+# A real (non-dry-run) submit that packages a git code_source, uploads the
+# tarball + provenance sidecars, and POSTs runs/submit.
+RecordRequests = true
+
+# run.yaml is generated from run.yaml.tmpl at test time (commit SHA templated in);
+# it isn't a committed input to diff.
+Ignore = ["run.yaml"]
+
+# The SDK probes host reachability with a HEAD request; stub it for determinism.
+[[Server]]
+Pattern = "HEAD /"
+Response.Body = ''
+
+[[Server]]
+Pattern = "POST /api/2.0/ai-training/config:validate"
+Response.Body = '{}'
+
+[[Server]]
+Pattern = "POST /api/2.2/jobs/runs/submit"
+Response.Body = '''
+{"run_id": 555}
+'''
+
+[[Server]]
+Pattern = "GET /api/2.2/jobs/runs/get"
+Response.Body = '''
+{"job_id":123,"run_id":555,"tasks":[{"run_id":456,"ai_runtime_task":{"experiment":"submit-smoke"}}]}
+'''
+
+[[Server]]
+Pattern = "PATCH /api/2.0/permissions/jobs/123"
+Response.Body = '{}'
+
+# The run's MLflow experiment id comes from runs/get-output (keyed by the task
+# run id); the CLI grants the same ACLs on that experiment, with job levels
+# mapped to experiment levels.
+[[Server]]
+Pattern = "GET /api/2.2/jobs/runs/get-output"
+Response.Body = '{"ai_runtime_task_output":{"mlflow_experiment_id":"42"}}'
+
+[[Server]]
+Pattern = "PATCH /api/2.0/permissions/experiments/42"
+Response.Body = '{}'
+
+# The snapshot tarball is named <dir>_<cachekey[:16]>.tar.gz, where <dir> is the
+# test's temp-dir basename and the cache key derives from the pinned commit SHA.
+# Both are stable given the pinned commit dates in the script, but the temp-dir
+# basename varies per run, so collapse the whole tarball filename to a stable token.
+[[Repls]]
+Old = '[a-zA-Z0-9._-]+_[0-9a-f]{16}\.tar\.gz'
+New = '[SNAPSHOT_TARBALL]'
+
+# The per-run launch directory ends in <run>_<16 hex>; the random suffix varies.
+[[Repls]]
+Old = 'submit-smoke_[0-9a-f]{16}'
+New = 'submit-smoke_[RUN_ID]'
diff --git a/acceptance/air/run/git-remote.yaml b/acceptance/air/run/git-remote.yaml
new file mode 100644
index 00000000000..0161fe14972
--- /dev/null
+++ b/acceptance/air/run/git-remote.yaml
@@ -0,0 +1,12 @@
+experiment_name: smoke-test
+command: python train.py
+compute:
+  accelerator_type: GPU_1xH100
+  num_accelerators: 1
+code_source:
+  type: snapshot
+  snapshot:
+    root_path: .
+    git:
+      branch: main
+      remote: origin
diff --git a/acceptance/air/run/invalid.yaml b/acceptance/air/run/invalid.yaml
new file mode 100644
index 00000000000..c011fc81b37
--- /dev/null
+++ b/acceptance/air/run/invalid.yaml
@@ -0,0 +1,5 @@
+experiment_name: bad.name
+command: x
+compute:
+  accelerator_type: GPU_8xH100
+  num_accelerators: 3
diff --git a/acceptance/air/run/out.test.toml b/acceptance/air/run/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/air/run/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/air/run/output.txt b/acceptance/air/run/output.txt
new file mode 100644
index 00000000000..1f59b17b246
--- /dev/null
+++ b/acceptance/air/run/output.txt
@@ -0,0 +1,78 @@
+
+=== dry-run (text)
+>>> [CLI] air run -f valid.yaml --dry-run
+Dry run: configuration for "smoke-test" is valid; not submitting.
+
+=== dry-run (json)
+>>> [CLI] air run -f valid.yaml --dry-run -o json
+{
+  "v": 1,
+  "ts": "[TIMESTAMP]",
+  "data": {
+    "status": "DRY_RUN_OK",
+    "dry_run": true
+  }
+}
+
+=== override applies and logs the change
+>>> [CLI] air run -f valid.yaml --dry-run --override compute.num_accelerators=2 --override timeout_minutes=45
+Override: changing compute.num_accelerators from 1 to 2
+Override: setting timeout_minutes to 45
+Dry run: configuration for "smoke-test" is valid; not submitting.
+
+=== override of an unknown field is rejected
+>>> [CLI] air run -f valid.yaml --dry-run --override bogus=1
+Error: invalid --override "bogus": "bogus" is not a known field; available fields are: code_source, command, compute, containers, env_variables, environment, experiment_name, idempotency_token, max_retries, mlflow_artifact_location, mlflow_experiment_directory, mlflow_run_name, parameters, permissions, secrets, timeout_minutes, usage_policy_id, usage_policy_name
+
+Tip: use the --debug flag to see more details and a trace of this error:
+  databricks --debug air run …
+
+Exit code: 1
+
+=== override still runs schema validation
+>>> [CLI] air run -f valid.yaml --dry-run --override compute.num_accelerators=0
+Override: changing compute.num_accelerators from 1 to 0
+Error: compute.num_accelerators must be positive, got 0
+
+Tip: use the --debug flag to see more details and a trace of this error:
+  databricks --debug air run …
+
+Exit code: 1
+
+=== watch is ignored with dry-run (nothing is submitted)
+>>> [CLI] air run -f valid.yaml --dry-run --watch
+Dry run: configuration for "smoke-test" is valid; not submitting.
+
+=== code_source config passes validation
+>>> [CLI] air run -f with-code-source.yaml --dry-run
+Dry run: configuration for "smoke-test" is valid; not submitting.
+
+=== git.remote is rejected
+>>> [CLI] air run -f git-remote.yaml --dry-run
+Error: git.remote is no longer supported: the snapshot archives your local copy, so a branch resolves to its local HEAD. To deploy a specific committed revision, use git.commit
+
+Tip: use the --debug flag to see more details and a trace of this error:
+  databricks --debug air run …
+
+Exit code: 1
+
+=== invalid config is rejected
+>>> [CLI] air run -f invalid.yaml --dry-run
+Error: invalid experiment_name "bad.name": only alphanumeric characters, hyphens (-), and underscores (_) are allowed
+
+Tip: use the --debug flag to see more details and a trace of this error:
+  databricks --debug air run …
+
+Exit code: 1
+
+=== missing --file
+>>> [CLI] air run --dry-run
+Error: required flag(s) "file" not set
+
+Exit code: 1
+
+=== experimental path directs users to the top-level command
+>>> [CLI] experimental air run -f valid.yaml --dry-run
+Error: the AIR commands have moved out of experimental; use "databricks air" instead
+
+Exit code: 1
diff --git a/acceptance/air/run/script b/acceptance/air/run/script
new file mode 100644
index 00000000000..835d78f6928
--- /dev/null
+++ b/acceptance/air/run/script
@@ -0,0 +1,32 @@
+title "dry-run (text)"
+trace $CLI air run -f valid.yaml --dry-run
+
+title "dry-run (json)"
+trace $CLI air run -f valid.yaml --dry-run -o json
+
+title "override applies and logs the change"
+trace $CLI air run -f valid.yaml --dry-run --override compute.num_accelerators=2 --override timeout_minutes=45
+
+title "override of an unknown field is rejected"
+errcode trace $CLI air run -f valid.yaml --dry-run --override bogus=1
+
+title "override still runs schema validation"
+errcode trace $CLI air run -f valid.yaml --dry-run --override compute.num_accelerators=0
+
+title "watch is ignored with dry-run (nothing is submitted)"
+trace $CLI air run -f valid.yaml --dry-run --watch
+
+title "code_source config passes validation"
+trace $CLI air run -f with-code-source.yaml --dry-run
+
+title "git.remote is rejected"
+errcode trace $CLI air run -f git-remote.yaml --dry-run
+
+title "invalid config is rejected"
+errcode trace $CLI air run -f invalid.yaml --dry-run
+
+title "missing --file"
+errcode trace $CLI air run --dry-run
+
+title "experimental path directs users to the top-level command"
+errcode trace $CLI experimental air run -f valid.yaml --dry-run
diff --git a/acceptance/air/run/test.toml b/acceptance/air/run/test.toml
new file mode 100644
index 00000000000..3daed6e5e2c
--- /dev/null
+++ b/acceptance/air/run/test.toml
@@ -0,0 +1,3 @@
+[[Server]]
+Pattern = "POST /api/2.0/ai-training/config:validate"
+Response.Body = '{}'
diff --git a/acceptance/air/run/valid.yaml b/acceptance/air/run/valid.yaml
new file mode 100644
index 00000000000..b82a321b051
--- /dev/null
+++ b/acceptance/air/run/valid.yaml
@@ -0,0 +1,5 @@
+experiment_name: smoke-test
+command: python train.py
+compute:
+  accelerator_type: GPU_1xH100
+  num_accelerators: 1
diff --git a/acceptance/air/run/with-code-source.yaml b/acceptance/air/run/with-code-source.yaml
new file mode 100644
index 00000000000..86a32c138cb
--- /dev/null
+++ b/acceptance/air/run/with-code-source.yaml
@@ -0,0 +1,13 @@
+experiment_name: smoke-test
+command: python train.py
+compute:
+  accelerator_type: GPU_1xH100
+  num_accelerators: 1
+code_source:
+  type: snapshot
+  snapshot:
+    root_path: .
+    git:
+      branch: main
+    include_paths:
+      - src
diff --git a/acceptance/apps/deploy/bundle-no-args-with-flags/out.test.toml b/acceptance/apps/deploy/bundle-no-args-with-flags/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/apps/deploy/bundle-no-args-with-flags/out.test.toml
+++ b/acceptance/apps/deploy/bundle-no-args-with-flags/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/apps/deploy/bundle-no-args-with-flags/output.txt b/acceptance/apps/deploy/bundle-no-args-with-flags/output.txt
index 5c655deef1e..43c1fbfd8b3 100644
--- a/acceptance/apps/deploy/bundle-no-args-with-flags/output.txt
+++ b/acceptance/apps/deploy/bundle-no-args-with-flags/output.txt
@@ -2,11 +2,11 @@
 >>> [CLI] apps deploy --skip-validation --auto-approve --force-lock --fail-on-active-runs
 Deploying project...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created apps.myapp
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 ✓ Getting the status of the app myapp
-✓ App is in RUNNING state
+✓ App is in UNAVAILABLE state
 ✓ App compute is in STOPPED state
 ✓ Starting the app myapp
 ✓ App is starting...
@@ -21,5 +21,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/apps/deploy/bundle-no-args-with-flags/test.toml b/acceptance/apps/deploy/bundle-no-args-with-flags/test.toml
index 4f08257f91b..3f38f3e1797 100644
--- a/acceptance/apps/deploy/bundle-no-args-with-flags/test.toml
+++ b/acceptance/apps/deploy/bundle-no-args-with-flags/test.toml
@@ -1,13 +1,9 @@
-Local = true
 Cloud = false
 
 Ignore = [
     '.databricks',
 ]
 
-[EnvMatrix]
-  DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
-
 [[Server]]
 Pattern = "POST /api/2.0/apps/myapp/deployments"
 Response.Body = '''
diff --git a/acceptance/apps/deploy/bundle-no-args/out.test.toml b/acceptance/apps/deploy/bundle-no-args/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/apps/deploy/bundle-no-args/out.test.toml
+++ b/acceptance/apps/deploy/bundle-no-args/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/apps/deploy/bundle-no-args/output.txt b/acceptance/apps/deploy/bundle-no-args/output.txt
index d6c98f85351..8aad2dbae4c 100644
--- a/acceptance/apps/deploy/bundle-no-args/output.txt
+++ b/acceptance/apps/deploy/bundle-no-args/output.txt
@@ -2,11 +2,11 @@
 >>> [CLI] apps deploy --skip-validation
 Deploying project...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created apps.myapp
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 ✓ Getting the status of the app myapp
-✓ App is in RUNNING state
+✓ App is in UNAVAILABLE state
 ✓ App compute is in STOPPED state
 ✓ Starting the app myapp
 ✓ App is starting...
@@ -21,5 +21,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/apps/deploy/bundle-no-args/test.toml b/acceptance/apps/deploy/bundle-no-args/test.toml
index 4f08257f91b..3f38f3e1797 100644
--- a/acceptance/apps/deploy/bundle-no-args/test.toml
+++ b/acceptance/apps/deploy/bundle-no-args/test.toml
@@ -1,13 +1,9 @@
-Local = true
 Cloud = false
 
 Ignore = [
     '.databricks',
 ]
 
-[EnvMatrix]
-  DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
-
 [[Server]]
 Pattern = "POST /api/2.0/apps/myapp/deployments"
 Response.Body = '''
diff --git a/acceptance/apps/deploy/bundle-with-appname/out.requests.txt b/acceptance/apps/deploy/bundle-with-appname/out.requests.txt
deleted file mode 100644
index 4e01ce32704..00000000000
--- a/acceptance/apps/deploy/bundle-with-appname/out.requests.txt
+++ /dev/null
@@ -1,9 +0,0 @@
-{
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/apps/test-app/deployments",
-  "body": {}
-}
diff --git a/acceptance/apps/deploy/bundle-with-appname/out.test.toml b/acceptance/apps/deploy/bundle-with-appname/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/apps/deploy/bundle-with-appname/out.test.toml
+++ b/acceptance/apps/deploy/bundle-with-appname/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/apps/deploy/bundle-with-appname/output.txt b/acceptance/apps/deploy/bundle-with-appname/output.txt
index 59e34f264c4..73b77d480cd 100644
--- a/acceptance/apps/deploy/bundle-with-appname/output.txt
+++ b/acceptance/apps/deploy/bundle-with-appname/output.txt
@@ -9,3 +9,10 @@
     "state": "PENDING"
   }
 }
+
+>>> print_requests.py //apps
+{
+  "method": "POST",
+  "path": "/api/2.0/apps/test-app/deployments",
+  "body": {}
+}
diff --git a/acceptance/apps/deploy/bundle-with-appname/script b/acceptance/apps/deploy/bundle-with-appname/script
index 8dac818a074..cf5f53c351c 100644
--- a/acceptance/apps/deploy/bundle-with-appname/script
+++ b/acceptance/apps/deploy/bundle-with-appname/script
@@ -1,3 +1,5 @@
 # Test: apps deploy with APP_NAME in a bundle directory
 # Expected: Falls back to API deploy (ignores bundle, no validation)
 trace $CLI apps deploy test-app --no-wait
+
+trace print_requests.py //apps
diff --git a/acceptance/apps/deploy/bundle-with-appname/test.toml b/acceptance/apps/deploy/bundle-with-appname/test.toml
index 02fcc70b527..20906ff8378 100644
--- a/acceptance/apps/deploy/bundle-with-appname/test.toml
+++ b/acceptance/apps/deploy/bundle-with-appname/test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
 RecordRequests = true
 
diff --git a/acceptance/apps/deploy/no-bundle-no-args/out.test.toml b/acceptance/apps/deploy/no-bundle-no-args/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/apps/deploy/no-bundle-no-args/out.test.toml
+++ b/acceptance/apps/deploy/no-bundle-no-args/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/apps/deploy/no-bundle-no-args/output.txt b/acceptance/apps/deploy/no-bundle-no-args/output.txt
index affcf94d8f5..9a96c4a49b8 100644
--- a/acceptance/apps/deploy/no-bundle-no-args/output.txt
+++ b/acceptance/apps/deploy/no-bundle-no-args/output.txt
@@ -1,3 +1,7 @@
-Error: accepts 1 arg(s), received 0
+Error: missing required argument: APP_NAME
 
-Exit code: 1
+Usage: databricks apps deploy APP_NAME
+
+APP_NAME is the name of the Databricks app to operate on.
+Alternatively, run this command from a project directory containing
+databricks.yml to auto-detect the app name.
diff --git a/acceptance/apps/deploy/no-bundle-no-args/script b/acceptance/apps/deploy/no-bundle-no-args/script
index 7161d5f742f..11862a782d2 100644
--- a/acceptance/apps/deploy/no-bundle-no-args/script
+++ b/acceptance/apps/deploy/no-bundle-no-args/script
@@ -1,3 +1,3 @@
 # Test: apps deploy without databricks.yml and no APP_NAME
 # Expected: Error about missing argument
-errcode $CLI apps deploy
+musterr $CLI apps deploy
diff --git a/acceptance/apps/deploy/no-bundle-no-args/test.toml b/acceptance/apps/deploy/no-bundle-no-args/test.toml
deleted file mode 100644
index 7d36fb9dc18..00000000000
--- a/acceptance/apps/deploy/no-bundle-no-args/test.toml
+++ /dev/null
@@ -1,2 +0,0 @@
-Local = true
-Cloud = false
diff --git a/acceptance/apps/deploy/no-bundle-with-appname/out.requests.txt b/acceptance/apps/deploy/no-bundle-with-appname/out.requests.txt
deleted file mode 100644
index 4e01ce32704..00000000000
--- a/acceptance/apps/deploy/no-bundle-with-appname/out.requests.txt
+++ /dev/null
@@ -1,9 +0,0 @@
-{
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/apps/test-app/deployments",
-  "body": {}
-}
diff --git a/acceptance/apps/deploy/no-bundle-with-appname/out.test.toml b/acceptance/apps/deploy/no-bundle-with-appname/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/apps/deploy/no-bundle-with-appname/out.test.toml
+++ b/acceptance/apps/deploy/no-bundle-with-appname/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/apps/deploy/no-bundle-with-appname/output.txt b/acceptance/apps/deploy/no-bundle-with-appname/output.txt
index 59e34f264c4..73b77d480cd 100644
--- a/acceptance/apps/deploy/no-bundle-with-appname/output.txt
+++ b/acceptance/apps/deploy/no-bundle-with-appname/output.txt
@@ -9,3 +9,10 @@
     "state": "PENDING"
   }
 }
+
+>>> print_requests.py //apps
+{
+  "method": "POST",
+  "path": "/api/2.0/apps/test-app/deployments",
+  "body": {}
+}
diff --git a/acceptance/apps/deploy/no-bundle-with-appname/script b/acceptance/apps/deploy/no-bundle-with-appname/script
index 628866514f7..e5135b16605 100644
--- a/acceptance/apps/deploy/no-bundle-with-appname/script
+++ b/acceptance/apps/deploy/no-bundle-with-appname/script
@@ -1,3 +1,5 @@
 # Test: apps deploy with APP_NAME but without databricks.yml
 # Expected: Normal API deploy using apps deploy API
 trace $CLI apps deploy test-app --no-wait
+
+trace print_requests.py //apps
diff --git a/acceptance/apps/deploy/no-bundle-with-appname/test.toml b/acceptance/apps/deploy/no-bundle-with-appname/test.toml
index 02fcc70b527..20906ff8378 100644
--- a/acceptance/apps/deploy/no-bundle-with-appname/test.toml
+++ b/acceptance/apps/deploy/no-bundle-with-appname/test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
 RecordRequests = true
 
diff --git a/acceptance/apps/deploy/test.toml b/acceptance/apps/deploy/test.toml
deleted file mode 100644
index 743db70ac76..00000000000
--- a/acceptance/apps/deploy/test.toml
+++ /dev/null
@@ -1 +0,0 @@
-# Common configuration for apps deploy tests
diff --git a/acceptance/apps/init/auth-mode/out.test.toml b/acceptance/apps/init/auth-mode/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/apps/init/auth-mode/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/apps/init/auth-mode/output.txt b/acceptance/apps/init/auth-mode/output.txt
new file mode 100644
index 00000000000..19ee20452c9
--- /dev/null
+++ b/acceptance/apps/init/auth-mode/output.txt
@@ -0,0 +1,417 @@
+
+=== Default: every resource bound to the service principal
+>>> [CLI] apps init --template ./template --skip-install --name app-sp --features analytics,genie,jobs --set analytics.sql-warehouse.id=wh1 --set genie.genie-space.id=g1 --set genie.genie-space.name=gs --set jobs.job.id=42 --set jobs.secret.scope=s --set jobs.secret.key=k
+✔ Creating project
+
+✔ Project created successfully!
+
+  Location: [TEST_TMP_DIR]/app-sp
+  Files: 3
+
+command: ['npm', 'run', 'start']
+env:
+  - name: DATABRICKS_WAREHOUSE_ID
+    valueFrom: sql-warehouse
+  - name: DATABRICKS_GENIE_SPACE_ID
+    valueFrom: genie-space
+  - name: DATABRICKS_JOB_ID
+    valueFrom: job
+  - name: SECRET_KEY
+    valueFrom: secret
+  - name: SECRET_SCOPE
+    valueFrom: secret
+bundle:
+  name: app-sp
+
+variables:
+  sql_warehouse_id:
+    description: SQL Warehouse ID
+  genie_space_id:
+    description: Genie Space ID
+  genie_space_name:
+    description: Genie Space name
+  job_id:
+    description: Job ID
+  secret_key:
+    description: Job token
+  secret_scope:
+    description: Job token
+
+resources:
+  apps:
+    app:
+      name: "app-sp"
+      description: "A Databricks App powered by AppKit"
+      source_code_path: ./
+
+      # Start the app automatically on deploy.
+      lifecycle:
+        started: true
+      user_api_scopes:
+        - dashboards.genie
+
+      # The resources which this app has access to.
+      resources:
+        - name: sql-warehouse
+          sql_warehouse:
+            id: ${var.sql_warehouse_id}
+            permission: CAN_USE
+        - name: genie-space
+          genie_space:
+            name: ${var.genie_space_name}
+            space_id: ${var.genie_space_id}
+            permission: CAN_RUN
+        - name: job
+          job:
+            id: ${var.job_id}
+            permission: CAN_MANAGE_RUN
+        - name: secret
+          secret:
+            scope: ${var.secret_scope}
+            key: ${var.secret_key}
+            permission: READ
+
+targets:
+  default:
+    default: true
+    workspace:
+      host: [DATABRICKS_URL]
+
+    variables:
+      sql_warehouse_id: wh1
+      genie_space_id: g1
+      genie_space_name: gs
+      job_id: 42
+      secret_key: k
+      secret_scope: s
+
+=== App-wide OBO, job kept on the service principal
+>>> [CLI] apps init --template ./template --skip-install --name app-obo --features analytics,genie,jobs --set analytics.sql-warehouse.id=wh1 --set genie.genie-space.id=g1 --set genie.genie-space.name=gs --set jobs.job.id=42 --set jobs.secret.scope=s --set jobs.secret.key=k --auth-mode obo --set jobs.job.authMode=sp
+Note: these resources cannot be accessed on behalf of the user and use the service principal: secret
+✔ Creating project
+
+✔ Project created successfully!
+
+  Location: [TEST_TMP_DIR]/app-obo
+  Files: 3
+
+command: ['npm', 'run', 'start']
+env:
+  - name: DATABRICKS_WAREHOUSE_ID
+    value: wh1
+  - name: DATABRICKS_GENIE_SPACE_ID
+    value: g1
+  - name: DATABRICKS_JOB_ID
+    valueFrom: job
+  - name: SECRET_KEY
+    valueFrom: secret
+  - name: SECRET_SCOPE
+    valueFrom: secret
+bundle:
+  name: app-obo
+
+variables:
+  job_id:
+    description: Job ID
+  secret_key:
+    description: Job token
+  secret_scope:
+    description: Job token
+
+resources:
+  apps:
+    app:
+      name: "app-obo"
+      description: "A Databricks App powered by AppKit"
+      source_code_path: ./
+
+      # Start the app automatically on deploy.
+      lifecycle:
+        started: true
+      user_api_scopes:
+        - sql
+        - genie
+        - ai-gateway
+
+      # The resources which this app has access to.
+      resources:
+        - name: job
+          job:
+            id: ${var.job_id}
+            permission: CAN_MANAGE_RUN
+        - name: secret
+          secret:
+            scope: ${var.secret_scope}
+            key: ${var.secret_key}
+            permission: READ
+
+targets:
+  default:
+    default: true
+    workspace:
+      host: [DATABRICKS_URL]
+
+    variables:
+      job_id: 42
+      secret_key: k
+      secret_scope: s
+
+=== Mixed: warehouse both, genie OBO
+>>> [CLI] apps init --template ./template --skip-install --name app-mixed --features analytics,genie,jobs --set analytics.sql-warehouse.id=wh1 --set genie.genie-space.id=g1 --set genie.genie-space.name=gs --set jobs.job.id=42 --set jobs.secret.scope=s --set jobs.secret.key=k --set analytics.sql-warehouse.authMode=both --set genie.genie-space.authMode=obo
+✔ Creating project
+
+✔ Project created successfully!
+
+  Location: [TEST_TMP_DIR]/app-mixed
+  Files: 3
+
+command: ['npm', 'run', 'start']
+env:
+  - name: DATABRICKS_WAREHOUSE_ID
+    valueFrom: sql-warehouse
+  - name: DATABRICKS_GENIE_SPACE_ID
+    value: g1
+  - name: DATABRICKS_JOB_ID
+    valueFrom: job
+  - name: SECRET_KEY
+    valueFrom: secret
+  - name: SECRET_SCOPE
+    valueFrom: secret
+bundle:
+  name: app-mixed
+
+variables:
+  sql_warehouse_id:
+    description: SQL Warehouse ID
+  job_id:
+    description: Job ID
+  secret_key:
+    description: Job token
+  secret_scope:
+    description: Job token
+
+resources:
+  apps:
+    app:
+      name: "app-mixed"
+      description: "A Databricks App powered by AppKit"
+      source_code_path: ./
+
+      # Start the app automatically on deploy.
+      lifecycle:
+        started: true
+      user_api_scopes:
+        - sql
+        - genie
+        - ai-gateway
+
+      # The resources which this app has access to.
+      resources:
+        - name: sql-warehouse
+          sql_warehouse:
+            id: ${var.sql_warehouse_id}
+            permission: CAN_USE
+        - name: job
+          job:
+            id: ${var.job_id}
+            permission: CAN_MANAGE_RUN
+        - name: secret
+          secret:
+            scope: ${var.secret_scope}
+            key: ${var.secret_key}
+            permission: READ
+
+targets:
+  default:
+    default: true
+    workspace:
+      host: [DATABRICKS_URL]
+
+    variables:
+      sql_warehouse_id: wh1
+      job_id: 42
+      secret_key: k
+      secret_scope: s
+
+=== App-wide OBO: resources without a scope stay on the service principal
+>>> [CLI] apps init --template ./template --skip-install --name app-obo-lenient --features analytics,genie,jobs --set analytics.sql-warehouse.id=wh1 --set genie.genie-space.id=g1 --set genie.genie-space.name=gs --set jobs.job.id=42 --set jobs.secret.scope=s --set jobs.secret.key=k --auth-mode obo
+Note: these resources cannot be accessed on behalf of the user and use the service principal: job, secret
+✔ Creating project
+
+✔ Project created successfully!
+
+  Location: [TEST_TMP_DIR]/app-obo-lenient
+  Files: 3
+
+command: ['npm', 'run', 'start']
+env:
+  - name: DATABRICKS_WAREHOUSE_ID
+    value: wh1
+  - name: DATABRICKS_GENIE_SPACE_ID
+    value: g1
+  - name: DATABRICKS_JOB_ID
+    valueFrom: job
+  - name: SECRET_KEY
+    valueFrom: secret
+  - name: SECRET_SCOPE
+    valueFrom: secret
+bundle:
+  name: app-obo-lenient
+
+variables:
+  job_id:
+    description: Job ID
+  secret_key:
+    description: Job token
+  secret_scope:
+    description: Job token
+
+resources:
+  apps:
+    app:
+      name: "app-obo-lenient"
+      description: "A Databricks App powered by AppKit"
+      source_code_path: ./
+
+      # Start the app automatically on deploy.
+      lifecycle:
+        started: true
+      user_api_scopes:
+        - sql
+        - genie
+        - ai-gateway
+
+      # The resources which this app has access to.
+      resources:
+        - name: job
+          job:
+            id: ${var.job_id}
+            permission: CAN_MANAGE_RUN
+        - name: secret
+          secret:
+            scope: ${var.secret_scope}
+            key: ${var.secret_key}
+            permission: READ
+
+targets:
+  default:
+    default: true
+    workspace:
+      host: [DATABRICKS_URL]
+
+    variables:
+      job_id: 42
+      secret_key: k
+      secret_scope: s
+
+=== Analytics OBO, genie space on the service principal: plugin scopes still emitted
+>>> [CLI] apps init --template ./template --skip-install --name app-genie-sp --features analytics,genie,jobs --set analytics.sql-warehouse.id=wh1 --set genie.genie-space.id=g1 --set genie.genie-space.name=gs --set jobs.job.id=42 --set jobs.secret.scope=s --set jobs.secret.key=k --set analytics.sql-warehouse.authMode=obo --set genie.genie-space.authMode=sp
+✔ Creating project
+
+✔ Project created successfully!
+
+  Location: [TEST_TMP_DIR]/app-genie-sp
+  Files: 3
+
+command: ['npm', 'run', 'start']
+env:
+  - name: DATABRICKS_WAREHOUSE_ID
+    value: wh1
+  - name: DATABRICKS_GENIE_SPACE_ID
+    valueFrom: genie-space
+  - name: DATABRICKS_JOB_ID
+    valueFrom: job
+  - name: SECRET_KEY
+    valueFrom: secret
+  - name: SECRET_SCOPE
+    valueFrom: secret
+bundle:
+  name: app-genie-sp
+
+variables:
+  genie_space_id:
+    description: Genie Space ID
+  genie_space_name:
+    description: Genie Space name
+  job_id:
+    description: Job ID
+  secret_key:
+    description: Job token
+  secret_scope:
+    description: Job token
+
+resources:
+  apps:
+    app:
+      name: "app-genie-sp"
+      description: "A Databricks App powered by AppKit"
+      source_code_path: ./
+
+      # Start the app automatically on deploy.
+      lifecycle:
+        started: true
+      user_api_scopes:
+        - sql
+        - ai-gateway
+        - genie
+
+      # The resources which this app has access to.
+      resources:
+        - name: genie-space
+          genie_space:
+            name: ${var.genie_space_name}
+            space_id: ${var.genie_space_id}
+            permission: CAN_RUN
+        - name: job
+          job:
+            id: ${var.job_id}
+            permission: CAN_MANAGE_RUN
+        - name: secret
+          secret:
+            scope: ${var.secret_scope}
+            key: ${var.secret_key}
+            permission: READ
+
+targets:
+  default:
+    default: true
+    workspace:
+      host: [DATABRICKS_URL]
+
+    variables:
+      genie_space_id: g1
+      genie_space_name: gs
+      job_id: 42
+      secret_key: k
+      secret_scope: s
+
+=== Errors
+>>> errcode [CLI] apps init --template ./template --skip-install --name app-err --features jobs --set jobs.job.authMode=obo
+Error: resource "job" of plugin "jobs" cannot be accessed on behalf of the user; use jobs.job.authMode=sp
+
+Exit code: 1
+
+>>> errcode [CLI] apps init --template ./template --skip-install --name app-err --features jobs --set jobs.secret.authMode=sp
+Error: resource "secret" of plugin "jobs" is always accessed by the app's service principal; remove --set jobs.secret.authMode=sp
+
+Exit code: 1
+
+>>> errcode [CLI] apps init --template ./template --skip-install --name app-err --features jobs --auth-mode both
+Error: invalid --auth-mode value: "both" (must be obo or sp; use --set <plugin>.<resourceKey>.authMode=both for a single resource)
+
+Exit code: 1
+
+=== Validate: OBO resource whose scope was removed from user_api_scopes
+>>> [CLI] apps init --template ./template --skip-install --name app-val --features analytics --set analytics.sql-warehouse.id=wh1 --set analytics.sql-warehouse.authMode=obo
+✔ Creating project
+
+✔ Project created successfully!
+
+  Location: [TEST_TMP_DIR]/app-val
+  Files: 3
+
+
+>>> errcode [CLI] apps validate --path app-val
+Error: resource "sql-warehouse" is accessed on behalf of the user but its scope "sql" is missing from user_api_scopes in databricks.yml
+
+Exit code: 1
diff --git a/acceptance/apps/init/auth-mode/script b/acceptance/apps/init/auth-mode/script
new file mode 100644
index 00000000000..90c035563f5
--- /dev/null
+++ b/acceptance/apps/init/auth-mode/script
@@ -0,0 +1,37 @@
+init() {
+  name=$1; shift
+  trace $CLI apps init --template ./template --skip-install --name $name \
+    --features analytics,genie,jobs \
+    --set analytics.sql-warehouse.id=wh1 --set genie.genie-space.id=g1 --set genie.genie-space.name=gs \
+    --set jobs.job.id=42 --set jobs.secret.scope=s --set jobs.secret.key=k "$@"
+  cat $name/app.yaml $name/databricks.yml
+  rm -rf $name
+}
+
+title "Default: every resource bound to the service principal"
+init app-sp
+
+title "App-wide OBO, job kept on the service principal"
+init app-obo --auth-mode obo --set jobs.job.authMode=sp
+
+title "Mixed: warehouse both, genie OBO"
+init app-mixed --set analytics.sql-warehouse.authMode=both --set genie.genie-space.authMode=obo
+
+title "App-wide OBO: resources without a scope stay on the service principal"
+init app-obo-lenient --auth-mode obo
+
+title "Analytics OBO, genie space on the service principal: plugin scopes still emitted"
+init app-genie-sp --set analytics.sql-warehouse.authMode=obo --set genie.genie-space.authMode=sp
+
+title "Errors"
+trace errcode $CLI apps init --template ./template --skip-install --name app-err --features jobs --set jobs.job.authMode=obo
+trace errcode $CLI apps init --template ./template --skip-install --name app-err --features jobs --set jobs.secret.authMode=sp
+trace errcode $CLI apps init --template ./template --skip-install --name app-err --features jobs --auth-mode both
+
+title "Validate: OBO resource whose scope was removed from user_api_scopes"
+trace $CLI apps init --template ./template --skip-install --name app-val --features analytics \
+  --set analytics.sql-warehouse.id=wh1 --set analytics.sql-warehouse.authMode=obo
+grep -v -- '- sql$' app-val/databricks.yml > app-val/databricks.yml.new
+mv app-val/databricks.yml.new app-val/databricks.yml
+trace errcode $CLI apps validate --path app-val
+rm -rf app-val
diff --git a/acceptance/apps/init/auth-mode/template/app.yaml.tmpl b/acceptance/apps/init/auth-mode/template/app.yaml.tmpl
new file mode 100644
index 00000000000..66311d1213e
--- /dev/null
+++ b/acceptance/apps/init/auth-mode/template/app.yaml.tmpl
@@ -0,0 +1,5 @@
+command: ['npm', 'run', 'start']
+{{- if .appEnv}}
+env:
+{{.appEnv}}
+{{- end}}
diff --git a/acceptance/apps/init/auth-mode/template/appkit.plugins.json b/acceptance/apps/init/auth-mode/template/appkit.plugins.json
new file mode 100644
index 00000000000..651849da1b2
--- /dev/null
+++ b/acceptance/apps/init/auth-mode/template/appkit.plugins.json
@@ -0,0 +1,76 @@
+{
+  "version": "1.0",
+  "plugins": {
+    "analytics": {
+      "name": "analytics",
+      "displayName": "Analytics",
+      "description": "SQL analytics",
+      "package": "@databricks/appkit",
+      "scopes": ["ai-gateway"],
+      "resources": {
+        "required": [
+          {
+            "type": "sql_warehouse",
+            "alias": "SQL Warehouse",
+            "resourceKey": "sql-warehouse",
+            "description": "SQL Warehouse for analytics queries",
+            "permission": "CAN_USE",
+            "scope": "sql",
+            "binding": {"yamlKey": "sql_warehouse", "varFields": [["id", "id"]]},
+            "fields": {"id": {"env": "DATABRICKS_WAREHOUSE_ID", "description": "SQL Warehouse ID"}}
+          }
+        ],
+        "optional": []
+      }
+    },
+    "genie": {
+      "name": "genie",
+      "displayName": "Genie",
+      "description": "Genie spaces",
+      "package": "@databricks/appkit",
+      "scopes": ["genie"],
+      "resources": {
+        "required": [
+          {
+            "type": "genie_space",
+            "alias": "Genie Space",
+            "resourceKey": "genie-space",
+            "description": "Genie Space",
+            "permission": "CAN_RUN",
+            "scope": "genie",
+            "fields": {"id": {"env": "DATABRICKS_GENIE_SPACE_ID", "description": "Genie Space ID"}, "name": {"description": "Genie Space name"}}
+          }
+        ],
+        "optional": []
+      }
+    },
+    "jobs": {
+      "name": "jobs",
+      "displayName": "Jobs",
+      "description": "Lakeflow jobs",
+      "package": "@databricks/appkit",
+      "resources": {
+        "required": [
+          {
+            "type": "job",
+            "alias": "Job",
+            "resourceKey": "job",
+            "description": "Job to trigger",
+            "permission": "CAN_MANAGE_RUN",
+            "fields": {"id": {"env": "DATABRICKS_JOB_ID", "description": "Job ID"}}
+          },
+          {
+            "type": "secret",
+            "alias": "Secret",
+            "resourceKey": "secret",
+            "description": "Job token",
+            "permission": "READ",
+            "appOnly": true,
+            "fields": {"scope": {"env": "SECRET_SCOPE"}, "key": {"env": "SECRET_KEY"}}
+          }
+        ],
+        "optional": []
+      }
+    }
+  }
+}
diff --git a/acceptance/apps/init/auth-mode/template/databricks.yml.tmpl b/acceptance/apps/init/auth-mode/template/databricks.yml.tmpl
new file mode 100644
index 00000000000..6a749066692
--- /dev/null
+++ b/acceptance/apps/init/auth-mode/template/databricks.yml.tmpl
@@ -0,0 +1,55 @@
+bundle:
+  name: {{.projectName}}
+{{- if .bundle.variables}}
+
+variables:
+{{.bundle.variables}}
+{{- end}}
+
+resources:
+  apps:
+    app:
+      name: "{{.projectName}}"
+      description: "{{.appDescription}}"
+      source_code_path: ./
+
+      # Start the app automatically on deploy.
+      lifecycle:
+        started: true
+
+{{- if .bundle.userApiScopes}}
+      user_api_scopes:
+{{.bundle.userApiScopes}}
+{{- else if or .plugins.genie .plugins.files .plugins.serving}}
+      user_api_scopes:
+{{- if .plugins.genie}}
+        - dashboards.genie
+{{- end}}
+{{- if .plugins.files}}
+        - files.files
+{{- end}}
+{{- if .plugins.serving}}
+        - serving.serving-endpoints
+{{- end}}
+{{- else}}
+      # Uncomment to enable on behalf of user API scopes. Available scopes: sql, dashboards.genie, files.files, serving.serving-endpoints
+      # user_api_scopes:
+      #   - sql
+{{- end}}
+{{- if .bundle.resources}}
+
+      # The resources which this app has access to.
+      resources:
+{{.bundle.resources}}
+{{- end}}
+
+targets:
+  default:
+    default: true
+    workspace:
+      host: {{.workspaceHost}}
+{{- if .bundle.targetVariables}}
+
+    variables:
+{{.bundle.targetVariables}}
+{{- end}}
diff --git a/acceptance/apps/init/auth-mode/test.toml b/acceptance/apps/init/auth-mode/test.toml
new file mode 100644
index 00000000000..b7713e67a70
--- /dev/null
+++ b/acceptance/apps/init/auth-mode/test.toml
@@ -0,0 +1,6 @@
+Cloud = false
+
+[[Repls]]
+# Fix path with reverse slashes in the output for Windows.
+Old = 'TEST_TMP_DIR]\\(app-[a-z-]+)'
+New = 'TEST_TMP_DIR]/${1}'
diff --git a/acceptance/apps/init/binding-values/out.test.toml b/acceptance/apps/init/binding-values/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/apps/init/binding-values/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/apps/init/binding-values/output.txt b/acceptance/apps/init/binding-values/output.txt
new file mode 100644
index 00000000000..d23b2f64453
--- /dev/null
+++ b/acceptance/apps/init/binding-values/output.txt
@@ -0,0 +1,170 @@
+
+=== Service principal, genie space without name: fails before writing files
+>>> errcode [CLI] apps init --template ./template --skip-install --name app-sp --features genie --set genie.genie-space.id=g123 --auth-mode sp
+Error: missing value for genie.genie-space.name (needed by the genie_space binding); use --set genie.genie-space.name=value
+
+Exit code: 1
+app-sp was not created
+
+=== Service principal with --set name: the binding variables have values
+>>> [CLI] apps init --template ./template --skip-install --name app-sp-name --features analytics,genie --set analytics.sql-warehouse.id=wh1 --set genie.genie-space.id=g123 --set genie.genie-space.name=space
+✔ Creating project
+
+✔ Project created successfully!
+
+  Location: [TEST_TMP_DIR]/app-sp-name
+  Files: 3
+
+bundle:
+  name: app-sp-name
+
+variables:
+  sql_warehouse_id:
+    description: SQL Warehouse ID
+  genie_space_id:
+    description: Genie Space ID
+  genie_space_name:
+    description: Genie Space
+
+resources:
+  apps:
+    app:
+      name: "app-sp-name"
+      description: "A Databricks App powered by AppKit"
+      source_code_path: ./
+
+      # Start the app automatically on deploy.
+      lifecycle:
+        started: true
+      user_api_scopes:
+        - dashboards.genie
+
+      # The resources which this app has access to.
+      resources:
+        - name: sql-warehouse
+          sql_warehouse:
+            id: ${var.sql_warehouse_id}
+            permission: CAN_USE
+        - name: genie-space
+          genie_space:
+            name: ${var.genie_space_name}
+            space_id: ${var.genie_space_id}
+            permission: CAN_RUN
+
+targets:
+  default:
+    default: true
+    workspace:
+      host: [DATABRICKS_URL]
+
+    variables:
+      sql_warehouse_id: wh1
+      genie_space_id: g123
+      genie_space_name: space
+
+>>> [CLI] bundle validate
+Name: app-sp-name
+Target: default
+Workspace:
+  Host: [DATABRICKS_URL]
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/app-sp-name/default
+
+Validation OK!
+
+=== On behalf of the user, genie space without name: no binding, nothing to check
+>>> [CLI] apps init --template ./template --skip-install --name app-obo --features analytics,genie --set analytics.sql-warehouse.id=wh1 --set genie.genie-space.id=g123 --auth-mode obo
+✔ Creating project
+
+✔ Project created successfully!
+
+  Location: [TEST_TMP_DIR]/app-obo
+  Files: 3
+
+bundle:
+  name: app-obo
+
+resources:
+  apps:
+    app:
+      name: "app-obo"
+      description: "A Databricks App powered by AppKit"
+      source_code_path: ./
+
+      # Start the app automatically on deploy.
+      lifecycle:
+        started: true
+      user_api_scopes:
+        - sql
+        - genie
+
+targets:
+  default:
+    default: true
+    workspace:
+      host: [DATABRICKS_URL]
+
+>>> [CLI] bundle validate
+Name: app-obo
+Target: default
+Workspace:
+  Host: [DATABRICKS_URL]
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/app-obo/default
+
+Validation OK!
+
+=== Mixed: warehouse on the service principal, genie space on behalf of the user
+>>> [CLI] apps init --template ./template --skip-install --name app-mixed --features analytics,genie --set analytics.sql-warehouse.id=wh1 --set genie.genie-space.id=g123 --set genie.genie-space.authMode=obo
+✔ Creating project
+
+✔ Project created successfully!
+
+  Location: [TEST_TMP_DIR]/app-mixed
+  Files: 3
+
+bundle:
+  name: app-mixed
+
+variables:
+  sql_warehouse_id:
+    description: SQL Warehouse ID
+
+resources:
+  apps:
+    app:
+      name: "app-mixed"
+      description: "A Databricks App powered by AppKit"
+      source_code_path: ./
+
+      # Start the app automatically on deploy.
+      lifecycle:
+        started: true
+      user_api_scopes:
+        - genie
+
+      # The resources which this app has access to.
+      resources:
+        - name: sql-warehouse
+          sql_warehouse:
+            id: ${var.sql_warehouse_id}
+            permission: CAN_USE
+
+targets:
+  default:
+    default: true
+    workspace:
+      host: [DATABRICKS_URL]
+
+    variables:
+      sql_warehouse_id: wh1
+
+>>> [CLI] bundle validate
+Name: app-mixed
+Target: default
+Workspace:
+  Host: [DATABRICKS_URL]
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/app-mixed/default
+
+Validation OK!
diff --git a/acceptance/apps/init/binding-values/script b/acceptance/apps/init/binding-values/script
new file mode 100644
index 00000000000..aa54b3358e1
--- /dev/null
+++ b/acceptance/apps/init/binding-values/script
@@ -0,0 +1,34 @@
+# The genie_space binding references "name" and "id", but this manifest only declares "id".
+init() {
+  name=$1; shift
+  trace $CLI apps init --template ./template --skip-install --name $name \
+    --features analytics,genie --set analytics.sql-warehouse.id=wh1 --set genie.genie-space.id=g123 "$@"
+}
+
+title "Service principal, genie space without name: fails before writing files"
+trace errcode $CLI apps init --template ./template --skip-install --name app-sp --features genie --set genie.genie-space.id=g123 --auth-mode sp
+[ -d app-sp ] && echo "app-sp was created" || echo "app-sp was not created"
+
+title "Service principal with --set name: the binding variables have values"
+init app-sp-name --set genie.genie-space.name=space
+cat app-sp-name/databricks.yml
+cd app-sp-name
+trace $CLI bundle validate
+cd ..
+rm -rf app-sp-name
+
+title "On behalf of the user, genie space without name: no binding, nothing to check"
+init app-obo --auth-mode obo
+cat app-obo/databricks.yml
+cd app-obo
+trace $CLI bundle validate
+cd ..
+rm -rf app-obo
+
+title "Mixed: warehouse on the service principal, genie space on behalf of the user"
+init app-mixed --set genie.genie-space.authMode=obo
+cat app-mixed/databricks.yml
+cd app-mixed
+trace $CLI bundle validate
+cd ..
+rm -rf app-mixed
diff --git a/acceptance/apps/init/binding-values/template/app.yaml.tmpl b/acceptance/apps/init/binding-values/template/app.yaml.tmpl
new file mode 100644
index 00000000000..66311d1213e
--- /dev/null
+++ b/acceptance/apps/init/binding-values/template/app.yaml.tmpl
@@ -0,0 +1,5 @@
+command: ['npm', 'run', 'start']
+{{- if .appEnv}}
+env:
+{{.appEnv}}
+{{- end}}
diff --git a/acceptance/apps/init/binding-values/template/appkit.plugins.json b/acceptance/apps/init/binding-values/template/appkit.plugins.json
new file mode 100644
index 00000000000..a09a3828405
--- /dev/null
+++ b/acceptance/apps/init/binding-values/template/appkit.plugins.json
@@ -0,0 +1,45 @@
+{
+  "version": "1.0",
+  "plugins": {
+    "analytics": {
+      "name": "analytics",
+      "displayName": "Analytics",
+      "description": "SQL analytics",
+      "package": "@databricks/appkit",
+      "resources": {
+        "required": [
+          {
+            "type": "sql_warehouse",
+            "alias": "SQL Warehouse",
+            "resourceKey": "sql-warehouse",
+            "description": "SQL Warehouse for analytics queries",
+            "permission": "CAN_USE",
+            "scope": "sql",
+            "fields": {"id": {"env": "DATABRICKS_WAREHOUSE_ID", "description": "SQL Warehouse ID"}}
+          }
+        ],
+        "optional": []
+      }
+    },
+    "genie": {
+      "name": "genie",
+      "displayName": "Genie",
+      "description": "Genie spaces",
+      "package": "@databricks/appkit",
+      "resources": {
+        "required": [
+          {
+            "type": "genie_space",
+            "alias": "Genie Space",
+            "resourceKey": "genie-space",
+            "description": "Genie Space",
+            "permission": "CAN_RUN",
+            "scope": "genie",
+            "fields": {"id": {"env": "DATABRICKS_GENIE_SPACE_ID", "description": "Genie Space ID"}}
+          }
+        ],
+        "optional": []
+      }
+    }
+  }
+}
diff --git a/acceptance/apps/init/binding-values/template/databricks.yml.tmpl b/acceptance/apps/init/binding-values/template/databricks.yml.tmpl
new file mode 100644
index 00000000000..6a749066692
--- /dev/null
+++ b/acceptance/apps/init/binding-values/template/databricks.yml.tmpl
@@ -0,0 +1,55 @@
+bundle:
+  name: {{.projectName}}
+{{- if .bundle.variables}}
+
+variables:
+{{.bundle.variables}}
+{{- end}}
+
+resources:
+  apps:
+    app:
+      name: "{{.projectName}}"
+      description: "{{.appDescription}}"
+      source_code_path: ./
+
+      # Start the app automatically on deploy.
+      lifecycle:
+        started: true
+
+{{- if .bundle.userApiScopes}}
+      user_api_scopes:
+{{.bundle.userApiScopes}}
+{{- else if or .plugins.genie .plugins.files .plugins.serving}}
+      user_api_scopes:
+{{- if .plugins.genie}}
+        - dashboards.genie
+{{- end}}
+{{- if .plugins.files}}
+        - files.files
+{{- end}}
+{{- if .plugins.serving}}
+        - serving.serving-endpoints
+{{- end}}
+{{- else}}
+      # Uncomment to enable on behalf of user API scopes. Available scopes: sql, dashboards.genie, files.files, serving.serving-endpoints
+      # user_api_scopes:
+      #   - sql
+{{- end}}
+{{- if .bundle.resources}}
+
+      # The resources which this app has access to.
+      resources:
+{{.bundle.resources}}
+{{- end}}
+
+targets:
+  default:
+    default: true
+    workspace:
+      host: {{.workspaceHost}}
+{{- if .bundle.targetVariables}}
+
+    variables:
+{{.bundle.targetVariables}}
+{{- end}}
diff --git a/acceptance/apps/init/binding-values/test.toml b/acceptance/apps/init/binding-values/test.toml
new file mode 100644
index 00000000000..b7713e67a70
--- /dev/null
+++ b/acceptance/apps/init/binding-values/test.toml
@@ -0,0 +1,6 @@
+Cloud = false
+
+[[Repls]]
+# Fix path with reverse slashes in the output for Windows.
+Old = 'TEST_TMP_DIR]\\(app-[a-z-]+)'
+New = 'TEST_TMP_DIR]/${1}'
diff --git a/acceptance/apps/validate-package-manager/bin/npm b/acceptance/apps/validate-package-manager/bin/npm
new file mode 100755
index 00000000000..d452c009e29
--- /dev/null
+++ b/acceptance/apps/validate-package-manager/bin/npm
@@ -0,0 +1,7 @@
+#!/bin/sh
+printf '%s %s\n' "${0##*/}" "$*" >> commands.log
+if [ "$*" = "${VALIDATION_TEST_FAIL:-}" ]; then
+    echo "validation stdout"
+    echo "validation stderr" >&2
+    exit 17
+fi
diff --git a/acceptance/apps/validate-package-manager/bin/npm.cmd b/acceptance/apps/validate-package-manager/bin/npm.cmd
new file mode 100644
index 00000000000..1e7de72f5dd
--- /dev/null
+++ b/acceptance/apps/validate-package-manager/bin/npm.cmd
@@ -0,0 +1,7 @@
+@echo off
+echo %~n0 %*>>commands.log
+if "%*"=="%VALIDATION_TEST_FAIL%" (
+    echo validation stdout
+    echo validation stderr 1>&2
+    exit /b 17
+)
diff --git a/acceptance/apps/validate-package-manager/bin/pnpm b/acceptance/apps/validate-package-manager/bin/pnpm
new file mode 100755
index 00000000000..d452c009e29
--- /dev/null
+++ b/acceptance/apps/validate-package-manager/bin/pnpm
@@ -0,0 +1,7 @@
+#!/bin/sh
+printf '%s %s\n' "${0##*/}" "$*" >> commands.log
+if [ "$*" = "${VALIDATION_TEST_FAIL:-}" ]; then
+    echo "validation stdout"
+    echo "validation stderr" >&2
+    exit 17
+fi
diff --git a/acceptance/apps/validate-package-manager/bin/pnpm.cmd b/acceptance/apps/validate-package-manager/bin/pnpm.cmd
new file mode 100644
index 00000000000..1e7de72f5dd
--- /dev/null
+++ b/acceptance/apps/validate-package-manager/bin/pnpm.cmd
@@ -0,0 +1,7 @@
+@echo off
+echo %~n0 %*>>commands.log
+if "%*"=="%VALIDATION_TEST_FAIL%" (
+    echo validation stdout
+    echo validation stderr 1>&2
+    exit /b 17
+)
diff --git a/acceptance/bundle/summary/show-full-config/src/my_dashboard.lvdash.json b/acceptance/apps/validate-package-manager/conflicting/package-lock.json
similarity index 100%
rename from acceptance/bundle/summary/show-full-config/src/my_dashboard.lvdash.json
rename to acceptance/apps/validate-package-manager/conflicting/package-lock.json
diff --git a/acceptance/apps/validate-package-manager/conflicting/package.json b/acceptance/apps/validate-package-manager/conflicting/package.json
new file mode 100644
index 00000000000..0967ef424bc
--- /dev/null
+++ b/acceptance/apps/validate-package-manager/conflicting/package.json
@@ -0,0 +1 @@
+{}
diff --git a/acceptance/apps/validate-package-manager/conflicting/pnpm-lock.yaml b/acceptance/apps/validate-package-manager/conflicting/pnpm-lock.yaml
new file mode 100644
index 00000000000..b0a073a9c13
--- /dev/null
+++ b/acceptance/apps/validate-package-manager/conflicting/pnpm-lock.yaml
@@ -0,0 +1 @@
+lockfileVersion: '9.0'
diff --git a/acceptance/apps/validate-package-manager/metadata-npm/package.json b/acceptance/apps/validate-package-manager/metadata-npm/package.json
new file mode 100644
index 00000000000..f7baa297652
--- /dev/null
+++ b/acceptance/apps/validate-package-manager/metadata-npm/package.json
@@ -0,0 +1,3 @@
+{
+  "packageManager": "npm@10.9.2"
+}
diff --git a/acceptance/apps/validate-package-manager/metadata-npm/pnpm-lock.yaml b/acceptance/apps/validate-package-manager/metadata-npm/pnpm-lock.yaml
new file mode 100644
index 00000000000..b0a073a9c13
--- /dev/null
+++ b/acceptance/apps/validate-package-manager/metadata-npm/pnpm-lock.yaml
@@ -0,0 +1 @@
+lockfileVersion: '9.0'
diff --git a/acceptance/apps/validate-package-manager/out.test.toml b/acceptance/apps/validate-package-manager/out.test.toml
new file mode 100644
index 00000000000..0938e678987
--- /dev/null
+++ b/acceptance/apps/validate-package-manager/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/apps/validate-package-manager/output.txt b/acceptance/apps/validate-package-manager/output.txt
new file mode 100644
index 00000000000..f4ed7abf012
--- /dev/null
+++ b/acceptance/apps/validate-package-manager/output.txt
@@ -0,0 +1,36 @@
+
+=== Warn but continue on conflicting lockfiles
+>>> [CLI] apps validate --path conflicting
+Warn: found conflicting package managers; using npm from package-lock.json and ignoring pnpm-lock.yaml
+Validating project using npm...
+✅ Installing dependencies ([DURATION])
+✅ Generating types ([DURATION])
+✅ Running AST-grep lint ([DURATION])
+✅ Type checking ([DURATION])
+✅ Building ([DURATION])
+✅ Running tests ([DURATION])
+✅ All validation checks passed ([DURATION])
+
+=== Warn but continue on unsupported lockfiles
+>>> [CLI] apps validate --path unsupported
+Warn: ignoring unsupported lockfile yarn.lock; apps validation uses npm or pnpm
+Validating project using npm...
+✅ Installing dependencies ([DURATION])
+✅ Generating types ([DURATION])
+✅ Running AST-grep lint ([DURATION])
+✅ Type checking ([DURATION])
+✅ Building ([DURATION])
+✅ Running tests ([DURATION])
+✅ All validation checks passed ([DURATION])
+
+=== Declared package manager wins over a pnpm lockfile
+>>> [CLI] apps validate --path metadata-npm
+Warn: found conflicting package managers; using npm from package.json and ignoring pnpm-lock.yaml
+Validating project using npm...
+✅ Installing dependencies ([DURATION])
+✅ Generating types ([DURATION])
+✅ Running AST-grep lint ([DURATION])
+✅ Type checking ([DURATION])
+✅ Building ([DURATION])
+✅ Running tests ([DURATION])
+✅ All validation checks passed ([DURATION])
diff --git a/acceptance/apps/validate-package-manager/script b/acceptance/apps/validate-package-manager/script
new file mode 100644
index 00000000000..e647253dade
--- /dev/null
+++ b/acceptance/apps/validate-package-manager/script
@@ -0,0 +1,10 @@
+export PATH="$PWD/bin:$PATH"
+
+title "Warn but continue on conflicting lockfiles"
+trace $CLI apps validate --path conflicting
+
+title "Warn but continue on unsupported lockfiles"
+trace $CLI apps validate --path unsupported
+
+title "Declared package manager wins over a pnpm lockfile"
+trace $CLI apps validate --path metadata-npm
diff --git a/acceptance/apps/validate-package-manager/test.toml b/acceptance/apps/validate-package-manager/test.toml
new file mode 100644
index 00000000000..0d42c72ca66
--- /dev/null
+++ b/acceptance/apps/validate-package-manager/test.toml
@@ -0,0 +1,6 @@
+EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+Ignore = ["commands.log"]
+
+[[Repls]]
+Old = '\d+\.\d+s'
+New = '[DURATION]'
diff --git a/acceptance/apps/validate-package-manager/unsupported/package.json b/acceptance/apps/validate-package-manager/unsupported/package.json
new file mode 100644
index 00000000000..0967ef424bc
--- /dev/null
+++ b/acceptance/apps/validate-package-manager/unsupported/package.json
@@ -0,0 +1 @@
+{}
diff --git a/acceptance/apps/validate-package-manager/unsupported/yarn.lock b/acceptance/apps/validate-package-manager/unsupported/yarn.lock
new file mode 100644
index 00000000000..ef452491215
--- /dev/null
+++ b/acceptance/apps/validate-package-manager/unsupported/yarn.lock
@@ -0,0 +1 @@
+# yarn lockfile v1
diff --git a/acceptance/apps/validate/app/package.json b/acceptance/apps/validate/app/package.json
new file mode 100644
index 00000000000..0967ef424bc
--- /dev/null
+++ b/acceptance/apps/validate/app/package.json
@@ -0,0 +1 @@
+{}
diff --git a/acceptance/apps/validate/bin/npm b/acceptance/apps/validate/bin/npm
new file mode 100755
index 00000000000..d452c009e29
--- /dev/null
+++ b/acceptance/apps/validate/bin/npm
@@ -0,0 +1,7 @@
+#!/bin/sh
+printf '%s %s\n' "${0##*/}" "$*" >> commands.log
+if [ "$*" = "${VALIDATION_TEST_FAIL:-}" ]; then
+    echo "validation stdout"
+    echo "validation stderr" >&2
+    exit 17
+fi
diff --git a/acceptance/apps/validate/bin/npm.cmd b/acceptance/apps/validate/bin/npm.cmd
new file mode 100644
index 00000000000..1e7de72f5dd
--- /dev/null
+++ b/acceptance/apps/validate/bin/npm.cmd
@@ -0,0 +1,7 @@
+@echo off
+echo %~n0 %*>>commands.log
+if "%*"=="%VALIDATION_TEST_FAIL%" (
+    echo validation stdout
+    echo validation stderr 1>&2
+    exit /b 17
+)
diff --git a/acceptance/apps/validate/bin/pnpm b/acceptance/apps/validate/bin/pnpm
new file mode 100755
index 00000000000..d452c009e29
--- /dev/null
+++ b/acceptance/apps/validate/bin/pnpm
@@ -0,0 +1,7 @@
+#!/bin/sh
+printf '%s %s\n' "${0##*/}" "$*" >> commands.log
+if [ "$*" = "${VALIDATION_TEST_FAIL:-}" ]; then
+    echo "validation stdout"
+    echo "validation stderr" >&2
+    exit 17
+fi
diff --git a/acceptance/apps/validate/bin/pnpm.cmd b/acceptance/apps/validate/bin/pnpm.cmd
new file mode 100644
index 00000000000..1e7de72f5dd
--- /dev/null
+++ b/acceptance/apps/validate/bin/pnpm.cmd
@@ -0,0 +1,7 @@
+@echo off
+echo %~n0 %*>>commands.log
+if "%*"=="%VALIDATION_TEST_FAIL%" (
+    echo validation stdout
+    echo validation stderr 1>&2
+    exit /b 17
+)
diff --git a/acceptance/apps/validate/databricks.yml b/acceptance/apps/validate/databricks.yml
new file mode 100644
index 00000000000..3b058245ebe
--- /dev/null
+++ b/acceptance/apps/validate/databricks.yml
@@ -0,0 +1,2 @@
+bundle:
+  name: validate-app
diff --git a/acceptance/apps/validate/out.test.toml b/acceptance/apps/validate/out.test.toml
new file mode 100644
index 00000000000..0938e678987
--- /dev/null
+++ b/acceptance/apps/validate/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/apps/validate/output.txt b/acceptance/apps/validate/output.txt
new file mode 100644
index 00000000000..bbcd46b0c91
--- /dev/null
+++ b/acceptance/apps/validate/output.txt
@@ -0,0 +1,84 @@
+
+=== Validate the directory selected by --path
+>>> withdir app [CLI] apps validate --path ..
+Validating project using pnpm...
+✅ Installing dependencies ([DURATION])
+✅ Generating types ([DURATION])
+✅ Running AST-grep lint ([DURATION])
+✅ Type checking ([DURATION])
+✅ Building ([DURATION])
+✅ Running tests ([DURATION])
+✅ All validation checks passed ([DURATION])
+
+=== Skip tests
+>>> [CLI] apps validate --skip-tests
+Validating project using pnpm...
+✅ Installing dependencies ([DURATION])
+✅ Generating types ([DURATION])
+✅ Running AST-grep lint ([DURATION])
+✅ Type checking ([DURATION])
+✅ Building ([DURATION])
+⏭️  Skipped Running tests
+✅ All validation checks passed ([DURATION])
+
+=== Report a failed script
+>>> VALIDATION_TEST_FAIL=run --if-present test musterr [CLI] apps validate
+Validating project using pnpm...
+✅ Installing dependencies ([DURATION])
+✅ Generating types ([DURATION])
+✅ Running AST-grep lint ([DURATION])
+✅ Type checking ([DURATION])
+✅ Building ([DURATION])
+Error: tests failed (duration: [DURATION])
+❌ Running tests failed ([DURATION])
+validation failed (exit code 17)
+Stdout:
+validation stdout
+
+Stderr:
+validation stderr
+
+Error: validation failed
+
+=== Deploy validates with the same package manager before uploading
+>>> VALIDATION_TEST_FAIL=run --if-present build musterr [CLI] apps deploy
+Validating project using pnpm...
+✅ Installing dependencies ([DURATION])
+✅ Generating types ([DURATION])
+✅ Running AST-grep lint ([DURATION])
+✅ Type checking ([DURATION])
+Error: build failed (duration: [DURATION])
+❌ Building failed ([DURATION])
+validation failed (exit code 17)
+Stdout:
+validation stdout
+
+Stderr:
+validation stderr
+
+Error: validation failed - fix errors before deploying
+
+=== Commands executed in the project directory
+>>> cat commands.log
+pnpm install
+pnpm run --if-present typegen
+pnpm run --if-present lint:ast-grep
+pnpm run --if-present typecheck
+pnpm run --if-present build
+pnpm run --if-present test
+pnpm install
+pnpm run --if-present typegen
+pnpm run --if-present lint:ast-grep
+pnpm run --if-present typecheck
+pnpm run --if-present build
+pnpm install
+pnpm run --if-present typegen
+pnpm run --if-present lint:ast-grep
+pnpm run --if-present typecheck
+pnpm run --if-present build
+pnpm run --if-present test
+pnpm install
+pnpm run --if-present typegen
+pnpm run --if-present lint:ast-grep
+pnpm run --if-present typecheck
+pnpm run --if-present build
diff --git a/acceptance/apps/validate/package.json b/acceptance/apps/validate/package.json
new file mode 100644
index 00000000000..373a51f977f
--- /dev/null
+++ b/acceptance/apps/validate/package.json
@@ -0,0 +1,6 @@
+{
+  "scripts": {
+    "build": "echo build",
+    "test": "echo test"
+  }
+}
diff --git a/acceptance/apps/validate/pnpm-lock.yaml b/acceptance/apps/validate/pnpm-lock.yaml
new file mode 100644
index 00000000000..b0a073a9c13
--- /dev/null
+++ b/acceptance/apps/validate/pnpm-lock.yaml
@@ -0,0 +1 @@
+lockfileVersion: '9.0'
diff --git a/acceptance/apps/validate/script b/acceptance/apps/validate/script
new file mode 100644
index 00000000000..3f079d8af64
--- /dev/null
+++ b/acceptance/apps/validate/script
@@ -0,0 +1,16 @@
+export PATH="$PWD/bin:$PATH"
+
+title "Validate the directory selected by --path"
+trace withdir app $CLI apps validate --path ..
+
+title "Skip tests"
+trace $CLI apps validate --skip-tests
+
+title "Report a failed script"
+trace VALIDATION_TEST_FAIL="run --if-present test" musterr $CLI apps validate
+
+title "Deploy validates with the same package manager before uploading"
+trace VALIDATION_TEST_FAIL="run --if-present build" musterr $CLI apps deploy
+
+title "Commands executed in the project directory"
+trace cat commands.log
diff --git a/acceptance/apps/validate/test.toml b/acceptance/apps/validate/test.toml
new file mode 100644
index 00000000000..aef8c31494f
--- /dev/null
+++ b/acceptance/apps/validate/test.toml
@@ -0,0 +1,7 @@
+EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+Env.VALIDATION_TEST_FAIL = ""
+Ignore = ["commands.log"]
+
+[[Repls]]
+Old = '\d+\.\d+s'
+New = '[DURATION]'
diff --git a/acceptance/auth/bundle_and_profile/.databrickscfg b/acceptance/auth/bundle_and_profile/.databrickscfg
index c17ef536fdc..2e5abbcd0ca 100644
--- a/acceptance/auth/bundle_and_profile/.databrickscfg
+++ b/acceptance/auth/bundle_and_profile/.databrickscfg
@@ -2,4 +2,4 @@
 host = $DATABRICKS_HOST
 
 [profile_name]
-host = https://test@non.existing.subdomain.databricks.com
+host = https://test@non.existing.subdomain.databricks.test
diff --git a/acceptance/auth/bundle_and_profile/out.test.toml b/acceptance/auth/bundle_and_profile/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/auth/bundle_and_profile/out.test.toml
+++ b/acceptance/auth/bundle_and_profile/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/auth/bundle_and_profile/output.txt b/acceptance/auth/bundle_and_profile/output.txt
index ce88f0519bf..98347d64007 100644
--- a/acceptance/auth/bundle_and_profile/output.txt
+++ b/acceptance/auth/bundle_and_profile/output.txt
@@ -13,14 +13,14 @@
 
 === Inside the bundle, profile flag not matching bundle host. Should use profile from the flag and not the bundle.
 >>> errcode [CLI] current-user me -p profile_name
-Warn: [hostmetadata] failed to fetch host metadata for https://non.existing.subdomain.databricks.com, will skip for 1m0s
-Error: Get "https://non.existing.subdomain.databricks.com/api/2.0/preview/scim/v2/Me": (redacted)
+Warn: [hostmetadata] failed to fetch host metadata for https://non.existing.subdomain.databricks.test, will skip for 1m0s
+Error: Get "https://non.existing.subdomain.databricks.test/api/2.0/preview/scim/v2/Me": (redacted)
 
 Exit code: 1
 
 === Inside the bundle, target and not matching profile
 >>> errcode [CLI] current-user me -t dev -p profile_name
-Error: cannot resolve bundle auth configuration: the host in the profile (https://non.existing.subdomain.databricks.com) doesn’t match the host configured in the bundle ([DATABRICKS_TARGET]). The profile "DEFAULT" has host="[DATABRICKS_TARGET]" that matches host in the bundle. To select it, pass "-p DEFAULT"
+Error: cannot resolve bundle auth configuration: the host in the profile (https://non.existing.subdomain.databricks.test) doesn’t match the host configured in the bundle ([DATABRICKS_TARGET]). The profile "DEFAULT" has host="[DATABRICKS_TARGET]" that matches host in the bundle. To select it, pass "-p DEFAULT"
 
 
 Exit code: 1
@@ -49,7 +49,7 @@ Validation OK!
 
 === Bundle commands load bundle configuration with -p flag, validation not OK (profile host don't match bundle host)
 >>> errcode [CLI] bundle validate -p profile_name
-Error: cannot resolve bundle auth configuration: the host in the profile (https://non.existing.subdomain.databricks.com) doesn’t match the host configured in the bundle ([DATABRICKS_TARGET]). The profile "DEFAULT" has host="[DATABRICKS_TARGET]" that matches host in the bundle. To select it, pass "-p DEFAULT"
+Error: cannot resolve bundle auth configuration: the host in the profile (https://non.existing.subdomain.databricks.test) doesn’t match the host configured in the bundle ([DATABRICKS_TARGET]). The profile "DEFAULT" has host="[DATABRICKS_TARGET]" that matches host in the bundle. To select it, pass "-p DEFAULT"
 
 Name: test-auth
 Target: dev
diff --git a/acceptance/auth/bundle_and_profile/test.toml b/acceptance/auth/bundle_and_profile/test.toml
index 92458e9d303..289402e027a 100644
--- a/acceptance/auth/bundle_and_profile/test.toml
+++ b/acceptance/auth/bundle_and_profile/test.toml
@@ -10,5 +10,5 @@ Old='DATABRICKS_URL'
 New='DATABRICKS_TARGET'
 
 [[Repls]]
-Old='Get "https://non.existing.subdomain.databricks.com/api/2.0/preview/scim/v2/Me": .*'
-New='Get "https://non.existing.subdomain.databricks.com/api/2.0/preview/scim/v2/Me": (redacted)'
+Old='Get "https://non.existing.subdomain.databricks.test/api/2.0/preview/scim/v2/Me\??": .*'
+New='Get "https://non.existing.subdomain.databricks.test/api/2.0/preview/scim/v2/Me": (redacted)'
diff --git a/acceptance/auth/bundle_default_profile/databricks.yml.no-host.tmpl b/acceptance/auth/bundle_default_profile/databricks.yml.no-host.tmpl
new file mode 100644
index 00000000000..be6fb0c8f5e
--- /dev/null
+++ b/acceptance/auth/bundle_default_profile/databricks.yml.no-host.tmpl
@@ -0,0 +1,5 @@
+bundle:
+  name: test-default-profile
+
+# No workspace.host on purpose: this is the surface where
+# [__settings__].default_profile should be applied.
diff --git a/acceptance/auth/bundle_default_profile/databricks.yml.with-host.tmpl b/acceptance/auth/bundle_default_profile/databricks.yml.with-host.tmpl
new file mode 100644
index 00000000000..4c2f0748389
--- /dev/null
+++ b/acceptance/auth/bundle_default_profile/databricks.yml.with-host.tmpl
@@ -0,0 +1,5 @@
+bundle:
+  name: bundle-with-host
+
+workspace:
+  host: $DATABRICKS_HOST
diff --git a/acceptance/auth/bundle_default_profile/databricks.yml.with-profile.tmpl b/acceptance/auth/bundle_default_profile/databricks.yml.with-profile.tmpl
new file mode 100644
index 00000000000..18e719f0ea8
--- /dev/null
+++ b/acceptance/auth/bundle_default_profile/databricks.yml.with-profile.tmpl
@@ -0,0 +1,5 @@
+bundle:
+  name: bundle-with-profile
+
+workspace:
+  profile: other
diff --git a/acceptance/auth/bundle_default_profile/home/.databrickscfg.tmpl b/acceptance/auth/bundle_default_profile/home/.databrickscfg.tmpl
new file mode 100644
index 00000000000..0c00242c066
--- /dev/null
+++ b/acceptance/auth/bundle_default_profile/home/.databrickscfg.tmpl
@@ -0,0 +1,10 @@
+[default-target]
+host  = $DATABRICKS_HOST
+token = $DATABRICKS_TOKEN
+
+[other]
+host  = https://other.test
+token = other-token
+
+[__settings__]
+default_profile = default-target
diff --git a/acceptance/auth/bundle_default_profile/out.test.toml b/acceptance/auth/bundle_default_profile/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/auth/bundle_default_profile/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/auth/bundle_default_profile/output.txt b/acceptance/auth/bundle_default_profile/output.txt
new file mode 100644
index 00000000000..f8e8a3c0062
--- /dev/null
+++ b/acceptance/auth/bundle_default_profile/output.txt
@@ -0,0 +1,41 @@
+
+=== Bundle without workspace.host: default_profile is honored
+
+>>> [CLI] bundle validate -o json
+{
+  "host": null,
+  "profile": "default-target"
+}
+
+=== --profile overrides default_profile (negative case)
+
+>>> errcode [CLI] bundle validate -p other -o json
+Warn: [hostmetadata] failed to fetch host metadata for https://other.test, will skip for 1m0s
+Error: Get "https://other.test/api/2.0/preview/scim/v2/Me": (redacted)
+
+
+Exit code: 1
+{
+  "host": null,
+  "profile": "other"
+}
+
+=== Bundle with workspace.host: default_profile is NOT applied
+
+>>> errcode [CLI] bundle validate -o json
+{
+  "host": "[DATABRICKS_URL]",
+  "profile": null
+}
+
+=== Bundle with workspace.profile: pinned profile wins over default_profile
+
+>>> errcode [CLI] bundle validate -o json
+Error: Get "https://other.test/api/2.0/preview/scim/v2/Me": (redacted)
+
+
+Exit code: 1
+{
+  "host": null,
+  "profile": "other"
+}
diff --git a/acceptance/auth/bundle_default_profile/script b/acceptance/auth/bundle_default_profile/script
new file mode 100644
index 00000000000..2baefcbe139
--- /dev/null
+++ b/acceptance/auth/bundle_default_profile/script
@@ -0,0 +1,33 @@
+sethome "./home"
+
+# Save the test server host so we can pin a bundle-with-host variant below.
+host_value="$DATABRICKS_HOST"
+
+envsubst < "./home/.databrickscfg.tmpl" > "./home/.databrickscfg"
+
+unset DATABRICKS_HOST
+unset DATABRICKS_TOKEN
+unset DATABRICKS_CONFIG_PROFILE
+
+cp databricks.yml.no-host.tmpl databricks.yml
+title "Bundle without workspace.host: default_profile is honored\n"
+trace $CLI bundle validate -o json | jq '{host: .workspace.host, profile: .workspace.profile}'
+
+cp databricks.yml.no-host.tmpl databricks.yml
+title "--profile overrides default_profile (negative case)\n"
+trace errcode $CLI bundle validate -p other -o json | jq '{host: .workspace.host, profile: .workspace.profile}'
+
+# Switch to a bundle that pins workspace.host. The default_profile guard in
+# configureProfile must NOT apply default_profile here, because that would
+# silently route the user to a profile pointing at a different host than the
+# bundle declares.
+DATABRICKS_HOST="$host_value" envsubst < databricks.yml.with-host.tmpl > databricks.yml
+title "Bundle with workspace.host: default_profile is NOT applied\n"
+trace errcode $CLI bundle validate -o json | jq '{host: .workspace.host, profile: .workspace.profile}'
+
+# Switch to a bundle that pins workspace.profile but no host. The pinned
+# profile must win over default_profile — configureProfile's guard skips
+# default_profile when workspace.profile is already set.
+cp databricks.yml.with-profile.tmpl databricks.yml
+title "Bundle with workspace.profile: pinned profile wins over default_profile\n"
+trace errcode $CLI bundle validate -o json | jq '{host: .workspace.host, profile: .workspace.profile}'
diff --git a/acceptance/auth/bundle_default_profile/test.toml b/acceptance/auth/bundle_default_profile/test.toml
new file mode 100644
index 00000000000..5d5b0283f42
--- /dev/null
+++ b/acceptance/auth/bundle_default_profile/test.toml
@@ -0,0 +1,11 @@
+Ignore = [
+    "home",
+    ".databricks",
+    "databricks.yml",
+]
+
+# Negative case: -p other tries to reach a non-existing host. Redact the
+# OS-/network-dependent suffix so the test is stable across runners.
+[[Repls]]
+Old = 'Get "https://other.test/api/2.0/preview/scim/v2/Me\??": .*'
+New = 'Get "https://other.test/api/2.0/preview/scim/v2/Me": (redacted)'
diff --git a/acceptance/auth/credentials/basic/out.requests.txt b/acceptance/auth/credentials/basic/out.requests.txt
deleted file mode 100644
index 689113dd08c..00000000000
--- a/acceptance/auth/credentials/basic/out.requests.txt
+++ /dev/null
@@ -1,21 +0,0 @@
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]"
-    ]
-  },
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "headers": {
-    "Authorization": [
-      "Basic [ENCODED_AUTH]"
-    ],
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/current-user_me cmd-exec-id/[UUID] interactive/none auth/basic"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/preview/scim/v2/Me"
-}
diff --git a/acceptance/auth/credentials/basic/out.test.toml b/acceptance/auth/credentials/basic/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/auth/credentials/basic/out.test.toml
+++ b/acceptance/auth/credentials/basic/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/auth/credentials/basic/output.txt b/acceptance/auth/credentials/basic/output.txt
index 93c6060cffc..93d17337132 100644
--- a/acceptance/auth/credentials/basic/output.txt
+++ b/acceptance/auth/credentials/basic/output.txt
@@ -2,3 +2,26 @@
   "id": "[USERID]",
   "userName": "[USERNAME]"
 }
+
+>>> print_requests.py --get //
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]"
+    ]
+  },
+  "method": "GET",
+  "path": "/.well-known/databricks-config"
+}
+{
+  "headers": {
+    "Authorization": [
+      "Basic [ENCODED_AUTH]"
+    ],
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/current-user_me cmd-exec-id/[UUID] interactive/none auth/basic"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/preview/scim/v2/Me"
+}
diff --git a/acceptance/auth/credentials/basic/script b/acceptance/auth/credentials/basic/script
index aae249083f5..8817191edf3 100644
--- a/acceptance/auth/credentials/basic/script
+++ b/acceptance/auth/credentials/basic/script
@@ -6,3 +6,5 @@ export DATABRICKS_USERNAME=username
 export DATABRICKS_PASSWORD=password
 
 $CLI current-user me
+
+trace print_requests.py --get //
diff --git a/acceptance/auth/credentials/oauth/out.requests.txt b/acceptance/auth/credentials/oauth/out.requests.txt
deleted file mode 100644
index c3b7b53a7f4..00000000000
--- a/acceptance/auth/credentials/oauth/out.requests.txt
+++ /dev/null
@@ -1,43 +0,0 @@
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]"
-    ]
-  },
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]"
-    ]
-  },
-  "method": "GET",
-  "path": "/oidc/.well-known/oauth-authorization-server"
-}
-{
-  "headers": {
-    "Authorization": [
-      "Basic [ENCODED_AUTH]"
-    ],
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]"
-    ]
-  },
-  "method": "POST",
-  "path": "/oidc/v1/token",
-  "raw_body": "grant_type=client_credentials\u0026scope=all-apis"
-}
-{
-  "headers": {
-    "Authorization": [
-      "Bearer oauth-token"
-    ],
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/current-user_me cmd-exec-id/[UUID] interactive/none auth/oauth-m2m"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/preview/scim/v2/Me"
-}
diff --git a/acceptance/auth/credentials/oauth/out.test.toml b/acceptance/auth/credentials/oauth/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/auth/credentials/oauth/out.test.toml
+++ b/acceptance/auth/credentials/oauth/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/auth/credentials/oauth/output.txt b/acceptance/auth/credentials/oauth/output.txt
index 93c6060cffc..dc95db17fd1 100644
--- a/acceptance/auth/credentials/oauth/output.txt
+++ b/acceptance/auth/credentials/oauth/output.txt
@@ -2,3 +2,48 @@
   "id": "[USERID]",
   "userName": "[USERNAME]"
 }
+
+>>> print_requests.py --get //
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]"
+    ]
+  },
+  "method": "GET",
+  "path": "/.well-known/databricks-config"
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]"
+    ]
+  },
+  "method": "GET",
+  "path": "/oidc/.well-known/oauth-authorization-server"
+}
+{
+  "headers": {
+    "Authorization": [
+      "Basic [ENCODED_AUTH]"
+    ],
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]"
+    ]
+  },
+  "method": "POST",
+  "path": "/oidc/v1/token",
+  "raw_body": "grant_type=client_credentials&scope=all-apis"
+}
+{
+  "headers": {
+    "Authorization": [
+      "Bearer oauth-token"
+    ],
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/current-user_me cmd-exec-id/[UUID] interactive/none auth/oauth-m2m"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/preview/scim/v2/Me"
+}
diff --git a/acceptance/auth/credentials/oauth/script b/acceptance/auth/credentials/oauth/script
index e4519e41b18..7f38140c467 100644
--- a/acceptance/auth/credentials/oauth/script
+++ b/acceptance/auth/credentials/oauth/script
@@ -6,3 +6,5 @@ export DATABRICKS_CLIENT_ID=client_id
 export DATABRICKS_CLIENT_SECRET=client_secret
 
 $CLI current-user me
+
+trace print_requests.py --get //
diff --git a/acceptance/auth/credentials/pat/out.requests.txt b/acceptance/auth/credentials/pat/out.requests.txt
deleted file mode 100644
index c01b146d530..00000000000
--- a/acceptance/auth/credentials/pat/out.requests.txt
+++ /dev/null
@@ -1,21 +0,0 @@
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]"
-    ]
-  },
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "headers": {
-    "Authorization": [
-      "Bearer dapi1234"
-    ],
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/current-user_me cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/preview/scim/v2/Me"
-}
diff --git a/acceptance/auth/credentials/pat/out.test.toml b/acceptance/auth/credentials/pat/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/auth/credentials/pat/out.test.toml
+++ b/acceptance/auth/credentials/pat/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/auth/credentials/pat/output.txt b/acceptance/auth/credentials/pat/output.txt
index 93c6060cffc..4d1f837a9e7 100644
--- a/acceptance/auth/credentials/pat/output.txt
+++ b/acceptance/auth/credentials/pat/output.txt
@@ -2,3 +2,26 @@
   "id": "[USERID]",
   "userName": "[USERNAME]"
 }
+
+>>> print_requests.py --get //
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]"
+    ]
+  },
+  "method": "GET",
+  "path": "/.well-known/databricks-config"
+}
+{
+  "headers": {
+    "Authorization": [
+      "Bearer dapi1234"
+    ],
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/current-user_me cmd-exec-id/[UUID] interactive/none auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/preview/scim/v2/Me"
+}
diff --git a/acceptance/auth/credentials/pat/script b/acceptance/auth/credentials/pat/script
index ccf1098e7a8..dcc8361e698 100644
--- a/acceptance/auth/credentials/pat/script
+++ b/acceptance/auth/credentials/pat/script
@@ -1,3 +1,5 @@
 export DATABRICKS_TOKEN=dapi1234
 
 $CLI current-user me
+
+trace print_requests.py --get //
diff --git a/acceptance/auth/host-metadata-cache/home/.databrickscfg.tmpl b/acceptance/auth/host-metadata-cache/home/.databrickscfg.tmpl
new file mode 100644
index 00000000000..4c721cd96de
--- /dev/null
+++ b/acceptance/auth/host-metadata-cache/home/.databrickscfg.tmpl
@@ -0,0 +1,3 @@
+[cached]
+host = ${DATABRICKS_HOST}
+token = test-token
diff --git a/acceptance/auth/host-metadata-cache/out.test.toml b/acceptance/auth/host-metadata-cache/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/auth/host-metadata-cache/out.test.toml
+++ b/acceptance/auth/host-metadata-cache/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/auth/host-metadata-cache/output.txt b/acceptance/auth/host-metadata-cache/output.txt
index 0b99e9579c8..d059d2bbc4b 100644
--- a/acceptance/auth/host-metadata-cache/output.txt
+++ b/acceptance/auth/host-metadata-cache/output.txt
@@ -6,8 +6,8 @@
       "name": "cached",
       "host": "[DATABRICKS_URL]",
       "cloud": "aws",
-      "auth_type": "",
-      "valid": false
+      "auth_type": "pat",
+      "valid": true
     }
   ]
 }
@@ -19,8 +19,8 @@
       "name": "cached",
       "host": "[DATABRICKS_URL]",
       "cloud": "aws",
-      "auth_type": "",
-      "valid": false
+      "auth_type": "pat",
+      "valid": true
     }
   ]
 }
diff --git a/acceptance/auth/host-metadata-cache/script b/acceptance/auth/host-metadata-cache/script
index f7a5f2fe0f8..31f989aba0d 100644
--- a/acceptance/auth/host-metadata-cache/script
+++ b/acceptance/auth/host-metadata-cache/script
@@ -2,18 +2,15 @@ sethome "./home"
 export DATABRICKS_CACHE_DIR="$TEST_TMP_DIR/cache"
 
 # Point a profile at the mock server so auth profiles triggers a host metadata
-# fetch. Without a profile the command does nothing and the cache is never read.
-cat > "./home/.databrickscfg" <<EOF
-[cached]
-host = ${DATABRICKS_HOST}
-token = test-token
-EOF
+# fetch. Validation must stay on: --skip-validate resolves offline and would
+# never fetch or populate the cache.
+envsubst < "./home/.databrickscfg.tmpl" > "./home/.databrickscfg"
 
 title "First invocation populates the cache\n"
-$CLI auth profiles --skip-validate --output json
+$CLI auth profiles --output json
 
 title "Second invocation should read from the cache\n"
-$CLI auth profiles --skip-validate --output json
+$CLI auth profiles --output json
 
 title "Only one /.well-known/databricks-config request recorded\n"
 print_requests.py //.well-known/databricks-config --get --sort
diff --git a/acceptance/bin/add_repl.py b/acceptance/bin/add_repl.py
index 4f9ee2e737a..5f97d9cee80 100755
--- a/acceptance/bin/add_repl.py
+++ b/acceptance/bin/add_repl.py
@@ -5,20 +5,21 @@
 If entry already exists, it'll add suffix in _<number> format.
 """
 
-import os
 import argparse
+import json
+import os
+import sys
 from pathlib import Path
 
-ACC_REPLS = Path(os.environ["TEST_TMP_DIR"]) / "ACC_REPLS"
+sys.path.insert(0, str(Path(__file__).parent))
+from repls import USER_ORDER, read_entries
+
+ACC_REPLS = Path(os.environ["ACC_REPLS"])
 
 
 def get_repls():
-    result = {}
-    if ACC_REPLS.exists():
-        for line in ACC_REPLS.open():
-            value, repl = line.strip().rsplit(":", 1)
-            result[repl] = value
-    return result
+    # Only the literal entries are added here, so only those can collide.
+    return {item["New"] for item in read_entries() if item.get("Literal") is not None}
 
 
 def add_repl(value, repl):
@@ -28,13 +29,24 @@ def add_repl(value, repl):
             r = f"{repl}_{extra}"
         else:
             r = repl
-        if r in existing:
+        if f"[{r}]" in existing:
             continue
         with ACC_REPLS.open("a") as fobj:
-            fobj.write(f"{value}:{r}\n")
+            json.dump({"Literal": value, "New": f"[{r}]", "Order": USER_ORDER}, fobj)
+            fobj.write("\n")
         break
 
 
+def id_repl_name(key):
+    """Replacement name for the id of the resource with the given key: "foo" -> "FOO_ID".
+
+    The name is upper-cased, so a $UNIQUE_NAME inside the key would escape the harness's
+    (case-sensitive) [UNIQUE_NAME] replacement and make the name differ on every run.
+    Substitute it first: "app_${UNIQUE_NAME}_job" -> "APP_UNIQUE_NAME_JOB_ID".
+    """
+    return key.replace(os.environ["UNIQUE_NAME"], "UNIQUE_NAME").upper() + "_ID"
+
+
 def main():
     parser = argparse.ArgumentParser()
     parser.add_argument("value")
diff --git a/acceptance/bin/assert_exists.py b/acceptance/bin/assert_exists.py
new file mode 100755
index 00000000000..96f0a9720c8
--- /dev/null
+++ b/acceptance/bin/assert_exists.py
@@ -0,0 +1,13 @@
+#!/usr/bin/env python3
+import os
+import sys
+
+errors = 0
+
+for filename in sys.argv[1:]:
+    if not os.path.exists(filename):
+        sys.stderr.write(f"Unexpected: {filename} does not exist.\n")
+        errors += 1
+
+if errors:
+    sys.exit(1)
diff --git a/acceptance/bin/assert_not_exists.py b/acceptance/bin/assert_not_exists.py
new file mode 100755
index 00000000000..09faea7f9bb
--- /dev/null
+++ b/acceptance/bin/assert_not_exists.py
@@ -0,0 +1,13 @@
+#!/usr/bin/env python3
+import os
+import sys
+
+errors = 0
+
+for filename in sys.argv[1:]:
+    if os.path.exists(filename):
+        sys.stderr.write(f"Unexpected: {filename} exists.\n")
+        errors += 1
+
+if errors:
+    sys.exit(1)
diff --git a/acceptance/bin/benchmark.py b/acceptance/bin/benchmark.py
index bad87fd8b21..064cbb62a20 100755
--- a/acceptance/bin/benchmark.py
+++ b/acceptance/bin/benchmark.py
@@ -1,11 +1,11 @@
 #!/usr/bin/env python3
 import argparse
-import subprocess
-import time
+import json
+import os
 import statistics
+import subprocess
 import sys
-import os
-import json
+import time
 
 try:
     import resource
@@ -19,7 +19,7 @@ def run_benchmark(command, warmup, runs):
 
     for i in range(runs):
         # double fork to reset max statistics like ru_maxrss
-        cp = subprocess.run([sys.executable, sys.argv[0], "--once"] + command, stdout=subprocess.PIPE)
+        cp = subprocess.run([sys.executable, sys.argv[0], "--once", *command], stdout=subprocess.PIPE)
         if cp.returncode != 0:
             sys.exit(cp.returncode)
 
@@ -54,7 +54,7 @@ def run_benchmark(command, warmup, runs):
 
 
 def run_once(command):
-    if len(command) == 1 and " " in command[0] or ">" in command[0]:
+    if (len(command) == 1 and " " in command[0]) or ">" in command[0]:
         shell = True
         command = command[0]
     else:
diff --git a/acceptance/bin/browser.py b/acceptance/bin/browser.py
index e8493523263..2ed3cca8ff2 100755
--- a/acceptance/bin/browser.py
+++ b/acceptance/bin/browser.py
@@ -6,8 +6,8 @@
 Usage: browser.py <url>
 """
 
-import urllib.request
 import sys
+import urllib.request
 
 if len(sys.argv) < 2:
     sys.stderr.write("Usage: browser.py <url>\n")
diff --git a/acceptance/bin/callserver.py b/acceptance/bin/callserver.py
index 294ef8fdb05..2f1b4265aa1 100755
--- a/acceptance/bin/callserver.py
+++ b/acceptance/bin/callserver.py
@@ -1,7 +1,7 @@
 #!/usr/bin/env python3
-import sys
-import os
 import json
+import os
+import sys
 import urllib.request
 from urllib.parse import urlencode
 
diff --git a/acceptance/bin/capture_tfstate.py b/acceptance/bin/capture_tfstate.py
new file mode 100755
index 00000000000..ba65df8d224
--- /dev/null
+++ b/acceptance/bin/capture_tfstate.py
@@ -0,0 +1,107 @@
+#!/usr/bin/env python3
+"""
+Capture a terraform deployment's artifacts as migrate-test fixtures. Run ONCE, right after a
+`DATABRICKS_BUNDLE_ENGINE=terraform bundle deploy`, while the terraform engine is still present.
+
+Writes into the test's SOURCE dir ($TESTDIR):
+  - terraform.tfstate        the real terraform state
+  - terraform-requests.json  the resource-mutating requests (with bodies) terraform issued
+
+replay_tfstate.py later replays the requests to reconstruct a real terraform-shaped backend and
+drops in the (id-remapped) tfstate, so the migrate test starts from a real terraform deployment
+without running the (removed) terraform engine. The capture-time host is normalized to
+[DATABRICKS_URL] so the fixtures do not embed a per-run port.
+
+Usage: capture_tfstate.py [TARGET] [--out PREFIX]
+  TARGET   bundle target to read state from; auto-detected from .databricks/bundle/* if omitted.
+  --out    output path prefix; writes PREFIX.tfstate + PREFIX.requests.json (parents created).
+           Defaults to $TESTDIR/terraform, i.e. terraform.tfstate + terraform-requests.json.
+"""
+
+import argparse
+import glob
+import json
+import os
+import re
+import sys
+
+TESTDIR = os.environ["TESTDIR"]
+HOST = os.environ.get("DATABRICKS_HOST", "").rstrip("/")
+# Per-run values baked into the captured state/requests are normalized to placeholders so the
+# fixtures are frozen; replay_tfstate.py substitutes the current run's values back in.
+UNIQUE_NAME = os.environ.get("UNIQUE_NAME", "")
+
+# Requests that build backend resource state; everything else (file sync, state push, lock,
+# telemetry, scim, deletes) is deploy plumbing the migrate test does not need reconstructed.
+# `workspace/mkdirs` is kept, though: a resource can require a parent directory (a dashboard's
+# parent_path), which the migrate test's own deploy would not recreate before replay uses it.
+SKIP = re.compile(r"/api/2\.0/workspace-files|/api/2\.0/workspace/(?!mkdirs)|/telemetry|/scim|/\.well-known|/state/")
+
+
+def read_json_many(s):
+    dec = json.JSONDecoder()
+    out = []
+    pos, n = 0, len(s)
+    while pos < n:
+        while pos < n and s[pos] in " \t\r\n":
+            pos += 1
+        if pos >= n:
+            break
+        obj, pos = dec.raw_decode(s, pos)
+        out.append(obj)
+    return out
+
+
+def norm(text):
+    if HOST:
+        text = text.replace(HOST, "[DATABRICKS_URL]")
+    # UNIQUE_NAME is a long random per-run token, so a plain replace is safe.
+    if len(UNIQUE_NAME) >= 8:
+        text = text.replace(UNIQUE_NAME, "[UNIQUE_NAME]")
+    return text
+
+
+def detect_target(explicit):
+    if explicit:
+        return explicit
+    # The invariant configs declare no target, so find the one the deploy actually wrote.
+    dirs = [d for d in glob.glob(".databricks/bundle/*") if os.path.exists(f"{d}/terraform/terraform.tfstate")]
+    if len(dirs) != 1:
+        sys.exit(f"capture_tfstate.py: expected exactly one deployed target, found {dirs}")
+    return os.path.basename(dirs[0])
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument("target", nargs="?")
+    parser.add_argument("--out")
+    args = parser.parse_args()
+
+    target = detect_target(args.target)
+    tfstate_raw = open(f".databricks/bundle/{target}/terraform/terraform.tfstate").read()
+    requests = read_json_many(open(os.environ["OUT_REQUESTS"]).read())
+
+    # Keep `q` (query params, recorded separately by the harness): some creates carry a required id
+    # there, e.g. postgres `?project_id=...`, which the backend reads from the query, not the body.
+    kept = [
+        {"method": r["method"], "path": r["path"], **({"q": r["q"]} if r.get("q") else {}), "body": r.get("body")}
+        for r in requests
+        if r.get("method") in ("POST", "PUT", "PATCH") and not SKIP.search(r.get("path", ""))
+    ]
+
+    if args.out:
+        tfstate_path = args.out + ".tfstate"
+        requests_path = args.out + ".requests.json"
+        os.makedirs(os.path.dirname(tfstate_path) or ".", exist_ok=True)
+    else:
+        tfstate_path = os.path.join(TESTDIR, "terraform.tfstate")
+        requests_path = os.path.join(TESTDIR, "terraform-requests.json")
+
+    with open(tfstate_path, "w") as f:
+        f.write(norm(tfstate_raw))
+    with open(requests_path, "w") as f:
+        f.write(norm(json.dumps(kept, indent=2)) + "\n")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/acceptance/bin/contains.py b/acceptance/bin/contains.py
index 441d18b9aa6..c3ea8c1002a 100755
--- a/acceptance/bin/contains.py
+++ b/acceptance/bin/contains.py
@@ -10,6 +10,7 @@
         must_find.append(arg)
 
 found = set()
+failed = False
 
 for line in sys.stdin:
     sys.stdout.write(line)
@@ -19,9 +20,16 @@
     for t in must_not_find:
         if t in line:
             sys.stderr.write(f"contains error: {t!r} was not expected: {line.strip()!r}\n")
+            failed = True
 
 sys.stdout.flush()
 
 not_found = set(must_find) - found
 for item in sorted(not_found):
     sys.stderr.write(f"contains error: {item!r} not found in the output.\n")
+    failed = True
+
+# Exit non-zero so a failed assertion aborts the script (set -e -o pipefail)
+# instead of silently baking the error line into the expected output.
+if failed:
+    sys.exit(1)
diff --git a/acceptance/bin/diff.py b/acceptance/bin/diff.py
index a1eb91bdc57..93c75ef882b 100755
--- a/acceptance/bin/diff.py
+++ b/acceptance/bin/diff.py
@@ -1,34 +1,19 @@
 #!/usr/bin/env python3
 """This script implements "diff -r -U2 dir1 dir2" but applies replacements first"""
 
-import sys
-import os
 import difflib
-import json
-import re
+import sys
 from pathlib import Path
 
-
-def replaceAll(patterns, s):
-    for comp, new in patterns:
-        s = comp.sub(new, s)
-    return s
+sys.path.insert(0, str(Path(__file__).parent))
+from repls import compile_repls, replace_all
 
 
 def main():
     d1, d2 = sys.argv[1:]
     d1, d2 = Path(d1), Path(d2)
 
-    repls_json = Path(os.environ["TEST_TMP_DIR"]) / "repls.json"
-    repls = json.loads(repls_json.read_text())
-
-    patterns = []
-    for r in repls:
-        try:
-            c = re.compile(r["Old"])
-            patterns.append((c, r["New"]))
-        except re.error as e:
-            print(f"Regex error for pattern {r}: {e}", file=sys.stderr)
+    patterns = compile_repls()
 
     if d1.is_dir() and d2.is_dir():
         files1 = [str(p.relative_to(d1)) for p in d1.rglob("*") if p.is_file() and not p.name.startswith("LOG")]
@@ -54,8 +39,8 @@ def main():
 
 
 def diff_files(patterns, p1, p2):
-    a = replaceAll(patterns, p1.read_text()).splitlines(True)
-    b = replaceAll(patterns, p2.read_text()).splitlines(True)
+    a = replace_all(patterns, p1.read_text()).splitlines(True)
+    b = replace_all(patterns, p2.read_text()).splitlines(True)
     if a != b:
         p1_str = p1.as_posix()
         p2_str = p2.as_posix()
diff --git a/acceptance/bin/discovery_browser.py b/acceptance/bin/discovery_browser.py
index 42099fa06dd..96978edafc5 100755
--- a/acceptance/bin/discovery_browser.py
+++ b/acceptance/bin/discovery_browser.py
@@ -31,6 +31,11 @@
 dest_parsed = urllib.parse.urlparse(destination_url)
 dest_params = urllib.parse.parse_qs(dest_parsed.query)
 
+expected_client_id = os.environ.get("DATABRICKS_TEST_CLIENT_ID")
+if expected_client_id and dest_params.get("client_id") != [expected_client_id]:
+    sys.stderr.write(f"Expected client_id {expected_client_id!r}, got {dest_params.get('client_id')!r}\n")
+    sys.exit(1)
+
 redirect_uri = dest_params.get("redirect_uri", [None])[0]
 state = dest_params.get("state", [None])[0]
 
diff --git a/acceptance/bin/echo_browser.py b/acceptance/bin/echo_browser.py
new file mode 100755
index 00000000000..3d451cf4526
--- /dev/null
+++ b/acceptance/bin/echo_browser.py
@@ -0,0 +1,19 @@
+#!/usr/bin/env python3
+"""
+Fake browser that prints the URL it was asked to open and exits.
+
+Used by acceptance tests that exercise commands which call libs/browser.Open
+but don't need to follow the URL (unlike auth tests, which use browser.py to
+close the OAuth callback loop). Setting BROWSER=echo_browser.py is portable
+across darwin/linux/windows because libs/browser routes through libs/exec.
+
+Usage: echo_browser.py <url>
+"""
+
+import sys
+
+if len(sys.argv) < 2:
+    sys.stderr.write("Usage: echo_browser.py <url>\n")
+    sys.exit(1)
+
+print(sys.argv[1])
diff --git a/acceptance/bin/edit_resource.py b/acceptance/bin/edit_resource.py
index 7bca11a070d..59e29188d1a 100755
--- a/acceptance/bin/edit_resource.py
+++ b/acceptance/bin/edit_resource.py
@@ -5,17 +5,15 @@
 Fetches a given resource by id from the backend, executes Python code read from stdin and updates the resource.
 """
 
-import sys
-import os
-import subprocess
 import argparse
 import json
+import os
 import pprint
+import sys
 
 sys.path.insert(0, os.path.dirname(__file__))
 import util
-from util import run_json, run
-
+from util import run, run_json
 
 CLI = os.environ["CLI"]
 
diff --git a/acceptance/bin/envsubst.py b/acceptance/bin/envsubst.py
index 089a58e1755..32737a8282e 100755
--- a/acceptance/bin/envsubst.py
+++ b/acceptance/bin/envsubst.py
@@ -14,9 +14,9 @@
   echo 'Hello $USER from $HOME' | python envsubst.py
 """
 
-import sys
 import os
 import re
+import sys
 
 
 def substitute_variables(text):
@@ -36,8 +36,10 @@ def replace_var(match):
         # If the environment variable is not set, replace with an empty string.
         return os.environ.get(var_name, "")
 
-    # Match both $VAR and ${VAR} formats
-    pattern = r"\$\{([A-Za-z_][A-Za-z0-9_]*)\}|\$([A-Za-z_][A-Za-z0-9_]*)"
+    # Match both $VAR and ${VAR} formats. A reference preceded by "$" is left
+    # untouched, so a config can carry a literal $${VAR} through rendering
+    # (bundle configs use that form to escape ${...} from variable resolution).
+    pattern = r"(?<!\$)\$\{([A-Za-z_][A-Za-z0-9_]*)\}|(?<!\$)\$([A-Za-z_][A-Za-z0-9_]*)"
     return re.sub(pattern, replace_var, text)
 
 
diff --git a/acceptance/bin/extract_command_exec_id.py b/acceptance/bin/extract_command_exec_id.py
index 781c3e7247f..46a76916f4d 100755
--- a/acceptance/bin/extract_command_exec_id.py
+++ b/acceptance/bin/extract_command_exec_id.py
@@ -1,12 +1,12 @@
 #!/usr/bin/env python3
 import json
+import os
 import re
-import sys
 from pathlib import Path
 
 
 def extract_cmd_exec_id():
-    requests_file = Path("out.requests.txt")
+    requests_file = Path(os.environ["OUT_REQUESTS"])
 
     # Read JSON objects one at a time and find the first one with a cmd-exec-id
     # in the User-Agent header. Some requests (e.g. .well-known/databricks-config)
@@ -32,7 +32,7 @@ def extract_cmd_exec_id():
             if match:
                 return match.group(1)
 
-    raise SystemExit("No command execution ID found in any request in out.requests.txt")
+    raise SystemExit(f"No command execution ID found in any request in {requests_file}")
 
 
 if __name__ == "__main__":
diff --git a/acceptance/bin/fault.py b/acceptance/bin/fault.py
new file mode 100755
index 00000000000..5b75c0a5907
--- /dev/null
+++ b/acceptance/bin/fault.py
@@ -0,0 +1,73 @@
+#!/usr/bin/env python3
+"""Set up a fault rule on the testserver for the current test token.
+
+Usage: fault.py [--after-handler] [--body-contains SUBSTR] PATTERN STATUS_CODE OFFSET TIMES [ERROR_CODE]
+
+  --after-handler  run the handler first; keep its effect and replace only the response
+  --body-contains  only fire when the request body contains SUBSTR, e.g. to target one
+                   file's /workspace/import upload (all uploads share that path)
+  PATTERN     HTTP method and path, supports trailing * wildcard,
+              e.g. "PUT /api/2.0/permissions/pipelines/*"
+  STATUS_CODE HTTP status code to return, e.g. 504
+  OFFSET      number of requests to let through before fault starts
+  TIMES       number of times to return the fault response
+  ERROR_CODE  optional error_code for the response body, e.g.
+              MAX_CHILD_NODE_SIZE_EXCEEDED (defaults to INJECTED)
+
+The rule is scoped to the current DATABRICKS_TOKEN so it only affects
+the test that registers it, even when tests share a server.
+"""
+
+import json
+import os
+import sys
+import urllib.request
+
+host = os.environ.get("DATABRICKS_HOST", "")
+token = os.environ.get("DATABRICKS_TOKEN", "")
+
+if not host:
+    print("DATABRICKS_HOST not set", file=sys.stderr)
+    sys.exit(1)
+
+args = sys.argv[1:]
+after_handler = "--after-handler" in args
+if after_handler:
+    args.remove("--after-handler")
+
+body_contains = ""
+if "--body-contains" in args:
+    i = args.index("--body-contains")
+    body_contains = args[i + 1]
+    del args[i : i + 2]
+
+if len(args) not in (4, 5):
+    print(
+        f"usage: {sys.argv[0]} [--after-handler] [--body-contains SUBSTR] PATTERN STATUS_CODE OFFSET TIMES [ERROR_CODE]",
+        file=sys.stderr,
+    )
+    sys.exit(1)
+
+pattern, status_code, offset, times = args[0], int(args[1]), int(args[2]), int(args[3])
+error_code = args[4] if len(args) == 5 else "INJECTED"
+body = json.dumps({"error_code": error_code, "message": "Fault injected by test."})
+
+data = json.dumps(
+    {
+        "pattern": pattern,
+        "status_code": status_code,
+        "body": body,
+        "offset": offset,
+        "times": times,
+        "after_handler": after_handler,
+        "body_contains": body_contains,
+    }
+).encode()
+
+req = urllib.request.Request(
+    f"{host}/__testserver/fault",
+    data=data,
+    headers={"Content-Type": "application/json", "Authorization": f"Bearer {token}"},
+    method="POST",
+)
+urllib.request.urlopen(req)
diff --git a/acceptance/bin/find.py b/acceptance/bin/find.py
index be0920be124..61ad752fdc7 100755
--- a/acceptance/bin/find.py
+++ b/acceptance/bin/find.py
@@ -6,11 +6,10 @@
 If --expect N is provided, the number of matches must be N or error is printed.
 """
 
-import sys
+import argparse
 import os
 import re
-import argparse
-
+import sys
 
 parser = argparse.ArgumentParser()
 parser.add_argument("regex")
@@ -20,7 +19,7 @@
 regex = re.compile(args.regex)
 result = []
 
-for root, dirs, files in os.walk("."):
+for root, _dirs, files in os.walk("."):
     for filename in files:
         path = os.path.join(root, filename).replace("\\", "/")
         path = path.removeprefix("./")
diff --git a/acceptance/bin/free_port.py b/acceptance/bin/free_port.py
new file mode 100755
index 00000000000..9f6b86617fd
--- /dev/null
+++ b/acceptance/bin/free_port.py
@@ -0,0 +1,27 @@
+#!/usr/bin/env python3
+"""
+Print space-separated free TCP ports on the loopback interface.
+Usage: free_port.py [count]
+"""
+
+import socket
+import sys
+
+
+def main():
+    count = int(sys.argv[1]) if len(sys.argv) > 1 else 1
+
+    # Keep every socket bound until all ports are picked, otherwise the kernel
+    # is free to hand out the same port twice.
+    sockets = [socket.socket() for _ in range(count)]
+    for s in sockets:
+        s.bind(("127.0.0.1", 0))
+
+    print(" ".join(str(s.getsockname()[1]) for s in sockets))
+
+    for s in sockets:
+        s.close()
+
+
+if __name__ == "__main__":
+    main()
diff --git a/acceptance/bin/gen_config.py b/acceptance/bin/gen_config.py
index 84a72622713..5edc99fa529 100755
--- a/acceptance/bin/gen_config.py
+++ b/acceptance/bin/gen_config.py
@@ -1,7 +1,7 @@
 #!/usr/bin/env python3
 import argparse
-import json
 import copy
+import json
 
 JOB_TEMPLATE_BASE = {
     "description": "This job contain multiple tasks that are required to produce the weekly shark sightings report.",
diff --git a/acceptance/bin/gron.py b/acceptance/bin/gron.py
index af16da51e2c..b5d412d0a36 100755
--- a/acceptance/bin/gron.py
+++ b/acceptance/bin/gron.py
@@ -60,6 +60,26 @@ def sort_arrays(obj, keys):
 
     Sort uses a canonical JSON repr so the order is content-determined and stable
     across runs. Arrays not under a matching key keep their original order.
+
+    >>> sort_arrays({"acls": [{"n": "b"}, {"n": "a"}]}, {"acls"})
+    {'acls': [{'n': 'a'}, {'n': 'b'}]}
+
+    Arrays under a non-matching key are left in place:
+
+    >>> sort_arrays({"items": [3, 1, 2]}, {"acls"})
+    {'items': [3, 1, 2]}
+
+    Matching keys are sorted at any nesting depth:
+
+    >>> sort_arrays({"outer": {"acls": [2, 1]}}, {"acls"})
+    {'outer': {'acls': [1, 2]}}
+    >>> sort_arrays([{"acls": [2, 1]}], {"acls"})
+    [{'acls': [1, 2]}]
+
+    Scalars pass through unchanged:
+
+    >>> sort_arrays("plain", {"acls"})
+    'plain'
     """
     if isinstance(obj, dict):
         for k, v in obj.items():
diff --git a/acceptance/bin/json_in_json_normalize.py b/acceptance/bin/json_in_json_normalize.py
index dca1fd12616..7db47737fd3 100755
--- a/acceptance/bin/json_in_json_normalize.py
+++ b/acceptance/bin/json_in_json_normalize.py
@@ -23,10 +23,18 @@ def normalize_json_field(line, fields):
     r"""
     Normalize JSON in a field if the field name matches.
 
+    A matching field has its JSON value re-normalized (whitespace collapsed):
+
     >>> normalize_json_field('  "foo": "{\\"a\\": 1}",', {'foo'})
-    '  "foo": "{\\"a\\":1}",'
+    '  "foo": "{\\"a\\":1}",\n'
+
+    A field not in the set is left untouched:
+
     >>> normalize_json_field('  "foo": "{\\"a\\": 1}",', {'bar'})
     '  "foo": "{\\"a\\": 1}",'
+
+    A non-JSON value is left untouched:
+
     >>> normalize_json_field('  "other": "plain string",', {'foo'})
     '  "other": "plain string",'
     """
diff --git a/acceptance/bin/kill_after.py b/acceptance/bin/kill_after.py
new file mode 100755
index 00000000000..029123a13f5
--- /dev/null
+++ b/acceptance/bin/kill_after.py
@@ -0,0 +1,39 @@
+#!/usr/bin/env python3
+"""Set up a kill rule on the testserver for the current test token.
+
+Usage: kill_after.py PATTERN OFFSET TIMES
+
+  PATTERN   HTTP method and path, e.g. "POST /api/2.2/jobs/create"
+  OFFSET    number of requests to let through before killing starts
+  TIMES     number of times to kill the caller
+
+The rule is scoped to the current DATABRICKS_TOKEN so it only affects
+the test that registers it, even when tests share a server.
+"""
+
+import json
+import os
+import sys
+import urllib.request
+
+host = os.environ.get("DATABRICKS_HOST", "")
+token = os.environ.get("DATABRICKS_TOKEN", "")
+
+if not host:
+    print("DATABRICKS_HOST not set", file=sys.stderr)
+    sys.exit(1)
+
+if len(sys.argv) != 4:
+    print(f"usage: {sys.argv[0]} PATTERN OFFSET TIMES", file=sys.stderr)
+    sys.exit(1)
+
+pattern, offset, times = sys.argv[1], int(sys.argv[2]), int(sys.argv[3])
+
+data = json.dumps({"pattern": pattern, "offset": offset, "times": times}).encode()
+req = urllib.request.Request(
+    f"{host}/__testserver/kill",
+    data=data,
+    headers={"Content-Type": "application/json", "Authorization": f"Bearer {token}"},
+    method="POST",
+)
+urllib.request.urlopen(req)
diff --git a/acceptance/bin/kill_port.py b/acceptance/bin/kill_port.py
index 7e499a99d42..94a96404309 100755
--- a/acceptance/bin/kill_port.py
+++ b/acceptance/bin/kill_port.py
@@ -4,10 +4,10 @@
 Usage: kill_port.py <port1> [port2] [port3] ...
 """
 
-import sys
-import subprocess
 import platform
 import re
+import subprocess
+import sys
 
 
 def kill_processes_on_port(port):
@@ -58,7 +58,7 @@ def kill_processes_on_port(port):
                                     capture_output=True,
                                 )
 
-    except Exception as e:
+    except Exception:
         # Silently continue - port cleanup is best effort
         pass
 
diff --git a/acceptance/bin/normalize_uc_payload.py b/acceptance/bin/normalize_uc_payload.py
new file mode 100755
index 00000000000..b5c07822386
--- /dev/null
+++ b/acceptance/bin/normalize_uc_payload.py
@@ -0,0 +1,120 @@
+#!/usr/bin/env python3
+"""
+Normalize a UC JSON payload read from stdin, writing the result to stdout. The payload
+is either a bundle plan or a `catalogs get` / `schemas get` response; the same pruning
+applies to both (the plan-only `changes` handling simply does not fire on a GET response).
+
+UC managed-default properties (unity.catalog.managed.<format>.defaults.*) are ALWAYS
+pruned. UC auto-populates these on every catalog/schema, but only on some clouds (AWS/GCP
+yes, Azure no), so a committed golden cannot show them. The CLI already classifies them as
+backend defaults, so they never affect the plan; dropping them here is output-only.
+
+Managed properties surface in these shapes, all handled by pruning matching keys:
+  - a `properties` map (remote_state.properties, new_state.value.properties, ...);
+    an emptied `properties` object is then dropped so {} vs absent doesn't diverge.
+  - a plan change entry that is purely a managed-default change (keyed `properties` with a
+    managed-only `remote`, or `properties['unity.catalog.managed...']`). It is dropped
+    wherever it appears — including at the top level, where `jq '.plan[].changes'` extracts
+    it without its enclosing `changes` key. An emptied `changes` object is likewise dropped.
+
+Only the managed-default change is dropped, not every `backend_default` skip: a plain
+backend default like a volume's `storage_location` is deterministic and stays in the golden.
+
+Any field names passed as arguments are additionally deleted wherever they appear. These
+are the volatile server-set fields (created_at, metastore_id, schema_id, ...) each test
+previously stripped with an inline `jq 'walk(del(...))'`; the set is test-specific, so it
+stays at the call site rather than being centralized here.
+"""
+
+import json
+import re
+import sys
+
+# Matches a managed-default property key, whether bare (as a map key) or wrapped in a
+# plan change key like properties['unity.catalog.managed.delta.defaults.delta....'].
+managed_re = re.compile(r"unity\.catalog\.managed\..*\.defaults\..*")
+
+
+def is_managed_change(key, value):
+    """Report whether a plan `changes` entry is purely a managed-default change.
+
+    UC emits the managed-property drift either per key (change key
+    `properties['unity.catalog.managed...']`) or as the whole map at the parent path
+    (bare `properties` key, managed map under `remote`). Both are backend defaults the
+    CLI already skips, so they are output noise.
+
+    >>> is_managed_change("properties['unity.catalog.managed.a.defaults.b']", {"action": "skip"})
+    True
+
+    >>> is_managed_change("properties", {"action": "skip", "reason": "backend_default", "remote": {"unity.catalog.managed.a.defaults.b": "1"}})
+    True
+
+    >>> is_managed_change("properties", {"action": "update", "remote": {"custom": "v"}})
+    False
+
+    >>> is_managed_change("name", {"action": "update"})
+    False
+    """
+    if managed_re.search(key):
+        return True
+    if key != "properties" or not isinstance(value, dict):
+        return False
+    remote = value.get("remote")
+    return isinstance(remote, dict) and bool(remote) and all(managed_re.search(k) for k in remote)
+
+
+def prune(node, drop_fields):
+    """Recursively drop managed-default properties and the given volatile fields.
+
+    >>> prune({"created_at": 1, "name": "c"}, {"created_at"})
+    {'name': 'c'}
+
+    >>> prune({"properties": {"unity.catalog.managed.delta.defaults.x": "true"}}, set())
+    {}
+
+    >>> prune({"properties": {"unity.catalog.managed.delta.defaults.x": "1", "k": "v"}}, set())
+    {'properties': {'k': 'v'}}
+
+    >>> prune({"changes": {"properties": {"action": "skip", "remote": {"unity.catalog.managed.a.defaults.b": "1"}}, "name": {"action": "update"}}}, set())
+    {'changes': {'name': {'action': 'update'}}}
+
+    >>> prune({"comment": {"action": "update"}, "properties": {"action": "skip", "reason": "backend_default", "remote": {"unity.catalog.managed.a.defaults.b": "1"}}}, set())
+    {'comment': {'action': 'update'}}
+
+    >>> prune({"storage_location": {"action": "skip", "reason": "backend_default"}}, set())
+    {'storage_location': {'action': 'skip', 'reason': 'backend_default'}}
+
+    >>> prune([{"metastore_id": "m", "full_name": "c.s"}], {"metastore_id"})
+    [{'full_name': 'c.s'}]
+    """
+    if isinstance(node, list):
+        return [prune(v, drop_fields) for v in node]
+    if not isinstance(node, dict):
+        return node
+
+    result = {}
+    for key, value in node.items():
+        if key in drop_fields or managed_re.search(key):
+            continue
+        # Drop a managed-default change wherever it sits: nested under `changes`, or at the
+        # top level after `jq '.plan[].changes'` has stripped the enclosing `changes` key.
+        if is_managed_change(key, value):
+            continue
+        pruned = prune(value, drop_fields)
+        # Drop a properties/changes object emptied by managed-key removal so goldens
+        # don't diverge on {} (cloud that injects) vs absent (cloud that doesn't).
+        if key in ("properties", "changes") and pruned == {}:
+            continue
+        result[key] = pruned
+    return result
+
+
+def main():
+    drop_fields = set(sys.argv[1:])
+    data = json.load(sys.stdin)
+    json.dump(prune(data, drop_fields), sys.stdout, indent=2)
+    sys.stdout.write("\n")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/acceptance/bin/nostamp.py b/acceptance/bin/nostamp.py
new file mode 100755
index 00000000000..8a0c222630c
--- /dev/null
+++ b/acceptance/bin/nostamp.py
@@ -0,0 +1,79 @@
+#!/usr/bin/env python3
+"""Read JSON on stdin, write it back with the DMS deployment stamp removed.
+
+Deployment history recording (DATABRICKS_BUNDLE_DEPLOYMENT_HISTORY=true; see
+bundle/test.toml) adds a deployment stamp to plans, states, and resource payloads. Pipe any of
+those through this so an acceptance golden compares equal whether or not recording is on. Output
+is a 2-space indent, keys in input order, <>& left unescaped, and integers at full precision.
+Tests under bundle/dms assert the stamp itself and must not use it.
+
+Removed in three shapes plus the plan header:
+  1. deployment_id/version_id nested in a deployment block, recognized by the
+     neighbouring "kind" and "metadata_file_path", which are kept; version_id
+     == "" is kept (a Terraform state dump carries that for an unstamped job).
+  2. changes entries keyed "deployment.deployment_id" / "deployment.version_id".
+  3. a changes object emptied by (2), or already empty.
+  4. the recorded plan header field features.
+"""
+
+import argparse
+import json
+import sys
+
+_STAMP_KEYS = ("deployment_id", "version_id")
+_CHANGE_KEYS = ("deployment.deployment_id", "deployment.version_id")
+_PLAN_HEADER_KEYS = ("features",)
+
+
+def scrub(node):
+    if isinstance(node, dict):
+        # 1. A deployment block is the only object carrying both of these.
+        if "kind" in node and "metadata_file_path" in node:
+            for k in _STAMP_KEYS:
+                if node.get(k, "") != "":
+                    node.pop(k, None)
+        out = {}
+        for k, v in node.items():
+            if k == "changes" and isinstance(v, dict):
+                v = {ck: scrub(cv) for ck, cv in v.items() if ck not in _CHANGE_KEYS}
+                if not v:
+                    continue  # 3. drop a changes object left (or already) empty
+                out[k] = v
+            else:
+                out[k] = scrub(v)
+        return out
+    if isinstance(node, list):
+        return [scrub(x) for x in node]
+    return node
+
+
+def render(data, indent):
+    data = scrub(data)
+    if isinstance(data, dict):
+        for k in _PLAN_HEADER_KEYS:
+            data.pop(k, None)  # 4. plan header, present only at the root
+    return json.dumps(data, indent=indent, ensure_ascii=False, separators=(",", ": "))
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    # A state dump is printed with a single-space indent; plans use two.
+    parser.add_argument("--indent", type=int, default=2)
+    args = parser.parse_args()
+
+    # Input is one JSON value (a plan or state dump) or a whitespace-separated stream of them (each
+    # request emitted by a print_requests filter) - jq accepted both here, so this must too.
+    text = sys.stdin.read()
+    decoder = json.JSONDecoder()
+    idx, n = 0, len(text)
+    while idx < n:
+        while idx < n and text[idx].isspace():
+            idx += 1
+        if idx >= n:
+            break
+        data, idx = decoder.raw_decode(text, idx)
+        sys.stdout.write(render(data, args.indent) + "\n")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/acceptance/bin/print_requests.py b/acceptance/bin/print_requests.py
index c06449a2482..dda0476d4fd 100755
--- a/acceptance/bin/print_requests.py
+++ b/acceptance/bin/print_requests.py
@@ -7,10 +7,11 @@
 If argument starts with ! then it's a negation filter.
 
 Examples:
-  print_requests.py //jobs                     # Show non-GET requests with /jobs in path
-  print_requests.py --get //jobs               # Show all requests with /jobs in path
-  print_requests.py --sort '^//import-file/'   # Show non-GET requests, exclude /import-file/, sort output
-  print_requests.py --keep //jobs              # Show requests and do not delete out.requests.json afterwards
+  print_requests.py //jobs                              # Show non-GET requests with /jobs in path
+  print_requests.py --get //jobs                        # Show all requests with /jobs in path
+  print_requests.py --sort '^//import-file/'            # Show non-GET requests, exclude /import-file/, sort output
+  print_requests.py --keep //jobs                       # Show requests and do not delete out.requests.json afterwards
+  print_requests.py //api/2.0/repos/snapshots --method DELETE  # Show only DELETE to that path
 
 This replaces custom jq wrappers like:
   jq --sort-keys 'select(.method != "GET" and (.path | contains("/jobs")))' < out.requests.txt
@@ -56,21 +57,48 @@
 >>> # Test positive + negative filters (AND logic)
 >>> test(test_requests, ["//api", "^/jobs"], False, False)
 R4 POST
+
+>>> # --unique collapses consecutive duplicate requests (like uniq), e.g. repeated GET polls
+>>> dup_requests = [
+...     {"method": "POST", "path": "/api/2.0/idx", "body": {"n": 1}},
+...     {"method": "GET", "path": "/api/2.0/idx"},
+...     {"method": "GET", "path": "/api/2.0/idx"},
+... ]
+>>> [x["method"] for x in filter_requests(dup_requests, ["//idx"], True, False, unique=True)]
+['POST', 'GET']
+
+>>> # Only consecutive duplicates collapse; a repeat after another request is kept
+>>> seq = [
+...     {"method": "GET", "path": "/api/2.0/idx"},
+...     {"method": "DELETE", "path": "/api/2.0/idx"},
+...     {"method": "GET", "path": "/api/2.0/idx"},
+...     {"method": "GET", "path": "/api/2.0/idx"},
+... ]
+>>> [x["method"] for x in filter_requests(seq, ["//idx"], True, False, unique=True)]
+['GET', 'DELETE', 'GET']
 """
 
+import argparse
+import json
 import os
 import sys
-import json
-import argparse
 from pathlib import Path
 
-
 # I've originally tried ADD_PREFIX to be empty, so you can just do "print_requests.py /jobs"
 # However, that causes test to fail on Windows CI because "/jobs" becomes "C:/Program Files/Git/jobs"
 # This behaviour can be disabled with MSYS_NO_PATHCONV=1 but that causes other failures, so we require extra slash here.
 ADD_PREFIX = "/"
 NEGATE_PREFIX = "^/"
 
+# What --nostamp deletes. A job create sends the deployment block at the top level, an
+# update nests it under new_settings.
+STAMP_FIELDS = [
+    "deployment.deployment_id",
+    "deployment.version_id",
+    "new_settings.deployment.deployment_id",
+    "new_settings.deployment.version_id",
+]
+
 
 def read_json_many(s):
     result = []
@@ -104,7 +132,13 @@ def read_json_many(s):
 assert result == [{"method": "GET"}, {"method": "POST"}], result
 
 
-def filter_requests(requests, path_filters, include_get, should_sort):
+# DMS_PATH is the deployment metadata service's prefix; see filter_requests.
+DMS_PATH = "/api/2.0/bundle"
+
+
+def filter_requests(
+    requests, path_filters, include_get, should_sort, unique=False, method_filter=None, include_dms=False
+):
     """Filter requests based on method and path filters."""
     positive_filters = []
     negative_filters = []
@@ -117,10 +151,21 @@ def filter_requests(requests, path_filters, include_get, should_sort):
         else:
             sys.exit(f"Unrecognized filter: {f!r}")
 
+    # Deployment-history requests carry the resource key in the path
+    # (.../operations/jobs.foo), so a filter like //jobs matches them too and every test
+    # that records one resource type would pick these up in the recording run. Excluded
+    # unless --dms asks for them.
+    if not include_dms:
+        negative_filters.append(DMS_PATH)
+
     filtered_requests = []
     for req in requests:
-        # Skip GET requests unless include_get is True
-        if req.get("method") == "GET" and not include_get:
+        if method_filter:
+            # --method overrides the default GET exclusion
+            if req.get("method") != method_filter:
+                continue
+        elif req.get("method") == "GET" and not include_get:
+            # Skip GET requests unless include_get is True
             continue
 
         # Apply path filters
@@ -145,28 +190,107 @@ def filter_requests(requests, path_filters, include_get, should_sort):
     if should_sort:
         filtered_requests.sort(key=str)
 
+    if unique:
+        deduped = []
+        for req in filtered_requests:
+            if not deduped or deduped[-1] != req:
+                deduped.append(req)
+        filtered_requests = deduped
+
     return filtered_requests
 
 
+def summary_line(req):
+    """Format a request as "METHOD path key=value ...", query keys sorted.
+
+    >>> summary_line({"method": "GET", "path": "/api/2.0/workspace/get-status", "q": {"path": "/a", "return_export_info": "true"}})
+    'GET /api/2.0/workspace/get-status path=/a return_export_info=true'
+    >>> summary_line({"method": "POST", "path": "/api/2.1/jobs/create", "body": {"name": "x"}})
+    'POST /api/2.1/jobs/create'
+    """
+    parts = [req.get("method", ""), req.get("path", "")]
+    parts += [f"{k}={v}" for k, v in sorted(req.get("q", {}).items())]
+    return " ".join(parts)
+
+
+def del_path(body, field):
+    """Delete field from body. A dotted field descends into nested objects, e.g.
+    deployment.version_id removes only that key from the deployment block."""
+    *parents, leaf = field.split(".")
+    for name in parents:
+        body = body.get(name)
+        if not isinstance(body, dict):
+            return
+    body.pop(leaf, None)
+
+
 def main():
     parser = argparse.ArgumentParser()
-    parser.add_argument("path_filters", nargs="*", help=f"Path substring filters")
+    parser.add_argument("path_filters", nargs="*", help="Path substring filters")
     parser.add_argument("-v", "--verbose", action="store_true", help="Enable diagnostic messages")
     parser.add_argument("--get", action="store_true", help="Include GET requests (excluded by default)")
+    parser.add_argument(
+        "--dms",
+        action="store_true",
+        help="Include deployment-history requests (excluded by default; see filter_requests)",
+    )
     parser.add_argument("--keep", action="store_true", help="Keep out.requests.json file after processing")
     parser.add_argument("--sort", action="store_true", help="Sort requests before output")
+    parser.add_argument(
+        "--unique",
+        action="store_true",
+        help="Collapse consecutive duplicate requests (like uniq), e.g. repeated GET polls",
+    )
+    parser.add_argument("--method", metavar="METHOD", help="Only show requests with this HTTP method (e.g. DELETE)")
     parser.add_argument("--oneline", action="store_true", help="Print output with one request per line")
-    parser.add_argument("--fname", default="out.requests.txt")
+    parser.add_argument(
+        "--summary",
+        action="store_true",
+        help="Print only method, path and query of each request, one per line, so a test can "
+        "assert which calls a command makes without their bodies.",
+    )
+    parser.add_argument(
+        "--del-body",
+        action="append",
+        default=[],
+        metavar="FIELDS",
+        help="Comma-separated body fields to delete from each request (repeatable). Use for "
+        "body fields that diverge between deployment engines, e.g. identity fields the "
+        "terraform provider serializes into the body but the direct engine sends as query params.",
+    )
+    parser.add_argument(
+        "--del-field",
+        action="append",
+        default=[],
+        metavar="FIELDS",
+        help="Comma-separated top-level request fields to delete (repeatable). Unlike "
+        "--del-body, which edits the parsed JSON body, this drops a field of the request "
+        "record itself, e.g. raw_body for a binary upload payload.",
+    )
+    parser.add_argument(
+        "--nostamp",
+        action="store_true",
+        help="Drop the deployment stamp (deployment_id, version_id) from job and pipeline "
+        "bodies, so a test asserts the same requests whether or not deployment history "
+        "recording is on. Shorthand for the --del-body fields it implies.",
+    )
+    parser.add_argument("--fname", default=os.environ["OUT_REQUESTS"])
     args = parser.parse_args()
 
+    del_body_fields = [field for group in args.del_body for field in group.split(",")]
+    if args.nostamp:
+        del_body_fields += STAMP_FIELDS
+    del_fields = [field for group in args.del_field for field in group.split(",")]
+
+    fname = Path(args.fname)
     test_tmp_dir = os.environ.get("TEST_TMP_DIR")
-    if test_tmp_dir:
-        requests_file = Path(test_tmp_dir) / args.fname
+    if test_tmp_dir and not fname.is_absolute():
+        requests_file = Path(test_tmp_dir) / fname
     else:
-        requests_file = Path(args.fname)
+        requests_file = fname
 
     if not requests_file.exists():
-        sys.exit(f"File {requests_file} not found")
+        sys.exit(f"File {requests_file.as_posix()} not found")
 
     with open(requests_file) as fobj:
         data = fobj.read()
@@ -175,7 +299,17 @@ def main():
         return
 
     requests = read_json_many(data)
-    filtered_requests = filter_requests(requests, args.path_filters, args.get, args.sort)
+    filtered_requests = filter_requests(
+        requests, args.path_filters, args.get, args.sort, args.unique, args.method, args.dms
+    )
+
+    for req in filtered_requests:
+        body = req.get("body")
+        if isinstance(body, dict):
+            for field in del_body_fields:
+                del_path(body, field)
+        for field in del_fields:
+            req.pop(field, None)
     if args.verbose:
         print(
             f"Read {len(data)} chars, {len(requests)} requests, {len(filtered_requests)} after filtering",
@@ -183,6 +317,16 @@ def main():
             flush=True,
         )
 
+    if args.summary:
+        lines = [summary_line(req) for req in filtered_requests]
+        # Sorted after formatting: concurrent requests are recorded in arrival order, and the
+        # summary drops the fields --sort would otherwise break ties on.
+        if args.sort:
+            lines.sort()
+        for line in lines:
+            print(line)
+        filtered_requests = []
+
     for req in filtered_requests:
         if args.oneline:
             print(json.dumps(req))
diff --git a/acceptance/bin/print_state.py b/acceptance/bin/print_state.py
index 1a1b47051b3..6ad674342c3 100755
--- a/acceptance/bin/print_state.py
+++ b/acceptance/bin/print_state.py
@@ -1,14 +1,20 @@
 #!/usr/bin/env python3
 """
-Print resources state from default target.
+Print resources state from default target, and handle DMS (deployment metadata service) interactions.
 
 Note, this intentionally has no logic on guessing what is the right state file (e.g. via DATABRICKS_BUNDLE_ENGINE),
 the goal is to record all states that are available.
 """
 
-import os
-import glob
 import argparse
+import functools
+import glob
+import json
+import os
+import posixpath
+import subprocess
+
+from nostamp import scrub
 
 
 def print_file(filename):
@@ -53,14 +59,172 @@ def get_state_file(target, backup):
     return filtered[0] if filtered else result[0]
 
 
+# DMS (deployment metadata service) interaction helpers
+# https://go.databricks.com/dms-service
+
+CLI = os.environ.get("CLI", "databricks")
+DEPLOYMENT_NODE_NAME = "resources.deployment.json"  # Must match dms.DeploymentNodeName
+
+
+def run_json(cmd, allow_failure=False):
+    """Run cmd and parse its stdout, or return None if it fails and allow_failure is set.
+    stderr is captured rather than inherited: these lookups are plumbing, and a CLI warning
+    like "no files to sync" would otherwise land in the test output."""
+    result = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, encoding="utf-8")
+    if result.returncode != 0:
+        if allow_failure:
+            return None
+        raise SystemExit(f"{cmd} failed with code {result.returncode}\n{result.stdout}{result.stderr}".strip())
+    return json.loads(result.stdout)
+
+
+def get_remote_state_path(target):
+    """The bundle's remote state directory.
+
+    Preferred source is the sync snapshot, because it needs no CLI call: re-running the config
+    load would need whatever --var and flags the test deployed with, which a helper cannot know.
+    A bundle with no files to sync writes no snapshot, so fall back to asking the CLI - those
+    bundles are the ones with nothing to parameterize."""
+    target_dir = os.path.dirname(get_state_file(target, False))
+    snapshots = glob.glob(f"{target_dir}/sync-snapshots/*.json")
+    if snapshots:
+        # One snapshot per remote path, so a test that moved its root leaves several: the newest
+        # is the one the last deploy used.
+        newest = max(snapshots, key=os.path.getmtime)
+        remote_path = json.loads(open(newest).read())["remote_path"]
+        # state and files are siblings under the bundle root.
+        return posixpath.join(posixpath.dirname(remote_path), "state")
+
+    args = [CLI, "bundle", "validate", "--output", "json"]
+    if target:
+        args += ["-t", target]
+    return run_json(args)["workspace"]["state_path"]
+
+
+@functools.cache
+def get_deployment_id(target):
+    """The recorded deployment's id, or None when nothing is recorded.
+
+    Cached and shared: both the resource listing and the version lookup need it, and resolving it
+    costs a workspace round trip. No node means nothing has been recorded, the conclusion
+    dms.resolveDeploymentID also draws from a 404 - the deployment is gone once the bundle is
+    destroyed.
+    """
+    state_path = get_remote_state_path(target)
+    if not state_path:
+        return None
+    node = run_json([CLI, "workspace", "get-status", f"{state_path}/{DEPLOYMENT_NODE_NAME}"], allow_failure=True)
+    if not node or not node.get("object_id"):
+        return None
+    return node["object_id"]
+
+
+@functools.cache
+def get_resources(target):
+    """Map every recorded resource key ("jobs.foo") to its {"id", "state"}.
+
+    Empty when the bundle has no deployment recorded yet. Cached because a lookup costs three
+    round trips and a script asks for one resource at a time.
+    """
+    deployment_id = get_deployment_id(target)
+    if not deployment_id:
+        return {}
+
+    result = {}
+    # The service pages at 50 resources; the local fake returns everything at once.
+    page_token = None
+    while True:
+        url = f"/api/2.0/bundle/deployments/{deployment_id}/resources"
+        if page_token:
+            url += f"?page_token={page_token}"
+        listed = run_json([CLI, "api", "get", url])
+        for resource in listed.get("resources") or []:
+            # The service stores state as the opaque envelope the CLI wrote (dstate.RecordedState),
+            # so unwrap it to the resource state itself.
+            envelope = json.loads(resource["state"]) if resource.get("state") else {}
+            result[resource["resource_key"]] = {
+                "id": resource.get("resource_id"),
+                "state": envelope.get("state") or {},
+                "depends_on": envelope.get("depends_on") or [],
+            }
+        page_token = listed.get("next_page_token")
+        if not page_token:
+            return result
+
+
+def get_recorded_state(target):
+    """The recorded resources in the on-disk state file's `state` shape (resources.<key> ->
+    {__id__, state, depends_on}), so a recording run prints the same shape as a non-recording one."""
+    state = {}
+    for key, value in sorted(get_resources(target).items()):
+        entry = {"__id__": value["id"], "state": value["state"]}
+        if value["depends_on"]:
+            entry["depends_on"] = value["depends_on"]
+        state[f"resources.{key}"] = entry
+    return state
+
+
+def get_last_version_id(target):
+    """The version the service has recorded for this deployment, or None when nothing is recorded."""
+    deployment_id = get_deployment_id(target)
+    if not deployment_id:
+        return None
+    deployment = run_json([CLI, "api", "get", f"/api/2.0/bundle/deployments/{deployment_id}"])
+    return (deployment or {}).get("last_version_id")
+
+
+def print_recorded_state(filename, target):
+    """Print the state file with its resources filled in from the deployment metadata service.
+
+    While recording, the file itself carries only the header - the service holds the resources - so
+    printing it raw would show an empty state and differ from the same test's non-recording run.
+    """
+    data = json.loads(open(filename).read())
+    # Recording stamps each resource payload with the deployment and version; drop it here so the
+    # printed state matches a non-recording run without every caller piping through nostamp.
+    data["state"] = scrub(get_recorded_state(target))
+
+    # The file's serial is a copy of the DMS version to ensure outdated resource state is not read.
+    # Rebuild in header order with the authoritative serial from the deployment.
+    last_version_id = get_last_version_id(target)
+    serial = int(last_version_id) if last_version_id else 0
+
+    # Recording itself is not what these tests assert, so drop the feature that marks it.
+    features = {k: v for k, v in (data.get("features") or {}).items() if k != "deployment_history"}
+
+    rebuilt = {}
+    for key in ("state_version", "cli_version", "lineage"):
+        if key in data:
+            rebuilt[key] = data[key]
+    rebuilt["serial"] = serial
+    if features:
+        rebuilt["features"] = features
+    for key, value in data.items():
+        if key not in rebuilt and key != "features":
+            rebuilt[key] = value
+    print(json.dumps(rebuilt, indent=1))
+
+
 def main():
     parser = argparse.ArgumentParser()
     parser.add_argument("-t", "--target")
     parser.add_argument("--backup", action="store_true")
+    parser.add_argument(
+        "--no-dms",
+        action="store_true",
+        help="Print resources.json as-is without fetching state from DMS. "
+        "Use in bundle/dms tests to assert the tombstone content of the file.",
+    )
     args = parser.parse_args()
 
     for filename in get_state_files(args.target, args.backup):
-        if os.path.exists(filename):
+        if not os.path.exists(filename):
+            continue
+        # Recording only applies to direct-engine state, so a terraform state file prints as-is.
+        recording = os.environ.get("DATABRICKS_BUNDLE_DEPLOYMENT_HISTORY") == "true"
+        if recording and filename.endswith("resources.json") and not args.no_dms:
+            print_recorded_state(filename, args.target)
+        else:
             print_file(filename)
 
 
diff --git a/acceptance/bin/read_id.py b/acceptance/bin/read_id.py
index 17efe8ed820..1b596d3d92f 100755
--- a/acceptance/bin/read_id.py
+++ b/acceptance/bin/read_id.py
@@ -3,19 +3,20 @@
 Print id of the resource from the state. Update ACC_REPLS for a given ID.
 
  Example: read_id.py foo
- Output job_id, e.g. "5555" and update ACC_REPLS with record "5555:FOO_ID"
+ Output job_id, e.g. "5555" and update ACC_REPLS to replace "5555" with [FOO_ID]
 
 Usage: <group> <name> [attr...]
 """
 
-import sys
-import json
 import argparse
+import json
+import os
+import sys
 from pathlib import Path
 
 sys.path.insert(0, str(Path(__file__).parent))
-from print_state import get_state_file
-from add_repl import add_repl
+from add_repl import add_repl, id_repl_name
+from print_state import get_resources, get_state_file
 
 
 def get_id_terraform(filename, name):
@@ -34,6 +35,23 @@ def get_id_terraform(filename, name):
     print(f"Cannot find resource with {name=}. Available: {available}", file=sys.stderr)
 
 
+def get_id_recorded(target, name):
+    """Find a recorded resource's id by its bare name ("foo"), scanning the resource list.
+
+    The GET resource API would be the direct lookup, but it needs the full resource key
+    ("jobs.foo"), and callers pass only the leaf name - matching how user-visible commands
+    take a bare name ("bundle run my_job"), which DABs allows because it enforces name
+    uniqueness across types. So list and match on the leaf instead. Switching to GET is a
+    reasonable follow-up; it likely needs the service to key resources by name as well.
+    """
+    resources = get_resources(target)
+    for key, value in resources.items():
+        if key.split(".")[1] == name:
+            return value["id"]
+
+    print(f"Cannot find recorded resource with {name=}. Available: {list(resources)}", file=sys.stderr)
+
+
 def get_id_direct(filename, name):
     raw = open(filename).read()
     data = json.loads(raw)
@@ -53,15 +71,18 @@ def main():
     parser.add_argument("name")
     args = parser.parse_args()
 
-    filename = get_state_file(args.target, args.backup)
-    if filename.endswith(".tfstate"):
-        id = get_id_terraform(filename, args.name)
+    if os.environ.get("DATABRICKS_BUNDLE_DEPLOYMENT_HISTORY") == "true":
+        id = get_id_recorded(args.target, args.name)
     else:
-        id = get_id_direct(filename, args.name)
+        filename = get_state_file(args.target, args.backup)
+        if filename.endswith(".tfstate"):
+            id = get_id_terraform(filename, args.name)
+        else:
+            id = get_id_direct(filename, args.name)
 
     if id:
         print(id)
-        add_repl(str(id), args.name.upper() + "_ID")
+        add_repl(str(id), id_repl_name(args.name))
 
 
 if __name__ == "__main__":
diff --git a/acceptance/bin/read_lineage.py b/acceptance/bin/read_lineage.py
new file mode 100755
index 00000000000..33332e97705
--- /dev/null
+++ b/acceptance/bin/read_lineage.py
@@ -0,0 +1,46 @@
+#!/usr/bin/env python3
+"""
+Update ACC_REPLS to replace the lineage hash of the state, as the CLI reports it in the user
+agent (lineage/...) and telemetry (execution_context.state_lineage_hash), with [LINEAGE_HASH].
+
+Use it after the deploy that mints a fresh lineage; fixture lineages hash to stable values
+and need no replacement.
+
+Usage: read_lineage.py [-t target]
+"""
+
+import argparse
+import hashlib
+import json
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).parent))
+from add_repl import add_repl
+from print_state import get_state_file
+
+ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
+
+
+def shortid_hash(s):
+    """Same as libs/shortid.Hash: first 64 bits of SHA-256, as 11 base62 digits."""
+    n = int.from_bytes(hashlib.sha256(s.encode()).digest()[:8], "big")
+    digits = []
+    for _ in range(11):
+        n, d = divmod(n, len(ALPHABET))
+        digits.append(ALPHABET[d])
+    return "".join(reversed(digits))
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument("-t", "--target")
+    args = parser.parse_args()
+
+    filename = get_state_file(args.target, backup=False)
+    lineage = json.loads(open(filename).read())["lineage"]
+    add_repl(shortid_hash(lineage), "LINEAGE_HASH")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/acceptance/bin/read_state.py b/acceptance/bin/read_state.py
index 212c4b3ca18..0c83a8bcf4e 100755
--- a/acceptance/bin/read_state.py
+++ b/acceptance/bin/read_state.py
@@ -1,47 +1,32 @@
 #!/usr/bin/env python3
 """
-Print selected attributes from terraform state.
+Print selected attributes from the bundle state.
 
 Usage: <group> <name> [attr...]
 """
 
-import sys
-import os
 import json
+import os
+import sys
 
-
-def print_resource_terraform(group, name, *attrs):
-    resource_type = "databricks_" + group[:-1]
-    filename = ".databricks/bundle/default/terraform/terraform.tfstate"
-    raw = open(filename).read()
-    data = json.loads(raw)
-    found = 0
-    for r in data["resources"]:
-        r_type = r["type"]
-        r_name = r["name"]
-        if r_type != resource_type:
-            continue
-        if r_name != name:
-            continue
-        for inst in r["instances"]:
-            attribute_values = inst.get("attributes")
-            if attribute_values:
-                values = [f"{x}={attribute_values.get(x)!r}" for x in attrs]
-                print(group, name, " ".join(values))
-                found += 1
-    if not found:
-        print(f"State not found for {group}.{name}")
+sys.path.insert(0, os.path.dirname(__file__))
+from print_state import get_resources
 
 
 def print_resource_direct(group, name, *attrs):
     filename = ".databricks/bundle/default/resources.json"
+    # A missing state file (e.g. after destroy removes it) means the resource's
+    # state is not there, same as a missing entry within the file.
+    if not os.path.exists(filename):
+        print(f"State not found for {group}.{name} in {filename}")
+        return
     raw = open(filename).read()
     data = json.loads(raw)
     state_map = data["state"]
     result = state_map.get(f"resources.{group}.{name}")
 
     if result is None:
-        print(f"State not found for {group}.{name}")
+        print(f"State not found for {group}.{name} in {filename}")
         return
 
     state = result.get("state", {})
@@ -50,7 +35,21 @@ def print_resource_direct(group, name, *attrs):
     print(group, name, " ".join(values))
 
 
-if os.environ.get("DATABRICKS_BUNDLE_ENGINE", "").startswith("direct"):
-    print_resource_direct(*sys.argv[1:])
+def print_resource_recorded(group, name, *attrs):
+    result = get_resources(None).get(f"{group}.{name}")
+    if result is None:
+        # Recorded state lives in deployment history, not on disk, so name that rather than a
+        # file (the Repl normalizes it to match the file-based variants).
+        print(f"State not found for {group}.{name} in deployment history")
+        return
+
+    state = dict(result["state"])
+    state.setdefault("id", result["id"])
+    values = [f"{x}={state.get(x)!r}" for x in attrs]
+    print(group, name, " ".join(values))
+
+
+if os.environ.get("DATABRICKS_BUNDLE_DEPLOYMENT_HISTORY") == "true":
+    print_resource_recorded(*sys.argv[1:])
 else:
-    print_resource_terraform(*sys.argv[1:])
+    print_resource_direct(*sys.argv[1:])
diff --git a/acceptance/bin/replace_ids.py b/acceptance/bin/replace_ids.py
index d25dd85a0b5..4bd13bf94b2 100755
--- a/acceptance/bin/replace_ids.py
+++ b/acceptance/bin/replace_ids.py
@@ -3,14 +3,15 @@
 Read state and add all resource IDs to ACC_REPLS.
 """
 
-import sys
-import json
 import argparse
+import json
+import os
+import sys
 from pathlib import Path
 
 sys.path.insert(0, str(Path(__file__).parent))
-from print_state import get_state_file
-from add_repl import add_repl
+from add_repl import add_repl, id_repl_name
+from print_state import get_resources, get_state_file
 
 
 def iter_ids_terraform(filename):
@@ -26,6 +27,12 @@ def iter_ids_terraform(filename):
             yield r_name, id
 
 
+def iter_ids_recorded(target):
+    for key, value in get_resources(target).items():
+        if value["id"]:
+            yield key.split(".")[1], value["id"]
+
+
 def iter_ids_direct(filename):
     raw = open(filename).read()
     data = json.loads(raw)
@@ -44,14 +51,17 @@ def main():
     parser.add_argument("--backup", action="store_true")
     args = parser.parse_args()
 
-    filename = get_state_file(args.target, args.backup)
-    if filename.endswith(".tfstate"):
-        it = iter_ids_terraform(filename)
+    if os.environ.get("DATABRICKS_BUNDLE_DEPLOYMENT_HISTORY") == "true":
+        it = iter_ids_recorded(args.target)
     else:
-        it = iter_ids_direct(filename)
+        filename = get_state_file(args.target, args.backup)
+        if filename.endswith(".tfstate"):
+            it = iter_ids_terraform(filename)
+        else:
+            it = iter_ids_direct(filename)
 
     for name, id in it:
-        add_repl(id, name.upper() + "_ID")
+        add_repl(id, id_repl_name(name))
 
 
 if __name__ == "__main__":
diff --git a/acceptance/bin/replay_tfstate.py b/acceptance/bin/replay_tfstate.py
new file mode 100755
index 00000000000..598f09215fb
--- /dev/null
+++ b/acceptance/bin/replay_tfstate.py
@@ -0,0 +1,203 @@
+#!/usr/bin/env python3
+"""
+Reconstruct a terraform deployment for the migrate tests without the (removed) terraform engine.
+
+Given a checked-in terraform.tfstate and the resource-mutating requests the terraform deploy made
+(both captured once from a real terraform run), replay the requests against the backend so it ends
+up in the exact terraform-shaped state, then write the tfstate locally with each recorded resource
+id rewritten to the one the backend just minted. The migrate step then reads a real terraform state
+backed by real (terraform-shaped) resources.
+
+The requests carry the recorded ids; the backend mints fresh ones on replay. We learn each mapping
+from the create responses (matching a create to its tfstate resource by an identifying name) and
+rewrite it into every later request and into the tfstate, so cross-resource references stay consistent.
+
+Usage: replay_tfstate.py REQUESTS.json TFSTATE.json [-t TARGET]
+"""
+
+import argparse
+import json
+import os
+import re
+import subprocess
+import sys
+import urllib.error
+import urllib.parse
+import urllib.request
+
+import print_state
+
+CLI = os.environ["CLI"]
+HOST = os.environ.get("DATABRICKS_HOST", "").rstrip("/")
+UNIQUE_NAME = os.environ.get("UNIQUE_NAME", "")
+
+# Talk to the workspace directly rather than via `databricks api`: the CLI renders responses through
+# Go's `any`, which decodes JSON numbers as float64 and silently mangles the low digits of a freshly
+# minted id (they exceed 2^53), so the id we'd record would not match the one the backend stored.
+# Python's json keeps ids exact. Bypass any proxy: these tests only hit the workspace directly.
+_opener = urllib.request.build_opener(urllib.request.ProxyHandler({}))
+
+
+# The fake server routes by the PAT in DATABRICKS_TOKEN. These fixtures are captured against it, so
+# the migrate tests that replay them are local-only (see their test.toml) - there is no cloud path.
+TOKEN = os.environ.get("DATABRICKS_TOKEN", "")
+
+# Per resource: which response field carries the new id. Terraform's tfstate stores the same value
+# as the resource's `id`, keyed here by the create path so we can match a create to its tfstate entry.
+ID_FIELDS = ["job_id", "pipeline_id", "dashboard_id", "experiment_id", "cluster_id", "full_name", "id", "name"]
+
+# A create request is matched to its tfstate resource by a human-supplied identifying field; different
+# resource types name it differently (jobs/pipelines use `name`, dashboards use `display_name`,
+# clusters use `cluster_name`, …).
+NAME_FIELDS = ["name", "display_name", "full_name", "cluster_name"]
+
+# A backend-minted value that another resource may reference (e.g. a volume's storage_location, which
+# a pipeline tags). We remap these recorded->minted just like ids: a UUID, an s3-style path (which
+# embeds a UUID), or a long numeric id. Timestamps (13-digit millis) are shorter and excluded.
+BACKEND_VALUE = re.compile(r"[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}")
+
+
+def is_backend_value(v):
+    s = str(v)
+    return bool(BACKEND_VALUE.search(s)) or s.startswith("s3://") or (s.isdigit() and len(s) >= 15)
+
+
+def apply_map(text, id_map):
+    for old, new in id_map.items():
+        text = text.replace(old, new)
+    return text
+
+
+def run_cli(*args):
+    r = subprocess.run([CLI, *args], stdout=subprocess.PIPE, stderr=subprocess.STDOUT, encoding="utf-8")
+    if r.returncode != 0:
+        sys.exit(f"replay_tfstate.py: {' '.join(args)} failed:\n{r.stdout}")
+
+
+def api(method, path, body):
+    data = json.dumps(body).encode() if body is not None else None
+    req = urllib.request.Request(HOST + path, data=data, method=method.upper())
+    req.add_header("Authorization", "Bearer " + TOKEN)
+    # Stable UA so tests that record the replayed requests don't pin the Python version.
+    req.add_header("User-Agent", "replay_tfstate.py")
+    if data is not None:
+        req.add_header("Content-Type", "application/json")
+    try:
+        with _opener.open(req) as resp:
+            text = resp.read().decode()
+    except urllib.error.HTTPError as e:
+        sys.exit(f"replay_tfstate.py: {method} {path} failed: HTTP {e.code}\n{e.read().decode()}")
+    return json.loads(text) if text.strip() else {}
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument("requests")
+    parser.add_argument("tfstate")
+    parser.add_argument("-t", "--target", default="default")
+    args = parser.parse_args()
+
+    requests_raw = open(args.requests).read()
+    tfstate_raw = open(args.tfstate).read()
+
+    # Restore this run's values into the frozen fixtures. UNIQUE_NAME goes into both (resource
+    # names must match the current config); the host goes into the requests we issue, but the
+    # tfstate keeps [DATABRICKS_URL] so print_state's output matches the goldens.
+    if UNIQUE_NAME:
+        requests_raw = requests_raw.replace("[UNIQUE_NAME]", UNIQUE_NAME)
+        tfstate_raw = tfstate_raw.replace("[UNIQUE_NAME]", UNIQUE_NAME)
+    if HOST:
+        requests_raw = requests_raw.replace("[DATABRICKS_URL]", HOST)
+
+    requests = json.loads(requests_raw)
+    tfstate = json.loads(tfstate_raw)
+
+    # The fixtures stay on disk (a later deploy skips them via the .gitignore script.prepare writes),
+    # so replay is non-destructive and a single fixture can be replayed more than once.
+
+    # identifying name -> recorded resource attributes, from the tfstate managed resources.
+    name_to_attrs = {}
+    for r in tfstate["resources"]:
+        if r.get("mode") != "managed":
+            continue
+        attrs = r["instances"][0]["attributes"]
+        if "id" not in attrs:
+            continue
+        for nf in NAME_FIELDS:
+            if attrs.get(nf):
+                name_to_attrs[str(attrs[nf])] = attrs
+
+    id_map = {}
+    for req in requests:
+        path = apply_map(req["path"], id_map)
+        # Reattach recorded query params (the backend reads some required ids from there, e.g.
+        # postgres `?project_id=...`); id-remap the values in case one references a minted id.
+        q = req.get("q")
+        if q:
+            items = [
+                (k, apply_map(str(val), id_map))
+                for k, vals in q.items()
+                for val in (vals if isinstance(vals, list) else [vals])
+            ]
+            path += "?" + urllib.parse.urlencode(items)
+        body = req.get("body")
+        if body is not None:
+            body = json.loads(apply_map(json.dumps(body), id_map))
+        resp = api(req["method"], path, body)
+
+        # A create (POST that returns a new id) whose identifying name matches a tfstate resource:
+        # map its recorded id to the freshly minted one.
+        create_name = None
+        if isinstance(body, dict):
+            create_name = next((str(body[nf]) for nf in NAME_FIELDS if body.get(nf)), None)
+        if req["method"] == "POST" and create_name in name_to_attrs:
+            attrs = name_to_attrs[create_name]
+            if str(attrs["id"]) != create_name:
+                # Backend-minted primary id (jobs, pipelines, volumes): map recorded -> minted.
+                new_id = next((str(resp[f]) for f in ID_FIELDS if f in resp), None)
+                if new_id is None:
+                    sys.exit(f"replay_tfstate.py: no id in response to {req['path']}: {resp}")
+                id_map[str(attrs["id"])] = new_id
+            else:
+                # The primary id is the client-provided name (registered models, serving endpoints),
+                # but the backend still mints a SECONDARY id that permissions target
+                # (serving_endpoint_id, registered_model_id). It rides the create response as `id`,
+                # or - for mlflow models - comes from the databricks GET terraform issues (capture
+                # drops GETs), so fetch it the same way. Map the recorded secondary id -> minted.
+                minted = resp.get("id")
+                if minted is None and req["path"].endswith("/mlflow/registered-models/create"):
+                    g = api(
+                        "GET",
+                        "/api/2.0/mlflow/databricks/registered-models/get?name=" + urllib.parse.quote(create_name),
+                        None,
+                    )
+                    minted = (g.get("registered_model_databricks") or {}).get("id")
+                if minted is not None and is_backend_value(minted):
+                    for k, v in attrs.items():
+                        if k != "id" and is_backend_value(v):
+                            id_map[str(v)] = str(minted)
+            # Also remap other backend-minted values a later resource may reference (e.g. a volume's
+            # storage_location that a pipeline tags), so those requests and the tfstate stay consistent.
+            for k, v in resp.items():
+                old = attrs.get(k)
+                if old is not None and str(old) != str(v) and is_backend_value(old):
+                    id_map[str(old)] = str(v)
+
+    out_dir = os.path.join(".databricks", "bundle", args.target, "terraform")
+    os.makedirs(out_dir, exist_ok=True)
+    local_path = os.path.join(out_dir, "terraform.tfstate")
+    with open(local_path, "w") as f:
+        f.write(apply_map(tfstate_raw, id_map))
+
+    # A real terraform deploy leaves its state both on disk and in the workspace; push the remote
+    # copy too so a later migrate has a remote state to back up and tests that inspect the remote
+    # state dir see it. workspace import does not create parents, so mkdirs first.
+    state_dir = print_state.get_remote_state_path(args.target)
+    run_cli("workspace", "mkdirs", state_dir)
+    run_cli(
+        "workspace", "import", f"{state_dir}/terraform.tfstate", "--file", local_path, "--format", "AUTO", "--overwrite"
+    )
+
+
+if __name__ == "__main__":
+    main()
diff --git a/acceptance/bin/repls.py b/acceptance/bin/repls.py
new file mode 100644
index 00000000000..338127cf949
--- /dev/null
+++ b/acceptance/bin/repls.py
@@ -0,0 +1,72 @@
+#!/usr/bin/env python3
+"""
+Read the replacements applied to the test output from $ACC_REPLS.
+
+Every line is one replacement encoded as a JSON object: "Old" is a regular expression
+(written by the test harness), "Literal" is a value to replace verbatim (appended by
+add_repl.py). "New" is the replacement, "Order" defines the order they are applied in.
+"""
+
+import json
+import os
+import re
+import sys
+from pathlib import Path
+
+# Order of the replacements added by the scripts, so that they are applied before the ones
+# from the harness: a job id must become [MY_JOB] even if a broader harness pattern matches it.
+USER_ORDER = -100
+
+
+def read_entries():
+    """Return the raw entries of $ACC_REPLS."""
+    result = []
+    for line in Path(os.environ["ACC_REPLS"]).read_text().splitlines():
+        line = line.strip()
+        if line:
+            result.append(json.loads(line))
+    return result
+
+
+def read_repls():
+    """Return (pattern, replacement) pairs in the order they must be applied."""
+    entries = []
+
+    for item in read_entries():
+        order = item.get("Order", 0)
+        new = item["New"]
+        literal = item.get("Literal")
+
+        if literal is None:
+            # "Distinct" is not honoured here; unlike the harness, we do not number the matches.
+            entries.append((order, item["Old"], new))
+            continue
+
+        # Set() in libs/testdiff also registers the JSON-encoded form of the value, so that
+        # values with quotes or backslashes are replaced inside JSON output as well.
+        encoded = json.dumps(literal, ensure_ascii=False)[1:-1]
+        if encoded != literal:
+            entries.append((order, re.escape(encoded), new))
+        entries.append((order, re.escape(literal), new))
+
+    # Stable sort: replacements with the same order are applied in the order they were added.
+    entries.sort(key=lambda entry: entry[0])
+
+    return [(old, new) for _, old, new in entries]
+
+
+def compile_repls():
+    """Same as read_repls(), with patterns compiled. Invalid patterns are reported and skipped."""
+    result = []
+    for old, new in read_repls():
+        try:
+            result.append((re.compile(old), new))
+        except re.error as e:
+            print(f"Regex error for pattern {old}: {e}", file=sys.stderr)
+    return result
+
+
+def replace_all(patterns, s):
+    for comp, new in patterns:
+        s = comp.sub(new, s)
+    return s
diff --git a/acceptance/bin/retry.py b/acceptance/bin/retry.py
new file mode 100755
index 00000000000..e8de6468fff
--- /dev/null
+++ b/acceptance/bin/retry.py
@@ -0,0 +1,79 @@
+#!/usr/bin/env python3
+"""Retry a command until it succeeds and its output matches expectations.
+
+Usage: retry.py [--until SUBSTR] [--until-not SUBSTR] CMD [ARGS...]
+
+Retries CMD up to 5 times (configurable via RETRY_MAX_ATTEMPTS env var),
+sleeping RETRY_INTERVAL_MS milliseconds (default 500) between attempts.
+An attempt is considered successful when the command exits with code 0 and:
+  --until SUBSTR     SUBSTR appears in stdout
+  --until-not SUBSTR SUBSTR does not appear in stdout
+
+The condition is checked on every attempt, including the last. If a
+--until/--until-not condition was given but never satisfied within
+RETRY_MAX_ATTEMPTS, retry.py writes the last (stale) output to stderr and exits
+non-zero, rather than passing the stale output through on stdout. When no
+condition is given, the final attempt's output and exit code pass through
+unchanged.
+"""
+
+import argparse
+import os
+import subprocess
+import sys
+import time
+
+
+def main():
+    parser = argparse.ArgumentParser(prog="retry.py")
+    parser.add_argument("--until")
+    parser.add_argument("--until-not")
+    parser.add_argument("cmd", nargs=argparse.REMAINDER)
+    args = parser.parse_args()
+    if not args.cmd:
+        parser.error("no command given")
+    until = args.until
+    until_not = args.until_not
+    argv = args.cmd
+
+    interval = float(os.environ.get("RETRY_INTERVAL_MS", "500")) / 1000.0
+    max_attempts = int(os.environ.get("RETRY_MAX_ATTEMPTS", "5"))
+
+    def succeeded(result):
+        return (
+            result.returncode == 0
+            and (until is None or until.encode() in result.stdout)
+            and (until_not is None or until_not.encode() not in result.stdout)
+        )
+
+    ok = False
+    result = None
+    for attempt in range(max_attempts):
+        if attempt > 0:
+            time.sleep(interval)
+        result = subprocess.run(argv, capture_output=True)
+        if succeeded(result):
+            ok = True
+            break
+
+    if not ok and (until is not None or until_not is not None):
+        # A content condition was requested but never held within max_attempts. Emit the
+        # stale output to stderr (never stdout) so callers capturing stdout don't silently
+        # ingest stale data, and fail loudly with a non-zero exit so the flake is
+        # attributed here rather than surfacing later as an unexplained output diff.
+        sys.stderr.buffer.write(result.stdout)
+        sys.stderr.buffer.write(result.stderr)
+        sys.stderr.buffer.flush()
+        print(f"retry: condition not met after {max_attempts} attempts", file=sys.stderr)
+        sys.exit(result.returncode or 1)
+
+    # Success, or no content condition was requested (retries only guarded the exit code).
+    # Either way callers capture stdout (e.g. DASHBOARD=$(retry --until ...)), so pass the
+    # final attempt's output and exit code through unchanged.
+    sys.stdout.buffer.write(result.stdout)
+    sys.stderr.buffer.write(result.stderr)
+    sys.exit(result.returncode)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/acceptance/bin/setmtime.py b/acceptance/bin/setmtime.py
index dd546d65c9c..5adaccf7366 100755
--- a/acceptance/bin/setmtime.py
+++ b/acceptance/bin/setmtime.py
@@ -4,9 +4,9 @@
 Usage: setmtime.py <timestamp> <filenames>
 """
 
-import sys
-import os
 import datetime
+import os
+import sys
 
 timestamp = sys.argv[1]
 ts, ns = timestamp.split(".")
diff --git a/acceptance/bin/sort_lines.py b/acceptance/bin/sort_lines.py
index fde64ba5c78..9644068b46c 100755
--- a/acceptance/bin/sort_lines.py
+++ b/acceptance/bin/sort_lines.py
@@ -1,34 +1,22 @@
 #!/usr/bin/env python3
 """
 Helper to sort lines in text file. Similar to 'sort' but no dependence on locale or presence of 'sort' in PATH.
-With --repl, applies TEST_TMP_DIR/repls.json replacements as sort key for stable output across different environments.
+With --repl, applies the test replacements ($ACC_REPLS) as sort key for stable output across different environments.
 """
 
 import sys
-import os
-import json
-import re
 from pathlib import Path
 
+sys.path.insert(0, str(Path(__file__).parent))
+from repls import compile_repls, replace_all
+
 use_repl = "--repl" in sys.argv[1:]
 
 lines = sys.stdin.readlines()
 
 if use_repl:
-    repls = json.loads((Path(os.environ["TEST_TMP_DIR"]) / "repls.json").read_text())
-    patterns = []
-    for r in repls:
-        try:
-            patterns.append((re.compile(r["Old"]), r["New"]))
-        except re.error as e:
-            print(f"Regex error for pattern {r}: {e}", file=sys.stderr)
-
-    def sort_key(line):
-        for comp, new in patterns:
-            line = comp.sub(new, line)
-        return line
-
-    lines.sort(key=sort_key)
+    patterns = compile_repls()
+    lines.sort(key=lambda line: replace_all(patterns, line))
 else:
     lines.sort()
 
diff --git a/acceptance/bin/update_file.py b/acceptance/bin/update_file.py
index ef643239533..8a69d5f5fef 100755
--- a/acceptance/bin/update_file.py
+++ b/acceptance/bin/update_file.py
@@ -5,6 +5,10 @@
 Replace all strings OLD with NEW in FILENAME.
 
 If OLD is not found in FILENAME, the script reports error.
+
+The file is read and written as bytes so that only the matched bytes change.
+Text mode on Windows rewrites every line ending as CRLF, which changes the
+file's content hash and upload payload.
 """
 
 import sys
@@ -20,9 +24,19 @@
 # call update_file.py on that file.
 assert filename != "output.txt"
 
-data = open(filename).read()
-newdata = data.replace(old, new)
+with open(filename, "rb") as fobj:
+    data = fobj.read()
+
+old_bytes = old.encode()
+new_bytes = new.encode()
+
+# Match the file's line endings so multi-line OLD/NEW work on CRLF checkouts.
+if b"\r\n" in data:
+    old_bytes = old_bytes.replace(b"\r\n", b"\n").replace(b"\n", b"\r\n")
+    new_bytes = new_bytes.replace(b"\r\n", b"\n").replace(b"\n", b"\r\n")
+
+newdata = data.replace(old_bytes, new_bytes)
 if newdata == data:
-    sys.exit(f"{old=} not found in {filename=}\n{data}")
-with open(filename, "w") as fobj:
+    sys.exit(f"{old=} not found in {filename=}\n{data.decode(errors='replace')}")
+with open(filename, "wb") as fobj:
     fobj.write(newdata)
diff --git a/acceptance/bin/util.py b/acceptance/bin/util.py
index 1bd73af0848..3ee8d65bc90 100644
--- a/acceptance/bin/util.py
+++ b/acceptance/bin/util.py
@@ -1,8 +1,7 @@
-import sys
-import subprocess
 import json
 import shlex
-
+import subprocess
+import sys
 
 VERBOSE = False
 
@@ -22,7 +21,7 @@ def run_json(cmd):
     try:
         return json.loads(result.stdout)
     except Exception as ex:
-        raise RunError(f"{cmd} returned non-json: {ex}\n{result.stdout}")
+        raise RunError(f"{cmd} returned non-json: {ex}\n{result.stdout}") from ex
 
 
 def run(cmd):
diff --git a/acceptance/bin/verify_no_drift.py b/acceptance/bin/verify_no_drift.py
index 2c0342e2b36..9b272c1ce79 100755
--- a/acceptance/bin/verify_no_drift.py
+++ b/acceptance/bin/verify_no_drift.py
@@ -3,9 +3,8 @@
 Check that all actions in plan are "skip".
 """
 
-import sys
 import json
-import pprint
+import sys
 
 
 def check_plan(path):
diff --git a/acceptance/bin/verify_update.py b/acceptance/bin/verify_update.py
new file mode 100755
index 00000000000..c1363a151fc
--- /dev/null
+++ b/acceptance/bin/verify_update.py
@@ -0,0 +1,49 @@
+#!/usr/bin/env python3
+"""
+Check that a plan applies at least one "update" and nothing more drastic.
+
+Used by the field_removal invariant test after dropping an optional field: the
+removal must be observable as an in-place update, never ignored (all "skip") and
+never a create/delete/recreate.
+"""
+
+import json
+import sys
+
+
+def check_plan(path):
+    with open(path) as fobj:
+        raw = fobj.read()
+
+    updates = 0
+    unexpected = 0
+
+    try:
+        data = json.loads(raw)
+        for key, value in data["plan"].items():
+            action = value.get("action")
+            if action == "update":
+                updates += 1
+            elif action != "skip":
+                print(f"Unexpected {action=} for {key}")
+                unexpected += 1
+    except Exception:
+        print(raw, flush=True)
+        raise
+
+    if not updates:
+        print("Expected at least one update action, found none")
+        unexpected += 1
+
+    if unexpected:
+        print(raw, flush=True)
+        sys.exit(10)
+
+
+def main():
+    for path in sys.argv[1:]:
+        check_plan(path)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/acceptance/bin/yamlcheck.py b/acceptance/bin/yamlcheck.py
index 83318921fb9..bfeb969265d 100755
--- a/acceptance/bin/yamlcheck.py
+++ b/acceptance/bin/yamlcheck.py
@@ -3,9 +3,8 @@
 import os
 import subprocess
 import sys
-from pathlib import Path
 from difflib import unified_diff
-
+from pathlib import Path
 
 NAME = "yamlfmt"
 if sys.platform.startswith("win"):
diff --git a/acceptance/bin/ziplist.py b/acceptance/bin/ziplist.py
index 5e2fa99d5c7..02b725e44d0 100755
--- a/acceptance/bin/ziplist.py
+++ b/acceptance/bin/ziplist.py
@@ -5,8 +5,6 @@
 
 import sys
 import zipfile
-from pathlib import Path
-
 
 for zip_path in sys.argv[1:]:
     with zipfile.ZipFile(zip_path.strip()) as z:
diff --git a/acceptance/bundle/apps/app_yaml/out.app.yml.txt b/acceptance/bundle/apps/app_yaml/out.app.yml.txt
index 29cb7da70fa..51431f28439 100644
--- a/acceptance/bundle/apps/app_yaml/out.app.yml.txt
+++ b/acceptance/bundle/apps/app_yaml/out.app.yml.txt
@@ -1,8 +1,12 @@
 {
   "method": "POST",
-  "path": "/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/app/app.yml",
-  "q": {
-    "overwrite": "true"
-  },
-  "raw_body": "command:\n  - python\n  - app.py\n"
+  "path": "/api/2.0/workspace/import",
+  "body": {
+    "multipart_form": {
+      "content": "command:\n  - python\n  - app.py\n",
+      "format": "RAW",
+      "overwrite": "true",
+      "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/app/app.yml"
+    }
+  }
 }
diff --git a/acceptance/bundle/apps/app_yaml/out.test.toml b/acceptance/bundle/apps/app_yaml/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/apps/app_yaml/out.test.toml
+++ b/acceptance/bundle/apps/app_yaml/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/apps/app_yaml/output.txt b/acceptance/bundle/apps/app_yaml/output.txt
index addb91d683c..50baf9b4559 100644
--- a/acceptance/bundle/apps/app_yaml/output.txt
+++ b/acceptance/bundle/apps/app_yaml/output.txt
@@ -15,11 +15,11 @@ Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created apps.myapp
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
->>> jq select(.path | test("app.yml")) out.requests.txt
+>>> jq select(.body.multipart_form.path | strings | test("app.yml")) [OUTPUT_DIR]/out.requests.txt
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
@@ -27,8 +27,7 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
 
 >>> print_requests.py //apps
 {
diff --git a/acceptance/bundle/apps/app_yaml/script b/acceptance/bundle/apps/app_yaml/script
index d0dd8d5f800..3267d66c598 100644
--- a/acceptance/bundle/apps/app_yaml/script
+++ b/acceptance/bundle/apps/app_yaml/script
@@ -1,9 +1,9 @@
 trace $CLI bundle validate
 trace $CLI bundle plan
 trace $CLI bundle deploy
-trace jq 'select(.path | test("app.yml"))' out.requests.txt | sed 's/\\r//g'  > out.app.yml.txt
+trace jq 'select(.body.multipart_form.path | strings | test("app.yml"))' "$OUT_REQUESTS" | sed 's/\\r//g'  > out.app.yml.txt
 #trace print_requests.py //apps  # currently fails due to TF inserting description=""
-rm out.requests.txt
+rm "$OUT_REQUESTS"
 
 trace $CLI bundle destroy --auto-approve
 trace print_requests.py //apps
diff --git a/acceptance/bundle/apps/artifact_and_app_same_path/out.test.toml b/acceptance/bundle/apps/artifact_and_app_same_path/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/apps/artifact_and_app_same_path/out.test.toml
+++ b/acceptance/bundle/apps/artifact_and_app_same_path/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/apps/compute_size/out.test.toml b/acceptance/bundle/apps/compute_size/out.test.toml
index bbc7fcfd1bd..0f167effef1 100644
--- a/acceptance/bundle/apps/compute_size/out.test.toml
+++ b/acceptance/bundle/apps/compute_size/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/apps/compute_size/out.update.direct.txt b/acceptance/bundle/apps/compute_size/out.update.direct.txt
deleted file mode 100644
index 6e02b630e61..00000000000
--- a/acceptance/bundle/apps/compute_size/out.update.direct.txt
+++ /dev/null
@@ -1,11 +0,0 @@
-
->>> errcode [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/app-compute-size-[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> [CLI] apps get app-[UNIQUE_NAME]
-{
-  "compute_size": "MEDIUM"
-}
diff --git a/acceptance/bundle/apps/compute_size/out.update.terraform.txt b/acceptance/bundle/apps/compute_size/out.update.terraform.txt
deleted file mode 100644
index 62a03593a3f..00000000000
--- a/acceptance/bundle/apps/compute_size/out.update.terraform.txt
+++ /dev/null
@@ -1,24 +0,0 @@
-
->>> errcode [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/app-compute-size-[UNIQUE_NAME]/files...
-Deploying resources...
-Error: terraform apply: exit status 1
-
-Error: failed to update app
-
-  with databricks_app.my_app,
-  on bundle.tf.json line 20, in resource.databricks_app.my_app:
-  20:       }
-
-Compute size updates are not supported in this update API. Please use the new
-update API instead.
-
-
-Updating deployment state...
-
-Exit code: 1
-
->>> [CLI] apps get app-[UNIQUE_NAME]
-{
-  "compute_size": "LARGE"
-}
diff --git a/acceptance/bundle/apps/compute_size/out.update.txt b/acceptance/bundle/apps/compute_size/out.update.txt
new file mode 100644
index 00000000000..c65c036da27
--- /dev/null
+++ b/acceptance/bundle/apps/compute_size/out.update.txt
@@ -0,0 +1,11 @@
+
+>>> errcode [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/app-compute-size-[UNIQUE_NAME]/files...
+Updated apps.my_app
+Files: 3 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] apps get app-[UNIQUE_NAME]
+{
+  "compute_size": "MEDIUM"
+}
diff --git a/acceptance/bundle/apps/compute_size/output.txt b/acceptance/bundle/apps/compute_size/output.txt
index 3c22e34adbd..9ab604797e6 100644
--- a/acceptance/bundle/apps/compute_size/output.txt
+++ b/acceptance/bundle/apps/compute_size/output.txt
@@ -2,9 +2,9 @@
 === Deploy bundle
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/app-compute-size-[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created apps.my_app
+Files: 4 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 === Update compute size and redeploy
 >>> [CLI] bundle destroy --auto-approve
@@ -13,5 +13,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/app-compute-size-[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/apps/compute_size/script b/acceptance/bundle/apps/compute_size/script
index 5f4714ae8df..9c993bc9e28 100644
--- a/acceptance/bundle/apps/compute_size/script
+++ b/acceptance/bundle/apps/compute_size/script
@@ -17,4 +17,4 @@ sed -i.bak 's/compute_size: LARGE/compute_size: MEDIUM/' databricks.yml
 {
   trace errcode $CLI bundle deploy
   trace $CLI apps get "app-$UNIQUE_NAME" | jq '{compute_size: .compute_size}'
-} &> out.update.$DATABRICKS_BUNDLE_ENGINE.txt
+} &> out.update.txt
diff --git a/acceptance/bundle/apps/compute_size/test.toml b/acceptance/bundle/apps/compute_size/test.toml
index 60f5da68878..64ac0737b95 100644
--- a/acceptance/bundle/apps/compute_size/test.toml
+++ b/acceptance/bundle/apps/compute_size/test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 RecordRequests = false
 
diff --git a/acceptance/bundle/apps/delete_deleting/app/app.py b/acceptance/bundle/apps/delete_deleting/app/app.py
new file mode 100644
index 00000000000..271596cec04
--- /dev/null
+++ b/acceptance/bundle/apps/delete_deleting/app/app.py
@@ -0,0 +1 @@
+print("Simple test app")
diff --git a/acceptance/bundle/apps/delete_deleting/app/app.yml b/acceptance/bundle/apps/delete_deleting/app/app.yml
new file mode 100644
index 00000000000..45b242d4064
--- /dev/null
+++ b/acceptance/bundle/apps/delete_deleting/app/app.yml
@@ -0,0 +1 @@
+command: ["python", "app.py"]
diff --git a/acceptance/bundle/apps/delete_deleting/databricks_header.yml.tmpl b/acceptance/bundle/apps/delete_deleting/databricks_header.yml.tmpl
new file mode 100644
index 00000000000..0198b2c4eb2
--- /dev/null
+++ b/acceptance/bundle/apps/delete_deleting/databricks_header.yml.tmpl
@@ -0,0 +1,5 @@
+bundle:
+  name: app-delete-deleting-$UNIQUE_NAME
+
+workspace:
+  root_path: "~/.bundle/app-delete-deleting-$UNIQUE_NAME"
diff --git a/acceptance/bundle/apps/delete_deleting/databricks_resources.yml.tmpl b/acceptance/bundle/apps/delete_deleting/databricks_resources.yml.tmpl
new file mode 100644
index 00000000000..1fa1d2192a0
--- /dev/null
+++ b/acceptance/bundle/apps/delete_deleting/databricks_resources.yml.tmpl
@@ -0,0 +1,5 @@
+resources:
+  apps:
+    my_app:
+      name: app-$UNIQUE_NAME
+      source_code_path: ./app
diff --git a/acceptance/bundle/apps/delete_deleting/out.test.toml b/acceptance/bundle/apps/delete_deleting/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/apps/delete_deleting/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/apps/delete_deleting/output.txt b/acceptance/bundle/apps/delete_deleting/output.txt
new file mode 100644
index 00000000000..3b2474e01ad
--- /dev/null
+++ b/acceptance/bundle/apps/delete_deleting/output.txt
@@ -0,0 +1,5 @@
+
+=== Deploy the app
+
+=== Apply the stale delete plan against the DELETING app
+DELETE_OK
diff --git a/acceptance/bundle/apps/delete_deleting/script b/acceptance/bundle/apps/delete_deleting/script
new file mode 100644
index 00000000000..14267a32af4
--- /dev/null
+++ b/acceptance/bundle/apps/delete_deleting/script
@@ -0,0 +1,38 @@
+#!/bin/bash
+
+# Regression: a saved delete-plan computed while the app is ACTIVE has Gone=false.
+# If the app enters DELETING before the plan is applied (concurrent delete, or an
+# interrupted destroy), apply must still succeed instead of failing with the
+# backend's "Cannot delete app ... not terminal with state DELETING" 400.
+
+# databricks.yml is assembled from a shared header plus a resources fragment, so
+# the delete config below reuses the exact same bundle/workspace stanza.
+envsubst < databricks_header.yml.tmpl > databricks.yml
+envsubst < databricks_resources.yml.tmpl >> databricks.yml
+
+cleanup() {
+  trace $CLI bundle destroy --auto-approve &> LOG.destroy
+}
+trap cleanup EXIT
+
+title "Deploy the app\n"
+trace $CLI bundle deploy &> LOG.deploy
+cat LOG.deploy | contains.py '!panic' '!internal error' > /dev/null
+
+# Save a delete plan while the app is still ACTIVE, so the plan records Gone=false.
+# Same header, empty resources -> the app is removed from config.
+envsubst < databricks_header.yml.tmpl > databricks.yml
+echo "resources: {}" >> databricks.yml
+
+trace $CLI bundle plan -o json > plan_delete.json 2>LOG.plan_delete.err
+cat LOG.plan_delete.err | contains.py '!panic' '!internal error' > /dev/null
+
+# Out-of-band delete flips the app into DELETING: a second delete now returns 400.
+trace $CLI apps delete "app-$UNIQUE_NAME" &> LOG.apps_delete
+cat LOG.apps_delete | contains.py '!panic' '!internal error' > /dev/null
+
+title "Apply the stale delete plan against the DELETING app\n"
+trace $CLI bundle deploy --auto-approve --plan plan_delete.json &> LOG.deploy_delete
+cat LOG.deploy_delete | contains.py '!panic' '!internal error' > /dev/null
+
+echo DELETE_OK
diff --git a/acceptance/bundle/apps/delete_deleting/test.toml b/acceptance/bundle/apps/delete_deleting/test.toml
new file mode 100644
index 00000000000..8b5a8c72095
--- /dev/null
+++ b/acceptance/bundle/apps/delete_deleting/test.toml
@@ -0,0 +1,6 @@
+Cloud = false
+RecordRequests = false
+
+# Saved-plan deploy (`--plan`) and the IsGone gone-detection are direct-engine only.
+
+Ignore = [".databricks", "databricks.yml", "plan_delete.json"]
diff --git a/acceptance/bundle/apps/git_source/out.test.toml b/acceptance/bundle/apps/git_source/out.test.toml
index 8f6c4a03c57..a927a5fbc06 100644
--- a/acceptance/bundle/apps/git_source/out.test.toml
+++ b/acceptance/bundle/apps/git_source/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = false
-RequiresWarehouse = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/apps/git_source/output.txt b/acceptance/bundle/apps/git_source/output.txt
index e012c597482..4046ed6e152 100644
--- a/acceptance/bundle/apps/git_source/output.txt
+++ b/acceptance/bundle/apps/git_source/output.txt
@@ -18,13 +18,13 @@ Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
 === Deploy bundle
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/app-git-source-[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created apps.my_app
+Files: 4 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle run my_app
 ✓ Getting the status of the app [APP_NAME]
-✓ App is in RUNNING state
+✓ App is in UNAVAILABLE state
 ✓ App compute is in STOPPED state
 ✓ Starting the app [APP_NAME]
 ✓ App is starting...
@@ -61,9 +61,8 @@ You can access the app at [APP_NAME]-123.cloud.databricksapps.com
 === Update git_source branch and redeploy
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/app-git-source-[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 3 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
 
 === Verify config update was applied
 >>> [CLI] apps get [APP_NAME] --output json
@@ -78,5 +77,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/app-git-source-[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/apps/git_source/script b/acceptance/bundle/apps/git_source/script
index c33cf091fa3..f9d90c84a53 100644
--- a/acceptance/bundle/apps/git_source/script
+++ b/acceptance/bundle/apps/git_source/script
@@ -21,7 +21,7 @@ trace $CLI bundle run my_app
 
 title "Get app details and verify git_source configuration"
 app_name=$(trace $CLI bundle summary --output json | jq -r '.resources.apps.my_app.name')
-echo "$app_name:APP_NAME" >> ACC_REPLS
+add_repl "$app_name" APP_NAME
 
 trace $CLI apps get $app_name --output json | jq '{name, description, git_repository, git_source}'
 
diff --git a/acceptance/bundle/apps/git_source/test.toml b/acceptance/bundle/apps/git_source/test.toml
index db551625c78..cf2d972562a 100644
--- a/acceptance/bundle/apps/git_source/test.toml
+++ b/acceptance/bundle/apps/git_source/test.toml
@@ -1,9 +1,7 @@
 # Test that git_repository and git_source fields are properly configured for apps
-Local = true
 # Temporary disable cloud tests because it fails with "Git repository cannot be defined in this workspace. Please try again later."
 Cloud = false
 RecordRequests = false
-RequiresWarehouse = true
 
 Ignore = [".databricks", "databricks.yml", "databricks.yml.bak", "tmp.app-run"]
 
diff --git a/acceptance/bundle/apps/job_permissions/databricks.yml.tmpl b/acceptance/bundle/apps/job_permissions/databricks.yml.tmpl
index 54739569cd4..9d2e6c079bb 100644
--- a/acceptance/bundle/apps/job_permissions/databricks.yml.tmpl
+++ b/acceptance/bundle/apps/job_permissions/databricks.yml.tmpl
@@ -1,6 +1,15 @@
 bundle:
   name: test-bundle-$UNIQUE_NAME
 
+# This test deploys several times and reports how many files each deploy uploaded, so
+# nothing written between the deploys may end up in the synced tree: the script's own
+# out.after_first_deploy.*, and the test runner's output.txt / ACC_REPLS, which it keeps
+# appending to while the deploy runs.
+sync:
+  exclude:
+    - out*
+    - ACC_REPLS
+
 permissions:
   - level: CAN_MANAGE
     user_name: ${workspace.current_user.userName}
diff --git a/acceptance/bundle/apps/job_permissions/out.after_first_deploy.terraform.txt b/acceptance/bundle/apps/job_permissions/out.after_first_deploy.terraform.txt
deleted file mode 100644
index 27ba77ddaf6..00000000000
--- a/acceptance/bundle/apps/job_permissions/out.after_first_deploy.terraform.txt
+++ /dev/null
@@ -1 +0,0 @@
-true
diff --git a/acceptance/bundle/apps/job_permissions/out.test.toml b/acceptance/bundle/apps/job_permissions/out.test.toml
index e849ec85ace..0f167effef1 100644
--- a/acceptance/bundle/apps/job_permissions/out.test.toml
+++ b/acceptance/bundle/apps/job_permissions/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/apps/job_permissions/output.txt b/acceptance/bundle/apps/job_permissions/output.txt
index d64fd16fd0c..db0a6cafed3 100644
--- a/acceptance/bundle/apps/job_permissions/output.txt
+++ b/acceptance/bundle/apps/job_permissions/output.txt
@@ -1,8 +1,8 @@
 
->>> [CLI] bundle deploy
+>>> [CLI] bundle deploy -qq
 Warning: app "my_app" references jobs "my_job" which has permissions set. To prevent permission override after deploying the app, please add the app service principal to the jobs permissions
   at resources.apps.my_app
-  in databricks.yml:24:7
+  in databricks.yml:33:7
 
 Add the following section to the jobs permissions:
 
@@ -14,19 +14,12 @@ Add the following section to the jobs permissions:
             service_principal_name: ${resources.apps.my_app.service_principal_client_id}
 
 
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
-=== After first deploy
->>> has_manage_run
 
 === After second deploy
->>> [CLI] bundle deploy
+>>> [CLI] bundle deploy -qq
 Warning: app "my_app" references jobs "my_job" which has permissions set. To prevent permission override after deploying the app, please add the app service principal to the jobs permissions
   at resources.apps.my_app
-  in databricks.yml:24:7
+  in databricks.yml:33:7
 
 Add the following section to the jobs permissions:
 
@@ -38,20 +31,12 @@ Add the following section to the jobs permissions:
             service_principal_name: ${resources.apps.my_app.service_principal_client_id}
 
 
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
 
 >>> has_manage_run
 false
 
 === Apply fix and redeploy
->>> [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+>>> [CLI] bundle deploy -qq
 
 >>> has_manage_run
 true
@@ -63,5 +48,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 2 deleted
diff --git a/acceptance/bundle/apps/job_permissions/script b/acceptance/bundle/apps/job_permissions/script
index df8a6b9e392..191a5af55fe 100644
--- a/acceptance/bundle/apps/job_permissions/script
+++ b/acceptance/bundle/apps/job_permissions/script
@@ -3,7 +3,7 @@
 # Issue: https://github.com/databricks/cli/issues/4309
 
 envsubst < databricks.yml.tmpl > databricks.yml
-trace $CLI bundle deploy
+trace $CLI bundle deploy -qq
 
 job_id=$(read_id.py my_job)
 
@@ -12,8 +12,6 @@ has_manage_run() {
     | jq 'any(.access_control_list[].all_permissions[]; .permission_level == "CAN_MANAGE_RUN")'
 }
 
-title "After first deploy"
-trace has_manage_run > out.after_first_deploy.$DATABRICKS_BUNDLE_ENGINE.txt
 # This is flaky on direct, because there are (at least) two ways to complete deployment:
 # sequence 1:
 #  job is deployed
@@ -23,16 +21,14 @@ trace has_manage_run > out.after_first_deploy.$DATABRICKS_BUNDLE_ENGINE.txt
 #  job is deployed
 #  app is deployed, updates job permissions
 #  job permissions are deployed
-# (It does not appear flaky on TF, maybe there is enough delay in one of the resources)
-rm -f out.after_first_deploy.direct.txt
 
 title "After second deploy"
-trace $CLI bundle deploy
+trace $CLI bundle deploy -qq
 trace has_manage_run
 
 title "Apply fix and redeploy"
 patch -s --no-backup-if-mismatch databricks.yml < fix.patch
-trace $CLI bundle deploy
+trace $CLI bundle deploy -qq
 trace has_manage_run
 
 trace $CLI bundle destroy --auto-approve
diff --git a/acceptance/bundle/apps/job_permissions/test.toml b/acceptance/bundle/apps/job_permissions/test.toml
index f54e2a6f9e7..c7fc201902b 100644
--- a/acceptance/bundle/apps/job_permissions/test.toml
+++ b/acceptance/bundle/apps/job_permissions/test.toml
@@ -1,6 +1,2 @@
 Cloud = true
-RequiresUnityCatalog = true
 RecordRequests = false
-
-[EnvMatrix]
-DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/bundle/apps/job_permissions_warning/out.test.toml b/acceptance/bundle/apps/job_permissions_warning/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/apps/job_permissions_warning/out.test.toml
+++ b/acceptance/bundle/apps/job_permissions_warning/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/apps/source_code_path_update/app/app.py b/acceptance/bundle/apps/source_code_path_update/app/app.py
new file mode 100644
index 00000000000..365435d747e
--- /dev/null
+++ b/acceptance/bundle/apps/source_code_path_update/app/app.py
@@ -0,0 +1,16 @@
+import os
+from http.server import BaseHTTPRequestHandler, HTTPServer
+
+
+class Handler(BaseHTTPRequestHandler):
+    def do_GET(self):
+        self.send_response(200)
+        self.end_headers()
+        self.wfile.write(b"OK")
+
+    def log_message(self, *_):
+        pass
+
+
+port = int(os.environ.get("APP_PORT", "8080"))
+HTTPServer(("0.0.0.0", port), Handler).serve_forever()
diff --git a/acceptance/bundle/apps/source_code_path_update/app/app.yml b/acceptance/bundle/apps/source_code_path_update/app/app.yml
new file mode 100644
index 00000000000..45b242d4064
--- /dev/null
+++ b/acceptance/bundle/apps/source_code_path_update/app/app.yml
@@ -0,0 +1 @@
+command: ["python", "app.py"]
diff --git a/acceptance/bundle/apps/source_code_path_update/databricks.yml.tmpl b/acceptance/bundle/apps/source_code_path_update/databricks.yml.tmpl
new file mode 100644
index 00000000000..ed90ba29a33
--- /dev/null
+++ b/acceptance/bundle/apps/source_code_path_update/databricks.yml.tmpl
@@ -0,0 +1,14 @@
+bundle:
+  name: app-scp-update-$UNIQUE_NAME
+
+workspace:
+  root_path: "~/.bundle/app-scp-update-$UNIQUE_NAME"
+
+resources:
+  apps:
+    my_app:
+      name: app-$UNIQUE_NAME
+      description: "first description"
+      source_code_path: ./app
+      lifecycle:
+        started: true
diff --git a/acceptance/bundle/apps/source_code_path_update/out.test.toml b/acceptance/bundle/apps/source_code_path_update/out.test.toml
new file mode 100644
index 00000000000..8bfa768b35b
--- /dev/null
+++ b/acceptance/bundle/apps/source_code_path_update/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = true
+CloudSlow = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/apps/source_code_path_update/output.txt b/acceptance/bundle/apps/source_code_path_update/output.txt
new file mode 100644
index 00000000000..1998e9489ca
--- /dev/null
+++ b/acceptance/bundle/apps/source_code_path_update/output.txt
@@ -0,0 +1,23 @@
+
+=== Initial deploy — lifecycle.started starts compute and creates active deployment
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/app-scp-update-[UNIQUE_NAME]/files...
+Created apps.my_app
+Files: 4 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Run app to redeploy (reproduces the issue precondition of having an active deployment)
+=== Redeploy from saved plan after description change
+>>> [CLI] bundle deploy --plan plan.json
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/app-scp-update-[UNIQUE_NAME]/files...
+Updated apps.my_app
+Files: 5 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.apps.my_app
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/app-scp-update-[UNIQUE_NAME]
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/apps/source_code_path_update/script b/acceptance/bundle/apps/source_code_path_update/script
new file mode 100644
index 00000000000..d4b781b0b95
--- /dev/null
+++ b/acceptance/bundle/apps/source_code_path_update/script
@@ -0,0 +1,35 @@
+#!/bin/bash
+# Regression test for https://github.com/databricks/cli/issues/6401
+#
+# bundle deploy must not send source_code_path in the UpdateApp request body when
+# redeploying an app that already has an active deployment.
+#
+# The bug manifests in the bundle deploy --plan flow: InitForApply JSON-round-trips
+# AppState through apps.App.UnmarshalJSON, which adds "SourceCodePath" to
+# apps.App.ForceSendFields; without the fix that forces "source_code_path": ""
+# into the UpdateApp body, which the API rejects with 400.
+
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+  trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+title "Initial deploy — lifecycle.started starts compute and creates active deployment"
+trace $CLI bundle deploy
+
+title "Run app to redeploy (reproduces the issue precondition of having an active deployment)"
+# Compute is already ACTIVE from the first deploy; bundle run just redeploys.
+# Route variable progress messages and the dynamic URL to a log so output.txt is stable.
+$CLI bundle run my_app &> LOG.run_app
+
+title "Redeploy from saved plan after description change"
+# Changing a non-deploy-only field (description) so DoUpdate is called.
+sed -i.bak 's/description: "first description"/description: "second description"/' databricks.yml
+# Route bundle plan stderr (diagnostics) to a log so output.txt stays clean.
+$CLI bundle plan -o json > plan.json 2> LOG.plan
+# bundle deploy --plan triggers InitForApply, which JSON-round-trips AppState.
+# Without the fix, apps.App.ForceSendFields ends up containing "SourceCodePath",
+# causing "source_code_path": "" to be sent in the UpdateApp body (API returns 400).
+trace $CLI bundle deploy --plan plan.json
diff --git a/acceptance/bundle/apps/source_code_path_update/test.toml b/acceptance/bundle/apps/source_code_path_update/test.toml
new file mode 100644
index 00000000000..e774ab2c55d
--- /dev/null
+++ b/acceptance/bundle/apps/source_code_path_update/test.toml
@@ -0,0 +1,20 @@
+Cloud = true
+CloudSlow = true
+RecordRequests = false
+
+# This regression is in the direct engine only (the bug is in InitForApply
+# which is only called for bundle deploy --plan on the direct engine).
+
+Ignore = [".databricks", "databricks.yml", "databricks.yml.bak", "plan.json", "LOG.*"]
+
+# Apps can take longer to start up and deploy on cloud.
+TimeoutCloud = "10m"
+
+# logProgress ("✓ <message>") emits deployment progress lines whose count and
+# content vary between the local test server (single "Deployment succeeded") and
+# a real workspace (multiple intermediate states: "Shutting down app...",
+# "App started successfully", etc.). Remove all of them from the output so that
+# the golden is stable across both environments.
+[[Repls]]
+Old = '✓ [^\n]+\n'
+New = ''
diff --git a/acceptance/bundle/apps/value_from_warning/out.test.toml b/acceptance/bundle/apps/value_from_warning/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/apps/value_from_warning/out.test.toml
+++ b/acceptance/bundle/apps/value_from_warning/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/artifacts/ai_runtime_code_source/command.sh b/acceptance/bundle/artifacts/ai_runtime_code_source/command.sh
new file mode 100644
index 00000000000..3b2cc1ddfe1
--- /dev/null
+++ b/acceptance/bundle/artifacts/ai_runtime_code_source/command.sh
@@ -0,0 +1,2 @@
+#!/bin/bash
+echo "hello from AI Runtime"
diff --git a/acceptance/bundle/artifacts/ai_runtime_code_source/databricks.yml b/acceptance/bundle/artifacts/ai_runtime_code_source/databricks.yml
new file mode 100644
index 00000000000..96783455893
--- /dev/null
+++ b/acceptance/bundle/artifacts/ai_runtime_code_source/databricks.yml
@@ -0,0 +1,44 @@
+bundle:
+  name: test-bundle
+
+workspace:
+  artifact_path: /foo/bar/artifacts
+
+# The tarball is delivered as an artifact; don't also sync it as a bundle file.
+# The archive glob is natural here and must not be mistaken for an exclude of the
+# generated code-snapshot dir: this task's code_source_path is a local FILE, so no
+# snapshot is packaged and the snapshot-dir guards must stay silent.
+sync:
+  exclude:
+    - build/**
+    - dist/**
+    - code.tgz
+    - "**/*.tar.gz"
+
+# The AI Runtime task ships user code as a tarball built locally by an artifact.
+artifacts:
+  code_source:
+    build: touch code.tgz
+    files:
+      - source: code.tgz
+
+resources:
+  jobs:
+    job:
+      name: "[${bundle.target}] AI Runtime Job"
+      environments:
+        - environment_key: default
+          spec:
+            environment_version: "4"
+      tasks:
+        - task_key: train
+          environment_key: default
+          ai_runtime_task:
+            experiment: my-experiment
+            # Local path to the built tarball; rewritten to the uploaded remote path.
+            code_source_path: code.tgz
+            deployments:
+              - command_path: command.sh
+                compute:
+                  accelerator_type: GPU_1xA10
+                  accelerator_count: 1
diff --git a/acceptance/bundle/artifacts/ai_runtime_code_source/out.test.toml b/acceptance/bundle/artifacts/ai_runtime_code_source/out.test.toml
new file mode 100644
index 00000000000..f7fafbcc731
--- /dev/null
+++ b/acceptance/bundle/artifacts/ai_runtime_code_source/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/artifacts/ai_runtime_code_source/output.txt b/acceptance/bundle/artifacts/ai_runtime_code_source/output.txt
new file mode 100644
index 00000000000..1a3ffc22b37
--- /dev/null
+++ b/acceptance/bundle/artifacts/ai_runtime_code_source/output.txt
@@ -0,0 +1,20 @@
+
+=== Expecting code_source_path rewritten to the uploaded artifact remote path
+>>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.tasks[].ai_runtime_task [OUTPUT_DIR]/out.requests.txt
+{
+  "code_source_path": "/Workspace/foo/bar/artifacts/.internal/code.tgz",
+  "deployments": [
+    {
+      "command_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/command.sh",
+      "compute": {
+        "accelerator_count": 1,
+        "accelerator_type": "GPU_1xA10"
+      }
+    }
+  ],
+  "experiment": "my-experiment"
+}
+
+=== Expecting the code_source tarball to be uploaded
+>>> print_workspace_imports
+/Workspace/foo/bar/artifacts/.internal/code.tgz
diff --git a/acceptance/bundle/artifacts/ai_runtime_code_source/script b/acceptance/bundle/artifacts/ai_runtime_code_source/script
new file mode 100644
index 00000000000..32460827ec5
--- /dev/null
+++ b/acceptance/bundle/artifacts/ai_runtime_code_source/script
@@ -0,0 +1,11 @@
+$CLI bundle plan -o json > tmp.plan.json 2>>LOG.plan
+$CLI bundle deploy $(readplanarg tmp.plan.json) &> LOG.deploy
+cat LOG.deploy | contains.py "Uploading code.tgz" > /dev/null
+
+title "Expecting code_source_path rewritten to the uploaded artifact remote path"
+trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.tasks[].ai_runtime_task' "$OUT_REQUESTS"
+
+title "Expecting the code_source tarball to be uploaded"
+trace print_workspace_imports | grep code.tgz | sort
+
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/artifacts/ai_runtime_code_source/test.toml b/acceptance/bundle/artifacts/ai_runtime_code_source/test.toml
new file mode 100644
index 00000000000..82b08e9442e
--- /dev/null
+++ b/acceptance/bundle/artifacts/ai_runtime_code_source/test.toml
@@ -0,0 +1,10 @@
+EnvMatrix.READPLAN = ["", "1"]
+
+RecordRequests = true
+Ignore = [
+    'code.tgz',
+    '.databricks',
+]
+
+# The Terraform provider dropped `code_source_path` from `ai_runtime_task` in
+# v1.122.0, so this feature is only exercisable via the direct engine.
diff --git a/acceptance/bundle/artifacts/artifact_path_with_volume/common_script.sh b/acceptance/bundle/artifacts/artifact_path_with_volume/common_script.sh
index c9d31b25da3..6eb6f1a868e 100644
--- a/acceptance/bundle/artifacts/artifact_path_with_volume/common_script.sh
+++ b/acceptance/bundle/artifacts/artifact_path_with_volume/common_script.sh
@@ -1,5 +1,6 @@
 export SCHEMA_NAME=schema-$UNIQUE_NAME
 trace envsubst < $TESTDIR/../databricks.yml.tmpl > databricks.yml
 trap "trace '$CLI' schemas delete main.$SCHEMA_NAME" EXIT
-trace $CLI schemas create $SCHEMA_NAME main | jq 'del(.effective_predictive_optimization_flag.inherited_from_name)'
+# effective_predictive_optimization_flag is inherited from the metastore and backend-controlled; drop it so the test does not depend on metastore settings.
+trace $CLI schemas create $SCHEMA_NAME main | jq 'del(.effective_predictive_optimization_flag)'
 trace musterr $CLI bundle deploy
diff --git a/acceptance/bundle/artifacts/artifact_path_with_volume/test.toml b/acceptance/bundle/artifacts/artifact_path_with_volume/test.toml
index 319c56cdfe0..e7d4c21d0fc 100644
--- a/acceptance/bundle/artifacts/artifact_path_with_volume/test.toml
+++ b/acceptance/bundle/artifacts/artifact_path_with_volume/test.toml
@@ -1,3 +1,4 @@
-Local = false
 Cloud = true
+
+# Overrides RecordRequests = true set by the artifacts parent test.toml.
 RecordRequests = false
diff --git a/acceptance/bundle/artifacts/artifact_path_with_volume/volume_doesnot_exist/out.test.toml b/acceptance/bundle/artifacts/artifact_path_with_volume/volume_doesnot_exist/out.test.toml
index 2d812727e32..0f167effef1 100644
--- a/acceptance/bundle/artifacts/artifact_path_with_volume/volume_doesnot_exist/out.test.toml
+++ b/acceptance/bundle/artifacts/artifact_path_with_volume/volume_doesnot_exist/out.test.toml
@@ -1,4 +1,2 @@
-Local = false
 Cloud = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/artifacts/artifact_path_with_volume/volume_doesnot_exist/output.txt b/acceptance/bundle/artifacts/artifact_path_with_volume/volume_doesnot_exist/output.txt
index 7307bcb0a87..369460360da 100644
--- a/acceptance/bundle/artifacts/artifact_path_with_volume/volume_doesnot_exist/output.txt
+++ b/acceptance/bundle/artifacts/artifact_path_with_volume/volume_doesnot_exist/output.txt
@@ -8,10 +8,6 @@
   "catalog_type": "MANAGED_CATALOG",
   "created_at": [UNIX_TIME_MILLIS][0],
   "created_by": "[USERNAME]",
-  "effective_predictive_optimization_flag": {
-    "inherited_from_type": "METASTORE",
-    "value": "DISABLE"
-  },
   "enable_predictive_optimization": "INHERIT",
   "full_name": "main.schema-[UNIQUE_NAME]",
   "metastore_id": "[UUID]",
diff --git a/acceptance/bundle/artifacts/artifact_path_with_volume/volume_doesnot_exist/test.toml b/acceptance/bundle/artifacts/artifact_path_with_volume/volume_doesnot_exist/test.toml
deleted file mode 100644
index 476b9209ae6..00000000000
--- a/acceptance/bundle/artifacts/artifact_path_with_volume/volume_doesnot_exist/test.toml
+++ /dev/null
@@ -1,2 +0,0 @@
-Cloud = true
-RequiresUnityCatalog = true
diff --git a/acceptance/bundle/artifacts/artifact_path_with_volume/volume_not_deployed/out.test.toml b/acceptance/bundle/artifacts/artifact_path_with_volume/volume_not_deployed/out.test.toml
index 2d812727e32..0f167effef1 100644
--- a/acceptance/bundle/artifacts/artifact_path_with_volume/volume_not_deployed/out.test.toml
+++ b/acceptance/bundle/artifacts/artifact_path_with_volume/volume_not_deployed/out.test.toml
@@ -1,4 +1,2 @@
-Local = false
 Cloud = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/artifacts/artifact_path_with_volume/volume_not_deployed/output.txt b/acceptance/bundle/artifacts/artifact_path_with_volume/volume_not_deployed/output.txt
index d8cae4e8af7..d5788b0b3c5 100644
--- a/acceptance/bundle/artifacts/artifact_path_with_volume/volume_not_deployed/output.txt
+++ b/acceptance/bundle/artifacts/artifact_path_with_volume/volume_not_deployed/output.txt
@@ -8,10 +8,6 @@
   "catalog_type": "MANAGED_CATALOG",
   "created_at": [UNIX_TIME_MILLIS][0],
   "created_by": "[USERNAME]",
-  "effective_predictive_optimization_flag": {
-    "inherited_from_type": "METASTORE",
-    "value": "DISABLE"
-  },
   "enable_predictive_optimization": "INHERIT",
   "full_name": "main.schema-[UNIQUE_NAME]",
   "metastore_id": "[UUID]",
diff --git a/acceptance/bundle/artifacts/artifact_path_with_volume/volume_not_deployed/test.toml b/acceptance/bundle/artifacts/artifact_path_with_volume/volume_not_deployed/test.toml
index fbdd6c8ddf1..de4b4cf2fc3 100644
--- a/acceptance/bundle/artifacts/artifact_path_with_volume/volume_not_deployed/test.toml
+++ b/acceptance/bundle/artifacts/artifact_path_with_volume/volume_not_deployed/test.toml
@@ -1,3 +1 @@
 Badness = "Requires two bundles; one for volumes, another for artifacts. Ideally it would just work but today we first upload then deploy, so it does not fit in that architecture."
-Cloud = true
-RequiresUnityCatalog = true
diff --git a/acceptance/bundle/artifacts/artifact_upload_for_volumes/out.test.toml b/acceptance/bundle/artifacts/artifact_upload_for_volumes/out.test.toml
index f784a183258..f7fafbcc731 100644
--- a/acceptance/bundle/artifacts/artifact_upload_for_volumes/out.test.toml
+++ b/acceptance/bundle/artifacts/artifact_upload_for_volumes/out.test.toml
@@ -1,3 +1,3 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/artifacts/artifact_upload_for_volumes/output.txt b/acceptance/bundle/artifacts/artifact_upload_for_volumes/output.txt
index 021ff6d7556..43f98e80a8c 100644
--- a/acceptance/bundle/artifacts/artifact_upload_for_volumes/output.txt
+++ b/acceptance/bundle/artifacts/artifact_upload_for_volumes/output.txt
@@ -1,13 +1,11 @@
-
->>> [CLI] bundle deploy
 Uploading whl/source.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.job
+Files: 4 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 === Expecting 2 wheels in libraries section in /jobs/create
->>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.tasks out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.tasks [OUTPUT_DIR]/out.requests.txt
 [
   {
     "existing_cluster_id": "0717-132531-5opeqon1",
@@ -50,7 +48,7 @@ Deployment complete!
 ]
 
 === Expecting environment dependencies to be updated
->>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.environments out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.environments [OUTPUT_DIR]/out.requests.txt
 [
   {
     "environment_key": "test_env",
@@ -65,7 +63,7 @@ Deployment complete!
 ]
 
 === Expecting wheel to be uploaded
->>> jq -s .[] | select(.path=="/api/2.0/fs/files/Volumes/foo/bar/artifacts/.internal/source.whl") out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.0/fs/files/Volumes/foo/bar/artifacts/.internal/source.whl") [OUTPUT_DIR]/out.requests.txt
 {
   "method": "PUT",
   "path": "/api/2.0/fs/files/Volumes/foo/bar/artifacts/.internal/source.whl",
diff --git a/acceptance/bundle/artifacts/artifact_upload_for_volumes/script b/acceptance/bundle/artifacts/artifact_upload_for_volumes/script
index 185482ca15e..7b07ae3162f 100644
--- a/acceptance/bundle/artifacts/artifact_upload_for_volumes/script
+++ b/acceptance/bundle/artifacts/artifact_upload_for_volumes/script
@@ -2,15 +2,16 @@
 mkdir -p whl
 echo "test wheel content" > whl/source.whl
 
-trace $CLI bundle deploy
+$CLI bundle plan -o json > tmp.plan.json 2>>LOG.plan
+$CLI bundle deploy $(readplanarg tmp.plan.json)
 
 title "Expecting 2 wheels in libraries section in /jobs/create"
-trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.tasks' out.requests.txt
+trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.tasks' "$OUT_REQUESTS"
 
 title "Expecting environment dependencies to be updated"
-trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.environments' out.requests.txt
+trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.environments' "$OUT_REQUESTS"
 
 title "Expecting wheel to be uploaded"
-trace jq -s '.[] | select(.path=="/api/2.0/fs/files/Volumes/foo/bar/artifacts/.internal/source.whl")' out.requests.txt
+trace jq -s '.[] | select(.path=="/api/2.0/fs/files/Volumes/foo/bar/artifacts/.internal/source.whl")' "$OUT_REQUESTS"
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/artifacts/artifact_upload_for_volumes/test.toml b/acceptance/bundle/artifacts/artifact_upload_for_volumes/test.toml
index fd0cfecf5d1..7f34103782f 100644
--- a/acceptance/bundle/artifacts/artifact_upload_for_volumes/test.toml
+++ b/acceptance/bundle/artifacts/artifact_upload_for_volumes/test.toml
@@ -1,3 +1,5 @@
+EnvMatrix.READPLAN = ["", "1"]
+
 RecordRequests = true
 Ignore = [
     '.venv',
diff --git a/acceptance/bundle/artifacts/artifact_upload_for_workspace/out.test.toml b/acceptance/bundle/artifacts/artifact_upload_for_workspace/out.test.toml
index f784a183258..f7fafbcc731 100644
--- a/acceptance/bundle/artifacts/artifact_upload_for_workspace/out.test.toml
+++ b/acceptance/bundle/artifacts/artifact_upload_for_workspace/out.test.toml
@@ -1,3 +1,3 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/artifacts/artifact_upload_for_workspace/output.txt b/acceptance/bundle/artifacts/artifact_upload_for_workspace/output.txt
index dd81ba7de2a..9997818f806 100644
--- a/acceptance/bundle/artifacts/artifact_upload_for_workspace/output.txt
+++ b/acceptance/bundle/artifacts/artifact_upload_for_workspace/output.txt
@@ -1,13 +1,11 @@
-
->>> [CLI] bundle deploy
 Uploading whl/source.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.job
+Files: 4 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 === Expecting 2 wheels in libraries section in /jobs/create
->>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.tasks out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.tasks [OUTPUT_DIR]/out.requests.txt
 [
   {
     "existing_cluster_id": "0717-132531-5opeqon1",
@@ -50,12 +48,12 @@ Deployment complete!
 ]
 
 === Expecting wheel to be uploaded
->>> jq .path
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/whl/source.whl"
-"/api/2.0/workspace-files/import-file/Workspace/foo/bar/artifacts/.internal/source.whl"
+>>> print_workspace_imports
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/whl/source.whl
+/Workspace/foo/bar/artifacts/.internal/source.whl
 
 === Expecting environment dependencies to be updated
->>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.environments out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.environments [OUTPUT_DIR]/out.requests.txt
 [
   {
     "environment_key": "test_env",
@@ -70,7 +68,7 @@ Deployment complete!
 ]
 
 === Expecting delete request to artifact_path/.internal folder
->>> jq -s .[] | select(.path=="/api/2.0/workspace/delete") | select(.body.path | test(".*/artifacts/.internal")) out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.0/workspace/delete") | select(.body.path | test(".*/artifacts/.internal")) [OUTPUT_DIR]/out.requests.txt
 {
   "method": "POST",
   "path": "/api/2.0/workspace/delete",
@@ -81,7 +79,7 @@ Deployment complete!
 }
 
 === Expecting mkdirs request to artifact_path/.internal folder
->>> jq -s .[] | select(.path=="/api/2.0/workspace/mkdirs") | select(.body.path | test(".*/artifacts/.internal")) out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.0/workspace/mkdirs") | select(.body.path | test(".*/artifacts/.internal")) [OUTPUT_DIR]/out.requests.txt
 {
   "method": "POST",
   "path": "/api/2.0/workspace/mkdirs",
diff --git a/acceptance/bundle/artifacts/artifact_upload_for_workspace/script b/acceptance/bundle/artifacts/artifact_upload_for_workspace/script
index e6b1437627c..b3c226bc752 100644
--- a/acceptance/bundle/artifacts/artifact_upload_for_workspace/script
+++ b/acceptance/bundle/artifacts/artifact_upload_for_workspace/script
@@ -2,21 +2,22 @@
 mkdir -p whl
 echo "test wheel content" > whl/source.whl
 
-trace $CLI bundle deploy
+$CLI bundle plan -o json > tmp.plan.json 2>>LOG.plan
+$CLI bundle deploy $(readplanarg tmp.plan.json)
 
 title "Expecting 2 wheels in libraries section in /jobs/create"
-trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.tasks' out.requests.txt
+trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.tasks' "$OUT_REQUESTS"
 
 title "Expecting wheel to be uploaded"
-trace jq .path < out.requests.txt | grep import | grep whl | sort
+trace print_workspace_imports | grep whl | sort
 
 title "Expecting environment dependencies to be updated"
-trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.environments' out.requests.txt
+trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.environments' "$OUT_REQUESTS"
 
 title "Expecting delete request to artifact_path/.internal folder"
-trace jq -s '.[] | select(.path=="/api/2.0/workspace/delete") | select(.body.path | test(".*/artifacts/.internal"))' out.requests.txt
+trace jq -s '.[] | select(.path=="/api/2.0/workspace/delete") | select(.body.path | test(".*/artifacts/.internal"))' "$OUT_REQUESTS"
 
 title "Expecting mkdirs request to artifact_path/.internal folder"
-trace jq -s '.[] | select(.path=="/api/2.0/workspace/mkdirs") | select(.body.path | test(".*/artifacts/.internal"))' out.requests.txt
+trace jq -s '.[] | select(.path=="/api/2.0/workspace/mkdirs") | select(.body.path | test(".*/artifacts/.internal"))' "$OUT_REQUESTS"
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/artifacts/artifact_upload_for_workspace/test.toml b/acceptance/bundle/artifacts/artifact_upload_for_workspace/test.toml
index a0a680e9d19..9d3e522e128 100644
--- a/acceptance/bundle/artifacts/artifact_upload_for_workspace/test.toml
+++ b/acceptance/bundle/artifacts/artifact_upload_for_workspace/test.toml
@@ -1,3 +1,5 @@
+EnvMatrix.READPLAN = ["", "1"]
+
 RecordRequests = true
 Ignore = [
     '.venv',
diff --git a/acceptance/bundle/artifacts/artifact_upload_with_no_library_reference/out.test.toml b/acceptance/bundle/artifacts/artifact_upload_with_no_library_reference/out.test.toml
index f784a183258..f7fafbcc731 100644
--- a/acceptance/bundle/artifacts/artifact_upload_with_no_library_reference/out.test.toml
+++ b/acceptance/bundle/artifacts/artifact_upload_with_no_library_reference/out.test.toml
@@ -1,3 +1,3 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/artifacts/artifact_upload_with_no_library_reference/output.txt b/acceptance/bundle/artifacts/artifact_upload_with_no_library_reference/output.txt
index 6d24880e6c0..ca39c787992 100644
--- a/acceptance/bundle/artifacts/artifact_upload_with_no_library_reference/output.txt
+++ b/acceptance/bundle/artifacts/artifact_upload_with_no_library_reference/output.txt
@@ -1,17 +1,15 @@
-
->>> [CLI] bundle deploy
 Uploading whl/source.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Deployment complete!
+Files: 4 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
 
 === Expecting wheel to be uploaded
->>> jq .path
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/whl/source.whl"
-"/api/2.0/workspace-files/import-file/Workspace/foo/bar/artifacts/.internal/source.whl"
+>>> print_workspace_imports
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/whl/source.whl
+/Workspace/foo/bar/artifacts/.internal/source.whl
 
 === Expecting delete request to artifact_path/.internal folder
->>> jq -s .[] | select(.path=="/api/2.0/workspace/delete") | select(.body.path | test(".*/artifacts/.internal")) out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.0/workspace/delete") | select(.body.path | test(".*/artifacts/.internal")) [OUTPUT_DIR]/out.requests.txt
 {
   "method": "POST",
   "path": "/api/2.0/workspace/delete",
@@ -22,7 +20,7 @@ Deployment complete!
 }
 
 === Expecting mkdirs request to artifact_path/.internal folder
->>> jq -s .[] | select(.path=="/api/2.0/workspace/mkdirs") | select(.body.path | test(".*/artifacts/.internal")) out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.0/workspace/mkdirs") | select(.body.path | test(".*/artifacts/.internal")) [OUTPUT_DIR]/out.requests.txt
 {
   "method": "POST",
   "path": "/api/2.0/workspace/mkdirs",
diff --git a/acceptance/bundle/artifacts/artifact_upload_with_no_library_reference/script b/acceptance/bundle/artifacts/artifact_upload_with_no_library_reference/script
index 883601185c9..0d665cfbc5f 100644
--- a/acceptance/bundle/artifacts/artifact_upload_with_no_library_reference/script
+++ b/acceptance/bundle/artifacts/artifact_upload_with_no_library_reference/script
@@ -2,15 +2,16 @@
 mkdir -p whl
 echo "test wheel content" > whl/source.whl
 
-trace $CLI bundle deploy
+$CLI bundle plan -o json > tmp.plan.json 2>>LOG.plan
+$CLI bundle deploy $(readplanarg tmp.plan.json)
 
 title "Expecting wheel to be uploaded"
-trace jq .path < out.requests.txt | grep import | grep whl | sort
+trace print_workspace_imports | grep whl | sort
 
 title "Expecting delete request to artifact_path/.internal folder"
-trace jq -s '.[] | select(.path=="/api/2.0/workspace/delete") | select(.body.path | test(".*/artifacts/.internal"))' out.requests.txt
+trace jq -s '.[] | select(.path=="/api/2.0/workspace/delete") | select(.body.path | test(".*/artifacts/.internal"))' "$OUT_REQUESTS"
 
 title "Expecting mkdirs request to artifact_path/.internal folder"
-trace jq -s '.[] | select(.path=="/api/2.0/workspace/mkdirs") | select(.body.path | test(".*/artifacts/.internal"))' out.requests.txt
+trace jq -s '.[] | select(.path=="/api/2.0/workspace/mkdirs") | select(.body.path | test(".*/artifacts/.internal"))' "$OUT_REQUESTS"
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/artifacts/artifact_upload_with_no_library_reference/test.toml b/acceptance/bundle/artifacts/artifact_upload_with_no_library_reference/test.toml
index a0a680e9d19..9d3e522e128 100644
--- a/acceptance/bundle/artifacts/artifact_upload_with_no_library_reference/test.toml
+++ b/acceptance/bundle/artifacts/artifact_upload_with_no_library_reference/test.toml
@@ -1,3 +1,5 @@
+EnvMatrix.READPLAN = ["", "1"]
+
 RecordRequests = true
 Ignore = [
     '.venv',
diff --git a/acceptance/bundle/artifacts/artifacts_dynamic_version/out.test.toml b/acceptance/bundle/artifacts/artifacts_dynamic_version/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/artifacts/artifacts_dynamic_version/out.test.toml
+++ b/acceptance/bundle/artifacts/artifacts_dynamic_version/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/artifacts/build_and_files/out.test.toml b/acceptance/bundle/artifacts/build_and_files/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/artifacts/build_and_files/out.test.toml
+++ b/acceptance/bundle/artifacts/build_and_files/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/artifacts/build_and_files_whl/out.test.toml b/acceptance/bundle/artifacts/build_and_files_whl/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/artifacts/build_and_files_whl/out.test.toml
+++ b/acceptance/bundle/artifacts/build_and_files_whl/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/artifacts/build_and_files_whl/output.txt b/acceptance/bundle/artifacts/build_and_files_whl/output.txt
index b618de6b89a..a0652eb8237 100644
--- a/acceptance/bundle/artifacts/build_and_files_whl/output.txt
+++ b/acceptance/bundle/artifacts/build_and_files_whl/output.txt
@@ -12,5 +12,5 @@ Validation OK!
 Building artifact_with_custom_dist...
 Uploading mydist/my_test_code-0.0.1-py3-none-any.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Deployment complete!
+Files: 13 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
diff --git a/acceptance/bundle/artifacts/glob_exact_whl/out.test.toml b/acceptance/bundle/artifacts/glob_exact_whl/out.test.toml
index f784a183258..f7fafbcc731 100644
--- a/acceptance/bundle/artifacts/glob_exact_whl/out.test.toml
+++ b/acceptance/bundle/artifacts/glob_exact_whl/out.test.toml
@@ -1,3 +1,3 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/artifacts/glob_exact_whl/output.txt b/acceptance/bundle/artifacts/glob_exact_whl/output.txt
index 3f292b7a0d9..d0d89fe9f50 100644
--- a/acceptance/bundle/artifacts/glob_exact_whl/output.txt
+++ b/acceptance/bundle/artifacts/glob_exact_whl/output.txt
@@ -11,10 +11,8 @@
     "type": "whl"
   }
 }
-
->>> [CLI] bundle deploy
 Uploading prebuilt/other_test_code-0.0.1-py3-none-any.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.test_job
+Files: 4 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
diff --git a/acceptance/bundle/artifacts/glob_exact_whl/script b/acceptance/bundle/artifacts/glob_exact_whl/script
index 3244477ed31..69320ee17b0 100644
--- a/acceptance/bundle/artifacts/glob_exact_whl/script
+++ b/acceptance/bundle/artifacts/glob_exact_whl/script
@@ -2,4 +2,5 @@ trap "rm -r prebuilt" EXIT
 mkdir prebuilt
 cp -r $TESTDIR/../whl_prebuilt_multiple/dist/lib/other_test_code-0.0.1-py3-none-any.whl prebuilt
 trace $CLI bundle validate -o json | jq .artifacts
-trace $CLI bundle deploy
+$CLI bundle plan -o json > tmp.plan.json 2>>LOG.plan
+$CLI bundle deploy $(readplanarg tmp.plan.json)
diff --git a/acceptance/bundle/artifacts/glob_exact_whl/test.toml b/acceptance/bundle/artifacts/glob_exact_whl/test.toml
index 93ee159927b..e5e39fc4c06 100644
--- a/acceptance/bundle/artifacts/glob_exact_whl/test.toml
+++ b/acceptance/bundle/artifacts/glob_exact_whl/test.toml
@@ -1,3 +1,5 @@
+EnvMatrix.READPLAN = ["", "1"]
+
 RecordRequests = false
 
 [[Repls]]
diff --git a/acceptance/bundle/artifacts/globs_in_files/out.test.toml b/acceptance/bundle/artifacts/globs_in_files/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/artifacts/globs_in_files/out.test.toml
+++ b/acceptance/bundle/artifacts/globs_in_files/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/artifacts/globs_in_files_in_include/out.test.toml b/acceptance/bundle/artifacts/globs_in_files_in_include/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/artifacts/globs_in_files_in_include/out.test.toml
+++ b/acceptance/bundle/artifacts/globs_in_files_in_include/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/artifacts/globs_invalid/out.test.toml b/acceptance/bundle/artifacts/globs_invalid/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/artifacts/globs_invalid/out.test.toml
+++ b/acceptance/bundle/artifacts/globs_invalid/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/artifacts/issue_3109/out.test.toml b/acceptance/bundle/artifacts/issue_3109/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/artifacts/issue_3109/out.test.toml
+++ b/acceptance/bundle/artifacts/issue_3109/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/artifacts/issue_3109/output.txt b/acceptance/bundle/artifacts/issue_3109/output.txt
index ff6b9968ce4..a4a14c53bb2 100644
--- a/acceptance/bundle/artifacts/issue_3109/output.txt
+++ b/acceptance/bundle/artifacts/issue_3109/output.txt
@@ -5,6 +5,6 @@ Warning: required field "entry_point" is not set
 Building wheels...
 Uploading dist/my_default_python-0.0.1-py3-none-any.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/dev/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.job1
+Files: 4 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
diff --git a/acceptance/bundle/artifacts/nil_artifacts/out.test.toml b/acceptance/bundle/artifacts/nil_artifacts/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/artifacts/nil_artifacts/out.test.toml
+++ b/acceptance/bundle/artifacts/nil_artifacts/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/artifacts/nil_artifacts/output.txt b/acceptance/bundle/artifacts/nil_artifacts/output.txt
index f4bf0a6f400..a47dca01faf 100644
--- a/acceptance/bundle/artifacts/nil_artifacts/output.txt
+++ b/acceptance/bundle/artifacts/nil_artifacts/output.txt
@@ -12,5 +12,3 @@ Workspace:
   Path: /Workspace/Users/[USERNAME]/.bundle/nil_artifacts_test/default
 
 Found 1 error
-
-Exit code: 1
diff --git a/acceptance/bundle/artifacts/nil_artifacts/script b/acceptance/bundle/artifacts/nil_artifacts/script
index f52b452ee67..277355fe918 100644
--- a/acceptance/bundle/artifacts/nil_artifacts/script
+++ b/acceptance/bundle/artifacts/nil_artifacts/script
@@ -1 +1 @@
-errcode trace $CLI bundle validate
+musterr trace $CLI bundle validate
diff --git a/acceptance/bundle/artifacts/same_name_libraries/out.test.toml b/acceptance/bundle/artifacts/same_name_libraries/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/artifacts/same_name_libraries/out.test.toml
+++ b/acceptance/bundle/artifacts/same_name_libraries/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/artifacts/shell/bash/out.test.toml b/acceptance/bundle/artifacts/shell/bash/out.test.toml
index 1baaa898c5b..8c2cb31de53 100644
--- a/acceptance/bundle/artifacts/shell/bash/out.test.toml
+++ b/acceptance/bundle/artifacts/shell/bash/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
 GOOS.windows = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/artifacts/shell/bash/output.txt b/acceptance/bundle/artifacts/shell/bash/output.txt
index fa5d7b76bcd..355c210ee21 100644
--- a/acceptance/bundle/artifacts/shell/bash/output.txt
+++ b/acceptance/bundle/artifacts/shell/bash/output.txt
@@ -2,5 +2,5 @@
 >>> [CLI] bundle deploy
 Building my_artifact...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/shell-bash/default/files...
-Deploying resources...
-Deployment complete!
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
diff --git a/acceptance/bundle/artifacts/shell/bash/test.toml b/acceptance/bundle/artifacts/shell/bash/test.toml
index 108550f0086..2b2e373e130 100644
--- a/acceptance/bundle/artifacts/shell/bash/test.toml
+++ b/acceptance/bundle/artifacts/shell/bash/test.toml
@@ -1,5 +1,4 @@
 # Line feed (\n) characters are rendered differently by bash vs sh on Unix based systems.
 # However that does not hold true for Windows WSL. Since the goal of this test is to assert
 # the chosen shell is being used, we skip this test on Windows.
-[GOOS]
-windows = false
+GOOS.windows = false
diff --git a/acceptance/bundle/artifacts/shell/basic/out.test.toml b/acceptance/bundle/artifacts/shell/basic/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/artifacts/shell/basic/out.test.toml
+++ b/acceptance/bundle/artifacts/shell/basic/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/artifacts/shell/basic/output.txt b/acceptance/bundle/artifacts/shell/basic/output.txt
index b5e01c79e67..f510c418262 100644
--- a/acceptance/bundle/artifacts/shell/basic/output.txt
+++ b/acceptance/bundle/artifacts/shell/basic/output.txt
@@ -2,5 +2,5 @@
 >>> [CLI] bundle deploy
 Building my_artifact...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/shell-basic/default/files...
-Deploying resources...
-Deployment complete!
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
diff --git a/acceptance/bundle/artifacts/shell/cmd/out.test.toml b/acceptance/bundle/artifacts/shell/cmd/out.test.toml
index 8471d88c7f3..fee5005f692 100644
--- a/acceptance/bundle/artifacts/shell/cmd/out.test.toml
+++ b/acceptance/bundle/artifacts/shell/cmd/out.test.toml
@@ -1,5 +1,4 @@
-Local = true
 Cloud = false
 GOOS.darwin = false
 GOOS.linux = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/artifacts/shell/cmd/output.txt b/acceptance/bundle/artifacts/shell/cmd/output.txt
index 8ebed9f66d4..ac6a5095fb9 100644
--- a/acceptance/bundle/artifacts/shell/cmd/output.txt
+++ b/acceptance/bundle/artifacts/shell/cmd/output.txt
@@ -1,6 +1,2 @@
 
->>> [CLI] bundle deploy
-Building my_artifact...
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/shell-cmd/default/files...
-Deploying resources...
-Deployment complete!
+>>> [CLI] bundle deploy -qq
diff --git a/acceptance/bundle/artifacts/shell/cmd/script b/acceptance/bundle/artifacts/shell/cmd/script
index 68ebb78d775..35afd848b7c 100644
--- a/acceptance/bundle/artifacts/shell/cmd/script
+++ b/acceptance/bundle/artifacts/shell/cmd/script
@@ -1 +1 @@
-trace $CLI bundle deploy
+trace $CLI bundle deploy -qq
diff --git a/acceptance/bundle/artifacts/shell/cmd/test.toml b/acceptance/bundle/artifacts/shell/cmd/test.toml
index 6a2c5b15fb7..485f659d110 100644
--- a/acceptance/bundle/artifacts/shell/cmd/test.toml
+++ b/acceptance/bundle/artifacts/shell/cmd/test.toml
@@ -1,4 +1,3 @@
 # cmd.exe is only available on Windows.
-[GOOS]
-darwin = false
-linux = false
+GOOS.darwin = false
+GOOS.linux = false
diff --git a/acceptance/bundle/artifacts/shell/default/out.test.toml b/acceptance/bundle/artifacts/shell/default/out.test.toml
index 1baaa898c5b..8c2cb31de53 100644
--- a/acceptance/bundle/artifacts/shell/default/out.test.toml
+++ b/acceptance/bundle/artifacts/shell/default/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
 GOOS.windows = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/artifacts/shell/default/output.txt b/acceptance/bundle/artifacts/shell/default/output.txt
index fa5d7b76bcd..355c210ee21 100644
--- a/acceptance/bundle/artifacts/shell/default/output.txt
+++ b/acceptance/bundle/artifacts/shell/default/output.txt
@@ -2,5 +2,5 @@
 >>> [CLI] bundle deploy
 Building my_artifact...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/shell-bash/default/files...
-Deploying resources...
-Deployment complete!
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
diff --git a/acceptance/bundle/artifacts/shell/default/test.toml b/acceptance/bundle/artifacts/shell/default/test.toml
index 108550f0086..2b2e373e130 100644
--- a/acceptance/bundle/artifacts/shell/default/test.toml
+++ b/acceptance/bundle/artifacts/shell/default/test.toml
@@ -1,5 +1,4 @@
 # Line feed (\n) characters are rendered differently by bash vs sh on Unix based systems.
 # However that does not hold true for Windows WSL. Since the goal of this test is to assert
 # the chosen shell is being used, we skip this test on Windows.
-[GOOS]
-windows = false
+GOOS.windows = false
diff --git a/acceptance/bundle/artifacts/shell/err-bash/out.test.toml b/acceptance/bundle/artifacts/shell/err-bash/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/artifacts/shell/err-bash/out.test.toml
+++ b/acceptance/bundle/artifacts/shell/err-bash/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/artifacts/shell/err-sh/out.test.toml b/acceptance/bundle/artifacts/shell/err-sh/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/artifacts/shell/err-sh/out.test.toml
+++ b/acceptance/bundle/artifacts/shell/err-sh/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/artifacts/shell/invalid/out.test.toml b/acceptance/bundle/artifacts/shell/invalid/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/artifacts/shell/invalid/out.test.toml
+++ b/acceptance/bundle/artifacts/shell/invalid/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/artifacts/shell/sh/out.test.toml b/acceptance/bundle/artifacts/shell/sh/out.test.toml
index 1baaa898c5b..8c2cb31de53 100644
--- a/acceptance/bundle/artifacts/shell/sh/out.test.toml
+++ b/acceptance/bundle/artifacts/shell/sh/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
 GOOS.windows = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/artifacts/shell/sh/output.txt b/acceptance/bundle/artifacts/shell/sh/output.txt
index 5117e6e9fc0..c35bb772ccf 100644
--- a/acceptance/bundle/artifacts/shell/sh/output.txt
+++ b/acceptance/bundle/artifacts/shell/sh/output.txt
@@ -2,5 +2,5 @@
 >>> [CLI] bundle deploy
 Building my_artifact...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/shell-sh/default/files...
-Deploying resources...
-Deployment complete!
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
diff --git a/acceptance/bundle/artifacts/shell/sh/test.toml b/acceptance/bundle/artifacts/shell/sh/test.toml
index 108550f0086..2b2e373e130 100644
--- a/acceptance/bundle/artifacts/shell/sh/test.toml
+++ b/acceptance/bundle/artifacts/shell/sh/test.toml
@@ -1,5 +1,4 @@
 # Line feed (\n) characters are rendered differently by bash vs sh on Unix based systems.
 # However that does not hold true for Windows WSL. Since the goal of this test is to assert
 # the chosen shell is being used, we skip this test on Windows.
-[GOOS]
-windows = false
+GOOS.windows = false
diff --git a/acceptance/bundle/artifacts/shell/test.toml b/acceptance/bundle/artifacts/shell/test.toml
index 9796804e9a9..262a6f41b15 100644
--- a/acceptance/bundle/artifacts/shell/test.toml
+++ b/acceptance/bundle/artifacts/shell/test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
 RecordRequests = false
diff --git a/acceptance/bundle/artifacts/test.toml b/acceptance/bundle/artifacts/test.toml
index 61bf8345e7b..745face4d7c 100644
--- a/acceptance/bundle/artifacts/test.toml
+++ b/acceptance/bundle/artifacts/test.toml
@@ -19,6 +19,7 @@ Ignore = [
     'build',
     '*egg-info',
     '.databricks',
+    'tmp.plan.json',
 ]
 
 [[Server]]
diff --git a/acceptance/bundle/artifacts/unique_name_libraries/out.test.toml b/acceptance/bundle/artifacts/unique_name_libraries/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/artifacts/unique_name_libraries/out.test.toml
+++ b/acceptance/bundle/artifacts/unique_name_libraries/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/artifacts/unique_name_libraries/output.txt b/acceptance/bundle/artifacts/unique_name_libraries/output.txt
index ca37098f923..6e065d0b30b 100644
--- a/acceptance/bundle/artifacts/unique_name_libraries/output.txt
+++ b/acceptance/bundle/artifacts/unique_name_libraries/output.txt
@@ -5,6 +5,6 @@ Building whl2...
 Uploading whl1/dist/my_package-0.0.1-py3-none-any.whl...
 Uploading whl2/dist/my_other_package-0.0.1-py3-none-any.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.test
+Files: 25 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
diff --git a/acceptance/bundle/artifacts/upload_multiple_libraries/out.test.toml b/acceptance/bundle/artifacts/upload_multiple_libraries/out.test.toml
index f784a183258..f7fafbcc731 100644
--- a/acceptance/bundle/artifacts/upload_multiple_libraries/out.test.toml
+++ b/acceptance/bundle/artifacts/upload_multiple_libraries/out.test.toml
@@ -1,3 +1,3 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/artifacts/upload_multiple_libraries/output.txt b/acceptance/bundle/artifacts/upload_multiple_libraries/output.txt
index fa725a29d86..e500ebd0342 100644
--- a/acceptance/bundle/artifacts/upload_multiple_libraries/output.txt
+++ b/acceptance/bundle/artifacts/upload_multiple_libraries/output.txt
@@ -1,16 +1,14 @@
-
->>> [CLI] bundle deploy
 Uploading whl/source1.whl...
 Uploading whl/source2.whl...
 Uploading whl/source3.whl...
 Uploading whl/source4.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.job
+Files: 7 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 === Expecting 5 wheels in libraries section in /jobs/create
->>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.tasks out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.tasks [OUTPUT_DIR]/out.requests.txt
 [
   {
     "existing_cluster_id": "0717-132531-5opeqon1",
@@ -40,18 +38,18 @@ Deployment complete!
 ]
 
 === Expecting 4 wheels to be uploaded
->>> jq .path
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/whl/source1.whl"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/whl/source2.whl"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/whl/source3.whl"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/whl/source4.whl"
-"/api/2.0/workspace-files/import-file/Workspace/foo/bar/artifacts/.internal/source1.whl"
-"/api/2.0/workspace-files/import-file/Workspace/foo/bar/artifacts/.internal/source2.whl"
-"/api/2.0/workspace-files/import-file/Workspace/foo/bar/artifacts/.internal/source3.whl"
-"/api/2.0/workspace-files/import-file/Workspace/foo/bar/artifacts/.internal/source4.whl"
+>>> print_workspace_imports
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/whl/source1.whl
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/whl/source2.whl
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/whl/source3.whl
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/whl/source4.whl
+/Workspace/foo/bar/artifacts/.internal/source1.whl
+/Workspace/foo/bar/artifacts/.internal/source2.whl
+/Workspace/foo/bar/artifacts/.internal/source3.whl
+/Workspace/foo/bar/artifacts/.internal/source4.whl
 
 === Expecting environment dependencies to be updated
->>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.environments out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.environments [OUTPUT_DIR]/out.requests.txt
 [
   {
     "environment_key": "test_env",
diff --git a/acceptance/bundle/artifacts/upload_multiple_libraries/script b/acceptance/bundle/artifacts/upload_multiple_libraries/script
index f615147f8c4..89d0ba55291 100644
--- a/acceptance/bundle/artifacts/upload_multiple_libraries/script
+++ b/acceptance/bundle/artifacts/upload_multiple_libraries/script
@@ -5,15 +5,16 @@ echo "test wheel content 2" > whl/source2.whl
 echo "test wheel content 3" > whl/source3.whl
 echo "test wheel content 4" > whl/source4.whl
 
-trace $CLI bundle deploy
+$CLI bundle plan -o json > tmp.plan.json 2>>LOG.plan
+$CLI bundle deploy $(readplanarg tmp.plan.json)
 
 title "Expecting 5 wheels in libraries section in /jobs/create"
-trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.tasks' out.requests.txt
+trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.tasks' "$OUT_REQUESTS"
 
 title "Expecting 4 wheels to be uploaded"
-trace jq .path < out.requests.txt | grep import | grep whl | sort
+trace print_workspace_imports | grep whl | sort
 
 title "Expecting environment dependencies to be updated"
-trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.environments' out.requests.txt
+trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.environments' "$OUT_REQUESTS"
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/artifacts/upload_multiple_libraries/test.toml b/acceptance/bundle/artifacts/upload_multiple_libraries/test.toml
index a0a680e9d19..9d3e522e128 100644
--- a/acceptance/bundle/artifacts/upload_multiple_libraries/test.toml
+++ b/acceptance/bundle/artifacts/upload_multiple_libraries/test.toml
@@ -1,3 +1,5 @@
+EnvMatrix.READPLAN = ["", "1"]
+
 RecordRequests = true
 Ignore = [
     '.venv',
diff --git a/acceptance/bundle/artifacts/whl_change_version/out.test.toml b/acceptance/bundle/artifacts/whl_change_version/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/artifacts/whl_change_version/out.test.toml
+++ b/acceptance/bundle/artifacts/whl_change_version/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/artifacts/whl_change_version/output.txt b/acceptance/bundle/artifacts/whl_change_version/output.txt
index 4fc7ff66741..30134175168 100644
--- a/acceptance/bundle/artifacts/whl_change_version/output.txt
+++ b/acceptance/bundle/artifacts/whl_change_version/output.txt
@@ -3,15 +3,15 @@
 Building python_artifact...
 Uploading dist/my_test_code-0.1.0-py3-none-any.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.test_job
+Files: 6 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> find.py --expect 1 whl
 dist/my_test_code-0.1.0-py3-none-any.whl
 
 === Expecting 1 wheel in libraries section in /jobs/create
->>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.tasks out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.tasks [OUTPUT_DIR]/out.requests.txt
 [
   {
     "existing_cluster_id": "0717-aaaaa-bbbbbb",
@@ -29,23 +29,19 @@ dist/my_test_code-0.1.0-py3-none-any.whl
 ]
 
 === Expecting 1 wheel to be uploaded
->>> jq .path out.requests.txt
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.1.0-py3-none-any.whl"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/.gitignore"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/databricks.yml"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/dist/my_test_code-0.1.0-py3-none-any.whl"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/my_test_code/__init__.py"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/my_test_code/__main__.py"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/out.requests.txt"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/output.txt"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/repls.json"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/script"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/setup.py"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/test.toml"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deployment.json"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/STATE_FILENAME"
+>>> print_workspace_imports
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.1.0-py3-none-any.whl
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/.gitignore
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/databricks.yml
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/dist/my_test_code-0.1.0-py3-none-any.whl
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/my_test_code/__init__.py
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/my_test_code/__main__.py
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/setup.py
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deployment.json
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/STATE_FILENAME
 
 >>> update_file.py my_test_code/__init__.py 0.1.0 0.2.0
 
@@ -53,29 +49,27 @@ dist/my_test_code-0.1.0-py3-none-any.whl
 Building python_artifact...
 Uploading dist/my_test_code-0.2.0-py3-none-any.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated jobs.test_job
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
 >>> find.py --expect 2 whl
 dist/my_test_code-0.1.0-py3-none-any.whl
 dist/my_test_code-0.2.0-py3-none-any.whl
 
 === Expecting 1 wheel in libraries section in /jobs/reset
->>> jq -s .[] | select(.path=="/api/2.2/jobs/reset") | .body.new_settings.tasks out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.2/jobs/reset") | .body.new_settings.tasks [OUTPUT_DIR]/out.requests.txt
 json[0].libraries[0].whl = "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.2.0-py3-none-any.whl";
 
 === Expecting 1 wheel to be uploaded
->>> jq .path out.requests.txt
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.2.0-py3-none-any.whl"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/dist/my_test_code-0.2.0-py3-none-any.whl"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/my_test_code/__init__.py"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/out.requests.txt"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/output.txt"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deployment.json"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/STATE_FILENAME"
+>>> print_workspace_imports
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.2.0-py3-none-any.whl
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/dist/my_test_code-0.2.0-py3-none-any.whl
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/my_test_code/__init__.py
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deployment.json
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/STATE_FILENAME
 
 === Restore config to target old wheel
 >>> update_file.py databricks.yml ./dist/*.whl ./dist/my*0.1.0*.whl
@@ -85,27 +79,25 @@ Building python_artifact...
 Uploading dist/my_test_code-0.1.0-py3-none-any.whl...
 Uploading dist/my_test_code-0.2.0-py3-none-any.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated jobs.test_job
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
 >>> find.py --expect 2 whl
 dist/my_test_code-0.1.0-py3-none-any.whl
 dist/my_test_code-0.2.0-py3-none-any.whl
 
 === Expecting 1 wheel in libraries section in /jobs/reset
->>> jq -s .[] | select(.path=="/api/2.2/jobs/reset") | .body.new_settings.tasks out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.2/jobs/reset") | .body.new_settings.tasks [OUTPUT_DIR]/out.requests.txt
 json[0].libraries[0].whl = "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.1.0-py3-none-any.whl";
 
 === Expecting 1 wheel to be uploaded
->>> jq .path out.requests.txt
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.1.0-py3-none-any.whl"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.2.0-py3-none-any.whl"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/databricks.yml"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/dist/my_test_code-0.2.0-py3-none-any.whl"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/out.requests.txt"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/output.txt"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deployment.json"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/STATE_FILENAME"
+>>> print_workspace_imports
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.1.0-py3-none-any.whl
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.2.0-py3-none-any.whl
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/databricks.yml
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/dist/my_test_code-0.2.0-py3-none-any.whl
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deployment.json
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/STATE_FILENAME
diff --git a/acceptance/bundle/artifacts/whl_change_version/script b/acceptance/bundle/artifacts/whl_change_version/script
index 9f6f480f0db..4b97cb54259 100644
--- a/acceptance/bundle/artifacts/whl_change_version/script
+++ b/acceptance/bundle/artifacts/whl_change_version/script
@@ -3,12 +3,12 @@ trace $CLI bundle deploy
 trace find.py --expect 1 whl
 
 title "Expecting 1 wheel in libraries section in /jobs/create"
-trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.tasks' out.requests.txt
+trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.tasks' "$OUT_REQUESTS"
 
 title "Expecting 1 wheel to be uploaded"
-trace jq .path out.requests.txt | grep import | sort
+trace print_workspace_imports | sort
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
 
 
 trace update_file.py my_test_code/__init__.py 0.1.0 0.2.0
@@ -17,12 +17,12 @@ trace $CLI bundle deploy
 trace find.py --expect 2 whl  # there are now 2 wheels on disk
 
 title "Expecting 1 wheel in libraries section in /jobs/reset"
-trace jq -s '.[] | select(.path=="/api/2.2/jobs/reset") | .body.new_settings.tasks' out.requests.txt | gron.py | grep -w libraries
+trace jq -s '.[] | select(.path=="/api/2.2/jobs/reset") | .body.new_settings.tasks' "$OUT_REQUESTS" | gron.py | grep -w libraries
 
 title "Expecting 1 wheel to be uploaded"
-trace jq .path out.requests.txt | grep import | sort
+trace print_workspace_imports | sort
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
 
 
 title 'Restore config to target old wheel'
@@ -31,9 +31,9 @@ trace $CLI bundle deploy
 trace find.py --expect 2 whl
 
 title "Expecting 1 wheel in libraries section in /jobs/reset"
-trace jq -s '.[] | select(.path=="/api/2.2/jobs/reset") | .body.new_settings.tasks' out.requests.txt | gron.py | grep -w libraries
+trace jq -s '.[] | select(.path=="/api/2.2/jobs/reset") | .body.new_settings.tasks' "$OUT_REQUESTS" | gron.py | grep -w libraries
 
 title "Expecting 1 wheel to be uploaded"
-trace jq .path out.requests.txt | grep import | sort
+trace print_workspace_imports | sort
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/artifacts/whl_dbfs/out.test.toml b/acceptance/bundle/artifacts/whl_dbfs/out.test.toml
index f784a183258..f7fafbcc731 100644
--- a/acceptance/bundle/artifacts/whl_dbfs/out.test.toml
+++ b/acceptance/bundle/artifacts/whl_dbfs/out.test.toml
@@ -1,3 +1,3 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/artifacts/whl_dbfs/output.txt b/acceptance/bundle/artifacts/whl_dbfs/output.txt
index 306de22de1f..04b3a0f58fa 100644
--- a/acceptance/bundle/artifacts/whl_dbfs/output.txt
+++ b/acceptance/bundle/artifacts/whl_dbfs/output.txt
@@ -1,15 +1,13 @@
-
->>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.test_job
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 === Expecting to find no wheels
 >>> errcode find.py --expect 0 whl
 
 === Expecting 1 wheel in libraries section in /jobs/create
->>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.tasks out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.tasks [OUTPUT_DIR]/out.requests.txt
 [
   {
     "existing_cluster_id": "0717-132531-5opeqon1",
@@ -27,6 +25,6 @@ Deployment complete!
 ]
 
 === Expecting no wheels to be uploaded
->>> errcode sh -c jq .path < out.requests.txt | grep import | grep whl
+>>> print_workspace_imports
 
 Exit code: 1
diff --git a/acceptance/bundle/artifacts/whl_dbfs/script b/acceptance/bundle/artifacts/whl_dbfs/script
index d7c93d8f38f..bd7b88b5806 100644
--- a/acceptance/bundle/artifacts/whl_dbfs/script
+++ b/acceptance/bundle/artifacts/whl_dbfs/script
@@ -1,12 +1,13 @@
-trace $CLI bundle deploy
+$CLI bundle plan -o json > tmp.plan.json 2>>LOG.plan
+$CLI bundle deploy $(readplanarg tmp.plan.json)
 
 title "Expecting to find no wheels"
 trace errcode find.py --expect 0 whl
 
 title "Expecting 1 wheel in libraries section in /jobs/create"
-trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.tasks' out.requests.txt
+trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.tasks' "$OUT_REQUESTS"
 
 title "Expecting no wheels to be uploaded"
-trace errcode sh -c 'jq .path < out.requests.txt | grep import | grep whl'
+trace print_workspace_imports | errcode grep whl
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/artifacts/whl_dbfs/test.toml b/acceptance/bundle/artifacts/whl_dbfs/test.toml
new file mode 100644
index 00000000000..ff8a66c196e
--- /dev/null
+++ b/acceptance/bundle/artifacts/whl_dbfs/test.toml
@@ -0,0 +1 @@
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/artifacts/whl_dynamic/out.plan_create.direct.json b/acceptance/bundle/artifacts/whl_dynamic/out.plan_create.direct.json
deleted file mode 100644
index 37f8cbcc319..00000000000
--- a/acceptance/bundle/artifacts/whl_dynamic/out.plan_create.direct.json
+++ /dev/null
@@ -1,77 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.test_job": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "edit_mode": "UI_LOCKED",
-          "environments": [
-            {
-              "environment_key": "test_env",
-              "spec": {
-                "client": "1",
-                "dependencies": [
-                  "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl"
-                ]
-              }
-            }
-          ],
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "[default] My Wheel Job",
-          "queue": {
-            "enabled": true
-          },
-          "tasks": [
-            {
-              "environment_key": "test_env",
-              "python_wheel_task": {
-                "entry_point": "run",
-                "package_name": "my_test_code"
-              },
-              "task_key": "ServerlessTestTask"
-            },
-            {
-              "existing_cluster_id": "0717-132531-5opeqon1",
-              "for_each_task": {
-                "inputs": "[1]",
-                "task": {
-                  "existing_cluster_id": "0717-132531-5opeqon1",
-                  "libraries": [
-                    {
-                      "whl": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl"
-                    }
-                  ],
-                  "python_wheel_task": {
-                    "entry_point": "run",
-                    "package_name": "my_test_code"
-                  },
-                  "task_key": "SubTask"
-                }
-              },
-              "libraries": [
-                {
-                  "whl": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl"
-                },
-                {
-                  "whl": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/other_test_code-0.0.1+[UNIX_TIME_NANOS][1]-py3-none-any.whl"
-                }
-              ],
-              "python_wheel_task": {
-                "entry_point": "run",
-                "package_name": "my_test_code"
-              },
-              "task_key": "TestTask"
-            }
-          ]
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/artifacts/whl_dynamic/out.plan_create.json b/acceptance/bundle/artifacts/whl_dynamic/out.plan_create.json
new file mode 100644
index 00000000000..15e1b903b6d
--- /dev/null
+++ b/acceptance/bundle/artifacts/whl_dynamic/out.plan_create.json
@@ -0,0 +1,77 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.jobs.test_job": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "environments": [
+            {
+              "environment_key": "test_env",
+              "spec": {
+                "client": "1",
+                "dependencies": [
+                  "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl"
+                ]
+              }
+            }
+          ],
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "[default] My Wheel Job",
+          "queue": {
+            "enabled": true
+          },
+          "tasks": [
+            {
+              "environment_key": "test_env",
+              "python_wheel_task": {
+                "entry_point": "run",
+                "package_name": "my_test_code"
+              },
+              "task_key": "ServerlessTestTask"
+            },
+            {
+              "existing_cluster_id": "0717-132531-5opeqon1",
+              "for_each_task": {
+                "inputs": "[1]",
+                "task": {
+                  "existing_cluster_id": "0717-132531-5opeqon1",
+                  "libraries": [
+                    {
+                      "whl": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl"
+                    }
+                  ],
+                  "python_wheel_task": {
+                    "entry_point": "run",
+                    "package_name": "my_test_code"
+                  },
+                  "task_key": "SubTask"
+                }
+              },
+              "libraries": [
+                {
+                  "whl": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl"
+                },
+                {
+                  "whl": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/other_test_code-0.0.1+[UNIX_TIME_NANOS][1]-py3-none-any.whl"
+                }
+              ],
+              "python_wheel_task": {
+                "entry_point": "run",
+                "package_name": "my_test_code"
+              },
+              "task_key": "TestTask"
+            }
+          ]
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/artifacts/whl_dynamic/out.plan_create.terraform.json b/acceptance/bundle/artifacts/whl_dynamic/out.plan_create.terraform.json
deleted file mode 100644
index d6e3fd5999c..00000000000
--- a/acceptance/bundle/artifacts/whl_dynamic/out.plan_create.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.test_job": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/artifacts/whl_dynamic/out.plan_update.direct.json b/acceptance/bundle/artifacts/whl_dynamic/out.plan_update.direct.json
deleted file mode 100644
index 10fa9af94c2..00000000000
--- a/acceptance/bundle/artifacts/whl_dynamic/out.plan_update.direct.json
+++ /dev/null
@@ -1,223 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.jobs.test_job": {
-      "action": "update",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "edit_mode": "UI_LOCKED",
-          "environments": [
-            {
-              "environment_key": "test_env",
-              "spec": {
-                "client": "1",
-                "dependencies": [
-                  "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl"
-                ]
-              }
-            }
-          ],
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "[default] My Wheel Job",
-          "queue": {
-            "enabled": true
-          },
-          "tasks": [
-            {
-              "environment_key": "test_env",
-              "python_wheel_task": {
-                "entry_point": "run",
-                "package_name": "my_test_code"
-              },
-              "task_key": "ServerlessTestTask"
-            },
-            {
-              "existing_cluster_id": "0717-132531-5opeqon1",
-              "for_each_task": {
-                "inputs": "[1]",
-                "task": {
-                  "existing_cluster_id": "0717-132531-5opeqon1",
-                  "libraries": [
-                    {
-                      "whl": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl"
-                    }
-                  ],
-                  "python_wheel_task": {
-                    "entry_point": "run",
-                    "package_name": "my_test_code"
-                  },
-                  "task_key": "SubTask"
-                }
-              },
-              "libraries": [
-                {
-                  "whl": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl"
-                },
-                {
-                  "whl": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/other_test_code-0.0.1+[UNIX_TIME_NANOS][1]-py3-none-any.whl"
-                }
-              ],
-              "python_wheel_task": {
-                "entry_point": "run",
-                "package_name": "my_test_code"
-              },
-              "task_key": "TestTask"
-            }
-          ]
-        }
-      },
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-        },
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "environments": [
-          {
-            "environment_key": "test_env",
-            "spec": {
-              "client": "1",
-              "dependencies": [
-                "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][2]-py3-none-any.whl"
-              ]
-            }
-          }
-        ],
-        "format": "MULTI_TASK",
-        "job_id": [NUMID],
-        "max_concurrent_runs": 1,
-        "name": "[default] My Wheel Job",
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "tasks": [
-          {
-            "email_notifications": {},
-            "environment_key": "test_env",
-            "python_wheel_task": {
-              "entry_point": "run",
-              "package_name": "my_test_code"
-            },
-            "run_if": "ALL_SUCCESS",
-            "task_key": "ServerlessTestTask",
-            "timeout_seconds": 0
-          },
-          {
-            "email_notifications": {},
-            "existing_cluster_id": "0717-132531-5opeqon1",
-            "for_each_task": {
-              "inputs": "[1]",
-              "task": {
-                "existing_cluster_id": "0717-132531-5opeqon1",
-                "libraries": [
-                  {
-                    "whl": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][2]-py3-none-any.whl"
-                  }
-                ],
-                "python_wheel_task": {
-                  "entry_point": "run",
-                  "package_name": "my_test_code"
-                },
-                "task_key": "SubTask"
-              }
-            },
-            "libraries": [
-              {
-                "whl": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][2]-py3-none-any.whl"
-              },
-              {
-                "whl": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/other_test_code-0.0.1+[UNIX_TIME_NANOS][1]-py3-none-any.whl"
-              }
-            ],
-            "python_wheel_task": {
-              "entry_point": "run",
-              "package_name": "my_test_code"
-            },
-            "run_if": "ALL_SUCCESS",
-            "task_key": "TestTask",
-            "timeout_seconds": 0
-          }
-        ],
-        "timeout_seconds": 0,
-        "webhook_notifications": {}
-      },
-      "changes": {
-        "email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "environments[environment_key='test_env'].spec.dependencies[0]": {
-          "action": "update",
-          "old": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][2]-py3-none-any.whl",
-          "new": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl",
-          "remote": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][2]-py3-none-any.whl"
-        },
-        "tasks[task_key='ServerlessTestTask'].email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks[task_key='ServerlessTestTask'].run_if": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "ALL_SUCCESS"
-        },
-        "tasks[task_key='ServerlessTestTask'].timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "tasks[task_key='TestTask'].email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks[task_key='TestTask'].for_each_task.task.libraries[0].whl": {
-          "action": "update",
-          "old": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][2]-py3-none-any.whl",
-          "new": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl",
-          "remote": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][2]-py3-none-any.whl"
-        },
-        "tasks[task_key='TestTask'].libraries[0].whl": {
-          "action": "update",
-          "old": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][2]-py3-none-any.whl",
-          "new": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl",
-          "remote": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][2]-py3-none-any.whl"
-        },
-        "tasks[task_key='TestTask'].run_if": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "ALL_SUCCESS"
-        },
-        "tasks[task_key='TestTask'].timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "webhook_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/artifacts/whl_dynamic/out.plan_update.json b/acceptance/bundle/artifacts/whl_dynamic/out.plan_update.json
new file mode 100644
index 00000000000..9b81021ae27
--- /dev/null
+++ b/acceptance/bundle/artifacts/whl_dynamic/out.plan_update.json
@@ -0,0 +1,223 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.jobs.test_job": {
+      "action": "update",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "environments": [
+            {
+              "environment_key": "test_env",
+              "spec": {
+                "client": "1",
+                "dependencies": [
+                  "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl"
+                ]
+              }
+            }
+          ],
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "[default] My Wheel Job",
+          "queue": {
+            "enabled": true
+          },
+          "tasks": [
+            {
+              "environment_key": "test_env",
+              "python_wheel_task": {
+                "entry_point": "run",
+                "package_name": "my_test_code"
+              },
+              "task_key": "ServerlessTestTask"
+            },
+            {
+              "existing_cluster_id": "0717-132531-5opeqon1",
+              "for_each_task": {
+                "inputs": "[1]",
+                "task": {
+                  "existing_cluster_id": "0717-132531-5opeqon1",
+                  "libraries": [
+                    {
+                      "whl": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl"
+                    }
+                  ],
+                  "python_wheel_task": {
+                    "entry_point": "run",
+                    "package_name": "my_test_code"
+                  },
+                  "task_key": "SubTask"
+                }
+              },
+              "libraries": [
+                {
+                  "whl": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl"
+                },
+                {
+                  "whl": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/other_test_code-0.0.1+[UNIX_TIME_NANOS][1]-py3-none-any.whl"
+                }
+              ],
+              "python_wheel_task": {
+                "entry_point": "run",
+                "package_name": "my_test_code"
+              },
+              "task_key": "TestTask"
+            }
+          ]
+        }
+      },
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "environments": [
+          {
+            "environment_key": "test_env",
+            "spec": {
+              "client": "1",
+              "dependencies": [
+                "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][2]-py3-none-any.whl"
+              ]
+            }
+          }
+        ],
+        "format": "MULTI_TASK",
+        "job_id": [TEST_JOB_ID],
+        "max_concurrent_runs": 1,
+        "name": "[default] My Wheel Job",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "tasks": [
+          {
+            "email_notifications": {},
+            "environment_key": "test_env",
+            "python_wheel_task": {
+              "entry_point": "run",
+              "package_name": "my_test_code"
+            },
+            "run_if": "ALL_SUCCESS",
+            "task_key": "ServerlessTestTask",
+            "timeout_seconds": 0
+          },
+          {
+            "email_notifications": {},
+            "existing_cluster_id": "0717-132531-5opeqon1",
+            "for_each_task": {
+              "inputs": "[1]",
+              "task": {
+                "existing_cluster_id": "0717-132531-5opeqon1",
+                "libraries": [
+                  {
+                    "whl": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][2]-py3-none-any.whl"
+                  }
+                ],
+                "python_wheel_task": {
+                  "entry_point": "run",
+                  "package_name": "my_test_code"
+                },
+                "task_key": "SubTask"
+              }
+            },
+            "libraries": [
+              {
+                "whl": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][2]-py3-none-any.whl"
+              },
+              {
+                "whl": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/other_test_code-0.0.1+[UNIX_TIME_NANOS][1]-py3-none-any.whl"
+              }
+            ],
+            "python_wheel_task": {
+              "entry_point": "run",
+              "package_name": "my_test_code"
+            },
+            "run_if": "ALL_SUCCESS",
+            "task_key": "TestTask",
+            "timeout_seconds": 0
+          }
+        ],
+        "timeout_seconds": 0,
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "environments[environment_key='test_env'].spec.dependencies[0]": {
+          "action": "update",
+          "old": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][2]-py3-none-any.whl",
+          "new": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl",
+          "remote": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][2]-py3-none-any.whl"
+        },
+        "tasks[task_key='ServerlessTestTask'].email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='ServerlessTestTask'].run_if": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": "ALL_SUCCESS"
+        },
+        "tasks[task_key='ServerlessTestTask'].timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "tasks[task_key='TestTask'].email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='TestTask'].for_each_task.task.libraries[0].whl": {
+          "action": "update",
+          "old": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][2]-py3-none-any.whl",
+          "new": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl",
+          "remote": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][2]-py3-none-any.whl"
+        },
+        "tasks[task_key='TestTask'].libraries[0].whl": {
+          "action": "update",
+          "old": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][2]-py3-none-any.whl",
+          "new": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl",
+          "remote": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][2]-py3-none-any.whl"
+        },
+        "tasks[task_key='TestTask'].run_if": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": "ALL_SUCCESS"
+        },
+        "tasks[task_key='TestTask'].timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/artifacts/whl_dynamic/out.plan_update.terraform.json b/acceptance/bundle/artifacts/whl_dynamic/out.plan_update.terraform.json
deleted file mode 100644
index 26c35b76dcb..00000000000
--- a/acceptance/bundle/artifacts/whl_dynamic/out.plan_update.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.test_job": {
-      "action": "update"
-    }
-  }
-}
diff --git a/acceptance/bundle/artifacts/whl_dynamic/out.test.toml b/acceptance/bundle/artifacts/whl_dynamic/out.test.toml
index f784a183258..f7fafbcc731 100644
--- a/acceptance/bundle/artifacts/whl_dynamic/out.test.toml
+++ b/acceptance/bundle/artifacts/whl_dynamic/out.test.toml
@@ -1,3 +1,3 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/artifacts/whl_dynamic/output.txt b/acceptance/bundle/artifacts/whl_dynamic/output.txt
index c7409f37408..3461014160d 100644
--- a/acceptance/bundle/artifacts/whl_dynamic/output.txt
+++ b/acceptance/bundle/artifacts/whl_dynamic/output.txt
@@ -23,16 +23,6 @@
     "type": "whl"
   }
 }
-Building my_test_code...
-
->>> [CLI] bundle deploy
-Building my_test_code...
-Uploading .databricks/bundle/default/patched_wheels/my_prebuilt_whl_other_test_code/other_test_code-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl...
-Uploading .databricks/bundle/default/patched_wheels/my_test_code_my_test_code/my_test_code-0.0.1+[UNIX_TIME_NANOS][1]-py3-none-any.whl...
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
 
 === There are 2 original wheels and 2 patched ones
 >>> find.py --expect 4 whl
@@ -52,29 +42,19 @@ my_test_code-0.0.1+[UNIX_TIME_NANOS][1].dist-info/top_level.txt
 my_test_code-0.0.1+[UNIX_TIME_NANOS][1].dist-info/RECORD
 
 === Expecting 2 patched wheels in libraries section in /jobs/create
->>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.tasks out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.tasks [OUTPUT_DIR]/out.requests.txt
 json[1].for_each_task.task.libraries[0].whl = "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][1]-py3-none-any.whl";
 json[1].libraries[0].whl = "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][1]-py3-none-any.whl";
 json[1].libraries[1].whl = "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/other_test_code-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl";
 
 === Expecting 2 patched wheels to be uploaded
->>> jq .path
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][1]-py3-none-any.whl"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/other_test_code-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/my_test_code/dist/my_test_code-0.0.1-py3-none-any.whl"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/prebuilt/other_test_code-0.0.1-py3-none-any.whl"
+>>> print_workspace_imports
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][1]-py3-none-any.whl
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/other_test_code-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/my_test_code/dist/my_test_code-0.0.1-py3-none-any.whl
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/prebuilt/other_test_code-0.0.1-py3-none-any.whl
 
 === Updating the local wheel and deploying again
-Building my_test_code...
-
->>> [CLI] bundle deploy
-Building my_test_code...
-Uploading .databricks/bundle/default/patched_wheels/my_prebuilt_whl_other_test_code/other_test_code-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl...
-Uploading .databricks/bundle/default/patched_wheels/my_test_code_my_test_code/my_test_code-0.0.1+[UNIX_TIME_NANOS][2]-py3-none-any.whl...
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
 
 === Verify contents, it should now have new_module.py
 >>> find.py --expect 1 .databricks/.*my_test_code.*whl
@@ -88,13 +68,13 @@ my_test_code-0.0.1+[UNIX_TIME_NANOS][2].dist-info/top_level.txt
 my_test_code-0.0.1+[UNIX_TIME_NANOS][2].dist-info/RECORD
 
 === Expecting 2 patched wheels in libraries section in /jobs/reset
->>> jq -s .[] | select(.path=="/api/2.2/jobs/reset") | .body.new_settings.tasks out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.2/jobs/reset") | .body.new_settings.tasks [OUTPUT_DIR]/out.requests.txt
 json[1].for_each_task.task.libraries[0].whl = "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][2]-py3-none-any.whl";
 json[1].libraries[0].whl = "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][2]-py3-none-any.whl";
 json[1].libraries[1].whl = "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/other_test_code-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl";
 
 === Expecting 2 pached wheels to be uploaded (Bad: it is currently uploaded twice)
->>> jq .path
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][2]-py3-none-any.whl"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/other_test_code-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/my_test_code/dist/my_test_code-0.0.1-py3-none-any.whl"
+>>> print_workspace_imports
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][2]-py3-none-any.whl
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/other_test_code-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/my_test_code/dist/my_test_code-0.0.1-py3-none-any.whl
diff --git a/acceptance/bundle/artifacts/whl_dynamic/script b/acceptance/bundle/artifacts/whl_dynamic/script
index 068db16caf8..d031d02715c 100644
--- a/acceptance/bundle/artifacts/whl_dynamic/script
+++ b/acceptance/bundle/artifacts/whl_dynamic/script
@@ -1,13 +1,16 @@
-trap "rm -fr out.requests.txt databricks.yml my_test_code prebuilt" EXIT
+trap "rm -fr "$OUT_REQUESTS" databricks.yml my_test_code prebuilt" EXIT
 
 cp -r $TESTDIR/../whl_explicit/my_test_code .
 mkdir prebuilt
 cp -r $TESTDIR/../whl_prebuilt_multiple/dist/lib/other_test_code-0.0.1-py3-none-any.whl prebuilt
 
-trace $CLI bundle validate -o json | jq .artifacts
+trace $CLI bundle validate -o json | nostamp | jq .artifacts
 
-$CLI bundle plan -o json > out.plan_create.$DATABRICKS_BUNDLE_ENGINE.json
-trace $CLI bundle deploy
+$CLI bundle plan -o json > tmp.plan.json 2>>LOG.plan
+nostamp < tmp.plan.json > out.plan_create.json
+$CLI bundle deploy $(readplanarg tmp.plan.json) &> LOG.deploy
+replace_ids.py
+cat LOG.deploy | contains.py "patched_wheels/my_test_code_my_test_code/my_test_code-0.0.1+" "patched_wheels/my_prebuilt_whl_other_test_code/other_test_code-0.0.1+" > /dev/null
 
 title "There are 2 original wheels and 2 patched ones"
 trace find.py --expect 4 whl
@@ -16,23 +19,25 @@ title "Verify contents of the zip file"
 trace find.py --expect 1 '.databricks/.*my_test_code.*whl' | xargs ziplist.py
 
 title "Expecting 2 patched wheels in libraries section in /jobs/create"
-trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.tasks' out.requests.txt | gron.py | grep -w libraries
+trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.tasks' "$OUT_REQUESTS" | gron.py | grep -w libraries
 
 title "Expecting 2 patched wheels to be uploaded"
-trace jq .path < out.requests.txt | grep import | grep whl | sort
+trace print_workspace_imports | grep whl | sort
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
 
 title "Updating the local wheel and deploying again\n"
 touch my_test_code/src/new_module.py
-$CLI bundle plan -o json > out.plan_update.$DATABRICKS_BUNDLE_ENGINE.json
-trace $CLI bundle deploy
+$CLI bundle plan -o json > tmp.plan.json 2>>LOG.plan
+nostamp < tmp.plan.json > out.plan_update.json
+$CLI bundle deploy $(readplanarg tmp.plan.json) &> LOG.redeploy
+cat LOG.redeploy | contains.py "patched_wheels/my_test_code_my_test_code/my_test_code-0.0.1+" "patched_wheels/my_prebuilt_whl_other_test_code/other_test_code-0.0.1+" > /dev/null
 
 title "Verify contents, it should now have new_module.py"
 trace find.py --expect 1 '.databricks/.*my_test_code.*whl' | xargs ziplist.py
 
 title "Expecting 2 patched wheels in libraries section in /jobs/reset"
-trace jq -s '.[] | select(.path=="/api/2.2/jobs/reset") | .body.new_settings.tasks' out.requests.txt | gron.py | grep -w libraries
+trace jq -s '.[] | select(.path=="/api/2.2/jobs/reset") | .body.new_settings.tasks' "$OUT_REQUESTS" | gron.py | grep -w libraries
 
 title "Expecting 2 pached wheels to be uploaded (Bad: it is currently uploaded twice)"
-trace jq .path < out.requests.txt | grep import | grep whl | sort
+trace print_workspace_imports | grep whl | sort
diff --git a/acceptance/bundle/artifacts/whl_dynamic/test.toml b/acceptance/bundle/artifacts/whl_dynamic/test.toml
index 571512c6ab6..61d4e5e0845 100644
--- a/acceptance/bundle/artifacts/whl_dynamic/test.toml
+++ b/acceptance/bundle/artifacts/whl_dynamic/test.toml
@@ -1,3 +1,5 @@
+EnvMatrix.READPLAN = ["", "1"]
+
 [[Repls]]
 Old = '\\\\'
 New = '/'
diff --git a/acceptance/bundle/artifacts/whl_explicit/out.test.toml b/acceptance/bundle/artifacts/whl_explicit/out.test.toml
index f784a183258..f7fafbcc731 100644
--- a/acceptance/bundle/artifacts/whl_explicit/out.test.toml
+++ b/acceptance/bundle/artifacts/whl_explicit/out.test.toml
@@ -1,3 +1,3 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/artifacts/whl_explicit/output.txt b/acceptance/bundle/artifacts/whl_explicit/output.txt
index 6c1c06c46e0..14358c0ab32 100644
--- a/acceptance/bundle/artifacts/whl_explicit/output.txt
+++ b/acceptance/bundle/artifacts/whl_explicit/output.txt
@@ -1,17 +1,9 @@
 
->>> [CLI] bundle deploy
-Building my_test_code...
-Uploading my_test_code/dist/my_test_code-0.0.1-py3-none-any.whl...
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
 >>> find.py --expect 1 whl
 my_test_code/dist/my_test_code-0.0.1-py3-none-any.whl
 
 === Expecting 1 wheel in libraries section in /jobs/create
->>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.tasks out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.tasks [OUTPUT_DIR]/out.requests.txt
 [
   {
     "existing_cluster_id": "0717-132531-5opeqon1",
@@ -29,12 +21,12 @@ my_test_code/dist/my_test_code-0.0.1-py3-none-any.whl
 ]
 
 === Expecting 1 wheel to be uploaded
->>> jq .path
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1-py3-none-any.whl"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/my_test_code/dist/my_test_code-0.0.1-py3-none-any.whl"
+>>> print_workspace_imports
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1-py3-none-any.whl
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/my_test_code/dist/my_test_code-0.0.1-py3-none-any.whl
 
 === Expecting delete request to artifact_path/.internal folder
->>> jq -s .[] | select(.path=="/api/2.0/workspace/delete") | select(.body.path | test(".*/artifacts/.internal")) out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.0/workspace/delete") | select(.body.path | test(".*/artifacts/.internal")) [OUTPUT_DIR]/out.requests.txt
 {
   "method": "POST",
   "path": "/api/2.0/workspace/delete",
@@ -45,7 +37,7 @@ my_test_code/dist/my_test_code-0.0.1-py3-none-any.whl
 }
 
 === Expecting mkdirs request to artifact_path/.internal folder
->>> jq -s .[] | select(.path=="/api/2.0/workspace/mkdirs") | select(.body.path | test(".*/artifacts/.internal")) out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.0/workspace/mkdirs") | select(.body.path | test(".*/artifacts/.internal")) [OUTPUT_DIR]/out.requests.txt
 {
   "method": "POST",
   "path": "/api/2.0/workspace/mkdirs",
diff --git a/acceptance/bundle/artifacts/whl_explicit/script b/acceptance/bundle/artifacts/whl_explicit/script
index 4988edd8155..a1227cd125d 100644
--- a/acceptance/bundle/artifacts/whl_explicit/script
+++ b/acceptance/bundle/artifacts/whl_explicit/script
@@ -1,18 +1,20 @@
-trace $CLI bundle deploy
+$CLI bundle plan -o json > tmp.plan.json 2>>LOG.plan
+$CLI bundle deploy $(readplanarg tmp.plan.json) &> LOG.deploy
+cat LOG.deploy | contains.py "my_test_code-0.0.1-py3-none-any.whl" > /dev/null
 
 trace find.py --expect 1 whl
 
 title "Expecting 1 wheel in libraries section in /jobs/create"
-trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.tasks' out.requests.txt
+trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.tasks' "$OUT_REQUESTS"
 
 title "Expecting 1 wheel to be uploaded"
-trace jq .path < out.requests.txt | grep import | grep whl | sort
+trace print_workspace_imports | grep whl | sort
 
 title "Expecting delete request to artifact_path/.internal folder"
-trace jq -s '.[] | select(.path=="/api/2.0/workspace/delete") | select(.body.path | test(".*/artifacts/.internal"))' out.requests.txt
+trace jq -s '.[] | select(.path=="/api/2.0/workspace/delete") | select(.body.path | test(".*/artifacts/.internal"))' "$OUT_REQUESTS"
 
 title "Expecting mkdirs request to artifact_path/.internal folder"
-trace jq -s '.[] | select(.path=="/api/2.0/workspace/mkdirs") | select(.body.path | test(".*/artifacts/.internal"))' out.requests.txt
+trace jq -s '.[] | select(.path=="/api/2.0/workspace/mkdirs") | select(.body.path | test(".*/artifacts/.internal"))' "$OUT_REQUESTS"
 
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/artifacts/whl_explicit/test.toml b/acceptance/bundle/artifacts/whl_explicit/test.toml
new file mode 100644
index 00000000000..ff8a66c196e
--- /dev/null
+++ b/acceptance/bundle/artifacts/whl_explicit/test.toml
@@ -0,0 +1 @@
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/artifacts/whl_implicit/out.test.toml b/acceptance/bundle/artifacts/whl_implicit/out.test.toml
index f784a183258..f7fafbcc731 100644
--- a/acceptance/bundle/artifacts/whl_implicit/out.test.toml
+++ b/acceptance/bundle/artifacts/whl_implicit/out.test.toml
@@ -1,3 +1,3 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/artifacts/whl_implicit/output.txt b/acceptance/bundle/artifacts/whl_implicit/output.txt
index 698cc20c514..c610058f32f 100644
--- a/acceptance/bundle/artifacts/whl_implicit/output.txt
+++ b/acceptance/bundle/artifacts/whl_implicit/output.txt
@@ -1,17 +1,9 @@
 
->>> [CLI] bundle deploy
-Building python_artifact...
-Uploading dist/my_test_code-0.0.1-py3-none-any.whl...
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
 >>> find.py --expect 1 whl
 dist/my_test_code-0.0.1-py3-none-any.whl
 
 === Expecting 1 wheels in libraries section in /jobs/create
->>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.tasks out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.tasks [OUTPUT_DIR]/out.requests.txt
 [
   {
     "existing_cluster_id": "0717-aaaaa-bbbbbb",
@@ -29,6 +21,6 @@ dist/my_test_code-0.0.1-py3-none-any.whl
 ]
 
 === Expecting 1 wheels to be uploaded
->>> jq .path
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1-py3-none-any.whl"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/dist/my_test_code-0.0.1-py3-none-any.whl"
+>>> print_workspace_imports
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1-py3-none-any.whl
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/dist/my_test_code-0.0.1-py3-none-any.whl
diff --git a/acceptance/bundle/artifacts/whl_implicit/script b/acceptance/bundle/artifacts/whl_implicit/script
index da61fb91f83..8124726f4ff 100644
--- a/acceptance/bundle/artifacts/whl_implicit/script
+++ b/acceptance/bundle/artifacts/whl_implicit/script
@@ -1,11 +1,13 @@
-trace $CLI bundle deploy
+$CLI bundle plan -o json > tmp.plan.json 2>>LOG.plan
+$CLI bundle deploy $(readplanarg tmp.plan.json) &> LOG.deploy
+cat LOG.deploy | contains.py "my_test_code-0.0.1-py3-none-any.whl" > /dev/null
 
 trace find.py --expect 1 whl
 
 title "Expecting 1 wheels in libraries section in /jobs/create"
-trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.tasks' out.requests.txt
+trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.tasks' "$OUT_REQUESTS"
 
 title "Expecting 1 wheels to be uploaded"
-trace jq .path < out.requests.txt | grep import | grep whl | sort
+trace print_workspace_imports | grep whl | sort
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/artifacts/whl_implicit/test.toml b/acceptance/bundle/artifacts/whl_implicit/test.toml
new file mode 100644
index 00000000000..ff8a66c196e
--- /dev/null
+++ b/acceptance/bundle/artifacts/whl_implicit/test.toml
@@ -0,0 +1 @@
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/artifacts/whl_implicit_custom_path/out.test.toml b/acceptance/bundle/artifacts/whl_implicit_custom_path/out.test.toml
index f784a183258..f7fafbcc731 100644
--- a/acceptance/bundle/artifacts/whl_implicit_custom_path/out.test.toml
+++ b/acceptance/bundle/artifacts/whl_implicit_custom_path/out.test.toml
@@ -1,3 +1,3 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/artifacts/whl_implicit_custom_path/output.txt b/acceptance/bundle/artifacts/whl_implicit_custom_path/output.txt
index 71f1bffc1df..1a93fb8c9bd 100644
--- a/acceptance/bundle/artifacts/whl_implicit_custom_path/output.txt
+++ b/acceptance/bundle/artifacts/whl_implicit_custom_path/output.txt
@@ -1,16 +1,14 @@
-
->>> [CLI] bundle deploy
 Uploading package/my_test_code-0.0.1-py3-none-any.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.test_job
+Files: 5 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> find.py --expect 1 whl
 package/my_test_code-0.0.1-py3-none-any.whl
 
 === Expecting 1 wheel in libraries section in /jobs/create
->>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body [OUTPUT_DIR]/out.requests.txt
 {
   "deployment": {
     "kind": "BUNDLE",
@@ -41,6 +39,6 @@ package/my_test_code-0.0.1-py3-none-any.whl
 }
 
 === Expecting 1 wheel to be uploaded
->>> jq .path
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/package/my_test_code-0.0.1-py3-none-any.whl"
-"/api/2.0/workspace-files/import-file/Workspace/foo/bar/.internal/my_test_code-0.0.1-py3-none-any.whl"
+>>> print_workspace_imports
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/package/my_test_code-0.0.1-py3-none-any.whl
+/Workspace/foo/bar/.internal/my_test_code-0.0.1-py3-none-any.whl
diff --git a/acceptance/bundle/artifacts/whl_implicit_custom_path/script b/acceptance/bundle/artifacts/whl_implicit_custom_path/script
index fdc0723f594..4d5fd31d6e7 100644
--- a/acceptance/bundle/artifacts/whl_implicit_custom_path/script
+++ b/acceptance/bundle/artifacts/whl_implicit_custom_path/script
@@ -1,11 +1,12 @@
-trace $CLI bundle deploy
+$CLI bundle plan -o json > tmp.plan.json 2>>LOG.plan
+$CLI bundle deploy $(readplanarg tmp.plan.json)
 
 trace find.py --expect 1 whl
 
 title "Expecting 1 wheel in libraries section in /jobs/create"
-trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body' out.requests.txt
+trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body' "$OUT_REQUESTS" | nostamp
 
 title "Expecting 1 wheel to be uploaded"
-trace jq .path < out.requests.txt | grep import | grep whl | sort
+trace print_workspace_imports | grep whl | sort
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/artifacts/whl_implicit_custom_path/test.toml b/acceptance/bundle/artifacts/whl_implicit_custom_path/test.toml
new file mode 100644
index 00000000000..ff8a66c196e
--- /dev/null
+++ b/acceptance/bundle/artifacts/whl_implicit_custom_path/test.toml
@@ -0,0 +1 @@
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/artifacts/whl_implicit_notebook/out.test.toml b/acceptance/bundle/artifacts/whl_implicit_notebook/out.test.toml
index f784a183258..f7fafbcc731 100644
--- a/acceptance/bundle/artifacts/whl_implicit_notebook/out.test.toml
+++ b/acceptance/bundle/artifacts/whl_implicit_notebook/out.test.toml
@@ -1,3 +1,3 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/artifacts/whl_implicit_notebook/output.txt b/acceptance/bundle/artifacts/whl_implicit_notebook/output.txt
index 7e393eabc47..6a49d1e1889 100644
--- a/acceptance/bundle/artifacts/whl_implicit_notebook/output.txt
+++ b/acceptance/bundle/artifacts/whl_implicit_notebook/output.txt
@@ -1,17 +1,9 @@
 
->>> [CLI] bundle deploy
-Building python_artifact...
-Uploading dist/my_test_code-0.0.1-py3-none-any.whl...
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
 >>> find.py --expect 1 whl
 dist/my_test_code-0.0.1-py3-none-any.whl
 
 === Expecting 1 wheel in libraries section in /jobs/create
->>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.tasks[0].libraries out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.tasks[0].libraries [OUTPUT_DIR]/out.requests.txt
 [
   {
     "whl": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1-py3-none-any.whl"
@@ -19,6 +11,6 @@ dist/my_test_code-0.0.1-py3-none-any.whl
 ]
 
 === Expecting 1 wheel to be uploaded
->>> jq .path
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1-py3-none-any.whl"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/dist/my_test_code-0.0.1-py3-none-any.whl"
+>>> print_workspace_imports
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1-py3-none-any.whl
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/dist/my_test_code-0.0.1-py3-none-any.whl
diff --git a/acceptance/bundle/artifacts/whl_implicit_notebook/script b/acceptance/bundle/artifacts/whl_implicit_notebook/script
index 30196556f1e..41bae0e4237 100644
--- a/acceptance/bundle/artifacts/whl_implicit_notebook/script
+++ b/acceptance/bundle/artifacts/whl_implicit_notebook/script
@@ -1,11 +1,13 @@
-trace $CLI bundle deploy
+$CLI bundle plan -o json > tmp.plan.json 2>>LOG.plan
+$CLI bundle deploy $(readplanarg tmp.plan.json) &> LOG.deploy
+cat LOG.deploy | contains.py "my_test_code-0.0.1-py3-none-any.whl" > /dev/null
 
 trace find.py --expect 1 whl
 
 title "Expecting 1 wheel in libraries section in /jobs/create"
-trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.tasks[0].libraries' out.requests.txt
+trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.tasks[0].libraries' "$OUT_REQUESTS"
 
 title "Expecting 1 wheel to be uploaded"
-trace jq .path < out.requests.txt | grep import | grep whl | sort
+trace print_workspace_imports | grep whl | sort
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/artifacts/whl_implicit_notebook/test.toml b/acceptance/bundle/artifacts/whl_implicit_notebook/test.toml
new file mode 100644
index 00000000000..ff8a66c196e
--- /dev/null
+++ b/acceptance/bundle/artifacts/whl_implicit_notebook/test.toml
@@ -0,0 +1 @@
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/artifacts/whl_multiple/out.test.toml b/acceptance/bundle/artifacts/whl_multiple/out.test.toml
index f784a183258..f7fafbcc731 100644
--- a/acceptance/bundle/artifacts/whl_multiple/out.test.toml
+++ b/acceptance/bundle/artifacts/whl_multiple/out.test.toml
@@ -1,3 +1,3 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/artifacts/whl_multiple/output.txt b/acceptance/bundle/artifacts/whl_multiple/output.txt
index a03025d9103..96edc8e5c85 100644
--- a/acceptance/bundle/artifacts/whl_multiple/output.txt
+++ b/acceptance/bundle/artifacts/whl_multiple/output.txt
@@ -1,20 +1,10 @@
 
->>> [CLI] bundle deploy
-Building my_test_code...
-Building my_test_code_2...
-Uploading my_test_code/dist/my_test_code-0.0.1-py3-none-any.whl...
-Uploading my_test_code/dist/my_test_code_2-0.0.1-py3-none-any.whl...
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
 >>> find.py --expect 2 whl
 my_test_code/dist/my_test_code-0.0.1-py3-none-any.whl
 my_test_code/dist/my_test_code_2-0.0.1-py3-none-any.whl
 
 === Expecting 2 wheels in libraries section in /jobs/create
->>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.tasks out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.tasks [OUTPUT_DIR]/out.requests.txt
 [
   {
     "existing_cluster_id": "0717-132531-5opeqon1",
@@ -35,8 +25,8 @@ my_test_code/dist/my_test_code_2-0.0.1-py3-none-any.whl
 ]
 
 === Expecting 2 wheels to be uploaded
->>> jq .path
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1-py3-none-any.whl"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code_2-0.0.1-py3-none-any.whl"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/my_test_code/dist/my_test_code-0.0.1-py3-none-any.whl"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/my_test_code/dist/my_test_code_2-0.0.1-py3-none-any.whl"
+>>> print_workspace_imports
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1-py3-none-any.whl
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code_2-0.0.1-py3-none-any.whl
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/my_test_code/dist/my_test_code-0.0.1-py3-none-any.whl
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/my_test_code/dist/my_test_code_2-0.0.1-py3-none-any.whl
diff --git a/acceptance/bundle/artifacts/whl_multiple/script b/acceptance/bundle/artifacts/whl_multiple/script
index 380c6c60f8a..8c06cd32454 100644
--- a/acceptance/bundle/artifacts/whl_multiple/script
+++ b/acceptance/bundle/artifacts/whl_multiple/script
@@ -1,11 +1,13 @@
-trace $CLI bundle deploy 2>&1
+$CLI bundle plan -o json > tmp.plan.json 2>>LOG.plan
+$CLI bundle deploy $(readplanarg tmp.plan.json) &> LOG.deploy
+cat LOG.deploy | contains.py "my_test_code-0.0.1-py3-none-any.whl" "my_test_code_2-0.0.1-py3-none-any.whl" > /dev/null
 
 trace find.py --expect 2 whl
 
 title "Expecting 2 wheels in libraries section in /jobs/create"
-trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.tasks' out.requests.txt
+trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.tasks' "$OUT_REQUESTS"
 
 title "Expecting 2 wheels to be uploaded"
-trace jq .path < out.requests.txt | grep import | grep whl | sort
+trace print_workspace_imports | grep whl | sort
 
-rm -fr out.requests.txt
+rm -fr "$OUT_REQUESTS"
diff --git a/acceptance/bundle/artifacts/whl_multiple/test.toml b/acceptance/bundle/artifacts/whl_multiple/test.toml
new file mode 100644
index 00000000000..ff8a66c196e
--- /dev/null
+++ b/acceptance/bundle/artifacts/whl_multiple/test.toml
@@ -0,0 +1 @@
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/artifacts/whl_no_cleanup/out.test.toml b/acceptance/bundle/artifacts/whl_no_cleanup/out.test.toml
index f784a183258..f7fafbcc731 100644
--- a/acceptance/bundle/artifacts/whl_no_cleanup/out.test.toml
+++ b/acceptance/bundle/artifacts/whl_no_cleanup/out.test.toml
@@ -1,3 +1,3 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/artifacts/whl_no_cleanup/output.txt b/acceptance/bundle/artifacts/whl_no_cleanup/output.txt
index a78810dbca9..b80a0145ad1 100644
--- a/acceptance/bundle/artifacts/whl_no_cleanup/output.txt
+++ b/acceptance/bundle/artifacts/whl_no_cleanup/output.txt
@@ -1,33 +1,17 @@
 
->>> [CLI] bundle deploy
-Building python_artifact...
-Uploading dist/my_test_code-0.0.1-py3-none-any.whl...
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
 >>> find.py --expect 1 whl
 dist/my_test_code-0.0.1-py3-none-any.whl
 
 === Expecting 1 wheels to be uploaded
->>> jq .path
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1-py3-none-any.whl"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/dist/my_test_code-0.0.1-py3-none-any.whl"
-
->>> [CLI] bundle deploy
-Building python_artifact...
-Uploading dist/my_test_code-0.0.1-py3-none-any.whl...
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+>>> print_workspace_imports
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1-py3-none-any.whl
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/dist/my_test_code-0.0.1-py3-none-any.whl
 
 === No calls to delete internal folder expected
->>> jq -s .[] | select(.path=="/api/2.0/workspace/delete") | select(.body.path | test(".*/artifacts/.internal")) out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.0/workspace/delete") | select(.body.path | test(".*/artifacts/.internal")) [OUTPUT_DIR]/out.requests.txt
 
 === Expected 2 calls to create artifacts folder (because 2 deploys were done)
->>> jq -s .[] | select(.path=="/api/2.0/workspace/mkdirs") | select(.body.path | test(".*/artifacts/.internal")) out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.0/workspace/mkdirs") | select(.body.path | test(".*/artifacts/.internal")) [OUTPUT_DIR]/out.requests.txt
 {
   "method": "POST",
   "path": "/api/2.0/workspace/mkdirs",
diff --git a/acceptance/bundle/artifacts/whl_no_cleanup/script b/acceptance/bundle/artifacts/whl_no_cleanup/script
index 4536f929468..6a4a10bc75e 100644
--- a/acceptance/bundle/artifacts/whl_no_cleanup/script
+++ b/acceptance/bundle/artifacts/whl_no_cleanup/script
@@ -1,15 +1,19 @@
-trace $CLI bundle deploy
+$CLI bundle plan -o json > tmp.plan.json 2>>LOG.plan
+$CLI bundle deploy $(readplanarg tmp.plan.json) &> LOG.deploy
+cat LOG.deploy | contains.py "my_test_code-0.0.1-py3-none-any.whl" > /dev/null
 
 trace find.py --expect 1 whl
 
 title "Expecting 1 wheels to be uploaded"
-trace jq .path < out.requests.txt | grep import | grep whl | sort
+trace print_workspace_imports | grep whl | sort
 
-trace $CLI bundle deploy
+$CLI bundle plan -o json > tmp.plan.json 2>>LOG.plan
+$CLI bundle deploy $(readplanarg tmp.plan.json) &> LOG.redeploy
+cat LOG.redeploy | contains.py "my_test_code-0.0.1-py3-none-any.whl" > /dev/null
 title "No calls to delete internal folder expected"
-trace jq -s '.[] | select(.path=="/api/2.0/workspace/delete") | select(.body.path | test(".*/artifacts/.internal"))' out.requests.txt
+trace jq -s '.[] | select(.path=="/api/2.0/workspace/delete") | select(.body.path | test(".*/artifacts/.internal"))' "$OUT_REQUESTS"
 
 title "Expected 2 calls to create artifacts folder (because 2 deploys were done)"
-trace jq -s '.[] | select(.path=="/api/2.0/workspace/mkdirs") | select(.body.path | test(".*/artifacts/.internal"))' out.requests.txt
+trace jq -s '.[] | select(.path=="/api/2.0/workspace/mkdirs") | select(.body.path | test(".*/artifacts/.internal"))' "$OUT_REQUESTS"
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/artifacts/whl_no_cleanup/test.toml b/acceptance/bundle/artifacts/whl_no_cleanup/test.toml
new file mode 100644
index 00000000000..ff8a66c196e
--- /dev/null
+++ b/acceptance/bundle/artifacts/whl_no_cleanup/test.toml
@@ -0,0 +1 @@
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/artifacts/whl_prebuilt_multiple/out.test.toml b/acceptance/bundle/artifacts/whl_prebuilt_multiple/out.test.toml
index f784a183258..f7fafbcc731 100644
--- a/acceptance/bundle/artifacts/whl_prebuilt_multiple/out.test.toml
+++ b/acceptance/bundle/artifacts/whl_prebuilt_multiple/out.test.toml
@@ -1,3 +1,3 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/artifacts/whl_prebuilt_multiple/output.txt b/acceptance/bundle/artifacts/whl_prebuilt_multiple/output.txt
index 4fe390e6350..c18e0b2d6da 100644
--- a/acceptance/bundle/artifacts/whl_prebuilt_multiple/output.txt
+++ b/acceptance/bundle/artifacts/whl_prebuilt_multiple/output.txt
@@ -2,14 +2,12 @@
 >>> find.py --expect 2 whl
 dist/lib/other_test_code-0.0.1-py3-none-any.whl
 dist/my_test_code-0.0.1-py3-none-any.whl
-
->>> [CLI] bundle deploy
 Uploading dist/lib/other_test_code-0.0.1-py3-none-any.whl...
 Uploading dist/my_test_code-0.0.1-py3-none-any.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.test_job
+Files: 6 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 === Expecting to find 2 wheels, same as initially provided
 >>> find.py --expect 2 whl
@@ -17,7 +15,7 @@ dist/lib/other_test_code-0.0.1-py3-none-any.whl
 dist/my_test_code-0.0.1-py3-none-any.whl
 
 === Expecting 2 wheels in libraries section in /jobs/create
->>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.tasks out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.tasks [OUTPUT_DIR]/out.requests.txt
 [
   {
     "existing_cluster_id": "0717-132531-5opeqon1",
@@ -38,8 +36,8 @@ dist/my_test_code-0.0.1-py3-none-any.whl
 ]
 
 === Expecting 2 wheels to be uploaded
->>> jq .path
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1-py3-none-any.whl"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/other_test_code-0.0.1-py3-none-any.whl"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/dist/lib/other_test_code-0.0.1-py3-none-any.whl"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/dist/my_test_code-0.0.1-py3-none-any.whl"
+>>> print_workspace_imports
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1-py3-none-any.whl
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/other_test_code-0.0.1-py3-none-any.whl
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/dist/lib/other_test_code-0.0.1-py3-none-any.whl
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/dist/my_test_code-0.0.1-py3-none-any.whl
diff --git a/acceptance/bundle/artifacts/whl_prebuilt_multiple/script b/acceptance/bundle/artifacts/whl_prebuilt_multiple/script
index 9df7ea3d987..8034c3171cf 100644
--- a/acceptance/bundle/artifacts/whl_prebuilt_multiple/script
+++ b/acceptance/bundle/artifacts/whl_prebuilt_multiple/script
@@ -1,14 +1,15 @@
 trace find.py --expect 2 whl
 
-trace $CLI bundle deploy 2>&1
+$CLI bundle plan -o json > tmp.plan.json 2>>LOG.plan
+$CLI bundle deploy $(readplanarg tmp.plan.json) 2>&1
 
 title "Expecting to find 2 wheels, same as initially provided"
 trace find.py --expect 2 whl
 
 title "Expecting 2 wheels in libraries section in /jobs/create"
-trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.tasks' out.requests.txt
+trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.tasks' "$OUT_REQUESTS"
 
 title "Expecting 2 wheels to be uploaded"
-trace jq .path < out.requests.txt | grep import | grep whl | sort
+trace print_workspace_imports | grep whl | sort
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/artifacts/whl_prebuilt_multiple/test.toml b/acceptance/bundle/artifacts/whl_prebuilt_multiple/test.toml
new file mode 100644
index 00000000000..ff8a66c196e
--- /dev/null
+++ b/acceptance/bundle/artifacts/whl_prebuilt_multiple/test.toml
@@ -0,0 +1 @@
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/artifacts/whl_prebuilt_outside/out.test.toml b/acceptance/bundle/artifacts/whl_prebuilt_outside/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/artifacts/whl_prebuilt_outside/out.test.toml
+++ b/acceptance/bundle/artifacts/whl_prebuilt_outside/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/artifacts/whl_prebuilt_outside/output.txt b/acceptance/bundle/artifacts/whl_prebuilt_outside/output.txt
index 369db2e47a7..a034c80a088 100644
--- a/acceptance/bundle/artifacts/whl_prebuilt_outside/output.txt
+++ b/acceptance/bundle/artifacts/whl_prebuilt_outside/output.txt
@@ -3,15 +3,15 @@
 Uploading other_dab/dist/lib/other_test_code-0.0.1-py3-none-any.whl...
 Uploading other_dab/dist/my_test_code-0.0.1-py3-none-any.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/python-wheel/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.test_job
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 === Expecting to find no wheels in current directory
 >>> find.py --expect 0 whl
 
 === Expecting 2 wheels in libraries section in /jobs/create
->>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.tasks out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.tasks [OUTPUT_DIR]/out.requests.txt
 [
   {
     "existing_cluster_id": "0717-132531-5opeqon1",
@@ -32,6 +32,6 @@ Deployment complete!
 ]
 
 === Expecting 2 wheels to be uploaded
->>> jq .path
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/python-wheel/default/artifacts/.internal/my_test_code-0.0.1-py3-none-any.whl"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/python-wheel/default/artifacts/.internal/other_test_code-0.0.1-py3-none-any.whl"
+>>> print_workspace_imports
+/Workspace/Users/[USERNAME]/.bundle/python-wheel/default/artifacts/.internal/my_test_code-0.0.1-py3-none-any.whl
+/Workspace/Users/[USERNAME]/.bundle/python-wheel/default/artifacts/.internal/other_test_code-0.0.1-py3-none-any.whl
diff --git a/acceptance/bundle/artifacts/whl_prebuilt_outside/script b/acceptance/bundle/artifacts/whl_prebuilt_outside/script
index 939847f6c12..23a2e0fc1ef 100644
--- a/acceptance/bundle/artifacts/whl_prebuilt_outside/script
+++ b/acceptance/bundle/artifacts/whl_prebuilt_outside/script
@@ -8,9 +8,9 @@ trace find.py --expect 0 whl
 cd ..
 
 title "Expecting 2 wheels in libraries section in /jobs/create"
-trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.tasks' out.requests.txt
+trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.tasks' "$OUT_REQUESTS"
 
 title "Expecting 2 wheels to be uploaded"
-trace jq .path < out.requests.txt | grep import | grep whl | sort
+trace print_workspace_imports | grep whl | sort
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/artifacts/whl_prebuilt_outside_dynamic/out.test.toml b/acceptance/bundle/artifacts/whl_prebuilt_outside_dynamic/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/artifacts/whl_prebuilt_outside_dynamic/out.test.toml
+++ b/acceptance/bundle/artifacts/whl_prebuilt_outside_dynamic/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/artifacts/whl_prebuilt_outside_dynamic/output.txt b/acceptance/bundle/artifacts/whl_prebuilt_outside_dynamic/output.txt
index 570b124a5bd..b26bae880f5 100644
--- a/acceptance/bundle/artifacts/whl_prebuilt_outside_dynamic/output.txt
+++ b/acceptance/bundle/artifacts/whl_prebuilt_outside_dynamic/output.txt
@@ -3,9 +3,9 @@
 Uploading this_dab/.databricks/bundle/default/patched_wheels/art1_my_test_code/my_test_code-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl...
 Uploading this_dab/.databricks/bundle/default/patched_wheels/art2_other_test_code/other_test_code-0.0.1+[UNIX_TIME_NANOS][1]-py3-none-any.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/python-wheel/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.test_job
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 === Expecting to find two patched wheels in current directory
 >>> find.py --expect 2 whl
@@ -13,7 +13,7 @@ Deployment complete!
 .databricks/bundle/default/patched_wheels/art2_other_test_code/other_test_code-0.0.1+[UNIX_TIME_NANOS][1]-py3-none-any.whl
 
 === Expecting 2 wheels in libraries section in /jobs/create
->>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.tasks out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.tasks [OUTPUT_DIR]/out.requests.txt
 [
   {
     "environment_key": "test_env",
@@ -41,7 +41,7 @@ Deployment complete!
   }
 ]
 
->>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.environments out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.environments [OUTPUT_DIR]/out.requests.txt
 [
   {
     "environment_key": "test_env",
@@ -56,6 +56,6 @@ Deployment complete!
 ]
 
 === Expecting 2 wheels to be uploaded
->>> jq .path
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/python-wheel/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/python-wheel/default/artifacts/.internal/other_test_code-0.0.1+[UNIX_TIME_NANOS][1]-py3-none-any.whl"
+>>> print_workspace_imports
+/Workspace/Users/[USERNAME]/.bundle/python-wheel/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl
+/Workspace/Users/[USERNAME]/.bundle/python-wheel/default/artifacts/.internal/other_test_code-0.0.1+[UNIX_TIME_NANOS][1]-py3-none-any.whl
diff --git a/acceptance/bundle/artifacts/whl_prebuilt_outside_dynamic/script b/acceptance/bundle/artifacts/whl_prebuilt_outside_dynamic/script
index af4e84b8b3f..f972cf2504e 100644
--- a/acceptance/bundle/artifacts/whl_prebuilt_outside_dynamic/script
+++ b/acceptance/bundle/artifacts/whl_prebuilt_outside_dynamic/script
@@ -10,10 +10,10 @@ trace find.py --expect 2 whl
 cd ..
 
 title "Expecting 2 wheels in libraries section in /jobs/create"
-trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.tasks' out.requests.txt
-trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.environments' out.requests.txt
+trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.tasks' "$OUT_REQUESTS"
+trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.environments' "$OUT_REQUESTS"
 
 title "Expecting 2 wheels to be uploaded"
-trace jq .path < out.requests.txt | grep import | grep whl | sort
+trace print_workspace_imports | grep whl | sort
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/artifacts/whl_via_environment_key/out.test.toml b/acceptance/bundle/artifacts/whl_via_environment_key/out.test.toml
index f784a183258..f7fafbcc731 100644
--- a/acceptance/bundle/artifacts/whl_via_environment_key/out.test.toml
+++ b/acceptance/bundle/artifacts/whl_via_environment_key/out.test.toml
@@ -1,3 +1,3 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/artifacts/whl_via_environment_key/output.txt b/acceptance/bundle/artifacts/whl_via_environment_key/output.txt
index 8afa59e7d8b..f6ba380bc11 100644
--- a/acceptance/bundle/artifacts/whl_via_environment_key/output.txt
+++ b/acceptance/bundle/artifacts/whl_via_environment_key/output.txt
@@ -1,17 +1,9 @@
 
->>> [CLI] bundle deploy
-Building my_test_code...
-Uploading my_test_code/dist/my_test_code-0.0.1-py3-none-any.whl...
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
 >>> find.py --expect 1 whl
 my_test_code/dist/my_test_code-0.0.1-py3-none-any.whl
 
 === Expecting 1 wheel in environments section in /jobs/create
->>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body [OUTPUT_DIR]/out.requests.txt
 {
   "deployment": {
     "kind": "BUNDLE",
@@ -49,6 +41,6 @@ my_test_code/dist/my_test_code-0.0.1-py3-none-any.whl
 }
 
 === Expecting 1 wheel to be uploaded
->>> jq .path
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1-py3-none-any.whl"
-"/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/my_test_code/dist/my_test_code-0.0.1-py3-none-any.whl"
+>>> print_workspace_imports
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1-py3-none-any.whl
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/my_test_code/dist/my_test_code-0.0.1-py3-none-any.whl
diff --git a/acceptance/bundle/artifacts/whl_via_environment_key/script b/acceptance/bundle/artifacts/whl_via_environment_key/script
index 3a0dd929c09..09f9ed82c47 100644
--- a/acceptance/bundle/artifacts/whl_via_environment_key/script
+++ b/acceptance/bundle/artifacts/whl_via_environment_key/script
@@ -1,11 +1,13 @@
-trace $CLI bundle deploy
+$CLI bundle plan -o json > tmp.plan.json 2>>LOG.plan
+$CLI bundle deploy $(readplanarg tmp.plan.json) &> LOG.deploy
+cat LOG.deploy | contains.py "my_test_code-0.0.1-py3-none-any.whl" > /dev/null
 
 trace find.py --expect 1 whl
 
 title "Expecting 1 wheel in environments section in /jobs/create"
-trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body' out.requests.txt
+trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body' "$OUT_REQUESTS" | nostamp
 
 title "Expecting 1 wheel to be uploaded"
-trace jq .path < out.requests.txt | grep import | grep whl | sort
+trace print_workspace_imports | grep whl | sort
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/artifacts/whl_via_environment_key/test.toml b/acceptance/bundle/artifacts/whl_via_environment_key/test.toml
new file mode 100644
index 00000000000..ff8a66c196e
--- /dev/null
+++ b/acceptance/bundle/artifacts/whl_via_environment_key/test.toml
@@ -0,0 +1 @@
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/artifacts/whl_via_environment_key_extras/.gitignore b/acceptance/bundle/artifacts/whl_via_environment_key_extras/.gitignore
new file mode 100644
index 00000000000..f03e23bc260
--- /dev/null
+++ b/acceptance/bundle/artifacts/whl_via_environment_key_extras/.gitignore
@@ -0,0 +1,3 @@
+build/
+*.egg-info
+.databricks
diff --git a/acceptance/bundle/artifacts/whl_via_environment_key_extras/databricks.yml b/acceptance/bundle/artifacts/whl_via_environment_key_extras/databricks.yml
new file mode 100644
index 00000000000..46821f31ac8
--- /dev/null
+++ b/acceptance/bundle/artifacts/whl_via_environment_key_extras/databricks.yml
@@ -0,0 +1,26 @@
+bundle:
+  name: test-bundle
+
+artifacts:
+  my_test_code:
+    type: whl
+    path: "./my_test_code"
+    build: uv build --wheel
+
+resources:
+  jobs:
+    test_job:
+      name: "My Wheel Job"
+      tasks:
+        - task_key: TestTask
+          existing_cluster_id: "0717-132531-5opeqon1"
+          python_wheel_task:
+            package_name: "my_test_code"
+            entry_point: "run"
+          environment_key: "test_env"
+      environments:
+        - environment_key: "test_env"
+          spec:
+            client: "1"
+            dependencies:
+              - ./my_test_code/dist/*.whl[train]
diff --git a/acceptance/bundle/artifacts/whl_via_environment_key_extras/my_test_code/pyproject.toml b/acceptance/bundle/artifacts/whl_via_environment_key_extras/my_test_code/pyproject.toml
new file mode 100644
index 00000000000..e895915465e
--- /dev/null
+++ b/acceptance/bundle/artifacts/whl_via_environment_key_extras/my_test_code/pyproject.toml
@@ -0,0 +1,19 @@
+[build-system]
+requires = ["setuptools"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "my_test_code"
+version = "0.0.1"
+description = "my test wheel"
+authors = [{ name = "Databricks", email = "john.doe@databricks.com" }]
+dependencies = ["setuptools"]
+
+[project.urls]
+Homepage = "https://databricks.com"
+
+[project.entry-points.group_1]
+run = "src.__main__:main"
+
+[tool.setuptools]
+packages = ["src"]
diff --git a/acceptance/bundle/artifacts/whl_via_environment_key_extras/my_test_code/src/__init__.py b/acceptance/bundle/artifacts/whl_via_environment_key_extras/my_test_code/src/__init__.py
new file mode 100644
index 00000000000..909f1f3220d
--- /dev/null
+++ b/acceptance/bundle/artifacts/whl_via_environment_key_extras/my_test_code/src/__init__.py
@@ -0,0 +1,2 @@
+__version__ = "0.0.1"
+__author__ = "Databricks"
diff --git a/acceptance/bundle/artifacts/whl_via_environment_key_extras/my_test_code/src/__main__.py b/acceptance/bundle/artifacts/whl_via_environment_key_extras/my_test_code/src/__main__.py
new file mode 100644
index 00000000000..ea918ce2d53
--- /dev/null
+++ b/acceptance/bundle/artifacts/whl_via_environment_key_extras/my_test_code/src/__main__.py
@@ -0,0 +1,16 @@
+"""
+The entry point of the Python Wheel
+"""
+
+import sys
+
+
+def main():
+    # This method will print the provided arguments
+    print("Hello from my func")
+    print("Got arguments:")
+    print(sys.argv)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/acceptance/bundle/artifacts/whl_via_environment_key_extras/out.test.toml b/acceptance/bundle/artifacts/whl_via_environment_key_extras/out.test.toml
new file mode 100644
index 00000000000..f7fafbcc731
--- /dev/null
+++ b/acceptance/bundle/artifacts/whl_via_environment_key_extras/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/artifacts/whl_via_environment_key_extras/output.txt b/acceptance/bundle/artifacts/whl_via_environment_key_extras/output.txt
new file mode 100644
index 00000000000..e99a248c94b
--- /dev/null
+++ b/acceptance/bundle/artifacts/whl_via_environment_key_extras/output.txt
@@ -0,0 +1,45 @@
+
+>>> find.py --expect 1 whl
+my_test_code/dist/my_test_code-0.0.1-py3-none-any.whl
+
+=== Expecting the environments dependency to keep its [train] extras suffix
+>>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body [OUTPUT_DIR]/out.requests.txt
+{
+  "deployment": {
+    "kind": "BUNDLE",
+    "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+  },
+  "edit_mode": "UI_LOCKED",
+  "environments": [
+    {
+      "environment_key": "test_env",
+      "spec": {
+        "client": "1",
+        "dependencies": [
+          "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1-py3-none-any.whl[train]"
+        ]
+      }
+    }
+  ],
+  "format": "MULTI_TASK",
+  "max_concurrent_runs": 1,
+  "name": "My Wheel Job",
+  "queue": {
+    "enabled": true
+  },
+  "tasks": [
+    {
+      "environment_key": "test_env",
+      "existing_cluster_id": "0717-132531-5opeqon1",
+      "python_wheel_task": {
+        "entry_point": "run",
+        "package_name": "my_test_code"
+      },
+      "task_key": "TestTask"
+    }
+  ]
+}
+
+=== Expecting 1 wheel to be uploaded under its bare filename (no extras)
+>>> print_workspace_imports
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1-py3-none-any.whl
diff --git a/acceptance/bundle/artifacts/whl_via_environment_key_extras/script b/acceptance/bundle/artifacts/whl_via_environment_key_extras/script
new file mode 100644
index 00000000000..157472b5f55
--- /dev/null
+++ b/acceptance/bundle/artifacts/whl_via_environment_key_extras/script
@@ -0,0 +1,13 @@
+$CLI bundle plan -o json > tmp.plan.json 2>>LOG.plan
+$CLI bundle deploy $(readplanarg tmp.plan.json) &> LOG.deploy
+cat LOG.deploy | contains.py "my_test_code-0.0.1-py3-none-any.whl" > /dev/null
+
+trace find.py --expect 1 whl
+
+title "Expecting the environments dependency to keep its [train] extras suffix"
+trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body' "$OUT_REQUESTS" | nostamp
+
+title "Expecting 1 wheel to be uploaded under its bare filename (no extras)"
+trace print_workspace_imports | grep whl | sort
+
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/artifacts/whl_via_environment_key_extras/test.toml b/acceptance/bundle/artifacts/whl_via_environment_key_extras/test.toml
new file mode 100644
index 00000000000..ff8a66c196e
--- /dev/null
+++ b/acceptance/bundle/artifacts/whl_via_environment_key_extras/test.toml
@@ -0,0 +1 @@
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/benchmarks/deploy/out.test.toml b/acceptance/bundle/benchmarks/deploy/out.test.toml
index 1baaa898c5b..8c2cb31de53 100644
--- a/acceptance/bundle/benchmarks/deploy/out.test.toml
+++ b/acceptance/bundle/benchmarks/deploy/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
 GOOS.windows = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/benchmarks/plan/out.test.toml b/acceptance/bundle/benchmarks/plan/out.test.toml
index 1baaa898c5b..8c2cb31de53 100644
--- a/acceptance/bundle/benchmarks/plan/out.test.toml
+++ b/acceptance/bundle/benchmarks/plan/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
 GOOS.windows = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/benchmarks/validate/out.test.toml b/acceptance/bundle/benchmarks/validate/out.test.toml
index 1baaa898c5b..8c2cb31de53 100644
--- a/acceptance/bundle/benchmarks/validate/out.test.toml
+++ b/acceptance/bundle/benchmarks/validate/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
 GOOS.windows = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/bundle_tag/id/out.test.toml b/acceptance/bundle/bundle_tag/id/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/bundle_tag/id/out.test.toml
+++ b/acceptance/bundle/bundle_tag/id/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/bundle_tag/id/output.txt b/acceptance/bundle/bundle_tag/id/output.txt
index 604c2df9699..427b059bfb0 100644
--- a/acceptance/bundle/bundle_tag/id/output.txt
+++ b/acceptance/bundle/bundle_tag/id/output.txt
@@ -35,11 +35,11 @@ Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.foo
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
->>> print_requests.py //jobs
+>>> print_requests.py --nostamp //jobs
 {
   "method": "POST",
   "path": "/api/2.2/jobs/create",
@@ -68,7 +68,7 @@ Resources:
   Jobs:
     foo:
       Name: Untitled
-      URL:  [DATABRICKS_URL]/jobs/[NUMID]?o=[NUMID]
+      URL:  [DATABRICKS_URL]/jobs/[FOO_ID]?w=[WORKSPACE_ID]
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
@@ -76,14 +76,13 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
 
->>> print_requests.py //jobs
+>>> print_requests.py --nostamp //jobs
 {
   "method": "POST",
   "path": "/api/2.2/jobs/delete",
   "body": {
-    "job_id": [NUMID]
+    "job_id": [FOO_ID]
   }
 }
diff --git a/acceptance/bundle/bundle_tag/id/script b/acceptance/bundle/bundle_tag/id/script
index dbc595a277f..cb86bbae429 100644
--- a/acceptance/bundle/bundle_tag/id/script
+++ b/acceptance/bundle/bundle_tag/id/script
@@ -1,8 +1,9 @@
 trace $CLI bundle validate
-trace $CLI bundle validate -o json | jq .resources
+trace $CLI bundle validate -o json | nostamp | jq .resources
 trace $CLI bundle plan
 trace $CLI bundle deploy
-trace print_requests.py //jobs
+replace_ids.py
+trace print_requests.py --nostamp //jobs
 trace $CLI bundle summary
 trace $CLI bundle destroy --auto-approve
-trace print_requests.py //jobs
+trace print_requests.py --nostamp //jobs
diff --git a/acceptance/bundle/bundle_tag/url/out.test.toml b/acceptance/bundle/bundle_tag/url/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/bundle_tag/url/out.test.toml
+++ b/acceptance/bundle/bundle_tag/url/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/bundle_tag/url/output.txt b/acceptance/bundle/bundle_tag/url/output.txt
index 3e4536666c1..6bcd3f040e4 100644
--- a/acceptance/bundle/bundle_tag/url/output.txt
+++ b/acceptance/bundle/bundle_tag/url/output.txt
@@ -35,11 +35,11 @@ Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.foo
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
->>> print_requests.py //jobs
+>>> print_requests.py --nostamp //jobs
 {
   "method": "POST",
   "path": "/api/2.2/jobs/create",
@@ -68,7 +68,7 @@ Resources:
   Jobs:
     foo:
       Name: Untitled
-      URL:  [DATABRICKS_URL]/jobs/[NUMID]?o=[NUMID]
+      URL:  [DATABRICKS_URL]/jobs/[FOO_ID]?w=[WORKSPACE_ID]
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
@@ -76,14 +76,13 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
 
->>> print_requests.py //jobs
+>>> print_requests.py --nostamp //jobs
 {
   "method": "POST",
   "path": "/api/2.2/jobs/delete",
   "body": {
-    "job_id": [NUMID]
+    "job_id": [FOO_ID]
   }
 }
diff --git a/acceptance/bundle/bundle_tag/url/script b/acceptance/bundle/bundle_tag/url/script
index dbc595a277f..cb86bbae429 100644
--- a/acceptance/bundle/bundle_tag/url/script
+++ b/acceptance/bundle/bundle_tag/url/script
@@ -1,8 +1,9 @@
 trace $CLI bundle validate
-trace $CLI bundle validate -o json | jq .resources
+trace $CLI bundle validate -o json | nostamp | jq .resources
 trace $CLI bundle plan
 trace $CLI bundle deploy
-trace print_requests.py //jobs
+replace_ids.py
+trace print_requests.py --nostamp //jobs
 trace $CLI bundle summary
 trace $CLI bundle destroy --auto-approve
-trace print_requests.py //jobs
+trace print_requests.py --nostamp //jobs
diff --git a/acceptance/bundle/bundle_tag/url_ref/out.deploy-requests.terraform.txt b/acceptance/bundle/bundle_tag/url_ref/out.deploy-requests.terraform.txt
deleted file mode 100644
index 0a9a51c98b7..00000000000
--- a/acceptance/bundle/bundle_tag/url_ref/out.deploy-requests.terraform.txt
+++ /dev/null
@@ -1,34 +0,0 @@
-{
-  "method": "POST",
-  "path": "/api/2.2/jobs/create",
-  "body": {
-    "deployment": {
-      "kind": "BUNDLE",
-      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-    },
-    "edit_mode": "UI_LOCKED",
-    "format": "MULTI_TASK",
-    "max_concurrent_runs": 1,
-    "name": "Untitled",
-    "queue": {
-      "enabled": true
-    }
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.2/jobs/create",
-  "body": {
-    "deployment": {
-      "kind": "BUNDLE",
-      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-    },
-    "edit_mode": "UI_LOCKED",
-    "format": "MULTI_TASK",
-    "max_concurrent_runs": 1,
-    "name": "Untitled",
-    "queue": {
-      "enabled": true
-    }
-  }
-}
diff --git a/acceptance/bundle/artifacts/whl_prebuilt_outside/test.toml b/acceptance/bundle/bundle_tag/url_ref/out.deploy-requests.txt
similarity index 100%
rename from acceptance/bundle/artifacts/whl_prebuilt_outside/test.toml
rename to acceptance/bundle/bundle_tag/url_ref/out.deploy-requests.txt
diff --git a/acceptance/bundle/bundle_tag/url_ref/out.deploy.direct.txt b/acceptance/bundle/bundle_tag/url_ref/out.deploy.direct.txt
deleted file mode 100644
index 8e75866b8d1..00000000000
--- a/acceptance/bundle/bundle_tag/url_ref/out.deploy.direct.txt
+++ /dev/null
@@ -1,7 +0,0 @@
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Error: cannot plan resources.jobs.bar: cannot resolve "${resources.jobs.foo.url}": schema mismatch: url: field "url" not found in jobs.JobSettings; url: field "url" not found in dresources.JobRemote
-
-Error: planning failed
-
-
-Exit code: 1
diff --git a/acceptance/bundle/bundle_tag/url_ref/out.deploy.terraform.txt b/acceptance/bundle/bundle_tag/url_ref/out.deploy.terraform.txt
deleted file mode 100644
index 56e08e87b22..00000000000
--- a/acceptance/bundle/bundle_tag/url_ref/out.deploy.terraform.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
diff --git a/acceptance/bundle/bundle_tag/url_ref/out.deploy.txt b/acceptance/bundle/bundle_tag/url_ref/out.deploy.txt
new file mode 100644
index 00000000000..763124eb2b9
--- /dev/null
+++ b/acceptance/bundle/bundle_tag/url_ref/out.deploy.txt
@@ -0,0 +1,5 @@
+Error: "resources.jobs.foo.url": Terraform-only field; cross-resource references to Terraform-only fields are not supported by the direct engine
+  in databricks.yml:11:12
+
+
+Exit code: 1
diff --git a/acceptance/bundle/bundle_tag/url_ref/out.destroy-requests.terraform.txt b/acceptance/bundle/bundle_tag/url_ref/out.destroy-requests.terraform.txt
deleted file mode 100644
index 756c38d7555..00000000000
--- a/acceptance/bundle/bundle_tag/url_ref/out.destroy-requests.terraform.txt
+++ /dev/null
@@ -1,14 +0,0 @@
-{
-  "method": "POST",
-  "path": "/api/2.2/jobs/delete",
-  "body": {
-    "job_id": [NUMID]
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.2/jobs/delete",
-  "body": {
-    "job_id": [NUMID]
-  }
-}
diff --git a/acceptance/bundle/bundle_tag/url_ref/out.destroy-requests.txt b/acceptance/bundle/bundle_tag/url_ref/out.destroy-requests.txt
new file mode 100644
index 00000000000..9ae96b91891
--- /dev/null
+++ b/acceptance/bundle/bundle_tag/url_ref/out.destroy-requests.txt
@@ -0,0 +1,3 @@
+File [OUTPUT_DIR]/out.requests.txt not found
+
+Exit code: 1
diff --git a/acceptance/bundle/bundle_tag/url_ref/out.destroy.direct.txt b/acceptance/bundle/bundle_tag/url_ref/out.destroy.direct.txt
deleted file mode 100644
index b01e4e42b66..00000000000
--- a/acceptance/bundle/bundle_tag/url_ref/out.destroy.direct.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
-
-Deleting files...
-Destroy complete!
diff --git a/acceptance/bundle/bundle_tag/url_ref/out.destroy.terraform.txt b/acceptance/bundle/bundle_tag/url_ref/out.destroy.terraform.txt
deleted file mode 100644
index 18c41708236..00000000000
--- a/acceptance/bundle/bundle_tag/url_ref/out.destroy.terraform.txt
+++ /dev/null
@@ -1,8 +0,0 @@
-The following resources will be deleted:
-  delete resources.jobs.bar
-  delete resources.jobs.foo
-
-All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
-
-Deleting files...
-Destroy complete!
diff --git a/acceptance/bundle/bundle_tag/url_ref/out.destroy.txt b/acceptance/bundle/bundle_tag/url_ref/out.destroy.txt
new file mode 100644
index 00000000000..763124eb2b9
--- /dev/null
+++ b/acceptance/bundle/bundle_tag/url_ref/out.destroy.txt
@@ -0,0 +1,5 @@
+Error: "resources.jobs.foo.url": Terraform-only field; cross-resource references to Terraform-only fields are not supported by the direct engine
+  in databricks.yml:11:12
+
+
+Exit code: 1
diff --git a/acceptance/bundle/bundle_tag/url_ref/out.plan.direct.txt b/acceptance/bundle/bundle_tag/url_ref/out.plan.direct.txt
deleted file mode 100644
index bab4bff1b40..00000000000
--- a/acceptance/bundle/bundle_tag/url_ref/out.plan.direct.txt
+++ /dev/null
@@ -1,6 +0,0 @@
-Error: cannot plan resources.jobs.bar: cannot resolve "${resources.jobs.foo.url}": schema mismatch: url: field "url" not found in jobs.JobSettings; url: field "url" not found in dresources.JobRemote
-
-Error: planning failed
-
-
-Exit code: 1
diff --git a/acceptance/bundle/bundle_tag/url_ref/out.plan.terraform.txt b/acceptance/bundle/bundle_tag/url_ref/out.plan.terraform.txt
deleted file mode 100644
index aca4ae9fb60..00000000000
--- a/acceptance/bundle/bundle_tag/url_ref/out.plan.terraform.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-create jobs.bar
-create jobs.foo
-
-Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
diff --git a/acceptance/bundle/bundle_tag/url_ref/out.plan.txt b/acceptance/bundle/bundle_tag/url_ref/out.plan.txt
new file mode 100644
index 00000000000..763124eb2b9
--- /dev/null
+++ b/acceptance/bundle/bundle_tag/url_ref/out.plan.txt
@@ -0,0 +1,5 @@
+Error: "resources.jobs.foo.url": Terraform-only field; cross-resource references to Terraform-only fields are not supported by the direct engine
+  in databricks.yml:11:12
+
+
+Exit code: 1
diff --git a/acceptance/bundle/bundle_tag/url_ref/out.summary.direct.txt b/acceptance/bundle/bundle_tag/url_ref/out.summary.direct.txt
deleted file mode 100644
index ed3f9c8ae54..00000000000
--- a/acceptance/bundle/bundle_tag/url_ref/out.summary.direct.txt
+++ /dev/null
@@ -1,13 +0,0 @@
-Name: test-bundle
-Target: default
-Workspace:
-  User: [USERNAME]
-  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
-Resources:
-  Jobs:
-    bar:
-      Name: Untitled
-      URL:  ${resources.jobs.foo.url}
-    foo:
-      Name: Untitled
-      URL:  my_job_url
diff --git a/acceptance/bundle/bundle_tag/url_ref/out.summary.terraform.txt b/acceptance/bundle/bundle_tag/url_ref/out.summary.terraform.txt
deleted file mode 100644
index e06a0d3041a..00000000000
--- a/acceptance/bundle/bundle_tag/url_ref/out.summary.terraform.txt
+++ /dev/null
@@ -1,13 +0,0 @@
-Name: test-bundle
-Target: default
-Workspace:
-  User: [USERNAME]
-  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
-Resources:
-  Jobs:
-    bar:
-      Name: Untitled
-      URL:  [DATABRICKS_URL]/jobs/[NUMID]?o=[NUMID]
-    foo:
-      Name: Untitled
-      URL:  [DATABRICKS_URL]/jobs/[NUMID]?o=[NUMID]
diff --git a/acceptance/bundle/bundle_tag/url_ref/out.summary.txt b/acceptance/bundle/bundle_tag/url_ref/out.summary.txt
new file mode 100644
index 00000000000..763124eb2b9
--- /dev/null
+++ b/acceptance/bundle/bundle_tag/url_ref/out.summary.txt
@@ -0,0 +1,5 @@
+Error: "resources.jobs.foo.url": Terraform-only field; cross-resource references to Terraform-only fields are not supported by the direct engine
+  in databricks.yml:11:12
+
+
+Exit code: 1
diff --git a/acceptance/bundle/bundle_tag/url_ref/out.test.toml b/acceptance/bundle/bundle_tag/url_ref/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/bundle_tag/url_ref/out.test.toml
+++ b/acceptance/bundle/bundle_tag/url_ref/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/bundle_tag/url_ref/out.validate.txt b/acceptance/bundle/bundle_tag/url_ref/out.validate.txt
new file mode 100644
index 00000000000..1b69b17fd69
--- /dev/null
+++ b/acceptance/bundle/bundle_tag/url_ref/out.validate.txt
@@ -0,0 +1,37 @@
+Error: "resources.jobs.foo.url": Terraform-only field; cross-resource references to Terraform-only fields are not supported by the direct engine
+  in databricks.yml:11:12
+
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Found 1 error
+
+Exit code: 1
+Error: "resources.jobs.foo.url": Terraform-only field; cross-resource references to Terraform-only fields are not supported by the direct engine
+  in databricks.yml:11:12
+
+
+Exit code: 1
+{
+  "jobs": {
+    "bar": {
+      "max_concurrent_runs": 1,
+      "name": "Untitled",
+      "queue": {
+        "enabled": true
+      },
+      "url": "${resources.jobs.foo.url}"
+    },
+    "foo": {
+      "max_concurrent_runs": 1,
+      "name": "Untitled",
+      "queue": {
+        "enabled": true
+      },
+      "url": "my_job_url"
+    }
+  }
+}
diff --git a/acceptance/bundle/bundle_tag/url_ref/output.txt b/acceptance/bundle/bundle_tag/url_ref/output.txt
index 1de0522b58e..e69de29bb2d 100644
--- a/acceptance/bundle/bundle_tag/url_ref/output.txt
+++ b/acceptance/bundle/bundle_tag/url_ref/output.txt
@@ -1,43 +0,0 @@
-
->>> [CLI] bundle validate
-Name: test-bundle
-Target: default
-Workspace:
-  User: [USERNAME]
-  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
-
-Validation OK!
-
->>> [CLI] bundle validate -o json
-{
-  "jobs": {
-    "bar": {
-      "deployment": {
-        "kind": "BUNDLE",
-        "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-      },
-      "edit_mode": "UI_LOCKED",
-      "format": "MULTI_TASK",
-      "max_concurrent_runs": 1,
-      "name": "Untitled",
-      "queue": {
-        "enabled": true
-      },
-      "url": "${resources.jobs.foo.url}"
-    },
-    "foo": {
-      "deployment": {
-        "kind": "BUNDLE",
-        "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-      },
-      "edit_mode": "UI_LOCKED",
-      "format": "MULTI_TASK",
-      "max_concurrent_runs": 1,
-      "name": "Untitled",
-      "queue": {
-        "enabled": true
-      },
-      "url": "my_job_url"
-    }
-  }
-}
diff --git a/acceptance/bundle/bundle_tag/url_ref/script b/acceptance/bundle/bundle_tag/url_ref/script
index fff6a266c27..6d2efe44d62 100644
--- a/acceptance/bundle/bundle_tag/url_ref/script
+++ b/acceptance/bundle/bundle_tag/url_ref/script
@@ -1,8 +1,10 @@
-trace $CLI bundle validate
-trace $CLI bundle validate -o json | jq .resources
-errcode $CLI bundle plan &> out.plan.$DATABRICKS_BUNDLE_ENGINE.txt
-errcode $CLI bundle deploy &> out.deploy.$DATABRICKS_BUNDLE_ENGINE.txt
-print_requests.py //jobs &> out.deploy-requests.$DATABRICKS_BUNDLE_ENGINE.txt
-errcode $CLI bundle summary &> out.summary.$DATABRICKS_BUNDLE_ENGINE.txt
-$CLI bundle destroy --auto-approve &> out.destroy.$DATABRICKS_BUNDLE_ENGINE.txt
-print_requests.py //jobs &> out.destroy-requests.$DATABRICKS_BUNDLE_ENGINE.txt
+errcode $CLI bundle validate &> out.validate.txt
+errcode $CLI bundle validate -o json > out.validate.json.tmp 2>> out.validate.txt
+jq .resources out.validate.json.tmp >> out.validate.txt
+rm out.validate.json.tmp
+errcode $CLI bundle plan &> out.plan.txt
+errcode $CLI bundle deploy &> out.deploy.txt
+errcode print_requests.py //jobs &> out.deploy-requests.txt
+errcode $CLI bundle summary &> out.summary.txt
+errcode $CLI bundle destroy --auto-approve &> out.destroy.txt
+errcode print_requests.py //jobs &> out.destroy-requests.txt
diff --git a/acceptance/bundle/config-remote-sync/cli_defaults/out.test.toml b/acceptance/bundle/config-remote-sync/cli_defaults/out.test.toml
index 579b1e4a3c9..a4f8dd5ef74 100644
--- a/acceptance/bundle/config-remote-sync/cli_defaults/out.test.toml
+++ b/acceptance/bundle/config-remote-sync/cli_defaults/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 GOOS.windows = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/cli_defaults/output.txt b/acceptance/bundle/config-remote-sync/cli_defaults/output.txt
index 307a945ea93..90e2b582ce5 100644
--- a/acceptance/bundle/config-remote-sync/cli_defaults/output.txt
+++ b/acceptance/bundle/config-remote-sync/cli_defaults/output.txt
@@ -1,7 +1,9 @@
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.job1
+Created jobs.job2
+Created pipelines.pipeline1
+Files: 2 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
 
 === Modify jobs
 Change max_concurrent_runs, name, change default tag
@@ -57,10 +59,9 @@ The following resources will be deleted:
   delete resources.pipelines.pipeline1
 
 This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
-Streaming Tables (STs) and Materialized Views (MVs) managed by them:
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:
   delete resources.pipelines.pipeline1
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 3 deleted
diff --git a/acceptance/bundle/config-remote-sync/cli_defaults/test.toml b/acceptance/bundle/config-remote-sync/cli_defaults/test.toml
index 3894d66826c..21cf5f934b3 100644
--- a/acceptance/bundle/config-remote-sync/cli_defaults/test.toml
+++ b/acceptance/bundle/config-remote-sync/cli_defaults/test.toml
@@ -3,8 +3,4 @@ Cloud = true
 RecordRequests = false
 Ignore = [".databricks", "dummy.whl", "databricks.yml", "databricks.yml.backup"]
 
-[Env]
-DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
-
-[EnvMatrix]
-DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+Env.DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
diff --git a/acceptance/bundle/config-remote-sync/cluster_policy_remote_addition/databricks.yml.tmpl b/acceptance/bundle/config-remote-sync/cluster_policy_remote_addition/databricks.yml.tmpl
new file mode 100644
index 00000000000..d4eb124a631
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/cluster_policy_remote_addition/databricks.yml.tmpl
@@ -0,0 +1,27 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+workspace:
+  root_path: ~/.bundle/$UNIQUE_NAME
+
+resources:
+  cluster_policies:
+    policy:
+      name: test-policy-$UNIQUE_NAME
+      definition:
+        # The policy does not constrain spark_conf.
+        custom_tags.PolicyTag:
+          type: fixed
+          value: from-policy
+  jobs:
+    test_job:
+      name: test-job-$UNIQUE_NAME
+      tasks:
+        - task_key: test
+          new_cluster:
+            policy_id: ${resources.cluster_policies.policy.id}
+            spark_version: $DEFAULT_SPARK_VERSION
+            node_type_id: $NODE_TYPE_ID
+            num_workers: 1
+          spark_python_task:
+            python_file: ./hello.py
diff --git a/acceptance/bundle/config-remote-sync/cluster_policy_remote_addition/hello.py b/acceptance/bundle/config-remote-sync/cluster_policy_remote_addition/hello.py
new file mode 100644
index 00000000000..8cb8f7a2d91
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/cluster_policy_remote_addition/hello.py
@@ -0,0 +1,3 @@
+#!/usr/bin/env python3
+
+print("hello")
diff --git a/acceptance/bundle/config-remote-sync/cluster_policy_remote_addition/out.test.toml b/acceptance/bundle/config-remote-sync/cluster_policy_remote_addition/out.test.toml
new file mode 100644
index 00000000000..a4f8dd5ef74
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/cluster_policy_remote_addition/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = true
+GOOS.windows = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/cluster_policy_remote_addition/output.txt b/acceptance/bundle/config-remote-sync/cluster_policy_remote_addition/output.txt
new file mode 100644
index 00000000000..bca88a73a63
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/cluster_policy_remote_addition/output.txt
@@ -0,0 +1,35 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Created cluster_policies.policy
+Created jobs.test_job
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] bundle config-remote-sync --save
+Detected changes in 1 resource(s):
+
+Resource: resources.jobs.test_job
+  tasks[task_key='test'].new_cluster.spark_conf: add
+
+
+
+>>> diff.py databricks.yml.backup databricks.yml
+--- databricks.yml.backup
++++ databricks.yml
+@@ -24,4 +24,6 @@
+             node_type_id: [NODE_TYPE_ID]
+             num_workers: 1
++            spark_conf:
++              spark.sql.shuffle.partitions: "7"
+           spark_python_task:
+             python_file: ./hello.py
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.cluster_policies.policy
+  delete resources.jobs.test_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/config-remote-sync/cluster_policy_remote_addition/script b/acceptance/bundle/config-remote-sync/cluster_policy_remote_addition/script
new file mode 100644
index 00000000000..afe89d9a834
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/cluster_policy_remote_addition/script
@@ -0,0 +1,18 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+trace $CLI bundle deploy
+job_id=$(read_id.py test_job)
+
+edit_resource.py jobs "$job_id" <<'EOF'
+r["tasks"][0]["new_cluster"]["spark_conf"] = {"spark.sql.shuffle.partitions": "7"}
+EOF
+
+cp databricks.yml databricks.yml.backup
+trace $CLI bundle config-remote-sync --save
+trace diff.py databricks.yml.backup databricks.yml
+rm databricks.yml.backup
diff --git a/acceptance/bundle/config-remote-sync/cluster_policy_remote_addition/test.toml b/acceptance/bundle/config-remote-sync/cluster_policy_remote_addition/test.toml
new file mode 100644
index 00000000000..a799274577a
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/cluster_policy_remote_addition/test.toml
@@ -0,0 +1,3 @@
+Cloud = true
+RecordRequests = false
+Ignore = [".databricks", "databricks.yml", "databricks.yml.backup"]
diff --git a/acceptance/bundle/config-remote-sync/config_edits/out.test.toml b/acceptance/bundle/config-remote-sync/config_edits/out.test.toml
index 579b1e4a3c9..a4f8dd5ef74 100644
--- a/acceptance/bundle/config-remote-sync/config_edits/out.test.toml
+++ b/acceptance/bundle/config-remote-sync/config_edits/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 GOOS.windows = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/config_edits/output.txt b/acceptance/bundle/config-remote-sync/config_edits/output.txt
index ce51b3c7a65..bc2fe828761 100644
--- a/acceptance/bundle/config-remote-sync/config_edits/output.txt
+++ b/acceptance/bundle/config-remote-sync/config_edits/output.txt
@@ -1,8 +1,8 @@
 Uploading dummy.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.my_job
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 === Case 1: Added locally, updated remotely with different value
 
@@ -59,5 +59,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/config-remote-sync/config_edits/test.toml b/acceptance/bundle/config-remote-sync/config_edits/test.toml
index 55c90b3896e..3215c8a064e 100644
--- a/acceptance/bundle/config-remote-sync/config_edits/test.toml
+++ b/acceptance/bundle/config-remote-sync/config_edits/test.toml
@@ -4,8 +4,4 @@ RecordRequests = false
 
 Ignore = [".databricks", "dummy.whl", "databricks.yml", "databricks.yml.backup"]
 
-[Env]
-DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
-
-[EnvMatrix]
-DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+Env.DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
diff --git a/acceptance/bundle/config-remote-sync/dashboard_etag/dashboard.lvdash.json b/acceptance/bundle/config-remote-sync/dashboard_etag/dashboard.lvdash.json
new file mode 100644
index 00000000000..397a9a1259c
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/dashboard_etag/dashboard.lvdash.json
@@ -0,0 +1,34 @@
+{
+  "pages": [
+    {
+      "displayName": "New Page",
+      "layout": [
+        {
+          "position": {
+            "height": 2,
+            "width": 6,
+            "x": 0,
+            "y": 0
+          },
+          "widget": {
+            "name": "82eb9107",
+            "textbox_spec": "# I'm a title"
+          }
+        },
+        {
+          "position": {
+            "height": 2,
+            "width": 6,
+            "x": 0,
+            "y": 2
+          },
+          "widget": {
+            "name": "ffa6de4f",
+            "textbox_spec": "Text"
+          }
+        }
+      ],
+      "name": "fdd21a3c"
+    }
+  ]
+}
diff --git a/acceptance/bundle/config-remote-sync/dashboard_etag/databricks.yml.tmpl b/acceptance/bundle/config-remote-sync/dashboard_etag/databricks.yml.tmpl
new file mode 100644
index 00000000000..26b1e7b7771
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/dashboard_etag/databricks.yml.tmpl
@@ -0,0 +1,9 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  dashboards:
+    my_dashboard:
+      display_name: test-dashboard-$UNIQUE_NAME
+      file_path: ./dashboard.lvdash.json
+      warehouse_id: $TEST_DEFAULT_WAREHOUSE_ID
diff --git a/acceptance/bundle/config-remote-sync/dashboard_etag/out.test.toml b/acceptance/bundle/config-remote-sync/dashboard_etag/out.test.toml
new file mode 100644
index 00000000000..a4f8dd5ef74
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/dashboard_etag/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = true
+GOOS.windows = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/dashboard_etag/output.txt b/acceptance/bundle/config-remote-sync/dashboard_etag/output.txt
new file mode 100644
index 00000000000..ad1dcbb2452
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/dashboard_etag/output.txt
@@ -0,0 +1,31 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Created dashboards.my_dashboard
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Modify the dashboard out of band to bump its remote etag
+{
+  "lifecycle_state": "ACTIVE"
+}
+
+=== Detect changes: etag drift must not be reported
+
+>>> [CLI] bundle config-remote-sync
+No changes detected.
+
+
+=== Save changes: config must not be modified
+
+>>> [CLI] bundle config-remote-sync --save
+No changes detected.
+
+
+>>> diff.py databricks.yml.backup databricks.yml
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.dashboards.my_dashboard
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/config-remote-sync/dashboard_etag/script b/acceptance/bundle/config-remote-sync/dashboard_etag/script
new file mode 100644
index 00000000000..990988c5906
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/dashboard_etag/script
@@ -0,0 +1,28 @@
+#!/bin/bash
+
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+  trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+$CLI bundle deploy
+dashboard_id=$(read_id.py my_dashboard)
+
+title "Modify the dashboard out of band to bump its remote etag"
+echo
+# Keep only lifecycle_state: the full response carries a nondeterministic etag
+# and update_time that would churn the snapshot.
+$CLI lakeview update "$dashboard_id" --json '{"serialized_dashboard": "{}", "warehouse_id": "'$TEST_DEFAULT_WAREHOUSE_ID'"}' | jq '{lifecycle_state}'
+
+title "Detect changes: etag drift must not be reported"
+echo
+trace $CLI bundle config-remote-sync
+
+title "Save changes: config must not be modified"
+echo
+cp databricks.yml databricks.yml.backup
+trace $CLI bundle config-remote-sync --save
+trace diff.py databricks.yml.backup databricks.yml
+rm databricks.yml.backup
diff --git a/acceptance/bundle/config-remote-sync/dashboard_etag/test.toml b/acceptance/bundle/config-remote-sync/dashboard_etag/test.toml
new file mode 100644
index 00000000000..440f488b0de
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/dashboard_etag/test.toml
@@ -0,0 +1,7 @@
+Cloud = true
+
+RecordRequests = false
+
+Ignore = [".databricks", "databricks.yml", "databricks.yml.backup"]
+
+Env.DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
diff --git a/acceptance/bundle/config-remote-sync/flushed_cache/out.test.toml b/acceptance/bundle/config-remote-sync/flushed_cache/out.test.toml
index 579b1e4a3c9..a4f8dd5ef74 100644
--- a/acceptance/bundle/config-remote-sync/flushed_cache/out.test.toml
+++ b/acceptance/bundle/config-remote-sync/flushed_cache/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 GOOS.windows = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/flushed_cache/output.txt b/acceptance/bundle/config-remote-sync/flushed_cache/output.txt
index 32ded320618..5aa49f3c427 100644
--- a/acceptance/bundle/config-remote-sync/flushed_cache/output.txt
+++ b/acceptance/bundle/config-remote-sync/flushed_cache/output.txt
@@ -1,9 +1,9 @@
 
 === Deploy bundle
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.test_job
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 === Get job ID and modify remote resource
 Modify max_concurrent_runs to 5
@@ -27,5 +27,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/config-remote-sync/flushed_cache/test.toml b/acceptance/bundle/config-remote-sync/flushed_cache/test.toml
index a533046f343..f388c192c90 100644
--- a/acceptance/bundle/config-remote-sync/flushed_cache/test.toml
+++ b/acceptance/bundle/config-remote-sync/flushed_cache/test.toml
@@ -3,13 +3,10 @@ Cloud = true
 RecordRequests = false
 Ignore = [".databricks", "databricks.yml"]
 
-[Env]
-DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
-
-[EnvMatrix]
-DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+Env.DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
 
 # Normalize ls error messages across platforms
+
 [[Repls]]
 Old = "ls: cannot access '\\.databricks': No such file or directory"
 New = "ls: .databricks: No such file or directory"
diff --git a/acceptance/bundle/config-remote-sync/formatting_preserved/out.test.toml b/acceptance/bundle/config-remote-sync/formatting_preserved/out.test.toml
index 579b1e4a3c9..a4f8dd5ef74 100644
--- a/acceptance/bundle/config-remote-sync/formatting_preserved/out.test.toml
+++ b/acceptance/bundle/config-remote-sync/formatting_preserved/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 GOOS.windows = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/formatting_preserved/output.txt b/acceptance/bundle/config-remote-sync/formatting_preserved/output.txt
index 6cba3ca53af..0a63ba22bac 100644
--- a/acceptance/bundle/config-remote-sync/formatting_preserved/output.txt
+++ b/acceptance/bundle/config-remote-sync/formatting_preserved/output.txt
@@ -1,7 +1,7 @@
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.my_job
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 === Modify max_concurrent_runs, description, and add timeout
 === Detect and save changes
@@ -55,5 +55,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/config-remote-sync/formatting_preserved/test.toml b/acceptance/bundle/config-remote-sync/formatting_preserved/test.toml
index 3894d66826c..21cf5f934b3 100644
--- a/acceptance/bundle/config-remote-sync/formatting_preserved/test.toml
+++ b/acceptance/bundle/config-remote-sync/formatting_preserved/test.toml
@@ -3,8 +3,4 @@ Cloud = true
 RecordRequests = false
 Ignore = [".databricks", "dummy.whl", "databricks.yml", "databricks.yml.backup"]
 
-[Env]
-DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
-
-[EnvMatrix]
-DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+Env.DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
diff --git a/acceptance/bundle/config-remote-sync/job_fields/out.test.toml b/acceptance/bundle/config-remote-sync/job_fields/out.test.toml
index 1773f7accf5..a4f8dd5ef74 100644
--- a/acceptance/bundle/config-remote-sync/job_fields/out.test.toml
+++ b/acceptance/bundle/config-remote-sync/job_fields/out.test.toml
@@ -1,5 +1,3 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
 GOOS.windows = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/job_fields/output.txt b/acceptance/bundle/config-remote-sync/job_fields/output.txt
index 56c26de52a1..b932a52aa88 100644
--- a/acceptance/bundle/config-remote-sync/job_fields/output.txt
+++ b/acceptance/bundle/config-remote-sync/job_fields/output.txt
@@ -1,8 +1,8 @@
 Uploading dummy.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.my_job
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 === Modify job fields remotely
 
@@ -58,18 +58,14 @@ Resource: resources.jobs.my_job
 +            - samples.nyctaxi.trips
        environments:
          - environment_key: default
-@@ -25,14 +31,14 @@
+@@ -25,5 +31,5 @@
                - ./*.whl
        job_clusters:
 -        - job_cluster_key: test_cluster
 +        - job_cluster_key: test_cluster_renamed
            new_cluster:
--            spark_version: [[DEFAULT_SPARK_VERSION]]
-             node_type_id: [NODE_TYPE_ID]
-             num_workers: 1
-+            spark_version: [[DEFAULT_SPARK_VERSION]]
-       tasks:
-         - task_key: main
+             spark_version: [DEFAULT_SPARK_VERSION]
+@@ -34,5 +40,5 @@
            notebook_task:
              notebook_path: /Users/{{workspace_user_name}}/notebook
 -          job_cluster_key: test_cluster
@@ -77,7 +73,7 @@ Resource: resources.jobs.my_job
          - task_key: inline_cluster_task
            notebook_task:
 @@ -41,5 +47,7 @@
-             spark_version: [[DEFAULT_SPARK_VERSION]]
+             spark_version: [DEFAULT_SPARK_VERSION]
              node_type_id: [NODE_TYPE_ID]
 -            num_workers: 1
 +            num_workers: 2
@@ -86,11 +82,41 @@ Resource: resources.jobs.my_job
 
  targets:
 
+=== Telemetry
+
+>>> cat [OUTPUT_DIR]/out.requests.txt
+{
+  "save": true,
+  "changes_total": 12,
+  "add_count": 6,
+  "replace_count": 4,
+  "remove_count": 2,
+  "resource_changes": [
+    {
+      "resource_type": "jobs",
+      "changes_count": 12,
+      "add_count": 6,
+      "replace_count": 4,
+      "remove_count": 2
+    }
+  ],
+  "files_changed_count": 1,
+  "files_written_count": 1,
+  "state_serial": 1,
+  "state_lineage": "[UUID]",
+  "state_source": "local",
+  "states_available_count": 2,
+  "state_resource_ids": {
+    "resource_job_ids": [
+      "[MY_JOB_ID]"
+    ]
+  }
+}
+
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
   delete resources.jobs.my_job
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/config-remote-sync/job_fields/script b/acceptance/bundle/config-remote-sync/job_fields/script
index 264304d7345..20653434666 100755
--- a/acceptance/bundle/config-remote-sync/job_fields/script
+++ b/acceptance/bundle/config-remote-sync/job_fields/script
@@ -1,11 +1,13 @@
 #!/bin/bash
 
 envsubst < databricks.yml.tmpl > databricks.yml
-add_repl.py "$DEFAULT_SPARK_VERSION" "[DEFAULT_SPARK_VERSION]"
-add_repl.py "$NODE_TYPE_ID" "[NODE_TYPE_ID]"
+add_repl "$DEFAULT_SPARK_VERSION" DEFAULT_SPARK_VERSION
+add_repl "$NODE_TYPE_ID" NODE_TYPE_ID
 
 cleanup() {
   trace $CLI bundle destroy --auto-approve
+  # destroy records requests too; drop the recorded file so it is not compared.
+  rm -f "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
@@ -63,3 +65,10 @@ title "Configuration changes"
 echo
 trace diff.py databricks.yml.backup databricks.yml
 rm databricks.yml.backup
+
+title "Telemetry"
+echo
+# The engine name is dropped because both EnvMatrix variants share this output;
+# every other counter is engine-agnostic. This run exercises add_count and
+# remove_count (the remote edits add and remove keyed fields).
+trace cat "$OUT_REQUESTS" | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log.bundle_config_remote_sync_event | select(. != null) | del(.engine)'
diff --git a/acceptance/bundle/config-remote-sync/job_fields/test.toml b/acceptance/bundle/config-remote-sync/job_fields/test.toml
index 625c660c617..d0e1bdf6049 100644
--- a/acceptance/bundle/config-remote-sync/job_fields/test.toml
+++ b/acceptance/bundle/config-remote-sync/job_fields/test.toml
@@ -1,11 +1,9 @@
 Cloud = true
-RequiresUnityCatalog = true
 
-RecordRequests = false
+# RecordRequests captures the config-remote-sync telemetry event so the script
+# can assert the per-operation change counts (add_count/remove_count/...).
+# out.requests.txt is removed in the script's cleanup so it is not compared.
+RecordRequests = true
 Ignore = [".databricks", "dummy.whl", "databricks.yml", "databricks.yml.backup"]
 
-[Env]
-DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
-
-[EnvMatrix]
-DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+Env.DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
diff --git a/acceptance/bundle/config-remote-sync/job_multiple_tasks/out.test.toml b/acceptance/bundle/config-remote-sync/job_multiple_tasks/out.test.toml
index 579b1e4a3c9..a4f8dd5ef74 100644
--- a/acceptance/bundle/config-remote-sync/job_multiple_tasks/out.test.toml
+++ b/acceptance/bundle/config-remote-sync/job_multiple_tasks/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 GOOS.windows = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/job_multiple_tasks/output.txt b/acceptance/bundle/config-remote-sync/job_multiple_tasks/output.txt
index 6c45a66bed1..7a7c2464d05 100644
--- a/acceptance/bundle/config-remote-sync/job_multiple_tasks/output.txt
+++ b/acceptance/bundle/config-remote-sync/job_multiple_tasks/output.txt
@@ -1,7 +1,9 @@
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.my_job
+Created jobs.no_tasks_job
+Created jobs.rename_task_job
+Files: 4 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
 
 === Modify c_task, remove d_task, add e_task
 === Detect and save changes
@@ -71,10 +73,8 @@ Resource: resources.jobs.no_tasks_job
 +          task_key: new_task
 
      rename_task_job:
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+
+>>> [CLI] bundle deploy -qq
 
 === Rename b_task, replace a_task notebook_path, add synced_task
 === Detect task key rename
@@ -97,21 +97,14 @@ Resource: resources.jobs.rename_task_job
 >>> diff.py databricks.yml.backup2 databricks.yml
 --- databricks.yml.backup2
 +++ databricks.yml
-@@ -52,14 +52,14 @@
+@@ -52,5 +52,5 @@
      rename_task_job:
        tasks:
 -        - task_key: b_task
-+        - new_cluster:
-+            node_type_id: [NODE_TYPE_ID]
-+            num_workers: 1
-+            spark_version: 13.3.x-snapshot-scala2.12
++        - task_key: b_task_renamed
            notebook_task:
              notebook_path: /Users/{{workspace_user_name}}/b_task
--          new_cluster:
--            spark_version: 13.3.x-snapshot-scala2.12
--            node_type_id: [NODE_TYPE_ID]
--            num_workers: 1
-+          task_key: b_task_renamed
+@@ -61,5 +61,5 @@
          - task_key: d_task
            depends_on:
 -            - task_key: b_task
@@ -152,5 +145,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 3 deleted
diff --git a/acceptance/bundle/config-remote-sync/job_multiple_tasks/script b/acceptance/bundle/config-remote-sync/job_multiple_tasks/script
index f935b4a7564..ff2b7e464ac 100755
--- a/acceptance/bundle/config-remote-sync/job_multiple_tasks/script
+++ b/acceptance/bundle/config-remote-sync/job_multiple_tasks/script
@@ -66,7 +66,7 @@ envsubst < databricks.yml > databricks.yml.resolved
 mv databricks.yml.resolved databricks.yml
 
 # Deploy the updated configuration to sync state
-$CLI bundle deploy
+trace $CLI bundle deploy -qq
 
 title "Rename b_task, replace a_task notebook_path, add synced_task"
 rename_job_id="$(read_id.py rename_task_job)"
diff --git a/acceptance/bundle/config-remote-sync/job_multiple_tasks/test.toml b/acceptance/bundle/config-remote-sync/job_multiple_tasks/test.toml
index c227fcbe565..3c27bbf8319 100644
--- a/acceptance/bundle/config-remote-sync/job_multiple_tasks/test.toml
+++ b/acceptance/bundle/config-remote-sync/job_multiple_tasks/test.toml
@@ -3,8 +3,4 @@ Cloud = true
 RecordRequests = false
 Ignore = [".databricks", "dummy.whl", "databricks.yml", "databricks.yml.backup", "synced_notebook.py"]
 
-[Env]
-DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
-
-[EnvMatrix]
-DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+Env.DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
diff --git a/acceptance/bundle/config-remote-sync/job_params_variables/out.test.toml b/acceptance/bundle/config-remote-sync/job_params_variables/out.test.toml
index 1773f7accf5..a4f8dd5ef74 100644
--- a/acceptance/bundle/config-remote-sync/job_params_variables/out.test.toml
+++ b/acceptance/bundle/config-remote-sync/job_params_variables/out.test.toml
@@ -1,5 +1,3 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
 GOOS.windows = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/job_params_variables/output.txt b/acceptance/bundle/config-remote-sync/job_params_variables/output.txt
index 9d440510f83..53434bb9957 100644
--- a/acceptance/bundle/config-remote-sync/job_params_variables/output.txt
+++ b/acceptance/bundle/config-remote-sync/job_params_variables/output.txt
@@ -1,7 +1,7 @@
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.my_job
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 === Add new parameter remotely
 === Detect and save changes
@@ -31,5 +31,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/config-remote-sync/job_params_variables/test.toml b/acceptance/bundle/config-remote-sync/job_params_variables/test.toml
index 3174477f7d2..8b6c9ef02fc 100644
--- a/acceptance/bundle/config-remote-sync/job_params_variables/test.toml
+++ b/acceptance/bundle/config-remote-sync/job_params_variables/test.toml
@@ -1,11 +1,6 @@
 Cloud = true
-RequiresUnityCatalog = true
 
 RecordRequests = false
 Ignore = [".databricks", "databricks.yml", "databricks.yml.backup"]
 
-[Env]
-DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
-
-[EnvMatrix]
-DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+Env.DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
diff --git a/acceptance/bundle/config-remote-sync/job_pipeline_task/out.test.toml b/acceptance/bundle/config-remote-sync/job_pipeline_task/out.test.toml
index 579b1e4a3c9..a4f8dd5ef74 100644
--- a/acceptance/bundle/config-remote-sync/job_pipeline_task/out.test.toml
+++ b/acceptance/bundle/config-remote-sync/job_pipeline_task/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 GOOS.windows = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/job_pipeline_task/output.txt b/acceptance/bundle/config-remote-sync/job_pipeline_task/output.txt
index 54a1e342788..fe64e7fce6f 100644
--- a/acceptance/bundle/config-remote-sync/job_pipeline_task/output.txt
+++ b/acceptance/bundle/config-remote-sync/job_pipeline_task/output.txt
@@ -1,11 +1,20 @@
+Warning: The "development" property of pipelines is deprecated. Use "mode: development" in your databricks.yml instead. See https://docs.databricks.com/dev-tools/bundles/deployment-modes.
+  at resources.pipelines.my_pipeline.development
+  in databricks.yml:8:20
+
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.my_job
+Created pipelines.my_pipeline
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 === Modify pipeline_task full_refresh to True
 === Modify pipeline continuous to True
 === Detect and save changes
+Warning: The "development" property of pipelines is deprecated. Use "mode: development" in your databricks.yml instead. See https://docs.databricks.com/dev-tools/bundles/deployment-modes.
+  at resources.pipelines.my_pipeline.development
+  in databricks.yml:8:20
+
 Detected changes in 2 resource(s):
 
 Resource: resources.jobs.my_job
@@ -36,15 +45,18 @@ Resource: resources.pipelines.my_pipeline
  targets:
 
 >>> [CLI] bundle destroy --auto-approve
+Warning: The "development" property of pipelines is deprecated. Use "mode: development" in your databricks.yml instead. See https://docs.databricks.com/dev-tools/bundles/deployment-modes.
+  at resources.pipelines.my_pipeline.development
+  in databricks.yml:8:20
+
 The following resources will be deleted:
   delete resources.jobs.my_job
   delete resources.pipelines.my_pipeline
 
 This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
-Streaming Tables (STs) and Materialized Views (MVs) managed by them:
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:
   delete resources.pipelines.my_pipeline
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 2 deleted
diff --git a/acceptance/bundle/config-remote-sync/job_pipeline_task/test.toml b/acceptance/bundle/config-remote-sync/job_pipeline_task/test.toml
index 3894d66826c..21cf5f934b3 100644
--- a/acceptance/bundle/config-remote-sync/job_pipeline_task/test.toml
+++ b/acceptance/bundle/config-remote-sync/job_pipeline_task/test.toml
@@ -3,8 +3,4 @@ Cloud = true
 RecordRequests = false
 Ignore = [".databricks", "dummy.whl", "databricks.yml", "databricks.yml.backup"]
 
-[Env]
-DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
-
-[EnvMatrix]
-DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+Env.DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
diff --git a/acceptance/bundle/config-remote-sync/json_status_missing_state/databricks.yml.tmpl b/acceptance/bundle/config-remote-sync/json_status_missing_state/databricks.yml.tmpl
new file mode 100644
index 00000000000..16d5646d970
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/json_status_missing_state/databricks.yml.tmpl
@@ -0,0 +1,19 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  jobs:
+    test_job:
+      max_concurrent_runs: 1
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/notebook
+          new_cluster:
+            spark_version: $DEFAULT_SPARK_VERSION
+            node_type_id: $NODE_TYPE_ID
+            num_workers: 1
+
+targets:
+  default:
+    mode: development
diff --git a/acceptance/bundle/config-remote-sync/json_status_missing_state/out.test.toml b/acceptance/bundle/config-remote-sync/json_status_missing_state/out.test.toml
new file mode 100644
index 00000000000..a4f8dd5ef74
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/json_status_missing_state/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = true
+GOOS.windows = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/json_status_missing_state/output.txt b/acceptance/bundle/config-remote-sync/json_status_missing_state/output.txt
new file mode 100644
index 00000000000..1afc65091f7
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/json_status_missing_state/output.txt
@@ -0,0 +1,8 @@
+
+=== Terraform removal is reported in JSON with exit 0
+{
+  "status": "failed",
+  "error": "the Terraform deployment engine has been removed in Databricks CLI v1.20.0\n\nUnset the DATABRICKS_BUNDLE_ENGINE environment variable (or set it to \"direct\") to deploy with the direct engine; existing Terraform state is migrated automatically. To keep using Terraform, revert to Databricks CLI v1.19.x.\nSee https://docs.databricks.com/dev-tools/bundles/direct for details",
+  "files": null,
+  "changes": {}
+}
diff --git a/acceptance/bundle/config-remote-sync/json_status_missing_state/script b/acceptance/bundle/config-remote-sync/json_status_missing_state/script
new file mode 100755
index 00000000000..8ce345c169f
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/json_status_missing_state/script
@@ -0,0 +1,9 @@
+#!/bin/bash
+
+envsubst < databricks.yml.tmpl > databricks.yml
+
+# In JSON mode the terraform-removal error is reported inside the payload
+# (status: failed) with exit 0, not as a hard CLI failure.
+title "Terraform removal is reported in JSON with exit 0"
+echo
+errcode $CLI bundle config-remote-sync -o json
diff --git a/acceptance/bundle/config-remote-sync/json_status_missing_state/test.toml b/acceptance/bundle/config-remote-sync/json_status_missing_state/test.toml
new file mode 100644
index 00000000000..a929db1d96e
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/json_status_missing_state/test.toml
@@ -0,0 +1,10 @@
+Cloud = true
+
+RecordRequests = false
+Ignore = [".databricks", "dummy.whl", "databricks.yml"]
+
+Env.DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
+
+# The terraform engine was removed: in JSON mode its rejection is reported in
+# the payload (status failed) with exit 0.
+Env.DATABRICKS_BUNDLE_ENGINE = "terraform"
diff --git a/acceptance/bundle/config-remote-sync/json_status_selectors/databricks.yml.tmpl b/acceptance/bundle/config-remote-sync/json_status_selectors/databricks.yml.tmpl
new file mode 100644
index 00000000000..16d5646d970
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/json_status_selectors/databricks.yml.tmpl
@@ -0,0 +1,19 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  jobs:
+    test_job:
+      max_concurrent_runs: 1
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/notebook
+          new_cluster:
+            spark_version: $DEFAULT_SPARK_VERSION
+            node_type_id: $NODE_TYPE_ID
+            num_workers: 1
+
+targets:
+  default:
+    mode: development
diff --git a/acceptance/bundle/config-remote-sync/json_status_selectors/out.test.toml b/acceptance/bundle/config-remote-sync/json_status_selectors/out.test.toml
new file mode 100644
index 00000000000..a4f8dd5ef74
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/json_status_selectors/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = true
+GOOS.windows = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/json_status_selectors/output.txt b/acceptance/bundle/config-remote-sync/json_status_selectors/output.txt
new file mode 100644
index 00000000000..2b13979059e
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/json_status_selectors/output.txt
@@ -0,0 +1,28 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Created jobs.test_job
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== A selector that matches nothing is reported as skipped, exit 0
+{
+  "status": "skipped",
+  "error": "no deployed jobs resource with id no-such-id-999; deployed jobs ids in state: [TEST_JOB_ID]",
+  "files": null,
+  "changes": {}
+}
+
+=== A malformed selector is reported as failed, exit 0
+{
+  "status": "failed",
+  "error": "invalid --select-ids value \"no-such-id-999\", expected \u003ctype\u003e:\u003cid\u003e (e.g. jobs:123456789)",
+  "files": null,
+  "changes": {}
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.test_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/config-remote-sync/json_status_selectors/script b/acceptance/bundle/config-remote-sync/json_status_selectors/script
new file mode 100755
index 00000000000..a375fd79213
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/json_status_selectors/script
@@ -0,0 +1,23 @@
+#!/bin/bash
+
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+  trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+touch dummy.whl
+$CLI bundle deploy
+job_id="$(read_id.py test_job)"
+
+# In JSON mode the command never fails the process: the outcome is carried in
+# "status" so the workspace caller can tell a benign no-op apart from an error.
+
+title "A selector that matches nothing is reported as skipped, exit 0"
+echo
+errcode $CLI bundle config-remote-sync --select-ids "jobs:no-such-id-999" -o json
+
+title "A malformed selector is reported as failed, exit 0"
+echo
+errcode $CLI bundle config-remote-sync --select-ids "no-such-id-999" -o json
diff --git a/acceptance/bundle/config-remote-sync/json_status_selectors/test.toml b/acceptance/bundle/config-remote-sync/json_status_selectors/test.toml
new file mode 100644
index 00000000000..1f20e9fda75
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/json_status_selectors/test.toml
@@ -0,0 +1,6 @@
+Cloud = true
+
+RecordRequests = false
+Ignore = [".databricks", "dummy.whl", "databricks.yml"]
+
+Env.DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
diff --git a/acceptance/bundle/config-remote-sync/multiple_files/out.test.toml b/acceptance/bundle/config-remote-sync/multiple_files/out.test.toml
index 579b1e4a3c9..a4f8dd5ef74 100644
--- a/acceptance/bundle/config-remote-sync/multiple_files/out.test.toml
+++ b/acceptance/bundle/config-remote-sync/multiple_files/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 GOOS.windows = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/multiple_files/output.txt b/acceptance/bundle/config-remote-sync/multiple_files/output.txt
index aa943ca185a..a8d9965bb8c 100644
--- a/acceptance/bundle/config-remote-sync/multiple_files/output.txt
+++ b/acceptance/bundle/config-remote-sync/multiple_files/output.txt
@@ -1,7 +1,8 @@
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/dev/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.job_one
+Created jobs.job_two
+Files: 8 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 === Modify job_one: max_concurrent_runs, rename c_task
 === Add synced_task to job_one (notebook in sync root, resource in subdirectory)
@@ -32,27 +33,13 @@ Resource: resources.jobs.job_two
 >>> diff.py resources/job1.yml.backup resources/job1.yml
 --- resources/job1.yml.backup
 +++ resources/job1.yml
-@@ -4,13 +4,13 @@
+@@ -4,5 +4,5 @@
        max_concurrent_runs: 1
        tasks:
 -        - task_key: c_task
-+        - depends_on:
-+            - task_key: b_task
-+          new_cluster:
-+            node_type_id: [NODE_TYPE_ID]
-+            num_workers: 1
-+            spark_version: 13.3.x-snapshot-scala2.12
++        - task_key: c_task_renamed
            notebook_task:
              notebook_path: /Users/{{workspace_user_name}}/c_task
--          new_cluster:
--            spark_version: 13.3.x-snapshot-scala2.12
--            node_type_id: [NODE_TYPE_ID]
--            num_workers: 1
--          depends_on:
--            - task_key: b_task
-+          task_key: c_task_renamed
-         - task_key: a_task
-           notebook_task:
 @@ -21,3 +21,10 @@
              num_workers: 1
            depends_on:
@@ -71,26 +58,16 @@ Resource: resources.jobs.job_two
 >>> diff.py resources/job2.yml.backup resources/job2.yml
 --- resources/job2.yml.backup
 +++ resources/job2.yml
-@@ -2,13 +2,13 @@
+@@ -2,7 +2,7 @@
    jobs:
      job_two:
 -      max_concurrent_runs: 2
 +      max_concurrent_runs: 10
        tasks:
 -        - task_key: run_pipeline
-+        - new_cluster:
-+            node_type_id: [NODE_TYPE_ID]
-+            num_workers: 1
-+            spark_version: 13.3.x-snapshot-scala2.12
++        - task_key: run_pipeline_renamed
            notebook_task:
              notebook_path: /Users/{{workspace_user_name}}/1
--          new_cluster:
--            spark_version: 13.3.x-snapshot-scala2.12
--            node_type_id: [NODE_TYPE_ID]
--            num_workers: 1
-+          task_key: run_pipeline_renamed
-         - task_key: etl_pipeline
-           notebook_task:
 @@ -18,5 +18,9 @@
              node_type_id: [NODE_TYPE_ID]
              num_workers: 2
@@ -110,5 +87,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/dev
 
-Deleting files...
-Destroy complete!
+Destroy: 2 deleted
diff --git a/acceptance/bundle/config-remote-sync/multiple_files/test.toml b/acceptance/bundle/config-remote-sync/multiple_files/test.toml
index b8b496456d9..647daee4044 100644
--- a/acceptance/bundle/config-remote-sync/multiple_files/test.toml
+++ b/acceptance/bundle/config-remote-sync/multiple_files/test.toml
@@ -3,8 +3,4 @@ Cloud = true
 RecordRequests = false
 Ignore = [".databricks", "dummy.whl", "databricks.yml", "resources/job1.yml", "resources/job2.yml", "sample_exploration.ipynb"]
 
-[Env]
-DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
-
-[EnvMatrix]
-DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+Env.DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
diff --git a/acceptance/bundle/config-remote-sync/multiple_resources/databricks.yml.tmpl b/acceptance/bundle/config-remote-sync/multiple_resources/databricks.yml.tmpl
index 421e62dc152..1cc53611e12 100644
--- a/acceptance/bundle/config-remote-sync/multiple_resources/databricks.yml.tmpl
+++ b/acceptance/bundle/config-remote-sync/multiple_resources/databricks.yml.tmpl
@@ -53,6 +53,7 @@ resources:
     test_warehouse:
       name: warehouse-$UNIQUE_NAME
       cluster_size: 2X-Small
+      auto_stop_mins: 10
 
 targets:
   default:
diff --git a/acceptance/bundle/config-remote-sync/multiple_resources/out.test.toml b/acceptance/bundle/config-remote-sync/multiple_resources/out.test.toml
index 1773f7accf5..a4f8dd5ef74 100644
--- a/acceptance/bundle/config-remote-sync/multiple_resources/out.test.toml
+++ b/acceptance/bundle/config-remote-sync/multiple_resources/out.test.toml
@@ -1,5 +1,3 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
 GOOS.windows = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/multiple_resources/output.txt b/acceptance/bundle/config-remote-sync/multiple_resources/output.txt
index adaa02f27a9..4cf758aafc7 100644
--- a/acceptance/bundle/config-remote-sync/multiple_resources/output.txt
+++ b/acceptance/bundle/config-remote-sync/multiple_resources/output.txt
@@ -1,7 +1,13 @@
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created clusters.test_cluster
+Created experiments.test_experiment
+Created jobs.job_one
+Created jobs.job_two
+Created registered_models.test_model
+Created sql_warehouses.test_warehouse
+Created volumes.test_volume
+Files: 3 uploaded, 0 deleted
+Resources: 7 created, 0 changed, 0 deleted, 0 unchanged
 
 === Modify both jobs
 === Detect and save changes
@@ -65,5 +71,4 @@ is removed from the catalog, but the underlying files are not deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 7 deleted
diff --git a/acceptance/bundle/config-remote-sync/multiple_resources/script b/acceptance/bundle/config-remote-sync/multiple_resources/script
index ae3b4c486fa..7a89c168d69 100755
--- a/acceptance/bundle/config-remote-sync/multiple_resources/script
+++ b/acceptance/bundle/config-remote-sync/multiple_resources/script
@@ -17,8 +17,8 @@ job_one_id="$(read_id.py job_one)"
 job_two_id="$(read_id.py job_two)"
 
 # Add replacements for dynamic values that appear in server-side defaults
-add_repl.py "$($CLI current-user me | jq -r .id)" "USER_ID"
-add_repl.py "$($CLI metastores current | jq -r .metastore_id)" "METASTORE_ID"
+add_repl "$($CLI current-user me | jq -r .id)" "USER_ID"
+add_repl "$($CLI metastores current | jq -r .metastore_id)" "METASTORE_ID"
 
 title "Modify both jobs"
 edit_resource.py jobs $job_one_id <<EOF
diff --git a/acceptance/bundle/config-remote-sync/multiple_resources/test.toml b/acceptance/bundle/config-remote-sync/multiple_resources/test.toml
index 625c660c617..21cf5f934b3 100644
--- a/acceptance/bundle/config-remote-sync/multiple_resources/test.toml
+++ b/acceptance/bundle/config-remote-sync/multiple_resources/test.toml
@@ -1,11 +1,6 @@
 Cloud = true
-RequiresUnityCatalog = true
 
 RecordRequests = false
 Ignore = [".databricks", "dummy.whl", "databricks.yml", "databricks.yml.backup"]
 
-[Env]
-DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
-
-[EnvMatrix]
-DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+Env.DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
diff --git a/acceptance/bundle/config-remote-sync/output_json/out.test.toml b/acceptance/bundle/config-remote-sync/output_json/out.test.toml
index 579b1e4a3c9..a4f8dd5ef74 100644
--- a/acceptance/bundle/config-remote-sync/output_json/out.test.toml
+++ b/acceptance/bundle/config-remote-sync/output_json/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 GOOS.windows = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/output_json/output.txt b/acceptance/bundle/config-remote-sync/output_json/output.txt
index 29ecfec8b71..6cf6c7b6b05 100644
--- a/acceptance/bundle/config-remote-sync/output_json/output.txt
+++ b/acceptance/bundle/config-remote-sync/output_json/output.txt
@@ -1,9 +1,10 @@
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.test_job
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 === JSON output format{
+  "status": "success",
   "files": [
     {
       "path": "[TEST_TMP_DIR]/databricks.yml",
@@ -31,5 +32,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/config-remote-sync/output_json/test.toml b/acceptance/bundle/config-remote-sync/output_json/test.toml
index 056ad8b30b1..33f2b8d728a 100644
--- a/acceptance/bundle/config-remote-sync/output_json/test.toml
+++ b/acceptance/bundle/config-remote-sync/output_json/test.toml
@@ -3,8 +3,4 @@ Cloud = true
 RecordRequests = false
 Ignore = [".databricks", "dummy.whl", "tmp.json", "databricks.yml"]
 
-[Env]
-DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
-
-[EnvMatrix]
-DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+Env.DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
diff --git a/acceptance/bundle/config-remote-sync/output_no_changes/out.test.toml b/acceptance/bundle/config-remote-sync/output_no_changes/out.test.toml
index 579b1e4a3c9..a4f8dd5ef74 100644
--- a/acceptance/bundle/config-remote-sync/output_no_changes/out.test.toml
+++ b/acceptance/bundle/config-remote-sync/output_no_changes/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 GOOS.windows = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/output_no_changes/output.txt b/acceptance/bundle/config-remote-sync/output_no_changes/output.txt
index 6aa616cbeee..6fc9150af2c 100644
--- a/acceptance/bundle/config-remote-sync/output_no_changes/output.txt
+++ b/acceptance/bundle/config-remote-sync/output_no_changes/output.txt
@@ -1,7 +1,7 @@
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.test_job
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 === Check for changes immediately after deployment
 No changes detected.
@@ -13,6 +13,7 @@ No changes detected.
 
 === JSON output
 {
+  "status": "success",
   "files": null,
   "changes": {}
 }
@@ -23,5 +24,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/config-remote-sync/output_no_changes/test.toml b/acceptance/bundle/config-remote-sync/output_no_changes/test.toml
index 056ad8b30b1..33f2b8d728a 100644
--- a/acceptance/bundle/config-remote-sync/output_no_changes/test.toml
+++ b/acceptance/bundle/config-remote-sync/output_no_changes/test.toml
@@ -3,8 +3,4 @@ Cloud = true
 RecordRequests = false
 Ignore = [".databricks", "dummy.whl", "tmp.json", "databricks.yml"]
 
-[Env]
-DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
-
-[EnvMatrix]
-DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+Env.DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
diff --git a/acceptance/bundle/config-remote-sync/pipeline_fields/out.test.toml b/acceptance/bundle/config-remote-sync/pipeline_fields/out.test.toml
index 1773f7accf5..a4f8dd5ef74 100644
--- a/acceptance/bundle/config-remote-sync/pipeline_fields/out.test.toml
+++ b/acceptance/bundle/config-remote-sync/pipeline_fields/out.test.toml
@@ -1,5 +1,3 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
 GOOS.windows = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/pipeline_fields/output.txt b/acceptance/bundle/config-remote-sync/pipeline_fields/output.txt
index e14b94f76f5..968f42c400b 100644
--- a/acceptance/bundle/config-remote-sync/pipeline_fields/output.txt
+++ b/acceptance/bundle/config-remote-sync/pipeline_fields/output.txt
@@ -1,7 +1,7 @@
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created pipelines.my_pipeline
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 === Modify pipeline fields remotely
 === Detect and save changes
@@ -60,10 +60,9 @@ The following resources will be deleted:
   delete resources.pipelines.my_pipeline
 
 This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
-Streaming Tables (STs) and Materialized Views (MVs) managed by them:
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:
   delete resources.pipelines.my_pipeline
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/config-remote-sync/pipeline_fields/test.toml b/acceptance/bundle/config-remote-sync/pipeline_fields/test.toml
index f307000e067..a311f6bf434 100644
--- a/acceptance/bundle/config-remote-sync/pipeline_fields/test.toml
+++ b/acceptance/bundle/config-remote-sync/pipeline_fields/test.toml
@@ -1,11 +1,6 @@
 Cloud = true
-RequiresUnityCatalog = true
 
 RecordRequests = false
 Ignore = [".databricks", "databricks.yml", "databricks.yml.backup", "pipeline_root"]
 
-[Env]
-DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
-
-[EnvMatrix]
-DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+Env.DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
diff --git a/acceptance/bundle/config-remote-sync/policy_injected_cluster_fields/databricks.yml.tmpl b/acceptance/bundle/config-remote-sync/policy_injected_cluster_fields/databricks.yml.tmpl
new file mode 100644
index 00000000000..62dd2814a7e
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/policy_injected_cluster_fields/databricks.yml.tmpl
@@ -0,0 +1,29 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+targets:
+  default:
+    mode: development
+
+resources:
+  jobs:
+    job1:
+      max_concurrent_runs: 1
+      job_clusters:
+        - job_cluster_key: shared
+          new_cluster:
+            spark_version: $DEFAULT_SPARK_VERSION
+            node_type_id: $NODE_TYPE_ID
+            num_workers: 1
+      tasks:
+        - task_key: shared_cluster_task
+          job_cluster_key: shared
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/notebook
+        - task_key: own_cluster_task
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/notebook
+          new_cluster:
+            spark_version: $DEFAULT_SPARK_VERSION
+            node_type_id: $NODE_TYPE_ID
+            num_workers: 1
diff --git a/acceptance/bundle/config-remote-sync/policy_injected_cluster_fields/out.test.toml b/acceptance/bundle/config-remote-sync/policy_injected_cluster_fields/out.test.toml
new file mode 100644
index 00000000000..a4f8dd5ef74
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/policy_injected_cluster_fields/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = true
+GOOS.windows = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/policy_injected_cluster_fields/output.txt b/acceptance/bundle/config-remote-sync/policy_injected_cluster_fields/output.txt
new file mode 100644
index 00000000000..019b581933a
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/policy_injected_cluster_fields/output.txt
@@ -0,0 +1,37 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Created jobs.job1
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Simulate a cluster policy injecting custom_tags and cluster_log_conf
+These fields exist only remotely (the user never set them in config).
+A legitimate edit (max_concurrent_runs) is made too, to show real edits still sync.
+
+=== Detect and save all changes
+Detected changes in 1 resource(s):
+
+Resource: resources.jobs.job1
+  max_concurrent_runs: replace
+
+
+
+=== Configuration changes
+
+>>> diff.py databricks.yml.backup databricks.yml
+--- databricks.yml.backup
++++ databricks.yml
+@@ -9,5 +9,5 @@
+   jobs:
+     job1:
+-      max_concurrent_runs: 1
++      max_concurrent_runs: 5
+       job_clusters:
+         - job_cluster_key: shared
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.job1
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/config-remote-sync/policy_injected_cluster_fields/script b/acceptance/bundle/config-remote-sync/policy_injected_cluster_fields/script
new file mode 100644
index 00000000000..bcc9844b03f
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/policy_injected_cluster_fields/script
@@ -0,0 +1,44 @@
+#!/bin/bash
+
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+  trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+$CLI bundle deploy
+job1_id="$(read_id.py job1)"
+
+title "Simulate a cluster policy injecting custom_tags and cluster_log_conf"
+echo
+echo "These fields exist only remotely (the user never set them in config)."
+echo "A legitimate edit (max_concurrent_runs) is made too, to show real edits still sync."
+edit_resource.py jobs $job1_id <<'EOF'
+r["max_concurrent_runs"] = 5
+
+# A DBFS destination is used instead of S3: the real backend rejects an S3
+# cluster log destination without a per-cluster instance-profile ARN, and the
+# field's value is irrelevant here — only that it exists remotely and not in config.
+policy_tags = {"CostCenter": "dev-1234", "Team": "finops"}
+policy_log_conf = {"dbfs": {"destination": "dbfs:/cluster-logs/dev"}}
+
+for task in r.get("tasks", []):
+    if "new_cluster" in task:
+        task["new_cluster"]["custom_tags"] = dict(policy_tags)
+        task["new_cluster"]["cluster_log_conf"] = dict(policy_log_conf)
+
+for jc in r.get("job_clusters", []):
+    jc["new_cluster"]["custom_tags"] = dict(policy_tags)
+    jc["new_cluster"]["cluster_log_conf"] = dict(policy_log_conf)
+EOF
+
+title "Detect and save all changes"
+echo
+cp databricks.yml databricks.yml.backup
+$CLI bundle config-remote-sync --save
+
+title "Configuration changes"
+echo
+trace diff.py databricks.yml.backup databricks.yml
+rm databricks.yml.backup
diff --git a/acceptance/bundle/config-remote-sync/policy_injected_cluster_fields/test.toml b/acceptance/bundle/config-remote-sync/policy_injected_cluster_fields/test.toml
new file mode 100644
index 00000000000..8b6c9ef02fc
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/policy_injected_cluster_fields/test.toml
@@ -0,0 +1,6 @@
+Cloud = true
+
+RecordRequests = false
+Ignore = [".databricks", "databricks.yml", "databricks.yml.backup"]
+
+Env.DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
diff --git a/acceptance/bundle/config-remote-sync/resolve_variables/out.test.toml b/acceptance/bundle/config-remote-sync/resolve_variables/out.test.toml
index 1773f7accf5..a4f8dd5ef74 100644
--- a/acceptance/bundle/config-remote-sync/resolve_variables/out.test.toml
+++ b/acceptance/bundle/config-remote-sync/resolve_variables/out.test.toml
@@ -1,5 +1,3 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
 GOOS.windows = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/resolve_variables/output.txt b/acceptance/bundle/config-remote-sync/resolve_variables/output.txt
index 520745de4ed..da1e166f682 100644
--- a/acceptance/bundle/config-remote-sync/resolve_variables/output.txt
+++ b/acceptance/bundle/config-remote-sync/resolve_variables/output.txt
@@ -1,11 +1,20 @@
+Warning: The "development" property of pipelines is deprecated. Use "mode: development" in your databricks.yml instead. See https://docs.databricks.com/dev-tools/bundles/deployment-modes.
+  at resources.pipelines.my_pipeline.development
+  in databricks.yml:34:20
+
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.my_job
+Created pipelines.my_pipeline
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 === Modify pipeline environment dependencies
 === Add and replace parameters remotely
 === Detect and save changes
+Warning: The "development" property of pipelines is deprecated. Use "mode: development" in your databricks.yml instead. See https://docs.databricks.com/dev-tools/bundles/deployment-modes.
+  at resources.pipelines.my_pipeline.development
+  in databricks.yml:34:20
+
 Detected changes in 2 resource(s):
 
 Resource: resources.jobs.my_job
@@ -108,16 +117,60 @@ Resource: resources.pipelines.my_pipeline
 
  targets:
 
+=== Telemetry
+
+>>> cat [OUTPUT_DIR]/out.requests.txt
+{
+  "save": true,
+  "changes_total": 17,
+  "add_count": 10,
+  "replace_count": 6,
+  "remove_count": 1,
+  "resource_changes": [
+    {
+      "resource_type": "jobs",
+      "changes_count": 16,
+      "add_count": 10,
+      "replace_count": 5,
+      "remove_count": 1
+    },
+    {
+      "resource_type": "pipelines",
+      "changes_count": 1,
+      "replace_count": 1
+    }
+  ],
+  "files_changed_count": 1,
+  "files_written_count": 1,
+  "refs_retargeted": 1,
+  "refs_from_siblings": 7,
+  "state_serial": [SERIAL],
+  "state_lineage": "[UUID]",
+  "state_source": "local",
+  "states_available_count": 2,
+  "state_resource_ids": {
+    "resource_job_ids": [
+      "[MY_JOB_ID]"
+    ],
+    "resource_pipeline_ids": [
+      "[MY_PIPELINE_ID]"
+    ]
+  }
+}
+
 >>> [CLI] bundle destroy --auto-approve
+Warning: The "development" property of pipelines is deprecated. Use "mode: development" in your databricks.yml instead. See https://docs.databricks.com/dev-tools/bundles/deployment-modes.
+  at resources.pipelines.my_pipeline.development
+  in databricks.yml:34:20
+
 The following resources will be deleted:
   delete resources.jobs.my_job
   delete resources.pipelines.my_pipeline
 
 This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
-Streaming Tables (STs) and Materialized Views (MVs) managed by them:
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:
   delete resources.pipelines.my_pipeline
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 2 deleted
diff --git a/acceptance/bundle/config-remote-sync/resolve_variables/script b/acceptance/bundle/config-remote-sync/resolve_variables/script
index 449fa9407f2..a3d0edf7468 100755
--- a/acceptance/bundle/config-remote-sync/resolve_variables/script
+++ b/acceptance/bundle/config-remote-sync/resolve_variables/script
@@ -4,6 +4,8 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
   trace $CLI bundle destroy --auto-approve
+  # destroy records requests too; drop the recorded file so it is not compared.
+  rm -f "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
@@ -127,3 +129,11 @@ title "Configuration changes"
 echo
 trace diff.py databricks.yml.backup databricks.yml
 rm databricks.yml.backup
+
+title "Telemetry"
+echo
+# The engine name is dropped because both EnvMatrix variants share this output;
+# every other counter is engine-agnostic. This run exercises refs_retargeted
+# (the env param re-targeted to a different variable) and refs_from_siblings
+# (added params/tasks restored from sibling references).
+trace cat "$OUT_REQUESTS" | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log.bundle_config_remote_sync_event | select(. != null) | del(.engine)'
diff --git a/acceptance/bundle/config-remote-sync/resolve_variables/test.toml b/acceptance/bundle/config-remote-sync/resolve_variables/test.toml
index 3174477f7d2..ab417b9ba5f 100644
--- a/acceptance/bundle/config-remote-sync/resolve_variables/test.toml
+++ b/acceptance/bundle/config-remote-sync/resolve_variables/test.toml
@@ -1,11 +1,18 @@
 Cloud = true
-RequiresUnityCatalog = true
 
-RecordRequests = false
+# RecordRequests captures the config-remote-sync telemetry event so the script
+# can assert the variable-reference restoration counts (refs_retargeted /
+# refs_from_siblings). out.requests.txt is removed in the script's cleanup so it
+# is not compared.
+RecordRequests = true
 Ignore = [".databricks", "databricks.yml", "databricks.yml.backup"]
 
-[Env]
-DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
+Env.DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
 
-[EnvMatrix]
-DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+# The state serial counts state writes, and the terraform path writes more times
+# than the direct path for the same script, so the value differs per engine.
+# The serial is not what this test asserts — normalize it.
+
+[[Repls]]
+Old = '"state_serial": [0-9]+'
+New = '"state_serial": [SERIAL]'
diff --git a/acceptance/bundle/config-remote-sync/select_basic/databricks.yml.tmpl b/acceptance/bundle/config-remote-sync/select_basic/databricks.yml.tmpl
new file mode 100644
index 00000000000..8301740fedd
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/select_basic/databricks.yml.tmpl
@@ -0,0 +1,30 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  jobs:
+    job_one:
+      max_concurrent_runs: 1
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/job1
+          new_cluster:
+            spark_version: $DEFAULT_SPARK_VERSION
+            node_type_id: $NODE_TYPE_ID
+            num_workers: 1
+
+    job_two:
+      max_concurrent_runs: 2
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/job2
+          new_cluster:
+            spark_version: $DEFAULT_SPARK_VERSION
+            node_type_id: $NODE_TYPE_ID
+            num_workers: 1
+
+targets:
+  default:
+    mode: development
diff --git a/acceptance/bundle/config-remote-sync/select_basic/out.test.toml b/acceptance/bundle/config-remote-sync/select_basic/out.test.toml
new file mode 100644
index 00000000000..a4f8dd5ef74
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/select_basic/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = true
+GOOS.windows = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/select_basic/output.txt b/acceptance/bundle/config-remote-sync/select_basic/output.txt
new file mode 100644
index 00000000000..efc4894ccd5
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/select_basic/output.txt
@@ -0,0 +1,87 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Created jobs.job_one
+Created jobs.job_two
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Modify both jobs remotely
+=== Sync only job_one, selected by its type and deployed resource id
+Detected changes in 1 resource(s):
+
+Resource: resources.jobs.job_one
+  max_concurrent_runs: replace
+
+
+
+=== Only job_one is updated; job_two is left untouched
+
+>>> diff.py databricks.yml.backup databricks.yml
+--- databricks.yml.backup
++++ databricks.yml
+@@ -5,5 +5,5 @@
+   jobs:
+     job_one:
+-      max_concurrent_runs: 1
++      max_concurrent_runs: 5
+       tasks:
+         - task_key: main
+
+=== Selecting job_one again is idempotent
+No changes detected.
+
+
+=== Unfiltered sync still detects the job_two drift (no lost updates)
+Detected changes in 1 resource(s):
+
+Resource: resources.jobs.job_two
+  max_concurrent_runs: replace
+
+
+
+=== A stale selector is skipped, not fatal: job_two still syncs alongside it
+Detected changes in 1 resource(s):
+
+Resource: resources.jobs.job_two
+  max_concurrent_runs: replace
+
+
+
+>>> diff.py databricks.yml.backup databricks.yml
+--- databricks.yml.backup
++++ databricks.yml
+@@ -16,5 +16,5 @@
+
+     job_two:
+-      max_concurrent_runs: 2
++      max_concurrent_runs: 10
+       tasks:
+         - task_key: main
+
+=== An unknown resource id alone is rejected (no match at all must not silently succeed)
+
+>>> [CLI] bundle config-remote-sync --select-ids jobs:no-such-id-123
+Error: no deployed jobs resource with id no-such-id-123; deployed jobs ids in state: [JOB_ID], [JOB_ID]
+
+Exit code: 1
+
+=== An id that exists under a different type matches nothing and is rejected too
+
+>>> [CLI] bundle config-remote-sync --select-ids pipelines:[JOB_ONE_ID]
+Error: no deployed pipelines resource with id [JOB_ONE_ID]; the deployment state contains no pipelines resources (deployed resources by type: jobs=2)
+
+Exit code: 1
+
+=== A selector without a type is still rejected
+>>> [CLI] bundle config-remote-sync --select-ids no-such-id-123
+Error: invalid --select-ids value "no-such-id-123", expected <type>:<id> (e.g. jobs:123456789)
+
+Exit code: 1
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.job_one
+  delete resources.jobs.job_two
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/config-remote-sync/select_basic/script b/acceptance/bundle/config-remote-sync/select_basic/script
new file mode 100644
index 00000000000..a85bb0b46a6
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/select_basic/script
@@ -0,0 +1,57 @@
+#!/bin/bash
+
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+  trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+$CLI bundle deploy
+job_one_id="$(read_id.py job_one)"
+job_two_id="$(read_id.py job_two)"
+
+title "Modify both jobs remotely"
+edit_resource.py jobs $job_one_id <<EOF
+r["max_concurrent_runs"] = 5
+EOF
+
+edit_resource.py jobs $job_two_id <<EOF
+r["max_concurrent_runs"] = 10
+EOF
+
+title "Sync only job_one, selected by its type and deployed resource id"
+echo
+cp databricks.yml databricks.yml.backup
+$CLI bundle config-remote-sync --select-ids "jobs:$job_one_id" --save
+
+title "Only job_one is updated; job_two is left untouched"
+echo
+trace diff.py databricks.yml.backup databricks.yml
+rm databricks.yml.backup
+
+title "Selecting job_one again is idempotent"
+echo
+$CLI bundle config-remote-sync --select-ids "jobs:$job_one_id"
+
+title "Unfiltered sync still detects the job_two drift (no lost updates)"
+echo
+$CLI bundle config-remote-sync
+
+title "A stale selector is skipped, not fatal: job_two still syncs alongside it"
+echo
+cp databricks.yml databricks.yml.backup
+$CLI bundle config-remote-sync --select-ids "jobs:no-such-id-123,jobs:$job_two_id" --save
+trace diff.py databricks.yml.backup databricks.yml
+rm databricks.yml.backup
+
+title "An unknown resource id alone is rejected (no match at all must not silently succeed)"
+echo
+errcode trace $CLI bundle config-remote-sync --select-ids jobs:no-such-id-123
+
+title "An id that exists under a different type matches nothing and is rejected too"
+echo
+errcode trace $CLI bundle config-remote-sync --select-ids "pipelines:$job_one_id"
+
+title "A selector without a type is still rejected"
+errcode trace $CLI bundle config-remote-sync --select-ids no-such-id-123
diff --git a/acceptance/bundle/config-remote-sync/select_basic/test.toml b/acceptance/bundle/config-remote-sync/select_basic/test.toml
new file mode 100644
index 00000000000..6708f69069f
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/select_basic/test.toml
@@ -0,0 +1,14 @@
+Cloud = true
+
+RecordRequests = false
+Ignore = [".databricks", "databricks.yml", "databricks.yml.backup"]
+
+Env.DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
+
+# The two job ids are server-assigned, so their sort order in the
+# "deployed jobs ids in state" list varies run to run. Collapse the pair to a
+# single stable token so the expectation stays hermetic.
+
+[[Repls]]
+Old = 'deployed jobs ids in state: \[JOB_(ONE|TWO)_ID\], \[JOB_(ONE|TWO)_ID\]'
+New = 'deployed jobs ids in state: [JOB_ID], [JOB_ID]'
diff --git a/acceptance/bundle/config-remote-sync/select_multiple/databricks.yml.tmpl b/acceptance/bundle/config-remote-sync/select_multiple/databricks.yml.tmpl
new file mode 100644
index 00000000000..f0730ae1680
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/select_multiple/databricks.yml.tmpl
@@ -0,0 +1,41 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  jobs:
+    job_a:
+      max_concurrent_runs: 1
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/job_a
+          new_cluster:
+            spark_version: $DEFAULT_SPARK_VERSION
+            node_type_id: $NODE_TYPE_ID
+            num_workers: 1
+
+    job_b:
+      max_concurrent_runs: 1
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/job_b
+          new_cluster:
+            spark_version: $DEFAULT_SPARK_VERSION
+            node_type_id: $NODE_TYPE_ID
+            num_workers: 1
+
+    job_c:
+      max_concurrent_runs: 1
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/job_c
+          new_cluster:
+            spark_version: $DEFAULT_SPARK_VERSION
+            node_type_id: $NODE_TYPE_ID
+            num_workers: 1
+
+targets:
+  default:
+    mode: development
diff --git a/acceptance/bundle/config-remote-sync/select_multiple/out.test.toml b/acceptance/bundle/config-remote-sync/select_multiple/out.test.toml
new file mode 100644
index 00000000000..a4f8dd5ef74
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/select_multiple/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = true
+GOOS.windows = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/select_multiple/output.txt b/acceptance/bundle/config-remote-sync/select_multiple/output.txt
new file mode 100644
index 00000000000..eb64a611009
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/select_multiple/output.txt
@@ -0,0 +1,75 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Created jobs.job_a
+Created jobs.job_b
+Created jobs.job_c
+Files: 2 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Modify all three jobs remotely
+=== Comma-separated selectors preview two of three resources
+Detected changes in 2 resource(s):
+
+Resource: resources.jobs.job_a
+  max_concurrent_runs: replace
+
+Resource: resources.jobs.job_b
+  max_concurrent_runs: replace
+
+
+
+=== Repeating the same selector dedupes silently
+Detected changes in 1 resource(s):
+
+Resource: resources.jobs.job_c
+  max_concurrent_runs: replace
+
+
+
+=== Save with repeated --select-ids flags
+Detected changes in 2 resource(s):
+
+Resource: resources.jobs.job_a
+  max_concurrent_runs: replace
+
+Resource: resources.jobs.job_b
+  max_concurrent_runs: replace
+
+
+
+=== job_a and job_b are updated, job_c is untouched
+
+>>> diff.py databricks.yml.backup databricks.yml
+--- databricks.yml.backup
++++ databricks.yml
+@@ -5,5 +5,5 @@
+   jobs:
+     job_a:
+-      max_concurrent_runs: 1
++      max_concurrent_runs: 5
+       tasks:
+         - task_key: main
+@@ -16,5 +16,5 @@
+
+     job_b:
+-      max_concurrent_runs: 1
++      max_concurrent_runs: 5
+       tasks:
+         - task_key: main
+
+=== Unfiltered sync still detects the job_c drift
+Detected changes in 1 resource(s):
+
+Resource: resources.jobs.job_c
+  max_concurrent_runs: replace
+
+
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.job_a
+  delete resources.jobs.job_b
+  delete resources.jobs.job_c
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
+
+Destroy: 3 deleted
diff --git a/acceptance/bundle/config-remote-sync/select_multiple/script b/acceptance/bundle/config-remote-sync/select_multiple/script
new file mode 100644
index 00000000000..8eab7443aff
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/select_multiple/script
@@ -0,0 +1,42 @@
+#!/bin/bash
+
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+  trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+$CLI bundle deploy
+job_a_id="$(read_id.py job_a)"
+job_b_id="$(read_id.py job_b)"
+job_c_id="$(read_id.py job_c)"
+
+title "Modify all three jobs remotely"
+for id in $job_a_id $job_b_id $job_c_id; do
+edit_resource.py jobs $id <<EOF
+r["max_concurrent_runs"] = 5
+EOF
+done
+
+title "Comma-separated selectors preview two of three resources"
+echo
+$CLI bundle config-remote-sync --select-ids "jobs:$job_a_id,jobs:$job_b_id"
+
+title "Repeating the same selector dedupes silently"
+echo
+$CLI bundle config-remote-sync --select-ids "jobs:$job_c_id,jobs:$job_c_id"
+
+title "Save with repeated --select-ids flags"
+echo
+cp databricks.yml databricks.yml.backup
+$CLI bundle config-remote-sync --select-ids "jobs:$job_a_id" --select-ids "jobs:$job_b_id" --save
+
+title "job_a and job_b are updated, job_c is untouched"
+echo
+trace diff.py databricks.yml.backup databricks.yml
+rm databricks.yml.backup
+
+title "Unfiltered sync still detects the job_c drift"
+echo
+$CLI bundle config-remote-sync
diff --git a/acceptance/bundle/config-remote-sync/select_multiple/test.toml b/acceptance/bundle/config-remote-sync/select_multiple/test.toml
new file mode 100644
index 00000000000..8b6c9ef02fc
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/select_multiple/test.toml
@@ -0,0 +1,6 @@
+Cloud = true
+
+RecordRequests = false
+Ignore = [".databricks", "databricks.yml", "databricks.yml.backup"]
+
+Env.DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
diff --git a/acceptance/bundle/config-remote-sync/skip_deployment/databricks.yml.tmpl b/acceptance/bundle/config-remote-sync/skip_deployment/databricks.yml.tmpl
new file mode 100644
index 00000000000..2c22bfa5e7a
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/skip_deployment/databricks.yml.tmpl
@@ -0,0 +1,33 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  jobs:
+    my_job:
+      name: test-job-$UNIQUE_NAME
+      description: original description
+      job_clusters:
+        - job_cluster_key: test_cluster
+          new_cluster:
+            spark_version: $DEFAULT_SPARK_VERSION
+            node_type_id: $NODE_TYPE_ID
+            num_workers: 1
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/notebook
+          job_cluster_key: test_cluster
+  pipelines:
+    my_pipeline:
+      name: test-pipeline-$UNIQUE_NAME
+      catalog: main
+      schema: default
+      configuration:
+        key1: value1
+      libraries:
+        - notebook:
+            path: /Users/{{workspace_user_name}}/notebook
+
+targets:
+  default:
+    mode: development
diff --git a/acceptance/bundle/config-remote-sync/skip_deployment/out.test.toml b/acceptance/bundle/config-remote-sync/skip_deployment/out.test.toml
new file mode 100644
index 00000000000..a4f8dd5ef74
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/skip_deployment/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = true
+GOOS.windows = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/skip_deployment/output.txt b/acceptance/bundle/config-remote-sync/skip_deployment/output.txt
new file mode 100644
index 00000000000..620d12c6d22
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/skip_deployment/output.txt
@@ -0,0 +1,50 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Created jobs.my_job
+Created pipelines.my_pipeline
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Modify the CLI-managed deployment metadata and one user field remotely
+
+=== Detect and save changes
+Detected changes in 2 resource(s):
+
+Resource: resources.jobs.my_job
+  description: replace
+
+Resource: resources.pipelines.my_pipeline
+  configuration['key2']: add
+
+
+
+=== Configuration changes
+
+>>> diff.py databricks.yml.backup databricks.yml
+--- databricks.yml.backup
++++ databricks.yml
+@@ -6,5 +6,5 @@
+     my_job:
+       name: test-job-[UNIQUE_NAME]
+-      description: original description
++      description: updated remotely
+       job_clusters:
+         - job_cluster_key: test_cluster
+@@ -25,4 +25,5 @@
+       configuration:
+         key1: value1
++        key2: value2
+       libraries:
+         - notebook:
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.my_job
+  delete resources.pipelines.my_pipeline
+
+This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:
+  delete resources.pipelines.my_pipeline
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/config-remote-sync/skip_deployment/script b/acceptance/bundle/config-remote-sync/skip_deployment/script
new file mode 100755
index 00000000000..532a889fe76
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/skip_deployment/script
@@ -0,0 +1,42 @@
+#!/bin/bash
+
+envsubst < databricks.yml.tmpl > databricks.yml
+add_repl "$DEFAULT_SPARK_VERSION" DEFAULT_SPARK_VERSION
+add_repl "$NODE_TYPE_ID" NODE_TYPE_ID
+
+cleanup() {
+  trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+$CLI bundle deploy
+job_id="$(read_id.py my_job)"
+pipeline_id="$(read_id.py my_pipeline)"
+
+
+title "Modify the CLI-managed deployment metadata and one user field remotely"
+echo
+# deployment.* is rewritten by the CLI on every deploy (metadata.AnnotateJobs /
+# AnnotatePipelines), so config-remote-sync must never sync it back, even when it
+# differs from the local value. The description / configuration edits are the
+# contrast: they are user fields and must still sync, so the diff below shows
+# only them, never deployment.
+edit_resource.py jobs $job_id <<EOF
+r["deployment"]["metadata_file_path"] = "/Workspace/changed/state/metadata.json"
+r["description"] = "updated remotely"
+EOF
+
+edit_resource.py pipelines $pipeline_id <<EOF
+r["deployment"]["metadata_file_path"] = "/Workspace/changed/state/metadata.json"
+r["configuration"]["key2"] = "value2"
+EOF
+
+title "Detect and save changes"
+echo
+cp databricks.yml databricks.yml.backup
+$CLI bundle config-remote-sync --save
+
+title "Configuration changes"
+echo
+trace diff.py databricks.yml.backup databricks.yml
+rm databricks.yml.backup
diff --git a/acceptance/bundle/config-remote-sync/skip_deployment/test.toml b/acceptance/bundle/config-remote-sync/skip_deployment/test.toml
new file mode 100644
index 00000000000..86ffa2fdb9c
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/skip_deployment/test.toml
@@ -0,0 +1,7 @@
+Cloud = true
+
+Ignore = [".databricks", "databricks.yml", "databricks.yml.backup"]
+
+# Enables writing the config-sync state snapshot at deploy time, which the
+# terraform-engine config-remote-sync reads back.
+Env.DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
diff --git a/acceptance/bundle/config-remote-sync/skip_permissions/databricks.yml.tmpl b/acceptance/bundle/config-remote-sync/skip_permissions/databricks.yml.tmpl
new file mode 100644
index 00000000000..74055593627
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/skip_permissions/databricks.yml.tmpl
@@ -0,0 +1,26 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+# Bundle-level permissions are applied to every resource on deploy but have no
+# per-resource YAML node. config-remote-sync must skip the resulting
+# permissions sub-resource instead of failing to resolve it.
+permissions:
+  - level: CAN_MANAGE
+    user_name: ${workspace.current_user.userName}
+
+resources:
+  jobs:
+    my_job:
+      max_concurrent_runs: 1
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/main
+          new_cluster:
+            spark_version: $DEFAULT_SPARK_VERSION
+            node_type_id: $NODE_TYPE_ID
+            num_workers: 1
+
+targets:
+  default:
+    mode: development
diff --git a/acceptance/bundle/config-remote-sync/skip_permissions/out.test.toml b/acceptance/bundle/config-remote-sync/skip_permissions/out.test.toml
new file mode 100644
index 00000000000..a4f8dd5ef74
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/skip_permissions/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = true
+GOOS.windows = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/skip_permissions/output.txt b/acceptance/bundle/config-remote-sync/skip_permissions/output.txt
new file mode 100644
index 00000000000..dd929a13ca0
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/skip_permissions/output.txt
@@ -0,0 +1,38 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Created jobs.my_job
+Created jobs.my_job.permissions
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Add a permission remotely (a change on the permissions sub-resource)
+
+=== Modify a regular job field remotely
+
+=== Sync: permissions are skipped, the regular field change is written
+Detected changes in 1 resource(s):
+
+Resource: resources.jobs.my_job
+  max_concurrent_runs: replace
+
+
+
+=== Configuration changes
+
+>>> diff.py databricks.yml.backup databricks.yml
+--- databricks.yml.backup
++++ databricks.yml
+@@ -12,5 +12,5 @@
+   jobs:
+     my_job:
+-      max_concurrent_runs: 1
++      max_concurrent_runs: 5
+       tasks:
+         - task_key: main
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.my_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/config-remote-sync/skip_permissions/script b/acceptance/bundle/config-remote-sync/skip_permissions/script
new file mode 100644
index 00000000000..585db4a5535
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/skip_permissions/script
@@ -0,0 +1,34 @@
+#!/bin/bash
+
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+  trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+$CLI bundle deploy
+job_id="$(read_id.py my_job)"
+
+title "Add a permission remotely (a change on the permissions sub-resource)"
+echo
+# permissions set replaces the whole ACL, so keep the deploy identity as owner
+# and add a grantee (the built-in "users" group) that is not in config: this
+# makes the permissions sub-resource show a change on the next sync.
+$CLI permissions set jobs $job_id --json '{"access_control_list":[{"permission_level":"IS_OWNER","user_name":"'"$CURRENT_USER_NAME"'"},{"permission_level":"CAN_VIEW","group_name":"users"}]}' > /dev/null
+
+title "Modify a regular job field remotely"
+echo
+edit_resource.py jobs $job_id <<EOF
+r["max_concurrent_runs"] = 5
+EOF
+
+title "Sync: permissions are skipped, the regular field change is written"
+echo
+cp databricks.yml databricks.yml.backup
+$CLI bundle config-remote-sync --save
+
+title "Configuration changes"
+echo
+trace diff.py databricks.yml.backup databricks.yml
+rm databricks.yml.backup
diff --git a/acceptance/bundle/config-remote-sync/skip_permissions/test.toml b/acceptance/bundle/config-remote-sync/skip_permissions/test.toml
new file mode 100644
index 00000000000..8b6c9ef02fc
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/skip_permissions/test.toml
@@ -0,0 +1,6 @@
+Cloud = true
+
+RecordRequests = false
+Ignore = [".databricks", "databricks.yml", "databricks.yml.backup"]
+
+Env.DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
diff --git a/acceptance/bundle/config-remote-sync/split/cli_default_split_element/databricks.yml.tmpl b/acceptance/bundle/config-remote-sync/split/cli_default_split_element/databricks.yml.tmpl
new file mode 100644
index 00000000000..e2aae808876
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/cli_default_split_element/databricks.yml.tmpl
@@ -0,0 +1,32 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+# cluster_id makes OverrideCompute replace each task's compute with
+# existing_cluster_id. It builds that value in Go, so the leaf is present in the
+# merged config but carries no source location -- unlike a field absent from the
+# config, which has no value either. Routing by location therefore finds nothing, and
+# on a task defined in both blocks there is no winning definition to fall back on. The
+# field is not declared anywhere, so writing it is an addition.
+
+resources:
+  jobs:
+    cli_default_job:
+      tasks:
+        - task_key: shared
+          max_retries: 1
+          new_cluster:
+            spark_version: 13.3.x-scala2.12
+            num_workers: 1
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/nb
+
+targets:
+  dev:
+    mode: development
+    cluster_id: 0101-000000-abcd1234
+    resources:
+      jobs:
+        cli_default_job:
+          tasks:
+            - task_key: shared
+              timeout_seconds: 45
diff --git a/acceptance/bundle/config-remote-sync/split/cli_default_split_element/out.test.toml b/acceptance/bundle/config-remote-sync/split/cli_default_split_element/out.test.toml
new file mode 100644
index 00000000000..8c2cb31de53
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/cli_default_split_element/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+GOOS.windows = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/split/cli_default_split_element/output.txt b/acceptance/bundle/config-remote-sync/split/cli_default_split_element/output.txt
new file mode 100644
index 00000000000..ba4ac371822
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/cli_default_split_element/output.txt
@@ -0,0 +1,40 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/dev/files...
+Created jobs.cli_default_job
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== existing_cluster_id is injected by OverrideCompute; the YAML has none
+>>> grep -c existing_cluster_id databricks.yml
+1
+
+=== Edit that locationless field remotely on a two-block task
+=== Sync
+Detected changes in 1 resource(s):
+
+Resource: resources.jobs.cli_default_job
+  tasks[task_key='shared'].existing_cluster_id: add
+
+
+
+=== The field is added to the block declaring the resource
+
+>>> diff.py databricks.yml.backup databricks.yml
+--- databricks.yml.backup
++++ databricks.yml
+@@ -20,4 +20,5 @@
+           notebook_task:
+             notebook_path: /Users/{{workspace_user_name}}/nb
++          existing_cluster_id: 0101-000000-remote1
+
+ targets:
+
+>>> grep -c existing_cluster_id: 0101-000000-remote1 databricks.yml
+1
+
+>>> [CLI] bundle destroy --auto-approve -t dev
+The following resources will be deleted:
+  delete resources.jobs.cli_default_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/dev
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/config-remote-sync/split/cli_default_split_element/script b/acceptance/bundle/config-remote-sync/split/cli_default_split_element/script
new file mode 100644
index 00000000000..a691d865e98
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/cli_default_split_element/script
@@ -0,0 +1,26 @@
+#!/bin/bash
+envsubst < databricks.yml.tmpl > databricks.yml
+cleanup() { trace $CLI bundle destroy --auto-approve -t dev; }
+trap cleanup EXIT
+$CLI bundle deploy -t dev
+job_id="$(read_id.py cli_default_job)"
+
+title "existing_cluster_id is injected by OverrideCompute; the YAML has none"
+errcode trace grep -c "existing_cluster_id" databricks.yml
+
+title "Edit that locationless field remotely on a two-block task"
+edit_resource.py jobs $job_id <<PYEDIT
+for task in r["tasks"]:
+    if task["task_key"] == "shared":
+        task["existing_cluster_id"] = "0101-000000-remote1"
+PYEDIT
+
+title "Sync"
+echo
+cp databricks.yml databricks.yml.backup
+errcode $CLI bundle config-remote-sync -t dev --save
+title "The field is added to the block declaring the resource"
+echo
+trace diff.py databricks.yml.backup databricks.yml
+errcode trace grep -c "existing_cluster_id: 0101-000000-remote1" databricks.yml
+rm databricks.yml.backup
diff --git a/acceptance/bundle/config-remote-sync/split/dotted_target/databricks.yml.tmpl b/acceptance/bundle/config-remote-sync/split/dotted_target/databricks.yml.tmpl
new file mode 100644
index 00000000000..244e7a93eaa
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/dotted_target/databricks.yml.tmpl
@@ -0,0 +1,24 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+# A target name may contain a dot. The write path to an override block is
+# targets.<target>.<field>, which is parsed back into segments, so a dotted name has to
+# be quoted or "dev.eu" becomes two keys and addresses a node that does not exist.
+resources:
+  jobs:
+    dotted_job:
+      tasks:
+        - task_key: main
+          max_retries: 1
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/nb
+
+targets:
+  dev.eu:
+    mode: development
+    resources:
+      jobs:
+        dotted_job:
+          tasks:
+            - task_key: main
+              timeout_seconds: 45
diff --git a/acceptance/bundle/config-remote-sync/split/dotted_target/out.test.toml b/acceptance/bundle/config-remote-sync/split/dotted_target/out.test.toml
new file mode 100644
index 00000000000..8c2cb31de53
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/dotted_target/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+GOOS.windows = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/split/dotted_target/output.txt b/acceptance/bundle/config-remote-sync/split/dotted_target/output.txt
new file mode 100644
index 00000000000..ca7af9375da
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/dotted_target/output.txt
@@ -0,0 +1,32 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/dev.eu/files...
+Created jobs.dotted_job
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Edit a field in the override block of a target whose name contains a dot
+=== Sync
+Detected changes in 1 resource(s):
+
+Resource: resources.jobs.dotted_job
+  tasks[task_key='main'].timeout_seconds: replace
+
+
+
+=== The override block is updated
+
+>>> diff.py databricks.yml.backup databricks.yml
+--- databricks.yml.backup
++++ databricks.yml
+@@ -22,3 +22,3 @@
+           tasks:
+             - task_key: main
+-              timeout_seconds: 45
++              timeout_seconds: 900
+
+>>> [CLI] bundle destroy --auto-approve -t dev.eu
+The following resources will be deleted:
+  delete resources.jobs.dotted_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/dev.eu
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/config-remote-sync/split/dotted_target/script b/acceptance/bundle/config-remote-sync/split/dotted_target/script
new file mode 100644
index 00000000000..c3d05534ab2
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/dotted_target/script
@@ -0,0 +1,22 @@
+#!/bin/bash
+envsubst < databricks.yml.tmpl > databricks.yml
+cleanup() { trace $CLI bundle destroy --auto-approve -t dev.eu; }
+trap cleanup EXIT
+$CLI bundle deploy -t dev.eu
+job_id="$(read_id.py -t dev.eu dotted_job)"
+
+title "Edit a field in the override block of a target whose name contains a dot"
+edit_resource.py jobs $job_id <<PYEDIT
+for task in r["tasks"]:
+    if task["task_key"] == "main":
+        task["timeout_seconds"] = 900
+PYEDIT
+
+title "Sync"
+echo
+cp databricks.yml databricks.yml.backup
+errcode $CLI bundle config-remote-sync -t dev.eu --save
+title "The override block is updated"
+echo
+trace diff.py databricks.yml.backup databricks.yml
+rm databricks.yml.backup
diff --git a/acceptance/bundle/config-remote-sync/split/isolation/databricks.yml.tmpl b/acceptance/bundle/config-remote-sync/split/isolation/databricks.yml.tmpl
new file mode 100644
index 00000000000..c5bc72f02f8
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/isolation/databricks.yml.tmpl
@@ -0,0 +1,34 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+# job_a's task list is split across both blocks and one task, "shared", is defined
+# in both. job_b is an ordinary single-block job.
+#
+# The point of the fixture: an unrelated resource's change must still be applied
+# in the same run as a structural change to a split element. The sync is
+# unattended, so one harder change must never stop the rest.
+resources:
+  jobs:
+    job_a:
+      tasks:
+        - task_key: shared
+          max_retries: 1
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/shared
+
+    job_b:
+      max_concurrent_runs: 1
+      tasks:
+        - task_key: simple
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/simple
+
+targets:
+  dev:
+    mode: development
+    resources:
+      jobs:
+        job_a:
+          tasks:
+            - task_key: shared
+              timeout_seconds: 45
diff --git a/acceptance/bundle/config-remote-sync/split/isolation/out.test.toml b/acceptance/bundle/config-remote-sync/split/isolation/out.test.toml
new file mode 100644
index 00000000000..8c2cb31de53
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/isolation/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+GOOS.windows = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/split/isolation/output.txt b/acceptance/bundle/config-remote-sync/split/isolation/output.txt
new file mode 100644
index 00000000000..f8805d02358
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/isolation/output.txt
@@ -0,0 +1,59 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/dev/files...
+Created jobs.job_a
+Created jobs.job_b
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Rename the two-block task on job_a, and edit job_b in the same run
+=== Sync
+Detected changes in 2 resource(s):
+
+Resource: resources.jobs.job_a
+  tasks[task_key='shared']: remove
+  tasks[task_key='shared_renamed']: add
+
+Resource: resources.jobs.job_b
+  max_concurrent_runs: replace
+
+
+
+=== job_b is updated, and job_a's rename is written in both blocks
+
+>>> diff.py databricks.yml.backup databricks.yml
+--- databricks.yml.backup
++++ databricks.yml
+@@ -12,5 +12,5 @@
+     job_a:
+       tasks:
+-        - task_key: shared
++        - task_key: shared_renamed
+           max_retries: 1
+           notebook_task:
+@@ -18,5 +18,5 @@
+
+     job_b:
+-      max_concurrent_runs: 1
++      max_concurrent_runs: 6
+       tasks:
+         - task_key: simple
+@@ -31,4 +31,4 @@
+         job_a:
+           tasks:
+-            - task_key: shared
++            - task_key: shared_renamed
+               timeout_seconds: 45
+
+>>> grep -c max_concurrent_runs: 6 databricks.yml
+1
+
+>>> grep -c task_key: shared_renamed databricks.yml
+2
+
+>>> [CLI] bundle destroy --auto-approve -t dev
+The following resources will be deleted:
+  delete resources.jobs.job_a
+  delete resources.jobs.job_b
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/dev
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/config-remote-sync/split/isolation/script b/acceptance/bundle/config-remote-sync/split/isolation/script
new file mode 100644
index 00000000000..b1320eed712
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/isolation/script
@@ -0,0 +1,39 @@
+#!/bin/bash
+
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+  trace $CLI bundle destroy --auto-approve -t dev
+}
+trap cleanup EXIT
+
+$CLI bundle deploy -t dev
+job_a_id="$(read_id.py job_a)"
+job_b_id="$(read_id.py job_b)"
+
+
+# A rename of the two-block task on job_a, and a plain scalar edit on job_b, in the
+# SAME run. job_b's edit is independent of anything job_a does, so it must be
+# applied whether or not job_a's rename can be placed.
+title "Rename the two-block task on job_a, and edit job_b in the same run"
+edit_resource.py jobs $job_a_id <<EOF
+for task in r["tasks"]:
+    if task["task_key"] == "shared":
+        task["task_key"] = "shared_renamed"
+EOF
+
+edit_resource.py jobs $job_b_id <<EOF
+r["max_concurrent_runs"] = 6
+EOF
+
+title "Sync"
+echo
+cp databricks.yml databricks.yml.backup
+errcode $CLI bundle config-remote-sync -t dev --save
+
+title "job_b is updated, and job_a's rename is written in both blocks"
+echo
+trace diff.py databricks.yml.backup databricks.yml
+trace grep -c "max_concurrent_runs: 6" databricks.yml
+trace grep -c "task_key: shared_renamed" databricks.yml
+rm databricks.yml.backup
diff --git a/acceptance/bundle/config-remote-sync/split/keyed_edit/databricks.yml.tmpl b/acceptance/bundle/config-remote-sync/split/keyed_edit/databricks.yml.tmpl
new file mode 100644
index 00000000000..85c310e6d50
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/keyed_edit/databricks.yml.tmpl
@@ -0,0 +1,30 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+# The task list of split_job is defined in two physical blocks: the top-level
+# one below and the targets.dev override further down. After loading they merge
+# into one list sorted by task_key, so the merged order is
+#   [alpha (target), mu (top-level), zeta (top-level)]
+# while each physical block keeps its own order. Editing a task must therefore
+# resolve to (file, block, index-within-that-block), not to the merged index.
+resources:
+  jobs:
+    split_job:
+      tasks:
+        - task_key: zeta
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/zeta
+        - task_key: mu
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/mu
+
+targets:
+  dev:
+    mode: development
+    resources:
+      jobs:
+        split_job:
+          tasks:
+            - task_key: alpha
+              notebook_task:
+                notebook_path: /Users/{{workspace_user_name}}/alpha
diff --git a/acceptance/bundle/config-remote-sync/split/keyed_edit/out.test.toml b/acceptance/bundle/config-remote-sync/split/keyed_edit/out.test.toml
new file mode 100644
index 00000000000..8c2cb31de53
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/keyed_edit/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+GOOS.windows = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/split/keyed_edit/output.txt b/acceptance/bundle/config-remote-sync/split/keyed_edit/output.txt
new file mode 100644
index 00000000000..7dd08e2e21c
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/keyed_edit/output.txt
@@ -0,0 +1,52 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/dev/files...
+Created jobs.split_job
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Edit alpha, defined only in the target block
+=== Sync
+Detected changes in 1 resource(s):
+
+Resource: resources.jobs.split_job
+  tasks[task_key='alpha'].timeout_seconds: add
+
+
+
+=== Only alpha in the target block gains timeout_seconds: 111
+
+>>> diff.py databricks.yml.backup databricks.yml
+--- databricks.yml.backup
++++ databricks.yml
+@@ -29,2 +29,3 @@
+               notebook_task:
+                 notebook_path: /Users/{{workspace_user_name}}/alpha
++              timeout_seconds: 111
+
+=== Edit mu, a top-level task that is not first after the merge sort
+=== Sync
+Detected changes in 1 resource(s):
+
+Resource: resources.jobs.split_job
+  tasks[task_key='mu'].timeout_seconds: add
+
+
+
+=== Only mu in the top-level block gains timeout_seconds: 222
+
+>>> diff.py databricks.yml.backup databricks.yml
+--- databricks.yml.backup
++++ databricks.yml
+@@ -18,4 +18,5 @@
+           notebook_task:
+             notebook_path: /Users/{{workspace_user_name}}/mu
++          timeout_seconds: 222
+
+ targets:
+
+>>> [CLI] bundle destroy --auto-approve -t dev
+The following resources will be deleted:
+  delete resources.jobs.split_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/dev
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/config-remote-sync/split/keyed_edit/script b/acceptance/bundle/config-remote-sync/split/keyed_edit/script
new file mode 100644
index 00000000000..dcfc1028455
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/keyed_edit/script
@@ -0,0 +1,53 @@
+#!/bin/bash
+
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+  trace $CLI bundle destroy --auto-approve -t dev
+}
+trap cleanup EXIT
+
+$CLI bundle deploy -t dev
+job_id="$(read_id.py split_job)"
+
+
+# alpha is the only task in the target block, so it must be written at index 0 of
+# that block. Its merged index is also 0, but the top-level block's index 0 is
+# zeta -- a naive merged-index write lands on zeta instead.
+title "Edit alpha, defined only in the target block"
+edit_resource.py jobs $job_id <<EOF
+for task in r["tasks"]:
+    if task["task_key"] == "alpha":
+        task["timeout_seconds"] = 111
+EOF
+
+title "Sync"
+echo
+cp databricks.yml databricks.yml.backup
+errcode $CLI bundle config-remote-sync -t dev --save
+
+title "Only alpha in the target block gains timeout_seconds: 111"
+echo
+trace diff.py databricks.yml.backup databricks.yml
+rm databricks.yml.backup
+
+
+# mu is at merged index 1 but physical index 1 of the top-level block, and zeta
+# (merged index 2) is physical index 0. The merged order and the block order
+# disagree, so writing by merged index edits the wrong task.
+title "Edit mu, a top-level task that is not first after the merge sort"
+edit_resource.py jobs $job_id <<EOF
+for task in r["tasks"]:
+    if task["task_key"] == "mu":
+        task["timeout_seconds"] = 222
+EOF
+
+title "Sync"
+echo
+cp databricks.yml databricks.yml.backup
+errcode $CLI bundle config-remote-sync -t dev --save
+
+title "Only mu in the top-level block gains timeout_seconds: 222"
+echo
+trace diff.py databricks.yml.backup databricks.yml
+rm databricks.yml.backup
diff --git a/acceptance/bundle/config-remote-sync/split/keyed_remove/databricks.yml.tmpl b/acceptance/bundle/config-remote-sync/split/keyed_remove/databricks.yml.tmpl
new file mode 100644
index 00000000000..18e341f0065
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/keyed_remove/databricks.yml.tmpl
@@ -0,0 +1,45 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+# remove_job: gamma/beta live top-level, alpha lives in the target block. The
+# merged order is [alpha, beta, gamma], so the merged indices collide with the
+# physical ones -- removing by merged index deletes the wrong tasks.
+#
+# twoblock_remove_job: "both" is defined in the two blocks at once. Removing it
+# cannot be expressed as "drop it from one scope but keep the merged result", so
+# the sync must leave the source untouched rather than half-deleting it.
+resources:
+  jobs:
+    remove_job:
+      tasks:
+        - task_key: gamma
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/gamma
+        - task_key: beta
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/beta
+
+    twoblock_remove_job:
+      tasks:
+        - task_key: both
+          max_retries: 2
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/both
+        - task_key: keep
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/keep
+
+targets:
+  dev:
+    mode: development
+    resources:
+      jobs:
+        remove_job:
+          tasks:
+            - task_key: alpha
+              notebook_task:
+                notebook_path: /Users/{{workspace_user_name}}/alpha
+        twoblock_remove_job:
+          tasks:
+            - task_key: both
+              timeout_seconds: 30
diff --git a/acceptance/bundle/config-remote-sync/split/keyed_remove/out.test.toml b/acceptance/bundle/config-remote-sync/split/keyed_remove/out.test.toml
new file mode 100644
index 00000000000..8c2cb31de53
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/keyed_remove/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+GOOS.windows = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/split/keyed_remove/output.txt b/acceptance/bundle/config-remote-sync/split/keyed_remove/output.txt
new file mode 100644
index 00000000000..4a9d9bb6657
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/keyed_remove/output.txt
@@ -0,0 +1,87 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/dev/files...
+Created jobs.remove_job
+Created jobs.twoblock_remove_job
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Remove gamma from the top-level block and alpha from the target block
+=== Sync
+Detected changes in 1 resource(s):
+
+Resource: resources.jobs.remove_job
+  tasks[task_key='alpha']: remove
+  tasks[task_key='gamma']: remove
+
+
+
+=== Exactly gamma and alpha are gone; beta survives
+
+>>> diff.py databricks.yml.backup databricks.yml
+--- databricks.yml.backup
++++ databricks.yml
+@@ -13,7 +13,4 @@
+     remove_job:
+       tasks:
+-        - task_key: gamma
+-          notebook_task:
+-            notebook_path: /Users/{{workspace_user_name}}/gamma
+         - task_key: beta
+           notebook_task:
+@@ -36,8 +33,5 @@
+       jobs:
+         remove_job:
+-          tasks:
+-            - task_key: alpha
+-              notebook_task:
+-                notebook_path: /Users/{{workspace_user_name}}/alpha
++          tasks: []
+         twoblock_remove_job:
+           tasks:
+
+=== Remove the task defined in BOTH blocks
+=== Sync
+Detected changes in 1 resource(s):
+
+Resource: resources.jobs.twoblock_remove_job
+  tasks[task_key='both']: remove
+
+
+
+=== 'both' is gone from both blocks; 'keep' survives
+
+>>> diff.py databricks.yml.backup databricks.yml
+--- databricks.yml.backup
++++ databricks.yml
+@@ -19,8 +19,4 @@
+     twoblock_remove_job:
+       tasks:
+-        - task_key: both
+-          max_retries: 2
+-          notebook_task:
+-            notebook_path: /Users/{{workspace_user_name}}/both
+         - task_key: keep
+           notebook_task:
+@@ -35,5 +31,3 @@
+           tasks: []
+         twoblock_remove_job:
+-          tasks:
+-            - task_key: both
+-              timeout_seconds: 30
++          tasks: []
+
+>>> grep -c task_key: both databricks.yml
+0
+
+Exit code: 1
+
+>>> grep -c task_key: keep databricks.yml
+1
+
+>>> [CLI] bundle destroy --auto-approve -t dev
+The following resources will be deleted:
+  delete resources.jobs.remove_job
+  delete resources.jobs.twoblock_remove_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/dev
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/config-remote-sync/split/keyed_remove/script b/acceptance/bundle/config-remote-sync/split/keyed_remove/script
new file mode 100644
index 00000000000..73998fa670b
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/keyed_remove/script
@@ -0,0 +1,54 @@
+#!/bin/bash
+
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+  trace $CLI bundle destroy --auto-approve -t dev
+}
+trap cleanup EXIT
+
+$CLI bundle deploy -t dev
+remove_job_id="$(read_id.py remove_job)"
+twoblock_job_id="$(read_id.py twoblock_remove_job)"
+
+
+# Remove one task from each block in a single run. Exactly gamma and alpha must
+# disappear; beta must survive even though the removals shift indices in both
+# blocks.
+title "Remove gamma from the top-level block and alpha from the target block"
+edit_resource.py jobs $remove_job_id <<EOF
+r["tasks"] = [t for t in r["tasks"] if t["task_key"] not in ("gamma", "alpha")]
+EOF
+
+title "Sync"
+echo
+cp databricks.yml databricks.yml.backup
+errcode $CLI bundle config-remote-sync -t dev --select-ids "jobs:$remove_job_id" --save
+
+title "Exactly gamma and alpha are gone; beta survives"
+echo
+trace diff.py databricks.yml.backup databricks.yml
+rm databricks.yml.backup
+
+
+# "both" is defined in two blocks, so it has a part in each. The merged element
+# only disappears once both parts are gone, so the removal has to be written to
+# both blocks. "keep" must survive in the top-level block.
+title "Remove the task defined in BOTH blocks"
+edit_resource.py jobs $twoblock_job_id <<EOF
+r["tasks"] = [t for t in r["tasks"] if t["task_key"] != "both"]
+EOF
+
+title "Sync"
+echo
+cp databricks.yml databricks.yml.backup
+errcode $CLI bundle config-remote-sync -t dev --select-ids "jobs:$twoblock_job_id" --save
+
+title "'both' is gone from both blocks; 'keep' survives"
+echo
+trace diff.py databricks.yml.backup databricks.yml
+# grep -c exits non-zero on a count of zero, which would abort the script under
+# bash -e before the second assertion runs.
+errcode trace grep -c "task_key: both" databricks.yml
+errcode trace grep -c "task_key: keep" databricks.yml
+rm databricks.yml.backup
diff --git a/acceptance/bundle/config-remote-sync/split/keyed_rename/databricks.yml.tmpl b/acceptance/bundle/config-remote-sync/split/keyed_rename/databricks.yml.tmpl
new file mode 100644
index 00000000000..9648ab01b5c
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/keyed_rename/databricks.yml.tmpl
@@ -0,0 +1,43 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+# "shared" is defined in both blocks: max_retries at the top level and
+# timeout_seconds in the target override. Renaming it must rewrite the key in both
+# places and leave each field in the scope it was written in.
+#
+# "solo" lives only in the target block, and the new keys are chosen so their sort
+# order is the reverse of the block order: "a_shared" sorts before "z_solo", while
+# the top-level block comes before the target block. An implementation that pairs
+# renames by order rather than by identity swaps their contents.
+resources:
+  jobs:
+    rename_job:
+      tasks:
+        - task_key: shared
+          max_retries: 1
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/shared
+
+    # A single block, to check that a removal earlier in the list shifts the
+    # position a later rename has to be written at.
+    shift_job:
+      tasks:
+        - task_key: aaa
+          max_retries: 1
+        - task_key: mmm
+          max_retries: 2
+        - task_key: zzz
+          max_retries: 3
+
+targets:
+  dev:
+    mode: development
+    resources:
+      jobs:
+        rename_job:
+          tasks:
+            - task_key: shared
+              timeout_seconds: 45
+            - task_key: solo
+              notebook_task:
+                notebook_path: /Users/{{workspace_user_name}}/solo
diff --git a/acceptance/bundle/config-remote-sync/split/keyed_rename/out.test.toml b/acceptance/bundle/config-remote-sync/split/keyed_rename/out.test.toml
new file mode 100644
index 00000000000..8c2cb31de53
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/keyed_rename/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+GOOS.windows = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/split/keyed_rename/output.txt b/acceptance/bundle/config-remote-sync/split/keyed_rename/output.txt
new file mode 100644
index 00000000000..80194ffa904
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/keyed_rename/output.txt
@@ -0,0 +1,115 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/dev/files...
+Created jobs.rename_job
+Created jobs.shift_job
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Rename a task defined in both blocks and a target-only task
+=== Sync
+Detected changes in 1 resource(s):
+
+Resource: resources.jobs.rename_job
+  tasks[task_key='a_shared']: add
+  tasks[task_key='shared']: remove
+  tasks[task_key='solo']: remove
+  tasks[task_key='z_solo']: add
+
+
+
+=== Both blocks get the new key; each field keeps its own scope
+
+>>> diff.py databricks.yml.backup databricks.yml
+--- databricks.yml.backup
++++ databricks.yml
+@@ -14,5 +14,5 @@
+     rename_job:
+       tasks:
+-        - task_key: shared
++        - task_key: a_shared
+           max_retries: 1
+           notebook_task:
+@@ -37,7 +37,7 @@
+         rename_job:
+           tasks:
+-            - task_key: shared
++            - task_key: a_shared
+               timeout_seconds: 45
+-            - task_key: solo
++            - task_key: z_solo
+               notebook_task:
+                 notebook_path: /Users/{{workspace_user_name}}/solo
+
+>>> grep -c task_key: a_shared databricks.yml
+2
+
+>>> grep -c task_key: z_solo databricks.yml
+1
+
+=== Remove a task and rename a later one in the same run, single block
+=== Sync
+Detected changes in 1 resource(s):
+
+Resource: resources.jobs.shift_job
+  tasks[task_key='aaa']: remove
+  tasks[task_key='mmm']: remove
+  tasks[task_key='mmm2']: add
+
+
+
+=== aaa is gone, mmm became mmm2, zzz keeps its name and its max_retries
+
+>>> diff.py databricks.yml.backup databricks.yml
+--- databricks.yml.backup
++++ databricks.yml
+@@ -23,7 +23,5 @@
+     shift_job:
+       tasks:
+-        - task_key: aaa
+-          max_retries: 1
+-        - task_key: mmm
++        - task_key: mmm2
+           max_retries: 2
+         - task_key: zzz
+
+>>> grep -c task_key: zzz databricks.yml
+1
+
+=== Rename the two-block task AND edit one of its fields in the same run
+=== Sync
+Detected changes in 1 resource(s):
+
+Resource: resources.jobs.rename_job
+  tasks[task_key='a_shared']: remove
+  tasks[task_key='b_shared']: add
+  tasks[task_key='z_solo']: replace
+
+
+
+=== Left unapplied: the split is intact and timeout_seconds stays target-scoped
+
+>>> diff.py databricks.yml.backup databricks.yml
+--- databricks.yml.backup
++++ databricks.yml
+@@ -37,5 +37,5 @@
+             - task_key: a_shared
+               timeout_seconds: 45
+-            - task_key: z_solo
+-              notebook_task:
++            - notebook_task:
+                 notebook_path: /Users/{{workspace_user_name}}/solo
++              task_key: z_solo
+
+>>> grep -c task_key: a_shared databricks.yml
+2
+
+>>> grep -c timeout_seconds: 45 databricks.yml
+1
+
+>>> [CLI] bundle destroy --auto-approve -t dev
+The following resources will be deleted:
+  delete resources.jobs.rename_job
+  delete resources.jobs.shift_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/dev
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/config-remote-sync/split/keyed_rename/script b/acceptance/bundle/config-remote-sync/split/keyed_rename/script
new file mode 100644
index 00000000000..88b8106ed55
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/keyed_rename/script
@@ -0,0 +1,86 @@
+#!/bin/bash
+
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+  trace $CLI bundle destroy --auto-approve -t dev
+}
+trap cleanup EXIT
+
+$CLI bundle deploy -t dev
+job_id="$(read_id.py rename_job)"
+shift_job_id="$(read_id.py shift_job)"
+
+
+# Rename the two-block task and the target-only task in one run. Each key rewrite
+# has to land on its own element: "a_shared" in both blocks, "z_solo" in the target
+# block only. Their sort order is the reverse of the block order, so pairing by
+# order instead of by identity swaps the two.
+title "Rename a task defined in both blocks and a target-only task"
+edit_resource.py jobs $job_id <<EOF
+for task in r["tasks"]:
+    if task["task_key"] == "shared":
+        task["task_key"] = "a_shared"
+    if task["task_key"] == "solo":
+        task["task_key"] = "z_solo"
+EOF
+
+title "Sync"
+echo
+cp databricks.yml databricks.yml.backup
+errcode $CLI bundle config-remote-sync -t dev --save
+
+title "Both blocks get the new key; each field keeps its own scope"
+echo
+trace diff.py databricks.yml.backup databricks.yml
+errcode trace grep -c "task_key: a_shared" databricks.yml
+errcode trace grep -c "task_key: z_solo" databricks.yml
+rm databricks.yml.backup
+
+
+# A removal earlier in the same block shifts every later element down, so the
+# rename has to be written at the shifted position. Writing the pre-removal index
+# renames the WRONG task and loses the one that was meant to be renamed.
+title "Remove a task and rename a later one in the same run, single block"
+edit_resource.py jobs $shift_job_id <<EOF
+r["tasks"] = [t for t in r["tasks"] if t["task_key"] != "aaa"]
+for task in r["tasks"]:
+    if task["task_key"] == "mmm":
+        task["task_key"] = "mmm2"
+EOF
+
+title "Sync"
+echo
+cp databricks.yml databricks.yml.backup
+errcode $CLI bundle config-remote-sync -t dev --select-ids "jobs:$shift_job_id" --save
+
+title "aaa is gone, mmm became mmm2, zzz keeps its name and its max_retries"
+echo
+trace diff.py databricks.yml.backup databricks.yml
+errcode trace grep -c "task_key: zzz" databricks.yml
+rm databricks.yml.backup
+
+
+# A key change whose element also had a field edited cannot be recognised as one
+# rename, so the halves would route apart: the removal deletes the element from
+# both blocks while the addition recreates it in one, collapsing the split and
+# moving timeout_seconds out of the target scope. It has to be left for a later run.
+title "Rename the two-block task AND edit one of its fields in the same run"
+edit_resource.py jobs $job_id <<EOF
+for task in r["tasks"]:
+    if task["task_key"] == "a_shared":
+        task["task_key"] = "b_shared"
+        task["max_retries"] = 7
+EOF
+
+title "Sync"
+echo
+cp databricks.yml databricks.yml.backup
+errcode $CLI bundle config-remote-sync -t dev --select-ids "jobs:$job_id" --save
+
+title "Left unapplied: the split is intact and timeout_seconds stays target-scoped"
+echo
+trace diff.py databricks.yml.backup databricks.yml
+errcode trace grep -c "task_key: a_shared" databricks.yml
+errcode trace grep -c "timeout_seconds: 45" databricks.yml
+rm databricks.yml.backup
diff --git a/acceptance/bundle/config-remote-sync/split/keyed_twoblock/databricks.yml.tmpl b/acceptance/bundle/config-remote-sync/split/keyed_twoblock/databricks.yml.tmpl
new file mode 100644
index 00000000000..55d7cae8812
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/keyed_twoblock/databricks.yml.tmpl
@@ -0,0 +1,39 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+# "shared" is defined in BOTH blocks: the top-level one carries max_retries and
+# the targets.dev one carries timeout_seconds. Loading merges them into a single
+# element whose fields come from two different physical places, so each field
+# edit has to be routed to the block that actually defines that field.
+#
+# max_retries is set in BOTH blocks, so the target's value is the one that was
+# deployed and the one an edit has to overwrite.
+#
+# "omega" sits after "shared" in the target block. Because "shared" contributes
+# to both blocks its position is easy to miscount, which is what makes editing
+# the plain single-block sibling "omega" the subtle case.
+resources:
+  jobs:
+    twoblock_job:
+      tasks:
+        - task_key: shared
+          max_retries: 1
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/shared
+        - task_key: nu
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/nu
+
+targets:
+  dev:
+    mode: development
+    resources:
+      jobs:
+        twoblock_job:
+          tasks:
+            - task_key: shared
+              max_retries: 2
+              timeout_seconds: 60
+            - task_key: omega
+              notebook_task:
+                notebook_path: /Users/{{workspace_user_name}}/omega
diff --git a/acceptance/bundle/config-remote-sync/split/keyed_twoblock/out.test.toml b/acceptance/bundle/config-remote-sync/split/keyed_twoblock/out.test.toml
new file mode 100644
index 00000000000..8c2cb31de53
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/keyed_twoblock/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+GOOS.windows = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/split/keyed_twoblock/output.txt b/acceptance/bundle/config-remote-sync/split/keyed_twoblock/output.txt
new file mode 100644
index 00000000000..6fde29887a5
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/keyed_twoblock/output.txt
@@ -0,0 +1,63 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/dev/files...
+Created jobs.twoblock_job
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Edit omega, whose sibling is defined in two blocks
+=== Sync
+Detected changes in 1 resource(s):
+
+Resource: resources.jobs.twoblock_job
+  tasks[task_key='omega'].timeout_seconds: add
+
+
+
+=== Only omega changes; shared is untouched in both blocks
+
+>>> diff.py databricks.yml.backup databricks.yml
+--- databricks.yml.backup
++++ databricks.yml
+@@ -38,2 +38,3 @@
+               notebook_task:
+                 notebook_path: /Users/{{workspace_user_name}}/omega
++              timeout_seconds: 303
+
+=== Edit a field per block, a field defined in both, and add a new field
+=== Sync
+Detected changes in 1 resource(s):
+
+Resource: resources.jobs.twoblock_job
+  tasks[task_key='shared'].max_retries: replace
+  tasks[task_key='shared'].min_retry_interval_millis: add
+  tasks[task_key='shared'].timeout_seconds: replace
+
+
+
+=== Each edit lands on the definition that was deployed
+
+>>> diff.py databricks.yml.backup databricks.yml
+--- databricks.yml.backup
++++ databricks.yml
+@@ -21,4 +21,5 @@
+           notebook_task:
+             notebook_path: /Users/{{workspace_user_name}}/shared
++          min_retry_interval_millis: 5000
+         - task_key: nu
+           notebook_task:
+@@ -33,6 +34,6 @@
+           tasks:
+             - task_key: shared
+-              max_retries: 2
+-              timeout_seconds: 60
++              max_retries: 9
++              timeout_seconds: 900
+             - task_key: omega
+               notebook_task:
+
+>>> [CLI] bundle destroy --auto-approve -t dev
+The following resources will be deleted:
+  delete resources.jobs.twoblock_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/dev
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/config-remote-sync/split/keyed_twoblock/script b/acceptance/bundle/config-remote-sync/split/keyed_twoblock/script
new file mode 100644
index 00000000000..2b7d8cf82ce
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/keyed_twoblock/script
@@ -0,0 +1,57 @@
+#!/bin/bash
+
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+  trace $CLI bundle destroy --auto-approve -t dev
+}
+trap cleanup EXIT
+
+$CLI bundle deploy -t dev
+job_id="$(read_id.py twoblock_job)"
+
+
+# omega is defined only in the target block, but its sibling "shared" contributes
+# to both blocks. Editing omega must land on omega and must leave the two-block
+# element completely untouched.
+title "Edit omega, whose sibling is defined in two blocks"
+edit_resource.py jobs $job_id <<EOF
+for task in r["tasks"]:
+    if task["task_key"] == "omega":
+        task["timeout_seconds"] = 303
+EOF
+
+title "Sync"
+echo
+cp databricks.yml databricks.yml.backup
+errcode $CLI bundle config-remote-sync -t dev --save
+
+title "Only omega changes; shared is untouched in both blocks"
+echo
+trace diff.py databricks.yml.backup databricks.yml
+rm databricks.yml.backup
+
+
+# timeout_seconds lives only in the target block, so its edit goes there.
+# max_retries is set in BOTH blocks: the target's value is the deployed one, so
+# that is the definition an edit has to overwrite -- writing the top-level copy
+# instead would leave the effective value unchanged. A brand-new field on the same
+# element must land in a single defined place, not be duplicated across both.
+title "Edit a field per block, a field defined in both, and add a new field"
+edit_resource.py jobs $job_id <<EOF
+for task in r["tasks"]:
+    if task["task_key"] == "shared":
+        task["max_retries"] = 9
+        task["timeout_seconds"] = 900
+        task["min_retry_interval_millis"] = 5000
+EOF
+
+title "Sync"
+echo
+cp databricks.yml databricks.yml.backup
+errcode $CLI bundle config-remote-sync -t dev --save
+
+title "Each edit lands on the definition that was deployed"
+echo
+trace diff.py databricks.yml.backup databricks.yml
+rm databricks.yml.backup
diff --git a/acceptance/bundle/config-remote-sync/split/multifile/databricks.yml.tmpl b/acceptance/bundle/config-remote-sync/split/multifile/databricks.yml.tmpl
new file mode 100644
index 00000000000..f2d063a7889
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/multifile/databricks.yml.tmpl
@@ -0,0 +1,28 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+# One target's override of a single job is spread across two included files.
+# Resource keys are unique across top-level files, but that is not enforced
+# inside the targets subtree, so a target override may legitimately span
+# several files. An edit must land in the exact file that defines the element.
+#
+# "in_both_files" is declared in both override files, so its fields come from two
+# files within the same target scope: max_retries from the first, timeout_seconds
+# from the second. Each field still has one definition, so each edit has one
+# destination.
+#
+# "same_field_both_files" sets max_retries in BOTH override files. Includes are merged
+# in load order, so the later file wins and its value is the one deployed -- note that
+# order is not the alphabetical order of the filenames, so the destination cannot be
+# chosen by sorting them. Writing the losing copy would leave the effective value
+# unchanged and the sync would re-detect the same change on every run.
+include:
+  - overrides/*.yml
+
+resources:
+  jobs:
+    multifile_job:
+      tasks:
+        - task_key: base
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/base
diff --git a/acceptance/bundle/config-remote-sync/split/multifile/out.test.toml b/acceptance/bundle/config-remote-sync/split/multifile/out.test.toml
new file mode 100644
index 00000000000..8c2cb31de53
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/multifile/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+GOOS.windows = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/split/multifile/output.txt b/acceptance/bundle/config-remote-sync/split/multifile/output.txt
new file mode 100644
index 00000000000..de38bd589d1
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/multifile/output.txt
@@ -0,0 +1,97 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/dev/files...
+Created jobs.multifile_job
+Files: 6 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Edit a task defined in the second included file
+=== Sync
+Detected changes in 1 resource(s):
+
+Resource: resources.jobs.multifile_job
+  tasks[task_key='from_second_file'].timeout_seconds: add
+
+
+
+=== databricks.yml is untouched
+
+>>> diff.py databricks.yml.backup databricks.yml
+
+=== overrides/10-first.yml is untouched
+
+>>> diff.py overrides/10-first.yml.backup overrides/10-first.yml
+
+=== overrides/20-second.yml gains timeout_seconds: 777
+
+>>> diff.py overrides/20-second.yml.backup overrides/20-second.yml
+--- overrides/20-second.yml.backup
++++ overrides/20-second.yml
+@@ -8,4 +8,5 @@
+               notebook_task:
+                 notebook_path: /Users/{{workspace_user_name}}/second
++              timeout_seconds: 777
+             - task_key: in_both_files
+               timeout_seconds: 30
+
+=== Edit one field per file on the task declared in both override files
+=== Sync
+Detected changes in 1 resource(s):
+
+Resource: resources.jobs.multifile_job
+  tasks[task_key='in_both_files'].max_retries: replace
+  tasks[task_key='in_both_files'].timeout_seconds: replace
+
+
+
+=== max_retries updates the first file, timeout_seconds the second
+
+>>> diff.py overrides/10-first.yml.backup overrides/10-first.yml
+--- overrides/10-first.yml.backup
++++ overrides/10-first.yml
+@@ -10,5 +10,5 @@
+                 notebook_path: /Users/{{workspace_user_name}}/first
+             - task_key: in_both_files
+-              max_retries: 1
++              max_retries: 9
+             - task_key: same_field_both_files
+               max_retries: 1
+
+>>> diff.py overrides/20-second.yml.backup overrides/20-second.yml
+--- overrides/20-second.yml.backup
++++ overrides/20-second.yml
+@@ -10,5 +10,5 @@
+               timeout_seconds: 777
+             - task_key: in_both_files
+-              timeout_seconds: 30
++              timeout_seconds: 900
+             - task_key: same_field_both_files
+               max_retries: 2
+
+=== Edit a field that both override files define
+=== Sync
+Detected changes in 1 resource(s):
+
+Resource: resources.jobs.multifile_job
+  tasks[task_key='same_field_both_files'].max_retries: replace
+
+
+
+=== The winning file is updated; the shadowed copy is left alone
+
+>>> diff.py overrides/10-first.yml.backup overrides/10-first.yml
+
+>>> diff.py overrides/20-second.yml.backup overrides/20-second.yml
+--- overrides/20-second.yml.backup
++++ overrides/20-second.yml
+@@ -12,3 +12,3 @@
+               timeout_seconds: 900
+             - task_key: same_field_both_files
+-              max_retries: 2
++              max_retries: 9
+
+>>> [CLI] bundle destroy --auto-approve -t dev
+The following resources will be deleted:
+  delete resources.jobs.multifile_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/dev
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/config-remote-sync/split/multifile/overrides/10-first.yml.tmpl b/acceptance/bundle/config-remote-sync/split/multifile/overrides/10-first.yml.tmpl
new file mode 100644
index 00000000000..5f3fdf1ccc5
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/multifile/overrides/10-first.yml.tmpl
@@ -0,0 +1,14 @@
+targets:
+  dev:
+    mode: development
+    resources:
+      jobs:
+        multifile_job:
+          tasks:
+            - task_key: from_first_file
+              notebook_task:
+                notebook_path: /Users/{{workspace_user_name}}/first
+            - task_key: in_both_files
+              max_retries: 1
+            - task_key: same_field_both_files
+              max_retries: 1
diff --git a/acceptance/bundle/config-remote-sync/split/multifile/overrides/20-second.yml.tmpl b/acceptance/bundle/config-remote-sync/split/multifile/overrides/20-second.yml.tmpl
new file mode 100644
index 00000000000..229f449ebf3
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/multifile/overrides/20-second.yml.tmpl
@@ -0,0 +1,13 @@
+targets:
+  dev:
+    resources:
+      jobs:
+        multifile_job:
+          tasks:
+            - task_key: from_second_file
+              notebook_task:
+                notebook_path: /Users/{{workspace_user_name}}/second
+            - task_key: in_both_files
+              timeout_seconds: 30
+            - task_key: same_field_both_files
+              max_retries: 2
diff --git a/acceptance/bundle/config-remote-sync/split/multifile/script b/acceptance/bundle/config-remote-sync/split/multifile/script
new file mode 100644
index 00000000000..4f82441d08e
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/multifile/script
@@ -0,0 +1,92 @@
+#!/bin/bash
+
+envsubst < databricks.yml.tmpl > databricks.yml
+envsubst < overrides/10-first.yml.tmpl > overrides/10-first.yml
+envsubst < overrides/20-second.yml.tmpl > overrides/20-second.yml
+
+cleanup() {
+  trace $CLI bundle destroy --auto-approve -t dev
+}
+trap cleanup EXIT
+
+$CLI bundle deploy -t dev
+job_id="$(read_id.py multifile_job)"
+
+
+# from_second_file is defined in overrides/20-second.yml. The edit must be written
+# to that file only -- not to the top-level databricks.yml and not to the sibling
+# override file, and without creating a duplicate subtree anywhere.
+title "Edit a task defined in the second included file"
+edit_resource.py jobs $job_id <<EOF
+for task in r["tasks"]:
+    if task["task_key"] == "from_second_file":
+        task["timeout_seconds"] = 777
+EOF
+
+title "Sync"
+echo
+cp databricks.yml databricks.yml.backup
+cp overrides/10-first.yml overrides/10-first.yml.backup
+cp overrides/20-second.yml overrides/20-second.yml.backup
+errcode $CLI bundle config-remote-sync -t dev --save
+
+title "databricks.yml is untouched"
+echo
+trace diff.py databricks.yml.backup databricks.yml
+
+title "overrides/10-first.yml is untouched"
+echo
+trace diff.py overrides/10-first.yml.backup overrides/10-first.yml
+
+title "overrides/20-second.yml gains timeout_seconds: 777"
+echo
+trace diff.py overrides/20-second.yml.backup overrides/20-second.yml
+
+rm databricks.yml.backup overrides/10-first.yml.backup overrides/20-second.yml.backup
+
+
+# "in_both_files" has max_retries in the first override file and timeout_seconds in
+# the second, so the two fields of one merged task live in two different files
+# within the same target scope. Each edit has to go to the file that defines that
+# field; writing both to one file would change a value the other file still owns.
+title "Edit one field per file on the task declared in both override files"
+edit_resource.py jobs $job_id <<EOF
+for task in r["tasks"]:
+    if task["task_key"] == "in_both_files":
+        task["max_retries"] = 9
+        task["timeout_seconds"] = 900
+EOF
+
+title "Sync"
+echo
+cp overrides/10-first.yml overrides/10-first.yml.backup
+cp overrides/20-second.yml overrides/20-second.yml.backup
+errcode $CLI bundle config-remote-sync -t dev --save
+
+title "max_retries updates the first file, timeout_seconds the second"
+echo
+trace diff.py overrides/10-first.yml.backup overrides/10-first.yml
+trace diff.py overrides/20-second.yml.backup overrides/20-second.yml
+rm overrides/10-first.yml.backup overrides/20-second.yml.backup
+
+
+# max_retries is set in both override files, so only one of them holds the value that
+# was deployed. The edit has to land there; the other copy is shadowed.
+title "Edit a field that both override files define"
+edit_resource.py jobs $job_id <<PYEDIT
+for task in r["tasks"]:
+    if task["task_key"] == "same_field_both_files":
+        task["max_retries"] = 9
+PYEDIT
+
+title "Sync"
+echo
+cp overrides/10-first.yml overrides/10-first.yml.backup
+cp overrides/20-second.yml overrides/20-second.yml.backup
+errcode $CLI bundle config-remote-sync -t dev --save
+
+title "The winning file is updated; the shadowed copy is left alone"
+echo
+trace diff.py overrides/10-first.yml.backup overrides/10-first.yml
+trace diff.py overrides/20-second.yml.backup overrides/20-second.yml
+rm overrides/10-first.yml.backup overrides/20-second.yml.backup
diff --git a/acceptance/bundle/config-remote-sync/split/nested_add_split_parent/databricks.yml.tmpl b/acceptance/bundle/config-remote-sync/split/nested_add_split_parent/databricks.yml.tmpl
new file mode 100644
index 00000000000..efc32fb7472
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/nested_add_split_parent/databricks.yml.tmpl
@@ -0,0 +1,33 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+# depends_on is a keyed sequence nested inside tasks. "zzz_shared" is defined in both
+# blocks and sorts after the target-only "aaa_target", so it is index 1 in the merged
+# list but index 0 in the top-level block that holds its depends_on.
+#
+# Placing a new depends_on entry means finding the sequence that receives it, and that
+# lookup runs per block -- so the enclosing task index has to be translated first.
+# Probing the merged index inside a block finds nothing, and the addition is dropped.
+resources:
+  jobs:
+    nested_add_job:
+      tasks:
+        - task_key: zzz_shared
+          max_retries: 1
+          depends_on:
+            - task_key: aaa_target
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/nb
+
+targets:
+  dev:
+    mode: development
+    resources:
+      jobs:
+        nested_add_job:
+          tasks:
+            - task_key: aaa_target
+              notebook_task:
+                notebook_path: /Users/{{workspace_user_name}}/nb
+            - task_key: zzz_shared
+              timeout_seconds: 60
diff --git a/acceptance/bundle/config-remote-sync/split/nested_add_split_parent/out.test.toml b/acceptance/bundle/config-remote-sync/split/nested_add_split_parent/out.test.toml
new file mode 100644
index 00000000000..8c2cb31de53
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/nested_add_split_parent/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+GOOS.windows = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/split/nested_add_split_parent/output.txt b/acceptance/bundle/config-remote-sync/split/nested_add_split_parent/output.txt
new file mode 100644
index 00000000000..5b5a85fab57
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/nested_add_split_parent/output.txt
@@ -0,0 +1,42 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/dev/files...
+Created jobs.nested_add_job
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Add a task, then depend on it from the split task zzz_shared
+=== Sync
+Detected changes in 1 resource(s):
+
+Resource: resources.jobs.nested_add_job
+  tasks[task_key='mid_new']: add
+  tasks[task_key='zzz_shared'].depends_on[task_key='mid_new']: add
+
+
+
+=== The dependency lands on zzz_shared, in the block that defines it
+
+>>> diff.py databricks.yml.backup databricks.yml
+--- databricks.yml.backup
++++ databricks.yml
+@@ -17,6 +17,10 @@
+           depends_on:
+             - task_key: aaa_target
++            - task_key: mid_new
+           notebook_task:
+             notebook_path: /Users/{{workspace_user_name}}/nb
++        - notebook_task:
++            notebook_path: /Users/{{workspace_user_name}}/nb
++          task_key: mid_new
+
+ targets:
+
+>>> grep -c task_key: mid_new databricks.yml
+2
+
+>>> [CLI] bundle destroy --auto-approve -t dev
+The following resources will be deleted:
+  delete resources.jobs.nested_add_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/dev
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/config-remote-sync/split/nested_add_split_parent/script b/acceptance/bundle/config-remote-sync/split/nested_add_split_parent/script
new file mode 100644
index 00000000000..cc23a266e2a
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/nested_add_split_parent/script
@@ -0,0 +1,25 @@
+#!/bin/bash
+envsubst < databricks.yml.tmpl > databricks.yml
+cleanup() { trace $CLI bundle destroy --auto-approve -t dev; }
+trap cleanup EXIT
+$CLI bundle deploy -t dev
+job_id="$(read_id.py nested_add_job)"
+
+title "Add a task, then depend on it from the split task zzz_shared"
+edit_resource.py jobs $job_id <<PYEDIT
+r["tasks"].append({"task_key": "mid_new",
+                   "notebook_task": {"notebook_path": "/Users/{{workspace_user_name}}/nb"}})
+for task in r["tasks"]:
+    if task["task_key"] == "zzz_shared":
+        task["depends_on"].append({"task_key": "mid_new"})
+PYEDIT
+
+title "Sync"
+echo
+cp databricks.yml databricks.yml.backup
+errcode $CLI bundle config-remote-sync -t dev --save
+title "The dependency lands on zzz_shared, in the block that defines it"
+echo
+trace diff.py databricks.yml.backup databricks.yml
+errcode trace grep -c "task_key: mid_new" databricks.yml
+rm databricks.yml.backup
diff --git a/acceptance/bundle/config-remote-sync/split/nested_sequence/databricks.yml.tmpl b/acceptance/bundle/config-remote-sync/split/nested_sequence/databricks.yml.tmpl
new file mode 100644
index 00000000000..afee7a28aef
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/nested_sequence/databricks.yml.tmpl
@@ -0,0 +1,32 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+# libraries is a sequence nested inside tasks, which is itself a sequence. "second" is
+# not the first task, so its position differs between the merged list and the physical
+# block once the target block contributes a task that sorts ahead of it. Adding a
+# library therefore has to translate the enclosing task's index before it can find the
+# receiving sequence.
+resources:
+  jobs:
+    nested_job:
+      tasks:
+        - task_key: first
+          libraries:
+            - pypi:
+                package: requests
+        - task_key: second
+          libraries:
+            - pypi:
+                package: urllib3
+
+targets:
+  dev:
+    mode: development
+    resources:
+      jobs:
+        nested_job:
+          tasks:
+            - task_key: aaa_sorts_first
+              libraries:
+                - pypi:
+                    package: certifi
diff --git a/acceptance/bundle/config-remote-sync/split/nested_sequence/out.test.toml b/acceptance/bundle/config-remote-sync/split/nested_sequence/out.test.toml
new file mode 100644
index 00000000000..8c2cb31de53
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/nested_sequence/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+GOOS.windows = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/split/nested_sequence/output.txt b/acceptance/bundle/config-remote-sync/split/nested_sequence/output.txt
new file mode 100644
index 00000000000..0074cfeafce
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/nested_sequence/output.txt
@@ -0,0 +1,37 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/dev/files...
+Created jobs.nested_job
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Add a library to a task that is not first after the merge sort
+=== Sync
+Detected changes in 1 resource(s):
+
+Resource: resources.jobs.nested_job
+  tasks[task_key='second'].libraries: replace
+
+
+
+=== The new library lands on the task that received it
+
+>>> diff.py databricks.yml.backup databricks.yml
+--- databricks.yml.backup
++++ databricks.yml
+@@ -19,4 +19,6 @@
+             - pypi:
+                 package: urllib3
++            - pypi:
++                package: pyyaml
+
+ targets:
+
+>>> grep -c pyyaml databricks.yml
+1
+
+>>> [CLI] bundle destroy --auto-approve -t dev
+The following resources will be deleted:
+  delete resources.jobs.nested_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/dev
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/config-remote-sync/split/nested_sequence/script b/acceptance/bundle/config-remote-sync/split/nested_sequence/script
new file mode 100644
index 00000000000..26d26468995
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/nested_sequence/script
@@ -0,0 +1,33 @@
+#!/bin/bash
+
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+  trace $CLI bundle destroy --auto-approve -t dev
+}
+trap cleanup EXIT
+
+$CLI bundle deploy -t dev
+job_id="$(read_id.py nested_job)"
+
+
+# Add an element to a sequence nested inside another sequence. The enclosing task sits
+# at a different index in the merged list than in the block it is written in, so the
+# outer index has to be translated before the receiving sequence can be found.
+title "Add a library to a task that is not first after the merge sort"
+edit_resource.py jobs $job_id <<PYEDIT
+for task in r["tasks"]:
+    if task["task_key"] == "second":
+        task["libraries"].append({"pypi": {"package": "pyyaml"}})
+PYEDIT
+
+title "Sync"
+echo
+cp databricks.yml databricks.yml.backup
+errcode $CLI bundle config-remote-sync -t dev --save
+
+title "The new library lands on the task that received it"
+echo
+trace diff.py databricks.yml.backup databricks.yml
+errcode trace grep -c "pyyaml" databricks.yml
+rm databricks.yml.backup
diff --git a/acceptance/bundle/config-remote-sync/split/positional/databricks.yml.tmpl b/acceptance/bundle/config-remote-sync/split/positional/databricks.yml.tmpl
new file mode 100644
index 00000000000..298d66f9625
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/positional/databricks.yml.tmpl
@@ -0,0 +1,30 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+# Pipeline clusters are NOT registered as a keyed slice, so they diff by
+# POSITION rather than by key: change paths arrive as clusters[N], and a
+# structural change can arrive as a replacement of the whole list. The list is
+# still split across the top-level block and the targets.dev override, so a
+# merged index has to be mapped to an index inside one physical block.
+resources:
+  pipelines:
+    split_pipeline:
+      name: test-pipeline-$UNIQUE_NAME
+      catalog: main
+      schema: default
+      clusters:
+        - label: default
+          num_workers: 2
+      libraries:
+        - notebook:
+            path: /Users/{{workspace_user_name}}/notebook
+
+targets:
+  dev:
+    mode: development
+    resources:
+      pipelines:
+        split_pipeline:
+          clusters:
+            - label: maintenance
+              num_workers: 1
diff --git a/acceptance/bundle/config-remote-sync/split/positional/out.test.toml b/acceptance/bundle/config-remote-sync/split/positional/out.test.toml
new file mode 100644
index 00000000000..8c2cb31de53
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/positional/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+GOOS.windows = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/split/positional/output.txt b/acceptance/bundle/config-remote-sync/split/positional/output.txt
new file mode 100644
index 00000000000..9516f90baa0
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/positional/output.txt
@@ -0,0 +1,73 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/dev/files...
+Created pipelines.split_pipeline
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Edit num_workers on the top-level cluster and on the target cluster
+=== Sync
+Detected changes in 1 resource(s):
+
+Resource: resources.pipelines.split_pipeline
+  clusters[0].num_workers: replace
+  clusters[1].num_workers: replace
+
+
+
+=== default updates top-level, maintenance updates the target block
+
+>>> diff.py databricks.yml.backup databricks.yml
+--- databricks.yml.backup
++++ databricks.yml
+@@ -15,5 +15,5 @@
+       clusters:
+         - label: default
+-          num_workers: 2
++          num_workers: 5
+       libraries:
+         - notebook:
+@@ -28,3 +28,3 @@
+           clusters:
+             - label: maintenance
+-              num_workers: 1
++              num_workers: 3
+
+=== Remove the target-block cluster (length change)
+=== Sync
+Detected changes in 1 resource(s):
+
+Resource: resources.pipelines.split_pipeline
+  clusters: replace
+  clusters[1].num_workers: remove
+
+
+
+=== The top-level cluster is untouched; the target entry is left as a remnant
+
+>>> diff.py databricks.yml.backup databricks.yml
+--- databricks.yml.backup
++++ databricks.yml
+@@ -28,3 +28,2 @@
+           clusters:
+             - label: maintenance
+-              num_workers: 3
+
+>>> grep -c label: default databricks.yml
+1
+
+>>> grep -c label: maintenance databricks.yml
+1
+
+>>> grep -c num_workers databricks.yml
+1
+
+>>> [CLI] bundle destroy --auto-approve -t dev
+The following resources will be deleted:
+  delete resources.pipelines.split_pipeline
+
+This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:
+  delete resources.pipelines.split_pipeline
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/dev
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/config-remote-sync/split/positional/script b/acceptance/bundle/config-remote-sync/split/positional/script
new file mode 100644
index 00000000000..fa7b1d54db1
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/positional/script
@@ -0,0 +1,60 @@
+#!/bin/bash
+
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+  trace $CLI bundle destroy --auto-approve -t dev
+}
+trap cleanup EXIT
+
+$CLI bundle deploy -t dev
+pipeline_id="$(read_id.py split_pipeline)"
+
+
+# Length-preserving field edits on both elements of a positional list that is
+# split across two blocks. Each edit must land in its own block.
+title "Edit num_workers on the top-level cluster and on the target cluster"
+edit_resource.py pipelines $pipeline_id <<EOF
+for cluster in r["clusters"]:
+    if cluster["label"] == "default":
+        cluster["num_workers"] = 5
+    if cluster["label"] == "maintenance":
+        cluster["num_workers"] = 3
+EOF
+
+title "Sync"
+echo
+cp databricks.yml databricks.yml.backup
+errcode $CLI bundle config-remote-sync -t dev --save
+
+title "default updates top-level, maintenance updates the target block"
+echo
+trace diff.py databricks.yml.backup databricks.yml
+rm databricks.yml.backup
+
+
+# A length change on a split positional list. Pipeline clusters carry no keyed-slice
+# registration, so they diff by index and a removal arrives as field-level deletes
+# rather than as the removal of an element. The surviving top-level cluster must be
+# untouched.
+#
+# KNOWN GAP: the removal strips the target cluster's fields but leaves the
+# "- label: maintenance" entry behind, so the element is not actually removed. The
+# grep below records that remnant rather than asserting it away.
+title "Remove the target-block cluster (length change)"
+edit_resource.py pipelines $pipeline_id <<EOF
+r["clusters"] = [c for c in r["clusters"] if c["label"] != "maintenance"]
+EOF
+
+title "Sync"
+echo
+cp databricks.yml databricks.yml.backup
+errcode $CLI bundle config-remote-sync -t dev --save
+
+title "The top-level cluster is untouched; the target entry is left as a remnant"
+echo
+trace diff.py databricks.yml.backup databricks.yml
+errcode trace grep -c "label: default" databricks.yml
+errcode trace grep -c "label: maintenance" databricks.yml
+errcode trace grep -c "num_workers" databricks.yml
+rm databricks.yml.backup
diff --git a/acceptance/bundle/config-remote-sync/split/remove_field_both_blocks/databricks.yml.tmpl b/acceptance/bundle/config-remote-sync/split/remove_field_both_blocks/databricks.yml.tmpl
new file mode 100644
index 00000000000..7f8de9c8476
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/remove_field_both_blocks/databricks.yml.tmpl
@@ -0,0 +1,26 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+# max_retries is defined in BOTH blocks. An edit only has to reach the definition that
+# wins the merge, but a removal has to reach every copy: deleting only the winner lets
+# the shadowed copy take effect, so the next deploy restores the value the user just
+# removed in the UI.
+
+resources:
+  jobs:
+    shared_field_job:
+      tasks:
+        - task_key: shared
+          max_retries: 1
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/nb
+
+targets:
+  dev:
+    mode: development
+    resources:
+      jobs:
+        shared_field_job:
+          tasks:
+            - task_key: shared
+              max_retries: 5
diff --git a/acceptance/bundle/config-remote-sync/split/remove_field_both_blocks/out.test.toml b/acceptance/bundle/config-remote-sync/split/remove_field_both_blocks/out.test.toml
new file mode 100644
index 00000000000..8c2cb31de53
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/remove_field_both_blocks/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+GOOS.windows = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/split/remove_field_both_blocks/output.txt b/acceptance/bundle/config-remote-sync/split/remove_field_both_blocks/output.txt
new file mode 100644
index 00000000000..83af06feaba
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/remove_field_both_blocks/output.txt
@@ -0,0 +1,40 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/dev/files...
+Created jobs.shared_field_job
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Remove max_retries, which both blocks define
+=== Sync
+Detected changes in 1 resource(s):
+
+Resource: resources.jobs.shared_field_job
+  tasks[task_key='shared'].max_retries: remove
+
+
+
+=== Both copies must be gone, else the next deploy pushes the value back
+
+>>> diff.py databricks.yml.backup databricks.yml
+--- databricks.yml.backup
++++ databricks.yml
+@@ -12,5 +12,4 @@
+       tasks:
+         - task_key: shared
+-          max_retries: 1
+           notebook_task:
+             notebook_path: /Users/{{workspace_user_name}}/nb
+@@ -24,3 +23,2 @@
+           tasks:
+             - task_key: shared
+-              max_retries: 5
+
+>>> grep -c max_retries databricks.yml
+1
+
+>>> [CLI] bundle destroy --auto-approve -t dev
+The following resources will be deleted:
+  delete resources.jobs.shared_field_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/dev
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/config-remote-sync/split/remove_field_both_blocks/script b/acceptance/bundle/config-remote-sync/split/remove_field_both_blocks/script
new file mode 100644
index 00000000000..876cb123a51
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/remove_field_both_blocks/script
@@ -0,0 +1,23 @@
+#!/bin/bash
+envsubst < databricks.yml.tmpl > databricks.yml
+cleanup() { trace $CLI bundle destroy --auto-approve -t dev; }
+trap cleanup EXIT
+$CLI bundle deploy -t dev
+job_id="$(read_id.py shared_field_job)"
+
+title "Remove max_retries, which both blocks define"
+edit_resource.py jobs $job_id <<PYEDIT
+for task in r["tasks"]:
+    if task["task_key"] == "shared":
+        task.pop("max_retries", None)
+PYEDIT
+
+title "Sync"
+echo
+cp databricks.yml databricks.yml.backup
+errcode $CLI bundle config-remote-sync -t dev --save
+title "Both copies must be gone, else the next deploy pushes the value back"
+echo
+trace diff.py databricks.yml.backup databricks.yml
+errcode trace grep -c "max_retries" databricks.yml
+rm databricks.yml.backup
diff --git a/acceptance/bundle/config-remote-sync/split/remove_with_unrelated_add/databricks.yml.tmpl b/acceptance/bundle/config-remote-sync/split/remove_with_unrelated_add/databricks.yml.tmpl
new file mode 100644
index 00000000000..6d9004d3afe
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/remove_with_unrelated_add/databricks.yml.tmpl
@@ -0,0 +1,30 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+# "shared" is defined in both blocks, so removing it is held back: the halves of a
+# suspected key change cannot be told apart from a removal plus an unrelated addition.
+# That hold-back must not extend to an addition that is genuinely unrelated -- a brand
+# new task in the same sequence is not the other half of anything.
+
+resources:
+  jobs:
+    unrelated_add_job:
+      tasks:
+        - task_key: shared
+          max_retries: 1
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/nb
+        - task_key: keep
+          max_retries: 2
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/nb
+
+targets:
+  dev:
+    mode: development
+    resources:
+      jobs:
+        unrelated_add_job:
+          tasks:
+            - task_key: shared
+              timeout_seconds: 45
diff --git a/acceptance/bundle/config-remote-sync/split/remove_with_unrelated_add/out.test.toml b/acceptance/bundle/config-remote-sync/split/remove_with_unrelated_add/out.test.toml
new file mode 100644
index 00000000000..8c2cb31de53
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/remove_with_unrelated_add/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+GOOS.windows = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/split/remove_with_unrelated_add/output.txt b/acceptance/bundle/config-remote-sync/split/remove_with_unrelated_add/output.txt
new file mode 100644
index 00000000000..0da6b78b7d9
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/remove_with_unrelated_add/output.txt
@@ -0,0 +1,52 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/dev/files...
+Created jobs.unrelated_add_job
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Remove the two-block task AND add an unrelated new task in one run
+=== Sync
+Detected changes in 1 resource(s):
+
+Resource: resources.jobs.unrelated_add_job
+  tasks[task_key='brand_new']: add
+  tasks[task_key='shared']: remove
+
+
+
+=== brand_new is added even though the removal of shared was held back
+
+>>> diff.py databricks.yml.backup databricks.yml
+--- databricks.yml.backup
++++ databricks.yml
+@@ -11,8 +11,8 @@
+     unrelated_add_job:
+       tasks:
+-        - task_key: shared
+-          max_retries: 1
++        - max_retries: 9
+           notebook_task:
+             notebook_path: /Users/{{workspace_user_name}}/nb
++          task_key: brand_new
+         - task_key: keep
+           max_retries: 2
+@@ -26,5 +26,3 @@
+       jobs:
+         unrelated_add_job:
+-          tasks:
+-            - task_key: shared
+-              timeout_seconds: 45
++          tasks: []
+
+>>> grep -c task_key: brand_new databricks.yml
+1
+
+>>> grep -c task_key: keep databricks.yml
+1
+
+>>> [CLI] bundle destroy --auto-approve -t dev
+The following resources will be deleted:
+  delete resources.jobs.unrelated_add_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/dev
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/config-remote-sync/split/remove_with_unrelated_add/script b/acceptance/bundle/config-remote-sync/split/remove_with_unrelated_add/script
new file mode 100644
index 00000000000..26f73be2078
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/remove_with_unrelated_add/script
@@ -0,0 +1,26 @@
+#!/bin/bash
+envsubst < databricks.yml.tmpl > databricks.yml
+cleanup() { trace $CLI bundle destroy --auto-approve -t dev; }
+trap cleanup EXIT
+$CLI bundle deploy -t dev
+job_id="$(read_id.py unrelated_add_job)"
+
+# The removal of the two-block element is expected to be held back. brand_new shares
+# nothing with it but the sequence, so it has to be applied in the same run.
+title "Remove the two-block task AND add an unrelated new task in one run"
+edit_resource.py jobs $job_id <<PYEDIT
+r["tasks"] = [t for t in r["tasks"] if t["task_key"] != "shared"]
+r["tasks"].append({"task_key": "brand_new", "max_retries": 9,
+                   "notebook_task": {"notebook_path": "/Users/{{workspace_user_name}}/nb"}})
+PYEDIT
+
+title "Sync"
+echo
+cp databricks.yml databricks.yml.backup
+errcode $CLI bundle config-remote-sync -t dev --save
+title "brand_new is added even though the removal of shared was held back"
+echo
+trace diff.py databricks.yml.backup databricks.yml
+errcode trace grep -c "task_key: brand_new" databricks.yml
+errcode trace grep -c "task_key: keep" databricks.yml
+rm databricks.yml.backup
diff --git a/acceptance/bundle/config-remote-sync/split/rename_ambiguous_pairing/databricks.yml.tmpl b/acceptance/bundle/config-remote-sync/split/rename_ambiguous_pairing/databricks.yml.tmpl
new file mode 100644
index 00000000000..f2f0e488331
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/rename_ambiguous_pairing/databricks.yml.tmpl
@@ -0,0 +1,28 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+# Two tasks with IDENTICAL bodies, one per block. Renaming both in one run yields two
+# removes that each match both adds, so the change set does not say which new key
+# belongs to which element. Guessing crosses them: a key lands in the other element's
+# block, and anything referring to a task by key points at the wrong one.
+
+resources:
+  jobs:
+    ambiguous_rename_job:
+      tasks:
+        - task_key: alpha
+          max_retries: 3
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/nb
+
+targets:
+  dev:
+    mode: development
+    resources:
+      jobs:
+        ambiguous_rename_job:
+          tasks:
+            - task_key: beta
+              max_retries: 3
+              notebook_task:
+                notebook_path: /Users/{{workspace_user_name}}/nb
diff --git a/acceptance/bundle/config-remote-sync/split/rename_ambiguous_pairing/out.test.toml b/acceptance/bundle/config-remote-sync/split/rename_ambiguous_pairing/out.test.toml
new file mode 100644
index 00000000000..8c2cb31de53
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/rename_ambiguous_pairing/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+GOOS.windows = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/split/rename_ambiguous_pairing/output.txt b/acceptance/bundle/config-remote-sync/split/rename_ambiguous_pairing/output.txt
new file mode 100644
index 00000000000..de185fb52ca
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/rename_ambiguous_pairing/output.txt
@@ -0,0 +1,34 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/dev/files...
+Created jobs.ambiguous_rename_job
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== alpha (top-level) -> zzz and beta (target block) -> aaa, bodies identical
+=== Sync
+Detected changes in 1 resource(s):
+
+Resource: resources.jobs.ambiguous_rename_job
+  tasks[task_key='aaa']: add
+  tasks[task_key='alpha']: remove
+  tasks[task_key='beta']: remove
+  tasks[task_key='zzz']: add
+
+
+
+=== Neither rename is applied, and both blocks keep their own task
+
+>>> diff.py databricks.yml.backup databricks.yml
+
+>>> grep -c task_key: alpha databricks.yml
+1
+
+>>> grep -c task_key: beta databricks.yml
+1
+
+>>> [CLI] bundle destroy --auto-approve -t dev
+The following resources will be deleted:
+  delete resources.jobs.ambiguous_rename_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/dev
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/config-remote-sync/split/rename_ambiguous_pairing/script b/acceptance/bundle/config-remote-sync/split/rename_ambiguous_pairing/script
new file mode 100644
index 00000000000..4d4d0bc5972
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/rename_ambiguous_pairing/script
@@ -0,0 +1,28 @@
+#!/bin/bash
+envsubst < databricks.yml.tmpl > databricks.yml
+cleanup() { trace $CLI bundle destroy --auto-approve -t dev; }
+trap cleanup EXIT
+$CLI bundle deploy -t dev
+job_id="$(read_id.py ambiguous_rename_job)"
+
+# alpha sorts before beta and zzz sorts after aaa, so an order-based pairing produces
+# the crossed result: alpha->aaa (top-level) and beta->zzz (target block).
+title "alpha (top-level) -> zzz and beta (target block) -> aaa, bodies identical"
+edit_resource.py jobs $job_id <<PYEDIT
+for task in r["tasks"]:
+    if task["task_key"] == "alpha":
+        task["task_key"] = "zzz"
+    elif task["task_key"] == "beta":
+        task["task_key"] = "aaa"
+PYEDIT
+
+title "Sync"
+echo
+cp databricks.yml databricks.yml.backup
+errcode $CLI bundle config-remote-sync -t dev --save
+title "Neither rename is applied, and both blocks keep their own task"
+echo
+trace diff.py databricks.yml.backup databricks.yml
+errcode trace grep -c "task_key: alpha" databricks.yml
+errcode trace grep -c "task_key: beta" databricks.yml
+rm databricks.yml.backup
diff --git a/acceptance/bundle/config-remote-sync/split/rename_ambiguous_single_block/databricks.yml.tmpl b/acceptance/bundle/config-remote-sync/split/rename_ambiguous_single_block/databricks.yml.tmpl
new file mode 100644
index 00000000000..be5e4dd17b6
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/rename_ambiguous_single_block/databricks.yml.tmpl
@@ -0,0 +1,30 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+# A depends_on entry holds nothing but a task_key, so stripping the key leaves an
+# empty body and every removal matches every addition by content. Renaming two tasks
+# rewrites gamma's two depends_on entries, and that pairing is unforced.
+#
+# Holding those back would be wrong: all of these elements are in one block, where
+# every pairing writes the same keys to the same place. Refusing them applies the task
+# renames while leaving depends_on pointing at keys that no longer exist, which breaks
+# the next deploy. Ambiguity only has to be refused when it crosses blocks.
+
+resources:
+  jobs:
+    ambiguous_single_block_job:
+      tasks:
+        - task_key: alpha
+          max_retries: 1
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/alpha
+        - task_key: beta
+          max_retries: 1
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/beta
+        - task_key: gamma
+          depends_on:
+            - task_key: alpha
+            - task_key: beta
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/gamma
diff --git a/acceptance/bundle/config-remote-sync/split/rename_ambiguous_single_block/out.test.toml b/acceptance/bundle/config-remote-sync/split/rename_ambiguous_single_block/out.test.toml
new file mode 100644
index 00000000000..8c2cb31de53
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/rename_ambiguous_single_block/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+GOOS.windows = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/split/rename_ambiguous_single_block/output.txt b/acceptance/bundle/config-remote-sync/split/rename_ambiguous_single_block/output.txt
new file mode 100644
index 00000000000..284fdae5f88
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/rename_ambiguous_single_block/output.txt
@@ -0,0 +1,84 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Created jobs.ambiguous_single_block_job
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Rename alpha -> zzz and beta -> aaa, and point gamma at the new keys
+=== Sync
+Detected changes in 1 resource(s):
+
+Resource: resources.jobs.ambiguous_single_block_job
+  tasks[task_key='aaa']: add
+  tasks[task_key='alpha']: remove
+  tasks[task_key='beta']: remove
+  tasks[task_key='gamma'].depends_on[task_key='aaa']: add
+  tasks[task_key='gamma'].depends_on[task_key='alpha']: remove
+  tasks[task_key='gamma'].depends_on[task_key='beta']: remove
+  tasks[task_key='gamma'].depends_on[task_key='zzz']: add
+  tasks[task_key='zzz']: add
+
+
+
+=== Both renames apply and depends_on follows them
+
+>>> diff.py databricks.yml.backup databricks.yml
+--- databricks.yml.backup
++++ databricks.yml
+@@ -15,9 +15,9 @@
+     ambiguous_single_block_job:
+       tasks:
+-        - task_key: alpha
++        - task_key: zzz
+           max_retries: 1
+           notebook_task:
+             notebook_path: /Users/{{workspace_user_name}}/alpha
+-        - task_key: beta
++        - task_key: aaa
+           max_retries: 1
+           notebook_task:
+@@ -25,6 +25,6 @@
+         - task_key: gamma
+           depends_on:
+-            - task_key: alpha
+-            - task_key: beta
++            - task_key: zzz
++            - {task_key: aaa}
+           notebook_task:
+             notebook_path: /Users/{{workspace_user_name}}/gamma
+
+=== Checking for old task keys (should be gone if renames applied):
+
+>>> grep -c task_key: alpha databricks.yml
+0
+
+Exit code: 1
+
+>>> grep -c task_key: beta databricks.yml
+0
+
+Exit code: 1
+
+=== Checking for new task keys:
+
+>>> grep -c task_key: zzz databricks.yml
+2
+
+>>> grep -c task_key: aaa databricks.yml
+2
+
+=== Checking depends_on (gamma's dependencies):
+
+>>> grep -A5 task_key: gamma databricks.yml
+          depends_on:
+            - task_key: zzz
+            - {task_key: aaa}
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/gamma
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.ambiguous_single_block_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/config-remote-sync/split/rename_ambiguous_single_block/script b/acceptance/bundle/config-remote-sync/split/rename_ambiguous_single_block/script
new file mode 100644
index 00000000000..ffbbfc09eab
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/rename_ambiguous_single_block/script
@@ -0,0 +1,40 @@
+#!/bin/bash
+
+envsubst < databricks.yml.tmpl > databricks.yml
+cleanup() { trace $CLI bundle destroy --auto-approve; }
+trap cleanup EXIT
+$CLI bundle deploy
+
+job_id="$(read_id.py ambiguous_single_block_job)"
+
+title "Rename alpha -> zzz and beta -> aaa, and point gamma at the new keys"
+edit_resource.py jobs $job_id <<PYEDIT
+for task in r["tasks"]:
+    if task["task_key"] == "alpha":
+        task["task_key"] = "zzz"
+    elif task["task_key"] == "beta":
+        task["task_key"] = "aaa"
+    elif task["task_key"] == "gamma":
+        task["depends_on"] = [{"task_key": "zzz"}, {"task_key": "aaa"}]
+PYEDIT
+
+title "Sync"
+echo
+cp databricks.yml databricks.yml.backup
+errcode $CLI bundle config-remote-sync --save
+
+title "Both renames apply and depends_on follows them"
+echo
+trace diff.py databricks.yml.backup databricks.yml
+echo
+echo "=== Checking for old task keys (should be gone if renames applied):"
+errcode trace grep -c "task_key: alpha" databricks.yml || echo "alpha: NOT FOUND (good)"
+errcode trace grep -c "task_key: beta" databricks.yml || echo "beta: NOT FOUND (good)"
+echo
+echo "=== Checking for new task keys:"
+errcode trace grep -c "task_key: zzz" databricks.yml || echo "zzz: NOT FOUND (BAD)"
+errcode trace grep -c "task_key: aaa" databricks.yml || echo "aaa: NOT FOUND (BAD)"
+echo
+echo "=== Checking depends_on (gamma's dependencies):"
+errcode trace grep -A5 "task_key: gamma" databricks.yml | grep -A5 "depends_on"
+rm databricks.yml.backup
diff --git a/acceptance/bundle/config-remote-sync/split/rename_two_removes_one_add/databricks.yml.tmpl b/acceptance/bundle/config-remote-sync/split/rename_two_removes_one_add/databricks.yml.tmpl
new file mode 100644
index 00000000000..1529473c0ba
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/rename_two_removes_one_add/databricks.yml.tmpl
@@ -0,0 +1,29 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+# Two tasks with IDENTICAL bodies apart from the key, one per block. Deleting one and
+# renaming the other in the same run yields two removes and a single add, and by
+# content either removal could be the renamed one. Pairing the first and deleting the
+# rest would move the new key into a block the user did not choose -- here promoting a
+# top-level task, visible to every target, into the dev-only block.
+
+resources:
+  jobs:
+    two_removes_job:
+      tasks:
+        - task_key: task_toplevel
+          max_retries: 2
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/nb
+
+targets:
+  dev:
+    mode: development
+    resources:
+      jobs:
+        two_removes_job:
+          tasks:
+            - task_key: task_target
+              max_retries: 2
+              notebook_task:
+                notebook_path: /Users/{{workspace_user_name}}/nb
diff --git a/acceptance/bundle/config-remote-sync/split/rename_two_removes_one_add/out.test.toml b/acceptance/bundle/config-remote-sync/split/rename_two_removes_one_add/out.test.toml
new file mode 100644
index 00000000000..8c2cb31de53
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/rename_two_removes_one_add/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+GOOS.windows = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/split/rename_two_removes_one_add/output.txt b/acceptance/bundle/config-remote-sync/split/rename_two_removes_one_add/output.txt
new file mode 100644
index 00000000000..4bec8863fd6
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/rename_two_removes_one_add/output.txt
@@ -0,0 +1,40 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/dev/files...
+Created jobs.two_removes_job
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Two identical tasks, one in each block; DELETE one (remote), RENAME the other
+=== Sync
+Detected changes in 1 resource(s):
+
+Resource: resources.jobs.two_removes_job
+  tasks[task_key='task_renamed']: add
+  tasks[task_key='task_target']: remove
+  tasks[task_key='task_toplevel']: remove
+
+
+
+=== Neither block is rewritten: the pairing is not forced
+
+>>> diff.py databricks.yml.backup databricks.yml
+
+
+=== Both tasks keep their original keys, and no new key was written
+>>> grep -c task_key: task_toplevel databricks.yml
+1
+
+>>> grep -c task_key: task_target databricks.yml
+1
+
+>>> grep -c task_key: task_renamed databricks.yml
+0
+
+Exit code: 1
+
+>>> [CLI] bundle destroy --auto-approve -t dev
+The following resources will be deleted:
+  delete resources.jobs.two_removes_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/dev
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/config-remote-sync/split/rename_two_removes_one_add/script b/acceptance/bundle/config-remote-sync/split/rename_two_removes_one_add/script
new file mode 100644
index 00000000000..045fec9922e
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/rename_two_removes_one_add/script
@@ -0,0 +1,37 @@
+#!/bin/bash
+
+envsubst < databricks.yml.tmpl > databricks.yml
+cleanup() { trace $CLI bundle destroy --auto-approve -t dev; }
+trap cleanup EXIT
+$CLI bundle deploy -t dev
+job_id="$(read_id.py two_removes_job)"
+
+title "Two identical tasks, one in each block; DELETE one (remote), RENAME the other"
+edit_resource.py jobs $job_id <<PYEDIT
+# Delete task_target and rename task_toplevel -> task_renamed
+new_tasks = []
+for task in r["tasks"]:
+    if task["task_key"] == "task_target":
+        # Delete this one (remove only, no add)
+        pass
+    elif task["task_key"] == "task_toplevel":
+        # Rename this one
+        task["task_key"] = "task_renamed"
+        new_tasks.append(task)
+r["tasks"] = new_tasks
+PYEDIT
+
+title "Sync"
+echo
+cp databricks.yml databricks.yml.backup
+errcode $CLI bundle config-remote-sync -t dev --save
+
+title "Neither block is rewritten: the pairing is not forced"
+echo
+trace diff.py databricks.yml.backup databricks.yml
+echo
+title "Both tasks keep their original keys, and no new key was written"
+errcode trace grep -c "task_key: task_toplevel" databricks.yml
+errcode trace grep -c "task_key: task_target" databricks.yml
+errcode trace grep -c "task_key: task_renamed" databricks.yml
+rm databricks.yml.backup
diff --git a/acceptance/bundle/config-remote-sync/split/target_variable/databricks.yml.tmpl b/acceptance/bundle/config-remote-sync/split/target_variable/databricks.yml.tmpl
new file mode 100644
index 00000000000..da9cb6f3e66
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/target_variable/databricks.yml.tmpl
@@ -0,0 +1,39 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+# notebook_path is defined ONLY in the target override block, and its value contains a
+# ${var.X} reference. Variable references are restored by looking the field up in the
+# pre-resolved configuration, where the target has already been folded into resources,
+# so that lookup path must not carry a targets.<target> prefix -- even though the write
+# itself has to.
+#
+# The lookup also has to keep MERGED sequence indices, which is why "aaa" exists: it
+# sorts before "zzz" and lives in the top-level block, so zzz is index 1 after the
+# merge but index 0 inside the block it is written to. Each task carries its own
+# variable, so reading the wrong sibling shows up as the wrong variable rather than
+# merely a lost reference.
+variables:
+  shared_dir:
+    default: base
+  dev_dir:
+    default: base
+
+resources:
+  jobs:
+    var_job:
+      max_concurrent_runs: 1
+      tasks:
+        - task_key: aaa
+          notebook_task:
+            notebook_path: /Users/${var.shared_dir}/aaa
+
+targets:
+  dev:
+    mode: development
+    resources:
+      jobs:
+        var_job:
+          tasks:
+            - task_key: zzz
+              notebook_task:
+                notebook_path: /Users/${var.dev_dir}/zzz
diff --git a/acceptance/bundle/config-remote-sync/split/target_variable/out.test.toml b/acceptance/bundle/config-remote-sync/split/target_variable/out.test.toml
new file mode 100644
index 00000000000..8c2cb31de53
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/target_variable/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+GOOS.windows = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/split/target_variable/output.txt b/acceptance/bundle/config-remote-sync/split/target_variable/output.txt
new file mode 100644
index 00000000000..0fe0a2d21a8
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/target_variable/output.txt
@@ -0,0 +1,38 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/dev/files...
+Created jobs.var_job
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Rename the notebook inside a target-block field that uses a variable
+=== Sync
+Detected changes in 1 resource(s):
+
+Resource: resources.jobs.var_job
+  tasks[task_key='zzz'].notebook_task.notebook_path: replace
+
+
+
+=== zzz keeps its own variable, and aaa is untouched
+
+>>> diff.py databricks.yml.backup databricks.yml
+--- databricks.yml.backup
++++ databricks.yml
+@@ -37,3 +37,3 @@
+             - task_key: zzz
+               notebook_task:
+-                notebook_path: /Users/${var.dev_dir}/zzz
++                notebook_path: /Users/${var.dev_dir}/renamed
+
+>>> grep -c var.dev_dir databricks.yml
+1
+
+>>> grep -c var.shared_dir databricks.yml
+1
+
+>>> [CLI] bundle destroy --auto-approve -t dev
+The following resources will be deleted:
+  delete resources.jobs.var_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/dev
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/config-remote-sync/split/target_variable/script b/acceptance/bundle/config-remote-sync/split/target_variable/script
new file mode 100644
index 00000000000..da7ff428244
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/target_variable/script
@@ -0,0 +1,34 @@
+#!/bin/bash
+
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+  trace $CLI bundle destroy --auto-approve -t dev
+}
+trap cleanup EXIT
+
+$CLI bundle deploy -t dev
+job_id="$(read_id.py var_job)"
+
+
+# Edit only the trailing segment of a path whose leading segment came from ${var.root}.
+# The reference must survive; hardcoding it would bake the dev value into the source.
+# zzz is index 1 in the merged list but index 0 in the target block it is written to.
+title "Rename the notebook inside a target-block field that uses a variable"
+edit_resource.py jobs $job_id <<PYEDIT
+for task in r["tasks"]:
+    if task["task_key"] == "zzz":
+        task["notebook_task"]["notebook_path"] = "/Users/base/renamed"
+PYEDIT
+
+title "Sync"
+echo
+cp databricks.yml databricks.yml.backup
+errcode $CLI bundle config-remote-sync -t dev --save
+
+title "zzz keeps its own variable, and aaa is untouched"
+echo
+trace diff.py databricks.yml.backup databricks.yml
+errcode trace grep -c 'var.dev_dir' databricks.yml
+errcode trace grep -c 'var.shared_dir' databricks.yml
+rm databricks.yml.backup
diff --git a/acceptance/bundle/config-remote-sync/split/test.toml b/acceptance/bundle/config-remote-sync/split/test.toml
new file mode 100644
index 00000000000..732f2cf0edd
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/test.toml
@@ -0,0 +1,7 @@
+# Local only: these assert which YAML file and list position a change is written
+# to, which the in-process test server exercises fully. Cloud = true would add a
+# real workspace round-trip that tells us nothing more about write-back.
+RecordRequests = false
+Ignore = [".databricks", "databricks.yml", "databricks.yml.backup", "overrides/*.yml", "overrides/*.backup"]
+
+Env.DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
diff --git a/acceptance/bundle/config-remote-sync/split/variable_file_order/databricks.yml.tmpl b/acceptance/bundle/config-remote-sync/split/variable_file_order/databricks.yml.tmpl
new file mode 100644
index 00000000000..4d8282db49d
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/variable_file_order/databricks.yml.tmpl
@@ -0,0 +1,25 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+# A single block with no target override at all: the tasks are in file order zzz, aaa,
+# but loading sorts keyed sequences by key, so aaa is index 0 in the merged view and
+# index 1 in the file. Restoring a ${var.X} reference reads the field from a second load
+# of the configuration, and that load has to be in the same index space -- otherwise the
+# lookup reads zzz and rewrites aaa with whatever it found, destroying the reference.
+
+variables:
+  zzz_dir:
+    default: zzzhome
+  aaa_dir:
+    default: aaahome
+
+resources:
+  jobs:
+    file_order_job:
+      tasks:
+        - task_key: zzz
+          notebook_task:
+            notebook_path: /Users/${var.zzz_dir}/zzz
+        - task_key: aaa
+          notebook_task:
+            notebook_path: /Users/${var.aaa_dir}/aaa
diff --git a/acceptance/bundle/config-remote-sync/split/variable_file_order/out.test.toml b/acceptance/bundle/config-remote-sync/split/variable_file_order/out.test.toml
new file mode 100644
index 00000000000..8c2cb31de53
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/variable_file_order/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+GOOS.windows = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/split/variable_file_order/output.txt b/acceptance/bundle/config-remote-sync/split/variable_file_order/output.txt
new file mode 100644
index 00000000000..2850f34c624
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/variable_file_order/output.txt
@@ -0,0 +1,35 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Created jobs.file_order_job
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Edit aaa, whose file position differs from its merged position
+=== Sync
+Detected changes in 1 resource(s):
+
+Resource: resources.jobs.file_order_job
+  tasks[task_key='aaa'].notebook_task.notebook_path: replace
+
+
+
+=== aaa keeps its own variable reference
+
+>>> diff.py databricks.yml.backup databricks.yml
+--- databricks.yml.backup
++++ databricks.yml
+@@ -23,3 +23,3 @@
+         - task_key: aaa
+           notebook_task:
+-            notebook_path: /Users/${var.aaa_dir}/aaa
++            notebook_path: /Users/${var.aaa_dir}/renamed
+
+>>> grep -c var.aaa_dir databricks.yml
+1
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.file_order_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/config-remote-sync/split/variable_file_order/script b/acceptance/bundle/config-remote-sync/split/variable_file_order/script
new file mode 100644
index 00000000000..b2e2b1d236f
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/split/variable_file_order/script
@@ -0,0 +1,23 @@
+#!/bin/bash
+envsubst < databricks.yml.tmpl > databricks.yml
+cleanup() { trace $CLI bundle destroy --auto-approve; }
+trap cleanup EXIT
+$CLI bundle deploy
+job_id="$(read_id.py file_order_job)"
+
+title "Edit aaa, whose file position differs from its merged position"
+edit_resource.py jobs $job_id <<PYEDIT
+for task in r["tasks"]:
+    if task["task_key"] == "aaa":
+        task["notebook_task"]["notebook_path"] = "/Users/aaahome/renamed"
+PYEDIT
+
+title "Sync"
+echo
+cp databricks.yml databricks.yml.backup
+errcode $CLI bundle config-remote-sync --save
+title "aaa keeps its own variable reference"
+echo
+trace diff.py databricks.yml.backup databricks.yml
+errcode trace grep -c 'var.aaa_dir' databricks.yml
+rm databricks.yml.backup
diff --git a/acceptance/bundle/config-remote-sync/target_override/out.test.toml b/acceptance/bundle/config-remote-sync/target_override/out.test.toml
index 579b1e4a3c9..a4f8dd5ef74 100644
--- a/acceptance/bundle/config-remote-sync/target_override/out.test.toml
+++ b/acceptance/bundle/config-remote-sync/target_override/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 GOOS.windows = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/target_override/output.txt b/acceptance/bundle/config-remote-sync/target_override/output.txt
index fa32ecade2c..4919594b609 100644
--- a/acceptance/bundle/config-remote-sync/target_override/output.txt
+++ b/acceptance/bundle/config-remote-sync/target_override/output.txt
@@ -1,7 +1,7 @@
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/dev/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.my_job
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 === Modify fields in target override
 === Detect and save changes
@@ -35,5 +35,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/dev
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/config-remote-sync/target_override/test.toml b/acceptance/bundle/config-remote-sync/target_override/test.toml
index 3894d66826c..21cf5f934b3 100644
--- a/acceptance/bundle/config-remote-sync/target_override/test.toml
+++ b/acceptance/bundle/config-remote-sync/target_override/test.toml
@@ -3,8 +3,4 @@ Cloud = true
 RecordRequests = false
 Ignore = [".databricks", "dummy.whl", "databricks.yml", "databricks.yml.backup"]
 
-[Env]
-DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
-
-[EnvMatrix]
-DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+Env.DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
diff --git a/acceptance/bundle/config-remote-sync/task_rename_revert/databricks.yml.tmpl b/acceptance/bundle/config-remote-sync/task_rename_revert/databricks.yml.tmpl
new file mode 100644
index 00000000000..7aa0dbecc25
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/task_rename_revert/databricks.yml.tmpl
@@ -0,0 +1,18 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  jobs:
+    sample_job:
+      tasks:
+        - task_key: new_task
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/new_task
+          new_cluster:
+            spark_version: $DEFAULT_SPARK_VERSION
+            node_type_id: $NODE_TYPE_ID
+            num_workers: 1
+
+targets:
+  default:
+    mode: development
diff --git a/acceptance/bundle/config-remote-sync/task_rename_revert/out.test.toml b/acceptance/bundle/config-remote-sync/task_rename_revert/out.test.toml
new file mode 100644
index 00000000000..a4f8dd5ef74
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/task_rename_revert/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = true
+GOOS.windows = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/task_rename_revert/output.txt b/acceptance/bundle/config-remote-sync/task_rename_revert/output.txt
new file mode 100644
index 00000000000..da1063577ab
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/task_rename_revert/output.txt
@@ -0,0 +1,56 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Created jobs.sample_job
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Rename task to new_task_2 remotely
+
+=== Sync the rename into config (no redeploy)
+Detected changes in 1 resource(s):
+
+Resource: resources.jobs.sample_job
+  tasks[task_key='new_task']: remove
+  tasks[task_key='new_task_2']: add
+
+
+
+>>> diff.py databricks.yml.backup databricks.yml
+--- databricks.yml.backup
++++ databricks.yml
+@@ -6,5 +6,5 @@
+     sample_job:
+       tasks:
+-        - task_key: new_task
++        - task_key: new_task_2
+           notebook_task:
+             notebook_path: /Users/{{workspace_user_name}}/new_task
+
+=== Rename task back to new_task remotely
+
+=== Sync the revert into config
+Detected changes in 1 resource(s):
+
+Resource: resources.jobs.sample_job
+  tasks[task_key='new_task']: add
+  tasks[task_key='new_task_2']: remove
+
+
+
+>>> diff.py databricks.yml.backup databricks.yml
+--- databricks.yml.backup
++++ databricks.yml
+@@ -6,5 +6,5 @@
+     sample_job:
+       tasks:
+-        - task_key: new_task_2
++        - task_key: new_task
+           notebook_task:
+             notebook_path: /Users/{{workspace_user_name}}/new_task
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.sample_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/config-remote-sync/task_rename_revert/script b/acceptance/bundle/config-remote-sync/task_rename_revert/script
new file mode 100644
index 00000000000..a01c1196de6
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/task_rename_revert/script
@@ -0,0 +1,45 @@
+#!/bin/bash
+
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+  trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+$CLI bundle deploy
+job_id="$(read_id.py sample_job)"
+
+title "Rename task to new_task_2 remotely"
+echo
+edit_resource.py jobs $job_id <<EOF
+for task in r["tasks"]:
+    if task["task_key"] == "new_task":
+        task["task_key"] = "new_task_2"
+EOF
+
+title "Sync the rename into config (no redeploy)"
+echo
+cp databricks.yml databricks.yml.backup
+$CLI bundle config-remote-sync --save
+trace diff.py databricks.yml.backup databricks.yml
+rm databricks.yml.backup
+
+title "Rename task back to new_task remotely"
+echo
+edit_resource.py jobs $job_id <<EOF
+for task in r["tasks"]:
+    if task["task_key"] == "new_task_2":
+        task["task_key"] = "new_task"
+EOF
+
+# Without redeploy, state still holds task_key='new_task' while config holds
+# 'new_task_2' from the first sync. Before the fix, sync errored with
+# "no array element found with task_key='new_task'" because the change was
+# classified as Replace on a key that the YAML no longer contains.
+title "Sync the revert into config"
+echo
+cp databricks.yml databricks.yml.backup
+$CLI bundle config-remote-sync --save
+trace diff.py databricks.yml.backup databricks.yml
+rm databricks.yml.backup
diff --git a/acceptance/bundle/config-remote-sync/task_rename_revert/test.toml b/acceptance/bundle/config-remote-sync/task_rename_revert/test.toml
new file mode 100644
index 00000000000..8b6c9ef02fc
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/task_rename_revert/test.toml
@@ -0,0 +1,6 @@
+Cloud = true
+
+RecordRequests = false
+Ignore = [".databricks", "databricks.yml", "databricks.yml.backup"]
+
+Env.DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
diff --git a/acceptance/bundle/config-remote-sync/terraform_state/databricks.yml b/acceptance/bundle/config-remote-sync/terraform_state/databricks.yml
new file mode 100644
index 00000000000..70c9a429f09
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/terraform_state/databricks.yml
@@ -0,0 +1,12 @@
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    test_job:
+      name: test-job
+      max_concurrent_runs: 1
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/notebook
diff --git a/acceptance/bundle/config-remote-sync/terraform_state/out.test.toml b/acceptance/bundle/config-remote-sync/terraform_state/out.test.toml
new file mode 100644
index 00000000000..aadf9e4a151
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/terraform_state/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+GOOS.windows = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/config-remote-sync/terraform_state/output.txt b/acceptance/bundle/config-remote-sync/terraform_state/output.txt
new file mode 100644
index 00000000000..08ec0fc6a0b
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/terraform_state/output.txt
@@ -0,0 +1,52 @@
+
+=== Replay a terraform deployment of the bundle (captured from a real terraform run)
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate
+
+=== config-remote-sync migrates the terraform state in memory and detects the remote change
+>>> [CLI] bundle config-remote-sync
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Detected changes in 1 resource(s):
+
+Resource: resources.jobs.test_job
+  max_concurrent_runs: replace
+
+
+
+=== The terraform state is untouched: config-remote-sync does not commit the migration
+>>> find.py \.databricks/.*(\.tfstate|resources.*\.json)
+.databricks/bundle/default/terraform/terraform.tfstate
+
+=== Saving writes the remote change into the config
+>>> [CLI] bundle config-remote-sync --save
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Detected changes in 1 resource(s):
+
+Resource: resources.jobs.test_job
+  max_concurrent_runs: replace
+
+
+
+>>> cat databricks.yml
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    test_job:
+      name: test-job
+      max_concurrent_runs: 3
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/notebook
+
+=== Cleanup
+>>> [CLI] bundle destroy --auto-approve
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+The following resources will be deleted:
+  delete resources.jobs.test_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Migrated 1 resource to direct deployment engine.
+Destroy: 1 deleted
diff --git a/acceptance/bundle/config-remote-sync/terraform_state/script b/acceptance/bundle/config-remote-sync/terraform_state/script
new file mode 100644
index 00000000000..31d7b70bb7f
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/terraform_state/script
@@ -0,0 +1,23 @@
+cleanup() {
+  title "Cleanup"
+  trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+title "Replay a terraform deployment of the bundle (captured from a real terraform run)"
+trace replay_tfstate.py terraform-requests.json terraform.tfstate
+job_id="$(read_id.py test_job)"
+
+edit_resource.py jobs $job_id <<EOF2
+r["max_concurrent_runs"] = 3
+EOF2
+
+title "config-remote-sync migrates the terraform state in memory and detects the remote change"
+trace $CLI bundle config-remote-sync
+
+title "The terraform state is untouched: config-remote-sync does not commit the migration"
+trace find.py '\.databricks/.*(\.tfstate|resources.*\.json)'
+
+title "Saving writes the remote change into the config"
+trace $CLI bundle config-remote-sync --save
+trace cat databricks.yml
diff --git a/acceptance/bundle/config-remote-sync/terraform_state/terraform-requests.json b/acceptance/bundle/config-remote-sync/terraform_state/terraform-requests.json
new file mode 100644
index 00000000000..1b1144e478d
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/terraform_state/terraform-requests.json
@@ -0,0 +1,49 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/artifacts/.internal"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/files"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "test-job",
+      "queue": {
+        "enabled": true
+      },
+      "tasks": [
+        {
+          "notebook_task": {
+            "notebook_path": "/Users/{{workspace_user_name}}/notebook",
+            "source": "WORKSPACE"
+          },
+          "task_key": "main"
+        }
+      ]
+    }
+  }
+]
diff --git a/acceptance/bundle/config-remote-sync/terraform_state/terraform.tfstate b/acceptance/bundle/config-remote-sync/terraform_state/terraform.tfstate
new file mode 100644
index 00000000000..919047d4d33
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/terraform_state/terraform.tfstate
@@ -0,0 +1,169 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "783b1c21-9167-f1e7-d383-751e1d4702f3",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "test_job",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8791204142431790000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "test-job",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [
+              {
+                "ai_runtime_task": [],
+                "alert_task": [],
+                "clean_rooms_notebook_task": [],
+                "compute": [],
+                "condition_task": [],
+                "dashboard_task": [],
+                "dbt_cloud_task": [],
+                "dbt_platform_task": [],
+                "dbt_task": [],
+                "depends_on": [],
+                "description": "",
+                "disable_auto_optimization": false,
+                "disabled": false,
+                "email_notifications": [
+                  {
+                    "no_alert_for_skipped_runs": false,
+                    "on_duration_warning_threshold_exceeded": [],
+                    "on_failure": [],
+                    "on_start": [],
+                    "on_streaming_backlog_exceeded": [],
+                    "on_success": []
+                  }
+                ],
+                "environment_key": "",
+                "existing_cluster_id": "",
+                "for_each_task": [],
+                "gen_ai_compute_task": [],
+                "health": [],
+                "job_cluster_key": "",
+                "library": [],
+                "max_retries": 0,
+                "min_retry_interval_millis": 0,
+                "new_cluster": [],
+                "notebook_task": [
+                  {
+                    "base_parameters": null,
+                    "notebook_path": "/Users/{{workspace_user_name}}/notebook",
+                    "source": "WORKSPACE",
+                    "warehouse_id": ""
+                  }
+                ],
+                "notification_settings": [],
+                "pipeline_task": [],
+                "power_bi_task": [],
+                "python_operator_task": [],
+                "python_wheel_task": [],
+                "retry_on_timeout": false,
+                "run_if": "ALL_SUCCESS",
+                "run_job_task": [],
+                "spark_jar_task": [],
+                "spark_python_task": [],
+                "spark_submit_task": [],
+                "sql_task": [],
+                "task_key": "main",
+                "timeout_seconds": 0,
+                "webhook_notifications": []
+              }
+            ],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8791204142431790000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/config-remote-sync/terraform_state/test.toml b/acceptance/bundle/config-remote-sync/terraform_state/test.toml
new file mode 100644
index 00000000000..cfe2805f631
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/terraform_state/test.toml
@@ -0,0 +1,10 @@
+# Local-only: the replay fixtures are captured against the fake server, so they reproduce a
+# terraform state only there, not on a real workspace.
+Cloud = false
+
+# The DMS variant does not apply to the migration story (see acceptance/bundle/migrate/test.toml).
+EnvMatrix.DMS = [""]
+
+Env.DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
+
+Ignore = [".databricks"]
diff --git a/acceptance/bundle/config-remote-sync/test.toml b/acceptance/bundle/config-remote-sync/test.toml
index 4ab67cee71a..6e7cb189b21 100644
--- a/acceptance/bundle/config-remote-sync/test.toml
+++ b/acceptance/bundle/config-remote-sync/test.toml
@@ -1,3 +1,2 @@
 # Disable Windows tests for config-remote-sync tests
-[GOOS]
-windows = false
+GOOS.windows = false
diff --git a/acceptance/bundle/config-remote-sync/validation_errors/out.test.toml b/acceptance/bundle/config-remote-sync/validation_errors/out.test.toml
index 4b5914daa2c..8c2cb31de53 100644
--- a/acceptance/bundle/config-remote-sync/validation_errors/out.test.toml
+++ b/acceptance/bundle/config-remote-sync/validation_errors/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
 GOOS.windows = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/validation_errors/output.txt b/acceptance/bundle/config-remote-sync/validation_errors/output.txt
index c4ce29efa0a..4a956e718df 100644
--- a/acceptance/bundle/config-remote-sync/validation_errors/output.txt
+++ b/acceptance/bundle/config-remote-sync/validation_errors/output.txt
@@ -1,7 +1,8 @@
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.my_job
+Created pipelines.my_pipeline
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 === Set correct paths and add git info remotely
 === Break local paths to simulate stale config
@@ -51,10 +52,9 @@ The following resources will be deleted:
   delete resources.pipelines.my_pipeline
 
 This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
-Streaming Tables (STs) and Materialized Views (MVs) managed by them:
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:
   delete resources.pipelines.my_pipeline
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 2 deleted
diff --git a/acceptance/bundle/config-remote-sync/validation_errors/test.toml b/acceptance/bundle/config-remote-sync/validation_errors/test.toml
index ff9cea4cfc9..bf190f0f3fb 100644
--- a/acceptance/bundle/config-remote-sync/validation_errors/test.toml
+++ b/acceptance/bundle/config-remote-sync/validation_errors/test.toml
@@ -1,8 +1,4 @@
 RecordRequests = false
 Ignore = [".databricks", "databricks.yml", "databricks.yml.backup", "src", "pipeline_root"]
 
-[Env]
-DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
-
-[EnvMatrix]
-DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+Env.DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
diff --git a/acceptance/bundle/config-remote-sync/variable_reference_parent/databricks.yml.tmpl b/acceptance/bundle/config-remote-sync/variable_reference_parent/databricks.yml.tmpl
new file mode 100644
index 00000000000..778f4dc71a8
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/variable_reference_parent/databricks.yml.tmpl
@@ -0,0 +1,29 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+variables:
+  spark_conf:
+    type: complex
+    default:
+      spark.speculation: "true"
+
+targets:
+  default:
+    mode: development
+
+resources:
+  jobs:
+    my_job:
+      max_concurrent_runs: 1
+      job_clusters:
+        - job_cluster_key: shared
+          new_cluster:
+            spark_version: $DEFAULT_SPARK_VERSION
+            node_type_id: $NODE_TYPE_ID
+            num_workers: 1
+            spark_conf: ${var.spark_conf}
+      tasks:
+        - task_key: main
+          job_cluster_key: shared
+          notebook_task:
+            notebook_path: /Users/{{workspace_user_name}}/notebook
diff --git a/acceptance/bundle/config-remote-sync/variable_reference_parent/out.test.toml b/acceptance/bundle/config-remote-sync/variable_reference_parent/out.test.toml
new file mode 100644
index 00000000000..8c2cb31de53
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/variable_reference_parent/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+GOOS.windows = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/config-remote-sync/variable_reference_parent/output.txt b/acceptance/bundle/config-remote-sync/variable_reference_parent/output.txt
new file mode 100644
index 00000000000..a4eac5ef990
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/variable_reference_parent/output.txt
@@ -0,0 +1,68 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Created jobs.my_job
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Inject a spark_conf key under a field defined as a complex variable
+spark_conf is set to a variable reference, so a remotely-added key cannot be
+written into that scalar node; the change is skipped while unrelated edits still sync.
+
+=== Detect and save all changes
+Detected changes in 1 resource(s):
+
+Resource: resources.jobs.my_job
+  job_clusters[job_cluster_key='shared'].new_cluster.spark_conf['spark.executor.memory']: skip
+  max_concurrent_runs: replace
+
+
+
+=== Configuration changes
+
+>>> diff.py databricks.yml.backup databricks.yml
+--- databricks.yml.backup
++++ databricks.yml
+@@ -15,5 +15,5 @@
+   jobs:
+     my_job:
+-      max_concurrent_runs: 1
++      max_concurrent_runs: 5
+       job_clusters:
+         - job_cluster_key: shared
+
+=== Telemetry
+
+>>> cat [OUTPUT_DIR]/out.requests.txt
+{
+  "save": true,
+  "changes_total": 2,
+  "add_count": 1,
+  "replace_count": 1,
+  "resource_changes": [
+    {
+      "resource_type": "jobs",
+      "changes_count": 2,
+      "add_count": 1,
+      "replace_count": 1
+    }
+  ],
+  "files_changed_count": 1,
+  "files_written_count": 1,
+  "skipped_changes_count": 1,
+  "state_serial": 1,
+  "state_lineage": "[UUID]",
+  "state_source": "local",
+  "states_available_count": 2,
+  "state_resource_ids": {
+    "resource_job_ids": [
+      "[MY_JOB_ID]"
+    ]
+  }
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.my_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/config-remote-sync/variable_reference_parent/script b/acceptance/bundle/config-remote-sync/variable_reference_parent/script
new file mode 100644
index 00000000000..00347b093f6
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/variable_reference_parent/script
@@ -0,0 +1,40 @@
+#!/bin/bash
+
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+  trace $CLI bundle destroy --auto-approve
+  # destroy records requests too; drop the recorded file so it is not compared.
+  rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+$CLI bundle deploy
+job_id="$(read_id.py my_job)"
+
+title "Inject a spark_conf key under a field defined as a complex variable"
+echo
+echo "spark_conf is set to a variable reference, so a remotely-added key cannot be"
+echo "written into that scalar node; the change is skipped while unrelated edits still sync."
+edit_resource.py jobs $job_id <<'EOF'
+r["max_concurrent_runs"] = 5
+
+for jc in r.get("job_clusters", []):
+    jc["new_cluster"]["spark_conf"]["spark.executor.memory"] = "4g"
+EOF
+
+title "Detect and save all changes"
+echo
+cp databricks.yml databricks.yml.backup
+$CLI bundle config-remote-sync --save
+
+title "Configuration changes"
+echo
+trace diff.py databricks.yml.backup databricks.yml
+rm databricks.yml.backup
+
+title "Telemetry"
+echo
+# The engine name is dropped because both EnvMatrix variants share this output.
+# skipped_changes_count reflects the spark_conf change skipped under a variable reference.
+trace cat "$OUT_REQUESTS" | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log.bundle_config_remote_sync_event | select(. != null) | del(.engine)'
diff --git a/acceptance/bundle/config-remote-sync/variable_reference_parent/test.toml b/acceptance/bundle/config-remote-sync/variable_reference_parent/test.toml
new file mode 100644
index 00000000000..4a0348ad065
--- /dev/null
+++ b/acceptance/bundle/config-remote-sync/variable_reference_parent/test.toml
@@ -0,0 +1,7 @@
+# RecordRequests captures the config-remote-sync telemetry event so the script
+# can assert skipped_changes_count (the change skipped under a variable reference).
+# out.requests.txt is removed in the script's cleanup so it is not compared.
+RecordRequests = true
+Ignore = [".databricks", "databricks.yml", "databricks.yml.backup"]
+
+Env.DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
diff --git a/acceptance/bundle/debug/fetch-repository-info-repos-error/databricks.yml b/acceptance/bundle/debug/fetch-repository-info-repos-error/databricks.yml
new file mode 100644
index 00000000000..576d7a9ef25
--- /dev/null
+++ b/acceptance/bundle/debug/fetch-repository-info-repos-error/databricks.yml
@@ -0,0 +1,2 @@
+bundle:
+  name: test-bundle
diff --git a/acceptance/bundle/debug/fetch-repository-info-repos-error/out.test.toml b/acceptance/bundle/debug/fetch-repository-info-repos-error/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/debug/fetch-repository-info-repos-error/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/debug/fetch-repository-info-repos-error/output.txt b/acceptance/bundle/debug/fetch-repository-info-repos-error/output.txt
new file mode 100644
index 00000000000..3f8cdf11fc4
--- /dev/null
+++ b/acceptance/bundle/debug/fetch-repository-info-repos-error/output.txt
@@ -0,0 +1,9 @@
+
+>>> [CLI] bundle debug fetch-repository-info --path /Workspace/Users/[USERNAME]/test-folder-[UNIQUE_NAME]
+Warn: failed to load git info for repo [REPO_ID]: Fault injected by test.
+{
+  "worktree_root": "/Workspace/Users/[USERNAME]/test-folder-[UNIQUE_NAME]",
+  "current_branch": "",
+  "latest_commit": "",
+  "origin_url": ""
+}
diff --git a/acceptance/bundle/debug/fetch-repository-info-repos-error/script b/acceptance/bundle/debug/fetch-repository-info-repos-error/script
new file mode 100644
index 00000000000..4bebfdd19fd
--- /dev/null
+++ b/acceptance/bundle/debug/fetch-repository-info-repos-error/script
@@ -0,0 +1,17 @@
+# A Git folder outside /Repos has Git CLI access, so the workspace API reports no
+# git metadata for it and it is read from the Repos API instead. Make that read
+# fail: the worktree root must still be reported, with the metadata left empty
+# rather than failing the command.
+#
+# Registered before MSYS_NO_PATHCONV is exported, which on Windows would rewrite
+# the path Git Bash passes for this helper's own script.
+fault.py "GET /api/2.0/repos/*" 403 0 1
+
+# Keep Git Bash from rewriting the /Workspace path passed to --path.
+export MSYS_NO_PATHCONV=1
+
+folder=/Workspace/Users/$CURRENT_USER_NAME/test-folder-$UNIQUE_NAME
+repo_id=$($CLI repos create https://github.com/databricks/bundle-examples gitHub --path "$folder" | jq -r .id)
+add_repl "$repo_id" REPO_ID
+
+trace $CLI bundle debug fetch-repository-info --path "$folder"
diff --git a/acceptance/bundle/debug/fetch-repository-info-repos-error/test.toml b/acceptance/bundle/debug/fetch-repository-info-repos-error/test.toml
new file mode 100644
index 00000000000..3b30595f0b8
--- /dev/null
+++ b/acceptance/bundle/debug/fetch-repository-info-repos-error/test.toml
@@ -0,0 +1,4 @@
+# Local only: the failure is injected into the testserver.
+Cloud = false
+
+# This exercises git.FetchRepositoryInfo, which is independent of the deploy engine.
diff --git a/acceptance/bundle/debug/fetch-repository-info/databricks.yml b/acceptance/bundle/debug/fetch-repository-info/databricks.yml
new file mode 100644
index 00000000000..576d7a9ef25
--- /dev/null
+++ b/acceptance/bundle/debug/fetch-repository-info/databricks.yml
@@ -0,0 +1,2 @@
+bundle:
+  name: test-bundle
diff --git a/acceptance/bundle/debug/fetch-repository-info/out.test.toml b/acceptance/bundle/debug/fetch-repository-info/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/debug/fetch-repository-info/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/debug/fetch-repository-info/output.txt b/acceptance/bundle/debug/fetch-repository-info/output.txt
new file mode 100644
index 00000000000..2c4a60db972
--- /dev/null
+++ b/acceptance/bundle/debug/fetch-repository-info/output.txt
@@ -0,0 +1,40 @@
+
+=== the root of a Git folder under /Repos
+
+>>> [CLI] bundle debug fetch-repository-info --path /Workspace/Repos/[USERNAME]/test-repo-[UNIQUE_NAME]
+{
+  "worktree_root": "/Workspace/Repos/[USERNAME]/test-repo-[UNIQUE_NAME]",
+  "current_branch": "main",
+  "latest_commit": "[COMMIT_SHA]",
+  "origin_url": "https://github.com/databricks/bundle-examples"
+}
+
+=== a subdirectory of it, which resolves to the same root
+
+>>> [CLI] bundle debug fetch-repository-info --path /Workspace/Repos/[USERNAME]/test-repo-[UNIQUE_NAME]/subdir
+{
+  "worktree_root": "/Workspace/Repos/[USERNAME]/test-repo-[UNIQUE_NAME]",
+  "current_branch": "main",
+  "latest_commit": "[COMMIT_SHA]",
+  "origin_url": "https://github.com/databricks/bundle-examples"
+}
+
+=== the root of a Git folder outside /Repos
+
+>>> [CLI] bundle debug fetch-repository-info --path /Workspace/Users/[USERNAME]/test-folder-[UNIQUE_NAME]
+{
+  "worktree_root": "/Workspace/Users/[USERNAME]/test-folder-[UNIQUE_NAME]",
+  "current_branch": "main",
+  "latest_commit": "[COMMIT_SHA]",
+  "origin_url": "https://github.com/databricks/bundle-examples"
+}
+
+=== a path in no Git folder at all
+
+>>> [CLI] bundle debug fetch-repository-info --path /Workspace/Users/[USERNAME]
+{
+  "worktree_root": "",
+  "current_branch": "",
+  "latest_commit": "",
+  "origin_url": ""
+}
diff --git a/acceptance/bundle/debug/fetch-repository-info/script b/acceptance/bundle/debug/fetch-repository-info/script
new file mode 100644
index 00000000000..6f69b821a9b
--- /dev/null
+++ b/acceptance/bundle/debug/fetch-repository-info/script
@@ -0,0 +1,33 @@
+# The fake workspace reports "main", which is this repo's default branch too.
+url=https://github.com/databricks/bundle-examples
+
+# A Git folder under /Repos and one outside it. Once a Git folder has Git CLI
+# access the workspace API reports no git metadata for it, so both resolve
+# through the Repos API; the resolved metadata must be identical either way.
+repo=/Workspace/Repos/$CURRENT_USER_NAME/test-repo-$UNIQUE_NAME
+folder=/Workspace/Users/$CURRENT_USER_NAME/test-folder-$UNIQUE_NAME
+
+$CLI repos create $url gitHub --path "$repo" > /dev/null
+$CLI repos create $url gitHub --path "$folder" > /dev/null
+
+# A directory inside the Git folder, so the subdirectory case below resolves a
+# path that exists rather than a missing one.
+$CLI workspace mkdirs "$repo/subdir"
+
+cleanup() {
+    $CLI repos delete "$repo" 2>>LOG.cleanup
+    $CLI repos delete "$folder" 2>>LOG.cleanup
+}
+trap cleanup EXIT
+
+title "the root of a Git folder under /Repos\n"
+trace $CLI bundle debug fetch-repository-info --path "$repo"
+
+title "a subdirectory of it, which resolves to the same root\n"
+trace $CLI bundle debug fetch-repository-info --path "$repo/subdir"
+
+title "the root of a Git folder outside /Repos\n"
+trace $CLI bundle debug fetch-repository-info --path "$folder"
+
+title "a path in no Git folder at all\n"
+trace $CLI bundle debug fetch-repository-info --path "/Workspace/Users/$CURRENT_USER_NAME"
diff --git a/acceptance/bundle/debug/fetch-repository-info/test.toml b/acceptance/bundle/debug/fetch-repository-info/test.toml
new file mode 100644
index 00000000000..057e7be73f6
--- /dev/null
+++ b/acceptance/bundle/debug/fetch-repository-info/test.toml
@@ -0,0 +1,12 @@
+Cloud = true
+
+# This exercises git.FetchRepositoryInfo, which is independent of the deploy engine.
+
+# Keep Git Bash from rewriting the /Workspace paths passed to --path.
+Env.MSYS_NO_PATHCONV = "1"
+
+# The commit differs between the fake workspace and a real clone of the repo, so
+# the golden matches both.
+[[Repls]]
+Old = '\b[0-9a-f]{40}\b'
+New = '[COMMIT_SHA]'
diff --git a/acceptance/bundle/debug/list-targets-root-engine/databricks.yml b/acceptance/bundle/debug/list-targets-root-engine/databricks.yml
new file mode 100644
index 00000000000..58fbbd93be0
--- /dev/null
+++ b/acceptance/bundle/debug/list-targets-root-engine/databricks.yml
@@ -0,0 +1,11 @@
+bundle:
+  name: test-bundle
+  engine: terraform
+
+targets:
+  inherited:
+    default: true
+  uses_direct:
+    bundle:
+      engine: direct
+  null_target:
diff --git a/acceptance/bundle/debug/list-targets-root-engine/out.test.toml b/acceptance/bundle/debug/list-targets-root-engine/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/debug/list-targets-root-engine/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/debug/list-targets-root-engine/output.txt b/acceptance/bundle/debug/list-targets-root-engine/output.txt
new file mode 100644
index 00000000000..b198244bb80
--- /dev/null
+++ b/acceptance/bundle/debug/list-targets-root-engine/output.txt
@@ -0,0 +1,23 @@
+
+>>> [CLI] bundle debug list-targets
+inherited (default) engine:terraform
+null_target engine:terraform
+uses_direct
+
+>>> [CLI] bundle debug list-targets --output json
+{
+  "targets": [
+    {
+      "name": "inherited",
+      "default": true,
+      "engine": "terraform"
+    },
+    {
+      "name": "null_target",
+      "engine": "terraform"
+    },
+    {
+      "name": "uses_direct"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/acceptance/bundle/debug/list-targets-root-engine/script b/acceptance/bundle/debug/list-targets-root-engine/script
new file mode 100644
index 00000000000..fb699dee0cc
--- /dev/null
+++ b/acceptance/bundle/debug/list-targets-root-engine/script
@@ -0,0 +1,2 @@
+trace $CLI bundle debug list-targets
+trace $CLI bundle debug list-targets --output json
diff --git a/acceptance/bundle/debug/list-targets/databricks.yml b/acceptance/bundle/debug/list-targets/databricks.yml
index 00406bb1800..438256ff729 100644
--- a/acceptance/bundle/debug/list-targets/databricks.yml
+++ b/acceptance/bundle/debug/list-targets/databricks.yml
@@ -15,11 +15,17 @@ targets:
     mode: development
     workspace:
       host: https://dev.example.com
-  staging: {}
+  staging:
   prod:
     mode: production
     workspace:
       host: https://prod.example.com
+  uses_terraform:
+    bundle:
+      engine: terraform
+  uses_direct:
+    bundle:
+      engine: direct
   with_vars:
     default: ${var.is_default}
     mode: ${var.target_mode}
diff --git a/acceptance/bundle/debug/list-targets/out.test.toml b/acceptance/bundle/debug/list-targets/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/debug/list-targets/out.test.toml
+++ b/acceptance/bundle/debug/list-targets/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/debug/list-targets/output.txt b/acceptance/bundle/debug/list-targets/output.txt
index a936dcf5033..abf957e8729 100644
--- a/acceptance/bundle/debug/list-targets/output.txt
+++ b/acceptance/bundle/debug/list-targets/output.txt
@@ -3,6 +3,8 @@
 dev (default) development https://dev.example.com
 prod production https://prod.example.com
 staging
+uses_direct
+uses_terraform engine:terraform
 with_vars ${var.target_mode} ${var.target_host}
 
 >>> [CLI] bundle debug list-targets --output json
@@ -22,6 +24,13 @@ with_vars ${var.target_mode} ${var.target_host}
     {
       "name": "staging"
     },
+    {
+      "name": "uses_direct"
+    },
+    {
+      "name": "uses_terraform",
+      "engine": "terraform"
+    },
     {
       "name": "with_vars",
       "mode": "${var.target_mode}",
diff --git a/acceptance/bundle/debug/out.test.toml b/acceptance/bundle/debug/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/debug/out.test.toml
+++ b/acceptance/bundle/debug/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/deploy/empty-bundle/out.test.toml b/acceptance/bundle/deploy/empty-bundle/out.test.toml
index 72e8a7a4dfe..772e01a6326 100644
--- a/acceptance/bundle/deploy/empty-bundle/out.test.toml
+++ b/acceptance/bundle/deploy/empty-bundle/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 EnvMatrix.DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = ["", "true"]
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/deploy/empty-bundle/output.txt b/acceptance/bundle/deploy/empty-bundle/output.txt
index 919accb661f..32057ac12f4 100644
--- a/acceptance/bundle/deploy/empty-bundle/output.txt
+++ b/acceptance/bundle/deploy/empty-bundle/output.txt
@@ -1,11 +1,10 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Deployment complete!
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle destroy --auto-approve
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 0 deleted
diff --git a/acceptance/bundle/deploy/empty-bundle/test.toml b/acceptance/bundle/deploy/empty-bundle/test.toml
index f64800a1636..c0e407629ec 100644
--- a/acceptance/bundle/deploy/empty-bundle/test.toml
+++ b/acceptance/bundle/deploy/empty-bundle/test.toml
@@ -1,4 +1,3 @@
 Cloud = true
 
-[EnvMatrix]
-DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = ["", "true"]
+EnvMatrix.DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = ["", "true"]
diff --git a/acceptance/bundle/deploy/experimental-python/out.test.toml b/acceptance/bundle/deploy/experimental-python/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/deploy/experimental-python/out.test.toml
+++ b/acceptance/bundle/deploy/experimental-python/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/deploy/experimental-python/output.txt b/acceptance/bundle/deploy/experimental-python/output.txt
index b3bfef9d4ca..e66bb4ef967 100644
--- a/acceptance/bundle/deploy/experimental-python/output.txt
+++ b/acceptance/bundle/deploy/experimental-python/output.txt
@@ -1,16 +1,16 @@
 
 >>> uv run --quiet --with [DATABRICKS_BUNDLES_WHEEL] -- [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.job1
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] jobs list --output json
 [
   {
     "created_time": [UNIX_TIME_MILLIS],
     "creator_user_name": "[USERNAME]",
-    "job_id": [NUMID],
+    "job_id": [JOB1_ID],
     "settings": {
       "deployment": {
         "kind": "BUNDLE",
diff --git a/acceptance/bundle/deploy/experimental-python/script b/acceptance/bundle/deploy/experimental-python/script
index 3e52e9c2a7a..7d4df28d794 100644
--- a/acceptance/bundle/deploy/experimental-python/script
+++ b/acceptance/bundle/deploy/experimental-python/script
@@ -1,3 +1,6 @@
 trace uv run --quiet --with $DATABRICKS_BUNDLES_WHEEL -- $CLI bundle deploy
-
-trace $CLI jobs list --output json
+trace $CLI jobs list --output json | tee jobs.json.tmp | nostamp
+# Take the id from the listing rather than via replace_ids.py: that needs the bundles wheel
+# (uv run), and uv cannot spawn a .py script on Windows. python3, not jq: the id exceeds 2^53.
+add_repl "$(python3 -c 'import sys, json; print(json.load(sys.stdin)[0]["job_id"])' < jobs.json.tmp)" JOB1_ID
+rm jobs.json.tmp
diff --git a/acceptance/bundle/deploy/experimental-python/test.toml b/acceptance/bundle/deploy/experimental-python/test.toml
deleted file mode 100644
index 05e2f27a229..00000000000
--- a/acceptance/bundle/deploy/experimental-python/test.toml
+++ /dev/null
@@ -1 +0,0 @@
-# need deterministic ids and clean workspace
diff --git a/acceptance/bundle/deploy/fail-on-active-runs/out.test.toml b/acceptance/bundle/deploy/fail-on-active-runs/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/deploy/fail-on-active-runs/out.test.toml
+++ b/acceptance/bundle/deploy/fail-on-active-runs/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/deploy/fail-on-active-runs/output.txt b/acceptance/bundle/deploy/fail-on-active-runs/output.txt
index b4ba46f998f..91445d88273 100644
--- a/acceptance/bundle/deploy/fail-on-active-runs/output.txt
+++ b/acceptance/bundle/deploy/fail-on-active-runs/output.txt
@@ -1,18 +1,18 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.my_job
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> errcode [CLI] bundle deploy --fail-on-active-runs
-Error: job [NUMID] is running
+Error: job [MY_JOB_ID] is running
 
 
 Exit code: 1
 
 === Expecting only 1 delete request to artifact_path/.internal folder from the first deploy
->>> jq -s .[] | select(.path=="/api/2.0/workspace/delete") | select(.body.path | test(".*/artifacts/.internal")) out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.0/workspace/delete") | select(.body.path | test(".*/artifacts/.internal")) [OUTPUT_DIR]/out.requests.txt
 {
   "method": "POST",
   "path": "/api/2.0/workspace/delete",
diff --git a/acceptance/bundle/deploy/fail-on-active-runs/script b/acceptance/bundle/deploy/fail-on-active-runs/script
index bedb035e2e7..7bfaacef082 100644
--- a/acceptance/bundle/deploy/fail-on-active-runs/script
+++ b/acceptance/bundle/deploy/fail-on-active-runs/script
@@ -1,10 +1,11 @@
 # We deploy the bundle first to create a job
 trace $CLI bundle deploy
+replace_ids.py
 
 # We deploy the bundle again to check that the deploy is failing if the job is running
 trace errcode $CLI bundle deploy --fail-on-active-runs
 
 title "Expecting only 1 delete request to artifact_path/.internal folder from the first deploy"
-trace jq -s '.[] | select(.path=="/api/2.0/workspace/delete") | select(.body.path | test(".*/artifacts/.internal"))' out.requests.txt
+trace jq -s '.[] | select(.path=="/api/2.0/workspace/delete") | select(.body.path | test(".*/artifacts/.internal"))' "$OUT_REQUESTS"
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/deploy/files/no-snapshot-sync/out.test.toml b/acceptance/bundle/deploy/files/no-snapshot-sync/out.test.toml
index 650836edeb3..0f167effef1 100644
--- a/acceptance/bundle/deploy/files/no-snapshot-sync/out.test.toml
+++ b/acceptance/bundle/deploy/files/no-snapshot-sync/out.test.toml
@@ -1,3 +1,2 @@
-Local = false
 Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/deploy/files/no-snapshot-sync/output.txt b/acceptance/bundle/deploy/files/no-snapshot-sync/output.txt
index 5ed1d5aa884..ab5fa74b709 100644
--- a/acceptance/bundle/deploy/files/no-snapshot-sync/output.txt
+++ b/acceptance/bundle/deploy/files/no-snapshot-sync/output.txt
@@ -1,9 +1,9 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.foo
+Files: 6 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 === Check that test file is in workspace
 >>> [CLI] workspace get-status /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files/test.py
@@ -44,9 +44,8 @@ Deployment complete!
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 4 uploaded, 2 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
 
 === Check that removed files are not in the workspace anymore
 >>> errcode [CLI] workspace get-status /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files/test.py
@@ -69,5 +68,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/deploy/files/no-snapshot-sync/test.toml b/acceptance/bundle/deploy/files/no-snapshot-sync/test.toml
index 7653e8c8194..4c6ee9a55df 100644
--- a/acceptance/bundle/deploy/files/no-snapshot-sync/test.toml
+++ b/acceptance/bundle/deploy/files/no-snapshot-sync/test.toml
@@ -1,12 +1,10 @@
-Local = false
 Cloud = true
 
 Ignore = [
     "databricks.yml",
 ]
 
-[Env]
 # MSYS2 automatically converts absolute paths like /Users/$username/$UNIQUE_NAME to
 # C:/Program Files/Git/Users/$username/UNIQUE_NAME before passing it to the CLI
 # Setting this environment variable prevents that conversion on windows.
-MSYS_NO_PATHCONV = "1"
+Env.MSYS_NO_PATHCONV = "1"
diff --git a/acceptance/bundle/deploy/files/out-of-band-delete/databricks.yml b/acceptance/bundle/deploy/files/out-of-band-delete/databricks.yml
new file mode 100644
index 00000000000..a4c66846c58
--- /dev/null
+++ b/acceptance/bundle/deploy/files/out-of-band-delete/databricks.yml
@@ -0,0 +1,15 @@
+bundle:
+  name: out-of-band-delete
+
+resources:
+  jobs:
+    foo:
+      name: test-job
+      tasks:
+        - task_key: my_task
+          spark_python_task:
+            python_file: ./hello_world.py
+          new_cluster:
+            num_workers: 1
+            spark_version: 13.3.x-snapshot-scala2.12
+            node_type_id: i3.xlarge
diff --git a/acceptance/bundle/deploy/files/out-of-band-delete/hello_world.py b/acceptance/bundle/deploy/files/out-of-band-delete/hello_world.py
new file mode 100644
index 00000000000..f301245e242
--- /dev/null
+++ b/acceptance/bundle/deploy/files/out-of-band-delete/hello_world.py
@@ -0,0 +1 @@
+print("Hello World!")
diff --git a/acceptance/bundle/deploy/files/out-of-band-delete/out.test.toml b/acceptance/bundle/deploy/files/out-of-band-delete/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/deploy/files/out-of-band-delete/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deploy/files/out-of-band-delete/output.txt b/acceptance/bundle/deploy/files/out-of-band-delete/output.txt
new file mode 100644
index 00000000000..4e5c2456633
--- /dev/null
+++ b/acceptance/bundle/deploy/files/out-of-band-delete/output.txt
@@ -0,0 +1,39 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/out-of-band-delete/default/files...
+Created jobs.foo
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== After the initial deploy the python_file exists
+>>> [CLI] workspace get-status /Workspace/Users/[USERNAME]/.bundle/out-of-band-delete/default/files/hello_world.py
+{
+  "object_type": "FILE",
+  "path": "/Workspace/Users/[USERNAME]/.bundle/out-of-band-delete/default/files/hello_world.py"
+}
+
+=== Delete the remote bundle directory out-of-band (simulates deleting it in the UI)
+>>> [CLI] workspace delete --recursive /Workspace/Users/[USERNAME]/.bundle/out-of-band-delete
+
+=== Redeploy reuses the stale snapshot, so the python_file is NOT re-uploaded
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/out-of-band-delete/default/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
+
+>>> musterr [CLI] workspace get-status /Workspace/Users/[USERNAME]/.bundle/out-of-band-delete/default/files/hello_world.py
+Error: Path (/Workspace/Users/[USERNAME]/.bundle/out-of-band-delete/default/files/hello_world.py) doesn't exist.
+
+=== Removing the sync snapshot forces a full re-upload, restoring the python_file
+>>> rm -rf .databricks/bundle/default/sync-snapshots
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/out-of-band-delete/default/files...
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
+
+>>> [CLI] workspace get-status /Workspace/Users/[USERNAME]/.bundle/out-of-band-delete/default/files/hello_world.py
+{
+  "object_type": "FILE",
+  "path": "/Workspace/Users/[USERNAME]/.bundle/out-of-band-delete/default/files/hello_world.py"
+}
diff --git a/acceptance/bundle/deploy/files/out-of-band-delete/script b/acceptance/bundle/deploy/files/out-of-band-delete/script
new file mode 100644
index 00000000000..183e58d04a2
--- /dev/null
+++ b/acceptance/bundle/deploy/files/out-of-band-delete/script
@@ -0,0 +1,21 @@
+# Reproduces https://github.com/databricks/cli/issues/1976: after the remote bundle
+# files are deleted out-of-band, a plain redeploy does not re-upload them.
+
+BUNDLE_PATH="/Workspace/Users/${CURRENT_USER_NAME}/.bundle/out-of-band-delete/default"
+
+trace $CLI bundle deploy
+
+title "After the initial deploy the python_file exists"
+trace $CLI workspace get-status "$BUNDLE_PATH/files/hello_world.py" | jq '{object_type,path}'
+
+title "Delete the remote bundle directory out-of-band (simulates deleting it in the UI)"
+trace $CLI workspace delete --recursive "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/out-of-band-delete"
+
+title "Redeploy reuses the stale snapshot, so the python_file is NOT re-uploaded"
+trace $CLI bundle deploy
+trace musterr $CLI workspace get-status "$BUNDLE_PATH/files/hello_world.py"
+
+title "Removing the sync snapshot forces a full re-upload, restoring the python_file"
+trace rm -rf .databricks/bundle/default/sync-snapshots
+trace $CLI bundle deploy
+trace $CLI workspace get-status "$BUNDLE_PATH/files/hello_world.py" | jq '{object_type,path}'
diff --git a/acceptance/bundle/deploy/files/out-of-band-delete/test.toml b/acceptance/bundle/deploy/files/out-of-band-delete/test.toml
new file mode 100644
index 00000000000..8c3f2408d5c
--- /dev/null
+++ b/acceptance/bundle/deploy/files/out-of-band-delete/test.toml
@@ -0,0 +1,13 @@
+# Recording needs a bundle it has seen from the start. This test seeds a state file,
+# so recording refuses it. TODO(DMS): drop this once existing state can be
+# handed over to the service (see the TODO in dstate.Open).
+EnvMatrix.DMS = [""]
+
+Badness = "After the remote bundle files are deleted out-of-band, the next deploy does not re-upload them until the local sync snapshot is removed."
+
+# This test passes absolute workspace paths like /Workspace/Users/.../hello_world.py
+# as CLI arguments. On Windows the script runs under MSYS2, which rewrites such
+# leading-slash arguments to Windows paths (e.g. C:/Program Files/Git/Workspace/...)
+# before the CLI sees them, so workspace get-status would query the wrong path.
+# Setting this environment variable disables that conversion.
+Env.MSYS_NO_PATHCONV = "1"
diff --git a/acceptance/bundle/deploy/files/upload-504/databricks.yml b/acceptance/bundle/deploy/files/upload-504/databricks.yml
new file mode 100644
index 00000000000..576d7a9ef25
--- /dev/null
+++ b/acceptance/bundle/deploy/files/upload-504/databricks.yml
@@ -0,0 +1,2 @@
+bundle:
+  name: test-bundle
diff --git a/acceptance/bundle/deploy/files/upload-504/out.test.toml b/acceptance/bundle/deploy/files/upload-504/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/deploy/files/upload-504/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/deploy/files/upload-504/output.txt b/acceptance/bundle/deploy/files/upload-504/output.txt
new file mode 100644
index 00000000000..52ff524b127
--- /dev/null
+++ b/acceptance/bundle/deploy/files/upload-504/output.txt
@@ -0,0 +1,6 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Warn: retrying after 504 Gateway Timeout from POST /api/2.0/workspace/import: failed to upload /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/databricks.yml: Fault injected by test.
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/databricks.yml
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/databricks.yml
diff --git a/acceptance/bundle/deploy/files/upload-504/script b/acceptance/bundle/deploy/files/upload-504/script
new file mode 100644
index 00000000000..78740b9becc
--- /dev/null
+++ b/acceptance/bundle/deploy/files/upload-504/script
@@ -0,0 +1,8 @@
+# Let the two deploy lock requests through, then inject a single 504 on the next import request, which is a file upload.
+# Uploads overwrite, so they are retried and the deploy succeeds.
+fault.py "POST /api/2.0/workspace/import" 504 2 1
+
+$CLI bundle deploy
+
+# databricks.yml is the only file. Two requests for it should appear: the initial 504 and the successful retry.
+print_requests.py //api/2.0/workspace/import | jq -r .body.multipart_form.path | grep '/files/'
diff --git a/acceptance/bundle/deploy/files/upload-504/test.toml b/acceptance/bundle/deploy/files/upload-504/test.toml
new file mode 100644
index 00000000000..7d496b2f139
--- /dev/null
+++ b/acceptance/bundle/deploy/files/upload-504/test.toml
@@ -0,0 +1,3 @@
+RecordRequests = true
+Env.DATABRICKS_BUNDLE_RETRY_INTERVAL_MS = "100"
+Env.DATABRICKS_BUNDLE_RETRY_DISABLE_WARNING = ""
diff --git a/acceptance/bundle/deploy/force-lock-config/databricks.yml b/acceptance/bundle/deploy/force-lock-config/databricks.yml
new file mode 100644
index 00000000000..5871468aeee
--- /dev/null
+++ b/acceptance/bundle/deploy/force-lock-config/databricks.yml
@@ -0,0 +1,11 @@
+bundle:
+  name: test-bundle-force-lock
+
+  deployment:
+    lock:
+      force: true
+
+resources:
+  jobs:
+    foo:
+      name: test-job
diff --git a/acceptance/bundle/deploy/force-lock-config/deploy.lock b/acceptance/bundle/deploy/force-lock-config/deploy.lock
new file mode 100644
index 00000000000..ce5e0f16801
--- /dev/null
+++ b/acceptance/bundle/deploy/force-lock-config/deploy.lock
@@ -0,0 +1,6 @@
+{
+  "ID": "12345678-1234-1234-1234-123456789abc",
+  "AcquisitionTime": "2024-01-15T15:40:00Z",
+  "IsForced": false,
+  "User": "user-with-lock@databricks.com"
+}
diff --git a/acceptance/bundle/deploy/force-lock-config/out.test.toml b/acceptance/bundle/deploy/force-lock-config/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/deploy/force-lock-config/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/deploy/force-lock-config/output.txt b/acceptance/bundle/deploy/force-lock-config/output.txt
new file mode 100644
index 00000000000..222e4c4dc6c
--- /dev/null
+++ b/acceptance/bundle/deploy/force-lock-config/output.txt
@@ -0,0 +1,10 @@
+
+=== upload a stale lock file held by another user
+>>> [CLI] workspace import /Workspace/Users/[USERNAME]/.bundle/test-bundle-force-lock/default/state/deploy.lock --format AUTO --file ./deploy.lock
+
+=== bundle.deployment.lock.force is set in databricks.yml, so the stale lock is overridden
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-force-lock/default/files...
+Created jobs.foo
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
diff --git a/acceptance/bundle/deploy/force-lock-config/script b/acceptance/bundle/deploy/force-lock-config/script
new file mode 100644
index 00000000000..3e10540c60d
--- /dev/null
+++ b/acceptance/bundle/deploy/force-lock-config/script
@@ -0,0 +1,11 @@
+export username=$($CLI current-user me | jq -r .userName)
+export MSYS_NO_PATHCONV=1
+
+title "upload a stale lock file held by another user"
+# The import API returns a 404 if the parent directory does not exist. No deploy has
+# run yet, so create the state directory before uploading the lock file into it.
+$CLI workspace mkdirs /Workspace/Users/$username/.bundle/test-bundle-force-lock/default/state
+trace $CLI workspace import /Workspace/Users/$username/.bundle/test-bundle-force-lock/default/state/deploy.lock --format AUTO --file ./deploy.lock
+
+title "bundle.deployment.lock.force is set in databricks.yml, so the stale lock is overridden"
+trace $CLI bundle deploy
diff --git a/acceptance/bundle/deploy/immutable-dev-mode/databricks.yml.tmpl b/acceptance/bundle/deploy/immutable-dev-mode/databricks.yml.tmpl
new file mode 100644
index 00000000000..601b9277507
--- /dev/null
+++ b/acceptance/bundle/deploy/immutable-dev-mode/databricks.yml.tmpl
@@ -0,0 +1,28 @@
+bundle:
+  name: test-bundle-immutable-dev-mode-$UNIQUE_NAME
+
+experimental:
+  immutable_folder: true
+
+resources:
+  jobs:
+    my_job:
+      name: my job
+      tasks:
+        - task_key: spark_python_task
+          spark_python_task:
+            python_file: ./src/main.py
+          environment_key: env
+      environments:
+        - environment_key: env
+          spec:
+            environment_version: "4"
+
+targets:
+  dev:
+    mode: development
+    default: true
+  prod:
+    mode: production
+    workspace:
+      root_path: /Workspace/Users/${workspace.current_user.userName}/.bundle/${bundle.name}/prod
diff --git a/acceptance/bundle/deploy/immutable-dev-mode/out.test.toml b/acceptance/bundle/deploy/immutable-dev-mode/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/deploy/immutable-dev-mode/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/deploy/immutable-dev-mode/output.txt b/acceptance/bundle/deploy/immutable-dev-mode/output.txt
new file mode 100644
index 00000000000..9d38d6c271e
--- /dev/null
+++ b/acceptance/bundle/deploy/immutable-dev-mode/output.txt
@@ -0,0 +1,38 @@
+
+>>> [CLI] bundle validate -t dev
+Name: test-bundle-immutable-dev-mode-[UNIQUE_NAME]
+Target: dev
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle-immutable-dev-mode-[UNIQUE_NAME]/dev
+
+Validation OK!
+
+>>> [CLI] bundle validate -t prod
+Name: test-bundle-immutable-dev-mode-[UNIQUE_NAME]
+Target: prod
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle-immutable-dev-mode-[UNIQUE_NAME]/prod
+
+Validation OK!
+
+>>> [CLI] bundle deploy -t dev
+Created internal_immutable_snapshots.immutable
+Created jobs.my_job
+Files: 0 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] jobs get [MY_JOB_ID]
+{
+  "name": "[dev [USERNAME]] my job",
+  "python_file": "/Workspace/Users/[UUID]/.snapshots/[SNAPSHOT_HASH]/[SNAPSHOT_HASH]/files/src/main.py"
+}
+
+>>> [CLI] bundle destroy -t dev --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.my_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-immutable-dev-mode-[UNIQUE_NAME]/dev
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/deploy/immutable-dev-mode/script b/acceptance/bundle/deploy/immutable-dev-mode/script
new file mode 100644
index 00000000000..31c0bdbb415
--- /dev/null
+++ b/acceptance/bundle/deploy/immutable-dev-mode/script
@@ -0,0 +1,13 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+cleanup() {
+    trace $CLI bundle destroy -t dev --auto-approve
+}
+trap cleanup EXIT
+
+# The snapshot path is unique per deployment, so 'mode: development' must accept it.
+trace $CLI bundle validate -t dev
+trace $CLI bundle validate -t prod
+
+trace $CLI bundle deploy -t dev
+
+trace $CLI jobs get "$(read_id.py -t dev my_job)" | jq '{name: .settings.name, python_file: .settings.tasks[0].spark_python_task.python_file}'
diff --git a/acceptance/bundle/deploy/immutable-dev-mode/src/main.py b/acceptance/bundle/deploy/immutable-dev-mode/src/main.py
new file mode 100644
index 00000000000..d1051b49f65
--- /dev/null
+++ b/acceptance/bundle/deploy/immutable-dev-mode/src/main.py
@@ -0,0 +1 @@
+print("Hello from immutable dev mode")
diff --git a/acceptance/bundle/deploy/immutable-dev-mode/test.toml b/acceptance/bundle/deploy/immutable-dev-mode/test.toml
new file mode 100644
index 00000000000..267c545f8e0
--- /dev/null
+++ b/acceptance/bundle/deploy/immutable-dev-mode/test.toml
@@ -0,0 +1,14 @@
+Cloud = false # Temporary disable cloud tests until the API is fully available
+
+# immutable_folder only works with the direct engine.
+
+Ignore = [
+    "databricks.yml",
+    ".databricks",
+]
+
+# Normalize the content-addressed snapshot hash so it doesn't need to be
+# hardcoded in output.txt and the test stays stable across file changes.
+[[Repls]]
+Old = '[0-9a-f]{64}'
+New = '[SNAPSHOT_HASH]'
diff --git a/acceptance/bundle/deploy/immutable-no-artifacts/.gitignore b/acceptance/bundle/deploy/immutable-no-artifacts/.gitignore
new file mode 100644
index 00000000000..78caa68e38e
--- /dev/null
+++ b/acceptance/bundle/deploy/immutable-no-artifacts/.gitignore
@@ -0,0 +1,2 @@
+*.txt
+*.json
diff --git a/acceptance/bundle/deploy/immutable-no-artifacts/databricks.yml.tmpl b/acceptance/bundle/deploy/immutable-no-artifacts/databricks.yml.tmpl
new file mode 100644
index 00000000000..6c41e997af6
--- /dev/null
+++ b/acceptance/bundle/deploy/immutable-no-artifacts/databricks.yml.tmpl
@@ -0,0 +1,26 @@
+bundle:
+  name: test-bundle-immutable-no-artifacts-$UNIQUE_NAME
+
+experimental:
+  immutable_folder: true
+
+resources:
+  jobs:
+    my_job:
+      name: my job
+      tasks:
+        - task_key: spark_python_task
+          spark_python_task:
+            python_file: ./src/main.py
+          environment_key: env
+        - task_key: notebook_task
+          notebook_task:
+            notebook_path: ./src/notebook.py
+            base_parameters:
+              path: ${workspace.file_path}/some_path
+
+
+      environments:
+        - environment_key: env
+          spec:
+            environment_version: "4"
diff --git a/acceptance/bundle/deploy/immutable-no-artifacts/out.test.toml b/acceptance/bundle/deploy/immutable-no-artifacts/out.test.toml
new file mode 100644
index 00000000000..f7fafbcc731
--- /dev/null
+++ b/acceptance/bundle/deploy/immutable-no-artifacts/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/deploy/immutable-no-artifacts/output.txt b/acceptance/bundle/deploy/immutable-no-artifacts/output.txt
new file mode 100644
index 00000000000..2fd5d2c3ef1
--- /dev/null
+++ b/acceptance/bundle/deploy/immutable-no-artifacts/output.txt
@@ -0,0 +1,125 @@
+
+>>> [CLI] bundle validate
+Name: test-bundle-immutable-no-artifacts-[UNIQUE_NAME]
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle-immutable-no-artifacts-[UNIQUE_NAME]/default
+
+Validation OK!
+
+>>> [CLI] bundle plan -o json
+
+>>> jq .plan["resources.jobs.my_job"].new_state.value.tasks plan.json
+[
+  {
+    "notebook_task": {
+      "base_parameters": {
+        "path": "/Workspace/Users/[UUID]/.snapshots/[SNAPSHOT_HASH]/[SNAPSHOT_HASH]/files/some_path"
+      },
+      "notebook_path": "/Workspace/Users/[UUID]/.snapshots/[SNAPSHOT_HASH]/[SNAPSHOT_HASH]/files/src/notebook"
+    },
+    "task_key": "notebook_task"
+  },
+  {
+    "environment_key": "env",
+    "spark_python_task": {
+      "python_file": "/Workspace/Users/[UUID]/.snapshots/[SNAPSHOT_HASH]/[SNAPSHOT_HASH]/files/src/main.py"
+    },
+    "task_key": "spark_python_task"
+  }
+]
+
+>>> jq .plan["resources.internal_immutable_snapshots.immutable"] plan.json
+{
+  "action": "create",
+  "new_state": {
+    "value": {
+      "relative_path": "[SNAPSHOT_HASH]/[SNAPSHOT_HASH]",
+      "full_path": "/Workspace/Users/[UUID]/.snapshots/[SNAPSHOT_HASH]/[SNAPSHOT_HASH]",
+      "bundle_id": "[SNAPSHOT_HASH]",
+      "acl": [
+        {
+          "user_name": "[USERNAME]",
+          "permission_level": "CAN_READ"
+        }
+      ],
+      "zip_path": "[TEST_TMP_DIR]/.databricks/bundle/default/snapshots/[SNAPSHOT_HASH].zip"
+    }
+  }
+}
+
+>>> [CLI] bundle deploy
+Created internal_immutable_snapshots.immutable
+Created jobs.my_job
+Files: 0 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> jq .settings.tasks job.json
+"/Workspace/Users/[UUID]/.snapshots/[SNAPSHOT_HASH]/[SNAPSHOT_HASH]/files/src/main.py"
+
+>>> jq .settings.tasks job.json
+"/Workspace/Users/[UUID]/.snapshots/[SNAPSHOT_HASH]/[SNAPSHOT_HASH]/files/src/notebook"
+
+>>> jq .settings.tasks job.json
+"/Workspace/Users/[UUID]/.snapshots/[SNAPSHOT_HASH]/[SNAPSHOT_HASH]/files/some_path"
+
+>>> title Check snapshot plan after deploy: 
+
+=== Check snapshot plan after deploy: 
+>>> [CLI] bundle plan -o json
+
+>>> jq .plan["resources.internal_immutable_snapshots.immutable"] plan.json
+{
+  "action": "skip",
+  "remote_state": {
+    "relative_path": "[SNAPSHOT_HASH]/[SNAPSHOT_HASH]",
+    "full_path": "/Workspace/Users/[UUID]/.snapshots/[SNAPSHOT_HASH]/[SNAPSHOT_HASH]"
+  },
+  "changes": {
+    "acl": {
+      "action": "skip",
+      "reason": "missing_in_remote",
+      "old": [
+        {
+          "user_name": "[USERNAME]",
+          "permission_level": "CAN_READ"
+        }
+      ],
+      "new": [
+        {
+          "user_name": "[USERNAME]",
+          "permission_level": "CAN_READ"
+        }
+      ],
+      "remote": null
+    },
+    "bundle_id": {
+      "action": "skip",
+      "reason": "missing_in_remote",
+      "old": "[SNAPSHOT_HASH]",
+      "new": "[SNAPSHOT_HASH]",
+      "remote": ""
+    },
+    "zip_path": {
+      "action": "skip",
+      "reason": "missing_in_remote",
+      "old": "[TEST_TMP_DIR]/.databricks/bundle/default/snapshots/[SNAPSHOT_HASH].zip",
+      "new": "[TEST_TMP_DIR]/.databricks/bundle/default/snapshots/[SNAPSHOT_HASH].zip",
+      "remote": ""
+    }
+  }
+}
+
+>>> [CLI] bundle deploy
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 2 unchanged
+Snapshot did not change as expected
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.my_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-immutable-no-artifacts-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/deploy/immutable-no-artifacts/script b/acceptance/bundle/deploy/immutable-no-artifacts/script
new file mode 100644
index 00000000000..4bf3fddd7a6
--- /dev/null
+++ b/acceptance/bundle/deploy/immutable-no-artifacts/script
@@ -0,0 +1,33 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+trace $CLI bundle validate
+trace $CLI bundle plan -o json > plan.json
+trace jq '.plan["resources.jobs.my_job"].new_state.value.tasks' plan.json
+trace jq '.plan["resources.internal_immutable_snapshots.immutable"]' plan.json
+
+trace $CLI bundle deploy $(readplanarg plan.json)
+
+# Get a job and check that task paths point into the snapshot
+JOB_ID=$($CLI bundle summary -o json | jq -r '.resources.jobs.my_job.id')
+$CLI jobs get $JOB_ID > job.json
+trace jq '.settings.tasks' job.json | jq '.[] | select(.spark_python_task != null) | .spark_python_task.python_file'
+trace jq '.settings.tasks' job.json | jq '.[] | select(.notebook_task != null) | .notebook_task.notebook_path'
+trace jq '.settings.tasks' job.json | jq '.[] | select(.notebook_task != null) | .notebook_task.base_parameters.path'
+PYTHON_FILE_1=$(jq '.settings.tasks' job.json | jq '.[] | select(.spark_python_task != null) | .spark_python_task.python_file')
+
+trace title "Check snapshot plan after deploy: "
+trace $CLI bundle plan -o json > plan.json
+trace jq '.plan["resources.internal_immutable_snapshots.immutable"]' plan.json
+
+trace $CLI bundle deploy $(readplanarg plan.json)
+rm plan.json
+rm job.json
+
+PYTHON_FILE_2=$($CLI jobs get $JOB_ID | jq '.settings.tasks' | jq '.[] | select(.spark_python_task != null) | .spark_python_task.python_file')
+if [ "$PYTHON_FILE_1" == "$PYTHON_FILE_2" ]; then
+    echo "Snapshot did not change as expected"
+else
+    echo "Snapshot changed"
+    exit 1
+fi
+trace $CLI bundle destroy --auto-approve
diff --git a/acceptance/bundle/deploy/immutable-no-artifacts/src/main.py b/acceptance/bundle/deploy/immutable-no-artifacts/src/main.py
new file mode 100644
index 00000000000..6c285f7e2f5
--- /dev/null
+++ b/acceptance/bundle/deploy/immutable-no-artifacts/src/main.py
@@ -0,0 +1 @@
+print("Hello from Spark Python Task!")
diff --git a/acceptance/bundle/deploy/immutable-no-artifacts/src/notebook.py b/acceptance/bundle/deploy/immutable-no-artifacts/src/notebook.py
new file mode 100644
index 00000000000..fb3c9597fbf
--- /dev/null
+++ b/acceptance/bundle/deploy/immutable-no-artifacts/src/notebook.py
@@ -0,0 +1,3 @@
+# Databricks notebook source
+
+print("Hello from Notebook Task!")
diff --git a/acceptance/bundle/deploy/immutable-no-artifacts/test.toml b/acceptance/bundle/deploy/immutable-no-artifacts/test.toml
new file mode 100644
index 00000000000..a2373c4f892
--- /dev/null
+++ b/acceptance/bundle/deploy/immutable-no-artifacts/test.toml
@@ -0,0 +1,23 @@
+Cloud = false # Temporary disable cloud tests until the API is fully available
+EnvMatrix.READPLAN = ["", "1"]
+
+# immutable_folder only works with the direct engine.
+
+Ignore = [
+    "databricks.yml",
+    ".databricks",
+    ".venv",
+    "*.pyc",
+]
+
+# Normalize the content-addressed snapshot hash so it doesn't need to be
+# hardcoded in output.txt and the test stays stable across file changes.
+[[Repls]]
+Old = '[0-9a-f]{64}'
+New = '[SNAPSHOT_HASH]'
+
+# When READPLAN=1, "bundle deploy" is called as "bundle deploy --plan plan.json".
+# Normalize so both variants produce identical output.
+[[Repls]]
+Old = ' --plan plan.json'
+New = ''
diff --git a/acceptance/bundle/deploy/immutable-permissions-change/databricks.yml.tmpl b/acceptance/bundle/deploy/immutable-permissions-change/databricks.yml.tmpl
new file mode 100644
index 00000000000..e23e6f3af5c
--- /dev/null
+++ b/acceptance/bundle/deploy/immutable-permissions-change/databricks.yml.tmpl
@@ -0,0 +1,19 @@
+bundle:
+  name: test-bundle-immutable-perms-$UNIQUE_NAME
+
+experimental:
+  immutable_folder: true
+
+resources:
+  jobs:
+    my_job:
+      name: my job
+      tasks:
+        - task_key: spark_python_task
+          spark_python_task:
+            python_file: ./src/main.py
+          environment_key: env
+      environments:
+        - environment_key: env
+          spec:
+            environment_version: "4"
diff --git a/acceptance/bundle/deploy/immutable-permissions-change/out.test.toml b/acceptance/bundle/deploy/immutable-permissions-change/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/deploy/immutable-permissions-change/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/deploy/immutable-permissions-change/output.txt b/acceptance/bundle/deploy/immutable-permissions-change/output.txt
new file mode 100644
index 00000000000..7e45089b269
--- /dev/null
+++ b/acceptance/bundle/deploy/immutable-permissions-change/output.txt
@@ -0,0 +1,52 @@
+
+=== Deploy without permissions
+>>> [CLI] bundle deploy
+Created internal_immutable_snapshots.immutable
+Created jobs.my_job
+Files: 0 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+First snapshot path: /Workspace/Users/[UUID]/.snapshots/[SNAPSHOT_HASH]/[SNAPSHOT_HASH]/files/src/main.py
+
+=== Add permissions and redeploy
+>>> [CLI] bundle deploy
+Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
+If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
+
+Consider using a adding a top-level permissions section such as the following:
+
+  permissions:
+    - user_name: [USERNAME]
+      level: CAN_MANAGE
+
+See https://docs.databricks.com/dev-tools/bundles/permissions.html to learn more about permission configuration.
+  in databricks.yml:22:3
+
+Recreated internal_immutable_snapshots.immutable
+Updated jobs.my_job
+Created jobs.my_job.permissions
+Files: 0 uploaded, 0 deleted
+Resources: 2 created, 1 changed, 1 deleted, 0 unchanged
+Second snapshot path: /Workspace/Users/[UUID]/.snapshots/[SNAPSHOT_HASH]/[SNAPSHOT_HASH]/files/src/main.py
+
+=== Verify snapshot path changed after permissions change
+OK: snapshot path changed as expected
+
+>>> [CLI] bundle destroy --auto-approve
+Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
+If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
+
+Consider using a adding a top-level permissions section such as the following:
+
+  permissions:
+    - user_name: [USERNAME]
+      level: CAN_MANAGE
+
+See https://docs.databricks.com/dev-tools/bundles/permissions.html to learn more about permission configuration.
+  in databricks.yml:22:3
+
+The following resources will be deleted:
+  delete resources.jobs.my_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-immutable-perms-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/deploy/immutable-permissions-change/script b/acceptance/bundle/deploy/immutable-permissions-change/script
new file mode 100644
index 00000000000..458bfdd2c85
--- /dev/null
+++ b/acceptance/bundle/deploy/immutable-permissions-change/script
@@ -0,0 +1,35 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+title "Deploy without permissions"
+trace $CLI bundle deploy
+
+JOB_ID=$($CLI bundle summary -o json | jq -r '.resources.jobs.my_job.id')
+SNAPSHOT_PATH_1=$($CLI jobs get "$JOB_ID" | jq -r '.settings.tasks[0].spark_python_task.python_file')
+echo "First snapshot path: $SNAPSHOT_PATH_1"
+
+title "Add permissions and redeploy"
+cat >> databricks.yml <<'EOF'
+
+permissions:
+  - level: CAN_VIEW
+    group_name: admins
+EOF
+
+trace $CLI bundle deploy
+
+SNAPSHOT_PATH_2=$($CLI jobs get "$JOB_ID" | jq -r '.settings.tasks[0].spark_python_task.python_file')
+echo "Second snapshot path: $SNAPSHOT_PATH_2"
+
+title "Verify snapshot path changed after permissions change"
+echo ""
+if [ "$SNAPSHOT_PATH_1" = "$SNAPSHOT_PATH_2" ]; then
+    echo "ERROR: snapshot path did not change after permissions were added"
+    exit 1
+else
+    echo "OK: snapshot path changed as expected"
+fi
diff --git a/acceptance/bundle/deploy/immutable-permissions-change/src/main.py b/acceptance/bundle/deploy/immutable-permissions-change/src/main.py
new file mode 100644
index 00000000000..6c285f7e2f5
--- /dev/null
+++ b/acceptance/bundle/deploy/immutable-permissions-change/src/main.py
@@ -0,0 +1 @@
+print("Hello from Spark Python Task!")
diff --git a/acceptance/bundle/deploy/immutable-permissions-change/test.toml b/acceptance/bundle/deploy/immutable-permissions-change/test.toml
new file mode 100644
index 00000000000..0439d8243bc
--- /dev/null
+++ b/acceptance/bundle/deploy/immutable-permissions-change/test.toml
@@ -0,0 +1,13 @@
+Cloud = false # Temporary disable cloud tests until the API is fully available
+
+# immutable_folder only works with the direct engine.
+
+Ignore = [
+    "databricks.yml",
+    ".databricks",
+]
+
+[[Repls]]
+# Replace snapshot hash with SNAPSHOT_HASH
+Old = "[0-9a-f]{64}"
+New = "[SNAPSHOT_HASH]"
diff --git a/acceptance/bundle/deploy/immutable/databricks.yml.tmpl b/acceptance/bundle/deploy/immutable/databricks.yml.tmpl
new file mode 100644
index 00000000000..407a1bbbe6f
--- /dev/null
+++ b/acceptance/bundle/deploy/immutable/databricks.yml.tmpl
@@ -0,0 +1,34 @@
+bundle:
+  name: test-bundle-immutable-$UNIQUE_NAME
+
+experimental:
+  immutable_folder: true
+
+artifacts:
+  python_artifact:
+    type: whl
+    build: uv build --wheel
+
+resources:
+  jobs:
+    my_job:
+      name: my job
+      tasks:
+        - task_key: spark_python_task
+          spark_python_task:
+            python_file: ./src/main.py
+          environment_key: env
+        - task_key: notebook_task
+          notebook_task:
+            notebook_path: ./src/notebook.py
+        - task_key: python_wheel_task
+          python_wheel_task:
+            package_name: immutable
+            entry_point: main
+          environment_key: env
+      environments:
+        - environment_key: env
+          spec:
+            environment_version: "4"
+            dependencies:
+              - ./dist/*.whl
diff --git a/acceptance/bundle/deploy/immutable/out.test.toml b/acceptance/bundle/deploy/immutable/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/deploy/immutable/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/deploy/immutable/output.txt b/acceptance/bundle/deploy/immutable/output.txt
new file mode 100644
index 00000000000..56de6c28d57
--- /dev/null
+++ b/acceptance/bundle/deploy/immutable/output.txt
@@ -0,0 +1,180 @@
+
+>>> [CLI] bundle validate
+Name: test-bundle-immutable-[UNIQUE_NAME]
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle-immutable-[UNIQUE_NAME]/default
+
+Validation OK!
+
+>>> [CLI] bundle plan -o json
+Building python_artifact...
+
+>>> jq .plan["resources.jobs.my_job"].new_state.value.tasks plan.json
+[
+  {
+    "notebook_task": {
+      "notebook_path": "/Workspace/Users/[UUID]/.snapshots/[SNAPSHOT_HASH]/[SNAPSHOT_HASH]/files/src/notebook"
+    },
+    "task_key": "notebook_task"
+  },
+  {
+    "environment_key": "env",
+    "python_wheel_task": {
+      "entry_point": "main",
+      "package_name": "immutable"
+    },
+    "task_key": "python_wheel_task"
+  },
+  {
+    "environment_key": "env",
+    "spark_python_task": {
+      "python_file": "/Workspace/Users/[UUID]/.snapshots/[SNAPSHOT_HASH]/[SNAPSHOT_HASH]/files/src/main.py"
+    },
+    "task_key": "spark_python_task"
+  }
+]
+
+>>> jq .plan["resources.jobs.my_job"].new_state.value.environments plan.json
+[
+  {
+    "environment_key": "env",
+    "spec": {
+      "dependencies": [
+        "/Workspace/Users/[UUID]/.snapshots/[SNAPSHOT_HASH]/[SNAPSHOT_HASH]/artifacts/.internal/immutable-0.0.1-py3-none-any.whl"
+      ],
+      "environment_version": "4"
+    }
+  }
+]
+
+>>> jq .plan["resources.internal_immutable_snapshots.immutable"] plan.json
+{
+  "action": "create",
+  "new_state": {
+    "value": {
+      "relative_path": "[SNAPSHOT_HASH]/[SNAPSHOT_HASH]",
+      "full_path": "/Workspace/Users/[UUID]/.snapshots/[SNAPSHOT_HASH]/[SNAPSHOT_HASH]",
+      "bundle_id": "[SNAPSHOT_HASH]",
+      "acl": [
+        {
+          "user_name": "[USERNAME]",
+          "permission_level": "CAN_READ"
+        }
+      ],
+      "zip_path": "[TEST_TMP_DIR]/.databricks/bundle/default/snapshots/[SNAPSHOT_HASH].zip"
+    }
+  }
+}
+
+>>> [CLI] bundle deploy
+Building python_artifact...
+Created internal_immutable_snapshots.immutable
+Created jobs.my_job
+Files: 0 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> jq .settings.tasks job.json
+"/Workspace/Users/[UUID]/.snapshots/[SNAPSHOT_HASH]/[SNAPSHOT_HASH]/files/src/main.py"
+
+>>> jq .settings.tasks job.json
+"/Workspace/Users/[UUID]/.snapshots/[SNAPSHOT_HASH]/[SNAPSHOT_HASH]/files/src/notebook"
+
+>>> jq .settings.environments[0].spec.dependencies job.json
+[
+  "/Workspace/Users/[UUID]/.snapshots/[SNAPSHOT_HASH]/[SNAPSHOT_HASH]/artifacts/.internal/immutable-0.0.1-py3-none-any.whl"
+]
+
+>>> title Check snapshot plan after deploy
+
+=== Check snapshot plan after deploy
+>>> [CLI] bundle plan -o json
+Building python_artifact...
+
+>>> jq .plan["resources.internal_immutable_snapshots.immutable"] plan.json
+{
+  "action": "recreate",
+  "new_state": {
+    "value": {
+      "relative_path": "[SNAPSHOT_HASH]/[SNAPSHOT_HASH]",
+      "full_path": "/Workspace/Users/[UUID]/.snapshots/[SNAPSHOT_HASH]/[SNAPSHOT_HASH]",
+      "bundle_id": "[SNAPSHOT_HASH]",
+      "acl": [
+        {
+          "user_name": "[USERNAME]",
+          "permission_level": "CAN_READ"
+        }
+      ],
+      "zip_path": "[TEST_TMP_DIR]/.databricks/bundle/default/snapshots/[SNAPSHOT_HASH].zip"
+    }
+  },
+  "remote_state": {
+    "relative_path": "[SNAPSHOT_HASH]/[SNAPSHOT_HASH]",
+    "full_path": "/Workspace/Users/[UUID]/.snapshots/[SNAPSHOT_HASH]/[SNAPSHOT_HASH]"
+  },
+  "changes": {
+    "acl": {
+      "action": "skip",
+      "reason": "missing_in_remote",
+      "old": [
+        {
+          "user_name": "[USERNAME]",
+          "permission_level": "CAN_READ"
+        }
+      ],
+      "new": [
+        {
+          "user_name": "[USERNAME]",
+          "permission_level": "CAN_READ"
+        }
+      ],
+      "remote": null
+    },
+    "bundle_id": {
+      "action": "skip",
+      "reason": "missing_in_remote",
+      "old": "[SNAPSHOT_HASH]",
+      "new": "[SNAPSHOT_HASH]",
+      "remote": ""
+    },
+    "full_path": {
+      "action": "recreate",
+      "reason": "immutable",
+      "old": "/Workspace/Users/[UUID]/.snapshots/[SNAPSHOT_HASH]/[SNAPSHOT_HASH]",
+      "new": "/Workspace/Users/[UUID]/.snapshots/[SNAPSHOT_HASH]/[SNAPSHOT_HASH]",
+      "remote": "/Workspace/Users/[UUID]/.snapshots/[SNAPSHOT_HASH]/[SNAPSHOT_HASH]"
+    },
+    "relative_path": {
+      "action": "recreate",
+      "reason": "immutable",
+      "old": "[SNAPSHOT_HASH]/[SNAPSHOT_HASH]",
+      "new": "[SNAPSHOT_HASH]/[SNAPSHOT_HASH]",
+      "remote": "[SNAPSHOT_HASH]/[SNAPSHOT_HASH]"
+    },
+    "zip_path": {
+      "action": "recreate",
+      "reason": "immutable",
+      "old": "[TEST_TMP_DIR]/.databricks/bundle/default/snapshots/[SNAPSHOT_HASH].zip",
+      "new": "[TEST_TMP_DIR]/.databricks/bundle/default/snapshots/[SNAPSHOT_HASH].zip",
+      "remote": ""
+    }
+  }
+}
+
+>>> [CLI] bundle deploy
+Building python_artifact...
+Recreated internal_immutable_snapshots.immutable
+Updated jobs.my_job
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 1 changed, 1 deleted, 0 unchanged
+
+=== Check that job uses a new snapshot: Snapshot changed as expected
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.my_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-immutable-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/deploy/immutable/pyproject.toml b/acceptance/bundle/deploy/immutable/pyproject.toml
new file mode 100644
index 00000000000..4e796c3f93a
--- /dev/null
+++ b/acceptance/bundle/deploy/immutable/pyproject.toml
@@ -0,0 +1,34 @@
+[project]
+name = "immutable"
+version = "0.0.1"
+authors = [{ name = "andrew.nester@databricks.com" }]
+requires-python = ">=3.10,<3.13"
+dependencies = [
+    # Any dependencies for jobs and pipelines in this project can be added here
+    # See also https://docs.databricks.com/dev-tools/bundles/library-dependencies
+    #
+    # LIMITATION: for pipelines, dependencies are cached during development;
+    # add dependencies to the 'environment' section of your pipeline.yml file instead
+]
+
+[dependency-groups]
+dev = [
+    "pytest",
+    "ruff",
+    "databricks-dlt",
+    "databricks-connect>=15.4,<15.5",
+    "ipykernel",
+]
+
+[project.scripts]
+main = "immutable.main:main"
+
+[build-system]
+requires = ["setuptools>=40.8.0"]
+build-backend = "setuptools.build_meta"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.ruff]
+line-length = 120
diff --git a/acceptance/bundle/deploy/immutable/script b/acceptance/bundle/deploy/immutable/script
new file mode 100644
index 00000000000..5babe793a9a
--- /dev/null
+++ b/acceptance/bundle/deploy/immutable/script
@@ -0,0 +1,41 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+trace $CLI bundle validate
+trace $CLI bundle plan -o json > plan.json
+trace jq '.plan["resources.jobs.my_job"].new_state.value.tasks' plan.json
+trace jq '.plan["resources.jobs.my_job"].new_state.value.environments' plan.json
+trace jq '.plan["resources.internal_immutable_snapshots.immutable"]' plan.json
+
+trace $CLI bundle deploy
+
+# Get a job and check that task paths are immutable
+JOB_ID=$($CLI bundle summary -o json | jq -r '.resources.jobs.my_job.id')
+$CLI jobs get $JOB_ID > job.json
+trace jq '.settings.tasks' job.json | jq '.[] | select(.spark_python_task != null) | .spark_python_task.python_file'
+trace jq '.settings.tasks' job.json | jq '.[] | select(.notebook_task != null) | .notebook_task.notebook_path'
+trace jq '.settings.environments[0].spec.dependencies' job.json
+PYTHON_FILE_1=$(jq '.settings.tasks' job.json | jq '.[] | select(.spark_python_task != null) | .spark_python_task.python_file')
+
+trace title "Check snapshot plan after deploy"
+trace $CLI bundle plan -o json > plan.json
+trace jq '.plan["resources.internal_immutable_snapshots.immutable"]' plan.json
+rm plan.json
+rm job.json
+
+trace $CLI bundle deploy
+
+title "Check that job uses a new snapshot: "
+PYTHON_FILE_2=$($CLI jobs get $JOB_ID | jq '.settings.tasks' | jq '.[] | select(.spark_python_task != null) | .spark_python_task.python_file')
+if [ "$PYTHON_FILE_1" != "$PYTHON_FILE_2" ]; then
+    echo "Snapshot changed as expected"
+else
+    echo "Snapshot did not change"
+    exit 1
+fi
+
+# Redirect run output to a log file — the real workspace produces different output than the local test server.
+$CLI bundle run my_job &> LOG.run
diff --git a/acceptance/bundle/bundle_tag/url_ref/out.deploy-requests.direct.txt b/acceptance/bundle/deploy/immutable/src/immutable/__init__.py
similarity index 100%
rename from acceptance/bundle/bundle_tag/url_ref/out.deploy-requests.direct.txt
rename to acceptance/bundle/deploy/immutable/src/immutable/__init__.py
diff --git a/acceptance/bundle/deploy/immutable/src/immutable/main.py b/acceptance/bundle/deploy/immutable/src/immutable/main.py
new file mode 100644
index 00000000000..9eccd00150d
--- /dev/null
+++ b/acceptance/bundle/deploy/immutable/src/immutable/main.py
@@ -0,0 +1,6 @@
+def main():
+    print("Hello from Python Wheel Task!")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/acceptance/bundle/deploy/immutable/src/main.py b/acceptance/bundle/deploy/immutable/src/main.py
new file mode 100644
index 00000000000..6c285f7e2f5
--- /dev/null
+++ b/acceptance/bundle/deploy/immutable/src/main.py
@@ -0,0 +1 @@
+print("Hello from Spark Python Task!")
diff --git a/acceptance/bundle/deploy/immutable/src/notebook.py b/acceptance/bundle/deploy/immutable/src/notebook.py
new file mode 100644
index 00000000000..fb3c9597fbf
--- /dev/null
+++ b/acceptance/bundle/deploy/immutable/src/notebook.py
@@ -0,0 +1,3 @@
+# Databricks notebook source
+
+print("Hello from Notebook Task!")
diff --git a/acceptance/bundle/deploy/immutable/test.toml b/acceptance/bundle/deploy/immutable/test.toml
new file mode 100644
index 00000000000..81910694737
--- /dev/null
+++ b/acceptance/bundle/deploy/immutable/test.toml
@@ -0,0 +1,18 @@
+Cloud = false # Temporary disable cloud tests until the API is fully available
+
+# immutable_folder only works with the direct engine.
+
+Ignore = [
+    "dist",
+    "build",
+    "databricks.yml",
+    ".databricks",
+    ".venv",
+    "*.pyc",
+    "src/*.egg-info",
+]
+
+[[Repls]]
+# Replace snapshot hash with SNAPSHOT_HASH
+Old = "[0-9a-f]{64}"
+New = "[SNAPSHOT_HASH]"
diff --git a/acceptance/bundle/deploy/mlops-stacks/config.json.tmpl b/acceptance/bundle/deploy/mlops-stacks/config.json.tmpl
index da7c7cf21c7..f1c00c269b5 100644
--- a/acceptance/bundle/deploy/mlops-stacks/config.json.tmpl
+++ b/acceptance/bundle/deploy/mlops-stacks/config.json.tmpl
@@ -1,6 +1,5 @@
 {
   "input_project_name": "project_name_$UNIQUE_NAME",
   "input_root_dir": "test_repo_mlops_stacks",
-  "input_include_models_in_unity_catalog": "no",
   "input_cloud": "$CLOUD_ENV_BASE"
 }
diff --git a/acceptance/bundle/deploy/mlops-stacks/out.test.toml b/acceptance/bundle/deploy/mlops-stacks/out.test.toml
index bbc7fcfd1bd..0f167effef1 100644
--- a/acceptance/bundle/deploy/mlops-stacks/out.test.toml
+++ b/acceptance/bundle/deploy/mlops-stacks/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/deploy/mlops-stacks/output.txt b/acceptance/bundle/deploy/mlops-stacks/output.txt
index 64a5599952e..1b62cc0093e 100644
--- a/acceptance/bundle/deploy/mlops-stacks/output.txt
+++ b/acceptance/bundle/deploy/mlops-stacks/output.txt
@@ -3,10 +3,14 @@
 {
   "input_project_name": "project_name_[UNIQUE_NAME]",
   "input_root_dir": "test_repo_mlops_stacks",
-  "input_include_models_in_unity_catalog": "no",
   "input_cloud": "[CLOUD_ENV_BASE]"
 }
 
+>>> [CLI] schemas create project_name_[UNIQUE_NAME] main
+{
+  "full_name": "main.project_name_[UNIQUE_NAME]"
+}
+
 >>> [CLI] bundle init mlops-stacks --config-file config.json
 Welcome to MLOps Stacks. For detailed information on project generation, see the README at https://github.com/databricks/mlops-stacks/blob/main/README.md.
 
@@ -20,14 +24,14 @@ Please refer to the README.md for further instructions on getting started.
 This directory contains an ML project based on the default
 [Databricks MLOps Stacks](https://github.com/databricks/mlops-stacks),
 
->>> [CLI] bundle summary
+>>> [CLI] bundle summary --var catalog_name=main
 Warning: expected a string value, found null
   at targets.dev.workspace.host
-  in databricks.yml:34:12
+  in databricks.yml:37:12
 
 Warning: unknown field: description
   at resources.experiments.experiment
-  in resources/ml-artifacts-resource.yml:21:7
+  in resources/ml-artifacts-resource.yml:28:7
 
 Name: project_name_[UNIQUE_NAME]
 Target: dev
@@ -46,19 +50,19 @@ Resources:
     model_training_job:
       Name: [dev [USERNAME]] dev-project_name_[UNIQUE_NAME]-model-training-job
       URL:  (not deployed)
-  Models:
+  Registered Models:
     model:
-      Name: [dev [USERNAME]] dev-project_name_[UNIQUE_NAME]-model
+      Name: dev_[USERNAME]_project_name_[UNIQUE_NAME]-model
       URL:  (not deployed)
 
->>> [CLI] bundle validate
+>>> [CLI] bundle validate --var catalog_name=main
 Warning: expected a string value, found null
   at targets.dev.workspace.host
-  in databricks.yml:34:12
+  in databricks.yml:37:12
 
 Warning: unknown field: description
   at resources.experiments.experiment
-  in resources/ml-artifacts-resource.yml:21:7
+  in resources/ml-artifacts-resource.yml:28:7
 
 Name: project_name_[UNIQUE_NAME]
 Target: dev
@@ -68,73 +72,89 @@ Workspace:
 
 Found 2 warnings
 
->>> [CLI] bundle deploy
+>>> [CLI] bundle deploy --var catalog_name=main
 Warning: expected a string value, found null
   at targets.dev.workspace.host
-  in databricks.yml:34:12
+  in databricks.yml:37:12
 
 Warning: unknown field: description
   at resources.experiments.experiment
-  in resources/ml-artifacts-resource.yml:21:7
+  in resources/ml-artifacts-resource.yml:28:7
 
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/dev/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> [CLI] bundle summary -o json
+Created experiments.experiment
+Created experiments.experiment.permissions
+Created jobs.batch_inference_job
+Created jobs.batch_inference_job.permissions
+Created jobs.model_training_job
+Created jobs.model_training_job.permissions
+Created registered_models.model
+Created registered_models.model.grants
+Files: 26 uploaded, 0 deleted
+Resources: 8 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] bundle summary --var catalog_name=main -o json
 Warning: expected a string value, found null
   at targets.dev.workspace.host
-  in databricks.yml:34:12
+  in databricks.yml:37:12
 
 Warning: unknown field: description
   at resources.experiments.experiment
-  in resources/ml-artifacts-resource.yml:21:7
+  in resources/ml-artifacts-resource.yml:28:7
 
 {
-  "experiment_id": "[NUMID]",
-  "model_id": "[dev [USERNAME]] dev-project_name_[UNIQUE_NAME]-model",
-  "inference_job_id": "[NUMID]",
-  "training_job_id": "[NUMID]"
+  "experiment_id": "[EXPERIMENT_ID]",
+  "model_id": "[MODEL_ID]",
+  "inference_job_id": "[BATCH_INFERENCE_JOB_ID]",
+  "training_job_id": "[MODEL_TRAINING_JOB_ID]"
 }
 
 === Assert the batch inference job actually exists
 Warning: expected a string value, found null
   at targets.dev.workspace.host
-  in databricks.yml:34:12
+  in databricks.yml:37:12
 
 Warning: unknown field: description
   at resources.experiments.experiment
-  in resources/ml-artifacts-resource.yml:21:7
+  in resources/ml-artifacts-resource.yml:28:7
 
 Warning: expected a string value, found null
   at targets.dev.workspace.host
-  in databricks.yml:34:12
+  in databricks.yml:37:12
 
 Warning: unknown field: description
   at resources.experiments.experiment
-  in resources/ml-artifacts-resource.yml:21:7
+  in resources/ml-artifacts-resource.yml:28:7
 
 {
   "name": "[dev [USERNAME]] dev-project_name_[UNIQUE_NAME]-batch-inference-job"
 }
 
->>> [CLI] bundle destroy --auto-approve
+>>> [CLI] bundle destroy --var catalog_name=main --auto-approve
 Warning: expected a string value, found null
   at targets.dev.workspace.host
-  in databricks.yml:34:12
+  in databricks.yml:37:12
 
 Warning: unknown field: description
   at resources.experiments.experiment
-  in resources/ml-artifacts-resource.yml:21:7
+  in resources/ml-artifacts-resource.yml:28:7
 
 The following resources will be deleted:
   delete resources.experiments.experiment
   delete resources.jobs.batch_inference_job
   delete resources.jobs.model_training_job
-  delete resources.models.model
+  delete resources.registered_models.model
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/dev
 
-Deleting files...
-Destroy complete!
+Destroy: 4 deleted
+
+>>> [CLI] schemas delete main.project_name_[UNIQUE_NAME]
+Warning: expected a string value, found null
+  at targets.dev.workspace.host
+  in databricks.yml:37:12
+
+Warning: unknown field: description
+  at resources.experiments.experiment
+  in resources/ml-artifacts-resource.yml:28:7
+
diff --git a/acceptance/bundle/deploy/mlops-stacks/script b/acceptance/bundle/deploy/mlops-stacks/script
index dec2a4ba473..a1770334913 100644
--- a/acceptance/bundle/deploy/mlops-stacks/script
+++ b/acceptance/bundle/deploy/mlops-stacks/script
@@ -13,24 +13,40 @@
 envsubst < config.json.tmpl > config.json
 trace cat config.json
 
+# The template hard-codes the model's schema name to the project name and always
+# registers the model in Unity Catalog, so the schema must already exist in the
+# target catalog. Create it in the shared "main" catalog (the convention used by
+# other cloud UC acceptance tests) and override catalog_name to match.
+SCHEMA_NAME="project_name_${UNIQUE_NAME}"
+
 cleanup() {
-  trace $CLI bundle destroy --auto-approve
+  trace $CLI bundle destroy --var catalog_name=main --auto-approve
+  trace $CLI schemas delete "main.${SCHEMA_NAME}"
   cd ../..
   rm -rf test_repo_mlops_stacks
 }
 trap cleanup EXIT
 
-trace $CLI bundle init mlops-stacks --config-file config.json
+trace $CLI schemas create "${SCHEMA_NAME}" main | jq '{full_name}'
+
+# Local runs must not reach the network; cloud runs clone to keep that path covered.
+# The vendored copy in ./template/ can be updated with `task bump-mlops-stacks`
+if [ -z "$CLOUD_ENV" ]; then
+  trace $CLI bundle init "$TESTDIR/template" --config-file config.json
+else
+  trace $CLI bundle init mlops-stacks --config-file config.json
+fi
 trace cat test_repo_mlops_stacks/README.md | head -n 4
 
 cd "test_repo_mlops_stacks/project_name_${UNIQUE_NAME}" || exit 1
 
-trace $CLI bundle summary
-trace $CLI bundle validate
-trace $CLI bundle deploy
+trace $CLI bundle summary --var catalog_name=main
+trace $CLI bundle validate --var catalog_name=main
+trace $CLI bundle deploy --var catalog_name=main
+replace_ids.py
 
-trace $CLI bundle summary -o json | jq -r '{experiment_id: .resources.experiments.experiment.id, model_id: .resources.models.model.id, inference_job_id: .resources.jobs.batch_inference_job.id, training_job_id: .resources.jobs.model_training_job.id}'
+trace $CLI bundle summary --var catalog_name=main -o json | jq -r '{experiment_id: .resources.experiments.experiment.id, model_id: .resources.registered_models.model.id, inference_job_id: .resources.jobs.batch_inference_job.id, training_job_id: .resources.jobs.model_training_job.id}'
 
 title "Assert the batch inference job actually exists\n"
-JOB_ID=$($CLI bundle summary -o json | jq -r '.resources.jobs.batch_inference_job.id')
+JOB_ID=$($CLI bundle summary --var catalog_name=main -o json | jq -r '.resources.jobs.batch_inference_job.id')
 $CLI jobs get "${JOB_ID}" | jq '{name: .settings.name}'
diff --git a/acceptance/bundle/deploy/mlops-stacks/template.REVISION b/acceptance/bundle/deploy/mlops-stacks/template.REVISION
new file mode 100644
index 00000000000..c4469c21626
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template.REVISION
@@ -0,0 +1 @@
+9b387898ad10439c90581e6064f19407121dc410
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/databricks_template_schema.json b/acceptance/bundle/deploy/mlops-stacks/template/databricks_template_schema.json
new file mode 100644
index 00000000000..ec840054ecc
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/databricks_template_schema.json
@@ -0,0 +1,266 @@
+{
+  "welcome_message": "Welcome to MLOps Stacks. For detailed information on project generation, see the README at https://github.com/databricks/mlops-stacks/blob/main/README.md.",
+  "min_databricks_cli_version": "v0.236.0",
+  "properties": {
+    "input_setup_cicd_and_project": {
+      "order": 1,
+      "type": "string",
+      "description": "{{if false}}\n\nERROR: This template is not supported by your current Databricks CLI version.\nPlease hit control-C and go to https://docs.databricks.com/en/dev-tools/cli/install.html for instructions on upgrading the CLI to the minimum version supported by MLOps Stacks.\n\n\n{{end}}\nSelect if both CI/CD and the Project should be set up, or only one of them.\nYou can always set up the other later by running initialization again",
+      "default": "CICD_and_Project",
+      "enum": ["CICD_and_Project", "Project_Only", "CICD_Only"]
+    },
+    "input_project_name": {
+      "order": 2,
+      "type": "string",
+      "default": "my_mlops_project",
+      "description": "\nProject Name. Default",
+      "pattern": "^[^ .\\\\/]{3,}$",
+      "pattern_match_failure_message": "Project name must be at least 3 characters long and cannot contain the following characters: \"\\\", \"/\", \" \" and \".\".",
+      "skip_prompt_if": {
+        "properties": {
+          "input_setup_cicd_and_project": {
+            "const": "CICD_Only"
+          }
+        }
+      }
+    },
+    "input_root_dir": {
+      "order": 3,
+      "type": "string",
+      "default": "{{ .input_project_name }}",
+      "description": "\nRoot directory name.\nFor monorepos, name of the root directory that contains all the projects.\nDefault",
+      "skip_prompt_if": {
+        "properties": {
+          "input_setup_cicd_and_project": {
+            "const": "CICD_and_Project"
+          }
+        }
+      }
+    },
+    "input_cloud": {
+      "order": 4,
+      "type": "string",
+      "description": "\nSelect cloud",
+      "default": "azure",
+      "enum": ["azure", "aws", "gcp"]
+    },
+    "input_cicd_platform": {
+      "order": 5,
+      "type": "string",
+      "description": "\nSelect CICD platform",
+      "default": "github_actions",
+      "enum": ["github_actions", "github_actions_for_github_enterprise_servers", "azure_devops", "gitlab"],
+      "skip_prompt_if": {
+        "properties": {
+          "input_setup_cicd_and_project": {
+            "const": "Project_Only"
+          }
+        }
+      }
+    },
+    "input_databricks_staging_workspace_host": {
+      "order": 6,
+      "type": "string",
+      "default": "{{if eq .input_cloud `azure`}}https://adb-xxxx.xx.azuredatabricks.net{{else if eq .input_cloud `aws`}}https://your-staging-workspace.cloud.databricks.com{{else if eq .input_cloud `gcp`}}https://your-staging-workspace.gcp.databricks.com{{end}}",
+      "description": "\nURL of staging Databricks workspace,\nIt will run PR CI and preview changes before they're deployed to production.\nDefault",
+      "pattern": "^(https.*)?$",
+      "pattern_match_failure_message": "Databricks staging workspace host URLs must start with https. Got invalid workspace host.",
+      "skip_prompt_if": {
+        "properties": {
+          "input_setup_cicd_and_project": {
+            "const": "Project_Only"
+          }
+        }
+      }
+    },
+    "input_databricks_prod_workspace_host": {
+      "order": 7,
+      "type": "string",
+      "default": "{{if eq .input_cloud `azure`}}https://adb-xxxx.xx.azuredatabricks.net{{else if eq .input_cloud `aws`}}https://your-prod-workspace.cloud.databricks.com{{else if eq .input_cloud `gcp`}}https://your-prod-workspace.gcp.databricks.com{{end}}",
+      "description": "\nURL of production Databricks workspace.\nDefault",
+      "pattern": "^(https.*)?$",
+      "pattern_match_failure_message": "Databricks production workspace host URLs must start with https. Got invalid workspace host.",
+      "skip_prompt_if": {
+        "properties": {
+          "input_setup_cicd_and_project": {
+            "const": "Project_Only"
+          }
+        }
+      }
+    },
+    "input_default_branch": {
+      "order": 8,
+      "type": "string",
+      "default": "main",
+      "description": "\nName of the default branch,\nStaging resources are deployed from this branch and stages the latest ML code.\nDefault",
+      "skip_prompt_if": {
+        "properties": {
+          "input_setup_cicd_and_project": {
+            "const": "Project_Only"
+          }
+        }
+      }
+    },
+    "input_release_branch": {
+      "order": 9,
+      "type": "string",
+      "default": "release",
+      "description": "\nName of the release branch.\nThe training and other production jobs pull ML code from this branch.\nDefault",
+      "skip_prompt_if": {
+        "properties": {
+          "input_setup_cicd_and_project": {
+            "const": "Project_Only"
+          }
+        }
+      }
+    },
+    "input_read_user_group": {
+      "order": 10,
+      "type": "string",
+      "default": "users",
+      "description": "\nUser group name to give READ permissions to for project resources\n(ML jobs, integration test job runs, and machine learning resources).\nA group with this name must exist in both the staging and prod workspaces.\nDefault",
+      "skip_prompt_if": {
+        "properties": {
+          "input_setup_cicd_and_project": {
+            "const": "CICD_Only"
+          }
+        }
+      }
+    },
+    "input_staging_catalog_name": {
+      "order": 12,
+      "type": "string",
+      "description": "\nName of the catalog in Unity Catalog that will host the staging UC resources. \nThis catalog must already exist and service principals must have access to it.\nDefault",
+      "default": "staging",
+      "skip_prompt_if": {
+        "properties": {
+          "input_setup_cicd_and_project": {
+            "const": "Project_Only"
+          }
+        }
+      }
+    },
+    "input_prod_catalog_name": {
+      "order": 13,
+      "type": "string",
+      "description": "\nName of the catalog in Unity Catalog that will host the production UC resources.\nThis catalog must already exist and service principals must have access to it.\nDefault",
+      "default": "prod",
+      "skip_prompt_if": {
+        "properties": {
+          "input_setup_cicd_and_project": {
+            "const": "Project_Only"
+          }
+        }
+      }
+    },
+    "input_test_catalog_name": {
+      "order": 14,
+      "type": "string",
+      "description": "\nName of the catalog in Unity Catalog that will be used for integration tests.\nThis catalog must already exist and service principals must have access to it.\nDefault",
+      "default": "test",
+      "skip_prompt_if": {
+        "properties": {
+          "input_setup_cicd_and_project": {
+            "const": "Project_Only"
+          }
+        }
+      }
+    },
+    "input_schema_name": {
+      "order": 15,
+      "type": "string",
+      "description": "\nName of schema to use when registering a model in Unity Catalog.\nThis schema must already exist and service principals must have access.\nWe recommend using the project name.\nDefault",
+      "default": "{{ .input_project_name }}",
+      "pattern": "^[^ .\\-\\/]*$",
+      "pattern_match_failure_message": "Valid schema names cannot contain any of the following characters: \" \", \".\", \"-\", \"\\\", \"/\"",
+      "skip_prompt_if": {
+        "properties": {
+          "input_setup_cicd_and_project": {
+            "const": "CICD_Only"
+          }
+        }
+      }
+    },
+    "input_unity_catalog_read_user_group": {
+      "order": 16,
+      "type": "string",
+      "default": "account users",
+      "description": "\nUser group name to give EXECUTE privileges to models in Unity Catalog (UC).\nIt must exist in UC with access granted to the staging and prod workspaces.\nDefault",
+      "skip_prompt_if": {
+        "properties": {
+          "input_setup_cicd_and_project": {
+            "const": "CICD_Only"
+          }
+        }
+      }
+    },
+    "input_inference_table_name": {
+      "order": 17,
+      "type": "string",
+      "description": "\nFully qualified name of inference table to attach monitoring to.\nThis table must already exist and service principals must have access.",
+      "default": "dev.{{ .input_project_name }}.predictions",
+      "pattern": "^[^ .\\-\\/]+(\\.[^ .\\-\\/]+){2}$",
+      "pattern_match_failure_message": "Fully qualified Unity Catalog table names must have catalog, schema, and table separated by \".\" and each cannot contain any of the following characters: \" \", \".\", \"-\", \"\\\", \"/\"",
+      "skip_prompt_if": {
+            "properties": {
+              "input_setup_cicd_and_project": {
+                "const": "CICD_Only"
+              }
+            }
+      }
+    },
+    "input_include_feature_store": {
+      "order": 18,
+      "type": "string",
+      "description": "\nWhether to include Feature Store",
+      "default": "no",
+      "enum": ["no", "yes"],
+      "skip_prompt_if": {
+        "properties": {
+          "input_setup_cicd_and_project": {
+            "const": "CICD_Only"
+          }
+        }
+      }
+    },
+    "input_docker_image": {
+      "order": 20,
+      "type": "string",
+      "description": "\nDocker image for the execution of Gitlab pipelines",
+      "default": "databricksfieldeng/mlopsstacks:latest",
+      "skip_prompt_if": {
+        "anyOf":[
+          {
+            "properties": {
+              "input_cicd_platform": {
+                "const": "github_actions"
+              }
+            }
+          },
+          {
+            "properties": {
+              "input_cicd_platform": {
+                "const": "github_actions_for_github_enterprise_servers"
+              }
+            }
+          },
+          {
+            "properties": {
+              "input_cicd_platform": {
+                "const": "azure_devops"
+              }
+            }
+          },
+          {
+            "properties": {
+              "input_setup_cicd_and_project": {
+                "const": "Project_Only"
+              }
+            }
+          }
+        ]
+      }
+    }
+  },
+  "success_message" : "\n*** Your MLOps Stack has been created in the '{{.input_root_dir}}{{if not (eq .input_setup_cicd_and_project `CICD_Only`) }}/{{.input_project_name}}{{end}}' directory! ***\n\nPlease refer to the README.md for further instructions on getting started."
+}
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/library/functions.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/library/functions.tmpl
new file mode 100644
index 00000000000..9d66c9e9ff4
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/library/functions.tmpl
@@ -0,0 +1,26 @@
+# define functions
+{{ define "get_host" -}}
+  {{- with url . -}}
+    {{- print .Scheme `://` .Host -}}
+  {{- end -}}
+{{- end }}
+
+{{ define "generate_doc_link" -}}
+    {{- if eq .cloud `aws` -}}
+        {{- if eq .path `repos/git-operations-with-repos#add-a-repo-and-connect-remotely-later` -}}
+            https://docs.databricks.com/repos/git-operations-with-repos.html#add-a-repo-connected-to-a-remote-repo
+        {{- else -}}
+            https://docs.databricks.com/{{ print .path }}
+        {{- end -}}
+    {{- else if eq .cloud `gcp` -}}
+        {{- if eq .path `repos/git-operations-with-repos#add-a-repo-and-connect-remotely-later` -}}
+            https://docs.gcp.databricks.com/en/repos/git-operations-with-repos.html#clone-a-repo-connected-to-a-remote-repo
+        {{- else -}}
+            https://docs.gcp.databricks.com/{{ print .path }}
+        {{- end -}}
+    {{- else if eq .cloud `azure` -}}
+        https://learn.microsoft.com/azure/databricks/{{ (regexp `\.html`).ReplaceAllString (print .path) `` }}
+    {{- else -}}
+        {{ fail `Invalid selection of cloud in function generate_doc_link. Please choose from [azure, aws, gcp]` }}
+    {{- end -}}
+{{- end }}
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/library/input_validation.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/library/input_validation.tmpl
new file mode 100644
index 00000000000..2f54565f956
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/library/input_validation.tmpl
@@ -0,0 +1,2 @@
+{{ define `validation` }}
+{{- end -}}
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/library/template_variables.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/library/template_variables.tmpl
new file mode 100644
index 00000000000..1cd95cd55b0
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/library/template_variables.tmpl
@@ -0,0 +1,64 @@
+# define template variables
+{{ define `databricks_prod_workspace_host` -}}
+    {{- if not (eq (print .input_databricks_prod_workspace_host) "") -}}
+        {{- with url (print .input_databricks_prod_workspace_host) -}}
+            {{ print .Scheme `://` .Host }}
+        {{- end -}}
+    {{- else -}}
+        {{- if eq .input_cloud `azure` -}}
+            https://adb-xxxx.xx.azuredatabricks.net
+        {{- else if eq .input_cloud `aws` -}}
+            https://your-prod-workspace.cloud.databricks.com
+        {{- else if eq .input_cloud `gcp` -}}
+            https://your-prod-workspace.gcp.databricks.com
+        {{- end -}}
+    {{- end -}}
+{{- end }}
+
+{{ define `databricks_staging_workspace_host` -}}
+    {{- if not (eq (print .input_databricks_staging_workspace_host) "") -}}
+        {{- with url (print .input_databricks_staging_workspace_host) -}}
+            {{- print .Scheme `://` .Host -}}
+        {{- end -}}
+    {{- else -}}
+        {{- if eq .input_cloud `azure` -}}
+            https://adb-xxxx.xx.azuredatabricks.net
+        {{- else if eq .input_cloud `aws` -}}
+            https://your-staging-workspace.cloud.databricks.com
+        {{- else if eq .input_cloud `gcp` -}}
+            https://your-staging-workspace.gcp.databricks.com
+        {{- end -}}
+    {{- end -}}
+{{- end }}
+
+{{ define `cloud_specific_node_type_id` -}}
+    {{- if (eq .input_cloud `aws`) -}}
+        i3.xlarge
+    {{- else if (eq .input_cloud `azure`) -}}
+        Standard_D3_v2
+    {{- else if (eq .input_cloud `gcp`) -}}
+        n2-highmem-4
+    {{- else -}}
+        {{ fail `Unknown cloud platform` }}
+    {{- end -}}
+{{- end -}}
+
+{{ define `model_name` -}}
+    {{ .input_project_name }}-model
+{{- end }}
+
+{{ define `experiment_base_name` -}}
+    {{ .input_project_name }}-experiment
+{{- end }}
+
+{{ define `project_name_alphanumeric_underscore` -}}
+    {{- (regexp `-`).ReplaceAllString ((regexp `[^A-Za-z0-9_-]`).ReplaceAllString (print .input_project_name) ``) `_` -}}
+{{- end }}
+
+{{ define `cli_version` -}}
+    v0.236.0
+{{- end }}
+
+{{ define `stacks_version` -}}
+    0.5
+{{- end }}
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/run_validations.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/template/run_validations.tmpl
new file mode 100644
index 00000000000..45a82b8eb1b
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/template/run_validations.tmpl
@@ -0,0 +1 @@
+run validation{{ template `validation` . }}
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/update_layout.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/template/update_layout.tmpl
new file mode 100644
index 00000000000..e1aee22344b
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/template/update_layout.tmpl
@@ -0,0 +1,48 @@
+# Remove unrelated CICD platform files
+{{ $project_name_alphanumeric_underscore := (regexp `-`).ReplaceAllString ((regexp `[^A-Za-z0-9_-]`).ReplaceAllString .input_project_name ``) `_` -}}
+{{ $root_dir := .input_root_dir}}
+
+{{ if (eq .input_setup_cicd_and_project `Project_Only`) }}
+    {{ skip (printf `%s/%s` $root_dir `.azure`) }}
+    {{ skip (printf `%s/%s` $root_dir `.github`) }}
+    {{ skip (printf `%s/%s` $root_dir `docs`) }}
+    {{ skip (printf `%s/%s` $root_dir `.gitignore`) }}
+    {{ skip (printf `%s/%s` $root_dir `README.md`) }}
+    {{ skip (printf `%s/%s` $root_dir `test-requirements.txt`) }}
+    {{ skip (printf `%s/%s` $root_dir `cicd.tar.gz`) }}
+    {{ skip (printf `%s/%s` $root_dir `cicd_params.json`) }}
+{{ else if (eq .input_setup_cicd_and_project `CICD_Only`) }}
+    {{ skip (printf `%s/%s` $root_dir $project_name_alphanumeric_underscore) }}
+    {{ skip (printf `%s/%s/%s-*` $root_dir `.github/workflows` .input_project_name) }}
+    {{ skip (printf `%s/%s/%s-*` $root_dir `.azure/devops-pipelines` .input_project_name) }}
+{{ end }}
+
+{{ if (or (eq .input_cicd_platform `github_actions`) (eq .input_cicd_platform `github_actions_for_github_enterprise_servers`)) }}
+    {{ skip (printf `%s/%s` $root_dir `.azure`) }}
+    {{ skip (printf `%s/%s` $root_dir `.gitlab`) }}
+{{ else if (eq .input_cicd_platform `azure_devops`) }}
+    {{ skip (printf `%s/%s` $root_dir `.github`) }}
+    {{ skip (printf `%s/%s` $root_dir `.gitlab`) }}
+{{ else if (eq .input_cicd_platform `gitlab`) }}
+    {{ skip (printf `%s/%s` $root_dir `.github`) }}
+    {{ skip (printf `%s/%s` $root_dir `.azure`) }}
+{{ end }}
+
+{{ if (not (eq .input_project_name `27896cf3-bb3e-476e-8129-96df0406d5c7`)) }}
+    {{ skip (printf `%s/%s` $root_dir `_params_testing_only.txt`) }}
+{{ end }}
+
+# Remove Feature Store code if not selected; remove Delta Train notebook if Feature Store is selected
+{{ if (eq .input_include_feature_store `yes`) }}
+    {{ skip (printf `%s/%s/%s` $root_dir $project_name_alphanumeric_underscore `training/Train.py`) }}
+{{ else }}
+    {{ skip (printf `%s/%s/%s` $root_dir $project_name_alphanumeric_underscore `feature_engineering`) }}
+    {{ skip (printf `%s/%s/%s` $root_dir $project_name_alphanumeric_underscore `tests/feature_engineering`) }}
+    {{ skip (printf `%s/%s/%s` $root_dir $project_name_alphanumeric_underscore `training/TrainWithFeatureStore.py`) }}
+    {{ skip (printf `%s/%s/%s` $root_dir $project_name_alphanumeric_underscore `resources/feature-engineering-workflow-resource.yml`) }}
+{{ end }}
+
+# Remove template files
+{{ skip (printf `%s/%s` $root_dir `cicd`) }}
+{{ skip `update_layout` }}
+{{ skip `run_validations` }}
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/.github/workflows/README.md.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/.github/workflows/README.md.tmpl
new file mode 100644
index 00000000000..8c991e8a714
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/.github/workflows/README.md.tmpl
@@ -0,0 +1,8 @@
+# CI/CD Workflow Definitions
+This directory contains CI/CD workflow definitions using [GitHub Actions](https://docs.github.com/en/actions),
+under ``workflows``. These workflows cover testing and deployment of both ML code (for model training, batch inference, etc) and 
+Databricks ML resource definitions. 
+
+To set up CI/CD for a new project,
+please refer to [Setting up CI/CD](<../../README.md#Setting up CI/CD>) and following the [MLOps Setup Guide](../../docs/mlops-setup.md)
+to make sure your `WORKFLOW_TOKEN` secret has been properly set up with `Workflow` permissions.
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/.github/workflows/deploy-cicd.yml.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/.github/workflows/deploy-cicd.yml.tmpl
new file mode 100644
index 00000000000..845131813c7
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/.github/workflows/deploy-cicd.yml.tmpl
@@ -0,0 +1,78 @@
+# This GitHub workflow sets up CI/CD workflows for a previously instantiated MLOps Stacks Project.
+name: Deploy CICD for Project Workflow
+
+on:
+  workflow_dispatch:
+    inputs:
+      project_name:
+        description: 'Project Name'
+        required: true
+        default: {{ .input_project_name }}
+
+env:
+  DATABRICKS_HOST: {{template `databricks_staging_workspace_host` .}}
+  {{ if (eq .input_cloud `azure`) -}}
+  ARM_TENANT_ID: {{`${{ secrets.STAGING_AZURE_SP_TENANT_ID }}`}}
+  ARM_CLIENT_ID: {{`${{ secrets.STAGING_AZURE_SP_APPLICATION_ID }}`}}
+  ARM_CLIENT_SECRET: {{`${{ secrets.STAGING_AZURE_SP_CLIENT_SECRET }}`}}
+  {{ else -}}
+  DATABRICKS_TOKEN: {{`${{ secrets.STAGING_WORKSPACE_TOKEN }}`}}
+  {{- end }}
+
+jobs:
+  cicd:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Get current timestamp
+        id: timestamp
+        run: |
+          echo "timestamp=$(date +'%s')" >> "$GITHUB_ENV"
+      - uses: actions/checkout@v4
+        with:
+          ref: {{`${{ github.event.pull_request.head.sha || github.sha }}`}}
+          token: {{`${{ secrets.WORKFLOW_TOKEN }}`}}
+      - uses: databricks/setup-cli@{{template `cli_version` .}}
+      - name: Convert Project Name to Only Alphanumeric Characters
+        run: |
+          PROJECT_NAME_ALPHA=$(echo "{{`${{ github.event.inputs.project_name }}`}}" | tr ' -' '_')
+          echo "PROJECT_NAME_ALPHA=$PROJECT_NAME_ALPHA" >> "$GITHUB_ENV"
+      - name: Install jq
+        run: sudo apt-get install jq
+      - name: Unzip Bundle and Append Parameters to Input JSON
+        id: unzip
+        run: |
+          tar -xzvf cicd.tar.gz
+          INPUT_CLOUD_1=$(jq -r '.input_cloud' cicd_params.json)
+          INPUT_CLOUD_2=$(jq -r '.input_cloud' "$PROJECT_NAME_ALPHA/project_params.json")
+          if [ "$INPUT_CLOUD_1" != "$INPUT_CLOUD_2" ]; then
+            printf "Error: CICD cloud '%s' does not match project cloud '%s'\n" "$INPUT_CLOUD_1" "$INPUT_CLOUD_2"
+            exit 1
+          fi
+          printf '%s' "$(jq '. += {"input_project_name":"{{`${{ github.event.inputs.project_name }}`}}"}' cicd_params.json)" > cicd_params.json
+          printf '%s' "$(jq -s '.[0] + .[1]' cicd_params.json "$PROJECT_NAME_ALPHA/project_params.json")" > cicd_params.json
+      - name: Update databricks.yml
+        id: update
+        run: |
+          echo -e "  staging:\n    variables:\n      catalog_name: {{ .input_staging_catalog_name }}\n    workspace:\n      host: {{template `databricks_staging_workspace_host` .}}\n\n  prod:\n    variables:\n      catalog_name: {{ .input_prod_catalog_name }}\n    workspace:\n      host: {{template `databricks_prod_workspace_host` .}}\n\n  test:\n    variables:\n      catalog_name: {{ .input_test_catalog_name }}\n    workspace:\n      host: {{template `databricks_staging_workspace_host` .}}" >> "$(PROJECT_NAME_ALPHA)\databricks.yml"
+      - name: Initialize Bundle
+        id: initialize
+        run: |
+          databricks bundle init ./cicd --config-file "cicd_params.json"
+      - name: Commit Changes
+        id: commit
+        env:
+          GITHUB_TOKEN: {{`${{ github.token }}`}}
+        run: |
+          git config --global user.name "Deploy CICD Bot"
+          git config --global user.email "noreply-cicd-bot@databricks.com"
+          git checkout -b add-cicd-for-{{`${{ github.event.inputs.project_name }}`}}-{{`${{ env.timestamp }}`}}
+          git add .github "$PROJECT_NAME_ALPHA/databricks.yml"
+          git commit -m "Add CICD for {{`${{ github.event.inputs.project_name }}`}}"
+          git push origin add-cicd-for-{{`${{ github.event.inputs.project_name }}`}}-{{`${{ env.timestamp }}`}}
+
+      - name: Create Pull Request
+        id: pr
+        env:
+          GITHUB_TOKEN: {{`${{ github.token }}`}}
+        run: |
+          gh pr create --base {{ .input_default_branch }} --head add-cicd-for-{{`${{ github.event.inputs.project_name }}`}}-{{`${{ env.timestamp }}`}} --title "Deploy CICD for {{`${{ github.event.inputs.project_name }}`}}" --body "This PR was generated by the Deploy CICD workflow." --reviewer {{`${{ github.actor }}`}}
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/.github/workflows/lint-cicd-workflow-files.yml.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/.github/workflows/lint-cicd-workflow-files.yml.tmpl
new file mode 100644
index 00000000000..1e6ebd4bdc4
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/.github/workflows/lint-cicd-workflow-files.yml.tmpl
@@ -0,0 +1,19 @@
+name: Lint CI/CD workflow files
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/**'
+  workflow_dispatch:
+  
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Download actionlint
+        id: get_actionlint
+        run: bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
+        shell: bash
+      - name: Check workflow files
+        {{`run: ${{ steps.get_actionlint.outputs.executable }} -color`}}
+        shell: bash
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/.github/workflows/{{.input_project_name}}-bundle-cd-prod.yml.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/.github/workflows/{{.input_project_name}}-bundle-cd-prod.yml.tmpl
new file mode 100644
index 00000000000..92ea44e9563
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/.github/workflows/{{.input_project_name}}-bundle-cd-prod.yml.tmpl
@@ -0,0 +1,40 @@
+# This GitHub workflow deploys Bundle resources (ML resource config and more)
+# defined under {{template `project_name_alphanumeric_underscore` .}}/resources/*
+# and {{template `project_name_alphanumeric_underscore` .}}/databricks.yml with prod deployment target configs,
+# when PRs are merged into the release branch
+name: Bundle Deployment for {{ .input_project_name }} Prod
+
+on:
+  push:
+    branches:
+      - '{{ .input_release_branch }}'
+  workflow_dispatch:
+
+defaults:
+  run:
+    working-directory: ./{{template `project_name_alphanumeric_underscore` .}}
+
+env:
+  {{ if (eq .input_cloud `azure`) -}}
+  ARM_TENANT_ID: {{`${{ secrets.PROD_AZURE_SP_TENANT_ID }}`}}
+  ARM_CLIENT_ID: {{`${{ secrets.PROD_AZURE_SP_APPLICATION_ID }}`}}
+  ARM_CLIENT_SECRET: {{`${{ secrets.PROD_AZURE_SP_CLIENT_SECRET }}`}}
+  {{ else -}}
+  DATABRICKS_TOKEN: {{`${{ secrets.PROD_WORKSPACE_TOKEN }}`}}
+  {{- end }}
+
+jobs:
+  prod:
+    concurrency: {{ .input_project_name }}-prod-bundle-job
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: databricks/setup-cli@{{template `cli_version` .}}
+      - name: Validate Bundle For Prod
+        id: validate
+        run: |
+          databricks bundle validate -t prod
+      - name: Deploy Bundle to Prod
+        id: deploy
+        run: |
+          databricks bundle deploy -t prod
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/.github/workflows/{{.input_project_name}}-bundle-cd-staging.yml.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/.github/workflows/{{.input_project_name}}-bundle-cd-staging.yml.tmpl
new file mode 100644
index 00000000000..87d93314d29
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/.github/workflows/{{.input_project_name}}-bundle-cd-staging.yml.tmpl
@@ -0,0 +1,40 @@
+# This GitHub workflow deploys Bundle resources (ML resource config and more)
+# defined under {{template `project_name_alphanumeric_underscore` .}}/resources/*
+# and {{template `project_name_alphanumeric_underscore` .}}/databricks.yml with staging deployment target configs,
+# when PRs are merged into the default branch
+name: Bundle Deployment for {{ .input_project_name }} Staging
+
+on:
+  push:
+    branches:
+      - '{{ .input_default_branch }}'
+  workflow_dispatch:
+
+defaults:
+  run:
+    working-directory: ./{{template `project_name_alphanumeric_underscore` .}}
+
+env:
+  {{ if (eq .input_cloud `azure`) -}}
+  ARM_TENANT_ID: {{`${{ secrets.STAGING_AZURE_SP_TENANT_ID }}`}}
+  ARM_CLIENT_ID: {{`${{ secrets.STAGING_AZURE_SP_APPLICATION_ID }}`}}
+  ARM_CLIENT_SECRET: {{`${{ secrets.STAGING_AZURE_SP_CLIENT_SECRET }}`}}
+  {{ else -}}
+  DATABRICKS_TOKEN: {{`${{ secrets.STAGING_WORKSPACE_TOKEN }}`}}
+  {{- end }}
+
+jobs:
+  staging:
+    concurrency: {{ .input_project_name }}-staging-bundle-job
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: databricks/setup-cli@{{template `cli_version` .}}
+      - name: Validate Bundle For Staging
+        id: validate
+        run: |
+          databricks bundle validate -t staging
+      - name: Deploy Bundle to Staging
+        id: deploy
+        run: |
+          databricks bundle deploy -t staging
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/.github/workflows/{{.input_project_name}}-bundle-ci.yml.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/.github/workflows/{{.input_project_name}}-bundle-ci.yml.tmpl
new file mode 100644
index 00000000000..cbdef1b00d8
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/.github/workflows/{{.input_project_name}}-bundle-ci.yml.tmpl
@@ -0,0 +1,116 @@
+# This GitHub workflow validates Bundle config (ML resource config and more)
+# defined under {{template `project_name_alphanumeric_underscore` .}}/resources/*
+# and {{template `project_name_alphanumeric_underscore` .}}/databricks.yml, when PRs are merged into the main branch
+name: Bundle validation for {{ .input_project_name }}
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - '{{template `project_name_alphanumeric_underscore` .}}/**'
+
+defaults:
+  run:
+    working-directory: ./{{template `project_name_alphanumeric_underscore` .}}/
+
+env:
+  {{ if (eq .input_cloud `azure`) -}}
+  STAGING_ARM_TENANT_ID: {{`${{ secrets.STAGING_AZURE_SP_TENANT_ID }}`}}
+  STAGING_ARM_CLIENT_ID: {{`${{ secrets.STAGING_AZURE_SP_APPLICATION_ID }}`}}
+  STAGING_ARM_CLIENT_SECRET: {{`${{ secrets.STAGING_AZURE_SP_CLIENT_SECRET }}`}}
+  PROD_ARM_TENANT_ID: {{`${{ secrets.PROD_AZURE_SP_TENANT_ID }}`}}
+  PROD_ARM_CLIENT_ID: {{`${{ secrets.PROD_AZURE_SP_APPLICATION_ID }}`}}
+  PROD_ARM_CLIENT_SECRET: {{`${{ secrets.PROD_AZURE_SP_CLIENT_SECRET }}`}}
+  {{ else -}}
+  STAGING_WORKSPACE_TOKEN: {{`${{ secrets.STAGING_WORKSPACE_TOKEN }}`}}
+  PROD_WORKSPACE_TOKEN: {{`${{ secrets.PROD_WORKSPACE_TOKEN }}`}}
+  {{- end }}
+
+jobs:
+  staging:
+    concurrency: {{ .input_project_name }}-staging-bundle-job
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: {{`${{ github.event.pull_request.head.sha || github.sha }}`}}
+      - uses: databricks/setup-cli@{{template `cli_version` .}}
+      - name: Validate Bundle For Staging
+        id: validate
+        env:
+          {{ if (eq .input_cloud `azure`) -}}
+          ARM_TENANT_ID: {{`${{ env.STAGING_ARM_TENANT_ID }}`}}
+          ARM_CLIENT_ID: {{`${{ env.STAGING_ARM_CLIENT_ID }}`}}
+          ARM_CLIENT_SECRET: {{`${{ env.STAGING_ARM_CLIENT_SECRET }}`}}
+          {{ else -}}
+          DATABRICKS_TOKEN: {{`${{ env.STAGING_WORKSPACE_TOKEN }}`}}
+          {{- end }}
+        run: |
+          databricks bundle validate -t staging > ../validate_output.txt
+      - name: Create Comment with Bundle Configuration
+        uses: actions/github-script@v7
+        id: comment
+        with:
+          github-token: {{`${{ secrets.GITHUB_TOKEN }}`}}
+          script: |
+            const fs = require('fs');
+            const fileContents = fs.readFileSync('validate_output.txt', 'utf8');
+            const output = `#### Bundle Staging Config Validated 🖌
+            <details><summary>Staging Validation Output</summary>
+
+            \`\`\`\n
+            ${fileContents}
+            \`\`\`
+
+            </details>`
+
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: output
+            })
+
+  prod:
+    concurrency: {{ .input_project_name }}-prod-bundle-job
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: {{`${{ github.event.pull_request.head.sha || github.sha }}`}}
+      - uses: databricks/setup-cli@{{template `cli_version` .}}
+      - name: Validate Bundle For Prod
+        id: validate
+        env:
+          {{ if (eq .input_cloud `azure`) -}}
+          ARM_TENANT_ID: {{`${{ env.PROD_ARM_TENANT_ID }}`}}
+          ARM_CLIENT_ID: {{`${{ env.PROD_ARM_CLIENT_ID }}`}}
+          ARM_CLIENT_SECRET: {{`${{ env.PROD_ARM_CLIENT_SECRET }}`}}
+          {{ else -}}
+          DATABRICKS_TOKEN: {{`${{ env.PROD_WORKSPACE_TOKEN }}`}}
+          {{- end }}
+        run: |
+          databricks bundle validate -t prod > ../validate_output.txt
+      - name: Create Comment with Bundle Configuration
+        uses: actions/github-script@v7
+        id: comment
+        with:
+          github-token: {{`${{ secrets.GITHUB_TOKEN }}`}}
+          script: |
+            const fs = require('fs');
+            const fileContents = fs.readFileSync('validate_output.txt', 'utf8');
+            const output = `#### Bundle Prod Config Validated 🖌
+            <details><summary>Prod Validation Output</summary>
+
+            \`\`\`\n
+            ${fileContents}
+            \`\`\`
+
+            </details>`
+
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: output
+            })
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/.github/workflows/{{.input_project_name}}-run-tests.yml.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/.github/workflows/{{.input_project_name}}-run-tests.yml.tmpl
new file mode 100644
index 00000000000..77a59a6f683
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/.github/workflows/{{.input_project_name}}-run-tests.yml.tmpl
@@ -0,0 +1,72 @@
+name: {{ if (eq .input_include_feature_store `yes`) }}Feature and {{end}}Training Unit and Integration Tests for {{ .input_project_name }}
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - '{{template `project_name_alphanumeric_underscore` .}}/**'
+      - '.github/workflows/{{ .input_project_name }}-run-tests.yml'
+
+defaults:
+  run:
+    working-directory: ./{{template `project_name_alphanumeric_underscore` .}}/
+
+env:
+  {{ if (eq .input_cloud `azure`) -}}
+  ARM_TENANT_ID: {{`${{ secrets.STAGING_AZURE_SP_TENANT_ID }}`}}
+  ARM_CLIENT_ID: {{`${{ secrets.STAGING_AZURE_SP_APPLICATION_ID }}`}}
+  ARM_CLIENT_SECRET: {{`${{ secrets.STAGING_AZURE_SP_CLIENT_SECRET }}`}}
+  {{ else -}}
+  DATABRICKS_TOKEN: {{`${{ secrets.STAGING_WORKSPACE_TOKEN }}`}}
+  {{- end }}
+
+concurrency: {{template `project_name_alphanumeric_underscore` .}}-{{ if (eq .input_include_feature_store `yes`) }}feature-{{end}}training-integration-test-staging
+
+jobs:
+  unit_tests:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.10'
+      {{- if (eq .input_include_feature_store `yes`) }}
+      # Feature store tests bring up a local Spark session, so Java is required.
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '11'
+      {{- end }}
+      - name: Install dependencies
+        run: |
+            python -m pip install --upgrade pip
+            pip install -r requirements.txt
+            pip install -r ../test-requirements.txt
+      - name: Run tests with pytest
+        run: |
+            pytest
+
+  integration_test:
+    needs: unit_tests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v4
+      - uses: databricks/setup-cli@{{template `cli_version` .}}
+      - name: Validate Bundle For Test Deployment Target in Staging Workspace
+        id: validate
+        run: |
+          databricks bundle validate -t test
+      - name: Deploy Bundle to Test Deployment Target in Staging Workspace
+        id: deploy
+        run: |
+          databricks bundle deploy -t test
+      {{- if (eq .input_include_feature_store `yes`) }}
+      - name: Run Feature Engineering Workflow for Test Deployment Target in Staging Workspace
+        id: feature_engineering
+        run: |
+          databricks bundle run write_feature_table_job -t test
+      {{- end }}
+      - name: Run Training Workflow for Test Deployment Target in Staging Workspace
+        id: training
+        run: |
+          databricks bundle run model_training_job -t test
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/.gitignore b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/.gitignore
new file mode 100644
index 00000000000..0e326c600ee
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/.gitignore
@@ -0,0 +1,15 @@
+.DS_Store
+__pycache__/
+# local bundle files
+**/.databricks/*
+.idea
+.vscode
+mlruns
+*.db
+.dbx
+# Exclude local environment directory
+venv
+# Exclude local distribution/packaging directories
+*.egg-info/
+build
+dist
\ No newline at end of file
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/README.md.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/README.md.tmpl
new file mode 100644
index 00000000000..0c981d70c89
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/README.md.tmpl
@@ -0,0 +1,160 @@
+# {{ .input_root_dir }}
+
+This directory contains an ML project based on the default
+[Databricks MLOps Stacks](https://github.com/databricks/mlops-stacks),
+defining a production-grade ML pipeline for automated retraining and batch inference of an ML model on tabular data.
+The "Getting Started" docs can be found at {{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "dev-tools/bundles/mlops-stacks.html")) }}.
+
+See the full pipeline structure below. The [MLOps Stacks README](https://github.com/databricks/mlops-stacks/blob/main/Pipeline.md)
+contains additional details on how ML pipelines are tested and deployed across each of the dev, staging, prod environments below.
+
+![MLOps Stacks diagram](docs/images/mlops-stack-summary.png)
+
+
+## Code structure
+This project contains the following components:
+
+| Component                  | Description                                                                                                                                                                                                                                                                                                                                             |
+|----------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+{{- if (eq .input_setup_cicd_and_project `CICD_and_Project`)}}
+| ML Code                    | Example ML project code, with unit tested Python modules and notebooks                                                                                                                                                                                                                                                                             |
+| ML Resources as Code | ML pipeline resources (training and batch inference jobs with schedules, etc) configured and deployed through [databricks CLI bundles]({{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "dev-tools/cli/bundle-cli.html")) }})                                                                                              |
+{{- end }}
+| CI/CD                      | {{ if (eq .input_cicd_platform `github_actions`) }}[GitHub Actions](https://github.com/actions) workflows  to test and deploy ML code and resources
+                               {{ else if (eq .input_cicd_platform `azure_devops`) }}[Azure DevOps Pipelines](https://learn.microsoft.com/en-us/azure/devops/pipelines) to test and deploy ML code and resources
+                               {{ else if (eq .input_cicd_platform `gitlab`) }}[Gitlab Pipelines](https://docs.gitlab.com/ee/ci/pipelines/) to test and deploy ML code and resources 
+                               {{ end }} |
+
+contained in the following files:
+
+```
+{{ .input_root_dir }}        <- Root directory. Both monorepo and polyrepo are supported.
+│
+{{- if (eq .input_setup_cicd_and_project `CICD_and_Project`)}}
+├── {{template `project_name_alphanumeric_underscore` .}}       <- Contains python code, notebooks and ML resources related to one ML project. 
+│   │
+│   ├── requirements.txt        <- Specifies Python dependencies for ML code (for example: model training, batch inference).
+│   │
+│   ├── databricks.yml          <- databricks.yml is the root bundle file for the ML project that can be loaded by databricks CLI bundles. It defines the bundle name, workspace URL and resource config component to be included.
+│   │
+{{- if (eq .input_include_feature_store `no`) }}
+│   ├── training                <- Training folder contains Notebook that trains and registers the model.
+│   │
+│   ├── validation              <- Optional model validation step before deploying a model.
+│   │
+│   ├── monitoring              <- Model monitoring, feature monitoring, etc.
+│   │
+│   ├── deployment              <- Deployment and Batch inference workflows
+│   │   │
+│   │   ├── batch_inference     <- Batch inference code that will run as part of scheduled workflow.
+│   │   │
+│   │   ├── model_deployment    <- As part of CD workflow, deploy the registered model by assigning it the appropriate alias.
+│   │
+│   │
+│   ├── tests                   <- Unit tests for the ML project, including the modules under `features`.
+│   │
+│   ├── resources               <- ML resource (ML jobs, MLflow models) config definitions expressed as code, across dev/staging/prod/test.
+│       │
+│       ├── model-workflow-resource.yml                <- ML resource config definition for model training, validation, deployment workflow
+│       │
+│       ├── batch-inference-workflow-resource.yml      <- ML resource config definition for batch inference workflow
+│       │
+│       ├── ml-artifacts-resource.yml                  <- ML resource config definition for model and experiment
+│       │
+│       ├── monitoring-resource.yml           <- ML resource config definition for quality monitoring workflow
+{{- else if (eq .input_include_feature_store `yes`) }}
+│   ├── training                <- Training folder contains Notebook that trains and registers the model with feature store support.
+│   │
+│   ├── feature_engineering     <- Feature computation code (Python modules) that implements the feature transforms.
+│   │                              The output of these transforms get persisted as Feature Store tables. Most development
+│   │                              work happens here.
+│   │
+│   ├── validation              <- Optional model validation step before deploying a model.
+│   │
+│   ├── monitoring              <- Model monitoring, feature monitoring, etc.
+│   │
+│   ├── deployment              <- Deployment and Batch inference workflows
+│   │   │
+│   │   ├── batch_inference     <- Batch inference code that will run as part of scheduled workflow.
+│   │   │
+│   │   ├── model_deployment    <- As part of CD workflow, deploy the registered model by assigning it the appropriate alias.
+│   │
+│   │
+│   ├── tests                   <- Unit tests for the ML project, including the modules under `features`.
+│   │
+│   ├── resources               <- ML resource (ML jobs, MLflow models) config definitions expressed as code, across dev/staging/prod/test.
+│       │
+│       ├── model-workflow-resource.yml                <- ML resource config definition for model training, validation, deployment workflow
+│       │
+│       ├── batch-inference-workflow-resource.yml      <- ML resource config definition for batch inference workflow
+│       │
+│       ├── feature-engineering-workflow-resource.yml  <- ML resource config definition for feature engineering workflow
+│       │
+│       ├── ml-artifacts-resource.yml                  <- ML resource config definition for model and experiment
+│       │
+│       ├── monitoring-resource.yml           <- ML resource config definition for quality monitoring workflow
+{{- end }}
+{{- end }}
+│
+{{- if or (eq .input_cicd_platform `github_actions`) (eq .input_cicd_platform `github_actions_for_github_enterprise_servers`) }}
+├── .github                     <- Configuration folder for CI/CD using GitHub Actions. {{ if (eq .input_setup_cicd_and_project `CICD_and_Project`)}} The CI/CD workflows deploy ML resources defined in the `./resources/*` folder with databricks CLI bundles.{{ end }}
+{{- else if (eq .input_cicd_platform `azure_devops`) }}
+├── .azure                      <- Configuration folder for CI/CD using Azure DevOps Pipelines. {{ if (eq .input_setup_cicd_and_project `CICD_and_Project`)}} The CI/CD workflows deploy ML resources defined in the `./resources/*` folder with databricks CLI bundles.{{ end }}
+{{- else if (eq .input_cicd_platform `gitlab`) }}
+├── .gitlab                      <- Configuration folder for CI/CD using Gitlab Pipelines. {{ if (eq .input_setup_cicd_and_project `CICD_and_Project`)}} The CI/CD workflows deploy ML resources defined in the `./resources/*` folder with databricks CLI bundles.{{ end }}
+{{- end }}
+│
+├── docs                        <- Contains documentation for the repo.
+│
+├── cicd.tar.gz                 <- Contains CI/CD bundle that should be deployed by deploy-cicd.yml to set up CI/CD for projects.
+```
+
+## Using this repo
+
+The table below links to detailed docs explaining how to use this repo for different use cases.
+
+{{ if (eq .input_setup_cicd_and_project `CICD_and_Project`)}}
+This project comes with example ML code to train, validate and deploy a regression model to predict NYC taxi fares.
+If you're a data scientist just getting started with this repo for a brand new ML project, we recommend 
+adapting the provided example code to your ML problem. Then making and 
+testing ML code changes on Databricks or your local machine. Follow the instructions from
+the [project README](./{{template `project_name_alphanumeric_underscore` .}}/README.md).
+{{ end }} 
+
+When you're ready to deploy production training/inference
+pipelines, ask your ops team to follow the [MLOps setup guide](docs/mlops-setup.md) to configure CI/CD and deploy 
+production ML pipelines.
+
+After that, follow the [ML pull request guide](docs/ml-pull-request.md)
+{{ if (eq .input_setup_cicd_and_project `CICD_and_Project`)}} and [ML resource config guide]({{template `project_name_alphanumeric_underscore` .}}/resources/README.md) {{ end }} to propose, test, and deploy changes to production ML code (e.g. update model parameters)
+or pipeline resources (e.g. use a larger instance type for model training) via pull request.
+
+| Role                          | Goal                                                                         | Docs                                                                                                                                                                |
+|-------------------------------|------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| Data Scientist                | Get started writing ML code for a brand new project                          | {{ if (eq .input_setup_cicd_and_project `CICD_and_Project`)}}[project README](./{{template `project_name_alphanumeric_underscore` .}}/README.md) {{ else }} README when project is initialized {{ end }}|
+| MLOps / DevOps                | Set up CI/CD for the current ML project   | [MLOps setup guide](docs/mlops-setup.md)                                                                                                                            |
+| Data Scientist                | Update production ML code (e.g. model training logic) for an existing project | [ML pull request guide](docs/ml-pull-request.md)                                                                                                                    |
+| Data Scientist                | Modify production model ML resources, e.g. model training or inference jobs  | {{ if (eq .input_setup_cicd_and_project `CICD_and_Project`)}}[ML resource config guide]({{template `project_name_alphanumeric_underscore` .}}/resources/README.md) {{ else }} ML resources README when project is initialized {{ end }} |
+
+## Setting up CI/CD
+This stack comes with a workflow to set up CI/CD for projects that can be found in
+{{ if (or (eq .input_cicd_platform `github_actions`) (eq .input_cicd_platform `github_actions_for_github_enterprise_servers`)) }}
+`.github/workflows/deploy-cicd.yml`.
+{{ else if (eq .input_cicd_platform `azure_devops`)}}
+`.azure/devops-pipelines/deploy-cicd.yml`.
+{{ else if (eq .input_cicd_platform `gitlab`)}}
+`.gitlab/pipelines/{{.input_project_name}}-triggers-cicd.yml`.
+{{ end }}
+
+To set up CI/CD for projects that were created through MLOps Stacks with the `Project_Only` parameter, 
+run the above mentioned workflow, specifying the `project_name` as a parameter. For example, for the monorepo case:
+
+1. Setup your repository by initializing MLOps Stacks via Databricks CLI with the `CICD_and_Project` or `CICD_Only` parameter.
+2. Follow the [MLOps Setup Guide](./docs/mlops-setup.md) to setup authentication and get the repo ready for CI/CD.
+3. Create a new project by initializing MLOps Stacks again but this time with the `Project_Only` parameter.
+4. Run the `deploy-cicd.yml` workflow with the `project_name` parameter set to the name of the project you want to set up CI/CD for.
+
+{{ if (eq .input_setup_cicd_and_project `CICD_and_Project`)}}
+NOTE: This project has already been initialized with an instantiation of the above workflow, so there's no
+need to run it again for project `{{.input_project_name}}`.
+{{ end -}}
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/cicd.tar.gz b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/cicd.tar.gz
new file mode 100644
index 00000000000..affa3dc8d23
Binary files /dev/null and b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/cicd.tar.gz differ
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/cicd_params.json.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/cicd_params.json.tmpl
new file mode 100644
index 00000000000..eba55d0490c
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/cicd_params.json.tmpl
@@ -0,0 +1,13 @@
+{
+  "input_root_dir": "{{ .input_root_dir }}",
+  "input_cloud": "{{ .input_cloud }}",
+  "input_cicd_platform": "{{ .input_cicd_platform }}",
+  "input_default_branch": "{{ .input_default_branch }}",
+  "input_release_branch": "{{ .input_release_branch }}",
+  "cloud_specific_node_type_id": "{{template `cli_version` .}}",
+  "input_cli_version": "{{template `cli_version` .}}",
+  "test_catalog_name": "{{ .input_test_catalog_name }}",
+  "staging_catalog_name": "{{ .input_staging_catalog_name }}",
+  "prod_catalog_name": "{{ .input_prod_catalog_name }}",
+  "input_docker_image": "{{ .input_docker_image }}"
+}
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/docs/images/mlops-stack-deploy.png b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/docs/images/mlops-stack-deploy.png
new file mode 100644
index 00000000000..77b67188029
Binary files /dev/null and b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/docs/images/mlops-stack-deploy.png differ
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/docs/images/mlops-stack-summary.png b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/docs/images/mlops-stack-summary.png
new file mode 100644
index 00000000000..f44bbd77df2
Binary files /dev/null and b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/docs/images/mlops-stack-summary.png differ
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/docs/ml-pull-request.md.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/docs/ml-pull-request.md.tmpl
new file mode 100644
index 00000000000..4ac613c1cfb
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/docs/ml-pull-request.md.tmpl
@@ -0,0 +1,92 @@
+# Updating ML code in production
+
+[(back to main README)](../README.md)
+
+**NOTE**: This page assumes that your MLOps team has already configured CI/CD and deployed initial
+ML resources, per the [MLOps setup guide](mlops-setup.md).
+
+## Table of contents
+* [Opening a pull request](#opening-a-pull-request)
+* [Viewing test status and debug logs](#viewing-test-status-and-debug-logs)
+* [Merging your pull request](#merging-your-pull-request)
+* [Next steps](#next-steps)
+
+## Opening a pull request
+
+To push your updated ML code to production, [open a pull request]({{ if (eq .input_cicd_platform `github_actions`) }}https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request
+{{ else if (eq .input_cicd_platform `azure_devops`) }}https://learn.microsoft.com/en-us/azure/devops/repos/git/pull-requests?view=azure-devops&tabs=browser#create-a-pull-request
+{{ else if (eq .input_cicd_platform `gitlab`) }}https://docs.gitlab.com/ee/user/project/merge_requests/
+{{ end }}) against the remote Git repo containing the current project.
+
+**NOTE**: the default tests provided in this repo require that you use a pull
+request branch on the Git repo for the current project, rather than opening a pull request from a fork
+of the Git repo. Support for running tests against pull requests from repo forks
+is planned for the future.
+
+## Viewing test status and debug logs
+Opening a pull request will trigger a 
+{{- if (eq .input_setup_cicd_and_project `CICD_and_Project`) }}
+{{- if or (eq .input_cicd_platform `github_actions`) (eq .input_cicd_platform `github_actions_for_github_enterprise_servers`) -}} 
+[workflow](../.github/workflows/{{ .input_project_name }}-run-tests.yml)
+{{- else if (eq .input_cicd_platform `azure_devops`) -}}
+[Azure DevOps Pipeline](../.azure/devops-pipelines/{{ .input_project_name }}-tests-ci.yml)
+{{- else if (eq .input_cicd_platform `gitlab`) -}}
+[Gitlab Pipeline](../.gitlab/pipelines/{{.input_project_name}}-bundle-ci.yml)
+{{- end }} 
+{{- else }}
+workflow
+{{- end }} 
+that runs unit and integration tests for the model training (and feature engineering if added) pipeline on Databricks against a test dataset.
+You can view test status and debug logs from the pull request UI, and push new commits to your pull request branch
+to address any test failures.
+{{ if (eq .input_include_feature_store `yes`) }}
+The integration test runs the feature engineering and model training notebooks as a multi-task Databricks Job in the staging workspace.
+It reads input data, performs feature transforms, and writes outputs to Feature Store tables in the staging workspace. 
+The model training notebook uses these Feature Store tables as inputs to train, validate and register a new model version in UC.
+The fitted model along with its metrics and params will also be logged to an MLflow run. 
+To debug failed integration test runs, click into the Databricks job run
+URL printed in the test logs. The executed notebook of the job run will contain a link to the MLflow model training run, which you can use with the Experiments page in the workspace
+to view training metrics or fetch and debug the model as needed.
+{{- else }}
+The integration test runs the model training notebook in the staging workspace, training, validating,
+and registering a new model version in UC.
+The fitted model along with its metrics and params
+will also be logged to an MLflow run. To debug failed integration test runs, click into the Databricks job run
+URL printed in the test logs. The executed notebook of the job run will contain a link to the MLflow model training run. You can also use the Experiments page in the workspace
+to view training metrics or fetch and debug the model as needed.
+{{ end }}
+
+## Merging your pull request
+Once tests pass on your pull request, get your pull request reviewed and approved by a teammate,
+and then merge it into the upstream repo.
+
+## Next Steps
+{{- if (eq .input_default_branch .input_release_branch) }}
+After merging your pull request, subsequent runs of the model training, feature engineering if added, and batch inference
+jobs in staging will automatically use your updated ML code.
+
+You may want to wait to confirm that
+the staging jobs succeed, then repeat the workflow above to open a pull request against the
+`{{ .input_release_branch }}` branch to promote your ML code to production. Once your pull request against `{{ .input_release_branch }}`
+merges, production jobs will also automatically include your changes. 
+
+{{- else }}
+After merging your pull request, subsequent runs of the model training and batch inference
+jobs in staging and production will automatically use your updated ML code.
+{{- end }}
+
+You can track the state of the ML pipelines for the current project from the MLflow registered model UI. 
+{{ if (eq .input_setup_cicd_and_project `CICD_and_Project`) }}
+Links:
+* [Staging model in UC]({{template `databricks_staging_workspace_host` .}}/explore/data/models/staging/{{.input_project_name}}/{{template `model_name` .}})
+* [Prod model in UC]({{template `databricks_prod_workspace_host` .}}/explore/data/models/prod/{{.input_project_name}}/{{template `model_name` .}})
+
+{{end}}
+
+In both the staging and prod workspaces, the MLflow registered model contains links to:
+* The model versions produced through automated retraining
+* The Git repository containing the ML code run in the training and inference pipelines
+ {{ if (eq .input_include_feature_store `yes`) }}* The recurring Feature Store jobs that computes and writes features to Feature Store tables. {{ end }}
+* The recurring training job that produces new model versions using the latest ML code and data
+* The model deployment CD workflow that takes model versions produced by the training job and deploys them for inference
+* The recurring batch inference job that uses the currently-deployed model version to score a dataset
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/docs/mlops-setup.md.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/docs/mlops-setup.md.tmpl
new file mode 100644
index 00000000000..abbc989a175
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/docs/mlops-setup.md.tmpl
@@ -0,0 +1,402 @@
+# MLOps Setup Guide
+[(back to main README)](../README.md)
+
+## Table of contents
+* [Intro](#intro)
+* [Create a hosted Git repo](#create-a-hosted-git-repo)
+* [Configure CI/CD]({{ if (eq .input_cicd_platform `github_actions`) }}#configure-cicd---github-actions{{ else if (eq .input_cicd_platform `azure_devops`) }}#configure-cicd---azure-devops{{ else if (eq .input_cicd_platform `gitlab`) }}#configure-cicd---gitlab{{ end }})
+{{- if (eq .input_setup_cicd_and_project `CICD_and_Project`)}}
+* [Merge PR with initial ML code](#merge-a-pr-with-your-initial-ml-code)
+{{- end }}
+{{ if not (eq .input_release_branch .input_default_branch) -}}
+* [Create release branch](#create-release-branch)
+{{ end -}}
+{{- if (eq .input_setup_cicd_and_project `CICD_and_Project`) }}
+* [Deploy ML resources and enable production jobs](#deploy-ml-resources-and-enable-production-jobs){{ end }}
+* [Next steps](#next-steps)
+
+## Intro
+This page explains how to productionize the current project, setting up CI/CD and
+ML resource deployment, and deploying ML training and inference jobs.
+
+After following this guide, data scientists can follow the [ML Pull Request](ml-pull-request.md) guide to make changes to ML code or deployed jobs.
+
+## Create a hosted Git repo
+Create a hosted Git repo to store project code, if you haven't already done so. From within the project
+directory, initialize Git and add your hosted Git repo as a remote:
+```
+git init --initial-branch={{ .input_default_branch }}
+```
+
+```
+git remote add upstream <hosted-git-repo-url>
+```
+
+Commit the current `README.md` file and other docs to the `{{ .input_default_branch }}` branch of the repo, to enable forking the repo:
+```
+{{ if (eq .input_setup_cicd_and_project `CICD_and_Project`)}}
+git add README.md docs .gitignore {{template `project_name_alphanumeric_underscore` .}}/resources/README.md
+git commit -m "Adding project README"
+{{ else }}
+git add .
+git commit -m "Adding CICD scaffolding"
+{{ end }}
+git push upstream {{ .input_default_branch }}
+```
+
+{{ if (eq .input_cicd_platform `github_actions`) -}}
+## Configure CI/CD - GitHub Actions
+
+### Prerequisites
+* You must be an account admin to add service principals to the account.
+* You must be a Databricks workspace admin in the staging and prod workspaces. 
+  Verify that you're an admin by viewing the
+  [staging workspace admin console]({{template `databricks_staging_workspace_host` .}}#setting/accounts) and
+  [prod workspace admin console]({{template `databricks_prod_workspace_host` .}}#setting/accounts). 
+  If the admin console UI loads instead of the Databricks workspace homepage, you are an admin.
+
+### Set up authentication for CI/CD
+#### Set up Service Principal
+{{ if eq .input_cloud `azure` }}
+To authenticate and manage ML resources created by CI/CD, 
+[service principals]({{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "administration-guide/users-groups/service-principals")) }})
+for the project should be created and added to both staging and prod workspaces. Follow
+[Add a service principal to your Azure Databricks account]({{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "administration-guide/users-groups/service-principals#--add-a-service-principal-to-your-azure-databricks-account")) }})
+and [Add a service principal to a workspace]({{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "administration-guide/users-groups/service-principals#--add-a-service-principal-to-a-workspace")) }})
+for details.
+
+For your convenience, we also have Terraform modules that can be used to [create](https://registry.terraform.io/modules/databricks/mlops-azure-project-with-sp-creation/databricks/latest) or [link](https://registry.terraform.io/modules/databricks/mlops-azure-project-with-sp-linking/databricks/latest) service principals.
+
+{{ else }}
+To authenticate and manage ML resources created by CI/CD, 
+[service principals]({{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "administration-guide/users-groups/service-principals.html")) }})
+for the project should be created and added to both staging and prod workspaces. Follow
+[Add a service principal to your Databricks account]({{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "administration-guide/users-groups/service-principals.html#add-a-service-principal-to-your-databricks-account")) }})
+and [Add a service principal to a workspace]({{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "administration-guide/users-groups/service-principals.html#add-a-service-principal-to-a-workspace")) }})
+for details.
+
+{{ if eq .input_cloud `aws` }}
+For your convenience, we also have a [Terraform module](https://registry.terraform.io/modules/databricks/mlops-aws-project/databricks/latest) that can set up your service principals.
+{{ end }}
+{{ end }}
+
+#### Configure Service Principal (SP) permissions 
+If the created project uses **Unity Catalog**, we expect a catalog to exist with the name of the deployment target by default. 
+For example, if the deployment target is dev, we expect a catalog named dev to exist in the workspace. 
+If you want to use different catalog names, please update the target names declared in the 
+{{- if (eq .input_setup_cicd_and_project `CICD_and_Project`)}}[{{ .input_project_name }}/databricks.yml](../{{template `project_name_alphanumeric_underscore` .}}/databricks.yml) 
+{{- else }} `databricks.yml` {{ end }} file.
+If changing the staging, prod, or test deployment targets, you'll also need to update the workflows located in the .github/workflows directory.
+
+The SP must have proper permission in each respective environment and the catalog for the environments.
+
+For the integration test and the ML training job, the SP must have permissions to read the input Delta table and create experiment and models. 
+i.e. for each environment:
+- USE_CATALOG
+- USE_SCHEMA
+- MODIFY
+- CREATE_MODEL
+- CREATE_TABLE
+
+For the batch inference job, the SP must have permissions to read input Delta table and modify the output Delta table. 
+i.e. for each environment
+- USAGE permissions for the catalog and schema of the input and output table.
+- SELECT permission for the input table.
+- MODIFY permission for the output table if it pre-dates your job.
+
+
+#### Set secrets for CI/CD
+{{ if eq .input_cloud `azure` }}
+After creating the service principals and adding them to the respective staging and prod workspaces, refer to
+[Manage access tokens for a service principal]({{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "administration-guide/users-groups/service-principals#--manage-access-tokens-for-a-service-principal")) }})
+and [Get Azure AD tokens for service principals]({{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "dev-tools/api/latest/aad/service-prin-aad-token")) }})
+to get your service principal credentials (tenant id, application id, and client secret) for both the staging and prod service principals, and [Encrypted secrets](https://docs.github.com/en/actions/security-guides/encrypted-secrets)
+to add the following secrets to GitHub:
+- `PROD_AZURE_SP_TENANT_ID`
+- `PROD_AZURE_SP_APPLICATION_ID`
+- `PROD_AZURE_SP_CLIENT_SECRET`
+- `STAGING_AZURE_SP_TENANT_ID`
+- `STAGING_AZURE_SP_APPLICATION_ID`
+- `STAGING_AZURE_SP_CLIENT_SECRET`
+- `WORKFLOW_TOKEN` : [Github token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#creating-a-personal-access-token-classic) with workflow permissions. This secret is needed for the Deploy CI/CD Workflow.
+Be sure to update the [Workflow Permissions](https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token) section under Repo Settings > Actions > General to allow `Read and write permissions`.
+{{ else }}
+After creating the service principals and adding them to the respective staging and prod workspaces, follow
+[Manage access tokens for a service principal]({{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "administration-guide/users-groups/service-principals.html#manage-access-tokens-for-a-service-principal")) }})
+to get service principal tokens for staging and prod workspace and follow [Encrypted secrets](https://docs.github.com/en/actions/security-guides/encrypted-secrets)
+to add the secrets to GitHub:
+- `STAGING_WORKSPACE_TOKEN` : service principal token for staging workspace
+- `PROD_WORKSPACE_TOKEN` : service principal token for prod workspace
+- `WORKFLOW_TOKEN` : [Github token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#creating-a-personal-access-token-classic) with workflow permissions. This secret is needed for the Deploy CI/CD Workflow.
+
+Next, be sure to update the [Workflow Permissions](https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token) section under Repo Settings > Actions > General:
+- Allow `Read and write permissions`,
+- Allow workflows to be able to open pull requests (PRs).
+{{ end }}
+
+### Setting up CI/CD workflows
+After setting up authentication for CI/CD, you can now set up CI/CD workflows. We provide a [Deploy CICD workflow](../.github/workflows/deploy-cicd.yml) that can be used to generate the other CICD workflows mentioned below for projects. 
+This workflow is manually triggered with `project_name` as parameter. This workflow will need to be triggered for each project to set up its set of CI/CD workflows that can be used to deploy ML resources and run ML jobs in the staging and prod workspaces. 
+These workflows will be defined under `.github/workflows`.
+
+If you want to deploy CI/CD for an initialized project (`Project-Only` MLOps Stacks initialization), you can manually run the `deploy-cicd.yml` workflow from the [Github Actions UI](https://docs.github.com/en/actions/using-workflows/manually-running-a-workflow?tool=webui) once the project code has been added to your main repo. 
+The workflow will create a pull request with all the changes against your {{ .input_default_branch }} branch. Review and approve it to commit the files to deploy CI/CD for the project. 
+
+{{ else if (eq .input_cicd_platform `azure_devops`) -}}
+## Configure CI/CD - Azure DevOps
+
+Azure DevOps Pipelines are defined under `.azure/devops-pipelines`:
+- **`deploy-cicd.yml`**:<br>
+  - Generates the other CICD pipelines mentioned below for projects<br>
+    - Manually triggered with `project_name` as parameter
+> Note that this workflow will need to be triggered for each project to set up its CI/CD.  In order to run the `Push CICD Bundle to a New Branch` step in the workflow, the project needs to enable the Build Service to be able to contribute and create a branch for the project,
+i.e when the deploy CI/CD pipeline is triggered, the build service that runs this pipeline needs the necessary permissions to be able to push. To do this, go to Project Settings -> Repositories -> Security -> Select <project_name> Build Service under users and 
+set "Contribute", "Create Branch", and "Contribute to pull requests" to "Allow".
+
+Project-Specific pipelines:
+- **`{{ .input_project_name }}-tests-ci.yml`**:<br>
+  - **[CI]** Performs unit and integration tests<br>
+    - Triggered on PR to main
+- **`{{ .input_project_name }}-bundle-cicd.yml`**:<br>
+  - **[CI]** Performs validation of Databricks resources defined under `{{template `project_name_alphanumeric_underscore` .}}/resources`<br>
+    - Triggered on PR to main<br>
+  - **[CD]** Deploys Databricks resources to the staging workspace<br>
+    - Triggered on merging into main<br>
+  - **[CD]** Deploys Databricks resources to the prod workspace<br>
+    - Triggered on merging into release
+> Note that these workflows are provided as example CI/CD workflows, and can be easily modified to match your preferred CI/CD order of operations.
+
+Within the CI/CD pipelines defined under `.azure/devops-pipelines`, we will be deploying Databricks resources to the defined staging and prod workspaces using the `databricks` CLI. This requires setting up authentication between the `databricks` CLI and Databricks. By default we show how to authenticate with service principals by passing [secret variables from a variable group](https://learn.microsoft.com/en-us/azure/devops/pipelines/scripts/cli/pipeline-variable-group-secret-nonsecret-variables?view=azure-devops). In a production setting it is recommended to either use an [Azure Key Vault](https://learn.microsoft.com/en-us/azure/devops/pipelines/release/azure-key-vault?view=azure-devops&tabs=yaml) to store these secrets, or alternatively use [Azure service connections](https://learn.microsoft.com/en-us/azure/devops/pipelines/library/service-endpoints?view=azure-devops&tabs=yaml). We describe below how you can adapt the project Pipelines to leverage service connections. Let's add these.
+
+```
+git add .azure
+git commit -m "Adding devops-pipeline files"
+git push upstream {{ .input_default_branch }}
+```
+
+### Service principal approach [Default]
+
+By default, we provide Azure Pipelines where authentication is done using service principals.
+
+#### Requirements:
+- You must be an account admin to add service principals to the account.
+- You must be a Databricks workspace admin in the staging and prod workspaces. Verify that you're an admin by viewing the
+  [staging workspace admin console]({{template `databricks_staging_workspace_host` .}}#setting/accounts) and
+  [prod workspace admin console]({{template `databricks_prod_workspace_host` .}}#setting/accounts). If
+  the admin console UI loads instead of the Databricks workspace homepage, you are an admin.
+- Permissions to create Azure DevOps Pipelines in your Azure DevOps project. See the following [Azure DevOps prerequisites](https://learn.microsoft.com/en-us/azure/devops/organizations/security/about-permissions).
+- Permissions to create Azure DevOps build policies. See the following [prerequisites](https://learn.microsoft.com/azure/devops/repos/git/branch-policies).
+
+#### Steps:
+{{ if (eq .input_cloud `azure`) }}
+1. Create two service principals - one to be used for deploying and running staging resources, and one to be used for deploying and running production resources. See [here]({{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "administration-guide/users-groups/service-principals")) }}) for details on how to create a service principal.
+1. [Add the staging and production service principals to your Azure Databricks account]({{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "administration-guide/users-groups/service-principals#add-service-principals-to-your-account-using-the-account-console")) }}), and following this add the staging service principal to the staging workspace, and production service principal to the production workspace. See [here]({{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "administration-guide/users-groups/service-principals")) }}) for details.
+1. Follow ['Get Azure AD tokens for the service principals']({{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "dev-tools/api/latest/aad/service-prin-aad-token")) }})
+to get your service principal credentials (tenant id, application id, and client secret) for both the staging and prod service principals. You will use these credentials as variables in the project Azure Pipelines.
+{{ else }}
+1. Create two service principals - one to be used for deploying and running staging resources, and one to be used for deploying and running production resources. See [here]({{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "administration-guide/users-groups/service-principals.html")) }}) for details on how to create a service principal.
+1. [Add the staging and production service principals to your Databricks account]({{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "administration-guide/users-groups/service-principals.html#add-service-principals-to-your-account-using-the-account-console")) }}), and following this add the staging service principal to the staging workspace, and production service principal to the production workspace. See [here]({{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "administration-guide/users-groups/service-principals.html")) }}) for details.
+1. Follow ['Get tokens for the service principals']({{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "administration-guide/users-groups/service-principals.html#manage-personal-access-tokens-for-a-service-principal")) }})
+to get your service principal token for both the staging and prod service principals. You will use the token as variables in the project Azure Pipelines.
+{{ end }}
+1. Create separate Azure Pipelines under your Azure DevOps project using the ‘Existing Azure Pipelines YAML file’ option. Create one pipeline for each script. See [here](https://docs.microsoft.com/en-us/azure/devops/pipelines/create-first-pipeline) for more details on creating Azure Pipelines.
+1. Create a new variable group called `{{ .input_root_dir }} variable group` defining the following secret variables, for more details [here](https://learn.microsoft.com/en-us/azure/devops/pipelines/library/variable-groups?view=azure-devops&tabs=classic#create-a-variable-group):
+{{ if (eq .input_cloud `azure`) }}
+    - `PROD_AZURE_SP_TENANT_ID`: tenant ID for the prod service principal
+    - `PROD_AZURE_SP_APPLICATION_ID`: application (client) ID for the prod service principal
+    - `PROD_AZURE_SP_CLIENT_SECRET`: client secret for the prod service principal
+    - `STAGING_AZURE_SP_TENANT_ID`: tenant ID for the staging service principal
+    - `STAGING_AZURE_SP_APPLICATION_ID`: application (client) ID for the staging service principal
+    - `STAGING_AZURE_SP_CLIENT_SECRET`: client secret for the prod service principal
+{{ else }}
+    - `PROD_WORKSPACE_TOKEN` : service principal token for prod workspace
+    - `STAGING_WORKSPACE_TOKEN` : service principal token for staging workspace
+{{ end }}
+  - Ensure that the Azure Pipelines created in the prior step have access to these variables by selecting the name of the pipelines under the 'Pipeline permissions' tab of this variable group.
+  - Alternatively you could store these secrets in an [Azure Key Vault](https://learn.microsoft.com/en-us/azure/devops/pipelines/release/key-vault-in-own-project?view=azure-devops&tabs=portal) and link those secrets as variables to be used in the Pipelines.
+1. Define [build validation branch policies](https://learn.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops&tabs=browser#build-validation) for the `{{ .input_default_branch }}` branch using the Azure build pipelines created in step 1. This is required so that any PR changes to the `{{ .input_default_branch }}` must build successfully before PRs can complete. 
+In the case of a monorepo, where there are multiple projects under a single repository, set a [path filter](https://learn.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops&tabs=browser#path-filters) on the build validation policies, such that devops pipelines are only triggered when there are changes to the respective projects (e.g. the path filter would be `/project1/*` to trigger a devops pipeline when changes are made to _only_ files under the `project1` folder).
+
+{{ if (eq .input_cloud `azure`) }}
+### Service connection approach [Recommended in production settings]
+
+#### Requirements:
+- You must be an Azure account admin to add service principals to the account.
+- You must be a Databricks workspace admin in the staging and prod workspaces. Verify that you're an admin by viewing the
+  [staging workspace admin console]({{template `databricks_staging_workspace_host` .}}#setting/accounts) and
+  [prod workspace admin console]({{template `databricks_prod_workspace_host` .}}#setting/accounts). If
+  the admin console UI loads instead of the Databricks workspace homepage, you are an admin.
+- Permissions to create service connections within an Azure subscription. See the following [prerequisites](https://docs.microsoft.com/azure/devops/pipelines/library/service-endpoints).
+- Permissions to create Azure DevOps Pipelines in your Azure DevOps project. See the following [Azure DevOps prerequisites](https://learn.microsoft.com/en-us/azure/devops/organizations/security/about-permissions).
+- Permissions to create Azure DevOps build policies. See the following [prerequisites](https://learn.microsoft.com/azure/devops/repos/git/branch-policies).
+
+The ultimate aim of the service connection approach is to use two separate service connections, authenticated with a staging service principal and a production service principal, to deploy and run resources in the respective Azure Databricks workspaces. Taking this approach then negates the need to read client secrets or client IDs from the CI/CD pipelines.
+
+#### Steps:
+1. Create two service principals - one to be used for deploying and running staging resources, and one to be used for deploying and running production resources. See [here]({{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "administration-guide/users-groups/service-principals")) }}) for details on how to create a service principal.
+1. [Add the staging and production service principals to your Azure Databricks account]({{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "administration-guide/users-groups/service-principals#add-service-principals-to-your-account-using-the-account-console")) }}), and following this add the staging service principal to the staging workspace, and production service principal to the production workspace. See [here]({{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "administration-guide/users-groups/service-principals.html")) }}) for details.
+1. [Create two Azure Resource Manager service connections](https://learn.microsoft.com/en-us/azure/devops/pipelines/library/service-endpoints?view=azure-devops&tabs=yaml#create-a-service-connection) - one to be used to deploy to staging Databricks resources, the other for production resources. Each of these service connections should be authenticated with the respective staging and production service principals created in the prior step.
+1. Update pipeline YAML files to use service connections rather than pipeline variables:
+   - First, remove any lines where the environment variables are set in tasks in `{{ .input_project_name }}-tests-ci.yml` or `{{ .input_project_name }}-bundle-cicd.yml` files. Specifically, any lines where the following env vars are used: `PROD_AZURE_SP_TENANT_ID`, `PROD_AZURE_SP_APPLICATION_ID`, `PROD_AZURE_SP_CLIENT_SECRET`, `STAGING_AZURE_SP_TENANT_ID`, `STAGING_AZURE_SP_APPLICATION_ID`, `STAGING_AZURE_SP_CLIENT_SECRET`
+   - Then, add the following AzureCLI task prior to installing the `databricks` cli in any of the pipeline jobs:
+
+```yaml
+# Get Azure Resource Manager variables using service connection
+- task: AzureCLI@2
+  displayName: 'Extract information from Azure CLI'
+  inputs:
+    azureSubscription: # TODO: insert SERVICE_CONNECTION_NAME
+    addSpnToEnvironment: true
+    scriptType: bash
+    scriptLocation: inlineScript
+    inlineScript: |
+      subscription_id=$(az account list --query "[?isDefault].id"|jq -r '.[0]')
+      echo "##vso[task.setvariable variable=ARM_CLIENT_ID]${servicePrincipalId}"
+      echo "##vso[task.setvariable variable=ARM_CLIENT_SECRET;issecret=true]${servicePrincipalKey}"
+      echo "##vso[task.setvariable variable=ARM_TENANT_ID]${tenantId}"
+      echo "##vso[task.setvariable variable=ARM_SUBSCRIPTION_ID]${subscription_id}"
+```
+  > Note that you will have to update this code snippet with the respective service connection names, depending on which Databricks workspace you are deploying resources to.
+
+1. Create separate Azure Pipelines under your Azure DevOps project using the ‘Existing Azure Pipelines YAML file’ option. Create one pipeline for each script. See [here](https://docs.microsoft.com/en-us/azure/devops/pipelines/create-first-pipeline) for more details on creating Azure Pipelines.
+1. Define [build validation branch policies](https://learn.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops&tabs=browser#build-validation) for the `{{ .input_default_branch }}` branch using the Azure build pipelines created in step 1. This is required so that any PR changes to the `{{ .input_default_branch }}` must build successfully before PRs can complete. 
+In the case of a monorepo, where there are multiple projects under a single repository, set a [path filter](https://learn.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops&tabs=browser#path-filters) on the build validation policies, such that devops pipelines are only triggered when there are changes to the respective projects (e.g. the path filter would be `/project1/*` to trigger a devops pipeline when changes are made to _only_ files under the `project1` folder).
+{{ end }}
+
+### Setting up CI/CD workflows
+After setting up authentication for CI/CD, you can now set up CI/CD workflows. We provide a [Deploy CICD workflow](../.azure/devops-pipelines/deploy-cicd.yml) that can be used to generate the other CICD workflows mentioned below for projects. 
+This workflow is manually triggered with `project_name` as parameter. This workflow will need to be triggered for each project to set up its set of CI/CD workflows that can be used to deploy ML resources and run ML jobs in the staging and prod workspaces. 
+These workflows will be defined under `.azure/devops-pipelines`. After generating these workflows, be sure to go through the above workflow-specific steps again to add the appropriate build branch policies and filters.
+
+{{ else if (eq .input_cicd_platform `gitlab`) }}
+## Configure CI/CD - Gitlab Pipelines
+
+### Prerequisites
+* You must be an account admin to add service principals to the account.
+* You must be a Databricks workspace admin in the staging and prod workspaces. Verify that you're an admin by viewing the
+  [staging workspace admin console]({{template `databricks_staging_workspace_host` .}}#setting/accounts) and
+  [prod workspace admin console]({{template `databricks_prod_workspace_host` .}}#setting/accounts). If
+  the admin console UI loads instead of the Databricks workspace homepage, you are an admin.
+
+### Set up authentication for CI/CD
+#### Set up Service Principal
+To authenticate and manage ML resources created by CI/CD, 
+[service principals]({{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "administration-guide/users-groups/service-principals")) }})
+should be created and added to test, staging and prod workspaces.
+
+Service principals can be created and managed in the your cloud provider identity solution or in Databricks directly. We normally recommend setting up a Databricks managed service principal.  
+Follow [Add a service principal to your Databricks account]({{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "administration-guide/users-groups/service-principals.html#add-a-service-principal-to-your-databricks-account")) }})
+and [Add a service principal to a workspace]({{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "administration-guide/users-groups/service-principals.html#add-a-service-principal-to-a-workspace")) }})
+for details.
+
+{{ if eq .input_cloud `aws` }}
+For your convenience, we also have a [Terraform module](https://registry.terraform.io/modules/databricks/mlops-aws-project/databricks/latest) that can set up your service principals.
+{{ end }}
+
+#### Configure Service Principal (SP) permissions 
+If the created project uses **Unity Catalog**, we expect a catalog to exist with the name of the deployment target by default. 
+For example, if the deployment target is dev, we expect a catalog named dev to exist in the workspace. 
+If you want to use different catalog names, please update the target names declared in the  
+{{- if (eq .input_setup_cicd_and_project `CICD_and_Project`)}}[{{ .input_project_name }}/databricks.yml](../{{template `project_name_alphanumeric_underscore` .}}/databricks.yml) 
+{{- else }} `databricks.yml` {{ end }} file.
+If changing the staging, prod, or test deployment targets, you'll also need to update the workflows located in the .gitlab/pipelines directory.
+
+The SP must have proper permission in each respective environment and the catalog for the environments.
+
+For the integration test and the ML training job, the SP must have permissions to read the input Delta table and create experiment and models. 
+i.e. for each environment:
+- USE_CATALOG
+- USE_SCHEMA
+- MODIFY
+- CREATE_MODEL
+- CREATE_TABLE
+
+For the batch inference job, the SP must have permissions to read input Delta table and modify the output Delta table. 
+i.e. for each environment
+- USAGE permissions for the catalog and schema of the input and output table.
+- SELECT permission for the input table.
+- MODIFY permission for the output table if it pre-dates your job.
+
+#### Gitlab Environment and secrets for CI/CD
+After creating the service principals and adding them to the respective staging and prod workspaces,
+you need to ad the client id and secret to Gitlab so that it can authenticate into Databricks for the execution of the integration tests and deployments.  
+First you need to setup the [Gitlab environments](https://docs.gitlab.com/ee/ci/environments/). Typically you setup the following environemnts:
+- integration
+- stage
+- production  
+  
+Add the following [Gitlab CI/CD variables](https://docs.gitlab.com/ee/ci/variables/) In each [environemt](https://docs.gitlab.com/ee/ci/environments/index.html#limit-the-environment-scope-of-a-cicd-variable),  with the corresponding service principal information:
+- SP_CLIENT_ID
+- SP_CLIENT_SECRET  
+   
+Ensure that the variable visibility is set to masked and hidden.
+
+### Building and Pushing the Docker image
+Gitlab exectues the pipeline on a VM initialized from a Docker image.
+The default Docker image is: [databricksfieldeng/mlopsstack:latest](https://hub.docker.com/repository/docker/databricksfieldeng/mlopsstack/general). 
+The Docker image should include all requirements to run the CI/CD pipelines (e.g. Databricks CLI, Python and its libraries used in the unit tests, Java for executing spark locally to the VM).
+The folder `.gitlab/docker/` includes the files to build the Docker image.  
+  
+You can execute the following script to locally build and push the Docker image into a registry on your local machine:  
+`{{.input_root_dir}}/.gitlab/docker/push_image_to_gitlab.sh`  
+Make sure that each pipeline yml file
+(in the folder `.gitlab/pipelines/`) points to that image.  
+NOTE: you can use the same image for multiple projects. 
+If a project requires additional Python libraries, they can also be installed as part of the pipelines scripts.
+
+### Setting up the CI/CD Pipeline
+Gitlab, by default, expects the pipeline file to be placed in the project root folder and to be named `.gitlab-ci.yml`. 
+Change the pipeline default [pipeline configuration file](https://docs.gitlab.com/ee/ci/pipelines/settings.html#specify-a-custom-cicd-configuration-file):  
+in the section `Settings > CI/CD > General Pipelines > CI/CD configuration file`, 
+add the value `.gitlab/pipelines/{{.input_project_name}}-triggers-cicd.yml` which is our project main pipeline file.
+
+{{ end }}
+
+{{- if (eq .input_setup_cicd_and_project `CICD_and_Project`)}}
+## Merge a PR with your initial ML code
+Create and push a PR branch adding the ML code to the repository.
+
+```
+git checkout -b add-ml-code
+git add .
+git commit -m "Add ML Code"
+git push upstream add-ml-code
+```
+
+Open a PR from the newly pushed branch. CI will run to ensure that tests pass
+on your initial ML code. Fix tests if needed, then get your PR reviewed and merged.
+After the pull request merges, pull the changes back into your local `{{ .input_default_branch }}`
+branch:
+
+```
+git checkout {{ .input_default_branch }}
+git pull upstream {{ .input_default_branch }}
+```
+{{- end }}
+
+{{ if not (eq .input_release_branch .input_default_branch) -}}
+## Create release branch
+Create and push a release branch called `{{ .input_release_branch }}` off of the `{{ .input_default_branch }}` branch of the repository:
+```
+git checkout -b {{ .input_release_branch }} {{ .input_default_branch }}
+git push upstream {{ .input_release_branch }}
+git checkout {{ .input_default_branch }}
+```
+
+Your production jobs (model training, batch inference) will pull ML code against this branch, while your staging jobs will pull ML code against the `{{ .input_default_branch }}` branch. Note that the `{{ .input_default_branch }}` branch will be the source of truth for ML resource configs and CI/CD workflows.
+
+For future ML code changes, iterate against the `{{ .input_default_branch }}` branch and regularly deploy your ML code from staging to production by merging code changes from the `{{ .input_default_branch }}` branch into the `{{ .input_release_branch }}` branch.
+{{ end -}}
+
+{{ if (eq .input_setup_cicd_and_project `CICD_and_Project`)}}
+## Deploy ML resources and enable production jobs
+Follow the instructions in [{{ .input_project_name }}/resources/README.md](../{{template `project_name_alphanumeric_underscore` .}}/resources/README.md) to deploy ML resources
+and production jobs.
+{{- end }}
+
+## Next steps
+After you configure CI/CD and deploy training & inference pipelines, notify data scientists working
+on the current project. They should now be able to follow the
+[ML pull request guide](ml-pull-request.md) and 
+{{ if (eq .input_setup_cicd_and_project `CICD_and_Project`)}}[ML resource config guide](../{{template `project_name_alphanumeric_underscore` .}}/resources/README.md){{- end }}  to propose, test, and deploy
+ML code and pipeline changes to production.
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/test-requirements.txt.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/test-requirements.txt.tmpl
new file mode 100644
index 00000000000..e160152b522
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/test-requirements.txt.tmpl
@@ -0,0 +1 @@
+pytest>=7.1.2
\ No newline at end of file
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/README.md.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/README.md.tmpl
new file mode 100644
index 00000000000..de0baae8a90
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/README.md.tmpl
@@ -0,0 +1,213 @@
+# {{ .input_project_name }}
+This project comes with example ML code to train, validate and deploy a regression model to predict NYC taxi fares.
+If you're a data scientist just getting started with this repo for a brand new ML project, we recommend 
+adapting the provided example code to your ML problem. Then making and 
+testing ML code changes on Databricks or your local machine.
+
+The "Getting Started" docs can be found at {{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "dev-tools/bundles/mlops-stacks.html")) }}.
+
+## Table of contents
+* [Code structure](#code-structure): structure of this project.
+{{ if (eq .input_include_feature_store `yes`) }}
+* [Configure your ML pipeline](#configure-your-ml-pipeline): making and testing ML code changes on Databricks or your local machine.
+{{ end }}
+* [Iterating on ML code](#iterating-on-ml-code): making and testing ML code changes on Databricks or your local machine.
+* [Next steps](#next-steps)
+
+This directory contains an ML project based on the default
+[Databricks MLOps Stacks](https://github.com/databricks/mlops-stacks),
+defining a production-grade ML pipeline for automated retraining and batch inference of an ML model on tabular data.
+
+## Code structure
+This project contains the following components:
+
+| Component                  | Description                                                                                                                                                                                                                                                                                                                                             |
+|----------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| ML Code                    | Example ML project code, with unit tested Python modules and notebooks                                                                                                                                                                                                                                                                                  |
+| ML Resources as Code | ML pipeline resources (training and batch inference jobs with schedules, etc) configured and deployed through [databricks CLI bundles]({{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "dev-tools/cli/bundle-cli.html")) }})                                                                                              |
+
+contained in the following files:
+
+```
+{{ .input_root_dir }}        <- Root directory. Both monorepo and polyrepo are supported.
+│
+├── {{template `project_name_alphanumeric_underscore` .}}       <- Contains python code, notebooks and ML resources related to one ML project. 
+│   │
+│   ├── requirements.txt        <- Specifies Python dependencies for ML code (for example: model training, batch inference).
+│   │
+│   ├── databricks.yml          <- databricks.yml is the root bundle file for the ML project that can be loaded by databricks CLI bundles. It defines the bundle name, workspace URL and resource config component to be included.
+│   │
+{{- if (eq .input_include_feature_store `no`) }}
+│   ├── training                <- Training folder contains Notebook that trains and registers the model.
+│   │
+│   ├── validation              <- Optional model validation step before deploying a model.
+│   │
+│   ├── monitoring              <- Model monitoring, feature monitoring, etc.
+│   │
+│   ├── deployment              <- Deployment and Batch inference workflows
+│   │   │
+│   │   ├── batch_inference     <- Batch inference code that will run as part of scheduled workflow.
+│   │   │
+│   │   ├── model_deployment    <- As part of CD workflow, deploy the registered model by assigning it the appropriate alias.
+│   │
+│   │
+│   ├── tests                   <- Unit tests for the ML project, including the modules under `features`.
+│   │
+│   ├── resources               <- ML resource (ML jobs, MLflow models) config definitions expressed as code, across dev/staging/prod/test.
+│       │
+│       ├── model-workflow-resource.yml                <- ML resource config definition for model training, validation, deployment workflow
+│       │
+│       ├── batch-inference-workflow-resource.yml      <- ML resource config definition for batch inference workflow
+│       │
+│       ├── ml-artifacts-resource.yml                  <- ML resource config definition for model and experiment
+│       │
+│       ├── monitoring-resource.yml           <- ML resource config definition for quality monitoring workflow
+{{- else if (eq .input_include_feature_store `yes`) }}
+│   ├── training                <- Training folder contains Notebook that trains and registers the model with feature store support.
+│   │
+│   ├── feature_engineering     <- Feature computation code (Python modules) that implements the feature transforms.
+│   │                              The output of these transforms get persisted as Feature Store tables. Most development
+│   │                              work happens here.
+│   │
+│   ├── validation              <- Optional model validation step before deploying a model.
+│   │
+│   ├── monitoring              <- Model monitoring, feature monitoring, etc.
+│   │
+│   ├── deployment              <- Deployment and Batch inference workflows
+│   │   │
+│   │   ├── batch_inference     <- Batch inference code that will run as part of scheduled workflow.
+│   │   │
+│   │   ├── model_deployment    <- As part of CD workflow, deploy the registered model by assigning it the appropriate alias.
+│   │
+│   │
+│   ├── tests                   <- Unit tests for the ML project, including the modules under `features`.
+│   │
+│   ├── resources               <- ML resource (ML jobs, MLflow models) config definitions expressed as code, across dev/staging/prod/test.
+│       │
+│       ├── model-workflow-resource.yml                <- ML resource config definition for model training, validation, deployment workflow
+│       │
+│       ├── batch-inference-workflow-resource.yml      <- ML resource config definition for batch inference workflow
+│       │
+│       ├── feature-engineering-workflow-resource.yml  <- ML resource config definition for feature engineering workflow
+│       │
+│       ├── ml-artifacts-resource.yml                  <- ML resource config definition for model and experiment
+│       │
+│       ├── monitoring-resource.yml           <- ML resource config definition for quality monitoring workflow
+{{- end }}
+```
+
+{{ if (eq .input_include_feature_store `yes`) }}
+## Configure your ML pipeline
+
+The sample ML code consists of the following:
+
+* Feature computation modules under `feature_engineering` folder. 
+These sample module contains features logic that can be used to generate and populate tables in Feature Store.
+In each module, there is `compute_features_fn` method that you need to implement. This should compute a features dataframe
+(each column being a separate feature), given the input dataframe, timestamp column and time-ranges. 
+The output dataframe will be persisted in a [time-series Feature Store table]({{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "machine-learning/feature-store/time-series.html")) }}).
+See the example modules' documentation for more information.
+* Python unit tests for feature computation modules in `tests/feature_engineering` folder.
+* Feature engineering notebook, `feature_engineering/GenerateAndWriteFeatures.py`, that reads input dataframes, dynamically loads feature computation modules, executes their `compute_features_fn` method and writes the outputs to a Feature Store table (creating it if missing).
+* Training notebook that [trains]({{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "machine-learning/feature-store/train-models-with-feature-store.html")) }} ) a regression model by creating a training dataset using the Feature Store client.
+* Model deployment and batch inference notebooks that deploy and use the trained model. 
+* An automated integration test is provided (in `.github/workflows/{{ .input_project_name }}-run-tests.yml`) that executes a multi task run on Databricks involving the feature engineering and model training notebooks.
+
+To adapt this sample code for your use case, implement your own feature module, specifying configs such as input Delta tables/dataset path(s) to use when developing
+the feature engineering pipelines.
+1. Implement your feature module, address TODOs in `feature_engineering/features` and create unit test in `tests/feature_engineering`
+2. Update `resources/feature-engineering-workflow-resource.yml`. Fill in notebook parameters for `write_feature_table_job`.
+3. Update training data path in `resources/model-workflow-resource.yml`.
+
+We expect most of the development to take place in the `feature_engineering` folder.
+
+{{ end }}
+## Iterating on ML code
+
+### Deploy ML code and resources to dev workspace using Bundles
+
+Refer to [Local development and dev workspace](./resources/README.md#local-development-and-dev-workspace)
+to use databricks CLI bundles to deploy ML code together with ML resource configs to dev workspace.
+
+This will allow you to develop locally and use databricks CLI bundles to deploy to your dev workspace to test out code and config changes.
+
+### Develop on Databricks using Databricks Git folders
+
+#### Prerequisites
+You'll need:
+* Access to run commands on a cluster running Databricks Runtime ML version 11.0 or above in your dev Databricks workspace
+* To set up [Databricks Git folders]({{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "repos/index.html")) }}): see instructions below
+
+#### Configuring Databricks Git folders
+To use Git folders, [set up git integration]({{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "repos/repos-setup.html")) }}) in your dev workspace.
+
+If the current project has already been pushed to a hosted Git repo, follow the
+[UI workflow]({{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "repos/git-operations-with-repos#add-a-repo-and-connect-remotely-later")) }})
+to clone it into your dev workspace and iterate. 
+
+Otherwise, e.g. if iterating on ML code for a new project, follow the steps below:
+* Follow the [UI workflow]({{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "repos/git-operations-with-repos#add-a-repo-and-connect-remotely-later")) }})
+  for creating a repo, but uncheck the "Create repo by cloning a Git repository" checkbox.
+* Install the `dbx` CLI via `pip install --upgrade dbx`
+* Run `databricks configure --profile {{ .input_project_name }}-dev --token --host <your-dev-workspace-url>`, passing the URL of your dev workspace.
+  This should prompt you to enter an API token
+* [Create a personal access token]({{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "dev-tools/auth/pat.html")) }})
+  in your dev workspace and paste it into the prompt from the previous step
+* From within the root directory of the current project, use the [dbx sync](https://dbx.readthedocs.io/en/latest/guides/python/devloop/mixed/#using-dbx-sync-repo-for-local-to-repo-synchronization) tool to copy code files from your local machine into the Repo by running
+  `dbx sync repo --profile {{ .input_project_name }}-dev --source . --dest-repo your-repo-name`, where `your-repo-name` should be the last segment of the full repo name (`/Repos/username/your-repo-name`)
+
+{{ if (eq .input_include_feature_store `yes`) }}
+### Develop locally
+
+You can iterate on the feature transform modules locally in your favorite IDE before running them on Databricks.  
+
+#### Running code on Databricks
+You can iterate on ML code by running the provided `feature_engineering/GenerateAndWriteFeatures.py` notebook on Databricks using
+[Git folders]({{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "repos/index.html")) }}). This notebook drives execution of
+the feature transforms code defined under ``features``. You can use multiple browser tabs to edit
+logic in `features` and run the feature engineering pipeline in the `GenerateAndWriteFeatures.py` notebook.
+
+#### Prerequisites
+* Python 3.8+
+* Install feature engineering code and test dependencies via `pip install -I -r requirements.txt` from project root directory.
+* The features transform code uses PySpark and brings up a local Spark instance for testing, so [Java (version 8 and later) is required](https://spark.apache.org/docs/latest/#downloading). 
+
+* Access to UC catalog and schema
+We expect a catalog to exist with the name of the deployment target by default.
+For example, if the deployment target is dev, we expect a catalog named dev to exist in the workspace.
+If you want to use different catalog names, please update the target names declared in the [databricks.yml](./databricks.yml) file.
+{{- if (eq .input_setup_cicd_and_project `CICD_and_Project`) }}
+If changing the staging, prod, or test deployment targets, you'll also need to update the workflows located in the .github/workflows directory.
+{{- end }}
+
+For the ML training job, you must have permissions to read the input Delta table and create experiment and models.
+i.e. for each environment:
+- USE_CATALOG
+- USE_SCHEMA
+- MODIFY
+- CREATE_MODEL
+- CREATE_TABLE
+
+For the batch inference job, you must have permissions to read input Delta table and modify the output Delta table.
+i.e. for each environment
+- USAGE permissions for the catalog and schema of the input and output table.
+- SELECT permission for the input table.
+- MODIFY permission for the output table if it pre-dates your job.
+
+#### Run unit tests
+You can run unit tests for your ML code via `pytest tests`.
+
+{{ end }}
+
+## Next Steps
+
+When you're satisfied with initial ML experimentation (e.g. validated that a model with reasonable performance can be trained on your dataset) and ready to deploy production training/inference pipelines, ask your ops team to set up CI/CD for the current ML project if they haven't already. CI/CD can be set up as part of the
+
+MLOps Stacks initialization even if it was skipped in this case, or this project can be added to a repo setup with CI/CD already, following the directions under "Setting up CI/CD" in the repo root directory README.
+
+To add CI/CD to this repo:
+ 1. Run `databricks bundle init mlops-stacks` via the Databricks CLI
+ 2. Select the option to only initialize `CICD_Only`
+ 3. Provide the root directory of this project and answer the subsequent prompts
+
+More details can be found on the homepage [MLOps Stacks README](https://github.com/databricks/mlops-stacks/blob/main/README.md).
diff --git a/acceptance/bundle/bundle_tag/url_ref/out.destroy-requests.direct.txt b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/__init__.py.tmpl
similarity index 100%
rename from acceptance/bundle/bundle_tag/url_ref/out.destroy-requests.direct.txt
rename to acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/__init__.py.tmpl
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/databricks.yml.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/databricks.yml.tmpl
new file mode 100644
index 00000000000..da265e6bcdd
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/databricks.yml.tmpl
@@ -0,0 +1,61 @@
+# The name of the bundle. run `databricks bundle schema` to see the full bundle settings schema.
+bundle:
+  # Do not modify the below line, this autogenerated field is used by the Databricks backend.
+  uuid: {{ bundle_uuid }}
+
+  name: {{ .input_project_name }}
+
+variables:
+  experiment_name:
+    description: Experiment name for the model training.
+    default: /Users/${workspace.current_user.userName}/${bundle.target}-{{template `experiment_base_name` .}}
+  model_name:
+    description: Model name for the model training.
+    default: {{template `model_name` .}}
+  catalog_name:
+    description: The catalog name to save the trained model
+
+include:
+  # Resources folder contains ML artifact resources for the ML project that defines model and experiment
+  # And workflows resources for the ML project including model training -> validation -> deployment,
+  # {{- if (eq .input_include_feature_store `yes`) }} feature engineering, {{ end }} batch inference, quality monitoring, metric refresh, alerts and triggering retraining
+  - ./resources/batch-inference-workflow-resource.yml
+  - ./resources/ml-artifacts-resource.yml
+  - ./resources/model-workflow-resource.yml
+  {{- if (eq .input_include_feature_store `yes`) }}
+  - ./resources/feature-engineering-workflow-resource.yml
+  {{- end }}
+  # TODO: uncomment once monitoring inference table has been created
+  # - ./resources/monitoring-resource.yml
+
+# Deployment Target specific values for workspace
+targets:
+  dev:  # UC Catalog Name
+    mode: development
+    default: true
+    variables:
+      catalog_name: dev
+    workspace:
+      # TODO: add dev workspace URL
+      host:
+
+{{- if (eq .input_setup_cicd_and_project `CICD_and_Project`)}}
+
+  staging:
+    variables:
+      catalog_name: {{ .input_staging_catalog_name }}
+    workspace:
+      host: {{template `databricks_staging_workspace_host` .}}
+
+  prod:
+    variables:
+      catalog_name: {{ .input_prod_catalog_name }}
+    workspace:
+      host: {{template `databricks_prod_workspace_host` .}}
+
+  test:
+    variables:
+      catalog_name: {{ .input_test_catalog_name }}
+    workspace:
+      host: {{template `databricks_staging_workspace_host` .}}
+{{ end }}
\ No newline at end of file
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/deployment/batch_inference/BatchInference.py.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/deployment/batch_inference/BatchInference.py.tmpl
new file mode 100644
index 00000000000..3a94480e422
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/deployment/batch_inference/BatchInference.py.tmpl
@@ -0,0 +1,69 @@
+# Databricks notebook source
+##################################################################################
+# Batch Inference Notebook
+#
+# This notebook is an example of applying a model for batch inference against an input delta table,
+# It is configured and can be executed as the batch_inference_job in the batch_inference_job workflow defined under
+# ``{{template `project_name_alphanumeric_underscore` .}}/resources/batch-inference-workflow-resource.yml``
+#
+# Parameters:
+#
+#  * env (optional)  - String name of the current environment (dev, staging, or prod). Defaults to "dev"
+#  * input_table_name (required)  - Delta table name containing your input data.
+#  * output_table_name (required) - Delta table name where the predictions will be written to.
+#                                   Note that this will create a new version of the Delta table if
+#                                   the table already exists
+#  * model_name (required) - The name of the model to be used in batch inference.
+##################################################################################
+
+
+# List of input args needed to run the notebook as a job.
+# Provide them via DB widgets or notebook arguments.
+#
+# Name of the current environment
+dbutils.widgets.dropdown("env", "dev", ["dev", "staging", "prod"], "Environment Name")
+# A Hive-registered Delta table containing the input features.
+dbutils.widgets.text("input_table_name", "", label="Input Table Name")
+# Delta table to store the output predictions.
+dbutils.widgets.text("output_table_name", "", label="Output Table Name")
+# Unity Catalog registered model name to use for the trained mode.
+dbutils.widgets.text(
+    "model_name", "dev.{{ .input_schema_name }}.{{template `model_name` .}}", label="Full (Three-Level) Model Name"
+)
+
+# COMMAND ----------
+
+# DBTITLE 1,Define input and output variables
+
+env = dbutils.widgets.get("env")
+input_table_name = dbutils.widgets.get("input_table_name")
+output_table_name = dbutils.widgets.get("output_table_name")
+model_name = dbutils.widgets.get("model_name")
+assert input_table_name != "", "input_table_name notebook parameter must be specified"
+assert output_table_name != "", "output_table_name notebook parameter must be specified"
+assert model_name != "", "model_name notebook parameter must be specified"
+alias = "champion"
+model_uri = f"models:/{model_name}@{alias}"
+
+# COMMAND ----------
+
+from mlflow import MlflowClient
+
+# Get model version from alias
+client = MlflowClient()
+model_version = client.get_model_version_by_alias(model_name, alias).version
+
+# COMMAND ----------
+
+# Get datetime
+from datetime import datetime
+
+ts = datetime.now().strftime("%Y-%m-%d %H:%M:%S")
+
+# COMMAND ----------
+# DBTITLE 1,Load model and run inference
+
+from predict import predict_batch
+
+predict_batch(spark, model_uri, input_table_name, output_table_name, model_version, ts)
+dbutils.notebook.exit(output_table_name)
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/deployment/batch_inference/README.md.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/deployment/batch_inference/README.md.tmpl
new file mode 100644
index 00000000000..2a86b6126b2
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/deployment/batch_inference/README.md.tmpl
@@ -0,0 +1,53 @@
+# Batch Inference
+To set up batch inference job via scheduled Databricks workflow, please refer to [{{template `project_name_alphanumeric_underscore` .}}/resources/README.md](../../resources/README.md)
+
+## Prepare the batch inference input table for the example Project
+Please run the following code in a notebook to generate the example batch inference input table.
+{{ if (eq .input_include_feature_store `yes`) }}
+```
+from pyspark.sql.functions import to_timestamp, lit
+from pyspark.sql.types import IntegerType
+import math
+from datetime import timedelta, timezone
+
+def rounded_unix_timestamp(dt, num_minutes=15):
+    """
+    Ceilings datetime dt to interval num_minutes, then returns the unix timestamp.
+    """
+    nsecs = dt.minute * 60 + dt.second + dt.microsecond * 1e-6
+    delta = math.ceil(nsecs / (60 * num_minutes)) * (60 * num_minutes) - nsecs
+    return int((dt + timedelta(seconds=delta)).replace(tzinfo=timezone.utc).timestamp())
+
+
+rounded_unix_timestamp_udf = udf(rounded_unix_timestamp, IntegerType())
+
+df = spark.table("delta.`dbfs:/databricks-datasets/nyctaxi-with-zipcodes/subsampled`")
+df.withColumn(
+    "rounded_pickup_datetime",
+    to_timestamp(rounded_unix_timestamp_udf(df["tpep_pickup_datetime"], lit(15))),
+).withColumn(
+    "rounded_dropoff_datetime",
+    to_timestamp(rounded_unix_timestamp_udf(df["tpep_dropoff_datetime"], lit(30))),
+).drop(
+    "tpep_pickup_datetime"
+).drop(
+    "tpep_dropoff_datetime"
+).drop(
+    "fare_amount"
+).write.mode(
+    "overwrite"
+).saveAsTable(
+    name="hive_metastore.default.taxi_scoring_sample_feature_store_inference_input"
+)
+```
+{{ else }}
+```
+df = spark.table(
+    "delta.`dbfs:/databricks-datasets/nyctaxi-with-zipcodes/subsampled`"
+).drop("fare_amount")
+
+df.write.mode("overwrite").saveAsTable(
+    name="<catalog>.{{ .input_schema_name }}.feature_store_inference_input"
+)
+```
+{{ end }}
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/deployment/batch_inference/predict.py.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/deployment/batch_inference/predict.py.tmpl
new file mode 100644
index 00000000000..641f8dfc8a1
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/deployment/batch_inference/predict.py.tmpl
@@ -0,0 +1,40 @@
+import mlflow
+from pyspark.sql.functions import struct, lit, to_timestamp
+
+
+def predict_batch(
+    spark_session, model_uri, input_table_name, output_table_name, model_version, ts
+):
+    """
+    Apply the model at the specified URI for batch inference on the table with name input_table_name,
+    writing results to the table with name output_table_name
+    """
+    table = spark_session.table(input_table_name)
+    {{ if (eq .input_include_feature_store `yes`) }}
+    from databricks.feature_engineering import FeatureEngineeringClient
+
+    fe_client = FeatureEngineeringClient()
+
+    prediction_df = fe_client.score_batch(model_uri=model_uri, df=table)
+    output_df = (
+        prediction_df.withColumn("prediction", prediction_df["prediction"])
+        .withColumn("model_id", lit(model_version))
+        .withColumn("timestamp", to_timestamp(lit(ts)))
+    )
+    {{ else }}
+    predict = mlflow.pyfunc.spark_udf(
+        spark_session, model_uri, result_type="double"
+    )
+
+    output_df = (
+        table.withColumn("prediction", predict(struct(*table.columns)))
+        .withColumn("model_id", lit(model_version))
+        .withColumn("timestamp", to_timestamp(lit(ts)))
+    )
+    {{ end -}}
+
+    output_df.display()
+
+    # Model predictions are written to the Delta table provided as input.
+    # Delta is the default format in Databricks Runtime 8.0 and above.
+    output_df.write.format("delta").mode("overwrite").saveAsTable(output_table_name)
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/deployment/model_deployment/ModelDeployment.py.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/deployment/model_deployment/ModelDeployment.py.tmpl
new file mode 100644
index 00000000000..951ba945f9f
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/deployment/model_deployment/ModelDeployment.py.tmpl
@@ -0,0 +1,43 @@
+# Databricks notebook source
+##################################################################################
+# Helper notebook to transition the model stage. This notebook is run
+# after the Train.py notebook as part of a multi-task job, in order to transition model
+# to target stage after training completes.
+#
+# Note that we deploy the model to the stage in MLflow Model Registry equivalent to the
+# environment in which the multi-task job is executed (e.g deploy the trained model to
+# stage=Production if triggered in the prod environment). In a practical setting, we would
+# recommend enabling the model validation step between  model training and automatically
+# registering the model to the Production stage in prod.
+#
+# This notebook has the following parameters:
+#
+#  * env (required)  - String name of the current environment for model deployment, which decides the target stage.
+#  * model_uri (required)  - URI of the model to deploy. Must be in the format "models:/<name>/<version-id>", as described in
+#                            https://www.mlflow.org/docs/latest/model-registry.html#fetching-an-mlflow-model-from-the-model-registry
+#                            This parameter is read as a task value
+#                            ({{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "dev-tools/databricks-utils.html")) }}),
+#                            rather than as a notebook widget. That is, we assume a preceding task (the Train.py
+#                            notebook) has set a task value with key "model_uri".
+##################################################################################
+
+# List of input args needed to run the notebook as a job.
+# Provide them via DB widgets or notebook arguments.
+#
+# Name of the current environment
+dbutils.widgets.dropdown("env", "None", ["None", "staging", "prod"], "Environment Name")
+
+# COMMAND ----------
+
+from deploy import deploy
+
+model_uri = dbutils.jobs.taskValues.get("Train", "model_uri", debugValue="")
+env = dbutils.widgets.get("env")
+assert env != "None", "env notebook parameter must be specified"
+assert model_uri != "", "model_uri notebook parameter must be specified"
+deploy(model_uri, env)
+
+# COMMAND ----------
+print(
+    f"Successfully completed model deployment for {model_uri}"
+)
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/deployment/model_deployment/deploy.py.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/deployment/model_deployment/deploy.py.tmpl
new file mode 100644
index 00000000000..56254638393
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/deployment/model_deployment/deploy.py.tmpl
@@ -0,0 +1,34 @@
+import sys
+from mlflow import MlflowClient
+
+def deploy(model_uri, env):
+    """Deploys an already-registered model in Unity catalog by assigning it the appropriate alias for model deployment.
+
+    :param model_uri: URI of the model to deploy. Must be in the format "models:/<name>/<version-id>", as described in
+                      https://www.mlflow.org/docs/latest/model-registry.html#fetching-an-mlflow-model-from-the-model-registry
+    :param env: name of the environment in which we're performing deployment, i.e one of "dev", "staging", "prod".
+                Defaults to "dev"
+    :return:
+    """
+    print(f"Deployment running in env: {env}")
+    _, model_name, version = model_uri.split("/")
+    client = MlflowClient()
+    mv = client.get_model_version(model_name, version)
+    target_alias = "champion"
+    if target_alias not in mv.aliases:
+        client.set_registered_model_alias(
+            name=model_name,
+            alias=target_alias,
+            version=version)
+        print(f"Assigned alias '{target_alias}' to model version {model_uri}.")
+
+        # remove "challenger" alias if assigning "champion" alias
+        if target_alias == "champion" and "challenger" in mv.aliases:
+            print(f"Removing 'challenger' alias from model version {model_uri}.")
+            client.delete_registered_model_alias(
+                name=model_name,
+                alias="challenger")
+
+
+if __name__ == "__main__":
+    deploy(model_uri=sys.argv[1], env=sys.argv[2])
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/monitoring/MonitoredMetricViolationCheck.py.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/monitoring/MonitoredMetricViolationCheck.py.tmpl
new file mode 100644
index 00000000000..7db01bf1433
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/monitoring/MonitoredMetricViolationCheck.py.tmpl
@@ -0,0 +1,61 @@
+# Databricks notebook source
+##################################################################################
+# This notebook runs a sql query and set the result as job task value
+#
+# This notebook has the following parameters:
+#
+#  * table_name_under_monitor (required)  - The name of a table that is currently being monitored
+#  * metric_to_monitor (required)  - Metric to be monitored for threshold violation
+#  * metric_violation_threshold (required)  - Threshold value for metric violation
+#  * num_evaluation_windows (required)  - Number of windows to check for violation
+#  * num_violation_windows (required)  - Number of windows that need to violate the threshold
+##################################################################################
+
+# List of input args needed to run the notebook as a job.
+# Provide them via DB widgets or notebook arguments.
+#
+# Name of the table that is currently being monitored
+dbutils.widgets.text(
+    "table_name_under_monitor", "{{ .input_inference_table_name }}", label="Full (three-Level) table name"
+)
+# Metric to be used for threshold violation check
+dbutils.widgets.text(
+    "metric_to_monitor", "root_mean_squared_error", label="Metric to be monitored for threshold violation"
+)
+
+# Threshold value to be checked
+dbutils.widgets.text(
+    "metric_violation_threshold", "100", label="Threshold value for metric violation"
+)
+
+# Threshold value to be checked
+dbutils.widgets.text(
+    "num_evaluation_windows", "5", label="Number of windows to check for violation"
+)
+
+# Threshold value to be checked
+dbutils.widgets.text(
+    "num_violation_windows", "2", label="Number of windows that need to violate the threshold"
+)
+
+# COMMAND ----------
+
+from metric_violation_check_query import sql_query
+
+table_name_under_monitor = dbutils.widgets.get("table_name_under_monitor")
+metric_to_monitor = dbutils.widgets.get("metric_to_monitor")
+metric_violation_threshold = dbutils.widgets.get("metric_violation_threshold")
+num_evaluation_windows = dbutils.widgets.get("num_evaluation_windows")
+num_violation_windows = dbutils.widgets.get("num_violation_windows")
+
+formatted_sql_query = sql_query.format(
+    table_name_under_monitor=table_name_under_monitor,
+    metric_to_monitor=metric_to_monitor,
+    metric_violation_threshold=metric_violation_threshold,
+    num_evaluation_windows=num_evaluation_windows,
+    num_violation_windows=num_violation_windows)
+is_metric_violated = bool(spark.sql(formatted_sql_query).toPandas()["query_result"][0])
+
+dbutils.jobs.taskValues.set("is_metric_violated", is_metric_violated)
+
+
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/monitoring/README.md.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/monitoring/README.md.tmpl
new file mode 100644
index 00000000000..55194d92051
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/monitoring/README.md.tmpl
@@ -0,0 +1,10 @@
+# Monitoring
+
+To enable monitoring as part of a scheduled Databricks workflow, please:
+- Create the inference table that you want to monitor and was passed in as an initialization parameter.
+- Update all the TODOs in the [monitoring resource file](../resources/monitoring-resource.yml).
+- Uncomment the monitoring workflow from the main Databricks Asset Bundles file [databricks.yml](../databricks.yml).
+
+For more details, refer to [{{template `project_name_alphanumeric_underscore` .}}/resources/README.md](../resources/README.md). 
+The implementation supports monitoring of batch inference tables directly.
+For real time inference tables, unpacking is required before monitoring can be attached.
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/monitoring/metric_violation_check_query.py.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/monitoring/metric_violation_check_query.py.tmpl
new file mode 100644
index 00000000000..7be5eb295d5
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/monitoring/metric_violation_check_query.py.tmpl
@@ -0,0 +1,79 @@
+# This file is used for the main SQL query that checks the last {num_evaluation_windows} metric violations and whether at least {num_violation_windows} of those runs violate the condition.
+
+"""The SQL query is divided into three main parts. The first part selects the top {num_evaluation_windows}
+values of the metric to be monitored, ordered by the time window, and saves as recent_metrics.
+```sql
+WITH recent_metrics AS (
+  SELECT
+    {metric_to_monitor},
+    window
+  FROM
+    {table_name_under_monitor}_profile_metrics
+  WHERE
+    column_name = ":table"
+    AND slice_key IS NULL
+    AND model_id != "*"
+    AND log_type = "INPUT"
+  ORDER BY
+    window DESC
+  LIMIT
+    {num_evaluation_windows}
+)
+```
+The `column_name = ":table"` and `slice_key IS NULL` conditions ensure that the metric
+is selected for the entire table within the given granularity. The `log_type = "INPUT"`
+condition ensures that the primary table metrics are considered, but not the baseline
+table metrics. The `model_id!= "*"` condition ensures that the metric aggregated across
+all model IDs is not selected.
+
+The second part of the query determines if the metric values have been violated with two cases. 
+The first case checks if the metric value is greater than the threshold for at least {num_violation_windows} windows:
+```sql
+(SELECT COUNT(*) FROM recent_metrics WHERE {metric_to_monitor} > {metric_violation_threshold}) >= {num_violation_windows}
+```
+The second case checks if the most recent metric value is greater than the threshold. This is to make sure we only trigger retraining
+if the most recent window was violated, avoiding unnecessary retraining if the violation was in the past and the metric is now within the threshold:
+```sql
+(SELECT {metric_to_monitor} FROM recent_metrics ORDER BY window DESC LIMIT 1) > {metric_violation_threshold}
+```
+
+The final part of the query sets the `query_result` to 1 if both of the above conditions are met, and 0 otherwise:
+```sql
+SELECT
+  CASE
+    WHEN
+      # Check if the metric value is greater than the threshold for at least {num_violation_windows} windows
+      AND
+      # Check if the most recent metric value is greater than the threshold
+    THEN 1
+    ELSE 0
+  END AS query_result
+```
+"""
+
+sql_query = """WITH recent_metrics AS (
+  SELECT
+    {metric_to_monitor},
+    window
+  FROM
+    {table_name_under_monitor}_profile_metrics
+  WHERE
+    column_name = ":table"
+    AND slice_key IS NULL
+    AND model_id != "*"
+    AND log_type = "INPUT"
+  ORDER BY
+    window DESC
+  LIMIT
+    {num_evaluation_windows}
+)
+SELECT
+  CASE
+    WHEN
+      (SELECT COUNT(*) FROM recent_metrics WHERE {metric_to_monitor} > {metric_violation_threshold}) >= {num_violation_windows}
+      AND
+      (SELECT {metric_to_monitor} FROM recent_metrics ORDER BY window DESC LIMIT 1) > {metric_violation_threshold}
+    THEN 1
+    ELSE 0
+  END AS query_result
+"""
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/project_params.json.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/project_params.json.tmpl
new file mode 100644
index 00000000000..7273af903ba
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/project_params.json.tmpl
@@ -0,0 +1,4 @@
+{
+  "input_cloud": "{{ .input_cloud }}",
+  "input_include_feature_store": "{{ .input_include_feature_store }}"
+}
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/pytest.ini.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/pytest.ini.tmpl
new file mode 100644
index 00000000000..04680e74955
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/pytest.ini.tmpl
@@ -0,0 +1,4 @@
+# Configure pytest to detect local modules in the current directory
+# See https://docs.pytest.org/en/7.1.x/reference/reference.html#confval-pythonpath for details
+[pytest]
+pythonpath = .
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/requirements.txt.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/requirements.txt.tmpl
new file mode 100644
index 00000000000..c9329d48c5c
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/requirements.txt.tmpl
@@ -0,0 +1,7 @@
+mlflow>=3.1
+lightgbm
+numpy
+pandas
+scikit-learn>=1.1.1
+matplotlib>=3.5.2
+pillow>=10.0.1
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/resources/README.md.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/resources/README.md.tmpl
new file mode 100644
index 00000000000..0e9f4618554
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/resources/README.md.tmpl
@@ -0,0 +1,315 @@
+# Databricks ML Resource Configurations
+[(back to project README)](../README.md)
+
+## Table of contents
+* [Intro](#intro)
+* [Local development and dev workspace](#local-development-and-dev-workspace)
+* [Develop and test config changes](#develop-and-test-config-changes)
+{{- if (eq .input_setup_cicd_and_project `CICD_and_Project`) }}
+* [CI/CD](#set-up-cicd)
+* [Deploy initial ML resources](#deploy-initial-ml-resources)
+* [Deploy config changes](#deploy-config-changes)
+{{- end }}
+
+## Intro
+
+### databricks CLI bundles
+MLOps Stacks ML resources are configured and deployed through [databricks CLI bundles]({{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "dev-tools/cli/bundle-cli.html")) }}).
+The bundle setting file must be expressed in YAML format and must contain at minimum the top-level bundle mapping.
+
+The databricks CLI bundles top level is defined by file `{{template `project_name_alphanumeric_underscore` .}}/databricks.yml`.
+During databricks CLI bundles deployment, the root config file will be loaded, validated and deployed to workspace provided by the environment together with all the included resources.
+
+ML Resource Configurations in this directory:
+ - model workflow (`{{template `project_name_alphanumeric_underscore` .}}/resources/model-workflow-resource.yml`)
+ - batch inference workflow (`{{template `project_name_alphanumeric_underscore` .}}/resources/batch-inference-workflow-resource.yml`)
+ - monitoring resource and workflow (`{{template `project_name_alphanumeric_underscore` .}}/resources/monitoring-resource.yml`)
+ - feature engineering workflow (`{{template `project_name_alphanumeric_underscore` .}}/resources/feature-engineering-workflow-resource.yml`)
+ - model definition and experiment definition (`{{template `project_name_alphanumeric_underscore` .}}/resources/ml-artifacts-resource.yml`)
+
+
+### Deployment Config & CI/CD integration
+The ML resources can be deployed to databricks workspace based on the databricks CLI bundles deployment config.
+Deployment configs of different deployment targets share the general ML resource configurations with added ability to specify deployment target specific values (workspace URI, model name, jobs notebook parameters, etc).
+
+{{- if (eq .input_setup_cicd_and_project `Project_Only`) }}
+
+NOTE: This project was not setup with CI/CD workflows. You can setup CI/CD with a new initialization of MLOps Stacks. The rest of this section only applies if you are using a monorepo setup with CI/CD previously or have setup CI/CD otherwise.
+{{- else }}
+This project ships with CI/CD workflows for developing and deploying ML resource configurations based on deployment config.
+{{- end }}
+
+
+For Model Registry in Unity Catalog, we expect a catalog to exist with the name of the deployment target by default. For example, if the deployment target is `dev`, we expect a catalog named `dev` to exist in the workspace.
+If you want to use different catalog names, please update the `targets` declared in the `{{template `project_name_alphanumeric_underscore` .}}/databricks.yml` and `{{template `project_name_alphanumeric_underscore` .}}/resources/ml-artifacts-resource.yml` files.
+If changing the `staging`, `prod`, or `test` deployment targets, you'll need to update the
+{{- if (eq .input_setup_cicd_and_project `Project_Only`) }} workflows located in the root directory if in a monorepo setup with CI/CD. Otherwise you can setup CI/CD with a new initialization of MLOps Stacks.
+{{- else if or (eq .input_cicd_platform `github_actions`) (eq .input_cicd_platform `github_actions_for_github_enterprise_servers`) }} workflows located in the `.github/workflows` directory.
+{{- else if (eq .input_cicd_platform `azure_devops`) }}  pipelines located in the `azure-pipelines` directory.
+{{- else if (eq .input_cicd_platform `gitlab`) }}  pipelines located in the `gitlab` directory.{{- end }}
+
+
+| Deployment Target | Description                                                                                                                                                                                                                           | Databricks Workspace | Model Name                          | Experiment Name                                |
+|-------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------|-------------------------------------|------------------------------------------------|
+| dev         | The `dev` deployment target is used by ML engineers to deploy ML resources to development workspace with `dev` configs. The config is for ML project development purposes.                                                           | dev workspace        | dev-{{template `model_name` .}}     | /dev-{{template `experiment_base_name` .}}     |
+| staging     | The `staging` deployment target is part of the CD pipeline. Latest {{ .input_default_branch }} content will be deployed to staging workspace with `staging` config.                                                             | staging workspace    | staging-{{template `model_name` .}} | /staging-{{template `experiment_base_name` .}} |
+| prod        | The `prod` deployment target is part of the CD pipeline. Latest {{ .input_release_branch }} content will be deployed to prod workspace with `prod` config.                                                                      | prod workspace       | prod-{{template `model_name` .}}    | /prod-{{template `experiment_base_name` .}}    |
+| test        | The `test` deployment target is part of the CI pipeline. For changes targeting the {{ .input_default_branch }} branch, upon making a PR, an integration test will be triggered and ML resources deployed to the staging workspace defined under `test` deployment target. | staging workspace    | test-{{template `model_name` .}}    | /test-{{template `experiment_base_name` .}}    |
+
+During ML code development, you can deploy local ML resource configurations together with ML code to the a Databricks workspace to run the training, model validation or batch inference pipelines. The deployment will use `dev` config by default.
+
+You can open a PR (pull request) to modify ML code or the resource config against {{ .input_default_branch }} branch.
+The PR will trigger Python unit tests, followed by an integration test executed on the staging workspace, as defined under the `test` environment resource. 
+
+Upon merging a PR to the {{ .input_default_branch }} branch, the {{ .input_default_branch }} branch content will be deployed to the staging workspace with `staging` environment resource configurations.
+
+Upon merging code into the release branch, the release branch content will be deployed to prod workspace with `prod` environment resource configurations.
+
+
+{{- if (eq .input_setup_cicd_and_project `CICD_and_Project`) }}
+![ML resource config diagram](../../docs/images/mlops-stack-deploy.png)
+{{- end }}
+
+## Local development and dev workspace
+
+### Set up authentication
+
+To set up the databricks CLI using a Databricks personal access token, take the following steps:
+
+1. Follow [databricks CLI]({{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "dev-tools/cli/databricks-cli.html")) }}) to download and set up the databricks CLI locally.
+2. Complete the `TODO` in `{{template `project_name_alphanumeric_underscore` .}}/databricks.yml` to add the dev workspace URI under `targets.dev.workspace.host`.
+3. [Create a personal access token]({{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "dev-tools/auth/pat.html")) }})
+  in your dev workspace and copy it.
+4. Set an env variable `DATABRICKS_TOKEN` with your Databricks personal access token in your terminal. For example, run `export DATABRICKS_TOKEN=dapi12345` if the access token is dapi12345.
+5. You can now use the databricks CLI to validate and deploy ML resource configurations to the dev workspace.
+
+Alternatively, you can use the other approaches described in the [databricks CLI]({{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "dev-tools/cli/databricks-cli.html")) }}) documentation to set up authentication. For example, using your Databricks username/password, or seting up a local profile.
+
+### Validate and provision ML resource configurations
+1. After installing the databricks CLI and creating the `DATABRICKS_TOKEN` env variable, change to the `{{template `project_name_alphanumeric_underscore` .}}` directory.
+2. Run `databricks bundle validate` to validate the Databricks resource configurations. 
+3. Run `databricks bundle deploy` to provision the Databricks resource configurations to the dev workspace. The resource configurations and your ML code will be copied together to the dev workspace. The defined resources such as Lakeflow Jobs, MLflow Model and MLflow Experiment will be provisioned according to the config files under `{{template `project_name_alphanumeric_underscore` .}}/resources`.
+4. Go to the Databricks dev workspace, check the defined model, experiment and workflows status, and interact with the created workflows.
+
+### Destroy ML resource configurations
+After development is done, you can run `databricks bundle destroy` to destroy (remove) the defined Databricks resources in the dev workspace. Any model version with `Production` or `Staging` stage will prevent the model from being deleted. Please update the version stage to `None` or `Archived` before destroying the ML resources.
+
+{{- if (eq .input_setup_cicd_and_project `CICD_and_Project`) }}
+## Set up CI/CD
+Please refer to [mlops-setup](../../docs/mlops-setup.md#configure-cicd) for instructions to set up CI/CD.
+
+## Deploy initial ML resources
+After completing the prerequisites, create and push a PR branch adding all files to the Git repo:
+```
+git checkout -b add-ml-resource-config-and-code
+git add .
+git commit -m "Add ML resource config and ML code"
+git push upstream add-ml-resource-config-and-code
+```
+Open a pull request to merge the pushed branch into the `{{ .input_default_branch }}` branch.
+Upon creating this PR, the CI workflows will be triggered.
+These CI workflow will run unit and integration tests of the ML code, 
+in addition to validating the Databricks resources to be deployed to both staging and prod workspaces.
+Once CI passes, merge the PR into the `{{ .input_default_branch }}` branch. This will deploy an initial set of Databricks resources to the staging workspace.
+resources will be deployed to the prod workspace on pushing code to the `{{ .input_release_branch }}` branch.
+
+Follow the next section to configure the input and output data tables for the batch inference job.
+{{- end }}
+
+### Setting up the batch inference job
+The batch inference job expects an input Delta table with a schema that your registered model accepts (out-of-the-box we provide a working example using the `nyctaxi` dataset with the schema [trip_distance, pickup_zip and dropoff_zip]). To use the batch
+inference job, set up such a Delta table in both your staging and prod workspaces. For example, with the `nyctaxi` dataset, the following code can be run in a Databricks notebook to create the batch inference input table:
+```
+# To test the batch job the training data can be used as input
+
+input_table_path = "/databricks-datasets/nyctaxi-with-zipcodes/subsampled"
+training_df = spark.read.format("delta").load(input_table_path)
+
+# drop unused columns
+df = df.drop("tpep_pickup_datetime", "tpep_dropoff_datetime")
+
+# target column used for monitoring, not for predictions
+df = df.withColumnRenamed('fare_amount', 'price')
+
+spark.sql("CREATE DATABASE IF NOT EXISTS my_catalog.my_schema")
+
+def write_to_table(df, database, table):
+  (df.write
+   .format("delta")
+   .mode("overwrite")
+   .option("overwriteSchema", "true")
+   .saveAsTable(f"{database}.{table}"))
+
+# Write the DataFrame to a Delta table
+write_to_table(training_df, database="my_catalog.my_schema", table="batch_input_table")
+```
+Following this, update the batch_inference_job base parameters in `{{template `project_name_alphanumeric_underscore` .}}/resources/batch-inference-workflow-resource.yml` to pass
+the name of the input Delta table and the name of the output Delta table to which to write batch predictions.
+
+As the batch job will be run with the credentials of the service principal that provisioned it, make sure that the service
+principal corresponding to a particular environment has permissions to read the input Delta table and modify the output Delta table in that environment's workspace. If the Delta table is in the [Unity Catalog](https://www.databricks.com/product/unity-catalog), these permissions are
+
+* `USAGE` permissions for the catalog and schema of the input and output table.
+* `SELECT` permission for the input table.
+* `MODIFY` permission for the output table if it pre-dates your job.
+
+### Setting up model validation
+The model validation workflow focuses on building a plug-and-play stack component for continuous deployment (CD) of models 
+in staging and prod.
+Its central purpose is to evaluate a registered model and validate its quality before deploying the model to Production/Staging.
+
+Model validation contains three components: 
+* [model-workflow-resource.yml](./model-workflow-resource.yml) contains the resource config and input parameters for model validation.
+* [validation.py](../validation/validation.py) defines custom metrics and validation thresholds that are referenced by the above resource config files.
+* [ModelValidation](../validation/ModelValidation.py) contains the validation job implementation. In most cases you don't need to modify this file.
+
+To set up and enable model validation, update [validation.py](../validation/validation.py) to return desired custom metrics and validation thresholds, then 
+resolve the `TODOs` in the ModelValidation task of [model-workflow-resource.yml](./model-workflow-resource.yml).
+
+
+### Setting up monitoring
+The monitoring workflow focuses on building a plug-and-play stack component for monitoring the feature drifts and model drifts and retrain based on the
+violation threshold defined given the ground truth labels.
+
+Its central purpose is to track production model performances, feature distributions and comparing different versions.
+
+Monitoring contains four components:
+* [metric_violation_check_query.py](../monitoring/metric_violation_check_query.py) defines a query that checks for violation of the monitored metric.
+* [MonitoredMetricViolationCheck](../monitoring/MonitoredMetricViolationCheck.py) acts as an entry point, executing the violation check query against the monitored inference table.
+It emits a boolean value based on the query result.
+* [monitoring-resource.yml](./monitoring-resource.yml) contains the resource config, inputs parameters for monitoring, and orchestrates model retraining based on monitoring. It first runs the [MonitoredMetricViolationCheck](../monitoring/MonitoredMetricViolationCheck.py)
+entry point then decides whether to execute the model retraining workflow.
+
+To set up and enable monitoring:
+* If it is not done already, generate inference table, join it with ground truth labels, and update the table name in [monitoring-resource.yml](./monitoring-resource.yml).
+* Resolve the `TODOs`  in [monitoring-resource.yml](./monitoring-resource.yml)
+* Uncomment the monitoring workflow in [databricks.yml](../databricks.yml)
+* OPTIONAL: Update the query in [metric_violation_check_query.py](../monitoring/metric_violation_check_query.py) to customize when the metric is considered to be in violation.
+
+NOTE: If ground truth labels are not available, you can still set up monitoring but should disable the retraining workflow.
+
+Retraining Constraints:
+The retraining job has constraints for optimal functioning:
+* Labels must be provided by the user, joined correctly for retraining history, and available on time with the retraining frequency.
+* Retraining Frequency is tightly coupled with the granularity of the monitor. Users should take into account and ensure that their retraining frequency is equal to or close to the granularity of the monitor.
+    * If the granularity of the monitor is 1 day and retraining frequency is 1 hour, the job will preemptively stop as there is no new data to evaluate retraining criteria
+    * If the granularity of the monitor is 1 day and retraining frequency is 1 week, retraining would be stale and not be efficient
+
+Permissions:
+Permissions for monitoring are inherited from the original table's permissions.
+* Users who own the monitored table or its parent catalog/schema can create, update, and view monitors.
+* Users with read permissions on the monitored table can view its monitor.
+
+Therefore, ensure that service principals are the owners or have the necessary permissions to manage the monitored table.
+
+## Develop and test config changes
+
+### databricks CLI bundles schema overview
+To get started, open `{{template `project_name_alphanumeric_underscore` .}}/resources/batch-inference-workflow-resource.yml`.  The file contains the ML resource definition of a batch inference job, like:
+
+```$xslt
+resources:
+  jobs:
+    batch_inference_job:
+      name: ${bundle.target}-{{ .input_project_name }}-batch-inference-job
+      tasks:
+        - task_key: batch_inference_job
+          environment_key: default
+          notebook_task:
+            notebook_path: ../deployment/batch_inference/BatchInference.py
+            base_parameters:
+              env: ${bundle.target}
+              input_table_name: batch_inference_input_table_name
+              ...
+
+      environments:
+        - environment_key: default
+          spec:
+            environment_version: "5"
+            dependencies:
+              - -r ../requirements.txt
+```
+
+The example above defines a Databricks job with name `${bundle.target}-{{ .input_project_name }}-batch-inference-job`
+that runs the notebook under `{{template `project_name_alphanumeric_underscore` .}}/deployment/batch_inference/BatchInference.py` to regularly apply your ML model for batch inference.
+
+Jobs run on [serverless compute]({{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "jobs/run-serverless-jobs.html")) }}) by default: the task references a serverless environment by its `environment_key` (`default` here), and that key is defined once under `environments`, with its own dependencies installed from `requirements.txt`. Multiple tasks in the same job can share the same `environment_key` to reuse one environment definition.
+
+We specify a `batch_inference_job` under `resources/jobs` to define a databricks workflow with internal key `batch_inference_job` and job name `{bundle.target}-{{ .input_project_name }}-batch-inference-job`.
+The workflow contains a single task with task key `batch_inference_job`. The task runs notebook `../deployment/batch_inference/BatchInference.py` with provided parameters `env` and `input_table_name` passing to the notebook.
+After setting up databricks CLI, you can run command `databricks bundle schema`  to learn more about databricks CLI bundles schema.
+
+The notebook_path is the relative path starting from the resource yaml file.
+
+### Environment config based variables
+The `${bundle.target}` will be replaced by the environment config name during the bundle deployment. For example, during the deployment of a `test` environment config, the job name will be
+`test-{{ .input_project_name }}-batch-inference-job`. During the deployment of the `staging` environment config, the job name will be
+`staging-{{ .input_project_name }}-batch-inference-job`.
+
+
+To use different values based on different environment, you can use bundle variables based on the given target, for example,
+```$xslt
+variables:
+  batch_inference_input_table: 
+    description: The table name to be used for input to the batch inference workflow.
+    default: input_table
+
+targets:
+  dev:
+    variables:
+      batch_inference_input_table: dev_table
+  test:
+    variables:
+      batch_inference_input_table: test_table
+
+resources:
+  jobs:
+    batch_inference_job:
+      name: ${bundle.target}-{{ .input_project_name }}-batch-inference-job
+      tasks:
+        - task_key: batch_inference_job
+          environment_key: default
+          notebook_task:
+            notebook_path: ../deployment/batch_inference/BatchInference.py
+            base_parameters:
+              env: ${bundle.target}
+              input_table_name: ${var.batch_inference_input_table}
+              ...
+
+      environments:
+        - environment_key: default
+          spec:
+            environment_version: "5"
+            dependencies:
+              - -r ../requirements.txt
+```
+The `batch_inference_job` notebook parameter `input_table_name` is using a bundle variable `batch_inference_input_table` with default value "input_table".
+The variable value will be overwritten with "dev_table" for `dev` environment config and "test_table" for `test` environment config:
+- during deployment with the `dev` environment config, the `input_table_name` parameter will get the value "dev_table"
+- during deployment with the `staging` environment config, the `input_table_name` parameter will get the value "input_table"
+- during deployment with the `prod` environment config, the `input_table_name` parameter will get the value "input_table"
+- during deployment with the `test` environment config, the `input_table_name` parameter will get the value "test_table"
+
+### Test config changes
+To test out a config change, simply edit one of the fields above. For example, increase the cluster size by updating `num_workers` from 3 to 4. 
+
+Then follow [Local development and dev workspace](#local-development-and-dev-workspace) to deploy the change to the dev workspace.
+Alternatively you can open a PR. Continuous integration will then validate the updated config and deploy tests to the to staging workspace.
+
+{{- if (eq .input_setup_cicd_and_project `CICD_and_Project`) }}
+## Deploy config changes
+
+### Dev workspace deployment
+Please refer to [Local development and dev workspace](#local-development-and-dev-workspace).
+
+### Test workspace deployment(CI)
+After setting up CI/CD, PRs against the {{ .input_default_branch }} branch will trigger CI workflows to run unit tests, integration test and resource validation.
+The integration test will deploy MLflow model, MLflow experiment and Databricks workflow resources defined under the `test` environment resource config to the staging workspace. The integration test then triggers a run of the model workflow to verify the ML code. 
+
+### Staging and Prod workspace deployment(CD)
+After merging a PR to the {{ .input_default_branch }} branch, continuous deployment automation will deploy the `staging` resources to the staging workspace.
+
+When you about to cut a release, you can create and merge a PR to merge changes from {{ .input_default_branch }} to {{ .input_release_branch }}. Continuous deployment automation will deploy `prod` resources to the prod workspace.
+{{- end }}
+
+[Back to project README](../README.md)
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/resources/batch-inference-workflow-resource.yml.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/resources/batch-inference-workflow-resource.yml.tmpl
new file mode 100644
index 00000000000..dd2020c6faa
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/resources/batch-inference-workflow-resource.yml.tmpl
@@ -0,0 +1,40 @@
+common_permissions: &permissions
+  permissions:
+    - level: CAN_VIEW
+      group_name: users
+
+resources:
+  jobs:
+    batch_inference_job:
+      name: ${bundle.target}-{{ .input_project_name }}-batch-inference-job
+      tasks:
+        - task_key: batch_inference_job
+          environment_key: default
+          notebook_task:
+            notebook_path: ../deployment/batch_inference/BatchInference.py
+            base_parameters:
+              env: ${bundle.target}
+              {{ if (eq .input_include_feature_store `yes`) }}input_table_name: ${bundle.target}.{{ .input_schema_name }}.feature_store_inference_input  # TODO: create input table for inference
+              {{- else -}}input_table_name: taxi_scoring_sample  # TODO: create input table for inference{{ end }}
+              output_table_name: ${var.catalog_name}.{{ .input_schema_name }}.predictions
+              model_name: ${var.catalog_name}.{{ .input_schema_name }}.${var.model_name}
+              # git source information of current ML resource deployment. It will be persisted as part of the workflow run
+              git_source_info: url:${bundle.git.origin_url}; branch:${bundle.git.branch}; commit:${bundle.git.commit}
+
+      environments:
+        - environment_key: default
+          spec:
+            environment_version: "5"
+            dependencies:
+              - -r ../requirements.txt
+      schedule:
+        quartz_cron_expression: "0 0 11 * * ?" # daily at 11am
+        timezone_id: UTC
+      <<: *permissions
+      # If you want to turn on notifications for this job, please uncomment the below code,
+      # and provide a list of emails to the on_failure argument.
+      #
+      #  email_notifications:
+      #    on_failure:
+      #      - first@company.com
+      #      - second@company.com
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/resources/ml-artifacts-resource.yml.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/resources/ml-artifacts-resource.yml.tmpl
new file mode 100644
index 00000000000..683bcd8fd2c
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/resources/ml-artifacts-resource.yml.tmpl
@@ -0,0 +1,28 @@
+# Allow users to read the experiment
+common_permissions: &permissions
+  permissions:
+    - level: CAN_READ
+      group_name: users
+
+# Allow users to execute models in Unity Catalog
+grants: &grants
+  grants:
+    - privileges:
+        - EXECUTE
+      principal: {{ .input_unity_catalog_read_user_group }}
+
+# Defines model and experiments
+resources:
+  registered_models:
+    model:
+      name: ${var.model_name}
+      catalog_name: ${var.catalog_name}
+      schema_name: {{ .input_schema_name }}
+      comment: Registered model in Unity Catalog for the "{{ .input_project_name }}" ML Project for ${bundle.target} deployment target.
+      <<: *grants
+
+  experiments:
+    experiment:
+      name: ${var.experiment_name}
+      <<: *permissions
+      description: MLflow Experiment used to track runs for {{ .input_project_name }} project.
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/resources/model-workflow-resource.yml.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/resources/model-workflow-resource.yml.tmpl
new file mode 100644
index 00000000000..35c4582bd6c
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/resources/model-workflow-resource.yml.tmpl
@@ -0,0 +1,96 @@
+common_permissions: &permissions
+  permissions:
+    - level: CAN_VIEW
+      group_name: users
+
+resources:
+  jobs:
+    model_training_job:
+      name: ${bundle.target}-{{ .input_project_name }}-model-training-job
+      tasks:
+        - task_key: Train
+          environment_key: default
+          {{ if (eq .input_include_feature_store `no`) }}notebook_task:
+            notebook_path: ../training/Train.py
+            base_parameters:
+              env: ${bundle.target}
+              # TODO: Update training_data_path
+              training_data_path: /databricks-datasets/nyctaxi-with-zipcodes/subsampled
+              experiment_name: ${var.experiment_name}
+              model_name: ${var.catalog_name}.{{ .input_schema_name }}.${var.model_name}
+              # git source information of current ML resource deployment. It will be persisted as part of the workflow run
+              git_source_info: url:${bundle.git.origin_url}; branch:${bundle.git.branch}; commit:${bundle.git.commit}
+          {{ else if (eq .input_include_feature_store `yes`) }}notebook_task:
+            notebook_path: ../training/TrainWithFeatureStore.py
+            base_parameters:
+              env: ${bundle.target}
+              # TODO: Update training_data_path
+              training_data_path: /databricks-datasets/nyctaxi-with-zipcodes/subsampled
+              experiment_name: ${var.experiment_name}
+              model_name: ${var.catalog_name}.{{ .input_schema_name }}.${var.model_name}
+              pickup_features_table: ${var.catalog_name}.{{ .input_schema_name }}.trip_pickup_features
+              dropoff_features_table: ${var.catalog_name}.{{ .input_schema_name }}.trip_dropoff_features
+              # git source information of current ML resource deployment. It will be persisted as part of the workflow run
+              git_source_info: url:${bundle.git.origin_url}; branch:${bundle.git.branch}; commit:${bundle.git.commit}
+          {{ end }}
+        - task_key: ModelValidation
+          environment_key: default
+          depends_on:
+            - task_key: Train
+          notebook_task:
+            notebook_path: ../validation/ModelValidation.py
+            base_parameters:
+              experiment_name: ${var.experiment_name}
+              # The `run_mode` defines whether model validation is enabled or not.
+              # It can be one of the three values:
+              # `disabled` : Do not run the model validation notebook.
+              # `dry_run`  : Run the model validation notebook. Ignore failed model validation rules and proceed to move
+              #               model to Production stage.
+              # `enabled`  : Run the model validation notebook. Move model to Production stage only if all model validation
+              #               rules are passing.
+              # TODO: update run_mode
+              run_mode: dry_run
+              # Whether to load the current registered "Production" stage model as baseline.
+              # Baseline model is a requirement for relative change and absolute change validation thresholds.
+              # TODO: update enable_baseline_comparison
+              enable_baseline_comparison: "false"
+              # Please refer to data parameter in mlflow.evaluate documentation https://mlflow.org/docs/latest/python_api/mlflow.html#mlflow.evaluate
+              # TODO: update validation_input
+              validation_input: SELECT * FROM delta.`dbfs:/databricks-datasets/nyctaxi-with-zipcodes/subsampled`
+              # A string describing the model type. The model type can be either "regressor" and "classifier".
+              # Please refer to model_type parameter in mlflow.evaluate documentation https://mlflow.org/docs/latest/python_api/mlflow.html#mlflow.evaluate
+              # TODO: update model_type
+              model_type: regressor
+              # The string name of a column from data that contains evaluation labels.
+              # Please refer to targets parameter in mlflow.evaluate documentation https://mlflow.org/docs/latest/python_api/mlflow.html#mlflow.evaluate
+              # TODO: targets
+              targets: fare_amount
+              # git source information of current ML resource deployment. It will be persisted as part of the workflow run
+              git_source_info: url:${bundle.git.origin_url}; branch:${bundle.git.branch}; commit:${bundle.git.commit}
+        - task_key: ModelDeployment
+          environment_key: default
+          depends_on:
+            - task_key: ModelValidation
+          notebook_task:
+            notebook_path: ../deployment/model_deployment/ModelDeployment.py
+            base_parameters:
+              env: ${bundle.target}
+              # git source information of current ML resource deployment. It will be persisted as part of the workflow run
+              git_source_info: url:${bundle.git.origin_url}; branch:${bundle.git.branch}; commit:${bundle.git.commit}
+      environments:
+        - environment_key: default
+          spec:
+            environment_version: "5"
+            dependencies:
+              - -r ../requirements.txt
+      schedule:
+        quartz_cron_expression: "0 0 9 * * ?" # daily at 9am
+        timezone_id: UTC
+      <<: *permissions
+      # If you want to turn on notifications for this job, please uncomment the below code,
+      # and provide a list of emails to the on_failure argument.
+      #
+      #  email_notifications:
+      #    on_failure:
+      #      - first@company.com
+      #      - second@company.com
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/resources/monitoring-resource.yml.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/resources/monitoring-resource.yml.tmpl
new file mode 100644
index 00000000000..1e9129fa6d8
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/resources/monitoring-resource.yml.tmpl
@@ -0,0 +1,80 @@
+# Please complete all the TODOs in this file.
+# The regression monitor defined here works OOB with this example regression notebook: {{ template `generate_doc_link` (map (pair "cloud" .input_cloud) (pair "path" "_extras/notebooks/source/monitoring/regression-monitor.html")) }}
+# NOTE: Monitoring only works on Unity Catalog tables.
+
+common_permissions: &permissions
+  permissions:
+    - level: CAN_VIEW
+      group_name: users
+
+resources:
+  quality_monitors:
+    {{ .input_project_name }}_quality_monitor:
+      table_name: {{ .input_inference_table_name }}
+      # TODO: Update the output schema name as per your requirements
+      output_schema_name: ${bundle.target}.{{ .input_project_name }}
+      # TODO: Update the below parameters as per your requirements
+      assets_dir: /Users/${workspace.current_user.userName}/databricks_lakehouse_monitoring
+      inference_log:
+        granularities: [1 day]
+        model_id_col: model_id
+        prediction_col: prediction
+        label_col: price
+        problem_type: PROBLEM_TYPE_REGRESSION
+        timestamp_col: timestamp
+      schedule:
+        quartz_cron_expression: 0 0 8 * * ? # Run Every day at 8am
+        timezone_id: UTC
+  jobs:
+    retraining_job:
+      name: ${bundle.target}-{{ .input_project_name }}-monitoring-retraining-job
+      tasks:
+        - task_key: monitored_metric_violation_check
+          environment_key: default
+          notebook_task:
+            notebook_path: ../monitoring/MonitoredMetricViolationCheck.py
+            base_parameters:
+              env: ${bundle.target}
+              table_name_under_monitor: {{ .input_inference_table_name }}
+              # TODO: Update the metric to be monitored and violation threshold
+              metric_to_monitor: root_mean_squared_error
+              metric_violation_threshold: 100
+              num_evaluation_windows: 5
+              num_violation_windows: 2
+              # git source information of current ML resource deployment. It will be persisted as part of the workflow run
+              git_source_info: url:${bundle.git.origin_url}; branch:${bundle.git.branch}; commit:${bundle.git.commit}
+
+        - task_key: is_metric_violated
+          depends_on:
+            - task_key: monitored_metric_violation_check
+          condition_task:
+            op: EQUAL_TO
+            left: "{{"{{tasks.monitored_metric_violation_check.values.is_metric_violated}}"}}"
+            right: "true"
+          git_source_info: url:${bundle.git.origin_url}; branch:${bundle.git.branch}; commit:${bundle.git.commit}
+
+        - task_key: trigger_retraining
+          depends_on:
+            - task_key: is_metric_violated
+              outcome: "true"
+          run_job_task:
+            job_id: ${resources.jobs.model_training_job.id}
+            git_source_info: url:${bundle.git.origin_url}; branch:${bundle.git.branch}; commit:${bundle.git.commit}
+
+      environments:
+        - environment_key: default
+          spec:
+            environment_version: "5"
+            dependencies:
+              - -r ../requirements.txt
+      schedule:
+        quartz_cron_expression: "0 0 18 * * ?" # daily at 6pm
+        timezone_id: UTC
+      <<: *permissions
+      # If you want to turn on notifications for this job, please uncomment the below code,
+      # and provide a list of emails to the on_failure argument.
+      #
+      #  email_notifications:
+      #    on_failure:
+      #      - first@company.com
+      #      - second@company.com
diff --git a/acceptance/bundle/resources/grants/catalogs/out.destroy.requests.direct.json b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/tests/__init__.py.tmpl
similarity index 100%
rename from acceptance/bundle/resources/grants/catalogs/out.destroy.requests.direct.json
rename to acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/tests/__init__.py.tmpl
diff --git a/acceptance/bundle/resources/grants/registered_models/out.destroy.requests.direct.json b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/tests/training/__init__.py.tmpl
similarity index 100%
rename from acceptance/bundle/resources/grants/registered_models/out.destroy.requests.direct.json
rename to acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/tests/training/__init__.py.tmpl
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/tests/training/test_notebooks.py.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/tests/training/test_notebooks.py.tmpl
new file mode 100644
index 00000000000..7293b1b382f
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/tests/training/test_notebooks.py.tmpl
@@ -0,0 +1,9 @@
+import pathlib
+
+
+def test_notebook_format():
+    # Verify that all Databricks notebooks have the required header
+    paths = list(pathlib.Path("./notebooks").glob("**/*.py"))
+    for f in paths:
+        notebook_str = open(str(f)).read()
+        assert notebook_str.startswith("# Databricks notebook source")
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/training/Train.py.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/training/Train.py.tmpl
new file mode 100644
index 00000000000..77896142264
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/training/Train.py.tmpl
@@ -0,0 +1,139 @@
+# Databricks notebook source
+##################################################################################
+# Model Training Notebook
+#
+# This notebook shows an example of a Model Training pipeline using Delta tables.
+# It is configured and can be executed as the "Train" task in the model_training_job workflow defined under
+# ``{{template `project_name_alphanumeric_underscore` .}}/resources/model-workflow-resource.yml``
+#
+# Parameters:
+# * env (required):                 - Environment the notebook is run in (staging, or prod). Defaults to "staging".
+# * training_data_path (required)   - Path to the training data.
+# * experiment_name (required)      - MLflow experiment name for the training runs. Will be created if it doesn't exist.
+# * model_name (required)           - Three-level name (<catalog>.<schema>.<model_name>) to register the trained model in Unity Catalog.
+#
+##################################################################################
+
+# COMMAND ----------
+
+# DBTITLE 1, Notebook arguments
+# List of input args needed to run this notebook as a job.
+# Provide them via DB widgets or notebook arguments.
+
+# Notebook Environment
+dbutils.widgets.dropdown("env", "staging", ["staging", "prod"], "Environment Name")
+env = dbutils.widgets.get("env")
+
+# Path to the Hive-registered Delta table containing the training data.
+dbutils.widgets.text(
+    "training_data_path",
+    "/databricks-datasets/nyctaxi-with-zipcodes/subsampled",
+    label="Path to the training data",
+)
+
+# MLflow experiment name.
+dbutils.widgets.text(
+    "experiment_name",
+    f"/dev-{{template `experiment_base_name` .}}",
+    label="MLflow experiment name",
+)
+
+# Unity Catalog registered model name to use for the trained model.
+dbutils.widgets.text(
+    "model_name", "dev.{{ .input_schema_name }}.{{template `model_name` .}}", label="Full (Three-Level) Model Name"
+)
+
+
+# COMMAND ----------
+
+# DBTITLE 1,Define input and output variables
+input_table_path = dbutils.widgets.get("training_data_path")
+experiment_name = dbutils.widgets.get("experiment_name")
+model_name = dbutils.widgets.get("model_name")
+
+# COMMAND ----------
+
+# DBTITLE 1, Set experiment
+import mlflow
+
+mlflow.set_experiment(experiment_name)
+
+# COMMAND ----------
+
+# DBTITLE 1, Load raw data
+training_df = spark.read.format("delta").load(input_table_path)
+training_df.display()
+
+# COMMAND ----------
+
+# DBTITLE 1, Helper function
+from mlflow import MlflowClient
+import mlflow.pyfunc
+
+
+def get_latest_model_version(model_name):
+    latest_version = 1
+    mlflow_client = MlflowClient()
+    for mv in mlflow_client.search_model_versions(f"name='{model_name}'"):
+        version_int = int(mv.version)
+        if version_int > latest_version:
+            latest_version = version_int
+    return latest_version
+
+
+# COMMAND ----------
+
+# MAGIC %md
+# MAGIC Train a LightGBM model on the data, then log and register the model with MLflow.
+
+# COMMAND ----------
+
+# DBTITLE 1, Train model
+import mlflow
+from sklearn.model_selection import train_test_split
+import lightgbm as lgb
+import mlflow.lightgbm
+
+# Collect data into a Pandas array for training. Since the timestamp columns would likely
+# cause the model to overfit the data, exclude them to avoid training on them.
+columns = [col for col in training_df.columns if col not in ['tpep_pickup_datetime', 'tpep_dropoff_datetime']]
+data = training_df.toPandas()[columns]
+
+train, test = train_test_split(data, random_state=123)
+X_train = train.drop(["fare_amount"], axis=1)
+X_test = test.drop(["fare_amount"], axis=1)
+y_train = train.fare_amount
+y_test = test.fare_amount
+
+mlflow.lightgbm.autolog()
+train_lgb_dataset = lgb.Dataset(X_train, label=y_train.values)
+test_lgb_dataset = lgb.Dataset(X_test, label=y_test.values)
+
+param = {"num_leaves": 32, "objective": "regression", "metric": "rmse"}
+num_rounds = 100
+
+# Train a lightGBM model
+model = lgb.train(param, train_lgb_dataset, num_rounds)
+
+# COMMAND ----------
+
+# DBTITLE 1, Log model and return output.
+# Take the first row of the training dataset as the model input example.
+input_example = X_train.iloc[[0]]
+
+# Log the trained model with MLflow
+mlflow.lightgbm.log_model(
+    model, 
+    artifact_path="lgb_model", 
+    # The signature is automatically inferred from the input example and its predicted output.
+    input_example=input_example,    
+    registered_model_name=model_name
+)
+
+# The returned model URI is needed by the model deployment notebook.
+model_version = get_latest_model_version(model_name)
+model_uri = f"models:/{model_name}/{model_version}"
+dbutils.jobs.taskValues.set("model_uri", model_uri)
+dbutils.jobs.taskValues.set("model_name", model_name)
+dbutils.jobs.taskValues.set("model_version", model_version)
+dbutils.notebook.exit(model_uri)
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/validation/ModelValidation.py.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/validation/ModelValidation.py.tmpl
new file mode 100644
index 00000000000..5d7025a94d3
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/validation/ModelValidation.py.tmpl
@@ -0,0 +1,315 @@
+# Databricks notebook source
+##################################################################################
+# Model Validation Notebook
+##
+# This notebook uses mlflow model validation API to run mode validation after training and registering a model
+# in model registry, before deploying it to the "champion" alias.
+#
+# It runs as part of CD and by an automated model training job -> validation -> deployment job defined under ``{{template `project_name_alphanumeric_underscore` .}}/resources/model-workflow-resource.yml``
+#
+#
+# Parameters:
+#
+# * env                                     - Name of the environment the notebook is run in (staging, or prod). Defaults to "prod".
+# * `run_mode`                              - The `run_mode` defines whether model validation is enabled or not. It can be one of the three values:
+#                                             * `disabled` : Do not run the model validation notebook.
+#                                             * `dry_run`  : Run the model validation notebook. Ignore failed model validation rules and proceed to move
+#                                                            model to the "champion" alias.
+#                                             * `enabled`  : Run the model validation notebook. Move model to the "champion" alias only if all model validation
+#                                                            rules are passing.
+# * enable_baseline_comparison              - Whether to load the current registered "champion" model as baseline.
+#                                             Baseline model is a requirement for relative change and absolute change validation thresholds.
+# * validation_input                        - Validation input. Please refer to data parameter in mlflow.evaluate documentation https://mlflow.org/docs/latest/python_api/mlflow.html#mlflow.evaluate
+# * model_type                              - A string describing the model type. The model type can be either "regressor" and "classifier".
+#                                             Please refer to model_type parameter in mlflow.evaluate documentation https://mlflow.org/docs/latest/python_api/mlflow.html#mlflow.evaluate
+# * targets                                 - The string name of a column from data that contains evaluation labels.
+#                                             Please refer to targets parameter in mlflow.evaluate documentation https://mlflow.org/docs/latest/python_api/mlflow.html#mlflow.evaluate
+#
+# Custom metrics, validation thresholds, and evaluator config are defined in validation/validation.py.
+#
+# For details on mlflow evaluate API, see doc https://mlflow.org/docs/latest/python_api/mlflow.html#mlflow.evaluate
+# For details and examples about performing model validation, see the Model Validation documentation https://mlflow.org/docs/latest/models.html#model-validation
+#
+##################################################################################
+
+# COMMAND ----------
+
+dbutils.widgets.text(
+    "experiment_name",
+    "/dev-{{template `experiment_base_name` .}}",
+    "Experiment Name",
+)
+dbutils.widgets.dropdown("run_mode", "disabled", ["disabled", "dry_run", "enabled"], "Run Mode")
+dbutils.widgets.dropdown("enable_baseline_comparison", "false", ["true", "false"], "Enable Baseline Comparison")
+dbutils.widgets.text("validation_input", "SELECT * FROM delta.`dbfs:/databricks-datasets/nyctaxi-with-zipcodes/subsampled`", "Validation Input")
+dbutils.widgets.text("model_type", "regressor", "Model Type")
+dbutils.widgets.text("targets", "fare_amount", "Targets")
+dbutils.widgets.text("model_name", "dev.{{ .input_schema_name }}.{{template `model_name` .}}", "Full (Three-Level) Model Name")
+
+dbutils.widgets.text("model_version", "", "Candidate Model Version")
+
+# COMMAND ----------
+run_mode = dbutils.widgets.get("run_mode").lower()
+assert run_mode == "disabled" or run_mode == "dry_run" or run_mode == "enabled"
+
+if run_mode == "disabled":
+    print(
+        "Model validation is in DISABLED mode. Exit model validation without blocking model deployment."
+    )
+    dbutils.notebook.exit(0)
+dry_run = run_mode == "dry_run"
+
+if dry_run:
+    print(
+        "Model validation is in DRY_RUN mode. Validation threshold validation failures will not block model deployment."
+    )
+else:
+    print(
+        "Model validation is in ENABLED mode. Validation threshold validation failures will block model deployment."
+    )
+
+# COMMAND ----------
+
+import mlflow
+import os
+import tempfile
+import traceback
+from mlflow import MlflowClient
+
+client = MlflowClient()
+
+# set experiment
+experiment_name = dbutils.widgets.get("experiment_name")
+mlflow.set_experiment(experiment_name)
+# set model evaluation parameters that can be inferred from the job
+model_uri = dbutils.jobs.taskValues.get("Train", "model_uri", debugValue="")
+model_name = dbutils.jobs.taskValues.get("Train", "model_name", debugValue="")
+model_version = dbutils.jobs.taskValues.get("Train", "model_version", debugValue="")
+
+if model_uri == "":
+    model_name = dbutils.widgets.get("model_name")
+    model_version = dbutils.widgets.get("model_version")
+    model_uri = "models:/" + model_name + "/" + model_version
+
+baseline_model_uri = "models:/" + model_name + "@champion"
+
+evaluators = "default"
+assert model_uri != "", "model_uri notebook parameter must be specified"
+assert model_name != "", "model_name notebook parameter must be specified"
+assert model_version != "", "model_version notebook parameter must be specified"
+
+# COMMAND ----------
+
+# take input
+enable_baseline_comparison = dbutils.widgets.get("enable_baseline_comparison")
+
+{{ if (eq .input_include_feature_store `yes`) }}
+enable_baseline_comparison = "false" 
+print(
+    "Currently baseline model comparison is not supported for models registered with feature store. Please refer to "
+    "issue https://github.com/databricks/mlops-stacks/issues/70 for more details."
+)
+{{ end }}
+assert enable_baseline_comparison == "true" or enable_baseline_comparison == "false"
+enable_baseline_comparison = enable_baseline_comparison == "true"
+
+validation_input = dbutils.widgets.get("validation_input")
+assert validation_input
+data = spark.sql(validation_input)
+
+model_type = dbutils.widgets.get("model_type")
+targets = dbutils.widgets.get("targets")
+
+assert model_type
+assert targets
+
+from validation import custom_metrics as _custom_metrics, validation_thresholds as _validation_thresholds, evaluator_config as _evaluator_config
+custom_metrics = _custom_metrics()
+validation_thresholds = _validation_thresholds()
+evaluator_config = _evaluator_config()
+
+# COMMAND ----------
+
+# helper methods
+def get_run_link(run_info):
+    return "[Run](#mlflow/experiments/{0}/runs/{1})".format(
+        run_info.experiment_id, run_info.run_id
+    )
+
+
+def get_training_run(model_name, model_version):
+    version = client.get_model_version(model_name, model_version)
+    if version.run_id:
+        return mlflow.get_run(run_id=version.run_id)
+    return None
+
+
+def generate_run_name(training_run):
+    return None if not training_run else training_run.info.run_name + "-validation"
+
+
+def generate_description(training_run):
+    return (
+        None
+        if not training_run
+        else "Model Training Details: {0}\n".format(get_run_link(training_run.info))
+    )
+
+
+def log_to_model_description(run, success):
+    run_link = get_run_link(run.info)
+    description = client.get_model_version(model_name, model_version).description
+    status = "SUCCESS" if success else "FAILURE"
+    if description != "":
+        description += "\n\n---\n\n"
+    description += "Model Validation Status: {0}\nValidation Details: {1}".format(
+        status, run_link
+    )
+    client.update_model_version(
+        name=model_name, version=model_version, description=description
+    )
+
+{{ if (eq .input_include_feature_store `yes`) }}
+
+from datetime import timedelta, timezone
+import math
+import pyspark.sql.functions as F
+from pyspark.sql.types import IntegerType
+
+
+def rounded_unix_timestamp(dt, num_minutes=15):
+    """
+    Ceilings datetime dt to interval num_minutes, then returns the unix timestamp.
+    """
+    nsecs = dt.minute * 60 + dt.second + dt.microsecond * 1e-6
+    delta = math.ceil(nsecs / (60 * num_minutes)) * (60 * num_minutes) - nsecs
+    return int((dt + timedelta(seconds=delta)).replace(tzinfo=timezone.utc).timestamp())
+
+
+rounded_unix_timestamp_udf = F.udf(rounded_unix_timestamp, IntegerType())
+
+
+def rounded_taxi_data(taxi_data_df):
+    # Round the taxi data timestamp to 15 and 30 minute intervals so we can join with the pickup and dropoff features
+    # respectively.
+    taxi_data_df = (
+        taxi_data_df.withColumn(
+            "rounded_pickup_datetime",
+            F.to_timestamp(
+                rounded_unix_timestamp_udf(
+                    taxi_data_df["tpep_pickup_datetime"], F.lit(15)
+                )
+            ),
+        )
+        .withColumn(
+            "rounded_dropoff_datetime",
+            F.to_timestamp(
+                rounded_unix_timestamp_udf(
+                    taxi_data_df["tpep_dropoff_datetime"], F.lit(30)
+                )
+            ),
+        )
+        .drop("tpep_pickup_datetime")
+        .drop("tpep_dropoff_datetime")
+    )
+    taxi_data_df.createOrReplaceTempView("taxi_data")
+    return taxi_data_df
+
+
+data = rounded_taxi_data(data)
+
+
+{{ end }}
+
+# COMMAND ----------
+
+{{ if (eq .input_include_feature_store `yes`) }}
+# Temporary fix as FS model can't predict as a pyfunc model
+# MLflow evaluate can take a lambda function instead of a model uri for a model
+# but id does not work for the baseline model as it requires a model_uri (baseline comparison is set to false)
+
+from databricks.feature_engineering import FeatureEngineeringClient
+
+def get_fs_model(df):
+    fe_client = FeatureEngineeringClient()
+    return (
+        fe_client.score_batch(model_uri=model_uri, df=spark.createDataFrame(df))
+        .select("prediction")
+        .toPandas()
+    )
+{{ end }}
+
+training_run = get_training_run(model_name, model_version)
+
+# run evaluate
+with mlflow.start_run(
+    run_name=generate_run_name(training_run),
+    description=generate_description(training_run),
+) as run, tempfile.TemporaryDirectory() as tmp_dir:
+    validation_thresholds_file = os.path.join(tmp_dir, "validation_thresholds.txt")
+    with open(validation_thresholds_file, "w") as f:
+        if validation_thresholds:
+            for metric_name in validation_thresholds:
+                f.write(
+                    "{0:30}  {1}\n".format(
+                        metric_name, str(validation_thresholds[metric_name])
+                    )
+                )
+    mlflow.log_artifact(validation_thresholds_file)
+
+    try:
+        eval_result = mlflow.evaluate(
+            {{ if (eq .input_include_feature_store `yes`) }}
+            model=get_fs_model,
+            {{ else }}
+            model=model_uri,
+            {{ end }}
+            data=data,
+            targets=targets,
+            model_type=model_type,
+            evaluators=evaluators,
+            validation_thresholds=validation_thresholds,
+            custom_metrics=custom_metrics,
+            baseline_model=None
+            if not enable_baseline_comparison
+            else baseline_model_uri,
+            evaluator_config=evaluator_config,
+        )
+        metrics_file = os.path.join(tmp_dir, "metrics.txt")
+        with open(metrics_file, "w") as f:
+            f.write(
+                "{0:30}  {1:30}  {2}\n".format("metric_name", "candidate", "baseline")
+            )
+            for metric in eval_result.metrics:
+                candidate_metric_value = str(eval_result.metrics[metric])
+                baseline_metric_value = "N/A"
+                if metric in eval_result.baseline_model_metrics:
+                    mlflow.log_metric(
+                        "baseline_" + metric, eval_result.baseline_model_metrics[metric]
+                    )
+                    baseline_metric_value = str(
+                        eval_result.baseline_model_metrics[metric]
+                    )
+                f.write(
+                    "{0:30}  {1:30}  {2}\n".format(
+                        metric, candidate_metric_value, baseline_metric_value
+                    )
+                )
+        mlflow.log_artifact(metrics_file)
+        log_to_model_description(run, True)
+        # Assign "challenger" alias to indicate model version has passed validation checks
+        print("Validation checks passed. Assigning 'challenger' alias to model version.")
+        client.set_registered_model_alias(model_name, "challenger", model_version)
+    except Exception as err:
+        log_to_model_description(run, False)
+        error_file = os.path.join(tmp_dir, "error.txt")
+        with open(error_file, "w") as f:
+            f.write("Validation failed : " + str(err) + "\n")
+            f.write(traceback.format_exc())
+        mlflow.log_artifact(error_file)
+        if not dry_run:
+            raise err
+        else:
+            print(
+                "Model validation failed in DRY_RUN. It will not block model deployment."
+            )
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/validation/README.md.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/validation/README.md.tmpl
new file mode 100644
index 00000000000..e5a6fec8236
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/validation/README.md.tmpl
@@ -0,0 +1,2 @@
+# Model Validation
+To enable model validation as part of scheduled databricks workflow, please refer to [{{template `project_name_alphanumeric_underscore` .}}/resources/README.md](../resources/README.md)
diff --git a/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/validation/validation.py.tmpl b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/validation/validation.py.tmpl
new file mode 100644
index 00000000000..25f7bc2881c
--- /dev/null
+++ b/acceptance/bundle/deploy/mlops-stacks/template/template/{{.input_root_dir}}/{{.input_project_name}}/validation/validation.py.tmpl
@@ -0,0 +1,41 @@
+import numpy as np
+from mlflow.models import make_metric, MetricThreshold
+
+# Custom metrics to be included. Return empty list if custom metrics are not needed.
+# Please refer to custom_metrics parameter in mlflow.evaluate documentation https://mlflow.org/docs/latest/python_api/mlflow.html#mlflow.evaluate
+# TODO(optional) : custom_metrics
+def custom_metrics():
+
+    # TODO(optional) : define custom metric function to be included in custom_metrics.
+    def squared_diff_plus_one(eval_df, _builtin_metrics):
+        """
+        This example custom metric function creates a metric based on the ``prediction`` and
+        ``target`` columns in ``eval_df`.
+        """
+        return np.sum(np.abs(eval_df["prediction"] - eval_df["target"] + 1) ** 2)
+
+    return [make_metric(eval_fn=squared_diff_plus_one, greater_is_better=False)]
+
+
+# Define model validation rules. Return empty dict if validation rules are not needed.
+# Please refer to validation_thresholds parameter in mlflow.evaluate documentation https://mlflow.org/docs/latest/python_api/mlflow.html#mlflow.evaluate
+# TODO(optional) : validation_thresholds
+def validation_thresholds():
+    return {
+        "max_error": MetricThreshold(
+            threshold=500, greater_is_better=False  # max_error should be <= 500
+        ),
+        "mean_squared_error": MetricThreshold(
+            threshold=500,  # mean_squared_error should be <= 500
+            # min_absolute_change=0.01,  # mean_squared_error should be at least 0.01 greater than baseline model accuracy
+            # min_relative_change=0.01,  # mean_squared_error should be at least 1 percent greater than baseline model accuracy
+            greater_is_better=False,
+        ),
+    }
+
+
+# Define evaluator config. Return empty dict if validation rules are not needed.
+# Please refer to evaluator_config parameter in mlflow.evaluate documentation https://mlflow.org/docs/latest/python_api/mlflow.html#mlflow.evaluate
+# TODO(optional) : evaluator_config
+def evaluator_config():
+    return {}
diff --git a/acceptance/bundle/deploy/mlops-stacks/test.toml b/acceptance/bundle/deploy/mlops-stacks/test.toml
index f4178c308eb..68270828373 100644
--- a/acceptance/bundle/deploy/mlops-stacks/test.toml
+++ b/acceptance/bundle/deploy/mlops-stacks/test.toml
@@ -1,5 +1,8 @@
 Cloud=true
-Local=true
+# The MLOps Stacks template registers the model in Unity Catalog and runs its
+# jobs on serverless compute, so this test only works on a UC-enabled workspace
+# (which also has serverless jobs). Gate on UC so it skips on the non-UC cloud
+# envs instead of failing with METASTORE_DOES_NOT_EXIST.
 
 Badness = "the newly initialized bundle from the 'mlops-stacks' template contains two validation warnings in the configuration"
 
@@ -10,3 +13,8 @@ Ignore = [
 [[Repls]]
 Old = "aws|azure|gcp"
 New = "[CLOUD_ENV_BASE]"
+
+# $TESTDIR uses backslashes on Windows, hence the either-separator match.
+[[Repls]]
+Old = 'bundle init .*[\\/]mlops-stacks/template'
+New = "bundle init mlops-stacks"
diff --git a/acceptance/bundle/deploy/partial-summary-on-push-fail/databricks.yml b/acceptance/bundle/deploy/partial-summary-on-push-fail/databricks.yml
new file mode 100644
index 00000000000..335123cef20
--- /dev/null
+++ b/acceptance/bundle/deploy/partial-summary-on-push-fail/databricks.yml
@@ -0,0 +1,7 @@
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    my_job:
+      name: my-job
diff --git a/acceptance/bundle/deploy/partial-summary-on-push-fail/out.test.toml b/acceptance/bundle/deploy/partial-summary-on-push-fail/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/deploy/partial-summary-on-push-fail/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/deploy/partial-summary-on-push-fail/output.txt b/acceptance/bundle/deploy/partial-summary-on-push-fail/output.txt
new file mode 100644
index 00000000000..4610f302b33
--- /dev/null
+++ b/acceptance/bundle/deploy/partial-summary-on-push-fail/output.txt
@@ -0,0 +1,26 @@
+
+>>> errcode [CLI] bundle deploy -q
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Error: access denied: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/resources.json (403 INJECTED)
+
+Endpoint: POST [DATABRICKS_URL]/api/2.0/workspace/import
+HTTP Status: 403 Forbidden
+API error_code: INJECTED
+API message: Fault injected by test.
+
+Files: 1 uploaded, 0 deleted
+
+Exit code: 1
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.my_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/deploy/partial-summary-on-push-fail/script b/acceptance/bundle/deploy/partial-summary-on-push-fail/script
new file mode 100644
index 00000000000..d2fef85a1d7
--- /dev/null
+++ b/acceptance/bundle/deploy/partial-summary-on-push-fail/script
@@ -0,0 +1,17 @@
+cleanup() {
+    # Second deploy has no fault, so it succeeds and prints both summary lines; this
+    # both cleans up and shows the contrast with the failed deploy above.
+    trace $CLI bundle deploy
+    trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+# Inject a 403 on the resource-state upload (PushResourcesState). The files are
+# uploaded by then, so "Files:" still reports them; "Resources:" must NOT print,
+# because this fails before planning and there are no resource counts to report.
+fault.py --body-contains "state/resources.json" "POST /api/2.0/workspace/import" 403 0 1
+
+# -q: the state-push 403 races resource apply, so whether "Created jobs.my_job" is
+# emitted before the failure is platform-dependent. This test asserts Files is reported
+# and Resources is not; -q drops the racing per-resource line while keeping both.
+trace errcode $CLI bundle deploy -q
diff --git a/acceptance/bundle/deploy/partial-summary-on-push-fail/test.toml b/acceptance/bundle/deploy/partial-summary-on-push-fail/test.toml
new file mode 100644
index 00000000000..64cb4896dce
--- /dev/null
+++ b/acceptance/bundle/deploy/partial-summary-on-push-fail/test.toml
@@ -0,0 +1,7 @@
+# The resource summary must not print when pushing resource state fails, so the
+# fault is injected on the state upload (POST /workspace/import). The path is fixed, so
+# the bundle name must be stable (test-bundle, not $UNIQUE_NAME).
+#
+# The injected path is the direct-engine state file (state/resources.json), so
+# this runs on the direct engine only.
+Ignore = [".databricks", ".gitignore"]
diff --git a/acceptance/bundle/deploy/pipeline-config-dots/out.test.toml b/acceptance/bundle/deploy/pipeline-config-dots/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/deploy/pipeline-config-dots/out.test.toml
+++ b/acceptance/bundle/deploy/pipeline-config-dots/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/deploy/pipeline-config-dots/output.txt b/acceptance/bundle/deploy/pipeline-config-dots/output.txt
index 48b6576f221..213e0fc8142 100644
--- a/acceptance/bundle/deploy/pipeline-config-dots/output.txt
+++ b/acceptance/bundle/deploy/pipeline-config-dots/output.txt
@@ -10,9 +10,10 @@ Validation OK!
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created pipelines.my_pipeline
+Created schemas.my_schema
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
@@ -23,10 +24,9 @@ This action will result in the deletion of the following UC schemas. Any underly
   delete resources.schemas.my_schema
 
 This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
-Streaming Tables (STs) and Materialized Views (MVs) managed by them:
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:
   delete resources.pipelines.my_pipeline
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 2 deleted
diff --git a/acceptance/bundle/deploy/python-notebook/out.test.toml b/acceptance/bundle/deploy/python-notebook/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/deploy/python-notebook/out.test.toml
+++ b/acceptance/bundle/deploy/python-notebook/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/deploy/python-notebook/output.txt b/acceptance/bundle/deploy/python-notebook/output.txt
index 62e9567ccee..95a09e78d58 100644
--- a/acceptance/bundle/deploy/python-notebook/output.txt
+++ b/acceptance/bundle/deploy/python-notebook/output.txt
@@ -1,16 +1,16 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.my_job
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] jobs list --output json
 [
   {
     "created_time": [UNIX_TIME_MILLIS],
     "creator_user_name": "[USERNAME]",
-    "job_id": [NUMID],
+    "job_id": [MY_JOB_ID],
     "settings": {
       "deployment": {
         "kind": "BUNDLE",
diff --git a/acceptance/bundle/deploy/python-notebook/script b/acceptance/bundle/deploy/python-notebook/script
index 601ecd36366..b2b536d41b7 100644
--- a/acceptance/bundle/deploy/python-notebook/script
+++ b/acceptance/bundle/deploy/python-notebook/script
@@ -1,3 +1,4 @@
 trace $CLI bundle deploy
+replace_ids.py
 
-trace $CLI jobs list --output json
+trace $CLI jobs list --output json | nostamp
diff --git a/acceptance/bundle/deploy/python-notebook/test.toml b/acceptance/bundle/deploy/python-notebook/test.toml
deleted file mode 100644
index 05e2f27a229..00000000000
--- a/acceptance/bundle/deploy/python-notebook/test.toml
+++ /dev/null
@@ -1 +0,0 @@
-# need deterministic ids and clean workspace
diff --git a/acceptance/bundle/deploy/readplan/basic/databricks.yml b/acceptance/bundle/deploy/readplan/basic/databricks.yml
index b93d6b5b021..9c77e2e4d98 100644
--- a/acceptance/bundle/deploy/readplan/basic/databricks.yml
+++ b/acceptance/bundle/deploy/readplan/basic/databricks.yml
@@ -1,6 +1,11 @@
 bundle:
   name: test-bundle
 
+# The raw plans deploy --plan reads live in the bundle root; keep them out of the file count.
+sync:
+  exclude:
+    - tmp.plan_*.json
+
 resources:
   jobs:
     job:
diff --git a/acceptance/bundle/deploy/readplan/basic/out.plan_create.json b/acceptance/bundle/deploy/readplan/basic/out.plan_create.json
index 5249bacdde0..ada1d9113df 100644
--- a/acceptance/bundle/deploy/readplan/basic/out.plan_create.json
+++ b/acceptance/bundle/deploy/readplan/basic/out.plan_create.json
@@ -1,6 +1,6 @@
 {
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
   "plan": {
     "resources.jobs.job": {
       "action": "create",
diff --git a/acceptance/bundle/deploy/readplan/basic/out.plan_skip.json b/acceptance/bundle/deploy/readplan/basic/out.plan_skip.json
index af0a16a10a5..8982add5d75 100644
--- a/acceptance/bundle/deploy/readplan/basic/out.plan_skip.json
+++ b/acceptance/bundle/deploy/readplan/basic/out.plan_skip.json
@@ -1,6 +1,6 @@
 {
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
   "lineage": "[UUID]",
   "serial": 1,
   "plan": {
@@ -16,7 +16,7 @@
         "edit_mode": "UI_LOCKED",
         "email_notifications": {},
         "format": "MULTI_TASK",
-        "job_id": [NUMID],
+        "job_id": [JOB_ID],
         "max_concurrent_runs": 1,
         "name": "test-job",
         "queue": {
diff --git a/acceptance/bundle/deploy/readplan/basic/out.test.toml b/acceptance/bundle/deploy/readplan/basic/out.test.toml
index e90b6d5d1ba..a927a5fbc06 100644
--- a/acceptance/bundle/deploy/readplan/basic/out.test.toml
+++ b/acceptance/bundle/deploy/readplan/basic/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/deploy/readplan/basic/output.txt b/acceptance/bundle/deploy/readplan/basic/output.txt
index 485488f0904..be446fb1b5a 100644
--- a/acceptance/bundle/deploy/readplan/basic/output.txt
+++ b/acceptance/bundle/deploy/readplan/basic/output.txt
@@ -3,11 +3,11 @@
 
 >>> print_requests.py --get //jobs
 
->>> [CLI] bundle deploy --plan out.plan_create.json
+>>> [CLI] bundle deploy --plan tmp.plan_create.json
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.job
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> print_requests.py --get //jobs
 {
@@ -35,15 +35,14 @@ Deployment complete!
   "method": "GET",
   "path": "/api/2.2/jobs/get",
   "q": {
-    "job_id": "[NUMID]"
+    "job_id": "[JOB_ID]"
   }
 }
 
->>> [CLI] bundle deploy --plan out.plan_skip.json
+>>> [CLI] bundle deploy --plan tmp.plan_skip.json
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
 
 >>> print_requests.py --get //jobs
 
@@ -53,5 +52,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/deploy/readplan/basic/script b/acceptance/bundle/deploy/readplan/basic/script
index 89bf2487b86..db73236d6a6 100644
--- a/acceptance/bundle/deploy/readplan/basic/script
+++ b/acceptance/bundle/deploy/readplan/basic/script
@@ -1,18 +1,21 @@
 # Generate initial plan
-trace $CLI bundle plan -o json > out.plan_create.json
-trace print_requests.py --get //jobs | contains.py "!GET" "!POST"
+trace $CLI bundle plan -o json > tmp.plan_create.json
+nostamp < tmp.plan_create.json > out.plan_create.json
+trace print_requests.py --get //jobs | nostamp | contains.py "!GET" "!POST"
 
 # First deploy to create the resource
-trace $CLI bundle deploy --plan out.plan_create.json
-trace print_requests.py --get //jobs | contains.py "!GET" "POST"
+trace $CLI bundle deploy --plan tmp.plan_create.json
+replace_ids.py
+trace print_requests.py --get //jobs | nostamp | contains.py "!GET" "POST"
 
 # Generate a plan (should show "skip" since nothing changed)
-trace $CLI bundle plan -o json > out.plan_skip.json
-trace print_requests.py --get //jobs | contains.py "GET"
+trace $CLI bundle plan -o json > tmp.plan_skip.json
+nostamp < tmp.plan_skip.json > out.plan_skip.json
+trace print_requests.py --get //jobs | nostamp | contains.py "GET"
 
-trace $CLI bundle deploy --plan out.plan_skip.json
+trace $CLI bundle deploy --plan tmp.plan_skip.json
 # Show what requests were made (should not create/update job again; should not read remote state)
-trace print_requests.py --get //jobs | contains.py "!GET" "!POST"
+trace print_requests.py --get //jobs | nostamp | contains.py "!GET" "!POST"
 
 trace $CLI bundle destroy --auto-approve
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/deploy/readplan/basic/test.toml b/acceptance/bundle/deploy/readplan/basic/test.toml
index ab71315de0d..301a964aeef 100644
--- a/acceptance/bundle/deploy/readplan/basic/test.toml
+++ b/acceptance/bundle/deploy/readplan/basic/test.toml
@@ -1,3 +1,3 @@
 # Test basic --plan functionality
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
 RecordRequests = true
+Ignore = ["tmp.plan_*.json"]
diff --git a/acceptance/bundle/deploy/readplan/cli-version-mismatch/out.test.toml b/acceptance/bundle/deploy/readplan/cli-version-mismatch/out.test.toml
index e90b6d5d1ba..a927a5fbc06 100644
--- a/acceptance/bundle/deploy/readplan/cli-version-mismatch/out.test.toml
+++ b/acceptance/bundle/deploy/readplan/cli-version-mismatch/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/deploy/readplan/cli-version-mismatch/output.txt b/acceptance/bundle/deploy/readplan/cli-version-mismatch/output.txt
index 568c435dade..e66de19681c 100644
--- a/acceptance/bundle/deploy/readplan/cli-version-mismatch/output.txt
+++ b/acceptance/bundle/deploy/readplan/cli-version-mismatch/output.txt
@@ -2,11 +2,11 @@
 >>> [CLI] bundle plan -o json
 
 >>> [CLI] bundle deploy --plan plan.json
-Warn: Plan was created with CLI version 1.2.3 but current version is [DEV_VERSION]
+Warn: Plan was created with CLI version 1.2.3 but current version is [CLI_VERSION]
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.job
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 {
   "method": "POST",
   "path": "/api/2.2/jobs/create",
@@ -31,5 +31,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/deploy/readplan/cli-version-mismatch/script b/acceptance/bundle/deploy/readplan/cli-version-mismatch/script
index b7fe9ee268d..321e3489401 100644
--- a/acceptance/bundle/deploy/readplan/cli-version-mismatch/script
+++ b/acceptance/bundle/deploy/readplan/cli-version-mismatch/script
@@ -1,9 +1,7 @@
-trace $CLI bundle plan -o json > plan.json
-
-jq '.cli_version = "1.2.3"' plan.json > plan.json.tmp && mv plan.json.tmp plan.json
+trace $CLI bundle plan -o json | jq '.cli_version = "1.2.3"' > plan.json
 
 trace $CLI bundle deploy --plan plan.json
 rm plan.json
-print_requests.py //jobs
+print_requests.py //jobs | nostamp
 trace $CLI bundle destroy --auto-approve
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/deploy/readplan/cli-version-mismatch/test.toml b/acceptance/bundle/deploy/readplan/cli-version-mismatch/test.toml
index c8f942fbf84..5d09f246c37 100644
--- a/acceptance/bundle/deploy/readplan/cli-version-mismatch/test.toml
+++ b/acceptance/bundle/deploy/readplan/cli-version-mismatch/test.toml
@@ -1,3 +1,2 @@
 # Test that --plan with different cli_version produces a warning but succeeds
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
 RecordRequests = true
diff --git a/acceptance/bundle/deploy/readplan/grants-remove-principal/databricks.yml b/acceptance/bundle/deploy/readplan/grants-remove-principal/databricks.yml
new file mode 100644
index 00000000000..be0581c3702
--- /dev/null
+++ b/acceptance/bundle/deploy/readplan/grants-remove-principal/databricks.yml
@@ -0,0 +1,15 @@
+bundle:
+  name: test-bundle
+
+resources:
+  schemas:
+    myschema:
+      name: myschema
+      catalog_name: main
+      grants:
+        - principal: ${workspace.current_user.userName}
+          privileges:
+            - USE_SCHEMA
+        - principal: extra@example.test # TO_REMOVE
+          privileges: # TO_REMOVE
+            - CREATE_TABLE # TO_REMOVE
diff --git a/acceptance/bundle/deploy/readplan/grants-remove-principal/out.plan.grants.json b/acceptance/bundle/deploy/readplan/grants-remove-principal/out.plan.grants.json
new file mode 100644
index 00000000000..0b90f0b19e6
--- /dev/null
+++ b/acceptance/bundle/deploy/readplan/grants-remove-principal/out.plan.grants.json
@@ -0,0 +1,58 @@
+{
+  "depends_on": [
+    {
+      "node": "resources.schemas.myschema",
+      "label": "${resources.schemas.myschema.id}"
+    }
+  ],
+  "action": "update",
+  "new_state": {
+    "value": {
+      "securable_type": "schema",
+      "full_name": "main.myschema",
+      "__embed__": [
+        {
+          "principal": "[USERNAME]",
+          "privileges": [
+            "USE_SCHEMA"
+          ]
+        }
+      ]
+    }
+  },
+  "remote_state": {
+    "securable_type": "schema",
+    "full_name": "main.myschema",
+    "__embed__": [
+      {
+        "principal": "extra@example.test",
+        "privileges": [
+          "CREATE_TABLE"
+        ]
+      },
+      {
+        "principal": "[USERNAME]",
+        "privileges": [
+          "USE_SCHEMA"
+        ]
+      }
+    ]
+  },
+  "changes": {
+    "[principal='extra@example.test']": {
+      "action": "update",
+      "old": {
+        "principal": "extra@example.test",
+        "privileges": [
+          "CREATE_TABLE"
+        ]
+      },
+      "remote": {
+        "principal": "extra@example.test",
+        "privileges": [
+          "CREATE_TABLE"
+        ]
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/deploy/readplan/grants-remove-principal/out.test.toml b/acceptance/bundle/deploy/readplan/grants-remove-principal/out.test.toml
new file mode 100644
index 00000000000..f7fafbcc731
--- /dev/null
+++ b/acceptance/bundle/deploy/readplan/grants-remove-principal/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/deploy/readplan/grants-remove-principal/output.txt b/acceptance/bundle/deploy/readplan/grants-remove-principal/output.txt
new file mode 100644
index 00000000000..948a497f7e9
--- /dev/null
+++ b/acceptance/bundle/deploy/readplan/grants-remove-principal/output.txt
@@ -0,0 +1,81 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created schemas.myschema
+Created schemas.myschema.grants
+Files: 1 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //unity-catalog/permissions --sort
+{
+  "method": "PATCH",
+  "path": "/api/2.1/unity-catalog/permissions/schema/main.myschema",
+  "body": {
+    "changes": [
+      {
+        "add": [
+          "USE_SCHEMA"
+        ],
+        "principal": "[USERNAME]",
+        "remove": [
+          "ALL_PRIVILEGES"
+        ]
+      },
+      {
+        "add": [
+          "CREATE_TABLE"
+        ],
+        "principal": "extra@example.test",
+        "remove": [
+          "ALL_PRIVILEGES"
+        ]
+      }
+    ]
+  }
+}
+
+>>> [CLI] bundle plan -o json
+
+>>> print_requests.py --get //unity-catalog/permissions --sort
+{
+  "method": "GET",
+  "path": "/api/2.1/unity-catalog/permissions/schema/main.myschema"
+}
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Updated schemas.myschema.grants
+Files: 3 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 1 unchanged
+
+>>> print_requests.py //unity-catalog/permissions --sort
+{
+  "method": "PATCH",
+  "path": "/api/2.1/unity-catalog/permissions/schema/main.myschema",
+  "body": {
+    "changes": [
+      {
+        "add": [
+          "USE_SCHEMA"
+        ],
+        "principal": "[USERNAME]",
+        "remove": [
+          "ALL_PRIVILEGES"
+        ]
+      },
+      {
+        "principal": "extra@example.test",
+        "remove": [
+          "ALL_PRIVILEGES"
+        ]
+      }
+    ]
+  }
+}
+The following resources will be deleted:
+  delete resources.schemas.myschema
+
+This action will result in the deletion of the following UC schemas. Any underlying data may be lost:
+  delete resources.schemas.myschema
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/deploy/readplan/grants-remove-principal/script b/acceptance/bundle/deploy/readplan/grants-remove-principal/script
new file mode 100644
index 00000000000..567724792c8
--- /dev/null
+++ b/acceptance/bundle/deploy/readplan/grants-remove-principal/script
@@ -0,0 +1,27 @@
+cleanup() {
+    $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+# Deploy schema with two grant principals.
+trace $CLI bundle deploy
+trace print_requests.py //unity-catalog/permissions --sort
+
+# Remove extra@example.test from config.
+grep -v 'TO_REMOVE' databricks.yml > updated.yml && mv updated.yml databricks.yml
+
+# Generate update plan: entry.RemoteState captures both principals as GrantsState.
+# remote_state.__embed__ principal order is non-deterministic (the backend, and the
+# testserver mirroring it, iterate a map), so sort it by principal for a stable golden.
+trace $CLI bundle plan -o json > tmp.plan.json
+nostamp < tmp.plan.json | jq '.plan["resources.schemas.myschema.grants"] | .remote_state.__embed__ |= sort_by(.principal)' > out.plan.grants.json
+trace print_requests.py --get //unity-catalog/permissions --sort
+
+# Deploy from serialized plan (READPLAN=1) or without (READPLAN="").
+# Without the fix, entry.RemoteState.(*GrantsState) fails for JSON-loaded plan,
+# removedGrantPrincipals returns nil, and the revocation is silently skipped.
+$CLI bundle deploy $(readplanarg tmp.plan.json)
+
+# Verify the PATCH call included a REMOVE for extra@example.test.
+trace print_requests.py //unity-catalog/permissions --sort | contains.py 'extra@example.test'
diff --git a/acceptance/bundle/deploy/readplan/grants-remove-principal/test.toml b/acceptance/bundle/deploy/readplan/grants-remove-principal/test.toml
new file mode 100644
index 00000000000..fd9213de255
--- /dev/null
+++ b/acceptance/bundle/deploy/readplan/grants-remove-principal/test.toml
@@ -0,0 +1,3 @@
+EnvMatrix.READPLAN = ["", "1"]
+RecordRequests = true
+Ignore = ["tmp.plan.json"]
diff --git a/acceptance/bundle/deploy/readplan/invalid-plan/out.test.toml b/acceptance/bundle/deploy/readplan/invalid-plan/out.test.toml
index e90b6d5d1ba..a927a5fbc06 100644
--- a/acceptance/bundle/deploy/readplan/invalid-plan/out.test.toml
+++ b/acceptance/bundle/deploy/readplan/invalid-plan/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/deploy/readplan/invalid-plan/test.toml b/acceptance/bundle/deploy/readplan/invalid-plan/test.toml
deleted file mode 100644
index 8a6becefe0a..00000000000
--- a/acceptance/bundle/deploy/readplan/invalid-plan/test.toml
+++ /dev/null
@@ -1,2 +0,0 @@
-# Test that --plan with invalid JSON produces an error
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/deploy/readplan/lineage-mismatch/out.test.toml b/acceptance/bundle/deploy/readplan/lineage-mismatch/out.test.toml
index e90b6d5d1ba..a927a5fbc06 100644
--- a/acceptance/bundle/deploy/readplan/lineage-mismatch/out.test.toml
+++ b/acceptance/bundle/deploy/readplan/lineage-mismatch/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/deploy/readplan/lineage-mismatch/output.txt b/acceptance/bundle/deploy/readplan/lineage-mismatch/output.txt
index ce67ee0d145..0d00e2f01d1 100644
--- a/acceptance/bundle/deploy/readplan/lineage-mismatch/output.txt
+++ b/acceptance/bundle/deploy/readplan/lineage-mismatch/output.txt
@@ -1,5 +1,5 @@
-Warn: Plan was created with CLI version 0.0.0-test but current version is [DEV_VERSION]
-Error: plan lineage "different-lineage" does not match state lineage ""; the state may have been modified by another process
 
+>>> musterr [CLI] bundle deploy --plan plan.json
+Warn: Plan was created with CLI version 0.0.0-test but current version is [CLI_VERSION]
+Error: plan lineage "different-lineage" does not match state lineage ""; the state may have been modified by another process
 
-Exit code: 1
diff --git a/acceptance/bundle/deploy/readplan/lineage-mismatch/plan.dms.json b/acceptance/bundle/deploy/readplan/lineage-mismatch/plan.dms.json
new file mode 100644
index 00000000000..58e072b84f1
--- /dev/null
+++ b/acceptance/bundle/deploy/readplan/lineage-mismatch/plan.dms.json
@@ -0,0 +1,10 @@
+{
+  "plan_version": 2,
+  "cli_version": "0.0.0-test",
+  "lineage": "different-lineage",
+  "serial": 0,
+  "plan": {},
+  "features": {
+    "deployment_history": {}
+  }
+}
diff --git a/acceptance/bundle/deploy/readplan/lineage-mismatch/script b/acceptance/bundle/deploy/readplan/lineage-mismatch/script
index d386f293771..53e15a0cc65 100644
--- a/acceptance/bundle/deploy/readplan/lineage-mismatch/script
+++ b/acceptance/bundle/deploy/readplan/lineage-mismatch/script
@@ -1,2 +1,13 @@
+# The plan is committed rather than generated, so it must match the shape of the target it is fed
+# to: a recorded target's state carries the deployment_history feature, and validatePlan rejects a
+# plan whose features differ before it looks at lineage.
+#
+# The deployment-history variant needs the recorded-shape plan; copy it over plan.json so the
+# traced command line ("--plan plan.json") is the same in both variants.
+if [ "$DATABRICKS_BUNDLE_DEPLOYMENT_HISTORY" = "true" ]; then
+    cp plan.dms.json plan.json
+fi
+
 # Try to deploy with mismatched lineage (should fail)
-$CLI bundle deploy --plan plan.json
+trace musterr $CLI bundle deploy --plan plan.json
+rm plan.json
diff --git a/acceptance/bundle/deploy/readplan/lineage-mismatch/test.toml b/acceptance/bundle/deploy/readplan/lineage-mismatch/test.toml
deleted file mode 100644
index de0ba18b25f..00000000000
--- a/acceptance/bundle/deploy/readplan/lineage-mismatch/test.toml
+++ /dev/null
@@ -1,2 +0,0 @@
-# Test that --plan with mismatched lineage produces an error
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/deploy/readplan/plan-not-found/out.test.toml b/acceptance/bundle/deploy/readplan/plan-not-found/out.test.toml
index f7c4cf648a9..8c2cb31de53 100644
--- a/acceptance/bundle/deploy/readplan/plan-not-found/out.test.toml
+++ b/acceptance/bundle/deploy/readplan/plan-not-found/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
 GOOS.windows = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/deploy/readplan/plan-not-found/test.toml b/acceptance/bundle/deploy/readplan/plan-not-found/test.toml
index 5ed97a8d220..490d17654af 100644
--- a/acceptance/bundle/deploy/readplan/plan-not-found/test.toml
+++ b/acceptance/bundle/deploy/readplan/plan-not-found/test.toml
@@ -1,5 +1,4 @@
 # Test that --plan with missing file produces an error
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
 
 # different error message on Windows
 GOOS.windows = false
diff --git a/acceptance/bundle/deploy/readplan/plan-version-mismatch/out.test.toml b/acceptance/bundle/deploy/readplan/plan-version-mismatch/out.test.toml
index e90b6d5d1ba..a927a5fbc06 100644
--- a/acceptance/bundle/deploy/readplan/plan-version-mismatch/out.test.toml
+++ b/acceptance/bundle/deploy/readplan/plan-version-mismatch/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/deploy/readplan/plan-version-mismatch/test.toml b/acceptance/bundle/deploy/readplan/plan-version-mismatch/test.toml
deleted file mode 100644
index 4530e5f8f55..00000000000
--- a/acceptance/bundle/deploy/readplan/plan-version-mismatch/test.toml
+++ /dev/null
@@ -1,2 +0,0 @@
-# Test that --plan with mismatched plan_version produces an error
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/deploy/readplan/postgres_role/databricks.yml b/acceptance/bundle/deploy/readplan/postgres_role/databricks.yml
new file mode 100644
index 00000000000..08edfa99205
--- /dev/null
+++ b/acceptance/bundle/deploy/readplan/postgres_role/databricks.yml
@@ -0,0 +1,20 @@
+bundle:
+  name: test-bundle
+
+resources:
+  postgres_projects:
+    project:
+      project_id: test-pg-project
+      display_name: Test Postgres Project
+
+  postgres_branches:
+    branch:
+      parent: ${resources.postgres_projects.project.name}
+      branch_id: test-branch
+      no_expiry: true
+
+  postgres_roles:
+    role:
+      parent: ${resources.postgres_branches.branch.name}
+      role_id: test-role
+      postgres_role: app_role
diff --git a/acceptance/bundle/deploy/readplan/postgres_role/out.plan.role.json b/acceptance/bundle/deploy/readplan/postgres_role/out.plan.role.json
new file mode 100644
index 00000000000..c236b61882a
--- /dev/null
+++ b/acceptance/bundle/deploy/readplan/postgres_role/out.plan.role.json
@@ -0,0 +1,19 @@
+{
+  "depends_on": [
+    {
+      "node": "resources.postgres_branches.branch",
+      "label": "${resources.postgres_branches.branch.name}"
+    }
+  ],
+  "action": "create",
+  "new_state": {
+    "value": {
+      "parent": "${resources.postgres_branches.branch.name}",
+      "postgres_role": "app_role",
+      "role_id": "test-role"
+    },
+    "vars": {
+      "parent": "${resources.postgres_branches.branch.name}"
+    }
+  }
+}
diff --git a/acceptance/bundle/deploy/readplan/postgres_role/out.test.toml b/acceptance/bundle/deploy/readplan/postgres_role/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/deploy/readplan/postgres_role/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/deploy/readplan/postgres_role/output.txt b/acceptance/bundle/deploy/readplan/postgres_role/output.txt
new file mode 100644
index 00000000000..31d0e2f41a8
--- /dev/null
+++ b/acceptance/bundle/deploy/readplan/postgres_role/output.txt
@@ -0,0 +1,45 @@
+
+>>> [CLI] bundle plan -o json
+
+>>> [CLI] bundle deploy --plan tmp.plan.json
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created postgres_branches.branch
+Created postgres_projects.project
+Created postgres_roles.role
+Files: 3 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //roles
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/test-pg-project/branches/test-branch/roles",
+  "q": {
+    "role_id": "test-role"
+  },
+  "body": {
+    "spec": {
+      "postgres_role": "app_role"
+    }
+  }
+}
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 3 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.postgres_branches.branch
+  delete resources.postgres_projects.project
+  delete resources.postgres_roles.role
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.project
+
+This action will result in the deletion of the following Lakebase branches.
+All data stored in them will be permanently lost:
+  delete resources.postgres_branches.branch
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Destroy: 3 deleted
diff --git a/acceptance/bundle/deploy/readplan/postgres_role/script b/acceptance/bundle/deploy/readplan/postgres_role/script
new file mode 100644
index 00000000000..dff65642595
--- /dev/null
+++ b/acceptance/bundle/deploy/readplan/postgres_role/script
@@ -0,0 +1,23 @@
+# Regression test: the serialized plan must preserve postgres_role's role_id and
+# parent. Both live outside the embedded RoleRoleSpec, so without custom
+# (Un)MarshalJSON on the state they are dropped from the plan's new_state. The
+# committed out.plan.role.json below must show role_id and parent under
+# new_state.value. Deploying such a lossy plan would create the role with an
+# empty role_id, the server would generate its own, and the next plan would
+# report phantom "recreate" drift on the immutable role_id.
+
+trace $CLI bundle plan -o json > tmp.plan.json
+
+# Keep only the role entry; role_id and parent must survive serialization.
+nostamp < tmp.plan.json | jq '.plan."resources.postgres_roles.role"' > out.plan.role.json
+
+trace $CLI bundle deploy --plan tmp.plan.json
+
+# The create request must carry the configured role_id, not an empty one.
+trace print_requests.py //roles
+
+# A follow-up plan must show no drift.
+trace $CLI bundle plan
+
+trace $CLI bundle destroy --auto-approve
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/deploy/readplan/postgres_role/test.toml b/acceptance/bundle/deploy/readplan/postgres_role/test.toml
new file mode 100644
index 00000000000..0371f86a139
--- /dev/null
+++ b/acceptance/bundle/deploy/readplan/postgres_role/test.toml
@@ -0,0 +1,4 @@
+RecordRequests = true
+
+# Full plan fed to `deploy --plan`; the committed golden keeps only the role entry.
+Ignore = ["tmp.plan.json"]
diff --git a/acceptance/bundle/deploy/readplan/serial-mismatch/out.test.toml b/acceptance/bundle/deploy/readplan/serial-mismatch/out.test.toml
index e90b6d5d1ba..a927a5fbc06 100644
--- a/acceptance/bundle/deploy/readplan/serial-mismatch/out.test.toml
+++ b/acceptance/bundle/deploy/readplan/serial-mismatch/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/deploy/readplan/serial-mismatch/output.txt b/acceptance/bundle/deploy/readplan/serial-mismatch/output.txt
index 50f6d7149ca..8aab5df3764 100644
--- a/acceptance/bundle/deploy/readplan/serial-mismatch/output.txt
+++ b/acceptance/bundle/deploy/readplan/serial-mismatch/output.txt
@@ -1,9 +1,9 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.job
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle plan -o json
 Error: plan serial 999 does not match state serial 1; the state has been modified since the plan was created. Please run 'bundle plan' again
@@ -15,5 +15,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/deploy/readplan/serial-mismatch/test.toml b/acceptance/bundle/deploy/readplan/serial-mismatch/test.toml
index dc4dcf06fc7..aee11c6dbf0 100644
--- a/acceptance/bundle/deploy/readplan/serial-mismatch/test.toml
+++ b/acceptance/bundle/deploy/readplan/serial-mismatch/test.toml
@@ -1,3 +1,2 @@
 # Test that --plan with mismatched serial produces an error
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
 RecordRequests = false
diff --git a/acceptance/bundle/deploy/readplan/terraform-error/out.test.toml b/acceptance/bundle/deploy/readplan/terraform-error/out.test.toml
index 65156e0457c..a927a5fbc06 100644
--- a/acceptance/bundle/deploy/readplan/terraform-error/out.test.toml
+++ b/acceptance/bundle/deploy/readplan/terraform-error/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/deploy/readplan/terraform-error/output.txt b/acceptance/bundle/deploy/readplan/terraform-error/output.txt
index 63cfb10967e..a34b3d73259 100644
--- a/acceptance/bundle/deploy/readplan/terraform-error/output.txt
+++ b/acceptance/bundle/deploy/readplan/terraform-error/output.txt
@@ -1,4 +1,6 @@
-Error: --plan is only supported with direct engine (set bundle.engine to "direct" or DATABRICKS_BUNDLE_ENGINE=direct)
 
+>>> musterr [CLI] bundle deploy --plan plan.json
+Error: the Terraform deployment engine has been removed in Databricks CLI v1.20.0
 
-Exit code: 1
+Unset the DATABRICKS_BUNDLE_ENGINE environment variable (or set it to "direct") to deploy with the direct engine; existing Terraform state is migrated automatically. To keep using Terraform, revert to Databricks CLI v1.19.x.
+See https://docs.databricks.com/dev-tools/bundles/direct for details
diff --git a/acceptance/bundle/deploy/readplan/terraform-error/script b/acceptance/bundle/deploy/readplan/terraform-error/script
index 9a05b826834..6ba237b5e82 100644
--- a/acceptance/bundle/deploy/readplan/terraform-error/script
+++ b/acceptance/bundle/deploy/readplan/terraform-error/script
@@ -1 +1 @@
-$CLI bundle deploy --plan plan.json
+trace musterr $CLI bundle deploy --plan plan.json
diff --git a/acceptance/bundle/deploy/readplan/terraform-error/test.toml b/acceptance/bundle/deploy/readplan/terraform-error/test.toml
index c9ad2c68ec1..dbfefb54d28 100644
--- a/acceptance/bundle/deploy/readplan/terraform-error/test.toml
+++ b/acceptance/bundle/deploy/readplan/terraform-error/test.toml
@@ -1,2 +1,2 @@
 # Test that --plan with terraform engine produces an error
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform"]
+Env.DATABRICKS_BUNDLE_ENGINE = "terraform"
diff --git a/acceptance/bundle/deploy/readplan/unknown-field/out.plan.json b/acceptance/bundle/deploy/readplan/unknown-field/out.plan.json
index adbd7ee5972..f3bb802c4ff 100644
--- a/acceptance/bundle/deploy/readplan/unknown-field/out.plan.json
+++ b/acceptance/bundle/deploy/readplan/unknown-field/out.plan.json
@@ -1,6 +1,6 @@
 {
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
   "plan": {
     "resources.jobs.job": {
       "action_renamed": "create",
diff --git a/acceptance/bundle/deploy/readplan/unknown-field/out.test.toml b/acceptance/bundle/deploy/readplan/unknown-field/out.test.toml
index e90b6d5d1ba..a927a5fbc06 100644
--- a/acceptance/bundle/deploy/readplan/unknown-field/out.test.toml
+++ b/acceptance/bundle/deploy/readplan/unknown-field/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/deploy/readplan/unknown-field/script b/acceptance/bundle/deploy/readplan/unknown-field/script
index 6032a3ae34e..1b46c6694e7 100644
--- a/acceptance/bundle/deploy/readplan/unknown-field/script
+++ b/acceptance/bundle/deploy/readplan/unknown-field/script
@@ -1,5 +1,5 @@
 # Generate a plan
-trace $CLI bundle plan -o json > out.plan.json
+trace $CLI bundle plan -o json | nostamp > out.plan.json
 
 # Modify the plan to rename "action" field to "action_renamed"
 # This will create an unknown field that the strict decoder should reject
diff --git a/acceptance/bundle/deploy/readplan/unknown-field/test.toml b/acceptance/bundle/deploy/readplan/unknown-field/test.toml
deleted file mode 100644
index 0653828bd08..00000000000
--- a/acceptance/bundle/deploy/readplan/unknown-field/test.toml
+++ /dev/null
@@ -1,2 +0,0 @@
-# Test that --plan with unknown fields in the plan JSON produces an error
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/deploy/readplan/whl-not-uploaded/test.toml b/acceptance/bundle/deploy/readplan/whl-not-uploaded/test.toml
new file mode 100644
index 00000000000..ef13b156702
--- /dev/null
+++ b/acceptance/bundle/deploy/readplan/whl-not-uploaded/test.toml
@@ -0,0 +1,5 @@
+Badness = "bundle deploy --plan skips the build phase, so a local wheel referenced by a job is never uploaded and the job fails at runtime."
+
+# --plan is direct-engine only.
+RecordRequests = true
+Ignore = [".databricks", "tmp.plan.json"]
diff --git a/acceptance/bundle/deploy/readplan/whl-upload/databricks.yml b/acceptance/bundle/deploy/readplan/whl-upload/databricks.yml
new file mode 100644
index 00000000000..04070ec83d1
--- /dev/null
+++ b/acceptance/bundle/deploy/readplan/whl-upload/databricks.yml
@@ -0,0 +1,29 @@
+bundle:
+  name: whl-upload
+
+artifacts:
+  my_test_code:
+    type: whl
+    # Pre-built wheel with dynamic_version: true. deploy --plan reads the patched
+    # filename directly from the plan's new_state and finds the cached local file,
+    # so no build command or glob re-expansion is needed.
+    files:
+      - source: ./dist/*.whl
+    dynamic_version: true
+
+resources:
+  jobs:
+    my_job:
+      name: whl-upload-job
+      tasks:
+        - task_key: main
+          new_cluster:
+            spark_version: 15.4.x-scala2.12
+            node_type_id: Standard_DS3_v2
+            num_workers: 1
+          python_wheel_task:
+            package_name: my_test_code
+            entry_point: run
+          libraries:
+            # Local wheel, prebuilt (no build: step) to keep the test hermetic.
+            - whl: ./dist/*.whl
diff --git a/acceptance/bundle/deploy/readplan/whl-upload/dist/my_test_code-0.0.1-py3-none-any.whl b/acceptance/bundle/deploy/readplan/whl-upload/dist/my_test_code-0.0.1-py3-none-any.whl
new file mode 100644
index 00000000000..4bb80477caf
Binary files /dev/null and b/acceptance/bundle/deploy/readplan/whl-upload/dist/my_test_code-0.0.1-py3-none-any.whl differ
diff --git a/acceptance/bundle/deploy/readplan/whl-upload/out.plan.json b/acceptance/bundle/deploy/readplan/whl-upload/out.plan.json
new file mode 100644
index 00000000000..3cf6591f3cc
--- /dev/null
+++ b/acceptance/bundle/deploy/readplan/whl-upload/out.plan.json
@@ -0,0 +1,43 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.jobs.my_job": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/whl-upload/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "whl-upload-job",
+          "queue": {
+            "enabled": true
+          },
+          "tasks": [
+            {
+              "libraries": [
+                {
+                  "whl": "/Workspace/Users/[USERNAME]/.bundle/whl-upload/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS]-py3-none-any.whl"
+                }
+              ],
+              "new_cluster": {
+                "node_type_id": "Standard_DS3_v2",
+                "num_workers": 1,
+                "spark_version": "15.4.x-scala2.12"
+              },
+              "python_wheel_task": {
+                "entry_point": "run",
+                "package_name": "my_test_code"
+              },
+              "task_key": "main"
+            }
+          ]
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/deploy/readplan/whl-upload/out.test.toml b/acceptance/bundle/deploy/readplan/whl-upload/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/deploy/readplan/whl-upload/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deploy/readplan/whl-upload/output.txt b/acceptance/bundle/deploy/readplan/whl-upload/output.txt
new file mode 100644
index 00000000000..6b21d59c6b0
--- /dev/null
+++ b/acceptance/bundle/deploy/readplan/whl-upload/output.txt
@@ -0,0 +1,38 @@
+
+=== bundle deploy uploads the wheel
+>>> [CLI] bundle deploy
+Uploading .databricks/bundle/default/patched_wheels/my_test_code_my_test_code/my_test_code-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl...
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/whl-upload/default/files...
+Created jobs.my_job
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_workspace_imports
+/Workspace/Users/[USERNAME]/.bundle/whl-upload/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.my_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/whl-upload/default
+
+Destroy: 1 deleted
+
+=== bundle deploy --plan also uploads the wheel
+>>> [CLI] bundle deploy --plan tmp.plan.json
+Uploading .databricks/bundle/default/patched_wheels/my_test_code_my_test_code/my_test_code-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl...
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/whl-upload/default/files...
+Created jobs.my_job
+Files: 4 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_workspace_imports
+/Workspace/Users/[USERNAME]/.bundle/whl-upload/default/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.my_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/whl-upload/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/deploy/readplan/whl-upload/script b/acceptance/bundle/deploy/readplan/whl-upload/script
new file mode 100644
index 00000000000..15b0c9aa6c3
--- /dev/null
+++ b/acceptance/bundle/deploy/readplan/whl-upload/script
@@ -0,0 +1,26 @@
+# A local wheel referenced by a job library must be uploaded to its .../artifacts/.internal/
+# workspace path by both `bundle deploy` and `bundle deploy --plan`. Applying a saved plan
+# runs phases.FindLibraries to discover which local files to upload without re-running any
+# build commands. This test pins that both deploy paths upload the wheel identically.
+
+title "bundle deploy uploads the wheel"
+trace $CLI bundle deploy
+# The wheel was uploaded to its .../artifacts/.internal/ workspace path.
+trace print_workspace_imports | grep artifacts/.internal
+
+trace $CLI bundle destroy --auto-approve
+# Discard destroy's requests so the saved-plan deploy below starts from a clean recording.
+rm "$OUT_REQUESTS"
+
+title "bundle deploy --plan also uploads the wheel"
+# tmp.plan.json is the live plan (with features/serial for validation);
+# out.plan.json is the nostamp-stripped golden for cross-variant comparison.
+$CLI bundle plan -o json > tmp.plan.json
+$CLI bundle plan -o json | nostamp > out.plan.json
+trace $CLI bundle deploy --plan tmp.plan.json
+# The wheel is uploaded to the same .../artifacts/.internal/ path the job task points at,
+# matching the plain `bundle deploy` above.
+trace print_workspace_imports | grep artifacts/.internal
+
+trace $CLI bundle destroy --auto-approve
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/deploy/readplan/whl-upload/test.toml b/acceptance/bundle/deploy/readplan/whl-upload/test.toml
new file mode 100644
index 00000000000..aad8dfa67f1
--- /dev/null
+++ b/acceptance/bundle/deploy/readplan/whl-upload/test.toml
@@ -0,0 +1,5 @@
+# --plan is direct-engine only.
+# Saved plans don't carry the deployment stamp, so this test skips the DMS variant.
+EnvMatrix.DMS = [""]
+RecordRequests = true
+Ignore = [".databricks", "tmp.plan.json"]
diff --git a/acceptance/bundle/deploy/resource-max-wait-zero/databricks.yml b/acceptance/bundle/deploy/resource-max-wait-zero/databricks.yml
new file mode 100644
index 00000000000..dd5b5c0bf57
--- /dev/null
+++ b/acceptance/bundle/deploy/resource-max-wait-zero/databricks.yml
@@ -0,0 +1,15 @@
+bundle:
+  name: test-bundle
+
+# Nothing to sync: keeps the "Files:" line out of the output, which would otherwise
+# count whatever the harness has written into the test directory.
+sync:
+  paths: []
+
+resources:
+  clusters:
+    my_cluster:
+      cluster_name: test-cluster
+      spark_version: 13.3.x-scala2.12
+      node_type_id: i3.xlarge
+      num_workers: 1
diff --git a/acceptance/bundle/deploy/resource-max-wait-zero/out.test.toml b/acceptance/bundle/deploy/resource-max-wait-zero/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/deploy/resource-max-wait-zero/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/deploy/resource-max-wait-zero/output.txt b/acceptance/bundle/deploy/resource-max-wait-zero/output.txt
new file mode 100644
index 00000000000..1f379a5692e
--- /dev/null
+++ b/acceptance/bundle/deploy/resource-max-wait-zero/output.txt
@@ -0,0 +1,38 @@
+
+=== Zero cap: the create wait is skipped entirely
+>>> DATABRICKS_BUNDLE_RESOURCE_MAX_WAIT=0 [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Warn: deploying resources.clusters.my_cluster: Not waiting for creation of resources.clusters.my_cluster (DATABRICKS_BUNDLE_RESOURCE_MAX_WAIT=0); it may still be in progress
+Created clusters.my_cluster
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py --get --unique --oneline --del-field body,q //clusters
+{"method": "POST", "path": "/api/2.1/clusters/create"}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.clusters.my_cluster
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Destroy: 1 deleted
+
+=== No cap: the deployment polls until the cluster is RUNNING
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created clusters.my_cluster
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py --get --unique --oneline --del-field body,q //clusters
+{"method": "POST", "path": "/api/2.1/clusters/create"}
+{"method": "GET", "path": "/api/2.1/clusters/get"}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.clusters.my_cluster
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/deploy/resource-max-wait-zero/script b/acceptance/bundle/deploy/resource-max-wait-zero/script
new file mode 100644
index 00000000000..2ec5cee9bf9
--- /dev/null
+++ b/acceptance/bundle/deploy/resource-max-wait-zero/script
@@ -0,0 +1,23 @@
+cleanup() {
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+title "Zero cap: the create wait is skipped entirely"
+rm -f "$OUT_REQUESTS"
+trace DATABRICKS_BUNDLE_RESOURCE_MAX_WAIT=0 $CLI bundle deploy
+
+# Only the create POST is recorded. No GET means the cluster was left PENDING: the
+# testserver advances PENDING -> RUNNING on read, so a wait would have shown up here.
+# Method and path are the whole assertion; the body would only add churn.
+trace print_requests.py --get --unique --oneline --del-field body,q //clusters
+
+trace $CLI bundle destroy --auto-approve
+
+title "No cap: the deployment polls until the cluster is RUNNING"
+rm -f "$OUT_REQUESTS"
+trace $CLI bundle deploy
+
+trace print_requests.py --get --unique --oneline --del-field body,q //clusters
+
+trace $CLI bundle destroy --auto-approve
diff --git a/acceptance/bundle/deploy/resource-max-wait-zero/test.toml b/acceptance/bundle/deploy/resource-max-wait-zero/test.toml
new file mode 100644
index 00000000000..c906a3efc89
--- /dev/null
+++ b/acceptance/bundle/deploy/resource-max-wait-zero/test.toml
@@ -0,0 +1,8 @@
+# The cap is read by the direct engine only.
+
+RecordRequests = true
+
+# A cluster is created PENDING and only reaches RUNNING when something polls it
+# (see ClustersGet in libs/testserver), so the poll GET is what proves whether the
+# deployment waited.
+Ignore = [".databricks"]
diff --git a/acceptance/bundle/deploy/resource-max-wait/databricks.yml b/acceptance/bundle/deploy/resource-max-wait/databricks.yml
new file mode 100644
index 00000000000..2d641214acb
--- /dev/null
+++ b/acceptance/bundle/deploy/resource-max-wait/databricks.yml
@@ -0,0 +1,16 @@
+bundle:
+  name: test-bundle
+
+# Nothing to sync: keeps the "Files:" line out of the output, which would otherwise
+# count whatever the harness has written into the test directory.
+sync:
+  paths: []
+
+resources:
+  jobs:
+    my_job:
+      name: test-job
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: /Workspace/notebook
diff --git a/acceptance/bundle/deploy/resource-max-wait/out.test.toml b/acceptance/bundle/deploy/resource-max-wait/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/deploy/resource-max-wait/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/deploy/resource-max-wait/output.txt b/acceptance/bundle/deploy/resource-max-wait/output.txt
new file mode 100644
index 00000000000..9da7b2c014a
--- /dev/null
+++ b/acceptance/bundle/deploy/resource-max-wait/output.txt
@@ -0,0 +1,28 @@
+
+=== A malformed value is rejected instead of falling back to the default wait
+>>> DATABRICKS_BUNDLE_RESOURCE_MAX_WAIT=1m musterr [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Error: invalid DATABRICKS_BUNDLE_RESOURCE_MAX_WAIT="1m": expected a non-negative number of seconds
+
+Files: 0 uploaded, 0 deleted
+
+>>> DATABRICKS_BUNDLE_RESOURCE_MAX_WAIT=-5 musterr [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Error: invalid DATABRICKS_BUNDLE_RESOURCE_MAX_WAIT="-5": expected a non-negative number of seconds
+
+Files: 0 uploaded, 0 deleted
+
+=== A valid value is accepted
+>>> DATABRICKS_BUNDLE_RESOURCE_MAX_WAIT=60 [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created jobs.my_job
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.my_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/deploy/resource-max-wait/script b/acceptance/bundle/deploy/resource-max-wait/script
new file mode 100644
index 00000000000..937b27e936a
--- /dev/null
+++ b/acceptance/bundle/deploy/resource-max-wait/script
@@ -0,0 +1,8 @@
+title "A malformed value is rejected instead of falling back to the default wait"
+trace DATABRICKS_BUNDLE_RESOURCE_MAX_WAIT=1m musterr $CLI bundle deploy
+trace DATABRICKS_BUNDLE_RESOURCE_MAX_WAIT=-5 musterr $CLI bundle deploy
+
+title "A valid value is accepted"
+trace DATABRICKS_BUNDLE_RESOURCE_MAX_WAIT=60 $CLI bundle deploy
+
+trace $CLI bundle destroy --auto-approve
diff --git a/acceptance/bundle/deploy/snapshot-comparison/databricks.yml.tmpl b/acceptance/bundle/deploy/snapshot-comparison/databricks.yml.tmpl
deleted file mode 100644
index bcf33e49d8f..00000000000
--- a/acceptance/bundle/deploy/snapshot-comparison/databricks.yml.tmpl
+++ /dev/null
@@ -1,26 +0,0 @@
-bundle:
-  name: ${BUNDLE_NAME}
-
-workspace:
-  host: ${DATABRICKS_HOST}
-
-resources:
-  pipelines:
-    test_pipeline:
-      name: "Snapshot Test Pipeline ${BUNDLE_NAME}"
-      libraries:
-        - notebook:
-            path: "./pipeline_notebook.py"
-      development: true
-
-  jobs:
-    test_job:
-      name: "Snapshot Test Job ${BUNDLE_NAME}"
-      tasks:
-        - task_key: "pipeline_task"
-          pipeline_task:
-            pipeline_id: ${resources.pipelines.test_pipeline.id}
-
-targets:
-  default:
-    mode: development
diff --git a/acceptance/bundle/deploy/snapshot-comparison/notebook.py b/acceptance/bundle/deploy/snapshot-comparison/notebook.py
deleted file mode 100644
index 8cfae7c74fa..00000000000
--- a/acceptance/bundle/deploy/snapshot-comparison/notebook.py
+++ /dev/null
@@ -1,2 +0,0 @@
-# Databricks notebook source
-print("Test notebook")
diff --git a/acceptance/bundle/deploy/snapshot-comparison/out.test.toml b/acceptance/bundle/deploy/snapshot-comparison/out.test.toml
deleted file mode 100644
index 42c0997090a..00000000000
--- a/acceptance/bundle/deploy/snapshot-comparison/out.test.toml
+++ /dev/null
@@ -1,3 +0,0 @@
-Local = true
-Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform"]
diff --git a/acceptance/bundle/deploy/snapshot-comparison/output.txt b/acceptance/bundle/deploy/snapshot-comparison/output.txt
deleted file mode 100644
index 1db9fa5024d..00000000000
--- a/acceptance/bundle/deploy/snapshot-comparison/output.txt
+++ /dev/null
@@ -1,69 +0,0 @@
-
-=== Deploy bundle 1 with terraform
->>> DATABRICKS_BUNDLE_ENGINE=terraform [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/snapshot-test-1-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
-=== Run migrate on bundle 1
->>> [CLI] bundle deployment migrate
-Note: Migration should be done after a full deploy. Running plan now to verify that deployment was done:
-Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
-Success! Migrated 2 resources to direct engine state file: [TEST_TMP_DIR]/bundle1/.databricks/bundle/default/resources.json
-
-Validate the migration by running "databricks bundle plan", there should be no actions planned.
-
-The state file is not synchronized to the workspace yet. To do that and finalize the migration, run "bundle deploy".
-
-To undo the migration, remove [TEST_TMP_DIR]/bundle1/.databricks/bundle/default/resources.json and rename [TEST_TMP_DIR]/bundle1/.databricks/bundle/default/terraform/terraform.tfstate.backup to [TEST_TMP_DIR]/bundle1/.databricks/bundle/default/terraform/terraform.tfstate
-
-
-=== Deploy bundle 2 with terraform and YamlSync
->>> DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC=true DATABRICKS_BUNDLE_ENGINE=terraform [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/snapshot-test-2-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
-=== Normalize bundle names for comparison
->>> cp bundle1/.databricks/bundle/default/resources.json tmp.bundle1.json
-
->>> cp bundle2/.databricks/bundle/default/resources-config-sync-snapshot.json tmp.bundle2.json
-
->>> update_file.py tmp.bundle1.json snapshot-test-1- snapshot-test-NORMALIZED-
-
->>> update_file.py tmp.bundle2.json snapshot-test-2- snapshot-test-NORMALIZED-
-
-=== Compare normalized snapshots
->>> diff.py tmp.bundle1.json tmp.bundle2.json
-
-=== Cleanup bundle 1
->>> [CLI] bundle destroy --auto-approve
-The following resources will be deleted:
-  delete resources.jobs.test_job
-  delete resources.pipelines.test_pipeline
-
-This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
-Streaming Tables (STs) and Materialized Views (MVs) managed by them:
-  delete resources.pipelines.test_pipeline
-
-All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/snapshot-test-1-[UNIQUE_NAME]/default
-
-Deleting files...
-Destroy complete!
-
-=== Cleanup bundle 2
->>> [CLI] bundle destroy --auto-approve
-The following resources will be deleted:
-  delete resources.jobs.test_job
-  delete resources.pipelines.test_pipeline
-
-This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
-Streaming Tables (STs) and Materialized Views (MVs) managed by them:
-  delete resources.pipelines.test_pipeline
-
-All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/snapshot-test-2-[UNIQUE_NAME]/default
-
-Deleting files...
-Destroy complete!
diff --git a/acceptance/bundle/deploy/snapshot-comparison/pipeline_notebook.py b/acceptance/bundle/deploy/snapshot-comparison/pipeline_notebook.py
deleted file mode 100644
index 4dc99b53098..00000000000
--- a/acceptance/bundle/deploy/snapshot-comparison/pipeline_notebook.py
+++ /dev/null
@@ -1,2 +0,0 @@
-# Databricks notebook source
-print("Test pipeline notebook")
diff --git a/acceptance/bundle/deploy/snapshot-comparison/script b/acceptance/bundle/deploy/snapshot-comparison/script
deleted file mode 100755
index d15616e642a..00000000000
--- a/acceptance/bundle/deploy/snapshot-comparison/script
+++ /dev/null
@@ -1,42 +0,0 @@
-#!/bin/bash
-
-mkdir -p bundle1 bundle2
-
-export BUNDLE_NAME="snapshot-test-1-${UNIQUE_NAME}"
-envsubst < databricks.yml.tmpl > bundle1/databricks.yml
-cp notebook.py bundle1/
-cp pipeline_notebook.py bundle1/
-
-export BUNDLE_NAME="snapshot-test-2-${UNIQUE_NAME}"
-envsubst < databricks.yml.tmpl > bundle2/databricks.yml
-cp notebook.py bundle2/
-cp pipeline_notebook.py bundle2/
-
-cleanup() {
-    title "Cleanup bundle 1"
-    (cd bundle1 && unset DATABRICKS_BUNDLE_ENGINE && trace $CLI bundle destroy --auto-approve)
-    title "Cleanup bundle 2"
-    (cd bundle2 && unset DATABRICKS_BUNDLE_ENGINE && trace $CLI bundle destroy --auto-approve)
-
-    rm -f out.requests.txt
-}
-trap cleanup EXIT
-
-title "Deploy bundle 1 with terraform"
-(cd bundle1 && trace DATABRICKS_BUNDLE_ENGINE=terraform $CLI bundle deploy)
-
-title "Run migrate on bundle 1"
-(cd bundle1 && trace $CLI bundle deployment migrate 2>&1 | contains.py 'Migrated 2 resources')
-
-title "Deploy bundle 2 with terraform and YamlSync"
-(cd bundle2 && trace DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC=true DATABRICKS_BUNDLE_ENGINE=terraform $CLI bundle deploy)
-
-title "Normalize bundle names for comparison"
-trace cp bundle1/.databricks/bundle/default/resources.json tmp.bundle1.json
-trace cp bundle2/.databricks/bundle/default/resources-config-sync-snapshot.json tmp.bundle2.json
-
-trace update_file.py tmp.bundle1.json "snapshot-test-1-" "snapshot-test-NORMALIZED-"
-trace update_file.py tmp.bundle2.json "snapshot-test-2-" "snapshot-test-NORMALIZED-"
-
-title "Compare normalized snapshots"
-trace diff.py tmp.bundle1.json tmp.bundle2.json
diff --git a/acceptance/bundle/deploy/snapshot-comparison/test.toml b/acceptance/bundle/deploy/snapshot-comparison/test.toml
deleted file mode 100644
index 51bdb7525a9..00000000000
--- a/acceptance/bundle/deploy/snapshot-comparison/test.toml
+++ /dev/null
@@ -1,17 +0,0 @@
-Cloud = true
-
-RecordRequests = true
-
-Ignore = [
-    ".databricks",
-    "databricks.yml",
-    "tmp.*",
-    "bundle1",
-    "bundle2"
-]
-
-[Env]
-DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC = "true"
-
-[EnvMatrix]
-DATABRICKS_BUNDLE_ENGINE = ["terraform"]
diff --git a/acceptance/bundle/deploy/spark-jar-task/out.test.toml b/acceptance/bundle/deploy/spark-jar-task/out.test.toml
index bbc7fcfd1bd..0f167effef1 100644
--- a/acceptance/bundle/deploy/spark-jar-task/out.test.toml
+++ b/acceptance/bundle/deploy/spark-jar-task/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/deploy/spark-jar-task/output.txt b/acceptance/bundle/deploy/spark-jar-task/output.txt
index 3b556fbb60f..44db681765f 100644
--- a/acceptance/bundle/deploy/spark-jar-task/output.txt
+++ b/acceptance/bundle/deploy/spark-jar-task/output.txt
@@ -3,12 +3,12 @@
 Building my_java_code...
 Uploading myjar/PrintArgs.jar...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/spark-jar-task-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.jar_job
+Files: 6 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle run jar_job
-Run URL: [DATABRICKS_URL]/?o=[NUMID]#job/[NUMID]/run/[NUMID]
+Run URL: [DATABRICKS_URL]/jobs/[JAR_JOB_ID]/runs/[RUN_ID]?o=[WORKSPACE_ID]
 
 [TIMESTAMP] "[default] Test Spark Jar Job [UNIQUE_NAME]" RUNNING
 [TIMESTAMP] "[default] Test Spark Jar Job [UNIQUE_NAME]" TERMINATED SUCCESS
@@ -20,5 +20,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/spark-jar-task-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/deploy/spark-jar-task/script b/acceptance/bundle/deploy/spark-jar-task/script
index d736ca6bfae..3243e4767fc 100644
--- a/acceptance/bundle/deploy/spark-jar-task/script
+++ b/acceptance/bundle/deploy/spark-jar-task/script
@@ -1,4 +1,5 @@
 envsubst < databricks.yml.tmpl > databricks.yml
 trap "errcode trace '$CLI' bundle destroy --auto-approve" EXIT
 trace $CLI bundle deploy
+replace_ids.py
 trace $CLI bundle run jar_job
diff --git a/acceptance/bundle/deploy/spark-jar-task/test.toml b/acceptance/bundle/deploy/spark-jar-task/test.toml
index 86ea49e050c..6670a96c8c3 100644
--- a/acceptance/bundle/deploy/spark-jar-task/test.toml
+++ b/acceptance/bundle/deploy/spark-jar-task/test.toml
@@ -1,6 +1,4 @@
-Local = true
 Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
 
 Ignore = [
     'myjar/PrintArgs.jar',
@@ -15,3 +13,7 @@ Response.Body = '''
 	"logs": "Hello from Jar!\n[]"
 }
 '''
+
+[[Repls]]
+Old = '/runs/\d+'
+New = '/runs/[RUN_ID]'
diff --git a/acceptance/bundle/deploy/wal/chain-3-jobs/databricks.yml b/acceptance/bundle/deploy/wal/chain-3-jobs/databricks.yml
new file mode 100644
index 00000000000..342a4516235
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/chain-3-jobs/databricks.yml
@@ -0,0 +1,37 @@
+bundle:
+  name: wal-chain-test
+
+resources:
+  jobs:
+    # Linear chain: job_01 -> job_02 -> job_03
+    # Execution order: job_01 first, job_03 last
+    job_01:
+      name: "job-01"
+      description: "first in chain"
+      tasks:
+        - task_key: "task"
+          spark_python_task:
+            python_file: ./test.py
+          new_cluster:
+            spark_version: 15.4.x-scala2.12
+            node_type_id: i3.xlarge
+    job_02:
+      name: "job-02"
+      description: "depends on ${resources.jobs.job_01.id}"
+      tasks:
+        - task_key: "task"
+          spark_python_task:
+            python_file: ./test.py
+          new_cluster:
+            spark_version: 15.4.x-scala2.12
+            node_type_id: i3.xlarge
+    job_03:
+      name: "job-03"
+      description: "depends on ${resources.jobs.job_02.id}"
+      tasks:
+        - task_key: "task"
+          spark_python_task:
+            python_file: ./test.py
+          new_cluster:
+            spark_version: 15.4.x-scala2.12
+            node_type_id: i3.xlarge
diff --git a/acceptance/bundle/deploy/wal/chain-3-jobs/out.test.toml b/acceptance/bundle/deploy/wal/chain-3-jobs/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/chain-3-jobs/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deploy/wal/chain-3-jobs/output.txt b/acceptance/bundle/deploy/wal/chain-3-jobs/output.txt
new file mode 100644
index 00000000000..6923c5b3b79
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/chain-3-jobs/output.txt
@@ -0,0 +1,109 @@
+=== First deploy (crashes on job_03) ===
+
+>>> errcode [CLI] bundle deploy -q
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/wal-chain-test/default/files...
+[PROCESS_KILLED]
+
+Exit code: [KILLED]
+
+=== WAL content after crash ===
+{
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "state_version": 3
+}
+{
+  "k": "resources.jobs.job_01",
+  "v": {
+    "__id__": "[JOB_01_ID]",
+    "state": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/wal-chain-test/default/state/metadata.json"
+      },
+      "description": "first in chain",
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "job-01",
+      "queue": {
+        "enabled": true
+      },
+      "tasks": [
+        {
+          "new_cluster": {
+            "node_type_id": "[NODE_TYPE_ID]",
+            "spark_version": "15.4.x-scala2.12"
+          },
+          "spark_python_task": {
+            "python_file": "/Workspace/Users/[USERNAME]/.bundle/wal-chain-test/default/files/test.py"
+          },
+          "task_key": "task"
+        }
+      ]
+    }
+  }
+}
+{
+  "k": "resources.jobs.job_02",
+  "v": {
+    "__id__": "[JOB_02_ID]",
+    "depends_on": [
+      {
+        "label": "${resources.jobs.job_01.id}",
+        "node": "resources.jobs.job_01"
+      }
+    ],
+    "state": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/wal-chain-test/default/state/metadata.json"
+      },
+      "description": "depends on [JOB_01_ID]",
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "job-02",
+      "queue": {
+        "enabled": true
+      },
+      "tasks": [
+        {
+          "new_cluster": {
+            "node_type_id": "[NODE_TYPE_ID]",
+            "spark_version": "15.4.x-scala2.12"
+          },
+          "spark_python_task": {
+            "python_file": "/Workspace/Users/[USERNAME]/.bundle/wal-chain-test/default/files/test.py"
+          },
+          "task_key": "task"
+        }
+      ]
+    }
+  }
+}
+
+=== Number of jobs saved in WAL ===
+2
+
+=== Bundle summary (reads from WAL) ===
+Name: wal-chain-test
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/wal-chain-test/default
+Resources:
+  Jobs:
+    job_01:
+      Name: job-01
+      URL:  [DATABRICKS_URL]/jobs/[JOB_01_ID]?w=[WORKSPACE_ID]
+    job_02:
+      Name: job-02
+      URL:  [DATABRICKS_URL]/jobs/[JOB_02_ID]?w=[WORKSPACE_ID]
+    job_03:
+      Name: job-03
+      URL:  (not deployed)
+
+=== WAL after successful deploy ===
+WAL deleted (expected)
diff --git a/acceptance/bundle/deploy/wal/chain-3-jobs/script b/acceptance/bundle/deploy/wal/chain-3-jobs/script
new file mode 100644
index 00000000000..990d015d386
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/chain-3-jobs/script
@@ -0,0 +1,27 @@
+# Linear chain: job_01 -> job_02 -> job_03
+# Let first 2 jobs/create succeed, then kill on the 3rd
+kill_after.py "POST /api/2.2/jobs/create" 2 1
+
+echo "=== First deploy (crashes on job_03) ==="
+# -q: the per-resource "Created" lines race the kill signal, so which of them flush
+# before the process dies is not stable (notably on Windows). This test asserts WAL
+# content, not deploy stdout.
+trace errcode $CLI bundle deploy -q
+
+echo ""
+echo "=== WAL content after crash ==="
+jq -S . .databricks/bundle/default/resources.json.wal 2>/dev/null | nostamp || echo "No WAL file"
+
+echo ""
+echo "=== Number of jobs saved in WAL ==="
+grep -c '"k":"resources.jobs' .databricks/bundle/default/resources.json.wal 2>/dev/null || echo "0"
+
+echo ""
+echo "=== Bundle summary (reads from WAL) ==="
+$CLI bundle summary
+
+echo ""
+echo "=== WAL after successful deploy ==="
+cat .databricks/bundle/default/resources.json.wal 2>/dev/null || echo "WAL deleted (expected)"
+
+replace_ids.py
diff --git a/acceptance/bundle/deploy/wal/chain-3-jobs/test.py b/acceptance/bundle/deploy/wal/chain-3-jobs/test.py
new file mode 100644
index 00000000000..1ff8e07c707
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/chain-3-jobs/test.py
@@ -0,0 +1 @@
+print("test")
diff --git a/acceptance/bundle/deploy/wal/corrupted-wal-entry/databricks.yml b/acceptance/bundle/deploy/wal/corrupted-wal-entry/databricks.yml
new file mode 100644
index 00000000000..a7a5cc2dfe0
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/corrupted-wal-entry/databricks.yml
@@ -0,0 +1,23 @@
+bundle:
+  name: wal-corrupted-test
+
+resources:
+  jobs:
+    valid_job:
+      name: "valid-job"
+      tasks:
+        - task_key: "task-a"
+          spark_python_task:
+            python_file: ./test.py
+          new_cluster:
+            spark_version: 15.4.x-scala2.12
+            node_type_id: i3.xlarge
+    another_valid:
+      name: "another-valid"
+      tasks:
+        - task_key: "task-b"
+          spark_python_task:
+            python_file: ./test.py
+          new_cluster:
+            spark_version: 15.4.x-scala2.12
+            node_type_id: i3.xlarge
diff --git a/acceptance/bundle/deploy/wal/corrupted-wal-entry/out.test.toml b/acceptance/bundle/deploy/wal/corrupted-wal-entry/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/corrupted-wal-entry/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deploy/wal/corrupted-wal-entry/output.txt b/acceptance/bundle/deploy/wal/corrupted-wal-entry/output.txt
new file mode 100644
index 00000000000..5e382cadfce
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/corrupted-wal-entry/output.txt
@@ -0,0 +1,35 @@
+
+>>> cat .databricks/bundle/default/resources.json.wal
+{"lineage":"test-lineage-123","serial":6}
+{"k":"resources.jobs.valid_job","v":{"__id__":"","state":{"name":"valid-job"}}}
+{"k":"resources.jobs.another_valid","v":{"__id__":"","state":{"name":"another-valid"}}}
+{"k":"resources.jobs.partial_write","v":{"__id__":"33","state":{"name":"partial-
+
+>>> [CLI] bundle deploy
+Warn: Skipping corrupted WAL entry at [TEST_TMP_DIR]/.databricks/bundle/default/resources.json.wal:4: unexpected end of JSON input
+Warn: Saved 1 corrupted WAL entries to [TEST_TMP_DIR]/.databricks/bundle/default/resources.json.wal.corrupted
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/wal-corrupted-test/default/files...
+Created jobs.another_valid
+Created jobs.valid_job
+Files: 4 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] bundle summary
+Name: wal-corrupted-test
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/wal-corrupted-test/default
+Resources:
+  Jobs:
+    another_valid:
+      Name: another-valid
+      URL:  [DATABRICKS_URL]/jobs/[ANOTHER_VALID_ID]?w=[WORKSPACE_ID]
+    valid_job:
+      Name: valid-job
+      URL:  [DATABRICKS_URL]/jobs/[VALID_JOB_ID]?w=[WORKSPACE_ID]
+
+>>> cat .databricks/bundle/default/resources.json.wal.corrupted
+{"k":"resources.jobs.partial_write","v":{"__id__":"33","state":{"name":"partial-
+=== WAL after successful deploy ===
+WAL deleted (expected)
diff --git a/acceptance/bundle/deploy/wal/corrupted-wal-entry/resources.json b/acceptance/bundle/deploy/wal/corrupted-wal-entry/resources.json
new file mode 100644
index 00000000000..f9f4e54d1ed
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/corrupted-wal-entry/resources.json
@@ -0,0 +1,7 @@
+{
+  "state_version": 1,
+  "cli_version": "0.0.0",
+  "lineage": "test-lineage-123",
+  "serial": 5,
+  "state": {}
+}
diff --git a/acceptance/bundle/deploy/wal/corrupted-wal-entry/resources.json.wal.tmpl b/acceptance/bundle/deploy/wal/corrupted-wal-entry/resources.json.wal.tmpl
new file mode 100644
index 00000000000..7ef5773a4ea
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/corrupted-wal-entry/resources.json.wal.tmpl
@@ -0,0 +1,4 @@
+{"lineage":"test-lineage-123","serial":6}
+{"k":"resources.jobs.valid_job","v":{"__id__":"$JOB1","state":{"name":"valid-job"}}}
+{"k":"resources.jobs.another_valid","v":{"__id__":"$JOB2","state":{"name":"another-valid"}}}
+{"k":"resources.jobs.partial_write","v":{"__id__":"33","state":{"name":"partial-
diff --git a/acceptance/bundle/deploy/wal/corrupted-wal-entry/script b/acceptance/bundle/deploy/wal/corrupted-wal-entry/script
new file mode 100644
index 00000000000..a3584ddb809
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/corrupted-wal-entry/script
@@ -0,0 +1,23 @@
+# Create pre-existing jobs in the testserver so WAL recovery triggers DoUpdate (reset) instead of DoCreate
+JOB1=$($CLI jobs create --json '{"name":"valid-job"}' | jq -r '.job_id')
+JOB2=$($CLI jobs create --json '{"name":"another-valid"}' | jq -r '.job_id')
+add_repl "$JOB1" JOB1_ID
+add_repl "$JOB2" JOB2_ID
+
+mkdir -p .databricks/bundle/default
+cp resources.json .databricks/bundle/default/
+
+envsubst < resources.json.wal.tmpl > .databricks/bundle/default/resources.json.wal
+
+trace cat .databricks/bundle/default/resources.json.wal
+trace $CLI bundle deploy
+replace_ids.py
+trace $CLI bundle summary
+trace cat .databricks/bundle/default/resources.json.wal.corrupted
+
+printf "\n=== WAL after successful deploy ===\n"
+if [ -f ".databricks/bundle/default/resources.json.wal" ]; then
+    echo "WAL exists (unexpected)"
+else
+    echo "WAL deleted (expected)"
+fi
diff --git a/acceptance/bundle/deploy/wal/corrupted-wal-entry/test.py b/acceptance/bundle/deploy/wal/corrupted-wal-entry/test.py
new file mode 100644
index 00000000000..1ff8e07c707
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/corrupted-wal-entry/test.py
@@ -0,0 +1 @@
+print("test")
diff --git a/acceptance/bundle/deploy/wal/corrupted-wal-entry/test.toml b/acceptance/bundle/deploy/wal/corrupted-wal-entry/test.toml
new file mode 100644
index 00000000000..921045dfd09
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/corrupted-wal-entry/test.toml
@@ -0,0 +1,4 @@
+# Recording needs a bundle it has seen from the start. This test seeds a state file,
+# so recording refuses it. TODO(DMS): drop this once existing state can be
+# handed over to the service (see the TODO in dstate.Open).
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deploy/wal/crash-after-create/databricks.yml b/acceptance/bundle/deploy/wal/crash-after-create/databricks.yml
new file mode 100644
index 00000000000..25b2efe2f8c
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/crash-after-create/databricks.yml
@@ -0,0 +1,25 @@
+bundle:
+  name: wal-crash-test
+
+resources:
+  jobs:
+    job_a:
+      name: "test-job-a"
+      description: "first job"
+      tasks:
+        - task_key: "task-a"
+          spark_python_task:
+            python_file: ./test.py
+          new_cluster:
+            spark_version: 15.4.x-scala2.12
+            node_type_id: i3.xlarge
+    job_b:
+      name: "test-job-b"
+      description: "depends on ${resources.jobs.job_a.id}"
+      tasks:
+        - task_key: "task-b"
+          spark_python_task:
+            python_file: ./test.py
+          new_cluster:
+            spark_version: 15.4.x-scala2.12
+            node_type_id: i3.xlarge
diff --git a/acceptance/bundle/deploy/wal/crash-after-create/out.test.toml b/acceptance/bundle/deploy/wal/crash-after-create/out.test.toml
new file mode 100644
index 00000000000..28505c1acaa
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/crash-after-create/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.COMMAND = ["plan", "deploy --force-lock", "summary"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deploy/wal/crash-after-create/output.txt b/acceptance/bundle/deploy/wal/crash-after-create/output.txt
new file mode 100644
index 00000000000..7c07a54e9ff
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/crash-after-create/output.txt
@@ -0,0 +1,56 @@
+=== First deploy (crashes after job_a create, before job_b) ===
+
+>>> errcode [CLI] bundle deploy -q
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/wal-crash-test/default/files...
+[PROCESS_KILLED]
+
+Exit code: [KILLED]
+
+>>> assert_exists.py .databricks/bundle/default/resources.json.wal
+
+>>> assert_not_exists.py .databricks/bundle/default/resources.json
+
+>>> cat .databricks/bundle/default/resources.json.wal
+{
+  "state_version": 3,
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1
+}
+{
+  "k": "resources.jobs.job_a",
+  "v": {
+    "__id__": "[JOB_A_ID]",
+    "state": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/wal-crash-test/default/state/metadata.json"
+      },
+      "description": "first job",
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "test-job-a",
+      "queue": {
+        "enabled": true
+      },
+      "tasks": [
+        {
+          "new_cluster": {
+            "node_type_id": "[NODE_TYPE_ID]",
+            "spark_version": "15.4.x-scala2.12"
+          },
+          "spark_python_task": {
+            "python_file": "/Workspace/Users/[USERNAME]/.bundle/wal-crash-test/default/files/test.py"
+          },
+          "task_key": "task-a"
+        }
+      ]
+    }
+  }
+}
+
+=== Any other command recovers state
+>>> assert_exists.py .databricks/bundle/default/resources.json
+
+>>> assert_not_exists.py .databricks/bundle/default/resources.json.wal
diff --git a/acceptance/bundle/deploy/wal/crash-after-create/script b/acceptance/bundle/deploy/wal/crash-after-create/script
new file mode 100644
index 00000000000..f43b5378392
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/crash-after-create/script
@@ -0,0 +1,21 @@
+# WAL recovery after real crash. First deploy creates job_a then crashes.
+# Second deploy recovers from WAL and completes successfully.
+# job_b depends on job_a, so jobs/get is called after job_a's SaveState.
+kill_after.py "POST /api/2.2/jobs/create" 1 1
+
+echo "=== First deploy (crashes after job_a create, before job_b) ==="
+# -q: the per-resource "Created" line races the kill signal, so whether it flushes
+# before the process dies is not stable (notably on Windows). This test asserts WAL
+# content, not deploy stdout.
+trace errcode $CLI bundle deploy -q
+
+trace assert_exists.py .databricks/bundle/default/resources.json.wal
+trace assert_not_exists.py .databricks/bundle/default/resources.json
+trace cat .databricks/bundle/default/resources.json.wal | jq | nostamp
+
+title "Any other command recovers state"
+$CLI bundle $COMMAND &> LOG.COMMAND.txt
+
+trace assert_exists.py .databricks/bundle/default/resources.json
+trace assert_not_exists.py .databricks/bundle/default/resources.json.wal
+replace_ids.py
diff --git a/acceptance/bundle/deploy/wal/crash-after-create/test.py b/acceptance/bundle/deploy/wal/crash-after-create/test.py
new file mode 100644
index 00000000000..1ff8e07c707
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/crash-after-create/test.py
@@ -0,0 +1 @@
+print("test")
diff --git a/acceptance/bundle/deploy/wal/crash-after-create/test.toml b/acceptance/bundle/deploy/wal/crash-after-create/test.toml
new file mode 100644
index 00000000000..ecd87c31a8b
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/crash-after-create/test.toml
@@ -0,0 +1,2 @@
+EnvMatrix.COMMAND = ["plan", "deploy --force-lock", "summary"]
+EnvRepl.COMMAND = false
diff --git a/acceptance/bundle/deploy/wal/empty-wal/databricks.yml b/acceptance/bundle/deploy/wal/empty-wal/databricks.yml
new file mode 100644
index 00000000000..8da92255ff1
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/empty-wal/databricks.yml
@@ -0,0 +1,14 @@
+bundle:
+  name: wal-empty-test
+
+resources:
+  jobs:
+    test_job:
+      name: "test-job"
+      tasks:
+        - task_key: "test-task"
+          spark_python_task:
+            python_file: ./test.py
+          new_cluster:
+            spark_version: 15.4.x-scala2.12
+            node_type_id: i3.xlarge
diff --git a/acceptance/bundle/deploy/wal/empty-wal/out.test.toml b/acceptance/bundle/deploy/wal/empty-wal/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/empty-wal/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deploy/wal/empty-wal/output.txt b/acceptance/bundle/deploy/wal/empty-wal/output.txt
new file mode 100644
index 00000000000..5cf7b67fe67
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/empty-wal/output.txt
@@ -0,0 +1,6 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/wal-empty-test/default/files...
+Created jobs.test_job
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
diff --git a/acceptance/bundle/deploy/wal/empty-wal/script b/acceptance/bundle/deploy/wal/empty-wal/script
new file mode 100644
index 00000000000..ac104951c58
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/empty-wal/script
@@ -0,0 +1,4 @@
+mkdir -p .databricks/bundle/default
+touch .databricks/bundle/default/resources.json.wal
+trace $CLI bundle deploy
+assert_not_exists.py .databricks/bundle/default/resources.json.wal*
diff --git a/acceptance/bundle/deploy/wal/empty-wal/test.py b/acceptance/bundle/deploy/wal/empty-wal/test.py
new file mode 100644
index 00000000000..11b15b1a458
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/empty-wal/test.py
@@ -0,0 +1 @@
+print("hello")
diff --git a/acceptance/bundle/deploy/wal/empty-wal/test.toml b/acceptance/bundle/deploy/wal/empty-wal/test.toml
new file mode 100644
index 00000000000..ad64cd6e746
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/empty-wal/test.toml
@@ -0,0 +1,13 @@
+# Empty WAL file should be moved to .wal.corrupted and deploy should proceed normally.
+
+[[Server]]
+Pattern = "POST /api/2.2/jobs/create"
+Response.Body = '{"job_id": 1001}'
+
+[[Server]]
+Pattern = "GET /api/2.2/jobs/get"
+Response.Body = '{"job_id": 1001, "settings": {"name": "test-job"}}'
+
+[[Repls]]
+Old = '-rw[^\s]+\s+\d+\s+[^\s]+\s+[^\s]+\s+\d+\s+[A-Z][a-z]+\s+\d+\s+\d+:\d+'
+New = '[FILE_INFO]'
diff --git a/acceptance/bundle/deploy/wal/failed-plan-no-wal/databricks.yml b/acceptance/bundle/deploy/wal/failed-plan-no-wal/databricks.yml
new file mode 100644
index 00000000000..b0d3c1cbca3
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/failed-plan-no-wal/databricks.yml
@@ -0,0 +1,14 @@
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    test_job:
+      name: "test-job"
+      tasks:
+        - task_key: "test-task"
+          spark_python_task:
+            python_file: ./test.py
+          new_cluster:
+            spark_version: 15.4.x-scala2.12
+            node_type_id: i3.xlarge
diff --git a/acceptance/bundle/deploy/wal/failed-plan-no-wal/out.test.toml b/acceptance/bundle/deploy/wal/failed-plan-no-wal/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/failed-plan-no-wal/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deploy/wal/failed-plan-no-wal/output.txt b/acceptance/bundle/deploy/wal/failed-plan-no-wal/output.txt
new file mode 100644
index 00000000000..f1b616e23af
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/failed-plan-no-wal/output.txt
@@ -0,0 +1,49 @@
+
+=== Deploy 1 (normal: creates the job and the committed state)
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created jobs.test_job
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Deploy 2 (planning fails, must not leave a WAL)
+>>> errcode [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Error: cannot plan resources.jobs.test_job: reading id="[TEST_JOB_ID]": Fault injected by test. (403 INJECTED)
+
+Endpoint: GET [DATABRICKS_URL]/api/2.2/jobs/get?job_id=[TEST_JOB_ID]
+HTTP Status: 403 Forbidden
+API error_code: INJECTED
+API message: Fault injected by test.
+
+Error: planning failed
+
+Files: 0 uploaded, 0 deleted
+
+Exit code: 1
+
+>>> assert_not_exists.py .databricks/bundle/default/resources.json.wal
+
+=== Deploy 3 (planning fails again, must not leave a WAL)
+>>> errcode [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Error: cannot plan resources.jobs.test_job: reading id="[TEST_JOB_ID]": Fault injected by test. (403 INJECTED)
+
+Endpoint: GET [DATABRICKS_URL]/api/2.2/jobs/get?job_id=[TEST_JOB_ID]
+HTTP Status: 403 Forbidden
+API error_code: INJECTED
+API message: Fault injected by test.
+
+Error: planning failed
+
+Files: 0 uploaded, 0 deleted
+
+Exit code: 1
+
+>>> assert_not_exists.py .databricks/bundle/default/resources.json.wal
+
+=== Deploy 4 (fault expired: recovers and succeeds)
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
diff --git a/acceptance/bundle/deploy/wal/failed-plan-no-wal/script b/acceptance/bundle/deploy/wal/failed-plan-no-wal/script
new file mode 100644
index 00000000000..381d8d647bc
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/failed-plan-no-wal/script
@@ -0,0 +1,30 @@
+# A failed plan must not leave a write-ahead log behind, so repeated planning
+# failures never block a later, healthy deploy. Previously a failed plan still
+# opened the WAL for write (UpgradeToWrite) and returned without finalizing,
+# leaving a header-only WAL; after two failures the WAL serial drifted two ahead
+# of the committed serial and every later command failed WAL recovery until the
+# WAL was deleted by hand.
+#
+# A first deploy creates the job normally. An injected fault then makes the next
+# two deploys fail while planning (planning refreshes the existing job via
+# jobs/get). The final deploy, with the fault expired, must recover and succeed.
+# A non-retried 403 is used so the failure is immediate; a 5xx would be retried
+# with backoff.
+
+title "Deploy 1 (normal: creates the job and the committed state)"
+trace $CLI bundle deploy
+replace_ids.py
+
+# Fail the plan-stage refresh GET for the next two deploys only.
+fault.py "GET /api/2.2/jobs/get" 403 0 2
+
+title "Deploy 2 (planning fails, must not leave a WAL)"
+trace errcode $CLI bundle deploy
+trace assert_not_exists.py .databricks/bundle/default/resources.json.wal
+
+title "Deploy 3 (planning fails again, must not leave a WAL)"
+trace errcode $CLI bundle deploy
+trace assert_not_exists.py .databricks/bundle/default/resources.json.wal
+
+title "Deploy 4 (fault expired: recovers and succeeds)"
+trace $CLI bundle deploy
diff --git a/acceptance/bundle/deploy/wal/failed-plan-no-wal/test.py b/acceptance/bundle/deploy/wal/failed-plan-no-wal/test.py
new file mode 100644
index 00000000000..1ff8e07c707
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/failed-plan-no-wal/test.py
@@ -0,0 +1 @@
+print("test")
diff --git a/acceptance/bundle/deploy/wal/future-serial-wal/databricks.yml b/acceptance/bundle/deploy/wal/future-serial-wal/databricks.yml
new file mode 100644
index 00000000000..56fa1313376
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/future-serial-wal/databricks.yml
@@ -0,0 +1,14 @@
+bundle:
+  name: wal-future-serial-test
+
+resources:
+  jobs:
+    test_job:
+      name: "test-job"
+      tasks:
+        - task_key: "test-task"
+          spark_python_task:
+            python_file: ./test.py
+          new_cluster:
+            spark_version: 15.4.x-scala2.12
+            node_type_id: i3.xlarge
diff --git a/acceptance/bundle/deploy/wal/future-serial-wal/out.test.toml b/acceptance/bundle/deploy/wal/future-serial-wal/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/future-serial-wal/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deploy/wal/future-serial-wal/output.txt b/acceptance/bundle/deploy/wal/future-serial-wal/output.txt
new file mode 100644
index 00000000000..48c23ddf84f
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/future-serial-wal/output.txt
@@ -0,0 +1,10 @@
+=== WAL content ===
+{"lineage":"test-lineage-123","serial":5}
+{"k":"resources.jobs.test_job","v":{"__id__":"1001","state":{"name":"test-job"}}}
+=== Deploy (should fail with corruption error) ===
+
+>>> errcode [CLI] bundle deploy
+Error: reading state from [TEST_TMP_DIR]/.databricks/bundle/default/resources.json: WAL recovery failed: WAL serial (5) is ahead of expected (3), state may be corrupted
+
+
+Exit code: 1
diff --git a/acceptance/bundle/deploy/wal/future-serial-wal/resources.json b/acceptance/bundle/deploy/wal/future-serial-wal/resources.json
new file mode 100644
index 00000000000..f2f06b34bf4
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/future-serial-wal/resources.json
@@ -0,0 +1,12 @@
+{
+  "state_version": 1,
+  "cli_version": "0.0.0",
+  "lineage": "test-lineage-123",
+  "serial": 2,
+  "state": {
+    "resources.jobs.test_job": {
+      "__id__": "1001",
+      "state": {"name": "test-job"}
+    }
+  }
+}
diff --git a/acceptance/bundle/deploy/wal/future-serial-wal/resources.json.wal b/acceptance/bundle/deploy/wal/future-serial-wal/resources.json.wal
new file mode 100644
index 00000000000..98a8e48802b
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/future-serial-wal/resources.json.wal
@@ -0,0 +1,2 @@
+{"lineage":"test-lineage-123","serial":5}
+{"k":"resources.jobs.test_job","v":{"__id__":"1001","state":{"name":"test-job"}}}
diff --git a/acceptance/bundle/deploy/wal/future-serial-wal/script b/acceptance/bundle/deploy/wal/future-serial-wal/script
new file mode 100644
index 00000000000..f7a57192255
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/future-serial-wal/script
@@ -0,0 +1,9 @@
+mkdir -p .databricks/bundle/default
+cp resources.json .databricks/bundle/default/
+cp resources.json.wal .databricks/bundle/default/
+
+echo "=== WAL content ==="
+cat .databricks/bundle/default/resources.json.wal
+
+echo "=== Deploy (should fail with corruption error) ==="
+trace errcode $CLI bundle deploy
diff --git a/acceptance/bundle/deploy/wal/future-serial-wal/test.py b/acceptance/bundle/deploy/wal/future-serial-wal/test.py
new file mode 100644
index 00000000000..1ff8e07c707
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/future-serial-wal/test.py
@@ -0,0 +1 @@
+print("test")
diff --git a/acceptance/bundle/deploy/wal/header-only-wal/databricks.yml b/acceptance/bundle/deploy/wal/header-only-wal/databricks.yml
new file mode 100644
index 00000000000..b0d3c1cbca3
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/header-only-wal/databricks.yml
@@ -0,0 +1,14 @@
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    test_job:
+      name: "test-job"
+      tasks:
+        - task_key: "test-task"
+          spark_python_task:
+            python_file: ./test.py
+          new_cluster:
+            spark_version: 15.4.x-scala2.12
+            node_type_id: i3.xlarge
diff --git a/acceptance/bundle/deploy/wal/header-only-wal/out.test.toml b/acceptance/bundle/deploy/wal/header-only-wal/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/header-only-wal/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deploy/wal/header-only-wal/output.txt b/acceptance/bundle/deploy/wal/header-only-wal/output.txt
new file mode 100644
index 00000000000..86ca2583663
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/header-only-wal/output.txt
@@ -0,0 +1,37 @@
+
+=== First deploy (killed before recording the job, leaves a header-only WAL)
+>>> errcode [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+[PROCESS_KILLED]
+
+Exit code: [KILLED]
+
+>>> cat .databricks/bundle/default/resources.json.wal
+{"state_version":3,"cli_version":"[CLI_VERSION]","lineage":"[UUID]","serial":1}
+
+=== Second deploy (killed again, leaves another header-only WAL)
+>>> errcode [CLI] bundle deploy --force-lock
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+[PROCESS_KILLED]
+
+Exit code: [KILLED]
+
+>>> cat .databricks/bundle/default/resources.json.wal
+{"state_version":3,"cli_version":"[CLI_VERSION]","lineage":"[UUID]","serial":1}
+
+=== Third deploy (must recover and succeed, not blocked by the leftover WAL)
+>>> errcode [CLI] bundle deploy --force-lock
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created jobs.test_job
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> errcode assert_not_exists.py .databricks/bundle/default/resources.json.wal
+
+>>> errcode print_state.py
+{
+  "serial": 1,
+  "state_keys": [
+    "resources.jobs.test_job"
+  ]
+}
diff --git a/acceptance/bundle/deploy/wal/header-only-wal/script b/acceptance/bundle/deploy/wal/header-only-wal/script
new file mode 100644
index 00000000000..557fc7d4f47
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/header-only-wal/script
@@ -0,0 +1,22 @@
+# Two consecutive deploys are killed mid-apply, after UpgradeToWrite has written
+# the WAL header but before Finalize runs (killed on the jobs/create call, before
+# the job's state is recorded). A kill cannot be prevented by bailing out early,
+# so each crash leaves a header-only WAL behind. Recovery must discard those
+# no-op WALs without advancing the serial; otherwise the second crash would write
+# its WAL header two serials ahead of the committed state and block every later
+# command. Regression test for the dstate recovery fix.
+kill_after.py "POST /api/2.2/jobs/create" 0 2
+
+title "First deploy (killed before recording the job, leaves a header-only WAL)"
+trace errcode $CLI bundle deploy
+trace cat .databricks/bundle/default/resources.json.wal
+
+title "Second deploy (killed again, leaves another header-only WAL)"
+trace errcode $CLI bundle deploy --force-lock
+trace cat .databricks/bundle/default/resources.json.wal
+
+title "Third deploy (must recover and succeed, not blocked by the leftover WAL)"
+trace errcode $CLI bundle deploy --force-lock
+
+trace errcode assert_not_exists.py .databricks/bundle/default/resources.json.wal
+trace errcode print_state.py | jq -S '{serial: .serial, state_keys: (.state | keys)}'
diff --git a/acceptance/bundle/deploy/wal/header-only-wal/test.py b/acceptance/bundle/deploy/wal/header-only-wal/test.py
new file mode 100644
index 00000000000..1ff8e07c707
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/header-only-wal/test.py
@@ -0,0 +1 @@
+print("test")
diff --git a/acceptance/bundle/deploy/wal/lineage-mismatch/databricks.yml b/acceptance/bundle/deploy/wal/lineage-mismatch/databricks.yml
new file mode 100644
index 00000000000..32461d14676
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/lineage-mismatch/databricks.yml
@@ -0,0 +1,14 @@
+bundle:
+  name: wal-lineage-mismatch-test
+
+resources:
+  jobs:
+    test_job:
+      name: "test-job"
+      tasks:
+        - task_key: "test-task"
+          spark_python_task:
+            python_file: ./test.py
+          new_cluster:
+            spark_version: 15.4.x-scala2.12
+            node_type_id: i3.xlarge
diff --git a/acceptance/bundle/deploy/wal/lineage-mismatch/out.test.toml b/acceptance/bundle/deploy/wal/lineage-mismatch/out.test.toml
new file mode 100644
index 00000000000..93e96ab2a1b
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/lineage-mismatch/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.COMMAND = ["deploy", "plan", "summary"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deploy/wal/lineage-mismatch/output.txt b/acceptance/bundle/deploy/wal/lineage-mismatch/output.txt
new file mode 100644
index 00000000000..43f8cf6931f
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/lineage-mismatch/output.txt
@@ -0,0 +1,7 @@
+Any command should fail with lineage mismatch error
+Error: reading state from [TEST_TMP_DIR]/.databricks/bundle/default/resources.json: WAL recovery failed: WAL lineage ("wal-lineage-bbb") does not match state lineage ("state-lineage-aaa")
+
+
+>>> musterr [CLI] bundle destroy --auto-approve
+Error: reading state from [TEST_TMP_DIR]/.databricks/bundle/default/resources.json: WAL recovery failed: WAL lineage ("wal-lineage-bbb") does not match state lineage ("state-lineage-aaa")
+
diff --git a/acceptance/bundle/deploy/wal/lineage-mismatch/resources.json b/acceptance/bundle/deploy/wal/lineage-mismatch/resources.json
new file mode 100644
index 00000000000..444a9ea888d
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/lineage-mismatch/resources.json
@@ -0,0 +1,12 @@
+{
+  "state_version": 1,
+  "cli_version": "0.0.0",
+  "lineage": "state-lineage-aaa",
+  "serial": 1,
+  "state": {
+    "resources.jobs.test_job": {
+      "__id__": "1001",
+      "state": {"name": "test-job"}
+    }
+  }
+}
diff --git a/acceptance/bundle/deploy/wal/lineage-mismatch/resources.json.wal b/acceptance/bundle/deploy/wal/lineage-mismatch/resources.json.wal
new file mode 100644
index 00000000000..d14fb4a9713
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/lineage-mismatch/resources.json.wal
@@ -0,0 +1,2 @@
+{"lineage":"wal-lineage-bbb","serial":2}
+{"k":"resources.jobs.test_job","v":{"__id__":"1001","state":{"name":"test-job"}}}
diff --git a/acceptance/bundle/deploy/wal/lineage-mismatch/script b/acceptance/bundle/deploy/wal/lineage-mismatch/script
new file mode 100644
index 00000000000..0629a37c0f9
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/lineage-mismatch/script
@@ -0,0 +1,8 @@
+mkdir -p .databricks/bundle/default
+cp resources.json .databricks/bundle/default/
+cp resources.json.wal .databricks/bundle/default/
+
+echo "Any command should fail with lineage mismatch error"
+musterr $CLI bundle $COMMAND
+
+trace musterr $CLI bundle destroy --auto-approve
diff --git a/acceptance/bundle/deploy/wal/lineage-mismatch/test.py b/acceptance/bundle/deploy/wal/lineage-mismatch/test.py
new file mode 100644
index 00000000000..1ff8e07c707
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/lineage-mismatch/test.py
@@ -0,0 +1 @@
+print("test")
diff --git a/acceptance/bundle/deploy/wal/lineage-mismatch/test.toml b/acceptance/bundle/deploy/wal/lineage-mismatch/test.toml
new file mode 100644
index 00000000000..0b3a9e0b7cc
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/lineage-mismatch/test.toml
@@ -0,0 +1 @@
+EnvMatrix.COMMAND = ["deploy", "plan", "summary"]
diff --git a/acceptance/bundle/deploy/wal/stale-wal/databricks.yml b/acceptance/bundle/deploy/wal/stale-wal/databricks.yml
new file mode 100644
index 00000000000..443283607e6
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/stale-wal/databricks.yml
@@ -0,0 +1,14 @@
+bundle:
+  name: wal-stale-test
+
+resources:
+  jobs:
+    test_job:
+      name: "test-job"
+      tasks:
+        - task_key: "test-task"
+          spark_python_task:
+            python_file: ./test.py
+          new_cluster:
+            spark_version: 15.4.x-scala2.12
+            node_type_id: i3.xlarge
diff --git a/acceptance/bundle/deploy/wal/stale-wal/out.test.toml b/acceptance/bundle/deploy/wal/stale-wal/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/stale-wal/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deploy/wal/stale-wal/output.txt b/acceptance/bundle/deploy/wal/stale-wal/output.txt
new file mode 100644
index 00000000000..933058b577d
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/stale-wal/output.txt
@@ -0,0 +1,19 @@
+=== WAL content before deploy ===
+{"lineage":"stale-test-lineage","serial":1}
+{"k":"resources.jobs.stale_job","v":{"__id__":"9999","state":{"name":"stale-job"}}}
+=== Deploy (should ignore stale WAL) ===
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/wal-stale-test/default/files...
+Updated jobs.test_job
+Files: 4 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+=== Checking WAL file after deploy ===
+Stale WAL deleted (expected)
+=== State file should NOT contain stale_job ===
+{
+  "serial": 3,
+  "state_keys": [
+    "resources.jobs.test_job"
+  ]
+}
diff --git a/acceptance/bundle/deploy/wal/stale-wal/resources.json b/acceptance/bundle/deploy/wal/stale-wal/resources.json
new file mode 100644
index 00000000000..6fd38b67ae8
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/stale-wal/resources.json
@@ -0,0 +1,12 @@
+{
+  "state_version": 1,
+  "cli_version": "0.0.0",
+  "lineage": "stale-test-lineage",
+  "serial": 2,
+  "state": {
+    "resources.jobs.test_job": {
+      "__id__": "1001",
+      "state": {"name": "test-job"}
+    }
+  }
+}
diff --git a/acceptance/bundle/deploy/wal/stale-wal/resources.json.wal b/acceptance/bundle/deploy/wal/stale-wal/resources.json.wal
new file mode 100644
index 00000000000..ef5f380ed84
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/stale-wal/resources.json.wal
@@ -0,0 +1,2 @@
+{"lineage":"stale-test-lineage","serial":1}
+{"k":"resources.jobs.stale_job","v":{"__id__":"9999","state":{"name":"stale-job"}}}
diff --git a/acceptance/bundle/deploy/wal/stale-wal/script b/acceptance/bundle/deploy/wal/stale-wal/script
new file mode 100644
index 00000000000..4de1bc1e921
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/stale-wal/script
@@ -0,0 +1,19 @@
+mkdir -p .databricks/bundle/default
+cp resources.json .databricks/bundle/default/
+cp resources.json.wal .databricks/bundle/default/
+
+echo "=== WAL content before deploy ==="
+cat .databricks/bundle/default/resources.json.wal
+
+echo "=== Deploy (should ignore stale WAL) ==="
+trace $CLI bundle deploy
+
+echo "=== Checking WAL file after deploy ==="
+if [ -f ".databricks/bundle/default/resources.json.wal" ]; then
+    echo "WAL file exists (unexpected)"
+else
+    echo "Stale WAL deleted (expected)"
+fi
+
+echo "=== State file should NOT contain stale_job ==="
+cat .databricks/bundle/default/resources.json | jq -S '{serial: .serial, state_keys: (.state | keys)}'
diff --git a/acceptance/bundle/deploy/wal/stale-wal/test.py b/acceptance/bundle/deploy/wal/stale-wal/test.py
new file mode 100644
index 00000000000..1ff8e07c707
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/stale-wal/test.py
@@ -0,0 +1 @@
+print("test")
diff --git a/acceptance/bundle/deploy/wal/stale-wal/test.toml b/acceptance/bundle/deploy/wal/stale-wal/test.toml
new file mode 100644
index 00000000000..1e3340c3c63
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/stale-wal/test.toml
@@ -0,0 +1,14 @@
+# Recording needs a bundle it has seen from the start. This test seeds a state file,
+# so recording refuses it. TODO(DMS): drop this once existing state can be
+# handed over to the service (see the TODO in dstate.Open).
+EnvMatrix.DMS = [""]
+
+# Deploy with a stale WAL (old serial) - WAL should be deleted and ignored.
+
+[[Server]]
+Pattern = "POST /api/2.2/jobs/reset"
+Response.Body = '{}'
+
+[[Server]]
+Pattern = "GET /api/2.2/jobs/get"
+Response.Body = '{"job_id": 1001, "settings": {"name": "test-job"}}'
diff --git a/acceptance/bundle/deploy/wal/test.toml b/acceptance/bundle/deploy/wal/test.toml
new file mode 100644
index 00000000000..5d9bd382fcb
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/test.toml
@@ -0,0 +1,36 @@
+# WAL (Write-Ahead Log) tests verify crash recovery during bundle deployment.
+# These tests simulate process crashes using KillCaller and verify state recovery.
+# Only runs with direct engine since WAL is a direct-engine feature.
+#
+# There is no WAL to recover from when DMS is enabled, so these do not run under it.
+
+Env.DATABRICKS_CLI_TEST_PID = "1"
+
+EnvMatrix.DMS = [""]
+
+[[Repls]]
+Old = 'script: line \d+:\s+\d+ Killed(: 9)?\s+"\$@"'
+New = '[PROCESS_KILLED]'
+
+[[Repls]]
+Old = '(\n>>> errcode [^\n]+\n)\nExit code:'
+New = "${1}[PROCESS_KILLED]\n\nExit code:"
+
+[[Repls]]
+Old = 'Exit code: 137'
+New = 'Exit code: [KILLED]'
+
+# On Linux, a KillCaller kill may surface as exit code 1 rather than 137.
+# Only normalise exit code 1 when it directly follows [PROCESS_KILLED] to
+# avoid masking genuine error exits (lineage-mismatch, future-serial-wal).
+[[Repls]]
+Old = '(\[PROCESS_KILLED\]\n\nExit code: )1'
+New = '${1}[KILLED]'
+
+# On Windows, no bash "Killed" message appears when CLI has produced output before termination.
+# The kill lands during resource apply, right after the "Uploading bundle files"
+# line, so that line is immediately followed by "Exit code: 1" (a genuine error
+# exit prints an "Error:" line in between and is left untouched).
+[[Repls]]
+Old = '(Uploading bundle files to [^\n]+)\n\nExit code: 1'
+New = "${1}\n[PROCESS_KILLED]\n\nExit code: [KILLED]"
diff --git a/acceptance/bundle/deploy/wal/wal-with-delete/databricks.yml b/acceptance/bundle/deploy/wal/wal-with-delete/databricks.yml
new file mode 100644
index 00000000000..128bbe37f56
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/wal-with-delete/databricks.yml
@@ -0,0 +1,4 @@
+bundle:
+  name: wal-delete-test
+
+resources: {}
diff --git a/acceptance/bundle/deploy/wal/wal-with-delete/out.test.toml b/acceptance/bundle/deploy/wal/wal-with-delete/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/wal-with-delete/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deploy/wal/wal-with-delete/output.txt b/acceptance/bundle/deploy/wal/wal-with-delete/output.txt
new file mode 100644
index 00000000000..9babc6ff543
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/wal-with-delete/output.txt
@@ -0,0 +1,18 @@
+=== WAL content ===
+{"lineage":"delete-test-lineage","serial":2}
+{"k":"resources.jobs.test_job","v":null}
+=== Deploy (should recover delete from WAL) ===
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/wal-delete-test/default/files...
+Files: 4 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
+=== Final state (should have no jobs) ===
+
+>>> [CLI] bundle summary
+Name: wal-delete-test
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/wal-delete-test/default
+Resources:
diff --git a/acceptance/bundle/deploy/wal/wal-with-delete/resources.json b/acceptance/bundle/deploy/wal/wal-with-delete/resources.json
new file mode 100644
index 00000000000..04263ec36f9
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/wal-with-delete/resources.json
@@ -0,0 +1,12 @@
+{
+  "state_version": 1,
+  "cli_version": "0.0.0",
+  "lineage": "delete-test-lineage",
+  "serial": 1,
+  "state": {
+    "resources.jobs.test_job": {
+      "__id__": "1001",
+      "state": {"name": "test-job"}
+    }
+  }
+}
diff --git a/acceptance/bundle/deploy/wal/wal-with-delete/resources.json.wal b/acceptance/bundle/deploy/wal/wal-with-delete/resources.json.wal
new file mode 100644
index 00000000000..9b5c6169e3f
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/wal-with-delete/resources.json.wal
@@ -0,0 +1,2 @@
+{"lineage":"delete-test-lineage","serial":2}
+{"k":"resources.jobs.test_job","v":null}
diff --git a/acceptance/bundle/deploy/wal/wal-with-delete/script b/acceptance/bundle/deploy/wal/wal-with-delete/script
new file mode 100644
index 00000000000..1b6708bc0ff
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/wal-with-delete/script
@@ -0,0 +1,12 @@
+mkdir -p .databricks/bundle/default
+cp resources.json .databricks/bundle/default/
+cp resources.json.wal .databricks/bundle/default/
+
+echo "=== WAL content ==="
+cat .databricks/bundle/default/resources.json.wal
+
+echo "=== Deploy (should recover delete from WAL) ==="
+trace $CLI bundle deploy
+
+echo "=== Final state (should have no jobs) ==="
+trace $CLI bundle summary
diff --git a/acceptance/bundle/deploy/wal/wal-with-delete/test.py b/acceptance/bundle/deploy/wal/wal-with-delete/test.py
new file mode 100644
index 00000000000..1ff8e07c707
--- /dev/null
+++ b/acceptance/bundle/deploy/wal/wal-with-delete/test.py
@@ -0,0 +1 @@
+print("test")
diff --git a/acceptance/bundle/deployment/bind/alert/out.test.toml b/acceptance/bundle/deployment/bind/alert/out.test.toml
index d47ff541e4b..f68b4a89c36 100644
--- a/acceptance/bundle/deployment/bind/alert/out.test.toml
+++ b/acceptance/bundle/deployment/bind/alert/out.test.toml
@@ -1,4 +1,2 @@
-Local = false
 Cloud = true
-CloudEnvs.aws = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/bind/alert/output.txt b/acceptance/bundle/deployment/bind/alert/output.txt
index 27949d29d1e..4473eb83917 100644
--- a/acceptance/bundle/deployment/bind/alert/output.txt
+++ b/acceptance/bundle/deployment/bind/alert/output.txt
@@ -2,7 +2,6 @@
 >>> [CLI] alerts-v2 create-alert --json @alert.json
 
 >>> [CLI] bundle deployment bind my_alert [ALERT_ID] --auto-approve
-Updating deployment state...
 Successfully bound alert with an id '[ALERT_ID]'
 Run 'bundle deploy' to deploy changes to your workspace
 
@@ -19,7 +18,6 @@ Resources:
       URL:  [DATABRICKS_URL]/sql/alerts-v2/[ALERT_ID]
 
 >>> [CLI] bundle deployment unbind my_alert
-Updating deployment state...
 
 >>> [CLI] bundle summary
 Name: test-bind-alert-[UNIQUE_NAME]
diff --git a/acceptance/bundle/deployment/bind/alert/script b/acceptance/bundle/deployment/bind/alert/script
index 88e12f15c34..9b6ae2f4085 100644
--- a/acceptance/bundle/deployment/bind/alert/script
+++ b/acceptance/bundle/deployment/bind/alert/script
@@ -2,7 +2,7 @@ envsubst < databricks.yml.tmpl > databricks.yml
 envsubst < alert.json.tmpl > alert.json
 
 alert_id=$(trace $CLI alerts-v2 create-alert --json @alert.json | jq -r '.id')
-echo "$alert_id:ALERT_ID" >> ACC_REPLS
+add_repl "$alert_id" ALERT_ID
 trace $CLI bundle deployment bind my_alert $alert_id --auto-approve
 trace $CLI bundle summary
 
diff --git a/acceptance/bundle/deployment/bind/alert/test.toml b/acceptance/bundle/deployment/bind/alert/test.toml
index a9912a35455..abf4db36f6f 100644
--- a/acceptance/bundle/deployment/bind/alert/test.toml
+++ b/acceptance/bundle/deployment/bind/alert/test.toml
@@ -1,15 +1,19 @@
 Cloud = true
-Local = false
-
 # Alert tests timeout during bundle deploy (hang at file upload for 50+ minutes).
 # Use aggressive 5-minute timeout until the issue is resolved.
 # See: https://github.com/databricks/cli/issues/4221
 TimeoutCloud = "5m"
 
-# On aws the host URL includes the workspace ID as well. Thus skipping it to keep the test simple.
-CloudEnvs.aws = false
-
 Ignore = [
     "databricks.yml",
     "alert.json",
 ]
+
+# Redact the ?[ow]=<id> workspace query param from summary URLs. The CLI appends it
+# whenever the host doesn't already carry the workspace ID in its subdomain, which is
+# the case for the local testserver (127.0.0.1) and aws hosts; azure/gcp vanity hosts
+# embed the ID and omit it. Stripping it lets one golden match local and all clouds.
+[[Repls]]
+Old = '\?[ow]=\[WORKSPACE_ID\]'
+New = ''
+Order = 1000
diff --git a/acceptance/bundle/deployment/bind/catalog/out.test.toml b/acceptance/bundle/deployment/bind/catalog/out.test.toml
index fe4076cdf9b..f68b4a89c36 100644
--- a/acceptance/bundle/deployment/bind/catalog/out.test.toml
+++ b/acceptance/bundle/deployment/bind/catalog/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/bind/catalog/output.txt b/acceptance/bundle/deployment/bind/catalog/output.txt
index d365080f498..b0fdbba006a 100644
--- a/acceptance/bundle/deployment/bind/catalog/output.txt
+++ b/acceptance/bundle/deployment/bind/catalog/output.txt
@@ -6,16 +6,15 @@
 }
 
 >>> [CLI] bundle deployment bind foo test-catalog-[UNIQUE_NAME] --auto-approve
-Updating deployment state...
 Successfully bound catalog with an id 'test-catalog-[UNIQUE_NAME]'
 Run 'bundle deploy' to deploy changes to your workspace
 
 === Deploy bundle
 >>> [CLI] bundle deploy --force-lock --auto-approve
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated catalogs.foo
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] catalogs get test-catalog-[UNIQUE_NAME]
 {
@@ -25,14 +24,12 @@ Deployment complete!
 
 === Unbind catalog
 >>> [CLI] bundle deployment unbind foo
-Updating deployment state...
 
 === Destroy bundle
 >>> [CLI] bundle destroy --auto-approve
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 0 deleted
 
 === Read the pre-defined catalog again (expecting it still exists): 
 >>> [CLI] catalogs get test-catalog-[UNIQUE_NAME]
diff --git a/acceptance/bundle/deployment/bind/catalog/test.toml b/acceptance/bundle/deployment/bind/catalog/test.toml
index 5722b37ccca..a26bade48d0 100644
--- a/acceptance/bundle/deployment/bind/catalog/test.toml
+++ b/acceptance/bundle/deployment/bind/catalog/test.toml
@@ -1,11 +1,6 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
 
 Ignore = [
     ".databricks",
     "databricks.yml",
 ]
-
-[EnvMatrix]
-  DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/deployment/bind/cluster/out.test.toml b/acceptance/bundle/deployment/bind/cluster/out.test.toml
index f61486ff080..f68b4a89c36 100644
--- a/acceptance/bundle/deployment/bind/cluster/out.test.toml
+++ b/acceptance/bundle/deployment/bind/cluster/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = true
-RequiresCluster = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/bind/cluster/output.txt b/acceptance/bundle/deployment/bind/cluster/output.txt
index 9c194337e76..d206309df05 100644
--- a/acceptance/bundle/deployment/bind/cluster/output.txt
+++ b/acceptance/bundle/deployment/bind/cluster/output.txt
@@ -5,9 +5,7 @@
 }
 
 >>> [CLI] bundle deployment bind cluster1 [TEST_DEFAULT_CLUSTER_ID] --auto-approve
-Updating deployment state...
 Successfully bound cluster with an id '[TEST_DEFAULT_CLUSTER_ID]'
 Run 'bundle deploy' to deploy changes to your workspace
 
 >>> [CLI] bundle deployment unbind cluster1
-Updating deployment state...
diff --git a/acceptance/bundle/deployment/bind/cluster/test.toml b/acceptance/bundle/deployment/bind/cluster/test.toml
index bebdb0bbcde..c7c6f58ed6e 100644
--- a/acceptance/bundle/deployment/bind/cluster/test.toml
+++ b/acceptance/bundle/deployment/bind/cluster/test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = true
-RequiresCluster = true
diff --git a/acceptance/bundle/deployment/bind/dashboard/out.test.toml b/acceptance/bundle/deployment/bind/dashboard/out.test.toml
index 96be4fdfe9d..de136de256d 100644
--- a/acceptance/bundle/deployment/bind/dashboard/out.test.toml
+++ b/acceptance/bundle/deployment/bind/dashboard/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
-RequiresWarehouse = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/deployment/bind/dashboard/output.txt b/acceptance/bundle/deployment/bind/dashboard/output.txt
index 5d3f23d4a7e..a8f0eddac00 100644
--- a/acceptance/bundle/deployment/bind/dashboard/output.txt
+++ b/acceptance/bundle/deployment/bind/dashboard/output.txt
@@ -1,14 +1,11 @@
 
 >>> [CLI] bundle deployment bind dashboard1 [DASHBOARD_ID] --auto-approve
-Updating deployment state...
 Successfully bound dashboard with an id '[DASHBOARD_ID]'
 Run 'bundle deploy' to deploy changes to your workspace
-
->>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated dashboards.dashboard1
+Files: 9 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] lakeview get [DASHBOARD_ID]
 {
@@ -28,13 +25,11 @@ Deployment complete!
 }
 
 >>> [CLI] bundle deployment unbind dashboard1
-Updating deployment state...
 
 >>> [CLI] bundle destroy --auto-approve
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 0 deleted
 
 >>> [CLI] lakeview get [DASHBOARD_ID]
 {
diff --git a/acceptance/bundle/deployment/bind/dashboard/recreation/out.state_after_bind.direct.json b/acceptance/bundle/deployment/bind/dashboard/recreation/out.state_after_bind.direct.json
deleted file mode 100644
index 771dd3f908b..00000000000
--- a/acceptance/bundle/deployment/bind/dashboard/recreation/out.state_after_bind.direct.json
+++ /dev/null
@@ -1,20 +0,0 @@
-{
- "state_version": 2,
- "cli_version": "[DEV_VERSION]",
- "lineage": "[UUID]",
- "serial": 2,
- "state": {
-  "resources.dashboards.dashboard1": {
-   "__id__": "[DASHBOARD_ID]",
-   "state": {
-    "display_name": "test dashboard [UNIQUE_NAME]",
-    "embed_credentials": true,
-    "etag": [ETAG],
-    "parent_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/resources",
-    "published": true,
-    "serialized_dashboard": "{\"pages\":[{\"displayName\":\"Page One\",\"name\":\"02724bf2\"}]}",
-    "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
-   }
-  }
- }
-}
diff --git a/acceptance/bundle/deployment/bind/dashboard/recreation/out.state_after_bind.json b/acceptance/bundle/deployment/bind/dashboard/recreation/out.state_after_bind.json
new file mode 100644
index 00000000000..05614d798bf
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/dashboard/recreation/out.state_after_bind.json
@@ -0,0 +1,20 @@
+{
+ "state_version": 3,
+ "cli_version": "[CLI_VERSION]",
+ "lineage": "[UUID]",
+ "serial": 2,
+ "state": {
+  "resources.dashboards.dashboard1": {
+   "__id__": "[DASHBOARD_ID]",
+   "state": {
+    "display_name": "test dashboard [UNIQUE_NAME]",
+    "embed_credentials": true,
+    "etag": [ETAG],
+    "parent_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/resources",
+    "published": true,
+    "serialized_dashboard": "{\"pages\":[{\"displayName\":\"Page One\",\"name\":\"02724bf2\"}]}",
+    "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
+   }
+  }
+ }
+}
diff --git a/acceptance/bundle/deployment/bind/dashboard/recreation/out.state_after_bind.terraform.json b/acceptance/bundle/deployment/bind/dashboard/recreation/out.state_after_bind.terraform.json
deleted file mode 100644
index 4eb65c32129..00000000000
--- a/acceptance/bundle/deployment/bind/dashboard/recreation/out.state_after_bind.terraform.json
+++ /dev/null
@@ -1,43 +0,0 @@
-{
-  "version": 4,
-  "terraform_version": "1.5.5",
-  "serial": 1,
-  "lineage": "[UUID]",
-  "outputs": {},
-  "resources": [
-    {
-      "mode": "managed",
-      "type": "databricks_dashboard",
-      "name": "dashboard1",
-      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
-      "instances": [
-        {
-          "schema_version": 0,
-          "attributes": {
-            "create_time": "[TIMESTAMP]",
-            "dashboard_change_detected": false,
-            "dashboard_id": "[DASHBOARD_ID]",
-            "dataset_catalog": null,
-            "dataset_schema": null,
-            "display_name": "test dashboard [UNIQUE_NAME]",
-            "embed_credentials": false,
-            "etag": [ETAG],
-            "file_path": null,
-            "id": "[DASHBOARD_ID]",
-            "lifecycle_state": "ACTIVE",
-            "md5": null,
-            "parent_path": "/Users/[USERNAME]",
-            "path": "/Users/[USERNAME]/test dashboard [UNIQUE_NAME].lvdash.json",
-            "provider_config": [],
-            "serialized_dashboard": "{\"pages\":[{\"displayName\":\"Untitled page\",\"name\":\"02724bf2\",\"pageType\":\"PAGE_TYPE_CANVAS\"}]}",
-            "update_time": "[TIMESTAMP]",
-            "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
-          },
-          "sensitive_attributes": [],
-          "private": "eyJzY2hlbWFfdmVyc2lvbiI6IjAifQ=="
-        }
-      ]
-    }
-  ],
-  "check_results": null
-}
diff --git a/acceptance/bundle/deployment/bind/dashboard/recreation/out.test.toml b/acceptance/bundle/deployment/bind/dashboard/recreation/out.test.toml
index 96be4fdfe9d..de136de256d 100644
--- a/acceptance/bundle/deployment/bind/dashboard/recreation/out.test.toml
+++ b/acceptance/bundle/deployment/bind/dashboard/recreation/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
-RequiresWarehouse = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/deployment/bind/dashboard/recreation/output.txt b/acceptance/bundle/deployment/bind/dashboard/recreation/output.txt
index 99c26a8ccc3..0b06a0a6d0c 100644
--- a/acceptance/bundle/deployment/bind/dashboard/recreation/output.txt
+++ b/acceptance/bundle/deployment/bind/dashboard/recreation/output.txt
@@ -1,6 +1,5 @@
 
 >>> [CLI] bundle deployment bind dashboard1 [DASHBOARD_ID] --auto-approve
-Updating deployment state...
 Successfully bound dashboard with an id '[DASHBOARD_ID]'
 Run 'bundle deploy' to deploy changes to your workspace
 
@@ -11,26 +10,24 @@ Run 'bundle deploy' to deploy changes to your workspace
 recreate dashboards.dashboard1
 
 Plan: 1 to add, 0 to change, 1 to delete, 0 unchanged
-
->>> errcode [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
 
 This action will result in the deletion or recreation of the following dashboards.
 This will result in changed IDs and permanent URLs of the dashboards that will be recreated:
   recreate resources.dashboards.dashboard1
-Error: the deployment requires destructive actions, but current console does not support prompting. Please specify --auto-approve if you would like to skip prompts and proceed
+Error: the deployment requires destructive actions, but the current console does not support prompting.
+Deleting data assets such as schemas, pipelines, or volumes may cause permanent data loss and should be carefully reviewed.
+To proceed, use --auto-approve after reviewing the plan above.
 
+Files: 5 uploaded, 0 deleted
 
 Exit code: 1
 
 >>> [CLI] bundle deployment unbind dashboard1
-Updating deployment state...
-
->>> [CLI] bundle deploy --auto-approve
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created dashboards.dashboard1
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] lakeview get [DASHBOARD_ID]
 {
diff --git a/acceptance/bundle/deployment/bind/dashboard/recreation/script b/acceptance/bundle/deployment/bind/dashboard/recreation/script
index fbd7033f026..9d9f5cacf2f 100644
--- a/acceptance/bundle/deployment/bind/dashboard/recreation/script
+++ b/acceptance/bundle/deployment/bind/dashboard/recreation/script
@@ -5,7 +5,7 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 # Create a pre-defined dashboard:
 DASHBOARD_ID=$($CLI lakeview create --display-name "${DASHBOARD_DISPLAY_NAME}" --warehouse-id "${TEST_DEFAULT_WAREHOUSE_ID}" --serialized-dashboard '{"pages":[{"name":"02724bf2","displayName":"Untitled page"}]}' | jq -r '.dashboard_id')
-echo "$DASHBOARD_ID:DASHBOARD_ID" >> ACC_REPLS
+add_repl "$DASHBOARD_ID" DASHBOARD_ID
 
 cleanupRemoveDashboard() {
     $CLI lakeview trash "${DASHBOARD_ID}"
@@ -13,17 +13,20 @@ cleanupRemoveDashboard() {
 trap cleanupRemoveDashboard EXIT
 
 trace $CLI bundle deployment bind dashboard1 "${DASHBOARD_ID}" --auto-approve
-trace print_state.py > out.state_after_bind.$DATABRICKS_BUNDLE_ENGINE.json
-ETAG=$(jq '.state["resources.dashboards.dashboard1"].state.etag // .resources[0].instances[0].attributes.etag // "no-etag"' < out.state_after_bind.$DATABRICKS_BUNDLE_ENGINE.json)
+trace print_state.py > out.state_after_bind.json
+ETAG=$(jq '.state["resources.dashboards.dashboard1"].state.etag // .resources[0].instances[0].attributes.etag // "no-etag"' < out.state_after_bind.json)
 echo $ETAG
-add_repl.py $ETAG ETAG
-json_in_json_normalize.py out.state_after_bind.$DATABRICKS_BUNDLE_ENGINE.json
+add_repl $ETAG ETAG
+json_in_json_normalize.py out.state_after_bind.json
 
 trace $CLI bundle plan
-trace errcode $CLI bundle deploy
+$CLI bundle plan -o json > tmp.plan.json
+errcode $CLI bundle deploy $(readplanarg tmp.plan.json)
 
 trace $CLI bundle deployment unbind dashboard1
 
-trace $CLI bundle deploy --auto-approve
+# Re-plan after unbind: the plan saved above no longer matches state.
+$CLI bundle plan -o json > tmp.plan_after_unbind.json
+$CLI bundle deploy --auto-approve $(readplanarg tmp.plan_after_unbind.json)
 
 trace $CLI lakeview get "${DASHBOARD_ID}" | jq '{display_name, lifecycle_state}'
diff --git a/acceptance/bundle/deployment/bind/dashboard/script b/acceptance/bundle/deployment/bind/dashboard/script
index ee59b588fda..3d4163a947f 100644
--- a/acceptance/bundle/deployment/bind/dashboard/script
+++ b/acceptance/bundle/deployment/bind/dashboard/script
@@ -13,7 +13,10 @@ trap cleanupRemoveDashboard EXIT
 
 trace $CLI bundle deployment bind dashboard1 "${DASHBOARD_ID}" --auto-approve
 
-trace $CLI bundle deploy
+# Bind writes state without going through DoCreate/DoUpdate, so a saved-plan deploy after
+# a bind must still send the full serialized_dashboard; the lakeview get below reads it back.
+$CLI bundle plan -o json > tmp.plan.json
+$CLI bundle deploy $(readplanarg tmp.plan.json)
 
 trace $CLI lakeview get "${DASHBOARD_ID}" | jq --sort-keys '{display_name, lifecycle_state, path, parent_path, serialized_dashboard} | .serialized_dashboard |= fromjson'
 
diff --git a/acceptance/bundle/deployment/bind/dashboard/test.toml b/acceptance/bundle/deployment/bind/dashboard/test.toml
index b429aa38e28..1e9db3f6eed 100644
--- a/acceptance/bundle/deployment/bind/dashboard/test.toml
+++ b/acceptance/bundle/deployment/bind/dashboard/test.toml
@@ -1,6 +1,11 @@
-Local = true
 Cloud = true
-RequiresWarehouse = true
+
+Ignore = ["tmp.plan.json", "tmp.plan_after_unbind.json"]
+
+# Bind writes state without going through DoCreate/DoUpdate, so a deploy from a saved
+# plan after binding must still send the full serialized_dashboard. Inherited by
+# recreation/, whose script also deploys from a saved plan.
+EnvMatrix.READPLAN = ["", "1"]
 
 [[Repls]]
 Old = "[0-9a-f]{32}"
diff --git a/acceptance/bundle/deployment/bind/database_instance/out.test.toml b/acceptance/bundle/deployment/bind/database_instance/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/deployment/bind/database_instance/out.test.toml
+++ b/acceptance/bundle/deployment/bind/database_instance/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/bind/database_instance/output.txt b/acceptance/bundle/deployment/bind/database_instance/output.txt
index b9da270a126..08a22ce7d59 100644
--- a/acceptance/bundle/deployment/bind/database_instance/output.txt
+++ b/acceptance/bundle/deployment/bind/database_instance/output.txt
@@ -1,6 +1,5 @@
 
 >>> [CLI] bundle deployment bind database_instance1 [UUID] --auto-approve
-Updating deployment state...
 Successfully bound database_instance with an id '[UUID]'
 Run 'bundle deploy' to deploy changes to your workspace
 
@@ -14,10 +13,9 @@ Resources:
   Database instances:
     database_instance1:
       Name: test-instance-02
-      URL:  [DATABRICKS_URL]/compute/database-instances/test-instance-02?o=[NUMID]
+      URL:  [DATABRICKS_URL]/compute/database-instances/test-instance-02?w=[WORKSPACE_ID]
 
 >>> [CLI] bundle deployment unbind database_instance1
-Updating deployment state...
 
 >>> [CLI] bundle summary
 Name: test-bundle
diff --git a/acceptance/bundle/deployment/bind/database_instance/test.toml b/acceptance/bundle/deployment/bind/database_instance/test.toml
index 6b1bcafac71..eebb640cedb 100644
--- a/acceptance/bundle/deployment/bind/database_instance/test.toml
+++ b/acceptance/bundle/deployment/bind/database_instance/test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
 
 Ignore = [
diff --git a/acceptance/bundle/deployment/bind/experiment/out.plan1.direct.json b/acceptance/bundle/deployment/bind/experiment/out.plan1.json
similarity index 100%
rename from acceptance/bundle/deployment/bind/experiment/out.plan1.direct.json
rename to acceptance/bundle/deployment/bind/experiment/out.plan1.json
diff --git a/acceptance/bundle/deployment/bind/experiment/out.plan1.terraform.json b/acceptance/bundle/deployment/bind/experiment/out.plan1.terraform.json
deleted file mode 100644
index 884cb9c919a..00000000000
--- a/acceptance/bundle/deployment/bind/experiment/out.plan1.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "plan": {
-    "resources.experiments.experiment1": {
-      "action": "skip",
-      "name_change": null
-    }
-  }
-}
diff --git a/acceptance/bundle/deployment/bind/experiment/out.plan2.direct.json b/acceptance/bundle/deployment/bind/experiment/out.plan2.json
similarity index 100%
rename from acceptance/bundle/deployment/bind/experiment/out.plan2.direct.json
rename to acceptance/bundle/deployment/bind/experiment/out.plan2.json
diff --git a/acceptance/bundle/deployment/bind/experiment/out.plan2.terraform.json b/acceptance/bundle/deployment/bind/experiment/out.plan2.terraform.json
deleted file mode 100644
index 884cb9c919a..00000000000
--- a/acceptance/bundle/deployment/bind/experiment/out.plan2.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "plan": {
-    "resources.experiments.experiment1": {
-      "action": "skip",
-      "name_change": null
-    }
-  }
-}
diff --git a/acceptance/bundle/deployment/bind/experiment/out.test.toml b/acceptance/bundle/deployment/bind/experiment/out.test.toml
index bbc7fcfd1bd..f68b4a89c36 100644
--- a/acceptance/bundle/deployment/bind/experiment/out.test.toml
+++ b/acceptance/bundle/deployment/bind/experiment/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/bind/experiment/output.txt b/acceptance/bundle/deployment/bind/experiment/output.txt
index 1efb0ddc4dd..639a001fe61 100644
--- a/acceptance/bundle/deployment/bind/experiment/output.txt
+++ b/acceptance/bundle/deployment/bind/experiment/output.txt
@@ -1,31 +1,27 @@
 
->>> [CLI] bundle deployment bind experiment1 [NUMID] --auto-approve
-Updating deployment state...
-Successfully bound experiment with an id '[NUMID]'
+>>> [CLI] bundle deployment bind experiment1 [EXPERIMENT_ID] --auto-approve
+Successfully bound experiment with an id '[EXPERIMENT_ID]'
 Run 'bundle deploy' to deploy changes to your workspace
 
 >>> [CLI] bundle deploy --force-lock --auto-approve
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
 
->>> [CLI] experiments get-experiment [NUMID]
+>>> [CLI] experiments get-experiment [EXPERIMENT_ID]
 {
   "name": "/Users/[USERNAME]/test-experiment[UNIQUE_NAME]",
   "lifecycle_stage": "active"
 }
 
 >>> [CLI] bundle deployment unbind experiment1
-Updating deployment state...
 
 >>> [CLI] bundle destroy --auto-approve
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 0 deleted
 
->>> [CLI] experiments get-experiment [NUMID]
+>>> [CLI] experiments get-experiment [EXPERIMENT_ID]
 {
   "name": "/Users/[USERNAME]/test-experiment[UNIQUE_NAME]",
   "lifecycle_stage": "active"
diff --git a/acceptance/bundle/deployment/bind/experiment/script b/acceptance/bundle/deployment/bind/experiment/script
index 70cf1933811..75eb9c590ce 100644
--- a/acceptance/bundle/deployment/bind/experiment/script
+++ b/acceptance/bundle/deployment/bind/experiment/script
@@ -4,6 +4,7 @@ export EXPERIMENT_NAME
 envsubst < databricks.yml.tmpl > databricks.yml
 
 EXPERIMENT_ID=$($CLI experiments create-experiment "${EXPERIMENT_NAME}" | jq -r '.experiment_id')
+add_repl "$EXPERIMENT_ID" EXPERIMENT_ID
 
 cleanupRemoveExperiment() {
     title "Test cleanup:"
@@ -21,7 +22,7 @@ trace $CLI bundle deploy --force-lock --auto-approve
 # Use --output json to verify the change details including skip reason.
 # Write per-engine output since direct includes change details that terraform doesn't.
 # Filter to only the name change (tags/artifact_location may differ between local and cloud).
-$CLI bundle plan --output json | jq '{plan: .plan | map_values({action, name_change: (.changes.name // null)})}' > out.plan1.$DATABRICKS_BUNDLE_ENGINE.json
+$CLI bundle plan --output json | nostamp | jq '{plan: .plan | map_values({action, name_change: (.changes.name // null)})}' > out.plan1.json
 
 trace $CLI experiments get-experiment ${EXPERIMENT_ID} | jq '{name: .experiment.name, lifecycle_stage: .experiment.lifecycle_stage}'
 
@@ -29,7 +30,7 @@ trace $CLI experiments get-experiment ${EXPERIMENT_ID} | jq '{name: .experiment.
 # Plan should still show no changes because the diff is suppressed.
 EXPERIMENT_NAME="//Users/${CURRENT_USER_NAME}/test-experiment$UNIQUE_NAME"
 envsubst < databricks.yml.tmpl > databricks.yml
-$CLI bundle plan --output json | jq '{plan: .plan | map_values({action, name_change: (.changes.name // null)})}' > out.plan2.$DATABRICKS_BUNDLE_ENGINE.json
+$CLI bundle plan --output json | nostamp | jq '{plan: .plan | map_values({action, name_change: (.changes.name // null)})}' > out.plan2.json
 
 trace $CLI bundle deployment unbind experiment1
 
diff --git a/acceptance/bundle/deployment/bind/experiment/test.toml b/acceptance/bundle/deployment/bind/experiment/test.toml
index 0e8c8a38404..c7c6f58ed6e 100644
--- a/acceptance/bundle/deployment/bind/experiment/test.toml
+++ b/acceptance/bundle/deployment/bind/experiment/test.toml
@@ -1,2 +1 @@
-Local = true
 Cloud = true
diff --git a/acceptance/bundle/deployment/bind/external_location/out.test.toml b/acceptance/bundle/deployment/bind/external_location/out.test.toml
index e90b6d5d1ba..19b5b15d11f 100644
--- a/acceptance/bundle/deployment/bind/external_location/out.test.toml
+++ b/acceptance/bundle/deployment/bind/external_location/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/bind/external_location/output.txt b/acceptance/bundle/deployment/bind/external_location/output.txt
index bc2ad4be800..0fbc59805fd 100644
--- a/acceptance/bundle/deployment/bind/external_location/output.txt
+++ b/acceptance/bundle/deployment/bind/external_location/output.txt
@@ -7,16 +7,15 @@
 }
 
 >>> [CLI] bundle deployment bind test_location test-location-[UNIQUE_NAME] --auto-approve
-Updating deployment state...
 Successfully bound external_location with an id 'test-location-[UNIQUE_NAME]'
 Run 'bundle deploy' to deploy changes to your workspace
 
 === Deploy bundle
 >>> [CLI] bundle deploy --force-lock --auto-approve
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated external_locations.test_location
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] external-locations get test-location-[UNIQUE_NAME]
 {
@@ -27,14 +26,12 @@ Deployment complete!
 
 === Unbind external location
 >>> [CLI] bundle deployment unbind test_location
-Updating deployment state...
 
 === Destroy bundle
 >>> [CLI] bundle destroy --auto-approve
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 0 deleted
 
 === Read the pre-defined external location again (expecting it still exists): 
 >>> [CLI] external-locations get test-location-[UNIQUE_NAME]
diff --git a/acceptance/bundle/deployment/bind/external_location/test.toml b/acceptance/bundle/deployment/bind/external_location/test.toml
index 63db7b2888d..c1bde723431 100644
--- a/acceptance/bundle/deployment/bind/external_location/test.toml
+++ b/acceptance/bundle/deployment/bind/external_location/test.toml
@@ -1,10 +1,6 @@
-Local = true
 Cloud = false
 
 Ignore = [
     ".databricks",
     "databricks.yml",
 ]
-
-[EnvMatrix]
-  DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/deployment/bind/feature/databricks.yml b/acceptance/bundle/deployment/bind/feature/databricks.yml
new file mode 100644
index 00000000000..10c39741536
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/feature/databricks.yml
@@ -0,0 +1,18 @@
+bundle:
+  name: test-bundle
+
+resources:
+  features:
+    feature1:
+      full_name: main.myschema.boundfeature
+      description: bound feature
+      source:
+        delta_table_source:
+          full_name: main.myschema.mysource
+      function:
+        column_selection:
+          column: amount
+      entities:
+        - name: account_id
+      timeseries_column:
+        name: event_ts
diff --git a/acceptance/bundle/deployment/bind/feature/out.test.toml b/acceptance/bundle/deployment/bind/feature/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/feature/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/bind/feature/output.txt b/acceptance/bundle/deployment/bind/feature/output.txt
new file mode 100644
index 00000000000..d4d47f6a660
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/feature/output.txt
@@ -0,0 +1,30 @@
+
+>>> [CLI] bundle deployment bind feature1 main.myschema.boundfeature --auto-approve
+Successfully bound feature with an id 'main.myschema.boundfeature'
+Run 'bundle deploy' to deploy changes to your workspace
+
+>>> [CLI] bundle summary
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+Resources:
+  Features:
+    feature1:
+      Name: main.myschema.boundfeature
+      URL:  [DATABRICKS_URL]/explore/data/features/main/myschema/boundfeature?w=[WORKSPACE_ID]
+
+>>> [CLI] bundle deployment unbind feature1
+
+>>> [CLI] bundle summary
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+Resources:
+  Features:
+    feature1:
+      Name: main.myschema.boundfeature
+      URL:  (not deployed)
diff --git a/acceptance/bundle/deployment/bind/feature/script b/acceptance/bundle/deployment/bind/feature/script
new file mode 100644
index 00000000000..8e27f69056c
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/feature/script
@@ -0,0 +1,5 @@
+trace $CLI bundle deployment bind feature1 main.myschema.boundfeature --auto-approve
+trace $CLI bundle summary
+
+trace $CLI bundle deployment unbind feature1
+trace $CLI bundle summary
diff --git a/acceptance/bundle/deployment/bind/feature/test.toml b/acceptance/bundle/deployment/bind/feature/test.toml
new file mode 100644
index 00000000000..84e8bf9b8f4
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/feature/test.toml
@@ -0,0 +1,22 @@
+Cloud = false
+
+Ignore = [
+    ".databricks",
+]
+
+# The bind flow issues a GET to confirm the remote feature exists before binding.
+[[Server]]
+Pattern = "GET /api/2.0/feature-engineering/features/{full_name}"
+Response.Body = '''
+{
+  "full_name": "main.myschema.boundfeature",
+  "catalog_name": "main",
+  "schema_name": "myschema",
+  "name": "boundfeature",
+  "description": "bound feature",
+  "source": {"delta_table_source": {"full_name": "main.myschema.mysource"}},
+  "function": {"column_selection": {"column": "amount"}},
+  "entities": [{"name": "account_id"}],
+  "timeseries_column": {"name": "event_ts"}
+}
+'''
diff --git a/acceptance/bundle/deployment/bind/genie_space/databricks.yml.tmpl b/acceptance/bundle/deployment/bind/genie_space/databricks.yml.tmpl
new file mode 100644
index 00000000000..a31d53c1785
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/genie_space/databricks.yml.tmpl
@@ -0,0 +1,13 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  genie_spaces:
+    genie_space1:
+      title: $GENIE_SPACE_TITLE
+      warehouse_id: "test-warehouse-id"
+      parent_path: /Users/$CURRENT_USER_NAME
+      # Inline body matches the out-of-band-created space byte-for-byte, so the
+      # only possible post-bind drift signal is the etag.
+      serialized_space:
+        version: 1
diff --git a/acceptance/bundle/deployment/bind/genie_space/out.test.toml b/acceptance/bundle/deployment/bind/genie_space/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/genie_space/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/bind/genie_space/output.txt b/acceptance/bundle/deployment/bind/genie_space/output.txt
new file mode 100644
index 00000000000..93e68b9116b
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/genie_space/output.txt
@@ -0,0 +1,33 @@
+
+>>> [CLI] bundle deployment bind genie_space1 [GENIE_SPACE_ID] --auto-approve
+Successfully bound genie_space with an id '[GENIE_SPACE_ID]'
+Run 'bundle deploy' to deploy changes to your workspace
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
+
+>>> [CLI] genie get-space [GENIE_SPACE_ID]
+{
+  "parent_path": "/Users/[USERNAME]",
+  "title": "test genie space [UNIQUE_NAME]",
+  "warehouse_id": "test-warehouse-id"
+}
+
+>>> [CLI] bundle deployment unbind genie_space1
+
+>>> [CLI] bundle destroy --auto-approve
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
+
+Destroy: 0 deleted
+
+>>> [CLI] genie get-space [GENIE_SPACE_ID]
+{
+  "parent_path": "/Users/[USERNAME]",
+  "title": "test genie space [UNIQUE_NAME]",
+  "warehouse_id": "test-warehouse-id"
+}
diff --git a/acceptance/bundle/deployment/bind/genie_space/script b/acceptance/bundle/deployment/bind/genie_space/script
new file mode 100644
index 00000000000..896685a2311
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/genie_space/script
@@ -0,0 +1,30 @@
+GENIE_SPACE_TITLE="test genie space $UNIQUE_NAME"
+
+export GENIE_SPACE_TITLE
+envsubst < databricks.yml.tmpl > databricks.yml
+
+# Create a Genie space out of band, then bind the bundle resource to it.
+GENIE_SPACE_ID=$($CLI genie create-space "test-warehouse-id" '{"version":1}' --title "${GENIE_SPACE_TITLE}" | jq -r '.space_id')
+
+cleanupRemoveGenieSpace() {
+    $CLI genie trash-space "${GENIE_SPACE_ID}"
+}
+trap cleanupRemoveGenieSpace EXIT
+
+trace $CLI bundle deployment bind genie_space1 "${GENIE_SPACE_ID}" --auto-approve
+
+# Bind must copy the remote etag into state, so the first plan after bind is
+# clean. Without that, the etag drift signal (empty stored vs remote) would
+# produce a bogus update here.
+trace $CLI bundle plan
+
+trace $CLI bundle deploy
+
+trace $CLI genie get-space "${GENIE_SPACE_ID}" | jq --sort-keys '{title, parent_path, warehouse_id}'
+
+trace $CLI bundle deployment unbind genie_space1
+
+trace $CLI bundle destroy --auto-approve
+
+# Read the Genie space again (expecting it still exists and is not deleted):
+trace $CLI genie get-space "${GENIE_SPACE_ID}" | jq --sort-keys '{title, parent_path, warehouse_id}'
diff --git a/acceptance/bundle/deployment/bind/genie_space/test.toml b/acceptance/bundle/deployment/bind/genie_space/test.toml
new file mode 100644
index 00000000000..792fc26cd6a
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/genie_space/test.toml
@@ -0,0 +1,10 @@
+# Genie spaces are only deployed via the direct deployment engine.
+
+# Uses a literal warehouse id and a version-sensitive serialized_space, so this
+# lifecycle test runs against the local mock server only (overrides the Cloud=true
+# inherited from acceptance/bundle/deployment/test.toml).
+Cloud = false
+
+[[Repls]]
+Old = "[0-9a-f]{32}"
+New = "[GENIE_SPACE_ID]"
diff --git a/acceptance/bundle/deployment/bind/job/already-managed-different/out.bind.terraform.txt b/acceptance/bundle/deployment/bind/job/already-managed-different/out.bind.terraform.txt
deleted file mode 100644
index 0415fee5299..00000000000
--- a/acceptance/bundle/deployment/bind/job/already-managed-different/out.bind.terraform.txt
+++ /dev/null
@@ -1,12 +0,0 @@
-
->>> musterr [CLI] bundle deployment bind foo [NEW_JOB_ID]
-Error: terraform import: exit status 1
-
-Error: Resource already managed by Terraform
-
-Terraform is already managing a remote object for databricks_job.foo. To
-import to this address you must first remove the existing object from the
-state.
-
-
-
diff --git a/acceptance/bundle/deployment/bind/job/already-managed-different/out.bind.direct.txt b/acceptance/bundle/deployment/bind/job/already-managed-different/out.bind.txt
similarity index 100%
rename from acceptance/bundle/deployment/bind/job/already-managed-different/out.bind.direct.txt
rename to acceptance/bundle/deployment/bind/job/already-managed-different/out.bind.txt
diff --git a/acceptance/bundle/deployment/bind/job/already-managed-different/out.test.toml b/acceptance/bundle/deployment/bind/job/already-managed-different/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/deployment/bind/job/already-managed-different/out.test.toml
+++ b/acceptance/bundle/deployment/bind/job/already-managed-different/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/bind/job/already-managed-different/output.txt b/acceptance/bundle/deployment/bind/job/already-managed-different/output.txt
index 9f0d1005cd8..6a586f0f0c4 100644
--- a/acceptance/bundle/deployment/bind/job/already-managed-different/output.txt
+++ b/acceptance/bundle/deployment/bind/job/already-managed-different/output.txt
@@ -1,8 +1,8 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/my_project/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.foo
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] jobs create --json {"name": "My Job"}
diff --git a/acceptance/bundle/deployment/bind/job/already-managed-different/script b/acceptance/bundle/deployment/bind/job/already-managed-different/script
index 0d2b5ada117..a844b9cbdbe 100644
--- a/acceptance/bundle/deployment/bind/job/already-managed-different/script
+++ b/acceptance/bundle/deployment/bind/job/already-managed-different/script
@@ -3,6 +3,6 @@ trace $CLI bundle deploy
 replace_ids.py
 
 new_job_id=$(trace $CLI jobs create --json '{"name": "My Job"}' | jq -r '.job_id')
-add_repl.py $new_job_id NEW_JOB_ID
+add_repl $new_job_id NEW_JOB_ID
 
-trace musterr $CLI bundle deployment bind foo $new_job_id &> out.bind.$DATABRICKS_BUNDLE_ENGINE.txt
+trace musterr $CLI bundle deployment bind foo $new_job_id &> out.bind.txt
diff --git a/acceptance/bundle/deployment/bind/job/already-managed-different/test.toml b/acceptance/bundle/deployment/bind/job/already-managed-different/test.toml
index 2f62cd9beb1..18b1a88417e 100644
--- a/acceptance/bundle/deployment/bind/job/already-managed-different/test.toml
+++ b/acceptance/bundle/deployment/bind/job/already-managed-different/test.toml
@@ -1,4 +1 @@
 Cloud = false
-
-[EnvMatrix]
-  DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/bundle/deployment/bind/job/already-managed-same/out.bind.terraform.txt b/acceptance/bundle/deployment/bind/job/already-managed-same/out.bind.terraform.txt
deleted file mode 100644
index a3be6f2ee3c..00000000000
--- a/acceptance/bundle/deployment/bind/job/already-managed-same/out.bind.terraform.txt
+++ /dev/null
@@ -1,12 +0,0 @@
-
->>> musterr [CLI] bundle deployment bind foo [FOO_ID]
-Error: terraform import: exit status 1
-
-Error: Resource already managed by Terraform
-
-Terraform is already managing a remote object for databricks_job.foo. To
-import to this address you must first remove the existing object from the
-state.
-
-
-
diff --git a/acceptance/bundle/deployment/bind/job/already-managed-same/out.bind.direct.txt b/acceptance/bundle/deployment/bind/job/already-managed-same/out.bind.txt
similarity index 100%
rename from acceptance/bundle/deployment/bind/job/already-managed-same/out.bind.direct.txt
rename to acceptance/bundle/deployment/bind/job/already-managed-same/out.bind.txt
diff --git a/acceptance/bundle/deployment/bind/job/already-managed-same/out.test.toml b/acceptance/bundle/deployment/bind/job/already-managed-same/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/deployment/bind/job/already-managed-same/out.test.toml
+++ b/acceptance/bundle/deployment/bind/job/already-managed-same/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/bind/job/already-managed-same/output.txt b/acceptance/bundle/deployment/bind/job/already-managed-same/output.txt
index 29757521ac0..29d2b423908 100644
--- a/acceptance/bundle/deployment/bind/job/already-managed-same/output.txt
+++ b/acceptance/bundle/deployment/bind/job/already-managed-same/output.txt
@@ -1,9 +1,9 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/my_project/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.foo
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle plan
 Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
diff --git a/acceptance/bundle/deployment/bind/job/already-managed-same/script b/acceptance/bundle/deployment/bind/job/already-managed-same/script
index a63358c112e..1d65e759e9f 100644
--- a/acceptance/bundle/deployment/bind/job/already-managed-same/script
+++ b/acceptance/bundle/deployment/bind/job/already-managed-same/script
@@ -4,5 +4,5 @@ trace $CLI bundle deploy
 
 job_id=$(read_id.py foo)
 
-trace musterr $CLI bundle deployment bind foo $job_id &> out.bind.$DATABRICKS_BUNDLE_ENGINE.txt
+trace musterr $CLI bundle deployment bind foo $job_id &> out.bind.txt
 trace $CLI bundle plan | contains.py "1 unchanged"
diff --git a/acceptance/bundle/deployment/bind/job/engine-from-config/out.test.toml b/acceptance/bundle/deployment/bind/job/engine-from-config/out.test.toml
index d6187dcb046..19b5b15d11f 100644
--- a/acceptance/bundle/deployment/bind/job/engine-from-config/out.test.toml
+++ b/acceptance/bundle/deployment/bind/job/engine-from-config/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = []
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/bind/job/engine-from-config/output.txt b/acceptance/bundle/deployment/bind/job/engine-from-config/output.txt
index 1e8bb572e8f..1c81c5d1ccc 100644
--- a/acceptance/bundle/deployment/bind/job/engine-from-config/output.txt
+++ b/acceptance/bundle/deployment/bind/job/engine-from-config/output.txt
@@ -1,20 +1,18 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/engine-from-config/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.job_1
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 === State files after deploy ===
 .databricks/bundle/default/resources.json
 
 >>> [CLI] bundle deployment unbind job_1
-Updating deployment state...
 
 >>> [CLI] jobs create --json {"name": "My Job"}
 
->>> [CLI] bundle deployment bind job_1 [NUMID] --auto-approve
-Updating deployment state...
-Successfully bound job with an id '[NUMID]'
+>>> [CLI] bundle deployment bind job_1 [JOB_ID] --auto-approve
+Successfully bound job with an id '[JOB_ID]'
 Run 'bundle deploy' to deploy changes to your workspace
 === State files after bind ===
 .databricks/bundle/default/resources.json
diff --git a/acceptance/bundle/deployment/bind/job/engine-from-config/script b/acceptance/bundle/deployment/bind/job/engine-from-config/script
index ac00fc85564..7f62df189d7 100644
--- a/acceptance/bundle/deployment/bind/job/engine-from-config/script
+++ b/acceptance/bundle/deployment/bind/job/engine-from-config/script
@@ -3,6 +3,8 @@
 # bundle.engine is set to "direct" in databricks.yml.
 # Both deploy and bind should use the direct engine.
 
+unset DATABRICKS_BUNDLE_ENGINE
+
 trace $CLI bundle deploy
 
 echo "=== State files after deploy ==="
@@ -13,6 +15,7 @@ trace $CLI bundle deployment unbind job_1
 
 # Create a new job to bind to
 job_id=$(trace $CLI jobs create --json '{"name": "My Job"}' | jq -r '.job_id')
+add_repl "$job_id" JOB_ID
 
 # Bind uses direct engine (reads bundle.engine from config).
 trace $CLI bundle deployment bind job_1 $job_id --auto-approve
diff --git a/acceptance/bundle/deployment/bind/job/engine-from-config/test.toml b/acceptance/bundle/deployment/bind/job/engine-from-config/test.toml
index 33e6ddaea12..b36629f1ecd 100644
--- a/acceptance/bundle/deployment/bind/job/engine-from-config/test.toml
+++ b/acceptance/bundle/deployment/bind/job/engine-from-config/test.toml
@@ -1,6 +1,4 @@
 Cloud = false # test leaves deployed job
 Ignore = [".databricks"]
 
-# Omit DATABRICKS_BUNDLE_ENGINE so bind must read engine from bundle.engine config.
-[EnvMatrix]
-  DATABRICKS_BUNDLE_ENGINE = []
+Env.DATABRICKS_BUNDLE_ENGINE = "direct"
diff --git a/acceptance/bundle/deployment/bind/job/generate-and-bind/out.test.toml b/acceptance/bundle/deployment/bind/job/generate-and-bind/out.test.toml
index 650836edeb3..f68b4a89c36 100644
--- a/acceptance/bundle/deployment/bind/job/generate-and-bind/out.test.toml
+++ b/acceptance/bundle/deployment/bind/job/generate-and-bind/out.test.toml
@@ -1,3 +1,2 @@
-Local = false
 Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/bind/job/generate-and-bind/output.txt b/acceptance/bundle/deployment/bind/job/generate-and-bind/output.txt
index ad92c2d3e0d..c80c5d84598 100644
--- a/acceptance/bundle/deployment/bind/job/generate-and-bind/output.txt
+++ b/acceptance/bundle/deployment/bind/job/generate-and-bind/output.txt
@@ -1,12 +1,12 @@
 
 === Create a pre-defined job:
-Created job with ID: [NUMID]
+Created job with ID: [JOB_ID]
 
 >>> [CLI] workspace mkdirs /Workspace/Users/[USERNAME]/python-[UNIQUE_NAME]
 
 >>> [CLI] workspace import /Workspace/Users/[USERNAME]/python-[UNIQUE_NAME]/test --file test.py --language PYTHON
 
->>> [CLI] bundle generate job --key test_job_key --existing-job-id [NUMID] --config-dir resources --source-dir src
+>>> [CLI] bundle generate job --key test_job_key --existing-job-id [JOB_ID] --config-dir resources --source-dir src
 File successfully saved to src/test.py
 Job configuration successfully saved to resources/test_job_key.job.yml
 
@@ -16,16 +16,15 @@ test.py
 >>> cat resources/test_job_key.job.yml
       name: generate-job-[UNIQUE_NAME]
 
->>> [CLI] bundle deployment bind test_job_key [NUMID] --auto-approve
-Updating deployment state...
-Successfully bound job with an id '[NUMID]'
+>>> [CLI] bundle deployment bind test_job_key [JOB_ID] --auto-approve
+Successfully bound job with an id '[JOB_ID]'
 Run 'bundle deploy' to deploy changes to your workspace
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-generate-bind-[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated jobs.test_job_key
+Files: 5 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
@@ -33,12 +32,11 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-generate-bind-[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
 
 === Check that job is bound and does not exist after bundle is destroyed:
->>> errcode [CLI] jobs get [NUMID] --output json
-Error: Job [NUMID] does not exist.
+>>> errcode [CLI] jobs get [JOB_ID] --output json
+Error: Job [JOB_ID] does not exist.
 
 Exit code: 1
 
diff --git a/acceptance/bundle/deployment/bind/job/generate-and-bind/script b/acceptance/bundle/deployment/bind/job/generate-and-bind/script
index a1f6e2c34e2..a049d45a9b8 100644
--- a/acceptance/bundle/deployment/bind/job/generate-and-bind/script
+++ b/acceptance/bundle/deployment/bind/job/generate-and-bind/script
@@ -26,6 +26,7 @@ JOB_ID=$($CLI jobs create --json '
   ]
 }' | jq -r '.job_id')
 
+add_repl "$JOB_ID" JOB_ID
 echo "Created job with ID: $JOB_ID"
 
 envsubst < databricks.yml.tmpl > databricks.yml
diff --git a/acceptance/bundle/deployment/bind/job/generate-and-bind/test.toml b/acceptance/bundle/deployment/bind/job/generate-and-bind/test.toml
index 01d47031e25..35e202bc361 100644
--- a/acceptance/bundle/deployment/bind/job/generate-and-bind/test.toml
+++ b/acceptance/bundle/deployment/bind/job/generate-and-bind/test.toml
@@ -1,7 +1,6 @@
-# This test is using a workspace import API to load a notebook file.
-# This API has a logic on how to accept notebook files and distinguishes them from regular python files.
-# To succeed locally we would need to replicate this logic in the fake_workspace
-Local = false
+# This test uses the workspace import API to load a notebook file. The testserver
+# models the SOURCE import format (notebook with an explicit language), so it runs
+# locally in addition to cloud.
 Cloud = true
 
 Ignore = [
@@ -10,8 +9,7 @@ Ignore = [
     "src/*"
 ]
 
-[Env]
 # MSYS2 automatically converts absolute paths like /Users/$username/$UNIQUE_NAME to
 # C:/Program Files/Git/Users/$username/UNIQUE_NAME before passing it to the CLI
 # Setting this environment variable prevents that conversion on windows.
-MSYS_NO_PATHCONV = "1"
+Env.MSYS_NO_PATHCONV = "1"
diff --git a/acceptance/bundle/deployment/bind/job/job-abort-bind/out.test.toml b/acceptance/bundle/deployment/bind/job/job-abort-bind/out.test.toml
index bbc7fcfd1bd..f68b4a89c36 100644
--- a/acceptance/bundle/deployment/bind/job/job-abort-bind/out.test.toml
+++ b/acceptance/bundle/deployment/bind/job/job-abort-bind/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/bind/job/job-abort-bind/output.txt b/acceptance/bundle/deployment/bind/job/job-abort-bind/output.txt
index 544448efbef..ee76570eda9 100644
--- a/acceptance/bundle/deployment/bind/job/job-abort-bind/output.txt
+++ b/acceptance/bundle/deployment/bind/job/job-abort-bind/output.txt
@@ -3,14 +3,18 @@
 Created job with ID: [JOB_ID]
 
 === Expect binding to fail without an auto-approve flag:
-Error: This bind operation requires user confirmation, but the current console does not support prompting. Please specify --auto-approve if you would like to skip prompts and proceed.
+Error: this bind operation requires user confirmation, but the current console does not support prompting.
+To proceed, use --auto-approve after reviewing the plan above.
+
+
+Exit code: 1
 
 === Deploy bundle:
 >>> [CLI] bundle deploy --force-lock
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bind-job-[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.foo
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 === Check that job is not bound and not updated with config from bundle:
 >>> [CLI] jobs get [JOB_ID]
diff --git a/acceptance/bundle/deployment/bind/job/job-abort-bind/script b/acceptance/bundle/deployment/bind/job/job-abort-bind/script
index bbe22b68fc4..57a9c5e57d8 100644
--- a/acceptance/bundle/deployment/bind/job/job-abort-bind/script
+++ b/acceptance/bundle/deployment/bind/job/job-abort-bind/script
@@ -23,7 +23,7 @@ JOB_ID=$($CLI jobs create --json '
 }' | jq -r '.job_id')
 
 echo "Created job with ID: $JOB_ID"
-echo "$JOB_ID:JOB_ID" >> ACC_REPLS
+add_repl "$JOB_ID" JOB_ID
 
 envsubst < $TESTDIR/../job-spark-python-task/databricks.yml.tmpl > databricks.yml
 
@@ -36,7 +36,7 @@ trap cleanup EXIT
 
 title "Expect binding to fail without an auto-approve flag:\n"
 trace errcode $CLI bundle deployment bind foo $JOB_ID &> out.bind-result.txt
-grep "^Error:" out.bind-result.txt
+sed -n '/^Error:/,$p' out.bind-result.txt
 rm out.bind-result.txt
 
 title "Deploy bundle:"
diff --git a/acceptance/bundle/deployment/bind/job/job-abort-bind/test.toml b/acceptance/bundle/deployment/bind/job/job-abort-bind/test.toml
index 8f87bf0f026..f9c33392008 100644
--- a/acceptance/bundle/deployment/bind/job/job-abort-bind/test.toml
+++ b/acceptance/bundle/deployment/bind/job/job-abort-bind/test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 
 Ignore = [
diff --git a/acceptance/bundle/deployment/bind/job/job-spark-python-task/out.test.toml b/acceptance/bundle/deployment/bind/job/job-spark-python-task/out.test.toml
index bbc7fcfd1bd..f68b4a89c36 100644
--- a/acceptance/bundle/deployment/bind/job/job-spark-python-task/out.test.toml
+++ b/acceptance/bundle/deployment/bind/job/job-spark-python-task/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/bind/job/job-spark-python-task/output.txt b/acceptance/bundle/deployment/bind/job/job-spark-python-task/output.txt
index 3b68a53f081..994bd66bd38 100644
--- a/acceptance/bundle/deployment/bind/job/job-spark-python-task/output.txt
+++ b/acceptance/bundle/deployment/bind/job/job-spark-python-task/output.txt
@@ -1,11 +1,10 @@
 
 === Create a pre-defined job:
-Created job with ID: [NUMID]
+Created job with ID: [JOB_ID]
 
 === Bind job:
->>> [CLI] bundle deployment bind foo [NUMID] --auto-approve
-Updating deployment state...
-Successfully bound job with an id '[NUMID]'
+>>> [CLI] bundle deployment bind foo [JOB_ID] --auto-approve
+Successfully bound job with an id '[JOB_ID]'
 Run 'bundle deploy' to deploy changes to your workspace
 
 === Remove .databricks directory to simulate fresh deployment:
@@ -14,14 +13,14 @@ Run 'bundle deploy' to deploy changes to your workspace
 === Deploy bundle:
 >>> [CLI] bundle deploy --force-lock --auto-approve
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bind-job-[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated jobs.foo
+Files: 3 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
 === Read the pre-defined job:
->>> [CLI] jobs get [NUMID]
+>>> [CLI] jobs get [JOB_ID]
 {
-  "job_id": [NUMID],
+  "job_id": [JOB_ID],
   "settings": {
     "name": "test-job-basic-[UNIQUE_NAME]",
     "tasks": [
@@ -37,7 +36,6 @@ Deployment complete!
 
 === Unbind the job:
 >>> [CLI] bundle deployment unbind foo
-Updating deployment state...
 
 === Remove .databricks directory to simulate fresh deployment:
 >>> rm -rf .databricks
@@ -46,13 +44,12 @@ Updating deployment state...
 >>> [CLI] bundle destroy --auto-approve
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bind-job-[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 0 deleted
 
 === Read the pre-defined job again (expecting it still exists):
->>> [CLI] jobs get [NUMID]
+>>> [CLI] jobs get [JOB_ID]
 {
-  "job_id": [NUMID],
+  "job_id": [JOB_ID],
   "settings": {
     "name": "test-job-basic-[UNIQUE_NAME]",
     "tasks": [
@@ -66,4 +63,4 @@ Destroy complete!
   }
 }
 
-=== Delete the pre-defined job [NUMID]:0
+=== Delete the pre-defined job [JOB_ID]:0
diff --git a/acceptance/bundle/deployment/bind/job/job-spark-python-task/script b/acceptance/bundle/deployment/bind/job/job-spark-python-task/script
index c0831899416..8562dab5647 100644
--- a/acceptance/bundle/deployment/bind/job/job-spark-python-task/script
+++ b/acceptance/bundle/deployment/bind/job/job-spark-python-task/script
@@ -19,6 +19,7 @@ JOB_ID=$($CLI jobs create --json '
     }
   ]
 }' | jq -r '.job_id')
+add_repl "$JOB_ID" JOB_ID
 
 echo "Created job with ID: $JOB_ID"
 
diff --git a/acceptance/bundle/deployment/bind/job/job-spark-python-task/test.toml b/acceptance/bundle/deployment/bind/job/job-spark-python-task/test.toml
index a07b3c091e6..36c17b2ed41 100644
--- a/acceptance/bundle/deployment/bind/job/job-spark-python-task/test.toml
+++ b/acceptance/bundle/deployment/bind/job/job-spark-python-task/test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 
 Ignore = [
diff --git a/acceptance/bundle/deployment/bind/job/noop-job/out.job.direct.json b/acceptance/bundle/deployment/bind/job/noop-job/out.job.direct.json
deleted file mode 100644
index 80509b893bd..00000000000
--- a/acceptance/bundle/deployment/bind/job/noop-job/out.job.direct.json
+++ /dev/null
@@ -1,22 +0,0 @@
-{
-  "created_time": [UNIX_TIME_MILLIS],
-  "creator_user_name": "[USERNAME]",
-  "job_id": [NUMID],
-  "run_as_user_name": "[USERNAME]",
-  "settings": {
-    "deployment": {
-      "kind": "BUNDLE",
-      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_project/default/state/metadata.json"
-    },
-    "edit_mode": "UI_LOCKED",
-    "email_notifications": {},
-    "format": "MULTI_TASK",
-    "max_concurrent_runs": 1,
-    "name": "Updated Job",
-    "queue": {
-      "enabled": true
-    },
-    "timeout_seconds": 0,
-    "webhook_notifications": {}
-  }
-}
diff --git a/acceptance/bundle/deployment/bind/job/noop-job/out.job.json b/acceptance/bundle/deployment/bind/job/noop-job/out.job.json
new file mode 100644
index 00000000000..8eb7900d9f9
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/job/noop-job/out.job.json
@@ -0,0 +1,22 @@
+{
+  "created_time": [UNIX_TIME_MILLIS],
+  "creator_user_name": "[USERNAME]",
+  "job_id": [JOB_ID],
+  "run_as_user_name": "[USERNAME]",
+  "settings": {
+    "deployment": {
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_project/default/state/metadata.json"
+    },
+    "edit_mode": "UI_LOCKED",
+    "email_notifications": {},
+    "format": "MULTI_TASK",
+    "max_concurrent_runs": 1,
+    "name": "Updated Job",
+    "queue": {
+      "enabled": true
+    },
+    "timeout_seconds": 0,
+    "webhook_notifications": {}
+  }
+}
diff --git a/acceptance/bundle/deployment/bind/job/noop-job/out.job.terraform.json b/acceptance/bundle/deployment/bind/job/noop-job/out.job.terraform.json
deleted file mode 100644
index 99953cf995c..00000000000
--- a/acceptance/bundle/deployment/bind/job/noop-job/out.job.terraform.json
+++ /dev/null
@@ -1,25 +0,0 @@
-{
-  "created_time": [UNIX_TIME_MILLIS],
-  "creator_user_name": "[USERNAME]",
-  "job_id": [NUMID],
-  "run_as_user_name": "[USERNAME]",
-  "settings": {
-    "deployment": {
-      "kind": "BUNDLE",
-      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_project/default/state/metadata.json"
-    },
-    "edit_mode": "UI_LOCKED",
-    "email_notifications": {},
-    "format": "MULTI_TASK",
-    "max_concurrent_runs": 1,
-    "name": "Updated Job",
-    "queue": {
-      "enabled": true
-    },
-    "run_as": {
-      "user_name": "[USERNAME]"
-    },
-    "timeout_seconds": 0,
-    "webhook_notifications": {}
-  }
-}
diff --git a/acceptance/bundle/deployment/bind/job/noop-job/out.test.toml b/acceptance/bundle/deployment/bind/job/noop-job/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/deployment/bind/job/noop-job/out.test.toml
+++ b/acceptance/bundle/deployment/bind/job/noop-job/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/bind/job/noop-job/output.txt b/acceptance/bundle/deployment/bind/job/noop-job/output.txt
index 21d3780de6c..956f90977b4 100644
--- a/acceptance/bundle/deployment/bind/job/noop-job/output.txt
+++ b/acceptance/bundle/deployment/bind/job/noop-job/output.txt
@@ -1,15 +1,14 @@
 
 >>> [CLI] jobs create --json {"name": "My Job"}
 
->>> [CLI] bundle deployment bind job_1 [NUMID] --auto-approve
-Updating deployment state...
-Successfully bound job with an id '[NUMID]'
+>>> [CLI] bundle deployment bind job_1 [JOB_ID] --auto-approve
+Successfully bound job with an id '[JOB_ID]'
 Run 'bundle deploy' to deploy changes to your workspace
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/my_project/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated jobs.job_1
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
->>> [CLI] jobs get [NUMID] --output json
+>>> [CLI] jobs get [JOB_ID] --output json
diff --git a/acceptance/bundle/deployment/bind/job/noop-job/script b/acceptance/bundle/deployment/bind/job/noop-job/script
index d844cea5b31..325a38f4726 100644
--- a/acceptance/bundle/deployment/bind/job/noop-job/script
+++ b/acceptance/bundle/deployment/bind/job/noop-job/script
@@ -1,8 +1,9 @@
 job_id=$(trace $CLI jobs create --json '{"name": "My Job"}' | jq -r '.job_id')
+add_repl "$job_id" JOB_ID
 
 trace $CLI bundle deployment bind job_1 $job_id --auto-approve
 
 trace $CLI bundle deploy
 
 # there is a difference: in terraform there is also run_as entry
-trace $CLI jobs get $job_id --output json > out.job.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI jobs get $job_id --output json > out.job.json
diff --git a/acceptance/bundle/deployment/bind/job/python-job/out.job.direct.json b/acceptance/bundle/deployment/bind/job/python-job/out.job.direct.json
deleted file mode 100644
index 80509b893bd..00000000000
--- a/acceptance/bundle/deployment/bind/job/python-job/out.job.direct.json
+++ /dev/null
@@ -1,22 +0,0 @@
-{
-  "created_time": [UNIX_TIME_MILLIS],
-  "creator_user_name": "[USERNAME]",
-  "job_id": [NUMID],
-  "run_as_user_name": "[USERNAME]",
-  "settings": {
-    "deployment": {
-      "kind": "BUNDLE",
-      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_project/default/state/metadata.json"
-    },
-    "edit_mode": "UI_LOCKED",
-    "email_notifications": {},
-    "format": "MULTI_TASK",
-    "max_concurrent_runs": 1,
-    "name": "Updated Job",
-    "queue": {
-      "enabled": true
-    },
-    "timeout_seconds": 0,
-    "webhook_notifications": {}
-  }
-}
diff --git a/acceptance/bundle/deployment/bind/job/python-job/out.job.json b/acceptance/bundle/deployment/bind/job/python-job/out.job.json
new file mode 100644
index 00000000000..8eb7900d9f9
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/job/python-job/out.job.json
@@ -0,0 +1,22 @@
+{
+  "created_time": [UNIX_TIME_MILLIS],
+  "creator_user_name": "[USERNAME]",
+  "job_id": [JOB_ID],
+  "run_as_user_name": "[USERNAME]",
+  "settings": {
+    "deployment": {
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_project/default/state/metadata.json"
+    },
+    "edit_mode": "UI_LOCKED",
+    "email_notifications": {},
+    "format": "MULTI_TASK",
+    "max_concurrent_runs": 1,
+    "name": "Updated Job",
+    "queue": {
+      "enabled": true
+    },
+    "timeout_seconds": 0,
+    "webhook_notifications": {}
+  }
+}
diff --git a/acceptance/bundle/deployment/bind/job/python-job/out.job.terraform.json b/acceptance/bundle/deployment/bind/job/python-job/out.job.terraform.json
deleted file mode 100644
index 99953cf995c..00000000000
--- a/acceptance/bundle/deployment/bind/job/python-job/out.job.terraform.json
+++ /dev/null
@@ -1,25 +0,0 @@
-{
-  "created_time": [UNIX_TIME_MILLIS],
-  "creator_user_name": "[USERNAME]",
-  "job_id": [NUMID],
-  "run_as_user_name": "[USERNAME]",
-  "settings": {
-    "deployment": {
-      "kind": "BUNDLE",
-      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_project/default/state/metadata.json"
-    },
-    "edit_mode": "UI_LOCKED",
-    "email_notifications": {},
-    "format": "MULTI_TASK",
-    "max_concurrent_runs": 1,
-    "name": "Updated Job",
-    "queue": {
-      "enabled": true
-    },
-    "run_as": {
-      "user_name": "[USERNAME]"
-    },
-    "timeout_seconds": 0,
-    "webhook_notifications": {}
-  }
-}
diff --git a/acceptance/bundle/deployment/bind/job/python-job/out.test.toml b/acceptance/bundle/deployment/bind/job/python-job/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/deployment/bind/job/python-job/out.test.toml
+++ b/acceptance/bundle/deployment/bind/job/python-job/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/bind/job/python-job/output.txt b/acceptance/bundle/deployment/bind/job/python-job/output.txt
index 2e327e3b476..22cb66acf04 100644
--- a/acceptance/bundle/deployment/bind/job/python-job/output.txt
+++ b/acceptance/bundle/deployment/bind/job/python-job/output.txt
@@ -1,15 +1,14 @@
 
 >>> [CLI] jobs create --json {"name": "My Job"}
 
->>> uv run --with [DATABRICKS_BUNDLES_WHEEL] -q [CLI] bundle deployment bind job_1 [NUMID] --auto-approve
-Updating deployment state...
-Successfully bound job with an id '[NUMID]'
+>>> uv run --with [DATABRICKS_BUNDLES_WHEEL] -q [CLI] bundle deployment bind job_1 [JOB_ID] --auto-approve
+Successfully bound job with an id '[JOB_ID]'
 Run 'bundle deploy' to deploy changes to your workspace
 
 >>> uv run --with [DATABRICKS_BUNDLES_WHEEL] -q [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/my_project/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated jobs.job_1
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
->>> [CLI] jobs get [NUMID] --output json
+>>> [CLI] jobs get [JOB_ID] --output json
diff --git a/acceptance/bundle/deployment/bind/job/python-job/script b/acceptance/bundle/deployment/bind/job/python-job/script
index 8120a8a5725..b915a7243f0 100644
--- a/acceptance/bundle/deployment/bind/job/python-job/script
+++ b/acceptance/bundle/deployment/bind/job/python-job/script
@@ -1,9 +1,10 @@
 UV_RUN="uv run --with $DATABRICKS_BUNDLES_WHEEL -q"
 
 job_id=$(trace $CLI jobs create --json '{"name": "My Job"}' | jq -r '.job_id')
+add_repl "$job_id" JOB_ID
 
 trace $UV_RUN $CLI bundle deployment bind job_1 $job_id --auto-approve
 
 trace $UV_RUN $CLI bundle deploy
 
-trace $CLI jobs get $job_id --output json > out.job.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI jobs get $job_id --output json > out.job.json
diff --git a/acceptance/bundle/deployment/bind/job/stale-state/out.bind.terraform.txt b/acceptance/bundle/deployment/bind/job/stale-state/out.bind.terraform.txt
deleted file mode 100644
index 88dabf9f204..00000000000
--- a/acceptance/bundle/deployment/bind/job/stale-state/out.bind.terraform.txt
+++ /dev/null
@@ -1,14 +0,0 @@
-
->>> errcode [CLI] bundle deployment bind job_2 [EXTERNAL_JOB_ID] --auto-approve
-Error: terraform import: exit status 1
-
-Error: Resource already managed by Terraform
-
-Terraform is already managing a remote object for databricks_job.job_2. To
-import to this address you must first remove the existing object from the
-state.
-
-
-
-
-Exit code: 1
diff --git a/acceptance/bundle/deployment/bind/job/stale-state/out.bind.direct.txt b/acceptance/bundle/deployment/bind/job/stale-state/out.bind.txt
similarity index 100%
rename from acceptance/bundle/deployment/bind/job/stale-state/out.bind.direct.txt
rename to acceptance/bundle/deployment/bind/job/stale-state/out.bind.txt
diff --git a/acceptance/bundle/deployment/bind/job/stale-state/out.test.toml b/acceptance/bundle/deployment/bind/job/stale-state/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/deployment/bind/job/stale-state/out.test.toml
+++ b/acceptance/bundle/deployment/bind/job/stale-state/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/bind/job/stale-state/output.txt b/acceptance/bundle/deployment/bind/job/stale-state/output.txt
index 815586e6d4a..de95b53685f 100644
--- a/acceptance/bundle/deployment/bind/job/stale-state/output.txt
+++ b/acceptance/bundle/deployment/bind/job/stale-state/output.txt
@@ -2,17 +2,17 @@
 === Step 1: Deploy with job_1 only
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/stale_state_test/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.job_1
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 === Step 2: Save stale local state (has only job_1, serial=1)
 === Step 3: Add job_2 to config and deploy again
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/stale_state_test/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.job_2
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 1 unchanged
 
 === Step 4: Record deployed job_2 ID from stateDeployed job_2 ID: [JOB_2_ID]
 
diff --git a/acceptance/bundle/deployment/bind/job/stale-state/script b/acceptance/bundle/deployment/bind/job/stale-state/script
index 32a2d3fb47d..a931f94d52a 100755
--- a/acceptance/bundle/deployment/bind/job/stale-state/script
+++ b/acceptance/bundle/deployment/bind/job/stale-state/script
@@ -1,8 +1,4 @@
-if [ "$DATABRICKS_BUNDLE_ENGINE" = "direct" ]; then
-  state_file=".databricks/bundle/default/resources.json"
-else
-  state_file=".databricks/bundle/default/terraform/terraform.tfstate"
-fi
+state_file=".databricks/bundle/default/resources.json"
 
 title "Step 1: Deploy with job_1 only"
 trace $CLI bundle deploy
@@ -22,6 +18,6 @@ cp stale_state.json "$state_file"
 
 title "Step 6: Create external job and try to bind (should fail: remote state already has job_2)\n"
 job_id=$($CLI jobs create --json '{"name": "External Job"}' | jq -r '.job_id')
-add_repl.py "$job_id" EXTERNAL_JOB_ID
+add_repl "$job_id" EXTERNAL_JOB_ID
 echo "External job ID: $job_id"
-trace errcode $CLI bundle deployment bind job_2 $job_id --auto-approve &> out.bind.$DATABRICKS_BUNDLE_ENGINE.txt
+trace errcode $CLI bundle deployment bind job_2 $job_id --auto-approve &> out.bind.txt
diff --git a/acceptance/bundle/deployment/bind/job/stale-state/test.toml b/acceptance/bundle/deployment/bind/job/stale-state/test.toml
index df072247bac..0002c563689 100644
--- a/acceptance/bundle/deployment/bind/job/stale-state/test.toml
+++ b/acceptance/bundle/deployment/bind/job/stale-state/test.toml
@@ -4,6 +4,3 @@ Ignore = [
   "databricks_v2.yml",
   "stale_state.json",
 ]
-
-[EnvMatrix]
-DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/bundle/deployment/bind/job/unreadable-state/databricks.yml b/acceptance/bundle/deployment/bind/job/unreadable-state/databricks.yml
new file mode 100644
index 00000000000..4077df9f8b3
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/job/unreadable-state/databricks.yml
@@ -0,0 +1,7 @@
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    job_1:
+      name: Job 1
diff --git a/acceptance/bundle/deployment/bind/job/unreadable-state/out.test.toml b/acceptance/bundle/deployment/bind/job/unreadable-state/out.test.toml
new file mode 100644
index 00000000000..27ec2a7fcd6
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/job/unreadable-state/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/bind/job/unreadable-state/output.txt b/acceptance/bundle/deployment/bind/job/unreadable-state/output.txt
new file mode 100644
index 00000000000..fb685a8f8f8
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/job/unreadable-state/output.txt
@@ -0,0 +1,21 @@
+
+=== Deploy job_1
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created jobs.job_1
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Leave behind a WAL from a different lineage, as a crashed deploy would
+=== Bind must refuse: the state cannot be read, so we cannot tell if job_1 is already managed
+
+>>> errcode [CLI] bundle deployment bind job_1 [EXTERNAL_JOB_ID] --auto-approve
+Error: cannot check whether resources.jobs.job_1 is already bound: reading state from [TEST_TMP_DIR]/.databricks/bundle/default/resources.json: WAL recovery failed: WAL lineage ("wal-lineage-bbb") does not match state lineage ("[UUID]")
+
+
+Exit code: 1
+
+=== Nothing was bound: the WAL is untouched and no bind state was written
+>>> diff.py resources.json.wal .databricks/bundle/default/resources.json.wal
+
+>>> assert_not_exists.py .databricks/bundle/default/resources.json.temp-bind
diff --git a/acceptance/bundle/deployment/bind/job/unreadable-state/resources.json.wal b/acceptance/bundle/deployment/bind/job/unreadable-state/resources.json.wal
new file mode 100644
index 00000000000..5ecc88124f0
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/job/unreadable-state/resources.json.wal
@@ -0,0 +1,2 @@
+{"lineage":"wal-lineage-bbb","serial":2}
+{"k":"resources.jobs.job_1","v":{"__id__":"1001","state":{"name":"Job 1"}}}
diff --git a/acceptance/bundle/deployment/bind/job/unreadable-state/script b/acceptance/bundle/deployment/bind/job/unreadable-state/script
new file mode 100644
index 00000000000..8a3a2ed81d1
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/job/unreadable-state/script
@@ -0,0 +1,14 @@
+title "Deploy job_1"
+trace $CLI bundle deploy
+
+title "Leave behind a WAL from a different lineage, as a crashed deploy would"
+cp resources.json.wal .databricks/bundle/default/
+
+title "Bind must refuse: the state cannot be read, so we cannot tell if job_1 is already managed\n"
+job_id=$($CLI jobs create --json '{"name": "External Job"}' | jq -r '.job_id')
+add_repl "$job_id" EXTERNAL_JOB_ID
+trace errcode $CLI bundle deployment bind job_1 "$job_id" --auto-approve
+
+title "Nothing was bound: the WAL is untouched and no bind state was written"
+trace diff.py resources.json.wal .databricks/bundle/default/resources.json.wal
+trace assert_not_exists.py .databricks/bundle/default/resources.json.temp-bind
diff --git a/acceptance/bundle/deployment/bind/job/unreadable-state/test.toml b/acceptance/bundle/deployment/bind/job/unreadable-state/test.toml
new file mode 100644
index 00000000000..267ca365b0f
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/job/unreadable-state/test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+
+EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/deployment/bind/mcp_service/databricks.yml b/acceptance/bundle/deployment/bind/mcp_service/databricks.yml
new file mode 100644
index 00000000000..c5958aa56b6
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/mcp_service/databricks.yml
@@ -0,0 +1,9 @@
+bundle:
+  name: test-bundle
+
+resources:
+  mcp_services:
+    mcp1:
+      parent: schemas/main.myschema
+      mcp_service_id: mysvc
+      comment: bound service
diff --git a/acceptance/bundle/deployment/bind/mcp_service/out.test.toml b/acceptance/bundle/deployment/bind/mcp_service/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/mcp_service/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/bind/mcp_service/output.txt b/acceptance/bundle/deployment/bind/mcp_service/output.txt
new file mode 100644
index 00000000000..63a9244a93c
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/mcp_service/output.txt
@@ -0,0 +1,30 @@
+
+>>> [CLI] bundle deployment bind mcp1 main.myschema.mysvc --auto-approve
+Successfully bound mcp_service with an id 'main.myschema.mysvc'
+Run 'bundle deploy' to deploy changes to your workspace
+
+>>> [CLI] bundle summary
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+Resources:
+  MCP services:
+    mcp1:
+      Name: mysvc
+      URL:  [DATABRICKS_URL]/explore/data/mcp-services/main/myschema/mysvc?w=[WORKSPACE_ID]
+
+>>> [CLI] bundle deployment unbind mcp1
+
+>>> [CLI] bundle summary
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+Resources:
+  MCP services:
+    mcp1:
+      Name: mysvc
+      URL:  (not deployed)
diff --git a/acceptance/bundle/deployment/bind/mcp_service/script b/acceptance/bundle/deployment/bind/mcp_service/script
new file mode 100644
index 00000000000..5314f84d153
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/mcp_service/script
@@ -0,0 +1,5 @@
+trace $CLI bundle deployment bind mcp1 main.myschema.mysvc --auto-approve
+trace $CLI bundle summary
+
+trace $CLI bundle deployment unbind mcp1
+trace $CLI bundle summary
diff --git a/acceptance/bundle/deployment/bind/mcp_service/test.toml b/acceptance/bundle/deployment/bind/mcp_service/test.toml
new file mode 100644
index 00000000000..025e9521ea9
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/mcp_service/test.toml
@@ -0,0 +1,17 @@
+# AI Gateway securables are direct-engine only.
+
+Cloud = false
+
+Ignore = [
+    ".databricks",
+]
+
+# The bind flow issues a GET to confirm the remote resource exists before binding.
+[[Server]]
+Pattern = "GET /api/2.1/unity-catalog/mcp-services/{name}"
+Response.Body = '''
+{
+  "name": "mcp-services/main.myschema.mysvc",
+  "comment": "bound service"
+}
+'''
diff --git a/acceptance/bundle/deployment/bind/model-serving-endpoint/out.test.toml b/acceptance/bundle/deployment/bind/model-serving-endpoint/out.test.toml
index bbc7fcfd1bd..f68b4a89c36 100644
--- a/acceptance/bundle/deployment/bind/model-serving-endpoint/out.test.toml
+++ b/acceptance/bundle/deployment/bind/model-serving-endpoint/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/bind/model-serving-endpoint/output.txt b/acceptance/bundle/deployment/bind/model-serving-endpoint/output.txt
index 702a1c17189..f11fea10cb4 100644
--- a/acceptance/bundle/deployment/bind/model-serving-endpoint/output.txt
+++ b/acceptance/bundle/deployment/bind/model-serving-endpoint/output.txt
@@ -29,15 +29,13 @@ resources:
 }
 
 >>> [CLI] bundle deployment bind endpoint1 test-endpoint-[UNIQUE_NAME]
-Updating deployment state...
 Successfully bound model_serving_endpoint with an id 'test-endpoint-[UNIQUE_NAME]'
 Run 'bundle deploy' to deploy changes to your workspace
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
 
 >>> [CLI] serving-endpoints get test-endpoint-[UNIQUE_NAME]
 {
@@ -51,13 +49,11 @@ Deployment complete!
 }
 
 >>> [CLI] bundle deployment unbind endpoint1
-Updating deployment state...
 
 >>> [CLI] bundle destroy --auto-approve
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 0 deleted
 
 >>> [CLI] serving-endpoints get test-endpoint-[UNIQUE_NAME]
 {
diff --git a/acceptance/bundle/deployment/bind/model-serving-endpoint/test.toml b/acceptance/bundle/deployment/bind/model-serving-endpoint/test.toml
index 0e8c8a38404..c7c6f58ed6e 100644
--- a/acceptance/bundle/deployment/bind/model-serving-endpoint/test.toml
+++ b/acceptance/bundle/deployment/bind/model-serving-endpoint/test.toml
@@ -1,2 +1 @@
-Local = true
 Cloud = true
diff --git a/acceptance/bundle/deployment/bind/model_provider_service/databricks.yml b/acceptance/bundle/deployment/bind/model_provider_service/databricks.yml
new file mode 100644
index 00000000000..18717f5715e
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/model_provider_service/databricks.yml
@@ -0,0 +1,16 @@
+bundle:
+  name: test-bundle
+
+resources:
+  model_provider_services:
+    mps1:
+      parent: schemas/main.myschema
+      model_provider_service_id: mysvc
+      comment: bound service
+      config:
+        provider_type: EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM
+        custom:
+          direct:
+            base_url: https://api.example.com/v1
+            api_key:
+              plaintext: dummy-api-key
diff --git a/acceptance/bundle/deployment/bind/model_provider_service/out.test.toml b/acceptance/bundle/deployment/bind/model_provider_service/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/model_provider_service/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/bind/model_provider_service/output.txt b/acceptance/bundle/deployment/bind/model_provider_service/output.txt
new file mode 100644
index 00000000000..ebb16ddd3b3
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/model_provider_service/output.txt
@@ -0,0 +1,30 @@
+
+>>> [CLI] bundle deployment bind mps1 main.myschema.mysvc --auto-approve
+Successfully bound model_provider_service with an id 'main.myschema.mysvc'
+Run 'bundle deploy' to deploy changes to your workspace
+
+>>> [CLI] bundle summary
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+Resources:
+  Model provider services:
+    mps1:
+      Name: mysvc
+      URL:  [DATABRICKS_URL]/explore/data/model-provider-services/main/myschema/mysvc?w=[WORKSPACE_ID]
+
+>>> [CLI] bundle deployment unbind mps1
+
+>>> [CLI] bundle summary
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+Resources:
+  Model provider services:
+    mps1:
+      Name: mysvc
+      URL:  (not deployed)
diff --git a/acceptance/bundle/deployment/bind/model_provider_service/script b/acceptance/bundle/deployment/bind/model_provider_service/script
new file mode 100644
index 00000000000..c003c48256c
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/model_provider_service/script
@@ -0,0 +1,5 @@
+trace $CLI bundle deployment bind mps1 main.myschema.mysvc --auto-approve
+trace $CLI bundle summary
+
+trace $CLI bundle deployment unbind mps1
+trace $CLI bundle summary
diff --git a/acceptance/bundle/deployment/bind/model_provider_service/test.toml b/acceptance/bundle/deployment/bind/model_provider_service/test.toml
new file mode 100644
index 00000000000..7f9f253ea48
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/model_provider_service/test.toml
@@ -0,0 +1,17 @@
+# AI Gateway securables are direct-engine only.
+
+Cloud = false
+
+Ignore = [
+    ".databricks",
+]
+
+# The bind flow issues a GET to confirm the remote resource exists before binding.
+[[Server]]
+Pattern = "GET /api/2.1/unity-catalog/model-provider-services/{name}"
+Response.Body = '''
+{
+  "name": "model-provider-services/main.myschema.mysvc",
+  "comment": "bound service"
+}
+'''
diff --git a/acceptance/bundle/deployment/bind/model_service/databricks.yml b/acceptance/bundle/deployment/bind/model_service/databricks.yml
new file mode 100644
index 00000000000..8d56e3b54d4
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/model_service/databricks.yml
@@ -0,0 +1,9 @@
+bundle:
+  name: test-bundle
+
+resources:
+  model_services:
+    ms1:
+      parent: schemas/main.myschema
+      model_service_id: mysvc
+      comment: bound service
diff --git a/acceptance/bundle/deployment/bind/model_service/out.test.toml b/acceptance/bundle/deployment/bind/model_service/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/model_service/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/bind/model_service/output.txt b/acceptance/bundle/deployment/bind/model_service/output.txt
new file mode 100644
index 00000000000..7e49db6c1ea
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/model_service/output.txt
@@ -0,0 +1,30 @@
+
+>>> [CLI] bundle deployment bind ms1 main.myschema.mysvc --auto-approve
+Successfully bound model_service with an id 'main.myschema.mysvc'
+Run 'bundle deploy' to deploy changes to your workspace
+
+>>> [CLI] bundle summary
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+Resources:
+  Model services:
+    ms1:
+      Name: mysvc
+      URL:  [DATABRICKS_URL]/explore/data/model-services/main/myschema/mysvc?w=[WORKSPACE_ID]
+
+>>> [CLI] bundle deployment unbind ms1
+
+>>> [CLI] bundle summary
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+Resources:
+  Model services:
+    ms1:
+      Name: mysvc
+      URL:  (not deployed)
diff --git a/acceptance/bundle/deployment/bind/model_service/script b/acceptance/bundle/deployment/bind/model_service/script
new file mode 100644
index 00000000000..e886f5dcd85
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/model_service/script
@@ -0,0 +1,5 @@
+trace $CLI bundle deployment bind ms1 main.myschema.mysvc --auto-approve
+trace $CLI bundle summary
+
+trace $CLI bundle deployment unbind ms1
+trace $CLI bundle summary
diff --git a/acceptance/bundle/deployment/bind/model_service/test.toml b/acceptance/bundle/deployment/bind/model_service/test.toml
new file mode 100644
index 00000000000..72e6e74c0ba
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/model_service/test.toml
@@ -0,0 +1,17 @@
+# AI Gateway securables are direct-engine only.
+
+Cloud = false
+
+Ignore = [
+    ".databricks",
+]
+
+# The bind flow issues a GET to confirm the remote resource exists before binding.
+[[Server]]
+Pattern = "GET /api/2.1/unity-catalog/model-services/{name}"
+Response.Body = '''
+{
+  "name": "model-services/main.myschema.mysvc",
+  "comment": "bound service"
+}
+'''
diff --git a/acceptance/bundle/deployment/bind/pipelines/recreate/out.bind-fail.direct.txt b/acceptance/bundle/deployment/bind/pipelines/recreate/out.bind-fail.direct.txt
deleted file mode 100644
index c5e00b49cbf..00000000000
--- a/acceptance/bundle/deployment/bind/pipelines/recreate/out.bind-fail.direct.txt
+++ /dev/null
@@ -1,15 +0,0 @@
-
->>> musterr [CLI] bundle deployment bind foo [NEW_PIPELINE_ID]
-Plan: recreate resources.pipelines.foo
-
-Changes detected:
-  ~ channel: null -> "CURRENT"
-  ~ deployment: null -> {"kind":"BUNDLE","metadata_file_path":"/Workspace/Users/[USERNAME]/.bundle/test-pipeline-recreate-[UNIQUE_NAME]/default/state/metadata.json"}
-  ~ edition: null -> "ADVANCED"
-  ~ libraries: [{"glob":{"include":"/Workspace/Users/someuser@databricks.com/lakeflow_pipeline/transformations/**"}},{"glob":{"include":"/Workspace/Users/foo@databricks.com/another/**"}}] -> [{"notebook":{"path":"/Workspace/Users/[USERNAME]/.bundle/test-pipeline-recreate-[UNIQUE_NAME]/default/files/nb"}}]
-  ~ name: "lakeflow-pipeline-[UNIQUE_NAME]" -> "test-pipeline-[UNIQUE_NAME]"
-  ~ root_path: "/Workspace/Users/someuser@databricks.com/lakeflow_pipeline" -> null
-  ~ storage: "/Shared/old_storage" -> "/Shared/new_storage"
-
-Error: This bind operation requires user confirmation, but the current console does not support prompting. Please specify --auto-approve if you would like to skip prompts and proceed.
-
diff --git a/acceptance/bundle/deployment/bind/pipelines/recreate/out.bind-fail.terraform.txt b/acceptance/bundle/deployment/bind/pipelines/recreate/out.bind-fail.terraform.txt
deleted file mode 100644
index 1d300160a95..00000000000
--- a/acceptance/bundle/deployment/bind/pipelines/recreate/out.bind-fail.terraform.txt
+++ /dev/null
@@ -1,58 +0,0 @@
-
->>> musterr [CLI] bundle deployment bind foo [NEW_PIPELINE_ID]
-databricks_pipeline.foo: Refreshing state... [id=[NEW_PIPELINE_ID]]
-
-Terraform used the selected providers to generate the following execution
-plan. Resource actions are indicated with the following symbols:
--/+ destroy and then create replacement
-
-Terraform will perform the following actions:
-
-  # databricks_pipeline.foo must be replaced
--/+ resource "databricks_pipeline" "foo" {
-      - allow_duplicate_names  = false -> null
-      + cause                  = (known after apply)
-      + channel                = "CURRENT"
-      + cluster_id             = (known after apply)
-      - continuous             = false -> null
-      ~ creator_user_name      = "[USERNAME]" -> (known after apply)
-      - development            = false -> null
-      + edition                = "ADVANCED"
-      - expected_last_modified = 0 -> null
-      + health                 = (known after apply)
-      ~ id                     = "[NEW_PIPELINE_ID]" -> (known after apply)
-      ~ last_modified          = [UNIX_TIME_MILLIS] -> (known after apply)
-      ~ name                   = "lakeflow-pipeline-[UNIQUE_NAME]" -> "test-pipeline-[UNIQUE_NAME]"
-      - photon                 = false -> null
-      - root_path              = "/Workspace/Users/someuser@databricks.com/lakeflow_pipeline" -> null
-      ~ run_as_user_name       = "[USERNAME]" -> (known after apply)
-      - serverless             = false -> null
-      ~ state                  = "IDLE" -> (known after apply)
-      ~ storage                = "/Shared/old_storage" -> "/Shared/new_storage" # forces replacement
-      ~ url                    = "[DATABRICKS_URL]/#joblist/pipelines/[NEW_PIPELINE_ID]" -> (known after apply)
-
-      + deployment {
-          + kind               = "BUNDLE"
-          + metadata_file_path = "/Workspace/Users/[USERNAME]/.bundle/test-pipeline-recreate-[UNIQUE_NAME]/default/state/metadata.json"
-        }
-
-      ~ library {
-          - glob {
-              - include = "/Workspace/Users/someuser@databricks.com/lakeflow_pipeline/transformations/**" -> null
-            }
-          + notebook {
-              + path = "/Workspace/Users/[USERNAME]/.bundle/test-pipeline-recreate-[UNIQUE_NAME]/default/files/nb"
-            }
-        }
-      - library {
-          - glob {
-              - include = "/Workspace/Users/foo@databricks.com/another/**" -> null
-            }
-        }
-    }
-
-Plan: 1 to add, 0 to change, 1 to destroy.
-
-
-Error: This bind operation requires user confirmation, but the current console does not support prompting. Please specify --auto-approve if you would like to skip prompts and proceed.
-
diff --git a/acceptance/bundle/deployment/bind/pipelines/recreate/out.bind-fail.txt b/acceptance/bundle/deployment/bind/pipelines/recreate/out.bind-fail.txt
new file mode 100644
index 00000000000..b081c183915
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/pipelines/recreate/out.bind-fail.txt
@@ -0,0 +1,16 @@
+
+>>> musterr [CLI] bundle deployment bind foo [NEW_PIPELINE_ID]
+Plan: recreate resources.pipelines.foo
+
+Changes detected:
+  ~ channel: null -> "CURRENT"
+  ~ deployment: null -> {"kind":"BUNDLE","metadata_file_path":"/Workspace/Users/[USERNAME]/.bundle/test-pipeline-recreate-[UNIQUE_NAME]/default/state/metadata.json"}
+  ~ edition: null -> "ADVANCED"
+  ~ libraries: [{"glob":{"include":"/Workspace/Users/someuser@databricks.com/lakeflow_pipeline/transformations/**"}},{"glob":{"include":"/Workspace/Users/foo@databricks.com/another/**"}}] -> [{"notebook":{"path":"/Workspace/Users/[USERNAME]/.bundle/test-pipeline-recreate-[UNIQUE_NAME]/default/files/nb"}}]
+  ~ name: "lakeflow-pipeline-[UNIQUE_NAME]" -> "test-pipeline-[UNIQUE_NAME]"
+  ~ root_path: "/Workspace/Users/someuser@databricks.com/lakeflow_pipeline" -> null
+  ~ storage: "/Shared/old_storage" -> "/Shared/new_storage"
+
+Error: this bind operation requires user confirmation, but the current console does not support prompting.
+To proceed, use --auto-approve after reviewing the plan above.
+
diff --git a/acceptance/bundle/deployment/bind/pipelines/recreate/out.bind-success.direct.txt b/acceptance/bundle/deployment/bind/pipelines/recreate/out.bind-success.direct.txt
deleted file mode 100644
index 6c88a3134b8..00000000000
--- a/acceptance/bundle/deployment/bind/pipelines/recreate/out.bind-success.direct.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-
->>> [CLI] bundle deployment bind foo [NEW_PIPELINE_ID] --auto-approve
-Updating deployment state...
-Successfully bound pipeline with an id '[NEW_PIPELINE_ID]'
-Run 'bundle deploy' to deploy changes to your workspace
diff --git a/acceptance/bundle/deployment/bind/pipelines/recreate/out.bind-success.terraform.txt b/acceptance/bundle/deployment/bind/pipelines/recreate/out.bind-success.terraform.txt
deleted file mode 100644
index 6c88a3134b8..00000000000
--- a/acceptance/bundle/deployment/bind/pipelines/recreate/out.bind-success.terraform.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-
->>> [CLI] bundle deployment bind foo [NEW_PIPELINE_ID] --auto-approve
-Updating deployment state...
-Successfully bound pipeline with an id '[NEW_PIPELINE_ID]'
-Run 'bundle deploy' to deploy changes to your workspace
diff --git a/acceptance/bundle/deployment/bind/pipelines/recreate/out.bind-success.txt b/acceptance/bundle/deployment/bind/pipelines/recreate/out.bind-success.txt
new file mode 100644
index 00000000000..670eec7006e
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/pipelines/recreate/out.bind-success.txt
@@ -0,0 +1,4 @@
+
+>>> [CLI] bundle deployment bind foo [NEW_PIPELINE_ID] --auto-approve
+Successfully bound pipeline with an id '[NEW_PIPELINE_ID]'
+Run 'bundle deploy' to deploy changes to your workspace
diff --git a/acceptance/bundle/deployment/bind/pipelines/recreate/out.summary.json b/acceptance/bundle/deployment/bind/pipelines/recreate/out.summary.json
index 59dbfe4a809..6db8ad09cf9 100644
--- a/acceptance/bundle/deployment/bind/pipelines/recreate/out.summary.json
+++ b/acceptance/bundle/deployment/bind/pipelines/recreate/out.summary.json
@@ -17,7 +17,7 @@
       ],
       "name": "test-pipeline-[UNIQUE_NAME]",
       "storage": "/Shared/new_storage",
-      "url": "[DATABRICKS_URL]/pipelines/[NEW_PIPELINE_ID]?o=[NUMID]"
+      "url": "[DATABRICKS_URL]/pipelines/[NEW_PIPELINE_ID]?w=[WORKSPACE_ID]"
     }
   }
 }
diff --git a/acceptance/bundle/deployment/bind/pipelines/recreate/out.test.toml b/acceptance/bundle/deployment/bind/pipelines/recreate/out.test.toml
index bbc7fcfd1bd..f68b4a89c36 100644
--- a/acceptance/bundle/deployment/bind/pipelines/recreate/out.test.toml
+++ b/acceptance/bundle/deployment/bind/pipelines/recreate/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/bind/pipelines/recreate/output.txt b/acceptance/bundle/deployment/bind/pipelines/recreate/output.txt
index af42322deec..f114763c887 100644
--- a/acceptance/bundle/deployment/bind/pipelines/recreate/output.txt
+++ b/acceptance/bundle/deployment/bind/pipelines/recreate/output.txt
@@ -1,5 +1,5 @@
 
->>> print_requests.py ^//import-file/ ^//workspace/
+>>> print_requests.py ^//workspace/
 
 >>> [CLI] bundle summary -o json
 
@@ -16,8 +16,11 @@ Streaming Tables (STs) and Materialized Views (MVs) managed by them. Recreating
 restore the defined STs and MVs through full refresh. Note that recreation is necessary when pipeline
 properties such as the 'catalog' or 'storage' are changed:
   recreate resources.pipelines.foo
-Error: the deployment requires destructive actions, but current console does not support prompting. Please specify --auto-approve if you would like to skip prompts and proceed
+Error: the deployment requires destructive actions, but the current console does not support prompting.
+Deleting data assets such as schemas, pipelines, or volumes may cause permanent data loss and should be carefully reviewed.
+To proceed, use --auto-approve after reviewing the plan above.
 
+Files: 8 uploaded, 0 deleted
 
 >>> [CLI] bundle deploy --auto-approve
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-pipeline-recreate-[UNIQUE_NAME]/default/files...
@@ -27,8 +30,8 @@ Streaming Tables (STs) and Materialized Views (MVs) managed by them. Recreating
 restore the defined STs and MVs through full refresh. Note that recreation is necessary when pipeline
 properties such as the 'catalog' or 'storage' are changed:
   recreate resources.pipelines.foo
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Recreated pipelines.foo
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 0 unchanged
 
->>> print_requests.py ^//import-file/ ^//workspace/ ^//telemetry-ext
+>>> print_requests.py ^//workspace/ ^//telemetry-ext
diff --git a/acceptance/bundle/deployment/bind/pipelines/recreate/script b/acceptance/bundle/deployment/bind/pipelines/recreate/script
index aba4cfb97a6..8d02246da3b 100644
--- a/acceptance/bundle/deployment/bind/pipelines/recreate/script
+++ b/acceptance/bundle/deployment/bind/pipelines/recreate/script
@@ -2,21 +2,21 @@ envsubst < databricks.yml.tmpl > databricks.yml
 envsubst < pipeline.json.tmpl > pipeline.json
 
 NEW_PIPELINE_ID=$($CLI pipelines create --json @pipeline.json | jq -r .pipeline_id)
-add_repl.py $NEW_PIPELINE_ID NEW_PIPELINE_ID
+add_repl $NEW_PIPELINE_ID NEW_PIPELINE_ID
 
-rm -f out.requests.txt
-trace musterr $CLI bundle deployment bind foo $NEW_PIPELINE_ID &> out.bind-fail.$DATABRICKS_BUNDLE_ENGINE.txt
-print_requests.py '^//import-file/' '^//workspace/'
+rm -f "$OUT_REQUESTS"
+trace musterr $CLI bundle deployment bind foo $NEW_PIPELINE_ID &> out.bind-fail.txt
+print_requests.py '^//workspace/'
 
-rm -f out.requests.txt
-trace $CLI bundle deployment bind foo $NEW_PIPELINE_ID --auto-approve &> out.bind-success.$DATABRICKS_BUNDLE_ENGINE.txt
-trace print_requests.py '^//import-file/' '^//workspace/'
+rm -f "$OUT_REQUESTS"
+trace $CLI bundle deployment bind foo $NEW_PIPELINE_ID --auto-approve &> out.bind-success.txt
+trace print_requests.py '^//workspace/'
 
 trace $CLI bundle summary -o json | jq .resources > out.summary.json
 trace $CLI bundle plan
 
 trace musterr $CLI bundle deploy
 
-rm -f out.requests.txt
+rm -f "$OUT_REQUESTS"
 trace $CLI bundle deploy --auto-approve
-trace print_requests.py '^//import-file/' '^//workspace/' '^//telemetry-ext' > out.deploy.requests.json
+trace print_requests.py '^//workspace/' '^//telemetry-ext' > out.deploy.requests.json
diff --git a/acceptance/bundle/deployment/bind/pipelines/update/out.bind-fail.direct.txt b/acceptance/bundle/deployment/bind/pipelines/update/out.bind-fail.direct.txt
deleted file mode 100644
index 7b858035299..00000000000
--- a/acceptance/bundle/deployment/bind/pipelines/update/out.bind-fail.direct.txt
+++ /dev/null
@@ -1,15 +0,0 @@
-
->>> musterr [CLI] bundle deployment bind foo [NEW_PIPELINE_ID]
-Plan: update resources.pipelines.foo
-
-Changes detected:
-  ~ catalog: null -> "main"
-  ~ channel: null -> "CURRENT"
-  ~ deployment: null -> {"kind":"BUNDLE","metadata_file_path":"/Workspace/Users/[USERNAME]/.bundle/test-pipeline-recreate/default/state/metadata.json"}
-  ~ edition: null -> "ADVANCED"
-  ~ libraries: [{"glob":{"include":"/Workspace/Users/[USERNAME]/lakeflow_pipeline/transformations/**"}},{"glob":{"include":"/Workspace/Users/foo@databricks.com/another/**"}}] -> [{"notebook":{"path":"/Workspace/Users/[USERNAME]/.bundle/test-pipeline-recreate/default/files/nb"}}]
-  ~ name: "lakeflow-pipeline" -> "test-pipeline"
-  ~ root_path: "/Workspace/Users/[USERNAME]/lakeflow_pipeline" -> null
-
-Error: This bind operation requires user confirmation, but the current console does not support prompting. Please specify --auto-approve if you would like to skip prompts and proceed.
-
diff --git a/acceptance/bundle/deployment/bind/pipelines/update/out.bind-fail.terraform.txt b/acceptance/bundle/deployment/bind/pipelines/update/out.bind-fail.terraform.txt
deleted file mode 100644
index 2ff60fce2b2..00000000000
--- a/acceptance/bundle/deployment/bind/pipelines/update/out.bind-fail.terraform.txt
+++ /dev/null
@@ -1,45 +0,0 @@
-
->>> musterr [CLI] bundle deployment bind foo [NEW_PIPELINE_ID]
-databricks_pipeline.foo: Refreshing state... [id=[NEW_PIPELINE_ID]]
-
-Terraform used the selected providers to generate the following execution
-plan. Resource actions are indicated with the following symbols:
-  ~ update in-place
-
-Terraform will perform the following actions:
-
-  # databricks_pipeline.foo will be updated in-place
-  ~ resource "databricks_pipeline" "foo" {
-      + catalog                = "main"
-      + channel                = "CURRENT"
-      + edition                = "ADVANCED"
-        id                     = "[NEW_PIPELINE_ID]"
-      ~ name                   = "lakeflow-pipeline" -> "test-pipeline"
-      - root_path              = "/Workspace/Users/[USERNAME]/lakeflow_pipeline" -> null
-        # (12 unchanged attributes hidden)
-
-      + deployment {
-          + kind               = "BUNDLE"
-          + metadata_file_path = "/Workspace/Users/[USERNAME]/.bundle/test-pipeline-recreate/default/state/metadata.json"
-        }
-
-      ~ library {
-          - glob {
-              - include = "/Workspace/Users/[USERNAME]/lakeflow_pipeline/transformations/**" -> null
-            }
-          + notebook {
-              + path = "/Workspace/Users/[USERNAME]/.bundle/test-pipeline-recreate/default/files/nb"
-            }
-        }
-      - library {
-          - glob {
-              - include = "/Workspace/Users/foo@databricks.com/another/**" -> null
-            }
-        }
-    }
-
-Plan: 0 to add, 1 to change, 0 to destroy.
-
-
-Error: This bind operation requires user confirmation, but the current console does not support prompting. Please specify --auto-approve if you would like to skip prompts and proceed.
-
diff --git a/acceptance/bundle/deployment/bind/pipelines/update/out.bind-fail.txt b/acceptance/bundle/deployment/bind/pipelines/update/out.bind-fail.txt
new file mode 100644
index 00000000000..a5e4ca80074
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/pipelines/update/out.bind-fail.txt
@@ -0,0 +1,16 @@
+
+>>> musterr [CLI] bundle deployment bind foo [NEW_PIPELINE_ID]
+Plan: update resources.pipelines.foo
+
+Changes detected:
+  ~ catalog: null -> "main"
+  ~ channel: null -> "CURRENT"
+  ~ deployment: null -> {"kind":"BUNDLE","metadata_file_path":"/Workspace/Users/[USERNAME]/.bundle/test-pipeline-recreate/default/state/metadata.json"}
+  ~ edition: null -> "ADVANCED"
+  ~ libraries: [{"glob":{"include":"/Workspace/Users/[USERNAME]/lakeflow_pipeline/transformations/**"}},{"glob":{"include":"/Workspace/Users/foo@databricks.com/another/**"}}] -> [{"notebook":{"path":"/Workspace/Users/[USERNAME]/.bundle/test-pipeline-recreate/default/files/nb"}}]
+  ~ name: "lakeflow-pipeline" -> "test-pipeline"
+  ~ root_path: "/Workspace/Users/[USERNAME]/lakeflow_pipeline" -> null
+
+Error: this bind operation requires user confirmation, but the current console does not support prompting.
+To proceed, use --auto-approve after reviewing the plan above.
+
diff --git a/acceptance/bundle/deployment/bind/pipelines/update/out.bind-success.direct.txt b/acceptance/bundle/deployment/bind/pipelines/update/out.bind-success.direct.txt
deleted file mode 100644
index 6c88a3134b8..00000000000
--- a/acceptance/bundle/deployment/bind/pipelines/update/out.bind-success.direct.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-
->>> [CLI] bundle deployment bind foo [NEW_PIPELINE_ID] --auto-approve
-Updating deployment state...
-Successfully bound pipeline with an id '[NEW_PIPELINE_ID]'
-Run 'bundle deploy' to deploy changes to your workspace
diff --git a/acceptance/bundle/deployment/bind/pipelines/update/out.bind-success.terraform.txt b/acceptance/bundle/deployment/bind/pipelines/update/out.bind-success.terraform.txt
deleted file mode 100644
index 6c88a3134b8..00000000000
--- a/acceptance/bundle/deployment/bind/pipelines/update/out.bind-success.terraform.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-
->>> [CLI] bundle deployment bind foo [NEW_PIPELINE_ID] --auto-approve
-Updating deployment state...
-Successfully bound pipeline with an id '[NEW_PIPELINE_ID]'
-Run 'bundle deploy' to deploy changes to your workspace
diff --git a/acceptance/bundle/deployment/bind/pipelines/update/out.bind-success.txt b/acceptance/bundle/deployment/bind/pipelines/update/out.bind-success.txt
new file mode 100644
index 00000000000..670eec7006e
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/pipelines/update/out.bind-success.txt
@@ -0,0 +1,4 @@
+
+>>> [CLI] bundle deployment bind foo [NEW_PIPELINE_ID] --auto-approve
+Successfully bound pipeline with an id '[NEW_PIPELINE_ID]'
+Run 'bundle deploy' to deploy changes to your workspace
diff --git a/acceptance/bundle/deployment/bind/pipelines/update/out.deploy.requests.direct.json b/acceptance/bundle/deployment/bind/pipelines/update/out.deploy.requests.json
similarity index 100%
rename from acceptance/bundle/deployment/bind/pipelines/update/out.deploy.requests.direct.json
rename to acceptance/bundle/deployment/bind/pipelines/update/out.deploy.requests.json
diff --git a/acceptance/bundle/deployment/bind/pipelines/update/out.deploy.requests.terraform.json b/acceptance/bundle/deployment/bind/pipelines/update/out.deploy.requests.terraform.json
deleted file mode 100644
index 3c8d1946b83..00000000000
--- a/acceptance/bundle/deployment/bind/pipelines/update/out.deploy.requests.terraform.json
+++ /dev/null
@@ -1,37 +0,0 @@
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-pipeline-recreate/default/artifacts/.internal"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-pipeline-recreate/default/files"
-  }
-}
-{
-  "method": "PUT",
-  "path": "/api/2.0/pipelines/[NEW_PIPELINE_ID]",
-  "body": {
-    "catalog": "main",
-    "channel": "CURRENT",
-    "deployment": {
-      "kind": "BUNDLE",
-      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-pipeline-recreate/default/state/metadata.json"
-    },
-    "edition": "ADVANCED",
-    "id": "[NEW_PIPELINE_ID]",
-    "libraries": [
-      {
-        "notebook": {
-          "path": "/Workspace/Users/[USERNAME]/.bundle/test-pipeline-recreate/default/files/nb"
-        }
-      }
-    ],
-    "name": "test-pipeline",
-    "storage": "dbfs:/pipelines/[NEW_PIPELINE_ID]"
-  }
-}
diff --git a/acceptance/bundle/deployment/bind/pipelines/update/out.summary.json b/acceptance/bundle/deployment/bind/pipelines/update/out.summary.json
index d4d9b72a851..6d538af432a 100644
--- a/acceptance/bundle/deployment/bind/pipelines/update/out.summary.json
+++ b/acceptance/bundle/deployment/bind/pipelines/update/out.summary.json
@@ -26,7 +26,7 @@
           }
         ],
         "name": "test-pipeline",
-        "url": "[DATABRICKS_URL]/pipelines/[NEW_PIPELINE_ID]?o=[NUMID]"
+        "url": "[DATABRICKS_URL]/pipelines/[NEW_PIPELINE_ID]?w=[WORKSPACE_ID]"
       }
     }
   },
diff --git a/acceptance/bundle/deployment/bind/pipelines/update/out.test.toml b/acceptance/bundle/deployment/bind/pipelines/update/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/deployment/bind/pipelines/update/out.test.toml
+++ b/acceptance/bundle/deployment/bind/pipelines/update/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/bind/pipelines/update/output.txt b/acceptance/bundle/deployment/bind/pipelines/update/output.txt
index f88ed70d69d..732d4b8795c 100644
--- a/acceptance/bundle/deployment/bind/pipelines/update/output.txt
+++ b/acceptance/bundle/deployment/bind/pipelines/update/output.txt
@@ -1,3 +1,10 @@
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-pipeline-recreate/default/state"
+  }
+}
 
 >>> [CLI] bundle summary -o json
 
@@ -8,8 +15,8 @@ Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy --auto-approve
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-pipeline-recreate/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated pipelines.foo
+Files: 6 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
->>> print_requests.py ^//import-file/ ^//workspace/delete ^//telemetry-ext
+>>> print_requests.py ^//workspace/import ^//workspace/delete ^//telemetry-ext
diff --git a/acceptance/bundle/deployment/bind/pipelines/update/script b/acceptance/bundle/deployment/bind/pipelines/update/script
index 5d2e487f10c..36c80f00f5d 100644
--- a/acceptance/bundle/deployment/bind/pipelines/update/script
+++ b/acceptance/bundle/deployment/bind/pipelines/update/script
@@ -1,17 +1,17 @@
 NEW_PIPELINE_ID=$($CLI pipelines create --json @pipeline.json | jq -r .pipeline_id)
-add_repl.py $NEW_PIPELINE_ID NEW_PIPELINE_ID
+add_repl $NEW_PIPELINE_ID NEW_PIPELINE_ID
 
-rm -f out.requests.txt
-trace musterr $CLI bundle deployment bind foo $NEW_PIPELINE_ID &> out.bind-fail.$DATABRICKS_BUNDLE_ENGINE.txt
-print_requests.py '^//import-file/' '^//workspace/delete'
+rm -f "$OUT_REQUESTS"
+trace musterr $CLI bundle deployment bind foo $NEW_PIPELINE_ID &> out.bind-fail.txt
+print_requests.py '^//workspace/import' '^//workspace/delete'
 
-rm -f out.requests.txt
-trace $CLI bundle deployment bind foo $NEW_PIPELINE_ID --auto-approve &> out.bind-success.$DATABRICKS_BUNDLE_ENGINE.txt
-print_requests.py '^//import-file/' '^//workspace/delete'
+rm -f "$OUT_REQUESTS"
+trace $CLI bundle deployment bind foo $NEW_PIPELINE_ID --auto-approve &> out.bind-success.txt
+print_requests.py '^//workspace/import' '^//workspace/delete'
 
 trace $CLI bundle summary -o json > out.summary.json
 trace $CLI bundle plan
 
-rm -f out.requests.txt
+rm -f "$OUT_REQUESTS"
 trace $CLI bundle deploy --auto-approve
-trace print_requests.py '^//import-file/' '^//workspace/delete' '^//telemetry-ext' > out.deploy.requests.$DATABRICKS_BUNDLE_ENGINE.json
+trace print_requests.py '^//workspace/import' '^//workspace/delete' '^//telemetry-ext' > out.deploy.requests.json
diff --git a/acceptance/bundle/deployment/bind/postgres_database/databricks.yml b/acceptance/bundle/deployment/bind/postgres_database/databricks.yml
new file mode 100644
index 00000000000..fa0d7947468
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/postgres_database/databricks.yml
@@ -0,0 +1,10 @@
+bundle:
+  name: test-bundle
+
+resources:
+  postgres_databases:
+    database1:
+      parent: projects/test-project/branches/main
+      database_id: test-database
+      postgres_database: app_db
+      role: projects/test-project/branches/main/roles/app_owner
diff --git a/acceptance/bundle/deployment/bind/postgres_database/out.test.toml b/acceptance/bundle/deployment/bind/postgres_database/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/postgres_database/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/bind/postgres_database/output.txt b/acceptance/bundle/deployment/bind/postgres_database/output.txt
new file mode 100644
index 00000000000..a7ea84ab505
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/postgres_database/output.txt
@@ -0,0 +1,28 @@
+
+>>> [CLI] bundle deployment bind database1 projects/test-project/branches/main/databases/test-database --auto-approve
+Successfully bound postgres_database with an id 'projects/test-project/branches/main/databases/test-database'
+Run 'bundle deploy' to deploy changes to your workspace
+
+>>> [CLI] bundle summary
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+Resources:
+  Postgres databases:
+    database1:
+      Name: projects/test-project/branches/main/databases/test-database
+
+>>> [CLI] bundle deployment unbind database1
+
+>>> [CLI] bundle summary
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+Resources:
+  Postgres databases:
+    database1:
+      Name: 
diff --git a/acceptance/bundle/deployment/bind/postgres_database/script b/acceptance/bundle/deployment/bind/postgres_database/script
new file mode 100644
index 00000000000..cc3f69efa2f
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/postgres_database/script
@@ -0,0 +1,6 @@
+DATABASE_NAME="projects/test-project/branches/main/databases/test-database"
+trace $CLI bundle deployment bind database1 "${DATABASE_NAME}" --auto-approve
+trace $CLI bundle summary
+
+trace $CLI bundle deployment unbind database1
+trace $CLI bundle summary
diff --git a/acceptance/bundle/deployment/bind/postgres_database/test.toml b/acceptance/bundle/deployment/bind/postgres_database/test.toml
new file mode 100644
index 00000000000..50fb046d4c0
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/postgres_database/test.toml
@@ -0,0 +1,17 @@
+Cloud = false
+
+Ignore = [
+    ".databricks"
+]
+
+[[Server]]
+Pattern = "GET /api/2.0/postgres/projects/test-project/branches/main/databases/test-database"
+Response.Body = '''
+{
+  "name": "projects/test-project/branches/main/databases/test-database",
+  "parent": "projects/test-project/branches/main",
+  "status": {
+    "postgres_database": "app_db"
+  }
+}
+'''
diff --git a/acceptance/bundle/deployment/bind/postgres_role/databricks.yml b/acceptance/bundle/deployment/bind/postgres_role/databricks.yml
new file mode 100644
index 00000000000..b7c555794e6
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/postgres_role/databricks.yml
@@ -0,0 +1,9 @@
+bundle:
+  name: test-bundle
+
+resources:
+  postgres_roles:
+    role1:
+      parent: projects/test-project/branches/main
+      role_id: test-role
+      postgres_role: app_role
diff --git a/acceptance/bundle/deployment/bind/postgres_role/out.test.toml b/acceptance/bundle/deployment/bind/postgres_role/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/postgres_role/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/bind/postgres_role/output.txt b/acceptance/bundle/deployment/bind/postgres_role/output.txt
new file mode 100644
index 00000000000..4895004fd45
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/postgres_role/output.txt
@@ -0,0 +1,28 @@
+
+>>> [CLI] bundle deployment bind role1 projects/test-project/branches/main/roles/test-role --auto-approve
+Successfully bound postgres_role with an id 'projects/test-project/branches/main/roles/test-role'
+Run 'bundle deploy' to deploy changes to your workspace
+
+>>> [CLI] bundle summary
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+Resources:
+  Postgres roles:
+    role1:
+      Name: projects/test-project/branches/main/roles/test-role
+
+>>> [CLI] bundle deployment unbind role1
+
+>>> [CLI] bundle summary
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+Resources:
+  Postgres roles:
+    role1:
+      Name: 
diff --git a/acceptance/bundle/deployment/bind/postgres_role/script b/acceptance/bundle/deployment/bind/postgres_role/script
new file mode 100644
index 00000000000..547aadd944f
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/postgres_role/script
@@ -0,0 +1,6 @@
+ROLE_NAME="projects/test-project/branches/main/roles/test-role"
+trace $CLI bundle deployment bind role1 "${ROLE_NAME}" --auto-approve
+trace $CLI bundle summary
+
+trace $CLI bundle deployment unbind role1
+trace $CLI bundle summary
diff --git a/acceptance/bundle/deployment/bind/postgres_role/test.toml b/acceptance/bundle/deployment/bind/postgres_role/test.toml
new file mode 100644
index 00000000000..43b81e9ed01
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/postgres_role/test.toml
@@ -0,0 +1,17 @@
+Cloud = false
+
+Ignore = [
+    ".databricks"
+]
+
+[[Server]]
+Pattern = "GET /api/2.0/postgres/projects/test-project/branches/main/roles/test-role"
+Response.Body = '''
+{
+  "name": "projects/test-project/branches/main/roles/test-role",
+  "parent": "projects/test-project/branches/main",
+  "status": {
+    "postgres_role": "app_role"
+  }
+}
+'''
diff --git a/acceptance/bundle/deployment/bind/postgres_snapshot_schedule/databricks.yml b/acceptance/bundle/deployment/bind/postgres_snapshot_schedule/databricks.yml
new file mode 100644
index 00000000000..d680805158d
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/postgres_snapshot_schedule/databricks.yml
@@ -0,0 +1,11 @@
+bundle:
+  name: test-bundle
+
+resources:
+  postgres_snapshot_schedules:
+    schedule1:
+      branch: projects/test-project/branches/main
+      schedule:
+        - daily_schedule:
+            hour: 3
+          retention: "604800s"
diff --git a/acceptance/bundle/deployment/bind/postgres_snapshot_schedule/out.test.toml b/acceptance/bundle/deployment/bind/postgres_snapshot_schedule/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/postgres_snapshot_schedule/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/bind/postgres_snapshot_schedule/output.txt b/acceptance/bundle/deployment/bind/postgres_snapshot_schedule/output.txt
new file mode 100644
index 00000000000..5033cd73dfc
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/postgres_snapshot_schedule/output.txt
@@ -0,0 +1,28 @@
+
+>>> [CLI] bundle deployment bind schedule1 projects/test-project/branches/main/snapshot-schedule --auto-approve
+Successfully bound postgres_snapshot_schedule with an id 'projects/test-project/branches/main/snapshot-schedule'
+Run 'bundle deploy' to deploy changes to your workspace
+
+>>> [CLI] bundle summary
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+Resources:
+  Postgres snapshot schedules:
+    schedule1:
+      Name: projects/test-project/branches/main/snapshot-schedule
+
+>>> [CLI] bundle deployment unbind schedule1
+
+>>> [CLI] bundle summary
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+Resources:
+  Postgres snapshot schedules:
+    schedule1:
+      Name: 
diff --git a/acceptance/bundle/deployment/bind/postgres_snapshot_schedule/script b/acceptance/bundle/deployment/bind/postgres_snapshot_schedule/script
new file mode 100644
index 00000000000..ee70c6a35bd
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/postgres_snapshot_schedule/script
@@ -0,0 +1,6 @@
+SCHEDULE_NAME="projects/test-project/branches/main/snapshot-schedule"
+trace $CLI bundle deployment bind schedule1 "${SCHEDULE_NAME}" --auto-approve
+trace $CLI bundle summary
+
+trace $CLI bundle deployment unbind schedule1
+trace $CLI bundle summary
diff --git a/acceptance/bundle/deployment/bind/postgres_snapshot_schedule/test.toml b/acceptance/bundle/deployment/bind/postgres_snapshot_schedule/test.toml
new file mode 100644
index 00000000000..e41822d5fb9
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/postgres_snapshot_schedule/test.toml
@@ -0,0 +1,25 @@
+Cloud = false
+
+# The snapshot schedule was added to the Postgres API in databricks-sdk-go
+# v0.177.0, which the pinned Terraform provider does not yet include, so there is
+# no databricks_..._snapshot_schedule resource. Run the direct engine only.
+
+Ignore = [
+    ".databricks"
+]
+
+[[Server]]
+Pattern = "GET /api/2.0/postgres/projects/test-project/branches/main/snapshot-schedule"
+Response.Body = '''
+{
+  "name": "projects/test-project/branches/main/snapshot-schedule",
+  "schedule": [
+    {
+      "daily_schedule": {
+        "hour": 3
+      },
+      "retention": "604800s"
+    }
+  ]
+}
+'''
diff --git a/acceptance/bundle/deployment/bind/quality-monitor/out.test.toml b/acceptance/bundle/deployment/bind/quality-monitor/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/deployment/bind/quality-monitor/out.test.toml
+++ b/acceptance/bundle/deployment/bind/quality-monitor/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/bind/quality-monitor/output.txt b/acceptance/bundle/deployment/bind/quality-monitor/output.txt
index 30e2790c9eb..5386d11e6f1 100644
--- a/acceptance/bundle/deployment/bind/quality-monitor/output.txt
+++ b/acceptance/bundle/deployment/bind/quality-monitor/output.txt
@@ -13,12 +13,10 @@
 }
 
 >>> [CLI] bundle deployment bind monitor1 catalog.schema.table
-Updating deployment state...
 Successfully bound quality_monitor with an id 'catalog.schema.table'
 Run 'bundle deploy' to deploy changes to your workspace
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/bind-quality-monitor-test-localonly/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
diff --git a/acceptance/bundle/deployment/bind/quality-monitor/test.toml b/acceptance/bundle/deployment/bind/quality-monitor/test.toml
index 0fe8781c058..3c7a940da51 100644
--- a/acceptance/bundle/deployment/bind/quality-monitor/test.toml
+++ b/acceptance/bundle/deployment/bind/quality-monitor/test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
 
 [[Repls]]
diff --git a/acceptance/bundle/deployment/bind/registered-model/out.test.toml b/acceptance/bundle/deployment/bind/registered-model/out.test.toml
index e849ec85ace..f68b4a89c36 100644
--- a/acceptance/bundle/deployment/bind/registered-model/out.test.toml
+++ b/acceptance/bundle/deployment/bind/registered-model/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/bind/registered-model/output.txt b/acceptance/bundle/deployment/bind/registered-model/output.txt
index cda82ea075f..6d8bded7ed0 100644
--- a/acceptance/bundle/deployment/bind/registered-model/output.txt
+++ b/acceptance/bundle/deployment/bind/registered-model/output.txt
@@ -15,15 +15,13 @@ resources:
 }
 
 >>> [CLI] bundle deployment bind model1 main.test-schema-rmodel-[UNIQUE_NAME].test-registered-model-[UNIQUE_NAME]
-Updating deployment state...
 Successfully bound registered_model with an id 'main.test-schema-rmodel-[UNIQUE_NAME].test-registered-model-[UNIQUE_NAME]'
 Run 'bundle deploy' to deploy changes to your workspace
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
 
 >>> [CLI] registered-models get main.test-schema-rmodel-[UNIQUE_NAME].test-registered-model-[UNIQUE_NAME]
 {
@@ -33,13 +31,11 @@ Deployment complete!
 }
 
 >>> [CLI] bundle deployment unbind model1
-Updating deployment state...
 
 >>> [CLI] bundle destroy --auto-approve
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 0 deleted
 
 >>> [CLI] registered-models get main.test-schema-rmodel-[UNIQUE_NAME].test-registered-model-[UNIQUE_NAME]
 {
diff --git a/acceptance/bundle/deployment/bind/registered-model/test.toml b/acceptance/bundle/deployment/bind/registered-model/test.toml
index f5706bb0af4..c7c6f58ed6e 100644
--- a/acceptance/bundle/deployment/bind/registered-model/test.toml
+++ b/acceptance/bundle/deployment/bind/registered-model/test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
diff --git a/acceptance/bundle/deployment/bind/schema/out.test.toml b/acceptance/bundle/deployment/bind/schema/out.test.toml
index e849ec85ace..f68b4a89c36 100644
--- a/acceptance/bundle/deployment/bind/schema/out.test.toml
+++ b/acceptance/bundle/deployment/bind/schema/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/bind/schema/output.txt b/acceptance/bundle/deployment/bind/schema/output.txt
index 2e6976fb580..89ab1f23437 100644
--- a/acceptance/bundle/deployment/bind/schema/output.txt
+++ b/acceptance/bundle/deployment/bind/schema/output.txt
@@ -6,14 +6,13 @@
   "catalog_name": "main"
 }
 
-=== Bind schema: Updating deployment state...
-Successfully bound schema with an id 'main.test-schema-[UUID]'
+=== Bind schema: Successfully bound schema with an id 'main.test-schema-[UUID]'
 Run 'bundle deploy' to deploy changes to your workspace
 
 === Deploy bundle: Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated schemas.schema1
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
 === Read the pre-defined schema: {
   "full_name": "main.test-schema-[UUID]",
@@ -21,12 +20,10 @@ Deployment complete!
   "comment": "This schema was created from DABs"
 }
 
-=== Unbind the schema: Updating deployment state...
-
+=== Unbind the schema: 
 === Destroy the bundle: All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 0 deleted
 
 === Read the pre-defined schema again (expecting it still exists): {
   "full_name": "main.test-schema-[UUID]",
diff --git a/acceptance/bundle/deployment/bind/schema/test.toml b/acceptance/bundle/deployment/bind/schema/test.toml
index f5706bb0af4..c7c6f58ed6e 100644
--- a/acceptance/bundle/deployment/bind/schema/test.toml
+++ b/acceptance/bundle/deployment/bind/schema/test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
diff --git a/acceptance/bundle/deployment/bind/secret-scope/out.test.toml b/acceptance/bundle/deployment/bind/secret-scope/out.test.toml
index e849ec85ace..f68b4a89c36 100644
--- a/acceptance/bundle/deployment/bind/secret-scope/out.test.toml
+++ b/acceptance/bundle/deployment/bind/secret-scope/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/bind/secret-scope/output.txt b/acceptance/bundle/deployment/bind/secret-scope/output.txt
index fb0f3ac11f3..20468f6d0e3 100644
--- a/acceptance/bundle/deployment/bind/secret-scope/output.txt
+++ b/acceptance/bundle/deployment/bind/secret-scope/output.txt
@@ -2,15 +2,10 @@
 >>> [CLI] secrets create-scope test-secret-scope-[UNIQUE_NAME]
 
 >>> [CLI] bundle deployment bind secret_scope1 test-secret-scope-[UNIQUE_NAME] --auto-approve
-Updating deployment state...
 Successfully bound secret_scope with an id 'test-secret-scope-[UNIQUE_NAME]'
 Run 'bundle deploy' to deploy changes to your workspace
 
->>> [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/bind-secret-scope-test-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+>>> [CLI] bundle deploy -qq
 
 >>> [CLI] secrets list-scopes -o json
 {
@@ -19,13 +14,11 @@ Deployment complete!
 }
 
 >>> [CLI] bundle deployment unbind secret_scope1
-Updating deployment state...
 
 >>> [CLI] bundle destroy --auto-approve
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/bind-secret-scope-test-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 0 deleted
 
 >>> [CLI] secrets list-scopes -o json
 {
diff --git a/acceptance/bundle/deployment/bind/secret-scope/script b/acceptance/bundle/deployment/bind/secret-scope/script
index c4e80009e64..e67b4f91f9e 100644
--- a/acceptance/bundle/deployment/bind/secret-scope/script
+++ b/acceptance/bundle/deployment/bind/secret-scope/script
@@ -12,7 +12,7 @@ trap cleanup EXIT
 
 trace $CLI bundle deployment bind secret_scope1 "${SECRET_SCOPE_NAME}" --auto-approve
 
-trace $CLI bundle deploy
+trace $CLI bundle deploy -qq
 
 trace $CLI secrets list-scopes -o json | jq --arg value ${SECRET_SCOPE_NAME} '.[] | select(.name == $value)'
 
diff --git a/acceptance/bundle/deployment/bind/secret-scope/test.toml b/acceptance/bundle/deployment/bind/secret-scope/test.toml
index f5706bb0af4..c7c6f58ed6e 100644
--- a/acceptance/bundle/deployment/bind/secret-scope/test.toml
+++ b/acceptance/bundle/deployment/bind/secret-scope/test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
diff --git a/acceptance/bundle/deployment/bind/sql_warehouse/out.test.toml b/acceptance/bundle/deployment/bind/sql_warehouse/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/deployment/bind/sql_warehouse/out.test.toml
+++ b/acceptance/bundle/deployment/bind/sql_warehouse/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/bind/sql_warehouse/output.txt b/acceptance/bundle/deployment/bind/sql_warehouse/output.txt
index 8ec970d6c1b..60c3fe5f6b2 100644
--- a/acceptance/bundle/deployment/bind/sql_warehouse/output.txt
+++ b/acceptance/bundle/deployment/bind/sql_warehouse/output.txt
@@ -1,6 +1,5 @@
 
 >>> [CLI] bundle deployment bind sql_warehouse1 [SQL-WAREHOUSE-ID] --auto-approve
-Updating deployment state...
 Successfully bound sql_warehouse with an id '[SQL-WAREHOUSE-ID]'
 Run 'bundle deploy' to deploy changes to your workspace
 
@@ -14,10 +13,9 @@ Resources:
   SQL Warehouses:
     sql_warehouse1:
       Name: DEFAULT Test SQL Warehouse
-      URL:  [DATABRICKS_URL]/sql/warehouses/[SQL-WAREHOUSE-ID]?o=[NUMID]
+      URL:  [DATABRICKS_URL]/sql/warehouses/[SQL-WAREHOUSE-ID]?w=[WORKSPACE_ID]
 
 >>> [CLI] bundle deployment unbind sql_warehouse1
-Updating deployment state...
 
 >>> [CLI] bundle summary
 Name: test-bundle
diff --git a/acceptance/bundle/deployment/bind/sql_warehouse/test.toml b/acceptance/bundle/deployment/bind/sql_warehouse/test.toml
index d61830b1fb5..5784321dace 100644
--- a/acceptance/bundle/deployment/bind/sql_warehouse/test.toml
+++ b/acceptance/bundle/deployment/bind/sql_warehouse/test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
 
 Ignore = [
diff --git a/acceptance/bundle/deployment/bind/test.toml b/acceptance/bundle/deployment/bind/test.toml
new file mode 100644
index 00000000000..b693e4ded26
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/test.toml
@@ -0,0 +1,2 @@
+# Bind operations are not yet supported by the Deployment Metadata Service (DMS)
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/bind/vector_search_endpoint/out.test.toml b/acceptance/bundle/deployment/bind/vector_search_endpoint/out.test.toml
index fe4076cdf9b..f68b4a89c36 100644
--- a/acceptance/bundle/deployment/bind/vector_search_endpoint/out.test.toml
+++ b/acceptance/bundle/deployment/bind/vector_search_endpoint/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/bind/vector_search_endpoint/output.txt b/acceptance/bundle/deployment/bind/vector_search_endpoint/output.txt
index 2a731b4827e..55724bd64b4 100644
--- a/acceptance/bundle/deployment/bind/vector_search_endpoint/output.txt
+++ b/acceptance/bundle/deployment/bind/vector_search_endpoint/output.txt
@@ -7,15 +7,13 @@
 }
 
 >>> [CLI] bundle deployment bind endpoint1 test-vs-endpoint-[UNIQUE_NAME] --auto-approve
-Updating deployment state...
 Successfully bound vector_search_endpoint with an id 'test-vs-endpoint-[UNIQUE_NAME]'
 Run 'bundle deploy' to deploy changes to your workspace
 
 >>> [CLI] bundle deploy --auto-approve
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
 
 >>> [CLI] vector-search-endpoints get-endpoint test-vs-endpoint-[UNIQUE_NAME]
 {
@@ -25,13 +23,11 @@ Deployment complete!
 }
 
 >>> [CLI] bundle deployment unbind endpoint1
-Updating deployment state...
 
 >>> [CLI] bundle destroy --auto-approve
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 0 deleted
 
 >>> [CLI] vector-search-endpoints get-endpoint test-vs-endpoint-[UNIQUE_NAME]
 {
diff --git a/acceptance/bundle/deployment/bind/vector_search_endpoint/test.toml b/acceptance/bundle/deployment/bind/vector_search_endpoint/test.toml
index 5722b37ccca..a26bade48d0 100644
--- a/acceptance/bundle/deployment/bind/vector_search_endpoint/test.toml
+++ b/acceptance/bundle/deployment/bind/vector_search_endpoint/test.toml
@@ -1,11 +1,6 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
 
 Ignore = [
     ".databricks",
     "databricks.yml",
 ]
-
-[EnvMatrix]
-  DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/deployment/bind/vector_search_index/databricks.yml.tmpl b/acceptance/bundle/deployment/bind/vector_search_index/databricks.yml.tmpl
new file mode 100644
index 00000000000..e057c575ed8
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/vector_search_index/databricks.yml.tmpl
@@ -0,0 +1,18 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  vector_search_indexes:
+    index1:
+      name: $INDEX_NAME
+      endpoint_name: $ENDPOINT_NAME
+      primary_key: id
+      index_type: DIRECT_ACCESS
+      direct_access_index_spec:
+        schema_json: '{"id":"int","vector":"array<float>"}'
+        embedding_vector_columns:
+          - name: vector
+            embedding_dimension: 768
diff --git a/acceptance/bundle/deployment/bind/vector_search_index/out.test.toml b/acceptance/bundle/deployment/bind/vector_search_index/out.test.toml
new file mode 100644
index 00000000000..c32648754d8
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/vector_search_index/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = true
+CloudSlow = true
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/bind/vector_search_index/output.txt b/acceptance/bundle/deployment/bind/vector_search_index/output.txt
new file mode 100644
index 00000000000..c64f94cc969
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/vector_search_index/output.txt
@@ -0,0 +1,50 @@
+
+>>> [CLI] vector-search-endpoints create-endpoint test-vs-endpoint-[UNIQUE_NAME] STANDARD
+{
+  "name": "test-vs-endpoint-[UNIQUE_NAME]",
+  "endpoint_type": "STANDARD"
+}
+
+>>> [CLI] vector-search-indexes create-index --json {"name":"main.default.test_vs_index_[UNIQUE_NAME]","endpoint_name":"test-vs-endpoint-[UNIQUE_NAME]","primary_key":"id","index_type":"DIRECT_ACCESS","direct_access_index_spec":{"schema_json":"{\"id\":\"int\",\"vector\":\"array<float>\"}","embedding_vector_columns":[{"name":"vector","embedding_dimension":768}]}}
+{
+  "name": "main.default.test_vs_index_[UNIQUE_NAME]",
+  "endpoint_name": "test-vs-endpoint-[UNIQUE_NAME]",
+  "index_type": "DIRECT_ACCESS",
+  "primary_key": "id"
+}
+
+>>> [CLI] bundle deployment bind index1 main.default.test_vs_index_[UNIQUE_NAME] --auto-approve
+Successfully bound vector_search_index with an id 'main.default.test_vs_index_[UNIQUE_NAME]'
+Run 'bundle deploy' to deploy changes to your workspace
+
+>>> [CLI] bundle deploy --auto-approve
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
+
+>>> [CLI] vector-search-indexes get-index main.default.test_vs_index_[UNIQUE_NAME]
+{
+  "name": "main.default.test_vs_index_[UNIQUE_NAME]",
+  "endpoint_name": "test-vs-endpoint-[UNIQUE_NAME]",
+  "index_type": "DIRECT_ACCESS",
+  "primary_key": "id"
+}
+
+>>> [CLI] bundle deployment unbind index1
+
+>>> [CLI] bundle destroy --auto-approve
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
+
+Destroy: 0 deleted
+
+>>> [CLI] vector-search-indexes get-index main.default.test_vs_index_[UNIQUE_NAME]
+{
+  "name": "main.default.test_vs_index_[UNIQUE_NAME]",
+  "endpoint_name": "test-vs-endpoint-[UNIQUE_NAME]",
+  "index_type": "DIRECT_ACCESS",
+  "primary_key": "id"
+}
+
+>>> [CLI] vector-search-indexes delete-index main.default.test_vs_index_[UNIQUE_NAME]
+
+>>> [CLI] vector-search-endpoints delete-endpoint test-vs-endpoint-[UNIQUE_NAME]
diff --git a/acceptance/bundle/deployment/bind/vector_search_index/script b/acceptance/bundle/deployment/bind/vector_search_index/script
new file mode 100644
index 00000000000..16f36a496fd
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/vector_search_index/script
@@ -0,0 +1,27 @@
+ENDPOINT_NAME="test-vs-endpoint-$UNIQUE_NAME"
+INDEX_NAME="main.default.test_vs_index_$UNIQUE_NAME"
+export ENDPOINT_NAME INDEX_NAME
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI vector-search-indexes delete-index "${INDEX_NAME}"
+    trace $CLI vector-search-endpoints delete-endpoint "${ENDPOINT_NAME}"
+}
+trap cleanup EXIT
+
+trace $CLI vector-search-endpoints create-endpoint "${ENDPOINT_NAME}" STANDARD | jq '{name, endpoint_type}'
+
+trace $CLI vector-search-indexes create-index --json "{\"name\":\"${INDEX_NAME}\",\"endpoint_name\":\"${ENDPOINT_NAME}\",\"primary_key\":\"id\",\"index_type\":\"DIRECT_ACCESS\",\"direct_access_index_spec\":{\"schema_json\":\"{\\\"id\\\":\\\"int\\\",\\\"vector\\\":\\\"array<float>\\\"}\",\"embedding_vector_columns\":[{\"name\":\"vector\",\"embedding_dimension\":768}]}}" | jq '{name, endpoint_name, index_type, primary_key}'
+
+trace $CLI bundle deployment bind index1 "${INDEX_NAME}" --auto-approve
+
+trace $CLI bundle deploy --auto-approve
+
+trace $CLI vector-search-indexes get-index "${INDEX_NAME}" | jq '{name, endpoint_name, index_type, primary_key}'
+
+trace $CLI bundle deployment unbind index1
+
+trace $CLI bundle destroy --auto-approve
+
+# Read the pre-defined index again (expecting it still exists and is not deleted):
+trace $CLI vector-search-indexes get-index "${INDEX_NAME}" | jq '{name, endpoint_name, index_type, primary_key}'
diff --git a/acceptance/bundle/deployment/bind/vector_search_index/test.toml b/acceptance/bundle/deployment/bind/vector_search_index/test.toml
new file mode 100644
index 00000000000..2b3acff2f47
--- /dev/null
+++ b/acceptance/bundle/deployment/bind/vector_search_index/test.toml
@@ -0,0 +1,9 @@
+Cloud = true
+
+# Vector Search indexes are slow to create, so only run them in the nightly (non-short) cloud job.
+CloudSlow = true
+
+Ignore = [
+    ".databricks",
+    "databricks.yml",
+]
diff --git a/acceptance/bundle/deployment/bind/volume/out.test.toml b/acceptance/bundle/deployment/bind/volume/out.test.toml
index e849ec85ace..f68b4a89c36 100644
--- a/acceptance/bundle/deployment/bind/volume/out.test.toml
+++ b/acceptance/bundle/deployment/bind/volume/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/bind/volume/output.txt b/acceptance/bundle/deployment/bind/volume/output.txt
index b7938df1430..c71865859f3 100644
--- a/acceptance/bundle/deployment/bind/volume/output.txt
+++ b/acceptance/bundle/deployment/bind/volume/output.txt
@@ -7,15 +7,13 @@
 
 === Create a pre-defined volume:
 >>> [CLI] bundle deployment bind volume1 main.test-schema-[UNIQUE_NAME].volume-[UNIQUE_NAME] --auto-approve
-Updating deployment state...
 Successfully bound volume with an id 'main.test-schema-[UNIQUE_NAME].volume-[UNIQUE_NAME]'
 Run 'bundle deploy' to deploy changes to your workspace
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
 
 >>> [CLI] volumes read main.test-schema-[UNIQUE_NAME].volume-[UNIQUE_NAME]
 {
@@ -26,13 +24,11 @@ Deployment complete!
 }
 
 >>> [CLI] bundle deployment unbind volume1
-Updating deployment state...
 
 >>> [CLI] bundle destroy --auto-approve
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 0 deleted
 
 >>> [CLI] volumes read main.test-schema-[UNIQUE_NAME].volume-[UNIQUE_NAME]
 {
diff --git a/acceptance/bundle/deployment/bind/volume/test.toml b/acceptance/bundle/deployment/bind/volume/test.toml
index f5706bb0af4..c7c6f58ed6e 100644
--- a/acceptance/bundle/deployment/bind/volume/test.toml
+++ b/acceptance/bundle/deployment/bind/volume/test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
diff --git a/acceptance/bundle/deployment/unbind/engine-from-config/out.test.toml b/acceptance/bundle/deployment/unbind/engine-from-config/out.test.toml
index d6187dcb046..19b5b15d11f 100644
--- a/acceptance/bundle/deployment/unbind/engine-from-config/out.test.toml
+++ b/acceptance/bundle/deployment/unbind/engine-from-config/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = []
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/unbind/engine-from-config/output.txt b/acceptance/bundle/deployment/unbind/engine-from-config/output.txt
index 9e833d5a0d0..e384fb56993 100644
--- a/acceptance/bundle/deployment/unbind/engine-from-config/output.txt
+++ b/acceptance/bundle/deployment/unbind/engine-from-config/output.txt
@@ -1,13 +1,12 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/engine-from-config/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.job_1
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 === State files after deploy ===
 .databricks/bundle/default/resources.json
 
 >>> [CLI] bundle deployment unbind job_1
-Updating deployment state...
 === State files after unbind ===
 .databricks/bundle/default/resources.json
diff --git a/acceptance/bundle/deployment/unbind/engine-from-config/script b/acceptance/bundle/deployment/unbind/engine-from-config/script
index 3b4d5d42f0f..06486dba0e0 100644
--- a/acceptance/bundle/deployment/unbind/engine-from-config/script
+++ b/acceptance/bundle/deployment/unbind/engine-from-config/script
@@ -3,6 +3,8 @@
 # bundle.engine is set to "direct" in databricks.yml.
 # Both deploy and unbind should use the direct engine.
 
+unset DATABRICKS_BUNDLE_ENGINE
+
 trace $CLI bundle deploy
 
 echo "=== State files after deploy ==="
diff --git a/acceptance/bundle/deployment/unbind/engine-from-config/test.toml b/acceptance/bundle/deployment/unbind/engine-from-config/test.toml
index 2d349a5bb51..b36629f1ecd 100644
--- a/acceptance/bundle/deployment/unbind/engine-from-config/test.toml
+++ b/acceptance/bundle/deployment/unbind/engine-from-config/test.toml
@@ -1,6 +1,4 @@
 Cloud = false # test leaves deployed job
 Ignore = [".databricks"]
 
-# Omit DATABRICKS_BUNDLE_ENGINE so unbind must read engine from bundle.engine config.
-[EnvMatrix]
-  DATABRICKS_BUNDLE_ENGINE = []
+Env.DATABRICKS_BUNDLE_ENGINE = "direct"
diff --git a/acceptance/bundle/deployment/unbind/grants/out.test.toml b/acceptance/bundle/deployment/unbind/grants/out.test.toml
index e849ec85ace..f68b4a89c36 100644
--- a/acceptance/bundle/deployment/unbind/grants/out.test.toml
+++ b/acceptance/bundle/deployment/unbind/grants/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/unbind/grants/output.txt b/acceptance/bundle/deployment/unbind/grants/output.txt
index 073bad25816..56265eeccd3 100644
--- a/acceptance/bundle/deployment/unbind/grants/output.txt
+++ b/acceptance/bundle/deployment/unbind/grants/output.txt
@@ -1,9 +1,10 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created schemas.schema_1
+Created schemas.schema_1.grants
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] grants get schema main.test-schema-[UNIQUE_NAME] --output json
 {
@@ -15,13 +16,13 @@ Deployment complete!
 }
 
 >>> [CLI] bundle deployment unbind schema_1
-Updating deployment state...
 
 >>> [CLI] bundle deploy --var suffix=another
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created schemas.schema_1
+Created schemas.schema_1.grants
+Files: 0 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 === Grants should be the same as before unbind
 >>> [CLI] grants get schema main.test-schema-[UNIQUE_NAME] --output json
@@ -42,8 +43,7 @@ This action will result in the deletion of the following UC schemas. Any underly
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
 
 >>> [CLI] schemas delete main.test-schema-[UNIQUE_NAME]
 0
diff --git a/acceptance/bundle/deployment/unbind/grants/test.toml b/acceptance/bundle/deployment/unbind/grants/test.toml
index 7eb723bd302..dc4941ee5c6 100644
--- a/acceptance/bundle/deployment/unbind/grants/test.toml
+++ b/acceptance/bundle/deployment/unbind/grants/test.toml
@@ -1,4 +1,3 @@
-RequiresUnityCatalog = true
 
 Ignore = [
     ".databricks",
diff --git a/acceptance/bundle/deployment/unbind/job/out.test.toml b/acceptance/bundle/deployment/unbind/job/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/deployment/unbind/job/out.test.toml
+++ b/acceptance/bundle/deployment/unbind/job/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/unbind/job/output.txt b/acceptance/bundle/deployment/unbind/job/output.txt
index e1c72de2d4f..0654ebfff39 100644
--- a/acceptance/bundle/deployment/unbind/job/output.txt
+++ b/acceptance/bundle/deployment/unbind/job/output.txt
@@ -1,26 +1,23 @@
 
 >>> [CLI] bundle deploy --var job_name=My Job
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/my_project/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> [CLI] bundle summary --var job_name=My Job --output json
+Created jobs.job_1
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle deployment unbind job_1 --var job_name=My Job
-Updating deployment state...
 
 >>> [CLI] bundle deploy --var job_name=Updated Job
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/my_project/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.job_1
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
->>> [CLI] jobs get [NUMID] --output json
+>>> [CLI] jobs get [JOB_1_ID] --output json
 {
   "created_time": [UNIX_TIME_MILLIS],
   "creator_user_name": "[USERNAME]",
-  "job_id": [NUMID],
+  "job_id": [JOB_1_ID],
   "run_as_user_name": "[USERNAME]",
   "settings": {
     "deployment": {
diff --git a/acceptance/bundle/deployment/unbind/job/script b/acceptance/bundle/deployment/unbind/job/script
index 59ccd32d894..061aadcfabf 100644
--- a/acceptance/bundle/deployment/unbind/job/script
+++ b/acceptance/bundle/deployment/unbind/job/script
@@ -1,6 +1,6 @@
 trace $CLI bundle deploy --var "job_name=My Job"
 
-job_id=$(trace $CLI bundle summary --var "job_name=My Job" --output json | jq -r '.resources.jobs.job_1.id')
+job_id=$(read_id.py job_1)
 
 trace $CLI bundle deployment unbind job_1 --var "job_name=My Job"
 
diff --git a/acceptance/bundle/deployment/unbind/permissions/out.test.toml b/acceptance/bundle/deployment/unbind/permissions/out.test.toml
index bbc7fcfd1bd..f68b4a89c36 100644
--- a/acceptance/bundle/deployment/unbind/permissions/out.test.toml
+++ b/acceptance/bundle/deployment/unbind/permissions/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/unbind/permissions/output.txt b/acceptance/bundle/deployment/unbind/permissions/output.txt
index a7e824374bf..4c7e4bde615 100644
--- a/acceptance/bundle/deployment/unbind/permissions/output.txt
+++ b/acceptance/bundle/deployment/unbind/permissions/output.txt
@@ -1,13 +1,12 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.job_1
+Created jobs.job_1.permissions
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
->>> [CLI] bundle summary --output json
-
->>> [CLI] jobs get-permissions [NUMID] --output json
+>>> [CLI] jobs get-permissions [JOB_1_ID] --output json
 {
   "all_permissions": [
     {
@@ -19,16 +18,16 @@ Deployment complete!
 }
 
 >>> [CLI] bundle deployment unbind job_1
-Updating deployment state...
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.job_1
+Created jobs.job_1.permissions
+Files: 0 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 === Permissions should be the same as before unbind
->>> [CLI] jobs get-permissions [NUMID] --output json
+>>> [CLI] jobs get-permissions [JOB_1_ID] --output json
 {
   "all_permissions": [
     {
@@ -45,8 +44,7 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
 
->>> [CLI] jobs delete [NUMID]
+>>> [CLI] jobs delete [JOB_1_ID]
 0
diff --git a/acceptance/bundle/deployment/unbind/permissions/script b/acceptance/bundle/deployment/unbind/permissions/script
index 078e3c3af6b..c8cd6e4e6ac 100644
--- a/acceptance/bundle/deployment/unbind/permissions/script
+++ b/acceptance/bundle/deployment/unbind/permissions/script
@@ -8,7 +8,7 @@ cleanup() {
 trap cleanup EXIT
 
 trace $CLI bundle deploy
-job_id=$(trace $CLI bundle summary --output json | jq -r '.resources.jobs.job_1.id')
+job_id=$(read_id.py job_1)
 trace $CLI jobs get-permissions $job_id --output json | jq '.access_control_list[] | select(.group_name == "users")'
 
 trace $CLI bundle deployment unbind job_1
diff --git a/acceptance/bundle/deployment/unbind/python-job/out.test.toml b/acceptance/bundle/deployment/unbind/python-job/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/deployment/unbind/python-job/out.test.toml
+++ b/acceptance/bundle/deployment/unbind/python-job/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/deployment/unbind/python-job/output.txt b/acceptance/bundle/deployment/unbind/python-job/output.txt
index 75ff185b35c..ae85cdeb4b7 100644
--- a/acceptance/bundle/deployment/unbind/python-job/output.txt
+++ b/acceptance/bundle/deployment/unbind/python-job/output.txt
@@ -1,26 +1,23 @@
 
 >>> uv run --with [DATABRICKS_BUNDLES_WHEEL] -q [CLI] bundle deploy --var job_name=My Job
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/my_project/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> uv run --with [DATABRICKS_BUNDLES_WHEEL] -q [CLI] bundle summary --var job_name=My Job --output json
+Created jobs.job_1
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> uv run --with [DATABRICKS_BUNDLES_WHEEL] -q [CLI] bundle deployment unbind job_1 --var job_name=My Job
-Updating deployment state...
 
 >>> uv run --with [DATABRICKS_BUNDLES_WHEEL] -q [CLI] bundle deploy --var job_name=Updated Job
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/my_project/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.job_1
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
->>> [CLI] jobs get [NUMID] --output json
+>>> [CLI] jobs get [JOB_1_ID] --output json
 {
   "created_time": [UNIX_TIME_MILLIS],
   "creator_user_name": "[USERNAME]",
-  "job_id": [NUMID],
+  "job_id": [JOB_1_ID],
   "run_as_user_name": "[USERNAME]",
   "settings": {
     "deployment": {
diff --git a/acceptance/bundle/deployment/unbind/python-job/script b/acceptance/bundle/deployment/unbind/python-job/script
index 84d3a2616fb..c3b4dba3417 100644
--- a/acceptance/bundle/deployment/unbind/python-job/script
+++ b/acceptance/bundle/deployment/unbind/python-job/script
@@ -2,7 +2,7 @@ UV_RUN="uv run --with $DATABRICKS_BUNDLES_WHEEL -q"
 
 trace $UV_RUN $CLI bundle deploy --var "job_name=My Job"
 
-job_id=$(trace $UV_RUN $CLI bundle summary --var "job_name=My Job" --output json | jq -r '.resources.jobs.job_1.id')
+job_id=$(read_id.py job_1)
 
 trace $UV_RUN $CLI bundle deployment unbind job_1 --var "job_name=My Job"
 
diff --git a/acceptance/bundle/deployment/unbind/test.toml b/acceptance/bundle/deployment/unbind/test.toml
new file mode 100644
index 00000000000..9f5f5d49a05
--- /dev/null
+++ b/acceptance/bundle/deployment/unbind/test.toml
@@ -0,0 +1,2 @@
+# Unbind operations are not yet supported by the Deployment Metadata Service (DMS)
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/destroy/all-resources/out.test.toml b/acceptance/bundle/destroy/all-resources/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/destroy/all-resources/out.test.toml
+++ b/acceptance/bundle/destroy/all-resources/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/destroy/all-resources/output.txt b/acceptance/bundle/destroy/all-resources/output.txt
index 5fd8d432a82..7949a6b7c08 100644
--- a/acceptance/bundle/destroy/all-resources/output.txt
+++ b/acceptance/bundle/destroy/all-resources/output.txt
@@ -1,9 +1,10 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created pipelines.my_pipeline
+Created schemas.my_schema
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
@@ -14,10 +15,13 @@ This action will result in the deletion of the following UC schemas. Any underly
   delete resources.schemas.my_schema
 
 This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
-Streaming Tables (STs) and Materialized Views (MVs) managed by them:
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:
   delete resources.pipelines.my_pipeline
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 2 deleted
+
+=== Assert the bundle directory is deleted
+>>> musterr [CLI] workspace get-status //Workspace/Users/[USERNAME]/.bundle/test-bundle
+Error: Path (//Workspace/Users/[USERNAME]/.bundle/test-bundle) doesn't exist.
diff --git a/acceptance/bundle/destroy/all-resources/script b/acceptance/bundle/destroy/all-resources/script
index ceb8acee91a..c9aa66b07f3 100644
--- a/acceptance/bundle/destroy/all-resources/script
+++ b/acceptance/bundle/destroy/all-resources/script
@@ -1,2 +1,7 @@
 trace $CLI bundle deploy
 trace $CLI bundle destroy --auto-approve
+
+# Destroy removes the target directory, and the .bundle/<name> parent goes with it once
+# nothing else is deployed under it. Double slash keeps Windows from rewriting the path.
+title "Assert the bundle directory is deleted"
+trace musterr $CLI workspace get-status "//Workspace/Users/${CURRENT_USER_NAME}/.bundle/test-bundle"
diff --git a/acceptance/bundle/destroy/force-lock-node-limit/databricks.yml b/acceptance/bundle/destroy/force-lock-node-limit/databricks.yml
new file mode 100644
index 00000000000..94d2ba5369e
--- /dev/null
+++ b/acceptance/bundle/destroy/force-lock-node-limit/databricks.yml
@@ -0,0 +1,7 @@
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    foo:
+      name: test-job
diff --git a/acceptance/bundle/destroy/force-lock-node-limit/out.test.toml b/acceptance/bundle/destroy/force-lock-node-limit/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/destroy/force-lock-node-limit/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/destroy/force-lock-node-limit/output.txt b/acceptance/bundle/destroy/force-lock-node-limit/output.txt
new file mode 100644
index 00000000000..8226b36d367
--- /dev/null
+++ b/acceptance/bundle/destroy/force-lock-node-limit/output.txt
@@ -0,0 +1,30 @@
+
+=== Deploy (creates the job and the deployment)
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created jobs.foo
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== destroy without --force-lock (lock write hits the node limit: aborts)
+>>> errcode [CLI] bundle destroy --auto-approve
+Error: Failed to acquire deployment lock: access denied: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock
+Error: Failed to update, encountered possible permission error: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state
+Error: unable to deploy to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state as [USERNAME].
+Please make sure the current user or one of their groups is listed under the permissions of this bundle.
+For assistance, contact the owners of this project.
+They may need to redeploy the bundle to apply the new permissions.
+Please refer to https://docs.databricks.com/dev-tools/bundles/permissions.html for more on managing permissions.
+
+
+Exit code: 1
+
+=== destroy with --force-lock (tolerates the node limit: proceeds and completes)
+>>> [CLI] bundle destroy --force-lock --auto-approve
+Warn: Proceeding with destroy without a deployment lock: access denied: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock
+The following resources will be deleted:
+  delete resources.jobs.foo
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/destroy/force-lock-node-limit/script b/acceptance/bundle/destroy/force-lock-node-limit/script
new file mode 100644
index 00000000000..616b626f2ef
--- /dev/null
+++ b/acceptance/bundle/destroy/force-lock-node-limit/script
@@ -0,0 +1,15 @@
+# When the workspace .bundle directory is at its child-node limit, writing the
+# deploy.lock file fails with a 403 MAX_CHILD_NODE_SIZE_EXCEEDED. A plain destroy
+# aborts on this, but `destroy --force-lock` tolerates it and proceeds lock-less
+# so the deployment can still be torn down (which is what frees up capacity).
+
+title "Deploy (creates the job and the deployment)"
+trace $CLI bundle deploy
+
+title "destroy without --force-lock (lock write hits the node limit: aborts)"
+fault.py --body-contains "state/deploy.lock" "POST /api/2.0/workspace/import" 403 0 1 MAX_CHILD_NODE_SIZE_EXCEEDED
+trace errcode $CLI bundle destroy --auto-approve
+
+title "destroy with --force-lock (tolerates the node limit: proceeds and completes)"
+fault.py --body-contains "state/deploy.lock" "POST /api/2.0/workspace/import" 403 0 1 MAX_CHILD_NODE_SIZE_EXCEEDED
+trace $CLI bundle destroy --force-lock --auto-approve
diff --git a/acceptance/bundle/destroy/force-lock-node-limit/test.toml b/acceptance/bundle/destroy/force-lock-node-limit/test.toml
new file mode 100644
index 00000000000..bcc3f31c5d0
--- /dev/null
+++ b/acceptance/bundle/destroy/force-lock-node-limit/test.toml
@@ -0,0 +1 @@
+Ignore = ["databricks.yml"]
diff --git a/acceptance/bundle/destroy/jobs-and-pipeline/out.test.toml b/acceptance/bundle/destroy/jobs-and-pipeline/out.test.toml
index 650836edeb3..0f167effef1 100644
--- a/acceptance/bundle/destroy/jobs-and-pipeline/out.test.toml
+++ b/acceptance/bundle/destroy/jobs-and-pipeline/out.test.toml
@@ -1,3 +1,2 @@
-Local = false
 Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/destroy/jobs-and-pipeline/output.txt b/acceptance/bundle/destroy/jobs-and-pipeline/output.txt
index ce1530c469a..ac68178a52b 100644
--- a/acceptance/bundle/destroy/jobs-and-pipeline/output.txt
+++ b/acceptance/bundle/destroy/jobs-and-pipeline/output.txt
@@ -4,9 +4,10 @@ Directory does not exist
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.foo
+Created pipelines.bar
+Files: 6 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 === Assert the snapshot file exists
 >>> find.py --expect 1 ^.databricks/bundle/default/sync-snapshots/[a-z0-9]+\.json
@@ -53,13 +54,12 @@ The following resources will be deleted:
   delete resources.pipelines.bar
 
 This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
-Streaming Tables (STs) and Materialized Views (MVs) managed by them:
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:
   delete resources.pipelines.bar
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 2 deleted
 
 === Assert pipeline is deleted
 >>> errcode [CLI] pipelines get [UUID]
@@ -68,11 +68,18 @@ Error: The specified pipeline [UUID] was not found.
 Exit code: 1
 
 === Assert job is deleted:
-Error: Job [NUMID] does not exist.
+Error: Job [FOO_ID] does not exist.
 
 Exit code: 1
 
-=== Assert snapshot file is deleted: Directory exists and is empty
+=== Assert destroy leaves the bundle state dir clean:
+
+>>> find .databricks -name terraform -prune -o -print
+.databricks
+.databricks/.gitignore
+.databricks/bundle
+.databricks/bundle/default
+.databricks/bundle/default/deployment.json
 
 === Assert bundle deployment path is deleted
 >>> errcode [CLI] workspace get-status //Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
diff --git a/acceptance/bundle/destroy/jobs-and-pipeline/script b/acceptance/bundle/destroy/jobs-and-pipeline/script
index 57ee878f12f..3d958e0c4a2 100644
--- a/acceptance/bundle/destroy/jobs-and-pipeline/script
+++ b/acceptance/bundle/destroy/jobs-and-pipeline/script
@@ -1,8 +1,6 @@
 envsubst < databricks.yml.tmpl > databricks.yml
 envsubst < resources.yml.tmpl > resources.yml
 
-SNAPSHOTS_DIR=".databricks/bundle/default/sync-snapshots"
-
 # double slash at the start prevents Windows to apply replacements to the path
 DEPLOYMENT_PATH="//Workspace/Users/${CURRENT_USER_NAME}/.bundle/${UNIQUE_NAME}"
 
@@ -16,12 +14,13 @@ cleanup() {
   title "Assert job is deleted:\n"
   errcode $CLI jobs get "${JOB_ID}" 2>&1
 
-  title "Assert snapshot file is deleted: "
-  if [ -d ${SNAPSHOTS_DIR} ] && [ -z "$(ls -A ${SNAPSHOTS_DIR})" ]; then
-      echo "Directory exists and is empty"
-  else
-      echo "Directory either does not exist or is not empty. This is unexpected by this test"
-  fi
+  # Print the whole state tree so a lingering snapshot file or an empty scaffolding
+  # dir (e.g. sync-snapshots/ or .internal/) both show up. The terraform engine dir is
+  # pruned: its contents differ by engine and embed the provider version and OS/arch,
+  # which would make the golden fragile. The bundle scaffolding we care about lives
+  # directly under the target dir, so it is still covered.
+  title "Assert destroy leaves the bundle state dir clean:\n"
+  trace find .databricks -name terraform -prune -o -print | sort
 
   title "Assert bundle deployment path is deleted"
   trace errcode $CLI workspace get-status "${DEPLOYMENT_PATH}"
@@ -45,8 +44,8 @@ trace $CLI workspace get-status "${DEPLOYMENT_PATH}" | jq '{path, object_type}'
 
 title "Assert the pipeline is created"
 PIPELINE_ID=$($CLI bundle summary -o json | jq -r '.resources.pipelines.bar.id')
-trace $CLI pipelines get "${PIPELINE_ID}" | jq "{spec}"
+trace $CLI pipelines get "${PIPELINE_ID}" | nostamp | jq "{spec}"
 
 title "Assert the job is created:\n"
-JOB_ID=$($CLI bundle summary -o json | jq -r '.resources.jobs.foo.id')
+JOB_ID=$(read_id.py foo)
 $CLI jobs get "${JOB_ID}" | jq '{name: .settings.name}'
diff --git a/acceptance/bundle/destroy/jobs-and-pipeline/test.toml b/acceptance/bundle/destroy/jobs-and-pipeline/test.toml
index f9455dae87c..c22d0376795 100644
--- a/acceptance/bundle/destroy/jobs-and-pipeline/test.toml
+++ b/acceptance/bundle/destroy/jobs-and-pipeline/test.toml
@@ -1,4 +1,3 @@
-Local = false
 Cloud = true
 
 Ignore = [
diff --git a/acceptance/bundle/destroy/lineage-mismatch-after-redeploy/databricks.yml b/acceptance/bundle/destroy/lineage-mismatch-after-redeploy/databricks.yml
new file mode 100644
index 00000000000..6f7e2364f0e
--- /dev/null
+++ b/acceptance/bundle/destroy/lineage-mismatch-after-redeploy/databricks.yml
@@ -0,0 +1,14 @@
+bundle:
+  name: lineage-mismatch-after-redeploy
+
+resources:
+  jobs:
+    test_job:
+      name: "test-job"
+      tasks:
+        - task_key: "test-task"
+          spark_python_task:
+            python_file: ./test.py
+          new_cluster:
+            spark_version: 15.4.x-scala2.12
+            node_type_id: i3.xlarge
diff --git a/acceptance/bundle/destroy/lineage-mismatch-after-redeploy/out.test.toml b/acceptance/bundle/destroy/lineage-mismatch-after-redeploy/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/destroy/lineage-mismatch-after-redeploy/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/destroy/lineage-mismatch-after-redeploy/output.txt b/acceptance/bundle/destroy/lineage-mismatch-after-redeploy/output.txt
new file mode 100644
index 00000000000..849e97605a2
--- /dev/null
+++ b/acceptance/bundle/destroy/lineage-mismatch-after-redeploy/output.txt
@@ -0,0 +1,63 @@
+
+=== Machine A: deploy, then destroy
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/lineage-mismatch-after-redeploy/default/files...
+Created jobs.test_job
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.test_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/lineage-mismatch-after-redeploy/default
+
+Destroy: 1 deleted
+
+=== A clean destroy removes the local state file, so no stale lineage is left behind:
+
+>>> find.py ^.databricks/bundle/default/(resources.json|terraform/terraform.tfstate)$ --expect 0
+
+=== and leaves the bundle state dir clean, with no empty scaffolding directories:
+
+>>> find .databricks -name terraform -prune -o -print
+.databricks
+.databricks/.gitignore
+.databricks/bundle
+.databricks/bundle/default
+.databricks/bundle/default/deployment.json
+
+=== Machine B: fresh deploy of the same bundle (mints a new lineage L2 remotely)
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/lineage-mismatch-after-redeploy/default/files...
+Created jobs.test_job
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Machine A with a lingering local state: any command that pulls remote state now fails
+
+>>> musterr [CLI] bundle plan
+Error: lineage mismatch in state files
+
+Available state files:
+- [STATE_FILE]: remote [ENGINE] state serial=[SERIAL] lineage="[LINEAGE_B]"
+- [TEST_TMP_DIR]/.databricks/bundle/default/[STATE_FILE]: local [ENGINE] state serial=[SERIAL] lineage="[LINEAGE_A]"
+
+
+>>> musterr [CLI] bundle deploy
+Error: lineage mismatch in state files
+
+Available state files:
+- [STATE_FILE]: remote [ENGINE] state serial=[SERIAL] lineage="[LINEAGE_B]"
+- [TEST_TMP_DIR]/.databricks/bundle/default/[STATE_FILE]: local [ENGINE] state serial=[SERIAL] lineage="[LINEAGE_A]"
+
+
+>>> musterr [CLI] bundle destroy --auto-approve
+Error: lineage mismatch in state files
+
+Available state files:
+- [STATE_FILE]: remote [ENGINE] state serial=[SERIAL] lineage="[LINEAGE_B]"
+- [TEST_TMP_DIR]/.databricks/bundle/default/[STATE_FILE]: local [ENGINE] state serial=[SERIAL] lineage="[LINEAGE_A]"
+
diff --git a/acceptance/bundle/destroy/lineage-mismatch-after-redeploy/script b/acceptance/bundle/destroy/lineage-mismatch-after-redeploy/script
new file mode 100644
index 00000000000..f8139fab31e
--- /dev/null
+++ b/acceptance/bundle/destroy/lineage-mismatch-after-redeploy/script
@@ -0,0 +1,51 @@
+# A user destroys a bundle on one machine and redeploys it (under the same name)
+# from another machine that has no local state. Local state is scoped by target
+# only (.databricks/bundle/<target>), while remote state lives under
+# ~/.bundle/<bundle name>/<target>/state, so the two can diverge.
+#
+# Destroy removes the local state file, so a clean destroy leaves no stale lineage
+# behind. But if that cleanup does not happen (e.g. the process dies after the remote
+# state is deleted), the lingering local lineage no longer matches the new one a fresh
+# redeploy mints, and every command that pulls remote state fails. Cover both cases.
+
+title "Machine A: deploy, then destroy\n"
+trace $CLI bundle deploy
+
+# Snapshot machine A's local state (lineage L1) while it exists, so the lingering-state
+# case below can replay a destroy whose local cleanup did not happen.
+LINEAGE_A=$(print_state.py | jq -r .lineage)
+add_repl "$LINEAGE_A" LINEAGE_A
+cp -r .databricks .databricks.machineA
+
+trace $CLI bundle destroy --auto-approve
+
+title "A clean destroy removes the local state file, so no stale lineage is left behind:\n"
+trace find.py '^.databricks/bundle/default/(resources.json|terraform/terraform.tfstate)$' --expect 0
+
+# Print the whole state tree so any empty scaffolding dir or stray file shows up. The
+# terraform engine dir is pruned: its contents differ by engine and embed the provider
+# version and OS/arch, which would make the golden fragile (the state file it holds is
+# already asserted gone above). The bundle scaffolding we care about lives directly
+# under the target dir, so it is still covered.
+title "and leaves the bundle state dir clean, with no empty scaffolding directories:\n"
+trace find .databricks -name terraform -prune -o -print | sort
+
+# Wipe whatever remains so the next deploy behaves like a fresh machine.
+rm -rf .databricks
+
+title "Machine B: fresh deploy of the same bundle (mints a new lineage L2 remotely)\n"
+trace $CLI bundle deploy
+
+# Mask machine B's (remote) lineage.
+LINEAGE_B=$(print_state.py | jq -r .lineage)
+add_repl "$LINEAGE_B" LINEAGE_B
+
+# Back on machine A, but this time destroy's local cleanup did not happen: restore the
+# stale local state that still carries L1.
+rm -rf .databricks
+mv .databricks.machineA .databricks
+
+title "Machine A with a lingering local state: any command that pulls remote state now fails\n"
+trace musterr $CLI bundle plan
+trace musterr $CLI bundle deploy
+trace musterr $CLI bundle destroy --auto-approve
diff --git a/acceptance/bundle/destroy/lineage-mismatch-after-redeploy/test.py b/acceptance/bundle/destroy/lineage-mismatch-after-redeploy/test.py
new file mode 100644
index 00000000000..1ff8e07c707
--- /dev/null
+++ b/acceptance/bundle/destroy/lineage-mismatch-after-redeploy/test.py
@@ -0,0 +1 @@
+print("test")
diff --git a/acceptance/bundle/destroy/lineage-mismatch-after-redeploy/test.toml b/acceptance/bundle/destroy/lineage-mismatch-after-redeploy/test.toml
new file mode 100644
index 00000000000..d2b44f3eb3b
--- /dev/null
+++ b/acceptance/bundle/destroy/lineage-mismatch-after-redeploy/test.toml
@@ -0,0 +1,24 @@
+# Both engines keep a lineage-bearing local state file, so the destroy scenario and its
+# fix (and the lingering-state failure) apply to both. The mismatch error names the
+# engine-specific state file; the Repls below align the terraform and direct forms so
+# both engines share one output.txt.
+
+# .databricks.machineA is the stashed local state; may linger if the test fails mid-run.
+Ignore = [".databricks.machineA"]
+
+# Needed because the serial is not set under DMS: the state file persists none, so the candidate
+# list the CLI prints shows serial=0 where a non-recording run shows the file's counter.
+[[Repls]]
+Old = 'serial=[0-9]+'
+New = 'serial=[SERIAL]'
+
+# Align the terraform vs direct state-file listing in the lineage-mismatch error so the
+# matrix variants produce identical output. Scoped by the ": remote/local <engine> state"
+# suffix so the find.py argument above is left untouched.
+[[Repls]]
+Old = '\.databricks/bundle/default/(resources\.json|terraform/terraform\.tfstate): local (direct|terraform) state'
+New = '.databricks/bundle/default/[STATE_FILE]: local [ENGINE] state'
+
+[[Repls]]
+Old = '(resources\.json|terraform\.tfstate): remote (direct|terraform) state'
+New = '[STATE_FILE]: remote [ENGINE] state'
diff --git a/acceptance/bundle/destroy/root-path-name-target/databricks.yml.tmpl b/acceptance/bundle/destroy/root-path-name-target/databricks.yml.tmpl
new file mode 100644
index 00000000000..0c0aa94f179
--- /dev/null
+++ b/acceptance/bundle/destroy/root-path-name-target/databricks.yml.tmpl
@@ -0,0 +1,5 @@
+bundle:
+  name: test-bundle
+
+workspace:
+  root_path: ~/.bundle/explicit-$UNIQUE_NAME/${bundle.name}/${bundle.target}
diff --git a/acceptance/bundle/destroy/root-path-name-target/out.test.toml b/acceptance/bundle/destroy/root-path-name-target/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/destroy/root-path-name-target/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/destroy/root-path-name-target/output.txt b/acceptance/bundle/destroy/root-path-name-target/output.txt
new file mode 100644
index 00000000000..ef3455ca0a2
--- /dev/null
+++ b/acceptance/bundle/destroy/root-path-name-target/output.txt
@@ -0,0 +1,23 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/explicit-[UNIQUE_NAME]/test-bundle/default/files...
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/explicit-[UNIQUE_NAME]/test-bundle/default
+
+Destroy: 0 deleted
+
+=== Assert the bundle directory is deleted
+>>> musterr [CLI] workspace get-status //Workspace/Users/[USERNAME]/.bundle/explicit-[UNIQUE_NAME]/test-bundle
+Error: Path (//Workspace/Users/[USERNAME]/.bundle/explicit-[UNIQUE_NAME]/test-bundle) doesn't exist.
+
+=== Assert the prefix above it is kept
+>>> [CLI] workspace get-status //Workspace/Users/[USERNAME]/.bundle/explicit-[UNIQUE_NAME]
+{
+  "object_type": "DIRECTORY"
+}
+
+=== Clean up
+>>> [CLI] workspace delete //Workspace/Users/[USERNAME]/.bundle/explicit-[UNIQUE_NAME] --recursive
diff --git a/acceptance/bundle/destroy/root-path-name-target/script b/acceptance/bundle/destroy/root-path-name-target/script
new file mode 100644
index 00000000000..414a7ab4ba8
--- /dev/null
+++ b/acceptance/bundle/destroy/root-path-name-target/script
@@ -0,0 +1,17 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+PREFIX="//Workspace/Users/${CURRENT_USER_NAME}/.bundle/explicit-${UNIQUE_NAME}"
+
+trace $CLI bundle deploy
+trace $CLI bundle destroy --auto-approve
+
+# root_path spells out ${bundle.name}/${bundle.target}, so the directory named after the
+# bundle goes with the deployment even outside the default location.
+title "Assert the bundle directory is deleted"
+trace musterr $CLI workspace get-status "${PREFIX}/test-bundle"
+
+title "Assert the prefix above it is kept"
+trace $CLI workspace get-status "${PREFIX}" | jq '{object_type}'
+
+title "Clean up"
+trace $CLI workspace delete "${PREFIX}" --recursive
diff --git a/acceptance/bundle/destroy/root-path-name-target/test.toml b/acceptance/bundle/destroy/root-path-name-target/test.toml
new file mode 100644
index 00000000000..606a2ff06ff
--- /dev/null
+++ b/acceptance/bundle/destroy/root-path-name-target/test.toml
@@ -0,0 +1,6 @@
+Cloud = true
+
+Ignore = [
+    "databricks.yml",
+    ".databricks/"
+]
diff --git a/acceptance/bundle/destroy/root-path-not-scoped/databricks.yml.tmpl b/acceptance/bundle/destroy/root-path-not-scoped/databricks.yml.tmpl
new file mode 100644
index 00000000000..8e8273a8d21
--- /dev/null
+++ b/acceptance/bundle/destroy/root-path-not-scoped/databricks.yml.tmpl
@@ -0,0 +1,5 @@
+bundle:
+  name: test-bundle
+
+workspace:
+  root_path: ~/.bundle/custom-root-$UNIQUE_NAME/inner
diff --git a/acceptance/bundle/destroy/root-path-not-scoped/out.test.toml b/acceptance/bundle/destroy/root-path-not-scoped/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/destroy/root-path-not-scoped/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/destroy/root-path-not-scoped/output.txt b/acceptance/bundle/destroy/root-path-not-scoped/output.txt
new file mode 100644
index 00000000000..1cc63137ca6
--- /dev/null
+++ b/acceptance/bundle/destroy/root-path-not-scoped/output.txt
@@ -0,0 +1,19 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/custom-root-[UNIQUE_NAME]/inner/files...
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/custom-root-[UNIQUE_NAME]/inner
+
+Destroy: 0 deleted
+
+=== Assert the parent directory is kept
+>>> [CLI] workspace get-status //Workspace/Users/[USERNAME]/.bundle/custom-root-[UNIQUE_NAME]
+{
+  "object_type": "DIRECTORY"
+}
+
+=== Clean up
+>>> [CLI] workspace delete //Workspace/Users/[USERNAME]/.bundle/custom-root-[UNIQUE_NAME] --recursive
diff --git a/acceptance/bundle/destroy/root-path-not-scoped/script b/acceptance/bundle/destroy/root-path-not-scoped/script
new file mode 100644
index 00000000000..f53ddf23cdb
--- /dev/null
+++ b/acceptance/bundle/destroy/root-path-not-scoped/script
@@ -0,0 +1,14 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+PARENT="//Workspace/Users/${CURRENT_USER_NAME}/.bundle/custom-root-${UNIQUE_NAME}"
+
+trace $CLI bundle deploy
+trace $CLI bundle destroy --auto-approve
+
+# root_path does not end in ${bundle.name}/${bundle.target}, so the directory above it is
+# not this bundle's and is left alone.
+title "Assert the parent directory is kept"
+trace $CLI workspace get-status "${PARENT}" | jq '{object_type}'
+
+title "Clean up"
+trace $CLI workspace delete "${PARENT}" --recursive
diff --git a/acceptance/bundle/destroy/root-path-not-scoped/test.toml b/acceptance/bundle/destroy/root-path-not-scoped/test.toml
new file mode 100644
index 00000000000..606a2ff06ff
--- /dev/null
+++ b/acceptance/bundle/destroy/root-path-not-scoped/test.toml
@@ -0,0 +1,6 @@
+Cloud = true
+
+Ignore = [
+    "databricks.yml",
+    ".databricks/"
+]
diff --git a/acceptance/bundle/destroy/sibling-target/databricks.yml.tmpl b/acceptance/bundle/destroy/sibling-target/databricks.yml.tmpl
new file mode 100644
index 00000000000..6ae23ac0937
--- /dev/null
+++ b/acceptance/bundle/destroy/sibling-target/databricks.yml.tmpl
@@ -0,0 +1,7 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+targets:
+  dev:
+    default: true
+  prod:
diff --git a/acceptance/bundle/destroy/sibling-target/out.test.toml b/acceptance/bundle/destroy/sibling-target/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/destroy/sibling-target/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/destroy/sibling-target/output.txt b/acceptance/bundle/destroy/sibling-target/output.txt
new file mode 100644
index 00000000000..e4d4c286c87
--- /dev/null
+++ b/acceptance/bundle/destroy/sibling-target/output.txt
@@ -0,0 +1,32 @@
+
+>>> [CLI] bundle deploy -t dev
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/dev/files...
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] bundle deploy -t prod
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/prod/files...
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Destroy one target while the other is still deployed
+>>> [CLI] bundle destroy -t dev --auto-approve
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/dev
+
+Destroy: 0 deleted
+
+=== Assert the bundle directory is kept: the sibling target is still under it
+>>> [CLI] workspace get-status //Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]
+{
+  "object_type": "DIRECTORY"
+}
+
+=== Destroy the remaining target
+>>> [CLI] bundle destroy -t prod --auto-approve
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/prod
+
+Destroy: 0 deleted
+
+=== Assert the bundle directory is deleted
+>>> musterr [CLI] workspace get-status //Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]
+Error: Path (//Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]) doesn't exist.
diff --git a/acceptance/bundle/destroy/sibling-target/script b/acceptance/bundle/destroy/sibling-target/script
new file mode 100644
index 00000000000..c77c90aa470
--- /dev/null
+++ b/acceptance/bundle/destroy/sibling-target/script
@@ -0,0 +1,19 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+# Double slash keeps Windows from rewriting the path.
+BUNDLE_DIR="//Workspace/Users/${CURRENT_USER_NAME}/.bundle/test-bundle-${UNIQUE_NAME}"
+
+trace $CLI bundle deploy -t dev
+trace $CLI bundle deploy -t prod
+
+title "Destroy one target while the other is still deployed"
+trace $CLI bundle destroy -t dev --auto-approve
+
+title "Assert the bundle directory is kept: the sibling target is still under it"
+trace $CLI workspace get-status "${BUNDLE_DIR}" | jq '{object_type}'
+
+title "Destroy the remaining target"
+trace $CLI bundle destroy -t prod --auto-approve
+
+title "Assert the bundle directory is deleted"
+trace musterr $CLI workspace get-status "${BUNDLE_DIR}"
diff --git a/acceptance/bundle/destroy/sibling-target/test.toml b/acceptance/bundle/destroy/sibling-target/test.toml
new file mode 100644
index 00000000000..606a2ff06ff
--- /dev/null
+++ b/acceptance/bundle/destroy/sibling-target/test.toml
@@ -0,0 +1,6 @@
+Cloud = true
+
+Ignore = [
+    "databricks.yml",
+    ".databricks/"
+]
diff --git a/acceptance/bundle/dms/bind-unbind-unsupported/databricks.yml.tmpl b/acceptance/bundle/dms/bind-unbind-unsupported/databricks.yml.tmpl
new file mode 100644
index 00000000000..e60f4605610
--- /dev/null
+++ b/acceptance/bundle/dms/bind-unbind-unsupported/databricks.yml.tmpl
@@ -0,0 +1,9 @@
+bundle:
+  name: dms-bind-unbind-$UNIQUE_NAME
+experimental:
+  deployment_history: true
+
+resources:
+  jobs:
+    foo:
+      name: foo
diff --git a/acceptance/bundle/dms/bind-unbind-unsupported/out.test.toml b/acceptance/bundle/dms/bind-unbind-unsupported/out.test.toml
new file mode 100644
index 00000000000..88e6fbd847c
--- /dev/null
+++ b/acceptance/bundle/dms/bind-unbind-unsupported/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["true"]
diff --git a/acceptance/bundle/dms/bind-unbind-unsupported/output.txt b/acceptance/bundle/dms/bind-unbind-unsupported/output.txt
new file mode 100644
index 00000000000..d2d0a366778
--- /dev/null
+++ b/acceptance/bundle/dms/bind-unbind-unsupported/output.txt
@@ -0,0 +1,16 @@
+
+=== bind is refused while recording deployment history
+>>> musterr [CLI] bundle deployment bind foo [JOB_ID]
+Error: bind is not supported for a bundle target that records deployment history
+
+
+=== Deploy so the bundle records state, then unbind is refused too
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dms-bind-unbind-[UNIQUE_NAME]/default/files...
+Created jobs.foo
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> musterr [CLI] bundle deployment unbind foo
+Error: unbind is not supported for a bundle target that records deployment history
+
diff --git a/acceptance/bundle/dms/bind-unbind-unsupported/script b/acceptance/bundle/dms/bind-unbind-unsupported/script
new file mode 100644
index 00000000000..03d9cf34a31
--- /dev/null
+++ b/acceptance/bundle/dms/bind-unbind-unsupported/script
@@ -0,0 +1,14 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+# The gate that refuses bind while recording deployment history is on the config, so it fires
+# before any deploy. Create a real workspace job so bind gets past fetching the resource and
+# reaches the gate, instead of failing because the resource does not exist.
+title "bind is refused while recording deployment history"
+job_id=$($CLI jobs create --json '{"name": "bind-target-'$UNIQUE_NAME'"}' | jq -r '.job_id')
+add_repl "$job_id" JOB_ID
+trace musterr $CLI bundle deployment bind foo "$job_id"
+
+# unbind refuses when it opens an existing recording state, so it needs a deployment first.
+title "Deploy so the bundle records state, then unbind is refused too"
+trace $CLI bundle deploy
+trace musterr $CLI bundle deployment unbind foo
diff --git a/acceptance/bundle/dms/bind-unbind-unsupported/test.toml b/acceptance/bundle/dms/bind-unbind-unsupported/test.toml
new file mode 100644
index 00000000000..140ee938238
--- /dev/null
+++ b/acceptance/bundle/dms/bind-unbind-unsupported/test.toml
@@ -0,0 +1,4 @@
+RecordRequests = false
+# bind/unbind refusal is a client-side gate on the recording config; it needs no real
+# workspace, so this stays local-only rather than inheriting the suite's cloud run.
+Cloud = false
diff --git a/acceptance/bundle/dms/declined-deploy/databricks.yml.tmpl b/acceptance/bundle/dms/declined-deploy/databricks.yml.tmpl
new file mode 100644
index 00000000000..7c48f1b7317
--- /dev/null
+++ b/acceptance/bundle/dms/declined-deploy/databricks.yml.tmpl
@@ -0,0 +1,10 @@
+bundle:
+  name: dms-declined-deploy-$UNIQUE_NAME
+experimental:
+  deployment_history: true
+
+resources:
+  schemas:
+    foo:
+      name: dms_declined_deploy_schema_$UNIQUE_NAME
+      catalog_name: main
diff --git a/acceptance/bundle/dms/declined-deploy/out.test.toml b/acceptance/bundle/dms/declined-deploy/out.test.toml
new file mode 100644
index 00000000000..84b22ba6735
--- /dev/null
+++ b/acceptance/bundle/dms/declined-deploy/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["true"]
diff --git a/acceptance/bundle/dms/declined-deploy/output.txt b/acceptance/bundle/dms/declined-deploy/output.txt
new file mode 100644
index 00000000000..3ef52219df5
--- /dev/null
+++ b/acceptance/bundle/dms/declined-deploy/output.txt
@@ -0,0 +1,210 @@
+
+=== Deploy a schema, so the deployment and its first version exist
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dms-declined-deploy-[UNIQUE_NAME]/default/files...
+Created schemas.foo
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py --dms --get //api/2.0/bundle
+{
+  "method": "POST",
+  "path": "/api/2.0/bundle/deployments",
+  "body": {
+    "display_name": "dms-declined-deploy-[UNIQUE_NAME]",
+    "initial_parent_path": "/Workspace/Users/[USERNAME]/.bundle/dms-declined-deploy-[UNIQUE_NAME]/default/state",
+    "target_name": "default",
+    "workspace_info": {
+      "file_path": "/Workspace/Users/[USERNAME]/.bundle/dms-declined-deploy-[UNIQUE_NAME]/default/files",
+      "root_path": "/Workspace/Users/[USERNAME]/.bundle/dms-declined-deploy-[UNIQUE_NAME]/default"
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions",
+  "q": {
+    "version_id": "1"
+  },
+  "body": {
+    "cli_version": "[CLI_VERSION]",
+    "operations": [
+      {
+        "action_type": "OPERATION_ACTION_TYPE_CREATE",
+        "resource_key": "schemas.foo"
+      }
+    ],
+    "version_type": "VERSION_TYPE_DEPLOY"
+  }
+}
+{
+  "method": "PATCH",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/1/operations/schemas.foo",
+  "q": {
+    "update_mask": "state,error_message,resource_id,status"
+  },
+  "body": {
+    "error_message": "",
+    "resource_id": "main.dms_declined_deploy_schema_[UNIQUE_NAME]",
+    "sequence_id": 0,
+    "state": "{\"state\":{\"catalog_name\":\"main\",\"name\":\"dms_declined_deploy_schema_[UNIQUE_NAME]\"}}",
+    "status": "OPERATION_STATUS_SUCCEEDED"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/1/complete",
+  "body": {
+    "completion_reason": "VERSION_COMPLETE_SUCCESS"
+  }
+}
+
+=== The plan is a no-op now and records the deployment_history feature; the service holds the schema at version 1
+>>> [CLI] bundle plan -o json
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "features": {
+    "deployment_history": {}
+  }
+}
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+>>> print_requests.py --dms --get //api/2.0/bundle
+{
+  "method": "GET",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/resources"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/resources"
+}
+
+>>> print_state.py --no-dms
+{
+ "state_version": 3,
+ "cli_version": "[CLI_VERSION]",
+ "lineage": "[UUID]",
+ "serial": 1,
+ "features": {
+  "deployment_history": {}
+ },
+ "state": {}
+}
+
+=== A destructive change without --auto-approve is declined: this console cannot prompt
+>>> update_file.py databricks.yml catalog_name: main catalog_name: dms_other_[UNIQUE_NAME]
+
+>>> musterr [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dms-declined-deploy-[UNIQUE_NAME]/default/files...
+
+This action will result in the deletion or recreation of the following UC schemas. Any underlying data may be lost:
+  recreate resources.schemas.foo
+Error: the deployment requires destructive actions, but the current console does not support prompting.
+Deleting data assets such as schemas, pipelines, or volumes may cause permanent data loss and should be carefully reviewed.
+To proceed, use --auto-approve after reviewing the plan above.
+
+Files: 2 uploaded, 0 deleted
+
+=== Nothing was recorded for the declined deploy - no version, so none to abort
+>>> print_requests.py --dms --get //api/2.0/bundle
+{
+  "method": "GET",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/resources"
+}
+
+=== The recorded resources are unchanged by the decline: the schema is still at version 1
+>>> MSYS_NO_PATHCONV=1 [CLI] bundle-deployments list-resources deployments/[DEPLOYMENT_ID] -o json
+[
+  {
+    "last_action_type": "OPERATION_ACTION_TYPE_CREATE",
+    "last_version_id": "1",
+    "resource_key": "schemas.foo"
+  }
+]
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.schemas.foo
+
+This action will result in the deletion of the following UC schemas. Any underlying data may be lost:
+  delete resources.schemas.foo
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/dms-declined-deploy-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
+
+=== After the destroy the deployment is gone, so the summary reports no history rather than a dangling id
+>>> [CLI] bundle summary -o json
+false
+
+>>> print_requests.py --dms --get //api/2.0/bundle
+{
+  "method": "GET",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/resources"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/resources"
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions",
+  "q": {
+    "version_id": "2"
+  },
+  "body": {
+    "cli_version": "[CLI_VERSION]",
+    "operations": [
+      {
+        "action_type": "OPERATION_ACTION_TYPE_DELETE",
+        "resource_key": "schemas.foo"
+      }
+    ],
+    "previous_version_id": "1",
+    "version_type": "VERSION_TYPE_DESTROY"
+  }
+}
+{
+  "method": "PATCH",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/2/operations/schemas.foo",
+  "q": {
+    "update_mask": "state,error_message,status"
+  },
+  "body": {
+    "error_message": "",
+    "sequence_id": 0,
+    "status": "OPERATION_STATUS_SUCCEEDED"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/2/complete",
+  "body": {
+    "completion_reason": "VERSION_COMPLETE_SUCCESS"
+  }
+}
+{
+  "method": "DELETE",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]"
+}
diff --git a/acceptance/bundle/dms/declined-deploy/script b/acceptance/bundle/dms/declined-deploy/script
new file mode 100644
index 00000000000..e0fa60f0763
--- /dev/null
+++ b/acceptance/bundle/dms/declined-deploy/script
@@ -0,0 +1,34 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+title "Deploy a schema, so the deployment and its first version exist"
+trace $CLI bundle deploy
+trace print_requests.py --dms --get //api/2.0/bundle
+
+title "The plan is a no-op now and records the deployment_history feature; the service holds the schema at version 1"
+dms_plan
+trace print_requests.py --dms --get //api/2.0/bundle
+trace print_state.py --no-dms
+
+title "A destructive change without --auto-approve is declined: this console cannot prompt"
+# Changing the catalog recreates the schema, which needs approval.
+# Unity Catalog has no catalog called "other", so make one to move the schema into.
+other_catalog="dms_other_${UNIQUE_NAME}"
+$CLI catalogs create "$other_catalog" &> LOG.catalog
+trap '$CLI catalogs delete "$other_catalog" --force >> LOG.catalog 2>&1; rm -f "$OUT_REQUESTS"' EXIT
+trace update_file.py databricks.yml "catalog_name: main" "catalog_name: ${other_catalog}"
+trace musterr $CLI bundle deploy
+
+title "Nothing was recorded for the declined deploy - no version, so none to abort"
+# The version number it would have used is left for the next deploy to take, so the
+# history has no entry that reads like a deploy which failed or did nothing.
+trace print_requests.py --dms --get //api/2.0/bundle
+
+title "The recorded resources are unchanged by the decline: the schema is still at version 1"
+deployment_id=$(MSYS_NO_PATHCONV=1 $CLI workspace get-status "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/dms-declined-deploy-${UNIQUE_NAME}/default/state/resources.deployment.json" | python3 -c 'import sys, json; print(json.load(sys.stdin)["object_id"])')
+add_repl "$deployment_id" DEPLOYMENT_ID
+trace MSYS_NO_PATHCONV=1 $CLI bundle-deployments list-resources "deployments/${deployment_id}" -o json | jq -S 'map({resource_key, last_version_id, last_action_type})'
+
+trace $CLI bundle destroy --auto-approve
+title "After the destroy the deployment is gone, so the summary reports no history rather than a dangling id"
+trace $CLI bundle summary -o json | jq '.bundle.deployment | has("history")'
+trace print_requests.py --dms --get //api/2.0/bundle
diff --git a/acceptance/bundle/dms/depends-on/databricks.yml.tmpl b/acceptance/bundle/dms/depends-on/databricks.yml.tmpl
new file mode 100644
index 00000000000..1b81c2ba6d8
--- /dev/null
+++ b/acceptance/bundle/dms/depends-on/databricks.yml.tmpl
@@ -0,0 +1,12 @@
+bundle:
+  name: dms-depends-on-$UNIQUE_NAME
+experimental:
+  deployment_history: true
+
+resources:
+  jobs:
+    parent:
+      name: parent
+    child:
+      name: child
+      description: depends on ${resources.jobs.parent.id}
diff --git a/acceptance/bundle/dms/depends-on/out.test.toml b/acceptance/bundle/dms/depends-on/out.test.toml
new file mode 100644
index 00000000000..84b22ba6735
--- /dev/null
+++ b/acceptance/bundle/dms/depends-on/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["true"]
diff --git a/acceptance/bundle/dms/depends-on/output.txt b/acceptance/bundle/dms/depends-on/output.txt
new file mode 100644
index 00000000000..c1b9beb1dec
--- /dev/null
+++ b/acceptance/bundle/dms/depends-on/output.txt
@@ -0,0 +1,106 @@
+
+=== Plan before first deploy: no deployment yet, so serial is still 0
+>>> [CLI] bundle plan -o json
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "features": {
+    "deployment_history": {}
+  }
+}
+
+>>> [CLI] bundle plan
+create jobs.child
+create jobs.parent
+
+Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
+
+=== Deploy a job that references another: depends_on is recorded alongside the config, since the reference is resolved to a literal in the config itself
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dms-depends-on-[UNIQUE_NAME]/default/files...
+Created jobs.child
+Created jobs.parent
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py --dms //versions/1/operations
+{
+  "method": "PATCH",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/1/operations/jobs.parent",
+  "q": {
+    "update_mask": "state,error_message,resource_id,status"
+  },
+  "body": {
+    "error_message": "",
+    "resource_id": "[PARENT_ID]",
+    "sequence_id": 0,
+    "state": "{\"state\":{\"deployment\":{\"deployment_id\":\"[DEPLOYMENT_ID]\",\"kind\":\"BUNDLE\",\"metadata_file_path\":\"/Workspace/Users/[USERNAME]/.bundle/dms-depends-on-[UNIQUE_NAME]/default/state/metadata.json\",\"version_id\":\"1\"},\"edit_mode\":\"UI_LOCKED\",\"format\":\"MULTI_TASK\",\"max_concurrent_runs\":1,\"name\":\"parent\",\"queue\":{\"enabled\":true}}}",
+    "status": "OPERATION_STATUS_SUCCEEDED"
+  }
+}
+{
+  "method": "PATCH",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/1/operations/jobs.child",
+  "q": {
+    "update_mask": "state,error_message,resource_id,status"
+  },
+  "body": {
+    "error_message": "",
+    "resource_id": "[CHILD_ID]",
+    "sequence_id": 0,
+    "state": "{\"state\":{\"deployment\":{\"deployment_id\":\"[DEPLOYMENT_ID]\",\"kind\":\"BUNDLE\",\"metadata_file_path\":\"/Workspace/Users/[USERNAME]/.bundle/dms-depends-on-[UNIQUE_NAME]/default/state/metadata.json\",\"version_id\":\"1\"},\"description\":\"depends on [PARENT_ID]\",\"edit_mode\":\"UI_LOCKED\",\"format\":\"MULTI_TASK\",\"max_concurrent_runs\":1,\"name\":\"child\",\"queue\":{\"enabled\":true}},\"depends_on\":[{\"node\":\"resources.jobs.parent\",\"label\":\"${resources.jobs.parent.id}\"}]}",
+    "status": "OPERATION_STATUS_SUCCEEDED"
+  }
+}
+
+=== The plan is a no-op now and records the deployment_history feature
+>>> [CLI] bundle plan -o json
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "features": {
+    "deployment_history": {}
+  }
+}
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
+
+=== The service lists both jobs, each recorded at version 1
+>>> MSYS_NO_PATHCONV=1 [CLI] bundle-deployments list-resources deployments/[DEPLOYMENT_ID] -o json
+[
+  {
+    "last_action_type": "OPERATION_ACTION_TYPE_CREATE",
+    "last_version_id": "1",
+    "resource_key": "jobs.child"
+  },
+  {
+    "last_action_type": "OPERATION_ACTION_TYPE_CREATE",
+    "last_version_id": "1",
+    "resource_key": "jobs.parent"
+  }
+]
+
+=== The raw recorded state the service holds for this deployment
+>>> print_state.py --no-dms
+{
+ "state_version": 3,
+ "cli_version": "[CLI_VERSION]",
+ "lineage": "[UUID]",
+ "serial": 1,
+ "features": {
+  "deployment_history": {}
+ },
+ "state": {}
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.child
+  delete resources.jobs.parent
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/dms-depends-on-[UNIQUE_NAME]/default
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/dms/depends-on/script b/acceptance/bundle/dms/depends-on/script
new file mode 100644
index 00000000000..e8a2f2c69e5
--- /dev/null
+++ b/acceptance/bundle/dms/depends-on/script
@@ -0,0 +1,23 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+title "Plan before first deploy: no deployment yet, so serial is still 0"
+dms_plan
+
+title "Deploy a job that references another: depends_on is recorded alongside the config, since the reference is resolved to a literal in the config itself"
+trace $CLI bundle deploy
+trace print_requests.py --dms //versions/1/operations
+
+title "The plan is a no-op now and records the deployment_history feature"
+dms_plan
+
+title "The service lists both jobs, each recorded at version 1"
+deployment_id=$(MSYS_NO_PATHCONV=1 $CLI workspace get-status "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/dms-depends-on-${UNIQUE_NAME}/default/state/resources.deployment.json" | python3 -c 'import sys, json; print(json.load(sys.stdin)["object_id"])')
+add_repl "$deployment_id" DEPLOYMENT_ID
+trace MSYS_NO_PATHCONV=1 $CLI bundle-deployments list-resources "deployments/${deployment_id}" -o json | jq -S 'map({resource_key, last_version_id, last_action_type})'
+
+title "The raw recorded state the service holds for this deployment"
+trace print_state.py --no-dms
+replace_ids.py
+
+trace $CLI bundle destroy --auto-approve
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/dms/deployment-metadata-change/databricks.yml.tmpl b/acceptance/bundle/dms/deployment-metadata-change/databricks.yml.tmpl
new file mode 100644
index 00000000000..2d22f7c1463
--- /dev/null
+++ b/acceptance/bundle/dms/deployment-metadata-change/databricks.yml.tmpl
@@ -0,0 +1,22 @@
+bundle:
+  name: dms-metadata-before-$UNIQUE_NAME
+experimental:
+  deployment_history: true
+
+workspace:
+  # Pinned, so renaming the bundle or switching target below keeps the same deployment: the
+  # deployment is the workspace node under state_path, and a different path would be a
+  # different deployment.
+  state_path: /Workspace/Users/${workspace.current_user.userName}/.bundle/dms-metadata-pinned-$UNIQUE_NAME/state
+
+resources:
+  schemas:
+    foo:
+      name: dms_metadata_schema_$UNIQUE_NAME
+      catalog_name: main
+
+targets:
+  dev:
+    default: true
+  prod:
+    mode: production
diff --git a/acceptance/bundle/dms/deployment-metadata-change/out.test.toml b/acceptance/bundle/dms/deployment-metadata-change/out.test.toml
new file mode 100644
index 00000000000..84b22ba6735
--- /dev/null
+++ b/acceptance/bundle/dms/deployment-metadata-change/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["true"]
diff --git a/acceptance/bundle/dms/deployment-metadata-change/output.txt b/acceptance/bundle/dms/deployment-metadata-change/output.txt
new file mode 100644
index 00000000000..675d23ca70d
--- /dev/null
+++ b/acceptance/bundle/dms/deployment-metadata-change/output.txt
@@ -0,0 +1,174 @@
+
+=== Deploy: the deployment is created carrying this bundle's metadata
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dms-metadata-before-[UNIQUE_NAME]/dev/files...
+Created schemas.foo
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py --dms //api/2.0/bundle
+{
+  "method": "POST",
+  "path": "/api/2.0/bundle/deployments",
+  "body": {
+    "display_name": "dms-metadata-before-[UNIQUE_NAME]",
+    "initial_parent_path": "/Workspace/Users/[USERNAME]/.bundle/dms-metadata-pinned-[UNIQUE_NAME]/state",
+    "target_name": "dev",
+    "workspace_info": {
+      "file_path": "/Workspace/Users/[USERNAME]/.bundle/dms-metadata-before-[UNIQUE_NAME]/dev/files",
+      "root_path": "/Workspace/Users/[USERNAME]/.bundle/dms-metadata-before-[UNIQUE_NAME]/dev"
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions",
+  "q": {
+    "version_id": "1"
+  },
+  "body": {
+    "cli_version": "[CLI_VERSION]",
+    "operations": [
+      {
+        "action_type": "OPERATION_ACTION_TYPE_CREATE",
+        "resource_key": "schemas.foo"
+      }
+    ],
+    "version_type": "VERSION_TYPE_DEPLOY"
+  }
+}
+{
+  "method": "PATCH",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/1/operations/schemas.foo",
+  "q": {
+    "update_mask": "state,error_message,resource_id,status"
+  },
+  "body": {
+    "error_message": "",
+    "resource_id": "main.dms_metadata_schema_[UNIQUE_NAME]",
+    "sequence_id": 0,
+    "state": "{\"state\":{\"catalog_name\":\"main\",\"name\":\"dms_metadata_schema_[UNIQUE_NAME]\"}}",
+    "status": "OPERATION_STATUS_SUCCEEDED"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/1/complete",
+  "body": {
+    "completion_reason": "VERSION_COMPLETE_SUCCESS"
+  }
+}
+
+=== The plan records the deployment_history feature; the service holds the schema at version 1
+>>> [CLI] bundle plan -o json
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "features": {
+    "deployment_history": {}
+  }
+}
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+>>> MSYS_NO_PATHCONV=1 [CLI] bundle-deployments list-resources deployments/[DEPLOYMENT_ID] -o json
+[
+  {
+    "last_action_type": "OPERATION_ACTION_TYPE_CREATE",
+    "last_version_id": "1",
+    "resource_key": "schemas.foo"
+  }
+]
+
+=== Rename the bundle and switch target+mode. The state path is pinned, so this is the same deployment, updated in place - the mask carries every field that changed
+>>> update_file.py databricks.yml dms-metadata-before dms-metadata-after
+
+>>> [CLI] bundle deploy -t prod
+Recommendation: target with 'mode: production' should set 'workspace.root_path' to make sure only one copy is deployed
+
+A common practice is to use a username or principal name in this path, i.e. use
+
+  root_path: /Workspace/Users/[USERNAME]/.bundle/${bundle.name}/${bundle.target}
+
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dms-metadata-after-[UNIQUE_NAME]/prod/files...
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
+
+>>> print_requests.py --dms //api/2.0/bundle
+{
+  "method": "PATCH",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]",
+  "q": {
+    "update_mask": "display_name,target_name,deployment_mode,workspace_info"
+  },
+  "body": {
+    "deployment_mode": "DEPLOYMENT_MODE_PRODUCTION",
+    "display_name": "dms-metadata-after-[UNIQUE_NAME]",
+    "target_name": "prod",
+    "workspace_info": {
+      "file_path": "/Workspace/Users/[USERNAME]/.bundle/dms-metadata-after-[UNIQUE_NAME]/prod/files",
+      "root_path": "/Workspace/Users/[USERNAME]/.bundle/dms-metadata-after-[UNIQUE_NAME]/prod"
+    }
+  }
+}
+
+>>> [CLI] bundle plan -t prod -o json
+Recommendation: target with 'mode: production' should set 'workspace.root_path' to make sure only one copy is deployed
+
+A common practice is to use a username or principal name in this path, i.e. use
+
+  root_path: /Workspace/Users/[USERNAME]/.bundle/${bundle.name}/${bundle.target}
+
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "features": {
+    "deployment_history": {}
+  }
+}
+
+>>> [CLI] bundle plan -t prod
+Recommendation: target with 'mode: production' should set 'workspace.root_path' to make sure only one copy is deployed
+
+A common practice is to use a username or principal name in this path, i.e. use
+
+  root_path: /Workspace/Users/[USERNAME]/.bundle/${bundle.name}/${bundle.target}
+
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+>>> MSYS_NO_PATHCONV=1 [CLI] bundle-deployments list-resources deployments/[DEPLOYMENT_ID] -o json
+[
+  {
+    "last_action_type": "OPERATION_ACTION_TYPE_CREATE",
+    "last_version_id": "1",
+    "resource_key": "schemas.foo"
+  }
+]
+
+=== Deploy again without touching anything: the record already says this, so no deployment update
+>>> [CLI] bundle deploy -t prod
+Recommendation: target with 'mode: production' should set 'workspace.root_path' to make sure only one copy is deployed
+
+A common practice is to use a username or principal name in this path, i.e. use
+
+  root_path: /Workspace/Users/[USERNAME]/.bundle/${bundle.name}/${bundle.target}
+
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dms-metadata-after-[UNIQUE_NAME]/prod/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
+
+>>> print_requests.py --dms //api/2.0/bundle
+
+>>> MSYS_NO_PATHCONV=1 [CLI] bundle-deployments list-resources deployments/[DEPLOYMENT_ID] -o json
+[
+  {
+    "last_action_type": "OPERATION_ACTION_TYPE_CREATE",
+    "last_version_id": "1",
+    "resource_key": "schemas.foo"
+  }
+]
diff --git a/acceptance/bundle/dms/deployment-metadata-change/script b/acceptance/bundle/dms/deployment-metadata-change/script
new file mode 100644
index 00000000000..af66e148fdb
--- /dev/null
+++ b/acceptance/bundle/dms/deployment-metadata-change/script
@@ -0,0 +1,26 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+title "Deploy: the deployment is created carrying this bundle's metadata"
+trace $CLI bundle deploy
+trace print_requests.py --dms //api/2.0/bundle
+
+title "The plan records the deployment_history feature; the service holds the schema at version 1"
+dms_plan
+deployment_id=$(MSYS_NO_PATHCONV=1 $CLI workspace get-status "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/dms-metadata-pinned-${UNIQUE_NAME}/state/resources.deployment.json" | python3 -c 'import sys, json; print(json.load(sys.stdin)["object_id"])')
+add_repl "$deployment_id" DEPLOYMENT_ID
+trace MSYS_NO_PATHCONV=1 $CLI bundle-deployments list-resources "deployments/${deployment_id}" -o json | jq -S 'map({resource_key, last_version_id, last_action_type})'
+
+title "Rename the bundle and switch target+mode. The state path is pinned, so this is the same deployment, updated in place - the mask carries every field that changed"
+trace update_file.py databricks.yml dms-metadata-before dms-metadata-after
+trace $CLI bundle deploy -t prod
+trace print_requests.py --dms //api/2.0/bundle
+
+dms_plan -t prod
+trace MSYS_NO_PATHCONV=1 $CLI bundle-deployments list-resources "deployments/${deployment_id}" -o json | jq -S 'map({resource_key, last_version_id, last_action_type})'
+
+title "Deploy again without touching anything: the record already says this, so no deployment update"
+trace $CLI bundle deploy -t prod
+trace print_requests.py --dms //api/2.0/bundle
+
+trace MSYS_NO_PATHCONV=1 $CLI bundle-deployments list-resources "deployments/${deployment_id}" -o json | jq -S 'map({resource_key, last_version_id, last_action_type})'
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/dms/empty-grants/databricks.yml.tmpl b/acceptance/bundle/dms/empty-grants/databricks.yml.tmpl
new file mode 100644
index 00000000000..57bec803335
--- /dev/null
+++ b/acceptance/bundle/dms/empty-grants/databricks.yml.tmpl
@@ -0,0 +1,11 @@
+bundle:
+  name: dms-empty-grants-$UNIQUE_NAME
+experimental:
+  deployment_history: true
+
+resources:
+  schemas:
+    foo:
+      name: dms_empty_grants_$UNIQUE_NAME
+      catalog_name: main
+      grants: [{principal: deco-test-user@databricks.com, privileges: [USE_SCHEMA]}]
diff --git a/acceptance/bundle/dms/empty-grants/out.test.toml b/acceptance/bundle/dms/empty-grants/out.test.toml
new file mode 100644
index 00000000000..88e6fbd847c
--- /dev/null
+++ b/acceptance/bundle/dms/empty-grants/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["true"]
diff --git a/acceptance/bundle/dms/empty-grants/output.txt b/acceptance/bundle/dms/empty-grants/output.txt
new file mode 100644
index 00000000000..0a6cbabcbce
--- /dev/null
+++ b/acceptance/bundle/dms/empty-grants/output.txt
@@ -0,0 +1,180 @@
+
+=== Deploy a schema with one grant: the grants node is recorded with its state
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dms-empty-grants-[UNIQUE_NAME]/default/files...
+Created schemas.foo
+Created schemas.foo.grants
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py --dms //api/2.0/bundle
+{
+  "method": "POST",
+  "path": "/api/2.0/bundle/deployments",
+  "body": {
+    "display_name": "dms-empty-grants-[UNIQUE_NAME]",
+    "initial_parent_path": "/Workspace/Users/[USERNAME]/.bundle/dms-empty-grants-[UNIQUE_NAME]/default/state",
+    "target_name": "default",
+    "workspace_info": {
+      "file_path": "/Workspace/Users/[USERNAME]/.bundle/dms-empty-grants-[UNIQUE_NAME]/default/files",
+      "root_path": "/Workspace/Users/[USERNAME]/.bundle/dms-empty-grants-[UNIQUE_NAME]/default"
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions",
+  "q": {
+    "version_id": "1"
+  },
+  "body": {
+    "cli_version": "[CLI_VERSION]",
+    "operations": [
+      {
+        "action_type": "OPERATION_ACTION_TYPE_CREATE",
+        "resource_key": "schemas.foo"
+      },
+      {
+        "action_type": "OPERATION_ACTION_TYPE_CREATE",
+        "resource_key": "schemas.foo.grants"
+      }
+    ],
+    "version_type": "VERSION_TYPE_DEPLOY"
+  }
+}
+{
+  "method": "PATCH",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/1/operations/schemas.foo",
+  "q": {
+    "update_mask": "state,error_message,resource_id,status"
+  },
+  "body": {
+    "error_message": "",
+    "resource_id": "main.dms_empty_grants_[UNIQUE_NAME]",
+    "sequence_id": 0,
+    "state": "{\"state\":{\"catalog_name\":\"main\",\"name\":\"dms_empty_grants_[UNIQUE_NAME]\"}}",
+    "status": "OPERATION_STATUS_SUCCEEDED"
+  }
+}
+{
+  "method": "PATCH",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/1/operations/schemas.foo.grants",
+  "q": {
+    "update_mask": "state,error_message,resource_id,status"
+  },
+  "body": {
+    "error_message": "",
+    "resource_id": "schema/main.dms_empty_grants_[UNIQUE_NAME]",
+    "sequence_id": 0,
+    "state": "{\"state\":{\"securable_type\":\"schema\",\"full_name\":\"main.dms_empty_grants_[UNIQUE_NAME]\",\"__embed__\":[{\"principal\":\"deco-test-user@databricks.com\",\"privileges\":[\"USE_SCHEMA\"]}]},\"depends_on\":[{\"node\":\"resources.schemas.foo\",\"label\":\"${resources.schemas.foo.id}\"}]}",
+    "status": "OPERATION_STATUS_SUCCEEDED"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/1/complete",
+  "body": {
+    "completion_reason": "VERSION_COMPLETE_SUCCESS"
+  }
+}
+
+=== Revoke the grant, so the grants node empties out
+>>> update_file.py databricks.yml grants: [{principal: deco-test-user@databricks.com, privileges: [USE_SCHEMA]}] grants: []
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dms-empty-grants-[UNIQUE_NAME]/default/files...
+Updated schemas.foo.grants
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 1 unchanged
+
+>>> print_requests.py --dms //api/2.0/bundle
+{
+  "method": "POST",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions",
+  "q": {
+    "version_id": "2"
+  },
+  "body": {
+    "cli_version": "[CLI_VERSION]",
+    "operations": [
+      {
+        "action_type": "OPERATION_ACTION_TYPE_UPDATE",
+        "resource_key": "schemas.foo.grants"
+      }
+    ],
+    "previous_version_id": "1",
+    "version_type": "VERSION_TYPE_DEPLOY"
+  }
+}
+{
+  "method": "PATCH",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/2/operations/schemas.foo.grants",
+  "q": {
+    "update_mask": "state,error_message,status"
+  },
+  "body": {
+    "error_message": "",
+    "sequence_id": 0,
+    "status": "OPERATION_STATUS_SUCCEEDED"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/2/complete",
+  "body": {
+    "completion_reason": "VERSION_COMPLETE_SUCCESS"
+  }
+}
+
+=== Plan again: reading state back from the service works and reports no work
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+=== The plan is a no-op and records the deployment_history feature
+>>> [CLI] bundle plan -o json
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 2,
+  "features": {
+    "deployment_history": {}
+  }
+}
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+=== The grants node emptied out, so the service no longer lists it - only the schema remains
+>>> MSYS_NO_PATHCONV=1 [CLI] bundle-deployments list-resources deployments/[DEPLOYMENT_ID] -o json
+[
+  {
+    "last_action_type": "OPERATION_ACTION_TYPE_CREATE",
+    "last_version_id": "1",
+    "resource_key": "schemas.foo"
+  }
+]
+
+=== The raw recorded state the service holds for this deployment
+>>> print_state.py --no-dms
+{
+ "state_version": 3,
+ "cli_version": "[CLI_VERSION]",
+ "lineage": "[UUID]",
+ "serial": 2,
+ "features": {
+  "deployment_history": {}
+ },
+ "state": {}
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.schemas.foo
+
+This action will result in the deletion of the following UC schemas. Any underlying data may be lost:
+  delete resources.schemas.foo
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/dms-empty-grants-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/dms/empty-grants/script b/acceptance/bundle/dms/empty-grants/script
new file mode 100644
index 00000000000..0dc96e90c39
--- /dev/null
+++ b/acceptance/bundle/dms/empty-grants/script
@@ -0,0 +1,35 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+title "Deploy a schema with one grant: the grants node is recorded with its state"
+trace $CLI bundle deploy
+trace print_requests.py --dms //api/2.0/bundle
+
+title "Revoke the grant, so the grants node empties out"
+trace update_file.py databricks.yml 'grants: [{principal: deco-test-user@databricks.com, privileges: [USE_SCHEMA]}]' 'grants: []'
+trace $CLI bundle deploy
+
+# KNOWN BUG (why this test is Cloud=false): emptying the grants node makes apply call
+# DeleteState, which records the operation as a delete with no state. The staged action
+# is still UPDATE, so the service sees a succeeded UPDATE that names no state while the
+# schema (a live resource) still exists, and rejects it (400 INVALID_PARAMETER_VALUE). The
+# fake does not model that check, so this passes locally; the recorded requests below are
+# the buggy output. Fix: emptying grants should record an update carrying the emptied
+# grants state, not a delete.
+trace print_requests.py --dms //api/2.0/bundle
+
+title "Plan again: reading state back from the service works and reports no work"
+trace $CLI bundle plan | contains.py "Plan: 0 to add, 0 to change, 0 to delete" "!unexpected end of JSON input"
+
+title "The plan is a no-op and records the deployment_history feature"
+dms_plan
+
+title "The grants node emptied out, so the service no longer lists it - only the schema remains"
+deployment_id=$(MSYS_NO_PATHCONV=1 $CLI workspace get-status "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/dms-empty-grants-${UNIQUE_NAME}/default/state/resources.deployment.json" | python3 -c 'import sys, json; print(json.load(sys.stdin)["object_id"])')
+add_repl "$deployment_id" DEPLOYMENT_ID
+trace MSYS_NO_PATHCONV=1 $CLI bundle-deployments list-resources "deployments/${deployment_id}" -o json | jq -S 'map({resource_key, last_version_id, last_action_type})'
+
+title "The raw recorded state the service holds for this deployment"
+trace print_state.py --no-dms
+
+trace $CLI bundle destroy --auto-approve
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/dms/empty-grants/test.toml b/acceptance/bundle/dms/empty-grants/test.toml
new file mode 100644
index 00000000000..fc548948325
--- /dev/null
+++ b/acceptance/bundle/dms/empty-grants/test.toml
@@ -0,0 +1,6 @@
+# KNOWN BUG (Cloud=false): emptying a grants node makes apply call DeleteState, which records
+# the operation as a delete with no state. The staged action is still UPDATE, so the service
+# rejects a succeeded UPDATE that names no state while the schema still exists. The fake does
+# not model that check, so this passes locally but fails on a real workspace. Re-enable once
+# emptying grants records an update carrying the emptied state instead of a delete.
+Cloud = false
diff --git a/acceptance/bundle/dms/existing-state/databricks.yml.tmpl b/acceptance/bundle/dms/existing-state/databricks.yml.tmpl
new file mode 100644
index 00000000000..29addd6433e
--- /dev/null
+++ b/acceptance/bundle/dms/existing-state/databricks.yml.tmpl
@@ -0,0 +1,7 @@
+bundle:
+  name: dms-existing-state-$UNIQUE_NAME
+
+resources:
+  jobs:
+    one:
+      name: one
diff --git a/acceptance/bundle/dms/existing-state/out.test.toml b/acceptance/bundle/dms/existing-state/out.test.toml
new file mode 100644
index 00000000000..f68b4a89c36
--- /dev/null
+++ b/acceptance/bundle/dms/existing-state/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/dms/existing-state/output.txt b/acceptance/bundle/dms/existing-state/output.txt
new file mode 100644
index 00000000000..4057525509b
--- /dev/null
+++ b/acceptance/bundle/dms/existing-state/output.txt
@@ -0,0 +1,78 @@
+
+=== Deploy without recording: ordinary direct-engine state tracking one job, unknown to DMS
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dms-existing-state-[UNIQUE_NAME]/default/files...
+Created jobs.one
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] bundle plan -o json
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1
+}
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+>>> print_requests.py --dms //api/2.0/bundle --oneline
+
+>>> jq {state_version, features} .databricks/bundle/default/resources.json
+{
+  "state_version": 3,
+  "features": null
+}
+
+=== Enabling recording is refused because the existing deployment is not recorded
+>>> DATABRICKS_BUNDLE_DEPLOYMENT_HISTORY=true [CLI] bundle deploy
+Error: deployment history setting (true) does not match the existing state (false)
+
+Update experimental.deployment_history to match the existing deployment, or run "databricks bundle destroy" to start over
+
+
+>>> print_requests.py --dms //api/2.0/bundle --oneline
+
+=== Wiping the local cache still refuses after pulling the non-DMS state from the workspace
+>>> DATABRICKS_BUNDLE_DEPLOYMENT_HISTORY=true [CLI] bundle deploy
+Error: deployment history setting (true) does not match the existing state (false)
+
+Update experimental.deployment_history to match the existing deployment, or run "databricks bundle destroy" to start over
+
+
+=== A leftover local WAL with the wrong lineage is still refused
+>>> DATABRICKS_BUNDLE_DEPLOYMENT_HISTORY=true [CLI] bundle deploy
+Error: reading state from [TEST_TMP_DIR]/.databricks/bundle/default/resources.json: WAL recovery failed: WAL lineage ("stale") does not match state lineage ("[UUID]")
+
+
+=== Destroy clears the deployment. With nothing recorded remotely the bundle is treated as new, so recording can be enabled once the stale WAL is gone
+>>> DATABRICKS_BUNDLE_DEPLOYMENT_HISTORY=true [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.one
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/dms-existing-state-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
+
+>>> DATABRICKS_BUNDLE_DEPLOYMENT_HISTORY=true [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dms-existing-state-[UNIQUE_NAME]/default/files...
+Created jobs.one
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py --dms //api/2.0/bundle --oneline
+{"method": "POST", "path": "/api/2.0/bundle/deployments", "body": {"display_name": "dms-existing-state-[UNIQUE_NAME]", "initial_parent_path": "/Workspace/Users/[USERNAME]/.bundle/dms-existing-state-[UNIQUE_NAME]/default/state", "target_name": "default", "workspace_info": {"file_path": "/Workspace/Users/[USERNAME]/.bundle/dms-existing-state-[UNIQUE_NAME]/default/files", "root_path": "/Workspace/Users/[USERNAME]/.bundle/dms-existing-state-[UNIQUE_NAME]/default"}}}
+{"method": "POST", "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions", "q": {"version_id": "1"}, "body": {"cli_version": "[CLI_VERSION]", "operations": [{"action_type": "OPERATION_ACTION_TYPE_CREATE", "resource_key": "jobs.one"}], "version_type": "VERSION_TYPE_DEPLOY"}}
+{"method": "PATCH", "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/1/operations/jobs.one", "q": {"update_mask": "state,error_message,resource_id,status"}, "body": {"error_message": "", "resource_id": "[ONE_ID]", "sequence_id": 0, "state": "{\"state\":{\"deployment\":{\"deployment_id\":\"[DEPLOYMENT_ID]\",\"kind\":\"BUNDLE\",\"metadata_file_path\":\"/Workspace/Users/[USERNAME]/.bundle/dms-existing-state-[UNIQUE_NAME]/default/state/metadata.json\",\"version_id\":\"1\"},\"edit_mode\":\"UI_LOCKED\",\"format\":\"MULTI_TASK\",\"max_concurrent_runs\":1,\"name\":\"one\",\"queue\":{\"enabled\":true}}}", "status": "OPERATION_STATUS_SUCCEEDED"}}
+{"method": "POST", "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/1/complete", "body": {"completion_reason": "VERSION_COMPLETE_SUCCESS"}}
+
+>>> find.py resources[.]json[.]wal --expect 0
+
+>>> jq {state_version, features} .databricks/bundle/default/resources.json
+{
+  "state_version": 3,
+  "features": {
+    "deployment_history": {}
+  }
+}
diff --git a/acceptance/bundle/dms/existing-state/script b/acceptance/bundle/dms/existing-state/script
new file mode 100644
index 00000000000..e64ca6febe6
--- /dev/null
+++ b/acceptance/bundle/dms/existing-state/script
@@ -0,0 +1,38 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+title "Deploy without recording: ordinary direct-engine state tracking one job, unknown to DMS"
+trace $CLI bundle deploy
+dms_plan
+trace print_requests.py --dms //api/2.0/bundle --oneline
+trace jq '{state_version, features}' .databricks/bundle/default/resources.json
+
+title "Enabling recording is refused because the existing deployment is not recorded"
+musterr trace DATABRICKS_BUNDLE_DEPLOYMENT_HISTORY=true $CLI bundle deploy
+trace print_requests.py --dms //api/2.0/bundle --oneline
+
+title "Wiping the local cache still refuses after pulling the non-DMS state from the workspace"
+rm -rf .databricks
+musterr trace DATABRICKS_BUNDLE_DEPLOYMENT_HISTORY=true $CLI bundle deploy
+
+title "A leftover local WAL with the wrong lineage is still refused"
+mkdir -p .databricks/bundle/default
+printf '{"lineage":"stale","serial":99,"state_version":2,"features":{"deployment_history":{}}}\n' > .databricks/bundle/default/resources.json.wal
+musterr trace DATABRICKS_BUNDLE_DEPLOYMENT_HISTORY=true $CLI bundle deploy
+
+title "Destroy clears the deployment. With nothing recorded remotely the bundle is treated as new, so recording can be enabled once the stale WAL is gone"
+# Clear the stale WAL first: it was refused, not deleted, and destroy runs without recording, so it
+# would otherwise try to replay it and fail on the lineage mismatch.
+rm -f .databricks/bundle/default/resources.json.wal
+# Keep the mismatched setting here to verify that destroy ignores configuration and follows state.
+trace DATABRICKS_BUNDLE_DEPLOYMENT_HISTORY=true $CLI bundle destroy --auto-approve
+trace DATABRICKS_BUNDLE_DEPLOYMENT_HISTORY=true $CLI bundle deploy
+trace print_requests.py --dms //api/2.0/bundle --oneline
+trace find.py 'resources[.]json[.]wal' --expect 0
+trace jq '{state_version, features}' .databricks/bundle/default/resources.json
+DATABRICKS_BUNDLE_DEPLOYMENT_HISTORY=true replace_ids.py
+deployment_id=$(MSYS_NO_PATHCONV=1 $CLI workspace get-status "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/dms-existing-state-${UNIQUE_NAME}/default/state/resources.deployment.json" | python3 -c 'import sys, json; print(json.load(sys.stdin)["object_id"])')
+add_repl "$deployment_id" DEPLOYMENT_ID
+
+# The recorded requests are asserted above via print_requests.py; drop whatever the run added after
+# that (telemetry, and the state probes of the non-recording variant) so nothing is left to compare.
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/dms/existing-state/test.toml b/acceptance/bundle/dms/existing-state/test.toml
new file mode 100644
index 00000000000..7499498f419
--- /dev/null
+++ b/acceptance/bundle/dms/existing-state/test.toml
@@ -0,0 +1,3 @@
+# This test deploys without recording first, then turns it on per-command, so it opts out of
+# the parent's DMS=true and drives DATABRICKS_BUNDLE_DEPLOYMENT_HISTORY inline instead.
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/dms/failed-delete/databricks.yml.tmpl b/acceptance/bundle/dms/failed-delete/databricks.yml.tmpl
new file mode 100644
index 00000000000..1c59553634d
--- /dev/null
+++ b/acceptance/bundle/dms/failed-delete/databricks.yml.tmpl
@@ -0,0 +1,9 @@
+bundle:
+  name: dms-failed-delete-$UNIQUE_NAME
+experimental:
+  deployment_history: true
+
+resources:
+  jobs:
+    stuck:
+      name: stuck
diff --git a/acceptance/bundle/dms/failed-delete/out.test.toml b/acceptance/bundle/dms/failed-delete/out.test.toml
new file mode 100644
index 00000000000..88e6fbd847c
--- /dev/null
+++ b/acceptance/bundle/dms/failed-delete/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["true"]
diff --git a/acceptance/bundle/dms/failed-delete/output.txt b/acceptance/bundle/dms/failed-delete/output.txt
new file mode 100644
index 00000000000..e3241b3d66a
--- /dev/null
+++ b/acceptance/bundle/dms/failed-delete/output.txt
@@ -0,0 +1,197 @@
+
+=== Deploy: the job is recorded
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dms-failed-delete-[UNIQUE_NAME]/default/files...
+Created jobs.stuck
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py --dms //api/2.0/bundle
+{
+  "method": "POST",
+  "path": "/api/2.0/bundle/deployments",
+  "body": {
+    "display_name": "dms-failed-delete-[UNIQUE_NAME]",
+    "initial_parent_path": "/Workspace/Users/[USERNAME]/.bundle/dms-failed-delete-[UNIQUE_NAME]/default/state",
+    "target_name": "default",
+    "workspace_info": {
+      "file_path": "/Workspace/Users/[USERNAME]/.bundle/dms-failed-delete-[UNIQUE_NAME]/default/files",
+      "root_path": "/Workspace/Users/[USERNAME]/.bundle/dms-failed-delete-[UNIQUE_NAME]/default"
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions",
+  "q": {
+    "version_id": "1"
+  },
+  "body": {
+    "cli_version": "[CLI_VERSION]",
+    "operations": [
+      {
+        "action_type": "OPERATION_ACTION_TYPE_CREATE",
+        "resource_key": "jobs.stuck"
+      }
+    ],
+    "version_type": "VERSION_TYPE_DEPLOY"
+  }
+}
+{
+  "method": "PATCH",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/1/operations/jobs.stuck",
+  "q": {
+    "update_mask": "state,error_message,resource_id,status"
+  },
+  "body": {
+    "error_message": "",
+    "resource_id": "[STUCK_ID]",
+    "sequence_id": 0,
+    "state": "{\"state\":{\"deployment\":{\"deployment_id\":\"[DEPLOYMENT_ID]\",\"kind\":\"BUNDLE\",\"metadata_file_path\":\"/Workspace/Users/[USERNAME]/.bundle/dms-failed-delete-[UNIQUE_NAME]/default/state/metadata.json\",\"version_id\":\"1\"},\"edit_mode\":\"UI_LOCKED\",\"format\":\"MULTI_TASK\",\"max_concurrent_runs\":1,\"name\":\"stuck\",\"queue\":{\"enabled\":true}}}",
+    "status": "OPERATION_STATUS_SUCCEEDED"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/1/complete",
+  "body": {
+    "completion_reason": "VERSION_COMPLETE_SUCCESS"
+  }
+}
+
+=== The plan is a no-op now and records the deployment_history feature
+>>> [CLI] bundle plan -o json
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "features": {
+    "deployment_history": {}
+  }
+}
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+=== After deploy, the service lists the resource at version 1
+>>> MSYS_NO_PATHCONV=1 [CLI] bundle-deployments list-resources deployments/[DEPLOYMENT_ID] -o json
+[
+  {
+    "last_action_type": "OPERATION_ACTION_TYPE_CREATE",
+    "last_version_id": "1",
+    "resource_key": "jobs.stuck"
+  }
+]
+
+=== The raw state after successful deploy
+>>> print_state.py --no-dms
+{
+ "state_version": 3,
+ "cli_version": "[CLI_VERSION]",
+ "lineage": "[UUID]",
+ "serial": 1,
+ "features": {
+  "deployment_history": {}
+ },
+ "state": {}
+}
+
+=== A resource that fails to delete is recorded as a failed operation carrying the error, so the history says why rather than showing the resource gone
+>>> fault.py POST /api/2.2/jobs/delete 400 0 1 INVALID_PARAMETER_VALUE
+
+>>> musterr [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.stuck
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/dms-failed-delete-[UNIQUE_NAME]/default
+
+Error: cannot delete resources.jobs.stuck: deleting id=[STUCK_ID]: Fault injected by test. (400 INVALID_PARAMETER_VALUE)
+
+Endpoint: POST [DATABRICKS_URL]/api/2.2/jobs/delete
+HTTP Status: 400 Bad Request
+API error_code: INVALID_PARAMETER_VALUE
+API message: Fault injected by test.
+
+
+>>> print_requests.py --dms //api/2.0/bundle
+{
+  "method": "POST",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions",
+  "q": {
+    "version_id": "2"
+  },
+  "body": {
+    "cli_version": "[CLI_VERSION]",
+    "operations": [
+      {
+        "action_type": "OPERATION_ACTION_TYPE_DELETE",
+        "resource_key": "jobs.stuck"
+      }
+    ],
+    "previous_version_id": "1",
+    "version_type": "VERSION_TYPE_DESTROY"
+  }
+}
+{
+  "method": "PATCH",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/2/operations/jobs.stuck",
+  "q": {
+    "update_mask": "state,error_message,resource_id,status"
+  },
+  "body": {
+    "error_message": "deleting id=[STUCK_ID]: Fault injected by test. (400 INVALID_PARAMETER_VALUE)",
+    "resource_id": "[STUCK_ID]",
+    "sequence_id": 0,
+    "state": "{\"state\":{\"deployment\":{\"deployment_id\":\"[DEPLOYMENT_ID]\",\"kind\":\"BUNDLE\",\"metadata_file_path\":\"/Workspace/Users/[USERNAME]/.bundle/dms-failed-delete-[UNIQUE_NAME]/default/state/metadata.json\",\"version_id\":\"1\"},\"edit_mode\":\"UI_LOCKED\",\"format\":\"MULTI_TASK\",\"max_concurrent_runs\":1,\"name\":\"stuck\",\"queue\":{\"enabled\":true}}}",
+    "status": "OPERATION_STATUS_FAILED"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/2/complete",
+  "body": {
+    "completion_reason": "VERSION_COMPLETE_FAILURE"
+  }
+}
+
+=== After failure, the service shows the operation failed
+>>> MSYS_NO_PATHCONV=1 [CLI] bundle-deployments list-resources deployments/[DEPLOYMENT_ID] -o json
+[
+  {
+    "last_action_type": "OPERATION_ACTION_TYPE_DELETE",
+    "last_version_id": "2",
+    "resource_key": "jobs.stuck"
+  }
+]
+
+=== The failed operation records the error message
+>>> MSYS_NO_PATHCONV=1 [CLI] bundle-deployments list-operations deployments/[DEPLOYMENT_ID]/versions/2 -o json
+[
+  {
+    "action_type": "OPERATION_ACTION_TYPE_DELETE",
+    "error_message": "deleting id=[STUCK_ID]: Fault injected by test. (400 INVALID_PARAMETER_VALUE)",
+    "resource_key": "jobs.stuck",
+    "status": "OPERATION_STATUS_FAILED"
+  }
+]
+
+=== The local state file records failed version 2
+>>> print_state.py --no-dms
+{
+ "state_version": 3,
+ "cli_version": "[CLI_VERSION]",
+ "lineage": "[UUID]",
+ "serial": 2,
+ "features": {
+  "deployment_history": {}
+ },
+ "state": {}
+}
+
+=== The remote checkpoint stays at serial 1 while DMS advances to version 2
+>>> MSYS_NO_PATHCONV=1 [CLI] workspace export /Workspace/Users/[USERNAME]/.bundle/dms-failed-delete-[UNIQUE_NAME]/default/state/resources.json --format RAW
+{"serial":1}
+
+>>> print_state.py
+{"serial":2}
diff --git a/acceptance/bundle/dms/failed-delete/script b/acceptance/bundle/dms/failed-delete/script
new file mode 100644
index 00000000000..2b733207f0a
--- /dev/null
+++ b/acceptance/bundle/dms/failed-delete/script
@@ -0,0 +1,40 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+title "Deploy: the job is recorded"
+trace $CLI bundle deploy
+trace print_requests.py --dms //api/2.0/bundle
+
+title "The plan is a no-op now and records the deployment_history feature"
+dms_plan
+
+title "After deploy, the service lists the resource at version 1"
+deployment_id=$(MSYS_NO_PATHCONV=1 $CLI workspace get-status "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/dms-failed-delete-${UNIQUE_NAME}/default/state/resources.deployment.json" | python3 -c 'import sys, json; print(json.load(sys.stdin)["object_id"])')
+add_repl "$deployment_id" DEPLOYMENT_ID
+trace MSYS_NO_PATHCONV=1 $CLI bundle-deployments list-resources "deployments/${deployment_id}" -o json | jq -S 'map({resource_key, last_version_id, last_action_type})'
+
+title "The raw state after successful deploy"
+trace print_state.py --no-dms
+replace_ids.py
+
+title "A resource that fails to delete is recorded as a failed operation carrying the error, so the history says why rather than showing the resource gone"
+# The state entry survives too, so the next deploy still knows about the resource.
+trace fault.py "POST /api/2.2/jobs/delete" 400 0 1 INVALID_PARAMETER_VALUE
+trace musterr $CLI bundle destroy --auto-approve
+trace print_requests.py --dms //api/2.0/bundle
+
+title "After failure, the service shows the operation failed"
+deployment_id=$(MSYS_NO_PATHCONV=1 $CLI workspace get-status "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/dms-failed-delete-${UNIQUE_NAME}/default/state/resources.deployment.json" | python3 -c 'import sys, json; print(json.load(sys.stdin)["object_id"])')
+trace MSYS_NO_PATHCONV=1 $CLI bundle-deployments list-resources "deployments/${deployment_id}" -o json | jq -S 'map({resource_key, last_version_id, last_action_type})'
+
+title "The failed operation records the error message"
+trace MSYS_NO_PATHCONV=1 $CLI bundle-deployments list-operations "deployments/${deployment_id}/versions/2" -o json | jq -S 'map({resource_key, action_type, status, error_message})'
+
+title "The local state file records failed version 2"
+trace print_state.py --no-dms
+
+title "The remote checkpoint stays at serial 1 while DMS advances to version 2"
+trace MSYS_NO_PATHCONV=1 $CLI workspace export "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/dms-failed-delete-${UNIQUE_NAME}/default/state/resources.json" --format RAW | jq -c '{serial}'
+trace print_state.py | jq -c '{serial}'
+
+# Drain any accumulated requests (plan, state reads) so the harness has nothing to diff.
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/dms/failed-delete/test.toml b/acceptance/bundle/dms/failed-delete/test.toml
new file mode 100644
index 00000000000..1a22ff04ef4
--- /dev/null
+++ b/acceptance/bundle/dms/failed-delete/test.toml
@@ -0,0 +1,3 @@
+# Local only: this case needs an injected failure - no job delete that the Jobs API refuses - and fault.py registers
+# its rule on the fake, which a cloud run does not have.
+Cloud = false
diff --git a/acceptance/bundle/dms/failed-recreate/databricks.yml.tmpl b/acceptance/bundle/dms/failed-recreate/databricks.yml.tmpl
new file mode 100644
index 00000000000..eadfeb09665
--- /dev/null
+++ b/acceptance/bundle/dms/failed-recreate/databricks.yml.tmpl
@@ -0,0 +1,11 @@
+bundle:
+  name: dms-failed-recreate-$UNIQUE_NAME
+experimental:
+  deployment_history: true
+
+resources:
+  schemas:
+    foo:
+      name: dms_failed_recreate_schema_$UNIQUE_NAME
+      catalog_name: main
+      comment: v1
diff --git a/acceptance/bundle/dms/failed-recreate/out.test.toml b/acceptance/bundle/dms/failed-recreate/out.test.toml
new file mode 100644
index 00000000000..88e6fbd847c
--- /dev/null
+++ b/acceptance/bundle/dms/failed-recreate/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["true"]
diff --git a/acceptance/bundle/dms/failed-recreate/output.txt b/acceptance/bundle/dms/failed-recreate/output.txt
new file mode 100644
index 00000000000..860460c3375
--- /dev/null
+++ b/acceptance/bundle/dms/failed-recreate/output.txt
@@ -0,0 +1,187 @@
+
+=== Deploy the schema, so there is a resource to recreate
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dms-failed-recreate-[UNIQUE_NAME]/default/files...
+Created schemas.foo
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py --dms //api/2.0/bundle
+{
+  "method": "POST",
+  "path": "/api/2.0/bundle/deployments",
+  "body": {
+    "display_name": "dms-failed-recreate-[UNIQUE_NAME]",
+    "initial_parent_path": "/Workspace/Users/[USERNAME]/.bundle/dms-failed-recreate-[UNIQUE_NAME]/default/state",
+    "target_name": "default",
+    "workspace_info": {
+      "file_path": "/Workspace/Users/[USERNAME]/.bundle/dms-failed-recreate-[UNIQUE_NAME]/default/files",
+      "root_path": "/Workspace/Users/[USERNAME]/.bundle/dms-failed-recreate-[UNIQUE_NAME]/default"
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions",
+  "q": {
+    "version_id": "1"
+  },
+  "body": {
+    "cli_version": "[CLI_VERSION]",
+    "operations": [
+      {
+        "action_type": "OPERATION_ACTION_TYPE_CREATE",
+        "resource_key": "schemas.foo"
+      }
+    ],
+    "version_type": "VERSION_TYPE_DEPLOY"
+  }
+}
+{
+  "method": "PATCH",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/1/operations/schemas.foo",
+  "q": {
+    "update_mask": "state,error_message,resource_id,status"
+  },
+  "body": {
+    "error_message": "",
+    "resource_id": "main.dms_failed_recreate_schema_[UNIQUE_NAME]",
+    "sequence_id": 0,
+    "state": "{\"state\":{\"catalog_name\":\"main\",\"comment\":\"v1\",\"name\":\"dms_failed_recreate_schema_[UNIQUE_NAME]\"}}",
+    "status": "OPERATION_STATUS_SUCCEEDED"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/1/complete",
+  "body": {
+    "completion_reason": "VERSION_COMPLETE_SUCCESS"
+  }
+}
+
+=== The plan is a no-op and records the deployment_history feature
+>>> [CLI] bundle plan -o json
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "features": {
+    "deployment_history": {}
+  }
+}
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+=== After deploy, the service lists the resource at version 1
+>>> MSYS_NO_PATHCONV=1 [CLI] bundle-deployments list-resources deployments/[DEPLOYMENT_ID] -o json
+[
+  {
+    "last_action_type": "OPERATION_ACTION_TYPE_CREATE",
+    "last_version_id": "1",
+    "resource_key": "schemas.foo"
+  }
+]
+
+=== The raw state after successful deploy
+>>> print_state.py --no-dms
+{
+ "state_version": 3,
+ "cli_version": "[CLI_VERSION]",
+ "lineage": "[UUID]",
+ "serial": 1,
+ "features": {
+  "deployment_history": {}
+ },
+ "state": {}
+}
+
+=== A recreate deletes and then fails to create. The delete went through, so the resource really is gone: the failed operation clears its state (self-contained, not assuming the delete's own write reached the service), rather than describing the resource as it was before the deploy
+>>> update_file.py databricks.yml catalog_name: main catalog_name: dms_other_[UNIQUE_NAME]
+
+>>> fault.py POST /api/2.1/unity-catalog/schemas 400 0 1 INVALID_PARAMETER_VALUE
+
+>>> musterr [CLI] bundle deploy --auto-approve
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dms-failed-recreate-[UNIQUE_NAME]/default/files...
+
+This action will result in the deletion or recreation of the following UC schemas. Any underlying data may be lost:
+  recreate resources.schemas.foo
+Error: cannot recreate resources.schemas.foo: Fault injected by test. (400 INVALID_PARAMETER_VALUE)
+
+Endpoint: POST [DATABRICKS_URL]/api/2.1/unity-catalog/schemas
+HTTP Status: 400 Bad Request
+API error_code: INVALID_PARAMETER_VALUE
+API message: Fault injected by test.
+
+Files: 2 uploaded, 0 deleted
+
+>>> print_requests.py --dms //api/2.0/bundle
+{
+  "method": "POST",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions",
+  "q": {
+    "version_id": "2"
+  },
+  "body": {
+    "cli_version": "[CLI_VERSION]",
+    "operations": [
+      {
+        "action_type": "OPERATION_ACTION_TYPE_RECREATE",
+        "resource_key": "schemas.foo"
+      }
+    ],
+    "previous_version_id": "1",
+    "version_type": "VERSION_TYPE_DEPLOY"
+  }
+}
+{
+  "method": "PATCH",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/2/operations/schemas.foo",
+  "q": {
+    "update_mask": "state,error_message,status"
+  },
+  "body": {
+    "error_message": "",
+    "sequence_id": 0,
+    "status": "OPERATION_STATUS_PENDING"
+  }
+}
+{
+  "method": "PATCH",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/2/operations/schemas.foo",
+  "q": {
+    "update_mask": "state,error_message,status"
+  },
+  "body": {
+    "error_message": "Fault injected by test. (400 INVALID_PARAMETER_VALUE)",
+    "sequence_id": 1,
+    "status": "OPERATION_STATUS_FAILED"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/2/complete",
+  "body": {
+    "completion_reason": "VERSION_COMPLETE_FAILURE"
+  }
+}
+
+=== The resource is not listed: state is what projects a resource, and the failed recreate left none
+>>> MSYS_NO_PATHCONV=1 [CLI] bundle-deployments list-resources deployments/[DEPLOYMENT_ID] -o json
+[]
+
+=== The raw state after failed recreate shows no resource
+>>> print_state.py --no-dms
+{
+ "state_version": 3,
+ "cli_version": "[CLI_VERSION]",
+ "lineage": "[UUID]",
+ "serial": 2,
+ "features": {
+  "deployment_history": {}
+ },
+ "state": {}
+}
+
+=== Planning from DMS state alone creates the schema, which is what has to happen: it no longer exists
\ No newline at end of file
diff --git a/acceptance/bundle/dms/failed-recreate/script b/acceptance/bundle/dms/failed-recreate/script
new file mode 100644
index 00000000000..60bcc99df10
--- /dev/null
+++ b/acceptance/bundle/dms/failed-recreate/script
@@ -0,0 +1,41 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+title "Deploy the schema, so there is a resource to recreate"
+trace $CLI bundle deploy
+trace print_requests.py --dms //api/2.0/bundle
+
+title "The plan is a no-op and records the deployment_history feature"
+dms_plan
+
+title "After deploy, the service lists the resource at version 1"
+deployment_id=$(MSYS_NO_PATHCONV=1 $CLI workspace get-status "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/dms-failed-recreate-${UNIQUE_NAME}/default/state/resources.deployment.json" | python3 -c 'import sys, json; print(json.load(sys.stdin)["object_id"])')
+add_repl "$deployment_id" DEPLOYMENT_ID
+trace MSYS_NO_PATHCONV=1 $CLI bundle-deployments list-resources "deployments/${deployment_id}" -o json | jq -S 'map({resource_key, last_version_id, last_action_type})'
+
+title "The raw state after successful deploy"
+trace print_state.py --no-dms
+
+title "A recreate deletes and then fails to create. The delete went through, so the resource really is gone: the failed operation clears its state (self-contained, not assuming the delete's own write reached the service), rather than describing the resource as it was before the deploy"
+# Move the schema to a different catalog to force a recreate (catalog_name is immutable), then
+# fault the schema create so the delete goes through but the create that follows it fails.
+other_catalog="dms_other_${UNIQUE_NAME}"
+$CLI catalogs create "$other_catalog" &> LOG.catalog
+trap '$CLI catalogs delete "$other_catalog" --force >> LOG.catalog 2>&1; rm -f "$OUT_REQUESTS"' EXIT
+trace update_file.py databricks.yml "catalog_name: main" "catalog_name: ${other_catalog}"
+trace fault.py "POST /api/2.1/unity-catalog/schemas" 400 0 1 INVALID_PARAMETER_VALUE
+trace musterr $CLI bundle deploy --auto-approve
+# Not sorted: the point of this test is the order the operations are recorded in.
+trace print_requests.py --dms //api/2.0/bundle
+
+title "The resource is not listed: state is what projects a resource, and the failed recreate left none"
+deployment_id=$(MSYS_NO_PATHCONV=1 $CLI workspace get-status "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/dms-failed-recreate-${UNIQUE_NAME}/default/state/resources.deployment.json" | python3 -c 'import sys, json; print(json.load(sys.stdin)["object_id"])')
+trace MSYS_NO_PATHCONV=1 $CLI bundle-deployments list-resources "deployments/${deployment_id}" -o json | jq -S 'map({resource_key, last_version_id, last_action_type})'
+
+title "The raw state after failed recreate shows no resource"
+trace print_state.py --no-dms
+
+title "Planning from DMS state alone creates the schema, which is what has to happen: it no longer exists"
+rm -rf .databricks
+$CLI bundle plan &> LOG.plan_final
+# Ensure "$OUT_REQUESTS" is not left behind (RecordRequests creates it when running tests)
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/dms/failed-recreate/test.toml b/acceptance/bundle/dms/failed-recreate/test.toml
new file mode 100644
index 00000000000..34bb7053d2c
--- /dev/null
+++ b/acceptance/bundle/dms/failed-recreate/test.toml
@@ -0,0 +1,3 @@
+# Local only: the recreate's create failure is injected with fault.py, which only the fake
+# server honors, so this case cannot be reproduced against a real workspace.
+Cloud = false
diff --git a/acceptance/bundle/dms/failed-update-permissions/databricks.yml.tmpl b/acceptance/bundle/dms/failed-update-permissions/databricks.yml.tmpl
new file mode 100644
index 00000000000..37b413a3ab2
--- /dev/null
+++ b/acceptance/bundle/dms/failed-update-permissions/databricks.yml.tmpl
@@ -0,0 +1,12 @@
+bundle:
+  name: dms-failed-update-permissions-$UNIQUE_NAME
+experimental:
+  deployment_history: true
+
+resources:
+  jobs:
+    foo:
+      name: foo
+      permissions:
+        - level: CAN_VIEW
+          user_name: viewer@example.com
diff --git a/acceptance/bundle/dms/failed-update-permissions/out.test.toml b/acceptance/bundle/dms/failed-update-permissions/out.test.toml
new file mode 100644
index 00000000000..88e6fbd847c
--- /dev/null
+++ b/acceptance/bundle/dms/failed-update-permissions/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["true"]
diff --git a/acceptance/bundle/dms/failed-update-permissions/output.txt b/acceptance/bundle/dms/failed-update-permissions/output.txt
new file mode 100644
index 00000000000..47ef6cd6eac
--- /dev/null
+++ b/acceptance/bundle/dms/failed-update-permissions/output.txt
@@ -0,0 +1,111 @@
+
+=== Deploy the job and its permissions
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dms-failed-update-permissions-[UNIQUE_NAME]/default/files...
+Created jobs.foo
+Created jobs.foo.permissions
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+=== The plan records the deployment_history feature and the job
+>>> [CLI] bundle plan -o json
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "features": {
+    "deployment_history": {}
+  }
+}
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
+
+=== The service lists the job at version 1
+>>> MSYS_NO_PATHCONV=1 [CLI] bundle-deployments list-resources deployments/[DEPLOYMENT_ID] -o json
+[
+  {
+    "last_action_type": "OPERATION_ACTION_TYPE_CREATE",
+    "last_version_id": "1",
+    "resource_key": "jobs.foo"
+  },
+  {
+    "last_action_type": "OPERATION_ACTION_TYPE_CREATE",
+    "last_version_id": "1",
+    "resource_key": "jobs.foo.permissions"
+  }
+]
+
+=== The raw recorded state after deploy
+>>> print_state.py --no-dms
+{
+ "state_version": 3,
+ "cli_version": "[CLI_VERSION]",
+ "lineage": "[UUID]",
+ "serial": 1,
+ "features": {
+  "deployment_history": {}
+ },
+ "state": {}
+}
+
+=== A permissions update that fails records the failure with the permissions it still has. The resource ID here is a path rather than a number, and the state is the embedded permission list, so this covers a shape the resource tests do not
+>>> update_file.py databricks.yml CAN_VIEW CAN_MANAGE
+
+>>> fault.py PUT /api/2.0/permissions/jobs/* 403 0 1 PERMISSION_DENIED
+
+>>> musterr [CLI] bundle deploy --auto-approve
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dms-failed-update-permissions-[UNIQUE_NAME]/default/files...
+Error: cannot update resources.jobs.foo.permissions: updating id=/jobs/[FOO_ID]: Fault injected by test. (403 PERMISSION_DENIED)
+
+Endpoint: PUT [DATABRICKS_URL]/api/2.0/permissions/jobs/[FOO_ID]
+HTTP Status: 403 Forbidden
+API error_code: PERMISSION_DENIED
+API message: Fault injected by test.
+
+Files: 1 uploaded, 0 deleted
+
+=== The service lists the job with the failure
+>>> MSYS_NO_PATHCONV=1 [CLI] bundle-deployments list-resources deployments/[DEPLOYMENT_ID] -o json
+[
+  {
+    "last_action_type": "OPERATION_ACTION_TYPE_CREATE",
+    "last_version_id": "1",
+    "resource_key": "jobs.foo"
+  },
+  {
+    "last_action_type": "OPERATION_ACTION_TYPE_UPDATE",
+    "last_version_id": "2",
+    "resource_key": "jobs.foo.permissions"
+  }
+]
+
+=== The failed operation (version 2) records the error message
+>>> MSYS_NO_PATHCONV=1 [CLI] bundle-deployments list-operations deployments/[DEPLOYMENT_ID]/versions/2 -o json
+[
+  {
+    "action_type": "OPERATION_ACTION_TYPE_UPDATE",
+    "error_message": "updating id=/jobs/[FOO_ID]: Fault injected by test. (403 PERMISSION_DENIED)",
+    "resource_key": "jobs.foo.permissions",
+    "status": "OPERATION_STATUS_FAILED"
+  }
+]
+
+=== The raw recorded state after the failure
+>>> print_state.py --no-dms
+{
+ "state_version": 3,
+ "cli_version": "[CLI_VERSION]",
+ "lineage": "[UUID]",
+ "serial": 2,
+ "features": {
+  "deployment_history": {}
+ },
+ "state": {}
+}
+
+>>> print_requests.py --dms //api/2.0/bundle --oneline
+{"method": "POST", "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions", "q": {"version_id": "2"}, "body": {"cli_version": "[CLI_VERSION]", "operations": [{"action_type": "OPERATION_ACTION_TYPE_UPDATE", "resource_key": "jobs.foo.permissions"}], "previous_version_id": "1", "version_type": "VERSION_TYPE_DEPLOY"}}
+{"method": "PATCH", "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/2/operations/jobs.foo.permissions", "q": {"update_mask": "state,error_message,resource_id,status"}, "body": {"error_message": "updating id=/jobs/[FOO_ID]: Fault injected by test. (403 PERMISSION_DENIED)", "resource_id": "/jobs/[FOO_ID]", "sequence_id": 0, "state": "{\"state\":{\"object_id\":\"/jobs/[FOO_ID]\",\"__embed__\":[{\"level\":\"CAN_VIEW\",\"user_name\":\"viewer@example.com\"},{\"level\":\"IS_OWNER\",\"user_name\":\"[USERNAME]\"}]},\"depends_on\":[{\"node\":\"resources.jobs.foo\",\"label\":\"${resources.jobs.foo.id}\"}]}", "status": "OPERATION_STATUS_FAILED"}}
+{"method": "POST", "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/2/complete", "body": {"completion_reason": "VERSION_COMPLETE_FAILURE"}}
diff --git a/acceptance/bundle/dms/failed-update-permissions/script b/acceptance/bundle/dms/failed-update-permissions/script
new file mode 100644
index 00000000000..8739bd4cc2b
--- /dev/null
+++ b/acceptance/bundle/dms/failed-update-permissions/script
@@ -0,0 +1,35 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+title "Deploy the job and its permissions"
+trace $CLI bundle deploy
+replace_ids.py
+rm -f "$OUT_REQUESTS"
+
+title "The plan records the deployment_history feature and the job"
+dms_plan
+
+title "The service lists the job at version 1"
+deployment_id=$(MSYS_NO_PATHCONV=1 $CLI workspace get-status "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/dms-failed-update-permissions-${UNIQUE_NAME}/default/state/resources.deployment.json" | python3 -c 'import sys, json; print(json.load(sys.stdin)["object_id"])')
+add_repl "$deployment_id" DEPLOYMENT_ID
+trace MSYS_NO_PATHCONV=1 $CLI bundle-deployments list-resources "deployments/${deployment_id}" -o json | jq -S 'map({resource_key, last_version_id, last_action_type})'
+
+title "The raw recorded state after deploy"
+trace print_state.py --no-dms
+
+title "A permissions update that fails records the failure with the permissions it still has. The resource ID here is a path rather than a number, and the state is the embedded permission list, so this covers a shape the resource tests do not"
+trace update_file.py databricks.yml "CAN_VIEW" "CAN_MANAGE"
+# A 403 is what the API returns when the caller cannot change a job's owner.
+trace fault.py "PUT /api/2.0/permissions/jobs/*" 403 0 1 PERMISSION_DENIED
+trace musterr $CLI bundle deploy --auto-approve
+
+title "The service lists the job with the failure"
+deployment_id=$(MSYS_NO_PATHCONV=1 $CLI workspace get-status "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/dms-failed-update-permissions-${UNIQUE_NAME}/default/state/resources.deployment.json" | python3 -c 'import sys, json; print(json.load(sys.stdin)["object_id"])')
+trace MSYS_NO_PATHCONV=1 $CLI bundle-deployments list-resources "deployments/${deployment_id}" -o json | jq -S 'map({resource_key, last_version_id, last_action_type})'
+
+title "The failed operation (version 2) records the error message"
+trace MSYS_NO_PATHCONV=1 $CLI bundle-deployments list-operations "deployments/${deployment_id}/versions/2" -o json | jq -S 'map({resource_key, action_type, status, error_message})'
+
+title "The raw recorded state after the failure"
+trace print_state.py --no-dms
+
+trace print_requests.py --dms //api/2.0/bundle --oneline
diff --git a/acceptance/bundle/dms/failed-update-permissions/test.toml b/acceptance/bundle/dms/failed-update-permissions/test.toml
new file mode 100644
index 00000000000..8a850ba07c5
--- /dev/null
+++ b/acceptance/bundle/dms/failed-update-permissions/test.toml
@@ -0,0 +1,5 @@
+# Local only: the failure is injected, and fault.py registers its rule on the fake, which
+# a cloud run does not have. Simulating it for real instead - a catalog or principal that
+# does not exist - does not work either: the fake accepts both, so the case would stop
+# failing locally. Making it portable needs the fake to model that existence.
+Cloud = false
diff --git a/acceptance/bundle/dms/immutable-folder/databricks.yml.tmpl b/acceptance/bundle/dms/immutable-folder/databricks.yml.tmpl
new file mode 100644
index 00000000000..dad517c9cfa
--- /dev/null
+++ b/acceptance/bundle/dms/immutable-folder/databricks.yml.tmpl
@@ -0,0 +1,19 @@
+bundle:
+  name: dms-immutable-folder-$UNIQUE_NAME
+experimental:
+  immutable_folder: true
+  deployment_history: true
+
+resources:
+  jobs:
+    foo:
+      name: foo
+      tasks:
+        - task_key: main
+          spark_python_task:
+            python_file: ./src/main.py
+          environment_key: env
+      environments:
+        - environment_key: env
+          spec:
+            environment_version: "4"
diff --git a/acceptance/bundle/dms/immutable-folder/out.test.toml b/acceptance/bundle/dms/immutable-folder/out.test.toml
new file mode 100644
index 00000000000..0cedb09be0f
--- /dev/null
+++ b/acceptance/bundle/dms/immutable-folder/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/dms/immutable-folder/output.txt b/acceptance/bundle/dms/immutable-folder/output.txt
new file mode 100644
index 00000000000..a45aa8ba189
--- /dev/null
+++ b/acceptance/bundle/dms/immutable-folder/output.txt
@@ -0,0 +1,43 @@
+
+=== Deploying with an immutable folder records the resolved snapshot path as the deployment's file_path
+>>> [CLI] bundle deploy
+Created internal_immutable_snapshots.immutable
+Created jobs.foo
+Files: 0 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> MSYS_NO_PATHCONV=1 [CLI] api get /api/2.0/bundle/deployments/[DEPLOYMENT_ID]
+{
+  "workspace_info": {
+    "root_path": "/Workspace/Users/[USERNAME]/.bundle/dms-immutable-folder-[UNIQUE_NAME]/default",
+    "file_path": "/Workspace/Users/[UUID]/.snapshots/[SNAPSHOT_HASH]/[SNAPSHOT_HASH]/files"
+  }
+}
+
+=== A new snapshot moves file_path, which is then updated on the deployment
+>>> [CLI] bundle deploy
+Recreated internal_immutable_snapshots.immutable
+Updated jobs.foo
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 1 changed, 1 deleted, 0 unchanged
+
+>>> MSYS_NO_PATHCONV=1 [CLI] api get /api/2.0/bundle/deployments/[DEPLOYMENT_ID]
+{
+  "workspace_info": {
+    "root_path": "/Workspace/Users/[USERNAME]/.bundle/dms-immutable-folder-[UNIQUE_NAME]/default",
+    "file_path": "/Workspace/Users/[UUID]/.snapshots/[SNAPSHOT_HASH]/[SNAPSHOT_HASH]/files"
+  }
+}
+
+=== An unchanged snapshot keeps the recorded file_path
+>>> [CLI] bundle deploy
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 2 unchanged
+
+>>> MSYS_NO_PATHCONV=1 [CLI] api get /api/2.0/bundle/deployments/[DEPLOYMENT_ID]
+{
+  "workspace_info": {
+    "root_path": "/Workspace/Users/[USERNAME]/.bundle/dms-immutable-folder-[UNIQUE_NAME]/default",
+    "file_path": "/Workspace/Users/[UUID]/.snapshots/[SNAPSHOT_HASH]/[SNAPSHOT_HASH]/files"
+  }
+}
diff --git a/acceptance/bundle/dms/immutable-folder/script b/acceptance/bundle/dms/immutable-folder/script
new file mode 100644
index 00000000000..ff70d11a08f
--- /dev/null
+++ b/acceptance/bundle/dms/immutable-folder/script
@@ -0,0 +1,30 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+deployment_workspace_info() {
+    deployment_id=$(MSYS_NO_PATHCONV=1 $CLI workspace get-status "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/dms-immutable-folder-${UNIQUE_NAME}/default/state/resources.deployment.json" -o json | python3 -c 'import sys,json; print(json.load(sys.stdin)["object_id"])')
+    add_repl "$deployment_id" DEPLOYMENT_ID
+    # MSYS_NO_PATHCONV: Git Bash on Windows would rewrite the leading-'/' API path.
+    trace MSYS_NO_PATHCONV=1 $CLI api get "/api/2.0/bundle/deployments/${deployment_id}" | jq '{workspace_info}'
+}
+
+deploy() {
+    mkdir -p .databricks
+    $CLI bundle plan -o json > .databricks/plan.json
+    trace $CLI bundle deploy $(readplanarg .databricks/plan.json)
+    rm .databricks/plan.json
+}
+
+title "Deploying with an immutable folder records the resolved snapshot path as the deployment's file_path"
+deploy
+deployment_workspace_info
+
+title "A new snapshot moves file_path, which is then updated on the deployment"
+echo 'print("changed")' > src/main.py
+deploy
+deployment_workspace_info
+
+title "An unchanged snapshot keeps the recorded file_path"
+deploy
+deployment_workspace_info
+
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/dms/immutable-folder/src/main.py b/acceptance/bundle/dms/immutable-folder/src/main.py
new file mode 100644
index 00000000000..11b15b1a458
--- /dev/null
+++ b/acceptance/bundle/dms/immutable-folder/src/main.py
@@ -0,0 +1 @@
+print("hello")
diff --git a/acceptance/bundle/dms/immutable-folder/test.toml b/acceptance/bundle/dms/immutable-folder/test.toml
new file mode 100644
index 00000000000..0aabadfa242
--- /dev/null
+++ b/acceptance/bundle/dms/immutable-folder/test.toml
@@ -0,0 +1,20 @@
+# The immutable folder API is not available against a real workspace yet.
+Cloud = false
+
+EnvMatrix.READPLAN = ["", "1"]
+
+Ignore = [
+    '.databricks',
+    'databricks.yml',
+]
+
+# The snapshot path is content-addressed.
+[[Repls]]
+Old = '[0-9a-f]{64}'
+New = '[SNAPSHOT_HASH]'
+
+# When READPLAN=1, "bundle deploy" is called as "bundle deploy --plan .databricks/plan.json".
+# Normalize so both variants produce identical output.
+[[Repls]]
+Old = ' --plan .databricks/plan.json'
+New = ''
diff --git a/acceptance/bundle/dms/mismatch-before-read/databricks.yml.tmpl b/acceptance/bundle/dms/mismatch-before-read/databricks.yml.tmpl
new file mode 100644
index 00000000000..67295024b20
--- /dev/null
+++ b/acceptance/bundle/dms/mismatch-before-read/databricks.yml.tmpl
@@ -0,0 +1,9 @@
+bundle:
+  name: dms-mismatch-before-read-$UNIQUE_NAME
+experimental:
+  deployment_history: true
+
+resources:
+  jobs:
+    foo:
+      name: mismatch-before-read
diff --git a/acceptance/bundle/dms/mismatch-before-read/out.test.toml b/acceptance/bundle/dms/mismatch-before-read/out.test.toml
new file mode 100644
index 00000000000..88e6fbd847c
--- /dev/null
+++ b/acceptance/bundle/dms/mismatch-before-read/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["true"]
diff --git a/acceptance/bundle/dms/mismatch-before-read/output.txt b/acceptance/bundle/dms/mismatch-before-read/output.txt
new file mode 100644
index 00000000000..d81bb0875eb
--- /dev/null
+++ b/acceptance/bundle/dms/mismatch-before-read/output.txt
@@ -0,0 +1,14 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dms-mismatch-before-read-[UNIQUE_NAME]/default/files...
+Created jobs.foo
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> fault.py GET /api/2.0/bundle/deployments/* 500 0 1
+
+>>> env DATABRICKS_BUNDLE_DEPLOYMENT_HISTORY=false [CLI] bundle plan
+Error: deployment history setting (false) does not match the existing state (true)
+
+Update experimental.deployment_history to match the existing deployment, or run "databricks bundle destroy" to start over
+
diff --git a/acceptance/bundle/dms/mismatch-before-read/script b/acceptance/bundle/dms/mismatch-before-read/script
new file mode 100644
index 00000000000..8d82f0f9c95
--- /dev/null
+++ b/acceptance/bundle/dms/mismatch-before-read/script
@@ -0,0 +1,8 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+trace $CLI bundle deploy
+update_file.py databricks.yml 'deployment_history: true' 'deployment_history: false'
+
+# The configuration mismatch must be rejected before trying to read the deployment from DMS.
+trace fault.py "GET /api/2.0/bundle/deployments/*" 500 0 1
+musterr trace env DATABRICKS_BUNDLE_DEPLOYMENT_HISTORY=false $CLI bundle plan
diff --git a/acceptance/bundle/dms/mismatch-before-read/test.toml b/acceptance/bundle/dms/mismatch-before-read/test.toml
new file mode 100644
index 00000000000..97b5eec0ed1
--- /dev/null
+++ b/acceptance/bundle/dms/mismatch-before-read/test.toml
@@ -0,0 +1,3 @@
+RecordRequests = false
+# Local only: fault.py registers its rule on the fake server.
+Cloud = false
diff --git a/acceptance/bundle/dms/multiple-resources/databricks.yml.tmpl b/acceptance/bundle/dms/multiple-resources/databricks.yml.tmpl
new file mode 100644
index 00000000000..ccb059f03c0
--- /dev/null
+++ b/acceptance/bundle/dms/multiple-resources/databricks.yml.tmpl
@@ -0,0 +1,17 @@
+bundle:
+  name: dms-multiple-resources-$UNIQUE_NAME
+experimental:
+  deployment_history: true
+
+resources:
+  jobs:
+    one:
+      name: one
+    two:
+      name: two
+    three:
+      name: three
+    four:
+      name: four
+    five:
+      name: five
diff --git a/acceptance/bundle/dms/multiple-resources/out.test.toml b/acceptance/bundle/dms/multiple-resources/out.test.toml
new file mode 100644
index 00000000000..84b22ba6735
--- /dev/null
+++ b/acceptance/bundle/dms/multiple-resources/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["true"]
diff --git a/acceptance/bundle/dms/multiple-resources/output.txt b/acceptance/bundle/dms/multiple-resources/output.txt
new file mode 100644
index 00000000000..10c8a496c2b
--- /dev/null
+++ b/acceptance/bundle/dms/multiple-resources/output.txt
@@ -0,0 +1,142 @@
+
+=== Deploy several resources: operations are uploaded from background workers, so exactly one is recorded per resource no matter what order the uploads finish in. The serialized state is dropped from the output here; other bundle/dms tests cover it.
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dms-multiple-resources-[UNIQUE_NAME]/default/files...
+Created jobs.five
+Created jobs.four
+Created jobs.one
+Created jobs.three
+Created jobs.two
+Files: 2 uploaded, 0 deleted
+Resources: 5 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py --dms //versions/1/operations --sort --del-body state --oneline
+{"method": "PATCH", "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/1/operations/jobs.five", "q": {"update_mask": "state,error_message,resource_id,status"}, "body": {"error_message": "", "resource_id": "[FIVE_ID]", "sequence_id": 0, "status": "OPERATION_STATUS_SUCCEEDED"}}
+{"method": "PATCH", "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/1/operations/jobs.four", "q": {"update_mask": "state,error_message,resource_id,status"}, "body": {"error_message": "", "resource_id": "[FOUR_ID]", "sequence_id": 0, "status": "OPERATION_STATUS_SUCCEEDED"}}
+{"method": "PATCH", "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/1/operations/jobs.one", "q": {"update_mask": "state,error_message,resource_id,status"}, "body": {"error_message": "", "resource_id": "[ONE_ID]", "sequence_id": 0, "status": "OPERATION_STATUS_SUCCEEDED"}}
+{"method": "PATCH", "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/1/operations/jobs.three", "q": {"update_mask": "state,error_message,resource_id,status"}, "body": {"error_message": "", "resource_id": "[THREE_ID]", "sequence_id": 0, "status": "OPERATION_STATUS_SUCCEEDED"}}
+{"method": "PATCH", "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/1/operations/jobs.two", "q": {"update_mask": "state,error_message,resource_id,status"}, "body": {"error_message": "", "resource_id": "[TWO_ID]", "sequence_id": 0, "status": "OPERATION_STATUS_SUCCEEDED"}}
+
+=== The plan records the deployment_history feature
+>>> [CLI] bundle plan -o json
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "features": {
+    "deployment_history": {}
+  }
+}
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 5 unchanged
+
+=== The service lists all five resources at version 1
+>>> MSYS_NO_PATHCONV=1 [CLI] bundle-deployments list-resources deployments/[DEPLOYMENT_ID] -o json
+[
+  {
+    "last_action_type": "OPERATION_ACTION_TYPE_CREATE",
+    "last_version_id": "1",
+    "resource_key": "jobs.five"
+  },
+  {
+    "last_action_type": "OPERATION_ACTION_TYPE_CREATE",
+    "last_version_id": "1",
+    "resource_key": "jobs.four"
+  },
+  {
+    "last_action_type": "OPERATION_ACTION_TYPE_CREATE",
+    "last_version_id": "1",
+    "resource_key": "jobs.one"
+  },
+  {
+    "last_action_type": "OPERATION_ACTION_TYPE_CREATE",
+    "last_version_id": "1",
+    "resource_key": "jobs.three"
+  },
+  {
+    "last_action_type": "OPERATION_ACTION_TYPE_CREATE",
+    "last_version_id": "1",
+    "resource_key": "jobs.two"
+  }
+]
+
+=== The raw recorded state the service holds for this deployment
+>>> print_state.py --no-dms
+{
+ "state_version": 3,
+ "cli_version": "[CLI_VERSION]",
+ "lineage": "[UUID]",
+ "serial": 1,
+ "features": {
+  "deployment_history": {}
+ },
+ "state": {}
+}
+
+=== Redeploy with no changes: nothing is applied, so no version is created at all - the deployment's version tracks state changes, like serial
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dms-multiple-resources-[UNIQUE_NAME]/default/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 5 unchanged
+
+>>> print_requests.py --dms //api/2.0/bundle --sort --oneline
+
+=== The plan records the deployment_history feature
+>>> [CLI] bundle plan -o json
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "features": {
+    "deployment_history": {}
+  }
+}
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 5 unchanged
+
+=== The service still lists all five resources, now at version 2
+>>> MSYS_NO_PATHCONV=1 [CLI] bundle-deployments list-resources deployments/[DEPLOYMENT_ID] -o json
+[
+  {
+    "last_action_type": "OPERATION_ACTION_TYPE_CREATE",
+    "last_version_id": "1",
+    "resource_key": "jobs.five"
+  },
+  {
+    "last_action_type": "OPERATION_ACTION_TYPE_CREATE",
+    "last_version_id": "1",
+    "resource_key": "jobs.four"
+  },
+  {
+    "last_action_type": "OPERATION_ACTION_TYPE_CREATE",
+    "last_version_id": "1",
+    "resource_key": "jobs.one"
+  },
+  {
+    "last_action_type": "OPERATION_ACTION_TYPE_CREATE",
+    "last_version_id": "1",
+    "resource_key": "jobs.three"
+  },
+  {
+    "last_action_type": "OPERATION_ACTION_TYPE_CREATE",
+    "last_version_id": "1",
+    "resource_key": "jobs.two"
+  }
+]
+
+=== The raw recorded state after redeploy
+>>> print_state.py --no-dms
+{
+ "state_version": 3,
+ "cli_version": "[CLI_VERSION]",
+ "lineage": "[UUID]",
+ "serial": 1,
+ "features": {
+  "deployment_history": {}
+ },
+ "state": {}
+}
diff --git a/acceptance/bundle/dms/multiple-resources/script b/acceptance/bundle/dms/multiple-resources/script
new file mode 100644
index 00000000000..0f0276ff357
--- /dev/null
+++ b/acceptance/bundle/dms/multiple-resources/script
@@ -0,0 +1,33 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+title "Deploy several resources: operations are uploaded from background workers, so exactly one is recorded per resource no matter what order the uploads finish in. The serialized state is dropped from the output here; other bundle/dms tests cover it."
+trace $CLI bundle deploy
+replace_ids.py
+trace print_requests.py --dms //versions/1/operations --sort --del-body state --oneline
+
+title "The plan records the deployment_history feature"
+dms_plan
+
+title "The service lists all five resources at version 1"
+deployment_id=$(MSYS_NO_PATHCONV=1 $CLI workspace get-status "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/dms-multiple-resources-${UNIQUE_NAME}/default/state/resources.deployment.json" | python3 -c 'import sys, json; print(json.load(sys.stdin)["object_id"])')
+add_repl "$deployment_id" DEPLOYMENT_ID
+trace MSYS_NO_PATHCONV=1 $CLI bundle-deployments list-resources "deployments/${deployment_id}" -o json | jq -S 'map({resource_key, last_version_id, last_action_type})'
+
+title "The raw recorded state the service holds for this deployment"
+trace print_state.py --no-dms
+
+title "Redeploy with no changes: nothing is applied, so no version is created at all - the deployment's version tracks state changes, like serial"
+trace $CLI bundle deploy
+trace print_requests.py --dms //api/2.0/bundle --sort --oneline
+
+title "The plan records the deployment_history feature"
+dms_plan
+
+title "The service still lists all five resources, now at version 2"
+deployment_id=$(MSYS_NO_PATHCONV=1 $CLI workspace get-status "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/dms-multiple-resources-${UNIQUE_NAME}/default/state/resources.deployment.json" | python3 -c 'import sys, json; print(json.load(sys.stdin)["object_id"])')
+trace MSYS_NO_PATHCONV=1 $CLI bundle-deployments list-resources "deployments/${deployment_id}" -o json | jq -S 'map({resource_key, last_version_id, last_action_type})'
+
+title "The raw recorded state after redeploy"
+trace print_state.py --no-dms
+
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/dms/no-drift/databricks.yml.tmpl b/acceptance/bundle/dms/no-drift/databricks.yml.tmpl
new file mode 100644
index 00000000000..0e001d8a69e
--- /dev/null
+++ b/acceptance/bundle/dms/no-drift/databricks.yml.tmpl
@@ -0,0 +1,20 @@
+bundle:
+  name: dms-no-drift-$UNIQUE_NAME
+experimental:
+  deployment_history: true
+
+resources:
+  jobs:
+    foo:
+      name: foo
+  pipelines:
+    bar:
+      # Unique: the Pipelines API refuses a duplicate name, so two overlapping runs on the
+      # same workspace would collide. Jobs allow duplicates, which is why foo above does not.
+      name: bar-$UNIQUE_NAME
+      catalog: main
+      schema: default
+      serverless: true
+      libraries:
+        - file:
+            path: ./transform.py
diff --git a/acceptance/bundle/dms/no-drift/out.test.toml b/acceptance/bundle/dms/no-drift/out.test.toml
new file mode 100644
index 00000000000..84b22ba6735
--- /dev/null
+++ b/acceptance/bundle/dms/no-drift/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["true"]
diff --git a/acceptance/bundle/dms/no-drift/output.txt b/acceptance/bundle/dms/no-drift/output.txt
new file mode 100644
index 00000000000..c2fe06a747e
--- /dev/null
+++ b/acceptance/bundle/dms/no-drift/output.txt
@@ -0,0 +1,214 @@
+
+=== Deploy job foo and pipeline bar; both are recorded at version 1
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dms-no-drift-[UNIQUE_NAME]/default/files...
+Created jobs.foo
+Created pipelines.bar
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> MSYS_NO_PATHCONV=1 [CLI] bundle-deployments list-resources deployments/[DEPLOYMENT_ID] -o json
+[
+  {
+    "last_action_type": "OPERATION_ACTION_TYPE_CREATE",
+    "last_version_id": "1",
+    "resource_key": "jobs.foo"
+  },
+  {
+    "last_action_type": "OPERATION_ACTION_TYPE_CREATE",
+    "last_version_id": "1",
+    "resource_key": "pipelines.bar"
+  }
+]
+
+>>> [CLI] bundle summary -o json
+{
+  "deployment_id": "[DEPLOYMENT_ID]",
+  "latest_version_id": 1
+}
+
+=== The plan is a no-op now and records the deployment_history feature
+>>> [CLI] bundle plan -o json
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "features": {
+    "deployment_history": {}
+  }
+}
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
+
+=== The raw recorded state the service holds for this deployment
+>>> print_state.py --no-dms
+{
+ "state_version": 3,
+ "cli_version": "[CLI_VERSION]",
+ "lineage": "[UUID]",
+ "serial": 1,
+ "features": {
+  "deployment_history": {}
+ },
+ "state": {}
+}
+
+=== Plan without touching anything: the deployment stamp must not show as drift
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
+
+=== Update only the pipeline (not the job), then redeploy: only the pipeline's recorded version bumps to 2
+>>> update_file.py databricks.yml serverless: true serverless: true
+      development: true
+
+>>> [CLI] bundle deploy
+Warning: The "development" property of pipelines is deprecated. Use "mode: development" in your databricks.yml instead. See https://docs.databricks.com/dev-tools/bundles/deployment-modes.
+  at resources.pipelines.bar.development
+  in databricks.yml:18:20
+
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dms-no-drift-[UNIQUE_NAME]/default/files...
+Updated pipelines.bar
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 1 unchanged
+
+>>> print_requests.py --dms //api/2.2/jobs //api/2.0/pipelines --sort
+{
+  "method": "POST",
+  "path": "/api/2.0/pipelines",
+  "body": {
+    "catalog": "main",
+    "channel": "CURRENT",
+    "deployment": {
+      "deployment_id": "[DEPLOYMENT_ID]",
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/dms-no-drift-[UNIQUE_NAME]/default/state/metadata.json",
+      "version_id": "1"
+    },
+    "edition": "ADVANCED",
+    "libraries": [
+      {
+        "file": {
+          "path": "/Workspace/Users/[USERNAME]/.bundle/dms-no-drift-[UNIQUE_NAME]/default/files/transform.py"
+        }
+      }
+    ],
+    "name": "bar-[UNIQUE_NAME]",
+    "schema": "default",
+    "serverless": true
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/create",
+  "body": {
+    "deployment": {
+      "deployment_id": "[DEPLOYMENT_ID]",
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/dms-no-drift-[UNIQUE_NAME]/default/state/metadata.json",
+      "version_id": "1"
+    },
+    "edit_mode": "UI_LOCKED",
+    "format": "MULTI_TASK",
+    "max_concurrent_runs": 1,
+    "name": "foo",
+    "queue": {
+      "enabled": true
+    }
+  }
+}
+{
+  "method": "PUT",
+  "path": "/api/2.0/pipelines/[UUID]",
+  "body": {
+    "catalog": "main",
+    "channel": "CURRENT",
+    "deployment": {
+      "deployment_id": "[DEPLOYMENT_ID]",
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/dms-no-drift-[UNIQUE_NAME]/default/state/metadata.json",
+      "version_id": "2"
+    },
+    "development": true,
+    "edition": "ADVANCED",
+    "libraries": [
+      {
+        "file": {
+          "path": "/Workspace/Users/[USERNAME]/.bundle/dms-no-drift-[UNIQUE_NAME]/default/files/transform.py"
+        }
+      }
+    ],
+    "name": "bar-[UNIQUE_NAME]",
+    "schema": "default",
+    "serverless": true
+  }
+}
+
+>>> MSYS_NO_PATHCONV=1 [CLI] bundle-deployments list-resources deployments/[DEPLOYMENT_ID] -o json
+[
+  {
+    "last_action_type": "OPERATION_ACTION_TYPE_CREATE",
+    "last_version_id": "1",
+    "resource_key": "jobs.foo"
+  },
+  {
+    "last_action_type": "OPERATION_ACTION_TYPE_UPDATE",
+    "last_version_id": "2",
+    "resource_key": "pipelines.bar"
+  }
+]
+
+>>> [CLI] bundle summary -o json
+Warning: The "development" property of pipelines is deprecated. Use "mode: development" in your databricks.yml instead. See https://docs.databricks.com/dev-tools/bundles/deployment-modes.
+  at resources.pipelines.bar.development
+  in databricks.yml:18:20
+
+{
+  "deployment_id": "[DEPLOYMENT_ID]",
+  "latest_version_id": 2
+}
+
+=== The plan shows the updated pipeline at serial 2 with the deployment_history feature
+>>> [CLI] bundle plan -o json
+Warning: The "development" property of pipelines is deprecated. Use "mode: development" in your databricks.yml instead. See https://docs.databricks.com/dev-tools/bundles/deployment-modes.
+  at resources.pipelines.bar.development
+  in databricks.yml:18:20
+
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 2,
+  "features": {
+    "deployment_history": {}
+  }
+}
+
+>>> [CLI] bundle plan
+Warning: The "development" property of pipelines is deprecated. Use "mode: development" in your databricks.yml instead. See https://docs.databricks.com/dev-tools/bundles/deployment-modes.
+  at resources.pipelines.bar.development
+  in databricks.yml:18:20
+
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
+
+=== The raw recorded state the service holds after the update
+>>> print_state.py --no-dms
+{
+ "state_version": 3,
+ "cli_version": "[CLI_VERSION]",
+ "lineage": "[UUID]",
+ "serial": 2,
+ "features": {
+  "deployment_history": {}
+ },
+ "state": {}
+}
+
+=== Plan again: no residual drift, and the version stamps are ignored
+>>> [CLI] bundle plan
+Warning: The "development" property of pipelines is deprecated. Use "mode: development" in your databricks.yml instead. See https://docs.databricks.com/dev-tools/bundles/deployment-modes.
+  at resources.pipelines.bar.development
+  in databricks.yml:18:20
+
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
diff --git a/acceptance/bundle/dms/no-drift/script b/acceptance/bundle/dms/no-drift/script
new file mode 100644
index 00000000000..66898d04cf9
--- /dev/null
+++ b/acceptance/bundle/dms/no-drift/script
@@ -0,0 +1,41 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+title "Deploy job foo and pipeline bar; both are recorded at version 1"
+trace $CLI bundle deploy
+
+deployment_id=$(MSYS_NO_PATHCONV=1 $CLI workspace get-status "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/dms-no-drift-${UNIQUE_NAME}/default/state/resources.deployment.json" | python3 -c 'import sys, json; print(json.load(sys.stdin)["object_id"])')
+add_repl "$deployment_id" DEPLOYMENT_ID
+trace MSYS_NO_PATHCONV=1 $CLI bundle-deployments list-resources "deployments/${deployment_id}" -o json | jq -S 'map({resource_key, last_version_id, last_action_type})'
+trace $CLI bundle summary -o json | jq '.bundle.deployment | {deployment_id, latest_version_id}'
+
+title "The plan is a no-op now and records the deployment_history feature"
+dms_plan
+
+title "The raw recorded state the service holds for this deployment"
+trace print_state.py --no-dms
+
+# Only deploy stamps deployment.deployment_id. Plan sees it in state but not in config,
+# so it must ignore it rather than report spurious changes.
+title "Plan without touching anything: the deployment stamp must not show as drift"
+trace $CLI bundle plan | contains.py "Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged"
+
+title "Update only the pipeline (not the job), then redeploy: only the pipeline's recorded version bumps to 2"
+trace update_file.py databricks.yml 'serverless: true' 'serverless: true
+      development: true'
+trace $CLI bundle deploy
+trace print_requests.py --dms //api/2.2/jobs //api/2.0/pipelines --sort
+trace MSYS_NO_PATHCONV=1 $CLI bundle-deployments list-resources "deployments/${deployment_id}" -o json | jq -S 'map({resource_key, last_version_id, last_action_type})'
+trace $CLI bundle summary -o json | jq '.bundle.deployment | {deployment_id, latest_version_id}'
+
+title "The plan shows the updated pipeline at serial 2 with the deployment_history feature"
+dms_plan
+
+title "The raw recorded state the service holds after the update"
+trace print_state.py --no-dms
+
+title "Plan again: no residual drift, and the version stamps are ignored"
+trace $CLI bundle plan | contains.py "Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged"
+
+# The list-resources and plan/state captures above record requests we do not assert on; drop them so
+# "$OUT_REQUESTS" does not become a nondeterministic golden.
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/dms/no-drift/transform.py b/acceptance/bundle/dms/no-drift/transform.py
new file mode 100644
index 00000000000..c07007592a6
--- /dev/null
+++ b/acceptance/bundle/dms/no-drift/transform.py
@@ -0,0 +1 @@
+# Minimal source so the pipeline has a library, which the API requires.
diff --git a/acceptance/bundle/dms/no-resources/databricks.yml.tmpl b/acceptance/bundle/dms/no-resources/databricks.yml.tmpl
new file mode 100644
index 00000000000..6b847711abd
--- /dev/null
+++ b/acceptance/bundle/dms/no-resources/databricks.yml.tmpl
@@ -0,0 +1,4 @@
+bundle:
+  name: dms-no-resources-$UNIQUE_NAME
+experimental:
+  deployment_history: true
diff --git a/acceptance/bundle/dms/no-resources/out.test.toml b/acceptance/bundle/dms/no-resources/out.test.toml
new file mode 100644
index 00000000000..84b22ba6735
--- /dev/null
+++ b/acceptance/bundle/dms/no-resources/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["true"]
diff --git a/acceptance/bundle/dms/no-resources/output.txt b/acceptance/bundle/dms/no-resources/output.txt
new file mode 100644
index 00000000000..884c22c6583
--- /dev/null
+++ b/acceptance/bundle/dms/no-resources/output.txt
@@ -0,0 +1,126 @@
+
+=== First deploy of a bundle with no resources: the deployment is created, and its workspace node identifies it even though no resource state was written
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dms-no-resources-[UNIQUE_NAME]/default/files...
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> deployment_history_telemetry
+deployment_history_enabled true
+
+>>> print_requests.py --dms //api/2.0/bundle --get
+{
+  "method": "POST",
+  "path": "/api/2.0/bundle/deployments",
+  "body": {
+    "display_name": "dms-no-resources-[UNIQUE_NAME]",
+    "initial_parent_path": "/Workspace/Users/[USERNAME]/.bundle/dms-no-resources-[UNIQUE_NAME]/default/state",
+    "target_name": "default",
+    "workspace_info": {
+      "file_path": "/Workspace/Users/[USERNAME]/.bundle/dms-no-resources-[UNIQUE_NAME]/default/files",
+      "root_path": "/Workspace/Users/[USERNAME]/.bundle/dms-no-resources-[UNIQUE_NAME]/default"
+    }
+  }
+}
+
+>>> MSYS_NO_PATHCONV=1 [CLI] workspace get-status /Workspace/Users/[USERNAME]/.bundle/dms-no-resources-[UNIQUE_NAME]/default/state/resources.deployment.json
+{
+  "object_type": "BUNDLE_DEPLOYMENT",
+  "path": "/Workspace/Users/[USERNAME]/.bundle/dms-no-resources-[UNIQUE_NAME]/default/state/resources.deployment.json"
+}
+
+=== The plan records the deployment_history feature
+>>> [CLI] bundle plan -o json
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "features": {
+    "deployment_history": {}
+  }
+}
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 0 unchanged
+
+=== The service lists no resources for the deployment
+>>> MSYS_NO_PATHCONV=1 [CLI] bundle-deployments list-resources deployments/[DEPLOYMENT_ID] -o json
+[]
+
+=== The raw recorded state the service holds for this deployment
+>>> print_state.py --no-dms
+{
+ "state_version": 3,
+ "cli_version": "[CLI_VERSION]",
+ "lineage": "[UUID]",
+ "features": {
+  "deployment_history": {}
+ },
+ "state": {}
+}
+
+=== Redeploy: the deployment is resolved from that node, so no second deployment is created
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dms-no-resources-[UNIQUE_NAME]/default/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py --dms //api/2.0/bundle --get
+{
+  "method": "GET",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/resources"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/resources"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/resources"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/resources"
+}
+
+=== The plan records the deployment_history feature
+>>> [CLI] bundle plan -o json
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "features": {
+    "deployment_history": {}
+  }
+}
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 0 unchanged
+
+=== The service still lists no resources
+>>> MSYS_NO_PATHCONV=1 [CLI] bundle-deployments list-resources deployments/[DEPLOYMENT_ID] -o json
+[]
+
+=== The raw recorded state after redeploy
+>>> print_state.py --no-dms
+{
+ "state_version": 3,
+ "cli_version": "[CLI_VERSION]",
+ "lineage": "[UUID]",
+ "features": {
+  "deployment_history": {}
+ },
+ "state": {}
+}
diff --git a/acceptance/bundle/dms/no-resources/script b/acceptance/bundle/dms/no-resources/script
new file mode 100644
index 00000000000..73c029962b9
--- /dev/null
+++ b/acceptance/bundle/dms/no-resources/script
@@ -0,0 +1,34 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+title "First deploy of a bundle with no resources: the deployment is created, and its workspace node identifies it even though no resource state was written"
+trace $CLI bundle deploy
+trace deployment_history_telemetry
+trace print_requests.py --dms //api/2.0/bundle --get
+trace MSYS_NO_PATHCONV=1 $CLI workspace get-status "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/dms-no-resources-${UNIQUE_NAME}/default/state/resources.deployment.json" | jq '{object_type,path}'
+
+title "The plan records the deployment_history feature"
+dms_plan
+
+title "The service lists no resources for the deployment"
+deployment_id=$(MSYS_NO_PATHCONV=1 $CLI workspace get-status "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/dms-no-resources-${UNIQUE_NAME}/default/state/resources.deployment.json" | python3 -c 'import sys, json; print(json.load(sys.stdin)["object_id"])')
+add_repl "$deployment_id" DEPLOYMENT_ID
+trace MSYS_NO_PATHCONV=1 $CLI bundle-deployments list-resources "deployments/${deployment_id}" -o json | jq -S 'map({resource_key, last_version_id, last_action_type})'
+
+title "The raw recorded state the service holds for this deployment"
+trace print_state.py --no-dms
+
+title "Redeploy: the deployment is resolved from that node, so no second deployment is created"
+trace $CLI bundle deploy
+trace print_requests.py --dms //api/2.0/bundle --get
+
+title "The plan records the deployment_history feature"
+dms_plan
+
+title "The service still lists no resources"
+deployment_id=$(MSYS_NO_PATHCONV=1 $CLI workspace get-status "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/dms-no-resources-${UNIQUE_NAME}/default/state/resources.deployment.json" | python3 -c 'import sys, json; print(json.load(sys.stdin)["object_id"])')
+trace MSYS_NO_PATHCONV=1 $CLI bundle-deployments list-resources "deployments/${deployment_id}" -o json | jq -S 'map({resource_key, last_version_id, last_action_type})'
+
+title "The raw recorded state after redeploy"
+trace print_state.py --no-dms
+
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/dms/operation-upload-fails-once/databricks.yml.tmpl b/acceptance/bundle/dms/operation-upload-fails-once/databricks.yml.tmpl
new file mode 100644
index 00000000000..f878a82cbcd
--- /dev/null
+++ b/acceptance/bundle/dms/operation-upload-fails-once/databricks.yml.tmpl
@@ -0,0 +1,11 @@
+bundle:
+  name: dms-upload-fails-once-$UNIQUE_NAME
+experimental:
+  deployment_history: true
+
+resources:
+  schemas:
+    foo:
+      name: dms_upload_fails_once_schema_$UNIQUE_NAME
+      catalog_name: main
+      comment: v1
diff --git a/acceptance/bundle/dms/operation-upload-fails-once/out.test.toml b/acceptance/bundle/dms/operation-upload-fails-once/out.test.toml
new file mode 100644
index 00000000000..88e6fbd847c
--- /dev/null
+++ b/acceptance/bundle/dms/operation-upload-fails-once/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["true"]
diff --git a/acceptance/bundle/dms/operation-upload-fails-once/output.txt b/acceptance/bundle/dms/operation-upload-fails-once/output.txt
new file mode 100644
index 00000000000..dc976dadead
--- /dev/null
+++ b/acceptance/bundle/dms/operation-upload-fails-once/output.txt
@@ -0,0 +1,141 @@
+
+=== Deploy so there is a recorded resource to recreate
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dms-upload-fails-once-[UNIQUE_NAME]/default/files...
+Created schemas.foo
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== The plan records the deployment_history feature and the schema
+>>> [CLI] bundle plan -o json
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "features": {
+    "deployment_history": {}
+  }
+}
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+=== The service lists the schema at version 1
+>>> MSYS_NO_PATHCONV=1 [CLI] bundle-deployments list-resources deployments/[DEPLOYMENT_ID] -o json
+[
+  {
+    "last_action_type": "OPERATION_ACTION_TYPE_CREATE",
+    "last_version_id": "1",
+    "resource_key": "schemas.foo"
+  }
+]
+
+=== The raw recorded state after deploy
+>>> print_state.py --no-dms
+{
+ "state_version": 3,
+ "cli_version": "[CLI_VERSION]",
+ "lineage": "[UUID]",
+ "serial": 1,
+ "features": {
+  "deployment_history": {}
+ },
+ "state": {}
+}
+
+=== A recreate records twice, and the first one fails: the second must still carry the sequence id staging left, because a rejected update earned no new one
+>>> fault.py PATCH /api/2.0/bundle/* 500 0 1
+
+>>> update_file.py databricks.yml catalog_name: main catalog_name: dms_other_[UNIQUE_NAME]
+
+>>> musterr [CLI] bundle deploy --auto-approve
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dms-upload-fails-once-[UNIQUE_NAME]/default/files...
+
+This action will result in the deletion or recreation of the following UC schemas. Any underlying data may be lost:
+  recreate resources.schemas.foo
+Recreated schemas.foo
+Error: recording operation for resources.schemas.foo: Fault injected by test. (500 INJECTED)
+
+Endpoint: PATCH [DATABRICKS_URL]/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/2/operations/schemas.foo?update_mask=state%2Cerror_message%2Cstatus
+HTTP Status: 500 Internal Server Error
+API error_code: INJECTED
+API message: Fault injected by test.
+
+Files: 2 uploaded, 0 deleted
+
+=== The service lists the schema with the failure
+>>> MSYS_NO_PATHCONV=1 [CLI] bundle-deployments list-resources deployments/[DEPLOYMENT_ID] -o json
+[
+  {
+    "last_action_type": "OPERATION_ACTION_TYPE_RECREATE",
+    "last_version_id": "2",
+    "resource_key": "schemas.foo"
+  }
+]
+
+=== The raw recorded state after the failure
+>>> print_state.py --no-dms
+{
+ "state_version": 3,
+ "cli_version": "[CLI_VERSION]",
+ "lineage": "[UUID]",
+ "serial": 2,
+ "features": {
+  "deployment_history": {}
+ },
+ "state": {}
+}
+
+>>> print_requests.py --dms //api/2.0/bundle
+{
+  "method": "POST",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions",
+  "q": {
+    "version_id": "2"
+  },
+  "body": {
+    "cli_version": "[CLI_VERSION]",
+    "operations": [
+      {
+        "action_type": "OPERATION_ACTION_TYPE_RECREATE",
+        "resource_key": "schemas.foo"
+      }
+    ],
+    "previous_version_id": "1",
+    "version_type": "VERSION_TYPE_DEPLOY"
+  }
+}
+{
+  "method": "PATCH",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/2/operations/schemas.foo",
+  "q": {
+    "update_mask": "state,error_message,status"
+  },
+  "body": {
+    "error_message": "",
+    "sequence_id": 0,
+    "status": "OPERATION_STATUS_PENDING"
+  }
+}
+{
+  "method": "PATCH",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/2/operations/schemas.foo",
+  "q": {
+    "update_mask": "state,error_message,resource_id,status"
+  },
+  "body": {
+    "error_message": "",
+    "resource_id": "dms_other_[UNIQUE_NAME].dms_upload_fails_once_schema_[UNIQUE_NAME]",
+    "sequence_id": 0,
+    "state": "{\"state\":{\"catalog_name\":\"dms_other_[UNIQUE_NAME]\",\"comment\":\"v1\",\"name\":\"dms_upload_fails_once_schema_[UNIQUE_NAME]\"}}",
+    "status": "OPERATION_STATUS_SUCCEEDED"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/2/complete",
+  "body": {
+    "completion_reason": "VERSION_COMPLETE_FAILURE"
+  }
+}
diff --git a/acceptance/bundle/dms/operation-upload-fails-once/script b/acceptance/bundle/dms/operation-upload-fails-once/script
new file mode 100644
index 00000000000..2b539134571
--- /dev/null
+++ b/acceptance/bundle/dms/operation-upload-fails-once/script
@@ -0,0 +1,34 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+title "Deploy so there is a recorded resource to recreate"
+trace $CLI bundle deploy
+rm -f "$OUT_REQUESTS"
+
+title "The plan records the deployment_history feature and the schema"
+dms_plan
+
+title "The service lists the schema at version 1"
+deployment_id=$(MSYS_NO_PATHCONV=1 $CLI workspace get-status "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/dms-upload-fails-once-${UNIQUE_NAME}/default/state/resources.deployment.json" | python3 -c 'import sys, json; print(json.load(sys.stdin)["object_id"])')
+add_repl "$deployment_id" DEPLOYMENT_ID
+trace MSYS_NO_PATHCONV=1 $CLI bundle-deployments list-resources "deployments/${deployment_id}" -o json | jq -S 'map({resource_key, last_version_id, last_action_type})'
+
+title "The raw recorded state after deploy"
+trace print_state.py --no-dms
+
+title "A recreate records twice, and the first one fails: the second must still carry the sequence id staging left, because a rejected update earned no new one"
+trace fault.py "PATCH /api/2.0/bundle/*" 500 0 1
+# Unity Catalog has no catalog called "other", so make one to move the schema into.
+other_catalog="dms_other_${UNIQUE_NAME}"
+$CLI catalogs create "$other_catalog" &> LOG.catalog
+trap '$CLI catalogs delete "$other_catalog" --force >> LOG.catalog 2>&1' EXIT
+trace update_file.py databricks.yml "catalog_name: main" "catalog_name: ${other_catalog}"
+trace musterr $CLI bundle deploy --auto-approve
+
+title "The service lists the schema with the failure"
+deployment_id=$(MSYS_NO_PATHCONV=1 $CLI workspace get-status "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/dms-upload-fails-once-${UNIQUE_NAME}/default/state/resources.deployment.json" | python3 -c 'import sys, json; print(json.load(sys.stdin)["object_id"])')
+trace MSYS_NO_PATHCONV=1 $CLI bundle-deployments list-resources "deployments/${deployment_id}" -o json | jq -S 'map({resource_key, last_version_id, last_action_type})'
+
+title "The raw recorded state after the failure"
+trace print_state.py --no-dms
+
+trace print_requests.py --dms //api/2.0/bundle
diff --git a/acceptance/bundle/dms/operation-upload-fails-once/test.toml b/acceptance/bundle/dms/operation-upload-fails-once/test.toml
new file mode 100644
index 00000000000..5baa9c9d923
--- /dev/null
+++ b/acceptance/bundle/dms/operation-upload-fails-once/test.toml
@@ -0,0 +1,3 @@
+# Local only: this case needs an injected failure - DMS itself must reject the operation upload, once - and fault.py registers
+# its rule on the fake, which a cloud run does not have.
+Cloud = false
diff --git a/acceptance/bundle/dms/plan-without-dms/databricks.yml.tmpl b/acceptance/bundle/dms/plan-without-dms/databricks.yml.tmpl
new file mode 100644
index 00000000000..729dff8f90a
--- /dev/null
+++ b/acceptance/bundle/dms/plan-without-dms/databricks.yml.tmpl
@@ -0,0 +1,7 @@
+bundle:
+  name: dms-plan-without-$UNIQUE_NAME
+
+resources:
+  jobs:
+    foo:
+      name: foo
diff --git a/acceptance/bundle/dms/plan-without-dms/out.test.toml b/acceptance/bundle/dms/plan-without-dms/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/dms/plan-without-dms/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/dms/plan-without-dms/output.txt b/acceptance/bundle/dms/plan-without-dms/output.txt
new file mode 100644
index 00000000000..ce1135f624d
--- /dev/null
+++ b/acceptance/bundle/dms/plan-without-dms/output.txt
@@ -0,0 +1,13 @@
+
+=== Generate and save plan WITHOUT DMS recording
+>>> jq {features}
+{
+  "features": null
+}
+
+=== Enable DMS recording and try to deploy the non-DMS plan
+>>> musterr [CLI] bundle deploy --plan tmp.plan.json
+Error: this plan was created for a different set of state features than the target now has; run 'bundle plan' again
+
+
+>>> print_requests.py //api/2.0/bundle --get
diff --git a/acceptance/bundle/dms/plan-without-dms/script b/acceptance/bundle/dms/plan-without-dms/script
new file mode 100644
index 00000000000..de35616b74e
--- /dev/null
+++ b/acceptance/bundle/dms/plan-without-dms/script
@@ -0,0 +1,15 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+title "Generate and save plan WITHOUT DMS recording"
+$CLI bundle plan -o json > tmp.plan.json
+trace jq '{features}' < tmp.plan.json
+
+title "Enable DMS recording and try to deploy the non-DMS plan"
+update_file.py databricks.yml 'bundle:' 'experimental:
+  deployment_history: true
+
+bundle:'
+trace musterr $CLI bundle deploy --plan tmp.plan.json
+trace print_requests.py //api/2.0/bundle --get
+
+rm -f tmp.plan.json "$OUT_REQUESTS"
diff --git a/acceptance/bundle/dms/plan-without-dms/test.toml b/acceptance/bundle/dms/plan-without-dms/test.toml
new file mode 100644
index 00000000000..d80809d201b
--- /dev/null
+++ b/acceptance/bundle/dms/plan-without-dms/test.toml
@@ -0,0 +1,4 @@
+Cloud = false
+RecordRequests = true
+# Override inherited DMS matrix to disable it for the initial plan generation
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/dms/provenance/databricks.yml.tmpl b/acceptance/bundle/dms/provenance/databricks.yml.tmpl
new file mode 100644
index 00000000000..49c989275ad
--- /dev/null
+++ b/acceptance/bundle/dms/provenance/databricks.yml.tmpl
@@ -0,0 +1,14 @@
+bundle:
+  name: dms-provenance-$UNIQUE_NAME
+experimental:
+  deployment_history: true
+
+targets:
+  dev:
+    default: true
+    mode: development
+
+resources:
+  jobs:
+    foo:
+      name: foo
diff --git a/acceptance/bundle/dms/provenance/out.test.toml b/acceptance/bundle/dms/provenance/out.test.toml
new file mode 100644
index 00000000000..84b22ba6735
--- /dev/null
+++ b/acceptance/bundle/dms/provenance/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["true"]
diff --git a/acceptance/bundle/dms/provenance/output.txt b/acceptance/bundle/dms/provenance/output.txt
new file mode 100644
index 00000000000..4decd10218b
--- /dev/null
+++ b/acceptance/bundle/dms/provenance/output.txt
@@ -0,0 +1,106 @@
+
+=== Deploying from a git repo records where the source came from: the version carries git_info, workspace_info and the target's deployment_mode
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dms-provenance-[UNIQUE_NAME]/dev/files...
+Created jobs.foo
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py --dms //versions
+{
+  "method": "POST",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions",
+  "q": {
+    "version_id": "1"
+  },
+  "body": {
+    "cli_version": "[CLI_VERSION]",
+    "git_info": {
+      "branch": "main",
+      "commit": "[COMMIT]",
+      "origin_url": "https://github.com/databricks/bundle-examples.git"
+    },
+    "operations": [
+      {
+        "action_type": "OPERATION_ACTION_TYPE_CREATE",
+        "resource_key": "jobs.foo"
+      }
+    ],
+    "version_type": "VERSION_TYPE_DEPLOY"
+  }
+}
+{
+  "method": "PATCH",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/1/operations/jobs.foo",
+  "q": {
+    "update_mask": "state,error_message,resource_id,status"
+  },
+  "body": {
+    "error_message": "",
+    "resource_id": "[FOO_ID]",
+    "sequence_id": 0,
+    "state": "{\"state\":{\"deployment\":{\"deployment_id\":\"[DEPLOYMENT_ID]\",\"kind\":\"BUNDLE\",\"metadata_file_path\":\"/Workspace/Users/[USERNAME]/.bundle/dms-provenance-[UNIQUE_NAME]/dev/state/metadata.json\",\"version_id\":\"1\"},\"edit_mode\":\"UI_LOCKED\",\"format\":\"MULTI_TASK\",\"max_concurrent_runs\":4,\"name\":\"[dev [USERNAME]] foo\",\"queue\":{\"enabled\":true},\"tags\":{\"dev\":\"[USERNAME]\"}}}",
+    "status": "OPERATION_STATUS_SUCCEEDED"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/1/complete",
+  "body": {
+    "completion_reason": "VERSION_COMPLETE_SUCCESS"
+  }
+}
+
+=== The plan is a no-op and records the deployment_history feature
+>>> [CLI] bundle plan -o json
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "features": {
+    "deployment_history": {}
+  }
+}
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+=== The service denormalizes them onto the deployment, so a reader gets the provenance of the latest version
+>>> MSYS_NO_PATHCONV=1 [CLI] api get /api/2.0/bundle/deployments/[DEPLOYMENT_ID]
+{
+  "target_name": "dev",
+  "deployment_mode": "DEPLOYMENT_MODE_DEVELOPMENT",
+  "git_info": {
+    "origin_url": "https://github.com/databricks/bundle-examples.git",
+    "branch": "main",
+    "commit": "[COMMIT]"
+  },
+  "workspace_info": {
+    "root_path": "/Workspace/Users/[USERNAME]/.bundle/dms-provenance-[UNIQUE_NAME]/dev",
+    "file_path": "/Workspace/Users/[USERNAME]/.bundle/dms-provenance-[UNIQUE_NAME]/dev/files"
+  }
+}
+
+=== The service lists the deployed job
+>>> MSYS_NO_PATHCONV=1 [CLI] bundle-deployments list-resources deployments/[DEPLOYMENT_ID] -o json
+[
+  {
+    "last_action_type": "OPERATION_ACTION_TYPE_CREATE",
+    "last_version_id": "1",
+    "resource_key": "jobs.foo"
+  }
+]
+
+=== The raw recorded state the service holds for this deployment
+>>> print_state.py --no-dms -t dev
+{
+ "state_version": 3,
+ "cli_version": "[CLI_VERSION]",
+ "lineage": "[UUID]",
+ "serial": 1,
+ "features": {
+  "deployment_history": {}
+ },
+ "state": {}
+}
diff --git a/acceptance/bundle/dms/provenance/script b/acceptance/bundle/dms/provenance/script
new file mode 100644
index 00000000000..8c15c861e19
--- /dev/null
+++ b/acceptance/bundle/dms/provenance/script
@@ -0,0 +1,30 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+title "Deploying from a git repo records where the source came from: the version carries git_info, workspace_info and the target's deployment_mode"
+git-repo-init
+git remote add origin https://github.com/databricks/bundle-examples.git
+trace $CLI bundle deploy
+# The commit SHA changes every run, so assert it is a 40-char hex string and drop it.
+add_repl.py "$(git rev-parse HEAD)" COMMIT
+replace_ids.py -t dev
+trace print_requests.py --dms //versions
+
+title "The plan is a no-op and records the deployment_history feature"
+dms_plan
+
+title "The service denormalizes them onto the deployment, so a reader gets the provenance of the latest version"
+deployment_id=$(MSYS_NO_PATHCONV=1 $CLI workspace get-status "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/dms-provenance-${UNIQUE_NAME}/dev/state/resources.deployment.json" -o json | python3 -c 'import sys,json; print(json.load(sys.stdin)["object_id"])')
+add_repl "$deployment_id" DEPLOYMENT_ID
+# MSYS_NO_PATHCONV as above: Git Bash on Windows would rewrite the leading-'/' API
+# path into C:/Program Files/Git/api/2.0/... before the CLI saw it.
+trace MSYS_NO_PATHCONV=1 $CLI api get "/api/2.0/bundle/deployments/${deployment_id}" | jq '{target_name, deployment_mode, git_info, workspace_info}'
+
+title "The service lists the deployed job"
+trace MSYS_NO_PATHCONV=1 $CLI bundle-deployments list-resources "deployments/${deployment_id}" -o json | jq -S 'map({resource_key, last_version_id, last_action_type})'
+
+title "The raw recorded state the service holds for this deployment"
+trace print_state.py --no-dms -t dev
+
+# The deploy uploads files in a nondeterministic order; only the requests above are
+# asserted.
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/dms/provenance/test.toml b/acceptance/bundle/dms/provenance/test.toml
new file mode 100644
index 00000000000..0a47bfb1b91
--- /dev/null
+++ b/acceptance/bundle/dms/provenance/test.toml
@@ -0,0 +1,4 @@
+# git-repo-init creates a repo in the test directory so the deploy has git provenance.
+Ignore = [
+    '.git',
+]
diff --git a/acceptance/bundle/dms/record-failure/databricks.yml.tmpl b/acceptance/bundle/dms/record-failure/databricks.yml.tmpl
new file mode 100644
index 00000000000..d9c8a7928c2
--- /dev/null
+++ b/acceptance/bundle/dms/record-failure/databricks.yml.tmpl
@@ -0,0 +1,17 @@
+bundle:
+  name: dms-record-failure-$UNIQUE_NAME
+experimental:
+  deployment_history: true
+
+resources:
+  jobs:
+    doomed:
+      name: doomed
+      tasks:
+        - task_key: doomed
+          new_cluster:
+            node_type_id: nonexistent-node-type
+            spark_version: 15.4.x-scala2.12
+            num_workers: 1
+          notebook_task:
+            notebook_path: /nonexistent
diff --git a/acceptance/bundle/dms/record-failure/out.test.toml b/acceptance/bundle/dms/record-failure/out.test.toml
new file mode 100644
index 00000000000..84b22ba6735
--- /dev/null
+++ b/acceptance/bundle/dms/record-failure/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["true"]
diff --git a/acceptance/bundle/dms/record-failure/output.txt b/acceptance/bundle/dms/record-failure/output.txt
new file mode 100644
index 00000000000..9f61f4a9274
--- /dev/null
+++ b/acceptance/bundle/dms/record-failure/output.txt
@@ -0,0 +1,104 @@
+
+=== A resource that fails to apply is recorded as a failed operation carrying the error, so the deployment history says why rather than omitting the resource
+>>> musterr [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dms-record-failure-[UNIQUE_NAME]/default/files...
+Error: cannot create resources.jobs.doomed: Node type nonexistent-node-type is not supported. Supported node types: [NODE_TYPES] (400 INVALID_PARAMETER_VALUE)
+
+Endpoint: POST [DATABRICKS_URL]/api/2.2/jobs/create
+HTTP Status: 400 Bad Request
+API error_code: INVALID_PARAMETER_VALUE
+API message: Node type nonexistent-node-type is not supported. Supported node types: [NODE_TYPES]
+
+Files: 2 uploaded, 0 deleted
+
+>>> [CLI] bundle plan -o json
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "features": {
+    "deployment_history": {}
+  }
+}
+
+>>> [CLI] bundle plan
+create jobs.doomed
+
+Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
+
+>>> print_requests.py --dms //api/2.0/bundle
+{
+  "method": "POST",
+  "path": "/api/2.0/bundle/deployments",
+  "body": {
+    "display_name": "dms-record-failure-[UNIQUE_NAME]",
+    "initial_parent_path": "/Workspace/Users/[USERNAME]/.bundle/dms-record-failure-[UNIQUE_NAME]/default/state",
+    "target_name": "default",
+    "workspace_info": {
+      "file_path": "/Workspace/Users/[USERNAME]/.bundle/dms-record-failure-[UNIQUE_NAME]/default/files",
+      "root_path": "/Workspace/Users/[USERNAME]/.bundle/dms-record-failure-[UNIQUE_NAME]/default"
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions",
+  "q": {
+    "version_id": "1"
+  },
+  "body": {
+    "cli_version": "[CLI_VERSION]",
+    "operations": [
+      {
+        "action_type": "OPERATION_ACTION_TYPE_CREATE",
+        "resource_key": "jobs.doomed"
+      }
+    ],
+    "version_type": "VERSION_TYPE_DEPLOY"
+  }
+}
+{
+  "method": "PATCH",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/1/operations/jobs.doomed",
+  "q": {
+    "update_mask": "error_message,status"
+  },
+  "body": {
+    "error_message": "Node type nonexistent-node-type is not supported. Supported node types: [NODE_TYPES] (400 INVALID_PARAMETER_VALUE)",
+    "sequence_id": 0,
+    "status": "OPERATION_STATUS_FAILED"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/1/complete",
+  "body": {
+    "completion_reason": "VERSION_COMPLETE_FAILURE"
+  }
+}
+
+=== The failed resource is not listed at all: state is what projects a resource, and a failed create records none, so a later deploy plans to create it rather than treating it as already deployed
+>>> MSYS_NO_PATHCONV=1 [CLI] api get /api/2.0/bundle/deployments/[DEPLOYMENT_ID]/resources
+{}
+
+>>> MSYS_NO_PATHCONV=1 [CLI] bundle-deployments list-resources deployments/[DEPLOYMENT_ID] -o json
+[]
+
+>>> print_state.py --no-dms
+{
+ "state_version": 3,
+ "cli_version": "[CLI_VERSION]",
+ "lineage": "[UUID]",
+ "serial": 1,
+ "features": {
+  "deployment_history": {}
+ },
+ "state": {}
+}
+
+=== Redeploying from DMS state alone still creates the failed resource: it was never applied, so it must not be skipped as unchanged
+>>> [CLI] bundle plan
+create jobs.doomed
+
+Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
diff --git a/acceptance/bundle/dms/record-failure/script b/acceptance/bundle/dms/record-failure/script
new file mode 100644
index 00000000000..806e7ab8b15
--- /dev/null
+++ b/acceptance/bundle/dms/record-failure/script
@@ -0,0 +1,26 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+title "A resource that fails to apply is recorded as a failed operation carrying the error, so the deployment history says why rather than omitting the resource"
+trace musterr $CLI bundle deploy
+dms_plan
+trace print_requests.py --dms //api/2.0/bundle
+
+title "The failed resource is not listed at all: state is what projects a resource, and a failed create records none, so a later deploy plans to create it rather than treating it as already deployed"
+# The deployment ID is the workspace node's ID; read it back the way the CLI does.
+# Extracted with python, not jq: the ID exceeds 2^53 and jq 1.6 rounds it.
+deployment_id=$(MSYS_NO_PATHCONV=1 $CLI workspace get-status "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/dms-record-failure-${UNIQUE_NAME}/default/state/resources.deployment.json" -o json | python3 -c 'import sys,json; print(json.load(sys.stdin)["object_id"])')
+add_repl "$deployment_id" DEPLOYMENT_ID
+# MSYS_NO_PATHCONV as above: Git Bash on Windows would rewrite the leading-'/' API
+# path into C:/Program Files/Git/api/2.0/... before the CLI saw it.
+trace MSYS_NO_PATHCONV=1 $CLI api get "/api/2.0/bundle/deployments/${deployment_id}/resources"
+
+trace MSYS_NO_PATHCONV=1 $CLI bundle-deployments list-resources "deployments/${deployment_id}" -o json | jq -S 'map({resource_key, last_version_id, last_action_type})'
+
+trace print_state.py --no-dms
+
+title "Redeploying from DMS state alone still creates the failed resource: it was never applied, so it must not be skipped as unchanged"
+rm -rf .databricks
+trace $CLI bundle plan
+# plan probes the state files concurrently, so the recorded order varies. Only the
+# operations above are asserted; drop the rest rather than diff a racy order.
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/dms/record-failure/test.toml b/acceptance/bundle/dms/record-failure/test.toml
new file mode 100644
index 00000000000..49f63c399ac
--- /dev/null
+++ b/acceptance/bundle/dms/record-failure/test.toml
@@ -0,0 +1,14 @@
+# The job's cluster names a node type that does not exist, so the create fails for real: on cloud
+# the Jobs API rejects it. The local fake is lax and would accept it, so this one test stubs the
+# create to return the same error - scoped here, not the shared fake, so no other test is affected.
+Cloud = true
+
+# The Jobs API error lists every supported node type, and the set grows over time; mask it.
+[[Repls]]
+Old = 'Supported node types: [^(\n]*[^ (\n]'
+New = 'Supported node types: [NODE_TYPES]'
+
+[[Server]]
+Pattern = "POST /api/2.2/jobs/create"
+Response.StatusCode = 400
+Response.Body = '''{"error_code": "INVALID_PARAMETER_VALUE", "message": "Node type nonexistent-node-type is not supported. Supported node types: r3.xlarge, m5.large"}'''
diff --git a/acceptance/bundle/dms/script.prepare b/acceptance/bundle/dms/script.prepare
new file mode 100644
index 00000000000..c67f63ef8e0
--- /dev/null
+++ b/acceptance/bundle/dms/script.prepare
@@ -0,0 +1,13 @@
+# dms_plan prints the plan's header only (via jq del(.plan)), then the readable plan.
+# The per-resource plan body carries remote_state that diverges between the fake and a
+# real workspace, so the recording tests assert the header fields (cli_version, lineage,
+# serial, deployment_id, next/last_version_id, features) and the human-readable
+# summary instead of the full JSON. Pass through any flags, e.g. `dms_plan -t prod`.
+dms_plan() {
+    trace $CLI bundle plan "$@" -o json | jq 'del(.plan)'
+    trace $CLI bundle plan "$@"
+}
+
+deployment_history_telemetry() {
+    jq -r 'select(.path? == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log.bundle_deploy_event.experimental.bool_values[] | select(.key == "deployment_history_enabled") | "\(.key) \(.value)"' "$OUT_REQUESTS"
+}
diff --git a/acceptance/bundle/dms/stale-local-state/databricks.yml.tmpl b/acceptance/bundle/dms/stale-local-state/databricks.yml.tmpl
new file mode 100644
index 00000000000..a9b1eada1f9
--- /dev/null
+++ b/acceptance/bundle/dms/stale-local-state/databricks.yml.tmpl
@@ -0,0 +1,10 @@
+bundle:
+  name: dms-stale-local-state-$UNIQUE_NAME
+
+experimental:
+  deployment_history: true
+
+resources:
+  jobs:
+    foo:
+      name: foo
diff --git a/acceptance/bundle/dms/stale-local-state/out.test.toml b/acceptance/bundle/dms/stale-local-state/out.test.toml
new file mode 100644
index 00000000000..f68b4a89c36
--- /dev/null
+++ b/acceptance/bundle/dms/stale-local-state/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/dms/stale-local-state/output.txt b/acceptance/bundle/dms/stale-local-state/output.txt
new file mode 100644
index 00000000000..5c2b2225a84
--- /dev/null
+++ b/acceptance/bundle/dms/stale-local-state/output.txt
@@ -0,0 +1,38 @@
+
+=== Setup (LOG.setup): reconstruct full version 1 without a history marker, then deploy version 2
+>>> jq -c {serial, features} .databricks/resources.v1.json
+{"serial":1,"features":null}
+
+>>> jq -c {serial, features} .databricks/resources.v2.json
+{"serial":2,"features":{"deployment_history":{}}}
+
+=== Local recorded serial 3 ahead of DMS version 2 is rejected
+>>> update_file.py .databricks/bundle/default/resources.json "serial": 2 "serial": 3
+
+>>> musterr [CLI] bundle deploy
+Error: inconsistent deployment state: resource state serial (3) is ahead of deployment history version (2)
+
+
+=== 1. Config false and env false: newer remote state replaces the local copy and reads DMS
+>>> cp .databricks/resources.v1.json .databricks/bundle/default/resources.json
+
+>>> DATABRICKS_BUNDLE_DEPLOYMENT_HISTORY=false [CLI] bundle summary --force-pull -o json
+Warn: Deployment history setting (false) does not match the existing state (true). Using the existing state.
+{"job_id":"[FOO_ID]"}
+
+>>> cmp .databricks/resources.v2.json .databricks/bundle/default/resources.json
+
+>>> print_requests.py --dms //resources --get --oneline
+{"method": "GET", "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/resources"}
+
+=== 2. Config removed and env false: restore the same snapshot, then read remote DMS state
+>>> cp .databricks/resources.v1.json .databricks/bundle/default/resources.json
+
+>>> DATABRICKS_BUNDLE_DEPLOYMENT_HISTORY=false [CLI] bundle summary --force-pull -o json
+Warn: Deployment history setting (false) does not match the existing state (true). Using the existing state.
+{"job_id":"[FOO_ID]"}
+
+>>> cmp .databricks/resources.v2.json .databricks/bundle/default/resources.json
+
+>>> print_requests.py --dms //resources --get --oneline
+{"method": "GET", "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/resources"}
diff --git a/acceptance/bundle/dms/stale-local-state/script b/acceptance/bundle/dms/stale-local-state/script
new file mode 100644
index 00000000000..38d0a3725b4
--- /dev/null
+++ b/acceptance/bundle/dms/stale-local-state/script
@@ -0,0 +1,38 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+title "Setup (LOG.setup): reconstruct full version 1 without a history marker, then deploy version 2"
+{
+    $CLI bundle deploy
+    DATABRICKS_BUNDLE_DEPLOYMENT_HISTORY=true print_state.py > .databricks/resources.v1.json
+    DATABRICKS_BUNDLE_DEPLOYMENT_HISTORY=true replace_ids.py
+    update_file.py databricks.yml 'name: foo' 'name: updated'
+    $CLI bundle deploy
+    cp .databricks/bundle/default/resources.json .databricks/resources.v2.json
+    deployment_id=$(MSYS_NO_PATHCONV=1 $CLI workspace get-status "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/dms-stale-local-state-${UNIQUE_NAME}/default/state/resources.deployment.json" -o json | jq -r '.object_id')
+    add_repl "$deployment_id" DEPLOYMENT_ID
+} &> LOG.setup
+trace jq -c '{serial, features}' .databricks/resources.v1.json
+trace jq -c '{serial, features}' .databricks/resources.v2.json
+
+title "Local recorded serial 3 ahead of DMS version 2 is rejected"
+trace update_file.py .databricks/bundle/default/resources.json '"serial": 2' '"serial": 3'
+trace musterr $CLI bundle deploy
+
+rm -f "$OUT_REQUESTS"
+
+title "1. Config false and env false: newer remote state replaces the local copy and reads DMS"
+update_file.py databricks.yml 'deployment_history: true' 'deployment_history: false'
+trace cp .databricks/resources.v1.json .databricks/bundle/default/resources.json
+trace DATABRICKS_BUNDLE_DEPLOYMENT_HISTORY=false $CLI bundle summary --force-pull -o json | jq -c '{job_id: .resources.jobs.foo.id}'
+trace cmp .databricks/resources.v2.json .databricks/bundle/default/resources.json
+trace print_requests.py --dms //resources --get --oneline
+
+title "2. Config removed and env false: restore the same snapshot, then read remote DMS state"
+update_file.py databricks.yml $'experimental:\n  deployment_history: false\n\n' ''
+trace cp .databricks/resources.v1.json .databricks/bundle/default/resources.json
+trace DATABRICKS_BUNDLE_DEPLOYMENT_HISTORY=false $CLI bundle summary --force-pull -o json | jq -c '{job_id: .resources.jobs.foo.id}'
+trace cmp .databricks/resources.v2.json .databricks/bundle/default/resources.json
+trace print_requests.py --dms //resources --get --oneline
+
+DATABRICKS_BUNDLE_DEPLOYMENT_HISTORY=true $CLI bundle destroy --auto-approve &> LOG.cleanup
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/dms/stale-local-state/test.toml b/acceptance/bundle/dms/stale-local-state/test.toml
new file mode 100644
index 00000000000..fa9adf06e5f
--- /dev/null
+++ b/acceptance/bundle/dms/stale-local-state/test.toml
@@ -0,0 +1 @@
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/dms/stale-plan/databricks.yml.tmpl b/acceptance/bundle/dms/stale-plan/databricks.yml.tmpl
new file mode 100644
index 00000000000..fc5e5d7028b
--- /dev/null
+++ b/acceptance/bundle/dms/stale-plan/databricks.yml.tmpl
@@ -0,0 +1,9 @@
+bundle:
+  name: dms-stale-plan-$UNIQUE_NAME
+experimental:
+  deployment_history: true
+
+resources:
+  jobs:
+    foo:
+      name: foo
diff --git a/acceptance/bundle/dms/stale-plan/out.test.toml b/acceptance/bundle/dms/stale-plan/out.test.toml
new file mode 100644
index 00000000000..ef2679cdd20
--- /dev/null
+++ b/acceptance/bundle/dms/stale-plan/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = true
+EnvMatrix.DMS = ["true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/dms/stale-plan/output.txt b/acceptance/bundle/dms/stale-plan/output.txt
new file mode 100644
index 00000000000..e9fbc70f832
--- /dev/null
+++ b/acceptance/bundle/dms/stale-plan/output.txt
@@ -0,0 +1,83 @@
+
+=== Save a plan, then deploy it: records version 1
+>>> [CLI] bundle plan -o json
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "features": {
+    "deployment_history": {}
+  }
+}
+
+>>> [CLI] bundle plan
+create jobs.foo
+
+Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dms-stale-plan-[UNIQUE_NAME]/default/files...
+Created jobs.foo
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> MSYS_NO_PATHCONV=1 [CLI] bundle-deployments list-resources deployments/[DEPLOYMENT_ID] -o json
+[
+  {
+    "last_action_type": "OPERATION_ACTION_TYPE_CREATE",
+    "last_version_id": "1",
+    "resource_key": "jobs.foo"
+  }
+]
+
+=== The raw recorded state the service holds for this deployment
+>>> print_state.py --no-dms
+{
+ "state_version": 3,
+ "cli_version": "[CLI_VERSION]",
+ "lineage": "[UUID]",
+ "serial": 1,
+ "features": {
+  "deployment_history": {}
+ },
+ "state": {}
+}
+
+=== A saved plan carries the version it was built against
+>>> [CLI] bundle plan -o json
+{
+  "serial": 1
+}
+
+=== Replay: re-deploying the same plan is rejected - it predates the recorded version
+>>> musterr [CLI] bundle deploy --plan tmp.plan.json
+Error: plan lineage "" does not match state lineage "[UUID]"; the state may have been modified by another process
+
+
+=== Only the first deploy recorded a version; the rejected replay created none
+>>> print_requests.py --dms //api/2.0/bundle --oneline
+{"method": "POST", "path": "/api/2.0/bundle/deployments", "body": {"display_name": "dms-stale-plan-[UNIQUE_NAME]", "initial_parent_path": "/Workspace/Users/[USERNAME]/.bundle/dms-stale-plan-[UNIQUE_NAME]/default/state", "target_name": "default", "workspace_info": {"file_path": "/Workspace/Users/[USERNAME]/.bundle/dms-stale-plan-[UNIQUE_NAME]/default/files", "root_path": "/Workspace/Users/[USERNAME]/.bundle/dms-stale-plan-[UNIQUE_NAME]/default"}}}
+{"method": "POST", "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions", "q": {"version_id": "1"}, "body": {"cli_version": "[CLI_VERSION]", "operations": [{"action_type": "OPERATION_ACTION_TYPE_CREATE", "resource_key": "jobs.foo"}], "version_type": "VERSION_TYPE_DEPLOY"}}
+{"method": "PATCH", "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/1/operations/jobs.foo", "q": {"update_mask": "state,error_message,resource_id,status"}, "body": {"error_message": "", "resource_id": "[FOO_ID]", "sequence_id": 0, "state": "{\"state\":{\"deployment\":{\"deployment_id\":\"[DEPLOYMENT_ID]\",\"kind\":\"BUNDLE\",\"metadata_file_path\":\"/Workspace/Users/[USERNAME]/.bundle/dms-stale-plan-[UNIQUE_NAME]/default/state/metadata.json\",\"version_id\":\"1\"},\"edit_mode\":\"UI_LOCKED\",\"format\":\"MULTI_TASK\",\"max_concurrent_runs\":1,\"name\":\"foo\",\"queue\":{\"enabled\":true}}}", "status": "OPERATION_STATUS_SUCCEEDED"}}
+{"method": "POST", "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/1/complete", "body": {"completion_reason": "VERSION_COMPLETE_SUCCESS"}}
+
+=== Save a plan against the recorded deployment, then move the deployment on
+>>> jq {serial} tmp.plan2.json
+{
+  "serial": 1
+}
+
+>>> update_file.py databricks.yml name: foo name: foo_renamed
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dms-stale-plan-[UNIQUE_NAME]/default/files...
+Updated jobs.foo
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+>>> jq {serial} .databricks/bundle/default/resources.json
+{
+  "serial": 2
+}
+
+=== Replaying the older plan is rejected: same deployment, outdated version
+>>> musterr [CLI] bundle deploy --plan tmp.plan2.json
+Error: plan serial 1 does not match state serial 2; the state has been modified since the plan was created. Please run 'bundle plan' again
+
diff --git a/acceptance/bundle/dms/stale-plan/script b/acceptance/bundle/dms/stale-plan/script
new file mode 100644
index 00000000000..7c9d37630f0
--- /dev/null
+++ b/acceptance/bundle/dms/stale-plan/script
@@ -0,0 +1,40 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+title "Save a plan, then deploy it: records version 1"
+$CLI bundle plan -o json > tmp.plan.json
+dms_plan
+# READPLAN deploys from the saved raw plan; without it the plan is recomputed. Untraced so the
+# variant-dependent command line stays out of the golden (the deploy output is identical either way).
+$CLI bundle deploy $(readplanarg tmp.plan.json)
+
+deployment_id=$(MSYS_NO_PATHCONV=1 $CLI workspace get-status "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/dms-stale-plan-${UNIQUE_NAME}/default/state/resources.deployment.json" | python3 -c 'import sys, json; print(json.load(sys.stdin)["object_id"])')
+add_repl "$deployment_id" DEPLOYMENT_ID
+replace_ids.py
+trace MSYS_NO_PATHCONV=1 $CLI bundle-deployments list-resources "deployments/${deployment_id}" -o json | jq -S 'map({resource_key, last_version_id, last_action_type})'
+
+title "The raw recorded state the service holds for this deployment"
+trace print_state.py --no-dms
+
+title "A saved plan carries the version it was built against"
+trace $CLI bundle plan -o json | jq '{serial}'
+
+title "Replay: re-deploying the same plan is rejected - it predates the recorded version"
+trace musterr $CLI bundle deploy --plan tmp.plan.json
+
+title "Only the first deploy recorded a version; the rejected replay created none"
+trace print_requests.py --dms //api/2.0/bundle --oneline
+
+# The replay above predates the deployment entirely (its plan was built before one existed).
+# This covers the other shape: a plan that targets the right deployment but an outdated
+# version, which the serial guard has to catch.
+title "Save a plan against the recorded deployment, then move the deployment on"
+$CLI bundle plan -o json > tmp.plan2.json
+trace jq '{serial}' tmp.plan2.json
+trace update_file.py databricks.yml "name: foo" "name: foo_renamed"
+trace $CLI bundle deploy
+trace jq '{serial}' .databricks/bundle/default/resources.json
+
+title "Replaying the older plan is rejected: same deployment, outdated version"
+trace musterr $CLI bundle deploy --plan tmp.plan2.json
+
+rm -f tmp.plan.json tmp.plan2.json "$OUT_REQUESTS"
diff --git a/acceptance/bundle/dms/stale-plan/test.toml b/acceptance/bundle/dms/stale-plan/test.toml
new file mode 100644
index 00000000000..4c51e8879d6
--- /dev/null
+++ b/acceptance/bundle/dms/stale-plan/test.toml
@@ -0,0 +1,4 @@
+# Also deploy from the saved plan (not just compute it), so recorded deploy --plan is covered by the
+# standard readplan option rather than a dedicated test. The saved plan is raw (not nostamp.py'd) so
+# it carries the DMS fields the replay needs.
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/dms/state-features/databricks.yml.tmpl b/acceptance/bundle/dms/state-features/databricks.yml.tmpl
new file mode 100644
index 00000000000..8f0cc75b608
--- /dev/null
+++ b/acceptance/bundle/dms/state-features/databricks.yml.tmpl
@@ -0,0 +1,9 @@
+bundle:
+  name: dms-state-features-$UNIQUE_NAME
+experimental:
+  deployment_history: true
+
+resources:
+  jobs:
+    foo:
+      name: state-features
diff --git a/acceptance/bundle/dms/state-features/out.test.toml b/acceptance/bundle/dms/state-features/out.test.toml
new file mode 100644
index 00000000000..84b22ba6735
--- /dev/null
+++ b/acceptance/bundle/dms/state-features/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["true"]
diff --git a/acceptance/bundle/dms/state-features/output.txt b/acceptance/bundle/dms/state-features/output.txt
new file mode 100644
index 00000000000..342fbfe6a44
--- /dev/null
+++ b/acceptance/bundle/dms/state-features/output.txt
@@ -0,0 +1,50 @@
+
+=== Deploy records version 3 and the deployment_history feature, with resources held in DMS
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dms-state-features-[UNIQUE_NAME]/default/files...
+Created jobs.foo
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> jq {state_version, features, state} .databricks/bundle/default/resources.json
+{
+  "state_version": 3,
+  "features": {
+    "deployment_history": {}
+  },
+  "state": {}
+}
+
+=== Reopening version 3 reads resources from DMS and produces a no-op plan
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+>>> print_requests.py --dms //resources --get --oneline
+{"method": "GET", "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/resources"}
+
+=== Disabling deployment history is refused by plan and deploy, while destroy keeps using DMS from state
+>>> env DATABRICKS_BUNDLE_DEPLOYMENT_HISTORY=false [CLI] bundle plan
+Error: deployment history setting (false) does not match the existing state (true)
+
+Update experimental.deployment_history to match the existing deployment, or run "databricks bundle destroy" to start over
+
+
+>>> env DATABRICKS_BUNDLE_DEPLOYMENT_HISTORY=false [CLI] bundle deploy
+Error: deployment history setting (false) does not match the existing state (true)
+
+Update experimental.deployment_history to match the existing deployment, or run "databricks bundle destroy" to start over
+
+
+>>> env DATABRICKS_BUNDLE_DEPLOYMENT_HISTORY=false [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.foo
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/dms-state-features-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
+
+>>> print_requests.py --dms //api/2.0/bundle --oneline
+{"method": "POST", "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions", "q": {"version_id": "2"}, "body": {"cli_version": "[CLI_VERSION]", "operations": [{"action_type": "OPERATION_ACTION_TYPE_DELETE", "resource_key": "jobs.foo"}], "previous_version_id": "1", "version_type": "VERSION_TYPE_DESTROY"}}
+{"method": "PATCH", "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/2/operations/jobs.foo", "q": {"update_mask": "state,error_message,status"}, "body": {"error_message": "", "sequence_id": 0, "status": "OPERATION_STATUS_SUCCEEDED"}}
+{"method": "POST", "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/2/complete", "body": {"completion_reason": "VERSION_COMPLETE_SUCCESS"}}
+{"method": "DELETE", "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]"}
diff --git a/acceptance/bundle/dms/state-features/script b/acceptance/bundle/dms/state-features/script
new file mode 100644
index 00000000000..349845853cc
--- /dev/null
+++ b/acceptance/bundle/dms/state-features/script
@@ -0,0 +1,22 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+title "Deploy records version 3 and the deployment_history feature, with resources held in DMS"
+trace $CLI bundle deploy
+trace jq '{state_version, features, state}' .databricks/bundle/default/resources.json
+deployment_id=$(MSYS_NO_PATHCONV=1 $CLI workspace get-status "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/dms-state-features-${UNIQUE_NAME}/default/state/resources.deployment.json" | python3 -c 'import sys, json; print(json.load(sys.stdin)["object_id"])')
+add_repl "$deployment_id" DEPLOYMENT_ID
+rm -f "$OUT_REQUESTS"
+
+title "Reopening version 3 reads resources from DMS and produces a no-op plan"
+trace $CLI bundle plan
+trace print_requests.py --dms //resources --get --oneline
+
+title "Disabling deployment history is refused by plan and deploy, while destroy keeps using DMS from state"
+update_file.py databricks.yml 'deployment_history: true' 'deployment_history: false'
+for command in plan deploy; do
+    musterr trace env DATABRICKS_BUNDLE_DEPLOYMENT_HISTORY=false $CLI bundle "$command"
+done
+trace env DATABRICKS_BUNDLE_DEPLOYMENT_HISTORY=false $CLI bundle destroy --auto-approve
+trace print_requests.py --dms //api/2.0/bundle --oneline
+
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/dms/successful-recreate/databricks.yml.tmpl b/acceptance/bundle/dms/successful-recreate/databricks.yml.tmpl
new file mode 100644
index 00000000000..b48a55716e7
--- /dev/null
+++ b/acceptance/bundle/dms/successful-recreate/databricks.yml.tmpl
@@ -0,0 +1,11 @@
+bundle:
+  name: dms-successful-recreate-$UNIQUE_NAME
+experimental:
+  deployment_history: true
+
+resources:
+  schemas:
+    foo:
+      name: dms_successful_recreate_schema_$UNIQUE_NAME
+      catalog_name: main
+      comment: v1
diff --git a/acceptance/bundle/dms/successful-recreate/out.test.toml b/acceptance/bundle/dms/successful-recreate/out.test.toml
new file mode 100644
index 00000000000..84b22ba6735
--- /dev/null
+++ b/acceptance/bundle/dms/successful-recreate/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["true"]
diff --git a/acceptance/bundle/dms/successful-recreate/output.txt b/acceptance/bundle/dms/successful-recreate/output.txt
new file mode 100644
index 00000000000..f2ecc3f8cbc
--- /dev/null
+++ b/acceptance/bundle/dms/successful-recreate/output.txt
@@ -0,0 +1,256 @@
+
+=== Deploy: the state write records the resource
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dms-successful-recreate-[UNIQUE_NAME]/default/files...
+Created schemas.foo
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py --dms //api/2.0/bundle
+{
+  "method": "POST",
+  "path": "/api/2.0/bundle/deployments",
+  "body": {
+    "display_name": "dms-successful-recreate-[UNIQUE_NAME]",
+    "initial_parent_path": "/Workspace/Users/[USERNAME]/.bundle/dms-successful-recreate-[UNIQUE_NAME]/default/state",
+    "target_name": "default",
+    "workspace_info": {
+      "file_path": "/Workspace/Users/[USERNAME]/.bundle/dms-successful-recreate-[UNIQUE_NAME]/default/files",
+      "root_path": "/Workspace/Users/[USERNAME]/.bundle/dms-successful-recreate-[UNIQUE_NAME]/default"
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions",
+  "q": {
+    "version_id": "1"
+  },
+  "body": {
+    "cli_version": "[CLI_VERSION]",
+    "operations": [
+      {
+        "action_type": "OPERATION_ACTION_TYPE_CREATE",
+        "resource_key": "schemas.foo"
+      }
+    ],
+    "version_type": "VERSION_TYPE_DEPLOY"
+  }
+}
+{
+  "method": "PATCH",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/1/operations/schemas.foo",
+  "q": {
+    "update_mask": "state,error_message,resource_id,status"
+  },
+  "body": {
+    "error_message": "",
+    "resource_id": "main.dms_successful_recreate_schema_[UNIQUE_NAME]",
+    "sequence_id": 0,
+    "state": "{\"state\":{\"catalog_name\":\"main\",\"comment\":\"v1\",\"name\":\"dms_successful_recreate_schema_[UNIQUE_NAME]\"}}",
+    "status": "OPERATION_STATUS_SUCCEEDED"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/1/complete",
+  "body": {
+    "completion_reason": "VERSION_COMPLETE_SUCCESS"
+  }
+}
+
+=== The plan is a no-op now and records the deployment_history feature
+>>> [CLI] bundle plan -o json
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "features": {
+    "deployment_history": {}
+  }
+}
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+=== The service lists the schema, recorded at version 1
+>>> MSYS_NO_PATHCONV=1 [CLI] bundle-deployments list-resources deployments/[DEPLOYMENT_ID] -o json
+[
+  {
+    "last_action_type": "OPERATION_ACTION_TYPE_CREATE",
+    "last_version_id": "1",
+    "resource_key": "schemas.foo"
+  }
+]
+
+=== The raw recorded state the service holds for this deployment
+>>> print_state.py --no-dms
+{
+ "state_version": 3,
+ "cli_version": "[CLI_VERSION]",
+ "lineage": "[UUID]",
+ "serial": 1,
+ "features": {
+  "deployment_history": {}
+ },
+ "state": {}
+}
+
+=== Recreate writes state twice - the entry is dropped, then the new resource is saved
+>>> update_file.py databricks.yml catalog_name: main catalog_name: dms_other_[UNIQUE_NAME]
+
+>>> [CLI] bundle deploy --auto-approve
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dms-successful-recreate-[UNIQUE_NAME]/default/files...
+
+This action will result in the deletion or recreation of the following UC schemas. Any underlying data may be lost:
+  recreate resources.schemas.foo
+Recreated schemas.foo
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 0 unchanged
+
+>>> print_requests.py --dms //api/2.0/bundle
+{
+  "method": "POST",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions",
+  "q": {
+    "version_id": "2"
+  },
+  "body": {
+    "cli_version": "[CLI_VERSION]",
+    "operations": [
+      {
+        "action_type": "OPERATION_ACTION_TYPE_RECREATE",
+        "resource_key": "schemas.foo"
+      }
+    ],
+    "previous_version_id": "1",
+    "version_type": "VERSION_TYPE_DEPLOY"
+  }
+}
+{
+  "method": "PATCH",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/2/operations/schemas.foo",
+  "q": {
+    "update_mask": "state,error_message,status"
+  },
+  "body": {
+    "error_message": "",
+    "sequence_id": 0,
+    "status": "OPERATION_STATUS_PENDING"
+  }
+}
+{
+  "method": "PATCH",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/2/operations/schemas.foo",
+  "q": {
+    "update_mask": "state,error_message,resource_id,status"
+  },
+  "body": {
+    "error_message": "",
+    "resource_id": "dms_other_[UNIQUE_NAME].dms_successful_recreate_schema_[UNIQUE_NAME]",
+    "sequence_id": 1,
+    "state": "{\"state\":{\"catalog_name\":\"dms_other_[UNIQUE_NAME]\",\"comment\":\"v1\",\"name\":\"dms_successful_recreate_schema_[UNIQUE_NAME]\"}}",
+    "status": "OPERATION_STATUS_SUCCEEDED"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/2/complete",
+  "body": {
+    "completion_reason": "VERSION_COMPLETE_SUCCESS"
+  }
+}
+
+=== The recreate is done: nothing left to plan, and the serial moved to 2
+>>> [CLI] bundle plan -o json
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 2,
+  "features": {
+    "deployment_history": {}
+  }
+}
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+=== The service lists the schema at version 2 with recreate action
+>>> MSYS_NO_PATHCONV=1 [CLI] bundle-deployments list-resources deployments/[DEPLOYMENT_ID] -o json
+[
+  {
+    "last_action_type": "OPERATION_ACTION_TYPE_RECREATE",
+    "last_version_id": "2",
+    "resource_key": "schemas.foo"
+  }
+]
+
+=== The raw recorded state after recreate
+>>> print_state.py --no-dms
+{
+ "state_version": 3,
+ "cli_version": "[CLI_VERSION]",
+ "lineage": "[UUID]",
+ "serial": 2,
+ "features": {
+  "deployment_history": {}
+ },
+ "state": {}
+}
+
+=== Destroy: the delete is recorded with the id and no state
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.schemas.foo
+
+This action will result in the deletion of the following UC schemas. Any underlying data may be lost:
+  delete resources.schemas.foo
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/dms-successful-recreate-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
+
+>>> print_requests.py --dms //api/2.0/bundle
+{
+  "method": "POST",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions",
+  "q": {
+    "version_id": "3"
+  },
+  "body": {
+    "cli_version": "[CLI_VERSION]",
+    "operations": [
+      {
+        "action_type": "OPERATION_ACTION_TYPE_DELETE",
+        "resource_key": "schemas.foo"
+      }
+    ],
+    "previous_version_id": "2",
+    "version_type": "VERSION_TYPE_DESTROY"
+  }
+}
+{
+  "method": "PATCH",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/3/operations/schemas.foo",
+  "q": {
+    "update_mask": "state,error_message,status"
+  },
+  "body": {
+    "error_message": "",
+    "sequence_id": 0,
+    "status": "OPERATION_STATUS_SUCCEEDED"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions/3/complete",
+  "body": {
+    "completion_reason": "VERSION_COMPLETE_SUCCESS"
+  }
+}
+{
+  "method": "DELETE",
+  "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]"
+}
diff --git a/acceptance/bundle/dms/successful-recreate/script b/acceptance/bundle/dms/successful-recreate/script
new file mode 100644
index 00000000000..87bdc98bc34
--- /dev/null
+++ b/acceptance/bundle/dms/successful-recreate/script
@@ -0,0 +1,41 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+title "Deploy: the state write records the resource"
+trace $CLI bundle deploy
+trace print_requests.py --dms //api/2.0/bundle
+
+title "The plan is a no-op now and records the deployment_history feature"
+dms_plan
+
+title "The service lists the schema, recorded at version 1"
+deployment_id=$(MSYS_NO_PATHCONV=1 $CLI workspace get-status "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/dms-successful-recreate-${UNIQUE_NAME}/default/state/resources.deployment.json" | python3 -c 'import sys, json; print(json.load(sys.stdin)["object_id"])')
+add_repl "$deployment_id" DEPLOYMENT_ID
+trace MSYS_NO_PATHCONV=1 $CLI bundle-deployments list-resources "deployments/${deployment_id}" -o json | jq -S 'map({resource_key, last_version_id, last_action_type})'
+
+title "The raw recorded state the service holds for this deployment"
+trace print_state.py --no-dms
+
+title "Recreate writes state twice - the entry is dropped, then the new resource is saved"
+# One operation per resource per version; both writes land on the same one.
+# The drop opens it IN_PROGRESS, the save patches it to SUCCEEDED.
+# Unity Catalog has no catalog called "other", so make one to move the schema into.
+other_catalog="dms_other_${UNIQUE_NAME}"
+$CLI catalogs create "$other_catalog" &> LOG.catalog
+trap '$CLI catalogs delete "$other_catalog" --force >> LOG.catalog 2>&1' EXIT
+trace update_file.py databricks.yml "catalog_name: main" "catalog_name: ${other_catalog}"
+trace $CLI bundle deploy --auto-approve
+trace print_requests.py --dms //api/2.0/bundle
+
+title "The recreate is done: nothing left to plan, and the serial moved to 2"
+dms_plan
+
+title "The service lists the schema at version 2 with recreate action"
+trace MSYS_NO_PATHCONV=1 $CLI bundle-deployments list-resources "deployments/${deployment_id}" -o json | jq -S 'map({resource_key, last_version_id, last_action_type})'
+
+title "The raw recorded state after recreate"
+trace print_state.py --no-dms
+
+title "Destroy: the delete is recorded with the id and no state"
+trace $CLI bundle destroy --auto-approve
+trace print_requests.py --dms //api/2.0/bundle
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/dms/test.toml b/acceptance/bundle/dms/test.toml
new file mode 100644
index 00000000000..f91ae5c29ab
--- /dev/null
+++ b/acceptance/bundle/dms/test.toml
@@ -0,0 +1,17 @@
+Cloud = true
+
+# Deployment Metadata Service (DMS) recording is only supported by the direct
+# engine; it is a no-op on terraform.
+
+RecordRequests = true
+
+Ignore = [
+    '.databricks',
+    'databricks.yml',
+]
+
+# These tests set experimental.deployment_history in databricks.yml; the DMS env var
+# both records and permits that otherwise-gated field. bundle/dms/not-supported covers the
+# rejection path. Pinned to "true" (not the suite's ["", "true"]) since the field already
+# records - the empty variant would just duplicate it.
+EnvMatrix.DMS = ["true"]
diff --git a/acceptance/bundle/dms/version-never-created/databricks.yml b/acceptance/bundle/dms/version-never-created/databricks.yml
new file mode 100644
index 00000000000..4b5143d04bc
--- /dev/null
+++ b/acceptance/bundle/dms/version-never-created/databricks.yml
@@ -0,0 +1,10 @@
+bundle:
+  name: dms-version-never-created
+
+experimental:
+  deployment_history: true
+
+resources:
+  jobs:
+    foo:
+      name: foo
diff --git a/acceptance/bundle/dms/version-never-created/out.test.toml b/acceptance/bundle/dms/version-never-created/out.test.toml
new file mode 100644
index 00000000000..88e6fbd847c
--- /dev/null
+++ b/acceptance/bundle/dms/version-never-created/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["true"]
diff --git a/acceptance/bundle/dms/version-never-created/output.txt b/acceptance/bundle/dms/version-never-created/output.txt
new file mode 100644
index 00000000000..989744df818
--- /dev/null
+++ b/acceptance/bundle/dms/version-never-created/output.txt
@@ -0,0 +1,60 @@
+
+=== The first version fails, so no deployment record exists - only the node naming its ID
+>>> musterr [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dms-version-never-created/default/files...
+Error: failed to create deployment version: Internal error (500 INTERNAL_ERROR)
+
+Endpoint: POST [DATABRICKS_URL]/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions?version_id=1
+HTTP Status: 500 Internal Server Error
+API error_code: INTERNAL_ERROR
+API message: Internal error
+
+Files: 1 uploaded, 0 deleted
+
+>>> [CLI] bundle plan -o json
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "features": {
+    "deployment_history": {}
+  }
+}
+
+>>> [CLI] bundle plan
+create jobs.foo
+
+Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
+
+>>> MSYS_NO_PATHCONV=1 [CLI] workspace get-status /Workspace/Users/[USERNAME]/.bundle/dms-version-never-created/default/state/resources.deployment.json
+{
+  "object_type": "BUNDLE_DEPLOYMENT"
+}
+
+>>> print_requests.py --dms //api/2.0/bundle --get --oneline
+{"method": "POST", "path": "/api/2.0/bundle/deployments", "body": {"display_name": "dms-version-never-created", "initial_parent_path": "/Workspace/Users/[USERNAME]/.bundle/dms-version-never-created/default/state", "target_name": "default", "workspace_info": {"file_path": "/Workspace/Users/[USERNAME]/.bundle/dms-version-never-created/default/files", "root_path": "/Workspace/Users/[USERNAME]/.bundle/dms-version-never-created/default"}}}
+{"method": "POST", "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions", "q": {"version_id": "1"}, "body": {"cli_version": "[CLI_VERSION]", "operations": [{"action_type": "OPERATION_ACTION_TYPE_CREATE", "resource_key": "jobs.foo"}], "version_type": "VERSION_TYPE_DEPLOY"}}
+{"method": "GET", "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]"}
+{"method": "GET", "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/resources"}
+{"method": "GET", "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]"}
+{"method": "GET", "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/resources"}
+
+>>> MSYS_NO_PATHCONV=1 [CLI] bundle-deployments list-resources deployments/[DEPLOYMENT_ID] -o json
+[]
+
+=== The next deploy reuses the ID that node names and retries version 1, rather than creating a second deployment
+>>> musterr [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dms-version-never-created/default/files...
+Error: failed to create deployment version: Internal error (500 INTERNAL_ERROR)
+
+Endpoint: POST [DATABRICKS_URL]/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions?version_id=1
+HTTP Status: 500 Internal Server Error
+API error_code: INTERNAL_ERROR
+API message: Internal error
+
+Files: 0 uploaded, 0 deleted
+
+>>> print_requests.py --dms //api/2.0/bundle --get --oneline
+{"method": "GET", "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/resources"}
+{"method": "GET", "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]"}
+{"method": "GET", "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/resources"}
+{"method": "POST", "path": "/api/2.0/bundle/deployments/[DEPLOYMENT_ID]/versions", "q": {"version_id": "1"}, "body": {"cli_version": "[CLI_VERSION]", "operations": [{"action_type": "OPERATION_ACTION_TYPE_CREATE", "resource_key": "jobs.foo"}], "version_type": "VERSION_TYPE_DEPLOY"}}
diff --git a/acceptance/bundle/dms/version-never-created/script b/acceptance/bundle/dms/version-never-created/script
new file mode 100644
index 00000000000..9498fa05eff
--- /dev/null
+++ b/acceptance/bundle/dms/version-never-created/script
@@ -0,0 +1,13 @@
+title "The first version fails, so no deployment record exists - only the node naming its ID"
+trace musterr $CLI bundle deploy
+dms_plan
+trace MSYS_NO_PATHCONV=1 $CLI workspace get-status "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/dms-version-never-created/default/state/resources.deployment.json" | jq '{object_type}'
+trace print_requests.py --dms //api/2.0/bundle --get --oneline
+
+deployment_id=$(MSYS_NO_PATHCONV=1 $CLI workspace get-status "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/dms-version-never-created/default/state/resources.deployment.json" | python3 -c 'import sys, json; print(json.load(sys.stdin)["object_id"])')
+add_repl "$deployment_id" DEPLOYMENT_ID
+trace MSYS_NO_PATHCONV=1 $CLI bundle-deployments list-resources "deployments/${deployment_id}" -o json | jq -S 'map({resource_key, last_version_id, last_action_type})'
+
+title "The next deploy reuses the ID that node names and retries version 1, rather than creating a second deployment"
+trace musterr $CLI bundle deploy
+trace print_requests.py --dms //api/2.0/bundle --get --oneline
diff --git a/acceptance/bundle/dms/version-never-created/test.toml b/acceptance/bundle/dms/version-never-created/test.toml
new file mode 100644
index 00000000000..6553e7c09bb
--- /dev/null
+++ b/acceptance/bundle/dms/version-never-created/test.toml
@@ -0,0 +1,12 @@
+# Local only: the failure has to land on CreateVersion and not on the CreateDeployment
+# that precedes it, which fault.py's trailing-* pattern cannot express, so this case
+# keeps a [[Server]] stub - and the cloud harness ignores stubs.
+Cloud = false
+
+# The first version fails, so the deployment record is never created - only the
+# workspace node CreateDeployment registered. The next deploy resolves the ID from
+# that node and has to cope with a deployment that has no record yet.
+[[Server]]
+Pattern = "POST /api/2.0/bundle/deployments/{deployment_id}/versions"
+Response.StatusCode = 500
+Response.Body = '''{"error_code": "INTERNAL_ERROR", "message": "Internal error"}'''
diff --git a/acceptance/bundle/resources/apps/lifecycle-started-terraform-error/app/app.py b/acceptance/bundle/empty_string_dropped/app/app.py
similarity index 100%
rename from acceptance/bundle/resources/apps/lifecycle-started-terraform-error/app/app.py
rename to acceptance/bundle/empty_string_dropped/app/app.py
diff --git a/acceptance/bundle/empty_string_dropped/base.yml b/acceptance/bundle/empty_string_dropped/base.yml
new file mode 100644
index 00000000000..16c893adb0b
--- /dev/null
+++ b/acceptance/bundle/empty_string_dropped/base.yml
@@ -0,0 +1,101 @@
+bundle:
+  name: test-bundle
+
+# Deployable skeleton per resource. gen_empty_config.py fills every settable
+# string leaf under the blocks present here with "" and records it. Coverage is
+# scoped to the blocks below: we include one side of each mutually-exclusive
+# choice (aws_attributes not gcp, s3 log conf not dbfs/volumes, git_source
+# present) because including both would make terraform abort. Only resources that
+# deploy on BOTH engines belong here.
+#
+# Fields set to a real value here are treated as required/meaningful and left
+# alone; everything else settable-and-string is emptied.
+resources:
+  apps:
+    my_app:
+      # App names are globally unique in the workspace; the two targets deploy to
+      # the same fake workspace, so scope the name per target to avoid a 409.
+      name: test-app-${bundle.target}
+      source_code_path: ./app
+
+  clusters:
+    my_cluster:
+      num_workers: 1
+      # spark_version is tagged omitempty in the SDK but required by terraform's
+      # schema and the backend, so it must have a real value or the deploy fails.
+      spark_version: 13.3.x-scala2.12
+      aws_attributes:
+        availability: SPOT
+      cluster_log_conf:
+        s3:
+          destination: s3://test-bucket/logs
+
+  jobs:
+    my_job:
+      max_concurrent_runs: 1
+      git_source:
+        git_url: https://example.com/repo
+        git_provider: gitHub
+        git_branch: main
+      job_clusters:
+        - job_cluster_key: main
+          new_cluster:
+            num_workers: 1
+            spark_version: 13.3.x-scala2.12
+            aws_attributes:
+              availability: SPOT
+            cluster_log_conf:
+              s3:
+                destination: s3://test-bucket/logs
+
+  pipelines:
+    my_pipeline:
+      libraries:
+        - file:
+            path: pipeline.py
+      clusters:
+        - label: default
+          aws_attributes:
+            availability: SPOT
+
+  sql_warehouses:
+    my_warehouse:
+      name: test-warehouse
+      cluster_size: 2X-Small
+      auto_stop_mins: 10
+      max_num_clusters: 1
+      min_num_clusters: 1
+
+  models:
+    my_model:
+      name: test-model
+
+  experiments:
+    my_experiment:
+      name: /Users/${workspace.current_user.userName}/test-experiment
+
+  registered_models:
+    my_registered_model:
+      name: test-registered-model
+      catalog_name: main
+      schema_name: default
+
+  schemas:
+    my_schema:
+      catalog_name: main
+      name: test-schema
+
+  volumes:
+    my_volume:
+      name: test-volume
+      catalog_name: main
+      schema_name: default
+
+  database_instances:
+    my_db_instance:
+      name: test-db-instance
+      capacity: CU_1
+
+targets:
+  tf:
+  direct:
diff --git a/acceptance/bundle/empty_string_dropped/databricks.yml b/acceptance/bundle/empty_string_dropped/databricks.yml
new file mode 100644
index 00000000000..12accd4278e
--- /dev/null
+++ b/acceptance/bundle/empty_string_dropped/databricks.yml
@@ -0,0 +1,154 @@
+# Generated by gen_empty_config.py. Do not edit; edit base.yml and regenerate.
+bundle:
+  name: test-bundle
+resources:
+  apps:
+    my_app:
+      budget_policy_id: ''
+      description: ''
+      name: test-app-${bundle.target}
+      source_code_path: ./app
+      space: ''
+      usage_policy_id: ''
+  clusters:
+    my_cluster:
+      aws_attributes:
+        availability: SPOT
+        instance_profile_arn: ''
+        zone_id: ''
+      cluster_log_conf:
+        s3:
+          canned_acl: ''
+          destination: s3://test-bucket/logs
+          encryption_type: ''
+          endpoint: ''
+          kms_key: ''
+          region: ''
+      cluster_name: ''
+      driver_instance_pool_id: ''
+      driver_node_type_id: ''
+      instance_pool_id: ''
+      node_type_id: ''
+      num_workers: 1
+      policy_id: ''
+      single_user_name: ''
+      spark_version: 13.3.x-scala2.12
+  database_instances:
+    my_db_instance:
+      capacity: CU_1
+      name: test-db-instance
+      usage_policy_id: ''
+  experiments:
+    my_experiment:
+      artifact_location: ''
+      name: /Users/${workspace.current_user.userName}/test-experiment
+  jobs:
+    my_job:
+      budget_policy_id: ''
+      description: ''
+      git_source:
+        git_branch: main
+        git_commit: ''
+        git_provider: gitHub
+        git_tag: ''
+        git_url: https://example.com/repo
+      job_clusters:
+        - job_cluster_key: main
+          new_cluster:
+            aws_attributes:
+              availability: SPOT
+              instance_profile_arn: ''
+              zone_id: ''
+            cluster_log_conf:
+              s3:
+                canned_acl: ''
+                destination: s3://test-bucket/logs
+                encryption_type: ''
+                endpoint: ''
+                kms_key: ''
+                region: ''
+            cluster_name: ''
+            driver_instance_pool_id: ''
+            driver_node_type_id: ''
+            instance_pool_id: ''
+            node_type_id: ''
+            num_workers: 1
+            policy_id: ''
+            single_user_name: ''
+            spark_version: 13.3.x-scala2.12
+          serverless_compute_id: ''
+      max_concurrent_runs: 1
+      name: ''
+      parent_path: ''
+      usage_policy_id: ''
+  models:
+    my_model:
+      description: ''
+      name: test-model
+  pipelines:
+    my_pipeline:
+      budget_policy_id: ''
+      catalog: ''
+      channel: ''
+      clusters:
+        - aws_attributes:
+            availability: SPOT
+            instance_profile_arn: ''
+            zone_id: ''
+          driver_instance_pool_id: ''
+          driver_node_type_id: ''
+          instance_pool_id: ''
+          label: default
+          node_type_id: ''
+          policy_id: ''
+      edition: ''
+      libraries:
+        - file:
+            path: pipeline.py
+          jar: ''
+          whl: ''
+      name: ''
+      root_path: ''
+      schema: ''
+      serverless_compute_id: ''
+      storage: ''
+      target: ''
+      usage_policy_id: ''
+  registered_models:
+    my_registered_model:
+      catalog_name: main
+      comment: ''
+      created_by: ''
+      full_name: ''
+      metastore_id: ''
+      name: test-registered-model
+      owner: ''
+      schema_name: default
+      storage_location: ''
+      updated_by: ''
+  schemas:
+    my_schema:
+      catalog_name: main
+      comment: ''
+      name: test-schema
+      storage_root: ''
+  sql_warehouses:
+    my_warehouse:
+      auto_stop_mins: 10
+      cluster_size: 2X-Small
+      creator_name: ''
+      instance_profile_arn: ''
+      max_num_clusters: 1
+      min_num_clusters: 1
+      name: test-warehouse
+  volumes:
+    my_volume:
+      catalog_name: main
+      comment: ''
+      name: test-volume
+      schema_name: default
+      storage_location: ''
+      volume_path: ''
+targets:
+  direct: null
+  tf: null
diff --git a/acceptance/bundle/empty_string_dropped/gen_empty_config.py b/acceptance/bundle/empty_string_dropped/gen_empty_config.py
new file mode 100644
index 00000000000..e4eca7882fa
--- /dev/null
+++ b/acceptance/bundle/empty_string_dropped/gen_empty_config.py
@@ -0,0 +1,111 @@
+#!/usr/bin/env python3
+"""Generate databricks.yml with every settable string field set to "".
+
+base.yml defines a deployable skeleton per resource, including whichever nested
+blocks we want to cover (job_clusters[*].new_cluster, git_source, one cloud
+attributes block, ...). This script walks every resource subtree and sets every
+settable string LEAF (including nested ones) that the base doesn't already set
+to "". Coverage is therefore scoped to the blocks present in base.yml, which is
+how we avoid mutually-exclusive blocks (aws vs gcp attributes, git_source vs
+none).
+
+A field is settable/eligible when out.fields.txt types it as `string` (this
+skips enums, which are named types) with flag ALL or INPUT, and it is not
+output_only (<resource_type>.generated.yml) or a bundle-framework field.
+
+Run from the repo root; writes databricks.yml in the test directory:
+  acceptance/bundle/empty_string_dropped/gen_empty_config.py
+"""
+
+import re
+from pathlib import Path
+
+import yaml
+
+FIELDS = Path("acceptance/bundle/refschema/out.fields.txt")
+CONFIGS = Path("bundle/direct/dresources/configs")
+GENERATED_SUFFIX = ".generated.yml"
+TESTDIR = Path("acceptance/bundle/empty_string_dropped")
+BASE = TESTDIR / "base.yml"
+
+# Bundle-framework fields present on every resource; not real API inputs.
+FRAMEWORK_FIELDS = {"id", "url", "modified_status"}
+
+
+def string_leaf_parents():
+    """Map resource type -> {parent_schema_path: {leaf field names}}.
+
+    Schema paths mirror out.fields.txt: dotted segments, list elements marked
+    with "[*]" (e.g. "job_clusters[*].new_cluster"). Only string leaves that are
+    real object fields are kept: names ending in "[*]" (string-array elements) or
+    "*" (map values) are skipped.
+    """
+    pat = re.compile(r"^resources\.([a-z_]+)\.\*\.(.+)$")
+    result = {}
+    for line in FIELDS.read_text().splitlines():
+        parts = line.split("\t")
+        if len(parts) < 3:
+            continue
+        path, typ, flag = parts[0], parts[1], parts[2]
+        if typ != "string" or flag not in ("ALL", "INPUT"):
+            continue
+        m = pat.match(path)
+        if not m:
+            continue
+        rtype, rel = m.group(1), m.group(2)
+        if rel.endswith(("[*]", ".*")) or rel == "*":
+            continue
+        parent, _, leaf = rel.rpartition(".")
+        result.setdefault(rtype, {}).setdefault(parent, set()).add(leaf)
+    return result
+
+
+def output_only_fields():
+    """Map resource type -> {output_only field paths} (user cannot set)."""
+    result = {}
+    for path in sorted(CONFIGS.glob("*" + GENERATED_SUFFIX)):
+        spec = yaml.safe_load(path.read_text()) or {}
+        fields = set()
+        for entry in spec.get("ignore_remote_changes") or []:
+            if str(entry.get("reason", "")).startswith("spec:output_only"):
+                fields.add(entry["field"])
+        result[path.name.removesuffix(GENERATED_SUFFIX)] = fields
+    return result
+
+
+def fill(node, schema_path, parents, excluded):
+    """Recursively set settable string leaves under node to ""; recurse into blocks.
+
+    schema_path uses out.fields.txt syntax (list elements marked "[*]") to look up
+    eligible leaves for the current object.
+    """
+    if isinstance(node, dict):
+        for leaf in parents.get(schema_path, set()):
+            if leaf not in node and leaf not in excluded:
+                node[leaf] = ""
+        for key, value in list(node.items()):
+            child = f"{schema_path}.{key}" if schema_path else key
+            fill(value, child, parents, excluded)
+    elif isinstance(node, list):
+        for item in node:
+            fill(item, schema_path + "[*]", parents, excluded)
+
+
+def main():
+    parents = string_leaf_parents()
+    output_only = output_only_fields()
+    base = yaml.safe_load(BASE.read_text())
+
+    for rtype, entries in sorted(base.get("resources", {}).items()):
+        excluded = output_only.get(rtype, set()) | FRAMEWORK_FIELDS
+        for cfg in entries.values():
+            fill(cfg, "", parents.get(rtype, {}), excluded)
+
+    (TESTDIR / "databricks.yml").write_text(
+        "# Generated by gen_empty_config.py. Do not edit; edit base.yml and regenerate.\n"
+        + yaml.dump(base, sort_keys=True, default_flow_style=False)
+    )
+
+
+if __name__ == "__main__":
+    main()
diff --git a/acceptance/bundle/empty_string_dropped/out.requests.json b/acceptance/bundle/empty_string_dropped/out.requests.json
new file mode 100644
index 00000000000..a4798a110a2
--- /dev/null
+++ b/acceptance/bundle/empty_string_dropped/out.requests.json
@@ -0,0 +1,154 @@
+{
+  "method": "POST",
+  "path": "/api/2.0/apps",
+  "q": {
+    "no_compute": "true"
+  },
+  "body": {
+    "description": "",
+    "name": "test-app-direct"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/database/instances",
+  "body": {
+    "capacity": "CU_1",
+    "name": "test-db-instance"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/mlflow/experiments/create",
+  "body": {
+    "name": "/Users/[USERNAME]/test-experiment"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/mlflow/registered-models/create",
+  "body": {
+    "name": "test-model"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/pipelines",
+  "body": {
+    "clusters": [
+      {
+        "aws_attributes": {
+          "availability": "SPOT"
+        },
+        "label": "default"
+      }
+    ],
+    "deployment": {
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/direct/state/metadata.json"
+    },
+    "libraries": [
+      {
+        "file": {
+          "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/direct/files/pipeline.py"
+        }
+      }
+    ],
+    "root_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/direct/files"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/sql/warehouses",
+  "body": {
+    "auto_stop_mins": 10,
+    "cluster_size": "2X-Small",
+    "enable_photon": true,
+    "max_num_clusters": 1,
+    "min_num_clusters": 1,
+    "name": "test-warehouse",
+    "spot_instance_policy": "COST_OPTIMIZED"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.1/clusters/create",
+  "body": {
+    "autotermination_minutes": 60,
+    "aws_attributes": {
+      "availability": "SPOT"
+    },
+    "cluster_log_conf": {
+      "s3": {
+        "destination": "s3://test-bucket/logs"
+      }
+    },
+    "num_workers": 1,
+    "spark_version": "13.3.x-scala2.12"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.1/unity-catalog/models",
+  "body": {
+    "catalog_name": "main",
+    "name": "test-registered-model",
+    "schema_name": "default"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.1/unity-catalog/schemas",
+  "body": {
+    "catalog_name": "main",
+    "name": "test-schema"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.1/unity-catalog/volumes",
+  "body": {
+    "catalog_name": "main",
+    "name": "test-volume",
+    "schema_name": "default",
+    "volume_type": "MANAGED"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/create",
+  "body": {
+    "deployment": {
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/direct/state/metadata.json"
+    },
+    "edit_mode": "UI_LOCKED",
+    "format": "MULTI_TASK",
+    "git_source": {
+      "git_branch": "main",
+      "git_provider": "gitHub",
+      "git_url": "https://example.com/repo"
+    },
+    "job_clusters": [
+      {
+        "job_cluster_key": "main",
+        "new_cluster": {
+          "aws_attributes": {
+            "availability": "SPOT"
+          },
+          "cluster_log_conf": {
+            "s3": {
+              "destination": "s3://test-bucket/logs"
+            }
+          },
+          "num_workers": 1,
+          "spark_version": "13.3.x-scala2.12"
+        }
+      }
+    ],
+    "max_concurrent_runs": 1,
+    "queue": {
+      "enabled": true
+    }
+  }
+}
diff --git a/acceptance/bundle/empty_string_dropped/out.test.toml b/acceptance/bundle/empty_string_dropped/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/empty_string_dropped/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/empty_string_dropped/out.validate.json b/acceptance/bundle/empty_string_dropped/out.validate.json
new file mode 100644
index 00000000000..d3143653cf1
--- /dev/null
+++ b/acceptance/bundle/empty_string_dropped/out.validate.json
@@ -0,0 +1,133 @@
+{
+  "apps": {
+    "my_app": {
+      "description": "",
+      "name": "test-app-direct",
+      "source_code_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/direct/files/app"
+    }
+  },
+  "clusters": {
+    "my_cluster": {
+      "autotermination_minutes": 60,
+      "aws_attributes": {
+        "availability": "SPOT"
+      },
+      "cluster_log_conf": {
+        "s3": {
+          "destination": "s3://test-bucket/logs"
+        }
+      },
+      "num_workers": 1,
+      "spark_version": "13.3.x-scala2.12"
+    }
+  },
+  "database_instances": {
+    "my_db_instance": {
+      "capacity": "CU_1",
+      "name": "test-db-instance"
+    }
+  },
+  "experiments": {
+    "my_experiment": {
+      "name": "/Users/[USERNAME]/test-experiment"
+    }
+  },
+  "jobs": {
+    "my_job": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/direct/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "git_source": {
+        "git_branch": "main",
+        "git_provider": "gitHub",
+        "git_url": "https://example.com/repo"
+      },
+      "job_clusters": [
+        {
+          "job_cluster_key": "main",
+          "new_cluster": {
+            "aws_attributes": {
+              "availability": "SPOT"
+            },
+            "cluster_log_conf": {
+              "s3": {
+                "destination": "s3://test-bucket/logs"
+              }
+            },
+            "num_workers": 1,
+            "spark_version": "13.3.x-scala2.12"
+          }
+        }
+      ],
+      "max_concurrent_runs": 1,
+      "queue": {
+        "enabled": true
+      }
+    }
+  },
+  "models": {
+    "my_model": {
+      "name": "test-model"
+    }
+  },
+  "pipelines": {
+    "my_pipeline": {
+      "clusters": [
+        {
+          "aws_attributes": {
+            "availability": "SPOT"
+          },
+          "label": "default"
+        }
+      ],
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/direct/state/metadata.json"
+      },
+      "libraries": [
+        {
+          "file": {
+            "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/direct/files/pipeline.py"
+          }
+        }
+      ],
+      "root_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/direct/files"
+    }
+  },
+  "registered_models": {
+    "my_registered_model": {
+      "catalog_name": "main",
+      "name": "test-registered-model",
+      "schema_name": "default"
+    }
+  },
+  "schemas": {
+    "my_schema": {
+      "catalog_name": "main",
+      "name": "test-schema"
+    }
+  },
+  "sql_warehouses": {
+    "my_warehouse": {
+      "auto_stop_mins": 10,
+      "cluster_size": "2X-Small",
+      "enable_photon": true,
+      "max_num_clusters": 1,
+      "min_num_clusters": 1,
+      "name": "test-warehouse",
+      "spot_instance_policy": "COST_OPTIMIZED"
+    }
+  },
+  "volumes": {
+    "my_volume": {
+      "catalog_name": "main",
+      "name": "test-volume",
+      "schema_name": "default",
+      "volume_path": "/Volumes/main/default/test-volume",
+      "volume_type": "MANAGED"
+    }
+  }
+}
diff --git a/acceptance/bundle/empty_string_dropped/output.txt b/acceptance/bundle/empty_string_dropped/output.txt
new file mode 100644
index 00000000000..8a173fd8e26
--- /dev/null
+++ b/acceptance/bundle/empty_string_dropped/output.txt
@@ -0,0 +1,16 @@
+
+>>> [CLI] bundle deploy -t direct
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/direct/files...
+Created apps.my_app
+Created clusters.my_cluster
+Created database_instances.my_db_instance
+Created experiments.my_experiment
+Created jobs.my_job
+Created models.my_model
+Created pipelines.my_pipeline
+Created registered_models.my_registered_model
+Created schemas.my_schema
+Created sql_warehouses.my_warehouse
+Created volumes.my_volume
+Files: 6 uploaded, 0 deleted
+Resources: 11 created, 0 changed, 0 deleted, 0 unchanged
diff --git a/acceptance/bundle/empty_string_dropped/pipeline.py b/acceptance/bundle/empty_string_dropped/pipeline.py
new file mode 100644
index 00000000000..e1b4968c112
--- /dev/null
+++ b/acceptance/bundle/empty_string_dropped/pipeline.py
@@ -0,0 +1,6 @@
+import dlt
+
+
+@dlt.table
+def my_table():
+    return spark.range(1)
diff --git a/acceptance/bundle/empty_string_dropped/script b/acceptance/bundle/empty_string_dropped/script
new file mode 100644
index 00000000000..90af6a0b686
--- /dev/null
+++ b/acceptance/bundle/empty_string_dropped/script
@@ -0,0 +1,12 @@
+# databricks.yml is committed, generated by gen_empty_config.py with every settable
+# string field set to "". Deploy and record the create requests to show which "" fields
+# are sent.
+
+# Resolved config the engine sees. Today every "" field is still present here; a
+# fix in the initialize phase would drop them, and this golden would show that.
+$CLI bundle validate -o json -t direct | nostamp | jq .resources > out.validate.json
+
+# Exclude non-create traffic: workspace file ops, telemetry (nondeterministic), and the
+# deployment history calls the DMS run adds.
+trace $CLI bundle deploy -t direct
+print_requests.py --nostamp ^//api/2.0/workspace ^//telemetry ^//api/2.0/bundle --sort > out.requests.json
diff --git a/acceptance/bundle/empty_string_dropped/test.toml b/acceptance/bundle/empty_string_dropped/test.toml
new file mode 100644
index 00000000000..78a0c9b05fa
--- /dev/null
+++ b/acceptance/bundle/empty_string_dropped/test.toml
@@ -0,0 +1,6 @@
+Cloud = false
+RecordRequests = true
+
+Ignore = [
+    ".databricks",
+]
diff --git a/acceptance/bundle/empty_string_variable/databricks.yml b/acceptance/bundle/empty_string_variable/databricks.yml
new file mode 100644
index 00000000000..88e38c86cf3
--- /dev/null
+++ b/acceptance/bundle/empty_string_variable/databricks.yml
@@ -0,0 +1,16 @@
+bundle:
+  name: test-bundle
+
+variables:
+  policy:
+    default: ""
+
+resources:
+  clusters:
+    my_cluster:
+      num_workers: 1
+      spark_version: 13.3.x-scala2.12
+      # The original bug: a variable resolves to "" and policy_id (omitempty) was
+      # force-sent, so the backend rejected it with "'' is not a valid cluster
+      # policy ID". It must now be dropped from the resolved config.
+      policy_id: ${var.policy}
diff --git a/acceptance/bundle/empty_string_variable/out.test.toml b/acceptance/bundle/empty_string_variable/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/empty_string_variable/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/empty_string_variable/output.txt b/acceptance/bundle/empty_string_variable/output.txt
new file mode 100644
index 00000000000..8b89eda8902
--- /dev/null
+++ b/acceptance/bundle/empty_string_variable/output.txt
@@ -0,0 +1,7 @@
+
+>>> [CLI] bundle validate -o json
+{
+  "spark_version": "13.3.x-scala2.12",
+  "policy_id": null,
+  "has_policy_id": false
+}
diff --git a/acceptance/bundle/empty_string_variable/script b/acceptance/bundle/empty_string_variable/script
new file mode 100644
index 00000000000..73a83e9bcce
--- /dev/null
+++ b/acceptance/bundle/empty_string_variable/script
@@ -0,0 +1,3 @@
+# policy_id resolves to "" via the variable. It must be absent from the resolved
+# config (dropped as an empty omitempty string), not present as "".
+trace $CLI bundle validate -o json | jq '.resources.clusters.my_cluster | {spark_version, policy_id, has_policy_id: has("policy_id")}'
diff --git a/acceptance/bundle/environments/dependencies/databricks.yml b/acceptance/bundle/environments/dependencies/databricks.yml
index 8ae97319def..3fd067837f7 100644
--- a/acceptance/bundle/environments/dependencies/databricks.yml
+++ b/acceptance/bundle/environments/dependencies/databricks.yml
@@ -29,6 +29,7 @@ resources:
               - "test_package"
               - "test_package==2.0.1"
               - "test_package>=2.0.1"
+              - "test_package==2.0.*"
               - "dist/*.whl"
               - "/Workspace/Users/test@databricks.com/test-package.whl"
               - "beautifulsoup4>=1.0.0,~=1.2.0,<2.0.0"
@@ -50,6 +51,7 @@ resources:
           - "test_package"
           - "test_package==2.0.1"
           - "test_package>=2.0.1"
+          - "test_package==2.0.*"
           - "beautifulsoup4>=1.0.0,~=1.2.0,<2.0.0"
           - "requests[security] @ https://github.com/psf/requests/archive/refs/heads/main.zip"
           - "--find-links=/Workspace/Users/test"
diff --git a/acceptance/bundle/environments/dependencies/out.test.toml b/acceptance/bundle/environments/dependencies/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/environments/dependencies/out.test.toml
+++ b/acceptance/bundle/environments/dependencies/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/environments/dependencies/output.txt b/acceptance/bundle/environments/dependencies/output.txt
index da08e74cdb4..83a11d75cc8 100644
--- a/acceptance/bundle/environments/dependencies/output.txt
+++ b/acceptance/bundle/environments/dependencies/output.txt
@@ -11,11 +11,12 @@ Validation OK!
 >>> [CLI] bundle deploy
 Uploading dist/test.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dependencies/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.test_job
+Created pipelines.test_pipeline
+Files: 5 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
->>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.environments out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.environments [OUTPUT_DIR]/out.requests.txt
 [
   {
     "environment_key": "test_env",
@@ -31,6 +32,7 @@ Deployment complete!
         "test_package",
         "test_package==2.0.1",
         "test_package>=2.0.1",
+        "test_package==2.0.*",
         "/Workspace/Users/[USERNAME]/.bundle/dependencies/default/artifacts/.internal/test.whl",
         "/Workspace/Users/test@databricks.com/test-package.whl",
         "beautifulsoup4>=1.0.0,~=1.2.0,<2.0.0",
@@ -51,7 +53,7 @@ Deployment complete!
   }
 ]
 
->>> jq -s .[] | select(.path=="/api/2.0/pipelines") out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.0/pipelines") [OUTPUT_DIR]/out.requests.txt
 {
   "method": "POST",
   "path": "/api/2.0/pipelines",
@@ -73,6 +75,7 @@ Deployment complete!
         "test_package",
         "test_package==2.0.1",
         "test_package>=2.0.1",
+        "test_package==2.0.*",
         "beautifulsoup4>=1.0.0,~=1.2.0,<2.0.0",
         "requests[security] @ https://github.com/psf/requests/archive/refs/heads/main.zip",
         "--find-links=/Workspace/Users/test"
@@ -98,6 +101,7 @@ Deployment complete!
         "test_package",
         "test_package==2.0.1",
         "test_package>=2.0.1",
+        "test_package==2.0.*",
         "./dist/*.whl",
         "/Workspace/Users/test@databricks.com/test-package.whl",
         "beautifulsoup4>=1.0.0,~=1.2.0,<2.0.0",
@@ -130,6 +134,7 @@ Deployment complete!
     "test_package",
     "test_package==2.0.1",
     "test_package>=2.0.1",
+    "test_package==2.0.*",
     "beautifulsoup4>=1.0.0,~=1.2.0,<2.0.0",
     "requests[security] @ https://github.com/psf/requests/archive/refs/heads/main.zip",
     "--find-links=/Workspace/Users/test"
diff --git a/acceptance/bundle/environments/dependencies/script b/acceptance/bundle/environments/dependencies/script
index 54d408a8db2..1d8ed4a4b18 100644
--- a/acceptance/bundle/environments/dependencies/script
+++ b/acceptance/bundle/environments/dependencies/script
@@ -4,11 +4,11 @@ set -euo pipefail
 trace $CLI bundle validate
 
 trace $CLI bundle deploy
-trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.environments' out.requests.txt
+trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.environments' "$OUT_REQUESTS" | nostamp
 
-trace jq -s '.[] | select(.path=="/api/2.0/pipelines")' out.requests.txt
+trace jq -s '.[] | select(.path=="/api/2.0/pipelines")' "$OUT_REQUESTS" | nostamp
 
-trace $CLI bundle validate -o json | jq '.resources.jobs.test_job.environments'
-trace $CLI bundle validate -o json | jq '.resources.pipelines.test_pipeline.environment'
+trace $CLI bundle validate -o json | nostamp | jq '.resources.jobs.test_job.environments'
+trace $CLI bundle validate -o json | nostamp | jq '.resources.pipelines.test_pipeline.environment'
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/environments/project_environment/databricks.yml b/acceptance/bundle/environments/project_environment/databricks.yml
new file mode 100644
index 00000000000..03565b8a553
--- /dev/null
+++ b/acceptance/bundle/environments/project_environment/databricks.yml
@@ -0,0 +1,5 @@
+bundle:
+  name: project_environment
+
+include:
+  - resources/*.yml
diff --git a/acceptance/bundle/environments/project_environment/out.test.toml b/acceptance/bundle/environments/project_environment/out.test.toml
new file mode 100644
index 00000000000..59b56a2037c
--- /dev/null
+++ b/acceptance/bundle/environments/project_environment/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/environments/project_environment/output.txt b/acceptance/bundle/environments/project_environment/output.txt
new file mode 100644
index 00000000000..a0090b9d8c3
--- /dev/null
+++ b/acceptance/bundle/environments/project_environment/output.txt
@@ -0,0 +1,32 @@
+
+>>> [CLI] bundle validate -o json
+{
+  "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/project_environment/default/files/src/notebook",
+  "project_environment": "/Workspace/Users/[USERNAME]/.bundle/project_environment/default/files/pyproject.toml"
+}
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/project_environment/default/files...
+Created jobs.notebook
+Files: 5 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //api/2.2/jobs/create
+{
+  "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/project_environment/default/files/src/notebook",
+  "project_environment": "/Workspace/Users/[USERNAME]/.bundle/project_environment/default/files/pyproject.toml"
+}
+
+>>> update_file.py resources/job.yml ../pyproject.toml ./pyproject.toml
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/project_environment/default/files...
+Updated jobs.notebook
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //api/2.2/jobs/reset
+{
+  "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/project_environment/default/files/src/notebook",
+  "project_environment": "/Workspace/Users/[USERNAME]/.bundle/project_environment/default/files/resources/pyproject.toml"
+}
diff --git a/acceptance/bundle/environments/project_environment/pyproject.toml b/acceptance/bundle/environments/project_environment/pyproject.toml
new file mode 100644
index 00000000000..b22de93e858
--- /dev/null
+++ b/acceptance/bundle/environments/project_environment/pyproject.toml
@@ -0,0 +1,6 @@
+[project]
+name = "project-environment-test"
+version = "0.1.0"
+
+[tool.databricks.environment]
+environment_version = "4"
diff --git a/acceptance/bundle/environments/project_environment/resources/job.yml b/acceptance/bundle/environments/project_environment/resources/job.yml
new file mode 100644
index 00000000000..bce7abe7c65
--- /dev/null
+++ b/acceptance/bundle/environments/project_environment/resources/job.yml
@@ -0,0 +1,13 @@
+resources:
+  jobs:
+    notebook:
+      name: project_environment
+      tasks:
+        - task_key: notebook
+          notebook_task:
+            notebook_path: ../src/notebook.py
+          environment_key: project
+      environments:
+        - environment_key: project
+          spec:
+            project_environment: ../pyproject.toml
diff --git a/acceptance/bundle/environments/project_environment/resources/pyproject.toml b/acceptance/bundle/environments/project_environment/resources/pyproject.toml
new file mode 100644
index 00000000000..d2854958830
--- /dev/null
+++ b/acceptance/bundle/environments/project_environment/resources/pyproject.toml
@@ -0,0 +1,6 @@
+[project]
+name = "updated-project-environment-test"
+version = "0.1.0"
+
+[tool.databricks.environment]
+environment_version = "4"
diff --git a/acceptance/bundle/environments/project_environment/script b/acceptance/bundle/environments/project_environment/script
new file mode 100644
index 00000000000..9b5a185900c
--- /dev/null
+++ b/acceptance/bundle/environments/project_environment/script
@@ -0,0 +1,15 @@
+job_paths() {
+    jq '{
+        notebook_path: .tasks[].notebook_task.notebook_path,
+        project_environment: .environments[].spec.project_environment
+    }'
+}
+
+trace $CLI bundle validate -o json | jq '.resources.jobs.notebook' | job_paths
+
+trace $CLI bundle deploy
+trace print_requests.py //api/2.2/jobs/create | jq '.body' | job_paths
+
+trace update_file.py resources/job.yml ../pyproject.toml ./pyproject.toml
+trace $CLI bundle deploy
+trace print_requests.py //api/2.2/jobs/reset | jq '.body.new_settings' | job_paths
diff --git a/acceptance/bundle/environments/project_environment/src/notebook.py b/acceptance/bundle/environments/project_environment/src/notebook.py
new file mode 100644
index 00000000000..5bee9c9eae0
--- /dev/null
+++ b/acceptance/bundle/environments/project_environment/src/notebook.py
@@ -0,0 +1,2 @@
+# Databricks notebook source
+print("Project environment")
diff --git a/acceptance/bundle/environments/project_environment/test.toml b/acceptance/bundle/environments/project_environment/test.toml
new file mode 100644
index 00000000000..ba0016a753f
--- /dev/null
+++ b/acceptance/bundle/environments/project_environment/test.toml
@@ -0,0 +1,2 @@
+EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+RecordRequests = true
diff --git a/acceptance/bundle/escaped_refs/out.plan.json b/acceptance/bundle/escaped_refs/out.plan.json
new file mode 100644
index 00000000000..9ab429a3522
--- /dev/null
+++ b/acceptance/bundle/escaped_refs/out.plan.json
@@ -0,0 +1,47 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.jobs.example_ingestion_job": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "test-job-[UNIQUE_NAME]",
+          "parameters": [
+            {
+              "default": "{{job.id}}",
+              "name": "batch_id"
+            },
+            {
+              "default": "{{job.start_time.iso_date}}",
+              "name": "business_date"
+            }
+          ],
+          "queue": {
+            "enabled": true
+          },
+          "tasks": [
+            {
+              "notebook_task": {
+                "base_parameters": {
+                  "generic_config": "{\"source\": {\"path\": \"landing/${p_folder}/${source_file}_*.csv\"}, \"schema\": {\"columns\": [{\"name\": \"w_batch_id\", \"expression\": \"${batch_id}\"}, {\"name\": \"w_business_dt\", \"expression\": \"cast('${business_date[0..9]}' as date)\"}]}, \"target\": {\"table\": \"main.${p_env_stg}.${target_table}\"}}",
+                  "parameters_list": "[{\"source_file\": \"TableA\", \"target_table\": \"table_a\", \"p_env_stg\": \"stg_example\", \"p_folder\": \"foldera\"}, {\"source_file\": \"TableB\", \"target_table\": \"table_b\", \"p_env_stg\": \"stg_example\", \"p_folder\": \"folderb\"}]"
+                },
+                "notebook_path": "/Shared/notebook",
+                "source": "WORKSPACE"
+              },
+              "task_key": "run_generic_ingestion"
+            }
+          ]
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/escaped_refs/out.test.toml b/acceptance/bundle/escaped_refs/out.test.toml
new file mode 100644
index 00000000000..f7fafbcc731
--- /dev/null
+++ b/acceptance/bundle/escaped_refs/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/escaped_refs/output.txt b/acceptance/bundle/escaped_refs/output.txt
new file mode 100644
index 00000000000..6dec4fd2c6b
--- /dev/null
+++ b/acceptance/bundle/escaped_refs/output.txt
@@ -0,0 +1,58 @@
+
+=== Validate: escapes are still escaped in the config
+>>> [CLI] bundle validate -o json
+{
+  "generic_config": "{\"source\": {\"path\": \"landing/$${p_folder}/$${source_file}_*.csv\"}, \"schema\": {\"columns\": [{\"name\": \"w_batch_id\", \"expression\": \"$${batch_id}\"}, {\"name\": \"w_business_dt\", \"expression\": \"cast('$${business_date[0..9]}' as date)\"}]}, \"target\": {\"table\": \"main.$${p_env_stg}.$${target_table}\"}}",
+  "parameters_list": "[{\"source_file\": \"TableA\", \"target_table\": \"table_a\", \"p_env_stg\": \"stg_example\", \"p_folder\": \"foldera\"}, {\"source_file\": \"TableB\", \"target_table\": \"table_b\", \"p_env_stg\": \"stg_example\", \"p_folder\": \"folderb\"}]"
+}
+
+=== Plan (json)
+>>> [CLI] bundle plan -o json
+
+=== Deploy: payload sent to the jobs API
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Created jobs.example_ingestion_job
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //jobs --nostamp
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/create",
+  "body": {
+    "deployment": {
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/state/metadata.json"
+    },
+    "edit_mode": "UI_LOCKED",
+    "format": "MULTI_TASK",
+    "max_concurrent_runs": 1,
+    "name": "test-job-[UNIQUE_NAME]",
+    "parameters": [
+      {
+        "default": "{{job.id}}",
+        "name": "batch_id"
+      },
+      {
+        "default": "{{job.start_time.iso_date}}",
+        "name": "business_date"
+      }
+    ],
+    "queue": {
+      "enabled": true
+    },
+    "tasks": [
+      {
+        "notebook_task": {
+          "base_parameters": {
+            "generic_config": "{\"source\": {\"path\": \"landing/${p_folder}/${source_file}_*.csv\"}, \"schema\": {\"columns\": [{\"name\": \"w_batch_id\", \"expression\": \"${batch_id}\"}, {\"name\": \"w_business_dt\", \"expression\": \"cast('${business_date[0..9]}' as date)\"}]}, \"target\": {\"table\": \"main.${p_env_stg}.${target_table}\"}}",
+            "parameters_list": "[{\"source_file\": \"TableA\", \"target_table\": \"table_a\", \"p_env_stg\": \"stg_example\", \"p_folder\": \"foldera\"}, {\"source_file\": \"TableB\", \"target_table\": \"table_b\", \"p_env_stg\": \"stg_example\", \"p_folder\": \"folderb\"}]"
+          },
+          "notebook_path": "/Shared/notebook",
+          "source": "WORKSPACE"
+        },
+        "task_key": "run_generic_ingestion"
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/escaped_refs/script b/acceptance/bundle/escaped_refs/script
new file mode 100644
index 00000000000..2cce0c25096
--- /dev/null
+++ b/acceptance/bundle/escaped_refs/script
@@ -0,0 +1,29 @@
+# Deploys the same config the invariant suite uses, and records the plan and the
+# job payload so both engines are shown to send "${...}" (single $) to the API.
+envsubst < "$TESTDIR/../invariant/configs/job_escaped_refs.yml.tmpl" > databricks.yml
+# The raw plan the replay reads goes under .databricks, which sync skips, so it stays out of the
+# uploaded file count.
+mkdir -p .databricks
+
+cleanup() {
+    $CLI bundle destroy --auto-approve &> LOG.destroy
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+title "Validate: escapes are still escaped in the config"
+trace $CLI bundle validate -o json | jq '.resources.jobs.example_ingestion_job.tasks[0].notebook_task.base_parameters'
+
+title "Plan (json)"
+trace $CLI bundle plan -o json > .databricks/tmp.plan.json
+# The golden gets the stamped-out copy; the replay below reads the raw one, which still carries
+# the DMS headers deploy --plan validates.
+nostamp < .databricks/tmp.plan.json > out.plan.json
+
+# Not traced: the READPLAN variant adds "--plan ...", and the point of that variant is
+# that the payload below is identical either way.
+title "Deploy: payload sent to the jobs API\n"
+$CLI bundle deploy $(readplanarg .databricks/tmp.plan.json)
+# --nostamp: under deployment-history recording the job payload carries the DMS deployment
+# stamp; drop it so the assertion is the same whether or not recording is on.
+trace print_requests.py //jobs --nostamp
diff --git a/acceptance/bundle/escaped_refs/test.toml b/acceptance/bundle/escaped_refs/test.toml
new file mode 100644
index 00000000000..e7b9cac3bf1
--- /dev/null
+++ b/acceptance/bundle/escaped_refs/test.toml
@@ -0,0 +1,10 @@
+RecordRequests = true
+
+# Also deploy from the saved plan, so the unescaped payload is asserted whether it
+# is built in-process or read back from a plan file.
+EnvMatrix.READPLAN = ["", "1"]
+
+Ignore = [
+    ".databricks",
+    "databricks.yml",
+]
diff --git a/acceptance/bundle/experimental/skip_name_prefix_for_schema/out.test.toml b/acceptance/bundle/experimental/skip_name_prefix_for_schema/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/experimental/skip_name_prefix_for_schema/out.test.toml
+++ b/acceptance/bundle/experimental/skip_name_prefix_for_schema/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/generate/alert/alert.json.tmpl b/acceptance/bundle/generate/alert/alert.json.tmpl
index a085d681174..463c9236c12 100644
--- a/acceptance/bundle/generate/alert/alert.json.tmpl
+++ b/acceptance/bundle/generate/alert/alert.json.tmpl
@@ -1,6 +1,6 @@
 {
   "display_name": "test alert",
-  "parent_path": "/Workspace/test-$UNIQUE_NAME",
+  "parent_path": "/Workspace/Users/$CURRENT_USER_NAME/test-$UNIQUE_NAME",
   "query_text": "SELECT 1\n as value",
   "warehouse_id": "$TEST_DEFAULT_WAREHOUSE_ID",
   "evaluation": {
diff --git a/acceptance/bundle/generate/alert/out.test.toml b/acceptance/bundle/generate/alert/out.test.toml
index 650836edeb3..0f167effef1 100644
--- a/acceptance/bundle/generate/alert/out.test.toml
+++ b/acceptance/bundle/generate/alert/out.test.toml
@@ -1,3 +1,2 @@
-Local = false
 Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/generate/alert/output.txt b/acceptance/bundle/generate/alert/output.txt
index 9d8a9f77ebe..774cd68f1ca 100644
--- a/acceptance/bundle/generate/alert/output.txt
+++ b/acceptance/bundle/generate/alert/output.txt
@@ -1,6 +1,16 @@
 
->>> [CLI] workspace mkdirs /Workspace/test-[UNIQUE_NAME]
+>>> [CLI] workspace mkdirs /Workspace/Users/[USERNAME]/test-[UNIQUE_NAME]
 
->>> [CLI] bundle generate alert --existing-id [NUMID] --source-dir out/alert --config-dir out/resource
+>>> [CLI] bundle generate alert --existing-id [ALERT_ID] --source-dir out/alert --config-dir out/resource
 Alert configuration successfully saved to [TEST_TMP_DIR]/out/resource/test_alert.alert.yml
 Serialized alert definition to [TEST_TMP_DIR]/out/alert/test_alert.dbalert.json
+Warning: Generated configuration is not included in the bundle
+
+The file out/resource/test_alert.alert.yml is not matched by any pattern in the 'include' section of databricks.yml,
+so it will not be deployed. Add a matching entry to the 'include' section, for example:
+
+include:
+  - out/resource/*.yml
+
+
+>>> [CLI] workspace delete /Workspace/Users/[USERNAME]/test-[UNIQUE_NAME] --recursive
diff --git a/acceptance/bundle/generate/alert/script b/acceptance/bundle/generate/alert/script
index ae40309f984..1d5e4b165d5 100644
--- a/acceptance/bundle/generate/alert/script
+++ b/acceptance/bundle/generate/alert/script
@@ -1,8 +1,9 @@
-trace $CLI workspace mkdirs /Workspace/test-$UNIQUE_NAME
+trace $CLI workspace mkdirs /Workspace/Users/$CURRENT_USER_NAME/test-$UNIQUE_NAME
 
 # create an alert to import
 envsubst < alert.json.tmpl > alert.json
 alert_id=$($CLI alerts-v2 create-alert --json @alert.json | jq -r '.id')
+add_repl "$alert_id" ALERT_ID
 rm alert.json
 
 trace $CLI bundle generate alert --existing-id $alert_id --source-dir out/alert --config-dir out/resource
diff --git a/acceptance/bundle/generate/alert/script.cleanup b/acceptance/bundle/generate/alert/script.cleanup
new file mode 100644
index 00000000000..df9daf87f47
--- /dev/null
+++ b/acceptance/bundle/generate/alert/script.cleanup
@@ -0,0 +1 @@
+trace $CLI workspace delete /Workspace/Users/$CURRENT_USER_NAME/test-$UNIQUE_NAME --recursive
diff --git a/acceptance/bundle/generate/alert/test.toml b/acceptance/bundle/generate/alert/test.toml
index 265f116f5d1..4cddd3268e8 100644
--- a/acceptance/bundle/generate/alert/test.toml
+++ b/acceptance/bundle/generate/alert/test.toml
@@ -1,13 +1,10 @@
 Cloud = true
-Local = false
-
 # Alert tests timeout during bundle deploy (hang at file upload for 50+ minutes).
 # Use aggressive 5-minute timeout until the issue is resolved.
 # See: https://github.com/databricks/cli/issues/4221
 TimeoutCloud = "5m"
 
-[Env]
 # MSYS2 automatically converts absolute paths like /Users/$username/$UNIQUE_NAME to
 # C:/Program Files/Git/Users/$username/UNIQUE_NAME before passing it to the CLI
 # Setting this environment variable prevents that conversion on windows.
-MSYS_NO_PATHCONV = "1"
+Env.MSYS_NO_PATHCONV = "1"
diff --git a/acceptance/bundle/generate/alert_existing_id_not_found/out.test.toml b/acceptance/bundle/generate/alert_existing_id_not_found/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/generate/alert_existing_id_not_found/out.test.toml
+++ b/acceptance/bundle/generate/alert_existing_id_not_found/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/generate/alert_existing_id_not_found/output.txt b/acceptance/bundle/generate/alert_existing_id_not_found/output.txt
index 3f841a92798..20e75bf0ff7 100644
--- a/acceptance/bundle/generate/alert_existing_id_not_found/output.txt
+++ b/acceptance/bundle/generate/alert_existing_id_not_found/output.txt
@@ -1,5 +1,3 @@
 
->>> errcode [CLI] bundle generate alert --existing-id f00dcafe
+>>> musterr [CLI] bundle generate alert --existing-id f00dcafe
 Error: alert with ID f00dcafe not found
-
-Exit code: 1
diff --git a/acceptance/bundle/generate/alert_existing_id_not_found/script b/acceptance/bundle/generate/alert_existing_id_not_found/script
index 85edf127c61..b84a42bd8c2 100644
--- a/acceptance/bundle/generate/alert_existing_id_not_found/script
+++ b/acceptance/bundle/generate/alert_existing_id_not_found/script
@@ -1,2 +1,2 @@
 # Test that bundle generate alert fails when the existing ID is not found
-trace errcode $CLI bundle generate alert --existing-id f00dcafe
+trace musterr $CLI bundle generate alert --existing-id f00dcafe
diff --git a/acceptance/bundle/generate/app_git_backed/databricks.yml b/acceptance/bundle/generate/app_git_backed/databricks.yml
new file mode 100644
index 00000000000..33f02e64d95
--- /dev/null
+++ b/acceptance/bundle/generate/app_git_backed/databricks.yml
@@ -0,0 +1,2 @@
+bundle:
+  name: app_git_backed
diff --git a/acceptance/bundle/generate/app_git_backed/out.app.yml b/acceptance/bundle/generate/app_git_backed/out.app.yml
new file mode 100644
index 00000000000..a8ddc85733b
--- /dev/null
+++ b/acceptance/bundle/generate/app_git_backed/out.app.yml
@@ -0,0 +1,12 @@
+resources:
+  apps:
+    out:
+      name: my_git_app
+      description: This is a git-backed app
+      git_repository:
+        url: https://github.com/my-org/my-repo
+        provider: gitHub
+        auto_deploy: true
+      git_source:
+        branch: main
+        source_code_path: apps/my-app
diff --git a/acceptance/bundle/generate/app_git_backed/out.test.toml b/acceptance/bundle/generate/app_git_backed/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/generate/app_git_backed/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/generate/app_git_backed/output.txt b/acceptance/bundle/generate/app_git_backed/output.txt
new file mode 100644
index 00000000000..8b097941315
--- /dev/null
+++ b/acceptance/bundle/generate/app_git_backed/output.txt
@@ -0,0 +1,10 @@
+Loading app 'my_git_app' configuration
+App configuration successfully saved to out.app.yml
+Warning: Generated configuration is not included in the bundle
+
+The file out.app.yml is not matched by any pattern in the 'include' section of databricks.yml,
+so it will not be deployed. Add a matching entry to the 'include' section, for example:
+
+include:
+  - *.yml
+
diff --git a/acceptance/bundle/generate/app_git_backed/script b/acceptance/bundle/generate/app_git_backed/script
new file mode 100644
index 00000000000..8f39e55343f
--- /dev/null
+++ b/acceptance/bundle/generate/app_git_backed/script
@@ -0,0 +1 @@
+$CLI bundle generate app --existing-app-name my_git_app --config-dir . --key out
diff --git a/acceptance/bundle/generate/app_git_backed/test.toml b/acceptance/bundle/generate/app_git_backed/test.toml
new file mode 100644
index 00000000000..096f61774f7
--- /dev/null
+++ b/acceptance/bundle/generate/app_git_backed/test.toml
@@ -0,0 +1,18 @@
+[[Server]]
+Pattern = "GET /api/2.0/apps/my_git_app"
+Response.Body = '''
+{
+    "app_id": "1234567890",
+    "name": "my_git_app",
+    "description": "This is a git-backed app",
+    "git_repository": {
+        "url": "https://github.com/my-org/my-repo",
+        "provider": "gitHub",
+        "auto_deploy": true
+    },
+    "git_source": {
+        "branch": "main",
+        "source_code_path": "apps/my-app"
+    }
+}
+'''
diff --git a/acceptance/bundle/generate/app_not_yet_deployed/out.test.toml b/acceptance/bundle/generate/app_not_yet_deployed/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/generate/app_not_yet_deployed/out.test.toml
+++ b/acceptance/bundle/generate/app_not_yet_deployed/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/generate/app_not_yet_deployed/output.txt b/acceptance/bundle/generate/app_not_yet_deployed/output.txt
index 8c0e62433e5..a1df279fd54 100644
--- a/acceptance/bundle/generate/app_not_yet_deployed/output.txt
+++ b/acceptance/bundle/generate/app_not_yet_deployed/output.txt
@@ -2,18 +2,19 @@
 >>> [CLI] apps create my-app --no-compute --no-wait
 {
   "app_status": {
-    "message": "Application is running.",
-    "state": "RUNNING"
+    "message": "App status is unavailable.",
+    "state": "UNAVAILABLE"
   },
   "compute_size": "MEDIUM",
   "compute_status": {
     "message": "App compute is stopped.",
     "state": "STOPPED"
   },
+  "forward_user_access_token": true,
   "id": "1000",
   "name": "my-app",
   "service_principal_client_id": "[UUID]",
-  "service_principal_id": [NUMID],
+  "service_principal_id": [SERVICE_PRINCIPAL_ID],
   "service_principal_name": "app-my-app",
   "url": "my-app-123.cloud.databricksapps.com"
 }
@@ -21,3 +22,11 @@
 >>> [CLI] bundle generate app --existing-app-name my-app --config-dir . --key out
 Loading app 'my-app' configuration
 App configuration successfully saved to out.app.yml
+Warning: Generated configuration is not included in the bundle
+
+The file out.app.yml is not matched by any pattern in the 'include' section of databricks.yml,
+so it will not be deployed. Add a matching entry to the 'include' section, for example:
+
+include:
+  - *.yml
+
diff --git a/acceptance/bundle/generate/app_not_yet_deployed/script b/acceptance/bundle/generate/app_not_yet_deployed/script
index 8883d05d15d..1dae6245c35 100644
--- a/acceptance/bundle/generate/app_not_yet_deployed/script
+++ b/acceptance/bundle/generate/app_not_yet_deployed/script
@@ -1,2 +1,4 @@
-trace $CLI apps create my-app --no-compute --no-wait
+trace $CLI apps create my-app --no-compute --no-wait | tee app.json.tmp
+add_repl "$(sed -n 's/.*"service_principal_id": \([0-9]*\).*/\1/p' app.json.tmp)" SERVICE_PRINCIPAL_ID
+rm app.json.tmp
 trace $CLI bundle generate app --existing-app-name my-app --config-dir . --key out
diff --git a/acceptance/bundle/generate/app_not_yet_deployed/test.toml b/acceptance/bundle/generate/app_not_yet_deployed/test.toml
deleted file mode 100644
index 7d36fb9dc18..00000000000
--- a/acceptance/bundle/generate/app_not_yet_deployed/test.toml
+++ /dev/null
@@ -1,2 +0,0 @@
-Local = true
-Cloud = false
diff --git a/acceptance/bundle/generate/app_subfolders/out.test.toml b/acceptance/bundle/generate/app_subfolders/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/generate/app_subfolders/out.test.toml
+++ b/acceptance/bundle/generate/app_subfolders/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/generate/app_subfolders/output.txt b/acceptance/bundle/generate/app_subfolders/output.txt
index 654d38ed1d6..40c2705cae3 100644
--- a/acceptance/bundle/generate/app_subfolders/output.txt
+++ b/acceptance/bundle/generate/app_subfolders/output.txt
@@ -1,3 +1,11 @@
 Loading app 'my_app' configuration
 File successfully saved to out/sub/folder/1.py
 App configuration successfully saved to out.app.yml
+Warning: Generated configuration is not included in the bundle
+
+The file out.app.yml is not matched by any pattern in the 'include' section of databricks.yml,
+so it will not be deployed. Add a matching entry to the 'include' section, for example:
+
+include:
+  - *.yml
+
diff --git a/acceptance/bundle/generate/auto-bind/databricks.yml.tmpl b/acceptance/bundle/generate/auto-bind/databricks.yml.tmpl
index c58a4bbd14c..49ff482e7f0 100644
--- a/acceptance/bundle/generate/auto-bind/databricks.yml.tmpl
+++ b/acceptance/bundle/generate/auto-bind/databricks.yml.tmpl
@@ -2,7 +2,7 @@ bundle:
   name: auto-bind-test
 
 workspace:
-  root_path: /tmp/${UNIQUE_NAME}
+  root_path: ~/.bundle/auto-bind-test-${UNIQUE_NAME}
 
 include:
   - resources/*.yml
diff --git a/acceptance/bundle/generate/auto-bind/out.test.toml b/acceptance/bundle/generate/auto-bind/out.test.toml
index 14e5fee5e76..f68b4a89c36 100644
--- a/acceptance/bundle/generate/auto-bind/out.test.toml
+++ b/acceptance/bundle/generate/auto-bind/out.test.toml
@@ -1,3 +1,2 @@
-Local = false
 Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/generate/auto-bind/output.txt b/acceptance/bundle/generate/auto-bind/output.txt
index fd574b5f7b2..e7a43c9c50e 100644
--- a/acceptance/bundle/generate/auto-bind/output.txt
+++ b/acceptance/bundle/generate/auto-bind/output.txt
@@ -1,17 +1,16 @@
 
 === Create a pre-defined job:
-Created job with ID: [NUMID]
+Created job with ID: [JOB_ID]
 
 >>> [CLI] workspace mkdirs /Workspace/Users/[USERNAME]/python-[UNIQUE_NAME]
 
 >>> [CLI] workspace import /Workspace/Users/[USERNAME]/python-[UNIQUE_NAME]/test --file test.py --language PYTHON
 
 === Generate and bind in one step:
->>> [CLI] bundle generate job --key test_job --existing-job-id [NUMID] --config-dir resources --source-dir src --bind
+>>> [CLI] bundle generate job --key test_job --existing-job-id [JOB_ID] --config-dir resources --source-dir src --bind
 File successfully saved to src/test.py
 Job configuration successfully saved to resources/test_job.job.yml
-Updating deployment state...
-Successfully bound job with an id '[NUMID]'
+Successfully bound job with an id '[JOB_ID]'
 
 >>> ls src/
 test.py
@@ -21,24 +20,23 @@ test.py
 
 === Deploy the bound job:
 >>> [CLI] bundle deploy
-Uploading bundle files to /Workspace/tmp/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/auto-bind-test-[UNIQUE_NAME]/files...
+Updated jobs.test_job
+Files: 5 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
 === Destroy the bundle:
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
   delete resources.jobs.test_job
 
-All files and directories at the following location will be deleted: /Workspace/tmp/[UNIQUE_NAME]
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/auto-bind-test-[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
 
 === Check that job is bound and does not exist after bundle is destroyed:
->>> errcode [CLI] jobs get [NUMID] --output json
-Error: Job [NUMID] does not exist.
+>>> errcode [CLI] jobs get [JOB_ID] --output json
+Error: Job [JOB_ID] does not exist.
 
 Exit code: 1
 
diff --git a/acceptance/bundle/generate/auto-bind/script b/acceptance/bundle/generate/auto-bind/script
index f6517a8adb6..542dc0b96d6 100755
--- a/acceptance/bundle/generate/auto-bind/script
+++ b/acceptance/bundle/generate/auto-bind/script
@@ -20,6 +20,7 @@ JOB_ID=$($CLI jobs create --json '
     }
   ]
 }' | jq -r '.job_id')
+add_repl "$JOB_ID" JOB_ID
 
 echo "Created job with ID: $JOB_ID"
 
diff --git a/acceptance/bundle/generate/auto-bind/test.toml b/acceptance/bundle/generate/auto-bind/test.toml
index a5b40dd31a5..a318fc61ddd 100644
--- a/acceptance/bundle/generate/auto-bind/test.toml
+++ b/acceptance/bundle/generate/auto-bind/test.toml
@@ -1,7 +1,3 @@
-# This test is using a workspace import API to load a notebook file.
-# This API has a logic on how to accept notebook files and distinguishes them from regular python files.
-# To succeed locally we would need to replicate this logic in the fake_workspace
-Local = false
 Cloud = true
 
 Ignore = [
@@ -11,12 +7,10 @@ Ignore = [
     ".databricks",
 ]
 
-[EnvMatrix]
-  DATABRICKS_BUNDLE_ENGINE = ["terraform"]
-
-
-[Env]
 # MSYS2 automatically converts absolute paths like /Users/$username/$UNIQUE_NAME to
 # C:/Program Files/Git/Users/$username/UNIQUE_NAME before passing it to the CLI
 # Setting this environment variable prevents that conversion on windows.
-MSYS_NO_PATHCONV = "1"
+Env.MSYS_NO_PATHCONV = "1"
+
+# bind is unsupported with deployment-history recording; pin DMS off so it runs on the plain cell.
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/generate/dashboard-inplace/out.test.toml b/acceptance/bundle/generate/dashboard-inplace/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/generate/dashboard-inplace/out.test.toml
+++ b/acceptance/bundle/generate/dashboard-inplace/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/generate/dashboard-inplace/output.txt b/acceptance/bundle/generate/dashboard-inplace/output.txt
index 90d054197aa..52e5822e308 100644
--- a/acceptance/bundle/generate/dashboard-inplace/output.txt
+++ b/acceptance/bundle/generate/dashboard-inplace/output.txt
@@ -5,9 +5,9 @@
 === deploy initial dashboard
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dashboard update inplace/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created dashboards.test_dashboard
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 === update the dashboard
 >>> [CLI] lakeview update [DASHBOARD_ID] --serialized-dashboard {"a":"b"}
@@ -15,7 +15,7 @@ Deployment complete!
   "create_time": "[TIMESTAMP]",
   "dashboard_id": "[DASHBOARD_ID]",
   "display_name": "test dashboard",
-  "etag": "[NUMID]",
+  "etag": "80611981",
   "lifecycle_state": "ACTIVE",
   "parent_path": "/Users/[USERNAME]/.bundle/dashboard update inplace/default/resources",
   "path": "/Users/[USERNAME]/.bundle/dashboard update inplace/default/resources/test dashboard.lvdash.json",
diff --git a/acceptance/bundle/generate/dashboard/dashboard.json.tmpl b/acceptance/bundle/generate/dashboard/dashboard.json.tmpl
index c6c73dd259f..517a16b6c54 100644
--- a/acceptance/bundle/generate/dashboard/dashboard.json.tmpl
+++ b/acceptance/bundle/generate/dashboard/dashboard.json.tmpl
@@ -1,5 +1,5 @@
 {
     "display_name": "test dashboard",
-    "parent_path": "/Workspace/test-$UNIQUE_NAME",
+    "parent_path": "/Workspace/Users/$CURRENT_USER_NAME/test-$UNIQUE_NAME",
     "serialized_dashboard": "{\"pages\":[{\"displayName\":\"New Page\",\"layout\":[],\"name\":\"12345678\"}]}"
 }
diff --git a/acceptance/bundle/generate/dashboard/out.test.toml b/acceptance/bundle/generate/dashboard/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/generate/dashboard/out.test.toml
+++ b/acceptance/bundle/generate/dashboard/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/generate/dashboard/out/dashboard/test_dashboard.lvdash.json b/acceptance/bundle/generate/dashboard/out/dashboard/test_dashboard.lvdash.json
index 5b9d2826f30..27ba4cd55f6 100644
--- a/acceptance/bundle/generate/dashboard/out/dashboard/test_dashboard.lvdash.json
+++ b/acceptance/bundle/generate/dashboard/out/dashboard/test_dashboard.lvdash.json
@@ -3,7 +3,7 @@
     {
       "displayName": "New Page",
       "layout": [],
-      "name": "[NUMID]",
+      "name": "12345678",
       "pageType": "PAGE_TYPE_CANVAS"
     }
   ]
diff --git a/acceptance/bundle/generate/dashboard/output.txt b/acceptance/bundle/generate/dashboard/output.txt
index 07a77e1097e..095e084f0a8 100644
--- a/acceptance/bundle/generate/dashboard/output.txt
+++ b/acceptance/bundle/generate/dashboard/output.txt
@@ -1,6 +1,16 @@
 
->>> [CLI] workspace mkdirs /Workspace/test-[UNIQUE_NAME]
+>>> [CLI] workspace mkdirs /Workspace/Users/[USERNAME]/test-[UNIQUE_NAME]
 
 >>> [CLI] bundle generate dashboard --existing-id [DASHBOARD_ID] --dashboard-dir out/dashboard --resource-dir out/resource
 Writing dashboard to out/dashboard/test_dashboard.lvdash.json
 Writing configuration to out/resource/test_dashboard.dashboard.yml
+Warning: Generated configuration is not included in the bundle
+
+The file out/resource/test_dashboard.dashboard.yml is not matched by any pattern in the 'include' section of databricks.yml,
+so it will not be deployed. Add a matching entry to the 'include' section, for example:
+
+include:
+  - out/resource/*.yml
+
+
+>>> [CLI] workspace delete /Workspace/Users/[USERNAME]/test-[UNIQUE_NAME] --recursive
diff --git a/acceptance/bundle/generate/dashboard/script b/acceptance/bundle/generate/dashboard/script
index a982ef547d4..aea3a6a694d 100644
--- a/acceptance/bundle/generate/dashboard/script
+++ b/acceptance/bundle/generate/dashboard/script
@@ -1,4 +1,4 @@
-trace $CLI workspace mkdirs /Workspace/test-$UNIQUE_NAME
+trace $CLI workspace mkdirs /Workspace/Users/$CURRENT_USER_NAME/test-$UNIQUE_NAME
 
 # create a dashboard to import
 envsubst < dashboard.json.tmpl > dashboard.json
diff --git a/acceptance/bundle/generate/dashboard/script.cleanup b/acceptance/bundle/generate/dashboard/script.cleanup
new file mode 100644
index 00000000000..df9daf87f47
--- /dev/null
+++ b/acceptance/bundle/generate/dashboard/script.cleanup
@@ -0,0 +1 @@
+trace $CLI workspace delete /Workspace/Users/$CURRENT_USER_NAME/test-$UNIQUE_NAME --recursive
diff --git a/acceptance/bundle/generate/dashboard/test.toml b/acceptance/bundle/generate/dashboard/test.toml
index 85f8e4285a0..894c7043333 100644
--- a/acceptance/bundle/generate/dashboard/test.toml
+++ b/acceptance/bundle/generate/dashboard/test.toml
@@ -1,6 +1,5 @@
+Env.MSYS_NO_PATHCONV = "1"
+
 [[Repls]]
 Old = "[0-9a-f]{32}"
 New = "[DASHBOARD_ID]"
-
-[Env]
-MSYS_NO_PATHCONV = "1"
diff --git a/acceptance/bundle/generate/dashboard_existing_id_not_found/out.test.toml b/acceptance/bundle/generate/dashboard_existing_id_not_found/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/generate/dashboard_existing_id_not_found/out.test.toml
+++ b/acceptance/bundle/generate/dashboard_existing_id_not_found/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/generate/dashboard_existing_path_nominal/out.test.toml b/acceptance/bundle/generate/dashboard_existing_path_nominal/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/generate/dashboard_existing_path_nominal/out.test.toml
+++ b/acceptance/bundle/generate/dashboard_existing_path_nominal/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/generate/dashboard_existing_path_nominal/out/dashboard/custom_key.lvdash.json b/acceptance/bundle/generate/dashboard_existing_path_nominal/out/dashboard/custom_key.lvdash.json
new file mode 100644
index 00000000000..ff23ab6f19b
--- /dev/null
+++ b/acceptance/bundle/generate/dashboard_existing_path_nominal/out/dashboard/custom_key.lvdash.json
@@ -0,0 +1,9 @@
+{
+  "pages": [
+    {
+      "displayName": "New Page",
+      "layout": [],
+      "name": "12345678"
+    }
+  ]
+}
diff --git a/acceptance/bundle/generate/dashboard_existing_path_nominal/out/dashboard/this_is_a_test_dashboard.lvdash.json b/acceptance/bundle/generate/dashboard_existing_path_nominal/out/dashboard/this_is_a_test_dashboard.lvdash.json
index ea901f555c7..ff23ab6f19b 100644
--- a/acceptance/bundle/generate/dashboard_existing_path_nominal/out/dashboard/this_is_a_test_dashboard.lvdash.json
+++ b/acceptance/bundle/generate/dashboard_existing_path_nominal/out/dashboard/this_is_a_test_dashboard.lvdash.json
@@ -3,7 +3,7 @@
     {
       "displayName": "New Page",
       "layout": [],
-      "name": "[NUMID]"
+      "name": "12345678"
     }
   ]
 }
diff --git a/acceptance/bundle/generate/dashboard_existing_path_nominal/out/resource/custom_key.dashboard.yml b/acceptance/bundle/generate/dashboard_existing_path_nominal/out/resource/custom_key.dashboard.yml
new file mode 100644
index 00000000000..43eec1b9664
--- /dev/null
+++ b/acceptance/bundle/generate/dashboard_existing_path_nominal/out/resource/custom_key.dashboard.yml
@@ -0,0 +1,6 @@
+resources:
+  dashboards:
+    custom_key:
+      display_name: "This is a test dashboard"
+      warehouse_id: w4r3h0us3
+      file_path: ../dashboard/custom_key.lvdash.json
diff --git a/acceptance/bundle/generate/dashboard_existing_path_nominal/output.txt b/acceptance/bundle/generate/dashboard_existing_path_nominal/output.txt
index de3519416c9..3b76a51c84b 100644
--- a/acceptance/bundle/generate/dashboard_existing_path_nominal/output.txt
+++ b/acceptance/bundle/generate/dashboard_existing_path_nominal/output.txt
@@ -2,3 +2,23 @@
 >>> [CLI] bundle generate dashboard --existing-path /path/to/dashboard --dashboard-dir out/dashboard --resource-dir out/resource
 Writing dashboard to out/dashboard/this_is_a_test_dashboard.lvdash.json
 Writing configuration to out/resource/this_is_a_test_dashboard.dashboard.yml
+Warning: Generated configuration is not included in the bundle
+
+The file out/resource/this_is_a_test_dashboard.dashboard.yml is not matched by any pattern in the 'include' section of databricks.yml,
+so it will not be deployed. Add a matching entry to the 'include' section, for example:
+
+include:
+  - out/resource/*.yml
+
+
+>>> [CLI] bundle generate dashboard --existing-path /path/to/dashboard --key custom_key --dashboard-dir out/dashboard --resource-dir out/resource
+Writing dashboard to out/dashboard/custom_key.lvdash.json
+Writing configuration to out/resource/custom_key.dashboard.yml
+Warning: Generated configuration is not included in the bundle
+
+The file out/resource/custom_key.dashboard.yml is not matched by any pattern in the 'include' section of databricks.yml,
+so it will not be deployed. Add a matching entry to the 'include' section, for example:
+
+include:
+  - out/resource/*.yml
+
diff --git a/acceptance/bundle/generate/dashboard_existing_path_nominal/script b/acceptance/bundle/generate/dashboard_existing_path_nominal/script
index 60f26d10841..814370542d9 100644
--- a/acceptance/bundle/generate/dashboard_existing_path_nominal/script
+++ b/acceptance/bundle/generate/dashboard_existing_path_nominal/script
@@ -1,2 +1,4 @@
 # Test generating dashboard from existing path
 trace $CLI bundle generate dashboard --existing-path /path/to/dashboard --dashboard-dir out/dashboard --resource-dir out/resource
+
+trace $CLI bundle generate dashboard --existing-path /path/to/dashboard --key custom_key --dashboard-dir out/dashboard --resource-dir out/resource
diff --git a/acceptance/bundle/generate/dashboard_existing_path_not_found/out.test.toml b/acceptance/bundle/generate/dashboard_existing_path_not_found/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/generate/dashboard_existing_path_not_found/out.test.toml
+++ b/acceptance/bundle/generate/dashboard_existing_path_not_found/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/generate/dashboard_existing_path_not_found/test.toml b/acceptance/bundle/generate/dashboard_existing_path_not_found/test.toml
new file mode 100644
index 00000000000..92e4b6925d3
--- /dev/null
+++ b/acceptance/bundle/generate/dashboard_existing_path_not_found/test.toml
@@ -0,0 +1 @@
+Env.MSYS_NO_PATHCONV = "1"
diff --git a/acceptance/bundle/generate/designer_job/databricks.yml b/acceptance/bundle/generate/designer_job/databricks.yml
new file mode 100644
index 00000000000..c613c584b4c
--- /dev/null
+++ b/acceptance/bundle/generate/designer_job/databricks.yml
@@ -0,0 +1,2 @@
+bundle:
+  name: designer_job
diff --git a/acceptance/bundle/generate/designer_job/out.job.yml b/acceptance/bundle/generate/designer_job/out.job.yml
new file mode 100644
index 00000000000..26afb0e4911
--- /dev/null
+++ b/acceptance/bundle/generate/designer_job/out.job.yml
@@ -0,0 +1,8 @@
+resources:
+  jobs:
+    out:
+      name: designer_job
+      tasks:
+        - task_key: test_task
+          notebook_task:
+            notebook_path: outnotebook.designer.ipynb
diff --git a/acceptance/bundle/generate/designer_job/out.test.toml b/acceptance/bundle/generate/designer_job/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/generate/designer_job/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/generate/designer_job/outnotebook.designer.ipynb b/acceptance/bundle/generate/designer_job/outnotebook.designer.ipynb
new file mode 100644
index 00000000000..80786d9e2f0
--- /dev/null
+++ b/acceptance/bundle/generate/designer_job/outnotebook.designer.ipynb
@@ -0,0 +1,52 @@
+{
+ "cells": [
+  {
+   "cell_type": "code",
+   "execution_count": 0,
+   "metadata": {
+    "application/vnd.databricks.v1+cell": {
+     "cellMetadata": {},
+     "inputWidgets": {},
+     "nuid": "[UUID]",
+     "showTitle": false,
+     "tableResultSettingsMap": {},
+     "title": ""
+    }
+   },
+   "outputs": [],
+   "source": [
+    "%python\n",
+    "\n",
+    "print(\"Hello, World!\")"
+   ]
+  }
+ ],
+ "metadata": {
+  "application/vnd.databricks.v1+notebook": {
+   "computePreferences": {
+    "hardware": {
+     "accelerator": null,
+     "gpuPoolId": null,
+     "memory": null
+    }
+   },
+   "dashboards": [],
+   "environmentMetadata": {
+    "base_environment": "",
+    "environment_version": "1"
+   },
+   "inputWidgetPreferences": null,
+   "language": "python",
+   "notebookMetadata": {
+    "pythonIndentUnit": 2
+   },
+   "notebookName": "test",
+   "widgets": {}
+  },
+  "language_info": {
+   "name": "python"
+  }
+ },
+ "nbformat": 4,
+ "nbformat_minor": 0
+}
diff --git a/acceptance/bundle/generate/designer_job/output.txt b/acceptance/bundle/generate/designer_job/output.txt
new file mode 100644
index 00000000000..44c322537b7
--- /dev/null
+++ b/acceptance/bundle/generate/designer_job/output.txt
@@ -0,0 +1,10 @@
+File successfully saved to outnotebook.designer.ipynb
+Job configuration successfully saved to out.job.yml
+Warning: Generated configuration is not included in the bundle
+
+The file out.job.yml is not matched by any pattern in the 'include' section of databricks.yml,
+so it will not be deployed. Add a matching entry to the 'include' section, for example:
+
+include:
+  - *.yml
+
diff --git a/acceptance/bundle/generate/designer_job/script b/acceptance/bundle/generate/designer_job/script
new file mode 100644
index 00000000000..16cfc1589ce
--- /dev/null
+++ b/acceptance/bundle/generate/designer_job/script
@@ -0,0 +1 @@
+$CLI bundle generate job --existing-job-id 1234 --config-dir . --key out --force --source-dir .
diff --git a/acceptance/bundle/generate/designer_job/test.toml b/acceptance/bundle/generate/designer_job/test.toml
new file mode 100644
index 00000000000..adbcec08593
--- /dev/null
+++ b/acceptance/bundle/generate/designer_job/test.toml
@@ -0,0 +1,86 @@
+[[Server]]
+Pattern = "GET /api/2.2/jobs/get"
+Response.Body = '''
+{
+    "job_id": 11223344,
+    "settings": {
+        "name": "designer_job",
+        "tasks": [
+            {
+                "task_key": "test_task",
+                "notebook_task": {
+                    "notebook_path": "/Workspace/Users/tester@databricks.com/outnotebook.designer.ipynb"
+                }
+            }
+        ]
+    }
+}
+'''
+
+# Lakeflow Designer files are stored as DESIGNER_FILE objects and get-status
+# reports no repos_export_format for them.
+[[Server]]
+Pattern = "GET /api/2.0/workspace/get-status"
+Response.Body = '''
+{
+    "path": "/Workspace/Users/tester@databricks.com/outnotebook.designer.ipynb",
+    "object_type": "DESIGNER_FILE"
+}
+'''
+
+[[Server]]
+Pattern = "GET /api/2.0/workspace/export"
+Response.Body = '''
+{
+ "cells": [
+  {
+   "cell_type": "code",
+   "execution_count": 0,
+   "metadata": {
+    "application/vnd.databricks.v1+cell": {
+     "cellMetadata": {},
+     "inputWidgets": {},
+     "nuid": "7027244a-b958-4dca-aca6-57a2c638f368",
+     "showTitle": false,
+     "tableResultSettingsMap": {},
+     "title": ""
+    }
+   },
+   "outputs": [],
+   "source": [
+    "%python\n",
+    "\n",
+    "print(\"Hello, World!\")"
+   ]
+  }
+ ],
+ "metadata": {
+  "application/vnd.databricks.v1+notebook": {
+   "computePreferences": {
+    "hardware": {
+     "accelerator": null,
+     "gpuPoolId": null,
+     "memory": null
+    }
+   },
+   "dashboards": [],
+   "environmentMetadata": {
+    "base_environment": "",
+    "environment_version": "1"
+   },
+   "inputWidgetPreferences": null,
+   "language": "python",
+   "notebookMetadata": {
+    "pythonIndentUnit": 2
+   },
+   "notebookName": "test",
+   "widgets": {}
+  },
+  "language_info": {
+   "name": "python"
+  }
+ },
+ "nbformat": 4,
+ "nbformat_minor": 0
+}
+'''
diff --git a/acceptance/bundle/generate/genie_space/databricks.yml b/acceptance/bundle/generate/genie_space/databricks.yml
new file mode 100644
index 00000000000..c533b2b6f98
--- /dev/null
+++ b/acceptance/bundle/generate/genie_space/databricks.yml
@@ -0,0 +1,2 @@
+bundle:
+  name: genie-space-generate
diff --git a/acceptance/bundle/generate/genie_space/genie_space.json.tmpl b/acceptance/bundle/generate/genie_space/genie_space.json.tmpl
new file mode 100644
index 00000000000..2692e17dfca
--- /dev/null
+++ b/acceptance/bundle/generate/genie_space/genie_space.json.tmpl
@@ -0,0 +1,7 @@
+{
+    "title": "test genie space",
+    "description": "test description",
+    "parent_path": "/Workspace/Users/$CURRENT_USER_NAME/test-$UNIQUE_NAME",
+    "warehouse_id": "test-warehouse-id",
+    "serialized_space": "{\"tables\":[],\"questions\":[]}"
+}
diff --git a/acceptance/bundle/generate/genie_space/out.test.toml b/acceptance/bundle/generate/genie_space/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/generate/genie_space/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/generate/genie_space/out/genie_space/test_genie_space.geniespace.json b/acceptance/bundle/generate/genie_space/out/genie_space/test_genie_space.geniespace.json
new file mode 100644
index 00000000000..2c12b3c032c
--- /dev/null
+++ b/acceptance/bundle/generate/genie_space/out/genie_space/test_genie_space.geniespace.json
@@ -0,0 +1,4 @@
+{
+  "questions": [],
+  "tables": []
+}
diff --git a/acceptance/bundle/generate/genie_space/out/resource/test_genie_space.genie_space.yml b/acceptance/bundle/generate/genie_space/out/resource/test_genie_space.genie_space.yml
new file mode 100644
index 00000000000..c383564eadf
--- /dev/null
+++ b/acceptance/bundle/generate/genie_space/out/resource/test_genie_space.genie_space.yml
@@ -0,0 +1,8 @@
+resources:
+  genie_spaces:
+    test_genie_space:
+      title: "test genie space"
+      warehouse_id: test-warehouse-id
+      file_path: ../genie_space/test_genie_space.geniespace.json
+      description: test description
+      parent_path: /Workspace/Users/[USERNAME]/test-[UNIQUE_NAME]
diff --git a/acceptance/bundle/generate/genie_space/output.txt b/acceptance/bundle/generate/genie_space/output.txt
new file mode 100644
index 00000000000..4a36ad952d6
--- /dev/null
+++ b/acceptance/bundle/generate/genie_space/output.txt
@@ -0,0 +1,16 @@
+
+>>> [CLI] workspace mkdirs /Workspace/Users/[USERNAME]/test-[UNIQUE_NAME]
+
+>>> [CLI] bundle generate genie-space --existing-id [GENIE_SPACE_ID] --genie-space-dir out/genie_space --resource-dir out/resource
+Writing genie space to out/genie_space/test_genie_space.geniespace.json
+Writing configuration to out/resource/test_genie_space.genie_space.yml
+Warning: Generated configuration is not included in the bundle
+
+The file out/resource/test_genie_space.genie_space.yml is not matched by any pattern in the 'include' section of databricks.yml,
+so it will not be deployed. Add a matching entry to the 'include' section, for example:
+
+include:
+  - out/resource/*.yml
+
+
+>>> [CLI] workspace delete /Workspace/Users/[USERNAME]/test-[UNIQUE_NAME] --recursive
diff --git a/acceptance/bundle/generate/genie_space/script b/acceptance/bundle/generate/genie_space/script
new file mode 100644
index 00000000000..246d008be45
--- /dev/null
+++ b/acceptance/bundle/generate/genie_space/script
@@ -0,0 +1,8 @@
+trace $CLI workspace mkdirs /Workspace/Users/$CURRENT_USER_NAME/test-$UNIQUE_NAME
+
+# create a genie space to import
+envsubst < genie_space.json.tmpl > genie_space.json
+genie_space_id=$($CLI genie create-space --json @genie_space.json | jq -r '.space_id')
+rm genie_space.json
+
+trace $CLI bundle generate genie-space --existing-id $genie_space_id --genie-space-dir out/genie_space --resource-dir out/resource
diff --git a/acceptance/bundle/generate/genie_space/script.cleanup b/acceptance/bundle/generate/genie_space/script.cleanup
new file mode 100644
index 00000000000..df9daf87f47
--- /dev/null
+++ b/acceptance/bundle/generate/genie_space/script.cleanup
@@ -0,0 +1 @@
+trace $CLI workspace delete /Workspace/Users/$CURRENT_USER_NAME/test-$UNIQUE_NAME --recursive
diff --git a/acceptance/bundle/generate/genie_space/test.toml b/acceptance/bundle/generate/genie_space/test.toml
new file mode 100644
index 00000000000..3e2bd6b3e12
--- /dev/null
+++ b/acceptance/bundle/generate/genie_space/test.toml
@@ -0,0 +1,9 @@
+Env.MSYS_NO_PATHCONV = "1"
+
+[[Repls]]
+Old = '\\\\'
+New = '/'
+
+[[Repls]]
+Old = "[0-9a-f]{32}"
+New = "[GENIE_SPACE_ID]"
diff --git a/acceptance/bundle/generate/genie_space_existing_id_not_found/databricks.yml b/acceptance/bundle/generate/genie_space_existing_id_not_found/databricks.yml
new file mode 100644
index 00000000000..576d7a9ef25
--- /dev/null
+++ b/acceptance/bundle/generate/genie_space_existing_id_not_found/databricks.yml
@@ -0,0 +1,2 @@
+bundle:
+  name: test-bundle
diff --git a/acceptance/bundle/generate/genie_space_existing_id_not_found/out.test.toml b/acceptance/bundle/generate/genie_space_existing_id_not_found/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/generate/genie_space_existing_id_not_found/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/generate/genie_space_existing_id_not_found/output.txt b/acceptance/bundle/generate/genie_space_existing_id_not_found/output.txt
new file mode 100644
index 00000000000..9dcb26e028d
--- /dev/null
+++ b/acceptance/bundle/generate/genie_space_existing_id_not_found/output.txt
@@ -0,0 +1,4 @@
+
+>>> [CLI] bundle generate genie-space --existing-id f00dcafe
+Error: genie space with ID f00dcafe not found
+
diff --git a/acceptance/bundle/generate/genie_space_existing_id_not_found/script b/acceptance/bundle/generate/genie_space_existing_id_not_found/script
new file mode 100644
index 00000000000..9e301dea727
--- /dev/null
+++ b/acceptance/bundle/generate/genie_space_existing_id_not_found/script
@@ -0,0 +1,2 @@
+# Test that bundle generate genie-space fails when the existing ID is not found
+musterr trace $CLI bundle generate genie-space --existing-id f00dcafe
diff --git a/acceptance/bundle/generate/genie_space_inplace/databricks.yml b/acceptance/bundle/generate/genie_space_inplace/databricks.yml
new file mode 100644
index 00000000000..e5a76861842
--- /dev/null
+++ b/acceptance/bundle/generate/genie_space_inplace/databricks.yml
@@ -0,0 +1,9 @@
+bundle:
+  name: genie space update inplace
+
+resources:
+  genie_spaces:
+    test_genie_space:
+      title: "test genie space"
+      warehouse_id: "my-warehouse-1234"
+      file_path: ./space.geniespace.json
diff --git a/acceptance/bundle/generate/genie_space_inplace/out.test.toml b/acceptance/bundle/generate/genie_space_inplace/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/generate/genie_space_inplace/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/generate/genie_space_inplace/output.txt b/acceptance/bundle/generate/genie_space_inplace/output.txt
new file mode 100644
index 00000000000..13b0736ee12
--- /dev/null
+++ b/acceptance/bundle/generate/genie_space_inplace/output.txt
@@ -0,0 +1,30 @@
+
+>>> cat space.geniespace.json
+{}
+
+=== deploy initial genie space
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/genie space update inplace/default/files...
+Created genie_spaces.test_genie_space
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== update the genie space
+>>> [CLI] genie update-space [GENIE_SPACE_ID] --serialized-space {"a":"b"}
+{
+  "etag": "2",
+  "parent_path": "/Users/[USERNAME]/.bundle/genie space update inplace/default/resources",
+  "serialized_space": "{\"a\":\"b\"}",
+  "space_id": "[GENIE_SPACE_ID]",
+  "title": "test genie space",
+  "warehouse_id": "my-warehouse-1234"
+}
+
+=== update the genie space file using bundle generate
+>>> [CLI] bundle generate genie-space --resource test_genie_space --force
+Writing genie space to space.geniespace.json
+
+>>> cat space.geniespace.json
+{
+  "a": "b"
+}
diff --git a/acceptance/bundle/generate/genie_space_inplace/script b/acceptance/bundle/generate/genie_space_inplace/script
new file mode 100644
index 00000000000..18ca58d2986
--- /dev/null
+++ b/acceptance/bundle/generate/genie_space_inplace/script
@@ -0,0 +1,13 @@
+trace cat space.geniespace.json
+
+title "deploy initial genie space"
+trace $CLI bundle deploy
+genie_space_id=$($CLI bundle summary --output json | jq -r '.resources.genie_spaces.test_genie_space.id')
+
+title "update the genie space"
+trace $CLI genie update-space $genie_space_id --serialized-space '{"a":"b"}'
+
+title "update the genie space file using bundle generate"
+trace $CLI bundle generate genie-space --resource test_genie_space --force
+
+trace cat space.geniespace.json
diff --git a/acceptance/bundle/generate/genie_space_inplace/space.geniespace.json b/acceptance/bundle/generate/genie_space_inplace/space.geniespace.json
new file mode 100644
index 00000000000..0967ef424bc
--- /dev/null
+++ b/acceptance/bundle/generate/genie_space_inplace/space.geniespace.json
@@ -0,0 +1 @@
+{}
diff --git a/acceptance/bundle/generate/genie_space_inplace/test.toml b/acceptance/bundle/generate/genie_space_inplace/test.toml
new file mode 100644
index 00000000000..cdaa88d84ec
--- /dev/null
+++ b/acceptance/bundle/generate/genie_space_inplace/test.toml
@@ -0,0 +1,5 @@
+# Genie spaces are only deployed via the direct deployment engine.
+
+[[Repls]]
+Old = "[0-9a-f]{32}"
+New = "[GENIE_SPACE_ID]"
diff --git a/acceptance/bundle/generate/git_job/out.test.toml b/acceptance/bundle/generate/git_job/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/generate/git_job/out.test.toml
+++ b/acceptance/bundle/generate/git_job/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/generate/git_job/output.txt b/acceptance/bundle/generate/git_job/output.txt
index 680c92ff94a..864f53e7dc1 100644
--- a/acceptance/bundle/generate/git_job/output.txt
+++ b/acceptance/bundle/generate/git_job/output.txt
@@ -1,2 +1,10 @@
 Job is using Git source, skipping downloading files
 Job configuration successfully saved to out.job.yml
+Warning: Generated configuration is not included in the bundle
+
+The file out.job.yml is not matched by any pattern in the 'include' section of databricks.yml,
+so it will not be deployed. Add a matching entry to the 'include' section, for example:
+
+include:
+  - *.yml
+
diff --git a/acceptance/bundle/generate/include_warning/databricks.yml b/acceptance/bundle/generate/include_warning/databricks.yml
new file mode 100644
index 00000000000..4057cf2dd10
--- /dev/null
+++ b/acceptance/bundle/generate/include_warning/databricks.yml
@@ -0,0 +1,5 @@
+bundle:
+  name: include_warning
+
+include:
+  - resources/*.yml
diff --git a/acceptance/bundle/generate/include_warning/out.test.toml b/acceptance/bundle/generate/include_warning/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/generate/include_warning/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/generate/include_warning/output.txt b/acceptance/bundle/generate/include_warning/output.txt
new file mode 100644
index 00000000000..e9869179df8
--- /dev/null
+++ b/acceptance/bundle/generate/include_warning/output.txt
@@ -0,0 +1,16 @@
+
+>>> [CLI] bundle generate job --existing-job-id 1234 --config-dir resources --key included
+Job is using Git source, skipping downloading files
+Job configuration successfully saved to resources/included.job.yml
+
+>>> [CLI] bundle generate job --existing-job-id 1234 --config-dir subdir --key excluded
+Job is using Git source, skipping downloading files
+Job configuration successfully saved to subdir/excluded.job.yml
+Warning: Generated configuration is not included in the bundle
+
+The file subdir/excluded.job.yml is not matched by any pattern in the 'include' section of databricks.yml,
+so it will not be deployed. Add a matching entry to the 'include' section, for example:
+
+include:
+  - subdir/*.yml
+
diff --git a/acceptance/bundle/generate/include_warning/script b/acceptance/bundle/generate/include_warning/script
new file mode 100644
index 00000000000..87f7afeb37a
--- /dev/null
+++ b/acceptance/bundle/generate/include_warning/script
@@ -0,0 +1,11 @@
+# A resource generated into a directory matched by the 'include' section
+# is deployed, so no warning is emitted.
+trace $CLI bundle generate job --existing-job-id 1234 --config-dir resources --key included
+
+# A resource generated into a directory that no 'include' pattern matches is
+# written to disk but silently ignored during deploy, so we warn about it.
+trace $CLI bundle generate job --existing-job-id 1234 --config-dir subdir --key excluded
+
+# The generated config files are not asserted on here; remove them so they are
+# not reported as unexpected leftover files.
+rm -r resources subdir
diff --git a/acceptance/bundle/generate/include_warning/test.toml b/acceptance/bundle/generate/include_warning/test.toml
new file mode 100644
index 00000000000..3a137df700c
--- /dev/null
+++ b/acceptance/bundle/generate/include_warning/test.toml
@@ -0,0 +1,24 @@
+[[Server]]
+Pattern = "GET /api/2.2/jobs/get"
+Response.Body = '''
+{
+    "job_id": 11223344,
+    "settings": {
+        "name": "gitjob",
+        "git_source": {
+            "git_url":      "https://git.databricks.com",
+            "git_provider": "github",
+            "git_branch":   "main",
+            "git_commit":   "abcdef"
+        },
+        "tasks": [
+            {
+                "task_key": "test_task",
+                "notebook_task": {
+                    "notebook_path": "some/test/notebook.py"
+                }
+            }
+        ]
+    }
+}
+'''
diff --git a/acceptance/bundle/generate/ipynb_job/out.test.toml b/acceptance/bundle/generate/ipynb_job/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/generate/ipynb_job/out.test.toml
+++ b/acceptance/bundle/generate/ipynb_job/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/generate/ipynb_job/output.txt b/acceptance/bundle/generate/ipynb_job/output.txt
index 61273cbf63e..e88d09508dc 100644
--- a/acceptance/bundle/generate/ipynb_job/output.txt
+++ b/acceptance/bundle/generate/ipynb_job/output.txt
@@ -1,2 +1,10 @@
 File successfully saved to outnotebook.ipynb
 Job configuration successfully saved to out.job.yml
+Warning: Generated configuration is not included in the bundle
+
+The file out.job.yml is not matched by any pattern in the 'include' section of databricks.yml,
+so it will not be deployed. Add a matching entry to the 'include' section, for example:
+
+include:
+  - *.yml
+
diff --git a/acceptance/bundle/generate/job_nested_notebooks/databricks.yml b/acceptance/bundle/generate/job_nested_notebooks/databricks.yml
new file mode 100644
index 00000000000..3331ecc8493
--- /dev/null
+++ b/acceptance/bundle/generate/job_nested_notebooks/databricks.yml
@@ -0,0 +1,2 @@
+bundle:
+  name: nested_notebooks
diff --git a/acceptance/bundle/generate/job_nested_notebooks/out.job.yml b/acceptance/bundle/generate/job_nested_notebooks/out.job.yml
new file mode 100644
index 00000000000..83a90b6298d
--- /dev/null
+++ b/acceptance/bundle/generate/job_nested_notebooks/out.job.yml
@@ -0,0 +1,11 @@
+resources:
+  jobs:
+    out:
+      name: dev.my_repo.my_job
+      tasks:
+        - task_key: my_notebook_task
+          notebook_task:
+            notebook_path: src/my_folder/my_notebook.py
+        - task_key: other_notebook_task
+          notebook_task:
+            notebook_path: src/other_folder/other_notebook.py
diff --git a/acceptance/bundle/generate/job_nested_notebooks/out.test.toml b/acceptance/bundle/generate/job_nested_notebooks/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/generate/job_nested_notebooks/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/generate/job_nested_notebooks/output.txt b/acceptance/bundle/generate/job_nested_notebooks/output.txt
new file mode 100644
index 00000000000..c0615715c5c
--- /dev/null
+++ b/acceptance/bundle/generate/job_nested_notebooks/output.txt
@@ -0,0 +1,17 @@
+File successfully saved to src/my_folder/my_notebook.py
+File successfully saved to src/other_folder/other_notebook.py
+Job configuration successfully saved to out.job.yml
+Warning: Generated configuration is not included in the bundle
+
+The file out.job.yml is not matched by any pattern in the 'include' section of databricks.yml,
+so it will not be deployed. Add a matching entry to the 'include' section, for example:
+
+include:
+  - *.yml
+
+=== old flattened files should be gone ===
+src/my_notebook.py removed
+src/other_notebook.py removed
+=== new nested files ===
+src/my_folder/my_notebook.py
+src/other_folder/other_notebook.py
diff --git a/acceptance/bundle/generate/job_nested_notebooks/script b/acceptance/bundle/generate/job_nested_notebooks/script
new file mode 100644
index 00000000000..a52154efbb0
--- /dev/null
+++ b/acceptance/bundle/generate/job_nested_notebooks/script
@@ -0,0 +1,18 @@
+mkdir -p src
+echo "old" > src/my_notebook.py
+echo "old" > src/other_notebook.py
+
+# The concurrent downloader emits the "File successfully saved" lines in
+# nondeterministic order, so sort just those; the remaining lines (including the
+# multi-line include warning) are deterministic and kept in their natural order.
+$CLI bundle generate job --existing-job-id 1234 --config-dir . --key out --force --source-dir src > out.gen.txt 2>&1
+grep '^File successfully saved to' out.gen.txt | sort
+grep -v '^File successfully saved to' out.gen.txt
+rm out.gen.txt
+
+echo "=== old flattened files should be gone ==="
+test ! -f src/my_notebook.py && echo "src/my_notebook.py removed" || echo "src/my_notebook.py still exists"
+test ! -f src/other_notebook.py && echo "src/other_notebook.py removed" || echo "src/other_notebook.py still exists"
+
+echo "=== new nested files ==="
+find src -type f | sort
diff --git a/acceptance/bundle/generate/job_nested_notebooks/test.toml b/acceptance/bundle/generate/job_nested_notebooks/test.toml
new file mode 100644
index 00000000000..bdb350e53f0
--- /dev/null
+++ b/acceptance/bundle/generate/job_nested_notebooks/test.toml
@@ -0,0 +1,42 @@
+Ignore = ["src"]
+
+[[Server]]
+Pattern = "GET /api/2.2/jobs/get"
+Response.Body = '''
+{
+    "job_id": 11223344,
+    "settings": {
+        "name": "dev.my_repo.my_job",
+        "tasks": [
+            {
+                "task_key": "my_notebook_task",
+                "notebook_task": {
+                    "notebook_path": "/my_data_product/dev/my_folder/my_notebook"
+                }
+            },
+            {
+                "task_key": "other_notebook_task",
+                "notebook_task": {
+                    "notebook_path": "/my_data_product/dev/other_folder/other_notebook"
+                }
+            }
+        ]
+    }
+}
+'''
+
+[[Server]]
+Pattern = "GET /api/2.0/workspace/get-status"
+Response.Body = '''
+{
+    "object_type": "NOTEBOOK",
+    "language": "PYTHON",
+    "repos_export_format": "SOURCE"
+}
+'''
+
+[[Server]]
+Pattern = "GET /api/2.0/workspace/export"
+Response.Body = '''
+print("Hello, World!")
+'''
diff --git a/acceptance/bundle/generate/lakeflow_pipelines/out.test.toml b/acceptance/bundle/generate/lakeflow_pipelines/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/generate/lakeflow_pipelines/out.test.toml
+++ b/acceptance/bundle/generate/lakeflow_pipelines/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/generate/lakeflow_pipelines/output.txt b/acceptance/bundle/generate/lakeflow_pipelines/output.txt
index b4c4e3d60aa..fbef31fbbe5 100644
--- a/acceptance/bundle/generate/lakeflow_pipelines/output.txt
+++ b/acceptance/bundle/generate/lakeflow_pipelines/output.txt
@@ -1,4 +1,12 @@
 Pipeline configuration successfully saved to out/config/out.pipeline.yml
+Warning: Generated configuration is not included in the bundle
+
+The file out/config/out.pipeline.yml is not matched by any pattern in the 'include' section of databricks.yml,
+so it will not be deployed. Add a matching entry to the 'include' section, for example:
+
+include:
+  - out/config/*.yml
+
 File successfully saved to out/pipeline/explorations/1.py
 File successfully saved to out/pipeline/transformations/1.py
 File successfully saved to out/pipeline/transformations/2.py
diff --git a/acceptance/bundle/generate/pipeline/out.test.toml b/acceptance/bundle/generate/pipeline/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/generate/pipeline/out.test.toml
+++ b/acceptance/bundle/generate/pipeline/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/generate/pipeline/output.txt b/acceptance/bundle/generate/pipeline/output.txt
index e6cf41871c1..bd1d6d9031c 100644
--- a/acceptance/bundle/generate/pipeline/output.txt
+++ b/acceptance/bundle/generate/pipeline/output.txt
@@ -1,2 +1,10 @@
 File successfully saved to outnotebook.py
 Pipeline configuration successfully saved to out.pipeline.yml
+Warning: Generated configuration is not included in the bundle
+
+The file out.pipeline.yml is not matched by any pattern in the 'include' section of databricks.yml,
+so it will not be deployed. Add a matching entry to the 'include' section, for example:
+
+include:
+  - *.yml
+
diff --git a/acceptance/bundle/generate/pipeline_and_deploy/databricks.yml.tmpl b/acceptance/bundle/generate/pipeline_and_deploy/databricks.yml.tmpl
new file mode 100644
index 00000000000..487b54402f8
--- /dev/null
+++ b/acceptance/bundle/generate/pipeline_and_deploy/databricks.yml.tmpl
@@ -0,0 +1,2 @@
+bundle:
+  name: pipeline_and_deploy-$UNIQUE_NAME
diff --git a/acceptance/bundle/generate/pipeline_and_deploy/notebook.py b/acceptance/bundle/generate/pipeline_and_deploy/notebook.py
new file mode 100644
index 00000000000..1a5691c338e
--- /dev/null
+++ b/acceptance/bundle/generate/pipeline_and_deploy/notebook.py
@@ -0,0 +1,2 @@
+# Databricks notebook source
+print("Hello world!")
diff --git a/acceptance/bundle/generate/pipeline_and_deploy/out.test.toml b/acceptance/bundle/generate/pipeline_and_deploy/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/generate/pipeline_and_deploy/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/generate/pipeline_and_deploy/output.txt b/acceptance/bundle/generate/pipeline_and_deploy/output.txt
new file mode 100644
index 00000000000..c63cfee74d5
--- /dev/null
+++ b/acceptance/bundle/generate/pipeline_and_deploy/output.txt
@@ -0,0 +1,39 @@
+
+=== Upload files to workspace
+>>> [CLI] workspace import /Workspace/Users/[USERNAME]/notebook-[UNIQUE_NAME].py --file notebook.py --format AUTO --overwrite
+
+>>> [CLI] workspace import /Workspace/Users/[USERNAME]/test-[UNIQUE_NAME].py --file test.py --format AUTO --overwrite
+
+=== Create a pipeline that references the filesCreated pipeline
+
+=== Generate bundle config from the pipelineFile successfully saved to src/notebook-[UNIQUE_NAME].py
+File successfully saved to src/test-[UNIQUE_NAME].py
+Pipeline configuration successfully saved to resources/out.pipeline.yml
+Warning: Generated configuration is not included in the bundle
+
+The file resources/out.pipeline.yml is not matched by any pattern in the 'include' section of databricks.yml,
+so it will not be deployed. Add a matching entry to the 'include' section, for example:
+
+include:
+  - resources/*.yml
+
+
+=== Verify generated yaml has expected fields
+=== Deploy the generated bundle
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/pipeline_and_deploy-[UNIQUE_NAME]/default/files...
+Files: 7 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Destroy the deployed bundle
+>>> [CLI] bundle destroy --auto-approve
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/pipeline_and_deploy-[UNIQUE_NAME]/default
+
+Destroy: 0 deleted
+
+=== Cleanup: delete the original pipeline and files
+>>> errcode [CLI] pipelines delete [PIPELINE_ID]
+
+>>> errcode [CLI] workspace delete /Workspace/Users/[USERNAME]/notebook-[UNIQUE_NAME]
+
+>>> errcode [CLI] workspace delete /Workspace/Users/[USERNAME]/test-[UNIQUE_NAME].py
diff --git a/acceptance/bundle/generate/pipeline_and_deploy/script b/acceptance/bundle/generate/pipeline_and_deploy/script
new file mode 100644
index 00000000000..32d4cbcbc4a
--- /dev/null
+++ b/acceptance/bundle/generate/pipeline_and_deploy/script
@@ -0,0 +1,53 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+title "Upload files to workspace"
+# The terraform and direct engine variants run concurrently against the same workspace user,
+# so embed $UNIQUE_NAME in the remote paths: otherwise one variant's cleanup deletes the shared
+# files out from under the other variant's bundle generate read.
+trace $CLI workspace import "/Workspace/Users/${CURRENT_USER_NAME}/notebook-${UNIQUE_NAME}.py" --file notebook.py --format AUTO --overwrite
+trace $CLI workspace import "/Workspace/Users/${CURRENT_USER_NAME}/test-${UNIQUE_NAME}.py" --file test.py --format AUTO --overwrite
+
+title "Create a pipeline that references the files"
+PIPELINE_ID=$($CLI pipelines create --json '{
+  "name": "test-pipeline-'${UNIQUE_NAME}'",
+  "libraries": [
+    {
+      "notebook": {
+        "path": "/Workspace/Users/'${CURRENT_USER_NAME}'/notebook-'${UNIQUE_NAME}'"
+      }
+    },
+    {
+      "file": {
+        "path": "/Workspace/Users/'${CURRENT_USER_NAME}'/test-'${UNIQUE_NAME}'.py"
+      }
+    }
+  ]
+}' | jq -r '.pipeline_id')
+echo "Created pipeline"
+add_repl "$PIPELINE_ID" PIPELINE_ID
+
+cleanup() {
+    title "Cleanup: delete the original pipeline and files"
+    trace errcode $CLI pipelines delete "$PIPELINE_ID"
+    trace errcode $CLI workspace delete "/Workspace/Users/${CURRENT_USER_NAME}/notebook-${UNIQUE_NAME}"
+    trace errcode $CLI workspace delete "/Workspace/Users/${CURRENT_USER_NAME}/test-${UNIQUE_NAME}.py"
+}
+trap cleanup EXIT
+
+title "Generate bundle config from the pipeline"
+# The concurrent downloader emits the "File successfully saved" lines in
+# nondeterministic order, so sort just those; the remaining lines (including the
+# multi-line include warning) are deterministic and kept in their natural order.
+$CLI bundle generate pipeline --existing-pipeline-id "$PIPELINE_ID" --key out --config-dir resources --source-dir src --force > out.gen.txt 2>&1
+grep '^File successfully saved to' out.gen.txt | sort
+grep -v '^File successfully saved to' out.gen.txt
+rm out.gen.txt
+
+title "Verify generated yaml has expected fields"
+cat resources/out.pipeline.yml | env -u MSYS_NO_PATHCONV contains.py "libraries:" "- notebook:" "path: ../src/notebook-${UNIQUE_NAME}.py" "- file:" "path: ../src/test-${UNIQUE_NAME}.py" > /dev/null
+
+title "Deploy the generated bundle"
+trace $CLI bundle deploy
+
+title "Destroy the deployed bundle"
+trace $CLI bundle destroy --auto-approve
diff --git a/acceptance/bundle/generate/pipeline_and_deploy/test.py b/acceptance/bundle/generate/pipeline_and_deploy/test.py
new file mode 100644
index 00000000000..693eaecb2b1
--- /dev/null
+++ b/acceptance/bundle/generate/pipeline_and_deploy/test.py
@@ -0,0 +1 @@
+print("Hello!")
diff --git a/acceptance/bundle/generate/pipeline_and_deploy/test.toml b/acceptance/bundle/generate/pipeline_and_deploy/test.toml
new file mode 100644
index 00000000000..8b64163ed67
--- /dev/null
+++ b/acceptance/bundle/generate/pipeline_and_deploy/test.toml
@@ -0,0 +1,11 @@
+Cloud = true
+
+Ignore = [
+    "databricks.yml",
+    "resources/*",
+    "src/*",
+    ".databricks",
+]
+
+# MSYS2 automatically converts absolute paths on Windows; disable for the workspace path.
+Env.MSYS_NO_PATHCONV = "1"
diff --git a/acceptance/bundle/generate/pipeline_with_glob/databricks.yml b/acceptance/bundle/generate/pipeline_with_glob/databricks.yml
new file mode 100644
index 00000000000..eb969e8375b
--- /dev/null
+++ b/acceptance/bundle/generate/pipeline_with_glob/databricks.yml
@@ -0,0 +1,2 @@
+bundle:
+  name: generate-pipeline
diff --git a/acceptance/bundle/generate/pipeline_with_glob/out.pipeline.yml b/acceptance/bundle/generate/pipeline_with_glob/out.pipeline.yml
new file mode 100644
index 00000000000..09ec6c4fd8b
--- /dev/null
+++ b/acceptance/bundle/generate/pipeline_with_glob/out.pipeline.yml
@@ -0,0 +1,7 @@
+resources:
+  pipelines:
+    out:
+      name: generate-pipeline
+      libraries:
+        - glob:
+            include: /Workspace/Users/[USERNAME]/src/*.py
diff --git a/acceptance/bundle/generate/pipeline_with_glob/out.test.toml b/acceptance/bundle/generate/pipeline_with_glob/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/generate/pipeline_with_glob/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/generate/pipeline_with_glob/output.txt b/acceptance/bundle/generate/pipeline_with_glob/output.txt
new file mode 100644
index 00000000000..fa9a5817593
--- /dev/null
+++ b/acceptance/bundle/generate/pipeline_with_glob/output.txt
@@ -0,0 +1,9 @@
+Pipeline configuration successfully saved to out.pipeline.yml
+Warning: Generated configuration is not included in the bundle
+
+The file out.pipeline.yml is not matched by any pattern in the 'include' section of databricks.yml,
+so it will not be deployed. Add a matching entry to the 'include' section, for example:
+
+include:
+  - *.yml
+
diff --git a/acceptance/bundle/generate/pipeline_with_glob/script b/acceptance/bundle/generate/pipeline_with_glob/script
new file mode 100644
index 00000000000..4d92e3dd4f7
--- /dev/null
+++ b/acceptance/bundle/generate/pipeline_with_glob/script
@@ -0,0 +1 @@
+$CLI bundle generate pipeline --existing-pipeline-id 1234 --config-dir . --key out --force --source-dir .
diff --git a/acceptance/bundle/generate/pipeline_with_glob/test.toml b/acceptance/bundle/generate/pipeline_with_glob/test.toml
new file mode 100644
index 00000000000..0abe427b555
--- /dev/null
+++ b/acceptance/bundle/generate/pipeline_with_glob/test.toml
@@ -0,0 +1,17 @@
+[[Server]]
+Pattern = "GET /api/2.0/pipelines/1234"
+Response.Body = '''
+{
+    "pipeline_id": 1234,
+    "spec": {
+        "name": "generate-pipeline",
+        "libraries": [
+            {
+                "glob": {
+                    "include": "/Workspace/Users/tester@databricks.com/src/*.py"
+                }
+            }
+        ]
+    }
+}
+'''
diff --git a/acceptance/bundle/generate/pipeline_with_sql/out.test.toml b/acceptance/bundle/generate/pipeline_with_sql/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/generate/pipeline_with_sql/out.test.toml
+++ b/acceptance/bundle/generate/pipeline_with_sql/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/generate/pipeline_with_sql/output.txt b/acceptance/bundle/generate/pipeline_with_sql/output.txt
index 3818255b6f9..230c4791b95 100644
--- a/acceptance/bundle/generate/pipeline_with_sql/output.txt
+++ b/acceptance/bundle/generate/pipeline_with_sql/output.txt
@@ -1,2 +1,10 @@
 File successfully saved to outsql.sql
 Pipeline configuration successfully saved to out.pipeline.yml
+Warning: Generated configuration is not included in the bundle
+
+The file out.pipeline.yml is not matched by any pattern in the 'include' section of databricks.yml,
+so it will not be deployed. Add a matching entry to the 'include' section, for example:
+
+include:
+  - *.yml
+
diff --git a/acceptance/bundle/generate/python_job/out.test.toml b/acceptance/bundle/generate/python_job/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/generate/python_job/out.test.toml
+++ b/acceptance/bundle/generate/python_job/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/generate/python_job/output.txt b/acceptance/bundle/generate/python_job/output.txt
index ad44285e3a9..28adf652f1d 100644
--- a/acceptance/bundle/generate/python_job/output.txt
+++ b/acceptance/bundle/generate/python_job/output.txt
@@ -1,2 +1,10 @@
 File successfully saved to outnotebook.py
 Job configuration successfully saved to out.job.yml
+Warning: Generated configuration is not included in the bundle
+
+The file out.job.yml is not matched by any pattern in the 'include' section of databricks.yml,
+so it will not be deployed. Add a matching entry to the 'include' section, for example:
+
+include:
+  - *.yml
+
diff --git a/acceptance/bundle/generate/python_job_and_deploy/databricks.yml.tmpl b/acceptance/bundle/generate/python_job_and_deploy/databricks.yml.tmpl
new file mode 100644
index 00000000000..9d3cc69cdec
--- /dev/null
+++ b/acceptance/bundle/generate/python_job_and_deploy/databricks.yml.tmpl
@@ -0,0 +1,2 @@
+bundle:
+  name: python_job_and_deploy-$UNIQUE_NAME
diff --git a/acceptance/bundle/generate/python_job_and_deploy/out.test.toml b/acceptance/bundle/generate/python_job_and_deploy/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/generate/python_job_and_deploy/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/generate/python_job_and_deploy/output.txt b/acceptance/bundle/generate/python_job_and_deploy/output.txt
new file mode 100644
index 00000000000..397d2049b36
--- /dev/null
+++ b/acceptance/bundle/generate/python_job_and_deploy/output.txt
@@ -0,0 +1,36 @@
+
+=== Upload notebook to a workspace path
+>>> [CLI] workspace import /Workspace/Users/[USERNAME]/test_notebook-[UNIQUE_NAME].py --file test_notebook.py --format AUTO --overwrite
+
+=== Create a job that references the notebookCreated job
+
+=== Generate bundle config from the job
+>>> [CLI] bundle generate job --existing-job-id [JOB_ID] --key out --config-dir resources --source-dir src --force
+File successfully saved to src/test_notebook-[UNIQUE_NAME].py
+Job configuration successfully saved to resources/out.job.yml
+Warning: Generated configuration is not included in the bundle
+
+The file resources/out.job.yml is not matched by any pattern in the 'include' section of databricks.yml,
+so it will not be deployed. Add a matching entry to the 'include' section, for example:
+
+include:
+  - resources/*.yml
+
+
+=== Verify generated yaml has expected fields
+=== Deploy the generated bundle
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/python_job_and_deploy-[UNIQUE_NAME]/default/files...
+Files: 5 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Destroy the deployed bundle
+>>> [CLI] bundle destroy --auto-approve
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/python_job_and_deploy-[UNIQUE_NAME]/default
+
+Destroy: 0 deleted
+
+=== Cleanup: delete the original job and notebook
+>>> errcode [CLI] jobs delete [JOB_ID]
+
+>>> errcode [CLI] workspace delete /Workspace/Users/[USERNAME]/test_notebook-[UNIQUE_NAME]
diff --git a/acceptance/bundle/generate/python_job_and_deploy/script b/acceptance/bundle/generate/python_job_and_deploy/script
new file mode 100644
index 00000000000..f9629bf8e7f
--- /dev/null
+++ b/acceptance/bundle/generate/python_job_and_deploy/script
@@ -0,0 +1,50 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+title "Upload notebook to a workspace path"
+# The terraform and direct engine variants run concurrently against the same workspace user,
+# so embed $UNIQUE_NAME in the remote path: otherwise one variant's cleanup deletes the shared
+# notebook out from under the other variant's bundle generate read.
+trace $CLI workspace import "/Workspace/Users/${CURRENT_USER_NAME}/test_notebook-${UNIQUE_NAME}.py" --file test_notebook.py --format AUTO --overwrite
+
+title "Create a job that references the notebook"
+JOB_ID=$($CLI jobs create --json '{
+  "name": "test-job",
+  "max_concurrent_runs": 1,
+  "queue": {"enabled": true},
+  "tasks": [
+    {
+      "task_key": "test_task",
+      "notebook_task": {
+        "notebook_path": "/Workspace/Users/'${CURRENT_USER_NAME}'/test_notebook-'${UNIQUE_NAME}'"
+      },
+      "new_cluster": {
+        "spark_version": "'${DEFAULT_SPARK_VERSION}'",
+        "node_type_id": "'${NODE_TYPE_ID}'",
+        "num_workers": 1
+      }
+    }
+  ]
+}' | jq -r '.job_id')
+echo "Created job"
+# Disable MSYS_NO_PATHCONV when invoking python scripts: with it set, Git Bash on Windows
+# fails to translate the script path so the python interpreter can't find the file.
+add_repl "$JOB_ID" JOB_ID
+
+cleanup() {
+    title "Cleanup: delete the original job and notebook"
+    trace errcode $CLI jobs delete "$JOB_ID"
+    trace errcode $CLI workspace delete "/Workspace/Users/${CURRENT_USER_NAME}/test_notebook-${UNIQUE_NAME}"
+}
+trap cleanup EXIT
+
+title "Generate bundle config from the job"
+trace $CLI bundle generate job --existing-job-id "$JOB_ID" --key out --config-dir resources --source-dir src --force
+
+title "Verify generated yaml has expected fields"
+cat resources/out.job.yml | env -u MSYS_NO_PATHCONV contains.py "task_key: test_task" "notebook_task:" "notebook_path: ../src/test_notebook-${UNIQUE_NAME}.py" > /dev/null
+
+title "Deploy the generated bundle"
+trace $CLI bundle deploy
+
+title "Destroy the deployed bundle"
+trace $CLI bundle destroy --auto-approve
diff --git a/acceptance/bundle/generate/python_job_and_deploy/test.toml b/acceptance/bundle/generate/python_job_and_deploy/test.toml
new file mode 100644
index 00000000000..8b64163ed67
--- /dev/null
+++ b/acceptance/bundle/generate/python_job_and_deploy/test.toml
@@ -0,0 +1,11 @@
+Cloud = true
+
+Ignore = [
+    "databricks.yml",
+    "resources/*",
+    "src/*",
+    ".databricks",
+]
+
+# MSYS2 automatically converts absolute paths on Windows; disable for the workspace path.
+Env.MSYS_NO_PATHCONV = "1"
diff --git a/acceptance/bundle/paths/fallback/src/notebook.py b/acceptance/bundle/generate/python_job_and_deploy/test_notebook.py
similarity index 100%
rename from acceptance/bundle/paths/fallback/src/notebook.py
rename to acceptance/bundle/generate/python_job_and_deploy/test_notebook.py
diff --git a/acceptance/bundle/generate/spark_python_task_job/databricks.yml b/acceptance/bundle/generate/spark_python_task_job/databricks.yml
new file mode 100644
index 00000000000..7419eb67c8a
--- /dev/null
+++ b/acceptance/bundle/generate/spark_python_task_job/databricks.yml
@@ -0,0 +1,2 @@
+bundle:
+  name: spark_python_task_job
diff --git a/acceptance/bundle/generate/spark_python_task_job/out.job.yml b/acceptance/bundle/generate/spark_python_task_job/out.job.yml
new file mode 100644
index 00000000000..091ed6b6726
--- /dev/null
+++ b/acceptance/bundle/generate/spark_python_task_job/out.job.yml
@@ -0,0 +1,11 @@
+resources:
+  jobs:
+    out:
+      name: sparkpythonjob
+      tasks:
+        - task_key: workspace_file_task
+          spark_python_task:
+            python_file: outjob.py
+        - task_key: cloud_uri_task
+          spark_python_task:
+            python_file: dbfs:/FileStore/job.py
diff --git a/acceptance/bundle/generate/spark_python_task_job/out.test.toml b/acceptance/bundle/generate/spark_python_task_job/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/generate/spark_python_task_job/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/paths/fallback/src/file.py b/acceptance/bundle/generate/spark_python_task_job/outjob.py
similarity index 100%
rename from acceptance/bundle/paths/fallback/src/file.py
rename to acceptance/bundle/generate/spark_python_task_job/outjob.py
diff --git a/acceptance/bundle/generate/spark_python_task_job/output.txt b/acceptance/bundle/generate/spark_python_task_job/output.txt
new file mode 100644
index 00000000000..7bff1e49496
--- /dev/null
+++ b/acceptance/bundle/generate/spark_python_task_job/output.txt
@@ -0,0 +1,10 @@
+File successfully saved to outjob.py
+Job configuration successfully saved to out.job.yml
+Warning: Generated configuration is not included in the bundle
+
+The file out.job.yml is not matched by any pattern in the 'include' section of databricks.yml,
+so it will not be deployed. Add a matching entry to the 'include' section, for example:
+
+include:
+  - *.yml
+
diff --git a/acceptance/bundle/generate/spark_python_task_job/script b/acceptance/bundle/generate/spark_python_task_job/script
new file mode 100644
index 00000000000..a1131f4c5dd
--- /dev/null
+++ b/acceptance/bundle/generate/spark_python_task_job/script
@@ -0,0 +1 @@
+$CLI bundle generate job --existing-job-id 1234 --config-dir . --key out --force --source-dir . --download-spark-python-files
diff --git a/acceptance/bundle/generate/spark_python_task_job/test.toml b/acceptance/bundle/generate/spark_python_task_job/test.toml
new file mode 100644
index 00000000000..6ee12cc669b
--- /dev/null
+++ b/acceptance/bundle/generate/spark_python_task_job/test.toml
@@ -0,0 +1,41 @@
+[[Server]]
+Pattern = "GET /api/2.2/jobs/get"
+Response.Body = '''
+{
+    "job_id": 11223344,
+    "settings": {
+        "name": "sparkpythonjob",
+        "tasks": [
+            {
+                "task_key": "workspace_file_task",
+                "spark_python_task": {
+                    "python_file": "/Workspace/Users/tester@databricks.com/outjob.py"
+                }
+            },
+            {
+                "task_key": "cloud_uri_task",
+                "spark_python_task": {
+                    "python_file": "dbfs:/FileStore/job.py"
+                }
+            }
+        ]
+    }
+}
+'''
+
+[[Server]]
+Pattern = "GET /api/2.0/workspace/get-status"
+Response.Body = '''
+{
+    "path": "/Workspace/Users/tester@databricks.com/outjob.py",
+    "object_type": "FILE",
+    "language": "PYTHON",
+    "repos_export_format": "SOURCE"
+}
+'''
+
+[[Server]]
+Pattern = "GET /api/2.0/workspace/export"
+Response.Body = '''
+print("Hello, World!")
+'''
diff --git a/acceptance/bundle/git-metadata/databricks.yml b/acceptance/bundle/git-metadata/databricks.yml
new file mode 100644
index 00000000000..576d7a9ef25
--- /dev/null
+++ b/acceptance/bundle/git-metadata/databricks.yml
@@ -0,0 +1,2 @@
+bundle:
+  name: test-bundle
diff --git a/acceptance/bundle/git-metadata/out.test.toml b/acceptance/bundle/git-metadata/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/git-metadata/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/git-metadata/output.txt b/acceptance/bundle/git-metadata/output.txt
new file mode 100644
index 00000000000..2a0ae8a75f5
--- /dev/null
+++ b/acceptance/bundle/git-metadata/output.txt
@@ -0,0 +1,16 @@
+
+=== a repository with a remote: branch, commit and origin URL come from .git
+
+>>> [CLI] bundle validate -o json
+{
+  "actual_branch": "main",
+  "branch": "main",
+  "bundle_root_path": ".",
+  "commit": "[COMMIT_SHA]",
+  "origin_url": "https://github.com/databricks/cli"
+}
+
+=== a malformed .git: the worktree root is still found, with no metadata
+{
+  "bundle_root_path": "."
+}
diff --git a/acceptance/bundle/git-metadata/script b/acceptance/bundle/git-metadata/script
new file mode 100644
index 00000000000..b629bc5776a
--- /dev/null
+++ b/acceptance/bundle/git-metadata/script
@@ -0,0 +1,23 @@
+title "a repository with a remote: branch, commit and origin URL come from .git\n"
+mkdir withremote
+cd withremote
+cp ../databricks.yml .
+git-repo-init
+git remote add origin https://github.com/databricks/cli
+trace $CLI bundle validate -o json | jq .bundle.git
+cd ..
+rm -fr withremote
+
+title "a malformed .git: the worktree root is still found, with no metadata\n"
+mkdir broken
+cd broken
+cp ../databricks.yml .
+# A .git file must name the real git dir; an empty one is reported but not fatal.
+printf '' > .git
+# validate reports the unreadable .git and fails. Its message names the .git path,
+# whose separators differ per platform, so it is asserted on outside the golden.
+musterr $CLI bundle validate -o json > ../LOG.validate 2> ../LOG.stderr
+jq .bundle.git < ../LOG.validate
+contains.py 'failed to read .git' < ../LOG.stderr > /dev/null
+cd ..
+rm -fr broken
diff --git a/acceptance/bundle/git-metadata/test.toml b/acceptance/bundle/git-metadata/test.toml
new file mode 100644
index 00000000000..96cdf4cd428
--- /dev/null
+++ b/acceptance/bundle/git-metadata/test.toml
@@ -0,0 +1,6 @@
+# Reading .git is independent of the deploy engine.
+
+# The commit differs on every run.
+[[Repls]]
+Old = '\b[0-9a-f]{40}\b'
+New = '[COMMIT_SHA]'
diff --git a/acceptance/bundle/git-permerror/out.test.toml b/acceptance/bundle/git-permerror/out.test.toml
index 1baaa898c5b..8c2cb31de53 100644
--- a/acceptance/bundle/git-permerror/out.test.toml
+++ b/acceptance/bundle/git-permerror/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
 GOOS.windows = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/git-permerror/test.toml b/acceptance/bundle/git-permerror/test.toml
index 15305cff1d7..dec897df580 100644
--- a/acceptance/bundle/git-permerror/test.toml
+++ b/acceptance/bundle/git-permerror/test.toml
@@ -1,5 +1,4 @@
 Badness = "inferred flag is set to true incorrect; bundle_root_path is not correct; Warn and Error talk about the same; Warn goes to stderr, Error goes to stdout (for backward compat); Warning about permissions repeated twice"
 
-[GOOS]
 # This test relies on chmod which does not work on Windows
-windows = false
+GOOS.windows = false
diff --git a/acceptance/bundle/hashing/new-cli-on-old-state/dashboard.lvdash.json b/acceptance/bundle/hashing/new-cli-on-old-state/dashboard.lvdash.json
new file mode 100644
index 00000000000..2aacbe44228
--- /dev/null
+++ b/acceptance/bundle/hashing/new-cli-on-old-state/dashboard.lvdash.json
@@ -0,0 +1 @@
+{"pages":[{"name":"main","displayName":"Sales Overview","layout":[{"widget":{"name":"counter1"}}]}]}
diff --git a/acceptance/bundle/hashing/new-cli-on-old-state/databricks.yml.tmpl b/acceptance/bundle/hashing/new-cli-on-old-state/databricks.yml.tmpl
new file mode 100644
index 00000000000..f7bf2c3a217
--- /dev/null
+++ b/acceptance/bundle/hashing/new-cli-on-old-state/databricks.yml.tmpl
@@ -0,0 +1,10 @@
+bundle:
+  name: hashing-upgrade-$UNIQUE_NAME
+
+resources:
+  dashboards:
+    dashboard1:
+      display_name: hashing-upgrade-$UNIQUE_NAME
+      warehouse_id: $TEST_DEFAULT_WAREHOUSE_ID
+      file_path: dashboard.lvdash.json
+      parent_path: /Users/$CURRENT_USER_NAME
diff --git a/acceptance/bundle/hashing/new-cli-on-old-state/out.test.toml b/acceptance/bundle/hashing/new-cli-on-old-state/out.test.toml
new file mode 100644
index 00000000000..2ab253adc73
--- /dev/null
+++ b/acceptance/bundle/hashing/new-cli-on-old-state/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = []
diff --git a/acceptance/bundle/hashing/new-cli-on-old-state/output.txt b/acceptance/bundle/hashing/new-cli-on-old-state/output.txt
new file mode 100644
index 00000000000..c9d7ef18808
--- /dev/null
+++ b/acceptance/bundle/hashing/new-cli-on-old-state/output.txt
@@ -0,0 +1,7 @@
+
+=== Old CLI (predates hashing) deploys: state holds the full serialized_dashboard
+json.state.resources.dashboards.dashboard1.state.serialized_dashboard = "{\"pages\":[{\"name\":\"main\",\"displayName\":\"Sales Overview\",\"layout\":[{\"widget\":{\"name\":\"counter1\"}}]}]}\n";
+
+=== Current CLI reads the old state without a phantom update
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
diff --git a/acceptance/bundle/hashing/new-cli-on-old-state/script b/acceptance/bundle/hashing/new-cli-on-old-state/script
new file mode 100644
index 00000000000..24bd173a560
--- /dev/null
+++ b/acceptance/bundle/hashing/new-cli-on-old-state/script
@@ -0,0 +1,16 @@
+export TEST_DEFAULT_WAREHOUSE_ID="warehouse-1234"
+add_repl warehouse-1234 TEST_DEFAULT_WAREHOUSE_ID
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() { $CLI bundle destroy --auto-approve &> LOG.destroy; }
+trap cleanup EXIT
+
+title "Old CLI (predates hashing) deploys: state holds the full serialized_dashboard\n"
+$CLI_1_16_1 bundle deploy &> LOG.deploy_old
+contains.py '!panic' '!internal error' < LOG.deploy_old > /dev/null
+print_state.py | gron.py | grep serialized_dashboard
+
+# The current CLI hashes the stored full content on read, so it compares equal to the config
+# and reports no phantom update.
+title "Current CLI reads the old state without a phantom update"
+trace $CLI bundle plan | contains.py "0 to add, 0 to change, 0 to delete"
diff --git a/acceptance/bundle/hashing/old-cli-on-new-state/dashboard.lvdash.json b/acceptance/bundle/hashing/old-cli-on-new-state/dashboard.lvdash.json
new file mode 100644
index 00000000000..2aacbe44228
--- /dev/null
+++ b/acceptance/bundle/hashing/old-cli-on-new-state/dashboard.lvdash.json
@@ -0,0 +1 @@
+{"pages":[{"name":"main","displayName":"Sales Overview","layout":[{"widget":{"name":"counter1"}}]}]}
diff --git a/acceptance/bundle/hashing/old-cli-on-new-state/databricks.yml.tmpl b/acceptance/bundle/hashing/old-cli-on-new-state/databricks.yml.tmpl
new file mode 100644
index 00000000000..f4d57efe1cd
--- /dev/null
+++ b/acceptance/bundle/hashing/old-cli-on-new-state/databricks.yml.tmpl
@@ -0,0 +1,10 @@
+bundle:
+  name: hashing-downgrade-$UNIQUE_NAME
+
+resources:
+  dashboards:
+    dashboard1:
+      display_name: hashing-downgrade-$UNIQUE_NAME
+      warehouse_id: $TEST_DEFAULT_WAREHOUSE_ID
+      file_path: dashboard.lvdash.json
+      parent_path: /Users/$CURRENT_USER_NAME
diff --git a/acceptance/bundle/hashing/old-cli-on-new-state/out.test.toml b/acceptance/bundle/hashing/old-cli-on-new-state/out.test.toml
new file mode 100644
index 00000000000..2ab253adc73
--- /dev/null
+++ b/acceptance/bundle/hashing/old-cli-on-new-state/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = []
diff --git a/acceptance/bundle/hashing/old-cli-on-new-state/output.txt b/acceptance/bundle/hashing/old-cli-on-new-state/output.txt
new file mode 100644
index 00000000000..bc7817f8633
--- /dev/null
+++ b/acceptance/bundle/hashing/old-cli-on-new-state/output.txt
@@ -0,0 +1,9 @@
+
+=== Current CLI deploys: serialized_dashboard is stored as a content hash
+json.state.resources.dashboards.dashboard1.state.serialized_dashboard = "sha256:[HASH]";
+
+=== Old CLI on the hashed state plans a drift update, not a recreate or crash
+=== The old CLI redeploys and writes full content back, so the drift is self-correcting
+json.state.resources.dashboards.dashboard1.state.serialized_dashboard = "{\"pages\":[{\"name\":\"main\",\"displayName\":\"Sales Overview\",\"layout\":[{\"widget\":{\"name\":\"counter1\"}}]}]}\n";
+
+=== A second old-CLI plan is a no-op
\ No newline at end of file
diff --git a/acceptance/bundle/hashing/old-cli-on-new-state/script b/acceptance/bundle/hashing/old-cli-on-new-state/script
new file mode 100644
index 00000000000..a2ffb0a6931
--- /dev/null
+++ b/acceptance/bundle/hashing/old-cli-on-new-state/script
@@ -0,0 +1,26 @@
+export TEST_DEFAULT_WAREHOUSE_ID="warehouse-1234"
+add_repl warehouse-1234 TEST_DEFAULT_WAREHOUSE_ID
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() { $CLI bundle destroy --auto-approve &> LOG.destroy; }
+trap cleanup EXIT
+
+title "Current CLI deploys: serialized_dashboard is stored as a content hash\n"
+$CLI bundle deploy &> LOG.deploy_new
+contains.py '!panic' '!internal error' < LOG.deploy_new > /dev/null
+print_state.py | gron.py | grep serialized_dashboard
+
+# The old CLI reads the hash as literal content; so hash != config content is a local change -> update
+# never a recreate or crash.
+title "Old CLI on the hashed state plans a drift update, not a recreate or crash"
+$CLI_1_16_1 bundle plan &> LOG.plan_old
+contains.py '!recreate' '!panic' '!internal error' < LOG.plan_old > /dev/null
+
+title "The old CLI redeploys and writes full content back, so the drift is self-correcting\n"
+$CLI_1_16_1 bundle deploy &> LOG.deploy_old
+contains.py '!panic' '!internal error' < LOG.deploy_old > /dev/null
+print_state.py | gron.py | grep serialized_dashboard
+
+title "A second old-CLI plan is a no-op"
+$CLI_1_16_1 bundle plan &> LOG.plan_old2
+contains.py '0 to change' '!panic' < LOG.plan_old2 > /dev/null
diff --git a/acceptance/bundle/hashing/test.toml b/acceptance/bundle/hashing/test.toml
new file mode 100644
index 00000000000..37e53e3ce25
--- /dev/null
+++ b/acceptance/bundle/hashing/test.toml
@@ -0,0 +1,6 @@
+# Cross-version state compat for direct-engine content hashing: $CLI hashes serialized_dashboard
+# in state; $CLI_1_16_1 (an old release) predates hashed_fields and stores it verbatim.
+# Direct-only and local, so the state reads are deterministic.
+EnvMatrix.DMS = []
+
+Ignore = ["databricks.yml"]
diff --git a/acceptance/bundle/help/bundle-deploy/out.test.toml b/acceptance/bundle/help/bundle-deploy/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/help/bundle-deploy/out.test.toml
+++ b/acceptance/bundle/help/bundle-deploy/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/help/bundle-deploy/output.txt b/acceptance/bundle/help/bundle-deploy/output.txt
index d9c5b1f14c2..2b4838b6fa6 100644
--- a/acceptance/bundle/help/bundle-deploy/output.txt
+++ b/acceptance/bundle/help/bundle-deploy/output.txt
@@ -19,7 +19,9 @@ Flags:
       --force                 Force-override Git branch validation.
       --force-lock            Force acquisition of deployment lock.
   -h, --help                  help for deploy
-      --plan string           Path to a JSON plan file to apply instead of planning (direct engine only).
+      --plan string           Path to a JSON plan file to apply instead of planning.
+  -q, --quiet count           Reduce output: -q prints only the summary, -qq prints only warnings and errors.
+      --select strings        Deploy only the specified resource (e.g. 'my_job' or 'jobs.my_job'). Can be repeated or comma-separated.
 
 Global Flags:
       --debug            enable debug logging
diff --git a/acceptance/bundle/help/bundle-deployment-migrate/out.test.toml b/acceptance/bundle/help/bundle-deployment-migrate/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/help/bundle-deployment-migrate/out.test.toml
+++ b/acceptance/bundle/help/bundle-deployment-migrate/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/help/bundle-deployment-migrate/output.txt b/acceptance/bundle/help/bundle-deployment-migrate/output.txt
index da2f95707bc..9312fb85ffc 100644
--- a/acceptance/bundle/help/bundle-deployment-migrate/output.txt
+++ b/acceptance/bundle/help/bundle-deployment-migrate/output.txt
@@ -13,7 +13,7 @@ Usage:
 
 Flags:
   -h, --help          help for migrate
-      --noplancheck   Skip running bundle plan before migration.
+      --noplancheck   No-op (kept for compatibility).
 
 Global Flags:
       --debug            enable debug logging
diff --git a/acceptance/bundle/help/bundle-deployment/out.test.toml b/acceptance/bundle/help/bundle-deployment/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/help/bundle-deployment/out.test.toml
+++ b/acceptance/bundle/help/bundle-deployment/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/help/bundle-destroy/out.test.toml b/acceptance/bundle/help/bundle-destroy/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/help/bundle-destroy/out.test.toml
+++ b/acceptance/bundle/help/bundle-destroy/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/help/bundle-destroy/output.txt b/acceptance/bundle/help/bundle-destroy/output.txt
index 64aecf7ffe1..73e72c9e4f9 100644
--- a/acceptance/bundle/help/bundle-destroy/output.txt
+++ b/acceptance/bundle/help/bundle-destroy/output.txt
@@ -20,6 +20,7 @@ Flags:
       --auto-approve   Skip interactive approvals for deleting resources and files
       --force-lock     Force acquisition of deployment lock.
   -h, --help           help for destroy
+  -q, --quiet count    Reduce output: -qq prints only warnings and errors.
 
 Global Flags:
       --debug            enable debug logging
diff --git a/acceptance/bundle/help/bundle-generate-dashboard/out.test.toml b/acceptance/bundle/help/bundle-generate-dashboard/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/help/bundle-generate-dashboard/out.test.toml
+++ b/acceptance/bundle/help/bundle-generate-dashboard/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/help/bundle-generate-job/out.test.toml b/acceptance/bundle/help/bundle-generate-job/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/help/bundle-generate-job/out.test.toml
+++ b/acceptance/bundle/help/bundle-generate-job/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/help/bundle-generate-job/output.txt b/acceptance/bundle/help/bundle-generate-job/output.txt
index f239691ab6a..092babc9af9 100644
--- a/acceptance/bundle/help/bundle-generate-job/output.txt
+++ b/acceptance/bundle/help/bundle-generate-job/output.txt
@@ -18,7 +18,8 @@ Examples:
 
 What gets generated:
 - Job configuration YAML file in the resources directory
-- Any associated notebook or Python files in the source directory
+- Any associated notebook files in the source directory
+- Any associated python spark files in the source directory, if --download-spark-python-files is provided
 
 After generation, you can deploy this job to other targets using:
   databricks bundle deploy --target staging
@@ -28,11 +29,12 @@ Usage:
   databricks bundle generate job [flags]
 
 Flags:
-  -d, --config-dir string     Dir path where the output config will be stored (default "resources")
-      --existing-job-id int   Job ID of the job to generate config for
-  -f, --force                 Force overwrite existing files in the output directory
-  -h, --help                  help for job
-  -s, --source-dir string     Dir path where the downloaded files will be stored (default "src")
+  -d, --config-dir string             Dir path where the output config will be stored (default "resources")
+      --download-spark-python-files   download workspace files referenced by spark_python_task and rewrite them to a relative path
+      --existing-job-id int           Job ID of the job to generate config for
+  -f, --force                         Force overwrite existing files in the output directory
+  -h, --help                          help for job
+  -s, --source-dir string             Dir path where the downloaded files will be stored (default "src")
 
 Global Flags:
       --debug            enable debug logging
diff --git a/acceptance/bundle/help/bundle-generate-pipeline/out.test.toml b/acceptance/bundle/help/bundle-generate-pipeline/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/help/bundle-generate-pipeline/out.test.toml
+++ b/acceptance/bundle/help/bundle-generate-pipeline/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/help/bundle-generate/out.test.toml b/acceptance/bundle/help/bundle-generate/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/help/bundle-generate/out.test.toml
+++ b/acceptance/bundle/help/bundle-generate/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/help/bundle-generate/output.txt b/acceptance/bundle/help/bundle-generate/output.txt
index 97e8667ac78..39ce9293539 100644
--- a/acceptance/bundle/help/bundle-generate/output.txt
+++ b/acceptance/bundle/help/bundle-generate/output.txt
@@ -30,6 +30,7 @@ Available Commands:
   alert       Generate configuration for an alert
   app         Generate bundle configuration for a Databricks app
   dashboard   Generate configuration for a dashboard
+  genie-space Generate configuration for a Genie space
   job         Generate bundle configuration for a job
   pipeline    Generate bundle configuration for a pipeline
 
diff --git a/acceptance/bundle/help/bundle-init/out.test.toml b/acceptance/bundle/help/bundle-init/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/help/bundle-init/out.test.toml
+++ b/acceptance/bundle/help/bundle-init/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/help/bundle-init/output.txt b/acceptance/bundle/help/bundle-init/output.txt
index dad5e198e4c..f11b6b51005 100644
--- a/acceptance/bundle/help/bundle-init/output.txt
+++ b/acceptance/bundle/help/bundle-init/output.txt
@@ -7,20 +7,20 @@ TEMPLATE_PATH optionally specifies which template to use. It can be one of the f
 - default-sql: The default SQL template for .sql files that run with Databricks SQL
 - default-minimal: The minimal template, for advanced users
 - default-scala: The default Scala template for JAR jobs
+- lakeflow-integrations: The template for Lakeflow integrations
 - dbt-sql: The dbt SQL template (databricks.com/blog/delivering-cost-effective-data-real-time-dbt-and-databricks)
 - mlops-stacks: The Databricks MLOps Stacks template (github.com/databricks/mlops-stacks)
 - pydabs: A variant of the 'default-python' template that defines resources in Python instead of YAML
+- app-appkit: Databricks App with AppKit (TypeScript)
 - a local file system path with a template directory
 - a Git repository URL, e.g. https://github.com/my/repository
 
 Examples:
-  databricks bundle init                   # Choose from built-in templates
-  databricks bundle init default-python    # Python jobs and notebooks
-  databricks bundle init dbt-sql           # dbt + SQL warehouse project
-  databricks bundle init --output-dir ./my-project
+  databricks bundle init default-python
+  databricks bundle init app-appkit --config-file input.json  # {"project_name":"my-app"}
 
 After initialization:
-  databricks bundle deploy --target dev
+  databricks bundle deploy
 
 See https://docs.databricks.com/en/dev-tools/bundles/templates.html for more information on templates.
 
diff --git a/acceptance/bundle/help/bundle-open/out.test.toml b/acceptance/bundle/help/bundle-open/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/help/bundle-open/out.test.toml
+++ b/acceptance/bundle/help/bundle-open/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/help/bundle-run/out.test.toml b/acceptance/bundle/help/bundle-run/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/help/bundle-run/out.test.toml
+++ b/acceptance/bundle/help/bundle-run/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/help/bundle-run/output.txt b/acceptance/bundle/help/bundle-run/output.txt
index 0c91c15ccd4..a6b453c8834 100644
--- a/acceptance/bundle/help/bundle-run/output.txt
+++ b/acceptance/bundle/help/bundle-run/output.txt
@@ -38,7 +38,7 @@ Usage:
   databricks bundle run [flags] [KEY]
 
 Job Flags:
-      --only strings            comma separated list of task keys to run
+      --only strings            comma separated list of task keys to run. Prefix a key with + to also run its upstream tasks. Suffix with + to also run its downstream tasks
       --params stringToString   comma separated k=v pairs for job parameters (default [])
 
 Job Task Flags:
diff --git a/acceptance/bundle/help/bundle-schema/out.test.toml b/acceptance/bundle/help/bundle-schema/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/help/bundle-schema/out.test.toml
+++ b/acceptance/bundle/help/bundle-schema/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/help/bundle-schema/output.txt b/acceptance/bundle/help/bundle-schema/output.txt
index 38d62a8949c..033159418b6 100644
--- a/acceptance/bundle/help/bundle-schema/output.txt
+++ b/acceptance/bundle/help/bundle-schema/output.txt
@@ -3,7 +3,7 @@
 Generate JSON Schema for bundle configuration to enable validation and autocomplete.
 
 This command outputs the JSON Schema that describes the structure and validation
-rules for Databricks Asset Bundle configuration files.
+rules for Declarative Automation Bundle configuration files.
 
 Common use cases:
 - Configure IDE/editor validation for databricks.yml files
diff --git a/acceptance/bundle/help/bundle-summary/out.test.toml b/acceptance/bundle/help/bundle-summary/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/help/bundle-summary/out.test.toml
+++ b/acceptance/bundle/help/bundle-summary/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/help/bundle-sync/out.test.toml b/acceptance/bundle/help/bundle-sync/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/help/bundle-sync/out.test.toml
+++ b/acceptance/bundle/help/bundle-sync/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/help/bundle-sync/output.txt b/acceptance/bundle/help/bundle-sync/output.txt
index a357882cbd3..2d7c3ef9959 100644
--- a/acceptance/bundle/help/bundle-sync/output.txt
+++ b/acceptance/bundle/help/bundle-sync/output.txt
@@ -19,11 +19,11 @@ Flags:
       --full                perform full synchronization (default is incremental)
   -h, --help                help for sync
       --interval duration   file system polling interval (for --watch) (default 1s)
-      --output type         type of the output format
       --watch               watch local file system for changes
 
 Global Flags:
       --debug            enable debug logging
+  -o, --output type      output type: text or json (default text)
   -p, --profile string   ~/.databrickscfg profile
   -t, --target string    bundle target to use (if applicable)
       --var strings      set values for variables defined in bundle config. Example: --var="foo=bar"
diff --git a/acceptance/bundle/help/bundle-validate/out.test.toml b/acceptance/bundle/help/bundle-validate/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/help/bundle-validate/out.test.toml
+++ b/acceptance/bundle/help/bundle-validate/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/help/bundle/out.test.toml b/acceptance/bundle/help/bundle/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/help/bundle/out.test.toml
+++ b/acceptance/bundle/help/bundle/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/includes/glob_in_root_path/out.test.toml b/acceptance/bundle/includes/glob_in_root_path/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/includes/glob_in_root_path/out.test.toml
+++ b/acceptance/bundle/includes/glob_in_root_path/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/includes/include_outside_root/out.test.toml b/acceptance/bundle/includes/include_outside_root/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/includes/include_outside_root/out.test.toml
+++ b/acceptance/bundle/includes/include_outside_root/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/includes/non_yaml_in_include/databricks.yml b/acceptance/bundle/includes/non_yaml_in_include/databricks.yml
index 15c68e1cf4e..7fd2b0724d7 100644
--- a/acceptance/bundle/includes/non_yaml_in_include/databricks.yml
+++ b/acceptance/bundle/includes/non_yaml_in_include/databricks.yml
@@ -2,5 +2,5 @@ bundle:
   name: non_yaml_in_includes
 
 include:
-  - test.py
   - resources/*.yml
+  - "*.py"
diff --git a/acceptance/bundle/includes/non_yaml_in_include/out.test.toml b/acceptance/bundle/includes/non_yaml_in_include/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/includes/non_yaml_in_include/out.test.toml
+++ b/acceptance/bundle/includes/non_yaml_in_include/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/includes/non_yaml_in_include/output.txt b/acceptance/bundle/includes/non_yaml_in_include/output.txt
index c4f259cb087..6b9fe12d7bd 100644
--- a/acceptance/bundle/includes/non_yaml_in_include/output.txt
+++ b/acceptance/bundle/includes/non_yaml_in_include/output.txt
@@ -1,10 +1,15 @@
 Error: Files in the 'include' configuration section must be YAML or JSON files.
-  in databricks.yml:5:5
+  in databricks.yml:6:5
 
 The file test.py in the 'include' configuration section is not a YAML or JSON file, and only such files are supported. To include files to sync, specify them in the 'sync.include' configuration section instead.
 
+Error: Files in the 'include' configuration section must be YAML or JSON files.
+  in databricks.yml:6:5
+
+The file test2.py in the 'include' configuration section is not a YAML or JSON file, and only such files are supported. To include files to sync, specify them in the 'sync.include' configuration section instead.
+
 Name: non_yaml_in_includes
 
-Found 1 error
+Found 2 errors
 
 Exit code: 1
diff --git a/acceptance/bundle/includes/non_yaml_in_include/test2.py b/acceptance/bundle/includes/non_yaml_in_include/test2.py
new file mode 100644
index 00000000000..e0aa8cdbfb6
--- /dev/null
+++ b/acceptance/bundle/includes/non_yaml_in_include/test2.py
@@ -0,0 +1 @@
+print("Hello again")
diff --git a/acceptance/bundle/includes/plan_multifile/databricks.yml b/acceptance/bundle/includes/plan_multifile/databricks.yml
new file mode 100644
index 00000000000..ccd037dc93a
--- /dev/null
+++ b/acceptance/bundle/includes/plan_multifile/databricks.yml
@@ -0,0 +1,17 @@
+bundle:
+  name: plan_multifile
+
+# Resources are spread across separate files matched by two globs, plus one job
+# defined directly in the root file. The plan must account for every one of them.
+include:
+  - resources/*.yml
+  - resources/*/*.yml
+
+resources:
+  jobs:
+    root_job:
+      name: root_job
+
+targets:
+  dev:
+    default: true
diff --git a/acceptance/bundle/includes/plan_multifile/out.test.toml b/acceptance/bundle/includes/plan_multifile/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/includes/plan_multifile/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/includes/plan_multifile/output.txt b/acceptance/bundle/includes/plan_multifile/output.txt
new file mode 100644
index 00000000000..f9f563d462b
--- /dev/null
+++ b/acceptance/bundle/includes/plan_multifile/output.txt
@@ -0,0 +1,16 @@
+
+>>> [CLI] bundle plan
+Warning: unknown field: unknown_field
+  at resources.jobs.job_d
+  in resources/nested/job_d.yml:8:7
+
+create jobs.job_a
+create jobs.job_b
+create jobs.job_d
+create jobs.root_job
+create pipelines.pipeline_c
+
+Plan: 5 to add, 0 to change, 0 to delete, 0 unchanged
+
+=== job_a merged max_concurrent_runs from the override file
+4
diff --git a/acceptance/bundle/includes/plan_multifile/resources/job_a.yml b/acceptance/bundle/includes/plan_multifile/resources/job_a.yml
new file mode 100644
index 00000000000..63491130c8e
--- /dev/null
+++ b/acceptance/bundle/includes/plan_multifile/resources/job_a.yml
@@ -0,0 +1,8 @@
+resources:
+  jobs:
+    job_a:
+      name: job_a
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: ./nb.py
diff --git a/acceptance/bundle/includes/plan_multifile/resources/job_b.yml b/acceptance/bundle/includes/plan_multifile/resources/job_b.yml
new file mode 100644
index 00000000000..55b1adf5799
--- /dev/null
+++ b/acceptance/bundle/includes/plan_multifile/resources/job_b.yml
@@ -0,0 +1,8 @@
+resources:
+  jobs:
+    job_b:
+      name: job_b
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: ./nb.py
diff --git a/acceptance/bundle/includes/plan_multifile/resources/nb.py b/acceptance/bundle/includes/plan_multifile/resources/nb.py
new file mode 100644
index 00000000000..4914a7436d9
--- /dev/null
+++ b/acceptance/bundle/includes/plan_multifile/resources/nb.py
@@ -0,0 +1,2 @@
+# Databricks notebook source
+print("hello")
diff --git a/acceptance/bundle/includes/plan_multifile/resources/nested/job_d.yml b/acceptance/bundle/includes/plan_multifile/resources/nested/job_d.yml
new file mode 100644
index 00000000000..b3838b32e2a
--- /dev/null
+++ b/acceptance/bundle/includes/plan_multifile/resources/nested/job_d.yml
@@ -0,0 +1,12 @@
+resources:
+  jobs:
+    job_d:
+      name: job_d
+      # Unknown field in a nested included file. `bundle validate` must report its
+      # location as this file, which verifies that source locations survive the
+      # in-scope include merge this PR introduces for load performance.
+      unknown_field: true
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: ../nb.py
diff --git a/acceptance/bundle/includes/plan_multifile/resources/override_job_a.yml b/acceptance/bundle/includes/plan_multifile/resources/override_job_a.yml
new file mode 100644
index 00000000000..b12a4602c48
--- /dev/null
+++ b/acceptance/bundle/includes/plan_multifile/resources/override_job_a.yml
@@ -0,0 +1,9 @@
+# Target override for job_a lives in a different file than its base definition.
+# UniqueResourceKeys allows a resource to span files inside a target block, so this
+# must merge into job_a rather than error or produce a second resource.
+targets:
+  dev:
+    resources:
+      jobs:
+        job_a:
+          max_concurrent_runs: 4
diff --git a/acceptance/bundle/includes/plan_multifile/resources/pipeline_c.yml b/acceptance/bundle/includes/plan_multifile/resources/pipeline_c.yml
new file mode 100644
index 00000000000..636e2dbbba1
--- /dev/null
+++ b/acceptance/bundle/includes/plan_multifile/resources/pipeline_c.yml
@@ -0,0 +1,7 @@
+resources:
+  pipelines:
+    pipeline_c:
+      name: pipeline_c
+      libraries:
+        - notebook:
+            path: ./nb.py
diff --git a/acceptance/bundle/includes/plan_multifile/script b/acceptance/bundle/includes/plan_multifile/script
new file mode 100644
index 00000000000..08350775a73
--- /dev/null
+++ b/acceptance/bundle/includes/plan_multifile/script
@@ -0,0 +1,11 @@
+# Every resource defined across the included files (two globs + the root file) must
+# appear in the plan exactly once, and the cross-file target override must merge into
+# job_a rather than be dropped. The unknown field in resources/nested/job_d.yml is
+# reported against that file, verifying source locations survive the in-scope include
+# merge this PR introduces for load performance.
+trace $CLI bundle plan
+
+title "job_a merged max_concurrent_runs from the override file\n"
+# The located warning is already asserted by the plan above; drop the duplicate here so
+# this step only shows the merged value.
+trace $CLI bundle validate -o json 2>/dev/null | jq '.resources.jobs.job_a.max_concurrent_runs'
diff --git a/acceptance/bundle/includes/yml_outside_root/out.test.toml b/acceptance/bundle/includes/yml_outside_root/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/includes/yml_outside_root/out.test.toml
+++ b/acceptance/bundle/includes/yml_outside_root/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/integration_whl/base/out.test.toml b/acceptance/bundle/integration_whl/base/out.test.toml
index 880431d5a9f..8bfa768b35b 100644
--- a/acceptance/bundle/integration_whl/base/out.test.toml
+++ b/acceptance/bundle/integration_whl/base/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 CloudSlow = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/integration_whl/base/output.txt b/acceptance/bundle/integration_whl/base/output.txt
index 13343edcb7b..e45eb854f37 100644
--- a/acceptance/bundle/integration_whl/base/output.txt
+++ b/acceptance/bundle/integration_whl/base/output.txt
@@ -34,12 +34,12 @@ resources:
 Building python_artifact...
 Uploading dist/my_test_code-0.0.1-py3-none-any.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.some_other_job
+Files: 17 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle run some_other_job
-Run URL: [DATABRICKS_URL]/?o=[NUMID]#job/[SOME_OTHER_JOB_ID]/run/[NUMID]
+Run URL: [DATABRICKS_URL]/jobs/[SOME_OTHER_JOB_ID]/runs/[RUN_ID]?o=[WORKSPACE_ID]
 
 [TIMESTAMP] "[default] Test Wheel Job [UNIQUE_NAME]" RUNNING
 [TIMESTAMP] "[default] Test Wheel Job [UNIQUE_NAME]" TERMINATED SUCCESS
@@ -52,12 +52,11 @@ Got arguments:
 Building python_artifact...
 Uploading dist/my_test_code-0.0.1-py3-none-any.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 9 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
 
 >>> [CLI] bundle run some_other_job
-Run URL: [DATABRICKS_URL]/?o=[NUMID]#job/[SOME_OTHER_JOB_ID]/run/[NUMID]
+Run URL: [DATABRICKS_URL]/jobs/[SOME_OTHER_JOB_ID]/runs/[RUN_ID]?o=[WORKSPACE_ID]
 
 [TIMESTAMP] "[default] Test Wheel Job [UNIQUE_NAME]" RUNNING
 [TIMESTAMP] "[default] Test Wheel Job [UNIQUE_NAME]" TERMINATED SUCCESS
@@ -71,5 +70,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/integration_whl/custom_params/out.test.toml b/acceptance/bundle/integration_whl/custom_params/out.test.toml
index 880431d5a9f..8bfa768b35b 100644
--- a/acceptance/bundle/integration_whl/custom_params/out.test.toml
+++ b/acceptance/bundle/integration_whl/custom_params/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 CloudSlow = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/integration_whl/custom_params/output.txt b/acceptance/bundle/integration_whl/custom_params/output.txt
index b5b5af78091..5da9e5cf0e7 100644
--- a/acceptance/bundle/integration_whl/custom_params/output.txt
+++ b/acceptance/bundle/integration_whl/custom_params/output.txt
@@ -34,12 +34,12 @@ resources:
 Building python_artifact...
 Uploading dist/my_test_code-0.0.1-py3-none-any.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.some_other_job
+Files: 14 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle run some_other_job --python-params param1,param2
-Run URL: [DATABRICKS_URL]/?o=[NUMID]#job/[SOME_OTHER_JOB_ID]/run/[NUMID]
+Run URL: [DATABRICKS_URL]/jobs/[SOME_OTHER_JOB_ID]/runs/[RUN_ID]?o=[WORKSPACE_ID]
 
 [TIMESTAMP] "[default] Test Wheel Job [UNIQUE_NAME]" RUNNING
 [TIMESTAMP] "[default] Test Wheel Job [UNIQUE_NAME]" TERMINATED SUCCESS
@@ -53,5 +53,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/integration_whl/interactive_cluster/out.test.toml b/acceptance/bundle/integration_whl/interactive_cluster/out.test.toml
index 880431d5a9f..8bfa768b35b 100644
--- a/acceptance/bundle/integration_whl/interactive_cluster/out.test.toml
+++ b/acceptance/bundle/integration_whl/interactive_cluster/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 CloudSlow = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/integration_whl/interactive_cluster/output.txt b/acceptance/bundle/integration_whl/interactive_cluster/output.txt
index 57beb13d026..e56247af31c 100644
--- a/acceptance/bundle/integration_whl/interactive_cluster/output.txt
+++ b/acceptance/bundle/integration_whl/interactive_cluster/output.txt
@@ -34,12 +34,13 @@ resources:
 Building python_artifact...
 Uploading dist/my_test_code-0.0.1-py3-none-any.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created clusters.test_cluster
+Created jobs.some_other_job
+Files: 14 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle run some_other_job
-Run URL: [DATABRICKS_URL]/?o=[NUMID]#job/[SOME_OTHER_JOB_ID]/run/[NUMID]
+Run URL: [DATABRICKS_URL]/jobs/[SOME_OTHER_JOB_ID]/runs/[RUN_ID]?o=[WORKSPACE_ID]
 
 [TIMESTAMP] "[default] Test Wheel Job [UNIQUE_NAME]" RUNNING
 [TIMESTAMP] "[default] Test Wheel Job [UNIQUE_NAME]" TERMINATED SUCCESS
@@ -52,12 +53,11 @@ Got arguments:
 Building python_artifact...
 Uploading dist/my_test_code-0.0.1-py3-none-any.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 9 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 2 unchanged
 
 >>> [CLI] bundle run some_other_job
-Run URL: [DATABRICKS_URL]/?o=[NUMID]#job/[SOME_OTHER_JOB_ID]/run/[NUMID]
+Run URL: [DATABRICKS_URL]/jobs/[SOME_OTHER_JOB_ID]/runs/[RUN_ID]?o=[WORKSPACE_ID]
 
 [TIMESTAMP] "[default] Test Wheel Job [UNIQUE_NAME]" RUNNING
 [TIMESTAMP] "[default] Test Wheel Job [UNIQUE_NAME]" TERMINATED SUCCESS
@@ -72,5 +72,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 2 deleted
diff --git a/acceptance/bundle/integration_whl/interactive_cluster_declared_libs/databricks.yml.tmpl b/acceptance/bundle/integration_whl/interactive_cluster_declared_libs/databricks.yml.tmpl
new file mode 100644
index 00000000000..c8eba0a0bcb
--- /dev/null
+++ b/acceptance/bundle/integration_whl/interactive_cluster_declared_libs/databricks.yml.tmpl
@@ -0,0 +1,36 @@
+bundle:
+  name: wheel-task-declared-libs
+
+workspace:
+  root_path: "~/.bundle/$UNIQUE_NAME"
+
+resources:
+  clusters:
+    test_cluster:
+      cluster_name: "test-cluster-$UNIQUE_NAME"
+      spark_version: "$DEFAULT_SPARK_VERSION"
+      node_type_id: "$NODE_TYPE_ID"
+      num_workers: 1
+      data_security_mode: $DATA_SECURITY_MODE
+      libraries:
+        - pypi:
+            package: requests
+        - pypi:
+            package: urllib3
+
+  jobs:
+    some_other_job:
+      name: "[${bundle.target}] Test Wheel Job $UNIQUE_NAME"
+      tasks:
+        - task_key: TestTask
+          existing_cluster_id: "${resources.clusters.test_cluster.cluster_id}"
+          python_wheel_task:
+            package_name: my_test_code
+            entry_point: run
+            parameters:
+              - "one"
+              - "two"
+          libraries:
+            - whl: ./dist/*.whl
+            - pypi:
+                package: six
diff --git a/acceptance/bundle/integration_whl/interactive_cluster_declared_libs/my_test_code/__init__.py b/acceptance/bundle/integration_whl/interactive_cluster_declared_libs/my_test_code/__init__.py
new file mode 100644
index 00000000000..909f1f3220d
--- /dev/null
+++ b/acceptance/bundle/integration_whl/interactive_cluster_declared_libs/my_test_code/__init__.py
@@ -0,0 +1,2 @@
+__version__ = "0.0.1"
+__author__ = "Databricks"
diff --git a/acceptance/bundle/integration_whl/interactive_cluster_declared_libs/my_test_code/__main__.py b/acceptance/bundle/integration_whl/interactive_cluster_declared_libs/my_test_code/__main__.py
new file mode 100644
index 00000000000..ea918ce2d53
--- /dev/null
+++ b/acceptance/bundle/integration_whl/interactive_cluster_declared_libs/my_test_code/__main__.py
@@ -0,0 +1,16 @@
+"""
+The entry point of the Python Wheel
+"""
+
+import sys
+
+
+def main():
+    # This method will print the provided arguments
+    print("Hello from my func")
+    print("Got arguments:")
+    print(sys.argv)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/acceptance/bundle/integration_whl/interactive_cluster_declared_libs/out.test.toml b/acceptance/bundle/integration_whl/interactive_cluster_declared_libs/out.test.toml
new file mode 100644
index 00000000000..8bfa768b35b
--- /dev/null
+++ b/acceptance/bundle/integration_whl/interactive_cluster_declared_libs/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = true
+CloudSlow = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/integration_whl/interactive_cluster_declared_libs/output.txt b/acceptance/bundle/integration_whl/interactive_cluster_declared_libs/output.txt
new file mode 100644
index 00000000000..96612a33430
--- /dev/null
+++ b/acceptance/bundle/integration_whl/interactive_cluster_declared_libs/output.txt
@@ -0,0 +1,94 @@
+
+=== Deploy the cluster (declares requests and urllib3) and the wheel job that targets it
+OK: deployed
+
+=== Run the job: its task installs the wheel and pypi 'six' on the shared cluster, out of band
+OK: job ran
+
+=== Plan: the job's out-of-band 'six' shows as a removal, the declared libraries are unchanged
+>>> plan_pypi_libs
+{
+  "libraries[pypi='six;']": {
+    "action": "update",
+    "remote": {
+      "pypi": {
+        "package": "six"
+      }
+    }
+  }
+}
+
+=== Remove the declared 'urllib3' and redeploy: uninstalls urllib3 and the job's libraries, keeps requests
+>>> plan_pypi_libs
+{
+  "libraries[pypi='six;']": {
+    "action": "update",
+    "remote": {
+      "pypi": {
+        "package": "six"
+      }
+    }
+  },
+  "libraries[pypi='urllib3;']": {
+    "action": "update",
+    "old": {
+      "pypi": {
+        "package": "urllib3"
+      }
+    },
+    "remote": {
+      "pypi": {
+        "package": "urllib3"
+      }
+    }
+  }
+}
+
+OK: redeployed
+
+>>> print_requests.py //libraries/uninstall //libraries/install
+{
+  "method": "POST",
+  "path": "/api/2.0/libraries/uninstall",
+  "body": {
+    "cluster_id": "[TEST_CLUSTER_ID]",
+    "libraries": [
+      {
+        "pypi": {
+          "package": "urllib3"
+        }
+      },
+      {
+        "whl": "/Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/artifacts/.internal/my_test_code-0.0.1-py3-none-any.whl"
+      },
+      {
+        "pypi": {
+          "package": "six"
+        }
+      }
+    ]
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/libraries/install",
+  "body": {
+    "cluster_id": "[TEST_CLUSTER_ID]",
+    "libraries": [
+      {
+        "pypi": {
+          "package": "requests"
+        }
+      }
+    ]
+  }
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.clusters.test_cluster
+  delete resources.jobs.some_other_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/integration_whl/interactive_cluster_declared_libs/script b/acceptance/bundle/integration_whl/interactive_cluster_declared_libs/script
new file mode 100644
index 00000000000..d1eff7cc290
--- /dev/null
+++ b/acceptance/bundle/integration_whl/interactive_cluster_declared_libs/script
@@ -0,0 +1,35 @@
+export DATA_SECURITY_MODE=USER_ISOLATION
+envsubst < databricks.yml.tmpl > databricks.yml
+trap "errcode trace '$CLI' bundle destroy --auto-approve" EXIT
+
+# Show the cluster's pypi library plan entries; build/plan noise and the noisy wheel path go to LOG.
+plan_pypi_libs() {
+    $CLI bundle plan -o json 2>>LOG.plan | jq '.plan["resources.clusters.test_cluster"].changes | with_entries(select(.key | startswith("libraries[pypi")))'
+}
+
+title "Deploy the cluster (declares requests and urllib3) and the wheel job that targets it"
+$CLI bundle deploy &> LOG.deploy
+cat LOG.deploy | contains.py "clusters.test_cluster" > /dev/null
+printf '\n%s\n' "OK: deployed"
+
+# Normalize server-generated resource IDs before we read requests/plans.
+replace_ids.py
+
+title "Run the job: its task installs the wheel and pypi 'six' on the shared cluster, out of band"
+$CLI bundle run some_other_job &> LOG.run
+printf '\n%s\n' "OK: job ran"
+# Flush the install requests the run recorded so they do not leak into the redeploy assertions.
+print_requests.py //libraries/install > /dev/null
+
+title "Plan: the job's out-of-band 'six' shows as a removal, the declared libraries are unchanged"
+trace plan_pypi_libs
+
+title "Remove the declared 'urllib3' and redeploy: uninstalls urllib3 and the job's libraries, keeps requests"
+update_file.py databricks.yml "
+        - pypi:
+            package: urllib3" ""
+trace plan_pypi_libs
+$CLI bundle deploy &> LOG.deploy2
+cat LOG.deploy2 | contains.py "Updated clusters.test_cluster" > /dev/null
+printf '\n%s\n' "OK: redeployed"
+trace print_requests.py //libraries/uninstall //libraries/install
diff --git a/acceptance/bundle/integration_whl/interactive_cluster_declared_libs/setup.py b/acceptance/bundle/integration_whl/interactive_cluster_declared_libs/setup.py
new file mode 100644
index 00000000000..8b48a92b4ce
--- /dev/null
+++ b/acceptance/bundle/integration_whl/interactive_cluster_declared_libs/setup.py
@@ -0,0 +1,15 @@
+from setuptools import setup, find_packages
+
+import my_test_code
+
+setup(
+    name="my_test_code",
+    version=my_test_code.__version__,
+    author=my_test_code.__author__,
+    url="https://databricks.com",
+    author_email="john.doe@databricks.com",
+    description="my example wheel",
+    packages=find_packages(include=["my_test_code"]),
+    entry_points={"group1": "run=my_test_code.__main__:main"},
+    install_requires=["setuptools"],
+)
diff --git a/acceptance/bundle/integration_whl/interactive_cluster_declared_libs/test.toml b/acceptance/bundle/integration_whl/interactive_cluster_declared_libs/test.toml
new file mode 100644
index 00000000000..862bc4fe4ba
--- /dev/null
+++ b/acceptance/bundle/integration_whl/interactive_cluster_declared_libs/test.toml
@@ -0,0 +1,6 @@
+# The cluster declares `requests` and `urllib3`; the wheel job's task targets the same cluster via
+# existing_cluster_id and installs the wheel and pypi `six` on it. So the cluster reads back
+# libraries it never declared and treats them as drift: removing `urllib3` uninstalls it and the
+# job's libraries (marked UNINSTALL_ON_RESTART on cloud). Cloud + CloudSlow and the venv/wheel harness are inherited from the parent.
+# Direct engine only (cluster libraries are a direct-engine feature).
+RecordRequests = true
diff --git a/acceptance/bundle/integration_whl/interactive_cluster_dynamic_version/out.test.toml b/acceptance/bundle/integration_whl/interactive_cluster_dynamic_version/out.test.toml
index 19068d43e0a..2a5a8204f13 100644
--- a/acceptance/bundle/integration_whl/interactive_cluster_dynamic_version/out.test.toml
+++ b/acceptance/bundle/integration_whl/interactive_cluster_dynamic_version/out.test.toml
@@ -1,5 +1,4 @@
-Local = true
 Cloud = true
 CloudSlow = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
 EnvMatrix.DATA_SECURITY_MODE = ["USER_ISOLATION", "SINGLE_USER"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/integration_whl/interactive_cluster_dynamic_version/output.txt b/acceptance/bundle/integration_whl/interactive_cluster_dynamic_version/output.txt
index 64e5907450d..160d5c1abe4 100644
--- a/acceptance/bundle/integration_whl/interactive_cluster_dynamic_version/output.txt
+++ b/acceptance/bundle/integration_whl/interactive_cluster_dynamic_version/output.txt
@@ -1,14 +1,15 @@
 
 >>> [CLI] bundle deploy
 Building python_artifact...
-Uploading .databricks/bundle/default/patched_wheels/python_artifact_my_test_code/my_test_code-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl...
+Uploading .databricks/bundle/default/patched_wheels/python_artifact_my_test_code/my_test_code-0.0.1+[UNIX_TIME_NANOS]-py3-none-any.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created clusters.test_cluster
+Created jobs.some_other_job
+Files: 13 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle run some_other_job
-Run URL: [DATABRICKS_URL]/?o=[NUMID]#job/[SOME_OTHER_JOB_ID]/run/[NUMID]
+Run URL: [DATABRICKS_URL]/jobs/[SOME_OTHER_JOB_ID]/runs/[RUN_ID]?o=[WORKSPACE_ID]
 
 [TIMESTAMP] "[default] Test Wheel Job [UNIQUE_NAME]" RUNNING
 [TIMESTAMP] "[default] Test Wheel Job [UNIQUE_NAME]" TERMINATED SUCCESS
@@ -17,16 +18,10 @@ Got arguments:
 ['my_test_code', 'one', 'two']
 
 === Make a change to code without version change and run the job again
->>> [CLI] bundle deploy
-Building python_artifact...
-Uploading .databricks/bundle/default/patched_wheels/python_artifact_my_test_code/my_test_code-0.0.1+[UNIX_TIME_NANOS][1]-py3-none-any.whl...
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+>>> [CLI] bundle deploy -qq
 
 >>> [CLI] bundle run some_other_job
-Run URL: [DATABRICKS_URL]/?o=[NUMID]#job/[SOME_OTHER_JOB_ID]/run/[NUMID]
+Run URL: [DATABRICKS_URL]/jobs/[SOME_OTHER_JOB_ID]/runs/[RUN_ID]?o=[WORKSPACE_ID]
 
 [TIMESTAMP] "[default] Test Wheel Job [UNIQUE_NAME]" RUNNING
 [TIMESTAMP] "[default] Test Wheel Job [UNIQUE_NAME]" TERMINATED SUCCESS
@@ -41,5 +36,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 2 deleted
diff --git a/acceptance/bundle/integration_whl/interactive_cluster_dynamic_version/script b/acceptance/bundle/integration_whl/interactive_cluster_dynamic_version/script
index 987dbef22f3..b30a73ee0d2 100644
--- a/acceptance/bundle/integration_whl/interactive_cluster_dynamic_version/script
+++ b/acceptance/bundle/integration_whl/interactive_cluster_dynamic_version/script
@@ -10,5 +10,5 @@ trace $CLI bundle run some_other_job
 
 title "Make a change to code without version change and run the job again"
 update_file.py my_test_code/__main__.py 'Hello from my func' 'UPDATED MY FUNC'
-trace $CLI bundle deploy
+trace $CLI bundle deploy -qq
 trace $CLI bundle run some_other_job
diff --git a/acceptance/bundle/integration_whl/interactive_cluster_dynamic_version/test.toml b/acceptance/bundle/integration_whl/interactive_cluster_dynamic_version/test.toml
index 35f395f3c48..61acb1fe28b 100644
--- a/acceptance/bundle/integration_whl/interactive_cluster_dynamic_version/test.toml
+++ b/acceptance/bundle/integration_whl/interactive_cluster_dynamic_version/test.toml
@@ -1,5 +1,4 @@
-[EnvMatrix]
-DATA_SECURITY_MODE = [
+EnvMatrix.DATA_SECURITY_MODE = [
     "USER_ISOLATION",
     "SINGLE_USER",
 ]
diff --git a/acceptance/bundle/integration_whl/interactive_single_user/out.terraform.txt b/acceptance/bundle/integration_whl/interactive_single_user/out.terraform.txt
deleted file mode 100644
index c9ac86bb078..00000000000
--- a/acceptance/bundle/integration_whl/interactive_single_user/out.terraform.txt
+++ /dev/null
@@ -1,6 +0,0 @@
-Hello from my func
-Got arguments:
-['my_test_code', 'one', 'two']
-UPDATED MY FUNC
-Got arguments:
-['my_test_code', 'one', 'two']
diff --git a/acceptance/bundle/integration_whl/interactive_single_user/out.test.toml b/acceptance/bundle/integration_whl/interactive_single_user/out.test.toml
index 880431d5a9f..8bfa768b35b 100644
--- a/acceptance/bundle/integration_whl/interactive_single_user/out.test.toml
+++ b/acceptance/bundle/integration_whl/interactive_single_user/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 CloudSlow = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/integration_whl/interactive_single_user/out.direct.txt b/acceptance/bundle/integration_whl/interactive_single_user/out.txt
similarity index 100%
rename from acceptance/bundle/integration_whl/interactive_single_user/out.direct.txt
rename to acceptance/bundle/integration_whl/interactive_single_user/out.txt
diff --git a/acceptance/bundle/integration_whl/interactive_single_user/output.txt b/acceptance/bundle/integration_whl/interactive_single_user/output.txt
index f45e1b9ce42..33047159fbd 100644
--- a/acceptance/bundle/integration_whl/interactive_single_user/output.txt
+++ b/acceptance/bundle/integration_whl/interactive_single_user/output.txt
@@ -34,27 +34,22 @@ resources:
 Building python_artifact...
 Uploading dist/my_test_code-0.0.1-py3-none-any.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created clusters.test_cluster
+Created jobs.some_other_job
+Files: 13 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle run some_other_job
-Run URL: [DATABRICKS_URL]/?o=[NUMID]#job/[SOME_OTHER_JOB_ID]/run/[NUMID]
+Run URL: [DATABRICKS_URL]/jobs/[SOME_OTHER_JOB_ID]/runs/[RUN_ID]?o=[WORKSPACE_ID]
 
 [TIMESTAMP] "[default] Test Wheel Job [UNIQUE_NAME]" RUNNING
 [TIMESTAMP] "[default] Test Wheel Job [UNIQUE_NAME]" TERMINATED SUCCESS
 
 === Make a change to code without version change and run the job again
->>> [CLI] bundle deploy
-Building python_artifact...
-Uploading dist/my_test_code-0.0.1-py3-none-any.whl...
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+>>> [CLI] bundle deploy -qq
 
 >>> [CLI] bundle run some_other_job
-Run URL: [DATABRICKS_URL]/?o=[NUMID]#job/[SOME_OTHER_JOB_ID]/run/[NUMID]
+Run URL: [DATABRICKS_URL]/jobs/[SOME_OTHER_JOB_ID]/runs/[RUN_ID]?o=[WORKSPACE_ID]
 
 [TIMESTAMP] "[default] Test Wheel Job [UNIQUE_NAME]" RUNNING
 [TIMESTAMP] "[default] Test Wheel Job [UNIQUE_NAME]" TERMINATED SUCCESS
@@ -66,5 +61,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 2 deleted
diff --git a/acceptance/bundle/integration_whl/interactive_single_user/script b/acceptance/bundle/integration_whl/interactive_single_user/script
index 1fb27126962..62f516d0a5b 100644
--- a/acceptance/bundle/integration_whl/interactive_single_user/script
+++ b/acceptance/bundle/integration_whl/interactive_single_user/script
@@ -8,9 +8,9 @@ trace $CLI bundle deploy
 # Add all resource IDs to runtime replacements to avoid pattern matching ambiguity
 replace_ids.py
 
-trace $CLI bundle run some_other_job > out.$DATABRICKS_BUNDLE_ENGINE.txt
+trace $CLI bundle run some_other_job > out.txt
 
 title "Make a change to code without version change and run the job again"
 update_file.py my_test_code/__main__.py 'Hello from my func' 'UPDATED MY FUNC'
-trace $CLI bundle deploy
-trace $CLI bundle run some_other_job >> out.$DATABRICKS_BUNDLE_ENGINE.txt
+trace $CLI bundle deploy -qq
+trace $CLI bundle run some_other_job >> out.txt
diff --git a/acceptance/bundle/integration_whl/interactive_single_user/test.toml b/acceptance/bundle/integration_whl/interactive_single_user/test.toml
deleted file mode 100644
index 2713ce3c616..00000000000
--- a/acceptance/bundle/integration_whl/interactive_single_user/test.toml
+++ /dev/null
@@ -1 +0,0 @@
-Local = true
diff --git a/acceptance/bundle/integration_whl/serverless/out.test.toml b/acceptance/bundle/integration_whl/serverless/out.test.toml
index 68b04957a4c..8bfa768b35b 100644
--- a/acceptance/bundle/integration_whl/serverless/out.test.toml
+++ b/acceptance/bundle/integration_whl/serverless/out.test.toml
@@ -1,5 +1,3 @@
-Local = true
 Cloud = true
 CloudSlow = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/integration_whl/serverless/output.txt b/acceptance/bundle/integration_whl/serverless/output.txt
index f09d77ad397..99dfccb17a7 100644
--- a/acceptance/bundle/integration_whl/serverless/output.txt
+++ b/acceptance/bundle/integration_whl/serverless/output.txt
@@ -5,12 +5,12 @@
 Building my_test_code...
 Uploading dist/my_test_code-0.0.1-py3-none-any.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.some_other_job
+Files: 14 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle run some_other_job
-Run URL: [DATABRICKS_URL]/?o=[NUMID]#job/[SOME_OTHER_JOB_ID]/run/[NUMID]
+Run URL: [DATABRICKS_URL]/jobs/[SOME_OTHER_JOB_ID]/runs/[RUN_ID]?o=[WORKSPACE_ID]
 
 [TIMESTAMP] "My Wheel Job" RUNNING
 [TIMESTAMP] "My Wheel Job" TERMINATED SUCCESS
@@ -23,12 +23,11 @@ Got arguments:
 Building my_test_code...
 Uploading dist/my_test_code-0.0.1-py3-none-any.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 9 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
 
 >>> [CLI] bundle run some_other_job
-Run URL: [DATABRICKS_URL]/?o=[NUMID]#job/[SOME_OTHER_JOB_ID]/run/[NUMID]
+Run URL: [DATABRICKS_URL]/jobs/[SOME_OTHER_JOB_ID]/runs/[RUN_ID]?o=[WORKSPACE_ID]
 
 [TIMESTAMP] "My Wheel Job" RUNNING
 [TIMESTAMP] "My Wheel Job" TERMINATED SUCCESS
@@ -42,5 +41,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/integration_whl/serverless/test.toml b/acceptance/bundle/integration_whl/serverless/test.toml
index 565f411a975..46ee804dba7 100644
--- a/acceptance/bundle/integration_whl/serverless/test.toml
+++ b/acceptance/bundle/integration_whl/serverless/test.toml
@@ -1,8 +1,5 @@
 CloudSlow = true
-Local = true
-
 # serverless is only enabled if UC is enabled
-RequiresUnityCatalog = true
 
 [[Repls]]
 Old = '\\'
diff --git a/acceptance/bundle/integration_whl/serverless_custom_params/out.test.toml b/acceptance/bundle/integration_whl/serverless_custom_params/out.test.toml
index 68b04957a4c..8bfa768b35b 100644
--- a/acceptance/bundle/integration_whl/serverless_custom_params/out.test.toml
+++ b/acceptance/bundle/integration_whl/serverless_custom_params/out.test.toml
@@ -1,5 +1,3 @@
-Local = true
 Cloud = true
 CloudSlow = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/integration_whl/serverless_custom_params/output.txt b/acceptance/bundle/integration_whl/serverless_custom_params/output.txt
index d964055d869..2b93520215a 100644
--- a/acceptance/bundle/integration_whl/serverless_custom_params/output.txt
+++ b/acceptance/bundle/integration_whl/serverless_custom_params/output.txt
@@ -3,12 +3,12 @@
 Building python_artifact...
 Uploading dist/my_test_code-0.0.1-py3-none-any.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.some_other_job
+Files: 14 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle run some_other_job
-Run URL: [DATABRICKS_URL]/?o=[NUMID]#job/[SOME_OTHER_JOB_ID]/run/[NUMID]
+Run URL: [DATABRICKS_URL]/jobs/[SOME_OTHER_JOB_ID]/runs/[RUN_ID]?o=[WORKSPACE_ID]
 
 [TIMESTAMP] "[default] Test Wheel Job With Environments [UNIQUE_NAME]" RUNNING
 [TIMESTAMP] "[default] Test Wheel Job With Environments [UNIQUE_NAME]" TERMINATED SUCCESS
@@ -17,7 +17,7 @@ Got arguments:
 ['my_test_code', 'one', 'two']
 
 >>> [CLI] bundle run some_other_job --python-params=param1,param2
-Run URL: [DATABRICKS_URL]/?o=[NUMID]#job/[SOME_OTHER_JOB_ID]/run/[NUMID]
+Run URL: [DATABRICKS_URL]/jobs/[SOME_OTHER_JOB_ID]/runs/[RUN_ID]?o=[WORKSPACE_ID]
 
 [TIMESTAMP] "[default] Test Wheel Job With Environments [UNIQUE_NAME]" RUNNING
 [TIMESTAMP] "[default] Test Wheel Job With Environments [UNIQUE_NAME]" TERMINATED SUCCESS
@@ -31,5 +31,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/integration_whl/serverless_custom_params/test.toml b/acceptance/bundle/integration_whl/serverless_custom_params/test.toml
index a981bc44c08..8afd6c34cef 100644
--- a/acceptance/bundle/integration_whl/serverless_custom_params/test.toml
+++ b/acceptance/bundle/integration_whl/serverless_custom_params/test.toml
@@ -1,5 +1,2 @@
 Cloud = true
-Local = true
-
 # serverless is only enabled if UC is enabled
-RequiresUnityCatalog = true
diff --git a/acceptance/bundle/integration_whl/serverless_dynamic_version/out.test.toml b/acceptance/bundle/integration_whl/serverless_dynamic_version/out.test.toml
index 68b04957a4c..8bfa768b35b 100644
--- a/acceptance/bundle/integration_whl/serverless_dynamic_version/out.test.toml
+++ b/acceptance/bundle/integration_whl/serverless_dynamic_version/out.test.toml
@@ -1,5 +1,3 @@
-Local = true
 Cloud = true
 CloudSlow = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/integration_whl/serverless_dynamic_version/output.txt b/acceptance/bundle/integration_whl/serverless_dynamic_version/output.txt
index 0c44462f8a8..1da7e8fcce6 100644
--- a/acceptance/bundle/integration_whl/serverless_dynamic_version/output.txt
+++ b/acceptance/bundle/integration_whl/serverless_dynamic_version/output.txt
@@ -5,12 +5,12 @@
 Building my_test_code...
 Uploading .databricks/bundle/default/patched_wheels/my_test_code_my_test_code/my_test_code-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.some_other_job
+Files: 14 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle run some_other_job
-Run URL: [DATABRICKS_URL]/?o=[NUMID]#job/[SOME_OTHER_JOB_ID]/run/[NUMID]
+Run URL: [DATABRICKS_URL]/jobs/[SOME_OTHER_JOB_ID]/runs/[RUN_ID]?o=[WORKSPACE_ID]
 
 [TIMESTAMP] "My Wheel Job" RUNNING
 [TIMESTAMP] "My Wheel Job" TERMINATED SUCCESS
@@ -23,12 +23,12 @@ Got arguments:
 Building my_test_code...
 Uploading .databricks/bundle/default/patched_wheels/my_test_code_my_test_code/my_test_code-0.0.1+[UNIX_TIME_NANOS][1]-py3-none-any.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated jobs.some_other_job
+Files: 9 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle run some_other_job
-Run URL: [DATABRICKS_URL]/?o=[NUMID]#job/[SOME_OTHER_JOB_ID]/run/[NUMID]
+Run URL: [DATABRICKS_URL]/jobs/[SOME_OTHER_JOB_ID]/runs/[RUN_ID]?o=[WORKSPACE_ID]
 
 [TIMESTAMP] "My Wheel Job" RUNNING
 [TIMESTAMP] "My Wheel Job" TERMINATED SUCCESS
@@ -42,5 +42,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/integration_whl/serverless_dynamic_version/test.toml b/acceptance/bundle/integration_whl/serverless_dynamic_version/test.toml
index 01576446a6b..920da59d1d7 100644
--- a/acceptance/bundle/integration_whl/serverless_dynamic_version/test.toml
+++ b/acceptance/bundle/integration_whl/serverless_dynamic_version/test.toml
@@ -1,5 +1,4 @@
 # serverless is only enabled if UC is enabled
-RequiresUnityCatalog = true
 
 [[Repls]]
 Old = '\\'
diff --git a/acceptance/bundle/integration_whl/serverless_extras/databricks.yml.tmpl b/acceptance/bundle/integration_whl/serverless_extras/databricks.yml.tmpl
new file mode 100644
index 00000000000..08046ead0c5
--- /dev/null
+++ b/acceptance/bundle/integration_whl/serverless_extras/databricks.yml.tmpl
@@ -0,0 +1,27 @@
+bundle:
+  name: environment_key_extras
+
+workspace:
+  root_path: "~/.bundle/$UNIQUE_NAME"
+
+artifacts:
+    my_test_code:
+      type: whl
+      build: uv build --wheel --no-build-isolation
+
+resources:
+  jobs:
+    some_other_job:
+      name: "My Wheel Job"
+      tasks:
+        - task_key: TestTask
+          python_wheel_task:
+            package_name: "my_test_code"
+            entry_point: "run"
+          environment_key:  "test_env"
+      environments:
+        - environment_key:  "test_env"
+          spec:
+            environment_version: "2"
+            dependencies:
+              - ./dist/*.whl[train]
diff --git a/acceptance/bundle/integration_whl/serverless_extras/my_test_code/__init__.py b/acceptance/bundle/integration_whl/serverless_extras/my_test_code/__init__.py
new file mode 100644
index 00000000000..909f1f3220d
--- /dev/null
+++ b/acceptance/bundle/integration_whl/serverless_extras/my_test_code/__init__.py
@@ -0,0 +1,2 @@
+__version__ = "0.0.1"
+__author__ = "Databricks"
diff --git a/acceptance/bundle/integration_whl/serverless_extras/my_test_code/__main__.py b/acceptance/bundle/integration_whl/serverless_extras/my_test_code/__main__.py
new file mode 100644
index 00000000000..ea918ce2d53
--- /dev/null
+++ b/acceptance/bundle/integration_whl/serverless_extras/my_test_code/__main__.py
@@ -0,0 +1,16 @@
+"""
+The entry point of the Python Wheel
+"""
+
+import sys
+
+
+def main():
+    # This method will print the provided arguments
+    print("Hello from my func")
+    print("Got arguments:")
+    print(sys.argv)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/acceptance/bundle/integration_whl/serverless_extras/out.test.toml b/acceptance/bundle/integration_whl/serverless_extras/out.test.toml
new file mode 100644
index 00000000000..8bfa768b35b
--- /dev/null
+++ b/acceptance/bundle/integration_whl/serverless_extras/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = true
+CloudSlow = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/integration_whl/serverless_extras/output.txt b/acceptance/bundle/integration_whl/serverless_extras/output.txt
new file mode 100644
index 00000000000..c9c5ac6554d
--- /dev/null
+++ b/acceptance/bundle/integration_whl/serverless_extras/output.txt
@@ -0,0 +1,31 @@
+
+>>> [CLI] bundle deploy
+Building my_test_code...
+Uploading dist/my_test_code-0.0.1-py3-none-any.whl...
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Created jobs.some_other_job
+Files: 13 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== The environment dependency keeps its [train] extras suffix
+>>> [CLI] jobs get [SOME_OTHER_JOB_ID]
+[
+  "/Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/artifacts/.internal/my_test_code-0.0.1-py3-none-any.whl[train]"
+]
+
+>>> [CLI] bundle run some_other_job
+Run URL: [DATABRICKS_URL]/jobs/[SOME_OTHER_JOB_ID]/runs/[RUN_ID]?o=[WORKSPACE_ID]
+
+[TIMESTAMP] "My Wheel Job" RUNNING
+[TIMESTAMP] "My Wheel Job" TERMINATED SUCCESS
+Hello from my func
+Got arguments:
+['my_test_code']
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.some_other_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/integration_whl/serverless_extras/pyproject.toml b/acceptance/bundle/integration_whl/serverless_extras/pyproject.toml
new file mode 100644
index 00000000000..a7ad7ff37df
--- /dev/null
+++ b/acceptance/bundle/integration_whl/serverless_extras/pyproject.toml
@@ -0,0 +1,22 @@
+[build-system]
+requires = ["setuptools"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "my_test_code"
+version = "0.0.1"
+description = "my example wheel"
+authors = [{ name = "Databricks", email = "john.doe@databricks.com" }]
+dependencies = ["setuptools"]
+
+[project.optional-dependencies]
+train = ["requests"]
+
+[project.urls]
+Homepage = "https://databricks.com"
+
+[project.entry-points.group1]
+run = "my_test_code.__main__:main"
+
+[tool.setuptools]
+packages = ["my_test_code"]
diff --git a/acceptance/bundle/integration_whl/serverless_extras/script b/acceptance/bundle/integration_whl/serverless_extras/script
new file mode 100644
index 00000000000..2de85e21b4b
--- /dev/null
+++ b/acceptance/bundle/integration_whl/serverless_extras/script
@@ -0,0 +1,16 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+trace $CLI bundle deploy
+
+# Add all resource IDs to runtime replacements to avoid pattern matching ambiguity
+replace_ids.py
+
+title "The environment dependency keeps its [train] extras suffix"
+trace $CLI jobs get "$(read_id.py some_other_job)" | jq '.settings.environments[].spec.dependencies'
+
+trace $CLI bundle run some_other_job
diff --git a/acceptance/bundle/integration_whl/serverless_extras/test.toml b/acceptance/bundle/integration_whl/serverless_extras/test.toml
new file mode 100644
index 00000000000..8afd6c34cef
--- /dev/null
+++ b/acceptance/bundle/integration_whl/serverless_extras/test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+# serverless is only enabled if UC is enabled
diff --git a/acceptance/bundle/integration_whl/serverless_extras_dynamic_version/databricks.yml.tmpl b/acceptance/bundle/integration_whl/serverless_extras_dynamic_version/databricks.yml.tmpl
new file mode 100644
index 00000000000..a306434a347
--- /dev/null
+++ b/acceptance/bundle/integration_whl/serverless_extras_dynamic_version/databricks.yml.tmpl
@@ -0,0 +1,28 @@
+bundle:
+  name: environment_key_extras_dynamic_version
+
+workspace:
+  root_path: "~/.bundle/$UNIQUE_NAME"
+
+artifacts:
+    my_test_code:
+      type: whl
+      build: uv build --wheel --no-build-isolation
+      dynamic_version: true
+
+resources:
+  jobs:
+    some_other_job:
+      name: "My Wheel Job"
+      tasks:
+        - task_key: TestTask
+          python_wheel_task:
+            package_name: "my_test_code"
+            entry_point: "run"
+          environment_key:  "test_env"
+      environments:
+        - environment_key:  "test_env"
+          spec:
+            environment_version: "2"
+            dependencies:
+              - ./dist/*.whl[train]
diff --git a/acceptance/bundle/integration_whl/serverless_extras_dynamic_version/my_test_code/__init__.py b/acceptance/bundle/integration_whl/serverless_extras_dynamic_version/my_test_code/__init__.py
new file mode 100644
index 00000000000..909f1f3220d
--- /dev/null
+++ b/acceptance/bundle/integration_whl/serverless_extras_dynamic_version/my_test_code/__init__.py
@@ -0,0 +1,2 @@
+__version__ = "0.0.1"
+__author__ = "Databricks"
diff --git a/acceptance/bundle/integration_whl/serverless_extras_dynamic_version/my_test_code/__main__.py b/acceptance/bundle/integration_whl/serverless_extras_dynamic_version/my_test_code/__main__.py
new file mode 100644
index 00000000000..ea918ce2d53
--- /dev/null
+++ b/acceptance/bundle/integration_whl/serverless_extras_dynamic_version/my_test_code/__main__.py
@@ -0,0 +1,16 @@
+"""
+The entry point of the Python Wheel
+"""
+
+import sys
+
+
+def main():
+    # This method will print the provided arguments
+    print("Hello from my func")
+    print("Got arguments:")
+    print(sys.argv)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/acceptance/bundle/integration_whl/serverless_extras_dynamic_version/out.test.toml b/acceptance/bundle/integration_whl/serverless_extras_dynamic_version/out.test.toml
new file mode 100644
index 00000000000..8bfa768b35b
--- /dev/null
+++ b/acceptance/bundle/integration_whl/serverless_extras_dynamic_version/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = true
+CloudSlow = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/integration_whl/serverless_extras_dynamic_version/output.txt b/acceptance/bundle/integration_whl/serverless_extras_dynamic_version/output.txt
new file mode 100644
index 00000000000..ae76c6b53d9
--- /dev/null
+++ b/acceptance/bundle/integration_whl/serverless_extras_dynamic_version/output.txt
@@ -0,0 +1,31 @@
+
+>>> [CLI] bundle deploy
+Building my_test_code...
+Uploading .databricks/bundle/default/patched_wheels/my_test_code_my_test_code/my_test_code-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl...
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Created jobs.some_other_job
+Files: 13 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== The environment dependency keeps its [train] extras suffix
+>>> [CLI] jobs get [SOME_OTHER_JOB_ID]
+[
+  "/Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/artifacts/.internal/my_test_code-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl[train]"
+]
+
+>>> [CLI] bundle run some_other_job
+Run URL: [DATABRICKS_URL]/jobs/[SOME_OTHER_JOB_ID]/runs/[RUN_ID]?o=[WORKSPACE_ID]
+
+[TIMESTAMP] "My Wheel Job" RUNNING
+[TIMESTAMP] "My Wheel Job" TERMINATED SUCCESS
+Hello from my func
+Got arguments:
+['my_test_code']
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.some_other_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/integration_whl/serverless_extras_dynamic_version/pyproject.toml b/acceptance/bundle/integration_whl/serverless_extras_dynamic_version/pyproject.toml
new file mode 100644
index 00000000000..a7ad7ff37df
--- /dev/null
+++ b/acceptance/bundle/integration_whl/serverless_extras_dynamic_version/pyproject.toml
@@ -0,0 +1,22 @@
+[build-system]
+requires = ["setuptools"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "my_test_code"
+version = "0.0.1"
+description = "my example wheel"
+authors = [{ name = "Databricks", email = "john.doe@databricks.com" }]
+dependencies = ["setuptools"]
+
+[project.optional-dependencies]
+train = ["requests"]
+
+[project.urls]
+Homepage = "https://databricks.com"
+
+[project.entry-points.group1]
+run = "my_test_code.__main__:main"
+
+[tool.setuptools]
+packages = ["my_test_code"]
diff --git a/acceptance/bundle/integration_whl/serverless_extras_dynamic_version/script b/acceptance/bundle/integration_whl/serverless_extras_dynamic_version/script
new file mode 100644
index 00000000000..2de85e21b4b
--- /dev/null
+++ b/acceptance/bundle/integration_whl/serverless_extras_dynamic_version/script
@@ -0,0 +1,16 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+trace $CLI bundle deploy
+
+# Add all resource IDs to runtime replacements to avoid pattern matching ambiguity
+replace_ids.py
+
+title "The environment dependency keeps its [train] extras suffix"
+trace $CLI jobs get "$(read_id.py some_other_job)" | jq '.settings.environments[].spec.dependencies'
+
+trace $CLI bundle run some_other_job
diff --git a/acceptance/bundle/integration_whl/serverless_extras_dynamic_version/test.toml b/acceptance/bundle/integration_whl/serverless_extras_dynamic_version/test.toml
new file mode 100644
index 00000000000..0b0adfab790
--- /dev/null
+++ b/acceptance/bundle/integration_whl/serverless_extras_dynamic_version/test.toml
@@ -0,0 +1,7 @@
+Cloud = true
+# serverless is only enabled if UC is enabled
+
+# The patched-wheel path is built with the OS separator; normalize for Windows.
+[[Repls]]
+Old = '\\'
+New = '/'
diff --git a/acceptance/bundle/integration_whl/test.toml b/acceptance/bundle/integration_whl/test.toml
index d97c489629e..b29abd8a7ec 100644
--- a/acceptance/bundle/integration_whl/test.toml
+++ b/acceptance/bundle/integration_whl/test.toml
@@ -1,4 +1,4 @@
-Local = true
+Cloud = true
 CloudSlow = true
 
 # Workspace file system does not allow initializing python envs on it.
@@ -26,3 +26,7 @@ Ignore = [
     "python_wheel_wrapper.yml",
     "empty.yml",
 ]
+
+[[Repls]]
+Old = '/runs/\d+'
+New = '/runs/[RUN_ID]'
diff --git a/acceptance/bundle/integration_whl/wrapper/out.test.toml b/acceptance/bundle/integration_whl/wrapper/out.test.toml
index 44a1a2186a1..14134330c80 100644
--- a/acceptance/bundle/integration_whl/wrapper/out.test.toml
+++ b/acceptance/bundle/integration_whl/wrapper/out.test.toml
@@ -1,6 +1,5 @@
-Local = true
 Cloud = true
 CloudSlow = true
 CloudEnvs.aws = false
 CloudEnvs.gcp = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/integration_whl/wrapper/output.txt b/acceptance/bundle/integration_whl/wrapper/output.txt
index bae674f2da4..418dcc45bda 100644
--- a/acceptance/bundle/integration_whl/wrapper/output.txt
+++ b/acceptance/bundle/integration_whl/wrapper/output.txt
@@ -34,12 +34,12 @@ resources:
 Building python_artifact...
 Uploading dist/my_test_code-0.0.1-py3-none-any.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.some_other_job
+Files: 15 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle run some_other_job
-Run URL: [DATABRICKS_URL]/?o=[NUMID]#job/[SOME_OTHER_JOB_ID]/run/[NUMID]
+Run URL: [DATABRICKS_URL]/jobs/[SOME_OTHER_JOB_ID]/runs/[RUN_ID]?o=[WORKSPACE_ID]
 
 [TIMESTAMP] "[default] Test Wheel Job [UNIQUE_NAME]" RUNNING
 [TIMESTAMP] "[default] Test Wheel Job [UNIQUE_NAME]" TERMINATED SUCCESS
@@ -53,5 +53,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/integration_whl/wrapper_custom_params/out.test.toml b/acceptance/bundle/integration_whl/wrapper_custom_params/out.test.toml
index 44a1a2186a1..14134330c80 100644
--- a/acceptance/bundle/integration_whl/wrapper_custom_params/out.test.toml
+++ b/acceptance/bundle/integration_whl/wrapper_custom_params/out.test.toml
@@ -1,6 +1,5 @@
-Local = true
 Cloud = true
 CloudSlow = true
 CloudEnvs.aws = false
 CloudEnvs.gcp = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/integration_whl/wrapper_custom_params/output.txt b/acceptance/bundle/integration_whl/wrapper_custom_params/output.txt
index 96a698ba0d3..f7127244cd2 100644
--- a/acceptance/bundle/integration_whl/wrapper_custom_params/output.txt
+++ b/acceptance/bundle/integration_whl/wrapper_custom_params/output.txt
@@ -34,12 +34,12 @@ resources:
 Building python_artifact...
 Uploading dist/my_test_code-0.0.1-py3-none-any.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.some_other_job
+Files: 15 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle run some_other_job --python-params param1,param2
-Run URL: [DATABRICKS_URL]/?o=[NUMID]#job/[NUMID]/run/[NUMID]
+Run URL: [DATABRICKS_URL]/jobs/[SOME_OTHER_JOB_ID]/runs/[RUN_ID]?o=[WORKSPACE_ID]
 
 [TIMESTAMP] "[default] Test Wheel Job [UNIQUE_NAME]" RUNNING
 [TIMESTAMP] "[default] Test Wheel Job [UNIQUE_NAME]" TERMINATED SUCCESS
@@ -53,5 +53,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/integration_whl/wrapper_custom_params/script b/acceptance/bundle/integration_whl/wrapper_custom_params/script
index ab9c4503276..ebe783a86b8 100644
--- a/acceptance/bundle/integration_whl/wrapper_custom_params/script
+++ b/acceptance/bundle/integration_whl/wrapper_custom_params/script
@@ -5,4 +5,5 @@ cp -r $TESTDIR/../base/{$EXTRA_CONFIG,setup.py,my_test_code} .
 trace cat databricks.yml
 trap "errcode trace '$CLI' bundle destroy --auto-approve" EXIT
 trace $CLI bundle deploy
+replace_ids.py
 trace $CLI bundle run some_other_job --python-params param1,param2
diff --git a/acceptance/bundle/invariant/README.md b/acceptance/bundle/invariant/README.md
index 184d3f541c4..3dc1bf04fab 100644
--- a/acceptance/bundle/invariant/README.md
+++ b/acceptance/bundle/invariant/README.md
@@ -4,3 +4,12 @@ no_drift test checks that there are no actions planned after successful deploy.
 test will dump full JSON plan to the output.
 
 In order to add a new test, add a config to configs/ and include it in test.toml.
+
+The no_drift test additionally exercises removing non-required fields. Tag a field with a
+`# CAN_REMOVE` comment on each of its lines; after the baseline no-drift check the test strips those
+lines (`grep -v '# CAN_REMOVE'`), then asserts the resulting plan is an update and that deploying it
+leaves no drift. This guards the class of bug where a field the config stops declaring is dropped from
+the update request instead of being cleared. Configs without `# CAN_REMOVE` only run the baseline. If a
+field's removal does not converge, tag it `# CANNOT_REMOVE` with a comment explaining the error or drift,
+rather than leaving a failing `# CAN_REMOVE`. The marker is matched with its `# ` prefix, so
+`# CANNOT_REMOVE` and prose that mentions the marker are neither stripped nor treated as a tag.
diff --git a/acceptance/bundle/invariant/auto-migrate/out.test.toml b/acceptance/bundle/invariant/auto-migrate/out.test.toml
new file mode 100644
index 00000000000..e44a5f2ce38
--- /dev/null
+++ b/acceptance/bundle/invariant/auto-migrate/out.test.toml
@@ -0,0 +1,46 @@
+Cloud = false
+EnvMatrix.DMS = [""]
+EnvMatrix.INPUT_CONFIG = [
+  "alert.yml.tmpl",
+  "app.yml.tmpl",
+  "cluster.yml.tmpl",
+  "cluster_apply_policy_default_values.yml.tmpl",
+  "dashboard.yml.tmpl",
+  "job_apply_policy_default_values_job_cluster.yml.tmpl",
+  "job_apply_policy_default_values_task_cluster.yml.tmpl",
+  "job_apply_policy_default_values_for_each_task.yml.tmpl",
+  "database_catalog.yml.tmpl",
+  "database_instance.yml.tmpl",
+  "experiment.yml.tmpl",
+  "job.yml.tmpl",
+  "job_pydabs_10_tasks.yml.tmpl",
+  "job_escaped_refs.yml.tmpl",
+  "job_run_job_ref.yml.tmpl",
+  "job_table_update_trigger.yml.tmpl",
+  "job_with_depends_on.yml.tmpl",
+  "job_with_task.yml.tmpl",
+  "model.yml.tmpl",
+  "model_with_permissions.yml.tmpl",
+  "model_serving_endpoint.yml.tmpl",
+  "pipeline.yml.tmpl",
+  "pipeline_allow_duplicate_names.yml.tmpl",
+  "pipeline_apply_policy_default_values.yml.tmpl",
+  "pipeline_config_dots.yml.tmpl",
+  "postgres_branch.yml.tmpl",
+  "postgres_catalog.yml.tmpl",
+  "postgres_database.yml.tmpl",
+  "postgres_endpoint.yml.tmpl",
+  "postgres_project.yml.tmpl",
+  "postgres_role.yml.tmpl",
+  "postgres_synced_table.yml.tmpl",
+  "registered_model.yml.tmpl",
+  "schema_tf_compat.yml.tmpl",
+  "schema_empty_grants.yml.tmpl",
+  "schema_uppercase_name.yml.tmpl",
+  "secret_scope.yml.tmpl",
+  "secret_scope_default_backend_type.yml.tmpl",
+  "synced_database_table.yml.tmpl",
+  "volume.yml.tmpl",
+  "volume_external.yml.tmpl",
+  "volume_path_job_ref.yml.tmpl"
+]
diff --git a/acceptance/bundle/invariant/auto-migrate/output.txt b/acceptance/bundle/invariant/auto-migrate/output.txt
new file mode 100644
index 00000000000..7a28cb73a58
--- /dev/null
+++ b/acceptance/bundle/invariant/auto-migrate/output.txt
@@ -0,0 +1 @@
+INPUT_CONFIG_OK
diff --git a/acceptance/bundle/invariant/auto-migrate/script b/acceptance/bundle/invariant/auto-migrate/script
new file mode 100644
index 00000000000..9ca136c4881
--- /dev/null
+++ b/acceptance/bundle/invariant/auto-migrate/script
@@ -0,0 +1,19 @@
+# Invariant to test: auto-migration on deploy is successful, no drift after deploy
+# Additional checks: no internal errors / panics in any commands
+
+unset DATABRICKS_BUNDLE_ENGINE
+
+invariant_setup
+
+# Replay a prior terraform deployment (per-config fixture captured once from a real terraform
+# run), standing in for the terraform deploy now that these tests must not run terraform.
+invariant_deploy LOG.replay replay_tfstate.py "$TESTDIR/../fixtures/$INPUT_CONFIG.requests.json" "$TESTDIR/../fixtures/$INPUT_CONFIG.tfstate"
+
+# Deploy on the direct default (engine unset): this migrates the terraform state to the
+# direct engine before deploying, exercising the auto path. Not invariant_deploy -- the
+# config was already validated by the terraform deploy above, so a failure here is a bug,
+# not an invalid config (and it must not re-emit the INPUT_CONFIG_OK marker).
+trace $CLI bundle deploy &> LOG.migrate
+cat LOG.migrate | contains.py '!panic:' '!internal error' > /dev/null
+
+invariant_verify_no_drift
diff --git a/acceptance/bundle/invariant/auto-migrate/test.toml b/acceptance/bundle/invariant/auto-migrate/test.toml
new file mode 100644
index 00000000000..e0be4eb605f
--- /dev/null
+++ b/acceptance/bundle/invariant/auto-migrate/test.toml
@@ -0,0 +1,73 @@
+# These migrate a per-config terraform-state fixture (replayed by replay_tfstate.py, captured once
+# against the local test server) instead of running a live terraform deploy, so they are local-only.
+# That is complete coverage, not a gap: tf->direct migration is a one-time transition over a closed
+# set of resource types (terraform gets no new converters, and resources created on the direct
+# engine are never migrated), so a real-workspace run would add nothing.
+Cloud = false
+
+# Recording needs a bundle it has seen from the start. This test seeds a state file,
+# so recording refuses it. TODO(DMS): drop this once existing state can be
+# handed over to the service (see the TODO in dstate.Open).
+EnvMatrix.DMS = [""]
+
+# schema.yml sets custom_max_retention_hours, which the terraform databricks_schema resource cannot
+# set (only direct does), so a terraform-first migrate would drift. schema_tf_compat.yml keeps migrate
+# coverage for schemas.
+EnvMatrixExclude.no_schema_custom_retention = ["INPUT_CONFIG=schema.yml.tmpl"]
+
+# vector_search_endpoints and vector_search_indexes have no terraform converter
+EnvMatrixExclude.no_vector_search_endpoint = ["INPUT_CONFIG=vector_search_endpoint.yml.tmpl"]
+EnvMatrixExclude.no_vector_search_index = ["INPUT_CONFIG=vector_search_index.yml.tmpl"]
+
+# job_runs is a direct-only resource with no terraform converter, so the
+# terraform deploy that seeds the migration fails for it.
+EnvMatrixExclude.no_job_run = ["INPUT_CONFIG=job_run.yml.tmpl"]
+
+# Error: Catalog resources are only supported with direct deployment mode
+EnvMatrixExclude.no_catalog = ["INPUT_CONFIG=catalog.yml.tmpl"]
+EnvMatrixExclude.no_catalog_optional_fields = ["INPUT_CONFIG=catalog_optional_fields.yml.tmpl"]
+EnvMatrixExclude.no_external_location = ["INPUT_CONFIG=external_location.yml.tmpl"]
+# uc_trailing_slash includes a catalog, which is direct-only (see above).
+EnvMatrixExclude.no_uc_trailing_slash = ["INPUT_CONFIG=uc_trailing_slash.yml.tmpl"]
+# Genie spaces are direct-only too; the terraform deploy that seeds the migration fails for them.
+EnvMatrixExclude.no_genie_space = ["INPUT_CONFIG=genie_space.yml.tmpl"]
+# Instance pools are direct-only; the terraform deploy that seeds the migration fails for them.
+EnvMatrixExclude.no_instance_pool = ["INPUT_CONFIG=instance_pool.yml.tmpl"]
+# Cluster policies are direct-only; the terraform deploy that seeds the migration fails for them.
+EnvMatrixExclude.no_cluster_policy = ["INPUT_CONFIG=cluster_policy.yml.tmpl"]
+# Cluster libraries are direct-only; the terraform deploy that seeds the migration fails for them.
+EnvMatrixExclude.no_cluster_libraries = ["INPUT_CONFIG=cluster_libraries.yml.tmpl"]
+# AI Gateway securables are direct-only; the terraform deploy that seeds the migration fails for them.
+EnvMatrixExclude.no_model_service = ["INPUT_CONFIG=model_service.yml.tmpl"]
+# Features are direct-only; the terraform deploy that seeds the migration fails for them.
+EnvMatrixExclude.no_feature = ["INPUT_CONFIG=feature.yml.tmpl"]
+
+# Cross-resource permission references (e.g. ${resources.jobs.job_b.permissions[0].level})
+# don't work in terraform mode: the terraform interpolator converts the path to
+# ${databricks_job.job_b.permissions[0].level}, but Terraform's databricks_job resource
+# does not expose permissions as output attributes (permissions are a separate
+# databricks_permissions resource in terraform), so the literal unresolved string
+# ends up as the permission level value.
+EnvMatrixExclude.no_permission_ref = ["INPUT_CONFIG=job_permission_ref.yml.tmpl"]
+EnvMatrixExclude.no_cross_resource_ref = ["INPUT_CONFIG=job_cross_resource_ref.yml.tmpl"]
+
+# Grant cross-references require the EmbeddedSlice pattern not present in terraform mode.
+EnvMatrixExclude.no_grant_ref = ["INPUT_CONFIG=schema_grant_ref.yml.tmpl"]
+
+# SQL warehouses currently failing with migration with permanent drift. TODO: fix this.
+EnvMatrixExclude.no_sql_warehouse = ["INPUT_CONFIG=sql_warehouse.yml.tmpl"]
+
+# The 1000-task scale case is covered by no_drift. Running it here adds ~1.5 min
+# per variant (deploy + migrate + plan at 1000 tasks) without incremental coverage.
+EnvMatrixExclude.no_pydabs_1000_tasks = ["INPUT_CONFIG=job_pydabs_1000_tasks.yml.tmpl"]
+
+# migrate deploys via Terraform first, and the TF provider rejects an uppercase
+# volume schema_name ("inconsistent final plan"). Covered by no_drift on direct.
+EnvMatrixExclude.no_volume_uppercase = ["INPUT_CONFIG=volume_uppercase_name.yml.tmpl"]
+
+# UC secrets are direct-only (no terraform converter), so the terraform deploy that seeds
+# the migration fails for them.
+EnvMatrixExclude.no_secret = ["INPUT_CONFIG=secret.yml.tmpl"]
+
+# Terraform types sampling_fraction as an integer and truncates 0.5; covered by no_drift.
+EnvMatrixExclude.no_model_serving_endpoint_telemetry = ["INPUT_CONFIG=model_serving_endpoint_telemetry.yml.tmpl"]
diff --git a/acceptance/bundle/invariant/configs/alert.yml.tmpl b/acceptance/bundle/invariant/configs/alert.yml.tmpl
index ea4acf7ffa9..80838f7fe75 100644
--- a/acceptance/bundle/invariant/configs/alert.yml.tmpl
+++ b/acceptance/bundle/invariant/configs/alert.yml.tmpl
@@ -7,3 +7,6 @@ resources:
       warehouse_id: $TEST_DEFAULT_WAREHOUSE_ID
       display_name: test-alert-$UNIQUE_NAME
       file_path: ./alert.dbalert.json
+      permissions:
+        - level: CAN_MANAGE
+          group_name: users
diff --git a/acceptance/bundle/invariant/configs/app.yml.tmpl b/acceptance/bundle/invariant/configs/app.yml.tmpl
index 7506f8fdc9e..bfd0b9bec6a 100644
--- a/acceptance/bundle/invariant/configs/app.yml.tmpl
+++ b/acceptance/bundle/invariant/configs/app.yml.tmpl
@@ -6,3 +6,7 @@ resources:
     foo:
       name: app-$UNIQUE_NAME
       source_code_path: ./app
+      description: This is a test app # CAN_REMOVE
+      permissions:
+        - level: CAN_USE
+          group_name: users
diff --git a/acceptance/bundle/invariant/configs/catalog.yml.tmpl b/acceptance/bundle/invariant/configs/catalog.yml.tmpl
index c525eab9a2f..75901f6061a 100644
--- a/acceptance/bundle/invariant/configs/catalog.yml.tmpl
+++ b/acceptance/bundle/invariant/configs/catalog.yml.tmpl
@@ -5,4 +5,8 @@ resources:
   catalogs:
     foo:
       name: test-catalog-$UNIQUE_NAME
-      comment: This is a test catalog
+      comment: This is a test catalog # CAN_REMOVE
+      grants:
+        - principal: account users
+          privileges:
+            - USE_CATALOG
diff --git a/acceptance/bundle/invariant/configs/catalog_optional_fields.yml.tmpl b/acceptance/bundle/invariant/configs/catalog_optional_fields.yml.tmpl
new file mode 100644
index 00000000000..6a971ec93d2
--- /dev/null
+++ b/acceptance/bundle/invariant/configs/catalog_optional_fields.yml.tmpl
@@ -0,0 +1,14 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  catalogs:
+    foo:
+      name: test-catalog-$UNIQUE_NAME
+      comment: This is a test catalog
+      custom_max_retention_hours: 48 # CAN_REMOVE
+      managed_encryption_settings:
+        customer_managed_key_id: 00000000-0000-0000-0000-000000000000
+      properties:
+        tier: bronze
+        team: data # CAN_REMOVE
diff --git a/acceptance/bundle/invariant/configs/cluster.yml.tmpl b/acceptance/bundle/invariant/configs/cluster.yml.tmpl
index d54d3d7dad8..22275900a52 100644
--- a/acceptance/bundle/invariant/configs/cluster.yml.tmpl
+++ b/acceptance/bundle/invariant/configs/cluster.yml.tmpl
@@ -7,4 +7,8 @@ resources:
       cluster_name: test-cluster-$UNIQUE_NAME
       spark_version: 13.3.x-scala2.12
       node_type_id: $NODE_TYPE_ID
+      instance_pool_id: $TEST_INSTANCE_POOL_ID
       num_workers: 1
+      permissions:
+        - level: CAN_ATTACH_TO
+          group_name: users
diff --git a/acceptance/bundle/invariant/configs/cluster_apply_policy_default_values.yml.tmpl b/acceptance/bundle/invariant/configs/cluster_apply_policy_default_values.yml.tmpl
new file mode 100644
index 00000000000..57f8541f30f
--- /dev/null
+++ b/acceptance/bundle/invariant/configs/cluster_apply_policy_default_values.yml.tmpl
@@ -0,0 +1,12 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  clusters:
+    foo:
+      cluster_name: test-cluster-$UNIQUE_NAME
+      spark_version: 13.3.x-scala2.12
+      node_type_id: $NODE_TYPE_ID
+      instance_pool_id: $TEST_INSTANCE_POOL_ID
+      num_workers: 1
+      apply_policy_default_values: true
diff --git a/acceptance/bundle/invariant/configs/cluster_libraries.yml.tmpl b/acceptance/bundle/invariant/configs/cluster_libraries.yml.tmpl
new file mode 100644
index 00000000000..507730ec287
--- /dev/null
+++ b/acceptance/bundle/invariant/configs/cluster_libraries.yml.tmpl
@@ -0,0 +1,14 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  clusters:
+    foo:
+      cluster_name: test-cluster-$UNIQUE_NAME
+      spark_version: 13.3.x-scala2.12
+      node_type_id: $NODE_TYPE_ID
+      instance_pool_id: $TEST_INSTANCE_POOL_ID
+      num_workers: 1
+      libraries:
+        - pypi:
+            package: requests
diff --git a/acceptance/bundle/invariant/configs/cluster_policy.yml.tmpl b/acceptance/bundle/invariant/configs/cluster_policy.yml.tmpl
new file mode 100644
index 00000000000..2bd9d90e538
--- /dev/null
+++ b/acceptance/bundle/invariant/configs/cluster_policy.yml.tmpl
@@ -0,0 +1,12 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  cluster_policies:
+    foo:
+      name: test-cluster-policy-$UNIQUE_NAME
+      definition: '{"spark_version":{"type":"fixed","value":"13.3.x-scala2.12"}}'
+      description: This is a test cluster policy # CAN_REMOVE
+      permissions:
+        - level: CAN_USE
+          group_name: users
diff --git a/acceptance/bundle/invariant/configs/dashboard.yml.tmpl b/acceptance/bundle/invariant/configs/dashboard.yml.tmpl
index a8a6d95ba16..c739ec72b52 100644
--- a/acceptance/bundle/invariant/configs/dashboard.yml.tmpl
+++ b/acceptance/bundle/invariant/configs/dashboard.yml.tmpl
@@ -5,5 +5,9 @@ resources:
   dashboards:
     foo:
       warehouse_id: $TEST_DEFAULT_WAREHOUSE_ID
+      # CANNOT_REMOVE: display_name is required; removing it fails validation ("dashboard display_name is required").
       display_name: test-dashboard-$UNIQUE_NAME
       file_path: ./dashboard.lvdash.json
+      permissions:
+        - level: CAN_READ
+          group_name: users
diff --git a/acceptance/bundle/invariant/configs/database_instance.yml.tmpl b/acceptance/bundle/invariant/configs/database_instance.yml.tmpl
index 1498593596d..c364740eb6f 100644
--- a/acceptance/bundle/invariant/configs/database_instance.yml.tmpl
+++ b/acceptance/bundle/invariant/configs/database_instance.yml.tmpl
@@ -6,3 +6,6 @@ resources:
     foo:
       name: test-db-instance-$UNIQUE_NAME
       capacity: CU_1
+      permissions:
+        - level: CAN_USE
+          group_name: users
diff --git a/acceptance/bundle/invariant/configs/experiment.yml.tmpl b/acceptance/bundle/invariant/configs/experiment.yml.tmpl
index 58a442e523b..1d6a275d85c 100644
--- a/acceptance/bundle/invariant/configs/experiment.yml.tmpl
+++ b/acceptance/bundle/invariant/configs/experiment.yml.tmpl
@@ -5,3 +5,6 @@ resources:
   experiments:
     foo:
       name: /Users/$CURRENT_USER_NAME/test-experiment-$UNIQUE_NAME
+      permissions:
+        - level: CAN_READ
+          group_name: users
diff --git a/acceptance/bundle/invariant/configs/external_location.yml.tmpl b/acceptance/bundle/invariant/configs/external_location.yml.tmpl
index 500cf2d41d3..3fe403dbf71 100644
--- a/acceptance/bundle/invariant/configs/external_location.yml.tmpl
+++ b/acceptance/bundle/invariant/configs/external_location.yml.tmpl
@@ -7,4 +7,8 @@ resources:
       name: test_location_$UNIQUE_NAME
       url: s3://test-bucket/path
       credential_name: test_storage_credential
-      comment: "Test external location from DABs"
+      comment: "Test external location from DABs" # CAN_REMOVE
+      grants:
+        - principal: account users
+          privileges:
+            - READ_FILES
diff --git a/acceptance/bundle/invariant/configs/feature.yml.tmpl b/acceptance/bundle/invariant/configs/feature.yml.tmpl
new file mode 100644
index 00000000000..fbd7529b9b0
--- /dev/null
+++ b/acceptance/bundle/invariant/configs/feature.yml.tmpl
@@ -0,0 +1,23 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  features:
+    foo:
+      full_name: main.feat_inv_$UNIQUE_NAME.test_feature
+      description: This is a test feature # CAN_REMOVE
+      source:
+        delta_table_source:
+          full_name: main.feat_inv_$UNIQUE_NAME.source_table
+      function:
+        aggregation_function:
+          count_function:
+            input: value
+          time_window:
+            sliding:
+              window_duration: 604800s
+              slide_duration: 86400s
+      entities:
+        - name: id
+      timeseries_column:
+        name: timestamp
diff --git a/acceptance/bundle/invariant/configs/feature.yml.tmpl-cleanup.sh b/acceptance/bundle/invariant/configs/feature.yml.tmpl-cleanup.sh
new file mode 100755
index 00000000000..46334094f3d
--- /dev/null
+++ b/acceptance/bundle/invariant/configs/feature.yml.tmpl-cleanup.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+echo "Cleaning up temporary source table"
+$CLI tables delete main.feat_inv_$UNIQUE_NAME.source_table || true
+$CLI schemas delete main.feat_inv_$UNIQUE_NAME || true
diff --git a/acceptance/bundle/invariant/configs/feature.yml.tmpl-init.sh b/acceptance/bundle/invariant/configs/feature.yml.tmpl-init.sh
new file mode 100755
index 00000000000..056e3fb27d4
--- /dev/null
+++ b/acceptance/bundle/invariant/configs/feature.yml.tmpl-init.sh
@@ -0,0 +1,14 @@
+#!/bin/bash
+
+# The feature's delta_table_source must already exist, and the invariant harness provisions no
+# tables of its own.
+echo "Creating temporary source table: main.feat_inv_$UNIQUE_NAME.source_table"
+
+$CLI schemas create feat_inv_$UNIQUE_NAME main -o json | jq '{full_name}'
+
+# MSYS_NO_PATHCONV=1 prevents Git Bash on Windows from converting /api/... to a filesystem path.
+MSYS_NO_PATHCONV=1 $CLI api post "/api/2.0/sql/statements/" --json "{
+    \"warehouse_id\": \"$TEST_DEFAULT_WAREHOUSE_ID\",
+    \"statement\": \"CREATE TABLE main.feat_inv_$UNIQUE_NAME.source_table (id INT, value STRING, timestamp TIMESTAMP) USING DELTA\",
+    \"wait_timeout\": \"45s\"
+  }" > /dev/null
diff --git a/acceptance/bundle/invariant/configs/genie_space.yml.tmpl b/acceptance/bundle/invariant/configs/genie_space.yml.tmpl
new file mode 100644
index 00000000000..b4ca88801bf
--- /dev/null
+++ b/acceptance/bundle/invariant/configs/genie_space.yml.tmpl
@@ -0,0 +1,19 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  genie_spaces:
+    foo:
+      warehouse_id: $TEST_DEFAULT_WAREHOUSE_ID
+      title: test-genie-space-$UNIQUE_NAME
+      description: This is a test genie space # CAN_REMOVE
+      # Structured (inline) serialized_space is marshalled to a JSON string by
+      # ConfigureGenieSpaceSerializedSpace; this config doubles as a regression
+      # guard that the normalization produces a drift-free deploy. Kept minimal
+      # ({version: 1}) so the real backend accepts it on cloud: it rejects
+      # unknown fields such as display_name with INVALID_PARAMETER_VALUE.
+      serialized_space:
+        version: 1
+      permissions:
+        - level: CAN_READ
+          group_name: users
diff --git a/acceptance/bundle/invariant/configs/instance_pool.yml.tmpl b/acceptance/bundle/invariant/configs/instance_pool.yml.tmpl
new file mode 100644
index 00000000000..7e6b231f487
--- /dev/null
+++ b/acceptance/bundle/invariant/configs/instance_pool.yml.tmpl
@@ -0,0 +1,13 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  instance_pools:
+    foo:
+      instance_pool_name: test-instance-pool-$UNIQUE_NAME
+      node_type_id: $NODE_TYPE_ID
+      idle_instance_autotermination_minutes: 60 # CAN_REMOVE
+      enable_elastic_disk: true # CAN_REMOVE
+      permissions:
+        - level: CAN_ATTACH_TO
+          group_name: users
diff --git a/acceptance/bundle/invariant/configs/job.yml.tmpl b/acceptance/bundle/invariant/configs/job.yml.tmpl
index c94cc5bc8b0..7d54aec4f83 100644
--- a/acceptance/bundle/invariant/configs/job.yml.tmpl
+++ b/acceptance/bundle/invariant/configs/job.yml.tmpl
@@ -5,3 +5,7 @@ resources:
   jobs:
     foo:
       name: test-job-$UNIQUE_NAME
+      description: This is a test job # CAN_REMOVE
+      permissions:
+        - level: CAN_VIEW
+          group_name: users
diff --git a/acceptance/bundle/invariant/configs/job_apply_policy_default_values_for_each_task.yml.tmpl b/acceptance/bundle/invariant/configs/job_apply_policy_default_values_for_each_task.yml.tmpl
new file mode 100644
index 00000000000..425f8a45151
--- /dev/null
+++ b/acceptance/bundle/invariant/configs/job_apply_policy_default_values_for_each_task.yml.tmpl
@@ -0,0 +1,20 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  jobs:
+    foo:
+      name: test-job-$UNIQUE_NAME
+      tasks:
+        - task_key: main
+          for_each_task:
+            inputs: "[1]"
+            task:
+              task_key: inner
+              notebook_task:
+                notebook_path: /Shared/notebook
+              new_cluster:
+                spark_version: $DEFAULT_SPARK_VERSION
+                instance_pool_id: $TEST_INSTANCE_POOL_ID
+                num_workers: 1
+                apply_policy_default_values: true
diff --git a/acceptance/bundle/invariant/configs/job_apply_policy_default_values_job_cluster.yml.tmpl b/acceptance/bundle/invariant/configs/job_apply_policy_default_values_job_cluster.yml.tmpl
new file mode 100644
index 00000000000..274882fc831
--- /dev/null
+++ b/acceptance/bundle/invariant/configs/job_apply_policy_default_values_job_cluster.yml.tmpl
@@ -0,0 +1,20 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  jobs:
+    foo:
+      name: test-job-$UNIQUE_NAME
+      job_clusters:
+        - job_cluster_key: shared
+          new_cluster:
+            spark_version: $DEFAULT_SPARK_VERSION
+            node_type_id: $NODE_TYPE_ID
+            instance_pool_id: $TEST_INSTANCE_POOL_ID
+            num_workers: 1
+            apply_policy_default_values: true
+      tasks:
+        - task_key: only_task
+          job_cluster_key: shared
+          notebook_task:
+            notebook_path: /Shared/notebook
diff --git a/acceptance/bundle/invariant/configs/job_apply_policy_default_values_task_cluster.yml.tmpl b/acceptance/bundle/invariant/configs/job_apply_policy_default_values_task_cluster.yml.tmpl
new file mode 100644
index 00000000000..68500c774f7
--- /dev/null
+++ b/acceptance/bundle/invariant/configs/job_apply_policy_default_values_task_cluster.yml.tmpl
@@ -0,0 +1,17 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  jobs:
+    foo:
+      name: test-job-$UNIQUE_NAME
+      tasks:
+        - task_key: only_task
+          notebook_task:
+            notebook_path: /Shared/notebook
+          new_cluster:
+            spark_version: $DEFAULT_SPARK_VERSION
+            node_type_id: $NODE_TYPE_ID
+            instance_pool_id: $TEST_INSTANCE_POOL_ID
+            num_workers: 1
+            apply_policy_default_values: true
diff --git a/acceptance/bundle/invariant/configs/job_escaped_refs.yml.tmpl b/acceptance/bundle/invariant/configs/job_escaped_refs.yml.tmpl
new file mode 100644
index 00000000000..fb45c7fc89f
--- /dev/null
+++ b/acceptance/bundle/invariant/configs/job_escaped_refs.yml.tmpl
@@ -0,0 +1,28 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+variables:
+  catalog_name:
+    default: main
+
+resources:
+  jobs:
+    example_ingestion_job:
+      name: test-job-$UNIQUE_NAME
+      tasks:
+        - task_key: run_generic_ingestion
+          notebook_task:
+            # Workspace-absolute so no local notebook file is needed; the
+            # base_parameters below are verbatim from the issue.
+            notebook_path: /Shared/notebook
+            # Set explicitly: terraform sends this default, direct does not, and
+            # bundle/escaped_refs asserts one payload for both engines.
+            source: WORKSPACE
+            base_parameters:
+              generic_config: '{"source": {"path": "landing/$${p_folder}/$${source_file}_*.csv"}, "schema": {"columns": [{"name": "w_batch_id", "expression": "$${batch_id}"}, {"name": "w_business_dt", "expression": "cast(''$${business_date[0..9]}'' as date)"}]}, "target": {"table": "${var.catalog_name}.$${p_env_stg}.$${target_table}"}}'
+              parameters_list: '[{"source_file": "TableA", "target_table": "table_a", "p_env_stg": "stg_example", "p_folder": "foldera"}, {"source_file": "TableB", "target_table": "table_b", "p_env_stg": "stg_example", "p_folder": "folderb"}]'
+      parameters:
+        - name: batch_id
+          default: '{{job.id}}'
+        - name: business_date
+          default: '{{job.start_time.iso_date}}'
diff --git a/acceptance/bundle/invariant/configs/job_run.yml.tmpl b/acceptance/bundle/invariant/configs/job_run.yml.tmpl
new file mode 100644
index 00000000000..f6cd068ff13
--- /dev/null
+++ b/acceptance/bundle/invariant/configs/job_run.yml.tmpl
@@ -0,0 +1,23 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  jobs:
+    foo:
+      name: test-job-$UNIQUE_NAME
+      tasks:
+        # Deploying a job_run actually runs the job, and the wait needs a task a
+        # workspace will execute. Serverless keeps this one to about a minute.
+        - task_key: only_task
+          spark_python_task:
+            python_file: ./job_run.py
+          environment_key: default
+
+      environments:
+        - environment_key: default
+          spec:
+            environment_version: "2"
+
+  job_runs:
+    foo_run:
+      job_id: ${resources.jobs.foo.id}
diff --git a/acceptance/bundle/invariant/configs/job_run_job_ref.yml.tmpl b/acceptance/bundle/invariant/configs/job_run_job_ref.yml.tmpl
new file mode 100644
index 00000000000..c84f7cd5145
--- /dev/null
+++ b/acceptance/bundle/invariant/configs/job_run_job_ref.yml.tmpl
@@ -0,0 +1,34 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  jobs:
+    trigger_job:
+      name: test-trigger-$UNIQUE_NAME
+      # 9007199254740993 = 2^53+1, the smallest integer float64 cannot represent
+      # exactly (it rounds to 2^53 = ...992). Stored as a literal via PrepareState,
+      # so trigger_job keeps the exact value; watcher_job references it to force the
+      # migration to resolve it from TF state, where naive float64 parsing of JSON
+      # numbers would corrupt it. Local-only: deliberately out of range for the
+      # real backend (see no_run_job_ref_on_cloud in the parent test.toml).
+      max_concurrent_runs: 9007199254740993
+      tasks:
+        - task_key: notebook
+          notebook_task:
+            notebook_path: /Shared/notebook
+          new_cluster:
+            spark_version: $DEFAULT_SPARK_VERSION
+            node_type_id: $NODE_TYPE_ID
+            instance_pool_id: $TEST_INSTANCE_POOL_ID
+            num_workers: 1
+
+    watcher_job:
+      name: test-watcher-$UNIQUE_NAME
+      # Resolved from trigger_job's TF state during migration. Exercises the
+      # json.Number parsing path end-to-end: with the fix the migrated state keeps
+      # 9007199254740993; without it the value is silently truncated to ...992.
+      max_concurrent_runs: ${resources.jobs.trigger_job.max_concurrent_runs}
+      tasks:
+        - task_key: run_trigger
+          run_job_task:
+            job_id: ${resources.jobs.trigger_job.id}
diff --git a/acceptance/bundle/invariant/configs/job_table_update_trigger.yml.tmpl b/acceptance/bundle/invariant/configs/job_table_update_trigger.yml.tmpl
new file mode 100644
index 00000000000..ceb0371c00d
--- /dev/null
+++ b/acceptance/bundle/invariant/configs/job_table_update_trigger.yml.tmpl
@@ -0,0 +1,13 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  jobs:
+    foo:
+      name: test-job-$UNIQUE_NAME
+      trigger:
+        table_update:
+          table_names:
+            - samples.nyctaxi.trips
+          condition: ANY_UPDATED
+          wait_after_last_change_seconds: 60
diff --git a/acceptance/bundle/invariant/configs/job_with_permissions.yml.tmpl b/acceptance/bundle/invariant/configs/job_with_permissions.yml.tmpl
deleted file mode 100644
index 696483648b5..00000000000
--- a/acceptance/bundle/invariant/configs/job_with_permissions.yml.tmpl
+++ /dev/null
@@ -1,10 +0,0 @@
-bundle:
-  name: test-bundle-$UNIQUE_NAME
-
-resources:
-  jobs:
-    foo:
-      name: test-job-$UNIQUE_NAME
-      permissions:
-        - level: CAN_VIEW
-          group_name: users
diff --git a/acceptance/bundle/invariant/configs/job_with_task.yml.tmpl b/acceptance/bundle/invariant/configs/job_with_task.yml.tmpl
index 9d75734195f..ebf38fccb95 100644
--- a/acceptance/bundle/invariant/configs/job_with_task.yml.tmpl
+++ b/acceptance/bundle/invariant/configs/job_with_task.yml.tmpl
@@ -12,4 +12,5 @@ resources:
           new_cluster:
             spark_version: $DEFAULT_SPARK_VERSION
             node_type_id: $NODE_TYPE_ID
+            instance_pool_id: $TEST_INSTANCE_POOL_ID
             num_workers: 1
diff --git a/acceptance/bundle/invariant/configs/mcp_service.yml.tmpl b/acceptance/bundle/invariant/configs/mcp_service.yml.tmpl
new file mode 100644
index 00000000000..5bf705e853c
--- /dev/null
+++ b/acceptance/bundle/invariant/configs/mcp_service.yml.tmpl
@@ -0,0 +1,13 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  mcp_services:
+    foo:
+      parent: schemas/main.default
+      mcp_service_id: test-mcp-service-$UNIQUE_NAME
+      comment: test mcp service
+      grants:
+        - principal: account users
+          privileges:
+            - APPLY_TAG
diff --git a/acceptance/bundle/invariant/configs/model.yml.tmpl b/acceptance/bundle/invariant/configs/model.yml.tmpl
index e105a731a33..8c8deed8aa2 100644
--- a/acceptance/bundle/invariant/configs/model.yml.tmpl
+++ b/acceptance/bundle/invariant/configs/model.yml.tmpl
@@ -5,3 +5,7 @@ resources:
   models:
     foo:
       name: test-model-$UNIQUE_NAME
+      # CANNOT_REMOVE: the MLflow model registry rejects an empty description on update with
+      # 400 "Description cannot be empty" (only reproducible on cloud; the local testserver
+      # accepts the cleared value).
+      description: This is a test model
diff --git a/acceptance/bundle/invariant/configs/model_provider_service.yml.tmpl b/acceptance/bundle/invariant/configs/model_provider_service.yml.tmpl
new file mode 100644
index 00000000000..907bdc0b79b
--- /dev/null
+++ b/acceptance/bundle/invariant/configs/model_provider_service.yml.tmpl
@@ -0,0 +1,24 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  model_provider_services:
+    foo:
+      parent: schemas/main.default
+      model_provider_service_id: test-model-provider-service-$UNIQUE_NAME
+      comment: test model provider service
+      grants:
+        - principal: account users
+          privileges:
+            - APPLY_TAG
+      config:
+        provider_type: EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM
+        targets:
+          - model: gpt-4o
+            native_api_types:
+              - openai/v1/chat/completions
+        custom:
+          direct:
+            base_url: https://api.example.com/v1
+            api_key:
+              plaintext: dummy-api-key
diff --git a/acceptance/bundle/invariant/configs/model_service.yml.tmpl b/acceptance/bundle/invariant/configs/model_service.yml.tmpl
new file mode 100644
index 00000000000..922a813bd88
--- /dev/null
+++ b/acceptance/bundle/invariant/configs/model_service.yml.tmpl
@@ -0,0 +1,13 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  model_services:
+    foo:
+      parent: schemas/main.default
+      model_service_id: test-model-service-$UNIQUE_NAME
+      comment: test model service
+      grants:
+        - principal: account users
+          privileges:
+            - APPLY_TAG
diff --git a/acceptance/bundle/invariant/configs/model_serving_endpoint.yml.tmpl b/acceptance/bundle/invariant/configs/model_serving_endpoint.yml.tmpl
index 102f14c0491..fe84a3a07a0 100644
--- a/acceptance/bundle/invariant/configs/model_serving_endpoint.yml.tmpl
+++ b/acceptance/bundle/invariant/configs/model_serving_endpoint.yml.tmpl
@@ -5,3 +5,6 @@ resources:
   model_serving_endpoints:
     foo:
       name: test-endpoint-$UNIQUE_NAME
+      permissions:
+        - level: CAN_VIEW
+          group_name: users
diff --git a/acceptance/bundle/invariant/configs/model_serving_endpoint_telemetry.yml.tmpl b/acceptance/bundle/invariant/configs/model_serving_endpoint_telemetry.yml.tmpl
new file mode 100644
index 00000000000..d8c0147e937
--- /dev/null
+++ b/acceptance/bundle/invariant/configs/model_serving_endpoint_telemetry.yml.tmpl
@@ -0,0 +1,20 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  model_serving_endpoints:
+    foo:
+      name: test-endpoint-$UNIQUE_NAME
+      config:
+        served_entities:
+          - name: prod
+            entity_name: main.default.test_model
+            entity_version: "1"
+            workload_size: Small
+            scale_to_zero_enabled: true
+      telemetry_config:
+        table_names:
+          logs_table: main.default.test_logs
+          traces_table: main.default.test_traces
+        inference_table_config:
+          sampling_fraction: 0.5
diff --git a/acceptance/bundle/invariant/configs/pipeline.yml.tmpl b/acceptance/bundle/invariant/configs/pipeline.yml.tmpl
index 8e412adbcdb..331fa7124d2 100644
--- a/acceptance/bundle/invariant/configs/pipeline.yml.tmpl
+++ b/acceptance/bundle/invariant/configs/pipeline.yml.tmpl
@@ -5,6 +5,10 @@ resources:
   pipelines:
     foo:
       name: test-pipeline-$UNIQUE_NAME
+      development: true # CAN_REMOVE
       libraries:
         - file:
             path: pipeline.py
+      permissions:
+        - level: CAN_VIEW
+          group_name: users
diff --git a/acceptance/bundle/invariant/configs/pipeline_allow_duplicate_names.yml.tmpl b/acceptance/bundle/invariant/configs/pipeline_allow_duplicate_names.yml.tmpl
new file mode 100644
index 00000000000..664f25aec46
--- /dev/null
+++ b/acceptance/bundle/invariant/configs/pipeline_allow_duplicate_names.yml.tmpl
@@ -0,0 +1,11 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  pipelines:
+    foo:
+      name: test-pipeline-$UNIQUE_NAME
+      allow_duplicate_names: true
+      libraries:
+        - file:
+            path: pipeline.py
diff --git a/acceptance/bundle/invariant/configs/pipeline_apply_policy_default_values.yml.tmpl b/acceptance/bundle/invariant/configs/pipeline_apply_policy_default_values.yml.tmpl
new file mode 100644
index 00000000000..2e6490eba3c
--- /dev/null
+++ b/acceptance/bundle/invariant/configs/pipeline_apply_policy_default_values.yml.tmpl
@@ -0,0 +1,14 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  pipelines:
+    foo:
+      name: test-pipeline-$UNIQUE_NAME
+      clusters:
+        - node_type_id: $NODE_TYPE_ID
+          num_workers: 1
+          apply_policy_default_values: true
+      libraries:
+        - file:
+            path: pipeline.py
diff --git a/acceptance/bundle/invariant/configs/postgres_branch.yml.tmpl b/acceptance/bundle/invariant/configs/postgres_branch.yml.tmpl
index e17859b0b90..2a7fe6d2dc7 100644
--- a/acceptance/bundle/invariant/configs/postgres_branch.yml.tmpl
+++ b/acceptance/bundle/invariant/configs/postgres_branch.yml.tmpl
@@ -11,4 +11,8 @@ resources:
     foo:
       parent: ${resources.postgres_projects.project.name}
       branch_id: test-branch-$UNIQUE_NAME
+      # CANNOT_REMOVE: clearing no_expiry adds spec.expiration to the update_mask but drops the field
+      # from the request body (omitempty), which the backend rejects with 400 "in update_mask but not
+      # provided in request". (is_protected behaves the same but is omitted here: a
+      # protected branch cannot be deleted, which wedges the test's destroy-based cleanup.)
       no_expiry: true
diff --git a/acceptance/bundle/invariant/configs/postgres_catalog.yml.tmpl b/acceptance/bundle/invariant/configs/postgres_catalog.yml.tmpl
new file mode 100644
index 00000000000..2ae10852504
--- /dev/null
+++ b/acceptance/bundle/invariant/configs/postgres_catalog.yml.tmpl
@@ -0,0 +1,15 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  postgres_projects:
+    project:
+      project_id: test-pg-project-$UNIQUE_NAME
+      display_name: Test Postgres Project
+
+  postgres_catalogs:
+    catalog:
+      catalog_id: test_pg_catalog_$UNIQUE_NAME
+      branch: ${resources.postgres_projects.project.name}/branches/production
+      postgres_database: appdb
+      create_database_if_missing: true
diff --git a/acceptance/bundle/invariant/configs/postgres_database.yml.tmpl b/acceptance/bundle/invariant/configs/postgres_database.yml.tmpl
new file mode 100644
index 00000000000..dcfca2c6ef6
--- /dev/null
+++ b/acceptance/bundle/invariant/configs/postgres_database.yml.tmpl
@@ -0,0 +1,27 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  postgres_projects:
+    project:
+      project_id: test-pg-project-$UNIQUE_NAME
+      display_name: Test Postgres Project
+
+  postgres_branches:
+    branch:
+      parent: ${resources.postgres_projects.project.name}
+      branch_id: test-branch-$UNIQUE_NAME
+      no_expiry: true
+
+  postgres_roles:
+    owner:
+      parent: ${resources.postgres_branches.branch.name}
+      role_id: test-role-$UNIQUE_NAME
+      postgres_role: app_role
+
+  postgres_databases:
+    foo:
+      parent: ${resources.postgres_branches.branch.name}
+      database_id: test-database-$UNIQUE_NAME
+      postgres_database: app_db
+      role: ${resources.postgres_roles.owner.name}
diff --git a/acceptance/bundle/invariant/configs/postgres_endpoint.yml.tmpl b/acceptance/bundle/invariant/configs/postgres_endpoint.yml.tmpl
index fbffd428ff6..2e678e70ad2 100644
--- a/acceptance/bundle/invariant/configs/postgres_endpoint.yml.tmpl
+++ b/acceptance/bundle/invariant/configs/postgres_endpoint.yml.tmpl
@@ -18,3 +18,9 @@ resources:
       parent: ${resources.postgres_branches.branch.name}
       endpoint_id: test-endpoint-$UNIQUE_NAME
       endpoint_type: ENDPOINT_TYPE_READ_WRITE
+      # CANNOT_REMOVE: clearing these adds them to the update_mask but drops the fields from the
+      # request body (omitempty), which the backend rejects with 400 "Field 'spec.autoscaling_limit_max_cu'
+      # is in update_mask but not provided in request".
+      autoscaling_limit_min_cu: 1
+      autoscaling_limit_max_cu: 4
+      disabled: true
diff --git a/acceptance/bundle/invariant/configs/postgres_project.yml.tmpl b/acceptance/bundle/invariant/configs/postgres_project.yml.tmpl
index d78bdf6812c..c8f5dbd13ea 100644
--- a/acceptance/bundle/invariant/configs/postgres_project.yml.tmpl
+++ b/acceptance/bundle/invariant/configs/postgres_project.yml.tmpl
@@ -5,4 +5,15 @@ resources:
   postgres_projects:
     foo:
       project_id: test-pg-project-$UNIQUE_NAME
+      # CANNOT_REMOVE: clearing display_name adds spec.display_name to the update_mask but drops
+      # the field from the request body (omitempty), which the backend rejects with 400
+      # "Field 'spec.display_name' is in update_mask but not provided in request".
       display_name: Test Postgres Project
+      enable_pg_native_login: false
+      # CANNOT_REMOVE: same update_mask 400 as display_name above — clearing it adds
+      # spec.default_endpoint_settings to the update_mask but drops it from the request body.
+      # Kept on one line so a future fix can flip it to CAN_REMOVE and have grep -v strip it cleanly.
+      default_endpoint_settings: {"autoscaling_limit_max_cu": 4}
+      permissions:
+        - level: CAN_USE
+          group_name: users
diff --git a/acceptance/bundle/invariant/configs/postgres_role.yml.tmpl b/acceptance/bundle/invariant/configs/postgres_role.yml.tmpl
new file mode 100644
index 00000000000..9c4aba0b5b8
--- /dev/null
+++ b/acceptance/bundle/invariant/configs/postgres_role.yml.tmpl
@@ -0,0 +1,20 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  postgres_projects:
+    project:
+      project_id: test-pg-project-$UNIQUE_NAME
+      display_name: Test Postgres Project
+
+  postgres_branches:
+    branch:
+      parent: ${resources.postgres_projects.project.name}
+      branch_id: test-branch-$UNIQUE_NAME
+      no_expiry: true
+
+  postgres_roles:
+    foo:
+      parent: ${resources.postgres_branches.branch.name}
+      role_id: test-role-$UNIQUE_NAME
+      postgres_role: app_role
diff --git a/acceptance/bundle/invariant/configs/postgres_snapshot_schedule.yml.tmpl b/acceptance/bundle/invariant/configs/postgres_snapshot_schedule.yml.tmpl
new file mode 100644
index 00000000000..5e36e89886c
--- /dev/null
+++ b/acceptance/bundle/invariant/configs/postgres_snapshot_schedule.yml.tmpl
@@ -0,0 +1,22 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  postgres_projects:
+    project:
+      project_id: test-pg-project-$UNIQUE_NAME
+      display_name: Test Postgres Project
+
+  postgres_branches:
+    foo:
+      parent: ${resources.postgres_projects.project.name}
+      branch_id: test-branch-$UNIQUE_NAME
+      no_expiry: true
+
+  postgres_snapshot_schedules:
+    foo:
+      branch: ${resources.postgres_branches.foo.name}
+      schedule:
+        - daily_schedule:
+            hour: 3
+          retention: "604800s"
diff --git a/acceptance/bundle/invariant/configs/postgres_synced_table.yml.tmpl b/acceptance/bundle/invariant/configs/postgres_synced_table.yml.tmpl
new file mode 100644
index 00000000000..7a548a02756
--- /dev/null
+++ b/acceptance/bundle/invariant/configs/postgres_synced_table.yml.tmpl
@@ -0,0 +1,16 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  postgres_synced_tables:
+    foo:
+      synced_table_id: lakebase_$UNIQUE_NAME.public.trips_synced
+      source_table_full_name: main.raw.trips
+      primary_key_columns: [id]
+      scheduling_policy: SNAPSHOT
+      postgres_database: appdb
+      branch: projects/test-pg-project-$UNIQUE_NAME/branches/production
+      create_database_objects_if_missing: true
+      new_pipeline_spec:
+        storage_catalog: main
+        storage_schema: pipelines
diff --git a/acceptance/bundle/invariant/configs/registered_model.yml.tmpl b/acceptance/bundle/invariant/configs/registered_model.yml.tmpl
index 5f605085d77..8b1fa846e6a 100644
--- a/acceptance/bundle/invariant/configs/registered_model.yml.tmpl
+++ b/acceptance/bundle/invariant/configs/registered_model.yml.tmpl
@@ -7,3 +7,8 @@ resources:
       name: test-model-$UNIQUE_NAME
       catalog_name: main
       schema_name: default
+      comment: This is a test registered model # CAN_REMOVE
+      grants:
+        - principal: account users
+          privileges:
+            - EXECUTE
diff --git a/acceptance/bundle/invariant/configs/schema.yml.tmpl b/acceptance/bundle/invariant/configs/schema.yml.tmpl
index 658dce88dd6..e817ca7b6fe 100644
--- a/acceptance/bundle/invariant/configs/schema.yml.tmpl
+++ b/acceptance/bundle/invariant/configs/schema.yml.tmpl
@@ -6,3 +6,13 @@ resources:
     foo:
       catalog_name: main
       name: test-schema-$UNIQUE_NAME
+      comment: This is a test schema # CAN_REMOVE
+      custom_max_retention_hours: 240 # CAN_REMOVE
+      # CANNOT_REMOVE: properties is a map, and ForceSendFields is inert for maps, so
+      # clearing the whole map drops it from the request and the old value drifts back every plan.
+      # Kept on one line so a future fix can flip it to CAN_REMOVE and have grep -v strip it cleanly.
+      properties: {"tier": "bronze"}
+      grants:
+        - principal: account users
+          privileges:
+            - USE_SCHEMA
diff --git a/acceptance/bundle/invariant/configs/schema_empty_grants.yml.tmpl b/acceptance/bundle/invariant/configs/schema_empty_grants.yml.tmpl
new file mode 100644
index 00000000000..70dd05dd74c
--- /dev/null
+++ b/acceptance/bundle/invariant/configs/schema_empty_grants.yml.tmpl
@@ -0,0 +1,11 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  schemas:
+    foo:
+      catalog_name: main
+      name: test-schema-$UNIQUE_NAME
+      # Empty grants: Terraform records no grants resource for an empty list, so
+      # migrate leaves no state entry and plan must not show a spurious create.
+      grants: []
diff --git a/acceptance/bundle/invariant/configs/schema_tf_compat.yml.tmpl b/acceptance/bundle/invariant/configs/schema_tf_compat.yml.tmpl
new file mode 100644
index 00000000000..25e783b1886
--- /dev/null
+++ b/acceptance/bundle/invariant/configs/schema_tf_compat.yml.tmpl
@@ -0,0 +1,16 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+# A schema without custom_max_retention_hours. The terraform databricks_schema resource cannot set
+# that field, so schema.yml (which carries it for the direct field-removal check) is excluded from
+# the migrate invariant; this terraform-compatible schema keeps migrate coverage for schemas.
+resources:
+  schemas:
+    foo:
+      catalog_name: main
+      name: test-schema-$UNIQUE_NAME
+      comment: This is a test schema
+      grants:
+        - principal: account users
+          privileges:
+            - USE_SCHEMA
diff --git a/acceptance/bundle/invariant/configs/schema_uppercase_name.yml.tmpl b/acceptance/bundle/invariant/configs/schema_uppercase_name.yml.tmpl
new file mode 100644
index 00000000000..abf993785f2
--- /dev/null
+++ b/acceptance/bundle/invariant/configs/schema_uppercase_name.yml.tmpl
@@ -0,0 +1,14 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+# Reproduce: UC API normalizes identifier names to lowercase, causing
+# false drift on the second deploy when the config uses mixed-case names.
+# Volumes are covered by acceptance/bundle/resources/volumes/uppercase-name
+# instead: the Terraform provider rejects an uppercase volume schema_name
+# ("inconsistent final plan"), and the migrate invariant always deploys via
+# Terraform first, so an uppercase volume cannot live in this shared config.
+resources:
+  schemas:
+    foo:
+      catalog_name: main
+      name: MySCHEMA-$UNIQUE_NAME
diff --git a/acceptance/bundle/invariant/configs/schema_with_grants.yml.tmpl b/acceptance/bundle/invariant/configs/schema_with_grants.yml.tmpl
deleted file mode 100644
index d9aebda0cef..00000000000
--- a/acceptance/bundle/invariant/configs/schema_with_grants.yml.tmpl
+++ /dev/null
@@ -1,12 +0,0 @@
-bundle:
-  name: test-bundle-$UNIQUE_NAME
-
-resources:
-  schemas:
-    foo:
-      catalog_name: main
-      name: test-schema-$UNIQUE_NAME
-      grants:
-        - principal: account users
-          privileges:
-            - USE_SCHEMA
diff --git a/acceptance/bundle/invariant/configs/secret.yml.tmpl b/acceptance/bundle/invariant/configs/secret.yml.tmpl
new file mode 100644
index 00000000000..14fa93b6ce1
--- /dev/null
+++ b/acceptance/bundle/invariant/configs/secret.yml.tmpl
@@ -0,0 +1,19 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+variables:
+  secret_value:
+    description: The value of the secret
+
+resources:
+  secrets:
+    foo:
+      catalog_name: main
+      schema_name: default
+      name: test-secret-$UNIQUE_NAME
+      value: ${var.secret_value}
+      comment: This is a test secret # CAN_REMOVE
+      grants:
+        - principal: account users
+          privileges:
+            - MANAGE
diff --git a/acceptance/bundle/invariant/configs/secret.yml.tmpl-init.sh b/acceptance/bundle/invariant/configs/secret.yml.tmpl-init.sh
new file mode 100755
index 00000000000..8ec839a40d3
--- /dev/null
+++ b/acceptance/bundle/invariant/configs/secret.yml.tmpl-init.sh
@@ -0,0 +1 @@
+export BUNDLE_VAR_secret_value="secret-value"
diff --git a/acceptance/bundle/invariant/configs/secret_scope.yml.tmpl b/acceptance/bundle/invariant/configs/secret_scope.yml.tmpl
index e891ad00003..daa61aaaaa2 100644
--- a/acceptance/bundle/invariant/configs/secret_scope.yml.tmpl
+++ b/acceptance/bundle/invariant/configs/secret_scope.yml.tmpl
@@ -6,3 +6,8 @@ resources:
     foo:
       name: test-scope-$UNIQUE_NAME
       backend_type: DATABRICKS
+      permissions:
+        - level: READ
+          group_name: users
+        - level: WRITE
+          group_name: admins
diff --git a/acceptance/bundle/invariant/configs/secret_scope_with_permissions.yml.tmpl b/acceptance/bundle/invariant/configs/secret_scope_with_permissions.yml.tmpl
deleted file mode 100644
index daa61aaaaa2..00000000000
--- a/acceptance/bundle/invariant/configs/secret_scope_with_permissions.yml.tmpl
+++ /dev/null
@@ -1,13 +0,0 @@
-bundle:
-  name: test-bundle-$UNIQUE_NAME
-
-resources:
-  secret_scopes:
-    foo:
-      name: test-scope-$UNIQUE_NAME
-      backend_type: DATABRICKS
-      permissions:
-        - level: READ
-          group_name: users
-        - level: WRITE
-          group_name: admins
diff --git a/acceptance/bundle/invariant/configs/sql_warehouse.yml.tmpl b/acceptance/bundle/invariant/configs/sql_warehouse.yml.tmpl
index 4c1bef63037..0110ebdbb2d 100644
--- a/acceptance/bundle/invariant/configs/sql_warehouse.yml.tmpl
+++ b/acceptance/bundle/invariant/configs/sql_warehouse.yml.tmpl
@@ -5,7 +5,11 @@ resources:
   sql_warehouses:
     foo:
       name: test-warehouse-$UNIQUE_NAME
-      cluster_size: X-Small
-      max_num_clusters: 1
+      cluster_size: 2X-Small
+      auto_stop_mins: 10 # CAN_REMOVE
+      max_num_clusters: 1 # CAN_REMOVE
       min_num_clusters: 1
       warehouse_type: CLASSIC
+      permissions:
+        - level: CAN_VIEW
+          group_name: users
diff --git a/acceptance/bundle/invariant/configs/uc_trailing_slash.yml.tmpl b/acceptance/bundle/invariant/configs/uc_trailing_slash.yml.tmpl
new file mode 100644
index 00000000000..9172d71668c
--- /dev/null
+++ b/acceptance/bundle/invariant/configs/uc_trailing_slash.yml.tmpl
@@ -0,0 +1,24 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+# UC strips a trailing slash from storage URLs on create. The direct engine saves
+# local config to state, so without normalize_slash handling the next plan sees the
+# original slash against the normalized remote value and plans a spurious recreate.
+# Covers catalog storage_root, schema storage_root, and external volume storage_location.
+resources:
+  catalogs:
+    foo:
+      name: test-catalog-$UNIQUE_NAME
+      storage_root: s3://test-bucket/catalog/
+  schemas:
+    bar:
+      catalog_name: main
+      name: test-schema-$UNIQUE_NAME
+      storage_root: s3://test-bucket/schema/
+  volumes:
+    baz:
+      name: test-volume-$UNIQUE_NAME
+      catalog_name: main
+      schema_name: default
+      volume_type: EXTERNAL
+      storage_location: s3://test-bucket/volume/
diff --git a/acceptance/bundle/invariant/configs/vector_search_endpoint.yml.tmpl b/acceptance/bundle/invariant/configs/vector_search_endpoint.yml.tmpl
index cea1a4d026c..1a8ff4c4ce5 100644
--- a/acceptance/bundle/invariant/configs/vector_search_endpoint.yml.tmpl
+++ b/acceptance/bundle/invariant/configs/vector_search_endpoint.yml.tmpl
@@ -6,6 +6,10 @@ resources:
     foo:
       name: test-endpoint-$UNIQUE_NAME
       endpoint_type: STANDARD
+      # CANNOT_REMOVE: target_qps is not re-sent on update, so clearing it leaves the old value
+      # and the plan re-proposes the change on every deploy (only reproducible on cloud; the
+      # local testserver converges).
+      target_qps: 2
     bar:
       # Endpoint names must be < 50 chars, so keep this prefix short.
       name: test-vse-perm-$UNIQUE_NAME
diff --git a/acceptance/bundle/invariant/configs/vector_search_index.yml.tmpl b/acceptance/bundle/invariant/configs/vector_search_index.yml.tmpl
new file mode 100644
index 00000000000..a4b486659e7
--- /dev/null
+++ b/acceptance/bundle/invariant/configs/vector_search_index.yml.tmpl
@@ -0,0 +1,23 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  vector_search_endpoints:
+    bar:
+      name: test-endpoint-$UNIQUE_NAME
+      endpoint_type: STANDARD
+  vector_search_indexes:
+    foo:
+      name: main.default.test_index_$UNIQUE_NAME
+      endpoint_name: ${resources.vector_search_endpoints.bar.name}
+      primary_key: id
+      index_type: DIRECT_ACCESS
+      direct_access_index_spec:
+        schema_json: '{"id":"integer","vector":"array<float>"}'
+        embedding_vector_columns:
+          - name: vector
+            embedding_dimension: 768
+      grants:
+        - principal: account users
+          privileges:
+            - SELECT
diff --git a/acceptance/bundle/invariant/configs/vector_search_index.yml.tmpl-init.sh b/acceptance/bundle/invariant/configs/vector_search_index.yml.tmpl-init.sh
new file mode 100644
index 00000000000..7a077fa9132
--- /dev/null
+++ b/acceptance/bundle/invariant/configs/vector_search_index.yml.tmpl-init.sh
@@ -0,0 +1,12 @@
+#!/bin/bash
+
+# Index provisioning takes 15-30 minutes, which is why this config used to be excluded from
+# cloud runs entirely. None of the invariants need a queryable index -- they deploy, re-plan,
+# delete and re-delete -- so cap the wait instead of skipping the coverage.
+#
+# Sourced by invariant_render, so the export applies to every $CLI call in the script.
+#
+# Deliberately per-config rather than Env in the directory's test.toml: this index is three
+# orders of magnitude slower than the next slowest config (cluster, ~100s), and capping every
+# config would leave nothing exercising a real WaitAfterCreate against a real backend.
+export DATABRICKS_BUNDLE_RESOURCE_MAX_WAIT=30
diff --git a/acceptance/bundle/invariant/configs/volume.yml.tmpl b/acceptance/bundle/invariant/configs/volume.yml.tmpl
index 69d462b9423..fc61b3311e7 100644
--- a/acceptance/bundle/invariant/configs/volume.yml.tmpl
+++ b/acceptance/bundle/invariant/configs/volume.yml.tmpl
@@ -7,3 +7,8 @@ resources:
       name: test-volume-$UNIQUE_NAME
       catalog_name: main
       schema_name: default
+      comment: This is a test volume # CAN_REMOVE
+      grants:
+        - principal: account users
+          privileges:
+            - READ_VOLUME
diff --git a/acceptance/bundle/invariant/configs/volume_path_job_ref.yml.tmpl b/acceptance/bundle/invariant/configs/volume_path_job_ref.yml.tmpl
new file mode 100644
index 00000000000..fa55fc15d7a
--- /dev/null
+++ b/acceptance/bundle/invariant/configs/volume_path_job_ref.yml.tmpl
@@ -0,0 +1,23 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+# The volume name references foo.id (only known after deploy), so volume_path
+# resolves at deploy and exercises the foo -> data.volume_path -> process chain
+# on both engines. schema_name must be a real schema (create-volume validates
+# it), so it points at "default" rather than a deferred reference.
+resources:
+  jobs:
+    foo:
+      name: test-job-foo-$UNIQUE_NAME
+
+    process:
+      name: test-job-process-$UNIQUE_NAME
+      parameters:
+        - name: data_path
+          default: ${resources.volumes.data.volume_path}
+
+  volumes:
+    data:
+      catalog_name: main
+      schema_name: default
+      name: ${resources.jobs.foo.id}
diff --git a/acceptance/bundle/invariant/configs/volume_uppercase_name.yml.tmpl b/acceptance/bundle/invariant/configs/volume_uppercase_name.yml.tmpl
new file mode 100644
index 00000000000..c6caa55caa7
--- /dev/null
+++ b/acceptance/bundle/invariant/configs/volume_uppercase_name.yml.tmpl
@@ -0,0 +1,22 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+# Reproduce: the UC API lowercases identifier names, causing false drift on the
+# second deploy when the config uses mixed-case names. This covers a volume's
+# catalog_name, schema_name and name on the direct engine.
+#
+# Excluded from the migrate invariant: that test deploys via Terraform first,
+# and the TF provider rejects an uppercase volume schema_name ("inconsistent
+# final plan").
+resources:
+  schemas:
+    foo:
+      catalog_name: main
+      name: MySCHEMA-$UNIQUE_NAME
+
+  volumes:
+    bar:
+      catalog_name: main
+      schema_name: ${resources.schemas.foo.name}
+      name: MyVOL-$UNIQUE_NAME
+      volume_type: MANAGED
diff --git a/acceptance/bundle/invariant/continue_293/out.test.toml b/acceptance/bundle/invariant/continue_293/out.test.toml
index 11aaf584918..0c9b0afd31d 100644
--- a/acceptance/bundle/invariant/continue_293/out.test.toml
+++ b/acceptance/bundle/invariant/continue_293/out.test.toml
@@ -1,43 +1,52 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = [""]
 EnvMatrix.INPUT_CONFIG = [
   "alert.yml.tmpl",
   "app.yml.tmpl",
   "catalog.yml.tmpl",
+  "catalog_optional_fields.yml.tmpl",
   "cluster.yml.tmpl",
+  "cluster_apply_policy_default_values.yml.tmpl",
   "dashboard.yml.tmpl",
+  "job_apply_policy_default_values_job_cluster.yml.tmpl",
+  "job_apply_policy_default_values_task_cluster.yml.tmpl",
+  "job_apply_policy_default_values_for_each_task.yml.tmpl",
   "database_catalog.yml.tmpl",
   "database_instance.yml.tmpl",
   "experiment.yml.tmpl",
   "external_location.yml.tmpl",
+  "feature.yml.tmpl",
   "job.yml.tmpl",
   "job_pydabs_10_tasks.yml.tmpl",
-  "job_pydabs_1000_tasks.yml.tmpl",
-  "job_cross_resource_ref.yml.tmpl",
-  "job_permission_ref.yml.tmpl",
+  "job_run_job_ref.yml.tmpl",
+  "job_table_update_trigger.yml.tmpl",
   "job_with_depends_on.yml.tmpl",
-  "job_with_permissions.yml.tmpl",
   "job_with_task.yml.tmpl",
   "model.yml.tmpl",
-  "model_with_permissions.yml.tmpl",
   "model_serving_endpoint.yml.tmpl",
+  "model_serving_endpoint_telemetry.yml.tmpl",
   "pipeline.yml.tmpl",
-  "pipeline_config_dots.yml.tmpl",
+  "pipeline_allow_duplicate_names.yml.tmpl",
+  "pipeline_apply_policy_default_values.yml.tmpl",
   "postgres_branch.yml.tmpl",
+  "postgres_catalog.yml.tmpl",
+  "postgres_database.yml.tmpl",
   "postgres_endpoint.yml.tmpl",
   "postgres_project.yml.tmpl",
+  "postgres_role.yml.tmpl",
+  "postgres_synced_table.yml.tmpl",
   "registered_model.yml.tmpl",
   "schema.yml.tmpl",
-  "schema_grant_ref.yml.tmpl",
-  "schema_with_grants.yml.tmpl",
+  "schema_tf_compat.yml.tmpl",
+  "schema_empty_grants.yml.tmpl",
+  "schema_uppercase_name.yml.tmpl",
   "secret_scope.yml.tmpl",
   "secret_scope_default_backend_type.yml.tmpl",
-  "secret_scope_with_permissions.yml.tmpl",
   "sql_warehouse.yml.tmpl",
   "synced_database_table.yml.tmpl",
-  "vector_search_endpoint.yml.tmpl",
+  "uc_trailing_slash.yml.tmpl",
   "volume.yml.tmpl",
-  "volume_external.yml.tmpl"
+  "volume_external.yml.tmpl",
+  "volume_uppercase_name.yml.tmpl",
+  "model_service.yml.tmpl"
 ]
diff --git a/acceptance/bundle/invariant/continue_293/script b/acceptance/bundle/invariant/continue_293/script
index c1c8d758eeb..2a0e94d9719 100644
--- a/acceptance/bundle/invariant/continue_293/script
+++ b/acceptance/bundle/invariant/continue_293/script
@@ -1,41 +1,17 @@
 # Invariant to test: current CLI can deploy on top of state produced by v0.293.0
 
-cp -r "$TESTDIR/../data/." . &> LOG.cp
-
-INIT_SCRIPT="$TESTDIR/../configs/$INPUT_CONFIG-init.sh"
-if [ -f "$INIT_SCRIPT" ]; then
-    source "$INIT_SCRIPT" &> LOG.init
-fi
-
-envsubst < "$TESTDIR/../configs/$INPUT_CONFIG" > databricks.yml
-
-cleanup() {
-    $CLI bundle destroy --auto-approve &> LOG.destroy
-    cat LOG.destroy | contains.py '!panic' '!internal error' > /dev/null
-
-    CLEANUP_SCRIPT="$TESTDIR/../configs/$INPUT_CONFIG-cleanup.sh"
-    if [ -f "$CLEANUP_SCRIPT" ]; then
-        source "$CLEANUP_SCRIPT" &> LOG.cleanup
-    fi
-}
-
-trap cleanup EXIT
+invariant_setup
 
 # Deploy with old CLI to produce v0.293.0 state
 trace $CLI_293 --version
-$CLI_293 bundle deploy &> LOG.deploy.293
-cat LOG.deploy.293 | contains.py '!panic' '!internal error' > /dev/null
-
-echo INPUT_CONFIG_OK
+invariant_deploy LOG.deploy.293 $CLI_293 bundle deploy
 
 # Deploy with current CLI on top of old state
 $CLI bundle deploy &> LOG.deploy
-cat LOG.deploy | contains.py '!panic' '!internal error' > /dev/null
+cat LOG.deploy | contains.py '!panic:' '!internal error' > /dev/null
 
 # Verify no drift after current CLI deploy
-$CLI bundle plan -o json > LOG.planjson 2>LOG.planjson.err
-cat LOG.planjson.err | contains.py '!panic' '!internal error' > /dev/null
-verify_no_drift.py LOG.planjson
+invariant_verify_no_drift
 
-$CLI bundle plan 2>LOG.plan.err | contains.py '!panic' '!internal error' 'Plan: 0 to add, 0 to change, 0 to delete' > LOG.plan
-cat LOG.plan.err | contains.py '!panic' '!internal error' > /dev/null
+$CLI bundle plan 2>LOG.plan.err | contains.py '!panic:' '!internal error' 'Plan: 0 to add, 0 to change, 0 to delete' > LOG.plan
+cat LOG.plan.err | contains.py '!panic:' '!internal error' > /dev/null
diff --git a/acceptance/bundle/invariant/continue_293/test.toml b/acceptance/bundle/invariant/continue_293/test.toml
index 91c45e0dd76..15890459519 100644
--- a/acceptance/bundle/invariant/continue_293/test.toml
+++ b/acceptance/bundle/invariant/continue_293/test.toml
@@ -1,3 +1,7 @@
+# The seed deploy runs an old CLI unaware of DMS, so resources aren't recorded.
+# Reading state from the service finds nothing; adopting pre-DMS resources is a separate story.
+EnvMatrix.DMS = [""]
+
 # $resources references to permissions and grants are not supported on v0.293.0
 EnvMatrixExclude.no_permission_ref = ["INPUT_CONFIG=job_permission_ref.yml.tmpl"]
 EnvMatrixExclude.no_cross_resource_ref = ["INPUT_CONFIG=job_cross_resource_ref.yml.tmpl"]
@@ -6,8 +10,39 @@ EnvMatrixExclude.no_grant_ref = ["INPUT_CONFIG=schema_grant_ref.yml.tmpl"]
 # Model permissions did not work until 0.297.0 https://github.com/databricks/cli/pull/4941
 EnvMatrixExclude.no_model_with_permissions = ["INPUT_CONFIG=model_with_permissions.yml.tmpl"]
 
-# vector_search_endpoints resource is not supported on v0.293.0
+# Vector Search resources are not supported on v0.293.0
 EnvMatrixExclude.no_vector_search_endpoint = ["INPUT_CONFIG=vector_search_endpoint.yml.tmpl"]
+EnvMatrixExclude.no_vector_search_index = ["INPUT_CONFIG=vector_search_index.yml.tmpl"]
+
+# genie_spaces resource is not supported on v0.293.0
+EnvMatrixExclude.no_genie_space = ["INPUT_CONFIG=genie_space.yml.tmpl"]
+
+# instance_pools resource is not supported on v0.293.0
+EnvMatrixExclude.no_instance_pool = ["INPUT_CONFIG=instance_pool.yml.tmpl"]
+
+# cluster_policies resource is not supported on v0.293.0
+EnvMatrixExclude.no_cluster_policy = ["INPUT_CONFIG=cluster_policy.yml.tmpl"]
+
+# cluster libraries (clusters.libraries) are not supported on v0.293.0
+EnvMatrixExclude.no_cluster_libraries = ["INPUT_CONFIG=cluster_libraries.yml.tmpl"]
+
+# job_runs resource is not supported on v0.293.0
+EnvMatrixExclude.no_job_run = ["INPUT_CONFIG=job_run.yml.tmpl"]
 
 # Dotted pipeline configuration keys are not supported on v0.293.0
 EnvMatrixExclude.no_pipeline_config_dots = ["INPUT_CONFIG=pipeline_config_dots.yml.tmpl"]
+
+# Computed volume_path is not supported on v0.293.0, so the seed deploy cannot
+# resolve ${resources.volumes.*.volume_path}. Covered by no_drift on direct.
+EnvMatrixExclude.no_volume_path_job_ref = ["INPUT_CONFIG=volume_path_job_ref.yml.tmpl"]
+
+# The 1000-task scale case is covered by no_drift. Running it here adds ~1.5 min
+# per variant (two full deploys at 1000 tasks) without incremental coverage.
+EnvMatrixExclude.no_pydabs_1000_tasks = ["INPUT_CONFIG=job_pydabs_1000_tasks.yml.tmpl"]
+
+# secret resource is not supported on v0.293.0
+EnvMatrixExclude.no_secret = ["INPUT_CONFIG=secret.yml.tmpl"]
+
+# $${...} escaping is not supported on v0.293.0: the seed deploy fails with
+# 'invalid dependency "${batch_id}", no such node ""' (issue #6480).
+EnvMatrixExclude.no_escaped_refs = ["INPUT_CONFIG=job_escaped_refs.yml.tmpl"]
diff --git a/acceptance/bundle/invariant/data/job_run.py b/acceptance/bundle/invariant/data/job_run.py
new file mode 100644
index 00000000000..93e0cef4a92
--- /dev/null
+++ b/acceptance/bundle/invariant/data/job_run.py
@@ -0,0 +1 @@
+print("hello from a job_run")
diff --git a/acceptance/bundle/invariant/delete_idempotent/out.test.toml b/acceptance/bundle/invariant/delete_idempotent/out.test.toml
new file mode 100644
index 00000000000..d9bed152760
--- /dev/null
+++ b/acceptance/bundle/invariant/delete_idempotent/out.test.toml
@@ -0,0 +1,69 @@
+Cloud = true
+EnvMatrix.DMS = [""]
+EnvMatrix.INPUT_CONFIG = [
+  "alert.yml.tmpl",
+  "app.yml.tmpl",
+  "catalog.yml.tmpl",
+  "catalog_optional_fields.yml.tmpl",
+  "cluster.yml.tmpl",
+  "cluster_apply_policy_default_values.yml.tmpl",
+  "cluster_libraries.yml.tmpl",
+  "cluster_policy.yml.tmpl",
+  "dashboard.yml.tmpl",
+  "job_apply_policy_default_values_job_cluster.yml.tmpl",
+  "job_apply_policy_default_values_task_cluster.yml.tmpl",
+  "job_apply_policy_default_values_for_each_task.yml.tmpl",
+  "database_catalog.yml.tmpl",
+  "database_instance.yml.tmpl",
+  "experiment.yml.tmpl",
+  "external_location.yml.tmpl",
+  "feature.yml.tmpl",
+  "genie_space.yml.tmpl",
+  "instance_pool.yml.tmpl",
+  "job.yml.tmpl",
+  "job_pydabs_10_tasks.yml.tmpl",
+  "job_pydabs_1000_tasks.yml.tmpl",
+  "job_cross_resource_ref.yml.tmpl",
+  "job_escaped_refs.yml.tmpl",
+  "job_permission_ref.yml.tmpl",
+  "job_run.yml.tmpl",
+  "job_run_job_ref.yml.tmpl",
+  "job_table_update_trigger.yml.tmpl",
+  "job_with_depends_on.yml.tmpl",
+  "job_with_task.yml.tmpl",
+  "model.yml.tmpl",
+  "model_with_permissions.yml.tmpl",
+  "model_serving_endpoint.yml.tmpl",
+  "model_serving_endpoint_telemetry.yml.tmpl",
+  "pipeline.yml.tmpl",
+  "pipeline_allow_duplicate_names.yml.tmpl",
+  "pipeline_apply_policy_default_values.yml.tmpl",
+  "pipeline_config_dots.yml.tmpl",
+  "postgres_branch.yml.tmpl",
+  "postgres_catalog.yml.tmpl",
+  "postgres_database.yml.tmpl",
+  "postgres_endpoint.yml.tmpl",
+  "postgres_project.yml.tmpl",
+  "postgres_role.yml.tmpl",
+  "postgres_synced_table.yml.tmpl",
+  "registered_model.yml.tmpl",
+  "schema.yml.tmpl",
+  "schema_tf_compat.yml.tmpl",
+  "schema_empty_grants.yml.tmpl",
+  "schema_grant_ref.yml.tmpl",
+  "schema_uppercase_name.yml.tmpl",
+  "secret.yml.tmpl",
+  "secret_scope.yml.tmpl",
+  "secret_scope_default_backend_type.yml.tmpl",
+  "sql_warehouse.yml.tmpl",
+  "synced_database_table.yml.tmpl",
+  "uc_trailing_slash.yml.tmpl",
+  "vector_search_endpoint.yml.tmpl",
+  "vector_search_index.yml.tmpl",
+  "volume.yml.tmpl",
+  "volume_external.yml.tmpl",
+  "volume_path_job_ref.yml.tmpl",
+  "volume_uppercase_name.yml.tmpl",
+  "model_service.yml.tmpl"
+]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/invariant/delete_idempotent/output.txt b/acceptance/bundle/invariant/delete_idempotent/output.txt
new file mode 100644
index 00000000000..7a28cb73a58
--- /dev/null
+++ b/acceptance/bundle/invariant/delete_idempotent/output.txt
@@ -0,0 +1 @@
+INPUT_CONFIG_OK
diff --git a/acceptance/bundle/invariant/delete_idempotent/script b/acceptance/bundle/invariant/delete_idempotent/script
new file mode 100644
index 00000000000..aba945dbb2e
--- /dev/null
+++ b/acceptance/bundle/invariant/delete_idempotent/script
@@ -0,0 +1,61 @@
+# Invariant to test: deleting resources by removing them from config is idempotent.
+# After a delete succeeds, restoring the pre-delete state and running deploy again
+# must succeed even though the resources are already gone on the server.
+
+invariant_setup
+
+# All configs use `test-bundle-$UNIQUE_NAME`; workspace root/state paths follow
+# the default `~/.bundle/<name>/<target>` template with target=default.
+bundle_name=test-bundle-$UNIQUE_NAME
+STATE_PATH=/Workspace/Users/$CURRENT_USER_NAME/.bundle/$bundle_name/default/state
+
+# Initial deploy of the resources. Only pre-plan when READPLAN=1 exercises the
+# saved-plan deploy path; otherwise `bundle deploy` plans on its own.
+if [[ -n "$READPLAN" ]]; then
+    $CLI bundle plan -o json > plan_initial.json 2>LOG.plan_initial.err
+    cat LOG.plan_initial.err | contains.py '!panic:' '!internal error' > /dev/null
+fi
+
+invariant_deploy LOG.deploy_initial $CLI bundle deploy $(readplanarg plan_initial.json)
+
+# Snapshot the deploy state before we delete anything.
+cp -r .databricks .databricks.backup
+
+# Replace the config with an empty resources map so the next deploy issues deletes.
+cat > databricks.yml <<EOF
+bundle:
+  name: $bundle_name
+
+resources: {}
+EOF
+
+if [[ -n "$READPLAN" ]]; then
+    $CLI bundle plan -o json > plan_delete.json 2>LOG.plan_delete.err
+    cat LOG.plan_delete.err | contains.py '!panic:' '!internal error' > /dev/null
+fi
+
+trace $CLI bundle deploy --auto-approve $(readplanarg plan_delete.json) &> LOG.deploy_delete
+cat LOG.deploy_delete | contains.py '!panic:' '!internal error' > /dev/null
+
+# Restore the pre-delete state; the resources are already gone from the server,
+# so the next delete-deploy must handle "resource already gone" idempotently.
+rm -rf .databricks
+mv .databricks.backup .databricks
+
+# Wipe the workspace state file the delete-deploy just wrote. With it present,
+# AlwaysPull=true would treat remote as newer and overwrite our restored local
+# state; nuking it leaves local as the sole state source, so the next plan
+# genuinely re-issues deletes for resources the server has already removed.
+# MSYS_NO_PATHCONV=1 stops Git Bash on Windows from rewriting the leading-slash
+# workspace path into C:/Program Files/Git/...; it is scoped to this command so
+# the Python helpers (which need their own paths converted) are unaffected.
+MSYS_NO_PATHCONV=1 $CLI workspace delete --recursive "$STATE_PATH" &> LOG.wipe_remote_state
+cat LOG.wipe_remote_state | contains.py '!panic:' '!internal error' > /dev/null
+
+if [[ -n "$READPLAN" ]]; then
+    $CLI bundle plan -o json > plan_delete2.json 2>LOG.plan_delete2.err
+    cat LOG.plan_delete2.err | contains.py '!panic:' '!internal error' > /dev/null
+fi
+
+trace $CLI bundle deploy --auto-approve $(readplanarg plan_delete2.json) &> LOG.deploy_delete2
+cat LOG.deploy_delete2 | contains.py '!panic:' '!internal error' > /dev/null
diff --git a/acceptance/bundle/invariant/delete_idempotent/test.toml b/acceptance/bundle/invariant/delete_idempotent/test.toml
new file mode 100644
index 00000000000..f876726848d
--- /dev/null
+++ b/acceptance/bundle/invariant/delete_idempotent/test.toml
@@ -0,0 +1,9 @@
+# Recording needs a bundle from the start. This test rewinds state and wipes the
+# deployment record path, so recording refuses it.
+EnvMatrix.DMS = [""]
+
+EnvMatrix.READPLAN = ["", "1"]
+
+# Snapshot of pre-delete state used to re-run the delete on state that still
+# references the (now-gone) resources; may linger if the test fails mid-run.
+Ignore = [".databricks.backup"]
diff --git a/acceptance/bundle/invariant/destroy_idempotent/out.test.toml b/acceptance/bundle/invariant/destroy_idempotent/out.test.toml
new file mode 100644
index 00000000000..d9bed152760
--- /dev/null
+++ b/acceptance/bundle/invariant/destroy_idempotent/out.test.toml
@@ -0,0 +1,69 @@
+Cloud = true
+EnvMatrix.DMS = [""]
+EnvMatrix.INPUT_CONFIG = [
+  "alert.yml.tmpl",
+  "app.yml.tmpl",
+  "catalog.yml.tmpl",
+  "catalog_optional_fields.yml.tmpl",
+  "cluster.yml.tmpl",
+  "cluster_apply_policy_default_values.yml.tmpl",
+  "cluster_libraries.yml.tmpl",
+  "cluster_policy.yml.tmpl",
+  "dashboard.yml.tmpl",
+  "job_apply_policy_default_values_job_cluster.yml.tmpl",
+  "job_apply_policy_default_values_task_cluster.yml.tmpl",
+  "job_apply_policy_default_values_for_each_task.yml.tmpl",
+  "database_catalog.yml.tmpl",
+  "database_instance.yml.tmpl",
+  "experiment.yml.tmpl",
+  "external_location.yml.tmpl",
+  "feature.yml.tmpl",
+  "genie_space.yml.tmpl",
+  "instance_pool.yml.tmpl",
+  "job.yml.tmpl",
+  "job_pydabs_10_tasks.yml.tmpl",
+  "job_pydabs_1000_tasks.yml.tmpl",
+  "job_cross_resource_ref.yml.tmpl",
+  "job_escaped_refs.yml.tmpl",
+  "job_permission_ref.yml.tmpl",
+  "job_run.yml.tmpl",
+  "job_run_job_ref.yml.tmpl",
+  "job_table_update_trigger.yml.tmpl",
+  "job_with_depends_on.yml.tmpl",
+  "job_with_task.yml.tmpl",
+  "model.yml.tmpl",
+  "model_with_permissions.yml.tmpl",
+  "model_serving_endpoint.yml.tmpl",
+  "model_serving_endpoint_telemetry.yml.tmpl",
+  "pipeline.yml.tmpl",
+  "pipeline_allow_duplicate_names.yml.tmpl",
+  "pipeline_apply_policy_default_values.yml.tmpl",
+  "pipeline_config_dots.yml.tmpl",
+  "postgres_branch.yml.tmpl",
+  "postgres_catalog.yml.tmpl",
+  "postgres_database.yml.tmpl",
+  "postgres_endpoint.yml.tmpl",
+  "postgres_project.yml.tmpl",
+  "postgres_role.yml.tmpl",
+  "postgres_synced_table.yml.tmpl",
+  "registered_model.yml.tmpl",
+  "schema.yml.tmpl",
+  "schema_tf_compat.yml.tmpl",
+  "schema_empty_grants.yml.tmpl",
+  "schema_grant_ref.yml.tmpl",
+  "schema_uppercase_name.yml.tmpl",
+  "secret.yml.tmpl",
+  "secret_scope.yml.tmpl",
+  "secret_scope_default_backend_type.yml.tmpl",
+  "sql_warehouse.yml.tmpl",
+  "synced_database_table.yml.tmpl",
+  "uc_trailing_slash.yml.tmpl",
+  "vector_search_endpoint.yml.tmpl",
+  "vector_search_index.yml.tmpl",
+  "volume.yml.tmpl",
+  "volume_external.yml.tmpl",
+  "volume_path_job_ref.yml.tmpl",
+  "volume_uppercase_name.yml.tmpl",
+  "model_service.yml.tmpl"
+]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/invariant/destroy_idempotent/output.txt b/acceptance/bundle/invariant/destroy_idempotent/output.txt
new file mode 100644
index 00000000000..7a28cb73a58
--- /dev/null
+++ b/acceptance/bundle/invariant/destroy_idempotent/output.txt
@@ -0,0 +1 @@
+INPUT_CONFIG_OK
diff --git a/acceptance/bundle/invariant/destroy_idempotent/script b/acceptance/bundle/invariant/destroy_idempotent/script
new file mode 100644
index 00000000000..0467b23330e
--- /dev/null
+++ b/acceptance/bundle/invariant/destroy_idempotent/script
@@ -0,0 +1,41 @@
+# Invariant to test: bundle destroy is idempotent.
+# After destroy succeeds, restoring the pre-destroy state and running destroy again
+# must succeed even though the resources are already gone on the server.
+
+invariant_setup
+
+# All configs use `test-bundle-$UNIQUE_NAME`; workspace root path follows the
+# default `~/.bundle/<name>/<target>` template with target=default.
+bundle_name=test-bundle-$UNIQUE_NAME
+ROOT_PATH=/Workspace/Users/$CURRENT_USER_NAME/.bundle/$bundle_name/default
+
+# Initial deploy of the resources. Only pre-plan when READPLAN=1 exercises the
+# saved-plan deploy path; otherwise `bundle deploy` plans on its own.
+if [[ -n "$READPLAN" ]]; then
+    $CLI bundle plan -o json > plan_initial.json 2>LOG.plan_initial.err
+    cat LOG.plan_initial.err | contains.py '!panic:' '!internal error' > /dev/null
+fi
+
+invariant_deploy LOG.deploy_initial $CLI bundle deploy $(readplanarg plan_initial.json)
+
+# Snapshot the deploy state before we destroy anything.
+cp -r .databricks .databricks.backup
+
+trace $CLI bundle destroy --auto-approve &> LOG.destroy1
+cat LOG.destroy1 | contains.py '!panic:' '!internal error' > /dev/null
+
+# Restore the pre-destroy state; the resources are already gone from the server,
+# so the next destroy must handle "resource already gone" idempotently.
+rm -rf .databricks
+mv .databricks.backup .databricks
+
+# Recreate the workspace root path deleted by destroy1 so destroy2 proceeds
+# past the "no active deployment" check and actually re-runs resource deletions.
+# MSYS_NO_PATHCONV=1 stops Git Bash on Windows from rewriting the leading-slash
+# workspace path into C:/Program Files/Git/...; it is scoped to this command so
+# the Python helpers (which need their own paths converted) are unaffected.
+MSYS_NO_PATHCONV=1 $CLI workspace mkdirs "$ROOT_PATH" &> LOG.mkdirs
+cat LOG.mkdirs | contains.py '!panic:' '!internal error' > /dev/null
+
+trace $CLI bundle destroy --auto-approve &> LOG.destroy2
+cat LOG.destroy2 | contains.py '!panic:' '!internal error' > /dev/null
diff --git a/acceptance/bundle/invariant/destroy_idempotent/test.toml b/acceptance/bundle/invariant/destroy_idempotent/test.toml
new file mode 100644
index 00000000000..d86b5366f20
--- /dev/null
+++ b/acceptance/bundle/invariant/destroy_idempotent/test.toml
@@ -0,0 +1,13 @@
+# Recording needs a bundle from the start. This test rewinds state and wipes the
+# deployment record path, so recording refuses it.
+EnvMatrix.DMS = [""]
+
+EnvMatrix.READPLAN = ["", "1"]
+
+# Snapshot of pre-destroy state used to re-run destroy on state that still
+# references the (now-gone) resources; may linger if the test fails mid-run.
+Ignore = [".databricks.backup"]
+
+# Secrets have sensitive fields (json:"-") that are stripped when a plan is serialized to JSON,
+# so deploying from a pre-computed plan file creates the secret with an empty value.
+EnvMatrixExclude.no_secret_with_readplan = ["READPLAN=1", "INPUT_CONFIG=secret.yml.tmpl"]
diff --git a/acceptance/bundle/invariant/fixtures/alert.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/alert.yml.tmpl.requests.json
new file mode 100644
index 00000000000..a26069b6604
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/alert.yml.tmpl.requests.json
@@ -0,0 +1,50 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.0/alerts",
+    "body": {
+      "custom_summary": "test-alert",
+      "display_name": "test-alert-[UNIQUE_NAME]",
+      "evaluation": {
+        "comparison_operator": "EQUAL",
+        "notification": {
+          "notify_on_ok": false,
+          "retrigger_seconds": 60
+        },
+        "source": {
+          "aggregation": "MAX",
+          "display": "1",
+          "name": "1"
+        },
+        "threshold": {
+          "value": {
+            "double_value": 1
+          }
+        }
+      },
+      "parent_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/resources",
+      "query_text": "select 1\n",
+      "schedule": {
+        "quartz_cron_schedule": "0 0 9 10 1 ?",
+        "timezone_id": "UTC"
+      },
+      "warehouse_id": "8ec9edc1-db0c-40df-af8d-7580020fe61e"
+    }
+  },
+  {
+    "method": "PUT",
+    "path": "/api/2.0/permissions/alertsv2/79fec857-226d-6338-79fe-c857226d6339",
+    "body": {
+      "access_control_list": [
+        {
+          "group_name": "users",
+          "permission_level": "CAN_MANAGE"
+        },
+        {
+          "permission_level": "CAN_MANAGE",
+          "user_name": "tester@databricks.com"
+        }
+      ]
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/alert.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/alert.yml.tmpl.tfstate
new file mode 100644
index 00000000000..95eaaf51016
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/alert.yml.tmpl.tfstate
@@ -0,0 +1,142 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 3,
+  "lineage": "545eadba-adc7-96a5-4dc4-52407a696f44",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_alert_v2",
+      "name": "foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "create_time": null,
+            "custom_description": null,
+            "custom_summary": "test-alert",
+            "display_name": "test-alert-[UNIQUE_NAME]",
+            "effective_run_as": null,
+            "evaluation": {
+              "comparison_operator": "EQUAL",
+              "empty_result_state": null,
+              "last_evaluated_at": null,
+              "notification": {
+                "effective_notify_on_ok": false,
+                "effective_retrigger_seconds": 60,
+                "notify_on_ok": false,
+                "retrigger_seconds": 60,
+                "subscriptions": null
+              },
+              "source": {
+                "aggregation": "MAX",
+                "display": "1",
+                "name": "1"
+              },
+              "state": null,
+              "threshold": {
+                "column": null,
+                "value": {
+                  "bool_value": null,
+                  "double_value": 1,
+                  "string_value": null
+                }
+              }
+            },
+            "id": "79fec857-226d-6338-79fe-c857226d6339",
+            "lifecycle_state": "ACTIVE",
+            "owner_user_name": null,
+            "parameters": null,
+            "parent_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/resources",
+            "provider_config": {
+              "workspace_id": "900800700600"
+            },
+            "purge_on_delete": true,
+            "query_text": "select 1\n",
+            "run_as": null,
+            "run_as_user_name": null,
+            "schedule": {
+              "pause_status": null,
+              "quartz_cron_schedule": "0 0 9 10 1 ?",
+              "timezone_id": "UTC"
+            },
+            "update_time": null,
+            "warehouse_id": "8ec9edc1-db0c-40df-af8d-7580020fe61e"
+          },
+          "sensitive_attributes": []
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_permissions",
+      "name": "alert_foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "access_control": [
+              {
+                "group_name": "",
+                "permission_level": "CAN_MANAGE",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              },
+              {
+                "group_name": "users",
+                "permission_level": "CAN_MANAGE",
+                "service_principal_name": "",
+                "user_name": ""
+              }
+            ],
+            "alert_v2_id": "79fec857-226d-6338-79fe-c857226d6339",
+            "app_name": null,
+            "authorization": null,
+            "cluster_id": null,
+            "cluster_policy_id": null,
+            "dashboard_id": null,
+            "database_instance_name": null,
+            "database_project_name": null,
+            "directory_id": null,
+            "directory_path": null,
+            "experiment_id": null,
+            "id": "/alertsv2/79fec857-226d-6338-79fe-c857226d6339",
+            "instance_pool_id": null,
+            "job_id": null,
+            "knowledge_assistant_id": null,
+            "notebook_id": null,
+            "notebook_path": null,
+            "object_type": "alertv2",
+            "pipeline_id": null,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "registered_model_id": null,
+            "repo_id": null,
+            "repo_path": null,
+            "serving_endpoint_id": null,
+            "sql_alert_id": null,
+            "sql_dashboard_id": null,
+            "sql_endpoint_id": null,
+            "sql_query_id": null,
+            "supervisor_agent_id": null,
+            "vector_search_endpoint_id": null,
+            "workspace_file_id": null,
+            "workspace_file_path": null
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "databricks_alert_v2.foo"
+          ]
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/app.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/app.yml.tmpl.requests.json
new file mode 100644
index 00000000000..2d0f0a50c3c
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/app.yml.tmpl.requests.json
@@ -0,0 +1,26 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.0/apps",
+    "body": {
+      "description": "This is a test app",
+      "name": "app-[UNIQUE_NAME]"
+    }
+  },
+  {
+    "method": "PUT",
+    "path": "/api/2.0/permissions/apps/app-[UNIQUE_NAME]",
+    "body": {
+      "access_control_list": [
+        {
+          "group_name": "users",
+          "permission_level": "CAN_USE"
+        },
+        {
+          "permission_level": "CAN_MANAGE",
+          "user_name": "tester@databricks.com"
+        }
+      ]
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/app.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/app.yml.tmpl.tfstate
new file mode 100644
index 00000000000..0bf86206823
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/app.yml.tmpl.tfstate
@@ -0,0 +1,140 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 3,
+  "lineage": "f256130a-2e45-9c58-751c-82c9dccea31e",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_app",
+      "name": "foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "active_deployment": null,
+            "app_status": {
+              "message": "App status is unavailable.",
+              "running_instances": null,
+              "state": "UNAVAILABLE"
+            },
+            "budget_policy_id": null,
+            "compute_max_instances": null,
+            "compute_min_instances": null,
+            "compute_size": "MEDIUM",
+            "compute_status": {
+              "active_instances": null,
+              "message": "App compute is stopped.",
+              "state": "STOPPED"
+            },
+            "create_time": null,
+            "creator": null,
+            "default_git_source": null,
+            "default_source_code_path": null,
+            "description": "This is a test app",
+            "effective_budget_policy_id": null,
+            "effective_usage_policy_id": null,
+            "effective_user_api_scopes": null,
+            "forward_user_access_token": true,
+            "git_repository": null,
+            "git_source": null,
+            "id": "1000",
+            "name": "app-[UNIQUE_NAME]",
+            "no_compute": true,
+            "oauth2_app_client_id": null,
+            "oauth2_app_integration_id": null,
+            "pending_deployment": null,
+            "provider_config": {
+              "workspace_id": "900800700600"
+            },
+            "resources": null,
+            "service_principal_client_id": "79fec85a-7ede-2b40-79fe-c85a7ede2b41",
+            "service_principal_id": 8790683813674889000,
+            "service_principal_name": "app-app-[UNIQUE_NAME]",
+            "source_code_path": null,
+            "space": null,
+            "telemetry_export_destinations": null,
+            "thumbnail_url": null,
+            "update_time": null,
+            "updater": null,
+            "url": "app-[UNIQUE_NAME]-123.cloud.databricksapps.com",
+            "usage_policy_id": null,
+            "user_api_scopes": null
+          },
+          "sensitive_attributes": []
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_permissions",
+      "name": "app_foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "access_control": [
+              {
+                "group_name": "",
+                "permission_level": "CAN_MANAGE",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              },
+              {
+                "group_name": "users",
+                "permission_level": "CAN_USE",
+                "service_principal_name": "",
+                "user_name": ""
+              }
+            ],
+            "alert_v2_id": null,
+            "app_name": "app-[UNIQUE_NAME]",
+            "authorization": null,
+            "cluster_id": null,
+            "cluster_policy_id": null,
+            "dashboard_id": null,
+            "database_instance_name": null,
+            "database_project_name": null,
+            "directory_id": null,
+            "directory_path": null,
+            "experiment_id": null,
+            "id": "/apps/app-[UNIQUE_NAME]",
+            "instance_pool_id": null,
+            "job_id": null,
+            "knowledge_assistant_id": null,
+            "notebook_id": null,
+            "notebook_path": null,
+            "object_type": "apps",
+            "pipeline_id": null,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "registered_model_id": null,
+            "repo_id": null,
+            "repo_path": null,
+            "serving_endpoint_id": null,
+            "sql_alert_id": null,
+            "sql_dashboard_id": null,
+            "sql_endpoint_id": null,
+            "sql_query_id": null,
+            "supervisor_agent_id": null,
+            "vector_search_endpoint_id": null,
+            "workspace_file_id": null,
+            "workspace_file_path": null
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "databricks_app.foo"
+          ]
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/cluster.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/cluster.yml.tmpl.requests.json
new file mode 100644
index 00000000000..e58b867b494
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/cluster.yml.tmpl.requests.json
@@ -0,0 +1,29 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.1/clusters/create",
+    "body": {
+      "autotermination_minutes": 60,
+      "cluster_name": "test-cluster-[UNIQUE_NAME]",
+      "instance_pool_id": "0123-456789-pool0",
+      "num_workers": 1,
+      "spark_version": "13.3.x-scala2.12"
+    }
+  },
+  {
+    "method": "PUT",
+    "path": "/api/2.0/permissions/clusters/79fec859-ec2d-4060-79fe-c859ec2d4061",
+    "body": {
+      "access_control_list": [
+        {
+          "group_name": "users",
+          "permission_level": "CAN_ATTACH_TO"
+        },
+        {
+          "permission_level": "CAN_MANAGE",
+          "user_name": "tester@databricks.com"
+        }
+      ]
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/cluster.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/cluster.yml.tmpl.tfstate
new file mode 100644
index 00000000000..eb2ce421cf4
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/cluster.yml.tmpl.tfstate
@@ -0,0 +1,158 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 3,
+  "lineage": "d6327401-5a86-6c7e-0691-b50a9eafab52",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_cluster",
+      "name": "foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 4,
+          "attributes": {
+            "apply_policy_default_values": null,
+            "autoscale": [],
+            "autotermination_minutes": 60,
+            "aws_attributes": [
+              {
+                "availability": "SPOT_WITH_FALLBACK",
+                "ebs_volume_count": 0,
+                "ebs_volume_iops": 0,
+                "ebs_volume_size": 0,
+                "ebs_volume_throughput": 0,
+                "ebs_volume_type": "",
+                "first_on_demand": 0,
+                "instance_profile_arn": "",
+                "spot_bid_price_percent": 0,
+                "zone_id": "us-east-1c"
+              }
+            ],
+            "azure_attributes": [],
+            "clear_cloud_attributes_on_remove": false,
+            "cluster_id": "79fec859-ec2d-4060-79fe-c859ec2d4061",
+            "cluster_log_conf": [],
+            "cluster_mount_info": [],
+            "cluster_name": "test-cluster-[UNIQUE_NAME]",
+            "custom_tags": null,
+            "data_security_mode": null,
+            "default_tags": {},
+            "dependency_mode": null,
+            "docker_image": [],
+            "driver_instance_pool_id": null,
+            "driver_node_type_flexibility": [],
+            "driver_node_type_id": null,
+            "enable_elastic_disk": false,
+            "enable_local_disk_encryption": false,
+            "gcp_attributes": [],
+            "id": "79fec859-ec2d-4060-79fe-c859ec2d4061",
+            "idempotency_token": null,
+            "init_scripts": [],
+            "instance_pool_id": "0123-456789-pool0",
+            "is_pinned": false,
+            "is_single_node": false,
+            "kind": null,
+            "library": [],
+            "no_wait": true,
+            "node_type_id": null,
+            "num_workers": 1,
+            "policy_id": null,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "remote_disk_throughput": 0,
+            "runtime_engine": null,
+            "single_user_name": null,
+            "spark_conf": null,
+            "spark_env_vars": null,
+            "spark_version": "13.3.x-scala2.12",
+            "ssh_public_keys": null,
+            "state": "RUNNING",
+            "timeouts": null,
+            "total_initial_remote_disk_size": 0,
+            "url": "[DATABRICKS_URL]/#setting/clusters/79fec859-ec2d-4060-79fe-c859ec2d4061/configuration",
+            "use_ml_runtime": false,
+            "worker_node_type_flexibility": [],
+            "workload_type": []
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJkZWxldGUiOjE4MDAwMDAwMDAwMDAsInVwZGF0ZSI6MTgwMDAwMDAwMDAwMH0sInNjaGVtYV92ZXJzaW9uIjoiNCJ9"
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_permissions",
+      "name": "cluster_foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "access_control": [
+              {
+                "group_name": "",
+                "permission_level": "CAN_MANAGE",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              },
+              {
+                "group_name": "users",
+                "permission_level": "CAN_ATTACH_TO",
+                "service_principal_name": "",
+                "user_name": ""
+              }
+            ],
+            "alert_v2_id": null,
+            "app_name": null,
+            "authorization": null,
+            "cluster_id": "79fec859-ec2d-4060-79fe-c859ec2d4061",
+            "cluster_policy_id": null,
+            "dashboard_id": null,
+            "database_instance_name": null,
+            "database_project_name": null,
+            "directory_id": null,
+            "directory_path": null,
+            "experiment_id": null,
+            "id": "/clusters/79fec859-ec2d-4060-79fe-c859ec2d4061",
+            "instance_pool_id": null,
+            "job_id": null,
+            "knowledge_assistant_id": null,
+            "notebook_id": null,
+            "notebook_path": null,
+            "object_type": "cluster",
+            "pipeline_id": null,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "registered_model_id": null,
+            "repo_id": null,
+            "repo_path": null,
+            "serving_endpoint_id": null,
+            "sql_alert_id": null,
+            "sql_dashboard_id": null,
+            "sql_endpoint_id": null,
+            "sql_query_id": null,
+            "supervisor_agent_id": null,
+            "vector_search_endpoint_id": null,
+            "workspace_file_id": null,
+            "workspace_file_path": null
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "databricks_cluster.foo"
+          ]
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/cluster_apply_policy_default_values.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/cluster_apply_policy_default_values.yml.tmpl.requests.json
new file mode 100644
index 00000000000..91b0ad2788e
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/cluster_apply_policy_default_values.yml.tmpl.requests.json
@@ -0,0 +1,14 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.1/clusters/create",
+    "body": {
+      "apply_policy_default_values": true,
+      "autotermination_minutes": 60,
+      "cluster_name": "test-cluster-[UNIQUE_NAME]",
+      "instance_pool_id": "0123-456789-pool0",
+      "num_workers": 1,
+      "spark_version": "13.3.x-scala2.12"
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/cluster_apply_policy_default_values.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/cluster_apply_policy_default_values.yml.tmpl.tfstate
new file mode 100644
index 00000000000..bd87e99ecac
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/cluster_apply_policy_default_values.yml.tmpl.tfstate
@@ -0,0 +1,90 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "d24988fc-7d03-6643-dcfe-e962bee3b962",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_cluster",
+      "name": "foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 4,
+          "attributes": {
+            "apply_policy_default_values": true,
+            "autoscale": [],
+            "autotermination_minutes": 60,
+            "aws_attributes": [
+              {
+                "availability": "SPOT_WITH_FALLBACK",
+                "ebs_volume_count": 0,
+                "ebs_volume_iops": 0,
+                "ebs_volume_size": 0,
+                "ebs_volume_throughput": 0,
+                "ebs_volume_type": "",
+                "first_on_demand": 0,
+                "instance_profile_arn": "",
+                "spot_bid_price_percent": 0,
+                "zone_id": "us-east-1c"
+              }
+            ],
+            "azure_attributes": [],
+            "clear_cloud_attributes_on_remove": false,
+            "cluster_id": "79fec85a-15b7-f0d8-79fe-c85a15b7f0d9",
+            "cluster_log_conf": [],
+            "cluster_mount_info": [],
+            "cluster_name": "test-cluster-[UNIQUE_NAME]",
+            "custom_tags": null,
+            "data_security_mode": null,
+            "default_tags": {},
+            "dependency_mode": null,
+            "docker_image": [],
+            "driver_instance_pool_id": null,
+            "driver_node_type_flexibility": [],
+            "driver_node_type_id": null,
+            "enable_elastic_disk": false,
+            "enable_local_disk_encryption": false,
+            "gcp_attributes": [],
+            "id": "79fec85a-15b7-f0d8-79fe-c85a15b7f0d9",
+            "idempotency_token": null,
+            "init_scripts": [],
+            "instance_pool_id": "0123-456789-pool0",
+            "is_pinned": false,
+            "is_single_node": false,
+            "kind": null,
+            "library": [],
+            "no_wait": true,
+            "node_type_id": null,
+            "num_workers": 1,
+            "policy_id": null,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "remote_disk_throughput": 0,
+            "runtime_engine": null,
+            "single_user_name": null,
+            "spark_conf": null,
+            "spark_env_vars": null,
+            "spark_version": "13.3.x-scala2.12",
+            "ssh_public_keys": null,
+            "state": "RUNNING",
+            "timeouts": null,
+            "total_initial_remote_disk_size": 0,
+            "url": "[DATABRICKS_URL]/#setting/clusters/79fec85a-15b7-f0d8-79fe-c85a15b7f0d9/configuration",
+            "use_ml_runtime": false,
+            "worker_node_type_flexibility": [],
+            "workload_type": []
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJkZWxldGUiOjE4MDAwMDAwMDAwMDAsInVwZGF0ZSI6MTgwMDAwMDAwMDAwMH0sInNjaGVtYV92ZXJzaW9uIjoiNCJ9"
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/dashboard.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/dashboard.yml.tmpl.requests.json
new file mode 100644
index 00000000000..265642ad5eb
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/dashboard.yml.tmpl.requests.json
@@ -0,0 +1,71 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/artifacts/.internal"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/files"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/files/app"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/resources"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/lakeview/dashboards",
+    "body": {
+      "display_name": "test-dashboard-[UNIQUE_NAME]",
+      "parent_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/resources",
+      "serialized_dashboard": "{\"pages\":[{\"name\":\"page1\",\"displayName\":\"Test Page\"}]}\n",
+      "warehouse_id": "8ec9edc1-db0c-40df-af8d-7580020fe61e"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/lakeview/dashboards/77d9d6ed0e90f2172a017254e91c8740/published",
+    "body": {
+      "embed_credentials": false,
+      "warehouse_id": "8ec9edc1-db0c-40df-af8d-7580020fe61e"
+    }
+  },
+  {
+    "method": "PUT",
+    "path": "/api/2.0/permissions/dashboards/77d9d6ed0e90f2172a017254e91c8740",
+    "body": {
+      "access_control_list": [
+        {
+          "group_name": "users",
+          "permission_level": "CAN_READ"
+        },
+        {
+          "permission_level": "CAN_MANAGE",
+          "user_name": "tester@databricks.com"
+        }
+      ]
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/dashboard.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/dashboard.yml.tmpl.tfstate
new file mode 100644
index 00000000000..8206a15953e
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/dashboard.yml.tmpl.tfstate
@@ -0,0 +1,115 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 3,
+  "lineage": "4d142404-7315-0dbd-419a-4a0b4147d8f7",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_dashboard",
+      "name": "foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "create_time": "2026-09-29T14:22:25.327739Z",
+            "dashboard_change_detected": false,
+            "dashboard_id": "77d9d6ed0e90f2172a017254e91c8740",
+            "dataset_catalog": null,
+            "dataset_schema": null,
+            "display_name": "test-dashboard-[UNIQUE_NAME]",
+            "embed_credentials": false,
+            "etag": "80611980",
+            "file_path": null,
+            "id": "77d9d6ed0e90f2172a017254e91c8740",
+            "lifecycle_state": "ACTIVE",
+            "md5": "04fb39463a614a544aed96a195e75143",
+            "parent_path": "/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/resources",
+            "path": "/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/resources/test-dashboard-[UNIQUE_NAME].lvdash.json",
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "serialized_dashboard": "{\"pages\":[{\"displayName\":\"Test Page\",\"name\":\"page1\",\"pageType\":\"PAGE_TYPE_CANVAS\"}]}\n",
+            "update_time": "2026-09-29T14:22:25.327739Z",
+            "warehouse_id": "8ec9edc1-db0c-40df-af8d-7580020fe61e"
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA=="
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_permissions",
+      "name": "dashboard_foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "access_control": [
+              {
+                "group_name": "",
+                "permission_level": "CAN_MANAGE",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              },
+              {
+                "group_name": "users",
+                "permission_level": "CAN_READ",
+                "service_principal_name": "",
+                "user_name": ""
+              }
+            ],
+            "alert_v2_id": null,
+            "app_name": null,
+            "authorization": null,
+            "cluster_id": null,
+            "cluster_policy_id": null,
+            "dashboard_id": "77d9d6ed0e90f2172a017254e91c8740",
+            "database_instance_name": null,
+            "database_project_name": null,
+            "directory_id": null,
+            "directory_path": null,
+            "experiment_id": null,
+            "id": "/dashboards/77d9d6ed0e90f2172a017254e91c8740",
+            "instance_pool_id": null,
+            "job_id": null,
+            "knowledge_assistant_id": null,
+            "notebook_id": null,
+            "notebook_path": null,
+            "object_type": "dashboard",
+            "pipeline_id": null,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "registered_model_id": null,
+            "repo_id": null,
+            "repo_path": null,
+            "serving_endpoint_id": null,
+            "sql_alert_id": null,
+            "sql_dashboard_id": null,
+            "sql_endpoint_id": null,
+            "sql_query_id": null,
+            "supervisor_agent_id": null,
+            "vector_search_endpoint_id": null,
+            "workspace_file_id": null,
+            "workspace_file_path": null
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "databricks_dashboard.foo"
+          ]
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/database_catalog.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/database_catalog.yml.tmpl.requests.json
new file mode 100644
index 00000000000..8c9110ffb73
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/database_catalog.yml.tmpl.requests.json
@@ -0,0 +1,48 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/artifacts/.internal"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/files"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/files/app"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/database/instances",
+    "body": {
+      "capacity": "CU_1",
+      "name": "test-db-instance-[UNIQUE_NAME]"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/database/catalogs",
+    "body": {
+      "create_database_if_not_exists": true,
+      "database_instance_name": "test-db-instance-[UNIQUE_NAME]",
+      "database_name": "test_db",
+      "name": "test-catalog-[UNIQUE_NAME]"
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/database_catalog.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/database_catalog.yml.tmpl.tfstate
new file mode 100644
index 00000000000..e5244080f5b
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/database_catalog.yml.tmpl.tfstate
@@ -0,0 +1,79 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 3,
+  "lineage": "646fd9d8-1906-ca12-5f5e-4d8d2d9122f1",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_database_database_catalog",
+      "name": "foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "create_database_if_not_exists": true,
+            "database_instance_name": "test-db-instance-[UNIQUE_NAME]",
+            "database_name": "test_db",
+            "name": "test-catalog-[UNIQUE_NAME]",
+            "provider_config": {
+              "workspace_id": "900800700600"
+            },
+            "uid": "79fecf9f-d093-fcc0-79fe-cf9fd093fcc1"
+          },
+          "sensitive_attributes": [],
+          "dependencies": [
+            "databricks_database_instance.instance1"
+          ]
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_database_instance",
+      "name": "instance1",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "capacity": "CU_1",
+            "child_instance_refs": null,
+            "creation_time": "2026-09-29T14:23:27Z",
+            "creator": "tester@databricks.com",
+            "custom_tags": null,
+            "effective_capacity": "CU_1",
+            "effective_custom_tags": null,
+            "effective_enable_pg_native_login": false,
+            "effective_enable_readable_secondaries": false,
+            "effective_node_count": 1,
+            "effective_retention_window_in_days": 7,
+            "effective_stopped": false,
+            "effective_usage_policy_id": null,
+            "enable_pg_native_login": null,
+            "enable_readable_secondaries": null,
+            "name": "test-db-instance-[UNIQUE_NAME]",
+            "node_count": null,
+            "parent_instance_ref": null,
+            "pg_version": "PG_VERSION_16",
+            "provider_config": {
+              "workspace_id": "900800700600"
+            },
+            "purge_on_delete": true,
+            "read_only_dns": null,
+            "read_write_dns": null,
+            "retention_window_in_days": null,
+            "state": "AVAILABLE",
+            "stopped": null,
+            "uid": "79fecf9f-cf1c-4528-79fe-cf9fcf1c4529",
+            "usage_policy_id": null
+          },
+          "sensitive_attributes": []
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/database_instance.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/database_instance.yml.tmpl.requests.json
new file mode 100644
index 00000000000..900eef0fcbe
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/database_instance.yml.tmpl.requests.json
@@ -0,0 +1,54 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/artifacts/.internal"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/files"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/files/app"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/database/instances",
+    "body": {
+      "capacity": "CU_1",
+      "name": "test-db-instance-[UNIQUE_NAME]"
+    }
+  },
+  {
+    "method": "PUT",
+    "path": "/api/2.0/permissions/database-instances/test-db-instance-[UNIQUE_NAME]",
+    "body": {
+      "access_control_list": [
+        {
+          "group_name": "users",
+          "permission_level": "CAN_USE"
+        },
+        {
+          "permission_level": "CAN_MANAGE",
+          "user_name": "tester@databricks.com"
+        }
+      ]
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/database_instance.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/database_instance.yml.tmpl.tfstate
new file mode 100644
index 00000000000..9f822577f7d
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/database_instance.yml.tmpl.tfstate
@@ -0,0 +1,122 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 3,
+  "lineage": "97defd5c-98e4-4bf7-33ed-77b67cb8ad0d",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_database_instance",
+      "name": "foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "capacity": "CU_1",
+            "child_instance_refs": null,
+            "creation_time": "2026-09-29T14:23:29Z",
+            "creator": "tester@databricks.com",
+            "custom_tags": null,
+            "effective_capacity": "CU_1",
+            "effective_custom_tags": null,
+            "effective_enable_pg_native_login": false,
+            "effective_enable_readable_secondaries": false,
+            "effective_node_count": 1,
+            "effective_retention_window_in_days": 7,
+            "effective_stopped": false,
+            "effective_usage_policy_id": null,
+            "enable_pg_native_login": null,
+            "enable_readable_secondaries": null,
+            "name": "test-db-instance-[UNIQUE_NAME]",
+            "node_count": null,
+            "parent_instance_ref": null,
+            "pg_version": "PG_VERSION_16",
+            "provider_config": {
+              "workspace_id": "900800700600"
+            },
+            "purge_on_delete": true,
+            "read_only_dns": null,
+            "read_write_dns": null,
+            "retention_window_in_days": null,
+            "state": "AVAILABLE",
+            "stopped": null,
+            "uid": "79fecfa0-282c-51a8-79fe-cfa0282c51a9",
+            "usage_policy_id": null
+          },
+          "sensitive_attributes": []
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_permissions",
+      "name": "database_instance_foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "access_control": [
+              {
+                "group_name": "",
+                "permission_level": "CAN_MANAGE",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              },
+              {
+                "group_name": "users",
+                "permission_level": "CAN_USE",
+                "service_principal_name": "",
+                "user_name": ""
+              }
+            ],
+            "alert_v2_id": null,
+            "app_name": null,
+            "authorization": null,
+            "cluster_id": null,
+            "cluster_policy_id": null,
+            "dashboard_id": null,
+            "database_instance_name": "test-db-instance-[UNIQUE_NAME]",
+            "database_project_name": null,
+            "directory_id": null,
+            "directory_path": null,
+            "experiment_id": null,
+            "id": "/database-instances/test-db-instance-[UNIQUE_NAME]",
+            "instance_pool_id": null,
+            "job_id": null,
+            "knowledge_assistant_id": null,
+            "notebook_id": null,
+            "notebook_path": null,
+            "object_type": "database-instances",
+            "pipeline_id": null,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "registered_model_id": null,
+            "repo_id": null,
+            "repo_path": null,
+            "serving_endpoint_id": null,
+            "sql_alert_id": null,
+            "sql_dashboard_id": null,
+            "sql_endpoint_id": null,
+            "sql_query_id": null,
+            "supervisor_agent_id": null,
+            "vector_search_endpoint_id": null,
+            "workspace_file_id": null,
+            "workspace_file_path": null
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "databricks_database_instance.foo"
+          ]
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/experiment.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/experiment.yml.tmpl.requests.json
new file mode 100644
index 00000000000..ba2e75719dc
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/experiment.yml.tmpl.requests.json
@@ -0,0 +1,25 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.0/mlflow/experiments/create",
+    "body": {
+      "name": "/Users/tester@databricks.com/test-experiment-[UNIQUE_NAME]"
+    }
+  },
+  {
+    "method": "PUT",
+    "path": "/api/2.0/permissions/experiments/8790683810185760000",
+    "body": {
+      "access_control_list": [
+        {
+          "group_name": "users",
+          "permission_level": "CAN_READ"
+        },
+        {
+          "permission_level": "CAN_MANAGE",
+          "user_name": "tester@databricks.com"
+        }
+      ]
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/experiment.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/experiment.yml.tmpl.tfstate
new file mode 100644
index 00000000000..f72da3c0a97
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/experiment.yml.tmpl.tfstate
@@ -0,0 +1,130 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 3,
+  "lineage": "f46647a6-543f-4dbe-eec8-b31c151ab733",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_mlflow_experiment",
+      "name": "foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "artifact_location": "dbfs:/databricks/mlflow-tracking/8790683810185760000",
+            "creation_time": 0,
+            "description": null,
+            "experiment_id": "8790683810185760000",
+            "id": "8790683810185760000",
+            "last_update_time": 0,
+            "lifecycle_stage": "active",
+            "name": "/Users/tester@databricks.com/test-experiment-[UNIQUE_NAME]",
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "tags": [
+              {
+                "key": "mlflow.ownerId",
+                "value": "1000012345"
+              },
+              {
+                "key": "mlflow.experiment.sourceName",
+                "value": "/Users/tester@databricks.com/test-experiment-[UNIQUE_NAME]"
+              },
+              {
+                "key": "mlflow.ownerId",
+                "value": "1000012345"
+              },
+              {
+                "key": "mlflow.ownerEmail",
+                "value": "tester@databricks.com"
+              },
+              {
+                "key": "mlflow.experimentType",
+                "value": "MLFLOW_EXPERIMENT"
+              }
+            ],
+            "timeouts": null,
+            "trace_location": []
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA=="
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_permissions",
+      "name": "mlflow_experiment_foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "access_control": [
+              {
+                "group_name": "",
+                "permission_level": "CAN_MANAGE",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              },
+              {
+                "group_name": "users",
+                "permission_level": "CAN_READ",
+                "service_principal_name": "",
+                "user_name": ""
+              }
+            ],
+            "alert_v2_id": null,
+            "app_name": null,
+            "authorization": null,
+            "cluster_id": null,
+            "cluster_policy_id": null,
+            "dashboard_id": null,
+            "database_instance_name": null,
+            "database_project_name": null,
+            "directory_id": null,
+            "directory_path": null,
+            "experiment_id": "8790683810185760000",
+            "id": "/experiments/8790683810185760000",
+            "instance_pool_id": null,
+            "job_id": null,
+            "knowledge_assistant_id": null,
+            "notebook_id": null,
+            "notebook_path": null,
+            "object_type": "mlflowExperiment",
+            "pipeline_id": null,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "registered_model_id": null,
+            "repo_id": null,
+            "repo_path": null,
+            "serving_endpoint_id": null,
+            "sql_alert_id": null,
+            "sql_dashboard_id": null,
+            "sql_endpoint_id": null,
+            "sql_query_id": null,
+            "supervisor_agent_id": null,
+            "vector_search_endpoint_id": null,
+            "workspace_file_id": null,
+            "workspace_file_path": null
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "databricks_mlflow_experiment.foo"
+          ]
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/job.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/job.yml.tmpl.requests.json
new file mode 100644
index 00000000000..f75a47b338d
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/job.yml.tmpl.requests.json
@@ -0,0 +1,36 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state/metadata.json"
+      },
+      "description": "This is a test job",
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "test-job-[UNIQUE_NAME]",
+      "queue": {
+        "enabled": true
+      }
+    }
+  },
+  {
+    "method": "PUT",
+    "path": "/api/2.0/permissions/jobs/8790683809500294000",
+    "body": {
+      "access_control_list": [
+        {
+          "group_name": "users",
+          "permission_level": "CAN_VIEW"
+        },
+        {
+          "permission_level": "IS_OWNER",
+          "user_name": "tester@databricks.com"
+        }
+      ]
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/job.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/job.yml.tmpl.tfstate
new file mode 100644
index 00000000000..e5532cd8731
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/job.yml.tmpl.tfstate
@@ -0,0 +1,178 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 3,
+  "lineage": "bd422c72-706f-ec7e-4054-8d42618c25be",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": "This is a test job",
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790683809500294000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "test-job-[UNIQUE_NAME]",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790683809500294000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_permissions",
+      "name": "job_foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "access_control": [
+              {
+                "group_name": "",
+                "permission_level": "IS_OWNER",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              },
+              {
+                "group_name": "users",
+                "permission_level": "CAN_VIEW",
+                "service_principal_name": "",
+                "user_name": ""
+              }
+            ],
+            "alert_v2_id": null,
+            "app_name": null,
+            "authorization": null,
+            "cluster_id": null,
+            "cluster_policy_id": null,
+            "dashboard_id": null,
+            "database_instance_name": null,
+            "database_project_name": null,
+            "directory_id": null,
+            "directory_path": null,
+            "experiment_id": null,
+            "id": "/jobs/8790683809500294000",
+            "instance_pool_id": null,
+            "job_id": "8790683809500294000",
+            "knowledge_assistant_id": null,
+            "notebook_id": null,
+            "notebook_path": null,
+            "object_type": "job",
+            "pipeline_id": null,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "registered_model_id": null,
+            "repo_id": null,
+            "repo_path": null,
+            "serving_endpoint_id": null,
+            "sql_alert_id": null,
+            "sql_dashboard_id": null,
+            "sql_endpoint_id": null,
+            "sql_query_id": null,
+            "supervisor_agent_id": null,
+            "vector_search_endpoint_id": null,
+            "workspace_file_id": null,
+            "workspace_file_path": null
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "databricks_job.foo"
+          ]
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/job_apply_policy_default_values_for_each_task.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/job_apply_policy_default_values_for_each_task.yml.tmpl.requests.json
new file mode 100644
index 00000000000..774dfa95fec
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/job_apply_policy_default_values_for_each_task.yml.tmpl.requests.json
@@ -0,0 +1,40 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "test-job-[UNIQUE_NAME]",
+      "queue": {
+        "enabled": true
+      },
+      "tasks": [
+        {
+          "for_each_task": {
+            "inputs": "[1]",
+            "task": {
+              "new_cluster": {
+                "apply_policy_default_values": true,
+                "instance_pool_id": "0123-456789-pool0",
+                "num_workers": 1,
+                "spark_version": "13.3.x-snapshot-scala2.12"
+              },
+              "notebook_task": {
+                "notebook_path": "/Shared/notebook",
+                "source": "WORKSPACE"
+              },
+              "task_key": "inner"
+            }
+          },
+          "task_key": "main"
+        }
+      ]
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/job_apply_policy_default_values_for_each_task.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/job_apply_policy_default_values_for_each_task.yml.tmpl.tfstate
new file mode 100644
index 00000000000..bdc4f982c03
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/job_apply_policy_default_values_for_each_task.yml.tmpl.tfstate
@@ -0,0 +1,259 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "6ac1f5ef-7dba-8f5f-cbf9-6366790e81ae",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790683811706225000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "test-job-[UNIQUE_NAME]",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [
+              {
+                "ai_runtime_task": [],
+                "alert_task": [],
+                "clean_rooms_notebook_task": [],
+                "compute": [],
+                "condition_task": [],
+                "dashboard_task": [],
+                "dbt_cloud_task": [],
+                "dbt_platform_task": [],
+                "dbt_task": [],
+                "depends_on": [],
+                "description": "",
+                "disable_auto_optimization": false,
+                "disabled": false,
+                "email_notifications": [
+                  {
+                    "no_alert_for_skipped_runs": false,
+                    "on_duration_warning_threshold_exceeded": [],
+                    "on_failure": [],
+                    "on_start": [],
+                    "on_streaming_backlog_exceeded": [],
+                    "on_success": []
+                  }
+                ],
+                "environment_key": "",
+                "existing_cluster_id": "",
+                "for_each_task": [
+                  {
+                    "concurrency": 0,
+                    "inputs": "[1]",
+                    "task": [
+                      {
+                        "ai_runtime_task": [],
+                        "alert_task": [],
+                        "clean_rooms_notebook_task": [],
+                        "compute": [],
+                        "condition_task": [],
+                        "dashboard_task": [],
+                        "dbt_cloud_task": [],
+                        "dbt_platform_task": [],
+                        "dbt_task": [],
+                        "depends_on": [],
+                        "description": "",
+                        "disable_auto_optimization": false,
+                        "disabled": false,
+                        "email_notifications": [],
+                        "environment_key": "",
+                        "existing_cluster_id": "",
+                        "gen_ai_compute_task": [],
+                        "health": [],
+                        "job_cluster_key": "",
+                        "library": [],
+                        "max_retries": 0,
+                        "min_retry_interval_millis": 0,
+                        "new_cluster": [
+                          {
+                            "apply_policy_default_values": false,
+                            "autoscale": [],
+                            "aws_attributes": [],
+                            "azure_attributes": [],
+                            "cluster_id": "",
+                            "cluster_log_conf": [],
+                            "cluster_mount_info": [],
+                            "cluster_name": "",
+                            "custom_tags": null,
+                            "data_security_mode": "",
+                            "dependency_mode": "",
+                            "docker_image": [],
+                            "driver_instance_pool_id": "",
+                            "driver_node_type_flexibility": [],
+                            "driver_node_type_id": "",
+                            "enable_elastic_disk": false,
+                            "enable_local_disk_encryption": false,
+                            "gcp_attributes": [],
+                            "idempotency_token": "",
+                            "init_scripts": [],
+                            "instance_pool_id": "0123-456789-pool0",
+                            "is_single_node": false,
+                            "kind": "",
+                            "library": [],
+                            "node_type_id": "",
+                            "num_workers": 1,
+                            "policy_id": "",
+                            "provider_config": [],
+                            "remote_disk_throughput": 0,
+                            "runtime_engine": "",
+                            "single_user_name": "",
+                            "spark_conf": null,
+                            "spark_env_vars": null,
+                            "spark_version": "13.3.x-snapshot-scala2.12",
+                            "ssh_public_keys": null,
+                            "total_initial_remote_disk_size": 0,
+                            "use_ml_runtime": false,
+                            "worker_node_type_flexibility": [],
+                            "workload_type": []
+                          }
+                        ],
+                        "notebook_task": [
+                          {
+                            "base_parameters": null,
+                            "notebook_path": "/Shared/notebook",
+                            "source": "WORKSPACE",
+                            "warehouse_id": ""
+                          }
+                        ],
+                        "notification_settings": [],
+                        "pipeline_task": [],
+                        "power_bi_task": [],
+                        "python_operator_task": [],
+                        "python_wheel_task": [],
+                        "retry_on_timeout": false,
+                        "run_if": "",
+                        "run_job_task": [],
+                        "spark_jar_task": [],
+                        "spark_python_task": [],
+                        "spark_submit_task": [],
+                        "sql_task": [],
+                        "task_key": "inner",
+                        "timeout_seconds": 0,
+                        "webhook_notifications": []
+                      }
+                    ]
+                  }
+                ],
+                "gen_ai_compute_task": [],
+                "health": [],
+                "job_cluster_key": "",
+                "library": [],
+                "max_retries": 0,
+                "min_retry_interval_millis": 0,
+                "new_cluster": [],
+                "notebook_task": [],
+                "notification_settings": [],
+                "pipeline_task": [],
+                "power_bi_task": [],
+                "python_operator_task": [],
+                "python_wheel_task": [],
+                "retry_on_timeout": false,
+                "run_if": "ALL_SUCCESS",
+                "run_job_task": [],
+                "spark_jar_task": [],
+                "spark_python_task": [],
+                "spark_submit_task": [],
+                "sql_task": [],
+                "task_key": "main",
+                "timeout_seconds": 0,
+                "webhook_notifications": []
+              }
+            ],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790683811706225000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/job_apply_policy_default_values_job_cluster.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/job_apply_policy_default_values_job_cluster.yml.tmpl.requests.json
new file mode 100644
index 00000000000..154b46e8e2f
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/job_apply_policy_default_values_job_cluster.yml.tmpl.requests.json
@@ -0,0 +1,40 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "job_clusters": [
+        {
+          "job_cluster_key": "shared",
+          "new_cluster": {
+            "apply_policy_default_values": true,
+            "instance_pool_id": "0123-456789-pool0",
+            "num_workers": 1,
+            "spark_version": "13.3.x-snapshot-scala2.12"
+          }
+        }
+      ],
+      "max_concurrent_runs": 1,
+      "name": "test-job-[UNIQUE_NAME]",
+      "queue": {
+        "enabled": true
+      },
+      "tasks": [
+        {
+          "job_cluster_key": "shared",
+          "notebook_task": {
+            "notebook_path": "/Shared/notebook",
+            "source": "WORKSPACE"
+          },
+          "task_key": "only_task"
+        }
+      ]
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/job_apply_policy_default_values_job_cluster.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/job_apply_policy_default_values_job_cluster.yml.tmpl.tfstate
new file mode 100644
index 00000000000..a433a5407e9
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/job_apply_policy_default_values_job_cluster.yml.tmpl.tfstate
@@ -0,0 +1,218 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "dafc4b99-dc5b-0ff3-0cbe-5bce1e2a3738",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790683813642400000",
+            "job_cluster": [
+              {
+                "job_cluster_key": "shared",
+                "new_cluster": [
+                  {
+                    "__apply_policy_default_values_allow_list": null,
+                    "apply_policy_default_values": false,
+                    "autoscale": [],
+                    "aws_attributes": [],
+                    "azure_attributes": [],
+                    "cluster_id": "",
+                    "cluster_log_conf": [],
+                    "cluster_mount_info": [],
+                    "cluster_name": "",
+                    "custom_tags": null,
+                    "data_security_mode": "",
+                    "dependency_mode": "",
+                    "docker_image": [],
+                    "driver_instance_pool_id": "",
+                    "driver_node_type_flexibility": [],
+                    "driver_node_type_id": "",
+                    "enable_elastic_disk": false,
+                    "enable_local_disk_encryption": false,
+                    "gcp_attributes": [],
+                    "idempotency_token": "",
+                    "init_scripts": [],
+                    "instance_pool_id": "0123-456789-pool0",
+                    "is_single_node": false,
+                    "kind": "",
+                    "library": [],
+                    "node_type_id": "",
+                    "num_workers": 1,
+                    "policy_id": "",
+                    "provider_config": [],
+                    "remote_disk_throughput": 0,
+                    "runtime_engine": "",
+                    "single_user_name": "",
+                    "spark_conf": null,
+                    "spark_env_vars": null,
+                    "spark_version": "13.3.x-snapshot-scala2.12",
+                    "ssh_public_keys": null,
+                    "total_initial_remote_disk_size": 0,
+                    "use_ml_runtime": false,
+                    "worker_node_type_flexibility": [],
+                    "workload_type": []
+                  }
+                ],
+                "serverless_compute_id": ""
+              }
+            ],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "test-job-[UNIQUE_NAME]",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [
+              {
+                "ai_runtime_task": [],
+                "alert_task": [],
+                "clean_rooms_notebook_task": [],
+                "compute": [],
+                "condition_task": [],
+                "dashboard_task": [],
+                "dbt_cloud_task": [],
+                "dbt_platform_task": [],
+                "dbt_task": [],
+                "depends_on": [],
+                "description": "",
+                "disable_auto_optimization": false,
+                "disabled": false,
+                "email_notifications": [
+                  {
+                    "no_alert_for_skipped_runs": false,
+                    "on_duration_warning_threshold_exceeded": [],
+                    "on_failure": [],
+                    "on_start": [],
+                    "on_streaming_backlog_exceeded": [],
+                    "on_success": []
+                  }
+                ],
+                "environment_key": "",
+                "existing_cluster_id": "",
+                "for_each_task": [],
+                "gen_ai_compute_task": [],
+                "health": [],
+                "job_cluster_key": "shared",
+                "library": [],
+                "max_retries": 0,
+                "min_retry_interval_millis": 0,
+                "new_cluster": [],
+                "notebook_task": [
+                  {
+                    "base_parameters": null,
+                    "notebook_path": "/Shared/notebook",
+                    "source": "WORKSPACE",
+                    "warehouse_id": ""
+                  }
+                ],
+                "notification_settings": [],
+                "pipeline_task": [],
+                "power_bi_task": [],
+                "python_operator_task": [],
+                "python_wheel_task": [],
+                "retry_on_timeout": false,
+                "run_if": "ALL_SUCCESS",
+                "run_job_task": [],
+                "spark_jar_task": [],
+                "spark_python_task": [],
+                "spark_submit_task": [],
+                "sql_task": [],
+                "task_key": "only_task",
+                "timeout_seconds": 0,
+                "webhook_notifications": []
+              }
+            ],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790683813642400000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/job_apply_policy_default_values_task_cluster.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/job_apply_policy_default_values_task_cluster.yml.tmpl.requests.json
new file mode 100644
index 00000000000..5328b58cc54
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/job_apply_policy_default_values_task_cluster.yml.tmpl.requests.json
@@ -0,0 +1,34 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "test-job-[UNIQUE_NAME]",
+      "queue": {
+        "enabled": true
+      },
+      "tasks": [
+        {
+          "new_cluster": {
+            "apply_policy_default_values": true,
+            "instance_pool_id": "0123-456789-pool0",
+            "num_workers": 1,
+            "spark_version": "13.3.x-snapshot-scala2.12"
+          },
+          "notebook_task": {
+            "notebook_path": "/Shared/notebook",
+            "source": "WORKSPACE"
+          },
+          "task_key": "only_task"
+        }
+      ]
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/job_apply_policy_default_values_task_cluster.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/job_apply_policy_default_values_task_cluster.yml.tmpl.tfstate
new file mode 100644
index 00000000000..d15690a2211
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/job_apply_policy_default_values_task_cluster.yml.tmpl.tfstate
@@ -0,0 +1,225 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "367905ae-9a60-4c55-7a19-7459bf44ca79",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790683811366592000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "test-job-[UNIQUE_NAME]",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [
+              {
+                "ai_runtime_task": [],
+                "alert_task": [],
+                "clean_rooms_notebook_task": [],
+                "compute": [],
+                "condition_task": [],
+                "dashboard_task": [],
+                "dbt_cloud_task": [],
+                "dbt_platform_task": [],
+                "dbt_task": [],
+                "depends_on": [],
+                "description": "",
+                "disable_auto_optimization": false,
+                "disabled": false,
+                "email_notifications": [
+                  {
+                    "no_alert_for_skipped_runs": false,
+                    "on_duration_warning_threshold_exceeded": [],
+                    "on_failure": [],
+                    "on_start": [],
+                    "on_streaming_backlog_exceeded": [],
+                    "on_success": []
+                  }
+                ],
+                "environment_key": "",
+                "existing_cluster_id": "",
+                "for_each_task": [],
+                "gen_ai_compute_task": [],
+                "health": [],
+                "job_cluster_key": "",
+                "library": [],
+                "max_retries": 0,
+                "min_retry_interval_millis": 0,
+                "new_cluster": [
+                  {
+                    "__apply_policy_default_values_allow_list": null,
+                    "apply_policy_default_values": false,
+                    "autoscale": [],
+                    "aws_attributes": [
+                      {
+                        "availability": "SPOT_WITH_FALLBACK",
+                        "ebs_volume_count": 0,
+                        "ebs_volume_iops": 0,
+                        "ebs_volume_size": 0,
+                        "ebs_volume_throughput": 0,
+                        "ebs_volume_type": "",
+                        "first_on_demand": 0,
+                        "instance_profile_arn": "",
+                        "spot_bid_price_percent": 0,
+                        "zone_id": "us-east-1c"
+                      }
+                    ],
+                    "azure_attributes": [],
+                    "cluster_id": "",
+                    "cluster_log_conf": [],
+                    "cluster_mount_info": [],
+                    "cluster_name": "",
+                    "custom_tags": null,
+                    "data_security_mode": "SINGLE_USER",
+                    "dependency_mode": "",
+                    "docker_image": [],
+                    "driver_instance_pool_id": "",
+                    "driver_node_type_flexibility": [],
+                    "driver_node_type_id": "",
+                    "enable_elastic_disk": false,
+                    "enable_local_disk_encryption": false,
+                    "gcp_attributes": [],
+                    "idempotency_token": "",
+                    "init_scripts": [],
+                    "instance_pool_id": "0123-456789-pool0",
+                    "is_single_node": false,
+                    "kind": "",
+                    "library": [],
+                    "node_type_id": "",
+                    "num_workers": 1,
+                    "policy_id": "",
+                    "provider_config": [],
+                    "remote_disk_throughput": 0,
+                    "runtime_engine": "",
+                    "single_user_name": "",
+                    "spark_conf": null,
+                    "spark_env_vars": null,
+                    "spark_version": "13.3.x-snapshot-scala2.12",
+                    "ssh_public_keys": null,
+                    "total_initial_remote_disk_size": 0,
+                    "use_ml_runtime": false,
+                    "worker_node_type_flexibility": [],
+                    "workload_type": []
+                  }
+                ],
+                "notebook_task": [
+                  {
+                    "base_parameters": null,
+                    "notebook_path": "/Shared/notebook",
+                    "source": "WORKSPACE",
+                    "warehouse_id": ""
+                  }
+                ],
+                "notification_settings": [],
+                "pipeline_task": [],
+                "power_bi_task": [],
+                "python_operator_task": [],
+                "python_wheel_task": [],
+                "retry_on_timeout": false,
+                "run_if": "ALL_SUCCESS",
+                "run_job_task": [],
+                "spark_jar_task": [],
+                "spark_python_task": [],
+                "spark_submit_task": [],
+                "sql_task": [],
+                "task_key": "only_task",
+                "timeout_seconds": 0,
+                "webhook_notifications": []
+              }
+            ],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790683811366592000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/job_escaped_refs.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/job_escaped_refs.yml.tmpl.requests.json
new file mode 100644
index 00000000000..7faf9128ece
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/job_escaped_refs.yml.tmpl.requests.json
@@ -0,0 +1,42 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "test-job-[UNIQUE_NAME]",
+      "parameters": [
+        {
+          "default": "{{job.id}}",
+          "name": "batch_id"
+        },
+        {
+          "default": "{{job.start_time.iso_date}}",
+          "name": "business_date"
+        }
+      ],
+      "queue": {
+        "enabled": true
+      },
+      "tasks": [
+        {
+          "notebook_task": {
+            "base_parameters": {
+              "generic_config": "{\"source\": {\"path\": \"landing/${p_folder}/${source_file}_*.csv\"}, \"schema\": {\"columns\": [{\"name\": \"w_batch_id\", \"expression\": \"${batch_id}\"}, {\"name\": \"w_business_dt\", \"expression\": \"cast('${business_date[0..9]}' as date)\"}]}, \"target\": {\"table\": \"main.${p_env_stg}.${target_table}\"}}",
+              "parameters_list": "[{\"source_file\": \"TableA\", \"target_table\": \"table_a\", \"p_env_stg\": \"stg_example\", \"p_folder\": \"foldera\"}, {\"source_file\": \"TableB\", \"target_table\": \"table_b\", \"p_env_stg\": \"stg_example\", \"p_folder\": \"folderb\"}]"
+            },
+            "notebook_path": "/Shared/notebook",
+            "source": "WORKSPACE"
+          },
+          "task_key": "run_generic_ingestion"
+        }
+      ]
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/job_escaped_refs.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/job_escaped_refs.yml.tmpl.tfstate
new file mode 100644
index 00000000000..40e9b7f1c6e
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/job_escaped_refs.yml.tmpl.tfstate
@@ -0,0 +1,181 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "2ba1823d-438c-9104-9aec-14a945c48cbb",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "example_ingestion_job",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790683810914821000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "test-job-[UNIQUE_NAME]",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [
+              {
+                "default": "{{job.id}}",
+                "name": "batch_id"
+              },
+              {
+                "default": "{{job.start_time.iso_date}}",
+                "name": "business_date"
+              }
+            ],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [
+              {
+                "ai_runtime_task": [],
+                "alert_task": [],
+                "clean_rooms_notebook_task": [],
+                "compute": [],
+                "condition_task": [],
+                "dashboard_task": [],
+                "dbt_cloud_task": [],
+                "dbt_platform_task": [],
+                "dbt_task": [],
+                "depends_on": [],
+                "description": "",
+                "disable_auto_optimization": false,
+                "disabled": false,
+                "email_notifications": [
+                  {
+                    "no_alert_for_skipped_runs": false,
+                    "on_duration_warning_threshold_exceeded": [],
+                    "on_failure": [],
+                    "on_start": [],
+                    "on_streaming_backlog_exceeded": [],
+                    "on_success": []
+                  }
+                ],
+                "environment_key": "",
+                "existing_cluster_id": "",
+                "for_each_task": [],
+                "gen_ai_compute_task": [],
+                "health": [],
+                "job_cluster_key": "",
+                "library": [],
+                "max_retries": 0,
+                "min_retry_interval_millis": 0,
+                "new_cluster": [],
+                "notebook_task": [
+                  {
+                    "base_parameters": {
+                      "generic_config": "{\"source\": {\"path\": \"landing/${p_folder}/${source_file}_*.csv\"}, \"schema\": {\"columns\": [{\"name\": \"w_batch_id\", \"expression\": \"${batch_id}\"}, {\"name\": \"w_business_dt\", \"expression\": \"cast('${business_date[0..9]}' as date)\"}]}, \"target\": {\"table\": \"main.${p_env_stg}.${target_table}\"}}",
+                      "parameters_list": "[{\"source_file\": \"TableA\", \"target_table\": \"table_a\", \"p_env_stg\": \"stg_example\", \"p_folder\": \"foldera\"}, {\"source_file\": \"TableB\", \"target_table\": \"table_b\", \"p_env_stg\": \"stg_example\", \"p_folder\": \"folderb\"}]"
+                    },
+                    "notebook_path": "/Shared/notebook",
+                    "source": "WORKSPACE",
+                    "warehouse_id": ""
+                  }
+                ],
+                "notification_settings": [],
+                "pipeline_task": [],
+                "power_bi_task": [],
+                "python_operator_task": [],
+                "python_wheel_task": [],
+                "retry_on_timeout": false,
+                "run_if": "ALL_SUCCESS",
+                "run_job_task": [],
+                "spark_jar_task": [],
+                "spark_python_task": [],
+                "spark_submit_task": [],
+                "sql_task": [],
+                "task_key": "run_generic_ingestion",
+                "timeout_seconds": 0,
+                "webhook_notifications": []
+              }
+            ],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790683810914821000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/job_pydabs_10_tasks.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/job_pydabs_10_tasks.yml.tmpl.requests.json
new file mode 100644
index 00000000000..c9d8f0e6531
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/job_pydabs_10_tasks.yml.tmpl.requests.json
@@ -0,0 +1,111 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "job_clusters": [
+        {
+          "job_cluster_key": "main_cluster",
+          "new_cluster": {
+            "node_type_id": "i3.xlarge",
+            "num_workers": 1,
+            "spark_version": "13.3.x-snapshot-scala2.12"
+          }
+        }
+      ],
+      "max_concurrent_runs": 1,
+      "name": "test-job-[UNIQUE_NAME]",
+      "queue": {
+        "enabled": true
+      },
+      "tasks": [
+        {
+          "job_cluster_key": "main_cluster",
+          "notebook_task": {
+            "notebook_path": "/Shared/notebook",
+            "source": "WORKSPACE"
+          },
+          "task_key": "task_00"
+        },
+        {
+          "job_cluster_key": "main_cluster",
+          "notebook_task": {
+            "notebook_path": "/Shared/notebook",
+            "source": "WORKSPACE"
+          },
+          "task_key": "task_01"
+        },
+        {
+          "job_cluster_key": "main_cluster",
+          "notebook_task": {
+            "notebook_path": "/Shared/notebook",
+            "source": "WORKSPACE"
+          },
+          "task_key": "task_02"
+        },
+        {
+          "job_cluster_key": "main_cluster",
+          "notebook_task": {
+            "notebook_path": "/Shared/notebook",
+            "source": "WORKSPACE"
+          },
+          "task_key": "task_03"
+        },
+        {
+          "job_cluster_key": "main_cluster",
+          "notebook_task": {
+            "notebook_path": "/Shared/notebook",
+            "source": "WORKSPACE"
+          },
+          "task_key": "task_04"
+        },
+        {
+          "job_cluster_key": "main_cluster",
+          "notebook_task": {
+            "notebook_path": "/Shared/notebook",
+            "source": "WORKSPACE"
+          },
+          "task_key": "task_05"
+        },
+        {
+          "job_cluster_key": "main_cluster",
+          "notebook_task": {
+            "notebook_path": "/Shared/notebook",
+            "source": "WORKSPACE"
+          },
+          "task_key": "task_06"
+        },
+        {
+          "job_cluster_key": "main_cluster",
+          "notebook_task": {
+            "notebook_path": "/Shared/notebook",
+            "source": "WORKSPACE"
+          },
+          "task_key": "task_07"
+        },
+        {
+          "job_cluster_key": "main_cluster",
+          "notebook_task": {
+            "notebook_path": "/Shared/notebook",
+            "source": "WORKSPACE"
+          },
+          "task_key": "task_08"
+        },
+        {
+          "job_cluster_key": "main_cluster",
+          "notebook_task": {
+            "notebook_path": "/Shared/notebook",
+            "source": "WORKSPACE"
+          },
+          "task_key": "task_09"
+        }
+      ]
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/job_pydabs_10_tasks.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/job_pydabs_10_tasks.yml.tmpl.tfstate
new file mode 100644
index 00000000000..aa83b98bcfa
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/job_pydabs_10_tasks.yml.tmpl.tfstate
@@ -0,0 +1,740 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "aabfbb75-d2b3-18f8-03c2-29f02614b989",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790683810877116000",
+            "job_cluster": [
+              {
+                "job_cluster_key": "main_cluster",
+                "new_cluster": [
+                  {
+                    "__apply_policy_default_values_allow_list": null,
+                    "apply_policy_default_values": false,
+                    "autoscale": [],
+                    "aws_attributes": [],
+                    "azure_attributes": [],
+                    "cluster_id": "",
+                    "cluster_log_conf": [],
+                    "cluster_mount_info": [],
+                    "cluster_name": "",
+                    "custom_tags": null,
+                    "data_security_mode": "",
+                    "dependency_mode": "",
+                    "docker_image": [],
+                    "driver_instance_pool_id": "",
+                    "driver_node_type_flexibility": [],
+                    "driver_node_type_id": "",
+                    "enable_elastic_disk": false,
+                    "enable_local_disk_encryption": false,
+                    "gcp_attributes": [],
+                    "idempotency_token": "",
+                    "init_scripts": [],
+                    "instance_pool_id": "",
+                    "is_single_node": false,
+                    "kind": "",
+                    "library": [],
+                    "node_type_id": "i3.xlarge",
+                    "num_workers": 1,
+                    "policy_id": "",
+                    "provider_config": [],
+                    "remote_disk_throughput": 0,
+                    "runtime_engine": "",
+                    "single_user_name": "",
+                    "spark_conf": null,
+                    "spark_env_vars": null,
+                    "spark_version": "13.3.x-snapshot-scala2.12",
+                    "ssh_public_keys": null,
+                    "total_initial_remote_disk_size": 0,
+                    "use_ml_runtime": false,
+                    "worker_node_type_flexibility": [],
+                    "workload_type": []
+                  }
+                ],
+                "serverless_compute_id": ""
+              }
+            ],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "test-job-[UNIQUE_NAME]",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [
+              {
+                "ai_runtime_task": [],
+                "alert_task": [],
+                "clean_rooms_notebook_task": [],
+                "compute": [],
+                "condition_task": [],
+                "dashboard_task": [],
+                "dbt_cloud_task": [],
+                "dbt_platform_task": [],
+                "dbt_task": [],
+                "depends_on": [],
+                "description": "",
+                "disable_auto_optimization": false,
+                "disabled": false,
+                "email_notifications": [
+                  {
+                    "no_alert_for_skipped_runs": false,
+                    "on_duration_warning_threshold_exceeded": [],
+                    "on_failure": [],
+                    "on_start": [],
+                    "on_streaming_backlog_exceeded": [],
+                    "on_success": []
+                  }
+                ],
+                "environment_key": "",
+                "existing_cluster_id": "",
+                "for_each_task": [],
+                "gen_ai_compute_task": [],
+                "health": [],
+                "job_cluster_key": "main_cluster",
+                "library": [],
+                "max_retries": 0,
+                "min_retry_interval_millis": 0,
+                "new_cluster": [],
+                "notebook_task": [
+                  {
+                    "base_parameters": null,
+                    "notebook_path": "/Shared/notebook",
+                    "source": "WORKSPACE",
+                    "warehouse_id": ""
+                  }
+                ],
+                "notification_settings": [],
+                "pipeline_task": [],
+                "power_bi_task": [],
+                "python_operator_task": [],
+                "python_wheel_task": [],
+                "retry_on_timeout": false,
+                "run_if": "ALL_SUCCESS",
+                "run_job_task": [],
+                "spark_jar_task": [],
+                "spark_python_task": [],
+                "spark_submit_task": [],
+                "sql_task": [],
+                "task_key": "task_00",
+                "timeout_seconds": 0,
+                "webhook_notifications": []
+              },
+              {
+                "ai_runtime_task": [],
+                "alert_task": [],
+                "clean_rooms_notebook_task": [],
+                "compute": [],
+                "condition_task": [],
+                "dashboard_task": [],
+                "dbt_cloud_task": [],
+                "dbt_platform_task": [],
+                "dbt_task": [],
+                "depends_on": [],
+                "description": "",
+                "disable_auto_optimization": false,
+                "disabled": false,
+                "email_notifications": [
+                  {
+                    "no_alert_for_skipped_runs": false,
+                    "on_duration_warning_threshold_exceeded": [],
+                    "on_failure": [],
+                    "on_start": [],
+                    "on_streaming_backlog_exceeded": [],
+                    "on_success": []
+                  }
+                ],
+                "environment_key": "",
+                "existing_cluster_id": "",
+                "for_each_task": [],
+                "gen_ai_compute_task": [],
+                "health": [],
+                "job_cluster_key": "main_cluster",
+                "library": [],
+                "max_retries": 0,
+                "min_retry_interval_millis": 0,
+                "new_cluster": [],
+                "notebook_task": [
+                  {
+                    "base_parameters": null,
+                    "notebook_path": "/Shared/notebook",
+                    "source": "WORKSPACE",
+                    "warehouse_id": ""
+                  }
+                ],
+                "notification_settings": [],
+                "pipeline_task": [],
+                "power_bi_task": [],
+                "python_operator_task": [],
+                "python_wheel_task": [],
+                "retry_on_timeout": false,
+                "run_if": "ALL_SUCCESS",
+                "run_job_task": [],
+                "spark_jar_task": [],
+                "spark_python_task": [],
+                "spark_submit_task": [],
+                "sql_task": [],
+                "task_key": "task_01",
+                "timeout_seconds": 0,
+                "webhook_notifications": []
+              },
+              {
+                "ai_runtime_task": [],
+                "alert_task": [],
+                "clean_rooms_notebook_task": [],
+                "compute": [],
+                "condition_task": [],
+                "dashboard_task": [],
+                "dbt_cloud_task": [],
+                "dbt_platform_task": [],
+                "dbt_task": [],
+                "depends_on": [],
+                "description": "",
+                "disable_auto_optimization": false,
+                "disabled": false,
+                "email_notifications": [
+                  {
+                    "no_alert_for_skipped_runs": false,
+                    "on_duration_warning_threshold_exceeded": [],
+                    "on_failure": [],
+                    "on_start": [],
+                    "on_streaming_backlog_exceeded": [],
+                    "on_success": []
+                  }
+                ],
+                "environment_key": "",
+                "existing_cluster_id": "",
+                "for_each_task": [],
+                "gen_ai_compute_task": [],
+                "health": [],
+                "job_cluster_key": "main_cluster",
+                "library": [],
+                "max_retries": 0,
+                "min_retry_interval_millis": 0,
+                "new_cluster": [],
+                "notebook_task": [
+                  {
+                    "base_parameters": null,
+                    "notebook_path": "/Shared/notebook",
+                    "source": "WORKSPACE",
+                    "warehouse_id": ""
+                  }
+                ],
+                "notification_settings": [],
+                "pipeline_task": [],
+                "power_bi_task": [],
+                "python_operator_task": [],
+                "python_wheel_task": [],
+                "retry_on_timeout": false,
+                "run_if": "ALL_SUCCESS",
+                "run_job_task": [],
+                "spark_jar_task": [],
+                "spark_python_task": [],
+                "spark_submit_task": [],
+                "sql_task": [],
+                "task_key": "task_02",
+                "timeout_seconds": 0,
+                "webhook_notifications": []
+              },
+              {
+                "ai_runtime_task": [],
+                "alert_task": [],
+                "clean_rooms_notebook_task": [],
+                "compute": [],
+                "condition_task": [],
+                "dashboard_task": [],
+                "dbt_cloud_task": [],
+                "dbt_platform_task": [],
+                "dbt_task": [],
+                "depends_on": [],
+                "description": "",
+                "disable_auto_optimization": false,
+                "disabled": false,
+                "email_notifications": [
+                  {
+                    "no_alert_for_skipped_runs": false,
+                    "on_duration_warning_threshold_exceeded": [],
+                    "on_failure": [],
+                    "on_start": [],
+                    "on_streaming_backlog_exceeded": [],
+                    "on_success": []
+                  }
+                ],
+                "environment_key": "",
+                "existing_cluster_id": "",
+                "for_each_task": [],
+                "gen_ai_compute_task": [],
+                "health": [],
+                "job_cluster_key": "main_cluster",
+                "library": [],
+                "max_retries": 0,
+                "min_retry_interval_millis": 0,
+                "new_cluster": [],
+                "notebook_task": [
+                  {
+                    "base_parameters": null,
+                    "notebook_path": "/Shared/notebook",
+                    "source": "WORKSPACE",
+                    "warehouse_id": ""
+                  }
+                ],
+                "notification_settings": [],
+                "pipeline_task": [],
+                "power_bi_task": [],
+                "python_operator_task": [],
+                "python_wheel_task": [],
+                "retry_on_timeout": false,
+                "run_if": "ALL_SUCCESS",
+                "run_job_task": [],
+                "spark_jar_task": [],
+                "spark_python_task": [],
+                "spark_submit_task": [],
+                "sql_task": [],
+                "task_key": "task_03",
+                "timeout_seconds": 0,
+                "webhook_notifications": []
+              },
+              {
+                "ai_runtime_task": [],
+                "alert_task": [],
+                "clean_rooms_notebook_task": [],
+                "compute": [],
+                "condition_task": [],
+                "dashboard_task": [],
+                "dbt_cloud_task": [],
+                "dbt_platform_task": [],
+                "dbt_task": [],
+                "depends_on": [],
+                "description": "",
+                "disable_auto_optimization": false,
+                "disabled": false,
+                "email_notifications": [
+                  {
+                    "no_alert_for_skipped_runs": false,
+                    "on_duration_warning_threshold_exceeded": [],
+                    "on_failure": [],
+                    "on_start": [],
+                    "on_streaming_backlog_exceeded": [],
+                    "on_success": []
+                  }
+                ],
+                "environment_key": "",
+                "existing_cluster_id": "",
+                "for_each_task": [],
+                "gen_ai_compute_task": [],
+                "health": [],
+                "job_cluster_key": "main_cluster",
+                "library": [],
+                "max_retries": 0,
+                "min_retry_interval_millis": 0,
+                "new_cluster": [],
+                "notebook_task": [
+                  {
+                    "base_parameters": null,
+                    "notebook_path": "/Shared/notebook",
+                    "source": "WORKSPACE",
+                    "warehouse_id": ""
+                  }
+                ],
+                "notification_settings": [],
+                "pipeline_task": [],
+                "power_bi_task": [],
+                "python_operator_task": [],
+                "python_wheel_task": [],
+                "retry_on_timeout": false,
+                "run_if": "ALL_SUCCESS",
+                "run_job_task": [],
+                "spark_jar_task": [],
+                "spark_python_task": [],
+                "spark_submit_task": [],
+                "sql_task": [],
+                "task_key": "task_04",
+                "timeout_seconds": 0,
+                "webhook_notifications": []
+              },
+              {
+                "ai_runtime_task": [],
+                "alert_task": [],
+                "clean_rooms_notebook_task": [],
+                "compute": [],
+                "condition_task": [],
+                "dashboard_task": [],
+                "dbt_cloud_task": [],
+                "dbt_platform_task": [],
+                "dbt_task": [],
+                "depends_on": [],
+                "description": "",
+                "disable_auto_optimization": false,
+                "disabled": false,
+                "email_notifications": [
+                  {
+                    "no_alert_for_skipped_runs": false,
+                    "on_duration_warning_threshold_exceeded": [],
+                    "on_failure": [],
+                    "on_start": [],
+                    "on_streaming_backlog_exceeded": [],
+                    "on_success": []
+                  }
+                ],
+                "environment_key": "",
+                "existing_cluster_id": "",
+                "for_each_task": [],
+                "gen_ai_compute_task": [],
+                "health": [],
+                "job_cluster_key": "main_cluster",
+                "library": [],
+                "max_retries": 0,
+                "min_retry_interval_millis": 0,
+                "new_cluster": [],
+                "notebook_task": [
+                  {
+                    "base_parameters": null,
+                    "notebook_path": "/Shared/notebook",
+                    "source": "WORKSPACE",
+                    "warehouse_id": ""
+                  }
+                ],
+                "notification_settings": [],
+                "pipeline_task": [],
+                "power_bi_task": [],
+                "python_operator_task": [],
+                "python_wheel_task": [],
+                "retry_on_timeout": false,
+                "run_if": "ALL_SUCCESS",
+                "run_job_task": [],
+                "spark_jar_task": [],
+                "spark_python_task": [],
+                "spark_submit_task": [],
+                "sql_task": [],
+                "task_key": "task_05",
+                "timeout_seconds": 0,
+                "webhook_notifications": []
+              },
+              {
+                "ai_runtime_task": [],
+                "alert_task": [],
+                "clean_rooms_notebook_task": [],
+                "compute": [],
+                "condition_task": [],
+                "dashboard_task": [],
+                "dbt_cloud_task": [],
+                "dbt_platform_task": [],
+                "dbt_task": [],
+                "depends_on": [],
+                "description": "",
+                "disable_auto_optimization": false,
+                "disabled": false,
+                "email_notifications": [
+                  {
+                    "no_alert_for_skipped_runs": false,
+                    "on_duration_warning_threshold_exceeded": [],
+                    "on_failure": [],
+                    "on_start": [],
+                    "on_streaming_backlog_exceeded": [],
+                    "on_success": []
+                  }
+                ],
+                "environment_key": "",
+                "existing_cluster_id": "",
+                "for_each_task": [],
+                "gen_ai_compute_task": [],
+                "health": [],
+                "job_cluster_key": "main_cluster",
+                "library": [],
+                "max_retries": 0,
+                "min_retry_interval_millis": 0,
+                "new_cluster": [],
+                "notebook_task": [
+                  {
+                    "base_parameters": null,
+                    "notebook_path": "/Shared/notebook",
+                    "source": "WORKSPACE",
+                    "warehouse_id": ""
+                  }
+                ],
+                "notification_settings": [],
+                "pipeline_task": [],
+                "power_bi_task": [],
+                "python_operator_task": [],
+                "python_wheel_task": [],
+                "retry_on_timeout": false,
+                "run_if": "ALL_SUCCESS",
+                "run_job_task": [],
+                "spark_jar_task": [],
+                "spark_python_task": [],
+                "spark_submit_task": [],
+                "sql_task": [],
+                "task_key": "task_06",
+                "timeout_seconds": 0,
+                "webhook_notifications": []
+              },
+              {
+                "ai_runtime_task": [],
+                "alert_task": [],
+                "clean_rooms_notebook_task": [],
+                "compute": [],
+                "condition_task": [],
+                "dashboard_task": [],
+                "dbt_cloud_task": [],
+                "dbt_platform_task": [],
+                "dbt_task": [],
+                "depends_on": [],
+                "description": "",
+                "disable_auto_optimization": false,
+                "disabled": false,
+                "email_notifications": [
+                  {
+                    "no_alert_for_skipped_runs": false,
+                    "on_duration_warning_threshold_exceeded": [],
+                    "on_failure": [],
+                    "on_start": [],
+                    "on_streaming_backlog_exceeded": [],
+                    "on_success": []
+                  }
+                ],
+                "environment_key": "",
+                "existing_cluster_id": "",
+                "for_each_task": [],
+                "gen_ai_compute_task": [],
+                "health": [],
+                "job_cluster_key": "main_cluster",
+                "library": [],
+                "max_retries": 0,
+                "min_retry_interval_millis": 0,
+                "new_cluster": [],
+                "notebook_task": [
+                  {
+                    "base_parameters": null,
+                    "notebook_path": "/Shared/notebook",
+                    "source": "WORKSPACE",
+                    "warehouse_id": ""
+                  }
+                ],
+                "notification_settings": [],
+                "pipeline_task": [],
+                "power_bi_task": [],
+                "python_operator_task": [],
+                "python_wheel_task": [],
+                "retry_on_timeout": false,
+                "run_if": "ALL_SUCCESS",
+                "run_job_task": [],
+                "spark_jar_task": [],
+                "spark_python_task": [],
+                "spark_submit_task": [],
+                "sql_task": [],
+                "task_key": "task_07",
+                "timeout_seconds": 0,
+                "webhook_notifications": []
+              },
+              {
+                "ai_runtime_task": [],
+                "alert_task": [],
+                "clean_rooms_notebook_task": [],
+                "compute": [],
+                "condition_task": [],
+                "dashboard_task": [],
+                "dbt_cloud_task": [],
+                "dbt_platform_task": [],
+                "dbt_task": [],
+                "depends_on": [],
+                "description": "",
+                "disable_auto_optimization": false,
+                "disabled": false,
+                "email_notifications": [
+                  {
+                    "no_alert_for_skipped_runs": false,
+                    "on_duration_warning_threshold_exceeded": [],
+                    "on_failure": [],
+                    "on_start": [],
+                    "on_streaming_backlog_exceeded": [],
+                    "on_success": []
+                  }
+                ],
+                "environment_key": "",
+                "existing_cluster_id": "",
+                "for_each_task": [],
+                "gen_ai_compute_task": [],
+                "health": [],
+                "job_cluster_key": "main_cluster",
+                "library": [],
+                "max_retries": 0,
+                "min_retry_interval_millis": 0,
+                "new_cluster": [],
+                "notebook_task": [
+                  {
+                    "base_parameters": null,
+                    "notebook_path": "/Shared/notebook",
+                    "source": "WORKSPACE",
+                    "warehouse_id": ""
+                  }
+                ],
+                "notification_settings": [],
+                "pipeline_task": [],
+                "power_bi_task": [],
+                "python_operator_task": [],
+                "python_wheel_task": [],
+                "retry_on_timeout": false,
+                "run_if": "ALL_SUCCESS",
+                "run_job_task": [],
+                "spark_jar_task": [],
+                "spark_python_task": [],
+                "spark_submit_task": [],
+                "sql_task": [],
+                "task_key": "task_08",
+                "timeout_seconds": 0,
+                "webhook_notifications": []
+              },
+              {
+                "ai_runtime_task": [],
+                "alert_task": [],
+                "clean_rooms_notebook_task": [],
+                "compute": [],
+                "condition_task": [],
+                "dashboard_task": [],
+                "dbt_cloud_task": [],
+                "dbt_platform_task": [],
+                "dbt_task": [],
+                "depends_on": [],
+                "description": "",
+                "disable_auto_optimization": false,
+                "disabled": false,
+                "email_notifications": [
+                  {
+                    "no_alert_for_skipped_runs": false,
+                    "on_duration_warning_threshold_exceeded": [],
+                    "on_failure": [],
+                    "on_start": [],
+                    "on_streaming_backlog_exceeded": [],
+                    "on_success": []
+                  }
+                ],
+                "environment_key": "",
+                "existing_cluster_id": "",
+                "for_each_task": [],
+                "gen_ai_compute_task": [],
+                "health": [],
+                "job_cluster_key": "main_cluster",
+                "library": [],
+                "max_retries": 0,
+                "min_retry_interval_millis": 0,
+                "new_cluster": [],
+                "notebook_task": [
+                  {
+                    "base_parameters": null,
+                    "notebook_path": "/Shared/notebook",
+                    "source": "WORKSPACE",
+                    "warehouse_id": ""
+                  }
+                ],
+                "notification_settings": [],
+                "pipeline_task": [],
+                "power_bi_task": [],
+                "python_operator_task": [],
+                "python_wheel_task": [],
+                "retry_on_timeout": false,
+                "run_if": "ALL_SUCCESS",
+                "run_job_task": [],
+                "spark_jar_task": [],
+                "spark_python_task": [],
+                "spark_submit_task": [],
+                "sql_task": [],
+                "task_key": "task_09",
+                "timeout_seconds": 0,
+                "webhook_notifications": []
+              }
+            ],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790683810877116000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/job_run_job_ref.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/job_run_job_ref.yml.tmpl.requests.json
new file mode 100644
index 00000000000..d6bc097147f
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/job_run_job_ref.yml.tmpl.requests.json
@@ -0,0 +1,58 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 9007199254740993,
+      "name": "test-trigger-[UNIQUE_NAME]",
+      "queue": {
+        "enabled": true
+      },
+      "tasks": [
+        {
+          "new_cluster": {
+            "instance_pool_id": "0123-456789-pool0",
+            "num_workers": 1,
+            "spark_version": "13.3.x-snapshot-scala2.12"
+          },
+          "notebook_task": {
+            "notebook_path": "/Shared/notebook",
+            "source": "WORKSPACE"
+          },
+          "task_key": "notebook"
+        }
+      ]
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 9007199254740993,
+      "name": "test-watcher-[UNIQUE_NAME]",
+      "queue": {
+        "enabled": true
+      },
+      "tasks": [
+        {
+          "run_job_task": {
+            "job_id": 8790683808461328000
+          },
+          "task_key": "run_trigger"
+        }
+      ]
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/job_run_job_ref.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/job_run_job_ref.yml.tmpl.tfstate
new file mode 100644
index 00000000000..577ab1fad44
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/job_run_job_ref.yml.tmpl.tfstate
@@ -0,0 +1,393 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 3,
+  "lineage": "0fc48eb3-bab2-e4ef-2b2b-383139ed178c",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "trigger_job",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790683808461328000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 9007199254740993,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "test-trigger-[UNIQUE_NAME]",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [
+              {
+                "ai_runtime_task": [],
+                "alert_task": [],
+                "clean_rooms_notebook_task": [],
+                "compute": [],
+                "condition_task": [],
+                "dashboard_task": [],
+                "dbt_cloud_task": [],
+                "dbt_platform_task": [],
+                "dbt_task": [],
+                "depends_on": [],
+                "description": "",
+                "disable_auto_optimization": false,
+                "disabled": false,
+                "email_notifications": [
+                  {
+                    "no_alert_for_skipped_runs": false,
+                    "on_duration_warning_threshold_exceeded": [],
+                    "on_failure": [],
+                    "on_start": [],
+                    "on_streaming_backlog_exceeded": [],
+                    "on_success": []
+                  }
+                ],
+                "environment_key": "",
+                "existing_cluster_id": "",
+                "for_each_task": [],
+                "gen_ai_compute_task": [],
+                "health": [],
+                "job_cluster_key": "",
+                "library": [],
+                "max_retries": 0,
+                "min_retry_interval_millis": 0,
+                "new_cluster": [
+                  {
+                    "__apply_policy_default_values_allow_list": null,
+                    "apply_policy_default_values": false,
+                    "autoscale": [],
+                    "aws_attributes": [
+                      {
+                        "availability": "SPOT_WITH_FALLBACK",
+                        "ebs_volume_count": 0,
+                        "ebs_volume_iops": 0,
+                        "ebs_volume_size": 0,
+                        "ebs_volume_throughput": 0,
+                        "ebs_volume_type": "",
+                        "first_on_demand": 0,
+                        "instance_profile_arn": "",
+                        "spot_bid_price_percent": 0,
+                        "zone_id": "us-east-1c"
+                      }
+                    ],
+                    "azure_attributes": [],
+                    "cluster_id": "",
+                    "cluster_log_conf": [],
+                    "cluster_mount_info": [],
+                    "cluster_name": "",
+                    "custom_tags": null,
+                    "data_security_mode": "SINGLE_USER",
+                    "dependency_mode": "",
+                    "docker_image": [],
+                    "driver_instance_pool_id": "",
+                    "driver_node_type_flexibility": [],
+                    "driver_node_type_id": "",
+                    "enable_elastic_disk": false,
+                    "enable_local_disk_encryption": false,
+                    "gcp_attributes": [],
+                    "idempotency_token": "",
+                    "init_scripts": [],
+                    "instance_pool_id": "0123-456789-pool0",
+                    "is_single_node": false,
+                    "kind": "",
+                    "library": [],
+                    "node_type_id": "",
+                    "num_workers": 1,
+                    "policy_id": "",
+                    "provider_config": [],
+                    "remote_disk_throughput": 0,
+                    "runtime_engine": "",
+                    "single_user_name": "",
+                    "spark_conf": null,
+                    "spark_env_vars": null,
+                    "spark_version": "13.3.x-snapshot-scala2.12",
+                    "ssh_public_keys": null,
+                    "total_initial_remote_disk_size": 0,
+                    "use_ml_runtime": false,
+                    "worker_node_type_flexibility": [],
+                    "workload_type": []
+                  }
+                ],
+                "notebook_task": [
+                  {
+                    "base_parameters": null,
+                    "notebook_path": "/Shared/notebook",
+                    "source": "WORKSPACE",
+                    "warehouse_id": ""
+                  }
+                ],
+                "notification_settings": [],
+                "pipeline_task": [],
+                "power_bi_task": [],
+                "python_operator_task": [],
+                "python_wheel_task": [],
+                "retry_on_timeout": false,
+                "run_if": "ALL_SUCCESS",
+                "run_job_task": [],
+                "spark_jar_task": [],
+                "spark_python_task": [],
+                "spark_submit_task": [],
+                "sql_task": [],
+                "task_key": "notebook",
+                "timeout_seconds": 0,
+                "webhook_notifications": []
+              }
+            ],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790683808461328000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "watcher_job",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790683808512713000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 9007199254740993,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "test-watcher-[UNIQUE_NAME]",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [
+              {
+                "ai_runtime_task": [],
+                "alert_task": [],
+                "clean_rooms_notebook_task": [],
+                "compute": [],
+                "condition_task": [],
+                "dashboard_task": [],
+                "dbt_cloud_task": [],
+                "dbt_platform_task": [],
+                "dbt_task": [],
+                "depends_on": [],
+                "description": "",
+                "disable_auto_optimization": false,
+                "disabled": false,
+                "email_notifications": [
+                  {
+                    "no_alert_for_skipped_runs": false,
+                    "on_duration_warning_threshold_exceeded": [],
+                    "on_failure": [],
+                    "on_start": [],
+                    "on_streaming_backlog_exceeded": [],
+                    "on_success": []
+                  }
+                ],
+                "environment_key": "",
+                "existing_cluster_id": "",
+                "for_each_task": [],
+                "gen_ai_compute_task": [],
+                "health": [],
+                "job_cluster_key": "",
+                "library": [],
+                "max_retries": 0,
+                "min_retry_interval_millis": 0,
+                "new_cluster": [],
+                "notebook_task": [],
+                "notification_settings": [],
+                "pipeline_task": [],
+                "power_bi_task": [],
+                "python_operator_task": [],
+                "python_wheel_task": [],
+                "retry_on_timeout": false,
+                "run_if": "ALL_SUCCESS",
+                "run_job_task": [
+                  {
+                    "dbt_commands": null,
+                    "jar_params": null,
+                    "job_id": 8790683808461328000,
+                    "job_parameters": null,
+                    "notebook_params": null,
+                    "pipeline_params": [],
+                    "python_named_params": null,
+                    "python_params": null,
+                    "spark_submit_params": null,
+                    "sql_params": null
+                  }
+                ],
+                "spark_jar_task": [],
+                "spark_python_task": [],
+                "spark_submit_task": [],
+                "sql_task": [],
+                "task_key": "run_trigger",
+                "timeout_seconds": 0,
+                "webhook_notifications": []
+              }
+            ],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790683808512713000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ==",
+          "dependencies": [
+            "databricks_job.trigger_job"
+          ]
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/job_table_update_trigger.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/job_table_update_trigger.yml.tmpl.requests.json
new file mode 100644
index 00000000000..6591c94179e
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/job_table_update_trigger.yml.tmpl.requests.json
@@ -0,0 +1,29 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "test-job-[UNIQUE_NAME]",
+      "queue": {
+        "enabled": true
+      },
+      "trigger": {
+        "pause_status": "UNPAUSED",
+        "table_update": {
+          "condition": "ANY_UPDATED",
+          "table_names": [
+            "samples.nyctaxi.trips"
+          ],
+          "wait_after_last_change_seconds": 60
+        }
+      }
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/job_table_update_trigger.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/job_table_update_trigger.yml.tmpl.tfstate
new file mode 100644
index 00000000000..d8b6074f848
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/job_table_update_trigger.yml.tmpl.tfstate
@@ -0,0 +1,128 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "b14c35d0-1a76-3e1d-cec5-dea29a9c3750",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790683807727982000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "test-job-[UNIQUE_NAME]",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [
+              {
+                "file_arrival": [],
+                "model": [],
+                "pause_status": "UNPAUSED",
+                "periodic": [],
+                "sql_condition": [],
+                "table_update": [
+                  {
+                    "condition": "",
+                    "min_time_between_triggers_seconds": 0,
+                    "table_names": [
+                      "samples.nyctaxi.trips"
+                    ],
+                    "wait_after_last_change_seconds": 60
+                  }
+                ]
+              }
+            ],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790683807727982000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/job_with_depends_on.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/job_with_depends_on.yml.tmpl.requests.json
new file mode 100644
index 00000000000..df4ddbbbe7d
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/job_with_depends_on.yml.tmpl.requests.json
@@ -0,0 +1,55 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "test-job-[UNIQUE_NAME]",
+      "queue": {
+        "enabled": true
+      },
+      "tasks": [
+        {
+          "depends_on": [
+            {
+              "task_key": "main"
+            },
+            {
+              "task_key": "process"
+            }
+          ],
+          "notebook_task": {
+            "notebook_path": "/Shared/notebook",
+            "source": "WORKSPACE"
+          },
+          "task_key": "finalize"
+        },
+        {
+          "notebook_task": {
+            "notebook_path": "/Shared/notebook",
+            "source": "WORKSPACE"
+          },
+          "task_key": "main"
+        },
+        {
+          "depends_on": [
+            {
+              "task_key": "main"
+            }
+          ],
+          "notebook_task": {
+            "notebook_path": "/Shared/notebook",
+            "source": "WORKSPACE"
+          },
+          "task_key": "process"
+        }
+      ]
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/job_with_depends_on.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/job_with_depends_on.yml.tmpl.tfstate
new file mode 100644
index 00000000000..fdf95c2db51
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/job_with_depends_on.yml.tmpl.tfstate
@@ -0,0 +1,299 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "24ecd52c-2520-805f-cf08-4bbe1b796aec",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790683808820303000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "test-job-[UNIQUE_NAME]",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [
+              {
+                "ai_runtime_task": [],
+                "alert_task": [],
+                "clean_rooms_notebook_task": [],
+                "compute": [],
+                "condition_task": [],
+                "dashboard_task": [],
+                "dbt_cloud_task": [],
+                "dbt_platform_task": [],
+                "dbt_task": [],
+                "depends_on": [
+                  {
+                    "outcome": "",
+                    "task_key": "main"
+                  },
+                  {
+                    "outcome": "",
+                    "task_key": "process"
+                  }
+                ],
+                "description": "",
+                "disable_auto_optimization": false,
+                "disabled": false,
+                "email_notifications": [
+                  {
+                    "no_alert_for_skipped_runs": false,
+                    "on_duration_warning_threshold_exceeded": [],
+                    "on_failure": [],
+                    "on_start": [],
+                    "on_streaming_backlog_exceeded": [],
+                    "on_success": []
+                  }
+                ],
+                "environment_key": "",
+                "existing_cluster_id": "",
+                "for_each_task": [],
+                "gen_ai_compute_task": [],
+                "health": [],
+                "job_cluster_key": "",
+                "library": [],
+                "max_retries": 0,
+                "min_retry_interval_millis": 0,
+                "new_cluster": [],
+                "notebook_task": [
+                  {
+                    "base_parameters": null,
+                    "notebook_path": "/Shared/notebook",
+                    "source": "WORKSPACE",
+                    "warehouse_id": ""
+                  }
+                ],
+                "notification_settings": [],
+                "pipeline_task": [],
+                "power_bi_task": [],
+                "python_operator_task": [],
+                "python_wheel_task": [],
+                "retry_on_timeout": false,
+                "run_if": "ALL_SUCCESS",
+                "run_job_task": [],
+                "spark_jar_task": [],
+                "spark_python_task": [],
+                "spark_submit_task": [],
+                "sql_task": [],
+                "task_key": "finalize",
+                "timeout_seconds": 0,
+                "webhook_notifications": []
+              },
+              {
+                "ai_runtime_task": [],
+                "alert_task": [],
+                "clean_rooms_notebook_task": [],
+                "compute": [],
+                "condition_task": [],
+                "dashboard_task": [],
+                "dbt_cloud_task": [],
+                "dbt_platform_task": [],
+                "dbt_task": [],
+                "depends_on": [],
+                "description": "",
+                "disable_auto_optimization": false,
+                "disabled": false,
+                "email_notifications": [
+                  {
+                    "no_alert_for_skipped_runs": false,
+                    "on_duration_warning_threshold_exceeded": [],
+                    "on_failure": [],
+                    "on_start": [],
+                    "on_streaming_backlog_exceeded": [],
+                    "on_success": []
+                  }
+                ],
+                "environment_key": "",
+                "existing_cluster_id": "",
+                "for_each_task": [],
+                "gen_ai_compute_task": [],
+                "health": [],
+                "job_cluster_key": "",
+                "library": [],
+                "max_retries": 0,
+                "min_retry_interval_millis": 0,
+                "new_cluster": [],
+                "notebook_task": [
+                  {
+                    "base_parameters": null,
+                    "notebook_path": "/Shared/notebook",
+                    "source": "WORKSPACE",
+                    "warehouse_id": ""
+                  }
+                ],
+                "notification_settings": [],
+                "pipeline_task": [],
+                "power_bi_task": [],
+                "python_operator_task": [],
+                "python_wheel_task": [],
+                "retry_on_timeout": false,
+                "run_if": "ALL_SUCCESS",
+                "run_job_task": [],
+                "spark_jar_task": [],
+                "spark_python_task": [],
+                "spark_submit_task": [],
+                "sql_task": [],
+                "task_key": "main",
+                "timeout_seconds": 0,
+                "webhook_notifications": []
+              },
+              {
+                "ai_runtime_task": [],
+                "alert_task": [],
+                "clean_rooms_notebook_task": [],
+                "compute": [],
+                "condition_task": [],
+                "dashboard_task": [],
+                "dbt_cloud_task": [],
+                "dbt_platform_task": [],
+                "dbt_task": [],
+                "depends_on": [
+                  {
+                    "outcome": "",
+                    "task_key": "main"
+                  }
+                ],
+                "description": "",
+                "disable_auto_optimization": false,
+                "disabled": false,
+                "email_notifications": [
+                  {
+                    "no_alert_for_skipped_runs": false,
+                    "on_duration_warning_threshold_exceeded": [],
+                    "on_failure": [],
+                    "on_start": [],
+                    "on_streaming_backlog_exceeded": [],
+                    "on_success": []
+                  }
+                ],
+                "environment_key": "",
+                "existing_cluster_id": "",
+                "for_each_task": [],
+                "gen_ai_compute_task": [],
+                "health": [],
+                "job_cluster_key": "",
+                "library": [],
+                "max_retries": 0,
+                "min_retry_interval_millis": 0,
+                "new_cluster": [],
+                "notebook_task": [
+                  {
+                    "base_parameters": null,
+                    "notebook_path": "/Shared/notebook",
+                    "source": "WORKSPACE",
+                    "warehouse_id": ""
+                  }
+                ],
+                "notification_settings": [],
+                "pipeline_task": [],
+                "power_bi_task": [],
+                "python_operator_task": [],
+                "python_wheel_task": [],
+                "retry_on_timeout": false,
+                "run_if": "ALL_SUCCESS",
+                "run_job_task": [],
+                "spark_jar_task": [],
+                "spark_python_task": [],
+                "spark_submit_task": [],
+                "sql_task": [],
+                "task_key": "process",
+                "timeout_seconds": 0,
+                "webhook_notifications": []
+              }
+            ],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790683808820303000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/job_with_task.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/job_with_task.yml.tmpl.requests.json
new file mode 100644
index 00000000000..ad8ac571023
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/job_with_task.yml.tmpl.requests.json
@@ -0,0 +1,33 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "test-job-[UNIQUE_NAME]",
+      "queue": {
+        "enabled": true
+      },
+      "tasks": [
+        {
+          "new_cluster": {
+            "instance_pool_id": "0123-456789-pool0",
+            "num_workers": 1,
+            "spark_version": "13.3.x-snapshot-scala2.12"
+          },
+          "notebook_task": {
+            "notebook_path": "/Shared/notebook",
+            "source": "WORKSPACE"
+          },
+          "task_key": "only_task"
+        }
+      ]
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/job_with_task.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/job_with_task.yml.tmpl.tfstate
new file mode 100644
index 00000000000..73f70b1939c
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/job_with_task.yml.tmpl.tfstate
@@ -0,0 +1,225 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "d50c245f-ca67-6013-6456-e3689552b697",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790683807383678000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "test-job-[UNIQUE_NAME]",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [
+              {
+                "ai_runtime_task": [],
+                "alert_task": [],
+                "clean_rooms_notebook_task": [],
+                "compute": [],
+                "condition_task": [],
+                "dashboard_task": [],
+                "dbt_cloud_task": [],
+                "dbt_platform_task": [],
+                "dbt_task": [],
+                "depends_on": [],
+                "description": "",
+                "disable_auto_optimization": false,
+                "disabled": false,
+                "email_notifications": [
+                  {
+                    "no_alert_for_skipped_runs": false,
+                    "on_duration_warning_threshold_exceeded": [],
+                    "on_failure": [],
+                    "on_start": [],
+                    "on_streaming_backlog_exceeded": [],
+                    "on_success": []
+                  }
+                ],
+                "environment_key": "",
+                "existing_cluster_id": "",
+                "for_each_task": [],
+                "gen_ai_compute_task": [],
+                "health": [],
+                "job_cluster_key": "",
+                "library": [],
+                "max_retries": 0,
+                "min_retry_interval_millis": 0,
+                "new_cluster": [
+                  {
+                    "__apply_policy_default_values_allow_list": null,
+                    "apply_policy_default_values": false,
+                    "autoscale": [],
+                    "aws_attributes": [
+                      {
+                        "availability": "SPOT_WITH_FALLBACK",
+                        "ebs_volume_count": 0,
+                        "ebs_volume_iops": 0,
+                        "ebs_volume_size": 0,
+                        "ebs_volume_throughput": 0,
+                        "ebs_volume_type": "",
+                        "first_on_demand": 0,
+                        "instance_profile_arn": "",
+                        "spot_bid_price_percent": 0,
+                        "zone_id": "us-east-1c"
+                      }
+                    ],
+                    "azure_attributes": [],
+                    "cluster_id": "",
+                    "cluster_log_conf": [],
+                    "cluster_mount_info": [],
+                    "cluster_name": "",
+                    "custom_tags": null,
+                    "data_security_mode": "SINGLE_USER",
+                    "dependency_mode": "",
+                    "docker_image": [],
+                    "driver_instance_pool_id": "",
+                    "driver_node_type_flexibility": [],
+                    "driver_node_type_id": "",
+                    "enable_elastic_disk": false,
+                    "enable_local_disk_encryption": false,
+                    "gcp_attributes": [],
+                    "idempotency_token": "",
+                    "init_scripts": [],
+                    "instance_pool_id": "0123-456789-pool0",
+                    "is_single_node": false,
+                    "kind": "",
+                    "library": [],
+                    "node_type_id": "",
+                    "num_workers": 1,
+                    "policy_id": "",
+                    "provider_config": [],
+                    "remote_disk_throughput": 0,
+                    "runtime_engine": "",
+                    "single_user_name": "",
+                    "spark_conf": null,
+                    "spark_env_vars": null,
+                    "spark_version": "13.3.x-snapshot-scala2.12",
+                    "ssh_public_keys": null,
+                    "total_initial_remote_disk_size": 0,
+                    "use_ml_runtime": false,
+                    "worker_node_type_flexibility": [],
+                    "workload_type": []
+                  }
+                ],
+                "notebook_task": [
+                  {
+                    "base_parameters": null,
+                    "notebook_path": "/Shared/notebook",
+                    "source": "WORKSPACE",
+                    "warehouse_id": ""
+                  }
+                ],
+                "notification_settings": [],
+                "pipeline_task": [],
+                "power_bi_task": [],
+                "python_operator_task": [],
+                "python_wheel_task": [],
+                "retry_on_timeout": false,
+                "run_if": "ALL_SUCCESS",
+                "run_job_task": [],
+                "spark_jar_task": [],
+                "spark_python_task": [],
+                "spark_submit_task": [],
+                "sql_task": [],
+                "task_key": "only_task",
+                "timeout_seconds": 0,
+                "webhook_notifications": []
+              }
+            ],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790683807383678000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/model.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/model.yml.tmpl.requests.json
new file mode 100644
index 00000000000..66a50f88017
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/model.yml.tmpl.requests.json
@@ -0,0 +1,10 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.0/mlflow/registered-models/create",
+    "body": {
+      "description": "This is a test model",
+      "name": "test-model-[UNIQUE_NAME]"
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/model.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/model.yml.tmpl.tfstate
new file mode 100644
index 00000000000..7a3f7f419c2
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/model.yml.tmpl.tfstate
@@ -0,0 +1,35 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "d35ebbdd-0ed9-b36a-af84-14e97526f69c",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_mlflow_model",
+      "name": "foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "description": "This is a test model",
+            "id": "test-model-[UNIQUE_NAME]",
+            "name": "test-model-[UNIQUE_NAME]",
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "registered_model_id": "8790683806880546000",
+            "tags": []
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/model_serving_endpoint.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/model_serving_endpoint.yml.tmpl.requests.json
new file mode 100644
index 00000000000..db19f55e810
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/model_serving_endpoint.yml.tmpl.requests.json
@@ -0,0 +1,25 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.0/serving-endpoints",
+    "body": {
+      "name": "test-endpoint-[UNIQUE_NAME]"
+    }
+  },
+  {
+    "method": "PUT",
+    "path": "/api/2.0/permissions/serving-endpoints/79fec858-f9bb-2a68-79fe-c858f9bb2a69",
+    "body": {
+      "access_control_list": [
+        {
+          "group_name": "users",
+          "permission_level": "CAN_VIEW"
+        },
+        {
+          "permission_level": "CAN_MANAGE",
+          "user_name": "tester@databricks.com"
+        }
+      ]
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/model_serving_endpoint.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/model_serving_endpoint.yml.tmpl.tfstate
new file mode 100644
index 00000000000..a5c109b8cae
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/model_serving_endpoint.yml.tmpl.tfstate
@@ -0,0 +1,112 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 3,
+  "lineage": "b5978844-a483-2772-9d03-73c6c4620f0f",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_model_serving",
+      "name": "foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "ai_gateway": [],
+            "budget_policy_id": null,
+            "config": null,
+            "description": null,
+            "email_notifications": [],
+            "endpoint_url": "",
+            "id": "test-endpoint-[UNIQUE_NAME]",
+            "name": "test-endpoint-[UNIQUE_NAME]",
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "rate_limits": [],
+            "route_optimized": false,
+            "serving_endpoint_id": "79fec858-f9bb-2a68-79fe-c858f9bb2a69",
+            "tags": [],
+            "telemetry_config": [],
+            "timeouts": null
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoyNzAwMDAwMDAwMDAwLCJ1cGRhdGUiOjI3MDAwMDAwMDAwMDB9fQ=="
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_permissions",
+      "name": "model_serving_foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "access_control": [
+              {
+                "group_name": "",
+                "permission_level": "CAN_MANAGE",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              },
+              {
+                "group_name": "users",
+                "permission_level": "CAN_VIEW",
+                "service_principal_name": "",
+                "user_name": ""
+              }
+            ],
+            "alert_v2_id": null,
+            "app_name": null,
+            "authorization": null,
+            "cluster_id": null,
+            "cluster_policy_id": null,
+            "dashboard_id": null,
+            "database_instance_name": null,
+            "database_project_name": null,
+            "directory_id": null,
+            "directory_path": null,
+            "experiment_id": null,
+            "id": "/serving-endpoints/79fec858-f9bb-2a68-79fe-c858f9bb2a69",
+            "instance_pool_id": null,
+            "job_id": null,
+            "knowledge_assistant_id": null,
+            "notebook_id": null,
+            "notebook_path": null,
+            "object_type": "serving-endpoint",
+            "pipeline_id": null,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "registered_model_id": null,
+            "repo_id": null,
+            "repo_path": null,
+            "serving_endpoint_id": "79fec858-f9bb-2a68-79fe-c858f9bb2a69",
+            "sql_alert_id": null,
+            "sql_dashboard_id": null,
+            "sql_endpoint_id": null,
+            "sql_query_id": null,
+            "supervisor_agent_id": null,
+            "vector_search_endpoint_id": null,
+            "workspace_file_id": null,
+            "workspace_file_path": null
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "databricks_model_serving.foo"
+          ]
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/model_with_permissions.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/model_with_permissions.yml.tmpl.requests.json
new file mode 100644
index 00000000000..7143ce084bd
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/model_with_permissions.yml.tmpl.requests.json
@@ -0,0 +1,25 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.0/mlflow/registered-models/create",
+    "body": {
+      "name": "test-model-[UNIQUE_NAME]"
+    }
+  },
+  {
+    "method": "PUT",
+    "path": "/api/2.0/permissions/registered-models/8790683807422935000",
+    "body": {
+      "access_control_list": [
+        {
+          "group_name": "users",
+          "permission_level": "CAN_READ"
+        },
+        {
+          "permission_level": "CAN_MANAGE",
+          "user_name": "tester@databricks.com"
+        }
+      ]
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/model_with_permissions.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/model_with_permissions.yml.tmpl.tfstate
new file mode 100644
index 00000000000..7cd422dafa3
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/model_with_permissions.yml.tmpl.tfstate
@@ -0,0 +1,103 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 3,
+  "lineage": "291022a3-0aad-d7b4-10da-46ca5086d21f",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_mlflow_model",
+      "name": "foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "description": null,
+            "id": "test-model-[UNIQUE_NAME]",
+            "name": "test-model-[UNIQUE_NAME]",
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "registered_model_id": "8790683807422935000",
+            "tags": []
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA=="
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_permissions",
+      "name": "mlflow_model_foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "access_control": [
+              {
+                "group_name": "",
+                "permission_level": "CAN_MANAGE",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              },
+              {
+                "group_name": "users",
+                "permission_level": "CAN_READ",
+                "service_principal_name": "",
+                "user_name": ""
+              }
+            ],
+            "alert_v2_id": null,
+            "app_name": null,
+            "authorization": null,
+            "cluster_id": null,
+            "cluster_policy_id": null,
+            "dashboard_id": null,
+            "database_instance_name": null,
+            "database_project_name": null,
+            "directory_id": null,
+            "directory_path": null,
+            "experiment_id": null,
+            "id": "/registered-models/8790683807422935000",
+            "instance_pool_id": null,
+            "job_id": null,
+            "knowledge_assistant_id": null,
+            "notebook_id": null,
+            "notebook_path": null,
+            "object_type": "registered-model",
+            "pipeline_id": null,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "registered_model_id": "8790683807422935000",
+            "repo_id": null,
+            "repo_path": null,
+            "serving_endpoint_id": null,
+            "sql_alert_id": null,
+            "sql_dashboard_id": null,
+            "sql_endpoint_id": null,
+            "sql_query_id": null,
+            "supervisor_agent_id": null,
+            "vector_search_endpoint_id": null,
+            "workspace_file_id": null,
+            "workspace_file_path": null
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "databricks_mlflow_model.foo"
+          ]
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/pipeline.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/pipeline.yml.tmpl.requests.json
new file mode 100644
index 00000000000..b3d60e1f91a
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/pipeline.yml.tmpl.requests.json
@@ -0,0 +1,39 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.0/pipelines",
+    "body": {
+      "channel": "CURRENT",
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state/metadata.json"
+      },
+      "development": true,
+      "edition": "ADVANCED",
+      "libraries": [
+        {
+          "file": {
+            "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/files/pipeline.py"
+          }
+        }
+      ],
+      "name": "test-pipeline-[UNIQUE_NAME]"
+    }
+  },
+  {
+    "method": "PUT",
+    "path": "/api/2.0/permissions/pipelines/79fec858-df65-cd58-79fe-c858df65cd59",
+    "body": {
+      "access_control_list": [
+        {
+          "group_name": "users",
+          "permission_level": "CAN_VIEW"
+        },
+        {
+          "permission_level": "IS_OWNER",
+          "user_name": "tester@databricks.com"
+        }
+      ]
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/pipeline.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/pipeline.yml.tmpl.tfstate
new file mode 100644
index 00000000000..49efa4fe3e2
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/pipeline.yml.tmpl.tfstate
@@ -0,0 +1,160 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 3,
+  "lineage": "9e071283-85b7-3566-3602-5290fa3c8a8e",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_permissions",
+      "name": "pipeline_foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "access_control": [
+              {
+                "group_name": "",
+                "permission_level": "IS_OWNER",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              },
+              {
+                "group_name": "users",
+                "permission_level": "CAN_VIEW",
+                "service_principal_name": "",
+                "user_name": ""
+              }
+            ],
+            "alert_v2_id": null,
+            "app_name": null,
+            "authorization": null,
+            "cluster_id": null,
+            "cluster_policy_id": null,
+            "dashboard_id": null,
+            "database_instance_name": null,
+            "database_project_name": null,
+            "directory_id": null,
+            "directory_path": null,
+            "experiment_id": null,
+            "id": "/pipelines/79fec858-df65-cd58-79fe-c858df65cd59",
+            "instance_pool_id": null,
+            "job_id": null,
+            "knowledge_assistant_id": null,
+            "notebook_id": null,
+            "notebook_path": null,
+            "object_type": "pipelines",
+            "pipeline_id": "79fec858-df65-cd58-79fe-c858df65cd59",
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "registered_model_id": null,
+            "repo_id": null,
+            "repo_path": null,
+            "serving_endpoint_id": null,
+            "sql_alert_id": null,
+            "sql_dashboard_id": null,
+            "sql_endpoint_id": null,
+            "sql_query_id": null,
+            "supervisor_agent_id": null,
+            "vector_search_endpoint_id": null,
+            "workspace_file_id": null,
+            "workspace_file_path": null
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "databricks_pipeline.foo"
+          ]
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_pipeline",
+      "name": "foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "allow_duplicate_names": false,
+            "budget_policy_id": null,
+            "catalog": null,
+            "cause": null,
+            "channel": "CURRENT",
+            "cluster": [],
+            "cluster_id": null,
+            "configuration": null,
+            "continuous": false,
+            "creator_user_name": "tester@databricks.com",
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "development": true,
+            "edition": "ADVANCED",
+            "environment": [],
+            "event_log": [],
+            "expected_last_modified": 0,
+            "filters": [],
+            "gateway_definition": [],
+            "health": null,
+            "id": "79fec858-df65-cd58-79fe-c858df65cd59",
+            "ingestion_definition": [],
+            "last_modified": 1790683806704,
+            "latest_updates": null,
+            "library": [
+              {
+                "file": [
+                  {
+                    "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/files/pipeline.py"
+                  }
+                ],
+                "glob": [],
+                "jar": "",
+                "maven": [],
+                "notebook": [],
+                "whl": ""
+              }
+            ],
+            "name": "test-pipeline-[UNIQUE_NAME]",
+            "notification": [],
+            "photon": false,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "restart_window": [],
+            "root_path": null,
+            "run_as": [],
+            "run_as_user_name": "tester@databricks.com",
+            "schema": null,
+            "serverless": false,
+            "serverless_compute_id": null,
+            "state": "IDLE",
+            "storage": "dbfs:/pipelines/79fec858-df65-cd58-79fe-c858df65cd59",
+            "tags": null,
+            "target": null,
+            "timeouts": null,
+            "trigger": [],
+            "url": "[DATABRICKS_URL]/#joblist/pipelines/79fec858-df65-cd58-79fe-c858df65cd59",
+            "usage_policy_id": null
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxMjAwMDAwMDAwMDAwLCJkZWZhdWx0IjoxMjAwMDAwMDAwMDAwLCJkZWxldGUiOjEyMDAwMDAwMDAwMDAsInJlYWQiOjEyMDAwMDAwMDAwMDAsInVwZGF0ZSI6MTIwMDAwMDAwMDAwMH19"
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/pipeline_allow_duplicate_names.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/pipeline_allow_duplicate_names.yml.tmpl.requests.json
new file mode 100644
index 00000000000..59eb59fdb49
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/pipeline_allow_duplicate_names.yml.tmpl.requests.json
@@ -0,0 +1,23 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.0/pipelines",
+    "body": {
+      "allow_duplicate_names": true,
+      "channel": "CURRENT",
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state/metadata.json"
+      },
+      "edition": "ADVANCED",
+      "libraries": [
+        {
+          "file": {
+            "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/files/pipeline.py"
+          }
+        }
+      ],
+      "name": "test-pipeline-[UNIQUE_NAME]"
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/pipeline_allow_duplicate_names.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/pipeline_allow_duplicate_names.yml.tmpl.tfstate
new file mode 100644
index 00000000000..81c92480a8e
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/pipeline_allow_duplicate_names.yml.tmpl.tfstate
@@ -0,0 +1,92 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "d7c19d23-d983-aabf-6f78-ea388474a81b",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_pipeline",
+      "name": "foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "allow_duplicate_names": false,
+            "budget_policy_id": null,
+            "catalog": null,
+            "cause": null,
+            "channel": "CURRENT",
+            "cluster": [],
+            "cluster_id": null,
+            "configuration": null,
+            "continuous": false,
+            "creator_user_name": "tester@databricks.com",
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "development": false,
+            "edition": "ADVANCED",
+            "environment": [],
+            "event_log": [],
+            "expected_last_modified": 0,
+            "filters": [],
+            "gateway_definition": [],
+            "health": null,
+            "id": "79fec858-9e5f-0338-79fe-c8589e5f0339",
+            "ingestion_definition": [],
+            "last_modified": 1790683805613,
+            "latest_updates": null,
+            "library": [
+              {
+                "file": [
+                  {
+                    "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/files/pipeline.py"
+                  }
+                ],
+                "glob": [],
+                "jar": "",
+                "maven": [],
+                "notebook": [],
+                "whl": ""
+              }
+            ],
+            "name": "test-pipeline-[UNIQUE_NAME]",
+            "notification": [],
+            "photon": false,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "restart_window": [],
+            "root_path": null,
+            "run_as": [],
+            "run_as_user_name": "tester@databricks.com",
+            "schema": null,
+            "serverless": false,
+            "serverless_compute_id": null,
+            "state": "IDLE",
+            "storage": "dbfs:/pipelines/79fec858-9e5f-0338-79fe-c8589e5f0339",
+            "tags": null,
+            "target": null,
+            "timeouts": null,
+            "trigger": [],
+            "url": "[DATABRICKS_URL]/#joblist/pipelines/79fec858-9e5f-0338-79fe-c8589e5f0339",
+            "usage_policy_id": null
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxMjAwMDAwMDAwMDAwLCJkZWZhdWx0IjoxMjAwMDAwMDAwMDAwLCJkZWxldGUiOjEyMDAwMDAwMDAwMDAsInJlYWQiOjEyMDAwMDAwMDAwMDAsInVwZGF0ZSI6MTIwMDAwMDAwMDAwMH19"
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/pipeline_apply_policy_default_values.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/pipeline_apply_policy_default_values.yml.tmpl.requests.json
new file mode 100644
index 00000000000..a88c29d2816
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/pipeline_apply_policy_default_values.yml.tmpl.requests.json
@@ -0,0 +1,30 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.0/pipelines",
+    "body": {
+      "channel": "CURRENT",
+      "clusters": [
+        {
+          "apply_policy_default_values": true,
+          "label": "default",
+          "node_type_id": "i3.xlarge",
+          "num_workers": 1
+        }
+      ],
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state/metadata.json"
+      },
+      "edition": "ADVANCED",
+      "libraries": [
+        {
+          "file": {
+            "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/files/pipeline.py"
+          }
+        }
+      ],
+      "name": "test-pipeline-[UNIQUE_NAME]"
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/pipeline_apply_policy_default_values.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/pipeline_apply_policy_default_values.yml.tmpl.tfstate
new file mode 100644
index 00000000000..7be604a59b0
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/pipeline_apply_policy_default_values.yml.tmpl.tfstate
@@ -0,0 +1,114 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "50c6e599-0006-6180-96f7-899f670a1018",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_pipeline",
+      "name": "foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "allow_duplicate_names": false,
+            "budget_policy_id": null,
+            "catalog": null,
+            "cause": null,
+            "channel": "CURRENT",
+            "cluster": [
+              {
+                "apply_policy_default_values": true,
+                "autoscale": [],
+                "aws_attributes": [],
+                "azure_attributes": [],
+                "cluster_log_conf": [],
+                "custom_tags": null,
+                "driver_instance_pool_id": "",
+                "driver_node_type_id": "",
+                "enable_local_disk_encryption": false,
+                "gcp_attributes": [],
+                "init_scripts": [],
+                "instance_pool_id": "",
+                "label": "default",
+                "node_type_id": "i3.xlarge",
+                "num_workers": 1,
+                "policy_id": "",
+                "spark_conf": null,
+                "spark_env_vars": null,
+                "ssh_public_keys": null
+              }
+            ],
+            "cluster_id": null,
+            "configuration": null,
+            "continuous": false,
+            "creator_user_name": "tester@databricks.com",
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "development": false,
+            "edition": "ADVANCED",
+            "environment": [],
+            "event_log": [],
+            "expected_last_modified": 0,
+            "filters": [],
+            "gateway_definition": [],
+            "health": null,
+            "id": "79fec858-921e-9188-79fe-c858921e9570",
+            "ingestion_definition": [],
+            "last_modified": 1790683805407,
+            "latest_updates": null,
+            "library": [
+              {
+                "file": [
+                  {
+                    "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/files/pipeline.py"
+                  }
+                ],
+                "glob": [],
+                "jar": "",
+                "maven": [],
+                "notebook": [],
+                "whl": ""
+              }
+            ],
+            "name": "test-pipeline-[UNIQUE_NAME]",
+            "notification": [],
+            "photon": false,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "restart_window": [],
+            "root_path": null,
+            "run_as": [],
+            "run_as_user_name": "tester@databricks.com",
+            "schema": null,
+            "serverless": false,
+            "serverless_compute_id": null,
+            "state": "IDLE",
+            "storage": "dbfs:/pipelines/79fec858-921e-9188-79fe-c858921e9570",
+            "tags": null,
+            "target": null,
+            "timeouts": null,
+            "trigger": [],
+            "url": "[DATABRICKS_URL]/#joblist/pipelines/79fec858-921e-9188-79fe-c858921e9570",
+            "usage_policy_id": null
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxMjAwMDAwMDAwMDAwLCJkZWZhdWx0IjoxMjAwMDAwMDAwMDAwLCJkZWxldGUiOjEyMDAwMDAwMDAwMDAsInJlYWQiOjEyMDAwMDAwMDAwMDAsInVwZGF0ZSI6MTIwMDAwMDAwMDAwMH19"
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/pipeline_config_dots.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/pipeline_config_dots.yml.tmpl.requests.json
new file mode 100644
index 00000000000..479a5e4c5f2
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/pipeline_config_dots.yml.tmpl.requests.json
@@ -0,0 +1,34 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.1/unity-catalog/schemas",
+    "body": {
+      "catalog_name": "main",
+      "name": "test-schema-[UNIQUE_NAME]"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/pipelines",
+    "body": {
+      "channel": "CURRENT",
+      "configuration": {
+        "europris.azure.subscription": "test-sub-123",
+        "europris.swipe.egress_streaming_schema": "main.test-schema-[UNIQUE_NAME]"
+      },
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state/metadata.json"
+      },
+      "edition": "ADVANCED",
+      "libraries": [
+        {
+          "file": {
+            "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/files/pipeline.py"
+          }
+        }
+      ],
+      "name": "test-pipeline-[UNIQUE_NAME]"
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/pipeline_config_dots.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/pipeline_config_dots.yml.tmpl.tfstate
new file mode 100644
index 00000000000..9f5b262f731
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/pipeline_config_dots.yml.tmpl.tfstate
@@ -0,0 +1,129 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 3,
+  "lineage": "1b7987ec-9840-7c36-cba2-9c100dd969c4",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_pipeline",
+      "name": "my_pipeline",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "allow_duplicate_names": false,
+            "budget_policy_id": null,
+            "catalog": null,
+            "cause": null,
+            "channel": "CURRENT",
+            "cluster": [],
+            "cluster_id": null,
+            "configuration": {
+              "europris.azure.subscription": "test-sub-123",
+              "europris.swipe.egress_streaming_schema": "main.test-schema-[UNIQUE_NAME]"
+            },
+            "continuous": false,
+            "creator_user_name": "tester@databricks.com",
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "development": false,
+            "edition": "ADVANCED",
+            "environment": [],
+            "event_log": [],
+            "expected_last_modified": 0,
+            "filters": [],
+            "gateway_definition": [],
+            "health": null,
+            "id": "79fec858-cd4b-7e88-79fe-c858cd4b7e89",
+            "ingestion_definition": [],
+            "last_modified": 1790683806400,
+            "latest_updates": null,
+            "library": [
+              {
+                "file": [
+                  {
+                    "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/files/pipeline.py"
+                  }
+                ],
+                "glob": [],
+                "jar": "",
+                "maven": [],
+                "notebook": [],
+                "whl": ""
+              }
+            ],
+            "name": "test-pipeline-[UNIQUE_NAME]",
+            "notification": [],
+            "photon": false,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "restart_window": [],
+            "root_path": null,
+            "run_as": [],
+            "run_as_user_name": "tester@databricks.com",
+            "schema": null,
+            "serverless": false,
+            "serverless_compute_id": null,
+            "state": "IDLE",
+            "storage": "dbfs:/pipelines/79fec858-cd4b-7e88-79fe-c858cd4b7e89",
+            "tags": null,
+            "target": null,
+            "timeouts": null,
+            "trigger": [],
+            "url": "[DATABRICKS_URL]/#joblist/pipelines/79fec858-cd4b-7e88-79fe-c858cd4b7e89",
+            "usage_policy_id": null
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxMjAwMDAwMDAwMDAwLCJkZWZhdWx0IjoxMjAwMDAwMDAwMDAwLCJkZWxldGUiOjEyMDAwMDAwMDAwMDAsInJlYWQiOjEyMDAwMDAwMDAwMDAsInVwZGF0ZSI6MTIwMDAwMDAwMDAwMH19",
+          "dependencies": [
+            "databricks_schema.my_schema"
+          ]
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_schema",
+      "name": "my_schema",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "catalog_name": "main",
+            "comment": null,
+            "enable_predictive_optimization": "INHERIT",
+            "force_destroy": true,
+            "id": "main.test-schema-[UNIQUE_NAME]",
+            "metastore_id": "120efa64-9b68-46ba-be38-f319458430d2",
+            "name": "test-schema-[UNIQUE_NAME]",
+            "owner": "tester@databricks.com",
+            "properties": null,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "schema_id": "79fec858-cb3b-d480-79fe-c858cb3bd481",
+            "storage_root": null
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/postgres_branch.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/postgres_branch.yml.tmpl.requests.json
new file mode 100644
index 00000000000..96242a31dcf
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/postgres_branch.yml.tmpl.requests.json
@@ -0,0 +1,57 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/artifacts/.internal"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/files"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/files/app"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/postgres/projects",
+    "q": {
+      "project_id": "test-pg-project-[UNIQUE_NAME]"
+    },
+    "body": {
+      "project_id": "test-pg-project-[UNIQUE_NAME]",
+      "spec": {
+        "display_name": "Test Postgres Project"
+      }
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/postgres/projects/test-pg-project-[UNIQUE_NAME]/branches",
+    "q": {
+      "branch_id": "test-branch-[UNIQUE_NAME]"
+    },
+    "body": {
+      "branch_id": "test-branch-[UNIQUE_NAME]",
+      "parent": "projects/test-pg-project-[UNIQUE_NAME]",
+      "spec": {
+        "no_expiry": true
+      }
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/postgres_branch.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/postgres_branch.yml.tmpl.tfstate
new file mode 100644
index 00000000000..e096b847b1c
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/postgres_branch.yml.tmpl.tfstate
@@ -0,0 +1,122 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 3,
+  "lineage": "13b7b323-51db-77c0-0b39-7d17d5e0a704",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_postgres_branch",
+      "name": "foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "branch_id": "test-branch-[UNIQUE_NAME]",
+            "create_time": "2026-09-29T14:23:27Z",
+            "name": "projects/test-pg-project-[UNIQUE_NAME]/branches/test-branch-[UNIQUE_NAME]",
+            "parent": "projects/test-pg-project-[UNIQUE_NAME]",
+            "provider_config": {
+              "workspace_id": "900800700600"
+            },
+            "purge_on_delete": null,
+            "replace_existing": null,
+            "spec": {
+              "expire_time": null,
+              "is_protected": null,
+              "no_expiry": true,
+              "source_branch": null,
+              "source_branch_lsn": null,
+              "source_branch_time": null,
+              "source_snapshot": null,
+              "ttl": null
+            },
+            "status": {
+              "branch_id": "test-branch-[UNIQUE_NAME]",
+              "current_state": "READY",
+              "default": false,
+              "delete_time": null,
+              "expire_time": null,
+              "is_protected": false,
+              "logical_size_bytes": 0,
+              "pending_state": null,
+              "purge_time": null,
+              "source_branch": "projects/test-pg-project-[UNIQUE_NAME]/branches/production",
+              "source_branch_lsn": "0/0",
+              "source_branch_time": "2026-09-29T14:23:27Z",
+              "source_snapshot": null,
+              "state_change_time": "2026-09-29T14:23:27Z"
+            },
+            "uid": "br-79fecf9f-d047-c120-7",
+            "update_time": "2026-09-29T14:23:27Z"
+          },
+          "sensitive_attributes": [],
+          "dependencies": [
+            "databricks_postgres_project.project"
+          ]
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_postgres_project",
+      "name": "project",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "create_time": "2026-09-29T14:23:27Z",
+            "delete_time": null,
+            "initial_branch_spec": null,
+            "initial_endpoint_spec": null,
+            "name": "projects/test-pg-project-[UNIQUE_NAME]",
+            "project_id": "test-pg-project-[UNIQUE_NAME]",
+            "provider_config": {
+              "workspace_id": "900800700600"
+            },
+            "purge_on_delete": null,
+            "purge_time": null,
+            "spec": {
+              "budget_policy_id": null,
+              "custom_tags": null,
+              "default_branch": null,
+              "default_endpoint_settings": null,
+              "display_name": "Test Postgres Project",
+              "enable_pg_native_login": null,
+              "history_retention_duration": null,
+              "pg_version": null
+            },
+            "status": {
+              "branch_logical_size_limit_bytes": 8796093022208,
+              "budget_policy_id": null,
+              "compute_last_active_time": null,
+              "custom_tags": null,
+              "default_branch": "projects/test-pg-project-[UNIQUE_NAME]/branches/production",
+              "default_endpoint_settings": {
+                "autoscaling_limit_max_cu": 1,
+                "autoscaling_limit_min_cu": 1,
+                "no_suspension": null,
+                "pg_settings": null,
+                "suspend_timeout_duration": "24h0m0s"
+              },
+              "display_name": "Test Postgres Project",
+              "enable_pg_native_login": false,
+              "history_retention_duration": "168h0m0s",
+              "owner": "tester@databricks.com",
+              "pg_version": null,
+              "project_id": "test-pg-project-[UNIQUE_NAME]",
+              "synthetic_storage_size_bytes": 0
+            },
+            "uid": "79fecf9f-ce85-19f0-79fe-cf9fce8519f1",
+            "update_time": "2026-09-29T14:23:27Z"
+          },
+          "sensitive_attributes": []
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/postgres_catalog.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/postgres_catalog.yml.tmpl.requests.json
new file mode 100644
index 00000000000..ff6b635e014
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/postgres_catalog.yml.tmpl.requests.json
@@ -0,0 +1,58 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/artifacts/.internal"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/files"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/files/app"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/postgres/projects",
+    "q": {
+      "project_id": "test-pg-project-[UNIQUE_NAME]"
+    },
+    "body": {
+      "project_id": "test-pg-project-[UNIQUE_NAME]",
+      "spec": {
+        "display_name": "Test Postgres Project"
+      }
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/postgres/catalogs",
+    "q": {
+      "catalog_id": "test_pg_catalog_[UNIQUE_NAME]"
+    },
+    "body": {
+      "catalog_id": "test_pg_catalog_[UNIQUE_NAME]",
+      "spec": {
+        "branch": "projects/test-pg-project-[UNIQUE_NAME]/branches/production",
+        "create_database_if_missing": true,
+        "postgres_database": "appdb"
+      }
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/postgres_catalog.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/postgres_catalog.yml.tmpl.tfstate
new file mode 100644
index 00000000000..feaba02e74b
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/postgres_catalog.yml.tmpl.tfstate
@@ -0,0 +1,103 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 3,
+  "lineage": "6a189914-84c5-ca44-663b-760142313aaf",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_postgres_catalog",
+      "name": "catalog",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "catalog_id": "test_pg_catalog_[UNIQUE_NAME]",
+            "create_time": "2026-09-29T14:23:29Z",
+            "name": "catalogs/test_pg_catalog_[UNIQUE_NAME]",
+            "provider_config": {
+              "workspace_id": "900800700600"
+            },
+            "spec": {
+              "branch": "projects/test-pg-project-[UNIQUE_NAME]/branches/production",
+              "create_database_if_missing": true,
+              "postgres_database": "appdb"
+            },
+            "status": {
+              "branch": "projects/test-pg-project-[UNIQUE_NAME]/branches/production",
+              "postgres_database": "appdb",
+              "project": "projects/test-pg-project-[UNIQUE_NAME]"
+            },
+            "uid": "79fecfa0-31c0-a688-79fe-cfa031c0a689",
+            "update_time": "2026-09-29T14:23:29Z"
+          },
+          "sensitive_attributes": [],
+          "dependencies": [
+            "databricks_postgres_project.project"
+          ]
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_postgres_project",
+      "name": "project",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "create_time": "2026-09-29T14:23:29Z",
+            "delete_time": null,
+            "initial_branch_spec": null,
+            "initial_endpoint_spec": null,
+            "name": "projects/test-pg-project-[UNIQUE_NAME]",
+            "project_id": "test-pg-project-[UNIQUE_NAME]",
+            "provider_config": {
+              "workspace_id": "900800700600"
+            },
+            "purge_on_delete": null,
+            "purge_time": null,
+            "spec": {
+              "budget_policy_id": null,
+              "custom_tags": null,
+              "default_branch": null,
+              "default_endpoint_settings": null,
+              "display_name": "Test Postgres Project",
+              "enable_pg_native_login": null,
+              "history_retention_duration": null,
+              "pg_version": null
+            },
+            "status": {
+              "branch_logical_size_limit_bytes": 8796093022208,
+              "budget_policy_id": null,
+              "compute_last_active_time": null,
+              "custom_tags": null,
+              "default_branch": "projects/test-pg-project-[UNIQUE_NAME]/branches/production",
+              "default_endpoint_settings": {
+                "autoscaling_limit_max_cu": 1,
+                "autoscaling_limit_min_cu": 1,
+                "no_suspension": null,
+                "pg_settings": null,
+                "suspend_timeout_duration": "24h0m0s"
+              },
+              "display_name": "Test Postgres Project",
+              "enable_pg_native_login": false,
+              "history_retention_duration": "168h0m0s",
+              "owner": "tester@databricks.com",
+              "pg_version": null,
+              "project_id": "test-pg-project-[UNIQUE_NAME]",
+              "synthetic_storage_size_bytes": 0
+            },
+            "uid": "79fecfa0-3127-5c58-79fe-cfa031275c59",
+            "update_time": "2026-09-29T14:23:29Z"
+          },
+          "sensitive_attributes": []
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/postgres_database.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/postgres_database.yml.tmpl.requests.json
new file mode 100644
index 00000000000..3ffb85f99e6
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/postgres_database.yml.tmpl.requests.json
@@ -0,0 +1,86 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/artifacts/.internal"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/files"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/files/app"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/postgres/projects",
+    "q": {
+      "project_id": "test-pg-project-[UNIQUE_NAME]"
+    },
+    "body": {
+      "project_id": "test-pg-project-[UNIQUE_NAME]",
+      "spec": {
+        "display_name": "Test Postgres Project"
+      }
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/postgres/projects/test-pg-project-[UNIQUE_NAME]/branches",
+    "q": {
+      "branch_id": "test-branch-[UNIQUE_NAME]"
+    },
+    "body": {
+      "branch_id": "test-branch-[UNIQUE_NAME]",
+      "parent": "projects/test-pg-project-[UNIQUE_NAME]",
+      "spec": {
+        "no_expiry": true
+      }
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/postgres/projects/test-pg-project-[UNIQUE_NAME]/branches/test-branch-[UNIQUE_NAME]/roles",
+    "q": {
+      "role_id": "test-role-[UNIQUE_NAME]"
+    },
+    "body": {
+      "parent": "projects/test-pg-project-[UNIQUE_NAME]/branches/test-branch-[UNIQUE_NAME]",
+      "role_id": "test-role-[UNIQUE_NAME]",
+      "spec": {
+        "postgres_role": "app_role"
+      }
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/postgres/projects/test-pg-project-[UNIQUE_NAME]/branches/test-branch-[UNIQUE_NAME]/databases",
+    "q": {
+      "database_id": "test-database-[UNIQUE_NAME]"
+    },
+    "body": {
+      "database_id": "test-database-[UNIQUE_NAME]",
+      "parent": "projects/test-pg-project-[UNIQUE_NAME]/branches/test-branch-[UNIQUE_NAME]",
+      "spec": {
+        "postgres_database": "app_db",
+        "role": "projects/test-pg-project-[UNIQUE_NAME]/branches/test-branch-[UNIQUE_NAME]/roles/test-role-[UNIQUE_NAME]"
+      }
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/postgres_database.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/postgres_database.yml.tmpl.tfstate
new file mode 100644
index 00000000000..76c36f7535d
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/postgres_database.yml.tmpl.tfstate
@@ -0,0 +1,205 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 5,
+  "lineage": "fbef0ade-832b-374f-71b3-fd546603343a",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_postgres_branch",
+      "name": "branch",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "branch_id": "test-branch-[UNIQUE_NAME]",
+            "create_time": "2026-09-29T14:23:28Z",
+            "name": "projects/test-pg-project-[UNIQUE_NAME]/branches/test-branch-[UNIQUE_NAME]",
+            "parent": "projects/test-pg-project-[UNIQUE_NAME]",
+            "provider_config": {
+              "workspace_id": "900800700600"
+            },
+            "purge_on_delete": null,
+            "replace_existing": null,
+            "spec": {
+              "expire_time": null,
+              "is_protected": null,
+              "no_expiry": true,
+              "source_branch": null,
+              "source_branch_lsn": null,
+              "source_branch_time": null,
+              "source_snapshot": null,
+              "ttl": null
+            },
+            "status": {
+              "branch_id": "test-branch-[UNIQUE_NAME]",
+              "current_state": "READY",
+              "default": false,
+              "delete_time": null,
+              "expire_time": null,
+              "is_protected": false,
+              "logical_size_bytes": 0,
+              "pending_state": null,
+              "purge_time": null,
+              "source_branch": "projects/test-pg-project-[UNIQUE_NAME]/branches/production",
+              "source_branch_lsn": "0/0",
+              "source_branch_time": "2026-09-29T14:23:28Z",
+              "source_snapshot": null,
+              "state_change_time": "2026-09-29T14:23:28Z"
+            },
+            "uid": "br-79fecf9f-f93d-4de8-7",
+            "update_time": "2026-09-29T14:23:28Z"
+          },
+          "sensitive_attributes": [],
+          "dependencies": [
+            "databricks_postgres_project.project"
+          ]
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_postgres_database",
+      "name": "foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "create_time": "2026-09-29T14:23:28Z",
+            "database_id": "test-database-[UNIQUE_NAME]",
+            "name": "projects/test-pg-project-[UNIQUE_NAME]/branches/test-branch-[UNIQUE_NAME]/databases/test-database-[UNIQUE_NAME]",
+            "parent": "projects/test-pg-project-[UNIQUE_NAME]/branches/test-branch-[UNIQUE_NAME]",
+            "provider_config": {
+              "workspace_id": "900800700600"
+            },
+            "replace_existing": null,
+            "spec": {
+              "postgres_database": "app_db",
+              "role": "projects/test-pg-project-[UNIQUE_NAME]/branches/test-branch-[UNIQUE_NAME]/roles/test-role-[UNIQUE_NAME]"
+            },
+            "status": {
+              "database_id": "test-database-[UNIQUE_NAME]",
+              "postgres_database": "app_db",
+              "role": "projects/test-pg-project-[UNIQUE_NAME]/branches/test-branch-[UNIQUE_NAME]/roles/test-role-[UNIQUE_NAME]"
+            },
+            "update_time": "2026-09-29T14:23:28Z"
+          },
+          "sensitive_attributes": [],
+          "dependencies": [
+            "databricks_postgres_branch.branch",
+            "databricks_postgres_project.project",
+            "databricks_postgres_role.owner"
+          ]
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_postgres_project",
+      "name": "project",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "create_time": "2026-09-29T14:23:28Z",
+            "delete_time": null,
+            "initial_branch_spec": null,
+            "initial_endpoint_spec": null,
+            "name": "projects/test-pg-project-[UNIQUE_NAME]",
+            "project_id": "test-pg-project-[UNIQUE_NAME]",
+            "provider_config": {
+              "workspace_id": "900800700600"
+            },
+            "purge_on_delete": null,
+            "purge_time": null,
+            "spec": {
+              "budget_policy_id": null,
+              "custom_tags": null,
+              "default_branch": null,
+              "default_endpoint_settings": null,
+              "display_name": "Test Postgres Project",
+              "enable_pg_native_login": null,
+              "history_retention_duration": null,
+              "pg_version": null
+            },
+            "status": {
+              "branch_logical_size_limit_bytes": 8796093022208,
+              "budget_policy_id": null,
+              "compute_last_active_time": null,
+              "custom_tags": null,
+              "default_branch": "projects/test-pg-project-[UNIQUE_NAME]/branches/production",
+              "default_endpoint_settings": {
+                "autoscaling_limit_max_cu": 1,
+                "autoscaling_limit_min_cu": 1,
+                "no_suspension": null,
+                "pg_settings": null,
+                "suspend_timeout_duration": "24h0m0s"
+              },
+              "display_name": "Test Postgres Project",
+              "enable_pg_native_login": false,
+              "history_retention_duration": "168h0m0s",
+              "owner": "tester@databricks.com",
+              "pg_version": null,
+              "project_id": "test-pg-project-[UNIQUE_NAME]",
+              "synthetic_storage_size_bytes": 0
+            },
+            "uid": "79fecf9f-f860-0190-79fe-cf9ff8600191",
+            "update_time": "2026-09-29T14:23:28Z"
+          },
+          "sensitive_attributes": []
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_postgres_role",
+      "name": "owner",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "create_time": "2026-09-29T14:23:28Z",
+            "name": "projects/test-pg-project-[UNIQUE_NAME]/branches/test-branch-[UNIQUE_NAME]/roles/test-role-[UNIQUE_NAME]",
+            "parent": "projects/test-pg-project-[UNIQUE_NAME]/branches/test-branch-[UNIQUE_NAME]",
+            "provider_config": {
+              "workspace_id": "900800700600"
+            },
+            "replace_existing": null,
+            "role_id": "test-role-[UNIQUE_NAME]",
+            "spec": {
+              "attributes": null,
+              "auth_method": null,
+              "identity_type": null,
+              "membership_roles": null,
+              "postgres_role": "app_role"
+            },
+            "status": {
+              "attributes": {
+                "bypassrls": false,
+                "createdb": false,
+                "createrole": false
+              },
+              "auth_method": "PG_PASSWORD_SCRAM_SHA_256",
+              "identity_type": "IDENTITY_TYPE_UNSPECIFIED",
+              "membership_roles": null,
+              "postgres_role": "app_role",
+              "role_id": "test-role-[UNIQUE_NAME]"
+            },
+            "update_time": "2026-09-29T14:23:28Z"
+          },
+          "sensitive_attributes": [],
+          "dependencies": [
+            "databricks_postgres_branch.branch",
+            "databricks_postgres_project.project"
+          ]
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/postgres_endpoint.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/postgres_endpoint.yml.tmpl.requests.json
new file mode 100644
index 00000000000..3d2ea7f0d73
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/postgres_endpoint.yml.tmpl.requests.json
@@ -0,0 +1,74 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/artifacts/.internal"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/files"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/files/app"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/postgres/projects",
+    "q": {
+      "project_id": "test-pg-project-[UNIQUE_NAME]"
+    },
+    "body": {
+      "project_id": "test-pg-project-[UNIQUE_NAME]",
+      "spec": {
+        "display_name": "Test Postgres Project"
+      }
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/postgres/projects/test-pg-project-[UNIQUE_NAME]/branches",
+    "q": {
+      "branch_id": "test-branch-[UNIQUE_NAME]"
+    },
+    "body": {
+      "branch_id": "test-branch-[UNIQUE_NAME]",
+      "parent": "projects/test-pg-project-[UNIQUE_NAME]",
+      "spec": {
+        "no_expiry": true
+      }
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/postgres/projects/test-pg-project-[UNIQUE_NAME]/branches/test-branch-[UNIQUE_NAME]/endpoints",
+    "q": {
+      "endpoint_id": "test-endpoint-[UNIQUE_NAME]"
+    },
+    "body": {
+      "endpoint_id": "test-endpoint-[UNIQUE_NAME]",
+      "parent": "projects/test-pg-project-[UNIQUE_NAME]/branches/test-branch-[UNIQUE_NAME]",
+      "spec": {
+        "autoscaling_limit_max_cu": 4,
+        "autoscaling_limit_min_cu": 1,
+        "disabled": true,
+        "endpoint_type": "ENDPOINT_TYPE_READ_WRITE"
+      }
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/postgres_endpoint.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/postgres_endpoint.yml.tmpl.tfstate
new file mode 100644
index 00000000000..f2612af9628
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/postgres_endpoint.yml.tmpl.tfstate
@@ -0,0 +1,185 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 4,
+  "lineage": "8ff55749-e1d9-e463-8cb1-79b836487daf",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_postgres_branch",
+      "name": "branch",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "branch_id": "test-branch-[UNIQUE_NAME]",
+            "create_time": "2026-09-29T14:23:27Z",
+            "name": "projects/test-pg-project-[UNIQUE_NAME]/branches/test-branch-[UNIQUE_NAME]",
+            "parent": "projects/test-pg-project-[UNIQUE_NAME]",
+            "provider_config": {
+              "workspace_id": "900800700600"
+            },
+            "purge_on_delete": null,
+            "replace_existing": null,
+            "spec": {
+              "expire_time": null,
+              "is_protected": null,
+              "no_expiry": true,
+              "source_branch": null,
+              "source_branch_lsn": null,
+              "source_branch_time": null,
+              "source_snapshot": null,
+              "ttl": null
+            },
+            "status": {
+              "branch_id": "test-branch-[UNIQUE_NAME]",
+              "current_state": "READY",
+              "default": false,
+              "delete_time": null,
+              "expire_time": null,
+              "is_protected": false,
+              "logical_size_bytes": 0,
+              "pending_state": null,
+              "purge_time": null,
+              "source_branch": "projects/test-pg-project-[UNIQUE_NAME]/branches/production",
+              "source_branch_lsn": "0/0",
+              "source_branch_time": "2026-09-29T14:23:27Z",
+              "source_snapshot": null,
+              "state_change_time": "2026-09-29T14:23:27Z"
+            },
+            "uid": "br-79fecf9f-d04c-87c8-7",
+            "update_time": "2026-09-29T14:23:27Z"
+          },
+          "sensitive_attributes": [],
+          "dependencies": [
+            "databricks_postgres_project.project"
+          ]
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_postgres_endpoint",
+      "name": "foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "create_time": "2026-09-29T14:23:27Z",
+            "endpoint_id": "test-endpoint-[UNIQUE_NAME]",
+            "name": "projects/test-pg-project-[UNIQUE_NAME]/branches/test-branch-[UNIQUE_NAME]/endpoints/test-endpoint-[UNIQUE_NAME]",
+            "parent": "projects/test-pg-project-[UNIQUE_NAME]/branches/test-branch-[UNIQUE_NAME]",
+            "provider_config": {
+              "workspace_id": "900800700600"
+            },
+            "replace_existing": null,
+            "spec": {
+              "autoscaling_limit_max_cu": 4,
+              "autoscaling_limit_min_cu": 1,
+              "disabled": true,
+              "endpoint_type": "ENDPOINT_TYPE_READ_WRITE",
+              "group": null,
+              "no_suspension": null,
+              "settings": null,
+              "suspend_timeout_duration": null
+            },
+            "status": {
+              "autoscaling_limit_max_cu": 4,
+              "autoscaling_limit_min_cu": 1,
+              "current_state": "ACTIVE",
+              "disabled": true,
+              "endpoint_id": "test-endpoint-[UNIQUE_NAME]",
+              "endpoint_type": "ENDPOINT_TYPE_READ_WRITE",
+              "group": {
+                "enable_readable_secondaries": true,
+                "max": 1,
+                "min": 1
+              },
+              "hosts": {
+                "host": "ep-79fecf9f-d177-09c0-7.database.us-east-1.cloud.databricks.com",
+                "read_only_host": "ep-79fecf9f-d177-09c0-7.database.us-east-1.cloud.databricks.com",
+                "read_only_pooled_host": null,
+                "read_write_pooled_host": null
+              },
+              "last_active_time": null,
+              "pending_state": null,
+              "settings": {
+                "pg_settings": null
+              },
+              "suspend_timeout_duration": "24h0m0s"
+            },
+            "uid": "ep-79fecf9f-d177-09c0-7",
+            "update_time": "2026-09-29T14:23:27Z"
+          },
+          "sensitive_attributes": [],
+          "dependencies": [
+            "databricks_postgres_branch.branch",
+            "databricks_postgres_project.project"
+          ]
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_postgres_project",
+      "name": "project",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "create_time": "2026-09-29T14:23:27Z",
+            "delete_time": null,
+            "initial_branch_spec": null,
+            "initial_endpoint_spec": null,
+            "name": "projects/test-pg-project-[UNIQUE_NAME]",
+            "project_id": "test-pg-project-[UNIQUE_NAME]",
+            "provider_config": {
+              "workspace_id": "900800700600"
+            },
+            "purge_on_delete": null,
+            "purge_time": null,
+            "spec": {
+              "budget_policy_id": null,
+              "custom_tags": null,
+              "default_branch": null,
+              "default_endpoint_settings": null,
+              "display_name": "Test Postgres Project",
+              "enable_pg_native_login": null,
+              "history_retention_duration": null,
+              "pg_version": null
+            },
+            "status": {
+              "branch_logical_size_limit_bytes": 8796093022208,
+              "budget_policy_id": null,
+              "compute_last_active_time": null,
+              "custom_tags": null,
+              "default_branch": "projects/test-pg-project-[UNIQUE_NAME]/branches/production",
+              "default_endpoint_settings": {
+                "autoscaling_limit_max_cu": 1,
+                "autoscaling_limit_min_cu": 1,
+                "no_suspension": null,
+                "pg_settings": null,
+                "suspend_timeout_duration": "24h0m0s"
+              },
+              "display_name": "Test Postgres Project",
+              "enable_pg_native_login": false,
+              "history_retention_duration": "168h0m0s",
+              "owner": "tester@databricks.com",
+              "pg_version": null,
+              "project_id": "test-pg-project-[UNIQUE_NAME]",
+              "synthetic_storage_size_bytes": 0
+            },
+            "uid": "79fecf9f-cf12-65d0-79fe-cf9fcf1269b8",
+            "update_time": "2026-09-29T14:23:27Z"
+          },
+          "sensitive_attributes": []
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/postgres_project.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/postgres_project.yml.tmpl.requests.json
new file mode 100644
index 00000000000..02c0d0d782a
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/postgres_project.yml.tmpl.requests.json
@@ -0,0 +1,63 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/artifacts/.internal"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/files"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/files/app"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/postgres/projects",
+    "q": {
+      "project_id": "test-pg-project-[UNIQUE_NAME]"
+    },
+    "body": {
+      "project_id": "test-pg-project-[UNIQUE_NAME]",
+      "spec": {
+        "default_endpoint_settings": {
+          "autoscaling_limit_max_cu": 4
+        },
+        "display_name": "Test Postgres Project",
+        "enable_pg_native_login": false
+      }
+    }
+  },
+  {
+    "method": "PUT",
+    "path": "/api/2.0/permissions/database-projects/test-pg-project-[UNIQUE_NAME]",
+    "body": {
+      "access_control_list": [
+        {
+          "group_name": "users",
+          "permission_level": "CAN_USE"
+        },
+        {
+          "permission_level": "CAN_MANAGE",
+          "user_name": "tester@databricks.com"
+        }
+      ]
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/postgres_project.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/postgres_project.yml.tmpl.tfstate
new file mode 100644
index 00000000000..29dcebe6228
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/postgres_project.yml.tmpl.tfstate
@@ -0,0 +1,142 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 3,
+  "lineage": "821d3e27-84dd-9bd9-9864-40d5dd287616",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_permissions",
+      "name": "postgres_project_foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "access_control": [
+              {
+                "group_name": "",
+                "permission_level": "CAN_MANAGE",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              },
+              {
+                "group_name": "users",
+                "permission_level": "CAN_USE",
+                "service_principal_name": "",
+                "user_name": ""
+              }
+            ],
+            "alert_v2_id": null,
+            "app_name": null,
+            "authorization": null,
+            "cluster_id": null,
+            "cluster_policy_id": null,
+            "dashboard_id": null,
+            "database_instance_name": null,
+            "database_project_name": "test-pg-project-[UNIQUE_NAME]",
+            "directory_id": null,
+            "directory_path": null,
+            "experiment_id": null,
+            "id": "/database-projects/test-pg-project-[UNIQUE_NAME]",
+            "instance_pool_id": null,
+            "job_id": null,
+            "knowledge_assistant_id": null,
+            "notebook_id": null,
+            "notebook_path": null,
+            "object_type": "database-projects",
+            "pipeline_id": null,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "registered_model_id": null,
+            "repo_id": null,
+            "repo_path": null,
+            "serving_endpoint_id": null,
+            "sql_alert_id": null,
+            "sql_dashboard_id": null,
+            "sql_endpoint_id": null,
+            "sql_query_id": null,
+            "supervisor_agent_id": null,
+            "vector_search_endpoint_id": null,
+            "workspace_file_id": null,
+            "workspace_file_path": null
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "databricks_postgres_project.foo"
+          ]
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_postgres_project",
+      "name": "foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "create_time": "2026-09-29T14:23:30Z",
+            "delete_time": null,
+            "initial_branch_spec": null,
+            "initial_endpoint_spec": null,
+            "name": "projects/test-pg-project-[UNIQUE_NAME]",
+            "project_id": "test-pg-project-[UNIQUE_NAME]",
+            "provider_config": {
+              "workspace_id": "900800700600"
+            },
+            "purge_on_delete": null,
+            "purge_time": null,
+            "spec": {
+              "budget_policy_id": null,
+              "custom_tags": null,
+              "default_branch": null,
+              "default_endpoint_settings": {
+                "autoscaling_limit_max_cu": 4,
+                "autoscaling_limit_min_cu": null,
+                "no_suspension": null,
+                "pg_settings": null,
+                "suspend_timeout_duration": null
+              },
+              "display_name": "Test Postgres Project",
+              "enable_pg_native_login": false,
+              "history_retention_duration": null,
+              "pg_version": null
+            },
+            "status": {
+              "branch_logical_size_limit_bytes": 8796093022208,
+              "budget_policy_id": null,
+              "compute_last_active_time": null,
+              "custom_tags": null,
+              "default_branch": "projects/test-pg-project-[UNIQUE_NAME]/branches/production",
+              "default_endpoint_settings": {
+                "autoscaling_limit_max_cu": 4,
+                "autoscaling_limit_min_cu": 1,
+                "no_suspension": null,
+                "pg_settings": null,
+                "suspend_timeout_duration": "24h0m0s"
+              },
+              "display_name": "Test Postgres Project",
+              "enable_pg_native_login": false,
+              "history_retention_duration": "168h0m0s",
+              "owner": "tester@databricks.com",
+              "pg_version": null,
+              "project_id": "test-pg-project-[UNIQUE_NAME]",
+              "synthetic_storage_size_bytes": 0
+            },
+            "uid": "79fecfa0-6c01-7e08-79fe-cfa06c017e09",
+            "update_time": "2026-09-29T14:23:30Z"
+          },
+          "sensitive_attributes": []
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/postgres_role.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/postgres_role.yml.tmpl.requests.json
new file mode 100644
index 00000000000..aad01bd6875
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/postgres_role.yml.tmpl.requests.json
@@ -0,0 +1,71 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/artifacts/.internal"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/files"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/files/app"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/postgres/projects",
+    "q": {
+      "project_id": "test-pg-project-[UNIQUE_NAME]"
+    },
+    "body": {
+      "project_id": "test-pg-project-[UNIQUE_NAME]",
+      "spec": {
+        "display_name": "Test Postgres Project"
+      }
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/postgres/projects/test-pg-project-[UNIQUE_NAME]/branches",
+    "q": {
+      "branch_id": "test-branch-[UNIQUE_NAME]"
+    },
+    "body": {
+      "branch_id": "test-branch-[UNIQUE_NAME]",
+      "parent": "projects/test-pg-project-[UNIQUE_NAME]",
+      "spec": {
+        "no_expiry": true
+      }
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/postgres/projects/test-pg-project-[UNIQUE_NAME]/branches/test-branch-[UNIQUE_NAME]/roles",
+    "q": {
+      "role_id": "test-role-[UNIQUE_NAME]"
+    },
+    "body": {
+      "parent": "projects/test-pg-project-[UNIQUE_NAME]/branches/test-branch-[UNIQUE_NAME]",
+      "role_id": "test-role-[UNIQUE_NAME]",
+      "spec": {
+        "postgres_role": "app_role"
+      }
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/postgres_role.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/postgres_role.yml.tmpl.tfstate
new file mode 100644
index 00000000000..531ffcf896f
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/postgres_role.yml.tmpl.tfstate
@@ -0,0 +1,168 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 4,
+  "lineage": "74cb4b90-ded3-2b86-818c-3093fef556a1",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_postgres_branch",
+      "name": "branch",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "branch_id": "test-branch-[UNIQUE_NAME]",
+            "create_time": "2026-09-29T14:23:29Z",
+            "name": "projects/test-pg-project-[UNIQUE_NAME]/branches/test-branch-[UNIQUE_NAME]",
+            "parent": "projects/test-pg-project-[UNIQUE_NAME]",
+            "provider_config": {
+              "workspace_id": "900800700600"
+            },
+            "purge_on_delete": null,
+            "replace_existing": null,
+            "spec": {
+              "expire_time": null,
+              "is_protected": null,
+              "no_expiry": true,
+              "source_branch": null,
+              "source_branch_lsn": null,
+              "source_branch_time": null,
+              "source_snapshot": null,
+              "ttl": null
+            },
+            "status": {
+              "branch_id": "test-branch-[UNIQUE_NAME]",
+              "current_state": "READY",
+              "default": false,
+              "delete_time": null,
+              "expire_time": null,
+              "is_protected": false,
+              "logical_size_bytes": 0,
+              "pending_state": null,
+              "purge_time": null,
+              "source_branch": "projects/test-pg-project-[UNIQUE_NAME]/branches/production",
+              "source_branch_lsn": "0/0",
+              "source_branch_time": "2026-09-29T14:23:29Z",
+              "source_snapshot": null,
+              "state_change_time": "2026-09-29T14:23:29Z"
+            },
+            "uid": "br-79fecfa0-21c5-ff80-7",
+            "update_time": "2026-09-29T14:23:29Z"
+          },
+          "sensitive_attributes": [],
+          "dependencies": [
+            "databricks_postgres_project.project"
+          ]
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_postgres_project",
+      "name": "project",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "create_time": "2026-09-29T14:23:29Z",
+            "delete_time": null,
+            "initial_branch_spec": null,
+            "initial_endpoint_spec": null,
+            "name": "projects/test-pg-project-[UNIQUE_NAME]",
+            "project_id": "test-pg-project-[UNIQUE_NAME]",
+            "provider_config": {
+              "workspace_id": "900800700600"
+            },
+            "purge_on_delete": null,
+            "purge_time": null,
+            "spec": {
+              "budget_policy_id": null,
+              "custom_tags": null,
+              "default_branch": null,
+              "default_endpoint_settings": null,
+              "display_name": "Test Postgres Project",
+              "enable_pg_native_login": null,
+              "history_retention_duration": null,
+              "pg_version": null
+            },
+            "status": {
+              "branch_logical_size_limit_bytes": 8796093022208,
+              "budget_policy_id": null,
+              "compute_last_active_time": null,
+              "custom_tags": null,
+              "default_branch": "projects/test-pg-project-[UNIQUE_NAME]/branches/production",
+              "default_endpoint_settings": {
+                "autoscaling_limit_max_cu": 1,
+                "autoscaling_limit_min_cu": 1,
+                "no_suspension": null,
+                "pg_settings": null,
+                "suspend_timeout_duration": "24h0m0s"
+              },
+              "display_name": "Test Postgres Project",
+              "enable_pg_native_login": false,
+              "history_retention_duration": "168h0m0s",
+              "owner": "tester@databricks.com",
+              "pg_version": null,
+              "project_id": "test-pg-project-[UNIQUE_NAME]",
+              "synthetic_storage_size_bytes": 0
+            },
+            "uid": "79fecfa0-20f9-39a0-79fe-cfa020f939a1",
+            "update_time": "2026-09-29T14:23:29Z"
+          },
+          "sensitive_attributes": []
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_postgres_role",
+      "name": "foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "create_time": "2026-09-29T14:23:29Z",
+            "name": "projects/test-pg-project-[UNIQUE_NAME]/branches/test-branch-[UNIQUE_NAME]/roles/test-role-[UNIQUE_NAME]",
+            "parent": "projects/test-pg-project-[UNIQUE_NAME]/branches/test-branch-[UNIQUE_NAME]",
+            "provider_config": {
+              "workspace_id": "900800700600"
+            },
+            "replace_existing": null,
+            "role_id": "test-role-[UNIQUE_NAME]",
+            "spec": {
+              "attributes": null,
+              "auth_method": null,
+              "identity_type": null,
+              "membership_roles": null,
+              "postgres_role": "app_role"
+            },
+            "status": {
+              "attributes": {
+                "bypassrls": false,
+                "createdb": false,
+                "createrole": false
+              },
+              "auth_method": "PG_PASSWORD_SCRAM_SHA_256",
+              "identity_type": "IDENTITY_TYPE_UNSPECIFIED",
+              "membership_roles": null,
+              "postgres_role": "app_role",
+              "role_id": "test-role-[UNIQUE_NAME]"
+            },
+            "update_time": "2026-09-29T14:23:29Z"
+          },
+          "sensitive_attributes": [],
+          "dependencies": [
+            "databricks_postgres_branch.branch",
+            "databricks_postgres_project.project"
+          ]
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/postgres_synced_table.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/postgres_synced_table.yml.tmpl.requests.json
new file mode 100644
index 00000000000..6a2f65c74d0
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/postgres_synced_table.yml.tmpl.requests.json
@@ -0,0 +1,54 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/artifacts/.internal"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/files"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/files/app"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/postgres/synced_tables",
+    "q": {
+      "synced_table_id": "lakebase_[UNIQUE_NAME].public.trips_synced"
+    },
+    "body": {
+      "spec": {
+        "branch": "projects/test-pg-project-[UNIQUE_NAME]/branches/production",
+        "create_database_objects_if_missing": true,
+        "new_pipeline_spec": {
+          "storage_catalog": "main",
+          "storage_schema": "pipelines"
+        },
+        "postgres_database": "appdb",
+        "primary_key_columns": [
+          "id"
+        ],
+        "scheduling_policy": "SNAPSHOT",
+        "source_table_full_name": "main.raw.trips"
+      },
+      "synced_table_id": "lakebase_[UNIQUE_NAME].public.trips_synced"
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/postgres_synced_table.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/postgres_synced_table.yml.tmpl.tfstate
new file mode 100644
index 00000000000..5e9332842a4
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/postgres_synced_table.yml.tmpl.tfstate
@@ -0,0 +1,64 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "ebbe5c40-3e22-ffd8-6553-3a9b4a0d8fc7",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_postgres_synced_table",
+      "name": "foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "create_time": "2026-09-29T14:23:31Z",
+            "name": "synced_tables/lakebase_[UNIQUE_NAME].public.trips_synced",
+            "provider_config": {
+              "workspace_id": "900800700600"
+            },
+            "spec": {
+              "accelerated_sync": null,
+              "branch": "projects/test-pg-project-[UNIQUE_NAME]/branches/production",
+              "create_database_objects_if_missing": true,
+              "existing_pipeline_id": null,
+              "extra_columns": null,
+              "new_pipeline_spec": {
+                "budget_policy_id": null,
+                "pipeline_channel": null,
+                "storage_catalog": "main",
+                "storage_schema": "pipelines"
+              },
+              "postgres_database": "appdb",
+              "primary_key_columns": [
+                "id"
+              ],
+              "scheduling_policy": "SNAPSHOT",
+              "source_table_full_name": "main.raw.trips",
+              "timeseries_key": null,
+              "type_overrides": null
+            },
+            "status": {
+              "detailed_state": "SYNCED_TABLE_ONLINE",
+              "last_processed_commit_version": null,
+              "last_sync": null,
+              "last_sync_time": null,
+              "message": null,
+              "ongoing_sync_progress": null,
+              "pipeline_id": null,
+              "project": null,
+              "provisioning_phase": null,
+              "unity_catalog_provisioning_state": "ACTIVE"
+            },
+            "synced_table_id": "lakebase_[UNIQUE_NAME].public.trips_synced",
+            "uid": "79fecfa0-8a71-1e48-79fe-cfa08a711e49"
+          },
+          "sensitive_attributes": []
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/registered_model.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/registered_model.yml.tmpl.requests.json
new file mode 100644
index 00000000000..6234ca8a236
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/registered_model.yml.tmpl.requests.json
@@ -0,0 +1,26 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.1/unity-catalog/models",
+    "body": {
+      "catalog_name": "main",
+      "comment": "This is a test registered model",
+      "name": "test-model-[UNIQUE_NAME]",
+      "schema_name": "default"
+    }
+  },
+  {
+    "method": "PATCH",
+    "path": "/api/2.1/unity-catalog/permissions/function/main.default.test-model-[UNIQUE_NAME]",
+    "body": {
+      "changes": [
+        {
+          "add": [
+            "EXECUTE"
+          ],
+          "principal": "account users"
+        }
+      ]
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/registered_model.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/registered_model.yml.tmpl.tfstate
new file mode 100644
index 00000000000..48d1b6dc242
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/registered_model.yml.tmpl.tfstate
@@ -0,0 +1,95 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 3,
+  "lineage": "7b9455c4-6f46-6218-637c-0a4bc75b755e",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_grants",
+      "name": "registered_model_foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "catalog": null,
+            "credential": null,
+            "external_location": null,
+            "foreign_connection": null,
+            "function": "main.default.test-model-[UNIQUE_NAME]",
+            "grant": [
+              {
+                "principal": "account users",
+                "privileges": [
+                  "EXECUTE"
+                ]
+              }
+            ],
+            "id": "function/main.default.test-model-[UNIQUE_NAME]",
+            "mcp_service": null,
+            "metastore": null,
+            "model": null,
+            "model_provider_service": null,
+            "model_service": null,
+            "pipeline": null,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "recipient": null,
+            "schema": null,
+            "secret": null,
+            "share": null,
+            "storage_credential": null,
+            "table": null,
+            "volume": null
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "databricks_registered_model.foo"
+          ]
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_registered_model",
+      "name": "foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "aliases": [],
+            "browse_only": false,
+            "catalog_name": "main",
+            "comment": "This is a test registered model",
+            "created_at": 1790683808645,
+            "created_by": "tester@databricks.com",
+            "full_name": "main.default.test-model-[UNIQUE_NAME]",
+            "id": "main.default.test-model-[UNIQUE_NAME]",
+            "metastore_id": "79fec859-5311-5038-79fe-c85953115039",
+            "name": "test-model-[UNIQUE_NAME]",
+            "owner": "tester@databricks.com",
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "schema_name": "default",
+            "storage_location": null,
+            "updated_at": 1790683808645,
+            "updated_by": "tester@databricks.com"
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/schema_empty_grants.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/schema_empty_grants.yml.tmpl.requests.json
new file mode 100644
index 00000000000..25b13666d6b
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/schema_empty_grants.yml.tmpl.requests.json
@@ -0,0 +1,10 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.1/unity-catalog/schemas",
+    "body": {
+      "catalog_name": "main",
+      "name": "test-schema-[UNIQUE_NAME]"
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/schema_empty_grants.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/schema_empty_grants.yml.tmpl.tfstate
new file mode 100644
index 00000000000..c8e0c5a6091
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/schema_empty_grants.yml.tmpl.tfstate
@@ -0,0 +1,41 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "efdc5770-d3e7-c467-49bd-c19b32661d19",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_schema",
+      "name": "foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "catalog_name": "main",
+            "comment": null,
+            "enable_predictive_optimization": "INHERIT",
+            "force_destroy": true,
+            "id": "main.test-schema-[UNIQUE_NAME]",
+            "metastore_id": "120efa64-9b68-46ba-be38-f319458430d2",
+            "name": "test-schema-[UNIQUE_NAME]",
+            "owner": "tester@databricks.com",
+            "properties": null,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "schema_id": "79fec858-165f-c418-79fe-c858165fc419",
+            "storage_root": null
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/schema_tf_compat.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/schema_tf_compat.yml.tmpl.requests.json
new file mode 100644
index 00000000000..1af31b6e971
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/schema_tf_compat.yml.tmpl.requests.json
@@ -0,0 +1,25 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.1/unity-catalog/schemas",
+    "body": {
+      "catalog_name": "main",
+      "comment": "This is a test schema",
+      "name": "test-schema-[UNIQUE_NAME]"
+    }
+  },
+  {
+    "method": "PATCH",
+    "path": "/api/2.1/unity-catalog/permissions/schema/main.test-schema-[UNIQUE_NAME]",
+    "body": {
+      "changes": [
+        {
+          "add": [
+            "USE_SCHEMA"
+          ],
+          "principal": "account users"
+        }
+      ]
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/schema_tf_compat.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/schema_tf_compat.yml.tmpl.tfstate
new file mode 100644
index 00000000000..876b79ec90e
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/schema_tf_compat.yml.tmpl.tfstate
@@ -0,0 +1,91 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 3,
+  "lineage": "4f89abb7-f107-dea9-25a5-63831e0cc71b",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_grants",
+      "name": "schema_foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "catalog": null,
+            "credential": null,
+            "external_location": null,
+            "foreign_connection": null,
+            "function": null,
+            "grant": [
+              {
+                "principal": "account users",
+                "privileges": [
+                  "USE_SCHEMA"
+                ]
+              }
+            ],
+            "id": "schema/main.test-schema-[UNIQUE_NAME]",
+            "mcp_service": null,
+            "metastore": null,
+            "model": null,
+            "model_provider_service": null,
+            "model_service": null,
+            "pipeline": null,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "recipient": null,
+            "schema": "main.test-schema-[UNIQUE_NAME]",
+            "secret": null,
+            "share": null,
+            "storage_credential": null,
+            "table": null,
+            "volume": null
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "databricks_schema.foo"
+          ]
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_schema",
+      "name": "foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "catalog_name": "main",
+            "comment": "This is a test schema",
+            "enable_predictive_optimization": "INHERIT",
+            "force_destroy": true,
+            "id": "main.test-schema-[UNIQUE_NAME]",
+            "metastore_id": "120efa64-9b68-46ba-be38-f319458430d2",
+            "name": "test-schema-[UNIQUE_NAME]",
+            "owner": "tester@databricks.com",
+            "properties": null,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "schema_id": "79fec857-f1db-3d70-79fe-c857f1db3d71",
+            "storage_root": null
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/schema_uppercase_name.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/schema_uppercase_name.yml.tmpl.requests.json
new file mode 100644
index 00000000000..b83dfc18b22
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/schema_uppercase_name.yml.tmpl.requests.json
@@ -0,0 +1,10 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.1/unity-catalog/schemas",
+    "body": {
+      "catalog_name": "main",
+      "name": "MySCHEMA-[UNIQUE_NAME]"
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/schema_uppercase_name.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/schema_uppercase_name.yml.tmpl.tfstate
new file mode 100644
index 00000000000..d8c88d703d1
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/schema_uppercase_name.yml.tmpl.tfstate
@@ -0,0 +1,41 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "471b186e-3697-03f1-c747-b731c50742e4",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_schema",
+      "name": "foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "catalog_name": "main",
+            "comment": null,
+            "enable_predictive_optimization": "INHERIT",
+            "force_destroy": true,
+            "id": "main.myschema-[UNIQUE_NAME]",
+            "metastore_id": "120efa64-9b68-46ba-be38-f319458430d2",
+            "name": "myschema-[UNIQUE_NAME]",
+            "owner": "tester@databricks.com",
+            "properties": null,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "schema_id": "79fec857-c80a-92e8-79fe-c857c80a92e9",
+            "storage_root": null
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/secret_scope.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/secret_scope.yml.tmpl.requests.json
new file mode 100644
index 00000000000..e84ef608056
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/secret_scope.yml.tmpl.requests.json
@@ -0,0 +1,28 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.0/secrets/scopes/create",
+    "body": {
+      "scope": "test-scope-[UNIQUE_NAME]",
+      "scope_backend_type": "DATABRICKS"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/secrets/acls/put",
+    "body": {
+      "permission": "READ",
+      "principal": "users",
+      "scope": "test-scope-[UNIQUE_NAME]"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/secrets/acls/put",
+    "body": {
+      "permission": "WRITE",
+      "principal": "admins",
+      "scope": "test-scope-[UNIQUE_NAME]"
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/secret_scope.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/secret_scope.yml.tmpl.tfstate
new file mode 100644
index 00000000000..d25e079ae05
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/secret_scope.yml.tmpl.tfstate
@@ -0,0 +1,90 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 4,
+  "lineage": "1d4d52bc-abb3-989b-8135-0dc301f42938",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_secret_acl",
+      "name": "secret_acl_foo_0",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "id": "test-scope-[UNIQUE_NAME]|||users",
+            "permission": "READ",
+            "principal": "users",
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "scope": "test-scope-[UNIQUE_NAME]"
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "databricks_secret_scope.foo"
+          ]
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_secret_acl",
+      "name": "secret_acl_foo_1",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "id": "test-scope-[UNIQUE_NAME]|||admins",
+            "permission": "WRITE",
+            "principal": "admins",
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "scope": "test-scope-[UNIQUE_NAME]"
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "databricks_secret_acl.secret_acl_foo_0",
+            "databricks_secret_scope.foo"
+          ]
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_secret_scope",
+      "name": "foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "backend_type": "DATABRICKS",
+            "id": "test-scope-[UNIQUE_NAME]",
+            "initial_manage_principal": null,
+            "keyvault_metadata": [],
+            "name": "test-scope-[UNIQUE_NAME]",
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/secret_scope_default_backend_type.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/secret_scope_default_backend_type.yml.tmpl.requests.json
new file mode 100644
index 00000000000..2a427daee26
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/secret_scope_default_backend_type.yml.tmpl.requests.json
@@ -0,0 +1,10 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.0/secrets/scopes/create",
+    "body": {
+      "scope": "test-scope-[UNIQUE_NAME]",
+      "scope_backend_type": "DATABRICKS"
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/secret_scope_default_backend_type.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/secret_scope_default_backend_type.yml.tmpl.tfstate
new file mode 100644
index 00000000000..332ddf2bf23
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/secret_scope_default_backend_type.yml.tmpl.tfstate
@@ -0,0 +1,35 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "2badadee-fc0d-203f-0079-e03d8e239f88",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_secret_scope",
+      "name": "foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "backend_type": "DATABRICKS",
+            "id": "test-scope-[UNIQUE_NAME]",
+            "initial_manage_principal": null,
+            "keyvault_metadata": [],
+            "name": "test-scope-[UNIQUE_NAME]",
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/synced_database_table.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/synced_database_table.yml.tmpl.requests.json
new file mode 100644
index 00000000000..9807dd442cb
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/synced_database_table.yml.tmpl.requests.json
@@ -0,0 +1,81 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.1/unity-catalog/schemas",
+    "body": {
+      "catalog_name": "main",
+      "name": "test_synced_[UNIQUE_NAME]"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/sql/statements/",
+    "body": {
+      "statement": "CREATE TABLE main.test_synced_[UNIQUE_NAME].trips_source AS SELECT * FROM samples.nyctaxi.trips LIMIT 10",
+      "wait_timeout": "45s",
+      "warehouse_id": "8ec9edc1-db0c-40df-af8d-7580020fe61e"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/artifacts/.internal"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/files"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/files/app"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/database/instances",
+    "body": {
+      "capacity": "CU_1",
+      "name": "test-db-instance-[UNIQUE_NAME]"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/database/catalogs",
+    "body": {
+      "create_database_if_not_exists": true,
+      "database_instance_name": "test-db-instance-[UNIQUE_NAME]",
+      "database_name": "test_db",
+      "name": "test-catalog-[UNIQUE_NAME]"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/database/synced_tables",
+    "body": {
+      "database_instance_name": "test-db-instance-[UNIQUE_NAME]",
+      "logical_database_name": "test_db",
+      "name": "test-catalog-[UNIQUE_NAME].test_db.test_table",
+      "spec": {
+        "primary_key_columns": [
+          "tpep_pickup_datetime"
+        ],
+        "scheduling_policy": "SNAPSHOT",
+        "source_table_full_name": "main.test_synced_[UNIQUE_NAME].trips_source"
+      }
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/synced_database_table.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/synced_database_table.yml.tmpl.tfstate
new file mode 100644
index 00000000000..3d49670ce60
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/synced_database_table.yml.tmpl.tfstate
@@ -0,0 +1,120 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 4,
+  "lineage": "2dd38d91-59ae-326e-9c93-15d39dc7312d",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_database_database_catalog",
+      "name": "catalog1",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "create_database_if_not_exists": true,
+            "database_instance_name": "test-db-instance-[UNIQUE_NAME]",
+            "database_name": "test_db",
+            "name": "test-catalog-[UNIQUE_NAME]",
+            "provider_config": {
+              "workspace_id": "900800700600"
+            },
+            "uid": "79fecfa0-6574-b438-79fe-cfa06574b439"
+          },
+          "sensitive_attributes": [],
+          "dependencies": [
+            "databricks_database_instance.instance1"
+          ]
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_database_instance",
+      "name": "instance1",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "capacity": "CU_1",
+            "child_instance_refs": null,
+            "creation_time": "2026-09-29T14:23:30Z",
+            "creator": "tester@databricks.com",
+            "custom_tags": null,
+            "effective_capacity": "CU_1",
+            "effective_custom_tags": null,
+            "effective_enable_pg_native_login": false,
+            "effective_enable_readable_secondaries": false,
+            "effective_node_count": 1,
+            "effective_retention_window_in_days": 7,
+            "effective_stopped": false,
+            "effective_usage_policy_id": null,
+            "enable_pg_native_login": null,
+            "enable_readable_secondaries": null,
+            "name": "test-db-instance-[UNIQUE_NAME]",
+            "node_count": null,
+            "parent_instance_ref": null,
+            "pg_version": "PG_VERSION_16",
+            "provider_config": {
+              "workspace_id": "900800700600"
+            },
+            "purge_on_delete": true,
+            "read_only_dns": null,
+            "read_write_dns": null,
+            "retention_window_in_days": null,
+            "state": "AVAILABLE",
+            "stopped": null,
+            "uid": "79fecfa0-64ca-4368-79fe-cfa064ca4369",
+            "usage_policy_id": null
+          },
+          "sensitive_attributes": []
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_database_synced_database_table",
+      "name": "foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "data_synchronization_status": null,
+            "database_instance_name": "test-db-instance-[UNIQUE_NAME]",
+            "effective_database_instance_name": null,
+            "effective_logical_database_name": null,
+            "logical_database_name": "test_db",
+            "name": "test-catalog-[UNIQUE_NAME].test_db.test_table",
+            "provider_config": {
+              "workspace_id": "900800700600"
+            },
+            "spec": {
+              "accelerated_sync": null,
+              "create_database_objects_if_missing": null,
+              "existing_pipeline_id": null,
+              "new_pipeline_spec": null,
+              "primary_key_columns": [
+                "tpep_pickup_datetime"
+              ],
+              "scheduling_policy": "SNAPSHOT",
+              "source_table_full_name": "main.test_synced_[UNIQUE_NAME].trips_source",
+              "timeseries_key": null,
+              "type_overrides": null
+            },
+            "unity_catalog_provisioning_state": null
+          },
+          "sensitive_attributes": [],
+          "dependencies": [
+            "databricks_database_database_catalog.catalog1",
+            "databricks_database_instance.instance1"
+          ]
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/volume.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/volume.yml.tmpl.requests.json
new file mode 100644
index 00000000000..2b0af45556f
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/volume.yml.tmpl.requests.json
@@ -0,0 +1,27 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.1/unity-catalog/volumes",
+    "body": {
+      "catalog_name": "main",
+      "comment": "This is a test volume",
+      "name": "test-volume-[UNIQUE_NAME]",
+      "schema_name": "default",
+      "volume_type": "MANAGED"
+    }
+  },
+  {
+    "method": "PATCH",
+    "path": "/api/2.1/unity-catalog/permissions/volume/main.default.test-volume-[UNIQUE_NAME]",
+    "body": {
+      "changes": [
+        {
+          "add": [
+            "READ_VOLUME"
+          ],
+          "principal": "account users"
+        }
+      ]
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/volume.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/volume.yml.tmpl.tfstate
new file mode 100644
index 00000000000..d3597b2f96d
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/volume.yml.tmpl.tfstate
@@ -0,0 +1,89 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 3,
+  "lineage": "d80abfb9-c8e0-77a1-6ce5-c2cb2d1b994d",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_grants",
+      "name": "volume_foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "catalog": null,
+            "credential": null,
+            "external_location": null,
+            "foreign_connection": null,
+            "function": null,
+            "grant": [
+              {
+                "principal": "account users",
+                "privileges": [
+                  "READ_VOLUME"
+                ]
+              }
+            ],
+            "id": "volume/main.default.test-volume-[UNIQUE_NAME]",
+            "mcp_service": null,
+            "metastore": null,
+            "model": null,
+            "model_provider_service": null,
+            "model_service": null,
+            "pipeline": null,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "recipient": null,
+            "schema": null,
+            "secret": null,
+            "share": null,
+            "storage_credential": null,
+            "table": null,
+            "volume": "main.default.test-volume-[UNIQUE_NAME]"
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "databricks_volume.foo"
+          ]
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_volume",
+      "name": "foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "catalog_name": "main",
+            "comment": "This is a test volume",
+            "id": "main.default.test-volume-[UNIQUE_NAME]",
+            "name": "test-volume-[UNIQUE_NAME]",
+            "owner": "tester@databricks.com",
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "schema_name": "default",
+            "storage_location": "s3://deco-uc-prod-isolated-aws-us-east-1/metastore/120efa64-9b68-46ba-be38-f319458430d2/volumes/79fec857-6c4b-3d18-79fe-c8576c4b3d19",
+            "volume_path": "/Volumes/main/default/test-volume-[UNIQUE_NAME]",
+            "volume_type": "MANAGED"
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/volume_external.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/volume_external.yml.tmpl.requests.json
new file mode 100644
index 00000000000..6555616efaf
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/volume_external.yml.tmpl.requests.json
@@ -0,0 +1,13 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.1/unity-catalog/volumes",
+    "body": {
+      "catalog_name": "main",
+      "name": "test-volume-[UNIQUE_NAME]",
+      "schema_name": "default",
+      "storage_location": "s3://test-bucket/path/",
+      "volume_type": "EXTERNAL"
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/volume_external.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/volume_external.yml.tmpl.tfstate
new file mode 100644
index 00000000000..992010a807a
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/volume_external.yml.tmpl.tfstate
@@ -0,0 +1,39 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "a2fd6c14-ad35-cadf-d2d0-b3dc48c51d87",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_volume",
+      "name": "foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "catalog_name": "main",
+            "comment": null,
+            "id": "main.default.test-volume-[UNIQUE_NAME]",
+            "name": "test-volume-[UNIQUE_NAME]",
+            "owner": "tester@databricks.com",
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "schema_name": "default",
+            "storage_location": "s3://test-bucket/path",
+            "volume_path": "/Volumes/main/default/test-volume-[UNIQUE_NAME]",
+            "volume_type": "EXTERNAL"
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/fixtures/volume_path_job_ref.yml.tmpl.requests.json b/acceptance/bundle/invariant/fixtures/volume_path_job_ref.yml.tmpl.requests.json
new file mode 100644
index 00000000000..5bdb1664ee1
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/volume_path_job_ref.yml.tmpl.requests.json
@@ -0,0 +1,52 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "test-job-foo-[UNIQUE_NAME]",
+      "queue": {
+        "enabled": true
+      }
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.1/unity-catalog/volumes",
+    "body": {
+      "catalog_name": "main",
+      "name": "8790683801080979000",
+      "schema_name": "default",
+      "volume_type": "MANAGED"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "test-job-process-[UNIQUE_NAME]",
+      "parameters": [
+        {
+          "default": "/Volumes/main/default/8790683801080979000",
+          "name": "data_path"
+        }
+      ],
+      "queue": {
+        "enabled": true
+      }
+    }
+  }
+]
diff --git a/acceptance/bundle/invariant/fixtures/volume_path_job_ref.yml.tmpl.tfstate b/acceptance/bundle/invariant/fixtures/volume_path_job_ref.yml.tmpl.tfstate
new file mode 100644
index 00000000000..27b3944bcea
--- /dev/null
+++ b/acceptance/bundle/invariant/fixtures/volume_path_job_ref.yml.tmpl.tfstate
@@ -0,0 +1,250 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 4,
+  "lineage": "da8c138d-5e6f-3299-e897-4ae331771aa6",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790683801080979000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "test-job-foo-[UNIQUE_NAME]",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790683801080979000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "process",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle-[UNIQUE_NAME]/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790683801125441000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "test-job-process-[UNIQUE_NAME]",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [
+              {
+                "default": "/Volumes/main/default/8790683801080979000",
+                "name": "data_path"
+              }
+            ],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790683801125441000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ==",
+          "dependencies": [
+            "databricks_job.foo"
+          ]
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_volume",
+      "name": "data",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "catalog_name": "main",
+            "comment": null,
+            "id": "main.default.8790683801080979000",
+            "name": "8790683801080979000",
+            "owner": "tester@databricks.com",
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "schema_name": "default",
+            "storage_location": "s3://deco-uc-prod-isolated-aws-us-east-1/metastore/120efa64-9b68-46ba-be38-f319458430d2/volumes/79fec857-913d-ac78-79fe-c857913dac79",
+            "volume_path": "/Volumes/main/default/8790683801080979000",
+            "volume_type": "MANAGED"
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "databricks_job.foo"
+          ]
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/invariant/migrate/out.test.toml b/acceptance/bundle/invariant/migrate/out.test.toml
index 11aaf584918..e44a5f2ce38 100644
--- a/acceptance/bundle/invariant/migrate/out.test.toml
+++ b/acceptance/bundle/invariant/migrate/out.test.toml
@@ -1,43 +1,46 @@
-Local = true
-Cloud = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+Cloud = false
+EnvMatrix.DMS = [""]
 EnvMatrix.INPUT_CONFIG = [
   "alert.yml.tmpl",
   "app.yml.tmpl",
-  "catalog.yml.tmpl",
   "cluster.yml.tmpl",
+  "cluster_apply_policy_default_values.yml.tmpl",
   "dashboard.yml.tmpl",
+  "job_apply_policy_default_values_job_cluster.yml.tmpl",
+  "job_apply_policy_default_values_task_cluster.yml.tmpl",
+  "job_apply_policy_default_values_for_each_task.yml.tmpl",
   "database_catalog.yml.tmpl",
   "database_instance.yml.tmpl",
   "experiment.yml.tmpl",
-  "external_location.yml.tmpl",
   "job.yml.tmpl",
   "job_pydabs_10_tasks.yml.tmpl",
-  "job_pydabs_1000_tasks.yml.tmpl",
-  "job_cross_resource_ref.yml.tmpl",
-  "job_permission_ref.yml.tmpl",
+  "job_escaped_refs.yml.tmpl",
+  "job_run_job_ref.yml.tmpl",
+  "job_table_update_trigger.yml.tmpl",
   "job_with_depends_on.yml.tmpl",
-  "job_with_permissions.yml.tmpl",
   "job_with_task.yml.tmpl",
   "model.yml.tmpl",
   "model_with_permissions.yml.tmpl",
   "model_serving_endpoint.yml.tmpl",
   "pipeline.yml.tmpl",
+  "pipeline_allow_duplicate_names.yml.tmpl",
+  "pipeline_apply_policy_default_values.yml.tmpl",
   "pipeline_config_dots.yml.tmpl",
   "postgres_branch.yml.tmpl",
+  "postgres_catalog.yml.tmpl",
+  "postgres_database.yml.tmpl",
   "postgres_endpoint.yml.tmpl",
   "postgres_project.yml.tmpl",
+  "postgres_role.yml.tmpl",
+  "postgres_synced_table.yml.tmpl",
   "registered_model.yml.tmpl",
-  "schema.yml.tmpl",
-  "schema_grant_ref.yml.tmpl",
-  "schema_with_grants.yml.tmpl",
+  "schema_tf_compat.yml.tmpl",
+  "schema_empty_grants.yml.tmpl",
+  "schema_uppercase_name.yml.tmpl",
   "secret_scope.yml.tmpl",
   "secret_scope_default_backend_type.yml.tmpl",
-  "secret_scope_with_permissions.yml.tmpl",
-  "sql_warehouse.yml.tmpl",
   "synced_database_table.yml.tmpl",
-  "vector_search_endpoint.yml.tmpl",
   "volume.yml.tmpl",
-  "volume_external.yml.tmpl"
+  "volume_external.yml.tmpl",
+  "volume_path_job_ref.yml.tmpl"
 ]
diff --git a/acceptance/bundle/invariant/migrate/script b/acceptance/bundle/invariant/migrate/script
index 78f45faa7da..a81c1bdfe84 100644
--- a/acceptance/bundle/invariant/migrate/script
+++ b/acceptance/bundle/invariant/migrate/script
@@ -3,36 +3,11 @@
 
 unset DATABRICKS_BUNDLE_ENGINE
 
-# Copy data files to test directory
-cp -r "$TESTDIR/../data/." . &> LOG.cp
+invariant_setup
 
-# Run init script if present
-INIT_SCRIPT="$TESTDIR/../configs/$INPUT_CONFIG-init.sh"
-if [ -f "$INIT_SCRIPT" ]; then
-    source "$INIT_SCRIPT" &> LOG.init
-fi
-
-envsubst < $TESTDIR/../configs/$INPUT_CONFIG > databricks.yml
-
-cp databricks.yml LOG.config
-
-cleanup() {
-    trace $CLI bundle destroy --auto-approve &> LOG.destroy
-    cat LOG.destroy | contains.py '!panic:' '!internal error' > /dev/null
-
-    # Run cleanup script if present
-    CLEANUP_SCRIPT="$TESTDIR/../configs/$INPUT_CONFIG-cleanup.sh"
-    if [ -f "$CLEANUP_SCRIPT" ]; then
-        source "$CLEANUP_SCRIPT" &> LOG.cleanup
-    fi
-}
-
-trap cleanup EXIT
-
-trace DATABRICKS_BUNDLE_ENGINE=terraform $CLI bundle deploy &> LOG.deploy
-cat LOG.deploy | contains.py '!panic:' '!internal error' > /dev/null
-
-echo INPUT_CONFIG_OK
+# Replay a prior terraform deployment (per-config fixture captured once from a real terraform run),
+# standing in for the terraform deploy now that the invariant tests must not run the terraform engine.
+invariant_deploy LOG.replay replay_tfstate.py "$TESTDIR/../fixtures/$INPUT_CONFIG.requests.json" "$TESTDIR/../fixtures/$INPUT_CONFIG.tfstate"
 
 MIGRATE_ARGS=""
 # The terraform provider sorts depends_on entries alphabetically by task_key on Read
@@ -48,6 +23,4 @@ trace $CLI bundle deployment migrate $MIGRATE_ARGS &> LOG.migrate
 
 cat LOG.migrate | contains.py '!panic:' '!internal error' > /dev/null
 
-$CLI bundle plan -o json > plan.json 2>plan.json.err
-cat plan.json.err | contains.py '!panic:' '!internal error' > /dev/null
-verify_no_drift.py plan.json
+invariant_verify_no_drift
diff --git a/acceptance/bundle/invariant/migrate/test.toml b/acceptance/bundle/invariant/migrate/test.toml
index adc49c2992e..a4c41dfba3d 100644
--- a/acceptance/bundle/invariant/migrate/test.toml
+++ b/acceptance/bundle/invariant/migrate/test.toml
@@ -1,9 +1,46 @@
-# vector_search_endpoints has no terraform converter
+# These migrate a per-config terraform-state fixture (replayed by replay_tfstate.py, captured once
+# against the local test server) instead of running a live terraform deploy, so they are local-only.
+# That is complete coverage, not a gap: tf->direct migration is a one-time transition over a closed
+# set of resource types (terraform gets no new converters, and resources created on the direct
+# engine are never migrated), so a real-workspace run would add nothing.
+Cloud = false
+
+# Recording needs a bundle it has seen from the start. This test seeds a state file,
+# so recording refuses it. TODO(DMS): drop this once existing state can be
+# handed over to the service (see the TODO in dstate.Open).
+EnvMatrix.DMS = [""]
+
+# schema.yml sets custom_max_retention_hours, which the terraform databricks_schema resource cannot
+# set (only direct does), so a terraform-first migrate would drift. schema_tf_compat.yml keeps migrate
+# coverage for schemas.
+EnvMatrixExclude.no_schema_custom_retention = ["INPUT_CONFIG=schema.yml.tmpl"]
+
+# vector_search_endpoints and vector_search_indexes have no terraform converter
 EnvMatrixExclude.no_vector_search_endpoint = ["INPUT_CONFIG=vector_search_endpoint.yml.tmpl"]
+EnvMatrixExclude.no_vector_search_index = ["INPUT_CONFIG=vector_search_index.yml.tmpl"]
+
+# job_runs is a direct-only resource with no terraform converter, so the
+# terraform deploy that seeds the migration fails for it.
+EnvMatrixExclude.no_job_run = ["INPUT_CONFIG=job_run.yml.tmpl"]
 
 # Error: Catalog resources are only supported with direct deployment mode
 EnvMatrixExclude.no_catalog = ["INPUT_CONFIG=catalog.yml.tmpl"]
+EnvMatrixExclude.no_catalog_optional_fields = ["INPUT_CONFIG=catalog_optional_fields.yml.tmpl"]
 EnvMatrixExclude.no_external_location = ["INPUT_CONFIG=external_location.yml.tmpl"]
+# uc_trailing_slash includes a catalog, which is direct-only (see above).
+EnvMatrixExclude.no_uc_trailing_slash = ["INPUT_CONFIG=uc_trailing_slash.yml.tmpl"]
+# Genie spaces are direct-only too; the terraform deploy that seeds the migration fails for them.
+EnvMatrixExclude.no_genie_space = ["INPUT_CONFIG=genie_space.yml.tmpl"]
+# Instance pools are direct-only; the terraform deploy that seeds the migration fails for them.
+EnvMatrixExclude.no_instance_pool = ["INPUT_CONFIG=instance_pool.yml.tmpl"]
+# Cluster policies are direct-only; the terraform deploy that seeds the migration fails for them.
+EnvMatrixExclude.no_cluster_policy = ["INPUT_CONFIG=cluster_policy.yml.tmpl"]
+# Cluster libraries are direct-only; the terraform deploy that seeds the migration fails for them.
+EnvMatrixExclude.no_cluster_libraries = ["INPUT_CONFIG=cluster_libraries.yml.tmpl"]
+# AI Gateway securables are direct-only; the terraform deploy that seeds the migration fails for them.
+EnvMatrixExclude.no_model_service = ["INPUT_CONFIG=model_service.yml.tmpl"]
+# Features are direct-only; the terraform deploy that seeds the migration fails for them.
+EnvMatrixExclude.no_feature = ["INPUT_CONFIG=feature.yml.tmpl"]
 
 # Cross-resource permission references (e.g. ${resources.jobs.job_b.permissions[0].level})
 # don't work in terraform mode: the terraform interpolator converts the path to
@@ -19,3 +56,16 @@ EnvMatrixExclude.no_grant_ref = ["INPUT_CONFIG=schema_grant_ref.yml.tmpl"]
 
 # SQL warehouses currently failing with migration with permanent drift. TODO: fix this.
 EnvMatrixExclude.no_sql_warehouse = ["INPUT_CONFIG=sql_warehouse.yml.tmpl"]
+
+# The 1000-task scale case is covered by no_drift. Running it here adds ~1.5 min
+# per variant (deploy + migrate + plan at 1000 tasks) without incremental coverage.
+EnvMatrixExclude.no_pydabs_1000_tasks = ["INPUT_CONFIG=job_pydabs_1000_tasks.yml.tmpl"]
+
+# migrate deploys via Terraform first, and the TF provider rejects an uppercase
+# volume schema_name ("inconsistent final plan"). Covered by no_drift on direct.
+EnvMatrixExclude.no_volume_uppercase = ["INPUT_CONFIG=volume_uppercase_name.yml.tmpl"]
+
+EnvMatrixExclude.no_secret = ["INPUT_CONFIG=secret.yml.tmpl"]
+
+# Terraform types sampling_fraction as an integer and truncates 0.5; covered by no_drift.
+EnvMatrixExclude.no_model_serving_endpoint_telemetry = ["INPUT_CONFIG=model_serving_endpoint_telemetry.yml.tmpl"]
diff --git a/acceptance/bundle/invariant/no_drift/out.test.toml b/acceptance/bundle/invariant/no_drift/out.test.toml
index 11aaf584918..39825248867 100644
--- a/acceptance/bundle/invariant/no_drift/out.test.toml
+++ b/acceptance/bundle/invariant/no_drift/out.test.toml
@@ -1,43 +1,69 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
 EnvMatrix.INPUT_CONFIG = [
   "alert.yml.tmpl",
   "app.yml.tmpl",
   "catalog.yml.tmpl",
+  "catalog_optional_fields.yml.tmpl",
   "cluster.yml.tmpl",
+  "cluster_apply_policy_default_values.yml.tmpl",
+  "cluster_libraries.yml.tmpl",
+  "cluster_policy.yml.tmpl",
   "dashboard.yml.tmpl",
+  "job_apply_policy_default_values_job_cluster.yml.tmpl",
+  "job_apply_policy_default_values_task_cluster.yml.tmpl",
+  "job_apply_policy_default_values_for_each_task.yml.tmpl",
   "database_catalog.yml.tmpl",
   "database_instance.yml.tmpl",
   "experiment.yml.tmpl",
   "external_location.yml.tmpl",
+  "feature.yml.tmpl",
+  "genie_space.yml.tmpl",
+  "instance_pool.yml.tmpl",
   "job.yml.tmpl",
   "job_pydabs_10_tasks.yml.tmpl",
   "job_pydabs_1000_tasks.yml.tmpl",
   "job_cross_resource_ref.yml.tmpl",
+  "job_escaped_refs.yml.tmpl",
   "job_permission_ref.yml.tmpl",
+  "job_run.yml.tmpl",
+  "job_run_job_ref.yml.tmpl",
+  "job_table_update_trigger.yml.tmpl",
   "job_with_depends_on.yml.tmpl",
-  "job_with_permissions.yml.tmpl",
   "job_with_task.yml.tmpl",
   "model.yml.tmpl",
   "model_with_permissions.yml.tmpl",
   "model_serving_endpoint.yml.tmpl",
+  "model_serving_endpoint_telemetry.yml.tmpl",
   "pipeline.yml.tmpl",
+  "pipeline_allow_duplicate_names.yml.tmpl",
+  "pipeline_apply_policy_default_values.yml.tmpl",
   "pipeline_config_dots.yml.tmpl",
   "postgres_branch.yml.tmpl",
+  "postgres_catalog.yml.tmpl",
+  "postgres_database.yml.tmpl",
   "postgres_endpoint.yml.tmpl",
   "postgres_project.yml.tmpl",
+  "postgres_role.yml.tmpl",
+  "postgres_synced_table.yml.tmpl",
   "registered_model.yml.tmpl",
   "schema.yml.tmpl",
+  "schema_tf_compat.yml.tmpl",
+  "schema_empty_grants.yml.tmpl",
   "schema_grant_ref.yml.tmpl",
-  "schema_with_grants.yml.tmpl",
+  "schema_uppercase_name.yml.tmpl",
+  "secret.yml.tmpl",
   "secret_scope.yml.tmpl",
   "secret_scope_default_backend_type.yml.tmpl",
-  "secret_scope_with_permissions.yml.tmpl",
   "sql_warehouse.yml.tmpl",
   "synced_database_table.yml.tmpl",
+  "uc_trailing_slash.yml.tmpl",
   "vector_search_endpoint.yml.tmpl",
+  "vector_search_index.yml.tmpl",
   "volume.yml.tmpl",
-  "volume_external.yml.tmpl"
+  "volume_external.yml.tmpl",
+  "volume_path_job_ref.yml.tmpl",
+  "volume_uppercase_name.yml.tmpl",
+  "model_service.yml.tmpl"
 ]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/invariant/no_drift/script b/acceptance/bundle/invariant/no_drift/script
index 0473672e169..0961e8edac8 100644
--- a/acceptance/bundle/invariant/no_drift/script
+++ b/acceptance/bundle/invariant/no_drift/script
@@ -1,49 +1,39 @@
-# Invariant to test: no drift after deploy
+# Invariant to test: no drift after deploy, and that removing a non-required field converges.
 # Additional checks: no internal errors / panics in validate/plan/deploy
 
-# Copy data files to test directory
-cp -r "$TESTDIR/../data/." . &> LOG.cp
+invariant_setup
 
-# Run init script if present
-INIT_SCRIPT="$TESTDIR/../configs/$INPUT_CONFIG-init.sh"
-if [ -f "$INIT_SCRIPT" ]; then
-    source "$INIT_SCRIPT" &> LOG.init
+# Only compute a plan up front when the READPLAN variant actually consumes it via --plan.
+# Without READPLAN, deploy computes its own plan internally, so a separate `bundle plan`
+# invocation is pure waste.
+if [[ -n "$READPLAN" ]]; then
+    $CLI bundle plan -o json > plan.json 2>LOG.plan_initial.err
+    cat LOG.plan_initial.err | contains.py '!panic:' '!internal error' > /dev/null
 fi
 
-envsubst < $TESTDIR/../configs/$INPUT_CONFIG > databricks.yml
+invariant_deploy LOG.deploy $CLI bundle deploy $(readplanarg plan.json)
 
-cp databricks.yml LOG.config
+invariant_verify_no_drift
 
-# We redirect output rather than record it because some configs that are being tested may produce warnings
-trace $CLI bundle validate &> LOG.validate
+# Field removal: dropping a non-required field (tagged `# CAN_REMOVE` on each of its lines) must be
+# applied as an update that converges -- a field the config stops declaring must be sent as its zero
+# value, not silently dropped from the request (which either fails or drifts forever). Runs only on the
+# non-READPLAN variant (the saved-plan path is orthogonal) and only for configs that tag a field.
+# `# CANNOT_REMOVE` documents a field whose removal is broken and is deliberately kept; the marker is
+# matched with its `# ` prefix so neither it nor prose mentioning the marker is stripped.
+if [[ -z "$READPLAN" ]] && grep -q '# CAN_REMOVE' databricks.yml; then
+    grep -v '# CAN_REMOVE' databricks.yml > databricks.yml.new
+    mv databricks.yml.new databricks.yml
+    cp databricks.yml LOG.config.removed
 
-cat LOG.validate | contains.py '!panic' '!internal error' > /dev/null
+    $CLI bundle plan -o json > LOG.plan_removed.json 2>LOG.plan_removed.err
+    cat LOG.plan_removed.err | contains.py '!panic:' '!internal error' > /dev/null
+    verify_update.py LOG.plan_removed.json
 
-cleanup() {
-    trace $CLI bundle destroy --auto-approve &> LOG.destroy
-    cat LOG.destroy | contains.py '!panic' '!internal error' > /dev/null
+    # Plain deploy (not invariant_deploy): a second INPUT_CONFIG_OK would make output.txt differ
+    # from the variants that skip this block.
+    trace $CLI bundle deploy &> LOG.deploy_removed
+    cat LOG.deploy_removed | contains.py '!panic:' '!internal error' > /dev/null
 
-    # Run cleanup script if present
-    CLEANUP_SCRIPT="$TESTDIR/../configs/$INPUT_CONFIG-cleanup.sh"
-    if [ -f "$CLEANUP_SCRIPT" ]; then
-        source "$CLEANUP_SCRIPT" &> LOG.cleanup
-    fi
-}
-
-trap cleanup EXIT
-
-trace $CLI bundle deploy &> LOG.deploy
-cat LOG.deploy | contains.py '!panic' '!internal error' > /dev/null
-
-# Special message to fuzzer that generated config was fine.
-# Any failures after this point will be considered as "bug detected" by fuzzer.
-echo INPUT_CONFIG_OK
-
-# Check both text and JSON plan for no changes
-# Note, expect that there maybe more than one resource unchanged
-$CLI bundle plan -o json > LOG.planjson 2>LOG.planjson.err
-cat LOG.planjson.err | contains.py '!panic' '!internal error' > /dev/null
-verify_no_drift.py LOG.planjson
-
-$CLI bundle plan 2>LOG.plan.err | contains.py '!panic' '!internal error' 'Plan: 0 to add, 0 to change, 0 to delete' > LOG.plan
-cat LOG.plan.err | contains.py '!panic' '!internal error' > /dev/null
+    invariant_verify_no_drift
+fi
diff --git a/acceptance/bundle/invariant/no_drift/test.toml b/acceptance/bundle/invariant/no_drift/test.toml
new file mode 100644
index 00000000000..1fece2a12ab
--- /dev/null
+++ b/acceptance/bundle/invariant/no_drift/test.toml
@@ -0,0 +1,15 @@
+EnvMatrix.READPLAN = ["", "1"]
+
+# A 1000-task job serializes to ~110 KB, over the 64 KB per-operation state limit the
+# deployment metadata service accepts, so recording it fails the deploy. Raising the limit
+# or splitting the state is a service-side decision.
+EnvMatrixExclude.dms_state_too_large = ["DMS=true", "INPUT_CONFIG=job_pydabs_1000_tasks.yml.tmpl"]
+
+# Secrets have sensitive fields (json:"-") that are stripped when a plan is serialized to JSON,
+# so deploying from a pre-computed plan file creates the secret with an empty value.
+EnvMatrixExclude.no_secret_with_readplan = ["READPLAN=1", "INPUT_CONFIG=secret.yml.tmpl"]
+
+# Emptying a grants node records the operation as a delete with no state, which the deployment
+# metadata service rejects on a succeeded UPDATE action that leaves the grants (a live resource). This
+# is a known bug tracked by bundle/dms/empty-grants (Cloud=false); skip it under recording here.
+EnvMatrixExclude.dms_empty_grants_bug = ["DMS=true", "INPUT_CONFIG=schema_empty_grants.yml.tmpl"]
diff --git a/acceptance/bundle/invariant/script.prepare b/acceptance/bundle/invariant/script.prepare
new file mode 100644
index 00000000000..54f2a3dbf25
--- /dev/null
+++ b/acceptance/bundle/invariant/script.prepare
@@ -0,0 +1,54 @@
+# Shared setup for the invariant targets; each script keeps only the invariant it asserts.
+
+invariant_cleanup() {
+    trace $CLI bundle destroy --auto-approve &> LOG.destroy
+    cat LOG.destroy | contains.py '!panic:' '!internal error' > /dev/null
+
+    CLEANUP_SCRIPT="$TESTDIR/../configs/$INPUT_CONFIG-cleanup.sh"
+    if [ -f "$CLEANUP_SCRIPT" ]; then
+        source "$CLEANUP_SCRIPT" &> LOG.cleanup
+    fi
+}
+
+# Separate from invariant_setup so a caller that generates its own config can override the
+# render alone; child script.prepare files are concatenated after this one.
+invariant_render() {
+    cp -r "$TESTDIR/../data/." . &> LOG.cp
+
+    INIT_SCRIPT="$TESTDIR/../configs/$INPUT_CONFIG-init.sh"
+    if [ -f "$INIT_SCRIPT" ]; then
+        source "$INIT_SCRIPT" &> LOG.init
+    fi
+
+    envsubst < "$TESTDIR/../configs/$INPUT_CONFIG" > databricks.yml
+
+    cp databricks.yml LOG.config
+}
+
+# Call from the target, not at prepare time: prepare runs outside the subshell wrapping the
+# script, so the trap would belong to the outer shell.
+invariant_setup() {
+    invariant_render
+
+    trap invariant_cleanup EXIT
+}
+
+# Goes through trace, so callers can prefix the command with VAR=val.
+invariant_deploy() {
+    local logfile="$1"
+    shift
+    trace "$@" &> "$logfile"
+    cat "$logfile" | contains.py '!panic:' '!internal error' > /dev/null
+
+    # Tells the fuzzer the generated config was valid; failures after this count as bugs.
+    echo INPUT_CONFIG_OK
+}
+
+# JSON plan asserts every action is "skip" -- a strict superset of the text
+# renderer's "Plan: 0 to add, 0 to change, 0 to delete" summary.
+# Overridable for a caller whose config the server does not round-trip exactly.
+invariant_verify_no_drift() {
+    $CLI bundle plan -o json > LOG.planjson 2>LOG.planjson.err
+    cat LOG.planjson.err | contains.py '!panic:' '!internal error' > /dev/null
+    verify_no_drift.py LOG.planjson
+}
diff --git a/acceptance/bundle/invariant/test.toml b/acceptance/bundle/invariant/test.toml
index 257e33005a3..2427b6a553f 100644
--- a/acceptance/bundle/invariant/test.toml
+++ b/acceptance/bundle/invariant/test.toml
@@ -1,6 +1,4 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
 Timeout = '10m'
 
 Ignore = [
@@ -14,68 +12,115 @@ Ignore = [
     "app",
 ]
 
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = [
-    "direct",
-    # These tests work on terraform but commented out to save time on test run
-    #"terraform",
-]
+Env.DATABRICKS_BUNDLE_ENGINE = "direct"
 
 EnvMatrix.INPUT_CONFIG = [
     "alert.yml.tmpl",
     "app.yml.tmpl",
     "catalog.yml.tmpl",
+    "catalog_optional_fields.yml.tmpl",
     "cluster.yml.tmpl",
+    "cluster_apply_policy_default_values.yml.tmpl",
+    "cluster_libraries.yml.tmpl",
+    "cluster_policy.yml.tmpl",
     "dashboard.yml.tmpl",
+    "job_apply_policy_default_values_job_cluster.yml.tmpl",
+    "job_apply_policy_default_values_task_cluster.yml.tmpl",
+    "job_apply_policy_default_values_for_each_task.yml.tmpl",
     "database_catalog.yml.tmpl",
     "database_instance.yml.tmpl",
     "experiment.yml.tmpl",
     "external_location.yml.tmpl",
+    "feature.yml.tmpl",
+    "genie_space.yml.tmpl",
+    "instance_pool.yml.tmpl",
     "job.yml.tmpl",
     "job_pydabs_10_tasks.yml.tmpl",
     "job_pydabs_1000_tasks.yml.tmpl",
     "job_cross_resource_ref.yml.tmpl",
+    "job_escaped_refs.yml.tmpl",
     "job_permission_ref.yml.tmpl",
+    "job_run.yml.tmpl",
+    "job_run_job_ref.yml.tmpl",
+    "job_table_update_trigger.yml.tmpl",
     "job_with_depends_on.yml.tmpl",
-    "job_with_permissions.yml.tmpl",
     "job_with_task.yml.tmpl",
     "model.yml.tmpl",
     "model_with_permissions.yml.tmpl",
     "model_serving_endpoint.yml.tmpl",
+    "model_serving_endpoint_telemetry.yml.tmpl",
     "pipeline.yml.tmpl",
+    "pipeline_allow_duplicate_names.yml.tmpl",
+    "pipeline_apply_policy_default_values.yml.tmpl",
     "pipeline_config_dots.yml.tmpl",
     "postgres_branch.yml.tmpl",
+    "postgres_catalog.yml.tmpl",
+    "postgres_database.yml.tmpl",
     "postgres_endpoint.yml.tmpl",
     "postgres_project.yml.tmpl",
+    "postgres_role.yml.tmpl",
+    "postgres_synced_table.yml.tmpl",
     "registered_model.yml.tmpl",
     "schema.yml.tmpl",
+    "schema_tf_compat.yml.tmpl",
+    "schema_empty_grants.yml.tmpl",
     "schema_grant_ref.yml.tmpl",
-    "schema_with_grants.yml.tmpl",
+    "schema_uppercase_name.yml.tmpl",
+    "secret.yml.tmpl",
     "secret_scope.yml.tmpl",
     "secret_scope_default_backend_type.yml.tmpl",
-    "secret_scope_with_permissions.yml.tmpl",
     "sql_warehouse.yml.tmpl",
     "synced_database_table.yml.tmpl",
+    "uc_trailing_slash.yml.tmpl",
     "vector_search_endpoint.yml.tmpl",
+    "vector_search_index.yml.tmpl",
     "volume.yml.tmpl",
     "volume_external.yml.tmpl",
+    "volume_path_job_ref.yml.tmpl",
+    "volume_uppercase_name.yml.tmpl",
+    "model_service.yml.tmpl",
 ]
 
-[EnvMatrixExclude]
-no_alert_on_cloud = ["CONFIG_Cloud=true", "INPUT_CONFIG=alert.yml.tmpl"]
-
+EnvMatrixExclude.no_alert_on_cloud = ["CONFIG_Cloud=true", "INPUT_CONFIG=alert.yml.tmpl"]
+# job_run_job_ref sets a health rule value to 2^53+1 to exercise large-integer
+# precision in state migration. The value is out of range for the real backend,
+# so this config is local-only (the mock server stores it verbatim).
+EnvMatrixExclude.no_run_job_ref_on_cloud = ["CONFIG_Cloud=true", "INPUT_CONFIG=job_run_job_ref.yml.tmpl"]
 # Postgres resources only work on AWS
-no_postgres_project_on_cloud = ["CONFIG_Cloud=true", "INPUT_CONFIG=postgres_project.yml.tmpl"]
-no_postgres_branch_on_cloud = ["CONFIG_Cloud=true", "INPUT_CONFIG=postgres_branch.yml.tmpl"]
-no_postgres_endpoint_on_cloud = ["CONFIG_Cloud=true", "INPUT_CONFIG=postgres_endpoint.yml.tmpl"]
-
+EnvMatrixExclude.no_postgres_project_on_cloud = ["CONFIG_Cloud=true", "INPUT_CONFIG=postgres_project.yml.tmpl"]
+EnvMatrixExclude.no_postgres_branch_on_cloud = ["CONFIG_Cloud=true", "INPUT_CONFIG=postgres_branch.yml.tmpl"]
+EnvMatrixExclude.no_postgres_endpoint_on_cloud = ["CONFIG_Cloud=true", "INPUT_CONFIG=postgres_endpoint.yml.tmpl"]
+EnvMatrixExclude.no_postgres_catalog_on_cloud = ["CONFIG_Cloud=true", "INPUT_CONFIG=postgres_catalog.yml.tmpl"]
+EnvMatrixExclude.no_postgres_synced_table_on_cloud = ["CONFIG_Cloud=true", "INPUT_CONFIG=postgres_synced_table.yml.tmpl"]
+EnvMatrixExclude.no_postgres_role_on_cloud = ["CONFIG_Cloud=true", "INPUT_CONFIG=postgres_role.yml.tmpl"]
+EnvMatrixExclude.no_postgres_database_on_cloud = ["CONFIG_Cloud=true", "INPUT_CONFIG=postgres_database.yml.tmpl"]
+# Lakebase v1 (database instances/catalogs/synced tables) is not available on GCP,
+# so exclude these from all cloud runs (same as the postgres resources above).
+EnvMatrixExclude.no_database_instance_on_cloud = ["CONFIG_Cloud=true", "INPUT_CONFIG=database_instance.yml.tmpl"]
+EnvMatrixExclude.no_database_catalog_on_cloud = ["CONFIG_Cloud=true", "INPUT_CONFIG=database_catalog.yml.tmpl"]
+EnvMatrixExclude.no_synced_database_table_on_cloud = ["CONFIG_Cloud=true", "INPUT_CONFIG=synced_database_table.yml.tmpl"]
+# managed_encryption_settings needs a CMK registered with the workspace, so this
+# config only runs against the mock server
+EnvMatrixExclude.no_catalog_optional_fields_on_cloud = ["CONFIG_Cloud=true", "INPUT_CONFIG=catalog_optional_fields.yml.tmpl"]
 # External locations require actual storage credentials with cloud IAM setup
 # which are environment-specific, so we only test locally with the mock server
-no_external_location_on_cloud = ["CONFIG_Cloud=true", "INPUT_CONFIG=external_location.yml.tmpl"]
-
+EnvMatrixExclude.no_external_location_on_cloud = ["CONFIG_Cloud=true", "INPUT_CONFIG=external_location.yml.tmpl"]
 # External volumes reference external locations; excluded from cloud for the same reason
-no_external_volume_on_cloud = ["CONFIG_Cloud=true", "INPUT_CONFIG=volume_external.yml.tmpl"]
-
+EnvMatrixExclude.no_external_volume_on_cloud = ["CONFIG_Cloud=true", "INPUT_CONFIG=volume_external.yml.tmpl"]
+# Trailing-slash config uses fake storage paths (and an external volume, see above),
+# so it only runs against the mock server that mimics UC's slash stripping.
+EnvMatrixExclude.no_uc_trailing_slash_on_cloud = ["CONFIG_Cloud=true", "INPUT_CONFIG=uc_trailing_slash.yml.tmpl"]
+# Telemetry requires a real model, which cloud invariant tests do not provision.
+EnvMatrixExclude.no_model_serving_endpoint_telemetry_on_cloud = ["CONFIG_Cloud=true", "INPUT_CONFIG=model_serving_endpoint_telemetry.yml.tmpl"]
+# AI Gateway securables (direct-only) need a real routing target / provider config /
+# UC connection to create on cloud, which the invariant tests don't provision; the
+# local mock server accepts them, so these run locally only.
+EnvMatrixExclude.no_model_service_on_cloud = ["CONFIG_Cloud=true", "INPUT_CONFIG=model_service.yml.tmpl"]
+# Deployment history has no "features." resource-key prefix, so the deploy fails before the feature
+# is created; see dmsResourceTypes in libs/testserver/bundledeployments.go.
+EnvMatrixExclude.no_feature_dms = ["DMS=true", "INPUT_CONFIG=feature.yml.tmpl"]
 # Fake SQL endpoint for local tests
+
 [[Server]]
 Pattern = "POST /api/2.0/sql/statements/"
 Response.Body = '{"status": {"state": "SUCCEEDED"}, "manifest": {"schema": {"columns": []}}}'
diff --git a/acceptance/bundle/libraries/maven/out.test.toml b/acceptance/bundle/libraries/maven/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/libraries/maven/out.test.toml
+++ b/acceptance/bundle/libraries/maven/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/libraries/maven/output.txt b/acceptance/bundle/libraries/maven/output.txt
index fd72d8d144b..8443f45490d 100644
--- a/acceptance/bundle/libraries/maven/output.txt
+++ b/acceptance/bundle/libraries/maven/output.txt
@@ -10,6 +10,6 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/maven/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.testjob
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
diff --git a/acceptance/bundle/libraries/maven/script b/acceptance/bundle/libraries/maven/script
index a1ca3622d3e..4001021ac0b 100644
--- a/acceptance/bundle/libraries/maven/script
+++ b/acceptance/bundle/libraries/maven/script
@@ -1,4 +1,4 @@
 trace $CLI bundle validate -o json | jq '.resources.jobs.testjob.tasks[0].libraries'
 trace $CLI bundle deploy
-cat out.requests.txt | jq 'select(.path == "/api/2.2/jobs/create")' | jq '.body.tasks[0].libraries'  > out.job.libraries.txt
-rm out.requests.txt
+cat "$OUT_REQUESTS" | jq 'select(.path == "/api/2.2/jobs/create")' | jq '.body.tasks[0].libraries'  > out.job.libraries.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/libraries/outside_of_bundle_root/out.test.toml b/acceptance/bundle/libraries/outside_of_bundle_root/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/libraries/outside_of_bundle_root/out.test.toml
+++ b/acceptance/bundle/libraries/outside_of_bundle_root/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/libraries/outside_of_bundle_root/output.txt b/acceptance/bundle/libraries/outside_of_bundle_root/output.txt
index e7d6530536a..72411ab8dbb 100644
--- a/acceptance/bundle/libraries/outside_of_bundle_root/output.txt
+++ b/acceptance/bundle/libraries/outside_of_bundle_root/output.txt
@@ -28,33 +28,38 @@ Validation OK!
 >>> [CLI] bundle deploy
 Uploading ../lib/test.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/outside_of_bundle_root/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.test
+Created pipelines.pipeline
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 === Check that the job libraries are uploaded and the path is correct in the job
->>> cat out.requests.txt
+>>> cat [OUTPUT_DIR]/out.requests.txt
 [
   {
     "whl": "/Workspace/Users/[USERNAME]/.bundle/outside_of_bundle_root/default/artifacts/.internal/test.whl"
   }
 ]
 
->>> cat out.requests.txt
+>>> cat [OUTPUT_DIR]/out.requests.txt
 [
   "/Workspace/Users/[USERNAME]/.bundle/outside_of_bundle_root/default/artifacts/.internal/test.whl"
 ]
 
->>> cat out.requests.txt
+>>> cat [OUTPUT_DIR]/out.requests.txt
 [
   "/Workspace/Users/[USERNAME]/.bundle/outside_of_bundle_root/default/artifacts/.internal/test.whl"
 ]
 
->>> cat out.requests.txt
+>>> cat [OUTPUT_DIR]/out.requests.txt
 {
   "method": "POST",
-  "path": "/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/outside_of_bundle_root/default/artifacts/.internal/test.whl",
-  "q": {
-    "overwrite": "true"
+  "path": "/api/2.0/workspace/import",
+  "body": {
+    "multipart_form": {
+      "format": "RAW",
+      "overwrite": "true",
+      "path": "/Workspace/Users/[USERNAME]/.bundle/outside_of_bundle_root/default/artifacts/.internal/test.whl"
+    }
   }
 }
diff --git a/acceptance/bundle/libraries/outside_of_bundle_root/script b/acceptance/bundle/libraries/outside_of_bundle_root/script
index ff72be1b690..7c4616890cc 100644
--- a/acceptance/bundle/libraries/outside_of_bundle_root/script
+++ b/acceptance/bundle/libraries/outside_of_bundle_root/script
@@ -8,9 +8,9 @@ trace $CLI bundle deploy
 cd ..
 
 title "Check that the job libraries are uploaded and the path is correct in the job"
-trace cat out.requests.txt | jq 'select(.path == "/api/2.2/jobs/create")' | jq '.body.tasks[0].libraries'
-trace cat out.requests.txt | jq 'select(.path == "/api/2.2/jobs/create")' | jq '.body.environments[0].spec.dependencies'
-trace cat out.requests.txt | jq 'select(.path == "/api/2.0/pipelines" and .method == "POST")' | jq '.body.environment.dependencies'
-trace cat out.requests.txt | jq 'select(.path | test("/api/2.0/workspace-files/import-file/Workspace/Users/.*/.bundle/outside_of_bundle_root/default/artifacts/.internal/test.whl"))'
+trace cat "$OUT_REQUESTS" | jq 'select(.path == "/api/2.2/jobs/create")' | jq '.body.tasks[0].libraries'
+trace cat "$OUT_REQUESTS" | jq 'select(.path == "/api/2.2/jobs/create")' | jq '.body.environments[0].spec.dependencies'
+trace cat "$OUT_REQUESTS" | jq 'select(.path == "/api/2.0/pipelines" and .method == "POST")' | jq '.body.environment.dependencies'
+trace cat "$OUT_REQUESTS" | jq 'select(.path == "/api/2.0/workspace/import" and (.body.multipart_form.path // "" | test("/Workspace/Users/.*/.bundle/outside_of_bundle_root/default/artifacts/.internal/test.whl")))' | jq 'del(.body.multipart_form.content)'
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/libraries/pypi/out.test.toml b/acceptance/bundle/libraries/pypi/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/libraries/pypi/out.test.toml
+++ b/acceptance/bundle/libraries/pypi/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/libraries/pypi/output.txt b/acceptance/bundle/libraries/pypi/output.txt
index 002677d64e1..d2d710545f5 100644
--- a/acceptance/bundle/libraries/pypi/output.txt
+++ b/acceptance/bundle/libraries/pypi/output.txt
@@ -10,6 +10,6 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/pypi/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.testjob
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
diff --git a/acceptance/bundle/libraries/pypi/script b/acceptance/bundle/libraries/pypi/script
index a1ca3622d3e..4001021ac0b 100644
--- a/acceptance/bundle/libraries/pypi/script
+++ b/acceptance/bundle/libraries/pypi/script
@@ -1,4 +1,4 @@
 trace $CLI bundle validate -o json | jq '.resources.jobs.testjob.tasks[0].libraries'
 trace $CLI bundle deploy
-cat out.requests.txt | jq 'select(.path == "/api/2.2/jobs/create")' | jq '.body.tasks[0].libraries'  > out.job.libraries.txt
-rm out.requests.txt
+cat "$OUT_REQUESTS" | jq 'select(.path == "/api/2.2/jobs/create")' | jq '.body.tasks[0].libraries'  > out.job.libraries.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/lifecycle/prevent-destroy/out.direct.txt b/acceptance/bundle/lifecycle/prevent-destroy/out.direct.txt
deleted file mode 100644
index a100c8774f7..00000000000
--- a/acceptance/bundle/lifecycle/prevent-destroy/out.direct.txt
+++ /dev/null
@@ -1,69 +0,0 @@
-
->>> musterr [CLI] bundle destroy --auto-approve
-Error: resources.pipelines.my_pipelines has lifecycle.prevent_destroy set, but the plan calls for this resource to be recreated or destroyed. To avoid this error, disable lifecycle.prevent_destroy for resources.pipelines.my_pipelines
-resources.schemas.my_schema has lifecycle.prevent_destroy set, but the plan calls for this resource to be recreated or destroyed. To avoid this error, disable lifecycle.prevent_destroy for resources.schemas.my_schema
-
-
->>> errcode [CLI] bundle plan
-recreate pipelines.my_pipelines
-
-Plan: 1 to add, 0 to change, 1 to delete, 1 unchanged
-
->>> musterr [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/prevent-destroy/default/files...
-Error: resources.pipelines.my_pipelines has lifecycle.prevent_destroy set, but the plan calls for this resource to be recreated or destroyed. To avoid this error, disable lifecycle.prevent_destroy for resources.pipelines.my_pipelines
-
-
->>> errcode [CLI] bundle plan
-recreate pipelines.my_pipelines
-recreate schemas.my_schema
-
-Plan: 2 to add, 0 to change, 2 to delete, 0 unchanged
-
->>> musterr [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/prevent-destroy/default/files...
-Error: resources.pipelines.my_pipelines has lifecycle.prevent_destroy set, but the plan calls for this resource to be recreated or destroyed. To avoid this error, disable lifecycle.prevent_destroy for resources.pipelines.my_pipelines
-resources.schemas.my_schema has lifecycle.prevent_destroy set, but the plan calls for this resource to be recreated or destroyed. To avoid this error, disable lifecycle.prevent_destroy for resources.schemas.my_schema
-
-
->>> errcode [CLI] bundle plan
-recreate pipelines.my_pipelines
-recreate schemas.my_schema
-
-Plan: 2 to add, 0 to change, 2 to delete, 0 unchanged
-
->>> [CLI] bundle deploy --auto-approve
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/prevent-destroy/default/files...
-
-This action will result in the deletion or recreation of the following UC schemas. Any underlying data may be lost:
-  recreate resources.schemas.my_schema
-
-This action will result in the deletion or recreation of the following Lakeflow Spark Declarative Pipelines along with the
-Streaming Tables (STs) and Materialized Views (MVs) managed by them. Recreating the pipelines will
-restore the defined STs and MVs through full refresh. Note that recreation is necessary when pipeline
-properties such as the 'catalog' or 'storage' are changed:
-  recreate resources.pipelines.my_pipelines
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> errcode [CLI] bundle plan
-delete pipelines.my_pipelines
-delete schemas.my_schema
-
-Plan: 0 to add, 0 to change, 2 to delete, 0 unchanged
-
->>> [CLI] bundle deploy --auto-approve
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/prevent-destroy/default/files...
-
-This action will result in the deletion or recreation of the following UC schemas. Any underlying data may be lost:
-  delete resources.schemas.my_schema
-
-This action will result in the deletion or recreation of the following Lakeflow Spark Declarative Pipelines along with the
-Streaming Tables (STs) and Materialized Views (MVs) managed by them. Recreating the pipelines will
-restore the defined STs and MVs through full refresh. Note that recreation is necessary when pipeline
-properties such as the 'catalog' or 'storage' are changed:
-  delete resources.pipelines.my_pipelines
-Deploying resources...
-Updating deployment state...
-Deployment complete!
diff --git a/acceptance/bundle/lifecycle/prevent-destroy/out.terraform.txt b/acceptance/bundle/lifecycle/prevent-destroy/out.terraform.txt
deleted file mode 100644
index f36fe5c8f30..00000000000
--- a/acceptance/bundle/lifecycle/prevent-destroy/out.terraform.txt
+++ /dev/null
@@ -1,153 +0,0 @@
-
->>> musterr [CLI] bundle destroy --auto-approve
-Error: exit status 1
-
-Error: Instance cannot be destroyed
-
-  on bundle.tf.json line 15, in resource.databricks_pipeline:
-  15:       "my_pipelines": {
-
-Resource databricks_pipeline.my_pipelines has lifecycle.prevent_destroy set,
-but the plan calls for this resource to be destroyed. To avoid this error and
-continue with the plan, either disable lifecycle.prevent_destroy or reduce
-the scope of the plan using the -target flag.
-
-Error: Instance cannot be destroyed
-
-  on bundle.tf.json line 38, in resource.databricks_schema:
-  38:       "my_schema": {
-
-Resource databricks_schema.my_schema has lifecycle.prevent_destroy set, but
-the plan calls for this resource to be destroyed. To avoid this error and
-continue with the plan, either disable lifecycle.prevent_destroy or reduce
-the scope of the plan using the -target flag.
-
-
-
->>> errcode [CLI] bundle plan
-Error: exit status 1
-
-Error: Instance cannot be destroyed
-
-  on bundle.tf.json line 15, in resource.databricks_pipeline:
-  15:       "my_pipelines": {
-
-Resource databricks_pipeline.my_pipelines has lifecycle.prevent_destroy set,
-but the plan calls for this resource to be destroyed. To avoid this error and
-continue with the plan, either disable lifecycle.prevent_destroy or reduce
-the scope of the plan using the -target flag.
-
-
-
-Exit code: 1
-
->>> musterr [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/prevent-destroy/default/files...
-Error: exit status 1
-
-Error: Instance cannot be destroyed
-
-  on bundle.tf.json line 15, in resource.databricks_pipeline:
-  15:       "my_pipelines": {
-
-Resource databricks_pipeline.my_pipelines has lifecycle.prevent_destroy set,
-but the plan calls for this resource to be destroyed. To avoid this error and
-continue with the plan, either disable lifecycle.prevent_destroy or reduce
-the scope of the plan using the -target flag.
-
-
-
->>> errcode [CLI] bundle plan
-Error: exit status 1
-
-Error: Instance cannot be destroyed
-
-  on bundle.tf.json line 15, in resource.databricks_pipeline:
-  15:       "my_pipelines": {
-
-Resource databricks_pipeline.my_pipelines has lifecycle.prevent_destroy set,
-but the plan calls for this resource to be destroyed. To avoid this error and
-continue with the plan, either disable lifecycle.prevent_destroy or reduce
-the scope of the plan using the -target flag.
-
-Error: Instance cannot be destroyed
-
-  on bundle.tf.json line 38, in resource.databricks_schema:
-  38:       "my_schema": {
-
-Resource databricks_schema.my_schema has lifecycle.prevent_destroy set, but
-the plan calls for this resource to be destroyed. To avoid this error and
-continue with the plan, either disable lifecycle.prevent_destroy or reduce
-the scope of the plan using the -target flag.
-
-
-
-Exit code: 1
-
->>> musterr [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/prevent-destroy/default/files...
-Error: exit status 1
-
-Error: Instance cannot be destroyed
-
-  on bundle.tf.json line 15, in resource.databricks_pipeline:
-  15:       "my_pipelines": {
-
-Resource databricks_pipeline.my_pipelines has lifecycle.prevent_destroy set,
-but the plan calls for this resource to be destroyed. To avoid this error and
-continue with the plan, either disable lifecycle.prevent_destroy or reduce
-the scope of the plan using the -target flag.
-
-Error: Instance cannot be destroyed
-
-  on bundle.tf.json line 38, in resource.databricks_schema:
-  38:       "my_schema": {
-
-Resource databricks_schema.my_schema has lifecycle.prevent_destroy set, but
-the plan calls for this resource to be destroyed. To avoid this error and
-continue with the plan, either disable lifecycle.prevent_destroy or reduce
-the scope of the plan using the -target flag.
-
-
-
->>> errcode [CLI] bundle plan
-recreate pipelines.my_pipelines
-recreate schemas.my_schema
-
-Plan: 2 to add, 0 to change, 2 to delete, 0 unchanged
-
->>> [CLI] bundle deploy --auto-approve
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/prevent-destroy/default/files...
-
-This action will result in the deletion or recreation of the following UC schemas. Any underlying data may be lost:
-  recreate resources.schemas.my_schema
-
-This action will result in the deletion or recreation of the following Lakeflow Spark Declarative Pipelines along with the
-Streaming Tables (STs) and Materialized Views (MVs) managed by them. Recreating the pipelines will
-restore the defined STs and MVs through full refresh. Note that recreation is necessary when pipeline
-properties such as the 'catalog' or 'storage' are changed:
-  recreate resources.pipelines.my_pipelines
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> errcode [CLI] bundle plan
-delete pipelines.my_pipelines
-delete schemas.my_schema
-
-Plan: 0 to add, 0 to change, 2 to delete, 0 unchanged
-
->>> [CLI] bundle deploy --auto-approve
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/prevent-destroy/default/files...
-
-This action will result in the deletion or recreation of the following UC schemas. Any underlying data may be lost:
-  delete resources.schemas.my_schema
-
-This action will result in the deletion or recreation of the following Lakeflow Spark Declarative Pipelines along with the
-Streaming Tables (STs) and Materialized Views (MVs) managed by them. Recreating the pipelines will
-restore the defined STs and MVs through full refresh. Note that recreation is necessary when pipeline
-properties such as the 'catalog' or 'storage' are changed:
-  delete resources.pipelines.my_pipelines
-Deploying resources...
-Updating deployment state...
-Deployment complete!
diff --git a/acceptance/bundle/lifecycle/prevent-destroy/out.test.toml b/acceptance/bundle/lifecycle/prevent-destroy/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/lifecycle/prevent-destroy/out.test.toml
+++ b/acceptance/bundle/lifecycle/prevent-destroy/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/lifecycle/prevent-destroy/out.txt b/acceptance/bundle/lifecycle/prevent-destroy/out.txt
new file mode 100644
index 00000000000..a7082af177b
--- /dev/null
+++ b/acceptance/bundle/lifecycle/prevent-destroy/out.txt
@@ -0,0 +1,69 @@
+
+>>> musterr [CLI] bundle destroy --auto-approve
+Error: resources.pipelines.my_pipelines has lifecycle.prevent_destroy set, but the plan calls for this resource to be recreated or destroyed. To avoid this error, disable lifecycle.prevent_destroy for resources.pipelines.my_pipelines
+resources.schemas.my_schema has lifecycle.prevent_destroy set, but the plan calls for this resource to be recreated or destroyed. To avoid this error, disable lifecycle.prevent_destroy for resources.schemas.my_schema
+
+
+>>> errcode [CLI] bundle plan
+recreate pipelines.my_pipelines
+
+Plan: 1 to add, 0 to change, 1 to delete, 1 unchanged
+
+>>> musterr [CLI] bundle deploy -qq
+Error: resources.pipelines.my_pipelines has lifecycle.prevent_destroy set, but the plan calls for this resource to be recreated or destroyed. To avoid this error, disable lifecycle.prevent_destroy for resources.pipelines.my_pipelines
+
+
+>>> errcode [CLI] bundle plan
+recreate pipelines.my_pipelines
+recreate schemas.my_schema
+
+Plan: 2 to add, 0 to change, 2 to delete, 0 unchanged
+
+>>> musterr [CLI] bundle deploy -qq
+Error: resources.pipelines.my_pipelines has lifecycle.prevent_destroy set, but the plan calls for this resource to be recreated or destroyed. To avoid this error, disable lifecycle.prevent_destroy for resources.pipelines.my_pipelines
+resources.schemas.my_schema has lifecycle.prevent_destroy set, but the plan calls for this resource to be recreated or destroyed. To avoid this error, disable lifecycle.prevent_destroy for resources.schemas.my_schema
+
+
+>>> errcode [CLI] bundle plan
+recreate pipelines.my_pipelines
+recreate schemas.my_schema
+
+Plan: 2 to add, 0 to change, 2 to delete, 0 unchanged
+
+>>> [CLI] bundle deploy --auto-approve
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/prevent-destroy/default/files...
+
+This action will result in the deletion or recreation of the following UC schemas. Any underlying data may be lost:
+  recreate resources.schemas.my_schema
+
+This action will result in the deletion or recreation of the following Lakeflow Spark Declarative Pipelines along with the
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Recreating the pipelines will
+restore the defined STs and MVs through full refresh. Note that recreation is necessary when pipeline
+properties such as the 'catalog' or 'storage' are changed:
+  recreate resources.pipelines.my_pipelines
+Recreated pipelines.my_pipelines
+Recreated schemas.my_schema
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 2 deleted, 0 unchanged
+
+>>> errcode [CLI] bundle plan
+delete pipelines.my_pipelines
+delete schemas.my_schema
+
+Plan: 0 to add, 0 to change, 2 to delete, 0 unchanged
+
+>>> [CLI] bundle deploy --auto-approve
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/prevent-destroy/default/files...
+
+This action will result in the deletion or recreation of the following UC schemas. Any underlying data may be lost:
+  delete resources.schemas.my_schema
+
+This action will result in the deletion or recreation of the following Lakeflow Spark Declarative Pipelines along with the
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Recreating the pipelines will
+restore the defined STs and MVs through full refresh. Note that recreation is necessary when pipeline
+properties such as the 'catalog' or 'storage' are changed:
+  delete resources.pipelines.my_pipelines
+Deleted pipelines.my_pipelines
+Deleted schemas.my_schema
+Files: 1 uploaded, 2 deleted
+Resources: 0 created, 0 changed, 2 deleted, 0 unchanged
diff --git a/acceptance/bundle/lifecycle/prevent-destroy/output.txt b/acceptance/bundle/lifecycle/prevent-destroy/output.txt
index 6a0f626b376..37501e77f07 100644
--- a/acceptance/bundle/lifecycle/prevent-destroy/output.txt
+++ b/acceptance/bundle/lifecycle/prevent-destroy/output.txt
@@ -10,9 +10,10 @@ Validation OK!
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/prevent-destroy/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created pipelines.my_pipelines
+Created schemas.my_schema
+Files: 4 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> errcode [CLI] bundle plan
 Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
diff --git a/acceptance/bundle/lifecycle/prevent-destroy/script b/acceptance/bundle/lifecycle/prevent-destroy/script
index 88b75c5d66d..a2c90cea5b5 100644
--- a/acceptance/bundle/lifecycle/prevent-destroy/script
+++ b/acceptance/bundle/lifecycle/prevent-destroy/script
@@ -3,30 +3,30 @@ trace $CLI bundle validate
 trace $CLI bundle deploy
 
 trace errcode $CLI bundle plan
-trace musterr $CLI bundle destroy --auto-approve >>out.$DATABRICKS_BUNDLE_ENGINE.txt 2>&1
+trace musterr $CLI bundle destroy --auto-approve >>out.txt 2>&1
 
 # Note: In Terraform provider v1.98.0+, changing the catalog no longer triggers recreation.
 # We use storage location instead, which still requires recreation.
 # Changing from catalog to storage, deploy must fail because pipeline will be recreated
 update_file.py resources/pipeline.yml '      catalog: main' '      storage: "dbfs:/my-storage"'
-trace errcode $CLI bundle plan >>out.$DATABRICKS_BUNDLE_ENGINE.txt 2>&1
-trace musterr $CLI bundle deploy >>out.$DATABRICKS_BUNDLE_ENGINE.txt 2>&1
+trace errcode $CLI bundle plan >>out.txt 2>&1
+trace musterr $CLI bundle deploy -qq >>out.txt 2>&1
 
 # Changing the schema name, deploy must fail because schema will be recreated
 update_file.py resources/schema.yml 'name: test-schema' 'name: test-schema-new'
-trace errcode $CLI bundle plan >>out.$DATABRICKS_BUNDLE_ENGINE.txt 2>&1
-trace musterr $CLI bundle deploy >>out.$DATABRICKS_BUNDLE_ENGINE.txt 2>&1
+trace errcode $CLI bundle plan >>out.txt 2>&1
+trace musterr $CLI bundle deploy -qq >>out.txt 2>&1
 
 # Removing the prevent_destroy, deploy must succeed
 update_file.py resources/pipeline.yml 'prevent_destroy: true' 'prevent_destroy: false'
 update_file.py resources/schema.yml 'prevent_destroy: true' 'prevent_destroy: false'
-trace errcode $CLI bundle plan >>out.$DATABRICKS_BUNDLE_ENGINE.txt 2>&1
-trace $CLI bundle deploy --auto-approve >>out.$DATABRICKS_BUNDLE_ENGINE.txt 2>&1
+trace errcode $CLI bundle plan >>out.txt 2>&1
+trace $CLI bundle deploy --auto-approve >>out.txt 2>&1
 update_file.py resources/pipeline.yml 'prevent_destroy: false' 'prevent_destroy: true'
 update_file.py resources/schema.yml 'prevent_destroy: false' 'prevent_destroy: true'
 
 
 # Removing the pipeline and schema, deploy must succeed
 rm resources/pipeline.yml resources/schema.yml
-trace errcode $CLI bundle plan >>out.$DATABRICKS_BUNDLE_ENGINE.txt 2>&1
-trace $CLI bundle deploy --auto-approve >>out.$DATABRICKS_BUNDLE_ENGINE.txt 2>&1
+trace errcode $CLI bundle plan >>out.txt 2>&1
+trace $CLI bundle deploy --auto-approve >>out.txt 2>&1
diff --git a/acceptance/bundle/lifecycle/started-validation/out.terraform.txt b/acceptance/bundle/lifecycle/started-validation/out.terraform.txt
deleted file mode 100644
index ef87f528c1c..00000000000
--- a/acceptance/bundle/lifecycle/started-validation/out.terraform.txt
+++ /dev/null
@@ -1,11 +0,0 @@
-
->>> errcode [CLI] bundle plan
-Warning: unknown field: started
-  at resources.jobs.my_job.lifecycle
-  in databricks.yml:9:9
-
-Error: lifecycle.started is only supported in direct deployment mode
-  in databricks.yml:16:18
-
-
-Exit code: 1
diff --git a/acceptance/bundle/lifecycle/started-validation/out.test.toml b/acceptance/bundle/lifecycle/started-validation/out.test.toml
index b37ee45aed6..a927a5fbc06 100644
--- a/acceptance/bundle/lifecycle/started-validation/out.test.toml
+++ b/acceptance/bundle/lifecycle/started-validation/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/lifecycle/started-validation/out.direct.txt b/acceptance/bundle/lifecycle/started-validation/out.txt
similarity index 100%
rename from acceptance/bundle/lifecycle/started-validation/out.direct.txt
rename to acceptance/bundle/lifecycle/started-validation/out.txt
diff --git a/acceptance/bundle/lifecycle/started-validation/script b/acceptance/bundle/lifecycle/started-validation/script
index ff9d8c04540..d8d063aa7aa 100644
--- a/acceptance/bundle/lifecycle/started-validation/script
+++ b/acceptance/bundle/lifecycle/started-validation/script
@@ -1 +1 @@
-trace errcode $CLI bundle plan >> out.$DATABRICKS_BUNDLE_ENGINE.txt 2>&1
+trace errcode $CLI bundle plan >> out.txt 2>&1
diff --git a/acceptance/bundle/lifecycle/started-validation/test.toml b/acceptance/bundle/lifecycle/started-validation/test.toml
index bc763883068..601384fdf96 100644
--- a/acceptance/bundle/lifecycle/started-validation/test.toml
+++ b/acceptance/bundle/lifecycle/started-validation/test.toml
@@ -1,4 +1 @@
 Ignore = [".databricks"]
-
-[EnvMatrix]
-  DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
diff --git a/acceptance/bundle/lifecycle/started/out.test.toml b/acceptance/bundle/lifecycle/started/out.test.toml
index e90b6d5d1ba..a927a5fbc06 100644
--- a/acceptance/bundle/lifecycle/started/out.test.toml
+++ b/acceptance/bundle/lifecycle/started/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/lifecycle/started/test.toml b/acceptance/bundle/lifecycle/started/test.toml
index d1240963e01..731086bc182 100644
--- a/acceptance/bundle/lifecycle/started/test.toml
+++ b/acceptance/bundle/lifecycle/started/test.toml
@@ -1,7 +1,3 @@
-Local = true
 Cloud = false
 
 Ignore = [".databricks"]
-
-[EnvMatrix]
-  DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/lifecycle/test.toml b/acceptance/bundle/lifecycle/test.toml
deleted file mode 100644
index 7d36fb9dc18..00000000000
--- a/acceptance/bundle/lifecycle/test.toml
+++ /dev/null
@@ -1,2 +0,0 @@
-Local = true
-Cloud = false
diff --git a/acceptance/bundle/local_state_staleness/out.test.toml b/acceptance/bundle/local_state_staleness/out.test.toml
index bbc7fcfd1bd..0f167effef1 100644
--- a/acceptance/bundle/local_state_staleness/out.test.toml
+++ b/acceptance/bundle/local_state_staleness/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/local_state_staleness/output.txt b/acceptance/bundle/local_state_staleness/output.txt
index c22387f85ed..133b867061c 100644
--- a/acceptance/bundle/local_state_staleness/output.txt
+++ b/acceptance/bundle/local_state_staleness/output.txt
@@ -2,28 +2,26 @@
 === Step 1: Deploy bundle A
 >>> [CLI] bundle deploy --force-lock --auto-approve
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/local-state-staleness-test-[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.test_job
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 === Step 2: Deploy bundle B
 >>> [CLI] bundle deploy --force-lock --auto-approve
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/local-state-staleness-test-[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
 
 === Step 3: Deploy bundle A again (should use remote state)
 >>> [CLI] bundle deploy --force-lock --auto-approve
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/local-state-staleness-test-[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
 
 === Step 4: Verify only one job exists
 {
   "name": "test-job-basic-[UNIQUE_NAME]",
-  "id": [NUMID]
+  "id": [TEST_JOB_ID]
 }
 
 === Cleanup - destroy bundle A (bundle B does not have an active deployment)
@@ -34,8 +32,7 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/local-state-staleness-test-[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
 
 >>> rm -rf [TEST_TMP_DIR]/bundle_a
 
diff --git a/acceptance/bundle/local_state_staleness/script b/acceptance/bundle/local_state_staleness/script
index 6c434629e2c..90faf6de288 100644
--- a/acceptance/bundle/local_state_staleness/script
+++ b/acceptance/bundle/local_state_staleness/script
@@ -30,6 +30,7 @@ trap cleanup EXIT
 title "Step 1: Deploy bundle A"
 cd "$BUNDLE_A_DIR"
 trace "$CLI" bundle deploy --force-lock --auto-approve
+replace_ids.py
 
 title "Step 2: Deploy bundle B"
 cd "$BUNDLE_B_DIR"
diff --git a/acceptance/bundle/local_state_staleness/test.toml b/acceptance/bundle/local_state_staleness/test.toml
index e93d23f722b..c7c6f58ed6e 100644
--- a/acceptance/bundle/local_state_staleness/test.toml
+++ b/acceptance/bundle/local_state_staleness/test.toml
@@ -1,2 +1 @@
 Cloud = true
-Local = true
diff --git a/acceptance/bundle/migrate/auto/apply-failure/databricks.yml b/acceptance/bundle/migrate/auto/apply-failure/databricks.yml
new file mode 100644
index 00000000000..eef37e5cb9c
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/apply-failure/databricks.yml
@@ -0,0 +1,7 @@
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    test_job:
+      name: "Test Auto-Migrate Apply Failure"
diff --git a/acceptance/bundle/migrate/auto/apply-failure/out.test.toml b/acceptance/bundle/migrate/auto/apply-failure/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/apply-failure/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/auto/apply-failure/output.txt b/acceptance/bundle/migrate/auto/apply-failure/output.txt
new file mode 100644
index 00000000000..be5d6f0a284
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/apply-failure/output.txt
@@ -0,0 +1,58 @@
+
+=== Replay a prior terraform deployment
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate
+
+>>> update_file.py databricks.yml Test Auto-Migrate Apply Failure Test Auto-Migrate Apply Failure (updated)
+
+=== Migrating deploy: migration commits (point of no return), then the job apply fails
+>>> DATABRICKS_BUNDLE_ENGINE=direct errcode [CLI] bundle deploy
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Migrated 1 resource to direct deployment engine.
+Error: cannot update resources.jobs.test_job: updating id=[TEST_JOB_ID]: Fault injected by test. (403 INJECTED)
+
+Endpoint: POST [DATABRICKS_URL]/api/2.2/jobs/reset
+HTTP Status: 403 Forbidden
+API error_code: INJECTED
+API message: Fault injected by test.
+
+Files: 1 uploaded, 0 deleted
+
+Exit code: 1
+
+>>> print_migration_telemetry
+direct_migrated_via_env true
+
+=== On direct despite the failed apply: resources.json present, terraform state retired
+
+>>> find.py \.databricks/.*(\.tfstate|resources.*\.json|\.wal)
+.databricks/bundle/default/resources.json
+.databricks/bundle/default/terraform/terraform.tfstate.backup
+
+>>> MSYS_NO_PATHCONV=1 [CLI] workspace list /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state
+ID                   Type  Language  Path
+[OBJECT_ID]  FILE            /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deployment.json
+[OBJECT_ID]  FILE            /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/resources.json
+[OBJECT_ID]  FILE            /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate.backup
+
+=== Retry finishes the apply on the already-migrated direct state (no re-migration)
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Updated jobs.test_job
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+>>> print_migration_telemetry
+
+=== Local state remains direct
+
+>>> find.py \.databricks/.*(\.tfstate|resources.*\.json|\.wal)
+.databricks/bundle/default/resources.json
+.databricks/bundle/default/terraform/terraform.tfstate.backup
+
+>>> MSYS_NO_PATHCONV=1 [CLI] workspace list /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state
+ID                   Type  Language  Path
+[OBJECT_ID]  FILE            /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deployment.json
+[OBJECT_ID]  FILE            /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json
+[OBJECT_ID]  FILE            /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/resources.json
+[OBJECT_ID]  FILE            /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate.backup
diff --git a/acceptance/bundle/migrate/auto/apply-failure/script b/acceptance/bundle/migrate/auto/apply-failure/script
new file mode 100644
index 00000000000..78b838fa835
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/apply-failure/script
@@ -0,0 +1,32 @@
+export DATABRICKS_BUNDLE_ENGINE=
+
+title "Replay a prior terraform deployment"
+trace replay_tfstate.py terraform-requests.json terraform.tfstate
+replace_ids.py
+rm -f "$OUT_REQUESTS"
+
+# Change the job so the migrating deploy must update it (jobs/reset), giving us a resource apply
+# to fault AFTER the migration has committed.
+trace update_file.py databricks.yml "Test Auto-Migrate Apply Failure" "Test Auto-Migrate Apply Failure (updated)"
+
+title "Migrating deploy: migration commits (point of no return), then the job apply fails"
+# CommitMigration runs after approval and BEFORE the apply: it pushes resources.json and retires
+# the terraform state, so the bundle is durably on direct. The subsequent jobs/reset then fails
+# (403). A deploy that fails after the commit has still migrated - this is the accepted window.
+fault.py "POST /api/2.2/jobs/reset" 403 0 1
+trace DATABRICKS_BUNDLE_ENGINE=direct errcode $CLI bundle deploy
+trace print_migration_telemetry
+rm -f "$OUT_REQUESTS"
+
+title "On direct despite the failed apply: resources.json present, terraform state retired\n"
+trace find.py '\.databricks/.*(\.tfstate|resources.*\.json|\.wal)'
+trace MSYS_NO_PATHCONV=1 $CLI workspace list "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/test-bundle/default/state"
+
+title "Retry finishes the apply on the already-migrated direct state (no re-migration)"
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle deploy
+trace print_migration_telemetry
+rm -f "$OUT_REQUESTS"
+
+title "Local state remains direct\n"
+trace find.py '\.databricks/.*(\.tfstate|resources.*\.json|\.wal)'
+trace MSYS_NO_PATHCONV=1 $CLI workspace list "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/test-bundle/default/state"
diff --git a/acceptance/bundle/migrate/auto/apply-failure/terraform-requests.json b/acceptance/bundle/migrate/auto/apply-failure/terraform-requests.json
new file mode 100644
index 00000000000..9b14a9769e2
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/apply-failure/terraform-requests.json
@@ -0,0 +1,19 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "Test Auto-Migrate Apply Failure",
+      "queue": {
+        "enabled": true
+      }
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/auto/apply-failure/terraform.tfstate b/acceptance/bundle/migrate/auto/apply-failure/terraform.tfstate
new file mode 100644
index 00000000000..a49c4cf4d15
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/apply-failure/terraform.tfstate
@@ -0,0 +1,110 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "e7b2f099-38a8-3ee6-5873-2f1f2490d94b",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "test_job",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790614093854675000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "Test Auto-Migrate Apply Failure",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790614093854675000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/auto/artifacts/databricks.yml b/acceptance/bundle/migrate/auto/artifacts/databricks.yml
new file mode 100644
index 00000000000..bf98a6ebc3b
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/artifacts/databricks.yml
@@ -0,0 +1,15 @@
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    test_job:
+      name: "Test Auto-Migrate Artifacts Job"
+      tasks:
+        - task_key: TestTask
+          existing_cluster_id: "0717-132531-5opeqon1"
+          python_wheel_task:
+            package_name: "my_test_code"
+            entry_point: "run"
+          libraries:
+            - whl: ./dist/*.whl
diff --git a/acceptance/bundle/migrate/auto/artifacts/dist/my_test_code-0.0.1-py3-none-any.whl b/acceptance/bundle/migrate/auto/artifacts/dist/my_test_code-0.0.1-py3-none-any.whl
new file mode 100644
index 00000000000..4bb80477caf
Binary files /dev/null and b/acceptance/bundle/migrate/auto/artifacts/dist/my_test_code-0.0.1-py3-none-any.whl differ
diff --git a/acceptance/bundle/migrate/auto/artifacts/out.test.toml b/acceptance/bundle/migrate/auto/artifacts/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/artifacts/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/auto/artifacts/output.txt b/acceptance/bundle/migrate/auto/artifacts/output.txt
new file mode 100644
index 00000000000..0656827cd2d
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/artifacts/output.txt
@@ -0,0 +1,42 @@
+
+=== Replay a prior terraform deployment
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate
+
+=== Redeploy with direct default: auto-migration runs after the build, so library refs are resolved
+>>> [CLI] bundle deploy
+Warn: unable to get spark version for cluster 0717-132531-5opeqon1, err: Not Found
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Uploading dist/my_test_code-0.0.1-py3-none-any.whl...
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Migrated 1 resource to direct deployment engine.
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
+
+=== Local state is now direct
+
+>>> find.py \.databricks/.*(\.tfstate|resources.*\.json|\.wal)
+.databricks/bundle/default/resources.json
+.databricks/bundle/default/terraform/terraform.tfstate.backup
+
+>>> MSYS_NO_PATHCONV=1 [CLI] workspace list /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state
+ID                   Type  Language  Path
+[OBJECT_ID]  FILE            /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deployment.json
+[OBJECT_ID]  FILE            /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json
+[OBJECT_ID]  FILE            /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/resources.json
+[OBJECT_ID]  FILE            /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate.backup
+
+=== Migrated state's library path (should be the resolved remote path, not the local glob)
+>>> print_state.py
+[
+  {
+    "whl": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1-py3-none-any.whl"
+  }
+]
+
+=== Subsequent deploy is a no-op on direct
+>>> [CLI] bundle deploy
+Warn: unable to get spark version for cluster 0717-132531-5opeqon1, err: Not Found
+Uploading dist/my_test_code-0.0.1-py3-none-any.whl...
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
diff --git a/acceptance/bundle/migrate/auto/artifacts/script b/acceptance/bundle/migrate/auto/artifacts/script
new file mode 100644
index 00000000000..b351121e54a
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/artifacts/script
@@ -0,0 +1,17 @@
+export DATABRICKS_BUNDLE_ENGINE=
+
+title "Replay a prior terraform deployment"
+trace replay_tfstate.py terraform-requests.json terraform.tfstate
+
+title "Redeploy with direct default: auto-migration runs after the build, so library refs are resolved"
+trace $CLI bundle deploy
+
+title "Local state is now direct\n"
+trace find.py '\.databricks/.*(\.tfstate|resources.*\.json|\.wal)'
+trace MSYS_NO_PATHCONV=1 $CLI workspace list "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/test-bundle/default/state"
+
+title "Migrated state's library path (should be the resolved remote path, not the local glob)"
+trace print_state.py | jq '.. | .libraries? | select(.)'
+
+title "Subsequent deploy is a no-op on direct"
+trace $CLI bundle deploy
diff --git a/acceptance/bundle/migrate/auto/artifacts/terraform-requests.json b/acceptance/bundle/migrate/auto/artifacts/terraform-requests.json
new file mode 100644
index 00000000000..34e7156a362
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/artifacts/terraform-requests.json
@@ -0,0 +1,34 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "Test Auto-Migrate Artifacts Job",
+      "queue": {
+        "enabled": true
+      },
+      "tasks": [
+        {
+          "existing_cluster_id": "0717-132531-5opeqon1",
+          "libraries": [
+            {
+              "whl": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1-py3-none-any.whl"
+            }
+          ],
+          "python_wheel_task": {
+            "entry_point": "run",
+            "package_name": "my_test_code"
+          },
+          "task_key": "TestTask"
+        }
+      ]
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/auto/artifacts/terraform.tfstate b/acceptance/bundle/migrate/auto/artifacts/terraform.tfstate
new file mode 100644
index 00000000000..1cd81631add
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/artifacts/terraform.tfstate
@@ -0,0 +1,180 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "5855e5a0-b4d4-25c6-1c18-927cf805aab9",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "test_job",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790614094870334000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "Test Auto-Migrate Artifacts Job",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [
+              {
+                "ai_runtime_task": [],
+                "alert_task": [],
+                "clean_rooms_notebook_task": [],
+                "compute": [],
+                "condition_task": [],
+                "dashboard_task": [],
+                "dbt_cloud_task": [],
+                "dbt_platform_task": [],
+                "dbt_task": [],
+                "depends_on": [],
+                "description": "",
+                "disable_auto_optimization": false,
+                "disabled": false,
+                "email_notifications": [
+                  {
+                    "no_alert_for_skipped_runs": false,
+                    "on_duration_warning_threshold_exceeded": [],
+                    "on_failure": [],
+                    "on_start": [],
+                    "on_streaming_backlog_exceeded": [],
+                    "on_success": []
+                  }
+                ],
+                "environment_key": "",
+                "existing_cluster_id": "0717-132531-5opeqon1",
+                "for_each_task": [],
+                "gen_ai_compute_task": [],
+                "health": [],
+                "job_cluster_key": "",
+                "library": [
+                  {
+                    "cran": [],
+                    "egg": "",
+                    "jar": "",
+                    "maven": [],
+                    "provider_config": [],
+                    "pypi": [],
+                    "requirements": "",
+                    "whl": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/artifacts/.internal/my_test_code-0.0.1-py3-none-any.whl"
+                  }
+                ],
+                "max_retries": 0,
+                "min_retry_interval_millis": 0,
+                "new_cluster": [],
+                "notebook_task": [],
+                "notification_settings": [],
+                "pipeline_task": [],
+                "power_bi_task": [],
+                "python_operator_task": [],
+                "python_wheel_task": [
+                  {
+                    "entry_point": "run",
+                    "named_parameters": null,
+                    "package_name": "my_test_code",
+                    "parameters": null
+                  }
+                ],
+                "retry_on_timeout": false,
+                "run_if": "ALL_SUCCESS",
+                "run_job_task": [],
+                "spark_jar_task": [],
+                "spark_python_task": [],
+                "spark_submit_task": [],
+                "sql_task": [],
+                "task_key": "TestTask",
+                "timeout_seconds": 0,
+                "webhook_notifications": []
+              }
+            ],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790614094870334000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/engine-config-direct/test.toml b/acceptance/bundle/migrate/auto/artifacts/test.toml
similarity index 100%
rename from acceptance/bundle/migrate/engine-config-direct/test.toml
rename to acceptance/bundle/migrate/auto/artifacts/test.toml
diff --git a/acceptance/bundle/migrate/auto/clean/databricks.yml b/acceptance/bundle/migrate/auto/clean/databricks.yml
new file mode 100644
index 00000000000..7acc0c3576e
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/clean/databricks.yml
@@ -0,0 +1,7 @@
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    test_job:
+      name: "Test Auto-Migrate Job"
diff --git a/acceptance/bundle/migrate/auto/clean/out.plan_update.json b/acceptance/bundle/migrate/auto/clean/out.plan_update.json
new file mode 100644
index 00000000000..1f79fdd0cb3
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/clean/out.plan_update.json
@@ -0,0 +1,69 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 3,
+  "plan": {
+    "resources.jobs.test_job": {
+      "action": "update",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "Test Auto-Migrate Job (renamed)",
+          "queue": {
+            "enabled": true
+          }
+        }
+      },
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_id": [TEST_JOB_ID],
+        "max_concurrent_runs": 1,
+        "name": "Test Auto-Migrate Job",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "timeout_seconds": 0,
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "name": {
+          "action": "update",
+          "old": "Test Auto-Migrate Job",
+          "new": "Test Auto-Migrate Job (renamed)",
+          "remote": "Test Auto-Migrate Job"
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/migrate/auto/clean/out.test.toml b/acceptance/bundle/migrate/auto/clean/out.test.toml
new file mode 100644
index 00000000000..73d7f3f004e
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/clean/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = [""]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/migrate/auto/clean/output.txt b/acceptance/bundle/migrate/auto/clean/output.txt
new file mode 100644
index 00000000000..e0cb4f41aaa
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/clean/output.txt
@@ -0,0 +1,60 @@
+
+=== Replay a prior terraform deployment
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate
+
+=== Opt in to direct engine via config and redeploy: auto-migration triggers
+>>> update_file.py databricks.yml name: test-bundle name: test-bundle
+  engine: direct
+
+>>> [CLI] bundle deploy
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Migrated 1 resource to direct deployment engine.
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
+
+>>> print_migration_telemetry
+direct_migrated_via_config true
+
+=== Direct-engine state is now in place; terraform state is backed up
+
+>>> find.py \.databricks/.*(\.tfstate|resources.*\.json|\.wal)
+.databricks/bundle/default/resources.json
+.databricks/bundle/default/terraform/terraform.tfstate.backup
+
+=== Remote state also reflects the migration (force-pull surfaces workspace state)
+
+>>> [CLI] bundle debug states --force-pull
+resources.json: remote direct state serial=3 lineage="[UUID]"
+[TEST_TMP_DIR]/.databricks/bundle/default/resources.json: local direct state serial=3 lineage="[UUID]"
+
+=== Subsequent plan under direct is a no-op
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+=== Subsequent deploy under direct is a no-op
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
+
+>>> print_migration_telemetry
+
+=== Modify the config — plan shows the pending update
+>>> update_file.py databricks.yml Test Auto-Migrate Job Test Auto-Migrate Job (renamed)
+
+>>> [CLI] bundle plan
+update jobs.test_job
+
+Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
+
+=== Deploy picks up the update (with and without --plan)
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Updated jobs.test_job
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+>>> print_migration_telemetry
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
diff --git a/acceptance/bundle/migrate/auto/clean/script b/acceptance/bundle/migrate/auto/clean/script
new file mode 100644
index 00000000000..695759c1760
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/clean/script
@@ -0,0 +1,42 @@
+export DATABRICKS_BUNDLE_ENGINE=
+
+title "Replay a prior terraform deployment"
+trace replay_tfstate.py terraform-requests.json terraform.tfstate
+replace_ids.py
+rm -f "$OUT_REQUESTS"
+
+# Each call to print_migration_telemetry inspects "$OUT_REQUESTS"; clear
+# it after each call so the next deploy's telemetry stands alone.
+title "Opt in to direct engine via config and redeploy: auto-migration triggers"
+trace update_file.py databricks.yml "name: test-bundle" $'name: test-bundle\n  engine: direct'
+trace $CLI bundle deploy
+trace print_migration_telemetry
+rm -f "$OUT_REQUESTS"
+
+title "Direct-engine state is now in place; terraform state is backed up\n"
+trace find.py '\.databricks/.*(\.tfstate|resources.*\.json|\.wal)'
+
+title "Remote state also reflects the migration (force-pull surfaces workspace state)\n"
+trace $CLI bundle debug states --force-pull
+
+title "Subsequent plan under direct is a no-op"
+trace $CLI bundle plan | contains.py "1 unchanged"
+
+title "Subsequent deploy under direct is a no-op"
+trace $CLI bundle deploy
+trace print_migration_telemetry
+rm -f "$OUT_REQUESTS"
+
+title "Modify the config — plan shows the pending update"
+trace update_file.py databricks.yml "Test Auto-Migrate Job" "Test Auto-Migrate Job (renamed)"
+trace $CLI bundle plan
+$CLI bundle plan -o json > out.plan_update.json
+
+title "Deploy picks up the update (with and without --plan)\n"
+$CLI bundle deploy $(readplanarg out.plan_update.json)
+trace print_migration_telemetry
+rm -f "$OUT_REQUESTS"
+
+trace $CLI bundle plan | contains.py "1 unchanged"
+
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/migrate/auto/clean/terraform-requests.json b/acceptance/bundle/migrate/auto/clean/terraform-requests.json
new file mode 100644
index 00000000000..6482593b189
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/clean/terraform-requests.json
@@ -0,0 +1,19 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "Test Auto-Migrate Job",
+      "queue": {
+        "enabled": true
+      }
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/auto/clean/terraform.tfstate b/acceptance/bundle/migrate/auto/clean/terraform.tfstate
new file mode 100644
index 00000000000..142494090fa
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/clean/terraform.tfstate
@@ -0,0 +1,110 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "b483d381-20e3-32f5-b2fb-11d5b8939772",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "test_job",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790614095102035000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "Test Auto-Migrate Job",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790614095102035000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/auto/clean/test.toml b/acceptance/bundle/migrate/auto/clean/test.toml
new file mode 100644
index 00000000000..513685bc005
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/clean/test.toml
@@ -0,0 +1,5 @@
+EnvMatrix.READPLAN = ["", "1"]
+
+# Migrating an existing deployment is not supported with deployment-history recording, so this
+# test only runs without it (recording is covered by bundle/dms).
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/auto/default/databricks.yml b/acceptance/bundle/migrate/auto/default/databricks.yml
new file mode 100644
index 00000000000..5fa3205df9d
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/default/databricks.yml
@@ -0,0 +1,6 @@
+bundle: {name: test-bundle}
+
+resources:
+  jobs:
+    test_job:
+      name: "Test Auto-Migrate Job"
diff --git a/acceptance/bundle/migrate/auto/default/out.test.toml b/acceptance/bundle/migrate/auto/default/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/default/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/auto/default/output.txt b/acceptance/bundle/migrate/auto/default/output.txt
new file mode 100644
index 00000000000..30a5dd774e6
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/default/output.txt
@@ -0,0 +1,93 @@
+
+=== Replay a prior terraform deployment
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate
+
+=== Summary works with engine: terraform and shows the deployed job's ID and URL
+>>> update_file.py databricks.yml {name: test-bundle} {name: test-bundle, engine: terraform}
+
+>>> [CLI] bundle summary
+Warning: the Terraform deployment engine has been removed in Databricks CLI v1.20.0
+  in databricks.yml:1:37
+
+Remove the "bundle.engine" setting (or set it to "direct") to deploy with the direct engine; existing Terraform state is migrated automatically. To keep using Terraform, revert to Databricks CLI v1.19.x.
+See https://docs.databricks.com/dev-tools/bundles/direct for details
+
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+Resources:
+  Jobs:
+    test_job:
+      Name: Test Auto-Migrate Job
+      URL:  [DATABRICKS_URL]/jobs/[TEST_JOB_ID]?w=[WORKSPACE_ID]
+
+>>> [CLI] bundle summary -o json
+Warning: the Terraform deployment engine has been removed in Databricks CLI v1.20.0
+  in databricks.yml:1:37
+
+Remove the "bundle.engine" setting (or set it to "direct") to deploy with the direct engine; existing Terraform state is migrated automatically. To keep using Terraform, revert to Databricks CLI v1.19.x.
+See https://docs.databricks.com/dev-tools/bundles/direct for details
+
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+{
+  "engine": "terraform",
+  "id": "[TEST_JOB_ID]",
+  "url": "[DATABRICKS_URL]/jobs/[TEST_JOB_ID]?w=[WORKSPACE_ID]"
+}
+
+=== Summary does not migrate: no state writes, terraform state is left untouched
+
+>>> print_requests.py
+
+>>> find.py \.databricks/.*(\.tfstate|resources.*\.json|\.wal)
+.databricks/bundle/default/terraform/terraform.tfstate
+
+>>> update_file.py databricks.yml {name: test-bundle, engine: terraform} {name: test-bundle}
+
+=== Redeploy with nothing set: direct is the default, so auto-migration triggers
+>>> [CLI] bundle deploy
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Migrated 1 resource to direct deployment engine.
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
+
+>>> print_migration_telemetry
+direct_migrated_via_default true
+
+=== Direct-engine state is now in place; terraform state is backed up
+
+>>> find.py \.databricks/.*(\.tfstate|resources.*\.json|\.wal)
+.databricks/bundle/default/resources.json
+.databricks/bundle/default/terraform/terraform.tfstate.backup
+
+=== Remote state also reflects the migration (force-pull surfaces workspace state)
+
+>>> [CLI] bundle debug states --force-pull
+resources.json: remote direct state serial=3 lineage="[UUID]"
+[TEST_TMP_DIR]/.databricks/bundle/default/resources.json: local direct state serial=3 lineage="[UUID]"
+
+=== Subsequent deploy is a no-op on direct
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
+
+>>> print_migration_telemetry
+
+=== Destroy the migrated bundle leaves no state behind, local or remote
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.test_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Destroy: 1 deleted
+
+>>> find.py \.databricks/.*(\.tfstate|resources.*\.json|\.wal)
+
+>>> MSYS_NO_PATHCONV=1 musterr [CLI] workspace list /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state
+Error: Path (/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state) doesn't exist.
diff --git a/acceptance/bundle/migrate/auto/default/script b/acceptance/bundle/migrate/auto/default/script
new file mode 100644
index 00000000000..e5a34df7e03
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/default/script
@@ -0,0 +1,48 @@
+export DATABRICKS_BUNDLE_ENGINE=
+
+# Replay a prior terraform deployment (its resource requests were captured from a real terraform
+# run), standing in for `DATABRICKS_BUNDLE_ENGINE=terraform bundle deploy` now that migrate tests
+# must not deploy with terraform.
+title "Replay a prior terraform deployment"
+trace replay_tfstate.py terraform-requests.json terraform.tfstate
+replace_ids.py
+rm -f "$OUT_REQUESTS"
+
+# Set after the replay: replay_tfstate.py runs bundle validate, which rejects engine: terraform.
+title "Summary works with engine: terraform and shows the deployed job's ID and URL"
+trace update_file.py databricks.yml "{name: test-bundle}" "{name: test-bundle, engine: terraform}"
+trace $CLI bundle summary
+trace $CLI bundle summary -o json | jq '{engine: .bundle.engine, id: .resources.jobs.test_job.id, url: .resources.jobs.test_job.url}'
+
+title "Summary does not migrate: no state writes, terraform state is left untouched\n"
+trace print_requests.py
+trace find.py '\.databricks/.*(\.tfstate|resources.*\.json|\.wal)'
+trace update_file.py databricks.yml "{name: test-bundle, engine: terraform}" "{name: test-bundle}"
+
+title "Redeploy with nothing set: direct is the default, so auto-migration triggers"
+trace $CLI bundle deploy
+trace print_migration_telemetry
+rm -f "$OUT_REQUESTS"
+
+title "Direct-engine state is now in place; terraform state is backed up\n"
+trace find.py '\.databricks/.*(\.tfstate|resources.*\.json|\.wal)'
+
+title "Remote state also reflects the migration (force-pull surfaces workspace state)\n"
+trace $CLI bundle debug states --force-pull
+
+title "Subsequent deploy is a no-op on direct"
+trace $CLI bundle deploy
+trace print_migration_telemetry
+
+rm -f "$OUT_REQUESTS"
+
+title "Destroy the migrated bundle leaves no state behind, local or remote"
+# The migrating deploy above renamed the local terraform.tfstate to terraform.tfstate.backup and
+# backed up the remote one; this direct destroy must not leave either (nor the direct state) behind.
+# find.py lists matching state files sorted with forward slashes (cross-platform), excluding the
+# terraform provider cache under .terraform/; the remote state dir is gone once the destroy completes.
+trace $CLI bundle destroy --auto-approve
+trace find.py '\.databricks/.*(\.tfstate|resources.*\.json|\.wal)'
+trace MSYS_NO_PATHCONV=1 musterr $CLI workspace list "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/test-bundle/default/state"
+
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/migrate/auto/default/terraform-requests.json b/acceptance/bundle/migrate/auto/default/terraform-requests.json
new file mode 100644
index 00000000000..6482593b189
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/default/terraform-requests.json
@@ -0,0 +1,19 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "Test Auto-Migrate Job",
+      "queue": {
+        "enabled": true
+      }
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/auto/default/terraform.tfstate b/acceptance/bundle/migrate/auto/default/terraform.tfstate
new file mode 100644
index 00000000000..c04f332a595
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/default/terraform.tfstate
@@ -0,0 +1,110 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "c39488aa-8f36-06fd-a7cb-3f0c95b4c506",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "test_job",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790612527183335000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "Test Auto-Migrate Job",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790612527183335000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/auto/delete-all/databricks.yml b/acceptance/bundle/migrate/auto/delete-all/databricks.yml
new file mode 100644
index 00000000000..b13f958f575
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/delete-all/databricks.yml
@@ -0,0 +1,7 @@
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    job_a:
+      name: "Job A"
diff --git a/acceptance/bundle/migrate/auto/delete-all/out.test.toml b/acceptance/bundle/migrate/auto/delete-all/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/delete-all/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/auto/delete-all/output.txt b/acceptance/bundle/migrate/auto/delete-all/output.txt
new file mode 100644
index 00000000000..f03f24ba55e
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/delete-all/output.txt
@@ -0,0 +1,16 @@
+
+=== Replay a prior terraform deployment
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate
+
+=== Remove all resources, then deploy on direct: migrate and delete
+>>> [CLI] bundle deploy
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Migrated 1 resource to direct deployment engine.
+Deleted jobs.job_a
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 1 deleted, 0 unchanged
+
+=== Follow-up plan is a clean no-op
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 0 unchanged
diff --git a/acceptance/bundle/migrate/auto/delete-all/script b/acceptance/bundle/migrate/auto/delete-all/script
new file mode 100644
index 00000000000..dfda9de6c85
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/delete-all/script
@@ -0,0 +1,15 @@
+export DATABRICKS_BUNDLE_ENGINE=
+
+title "Replay a prior terraform deployment"
+trace replay_tfstate.py terraform-requests.json terraform.tfstate
+
+# Removing every resource leaves the migration with no config-declared resources, so
+# BuildStateFromTF records no WAL entries. The migration must still persist the seeded
+# terraform-state resources so the direct plan can delete them (otherwise Finalize would
+# write no state file and the migration would fail with a missing resources.json).
+title "Remove all resources, then deploy on direct: migrate and delete"
+echo '{"bundle": {"name": "test-bundle"}}' > databricks.yml
+trace $CLI bundle deploy
+
+title "Follow-up plan is a clean no-op"
+trace $CLI bundle plan | contains.py "0 to delete, 0 unchanged"
diff --git a/acceptance/bundle/migrate/auto/delete-all/terraform-requests.json b/acceptance/bundle/migrate/auto/delete-all/terraform-requests.json
new file mode 100644
index 00000000000..ede3d2b4e2d
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/delete-all/terraform-requests.json
@@ -0,0 +1,19 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "Job A",
+      "queue": {
+        "enabled": true
+      }
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/auto/delete-all/terraform.tfstate b/acceptance/bundle/migrate/auto/delete-all/terraform.tfstate
new file mode 100644
index 00000000000..d9b084cce37
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/delete-all/terraform.tfstate
@@ -0,0 +1,110 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "75222e93-2446-500e-da3b-173118f55649",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "job_a",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790614095029368000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "Job A",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790614095029368000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/engine-config-terraform/test.toml b/acceptance/bundle/migrate/auto/delete-all/test.toml
similarity index 100%
rename from acceptance/bundle/migrate/engine-config-terraform/test.toml
rename to acceptance/bundle/migrate/auto/delete-all/test.toml
diff --git a/acceptance/bundle/migrate/auto/delete/databricks.yml b/acceptance/bundle/migrate/auto/delete/databricks.yml
new file mode 100644
index 00000000000..858177a2dfb
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/delete/databricks.yml
@@ -0,0 +1,9 @@
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    job_keep:
+      name: "Keep Job"
+    job_drop: # TO_REMOVE
+      name: "Drop Job" # TO_REMOVE
diff --git a/acceptance/bundle/migrate/auto/delete/out.test.toml b/acceptance/bundle/migrate/auto/delete/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/delete/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/auto/delete/output.txt b/acceptance/bundle/migrate/auto/delete/output.txt
new file mode 100644
index 00000000000..7d6a7b04dd2
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/delete/output.txt
@@ -0,0 +1,16 @@
+
+=== Replay a prior terraform deployment
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate
+
+=== Drop one job from config, then deploy on direct: migrate two, delete the dropped one
+>>> [CLI] bundle deploy
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Migrated 2 resources to direct deployment engine.
+Deleted jobs.job_drop
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 1 deleted, 1 unchanged
+
+=== Follow-up plan is a clean no-op
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
diff --git a/acceptance/bundle/migrate/auto/delete/script b/acceptance/bundle/migrate/auto/delete/script
new file mode 100644
index 00000000000..19d1c9f1462
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/delete/script
@@ -0,0 +1,13 @@
+export DATABRICKS_BUNDLE_ENGINE=
+
+title "Replay a prior terraform deployment"
+trace replay_tfstate.py terraform-requests.json terraform.tfstate
+
+# The migration seeds every terraform-state resource into the direct state, so the
+# first direct plan can delete the ones the config no longer declares.
+title "Drop one job from config, then deploy on direct: migrate two, delete the dropped one"
+grep -v 'TO_REMOVE' databricks.yml > updated.yml && mv updated.yml databricks.yml
+trace $CLI bundle deploy
+
+title "Follow-up plan is a clean no-op"
+trace $CLI bundle plan | contains.py "1 unchanged"
diff --git a/acceptance/bundle/migrate/auto/delete/terraform-requests.json b/acceptance/bundle/migrate/auto/delete/terraform-requests.json
new file mode 100644
index 00000000000..f5b5b9b7d0c
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/delete/terraform-requests.json
@@ -0,0 +1,36 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "Keep Job",
+      "queue": {
+        "enabled": true
+      }
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "Drop Job",
+      "queue": {
+        "enabled": true
+      }
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/auto/delete/terraform.tfstate b/acceptance/bundle/migrate/auto/delete/terraform.tfstate
new file mode 100644
index 00000000000..21475705f5c
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/delete/terraform.tfstate
@@ -0,0 +1,210 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 3,
+  "lineage": "b1bd09de-e358-bfbf-88ed-3f2412c885b7",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "job_drop",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790614094719792000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "Drop Job",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790614094719792000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "job_keep",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790614094711879000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "Keep Job",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790614094711879000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/profile_arg/test.toml b/acceptance/bundle/migrate/auto/delete/test.toml
similarity index 100%
rename from acceptance/bundle/migrate/profile_arg/test.toml
rename to acceptance/bundle/migrate/auto/delete/test.toml
diff --git a/acceptance/bundle/migrate/auto/destroy/databricks.yml b/acceptance/bundle/migrate/auto/destroy/databricks.yml
new file mode 100644
index 00000000000..b13f958f575
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/destroy/databricks.yml
@@ -0,0 +1,7 @@
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    job_a:
+      name: "Job A"
diff --git a/acceptance/bundle/migrate/auto/destroy/out.test.toml b/acceptance/bundle/migrate/auto/destroy/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/destroy/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/auto/destroy/output.txt b/acceptance/bundle/migrate/auto/destroy/output.txt
new file mode 100644
index 00000000000..7022244297c
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/destroy/output.txt
@@ -0,0 +1,33 @@
+
+=== Replay a prior terraform deployment
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate
+
+=== Destroy without approval: migration prepared in memory then dropped, stays on terraform
+>>> musterr [CLI] bundle destroy
+Error: this command will destroy all resources deployed by this bundle, including workspace files in the deployment directory.
+Deleting data assets such as schemas, pipelines, or volumes may cause permanent data loss and should be carefully reviewed.
+To proceed, use --auto-approve.
+
+>>> find.py \.databricks/.*(\.tfstate|resources.*\.json|\.wal)
+.databricks/bundle/default/terraform/terraform.tfstate
+
+>>> MSYS_NO_PATHCONV=1 [CLI] workspace list /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state
+ID                   Type  Language  Path
+[OBJECT_ID]  FILE            /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate
+
+=== Destroy on direct: migrate then destroy
+>>> [CLI] bundle destroy --auto-approve
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+The following resources will be deleted:
+  delete resources.jobs.job_a
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Migrated 1 resource to direct deployment engine.
+Destroy: 1 deleted
+
+=== Destroy leaves no state behind: no local state files, remote deployment removed
+>>> find.py \.databricks/.*(\.tfstate|resources.*\.json|\.wal)
+
+>>> MSYS_NO_PATHCONV=1 musterr [CLI] workspace list /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state
+Error: Path (/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state) doesn't exist.
diff --git a/acceptance/bundle/migrate/auto/destroy/script b/acceptance/bundle/migrate/auto/destroy/script
new file mode 100644
index 00000000000..ec4954a9fd2
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/destroy/script
@@ -0,0 +1,30 @@
+export DATABRICKS_BUNDLE_ENGINE=
+
+# find.py lists matching files sorted with forward slashes (cross-platform); the regex matches only
+# state files (tfstate/.backup, resources*.json, WAL), excluding the terraform provider cache under
+# .terraform/. Paired with a remote listing of the state directory, this shows exactly which state
+# is present locally and remotely and proves nothing is left behind.
+
+title "Replay a prior terraform deployment"
+trace replay_tfstate.py terraform-requests.json terraform.tfstate
+replace_ids.py
+
+title "Destroy without approval: migration prepared in memory then dropped, stays on terraform"
+# The migration is prepared in memory (in process.go) before the destroy phase asks for approval,
+# so a refused destroy exercises the not-committed path. Nothing durable must be left behind: no
+# direct state, no migrating temp, no WAL - only the terraform state remains, local and remote.
+trace musterr $CLI bundle destroy
+trace find.py '\.databricks/.*(\.tfstate|resources.*\.json|\.wal)'
+trace MSYS_NO_PATHCONV=1 $CLI workspace list "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/test-bundle/default/state"
+
+# Destroy behaves like deploy: it migrates the terraform state to direct (writing the local
+# direct state), plan-checks it, and - once approved - destroys on the direct engine. destroyCore
+# then removes the local state files: the superseded terraform state first, then the direct state,
+# so a crash between the two never leaves a live terraform.tfstate with no direct state. A declined
+# destroy would discard the migration and stay on terraform.
+title "Destroy on direct: migrate then destroy"
+trace $CLI bundle destroy --auto-approve
+
+title "Destroy leaves no state behind: no local state files, remote deployment removed"
+trace find.py '\.databricks/.*(\.tfstate|resources.*\.json|\.wal)'
+trace MSYS_NO_PATHCONV=1 musterr $CLI workspace list "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/test-bundle/default/state"
diff --git a/acceptance/bundle/migrate/auto/destroy/terraform-requests.json b/acceptance/bundle/migrate/auto/destroy/terraform-requests.json
new file mode 100644
index 00000000000..ede3d2b4e2d
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/destroy/terraform-requests.json
@@ -0,0 +1,19 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "Job A",
+      "queue": {
+        "enabled": true
+      }
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/auto/destroy/terraform.tfstate b/acceptance/bundle/migrate/auto/destroy/terraform.tfstate
new file mode 100644
index 00000000000..3ee7ea61161
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/destroy/terraform.tfstate
@@ -0,0 +1,110 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "2e5d76d4-f80d-57cc-7203-c95306803b1c",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "job_a",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790614093535995000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "Job A",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790614093535995000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/var_arg/test.toml b/acceptance/bundle/migrate/auto/destroy/test.toml
similarity index 100%
rename from acceptance/bundle/migrate/var_arg/test.toml
rename to acceptance/bundle/migrate/auto/destroy/test.toml
diff --git a/acceptance/bundle/migrate/auto/direct-only-envvar/databricks.yml b/acceptance/bundle/migrate/auto/direct-only-envvar/databricks.yml
new file mode 100644
index 00000000000..8f2a40d4f2b
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/direct-only-envvar/databricks.yml
@@ -0,0 +1,7 @@
+bundle:
+  name: test-bundle
+
+resources:
+  #instance_pools: {pool: {instance_pool_name: "My Pool", node_type_id: "Standard_DS3_v2", idle_instance_autotermination_minutes: 60}}
+  jobs:
+    job_a: {name: "Job A"}
diff --git a/acceptance/bundle/migrate/auto/direct-only-envvar/out.test.toml b/acceptance/bundle/migrate/auto/direct-only-envvar/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/direct-only-envvar/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/auto/direct-only-envvar/output.txt b/acceptance/bundle/migrate/auto/direct-only-envvar/output.txt
new file mode 100644
index 00000000000..b069e473748
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/direct-only-envvar/output.txt
@@ -0,0 +1,33 @@
+
+=== Replay a prior terraform deployment
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate
+
+=== Add a direct-only resource to the config
+>>> update_file.py databricks.yml #instance_pools instance_pools
+
+=== Opt in via env var only: deploy migrates the state and creates the direct-only resource
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle deploy
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Migrated 1 resource to direct deployment engine.
+Created instance_pools.pool
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 1 unchanged
+
+>>> print_migration_telemetry
+direct_migrated_via_env true
+
+=== Redeploy is a no-op: state is already on the direct engine
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 2 unchanged
+
+>>> print_requests.py //instance-pools/create
+
+=== No further actions planned
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
diff --git a/acceptance/bundle/migrate/auto/direct-only-envvar/script b/acceptance/bundle/migrate/auto/direct-only-envvar/script
new file mode 100644
index 00000000000..d98281e937f
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/direct-only-envvar/script
@@ -0,0 +1,23 @@
+export DATABRICKS_BUNDLE_ENGINE=
+
+title "Replay a prior terraform deployment"
+trace replay_tfstate.py terraform-requests.json terraform.tfstate
+rm -f "$OUT_REQUESTS"
+
+title "Add a direct-only resource to the config"
+trace update_file.py databricks.yml "#instance_pools" "instance_pools"
+
+title "Opt in via env var only: deploy migrates the state and creates the direct-only resource"
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle deploy
+trace print_migration_telemetry
+rm -f "$OUT_REQUESTS"
+
+title "Redeploy is a no-op: state is already on the direct engine"
+trace $CLI bundle plan
+trace $CLI bundle deploy
+trace print_requests.py //instance-pools/create
+
+title "No further actions planned"
+trace $CLI bundle plan
+
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/migrate/auto/direct-only-envvar/terraform-requests.json b/acceptance/bundle/migrate/auto/direct-only-envvar/terraform-requests.json
new file mode 100644
index 00000000000..ede3d2b4e2d
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/direct-only-envvar/terraform-requests.json
@@ -0,0 +1,19 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "Job A",
+      "queue": {
+        "enabled": true
+      }
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/auto/direct-only-envvar/terraform.tfstate b/acceptance/bundle/migrate/auto/direct-only-envvar/terraform.tfstate
new file mode 100644
index 00000000000..41e3ff52664
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/direct-only-envvar/terraform.tfstate
@@ -0,0 +1,110 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "df0ab31f-787b-ce52-0046-2f55f43b1a55",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "job_a",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790614093628026000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "Job A",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790614093628026000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/auto/direct-only/databricks.yml b/acceptance/bundle/migrate/auto/direct-only/databricks.yml
new file mode 100644
index 00000000000..8f2a40d4f2b
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/direct-only/databricks.yml
@@ -0,0 +1,7 @@
+bundle:
+  name: test-bundle
+
+resources:
+  #instance_pools: {pool: {instance_pool_name: "My Pool", node_type_id: "Standard_DS3_v2", idle_instance_autotermination_minutes: 60}}
+  jobs:
+    job_a: {name: "Job A"}
diff --git a/acceptance/bundle/migrate/auto/direct-only/out.test.toml b/acceptance/bundle/migrate/auto/direct-only/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/direct-only/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/auto/direct-only/output.txt b/acceptance/bundle/migrate/auto/direct-only/output.txt
new file mode 100644
index 00000000000..10fcf4b0bc6
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/direct-only/output.txt
@@ -0,0 +1,58 @@
+
+=== Replay a prior terraform deployment
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate
+
+=== Add a direct-only resource and opt in to the direct engine via config
+>>> update_file.py databricks.yml #instance_pools instance_pools
+
+>>> update_file.py databricks.yml name: test-bundle name: test-bundle
+  engine: direct
+
+=== Plan runs on the direct engine (state migrated in memory), so the direct-only resource is planned
+>>> [CLI] bundle plan
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+create instance_pools.pool
+
+Plan: 1 to add, 0 to change, 0 to delete, 1 unchanged
+
+>>> [CLI] bundle plan -o json
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+json.plan.resources.instance_pools.pool.action = "create";
+json.plan.resources.instance_pools.pool.new_state.value.idle_instance_autotermination_minutes = 60;
+json.plan.resources.instance_pools.pool.new_state.value.instance_pool_name = "My Pool";
+json.plan.resources.instance_pools.pool.new_state.value.node_type_id = "Standard_DS3_v2";
+
+=== Plan does not commit state change, terraform stays
+>>> find.py \.databricks/.*(\.tfstate|resources.*\.json|\.wal)
+.databricks/bundle/default/terraform/terraform.tfstate
+
+>>> MSYS_NO_PATHCONV=1 [CLI] workspace list /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state
+ID                   Type  Language  Path
+[OBJECT_ID]  FILE            /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate
+
+=== Deploy commits the migration and creates the direct-only resource
+>>> [CLI] bundle deploy
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Migrated 1 resource to direct deployment engine.
+Created instance_pools.pool
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 1 unchanged
+
+>>> print_migration_telemetry
+direct_migrated_via_config true
+
+=== Redeploy is a no-op: state is already on the direct engine
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 2 unchanged
+
+>>> print_requests.py //instance-pools/create
+
+=== No further actions planned
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
diff --git a/acceptance/bundle/migrate/auto/direct-only/script b/acceptance/bundle/migrate/auto/direct-only/script
new file mode 100644
index 00000000000..2730c7ba5d9
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/direct-only/script
@@ -0,0 +1,31 @@
+export DATABRICKS_BUNDLE_ENGINE=
+
+title "Replay a prior terraform deployment"
+trace replay_tfstate.py terraform-requests.json terraform.tfstate
+rm -f "$OUT_REQUESTS"
+
+title "Add a direct-only resource and opt in to the direct engine via config"
+trace update_file.py databricks.yml "#instance_pools" "instance_pools"
+trace update_file.py databricks.yml "name: test-bundle" $'name: test-bundle\n  engine: direct'
+
+title "Plan runs on the direct engine (state migrated in memory), so the direct-only resource is planned"
+trace $CLI bundle plan
+trace $CLI bundle plan -o json | nostamp | gron.py | grep instance_pools
+title "Plan does not commit state change, terraform stays"
+trace find.py '\.databricks/.*(\.tfstate|resources.*\.json|\.wal)'
+trace MSYS_NO_PATHCONV=1 $CLI workspace list "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/test-bundle/default/state"
+
+title "Deploy commits the migration and creates the direct-only resource"
+trace $CLI bundle deploy
+trace print_migration_telemetry
+rm -f "$OUT_REQUESTS"
+
+title "Redeploy is a no-op: state is already on the direct engine"
+trace $CLI bundle plan
+trace $CLI bundle deploy
+trace print_requests.py //instance-pools/create
+
+title "No further actions planned"
+trace $CLI bundle plan
+
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/migrate/auto/direct-only/terraform-requests.json b/acceptance/bundle/migrate/auto/direct-only/terraform-requests.json
new file mode 100644
index 00000000000..ede3d2b4e2d
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/direct-only/terraform-requests.json
@@ -0,0 +1,19 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "Job A",
+      "queue": {
+        "enabled": true
+      }
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/auto/direct-only/terraform.tfstate b/acceptance/bundle/migrate/auto/direct-only/terraform.tfstate
new file mode 100644
index 00000000000..c1d5e382ae2
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/direct-only/terraform.tfstate
@@ -0,0 +1,110 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "06b4597d-82c3-9231-5fa6-08450cea3714",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "job_a",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790614093625257000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "Job A",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790614093625257000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/auto/dms-migration/databricks.yml b/acceptance/bundle/migrate/auto/dms-migration/databricks.yml
new file mode 100644
index 00000000000..eb60861a2b7
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/dms-migration/databricks.yml
@@ -0,0 +1,7 @@
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    test_job:
+      name: "Test Auto-Migrate DMS"
diff --git a/acceptance/bundle/migrate/auto/dms-migration/out.test.toml b/acceptance/bundle/migrate/auto/dms-migration/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/dms-migration/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/auto/dms-migration/output.txt b/acceptance/bundle/migrate/auto/dms-migration/output.txt
new file mode 100644
index 00000000000..ba6f36cc8bf
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/dms-migration/output.txt
@@ -0,0 +1,20 @@
+
+=== Replay a prior terraform deployment (captured from a real terraform run)
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate
+
+=== Direct + deployment-history requested against a terraform state is rejected before commit
+>>> DATABRICKS_BUNDLE_ENGINE=direct DATABRICKS_BUNDLE_DEPLOYMENT_HISTORY=true errcode [CLI] bundle deploy
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Error: deployment history setting (true) does not match the existing state (false)
+
+Update experimental.deployment_history to match the existing deployment, or run "databricks bundle destroy" to start over
+
+
+Exit code: 1
+
+>>> find.py \.databricks/.*(\.tfstate|resources.*\.json|\.wal)
+.databricks/bundle/default/terraform/terraform.tfstate
+
+>>> MSYS_NO_PATHCONV=1 [CLI] workspace list /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state
+ID                   Type  Language  Path
+[OBJECT_ID]  FILE            /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate
diff --git a/acceptance/bundle/migrate/auto/dms-migration/script b/acceptance/bundle/migrate/auto/dms-migration/script
new file mode 100644
index 00000000000..7ef1ca09f94
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/dms-migration/script
@@ -0,0 +1,14 @@
+export DATABRICKS_BUNDLE_ENGINE=
+
+title "Replay a prior terraform deployment (captured from a real terraform run)"
+trace replay_tfstate.py terraform-requests.json terraform.tfstate
+rm -f "$OUT_REQUESTS"
+
+title "Direct + deployment-history requested against a terraform state is rejected before commit"
+# Migration produces a plain direct state (no deployment_history feature), so requesting
+# deployment history while migrating is a mismatch. It is rejected after the in-memory migration
+# but before CommitMigration writes or pushes anything, so the bundle stays on terraform with no
+# leaked direct state - migrate first (plain deploy), then enable deployment history.
+trace DATABRICKS_BUNDLE_ENGINE=direct DATABRICKS_BUNDLE_DEPLOYMENT_HISTORY=true errcode $CLI bundle deploy
+trace find.py '\.databricks/.*(\.tfstate|resources.*\.json|\.wal)'
+trace MSYS_NO_PATHCONV=1 $CLI workspace list "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/test-bundle/default/state"
diff --git a/acceptance/bundle/migrate/auto/dms-migration/terraform-requests.json b/acceptance/bundle/migrate/auto/dms-migration/terraform-requests.json
new file mode 100644
index 00000000000..5703aa863ef
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/dms-migration/terraform-requests.json
@@ -0,0 +1,19 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "Test Auto-Migrate DMS",
+      "queue": {
+        "enabled": true
+      }
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/auto/dms-migration/terraform.tfstate b/acceptance/bundle/migrate/auto/dms-migration/terraform.tfstate
new file mode 100644
index 00000000000..27ce97659cd
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/dms-migration/terraform.tfstate
@@ -0,0 +1,110 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "99f0db23-4ab4-72e5-f20f-bd69f4e61594",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "test_job",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790613892172219000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "Test Auto-Migrate DMS",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790613892172219000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/auto/empty-plan-missing/databricks.yml b/acceptance/bundle/migrate/auto/empty-plan-missing/databricks.yml
new file mode 100644
index 00000000000..576d7a9ef25
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/empty-plan-missing/databricks.yml
@@ -0,0 +1,2 @@
+bundle:
+  name: test-bundle
diff --git a/acceptance/bundle/migrate/auto/empty-plan-missing/out.test.toml b/acceptance/bundle/migrate/auto/empty-plan-missing/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/empty-plan-missing/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/auto/empty-plan-missing/output.txt b/acceptance/bundle/migrate/auto/empty-plan-missing/output.txt
new file mode 100644
index 00000000000..795b9d599d4
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/empty-plan-missing/output.txt
@@ -0,0 +1,12 @@
+
+=== deploy --plan with a missing plan file fails after the empty migration prepared the direct state
+>>> DATABRICKS_BUNDLE_ENGINE=direct errcode [CLI] bundle deploy --plan does-not-exist.json
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Error: reading plan file: open does-not-exist.json: no such file or directory
+
+
+Exit code: 1
+
+=== Terraform state is untouched - the empty migration was never committed or swept
+>>> find.py \.databricks/.*(\.tfstate|resources.*\.json|\.wal)
+.databricks/bundle/default/terraform/terraform.tfstate
diff --git a/acceptance/bundle/migrate/auto/empty-plan-missing/script b/acceptance/bundle/migrate/auto/empty-plan-missing/script
new file mode 100644
index 00000000000..e6c0e7bf5a3
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/empty-plan-missing/script
@@ -0,0 +1,17 @@
+export DATABRICKS_BUNDLE_ENGINE=
+
+# Seed an empty terraform state (no databricks_* resources) as the existing state.
+mkdir -p .databricks/bundle/default/terraform
+cat > .databricks/bundle/default/terraform/terraform.tfstate <<'EOF'
+{"version": 4, "serial": 1, "lineage": "test-lineage", "resources": []}
+EOF
+
+title "deploy --plan with a missing plan file fails after the empty migration prepared the direct state"
+# The empty-state migration runs in memory like any other: it converts the state but writes and
+# backs up nothing until CommitMigration. A missing --plan file fails before approval, so the
+# in-memory migration is dropped and the bundle stays on terraform - proving the empty sweep is
+# gated by commit, not done unconditionally up front.
+trace DATABRICKS_BUNDLE_ENGINE=direct errcode $CLI bundle deploy --plan does-not-exist.json
+
+title "Terraform state is untouched - the empty migration was never committed or swept"
+trace find.py '\.databricks/.*(\.tfstate|resources.*\.json|\.wal)'
diff --git a/acceptance/bundle/migrate/auto/empty-plan-missing/test.toml b/acceptance/bundle/migrate/auto/empty-plan-missing/test.toml
new file mode 100644
index 00000000000..455a6a5c9bf
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/empty-plan-missing/test.toml
@@ -0,0 +1,5 @@
+# Normalize the Windows os.Open error so this migration-discard test runs on all platforms
+# (the discard file operations it exercises are worth covering on Windows too).
+[[Repls]]
+Old = "open does-not-exist.json: The system cannot find the file specified."
+New = "open does-not-exist.json: no such file or directory"
diff --git a/acceptance/bundle/migrate/auto/empty-tfstate/databricks.yml b/acceptance/bundle/migrate/auto/empty-tfstate/databricks.yml
new file mode 100644
index 00000000000..bd74d8e74b9
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/empty-tfstate/databricks.yml
@@ -0,0 +1,3 @@
+bundle:
+  name: test-bundle
+  engine: direct
diff --git a/acceptance/bundle/migrate/auto/empty-tfstate/out.test.toml b/acceptance/bundle/migrate/auto/empty-tfstate/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/empty-tfstate/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/auto/empty-tfstate/output.txt b/acceptance/bundle/migrate/auto/empty-tfstate/output.txt
new file mode 100644
index 00000000000..2569d95ccfb
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/empty-tfstate/output.txt
@@ -0,0 +1,46 @@
+
+=== Deploy with bundle.engine: direct and an empty terraform state — migrate (0 resources)
+>>> [CLI] bundle deploy
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Migrated 0 resources to direct deployment engine.
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Empty state migrated: resources.json written, local terraform state backed up
+
+>>> find.py \.databricks/.*(\.tfstate|resources.*\.json|\.wal)
+.databricks/bundle/default/resources.json
+.databricks/bundle/default/terraform/terraform.tfstate.backup
+
+=== Migration is recorded in telemetry as via-config
+
+>>> print_migration_telemetry
+direct_migrated_via_config true
+
+=== The remote had no terraform state, so nothing terraform-related is backed up remotely
+
+>>> print_requests.py //workspace/import //workspace/delete --sort
+"POST /api/2.0/workspace/delete"
+"POST /api/2.0/workspace/delete"
+"POST /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/databricks.yml"
+"POST /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock"
+"POST /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock"
+"POST /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deployment.json"
+"POST /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+"POST /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/resources.json"
+"POST /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/resources.json"
+
+=== debug states confirms no terraform.tfstate anywhere; only the local .backup remains
+
+>>> [CLI] bundle debug states --force-pull
+resources.json: remote direct state serial=2 lineage="test-lineage"
+[TEST_TMP_DIR]/.databricks/bundle/default/resources.json: local direct state serial=2 lineage="test-lineage"
+
+=== Next deploy uses direct engine by default (no more mismatch warning, no re-migration)
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_migration_telemetry
diff --git a/acceptance/bundle/migrate/auto/empty-tfstate/script b/acceptance/bundle/migrate/auto/empty-tfstate/script
new file mode 100644
index 00000000000..c0df01e54ec
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/empty-tfstate/script
@@ -0,0 +1,31 @@
+# A terraform.tfstate with no databricks_* resources goes through the same migration path as a
+# populated one: the converter writes an empty direct base state, the approved deploy commits it,
+# and the superseded terraform state is backed up. (There is no special "sweep" branch - empty and
+# populated states share one code path.) The empty terraform state here exists only locally (never
+# pushed), so nothing terraform-related is backed up remotely; the populated tests cover that.
+
+mkdir -p .databricks/bundle/default/terraform
+cat > .databricks/bundle/default/terraform/terraform.tfstate <<'EOF'
+{"version": 4, "serial": 1, "lineage": "test-lineage", "resources": []}
+EOF
+
+title "Deploy with bundle.engine: direct and an empty terraform state — migrate (0 resources)"
+trace $CLI bundle deploy 2>&1 | contains.py 'Migrated 0 resources to direct deployment engine.'
+
+title "Empty state migrated: resources.json written, local terraform state backed up\n"
+trace find.py '\.databricks/.*(\.tfstate|resources.*\.json|\.wal)'
+
+title "Migration is recorded in telemetry as via-config\n"
+trace print_migration_telemetry
+
+title "The remote had no terraform state, so nothing terraform-related is backed up remotely\n"
+trace print_requests.py //workspace/import //workspace/delete --sort | jq '.method + " " + (.body.multipart_form.path // .path)' | contains.py '!terraform.tfstate'
+
+title "debug states confirms no terraform.tfstate anywhere; only the local .backup remains\n"
+trace $CLI bundle debug states --force-pull
+
+title "Next deploy uses direct engine by default (no more mismatch warning, no re-migration)"
+trace $CLI bundle deploy 2>&1 | contains.py '!does not match the existing state'
+trace print_migration_telemetry
+
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/migrate/auto/envvar/databricks.yml b/acceptance/bundle/migrate/auto/envvar/databricks.yml
new file mode 100644
index 00000000000..7acc0c3576e
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/envvar/databricks.yml
@@ -0,0 +1,7 @@
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    test_job:
+      name: "Test Auto-Migrate Job"
diff --git a/acceptance/bundle/migrate/auto/envvar/out.test.toml b/acceptance/bundle/migrate/auto/envvar/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/envvar/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/auto/envvar/output.txt b/acceptance/bundle/migrate/auto/envvar/output.txt
new file mode 100644
index 00000000000..e67cc31e1c9
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/envvar/output.txt
@@ -0,0 +1,29 @@
+
+=== Replay a prior terraform deployment
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate
+
+=== Opt in via env var only (no bundle.engine in config): auto-migration triggers
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle deploy
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Migrated 1 resource to direct deployment engine.
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
+
+>>> print_migration_telemetry
+direct_migrated_via_env true
+
+>>> print_requests.py
+engine/direct
+
+=== Direct-engine state is now in place; terraform state is backed up
+
+>>> find.py \.databricks/.*(\.tfstate|resources.*\.json|\.wal)
+.databricks/bundle/default/resources.json
+.databricks/bundle/default/terraform/terraform.tfstate.backup
+
+=== Remote state also reflects the migration (force-pull surfaces workspace state)
+
+>>> [CLI] bundle debug states --force-pull
+resources.json: remote direct state serial=3 lineage="[UUID]"
+[TEST_TMP_DIR]/.databricks/bundle/default/resources.json: local direct state serial=3 lineage="[UUID]"
diff --git a/acceptance/bundle/migrate/auto/envvar/script b/acceptance/bundle/migrate/auto/envvar/script
new file mode 100644
index 00000000000..f704b02f97c
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/envvar/script
@@ -0,0 +1,22 @@
+export DATABRICKS_BUNDLE_ENGINE=
+
+title "Replay a prior terraform deployment"
+trace replay_tfstate.py terraform-requests.json terraform.tfstate
+rm -f "$OUT_REQUESTS"
+
+title "Opt in via env var only (no bundle.engine in config): auto-migration triggers"
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle deploy
+trace print_migration_telemetry
+# The migrated deploy runs on the direct engine, so its requests carry engine/direct only.
+# A stale engine/terraform here would mean the user-agent engine tag was appended rather
+# than resolved once (the SDK user agent cannot replace an existing dimension).
+trace print_requests.py | grep -o 'engine/[a-z]*' | sort -u
+rm -f "$OUT_REQUESTS"
+
+title "Direct-engine state is now in place; terraform state is backed up\n"
+trace find.py '\.databricks/.*(\.tfstate|resources.*\.json|\.wal)'
+
+title "Remote state also reflects the migration (force-pull surfaces workspace state)\n"
+trace $CLI bundle debug states --force-pull
+
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/migrate/auto/envvar/terraform-requests.json b/acceptance/bundle/migrate/auto/envvar/terraform-requests.json
new file mode 100644
index 00000000000..6482593b189
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/envvar/terraform-requests.json
@@ -0,0 +1,19 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "Test Auto-Migrate Job",
+      "queue": {
+        "enabled": true
+      }
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/auto/envvar/terraform.tfstate b/acceptance/bundle/migrate/auto/envvar/terraform.tfstate
new file mode 100644
index 00000000000..3ce9175fa48
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/envvar/terraform.tfstate
@@ -0,0 +1,110 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "01cad7c2-9ba4-5e4e-0624-f39165c6a547",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "test_job",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790614094101726000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "Test Auto-Migrate Job",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790614094101726000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/auto/new-resource-ref/databricks.yml b/acceptance/bundle/migrate/auto/new-resource-ref/databricks.yml
new file mode 100644
index 00000000000..b78d8f2a865
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/new-resource-ref/databricks.yml
@@ -0,0 +1,35 @@
+bundle:
+  name: test-bundle
+
+resources:
+  # alerts:
+  #   new_alert:
+  #     display_name: "New alert"
+  #     query_text: "select 2"
+  #     warehouse_id: "${var.warehouse_id}"
+  #     evaluation:
+  #       comparison_operator: EQUAL
+  #       notification:
+  #         retrigger_seconds: 300
+  #       source:
+  #         name: "1"
+  #       threshold:
+  #         value:
+  #           double_value: 1.3
+  #     schedule:
+  #       pause_status: UNPAUSED
+  #       quartz_cron_schedule: "44 19 */1 * * ?"
+  #       timezone_id: Europe/Amsterdam
+
+  jobs:
+    test_job:
+      name: "Test Auto-Migrate Job"
+      # timeout_seconds: ${resources.alerts.new_alert.evaluation.notification.retrigger_seconds}
+      # tasks:
+      #   - task_key: check
+      #     alert_task:
+      #       alert_id: "${resources.alerts.new_alert.id}"
+
+variables:
+  warehouse_id:
+    description: Set via BUNDLE_VAR_warehouse_id
diff --git a/acceptance/bundle/migrate/auto/new-resource-ref/out.test.toml b/acceptance/bundle/migrate/auto/new-resource-ref/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/new-resource-ref/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/auto/new-resource-ref/output.txt b/acceptance/bundle/migrate/auto/new-resource-ref/output.txt
new file mode 100644
index 00000000000..e3c122f31c1
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/new-resource-ref/output.txt
@@ -0,0 +1,175 @@
+
+=== Replay a prior terraform deployment of a job only
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate
+
+=== Add a new alert and a job task that references it
+=== Plan shows the new alert and the job update (the terraform state is migrated in memory)
+>>> [CLI] bundle plan -o json
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 3,
+  "plan": {
+    "resources.alerts.new_alert": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "display_name": "New alert",
+          "evaluation": {
+            "comparison_operator": "EQUAL",
+            "notification": {
+              "retrigger_seconds": 300
+            },
+            "source": {
+              "name": "1"
+            },
+            "threshold": {
+              "value": {
+                "double_value": 1.3
+              }
+            }
+          },
+          "parent_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/resources",
+          "query_text": "select 2",
+          "schedule": {
+            "pause_status": "UNPAUSED",
+            "quartz_cron_schedule": "44 19 */1 * * ?",
+            "timezone_id": "Europe/Amsterdam"
+          },
+          "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
+        }
+      }
+    },
+    "resources.jobs.test_job": {
+      "depends_on": [
+        {
+          "node": "resources.alerts.new_alert",
+          "label": "${resources.alerts.new_alert.evaluation.notification.retrigger_seconds}"
+        },
+        {
+          "node": "resources.alerts.new_alert",
+          "label": "${resources.alerts.new_alert.id}"
+        }
+      ],
+      "action": "update",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "Test Auto-Migrate Job",
+          "queue": {
+            "enabled": true
+          },
+          "tasks": [
+            {
+              "alert_task": {
+                "alert_id": "${resources.alerts.new_alert.id}"
+              },
+              "task_key": "check"
+            }
+          ],
+          "timeout_seconds": 300
+        },
+        "vars": {
+          "tasks[0].alert_task.alert_id": "${resources.alerts.new_alert.id}"
+        }
+      },
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_id": [TEST_JOB_ID],
+        "max_concurrent_runs": 1,
+        "name": "Test Auto-Migrate Job",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "timeout_seconds": 0,
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks": {
+          "action": "update",
+          "old": [
+            {
+              "alert_task": {
+                "alert_id": ""
+              },
+              "task_key": "check"
+            }
+          ],
+          "new": [
+            {
+              "alert_task": {
+                "alert_id": "${resources.alerts.new_alert.id}"
+              },
+              "task_key": "check"
+            }
+          ]
+        },
+        "tasks[task_key='check'].alert_task.alert_id": {
+          "action": "update",
+          "old": "",
+          "new": "${resources.alerts.new_alert.id}"
+        },
+        "timeout_seconds": {
+          "action": "update",
+          "new": 300,
+          "remote": 0
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    }
+  }
+}
+
+=== Deploy migrates to direct, creates the alert and updates the job
+>>> [CLI] bundle deploy
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Migrated 1 resource to direct deployment engine.
+Created alerts.new_alert
+Updated jobs.test_job
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 1 changed, 0 deleted, 0 unchanged
+
+=== The job update carries the new alert id and timeout
+>>> print_requests.py //api/2.2/jobs/reset
+json.body.new_settings.tasks[0].alert_task.alert_id = "[NEW_ALERT_ID]";
+json.body.new_settings.timeout_seconds = 300;
+
+=== Redeploy is a no-op
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.alerts.new_alert
+  delete resources.jobs.test_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/migrate/auto/new-resource-ref/script b/acceptance/bundle/migrate/auto/new-resource-ref/script
new file mode 100644
index 00000000000..d2e16d8ef9c
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/new-resource-ref/script
@@ -0,0 +1,31 @@
+export DATABRICKS_BUNDLE_ENGINE=
+export BUNDLE_VAR_warehouse_id=$TEST_DEFAULT_WAREHOUSE_ID
+
+title "Replay a prior terraform deployment of a job only"
+trace replay_tfstate.py terraform-requests.json terraform.tfstate
+rm -f "$OUT_REQUESTS"
+
+# The job gains an alert_task that references a new alert, neither of which terraform ever deployed.
+# Neither the job's terraform state nor the alert has the referenced id, so the migration must not
+# try to resolve it.
+title "Add a new alert and a job task that references it"
+# Uncomment the alert, the task and timeout_seconds (a number field with a reference) in databricks.yml.
+update_file.py databricks.yml '# ' ''
+
+title "Plan shows the new alert and the job update (the terraform state is migrated in memory)"
+trace $CLI bundle plan -o json
+rm -f "$OUT_REQUESTS"
+
+title "Deploy migrates to direct, creates the alert and updates the job"
+trace $CLI bundle deploy
+replace_ids.py
+
+title "The job update carries the new alert id and timeout"
+trace print_requests.py //api/2.2/jobs/reset | gron.py | grep -E "alert_id|timeout_seconds"
+rm -f "$OUT_REQUESTS"
+
+title "Redeploy is a no-op"
+trace $CLI bundle plan
+
+trace $CLI bundle destroy --auto-approve
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/migrate/auto/new-resource-ref/terraform-requests.json b/acceptance/bundle/migrate/auto/new-resource-ref/terraform-requests.json
new file mode 100644
index 00000000000..6482593b189
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/new-resource-ref/terraform-requests.json
@@ -0,0 +1,19 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "Test Auto-Migrate Job",
+      "queue": {
+        "enabled": true
+      }
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/auto/new-resource-ref/terraform.tfstate b/acceptance/bundle/migrate/auto/new-resource-ref/terraform.tfstate
new file mode 100644
index 00000000000..c04f332a595
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/new-resource-ref/terraform.tfstate
@@ -0,0 +1,110 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "c39488aa-8f36-06fd-a7cb-3f0c95b4c506",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "test_job",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790612527183335000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "Test Auto-Migrate Job",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790612527183335000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/auto/new-resource-ref/test.toml b/acceptance/bundle/migrate/auto/new-resource-ref/test.toml
new file mode 100644
index 00000000000..34dd8bbcbda
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/new-resource-ref/test.toml
@@ -0,0 +1,9 @@
+# Local-only: the replay fixtures are captured against the fake server, so they reproduce a
+# terraform state only there, not on a real workspace (replaying them on cloud fails auth and
+# hits backend validation the mock does not enforce).
+Cloud = false
+RecordRequests = true
+
+Ignore = [
+    ".databricks",
+]
diff --git a/acceptance/bundle/migrate/auto/pipeline-storage-change/databricks.yml.tmpl b/acceptance/bundle/migrate/auto/pipeline-storage-change/databricks.yml.tmpl
new file mode 100644
index 00000000000..cf02ed35516
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/pipeline-storage-change/databricks.yml.tmpl
@@ -0,0 +1,15 @@
+bundle:
+  name: uc-pipeline-$UNIQUE_NAME
+
+workspace:
+  root_path: ~/.bundle/$UNIQUE_NAME
+
+resources:
+  pipelines:
+    my_pipeline:
+      name: pipeline-$UNIQUE_NAME
+      storage: dbfs:/pipelines/$UNIQUE_NAME-init
+      libraries:
+        - notebook:
+            path: ./nb.sql
+      development: true
diff --git a/acceptance/bundle/migrate/auto/pipeline-storage-change/nb.sql b/acceptance/bundle/migrate/auto/pipeline-storage-change/nb.sql
new file mode 100644
index 00000000000..199ff507884
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/pipeline-storage-change/nb.sql
@@ -0,0 +1,2 @@
+-- Databricks notebook source
+select 1
diff --git a/acceptance/bundle/migrate/auto/pipeline-storage-change/out.test.toml b/acceptance/bundle/migrate/auto/pipeline-storage-change/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/pipeline-storage-change/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/auto/pipeline-storage-change/output.txt b/acceptance/bundle/migrate/auto/pipeline-storage-change/output.txt
new file mode 100644
index 00000000000..7e5d258fdf0
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/pipeline-storage-change/output.txt
@@ -0,0 +1,73 @@
+
+=== Replay the prior terraform deployment (captured from a real terraform run)
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate
+
+=== Change immutable storage. Without --auto-approve the recreate is refused
+>>> DATABRICKS_BUNDLE_ENGINE=direct errcode [CLI] bundle deploy
+Warning: The "development" property of pipelines is deprecated. Use "mode: development" in your databricks.yml instead. See https://docs.databricks.com/dev-tools/bundles/deployment-modes.
+  at resources.pipelines.my_pipeline.development
+  in databricks.yml:15:20
+
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+
+This action will result in the deletion or recreation of the following Lakeflow Spark Declarative Pipelines along with the
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Recreating the pipelines will
+restore the defined STs and MVs through full refresh. Note that recreation is necessary when pipeline
+properties such as the 'catalog' or 'storage' are changed:
+  recreate resources.pipelines.my_pipeline
+Warn: Migration not committed, keeping Terraform state
+Error: the deployment requires destructive actions, but the current console does not support prompting.
+Deleting data assets such as schemas, pipelines, or volumes may cause permanent data loss and should be carefully reviewed.
+To proceed, use --auto-approve after reviewing the plan above.
+
+Files: 3 uploaded, 0 deleted
+
+Exit code: 1
+
+>>> print_migration_telemetry
+direct_migrate_recreate_planned true
+
+>>> find.py \.databricks/.*(\.tfstate|resources.*\.json|\.wal)
+.databricks/bundle/default/terraform/terraform.tfstate
+
+=== With --auto-approve the recreate is applied on direct
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle deploy --auto-approve
+Warning: The "development" property of pipelines is deprecated. Use "mode: development" in your databricks.yml instead. See https://docs.databricks.com/dev-tools/bundles/deployment-modes.
+  at resources.pipelines.my_pipeline.development
+  in databricks.yml:15:20
+
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+
+This action will result in the deletion or recreation of the following Lakeflow Spark Declarative Pipelines along with the
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Recreating the pipelines will
+restore the defined STs and MVs through full refresh. Note that recreation is necessary when pipeline
+properties such as the 'catalog' or 'storage' are changed:
+  recreate resources.pipelines.my_pipeline
+Migrated 1 resource to direct deployment engine.
+Recreated pipelines.my_pipeline
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 0 unchanged
+
+=== Local state is now direct
+>>> find.py \.databricks/.*(\.tfstate|resources.*\.json|\.wal)
+.databricks/bundle/default/resources.json
+.databricks/bundle/default/terraform/terraform.tfstate.backup
+
+=== Cleanup
+>>> [CLI] bundle destroy --auto-approve
+Warning: The "development" property of pipelines is deprecated. Use "mode: development" in your databricks.yml instead. See https://docs.databricks.com/dev-tools/bundles/deployment-modes.
+  at resources.pipelines.my_pipeline.development
+  in databricks.yml:15:20
+
+The following resources will be deleted:
+  delete resources.pipelines.my_pipeline
+
+This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:
+  delete resources.pipelines.my_pipeline
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/migrate/auto/pipeline-storage-change/script b/acceptance/bundle/migrate/auto/pipeline-storage-change/script
new file mode 100644
index 00000000000..7f1172b1ad2
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/pipeline-storage-change/script
@@ -0,0 +1,34 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+  title "Cleanup"
+  trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+title "Replay the prior terraform deployment (captured from a real terraform run)"
+trace replay_tfstate.py terraform-requests.json terraform.tfstate
+rm -f "$OUT_REQUESTS"
+
+title "Change immutable storage. Without --auto-approve the recreate is refused"
+# storage is a recreate_on_changes field on pipelines (not an id field). The migration's plan
+# compares the new config value against the deployed remote and plans a recreate. Pipelines are
+# in the destructive-approval group, so without --auto-approve the deploy refuses it (exit 1)
+# and the migration is not committed.
+update_file.py databricks.yml "$UNIQUE_NAME-init" "$UNIQUE_NAME-changed"
+trace DATABRICKS_BUNDLE_ENGINE=direct errcode $CLI bundle deploy
+trace print_migration_telemetry
+trace find.py '\.databricks/.*(\.tfstate|resources.*\.json|\.wal)'
+
+title "With --auto-approve the recreate is applied on direct"
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle deploy --auto-approve
+
+# No clean-redeploy assertion here: on a real workspace a direct-engine pipeline recreate
+# leaves a field the next plan re-updates ("1 changed"), while the testserver converges
+# ("1 unchanged"). That post-recreate convergence is a direct-engine pipeline concern
+# orthogonal to migration, and a single golden can't match both engines, so the test stops
+# after applying the recreate. The schema / registered-model recreate tests cover the
+# clean-redeploy path on cloud.
+
+title "Local state is now direct"
+trace find.py '\.databricks/.*(\.tfstate|resources.*\.json|\.wal)'
diff --git a/acceptance/bundle/migrate/auto/pipeline-storage-change/terraform-requests.json b/acceptance/bundle/migrate/auto/pipeline-storage-change/terraform-requests.json
new file mode 100644
index 00000000000..5297a9d03dd
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/pipeline-storage-change/terraform-requests.json
@@ -0,0 +1,24 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.0/pipelines",
+    "body": {
+      "channel": "CURRENT",
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/[UNIQUE_NAME]/state/metadata.json"
+      },
+      "development": true,
+      "edition": "ADVANCED",
+      "libraries": [
+        {
+          "notebook": {
+            "path": "/Workspace/Users/tester@databricks.com/.bundle/[UNIQUE_NAME]/files/nb"
+          }
+        }
+      ],
+      "name": "pipeline-[UNIQUE_NAME]",
+      "storage": "dbfs:/pipelines/[UNIQUE_NAME]-init"
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/auto/pipeline-storage-change/terraform.tfstate b/acceptance/bundle/migrate/auto/pipeline-storage-change/terraform.tfstate
new file mode 100644
index 00000000000..472777cce39
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/pipeline-storage-change/terraform.tfstate
@@ -0,0 +1,92 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "fd53c428-e47e-504a-18bc-74d100d9f9ab",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_pipeline",
+      "name": "my_pipeline",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "allow_duplicate_names": false,
+            "budget_policy_id": null,
+            "catalog": null,
+            "cause": null,
+            "channel": "CURRENT",
+            "cluster": [],
+            "cluster_id": null,
+            "configuration": null,
+            "continuous": false,
+            "creator_user_name": "tester@databricks.com",
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/[UNIQUE_NAME]/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "development": true,
+            "edition": "ADVANCED",
+            "environment": [],
+            "event_log": [],
+            "expected_last_modified": 0,
+            "filters": [],
+            "gateway_definition": [],
+            "health": null,
+            "id": "79fe88b1-3ff7-b470-79fe-88b13ff7b471",
+            "ingestion_definition": [],
+            "last_modified": 1790613817537,
+            "latest_updates": null,
+            "library": [
+              {
+                "file": [],
+                "glob": [],
+                "jar": "",
+                "maven": [],
+                "notebook": [
+                  {
+                    "path": "/Workspace/Users/tester@databricks.com/.bundle/[UNIQUE_NAME]/files/nb"
+                  }
+                ],
+                "whl": ""
+              }
+            ],
+            "name": "pipeline-[UNIQUE_NAME]",
+            "notification": [],
+            "photon": false,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "restart_window": [],
+            "root_path": null,
+            "run_as": [],
+            "run_as_user_name": "tester@databricks.com",
+            "schema": null,
+            "serverless": false,
+            "serverless_compute_id": null,
+            "state": "IDLE",
+            "storage": "dbfs:/pipelines/[UNIQUE_NAME]-init",
+            "tags": null,
+            "target": null,
+            "timeouts": null,
+            "trigger": [],
+            "url": "[DATABRICKS_URL]/#joblist/pipelines/79fe88b1-3ff7-b470-79fe-88b13ff7b471",
+            "usage_policy_id": null
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxMjAwMDAwMDAwMDAwLCJkZWZhdWx0IjoxMjAwMDAwMDAwMDAwLCJkZWxldGUiOjEyMDAwMDAwMDAwMDAsInJlYWQiOjEyMDAwMDAwMDAwMDAsInVwZGF0ZSI6MTIwMDAwMDAwMDAwMH19"
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/auto/pipeline-storage-change/test.toml b/acceptance/bundle/migrate/auto/pipeline-storage-change/test.toml
new file mode 100644
index 00000000000..6880cf5c651
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/pipeline-storage-change/test.toml
@@ -0,0 +1,10 @@
+# Local-only: the replay fixtures are captured against the fake server, so they reproduce a
+# terraform state only there, not on a real workspace (replaying them on cloud fails auth and
+# hits backend validation the mock does not enforce).
+Cloud = false
+RecordRequests = true
+
+Ignore = [
+    ".databricks",
+    "databricks.yml",
+]
diff --git a/acceptance/bundle/migrate/auto/plan-failure/databricks.yml b/acceptance/bundle/migrate/auto/plan-failure/databricks.yml
new file mode 100644
index 00000000000..8eed9482e74
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/plan-failure/databricks.yml
@@ -0,0 +1,7 @@
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    test_job:
+      name: "Test Auto-Migrate Plan Failure"
diff --git a/acceptance/bundle/migrate/auto/plan-failure/out.test.toml b/acceptance/bundle/migrate/auto/plan-failure/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/plan-failure/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/auto/plan-failure/output.txt b/acceptance/bundle/migrate/auto/plan-failure/output.txt
new file mode 100644
index 00000000000..343ba610c1d
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/plan-failure/output.txt
@@ -0,0 +1,50 @@
+
+=== Replay a prior terraform deployment (captured from a real terraform run)
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate
+
+>>> print_migration_telemetry
+
+=== Inject GET failure so the migration plan check fails: migration hard-errors (no terraform fallback)
+>>> DATABRICKS_BUNDLE_ENGINE=direct musterr [CLI] bundle deploy
+Warn: migration to direct: cannot plan resources.jobs.test_job: reading id="[TEST_JOB_ID]": Fault injected by test. (403 INJECTED): Endpoint: GET [DATABRICKS_URL]/api/2.2/jobs/get?job_id=[TEST_JOB_ID]
+HTTP Status: 403 Forbidden
+API error_code: INJECTED
+API message: Fault injected by test.
+Error: migrating Terraform state to the direct engine: the migrated state failed its plan check: planning failed
+
+The Terraform deployment engine was removed in Databricks CLI v1.20.0. Auto-migration of your bundle failed. Install Databricks CLI v1.19.x to deploy on Terraform, and please report this to dabs-feedback@databricks.com
+
+
+>>> print_migration_telemetry
+direct_migrate_plan_error true
+
+=== Local state was NOT rewritten (still terraform)
+>>> find.py \.databricks/.*(\.tfstate|resources.*\.json|\.wal)
+.databricks/bundle/default/terraform/terraform.tfstate
+
+>>> MSYS_NO_PATHCONV=1 [CLI] workspace list /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state
+ID                   Type  Language  Path
+[OBJECT_ID]  FILE            /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate
+
+=== Retry: plan check passes this time, migration succeeds
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle deploy
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Migrated 1 resource to direct deployment engine.
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
+
+>>> print_migration_telemetry
+direct_migrated_via_env true
+
+=== Local state is now direct
+>>> find.py \.databricks/.*(\.tfstate|resources.*\.json|\.wal)
+.databricks/bundle/default/resources.json
+.databricks/bundle/default/terraform/terraform.tfstate.backup
+
+>>> MSYS_NO_PATHCONV=1 [CLI] workspace list /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state
+ID                   Type  Language  Path
+[OBJECT_ID]  FILE            /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deployment.json
+[OBJECT_ID]  FILE            /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json
+[OBJECT_ID]  FILE            /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/resources.json
+[OBJECT_ID]  FILE            /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate.backup
diff --git a/acceptance/bundle/migrate/auto/plan-failure/script b/acceptance/bundle/migrate/auto/plan-failure/script
new file mode 100644
index 00000000000..0f56cae649c
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/plan-failure/script
@@ -0,0 +1,33 @@
+export DATABRICKS_BUNDLE_ENGINE=
+
+title "Replay a prior terraform deployment (captured from a real terraform run)"
+trace replay_tfstate.py terraform-requests.json terraform.tfstate
+replace_ids.py
+trace print_migration_telemetry
+rm -f "$OUT_REQUESTS"
+
+title "Inject GET failure so the migration plan check fails: migration hard-errors (no terraform fallback)"
+# The migration plan-checks the converted state, GET-ing each resource to compare local config
+# against remote state. A 403 (non-retryable) fails the plan check. The terraform engine was
+# removed in v1.20.0, so there is no fallback: the deploy errors and nothing is committed, leaving
+# the bundle on its terraform state so a retry can migrate. The migration runs before any plan, so
+# the plan check's DoRead is the first GET here: OFFSET=0 fails it, and TIMES=1 lets the retry through.
+fault.py "GET /api/2.2/jobs/get*" 403 0 1
+trace DATABRICKS_BUNDLE_ENGINE=direct musterr $CLI bundle deploy
+trace print_migration_telemetry
+rm -f "$OUT_REQUESTS"
+
+title "Local state was NOT rewritten (still terraform)"
+trace find.py '\.databricks/.*(\.tfstate|resources.*\.json|\.wal)'
+trace MSYS_NO_PATHCONV=1 $CLI workspace list "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/test-bundle/default/state"
+
+title "Retry: plan check passes this time, migration succeeds"
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle deploy
+trace print_migration_telemetry
+rm -f "$OUT_REQUESTS"
+
+title "Local state is now direct"
+trace find.py '\.databricks/.*(\.tfstate|resources.*\.json|\.wal)'
+trace MSYS_NO_PATHCONV=1 $CLI workspace list "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/test-bundle/default/state"
+
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/migrate/auto/plan-failure/terraform-requests.json b/acceptance/bundle/migrate/auto/plan-failure/terraform-requests.json
new file mode 100644
index 00000000000..514877afead
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/plan-failure/terraform-requests.json
@@ -0,0 +1,19 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "Test Auto-Migrate Plan Failure",
+      "queue": {
+        "enabled": true
+      }
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/auto/plan-failure/terraform.tfstate b/acceptance/bundle/migrate/auto/plan-failure/terraform.tfstate
new file mode 100644
index 00000000000..5f749b73a1d
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/plan-failure/terraform.tfstate
@@ -0,0 +1,110 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "115ec518-3f72-3614-4e56-01411863558a",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "test_job",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790613902942848000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "Test Auto-Migrate Plan Failure",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790613902942848000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/auto/plan-missing/databricks.yml b/acceptance/bundle/migrate/auto/plan-missing/databricks.yml
new file mode 100644
index 00000000000..7d47b2d4957
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/plan-missing/databricks.yml
@@ -0,0 +1,7 @@
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    test_job:
+      name: "Test Auto-Migrate Plan Missing"
diff --git a/acceptance/bundle/migrate/auto/plan-missing/out.test.toml b/acceptance/bundle/migrate/auto/plan-missing/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/plan-missing/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/auto/plan-missing/output.txt b/acceptance/bundle/migrate/auto/plan-missing/output.txt
new file mode 100644
index 00000000000..74d958908d0
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/plan-missing/output.txt
@@ -0,0 +1,27 @@
+
+=== Replay a prior terraform deployment (captured from a real terraform run)
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate
+
+=== deploy --plan with a missing plan file fails after the migration prepared the direct state
+>>> DATABRICKS_BUNDLE_ENGINE=direct errcode [CLI] bundle deploy --plan does-not-exist.json
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Error: reading plan file: open does-not-exist.json: no such file or directory
+
+
+Exit code: 1
+
+=== State is still terraform - the migration was never committed
+>>> find.py \.databricks/.*(\.tfstate|resources.*\.json|\.wal)
+.databricks/bundle/default/terraform/terraform.tfstate
+
+>>> MSYS_NO_PATHCONV=1 [CLI] workspace list /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state
+ID                   Type  Language  Path
+[OBJECT_ID]  FILE            /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate
+
+=== A plain deploy migrates the still-terraform state to direct
+>>> [CLI] bundle deploy
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Migrated 1 resource to direct deployment engine.
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
diff --git a/acceptance/bundle/migrate/auto/plan-missing/script b/acceptance/bundle/migrate/auto/plan-missing/script
new file mode 100644
index 00000000000..d6721b1ba96
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/plan-missing/script
@@ -0,0 +1,18 @@
+export DATABRICKS_BUNDLE_ENGINE=
+
+title "Replay a prior terraform deployment (captured from a real terraform run)"
+trace replay_tfstate.py terraform-requests.json terraform.tfstate
+rm -f "$OUT_REQUESTS"
+
+title "deploy --plan with a missing plan file fails after the migration prepared the direct state"
+# The migration runs in memory (nothing is written) before the saved plan is loaded, so a missing
+# plan file fails before approval, and before CommitMigration would make it durable. A failed
+# command changes nothing: the in-memory migration is dropped and the bundle stays on terraform.
+trace DATABRICKS_BUNDLE_ENGINE=direct errcode $CLI bundle deploy --plan does-not-exist.json
+
+title "State is still terraform - the migration was never committed"
+trace find.py '\.databricks/.*(\.tfstate|resources.*\.json|\.wal)'
+trace MSYS_NO_PATHCONV=1 $CLI workspace list "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/test-bundle/default/state"
+
+title "A plain deploy migrates the still-terraform state to direct"
+trace $CLI bundle deploy
diff --git a/acceptance/bundle/migrate/auto/plan-missing/terraform-requests.json b/acceptance/bundle/migrate/auto/plan-missing/terraform-requests.json
new file mode 100644
index 00000000000..3463e6babb2
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/plan-missing/terraform-requests.json
@@ -0,0 +1,19 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "Test Auto-Migrate Plan Missing",
+      "queue": {
+        "enabled": true
+      }
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/auto/plan-missing/terraform.tfstate b/acceptance/bundle/migrate/auto/plan-missing/terraform.tfstate
new file mode 100644
index 00000000000..c281c34587e
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/plan-missing/terraform.tfstate
@@ -0,0 +1,110 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "b0ca93bf-2a4f-d420-021b-c0385fe75d21",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "test_job",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790613913802774000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "Test Auto-Migrate Plan Missing",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790613913802774000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/auto/plan-missing/test.toml b/acceptance/bundle/migrate/auto/plan-missing/test.toml
new file mode 100644
index 00000000000..455a6a5c9bf
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/plan-missing/test.toml
@@ -0,0 +1,5 @@
+# Normalize the Windows os.Open error so this migration-discard test runs on all platforms
+# (the discard file operations it exercises are worth covering on Windows too).
+[[Repls]]
+Old = "open does-not-exist.json: The system cannot find the file specified."
+New = "open does-not-exist.json: no such file or directory"
diff --git a/acceptance/bundle/migrate/auto/push-failure/databricks.yml b/acceptance/bundle/migrate/auto/push-failure/databricks.yml
new file mode 100644
index 00000000000..a07dda12a16
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/push-failure/databricks.yml
@@ -0,0 +1,7 @@
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    test_job:
+      name: "Test Auto-Migrate Push Failure"
diff --git a/acceptance/bundle/migrate/auto/push-failure/out.test.toml b/acceptance/bundle/migrate/auto/push-failure/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/push-failure/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/auto/push-failure/output.txt b/acceptance/bundle/migrate/auto/push-failure/output.txt
new file mode 100644
index 00000000000..bd638d6e829
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/push-failure/output.txt
@@ -0,0 +1,52 @@
+
+=== Replay a prior terraform deployment (captured from a real terraform run)
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate
+
+=== Opt in via env var; inject 403 on the resources.json push so the deploy fails
+>>> DATABRICKS_BUNDLE_ENGINE=direct errcode [CLI] bundle deploy
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Error: access denied: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/resources.json (403 INJECTED)
+
+Endpoint: POST [DATABRICKS_URL]/api/2.0/workspace/import
+HTTP Status: 403 Forbidden
+API error_code: INJECTED
+API message: Fault injected by test.
+
+Files: 1 uploaded, 0 deleted
+
+Exit code: 1
+
+>>> print_migration_telemetry
+
+=== Local state is direct (the migration wrote it) though the remote push did not land
+
+>>> find.py \.databricks/.*(\.tfstate|resources.*\.json|\.wal)
+.databricks/bundle/default/resources.json
+.databricks/bundle/default/terraform/terraform.tfstate
+
+>>> MSYS_NO_PATHCONV=1 [CLI] workspace list /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state
+ID                   Type  Language  Path
+[OBJECT_ID]  FILE            /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deployment.json
+[OBJECT_ID]  FILE            /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate
+
+=== Retry: the local direct state is used (no re-migration) and the push completes
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
+
+>>> print_migration_telemetry
+
+=== Retry recovered: local state is direct (the outranked local terraform.tfstate lingers)
+
+>>> find.py \.databricks/.*(\.tfstate|resources.*\.json|\.wal)
+.databricks/bundle/default/resources.json
+.databricks/bundle/default/terraform/terraform.tfstate
+
+>>> MSYS_NO_PATHCONV=1 [CLI] workspace list /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state
+ID                   Type  Language  Path
+[OBJECT_ID]  FILE            /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deployment.json
+[OBJECT_ID]  FILE            /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json
+[OBJECT_ID]  FILE            /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/resources.json
+[OBJECT_ID]  FILE            /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate.backup
diff --git a/acceptance/bundle/migrate/auto/push-failure/script b/acceptance/bundle/migrate/auto/push-failure/script
new file mode 100644
index 00000000000..4231617175e
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/push-failure/script
@@ -0,0 +1,31 @@
+export DATABRICKS_BUNDLE_ENGINE=
+
+title "Replay a prior terraform deployment (captured from a real terraform run)"
+trace replay_tfstate.py terraform-requests.json terraform.tfstate
+rm -f "$OUT_REQUESTS"
+
+title "Opt in via env var; inject 403 on the resources.json push so the deploy fails"
+# The migration prepares the direct state in memory and in the local state file; the approved
+# deploy (deployCore) pushes resources.json to the workspace. A 403 (non-retryable) on that
+# push fails the deploy - unlike a declined deploy, the migration is not discarded, so the
+# local direct state remains and a retry finishes the push. (A push failure is a hard error on
+# any direct deploy, not just a migrating one.)
+fault.py --body-contains "Users/$CURRENT_USER_NAME/.bundle/test-bundle/default/state/resources.json" "POST /api/2.0/workspace/import" 403 0 1
+trace DATABRICKS_BUNDLE_ENGINE=direct errcode $CLI bundle deploy
+trace print_migration_telemetry
+rm -f "$OUT_REQUESTS"
+
+title "Local state is direct (the migration wrote it) though the remote push did not land\n"
+trace find.py '\.databricks/.*(\.tfstate|resources.*\.json|\.wal)'
+trace MSYS_NO_PATHCONV=1 $CLI workspace list "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/test-bundle/default/state"
+
+title "Retry: the local direct state is used (no re-migration) and the push completes"
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle deploy
+trace print_migration_telemetry
+rm -f "$OUT_REQUESTS"
+
+title "Retry recovered: local state is direct (the outranked local terraform.tfstate lingers)\n"
+trace find.py '\.databricks/.*(\.tfstate|resources.*\.json|\.wal)'
+trace MSYS_NO_PATHCONV=1 $CLI workspace list "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/test-bundle/default/state"
+
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/migrate/auto/push-failure/terraform-requests.json b/acceptance/bundle/migrate/auto/push-failure/terraform-requests.json
new file mode 100644
index 00000000000..00fb6ce547f
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/push-failure/terraform-requests.json
@@ -0,0 +1,19 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "Test Auto-Migrate Push Failure",
+      "queue": {
+        "enabled": true
+      }
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/auto/push-failure/terraform.tfstate b/acceptance/bundle/migrate/auto/push-failure/terraform.tfstate
new file mode 100644
index 00000000000..0526f00a931
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/push-failure/terraform.tfstate
@@ -0,0 +1,110 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "4f1f3b2b-ddfb-e225-9c17-a7000030c36b",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "test_job",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790613925057558000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "Test Auto-Migrate Push Failure",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790613925057558000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/auto/registered-model-catalog-change/databricks.yml.tmpl b/acceptance/bundle/migrate/auto/registered-model-catalog-change/databricks.yml.tmpl
new file mode 100644
index 00000000000..cd4a1173826
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/registered-model-catalog-change/databricks.yml.tmpl
@@ -0,0 +1,12 @@
+bundle:
+  name: uc-modelcat-$UNIQUE_NAME
+
+workspace:
+  root_path: ~/.bundle/$UNIQUE_NAME
+
+resources:
+  registered_models:
+    my_model:
+      name: mymodel-$UNIQUE_NAME
+      catalog_name: main
+      schema_name: default
diff --git a/acceptance/bundle/migrate/auto/registered-model-catalog-change/out.test.toml b/acceptance/bundle/migrate/auto/registered-model-catalog-change/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/registered-model-catalog-change/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/auto/registered-model-catalog-change/output.txt b/acceptance/bundle/migrate/auto/registered-model-catalog-change/output.txt
new file mode 100644
index 00000000000..a824176b8ed
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/registered-model-catalog-change/output.txt
@@ -0,0 +1,49 @@
+
+>>> [CLI] catalogs create othercat_[UNIQUE_NAME] -o json
+{
+  "name": "othercat_[UNIQUE_NAME]"
+}
+
+=== Replay the prior terraform deployment (captured from a real terraform run)
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate
+
+=== Move the model to another catalog and deploy on direct
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle deploy
+Warn: migration to direct: registered_models.my_model: catalog_name differs between config ("othercat_[UNIQUE_NAME]") and terraform state ("main"); this resource will be recreated.
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Migrated 1 resource to direct deployment engine.
+Recreated registered_models.my_model
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 0 unchanged
+
+>>> print_migration_telemetry
+direct_migrate_recreate_planned true
+direct_migrated_via_env true
+
+=== Redeploy on direct: the model now matches config, so the plan is a clean no-op
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
+
+=== The model exists in the new catalog and the local state is direct
+>>> [CLI] registered-models get othercat_[UNIQUE_NAME].default.mymodel-[UNIQUE_NAME]
+{
+  "full_name": "othercat_[UNIQUE_NAME].default.mymodel-[UNIQUE_NAME]"
+}
+
+>>> find.py \.databricks/.*(\.tfstate|resources.*\.json|\.wal)
+.databricks/bundle/default/resources.json
+.databricks/bundle/default/terraform/terraform.tfstate.backup
+
+=== Cleanup
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.registered_models.my_model
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 1 deleted
+
+>>> errcode [CLI] catalogs delete othercat_[UNIQUE_NAME] --force
diff --git a/acceptance/bundle/migrate/auto/registered-model-catalog-change/script b/acceptance/bundle/migrate/auto/registered-model-catalog-change/script
new file mode 100644
index 00000000000..d260fc05a3d
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/registered-model-catalog-change/script
@@ -0,0 +1,34 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+# catalog_name is an immutable provided id field on registered models; moving the model to
+# another catalog recreates it. Create the destination catalog out of band (it auto-provisions
+# a "default" schema, which the moved model reuses).
+TARGET_CATALOG="othercat_$UNIQUE_NAME"
+trace $CLI catalogs create "$TARGET_CATALOG" -o json | jq '{name: (.name // .full_name)}'
+
+cleanup() {
+  title "Cleanup"
+  trace $CLI bundle destroy --auto-approve
+  trace errcode $CLI catalogs delete "$TARGET_CATALOG" --force
+}
+trap cleanup EXIT
+
+title "Replay the prior terraform deployment (captured from a real terraform run)"
+trace replay_tfstate.py terraform-requests.json terraform.tfstate
+rm -f "$OUT_REQUESTS"
+
+title "Move the model to another catalog and deploy on direct"
+# reconcileIDFields records the deployed catalog, so the migration's plan sees a real change
+# and the model recreates. Registered models are not in the destructive-approval group, so the
+# deploy is approved without --auto-approve: the migration commits and the recreate moves the
+# model to the new catalog.
+update_file.py databricks.yml "catalog_name: main" "catalog_name: $TARGET_CATALOG"
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle deploy
+trace print_migration_telemetry
+
+title "Redeploy on direct: the model now matches config, so the plan is a clean no-op"
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle deploy
+
+title "The model exists in the new catalog and the local state is direct"
+trace $CLI registered-models get "$TARGET_CATALOG.default.mymodel-$UNIQUE_NAME" | jq "{full_name}"
+trace find.py '\.databricks/.*(\.tfstate|resources.*\.json|\.wal)'
diff --git a/acceptance/bundle/migrate/auto/registered-model-catalog-change/terraform-requests.json b/acceptance/bundle/migrate/auto/registered-model-catalog-change/terraform-requests.json
new file mode 100644
index 00000000000..6f4620d81f5
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/registered-model-catalog-change/terraform-requests.json
@@ -0,0 +1,18 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.1/unity-catalog/catalogs",
+    "body": {
+      "name": "othercat_[UNIQUE_NAME]"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.1/unity-catalog/models",
+    "body": {
+      "catalog_name": "main",
+      "name": "mymodel-[UNIQUE_NAME]",
+      "schema_name": "default"
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/auto/registered-model-catalog-change/terraform.tfstate b/acceptance/bundle/migrate/auto/registered-model-catalog-change/terraform.tfstate
new file mode 100644
index 00000000000..3cf5038c0ba
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/registered-model-catalog-change/terraform.tfstate
@@ -0,0 +1,45 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "dff6923c-7f23-1707-8218-fab29ab6f508",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_registered_model",
+      "name": "my_model",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "aliases": [],
+            "browse_only": false,
+            "catalog_name": "main",
+            "comment": null,
+            "created_at": 1790613818295,
+            "created_by": "tester@databricks.com",
+            "full_name": "main.default.mymodel-[UNIQUE_NAME]",
+            "id": "main.default.mymodel-[UNIQUE_NAME]",
+            "metastore_id": "79fe88b1-6d1d-db28-79fe-88b16d1ddb29",
+            "name": "mymodel-[UNIQUE_NAME]",
+            "owner": "tester@databricks.com",
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "schema_name": "default",
+            "storage_location": null,
+            "updated_at": 1790613818295,
+            "updated_by": "tester@databricks.com"
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/auto/registered-model-catalog-change/test.toml b/acceptance/bundle/migrate/auto/registered-model-catalog-change/test.toml
new file mode 100644
index 00000000000..6880cf5c651
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/registered-model-catalog-change/test.toml
@@ -0,0 +1,10 @@
+# Local-only: the replay fixtures are captured against the fake server, so they reproduce a
+# terraform state only there, not on a real workspace (replaying them on cloud fails auth and
+# hits backend validation the mock does not enforce).
+Cloud = false
+RecordRequests = true
+
+Ignore = [
+    ".databricks",
+    "databricks.yml",
+]
diff --git a/acceptance/bundle/migrate/auto/registered-model-rename/databricks.yml.tmpl b/acceptance/bundle/migrate/auto/registered-model-rename/databricks.yml.tmpl
new file mode 100644
index 00000000000..45ced1357d5
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/registered-model-rename/databricks.yml.tmpl
@@ -0,0 +1,16 @@
+bundle:
+  name: uc-migrmodel-$UNIQUE_NAME
+
+workspace:
+  root_path: ~/.bundle/$UNIQUE_NAME
+
+resources:
+  schemas:
+    parent:
+      name: mschema-$UNIQUE_NAME
+      catalog_name: main
+  registered_models:
+    my_model:
+      name: themodel-$UNIQUE_NAME
+      catalog_name: main
+      schema_name: mschema-$UNIQUE_NAME
diff --git a/acceptance/bundle/migrate/auto/registered-model-rename/out.test.toml b/acceptance/bundle/migrate/auto/registered-model-rename/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/registered-model-rename/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/auto/registered-model-rename/output.txt b/acceptance/bundle/migrate/auto/registered-model-rename/output.txt
new file mode 100644
index 00000000000..fbad32d54f3
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/registered-model-rename/output.txt
@@ -0,0 +1,46 @@
+
+=== Replay the prior terraform deployment (captured from a real terraform run)
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate
+
+=== Rename the model (an immutable id field) and deploy on direct
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle deploy
+Warn: migration to direct: registered_models.my_model: name differs between config ("themodel-[UNIQUE_NAME]-renamed") and terraform state ("themodel-[UNIQUE_NAME]"); this resource will be recreated.
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Migrated 2 resources to direct deployment engine.
+Recreated registered_models.my_model
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 1 unchanged
+
+>>> print_migration_telemetry
+direct_migrate_recreate_planned true
+direct_migrated_via_env true
+
+=== Redeploy on direct: the model now matches config, so the plan is a clean no-op
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 2 unchanged
+
+=== The model exists under the new name and the local state is direct
+>>> [CLI] registered-models get main.mschema-[UNIQUE_NAME].themodel-[UNIQUE_NAME]-renamed
+{
+  "full_name": "main.mschema-[UNIQUE_NAME].themodel-[UNIQUE_NAME]-renamed"
+}
+
+>>> find.py \.databricks/.*(\.tfstate|resources.*\.json|\.wal)
+.databricks/bundle/default/resources.json
+.databricks/bundle/default/terraform/terraform.tfstate.backup
+
+=== Cleanup
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.registered_models.my_model
+  delete resources.schemas.parent
+
+This action will result in the deletion of the following UC schemas. Any underlying data may be lost:
+  delete resources.schemas.parent
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/migrate/auto/registered-model-rename/script b/acceptance/bundle/migrate/auto/registered-model-rename/script
new file mode 100644
index 00000000000..0b81939d6d4
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/registered-model-rename/script
@@ -0,0 +1,28 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+  title "Cleanup"
+  trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+title "Replay the prior terraform deployment (captured from a real terraform run)"
+trace replay_tfstate.py terraform-requests.json terraform.tfstate
+rm -f "$OUT_REQUESTS"
+
+title "Rename the model (an immutable id field) and deploy on direct"
+# name is a provided id field on registered models, so a rename recreates. reconcileIDFields
+# seeds the deployed name into the converted state, so the migration's plan sees a real
+# recreate. Unlike schemas/volumes, registered models are not in the destructive-approval
+# group (a model recreate loses no data), so the deploy is approved without --auto-approve:
+# the migration commits and the recreate applies on direct.
+update_file.py databricks.yml "themodel-$UNIQUE_NAME" "themodel-$UNIQUE_NAME-renamed"
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle deploy
+trace print_migration_telemetry
+
+title "Redeploy on direct: the model now matches config, so the plan is a clean no-op"
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle deploy
+
+title "The model exists under the new name and the local state is direct"
+trace $CLI registered-models get "main.mschema-$UNIQUE_NAME.themodel-$UNIQUE_NAME-renamed" | jq "{full_name}"
+trace find.py '\.databricks/.*(\.tfstate|resources.*\.json|\.wal)'
diff --git a/acceptance/bundle/migrate/auto/registered-model-rename/terraform-requests.json b/acceptance/bundle/migrate/auto/registered-model-rename/terraform-requests.json
new file mode 100644
index 00000000000..b9adfbc0f4d
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/registered-model-rename/terraform-requests.json
@@ -0,0 +1,19 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.1/unity-catalog/schemas",
+    "body": {
+      "catalog_name": "main",
+      "name": "mschema-[UNIQUE_NAME]"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.1/unity-catalog/models",
+    "body": {
+      "catalog_name": "main",
+      "name": "themodel-[UNIQUE_NAME]",
+      "schema_name": "mschema-[UNIQUE_NAME]"
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/auto/registered-model-rename/terraform.tfstate b/acceptance/bundle/migrate/auto/registered-model-rename/terraform.tfstate
new file mode 100644
index 00000000000..24bd20d48aa
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/registered-model-rename/terraform.tfstate
@@ -0,0 +1,79 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 3,
+  "lineage": "d13e5e08-3a73-ee41-a08d-10264c8fe9f1",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_registered_model",
+      "name": "my_model",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "aliases": [],
+            "browse_only": false,
+            "catalog_name": "main",
+            "comment": null,
+            "created_at": 1790613818146,
+            "created_by": "tester@databricks.com",
+            "full_name": "main.mschema-[UNIQUE_NAME].themodel-[UNIQUE_NAME]",
+            "id": "main.mschema-[UNIQUE_NAME].themodel-[UNIQUE_NAME]",
+            "metastore_id": "79fe88b1-6443-e150-79fe-88b16443e151",
+            "name": "themodel-[UNIQUE_NAME]",
+            "owner": "tester@databricks.com",
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "schema_name": "mschema-[UNIQUE_NAME]",
+            "storage_location": null,
+            "updated_at": 1790613818146,
+            "updated_by": "tester@databricks.com"
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "databricks_schema.parent"
+          ]
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_schema",
+      "name": "parent",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "catalog_name": "main",
+            "comment": null,
+            "enable_predictive_optimization": "INHERIT",
+            "force_destroy": true,
+            "id": "main.mschema-[UNIQUE_NAME]",
+            "metastore_id": "120efa64-9b68-46ba-be38-f319458430d2",
+            "name": "mschema-[UNIQUE_NAME]",
+            "owner": "tester@databricks.com",
+            "properties": null,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "schema_id": "79fe88b1-63b3-6508-79fe-88b163b368f0",
+            "storage_root": null
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/auto/registered-model-rename/test.toml b/acceptance/bundle/migrate/auto/registered-model-rename/test.toml
new file mode 100644
index 00000000000..6880cf5c651
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/registered-model-rename/test.toml
@@ -0,0 +1,10 @@
+# Local-only: the replay fixtures are captured against the fake server, so they reproduce a
+# terraform state only there, not on a real workspace (replaying them on cloud fails auth and
+# hits backend validation the mock does not enforce).
+Cloud = false
+RecordRequests = true
+
+Ignore = [
+    ".databricks",
+    "databricks.yml",
+]
diff --git a/acceptance/bundle/migrate/auto/run-no-commit/databricks.yml b/acceptance/bundle/migrate/auto/run-no-commit/databricks.yml
new file mode 100644
index 00000000000..9227b4b8b99
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/run-no-commit/databricks.yml
@@ -0,0 +1,6 @@
+bundle: {name: test-bundle}
+
+resources:
+  jobs:
+    test_job:
+      name: "Test Auto-Migrate Run"
diff --git a/acceptance/bundle/migrate/auto/run-no-commit/out.test.toml b/acceptance/bundle/migrate/auto/run-no-commit/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/run-no-commit/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/auto/run-no-commit/output.txt b/acceptance/bundle/migrate/auto/run-no-commit/output.txt
new file mode 100644
index 00000000000..87ab33b2c30
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/run-no-commit/output.txt
@@ -0,0 +1,51 @@
+
+=== Replay a prior terraform deployment
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate
+
+=== bundle run on direct migrates the terraform state IN MEMORY (no commit) to resolve the job
+>>> DATABRICKS_BUNDLE_ENGINE=direct errcode [CLI] bundle run test_job --no-wait
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Run URL: [DATABRICKS_URL]/jobs/[TEST_JOB_ID]/runs/[RUN_ID]?o=[WORKSPACE_ID]
+
+
+>>> print_migration_telemetry
+
+=== Nothing durable written: still on terraform (local state files + remote), no direct state / migrating temp / WAL
+
+>>> find.py \.databricks/.*(\.tfstate|resources.*\.json|\.wal)
+.databricks/bundle/default/terraform/terraform.tfstate
+
+>>> MSYS_NO_PATHCONV=1 [CLI] workspace list /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state
+ID                   Type  Language  Path
+[OBJECT_ID]  FILE            /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate
+
+=== bundle run works with engine: terraform: warns and runs the job from the terraform state
+>>> update_file.py databricks.yml {name: test-bundle} {name: test-bundle, engine: terraform}
+
+>>> [CLI] bundle run test_job --no-wait
+Warning: the Terraform deployment engine has been removed in Databricks CLI v1.20.0
+  in databricks.yml:1:37
+
+Remove the "bundle.engine" setting (or set it to "direct") to deploy with the direct engine; existing Terraform state is migrated automatically. To keep using Terraform, revert to Databricks CLI v1.19.x.
+See https://docs.databricks.com/dev-tools/bundles/direct for details
+
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Run URL: [DATABRICKS_URL]/jobs/[TEST_JOB_ID]/runs/[RUN_ID]?o=[WORKSPACE_ID]
+
+
+>>> print_requests.py //jobs
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_run cmd-exec-id/[UUID] interactive/none lineage/AlC62qhncMO engine/direct auth/pat"
+    ]
+  },
+  "method": "POST",
+  "path": "/api/2.2/jobs/run-now",
+  "body": {
+    "job_id": [TEST_JOB_ID]
+  }
+}
+
+>>> find.py \.databricks/.*(\.tfstate|resources.*\.json|\.wal)
+.databricks/bundle/default/terraform/terraform.tfstate
diff --git a/acceptance/bundle/migrate/auto/run-no-commit/script b/acceptance/bundle/migrate/auto/run-no-commit/script
new file mode 100644
index 00000000000..2640ea4e235
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/run-no-commit/script
@@ -0,0 +1,27 @@
+export DATABRICKS_BUNDLE_ENGINE=
+
+title "Replay a prior terraform deployment"
+trace replay_tfstate.py terraform-requests.json terraform.tfstate
+replace_ids.py
+rm -f "$OUT_REQUESTS"
+
+title "bundle run on direct migrates the terraform state IN MEMORY (no commit) to resolve the job"
+# run needs the resource id, so it migrates in memory - but it is read-only w.r.t. the engine: it
+# writes no local direct state, pushes nothing, and does not retire the terraform state. The bundle
+# stays on terraform; a later deploy is what commits the migration.
+trace DATABRICKS_BUNDLE_ENGINE=direct errcode $CLI bundle run test_job --no-wait
+trace print_migration_telemetry
+rm -f "$OUT_REQUESTS"
+
+title "Nothing durable written: still on terraform (local state files + remote), no direct state / migrating temp / WAL\n"
+# find.py lists matching files sorted with forward slashes (cross-platform); the terraform provider
+# cache under .terraform/ is excluded by matching only state files (tfstate/.backup, resources*.json, WAL).
+trace find.py '\.databricks/.*(\.tfstate|resources.*\.json|\.wal)'
+trace MSYS_NO_PATHCONV=1 $CLI workspace list "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/test-bundle/default/state"
+
+title "bundle run works with engine: terraform: warns and runs the job from the terraform state"
+# Set after the replay: replay_tfstate.py runs bundle validate, which rejects engine: terraform.
+trace update_file.py databricks.yml "{name: test-bundle}" "{name: test-bundle, engine: terraform}"
+trace $CLI bundle run test_job --no-wait
+trace print_requests.py //jobs
+trace find.py '\.databricks/.*(\.tfstate|resources.*\.json|\.wal)'
diff --git a/acceptance/bundle/migrate/auto/run-no-commit/terraform-requests.json b/acceptance/bundle/migrate/auto/run-no-commit/terraform-requests.json
new file mode 100644
index 00000000000..b7e85269c49
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/run-no-commit/terraform-requests.json
@@ -0,0 +1,19 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "Test Auto-Migrate Run",
+      "queue": {
+        "enabled": true
+      }
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/auto/run-no-commit/terraform.tfstate b/acceptance/bundle/migrate/auto/run-no-commit/terraform.tfstate
new file mode 100644
index 00000000000..a9a79a3d5e1
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/run-no-commit/terraform.tfstate
@@ -0,0 +1,110 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "4d00d92b-65ae-9e2c-2027-3c140eafb60b",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "test_job",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790614094573888000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "Test Auto-Migrate Run",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790614094573888000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/auto/run-no-commit/test.toml b/acceptance/bundle/migrate/auto/run-no-commit/test.toml
new file mode 100644
index 00000000000..3c887dd20bf
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/run-no-commit/test.toml
@@ -0,0 +1,3 @@
+[[Repls]]
+Old = '/runs/\d+'
+New = '/runs/[RUN_ID]'
diff --git a/acceptance/bundle/migrate/auto/schema-catalog-change/databricks.yml.tmpl b/acceptance/bundle/migrate/auto/schema-catalog-change/databricks.yml.tmpl
new file mode 100644
index 00000000000..53cf960a034
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/schema-catalog-change/databricks.yml.tmpl
@@ -0,0 +1,11 @@
+bundle:
+  name: uc-schemacat-$UNIQUE_NAME
+
+workspace:
+  root_path: ~/.bundle/$UNIQUE_NAME
+
+resources:
+  schemas:
+    my_schema:
+      name: myschema-$UNIQUE_NAME
+      catalog_name: main
diff --git a/acceptance/bundle/migrate/auto/schema-catalog-change/out.test.toml b/acceptance/bundle/migrate/auto/schema-catalog-change/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/schema-catalog-change/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/auto/schema-catalog-change/output.txt b/acceptance/bundle/migrate/auto/schema-catalog-change/output.txt
new file mode 100644
index 00000000000..5295feaa2e9
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/schema-catalog-change/output.txt
@@ -0,0 +1,71 @@
+
+>>> [CLI] catalogs create othercat_[UNIQUE_NAME] -o json
+{
+  "name": "othercat_[UNIQUE_NAME]"
+}
+
+=== Replay the prior terraform deployment (captured from a real terraform run)
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate
+
+=== Move the schema to another catalog. Without --auto-approve the recreate is refused
+>>> DATABRICKS_BUNDLE_ENGINE=direct errcode [CLI] bundle deploy
+Warn: migration to direct: schemas.my_schema: catalog_name differs between config ("othercat_[UNIQUE_NAME]") and terraform state ("main"); this resource will be recreated.
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+
+This action will result in the deletion or recreation of the following UC schemas. Any underlying data may be lost:
+  recreate resources.schemas.my_schema
+Warn: Migration not committed, keeping Terraform state
+Error: the deployment requires destructive actions, but the current console does not support prompting.
+Deleting data assets such as schemas, pipelines, or volumes may cause permanent data loss and should be carefully reviewed.
+To proceed, use --auto-approve after reviewing the plan above.
+
+Files: 2 uploaded, 0 deleted
+
+Exit code: 1
+
+>>> print_migration_telemetry
+direct_migrate_recreate_planned true
+
+=== With --auto-approve the recreate moves the schema to the new catalog on direct
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle deploy --auto-approve
+Warn: migration to direct: schemas.my_schema: catalog_name differs between config ("othercat_[UNIQUE_NAME]") and terraform state ("main"); this resource will be recreated.
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+
+This action will result in the deletion or recreation of the following UC schemas. Any underlying data may be lost:
+  recreate resources.schemas.my_schema
+Migrated 1 resource to direct deployment engine.
+Recreated schemas.my_schema
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 0 unchanged
+
+=== Redeploy on direct: the schema now matches config, so the plan is a clean no-op
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
+
+=== The schema exists in the new catalog and the local state is direct
+>>> [CLI] schemas get othercat_[UNIQUE_NAME].myschema-[UNIQUE_NAME]
+{
+  "full_name": "othercat_[UNIQUE_NAME].myschema-[UNIQUE_NAME]"
+}
+
+>>> find.py \.databricks/.*(\.tfstate|resources.*\.json|\.wal)
+.databricks/bundle/default/resources.json
+.databricks/bundle/default/terraform/terraform.tfstate.backup
+
+=== Cleanup
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.schemas.my_schema
+
+This action will result in the deletion of the following UC schemas. Any underlying data may be lost:
+  delete resources.schemas.my_schema
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 1 deleted
+
+>>> errcode [CLI] catalogs delete othercat_[UNIQUE_NAME] --force
diff --git a/acceptance/bundle/migrate/auto/schema-catalog-change/script b/acceptance/bundle/migrate/auto/schema-catalog-change/script
new file mode 100644
index 00000000000..3f166db2b19
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/schema-catalog-change/script
@@ -0,0 +1,36 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+# catalog_name is an immutable provided id field. Moving the schema to another catalog
+# recreates it. Create the destination catalog out of band (a catalog cannot be a bundle
+# resource here: catalogs are direct-only and this bundle deploys on terraform first).
+TARGET_CATALOG="othercat_$UNIQUE_NAME"
+trace $CLI catalogs create "$TARGET_CATALOG" -o json | jq '{name: (.name // .full_name)}'
+
+cleanup() {
+  title "Cleanup"
+  trace $CLI bundle destroy --auto-approve
+  trace errcode $CLI catalogs delete "$TARGET_CATALOG" --force
+}
+trap cleanup EXIT
+
+title "Replay the prior terraform deployment (captured from a real terraform run)"
+trace replay_tfstate.py terraform-requests.json terraform.tfstate
+rm -f "$OUT_REQUESTS"
+
+title "Move the schema to another catalog. Without --auto-approve the recreate is refused"
+# reconcileIDFields records the deployed catalog, so the migration's plan sees a real change;
+# schemas recreate on it. Schemas are in the destructive-approval group, so without
+# --auto-approve the deploy refuses the recreate (exit 1) and the migration is not committed.
+update_file.py databricks.yml "catalog_name: main" "catalog_name: $TARGET_CATALOG"
+trace DATABRICKS_BUNDLE_ENGINE=direct errcode $CLI bundle deploy
+trace print_migration_telemetry
+
+title "With --auto-approve the recreate moves the schema to the new catalog on direct"
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle deploy --auto-approve
+
+title "Redeploy on direct: the schema now matches config, so the plan is a clean no-op"
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle deploy
+
+title "The schema exists in the new catalog and the local state is direct"
+trace $CLI schemas get "$TARGET_CATALOG.myschema-$UNIQUE_NAME" | jq "{full_name}"
+trace find.py '\.databricks/.*(\.tfstate|resources.*\.json|\.wal)'
diff --git a/acceptance/bundle/migrate/auto/schema-catalog-change/terraform-requests.json b/acceptance/bundle/migrate/auto/schema-catalog-change/terraform-requests.json
new file mode 100644
index 00000000000..eda99b84d42
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/schema-catalog-change/terraform-requests.json
@@ -0,0 +1,17 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.1/unity-catalog/catalogs",
+    "body": {
+      "name": "othercat_[UNIQUE_NAME]"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.1/unity-catalog/schemas",
+    "body": {
+      "catalog_name": "main",
+      "name": "myschema-[UNIQUE_NAME]"
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/auto/schema-catalog-change/terraform.tfstate b/acceptance/bundle/migrate/auto/schema-catalog-change/terraform.tfstate
new file mode 100644
index 00000000000..f303e9926c0
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/schema-catalog-change/terraform.tfstate
@@ -0,0 +1,41 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "8c9edde2-6ce1-15eb-cb32-4db7169733c3",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_schema",
+      "name": "my_schema",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "catalog_name": "main",
+            "comment": null,
+            "enable_predictive_optimization": "INHERIT",
+            "force_destroy": true,
+            "id": "main.myschema-[UNIQUE_NAME]",
+            "metastore_id": "120efa64-9b68-46ba-be38-f319458430d2",
+            "name": "myschema-[UNIQUE_NAME]",
+            "owner": "tester@databricks.com",
+            "properties": null,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "schema_id": "79fe88b1-685c-28b0-79fe-88b1685c28b1",
+            "storage_root": null
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/auto/schema-catalog-change/test.toml b/acceptance/bundle/migrate/auto/schema-catalog-change/test.toml
new file mode 100644
index 00000000000..6880cf5c651
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/schema-catalog-change/test.toml
@@ -0,0 +1,10 @@
+# Local-only: the replay fixtures are captured against the fake server, so they reproduce a
+# terraform state only there, not on a real workspace (replaying them on cloud fails auth and
+# hits backend validation the mock does not enforce).
+Cloud = false
+RecordRequests = true
+
+Ignore = [
+    ".databricks",
+    "databricks.yml",
+]
diff --git a/acceptance/bundle/migrate/auto/schema-name-normalized/databricks.yml.tmpl b/acceptance/bundle/migrate/auto/schema-name-normalized/databricks.yml.tmpl
new file mode 100644
index 00000000000..13c8a9a9785
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/schema-name-normalized/databricks.yml.tmpl
@@ -0,0 +1,11 @@
+bundle:
+  name: uc-schemaname-$UNIQUE_NAME
+
+workspace:
+  root_path: ~/.bundle/$UNIQUE_NAME
+
+resources:
+  schemas:
+    my_schema:
+      name: MySchema-$UNIQUE_NAME
+      catalog_name: main
diff --git a/acceptance/bundle/migrate/auto/schema-name-normalized/out.test.toml b/acceptance/bundle/migrate/auto/schema-name-normalized/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/schema-name-normalized/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/auto/schema-name-normalized/output.txt b/acceptance/bundle/migrate/auto/schema-name-normalized/output.txt
new file mode 100644
index 00000000000..cdfe47510ee
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/schema-name-normalized/output.txt
@@ -0,0 +1,27 @@
+
+=== Replay the prior terraform deployment (captured from a real terraform run)
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate
+
+=== Migrate to direct with the same config (mixed-case name unchanged)
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle deploy
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Migrated 1 resource to direct deployment engine.
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
+
+=== Follow-up plan on direct converges (the case-only difference is not a change)
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+=== Cleanup
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.schemas.my_schema
+
+This action will result in the deletion of the following UC schemas. Any underlying data may be lost:
+  delete resources.schemas.my_schema
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/migrate/auto/schema-name-normalized/script b/acceptance/bundle/migrate/auto/schema-name-normalized/script
new file mode 100644
index 00000000000..442b762ee9d
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/schema-name-normalized/script
@@ -0,0 +1,21 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+  title "Cleanup"
+  trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+# The config uses a mixed-case schema name; UC lowercases the stored name, so the deployed id
+# differs from config by case only, without the user changing anything. reconcileIDFields
+# treats a case-only difference as backend normalization and keeps the config value, so the
+# migration proceeds with no warning and the plan converges.
+
+title "Replay the prior terraform deployment (captured from a real terraform run)"
+trace replay_tfstate.py terraform-requests.json terraform.tfstate
+
+title "Migrate to direct with the same config (mixed-case name unchanged)"
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle deploy
+
+title "Follow-up plan on direct converges (the case-only difference is not a change)"
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle plan
diff --git a/acceptance/bundle/migrate/auto/schema-name-normalized/terraform-requests.json b/acceptance/bundle/migrate/auto/schema-name-normalized/terraform-requests.json
new file mode 100644
index 00000000000..beed48833c5
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/schema-name-normalized/terraform-requests.json
@@ -0,0 +1,10 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.1/unity-catalog/schemas",
+    "body": {
+      "catalog_name": "main",
+      "name": "MySchema-[UNIQUE_NAME]"
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/auto/schema-name-normalized/terraform.tfstate b/acceptance/bundle/migrate/auto/schema-name-normalized/terraform.tfstate
new file mode 100644
index 00000000000..d328567decc
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/schema-name-normalized/terraform.tfstate
@@ -0,0 +1,41 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "79279b96-ff5f-62aa-efec-c286658acf2c",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_schema",
+      "name": "my_schema",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "catalog_name": "main",
+            "comment": null,
+            "enable_predictive_optimization": "INHERIT",
+            "force_destroy": true,
+            "id": "main.myschema-[UNIQUE_NAME]",
+            "metastore_id": "120efa64-9b68-46ba-be38-f319458430d2",
+            "name": "myschema-[UNIQUE_NAME]",
+            "owner": "tester@databricks.com",
+            "properties": null,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "schema_id": "79fe88d4-0f11-57d0-79fe-88d40f1157d1",
+            "storage_root": null
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/auto/schema-name-normalized/test.toml b/acceptance/bundle/migrate/auto/schema-name-normalized/test.toml
new file mode 100644
index 00000000000..b61ef681ed8
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/schema-name-normalized/test.toml
@@ -0,0 +1,10 @@
+# Local-only: the replay fixtures are captured against the fake server, so they reproduce a
+# terraform state only there, not on a real workspace (replaying them on cloud fails auth and
+# hits backend validation the mock does not enforce).
+Cloud = false
+RecordRequests = false
+
+Ignore = [
+    ".databricks",
+    "databricks.yml",
+]
diff --git a/acceptance/bundle/migrate/auto/schema-rename/databricks.yml.tmpl b/acceptance/bundle/migrate/auto/schema-rename/databricks.yml.tmpl
new file mode 100644
index 00000000000..b1ea125e2fd
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/schema-rename/databricks.yml.tmpl
@@ -0,0 +1,11 @@
+bundle:
+  name: uc-migr-schema-$UNIQUE_NAME
+
+workspace:
+  root_path: ~/.bundle/$UNIQUE_NAME
+
+resources:
+  schemas:
+    my_schema:
+      name: myschema-$UNIQUE_NAME
+      catalog_name: main
diff --git a/acceptance/bundle/migrate/auto/schema-rename/out.test.toml b/acceptance/bundle/migrate/auto/schema-rename/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/schema-rename/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/auto/schema-rename/output.txt b/acceptance/bundle/migrate/auto/schema-rename/output.txt
new file mode 100644
index 00000000000..65e060f08f9
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/schema-rename/output.txt
@@ -0,0 +1,64 @@
+
+=== Replay the prior terraform deployment (captured from a real terraform run)
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate
+
+=== Rename the schema (an immutable id field). Without --auto-approve the recreate is refused
+>>> DATABRICKS_BUNDLE_ENGINE=direct errcode [CLI] bundle deploy
+Warn: migration to direct: schemas.my_schema: name differs between config ("myschema-[UNIQUE_NAME]-renamed") and terraform state ("myschema-[UNIQUE_NAME]"); this resource will be recreated.
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+
+This action will result in the deletion or recreation of the following UC schemas. Any underlying data may be lost:
+  recreate resources.schemas.my_schema
+Warn: Migration not committed, keeping Terraform state
+Error: the deployment requires destructive actions, but the current console does not support prompting.
+Deleting data assets such as schemas, pipelines, or volumes may cause permanent data loss and should be carefully reviewed.
+To proceed, use --auto-approve after reviewing the plan above.
+
+Files: 2 uploaded, 0 deleted
+
+Exit code: 1
+
+>>> print_migration_telemetry
+direct_migrate_recreate_planned true
+
+=== With --auto-approve the recreate is applied on direct under the new name
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle deploy --auto-approve
+Warn: migration to direct: schemas.my_schema: name differs between config ("myschema-[UNIQUE_NAME]-renamed") and terraform state ("myschema-[UNIQUE_NAME]"); this resource will be recreated.
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+
+This action will result in the deletion or recreation of the following UC schemas. Any underlying data may be lost:
+  recreate resources.schemas.my_schema
+Migrated 1 resource to direct deployment engine.
+Recreated schemas.my_schema
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 0 unchanged
+
+=== Redeploy on direct: the schema now matches config, so the plan is a clean no-op
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
+
+=== The schema exists under the new name and the local state is direct
+>>> [CLI] schemas get main.myschema-[UNIQUE_NAME]-renamed
+{
+  "full_name": "main.myschema-[UNIQUE_NAME]-renamed"
+}
+
+>>> find.py \.databricks/.*(\.tfstate|resources.*\.json|\.wal)
+.databricks/bundle/default/resources.json
+.databricks/bundle/default/terraform/terraform.tfstate.backup
+
+=== Cleanup
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.schemas.my_schema
+
+This action will result in the deletion of the following UC schemas. Any underlying data may be lost:
+  delete resources.schemas.my_schema
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/migrate/auto/schema-rename/script b/acceptance/bundle/migrate/auto/schema-rename/script
new file mode 100644
index 00000000000..2286ccca1b2
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/schema-rename/script
@@ -0,0 +1,30 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+  title "Cleanup"
+  trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+title "Replay the prior terraform deployment (captured from a real terraform run)"
+trace replay_tfstate.py terraform-requests.json terraform.tfstate
+rm -f "$OUT_REQUESTS"
+
+title "Rename the schema (an immutable id field). Without --auto-approve the recreate is refused"
+# name is a provided id field, so a rename recreates. reconcileIDFields seeds the deployed
+# name into the converted state, so the migration's plan sees a real recreate. Schemas are in
+# the destructive-approval group, so without --auto-approve the deploy refuses the recreate
+# (exit 1) and the migration is not committed - the run stays on terraform.
+update_file.py databricks.yml "myschema-$UNIQUE_NAME" "myschema-$UNIQUE_NAME-renamed"
+trace DATABRICKS_BUNDLE_ENGINE=direct errcode $CLI bundle deploy
+trace print_migration_telemetry
+
+title "With --auto-approve the recreate is applied on direct under the new name"
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle deploy --auto-approve
+
+title "Redeploy on direct: the schema now matches config, so the plan is a clean no-op"
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle deploy
+
+title "The schema exists under the new name and the local state is direct"
+trace $CLI schemas get "main.myschema-$UNIQUE_NAME-renamed" | jq "{full_name}"
+trace find.py '\.databricks/.*(\.tfstate|resources.*\.json|\.wal)'
diff --git a/acceptance/bundle/migrate/auto/schema-rename/terraform-requests.json b/acceptance/bundle/migrate/auto/schema-rename/terraform-requests.json
new file mode 100644
index 00000000000..e7072606fd3
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/schema-rename/terraform-requests.json
@@ -0,0 +1,10 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.1/unity-catalog/schemas",
+    "body": {
+      "catalog_name": "main",
+      "name": "myschema-[UNIQUE_NAME]"
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/auto/schema-rename/terraform.tfstate b/acceptance/bundle/migrate/auto/schema-rename/terraform.tfstate
new file mode 100644
index 00000000000..5cda30b7890
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/schema-rename/terraform.tfstate
@@ -0,0 +1,41 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "6b2758d5-3e2d-380e-9204-421634777e54",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_schema",
+      "name": "my_schema",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "catalog_name": "main",
+            "comment": null,
+            "enable_predictive_optimization": "INHERIT",
+            "force_destroy": true,
+            "id": "main.myschema-[UNIQUE_NAME]",
+            "metastore_id": "120efa64-9b68-46ba-be38-f319458430d2",
+            "name": "myschema-[UNIQUE_NAME]",
+            "owner": "tester@databricks.com",
+            "properties": null,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "schema_id": "79fe88b1-3db7-d2a8-79fe-88b13db7d2a9",
+            "storage_root": null
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/auto/schema-rename/test.toml b/acceptance/bundle/migrate/auto/schema-rename/test.toml
new file mode 100644
index 00000000000..6880cf5c651
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/schema-rename/test.toml
@@ -0,0 +1,10 @@
+# Local-only: the replay fixtures are captured against the fake server, so they reproduce a
+# terraform state only there, not on a real workspace (replaying them on cloud fails auth and
+# hits backend validation the mock does not enforce).
+Cloud = false
+RecordRequests = true
+
+Ignore = [
+    ".databricks",
+    "databricks.yml",
+]
diff --git a/acceptance/bundle/migrate/auto/schema-storage-change/databricks.yml b/acceptance/bundle/migrate/auto/schema-storage-change/databricks.yml
new file mode 100644
index 00000000000..30d1ade858b
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/schema-storage-change/databricks.yml
@@ -0,0 +1,9 @@
+bundle:
+  name: test-bundle
+
+resources:
+  schemas:
+    my_schema:
+      name: myschema
+      catalog_name: main
+      storage_root: s3://mybucket/init
diff --git a/acceptance/bundle/migrate/auto/schema-storage-change/out.test.toml b/acceptance/bundle/migrate/auto/schema-storage-change/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/schema-storage-change/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/auto/schema-storage-change/output.txt b/acceptance/bundle/migrate/auto/schema-storage-change/output.txt
new file mode 100644
index 00000000000..bc4083f4457
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/schema-storage-change/output.txt
@@ -0,0 +1,55 @@
+
+=== Replay the prior terraform deployment (captured from a real terraform run)
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate
+
+>>> print_migration_telemetry
+
+=== Change immutable storage_root; without --auto-approve the recreate is refused
+>>> DATABRICKS_BUNDLE_ENGINE=direct errcode [CLI] bundle deploy
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+
+This action will result in the deletion or recreation of the following UC schemas. Any underlying data may be lost:
+  recreate resources.schemas.my_schema
+Warn: Migration not committed, keeping Terraform state
+Error: the deployment requires destructive actions, but the current console does not support prompting.
+Deleting data assets such as schemas, pipelines, or volumes may cause permanent data loss and should be carefully reviewed.
+To proceed, use --auto-approve after reviewing the plan above.
+
+Files: 1 uploaded, 0 deleted
+
+Exit code: 1
+
+>>> print_migration_telemetry
+direct_migrate_recreate_planned true
+
+=== The migration was not committed: the state is still terraform
+>>> find.py \.databricks/.*(\.tfstate|resources.*\.json|\.wal)
+.databricks/bundle/default/terraform/terraform.tfstate
+
+>>> MSYS_NO_PATHCONV=1 [CLI] workspace list /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state
+ID                   Type  Language  Path
+[OBJECT_ID]  FILE            /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deployment.json
+[OBJECT_ID]  FILE            /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate
+
+=== With --auto-approve the migration commits and the recreate is applied on direct
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle deploy --auto-approve
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+
+This action will result in the deletion or recreation of the following UC schemas. Any underlying data may be lost:
+  recreate resources.schemas.my_schema
+Migrated 1 resource to direct deployment engine.
+Recreated schemas.my_schema
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 0 unchanged
+
+>>> print_migration_telemetry
+direct_migrate_recreate_planned true
+direct_migrated_via_env true
+
+=== Redeploy on direct: the schema now matches config, so the plan is a clean no-op
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
diff --git a/acceptance/bundle/migrate/auto/schema-storage-change/script b/acceptance/bundle/migrate/auto/schema-storage-change/script
new file mode 100644
index 00000000000..c0ab15856de
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/schema-storage-change/script
@@ -0,0 +1,33 @@
+export DATABRICKS_BUNDLE_ENGINE=
+
+# Testserver-only: an explicit storage_root needs a registered external location on a real
+# workspace, so this is not Cloud-enabled. The recreate/refusal class it covers is verified
+# on cloud by schema-rename and pipeline-storage-change.
+
+title "Replay the prior terraform deployment (captured from a real terraform run)"
+trace replay_tfstate.py terraform-requests.json terraform.tfstate
+trace print_migration_telemetry
+rm -f "$OUT_REQUESTS"
+
+title "Change immutable storage_root; without --auto-approve the recreate is refused"
+# storage_root is immutable (recreate_on_changes). The migration prepares the direct state and
+# its plan compares the new config value against the deployed remote and plans a recreate
+# (direct_migrate_recreate_planned). Schemas are in the destructive-approval group, so without
+# --auto-approve the deploy refuses the recreate (exit 1) and the migration is not committed -
+# the run stays on terraform.
+update_file.py databricks.yml "storage_root: s3://mybucket/init" "storage_root: s3://mybucket/changed"
+trace DATABRICKS_BUNDLE_ENGINE=direct errcode $CLI bundle deploy
+trace print_migration_telemetry
+rm -f "$OUT_REQUESTS"
+
+title "The migration was not committed: the state is still terraform"
+trace find.py '\.databricks/.*(\.tfstate|resources.*\.json|\.wal)'
+trace MSYS_NO_PATHCONV=1 $CLI workspace list "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/test-bundle/default/state"
+
+title "With --auto-approve the migration commits and the recreate is applied on direct"
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle deploy --auto-approve
+trace print_migration_telemetry
+rm -f "$OUT_REQUESTS"
+
+title "Redeploy on direct: the schema now matches config, so the plan is a clean no-op"
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle deploy
diff --git a/acceptance/bundle/migrate/auto/schema-storage-change/terraform-requests.json b/acceptance/bundle/migrate/auto/schema-storage-change/terraform-requests.json
new file mode 100644
index 00000000000..0c3e56abc30
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/schema-storage-change/terraform-requests.json
@@ -0,0 +1,11 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.1/unity-catalog/schemas",
+    "body": {
+      "catalog_name": "main",
+      "name": "myschema",
+      "storage_root": "s3://mybucket/init"
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/auto/schema-storage-change/terraform.tfstate b/acceptance/bundle/migrate/auto/schema-storage-change/terraform.tfstate
new file mode 100644
index 00000000000..90a6b74d9e4
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/schema-storage-change/terraform.tfstate
@@ -0,0 +1,41 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "ed6ea4b1-1168-2291-5f1b-45c0c5698c28",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_schema",
+      "name": "my_schema",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "catalog_name": "main",
+            "comment": null,
+            "enable_predictive_optimization": "INHERIT",
+            "force_destroy": true,
+            "id": "main.myschema",
+            "metastore_id": "120efa64-9b68-46ba-be38-f319458430d2",
+            "name": "myschema",
+            "owner": "tester@databricks.com",
+            "properties": null,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "schema_id": "79fe88b1-3e30-0048-79fe-88b13e300049",
+            "storage_root": "s3://mybucket/init"
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/auto/schema-storage-normalized/databricks.yml b/acceptance/bundle/migrate/auto/schema-storage-normalized/databricks.yml
new file mode 100644
index 00000000000..14875f41279
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/schema-storage-normalized/databricks.yml
@@ -0,0 +1,9 @@
+bundle:
+  name: test-bundle
+
+resources:
+  schemas:
+    my_schema:
+      name: myschema
+      catalog_name: main
+      storage_root: s3://bucket/path/
diff --git a/acceptance/bundle/migrate/auto/schema-storage-normalized/out.test.toml b/acceptance/bundle/migrate/auto/schema-storage-normalized/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/schema-storage-normalized/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/auto/schema-storage-normalized/output.txt b/acceptance/bundle/migrate/auto/schema-storage-normalized/output.txt
new file mode 100644
index 00000000000..ccb8f6f49fa
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/schema-storage-normalized/output.txt
@@ -0,0 +1,15 @@
+
+=== Replay the prior terraform deployment (captured from a real terraform run)
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate
+
+=== Migrate to direct with the same config (storage_root still has the trailing slash)
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle deploy
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Migrated 1 resource to direct deployment engine.
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
+
+=== Follow-up plan on direct: does it converge or keep seeing a diff?
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
diff --git a/acceptance/bundle/migrate/auto/schema-storage-normalized/script b/acceptance/bundle/migrate/auto/schema-storage-normalized/script
new file mode 100644
index 00000000000..ea5185491af
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/schema-storage-normalized/script
@@ -0,0 +1,19 @@
+export DATABRICKS_BUNDLE_ENGINE=
+
+# Testserver-only: an explicit storage_root needs a registered external location on a real
+# workspace, so this is not Cloud-enabled. The normalization-converge class it covers is
+# verified on cloud by schema-name-normalized / volume-name-normalized.
+
+# storage_root is immutable (recreate_on_changes) and UC strips a trailing slash. The config
+# keeps the trailing slash ("s3://bucket/path/") but the deployed value is normalized
+# ("s3://bucket/path"), a difference the user did not make. normalize_slash absorbs it, so the
+# migration proceeds with no warning or recreate and the plan converges.
+
+title "Replay the prior terraform deployment (captured from a real terraform run)"
+trace replay_tfstate.py terraform-requests.json terraform.tfstate
+
+title "Migrate to direct with the same config (storage_root still has the trailing slash)"
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle deploy
+
+title "Follow-up plan on direct: does it converge or keep seeing a diff?"
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle plan
diff --git a/acceptance/bundle/migrate/auto/schema-storage-normalized/terraform-requests.json b/acceptance/bundle/migrate/auto/schema-storage-normalized/terraform-requests.json
new file mode 100644
index 00000000000..bca35cbd458
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/schema-storage-normalized/terraform-requests.json
@@ -0,0 +1,11 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.1/unity-catalog/schemas",
+    "body": {
+      "catalog_name": "main",
+      "name": "myschema",
+      "storage_root": "s3://bucket/path/"
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/auto/schema-storage-normalized/terraform.tfstate b/acceptance/bundle/migrate/auto/schema-storage-normalized/terraform.tfstate
new file mode 100644
index 00000000000..306b3eae42c
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/schema-storage-normalized/terraform.tfstate
@@ -0,0 +1,41 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "25045b58-c818-2e36-1759-c752d9798d39",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_schema",
+      "name": "my_schema",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "catalog_name": "main",
+            "comment": null,
+            "enable_predictive_optimization": "INHERIT",
+            "force_destroy": true,
+            "id": "main.myschema",
+            "metastore_id": "120efa64-9b68-46ba-be38-f319458430d2",
+            "name": "myschema",
+            "owner": "tester@databricks.com",
+            "properties": null,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "schema_id": "79fe88b1-3cc3-aea8-79fe-88b13cc3aea9",
+            "storage_root": "s3://bucket/path"
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/auto/tf-resource-type-references/databricks.yml b/acceptance/bundle/migrate/auto/tf-resource-type-references/databricks.yml
new file mode 100644
index 00000000000..6d91f6515bd
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/tf-resource-type-references/databricks.yml
@@ -0,0 +1,17 @@
+bundle:
+  name: test-bundle
+
+resources:
+  pipelines:
+    src_pipeline:
+      name: source-pipeline
+
+  jobs:
+    dst_job:
+      name: dst-job
+      tasks:
+        - task_key: main
+          pipeline_task:
+            # Terraform-style resource reference: databricks_pipeline is the terraform
+            # resource type for DABs "pipelines".
+            pipeline_id: ${databricks_pipeline.src_pipeline.id}
diff --git a/acceptance/bundle/migrate/auto/tf-resource-type-references/out.test.toml b/acceptance/bundle/migrate/auto/tf-resource-type-references/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/tf-resource-type-references/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/auto/tf-resource-type-references/output.txt b/acceptance/bundle/migrate/auto/tf-resource-type-references/output.txt
new file mode 100644
index 00000000000..a75cf4019df
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/tf-resource-type-references/output.txt
@@ -0,0 +1,42 @@
+
+=== Replay a prior terraform deployment
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate
+
+=== Validation does not flag the reference
+>>> [CLI] bundle validate
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Validation OK!
+
+=== Plan after auto-migration
+>>> musterr [CLI] bundle plan
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Error: invalid dependency "${databricks_pipeline.src_pipeline.id}", no such node ""
+
+
+=== Deploy after auto-migration
+>>> musterr [CLI] bundle deploy
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Error: invalid dependency "${databricks_pipeline.src_pipeline.id}", no such node ""
+
+Files: 1 uploaded, 0 deleted
+
+>>> [CLI] bundle destroy --auto-approve
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+The following resources will be deleted:
+  delete resources.jobs.dst_job
+  delete resources.pipelines.src_pipeline
+
+This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:
+  delete resources.pipelines.src_pipeline
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Migrated 2 resources to direct deployment engine.
+Destroy: 2 deleted
diff --git a/acceptance/bundle/migrate/auto/tf-resource-type-references/script b/acceptance/bundle/migrate/auto/tf-resource-type-references/script
new file mode 100644
index 00000000000..0eada0a9bf6
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/tf-resource-type-references/script
@@ -0,0 +1,21 @@
+export DATABRICKS_BUNDLE_ENGINE=
+
+# The config references the pipeline by its terraform resource type (${databricks_pipeline...}),
+# which terraform resolved on the original deploy. The direct engine does not support this syntax
+# (only terraform field paths inside ${resources.*}), so after auto-migration plan and deploy fail.
+title "Replay a prior terraform deployment"
+trace replay_tfstate.py terraform-requests.json terraform.tfstate
+rm -f "$OUT_REQUESTS"
+
+title "Validation does not flag the reference"
+trace $CLI bundle validate
+
+title "Plan after auto-migration"
+trace musterr $CLI bundle plan
+
+title "Deploy after auto-migration"
+trace musterr $CLI bundle deploy
+rm -f "$OUT_REQUESTS"
+
+trace $CLI bundle destroy --auto-approve
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/migrate/auto/tf-resource-type-references/terraform-requests.json b/acceptance/bundle/migrate/auto/tf-resource-type-references/terraform-requests.json
new file mode 100644
index 00000000000..b638e9f92d5
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/tf-resource-type-references/terraform-requests.json
@@ -0,0 +1,61 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/artifacts/.internal"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/workspace/mkdirs",
+    "body": {
+      "path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/files"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/pipelines",
+    "body": {
+      "channel": "CURRENT",
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json"
+      },
+      "edition": "ADVANCED",
+      "name": "source-pipeline"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "dst-job",
+      "queue": {
+        "enabled": true
+      },
+      "tasks": [
+        {
+          "pipeline_task": {
+            "pipeline_id": "7a00a8c6-b18f-59a8-7a00-a8c6b18f59a9"
+          },
+          "task_key": "main"
+        }
+      ]
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/auto/tf-resource-type-references/terraform.tfstate b/acceptance/bundle/migrate/auto/tf-resource-type-references/terraform.tfstate
new file mode 100644
index 00000000000..564391bbe5a
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/tf-resource-type-references/terraform.tfstate
@@ -0,0 +1,244 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 3,
+  "lineage": "feddf884-7b6a-3c90-968d-3dcc4761437e",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "dst_job",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8791212044006401000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "dst-job",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [
+              {
+                "ai_runtime_task": [],
+                "alert_task": [],
+                "clean_rooms_notebook_task": [],
+                "compute": [],
+                "condition_task": [],
+                "dashboard_task": [],
+                "dbt_cloud_task": [],
+                "dbt_platform_task": [],
+                "dbt_task": [],
+                "depends_on": [],
+                "description": "",
+                "disable_auto_optimization": false,
+                "disabled": false,
+                "email_notifications": [
+                  {
+                    "no_alert_for_skipped_runs": false,
+                    "on_duration_warning_threshold_exceeded": [],
+                    "on_failure": [],
+                    "on_start": [],
+                    "on_streaming_backlog_exceeded": [],
+                    "on_success": []
+                  }
+                ],
+                "environment_key": "",
+                "existing_cluster_id": "",
+                "for_each_task": [],
+                "gen_ai_compute_task": [],
+                "health": [],
+                "job_cluster_key": "",
+                "library": [],
+                "max_retries": 0,
+                "min_retry_interval_millis": 0,
+                "new_cluster": [],
+                "notebook_task": [],
+                "notification_settings": [],
+                "pipeline_task": [
+                  {
+                    "full_refresh": false,
+                    "full_refresh_selection": null,
+                    "parameters": null,
+                    "pipeline_id": "7a00a8c6-b18f-59a8-7a00-a8c6b18f59a9",
+                    "refresh_flow_selection": null,
+                    "refresh_selection": null,
+                    "reset_checkpoint_selection": null
+                  }
+                ],
+                "power_bi_task": [],
+                "python_operator_task": [],
+                "python_wheel_task": [],
+                "retry_on_timeout": false,
+                "run_if": "ALL_SUCCESS",
+                "run_job_task": [],
+                "spark_jar_task": [],
+                "spark_python_task": [],
+                "spark_submit_task": [],
+                "sql_task": [],
+                "task_key": "main",
+                "timeout_seconds": 0,
+                "webhook_notifications": []
+              }
+            ],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8791212044006401000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ==",
+          "dependencies": [
+            "databricks_pipeline.src_pipeline"
+          ]
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_pipeline",
+      "name": "src_pipeline",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "allow_duplicate_names": false,
+            "budget_policy_id": null,
+            "catalog": null,
+            "cause": null,
+            "channel": "CURRENT",
+            "cluster": [],
+            "cluster_id": null,
+            "configuration": null,
+            "continuous": false,
+            "creator_user_name": "tester@databricks.com",
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "development": false,
+            "edition": "ADVANCED",
+            "environment": [],
+            "event_log": [],
+            "expected_last_modified": 0,
+            "filters": [],
+            "gateway_definition": [],
+            "health": null,
+            "id": "7a00a8c6-b18f-59a8-7a00-a8c6b18f59a9",
+            "ingestion_definition": [],
+            "last_modified": 1791212043963,
+            "latest_updates": null,
+            "library": [],
+            "name": "source-pipeline",
+            "notification": [],
+            "photon": false,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "restart_window": [],
+            "root_path": null,
+            "run_as": [],
+            "run_as_user_name": "tester@databricks.com",
+            "schema": null,
+            "serverless": false,
+            "serverless_compute_id": null,
+            "state": "IDLE",
+            "storage": "dbfs:/pipelines/7a00a8c6-b18f-59a8-7a00-a8c6b18f59a9",
+            "tags": null,
+            "target": null,
+            "timeouts": null,
+            "trigger": [],
+            "url": "[DATABRICKS_URL]/#joblist/pipelines/7a00a8c6-b18f-59a8-7a00-a8c6b18f59a9",
+            "usage_policy_id": null
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxMjAwMDAwMDAwMDAwLCJkZWZhdWx0IjoxMjAwMDAwMDAwMDAwLCJkZWxldGUiOjEyMDAwMDAwMDAwMDAsInJlYWQiOjEyMDAwMDAwMDAwMDAsInVwZGF0ZSI6MTIwMDAwMDAwMDAwMH19"
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/auto/tfbackup-failure/databricks.yml b/acceptance/bundle/migrate/auto/tfbackup-failure/databricks.yml
new file mode 100644
index 00000000000..a16d144b0c9
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/tfbackup-failure/databricks.yml
@@ -0,0 +1,7 @@
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    test_job:
+      name: "Test Auto-Migrate Backup Failure"
diff --git a/acceptance/bundle/migrate/auto/tfbackup-failure/out.test.toml b/acceptance/bundle/migrate/auto/tfbackup-failure/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/tfbackup-failure/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/auto/tfbackup-failure/output.txt b/acceptance/bundle/migrate/auto/tfbackup-failure/output.txt
new file mode 100644
index 00000000000..8475d5c21a0
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/tfbackup-failure/output.txt
@@ -0,0 +1,43 @@
+
+=== Replay a prior terraform deployment (captured from a real terraform run)
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate
+
+=== Opt in via env var; inject 403 on the DELETE of remote terraform.tfstate
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle deploy
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Warn: backing up terraform state: could not delete terraform.tfstate: Fault injected by test.
+Migrated 1 resource to direct deployment engine.
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
+
+>>> print_migration_telemetry
+direct_migrated_via_env true
+
+=== Local state is now direct (migration succeeded with warning)
+
+>>> find.py \.databricks/.*(\.tfstate|resources.*\.json|\.wal)
+.databricks/bundle/default/resources.json
+.databricks/bundle/default/terraform/terraform.tfstate.backup
+
+>>> MSYS_NO_PATHCONV=1 [CLI] workspace list /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state
+ID                   Type  Language  Path
+[OBJECT_ID]  FILE            /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deployment.json
+[OBJECT_ID]  FILE            /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json
+[OBJECT_ID]  FILE            /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/resources.json
+[OBJECT_ID]  FILE            /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate
+[OBJECT_ID]  FILE            /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate.backup
+
+=== Retry: deploys on already-migrated direct state
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
+
+>>> print_migration_telemetry
+
+=== Local state remains direct
+
+>>> find.py \.databricks/.*(\.tfstate|resources.*\.json|\.wal)
+.databricks/bundle/default/resources.json
+.databricks/bundle/default/terraform/terraform.tfstate.backup
diff --git a/acceptance/bundle/migrate/auto/tfbackup-failure/script b/acceptance/bundle/migrate/auto/tfbackup-failure/script
new file mode 100644
index 00000000000..b2d2d9a6618
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/tfbackup-failure/script
@@ -0,0 +1,31 @@
+export DATABRICKS_BUNDLE_ENGINE=
+
+title "Replay a prior terraform deployment (captured from a real terraform run)"
+trace replay_tfstate.py terraform-requests.json terraform.tfstate
+rm -f "$OUT_REQUESTS"
+
+title "Opt in via env var; inject 403 on the DELETE of remote terraform.tfstate"
+# The approved deploy commits the migration (CommitMigration): it pushes resources.json, then
+# best-effort backs up and deletes the remote terraform.tfstate. That delete is the SECOND
+# workspace/delete of the run - the first is the artifacts/.internal cleanup - so OFFSET=1 faults
+# it. The delete failure is best-effort (resources.json already outranks the terraform state by
+# serial), so the migration succeeds with a warning and the remote terraform.tfstate and its
+# .backup both remain.
+fault.py "POST /api/2.0/workspace/delete" 403 1 1
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle deploy
+trace print_migration_telemetry
+rm -f "$OUT_REQUESTS"
+
+title "Local state is now direct (migration succeeded with warning)\n"
+trace find.py '\.databricks/.*(\.tfstate|resources.*\.json|\.wal)'
+trace MSYS_NO_PATHCONV=1 $CLI workspace list "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/test-bundle/default/state"
+
+title "Retry: deploys on already-migrated direct state"
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle deploy
+trace print_migration_telemetry
+rm -f "$OUT_REQUESTS"
+
+title "Local state remains direct\n"
+trace find.py '\.databricks/.*(\.tfstate|resources.*\.json|\.wal)'
+
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/migrate/auto/tfbackup-failure/terraform-requests.json b/acceptance/bundle/migrate/auto/tfbackup-failure/terraform-requests.json
new file mode 100644
index 00000000000..c4ddf421f43
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/tfbackup-failure/terraform-requests.json
@@ -0,0 +1,19 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "Test Auto-Migrate Backup Failure",
+      "queue": {
+        "enabled": true
+      }
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/auto/tfbackup-failure/terraform.tfstate b/acceptance/bundle/migrate/auto/tfbackup-failure/terraform.tfstate
new file mode 100644
index 00000000000..99e62630467
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/tfbackup-failure/terraform.tfstate
@@ -0,0 +1,110 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "0b9afba9-af0a-a76d-c3b1-2d81b54bdc14",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "test_job",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790613935512642000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "Test Auto-Migrate Backup Failure",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790613935512642000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/auto/volume-name-normalized/databricks.yml.tmpl b/acceptance/bundle/migrate/auto/volume-name-normalized/databricks.yml.tmpl
new file mode 100644
index 00000000000..c64198ef3ca
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/volume-name-normalized/databricks.yml.tmpl
@@ -0,0 +1,13 @@
+bundle:
+  name: uc-volname-$UNIQUE_NAME
+
+workspace:
+  root_path: ~/.bundle/$UNIQUE_NAME
+
+resources:
+  volumes:
+    my_volume:
+      catalog_name: main
+      schema_name: default
+      name: MyVolume-$UNIQUE_NAME
+      volume_type: MANAGED
diff --git a/acceptance/bundle/migrate/auto/volume-name-normalized/out.test.toml b/acceptance/bundle/migrate/auto/volume-name-normalized/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/volume-name-normalized/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/auto/volume-name-normalized/output.txt b/acceptance/bundle/migrate/auto/volume-name-normalized/output.txt
new file mode 100644
index 00000000000..38b0ebc578c
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/volume-name-normalized/output.txt
@@ -0,0 +1,30 @@
+
+=== Replay the prior terraform deployment (captured from a real terraform run)
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate
+
+=== Migrate to direct with the same config (mixed-case name unchanged)
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle deploy
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Migrated 1 resource to direct deployment engine.
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
+
+=== Follow-up plan on direct converges (the case-only difference is not a change)
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+=== Cleanup
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.volumes.my_volume
+
+This action will result in the deletion of the following volumes.
+For managed volumes, the files stored in the volume are also deleted from your
+cloud tenant within 30 days. For external volumes, the metadata about the volume
+is removed from the catalog, but the underlying files are not deleted:
+  delete resources.volumes.my_volume
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/migrate/auto/volume-name-normalized/script b/acceptance/bundle/migrate/auto/volume-name-normalized/script
new file mode 100644
index 00000000000..6714d068191
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/volume-name-normalized/script
@@ -0,0 +1,21 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+  title "Cleanup"
+  trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+# name is an immutable provided id field. UC lowercases it, so the deployed id differs from
+# config by case only, without the user changing anything. reconcileIDFields treats the
+# case-only difference as backend normalization and keeps the config value, so the migration
+# proceeds with no warning and the plan converges.
+
+title "Replay the prior terraform deployment (captured from a real terraform run)"
+trace replay_tfstate.py terraform-requests.json terraform.tfstate
+
+title "Migrate to direct with the same config (mixed-case name unchanged)"
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle deploy
+
+title "Follow-up plan on direct converges (the case-only difference is not a change)"
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle plan
diff --git a/acceptance/bundle/migrate/auto/volume-name-normalized/terraform-requests.json b/acceptance/bundle/migrate/auto/volume-name-normalized/terraform-requests.json
new file mode 100644
index 00000000000..4763e0eb852
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/volume-name-normalized/terraform-requests.json
@@ -0,0 +1,12 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.1/unity-catalog/volumes",
+    "body": {
+      "catalog_name": "main",
+      "name": "MyVolume-[UNIQUE_NAME]",
+      "schema_name": "default",
+      "volume_type": "MANAGED"
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/auto/volume-name-normalized/terraform.tfstate b/acceptance/bundle/migrate/auto/volume-name-normalized/terraform.tfstate
new file mode 100644
index 00000000000..133f595761c
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/volume-name-normalized/terraform.tfstate
@@ -0,0 +1,39 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "9e8dd82b-acd0-2bf6-dfa2-d736bcff7b1b",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_volume",
+      "name": "my_volume",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "catalog_name": "main",
+            "comment": null,
+            "id": "main.default.myvolume-[UNIQUE_NAME]",
+            "name": "myvolume-[UNIQUE_NAME]",
+            "owner": "tester@databricks.com",
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "schema_name": "default",
+            "storage_location": "s3://deco-uc-prod-isolated-aws-us-east-1/metastore/120efa64-9b68-46ba-be38-f319458430d2/volumes/79fe88d4-0f11-b590-79fe-88d40f11b591",
+            "volume_path": "/Volumes/main/default/myvolume-[UNIQUE_NAME]",
+            "volume_type": "MANAGED"
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/auto/volume-name-normalized/test.toml b/acceptance/bundle/migrate/auto/volume-name-normalized/test.toml
new file mode 100644
index 00000000000..b61ef681ed8
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/volume-name-normalized/test.toml
@@ -0,0 +1,10 @@
+# Local-only: the replay fixtures are captured against the fake server, so they reproduce a
+# terraform state only there, not on a real workspace (replaying them on cloud fails auth and
+# hits backend validation the mock does not enforce).
+Cloud = false
+RecordRequests = false
+
+Ignore = [
+    ".databricks",
+    "databricks.yml",
+]
diff --git a/acceptance/bundle/migrate/auto/volume-rename/databricks.yml.tmpl b/acceptance/bundle/migrate/auto/volume-rename/databricks.yml.tmpl
new file mode 100644
index 00000000000..10bfccbb9e1
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/volume-rename/databricks.yml.tmpl
@@ -0,0 +1,17 @@
+bundle:
+  name: uc-migrvol-$UNIQUE_NAME
+
+workspace:
+  root_path: ~/.bundle/$UNIQUE_NAME
+
+resources:
+  schemas:
+    parent:
+      name: pschema-$UNIQUE_NAME
+      catalog_name: main
+  volumes:
+    my_volume:
+      name: thevolume-$UNIQUE_NAME
+      catalog_name: main
+      schema_name: pschema-$UNIQUE_NAME
+      volume_type: MANAGED
diff --git a/acceptance/bundle/migrate/auto/volume-rename/out.test.toml b/acceptance/bundle/migrate/auto/volume-rename/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/volume-rename/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/auto/volume-rename/output.txt b/acceptance/bundle/migrate/auto/volume-rename/output.txt
new file mode 100644
index 00000000000..762538efab5
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/volume-rename/output.txt
@@ -0,0 +1,48 @@
+
+=== Replay the prior terraform deployment (captured from a real terraform run)
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate
+
+=== Rename the volume (an updatable id field) and deploy on direct
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle deploy
+Warn: migration to direct: volumes.my_volume: name differs between config ("thevolume-[UNIQUE_NAME]-renamed") and terraform state ("thevolume-[UNIQUE_NAME]"); this resource will be renamed.
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Migrated 2 resources to direct deployment engine.
+Updated volumes.my_volume
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 1 unchanged
+
+=== Retry on direct: state now matches the backend, so the migration succeeds
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 2 unchanged
+
+=== The volume exists under the new name and the local state is direct
+>>> [CLI] volumes read main.pschema-[UNIQUE_NAME].thevolume-[UNIQUE_NAME]-renamed
+{
+  "full_name": "main.pschema-[UNIQUE_NAME].thevolume-[UNIQUE_NAME]-renamed"
+}
+
+>>> find.py \.databricks/.*(\.tfstate|resources.*\.json|\.wal)
+.databricks/bundle/default/resources.json
+.databricks/bundle/default/terraform/terraform.tfstate.backup
+
+=== Cleanup
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.schemas.parent
+  delete resources.volumes.my_volume
+
+This action will result in the deletion of the following UC schemas. Any underlying data may be lost:
+  delete resources.schemas.parent
+
+This action will result in the deletion of the following volumes.
+For managed volumes, the files stored in the volume are also deleted from your
+cloud tenant within 30 days. For external volumes, the metadata about the volume
+is removed from the catalog, but the underlying files are not deleted:
+  delete resources.volumes.my_volume
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/migrate/auto/volume-rename/script b/acceptance/bundle/migrate/auto/volume-rename/script
new file mode 100644
index 00000000000..5ef772365b7
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/volume-rename/script
@@ -0,0 +1,26 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+  title "Cleanup"
+  trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+title "Replay the prior terraform deployment (captured from a real terraform run)"
+trace replay_tfstate.py terraform-requests.json terraform.tfstate
+
+title "Rename the volume (an updatable id field) and deploy on direct"
+# Unlike a schema (whose name recreates), a volume name is an updatable id field: it is
+# renamed in place (UpdateWithID). The migration seeds the deployed name into the converted
+# state, so its plan sees a rename and the migration succeeds; the deploy then renames the
+# volume rather than the migration snapshotting the new name as already applied. Verifies the
+# updatable-id path against the real backend.
+update_file.py databricks.yml "thevolume-$UNIQUE_NAME" "thevolume-$UNIQUE_NAME-renamed"
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle deploy
+
+title "Retry on direct: state now matches the backend, so the migration succeeds"
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle deploy
+
+title "The volume exists under the new name and the local state is direct"
+trace $CLI volumes read "main.pschema-$UNIQUE_NAME.thevolume-$UNIQUE_NAME-renamed" | jq "{full_name}"
+trace find.py '\.databricks/.*(\.tfstate|resources.*\.json|\.wal)'
diff --git a/acceptance/bundle/migrate/auto/volume-rename/terraform-requests.json b/acceptance/bundle/migrate/auto/volume-rename/terraform-requests.json
new file mode 100644
index 00000000000..4146ec77e8b
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/volume-rename/terraform-requests.json
@@ -0,0 +1,20 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.1/unity-catalog/schemas",
+    "body": {
+      "catalog_name": "main",
+      "name": "pschema-[UNIQUE_NAME]"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.1/unity-catalog/volumes",
+    "body": {
+      "catalog_name": "main",
+      "name": "thevolume-[UNIQUE_NAME]",
+      "schema_name": "pschema-[UNIQUE_NAME]",
+      "volume_type": "MANAGED"
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/auto/volume-rename/terraform.tfstate b/acceptance/bundle/migrate/auto/volume-rename/terraform.tfstate
new file mode 100644
index 00000000000..c35e7d36bc4
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/volume-rename/terraform.tfstate
@@ -0,0 +1,73 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 3,
+  "lineage": "0e934b56-6175-2115-0be1-c7409a5c51b7",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_schema",
+      "name": "parent",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "catalog_name": "main",
+            "comment": null,
+            "enable_predictive_optimization": "INHERIT",
+            "force_destroy": true,
+            "id": "main.pschema-[UNIQUE_NAME]",
+            "metastore_id": "120efa64-9b68-46ba-be38-f319458430d2",
+            "name": "pschema-[UNIQUE_NAME]",
+            "owner": "tester@databricks.com",
+            "properties": null,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "schema_id": "79fe88d4-0fae-7a60-79fe-88d40fae7e48",
+            "storage_root": null
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA=="
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_volume",
+      "name": "my_volume",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "catalog_name": "main",
+            "comment": null,
+            "id": "main.pschema-[UNIQUE_NAME].thevolume-[UNIQUE_NAME]",
+            "name": "thevolume-[UNIQUE_NAME]",
+            "owner": "tester@databricks.com",
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "schema_name": "pschema-[UNIQUE_NAME]",
+            "storage_location": "s3://deco-uc-prod-isolated-aws-us-east-1/metastore/120efa64-9b68-46ba-be38-f319458430d2/volumes/79fe88d4-1078-f650-79fe-88d41078f651",
+            "volume_path": "/Volumes/main/pschema-[UNIQUE_NAME]/thevolume-[UNIQUE_NAME]",
+            "volume_type": "MANAGED"
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "databricks_schema.parent"
+          ]
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/auto/volume-rename/test.toml b/acceptance/bundle/migrate/auto/volume-rename/test.toml
new file mode 100644
index 00000000000..b61ef681ed8
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/volume-rename/test.toml
@@ -0,0 +1,10 @@
+# Local-only: the replay fixtures are captured against the fake server, so they reproduce a
+# terraform state only there, not on a real workspace (replaying them on cloud fails auth and
+# hits backend validation the mock does not enforce).
+Cloud = false
+RecordRequests = false
+
+Ignore = [
+    ".databricks",
+    "databricks.yml",
+]
diff --git a/acceptance/bundle/migrate/auto/volume-type-change/databricks.yml b/acceptance/bundle/migrate/auto/volume-type-change/databricks.yml
new file mode 100644
index 00000000000..c90a9506ef9
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/volume-type-change/databricks.yml
@@ -0,0 +1,10 @@
+bundle:
+  name: test-bundle
+
+resources:
+  volumes:
+    my_volume:
+      catalog_name: main
+      schema_name: default
+      name: myvolume
+      volume_type: MANAGED
diff --git a/acceptance/bundle/migrate/auto/volume-type-change/out.test.toml b/acceptance/bundle/migrate/auto/volume-type-change/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/volume-type-change/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/auto/volume-type-change/output.txt b/acceptance/bundle/migrate/auto/volume-type-change/output.txt
new file mode 100644
index 00000000000..40989888210
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/volume-type-change/output.txt
@@ -0,0 +1,25 @@
+
+=== Replay the prior terraform deployment (captured from a real terraform run)
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate
+
+=== Change volume_type (immutable); without --auto-approve the recreate is refused
+>>> DATABRICKS_BUNDLE_ENGINE=direct errcode [CLI] bundle deploy
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+
+This action will result in the deletion or recreation of the following volumes.
+For managed volumes, the files stored in the volume are also deleted from your
+cloud tenant within 30 days. For external volumes, the metadata about the volume
+is removed from the catalog, but the underlying files are not deleted:
+  recreate resources.volumes.my_volume
+Warn: Migration not committed, keeping Terraform state
+Error: the deployment requires destructive actions, but the current console does not support prompting.
+Deleting data assets such as schemas, pipelines, or volumes may cause permanent data loss and should be carefully reviewed.
+To proceed, use --auto-approve after reviewing the plan above.
+
+Files: 1 uploaded, 0 deleted
+
+Exit code: 1
+
+>>> print_migration_telemetry
+direct_migrate_recreate_planned true
diff --git a/acceptance/bundle/migrate/auto/volume-type-change/script b/acceptance/bundle/migrate/auto/volume-type-change/script
new file mode 100644
index 00000000000..6b02a55f247
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/volume-type-change/script
@@ -0,0 +1,19 @@
+export DATABRICKS_BUNDLE_ENGINE=
+
+# Testserver-only: changing volume_type to EXTERNAL needs a storage_location backed by a
+# registered external location on a real workspace, so this is not Cloud-enabled. The
+# recreate class it covers is verified on cloud by schema-rename / registered-model-rename.
+
+# volume_type is both a provided id field and a recreate_on_changes field. reconcileIDFields
+# records the deployed value, so the migration's plan sees a real change and recreates. Volumes
+# are in the destructive-approval group, so without --auto-approve the deploy refuses the
+# recreate (exit 1) and the migration is not committed.
+
+title "Replay the prior terraform deployment (captured from a real terraform run)"
+trace replay_tfstate.py terraform-requests.json terraform.tfstate
+rm -f "$OUT_REQUESTS"
+
+title "Change volume_type (immutable); without --auto-approve the recreate is refused"
+update_file.py databricks.yml "volume_type: MANAGED" "volume_type: EXTERNAL"
+trace DATABRICKS_BUNDLE_ENGINE=direct errcode $CLI bundle deploy
+trace print_migration_telemetry
diff --git a/acceptance/bundle/migrate/auto/volume-type-change/terraform-requests.json b/acceptance/bundle/migrate/auto/volume-type-change/terraform-requests.json
new file mode 100644
index 00000000000..09adcd7745e
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/volume-type-change/terraform-requests.json
@@ -0,0 +1,12 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.1/unity-catalog/volumes",
+    "body": {
+      "catalog_name": "main",
+      "name": "myvolume",
+      "schema_name": "default",
+      "volume_type": "MANAGED"
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/auto/volume-type-change/terraform.tfstate b/acceptance/bundle/migrate/auto/volume-type-change/terraform.tfstate
new file mode 100644
index 00000000000..16923e4f957
--- /dev/null
+++ b/acceptance/bundle/migrate/auto/volume-type-change/terraform.tfstate
@@ -0,0 +1,39 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "a9d4a05d-74a7-4d2a-0a69-63593884413f",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_volume",
+      "name": "my_volume",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "catalog_name": "main",
+            "comment": null,
+            "id": "main.default.myvolume",
+            "name": "myvolume",
+            "owner": "tester@databricks.com",
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "schema_name": "default",
+            "storage_location": "s3://deco-uc-prod-isolated-aws-us-east-1/metastore/120efa64-9b68-46ba-be38-f319458430d2/volumes/79fe88b1-3b67-4358-79fe-88b13b674359",
+            "volume_path": "/Volumes/main/default/myvolume",
+            "volume_type": "MANAGED"
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/basic/out.new_state.json b/acceptance/bundle/migrate/basic/out.new_state.json
deleted file mode 100644
index c5e2050d921..00000000000
--- a/acceptance/bundle/migrate/basic/out.new_state.json
+++ /dev/null
@@ -1,94 +0,0 @@
-{
- "state_version": 2,
- "cli_version": "[DEV_VERSION]",
- "lineage": "[UUID]",
- "serial": 6,
- "state": {
-  "resources.jobs.test_job": {
-   "__id__": "[NUMID]",
-   "state": {
-    "deployment": {
-     "kind": "BUNDLE",
-     "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/dev/state/metadata.json"
-    },
-    "edit_mode": "UI_LOCKED",
-    "format": "MULTI_TASK",
-    "max_concurrent_runs": 1,
-    "name": "Test Migration Job",
-    "queue": {
-     "enabled": true
-    },
-    "tasks": [
-     {
-      "notebook_task": {
-       "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/dev/files/notebook"
-      },
-      "task_key": "main"
-     }
-    ]
-   }
-  },
-  "resources.pipelines.test_pipeline": {
-   "__id__": "[UUID]",
-   "state": {
-    "channel": "CURRENT",
-    "deployment": {
-     "kind": "BUNDLE",
-     "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/dev/state/metadata.json"
-    },
-    "edition": "ADVANCED",
-    "libraries": [
-     {
-      "notebook": {
-       "path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/dev/files/pipeline"
-      }
-     }
-    ],
-    "name": "Test Migration Pipeline",
-    "tags": {
-     "myjob_id": "[NUMID]",
-     "myjob_name": "Test Migration Job",
-     "myjob_timeout": "0",
-     "myvolume_id": "mycat.myschema.myvol",
-     "volume_catalog_name": "mycat",
-     "volume_storage_location": "s3://[METASTORE_NAME]/metastore/[UUID]/volumes/[UUID]"
-    }
-   },
-   "depends_on": [
-    {
-     "node": "resources.jobs.test_job",
-     "label": "${resources.jobs.test_job.id}"
-    },
-    {
-     "node": "resources.jobs.test_job",
-     "label": "${resources.jobs.test_job.name}"
-    },
-    {
-     "node": "resources.jobs.test_job",
-     "label": "${resources.jobs.test_job.timeout_seconds}"
-    },
-    {
-     "node": "resources.volumes.test_volume",
-     "label": "${resources.volumes.test_volume.catalog_name}"
-    },
-    {
-     "node": "resources.volumes.test_volume",
-     "label": "${resources.volumes.test_volume.id}"
-    },
-    {
-     "node": "resources.volumes.test_volume",
-     "label": "${resources.volumes.test_volume.storage_location}"
-    }
-   ]
-  },
-  "resources.volumes.test_volume": {
-   "__id__": "mycat.myschema.myvol",
-   "state": {
-    "catalog_name": "mycat",
-    "name": "myvol",
-    "schema_name": "myschema",
-    "volume_type": "MANAGED"
-   }
-  }
- }
-}
diff --git a/acceptance/bundle/migrate/basic/out.original_state.json b/acceptance/bundle/migrate/basic/out.original_state.json
deleted file mode 100644
index 65e976ff461..00000000000
--- a/acceptance/bundle/migrate/basic/out.original_state.json
+++ /dev/null
@@ -1,270 +0,0 @@
-{
-  "version": 4,
-  "terraform_version": "1.5.5",
-  "serial": 4,
-  "lineage": "[UUID]",
-  "outputs": {},
-  "resources": [
-    {
-      "mode": "managed",
-      "type": "databricks_job",
-      "name": "test_job",
-      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
-      "instances": [
-        {
-          "schema_version": 2,
-          "attributes": {
-            "always_running": false,
-            "budget_policy_id": null,
-            "continuous": [],
-            "control_run_state": false,
-            "dbt_task": [],
-            "deployment": [
-              {
-                "kind": "BUNDLE",
-                "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/dev/state/metadata.json"
-              }
-            ],
-            "description": null,
-            "edit_mode": "UI_LOCKED",
-            "email_notifications": [
-              {
-                "no_alert_for_skipped_runs": false,
-                "on_duration_warning_threshold_exceeded": [],
-                "on_failure": [],
-                "on_start": [],
-                "on_streaming_backlog_exceeded": [],
-                "on_success": []
-              }
-            ],
-            "environment": [],
-            "existing_cluster_id": null,
-            "format": "MULTI_TASK",
-            "git_source": [],
-            "health": [],
-            "id": "[NUMID]",
-            "job_cluster": [],
-            "library": [],
-            "max_concurrent_runs": 1,
-            "max_retries": 0,
-            "min_retry_interval_millis": 0,
-            "name": "Test Migration Job",
-            "new_cluster": [],
-            "notebook_task": [],
-            "notification_settings": [],
-            "parameter": [],
-            "performance_target": null,
-            "pipeline_task": [],
-            "provider_config": [],
-            "python_wheel_task": [],
-            "queue": [
-              {
-                "enabled": true
-              }
-            ],
-            "retry_on_timeout": false,
-            "run_as": [
-              {
-                "group_name": "",
-                "service_principal_name": "",
-                "user_name": "[USERNAME]"
-              }
-            ],
-            "run_job_task": [],
-            "schedule": [],
-            "spark_jar_task": [],
-            "spark_python_task": [],
-            "spark_submit_task": [],
-            "tags": null,
-            "task": [
-              {
-                "alert_task": [],
-                "clean_rooms_notebook_task": [],
-                "compute": [],
-                "condition_task": [],
-                "dashboard_task": [],
-                "dbt_cloud_task": [],
-                "dbt_platform_task": [],
-                "dbt_task": [],
-                "depends_on": [],
-                "description": "",
-                "disable_auto_optimization": false,
-                "disabled": false,
-                "email_notifications": [
-                  {
-                    "no_alert_for_skipped_runs": false,
-                    "on_duration_warning_threshold_exceeded": [],
-                    "on_failure": [],
-                    "on_start": [],
-                    "on_streaming_backlog_exceeded": [],
-                    "on_success": []
-                  }
-                ],
-                "environment_key": "",
-                "existing_cluster_id": "",
-                "for_each_task": [],
-                "gen_ai_compute_task": [],
-                "health": [],
-                "job_cluster_key": "",
-                "library": [],
-                "max_retries": 0,
-                "min_retry_interval_millis": 0,
-                "new_cluster": [],
-                "notebook_task": [
-                  {
-                    "base_parameters": null,
-                    "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/dev/files/notebook",
-                    "source": "WORKSPACE",
-                    "warehouse_id": ""
-                  }
-                ],
-                "notification_settings": [],
-                "pipeline_task": [],
-                "power_bi_task": [],
-                "python_wheel_task": [],
-                "retry_on_timeout": false,
-                "run_if": "ALL_SUCCESS",
-                "run_job_task": [],
-                "spark_jar_task": [],
-                "spark_python_task": [],
-                "spark_submit_task": [],
-                "sql_task": [],
-                "task_key": "main",
-                "timeout_seconds": 0,
-                "webhook_notifications": []
-              }
-            ],
-            "timeout_seconds": 0,
-            "timeouts": null,
-            "trigger": [],
-            "url": "[DATABRICKS_URL]/#job/[NUMID]",
-            "usage_policy_id": null,
-            "webhook_notifications": [
-              {
-                "on_duration_warning_threshold_exceeded": [],
-                "on_failure": [],
-                "on_start": [],
-                "on_streaming_backlog_exceeded": [],
-                "on_success": []
-              }
-            ]
-          },
-          "sensitive_attributes": [],
-          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
-        }
-      ]
-    },
-    {
-      "mode": "managed",
-      "type": "databricks_pipeline",
-      "name": "test_pipeline",
-      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
-      "instances": [
-        {
-          "schema_version": 0,
-          "attributes": {
-            "allow_duplicate_names": false,
-            "budget_policy_id": null,
-            "catalog": null,
-            "cause": null,
-            "channel": "CURRENT",
-            "cluster": [],
-            "cluster_id": null,
-            "configuration": null,
-            "continuous": false,
-            "creator_user_name": "[USERNAME]",
-            "deployment": [
-              {
-                "kind": "BUNDLE",
-                "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/dev/state/metadata.json"
-              }
-            ],
-            "development": false,
-            "edition": "ADVANCED",
-            "environment": [],
-            "event_log": [],
-            "expected_last_modified": 0,
-            "filters": [],
-            "gateway_definition": [],
-            "health": null,
-            "id": "[UUID]",
-            "ingestion_definition": [],
-            "last_modified": [UNIX_TIME_MILLIS],
-            "latest_updates": null,
-            "library": [
-              {
-                "file": [],
-                "glob": [],
-                "jar": "",
-                "maven": [],
-                "notebook": [
-                  {
-                    "path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/dev/files/pipeline"
-                  }
-                ],
-                "whl": ""
-              }
-            ],
-            "name": "Test Migration Pipeline",
-            "notification": [],
-            "photon": false,
-            "provider_config": [],
-            "restart_window": [],
-            "root_path": null,
-            "run_as": [],
-            "run_as_user_name": "[USERNAME]",
-            "schema": null,
-            "serverless": false,
-            "state": "IDLE",
-            "storage": "dbfs:/pipelines/[UUID]",
-            "tags": {
-              "myjob_id": "[NUMID]",
-              "myjob_name": "Test Migration Job",
-              "myjob_timeout": "0",
-              "myvolume_id": "mycat.myschema.myvol",
-              "volume_catalog_name": "mycat",
-              "volume_storage_location": "s3://[METASTORE_NAME]/metastore/[UUID]/volumes/[UUID]"
-            },
-            "target": null,
-            "timeouts": null,
-            "trigger": [],
-            "url": "[DATABRICKS_URL]/#joblist/pipelines/[UUID]",
-            "usage_policy_id": null
-          },
-          "sensitive_attributes": [],
-          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxMjAwMDAwMDAwMDAwLCJkZWZhdWx0IjoxMjAwMDAwMDAwMDAwLCJkZWxldGUiOjEyMDAwMDAwMDAwMDAsInJlYWQiOjEyMDAwMDAwMDAwMDAsInVwZGF0ZSI6MTIwMDAwMDAwMDAwMH19",
-          "dependencies": [
-            "databricks_job.test_job",
-            "databricks_volume.test_volume"
-          ]
-        }
-      ]
-    },
-    {
-      "mode": "managed",
-      "type": "databricks_volume",
-      "name": "test_volume",
-      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
-      "instances": [
-        {
-          "schema_version": 0,
-          "attributes": {
-            "catalog_name": "mycat",
-            "comment": null,
-            "id": "mycat.myschema.myvol",
-            "name": "myvol",
-            "owner": "[USERNAME]",
-            "provider_config": [],
-            "schema_name": "myschema",
-            "storage_location": "s3://[METASTORE_NAME]/metastore/[UUID]/volumes/[UUID]",
-            "volume_path": "/Volumes/mycat/myschema/myvol",
-            "volume_type": "MANAGED"
-          },
-          "sensitive_attributes": [],
-          "private": "bnVsbA=="
-        }
-      ]
-    }
-  ],
-  "check_results": null
-}
diff --git a/acceptance/bundle/migrate/basic/out.plan_update.json b/acceptance/bundle/migrate/basic/out.plan_update.json
deleted file mode 100644
index 44ba986a2f6..00000000000
--- a/acceptance/bundle/migrate/basic/out.plan_update.json
+++ /dev/null
@@ -1,247 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 8,
-  "plan": {
-    "resources.jobs.test_job": {
-      "action": "update",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/dev/state/metadata.json"
-          },
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "Test Migrated Job",
-          "queue": {
-            "enabled": true
-          },
-          "tasks": [
-            {
-              "notebook_task": {
-                "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/dev/files/notebook"
-              },
-              "task_key": "main"
-            }
-          ]
-        }
-      },
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS][0],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/dev/state/metadata.json"
-        },
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_id": [NUMID],
-        "max_concurrent_runs": 1,
-        "name": "Test Migration Job",
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "tasks": [
-          {
-            "email_notifications": {},
-            "notebook_task": {
-              "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/dev/files/notebook",
-              "source": "WORKSPACE"
-            },
-            "run_if": "ALL_SUCCESS",
-            "task_key": "main",
-            "timeout_seconds": 0
-          }
-        ],
-        "timeout_seconds": 0,
-        "webhook_notifications": {}
-      },
-      "changes": {
-        "email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "name": {
-          "action": "update",
-          "old": "Test Migration Job",
-          "new": "Test Migrated Job",
-          "remote": "Test Migration Job"
-        },
-        "tasks[task_key='main'].email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks[task_key='main'].notebook_task.source": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "WORKSPACE"
-        },
-        "tasks[task_key='main'].run_if": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "ALL_SUCCESS"
-        },
-        "tasks[task_key='main'].timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "webhook_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        }
-      }
-    },
-    "resources.pipelines.test_pipeline": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.test_job",
-          "label": "${resources.jobs.test_job.id}"
-        },
-        {
-          "node": "resources.jobs.test_job",
-          "label": "${resources.jobs.test_job.name}"
-        },
-        {
-          "node": "resources.jobs.test_job",
-          "label": "${resources.jobs.test_job.timeout_seconds}"
-        },
-        {
-          "node": "resources.volumes.test_volume",
-          "label": "${resources.volumes.test_volume.catalog_name}"
-        },
-        {
-          "node": "resources.volumes.test_volume",
-          "label": "${resources.volumes.test_volume.id}"
-        },
-        {
-          "node": "resources.volumes.test_volume",
-          "label": "${resources.volumes.test_volume.storage_location}"
-        }
-      ],
-      "action": "update",
-      "new_state": {
-        "value": {
-          "channel": "CURRENT",
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/dev/state/metadata.json"
-          },
-          "edition": "ADVANCED",
-          "libraries": [
-            {
-              "notebook": {
-                "path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/dev/files/pipeline"
-              }
-            }
-          ],
-          "name": "Test Migrated Pipeline",
-          "tags": {
-            "myjob_id": "[NUMID]",
-            "myjob_name": "Test Migrated Job",
-            "myjob_timeout": "${resources.jobs.test_job.timeout_seconds}",
-            "myvolume_id": "mycat.myschema.myvol",
-            "volume_catalog_name": "mycat",
-            "volume_storage_location": "s3://[METASTORE_NAME]/metastore/[UUID]/volumes/[UUID]"
-          }
-        },
-        "vars": {
-          "tags.myjob_timeout": "${resources.jobs.test_job.timeout_seconds}"
-        }
-      },
-      "remote_state": {
-        "channel": "CURRENT",
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/dev/state/metadata.json"
-        },
-        "edition": "ADVANCED",
-        "effective_publishing_mode": "DEFAULT_PUBLISHING_MODE",
-        "id": "[UUID]",
-        "last_modified": [UNIX_TIME_MILLIS][1],
-        "libraries": [
-          {
-            "notebook": {
-              "path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/dev/files/pipeline"
-            }
-          }
-        ],
-        "name": "Test Migration Pipeline",
-        "pipeline_id": "[UUID]",
-        "run_as_user_name": "[USERNAME]",
-        "state": "IDLE",
-        "storage": "dbfs:/pipelines/[UUID]",
-        "tags": {
-          "myjob_id": "[NUMID]",
-          "myjob_name": "Test Migration Job",
-          "myjob_timeout": "0",
-          "myvolume_id": "mycat.myschema.myvol",
-          "volume_catalog_name": "mycat",
-          "volume_storage_location": "s3://[METASTORE_NAME]/metastore/[UUID]/volumes/[UUID]"
-        }
-      },
-      "changes": {
-        "name": {
-          "action": "update",
-          "old": "Test Migration Pipeline",
-          "new": "Test Migrated Pipeline",
-          "remote": "Test Migration Pipeline"
-        },
-        "storage": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "dbfs:/pipelines/[UUID]"
-        },
-        "tags['myjob_name']": {
-          "action": "update",
-          "old": "Test Migration Job",
-          "new": "Test Migrated Job",
-          "remote": "Test Migration Job"
-        },
-        "tags['myjob_timeout']": {
-          "action": "update",
-          "old": "0",
-          "new": "${resources.jobs.test_job.timeout_seconds}",
-          "remote": "0"
-        }
-      }
-    },
-    "resources.volumes.test_volume": {
-      "action": "skip",
-      "remote_state": {
-        "catalog_name": "mycat",
-        "created_at": [UNIX_TIME_MILLIS][2],
-        "created_by": "[USERNAME]",
-        "full_name": "mycat.myschema.myvol",
-        "name": "myvol",
-        "owner": "[USERNAME]",
-        "schema_name": "myschema",
-        "storage_location": "s3://[METASTORE_NAME]/metastore/[UUID]/volumes/[UUID]",
-        "updated_at": [UNIX_TIME_MILLIS][2],
-        "volume_id": "[UUID]",
-        "volume_type": "MANAGED"
-      },
-      "changes": {
-        "storage_location": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "s3://[METASTORE_NAME]/metastore/[UUID]/volumes/[UUID]"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/migrate/basic/out.test.toml b/acceptance/bundle/migrate/basic/out.test.toml
deleted file mode 100644
index e90b6d5d1ba..00000000000
--- a/acceptance/bundle/migrate/basic/out.test.toml
+++ /dev/null
@@ -1,3 +0,0 @@
-Local = true
-Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/migrate/basic/output.txt b/acceptance/bundle/migrate/basic/output.txt
deleted file mode 100644
index 0d31bbd682f..00000000000
--- a/acceptance/bundle/migrate/basic/output.txt
+++ /dev/null
@@ -1,131 +0,0 @@
-
->>> musterr [CLI] bundle deployment migrate
-Error: This command migrates the existing Terraform state file (terraform.tfstate) to a direct deployment state file (resources.json). However, no existing local or remote state was found.
-
-To start using direct engine, set "engine: direct" under bundle in your databricks.yml or deploy with DATABRICKS_BUNDLE_ENGINE=direct env var set.
-
->>> DATABRICKS_BUNDLE_ENGINE=terraform [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/dev/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> [CLI] bundle deployment migrate
-Note: Migration should be done after a full deploy. Running plan now to verify that deployment was done:
-Plan: 0 to add, 0 to change, 0 to delete, 3 unchanged
-Success! Migrated 3 resources to direct engine state file: [TEST_TMP_DIR]/.databricks/bundle/dev/resources.json
-
-Validate the migration by running "databricks bundle plan", there should be no actions planned.
-
-The state file is not synchronized to the workspace yet. To do that and finalize the migration, run "bundle deploy".
-
-To undo the migration, remove [TEST_TMP_DIR]/.databricks/bundle/dev/resources.json and rename [TEST_TMP_DIR]/.databricks/bundle/dev/terraform/terraform.tfstate.backup to [TEST_TMP_DIR]/.databricks/bundle/dev/terraform/terraform.tfstate
-
-
->>> diff out.original_state.json out.backup_state.json
-
->>> jq .state."resources.pipelines.test_pipeline".state.tags.volume_storage_location out.new_state.json
-"s3://[METASTORE_NAME]/metastore/[UUID]/volumes/[UUID]"
-
->>> DATABRICKS_BUNDLE_ENGINE=terraform [CLI] bundle plan
-Plan: 0 to add, 0 to change, 0 to delete, 3 unchanged
-
->>> DATABRICKS_BUNDLE_ENGINE=terraform [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/dev/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
-=== Should show that it's already migrated
->>> musterr [CLI] bundle deployment migrate
-Error: already using direct engine
-Details: [TEST_TMP_DIR]/.databricks/bundle/dev/resources.json: local direct state serial=7 lineage="[UUID]"
-
->>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle plan
-Plan: 0 to add, 0 to change, 0 to delete, 3 unchanged
-
->>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle plan
-Plan: 0 to add, 0 to change, 0 to delete, 3 unchanged
-
->>> print_requests.py --get //jobs/get
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.2/jobs/get",
-  "q": {
-    "job_id": "[NUMID]"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.2/jobs/get",
-  "q": {
-    "job_id": "[NUMID]"
-  }
-}
-
->>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/dev/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> print_requests.py --get //jobs/get
-"cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
-"cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
-
-=== Should show that it's already migrated
->>> musterr [CLI] bundle deployment migrate
-Error: already using direct engine
-Details: [TEST_TMP_DIR]/.databricks/bundle/dev/resources.json: local direct state serial=8 lineage="[UUID]"
-
->>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle debug states
-[TEST_TMP_DIR]/.databricks/bundle/dev/resources.json: local direct state serial=8 lineage="[UUID]"
-
->>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle debug states --force-pull
-resources.json: remote direct state serial=8 lineage="[UUID]"
-[TEST_TMP_DIR]/.databricks/bundle/dev/resources.json: local direct state serial=8 lineage="[UUID]"
-
-=== Extra plan: should have no drift
->>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle plan
-Plan: 0 to add, 0 to change, 0 to delete, 3 unchanged
-
-=== Update databricks.yml, run plan & update
->>> update_file.py databricks.yml Migration Migrated
-
->>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle plan
-update jobs.test_job
-update pipelines.test_pipeline
-
-Plan: 0 to add, 2 to change, 0 to delete, 1 unchanged
-
->>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle plan -o json
-
->>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/dev/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
-=== Different target, still on terraform
->>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle deploy -t prod
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/prod/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle debug states -t prod
-[TEST_TMP_DIR]/.databricks/bundle/prod/terraform/terraform.tfstate: local terraform state serial=5 lineage="[UUID]"
-
->>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle debug states -t prod --force-pull
-terraform.tfstate: remote terraform state serial=5 lineage="[UUID]"
-[TEST_TMP_DIR]/.databricks/bundle/prod/terraform/terraform.tfstate: local terraform state serial=5 lineage="[UUID]"
diff --git a/acceptance/bundle/migrate/basic/script b/acceptance/bundle/migrate/basic/script
deleted file mode 100755
index f64ae14bce7..00000000000
--- a/acceptance/bundle/migrate/basic/script
+++ /dev/null
@@ -1,54 +0,0 @@
-export DATABRICKS_BUNDLE_ENGINE=
-# Migrating without state, should print a message about missing state.
-trace musterr $CLI bundle deployment migrate
-
-trace DATABRICKS_BUNDLE_ENGINE=terraform $CLI bundle deploy
-print_state.py -t dev > out.original_state.json
-
-trace $CLI bundle deployment migrate 2>&1 | contains.py 'Migrated 3 resources'
-print_state.py -t dev > out.new_state.json
-print_state.py -t dev --backup > out.backup_state.json
-trace diff out.original_state.json out.backup_state.json
-rm out.backup_state.json
-
-# check that this is stored as resolved value, not as reference:
-trace jq '.state."resources.pipelines.test_pipeline".state.tags.volume_storage_location' out.new_state.json | contains.py 's3://'
-
-# this is expected to warn because state does not match env var, but still succeed using state engine
-trace DATABRICKS_BUNDLE_ENGINE=terraform $CLI bundle plan
-trace DATABRICKS_BUNDLE_ENGINE=terraform $CLI bundle deploy
-
-title "Should show that it's already migrated"
-trace musterr $CLI bundle deployment migrate
-
-rm out.requests.txt
-# Both DATABRICKS_BUNDLE_ENGINE=direct and DATABRICKS_BUNDLE_ENGINE= work
-trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle plan | contains.py "3 unchanged"
-trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle plan | contains.py "3 unchanged"
-trace print_requests.py --get //jobs/get | contains.py 'engine/direct'
-
-trace DATABRICKS_BUNDLE_ENGINE="" $CLI bundle deploy
-trace print_requests.py --get //jobs/get | jq '.headers["User-Agent"][0]' | contains.py 'engine/direct'
-
-title "Should show that it's already migrated"
-trace musterr $CLI bundle deployment migrate
-trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle debug states
-trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle debug states --force-pull
-
-title "Extra plan: should have no drift"
-trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle plan | contains.py "3 unchanged"
-
-rm out.requests.txt
-
-title "Update databricks.yml, run plan & update"
-trace update_file.py databricks.yml Migration Migrated
-trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle plan
-trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle plan -o json > out.plan_update.json
-trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle deploy
-
-title "Different target, still on terraform"
-trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle deploy -t prod
-trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle debug states -t prod
-trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle debug states -t prod --force-pull
-
-rm out.requests.txt
diff --git a/acceptance/bundle/migrate/command/added-direct-only/databricks.yml b/acceptance/bundle/migrate/command/added-direct-only/databricks.yml
new file mode 100644
index 00000000000..8f2a40d4f2b
--- /dev/null
+++ b/acceptance/bundle/migrate/command/added-direct-only/databricks.yml
@@ -0,0 +1,7 @@
+bundle:
+  name: test-bundle
+
+resources:
+  #instance_pools: {pool: {instance_pool_name: "My Pool", node_type_id: "Standard_DS3_v2", idle_instance_autotermination_minutes: 60}}
+  jobs:
+    job_a: {name: "Job A"}
diff --git a/acceptance/bundle/migrate/command/added-direct-only/out.test.toml b/acceptance/bundle/migrate/command/added-direct-only/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/command/added-direct-only/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/command/added-direct-only/output.txt b/acceptance/bundle/migrate/command/added-direct-only/output.txt
new file mode 100644
index 00000000000..2d6abe8d412
--- /dev/null
+++ b/acceptance/bundle/migrate/command/added-direct-only/output.txt
@@ -0,0 +1,50 @@
+
+=== Replay a prior terraform deployment (instance_pools is commented out)
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate
+
+=== Add a direct-only resource to the config without deploying it
+>>> update_file.py databricks.yml #instance_pools instance_pools
+
+=== Migration ignores the direct-only resource; it will be created on the next deploy
+>>> [CLI] bundle deployment migrate
+Success! Migrated 1 resources to direct engine state file: [TEST_TMP_DIR]/.databricks/bundle/default/resources.json
+
+Validate the migration by running "databricks bundle plan", there should be no actions planned.
+
+The state file is not synchronized to the workspace yet. To do that and finalize the migration, run "bundle deploy".
+
+To undo the migration, remove [TEST_TMP_DIR]/.databricks/bundle/default/resources.json and rename [TEST_TMP_DIR]/.databricks/bundle/default/terraform/terraform.tfstate.backup to [TEST_TMP_DIR]/.databricks/bundle/default/terraform/terraform.tfstate
+
+
+=== After migration: plan shows the direct-only resource as "to add"
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle plan
+create instance_pools.pool
+
+Plan: 1 to add, 0 to change, 0 to delete, 1 unchanged
+
+=== Deploy creates it; verify via recorded requests
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created instance_pools.pool
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 1 unchanged
+
+>>> print_requests.py //instance-pools/create
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct lineage/EnVBsDvOxKV auth/pat"
+    ]
+  },
+  "method": "POST",
+  "path": "/api/2.0/instance-pools/create",
+  "body": {
+    "idle_instance_autotermination_minutes": 60,
+    "instance_pool_name": "My Pool",
+    "node_type_id": "Standard_DS3_v2"
+  }
+}
+
+=== No further actions planned
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
diff --git a/acceptance/bundle/migrate/command/added-direct-only/script b/acceptance/bundle/migrate/command/added-direct-only/script
new file mode 100644
index 00000000000..93627e50a2c
--- /dev/null
+++ b/acceptance/bundle/migrate/command/added-direct-only/script
@@ -0,0 +1,23 @@
+export DATABRICKS_BUNDLE_ENGINE=
+
+title "Replay a prior terraform deployment (instance_pools is commented out)"
+trace replay_tfstate.py terraform-requests.json terraform.tfstate
+
+title "Add a direct-only resource to the config without deploying it"
+trace update_file.py databricks.yml "#instance_pools" "instance_pools"
+
+title "Migration ignores the direct-only resource; it will be created on the next deploy"
+trace $CLI bundle deployment migrate
+
+title "After migration: plan shows the direct-only resource as \"to add\""
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle plan
+
+title "Deploy creates it; verify via recorded requests"
+rm "$OUT_REQUESTS"
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle deploy
+trace print_requests.py //instance-pools/create
+
+title "No further actions planned"
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle plan
+
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/migrate/command/added-direct-only/terraform-requests.json b/acceptance/bundle/migrate/command/added-direct-only/terraform-requests.json
new file mode 100644
index 00000000000..ede3d2b4e2d
--- /dev/null
+++ b/acceptance/bundle/migrate/command/added-direct-only/terraform-requests.json
@@ -0,0 +1,19 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "Job A",
+      "queue": {
+        "enabled": true
+      }
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/command/added-direct-only/terraform.tfstate b/acceptance/bundle/migrate/command/added-direct-only/terraform.tfstate
new file mode 100644
index 00000000000..ce20cbf8f0d
--- /dev/null
+++ b/acceptance/bundle/migrate/command/added-direct-only/terraform.tfstate
@@ -0,0 +1,110 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "fa49fd4c-1db2-384e-33d4-1cc1d0302360",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "job_a",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790614029664429000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "Job A",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790614029664429000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/command/added/databricks.yml b/acceptance/bundle/migrate/command/added/databricks.yml
new file mode 100644
index 00000000000..e245a4f02b5
--- /dev/null
+++ b/acceptance/bundle/migrate/command/added/databricks.yml
@@ -0,0 +1,7 @@
+bundle:
+  name: migrate-added-test
+
+resources:
+  jobs:
+    job_a: {name: "Job A"}
+    #job_b: {name: "Job B"}
diff --git a/acceptance/bundle/migrate/command/added/out.test.toml b/acceptance/bundle/migrate/command/added/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/command/added/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/command/added/output.txt b/acceptance/bundle/migrate/command/added/output.txt
new file mode 100644
index 00000000000..5254379ec3d
--- /dev/null
+++ b/acceptance/bundle/migrate/command/added/output.txt
@@ -0,0 +1,50 @@
+
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate
+
+>>> [CLI] bundle deployment migrate
+Success! Migrated 1 resources to direct engine state file: [TEST_TMP_DIR]/.databricks/bundle/default/resources.json
+
+Validate the migration by running "databricks bundle plan", there should be no actions planned.
+
+The state file is not synchronized to the workspace yet. To do that and finalize the migration, run "bundle deploy".
+
+To undo the migration, remove [TEST_TMP_DIR]/.databricks/bundle/default/resources.json and rename [TEST_TMP_DIR]/.databricks/bundle/default/terraform/terraform.tfstate.backup to [TEST_TMP_DIR]/.databricks/bundle/default/terraform/terraform.tfstate
+
+
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle plan
+create jobs.job_b
+
+Plan: 1 to add, 0 to change, 0 to delete, 1 unchanged
+
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/migrate-added-test/default/files...
+Created jobs.job_b
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 1 unchanged
+
+>>> print_requests.py //jobs/create
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct lineage/CEQDk4eRCyq auth/pat"
+    ]
+  },
+  "method": "POST",
+  "path": "/api/2.2/jobs/create",
+  "body": {
+    "deployment": {
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/migrate-added-test/default/state/metadata.json"
+    },
+    "edit_mode": "UI_LOCKED",
+    "format": "MULTI_TASK",
+    "max_concurrent_runs": 1,
+    "name": "Job B",
+    "queue": {
+      "enabled": true
+    }
+  }
+}
+
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
diff --git a/acceptance/bundle/migrate/command/added/script b/acceptance/bundle/migrate/command/added/script
new file mode 100644
index 00000000000..11ddfaf9b1f
--- /dev/null
+++ b/acceptance/bundle/migrate/command/added/script
@@ -0,0 +1,23 @@
+export DATABRICKS_BUNDLE_ENGINE=
+
+# Replay a prior terraform deployment (only job_a; job_b is commented out)
+trace replay_tfstate.py terraform-requests.json terraform.tfstate
+
+# Uncomment job_b (add it to config without deploying)
+update_file.py databricks.yml "#job_b" "job_b"
+
+# job_b skipped, will be created on next deploy
+trace $CLI bundle deployment migrate
+
+# After migration: plan shows job_b as "to add"
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle plan | contains.py "1 to add"
+
+# Deploy creates job_b; verify via recorded requests
+rm "$OUT_REQUESTS"
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle deploy
+trace print_requests.py //jobs/create
+
+# No further actions planned
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle plan | contains.py "2 unchanged"
+
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/migrate/command/added/terraform-requests.json b/acceptance/bundle/migrate/command/added/terraform-requests.json
new file mode 100644
index 00000000000..37dfc7d92cd
--- /dev/null
+++ b/acceptance/bundle/migrate/command/added/terraform-requests.json
@@ -0,0 +1,19 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-added-test/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "Job A",
+      "queue": {
+        "enabled": true
+      }
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/command/added/terraform.tfstate b/acceptance/bundle/migrate/command/added/terraform.tfstate
new file mode 100644
index 00000000000..42841842794
--- /dev/null
+++ b/acceptance/bundle/migrate/command/added/terraform.tfstate
@@ -0,0 +1,110 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "98692851-b674-5437-4c69-326971c0e8b2",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "job_a",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-added-test/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790613850525108000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "Job A",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790613850525108000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/basic/databricks.yml b/acceptance/bundle/migrate/command/basic/databricks.yml
similarity index 100%
rename from acceptance/bundle/migrate/basic/databricks.yml
rename to acceptance/bundle/migrate/command/basic/databricks.yml
diff --git a/acceptance/bundle/migrate/basic/notebook.py b/acceptance/bundle/migrate/command/basic/notebook.py
similarity index 100%
rename from acceptance/bundle/migrate/basic/notebook.py
rename to acceptance/bundle/migrate/command/basic/notebook.py
diff --git a/acceptance/bundle/migrate/command/basic/out.new_state.json b/acceptance/bundle/migrate/command/basic/out.new_state.json
new file mode 100644
index 00000000000..81f4123c8c3
--- /dev/null
+++ b/acceptance/bundle/migrate/command/basic/out.new_state.json
@@ -0,0 +1,94 @@
+{
+ "state_version": 3,
+ "cli_version": "[CLI_VERSION]",
+ "lineage": "[UUID]",
+ "serial": 6,
+ "state": {
+  "resources.jobs.test_job": {
+   "__id__": "[TEST_JOB_ID]",
+   "state": {
+    "deployment": {
+     "kind": "BUNDLE",
+     "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/dev/state/metadata.json"
+    },
+    "edit_mode": "UI_LOCKED",
+    "format": "MULTI_TASK",
+    "max_concurrent_runs": 1,
+    "name": "Test Migration Job",
+    "queue": {
+     "enabled": true
+    },
+    "tasks": [
+     {
+      "notebook_task": {
+       "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/dev/files/notebook"
+      },
+      "task_key": "main"
+     }
+    ]
+   }
+  },
+  "resources.pipelines.test_pipeline": {
+   "__id__": "[UUID]",
+   "state": {
+    "channel": "CURRENT",
+    "deployment": {
+     "kind": "BUNDLE",
+     "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/dev/state/metadata.json"
+    },
+    "edition": "ADVANCED",
+    "libraries": [
+     {
+      "notebook": {
+       "path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/dev/files/pipeline"
+      }
+     }
+    ],
+    "name": "Test Migration Pipeline",
+    "tags": {
+     "myjob_id": "[TEST_JOB_ID]",
+     "myjob_name": "Test Migration Job",
+     "myjob_timeout": "0",
+     "myvolume_id": "mycat.myschema.myvol",
+     "volume_catalog_name": "mycat",
+     "volume_storage_location": "s3://[METASTORE_NAME]/metastore/[UUID]/volumes/[UUID]"
+    }
+   },
+   "depends_on": [
+    {
+     "node": "resources.jobs.test_job",
+     "label": "${resources.jobs.test_job.id}"
+    },
+    {
+     "node": "resources.jobs.test_job",
+     "label": "${resources.jobs.test_job.name}"
+    },
+    {
+     "node": "resources.jobs.test_job",
+     "label": "${resources.jobs.test_job.timeout_seconds}"
+    },
+    {
+     "node": "resources.volumes.test_volume",
+     "label": "${resources.volumes.test_volume.catalog_name}"
+    },
+    {
+     "node": "resources.volumes.test_volume",
+     "label": "${resources.volumes.test_volume.id}"
+    },
+    {
+     "node": "resources.volumes.test_volume",
+     "label": "${resources.volumes.test_volume.storage_location}"
+    }
+   ]
+  },
+  "resources.volumes.test_volume": {
+   "__id__": "mycat.myschema.myvol",
+   "state": {
+    "catalog_name": "mycat",
+    "name": "myvol",
+    "schema_name": "myschema",
+    "volume_type": "MANAGED"
+   }
+  }
+ }
+}
diff --git a/acceptance/bundle/migrate/command/basic/out.original_state.json b/acceptance/bundle/migrate/command/basic/out.original_state.json
new file mode 100644
index 00000000000..89a3af519d6
--- /dev/null
+++ b/acceptance/bundle/migrate/command/basic/out.original_state.json
@@ -0,0 +1,291 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 4,
+  "lineage": "[UUID]",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "test_job",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/dev/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "[TEST_JOB_ID]",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "Test Migration Job",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "[WORKSPACE_ID]"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "[USERNAME]"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [
+              {
+                "ai_runtime_task": [],
+                "alert_task": [],
+                "clean_rooms_notebook_task": [],
+                "compute": [],
+                "condition_task": [],
+                "dashboard_task": [],
+                "dbt_cloud_task": [],
+                "dbt_platform_task": [],
+                "dbt_task": [],
+                "depends_on": [],
+                "description": "",
+                "disable_auto_optimization": false,
+                "disabled": false,
+                "email_notifications": [
+                  {
+                    "no_alert_for_skipped_runs": false,
+                    "on_duration_warning_threshold_exceeded": [],
+                    "on_failure": [],
+                    "on_start": [],
+                    "on_streaming_backlog_exceeded": [],
+                    "on_success": []
+                  }
+                ],
+                "environment_key": "",
+                "existing_cluster_id": "",
+                "for_each_task": [],
+                "gen_ai_compute_task": [],
+                "health": [],
+                "job_cluster_key": "",
+                "library": [],
+                "max_retries": 0,
+                "min_retry_interval_millis": 0,
+                "new_cluster": [],
+                "notebook_task": [
+                  {
+                    "base_parameters": null,
+                    "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/dev/files/notebook",
+                    "source": "WORKSPACE",
+                    "warehouse_id": ""
+                  }
+                ],
+                "notification_settings": [],
+                "pipeline_task": [],
+                "power_bi_task": [],
+                "python_operator_task": [],
+                "python_wheel_task": [],
+                "retry_on_timeout": false,
+                "run_if": "ALL_SUCCESS",
+                "run_job_task": [],
+                "spark_jar_task": [],
+                "spark_python_task": [],
+                "spark_submit_task": [],
+                "sql_task": [],
+                "task_key": "main",
+                "timeout_seconds": 0,
+                "webhook_notifications": []
+              }
+            ],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/[TEST_JOB_ID]",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_pipeline",
+      "name": "test_pipeline",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "allow_duplicate_names": false,
+            "budget_policy_id": null,
+            "catalog": null,
+            "cause": null,
+            "channel": "CURRENT",
+            "cluster": [],
+            "cluster_id": null,
+            "configuration": null,
+            "continuous": false,
+            "creator_user_name": "[USERNAME]",
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/dev/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "development": false,
+            "edition": "ADVANCED",
+            "environment": [],
+            "event_log": [],
+            "expected_last_modified": 0,
+            "filters": [],
+            "gateway_definition": [],
+            "health": null,
+            "id": "[UUID]",
+            "ingestion_definition": [],
+            "last_modified": [UNIX_TIME_MILLIS],
+            "latest_updates": null,
+            "library": [
+              {
+                "file": [],
+                "glob": [],
+                "jar": "",
+                "maven": [],
+                "notebook": [
+                  {
+                    "path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/dev/files/pipeline"
+                  }
+                ],
+                "whl": ""
+              }
+            ],
+            "name": "Test Migration Pipeline",
+            "notification": [],
+            "photon": false,
+            "provider_config": [
+              {
+                "workspace_id": "[WORKSPACE_ID]"
+              }
+            ],
+            "restart_window": [],
+            "root_path": null,
+            "run_as": [],
+            "run_as_user_name": "[USERNAME]",
+            "schema": null,
+            "serverless": false,
+            "serverless_compute_id": null,
+            "state": "IDLE",
+            "storage": "dbfs:/pipelines/[UUID]",
+            "tags": {
+              "myjob_id": "[TEST_JOB_ID]",
+              "myjob_name": "Test Migration Job",
+              "myjob_timeout": "0",
+              "myvolume_id": "mycat.myschema.myvol",
+              "volume_catalog_name": "mycat",
+              "volume_storage_location": "s3://[METASTORE_NAME]/metastore/[UUID]/volumes/[UUID]"
+            },
+            "target": null,
+            "timeouts": null,
+            "trigger": [],
+            "url": "[DATABRICKS_URL]/#joblist/pipelines/[UUID]",
+            "usage_policy_id": null
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxMjAwMDAwMDAwMDAwLCJkZWZhdWx0IjoxMjAwMDAwMDAwMDAwLCJkZWxldGUiOjEyMDAwMDAwMDAwMDAsInJlYWQiOjEyMDAwMDAwMDAwMDAsInVwZGF0ZSI6MTIwMDAwMDAwMDAwMH19",
+          "dependencies": [
+            "databricks_job.test_job",
+            "databricks_volume.test_volume"
+          ]
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_volume",
+      "name": "test_volume",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "catalog_name": "mycat",
+            "comment": null,
+            "id": "mycat.myschema.myvol",
+            "name": "myvol",
+            "owner": "[USERNAME]",
+            "provider_config": [
+              {
+                "workspace_id": "[WORKSPACE_ID]"
+              }
+            ],
+            "schema_name": "myschema",
+            "storage_location": "s3://[METASTORE_NAME]/metastore/[UUID]/volumes/[UUID]",
+            "volume_path": "/Volumes/mycat/myschema/myvol",
+            "volume_type": "MANAGED"
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/command/basic/out.plan_update.json b/acceptance/bundle/migrate/command/basic/out.plan_update.json
new file mode 100644
index 00000000000..b873a52a785
--- /dev/null
+++ b/acceptance/bundle/migrate/command/basic/out.plan_update.json
@@ -0,0 +1,247 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 6,
+  "plan": {
+    "resources.jobs.test_job": {
+      "action": "update",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/dev/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "Test Migrated Job",
+          "queue": {
+            "enabled": true
+          },
+          "tasks": [
+            {
+              "notebook_task": {
+                "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/dev/files/notebook"
+              },
+              "task_key": "main"
+            }
+          ]
+        }
+      },
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS][0],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/dev/state/metadata.json"
+        },
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_id": [TEST_JOB_ID],
+        "max_concurrent_runs": 1,
+        "name": "Test Migration Job",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "tasks": [
+          {
+            "email_notifications": {},
+            "notebook_task": {
+              "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/dev/files/notebook",
+              "source": "WORKSPACE"
+            },
+            "run_if": "ALL_SUCCESS",
+            "task_key": "main",
+            "timeout_seconds": 0
+          }
+        ],
+        "timeout_seconds": 0,
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "name": {
+          "action": "update",
+          "old": "Test Migration Job",
+          "new": "Test Migrated Job",
+          "remote": "Test Migration Job"
+        },
+        "tasks[task_key='main'].email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='main'].notebook_task.source": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": "WORKSPACE"
+        },
+        "tasks[task_key='main'].run_if": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": "ALL_SUCCESS"
+        },
+        "tasks[task_key='main'].timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    },
+    "resources.pipelines.test_pipeline": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.test_job",
+          "label": "${resources.jobs.test_job.id}"
+        },
+        {
+          "node": "resources.jobs.test_job",
+          "label": "${resources.jobs.test_job.name}"
+        },
+        {
+          "node": "resources.jobs.test_job",
+          "label": "${resources.jobs.test_job.timeout_seconds}"
+        },
+        {
+          "node": "resources.volumes.test_volume",
+          "label": "${resources.volumes.test_volume.catalog_name}"
+        },
+        {
+          "node": "resources.volumes.test_volume",
+          "label": "${resources.volumes.test_volume.id}"
+        },
+        {
+          "node": "resources.volumes.test_volume",
+          "label": "${resources.volumes.test_volume.storage_location}"
+        }
+      ],
+      "action": "update",
+      "new_state": {
+        "value": {
+          "channel": "CURRENT",
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/dev/state/metadata.json"
+          },
+          "edition": "ADVANCED",
+          "libraries": [
+            {
+              "notebook": {
+                "path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/dev/files/pipeline"
+              }
+            }
+          ],
+          "name": "Test Migrated Pipeline",
+          "tags": {
+            "myjob_id": "[TEST_JOB_ID]",
+            "myjob_name": "Test Migrated Job",
+            "myjob_timeout": "${resources.jobs.test_job.timeout_seconds}",
+            "myvolume_id": "mycat.myschema.myvol",
+            "volume_catalog_name": "mycat",
+            "volume_storage_location": "s3://[METASTORE_NAME]/metastore/[UUID]/volumes/[UUID]"
+          }
+        },
+        "vars": {
+          "tags.myjob_timeout": "${resources.jobs.test_job.timeout_seconds}"
+        }
+      },
+      "remote_state": {
+        "channel": "CURRENT",
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/dev/state/metadata.json"
+        },
+        "edition": "ADVANCED",
+        "effective_publishing_mode": "DEFAULT_PUBLISHING_MODE",
+        "id": "[UUID]",
+        "last_modified": [UNIX_TIME_MILLIS][1],
+        "libraries": [
+          {
+            "notebook": {
+              "path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/dev/files/pipeline"
+            }
+          }
+        ],
+        "name": "Test Migration Pipeline",
+        "pipeline_id": "[UUID]",
+        "run_as_user_name": "[USERNAME]",
+        "state": "IDLE",
+        "storage": "dbfs:/pipelines/[UUID]",
+        "tags": {
+          "myjob_id": "[TEST_JOB_ID]",
+          "myjob_name": "Test Migration Job",
+          "myjob_timeout": "0",
+          "myvolume_id": "mycat.myschema.myvol",
+          "volume_catalog_name": "mycat",
+          "volume_storage_location": "s3://[METASTORE_NAME]/metastore/[UUID]/volumes/[UUID]"
+        }
+      },
+      "changes": {
+        "name": {
+          "action": "update",
+          "old": "Test Migration Pipeline",
+          "new": "Test Migrated Pipeline",
+          "remote": "Test Migration Pipeline"
+        },
+        "storage": {
+          "action": "skip",
+          "reason": "immutable_backend_value",
+          "remote": "dbfs:/pipelines/[UUID]"
+        },
+        "tags['myjob_name']": {
+          "action": "update",
+          "old": "Test Migration Job",
+          "new": "Test Migrated Job",
+          "remote": "Test Migration Job"
+        },
+        "tags['myjob_timeout']": {
+          "action": "update",
+          "old": "0",
+          "new": "${resources.jobs.test_job.timeout_seconds}",
+          "remote": "0"
+        }
+      }
+    },
+    "resources.volumes.test_volume": {
+      "action": "skip",
+      "remote_state": {
+        "catalog_name": "mycat",
+        "created_at": [UNIX_TIME_MILLIS][2],
+        "created_by": "[USERNAME]",
+        "full_name": "mycat.myschema.myvol",
+        "name": "myvol",
+        "owner": "[USERNAME]",
+        "schema_name": "myschema",
+        "storage_location": "s3://[METASTORE_NAME]/metastore/[UUID]/volumes/[UUID]",
+        "updated_at": [UNIX_TIME_MILLIS][2],
+        "volume_id": "[UUID]",
+        "volume_type": "MANAGED"
+      },
+      "changes": {
+        "storage_location": {
+          "action": "skip",
+          "reason": "immutable_backend_value",
+          "remote": "s3://[METASTORE_NAME]/metastore/[UUID]/volumes/[UUID]"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/migrate/command/basic/out.test.toml b/acceptance/bundle/migrate/command/basic/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/command/basic/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/command/basic/output.txt b/acceptance/bundle/migrate/command/basic/output.txt
new file mode 100644
index 00000000000..b5cb0785560
--- /dev/null
+++ b/acceptance/bundle/migrate/command/basic/output.txt
@@ -0,0 +1,112 @@
+
+>>> musterr [CLI] bundle deployment migrate
+Error: This command migrates the existing Terraform state file (terraform.tfstate) to a direct deployment state file (resources.json). However, no existing local or remote state was found.
+
+New bundles use the direct engine automatically, no migration is needed.
+
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate -t dev
+
+>>> [CLI] bundle deployment migrate
+Success! Migrated 3 resources to direct engine state file: [TEST_TMP_DIR]/.databricks/bundle/dev/resources.json
+
+Validate the migration by running "databricks bundle plan", there should be no actions planned.
+
+The state file is not synchronized to the workspace yet. To do that and finalize the migration, run "bundle deploy".
+
+To undo the migration, remove [TEST_TMP_DIR]/.databricks/bundle/dev/resources.json and rename [TEST_TMP_DIR]/.databricks/bundle/dev/terraform/terraform.tfstate.backup to [TEST_TMP_DIR]/.databricks/bundle/dev/terraform/terraform.tfstate
+
+
+>>> diff out.original_state.json out.backup_state.json
+
+>>> jq .state."resources.pipelines.test_pipeline".state.tags.volume_storage_location out.new_state.json
+"s3://[METASTORE_NAME]/metastore/[UUID]/volumes/[UUID]"
+
+=== Should show that it's already migrated
+>>> musterr [CLI] bundle deployment migrate
+Error: already using direct engine
+Details: [TEST_TMP_DIR]/.databricks/bundle/dev/resources.json: local direct state serial=6 lineage="[UUID]"
+
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 3 unchanged
+
+>>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 3 unchanged
+
+>>> print_requests.py --get //jobs/get
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none engine/direct lineage/5MDu0ewFJPg auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.2/jobs/get",
+  "q": {
+    "job_id": "[TEST_JOB_ID]"
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none engine/direct lineage/5MDu0ewFJPg auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.2/jobs/get",
+  "q": {
+    "job_id": "[TEST_JOB_ID]"
+  }
+}
+
+>>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/dev/files...
+Files: 3 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 3 unchanged
+
+>>> print_requests.py --get //jobs/get
+"cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct lineage/5MDu0ewFJPg auth/pat"
+"cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct lineage/5MDu0ewFJPg auth/pat"
+
+=== Should show that it's already migrated
+>>> musterr [CLI] bundle deployment migrate
+Error: already using direct engine
+Details: [TEST_TMP_DIR]/.databricks/bundle/dev/resources.json: local direct state serial=6 lineage="[UUID]"
+
+>>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle debug states
+[TEST_TMP_DIR]/.databricks/bundle/dev/resources.json: local direct state serial=6 lineage="[UUID]"
+
+>>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle debug states --force-pull
+resources.json: remote direct state serial=6 lineage="[UUID]"
+[TEST_TMP_DIR]/.databricks/bundle/dev/resources.json: local direct state serial=6 lineage="[UUID]"
+
+=== Extra plan: should have no drift
+>>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 3 unchanged
+
+=== Update databricks.yml, run plan & update
+>>> update_file.py databricks.yml Migration Migrated
+
+>>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle plan
+update jobs.test_job
+update pipelines.test_pipeline
+
+Plan: 0 to add, 2 to change, 0 to delete, 1 unchanged
+
+>>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle plan -o json
+
+>>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/dev/files...
+Updated jobs.test_job
+Updated pipelines.test_pipeline
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 2 changed, 0 deleted, 1 unchanged
+
+=== Different target, still on the terraform state from a prior deployment
+>>> replay_tfstate.py .databricks/terraform-prod-requests.json .databricks/terraform-prod.tfstate -t prod
+
+>>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle debug states -t prod
+[TEST_TMP_DIR]/.databricks/bundle/prod/terraform/terraform.tfstate: local terraform state serial=5 lineage="[UUID]"
+
+>>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle debug states -t prod --force-pull
+terraform.tfstate: remote terraform state serial=5 lineage="[UUID]"
+[TEST_TMP_DIR]/.databricks/bundle/prod/terraform/terraform.tfstate: local terraform state serial=5 lineage="[UUID]"
diff --git a/acceptance/bundle/migrate/basic/pipeline.py b/acceptance/bundle/migrate/command/basic/pipeline.py
similarity index 100%
rename from acceptance/bundle/migrate/basic/pipeline.py
rename to acceptance/bundle/migrate/command/basic/pipeline.py
diff --git a/acceptance/bundle/migrate/command/basic/script b/acceptance/bundle/migrate/command/basic/script
new file mode 100755
index 00000000000..fe089b00c11
--- /dev/null
+++ b/acceptance/bundle/migrate/command/basic/script
@@ -0,0 +1,58 @@
+export DATABRICKS_BUNDLE_ENGINE=
+# Migrating without state, should print a message about missing state.
+trace musterr $CLI bundle deployment migrate
+
+# Stash the prod fixtures under .databricks (never synced, never compared) so the dev deploys
+# below do not upload them; the prod target is replayed at the end.
+mkdir -p .databricks
+mv terraform-prod.tfstate .databricks/terraform-prod.tfstate
+mv terraform-prod-requests.json .databricks/terraform-prod-requests.json
+
+# Replay a prior terraform deployment (dev: a job, a volume and a pipeline).
+trace replay_tfstate.py terraform-requests.json terraform.tfstate -t dev
+read_id.py -t dev test_job > /dev/null
+print_state.py -t dev > out.original_state.json
+
+trace $CLI bundle deployment migrate 2>&1 | contains.py 'Migrated 3 resources'
+print_state.py -t dev > out.new_state.json
+print_state.py -t dev --backup > out.backup_state.json
+trace diff out.original_state.json out.backup_state.json
+rm out.backup_state.json
+
+# check that this is stored as resolved value, not as reference:
+trace jq '.state."resources.pipelines.test_pipeline".state.tags.volume_storage_location' out.new_state.json | contains.py 's3://'
+
+title "Should show that it's already migrated"
+trace musterr $CLI bundle deployment migrate
+
+rm "$OUT_REQUESTS"
+# Both DATABRICKS_BUNDLE_ENGINE=direct and DATABRICKS_BUNDLE_ENGINE= work
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle plan | contains.py "3 unchanged"
+trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle plan | contains.py "3 unchanged"
+trace print_requests.py --get //jobs/get | contains.py 'engine/direct'
+
+trace DATABRICKS_BUNDLE_ENGINE="" $CLI bundle deploy
+trace print_requests.py --get //jobs/get | jq '.headers["User-Agent"][0]' | contains.py 'engine/direct'
+
+title "Should show that it's already migrated"
+trace musterr $CLI bundle deployment migrate
+trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle debug states
+trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle debug states --force-pull
+
+title "Extra plan: should have no drift"
+trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle plan | contains.py "3 unchanged"
+
+rm "$OUT_REQUESTS"
+
+title "Update databricks.yml, run plan & update"
+trace update_file.py databricks.yml Migration Migrated
+trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle plan
+trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle plan -o json | nostamp > out.plan_update.json
+trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle deploy
+
+title "Different target, still on the terraform state from a prior deployment"
+trace replay_tfstate.py .databricks/terraform-prod-requests.json .databricks/terraform-prod.tfstate -t prod
+trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle debug states -t prod
+trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle debug states -t prod --force-pull
+
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/migrate/command/basic/terraform-prod-requests.json b/acceptance/bundle/migrate/command/basic/terraform-prod-requests.json
new file mode 100644
index 00000000000..73f8566a51c
--- /dev/null
+++ b/acceptance/bundle/migrate/command/basic/terraform-prod-requests.json
@@ -0,0 +1,74 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.1/unity-catalog/schemas",
+    "body": {
+      "catalog_name": "mycat",
+      "name": "myschema"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.1/unity-catalog/volumes",
+    "body": {
+      "catalog_name": "mycat",
+      "name": "myvol",
+      "schema_name": "myschema",
+      "volume_type": "MANAGED"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-basic-test/prod/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "Test Migrated Job",
+      "queue": {
+        "enabled": true
+      },
+      "tasks": [
+        {
+          "notebook_task": {
+            "notebook_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-basic-test/prod/files/notebook",
+            "source": "WORKSPACE"
+          },
+          "task_key": "main"
+        }
+      ]
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/pipelines",
+    "body": {
+      "channel": "CURRENT",
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-basic-test/prod/state/metadata.json"
+      },
+      "edition": "ADVANCED",
+      "libraries": [
+        {
+          "notebook": {
+            "path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-basic-test/prod/files/pipeline"
+          }
+        }
+      ],
+      "name": "Test Migrated Pipeline",
+      "tags": {
+        "myjob_id": "8790615649482281000",
+        "myjob_name": "Test Migrated Job",
+        "myjob_timeout": "0",
+        "myvolume_id": "mycat.myschema.myvol",
+        "volume_catalog_name": "mycat",
+        "volume_storage_location": "s3://deco-uc-prod-isolated-aws-us-east-1/metastore/120efa64-9b68-46ba-be38-f319458430d2/volumes/79fe8a5b-c6f7-e638-79fe-8a5bc6f7e639"
+      }
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/command/basic/terraform-prod.tfstate b/acceptance/bundle/migrate/command/basic/terraform-prod.tfstate
new file mode 100644
index 00000000000..719e04658d2
--- /dev/null
+++ b/acceptance/bundle/migrate/command/basic/terraform-prod.tfstate
@@ -0,0 +1,326 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 5,
+  "lineage": "ffd492fe-9f85-8436-35fc-cfb0ebc232b1",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "test_job",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-basic-test/prod/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790615649482281000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "Test Migrated Job",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [
+              {
+                "ai_runtime_task": [],
+                "alert_task": [],
+                "clean_rooms_notebook_task": [],
+                "compute": [],
+                "condition_task": [],
+                "dashboard_task": [],
+                "dbt_cloud_task": [],
+                "dbt_platform_task": [],
+                "dbt_task": [],
+                "depends_on": [],
+                "description": "",
+                "disable_auto_optimization": false,
+                "disabled": false,
+                "email_notifications": [
+                  {
+                    "no_alert_for_skipped_runs": false,
+                    "on_duration_warning_threshold_exceeded": [],
+                    "on_failure": [],
+                    "on_start": [],
+                    "on_streaming_backlog_exceeded": [],
+                    "on_success": []
+                  }
+                ],
+                "environment_key": "",
+                "existing_cluster_id": "",
+                "for_each_task": [],
+                "gen_ai_compute_task": [],
+                "health": [],
+                "job_cluster_key": "",
+                "library": [],
+                "max_retries": 0,
+                "min_retry_interval_millis": 0,
+                "new_cluster": [],
+                "notebook_task": [
+                  {
+                    "base_parameters": null,
+                    "notebook_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-basic-test/prod/files/notebook",
+                    "source": "WORKSPACE",
+                    "warehouse_id": ""
+                  }
+                ],
+                "notification_settings": [],
+                "pipeline_task": [],
+                "power_bi_task": [],
+                "python_operator_task": [],
+                "python_wheel_task": [],
+                "retry_on_timeout": false,
+                "run_if": "ALL_SUCCESS",
+                "run_job_task": [],
+                "spark_jar_task": [],
+                "spark_python_task": [],
+                "spark_submit_task": [],
+                "sql_task": [],
+                "task_key": "main",
+                "timeout_seconds": 0,
+                "webhook_notifications": []
+              }
+            ],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790615649482281000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_pipeline",
+      "name": "test_pipeline",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "allow_duplicate_names": false,
+            "budget_policy_id": null,
+            "catalog": null,
+            "cause": null,
+            "channel": "CURRENT",
+            "cluster": [],
+            "cluster_id": null,
+            "configuration": null,
+            "continuous": false,
+            "creator_user_name": "tester@databricks.com",
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-basic-test/prod/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "development": false,
+            "edition": "ADVANCED",
+            "environment": [],
+            "event_log": [],
+            "expected_last_modified": 0,
+            "filters": [],
+            "gateway_definition": [],
+            "health": null,
+            "id": "79fe8a5b-ca8c-5798-79fe-8a5bca8c5799",
+            "ingestion_definition": [],
+            "last_modified": 1790615649518,
+            "latest_updates": null,
+            "library": [
+              {
+                "file": [],
+                "glob": [],
+                "jar": "",
+                "maven": [],
+                "notebook": [
+                  {
+                    "path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-basic-test/prod/files/pipeline"
+                  }
+                ],
+                "whl": ""
+              }
+            ],
+            "name": "Test Migrated Pipeline",
+            "notification": [],
+            "photon": false,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "restart_window": [],
+            "root_path": null,
+            "run_as": [],
+            "run_as_user_name": "tester@databricks.com",
+            "schema": null,
+            "serverless": false,
+            "serverless_compute_id": null,
+            "state": "IDLE",
+            "storage": "dbfs:/pipelines/79fe8a5b-ca8c-5798-79fe-8a5bca8c5799",
+            "tags": {
+              "myjob_id": "8790615649482281000",
+              "myjob_name": "Test Migrated Job",
+              "myjob_timeout": "0",
+              "myvolume_id": "mycat.myschema.myvol",
+              "volume_catalog_name": "mycat",
+              "volume_storage_location": "s3://deco-uc-prod-isolated-aws-us-east-1/metastore/120efa64-9b68-46ba-be38-f319458430d2/volumes/79fe8a5b-c6f7-e638-79fe-8a5bc6f7e639"
+            },
+            "target": null,
+            "timeouts": null,
+            "trigger": [],
+            "url": "[DATABRICKS_URL]/#joblist/pipelines/79fe8a5b-ca8c-5798-79fe-8a5bca8c5799",
+            "usage_policy_id": null
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxMjAwMDAwMDAwMDAwLCJkZWZhdWx0IjoxMjAwMDAwMDAwMDAwLCJkZWxldGUiOjEyMDAwMDAwMDAwMDAsInJlYWQiOjEyMDAwMDAwMDAwMDAsInVwZGF0ZSI6MTIwMDAwMDAwMDAwMH19",
+          "dependencies": [
+            "databricks_job.test_job",
+            "databricks_schema.test_schema",
+            "databricks_volume.test_volume"
+          ]
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_schema",
+      "name": "test_schema",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "catalog_name": "mycat",
+            "comment": null,
+            "enable_predictive_optimization": "INHERIT",
+            "force_destroy": true,
+            "id": "mycat.myschema",
+            "metastore_id": "120efa64-9b68-46ba-be38-f319458430d2",
+            "name": "myschema",
+            "owner": "tester@databricks.com",
+            "properties": null,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "schema_id": "79fe8a5b-c679-ffc0-79fe-8a5bc679ffc1",
+            "storage_root": null
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA=="
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_volume",
+      "name": "test_volume",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "catalog_name": "mycat",
+            "comment": null,
+            "id": "mycat.myschema.myvol",
+            "name": "myvol",
+            "owner": "tester@databricks.com",
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "schema_name": "myschema",
+            "storage_location": "s3://deco-uc-prod-isolated-aws-us-east-1/metastore/120efa64-9b68-46ba-be38-f319458430d2/volumes/79fe8a5b-c6f7-e638-79fe-8a5bc6f7e639",
+            "volume_path": "/Volumes/mycat/myschema/myvol",
+            "volume_type": "MANAGED"
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "databricks_schema.test_schema"
+          ]
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/command/basic/terraform-requests.json b/acceptance/bundle/migrate/command/basic/terraform-requests.json
new file mode 100644
index 00000000000..a7ccd42f220
--- /dev/null
+++ b/acceptance/bundle/migrate/command/basic/terraform-requests.json
@@ -0,0 +1,66 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.1/unity-catalog/volumes",
+    "body": {
+      "catalog_name": "mycat",
+      "name": "myvol",
+      "schema_name": "myschema",
+      "volume_type": "MANAGED"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-basic-test/dev/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "Test Migration Job",
+      "queue": {
+        "enabled": true
+      },
+      "tasks": [
+        {
+          "notebook_task": {
+            "notebook_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-basic-test/dev/files/notebook",
+            "source": "WORKSPACE"
+          },
+          "task_key": "main"
+        }
+      ]
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/pipelines",
+    "body": {
+      "channel": "CURRENT",
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-basic-test/dev/state/metadata.json"
+      },
+      "edition": "ADVANCED",
+      "libraries": [
+        {
+          "notebook": {
+            "path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-basic-test/dev/files/pipeline"
+          }
+        }
+      ],
+      "name": "Test Migration Pipeline",
+      "tags": {
+        "myjob_id": "8790615647432326000",
+        "myjob_name": "Test Migration Job",
+        "myjob_timeout": "0",
+        "myvolume_id": "mycat.myschema.myvol",
+        "volume_catalog_name": "mycat",
+        "volume_storage_location": "s3://deco-uc-prod-isolated-aws-us-east-1/metastore/120efa64-9b68-46ba-be38-f319458430d2/volumes/79fe8a5b-4c3a-cd70-79fe-8a5b4c3acd71"
+      }
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/command/basic/terraform.tfstate b/acceptance/bundle/migrate/command/basic/terraform.tfstate
new file mode 100644
index 00000000000..79c34bc74b7
--- /dev/null
+++ b/acceptance/bundle/migrate/command/basic/terraform.tfstate
@@ -0,0 +1,291 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 4,
+  "lineage": "4b4ef315-59d3-0f6e-900a-27ab3918bd54",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "test_job",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-basic-test/dev/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790615647432326000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "Test Migration Job",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [
+              {
+                "ai_runtime_task": [],
+                "alert_task": [],
+                "clean_rooms_notebook_task": [],
+                "compute": [],
+                "condition_task": [],
+                "dashboard_task": [],
+                "dbt_cloud_task": [],
+                "dbt_platform_task": [],
+                "dbt_task": [],
+                "depends_on": [],
+                "description": "",
+                "disable_auto_optimization": false,
+                "disabled": false,
+                "email_notifications": [
+                  {
+                    "no_alert_for_skipped_runs": false,
+                    "on_duration_warning_threshold_exceeded": [],
+                    "on_failure": [],
+                    "on_start": [],
+                    "on_streaming_backlog_exceeded": [],
+                    "on_success": []
+                  }
+                ],
+                "environment_key": "",
+                "existing_cluster_id": "",
+                "for_each_task": [],
+                "gen_ai_compute_task": [],
+                "health": [],
+                "job_cluster_key": "",
+                "library": [],
+                "max_retries": 0,
+                "min_retry_interval_millis": 0,
+                "new_cluster": [],
+                "notebook_task": [
+                  {
+                    "base_parameters": null,
+                    "notebook_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-basic-test/dev/files/notebook",
+                    "source": "WORKSPACE",
+                    "warehouse_id": ""
+                  }
+                ],
+                "notification_settings": [],
+                "pipeline_task": [],
+                "power_bi_task": [],
+                "python_operator_task": [],
+                "python_wheel_task": [],
+                "retry_on_timeout": false,
+                "run_if": "ALL_SUCCESS",
+                "run_job_task": [],
+                "spark_jar_task": [],
+                "spark_python_task": [],
+                "spark_submit_task": [],
+                "sql_task": [],
+                "task_key": "main",
+                "timeout_seconds": 0,
+                "webhook_notifications": []
+              }
+            ],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790615647432326000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_pipeline",
+      "name": "test_pipeline",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "allow_duplicate_names": false,
+            "budget_policy_id": null,
+            "catalog": null,
+            "cause": null,
+            "channel": "CURRENT",
+            "cluster": [],
+            "cluster_id": null,
+            "configuration": null,
+            "continuous": false,
+            "creator_user_name": "tester@databricks.com",
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-basic-test/dev/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "development": false,
+            "edition": "ADVANCED",
+            "environment": [],
+            "event_log": [],
+            "expected_last_modified": 0,
+            "filters": [],
+            "gateway_definition": [],
+            "health": null,
+            "id": "79fe8a5b-5084-fe28-79fe-8a5b5084fe29",
+            "ingestion_definition": [],
+            "last_modified": 1790615647471,
+            "latest_updates": null,
+            "library": [
+              {
+                "file": [],
+                "glob": [],
+                "jar": "",
+                "maven": [],
+                "notebook": [
+                  {
+                    "path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-basic-test/dev/files/pipeline"
+                  }
+                ],
+                "whl": ""
+              }
+            ],
+            "name": "Test Migration Pipeline",
+            "notification": [],
+            "photon": false,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "restart_window": [],
+            "root_path": null,
+            "run_as": [],
+            "run_as_user_name": "tester@databricks.com",
+            "schema": null,
+            "serverless": false,
+            "serverless_compute_id": null,
+            "state": "IDLE",
+            "storage": "dbfs:/pipelines/79fe8a5b-5084-fe28-79fe-8a5b5084fe29",
+            "tags": {
+              "myjob_id": "8790615647432326000",
+              "myjob_name": "Test Migration Job",
+              "myjob_timeout": "0",
+              "myvolume_id": "mycat.myschema.myvol",
+              "volume_catalog_name": "mycat",
+              "volume_storage_location": "s3://deco-uc-prod-isolated-aws-us-east-1/metastore/120efa64-9b68-46ba-be38-f319458430d2/volumes/79fe8a5b-4c3a-cd70-79fe-8a5b4c3acd71"
+            },
+            "target": null,
+            "timeouts": null,
+            "trigger": [],
+            "url": "[DATABRICKS_URL]/#joblist/pipelines/79fe8a5b-5084-fe28-79fe-8a5b5084fe29",
+            "usage_policy_id": null
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxMjAwMDAwMDAwMDAwLCJkZWZhdWx0IjoxMjAwMDAwMDAwMDAwLCJkZWxldGUiOjEyMDAwMDAwMDAwMDAsInJlYWQiOjEyMDAwMDAwMDAwMDAsInVwZGF0ZSI6MTIwMDAwMDAwMDAwMH19",
+          "dependencies": [
+            "databricks_job.test_job",
+            "databricks_volume.test_volume"
+          ]
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_volume",
+      "name": "test_volume",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "catalog_name": "mycat",
+            "comment": null,
+            "id": "mycat.myschema.myvol",
+            "name": "myvol",
+            "owner": "tester@databricks.com",
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "schema_name": "myschema",
+            "storage_location": "s3://deco-uc-prod-isolated-aws-us-east-1/metastore/120efa64-9b68-46ba-be38-f319458430d2/volumes/79fe8a5b-4c3a-cd70-79fe-8a5b4c3acd71",
+            "volume_path": "/Volumes/mycat/myschema/myvol",
+            "volume_type": "MANAGED"
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/basic/test.toml b/acceptance/bundle/migrate/command/basic/test.toml
similarity index 100%
rename from acceptance/bundle/migrate/basic/test.toml
rename to acceptance/bundle/migrate/command/basic/test.toml
diff --git a/acceptance/bundle/migrate/dashboards/databricks.yml b/acceptance/bundle/migrate/command/dashboards/databricks.yml
similarity index 100%
rename from acceptance/bundle/migrate/dashboards/databricks.yml
rename to acceptance/bundle/migrate/command/dashboards/databricks.yml
diff --git a/acceptance/bundle/migrate/command/dashboards/out.new_state.json b/acceptance/bundle/migrate/command/dashboards/out.new_state.json
new file mode 100644
index 00000000000..c710e449216
--- /dev/null
+++ b/acceptance/bundle/migrate/command/dashboards/out.new_state.json
@@ -0,0 +1,20 @@
+{
+ "state_version": 3,
+ "cli_version": "[CLI_VERSION]",
+ "lineage": "[UUID]",
+ "serial": 3,
+ "state": {
+  "resources.dashboards.dashboard1": {
+   "__id__": "[DASHBOARD1_ID]",
+   "state": {
+    "display_name": "my dashboard",
+    "embed_credentials": true,
+    "etag": "80611980",
+    "parent_path": "/Workspace/Users/[USERNAME]",
+    "published": true,
+    "serialized_dashboard": "sha256:[HASH]",
+    "warehouse_id": "123456"
+   }
+  }
+ }
+}
diff --git a/acceptance/bundle/migrate/command/dashboards/out.original_state.json b/acceptance/bundle/migrate/command/dashboards/out.original_state.json
new file mode 100644
index 00000000000..98213d4ec86
--- /dev/null
+++ b/acceptance/bundle/migrate/command/dashboards/out.original_state.json
@@ -0,0 +1,47 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "[UUID]",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_dashboard",
+      "name": "dashboard1",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "create_time": "[TIMESTAMP]",
+            "dashboard_change_detected": false,
+            "dashboard_id": "[DASHBOARD1_ID]",
+            "dataset_catalog": null,
+            "dataset_schema": null,
+            "display_name": "my dashboard",
+            "embed_credentials": true,
+            "etag": "80611980",
+            "file_path": null,
+            "id": "[DASHBOARD1_ID]",
+            "lifecycle_state": "ACTIVE",
+            "md5": "b4ab6aee48485b0b5e980761d3efe936",
+            "parent_path": "/Users/[USERNAME]",
+            "path": "/Users/[USERNAME]/my dashboard.lvdash.json",
+            "provider_config": [
+              {
+                "workspace_id": "[WORKSPACE_ID]"
+              }
+            ],
+            "serialized_dashboard": "{\"pages\":[{\"displayName\":\"Dashboard test bundle-deploy-dashboard\",\"name\":\"02724bf2\",\"pageType\":\"PAGE_TYPE_CANVAS\"}]}\n",
+            "update_time": "[TIMESTAMP]",
+            "warehouse_id": "123456"
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/command/dashboards/out.plan_after_migrate.json b/acceptance/bundle/migrate/command/dashboards/out.plan_after_migrate.json
new file mode 100644
index 00000000000..3d9a600d1d8
--- /dev/null
+++ b/acceptance/bundle/migrate/command/dashboards/out.plan_after_migrate.json
@@ -0,0 +1,65 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 3,
+  "plan": {
+    "resources.dashboards.dashboard1": {
+      "action": "skip",
+      "remote_state": {
+        "create_time": "[TIMESTAMP]",
+        "dashboard_id": "[DASHBOARD1_ID]",
+        "display_name": "my dashboard",
+        "embed_credentials": true,
+        "etag": "80611980",
+        "lifecycle_state": "ACTIVE",
+        "parent_path": "/Workspace/Users/[USERNAME]",
+        "path": "/Users/[USERNAME]/my dashboard.lvdash.json",
+        "published": true,
+        "serialized_dashboard": "{\"pages\":[{\"displayName\":\"Dashboard test bundle-deploy-dashboard\",\"name\":\"02724bf2\",\"pageType\":\"PAGE_TYPE_CANVAS\"}]}\n",
+        "update_time": "[TIMESTAMP]",
+        "warehouse_id": "123456"
+      },
+      "changes": {
+        "create_time": {
+          "action": "skip",
+          "reason": "spec:output_only",
+          "remote": "[TIMESTAMP]"
+        },
+        "dashboard_id": {
+          "action": "skip",
+          "reason": "spec:output_only",
+          "remote": "[DASHBOARD1_ID]"
+        },
+        "etag": {
+          "action": "skip",
+          "reason": "custom",
+          "old": "80611980",
+          "remote": "80611980"
+        },
+        "lifecycle_state": {
+          "action": "skip",
+          "reason": "spec:output_only",
+          "remote": "ACTIVE"
+        },
+        "path": {
+          "action": "skip",
+          "reason": "spec:output_only",
+          "remote": "/Users/[USERNAME]/my dashboard.lvdash.json"
+        },
+        "serialized_dashboard": {
+          "action": "skip",
+          "reason": "etag_based",
+          "old": "sha256:[HASH][0]",
+          "new": "sha256:[HASH][0]",
+          "remote": "sha256:[HASH][1]"
+        },
+        "update_time": {
+          "action": "skip",
+          "reason": "spec:output_only",
+          "remote": "[TIMESTAMP]"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/migrate/command/dashboards/out.test.toml b/acceptance/bundle/migrate/command/dashboards/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/command/dashboards/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/command/dashboards/output.txt b/acceptance/bundle/migrate/command/dashboards/output.txt
new file mode 100644
index 00000000000..306d160ea38
--- /dev/null
+++ b/acceptance/bundle/migrate/command/dashboards/output.txt
@@ -0,0 +1,41 @@
+
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate
+
+>>> [CLI] bundle deployment migrate
+Success! Migrated 1 resources to direct engine state file: [TEST_TMP_DIR]/.databricks/bundle/default/resources.json
+
+Validate the migration by running "databricks bundle plan", there should be no actions planned.
+
+The state file is not synchronized to the workspace yet. To do that and finalize the migration, run "bundle deploy".
+
+To undo the migration, remove [TEST_TMP_DIR]/.databricks/bundle/default/resources.json and rename [TEST_TMP_DIR]/.databricks/bundle/default/terraform/terraform.tfstate.backup to [TEST_TMP_DIR]/.databricks/bundle/default/terraform/terraform.tfstate
+
+
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+>>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+>>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle plan -o json
+
+>>> print_requests.py --get //dashboards
+
+>>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle deploy --auto-approve
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
+
+>>> print_requests.py --get //dashboards
+
+=== Should show that it's already migrated
+>>> musterr [CLI] bundle deployment migrate
+Error: already using direct engine
+Details: [TEST_TMP_DIR]/.databricks/bundle/default/resources.json: local direct state serial=3 lineage="[UUID]"
+
+>>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle debug states
+[TEST_TMP_DIR]/.databricks/bundle/default/resources.json: local direct state serial=3 lineage="[UUID]"
+
+>>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle debug states --force-pull
+resources.json: remote direct state serial=3 lineage="[UUID]"
+[TEST_TMP_DIR]/.databricks/bundle/default/resources.json: local direct state serial=3 lineage="[UUID]"
diff --git a/acceptance/bundle/migrate/dashboards/sample-dashboard.lvdash.json b/acceptance/bundle/migrate/command/dashboards/sample-dashboard.lvdash.json
similarity index 100%
rename from acceptance/bundle/migrate/dashboards/sample-dashboard.lvdash.json
rename to acceptance/bundle/migrate/command/dashboards/sample-dashboard.lvdash.json
diff --git a/acceptance/bundle/migrate/command/dashboards/script b/acceptance/bundle/migrate/command/dashboards/script
new file mode 100755
index 00000000000..eb983cb8197
--- /dev/null
+++ b/acceptance/bundle/migrate/command/dashboards/script
@@ -0,0 +1,36 @@
+# Replay a prior terraform deployment (captured from a real terraform run)
+trace replay_tfstate.py terraform-requests.json terraform.tfstate
+# Add all resource IDs to runtime replacements to avoid pattern matching ambiguity
+replace_ids.py
+print_state.py > out.original_state.json
+
+trace $CLI bundle deployment migrate 2>&1 | contains.py 'Migrated 1 resources'
+print_state.py > out.new_state.json
+
+
+rm "$OUT_REQUESTS"
+# Both DATABRICKS_BUNDLE_ENGINE=direct and DATABRICKS_BUNDLE_ENGINE= work
+# Badness: known issue with dashboards, will show up as 'recreate' see https://github.com/databricks/cli/pull/3966
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle plan | contains.py "1 unchanged"
+trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle plan | contains.py "1 unchanged"
+trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle plan -o json | nostamp > out.plan_after_migrate.json
+trace print_requests.py --get //dashboards | contains.py 'engine/direct' > /dev/null
+
+trace DATABRICKS_BUNDLE_ENGINE="" $CLI bundle deploy --auto-approve
+trace print_requests.py --get //dashboards | jq '.headers["User-Agent"][0]' | contains.py 'engine/direct' > /dev/null
+
+title "Should show that it's already migrated"
+trace musterr $CLI bundle deployment migrate
+trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle debug states
+trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle debug states --force-pull
+
+rm "$OUT_REQUESTS"
+
+# Uncomment once 'recreate' bug is fixed
+#title "Update databricks.yml, run plan & update"
+#trace update_file.py databricks.yml dashboard DASHBOARD
+#trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle plan
+#trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle plan -o json | nostamp > out.plan_update.json
+#trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle deploy
+
+#rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/migrate/command/dashboards/terraform-requests.json b/acceptance/bundle/migrate/command/dashboards/terraform-requests.json
new file mode 100644
index 00000000000..8149ba09aec
--- /dev/null
+++ b/acceptance/bundle/migrate/command/dashboards/terraform-requests.json
@@ -0,0 +1,20 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.0/lakeview/dashboards",
+    "body": {
+      "display_name": "my dashboard",
+      "parent_path": "/Workspace/Users/tester@databricks.com",
+      "serialized_dashboard": "{\"pages\":[{\"name\":\"02724bf2\",\"displayName\":\"Dashboard test bundle-deploy-dashboard\"}]}\n",
+      "warehouse_id": "123456"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/lakeview/dashboards/21e426a8882f7de9a42b984dbff36469/published",
+    "body": {
+      "embed_credentials": true,
+      "warehouse_id": "123456"
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/command/dashboards/terraform.tfstate b/acceptance/bundle/migrate/command/dashboards/terraform.tfstate
new file mode 100644
index 00000000000..65fdb7316c4
--- /dev/null
+++ b/acceptance/bundle/migrate/command/dashboards/terraform.tfstate
@@ -0,0 +1,47 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "25d594e8-e1e8-2d7b-3515-d9e97d6cb02a",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_dashboard",
+      "name": "dashboard1",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "create_time": "2026-09-28T16:49:42.39891Z",
+            "dashboard_change_detected": false,
+            "dashboard_id": "21e426a8882f7de9a42b984dbff36469",
+            "dataset_catalog": null,
+            "dataset_schema": null,
+            "display_name": "my dashboard",
+            "embed_credentials": true,
+            "etag": "80611980",
+            "file_path": null,
+            "id": "21e426a8882f7de9a42b984dbff36469",
+            "lifecycle_state": "ACTIVE",
+            "md5": "b4ab6aee48485b0b5e980761d3efe936",
+            "parent_path": "/Users/tester@databricks.com",
+            "path": "/Users/tester@databricks.com/my dashboard.lvdash.json",
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "serialized_dashboard": "{\"pages\":[{\"displayName\":\"Dashboard test bundle-deploy-dashboard\",\"name\":\"02724bf2\",\"pageType\":\"PAGE_TYPE_CANVAS\"}]}\n",
+            "update_time": "2026-09-28T16:49:42.39891Z",
+            "warehouse_id": "123456"
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/default-python/databricks.yml b/acceptance/bundle/migrate/command/default-python/databricks.yml
similarity index 100%
rename from acceptance/bundle/migrate/default-python/databricks.yml
rename to acceptance/bundle/migrate/command/default-python/databricks.yml
diff --git a/acceptance/bundle/migrate/default-python/input.json b/acceptance/bundle/migrate/command/default-python/input.json
similarity index 100%
rename from acceptance/bundle/migrate/default-python/input.json
rename to acceptance/bundle/migrate/command/default-python/input.json
diff --git a/acceptance/bundle/migrate/default-python/notebook.py b/acceptance/bundle/migrate/command/default-python/notebook.py
similarity index 100%
rename from acceptance/bundle/migrate/default-python/notebook.py
rename to acceptance/bundle/migrate/command/default-python/notebook.py
diff --git a/acceptance/bundle/migrate/default-python/out.plan_after_deploy.json b/acceptance/bundle/migrate/command/default-python/out.plan_after_deploy.json
similarity index 94%
rename from acceptance/bundle/migrate/default-python/out.plan_after_deploy.json
rename to acceptance/bundle/migrate/command/default-python/out.plan_after_deploy.json
index 439c9e6379a..5f9270249fa 100644
--- a/acceptance/bundle/migrate/default-python/out.plan_after_deploy.json
+++ b/acceptance/bundle/migrate/command/default-python/out.plan_after_deploy.json
@@ -1,6 +1,6 @@
 {
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
   "lineage": "[UUID]",
   "serial": 6,
   "plan": {
@@ -28,7 +28,7 @@
                   "max_workers": 4,
                   "min_workers": 1
                 },
-                "data_security_mode": "SINGLE_USER",
+                "data_security_mode": "DATA_SECURITY_MODE_AUTO",
                 "node_type_id": "[NODE_TYPE_ID]",
                 "spark_version": "16.4.x-scala2.12"
               }
@@ -96,7 +96,7 @@
                 }
               ],
               "pipeline_task": {
-                "pipeline_id": "[UUID]"
+                "pipeline_id": "[MY_DEFAULT_PYTHON_ETL_ID]"
               },
               "task_key": "refresh_pipeline"
             }
@@ -128,13 +128,13 @@
                 "max_workers": 4,
                 "min_workers": 1
               },
-              "data_security_mode": "SINGLE_USER",
+              "data_security_mode": "DATA_SECURITY_MODE_AUTO",
               "node_type_id": "[NODE_TYPE_ID]",
               "spark_version": "16.4.x-scala2.12"
             }
           }
         ],
-        "job_id": [NUMID],
+        "job_id": [SAMPLE_JOB_ID],
         "max_concurrent_runs": 4,
         "name": "[dev [USERNAME]] sample_job",
         "parameters": [
@@ -206,7 +206,7 @@
             ],
             "email_notifications": {},
             "pipeline_task": {
-              "pipeline_id": "[UUID]"
+              "pipeline_id": "[MY_DEFAULT_PYTHON_ETL_ID]"
             },
             "run_if": "ALL_SUCCESS",
             "task_key": "refresh_pipeline",
@@ -320,7 +320,7 @@
             "--editable /Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files"
           ]
         },
-        "id": "[UUID]",
+        "id": "[MY_DEFAULT_PYTHON_ETL_ID]",
         "last_modified": [UNIX_TIME_MILLIS][1],
         "libraries": [
           {
@@ -330,12 +330,12 @@
           }
         ],
         "name": "[dev [USERNAME]] my_default_python_etl",
-        "pipeline_id": "[UUID]",
+        "pipeline_id": "[MY_DEFAULT_PYTHON_ETL_ID]",
         "root_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python_etl",
         "run_as_user_name": "[USERNAME]",
         "schema": "[USERNAME]",
         "state": "IDLE",
-        "storage": "dbfs:/pipelines/[UUID]",
+        "storage": "dbfs:/pipelines/[MY_DEFAULT_PYTHON_ETL_ID]",
         "tags": {
           "dev": "[USERNAME]"
         }
@@ -343,8 +343,8 @@
       "changes": {
         "storage": {
           "action": "skip",
-          "reason": "backend_default",
-          "remote": "dbfs:/pipelines/[UUID]"
+          "reason": "immutable_backend_value",
+          "remote": "dbfs:/pipelines/[MY_DEFAULT_PYTHON_ETL_ID]"
         }
       }
     }
diff --git a/acceptance/bundle/migrate/default-python/out.plan_after_migration.json b/acceptance/bundle/migrate/command/default-python/out.plan_after_migration.json
similarity index 94%
rename from acceptance/bundle/migrate/default-python/out.plan_after_migration.json
rename to acceptance/bundle/migrate/command/default-python/out.plan_after_migration.json
index a868c0f5a67..8df5a4684a9 100644
--- a/acceptance/bundle/migrate/default-python/out.plan_after_migration.json
+++ b/acceptance/bundle/migrate/command/default-python/out.plan_after_migration.json
@@ -1,6 +1,6 @@
 {
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
   "lineage": "[UUID]",
   "serial": 5,
   "plan": {
@@ -28,7 +28,7 @@
                   "max_workers": 4,
                   "min_workers": 1
                 },
-                "data_security_mode": "SINGLE_USER",
+                "data_security_mode": "DATA_SECURITY_MODE_AUTO",
                 "node_type_id": "[NODE_TYPE_ID]",
                 "spark_version": "16.4.x-scala2.12"
               }
@@ -96,7 +96,7 @@
                 }
               ],
               "pipeline_task": {
-                "pipeline_id": "[UUID]"
+                "pipeline_id": "[MY_DEFAULT_PYTHON_ETL_ID]"
               },
               "task_key": "refresh_pipeline"
             }
@@ -128,13 +128,13 @@
                 "max_workers": 4,
                 "min_workers": 1
               },
-              "data_security_mode": "SINGLE_USER",
+              "data_security_mode": "DATA_SECURITY_MODE_AUTO",
               "node_type_id": "[NODE_TYPE_ID]",
               "spark_version": "16.4.x-scala2.12"
             }
           }
         ],
-        "job_id": [NUMID],
+        "job_id": [SAMPLE_JOB_ID],
         "max_concurrent_runs": 4,
         "name": "[dev [USERNAME]] sample_job",
         "parameters": [
@@ -206,7 +206,7 @@
             ],
             "email_notifications": {},
             "pipeline_task": {
-              "pipeline_id": "[UUID]"
+              "pipeline_id": "[MY_DEFAULT_PYTHON_ETL_ID]"
             },
             "run_if": "ALL_SUCCESS",
             "task_key": "refresh_pipeline",
@@ -320,7 +320,7 @@
             "--editable /Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files"
           ]
         },
-        "id": "[UUID]",
+        "id": "[MY_DEFAULT_PYTHON_ETL_ID]",
         "last_modified": [UNIX_TIME_MILLIS][1],
         "libraries": [
           {
@@ -330,12 +330,12 @@
           }
         ],
         "name": "[dev [USERNAME]] my_default_python_etl",
-        "pipeline_id": "[UUID]",
+        "pipeline_id": "[MY_DEFAULT_PYTHON_ETL_ID]",
         "root_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python_etl",
         "run_as_user_name": "[USERNAME]",
         "schema": "[USERNAME]",
         "state": "IDLE",
-        "storage": "dbfs:/pipelines/[UUID]",
+        "storage": "dbfs:/pipelines/[MY_DEFAULT_PYTHON_ETL_ID]",
         "tags": {
           "dev": "[USERNAME]"
         }
@@ -343,8 +343,8 @@
       "changes": {
         "storage": {
           "action": "skip",
-          "reason": "backend_default",
-          "remote": "dbfs:/pipelines/[UUID]"
+          "reason": "immutable_backend_value",
+          "remote": "dbfs:/pipelines/[MY_DEFAULT_PYTHON_ETL_ID]"
         }
       }
     }
diff --git a/acceptance/bundle/migrate/default-python/out.state_after_migration.json b/acceptance/bundle/migrate/command/default-python/out.state_after_migration.json
similarity index 93%
rename from acceptance/bundle/migrate/default-python/out.state_after_migration.json
rename to acceptance/bundle/migrate/command/default-python/out.state_after_migration.json
index 029649aae3b..007548bcee5 100644
--- a/acceptance/bundle/migrate/default-python/out.state_after_migration.json
+++ b/acceptance/bundle/migrate/command/default-python/out.state_after_migration.json
@@ -1,11 +1,11 @@
 {
- "state_version": 2,
- "cli_version": "[DEV_VERSION]",
+ "state_version": 3,
+ "cli_version": "[CLI_VERSION]",
  "lineage": "[UUID]",
  "serial": 5,
  "state": {
   "resources.jobs.sample_job": {
-   "__id__": "[NUMID]",
+   "__id__": "[SAMPLE_JOB_ID]",
    "state": {
     "deployment": {
      "kind": "BUNDLE",
@@ -21,7 +21,7 @@
         "max_workers": 4,
         "min_workers": 1
        },
-       "data_security_mode": "SINGLE_USER",
+       "data_security_mode": "DATA_SECURITY_MODE_AUTO",
        "node_type_id": "[NODE_TYPE_ID]",
        "spark_version": "16.4.x-scala2.12"
       }
@@ -89,7 +89,7 @@
        }
       ],
       "pipeline_task": {
-       "pipeline_id": "[UUID]"
+       "pipeline_id": "[MY_DEFAULT_PYTHON_ETL_ID]"
       },
       "task_key": "refresh_pipeline"
      }
@@ -110,7 +110,7 @@
    ]
   },
   "resources.pipelines.my_default_python_etl": {
-   "__id__": "[UUID]",
+   "__id__": "[MY_DEFAULT_PYTHON_ETL_ID]",
    "state": {
     "channel": "CURRENT",
     "deployment": {
diff --git a/acceptance/bundle/migrate/default-python/out.state_original.json b/acceptance/bundle/migrate/command/default-python/out.state_original.json
similarity index 90%
rename from acceptance/bundle/migrate/default-python/out.state_original.json
rename to acceptance/bundle/migrate/command/default-python/out.state_original.json
index a91be18e2d2..049572d0136 100644
--- a/acceptance/bundle/migrate/default-python/out.state_original.json
+++ b/acceptance/bundle/migrate/command/default-python/out.state_original.json
@@ -21,8 +21,10 @@
             "dbt_task": [],
             "deployment": [
               {
+                "deployment_id": "",
                 "kind": "BUNDLE",
-                "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/state/metadata.json"
+                "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/state/metadata.json",
+                "version_id": ""
               }
             ],
             "description": null,
@@ -42,7 +44,7 @@
             "format": "MULTI_TASK",
             "git_source": [],
             "health": [],
-            "id": "[NUMID]",
+            "id": "[SAMPLE_JOB_ID]",
             "job_cluster": [
               {
                 "job_cluster_key": "job_cluster",
@@ -63,7 +65,8 @@
                     "cluster_mount_info": [],
                     "cluster_name": "",
                     "custom_tags": null,
-                    "data_security_mode": "SINGLE_USER",
+                    "data_security_mode": "DATA_SECURITY_MODE_AUTO",
+                    "dependency_mode": "",
                     "docker_image": [],
                     "driver_instance_pool_id": "",
                     "driver_node_type_flexibility": [],
@@ -93,7 +96,8 @@
                     "worker_node_type_flexibility": [],
                     "workload_type": []
                   }
-                ]
+                ],
+                "serverless_compute_id": ""
               }
             ],
             "library": [],
@@ -114,9 +118,14 @@
                 "name": "schema"
               }
             ],
+            "parent_path": null,
             "performance_target": null,
             "pipeline_task": [],
-            "provider_config": [],
+            "provider_config": [
+              {
+                "workspace_id": "[WORKSPACE_ID]"
+              }
+            ],
             "python_wheel_task": [],
             "queue": [
               {
@@ -141,6 +150,7 @@
             },
             "task": [
               {
+                "ai_runtime_task": [],
                 "alert_task": [],
                 "clean_rooms_notebook_task": [],
                 "compute": [],
@@ -195,6 +205,7 @@
                 "notification_settings": [],
                 "pipeline_task": [],
                 "power_bi_task": [],
+                "python_operator_task": [],
                 "python_wheel_task": [],
                 "retry_on_timeout": false,
                 "run_if": "ALL_SUCCESS",
@@ -208,6 +219,7 @@
                 "webhook_notifications": []
               },
               {
+                "ai_runtime_task": [],
                 "alert_task": [],
                 "clean_rooms_notebook_task": [],
                 "compute": [],
@@ -260,6 +272,7 @@
                 "notification_settings": [],
                 "pipeline_task": [],
                 "power_bi_task": [],
+                "python_operator_task": [],
                 "python_wheel_task": [
                   {
                     "entry_point": "main",
@@ -285,6 +298,7 @@
                 "webhook_notifications": []
               },
               {
+                "ai_runtime_task": [],
                 "alert_task": [],
                 "clean_rooms_notebook_task": [],
                 "compute": [],
@@ -327,10 +341,16 @@
                 "pipeline_task": [
                   {
                     "full_refresh": false,
-                    "pipeline_id": "[UUID]"
+                    "full_refresh_selection": null,
+                    "parameters": null,
+                    "pipeline_id": "[MY_DEFAULT_PYTHON_ETL_ID]",
+                    "refresh_flow_selection": null,
+                    "refresh_selection": null,
+                    "reset_checkpoint_selection": null
                   }
                 ],
                 "power_bi_task": [],
+                "python_operator_task": [],
                 "python_wheel_task": [],
                 "retry_on_timeout": false,
                 "run_if": "ALL_SUCCESS",
@@ -357,10 +377,12 @@
                     "unit": "DAYS"
                   }
                 ],
+                "sql_condition": [],
                 "table_update": []
               }
             ],
-            "url": "[DATABRICKS_URL]/#job/[NUMID]",
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/[SAMPLE_JOB_ID]",
             "usage_policy_id": null,
             "webhook_notifications": [
               {
@@ -401,8 +423,10 @@
             "creator_user_name": "[USERNAME]",
             "deployment": [
               {
+                "deployment_id": "",
                 "kind": "BUNDLE",
-                "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/state/metadata.json"
+                "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/state/metadata.json",
+                "version_id": ""
               }
             ],
             "development": true,
@@ -420,7 +444,7 @@
             "filters": [],
             "gateway_definition": [],
             "health": null,
-            "id": "[UUID]",
+            "id": "[MY_DEFAULT_PYTHON_ETL_ID]",
             "ingestion_definition": [],
             "last_modified": [UNIX_TIME_MILLIS],
             "latest_updates": null,
@@ -441,22 +465,27 @@
             "name": "[dev [USERNAME]] my_default_python_etl",
             "notification": [],
             "photon": false,
-            "provider_config": [],
+            "provider_config": [
+              {
+                "workspace_id": "[WORKSPACE_ID]"
+              }
+            ],
             "restart_window": [],
             "root_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python_etl",
             "run_as": [],
             "run_as_user_name": "[USERNAME]",
             "schema": "[USERNAME]",
             "serverless": false,
+            "serverless_compute_id": null,
             "state": "IDLE",
-            "storage": "dbfs:/pipelines/[UUID]",
+            "storage": "dbfs:/pipelines/[MY_DEFAULT_PYTHON_ETL_ID]",
             "tags": {
               "dev": "[USERNAME]"
             },
             "target": null,
             "timeouts": null,
             "trigger": [],
-            "url": "[DATABRICKS_URL]/#joblist/pipelines/[UUID]",
+            "url": "[DATABRICKS_URL]/#joblist/pipelines/[MY_DEFAULT_PYTHON_ETL_ID]",
             "usage_policy_id": null
           },
           "sensitive_attributes": [],
diff --git a/acceptance/bundle/migrate/command/default-python/out.test.toml b/acceptance/bundle/migrate/command/default-python/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/command/default-python/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/command/default-python/output.txt b/acceptance/bundle/migrate/command/default-python/output.txt
new file mode 100644
index 00000000000..8212f47a6c9
--- /dev/null
+++ b/acceptance/bundle/migrate/command/default-python/output.txt
@@ -0,0 +1,265 @@
+
+>>> [CLI] bundle init default-python --config-file ./input.json
+Welcome to the default Python template for Declarative Automation Bundles!
+
+Answer the following questions to customize your project.
+You can always change your configuration in the databricks.yml file later.
+
+Note that [DATABRICKS_URL] is used for initialization.
+(For information on how to change your profile, see https://docs.databricks.com/dev-tools/cli/profiles.html.)
+
+✨ Your new project has been created in the 'my_default_python' directory!
+
+To get started, refer to the project README.md file and the documentation at https://docs.databricks.com/dev-tools/bundles/index.html.
+
+>>> replay_tfstate.py ../terraform-requests.json ../terraform.tfstate -t dev
+
+>>> print_state.py
+
+>>> [CLI] bundle deployment migrate
+Building python_artifact...
+Success! Migrated 2 resources to direct engine state file: [TEST_TMP_DIR]/my_default_python/.databricks/bundle/dev/resources.json
+
+Validate the migration by running "databricks bundle plan", there should be no actions planned.
+
+The state file is not synchronized to the workspace yet. To do that and finalize the migration, run "bundle deploy".
+
+To undo the migration, remove [TEST_TMP_DIR]/my_default_python/.databricks/bundle/dev/resources.json and rename [TEST_TMP_DIR]/my_default_python/.databricks/bundle/dev/terraform/terraform.tfstate.backup to [TEST_TMP_DIR]/my_default_python/.databricks/bundle/dev/terraform/terraform.tfstate
+
+
+>>> print_state.py
+
+>>> jq .. | .libraries? | select(.) ../out.state_after_migration.json
+[
+  {
+    "whl": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl"
+  }
+]
+[
+  {
+    "whl": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl"
+  }
+]
+[
+  {
+    "glob": {
+      "include": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python_etl/transformations/**"
+    }
+  }
+]
+
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle plan
+Building python_artifact...
+update jobs.sample_job
+
+Plan: 0 to add, 1 to change, 0 to delete, 1 unchanged
+
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle plan -o json
+Building python_artifact...
+
+>>> jq .plan[] | .changes ../out.plan_after_migration.json
+{
+  "email_notifications": {
+    "action": "skip",
+    "reason": "empty",
+    "remote": {}
+  },
+  "tasks[task_key='notebook_task'].email_notifications": {
+    "action": "skip",
+    "reason": "empty",
+    "remote": {}
+  },
+  "tasks[task_key='notebook_task'].libraries[0].whl": {
+    "action": "update",
+    "old": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl",
+    "new": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][1]-py3-none-any.whl",
+    "remote": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][2]-py3-none-any.whl"
+  },
+  "tasks[task_key='notebook_task'].notebook_task.source": {
+    "action": "skip",
+    "reason": "backend_default",
+    "remote": "WORKSPACE"
+  },
+  "tasks[task_key='notebook_task'].run_if": {
+    "action": "skip",
+    "reason": "backend_default",
+    "remote": "ALL_SUCCESS"
+  },
+  "tasks[task_key='notebook_task'].timeout_seconds": {
+    "action": "skip",
+    "reason": "empty",
+    "remote": 0
+  },
+  "tasks[task_key='python_wheel_task'].email_notifications": {
+    "action": "skip",
+    "reason": "empty",
+    "remote": {}
+  },
+  "tasks[task_key='python_wheel_task'].libraries[0].whl": {
+    "action": "update",
+    "old": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl",
+    "new": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][1]-py3-none-any.whl",
+    "remote": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][2]-py3-none-any.whl"
+  },
+  "tasks[task_key='python_wheel_task'].run_if": {
+    "action": "skip",
+    "reason": "backend_default",
+    "remote": "ALL_SUCCESS"
+  },
+  "tasks[task_key='python_wheel_task'].timeout_seconds": {
+    "action": "skip",
+    "reason": "empty",
+    "remote": 0
+  },
+  "tasks[task_key='refresh_pipeline'].email_notifications": {
+    "action": "skip",
+    "reason": "empty",
+    "remote": {}
+  },
+  "tasks[task_key='refresh_pipeline'].run_if": {
+    "action": "skip",
+    "reason": "backend_default",
+    "remote": "ALL_SUCCESS"
+  },
+  "tasks[task_key='refresh_pipeline'].timeout_seconds": {
+    "action": "skip",
+    "reason": "empty",
+    "remote": 0
+  },
+  "timeout_seconds": {
+    "action": "skip",
+    "reason": "empty",
+    "remote": 0
+  },
+  "webhook_notifications": {
+    "action": "skip",
+    "reason": "empty",
+    "remote": {}
+  }
+}
+{
+  "storage": {
+    "action": "skip",
+    "reason": "immutable_backend_value",
+    "remote": "dbfs:/pipelines/[MY_DEFAULT_PYTHON_ETL_ID]"
+  }
+}
+
+>>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle deploy
+Building python_artifact...
+Uploading .databricks/bundle/dev/patched_wheels/python_artifact_my_default_python/my_default_python-0.0.1+[UNIX_TIME_NANOS][3]-py3-none-any.whl...
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files...
+Updated jobs.sample_job
+Files: 20 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 1 unchanged
+
+>>> print_state.py
+
+>>> diff.py ../out.state_after_migration.json ../out.state_after_deploy.json
+--- ../out.state_after_migration.json
++++ ../out.state_after_deploy.json
+@@ -3,5 +3,5 @@
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+- "serial": 5,
++ "serial": 6,
+  "state": {
+   "resources.jobs.sample_job": {
+
+=== Extra plan: should have no drift
+>>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle plan
+Building python_artifact...
+update jobs.sample_job
+
+Plan: 0 to add, 1 to change, 0 to delete, 1 unchanged
+
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle plan -o json
+Building python_artifact...
+
+>>> jq .plan[] | .changes ../out.plan_after_migration.json
+{
+  "email_notifications": {
+    "action": "skip",
+    "reason": "empty",
+    "remote": {}
+  },
+  "tasks[task_key='notebook_task'].email_notifications": {
+    "action": "skip",
+    "reason": "empty",
+    "remote": {}
+  },
+  "tasks[task_key='notebook_task'].libraries[0].whl": {
+    "action": "update",
+    "old": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl",
+    "new": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][1]-py3-none-any.whl",
+    "remote": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][2]-py3-none-any.whl"
+  },
+  "tasks[task_key='notebook_task'].notebook_task.source": {
+    "action": "skip",
+    "reason": "backend_default",
+    "remote": "WORKSPACE"
+  },
+  "tasks[task_key='notebook_task'].run_if": {
+    "action": "skip",
+    "reason": "backend_default",
+    "remote": "ALL_SUCCESS"
+  },
+  "tasks[task_key='notebook_task'].timeout_seconds": {
+    "action": "skip",
+    "reason": "empty",
+    "remote": 0
+  },
+  "tasks[task_key='python_wheel_task'].email_notifications": {
+    "action": "skip",
+    "reason": "empty",
+    "remote": {}
+  },
+  "tasks[task_key='python_wheel_task'].libraries[0].whl": {
+    "action": "update",
+    "old": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl",
+    "new": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][1]-py3-none-any.whl",
+    "remote": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][2]-py3-none-any.whl"
+  },
+  "tasks[task_key='python_wheel_task'].run_if": {
+    "action": "skip",
+    "reason": "backend_default",
+    "remote": "ALL_SUCCESS"
+  },
+  "tasks[task_key='python_wheel_task'].timeout_seconds": {
+    "action": "skip",
+    "reason": "empty",
+    "remote": 0
+  },
+  "tasks[task_key='refresh_pipeline'].email_notifications": {
+    "action": "skip",
+    "reason": "empty",
+    "remote": {}
+  },
+  "tasks[task_key='refresh_pipeline'].run_if": {
+    "action": "skip",
+    "reason": "backend_default",
+    "remote": "ALL_SUCCESS"
+  },
+  "tasks[task_key='refresh_pipeline'].timeout_seconds": {
+    "action": "skip",
+    "reason": "empty",
+    "remote": 0
+  },
+  "timeout_seconds": {
+    "action": "skip",
+    "reason": "empty",
+    "remote": 0
+  },
+  "webhook_notifications": {
+    "action": "skip",
+    "reason": "empty",
+    "remote": {}
+  }
+}
+{
+  "storage": {
+    "action": "skip",
+    "reason": "immutable_backend_value",
+    "remote": "dbfs:/pipelines/[MY_DEFAULT_PYTHON_ETL_ID]"
+  }
+}
diff --git a/acceptance/bundle/migrate/default-python/pipeline.py b/acceptance/bundle/migrate/command/default-python/pipeline.py
similarity index 100%
rename from acceptance/bundle/migrate/default-python/pipeline.py
rename to acceptance/bundle/migrate/command/default-python/pipeline.py
diff --git a/acceptance/bundle/migrate/command/default-python/script b/acceptance/bundle/migrate/command/default-python/script
new file mode 100755
index 00000000000..ce5f97c944a
--- /dev/null
+++ b/acceptance/bundle/migrate/command/default-python/script
@@ -0,0 +1,27 @@
+export DATABRICKS_BUNDLE_ENGINE=
+trace $CLI bundle init default-python --config-file ./input.json
+cd my_default_python
+
+# Replay a prior terraform deployment (a job and a DLT pipeline)
+trace replay_tfstate.py ../terraform-requests.json ../terraform.tfstate -t dev
+replace_ids.py -t dev
+trace print_state.py > ../out.state_original.json
+
+trace $CLI bundle deployment migrate
+
+trace print_state.py > ../out.state_after_migration.json
+trace jq '.. | .libraries? | select(.)' ../out.state_after_migration.json
+
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle plan
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle plan -o json | nostamp > ../out.plan_after_migration.json
+trace jq '.plan[] | .changes' ../out.plan_after_migration.json  # Badness: contains changes for whl and num_workers
+trace DATABRICKS_BUNDLE_ENGINE="" $CLI bundle deploy
+
+trace print_state.py > ../out.state_after_deploy.json
+trace diff.py ../out.state_after_migration.json ../out.state_after_deploy.json
+rm ../out.state_after_deploy.json
+
+title "Extra plan: should have no drift"
+trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle plan
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle plan -o json | nostamp > ../out.plan_after_deploy.json
+trace jq '.plan[] | .changes' ../out.plan_after_migration.json  # Badness: contains changes for whl
diff --git a/acceptance/bundle/migrate/command/default-python/terraform-requests.json b/acceptance/bundle/migrate/command/default-python/terraform-requests.json
new file mode 100644
index 00000000000..0bacbb9cdf5
--- /dev/null
+++ b/acceptance/bundle/migrate/command/default-python/terraform-requests.json
@@ -0,0 +1,134 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.0/pipelines",
+    "body": {
+      "channel": "CURRENT",
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/my_default_python/dev/state/metadata.json"
+      },
+      "development": true,
+      "edition": "ADVANCED",
+      "environment": {
+        "dependencies": [
+          "--editable /Workspace/Users/tester@databricks.com/.bundle/my_default_python/dev/files"
+        ]
+      },
+      "libraries": [
+        {
+          "glob": {
+            "include": "/Workspace/Users/tester@databricks.com/.bundle/my_default_python/dev/files/src/my_default_python_etl/transformations/**"
+          }
+        }
+      ],
+      "name": "[dev tester] my_default_python_etl",
+      "root_path": "/Workspace/Users/tester@databricks.com/.bundle/my_default_python/dev/files/src/my_default_python_etl",
+      "schema": "tester",
+      "tags": {
+        "dev": "tester"
+      }
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/my_default_python/dev/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "job_clusters": [
+        {
+          "job_cluster_key": "job_cluster",
+          "new_cluster": {
+            "autoscale": {
+              "max_workers": 4,
+              "min_workers": 1
+            },
+            "data_security_mode": "DATA_SECURITY_MODE_AUTO",
+            "node_type_id": "i3.xlarge",
+            "spark_version": "16.4.x-scala2.12"
+          }
+        }
+      ],
+      "max_concurrent_runs": 4,
+      "name": "[dev tester] sample_job",
+      "parameters": [
+        {
+          "default": "hive_metastore",
+          "name": "catalog"
+        },
+        {
+          "default": "tester",
+          "name": "schema"
+        }
+      ],
+      "queue": {
+        "enabled": true
+      },
+      "tags": {
+        "dev": "tester"
+      },
+      "tasks": [
+        {
+          "job_cluster_key": "job_cluster",
+          "libraries": [
+            {
+              "whl": "/Workspace/Users/tester@databricks.com/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+1790615449746915976-py3-none-any.whl"
+            }
+          ],
+          "notebook_task": {
+            "notebook_path": "/Workspace/Users/tester@databricks.com/.bundle/my_default_python/dev/files/src/sample_notebook",
+            "source": "WORKSPACE"
+          },
+          "task_key": "notebook_task"
+        },
+        {
+          "depends_on": [
+            {
+              "task_key": "notebook_task"
+            }
+          ],
+          "job_cluster_key": "job_cluster",
+          "libraries": [
+            {
+              "whl": "/Workspace/Users/tester@databricks.com/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+1790615449746915976-py3-none-any.whl"
+            }
+          ],
+          "python_wheel_task": {
+            "entry_point": "main",
+            "package_name": "my_default_python",
+            "parameters": [
+              "--catalog",
+              "hive_metastore",
+              "--schema",
+              "tester"
+            ]
+          },
+          "task_key": "python_wheel_task"
+        },
+        {
+          "depends_on": [
+            {
+              "task_key": "notebook_task"
+            }
+          ],
+          "pipeline_task": {
+            "pipeline_id": "79fe8a2d-965e-74e8-79fe-8a2d965e74e9"
+          },
+          "task_key": "refresh_pipeline"
+        }
+      ],
+      "trigger": {
+        "pause_status": "PAUSED",
+        "periodic": {
+          "interval": 1,
+          "unit": "DAYS"
+        }
+      }
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/command/default-python/terraform.tfstate b/acceptance/bundle/migrate/command/default-python/terraform.tfstate
new file mode 100644
index 00000000000..aefa65b1866
--- /dev/null
+++ b/acceptance/bundle/migrate/command/default-python/terraform.tfstate
@@ -0,0 +1,498 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 3,
+  "lineage": "ec477bfd-db39-0f7c-fb69-9c40fa7736dd",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "sample_job",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/my_default_python/dev/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790615451138502000",
+            "job_cluster": [
+              {
+                "job_cluster_key": "job_cluster",
+                "new_cluster": [
+                  {
+                    "__apply_policy_default_values_allow_list": null,
+                    "apply_policy_default_values": false,
+                    "autoscale": [
+                      {
+                        "max_workers": 4,
+                        "min_workers": 1
+                      }
+                    ],
+                    "aws_attributes": [],
+                    "azure_attributes": [],
+                    "cluster_id": "",
+                    "cluster_log_conf": [],
+                    "cluster_mount_info": [],
+                    "cluster_name": "",
+                    "custom_tags": null,
+                    "data_security_mode": "DATA_SECURITY_MODE_AUTO",
+                    "dependency_mode": "",
+                    "docker_image": [],
+                    "driver_instance_pool_id": "",
+                    "driver_node_type_flexibility": [],
+                    "driver_node_type_id": "",
+                    "enable_elastic_disk": false,
+                    "enable_local_disk_encryption": false,
+                    "gcp_attributes": [],
+                    "idempotency_token": "",
+                    "init_scripts": [],
+                    "instance_pool_id": "",
+                    "is_single_node": false,
+                    "kind": "",
+                    "library": [],
+                    "node_type_id": "i3.xlarge",
+                    "num_workers": 0,
+                    "policy_id": "",
+                    "provider_config": [],
+                    "remote_disk_throughput": 0,
+                    "runtime_engine": "",
+                    "single_user_name": "",
+                    "spark_conf": null,
+                    "spark_env_vars": null,
+                    "spark_version": "16.4.x-scala2.12",
+                    "ssh_public_keys": null,
+                    "total_initial_remote_disk_size": 0,
+                    "use_ml_runtime": false,
+                    "worker_node_type_flexibility": [],
+                    "workload_type": []
+                  }
+                ],
+                "serverless_compute_id": ""
+              }
+            ],
+            "library": [],
+            "max_concurrent_runs": 4,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "[dev tester] sample_job",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [
+              {
+                "default": "hive_metastore",
+                "name": "catalog"
+              },
+              {
+                "default": "tester",
+                "name": "schema"
+              }
+            ],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": {
+              "dev": "tester"
+            },
+            "task": [
+              {
+                "ai_runtime_task": [],
+                "alert_task": [],
+                "clean_rooms_notebook_task": [],
+                "compute": [],
+                "condition_task": [],
+                "dashboard_task": [],
+                "dbt_cloud_task": [],
+                "dbt_platform_task": [],
+                "dbt_task": [],
+                "depends_on": [],
+                "description": "",
+                "disable_auto_optimization": false,
+                "disabled": false,
+                "email_notifications": [
+                  {
+                    "no_alert_for_skipped_runs": false,
+                    "on_duration_warning_threshold_exceeded": [],
+                    "on_failure": [],
+                    "on_start": [],
+                    "on_streaming_backlog_exceeded": [],
+                    "on_success": []
+                  }
+                ],
+                "environment_key": "",
+                "existing_cluster_id": "",
+                "for_each_task": [],
+                "gen_ai_compute_task": [],
+                "health": [],
+                "job_cluster_key": "job_cluster",
+                "library": [
+                  {
+                    "cran": [],
+                    "egg": "",
+                    "jar": "",
+                    "maven": [],
+                    "provider_config": [],
+                    "pypi": [],
+                    "requirements": "",
+                    "whl": "/Workspace/Users/tester@databricks.com/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+1790615449746915976-py3-none-any.whl"
+                  }
+                ],
+                "max_retries": 0,
+                "min_retry_interval_millis": 0,
+                "new_cluster": [],
+                "notebook_task": [
+                  {
+                    "base_parameters": null,
+                    "notebook_path": "/Workspace/Users/tester@databricks.com/.bundle/my_default_python/dev/files/src/sample_notebook",
+                    "source": "WORKSPACE",
+                    "warehouse_id": ""
+                  }
+                ],
+                "notification_settings": [],
+                "pipeline_task": [],
+                "power_bi_task": [],
+                "python_operator_task": [],
+                "python_wheel_task": [],
+                "retry_on_timeout": false,
+                "run_if": "ALL_SUCCESS",
+                "run_job_task": [],
+                "spark_jar_task": [],
+                "spark_python_task": [],
+                "spark_submit_task": [],
+                "sql_task": [],
+                "task_key": "notebook_task",
+                "timeout_seconds": 0,
+                "webhook_notifications": []
+              },
+              {
+                "ai_runtime_task": [],
+                "alert_task": [],
+                "clean_rooms_notebook_task": [],
+                "compute": [],
+                "condition_task": [],
+                "dashboard_task": [],
+                "dbt_cloud_task": [],
+                "dbt_platform_task": [],
+                "dbt_task": [],
+                "depends_on": [
+                  {
+                    "outcome": "",
+                    "task_key": "notebook_task"
+                  }
+                ],
+                "description": "",
+                "disable_auto_optimization": false,
+                "disabled": false,
+                "email_notifications": [
+                  {
+                    "no_alert_for_skipped_runs": false,
+                    "on_duration_warning_threshold_exceeded": [],
+                    "on_failure": [],
+                    "on_start": [],
+                    "on_streaming_backlog_exceeded": [],
+                    "on_success": []
+                  }
+                ],
+                "environment_key": "",
+                "existing_cluster_id": "",
+                "for_each_task": [],
+                "gen_ai_compute_task": [],
+                "health": [],
+                "job_cluster_key": "job_cluster",
+                "library": [
+                  {
+                    "cran": [],
+                    "egg": "",
+                    "jar": "",
+                    "maven": [],
+                    "provider_config": [],
+                    "pypi": [],
+                    "requirements": "",
+                    "whl": "/Workspace/Users/tester@databricks.com/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+1790615449746915976-py3-none-any.whl"
+                  }
+                ],
+                "max_retries": 0,
+                "min_retry_interval_millis": 0,
+                "new_cluster": [],
+                "notebook_task": [],
+                "notification_settings": [],
+                "pipeline_task": [],
+                "power_bi_task": [],
+                "python_operator_task": [],
+                "python_wheel_task": [
+                  {
+                    "entry_point": "main",
+                    "named_parameters": null,
+                    "package_name": "my_default_python",
+                    "parameters": [
+                      "--catalog",
+                      "hive_metastore",
+                      "--schema",
+                      "tester"
+                    ]
+                  }
+                ],
+                "retry_on_timeout": false,
+                "run_if": "ALL_SUCCESS",
+                "run_job_task": [],
+                "spark_jar_task": [],
+                "spark_python_task": [],
+                "spark_submit_task": [],
+                "sql_task": [],
+                "task_key": "python_wheel_task",
+                "timeout_seconds": 0,
+                "webhook_notifications": []
+              },
+              {
+                "ai_runtime_task": [],
+                "alert_task": [],
+                "clean_rooms_notebook_task": [],
+                "compute": [],
+                "condition_task": [],
+                "dashboard_task": [],
+                "dbt_cloud_task": [],
+                "dbt_platform_task": [],
+                "dbt_task": [],
+                "depends_on": [
+                  {
+                    "outcome": "",
+                    "task_key": "notebook_task"
+                  }
+                ],
+                "description": "",
+                "disable_auto_optimization": false,
+                "disabled": false,
+                "email_notifications": [
+                  {
+                    "no_alert_for_skipped_runs": false,
+                    "on_duration_warning_threshold_exceeded": [],
+                    "on_failure": [],
+                    "on_start": [],
+                    "on_streaming_backlog_exceeded": [],
+                    "on_success": []
+                  }
+                ],
+                "environment_key": "",
+                "existing_cluster_id": "",
+                "for_each_task": [],
+                "gen_ai_compute_task": [],
+                "health": [],
+                "job_cluster_key": "",
+                "library": [],
+                "max_retries": 0,
+                "min_retry_interval_millis": 0,
+                "new_cluster": [],
+                "notebook_task": [],
+                "notification_settings": [],
+                "pipeline_task": [
+                  {
+                    "full_refresh": false,
+                    "full_refresh_selection": null,
+                    "parameters": null,
+                    "pipeline_id": "79fe8a2d-965e-74e8-79fe-8a2d965e74e9",
+                    "refresh_flow_selection": null,
+                    "refresh_selection": null,
+                    "reset_checkpoint_selection": null
+                  }
+                ],
+                "power_bi_task": [],
+                "python_operator_task": [],
+                "python_wheel_task": [],
+                "retry_on_timeout": false,
+                "run_if": "ALL_SUCCESS",
+                "run_job_task": [],
+                "spark_jar_task": [],
+                "spark_python_task": [],
+                "spark_submit_task": [],
+                "sql_task": [],
+                "task_key": "refresh_pipeline",
+                "timeout_seconds": 0,
+                "webhook_notifications": []
+              }
+            ],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [
+              {
+                "file_arrival": [],
+                "model": [],
+                "pause_status": "PAUSED",
+                "periodic": [
+                  {
+                    "interval": 1,
+                    "unit": "DAYS"
+                  }
+                ],
+                "sql_condition": [],
+                "table_update": []
+              }
+            ],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790615451138502000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ==",
+          "dependencies": [
+            "databricks_pipeline.my_default_python_etl"
+          ]
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_pipeline",
+      "name": "my_default_python_etl",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "allow_duplicate_names": false,
+            "budget_policy_id": null,
+            "catalog": null,
+            "cause": null,
+            "channel": "CURRENT",
+            "cluster": [],
+            "cluster_id": null,
+            "configuration": null,
+            "continuous": false,
+            "creator_user_name": "tester@databricks.com",
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/my_default_python/dev/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "development": true,
+            "edition": "ADVANCED",
+            "environment": [
+              {
+                "dependencies": [
+                  "--editable /Workspace/Users/tester@databricks.com/.bundle/my_default_python/dev/files"
+                ],
+                "environment_version": ""
+              }
+            ],
+            "event_log": [],
+            "expected_last_modified": 0,
+            "filters": [],
+            "gateway_definition": [],
+            "health": null,
+            "id": "79fe8a2d-965e-74e8-79fe-8a2d965e74e9",
+            "ingestion_definition": [],
+            "last_modified": 1790615451074,
+            "latest_updates": null,
+            "library": [
+              {
+                "file": [],
+                "glob": [
+                  {
+                    "include": "/Workspace/Users/tester@databricks.com/.bundle/my_default_python/dev/files/src/my_default_python_etl/transformations/**"
+                  }
+                ],
+                "jar": "",
+                "maven": [],
+                "notebook": [],
+                "whl": ""
+              }
+            ],
+            "name": "[dev tester] my_default_python_etl",
+            "notification": [],
+            "photon": false,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "restart_window": [],
+            "root_path": "/Workspace/Users/tester@databricks.com/.bundle/my_default_python/dev/files/src/my_default_python_etl",
+            "run_as": [],
+            "run_as_user_name": "tester@databricks.com",
+            "schema": "tester",
+            "serverless": false,
+            "serverless_compute_id": null,
+            "state": "IDLE",
+            "storage": "dbfs:/pipelines/79fe8a2d-965e-74e8-79fe-8a2d965e74e9",
+            "tags": {
+              "dev": "tester"
+            },
+            "target": null,
+            "timeouts": null,
+            "trigger": [],
+            "url": "[DATABRICKS_URL]/#joblist/pipelines/79fe8a2d-965e-74e8-79fe-8a2d965e74e9",
+            "usage_policy_id": null
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxMjAwMDAwMDAwMDAwLCJkZWZhdWx0IjoxMjAwMDAwMDAwMDAwLCJkZWxldGUiOjEyMDAwMDAwMDAwMDAsInJlYWQiOjEyMDAwMDAwMDAwMDAsInVwZGF0ZSI6MTIwMDAwMDAwMDAwMH19"
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/default-python/test.toml b/acceptance/bundle/migrate/command/default-python/test.toml
similarity index 100%
rename from acceptance/bundle/migrate/default-python/test.toml
rename to acceptance/bundle/migrate/command/default-python/test.toml
diff --git a/acceptance/bundle/migrate/command/empty-state/databricks.yml b/acceptance/bundle/migrate/command/empty-state/databricks.yml
new file mode 100644
index 00000000000..fe3a0edaf1d
--- /dev/null
+++ b/acceptance/bundle/migrate/command/empty-state/databricks.yml
@@ -0,0 +1,6 @@
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    job_a: {name: "Job A"}
diff --git a/acceptance/bundle/migrate/command/empty-state/out.test.toml b/acceptance/bundle/migrate/command/empty-state/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/command/empty-state/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/command/empty-state/output.txt b/acceptance/bundle/migrate/command/empty-state/output.txt
new file mode 100644
index 00000000000..d7a6dbf872e
--- /dev/null
+++ b/acceptance/bundle/migrate/command/empty-state/output.txt
@@ -0,0 +1,17 @@
+
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate
+
+>>> [CLI] bundle deployment migrate
+Success! Migrated 0 resources to direct engine state file: [TEST_TMP_DIR]/.databricks/bundle/default/resources.json
+
+Validate the migration by running "databricks bundle plan", there should be no actions planned.
+
+The state file is not synchronized to the workspace yet. To do that and finalize the migration, run "bundle deploy".
+
+To undo the migration, remove [TEST_TMP_DIR]/.databricks/bundle/default/resources.json and rename [TEST_TMP_DIR]/.databricks/bundle/default/terraform/terraform.tfstate.backup to [TEST_TMP_DIR]/.databricks/bundle/default/terraform/terraform.tfstate
+
+
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle plan
+create jobs.job_a
+
+Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
diff --git a/acceptance/bundle/migrate/command/empty-state/script b/acceptance/bundle/migrate/command/empty-state/script
new file mode 100644
index 00000000000..ae14476c979
--- /dev/null
+++ b/acceptance/bundle/migrate/command/empty-state/script
@@ -0,0 +1,10 @@
+export DATABRICKS_BUNDLE_ENGINE=
+
+# A terraform state that tracks no resources (e.g. everything was destroyed)
+trace replay_tfstate.py terraform-requests.json terraform.tfstate
+
+trace $CLI bundle deployment migrate
+
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle plan | contains.py "1 to add"
+
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/migrate/command/empty-state/terraform-requests.json b/acceptance/bundle/migrate/command/empty-state/terraform-requests.json
new file mode 100644
index 00000000000..fe51488c706
--- /dev/null
+++ b/acceptance/bundle/migrate/command/empty-state/terraform-requests.json
@@ -0,0 +1 @@
+[]
diff --git a/acceptance/bundle/migrate/command/empty-state/terraform.tfstate b/acceptance/bundle/migrate/command/empty-state/terraform.tfstate
new file mode 100644
index 00000000000..fce53877298
--- /dev/null
+++ b/acceptance/bundle/migrate/command/empty-state/terraform.tfstate
@@ -0,0 +1,9 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "37f6c843-91a5-3d5c-457c-2c43d9630444",
+  "outputs": {},
+  "resources": [],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/engine-config-direct/databricks.yml b/acceptance/bundle/migrate/command/engine-config-direct/databricks.yml
similarity index 100%
rename from acceptance/bundle/migrate/engine-config-direct/databricks.yml
rename to acceptance/bundle/migrate/command/engine-config-direct/databricks.yml
diff --git a/acceptance/bundle/migrate/command/engine-config-direct/out.test.toml b/acceptance/bundle/migrate/command/engine-config-direct/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/command/engine-config-direct/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/command/engine-config-direct/output.txt b/acceptance/bundle/migrate/command/engine-config-direct/output.txt
new file mode 100644
index 00000000000..af0cb97daa1
--- /dev/null
+++ b/acceptance/bundle/migrate/command/engine-config-direct/output.txt
@@ -0,0 +1,5 @@
+
+>>> musterr [CLI] bundle deployment migrate
+Error: This command migrates the existing Terraform state file (terraform.tfstate) to a direct deployment state file (resources.json). However, no existing local or remote state was found.
+
+New bundles use the direct engine automatically, no migration is needed.
diff --git a/acceptance/bundle/migrate/engine-config-direct/script b/acceptance/bundle/migrate/command/engine-config-direct/script
similarity index 100%
rename from acceptance/bundle/migrate/engine-config-direct/script
rename to acceptance/bundle/migrate/command/engine-config-direct/script
diff --git a/acceptance/bundle/migrate/command/engine-config-direct/test.toml b/acceptance/bundle/migrate/command/engine-config-direct/test.toml
new file mode 100644
index 00000000000..a030353d571
--- /dev/null
+++ b/acceptance/bundle/migrate/command/engine-config-direct/test.toml
@@ -0,0 +1 @@
+RecordRequests = false
diff --git a/acceptance/bundle/migrate/engine-config-terraform/databricks.yml b/acceptance/bundle/migrate/command/engine-config-terraform/databricks.yml
similarity index 100%
rename from acceptance/bundle/migrate/engine-config-terraform/databricks.yml
rename to acceptance/bundle/migrate/command/engine-config-terraform/databricks.yml
diff --git a/acceptance/bundle/migrate/command/engine-config-terraform/out.test.toml b/acceptance/bundle/migrate/command/engine-config-terraform/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/command/engine-config-terraform/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/command/engine-config-terraform/output.txt b/acceptance/bundle/migrate/command/engine-config-terraform/output.txt
new file mode 100644
index 00000000000..e2456dba2d6
--- /dev/null
+++ b/acceptance/bundle/migrate/command/engine-config-terraform/output.txt
@@ -0,0 +1,8 @@
+
+>>> musterr [CLI] bundle deployment migrate
+Error: the Terraform deployment engine has been removed in Databricks CLI v1.20.0
+  in databricks.yml:3:11
+
+Remove the "bundle.engine" setting (or set it to "direct") to deploy with the direct engine; existing Terraform state is migrated automatically. To keep using Terraform, revert to Databricks CLI v1.19.x.
+See https://docs.databricks.com/dev-tools/bundles/direct for details
+
diff --git a/acceptance/bundle/migrate/engine-config-terraform/script b/acceptance/bundle/migrate/command/engine-config-terraform/script
similarity index 100%
rename from acceptance/bundle/migrate/engine-config-terraform/script
rename to acceptance/bundle/migrate/command/engine-config-terraform/script
diff --git a/acceptance/bundle/migrate/command/engine-config-terraform/test.toml b/acceptance/bundle/migrate/command/engine-config-terraform/test.toml
new file mode 100644
index 00000000000..a030353d571
--- /dev/null
+++ b/acceptance/bundle/migrate/command/engine-config-terraform/test.toml
@@ -0,0 +1 @@
+RecordRequests = false
diff --git a/acceptance/bundle/migrate/grants/databricks.yml b/acceptance/bundle/migrate/command/grants/databricks.yml
similarity index 100%
rename from acceptance/bundle/migrate/grants/databricks.yml
rename to acceptance/bundle/migrate/command/grants/databricks.yml
diff --git a/acceptance/bundle/migrate/command/grants/out.new_state.json b/acceptance/bundle/migrate/command/grants/out.new_state.json
new file mode 100644
index 00000000000..82b918f76d3
--- /dev/null
+++ b/acceptance/bundle/migrate/command/grants/out.new_state.json
@@ -0,0 +1,110 @@
+{
+ "state_version": 3,
+ "cli_version": "[CLI_VERSION]",
+ "lineage": "[UUID]",
+ "serial": 9,
+ "state": {
+  "resources.registered_models.my_registered_model": {
+   "__id__": "main.schema_grants.mymodel",
+   "state": {
+    "catalog_name": "main",
+    "comment": "mycomment",
+    "name": "mymodel",
+    "schema_name": "schema_grants"
+   },
+   "depends_on": [
+    {
+     "node": "resources.schemas.my_schema",
+     "label": "${resources.schemas.my_schema.name}"
+    }
+   ]
+  },
+  "resources.registered_models.my_registered_model.grants": {
+   "__id__": "function/main.schema_grants.mymodel",
+   "state": {
+    "securable_type": "function",
+    "full_name": "main.schema_grants.mymodel",
+    "__embed__": [
+     {
+      "principal": "deco-test-user@databricks.com",
+      "privileges": [
+       "APPLY_TAG"
+      ]
+     }
+    ]
+   },
+   "depends_on": [
+    {
+     "node": "resources.registered_models.my_registered_model",
+     "label": "${resources.registered_models.my_registered_model.id}"
+    }
+   ]
+  },
+  "resources.schemas.my_schema": {
+   "__id__": "main.schema_grants",
+   "state": {
+    "catalog_name": "main",
+    "name": "schema_grants"
+   }
+  },
+  "resources.schemas.my_schema.grants": {
+   "__id__": "schema/main.schema_grants",
+   "state": {
+    "securable_type": "schema",
+    "full_name": "main.schema_grants",
+    "__embed__": [
+     {
+      "principal": "deco-test-user@databricks.com",
+      "privileges": [
+       "CREATE_TABLE",
+       "USE_SCHEMA"
+      ]
+     }
+    ]
+   },
+   "depends_on": [
+    {
+     "node": "resources.schemas.my_schema",
+     "label": "${resources.schemas.my_schema.id}"
+    }
+   ]
+  },
+  "resources.volumes.my_volume": {
+   "__id__": "main.schema_grants.volume_name",
+   "state": {
+    "catalog_name": "main",
+    "name": "volume_name",
+    "schema_name": "schema_grants",
+    "volume_type": "MANAGED"
+   },
+   "depends_on": [
+    {
+     "node": "resources.schemas.my_schema",
+     "label": "${resources.schemas.my_schema.name}"
+    }
+   ]
+  },
+  "resources.volumes.my_volume.grants": {
+   "__id__": "volume/main.schema_grants.volume_name",
+   "state": {
+    "securable_type": "volume",
+    "full_name": "main.schema_grants.volume_name",
+    "__embed__": [
+     {
+      "principal": "deco-test-user@databricks.com",
+      "privileges": [
+       "READ_VOLUME",
+       "WRITE_VOLUME"
+      ]
+     }
+    ]
+   },
+   "depends_on": [
+    {
+     "node": "resources.volumes.my_volume",
+     "label": "${resources.volumes.my_volume.id}"
+    }
+   ]
+  }
+ }
+}
diff --git a/acceptance/bundle/migrate/command/grants/out.original_state.json b/acceptance/bundle/migrate/command/grants/out.original_state.json
new file mode 100644
index 00000000000..b83be57aff1
--- /dev/null
+++ b/acceptance/bundle/migrate/command/grants/out.original_state.json
@@ -0,0 +1,265 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 7,
+  "lineage": "[UUID]",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_grants",
+      "name": "registered_model_my_registered_model",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "catalog": null,
+            "credential": null,
+            "external_location": null,
+            "foreign_connection": null,
+            "function": "main.schema_grants.mymodel",
+            "grant": [
+              {
+                "principal": "deco-test-user@databricks.com",
+                "privileges": [
+                  "APPLY_TAG"
+                ]
+              }
+            ],
+            "id": "function/main.schema_grants.mymodel",
+            "mcp_service": null,
+            "metastore": null,
+            "model": null,
+            "model_provider_service": null,
+            "model_service": null,
+            "pipeline": null,
+            "provider_config": [
+              {
+                "workspace_id": "[WORKSPACE_ID]"
+              }
+            ],
+            "recipient": null,
+            "schema": null,
+            "secret": null,
+            "share": null,
+            "storage_credential": null,
+            "table": null,
+            "volume": null
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "databricks_registered_model.my_registered_model",
+            "databricks_schema.my_schema"
+          ]
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_grants",
+      "name": "schema_my_schema",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "catalog": null,
+            "credential": null,
+            "external_location": null,
+            "foreign_connection": null,
+            "function": null,
+            "grant": [
+              {
+                "principal": "deco-test-user@databricks.com",
+                "privileges": [
+                  "CREATE_TABLE",
+                  "USE_SCHEMA"
+                ]
+              }
+            ],
+            "id": "schema/main.schema_grants",
+            "mcp_service": null,
+            "metastore": null,
+            "model": null,
+            "model_provider_service": null,
+            "model_service": null,
+            "pipeline": null,
+            "provider_config": [
+              {
+                "workspace_id": "[WORKSPACE_ID]"
+              }
+            ],
+            "recipient": null,
+            "schema": "main.schema_grants",
+            "secret": null,
+            "share": null,
+            "storage_credential": null,
+            "table": null,
+            "volume": null
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "databricks_schema.my_schema"
+          ]
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_grants",
+      "name": "volume_my_volume",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "catalog": null,
+            "credential": null,
+            "external_location": null,
+            "foreign_connection": null,
+            "function": null,
+            "grant": [
+              {
+                "principal": "deco-test-user@databricks.com",
+                "privileges": [
+                  "READ_VOLUME",
+                  "WRITE_VOLUME"
+                ]
+              }
+            ],
+            "id": "volume/main.schema_grants.volume_name",
+            "mcp_service": null,
+            "metastore": null,
+            "model": null,
+            "model_provider_service": null,
+            "model_service": null,
+            "pipeline": null,
+            "provider_config": [
+              {
+                "workspace_id": "[WORKSPACE_ID]"
+              }
+            ],
+            "recipient": null,
+            "schema": null,
+            "secret": null,
+            "share": null,
+            "storage_credential": null,
+            "table": null,
+            "volume": "main.schema_grants.volume_name"
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "databricks_schema.my_schema",
+            "databricks_volume.my_volume"
+          ]
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_registered_model",
+      "name": "my_registered_model",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "aliases": [],
+            "browse_only": false,
+            "catalog_name": "main",
+            "comment": "mycomment",
+            "created_at": [UNIX_TIME_MILLIS][0],
+            "created_by": "[USERNAME]",
+            "full_name": "main.schema_grants.mymodel",
+            "id": "main.schema_grants.mymodel",
+            "metastore_id": "[UUID]",
+            "name": "mymodel",
+            "owner": "[USERNAME]",
+            "provider_config": [
+              {
+                "workspace_id": "[WORKSPACE_ID]"
+              }
+            ],
+            "schema_name": "schema_grants",
+            "storage_location": null,
+            "updated_at": [UNIX_TIME_MILLIS][0],
+            "updated_by": "[USERNAME]"
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "databricks_schema.my_schema"
+          ]
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_schema",
+      "name": "my_schema",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "catalog_name": "main",
+            "comment": null,
+            "enable_predictive_optimization": "INHERIT",
+            "force_destroy": true,
+            "id": "main.schema_grants",
+            "metastore_id": "[UUID]",
+            "name": "schema_grants",
+            "owner": "[USERNAME]",
+            "properties": null,
+            "provider_config": [
+              {
+                "workspace_id": "[WORKSPACE_ID]"
+              }
+            ],
+            "schema_id": "[UUID]",
+            "storage_root": null
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA=="
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_volume",
+      "name": "my_volume",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "catalog_name": "main",
+            "comment": null,
+            "id": "main.schema_grants.volume_name",
+            "name": "volume_name",
+            "owner": "[USERNAME]",
+            "provider_config": [
+              {
+                "workspace_id": "[WORKSPACE_ID]"
+              }
+            ],
+            "schema_name": "schema_grants",
+            "storage_location": "s3://[METASTORE_NAME]/metastore/[UUID]/volumes/[UUID]",
+            "volume_path": "/Volumes/main/schema_grants/volume_name",
+            "volume_type": "MANAGED"
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "databricks_schema.my_schema"
+          ]
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/command/grants/out.test.toml b/acceptance/bundle/migrate/command/grants/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/command/grants/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/command/grants/output.txt b/acceptance/bundle/migrate/command/grants/output.txt
new file mode 100644
index 00000000000..bd4d8df3fa5
--- /dev/null
+++ b/acceptance/bundle/migrate/command/grants/output.txt
@@ -0,0 +1,39 @@
+
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate
+
+>>> [CLI] bundle deployment migrate
+Success! Migrated 6 resources to direct engine state file: [TEST_TMP_DIR]/.databricks/bundle/default/resources.json
+
+Validate the migration by running "databricks bundle plan", there should be no actions planned.
+
+The state file is not synchronized to the workspace yet. To do that and finalize the migration, run "bundle deploy".
+
+To undo the migration, remove [TEST_TMP_DIR]/.databricks/bundle/default/resources.json and rename [TEST_TMP_DIR]/.databricks/bundle/default/terraform/terraform.tfstate.backup to [TEST_TMP_DIR]/.databricks/bundle/default/terraform/terraform.tfstate
+
+
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 6 unchanged
+
+>>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 6 unchanged
+
+>>> print_requests.py --get //unity-catalog/permissions
+
+>>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 6 unchanged
+
+>>> print_requests.py --get //unity-catalog/permissions
+
+=== Should show that it's already migrated
+>>> musterr [CLI] bundle deployment migrate
+Error: already using direct engine
+Details: [TEST_TMP_DIR]/.databricks/bundle/default/resources.json: local direct state serial=9 lineage="[UUID]"
+
+>>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle debug states
+[TEST_TMP_DIR]/.databricks/bundle/default/resources.json: local direct state serial=9 lineage="[UUID]"
+
+>>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle debug states --force-pull
+resources.json: remote direct state serial=9 lineage="[UUID]"
+[TEST_TMP_DIR]/.databricks/bundle/default/resources.json: local direct state serial=9 lineage="[UUID]"
diff --git a/acceptance/bundle/migrate/command/grants/script b/acceptance/bundle/migrate/command/grants/script
new file mode 100755
index 00000000000..153af1a1aa9
--- /dev/null
+++ b/acceptance/bundle/migrate/command/grants/script
@@ -0,0 +1,24 @@
+export DATABRICKS_BUNDLE_ENGINE=
+# Replay a prior terraform deployment (captured from a real terraform run)
+trace replay_tfstate.py terraform-requests.json terraform.tfstate
+print_state.py > out.original_state.json
+
+trace $CLI bundle deployment migrate 2>&1 | contains.py 'Migrated 6 resources'
+print_state.py > out.new_state.json
+
+
+rm "$OUT_REQUESTS"
+# Both DATABRICKS_BUNDLE_ENGINE=direct and DATABRICKS_BUNDLE_ENGINE= work
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle plan | contains.py "6 unchanged"
+trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle plan | contains.py "6 unchanged"
+trace print_requests.py --get //unity-catalog/permissions | contains.py 'engine/direct' > /dev/null
+
+trace DATABRICKS_BUNDLE_ENGINE="" $CLI bundle deploy
+trace print_requests.py --get //unity-catalog/permissions | jq '.headers["User-Agent"][0]' | contains.py 'engine/direct' > LOG.requests_deploy.txt
+
+title "Should show that it's already migrated"
+trace musterr $CLI bundle deployment migrate
+trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle debug states
+trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle debug states --force-pull
+
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/migrate/command/grants/terraform-requests.json b/acceptance/bundle/migrate/command/grants/terraform-requests.json
new file mode 100644
index 00000000000..49a06507ed8
--- /dev/null
+++ b/acceptance/bundle/migrate/command/grants/terraform-requests.json
@@ -0,0 +1,74 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.1/unity-catalog/schemas",
+    "body": {
+      "catalog_name": "main",
+      "name": "schema_grants"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.1/unity-catalog/volumes",
+    "body": {
+      "catalog_name": "main",
+      "name": "volume_name",
+      "schema_name": "schema_grants",
+      "volume_type": "MANAGED"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.1/unity-catalog/models",
+    "body": {
+      "catalog_name": "main",
+      "comment": "mycomment",
+      "name": "mymodel",
+      "schema_name": "schema_grants"
+    }
+  },
+  {
+    "method": "PATCH",
+    "path": "/api/2.1/unity-catalog/permissions/schema/main.schema_grants",
+    "body": {
+      "changes": [
+        {
+          "add": [
+            "CREATE_TABLE",
+            "USE_SCHEMA"
+          ],
+          "principal": "deco-test-user@databricks.com"
+        }
+      ]
+    }
+  },
+  {
+    "method": "PATCH",
+    "path": "/api/2.1/unity-catalog/permissions/volume/main.schema_grants.volume_name",
+    "body": {
+      "changes": [
+        {
+          "add": [
+            "READ_VOLUME",
+            "WRITE_VOLUME"
+          ],
+          "principal": "deco-test-user@databricks.com"
+        }
+      ]
+    }
+  },
+  {
+    "method": "PATCH",
+    "path": "/api/2.1/unity-catalog/permissions/function/main.schema_grants.mymodel",
+    "body": {
+      "changes": [
+        {
+          "add": [
+            "APPLY_TAG"
+          ],
+          "principal": "deco-test-user@databricks.com"
+        }
+      ]
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/command/grants/terraform.tfstate b/acceptance/bundle/migrate/command/grants/terraform.tfstate
new file mode 100644
index 00000000000..14b1d3ed46f
--- /dev/null
+++ b/acceptance/bundle/migrate/command/grants/terraform.tfstate
@@ -0,0 +1,265 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 7,
+  "lineage": "fbb98d27-f582-d0ce-a226-c73269dcf1ea",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_grants",
+      "name": "registered_model_my_registered_model",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "catalog": null,
+            "credential": null,
+            "external_location": null,
+            "foreign_connection": null,
+            "function": "main.schema_grants.mymodel",
+            "grant": [
+              {
+                "principal": "deco-test-user@databricks.com",
+                "privileges": [
+                  "APPLY_TAG"
+                ]
+              }
+            ],
+            "id": "function/main.schema_grants.mymodel",
+            "mcp_service": null,
+            "metastore": null,
+            "model": null,
+            "model_provider_service": null,
+            "model_service": null,
+            "pipeline": null,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "recipient": null,
+            "schema": null,
+            "secret": null,
+            "share": null,
+            "storage_credential": null,
+            "table": null,
+            "volume": null
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "databricks_registered_model.my_registered_model",
+            "databricks_schema.my_schema"
+          ]
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_grants",
+      "name": "schema_my_schema",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "catalog": null,
+            "credential": null,
+            "external_location": null,
+            "foreign_connection": null,
+            "function": null,
+            "grant": [
+              {
+                "principal": "deco-test-user@databricks.com",
+                "privileges": [
+                  "CREATE_TABLE",
+                  "USE_SCHEMA"
+                ]
+              }
+            ],
+            "id": "schema/main.schema_grants",
+            "mcp_service": null,
+            "metastore": null,
+            "model": null,
+            "model_provider_service": null,
+            "model_service": null,
+            "pipeline": null,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "recipient": null,
+            "schema": "main.schema_grants",
+            "secret": null,
+            "share": null,
+            "storage_credential": null,
+            "table": null,
+            "volume": null
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "databricks_schema.my_schema"
+          ]
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_grants",
+      "name": "volume_my_volume",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "catalog": null,
+            "credential": null,
+            "external_location": null,
+            "foreign_connection": null,
+            "function": null,
+            "grant": [
+              {
+                "principal": "deco-test-user@databricks.com",
+                "privileges": [
+                  "READ_VOLUME",
+                  "WRITE_VOLUME"
+                ]
+              }
+            ],
+            "id": "volume/main.schema_grants.volume_name",
+            "mcp_service": null,
+            "metastore": null,
+            "model": null,
+            "model_provider_service": null,
+            "model_service": null,
+            "pipeline": null,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "recipient": null,
+            "schema": null,
+            "secret": null,
+            "share": null,
+            "storage_credential": null,
+            "table": null,
+            "volume": "main.schema_grants.volume_name"
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "databricks_schema.my_schema",
+            "databricks_volume.my_volume"
+          ]
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_registered_model",
+      "name": "my_registered_model",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "aliases": [],
+            "browse_only": false,
+            "catalog_name": "main",
+            "comment": "mycomment",
+            "created_at": 1790614172511,
+            "created_by": "tester@databricks.com",
+            "full_name": "main.schema_grants.mymodel",
+            "id": "main.schema_grants.mymodel",
+            "metastore_id": "79fe8903-e604-bbe0-79fe-8903e604bfc8",
+            "name": "mymodel",
+            "owner": "tester@databricks.com",
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "schema_name": "schema_grants",
+            "storage_location": null,
+            "updated_at": 1790614172511,
+            "updated_by": "tester@databricks.com"
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "databricks_schema.my_schema"
+          ]
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_schema",
+      "name": "my_schema",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "catalog_name": "main",
+            "comment": null,
+            "enable_predictive_optimization": "INHERIT",
+            "force_destroy": true,
+            "id": "main.schema_grants",
+            "metastore_id": "120efa64-9b68-46ba-be38-f319458430d2",
+            "name": "schema_grants",
+            "owner": "tester@databricks.com",
+            "properties": null,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "schema_id": "79fe8903-e536-c938-79fe-8903e536c939",
+            "storage_root": null
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA=="
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_volume",
+      "name": "my_volume",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "catalog_name": "main",
+            "comment": null,
+            "id": "main.schema_grants.volume_name",
+            "name": "volume_name",
+            "owner": "tester@databricks.com",
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "schema_name": "schema_grants",
+            "storage_location": "s3://deco-uc-prod-isolated-aws-us-east-1/metastore/120efa64-9b68-46ba-be38-f319458430d2/volumes/79fe8903-e5fc-b918-79fe-8903e5fcbd00",
+            "volume_path": "/Volumes/main/schema_grants/volume_name",
+            "volume_type": "MANAGED"
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "databricks_schema.my_schema"
+          ]
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/permissions/databricks.yml b/acceptance/bundle/migrate/command/permissions/databricks.yml
similarity index 100%
rename from acceptance/bundle/migrate/permissions/databricks.yml
rename to acceptance/bundle/migrate/command/permissions/databricks.yml
diff --git a/acceptance/bundle/migrate/permissions/notebook.py b/acceptance/bundle/migrate/command/permissions/notebook.py
similarity index 100%
rename from acceptance/bundle/migrate/permissions/notebook.py
rename to acceptance/bundle/migrate/command/permissions/notebook.py
diff --git a/acceptance/bundle/migrate/command/permissions/out.new_state.json b/acceptance/bundle/migrate/command/permissions/out.new_state.json
new file mode 100644
index 00000000000..a2545a07093
--- /dev/null
+++ b/acceptance/bundle/migrate/command/permissions/out.new_state.json
@@ -0,0 +1,95 @@
+{
+ "state_version": 3,
+ "cli_version": "[CLI_VERSION]",
+ "lineage": "[UUID]",
+ "serial": 7,
+ "state": {
+  "resources.jobs.test_job": {
+   "__id__": "[TEST_JOB_ID]",
+   "state": {
+    "deployment": {
+     "kind": "BUNDLE",
+     "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/default/state/metadata.json"
+    },
+    "edit_mode": "UI_LOCKED",
+    "format": "MULTI_TASK",
+    "max_concurrent_runs": 1,
+    "name": "Test Migration Job",
+    "queue": {
+     "enabled": true
+    },
+    "tasks": [
+     {
+      "notebook_task": {
+       "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/default/files/notebook"
+      },
+      "task_key": "main"
+     }
+    ]
+   }
+  },
+  "resources.jobs.test_job.permissions": {
+   "__id__": "/jobs/[TEST_JOB_ID]",
+   "state": {
+    "object_id": "/jobs/[TEST_JOB_ID]",
+    "__embed__": [
+     {
+      "level": "CAN_VIEW",
+      "user_name": "viewer@databricks.com"
+     },
+     {
+      "level": "IS_OWNER",
+      "user_name": "[USERNAME]"
+     }
+    ]
+   },
+   "depends_on": [
+    {
+     "node": "resources.jobs.test_job",
+     "label": "${resources.jobs.test_job.id}"
+    }
+   ]
+  },
+  "resources.pipelines.test_pipeline": {
+   "__id__": "[UUID]",
+   "state": {
+    "channel": "CURRENT",
+    "deployment": {
+     "kind": "BUNDLE",
+     "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/default/state/metadata.json"
+    },
+    "edition": "ADVANCED",
+    "libraries": [
+     {
+      "notebook": {
+       "path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/default/files/pipeline"
+      }
+     }
+    ],
+    "name": "Test Migration Pipeline"
+   }
+  },
+  "resources.pipelines.test_pipeline.permissions": {
+   "__id__": "/pipelines/[UUID]",
+   "state": {
+    "object_id": "/pipelines/[UUID]",
+    "__embed__": [
+     {
+      "level": "CAN_MANAGE",
+      "user_name": "manager@databricks.com"
+     },
+     {
+      "level": "IS_OWNER",
+      "user_name": "[USERNAME]"
+     }
+    ]
+   },
+   "depends_on": [
+    {
+     "node": "resources.pipelines.test_pipeline",
+     "label": "${resources.pipelines.test_pipeline.id}"
+    }
+   ]
+  }
+ }
+}
diff --git a/acceptance/bundle/migrate/command/permissions/out.original_state.json b/acceptance/bundle/migrate/command/permissions/out.original_state.json
new file mode 100644
index 00000000000..e127e33e07b
--- /dev/null
+++ b/acceptance/bundle/migrate/command/permissions/out.original_state.json
@@ -0,0 +1,387 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 5,
+  "lineage": "[UUID]",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "test_job",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "[TEST_JOB_ID]",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "Test Migration Job",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "[WORKSPACE_ID]"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "[USERNAME]"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [
+              {
+                "ai_runtime_task": [],
+                "alert_task": [],
+                "clean_rooms_notebook_task": [],
+                "compute": [],
+                "condition_task": [],
+                "dashboard_task": [],
+                "dbt_cloud_task": [],
+                "dbt_platform_task": [],
+                "dbt_task": [],
+                "depends_on": [],
+                "description": "",
+                "disable_auto_optimization": false,
+                "disabled": false,
+                "email_notifications": [
+                  {
+                    "no_alert_for_skipped_runs": false,
+                    "on_duration_warning_threshold_exceeded": [],
+                    "on_failure": [],
+                    "on_start": [],
+                    "on_streaming_backlog_exceeded": [],
+                    "on_success": []
+                  }
+                ],
+                "environment_key": "",
+                "existing_cluster_id": "",
+                "for_each_task": [],
+                "gen_ai_compute_task": [],
+                "health": [],
+                "job_cluster_key": "",
+                "library": [],
+                "max_retries": 0,
+                "min_retry_interval_millis": 0,
+                "new_cluster": [],
+                "notebook_task": [
+                  {
+                    "base_parameters": null,
+                    "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/default/files/notebook",
+                    "source": "WORKSPACE",
+                    "warehouse_id": ""
+                  }
+                ],
+                "notification_settings": [],
+                "pipeline_task": [],
+                "power_bi_task": [],
+                "python_operator_task": [],
+                "python_wheel_task": [],
+                "retry_on_timeout": false,
+                "run_if": "ALL_SUCCESS",
+                "run_job_task": [],
+                "spark_jar_task": [],
+                "spark_python_task": [],
+                "spark_submit_task": [],
+                "sql_task": [],
+                "task_key": "main",
+                "timeout_seconds": 0,
+                "webhook_notifications": []
+              }
+            ],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/[TEST_JOB_ID]",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_permissions",
+      "name": "job_test_job",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "access_control": [
+              {
+                "group_name": "",
+                "permission_level": "CAN_VIEW",
+                "service_principal_name": "",
+                "user_name": "viewer@databricks.com"
+              },
+              {
+                "group_name": "",
+                "permission_level": "IS_OWNER",
+                "service_principal_name": "",
+                "user_name": "[USERNAME]"
+              }
+            ],
+            "alert_v2_id": null,
+            "app_name": null,
+            "authorization": null,
+            "cluster_id": null,
+            "cluster_policy_id": null,
+            "dashboard_id": null,
+            "database_instance_name": null,
+            "database_project_name": null,
+            "directory_id": null,
+            "directory_path": null,
+            "experiment_id": null,
+            "id": "/jobs/[TEST_JOB_ID]",
+            "instance_pool_id": null,
+            "job_id": "[TEST_JOB_ID]",
+            "knowledge_assistant_id": null,
+            "notebook_id": null,
+            "notebook_path": null,
+            "object_type": "job",
+            "pipeline_id": null,
+            "provider_config": [
+              {
+                "workspace_id": "[WORKSPACE_ID]"
+              }
+            ],
+            "registered_model_id": null,
+            "repo_id": null,
+            "repo_path": null,
+            "serving_endpoint_id": null,
+            "sql_alert_id": null,
+            "sql_dashboard_id": null,
+            "sql_endpoint_id": null,
+            "sql_query_id": null,
+            "supervisor_agent_id": null,
+            "vector_search_endpoint_id": null,
+            "workspace_file_id": null,
+            "workspace_file_path": null
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "databricks_job.test_job"
+          ]
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_permissions",
+      "name": "pipeline_test_pipeline",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "access_control": [
+              {
+                "group_name": "",
+                "permission_level": "CAN_MANAGE",
+                "service_principal_name": "",
+                "user_name": "manager@databricks.com"
+              },
+              {
+                "group_name": "",
+                "permission_level": "IS_OWNER",
+                "service_principal_name": "",
+                "user_name": "[USERNAME]"
+              }
+            ],
+            "alert_v2_id": null,
+            "app_name": null,
+            "authorization": null,
+            "cluster_id": null,
+            "cluster_policy_id": null,
+            "dashboard_id": null,
+            "database_instance_name": null,
+            "database_project_name": null,
+            "directory_id": null,
+            "directory_path": null,
+            "experiment_id": null,
+            "id": "/pipelines/[UUID]",
+            "instance_pool_id": null,
+            "job_id": null,
+            "knowledge_assistant_id": null,
+            "notebook_id": null,
+            "notebook_path": null,
+            "object_type": "pipelines",
+            "pipeline_id": "[UUID]",
+            "provider_config": [
+              {
+                "workspace_id": "[WORKSPACE_ID]"
+              }
+            ],
+            "registered_model_id": null,
+            "repo_id": null,
+            "repo_path": null,
+            "serving_endpoint_id": null,
+            "sql_alert_id": null,
+            "sql_dashboard_id": null,
+            "sql_endpoint_id": null,
+            "sql_query_id": null,
+            "supervisor_agent_id": null,
+            "vector_search_endpoint_id": null,
+            "workspace_file_id": null,
+            "workspace_file_path": null
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "databricks_pipeline.test_pipeline"
+          ]
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_pipeline",
+      "name": "test_pipeline",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "allow_duplicate_names": false,
+            "budget_policy_id": null,
+            "catalog": null,
+            "cause": null,
+            "channel": "CURRENT",
+            "cluster": [],
+            "cluster_id": null,
+            "configuration": null,
+            "continuous": false,
+            "creator_user_name": "[USERNAME]",
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "development": false,
+            "edition": "ADVANCED",
+            "environment": [],
+            "event_log": [],
+            "expected_last_modified": 0,
+            "filters": [],
+            "gateway_definition": [],
+            "health": null,
+            "id": "[UUID]",
+            "ingestion_definition": [],
+            "last_modified": [UNIX_TIME_MILLIS],
+            "latest_updates": null,
+            "library": [
+              {
+                "file": [],
+                "glob": [],
+                "jar": "",
+                "maven": [],
+                "notebook": [
+                  {
+                    "path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/default/files/pipeline"
+                  }
+                ],
+                "whl": ""
+              }
+            ],
+            "name": "Test Migration Pipeline",
+            "notification": [],
+            "photon": false,
+            "provider_config": [
+              {
+                "workspace_id": "[WORKSPACE_ID]"
+              }
+            ],
+            "restart_window": [],
+            "root_path": null,
+            "run_as": [],
+            "run_as_user_name": "[USERNAME]",
+            "schema": null,
+            "serverless": false,
+            "serverless_compute_id": null,
+            "state": "IDLE",
+            "storage": "dbfs:/pipelines/[UUID]",
+            "tags": null,
+            "target": null,
+            "timeouts": null,
+            "trigger": [],
+            "url": "[DATABRICKS_URL]/#joblist/pipelines/[UUID]",
+            "usage_policy_id": null
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxMjAwMDAwMDAwMDAwLCJkZWZhdWx0IjoxMjAwMDAwMDAwMDAwLCJkZWxldGUiOjEyMDAwMDAwMDAwMDAsInJlYWQiOjEyMDAwMDAwMDAwMDAsInVwZGF0ZSI6MTIwMDAwMDAwMDAwMH19"
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/command/permissions/out.test.toml b/acceptance/bundle/migrate/command/permissions/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/command/permissions/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/command/permissions/output.txt b/acceptance/bundle/migrate/command/permissions/output.txt
new file mode 100644
index 00000000000..9ce27830d1b
--- /dev/null
+++ b/acceptance/bundle/migrate/command/permissions/output.txt
@@ -0,0 +1,65 @@
+
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate
+
+>>> [CLI] bundle deployment migrate
+Success! Migrated 4 resources to direct engine state file: [TEST_TMP_DIR]/.databricks/bundle/default/resources.json
+
+Validate the migration by running "databricks bundle plan", there should be no actions planned.
+
+The state file is not synchronized to the workspace yet. To do that and finalize the migration, run "bundle deploy".
+
+To undo the migration, remove [TEST_TMP_DIR]/.databricks/bundle/default/resources.json and rename [TEST_TMP_DIR]/.databricks/bundle/default/terraform/terraform.tfstate.backup to [TEST_TMP_DIR]/.databricks/bundle/default/terraform/terraform.tfstate
+
+
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 4 unchanged
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 4 unchanged
+
+>>> print_requests.py --get //jobs/get
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none engine/direct lineage/DIsgyJN5V5G auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.2/jobs/get",
+  "q": {
+    "job_id": "[TEST_JOB_ID]"
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none engine/direct lineage/DIsgyJN5V5G auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.2/jobs/get",
+  "q": {
+    "job_id": "[TEST_JOB_ID]"
+  }
+}
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/default/files...
+Files: 3 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 4 unchanged
+
+>>> print_requests.py --get //jobs/get
+"cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct lineage/DIsgyJN5V5G auth/pat"
+"cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct lineage/DIsgyJN5V5G auth/pat"
+
+=== Should show that it's already migrated
+>>> musterr [CLI] bundle deployment migrate
+Error: already using direct engine
+Details: [TEST_TMP_DIR]/.databricks/bundle/default/resources.json: local direct state serial=7 lineage="[UUID]"
+
+>>> [CLI] bundle debug states
+[TEST_TMP_DIR]/.databricks/bundle/default/resources.json: local direct state serial=7 lineage="[UUID]"
+
+>>> [CLI] bundle debug states --force-pull
+resources.json: remote direct state serial=7 lineage="[UUID]"
+[TEST_TMP_DIR]/.databricks/bundle/default/resources.json: local direct state serial=7 lineage="[UUID]"
diff --git a/acceptance/bundle/migrate/permissions/pipeline.py b/acceptance/bundle/migrate/command/permissions/pipeline.py
similarity index 100%
rename from acceptance/bundle/migrate/permissions/pipeline.py
rename to acceptance/bundle/migrate/command/permissions/pipeline.py
diff --git a/acceptance/bundle/migrate/command/permissions/script b/acceptance/bundle/migrate/command/permissions/script
new file mode 100755
index 00000000000..8877d0da7d3
--- /dev/null
+++ b/acceptance/bundle/migrate/command/permissions/script
@@ -0,0 +1,28 @@
+# Replay the terraform deploy's resource requests (captured once from a real terraform run) so the
+# backend holds the same terraform-shaped resources, and drop in the captured terraform.tfstate;
+# this stands in for `DATABRICKS_BUNDLE_ENGINE=terraform bundle deploy` now that migrate tests must
+# not deploy with terraform.
+trace replay_tfstate.py terraform-requests.json terraform.tfstate
+read_id.py test_job > /dev/null
+print_state.py > out.original_state.json
+
+trace $CLI bundle deployment migrate 2>&1 | contains.py 'Migrated 4 resources'
+print_state.py > out.new_state.json
+
+export DATABRICKS_BUNDLE_ENGINE=
+
+rm "$OUT_REQUESTS"
+# Both DATABRICKS_BUNDLE_ENGINE=direct and DATABRICKS_BUNDLE_ENGINE= work
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle plan | contains.py "4 unchanged"
+trace $CLI bundle plan | contains.py "4 unchanged"
+trace print_requests.py --get //jobs/get | contains.py 'engine/direct'
+
+trace $CLI bundle deploy
+trace print_requests.py --get //jobs/get | jq '.headers["User-Agent"][0]' | contains.py 'engine/direct'
+
+title "Should show that it's already migrated"
+trace musterr $CLI bundle deployment migrate
+trace $CLI bundle debug states
+trace $CLI bundle debug states --force-pull
+
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/migrate/command/permissions/terraform-requests.json b/acceptance/bundle/migrate/command/permissions/terraform-requests.json
new file mode 100644
index 00000000000..a8894d9f79a
--- /dev/null
+++ b/acceptance/bundle/migrate/command/permissions/terraform-requests.json
@@ -0,0 +1,80 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.0/pipelines",
+    "body": {
+      "channel": "CURRENT",
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-basic-test/default/state/metadata.json"
+      },
+      "edition": "ADVANCED",
+      "libraries": [
+        {
+          "notebook": {
+            "path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-basic-test/default/files/pipeline"
+          }
+        }
+      ],
+      "name": "Test Migration Pipeline"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-basic-test/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "Test Migration Job",
+      "queue": {
+        "enabled": true
+      },
+      "tasks": [
+        {
+          "notebook_task": {
+            "notebook_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-basic-test/default/files/notebook",
+            "source": "WORKSPACE"
+          },
+          "task_key": "main"
+        }
+      ]
+    }
+  },
+  {
+    "method": "PUT",
+    "path": "/api/2.0/permissions/pipelines/79fe85ff-42ab-b5b8-79fe-85ff42abb5b9",
+    "body": {
+      "access_control_list": [
+        {
+          "permission_level": "CAN_MANAGE",
+          "user_name": "manager@databricks.com"
+        },
+        {
+          "permission_level": "IS_OWNER",
+          "user_name": "tester@databricks.com"
+        }
+      ]
+    }
+  },
+  {
+    "method": "PUT",
+    "path": "/api/2.0/permissions/jobs/8790610854067598000",
+    "body": {
+      "access_control_list": [
+        {
+          "permission_level": "CAN_VIEW",
+          "user_name": "viewer@databricks.com"
+        },
+        {
+          "permission_level": "IS_OWNER",
+          "user_name": "tester@databricks.com"
+        }
+      ]
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/command/permissions/terraform.tfstate b/acceptance/bundle/migrate/command/permissions/terraform.tfstate
new file mode 100644
index 00000000000..a1561224071
--- /dev/null
+++ b/acceptance/bundle/migrate/command/permissions/terraform.tfstate
@@ -0,0 +1,387 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 5,
+  "lineage": "a0fc6106-3686-738c-7a93-06c0a226574f",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "test_job",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-basic-test/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790610854067598000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "Test Migration Job",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [
+              {
+                "ai_runtime_task": [],
+                "alert_task": [],
+                "clean_rooms_notebook_task": [],
+                "compute": [],
+                "condition_task": [],
+                "dashboard_task": [],
+                "dbt_cloud_task": [],
+                "dbt_platform_task": [],
+                "dbt_task": [],
+                "depends_on": [],
+                "description": "",
+                "disable_auto_optimization": false,
+                "disabled": false,
+                "email_notifications": [
+                  {
+                    "no_alert_for_skipped_runs": false,
+                    "on_duration_warning_threshold_exceeded": [],
+                    "on_failure": [],
+                    "on_start": [],
+                    "on_streaming_backlog_exceeded": [],
+                    "on_success": []
+                  }
+                ],
+                "environment_key": "",
+                "existing_cluster_id": "",
+                "for_each_task": [],
+                "gen_ai_compute_task": [],
+                "health": [],
+                "job_cluster_key": "",
+                "library": [],
+                "max_retries": 0,
+                "min_retry_interval_millis": 0,
+                "new_cluster": [],
+                "notebook_task": [
+                  {
+                    "base_parameters": null,
+                    "notebook_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-basic-test/default/files/notebook",
+                    "source": "WORKSPACE",
+                    "warehouse_id": ""
+                  }
+                ],
+                "notification_settings": [],
+                "pipeline_task": [],
+                "power_bi_task": [],
+                "python_operator_task": [],
+                "python_wheel_task": [],
+                "retry_on_timeout": false,
+                "run_if": "ALL_SUCCESS",
+                "run_job_task": [],
+                "spark_jar_task": [],
+                "spark_python_task": [],
+                "spark_submit_task": [],
+                "sql_task": [],
+                "task_key": "main",
+                "timeout_seconds": 0,
+                "webhook_notifications": []
+              }
+            ],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790610854067598000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_permissions",
+      "name": "job_test_job",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "access_control": [
+              {
+                "group_name": "",
+                "permission_level": "CAN_VIEW",
+                "service_principal_name": "",
+                "user_name": "viewer@databricks.com"
+              },
+              {
+                "group_name": "",
+                "permission_level": "IS_OWNER",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "alert_v2_id": null,
+            "app_name": null,
+            "authorization": null,
+            "cluster_id": null,
+            "cluster_policy_id": null,
+            "dashboard_id": null,
+            "database_instance_name": null,
+            "database_project_name": null,
+            "directory_id": null,
+            "directory_path": null,
+            "experiment_id": null,
+            "id": "/jobs/8790610854067598000",
+            "instance_pool_id": null,
+            "job_id": "8790610854067598000",
+            "knowledge_assistant_id": null,
+            "notebook_id": null,
+            "notebook_path": null,
+            "object_type": "job",
+            "pipeline_id": null,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "registered_model_id": null,
+            "repo_id": null,
+            "repo_path": null,
+            "serving_endpoint_id": null,
+            "sql_alert_id": null,
+            "sql_dashboard_id": null,
+            "sql_endpoint_id": null,
+            "sql_query_id": null,
+            "supervisor_agent_id": null,
+            "vector_search_endpoint_id": null,
+            "workspace_file_id": null,
+            "workspace_file_path": null
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "databricks_job.test_job"
+          ]
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_permissions",
+      "name": "pipeline_test_pipeline",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "access_control": [
+              {
+                "group_name": "",
+                "permission_level": "CAN_MANAGE",
+                "service_principal_name": "",
+                "user_name": "manager@databricks.com"
+              },
+              {
+                "group_name": "",
+                "permission_level": "IS_OWNER",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "alert_v2_id": null,
+            "app_name": null,
+            "authorization": null,
+            "cluster_id": null,
+            "cluster_policy_id": null,
+            "dashboard_id": null,
+            "database_instance_name": null,
+            "database_project_name": null,
+            "directory_id": null,
+            "directory_path": null,
+            "experiment_id": null,
+            "id": "/pipelines/79fe85ff-42ab-b5b8-79fe-85ff42abb5b9",
+            "instance_pool_id": null,
+            "job_id": null,
+            "knowledge_assistant_id": null,
+            "notebook_id": null,
+            "notebook_path": null,
+            "object_type": "pipelines",
+            "pipeline_id": "79fe85ff-42ab-b5b8-79fe-85ff42abb5b9",
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "registered_model_id": null,
+            "repo_id": null,
+            "repo_path": null,
+            "serving_endpoint_id": null,
+            "sql_alert_id": null,
+            "sql_dashboard_id": null,
+            "sql_endpoint_id": null,
+            "sql_query_id": null,
+            "supervisor_agent_id": null,
+            "vector_search_endpoint_id": null,
+            "workspace_file_id": null,
+            "workspace_file_path": null
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "databricks_pipeline.test_pipeline"
+          ]
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_pipeline",
+      "name": "test_pipeline",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "allow_duplicate_names": false,
+            "budget_policy_id": null,
+            "catalog": null,
+            "cause": null,
+            "channel": "CURRENT",
+            "cluster": [],
+            "cluster_id": null,
+            "configuration": null,
+            "continuous": false,
+            "creator_user_name": "tester@databricks.com",
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-basic-test/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "development": false,
+            "edition": "ADVANCED",
+            "environment": [],
+            "event_log": [],
+            "expected_last_modified": 0,
+            "filters": [],
+            "gateway_definition": [],
+            "health": null,
+            "id": "79fe85ff-42ab-b5b8-79fe-85ff42abb5b9",
+            "ingestion_definition": [],
+            "last_modified": 1790610854055,
+            "latest_updates": null,
+            "library": [
+              {
+                "file": [],
+                "glob": [],
+                "jar": "",
+                "maven": [],
+                "notebook": [
+                  {
+                    "path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-basic-test/default/files/pipeline"
+                  }
+                ],
+                "whl": ""
+              }
+            ],
+            "name": "Test Migration Pipeline",
+            "notification": [],
+            "photon": false,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "restart_window": [],
+            "root_path": null,
+            "run_as": [],
+            "run_as_user_name": "tester@databricks.com",
+            "schema": null,
+            "serverless": false,
+            "serverless_compute_id": null,
+            "state": "IDLE",
+            "storage": "dbfs:/pipelines/79fe85ff-42ab-b5b8-79fe-85ff42abb5b9",
+            "tags": null,
+            "target": null,
+            "timeouts": null,
+            "trigger": [],
+            "url": "[DATABRICKS_URL]/#joblist/pipelines/79fe85ff-42ab-b5b8-79fe-85ff42abb5b9",
+            "usage_policy_id": null
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxMjAwMDAwMDAwMDAwLCJkZWZhdWx0IjoxMjAwMDAwMDAwMDAwLCJkZWxldGUiOjEyMDAwMDAwMDAwMDAsInJlYWQiOjEyMDAwMDAwMDAwMDAsInVwZGF0ZSI6MTIwMDAwMDAwMDAwMH19"
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/permissions/test.toml b/acceptance/bundle/migrate/command/permissions/test.toml
similarity index 100%
rename from acceptance/bundle/migrate/permissions/test.toml
rename to acceptance/bundle/migrate/command/permissions/test.toml
diff --git a/acceptance/bundle/migrate/profile_arg/databricks.yml b/acceptance/bundle/migrate/command/profile_arg/databricks.yml
similarity index 100%
rename from acceptance/bundle/migrate/profile_arg/databricks.yml
rename to acceptance/bundle/migrate/command/profile_arg/databricks.yml
diff --git a/acceptance/bundle/migrate/profile_arg/notebook.py b/acceptance/bundle/migrate/command/profile_arg/notebook.py
similarity index 100%
rename from acceptance/bundle/migrate/profile_arg/notebook.py
rename to acceptance/bundle/migrate/command/profile_arg/notebook.py
diff --git a/acceptance/bundle/migrate/command/profile_arg/out.test.toml b/acceptance/bundle/migrate/command/profile_arg/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/command/profile_arg/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/command/profile_arg/output.txt b/acceptance/bundle/migrate/command/profile_arg/output.txt
new file mode 100644
index 00000000000..dfa1e9b41dd
--- /dev/null
+++ b/acceptance/bundle/migrate/command/profile_arg/output.txt
@@ -0,0 +1,24 @@
+
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate -t dev
+
+>>> [CLI] bundle deployment migrate -p non_existent321
+Success! Migrated 1 resources to direct engine state file: [TEST_TMP_DIR]/.databricks/bundle/dev/resources.json
+
+Validate the migration by running "databricks bundle plan -p non_existent321", there should be no actions planned.
+
+The state file is not synchronized to the workspace yet. To do that and finalize the migration, run "bundle deploy -p non_existent321".
+
+To undo the migration, remove [TEST_TMP_DIR]/.databricks/bundle/dev/resources.json and rename [TEST_TMP_DIR]/.databricks/bundle/dev/terraform/terraform.tfstate.backup to [TEST_TMP_DIR]/.databricks/bundle/dev/terraform/terraform.tfstate
+
+
+>>> replay_tfstate.py terraform-prod-requests.json terraform-prod.tfstate -t prod
+
+>>> [CLI] bundle deployment migrate -p non_existent321 -t prod
+Success! Migrated 2 resources to direct engine state file: [TEST_TMP_DIR]/.databricks/bundle/prod/resources.json
+
+Validate the migration by running "databricks bundle plan -t prod -p non_existent321", there should be no actions planned.
+
+The state file is not synchronized to the workspace yet. To do that and finalize the migration, run "bundle deploy -t prod -p non_existent321".
+
+To undo the migration, remove [TEST_TMP_DIR]/.databricks/bundle/prod/resources.json and rename [TEST_TMP_DIR]/.databricks/bundle/prod/terraform/terraform.tfstate.backup to [TEST_TMP_DIR]/.databricks/bundle/prod/terraform/terraform.tfstate
+
diff --git a/acceptance/bundle/migrate/profile_arg/pipeline.py b/acceptance/bundle/migrate/command/profile_arg/pipeline.py
similarity index 100%
rename from acceptance/bundle/migrate/profile_arg/pipeline.py
rename to acceptance/bundle/migrate/command/profile_arg/pipeline.py
diff --git a/acceptance/bundle/migrate/command/profile_arg/script b/acceptance/bundle/migrate/command/profile_arg/script
new file mode 100755
index 00000000000..c8f07b32272
--- /dev/null
+++ b/acceptance/bundle/migrate/command/profile_arg/script
@@ -0,0 +1,10 @@
+# Replay a prior terraform deployment (a single job)
+trace replay_tfstate.py terraform-requests.json terraform.tfstate -t dev
+
+# only interested in output here; for some reason in test env -p is not validated
+trace $CLI bundle deployment migrate -p non_existent321
+
+# Replay a prior terraform deployment on a different target (a job and a schema)
+trace replay_tfstate.py terraform-prod-requests.json terraform-prod.tfstate -t prod
+
+trace $CLI bundle deployment migrate -p non_existent321 -t prod
diff --git a/acceptance/bundle/migrate/command/profile_arg/terraform-prod-requests.json b/acceptance/bundle/migrate/command/profile_arg/terraform-prod-requests.json
new file mode 100644
index 00000000000..c0de69c216b
--- /dev/null
+++ b/acceptance/bundle/migrate/command/profile_arg/terraform-prod-requests.json
@@ -0,0 +1,36 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.1/unity-catalog/schemas",
+    "body": {
+      "catalog_name": "mycat",
+      "name": "myschema"
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-basic-test/prod/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "Test Migration Job",
+      "queue": {
+        "enabled": true
+      },
+      "tasks": [
+        {
+          "notebook_task": {
+            "notebook_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-basic-test/prod/files/notebook",
+            "source": "WORKSPACE"
+          },
+          "task_key": "main"
+        }
+      ]
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/command/profile_arg/terraform-prod.tfstate b/acceptance/bundle/migrate/command/profile_arg/terraform-prod.tfstate
new file mode 100644
index 00000000000..6e0e3b0f53c
--- /dev/null
+++ b/acceptance/bundle/migrate/command/profile_arg/terraform-prod.tfstate
@@ -0,0 +1,200 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 3,
+  "lineage": "93b93ed4-821d-ea9e-0fea-e6ccc03c0316",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "test_job",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-basic-test/prod/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790615136304176000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "Test Migration Job",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [
+              {
+                "ai_runtime_task": [],
+                "alert_task": [],
+                "clean_rooms_notebook_task": [],
+                "compute": [],
+                "condition_task": [],
+                "dashboard_task": [],
+                "dbt_cloud_task": [],
+                "dbt_platform_task": [],
+                "dbt_task": [],
+                "depends_on": [],
+                "description": "",
+                "disable_auto_optimization": false,
+                "disabled": false,
+                "email_notifications": [
+                  {
+                    "no_alert_for_skipped_runs": false,
+                    "on_duration_warning_threshold_exceeded": [],
+                    "on_failure": [],
+                    "on_start": [],
+                    "on_streaming_backlog_exceeded": [],
+                    "on_success": []
+                  }
+                ],
+                "environment_key": "",
+                "existing_cluster_id": "",
+                "for_each_task": [],
+                "gen_ai_compute_task": [],
+                "health": [],
+                "job_cluster_key": "",
+                "library": [],
+                "max_retries": 0,
+                "min_retry_interval_millis": 0,
+                "new_cluster": [],
+                "notebook_task": [
+                  {
+                    "base_parameters": null,
+                    "notebook_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-basic-test/prod/files/notebook",
+                    "source": "WORKSPACE",
+                    "warehouse_id": ""
+                  }
+                ],
+                "notification_settings": [],
+                "pipeline_task": [],
+                "power_bi_task": [],
+                "python_operator_task": [],
+                "python_wheel_task": [],
+                "retry_on_timeout": false,
+                "run_if": "ALL_SUCCESS",
+                "run_job_task": [],
+                "spark_jar_task": [],
+                "spark_python_task": [],
+                "spark_submit_task": [],
+                "sql_task": [],
+                "task_key": "main",
+                "timeout_seconds": 0,
+                "webhook_notifications": []
+              }
+            ],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790615136304176000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_schema",
+      "name": "test_schema",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "catalog_name": "mycat",
+            "comment": null,
+            "enable_predictive_optimization": "INHERIT",
+            "force_destroy": true,
+            "id": "mycat.myschema",
+            "metastore_id": "120efa64-9b68-46ba-be38-f319458430d2",
+            "name": "myschema",
+            "owner": "tester@databricks.com",
+            "properties": null,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "schema_id": "79fe89e4-4a95-1948-79fe-89e44a951d30",
+            "storage_root": null
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/command/profile_arg/terraform-requests.json b/acceptance/bundle/migrate/command/profile_arg/terraform-requests.json
new file mode 100644
index 00000000000..8dcc9089324
--- /dev/null
+++ b/acceptance/bundle/migrate/command/profile_arg/terraform-requests.json
@@ -0,0 +1,28 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-basic-test/dev/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "Test Migration Job",
+      "queue": {
+        "enabled": true
+      },
+      "tasks": [
+        {
+          "notebook_task": {
+            "notebook_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-basic-test/dev/files/notebook",
+            "source": "WORKSPACE"
+          },
+          "task_key": "main"
+        }
+      ]
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/command/profile_arg/terraform.tfstate b/acceptance/bundle/migrate/command/profile_arg/terraform.tfstate
new file mode 100644
index 00000000000..4746fa35538
--- /dev/null
+++ b/acceptance/bundle/migrate/command/profile_arg/terraform.tfstate
@@ -0,0 +1,169 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "25eb53a2-0b56-1698-68f5-f1eff6417572",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "test_job",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-basic-test/dev/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790615135218268000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "Test Migration Job",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [
+              {
+                "ai_runtime_task": [],
+                "alert_task": [],
+                "clean_rooms_notebook_task": [],
+                "compute": [],
+                "condition_task": [],
+                "dashboard_task": [],
+                "dbt_cloud_task": [],
+                "dbt_platform_task": [],
+                "dbt_task": [],
+                "depends_on": [],
+                "description": "",
+                "disable_auto_optimization": false,
+                "disabled": false,
+                "email_notifications": [
+                  {
+                    "no_alert_for_skipped_runs": false,
+                    "on_duration_warning_threshold_exceeded": [],
+                    "on_failure": [],
+                    "on_start": [],
+                    "on_streaming_backlog_exceeded": [],
+                    "on_success": []
+                  }
+                ],
+                "environment_key": "",
+                "existing_cluster_id": "",
+                "for_each_task": [],
+                "gen_ai_compute_task": [],
+                "health": [],
+                "job_cluster_key": "",
+                "library": [],
+                "max_retries": 0,
+                "min_retry_interval_millis": 0,
+                "new_cluster": [],
+                "notebook_task": [
+                  {
+                    "base_parameters": null,
+                    "notebook_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-basic-test/dev/files/notebook",
+                    "source": "WORKSPACE",
+                    "warehouse_id": ""
+                  }
+                ],
+                "notification_settings": [],
+                "pipeline_task": [],
+                "power_bi_task": [],
+                "python_operator_task": [],
+                "python_wheel_task": [],
+                "retry_on_timeout": false,
+                "run_if": "ALL_SUCCESS",
+                "run_job_task": [],
+                "spark_jar_task": [],
+                "spark_python_task": [],
+                "spark_submit_task": [],
+                "sql_task": [],
+                "task_key": "main",
+                "timeout_seconds": 0,
+                "webhook_notifications": []
+              }
+            ],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790615135218268000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/command/profile_arg/test.toml b/acceptance/bundle/migrate/command/profile_arg/test.toml
new file mode 100644
index 00000000000..a030353d571
--- /dev/null
+++ b/acceptance/bundle/migrate/command/profile_arg/test.toml
@@ -0,0 +1 @@
+RecordRequests = false
diff --git a/acceptance/bundle/migrate/command/removed-all/databricks.yml b/acceptance/bundle/migrate/command/removed-all/databricks.yml
new file mode 100644
index 00000000000..3495c042502
--- /dev/null
+++ b/acceptance/bundle/migrate/command/removed-all/databricks.yml
@@ -0,0 +1,7 @@
+bundle:
+  name: migrate-removed-test
+
+resources:
+  jobs:
+    job_a: {name: "Job A"}
+    job_b: {name: "Job B"}
diff --git a/acceptance/bundle/migrate/command/removed-all/out.test.toml b/acceptance/bundle/migrate/command/removed-all/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/command/removed-all/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/command/removed-all/output.txt b/acceptance/bundle/migrate/command/removed-all/output.txt
new file mode 100644
index 00000000000..54b03f4a28b
--- /dev/null
+++ b/acceptance/bundle/migrate/command/removed-all/output.txt
@@ -0,0 +1,51 @@
+
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate
+
+>>> [CLI] bundle deployment migrate
+Success! Migrated 2 resources to direct engine state file: [TEST_TMP_DIR]/.databricks/bundle/default/resources.json
+
+Validate the migration by running "databricks bundle plan", there should be no actions planned.
+
+The state file is not synchronized to the workspace yet. To do that and finalize the migration, run "bundle deploy".
+
+To undo the migration, remove [TEST_TMP_DIR]/.databricks/bundle/default/resources.json and rename [TEST_TMP_DIR]/.databricks/bundle/default/terraform/terraform.tfstate.backup to [TEST_TMP_DIR]/.databricks/bundle/default/terraform/terraform.tfstate
+
+
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle plan
+delete jobs.job_a
+delete jobs.job_b
+
+Plan: 0 to add, 0 to change, 2 to delete, 0 unchanged
+
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle deploy --auto-approve
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/migrate-removed-test/default/files...
+Deleted jobs.job_a
+Deleted jobs.job_b
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 2 deleted, 0 unchanged
+
+>>> print_requests.py --sort //jobs/delete
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct lineage/InPa9XqlYQg auth/pat"
+    ]
+  },
+  "method": "POST",
+  "path": "/api/2.2/jobs/delete",
+  "body": {
+    "job_id": [JOB_A_ID]
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct lineage/InPa9XqlYQg auth/pat"
+    ]
+  },
+  "method": "POST",
+  "path": "/api/2.2/jobs/delete",
+  "body": {
+    "job_id": [JOB_B_ID]
+  }
+}
diff --git a/acceptance/bundle/migrate/command/removed-all/script b/acceptance/bundle/migrate/command/removed-all/script
new file mode 100644
index 00000000000..41d7fe33160
--- /dev/null
+++ b/acceptance/bundle/migrate/command/removed-all/script
@@ -0,0 +1,20 @@
+export DATABRICKS_BUNDLE_ENGINE=
+
+# Replay a prior terraform deployment (job_a and job_b)
+trace replay_tfstate.py terraform-requests.json terraform.tfstate
+replace_ids.py
+
+# Remove every resource from config without deploying the deletion
+cat > databricks.yml <<'YAML'
+bundle:
+  name: migrate-removed-test
+YAML
+
+# Both IDs are preserved in direct state for deletion on next deploy
+trace $CLI bundle deployment migrate
+
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle plan | contains.py "2 to delete"
+
+rm "$OUT_REQUESTS"
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle deploy --auto-approve
+trace print_requests.py --sort //jobs/delete
diff --git a/acceptance/bundle/migrate/command/removed-all/terraform-requests.json b/acceptance/bundle/migrate/command/removed-all/terraform-requests.json
new file mode 100644
index 00000000000..20d41dc71cf
--- /dev/null
+++ b/acceptance/bundle/migrate/command/removed-all/terraform-requests.json
@@ -0,0 +1,36 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-removed-test/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "Job A",
+      "queue": {
+        "enabled": true
+      }
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-removed-test/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "Job B",
+      "queue": {
+        "enabled": true
+      }
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/command/removed-all/terraform.tfstate b/acceptance/bundle/migrate/command/removed-all/terraform.tfstate
new file mode 100644
index 00000000000..6a8ad85c9a1
--- /dev/null
+++ b/acceptance/bundle/migrate/command/removed-all/terraform.tfstate
@@ -0,0 +1,210 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "37f6c843-91a5-3d5c-457c-2c43d9630444",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "job_a",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-removed-test/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790614038615498000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "Job A",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790614038615498000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "job_b",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-removed-test/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790614038615799000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "Job B",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790614038615799000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/command/removed/databricks.yml b/acceptance/bundle/migrate/command/removed/databricks.yml
new file mode 100644
index 00000000000..3495c042502
--- /dev/null
+++ b/acceptance/bundle/migrate/command/removed/databricks.yml
@@ -0,0 +1,7 @@
+bundle:
+  name: migrate-removed-test
+
+resources:
+  jobs:
+    job_a: {name: "Job A"}
+    job_b: {name: "Job B"}
diff --git a/acceptance/bundle/migrate/command/removed/out.test.toml b/acceptance/bundle/migrate/command/removed/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/command/removed/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/command/removed/output.txt b/acceptance/bundle/migrate/command/removed/output.txt
new file mode 100644
index 00000000000..88ed35451f5
--- /dev/null
+++ b/acceptance/bundle/migrate/command/removed/output.txt
@@ -0,0 +1,40 @@
+
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate
+
+>>> [CLI] bundle deployment migrate
+Success! Migrated 2 resources to direct engine state file: [TEST_TMP_DIR]/.databricks/bundle/default/resources.json
+
+Validate the migration by running "databricks bundle plan", there should be no actions planned.
+
+The state file is not synchronized to the workspace yet. To do that and finalize the migration, run "bundle deploy".
+
+To undo the migration, remove [TEST_TMP_DIR]/.databricks/bundle/default/resources.json and rename [TEST_TMP_DIR]/.databricks/bundle/default/terraform/terraform.tfstate.backup to [TEST_TMP_DIR]/.databricks/bundle/default/terraform/terraform.tfstate
+
+
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle plan
+delete jobs.job_b
+
+Plan: 0 to add, 0 to change, 1 to delete, 1 unchanged
+
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/migrate-removed-test/default/files...
+Deleted jobs.job_b
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 1 deleted, 1 unchanged
+
+>>> print_requests.py //jobs/delete
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct lineage/InPa9XqlYQg auth/pat"
+    ]
+  },
+  "method": "POST",
+  "path": "/api/2.2/jobs/delete",
+  "body": {
+    "job_id": [JOB_B_ID]
+  }
+}
+
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
diff --git a/acceptance/bundle/migrate/command/removed/script b/acceptance/bundle/migrate/command/removed/script
new file mode 100644
index 00000000000..acae30b7549
--- /dev/null
+++ b/acceptance/bundle/migrate/command/removed/script
@@ -0,0 +1,24 @@
+export DATABRICKS_BUNDLE_ENGINE=
+
+# Replay a prior terraform deployment (both job_a and job_b)
+trace replay_tfstate.py terraform-requests.json terraform.tfstate
+replace_ids.py
+
+# Remove job_b from config without deploying the deletion
+grep -v job_b databricks.yml > databricks_tmp.yml && mv databricks_tmp.yml databricks.yml
+
+# job_b's ID preserved in direct state for deletion on next deploy
+trace $CLI bundle deployment migrate
+
+# After migration: plan shows job_b as "to delete"
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle plan | contains.py "1 to delete"
+
+# Deploy deletes job_b; verify via recorded requests
+rm "$OUT_REQUESTS"
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle deploy
+trace print_requests.py //jobs/delete
+
+# No further actions planned
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle plan | contains.py "1 unchanged"
+
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/migrate/command/removed/terraform-requests.json b/acceptance/bundle/migrate/command/removed/terraform-requests.json
new file mode 100644
index 00000000000..20d41dc71cf
--- /dev/null
+++ b/acceptance/bundle/migrate/command/removed/terraform-requests.json
@@ -0,0 +1,36 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-removed-test/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "Job A",
+      "queue": {
+        "enabled": true
+      }
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-removed-test/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "Job B",
+      "queue": {
+        "enabled": true
+      }
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/command/removed/terraform.tfstate b/acceptance/bundle/migrate/command/removed/terraform.tfstate
new file mode 100644
index 00000000000..6a8ad85c9a1
--- /dev/null
+++ b/acceptance/bundle/migrate/command/removed/terraform.tfstate
@@ -0,0 +1,210 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "37f6c843-91a5-3d5c-457c-2c43d9630444",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "job_a",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-removed-test/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790614038615498000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "Job A",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790614038615498000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "job_b",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-removed-test/default/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790614038615799000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "Job B",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790614038615799000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/runas/databricks.yml.tmpl b/acceptance/bundle/migrate/command/runas/databricks.yml.tmpl
similarity index 100%
rename from acceptance/bundle/migrate/runas/databricks.yml.tmpl
rename to acceptance/bundle/migrate/command/runas/databricks.yml.tmpl
diff --git a/acceptance/bundle/migrate/command/runas/out.create_requests.json b/acceptance/bundle/migrate/command/runas/out.create_requests.json
new file mode 100644
index 00000000000..abeb78d7d35
--- /dev/null
+++ b/acceptance/bundle/migrate/command/runas/out.create_requests.json
@@ -0,0 +1,52 @@
+{
+  "headers": {
+    "User-Agent": [
+      "replay_tfstate.py"
+    ]
+  },
+  "method": "POST",
+  "path": "/api/2.0/pipelines",
+  "body": {
+    "catalog": "main",
+    "channel": "CURRENT",
+    "deployment": {
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/dabs_revenue-[UNIQUE_NAME]/production/state/metadata.json"
+    },
+    "edition": "ADVANCED",
+    "libraries": [
+      {
+        "notebook": {
+          "path": "/Workspace/Users/[USERNAME]/.bundle/dabs_revenue-[UNIQUE_NAME]/production/files/sql"
+        }
+      }
+    ],
+    "name": "DABs Revenue Pipeline",
+    "run_as": {
+      "service_principal_name": "[UUID]"
+    },
+    "serverless": true,
+    "target": "team_eng_deco"
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "replay_tfstate.py"
+    ]
+  },
+  "method": "PUT",
+  "path": "/api/2.0/permissions/pipelines/[UUID]",
+  "body": {
+    "access_control_list": [
+      {
+        "group_name": "users",
+        "permission_level": "CAN_VIEW"
+      },
+      {
+        "permission_level": "IS_OWNER",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/migrate/command/runas/out.new_state.json b/acceptance/bundle/migrate/command/runas/out.new_state.json
new file mode 100644
index 00000000000..134f7aff689
--- /dev/null
+++ b/acceptance/bundle/migrate/command/runas/out.new_state.json
@@ -0,0 +1,55 @@
+{
+ "state_version": 3,
+ "cli_version": "[CLI_VERSION]",
+ "lineage": "[UUID]",
+ "serial": 5,
+ "state": {
+  "resources.pipelines.foo": {
+   "__id__": "[UUID]",
+   "state": {
+    "catalog": "main",
+    "channel": "CURRENT",
+    "deployment": {
+     "kind": "BUNDLE",
+     "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/dabs_revenue-[UNIQUE_NAME]/production/state/metadata.json"
+    },
+    "edition": "ADVANCED",
+    "libraries": [
+     {
+      "notebook": {
+       "path": "/Workspace/Users/[USERNAME]/.bundle/dabs_revenue-[UNIQUE_NAME]/production/files/sql"
+      }
+     }
+    ],
+    "name": "DABs Revenue Pipeline",
+    "run_as": {
+     "service_principal_name": "[UUID]"
+    },
+    "serverless": true,
+    "target": "team_eng_deco"
+   }
+  },
+  "resources.pipelines.foo.permissions": {
+   "__id__": "/pipelines/[UUID]",
+   "state": {
+    "object_id": "/pipelines/[UUID]",
+    "__embed__": [
+     {
+      "level": "CAN_VIEW",
+      "group_name": "users"
+     },
+     {
+      "level": "IS_OWNER",
+      "user_name": "[USERNAME]"
+     }
+    ]
+   },
+   "depends_on": [
+    {
+     "node": "resources.pipelines.foo",
+     "label": "${resources.pipelines.foo.id}"
+    }
+   ]
+  }
+ }
+}
diff --git a/acceptance/bundle/migrate/runas/out.old_state.json b/acceptance/bundle/migrate/command/runas/out.old_state.json
similarity index 90%
rename from acceptance/bundle/migrate/runas/out.old_state.json
rename to acceptance/bundle/migrate/command/runas/out.old_state.json
index 2d0fba02fd9..ffc6dcc50da 100644
--- a/acceptance/bundle/migrate/runas/out.old_state.json
+++ b/acceptance/bundle/migrate/command/runas/out.old_state.json
@@ -42,11 +42,16 @@
             "id": "/pipelines/[UUID]",
             "instance_pool_id": null,
             "job_id": null,
+            "knowledge_assistant_id": null,
             "notebook_id": null,
             "notebook_path": null,
             "object_type": "pipelines",
             "pipeline_id": "[UUID]",
-            "provider_config": [],
+            "provider_config": [
+              {
+                "workspace_id": "[WORKSPACE_ID]"
+              }
+            ],
             "registered_model_id": null,
             "repo_id": null,
             "repo_path": null,
@@ -55,6 +60,7 @@
             "sql_dashboard_id": null,
             "sql_endpoint_id": null,
             "sql_query_id": null,
+            "supervisor_agent_id": null,
             "vector_search_endpoint_id": null,
             "workspace_file_id": null,
             "workspace_file_path": null
@@ -88,8 +94,10 @@
             "creator_user_name": "[USERNAME]",
             "deployment": [
               {
+                "deployment_id": "",
                 "kind": "BUNDLE",
-                "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/dabs_revenue-[UNIQUE_NAME]/production/state/metadata.json"
+                "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/dabs_revenue-[UNIQUE_NAME]/production/state/metadata.json",
+                "version_id": ""
               }
             ],
             "development": false,
@@ -121,11 +129,16 @@
             "name": "DABs Revenue Pipeline",
             "notification": [],
             "photon": false,
-            "provider_config": [],
+            "provider_config": [
+              {
+                "workspace_id": "[WORKSPACE_ID]"
+              }
+            ],
             "restart_window": [],
             "root_path": null,
             "run_as": [
               {
+                "group_name": "",
                 "service_principal_name": "[UUID]",
                 "user_name": ""
               }
@@ -133,6 +146,7 @@
             "run_as_user_name": "[USERNAME]",
             "schema": null,
             "serverless": true,
+            "serverless_compute_id": null,
             "state": "IDLE",
             "storage": null,
             "tags": null,
diff --git a/acceptance/bundle/migrate/runas/out.pipelines_get.json b/acceptance/bundle/migrate/command/runas/out.pipelines_get.json
similarity index 93%
rename from acceptance/bundle/migrate/runas/out.pipelines_get.json
rename to acceptance/bundle/migrate/command/runas/out.pipelines_get.json
index 715c10e9e13..fb06fd6bdb6 100644
--- a/acceptance/bundle/migrate/runas/out.pipelines_get.json
+++ b/acceptance/bundle/migrate/command/runas/out.pipelines_get.json
@@ -4,6 +4,9 @@
   "last_modified": [UNIX_TIME_MILLIS],
   "name": "DABs Revenue Pipeline",
   "pipeline_id": "[UUID]",
+  "run_as": {
+    "service_principal_name": "[UUID]"
+  },
   "run_as_user_name": "[USERNAME]",
   "spec": {
     "catalog": "main",
diff --git a/acceptance/bundle/migrate/command/runas/out.plan.json b/acceptance/bundle/migrate/command/runas/out.plan.json
new file mode 100644
index 00000000000..3c6a3717007
--- /dev/null
+++ b/acceptance/bundle/migrate/command/runas/out.plan.json
@@ -0,0 +1,62 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 5,
+  "plan": {
+    "resources.pipelines.foo": {
+      "action": "skip",
+      "remote_state": {
+        "catalog": "main",
+        "channel": "CURRENT",
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/dabs_revenue-[UNIQUE_NAME]/production/state/metadata.json"
+        },
+        "edition": "ADVANCED",
+        "effective_publishing_mode": "DEFAULT_PUBLISHING_MODE",
+        "id": "[UUID]",
+        "last_modified": [UNIX_TIME_MILLIS],
+        "libraries": [
+          {
+            "notebook": {
+              "path": "/Workspace/Users/[USERNAME]/.bundle/dabs_revenue-[UNIQUE_NAME]/production/files/sql"
+            }
+          }
+        ],
+        "name": "DABs Revenue Pipeline",
+        "pipeline_id": "[UUID]",
+        "run_as": {
+          "service_principal_name": "[UUID]"
+        },
+        "run_as_user_name": "[USERNAME]",
+        "serverless": true,
+        "state": "IDLE",
+        "target": "team_eng_deco"
+      }
+    },
+    "resources.pipelines.foo.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.foo",
+          "label": "${resources.pipelines.foo.id}"
+        }
+      ],
+      "action": "skip",
+      "remote_state": {
+        "object_id": "/pipelines/[UUID]",
+        "__embed__": [
+          {
+            "level": "CAN_VIEW",
+            "group_name": "users"
+          },
+          {
+            "level": "IS_OWNER",
+            "user_name": "[USERNAME]"
+          }
+        ]
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/migrate/command/runas/out.test.toml b/acceptance/bundle/migrate/command/runas/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/command/runas/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/command/runas/output.txt b/acceptance/bundle/migrate/command/runas/output.txt
new file mode 100644
index 00000000000..c17ffdec425
--- /dev/null
+++ b/acceptance/bundle/migrate/command/runas/output.txt
@@ -0,0 +1,98 @@
+
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate -t production
+
+>>> print_requests.py //pipelines
+
+>>> print_state.py
+Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
+If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
+
+Consider using a adding a top-level permissions section such as the following:
+
+  permissions:
+    - user_name: [USERNAME]
+      level: CAN_MANAGE
+
+See https://docs.databricks.com/dev-tools/bundles/permissions.html to learn more about permission configuration.
+  in databricks.yml:5:3
+
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
+
+>>> [CLI] pipelines get [UUID]
+
+>>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle deployment migrate
+Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
+If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
+
+Consider using a adding a top-level permissions section such as the following:
+
+  permissions:
+    - user_name: [USERNAME]
+      level: CAN_MANAGE
+
+See https://docs.databricks.com/dev-tools/bundles/permissions.html to learn more about permission configuration.
+  in databricks.yml:5:3
+
+Success! Migrated 2 resources to direct engine state file: [TEST_TMP_DIR]/.databricks/bundle/production/resources.json
+
+Validate the migration by running "databricks bundle plan", there should be no actions planned.
+
+The state file is not synchronized to the workspace yet. To do that and finalize the migration, run "bundle deploy".
+
+To undo the migration, remove [TEST_TMP_DIR]/.databricks/bundle/production/resources.json and rename [TEST_TMP_DIR]/.databricks/bundle/production/terraform/terraform.tfstate.backup to [TEST_TMP_DIR]/.databricks/bundle/production/terraform/terraform.tfstate
+
+
+>>> print_state.py
+
+>>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle plan
+Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
+If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
+
+Consider using a adding a top-level permissions section such as the following:
+
+  permissions:
+    - user_name: [USERNAME]
+      level: CAN_MANAGE
+
+See https://docs.databricks.com/dev-tools/bundles/permissions.html to learn more about permission configuration.
+  in databricks.yml:5:3
+
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
+
+>>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle plan -o json
+Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
+If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
+
+Consider using a adding a top-level permissions section such as the following:
+
+  permissions:
+    - user_name: [USERNAME]
+      level: CAN_MANAGE
+
+See https://docs.databricks.com/dev-tools/bundles/permissions.html to learn more about permission configuration.
+  in databricks.yml:5:3
+
+
+>>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle destroy --auto-approve
+Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
+If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
+
+Consider using a adding a top-level permissions section such as the following:
+
+  permissions:
+    - user_name: [USERNAME]
+      level: CAN_MANAGE
+
+See https://docs.databricks.com/dev-tools/bundles/permissions.html to learn more about permission configuration.
+  in databricks.yml:5:3
+
+The following resources will be deleted:
+  delete resources.pipelines.foo
+
+This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:
+  delete resources.pipelines.foo
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/dabs_revenue-[UNIQUE_NAME]/production
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/migrate/command/runas/script b/acceptance/bundle/migrate/command/runas/script
new file mode 100644
index 00000000000..d90cf2235aa
--- /dev/null
+++ b/acceptance/bundle/migrate/command/runas/script
@@ -0,0 +1,25 @@
+if [ -z "${TEST_SP_APPLICATION_ID+x}" ]; then
+    export TEST_SP_APPLICATION_ID="123b0db3-ba48-4e12-be3b-3b7898cdf000"
+fi
+
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+
+trap cleanup EXIT
+
+# Replay a prior terraform deployment (a pipeline deployed with run_as)
+trace replay_tfstate.py terraform-requests.json terraform.tfstate -t production
+trace print_requests.py //pipelines > out.create_requests.json
+trace print_state.py > out.old_state.json
+
+pipeline_id=$(DATABRICKS_BUNDLE_ENGINE= $CLI bundle summary --output json | jq -r '.resources.pipelines.foo.id')
+trace $CLI pipelines get $pipeline_id > out.pipelines_get.json
+
+trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle deployment migrate
+trace print_state.py > out.new_state.json
+trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle plan
+trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle plan -o json | nostamp > out.plan.json
diff --git a/acceptance/bundle/migrate/runas/sql.sql b/acceptance/bundle/migrate/command/runas/sql.sql
similarity index 100%
rename from acceptance/bundle/migrate/runas/sql.sql
rename to acceptance/bundle/migrate/command/runas/sql.sql
diff --git a/acceptance/bundle/migrate/command/runas/terraform-requests.json b/acceptance/bundle/migrate/command/runas/terraform-requests.json
new file mode 100644
index 00000000000..09fefd90ab6
--- /dev/null
+++ b/acceptance/bundle/migrate/command/runas/terraform-requests.json
@@ -0,0 +1,56 @@
+[
+  {
+    "method": "PUT",
+    "path": "/api/2.0/permissions/directories/8790615267072834001",
+    "body": {
+      "access_control_list": [
+        {
+          "group_name": "users",
+          "permission_level": "CAN_READ"
+        }
+      ]
+    }
+  },
+  {
+    "method": "POST",
+    "path": "/api/2.0/pipelines",
+    "body": {
+      "catalog": "main",
+      "channel": "CURRENT",
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/dabs_revenue-[UNIQUE_NAME]/production/state/metadata.json"
+      },
+      "edition": "ADVANCED",
+      "libraries": [
+        {
+          "notebook": {
+            "path": "/Workspace/Users/tester@databricks.com/.bundle/dabs_revenue-[UNIQUE_NAME]/production/files/sql"
+          }
+        }
+      ],
+      "name": "DABs Revenue Pipeline",
+      "run_as": {
+        "service_principal_name": "123b0db3-ba48-4e12-be3b-3b7898cdf000"
+      },
+      "serverless": true,
+      "target": "team_eng_deco"
+    }
+  },
+  {
+    "method": "PUT",
+    "path": "/api/2.0/permissions/pipelines/79fe8a02-f7fe-ced0-79fe-8a02f7fed2b8",
+    "body": {
+      "access_control_list": [
+        {
+          "group_name": "users",
+          "permission_level": "CAN_VIEW"
+        },
+        {
+          "permission_level": "IS_OWNER",
+          "user_name": "tester@databricks.com"
+        }
+      ]
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/command/runas/terraform.tfstate b/acceptance/bundle/migrate/command/runas/terraform.tfstate
new file mode 100644
index 00000000000..8b3c0b6ec3d
--- /dev/null
+++ b/acceptance/bundle/migrate/command/runas/terraform.tfstate
@@ -0,0 +1,166 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 3,
+  "lineage": "077aa86d-dff4-9481-ecbe-357801f46445",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_permissions",
+      "name": "pipeline_foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "access_control": [
+              {
+                "group_name": "",
+                "permission_level": "IS_OWNER",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              },
+              {
+                "group_name": "users",
+                "permission_level": "CAN_VIEW",
+                "service_principal_name": "",
+                "user_name": ""
+              }
+            ],
+            "alert_v2_id": null,
+            "app_name": null,
+            "authorization": null,
+            "cluster_id": null,
+            "cluster_policy_id": null,
+            "dashboard_id": null,
+            "database_instance_name": null,
+            "database_project_name": null,
+            "directory_id": null,
+            "directory_path": null,
+            "experiment_id": null,
+            "id": "/pipelines/79fe8a02-f7fe-ced0-79fe-8a02f7fed2b8",
+            "instance_pool_id": null,
+            "job_id": null,
+            "knowledge_assistant_id": null,
+            "notebook_id": null,
+            "notebook_path": null,
+            "object_type": "pipelines",
+            "pipeline_id": "79fe8a02-f7fe-ced0-79fe-8a02f7fed2b8",
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "registered_model_id": null,
+            "repo_id": null,
+            "repo_path": null,
+            "serving_endpoint_id": null,
+            "sql_alert_id": null,
+            "sql_dashboard_id": null,
+            "sql_endpoint_id": null,
+            "sql_query_id": null,
+            "supervisor_agent_id": null,
+            "vector_search_endpoint_id": null,
+            "workspace_file_id": null,
+            "workspace_file_path": null
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "databricks_pipeline.foo"
+          ]
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "databricks_pipeline",
+      "name": "foo",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "allow_duplicate_names": false,
+            "budget_policy_id": null,
+            "catalog": "main",
+            "cause": null,
+            "channel": "CURRENT",
+            "cluster": [],
+            "cluster_id": null,
+            "configuration": null,
+            "continuous": false,
+            "creator_user_name": "tester@databricks.com",
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/dabs_revenue-[UNIQUE_NAME]/production/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "development": false,
+            "edition": "ADVANCED",
+            "environment": [],
+            "event_log": [],
+            "expected_last_modified": 0,
+            "filters": [],
+            "gateway_definition": [],
+            "health": null,
+            "id": "79fe8a02-f7fe-ced0-79fe-8a02f7fed2b8",
+            "ingestion_definition": [],
+            "last_modified": 1790615268029,
+            "latest_updates": null,
+            "library": [
+              {
+                "file": [],
+                "glob": [],
+                "jar": "",
+                "maven": [],
+                "notebook": [
+                  {
+                    "path": "/Workspace/Users/tester@databricks.com/.bundle/dabs_revenue-[UNIQUE_NAME]/production/files/sql"
+                  }
+                ],
+                "whl": ""
+              }
+            ],
+            "name": "DABs Revenue Pipeline",
+            "notification": [],
+            "photon": false,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "restart_window": [],
+            "root_path": null,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "123b0db3-ba48-4e12-be3b-3b7898cdf000",
+                "user_name": ""
+              }
+            ],
+            "run_as_user_name": "tester@databricks.com",
+            "schema": null,
+            "serverless": true,
+            "serverless_compute_id": null,
+            "state": "IDLE",
+            "storage": null,
+            "tags": null,
+            "target": "team_eng_deco",
+            "timeouts": null,
+            "trigger": [],
+            "url": "[DATABRICKS_URL]/#joblist/pipelines/79fe8a02-f7fe-ced0-79fe-8a02f7fed2b8",
+            "usage_policy_id": null
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxMjAwMDAwMDAwMDAwLCJkZWZhdWx0IjoxMjAwMDAwMDAwMDAwLCJkZWxldGUiOjEyMDAwMDAwMDAwMDAsInJlYWQiOjEyMDAwMDAwMDAwMDAsInVwZGF0ZSI6MTIwMDAwMDAwMDAwMH19"
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/runas/test.toml b/acceptance/bundle/migrate/command/runas/test.toml
similarity index 100%
rename from acceptance/bundle/migrate/runas/test.toml
rename to acceptance/bundle/migrate/command/runas/test.toml
diff --git a/acceptance/bundle/migrate/var_arg/databricks.yml b/acceptance/bundle/migrate/command/var_arg/databricks.yml
similarity index 100%
rename from acceptance/bundle/migrate/var_arg/databricks.yml
rename to acceptance/bundle/migrate/command/var_arg/databricks.yml
diff --git a/acceptance/bundle/migrate/var_arg/notebook.py b/acceptance/bundle/migrate/command/var_arg/notebook.py
similarity index 100%
rename from acceptance/bundle/migrate/var_arg/notebook.py
rename to acceptance/bundle/migrate/command/var_arg/notebook.py
diff --git a/acceptance/bundle/migrate/command/var_arg/out.test.toml b/acceptance/bundle/migrate/command/var_arg/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/migrate/command/var_arg/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/migrate/command/var_arg/output.txt b/acceptance/bundle/migrate/command/var_arg/output.txt
new file mode 100644
index 00000000000..1280cf619da
--- /dev/null
+++ b/acceptance/bundle/migrate/command/var_arg/output.txt
@@ -0,0 +1,52 @@
+
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate -t dev
+
+>>> [CLI] bundle deployment migrate --var=job_name=Custom Job Name
+Success! Migrated 1 resources to direct engine state file: [TEST_TMP_DIR]/.databricks/bundle/dev/resources.json
+
+Validate the migration by running "databricks bundle plan --var 'job_name=Custom Job Name'", there should be no actions planned.
+
+The state file is not synchronized to the workspace yet. To do that and finalize the migration, run "bundle deploy --var 'job_name=Custom Job Name'".
+
+To undo the migration, remove [TEST_TMP_DIR]/.databricks/bundle/dev/resources.json and rename [TEST_TMP_DIR]/.databricks/bundle/dev/terraform/terraform.tfstate.backup to [TEST_TMP_DIR]/.databricks/bundle/dev/terraform/terraform.tfstate
+
+
+>>> print_state.py
+"Custom Job Name"
+
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle plan --var=job_name=Custom Job Name
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+>>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle destroy --var=job_name=Custom Job Name --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.test_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/migrate-var-test/dev
+
+Destroy: 1 deleted
+
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate -t dev
+
+>>> [CLI] bundle deployment migrate --var job_name=Custom Job Name
+Success! Migrated 1 resources to direct engine state file: [TEST_TMP_DIR]/.databricks/bundle/dev/resources.json
+
+Validate the migration by running "databricks bundle plan --var 'job_name=Custom Job Name'", there should be no actions planned.
+
+The state file is not synchronized to the workspace yet. To do that and finalize the migration, run "bundle deploy --var 'job_name=Custom Job Name'".
+
+To undo the migration, remove [TEST_TMP_DIR]/.databricks/bundle/dev/resources.json and rename [TEST_TMP_DIR]/.databricks/bundle/dev/terraform/terraform.tfstate.backup to [TEST_TMP_DIR]/.databricks/bundle/dev/terraform/terraform.tfstate
+
+
+>>> print_state.py
+"Custom Job Name"
+
+>>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle plan --var job_name=Custom Job Name
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+>>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle destroy --var=job_name=Custom Job Name --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.test_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/migrate-var-test/dev
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/migrate/command/var_arg/script b/acceptance/bundle/migrate/command/var_arg/script
new file mode 100644
index 00000000000..5036336a424
--- /dev/null
+++ b/acceptance/bundle/migrate/command/var_arg/script
@@ -0,0 +1,16 @@
+# Replay a prior terraform deployment (a job named via --var)
+trace replay_tfstate.py terraform-requests.json terraform.tfstate -t dev
+trace $CLI bundle deployment migrate --var="job_name=Custom Job Name" 2>&1 | contains.py 'Migrated 1 resources'
+trace print_state.py | jq '.state."resources.jobs.test_job".state.name'
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle plan --var="job_name=Custom Job Name" | contains.py "1 unchanged"
+trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle destroy --var="job_name=Custom Job Name" --auto-approve
+
+# Try different syntax, '--var X', instead of '--var=X'
+rm -fr .databricks
+
+# Replay the same deployment again (replay is non-destructive, so one fixture serves both)
+trace replay_tfstate.py terraform-requests.json terraform.tfstate -t dev
+trace $CLI bundle deployment migrate --var "job_name=Custom Job Name" 2>&1 | contains.py 'Migrated 1 resources'
+trace print_state.py | jq '.state."resources.jobs.test_job".state.name'
+trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle plan --var "job_name=Custom Job Name" | contains.py "1 unchanged"
+trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle destroy --var="job_name=Custom Job Name" --auto-approve
diff --git a/acceptance/bundle/migrate/command/var_arg/terraform-requests.json b/acceptance/bundle/migrate/command/var_arg/terraform-requests.json
new file mode 100644
index 00000000000..6fb9f2341c4
--- /dev/null
+++ b/acceptance/bundle/migrate/command/var_arg/terraform-requests.json
@@ -0,0 +1,28 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.2/jobs/create",
+    "body": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-var-test/dev/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "Custom Job Name",
+      "queue": {
+        "enabled": true
+      },
+      "tasks": [
+        {
+          "notebook_task": {
+            "notebook_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-var-test/dev/files/notebook",
+            "source": "WORKSPACE"
+          },
+          "task_key": "main"
+        }
+      ]
+    }
+  }
+]
diff --git a/acceptance/bundle/migrate/command/var_arg/terraform.tfstate b/acceptance/bundle/migrate/command/var_arg/terraform.tfstate
new file mode 100644
index 00000000000..434dbe1f911
--- /dev/null
+++ b/acceptance/bundle/migrate/command/var_arg/terraform.tfstate
@@ -0,0 +1,169 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "72aa60ee-0151-f001-7cd5-ea9bace71dc7",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_job",
+      "name": "test_job",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "always_running": false,
+            "budget_policy_id": null,
+            "continuous": [],
+            "control_run_state": false,
+            "dbt_task": [],
+            "deployment": [
+              {
+                "deployment_id": "",
+                "kind": "BUNDLE",
+                "metadata_file_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-var-test/dev/state/metadata.json",
+                "version_id": ""
+              }
+            ],
+            "description": null,
+            "edit_mode": "UI_LOCKED",
+            "email_notifications": [
+              {
+                "no_alert_for_skipped_runs": false,
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ],
+            "environment": [],
+            "existing_cluster_id": null,
+            "format": "MULTI_TASK",
+            "git_source": [],
+            "health": [],
+            "id": "8790614985789453000",
+            "job_cluster": [],
+            "library": [],
+            "max_concurrent_runs": 1,
+            "max_retries": 0,
+            "min_retry_interval_millis": 0,
+            "name": "Custom Job Name",
+            "new_cluster": [],
+            "notebook_task": [],
+            "notification_settings": [],
+            "parameter": [],
+            "parent_path": null,
+            "performance_target": null,
+            "pipeline_task": [],
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "python_wheel_task": [],
+            "queue": [
+              {
+                "enabled": true
+              }
+            ],
+            "retry_on_timeout": false,
+            "run_as": [
+              {
+                "group_name": "",
+                "service_principal_name": "",
+                "user_name": "tester@databricks.com"
+              }
+            ],
+            "run_job_task": [],
+            "schedule": [],
+            "spark_jar_task": [],
+            "spark_python_task": [],
+            "spark_submit_task": [],
+            "tags": null,
+            "task": [
+              {
+                "ai_runtime_task": [],
+                "alert_task": [],
+                "clean_rooms_notebook_task": [],
+                "compute": [],
+                "condition_task": [],
+                "dashboard_task": [],
+                "dbt_cloud_task": [],
+                "dbt_platform_task": [],
+                "dbt_task": [],
+                "depends_on": [],
+                "description": "",
+                "disable_auto_optimization": false,
+                "disabled": false,
+                "email_notifications": [
+                  {
+                    "no_alert_for_skipped_runs": false,
+                    "on_duration_warning_threshold_exceeded": [],
+                    "on_failure": [],
+                    "on_start": [],
+                    "on_streaming_backlog_exceeded": [],
+                    "on_success": []
+                  }
+                ],
+                "environment_key": "",
+                "existing_cluster_id": "",
+                "for_each_task": [],
+                "gen_ai_compute_task": [],
+                "health": [],
+                "job_cluster_key": "",
+                "library": [],
+                "max_retries": 0,
+                "min_retry_interval_millis": 0,
+                "new_cluster": [],
+                "notebook_task": [
+                  {
+                    "base_parameters": null,
+                    "notebook_path": "/Workspace/Users/tester@databricks.com/.bundle/migrate-var-test/dev/files/notebook",
+                    "source": "WORKSPACE",
+                    "warehouse_id": ""
+                  }
+                ],
+                "notification_settings": [],
+                "pipeline_task": [],
+                "power_bi_task": [],
+                "python_operator_task": [],
+                "python_wheel_task": [],
+                "retry_on_timeout": false,
+                "run_if": "ALL_SUCCESS",
+                "run_job_task": [],
+                "spark_jar_task": [],
+                "spark_python_task": [],
+                "spark_submit_task": [],
+                "sql_task": [],
+                "task_key": "main",
+                "timeout_seconds": 0,
+                "webhook_notifications": []
+              }
+            ],
+            "timeout_seconds": 0,
+            "timeouts": null,
+            "trigger": [],
+            "triggers": [],
+            "url": "[DATABRICKS_URL]/#job/8790614985789453000",
+            "usage_policy_id": null,
+            "webhook_notifications": [
+              {
+                "on_duration_warning_threshold_exceeded": [],
+                "on_failure": [],
+                "on_start": [],
+                "on_streaming_backlog_exceeded": [],
+                "on_success": []
+              }
+            ]
+          },
+          "sensitive_attributes": [],
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/migrate/command/var_arg/test.toml b/acceptance/bundle/migrate/command/var_arg/test.toml
new file mode 100644
index 00000000000..a030353d571
--- /dev/null
+++ b/acceptance/bundle/migrate/command/var_arg/test.toml
@@ -0,0 +1 @@
+RecordRequests = false
diff --git a/acceptance/bundle/migrate/dashboards/out.new_state.json b/acceptance/bundle/migrate/dashboards/out.new_state.json
deleted file mode 100644
index 695d14602a7..00000000000
--- a/acceptance/bundle/migrate/dashboards/out.new_state.json
+++ /dev/null
@@ -1,20 +0,0 @@
-{
- "state_version": 2,
- "cli_version": "[DEV_VERSION]",
- "lineage": "[UUID]",
- "serial": 3,
- "state": {
-  "resources.dashboards.dashboard1": {
-   "__id__": "[DASHBOARD1_ID]",
-   "state": {
-    "display_name": "my dashboard",
-    "embed_credentials": true,
-    "etag": "[NUMID]",
-    "parent_path": "/Workspace/Users/[USERNAME]",
-    "published": true,
-    "serialized_dashboard": "{\"pages\":[{\"name\":\"02724bf2\",\"displayName\":\"Dashboard test bundle-deploy-dashboard\"}]}\n",
-    "warehouse_id": "123456"
-   }
-  }
- }
-}
diff --git a/acceptance/bundle/migrate/dashboards/out.original_state.json b/acceptance/bundle/migrate/dashboards/out.original_state.json
deleted file mode 100644
index fd7f588ea60..00000000000
--- a/acceptance/bundle/migrate/dashboards/out.original_state.json
+++ /dev/null
@@ -1,43 +0,0 @@
-{
-  "version": 4,
-  "terraform_version": "1.5.5",
-  "serial": 1,
-  "lineage": "[UUID]",
-  "outputs": {},
-  "resources": [
-    {
-      "mode": "managed",
-      "type": "databricks_dashboard",
-      "name": "dashboard1",
-      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
-      "instances": [
-        {
-          "schema_version": 0,
-          "attributes": {
-            "create_time": "[TIMESTAMP]",
-            "dashboard_change_detected": false,
-            "dashboard_id": "[DASHBOARD1_ID]",
-            "dataset_catalog": null,
-            "dataset_schema": null,
-            "display_name": "my dashboard",
-            "embed_credentials": true,
-            "etag": "[NUMID]",
-            "file_path": null,
-            "id": "[DASHBOARD1_ID]",
-            "lifecycle_state": "ACTIVE",
-            "md5": "b4ab6aee48485b0b5e980761d3efe936",
-            "parent_path": "/Users/[USERNAME]",
-            "path": "/Users/[USERNAME]/my dashboard.lvdash.json",
-            "provider_config": [],
-            "serialized_dashboard": "{\"pages\":[{\"displayName\":\"Dashboard test bundle-deploy-dashboard\",\"name\":\"02724bf2\",\"pageType\":\"PAGE_TYPE_CANVAS\"}]}\n",
-            "update_time": "[TIMESTAMP]",
-            "warehouse_id": "123456"
-          },
-          "sensitive_attributes": [],
-          "private": "bnVsbA=="
-        }
-      ]
-    }
-  ],
-  "check_results": null
-}
diff --git a/acceptance/bundle/migrate/dashboards/out.plan_after_migrate.json b/acceptance/bundle/migrate/dashboards/out.plan_after_migrate.json
deleted file mode 100644
index 0f73ce72be1..00000000000
--- a/acceptance/bundle/migrate/dashboards/out.plan_after_migrate.json
+++ /dev/null
@@ -1,40 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 4,
-  "plan": {
-    "resources.dashboards.dashboard1": {
-      "action": "skip",
-      "remote_state": {
-        "create_time": "[TIMESTAMP]",
-        "dashboard_id": "[DASHBOARD1_ID]",
-        "display_name": "my dashboard",
-        "embed_credentials": true,
-        "etag": "[NUMID]",
-        "lifecycle_state": "ACTIVE",
-        "parent_path": "/Workspace/Users/[USERNAME]",
-        "path": "/Users/[USERNAME]/my dashboard.lvdash.json",
-        "published": true,
-        "serialized_dashboard": "{\"pages\":[{\"displayName\":\"Dashboard test bundle-deploy-dashboard\",\"name\":\"02724bf2\",\"pageType\":\"PAGE_TYPE_CANVAS\"}]}\n",
-        "update_time": "[TIMESTAMP]",
-        "warehouse_id": "123456"
-      },
-      "changes": {
-        "etag": {
-          "action": "skip",
-          "reason": "custom",
-          "old": "[NUMID]",
-          "remote": "[NUMID]"
-        },
-        "serialized_dashboard": {
-          "action": "skip",
-          "reason": "etag_based",
-          "old": "{\"pages\":[{\"name\":\"02724bf2\",\"displayName\":\"Dashboard test bundle-deploy-dashboard\"}]}\n",
-          "new": "{\"pages\":[{\"name\":\"02724bf2\",\"displayName\":\"Dashboard test bundle-deploy-dashboard\"}]}\n",
-          "remote": "{\"pages\":[{\"displayName\":\"Dashboard test bundle-deploy-dashboard\",\"name\":\"02724bf2\",\"pageType\":\"PAGE_TYPE_CANVAS\"}]}\n"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/migrate/dashboards/out.test.toml b/acceptance/bundle/migrate/dashboards/out.test.toml
deleted file mode 100644
index e90b6d5d1ba..00000000000
--- a/acceptance/bundle/migrate/dashboards/out.test.toml
+++ /dev/null
@@ -1,3 +0,0 @@
-Local = true
-Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/migrate/dashboards/output.txt b/acceptance/bundle/migrate/dashboards/output.txt
deleted file mode 100644
index 7cbd91a2f68..00000000000
--- a/acceptance/bundle/migrate/dashboards/output.txt
+++ /dev/null
@@ -1,57 +0,0 @@
-
->>> DATABRICKS_BUNDLE_ENGINE=terraform [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> [CLI] bundle deployment migrate
-Note: Migration should be done after a full deploy. Running plan now to verify that deployment was done:
-Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
-Success! Migrated 1 resources to direct engine state file: [TEST_TMP_DIR]/.databricks/bundle/default/resources.json
-
-Validate the migration by running "databricks bundle plan", there should be no actions planned.
-
-The state file is not synchronized to the workspace yet. To do that and finalize the migration, run "bundle deploy".
-
-To undo the migration, remove [TEST_TMP_DIR]/.databricks/bundle/default/resources.json and rename [TEST_TMP_DIR]/.databricks/bundle/default/terraform/terraform.tfstate.backup to [TEST_TMP_DIR]/.databricks/bundle/default/terraform/terraform.tfstate
-
-
->>> DATABRICKS_BUNDLE_ENGINE=terraform [CLI] bundle plan
-Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
-
->>> DATABRICKS_BUNDLE_ENGINE=terraform [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle plan
-Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
-
->>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle plan
-Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
-
->>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle plan -o json
-
->>> print_requests.py --get //dashboards
-
->>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle deploy --auto-approve
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> print_requests.py --get //dashboards
-
-=== Should show that it's already migrated
->>> musterr [CLI] bundle deployment migrate
-Error: already using direct engine
-Details: [TEST_TMP_DIR]/.databricks/bundle/default/resources.json: local direct state serial=5 lineage="[UUID]"
-
->>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle debug states
-[TEST_TMP_DIR]/.databricks/bundle/default/resources.json: local direct state serial=5 lineage="[UUID]"
-
->>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle debug states --force-pull
-resources.json: remote direct state serial=5 lineage="[UUID]"
-[TEST_TMP_DIR]/.databricks/bundle/default/resources.json: local direct state serial=5 lineage="[UUID]"
diff --git a/acceptance/bundle/migrate/dashboards/script b/acceptance/bundle/migrate/dashboards/script
deleted file mode 100755
index bd599144f94..00000000000
--- a/acceptance/bundle/migrate/dashboards/script
+++ /dev/null
@@ -1,38 +0,0 @@
-trace DATABRICKS_BUNDLE_ENGINE=terraform $CLI bundle deploy
-# Add all resource IDs to runtime replacements to avoid pattern matching ambiguity
-replace_ids.py
-print_state.py > out.original_state.json
-
-trace $CLI bundle deployment migrate 2>&1 | contains.py 'Migrated 1 resources'
-print_state.py > out.new_state.json
-
-# this is expected to warn because state does not match env var, but still succeed using state engine
-trace DATABRICKS_BUNDLE_ENGINE=terraform $CLI bundle plan
-trace DATABRICKS_BUNDLE_ENGINE=terraform $CLI bundle deploy
-
-rm out.requests.txt
-# Both DATABRICKS_BUNDLE_ENGINE=direct and DATABRICKS_BUNDLE_ENGINE= work
-# Badness: known issue with dashboards, will show up as 'recreate' see https://github.com/databricks/cli/pull/3966
-trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle plan | contains.py "1 unchanged"
-trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle plan | contains.py "1 unchanged"
-trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle plan -o json > out.plan_after_migrate.json
-trace print_requests.py --get //dashboards | contains.py 'engine/direct' > /dev/null
-
-trace DATABRICKS_BUNDLE_ENGINE="" $CLI bundle deploy --auto-approve
-trace print_requests.py --get //dashboards | jq '.headers["User-Agent"][0]' | contains.py 'engine/direct' > /dev/null
-
-title "Should show that it's already migrated"
-trace musterr $CLI bundle deployment migrate
-trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle debug states
-trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle debug states --force-pull
-
-rm out.requests.txt
-
-# Uncomment once 'recreate' bug is fixed
-#title "Update databricks.yml, run plan & update"
-#trace update_file.py databricks.yml dashboard DASHBOARD
-#trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle plan
-#trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle plan -o json > out.plan_update.json
-#trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle deploy
-
-#rm out.requests.txt
diff --git a/acceptance/bundle/migrate/default-python/out.test.toml b/acceptance/bundle/migrate/default-python/out.test.toml
deleted file mode 100644
index e90b6d5d1ba..00000000000
--- a/acceptance/bundle/migrate/default-python/out.test.toml
+++ /dev/null
@@ -1,3 +0,0 @@
-Local = true
-Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/migrate/default-python/output.txt b/acceptance/bundle/migrate/default-python/output.txt
deleted file mode 100644
index 15d49805b47..00000000000
--- a/acceptance/bundle/migrate/default-python/output.txt
+++ /dev/null
@@ -1,280 +0,0 @@
-
->>> [CLI] bundle init default-python --config-file ./input.json
-Welcome to the default Python template for Declarative Automation Bundles!
-
-Answer the following questions to customize your project.
-You can always change your configuration in the databricks.yml file later.
-
-Note that [DATABRICKS_URL] is used for initialization.
-(For information on how to change your profile, see https://docs.databricks.com/dev-tools/cli/profiles.html.)
-
-✨ Your new project has been created in the 'my_default_python' directory!
-
-To get started, refer to the project README.md file and the documentation at https://docs.databricks.com/dev-tools/bundles/index.html.
-
->>> DATABRICKS_BUNDLE_ENGINE=terraform [CLI] bundle deploy
-Building python_artifact...
-Uploading .databricks/bundle/dev/patched_wheels/python_artifact_my_default_python/my_default_python-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl...
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> print_state.py
-
->>> musterr [CLI] bundle deployment migrate
-Building python_artifact...
-Note: Migration should be done after a full deploy. Running plan now to verify that deployment was done:
-Building python_artifact...
-update jobs.sample_job
-
-Plan: 0 to add, 1 to change, 0 to delete, 1 unchanged
-Error: 'databricks bundle plan' shows actions planned, aborting migration. Please run 'databricks bundle deploy' first to ensure your bundle is up to date, If actions persist after deploy, skip plan check with --noplancheck option
-
->>> [CLI] bundle deployment migrate --noplancheck
-Building python_artifact...
-Success! Migrated 2 resources to direct engine state file: [TEST_TMP_DIR]/my_default_python/.databricks/bundle/dev/resources.json
-
-Validate the migration by running "databricks bundle plan", there should be no actions planned.
-
-The state file is not synchronized to the workspace yet. To do that and finalize the migration, run "bundle deploy".
-
-To undo the migration, remove [TEST_TMP_DIR]/my_default_python/.databricks/bundle/dev/resources.json and rename [TEST_TMP_DIR]/my_default_python/.databricks/bundle/dev/terraform/terraform.tfstate.backup to [TEST_TMP_DIR]/my_default_python/.databricks/bundle/dev/terraform/terraform.tfstate
-
-
->>> print_state.py
-
->>> jq .. | .libraries? | select(.) ../out.state_after_migration.json
-[
-  {
-    "whl": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][1]-py3-none-any.whl"
-  }
-]
-[
-  {
-    "whl": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][1]-py3-none-any.whl"
-  }
-]
-[
-  {
-    "glob": {
-      "include": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python_etl/transformations/**"
-    }
-  }
-]
-
->>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle plan
-Building python_artifact...
-update jobs.sample_job
-
-Plan: 0 to add, 1 to change, 0 to delete, 1 unchanged
-
->>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle plan -o json
-Building python_artifact...
-
->>> jq .plan[] | .changes ../out.plan_after_migration.json
-{
-  "email_notifications": {
-    "action": "skip",
-    "reason": "empty",
-    "remote": {}
-  },
-  "tasks[task_key='notebook_task'].email_notifications": {
-    "action": "skip",
-    "reason": "empty",
-    "remote": {}
-  },
-  "tasks[task_key='notebook_task'].libraries[0].whl": {
-    "action": "update",
-    "old": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][1]-py3-none-any.whl",
-    "new": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][2]-py3-none-any.whl",
-    "remote": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl"
-  },
-  "tasks[task_key='notebook_task'].notebook_task.source": {
-    "action": "skip",
-    "reason": "backend_default",
-    "remote": "WORKSPACE"
-  },
-  "tasks[task_key='notebook_task'].run_if": {
-    "action": "skip",
-    "reason": "backend_default",
-    "remote": "ALL_SUCCESS"
-  },
-  "tasks[task_key='notebook_task'].timeout_seconds": {
-    "action": "skip",
-    "reason": "empty",
-    "remote": 0
-  },
-  "tasks[task_key='python_wheel_task'].email_notifications": {
-    "action": "skip",
-    "reason": "empty",
-    "remote": {}
-  },
-  "tasks[task_key='python_wheel_task'].libraries[0].whl": {
-    "action": "update",
-    "old": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][1]-py3-none-any.whl",
-    "new": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][2]-py3-none-any.whl",
-    "remote": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl"
-  },
-  "tasks[task_key='python_wheel_task'].run_if": {
-    "action": "skip",
-    "reason": "backend_default",
-    "remote": "ALL_SUCCESS"
-  },
-  "tasks[task_key='python_wheel_task'].timeout_seconds": {
-    "action": "skip",
-    "reason": "empty",
-    "remote": 0
-  },
-  "tasks[task_key='refresh_pipeline'].email_notifications": {
-    "action": "skip",
-    "reason": "empty",
-    "remote": {}
-  },
-  "tasks[task_key='refresh_pipeline'].run_if": {
-    "action": "skip",
-    "reason": "backend_default",
-    "remote": "ALL_SUCCESS"
-  },
-  "tasks[task_key='refresh_pipeline'].timeout_seconds": {
-    "action": "skip",
-    "reason": "empty",
-    "remote": 0
-  },
-  "timeout_seconds": {
-    "action": "skip",
-    "reason": "empty",
-    "remote": 0
-  },
-  "webhook_notifications": {
-    "action": "skip",
-    "reason": "empty",
-    "remote": {}
-  }
-}
-{
-  "storage": {
-    "action": "skip",
-    "reason": "backend_default",
-    "remote": "dbfs:/pipelines/[UUID]"
-  }
-}
-
->>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle deploy
-Building python_artifact...
-Uploading .databricks/bundle/dev/patched_wheels/python_artifact_my_default_python/my_default_python-0.0.1+[UNIX_TIME_NANOS][3]-py3-none-any.whl...
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> print_state.py
-
->>> diff.py ../out.state_after_migration.json ../out.state_after_deploy.json
---- ../out.state_after_migration.json
-+++ ../out.state_after_deploy.json
-@@ -3,5 +3,5 @@
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-- "serial": 5,
-+ "serial": 6,
-  "state": {
-   "resources.jobs.sample_job": {
-
-=== Extra plan: should have no drift
->>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle plan
-Building python_artifact...
-update jobs.sample_job
-
-Plan: 0 to add, 1 to change, 0 to delete, 1 unchanged
-
->>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle plan -o json
-Building python_artifact...
-
->>> jq .plan[] | .changes ../out.plan_after_migration.json
-{
-  "email_notifications": {
-    "action": "skip",
-    "reason": "empty",
-    "remote": {}
-  },
-  "tasks[task_key='notebook_task'].email_notifications": {
-    "action": "skip",
-    "reason": "empty",
-    "remote": {}
-  },
-  "tasks[task_key='notebook_task'].libraries[0].whl": {
-    "action": "update",
-    "old": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][1]-py3-none-any.whl",
-    "new": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][2]-py3-none-any.whl",
-    "remote": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl"
-  },
-  "tasks[task_key='notebook_task'].notebook_task.source": {
-    "action": "skip",
-    "reason": "backend_default",
-    "remote": "WORKSPACE"
-  },
-  "tasks[task_key='notebook_task'].run_if": {
-    "action": "skip",
-    "reason": "backend_default",
-    "remote": "ALL_SUCCESS"
-  },
-  "tasks[task_key='notebook_task'].timeout_seconds": {
-    "action": "skip",
-    "reason": "empty",
-    "remote": 0
-  },
-  "tasks[task_key='python_wheel_task'].email_notifications": {
-    "action": "skip",
-    "reason": "empty",
-    "remote": {}
-  },
-  "tasks[task_key='python_wheel_task'].libraries[0].whl": {
-    "action": "update",
-    "old": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][1]-py3-none-any.whl",
-    "new": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][2]-py3-none-any.whl",
-    "remote": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl"
-  },
-  "tasks[task_key='python_wheel_task'].run_if": {
-    "action": "skip",
-    "reason": "backend_default",
-    "remote": "ALL_SUCCESS"
-  },
-  "tasks[task_key='python_wheel_task'].timeout_seconds": {
-    "action": "skip",
-    "reason": "empty",
-    "remote": 0
-  },
-  "tasks[task_key='refresh_pipeline'].email_notifications": {
-    "action": "skip",
-    "reason": "empty",
-    "remote": {}
-  },
-  "tasks[task_key='refresh_pipeline'].run_if": {
-    "action": "skip",
-    "reason": "backend_default",
-    "remote": "ALL_SUCCESS"
-  },
-  "tasks[task_key='refresh_pipeline'].timeout_seconds": {
-    "action": "skip",
-    "reason": "empty",
-    "remote": 0
-  },
-  "timeout_seconds": {
-    "action": "skip",
-    "reason": "empty",
-    "remote": 0
-  },
-  "webhook_notifications": {
-    "action": "skip",
-    "reason": "empty",
-    "remote": {}
-  }
-}
-{
-  "storage": {
-    "action": "skip",
-    "reason": "backend_default",
-    "remote": "dbfs:/pipelines/[UUID]"
-  }
-}
diff --git a/acceptance/bundle/migrate/default-python/script b/acceptance/bundle/migrate/default-python/script
deleted file mode 100755
index c9b585dbea7..00000000000
--- a/acceptance/bundle/migrate/default-python/script
+++ /dev/null
@@ -1,26 +0,0 @@
-export DATABRICKS_BUNDLE_ENGINE=
-trace $CLI bundle init default-python --config-file ./input.json
-cd my_default_python
-
-trace DATABRICKS_BUNDLE_ENGINE=terraform $CLI bundle deploy
-trace print_state.py > ../out.state_original.json
-
-trace musterr $CLI bundle deployment migrate
-trace $CLI bundle deployment migrate --noplancheck
-
-trace print_state.py > ../out.state_after_migration.json
-trace jq '.. | .libraries? | select(.)' ../out.state_after_migration.json
-
-trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle plan
-trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle plan -o json > ../out.plan_after_migration.json
-trace jq '.plan[] | .changes' ../out.plan_after_migration.json  # Badness: contains changes for whl and num_workers
-trace DATABRICKS_BUNDLE_ENGINE="" $CLI bundle deploy
-
-trace print_state.py > ../out.state_after_deploy.json
-trace diff.py ../out.state_after_migration.json ../out.state_after_deploy.json
-rm ../out.state_after_deploy.json
-
-title "Extra plan: should have no drift"
-trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle plan
-trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle plan -o json > ../out.plan_after_deploy.json
-trace jq '.plan[] | .changes' ../out.plan_after_migration.json  # Badness: contains changes for whl
diff --git a/acceptance/bundle/migrate/engine-config-direct/out.test.toml b/acceptance/bundle/migrate/engine-config-direct/out.test.toml
deleted file mode 100644
index e90b6d5d1ba..00000000000
--- a/acceptance/bundle/migrate/engine-config-direct/out.test.toml
+++ /dev/null
@@ -1,3 +0,0 @@
-Local = true
-Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/migrate/engine-config-direct/output.txt b/acceptance/bundle/migrate/engine-config-direct/output.txt
deleted file mode 100644
index 0a90ee8f9d5..00000000000
--- a/acceptance/bundle/migrate/engine-config-direct/output.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-
->>> musterr [CLI] bundle deployment migrate
-Error: This command migrates the existing Terraform state file (terraform.tfstate) to a direct deployment state file (resources.json). However, no existing local or remote state was found.
-
-To start using direct engine, set "engine: direct" under bundle in your databricks.yml or deploy with DATABRICKS_BUNDLE_ENGINE=direct env var set.
diff --git a/acceptance/bundle/migrate/engine-config-terraform/out.test.toml b/acceptance/bundle/migrate/engine-config-terraform/out.test.toml
deleted file mode 100644
index e90b6d5d1ba..00000000000
--- a/acceptance/bundle/migrate/engine-config-terraform/out.test.toml
+++ /dev/null
@@ -1,3 +0,0 @@
-Local = true
-Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/migrate/engine-config-terraform/output.txt b/acceptance/bundle/migrate/engine-config-terraform/output.txt
deleted file mode 100644
index 5169f045260..00000000000
--- a/acceptance/bundle/migrate/engine-config-terraform/output.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-
->>> musterr [CLI] bundle deployment migrate
-Error: bundle.engine is set to "terraform". Migration requires "engine: direct" or no engine setting. Change the setting to "engine: direct" and retry
diff --git a/acceptance/bundle/migrate/grants/out.new_state.json b/acceptance/bundle/migrate/grants/out.new_state.json
deleted file mode 100644
index 7a24ba0f3c2..00000000000
--- a/acceptance/bundle/migrate/grants/out.new_state.json
+++ /dev/null
@@ -1,110 +0,0 @@
-{
- "state_version": 2,
- "cli_version": "[DEV_VERSION]",
- "lineage": "[UUID]",
- "serial": 9,
- "state": {
-  "resources.registered_models.my_registered_model": {
-   "__id__": "main.schema_grants.mymodel",
-   "state": {
-    "catalog_name": "main",
-    "comment": "mycomment",
-    "name": "mymodel",
-    "schema_name": "schema_grants"
-   },
-   "depends_on": [
-    {
-     "node": "resources.schemas.my_schema",
-     "label": "${resources.schemas.my_schema.name}"
-    }
-   ]
-  },
-  "resources.registered_models.my_registered_model.grants": {
-   "__id__": "function/main.schema_grants.mymodel",
-   "state": {
-    "securable_type": "function",
-    "full_name": "main.schema_grants.mymodel",
-    "__embed__": [
-     {
-      "principal": "deco-test-user@databricks.com",
-      "privileges": [
-       "APPLY_TAG"
-      ]
-     }
-    ]
-   },
-   "depends_on": [
-    {
-     "node": "resources.registered_models.my_registered_model",
-     "label": "${resources.registered_models.my_registered_model.id}"
-    }
-   ]
-  },
-  "resources.schemas.my_schema": {
-   "__id__": "main.schema_grants",
-   "state": {
-    "catalog_name": "main",
-    "name": "schema_grants"
-   }
-  },
-  "resources.schemas.my_schema.grants": {
-   "__id__": "schema/main.schema_grants",
-   "state": {
-    "securable_type": "schema",
-    "full_name": "main.schema_grants",
-    "__embed__": [
-     {
-      "principal": "deco-test-user@databricks.com",
-      "privileges": [
-       "CREATE_TABLE",
-       "USE_SCHEMA"
-      ]
-     }
-    ]
-   },
-   "depends_on": [
-    {
-     "node": "resources.schemas.my_schema",
-     "label": "${resources.schemas.my_schema.id}"
-    }
-   ]
-  },
-  "resources.volumes.my_volume": {
-   "__id__": "main.schema_grants.volume_name",
-   "state": {
-    "catalog_name": "main",
-    "name": "volume_name",
-    "schema_name": "schema_grants",
-    "volume_type": "MANAGED"
-   },
-   "depends_on": [
-    {
-     "node": "resources.schemas.my_schema",
-     "label": "${resources.schemas.my_schema.name}"
-    }
-   ]
-  },
-  "resources.volumes.my_volume.grants": {
-   "__id__": "volume/main.schema_grants.volume_name",
-   "state": {
-    "securable_type": "volume",
-    "full_name": "main.schema_grants.volume_name",
-    "__embed__": [
-     {
-      "principal": "deco-test-user@databricks.com",
-      "privileges": [
-       "READ_VOLUME",
-       "WRITE_VOLUME"
-      ]
-     }
-    ]
-   },
-   "depends_on": [
-    {
-     "node": "resources.volumes.my_volume",
-     "label": "${resources.volumes.my_volume.id}"
-    }
-   ]
-  }
- }
-}
diff --git a/acceptance/bundle/migrate/grants/out.original_state.json b/acceptance/bundle/migrate/grants/out.original_state.json
deleted file mode 100644
index a410fff585a..00000000000
--- a/acceptance/bundle/migrate/grants/out.original_state.json
+++ /dev/null
@@ -1,229 +0,0 @@
-{
-  "version": 4,
-  "terraform_version": "1.5.5",
-  "serial": 7,
-  "lineage": "[UUID]",
-  "outputs": {},
-  "resources": [
-    {
-      "mode": "managed",
-      "type": "databricks_grants",
-      "name": "registered_model_my_registered_model",
-      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
-      "instances": [
-        {
-          "schema_version": 0,
-          "attributes": {
-            "catalog": null,
-            "credential": null,
-            "external_location": null,
-            "foreign_connection": null,
-            "function": "main.schema_grants.mymodel",
-            "grant": [
-              {
-                "principal": "deco-test-user@databricks.com",
-                "privileges": [
-                  "APPLY_TAG"
-                ]
-              }
-            ],
-            "id": "function/main.schema_grants.mymodel",
-            "metastore": null,
-            "model": null,
-            "pipeline": null,
-            "provider_config": [],
-            "recipient": null,
-            "schema": null,
-            "share": null,
-            "storage_credential": null,
-            "table": null,
-            "volume": null
-          },
-          "sensitive_attributes": [],
-          "private": "bnVsbA==",
-          "dependencies": [
-            "databricks_registered_model.my_registered_model",
-            "databricks_schema.my_schema"
-          ]
-        }
-      ]
-    },
-    {
-      "mode": "managed",
-      "type": "databricks_grants",
-      "name": "schema_my_schema",
-      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
-      "instances": [
-        {
-          "schema_version": 0,
-          "attributes": {
-            "catalog": null,
-            "credential": null,
-            "external_location": null,
-            "foreign_connection": null,
-            "function": null,
-            "grant": [
-              {
-                "principal": "deco-test-user@databricks.com",
-                "privileges": [
-                  "CREATE_TABLE",
-                  "USE_SCHEMA"
-                ]
-              }
-            ],
-            "id": "schema/main.schema_grants",
-            "metastore": null,
-            "model": null,
-            "pipeline": null,
-            "provider_config": [],
-            "recipient": null,
-            "schema": "main.schema_grants",
-            "share": null,
-            "storage_credential": null,
-            "table": null,
-            "volume": null
-          },
-          "sensitive_attributes": [],
-          "private": "bnVsbA==",
-          "dependencies": [
-            "databricks_schema.my_schema"
-          ]
-        }
-      ]
-    },
-    {
-      "mode": "managed",
-      "type": "databricks_grants",
-      "name": "volume_my_volume",
-      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
-      "instances": [
-        {
-          "schema_version": 0,
-          "attributes": {
-            "catalog": null,
-            "credential": null,
-            "external_location": null,
-            "foreign_connection": null,
-            "function": null,
-            "grant": [
-              {
-                "principal": "deco-test-user@databricks.com",
-                "privileges": [
-                  "READ_VOLUME",
-                  "WRITE_VOLUME"
-                ]
-              }
-            ],
-            "id": "volume/main.schema_grants.volume_name",
-            "metastore": null,
-            "model": null,
-            "pipeline": null,
-            "provider_config": [],
-            "recipient": null,
-            "schema": null,
-            "share": null,
-            "storage_credential": null,
-            "table": null,
-            "volume": "main.schema_grants.volume_name"
-          },
-          "sensitive_attributes": [],
-          "private": "bnVsbA==",
-          "dependencies": [
-            "databricks_schema.my_schema",
-            "databricks_volume.my_volume"
-          ]
-        }
-      ]
-    },
-    {
-      "mode": "managed",
-      "type": "databricks_registered_model",
-      "name": "my_registered_model",
-      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
-      "instances": [
-        {
-          "schema_version": 0,
-          "attributes": {
-            "aliases": [],
-            "browse_only": false,
-            "catalog_name": "main",
-            "comment": "mycomment",
-            "created_at": [UNIX_TIME_MILLIS][0],
-            "created_by": "[USERNAME]",
-            "full_name": "main.schema_grants.mymodel",
-            "id": "main.schema_grants.mymodel",
-            "metastore_id": "[UUID]",
-            "name": "mymodel",
-            "owner": "[USERNAME]",
-            "provider_config": [],
-            "schema_name": "schema_grants",
-            "storage_location": null,
-            "updated_at": [UNIX_TIME_MILLIS][0],
-            "updated_by": "[USERNAME]"
-          },
-          "sensitive_attributes": [],
-          "private": "bnVsbA==",
-          "dependencies": [
-            "databricks_schema.my_schema"
-          ]
-        }
-      ]
-    },
-    {
-      "mode": "managed",
-      "type": "databricks_schema",
-      "name": "my_schema",
-      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
-      "instances": [
-        {
-          "schema_version": 0,
-          "attributes": {
-            "catalog_name": "main",
-            "comment": null,
-            "enable_predictive_optimization": "INHERIT",
-            "force_destroy": true,
-            "id": "main.schema_grants",
-            "metastore_id": "[UUID]",
-            "name": "schema_grants",
-            "owner": "[USERNAME]",
-            "properties": null,
-            "provider_config": [],
-            "schema_id": "[UUID]",
-            "storage_root": null
-          },
-          "sensitive_attributes": [],
-          "private": "bnVsbA=="
-        }
-      ]
-    },
-    {
-      "mode": "managed",
-      "type": "databricks_volume",
-      "name": "my_volume",
-      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
-      "instances": [
-        {
-          "schema_version": 0,
-          "attributes": {
-            "catalog_name": "main",
-            "comment": null,
-            "id": "main.schema_grants.volume_name",
-            "name": "volume_name",
-            "owner": "[USERNAME]",
-            "provider_config": [],
-            "schema_name": "schema_grants",
-            "storage_location": "s3://[METASTORE_NAME]/metastore/[UUID]/volumes/[UUID]",
-            "volume_path": "/Volumes/main/schema_grants/volume_name",
-            "volume_type": "MANAGED"
-          },
-          "sensitive_attributes": [],
-          "private": "bnVsbA==",
-          "dependencies": [
-            "databricks_schema.my_schema"
-          ]
-        }
-      ]
-    }
-  ],
-  "check_results": null
-}
diff --git a/acceptance/bundle/migrate/grants/out.test.toml b/acceptance/bundle/migrate/grants/out.test.toml
deleted file mode 100644
index e90b6d5d1ba..00000000000
--- a/acceptance/bundle/migrate/grants/out.test.toml
+++ /dev/null
@@ -1,3 +0,0 @@
-Local = true
-Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/migrate/grants/output.txt b/acceptance/bundle/migrate/grants/output.txt
deleted file mode 100644
index 44ec67fb48a..00000000000
--- a/acceptance/bundle/migrate/grants/output.txt
+++ /dev/null
@@ -1,55 +0,0 @@
-
->>> DATABRICKS_BUNDLE_ENGINE=terraform [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> [CLI] bundle deployment migrate
-Note: Migration should be done after a full deploy. Running plan now to verify that deployment was done:
-Plan: 0 to add, 0 to change, 0 to delete, 6 unchanged
-Success! Migrated 6 resources to direct engine state file: [TEST_TMP_DIR]/.databricks/bundle/default/resources.json
-
-Validate the migration by running "databricks bundle plan", there should be no actions planned.
-
-The state file is not synchronized to the workspace yet. To do that and finalize the migration, run "bundle deploy".
-
-To undo the migration, remove [TEST_TMP_DIR]/.databricks/bundle/default/resources.json and rename [TEST_TMP_DIR]/.databricks/bundle/default/terraform/terraform.tfstate.backup to [TEST_TMP_DIR]/.databricks/bundle/default/terraform/terraform.tfstate
-
-
->>> DATABRICKS_BUNDLE_ENGINE=terraform [CLI] bundle plan
-Plan: 0 to add, 0 to change, 0 to delete, 6 unchanged
-
->>> DATABRICKS_BUNDLE_ENGINE=terraform [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle plan
-Plan: 0 to add, 0 to change, 0 to delete, 6 unchanged
-
->>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle plan
-Plan: 0 to add, 0 to change, 0 to delete, 6 unchanged
-
->>> print_requests.py --get //unity-catalog/permissions
-
->>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> print_requests.py --get //unity-catalog/permissions
-
-=== Should show that it's already migrated
->>> musterr [CLI] bundle deployment migrate
-Error: already using direct engine
-Details: [TEST_TMP_DIR]/.databricks/bundle/default/resources.json: local direct state serial=11 lineage="[UUID]"
-
->>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle debug states
-[TEST_TMP_DIR]/.databricks/bundle/default/resources.json: local direct state serial=11 lineage="[UUID]"
-
->>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle debug states --force-pull
-resources.json: remote direct state serial=11 lineage="[UUID]"
-[TEST_TMP_DIR]/.databricks/bundle/default/resources.json: local direct state serial=11 lineage="[UUID]"
diff --git a/acceptance/bundle/migrate/grants/script b/acceptance/bundle/migrate/grants/script
deleted file mode 100755
index 5686ab0563c..00000000000
--- a/acceptance/bundle/migrate/grants/script
+++ /dev/null
@@ -1,26 +0,0 @@
-export DATABRICKS_BUNDLE_ENGINE=
-trace DATABRICKS_BUNDLE_ENGINE=terraform $CLI bundle deploy
-print_state.py > out.original_state.json
-
-trace $CLI bundle deployment migrate 2>&1 | contains.py 'Migrated 6 resources'
-print_state.py > out.new_state.json
-
-# this is expected to warn because state does not match env var, but still succeed using state engine
-trace DATABRICKS_BUNDLE_ENGINE=terraform $CLI bundle plan
-trace DATABRICKS_BUNDLE_ENGINE=terraform $CLI bundle deploy
-
-rm out.requests.txt
-# Both DATABRICKS_BUNDLE_ENGINE=direct and DATABRICKS_BUNDLE_ENGINE= work
-trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle plan | contains.py "6 unchanged"
-trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle plan | contains.py "6 unchanged"
-trace print_requests.py --get //unity-catalog/permissions | contains.py 'engine/direct' > /dev/null
-
-trace DATABRICKS_BUNDLE_ENGINE="" $CLI bundle deploy
-trace print_requests.py --get //unity-catalog/permissions | jq '.headers["User-Agent"][0]' | contains.py 'engine/direct' > LOG.requests_deploy.txt
-
-title "Should show that it's already migrated"
-trace musterr $CLI bundle deployment migrate
-trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle debug states
-trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle debug states --force-pull
-
-rm out.requests.txt
diff --git a/acceptance/bundle/migrate/permissions/out.new_state.json b/acceptance/bundle/migrate/permissions/out.new_state.json
deleted file mode 100644
index b020b1401d2..00000000000
--- a/acceptance/bundle/migrate/permissions/out.new_state.json
+++ /dev/null
@@ -1,95 +0,0 @@
-{
- "state_version": 2,
- "cli_version": "[DEV_VERSION]",
- "lineage": "[UUID]",
- "serial": 7,
- "state": {
-  "resources.jobs.test_job": {
-   "__id__": "[NUMID]",
-   "state": {
-    "deployment": {
-     "kind": "BUNDLE",
-     "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/default/state/metadata.json"
-    },
-    "edit_mode": "UI_LOCKED",
-    "format": "MULTI_TASK",
-    "max_concurrent_runs": 1,
-    "name": "Test Migration Job",
-    "queue": {
-     "enabled": true
-    },
-    "tasks": [
-     {
-      "notebook_task": {
-       "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/default/files/notebook"
-      },
-      "task_key": "main"
-     }
-    ]
-   }
-  },
-  "resources.jobs.test_job.permissions": {
-   "__id__": "/jobs/[NUMID]",
-   "state": {
-    "object_id": "/jobs/[NUMID]",
-    "__embed__": [
-     {
-      "level": "CAN_VIEW",
-      "user_name": "viewer@databricks.com"
-     },
-     {
-      "level": "IS_OWNER",
-      "user_name": "[USERNAME]"
-     }
-    ]
-   },
-   "depends_on": [
-    {
-     "node": "resources.jobs.test_job",
-     "label": "${resources.jobs.test_job.id}"
-    }
-   ]
-  },
-  "resources.pipelines.test_pipeline": {
-   "__id__": "[UUID]",
-   "state": {
-    "channel": "CURRENT",
-    "deployment": {
-     "kind": "BUNDLE",
-     "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/default/state/metadata.json"
-    },
-    "edition": "ADVANCED",
-    "libraries": [
-     {
-      "notebook": {
-       "path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/default/files/pipeline"
-      }
-     }
-    ],
-    "name": "Test Migration Pipeline"
-   }
-  },
-  "resources.pipelines.test_pipeline.permissions": {
-   "__id__": "/pipelines/[UUID]",
-   "state": {
-    "object_id": "/pipelines/[UUID]",
-    "__embed__": [
-     {
-      "level": "CAN_MANAGE",
-      "user_name": "manager@databricks.com"
-     },
-     {
-      "level": "IS_OWNER",
-      "user_name": "[USERNAME]"
-     }
-    ]
-   },
-   "depends_on": [
-    {
-     "node": "resources.pipelines.test_pipeline",
-     "label": "${resources.pipelines.test_pipeline.id}"
-    }
-   ]
-  }
- }
-}
diff --git a/acceptance/bundle/migrate/permissions/out.original_state.json b/acceptance/bundle/migrate/permissions/out.original_state.json
deleted file mode 100644
index 866dadca8ac..00000000000
--- a/acceptance/bundle/migrate/permissions/out.original_state.json
+++ /dev/null
@@ -1,358 +0,0 @@
-{
-  "version": 4,
-  "terraform_version": "1.5.5",
-  "serial": 5,
-  "lineage": "[UUID]",
-  "outputs": {},
-  "resources": [
-    {
-      "mode": "managed",
-      "type": "databricks_job",
-      "name": "test_job",
-      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
-      "instances": [
-        {
-          "schema_version": 2,
-          "attributes": {
-            "always_running": false,
-            "budget_policy_id": null,
-            "continuous": [],
-            "control_run_state": false,
-            "dbt_task": [],
-            "deployment": [
-              {
-                "kind": "BUNDLE",
-                "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/default/state/metadata.json"
-              }
-            ],
-            "description": null,
-            "edit_mode": "UI_LOCKED",
-            "email_notifications": [
-              {
-                "no_alert_for_skipped_runs": false,
-                "on_duration_warning_threshold_exceeded": [],
-                "on_failure": [],
-                "on_start": [],
-                "on_streaming_backlog_exceeded": [],
-                "on_success": []
-              }
-            ],
-            "environment": [],
-            "existing_cluster_id": null,
-            "format": "MULTI_TASK",
-            "git_source": [],
-            "health": [],
-            "id": "[NUMID]",
-            "job_cluster": [],
-            "library": [],
-            "max_concurrent_runs": 1,
-            "max_retries": 0,
-            "min_retry_interval_millis": 0,
-            "name": "Test Migration Job",
-            "new_cluster": [],
-            "notebook_task": [],
-            "notification_settings": [],
-            "parameter": [],
-            "performance_target": null,
-            "pipeline_task": [],
-            "provider_config": [],
-            "python_wheel_task": [],
-            "queue": [
-              {
-                "enabled": true
-              }
-            ],
-            "retry_on_timeout": false,
-            "run_as": [
-              {
-                "group_name": "",
-                "service_principal_name": "",
-                "user_name": "[USERNAME]"
-              }
-            ],
-            "run_job_task": [],
-            "schedule": [],
-            "spark_jar_task": [],
-            "spark_python_task": [],
-            "spark_submit_task": [],
-            "tags": null,
-            "task": [
-              {
-                "alert_task": [],
-                "clean_rooms_notebook_task": [],
-                "compute": [],
-                "condition_task": [],
-                "dashboard_task": [],
-                "dbt_cloud_task": [],
-                "dbt_platform_task": [],
-                "dbt_task": [],
-                "depends_on": [],
-                "description": "",
-                "disable_auto_optimization": false,
-                "disabled": false,
-                "email_notifications": [
-                  {
-                    "no_alert_for_skipped_runs": false,
-                    "on_duration_warning_threshold_exceeded": [],
-                    "on_failure": [],
-                    "on_start": [],
-                    "on_streaming_backlog_exceeded": [],
-                    "on_success": []
-                  }
-                ],
-                "environment_key": "",
-                "existing_cluster_id": "",
-                "for_each_task": [],
-                "gen_ai_compute_task": [],
-                "health": [],
-                "job_cluster_key": "",
-                "library": [],
-                "max_retries": 0,
-                "min_retry_interval_millis": 0,
-                "new_cluster": [],
-                "notebook_task": [
-                  {
-                    "base_parameters": null,
-                    "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/default/files/notebook",
-                    "source": "WORKSPACE",
-                    "warehouse_id": ""
-                  }
-                ],
-                "notification_settings": [],
-                "pipeline_task": [],
-                "power_bi_task": [],
-                "python_wheel_task": [],
-                "retry_on_timeout": false,
-                "run_if": "ALL_SUCCESS",
-                "run_job_task": [],
-                "spark_jar_task": [],
-                "spark_python_task": [],
-                "spark_submit_task": [],
-                "sql_task": [],
-                "task_key": "main",
-                "timeout_seconds": 0,
-                "webhook_notifications": []
-              }
-            ],
-            "timeout_seconds": 0,
-            "timeouts": null,
-            "trigger": [],
-            "url": "[DATABRICKS_URL]/#job/[NUMID]",
-            "usage_policy_id": null,
-            "webhook_notifications": [
-              {
-                "on_duration_warning_threshold_exceeded": [],
-                "on_failure": [],
-                "on_start": [],
-                "on_streaming_backlog_exceeded": [],
-                "on_success": []
-              }
-            ]
-          },
-          "sensitive_attributes": [],
-          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
-        }
-      ]
-    },
-    {
-      "mode": "managed",
-      "type": "databricks_permissions",
-      "name": "job_test_job",
-      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
-      "instances": [
-        {
-          "schema_version": 0,
-          "attributes": {
-            "access_control": [
-              {
-                "group_name": "",
-                "permission_level": "CAN_VIEW",
-                "service_principal_name": "",
-                "user_name": "viewer@databricks.com"
-              },
-              {
-                "group_name": "",
-                "permission_level": "IS_OWNER",
-                "service_principal_name": "",
-                "user_name": "[USERNAME]"
-              }
-            ],
-            "alert_v2_id": null,
-            "app_name": null,
-            "authorization": null,
-            "cluster_id": null,
-            "cluster_policy_id": null,
-            "dashboard_id": null,
-            "database_instance_name": null,
-            "database_project_name": null,
-            "directory_id": null,
-            "directory_path": null,
-            "experiment_id": null,
-            "id": "/jobs/[NUMID]",
-            "instance_pool_id": null,
-            "job_id": "[NUMID]",
-            "notebook_id": null,
-            "notebook_path": null,
-            "object_type": "job",
-            "pipeline_id": null,
-            "provider_config": [],
-            "registered_model_id": null,
-            "repo_id": null,
-            "repo_path": null,
-            "serving_endpoint_id": null,
-            "sql_alert_id": null,
-            "sql_dashboard_id": null,
-            "sql_endpoint_id": null,
-            "sql_query_id": null,
-            "vector_search_endpoint_id": null,
-            "workspace_file_id": null,
-            "workspace_file_path": null
-          },
-          "sensitive_attributes": [],
-          "private": "bnVsbA==",
-          "dependencies": [
-            "databricks_job.test_job"
-          ]
-        }
-      ]
-    },
-    {
-      "mode": "managed",
-      "type": "databricks_permissions",
-      "name": "pipeline_test_pipeline",
-      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
-      "instances": [
-        {
-          "schema_version": 0,
-          "attributes": {
-            "access_control": [
-              {
-                "group_name": "",
-                "permission_level": "CAN_MANAGE",
-                "service_principal_name": "",
-                "user_name": "manager@databricks.com"
-              },
-              {
-                "group_name": "",
-                "permission_level": "IS_OWNER",
-                "service_principal_name": "",
-                "user_name": "[USERNAME]"
-              }
-            ],
-            "alert_v2_id": null,
-            "app_name": null,
-            "authorization": null,
-            "cluster_id": null,
-            "cluster_policy_id": null,
-            "dashboard_id": null,
-            "database_instance_name": null,
-            "database_project_name": null,
-            "directory_id": null,
-            "directory_path": null,
-            "experiment_id": null,
-            "id": "/pipelines/[UUID]",
-            "instance_pool_id": null,
-            "job_id": null,
-            "notebook_id": null,
-            "notebook_path": null,
-            "object_type": "pipelines",
-            "pipeline_id": "[UUID]",
-            "provider_config": [],
-            "registered_model_id": null,
-            "repo_id": null,
-            "repo_path": null,
-            "serving_endpoint_id": null,
-            "sql_alert_id": null,
-            "sql_dashboard_id": null,
-            "sql_endpoint_id": null,
-            "sql_query_id": null,
-            "vector_search_endpoint_id": null,
-            "workspace_file_id": null,
-            "workspace_file_path": null
-          },
-          "sensitive_attributes": [],
-          "private": "bnVsbA==",
-          "dependencies": [
-            "databricks_pipeline.test_pipeline"
-          ]
-        }
-      ]
-    },
-    {
-      "mode": "managed",
-      "type": "databricks_pipeline",
-      "name": "test_pipeline",
-      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
-      "instances": [
-        {
-          "schema_version": 0,
-          "attributes": {
-            "allow_duplicate_names": false,
-            "budget_policy_id": null,
-            "catalog": null,
-            "cause": null,
-            "channel": "CURRENT",
-            "cluster": [],
-            "cluster_id": null,
-            "configuration": null,
-            "continuous": false,
-            "creator_user_name": "[USERNAME]",
-            "deployment": [
-              {
-                "kind": "BUNDLE",
-                "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/default/state/metadata.json"
-              }
-            ],
-            "development": false,
-            "edition": "ADVANCED",
-            "environment": [],
-            "event_log": [],
-            "expected_last_modified": 0,
-            "filters": [],
-            "gateway_definition": [],
-            "health": null,
-            "id": "[UUID]",
-            "ingestion_definition": [],
-            "last_modified": [UNIX_TIME_MILLIS],
-            "latest_updates": null,
-            "library": [
-              {
-                "file": [],
-                "glob": [],
-                "jar": "",
-                "maven": [],
-                "notebook": [
-                  {
-                    "path": "/Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/default/files/pipeline"
-                  }
-                ],
-                "whl": ""
-              }
-            ],
-            "name": "Test Migration Pipeline",
-            "notification": [],
-            "photon": false,
-            "provider_config": [],
-            "restart_window": [],
-            "root_path": null,
-            "run_as": [],
-            "run_as_user_name": "[USERNAME]",
-            "schema": null,
-            "serverless": false,
-            "state": "IDLE",
-            "storage": "dbfs:/pipelines/[UUID]",
-            "tags": null,
-            "target": null,
-            "timeouts": null,
-            "trigger": [],
-            "url": "[DATABRICKS_URL]/#joblist/pipelines/[UUID]",
-            "usage_policy_id": null
-          },
-          "sensitive_attributes": [],
-          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxMjAwMDAwMDAwMDAwLCJkZWZhdWx0IjoxMjAwMDAwMDAwMDAwLCJkZWxldGUiOjEyMDAwMDAwMDAwMDAsInJlYWQiOjEyMDAwMDAwMDAwMDAsInVwZGF0ZSI6MTIwMDAwMDAwMDAwMH19"
-        }
-      ]
-    }
-  ],
-  "check_results": null
-}
diff --git a/acceptance/bundle/migrate/permissions/out.test.toml b/acceptance/bundle/migrate/permissions/out.test.toml
deleted file mode 100644
index e90b6d5d1ba..00000000000
--- a/acceptance/bundle/migrate/permissions/out.test.toml
+++ /dev/null
@@ -1,3 +0,0 @@
-Local = true
-Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/migrate/permissions/output.txt b/acceptance/bundle/migrate/permissions/output.txt
deleted file mode 100644
index 953a4bae979..00000000000
--- a/acceptance/bundle/migrate/permissions/output.txt
+++ /dev/null
@@ -1,72 +0,0 @@
-
->>> DATABRICKS_BUNDLE_ENGINE=terraform [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> [CLI] bundle deployment migrate
-Note: Migration should be done after a full deploy. Running plan now to verify that deployment was done:
-Plan: 0 to add, 0 to change, 0 to delete, 4 unchanged
-Success! Migrated 4 resources to direct engine state file: [TEST_TMP_DIR]/.databricks/bundle/default/resources.json
-
-Validate the migration by running "databricks bundle plan", there should be no actions planned.
-
-The state file is not synchronized to the workspace yet. To do that and finalize the migration, run "bundle deploy".
-
-To undo the migration, remove [TEST_TMP_DIR]/.databricks/bundle/default/resources.json and rename [TEST_TMP_DIR]/.databricks/bundle/default/terraform/terraform.tfstate.backup to [TEST_TMP_DIR]/.databricks/bundle/default/terraform/terraform.tfstate
-
-
->>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle plan
-Plan: 0 to add, 0 to change, 0 to delete, 4 unchanged
-
->>> [CLI] bundle plan
-Plan: 0 to add, 0 to change, 0 to delete, 4 unchanged
-
->>> print_requests.py --get //jobs/get
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.2/jobs/get",
-  "q": {
-    "job_id": "[NUMID]"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.2/jobs/get",
-  "q": {
-    "job_id": "[NUMID]"
-  }
-}
-
->>> [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> print_requests.py --get //jobs/get
-"cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
-"cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
-
-=== Should show that it's already migrated
->>> musterr [CLI] bundle deployment migrate
-Error: already using direct engine
-Details: [TEST_TMP_DIR]/.databricks/bundle/default/resources.json: local direct state serial=8 lineage="[UUID]"
-
->>> [CLI] bundle debug states
-[TEST_TMP_DIR]/.databricks/bundle/default/resources.json: local direct state serial=8 lineage="[UUID]"
-
->>> [CLI] bundle debug states --force-pull
-resources.json: remote direct state serial=8 lineage="[UUID]"
-[TEST_TMP_DIR]/.databricks/bundle/default/resources.json: local direct state serial=8 lineage="[UUID]"
diff --git a/acceptance/bundle/migrate/permissions/script b/acceptance/bundle/migrate/permissions/script
deleted file mode 100755
index 2bc8ca521a4..00000000000
--- a/acceptance/bundle/migrate/permissions/script
+++ /dev/null
@@ -1,23 +0,0 @@
-trace DATABRICKS_BUNDLE_ENGINE=terraform $CLI bundle deploy
-print_state.py > out.original_state.json
-
-trace $CLI bundle deployment migrate 2>&1 | contains.py 'Migrated 4 resources'
-print_state.py > out.new_state.json
-
-export DATABRICKS_BUNDLE_ENGINE=
-
-rm out.requests.txt
-# Both DATABRICKS_BUNDLE_ENGINE=direct and DATABRICKS_BUNDLE_ENGINE= work
-trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle plan | contains.py "4 unchanged"
-trace $CLI bundle plan | contains.py "4 unchanged"
-trace print_requests.py --get //jobs/get | contains.py 'engine/direct'
-
-trace $CLI bundle deploy
-trace print_requests.py --get //jobs/get | jq '.headers["User-Agent"][0]' | contains.py 'engine/direct'
-
-title "Should show that it's already migrated"
-trace musterr $CLI bundle deployment migrate
-trace $CLI bundle debug states
-trace $CLI bundle debug states --force-pull
-
-rm out.requests.txt
diff --git a/acceptance/bundle/migrate/profile_arg/out.test.toml b/acceptance/bundle/migrate/profile_arg/out.test.toml
deleted file mode 100644
index e90b6d5d1ba..00000000000
--- a/acceptance/bundle/migrate/profile_arg/out.test.toml
+++ /dev/null
@@ -1,3 +0,0 @@
-Local = true
-Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/migrate/profile_arg/output.txt b/acceptance/bundle/migrate/profile_arg/output.txt
deleted file mode 100644
index a6def38363a..00000000000
--- a/acceptance/bundle/migrate/profile_arg/output.txt
+++ /dev/null
@@ -1,36 +0,0 @@
-
->>> DATABRICKS_BUNDLE_ENGINE=terraform [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/dev/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> [CLI] bundle deployment migrate -p non_existent321
-Note: Migration should be done after a full deploy. Running plan now to verify that deployment was done:
-Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
-Success! Migrated 1 resources to direct engine state file: [TEST_TMP_DIR]/.databricks/bundle/dev/resources.json
-
-Validate the migration by running "databricks bundle plan -p non_existent321", there should be no actions planned.
-
-The state file is not synchronized to the workspace yet. To do that and finalize the migration, run "bundle deploy -p non_existent321".
-
-To undo the migration, remove [TEST_TMP_DIR]/.databricks/bundle/dev/resources.json and rename [TEST_TMP_DIR]/.databricks/bundle/dev/terraform/terraform.tfstate.backup to [TEST_TMP_DIR]/.databricks/bundle/dev/terraform/terraform.tfstate
-
-
->>> DATABRICKS_BUNDLE_ENGINE=terraform [CLI] bundle deploy -t prod
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/migrate-basic-test/prod/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> [CLI] bundle deployment migrate -p non_existent321 -t prod
-Note: Migration should be done after a full deploy. Running plan now to verify that deployment was done:
-Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
-Success! Migrated 2 resources to direct engine state file: [TEST_TMP_DIR]/.databricks/bundle/prod/resources.json
-
-Validate the migration by running "databricks bundle plan -t prod -p non_existent321", there should be no actions planned.
-
-The state file is not synchronized to the workspace yet. To do that and finalize the migration, run "bundle deploy -t prod -p non_existent321".
-
-To undo the migration, remove [TEST_TMP_DIR]/.databricks/bundle/prod/resources.json and rename [TEST_TMP_DIR]/.databricks/bundle/prod/terraform/terraform.tfstate.backup to [TEST_TMP_DIR]/.databricks/bundle/prod/terraform/terraform.tfstate
-
diff --git a/acceptance/bundle/migrate/profile_arg/script b/acceptance/bundle/migrate/profile_arg/script
deleted file mode 100755
index 9e3c242cf1e..00000000000
--- a/acceptance/bundle/migrate/profile_arg/script
+++ /dev/null
@@ -1,7 +0,0 @@
-trace DATABRICKS_BUNDLE_ENGINE=terraform $CLI bundle deploy
-
-# only interested in output here; for some reason in test env -p is not validated
-trace $CLI bundle deployment migrate -p non_existent321
-
-trace DATABRICKS_BUNDLE_ENGINE=terraform $CLI bundle deploy -t prod
-trace $CLI bundle deployment migrate -p non_existent321 -t prod
diff --git a/acceptance/bundle/migrate/runas/out.create_requests.json b/acceptance/bundle/migrate/runas/out.create_requests.json
deleted file mode 100644
index 65cdc895abc..00000000000
--- a/acceptance/bundle/migrate/runas/out.create_requests.json
+++ /dev/null
@@ -1,52 +0,0 @@
-{
-  "headers": {
-    "User-Agent": [
-      "databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5 sdk/sdkv2 resource/pipeline auth/pat"
-    ]
-  },
-  "method": "POST",
-  "path": "/api/2.0/pipelines",
-  "body": {
-    "catalog": "main",
-    "channel": "CURRENT",
-    "deployment": {
-      "kind": "BUNDLE",
-      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/dabs_revenue-[UNIQUE_NAME]/production/state/metadata.json"
-    },
-    "edition": "ADVANCED",
-    "libraries": [
-      {
-        "notebook": {
-          "path": "/Workspace/Users/[USERNAME]/.bundle/dabs_revenue-[UNIQUE_NAME]/production/files/sql"
-        }
-      }
-    ],
-    "name": "DABs Revenue Pipeline",
-    "run_as": {
-      "service_principal_name": "[UUID]"
-    },
-    "serverless": true,
-    "target": "team_eng_deco"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5 sdk/sdkv2 resource/permissions auth/pat"
-    ]
-  },
-  "method": "PUT",
-  "path": "/api/2.0/permissions/pipelines/[UUID]",
-  "body": {
-    "access_control_list": [
-      {
-        "group_name": "users",
-        "permission_level": "CAN_VIEW"
-      },
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/migrate/runas/out.new_state.json b/acceptance/bundle/migrate/runas/out.new_state.json
deleted file mode 100644
index a7308ab59c2..00000000000
--- a/acceptance/bundle/migrate/runas/out.new_state.json
+++ /dev/null
@@ -1,55 +0,0 @@
-{
- "state_version": 2,
- "cli_version": "[DEV_VERSION]",
- "lineage": "[UUID]",
- "serial": 5,
- "state": {
-  "resources.pipelines.foo": {
-   "__id__": "[UUID]",
-   "state": {
-    "catalog": "main",
-    "channel": "CURRENT",
-    "deployment": {
-     "kind": "BUNDLE",
-     "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/dabs_revenue-[UNIQUE_NAME]/production/state/metadata.json"
-    },
-    "edition": "ADVANCED",
-    "libraries": [
-     {
-      "notebook": {
-       "path": "/Workspace/Users/[USERNAME]/.bundle/dabs_revenue-[UNIQUE_NAME]/production/files/sql"
-      }
-     }
-    ],
-    "name": "DABs Revenue Pipeline",
-    "run_as": {
-     "service_principal_name": "[UUID]"
-    },
-    "serverless": true,
-    "target": "team_eng_deco"
-   }
-  },
-  "resources.pipelines.foo.permissions": {
-   "__id__": "/pipelines/[UUID]",
-   "state": {
-    "object_id": "/pipelines/[UUID]",
-    "__embed__": [
-     {
-      "level": "CAN_VIEW",
-      "group_name": "users"
-     },
-     {
-      "level": "IS_OWNER",
-      "user_name": "[USERNAME]"
-     }
-    ]
-   },
-   "depends_on": [
-    {
-     "node": "resources.pipelines.foo",
-     "label": "${resources.pipelines.foo.id}"
-    }
-   ]
-  }
- }
-}
diff --git a/acceptance/bundle/migrate/runas/out.plan.json b/acceptance/bundle/migrate/runas/out.plan.json
deleted file mode 100644
index 68dbb9f229c..00000000000
--- a/acceptance/bundle/migrate/runas/out.plan.json
+++ /dev/null
@@ -1,71 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 5,
-  "plan": {
-    "resources.pipelines.foo": {
-      "action": "skip",
-      "remote_state": {
-        "catalog": "main",
-        "channel": "CURRENT",
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/dabs_revenue-[UNIQUE_NAME]/production/state/metadata.json"
-        },
-        "edition": "ADVANCED",
-        "effective_publishing_mode": "DEFAULT_PUBLISHING_MODE",
-        "id": "[UUID]",
-        "last_modified": [UNIX_TIME_MILLIS],
-        "libraries": [
-          {
-            "notebook": {
-              "path": "/Workspace/Users/[USERNAME]/.bundle/dabs_revenue-[UNIQUE_NAME]/production/files/sql"
-            }
-          }
-        ],
-        "name": "DABs Revenue Pipeline",
-        "pipeline_id": "[UUID]",
-        "run_as_user_name": "[USERNAME]",
-        "serverless": true,
-        "state": "IDLE",
-        "target": "team_eng_deco"
-      },
-      "changes": {
-        "run_as": {
-          "action": "skip",
-          "reason": "input_only",
-          "old": {
-            "service_principal_name": "[UUID]"
-          },
-          "new": {
-            "service_principal_name": "[UUID]"
-          }
-        }
-      }
-    },
-    "resources.pipelines.foo.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.foo",
-          "label": "${resources.pipelines.foo.id}"
-        }
-      ],
-      "action": "skip",
-      "remote_state": {
-        "object_id": "/pipelines/[UUID]",
-        "__embed__": [
-          {
-            "level": "CAN_VIEW",
-            "group_name": "users"
-          },
-          {
-            "level": "IS_OWNER",
-            "user_name": "[USERNAME]"
-          }
-        ]
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/migrate/runas/out.test.toml b/acceptance/bundle/migrate/runas/out.test.toml
deleted file mode 100644
index e90b6d5d1ba..00000000000
--- a/acceptance/bundle/migrate/runas/out.test.toml
+++ /dev/null
@@ -1,3 +0,0 @@
-Local = true
-Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/migrate/runas/output.txt b/acceptance/bundle/migrate/runas/output.txt
deleted file mode 100644
index 74b9a0217f3..00000000000
--- a/acceptance/bundle/migrate/runas/output.txt
+++ /dev/null
@@ -1,161 +0,0 @@
-
->>> DATABRICKS_BUNDLE_ENGINE=terraform [CLI] bundle plan
-Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
-If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
-
-Consider using a adding a top-level permissions section such as the following:
-
-  permissions:
-    - user_name: [USERNAME]
-      level: CAN_MANAGE
-
-See https://docs.databricks.com/dev-tools/bundles/permissions.html to learn more about permission configuration.
-  in databricks.yml:5:3
-
-create pipelines.foo
-create pipelines.foo.permissions
-
-Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
-
->>> DATABRICKS_BUNDLE_ENGINE=terraform [CLI] bundle deploy
-Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
-If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
-
-Consider using a adding a top-level permissions section such as the following:
-
-  permissions:
-    - user_name: [USERNAME]
-      level: CAN_MANAGE
-
-See https://docs.databricks.com/dev-tools/bundles/permissions.html to learn more about permission configuration.
-  in databricks.yml:5:3
-
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dabs_revenue-[UNIQUE_NAME]/production/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> print_requests.py //pipelines
-
->>> print_state.py
-Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
-If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
-
-Consider using a adding a top-level permissions section such as the following:
-
-  permissions:
-    - user_name: [USERNAME]
-      level: CAN_MANAGE
-
-See https://docs.databricks.com/dev-tools/bundles/permissions.html to learn more about permission configuration.
-  in databricks.yml:5:3
-
-
->>> [CLI] pipelines get [UUID]
-
->>> DATABRICKS_BUNDLE_ENGINE=terraform [CLI] bundle plan
-Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
-If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
-
-Consider using a adding a top-level permissions section such as the following:
-
-  permissions:
-    - user_name: [USERNAME]
-      level: CAN_MANAGE
-
-See https://docs.databricks.com/dev-tools/bundles/permissions.html to learn more about permission configuration.
-  in databricks.yml:5:3
-
-Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
-
->>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle deployment migrate
-Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
-If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
-
-Consider using a adding a top-level permissions section such as the following:
-
-  permissions:
-    - user_name: [USERNAME]
-      level: CAN_MANAGE
-
-See https://docs.databricks.com/dev-tools/bundles/permissions.html to learn more about permission configuration.
-  in databricks.yml:5:3
-
-Note: Migration should be done after a full deploy. Running plan now to verify that deployment was done:
-Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
-If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
-
-Consider using a adding a top-level permissions section such as the following:
-
-  permissions:
-    - user_name: [USERNAME]
-      level: CAN_MANAGE
-
-See https://docs.databricks.com/dev-tools/bundles/permissions.html to learn more about permission configuration.
-  in databricks.yml:5:3
-
-Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
-Success! Migrated 2 resources to direct engine state file: [TEST_TMP_DIR]/.databricks/bundle/production/resources.json
-
-Validate the migration by running "databricks bundle plan", there should be no actions planned.
-
-The state file is not synchronized to the workspace yet. To do that and finalize the migration, run "bundle deploy".
-
-To undo the migration, remove [TEST_TMP_DIR]/.databricks/bundle/production/resources.json and rename [TEST_TMP_DIR]/.databricks/bundle/production/terraform/terraform.tfstate.backup to [TEST_TMP_DIR]/.databricks/bundle/production/terraform/terraform.tfstate
-
-
->>> print_state.py
-
->>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle plan
-Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
-If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
-
-Consider using a adding a top-level permissions section such as the following:
-
-  permissions:
-    - user_name: [USERNAME]
-      level: CAN_MANAGE
-
-See https://docs.databricks.com/dev-tools/bundles/permissions.html to learn more about permission configuration.
-  in databricks.yml:5:3
-
-Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
-
->>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle plan -o json
-Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
-If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
-
-Consider using a adding a top-level permissions section such as the following:
-
-  permissions:
-    - user_name: [USERNAME]
-      level: CAN_MANAGE
-
-See https://docs.databricks.com/dev-tools/bundles/permissions.html to learn more about permission configuration.
-  in databricks.yml:5:3
-
-
->>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle destroy --auto-approve
-Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
-If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
-
-Consider using a adding a top-level permissions section such as the following:
-
-  permissions:
-    - user_name: [USERNAME]
-      level: CAN_MANAGE
-
-See https://docs.databricks.com/dev-tools/bundles/permissions.html to learn more about permission configuration.
-  in databricks.yml:5:3
-
-The following resources will be deleted:
-  delete resources.pipelines.foo
-
-This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
-Streaming Tables (STs) and Materialized Views (MVs) managed by them:
-  delete resources.pipelines.foo
-
-All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/dabs_revenue-[UNIQUE_NAME]/production
-
-Deleting files...
-Destroy complete!
diff --git a/acceptance/bundle/migrate/runas/script b/acceptance/bundle/migrate/runas/script
deleted file mode 100644
index f3675f4d9bb..00000000000
--- a/acceptance/bundle/migrate/runas/script
+++ /dev/null
@@ -1,26 +0,0 @@
-if [ -z "${TEST_SP_APPLICATION_ID+x}" ]; then
-    export TEST_SP_APPLICATION_ID="123b0db3-ba48-4e12-be3b-3b7898cdf000"
-fi
-
-envsubst < databricks.yml.tmpl > databricks.yml
-trace DATABRICKS_BUNDLE_ENGINE=terraform $CLI bundle plan
-
-cleanup() {
-    trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle destroy --auto-approve
-    rm -f out.requests.txt
-}
-
-trap cleanup EXIT
-
-trace DATABRICKS_BUNDLE_ENGINE=terraform $CLI bundle deploy
-trace print_requests.py //pipelines > out.create_requests.json
-trace print_state.py > out.old_state.json
-
-pipeline_id=$(DATABRICKS_BUNDLE_ENGINE= $CLI bundle summary --output json | jq -r '.resources.pipelines.foo.id')
-trace $CLI pipelines get $pipeline_id > out.pipelines_get.json
-
-trace DATABRICKS_BUNDLE_ENGINE=terraform $CLI bundle plan
-trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle deployment migrate
-trace print_state.py > out.new_state.json
-trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle plan
-trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle plan -o json > out.plan.json
diff --git a/acceptance/bundle/migrate/script.prepare b/acceptance/bundle/migrate/script.prepare
new file mode 100644
index 00000000000..559d2cec52e
--- /dev/null
+++ b/acceptance/bundle/migrate/script.prepare
@@ -0,0 +1,12 @@
+# Filter print_telemetry_bool_values output to auto-migration keys
+# (direct_migrate_*, direct_migrated_via_*). Callers
+# clear "$OUT_REQUESTS" themselves; some tests want to keep it for a
+# subsequent print_requests.py assertion.
+print_migration_telemetry() {
+    print_telemetry_bool_values | grep '^direct_' || true
+}
+
+# The replay fixtures and the generated out.* files live in the bundle root but are not bundle
+# files, so keep them out of `bundle deploy`'s upload. The list excludes .gitignore itself so it is
+# not uploaded either; test.toml adds .gitignore to Ignore so the harness does not flag it.
+printf '%s\n' '.gitignore' 'out.*' 'terraform*.tfstate' 'terraform*-requests.json' > .gitignore
diff --git a/acceptance/bundle/migrate/test.toml b/acceptance/bundle/migrate/test.toml
index bd5a7467381..bc9174120a7 100644
--- a/acceptance/bundle/migrate/test.toml
+++ b/acceptance/bundle/migrate/test.toml
@@ -1,7 +1,25 @@
 Cloud = false
 RecordRequests = true
 IncludeRequestHeaders = ["User-Agent"]
-Ignore = [".databricks"]
+# .databricks: engine-internal state; .gitignore: written by script.prepare to keep the replay
+# fixtures and out.* files out of the bundle upload (it is not a bundle file itself).
+Ignore = [".databricks", ".gitignore"]
 
-# All tests explicitly set DATABRICKS_BUNDLE_ENGINE, so there is no need for matrix testing
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+# Each test's script sets DATABRICKS_BUNDLE_ENGINE inline; pin the outer
+# matrix to ["direct"] so CI's engine filter includes these tests without
+# also running the same script twice per engine.
+Env.DATABRICKS_BUNDLE_ENGINE = "direct"
+
+# These tests replay a prior terraform deployment (replay_tfstate.py) and then migrate to direct.
+# Recording is direct-only, and the DMS variant does not apply to the migration story.
+EnvMatrix.DMS = [""]
+
+# workspace list prints each state file's object id, minted per run.
+[[Repls]]
+Old = '(?m)^\d+ +FILE\b'
+New = '[OBJECT_ID]  FILE'
+
+# The ID column width depends on ID length, not migration behavior.
+[[Repls]]
+Old = '(?m)^ID +Type  Language  Path$'
+New = 'ID                   Type  Language  Path'
diff --git a/acceptance/bundle/migrate/var_arg/out.test.toml b/acceptance/bundle/migrate/var_arg/out.test.toml
deleted file mode 100644
index e90b6d5d1ba..00000000000
--- a/acceptance/bundle/migrate/var_arg/out.test.toml
+++ /dev/null
@@ -1,3 +0,0 @@
-Local = true
-Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/migrate/var_arg/output.txt b/acceptance/bundle/migrate/var_arg/output.txt
deleted file mode 100644
index a7f8c0e5b2e..00000000000
--- a/acceptance/bundle/migrate/var_arg/output.txt
+++ /dev/null
@@ -1,66 +0,0 @@
-
->>> DATABRICKS_BUNDLE_ENGINE=terraform [CLI] bundle deploy --var=job_name=Custom Job Name
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/migrate-var-test/dev/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> [CLI] bundle deployment migrate --var=job_name=Custom Job Name
-Note: Migration should be done after a full deploy. Running plan now to verify that deployment was done:
-Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
-Success! Migrated 1 resources to direct engine state file: [TEST_TMP_DIR]/.databricks/bundle/dev/resources.json
-
-Validate the migration by running "databricks bundle plan --var 'job_name=Custom Job Name'", there should be no actions planned.
-
-The state file is not synchronized to the workspace yet. To do that and finalize the migration, run "bundle deploy --var 'job_name=Custom Job Name'".
-
-To undo the migration, remove [TEST_TMP_DIR]/.databricks/bundle/dev/resources.json and rename [TEST_TMP_DIR]/.databricks/bundle/dev/terraform/terraform.tfstate.backup to [TEST_TMP_DIR]/.databricks/bundle/dev/terraform/terraform.tfstate
-
-
->>> print_state.py
-"Custom Job Name"
-
->>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle plan --var=job_name=Custom Job Name
-Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
-
->>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle destroy --var=job_name=Custom Job Name --auto-approve
-The following resources will be deleted:
-  delete resources.jobs.test_job
-
-All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/migrate-var-test/dev
-
-Deleting files...
-Destroy complete!
-
->>> DATABRICKS_BUNDLE_ENGINE=terraform [CLI] bundle deploy --var job_name=Custom Job Name
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/migrate-var-test/dev/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> [CLI] bundle deployment migrate --var job_name=Custom Job Name
-Note: Migration should be done after a full deploy. Running plan now to verify that deployment was done:
-Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
-Success! Migrated 1 resources to direct engine state file: [TEST_TMP_DIR]/.databricks/bundle/dev/resources.json
-
-Validate the migration by running "databricks bundle plan --var 'job_name=Custom Job Name'", there should be no actions planned.
-
-The state file is not synchronized to the workspace yet. To do that and finalize the migration, run "bundle deploy --var 'job_name=Custom Job Name'".
-
-To undo the migration, remove [TEST_TMP_DIR]/.databricks/bundle/dev/resources.json and rename [TEST_TMP_DIR]/.databricks/bundle/dev/terraform/terraform.tfstate.backup to [TEST_TMP_DIR]/.databricks/bundle/dev/terraform/terraform.tfstate
-
-
->>> print_state.py
-"Custom Job Name"
-
->>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle plan --var job_name=Custom Job Name
-Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
-
->>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle destroy --var=job_name=Custom Job Name --auto-approve
-The following resources will be deleted:
-  delete resources.jobs.test_job
-
-All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/migrate-var-test/dev
-
-Deleting files...
-Destroy complete!
diff --git a/acceptance/bundle/migrate/var_arg/script b/acceptance/bundle/migrate/var_arg/script
deleted file mode 100644
index 722b0527f86..00000000000
--- a/acceptance/bundle/migrate/var_arg/script
+++ /dev/null
@@ -1,15 +0,0 @@
-trace DATABRICKS_BUNDLE_ENGINE=terraform $CLI bundle deploy --var="job_name=Custom Job Name"
-trace $CLI bundle deployment migrate --var="job_name=Custom Job Name" 2>&1 | contains.py 'Migrated 1 resources'
-trace print_state.py | jq '.state."resources.jobs.test_job".state.name'
-trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle plan --var="job_name=Custom Job Name" | contains.py "1 unchanged"
-trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle destroy --var="job_name=Custom Job Name" --auto-approve
-
-# Try different syntax, '--var X', instead of '--var=X'
-rm -fr .databricks
-
-# Deploy with Terraform using a variable
-trace DATABRICKS_BUNDLE_ENGINE=terraform $CLI bundle deploy --var "job_name=Custom Job Name"
-trace $CLI bundle deployment migrate --var "job_name=Custom Job Name" 2>&1 | contains.py 'Migrated 1 resources'
-trace print_state.py | jq '.state."resources.jobs.test_job".state.name'
-trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle plan --var "job_name=Custom Job Name" | contains.py "1 unchanged"
-trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle destroy --var="job_name=Custom Job Name" --auto-approve
diff --git a/acceptance/bundle/multi_profile/auto_select/databricks.yml b/acceptance/bundle/multi_profile/auto_select/databricks.yml
index 50ac852b94a..c80231ab5ca 100644
--- a/acceptance/bundle/multi_profile/auto_select/databricks.yml
+++ b/acceptance/bundle/multi_profile/auto_select/databricks.yml
@@ -1,2 +1,5 @@
 bundle:
   name: multi-profile-auto-select
+
+workspace:
+  host: $DATABRICKS_HOST
diff --git a/acceptance/bundle/multi_profile/auto_select/out.test.toml b/acceptance/bundle/multi_profile/auto_select/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/multi_profile/auto_select/out.test.toml
+++ b/acceptance/bundle/multi_profile/auto_select/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/multi_profile/auto_select/script b/acceptance/bundle/multi_profile/auto_select/script
index c785d4e0b43..26b039befc2 100644
--- a/acceptance/bundle/multi_profile/auto_select/script
+++ b/acceptance/bundle/multi_profile/auto_select/script
@@ -1,15 +1,7 @@
-# Set up .databrickscfg with two profiles for the same host:
-# one workspace profile and one account profile.
+# Substitute the actual host URL into the checked-in .databrickscfg (two profiles
+# for the same host: one workspace, one account) and databricks.yml.
 envsubst < .databrickscfg > out && mv out .databrickscfg
-
-# Write databricks.yml with the actual host URL.
-cat > databricks.yml << EOF
-bundle:
-  name: multi-profile-auto-select
-
-workspace:
-  host: $DATABRICKS_HOST
-EOF
+envsubst < databricks.yml > out && mv out databricks.yml
 
 export DATABRICKS_CONFIG_FILE=.databrickscfg
 unset DATABRICKS_HOST
diff --git a/acceptance/bundle/multi_profile/env_auth_skip/databricks.yml b/acceptance/bundle/multi_profile/env_auth_skip/databricks.yml
index cc3be2a1dc4..3c74de269ee 100644
--- a/acceptance/bundle/multi_profile/env_auth_skip/databricks.yml
+++ b/acceptance/bundle/multi_profile/env_auth_skip/databricks.yml
@@ -1,2 +1,5 @@
 bundle:
   name: multi-profile-env-skip
+
+workspace:
+  host: $DATABRICKS_HOST
diff --git a/acceptance/bundle/multi_profile/env_auth_skip/out.test.toml b/acceptance/bundle/multi_profile/env_auth_skip/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/multi_profile/env_auth_skip/out.test.toml
+++ b/acceptance/bundle/multi_profile/env_auth_skip/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/multi_profile/env_auth_skip/script b/acceptance/bundle/multi_profile/env_auth_skip/script
index 5f934dfc10e..c9ba395cc93 100644
--- a/acceptance/bundle/multi_profile/env_auth_skip/script
+++ b/acceptance/bundle/multi_profile/env_auth_skip/script
@@ -1,13 +1,7 @@
-# Set up .databrickscfg with two workspace profiles for the same host.
+# Substitute the actual host URL into the checked-in .databrickscfg (two
+# workspace profiles for the same host) and databricks.yml.
 envsubst < .databrickscfg > out && mv out .databrickscfg
-
-cat > databricks.yml << EOF
-bundle:
-  name: multi-profile-env-skip
-
-workspace:
-  host: $DATABRICKS_HOST
-EOF
+envsubst < databricks.yml > out && mv out databricks.yml
 
 export DATABRICKS_CONFIG_FILE=.databrickscfg
 # Keep DATABRICKS_HOST and DATABRICKS_TOKEN set — env auth takes precedence
diff --git a/acceptance/bundle/multi_profile/no_workspace_profiles/databricks.yml b/acceptance/bundle/multi_profile/no_workspace_profiles/databricks.yml
index 298f0763d7c..259da145f03 100644
--- a/acceptance/bundle/multi_profile/no_workspace_profiles/databricks.yml
+++ b/acceptance/bundle/multi_profile/no_workspace_profiles/databricks.yml
@@ -1,2 +1,5 @@
 bundle:
   name: multi-profile-no-ws
+
+workspace:
+  host: $DATABRICKS_HOST
diff --git a/acceptance/bundle/multi_profile/no_workspace_profiles/out.test.toml b/acceptance/bundle/multi_profile/no_workspace_profiles/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/multi_profile/no_workspace_profiles/out.test.toml
+++ b/acceptance/bundle/multi_profile/no_workspace_profiles/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/multi_profile/no_workspace_profiles/output.txt b/acceptance/bundle/multi_profile/no_workspace_profiles/output.txt
index 02a544efb52..5ab1e747db4 100644
--- a/acceptance/bundle/multi_profile/no_workspace_profiles/output.txt
+++ b/acceptance/bundle/multi_profile/no_workspace_profiles/output.txt
@@ -8,5 +8,3 @@ Workspace:
   Host: [DATABRICKS_URL]
 
 Found 1 error
-
-Exit code: 1
diff --git a/acceptance/bundle/multi_profile/no_workspace_profiles/script b/acceptance/bundle/multi_profile/no_workspace_profiles/script
index 97dda0e2afc..0825a07c435 100644
--- a/acceptance/bundle/multi_profile/no_workspace_profiles/script
+++ b/acceptance/bundle/multi_profile/no_workspace_profiles/script
@@ -1,17 +1,11 @@
-# Set up .databrickscfg with two account-only profiles for the same host.
+# Substitute the actual host URL into the checked-in .databrickscfg (two
+# account-only profiles for the same host) and databricks.yml.
 envsubst < .databrickscfg > out && mv out .databrickscfg
-
-cat > databricks.yml << EOF
-bundle:
-  name: multi-profile-no-ws
-
-workspace:
-  host: $DATABRICKS_HOST
-EOF
+envsubst < databricks.yml > out && mv out databricks.yml
 
 export DATABRICKS_CONFIG_FILE=.databrickscfg
 unset DATABRICKS_HOST
 unset DATABRICKS_TOKEN
 
 # No workspace-compatible profiles → original multi-profile error returned.
-errcode trace $CLI bundle validate
+musterr trace $CLI bundle validate
diff --git a/acceptance/bundle/multi_profile/non_interactive_error/databricks.yml b/acceptance/bundle/multi_profile/non_interactive_error/databricks.yml
index 529bc314c7f..27f84afb7eb 100644
--- a/acceptance/bundle/multi_profile/non_interactive_error/databricks.yml
+++ b/acceptance/bundle/multi_profile/non_interactive_error/databricks.yml
@@ -1,2 +1,5 @@
 bundle:
   name: multi-profile-non-interactive
+
+workspace:
+  host: $DATABRICKS_HOST
diff --git a/acceptance/bundle/multi_profile/non_interactive_error/out.test.toml b/acceptance/bundle/multi_profile/non_interactive_error/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/multi_profile/non_interactive_error/out.test.toml
+++ b/acceptance/bundle/multi_profile/non_interactive_error/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/multi_profile/non_interactive_error/output.txt b/acceptance/bundle/multi_profile/non_interactive_error/output.txt
index d3621f1274b..f5fd72ff443 100644
--- a/acceptance/bundle/multi_profile/non_interactive_error/output.txt
+++ b/acceptance/bundle/multi_profile/non_interactive_error/output.txt
@@ -19,5 +19,3 @@ Workspace:
   Host: [DATABRICKS_URL]
 
 Found 1 error
-
-Exit code: 1
diff --git a/acceptance/bundle/multi_profile/non_interactive_error/script b/acceptance/bundle/multi_profile/non_interactive_error/script
index 85003ad4710..c957035ad40 100644
--- a/acceptance/bundle/multi_profile/non_interactive_error/script
+++ b/acceptance/bundle/multi_profile/non_interactive_error/script
@@ -1,17 +1,11 @@
-# Set up .databrickscfg with two workspace profiles for the same host.
+# Substitute the actual host URL into the checked-in .databrickscfg (two
+# workspace profiles for the same host) and databricks.yml.
 envsubst < .databrickscfg > out && mv out .databrickscfg
-
-cat > databricks.yml << EOF
-bundle:
-  name: multi-profile-non-interactive
-
-workspace:
-  host: $DATABRICKS_HOST
-EOF
+envsubst < databricks.yml > out && mv out databricks.yml
 
 export DATABRICKS_CONFIG_FILE=.databrickscfg
 unset DATABRICKS_HOST
 unset DATABRICKS_TOKEN
 
 # Multiple workspace profiles, non-interactive → error with guidance.
-errcode trace $CLI bundle validate
+musterr trace $CLI bundle validate
diff --git a/acceptance/bundle/multi_profile/test.toml b/acceptance/bundle/multi_profile/test.toml
index 85e02532c93..8f238a7f609 100644
--- a/acceptance/bundle/multi_profile/test.toml
+++ b/acceptance/bundle/multi_profile/test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
 Ignore = [".databricks"]
diff --git a/acceptance/bundle/open/open b/acceptance/bundle/open/open
deleted file mode 100755
index 5c6c78d6a78..00000000000
--- a/acceptance/bundle/open/open
+++ /dev/null
@@ -1,2 +0,0 @@
-#!/bin/bash
-echo "I AM BROWSER"
diff --git a/acceptance/bundle/open/out.test.toml b/acceptance/bundle/open/out.test.toml
index 519954aedc9..a927a5fbc06 100644
--- a/acceptance/bundle/open/out.test.toml
+++ b/acceptance/bundle/open/out.test.toml
@@ -1,5 +1,2 @@
-Local = true
 Cloud = false
-GOOS.linux = false
-GOOS.windows = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/open/output.txt b/acceptance/bundle/open/output.txt
index e310567b110..603198f2c19 100644
--- a/acceptance/bundle/open/output.txt
+++ b/acceptance/bundle/open/output.txt
@@ -13,15 +13,15 @@ Exit code: 1
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/caterpillar/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.foo
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
-=== Modify PATH so that real open is not run
-=== open after deployment. This will fail to open browser and complain, that's ok, we only want the message
+=== Use a fake browser that just prints the URL it would have opened
+=== open after deployment
 >>> [CLI] bundle open foo
-Opening browser at [DATABRICKS_URL]/jobs/[NUMID]?o=[NUMID]
-Error: exec: "open": cannot run executable found relative to current directory
+Opening browser at [DATABRICKS_URL]/jobs/[FOO_ID]?w=[WORKSPACE_ID]
+[DATABRICKS_URL]/jobs/[FOO_ID]?w=[WORKSPACE_ID]
 
 === test auto-completion handler
 >>> [CLI] __complete bundle open ,
diff --git a/acceptance/bundle/open/script b/acceptance/bundle/open/script
index 724bb42871e..dfce55aa6da 100644
--- a/acceptance/bundle/open/script
+++ b/acceptance/bundle/open/script
@@ -5,12 +5,13 @@ title "not deployed yet"
 errcode trace $CLI bundle open foo
 
 errcode trace $CLI bundle deploy
+replace_ids.py
 
-title "Modify PATH so that real open is not run"
-export PATH=.:$PATH
+title "Use a fake browser that just prints the URL it would have opened"
+export BROWSER="echo_browser.py"
 
-title "open after deployment. This will fail to open browser and complain, that's ok, we only want the message"
-musterr trace $CLI bundle open foo
+title "open after deployment"
+trace $CLI bundle open foo
 
 title "test auto-completion handler"
 trace $CLI __complete bundle open ,
diff --git a/acceptance/bundle/open/test.toml b/acceptance/bundle/open/test.toml
deleted file mode 100644
index 078e52c97ea..00000000000
--- a/acceptance/bundle/open/test.toml
+++ /dev/null
@@ -1,2 +0,0 @@
-GOOS.windows = false
-GOOS.linux = false
diff --git a/acceptance/bundle/override/clusters/out.test.toml b/acceptance/bundle/override/clusters/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/override/clusters/out.test.toml
+++ b/acceptance/bundle/override/clusters/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/override/job_cluster/out.test.toml b/acceptance/bundle/override/job_cluster/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/override/job_cluster/out.test.toml
+++ b/acceptance/bundle/override/job_cluster/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/override/job_cluster_var/out.test.toml b/acceptance/bundle/override/job_cluster_var/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/override/job_cluster_var/out.test.toml
+++ b/acceptance/bundle/override/job_cluster_var/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/override/job_tasks/out.test.toml b/acceptance/bundle/override/job_tasks/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/override/job_tasks/out.test.toml
+++ b/acceptance/bundle/override/job_tasks/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/override/merge-string-map/out.test.toml b/acceptance/bundle/override/merge-string-map/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/override/merge-string-map/out.test.toml
+++ b/acceptance/bundle/override/merge-string-map/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/override/pipeline_cluster/out.test.toml b/acceptance/bundle/override/pipeline_cluster/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/override/pipeline_cluster/out.test.toml
+++ b/acceptance/bundle/override/pipeline_cluster/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/paths/designer_notebook/databricks.yml b/acceptance/bundle/paths/designer_notebook/databricks.yml
new file mode 100644
index 00000000000..291e63df797
--- /dev/null
+++ b/acceptance/bundle/paths/designer_notebook/databricks.yml
@@ -0,0 +1,14 @@
+bundle:
+  name: designer_paths
+
+resources:
+  jobs:
+    designer_job:
+      name: designer_job
+      tasks:
+        - task_key: designer_task
+          notebook_task:
+            notebook_path: ./src/test.designer.ipynb
+        - task_key: regular_task
+          notebook_task:
+            notebook_path: ./src/regular.ipynb
diff --git a/acceptance/bundle/paths/designer_notebook/out.test.toml b/acceptance/bundle/paths/designer_notebook/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/paths/designer_notebook/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/paths/designer_notebook/output.txt b/acceptance/bundle/paths/designer_notebook/output.txt
new file mode 100644
index 00000000000..b473fac5f8d
--- /dev/null
+++ b/acceptance/bundle/paths/designer_notebook/output.txt
@@ -0,0 +1,10 @@
+[
+  {
+    "task_key": "designer_task",
+    "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/designer_paths/default/files/src/test.designer.ipynb"
+  },
+  {
+    "task_key": "regular_task",
+    "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/designer_paths/default/files/src/regular"
+  }
+]
diff --git a/acceptance/bundle/paths/designer_notebook/script b/acceptance/bundle/paths/designer_notebook/script
new file mode 100644
index 00000000000..6affc4a74eb
--- /dev/null
+++ b/acceptance/bundle/paths/designer_notebook/script
@@ -0,0 +1 @@
+$CLI bundle validate -o json | jq '.resources.jobs.designer_job.tasks | map({task_key, notebook_path: .notebook_task.notebook_path})'
diff --git a/acceptance/bundle/paths/designer_notebook/src/regular.ipynb b/acceptance/bundle/paths/designer_notebook/src/regular.ipynb
new file mode 100644
index 00000000000..1ec2d26c287
--- /dev/null
+++ b/acceptance/bundle/paths/designer_notebook/src/regular.ipynb
@@ -0,0 +1,10 @@
+{
+  "cells": [],
+  "metadata": {
+    "application/vnd.databricks.v1+notebook": {
+      "language": "python"
+    }
+  },
+  "nbformat": 4,
+  "nbformat_minor": 0
+}
diff --git a/acceptance/bundle/paths/designer_notebook/src/test.designer.ipynb b/acceptance/bundle/paths/designer_notebook/src/test.designer.ipynb
new file mode 100644
index 00000000000..1ec2d26c287
--- /dev/null
+++ b/acceptance/bundle/paths/designer_notebook/src/test.designer.ipynb
@@ -0,0 +1,10 @@
+{
+  "cells": [],
+  "metadata": {
+    "application/vnd.databricks.v1+notebook": {
+      "language": "python"
+    }
+  },
+  "nbformat": 4,
+  "nbformat_minor": 0
+}
diff --git a/acceptance/bundle/paths/fallback/README.md b/acceptance/bundle/paths/fallback/README.md
deleted file mode 100644
index ec5f6c74098..00000000000
--- a/acceptance/bundle/paths/fallback/README.md
+++ /dev/null
@@ -1,42 +0,0 @@
-# Test path translation (with fallback to previous behavior)
-
-As of v0.214.0, all paths in a resource definition were resolved relative to the path
-where that resource was first defined. If those paths were specified in the same file,
-or in a different file in the same directory, this would be intuitive.
-
-If those paths were specified in a different file in a different directory, they would
-still be resolved relative to the original file.
-
-For example, a job defined in `./resources/my_job.yml` with an override
-in `./override.yml` would have to use paths relative to `./resources`.
-This is counter-intuitive and error-prone, and we changed this behavior
-in https://github.com/databricks/cli/pull/1273.
-
-## Appendix
-
-Q: Why did this behavior apply as of v0.214.0?
-
-A: With the introduction of dynamic configuration loading, we keep track
-   of the location (file, line, column) where a resource is defined.
-   This location information is used to perform path translation, but upon
-   introduction in v0.214.0, the code still used only a single path per resource.
-   Due to the semantics of merging two `dyn.Value` objects, the location
-   information of the first existing value is used for the merged value.
-   This meant that all paths for a resource were resolved relative to the
-   location where the resource was first defined.
-
-Q: What was the behavior before v0.214.0?
-
-A: Before we relied on dynamic configuration loading, all configuration was
-   maintained in a typed struct. The path for a resource was an unexported field on the
-   resource and was set right after loading the configuration file that contains it.
-   Target overrides contained the same path field, and applying a target override
-   would set the path for the resource to the path of the target override.
-   This meant that all paths for a resource were resolved relative to the
-   location where the resource was last defined.
-
-Q: Why are we maintaining compatibility with the old behavior?
-
-A: We want to avoid breaking existing configurations that depend on this behavior.
-   Use of the old behavior should trigger warnings with a call to action to update.
-   We can include a deprecation timeline to remove the old behavior in the future.
diff --git a/acceptance/bundle/paths/fallback/databricks.yml b/acceptance/bundle/paths/fallback/databricks.yml
deleted file mode 100644
index c6d0abe0aa4..00000000000
--- a/acceptance/bundle/paths/fallback/databricks.yml
+++ /dev/null
@@ -1,13 +0,0 @@
-bundle:
-  name: fallback
-
-include:
-  - "resources/*.yml"
-  - "override_*.yml"
-
-targets:
-  development:
-    default: true
-
-  error:
-    default: false
diff --git a/acceptance/bundle/paths/fallback/out.test.toml b/acceptance/bundle/paths/fallback/out.test.toml
deleted file mode 100644
index f784a183258..00000000000
--- a/acceptance/bundle/paths/fallback/out.test.toml
+++ /dev/null
@@ -1,3 +0,0 @@
-Local = true
-Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/bundle/paths/fallback/output.job.json b/acceptance/bundle/paths/fallback/output.job.json
deleted file mode 100644
index 98bb2e40e20..00000000000
--- a/acceptance/bundle/paths/fallback/output.job.json
+++ /dev/null
@@ -1,67 +0,0 @@
-[
-  {
-    "dbt_task": {
-      "commands": [
-        "dbt run",
-        "dbt run"
-      ],
-      "project_directory": "/Workspace/Users/[USERNAME]/.bundle/fallback/development/files/src/dbt_project"
-    },
-    "job_cluster_key": "default",
-    "task_key": "dbt_example"
-  },
-  {
-    "job_cluster_key": "default",
-    "notebook_task": {
-      "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/fallback/development/files/src/notebook"
-    },
-    "task_key": "notebook_example"
-  },
-  {
-    "job_cluster_key": "default",
-    "libraries": [
-      {
-        "whl": "dist/wheel1.whl"
-      },
-      {
-        "whl": "../dist/wheel2.whl"
-      }
-    ],
-    "python_wheel_task": {
-      "package_name": "my_package"
-    },
-    "task_key": "python_wheel_example"
-  },
-  {
-    "job_cluster_key": "default",
-    "libraries": [
-      {
-        "jar": "target/jar1.jar"
-      },
-      {
-        "jar": "../target/jar2.jar"
-      }
-    ],
-    "spark_jar_task": {
-      "main_class_name": "com.example.Main"
-    },
-    "task_key": "spark_jar_example"
-  },
-  {
-    "job_cluster_key": "default",
-    "spark_python_task": {
-      "python_file": "/Workspace/Users/[USERNAME]/.bundle/fallback/development/files/src/file.py"
-    },
-    "task_key": "spark_python_example"
-  },
-  {
-    "job_cluster_key": "default",
-    "sql_task": {
-      "file": {
-        "path": "/Workspace/Users/[USERNAME]/.bundle/fallback/development/files/src/sql.sql"
-      },
-      "warehouse_id": "cafef00d"
-    },
-    "task_key": "sql_example"
-  }
-]
diff --git a/acceptance/bundle/paths/fallback/output.pipeline.json b/acceptance/bundle/paths/fallback/output.pipeline.json
deleted file mode 100644
index 7ed4f74e690..00000000000
--- a/acceptance/bundle/paths/fallback/output.pipeline.json
+++ /dev/null
@@ -1,22 +0,0 @@
-[
-  {
-    "file": {
-      "path": "/Workspace/Users/[USERNAME]/.bundle/fallback/development/files/src/file1.py"
-    }
-  },
-  {
-    "notebook": {
-      "path": "/Workspace/Users/[USERNAME]/.bundle/fallback/development/files/src/notebook1"
-    }
-  },
-  {
-    "file": {
-      "path": "/Workspace/Users/[USERNAME]/.bundle/fallback/development/files/src/file2.py"
-    }
-  },
-  {
-    "notebook": {
-      "path": "/Workspace/Users/[USERNAME]/.bundle/fallback/development/files/src/notebook2"
-    }
-  }
-]
diff --git a/acceptance/bundle/paths/fallback/output.txt b/acceptance/bundle/paths/fallback/output.txt
deleted file mode 100644
index 078943ad41e..00000000000
--- a/acceptance/bundle/paths/fallback/output.txt
+++ /dev/null
@@ -1,49 +0,0 @@
-
->>> [CLI] bundle validate -t development -o json
-Warning: required field "entry_point" is not set
-  at resources.jobs.my_job.tasks[2].python_wheel_task
-  in resources/my_job.yml:33:13
-     override_job.yml:29:17
-
-Error: path ../src/notebook.py is defined relative to the [TEST_TMP_DIR]/resources directory ([TEST_TMP_DIR]/override_job.yml:9:32). Please update the path to be relative to the file where it is defined or use earlier version of CLI (0.261.0 or earlier).
-  in override_job.yml:9:32
-     resources/my_job.yml:9:28
-
-Error: path ../src/file.py is defined relative to the [TEST_TMP_DIR]/resources directory ([TEST_TMP_DIR]/override_job.yml:13:30). Please update the path to be relative to the file where it is defined or use earlier version of CLI (0.261.0 or earlier).
-  in override_job.yml:13:30
-     resources/my_job.yml:14:26
-
-Error: path ../src/dbt_project is defined relative to the [TEST_TMP_DIR]/resources directory ([TEST_TMP_DIR]/override_job.yml:17:36). Please update the path to be relative to the file where it is defined or use earlier version of CLI (0.261.0 or earlier).
-  in override_job.yml:17:36
-     resources/my_job.yml:19:32
-
-Error: path ../src/sql.sql is defined relative to the [TEST_TMP_DIR]/resources directory ([TEST_TMP_DIR]/override_job.yml:24:25). Please update the path to be relative to the file where it is defined or use earlier version of CLI (0.261.0 or earlier).
-  in override_job.yml:24:25
-     resources/my_job.yml:27:21
-
-Error: path ../src/notebook2.py is defined relative to the [TEST_TMP_DIR]/resources directory ([TEST_TMP_DIR]/override_pipeline.yml:13:23). Please update the path to be relative to the file where it is defined or use earlier version of CLI (0.261.0 or earlier).
-  in override_pipeline.yml:13:23
-
-Error: path ../src/file2.py is defined relative to the [TEST_TMP_DIR]/resources directory ([TEST_TMP_DIR]/override_pipeline.yml:10:23). Please update the path to be relative to the file where it is defined or use earlier version of CLI (0.261.0 or earlier).
-  in override_pipeline.yml:10:23
-
-
-Exit code: 1
-
->>> [CLI] bundle validate -t error
-Warning: required field "entry_point" is not set
-  at resources.jobs.my_job.tasks[2].python_wheel_task
-  in resources/my_job.yml:33:13
-
-Error: notebook "resources/this value is overridden" not found. Local notebook references are expected
-to contain one of the following file extensions: [.py, .r, .scala, .sql, .ipynb]
-
-Name: fallback
-Target: error
-Workspace:
-  User: [USERNAME]
-  Path: /Workspace/Users/[USERNAME]/.bundle/fallback/error
-
-Found 1 error and 1 warning
-
-Exit code: 1
diff --git a/acceptance/bundle/paths/fallback/override_job.yml b/acceptance/bundle/paths/fallback/override_job.yml
deleted file mode 100644
index c4354b14bb3..00000000000
--- a/acceptance/bundle/paths/fallback/override_job.yml
+++ /dev/null
@@ -1,41 +0,0 @@
-targets:
-  development:
-    resources:
-      jobs:
-        my_job:
-          tasks:
-            - task_key: notebook_example
-              notebook_task:
-                notebook_path: ../src/notebook.py
-
-            - task_key: spark_python_example
-              spark_python_task:
-                python_file: ../src/file.py
-
-            - task_key: dbt_example
-              dbt_task:
-                project_directory: ../src/dbt_project
-                commands:
-                  - "dbt run"
-
-            - task_key: sql_example
-              sql_task:
-                file:
-                  path: ../src/sql.sql
-                warehouse_id: cafef00d
-
-            - task_key: python_wheel_example
-              python_wheel_task:
-                package_name: my_package
-
-              # Append library; the path is resolved relative to the job's directory.
-              libraries:
-                - whl: ../dist/wheel2.whl
-
-            - task_key: spark_jar_example
-              spark_jar_task:
-                main_class_name: com.example.Main
-
-              # Append library; the path is resolved relative to the job's directory.
-              libraries:
-                - jar: ../target/jar2.jar
diff --git a/acceptance/bundle/paths/fallback/override_pipeline.yml b/acceptance/bundle/paths/fallback/override_pipeline.yml
deleted file mode 100644
index e5790256aae..00000000000
--- a/acceptance/bundle/paths/fallback/override_pipeline.yml
+++ /dev/null
@@ -1,13 +0,0 @@
-targets:
-  development:
-    resources:
-      pipelines:
-        my_pipeline:
-
-          # Append library; the path is resolved relative to the pipeline's directory.
-          libraries:
-            - file:
-                path: ../src/file2.py
-
-            - notebook:
-                path: ../src/notebook2.py
diff --git a/acceptance/bundle/paths/fallback/resources/my_job.yml b/acceptance/bundle/paths/fallback/resources/my_job.yml
deleted file mode 100644
index 921ee412b98..00000000000
--- a/acceptance/bundle/paths/fallback/resources/my_job.yml
+++ /dev/null
@@ -1,48 +0,0 @@
-resources:
-  jobs:
-    my_job:
-      name: "placeholder"
-      tasks:
-        - task_key: notebook_example
-          job_cluster_key: default
-          notebook_task:
-            notebook_path: "this value is overridden"
-
-        - task_key: spark_python_example
-          job_cluster_key: default
-          spark_python_task:
-            python_file: "this value is overridden"
-
-        - task_key: dbt_example
-          job_cluster_key: default
-          dbt_task:
-            project_directory: "this value is overridden"
-            commands:
-              - "dbt run"
-
-        - task_key: sql_example
-          job_cluster_key: default
-          sql_task:
-            file:
-              path: "this value is overridden"
-            warehouse_id: cafef00d
-
-        - task_key: python_wheel_example
-          job_cluster_key: default
-          python_wheel_task:
-            package_name: my_package
-          libraries:
-            - whl: ../dist/wheel1.whl
-
-        - task_key: spark_jar_example
-          job_cluster_key: default
-          spark_jar_task:
-            main_class_name: com.example.Main
-          libraries:
-            - jar: ../target/jar1.jar
-
-      # Include a job cluster for completeness
-      job_clusters:
-        - job_cluster_key: default
-          new_cluster:
-            spark_version: 15.4.x-scala2.12
diff --git a/acceptance/bundle/paths/fallback/resources/my_pipeline.yml b/acceptance/bundle/paths/fallback/resources/my_pipeline.yml
deleted file mode 100644
index 457856d1d2d..00000000000
--- a/acceptance/bundle/paths/fallback/resources/my_pipeline.yml
+++ /dev/null
@@ -1,9 +0,0 @@
-resources:
-  pipelines:
-    my_pipeline:
-      name: "placeholder"
-      libraries:
-        - file:
-            path: ../src/file1.py
-        - notebook:
-            path: ../src/notebook1.py
diff --git a/acceptance/bundle/paths/fallback/script b/acceptance/bundle/paths/fallback/script
deleted file mode 100644
index 29aa420c598..00000000000
--- a/acceptance/bundle/paths/fallback/script
+++ /dev/null
@@ -1,10 +0,0 @@
-errcode trace $CLI bundle validate -t development -o json > output.tmp.json
-
-# Capture job tasks
-jq '.resources.jobs.my_job.tasks' output.tmp.json > output.job.json
-
-# Capture pipeline libraries
-jq '.resources.pipelines.my_pipeline.libraries' output.tmp.json > output.pipeline.json
-
-# Expect failure for the "error" target
-errcode trace $CLI bundle validate -t error
diff --git a/acceptance/bundle/paths/fallback/script.cleanup b/acceptance/bundle/paths/fallback/script.cleanup
deleted file mode 100644
index f93425dffdb..00000000000
--- a/acceptance/bundle/paths/fallback/script.cleanup
+++ /dev/null
@@ -1 +0,0 @@
-rm -f output.tmp.json
diff --git a/acceptance/bundle/paths/fallback/src/file1.py b/acceptance/bundle/paths/fallback/src/file1.py
deleted file mode 100644
index 7df869a15e7..00000000000
--- a/acceptance/bundle/paths/fallback/src/file1.py
+++ /dev/null
@@ -1 +0,0 @@
-print("Hello, World!")
diff --git a/acceptance/bundle/paths/fallback/src/file2.py b/acceptance/bundle/paths/fallback/src/file2.py
deleted file mode 100644
index 7df869a15e7..00000000000
--- a/acceptance/bundle/paths/fallback/src/file2.py
+++ /dev/null
@@ -1 +0,0 @@
-print("Hello, World!")
diff --git a/acceptance/bundle/paths/fallback/src/notebook1.py b/acceptance/bundle/paths/fallback/src/notebook1.py
deleted file mode 100644
index 38d86b79c70..00000000000
--- a/acceptance/bundle/paths/fallback/src/notebook1.py
+++ /dev/null
@@ -1,2 +0,0 @@
-# Databricks notebook source
-print("Hello, World!")
diff --git a/acceptance/bundle/paths/fallback/src/notebook2.py b/acceptance/bundle/paths/fallback/src/notebook2.py
deleted file mode 100644
index 38d86b79c70..00000000000
--- a/acceptance/bundle/paths/fallback/src/notebook2.py
+++ /dev/null
@@ -1,2 +0,0 @@
-# Databricks notebook source
-print("Hello, World!")
diff --git a/acceptance/bundle/paths/fallback/src/sql.sql b/acceptance/bundle/paths/fallback/src/sql.sql
deleted file mode 100644
index 24c55832d75..00000000000
--- a/acceptance/bundle/paths/fallback/src/sql.sql
+++ /dev/null
@@ -1 +0,0 @@
-select "Hello, World!"
diff --git a/acceptance/bundle/paths/fallback_metric/output.txt b/acceptance/bundle/paths/fallback_metric/output.txt
deleted file mode 100644
index a98e275088d..00000000000
--- a/acceptance/bundle/paths/fallback_metric/output.txt
+++ /dev/null
@@ -1,79 +0,0 @@
-
->>> [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/fallback_metric/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> [CLI] bundle deploy -t fallback
-Warn: path ../src/notebook.py is defined relative to the [TEST_TMP_DIR]/resources directory ([TEST_TMP_DIR]/databricks.yml:15:32). Please update the path to be relative to the file where it is defined. The current value will no longer be valid in the next release.
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/fallback_metric/fallback/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> cat out.requests.txt
-[
-  {
-    "key": "experimental.use_legacy_run_as",
-    "value": false
-  },
-  {
-    "key": "presets_name_prefix_is_set",
-    "value": false
-  },
-  {
-    "key": "python_wheel_wrapper_is_set",
-    "value": false
-  },
-  {
-    "key": "skip_artifact_cleanup",
-    "value": false
-  },
-  {
-    "key": "has_serverless_compute",
-    "value": false
-  },
-  {
-    "key": "has_classic_job_compute",
-    "value": true
-  },
-  {
-    "key": "has_classic_interactive_compute",
-    "value": false
-  }
-]
-[
-  {
-    "key": "experimental.use_legacy_run_as",
-    "value": false
-  },
-  {
-    "key": "presets_name_prefix_is_set",
-    "value": false
-  },
-  {
-    "key": "is_job_path_fallback",
-    "value": true
-  },
-  {
-    "key": "python_wheel_wrapper_is_set",
-    "value": false
-  },
-  {
-    "key": "skip_artifact_cleanup",
-    "value": false
-  },
-  {
-    "key": "has_serverless_compute",
-    "value": false
-  },
-  {
-    "key": "has_classic_job_compute",
-    "value": true
-  },
-  {
-    "key": "has_classic_interactive_compute",
-    "value": false
-  }
-]
diff --git a/acceptance/bundle/paths/git_source_jobs/out.test.toml b/acceptance/bundle/paths/git_source_jobs/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/paths/git_source_jobs/out.test.toml
+++ b/acceptance/bundle/paths/git_source_jobs/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/paths/invalid_pipeline_globs/out.test.toml b/acceptance/bundle/paths/invalid_pipeline_globs/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/paths/invalid_pipeline_globs/out.test.toml
+++ b/acceptance/bundle/paths/invalid_pipeline_globs/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/paths/job_environment_variables_files/databricks.yml b/acceptance/bundle/paths/job_environment_variables_files/databricks.yml
new file mode 100644
index 00000000000..3eb7d935c5e
--- /dev/null
+++ b/acceptance/bundle/paths/job_environment_variables_files/databricks.yml
@@ -0,0 +1,5 @@
+bundle:
+  name: job_environment_variables_files
+
+include:
+  - resources/*.yml
diff --git a/acceptance/bundle/paths/job_environment_variables_files/env/common.env b/acceptance/bundle/paths/job_environment_variables_files/env/common.env
new file mode 100644
index 00000000000..c075a74be94
--- /dev/null
+++ b/acceptance/bundle/paths/job_environment_variables_files/env/common.env
@@ -0,0 +1 @@
+FOO=bar
diff --git a/acceptance/bundle/paths/job_environment_variables_files/out.test.toml b/acceptance/bundle/paths/job_environment_variables_files/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/paths/job_environment_variables_files/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/paths/job_environment_variables_files/output.txt b/acceptance/bundle/paths/job_environment_variables_files/output.txt
new file mode 100644
index 00000000000..c2976892187
--- /dev/null
+++ b/acceptance/bundle/paths/job_environment_variables_files/output.txt
@@ -0,0 +1,17 @@
+
+>>> [CLI] bundle validate -o json
+[
+  {
+    "environment_variables_key": "default",
+    "spec": {
+      "files": [
+        "/Workspace/Users/[USERNAME]/.bundle/job_environment_variables_files/default/files/env/common.env",
+        "/Volumes/main/default/vol/shared.env",
+        "/Workspace/Shared/shared.env"
+      ],
+      "variables": {
+        "FOO": "bar"
+      }
+    }
+  }
+]
diff --git a/acceptance/bundle/paths/job_environment_variables_files/resources/job.yml b/acceptance/bundle/paths/job_environment_variables_files/resources/job.yml
new file mode 100644
index 00000000000..54b66074fb2
--- /dev/null
+++ b/acceptance/bundle/paths/job_environment_variables_files/resources/job.yml
@@ -0,0 +1,23 @@
+resources:
+  jobs:
+    my_job:
+      name: my job
+      environment_variables:
+        - environment_variables_key: default
+          spec:
+            variables:
+              FOO: bar
+            files:
+              - ../env/common.env
+              - /Volumes/main/default/vol/shared.env
+              - /Workspace/Shared/shared.env
+      tasks:
+        - task_key: my_task
+          environment_key: default
+          environment_variables_key: default
+          spark_python_task:
+            python_file: /Workspace/Shared/main.py
+      environments:
+        - environment_key: default
+          spec:
+            environment_version: "5"
diff --git a/acceptance/bundle/paths/job_environment_variables_files/script b/acceptance/bundle/paths/job_environment_variables_files/script
new file mode 100644
index 00000000000..ec97db7e2b6
--- /dev/null
+++ b/acceptance/bundle/paths/job_environment_variables_files/script
@@ -0,0 +1 @@
+trace $CLI bundle validate -o json | jq '.resources.jobs.my_job.environment_variables'
diff --git a/acceptance/bundle/paths/nominal/out.test.toml b/acceptance/bundle/paths/nominal/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/paths/nominal/out.test.toml
+++ b/acceptance/bundle/paths/nominal/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/paths/outside_root_no_sync/out.test.toml b/acceptance/bundle/paths/outside_root_no_sync/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/paths/outside_root_no_sync/out.test.toml
+++ b/acceptance/bundle/paths/outside_root_no_sync/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/paths/pipeline_expected_file_got_notebook/out.test.toml b/acceptance/bundle/paths/pipeline_expected_file_got_notebook/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/paths/pipeline_expected_file_got_notebook/out.test.toml
+++ b/acceptance/bundle/paths/pipeline_expected_file_got_notebook/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/paths/pipeline_globs/out.test.toml b/acceptance/bundle/paths/pipeline_globs/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/paths/pipeline_globs/out.test.toml
+++ b/acceptance/bundle/paths/pipeline_globs/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/paths/pipeline_root_path_doesnotexist/out.test.toml b/acceptance/bundle/paths/pipeline_root_path_doesnotexist/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/paths/pipeline_root_path_doesnotexist/out.test.toml
+++ b/acceptance/bundle/paths/pipeline_root_path_doesnotexist/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/paths/pipeline_root_path_doesnotexist/output.txt b/acceptance/bundle/paths/pipeline_root_path_doesnotexist/output.txt
index 043526e6692..85ffdf9201e 100644
--- a/acceptance/bundle/paths/pipeline_root_path_doesnotexist/output.txt
+++ b/acceptance/bundle/paths/pipeline_root_path_doesnotexist/output.txt
@@ -9,5 +9,3 @@ Workspace:
   Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
 Found 1 error
-
-Exit code: 1
diff --git a/acceptance/bundle/paths/pipeline_root_path_doesnotexist/script b/acceptance/bundle/paths/pipeline_root_path_doesnotexist/script
index f52b452ee67..277355fe918 100644
--- a/acceptance/bundle/paths/pipeline_root_path_doesnotexist/script
+++ b/acceptance/bundle/paths/pipeline_root_path_doesnotexist/script
@@ -1 +1 @@
-errcode trace $CLI bundle validate
+musterr trace $CLI bundle validate
diff --git a/acceptance/bundle/paths/pipelines_glob_include_and_root_path/out.test.toml b/acceptance/bundle/paths/pipelines_glob_include_and_root_path/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/paths/pipelines_glob_include_and_root_path/out.test.toml
+++ b/acceptance/bundle/paths/pipelines_glob_include_and_root_path/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/paths/pipelines_root_path_outside_sync_root/out.test.toml b/acceptance/bundle/paths/pipelines_root_path_outside_sync_root/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/paths/pipelines_root_path_outside_sync_root/out.test.toml
+++ b/acceptance/bundle/paths/pipelines_root_path_outside_sync_root/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/paths/relative_path_outside_root/out.test.toml b/acceptance/bundle/paths/relative_path_outside_root/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/paths/relative_path_outside_root/out.test.toml
+++ b/acceptance/bundle/paths/relative_path_outside_root/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/paths/relative_path_translation/out.test.toml b/acceptance/bundle/paths/relative_path_translation/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/paths/relative_path_translation/out.test.toml
+++ b/acceptance/bundle/paths/relative_path_translation/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/plan/no_upload/out.test.toml b/acceptance/bundle/plan/no_upload/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/plan/no_upload/out.test.toml
+++ b/acceptance/bundle/plan/no_upload/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/plan/no_upload/output.txt b/acceptance/bundle/plan/no_upload/output.txt
index e6cc86840a8..9711d59171a 100644
--- a/acceptance/bundle/plan/no_upload/output.txt
+++ b/acceptance/bundle/plan/no_upload/output.txt
@@ -4,4 +4,4 @@ create jobs.my_job
 
 Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
 
->>> jq -s .[] | select(.method != "GET") out.requests.txt
+>>> print_requests.py
diff --git a/acceptance/bundle/plan/no_upload/script b/acceptance/bundle/plan/no_upload/script
index 02d44d657ba..03bcb61fde8 100644
--- a/acceptance/bundle/plan/no_upload/script
+++ b/acceptance/bundle/plan/no_upload/script
@@ -1,6 +1,4 @@
 trace $CLI bundle plan
 
 # Expect no non-GET requests
-trace jq -s '.[] | select(.method != "GET")' out.requests.txt
-
-rm out.requests.txt
+trace print_requests.py
diff --git a/acceptance/bundle/plan/no_upload/test.toml b/acceptance/bundle/plan/no_upload/test.toml
index 9efba53719b..7061886de47 100644
--- a/acceptance/bundle/plan/no_upload/test.toml
+++ b/acceptance/bundle/plan/no_upload/test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
 RecordRequests = true
diff --git a/acceptance/bundle/presets/preset_vs_dev_mode/out.test.toml b/acceptance/bundle/presets/preset_vs_dev_mode/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/presets/preset_vs_dev_mode/out.test.toml
+++ b/acceptance/bundle/presets/preset_vs_dev_mode/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/python/README.md b/acceptance/bundle/python/README.md
new file mode 100644
index 00000000000..c3d4812057f
--- /dev/null
+++ b/acceptance/bundle/python/README.md
@@ -0,0 +1,64 @@
+# PyDABs resource acceptance tests
+
+Each `<plural>-support/` directory is the acceptance test for one PyDABs resource. It
+checks that the resource loads both from YAML and from Python and that a mutator runs
+over it. `test_python_support_coverage`
+(`python/databricks_tests/core/test_python_support.py`) requires every PyDABs resource
+to have one, so a newly-onboarded resource needs a fixture here.
+
+Copy an existing one — `alerts-support/` (a resource with required nested fields) or
+`catalogs-support/` are the canonical examples. A fixture is six
+files:
+
+- `databricks.yml` — `bundle.name: my_project`, `sync: {paths: []}`, a top-level
+  `python:` block wiring `resources:load_resources` + `mutators:update_<singular>`, and
+  one YAML-declared instance `<plural>.my_<name>_1`.
+- `resources.py` — `load_resources()` adds a second instance `my_<name>_2` via
+  `resources.add_<singular>(...)`.
+- `mutators.py` — a `@<singular>_mutator` that appends `" (updated)"` to a required
+  string field; it runs over both instances.
+- `script` — copy it verbatim (`bundle validate --output json | jq "pick(...)"`).
+- `test.toml` — `Cloud = false`.
+- `output.txt` — generated, never hand-written.
+
+## Authoring a new one
+
+1. Confirm the resource is wired: `python/databricks/bundles/<plural>/` exists, and
+   `add_<singular>` / `<singular>_mutator` are in `databricks.bundles.core`. If not, it
+   must be onboarded in PyDABs first.
+2. Required fields are the `VariableOr[...]` (no default) fields in
+   `python/databricks/bundles/<plural>/_models/<singular>.py`; set all of them,
+   recursing into required nested objects. `VariableOrOptional[...] = None` fields are
+   optional — omit them.
+3. Get realistic values from `acceptance/bundle/invariant/configs/<singular>.yml.tmpl`,
+   but **adapt**: replace `$UNIQUE_NAME` / `$TEST_DEFAULT_WAREHOUSE_ID` and other `$VAR`s
+   with plain literals, and drop cloud-only blocks (`permissions`, `grants`,
+   `file_path`) — this test is local and deterministic.
+4. `test.toml`: add `EnvMatrix.PYDAB_VERSION = ["current"]` for a brand-new resource
+   (it only exists in the current wheel).
+5. Generate the golden:
+   `go test ./acceptance -run 'TestAccept/bundle/python/<plural>-support' -update`.
+6. **Re-run without `-update`** — it must pass against the golden you just generated. A
+   test that only passes with `-update` is nondeterministic (usually a `$VAR` or a
+   volatile field left in); fix it before finishing.
+
+## Interface (`Any`) fields
+
+A field generated as `VariableOrOptional[Any]` comes from a Go `interface{}` (schema ref
+`#/$defs/interface`) — an untyped blob (e.g. a serialized JSON document) that a Go config
+mutator normalizes to a string at deploy time. From Python it accepts two forms — an inline
+`dict` and a serialized JSON `str` — and the two take different `_transform` code paths, so
+a fixture must exercise **both through `add_<singular>`**. Covering only one leaves the
+other path silently brittle, so add two Python instances:
+
+- one sets the field as a **serialized JSON string** (`my_<name>_2`), and
+- one sets it as an **inline dict** (`my_<name>_3`).
+
+The YAML instance (`my_<name>_1`) may use either form, but it exercises the YAML loader, not
+the Python `Any` path, so it does not substitute for either Python instance. The golden
+shows all of them converging: a dict is marshalled to a compact JSON string, a string passes
+through unchanged. See `cluster_policies-support/` for an example. Apply this to every
+resource with an interface field.
+
+Note: `bundle validate` normalizes the `python:` key to `experimental.python` in the
+output — that's expected.
diff --git a/acceptance/bundle/python/alerts-support/databricks.yml b/acceptance/bundle/python/alerts-support/databricks.yml
new file mode 100644
index 00000000000..7d42b60ec68
--- /dev/null
+++ b/acceptance/bundle/python/alerts-support/databricks.yml
@@ -0,0 +1,24 @@
+bundle:
+  name: my_project
+
+sync: {paths: []} # don't need to copy files
+
+python:
+  resources:
+    - "resources:load_resources"
+  mutators:
+    - "mutators:update_alert"
+
+resources:
+  alerts:
+    my_alert_1:
+      display_name: "My Alert"
+      query_text: "SELECT 1"
+      warehouse_id: "my_warehouse"
+      evaluation:
+        comparison_operator: "GREATER_THAN"
+        source:
+          name: "column_1"
+      schedule:
+        quartz_cron_schedule: "0 0 0 * * ?"
+        timezone_id: "UTC"
diff --git a/acceptance/bundle/python/alerts-support/mutators.py b/acceptance/bundle/python/alerts-support/mutators.py
new file mode 100644
index 00000000000..9d86b12aa45
--- /dev/null
+++ b/acceptance/bundle/python/alerts-support/mutators.py
@@ -0,0 +1,11 @@
+from dataclasses import replace
+
+from databricks.bundles.alerts import Alert
+from databricks.bundles.core import alert_mutator
+
+
+@alert_mutator
+def update_alert(alert: Alert) -> Alert:
+    assert isinstance(alert.display_name, str)
+
+    return replace(alert, display_name=f"{alert.display_name} (updated)")
diff --git a/acceptance/bundle/python/alerts-support/out.test.toml b/acceptance/bundle/python/alerts-support/out.test.toml
new file mode 100644
index 00000000000..aeddf3e619e
--- /dev/null
+++ b/acceptance/bundle/python/alerts-support/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/alerts-support/output.txt b/acceptance/bundle/python/alerts-support/output.txt
new file mode 100644
index 00000000000..e23e145353b
--- /dev/null
+++ b/acceptance/bundle/python/alerts-support/output.txt
@@ -0,0 +1,50 @@
+
+>>> uv run [UV_ARGS] -q [CLI] bundle validate --output json
+{
+  "experimental": {
+    "python": {
+      "mutators": [
+        "mutators:update_alert"
+      ],
+      "resources": [
+        "resources:load_resources"
+      ]
+    }
+  },
+  "resources": {
+    "alerts": {
+      "my_alert_1": {
+        "display_name": "My Alert (updated)",
+        "evaluation": {
+          "comparison_operator": "GREATER_THAN",
+          "source": {
+            "name": "column_1"
+          }
+        },
+        "parent_path": "/Workspace/Users/[USERNAME]/.bundle/my_project/default/resources",
+        "query_text": "SELECT 1",
+        "schedule": {
+          "quartz_cron_schedule": "0 0 0 * * ?",
+          "timezone_id": "UTC"
+        },
+        "warehouse_id": "my_warehouse"
+      },
+      "my_alert_2": {
+        "display_name": "My Alert (2) (updated)",
+        "evaluation": {
+          "comparison_operator": "LESS_THAN",
+          "source": {
+            "name": "column_2"
+          }
+        },
+        "parent_path": "/Workspace/Users/[USERNAME]/.bundle/my_project/default/resources",
+        "query_text": "SELECT 2",
+        "schedule": {
+          "quartz_cron_schedule": "0 0 12 * * ?",
+          "timezone_id": "UTC"
+        },
+        "warehouse_id": "my_warehouse_2"
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/python/alerts-support/resources.py b/acceptance/bundle/python/alerts-support/resources.py
new file mode 100644
index 00000000000..e9dc9112fed
--- /dev/null
+++ b/acceptance/bundle/python/alerts-support/resources.py
@@ -0,0 +1,24 @@
+from databricks.bundles.core import Resources
+
+
+def load_resources() -> Resources:
+    resources = Resources()
+
+    resources.add_alert(
+        "my_alert_2",
+        {
+            "display_name": "My Alert (2)",
+            "query_text": "SELECT 2",
+            "warehouse_id": "my_warehouse_2",
+            "evaluation": {
+                "comparison_operator": "LESS_THAN",
+                "source": {"name": "column_2"},
+            },
+            "schedule": {
+                "quartz_cron_schedule": "0 0 12 * * ?",
+                "timezone_id": "UTC",
+            },
+        },
+    )
+
+    return resources
diff --git a/acceptance/bundle/python/alerts-support/script b/acceptance/bundle/python/alerts-support/script
new file mode 100644
index 00000000000..e273fb45a53
--- /dev/null
+++ b/acceptance/bundle/python/alerts-support/script
@@ -0,0 +1,5 @@
+
+trace uv run $UV_ARGS -q $CLI bundle validate --output json | \
+  jq "pick(.experimental.python, .resources)"
+
+rm -fr .databricks __pycache__
diff --git a/acceptance/bundle/python/alerts-support/test.toml b/acceptance/bundle/python/alerts-support/test.toml
new file mode 100644
index 00000000000..1f959d0b164
--- /dev/null
+++ b/acceptance/bundle/python/alerts-support/test.toml
@@ -0,0 +1,4 @@
+Cloud = false # tests don't interact with APIs
+
+# alerts are only supported in the current version of the wheel
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/resources/grants/schemas/change_privilege/out.destroy.requests.direct.json b/acceptance/bundle/python/apps-support/app1/placeholder.txt
similarity index 100%
rename from acceptance/bundle/resources/grants/schemas/change_privilege/out.destroy.requests.direct.json
rename to acceptance/bundle/python/apps-support/app1/placeholder.txt
diff --git a/acceptance/bundle/resources/grants/schemas/empty_array/out.deploy1.requests.terraform.json b/acceptance/bundle/python/apps-support/app2/placeholder.txt
similarity index 100%
rename from acceptance/bundle/resources/grants/schemas/empty_array/out.deploy1.requests.terraform.json
rename to acceptance/bundle/python/apps-support/app2/placeholder.txt
diff --git a/acceptance/bundle/python/apps-support/databricks.yml b/acceptance/bundle/python/apps-support/databricks.yml
new file mode 100644
index 00000000000..6b65d541d4a
--- /dev/null
+++ b/acceptance/bundle/python/apps-support/databricks.yml
@@ -0,0 +1,17 @@
+bundle:
+  name: my_project
+
+sync: {paths: []} # don't need to copy files
+
+python:
+  resources:
+    - "resources:load_resources"
+  mutators:
+    - "mutators:update_app"
+
+resources:
+  apps:
+    my_app_1:
+      name: "my_app_1"
+      description: "My app"
+      source_code_path: "./app1"
diff --git a/acceptance/bundle/python/apps-support/mutators.py b/acceptance/bundle/python/apps-support/mutators.py
new file mode 100644
index 00000000000..ab2d11dd921
--- /dev/null
+++ b/acceptance/bundle/python/apps-support/mutators.py
@@ -0,0 +1,11 @@
+from dataclasses import replace
+
+from databricks.bundles.apps import App
+from databricks.bundles.core import app_mutator
+
+
+@app_mutator
+def update_app(app: App) -> App:
+    assert isinstance(app.name, str)
+
+    return replace(app, name=f"{app.name} (updated)")
diff --git a/acceptance/bundle/python/apps-support/out.test.toml b/acceptance/bundle/python/apps-support/out.test.toml
new file mode 100644
index 00000000000..aeddf3e619e
--- /dev/null
+++ b/acceptance/bundle/python/apps-support/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/apps-support/output.txt b/acceptance/bundle/python/apps-support/output.txt
new file mode 100644
index 00000000000..a640e206e55
--- /dev/null
+++ b/acceptance/bundle/python/apps-support/output.txt
@@ -0,0 +1,28 @@
+
+>>> uv run [UV_ARGS] -q [CLI] bundle validate --output json
+{
+  "experimental": {
+    "python": {
+      "mutators": [
+        "mutators:update_app"
+      ],
+      "resources": [
+        "resources:load_resources"
+      ]
+    }
+  },
+  "resources": {
+    "apps": {
+      "my_app_1": {
+        "description": "My app",
+        "name": "my_app_1 (updated)",
+        "source_code_path": "/Workspace/Users/[USERNAME]/.bundle/my_project/default/files/app1"
+      },
+      "my_app_2": {
+        "description": "My app (2)",
+        "name": "my_app_2 (updated)",
+        "source_code_path": "/Workspace/Users/[USERNAME]/.bundle/my_project/default/files/app2"
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/python/apps-support/resources.py b/acceptance/bundle/python/apps-support/resources.py
new file mode 100644
index 00000000000..593123f6e6c
--- /dev/null
+++ b/acceptance/bundle/python/apps-support/resources.py
@@ -0,0 +1,16 @@
+from databricks.bundles.core import Resources
+
+
+def load_resources() -> Resources:
+    resources = Resources()
+
+    resources.add_app(
+        "my_app_2",
+        {
+            "name": "my_app_2",
+            "description": "My app (2)",
+            "source_code_path": "./app2",
+        },
+    )
+
+    return resources
diff --git a/acceptance/bundle/python/apps-support/script b/acceptance/bundle/python/apps-support/script
new file mode 100644
index 00000000000..e273fb45a53
--- /dev/null
+++ b/acceptance/bundle/python/apps-support/script
@@ -0,0 +1,5 @@
+
+trace uv run $UV_ARGS -q $CLI bundle validate --output json | \
+  jq "pick(.experimental.python, .resources)"
+
+rm -fr .databricks __pycache__
diff --git a/acceptance/bundle/python/apps-support/test.toml b/acceptance/bundle/python/apps-support/test.toml
new file mode 100644
index 00000000000..b7fda406b0c
--- /dev/null
+++ b/acceptance/bundle/python/apps-support/test.toml
@@ -0,0 +1,4 @@
+Cloud = false # tests don't interact with APIs
+
+# apps are only supported in the current version of the wheel
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/catalogs-support/databricks.yml b/acceptance/bundle/python/catalogs-support/databricks.yml
new file mode 100644
index 00000000000..c9a049d5831
--- /dev/null
+++ b/acceptance/bundle/python/catalogs-support/databricks.yml
@@ -0,0 +1,16 @@
+bundle:
+  name: my_project
+
+sync: {paths: []} # don't need to copy files
+
+python:
+  resources:
+    - "resources:load_resources"
+  mutators:
+    - "mutators:update_catalog"
+
+resources:
+  catalogs:
+    my_catalog_1:
+      name: "my_catalog_1"
+      comment: "My catalog"
diff --git a/acceptance/bundle/python/catalogs-support/mutators.py b/acceptance/bundle/python/catalogs-support/mutators.py
new file mode 100644
index 00000000000..5d024a928a8
--- /dev/null
+++ b/acceptance/bundle/python/catalogs-support/mutators.py
@@ -0,0 +1,11 @@
+from dataclasses import replace
+
+from databricks.bundles.catalogs import Catalog
+from databricks.bundles.core import catalog_mutator
+
+
+@catalog_mutator
+def update_catalog(catalog: Catalog) -> Catalog:
+    assert isinstance(catalog.comment, str)
+
+    return replace(catalog, comment=f"{catalog.comment} (updated)")
diff --git a/acceptance/bundle/python/catalogs-support/out.test.toml b/acceptance/bundle/python/catalogs-support/out.test.toml
new file mode 100644
index 00000000000..aeddf3e619e
--- /dev/null
+++ b/acceptance/bundle/python/catalogs-support/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/catalogs-support/output.txt b/acceptance/bundle/python/catalogs-support/output.txt
new file mode 100644
index 00000000000..7022fa145c8
--- /dev/null
+++ b/acceptance/bundle/python/catalogs-support/output.txt
@@ -0,0 +1,26 @@
+
+>>> uv run [UV_ARGS] -q [CLI] bundle validate --output json
+{
+  "experimental": {
+    "python": {
+      "mutators": [
+        "mutators:update_catalog"
+      ],
+      "resources": [
+        "resources:load_resources"
+      ]
+    }
+  },
+  "resources": {
+    "catalogs": {
+      "my_catalog_1": {
+        "comment": "My catalog (updated)",
+        "name": "my_catalog_1"
+      },
+      "my_catalog_2": {
+        "comment": "My catalog (2) (updated)",
+        "name": "my_catalog_2"
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/python/catalogs-support/resources.py b/acceptance/bundle/python/catalogs-support/resources.py
new file mode 100644
index 00000000000..d5f91ed2d8e
--- /dev/null
+++ b/acceptance/bundle/python/catalogs-support/resources.py
@@ -0,0 +1,15 @@
+from databricks.bundles.core import Resources
+
+
+def load_resources() -> Resources:
+    resources = Resources()
+
+    resources.add_catalog(
+        "my_catalog_2",
+        {
+            "name": "my_catalog_2",
+            "comment": "My catalog (2)",
+        },
+    )
+
+    return resources
diff --git a/acceptance/bundle/python/catalogs-support/script b/acceptance/bundle/python/catalogs-support/script
new file mode 100644
index 00000000000..e273fb45a53
--- /dev/null
+++ b/acceptance/bundle/python/catalogs-support/script
@@ -0,0 +1,5 @@
+
+trace uv run $UV_ARGS -q $CLI bundle validate --output json | \
+  jq "pick(.experimental.python, .resources)"
+
+rm -fr .databricks __pycache__
diff --git a/acceptance/bundle/python/catalogs-support/test.toml b/acceptance/bundle/python/catalogs-support/test.toml
new file mode 100644
index 00000000000..476e72e7def
--- /dev/null
+++ b/acceptance/bundle/python/catalogs-support/test.toml
@@ -0,0 +1,6 @@
+Cloud = false # tests don't interact with APIs
+
+# catalogs are only supported in the current version of the wheel
+EnvMatrix.PYDAB_VERSION = ["current"]
+
+# catalogs are only supported on the direct deployment engine
diff --git a/acceptance/bundle/python/cluster_policies-support/databricks.yml b/acceptance/bundle/python/cluster_policies-support/databricks.yml
new file mode 100644
index 00000000000..d4b0a7c22ed
--- /dev/null
+++ b/acceptance/bundle/python/cluster_policies-support/databricks.yml
@@ -0,0 +1,21 @@
+bundle:
+  name: my_project
+
+sync: {paths: []} # don't need to copy files
+
+python:
+  resources:
+    - "resources:load_resources"
+  mutators:
+    - "mutators:update_cluster_policy"
+
+resources:
+  cluster_policies:
+    my_cluster_policy_1:
+      name: "my_cluster_policy_1"
+      description: "My cluster policy"
+      # interface{} field authored inline as a YAML map
+      definition:
+        spark_version:
+          type: fixed
+          value: "13.3.x-scala2.12"
diff --git a/acceptance/bundle/python/cluster_policies-support/mutators.py b/acceptance/bundle/python/cluster_policies-support/mutators.py
new file mode 100644
index 00000000000..608c5beff3b
--- /dev/null
+++ b/acceptance/bundle/python/cluster_policies-support/mutators.py
@@ -0,0 +1,11 @@
+from dataclasses import replace
+
+from databricks.bundles.cluster_policies import ClusterPolicy
+from databricks.bundles.core import cluster_policy_mutator
+
+
+@cluster_policy_mutator
+def update_cluster_policy(cluster_policy: ClusterPolicy) -> ClusterPolicy:
+    assert isinstance(cluster_policy.description, str)
+
+    return replace(cluster_policy, description=f"{cluster_policy.description} (updated)")
diff --git a/acceptance/bundle/python/cluster_policies-support/out.test.toml b/acceptance/bundle/python/cluster_policies-support/out.test.toml
new file mode 100644
index 00000000000..aeddf3e619e
--- /dev/null
+++ b/acceptance/bundle/python/cluster_policies-support/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/cluster_policies-support/output.txt b/acceptance/bundle/python/cluster_policies-support/output.txt
new file mode 100644
index 00000000000..c3492316cff
--- /dev/null
+++ b/acceptance/bundle/python/cluster_policies-support/output.txt
@@ -0,0 +1,33 @@
+
+>>> uv run [UV_ARGS] -q [CLI] bundle validate --output json
+{
+  "experimental": {
+    "python": {
+      "mutators": [
+        "mutators:update_cluster_policy"
+      ],
+      "resources": [
+        "resources:load_resources"
+      ]
+    }
+  },
+  "resources": {
+    "cluster_policies": {
+      "my_cluster_policy_1": {
+        "definition": "{\"spark_version\":{\"type\":\"fixed\",\"value\":\"13.3.x-scala2.12\"}}",
+        "description": "My cluster policy (updated)",
+        "name": "my_cluster_policy_1"
+      },
+      "my_cluster_policy_2": {
+        "definition": "{\"spark_version\": {\"type\": \"fixed\", \"value\": \"13.3.x-scala2.12\"}}",
+        "description": "My cluster policy (2) (updated)",
+        "name": "my_cluster_policy_2"
+      },
+      "my_cluster_policy_3": {
+        "definition": "{\"spark_version\":{\"type\":\"fixed\",\"value\":\"13.3.x-scala2.12\"}}",
+        "description": "My cluster policy (3) (updated)",
+        "name": "my_cluster_policy_3"
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/python/cluster_policies-support/resources.py b/acceptance/bundle/python/cluster_policies-support/resources.py
new file mode 100644
index 00000000000..3fd0db27aba
--- /dev/null
+++ b/acceptance/bundle/python/cluster_policies-support/resources.py
@@ -0,0 +1,32 @@
+from databricks.bundles.core import Resources
+
+
+def load_resources() -> Resources:
+    resources = Resources()
+
+    # interface{} field authored as a serialized JSON string
+    resources.add_cluster_policy(
+        "my_cluster_policy_2",
+        {
+            "name": "my_cluster_policy_2",
+            "description": "My cluster policy (2)",
+            "definition": '{"spark_version": {"type": "fixed", "value": "13.3.x-scala2.12"}}',
+        },
+    )
+
+    # interface{} field authored as an inline dict
+    resources.add_cluster_policy(
+        "my_cluster_policy_3",
+        {
+            "name": "my_cluster_policy_3",
+            "description": "My cluster policy (3)",
+            "definition": {
+                "spark_version": {
+                    "type": "fixed",
+                    "value": "13.3.x-scala2.12",
+                },
+            },
+        },
+    )
+
+    return resources
diff --git a/acceptance/bundle/python/cluster_policies-support/script b/acceptance/bundle/python/cluster_policies-support/script
new file mode 100644
index 00000000000..e273fb45a53
--- /dev/null
+++ b/acceptance/bundle/python/cluster_policies-support/script
@@ -0,0 +1,5 @@
+
+trace uv run $UV_ARGS -q $CLI bundle validate --output json | \
+  jq "pick(.experimental.python, .resources)"
+
+rm -fr .databricks __pycache__
diff --git a/acceptance/bundle/python/cluster_policies-support/test.toml b/acceptance/bundle/python/cluster_policies-support/test.toml
new file mode 100644
index 00000000000..94f72755775
--- /dev/null
+++ b/acceptance/bundle/python/cluster_policies-support/test.toml
@@ -0,0 +1,6 @@
+Cloud = false # tests don't interact with APIs
+
+# cluster_policies are only supported in the current version of the wheel
+EnvMatrix.PYDAB_VERSION = ["current"]
+
+# cluster_policies are only supported on the direct deployment engine
diff --git a/acceptance/bundle/python/clusters-support/databricks.yml b/acceptance/bundle/python/clusters-support/databricks.yml
new file mode 100644
index 00000000000..7c90267663e
--- /dev/null
+++ b/acceptance/bundle/python/clusters-support/databricks.yml
@@ -0,0 +1,17 @@
+bundle:
+  name: my_project
+
+sync: {paths: []} # don't need to copy files
+
+python:
+  resources:
+    - "resources:load_resources"
+  mutators:
+    - "mutators:update_cluster"
+
+resources:
+  clusters:
+    my_cluster_1:
+      cluster_name: "my_cluster_1"
+      spark_version: "13.3.x-scala2.12"
+      num_workers: 1
diff --git a/acceptance/bundle/python/clusters-support/mutators.py b/acceptance/bundle/python/clusters-support/mutators.py
new file mode 100644
index 00000000000..8aad2a5bc8c
--- /dev/null
+++ b/acceptance/bundle/python/clusters-support/mutators.py
@@ -0,0 +1,11 @@
+from dataclasses import replace
+
+from databricks.bundles.clusters import Cluster
+from databricks.bundles.core import cluster_mutator
+
+
+@cluster_mutator
+def update_cluster(cluster: Cluster) -> Cluster:
+    assert isinstance(cluster.cluster_name, str)
+
+    return replace(cluster, cluster_name=f"{cluster.cluster_name} (updated)")
diff --git a/acceptance/bundle/python/clusters-support/out.test.toml b/acceptance/bundle/python/clusters-support/out.test.toml
new file mode 100644
index 00000000000..aeddf3e619e
--- /dev/null
+++ b/acceptance/bundle/python/clusters-support/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/clusters-support/output.txt b/acceptance/bundle/python/clusters-support/output.txt
new file mode 100644
index 00000000000..6088a23cb7d
--- /dev/null
+++ b/acceptance/bundle/python/clusters-support/output.txt
@@ -0,0 +1,30 @@
+
+>>> uv run [UV_ARGS] -q [CLI] bundle validate --output json
+{
+  "experimental": {
+    "python": {
+      "mutators": [
+        "mutators:update_cluster"
+      ],
+      "resources": [
+        "resources:load_resources"
+      ]
+    }
+  },
+  "resources": {
+    "clusters": {
+      "my_cluster_1": {
+        "autotermination_minutes": 60,
+        "cluster_name": "my_cluster_1 (updated)",
+        "num_workers": 1,
+        "spark_version": "13.3.x-scala2.12"
+      },
+      "my_cluster_2": {
+        "autotermination_minutes": 60,
+        "cluster_name": "my_cluster_2 (updated)",
+        "num_workers": 1,
+        "spark_version": "13.3.x-scala2.12"
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/python/clusters-support/resources.py b/acceptance/bundle/python/clusters-support/resources.py
new file mode 100644
index 00000000000..434349b2bbe
--- /dev/null
+++ b/acceptance/bundle/python/clusters-support/resources.py
@@ -0,0 +1,16 @@
+from databricks.bundles.core import Resources
+
+
+def load_resources() -> Resources:
+    resources = Resources()
+
+    resources.add_cluster(
+        "my_cluster_2",
+        {
+            "cluster_name": "my_cluster_2",
+            "spark_version": "13.3.x-scala2.12",
+            "num_workers": 1,
+        },
+    )
+
+    return resources
diff --git a/acceptance/bundle/python/clusters-support/script b/acceptance/bundle/python/clusters-support/script
new file mode 100644
index 00000000000..e273fb45a53
--- /dev/null
+++ b/acceptance/bundle/python/clusters-support/script
@@ -0,0 +1,5 @@
+
+trace uv run $UV_ARGS -q $CLI bundle validate --output json | \
+  jq "pick(.experimental.python, .resources)"
+
+rm -fr .databricks __pycache__
diff --git a/acceptance/bundle/python/clusters-support/test.toml b/acceptance/bundle/python/clusters-support/test.toml
new file mode 100644
index 00000000000..7b118126b12
--- /dev/null
+++ b/acceptance/bundle/python/clusters-support/test.toml
@@ -0,0 +1,4 @@
+Cloud = false # tests don't interact with APIs
+
+# clusters are only supported in the current version of the wheel
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/dashboards-support/databricks.yml b/acceptance/bundle/python/dashboards-support/databricks.yml
new file mode 100644
index 00000000000..4ccdfa0f679
--- /dev/null
+++ b/acceptance/bundle/python/dashboards-support/databricks.yml
@@ -0,0 +1,22 @@
+bundle:
+  name: my_project
+
+sync: {paths: []} # don't need to copy files
+
+python:
+  resources:
+    - "resources:load_resources"
+  mutators:
+    - "mutators:update_dashboard"
+
+resources:
+  dashboards:
+    my_dashboard_1:
+      display_name: "my_dashboard_1"
+      warehouse_id: "abc123"
+      parent_path: "/Workspace/Users/me"
+      # interface{} field authored inline as a YAML map
+      serialized_dashboard:
+        pages:
+          - name: main
+            displayName: "Main"
diff --git a/acceptance/bundle/python/dashboards-support/mutators.py b/acceptance/bundle/python/dashboards-support/mutators.py
new file mode 100644
index 00000000000..ec5c2562016
--- /dev/null
+++ b/acceptance/bundle/python/dashboards-support/mutators.py
@@ -0,0 +1,11 @@
+from dataclasses import replace
+
+from databricks.bundles.core import dashboard_mutator
+from databricks.bundles.dashboards import Dashboard
+
+
+@dashboard_mutator
+def update_dashboard(dashboard: Dashboard) -> Dashboard:
+    assert isinstance(dashboard.display_name, str)
+
+    return replace(dashboard, display_name=f"{dashboard.display_name} (updated)")
diff --git a/acceptance/bundle/python/dashboards-support/out.test.toml b/acceptance/bundle/python/dashboards-support/out.test.toml
new file mode 100644
index 00000000000..aeddf3e619e
--- /dev/null
+++ b/acceptance/bundle/python/dashboards-support/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/dashboards-support/output.txt b/acceptance/bundle/python/dashboards-support/output.txt
new file mode 100644
index 00000000000..fa762d2a2c3
--- /dev/null
+++ b/acceptance/bundle/python/dashboards-support/output.txt
@@ -0,0 +1,39 @@
+
+>>> uv run [UV_ARGS] -q [CLI] bundle validate --output json
+{
+  "experimental": {
+    "python": {
+      "mutators": [
+        "mutators:update_dashboard"
+      ],
+      "resources": [
+        "resources:load_resources"
+      ]
+    }
+  },
+  "resources": {
+    "dashboards": {
+      "my_dashboard_1": {
+        "display_name": "my_dashboard_1 (updated)",
+        "embed_credentials": false,
+        "parent_path": "/Workspace/Users/me",
+        "serialized_dashboard": "{\"pages\":[{\"displayName\":\"Main\",\"name\":\"main\"}]}",
+        "warehouse_id": "abc123"
+      },
+      "my_dashboard_2": {
+        "display_name": "my_dashboard_2 (updated)",
+        "embed_credentials": false,
+        "parent_path": "/Workspace/Users/me",
+        "serialized_dashboard": "{\"pages\": [{\"name\": \"main\", \"displayName\": \"Main\"}]}",
+        "warehouse_id": "abc123"
+      },
+      "my_dashboard_3": {
+        "display_name": "my_dashboard_3 (updated)",
+        "embed_credentials": false,
+        "parent_path": "/Workspace/Users/me",
+        "serialized_dashboard": "{\"pages\":[{\"displayName\":\"Main\",\"name\":\"main\"}]}",
+        "warehouse_id": "abc123"
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/python/dashboards-support/resources.py b/acceptance/bundle/python/dashboards-support/resources.py
new file mode 100644
index 00000000000..8aabcdb83ad
--- /dev/null
+++ b/acceptance/bundle/python/dashboards-support/resources.py
@@ -0,0 +1,36 @@
+from databricks.bundles.core import Resources
+
+
+def load_resources() -> Resources:
+    resources = Resources()
+
+    # interface{} field authored as a serialized JSON string
+    resources.add_dashboard(
+        "my_dashboard_2",
+        {
+            "display_name": "my_dashboard_2",
+            "warehouse_id": "abc123",
+            "parent_path": "/Workspace/Users/me",
+            "serialized_dashboard": '{"pages": [{"name": "main", "displayName": "Main"}]}',
+        },
+    )
+
+    # interface{} field authored as an inline dict
+    resources.add_dashboard(
+        "my_dashboard_3",
+        {
+            "display_name": "my_dashboard_3",
+            "warehouse_id": "abc123",
+            "parent_path": "/Workspace/Users/me",
+            "serialized_dashboard": {
+                "pages": [
+                    {
+                        "name": "main",
+                        "displayName": "Main",
+                    },
+                ],
+            },
+        },
+    )
+
+    return resources
diff --git a/acceptance/bundle/python/dashboards-support/script b/acceptance/bundle/python/dashboards-support/script
new file mode 100644
index 00000000000..e273fb45a53
--- /dev/null
+++ b/acceptance/bundle/python/dashboards-support/script
@@ -0,0 +1,5 @@
+
+trace uv run $UV_ARGS -q $CLI bundle validate --output json | \
+  jq "pick(.experimental.python, .resources)"
+
+rm -fr .databricks __pycache__
diff --git a/acceptance/bundle/python/dashboards-support/test.toml b/acceptance/bundle/python/dashboards-support/test.toml
new file mode 100644
index 00000000000..3b72786e9dd
--- /dev/null
+++ b/acceptance/bundle/python/dashboards-support/test.toml
@@ -0,0 +1,4 @@
+Cloud = false # tests don't interact with APIs
+
+# dashboards are only supported in the current version of the wheel
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/database_catalogs-support/databricks.yml b/acceptance/bundle/python/database_catalogs-support/databricks.yml
new file mode 100644
index 00000000000..869592c9a17
--- /dev/null
+++ b/acceptance/bundle/python/database_catalogs-support/databricks.yml
@@ -0,0 +1,17 @@
+bundle:
+  name: my_project
+
+sync: {paths: []} # don't need to copy files
+
+python:
+  resources:
+    - "resources:load_resources"
+  mutators:
+    - "mutators:update_database_catalog"
+
+resources:
+  database_catalogs:
+    my_database_catalog_1:
+      database_instance_name: "test_instance"
+      database_name: "test_db"
+      name: "my_database_catalog_1"
diff --git a/acceptance/bundle/python/database_catalogs-support/mutators.py b/acceptance/bundle/python/database_catalogs-support/mutators.py
new file mode 100644
index 00000000000..802a2a40bfc
--- /dev/null
+++ b/acceptance/bundle/python/database_catalogs-support/mutators.py
@@ -0,0 +1,11 @@
+from dataclasses import replace
+
+from databricks.bundles.core import database_catalog_mutator
+from databricks.bundles.database_catalogs import DatabaseCatalog
+
+
+@database_catalog_mutator
+def update_database_catalog(database_catalog: DatabaseCatalog) -> DatabaseCatalog:
+    assert isinstance(database_catalog.name, str)
+
+    return replace(database_catalog, name=f"{database_catalog.name} (updated)")
diff --git a/acceptance/bundle/python/database_catalogs-support/out.test.toml b/acceptance/bundle/python/database_catalogs-support/out.test.toml
new file mode 100644
index 00000000000..aeddf3e619e
--- /dev/null
+++ b/acceptance/bundle/python/database_catalogs-support/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/database_catalogs-support/output.txt b/acceptance/bundle/python/database_catalogs-support/output.txt
new file mode 100644
index 00000000000..5b72712ddaa
--- /dev/null
+++ b/acceptance/bundle/python/database_catalogs-support/output.txt
@@ -0,0 +1,28 @@
+
+>>> uv run [UV_ARGS] -q [CLI] bundle validate --output json
+{
+  "experimental": {
+    "python": {
+      "mutators": [
+        "mutators:update_database_catalog"
+      ],
+      "resources": [
+        "resources:load_resources"
+      ]
+    }
+  },
+  "resources": {
+    "database_catalogs": {
+      "my_database_catalog_1": {
+        "database_instance_name": "test_instance",
+        "database_name": "test_db",
+        "name": "my_database_catalog_1 (updated)"
+      },
+      "my_database_catalog_2": {
+        "database_instance_name": "test_instance",
+        "database_name": "test_db_2",
+        "name": "my_database_catalog_2 (updated)"
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/python/database_catalogs-support/resources.py b/acceptance/bundle/python/database_catalogs-support/resources.py
new file mode 100644
index 00000000000..8aa8ca8a96b
--- /dev/null
+++ b/acceptance/bundle/python/database_catalogs-support/resources.py
@@ -0,0 +1,16 @@
+from databricks.bundles.core import Resources
+
+
+def load_resources() -> Resources:
+    resources = Resources()
+
+    resources.add_database_catalog(
+        "my_database_catalog_2",
+        {
+            "database_instance_name": "test_instance",
+            "database_name": "test_db_2",
+            "name": "my_database_catalog_2",
+        },
+    )
+
+    return resources
diff --git a/acceptance/bundle/python/database_catalogs-support/script b/acceptance/bundle/python/database_catalogs-support/script
new file mode 100644
index 00000000000..e273fb45a53
--- /dev/null
+++ b/acceptance/bundle/python/database_catalogs-support/script
@@ -0,0 +1,5 @@
+
+trace uv run $UV_ARGS -q $CLI bundle validate --output json | \
+  jq "pick(.experimental.python, .resources)"
+
+rm -fr .databricks __pycache__
diff --git a/acceptance/bundle/python/database_catalogs-support/test.toml b/acceptance/bundle/python/database_catalogs-support/test.toml
new file mode 100644
index 00000000000..8ef152dbe21
--- /dev/null
+++ b/acceptance/bundle/python/database_catalogs-support/test.toml
@@ -0,0 +1,4 @@
+Cloud = false # tests don't interact with APIs
+
+# database_catalogs are only supported in the current version of the wheel
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/database_instances-support/databricks.yml b/acceptance/bundle/python/database_instances-support/databricks.yml
new file mode 100644
index 00000000000..fd6e9f200ae
--- /dev/null
+++ b/acceptance/bundle/python/database_instances-support/databricks.yml
@@ -0,0 +1,16 @@
+bundle:
+  name: my_project
+
+sync: {paths: []} # don't need to copy files
+
+python:
+  resources:
+    - "resources:load_resources"
+  mutators:
+    - "mutators:update_database_instance"
+
+resources:
+  database_instances:
+    my_database_instance_1:
+      name: "my_database_instance_1"
+      capacity: "CU_1"
diff --git a/acceptance/bundle/python/database_instances-support/mutators.py b/acceptance/bundle/python/database_instances-support/mutators.py
new file mode 100644
index 00000000000..685551d1ee6
--- /dev/null
+++ b/acceptance/bundle/python/database_instances-support/mutators.py
@@ -0,0 +1,11 @@
+from dataclasses import replace
+
+from databricks.bundles.database_instances import DatabaseInstance
+from databricks.bundles.core import database_instance_mutator
+
+
+@database_instance_mutator
+def update_database_instance(database_instance: DatabaseInstance) -> DatabaseInstance:
+    assert isinstance(database_instance.name, str)
+
+    return replace(database_instance, name=f"{database_instance.name} (updated)")
diff --git a/acceptance/bundle/python/database_instances-support/out.test.toml b/acceptance/bundle/python/database_instances-support/out.test.toml
new file mode 100644
index 00000000000..aeddf3e619e
--- /dev/null
+++ b/acceptance/bundle/python/database_instances-support/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/database_instances-support/output.txt b/acceptance/bundle/python/database_instances-support/output.txt
new file mode 100644
index 00000000000..6ce8aadf764
--- /dev/null
+++ b/acceptance/bundle/python/database_instances-support/output.txt
@@ -0,0 +1,26 @@
+
+>>> uv run [UV_ARGS] -q [CLI] bundle validate --output json
+{
+  "experimental": {
+    "python": {
+      "mutators": [
+        "mutators:update_database_instance"
+      ],
+      "resources": [
+        "resources:load_resources"
+      ]
+    }
+  },
+  "resources": {
+    "database_instances": {
+      "my_database_instance_1": {
+        "capacity": "CU_1",
+        "name": "my_database_instance_1 (updated)"
+      },
+      "my_database_instance_2": {
+        "capacity": "CU_1",
+        "name": "my_database_instance_2 (updated)"
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/python/database_instances-support/resources.py b/acceptance/bundle/python/database_instances-support/resources.py
new file mode 100644
index 00000000000..ab65ede3d26
--- /dev/null
+++ b/acceptance/bundle/python/database_instances-support/resources.py
@@ -0,0 +1,15 @@
+from databricks.bundles.core import Resources
+
+
+def load_resources() -> Resources:
+    resources = Resources()
+
+    resources.add_database_instance(
+        "my_database_instance_2",
+        {
+            "name": "my_database_instance_2",
+            "capacity": "CU_1",
+        },
+    )
+
+    return resources
diff --git a/acceptance/bundle/python/database_instances-support/script b/acceptance/bundle/python/database_instances-support/script
new file mode 100644
index 00000000000..e273fb45a53
--- /dev/null
+++ b/acceptance/bundle/python/database_instances-support/script
@@ -0,0 +1,5 @@
+
+trace uv run $UV_ARGS -q $CLI bundle validate --output json | \
+  jq "pick(.experimental.python, .resources)"
+
+rm -fr .databricks __pycache__
diff --git a/acceptance/bundle/python/database_instances-support/test.toml b/acceptance/bundle/python/database_instances-support/test.toml
new file mode 100644
index 00000000000..a2093f387f2
--- /dev/null
+++ b/acceptance/bundle/python/database_instances-support/test.toml
@@ -0,0 +1,4 @@
+Cloud = false # tests don't interact with APIs
+
+# database_instances are only supported in the current version of the wheel
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/experimental-compatibility-both-equal/out.test.toml b/acceptance/bundle/python/experimental-compatibility-both-equal/out.test.toml
index 0969b3f3733..dce9192f28d 100644
--- a/acceptance/bundle/python/experimental-compatibility-both-equal/out.test.toml
+++ b/acceptance/bundle/python/experimental-compatibility-both-equal/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
 EnvMatrix.PYDAB_VERSION = ["0.266.0", "current"]
diff --git a/acceptance/bundle/python/experimental-compatibility-both-error/out.test.toml b/acceptance/bundle/python/experimental-compatibility-both-error/out.test.toml
index 0969b3f3733..dce9192f28d 100644
--- a/acceptance/bundle/python/experimental-compatibility-both-error/out.test.toml
+++ b/acceptance/bundle/python/experimental-compatibility-both-error/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
 EnvMatrix.PYDAB_VERSION = ["0.266.0", "current"]
diff --git a/acceptance/bundle/python/experimental-compatibility/out.test.toml b/acceptance/bundle/python/experimental-compatibility/out.test.toml
index 0969b3f3733..dce9192f28d 100644
--- a/acceptance/bundle/python/experimental-compatibility/out.test.toml
+++ b/acceptance/bundle/python/experimental-compatibility/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
 EnvMatrix.PYDAB_VERSION = ["0.266.0", "current"]
diff --git a/acceptance/bundle/python/experiments-support/databricks.yml b/acceptance/bundle/python/experiments-support/databricks.yml
new file mode 100644
index 00000000000..8f891041585
--- /dev/null
+++ b/acceptance/bundle/python/experiments-support/databricks.yml
@@ -0,0 +1,15 @@
+bundle:
+  name: my_project
+
+sync: {paths: []} # don't need to copy files
+
+python:
+  resources:
+    - "resources:load_resources"
+  mutators:
+    - "mutators:update_mlflow_experiment"
+
+resources:
+  experiments:
+    my_experiment_1:
+      name: "/my_experiment_1"
diff --git a/acceptance/bundle/python/experiments-support/mutators.py b/acceptance/bundle/python/experiments-support/mutators.py
new file mode 100644
index 00000000000..682f2ee8e99
--- /dev/null
+++ b/acceptance/bundle/python/experiments-support/mutators.py
@@ -0,0 +1,11 @@
+from dataclasses import replace
+
+from databricks.bundles.experiments import MlflowExperiment
+from databricks.bundles.core import mlflow_experiment_mutator
+
+
+@mlflow_experiment_mutator
+def update_mlflow_experiment(experiment: MlflowExperiment) -> MlflowExperiment:
+    assert isinstance(experiment.name, str)
+
+    return replace(experiment, name=f"{experiment.name} (updated)")
diff --git a/acceptance/bundle/python/experiments-support/out.test.toml b/acceptance/bundle/python/experiments-support/out.test.toml
new file mode 100644
index 00000000000..aeddf3e619e
--- /dev/null
+++ b/acceptance/bundle/python/experiments-support/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/experiments-support/output.txt b/acceptance/bundle/python/experiments-support/output.txt
new file mode 100644
index 00000000000..4280a2bc8de
--- /dev/null
+++ b/acceptance/bundle/python/experiments-support/output.txt
@@ -0,0 +1,24 @@
+
+>>> uv run [UV_ARGS] -q [CLI] bundle validate --output json
+{
+  "experimental": {
+    "python": {
+      "mutators": [
+        "mutators:update_mlflow_experiment"
+      ],
+      "resources": [
+        "resources:load_resources"
+      ]
+    }
+  },
+  "resources": {
+    "experiments": {
+      "my_experiment_1": {
+        "name": "//my_experiment_1 (updated)"
+      },
+      "my_experiment_2": {
+        "name": "//my_experiment_2 (updated)"
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/python/experiments-support/resources.py b/acceptance/bundle/python/experiments-support/resources.py
new file mode 100644
index 00000000000..a3db67dac41
--- /dev/null
+++ b/acceptance/bundle/python/experiments-support/resources.py
@@ -0,0 +1,14 @@
+from databricks.bundles.core import Resources
+
+
+def load_resources() -> Resources:
+    resources = Resources()
+
+    resources.add_mlflow_experiment(
+        "my_experiment_2",
+        {
+            "name": "/my_experiment_2",
+        },
+    )
+
+    return resources
diff --git a/acceptance/bundle/python/experiments-support/script b/acceptance/bundle/python/experiments-support/script
new file mode 100644
index 00000000000..e273fb45a53
--- /dev/null
+++ b/acceptance/bundle/python/experiments-support/script
@@ -0,0 +1,5 @@
+
+trace uv run $UV_ARGS -q $CLI bundle validate --output json | \
+  jq "pick(.experimental.python, .resources)"
+
+rm -fr .databricks __pycache__
diff --git a/acceptance/bundle/python/experiments-support/test.toml b/acceptance/bundle/python/experiments-support/test.toml
new file mode 100644
index 00000000000..1c1599a11cb
--- /dev/null
+++ b/acceptance/bundle/python/experiments-support/test.toml
@@ -0,0 +1,4 @@
+Cloud = false # tests don't interact with APIs
+
+# experiments are only supported in the current version of the wheel
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/external_locations-support/databricks.yml b/acceptance/bundle/python/external_locations-support/databricks.yml
new file mode 100644
index 00000000000..55b0c8cc6fd
--- /dev/null
+++ b/acceptance/bundle/python/external_locations-support/databricks.yml
@@ -0,0 +1,17 @@
+bundle:
+  name: my_project
+
+sync: {paths: []} # don't need to copy files
+
+python:
+  resources:
+    - "resources:load_resources"
+  mutators:
+    - "mutators:update_external_location"
+
+resources:
+  external_locations:
+    my_location_1:
+      name: "my_location_1"
+      url: "s3://test-bucket/path"
+      credential_name: "test_cred"
diff --git a/acceptance/bundle/python/external_locations-support/mutators.py b/acceptance/bundle/python/external_locations-support/mutators.py
new file mode 100644
index 00000000000..f0030a43639
--- /dev/null
+++ b/acceptance/bundle/python/external_locations-support/mutators.py
@@ -0,0 +1,11 @@
+from dataclasses import replace
+
+from databricks.bundles.core import external_location_mutator
+from databricks.bundles.external_locations import ExternalLocation
+
+
+@external_location_mutator
+def update_external_location(location: ExternalLocation) -> ExternalLocation:
+    assert isinstance(location.name, str)
+
+    return replace(location, name=f"{location.name} (updated)")
diff --git a/acceptance/bundle/python/external_locations-support/out.test.toml b/acceptance/bundle/python/external_locations-support/out.test.toml
new file mode 100644
index 00000000000..aeddf3e619e
--- /dev/null
+++ b/acceptance/bundle/python/external_locations-support/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/external_locations-support/output.txt b/acceptance/bundle/python/external_locations-support/output.txt
new file mode 100644
index 00000000000..0f9ca1b7fea
--- /dev/null
+++ b/acceptance/bundle/python/external_locations-support/output.txt
@@ -0,0 +1,28 @@
+
+>>> uv run [UV_ARGS] -q [CLI] bundle validate --output json
+{
+  "experimental": {
+    "python": {
+      "mutators": [
+        "mutators:update_external_location"
+      ],
+      "resources": [
+        "resources:load_resources"
+      ]
+    }
+  },
+  "resources": {
+    "external_locations": {
+      "my_location_1": {
+        "credential_name": "test_cred",
+        "name": "my_location_1 (updated)",
+        "url": "s3://test-bucket/path"
+      },
+      "my_location_2": {
+        "credential_name": "test_cred",
+        "name": "my_location_2 (updated)",
+        "url": "s3://test-bucket/path2"
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/python/external_locations-support/resources.py b/acceptance/bundle/python/external_locations-support/resources.py
new file mode 100644
index 00000000000..cdbc16df964
--- /dev/null
+++ b/acceptance/bundle/python/external_locations-support/resources.py
@@ -0,0 +1,16 @@
+from databricks.bundles.core import Resources
+
+
+def load_resources() -> Resources:
+    resources = Resources()
+
+    resources.add_external_location(
+        "my_location_2",
+        {
+            "name": "my_location_2",
+            "url": "s3://test-bucket/path2",
+            "credential_name": "test_cred",
+        },
+    )
+
+    return resources
diff --git a/acceptance/bundle/python/external_locations-support/script b/acceptance/bundle/python/external_locations-support/script
new file mode 100644
index 00000000000..e273fb45a53
--- /dev/null
+++ b/acceptance/bundle/python/external_locations-support/script
@@ -0,0 +1,5 @@
+
+trace uv run $UV_ARGS -q $CLI bundle validate --output json | \
+  jq "pick(.experimental.python, .resources)"
+
+rm -fr .databricks __pycache__
diff --git a/acceptance/bundle/python/external_locations-support/test.toml b/acceptance/bundle/python/external_locations-support/test.toml
new file mode 100644
index 00000000000..7c94b3ee22c
--- /dev/null
+++ b/acceptance/bundle/python/external_locations-support/test.toml
@@ -0,0 +1,6 @@
+Cloud = false # tests don't interact with APIs
+
+# external_locations are only supported in the current version of the wheel
+EnvMatrix.PYDAB_VERSION = ["current"]
+
+# external_locations are only supported on the direct deployment engine
diff --git a/acceptance/bundle/python/features-support/databricks.yml b/acceptance/bundle/python/features-support/databricks.yml
new file mode 100644
index 00000000000..2a2c08e8cbc
--- /dev/null
+++ b/acceptance/bundle/python/features-support/databricks.yml
@@ -0,0 +1,27 @@
+bundle:
+  name: my_project
+
+sync: {paths: []} # don't need to copy files
+
+python:
+  resources:
+    - "resources:load_resources"
+  mutators:
+    - "mutators:update_feature"
+
+resources:
+  features:
+    my_feature_1:
+      full_name: main.default.my_feature_1
+      description: "My Feature"
+      source:
+        delta_table_source:
+          full_name: main.default.my_source_1
+      function:
+        aggregation_function:
+          count_function:
+            input: value
+          time_window:
+            sliding:
+              window_duration: 604800s
+              slide_duration: 86400s
diff --git a/acceptance/bundle/python/features-support/mutators.py b/acceptance/bundle/python/features-support/mutators.py
new file mode 100644
index 00000000000..c9c8924b49e
--- /dev/null
+++ b/acceptance/bundle/python/features-support/mutators.py
@@ -0,0 +1,11 @@
+from dataclasses import replace
+
+from databricks.bundles.core import feature_mutator
+from databricks.bundles.features import Feature
+
+
+@feature_mutator
+def update_feature(feature: Feature) -> Feature:
+    assert isinstance(feature.description, str)
+
+    return replace(feature, description=f"{feature.description} (updated)")
diff --git a/acceptance/bundle/python/features-support/out.test.toml b/acceptance/bundle/python/features-support/out.test.toml
new file mode 100644
index 00000000000..ea77b758035
--- /dev/null
+++ b/acceptance/bundle/python/features-support/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/features-support/output.txt b/acceptance/bundle/python/features-support/output.txt
new file mode 100644
index 00000000000..3dbfffc35ec
--- /dev/null
+++ b/acceptance/bundle/python/features-support/output.txt
@@ -0,0 +1,62 @@
+
+>>> uv run [UV_ARGS] -q [CLI] bundle validate --output json
+{
+  "experimental": {
+    "python": {
+      "mutators": [
+        "mutators:update_feature"
+      ],
+      "resources": [
+        "resources:load_resources"
+      ]
+    }
+  },
+  "resources": {
+    "features": {
+      "my_feature_1": {
+        "description": "My Feature (updated)",
+        "full_name": "main.default.my_feature_1",
+        "function": {
+          "aggregation_function": {
+            "count_function": {
+              "input": "value"
+            },
+            "time_window": {
+              "sliding": {
+                "slide_duration": "86400s",
+                "window_duration": "604800s"
+              }
+            }
+          }
+        },
+        "source": {
+          "delta_table_source": {
+            "full_name": "main.default.my_source_1"
+          }
+        }
+      },
+      "my_feature_2": {
+        "description": "My Feature (2) (updated)",
+        "full_name": "main.default.my_feature_2",
+        "function": {
+          "aggregation_function": {
+            "count_function": {
+              "input": "value"
+            },
+            "time_window": {
+              "sliding": {
+                "slide_duration": "86400s",
+                "window_duration": "604800s"
+              }
+            }
+          }
+        },
+        "source": {
+          "delta_table_source": {
+            "full_name": "main.default.my_source_2"
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/python/features-support/resources.py b/acceptance/bundle/python/features-support/resources.py
new file mode 100644
index 00000000000..57e58acbd42
--- /dev/null
+++ b/acceptance/bundle/python/features-support/resources.py
@@ -0,0 +1,29 @@
+from databricks.bundles.core import Resources
+
+
+def load_resources() -> Resources:
+    resources = Resources()
+
+    resources.add_feature(
+        "my_feature_2",
+        {
+            "full_name": "main.default.my_feature_2",
+            "description": "My Feature (2)",
+            "source": {
+                "delta_table_source": {"full_name": "main.default.my_source_2"},
+            },
+            "function": {
+                "aggregation_function": {
+                    "count_function": {"input": "value"},
+                    "time_window": {
+                        "sliding": {
+                            "window_duration": "604800s",
+                            "slide_duration": "86400s",
+                        },
+                    },
+                },
+            },
+        },
+    )
+
+    return resources
diff --git a/acceptance/bundle/python/features-support/script b/acceptance/bundle/python/features-support/script
new file mode 100644
index 00000000000..e273fb45a53
--- /dev/null
+++ b/acceptance/bundle/python/features-support/script
@@ -0,0 +1,5 @@
+
+trace uv run $UV_ARGS -q $CLI bundle validate --output json | \
+  jq "pick(.experimental.python, .resources)"
+
+rm -fr .databricks __pycache__
diff --git a/acceptance/bundle/python/features-support/test.toml b/acceptance/bundle/python/features-support/test.toml
new file mode 100644
index 00000000000..a067023f377
--- /dev/null
+++ b/acceptance/bundle/python/features-support/test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+
+# features are only supported in the current version of the wheel
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/genie_spaces-support/databricks.yml b/acceptance/bundle/python/genie_spaces-support/databricks.yml
new file mode 100644
index 00000000000..7c43a3f2b7d
--- /dev/null
+++ b/acceptance/bundle/python/genie_spaces-support/databricks.yml
@@ -0,0 +1,22 @@
+bundle:
+  name: my_project
+
+sync: {paths: []} # don't need to copy files
+
+python:
+  resources:
+    - "resources:load_resources"
+  mutators:
+    - "mutators:update_genie_space"
+
+resources:
+  genie_spaces:
+    my_genie_space_1:
+      title: "my_genie_space_1"
+      description: "My genie space"
+      warehouse_id: "abc123"
+      parent_path: "/Workspace/Users/me"
+      # interface{} field authored inline as a YAML map
+      serialized_space:
+        instructions:
+          - "Answer questions about sales data"
diff --git a/acceptance/bundle/python/genie_spaces-support/mutators.py b/acceptance/bundle/python/genie_spaces-support/mutators.py
new file mode 100644
index 00000000000..6f0df7721d6
--- /dev/null
+++ b/acceptance/bundle/python/genie_spaces-support/mutators.py
@@ -0,0 +1,11 @@
+from dataclasses import replace
+
+from databricks.bundles.core import genie_space_mutator
+from databricks.bundles.genie_spaces import GenieSpace
+
+
+@genie_space_mutator
+def update_genie_space(genie_space: GenieSpace) -> GenieSpace:
+    assert isinstance(genie_space.description, str)
+
+    return replace(genie_space, description=f"{genie_space.description} (updated)")
diff --git a/acceptance/bundle/python/genie_spaces-support/out.test.toml b/acceptance/bundle/python/genie_spaces-support/out.test.toml
new file mode 100644
index 00000000000..aeddf3e619e
--- /dev/null
+++ b/acceptance/bundle/python/genie_spaces-support/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/genie_spaces-support/output.txt b/acceptance/bundle/python/genie_spaces-support/output.txt
new file mode 100644
index 00000000000..9d487930dea
--- /dev/null
+++ b/acceptance/bundle/python/genie_spaces-support/output.txt
@@ -0,0 +1,39 @@
+
+>>> uv run [UV_ARGS] -q [CLI] bundle validate --output json
+{
+  "experimental": {
+    "python": {
+      "mutators": [
+        "mutators:update_genie_space"
+      ],
+      "resources": [
+        "resources:load_resources"
+      ]
+    }
+  },
+  "resources": {
+    "genie_spaces": {
+      "my_genie_space_1": {
+        "description": "My genie space (updated)",
+        "parent_path": "/Workspace/Users/me",
+        "serialized_space": "{\"instructions\":[\"Answer questions about sales data\"]}",
+        "title": "my_genie_space_1",
+        "warehouse_id": "abc123"
+      },
+      "my_genie_space_2": {
+        "description": "My genie space (2) (updated)",
+        "parent_path": "/Workspace/Users/me",
+        "serialized_space": "{\"instructions\": [\"Answer questions about sales data\"]}",
+        "title": "my_genie_space_2",
+        "warehouse_id": "abc123"
+      },
+      "my_genie_space_3": {
+        "description": "My genie space (3) (updated)",
+        "parent_path": "/Workspace/Users/me",
+        "serialized_space": "{\"instructions\":[\"Answer questions about sales data\"]}",
+        "title": "my_genie_space_3",
+        "warehouse_id": "abc123"
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/python/genie_spaces-support/resources.py b/acceptance/bundle/python/genie_spaces-support/resources.py
new file mode 100644
index 00000000000..9e16f04371c
--- /dev/null
+++ b/acceptance/bundle/python/genie_spaces-support/resources.py
@@ -0,0 +1,35 @@
+from databricks.bundles.core import Resources
+
+
+def load_resources() -> Resources:
+    resources = Resources()
+
+    # interface{} field authored as a serialized JSON string
+    resources.add_genie_space(
+        "my_genie_space_2",
+        {
+            "title": "my_genie_space_2",
+            "description": "My genie space (2)",
+            "warehouse_id": "abc123",
+            "parent_path": "/Workspace/Users/me",
+            "serialized_space": '{"instructions": ["Answer questions about sales data"]}',
+        },
+    )
+
+    # interface{} field authored as an inline dict
+    resources.add_genie_space(
+        "my_genie_space_3",
+        {
+            "title": "my_genie_space_3",
+            "description": "My genie space (3)",
+            "warehouse_id": "abc123",
+            "parent_path": "/Workspace/Users/me",
+            "serialized_space": {
+                "instructions": [
+                    "Answer questions about sales data",
+                ],
+            },
+        },
+    )
+
+    return resources
diff --git a/acceptance/bundle/python/genie_spaces-support/script b/acceptance/bundle/python/genie_spaces-support/script
new file mode 100644
index 00000000000..e273fb45a53
--- /dev/null
+++ b/acceptance/bundle/python/genie_spaces-support/script
@@ -0,0 +1,5 @@
+
+trace uv run $UV_ARGS -q $CLI bundle validate --output json | \
+  jq "pick(.experimental.python, .resources)"
+
+rm -fr .databricks __pycache__
diff --git a/acceptance/bundle/python/genie_spaces-support/test.toml b/acceptance/bundle/python/genie_spaces-support/test.toml
new file mode 100644
index 00000000000..25745f973ca
--- /dev/null
+++ b/acceptance/bundle/python/genie_spaces-support/test.toml
@@ -0,0 +1,6 @@
+Cloud = false # tests don't interact with APIs
+
+# genie_spaces are only supported in the current version of the wheel
+EnvMatrix.PYDAB_VERSION = ["current"]
+
+# genie_spaces are only supported on the direct deployment engine
diff --git a/acceptance/bundle/python/grants-aliases/out.test.toml b/acceptance/bundle/python/grants-aliases/out.test.toml
index 98d084e3bb9..aeddf3e619e 100644
--- a/acceptance/bundle/python/grants-aliases/out.test.toml
+++ b/acceptance/bundle/python/grants-aliases/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
 EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/grants-aliases/test.toml b/acceptance/bundle/python/grants-aliases/test.toml
index d9488bc50fc..6b979c98230 100644
--- a/acceptance/bundle/python/grants-aliases/test.toml
+++ b/acceptance/bundle/python/grants-aliases/test.toml
@@ -1,7 +1,5 @@
-Local = true
 Cloud = false # tests don't interact with APIs
 
-[EnvMatrix]
-PYDAB_VERSION = [
+EnvMatrix.PYDAB_VERSION = [
     "current",
 ]
diff --git a/acceptance/bundle/python/instance_pools-support/databricks.yml b/acceptance/bundle/python/instance_pools-support/databricks.yml
new file mode 100644
index 00000000000..9760325c97e
--- /dev/null
+++ b/acceptance/bundle/python/instance_pools-support/databricks.yml
@@ -0,0 +1,16 @@
+bundle:
+  name: my_project
+
+sync: {paths: []} # don't need to copy files
+
+python:
+  resources:
+    - "resources:load_resources"
+  mutators:
+    - "mutators:update_instance_pool"
+
+resources:
+  instance_pools:
+    my_pool_1:
+      instance_pool_name: "my_pool_1"
+      node_type_id: "i3.xlarge"
diff --git a/acceptance/bundle/python/instance_pools-support/mutators.py b/acceptance/bundle/python/instance_pools-support/mutators.py
new file mode 100644
index 00000000000..49a8b200263
--- /dev/null
+++ b/acceptance/bundle/python/instance_pools-support/mutators.py
@@ -0,0 +1,11 @@
+from dataclasses import replace
+
+from databricks.bundles.core import instance_pool_mutator
+from databricks.bundles.instance_pools import InstancePool
+
+
+@instance_pool_mutator
+def update_instance_pool(pool: InstancePool) -> InstancePool:
+    assert isinstance(pool.instance_pool_name, str)
+
+    return replace(pool, instance_pool_name=f"{pool.instance_pool_name} (updated)")
diff --git a/acceptance/bundle/python/instance_pools-support/out.test.toml b/acceptance/bundle/python/instance_pools-support/out.test.toml
new file mode 100644
index 00000000000..aeddf3e619e
--- /dev/null
+++ b/acceptance/bundle/python/instance_pools-support/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/instance_pools-support/output.txt b/acceptance/bundle/python/instance_pools-support/output.txt
new file mode 100644
index 00000000000..701d3a8b1d2
--- /dev/null
+++ b/acceptance/bundle/python/instance_pools-support/output.txt
@@ -0,0 +1,26 @@
+
+>>> uv run [UV_ARGS] -q [CLI] bundle validate --output json
+{
+  "experimental": {
+    "python": {
+      "mutators": [
+        "mutators:update_instance_pool"
+      ],
+      "resources": [
+        "resources:load_resources"
+      ]
+    }
+  },
+  "resources": {
+    "instance_pools": {
+      "my_pool_1": {
+        "instance_pool_name": "my_pool_1 (updated)",
+        "node_type_id": "[NODE_TYPE_ID]"
+      },
+      "my_pool_2": {
+        "instance_pool_name": "my_pool_2 (updated)",
+        "node_type_id": "[NODE_TYPE_ID]"
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/python/instance_pools-support/resources.py b/acceptance/bundle/python/instance_pools-support/resources.py
new file mode 100644
index 00000000000..8ef6bf4789e
--- /dev/null
+++ b/acceptance/bundle/python/instance_pools-support/resources.py
@@ -0,0 +1,15 @@
+from databricks.bundles.core import Resources
+
+
+def load_resources() -> Resources:
+    resources = Resources()
+
+    resources.add_instance_pool(
+        "my_pool_2",
+        {
+            "instance_pool_name": "my_pool_2",
+            "node_type_id": "i3.xlarge",
+        },
+    )
+
+    return resources
diff --git a/acceptance/bundle/python/instance_pools-support/script b/acceptance/bundle/python/instance_pools-support/script
new file mode 100644
index 00000000000..e273fb45a53
--- /dev/null
+++ b/acceptance/bundle/python/instance_pools-support/script
@@ -0,0 +1,5 @@
+
+trace uv run $UV_ARGS -q $CLI bundle validate --output json | \
+  jq "pick(.experimental.python, .resources)"
+
+rm -fr .databricks __pycache__
diff --git a/acceptance/bundle/python/instance_pools-support/test.toml b/acceptance/bundle/python/instance_pools-support/test.toml
new file mode 100644
index 00000000000..f7000d5d0db
--- /dev/null
+++ b/acceptance/bundle/python/instance_pools-support/test.toml
@@ -0,0 +1,6 @@
+Cloud = false # tests don't interact with APIs
+
+# instance_pools are only supported in the current version of the wheel
+EnvMatrix.PYDAB_VERSION = ["current"]
+
+# instance_pools are only supported on the direct deployment engine
diff --git a/acceptance/bundle/python/job_runs-support/databricks.yml b/acceptance/bundle/python/job_runs-support/databricks.yml
new file mode 100644
index 00000000000..6edcb37c932
--- /dev/null
+++ b/acceptance/bundle/python/job_runs-support/databricks.yml
@@ -0,0 +1,17 @@
+bundle:
+  name: my_project
+
+sync: {paths: []} # don't need to copy files
+
+python:
+  resources:
+    - "resources:load_resources"
+  mutators:
+    - "mutators:update_job_run"
+
+resources:
+  job_runs:
+    my_run_1:
+      job_id: 1
+      job_parameters:
+        description: "test"
diff --git a/acceptance/bundle/python/job_runs-support/mutators.py b/acceptance/bundle/python/job_runs-support/mutators.py
new file mode 100644
index 00000000000..0ec911f9fda
--- /dev/null
+++ b/acceptance/bundle/python/job_runs-support/mutators.py
@@ -0,0 +1,19 @@
+from dataclasses import replace
+from typing import Any, Dict
+
+from databricks.bundles.core import job_run_mutator
+from databricks.bundles.job_runs import JobRun
+
+
+@job_run_mutator
+def update_job_run(run: JobRun) -> JobRun:
+    # Update job_parameters dict with " (updated)" suffix to description
+    params = run.job_parameters or {}
+    updated_params: Dict[str, Any] = {}
+    for key, value in params.items():
+        if key == "description" and isinstance(value, str):
+            updated_params[key] = f"{value} (updated)"
+        else:
+            updated_params[key] = value
+
+    return replace(run, job_parameters=updated_params)
diff --git a/acceptance/bundle/python/job_runs-support/out.test.toml b/acceptance/bundle/python/job_runs-support/out.test.toml
new file mode 100644
index 00000000000..aeddf3e619e
--- /dev/null
+++ b/acceptance/bundle/python/job_runs-support/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/job_runs-support/output.txt b/acceptance/bundle/python/job_runs-support/output.txt
new file mode 100644
index 00000000000..a926f628b96
--- /dev/null
+++ b/acceptance/bundle/python/job_runs-support/output.txt
@@ -0,0 +1,30 @@
+
+>>> uv run [UV_ARGS] -q [CLI] bundle validate --output json
+{
+  "experimental": {
+    "python": {
+      "mutators": [
+        "mutators:update_job_run"
+      ],
+      "resources": [
+        "resources:load_resources"
+      ]
+    }
+  },
+  "resources": {
+    "job_runs": {
+      "my_run_1": {
+        "job_id": 1,
+        "job_parameters": {
+          "description": "test (updated)"
+        }
+      },
+      "my_run_2": {
+        "job_id": 1,
+        "job_parameters": {
+          "description": "test (updated)"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/python/job_runs-support/resources.py b/acceptance/bundle/python/job_runs-support/resources.py
new file mode 100644
index 00000000000..5cf76ef752a
--- /dev/null
+++ b/acceptance/bundle/python/job_runs-support/resources.py
@@ -0,0 +1,15 @@
+from databricks.bundles.core import Resources
+
+
+def load_resources() -> Resources:
+    resources = Resources()
+
+    resources.add_job_run(
+        "my_run_2",
+        {
+            "job_id": 1,
+            "job_parameters": {"description": "test"},
+        },
+    )
+
+    return resources
diff --git a/acceptance/bundle/python/job_runs-support/script b/acceptance/bundle/python/job_runs-support/script
new file mode 100644
index 00000000000..e273fb45a53
--- /dev/null
+++ b/acceptance/bundle/python/job_runs-support/script
@@ -0,0 +1,5 @@
+
+trace uv run $UV_ARGS -q $CLI bundle validate --output json | \
+  jq "pick(.experimental.python, .resources)"
+
+rm -fr .databricks __pycache__
diff --git a/acceptance/bundle/python/job_runs-support/test.toml b/acceptance/bundle/python/job_runs-support/test.toml
new file mode 100644
index 00000000000..58528cf7c40
--- /dev/null
+++ b/acceptance/bundle/python/job_runs-support/test.toml
@@ -0,0 +1,6 @@
+Cloud = false # tests don't interact with APIs
+
+# job_runs are only supported in the current version of the wheel
+EnvMatrix.PYDAB_VERSION = ["current"]
+
+# job_runs are only supported on the direct deployment engine
diff --git a/acceptance/bundle/python/jobs-support/databricks.yml b/acceptance/bundle/python/jobs-support/databricks.yml
new file mode 100644
index 00000000000..583e671060d
--- /dev/null
+++ b/acceptance/bundle/python/jobs-support/databricks.yml
@@ -0,0 +1,15 @@
+bundle:
+  name: my_project
+
+sync: {paths: []} # don't need to copy files
+
+python:
+  resources:
+    - "resources:load_resources"
+  mutators:
+    - "mutators:update_job"
+
+resources:
+  jobs:
+    my_job_1:
+      name: "My Job 1"
diff --git a/acceptance/bundle/python/jobs-support/mutators.py b/acceptance/bundle/python/jobs-support/mutators.py
new file mode 100644
index 00000000000..9335dd63f19
--- /dev/null
+++ b/acceptance/bundle/python/jobs-support/mutators.py
@@ -0,0 +1,11 @@
+from dataclasses import replace
+
+from databricks.bundles.core import job_mutator
+from databricks.bundles.jobs import Job
+
+
+@job_mutator
+def update_job(job: Job) -> Job:
+    assert isinstance(job.name, str)
+
+    return replace(job, name=f"{job.name} (updated)")
diff --git a/acceptance/bundle/python/jobs-support/out.test.toml b/acceptance/bundle/python/jobs-support/out.test.toml
new file mode 100644
index 00000000000..dce9192f28d
--- /dev/null
+++ b/acceptance/bundle/python/jobs-support/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.PYDAB_VERSION = ["0.266.0", "current"]
diff --git a/acceptance/bundle/python/jobs-support/output.txt b/acceptance/bundle/python/jobs-support/output.txt
new file mode 100644
index 00000000000..c58d1ce8c28
--- /dev/null
+++ b/acceptance/bundle/python/jobs-support/output.txt
@@ -0,0 +1,44 @@
+
+>>> uv run [UV_ARGS] -q [CLI] bundle validate --output json
+{
+  "experimental": {
+    "python": {
+      "mutators": [
+        "mutators:update_job"
+      ],
+      "resources": [
+        "resources:load_resources"
+      ]
+    }
+  },
+  "resources": {
+    "jobs": {
+      "my_job_1": {
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_project/default/state/metadata.json"
+        },
+        "edit_mode": "UI_LOCKED",
+        "format": "MULTI_TASK",
+        "max_concurrent_runs": 1,
+        "name": "My Job 1 (updated)",
+        "queue": {
+          "enabled": true
+        }
+      },
+      "my_job_2": {
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_project/default/state/metadata.json"
+        },
+        "edit_mode": "UI_LOCKED",
+        "format": "MULTI_TASK",
+        "max_concurrent_runs": 1,
+        "name": "My Job 2 (updated)",
+        "queue": {
+          "enabled": true
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/python/jobs-support/resources.py b/acceptance/bundle/python/jobs-support/resources.py
new file mode 100644
index 00000000000..a6e6ce3f4ec
--- /dev/null
+++ b/acceptance/bundle/python/jobs-support/resources.py
@@ -0,0 +1,9 @@
+from databricks.bundles.core import Resources
+
+
+def load_resources() -> Resources:
+    resources = Resources()
+
+    resources.add_job("my_job_2", {"name": "My Job 2"})
+
+    return resources
diff --git a/acceptance/bundle/python/jobs-support/script b/acceptance/bundle/python/jobs-support/script
new file mode 100644
index 00000000000..e273fb45a53
--- /dev/null
+++ b/acceptance/bundle/python/jobs-support/script
@@ -0,0 +1,5 @@
+
+trace uv run $UV_ARGS -q $CLI bundle validate --output json | \
+  jq "pick(.experimental.python, .resources)"
+
+rm -fr .databricks __pycache__
diff --git a/acceptance/bundle/python/mcp_services-support/databricks.yml b/acceptance/bundle/python/mcp_services-support/databricks.yml
new file mode 100644
index 00000000000..c9b661e88bc
--- /dev/null
+++ b/acceptance/bundle/python/mcp_services-support/databricks.yml
@@ -0,0 +1,17 @@
+bundle:
+  name: my_project
+
+sync: {paths: []} # don't need to copy files
+
+python:
+  resources:
+    - "resources:load_resources"
+  mutators:
+    - "mutators:update_mcp_service"
+
+resources:
+  mcp_services:
+    my_mcp_service_1:
+      parent: "schemas/main.default"
+      mcp_service_id: "my_mcp_service_1"
+      comment: "My MCP service"
diff --git a/acceptance/bundle/python/mcp_services-support/mutators.py b/acceptance/bundle/python/mcp_services-support/mutators.py
new file mode 100644
index 00000000000..59f13f65265
--- /dev/null
+++ b/acceptance/bundle/python/mcp_services-support/mutators.py
@@ -0,0 +1,11 @@
+from dataclasses import replace
+
+from databricks.bundles.mcp_services import McpService
+from databricks.bundles.core import mcp_service_mutator
+
+
+@mcp_service_mutator
+def update_mcp_service(mcp_service: McpService) -> McpService:
+    assert isinstance(mcp_service.comment, str)
+
+    return replace(mcp_service, comment=f"{mcp_service.comment} (updated)")
diff --git a/acceptance/bundle/python/mcp_services-support/out.test.toml b/acceptance/bundle/python/mcp_services-support/out.test.toml
new file mode 100644
index 00000000000..aeddf3e619e
--- /dev/null
+++ b/acceptance/bundle/python/mcp_services-support/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/mcp_services-support/output.txt b/acceptance/bundle/python/mcp_services-support/output.txt
new file mode 100644
index 00000000000..da90e33dba3
--- /dev/null
+++ b/acceptance/bundle/python/mcp_services-support/output.txt
@@ -0,0 +1,28 @@
+
+>>> uv run [UV_ARGS] -q [CLI] bundle validate --output json
+{
+  "experimental": {
+    "python": {
+      "mutators": [
+        "mutators:update_mcp_service"
+      ],
+      "resources": [
+        "resources:load_resources"
+      ]
+    }
+  },
+  "resources": {
+    "mcp_services": {
+      "my_mcp_service_1": {
+        "comment": "My MCP service (updated)",
+        "mcp_service_id": "my_mcp_service_1",
+        "parent": "schemas/main.default"
+      },
+      "my_mcp_service_2": {
+        "comment": "My MCP service (2) (updated)",
+        "mcp_service_id": "my_mcp_service_2",
+        "parent": "schemas/main.default"
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/python/mcp_services-support/resources.py b/acceptance/bundle/python/mcp_services-support/resources.py
new file mode 100644
index 00000000000..7ec7c51d189
--- /dev/null
+++ b/acceptance/bundle/python/mcp_services-support/resources.py
@@ -0,0 +1,16 @@
+from databricks.bundles.core import Resources
+
+
+def load_resources() -> Resources:
+    resources = Resources()
+
+    resources.add_mcp_service(
+        "my_mcp_service_2",
+        {
+            "parent": "schemas/main.default",
+            "mcp_service_id": "my_mcp_service_2",
+            "comment": "My MCP service (2)",
+        },
+    )
+
+    return resources
diff --git a/acceptance/bundle/python/mcp_services-support/script b/acceptance/bundle/python/mcp_services-support/script
new file mode 100644
index 00000000000..e273fb45a53
--- /dev/null
+++ b/acceptance/bundle/python/mcp_services-support/script
@@ -0,0 +1,5 @@
+
+trace uv run $UV_ARGS -q $CLI bundle validate --output json | \
+  jq "pick(.experimental.python, .resources)"
+
+rm -fr .databricks __pycache__
diff --git a/acceptance/bundle/python/mcp_services-support/test.toml b/acceptance/bundle/python/mcp_services-support/test.toml
new file mode 100644
index 00000000000..4f1fe544200
--- /dev/null
+++ b/acceptance/bundle/python/mcp_services-support/test.toml
@@ -0,0 +1,4 @@
+Cloud = false # tests don't interact with APIs
+
+# mcp_services are only supported in the current version of the wheel
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/model_provider_services-support/databricks.yml b/acceptance/bundle/python/model_provider_services-support/databricks.yml
new file mode 100644
index 00000000000..ef383951e01
--- /dev/null
+++ b/acceptance/bundle/python/model_provider_services-support/databricks.yml
@@ -0,0 +1,17 @@
+bundle:
+  name: my_project
+
+sync: {paths: []} # don't need to copy files
+
+python:
+  resources:
+    - "resources:load_resources"
+  mutators:
+    - "mutators:update_model_provider_service"
+
+resources:
+  model_provider_services:
+    my_model_provider_service_1:
+      parent: "schemas/main.default"
+      model_provider_service_id: "my_model_provider_service_1"
+      comment: "My model provider service"
diff --git a/acceptance/bundle/python/model_provider_services-support/mutators.py b/acceptance/bundle/python/model_provider_services-support/mutators.py
new file mode 100644
index 00000000000..03b76e35a46
--- /dev/null
+++ b/acceptance/bundle/python/model_provider_services-support/mutators.py
@@ -0,0 +1,16 @@
+from dataclasses import replace
+
+from databricks.bundles.model_provider_services import ModelProviderService
+from databricks.bundles.core import model_provider_service_mutator
+
+
+@model_provider_service_mutator
+def update_model_provider_service(
+    model_provider_service: ModelProviderService,
+) -> ModelProviderService:
+    assert isinstance(model_provider_service.comment, str)
+
+    return replace(
+        model_provider_service,
+        comment=f"{model_provider_service.comment} (updated)",
+    )
diff --git a/acceptance/bundle/python/model_provider_services-support/out.test.toml b/acceptance/bundle/python/model_provider_services-support/out.test.toml
new file mode 100644
index 00000000000..aeddf3e619e
--- /dev/null
+++ b/acceptance/bundle/python/model_provider_services-support/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/model_provider_services-support/output.txt b/acceptance/bundle/python/model_provider_services-support/output.txt
new file mode 100644
index 00000000000..b3f971b560a
--- /dev/null
+++ b/acceptance/bundle/python/model_provider_services-support/output.txt
@@ -0,0 +1,28 @@
+
+>>> uv run [UV_ARGS] -q [CLI] bundle validate --output json
+{
+  "experimental": {
+    "python": {
+      "mutators": [
+        "mutators:update_model_provider_service"
+      ],
+      "resources": [
+        "resources:load_resources"
+      ]
+    }
+  },
+  "resources": {
+    "model_provider_services": {
+      "my_model_provider_service_1": {
+        "comment": "My model provider service (updated)",
+        "model_provider_service_id": "my_model_provider_service_1",
+        "parent": "schemas/main.default"
+      },
+      "my_model_provider_service_2": {
+        "comment": "My model provider service (2) (updated)",
+        "model_provider_service_id": "my_model_provider_service_2",
+        "parent": "schemas/main.default"
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/python/model_provider_services-support/resources.py b/acceptance/bundle/python/model_provider_services-support/resources.py
new file mode 100644
index 00000000000..5dceaf37b68
--- /dev/null
+++ b/acceptance/bundle/python/model_provider_services-support/resources.py
@@ -0,0 +1,16 @@
+from databricks.bundles.core import Resources
+
+
+def load_resources() -> Resources:
+    resources = Resources()
+
+    resources.add_model_provider_service(
+        "my_model_provider_service_2",
+        {
+            "parent": "schemas/main.default",
+            "model_provider_service_id": "my_model_provider_service_2",
+            "comment": "My model provider service (2)",
+        },
+    )
+
+    return resources
diff --git a/acceptance/bundle/python/model_provider_services-support/script b/acceptance/bundle/python/model_provider_services-support/script
new file mode 100644
index 00000000000..e273fb45a53
--- /dev/null
+++ b/acceptance/bundle/python/model_provider_services-support/script
@@ -0,0 +1,5 @@
+
+trace uv run $UV_ARGS -q $CLI bundle validate --output json | \
+  jq "pick(.experimental.python, .resources)"
+
+rm -fr .databricks __pycache__
diff --git a/acceptance/bundle/python/model_provider_services-support/test.toml b/acceptance/bundle/python/model_provider_services-support/test.toml
new file mode 100644
index 00000000000..b9ab1057685
--- /dev/null
+++ b/acceptance/bundle/python/model_provider_services-support/test.toml
@@ -0,0 +1,4 @@
+Cloud = false # tests don't interact with APIs
+
+# model_provider_services are only supported in the current version of the wheel
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/model_services-support/databricks.yml b/acceptance/bundle/python/model_services-support/databricks.yml
new file mode 100644
index 00000000000..37acd94d33a
--- /dev/null
+++ b/acceptance/bundle/python/model_services-support/databricks.yml
@@ -0,0 +1,17 @@
+bundle:
+  name: my_project
+
+sync: {paths: []} # don't need to copy files
+
+python:
+  resources:
+    - "resources:load_resources"
+  mutators:
+    - "mutators:update_model_service"
+
+resources:
+  model_services:
+    my_model_service_1:
+      parent: "schemas/main.default"
+      model_service_id: "my_model_service_1"
+      comment: "My model service"
diff --git a/acceptance/bundle/python/model_services-support/mutators.py b/acceptance/bundle/python/model_services-support/mutators.py
new file mode 100644
index 00000000000..fdd96009e1b
--- /dev/null
+++ b/acceptance/bundle/python/model_services-support/mutators.py
@@ -0,0 +1,11 @@
+from dataclasses import replace
+
+from databricks.bundles.model_services import ModelService
+from databricks.bundles.core import model_service_mutator
+
+
+@model_service_mutator
+def update_model_service(model_service: ModelService) -> ModelService:
+    assert isinstance(model_service.comment, str)
+
+    return replace(model_service, comment=f"{model_service.comment} (updated)")
diff --git a/acceptance/bundle/python/model_services-support/out.test.toml b/acceptance/bundle/python/model_services-support/out.test.toml
new file mode 100644
index 00000000000..aeddf3e619e
--- /dev/null
+++ b/acceptance/bundle/python/model_services-support/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/model_services-support/output.txt b/acceptance/bundle/python/model_services-support/output.txt
new file mode 100644
index 00000000000..52935d3c124
--- /dev/null
+++ b/acceptance/bundle/python/model_services-support/output.txt
@@ -0,0 +1,28 @@
+
+>>> uv run [UV_ARGS] -q [CLI] bundle validate --output json
+{
+  "experimental": {
+    "python": {
+      "mutators": [
+        "mutators:update_model_service"
+      ],
+      "resources": [
+        "resources:load_resources"
+      ]
+    }
+  },
+  "resources": {
+    "model_services": {
+      "my_model_service_1": {
+        "comment": "My model service (updated)",
+        "model_service_id": "my_model_service_1",
+        "parent": "schemas/main.default"
+      },
+      "my_model_service_2": {
+        "comment": "My model service (2) (updated)",
+        "model_service_id": "my_model_service_2",
+        "parent": "schemas/main.default"
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/python/model_services-support/resources.py b/acceptance/bundle/python/model_services-support/resources.py
new file mode 100644
index 00000000000..58a92215744
--- /dev/null
+++ b/acceptance/bundle/python/model_services-support/resources.py
@@ -0,0 +1,16 @@
+from databricks.bundles.core import Resources
+
+
+def load_resources() -> Resources:
+    resources = Resources()
+
+    resources.add_model_service(
+        "my_model_service_2",
+        {
+            "parent": "schemas/main.default",
+            "model_service_id": "my_model_service_2",
+            "comment": "My model service (2)",
+        },
+    )
+
+    return resources
diff --git a/acceptance/bundle/python/model_services-support/script b/acceptance/bundle/python/model_services-support/script
new file mode 100644
index 00000000000..e273fb45a53
--- /dev/null
+++ b/acceptance/bundle/python/model_services-support/script
@@ -0,0 +1,5 @@
+
+trace uv run $UV_ARGS -q $CLI bundle validate --output json | \
+  jq "pick(.experimental.python, .resources)"
+
+rm -fr .databricks __pycache__
diff --git a/acceptance/bundle/python/model_services-support/test.toml b/acceptance/bundle/python/model_services-support/test.toml
new file mode 100644
index 00000000000..092080306b1
--- /dev/null
+++ b/acceptance/bundle/python/model_services-support/test.toml
@@ -0,0 +1,4 @@
+Cloud = false # tests don't interact with APIs
+
+# model_services are only supported in the current version of the wheel
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/model_serving_endpoints-support/databricks.yml b/acceptance/bundle/python/model_serving_endpoints-support/databricks.yml
new file mode 100644
index 00000000000..bf1e1a324cf
--- /dev/null
+++ b/acceptance/bundle/python/model_serving_endpoints-support/databricks.yml
@@ -0,0 +1,16 @@
+bundle:
+  name: my_project
+
+sync: {paths: []} # don't need to copy files
+
+python:
+  resources:
+    - "resources:load_resources"
+  mutators:
+    - "mutators:update_model_serving_endpoint"
+
+resources:
+  model_serving_endpoints:
+    my_endpoint_1:
+      name: "my_endpoint_1"
+      description: "My endpoint"
diff --git a/acceptance/bundle/python/model_serving_endpoints-support/mutators.py b/acceptance/bundle/python/model_serving_endpoints-support/mutators.py
new file mode 100644
index 00000000000..a86c55757a3
--- /dev/null
+++ b/acceptance/bundle/python/model_serving_endpoints-support/mutators.py
@@ -0,0 +1,11 @@
+from dataclasses import replace
+
+from databricks.bundles.model_serving_endpoints import ModelServingEndpoint
+from databricks.bundles.core import model_serving_endpoint_mutator
+
+
+@model_serving_endpoint_mutator
+def update_model_serving_endpoint(endpoint: ModelServingEndpoint) -> ModelServingEndpoint:
+    assert isinstance(endpoint.name, str)
+
+    return replace(endpoint, name=f"{endpoint.name} (updated)")
diff --git a/acceptance/bundle/python/model_serving_endpoints-support/out.test.toml b/acceptance/bundle/python/model_serving_endpoints-support/out.test.toml
new file mode 100644
index 00000000000..aeddf3e619e
--- /dev/null
+++ b/acceptance/bundle/python/model_serving_endpoints-support/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/model_serving_endpoints-support/output.txt b/acceptance/bundle/python/model_serving_endpoints-support/output.txt
new file mode 100644
index 00000000000..3adc3abd079
--- /dev/null
+++ b/acceptance/bundle/python/model_serving_endpoints-support/output.txt
@@ -0,0 +1,26 @@
+
+>>> uv run [UV_ARGS] -q [CLI] bundle validate --output json
+{
+  "experimental": {
+    "python": {
+      "mutators": [
+        "mutators:update_model_serving_endpoint"
+      ],
+      "resources": [
+        "resources:load_resources"
+      ]
+    }
+  },
+  "resources": {
+    "model_serving_endpoints": {
+      "my_endpoint_1": {
+        "description": "My endpoint",
+        "name": "my_endpoint_1 (updated)"
+      },
+      "my_endpoint_2": {
+        "description": "My endpoint (2)",
+        "name": "my_endpoint_2 (updated)"
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/python/model_serving_endpoints-support/resources.py b/acceptance/bundle/python/model_serving_endpoints-support/resources.py
new file mode 100644
index 00000000000..08dc2faa72d
--- /dev/null
+++ b/acceptance/bundle/python/model_serving_endpoints-support/resources.py
@@ -0,0 +1,15 @@
+from databricks.bundles.core import Resources
+
+
+def load_resources() -> Resources:
+    resources = Resources()
+
+    resources.add_model_serving_endpoint(
+        "my_endpoint_2",
+        {
+            "name": "my_endpoint_2",
+            "description": "My endpoint (2)",
+        },
+    )
+
+    return resources
diff --git a/acceptance/bundle/python/model_serving_endpoints-support/script b/acceptance/bundle/python/model_serving_endpoints-support/script
new file mode 100644
index 00000000000..e273fb45a53
--- /dev/null
+++ b/acceptance/bundle/python/model_serving_endpoints-support/script
@@ -0,0 +1,5 @@
+
+trace uv run $UV_ARGS -q $CLI bundle validate --output json | \
+  jq "pick(.experimental.python, .resources)"
+
+rm -fr .databricks __pycache__
diff --git a/acceptance/bundle/python/model_serving_endpoints-support/test.toml b/acceptance/bundle/python/model_serving_endpoints-support/test.toml
new file mode 100644
index 00000000000..4669afde3f0
--- /dev/null
+++ b/acceptance/bundle/python/model_serving_endpoints-support/test.toml
@@ -0,0 +1,4 @@
+Cloud = false # tests don't interact with APIs
+
+# model_serving_endpoints are only supported in the current version of the wheel
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/models-support/databricks.yml b/acceptance/bundle/python/models-support/databricks.yml
new file mode 100644
index 00000000000..2167c246e2a
--- /dev/null
+++ b/acceptance/bundle/python/models-support/databricks.yml
@@ -0,0 +1,16 @@
+bundle:
+  name: my_project
+
+sync: {paths: []} # don't need to copy files
+
+python:
+  resources:
+    - "resources:load_resources"
+  mutators:
+    - "mutators:update_mlflow_model"
+
+resources:
+  models:
+    my_model_1:
+      name: "my_model_1"
+      description: "My model"
diff --git a/acceptance/bundle/python/models-support/mutators.py b/acceptance/bundle/python/models-support/mutators.py
new file mode 100644
index 00000000000..8a8f7cd8918
--- /dev/null
+++ b/acceptance/bundle/python/models-support/mutators.py
@@ -0,0 +1,11 @@
+from dataclasses import replace
+
+from databricks.bundles.models import MlflowModel
+from databricks.bundles.core import mlflow_model_mutator
+
+
+@mlflow_model_mutator
+def update_mlflow_model(model: MlflowModel) -> MlflowModel:
+    assert isinstance(model.name, str)
+
+    return replace(model, name=f"{model.name} (updated)")
diff --git a/acceptance/bundle/python/models-support/out.test.toml b/acceptance/bundle/python/models-support/out.test.toml
new file mode 100644
index 00000000000..aeddf3e619e
--- /dev/null
+++ b/acceptance/bundle/python/models-support/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/models-support/output.txt b/acceptance/bundle/python/models-support/output.txt
new file mode 100644
index 00000000000..d7e8e47d885
--- /dev/null
+++ b/acceptance/bundle/python/models-support/output.txt
@@ -0,0 +1,26 @@
+
+>>> uv run [UV_ARGS] -q [CLI] bundle validate --output json
+{
+  "experimental": {
+    "python": {
+      "mutators": [
+        "mutators:update_mlflow_model"
+      ],
+      "resources": [
+        "resources:load_resources"
+      ]
+    }
+  },
+  "resources": {
+    "models": {
+      "my_model_1": {
+        "description": "My model",
+        "name": "my_model_1 (updated)"
+      },
+      "my_model_2": {
+        "description": "My model (2)",
+        "name": "my_model_2 (updated)"
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/python/models-support/resources.py b/acceptance/bundle/python/models-support/resources.py
new file mode 100644
index 00000000000..593507b61d7
--- /dev/null
+++ b/acceptance/bundle/python/models-support/resources.py
@@ -0,0 +1,15 @@
+from databricks.bundles.core import Resources
+
+
+def load_resources() -> Resources:
+    resources = Resources()
+
+    resources.add_mlflow_model(
+        "my_model_2",
+        {
+            "name": "my_model_2",
+            "description": "My model (2)",
+        },
+    )
+
+    return resources
diff --git a/acceptance/bundle/python/models-support/script b/acceptance/bundle/python/models-support/script
new file mode 100644
index 00000000000..e273fb45a53
--- /dev/null
+++ b/acceptance/bundle/python/models-support/script
@@ -0,0 +1,5 @@
+
+trace uv run $UV_ARGS -q $CLI bundle validate --output json | \
+  jq "pick(.experimental.python, .resources)"
+
+rm -fr .databricks __pycache__
diff --git a/acceptance/bundle/python/models-support/test.toml b/acceptance/bundle/python/models-support/test.toml
new file mode 100644
index 00000000000..88fe8ee4990
--- /dev/null
+++ b/acceptance/bundle/python/models-support/test.toml
@@ -0,0 +1,4 @@
+Cloud = false # tests don't interact with APIs
+
+# models are only supported in the current version of the wheel
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/mutator-ordering/out.test.toml b/acceptance/bundle/python/mutator-ordering/out.test.toml
index 0969b3f3733..dce9192f28d 100644
--- a/acceptance/bundle/python/mutator-ordering/out.test.toml
+++ b/acceptance/bundle/python/mutator-ordering/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
 EnvMatrix.PYDAB_VERSION = ["0.266.0", "current"]
diff --git a/acceptance/bundle/python/mutator-permissions-owner-5682/databricks.yml.tmpl b/acceptance/bundle/python/mutator-permissions-owner-5682/databricks.yml.tmpl
new file mode 100644
index 00000000000..ac0754ae15b
--- /dev/null
+++ b/acceptance/bundle/python/mutator-permissions-owner-5682/databricks.yml.tmpl
@@ -0,0 +1,21 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+variables:
+  grantee_group:
+    default: some-group
+
+python:
+  mutators:
+    - "mutators:add_pipeline_permission"
+
+resources:
+  pipelines:
+    my_pipeline:
+      name: test-pipeline-$UNIQUE_NAME
+      catalog: main
+      schema: default
+      serverless: true
+      libraries:
+        - notebook:
+            path: ./nb.py
diff --git a/acceptance/bundle/python/mutator-permissions-owner-5682/mutators.py b/acceptance/bundle/python/mutator-permissions-owner-5682/mutators.py
new file mode 100644
index 00000000000..7d2fdf5a5dc
--- /dev/null
+++ b/acceptance/bundle/python/mutator-permissions-owner-5682/mutators.py
@@ -0,0 +1,20 @@
+from dataclasses import replace
+from databricks.bundles.pipelines import Pipeline, PipelinePermission
+from databricks.bundles.core import pipeline_mutator, Bundle
+
+
+# Regression test for https://github.com/databricks/cli/issues/5682.
+# Adds a permission to a pipeline that is already defined in YAML (mirrors the
+# reporter's mutator, which reads a bundle variable). Resources updated by a
+# PythonMutator go through NormalizeResources; that path now runs FixPermissions,
+# so the deploying user is added as IS_OWNER and the permissions PUT succeeds.
+# Before the fix the ACL had no owner and the backend rejected the PUT with
+# "The pipeline must have exactly one owner".
+@pipeline_mutator
+def add_pipeline_permission(bundle: Bundle, pipeline: Pipeline) -> Pipeline:
+    group = bundle.resolve_variable(bundle.variables["grantee_group"])
+    permissions = [
+        *pipeline.permissions,
+        PipelinePermission.from_dict({"group_name": group, "level": "CAN_RUN"}),
+    ]
+    return replace(pipeline, permissions=permissions)
diff --git a/acceptance/bundle/python/mutator-permissions-owner-5682/nb.py b/acceptance/bundle/python/mutator-permissions-owner-5682/nb.py
new file mode 100644
index 00000000000..1645e04b1de
--- /dev/null
+++ b/acceptance/bundle/python/mutator-permissions-owner-5682/nb.py
@@ -0,0 +1 @@
+# Databricks notebook source
diff --git a/acceptance/bundle/python/mutator-permissions-owner-5682/out.test.toml b/acceptance/bundle/python/mutator-permissions-owner-5682/out.test.toml
new file mode 100644
index 00000000000..9cff9965350
--- /dev/null
+++ b/acceptance/bundle/python/mutator-permissions-owner-5682/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.PYDAB_VERSION = ["0.266.0", "current"]
diff --git a/acceptance/bundle/python/mutator-permissions-owner-5682/output.txt b/acceptance/bundle/python/mutator-permissions-owner-5682/output.txt
new file mode 100644
index 00000000000..c28efb0f69f
--- /dev/null
+++ b/acceptance/bundle/python/mutator-permissions-owner-5682/output.txt
@@ -0,0 +1,13 @@
+
+>>> uv run [UV_ARGS] -q [CLI] bundle validate --output json
+[
+  "CAN_RUN",
+  "IS_OWNER"
+]
+
+>>> uv run [UV_ARGS] -q [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Created pipelines.my_pipeline
+Created pipelines.my_pipeline.permissions
+Files: 5 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
diff --git a/acceptance/bundle/python/mutator-permissions-owner-5682/script b/acceptance/bundle/python/mutator-permissions-owner-5682/script
new file mode 100644
index 00000000000..31330842b48
--- /dev/null
+++ b/acceptance/bundle/python/mutator-permissions-owner-5682/script
@@ -0,0 +1,22 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+if [ -n "$CLOUD_ENV" ]; then
+    # Unique group so parallel cloud runs don't collide; must exist for the PUT to
+    # reach the owner check rather than failing on an unknown principal.
+    export BUNDLE_VAR_grantee_group="dabs-5682-$UNIQUE_NAME"
+    $CLI groups create --display-name "$BUNDLE_VAR_grantee_group" &> /dev/null || true
+fi
+
+cleanup() {
+    uv run $UV_ARGS -q $CLI bundle destroy --auto-approve &> LOG.destroy
+    rm -fr .databricks __pycache__
+}
+trap cleanup EXIT
+
+# The Python mutator adds a CAN_RUN permission; FixPermissions then adds IS_OWNER for
+# the current user (issue #5682 - previously it did not run on Python-updated resources).
+trace uv run $UV_ARGS -q $CLI bundle validate --output json | \
+  jq ".resources.pipelines.my_pipeline.permissions | map(.level)"
+
+# With the owner present, the deploy succeeds on both engines.
+trace uv run $UV_ARGS -q $CLI bundle deploy
diff --git a/acceptance/bundle/python/mutator-permissions-owner-5682/test.toml b/acceptance/bundle/python/mutator-permissions-owner-5682/test.toml
new file mode 100644
index 00000000000..c7c6f58ed6e
--- /dev/null
+++ b/acceptance/bundle/python/mutator-permissions-owner-5682/test.toml
@@ -0,0 +1 @@
+Cloud = true
diff --git a/acceptance/bundle/python/pipeline-development-deprecated/databricks.yml b/acceptance/bundle/python/pipeline-development-deprecated/databricks.yml
new file mode 100644
index 00000000000..8c2bc005b78
--- /dev/null
+++ b/acceptance/bundle/python/pipeline-development-deprecated/databricks.yml
@@ -0,0 +1,13 @@
+bundle:
+  name: my_project
+
+sync: {paths: []} # don't need to copy files
+
+python:
+  resources:
+    - "resources:load_resources"
+
+targets:
+  dev:
+    mode: development
+    default: true
diff --git a/acceptance/bundle/python/pipeline-development-deprecated/out.test.toml b/acceptance/bundle/python/pipeline-development-deprecated/out.test.toml
new file mode 100644
index 00000000000..dce9192f28d
--- /dev/null
+++ b/acceptance/bundle/python/pipeline-development-deprecated/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.PYDAB_VERSION = ["0.266.0", "current"]
diff --git a/acceptance/bundle/python/pipeline-development-deprecated/output.txt b/acceptance/bundle/python/pipeline-development-deprecated/output.txt
new file mode 100644
index 00000000000..0150edea922
--- /dev/null
+++ b/acceptance/bundle/python/pipeline-development-deprecated/output.txt
@@ -0,0 +1,23 @@
+
+>>> uv run [UV_ARGS] -q [CLI] bundle validate
+Warning: The "development" property of pipelines is deprecated. Use "mode: development" in your databricks.yml instead. See https://docs.databricks.com/dev-tools/bundles/deployment-modes.
+  at resources.pipelines.with_development.development
+  in resources.py:7:1
+
+Name: my_project
+Target: dev
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/my_project/dev
+
+Found 1 warning
+
+>>> uv run [UV_ARGS] -q [CLI] bundle validate --output json
+Warning: The "development" property of pipelines is deprecated. Use "mode: development" in your databricks.yml instead. See https://docs.databricks.com/dev-tools/bundles/deployment-modes.
+  at resources.pipelines.with_development.development
+  in resources.py:7:1
+
+{
+  "with_development": true,
+  "without_development": true
+}
diff --git a/acceptance/bundle/python/pipeline-development-deprecated/resources.py b/acceptance/bundle/python/pipeline-development-deprecated/resources.py
new file mode 100644
index 00000000000..b8ba31f30a9
--- /dev/null
+++ b/acceptance/bundle/python/pipeline-development-deprecated/resources.py
@@ -0,0 +1,10 @@
+from databricks.bundles.core import Resources
+
+
+def load_resources() -> Resources:
+    resources = Resources()
+
+    resources.add_pipeline("with_development", {"name": "With development", "development": True})
+    resources.add_pipeline("without_development", {"name": "Without development"})
+
+    return resources
diff --git a/acceptance/bundle/python/pipeline-development-deprecated/script b/acceptance/bundle/python/pipeline-development-deprecated/script
new file mode 100644
index 00000000000..dcddc004f1d
--- /dev/null
+++ b/acceptance/bundle/python/pipeline-development-deprecated/script
@@ -0,0 +1,5 @@
+trace uv run $UV_ARGS -q $CLI bundle validate
+
+trace uv run $UV_ARGS -q $CLI bundle validate --output json | jq '.resources.pipelines | map_values(.development)'
+
+rm -fr .databricks __pycache__
diff --git a/acceptance/bundle/python/pipeline-development-mutator/databricks.yml b/acceptance/bundle/python/pipeline-development-mutator/databricks.yml
new file mode 100644
index 00000000000..0b3295f3e2f
--- /dev/null
+++ b/acceptance/bundle/python/pipeline-development-mutator/databricks.yml
@@ -0,0 +1,18 @@
+bundle:
+  name: my_project
+
+sync: {paths: []} # don't need to copy files
+
+python:
+  mutators:
+    - "mutators:disable_development"
+
+resources:
+  pipelines:
+    my_pipeline:
+      name: My Pipeline
+
+targets:
+  dev:
+    mode: development
+    default: true
diff --git a/acceptance/bundle/python/pipeline-development-mutator/mutators.py b/acceptance/bundle/python/pipeline-development-mutator/mutators.py
new file mode 100644
index 00000000000..e58e451f217
--- /dev/null
+++ b/acceptance/bundle/python/pipeline-development-mutator/mutators.py
@@ -0,0 +1,9 @@
+from dataclasses import replace
+
+from databricks.bundles.core import pipeline_mutator
+from databricks.bundles.pipelines import Pipeline
+
+
+@pipeline_mutator
+def disable_development(pipeline: Pipeline) -> Pipeline:
+    return replace(pipeline, development=False)
diff --git a/acceptance/bundle/python/pipeline-development-mutator/out.test.toml b/acceptance/bundle/python/pipeline-development-mutator/out.test.toml
new file mode 100644
index 00000000000..dce9192f28d
--- /dev/null
+++ b/acceptance/bundle/python/pipeline-development-mutator/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.PYDAB_VERSION = ["0.266.0", "current"]
diff --git a/acceptance/bundle/python/pipeline-development-mutator/output.txt b/acceptance/bundle/python/pipeline-development-mutator/output.txt
new file mode 100644
index 00000000000..c281946ba91
--- /dev/null
+++ b/acceptance/bundle/python/pipeline-development-mutator/output.txt
@@ -0,0 +1,55 @@
+
+=== Mutator sets development: false after mode: development stamped it
+>>> uv run [UV_ARGS] -q [CLI] bundle validate --output json
+Warning: The "development" property of pipelines is deprecated. Use "mode: development" in your databricks.yml instead. See https://docs.databricks.com/dev-tools/bundles/deployment-modes.
+  at resources.pipelines.my_pipeline.development
+  in mutators.py:7:1
+
+Warning: The "development: false" set by a Python mutator is ignored when running the pipeline. "bundle run" uses development mode from "mode: development" instead.
+  at resources.pipelines.my_pipeline.development
+  in mutators.py:7:1
+
+To run this pipeline in production, set "presets.pipelines_development: false" on the target.
+
+false
+
+>>> uv run [UV_ARGS] -q [CLI] bundle deploy
+Warning: The "development" property of pipelines is deprecated. Use "mode: development" in your databricks.yml instead. See https://docs.databricks.com/dev-tools/bundles/deployment-modes.
+  at resources.pipelines.my_pipeline.development
+  in mutators.py:7:1
+
+Warning: The "development: false" set by a Python mutator is ignored when running the pipeline. "bundle run" uses development mode from "mode: development" instead.
+  at resources.pipelines.my_pipeline.development
+  in mutators.py:7:1
+
+To run this pipeline in production, set "presets.pipelines_development: false" on the target.
+
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/my_project/dev/files...
+Created pipelines.my_pipeline
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Run sends development: true from mode: development, ignoring the deployed false
+>>> uv run [UV_ARGS] -q [CLI] bundle run my_pipeline
+Warning: The "development" property of pipelines is deprecated. Use "mode: development" in your databricks.yml instead. See https://docs.databricks.com/dev-tools/bundles/deployment-modes.
+  at resources.pipelines.my_pipeline.development
+  in mutators.py:7:1
+
+Warning: The "development: false" set by a Python mutator is ignored when running the pipeline. "bundle run" uses development mode from "mode: development" instead.
+  at resources.pipelines.my_pipeline.development
+  in mutators.py:7:1
+
+To run this pipeline in production, set "presets.pipelines_development: false" on the target.
+
+Update URL: [DATABRICKS_URL]/#joblist/pipelines/[UUID]/updates/[UUID]
+
+Update ID: [UUID]
+
+>>> print_requests.py //pipelines
+{
+  "method": "POST",
+  "path": "/api/2.0/pipelines/[UUID]/updates",
+  "body": {
+    "development": true
+  }
+}
diff --git a/acceptance/bundle/python/pipeline-development-mutator/script b/acceptance/bundle/python/pipeline-development-mutator/script
new file mode 100644
index 00000000000..31ea6bdbc99
--- /dev/null
+++ b/acceptance/bundle/python/pipeline-development-mutator/script
@@ -0,0 +1,13 @@
+cleanup() {
+    rm -fr .databricks __pycache__
+}
+trap cleanup EXIT
+
+title "Mutator sets development: false after mode: development stamped it"
+trace uv run $UV_ARGS -q $CLI bundle validate --output json | jq '.resources.pipelines.my_pipeline.development'
+trace uv run $UV_ARGS -q $CLI bundle deploy
+rm "$OUT_REQUESTS"
+
+title "Run sends development: true from mode: development, ignoring the deployed false"
+trace uv run $UV_ARGS -q $CLI bundle run my_pipeline
+trace print_requests.py //pipelines
diff --git a/acceptance/bundle/python/pipeline-development-mutator/test.toml b/acceptance/bundle/python/pipeline-development-mutator/test.toml
new file mode 100644
index 00000000000..159efe02696
--- /dev/null
+++ b/acceptance/bundle/python/pipeline-development-mutator/test.toml
@@ -0,0 +1 @@
+RecordRequests = true
diff --git a/acceptance/bundle/python/pipelines-support/out.test.toml b/acceptance/bundle/python/pipelines-support/out.test.toml
index 0969b3f3733..dce9192f28d 100644
--- a/acceptance/bundle/python/pipelines-support/out.test.toml
+++ b/acceptance/bundle/python/pipelines-support/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
 EnvMatrix.PYDAB_VERSION = ["0.266.0", "current"]
diff --git a/acceptance/bundle/python/propagates-auth-env/.databrickscfg b/acceptance/bundle/python/propagates-auth-env/.databrickscfg
new file mode 100644
index 00000000000..dec8f683589
--- /dev/null
+++ b/acceptance/bundle/python/propagates-auth-env/.databrickscfg
@@ -0,0 +1,7 @@
+[my-profile]
+host = $DATABRICKS_HOST
+token = $DATABRICKS_TOKEN
+
+[other-profile]
+host = $DATABRICKS_HOST
+token = other-token
diff --git a/acceptance/bundle/python/propagates-auth-env/databricks.yml b/acceptance/bundle/python/propagates-auth-env/databricks.yml
new file mode 100644
index 00000000000..ad214e007bf
--- /dev/null
+++ b/acceptance/bundle/python/propagates-auth-env/databricks.yml
@@ -0,0 +1,16 @@
+bundle:
+  name: my_project
+
+sync: {paths: []} # don't need to copy files
+
+python:
+  mutators:
+    - "mutators:capture_profile_env"
+
+workspace:
+  profile: my-profile
+
+resources:
+  jobs:
+    my_job:
+      name: "Job"
diff --git a/acceptance/bundle/python/propagates-auth-env/mutators.py b/acceptance/bundle/python/propagates-auth-env/mutators.py
new file mode 100644
index 00000000000..959d3929379
--- /dev/null
+++ b/acceptance/bundle/python/propagates-auth-env/mutators.py
@@ -0,0 +1,13 @@
+from databricks.bundles.jobs import Job
+from databricks.bundles.core import job_mutator, Bundle
+import os
+
+
+@job_mutator
+def capture_profile_env(bundle: Bundle, job: Job) -> Job:
+    # The CLI must propagate DATABRICKS_CONFIG_PROFILE to the python subprocess
+    # so the Databricks SDK can disambiguate when multiple profiles share a host.
+    value = os.getenv("DATABRICKS_CONFIG_PROFILE", "<unset>")
+    with open("captured_env.txt", "w") as f:
+        f.write(value)
+    return job
diff --git a/acceptance/bundle/python/propagates-auth-env/out.test.toml b/acceptance/bundle/python/propagates-auth-env/out.test.toml
new file mode 100644
index 00000000000..dce9192f28d
--- /dev/null
+++ b/acceptance/bundle/python/propagates-auth-env/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.PYDAB_VERSION = ["0.266.0", "current"]
diff --git a/acceptance/bundle/python/propagates-auth-env/output.txt b/acceptance/bundle/python/propagates-auth-env/output.txt
new file mode 100644
index 00000000000..7279b3df1a6
--- /dev/null
+++ b/acceptance/bundle/python/propagates-auth-env/output.txt
@@ -0,0 +1,8 @@
+
+>>> uv run [UV_ARGS] -q [CLI] bundle summary -o json
+{
+  "profile": "my-profile"
+}
+
+>>> cat captured_env.txt
+my-profile
diff --git a/acceptance/bundle/python/propagates-auth-env/script b/acceptance/bundle/python/propagates-auth-env/script
new file mode 100644
index 00000000000..73f9542cce3
--- /dev/null
+++ b/acceptance/bundle/python/propagates-auth-env/script
@@ -0,0 +1,18 @@
+
+# Two workspace profiles share the same host so picking one is meaningful.
+envsubst < .databrickscfg > out && mv out .databrickscfg
+export DATABRICKS_CONFIG_FILE=.databrickscfg
+unset DATABRICKS_HOST
+unset DATABRICKS_TOKEN
+unset DATABRICKS_CONFIG_PROFILE
+
+trace uv run $UV_ARGS -q $CLI bundle summary -o json | jq '{profile: .workspace.profile}'
+
+# The python mutator captures DATABRICKS_CONFIG_PROFILE from its subprocess env.
+# Without the fix, the CLI does not propagate the bundle's resolved profile,
+# so the SDK inside python re-invokes the CLI without a profile and fails on
+# multi-profile ambiguity.
+trace cat captured_env.txt
+echo ""
+
+rm -fr .databricks __pycache__ captured_env.txt
diff --git a/acceptance/bundle/python/quality_monitors-support/databricks.yml b/acceptance/bundle/python/quality_monitors-support/databricks.yml
new file mode 100644
index 00000000000..7fd203d8bf1
--- /dev/null
+++ b/acceptance/bundle/python/quality_monitors-support/databricks.yml
@@ -0,0 +1,17 @@
+bundle:
+  name: my_project
+
+sync: {paths: []} # don't need to copy files
+
+python:
+  resources:
+    - "resources:load_resources"
+  mutators:
+    - "mutators:update_quality_monitor"
+
+resources:
+  quality_monitors:
+    my_monitor_1:
+      assets_dir: "/Workspace/monitoring"
+      output_schema_name: "default.monitoring"
+      table_name: "default.test_table"
diff --git a/acceptance/bundle/python/quality_monitors-support/mutators.py b/acceptance/bundle/python/quality_monitors-support/mutators.py
new file mode 100644
index 00000000000..d53fed2f9a3
--- /dev/null
+++ b/acceptance/bundle/python/quality_monitors-support/mutators.py
@@ -0,0 +1,11 @@
+from dataclasses import replace
+
+from databricks.bundles.core import quality_monitor_mutator
+from databricks.bundles.quality_monitors import QualityMonitor
+
+
+@quality_monitor_mutator
+def update_quality_monitor(monitor: QualityMonitor) -> QualityMonitor:
+    assert isinstance(monitor.output_schema_name, str)
+
+    return replace(monitor, output_schema_name=f"{monitor.output_schema_name} (updated)")
diff --git a/acceptance/bundle/python/quality_monitors-support/out.test.toml b/acceptance/bundle/python/quality_monitors-support/out.test.toml
new file mode 100644
index 00000000000..aeddf3e619e
--- /dev/null
+++ b/acceptance/bundle/python/quality_monitors-support/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/quality_monitors-support/output.txt b/acceptance/bundle/python/quality_monitors-support/output.txt
new file mode 100644
index 00000000000..708ce30fc88
--- /dev/null
+++ b/acceptance/bundle/python/quality_monitors-support/output.txt
@@ -0,0 +1,28 @@
+
+>>> uv run [UV_ARGS] -q [CLI] bundle validate --output json
+{
+  "experimental": {
+    "python": {
+      "mutators": [
+        "mutators:update_quality_monitor"
+      ],
+      "resources": [
+        "resources:load_resources"
+      ]
+    }
+  },
+  "resources": {
+    "quality_monitors": {
+      "my_monitor_1": {
+        "assets_dir": "/Workspace/monitoring",
+        "output_schema_name": "default.monitoring (updated)",
+        "table_name": "default.test_table"
+      },
+      "my_monitor_2": {
+        "assets_dir": "/Workspace/monitoring",
+        "output_schema_name": "default.monitoring (updated)",
+        "table_name": "default.test_table"
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/python/quality_monitors-support/resources.py b/acceptance/bundle/python/quality_monitors-support/resources.py
new file mode 100644
index 00000000000..8e26b02bc1e
--- /dev/null
+++ b/acceptance/bundle/python/quality_monitors-support/resources.py
@@ -0,0 +1,16 @@
+from databricks.bundles.core import Resources
+
+
+def load_resources() -> Resources:
+    resources = Resources()
+
+    resources.add_quality_monitor(
+        "my_monitor_2",
+        {
+            "assets_dir": "/Workspace/monitoring",
+            "output_schema_name": "default.monitoring",
+            "table_name": "default.test_table",
+        },
+    )
+
+    return resources
diff --git a/acceptance/bundle/python/quality_monitors-support/script b/acceptance/bundle/python/quality_monitors-support/script
new file mode 100644
index 00000000000..e273fb45a53
--- /dev/null
+++ b/acceptance/bundle/python/quality_monitors-support/script
@@ -0,0 +1,5 @@
+
+trace uv run $UV_ARGS -q $CLI bundle validate --output json | \
+  jq "pick(.experimental.python, .resources)"
+
+rm -fr .databricks __pycache__
diff --git a/acceptance/bundle/python/quality_monitors-support/test.toml b/acceptance/bundle/python/quality_monitors-support/test.toml
new file mode 100644
index 00000000000..afd4f163d83
--- /dev/null
+++ b/acceptance/bundle/python/quality_monitors-support/test.toml
@@ -0,0 +1,6 @@
+Cloud = false # tests don't interact with APIs
+
+# quality_monitors are only supported in the current version of the wheel
+EnvMatrix.PYDAB_VERSION = ["current"]
+
+# quality_monitors are only supported on the direct deployment engine
diff --git a/acceptance/bundle/python/registered_models-support/databricks.yml b/acceptance/bundle/python/registered_models-support/databricks.yml
new file mode 100644
index 00000000000..8de75616dba
--- /dev/null
+++ b/acceptance/bundle/python/registered_models-support/databricks.yml
@@ -0,0 +1,16 @@
+bundle:
+  name: my_project
+
+sync: {paths: []} # don't need to copy files
+
+python:
+  resources:
+    - "resources:load_resources"
+  mutators:
+    - "mutators:update_registered_model"
+
+resources:
+  registered_models:
+    my_registered_model_1:
+      name: "my_registered_model_1"
+      comment: "My model"
diff --git a/acceptance/bundle/python/registered_models-support/mutators.py b/acceptance/bundle/python/registered_models-support/mutators.py
new file mode 100644
index 00000000000..b48e8b1a86f
--- /dev/null
+++ b/acceptance/bundle/python/registered_models-support/mutators.py
@@ -0,0 +1,11 @@
+from dataclasses import replace
+
+from databricks.bundles.core import registered_model_mutator
+from databricks.bundles.registered_models import RegisteredModel
+
+
+@registered_model_mutator
+def update_registered_model(registered_model: RegisteredModel) -> RegisteredModel:
+    assert isinstance(registered_model.comment, str)
+
+    return replace(registered_model, comment=f"{registered_model.comment} (updated)")
diff --git a/acceptance/bundle/python/registered_models-support/out.test.toml b/acceptance/bundle/python/registered_models-support/out.test.toml
new file mode 100644
index 00000000000..aeddf3e619e
--- /dev/null
+++ b/acceptance/bundle/python/registered_models-support/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/registered_models-support/output.txt b/acceptance/bundle/python/registered_models-support/output.txt
new file mode 100644
index 00000000000..1a6fbbde43b
--- /dev/null
+++ b/acceptance/bundle/python/registered_models-support/output.txt
@@ -0,0 +1,26 @@
+
+>>> uv run [UV_ARGS] -q [CLI] bundle validate --output json
+{
+  "experimental": {
+    "python": {
+      "mutators": [
+        "mutators:update_registered_model"
+      ],
+      "resources": [
+        "resources:load_resources"
+      ]
+    }
+  },
+  "resources": {
+    "registered_models": {
+      "my_registered_model_1": {
+        "comment": "My model (updated)",
+        "name": "my_registered_model_1"
+      },
+      "my_registered_model_2": {
+        "comment": "My model (2) (updated)",
+        "name": "my_registered_model_2"
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/python/registered_models-support/resources.py b/acceptance/bundle/python/registered_models-support/resources.py
new file mode 100644
index 00000000000..b05fbbca011
--- /dev/null
+++ b/acceptance/bundle/python/registered_models-support/resources.py
@@ -0,0 +1,15 @@
+from databricks.bundles.core import Resources
+
+
+def load_resources() -> Resources:
+    resources = Resources()
+
+    resources.add_registered_model(
+        "my_registered_model_2",
+        {
+            "name": "my_registered_model_2",
+            "comment": "My model (2)",
+        },
+    )
+
+    return resources
diff --git a/acceptance/bundle/python/registered_models-support/script b/acceptance/bundle/python/registered_models-support/script
new file mode 100644
index 00000000000..e273fb45a53
--- /dev/null
+++ b/acceptance/bundle/python/registered_models-support/script
@@ -0,0 +1,5 @@
+
+trace uv run $UV_ARGS -q $CLI bundle validate --output json | \
+  jq "pick(.experimental.python, .resources)"
+
+rm -fr .databricks __pycache__
diff --git a/acceptance/bundle/python/registered_models-support/test.toml b/acceptance/bundle/python/registered_models-support/test.toml
new file mode 100644
index 00000000000..b8a3736ca28
--- /dev/null
+++ b/acceptance/bundle/python/registered_models-support/test.toml
@@ -0,0 +1,4 @@
+Cloud = false # tests don't interact with APIs
+
+# registered_models are only supported in the current version of the wheel
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/resolve-variable/out.test.toml b/acceptance/bundle/python/resolve-variable/out.test.toml
index 0969b3f3733..dce9192f28d 100644
--- a/acceptance/bundle/python/resolve-variable/out.test.toml
+++ b/acceptance/bundle/python/resolve-variable/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
 EnvMatrix.PYDAB_VERSION = ["0.266.0", "current"]
diff --git a/acceptance/bundle/python/resource-loading/out.test.toml b/acceptance/bundle/python/resource-loading/out.test.toml
index 0969b3f3733..dce9192f28d 100644
--- a/acceptance/bundle/python/resource-loading/out.test.toml
+++ b/acceptance/bundle/python/resource-loading/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
 EnvMatrix.PYDAB_VERSION = ["0.266.0", "current"]
diff --git a/acceptance/bundle/python/restricted-execution/out.test.toml b/acceptance/bundle/python/restricted-execution/out.test.toml
index 0969b3f3733..dce9192f28d 100644
--- a/acceptance/bundle/python/restricted-execution/out.test.toml
+++ b/acceptance/bundle/python/restricted-execution/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
 EnvMatrix.PYDAB_VERSION = ["0.266.0", "current"]
diff --git a/acceptance/bundle/python/schemas-support/out.test.toml b/acceptance/bundle/python/schemas-support/out.test.toml
index 98d084e3bb9..aeddf3e619e 100644
--- a/acceptance/bundle/python/schemas-support/out.test.toml
+++ b/acceptance/bundle/python/schemas-support/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
 EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/schemas-support/test.toml b/acceptance/bundle/python/schemas-support/test.toml
index 9342570f504..005e1e625c7 100644
--- a/acceptance/bundle/python/schemas-support/test.toml
+++ b/acceptance/bundle/python/schemas-support/test.toml
@@ -1,8 +1,6 @@
-Local = true
 Cloud = false # tests don't interact with APIs
 
-[EnvMatrix]
-PYDAB_VERSION = [
+EnvMatrix.PYDAB_VERSION = [
     # pipelines are only supported in the latest version of the wheel
     "current",
 ]
diff --git a/acceptance/bundle/python/script.prepare b/acceptance/bundle/python/script.prepare
index c0d9f2b67d1..0e5ba9bb79f 100644
--- a/acceptance/bundle/python/script.prepare
+++ b/acceptance/bundle/python/script.prepare
@@ -1,7 +1,10 @@
+# Written in both branches, even though only "current" passes it to uv: the file sits
+# in the bundle root, so creating it in just one variant makes that variant sync one
+# more file than the other, and both variants share a single output.txt.
+echo "$DATABRICKS_BUNDLES_WHEEL" > "requirements-latest.txt"
 if [ "$PYDAB_VERSION" = "current" ]; then
-  echo "$DATABRICKS_BUNDLES_WHEEL" > "requirements-latest.txt"
   UV_ARGS="--with-requirements requirements-latest.txt"
 else
   UV_ARGS="--with databricks-bundles==$PYDAB_VERSION"
 fi
-add_repl.py "$UV_ARGS" UV_ARGS
+add_repl "$UV_ARGS" UV_ARGS
diff --git a/acceptance/bundle/python/secret_scopes-support/databricks.yml b/acceptance/bundle/python/secret_scopes-support/databricks.yml
new file mode 100644
index 00000000000..3be6b161c51
--- /dev/null
+++ b/acceptance/bundle/python/secret_scopes-support/databricks.yml
@@ -0,0 +1,16 @@
+bundle:
+  name: my_project
+
+sync: {paths: []} # don't need to copy files
+
+python:
+  resources:
+    - "resources:load_resources"
+  mutators:
+    - "mutators:update_secret_scope"
+
+resources:
+  secret_scopes:
+    my_scope_1:
+      name: "my_scope_1"
+      backend_type: "DATABRICKS"
diff --git a/acceptance/bundle/python/secret_scopes-support/mutators.py b/acceptance/bundle/python/secret_scopes-support/mutators.py
new file mode 100644
index 00000000000..ace70fd68f4
--- /dev/null
+++ b/acceptance/bundle/python/secret_scopes-support/mutators.py
@@ -0,0 +1,11 @@
+from dataclasses import replace
+
+from databricks.bundles.secret_scopes import SecretScope
+from databricks.bundles.core import secret_scope_mutator
+
+
+@secret_scope_mutator
+def update_secret_scope(scope: SecretScope) -> SecretScope:
+    assert isinstance(scope.name, str)
+
+    return replace(scope, name=f"{scope.name} (updated)")
diff --git a/acceptance/bundle/python/secret_scopes-support/out.test.toml b/acceptance/bundle/python/secret_scopes-support/out.test.toml
new file mode 100644
index 00000000000..aeddf3e619e
--- /dev/null
+++ b/acceptance/bundle/python/secret_scopes-support/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/secret_scopes-support/output.txt b/acceptance/bundle/python/secret_scopes-support/output.txt
new file mode 100644
index 00000000000..c3139333141
--- /dev/null
+++ b/acceptance/bundle/python/secret_scopes-support/output.txt
@@ -0,0 +1,26 @@
+
+>>> uv run [UV_ARGS] -q [CLI] bundle validate --output json
+{
+  "experimental": {
+    "python": {
+      "mutators": [
+        "mutators:update_secret_scope"
+      ],
+      "resources": [
+        "resources:load_resources"
+      ]
+    }
+  },
+  "resources": {
+    "secret_scopes": {
+      "my_scope_1": {
+        "backend_type": "DATABRICKS",
+        "name": "my_scope_1 (updated)"
+      },
+      "my_scope_2": {
+        "backend_type": "DATABRICKS",
+        "name": "my_scope_2 (updated)"
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/python/secret_scopes-support/resources.py b/acceptance/bundle/python/secret_scopes-support/resources.py
new file mode 100644
index 00000000000..64c21b39f9a
--- /dev/null
+++ b/acceptance/bundle/python/secret_scopes-support/resources.py
@@ -0,0 +1,15 @@
+from databricks.bundles.core import Resources
+
+
+def load_resources() -> Resources:
+    resources = Resources()
+
+    resources.add_secret_scope(
+        "my_scope_2",
+        {
+            "name": "my_scope_2",
+            "backend_type": "DATABRICKS",
+        },
+    )
+
+    return resources
diff --git a/acceptance/bundle/python/secret_scopes-support/script b/acceptance/bundle/python/secret_scopes-support/script
new file mode 100644
index 00000000000..e273fb45a53
--- /dev/null
+++ b/acceptance/bundle/python/secret_scopes-support/script
@@ -0,0 +1,5 @@
+
+trace uv run $UV_ARGS -q $CLI bundle validate --output json | \
+  jq "pick(.experimental.python, .resources)"
+
+rm -fr .databricks __pycache__
diff --git a/acceptance/bundle/python/secret_scopes-support/test.toml b/acceptance/bundle/python/secret_scopes-support/test.toml
new file mode 100644
index 00000000000..b9d934df8fe
--- /dev/null
+++ b/acceptance/bundle/python/secret_scopes-support/test.toml
@@ -0,0 +1,4 @@
+Cloud = false # tests don't interact with APIs
+
+# secret_scopes are only supported in the current version of the wheel
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/secrets-support/databricks.yml b/acceptance/bundle/python/secrets-support/databricks.yml
new file mode 100644
index 00000000000..4b4f4fe3924
--- /dev/null
+++ b/acceptance/bundle/python/secrets-support/databricks.yml
@@ -0,0 +1,23 @@
+bundle:
+  name: my_project
+
+sync: {paths: []} # don't need to copy files
+
+variables:
+  secret_value:
+    description: The value of the secret
+
+python:
+  resources:
+    - "resources:load_resources"
+  mutators:
+    - "mutators:update_secret"
+
+resources:
+  secrets:
+    my_secret_1:
+      catalog_name: main
+      schema_name: default
+      name: my_secret_1
+      value: ${var.secret_value}
+      expire_time: "2030-01-01T00:00:00Z"
diff --git a/acceptance/bundle/python/secrets-support/mutators.py b/acceptance/bundle/python/secrets-support/mutators.py
new file mode 100644
index 00000000000..b8d71911a43
--- /dev/null
+++ b/acceptance/bundle/python/secrets-support/mutators.py
@@ -0,0 +1,11 @@
+from dataclasses import replace
+
+from databricks.bundles.secrets import Secret
+from databricks.bundles.core import secret_mutator
+
+
+@secret_mutator
+def update_secret(secret: Secret) -> Secret:
+    assert isinstance(secret.name, str)
+
+    return replace(secret, name=f"{secret.name} (updated)")
diff --git a/acceptance/bundle/python/secrets-support/out.test.toml b/acceptance/bundle/python/secrets-support/out.test.toml
new file mode 100644
index 00000000000..aeddf3e619e
--- /dev/null
+++ b/acceptance/bundle/python/secrets-support/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/secrets-support/output.txt b/acceptance/bundle/python/secrets-support/output.txt
new file mode 100644
index 00000000000..ed0e0dc9fca
--- /dev/null
+++ b/acceptance/bundle/python/secrets-support/output.txt
@@ -0,0 +1,32 @@
+
+>>> uv run [UV_ARGS] -q [CLI] bundle validate --var secret_value=my-secret-value --output json
+{
+  "experimental": {
+    "python": {
+      "mutators": [
+        "mutators:update_secret"
+      ],
+      "resources": [
+        "resources:load_resources"
+      ]
+    }
+  },
+  "resources": {
+    "secrets": {
+      "my_secret_1": {
+        "catalog_name": "main",
+        "expire_time": "[TIMESTAMP]",
+        "name": "my_secret_1 (updated)",
+        "schema_name": "default",
+        "value": "[redacted]"
+      },
+      "my_secret_2": {
+        "catalog_name": "main",
+        "expire_time": "[TIMESTAMP]",
+        "name": "my_secret_2 (updated)",
+        "schema_name": "default",
+        "value": "[redacted]"
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/python/secrets-support/resources.py b/acceptance/bundle/python/secrets-support/resources.py
new file mode 100644
index 00000000000..b46f8586a64
--- /dev/null
+++ b/acceptance/bundle/python/secrets-support/resources.py
@@ -0,0 +1,18 @@
+from databricks.bundles.core import Resources
+
+
+def load_resources() -> Resources:
+    resources = Resources()
+
+    resources.add_secret(
+        "my_secret_2",
+        {
+            "catalog_name": "main",
+            "schema_name": "default",
+            "name": "my_secret_2",
+            "value": "${var.secret_value}",
+            "expire_time": "2030-01-01T00:00:00Z",
+        },
+    )
+
+    return resources
diff --git a/acceptance/bundle/python/secrets-support/script b/acceptance/bundle/python/secrets-support/script
new file mode 100644
index 00000000000..3864446e68b
--- /dev/null
+++ b/acceptance/bundle/python/secrets-support/script
@@ -0,0 +1,6 @@
+
+# secrets require value to be a variable reference, so supply it at validate time.
+trace uv run $UV_ARGS -q $CLI bundle validate --var secret_value=my-secret-value --output json | \
+  jq "pick(.experimental.python, .resources)"
+
+rm -fr .databricks __pycache__
diff --git a/acceptance/bundle/python/secrets-support/test.toml b/acceptance/bundle/python/secrets-support/test.toml
new file mode 100644
index 00000000000..3950598f0b2
--- /dev/null
+++ b/acceptance/bundle/python/secrets-support/test.toml
@@ -0,0 +1,6 @@
+Cloud = false # tests don't interact with APIs
+
+# secrets are only supported in the current version of the wheel
+EnvMatrix.PYDAB_VERSION = ["current"]
+
+# secrets are only supported on the direct deployment engine
diff --git a/acceptance/bundle/python/sql_warehouses-support/databricks.yml b/acceptance/bundle/python/sql_warehouses-support/databricks.yml
new file mode 100644
index 00000000000..3a7a3012756
--- /dev/null
+++ b/acceptance/bundle/python/sql_warehouses-support/databricks.yml
@@ -0,0 +1,20 @@
+bundle:
+  name: my_project
+
+sync: {paths: []} # don't need to copy files
+
+python:
+  resources:
+    - "resources:load_resources"
+  mutators:
+    - "mutators:update_sql_warehouse"
+
+resources:
+  sql_warehouses:
+    my_sql_warehouse_1:
+      name: "my_sql_warehouse_1"
+      cluster_size: "2X-Small"
+      auto_stop_mins: 10
+      max_num_clusters: 1
+      min_num_clusters: 1
+      warehouse_type: "CLASSIC"
diff --git a/acceptance/bundle/python/sql_warehouses-support/mutators.py b/acceptance/bundle/python/sql_warehouses-support/mutators.py
new file mode 100644
index 00000000000..67cf5d9b07d
--- /dev/null
+++ b/acceptance/bundle/python/sql_warehouses-support/mutators.py
@@ -0,0 +1,11 @@
+from dataclasses import replace
+
+from databricks.bundles.core import sql_warehouse_mutator
+from databricks.bundles.sql_warehouses import SqlWarehouse
+
+
+@sql_warehouse_mutator
+def update_sql_warehouse(sql_warehouse: SqlWarehouse) -> SqlWarehouse:
+    assert isinstance(sql_warehouse.name, str)
+
+    return replace(sql_warehouse, name=f"{sql_warehouse.name} (updated)")
diff --git a/acceptance/bundle/python/sql_warehouses-support/out.test.toml b/acceptance/bundle/python/sql_warehouses-support/out.test.toml
new file mode 100644
index 00000000000..aeddf3e619e
--- /dev/null
+++ b/acceptance/bundle/python/sql_warehouses-support/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/sql_warehouses-support/output.txt b/acceptance/bundle/python/sql_warehouses-support/output.txt
new file mode 100644
index 00000000000..65c2cae42b2
--- /dev/null
+++ b/acceptance/bundle/python/sql_warehouses-support/output.txt
@@ -0,0 +1,38 @@
+
+>>> uv run [UV_ARGS] -q [CLI] bundle validate --output json
+{
+  "experimental": {
+    "python": {
+      "mutators": [
+        "mutators:update_sql_warehouse"
+      ],
+      "resources": [
+        "resources:load_resources"
+      ]
+    }
+  },
+  "resources": {
+    "sql_warehouses": {
+      "my_sql_warehouse_1": {
+        "auto_stop_mins": 10,
+        "cluster_size": "2X-Small",
+        "enable_photon": true,
+        "max_num_clusters": 1,
+        "min_num_clusters": 1,
+        "name": "my_sql_warehouse_1 (updated)",
+        "spot_instance_policy": "COST_OPTIMIZED",
+        "warehouse_type": "CLASSIC"
+      },
+      "my_sql_warehouse_2": {
+        "auto_stop_mins": 10,
+        "cluster_size": "2X-Small",
+        "enable_photon": true,
+        "max_num_clusters": 1,
+        "min_num_clusters": 1,
+        "name": "my_sql_warehouse_2 (updated)",
+        "spot_instance_policy": "COST_OPTIMIZED",
+        "warehouse_type": "CLASSIC"
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/python/sql_warehouses-support/resources.py b/acceptance/bundle/python/sql_warehouses-support/resources.py
new file mode 100644
index 00000000000..bcd2f0676a6
--- /dev/null
+++ b/acceptance/bundle/python/sql_warehouses-support/resources.py
@@ -0,0 +1,19 @@
+from databricks.bundles.core import Resources
+
+
+def load_resources() -> Resources:
+    resources = Resources()
+
+    resources.add_sql_warehouse(
+        "my_sql_warehouse_2",
+        {
+            "name": "my_sql_warehouse_2",
+            "cluster_size": "2X-Small",
+            "auto_stop_mins": 10,
+            "max_num_clusters": 1,
+            "min_num_clusters": 1,
+            "warehouse_type": "CLASSIC",
+        },
+    )
+
+    return resources
diff --git a/acceptance/bundle/python/sql_warehouses-support/script b/acceptance/bundle/python/sql_warehouses-support/script
new file mode 100644
index 00000000000..e273fb45a53
--- /dev/null
+++ b/acceptance/bundle/python/sql_warehouses-support/script
@@ -0,0 +1,5 @@
+
+trace uv run $UV_ARGS -q $CLI bundle validate --output json | \
+  jq "pick(.experimental.python, .resources)"
+
+rm -fr .databricks __pycache__
diff --git a/acceptance/bundle/python/sql_warehouses-support/test.toml b/acceptance/bundle/python/sql_warehouses-support/test.toml
new file mode 100644
index 00000000000..964cb938f02
--- /dev/null
+++ b/acceptance/bundle/python/sql_warehouses-support/test.toml
@@ -0,0 +1,4 @@
+Cloud = false # tests don't interact with APIs
+
+# sql_warehouses are only supported in the current version of the wheel
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/synced_database_tables-support/databricks.yml b/acceptance/bundle/python/synced_database_tables-support/databricks.yml
new file mode 100644
index 00000000000..0867ea43b6c
--- /dev/null
+++ b/acceptance/bundle/python/synced_database_tables-support/databricks.yml
@@ -0,0 +1,15 @@
+bundle:
+  name: my_project
+
+sync: {paths: []} # don't need to copy files
+
+python:
+  resources:
+    - "resources:load_resources"
+  mutators:
+    - "mutators:update_synced_database_table"
+
+resources:
+  synced_database_tables:
+    my_synced_table_1:
+      name: "main.default.my_synced_table_1"
diff --git a/acceptance/bundle/python/synced_database_tables-support/mutators.py b/acceptance/bundle/python/synced_database_tables-support/mutators.py
new file mode 100644
index 00000000000..2c9cd6ec3c0
--- /dev/null
+++ b/acceptance/bundle/python/synced_database_tables-support/mutators.py
@@ -0,0 +1,11 @@
+from dataclasses import replace
+
+from databricks.bundles.core import synced_database_table_mutator
+from databricks.bundles.synced_database_tables import SyncedDatabaseTable
+
+
+@synced_database_table_mutator
+def update_synced_database_table(synced_database_table: SyncedDatabaseTable) -> SyncedDatabaseTable:
+    assert isinstance(synced_database_table.name, str)
+
+    return replace(synced_database_table, name=f"{synced_database_table.name} (updated)")
diff --git a/acceptance/bundle/python/synced_database_tables-support/out.test.toml b/acceptance/bundle/python/synced_database_tables-support/out.test.toml
new file mode 100644
index 00000000000..aeddf3e619e
--- /dev/null
+++ b/acceptance/bundle/python/synced_database_tables-support/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/synced_database_tables-support/output.txt b/acceptance/bundle/python/synced_database_tables-support/output.txt
new file mode 100644
index 00000000000..643fccdfcad
--- /dev/null
+++ b/acceptance/bundle/python/synced_database_tables-support/output.txt
@@ -0,0 +1,24 @@
+
+>>> uv run [UV_ARGS] -q [CLI] bundle validate --output json
+{
+  "experimental": {
+    "python": {
+      "mutators": [
+        "mutators:update_synced_database_table"
+      ],
+      "resources": [
+        "resources:load_resources"
+      ]
+    }
+  },
+  "resources": {
+    "synced_database_tables": {
+      "my_synced_table_1": {
+        "name": "main.default.my_synced_table_1 (updated)"
+      },
+      "my_synced_table_2": {
+        "name": "main.default.my_synced_table_2 (updated)"
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/python/synced_database_tables-support/resources.py b/acceptance/bundle/python/synced_database_tables-support/resources.py
new file mode 100644
index 00000000000..3e416b28f2e
--- /dev/null
+++ b/acceptance/bundle/python/synced_database_tables-support/resources.py
@@ -0,0 +1,14 @@
+from databricks.bundles.core import Resources
+
+
+def load_resources() -> Resources:
+    resources = Resources()
+
+    resources.add_synced_database_table(
+        "my_synced_table_2",
+        {
+            "name": "main.default.my_synced_table_2",
+        },
+    )
+
+    return resources
diff --git a/acceptance/bundle/python/synced_database_tables-support/script b/acceptance/bundle/python/synced_database_tables-support/script
new file mode 100644
index 00000000000..e273fb45a53
--- /dev/null
+++ b/acceptance/bundle/python/synced_database_tables-support/script
@@ -0,0 +1,5 @@
+
+trace uv run $UV_ARGS -q $CLI bundle validate --output json | \
+  jq "pick(.experimental.python, .resources)"
+
+rm -fr .databricks __pycache__
diff --git a/acceptance/bundle/python/synced_database_tables-support/test.toml b/acceptance/bundle/python/synced_database_tables-support/test.toml
new file mode 100644
index 00000000000..08a67723677
--- /dev/null
+++ b/acceptance/bundle/python/synced_database_tables-support/test.toml
@@ -0,0 +1,4 @@
+Cloud = false # tests don't interact with APIs
+
+# synced_database_tables are only supported in the current version of the wheel
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/test.toml b/acceptance/bundle/python/test.toml
index 8d11f9d2557..08fce7bcbcb 100644
--- a/acceptance/bundle/python/test.toml
+++ b/acceptance/bundle/python/test.toml
@@ -2,8 +2,7 @@ Ignore = [
   "requirements-latest.txt",
 ]
 
-[EnvMatrix]
-PYDAB_VERSION = [
+EnvMatrix.PYDAB_VERSION = [
   # pin to a specific version from the past to avoid issues with unintended breaking changes
   # we can't expect CLI and databricks-bundles versions to be always in sync
   "0.266.0",
@@ -11,6 +10,5 @@ PYDAB_VERSION = [
   "current",
 ]
 
-[EnvRepl]
 # Don't replace PYDAB_VERSION values in output — "current" is too common a word
-PYDAB_VERSION = false
+EnvRepl.PYDAB_VERSION = false
diff --git a/acceptance/bundle/python/unicode-support/out.test.toml b/acceptance/bundle/python/unicode-support/out.test.toml
index 0969b3f3733..dce9192f28d 100644
--- a/acceptance/bundle/python/unicode-support/out.test.toml
+++ b/acceptance/bundle/python/unicode-support/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
 EnvMatrix.PYDAB_VERSION = ["0.266.0", "current"]
diff --git a/acceptance/bundle/python/vector_search_endpoints-support/databricks.yml b/acceptance/bundle/python/vector_search_endpoints-support/databricks.yml
new file mode 100644
index 00000000000..94dfd6f2e99
--- /dev/null
+++ b/acceptance/bundle/python/vector_search_endpoints-support/databricks.yml
@@ -0,0 +1,16 @@
+bundle:
+  name: my_project
+
+sync: {paths: []} # don't need to copy files
+
+python:
+  resources:
+    - "resources:load_resources"
+  mutators:
+    - "mutators:update_vector_search_endpoint"
+
+resources:
+  vector_search_endpoints:
+    my_endpoint_1:
+      name: "my_endpoint_1"
+      endpoint_type: "STANDARD"
diff --git a/acceptance/bundle/python/vector_search_endpoints-support/mutators.py b/acceptance/bundle/python/vector_search_endpoints-support/mutators.py
new file mode 100644
index 00000000000..743001fd4c8
--- /dev/null
+++ b/acceptance/bundle/python/vector_search_endpoints-support/mutators.py
@@ -0,0 +1,13 @@
+from dataclasses import replace
+
+from databricks.bundles.core import vector_search_endpoint_mutator
+from databricks.bundles.vector_search_endpoints import VectorSearchEndpoint
+
+
+@vector_search_endpoint_mutator
+def update_vector_search_endpoint(
+    endpoint: VectorSearchEndpoint,
+) -> VectorSearchEndpoint:
+    assert isinstance(endpoint.name, str)
+
+    return replace(endpoint, name=f"{endpoint.name} (updated)")
diff --git a/acceptance/bundle/python/vector_search_endpoints-support/out.test.toml b/acceptance/bundle/python/vector_search_endpoints-support/out.test.toml
new file mode 100644
index 00000000000..aeddf3e619e
--- /dev/null
+++ b/acceptance/bundle/python/vector_search_endpoints-support/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/vector_search_endpoints-support/output.txt b/acceptance/bundle/python/vector_search_endpoints-support/output.txt
new file mode 100644
index 00000000000..b0316919bac
--- /dev/null
+++ b/acceptance/bundle/python/vector_search_endpoints-support/output.txt
@@ -0,0 +1,26 @@
+
+>>> uv run [UV_ARGS] -q [CLI] bundle validate --output json
+{
+  "experimental": {
+    "python": {
+      "mutators": [
+        "mutators:update_vector_search_endpoint"
+      ],
+      "resources": [
+        "resources:load_resources"
+      ]
+    }
+  },
+  "resources": {
+    "vector_search_endpoints": {
+      "my_endpoint_1": {
+        "endpoint_type": "STANDARD",
+        "name": "my_endpoint_1 (updated)"
+      },
+      "my_endpoint_2": {
+        "endpoint_type": "STANDARD",
+        "name": "my_endpoint_2 (updated)"
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/python/vector_search_endpoints-support/resources.py b/acceptance/bundle/python/vector_search_endpoints-support/resources.py
new file mode 100644
index 00000000000..df66ab797d6
--- /dev/null
+++ b/acceptance/bundle/python/vector_search_endpoints-support/resources.py
@@ -0,0 +1,15 @@
+from databricks.bundles.core import Resources
+
+
+def load_resources() -> Resources:
+    resources = Resources()
+
+    resources.add_vector_search_endpoint(
+        "my_endpoint_2",
+        {
+            "name": "my_endpoint_2",
+            "endpoint_type": "STANDARD",
+        },
+    )
+
+    return resources
diff --git a/acceptance/bundle/python/vector_search_endpoints-support/script b/acceptance/bundle/python/vector_search_endpoints-support/script
new file mode 100644
index 00000000000..e273fb45a53
--- /dev/null
+++ b/acceptance/bundle/python/vector_search_endpoints-support/script
@@ -0,0 +1,5 @@
+
+trace uv run $UV_ARGS -q $CLI bundle validate --output json | \
+  jq "pick(.experimental.python, .resources)"
+
+rm -fr .databricks __pycache__
diff --git a/acceptance/bundle/python/vector_search_endpoints-support/test.toml b/acceptance/bundle/python/vector_search_endpoints-support/test.toml
new file mode 100644
index 00000000000..76a6852f977
--- /dev/null
+++ b/acceptance/bundle/python/vector_search_endpoints-support/test.toml
@@ -0,0 +1,6 @@
+Cloud = false # tests don't interact with APIs
+
+# vector_search_endpoints are only supported in the current version of the wheel
+EnvMatrix.PYDAB_VERSION = ["current"]
+
+# vector_search_endpoints are only supported on the direct deployment engine
diff --git a/acceptance/bundle/python/vector_search_indexes-support/databricks.yml b/acceptance/bundle/python/vector_search_indexes-support/databricks.yml
new file mode 100644
index 00000000000..82d228e3198
--- /dev/null
+++ b/acceptance/bundle/python/vector_search_indexes-support/databricks.yml
@@ -0,0 +1,18 @@
+bundle:
+  name: my_project
+
+sync: {paths: []} # don't need to copy files
+
+python:
+  resources:
+    - "resources:load_resources"
+  mutators:
+    - "mutators:update_vector_search_index"
+
+resources:
+  vector_search_indexes:
+    my_index_1:
+      name: "my_index_1"
+      endpoint_name: "my_endpoint"
+      primary_key: "id"
+      index_type: "DELTA_SYNC"
diff --git a/acceptance/bundle/python/vector_search_indexes-support/mutators.py b/acceptance/bundle/python/vector_search_indexes-support/mutators.py
new file mode 100644
index 00000000000..e1e7fa5a62b
--- /dev/null
+++ b/acceptance/bundle/python/vector_search_indexes-support/mutators.py
@@ -0,0 +1,11 @@
+from dataclasses import replace
+
+from databricks.bundles.core import vector_search_index_mutator
+from databricks.bundles.vector_search_indexes import VectorSearchIndex
+
+
+@vector_search_index_mutator
+def update_vector_search_index(index: VectorSearchIndex) -> VectorSearchIndex:
+    assert isinstance(index.name, str)
+
+    return replace(index, name=f"{index.name} (updated)")
diff --git a/acceptance/bundle/python/vector_search_indexes-support/out.test.toml b/acceptance/bundle/python/vector_search_indexes-support/out.test.toml
new file mode 100644
index 00000000000..aeddf3e619e
--- /dev/null
+++ b/acceptance/bundle/python/vector_search_indexes-support/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.PYDAB_VERSION = ["current"]
diff --git a/acceptance/bundle/python/vector_search_indexes-support/output.txt b/acceptance/bundle/python/vector_search_indexes-support/output.txt
new file mode 100644
index 00000000000..08fc86da293
--- /dev/null
+++ b/acceptance/bundle/python/vector_search_indexes-support/output.txt
@@ -0,0 +1,30 @@
+
+>>> uv run [UV_ARGS] -q [CLI] bundle validate --output json
+{
+  "experimental": {
+    "python": {
+      "mutators": [
+        "mutators:update_vector_search_index"
+      ],
+      "resources": [
+        "resources:load_resources"
+      ]
+    }
+  },
+  "resources": {
+    "vector_search_indexes": {
+      "my_index_1": {
+        "endpoint_name": "my_endpoint",
+        "index_type": "DELTA_SYNC",
+        "name": "my_index_1 (updated)",
+        "primary_key": "id"
+      },
+      "my_index_2": {
+        "endpoint_name": "my_endpoint",
+        "index_type": "DELTA_SYNC",
+        "name": "my_index_2 (updated)",
+        "primary_key": "id"
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/python/vector_search_indexes-support/resources.py b/acceptance/bundle/python/vector_search_indexes-support/resources.py
new file mode 100644
index 00000000000..5433fc7258f
--- /dev/null
+++ b/acceptance/bundle/python/vector_search_indexes-support/resources.py
@@ -0,0 +1,17 @@
+from databricks.bundles.core import Resources
+
+
+def load_resources() -> Resources:
+    resources = Resources()
+
+    resources.add_vector_search_index(
+        "my_index_2",
+        {
+            "name": "my_index_2",
+            "endpoint_name": "my_endpoint",
+            "primary_key": "id",
+            "index_type": "DELTA_SYNC",
+        },
+    )
+
+    return resources
diff --git a/acceptance/bundle/python/vector_search_indexes-support/script b/acceptance/bundle/python/vector_search_indexes-support/script
new file mode 100644
index 00000000000..e273fb45a53
--- /dev/null
+++ b/acceptance/bundle/python/vector_search_indexes-support/script
@@ -0,0 +1,5 @@
+
+trace uv run $UV_ARGS -q $CLI bundle validate --output json | \
+  jq "pick(.experimental.python, .resources)"
+
+rm -fr .databricks __pycache__
diff --git a/acceptance/bundle/python/vector_search_indexes-support/test.toml b/acceptance/bundle/python/vector_search_indexes-support/test.toml
new file mode 100644
index 00000000000..8f9f1317cf2
--- /dev/null
+++ b/acceptance/bundle/python/vector_search_indexes-support/test.toml
@@ -0,0 +1,6 @@
+Cloud = false # tests don't interact with APIs
+
+# vector_search_indexes are only supported in the current version of the wheel
+EnvMatrix.PYDAB_VERSION = ["current"]
+
+# vector_search_indexes are only supported on the direct deployment engine
diff --git a/acceptance/bundle/python/volumes-support/out.test.toml b/acceptance/bundle/python/volumes-support/out.test.toml
index 0969b3f3733..dce9192f28d 100644
--- a/acceptance/bundle/python/volumes-support/out.test.toml
+++ b/acceptance/bundle/python/volumes-support/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
 EnvMatrix.PYDAB_VERSION = ["0.266.0", "current"]
diff --git a/acceptance/bundle/python/volumes-support/output.txt b/acceptance/bundle/python/volumes-support/output.txt
index e2b6d8771e6..eafa1e8685d 100644
--- a/acceptance/bundle/python/volumes-support/output.txt
+++ b/acceptance/bundle/python/volumes-support/output.txt
@@ -17,12 +17,14 @@
         "catalog_name": "my_catalog",
         "name": "My Volume (updated)",
         "schema_name": "my_schema",
+        "volume_path": "/Volumes/my_catalog/my_schema/My Volume (updated)",
         "volume_type": "MANAGED"
       },
       "my_volume_2": {
         "catalog_name": "my_catalog_2",
         "name": "My Volume (2) (updated)",
         "schema_name": "my_schema_2",
+        "volume_path": "/Volumes/my_catalog_2/my_schema_2/My Volume (2) (updated)",
         "volume_type": "MANAGED"
       }
     }
diff --git a/acceptance/bundle/python/volumes-support/test.toml b/acceptance/bundle/python/volumes-support/test.toml
index 95d0b9d9f95..03da5a5afa6 100644
--- a/acceptance/bundle/python/volumes-support/test.toml
+++ b/acceptance/bundle/python/volumes-support/test.toml
@@ -1,2 +1 @@
-Local = true
 Cloud = false # tests don't interact with APIs
diff --git a/acceptance/bundle/quality_monitor/out.test.toml b/acceptance/bundle/quality_monitor/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/quality_monitor/out.test.toml
+++ b/acceptance/bundle/quality_monitor/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/quiet-levels/databricks.yml.tmpl b/acceptance/bundle/quiet-levels/databricks.yml.tmpl
new file mode 100644
index 00000000000..5ef156288e8
--- /dev/null
+++ b/acceptance/bundle/quiet-levels/databricks.yml.tmpl
@@ -0,0 +1,10 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+# An experiment needs no local files and has no sub-resources, so this bundle has
+# nothing to build, no language runtime leaving artifacts behind, and one plan node
+# on both engines. That keeps the counts below identical across engines and runs.
+resources:
+  experiments:
+    my_experiment:
+      name: /Users/${CURRENT_USER_NAME}/test-experiment-${UNIQUE_NAME}
diff --git a/acceptance/bundle/quiet-levels/out.test.toml b/acceptance/bundle/quiet-levels/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/quiet-levels/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/quiet-levels/output.txt b/acceptance/bundle/quiet-levels/output.txt
new file mode 100644
index 00000000000..605cbccfbd8
--- /dev/null
+++ b/acceptance/bundle/quiet-levels/output.txt
@@ -0,0 +1,58 @@
+
+=== plan: actions and summary
+>>> [CLI] bundle plan
+create experiments.my_experiment
+
+Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
+
+=== plan -q: summary only
+>>> [CLI] bundle plan -q
+Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
+
+=== plan -qq: nothing
+>>> [CLI] bundle plan -qq
+
+=== deploy: per-resource lines, progress and summary
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Created experiments.my_experiment
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] bundle destroy --auto-approve -qq
+
+=== deploy -q: summary only, no per-resource lines
+>>> [CLI] bundle deploy -q
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] bundle destroy --auto-approve -qq
+
+=== deploy -qq: nothing
+>>> [CLI] bundle deploy -qq
+
+=== destroy: approval list and summary
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.experiments.my_experiment
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
+
+=== destroy -q: same as default, there are no per-resource lines to drop
+>>> [CLI] bundle deploy -qq
+
+>>> [CLI] bundle destroy --auto-approve -q
+The following resources will be deleted:
+  delete resources.experiments.my_experiment
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
+
+=== destroy --auto-approve -qq: nothing
+>>> [CLI] bundle deploy -qq
+
+>>> [CLI] bundle destroy --auto-approve -qq
diff --git a/acceptance/bundle/quiet-levels/script b/acceptance/bundle/quiet-levels/script
new file mode 100644
index 00000000000..cfe42aaab5e
--- /dev/null
+++ b/acceptance/bundle/quiet-levels/script
@@ -0,0 +1,45 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    $CLI bundle destroy --auto-approve -qq
+}
+trap cleanup EXIT
+
+# Each level starts from the same state -- nothing deployed -- so the three outputs
+# differ only by the flag. Destroying in between costs a little time but makes the
+# comparison meaningful: otherwise the second deploy has nothing to create and the
+# third nothing to change, and the counts differ for that reason instead.
+
+title "plan: actions and summary"
+trace $CLI bundle plan
+
+title "plan -q: summary only"
+trace $CLI bundle plan -q
+
+title "plan -qq: nothing"
+trace $CLI bundle plan -qq
+
+title "deploy: per-resource lines, progress and summary"
+trace $CLI bundle deploy
+trace $CLI bundle destroy --auto-approve -qq
+
+title "deploy -q: summary only, no per-resource lines"
+trace $CLI bundle deploy -q
+trace $CLI bundle destroy --auto-approve -qq
+
+title "deploy -qq: nothing"
+trace $CLI bundle deploy -qq
+
+title "destroy: approval list and summary"
+trace $CLI bundle destroy --auto-approve
+
+title "destroy -q: same as default, there are no per-resource lines to drop"
+trace $CLI bundle deploy -qq
+trace $CLI bundle destroy --auto-approve -q
+
+# Only suppressed because --auto-approve makes the listing informational. Without it the
+# CLI is about to ask for consent and the listing prints at any -q level; that path needs
+# a TTY, so TestApprovalForDestroyQuietWhilePrompting covers it.
+title "destroy --auto-approve -qq: nothing"
+trace $CLI bundle deploy -qq
+trace $CLI bundle destroy --auto-approve -qq
diff --git a/acceptance/bundle/quiet-levels/test.toml b/acceptance/bundle/quiet-levels/test.toml
new file mode 100644
index 00000000000..c7c6f58ed6e
--- /dev/null
+++ b/acceptance/bundle/quiet-levels/test.toml
@@ -0,0 +1 @@
+Cloud = true
diff --git a/acceptance/bundle/refschema/out.fields.txt b/acceptance/bundle/refschema/out.fields.txt
index c79b0d3533c..8663853ceb1 100644
--- a/acceptance/bundle/refschema/out.fields.txt
+++ b/acceptance/bundle/refschema/out.fields.txt
@@ -1,6 +1,7 @@
 resources.alerts.*.create_time	string	ALL
 resources.alerts.*.custom_description	string	ALL
 resources.alerts.*.custom_summary	string	ALL
+resources.alerts.*.custom_template_format	sql.CustomTemplateFormat	ALL
 resources.alerts.*.display_name	string	ALL
 resources.alerts.*.effective_run_as	*sql.AlertV2RunAs	ALL
 resources.alerts.*.effective_run_as.service_principal_name	string	ALL
@@ -37,6 +38,11 @@ resources.alerts.*.lifecycle.prevent_destroy	bool	INPUT
 resources.alerts.*.lifecycle_state	sql.AlertLifecycleState	ALL
 resources.alerts.*.modified_status	string	INPUT
 resources.alerts.*.owner_user_name	string	ALL
+resources.alerts.*.parameters	[]sql.AlertStatementParameter	ALL
+resources.alerts.*.parameters[*]	sql.AlertStatementParameter	ALL
+resources.alerts.*.parameters[*].name	string	ALL
+resources.alerts.*.parameters[*].type	string	ALL
+resources.alerts.*.parameters[*].value	string	ALL
 resources.alerts.*.parent_path	string	ALL
 resources.alerts.*.query_text	string	ALL
 resources.alerts.*.run_as	*sql.AlertV2RunAs	ALL
@@ -73,11 +79,16 @@ resources.apps.*.active_deployment.git_source	*apps.GitSource	ALL
 resources.apps.*.active_deployment.git_source.branch	string	ALL
 resources.apps.*.active_deployment.git_source.commit	string	ALL
 resources.apps.*.active_deployment.git_source.git_repository	*apps.GitRepository	ALL
+resources.apps.*.active_deployment.git_source.git_repository.auto_deploy	bool	ALL
+resources.apps.*.active_deployment.git_source.git_repository.caller_credential_id	int64	ALL
 resources.apps.*.active_deployment.git_source.git_repository.provider	string	ALL
 resources.apps.*.active_deployment.git_source.git_repository.url	string	ALL
 resources.apps.*.active_deployment.git_source.resolved_commit	string	ALL
 resources.apps.*.active_deployment.git_source.source_code_path	string	ALL
 resources.apps.*.active_deployment.git_source.tag	string	ALL
+resources.apps.*.active_deployment.health_check	*apps.AppHealthCheck	ALL
+resources.apps.*.active_deployment.health_check.path	string	ALL
+resources.apps.*.active_deployment.health_check.timeout	*duration.Duration	ALL
 resources.apps.*.active_deployment.mode	apps.AppDeploymentMode	ALL
 resources.apps.*.active_deployment.source_code_path	string	ALL
 resources.apps.*.active_deployment.status	*apps.AppDeploymentStatus	ALL
@@ -86,8 +97,11 @@ resources.apps.*.active_deployment.status.state	apps.AppDeploymentState	ALL
 resources.apps.*.active_deployment.update_time	string	ALL
 resources.apps.*.app_status	*apps.ApplicationStatus	ALL
 resources.apps.*.app_status.message	string	ALL
+resources.apps.*.app_status.running_instances	int	ALL
 resources.apps.*.app_status.state	apps.ApplicationState	ALL
 resources.apps.*.budget_policy_id	string	ALL
+resources.apps.*.compute_max_instances	int	ALL
+resources.apps.*.compute_min_instances	int	ALL
 resources.apps.*.compute_size	apps.ComputeSize	ALL
 resources.apps.*.compute_status	*apps.ComputeStatus	ALL
 resources.apps.*.compute_status.active_instances	int	ALL
@@ -103,26 +117,42 @@ resources.apps.*.config.env[*].value	string	ALL
 resources.apps.*.config.env[*].value_from	string	ALL
 resources.apps.*.create_time	string	ALL
 resources.apps.*.creator	string	ALL
+resources.apps.*.default_git_source	*apps.GitSource	ALL
+resources.apps.*.default_git_source.branch	string	ALL
+resources.apps.*.default_git_source.commit	string	ALL
+resources.apps.*.default_git_source.git_repository	*apps.GitRepository	ALL
+resources.apps.*.default_git_source.git_repository.auto_deploy	bool	ALL
+resources.apps.*.default_git_source.git_repository.caller_credential_id	int64	ALL
+resources.apps.*.default_git_source.git_repository.provider	string	ALL
+resources.apps.*.default_git_source.git_repository.url	string	ALL
+resources.apps.*.default_git_source.resolved_commit	string	ALL
+resources.apps.*.default_git_source.source_code_path	string	ALL
+resources.apps.*.default_git_source.tag	string	ALL
 resources.apps.*.default_source_code_path	string	ALL
 resources.apps.*.description	string	ALL
 resources.apps.*.effective_budget_policy_id	string	ALL
 resources.apps.*.effective_usage_policy_id	string	ALL
 resources.apps.*.effective_user_api_scopes	[]string	ALL
 resources.apps.*.effective_user_api_scopes[*]	string	ALL
+resources.apps.*.forward_user_access_token	bool	ALL
 resources.apps.*.git_repository	*apps.GitRepository	ALL
+resources.apps.*.git_repository.auto_deploy	bool	ALL
+resources.apps.*.git_repository.caller_credential_id	int64	ALL
 resources.apps.*.git_repository.provider	string	ALL
 resources.apps.*.git_repository.url	string	ALL
 resources.apps.*.git_source	*apps.GitSource	ALL
 resources.apps.*.git_source.branch	string	ALL
 resources.apps.*.git_source.commit	string	ALL
 resources.apps.*.git_source.git_repository	*apps.GitRepository	ALL
+resources.apps.*.git_source.git_repository.auto_deploy	bool	ALL
+resources.apps.*.git_source.git_repository.caller_credential_id	int64	ALL
 resources.apps.*.git_source.git_repository.provider	string	ALL
 resources.apps.*.git_source.git_repository.url	string	ALL
 resources.apps.*.git_source.resolved_commit	string	ALL
 resources.apps.*.git_source.source_code_path	string	ALL
 resources.apps.*.git_source.tag	string	ALL
 resources.apps.*.id	string	ALL
-resources.apps.*.lifecycle	*dresources.AppStateLifecycle	REMOTE	STATE
+resources.apps.*.lifecycle	*dresources.StateLifecycle	REMOTE	STATE
 resources.apps.*.lifecycle	*resources.LifecycleWithStarted	INPUT
 resources.apps.*.lifecycle	resources.Lifecycle	INPUT
 resources.apps.*.lifecycle.prevent_destroy	bool	INPUT
@@ -148,11 +178,16 @@ resources.apps.*.pending_deployment.git_source	*apps.GitSource	ALL
 resources.apps.*.pending_deployment.git_source.branch	string	ALL
 resources.apps.*.pending_deployment.git_source.commit	string	ALL
 resources.apps.*.pending_deployment.git_source.git_repository	*apps.GitRepository	ALL
+resources.apps.*.pending_deployment.git_source.git_repository.auto_deploy	bool	ALL
+resources.apps.*.pending_deployment.git_source.git_repository.caller_credential_id	int64	ALL
 resources.apps.*.pending_deployment.git_source.git_repository.provider	string	ALL
 resources.apps.*.pending_deployment.git_source.git_repository.url	string	ALL
 resources.apps.*.pending_deployment.git_source.resolved_commit	string	ALL
 resources.apps.*.pending_deployment.git_source.source_code_path	string	ALL
 resources.apps.*.pending_deployment.git_source.tag	string	ALL
+resources.apps.*.pending_deployment.health_check	*apps.AppHealthCheck	ALL
+resources.apps.*.pending_deployment.health_check.path	string	ALL
+resources.apps.*.pending_deployment.health_check.timeout	*duration.Duration	ALL
 resources.apps.*.pending_deployment.mode	apps.AppDeploymentMode	ALL
 resources.apps.*.pending_deployment.source_code_path	string	ALL
 resources.apps.*.pending_deployment.status	*apps.AppDeploymentStatus	ALL
@@ -210,6 +245,7 @@ resources.apps.*.telemetry_export_destinations[*].unity_catalog	*apps.UnityCatal
 resources.apps.*.telemetry_export_destinations[*].unity_catalog.logs_table	string	ALL
 resources.apps.*.telemetry_export_destinations[*].unity_catalog.metrics_table	string	ALL
 resources.apps.*.telemetry_export_destinations[*].unity_catalog.traces_table	string	ALL
+resources.apps.*.thumbnail_url	string	ALL
 resources.apps.*.update_time	string	ALL
 resources.apps.*.updater	string	ALL
 resources.apps.*.url	string	ALL
@@ -228,6 +264,7 @@ resources.catalogs.*.comment	string	ALL
 resources.catalogs.*.connection_name	string	ALL
 resources.catalogs.*.created_at	int64	REMOTE
 resources.catalogs.*.created_by	string	REMOTE
+resources.catalogs.*.custom_max_retention_hours	int64	ALL
 resources.catalogs.*.effective_predictive_optimization_flag	*catalog.EffectivePredictiveOptimizationFlag	REMOTE
 resources.catalogs.*.effective_predictive_optimization_flag.inherited_from_name	string	REMOTE
 resources.catalogs.*.effective_predictive_optimization_flag.inherited_from_type	catalog.EffectivePredictiveOptimizationFlagInheritedFromType	REMOTE
@@ -269,7 +306,47 @@ resources.catalogs.*.grants[*]	catalog.PrivilegeAssignment	ALL
 resources.catalogs.*.grants[*].principal	string	ALL
 resources.catalogs.*.grants[*].privileges	[]catalog.Privilege	ALL
 resources.catalogs.*.grants[*].privileges[*]	catalog.Privilege	ALL
-resources.clusters.*.apply_policy_default_values	bool	INPUT	STATE
+resources.cluster_policies.*.created_at_timestamp	int64	REMOTE
+resources.cluster_policies.*.creator_user_name	string	REMOTE
+resources.cluster_policies.*.definition	any	INPUT
+resources.cluster_policies.*.definition	string	ALL
+resources.cluster_policies.*.description	string	ALL
+resources.cluster_policies.*.id	string	INPUT
+resources.cluster_policies.*.is_default	bool	REMOTE
+resources.cluster_policies.*.libraries	[]compute.Library	ALL
+resources.cluster_policies.*.libraries[*]	compute.Library	ALL
+resources.cluster_policies.*.libraries[*].cran	*compute.RCranLibrary	ALL
+resources.cluster_policies.*.libraries[*].cran.package	string	ALL
+resources.cluster_policies.*.libraries[*].cran.repo	string	ALL
+resources.cluster_policies.*.libraries[*].egg	string	ALL
+resources.cluster_policies.*.libraries[*].jar	string	ALL
+resources.cluster_policies.*.libraries[*].maven	*compute.MavenLibrary	ALL
+resources.cluster_policies.*.libraries[*].maven.coordinates	string	ALL
+resources.cluster_policies.*.libraries[*].maven.exclusions	[]string	ALL
+resources.cluster_policies.*.libraries[*].maven.exclusions[*]	string	ALL
+resources.cluster_policies.*.libraries[*].maven.repo	string	ALL
+resources.cluster_policies.*.libraries[*].pypi	*compute.PythonPyPiLibrary	ALL
+resources.cluster_policies.*.libraries[*].pypi.package	string	ALL
+resources.cluster_policies.*.libraries[*].pypi.repo	string	ALL
+resources.cluster_policies.*.libraries[*].requirements	string	ALL
+resources.cluster_policies.*.libraries[*].whl	string	ALL
+resources.cluster_policies.*.lifecycle	resources.Lifecycle	INPUT
+resources.cluster_policies.*.lifecycle.prevent_destroy	bool	INPUT
+resources.cluster_policies.*.max_clusters_per_user	int64	ALL
+resources.cluster_policies.*.modified_status	string	INPUT
+resources.cluster_policies.*.name	string	ALL
+resources.cluster_policies.*.policy_family_definition_overrides	any	INPUT
+resources.cluster_policies.*.policy_family_definition_overrides	string	ALL
+resources.cluster_policies.*.policy_family_id	string	ALL
+resources.cluster_policies.*.policy_id	string	REMOTE
+resources.cluster_policies.*.url	string	INPUT
+resources.cluster_policies.*.permissions.object_id	string	ALL
+resources.cluster_policies.*.permissions[*]	dresources.StatePermission	ALL
+resources.cluster_policies.*.permissions[*].group_name	string	ALL
+resources.cluster_policies.*.permissions[*].level	iam.PermissionLevel	ALL
+resources.cluster_policies.*.permissions[*].service_principal_name	string	ALL
+resources.cluster_policies.*.permissions[*].user_name	string	ALL
+resources.clusters.*.apply_policy_default_values	bool	ALL
 resources.clusters.*.autoscale	*compute.AutoScale	ALL
 resources.clusters.*.autoscale.max_workers	int	ALL
 resources.clusters.*.autoscale.min_workers	int	ALL
@@ -287,6 +364,7 @@ resources.clusters.*.aws_attributes.spot_bid_price_percent	int	ALL
 resources.clusters.*.aws_attributes.zone_id	string	ALL
 resources.clusters.*.azure_attributes	*compute.AzureAttributes	ALL
 resources.clusters.*.azure_attributes.availability	compute.AzureAvailability	ALL
+resources.clusters.*.azure_attributes.capacity_reservation_group	string	ALL
 resources.clusters.*.azure_attributes.first_on_demand	int	ALL
 resources.clusters.*.azure_attributes.log_analytics_info	*compute.LogAnalyticsInfo	ALL
 resources.clusters.*.azure_attributes.log_analytics_info.log_analytics_primary_key	string	ALL
@@ -319,6 +397,7 @@ resources.clusters.*.custom_tags.*	string	ALL
 resources.clusters.*.data_security_mode	compute.DataSecurityMode	ALL
 resources.clusters.*.default_tags	map[string]string	REMOTE
 resources.clusters.*.default_tags.*	string	REMOTE
+resources.clusters.*.dependency_mode	compute.DependencyMode	ALL
 resources.clusters.*.docker_image	*compute.DockerImage	ALL
 resources.clusters.*.docker_image.basic_auth	*compute.DockerBasicAuth	ALL
 resources.clusters.*.docker_image.basic_auth.password	string	ALL
@@ -337,6 +416,7 @@ resources.clusters.*.driver_instance_pool_id	string	ALL
 resources.clusters.*.driver_node_type_flexibility	*compute.NodeTypeFlexibility	ALL
 resources.clusters.*.driver_node_type_flexibility.alternate_node_type_ids	[]string	ALL
 resources.clusters.*.driver_node_type_flexibility.alternate_node_type_ids[*]	string	ALL
+resources.clusters.*.driver_node_type_flexibility.aws_context_id	string	ALL
 resources.clusters.*.driver_node_type_id	string	ALL
 resources.clusters.*.enable_elastic_disk	bool	ALL
 resources.clusters.*.enable_local_disk_encryption	bool	ALL
@@ -353,6 +433,7 @@ resources.clusters.*.executors[*].start_timestamp	int64	REMOTE
 resources.clusters.*.gcp_attributes	*compute.GcpAttributes	ALL
 resources.clusters.*.gcp_attributes.availability	compute.GcpAvailability	ALL
 resources.clusters.*.gcp_attributes.boot_disk_size	int	ALL
+resources.clusters.*.gcp_attributes.confidential_compute_type	compute.ConfidentialComputeType	ALL
 resources.clusters.*.gcp_attributes.first_on_demand	int	ALL
 resources.clusters.*.gcp_attributes.google_service_account	string	ALL
 resources.clusters.*.gcp_attributes.local_ssd_count	int	ALL
@@ -387,8 +468,28 @@ resources.clusters.*.jdbc_port	int	REMOTE
 resources.clusters.*.kind	compute.Kind	ALL
 resources.clusters.*.last_restarted_time	int64	REMOTE
 resources.clusters.*.last_state_loss_time	int64	REMOTE
+resources.clusters.*.libraries	[]compute.Library	ALL
+resources.clusters.*.libraries[*]	compute.Library	ALL
+resources.clusters.*.libraries[*].cran	*compute.RCranLibrary	ALL
+resources.clusters.*.libraries[*].cran.package	string	ALL
+resources.clusters.*.libraries[*].cran.repo	string	ALL
+resources.clusters.*.libraries[*].egg	string	ALL
+resources.clusters.*.libraries[*].jar	string	ALL
+resources.clusters.*.libraries[*].maven	*compute.MavenLibrary	ALL
+resources.clusters.*.libraries[*].maven.coordinates	string	ALL
+resources.clusters.*.libraries[*].maven.exclusions	[]string	ALL
+resources.clusters.*.libraries[*].maven.exclusions[*]	string	ALL
+resources.clusters.*.libraries[*].maven.repo	string	ALL
+resources.clusters.*.libraries[*].pypi	*compute.PythonPyPiLibrary	ALL
+resources.clusters.*.libraries[*].pypi.package	string	ALL
+resources.clusters.*.libraries[*].pypi.repo	string	ALL
+resources.clusters.*.libraries[*].requirements	string	ALL
+resources.clusters.*.libraries[*].whl	string	ALL
+resources.clusters.*.lifecycle	*dresources.StateLifecycle	REMOTE	STATE
+resources.clusters.*.lifecycle	*resources.LifecycleWithStarted	INPUT
 resources.clusters.*.lifecycle	resources.Lifecycle	INPUT
 resources.clusters.*.lifecycle.prevent_destroy	bool	INPUT
+resources.clusters.*.lifecycle.started	*bool	ALL
 resources.clusters.*.modified_status	string	INPUT
 resources.clusters.*.node_type_id	string	ALL
 resources.clusters.*.num_workers	int	ALL
@@ -421,6 +522,7 @@ resources.clusters.*.spec.aws_attributes.spot_bid_price_percent	int	REMOTE
 resources.clusters.*.spec.aws_attributes.zone_id	string	REMOTE
 resources.clusters.*.spec.azure_attributes	*compute.AzureAttributes	REMOTE
 resources.clusters.*.spec.azure_attributes.availability	compute.AzureAvailability	REMOTE
+resources.clusters.*.spec.azure_attributes.capacity_reservation_group	string	REMOTE
 resources.clusters.*.spec.azure_attributes.first_on_demand	int	REMOTE
 resources.clusters.*.spec.azure_attributes.log_analytics_info	*compute.LogAnalyticsInfo	REMOTE
 resources.clusters.*.spec.azure_attributes.log_analytics_info.log_analytics_primary_key	string	REMOTE
@@ -443,6 +545,7 @@ resources.clusters.*.spec.cluster_name	string	REMOTE
 resources.clusters.*.spec.custom_tags	map[string]string	REMOTE
 resources.clusters.*.spec.custom_tags.*	string	REMOTE
 resources.clusters.*.spec.data_security_mode	compute.DataSecurityMode	REMOTE
+resources.clusters.*.spec.dependency_mode	compute.DependencyMode	REMOTE
 resources.clusters.*.spec.docker_image	*compute.DockerImage	REMOTE
 resources.clusters.*.spec.docker_image.basic_auth	*compute.DockerBasicAuth	REMOTE
 resources.clusters.*.spec.docker_image.basic_auth.password	string	REMOTE
@@ -452,12 +555,14 @@ resources.clusters.*.spec.driver_instance_pool_id	string	REMOTE
 resources.clusters.*.spec.driver_node_type_flexibility	*compute.NodeTypeFlexibility	REMOTE
 resources.clusters.*.spec.driver_node_type_flexibility.alternate_node_type_ids	[]string	REMOTE
 resources.clusters.*.spec.driver_node_type_flexibility.alternate_node_type_ids[*]	string	REMOTE
+resources.clusters.*.spec.driver_node_type_flexibility.aws_context_id	string	REMOTE
 resources.clusters.*.spec.driver_node_type_id	string	REMOTE
 resources.clusters.*.spec.enable_elastic_disk	bool	REMOTE
 resources.clusters.*.spec.enable_local_disk_encryption	bool	REMOTE
 resources.clusters.*.spec.gcp_attributes	*compute.GcpAttributes	REMOTE
 resources.clusters.*.spec.gcp_attributes.availability	compute.GcpAvailability	REMOTE
 resources.clusters.*.spec.gcp_attributes.boot_disk_size	int	REMOTE
+resources.clusters.*.spec.gcp_attributes.confidential_compute_type	compute.ConfidentialComputeType	REMOTE
 resources.clusters.*.spec.gcp_attributes.first_on_demand	int	REMOTE
 resources.clusters.*.spec.gcp_attributes.google_service_account	string	REMOTE
 resources.clusters.*.spec.gcp_attributes.local_ssd_count	int	REMOTE
@@ -506,6 +611,7 @@ resources.clusters.*.spec.use_ml_runtime	bool	REMOTE
 resources.clusters.*.spec.worker_node_type_flexibility	*compute.NodeTypeFlexibility	REMOTE
 resources.clusters.*.spec.worker_node_type_flexibility.alternate_node_type_ids	[]string	REMOTE
 resources.clusters.*.spec.worker_node_type_flexibility.alternate_node_type_ids[*]	string	REMOTE
+resources.clusters.*.spec.worker_node_type_flexibility.aws_context_id	string	REMOTE
 resources.clusters.*.spec.workload_type	*compute.WorkloadType	REMOTE
 resources.clusters.*.spec.workload_type.clients	compute.ClientsTypes	REMOTE
 resources.clusters.*.spec.workload_type.clients.jobs	bool	REMOTE
@@ -527,6 +633,7 @@ resources.clusters.*.use_ml_runtime	bool	ALL
 resources.clusters.*.worker_node_type_flexibility	*compute.NodeTypeFlexibility	ALL
 resources.clusters.*.worker_node_type_flexibility.alternate_node_type_ids	[]string	ALL
 resources.clusters.*.worker_node_type_flexibility.alternate_node_type_ids[*]	string	ALL
+resources.clusters.*.worker_node_type_flexibility.aws_context_id	string	ALL
 resources.clusters.*.workload_type	*compute.WorkloadType	ALL
 resources.clusters.*.workload_type.clients	compute.ClientsTypes	ALL
 resources.clusters.*.workload_type.clients.jobs	bool	ALL
@@ -641,6 +748,12 @@ resources.experiments.*.tags	[]ml.ExperimentTag	ALL
 resources.experiments.*.tags[*]	ml.ExperimentTag	ALL
 resources.experiments.*.tags[*].key	string	ALL
 resources.experiments.*.tags[*].value	string	ALL
+resources.experiments.*.trace_location	*ml.ExperimentTraceLocation	ALL
+resources.experiments.*.trace_location.uc_trace_location	*ml.UcTraceLocation	ALL
+resources.experiments.*.trace_location.uc_trace_location.catalog	string	ALL
+resources.experiments.*.trace_location.uc_trace_location.effective_table_prefix	string	ALL
+resources.experiments.*.trace_location.uc_trace_location.schema	string	ALL
+resources.experiments.*.trace_location.uc_trace_location.table_prefix	string	ALL
 resources.experiments.*.url	string	INPUT
 resources.experiments.*.permissions.object_id	string	ALL
 resources.experiments.*.permissions[*]	dresources.StatePermission	ALL
@@ -726,16 +839,337 @@ resources.external_locations.*.grants[*]	catalog.PrivilegeAssignment	ALL
 resources.external_locations.*.grants[*].principal	string	ALL
 resources.external_locations.*.grants[*].privileges	[]catalog.Privilege	ALL
 resources.external_locations.*.grants[*].privileges[*]	catalog.Privilege	ALL
+resources.features.*.catalog_name	string	ALL
+resources.features.*.created_at	*time.Time	ALL
+resources.features.*.created_by	string	ALL
+resources.features.*.description	string	ALL
+resources.features.*.entities	[]ml.EntityColumn	ALL
+resources.features.*.entities[*]	ml.EntityColumn	ALL
+resources.features.*.entities[*].name	string	ALL
+resources.features.*.filter_condition	string	ALL
+resources.features.*.full_name	string	ALL
+resources.features.*.function	ml.Function	ALL
+resources.features.*.function.aggregation_function	*ml.AggregationFunction	ALL
+resources.features.*.function.aggregation_function.approx_count_distinct	*ml.ApproxCountDistinctFunction	ALL
+resources.features.*.function.aggregation_function.approx_count_distinct.input	string	ALL
+resources.features.*.function.aggregation_function.approx_count_distinct.relative_sd	float64	ALL
+resources.features.*.function.aggregation_function.approx_percentile	*ml.ApproxPercentileFunction	ALL
+resources.features.*.function.aggregation_function.approx_percentile.accuracy	int64	ALL
+resources.features.*.function.aggregation_function.approx_percentile.input	string	ALL
+resources.features.*.function.aggregation_function.approx_percentile.percentile	float64	ALL
+resources.features.*.function.aggregation_function.avg	*ml.AvgFunction	ALL
+resources.features.*.function.aggregation_function.avg.input	string	ALL
+resources.features.*.function.aggregation_function.count_function	*ml.CountFunction	ALL
+resources.features.*.function.aggregation_function.count_function.input	string	ALL
+resources.features.*.function.aggregation_function.first	*ml.FirstFunction	ALL
+resources.features.*.function.aggregation_function.first.input	string	ALL
+resources.features.*.function.aggregation_function.first_distinct	*ml.FirstDistinctFunction	ALL
+resources.features.*.function.aggregation_function.first_distinct.input	string	ALL
+resources.features.*.function.aggregation_function.first_distinct.n	int64	ALL
+resources.features.*.function.aggregation_function.first_n	*ml.FirstNFunction	ALL
+resources.features.*.function.aggregation_function.first_n.input	string	ALL
+resources.features.*.function.aggregation_function.first_n.n	int64	ALL
+resources.features.*.function.aggregation_function.last	*ml.LastFunction	ALL
+resources.features.*.function.aggregation_function.last.input	string	ALL
+resources.features.*.function.aggregation_function.last_distinct	*ml.LastDistinctFunction	ALL
+resources.features.*.function.aggregation_function.last_distinct.input	string	ALL
+resources.features.*.function.aggregation_function.last_distinct.n	int64	ALL
+resources.features.*.function.aggregation_function.last_n	*ml.LastNFunction	ALL
+resources.features.*.function.aggregation_function.last_n.input	string	ALL
+resources.features.*.function.aggregation_function.last_n.n	int64	ALL
+resources.features.*.function.aggregation_function.max	*ml.MaxFunction	ALL
+resources.features.*.function.aggregation_function.max.input	string	ALL
+resources.features.*.function.aggregation_function.min	*ml.MinFunction	ALL
+resources.features.*.function.aggregation_function.min.input	string	ALL
+resources.features.*.function.aggregation_function.stddev_pop	*ml.StddevPopFunction	ALL
+resources.features.*.function.aggregation_function.stddev_pop.input	string	ALL
+resources.features.*.function.aggregation_function.stddev_samp	*ml.StddevSampFunction	ALL
+resources.features.*.function.aggregation_function.stddev_samp.input	string	ALL
+resources.features.*.function.aggregation_function.sum	*ml.SumFunction	ALL
+resources.features.*.function.aggregation_function.sum.input	string	ALL
+resources.features.*.function.aggregation_function.time_window	*ml.TimeWindow	ALL
+resources.features.*.function.aggregation_function.time_window.continuous	*ml.ContinuousWindow	ALL
+resources.features.*.function.aggregation_function.time_window.continuous.offset	string	ALL
+resources.features.*.function.aggregation_function.time_window.continuous.window_duration	string	ALL
+resources.features.*.function.aggregation_function.time_window.rolling	*ml.RollingWindow	ALL
+resources.features.*.function.aggregation_function.time_window.rolling.delay	*duration.Duration	ALL
+resources.features.*.function.aggregation_function.time_window.rolling.window_duration	*duration.Duration	ALL
+resources.features.*.function.aggregation_function.time_window.sawtooth	*ml.SawtoothWindow	ALL
+resources.features.*.function.aggregation_function.time_window.sawtooth.delay	*duration.Duration	ALL
+resources.features.*.function.aggregation_function.time_window.sawtooth.window_duration	*duration.Duration	ALL
+resources.features.*.function.aggregation_function.time_window.sliding	*ml.SlidingWindow	ALL
+resources.features.*.function.aggregation_function.time_window.sliding.delay	*duration.Duration	ALL
+resources.features.*.function.aggregation_function.time_window.sliding.offset	*duration.Duration	ALL
+resources.features.*.function.aggregation_function.time_window.sliding.slide_duration	string	ALL
+resources.features.*.function.aggregation_function.time_window.sliding.window_duration	string	ALL
+resources.features.*.function.aggregation_function.time_window.start_time	*time.Time	ALL
+resources.features.*.function.aggregation_function.time_window.tumbling	*ml.TumblingWindow	ALL
+resources.features.*.function.aggregation_function.time_window.tumbling.delay	*duration.Duration	ALL
+resources.features.*.function.aggregation_function.time_window.tumbling.offset	*duration.Duration	ALL
+resources.features.*.function.aggregation_function.time_window.tumbling.window_duration	string	ALL
+resources.features.*.function.aggregation_function.var_pop	*ml.VarPopFunction	ALL
+resources.features.*.function.aggregation_function.var_pop.input	string	ALL
+resources.features.*.function.aggregation_function.var_samp	*ml.VarSampFunction	ALL
+resources.features.*.function.aggregation_function.var_samp.input	string	ALL
+resources.features.*.function.column_selection	*ml.ColumnSelection	ALL
+resources.features.*.function.column_selection.column	string	ALL
+resources.features.*.function.custom_udf	*ml.CustomUdf	ALL
+resources.features.*.function.custom_udf.function_path	string	ALL
+resources.features.*.function.custom_udf.input_bindings	[]ml.InputBinding	ALL
+resources.features.*.function.custom_udf.input_bindings[*]	ml.InputBinding	ALL
+resources.features.*.function.custom_udf.input_bindings[*].column	string	ALL
+resources.features.*.function.custom_udf.input_bindings[*].parameter	string	ALL
+resources.features.*.function.extra_parameters	[]ml.FunctionExtraParameter	ALL
+resources.features.*.function.extra_parameters[*]	ml.FunctionExtraParameter	ALL
+resources.features.*.function.extra_parameters[*].key	string	ALL
+resources.features.*.function.extra_parameters[*].value	string	ALL
+resources.features.*.function.function_type	ml.FunctionFunctionType	ALL
+resources.features.*.id	string	INPUT
+resources.features.*.inputs	[]string	ALL
+resources.features.*.inputs[*]	string	ALL
+resources.features.*.lifecycle	resources.Lifecycle	INPUT
+resources.features.*.lifecycle.prevent_destroy	bool	INPUT
+resources.features.*.lineage_context	*ml.LineageContext	ALL
+resources.features.*.lineage_context.job_context	*ml.JobContext	ALL
+resources.features.*.lineage_context.job_context.job_id	int64	ALL
+resources.features.*.lineage_context.job_context.job_run_id	int64	ALL
+resources.features.*.lineage_context.notebook_id	int64	ALL
+resources.features.*.modified_status	string	INPUT
+resources.features.*.name	string	ALL
+resources.features.*.schema_name	string	ALL
+resources.features.*.source	ml.DataSource	ALL
+resources.features.*.source.delta_table_source	*ml.DeltaTableSource	ALL
+resources.features.*.source.delta_table_source.dataframe_schema	string	ALL
+resources.features.*.source.delta_table_source.entity_columns	[]string	ALL
+resources.features.*.source.delta_table_source.entity_columns[*]	string	ALL
+resources.features.*.source.delta_table_source.filter_condition	string	ALL
+resources.features.*.source.delta_table_source.full_name	string	ALL
+resources.features.*.source.delta_table_source.timeseries_column	string	ALL
+resources.features.*.source.delta_table_source.transformation_sql	string	ALL
+resources.features.*.source.feature_view_source	*ml.FeatureViewSource	ALL
+resources.features.*.source.feature_view_source.feature_references	[]ml.FeatureReference	ALL
+resources.features.*.source.feature_view_source.feature_references[*]	ml.FeatureReference	ALL
+resources.features.*.source.feature_view_source.feature_references[*].feature	string	ALL
+resources.features.*.source.kafka_source	*ml.KafkaSource	ALL
+resources.features.*.source.kafka_source.entity_column_identifiers	[]ml.ColumnIdentifier	ALL
+resources.features.*.source.kafka_source.entity_column_identifiers[*]	ml.ColumnIdentifier	ALL
+resources.features.*.source.kafka_source.entity_column_identifiers[*].variant_expr_path	string	ALL
+resources.features.*.source.kafka_source.filter_condition	string	ALL
+resources.features.*.source.kafka_source.name	string	ALL
+resources.features.*.source.kafka_source.timeseries_column_identifier	*ml.ColumnIdentifier	ALL
+resources.features.*.source.kafka_source.timeseries_column_identifier.variant_expr_path	string	ALL
+resources.features.*.source.lateness	*ml.SourceLateness	ALL
+resources.features.*.source.lateness.settling_delay	*duration.Duration	ALL
+resources.features.*.source.request_source	*ml.RequestSource	ALL
+resources.features.*.source.request_source.dataframe_schema	string	ALL
+resources.features.*.source.request_source.flat_schema	*ml.FlatSchema	ALL
+resources.features.*.source.request_source.flat_schema.fields	[]ml.FieldDefinition	ALL
+resources.features.*.source.request_source.flat_schema.fields[*]	ml.FieldDefinition	ALL
+resources.features.*.source.request_source.flat_schema.fields[*].data_type	ml.ScalarDataType	ALL
+resources.features.*.source.request_source.flat_schema.fields[*].name	string	ALL
+resources.features.*.source.stream_source	*ml.StreamSource	ALL
+resources.features.*.source.stream_source.dataframe_schema	string	ALL
+resources.features.*.source.stream_source.filter_condition	string	ALL
+resources.features.*.source.stream_source.full_name	string	ALL
+resources.features.*.source.stream_source.transformation_sql	string	ALL
+resources.features.*.time_window	*ml.TimeWindow	ALL
+resources.features.*.time_window.continuous	*ml.ContinuousWindow	ALL
+resources.features.*.time_window.continuous.offset	string	ALL
+resources.features.*.time_window.continuous.window_duration	string	ALL
+resources.features.*.time_window.rolling	*ml.RollingWindow	ALL
+resources.features.*.time_window.rolling.delay	*duration.Duration	ALL
+resources.features.*.time_window.rolling.window_duration	*duration.Duration	ALL
+resources.features.*.time_window.sawtooth	*ml.SawtoothWindow	ALL
+resources.features.*.time_window.sawtooth.delay	*duration.Duration	ALL
+resources.features.*.time_window.sawtooth.window_duration	*duration.Duration	ALL
+resources.features.*.time_window.sliding	*ml.SlidingWindow	ALL
+resources.features.*.time_window.sliding.delay	*duration.Duration	ALL
+resources.features.*.time_window.sliding.offset	*duration.Duration	ALL
+resources.features.*.time_window.sliding.slide_duration	string	ALL
+resources.features.*.time_window.sliding.window_duration	string	ALL
+resources.features.*.time_window.start_time	*time.Time	ALL
+resources.features.*.time_window.tumbling	*ml.TumblingWindow	ALL
+resources.features.*.time_window.tumbling.delay	*duration.Duration	ALL
+resources.features.*.time_window.tumbling.offset	*duration.Duration	ALL
+resources.features.*.time_window.tumbling.window_duration	string	ALL
+resources.features.*.timeseries_column	*ml.TimeseriesColumn	ALL
+resources.features.*.timeseries_column.name	string	ALL
+resources.features.*.url	string	INPUT
+resources.genie_spaces.*.description	string	ALL
+resources.genie_spaces.*.etag	string	ALL
+resources.genie_spaces.*.file_path	string	INPUT
+resources.genie_spaces.*.id	string	INPUT
+resources.genie_spaces.*.lifecycle	resources.Lifecycle	INPUT
+resources.genie_spaces.*.lifecycle.prevent_destroy	bool	INPUT
+resources.genie_spaces.*.modified_status	string	INPUT
+resources.genie_spaces.*.parent_path	string	ALL
+resources.genie_spaces.*.serialized_space	any	ALL
+resources.genie_spaces.*.title	string	ALL
+resources.genie_spaces.*.url	string	INPUT
+resources.genie_spaces.*.warehouse_id	string	ALL
+resources.genie_spaces.*.permissions.object_id	string	ALL
+resources.genie_spaces.*.permissions[*]	dresources.StatePermission	ALL
+resources.genie_spaces.*.permissions[*].group_name	string	ALL
+resources.genie_spaces.*.permissions[*].level	iam.PermissionLevel	ALL
+resources.genie_spaces.*.permissions[*].service_principal_name	string	ALL
+resources.genie_spaces.*.permissions[*].user_name	string	ALL
+resources.instance_pools.*.aws_attributes	*compute.InstancePoolAwsAttributes	ALL
+resources.instance_pools.*.aws_attributes.availability	compute.InstancePoolAwsAttributesAvailability	ALL
+resources.instance_pools.*.aws_attributes.instance_profile_arn	string	ALL
+resources.instance_pools.*.aws_attributes.spot_bid_price_percent	int	ALL
+resources.instance_pools.*.aws_attributes.zone_id	string	ALL
+resources.instance_pools.*.azure_attributes	*compute.InstancePoolAzureAttributes	ALL
+resources.instance_pools.*.azure_attributes.availability	compute.InstancePoolAzureAttributesAvailability	ALL
+resources.instance_pools.*.azure_attributes.capacity_reservation_group	string	ALL
+resources.instance_pools.*.azure_attributes.spot_bid_max_price	float64	ALL
+resources.instance_pools.*.custom_tags	map[string]string	ALL
+resources.instance_pools.*.custom_tags.*	string	ALL
+resources.instance_pools.*.default_tags	map[string]string	REMOTE
+resources.instance_pools.*.default_tags.*	string	REMOTE
+resources.instance_pools.*.disk_spec	*compute.DiskSpec	ALL
+resources.instance_pools.*.disk_spec.disk_count	int	ALL
+resources.instance_pools.*.disk_spec.disk_iops	int	ALL
+resources.instance_pools.*.disk_spec.disk_size	int	ALL
+resources.instance_pools.*.disk_spec.disk_throughput	int	ALL
+resources.instance_pools.*.disk_spec.disk_type	*compute.DiskType	ALL
+resources.instance_pools.*.disk_spec.disk_type.azure_disk_volume_type	compute.DiskTypeAzureDiskVolumeType	ALL
+resources.instance_pools.*.disk_spec.disk_type.ebs_volume_type	compute.DiskTypeEbsVolumeType	ALL
+resources.instance_pools.*.enable_elastic_disk	bool	ALL
+resources.instance_pools.*.gcp_attributes	*compute.InstancePoolGcpAttributes	ALL
+resources.instance_pools.*.gcp_attributes.gcp_availability	compute.GcpAvailability	ALL
+resources.instance_pools.*.gcp_attributes.local_ssd_count	int	ALL
+resources.instance_pools.*.gcp_attributes.zone_id	string	ALL
+resources.instance_pools.*.id	string	INPUT
+resources.instance_pools.*.idle_instance_autotermination_minutes	int	ALL
+resources.instance_pools.*.instance_pool_id	string	REMOTE
+resources.instance_pools.*.instance_pool_name	string	ALL
+resources.instance_pools.*.lifecycle	resources.Lifecycle	INPUT
+resources.instance_pools.*.lifecycle.prevent_destroy	bool	INPUT
+resources.instance_pools.*.max_capacity	int	ALL
+resources.instance_pools.*.min_idle_instances	int	ALL
+resources.instance_pools.*.modified_status	string	INPUT
+resources.instance_pools.*.node_type_flexibility	*compute.NodeTypeFlexibility	ALL
+resources.instance_pools.*.node_type_flexibility.alternate_node_type_ids	[]string	ALL
+resources.instance_pools.*.node_type_flexibility.alternate_node_type_ids[*]	string	ALL
+resources.instance_pools.*.node_type_flexibility.aws_context_id	string	ALL
+resources.instance_pools.*.node_type_id	string	ALL
+resources.instance_pools.*.preloaded_docker_images	[]compute.DockerImage	ALL
+resources.instance_pools.*.preloaded_docker_images[*]	compute.DockerImage	ALL
+resources.instance_pools.*.preloaded_docker_images[*].basic_auth	*compute.DockerBasicAuth	ALL
+resources.instance_pools.*.preloaded_docker_images[*].basic_auth.password	string	ALL
+resources.instance_pools.*.preloaded_docker_images[*].basic_auth.username	string	ALL
+resources.instance_pools.*.preloaded_docker_images[*].url	string	ALL
+resources.instance_pools.*.preloaded_spark_versions	[]string	ALL
+resources.instance_pools.*.preloaded_spark_versions[*]	string	ALL
+resources.instance_pools.*.remote_disk_throughput	int	ALL
+resources.instance_pools.*.state	compute.InstancePoolState	REMOTE
+resources.instance_pools.*.stats	*compute.InstancePoolStats	REMOTE
+resources.instance_pools.*.stats.idle_count	int	REMOTE
+resources.instance_pools.*.stats.pending_idle_count	int	REMOTE
+resources.instance_pools.*.stats.pending_used_count	int	REMOTE
+resources.instance_pools.*.stats.used_count	int	REMOTE
+resources.instance_pools.*.status	*compute.InstancePoolStatus	REMOTE
+resources.instance_pools.*.status.pending_instance_errors	[]compute.PendingInstanceError	REMOTE
+resources.instance_pools.*.status.pending_instance_errors[*]	compute.PendingInstanceError	REMOTE
+resources.instance_pools.*.status.pending_instance_errors[*].instance_id	string	REMOTE
+resources.instance_pools.*.status.pending_instance_errors[*].message	string	REMOTE
+resources.instance_pools.*.total_initial_remote_disk_size	int	ALL
+resources.instance_pools.*.url	string	INPUT
+resources.instance_pools.*.permissions.object_id	string	ALL
+resources.instance_pools.*.permissions[*]	dresources.StatePermission	ALL
+resources.instance_pools.*.permissions[*].group_name	string	ALL
+resources.instance_pools.*.permissions[*].level	iam.PermissionLevel	ALL
+resources.instance_pools.*.permissions[*].service_principal_name	string	ALL
+resources.instance_pools.*.permissions[*].user_name	string	ALL
+resources.internal_immutable_snapshots.*.acl	[]snapshot.ACLEntry	INPUT	STATE
+resources.internal_immutable_snapshots.*.acl[*]	snapshot.ACLEntry	INPUT	STATE
+resources.internal_immutable_snapshots.*.acl[*].group_name	string	INPUT	STATE
+resources.internal_immutable_snapshots.*.acl[*].permission_level	string	INPUT	STATE
+resources.internal_immutable_snapshots.*.acl[*].service_principal_name	string	INPUT	STATE
+resources.internal_immutable_snapshots.*.acl[*].user_name	string	INPUT	STATE
+resources.internal_immutable_snapshots.*.bundle_id	string	INPUT	STATE
+resources.internal_immutable_snapshots.*.full_path	string	REMOTE	STATE
+resources.internal_immutable_snapshots.*.relative_path	string	REMOTE	STATE
+resources.internal_immutable_snapshots.*.remote_root	string	INPUT
+resources.internal_immutable_snapshots.*.zip_path	string	INPUT	STATE
+resources.job_runs.*.dbt_commands	[]string	ALL
+resources.job_runs.*.dbt_commands[*]	string	ALL
+resources.job_runs.*.duration_target	string	ALL
+resources.job_runs.*.id	string	INPUT
+resources.job_runs.*.idempotency_token	string	ALL
+resources.job_runs.*.jar_params	[]string	ALL
+resources.job_runs.*.jar_params[*]	string	ALL
+resources.job_runs.*.job_id	int64	ALL
+resources.job_runs.*.job_parameters	map[string]string	ALL
+resources.job_runs.*.job_parameters.*	string	ALL
+resources.job_runs.*.lifecycle	*dresources.JobRunLifecycleState	STATE
+resources.job_runs.*.lifecycle	*resources.JobRunLifecycle	INPUT
+resources.job_runs.*.lifecycle	resources.Lifecycle	INPUT
+resources.job_runs.*.lifecycle.prevent_destroy	bool	INPUT
+resources.job_runs.*.lifecycle.triggers	[]resources.JobRunTrigger	INPUT
+resources.job_runs.*.lifecycle.triggers[*]	resources.JobRunTrigger	INPUT
+resources.job_runs.*.lifecycle.triggers[*].on_bundle_deploy	*bool	INPUT
+resources.job_runs.*.lifecycle.triggers[*].on_file_change	*string	INPUT
+resources.job_runs.*.lifecycle.triggers_state	*resources.JobRunTriggersState	INPUT	STATE
+resources.job_runs.*.lifecycle.triggers_state.on_bundle_deploy	string	INPUT	STATE
+resources.job_runs.*.lifecycle.triggers_state.on_file_change	map[string]string	INPUT	STATE
+resources.job_runs.*.lifecycle.triggers_state.on_file_change.*	string	INPUT	STATE
+resources.job_runs.*.modified_status	string	INPUT
+resources.job_runs.*.notebook_params	map[string]string	ALL
+resources.job_runs.*.notebook_params.*	string	ALL
+resources.job_runs.*.only	[]string	ALL
+resources.job_runs.*.only[*]	string	ALL
+resources.job_runs.*.performance_target	jobs.PerformanceTarget	ALL
+resources.job_runs.*.pipeline_params	*jobs.PipelineParams	ALL
+resources.job_runs.*.pipeline_params.full_refresh	bool	ALL
+resources.job_runs.*.pipeline_params.full_refresh_selection	[]string	ALL
+resources.job_runs.*.pipeline_params.full_refresh_selection[*]	string	ALL
+resources.job_runs.*.pipeline_params.refresh_flow_selection	[]string	ALL
+resources.job_runs.*.pipeline_params.refresh_flow_selection[*]	string	ALL
+resources.job_runs.*.pipeline_params.refresh_selection	[]string	ALL
+resources.job_runs.*.pipeline_params.refresh_selection[*]	string	ALL
+resources.job_runs.*.pipeline_params.reset_checkpoint_selection	[]string	ALL
+resources.job_runs.*.pipeline_params.reset_checkpoint_selection[*]	string	ALL
+resources.job_runs.*.python_named_params	map[string]string	ALL
+resources.job_runs.*.python_named_params.*	string	ALL
+resources.job_runs.*.python_params	[]string	ALL
+resources.job_runs.*.python_params[*]	string	ALL
+resources.job_runs.*.queue	*jobs.QueueSettings	ALL
+resources.job_runs.*.queue.enabled	bool	ALL
+resources.job_runs.*.resolved_job_id	int64	INPUT
+resources.job_runs.*.result_state	jobs.RunResultState	REMOTE	STATE
+resources.job_runs.*.run_id	int64	REMOTE
+resources.job_runs.*.run_name	string	REMOTE
+resources.job_runs.*.run_page_url	string	REMOTE
+resources.job_runs.*.run_type	jobs.RunType	REMOTE
+resources.job_runs.*.spark_submit_params	[]string	ALL
+resources.job_runs.*.spark_submit_params[*]	string	ALL
+resources.job_runs.*.sql_params	map[string]string	ALL
+resources.job_runs.*.sql_params.*	string	ALL
+resources.job_runs.*.state	*jobs.RunState	REMOTE
+resources.job_runs.*.state.life_cycle_state	jobs.RunLifeCycleState	REMOTE
+resources.job_runs.*.state.queue_reason	string	REMOTE
+resources.job_runs.*.state.result_state	jobs.RunResultState	REMOTE
+resources.job_runs.*.state.state_message	string	REMOTE
+resources.job_runs.*.state.user_cancelled_or_timedout	bool	REMOTE
+resources.job_runs.*.url	string	INPUT
 resources.jobs.*.budget_policy_id	string	ALL
 resources.jobs.*.continuous	*jobs.Continuous	ALL
+resources.jobs.*.continuous.maintenance_window	*jobs.MaintenanceWindow	ALL
+resources.jobs.*.continuous.maintenance_window.day_of_week	jobs.DayOfWeek	ALL
+resources.jobs.*.continuous.maintenance_window.start_hour	int	ALL
+resources.jobs.*.continuous.maintenance_window.timezone_id	string	ALL
 resources.jobs.*.continuous.pause_status	jobs.PauseStatus	ALL
 resources.jobs.*.continuous.task_retry_mode	jobs.TaskRetryMode	ALL
 resources.jobs.*.created_time	int64	REMOTE
 resources.jobs.*.creator_user_name	string	REMOTE
 resources.jobs.*.deployment	*jobs.JobDeployment	ALL
+resources.jobs.*.deployment.deployment_id	string	ALL
 resources.jobs.*.deployment.kind	jobs.JobDeploymentKind	ALL
 resources.jobs.*.deployment.metadata_file_path	string	ALL
+resources.jobs.*.deployment.version_id	string	ALL
 resources.jobs.*.description	string	ALL
+resources.jobs.*.duration_target	string	ALL
 resources.jobs.*.edit_mode	jobs.JobEditMode	ALL
 resources.jobs.*.effective_budget_policy_id	string	REMOTE
 resources.jobs.*.effective_usage_policy_id	string	REMOTE
@@ -745,12 +1179,24 @@ resources.jobs.*.email_notifications.on_duration_warning_threshold_exceeded	[]st
 resources.jobs.*.email_notifications.on_duration_warning_threshold_exceeded[*]	string	ALL
 resources.jobs.*.email_notifications.on_failure	[]string	ALL
 resources.jobs.*.email_notifications.on_failure[*]	string	ALL
+resources.jobs.*.email_notifications.on_maintenance_complete	[]string	ALL
+resources.jobs.*.email_notifications.on_maintenance_complete[*]	string	ALL
+resources.jobs.*.email_notifications.on_maintenance_start	[]string	ALL
+resources.jobs.*.email_notifications.on_maintenance_start[*]	string	ALL
 resources.jobs.*.email_notifications.on_start	[]string	ALL
 resources.jobs.*.email_notifications.on_start[*]	string	ALL
 resources.jobs.*.email_notifications.on_streaming_backlog_exceeded	[]string	ALL
 resources.jobs.*.email_notifications.on_streaming_backlog_exceeded[*]	string	ALL
 resources.jobs.*.email_notifications.on_success	[]string	ALL
 resources.jobs.*.email_notifications.on_success[*]	string	ALL
+resources.jobs.*.environment_variables	[]jobs.JobEnvironmentVariables	ALL
+resources.jobs.*.environment_variables[*]	jobs.JobEnvironmentVariables	ALL
+resources.jobs.*.environment_variables[*].environment_variables_key	string	ALL
+resources.jobs.*.environment_variables[*].spec	*jobs.JobEnvironmentVariablesSpec	ALL
+resources.jobs.*.environment_variables[*].spec.files	[]string	ALL
+resources.jobs.*.environment_variables[*].spec.files[*]	string	ALL
+resources.jobs.*.environment_variables[*].spec.variables	map[string]string	ALL
+resources.jobs.*.environment_variables[*].spec.variables.*	string	ALL
 resources.jobs.*.environments	[]jobs.JobEnvironment	ALL
 resources.jobs.*.environments[*]	jobs.JobEnvironment	ALL
 resources.jobs.*.environments[*].environment_key	string	ALL
@@ -762,6 +1208,7 @@ resources.jobs.*.environments[*].spec.dependencies[*]	string	ALL
 resources.jobs.*.environments[*].spec.environment_version	string	ALL
 resources.jobs.*.environments[*].spec.java_dependencies	[]string	ALL
 resources.jobs.*.environments[*].spec.java_dependencies[*]	string	ALL
+resources.jobs.*.environments[*].spec.project_environment	string	ALL
 resources.jobs.*.format	jobs.Format	ALL
 resources.jobs.*.git_source	*jobs.GitSource	ALL
 resources.jobs.*.git_source.git_branch	string	ALL
@@ -788,7 +1235,7 @@ resources.jobs.*.id	string	INPUT
 resources.jobs.*.job_clusters	[]jobs.JobCluster	ALL
 resources.jobs.*.job_clusters[*]	jobs.JobCluster	ALL
 resources.jobs.*.job_clusters[*].job_cluster_key	string	ALL
-resources.jobs.*.job_clusters[*].new_cluster	compute.ClusterSpec	ALL
+resources.jobs.*.job_clusters[*].new_cluster	*compute.ClusterSpec	ALL
 resources.jobs.*.job_clusters[*].new_cluster.apply_policy_default_values	bool	ALL
 resources.jobs.*.job_clusters[*].new_cluster.autoscale	*compute.AutoScale	ALL
 resources.jobs.*.job_clusters[*].new_cluster.autoscale.max_workers	int	ALL
@@ -807,6 +1254,7 @@ resources.jobs.*.job_clusters[*].new_cluster.aws_attributes.spot_bid_price_perce
 resources.jobs.*.job_clusters[*].new_cluster.aws_attributes.zone_id	string	ALL
 resources.jobs.*.job_clusters[*].new_cluster.azure_attributes	*compute.AzureAttributes	ALL
 resources.jobs.*.job_clusters[*].new_cluster.azure_attributes.availability	compute.AzureAvailability	ALL
+resources.jobs.*.job_clusters[*].new_cluster.azure_attributes.capacity_reservation_group	string	ALL
 resources.jobs.*.job_clusters[*].new_cluster.azure_attributes.first_on_demand	int	ALL
 resources.jobs.*.job_clusters[*].new_cluster.azure_attributes.log_analytics_info	*compute.LogAnalyticsInfo	ALL
 resources.jobs.*.job_clusters[*].new_cluster.azure_attributes.log_analytics_info.log_analytics_primary_key	string	ALL
@@ -829,6 +1277,7 @@ resources.jobs.*.job_clusters[*].new_cluster.cluster_name	string	ALL
 resources.jobs.*.job_clusters[*].new_cluster.custom_tags	map[string]string	ALL
 resources.jobs.*.job_clusters[*].new_cluster.custom_tags.*	string	ALL
 resources.jobs.*.job_clusters[*].new_cluster.data_security_mode	compute.DataSecurityMode	ALL
+resources.jobs.*.job_clusters[*].new_cluster.dependency_mode	compute.DependencyMode	ALL
 resources.jobs.*.job_clusters[*].new_cluster.docker_image	*compute.DockerImage	ALL
 resources.jobs.*.job_clusters[*].new_cluster.docker_image.basic_auth	*compute.DockerBasicAuth	ALL
 resources.jobs.*.job_clusters[*].new_cluster.docker_image.basic_auth.password	string	ALL
@@ -838,12 +1287,14 @@ resources.jobs.*.job_clusters[*].new_cluster.driver_instance_pool_id	string	ALL
 resources.jobs.*.job_clusters[*].new_cluster.driver_node_type_flexibility	*compute.NodeTypeFlexibility	ALL
 resources.jobs.*.job_clusters[*].new_cluster.driver_node_type_flexibility.alternate_node_type_ids	[]string	ALL
 resources.jobs.*.job_clusters[*].new_cluster.driver_node_type_flexibility.alternate_node_type_ids[*]	string	ALL
+resources.jobs.*.job_clusters[*].new_cluster.driver_node_type_flexibility.aws_context_id	string	ALL
 resources.jobs.*.job_clusters[*].new_cluster.driver_node_type_id	string	ALL
 resources.jobs.*.job_clusters[*].new_cluster.enable_elastic_disk	bool	ALL
 resources.jobs.*.job_clusters[*].new_cluster.enable_local_disk_encryption	bool	ALL
 resources.jobs.*.job_clusters[*].new_cluster.gcp_attributes	*compute.GcpAttributes	ALL
 resources.jobs.*.job_clusters[*].new_cluster.gcp_attributes.availability	compute.GcpAvailability	ALL
 resources.jobs.*.job_clusters[*].new_cluster.gcp_attributes.boot_disk_size	int	ALL
+resources.jobs.*.job_clusters[*].new_cluster.gcp_attributes.confidential_compute_type	compute.ConfidentialComputeType	ALL
 resources.jobs.*.job_clusters[*].new_cluster.gcp_attributes.first_on_demand	int	ALL
 resources.jobs.*.job_clusters[*].new_cluster.gcp_attributes.google_service_account	string	ALL
 resources.jobs.*.job_clusters[*].new_cluster.gcp_attributes.local_ssd_count	int	ALL
@@ -892,10 +1343,12 @@ resources.jobs.*.job_clusters[*].new_cluster.use_ml_runtime	bool	ALL
 resources.jobs.*.job_clusters[*].new_cluster.worker_node_type_flexibility	*compute.NodeTypeFlexibility	ALL
 resources.jobs.*.job_clusters[*].new_cluster.worker_node_type_flexibility.alternate_node_type_ids	[]string	ALL
 resources.jobs.*.job_clusters[*].new_cluster.worker_node_type_flexibility.alternate_node_type_ids[*]	string	ALL
+resources.jobs.*.job_clusters[*].new_cluster.worker_node_type_flexibility.aws_context_id	string	ALL
 resources.jobs.*.job_clusters[*].new_cluster.workload_type	*compute.WorkloadType	ALL
 resources.jobs.*.job_clusters[*].new_cluster.workload_type.clients	compute.ClientsTypes	ALL
 resources.jobs.*.job_clusters[*].new_cluster.workload_type.clients.jobs	bool	ALL
 resources.jobs.*.job_clusters[*].new_cluster.workload_type.clients.notebooks	bool	ALL
+resources.jobs.*.job_clusters[*].serverless_compute_id	string	ALL
 resources.jobs.*.job_id	int64	REMOTE
 resources.jobs.*.lifecycle	resources.Lifecycle	INPUT
 resources.jobs.*.lifecycle.prevent_destroy	bool	INPUT
@@ -909,6 +1362,7 @@ resources.jobs.*.parameters	[]jobs.JobParameterDefinition	ALL
 resources.jobs.*.parameters[*]	jobs.JobParameterDefinition	ALL
 resources.jobs.*.parameters[*].default	string	ALL
 resources.jobs.*.parameters[*].name	string	ALL
+resources.jobs.*.parent_path	string	ALL
 resources.jobs.*.performance_target	jobs.PerformanceTarget	ALL
 resources.jobs.*.queue	*jobs.QueueSettings	ALL
 resources.jobs.*.queue.enabled	bool	ALL
@@ -920,13 +1374,36 @@ resources.jobs.*.run_as_user_name	string	REMOTE
 resources.jobs.*.schedule	*jobs.CronSchedule	ALL
 resources.jobs.*.schedule.pause_status	jobs.PauseStatus	ALL
 resources.jobs.*.schedule.quartz_cron_expression	string	ALL
+resources.jobs.*.schedule.sql_condition	*jobs.SqlConditionConfiguration	ALL
+resources.jobs.*.schedule.sql_condition.sql_query_id	string	ALL
+resources.jobs.*.schedule.sql_condition.trigger_mode	jobs.SqlConditionTriggerMode	ALL
+resources.jobs.*.schedule.sql_condition.warehouse_id	string	ALL
 resources.jobs.*.schedule.timezone_id	string	ALL
 resources.jobs.*.tags	map[string]string	ALL
 resources.jobs.*.tags.*	string	ALL
 resources.jobs.*.tasks	[]jobs.Task	ALL
 resources.jobs.*.tasks[*]	jobs.Task	ALL
+resources.jobs.*.tasks[*].ai_runtime_task	*jobs.AiRuntimeTask	ALL
+resources.jobs.*.tasks[*].ai_runtime_task.code_source_path	string	ALL
+resources.jobs.*.tasks[*].ai_runtime_task.deployments	[]jobs.DeploymentSpec	ALL
+resources.jobs.*.tasks[*].ai_runtime_task.deployments[*]	jobs.DeploymentSpec	ALL
+resources.jobs.*.tasks[*].ai_runtime_task.deployments[*].command_path	string	ALL
+resources.jobs.*.tasks[*].ai_runtime_task.deployments[*].compute	jobs.ComputeSpec	ALL
+resources.jobs.*.tasks[*].ai_runtime_task.deployments[*].compute.accelerator_count	int	ALL
+resources.jobs.*.tasks[*].ai_runtime_task.deployments[*].compute.accelerator_type	jobs.ComputeSpecAcceleratorType	ALL
+resources.jobs.*.tasks[*].ai_runtime_task.deployments[*].compute.provisioned_capacity_id	string	ALL
+resources.jobs.*.tasks[*].ai_runtime_task.deployments[*].name	string	ALL
+resources.jobs.*.tasks[*].ai_runtime_task.docker_image_url	string	ALL
+resources.jobs.*.tasks[*].ai_runtime_task.experiment	string	ALL
+resources.jobs.*.tasks[*].ai_runtime_task.mlflow_artifact_location	string	ALL
+resources.jobs.*.tasks[*].ai_runtime_task.mlflow_experiment_directory	string	ALL
+resources.jobs.*.tasks[*].ai_runtime_task.mlflow_run	string	ALL
+resources.jobs.*.tasks[*].ai_runtime_task.priority_class	jobs.AiRuntimeTaskPriorityClass	ALL
+resources.jobs.*.tasks[*].ai_runtime_task.unity_catalog_image_path	string	ALL
 resources.jobs.*.tasks[*].alert_task	*jobs.AlertTask	ALL
 resources.jobs.*.tasks[*].alert_task.alert_id	string	ALL
+resources.jobs.*.tasks[*].alert_task.parameters	map[string]string	ALL
+resources.jobs.*.tasks[*].alert_task.parameters.*	string	ALL
 resources.jobs.*.tasks[*].alert_task.subscribers	[]jobs.AlertTaskSubscriber	ALL
 resources.jobs.*.tasks[*].alert_task.subscribers[*]	jobs.AlertTaskSubscriber	ALL
 resources.jobs.*.tasks[*].alert_task.subscribers[*].destination_id	string	ALL
@@ -950,6 +1427,18 @@ resources.jobs.*.tasks[*].dashboard_task.dashboard_id	string	ALL
 resources.jobs.*.tasks[*].dashboard_task.filters	map[string]string	ALL
 resources.jobs.*.tasks[*].dashboard_task.filters.*	string	ALL
 resources.jobs.*.tasks[*].dashboard_task.subscription	*jobs.Subscription	ALL
+resources.jobs.*.tasks[*].dashboard_task.subscription.attachment	*jobs.SubscriptionAttachment	ALL
+resources.jobs.*.tasks[*].dashboard_task.subscription.attachment.data_attachment	*jobs.SubscriptionAttachmentDataAttachment	ALL
+resources.jobs.*.tasks[*].dashboard_task.subscription.attachment.data_attachment.file_format	jobs.SubscriptionAttachmentDataAttachmentFileFormat	ALL
+resources.jobs.*.tasks[*].dashboard_task.subscription.attachment.data_attachment.include_applied_filters	bool	ALL
+resources.jobs.*.tasks[*].dashboard_task.subscription.attachment.data_attachment.widgets	[]jobs.SubscriptionAttachmentDataAttachmentWidget	ALL
+resources.jobs.*.tasks[*].dashboard_task.subscription.attachment.data_attachment.widgets[*]	jobs.SubscriptionAttachmentDataAttachmentWidget	ALL
+resources.jobs.*.tasks[*].dashboard_task.subscription.attachment.data_attachment.widgets[*].page_id	string	ALL
+resources.jobs.*.tasks[*].dashboard_task.subscription.attachment.data_attachment.widgets[*].widget_id	string	ALL
+resources.jobs.*.tasks[*].dashboard_task.subscription.attachment.page_attachment	*jobs.SubscriptionAttachmentPageAttachment	ALL
+resources.jobs.*.tasks[*].dashboard_task.subscription.attachment.page_attachment.page_ids	[]string	ALL
+resources.jobs.*.tasks[*].dashboard_task.subscription.attachment.page_attachment.page_ids[*]	string	ALL
+resources.jobs.*.tasks[*].dashboard_task.subscription.attachment.page_attachment.page_selection	jobs.SubscriptionAttachmentPageAttachmentPageSelection	ALL
 resources.jobs.*.tasks[*].dashboard_task.subscription.custom_subject	string	ALL
 resources.jobs.*.tasks[*].dashboard_task.subscription.paused	bool	ALL
 resources.jobs.*.tasks[*].dashboard_task.subscription.subscribers	[]jobs.SubscriptionSubscriber	ALL
@@ -985,6 +1474,10 @@ resources.jobs.*.tasks[*].email_notifications.on_duration_warning_threshold_exce
 resources.jobs.*.tasks[*].email_notifications.on_duration_warning_threshold_exceeded[*]	string	ALL
 resources.jobs.*.tasks[*].email_notifications.on_failure	[]string	ALL
 resources.jobs.*.tasks[*].email_notifications.on_failure[*]	string	ALL
+resources.jobs.*.tasks[*].email_notifications.on_maintenance_complete	[]string	ALL
+resources.jobs.*.tasks[*].email_notifications.on_maintenance_complete[*]	string	ALL
+resources.jobs.*.tasks[*].email_notifications.on_maintenance_start	[]string	ALL
+resources.jobs.*.tasks[*].email_notifications.on_maintenance_start[*]	string	ALL
 resources.jobs.*.tasks[*].email_notifications.on_start	[]string	ALL
 resources.jobs.*.tasks[*].email_notifications.on_start[*]	string	ALL
 resources.jobs.*.tasks[*].email_notifications.on_streaming_backlog_exceeded	[]string	ALL
@@ -992,13 +1485,33 @@ resources.jobs.*.tasks[*].email_notifications.on_streaming_backlog_exceeded[*]	s
 resources.jobs.*.tasks[*].email_notifications.on_success	[]string	ALL
 resources.jobs.*.tasks[*].email_notifications.on_success[*]	string	ALL
 resources.jobs.*.tasks[*].environment_key	string	ALL
+resources.jobs.*.tasks[*].environment_variables_key	string	ALL
 resources.jobs.*.tasks[*].existing_cluster_id	string	ALL
 resources.jobs.*.tasks[*].for_each_task	*jobs.ForEachTask	ALL
 resources.jobs.*.tasks[*].for_each_task.concurrency	int	ALL
 resources.jobs.*.tasks[*].for_each_task.inputs	string	ALL
 resources.jobs.*.tasks[*].for_each_task.task	jobs.Task	ALL
+resources.jobs.*.tasks[*].for_each_task.task.ai_runtime_task	*jobs.AiRuntimeTask	ALL
+resources.jobs.*.tasks[*].for_each_task.task.ai_runtime_task.code_source_path	string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.ai_runtime_task.deployments	[]jobs.DeploymentSpec	ALL
+resources.jobs.*.tasks[*].for_each_task.task.ai_runtime_task.deployments[*]	jobs.DeploymentSpec	ALL
+resources.jobs.*.tasks[*].for_each_task.task.ai_runtime_task.deployments[*].command_path	string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.ai_runtime_task.deployments[*].compute	jobs.ComputeSpec	ALL
+resources.jobs.*.tasks[*].for_each_task.task.ai_runtime_task.deployments[*].compute.accelerator_count	int	ALL
+resources.jobs.*.tasks[*].for_each_task.task.ai_runtime_task.deployments[*].compute.accelerator_type	jobs.ComputeSpecAcceleratorType	ALL
+resources.jobs.*.tasks[*].for_each_task.task.ai_runtime_task.deployments[*].compute.provisioned_capacity_id	string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.ai_runtime_task.deployments[*].name	string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.ai_runtime_task.docker_image_url	string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.ai_runtime_task.experiment	string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.ai_runtime_task.mlflow_artifact_location	string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.ai_runtime_task.mlflow_experiment_directory	string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.ai_runtime_task.mlflow_run	string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.ai_runtime_task.priority_class	jobs.AiRuntimeTaskPriorityClass	ALL
+resources.jobs.*.tasks[*].for_each_task.task.ai_runtime_task.unity_catalog_image_path	string	ALL
 resources.jobs.*.tasks[*].for_each_task.task.alert_task	*jobs.AlertTask	ALL
 resources.jobs.*.tasks[*].for_each_task.task.alert_task.alert_id	string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.alert_task.parameters	map[string]string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.alert_task.parameters.*	string	ALL
 resources.jobs.*.tasks[*].for_each_task.task.alert_task.subscribers	[]jobs.AlertTaskSubscriber	ALL
 resources.jobs.*.tasks[*].for_each_task.task.alert_task.subscribers[*]	jobs.AlertTaskSubscriber	ALL
 resources.jobs.*.tasks[*].for_each_task.task.alert_task.subscribers[*].destination_id	string	ALL
@@ -1022,6 +1535,18 @@ resources.jobs.*.tasks[*].for_each_task.task.dashboard_task.dashboard_id	string
 resources.jobs.*.tasks[*].for_each_task.task.dashboard_task.filters	map[string]string	ALL
 resources.jobs.*.tasks[*].for_each_task.task.dashboard_task.filters.*	string	ALL
 resources.jobs.*.tasks[*].for_each_task.task.dashboard_task.subscription	*jobs.Subscription	ALL
+resources.jobs.*.tasks[*].for_each_task.task.dashboard_task.subscription.attachment	*jobs.SubscriptionAttachment	ALL
+resources.jobs.*.tasks[*].for_each_task.task.dashboard_task.subscription.attachment.data_attachment	*jobs.SubscriptionAttachmentDataAttachment	ALL
+resources.jobs.*.tasks[*].for_each_task.task.dashboard_task.subscription.attachment.data_attachment.file_format	jobs.SubscriptionAttachmentDataAttachmentFileFormat	ALL
+resources.jobs.*.tasks[*].for_each_task.task.dashboard_task.subscription.attachment.data_attachment.include_applied_filters	bool	ALL
+resources.jobs.*.tasks[*].for_each_task.task.dashboard_task.subscription.attachment.data_attachment.widgets	[]jobs.SubscriptionAttachmentDataAttachmentWidget	ALL
+resources.jobs.*.tasks[*].for_each_task.task.dashboard_task.subscription.attachment.data_attachment.widgets[*]	jobs.SubscriptionAttachmentDataAttachmentWidget	ALL
+resources.jobs.*.tasks[*].for_each_task.task.dashboard_task.subscription.attachment.data_attachment.widgets[*].page_id	string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.dashboard_task.subscription.attachment.data_attachment.widgets[*].widget_id	string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.dashboard_task.subscription.attachment.page_attachment	*jobs.SubscriptionAttachmentPageAttachment	ALL
+resources.jobs.*.tasks[*].for_each_task.task.dashboard_task.subscription.attachment.page_attachment.page_ids	[]string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.dashboard_task.subscription.attachment.page_attachment.page_ids[*]	string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.dashboard_task.subscription.attachment.page_attachment.page_selection	jobs.SubscriptionAttachmentPageAttachmentPageSelection	ALL
 resources.jobs.*.tasks[*].for_each_task.task.dashboard_task.subscription.custom_subject	string	ALL
 resources.jobs.*.tasks[*].for_each_task.task.dashboard_task.subscription.paused	bool	ALL
 resources.jobs.*.tasks[*].for_each_task.task.dashboard_task.subscription.subscribers	[]jobs.SubscriptionSubscriber	ALL
@@ -1057,6 +1582,10 @@ resources.jobs.*.tasks[*].for_each_task.task.email_notifications.on_duration_war
 resources.jobs.*.tasks[*].for_each_task.task.email_notifications.on_duration_warning_threshold_exceeded[*]	string	ALL
 resources.jobs.*.tasks[*].for_each_task.task.email_notifications.on_failure	[]string	ALL
 resources.jobs.*.tasks[*].for_each_task.task.email_notifications.on_failure[*]	string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.email_notifications.on_maintenance_complete	[]string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.email_notifications.on_maintenance_complete[*]	string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.email_notifications.on_maintenance_start	[]string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.email_notifications.on_maintenance_start[*]	string	ALL
 resources.jobs.*.tasks[*].for_each_task.task.email_notifications.on_start	[]string	ALL
 resources.jobs.*.tasks[*].for_each_task.task.email_notifications.on_start[*]	string	ALL
 resources.jobs.*.tasks[*].for_each_task.task.email_notifications.on_streaming_backlog_exceeded	[]string	ALL
@@ -1064,6 +1593,7 @@ resources.jobs.*.tasks[*].for_each_task.task.email_notifications.on_streaming_ba
 resources.jobs.*.tasks[*].for_each_task.task.email_notifications.on_success	[]string	ALL
 resources.jobs.*.tasks[*].for_each_task.task.email_notifications.on_success[*]	string	ALL
 resources.jobs.*.tasks[*].for_each_task.task.environment_key	string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.environment_variables_key	string	ALL
 resources.jobs.*.tasks[*].for_each_task.task.existing_cluster_id	string	ALL
 resources.jobs.*.tasks[*].for_each_task.task.for_each_task	*jobs.ForEachTask	ALL
 resources.jobs.*.tasks[*].for_each_task.task.for_each_task.concurrency	int	ALL
@@ -1126,6 +1656,7 @@ resources.jobs.*.tasks[*].for_each_task.task.new_cluster.aws_attributes.spot_bid
 resources.jobs.*.tasks[*].for_each_task.task.new_cluster.aws_attributes.zone_id	string	ALL
 resources.jobs.*.tasks[*].for_each_task.task.new_cluster.azure_attributes	*compute.AzureAttributes	ALL
 resources.jobs.*.tasks[*].for_each_task.task.new_cluster.azure_attributes.availability	compute.AzureAvailability	ALL
+resources.jobs.*.tasks[*].for_each_task.task.new_cluster.azure_attributes.capacity_reservation_group	string	ALL
 resources.jobs.*.tasks[*].for_each_task.task.new_cluster.azure_attributes.first_on_demand	int	ALL
 resources.jobs.*.tasks[*].for_each_task.task.new_cluster.azure_attributes.log_analytics_info	*compute.LogAnalyticsInfo	ALL
 resources.jobs.*.tasks[*].for_each_task.task.new_cluster.azure_attributes.log_analytics_info.log_analytics_primary_key	string	ALL
@@ -1148,6 +1679,7 @@ resources.jobs.*.tasks[*].for_each_task.task.new_cluster.cluster_name	string	ALL
 resources.jobs.*.tasks[*].for_each_task.task.new_cluster.custom_tags	map[string]string	ALL
 resources.jobs.*.tasks[*].for_each_task.task.new_cluster.custom_tags.*	string	ALL
 resources.jobs.*.tasks[*].for_each_task.task.new_cluster.data_security_mode	compute.DataSecurityMode	ALL
+resources.jobs.*.tasks[*].for_each_task.task.new_cluster.dependency_mode	compute.DependencyMode	ALL
 resources.jobs.*.tasks[*].for_each_task.task.new_cluster.docker_image	*compute.DockerImage	ALL
 resources.jobs.*.tasks[*].for_each_task.task.new_cluster.docker_image.basic_auth	*compute.DockerBasicAuth	ALL
 resources.jobs.*.tasks[*].for_each_task.task.new_cluster.docker_image.basic_auth.password	string	ALL
@@ -1157,12 +1689,14 @@ resources.jobs.*.tasks[*].for_each_task.task.new_cluster.driver_instance_pool_id
 resources.jobs.*.tasks[*].for_each_task.task.new_cluster.driver_node_type_flexibility	*compute.NodeTypeFlexibility	ALL
 resources.jobs.*.tasks[*].for_each_task.task.new_cluster.driver_node_type_flexibility.alternate_node_type_ids	[]string	ALL
 resources.jobs.*.tasks[*].for_each_task.task.new_cluster.driver_node_type_flexibility.alternate_node_type_ids[*]	string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.new_cluster.driver_node_type_flexibility.aws_context_id	string	ALL
 resources.jobs.*.tasks[*].for_each_task.task.new_cluster.driver_node_type_id	string	ALL
 resources.jobs.*.tasks[*].for_each_task.task.new_cluster.enable_elastic_disk	bool	ALL
 resources.jobs.*.tasks[*].for_each_task.task.new_cluster.enable_local_disk_encryption	bool	ALL
 resources.jobs.*.tasks[*].for_each_task.task.new_cluster.gcp_attributes	*compute.GcpAttributes	ALL
 resources.jobs.*.tasks[*].for_each_task.task.new_cluster.gcp_attributes.availability	compute.GcpAvailability	ALL
 resources.jobs.*.tasks[*].for_each_task.task.new_cluster.gcp_attributes.boot_disk_size	int	ALL
+resources.jobs.*.tasks[*].for_each_task.task.new_cluster.gcp_attributes.confidential_compute_type	compute.ConfidentialComputeType	ALL
 resources.jobs.*.tasks[*].for_each_task.task.new_cluster.gcp_attributes.first_on_demand	int	ALL
 resources.jobs.*.tasks[*].for_each_task.task.new_cluster.gcp_attributes.google_service_account	string	ALL
 resources.jobs.*.tasks[*].for_each_task.task.new_cluster.gcp_attributes.local_ssd_count	int	ALL
@@ -1211,6 +1745,7 @@ resources.jobs.*.tasks[*].for_each_task.task.new_cluster.use_ml_runtime	bool	ALL
 resources.jobs.*.tasks[*].for_each_task.task.new_cluster.worker_node_type_flexibility	*compute.NodeTypeFlexibility	ALL
 resources.jobs.*.tasks[*].for_each_task.task.new_cluster.worker_node_type_flexibility.alternate_node_type_ids	[]string	ALL
 resources.jobs.*.tasks[*].for_each_task.task.new_cluster.worker_node_type_flexibility.alternate_node_type_ids[*]	string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.new_cluster.worker_node_type_flexibility.aws_context_id	string	ALL
 resources.jobs.*.tasks[*].for_each_task.task.new_cluster.workload_type	*compute.WorkloadType	ALL
 resources.jobs.*.tasks[*].for_each_task.task.new_cluster.workload_type.clients	compute.ClientsTypes	ALL
 resources.jobs.*.tasks[*].for_each_task.task.new_cluster.workload_type.clients.jobs	bool	ALL
@@ -1227,7 +1762,17 @@ resources.jobs.*.tasks[*].for_each_task.task.notification_settings.no_alert_for_
 resources.jobs.*.tasks[*].for_each_task.task.notification_settings.no_alert_for_skipped_runs	bool	ALL
 resources.jobs.*.tasks[*].for_each_task.task.pipeline_task	*jobs.PipelineTask	ALL
 resources.jobs.*.tasks[*].for_each_task.task.pipeline_task.full_refresh	bool	ALL
+resources.jobs.*.tasks[*].for_each_task.task.pipeline_task.full_refresh_selection	[]string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.pipeline_task.full_refresh_selection[*]	string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.pipeline_task.parameters	map[string]string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.pipeline_task.parameters.*	string	ALL
 resources.jobs.*.tasks[*].for_each_task.task.pipeline_task.pipeline_id	string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.pipeline_task.refresh_flow_selection	[]string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.pipeline_task.refresh_flow_selection[*]	string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.pipeline_task.refresh_selection	[]string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.pipeline_task.refresh_selection[*]	string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.pipeline_task.reset_checkpoint_selection	[]string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.pipeline_task.reset_checkpoint_selection[*]	string	ALL
 resources.jobs.*.tasks[*].for_each_task.task.power_bi_task	*jobs.PowerBiTask	ALL
 resources.jobs.*.tasks[*].for_each_task.task.power_bi_task.connection_resource_name	string	ALL
 resources.jobs.*.tasks[*].for_each_task.task.power_bi_task.power_bi_model	*jobs.PowerBiModel	ALL
@@ -1244,6 +1789,12 @@ resources.jobs.*.tasks[*].for_each_task.task.power_bi_task.tables[*].name	string
 resources.jobs.*.tasks[*].for_each_task.task.power_bi_task.tables[*].schema	string	ALL
 resources.jobs.*.tasks[*].for_each_task.task.power_bi_task.tables[*].storage_mode	jobs.StorageMode	ALL
 resources.jobs.*.tasks[*].for_each_task.task.power_bi_task.warehouse_id	string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.python_operator_task	*jobs.PythonOperatorTask	ALL
+resources.jobs.*.tasks[*].for_each_task.task.python_operator_task.main	string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.python_operator_task.parameters	[]jobs.PythonOperatorTaskParameter	ALL
+resources.jobs.*.tasks[*].for_each_task.task.python_operator_task.parameters[*]	jobs.PythonOperatorTaskParameter	ALL
+resources.jobs.*.tasks[*].for_each_task.task.python_operator_task.parameters[*].name	string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.python_operator_task.parameters[*].value	string	ALL
 resources.jobs.*.tasks[*].for_each_task.task.python_wheel_task	*jobs.PythonWheelTask	ALL
 resources.jobs.*.tasks[*].for_each_task.task.python_wheel_task.entry_point	string	ALL
 resources.jobs.*.tasks[*].for_each_task.task.python_wheel_task.named_parameters	map[string]string	ALL
@@ -1265,6 +1816,14 @@ resources.jobs.*.tasks[*].for_each_task.task.run_job_task.notebook_params	map[st
 resources.jobs.*.tasks[*].for_each_task.task.run_job_task.notebook_params.*	string	ALL
 resources.jobs.*.tasks[*].for_each_task.task.run_job_task.pipeline_params	*jobs.PipelineParams	ALL
 resources.jobs.*.tasks[*].for_each_task.task.run_job_task.pipeline_params.full_refresh	bool	ALL
+resources.jobs.*.tasks[*].for_each_task.task.run_job_task.pipeline_params.full_refresh_selection	[]string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.run_job_task.pipeline_params.full_refresh_selection[*]	string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.run_job_task.pipeline_params.refresh_flow_selection	[]string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.run_job_task.pipeline_params.refresh_flow_selection[*]	string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.run_job_task.pipeline_params.refresh_selection	[]string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.run_job_task.pipeline_params.refresh_selection[*]	string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.run_job_task.pipeline_params.reset_checkpoint_selection	[]string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.run_job_task.pipeline_params.reset_checkpoint_selection[*]	string	ALL
 resources.jobs.*.tasks[*].for_each_task.task.run_job_task.python_named_params	map[string]string	ALL
 resources.jobs.*.tasks[*].for_each_task.task.run_job_task.python_named_params.*	string	ALL
 resources.jobs.*.tasks[*].for_each_task.task.run_job_task.python_params	[]string	ALL
@@ -1320,6 +1879,12 @@ resources.jobs.*.tasks[*].for_each_task.task.webhook_notifications.on_duration_w
 resources.jobs.*.tasks[*].for_each_task.task.webhook_notifications.on_failure	[]jobs.Webhook	ALL
 resources.jobs.*.tasks[*].for_each_task.task.webhook_notifications.on_failure[*]	jobs.Webhook	ALL
 resources.jobs.*.tasks[*].for_each_task.task.webhook_notifications.on_failure[*].id	string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.webhook_notifications.on_maintenance_complete	[]jobs.Webhook	ALL
+resources.jobs.*.tasks[*].for_each_task.task.webhook_notifications.on_maintenance_complete[*]	jobs.Webhook	ALL
+resources.jobs.*.tasks[*].for_each_task.task.webhook_notifications.on_maintenance_complete[*].id	string	ALL
+resources.jobs.*.tasks[*].for_each_task.task.webhook_notifications.on_maintenance_start	[]jobs.Webhook	ALL
+resources.jobs.*.tasks[*].for_each_task.task.webhook_notifications.on_maintenance_start[*]	jobs.Webhook	ALL
+resources.jobs.*.tasks[*].for_each_task.task.webhook_notifications.on_maintenance_start[*].id	string	ALL
 resources.jobs.*.tasks[*].for_each_task.task.webhook_notifications.on_start	[]jobs.Webhook	ALL
 resources.jobs.*.tasks[*].for_each_task.task.webhook_notifications.on_start[*]	jobs.Webhook	ALL
 resources.jobs.*.tasks[*].for_each_task.task.webhook_notifications.on_start[*].id	string	ALL
@@ -1386,6 +1951,7 @@ resources.jobs.*.tasks[*].new_cluster.aws_attributes.spot_bid_price_percent	int
 resources.jobs.*.tasks[*].new_cluster.aws_attributes.zone_id	string	ALL
 resources.jobs.*.tasks[*].new_cluster.azure_attributes	*compute.AzureAttributes	ALL
 resources.jobs.*.tasks[*].new_cluster.azure_attributes.availability	compute.AzureAvailability	ALL
+resources.jobs.*.tasks[*].new_cluster.azure_attributes.capacity_reservation_group	string	ALL
 resources.jobs.*.tasks[*].new_cluster.azure_attributes.first_on_demand	int	ALL
 resources.jobs.*.tasks[*].new_cluster.azure_attributes.log_analytics_info	*compute.LogAnalyticsInfo	ALL
 resources.jobs.*.tasks[*].new_cluster.azure_attributes.log_analytics_info.log_analytics_primary_key	string	ALL
@@ -1408,6 +1974,7 @@ resources.jobs.*.tasks[*].new_cluster.cluster_name	string	ALL
 resources.jobs.*.tasks[*].new_cluster.custom_tags	map[string]string	ALL
 resources.jobs.*.tasks[*].new_cluster.custom_tags.*	string	ALL
 resources.jobs.*.tasks[*].new_cluster.data_security_mode	compute.DataSecurityMode	ALL
+resources.jobs.*.tasks[*].new_cluster.dependency_mode	compute.DependencyMode	ALL
 resources.jobs.*.tasks[*].new_cluster.docker_image	*compute.DockerImage	ALL
 resources.jobs.*.tasks[*].new_cluster.docker_image.basic_auth	*compute.DockerBasicAuth	ALL
 resources.jobs.*.tasks[*].new_cluster.docker_image.basic_auth.password	string	ALL
@@ -1417,12 +1984,14 @@ resources.jobs.*.tasks[*].new_cluster.driver_instance_pool_id	string	ALL
 resources.jobs.*.tasks[*].new_cluster.driver_node_type_flexibility	*compute.NodeTypeFlexibility	ALL
 resources.jobs.*.tasks[*].new_cluster.driver_node_type_flexibility.alternate_node_type_ids	[]string	ALL
 resources.jobs.*.tasks[*].new_cluster.driver_node_type_flexibility.alternate_node_type_ids[*]	string	ALL
+resources.jobs.*.tasks[*].new_cluster.driver_node_type_flexibility.aws_context_id	string	ALL
 resources.jobs.*.tasks[*].new_cluster.driver_node_type_id	string	ALL
 resources.jobs.*.tasks[*].new_cluster.enable_elastic_disk	bool	ALL
 resources.jobs.*.tasks[*].new_cluster.enable_local_disk_encryption	bool	ALL
 resources.jobs.*.tasks[*].new_cluster.gcp_attributes	*compute.GcpAttributes	ALL
 resources.jobs.*.tasks[*].new_cluster.gcp_attributes.availability	compute.GcpAvailability	ALL
 resources.jobs.*.tasks[*].new_cluster.gcp_attributes.boot_disk_size	int	ALL
+resources.jobs.*.tasks[*].new_cluster.gcp_attributes.confidential_compute_type	compute.ConfidentialComputeType	ALL
 resources.jobs.*.tasks[*].new_cluster.gcp_attributes.first_on_demand	int	ALL
 resources.jobs.*.tasks[*].new_cluster.gcp_attributes.google_service_account	string	ALL
 resources.jobs.*.tasks[*].new_cluster.gcp_attributes.local_ssd_count	int	ALL
@@ -1471,6 +2040,7 @@ resources.jobs.*.tasks[*].new_cluster.use_ml_runtime	bool	ALL
 resources.jobs.*.tasks[*].new_cluster.worker_node_type_flexibility	*compute.NodeTypeFlexibility	ALL
 resources.jobs.*.tasks[*].new_cluster.worker_node_type_flexibility.alternate_node_type_ids	[]string	ALL
 resources.jobs.*.tasks[*].new_cluster.worker_node_type_flexibility.alternate_node_type_ids[*]	string	ALL
+resources.jobs.*.tasks[*].new_cluster.worker_node_type_flexibility.aws_context_id	string	ALL
 resources.jobs.*.tasks[*].new_cluster.workload_type	*compute.WorkloadType	ALL
 resources.jobs.*.tasks[*].new_cluster.workload_type.clients	compute.ClientsTypes	ALL
 resources.jobs.*.tasks[*].new_cluster.workload_type.clients.jobs	bool	ALL
@@ -1487,7 +2057,17 @@ resources.jobs.*.tasks[*].notification_settings.no_alert_for_canceled_runs	bool
 resources.jobs.*.tasks[*].notification_settings.no_alert_for_skipped_runs	bool	ALL
 resources.jobs.*.tasks[*].pipeline_task	*jobs.PipelineTask	ALL
 resources.jobs.*.tasks[*].pipeline_task.full_refresh	bool	ALL
+resources.jobs.*.tasks[*].pipeline_task.full_refresh_selection	[]string	ALL
+resources.jobs.*.tasks[*].pipeline_task.full_refresh_selection[*]	string	ALL
+resources.jobs.*.tasks[*].pipeline_task.parameters	map[string]string	ALL
+resources.jobs.*.tasks[*].pipeline_task.parameters.*	string	ALL
 resources.jobs.*.tasks[*].pipeline_task.pipeline_id	string	ALL
+resources.jobs.*.tasks[*].pipeline_task.refresh_flow_selection	[]string	ALL
+resources.jobs.*.tasks[*].pipeline_task.refresh_flow_selection[*]	string	ALL
+resources.jobs.*.tasks[*].pipeline_task.refresh_selection	[]string	ALL
+resources.jobs.*.tasks[*].pipeline_task.refresh_selection[*]	string	ALL
+resources.jobs.*.tasks[*].pipeline_task.reset_checkpoint_selection	[]string	ALL
+resources.jobs.*.tasks[*].pipeline_task.reset_checkpoint_selection[*]	string	ALL
 resources.jobs.*.tasks[*].power_bi_task	*jobs.PowerBiTask	ALL
 resources.jobs.*.tasks[*].power_bi_task.connection_resource_name	string	ALL
 resources.jobs.*.tasks[*].power_bi_task.power_bi_model	*jobs.PowerBiModel	ALL
@@ -1504,6 +2084,12 @@ resources.jobs.*.tasks[*].power_bi_task.tables[*].name	string	ALL
 resources.jobs.*.tasks[*].power_bi_task.tables[*].schema	string	ALL
 resources.jobs.*.tasks[*].power_bi_task.tables[*].storage_mode	jobs.StorageMode	ALL
 resources.jobs.*.tasks[*].power_bi_task.warehouse_id	string	ALL
+resources.jobs.*.tasks[*].python_operator_task	*jobs.PythonOperatorTask	ALL
+resources.jobs.*.tasks[*].python_operator_task.main	string	ALL
+resources.jobs.*.tasks[*].python_operator_task.parameters	[]jobs.PythonOperatorTaskParameter	ALL
+resources.jobs.*.tasks[*].python_operator_task.parameters[*]	jobs.PythonOperatorTaskParameter	ALL
+resources.jobs.*.tasks[*].python_operator_task.parameters[*].name	string	ALL
+resources.jobs.*.tasks[*].python_operator_task.parameters[*].value	string	ALL
 resources.jobs.*.tasks[*].python_wheel_task	*jobs.PythonWheelTask	ALL
 resources.jobs.*.tasks[*].python_wheel_task.entry_point	string	ALL
 resources.jobs.*.tasks[*].python_wheel_task.named_parameters	map[string]string	ALL
@@ -1525,6 +2111,14 @@ resources.jobs.*.tasks[*].run_job_task.notebook_params	map[string]string	ALL
 resources.jobs.*.tasks[*].run_job_task.notebook_params.*	string	ALL
 resources.jobs.*.tasks[*].run_job_task.pipeline_params	*jobs.PipelineParams	ALL
 resources.jobs.*.tasks[*].run_job_task.pipeline_params.full_refresh	bool	ALL
+resources.jobs.*.tasks[*].run_job_task.pipeline_params.full_refresh_selection	[]string	ALL
+resources.jobs.*.tasks[*].run_job_task.pipeline_params.full_refresh_selection[*]	string	ALL
+resources.jobs.*.tasks[*].run_job_task.pipeline_params.refresh_flow_selection	[]string	ALL
+resources.jobs.*.tasks[*].run_job_task.pipeline_params.refresh_flow_selection[*]	string	ALL
+resources.jobs.*.tasks[*].run_job_task.pipeline_params.refresh_selection	[]string	ALL
+resources.jobs.*.tasks[*].run_job_task.pipeline_params.refresh_selection[*]	string	ALL
+resources.jobs.*.tasks[*].run_job_task.pipeline_params.reset_checkpoint_selection	[]string	ALL
+resources.jobs.*.tasks[*].run_job_task.pipeline_params.reset_checkpoint_selection[*]	string	ALL
 resources.jobs.*.tasks[*].run_job_task.python_named_params	map[string]string	ALL
 resources.jobs.*.tasks[*].run_job_task.python_named_params.*	string	ALL
 resources.jobs.*.tasks[*].run_job_task.python_params	[]string	ALL
@@ -1580,6 +2174,12 @@ resources.jobs.*.tasks[*].webhook_notifications.on_duration_warning_threshold_ex
 resources.jobs.*.tasks[*].webhook_notifications.on_failure	[]jobs.Webhook	ALL
 resources.jobs.*.tasks[*].webhook_notifications.on_failure[*]	jobs.Webhook	ALL
 resources.jobs.*.tasks[*].webhook_notifications.on_failure[*].id	string	ALL
+resources.jobs.*.tasks[*].webhook_notifications.on_maintenance_complete	[]jobs.Webhook	ALL
+resources.jobs.*.tasks[*].webhook_notifications.on_maintenance_complete[*]	jobs.Webhook	ALL
+resources.jobs.*.tasks[*].webhook_notifications.on_maintenance_complete[*].id	string	ALL
+resources.jobs.*.tasks[*].webhook_notifications.on_maintenance_start	[]jobs.Webhook	ALL
+resources.jobs.*.tasks[*].webhook_notifications.on_maintenance_start[*]	jobs.Webhook	ALL
+resources.jobs.*.tasks[*].webhook_notifications.on_maintenance_start[*].id	string	ALL
 resources.jobs.*.tasks[*].webhook_notifications.on_start	[]jobs.Webhook	ALL
 resources.jobs.*.tasks[*].webhook_notifications.on_start[*]	jobs.Webhook	ALL
 resources.jobs.*.tasks[*].webhook_notifications.on_start[*].id	string	ALL
@@ -1606,21 +2206,103 @@ resources.jobs.*.trigger.pause_status	jobs.PauseStatus	ALL
 resources.jobs.*.trigger.periodic	*jobs.PeriodicTriggerConfiguration	ALL
 resources.jobs.*.trigger.periodic.interval	int	ALL
 resources.jobs.*.trigger.periodic.unit	jobs.PeriodicTriggerConfigurationTimeUnit	ALL
+resources.jobs.*.trigger.sql_condition	*jobs.SqlConditionConfiguration	ALL
+resources.jobs.*.trigger.sql_condition.sql_query_id	string	ALL
+resources.jobs.*.trigger.sql_condition.trigger_mode	jobs.SqlConditionTriggerMode	ALL
+resources.jobs.*.trigger.sql_condition.warehouse_id	string	ALL
 resources.jobs.*.trigger.table_update	*jobs.TableUpdateTriggerConfiguration	ALL
 resources.jobs.*.trigger.table_update.condition	jobs.Condition	ALL
 resources.jobs.*.trigger.table_update.min_time_between_triggers_seconds	int	ALL
 resources.jobs.*.trigger.table_update.table_names	[]string	ALL
 resources.jobs.*.trigger.table_update.table_names[*]	string	ALL
 resources.jobs.*.trigger.table_update.wait_after_last_change_seconds	int	ALL
+resources.jobs.*.trigger_details	[]jobs.TriggerDetails	REMOTE
+resources.jobs.*.trigger_details[*]	jobs.TriggerDetails	REMOTE
+resources.jobs.*.trigger_details[*].history	*jobs.TriggerHistory	REMOTE
+resources.jobs.*.trigger_details[*].history.last_failed	*jobs.TriggerEvaluation	REMOTE
+resources.jobs.*.trigger_details[*].history.last_failed.description	string	REMOTE
+resources.jobs.*.trigger_details[*].history.last_failed.run_id	int64	REMOTE
+resources.jobs.*.trigger_details[*].history.last_failed.timestamp	int64	REMOTE
+resources.jobs.*.trigger_details[*].history.last_not_triggered	*jobs.TriggerEvaluation	REMOTE
+resources.jobs.*.trigger_details[*].history.last_not_triggered.description	string	REMOTE
+resources.jobs.*.trigger_details[*].history.last_not_triggered.run_id	int64	REMOTE
+resources.jobs.*.trigger_details[*].history.last_not_triggered.timestamp	int64	REMOTE
+resources.jobs.*.trigger_details[*].history.last_triggered	*jobs.TriggerEvaluation	REMOTE
+resources.jobs.*.trigger_details[*].history.last_triggered.description	string	REMOTE
+resources.jobs.*.trigger_details[*].history.last_triggered.run_id	int64	REMOTE
+resources.jobs.*.trigger_details[*].history.last_triggered.timestamp	int64	REMOTE
+resources.jobs.*.trigger_details[*].state	*jobs.PerTriggerState	REMOTE
+resources.jobs.*.trigger_details[*].state.continuous	*jobs.ContinuousTriggerState	REMOTE
+resources.jobs.*.trigger_details[*].state.continuous.consecutive_failures	int	REMOTE
+resources.jobs.*.trigger_details[*].state.continuous.is_backing_off	bool	REMOTE
+resources.jobs.*.trigger_details[*].state.continuous.next_attempt_ms	int64	REMOTE
+resources.jobs.*.trigger_details[*].state.file_arrival	*jobs.FileArrivalTriggerState	REMOTE
+resources.jobs.*.trigger_details[*].state.file_arrival.using_file_events	bool	REMOTE
+resources.jobs.*.trigger_details[*].state.model	*jobs.ModelTriggerState	REMOTE
+resources.jobs.*.trigger_details[*].state.pause_status	jobs.PauseStatus	REMOTE
+resources.jobs.*.trigger_details[*].state.periodic	*jobs.PeriodicTriggerState	REMOTE
+resources.jobs.*.trigger_details[*].state.periodic.next_run_time	int64	REMOTE
+resources.jobs.*.trigger_details[*].state.schedule	*jobs.ScheduleTriggerState	REMOTE
+resources.jobs.*.trigger_details[*].state.sql_condition	*jobs.SqlConditionState	REMOTE
+resources.jobs.*.trigger_details[*].state.sql_condition.latest_condition_evaluation_satisfied	bool	REMOTE
+resources.jobs.*.trigger_details[*].state.sql_condition.latest_condition_evaluation_sql_session_id	string	REMOTE
+resources.jobs.*.trigger_details[*].state.sql_condition.latest_condition_evaluation_sql_statement_id	string	REMOTE
+resources.jobs.*.trigger_details[*].state.table_update	*jobs.TableTriggerState	REMOTE
+resources.jobs.*.trigger_details[*].state.table_update.last_seen_table_states	[]jobs.TableState	REMOTE
+resources.jobs.*.trigger_details[*].state.table_update.last_seen_table_states[*]	jobs.TableState	REMOTE
+resources.jobs.*.trigger_details[*].state.table_update.last_seen_table_states[*].has_seen_updates	bool	REMOTE
+resources.jobs.*.trigger_details[*].state.table_update.last_seen_table_states[*].table_name	string	REMOTE
+resources.jobs.*.trigger_details[*].state.table_update.using_scalable_monitoring	bool	REMOTE
 resources.jobs.*.trigger_state	*jobs.TriggerStateProto	REMOTE
 resources.jobs.*.trigger_state.file_arrival	*jobs.FileArrivalTriggerState	REMOTE
 resources.jobs.*.trigger_state.file_arrival.using_file_events	bool	REMOTE
+resources.jobs.*.trigger_state.pause_status	jobs.PauseStatus	REMOTE
+resources.jobs.*.trigger_state.sql_condition	*jobs.SqlConditionState	REMOTE
+resources.jobs.*.trigger_state.sql_condition.latest_condition_evaluation_satisfied	bool	REMOTE
+resources.jobs.*.trigger_state.sql_condition.latest_condition_evaluation_sql_session_id	string	REMOTE
+resources.jobs.*.trigger_state.sql_condition.latest_condition_evaluation_sql_statement_id	string	REMOTE
 resources.jobs.*.trigger_state.table	*jobs.TableTriggerState	REMOTE
 resources.jobs.*.trigger_state.table.last_seen_table_states	[]jobs.TableState	REMOTE
 resources.jobs.*.trigger_state.table.last_seen_table_states[*]	jobs.TableState	REMOTE
 resources.jobs.*.trigger_state.table.last_seen_table_states[*].has_seen_updates	bool	REMOTE
 resources.jobs.*.trigger_state.table.last_seen_table_states[*].table_name	string	REMOTE
 resources.jobs.*.trigger_state.table.using_scalable_monitoring	bool	REMOTE
+resources.jobs.*.triggers	[]jobs.TriggerConfiguration	ALL
+resources.jobs.*.triggers[*]	jobs.TriggerConfiguration	ALL
+resources.jobs.*.triggers[*].continuous	*jobs.ContinuousTriggerConfiguration	ALL
+resources.jobs.*.triggers[*].continuous.maintenance_window	*jobs.MaintenanceWindow	ALL
+resources.jobs.*.triggers[*].continuous.maintenance_window.day_of_week	jobs.DayOfWeek	ALL
+resources.jobs.*.triggers[*].continuous.maintenance_window.start_hour	int	ALL
+resources.jobs.*.triggers[*].continuous.maintenance_window.timezone_id	string	ALL
+resources.jobs.*.triggers[*].continuous.task_retry_mode	jobs.TaskRetryMode	ALL
+resources.jobs.*.triggers[*].file_arrival	*jobs.FileArrivalTriggerConfiguration	ALL
+resources.jobs.*.triggers[*].file_arrival.min_time_between_triggers_seconds	int	ALL
+resources.jobs.*.triggers[*].file_arrival.url	string	ALL
+resources.jobs.*.triggers[*].file_arrival.wait_after_last_change_seconds	int	ALL
+resources.jobs.*.triggers[*].model	*jobs.ModelTriggerConfiguration	ALL
+resources.jobs.*.triggers[*].model.aliases	[]string	ALL
+resources.jobs.*.triggers[*].model.aliases[*]	string	ALL
+resources.jobs.*.triggers[*].model.condition	jobs.ModelTriggerConfigurationCondition	ALL
+resources.jobs.*.triggers[*].model.min_time_between_triggers_seconds	int	ALL
+resources.jobs.*.triggers[*].model.securable_name	string	ALL
+resources.jobs.*.triggers[*].model.wait_after_last_change_seconds	int	ALL
+resources.jobs.*.triggers[*].pause_status	jobs.PauseStatus	ALL
+resources.jobs.*.triggers[*].periodic	*jobs.PeriodicTriggerConfiguration	ALL
+resources.jobs.*.triggers[*].periodic.interval	int	ALL
+resources.jobs.*.triggers[*].periodic.unit	jobs.PeriodicTriggerConfigurationTimeUnit	ALL
+resources.jobs.*.triggers[*].schedule	*jobs.CronTriggerConfiguration	ALL
+resources.jobs.*.triggers[*].schedule.quartz_cron_expression	string	ALL
+resources.jobs.*.triggers[*].schedule.timezone_id	string	ALL
+resources.jobs.*.triggers[*].sql_condition	*jobs.SqlConditionConfiguration	ALL
+resources.jobs.*.triggers[*].sql_condition.sql_query_id	string	ALL
+resources.jobs.*.triggers[*].sql_condition.trigger_mode	jobs.SqlConditionTriggerMode	ALL
+resources.jobs.*.triggers[*].sql_condition.warehouse_id	string	ALL
+resources.jobs.*.triggers[*].table_update	*jobs.TableUpdateTriggerConfiguration	ALL
+resources.jobs.*.triggers[*].table_update.condition	jobs.Condition	ALL
+resources.jobs.*.triggers[*].table_update.min_time_between_triggers_seconds	int	ALL
+resources.jobs.*.triggers[*].table_update.table_names	[]string	ALL
+resources.jobs.*.triggers[*].table_update.table_names[*]	string	ALL
+resources.jobs.*.triggers[*].table_update.wait_after_last_change_seconds	int	ALL
 resources.jobs.*.url	string	INPUT
 resources.jobs.*.usage_policy_id	string	ALL
 resources.jobs.*.webhook_notifications	*jobs.WebhookNotifications	ALL
@@ -1630,6 +2312,12 @@ resources.jobs.*.webhook_notifications.on_duration_warning_threshold_exceeded[*]
 resources.jobs.*.webhook_notifications.on_failure	[]jobs.Webhook	ALL
 resources.jobs.*.webhook_notifications.on_failure[*]	jobs.Webhook	ALL
 resources.jobs.*.webhook_notifications.on_failure[*].id	string	ALL
+resources.jobs.*.webhook_notifications.on_maintenance_complete	[]jobs.Webhook	ALL
+resources.jobs.*.webhook_notifications.on_maintenance_complete[*]	jobs.Webhook	ALL
+resources.jobs.*.webhook_notifications.on_maintenance_complete[*].id	string	ALL
+resources.jobs.*.webhook_notifications.on_maintenance_start	[]jobs.Webhook	ALL
+resources.jobs.*.webhook_notifications.on_maintenance_start[*]	jobs.Webhook	ALL
+resources.jobs.*.webhook_notifications.on_maintenance_start[*].id	string	ALL
 resources.jobs.*.webhook_notifications.on_start	[]jobs.Webhook	ALL
 resources.jobs.*.webhook_notifications.on_start[*]	jobs.Webhook	ALL
 resources.jobs.*.webhook_notifications.on_start[*].id	string	ALL
@@ -1645,148 +2333,375 @@ resources.jobs.*.permissions[*].group_name	string	ALL
 resources.jobs.*.permissions[*].level	iam.PermissionLevel	ALL
 resources.jobs.*.permissions[*].service_principal_name	string	ALL
 resources.jobs.*.permissions[*].user_name	string	ALL
-resources.model_serving_endpoints.*.ai_gateway	*serving.AiGatewayConfig	INPUT	STATE
-resources.model_serving_endpoints.*.ai_gateway.fallback_config	*serving.FallbackConfig	INPUT	STATE
-resources.model_serving_endpoints.*.ai_gateway.fallback_config.enabled	bool	INPUT	STATE
-resources.model_serving_endpoints.*.ai_gateway.guardrails	*serving.AiGatewayGuardrails	INPUT	STATE
-resources.model_serving_endpoints.*.ai_gateway.guardrails.input	*serving.AiGatewayGuardrailParameters	INPUT	STATE
-resources.model_serving_endpoints.*.ai_gateway.guardrails.input.invalid_keywords	[]string	INPUT	STATE
-resources.model_serving_endpoints.*.ai_gateway.guardrails.input.invalid_keywords[*]	string	INPUT	STATE
-resources.model_serving_endpoints.*.ai_gateway.guardrails.input.pii	*serving.AiGatewayGuardrailPiiBehavior	INPUT	STATE
-resources.model_serving_endpoints.*.ai_gateway.guardrails.input.pii.behavior	serving.AiGatewayGuardrailPiiBehaviorBehavior	INPUT	STATE
-resources.model_serving_endpoints.*.ai_gateway.guardrails.input.safety	bool	INPUT	STATE
-resources.model_serving_endpoints.*.ai_gateway.guardrails.input.valid_topics	[]string	INPUT	STATE
-resources.model_serving_endpoints.*.ai_gateway.guardrails.input.valid_topics[*]	string	INPUT	STATE
-resources.model_serving_endpoints.*.ai_gateway.guardrails.output	*serving.AiGatewayGuardrailParameters	INPUT	STATE
-resources.model_serving_endpoints.*.ai_gateway.guardrails.output.invalid_keywords	[]string	INPUT	STATE
-resources.model_serving_endpoints.*.ai_gateway.guardrails.output.invalid_keywords[*]	string	INPUT	STATE
-resources.model_serving_endpoints.*.ai_gateway.guardrails.output.pii	*serving.AiGatewayGuardrailPiiBehavior	INPUT	STATE
-resources.model_serving_endpoints.*.ai_gateway.guardrails.output.pii.behavior	serving.AiGatewayGuardrailPiiBehaviorBehavior	INPUT	STATE
-resources.model_serving_endpoints.*.ai_gateway.guardrails.output.safety	bool	INPUT	STATE
-resources.model_serving_endpoints.*.ai_gateway.guardrails.output.valid_topics	[]string	INPUT	STATE
-resources.model_serving_endpoints.*.ai_gateway.guardrails.output.valid_topics[*]	string	INPUT	STATE
-resources.model_serving_endpoints.*.ai_gateway.inference_table_config	*serving.AiGatewayInferenceTableConfig	INPUT	STATE
-resources.model_serving_endpoints.*.ai_gateway.inference_table_config.catalog_name	string	INPUT	STATE
-resources.model_serving_endpoints.*.ai_gateway.inference_table_config.enabled	bool	INPUT	STATE
-resources.model_serving_endpoints.*.ai_gateway.inference_table_config.schema_name	string	INPUT	STATE
-resources.model_serving_endpoints.*.ai_gateway.inference_table_config.table_name_prefix	string	INPUT	STATE
-resources.model_serving_endpoints.*.ai_gateway.rate_limits	[]serving.AiGatewayRateLimit	INPUT	STATE
-resources.model_serving_endpoints.*.ai_gateway.rate_limits[*]	serving.AiGatewayRateLimit	INPUT	STATE
-resources.model_serving_endpoints.*.ai_gateway.rate_limits[*].calls	int64	INPUT	STATE
-resources.model_serving_endpoints.*.ai_gateway.rate_limits[*].key	serving.AiGatewayRateLimitKey	INPUT	STATE
-resources.model_serving_endpoints.*.ai_gateway.rate_limits[*].principal	string	INPUT	STATE
-resources.model_serving_endpoints.*.ai_gateway.rate_limits[*].renewal_period	serving.AiGatewayRateLimitRenewalPeriod	INPUT	STATE
-resources.model_serving_endpoints.*.ai_gateway.rate_limits[*].tokens	int64	INPUT	STATE
-resources.model_serving_endpoints.*.ai_gateway.usage_tracking_config	*serving.AiGatewayUsageTrackingConfig	INPUT	STATE
-resources.model_serving_endpoints.*.ai_gateway.usage_tracking_config.enabled	bool	INPUT	STATE
-resources.model_serving_endpoints.*.budget_policy_id	string	INPUT	STATE
-resources.model_serving_endpoints.*.config	*serving.EndpointCoreConfigInput	INPUT	STATE
-resources.model_serving_endpoints.*.config.auto_capture_config	*serving.AutoCaptureConfigInput	INPUT	STATE
-resources.model_serving_endpoints.*.config.auto_capture_config.catalog_name	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.auto_capture_config.enabled	bool	INPUT	STATE
-resources.model_serving_endpoints.*.config.auto_capture_config.schema_name	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.auto_capture_config.table_name_prefix	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities	[]serving.ServedEntityInput	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*]	serving.ServedEntityInput	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].burst_scaling_enabled	bool	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].entity_name	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].entity_version	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].environment_vars	map[string]string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].environment_vars.*	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model	*serving.ExternalModel	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.ai21labs_config	*serving.Ai21LabsConfig	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.ai21labs_config.ai21labs_api_key	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.ai21labs_config.ai21labs_api_key_plaintext	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.amazon_bedrock_config	*serving.AmazonBedrockConfig	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.amazon_bedrock_config.aws_access_key_id	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.amazon_bedrock_config.aws_access_key_id_plaintext	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.amazon_bedrock_config.aws_region	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.amazon_bedrock_config.aws_secret_access_key	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.amazon_bedrock_config.aws_secret_access_key_plaintext	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.amazon_bedrock_config.bedrock_provider	serving.AmazonBedrockConfigBedrockProvider	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.amazon_bedrock_config.instance_profile_arn	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.anthropic_config	*serving.AnthropicConfig	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.anthropic_config.anthropic_api_key	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.anthropic_config.anthropic_api_key_plaintext	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.cohere_config	*serving.CohereConfig	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.cohere_config.cohere_api_base	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.cohere_config.cohere_api_key	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.cohere_config.cohere_api_key_plaintext	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.custom_provider_config	*serving.CustomProviderConfig	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.custom_provider_config.api_key_auth	*serving.ApiKeyAuth	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.custom_provider_config.api_key_auth.key	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.custom_provider_config.api_key_auth.value	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.custom_provider_config.api_key_auth.value_plaintext	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.custom_provider_config.bearer_token_auth	*serving.BearerTokenAuth	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.custom_provider_config.bearer_token_auth.token	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.custom_provider_config.bearer_token_auth.token_plaintext	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.custom_provider_config.custom_provider_url	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.databricks_model_serving_config	*serving.DatabricksModelServingConfig	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.databricks_model_serving_config.databricks_api_token	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.databricks_model_serving_config.databricks_api_token_plaintext	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.databricks_model_serving_config.databricks_workspace_url	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.google_cloud_vertex_ai_config	*serving.GoogleCloudVertexAiConfig	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.google_cloud_vertex_ai_config.private_key	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.google_cloud_vertex_ai_config.private_key_plaintext	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.google_cloud_vertex_ai_config.project_id	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.google_cloud_vertex_ai_config.region	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.name	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.openai_config	*serving.OpenAiConfig	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.openai_config.microsoft_entra_client_id	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.openai_config.microsoft_entra_client_secret	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.openai_config.microsoft_entra_client_secret_plaintext	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.openai_config.microsoft_entra_tenant_id	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.openai_config.openai_api_base	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.openai_config.openai_api_key	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.openai_config.openai_api_key_plaintext	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.openai_config.openai_api_type	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.openai_config.openai_api_version	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.openai_config.openai_deployment_name	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.openai_config.openai_organization	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.palm_config	*serving.PaLmConfig	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.palm_config.palm_api_key	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.palm_config.palm_api_key_plaintext	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.provider	serving.ExternalModelProvider	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].external_model.task	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].instance_profile_arn	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].max_provisioned_concurrency	int	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].max_provisioned_throughput	int	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].min_provisioned_concurrency	int	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].min_provisioned_throughput	int	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].name	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].provisioned_model_units	int64	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].scale_to_zero_enabled	bool	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].workload_size	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_entities[*].workload_type	serving.ServingModelWorkloadType	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_models	[]serving.ServedModelInput	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_models[*]	serving.ServedModelInput	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_models[*].burst_scaling_enabled	bool	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_models[*].environment_vars	map[string]string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_models[*].environment_vars.*	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_models[*].instance_profile_arn	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_models[*].max_provisioned_concurrency	int	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_models[*].max_provisioned_throughput	int	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_models[*].min_provisioned_concurrency	int	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_models[*].min_provisioned_throughput	int	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_models[*].model_name	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_models[*].model_version	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_models[*].name	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_models[*].provisioned_model_units	int64	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_models[*].scale_to_zero_enabled	bool	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_models[*].workload_size	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.served_models[*].workload_type	serving.ServedModelInputWorkloadType	INPUT	STATE
-resources.model_serving_endpoints.*.config.traffic_config	*serving.TrafficConfig	INPUT	STATE
-resources.model_serving_endpoints.*.config.traffic_config.routes	[]serving.Route	INPUT	STATE
-resources.model_serving_endpoints.*.config.traffic_config.routes[*]	serving.Route	INPUT	STATE
-resources.model_serving_endpoints.*.config.traffic_config.routes[*].served_entity_name	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.traffic_config.routes[*].served_model_name	string	INPUT	STATE
-resources.model_serving_endpoints.*.config.traffic_config.routes[*].traffic_percentage	int	INPUT	STATE
-resources.model_serving_endpoints.*.description	string	INPUT	STATE
-resources.model_serving_endpoints.*.email_notifications	*serving.EmailNotifications	INPUT	STATE
-resources.model_serving_endpoints.*.email_notifications.on_update_failure	[]string	INPUT	STATE
-resources.model_serving_endpoints.*.email_notifications.on_update_failure[*]	string	INPUT	STATE
-resources.model_serving_endpoints.*.email_notifications.on_update_success	[]string	INPUT	STATE
-resources.model_serving_endpoints.*.email_notifications.on_update_success[*]	string	INPUT	STATE
+resources.mcp_services.*.comment	string	ALL
+resources.mcp_services.*.config	*catalog.McpServiceConfig	ALL
+resources.mcp_services.*.config.include_tool_selectors	[]string	ALL
+resources.mcp_services.*.config.include_tool_selectors[*]	string	ALL
+resources.mcp_services.*.config.rate_limits	[]catalog.RateLimit	ALL
+resources.mcp_services.*.config.rate_limits[*]	catalog.RateLimit	ALL
+resources.mcp_services.*.config.rate_limits[*].key	catalog.RateLimitRateLimitKey	ALL
+resources.mcp_services.*.config.rate_limits[*].principal	string	ALL
+resources.mcp_services.*.config.rate_limits[*].renewal_period	catalog.RateLimitRateLimitRenewalPeriod	ALL
+resources.mcp_services.*.config.rate_limits[*].requests	int64	ALL
+resources.mcp_services.*.config.rate_limits[*].tokens	int64	ALL
+resources.mcp_services.*.config.source_connection	*catalog.McpServiceConfigSourceConnection	ALL
+resources.mcp_services.*.config.source_connection.is_deleted	bool	ALL
+resources.mcp_services.*.config.source_connection.name	string	ALL
+resources.mcp_services.*.config.source_connection.options	map[string]string	ALL
+resources.mcp_services.*.config.source_connection.options.*	string	ALL
+resources.mcp_services.*.id	string	INPUT
+resources.mcp_services.*.lifecycle	resources.Lifecycle	INPUT
+resources.mcp_services.*.lifecycle.prevent_destroy	bool	INPUT
+resources.mcp_services.*.mcp_service_id	string	ALL
+resources.mcp_services.*.modified_status	string	INPUT
+resources.mcp_services.*.parent	string	ALL
+resources.mcp_services.*.url	string	INPUT
+resources.mcp_services.*.grants.full_name	string	ALL
+resources.mcp_services.*.grants.securable_type	string	ALL
+resources.mcp_services.*.grants[*]	catalog.PrivilegeAssignment	ALL
+resources.mcp_services.*.grants[*].principal	string	ALL
+resources.mcp_services.*.grants[*].privileges	[]catalog.Privilege	ALL
+resources.mcp_services.*.grants[*].privileges[*]	catalog.Privilege	ALL
+resources.model_provider_services.*.comment	string	ALL
+resources.model_provider_services.*.config	*catalog.ModelProviderServiceConfig	ALL
+resources.model_provider_services.*.config.allow_all_targets	bool	ALL
+resources.model_provider_services.*.config.amazon_bedrock	*catalog.ModelProviderServiceConfigAmazonBedrockProviderConfig	ALL
+resources.model_provider_services.*.config.amazon_bedrock.direct	*catalog.ModelProviderServiceConfigAmazonBedrockProviderDirectConfig	ALL
+resources.model_provider_services.*.config.amazon_bedrock.direct.aws_access_key	*catalog.ModelProviderServiceConfigAwsAccessKey	ALL
+resources.model_provider_services.*.config.amazon_bedrock.direct.aws_access_key.access_key_id	string	ALL
+resources.model_provider_services.*.config.amazon_bedrock.direct.aws_access_key.secret_access_key	*catalog.ModelProviderServiceConfigProviderSecret	ALL
+resources.model_provider_services.*.config.amazon_bedrock.direct.aws_access_key.secret_access_key.plaintext	string	ALL
+resources.model_provider_services.*.config.amazon_bedrock.direct.aws_access_key.secret_access_key.secret_reference	*catalog.ModelProviderServiceConfigSecretReference	ALL
+resources.model_provider_services.*.config.amazon_bedrock.direct.aws_access_key.secret_access_key.secret_reference.name	string	ALL
+resources.model_provider_services.*.config.amazon_bedrock.direct.region	string	ALL
+resources.model_provider_services.*.config.amazon_bedrock.direct.service_credential	*catalog.ModelProviderServiceConfigServiceCredential	ALL
+resources.model_provider_services.*.config.amazon_bedrock.direct.service_credential.name	string	ALL
+resources.model_provider_services.*.config.anthropic	*catalog.ModelProviderServiceConfigAnthropicProviderConfig	ALL
+resources.model_provider_services.*.config.anthropic.direct	*catalog.ModelProviderServiceConfigAnthropicProviderDirectConfig	ALL
+resources.model_provider_services.*.config.anthropic.direct.api_key	*catalog.ModelProviderServiceConfigProviderSecret	ALL
+resources.model_provider_services.*.config.anthropic.direct.api_key.plaintext	string	ALL
+resources.model_provider_services.*.config.anthropic.direct.api_key.secret_reference	*catalog.ModelProviderServiceConfigSecretReference	ALL
+resources.model_provider_services.*.config.anthropic.direct.api_key.secret_reference.name	string	ALL
+resources.model_provider_services.*.config.anthropic.relayed	*catalog.ModelProviderServiceConfigAnthropicProviderRelayedConfig	ALL
+resources.model_provider_services.*.config.azure_openai	*catalog.ModelProviderServiceConfigAzureOpenAiProviderConfig	ALL
+resources.model_provider_services.*.config.azure_openai.direct	*catalog.ModelProviderServiceConfigAzureOpenAiProviderDirectConfig	ALL
+resources.model_provider_services.*.config.azure_openai.direct.api_key	*catalog.ModelProviderServiceConfigProviderSecret	ALL
+resources.model_provider_services.*.config.azure_openai.direct.api_key.plaintext	string	ALL
+resources.model_provider_services.*.config.azure_openai.direct.api_key.secret_reference	*catalog.ModelProviderServiceConfigSecretReference	ALL
+resources.model_provider_services.*.config.azure_openai.direct.api_key.secret_reference.name	string	ALL
+resources.model_provider_services.*.config.azure_openai.direct.base_url	string	ALL
+resources.model_provider_services.*.config.azure_openai.direct.entra_service_principal	*catalog.ModelProviderServiceConfigEntraServicePrincipal	ALL
+resources.model_provider_services.*.config.azure_openai.direct.entra_service_principal.client_id	string	ALL
+resources.model_provider_services.*.config.azure_openai.direct.entra_service_principal.client_secret	*catalog.ModelProviderServiceConfigProviderSecret	ALL
+resources.model_provider_services.*.config.azure_openai.direct.entra_service_principal.client_secret.plaintext	string	ALL
+resources.model_provider_services.*.config.azure_openai.direct.entra_service_principal.client_secret.secret_reference	*catalog.ModelProviderServiceConfigSecretReference	ALL
+resources.model_provider_services.*.config.azure_openai.direct.entra_service_principal.client_secret.secret_reference.name	string	ALL
+resources.model_provider_services.*.config.azure_openai.direct.entra_service_principal.tenant_id	string	ALL
+resources.model_provider_services.*.config.azure_openai.direct.service_credential	*catalog.ModelProviderServiceConfigServiceCredential	ALL
+resources.model_provider_services.*.config.azure_openai.direct.service_credential.name	string	ALL
+resources.model_provider_services.*.config.bedrock_mantle	*catalog.ModelProviderServiceConfigAmazonBedrockProviderConfig	ALL
+resources.model_provider_services.*.config.bedrock_mantle.direct	*catalog.ModelProviderServiceConfigAmazonBedrockProviderDirectConfig	ALL
+resources.model_provider_services.*.config.bedrock_mantle.direct.aws_access_key	*catalog.ModelProviderServiceConfigAwsAccessKey	ALL
+resources.model_provider_services.*.config.bedrock_mantle.direct.aws_access_key.access_key_id	string	ALL
+resources.model_provider_services.*.config.bedrock_mantle.direct.aws_access_key.secret_access_key	*catalog.ModelProviderServiceConfigProviderSecret	ALL
+resources.model_provider_services.*.config.bedrock_mantle.direct.aws_access_key.secret_access_key.plaintext	string	ALL
+resources.model_provider_services.*.config.bedrock_mantle.direct.aws_access_key.secret_access_key.secret_reference	*catalog.ModelProviderServiceConfigSecretReference	ALL
+resources.model_provider_services.*.config.bedrock_mantle.direct.aws_access_key.secret_access_key.secret_reference.name	string	ALL
+resources.model_provider_services.*.config.bedrock_mantle.direct.region	string	ALL
+resources.model_provider_services.*.config.bedrock_mantle.direct.service_credential	*catalog.ModelProviderServiceConfigServiceCredential	ALL
+resources.model_provider_services.*.config.bedrock_mantle.direct.service_credential.name	string	ALL
+resources.model_provider_services.*.config.custom	*catalog.ModelProviderServiceConfigCustomProviderConfig	ALL
+resources.model_provider_services.*.config.custom.direct	*catalog.ModelProviderServiceConfigCustomProviderDirectConfig	ALL
+resources.model_provider_services.*.config.custom.direct.api_key	*catalog.ModelProviderServiceConfigProviderSecret	ALL
+resources.model_provider_services.*.config.custom.direct.api_key.plaintext	string	ALL
+resources.model_provider_services.*.config.custom.direct.api_key.secret_reference	*catalog.ModelProviderServiceConfigSecretReference	ALL
+resources.model_provider_services.*.config.custom.direct.api_key.secret_reference.name	string	ALL
+resources.model_provider_services.*.config.custom.direct.base_url	string	ALL
+resources.model_provider_services.*.config.custom.direct.header_auth	*catalog.ModelProviderServiceConfigCustomProviderApiKeyHeaderAuth	ALL
+resources.model_provider_services.*.config.custom.direct.header_auth.api_key_name	string	ALL
+resources.model_provider_services.*.config.custom.direct.header_auth.api_key_value	*catalog.ModelProviderServiceConfigProviderSecret	ALL
+resources.model_provider_services.*.config.custom.direct.header_auth.api_key_value.plaintext	string	ALL
+resources.model_provider_services.*.config.custom.direct.header_auth.api_key_value.secret_reference	*catalog.ModelProviderServiceConfigSecretReference	ALL
+resources.model_provider_services.*.config.custom.direct.header_auth.api_key_value.secret_reference.name	string	ALL
+resources.model_provider_services.*.config.forward_headers	bool	ALL
+resources.model_provider_services.*.config.forward_query_parameters	bool	ALL
+resources.model_provider_services.*.config.forward_unmanaged_paths	bool	ALL
+resources.model_provider_services.*.config.gemini_enterprise	*catalog.ModelProviderServiceConfigGeminiEnterpriseProviderConfig	ALL
+resources.model_provider_services.*.config.gemini_enterprise.direct	*catalog.ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfig	ALL
+resources.model_provider_services.*.config.gemini_enterprise.direct.api_key	*catalog.ModelProviderServiceConfigProviderSecret	ALL
+resources.model_provider_services.*.config.gemini_enterprise.direct.api_key.plaintext	string	ALL
+resources.model_provider_services.*.config.gemini_enterprise.direct.api_key.secret_reference	*catalog.ModelProviderServiceConfigSecretReference	ALL
+resources.model_provider_services.*.config.gemini_enterprise.direct.api_key.secret_reference.name	string	ALL
+resources.model_provider_services.*.config.gemini_enterprise.direct.project_id	string	ALL
+resources.model_provider_services.*.config.gemini_enterprise.direct.region	string	ALL
+resources.model_provider_services.*.config.gemini_enterprise.direct.service_credential	*catalog.ModelProviderServiceConfigServiceCredential	ALL
+resources.model_provider_services.*.config.gemini_enterprise.direct.service_credential.name	string	ALL
+resources.model_provider_services.*.config.inference_table	*catalog.InferenceTableConfig	ALL
+resources.model_provider_services.*.config.inference_table.is_deleted	bool	ALL
+resources.model_provider_services.*.config.inference_table.parent	string	ALL
+resources.model_provider_services.*.config.inference_table.table	string	ALL
+resources.model_provider_services.*.config.inference_table.table_name_prefix	string	ALL
+resources.model_provider_services.*.config.microsoft_foundry	*catalog.ModelProviderServiceConfigMicrosoftFoundryProviderConfig	ALL
+resources.model_provider_services.*.config.microsoft_foundry.direct	*catalog.ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfig	ALL
+resources.model_provider_services.*.config.microsoft_foundry.direct.api_key	*catalog.ModelProviderServiceConfigProviderSecret	ALL
+resources.model_provider_services.*.config.microsoft_foundry.direct.api_key.plaintext	string	ALL
+resources.model_provider_services.*.config.microsoft_foundry.direct.api_key.secret_reference	*catalog.ModelProviderServiceConfigSecretReference	ALL
+resources.model_provider_services.*.config.microsoft_foundry.direct.api_key.secret_reference.name	string	ALL
+resources.model_provider_services.*.config.microsoft_foundry.direct.base_url	string	ALL
+resources.model_provider_services.*.config.microsoft_foundry.direct.entra_service_principal	*catalog.ModelProviderServiceConfigEntraServicePrincipal	ALL
+resources.model_provider_services.*.config.microsoft_foundry.direct.entra_service_principal.client_id	string	ALL
+resources.model_provider_services.*.config.microsoft_foundry.direct.entra_service_principal.client_secret	*catalog.ModelProviderServiceConfigProviderSecret	ALL
+resources.model_provider_services.*.config.microsoft_foundry.direct.entra_service_principal.client_secret.plaintext	string	ALL
+resources.model_provider_services.*.config.microsoft_foundry.direct.entra_service_principal.client_secret.secret_reference	*catalog.ModelProviderServiceConfigSecretReference	ALL
+resources.model_provider_services.*.config.microsoft_foundry.direct.entra_service_principal.client_secret.secret_reference.name	string	ALL
+resources.model_provider_services.*.config.microsoft_foundry.direct.entra_service_principal.tenant_id	string	ALL
+resources.model_provider_services.*.config.microsoft_foundry.direct.service_credential	*catalog.ModelProviderServiceConfigServiceCredential	ALL
+resources.model_provider_services.*.config.microsoft_foundry.direct.service_credential.name	string	ALL
+resources.model_provider_services.*.config.openai	*catalog.ModelProviderServiceConfigOpenAiProviderConfig	ALL
+resources.model_provider_services.*.config.openai.direct	*catalog.ModelProviderServiceConfigOpenAiProviderDirectConfig	ALL
+resources.model_provider_services.*.config.openai.direct.api_key	*catalog.ModelProviderServiceConfigProviderSecret	ALL
+resources.model_provider_services.*.config.openai.direct.api_key.plaintext	string	ALL
+resources.model_provider_services.*.config.openai.direct.api_key.secret_reference	*catalog.ModelProviderServiceConfigSecretReference	ALL
+resources.model_provider_services.*.config.openai.direct.api_key.secret_reference.name	string	ALL
+resources.model_provider_services.*.config.openai.direct.base_url	string	ALL
+resources.model_provider_services.*.config.openai.direct.organization	string	ALL
+resources.model_provider_services.*.config.pricing	*catalog.ModelProviderServiceConfigProviderPricingConfig	ALL
+resources.model_provider_services.*.config.pricing.default_discount_basis_points	int	ALL
+resources.model_provider_services.*.config.provider_type	catalog.ModelProviderServiceConfigExternalModelProviderType	ALL
+resources.model_provider_services.*.config.rate_limits	[]catalog.RateLimit	ALL
+resources.model_provider_services.*.config.rate_limits[*]	catalog.RateLimit	ALL
+resources.model_provider_services.*.config.rate_limits[*].key	catalog.RateLimitRateLimitKey	ALL
+resources.model_provider_services.*.config.rate_limits[*].principal	string	ALL
+resources.model_provider_services.*.config.rate_limits[*].renewal_period	catalog.RateLimitRateLimitRenewalPeriod	ALL
+resources.model_provider_services.*.config.rate_limits[*].requests	int64	ALL
+resources.model_provider_services.*.config.rate_limits[*].tokens	int64	ALL
+resources.model_provider_services.*.config.targets	[]catalog.ModelProviderServiceConfigModelTargetConfig	ALL
+resources.model_provider_services.*.config.targets[*]	catalog.ModelProviderServiceConfigModelTargetConfig	ALL
+resources.model_provider_services.*.config.targets[*].endpoint_route	string	ALL
+resources.model_provider_services.*.config.targets[*].model	string	ALL
+resources.model_provider_services.*.config.targets[*].native_api_types	[]string	ALL
+resources.model_provider_services.*.config.targets[*].native_api_types[*]	string	ALL
+resources.model_provider_services.*.id	string	INPUT
+resources.model_provider_services.*.lifecycle	resources.Lifecycle	INPUT
+resources.model_provider_services.*.lifecycle.prevent_destroy	bool	INPUT
+resources.model_provider_services.*.model_provider_service_id	string	ALL
+resources.model_provider_services.*.modified_status	string	INPUT
+resources.model_provider_services.*.parent	string	ALL
+resources.model_provider_services.*.url	string	INPUT
+resources.model_provider_services.*.grants.full_name	string	ALL
+resources.model_provider_services.*.grants.securable_type	string	ALL
+resources.model_provider_services.*.grants[*]	catalog.PrivilegeAssignment	ALL
+resources.model_provider_services.*.grants[*].principal	string	ALL
+resources.model_provider_services.*.grants[*].privileges	[]catalog.Privilege	ALL
+resources.model_provider_services.*.grants[*].privileges[*]	catalog.Privilege	ALL
+resources.model_services.*.comment	string	ALL
+resources.model_services.*.config	*catalog.ModelServiceConfig	ALL
+resources.model_services.*.config.inference_table	*catalog.InferenceTableConfig	ALL
+resources.model_services.*.config.inference_table.is_deleted	bool	ALL
+resources.model_services.*.config.inference_table.parent	string	ALL
+resources.model_services.*.config.inference_table.table	string	ALL
+resources.model_services.*.config.inference_table.table_name_prefix	string	ALL
+resources.model_services.*.config.rate_limits	[]catalog.RateLimit	ALL
+resources.model_services.*.config.rate_limits[*]	catalog.RateLimit	ALL
+resources.model_services.*.config.rate_limits[*].key	catalog.RateLimitRateLimitKey	ALL
+resources.model_services.*.config.rate_limits[*].principal	string	ALL
+resources.model_services.*.config.rate_limits[*].renewal_period	catalog.RateLimitRateLimitRenewalPeriod	ALL
+resources.model_services.*.config.rate_limits[*].requests	int64	ALL
+resources.model_services.*.config.rate_limits[*].tokens	int64	ALL
+resources.model_services.*.config.routing	*catalog.ModelServiceConfigRoutingConfig	ALL
+resources.model_services.*.config.routing.destinations	[]catalog.ModelServiceConfigDestinationConfig	ALL
+resources.model_services.*.config.routing.destinations[*]	catalog.ModelServiceConfigDestinationConfig	ALL
+resources.model_services.*.config.routing.destinations[*].destination_type	catalog.ModelServiceConfigDestinationConfigDestinationType	ALL
+resources.model_services.*.config.routing.destinations[*].external_model_config	*catalog.ModelServiceConfigExternalModelConfig	ALL
+resources.model_services.*.config.routing.destinations[*].external_model_config.model_provider_service	string	ALL
+resources.model_services.*.config.routing.destinations[*].external_model_config.target	catalog.ModelProviderServiceConfigModelTargetConfig	ALL
+resources.model_services.*.config.routing.destinations[*].external_model_config.target.endpoint_route	string	ALL
+resources.model_services.*.config.routing.destinations[*].external_model_config.target.model	string	ALL
+resources.model_services.*.config.routing.destinations[*].external_model_config.target.native_api_types	[]string	ALL
+resources.model_services.*.config.routing.destinations[*].external_model_config.target.native_api_types[*]	string	ALL
+resources.model_services.*.config.routing.destinations[*].is_deleted	bool	ALL
+resources.model_services.*.config.routing.destinations[*].name	string	ALL
+resources.model_services.*.config.routing.destinations[*].pay_per_token_config	*catalog.ModelServiceConfigPayPerTokenConfig	ALL
+resources.model_services.*.config.routing.destinations[*].pay_per_token_config.model	string	ALL
+resources.model_services.*.config.routing.destinations[*].provisioned_throughput_config	*catalog.ModelServiceConfigProvisionedThroughputConfig	ALL
+resources.model_services.*.config.routing.destinations[*].provisioned_throughput_config.model	string	ALL
+resources.model_services.*.config.routing.destinations[*].provisioned_throughput_config.model_serving_endpoint	string	ALL
+resources.model_services.*.config.routing.destinations[*].traffic_percentage	int	ALL
+resources.model_services.*.config.routing.fallback	*catalog.ModelServiceConfigFallbackConfig	ALL
+resources.model_services.*.config.routing.fallback.destinations	[]catalog.ModelServiceConfigDestinationConfig	ALL
+resources.model_services.*.config.routing.fallback.destinations[*]	catalog.ModelServiceConfigDestinationConfig	ALL
+resources.model_services.*.config.routing.fallback.destinations[*].destination_type	catalog.ModelServiceConfigDestinationConfigDestinationType	ALL
+resources.model_services.*.config.routing.fallback.destinations[*].external_model_config	*catalog.ModelServiceConfigExternalModelConfig	ALL
+resources.model_services.*.config.routing.fallback.destinations[*].external_model_config.model_provider_service	string	ALL
+resources.model_services.*.config.routing.fallback.destinations[*].external_model_config.target	catalog.ModelProviderServiceConfigModelTargetConfig	ALL
+resources.model_services.*.config.routing.fallback.destinations[*].external_model_config.target.endpoint_route	string	ALL
+resources.model_services.*.config.routing.fallback.destinations[*].external_model_config.target.model	string	ALL
+resources.model_services.*.config.routing.fallback.destinations[*].external_model_config.target.native_api_types	[]string	ALL
+resources.model_services.*.config.routing.fallback.destinations[*].external_model_config.target.native_api_types[*]	string	ALL
+resources.model_services.*.config.routing.fallback.destinations[*].is_deleted	bool	ALL
+resources.model_services.*.config.routing.fallback.destinations[*].name	string	ALL
+resources.model_services.*.config.routing.fallback.destinations[*].pay_per_token_config	*catalog.ModelServiceConfigPayPerTokenConfig	ALL
+resources.model_services.*.config.routing.fallback.destinations[*].pay_per_token_config.model	string	ALL
+resources.model_services.*.config.routing.fallback.destinations[*].provisioned_throughput_config	*catalog.ModelServiceConfigProvisionedThroughputConfig	ALL
+resources.model_services.*.config.routing.fallback.destinations[*].provisioned_throughput_config.model	string	ALL
+resources.model_services.*.config.routing.fallback.destinations[*].provisioned_throughput_config.model_serving_endpoint	string	ALL
+resources.model_services.*.config.routing.fallback.destinations[*].traffic_percentage	int	ALL
+resources.model_services.*.id	string	INPUT
+resources.model_services.*.lifecycle	resources.Lifecycle	INPUT
+resources.model_services.*.lifecycle.prevent_destroy	bool	INPUT
+resources.model_services.*.model_service_id	string	ALL
+resources.model_services.*.modified_status	string	INPUT
+resources.model_services.*.parent	string	ALL
+resources.model_services.*.url	string	INPUT
+resources.model_services.*.grants.full_name	string	ALL
+resources.model_services.*.grants.securable_type	string	ALL
+resources.model_services.*.grants[*]	catalog.PrivilegeAssignment	ALL
+resources.model_services.*.grants[*].principal	string	ALL
+resources.model_services.*.grants[*].privileges	[]catalog.Privilege	ALL
+resources.model_services.*.grants[*].privileges[*]	catalog.Privilege	ALL
+resources.model_serving_endpoints.*.ai_gateway	*serving.AiGatewayConfig	ALL
+resources.model_serving_endpoints.*.ai_gateway.fallback_config	*serving.FallbackConfig	ALL
+resources.model_serving_endpoints.*.ai_gateway.fallback_config.enabled	bool	ALL
+resources.model_serving_endpoints.*.ai_gateway.guardrails	*serving.AiGatewayGuardrails	ALL
+resources.model_serving_endpoints.*.ai_gateway.guardrails.input	*serving.AiGatewayGuardrailParameters	ALL
+resources.model_serving_endpoints.*.ai_gateway.guardrails.input.invalid_keywords	[]string	ALL
+resources.model_serving_endpoints.*.ai_gateway.guardrails.input.invalid_keywords[*]	string	ALL
+resources.model_serving_endpoints.*.ai_gateway.guardrails.input.pii	*serving.AiGatewayGuardrailPiiBehavior	ALL
+resources.model_serving_endpoints.*.ai_gateway.guardrails.input.pii.behavior	serving.AiGatewayGuardrailPiiBehaviorBehavior	ALL
+resources.model_serving_endpoints.*.ai_gateway.guardrails.input.safety	bool	ALL
+resources.model_serving_endpoints.*.ai_gateway.guardrails.input.valid_topics	[]string	ALL
+resources.model_serving_endpoints.*.ai_gateway.guardrails.input.valid_topics[*]	string	ALL
+resources.model_serving_endpoints.*.ai_gateway.guardrails.output	*serving.AiGatewayGuardrailParameters	ALL
+resources.model_serving_endpoints.*.ai_gateway.guardrails.output.invalid_keywords	[]string	ALL
+resources.model_serving_endpoints.*.ai_gateway.guardrails.output.invalid_keywords[*]	string	ALL
+resources.model_serving_endpoints.*.ai_gateway.guardrails.output.pii	*serving.AiGatewayGuardrailPiiBehavior	ALL
+resources.model_serving_endpoints.*.ai_gateway.guardrails.output.pii.behavior	serving.AiGatewayGuardrailPiiBehaviorBehavior	ALL
+resources.model_serving_endpoints.*.ai_gateway.guardrails.output.safety	bool	ALL
+resources.model_serving_endpoints.*.ai_gateway.guardrails.output.valid_topics	[]string	ALL
+resources.model_serving_endpoints.*.ai_gateway.guardrails.output.valid_topics[*]	string	ALL
+resources.model_serving_endpoints.*.ai_gateway.inference_table_config	*serving.AiGatewayInferenceTableConfig	ALL
+resources.model_serving_endpoints.*.ai_gateway.inference_table_config.catalog_name	string	ALL
+resources.model_serving_endpoints.*.ai_gateway.inference_table_config.enabled	bool	ALL
+resources.model_serving_endpoints.*.ai_gateway.inference_table_config.schema_name	string	ALL
+resources.model_serving_endpoints.*.ai_gateway.inference_table_config.table_name_prefix	string	ALL
+resources.model_serving_endpoints.*.ai_gateway.rate_limits	[]serving.AiGatewayRateLimit	ALL
+resources.model_serving_endpoints.*.ai_gateway.rate_limits[*]	serving.AiGatewayRateLimit	ALL
+resources.model_serving_endpoints.*.ai_gateway.rate_limits[*].calls	int64	ALL
+resources.model_serving_endpoints.*.ai_gateway.rate_limits[*].key	serving.AiGatewayRateLimitKey	ALL
+resources.model_serving_endpoints.*.ai_gateway.rate_limits[*].principal	string	ALL
+resources.model_serving_endpoints.*.ai_gateway.rate_limits[*].renewal_period	serving.AiGatewayRateLimitRenewalPeriod	ALL
+resources.model_serving_endpoints.*.ai_gateway.rate_limits[*].tokens	int64	ALL
+resources.model_serving_endpoints.*.ai_gateway.usage_tracking_config	*serving.AiGatewayUsageTrackingConfig	ALL
+resources.model_serving_endpoints.*.ai_gateway.usage_tracking_config.enabled	bool	ALL
+resources.model_serving_endpoints.*.budget_policy_id	string	ALL
+resources.model_serving_endpoints.*.config	*serving.EndpointCoreConfigInput	ALL
+resources.model_serving_endpoints.*.config.auto_capture_config	*serving.AutoCaptureConfigInput	ALL
+resources.model_serving_endpoints.*.config.auto_capture_config.catalog_name	string	ALL
+resources.model_serving_endpoints.*.config.auto_capture_config.enabled	bool	ALL
+resources.model_serving_endpoints.*.config.auto_capture_config.schema_name	string	ALL
+resources.model_serving_endpoints.*.config.auto_capture_config.table_name_prefix	string	ALL
+resources.model_serving_endpoints.*.config.served_entities	[]serving.ServedEntityInput	ALL
+resources.model_serving_endpoints.*.config.served_entities[*]	serving.ServedEntityInput	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].burst_scaling_enabled	bool	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].entity_name	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].entity_version	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].environment_vars	map[string]string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].environment_vars.*	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model	*serving.ExternalModel	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.ai21labs_config	*serving.Ai21LabsConfig	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.ai21labs_config.ai21labs_api_key	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.ai21labs_config.ai21labs_api_key_plaintext	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.amazon_bedrock_config	*serving.AmazonBedrockConfig	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.amazon_bedrock_config.aws_access_key_id	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.amazon_bedrock_config.aws_access_key_id_plaintext	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.amazon_bedrock_config.aws_region	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.amazon_bedrock_config.aws_secret_access_key	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.amazon_bedrock_config.aws_secret_access_key_plaintext	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.amazon_bedrock_config.bedrock_provider	serving.AmazonBedrockConfigBedrockProvider	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.amazon_bedrock_config.instance_profile_arn	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.amazon_bedrock_config.uc_service_credential_name	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.anthropic_config	*serving.AnthropicConfig	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.anthropic_config.anthropic_api_key	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.anthropic_config.anthropic_api_key_plaintext	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.cohere_config	*serving.CohereConfig	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.cohere_config.cohere_api_base	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.cohere_config.cohere_api_key	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.cohere_config.cohere_api_key_plaintext	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.custom_provider_config	*serving.CustomProviderConfig	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.custom_provider_config.api_key_auth	*serving.ApiKeyAuth	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.custom_provider_config.api_key_auth.key	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.custom_provider_config.api_key_auth.value	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.custom_provider_config.api_key_auth.value_plaintext	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.custom_provider_config.bearer_token_auth	*serving.BearerTokenAuth	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.custom_provider_config.bearer_token_auth.token	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.custom_provider_config.bearer_token_auth.token_plaintext	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.custom_provider_config.custom_provider_url	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.databricks_model_serving_config	*serving.DatabricksModelServingConfig	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.databricks_model_serving_config.databricks_api_token	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.databricks_model_serving_config.databricks_api_token_plaintext	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.databricks_model_serving_config.databricks_workspace_url	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.google_cloud_vertex_ai_config	*serving.GoogleCloudVertexAiConfig	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.google_cloud_vertex_ai_config.private_key	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.google_cloud_vertex_ai_config.private_key_plaintext	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.google_cloud_vertex_ai_config.project_id	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.google_cloud_vertex_ai_config.region	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.name	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.openai_config	*serving.OpenAiConfig	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.openai_config.microsoft_entra_client_id	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.openai_config.microsoft_entra_client_secret	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.openai_config.microsoft_entra_client_secret_plaintext	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.openai_config.microsoft_entra_tenant_id	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.openai_config.openai_api_base	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.openai_config.openai_api_key	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.openai_config.openai_api_key_plaintext	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.openai_config.openai_api_type	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.openai_config.openai_api_version	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.openai_config.openai_deployment_name	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.openai_config.openai_organization	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.palm_config	*serving.PaLmConfig	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.palm_config.palm_api_key	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.palm_config.palm_api_key_plaintext	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.provider	serving.ExternalModelProvider	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].external_model.task	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].instance_profile_arn	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].max_provisioned_concurrency	int	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].max_provisioned_throughput	int	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].min_provisioned_concurrency	int	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].min_provisioned_throughput	int	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].name	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].provisioned_model_units	int64	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].scale_to_zero_enabled	bool	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].workload_size	string	ALL
+resources.model_serving_endpoints.*.config.served_entities[*].workload_type	serving.ServingModelWorkloadType	ALL
+resources.model_serving_endpoints.*.config.served_models	[]serving.ServedModelInput	ALL
+resources.model_serving_endpoints.*.config.served_models[*]	serving.ServedModelInput	ALL
+resources.model_serving_endpoints.*.config.served_models[*].burst_scaling_enabled	bool	ALL
+resources.model_serving_endpoints.*.config.served_models[*].environment_vars	map[string]string	ALL
+resources.model_serving_endpoints.*.config.served_models[*].environment_vars.*	string	ALL
+resources.model_serving_endpoints.*.config.served_models[*].instance_profile_arn	string	ALL
+resources.model_serving_endpoints.*.config.served_models[*].max_provisioned_concurrency	int	ALL
+resources.model_serving_endpoints.*.config.served_models[*].max_provisioned_throughput	int	ALL
+resources.model_serving_endpoints.*.config.served_models[*].min_provisioned_concurrency	int	ALL
+resources.model_serving_endpoints.*.config.served_models[*].min_provisioned_throughput	int	ALL
+resources.model_serving_endpoints.*.config.served_models[*].model_name	string	ALL
+resources.model_serving_endpoints.*.config.served_models[*].model_version	string	ALL
+resources.model_serving_endpoints.*.config.served_models[*].name	string	ALL
+resources.model_serving_endpoints.*.config.served_models[*].provisioned_model_units	int64	ALL
+resources.model_serving_endpoints.*.config.served_models[*].scale_to_zero_enabled	bool	ALL
+resources.model_serving_endpoints.*.config.served_models[*].workload_size	string	ALL
+resources.model_serving_endpoints.*.config.served_models[*].workload_type	serving.ServedModelInputWorkloadType	ALL
+resources.model_serving_endpoints.*.config.traffic_config	*serving.TrafficConfig	ALL
+resources.model_serving_endpoints.*.config.traffic_config.routes	[]serving.Route	ALL
+resources.model_serving_endpoints.*.config.traffic_config.routes[*]	serving.Route	ALL
+resources.model_serving_endpoints.*.config.traffic_config.routes[*].served_entity_name	string	ALL
+resources.model_serving_endpoints.*.config.traffic_config.routes[*].served_model_name	string	ALL
+resources.model_serving_endpoints.*.config.traffic_config.routes[*].traffic_percentage	int	ALL
+resources.model_serving_endpoints.*.description	string	ALL
+resources.model_serving_endpoints.*.email_notifications	*serving.EmailNotifications	ALL
+resources.model_serving_endpoints.*.email_notifications.on_update_failure	[]string	ALL
+resources.model_serving_endpoints.*.email_notifications.on_update_failure[*]	string	ALL
+resources.model_serving_endpoints.*.email_notifications.on_update_success	[]string	ALL
+resources.model_serving_endpoints.*.email_notifications.on_update_success[*]	string	ALL
 resources.model_serving_endpoints.*.endpoint_details	*serving.ServingEndpointDetailed	REMOTE
 resources.model_serving_endpoints.*.endpoint_details.ai_gateway	*serving.AiGatewayConfig	REMOTE
 resources.model_serving_endpoints.*.endpoint_details.ai_gateway.fallback_config	*serving.FallbackConfig	REMOTE
@@ -1856,6 +2771,7 @@ resources.model_serving_endpoints.*.endpoint_details.config.served_entities[*].e
 resources.model_serving_endpoints.*.endpoint_details.config.served_entities[*].external_model.amazon_bedrock_config.aws_secret_access_key_plaintext	string	REMOTE
 resources.model_serving_endpoints.*.endpoint_details.config.served_entities[*].external_model.amazon_bedrock_config.bedrock_provider	serving.AmazonBedrockConfigBedrockProvider	REMOTE
 resources.model_serving_endpoints.*.endpoint_details.config.served_entities[*].external_model.amazon_bedrock_config.instance_profile_arn	string	REMOTE
+resources.model_serving_endpoints.*.endpoint_details.config.served_entities[*].external_model.amazon_bedrock_config.uc_service_credential_name	string	REMOTE
 resources.model_serving_endpoints.*.endpoint_details.config.served_entities[*].external_model.anthropic_config	*serving.AnthropicConfig	REMOTE
 resources.model_serving_endpoints.*.endpoint_details.config.served_entities[*].external_model.anthropic_config.anthropic_api_key	string	REMOTE
 resources.model_serving_endpoints.*.endpoint_details.config.served_entities[*].external_model.anthropic_config.anthropic_api_key_plaintext	string	REMOTE
@@ -1992,6 +2908,7 @@ resources.model_serving_endpoints.*.endpoint_details.pending_config.served_entit
 resources.model_serving_endpoints.*.endpoint_details.pending_config.served_entities[*].external_model.amazon_bedrock_config.aws_secret_access_key_plaintext	string	REMOTE
 resources.model_serving_endpoints.*.endpoint_details.pending_config.served_entities[*].external_model.amazon_bedrock_config.bedrock_provider	serving.AmazonBedrockConfigBedrockProvider	REMOTE
 resources.model_serving_endpoints.*.endpoint_details.pending_config.served_entities[*].external_model.amazon_bedrock_config.instance_profile_arn	string	REMOTE
+resources.model_serving_endpoints.*.endpoint_details.pending_config.served_entities[*].external_model.amazon_bedrock_config.uc_service_credential_name	string	REMOTE
 resources.model_serving_endpoints.*.endpoint_details.pending_config.served_entities[*].external_model.anthropic_config	*serving.AnthropicConfig	REMOTE
 resources.model_serving_endpoints.*.endpoint_details.pending_config.served_entities[*].external_model.anthropic_config.anthropic_api_key	string	REMOTE
 resources.model_serving_endpoints.*.endpoint_details.pending_config.served_entities[*].external_model.anthropic_config.anthropic_api_key_plaintext	string	REMOTE
@@ -2090,22 +3007,46 @@ resources.model_serving_endpoints.*.endpoint_details.tags[*]	serving.EndpointTag
 resources.model_serving_endpoints.*.endpoint_details.tags[*].key	string	REMOTE
 resources.model_serving_endpoints.*.endpoint_details.tags[*].value	string	REMOTE
 resources.model_serving_endpoints.*.endpoint_details.task	string	REMOTE
+resources.model_serving_endpoints.*.endpoint_details.telemetry_config	*serving.TelemetryConfig	REMOTE
+resources.model_serving_endpoints.*.endpoint_details.telemetry_config.enabled_telemetry_features	[]serving.TelemetryFeature	REMOTE
+resources.model_serving_endpoints.*.endpoint_details.telemetry_config.enabled_telemetry_features[*]	serving.TelemetryFeature	REMOTE
+resources.model_serving_endpoints.*.endpoint_details.telemetry_config.inference_table_config	*serving.TelemetryInferenceTableConfig	REMOTE
+resources.model_serving_endpoints.*.endpoint_details.telemetry_config.inference_table_config.name	string	REMOTE
+resources.model_serving_endpoints.*.endpoint_details.telemetry_config.inference_table_config.sampling_fraction	float64	REMOTE
+resources.model_serving_endpoints.*.endpoint_details.telemetry_config.table_names	*serving.UnityCatalogTableNames	REMOTE
+resources.model_serving_endpoints.*.endpoint_details.telemetry_config.table_names.annotations_table	string	REMOTE
+resources.model_serving_endpoints.*.endpoint_details.telemetry_config.table_names.logs_table	string	REMOTE
+resources.model_serving_endpoints.*.endpoint_details.telemetry_config.table_names.metrics_table	string	REMOTE
+resources.model_serving_endpoints.*.endpoint_details.telemetry_config.table_names.traces_table	string	REMOTE
+resources.model_serving_endpoints.*.endpoint_details.telemetry_config.telemetry_profile_id	string	REMOTE
 resources.model_serving_endpoints.*.endpoint_id	string	REMOTE
 resources.model_serving_endpoints.*.id	string	INPUT
 resources.model_serving_endpoints.*.lifecycle	resources.Lifecycle	INPUT
 resources.model_serving_endpoints.*.lifecycle.prevent_destroy	bool	INPUT
 resources.model_serving_endpoints.*.modified_status	string	INPUT
-resources.model_serving_endpoints.*.name	string	INPUT	STATE
+resources.model_serving_endpoints.*.name	string	ALL
 resources.model_serving_endpoints.*.rate_limits	[]serving.RateLimit	INPUT	STATE
 resources.model_serving_endpoints.*.rate_limits[*]	serving.RateLimit	INPUT	STATE
 resources.model_serving_endpoints.*.rate_limits[*].calls	int64	INPUT	STATE
 resources.model_serving_endpoints.*.rate_limits[*].key	serving.RateLimitKey	INPUT	STATE
 resources.model_serving_endpoints.*.rate_limits[*].renewal_period	serving.RateLimitRenewalPeriod	INPUT	STATE
-resources.model_serving_endpoints.*.route_optimized	bool	INPUT	STATE
-resources.model_serving_endpoints.*.tags	[]serving.EndpointTag	INPUT	STATE
-resources.model_serving_endpoints.*.tags[*]	serving.EndpointTag	INPUT	STATE
-resources.model_serving_endpoints.*.tags[*].key	string	INPUT	STATE
-resources.model_serving_endpoints.*.tags[*].value	string	INPUT	STATE
+resources.model_serving_endpoints.*.route_optimized	bool	ALL
+resources.model_serving_endpoints.*.tags	[]serving.EndpointTag	ALL
+resources.model_serving_endpoints.*.tags[*]	serving.EndpointTag	ALL
+resources.model_serving_endpoints.*.tags[*].key	string	ALL
+resources.model_serving_endpoints.*.tags[*].value	string	ALL
+resources.model_serving_endpoints.*.telemetry_config	*serving.TelemetryConfig	ALL
+resources.model_serving_endpoints.*.telemetry_config.enabled_telemetry_features	[]serving.TelemetryFeature	ALL
+resources.model_serving_endpoints.*.telemetry_config.enabled_telemetry_features[*]	serving.TelemetryFeature	ALL
+resources.model_serving_endpoints.*.telemetry_config.inference_table_config	*serving.TelemetryInferenceTableConfig	ALL
+resources.model_serving_endpoints.*.telemetry_config.inference_table_config.name	string	ALL
+resources.model_serving_endpoints.*.telemetry_config.inference_table_config.sampling_fraction	float64	ALL
+resources.model_serving_endpoints.*.telemetry_config.table_names	*serving.UnityCatalogTableNames	ALL
+resources.model_serving_endpoints.*.telemetry_config.table_names.annotations_table	string	ALL
+resources.model_serving_endpoints.*.telemetry_config.table_names.logs_table	string	ALL
+resources.model_serving_endpoints.*.telemetry_config.table_names.metrics_table	string	ALL
+resources.model_serving_endpoints.*.telemetry_config.table_names.traces_table	string	ALL
+resources.model_serving_endpoints.*.telemetry_config.telemetry_profile_id	string	ALL
 resources.model_serving_endpoints.*.url	string	INPUT
 resources.model_serving_endpoints.*.permissions.object_id	string	ALL
 resources.model_serving_endpoints.*.permissions[*]	dresources.StatePermission	ALL
@@ -2155,6 +3096,7 @@ resources.models.*.permissions[*].service_principal_name	string	ALL
 resources.models.*.permissions[*].user_name	string	ALL
 resources.pipelines.*.allow_duplicate_names	bool	ALL
 resources.pipelines.*.budget_policy_id	string	ALL
+resources.pipelines.*.cascade_on_destroy	*bool	INPUT	STATE
 resources.pipelines.*.catalog	string	ALL
 resources.pipelines.*.cause	string	REMOTE
 resources.pipelines.*.channel	string	ALL
@@ -2179,6 +3121,7 @@ resources.pipelines.*.clusters[*].aws_attributes.spot_bid_price_percent	int	ALL
 resources.pipelines.*.clusters[*].aws_attributes.zone_id	string	ALL
 resources.pipelines.*.clusters[*].azure_attributes	*compute.AzureAttributes	ALL
 resources.pipelines.*.clusters[*].azure_attributes.availability	compute.AzureAvailability	ALL
+resources.pipelines.*.clusters[*].azure_attributes.capacity_reservation_group	string	ALL
 resources.pipelines.*.clusters[*].azure_attributes.first_on_demand	int	ALL
 resources.pipelines.*.clusters[*].azure_attributes.log_analytics_info	*compute.LogAnalyticsInfo	ALL
 resources.pipelines.*.clusters[*].azure_attributes.log_analytics_info.log_analytics_primary_key	string	ALL
@@ -2205,6 +3148,7 @@ resources.pipelines.*.clusters[*].enable_local_disk_encryption	bool	ALL
 resources.pipelines.*.clusters[*].gcp_attributes	*compute.GcpAttributes	ALL
 resources.pipelines.*.clusters[*].gcp_attributes.availability	compute.GcpAvailability	ALL
 resources.pipelines.*.clusters[*].gcp_attributes.boot_disk_size	int	ALL
+resources.pipelines.*.clusters[*].gcp_attributes.confidential_compute_type	compute.ConfidentialComputeType	ALL
 resources.pipelines.*.clusters[*].gcp_attributes.first_on_demand	int	ALL
 resources.pipelines.*.clusters[*].gcp_attributes.google_service_account	string	ALL
 resources.pipelines.*.clusters[*].gcp_attributes.local_ssd_count	int	ALL
@@ -2248,13 +3192,16 @@ resources.pipelines.*.configuration.*	string	ALL
 resources.pipelines.*.continuous	bool	ALL
 resources.pipelines.*.creator_user_name	string	REMOTE
 resources.pipelines.*.deployment	*pipelines.PipelineDeployment	ALL
+resources.pipelines.*.deployment.deployment_id	string	ALL
 resources.pipelines.*.deployment.kind	pipelines.DeploymentKind	ALL
 resources.pipelines.*.deployment.metadata_file_path	string	ALL
+resources.pipelines.*.deployment.version_id	string	ALL
 resources.pipelines.*.development	bool	ALL
 resources.pipelines.*.dry_run	bool	ALL
 resources.pipelines.*.edition	string	ALL
 resources.pipelines.*.effective_budget_policy_id	string	REMOTE
 resources.pipelines.*.effective_publishing_mode	pipelines.PublishingMode	REMOTE
+resources.pipelines.*.effective_serverless_compute_id	string	REMOTE
 resources.pipelines.*.environment	*pipelines.PipelinesEnvironment	ALL
 resources.pipelines.*.environment.dependencies	[]string	ALL
 resources.pipelines.*.environment.dependencies[*]	string	ALL
@@ -2304,6 +3251,9 @@ resources.pipelines.*.ingestion_definition.objects[*].report.table_configuration
 resources.pipelines.*.ingestion_definition.objects[*].report.table_configuration.auto_full_refresh_policy	*pipelines.AutoFullRefreshPolicy	ALL
 resources.pipelines.*.ingestion_definition.objects[*].report.table_configuration.auto_full_refresh_policy.enabled	bool	ALL
 resources.pipelines.*.ingestion_definition.objects[*].report.table_configuration.auto_full_refresh_policy.min_interval_hours	int	ALL
+resources.pipelines.*.ingestion_definition.objects[*].report.table_configuration.clustering_columns	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].report.table_configuration.clustering_columns[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].report.table_configuration.enable_auto_clustering	bool	ALL
 resources.pipelines.*.ingestion_definition.objects[*].report.table_configuration.exclude_columns	[]string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].report.table_configuration.exclude_columns[*]	string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].report.table_configuration.include_columns	[]string	ALL
@@ -2320,6 +3270,9 @@ resources.pipelines.*.ingestion_definition.objects[*].report.table_configuration
 resources.pipelines.*.ingestion_definition.objects[*].report.table_configuration.scd_type	pipelines.TableSpecificConfigScdType	ALL
 resources.pipelines.*.ingestion_definition.objects[*].report.table_configuration.sequence_by	[]string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].report.table_configuration.sequence_by[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].report.table_configuration.source_metadata_column	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].report.table_configuration.table_properties	map[string]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].report.table_configuration.table_properties.*	string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].report.table_configuration.workday_report_parameters	*pipelines.IngestionPipelineDefinitionWorkdayReportParameters	ALL
 resources.pipelines.*.ingestion_definition.objects[*].report.table_configuration.workday_report_parameters.incremental	bool	ALL
 resources.pipelines.*.ingestion_definition.objects[*].report.table_configuration.workday_report_parameters.parameters	map[string]string	ALL
@@ -2330,6 +3283,12 @@ resources.pipelines.*.ingestion_definition.objects[*].report.table_configuration
 resources.pipelines.*.ingestion_definition.objects[*].report.table_configuration.workday_report_parameters.report_parameters[*].value	string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].schema	*pipelines.SchemaSpec	ALL
 resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options	*pipelines.ConnectorOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.api_source_connector_options	*pipelines.ApiSourceConnectorOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.api_source_connector_options.options	map[string]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.api_source_connector_options.options.*	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.confluence_options	*pipelines.ConfluenceConnectorOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.confluence_options.include_confluence_spaces	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.confluence_options.include_confluence_spaces[*]	string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.gdrive_options	*pipelines.GoogleDriveOptions	ALL
 resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.gdrive_options.entity_type	pipelines.GoogleDriveOptionsGoogleDriveEntityType	ALL
 resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.gdrive_options.file_ingestion_options	*pipelines.FileIngestionOptions	ALL
@@ -2351,9 +3310,148 @@ resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.g
 resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.gdrive_options.file_ingestion_options.single_variant_column	string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.gdrive_options.url	string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.google_ads_options	*pipelines.GoogleAdsOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.google_ads_options.custom_report_options	*pipelines.GoogleAdsCustomReportOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.google_ads_options.custom_report_options.metrics	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.google_ads_options.custom_report_options.metrics[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.google_ads_options.custom_report_options.resource	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.google_ads_options.custom_report_options.resource_fields	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.google_ads_options.custom_report_options.resource_fields[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.google_ads_options.custom_report_options.segments	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.google_ads_options.custom_report_options.segments[*]	string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.google_ads_options.lookback_window_days	int	ALL
 resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.google_ads_options.manager_account_id	string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.google_ads_options.sync_start_date	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.jira_options	*pipelines.JiraConnectorOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.jira_options.include_jira_spaces	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.jira_options.include_jira_spaces[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options	*pipelines.KafkaOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.client_config	map[string]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.client_config.*	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.key_transformer	*pipelines.Transformer	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.key_transformer.avro_options	*pipelines.AvroTransformerOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.key_transformer.avro_options.parse_mode	pipelines.ParseMode	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.key_transformer.avro_options.schema	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.key_transformer.avro_options.schema_file_path	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.key_transformer.avro_options.schema_registry	*pipelines.SchemaRegistryConfig	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.key_transformer.avro_options.schema_registry.confluent_options	*pipelines.ConfluentSchemaRegistryOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.key_transformer.avro_options.schema_registry.confluent_options.subject	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.key_transformer.avro_options.schema_registry.connection_name	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.key_transformer.avro_options.schema_registry.protobuf_message_name	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.key_transformer.format	pipelines.TransformerFormat	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.key_transformer.input_column	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.key_transformer.json_options	*pipelines.JsonTransformerOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.key_transformer.json_options.as_variant	bool	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.key_transformer.json_options.schema	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.key_transformer.json_options.schema_evolution_mode	pipelines.FileIngestionOptionsSchemaEvolutionMode	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.key_transformer.json_options.schema_file_path	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.key_transformer.json_options.schema_hints	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.key_transformer.output_column	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.key_transformer.protobuf_options	*pipelines.ProtobufTransformerOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.key_transformer.protobuf_options.desc_file_path	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.key_transformer.protobuf_options.message_name	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.key_transformer.protobuf_options.parse_mode	pipelines.ParseMode	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.key_transformer.protobuf_options.recursive_fields_max_depth	int	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.key_transformer.protobuf_options.schema_registry	*pipelines.SchemaRegistryConfig	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.key_transformer.protobuf_options.schema_registry.confluent_options	*pipelines.ConfluentSchemaRegistryOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.key_transformer.protobuf_options.schema_registry.confluent_options.subject	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.key_transformer.protobuf_options.schema_registry.connection_name	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.key_transformer.protobuf_options.schema_registry.protobuf_message_name	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.max_offsets_per_trigger	int64	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.starting_offset	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.topic_pattern	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.topics	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.topics[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.value_transformer	*pipelines.Transformer	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.value_transformer.avro_options	*pipelines.AvroTransformerOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.value_transformer.avro_options.parse_mode	pipelines.ParseMode	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.value_transformer.avro_options.schema	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.value_transformer.avro_options.schema_file_path	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.value_transformer.avro_options.schema_registry	*pipelines.SchemaRegistryConfig	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.value_transformer.avro_options.schema_registry.confluent_options	*pipelines.ConfluentSchemaRegistryOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.value_transformer.avro_options.schema_registry.confluent_options.subject	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.value_transformer.avro_options.schema_registry.connection_name	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.value_transformer.avro_options.schema_registry.protobuf_message_name	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.value_transformer.format	pipelines.TransformerFormat	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.value_transformer.input_column	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.value_transformer.json_options	*pipelines.JsonTransformerOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.value_transformer.json_options.as_variant	bool	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.value_transformer.json_options.schema	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.value_transformer.json_options.schema_evolution_mode	pipelines.FileIngestionOptionsSchemaEvolutionMode	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.value_transformer.json_options.schema_file_path	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.value_transformer.json_options.schema_hints	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.value_transformer.output_column	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.value_transformer.protobuf_options	*pipelines.ProtobufTransformerOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.value_transformer.protobuf_options.desc_file_path	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.value_transformer.protobuf_options.message_name	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.value_transformer.protobuf_options.parse_mode	pipelines.ParseMode	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.value_transformer.protobuf_options.recursive_fields_max_depth	int	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.value_transformer.protobuf_options.schema_registry	*pipelines.SchemaRegistryConfig	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.value_transformer.protobuf_options.schema_registry.confluent_options	*pipelines.ConfluentSchemaRegistryOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.value_transformer.protobuf_options.schema_registry.confluent_options.subject	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.value_transformer.protobuf_options.schema_registry.connection_name	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.value_transformer.protobuf_options.schema_registry.protobuf_message_name	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.linkedin_ads_options	*pipelines.LinkedInAdsOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.linkedin_ads_options.custom_report_options	*pipelines.LinkedInAdsOptionsLinkedInAdsCustomReportOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.linkedin_ads_options.custom_report_options.entity_granularity	[]pipelines.LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsEntityGranularity	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.linkedin_ads_options.custom_report_options.entity_granularity[*]	pipelines.LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsEntityGranularity	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.linkedin_ads_options.custom_report_options.finder	pipelines.LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsFinder	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.linkedin_ads_options.custom_report_options.metrics	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.linkedin_ads_options.custom_report_options.metrics[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.linkedin_ads_options.custom_report_options.time_granularity	pipelines.LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsTimeGranularity	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.linkedin_ads_options.lookback_window_days	int	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.linkedin_ads_options.sync_start_date	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.marketo_options	*pipelines.MarketoOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.marketo_options.sync_start_date	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.meta_ads_options	*pipelines.MetaMarketingOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.meta_ads_options.action_attribution_windows	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.meta_ads_options.action_attribution_windows[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.meta_ads_options.action_breakdowns	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.meta_ads_options.action_breakdowns[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.meta_ads_options.action_report_time	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.meta_ads_options.breakdowns	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.meta_ads_options.breakdowns[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.meta_ads_options.custom_insights_lookback_window	int	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.meta_ads_options.custom_report_options	*pipelines.MetaMarketingOptionsMetaMarketingCustomReportOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.meta_ads_options.custom_report_options.action_attribution_windows	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.meta_ads_options.custom_report_options.action_attribution_windows[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.meta_ads_options.custom_report_options.action_breakdowns	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.meta_ads_options.custom_report_options.action_breakdowns[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.meta_ads_options.custom_report_options.action_report_time	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.meta_ads_options.custom_report_options.breakdowns	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.meta_ads_options.custom_report_options.breakdowns[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.meta_ads_options.custom_report_options.level	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.meta_ads_options.custom_report_options.time_increment	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.meta_ads_options.level	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.meta_ads_options.start_date	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.meta_ads_options.time_increment	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.outlook_options	*pipelines.OutlookOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.outlook_options.attachment_mode	pipelines.OutlookAttachmentMode	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.outlook_options.body_format	pipelines.OutlookBodyFormat	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.outlook_options.folder_filter	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.outlook_options.folder_filter[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.outlook_options.include_folders	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.outlook_options.include_folders[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.outlook_options.include_mailboxes	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.outlook_options.include_mailboxes[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.outlook_options.include_senders	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.outlook_options.include_senders[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.outlook_options.include_subjects	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.outlook_options.include_subjects[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.outlook_options.sender_filter	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.outlook_options.sender_filter[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.outlook_options.start_date	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.outlook_options.subject_filter	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.outlook_options.subject_filter[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.rabbitmq_options	*pipelines.RabbitmqOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.rabbitmq_options.queue	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.reddit_ads_options	*pipelines.RedditAdsOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.reddit_ads_options.custom_report_options	*pipelines.RedditAdsOptionsRedditAdsCustomReportOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.reddit_ads_options.custom_report_options.breakdowns	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.reddit_ads_options.custom_report_options.breakdowns[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.reddit_ads_options.custom_report_options.fields	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.reddit_ads_options.custom_report_options.fields[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.reddit_ads_options.lookback_window_days	int	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.reddit_ads_options.sync_start_date	string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.sharepoint_options	*pipelines.SharepointOptions	ALL
 resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.sharepoint_options.entity_type	pipelines.SharepointOptionsSharepointEntityType	ALL
 resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.sharepoint_options.file_ingestion_options	*pipelines.FileIngestionOptions	ALL
@@ -2374,7 +3472,17 @@ resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.s
 resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.sharepoint_options.file_ingestion_options.schema_hints	string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.sharepoint_options.file_ingestion_options.single_variant_column	string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.sharepoint_options.url	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.smartsheet_options	*pipelines.SmartsheetOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.smartsheet_options.enforce_schema	bool	ALL
 resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.tiktok_ads_options	*pipelines.TikTokAdsOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.tiktok_ads_options.custom_report_options	*pipelines.TikTokAdsOptionsTikTokAdsCustomReportOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.tiktok_ads_options.custom_report_options.data_level	pipelines.TikTokAdsOptionsTikTokDataLevel	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.tiktok_ads_options.custom_report_options.dimensions	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.tiktok_ads_options.custom_report_options.dimensions[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.tiktok_ads_options.custom_report_options.metrics	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.tiktok_ads_options.custom_report_options.metrics[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.tiktok_ads_options.custom_report_options.query_lifetime	bool	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.tiktok_ads_options.custom_report_options.report_type	pipelines.TikTokAdsOptionsTikTokReportType	ALL
 resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.tiktok_ads_options.data_level	pipelines.TikTokAdsOptionsTikTokDataLevel	ALL
 resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.tiktok_ads_options.dimensions	[]string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.tiktok_ads_options.dimensions[*]	string	ALL
@@ -2384,14 +3492,51 @@ resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.t
 resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.tiktok_ads_options.query_lifetime	bool	ALL
 resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.tiktok_ads_options.report_type	pipelines.TikTokAdsOptionsTikTokReportType	ALL
 resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.tiktok_ads_options.sync_start_date	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.zendesk_support_options	*pipelines.ZendeskSupportOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.zendesk_support_options.start_date	string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].schema.destination_catalog	string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].schema.destination_schema	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.fanout_options	*pipelines.IngestionPipelineDefinitionFanoutOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.fanout_options.fanout_by	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.fanout_options.transforms	[]pipelines.Transformer	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.fanout_options.transforms[*]	pipelines.Transformer	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.fanout_options.transforms[*].avro_options	*pipelines.AvroTransformerOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.fanout_options.transforms[*].avro_options.parse_mode	pipelines.ParseMode	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.fanout_options.transforms[*].avro_options.schema	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.fanout_options.transforms[*].avro_options.schema_file_path	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.fanout_options.transforms[*].avro_options.schema_registry	*pipelines.SchemaRegistryConfig	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.fanout_options.transforms[*].avro_options.schema_registry.confluent_options	*pipelines.ConfluentSchemaRegistryOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.fanout_options.transforms[*].avro_options.schema_registry.confluent_options.subject	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.fanout_options.transforms[*].avro_options.schema_registry.connection_name	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.fanout_options.transforms[*].avro_options.schema_registry.protobuf_message_name	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.fanout_options.transforms[*].format	pipelines.TransformerFormat	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.fanout_options.transforms[*].input_column	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.fanout_options.transforms[*].json_options	*pipelines.JsonTransformerOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.fanout_options.transforms[*].json_options.as_variant	bool	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.fanout_options.transforms[*].json_options.schema	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.fanout_options.transforms[*].json_options.schema_evolution_mode	pipelines.FileIngestionOptionsSchemaEvolutionMode	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.fanout_options.transforms[*].json_options.schema_file_path	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.fanout_options.transforms[*].json_options.schema_hints	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.fanout_options.transforms[*].output_column	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.fanout_options.transforms[*].protobuf_options	*pipelines.ProtobufTransformerOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.fanout_options.transforms[*].protobuf_options.desc_file_path	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.fanout_options.transforms[*].protobuf_options.message_name	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.fanout_options.transforms[*].protobuf_options.parse_mode	pipelines.ParseMode	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.fanout_options.transforms[*].protobuf_options.recursive_fields_max_depth	int	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.fanout_options.transforms[*].protobuf_options.schema_registry	*pipelines.SchemaRegistryConfig	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.fanout_options.transforms[*].protobuf_options.schema_registry.confluent_options	*pipelines.ConfluentSchemaRegistryOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.fanout_options.transforms[*].protobuf_options.schema_registry.confluent_options.subject	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.fanout_options.transforms[*].protobuf_options.schema_registry.connection_name	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.fanout_options.transforms[*].protobuf_options.schema_registry.protobuf_message_name	string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].schema.source_catalog	string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].schema.source_schema	string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].schema.table_configuration	*pipelines.TableSpecificConfig	ALL
 resources.pipelines.*.ingestion_definition.objects[*].schema.table_configuration.auto_full_refresh_policy	*pipelines.AutoFullRefreshPolicy	ALL
 resources.pipelines.*.ingestion_definition.objects[*].schema.table_configuration.auto_full_refresh_policy.enabled	bool	ALL
 resources.pipelines.*.ingestion_definition.objects[*].schema.table_configuration.auto_full_refresh_policy.min_interval_hours	int	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.table_configuration.clustering_columns	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.table_configuration.clustering_columns[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.table_configuration.enable_auto_clustering	bool	ALL
 resources.pipelines.*.ingestion_definition.objects[*].schema.table_configuration.exclude_columns	[]string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].schema.table_configuration.exclude_columns[*]	string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].schema.table_configuration.include_columns	[]string	ALL
@@ -2408,6 +3553,9 @@ resources.pipelines.*.ingestion_definition.objects[*].schema.table_configuration
 resources.pipelines.*.ingestion_definition.objects[*].schema.table_configuration.scd_type	pipelines.TableSpecificConfigScdType	ALL
 resources.pipelines.*.ingestion_definition.objects[*].schema.table_configuration.sequence_by	[]string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].schema.table_configuration.sequence_by[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.table_configuration.source_metadata_column	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.table_configuration.table_properties	map[string]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].schema.table_configuration.table_properties.*	string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].schema.table_configuration.workday_report_parameters	*pipelines.IngestionPipelineDefinitionWorkdayReportParameters	ALL
 resources.pipelines.*.ingestion_definition.objects[*].schema.table_configuration.workday_report_parameters.incremental	bool	ALL
 resources.pipelines.*.ingestion_definition.objects[*].schema.table_configuration.workday_report_parameters.parameters	map[string]string	ALL
@@ -2418,6 +3566,12 @@ resources.pipelines.*.ingestion_definition.objects[*].schema.table_configuration
 resources.pipelines.*.ingestion_definition.objects[*].schema.table_configuration.workday_report_parameters.report_parameters[*].value	string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].table	*pipelines.TableSpec	ALL
 resources.pipelines.*.ingestion_definition.objects[*].table.connector_options	*pipelines.ConnectorOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.api_source_connector_options	*pipelines.ApiSourceConnectorOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.api_source_connector_options.options	map[string]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.api_source_connector_options.options.*	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.confluence_options	*pipelines.ConfluenceConnectorOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.confluence_options.include_confluence_spaces	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.confluence_options.include_confluence_spaces[*]	string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.gdrive_options	*pipelines.GoogleDriveOptions	ALL
 resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.gdrive_options.entity_type	pipelines.GoogleDriveOptionsGoogleDriveEntityType	ALL
 resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.gdrive_options.file_ingestion_options	*pipelines.FileIngestionOptions	ALL
@@ -2439,9 +3593,148 @@ resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.gd
 resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.gdrive_options.file_ingestion_options.single_variant_column	string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.gdrive_options.url	string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.google_ads_options	*pipelines.GoogleAdsOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.google_ads_options.custom_report_options	*pipelines.GoogleAdsCustomReportOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.google_ads_options.custom_report_options.metrics	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.google_ads_options.custom_report_options.metrics[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.google_ads_options.custom_report_options.resource	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.google_ads_options.custom_report_options.resource_fields	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.google_ads_options.custom_report_options.resource_fields[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.google_ads_options.custom_report_options.segments	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.google_ads_options.custom_report_options.segments[*]	string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.google_ads_options.lookback_window_days	int	ALL
 resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.google_ads_options.manager_account_id	string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.google_ads_options.sync_start_date	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.jira_options	*pipelines.JiraConnectorOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.jira_options.include_jira_spaces	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.jira_options.include_jira_spaces[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options	*pipelines.KafkaOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.client_config	map[string]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.client_config.*	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.key_transformer	*pipelines.Transformer	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.key_transformer.avro_options	*pipelines.AvroTransformerOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.key_transformer.avro_options.parse_mode	pipelines.ParseMode	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.key_transformer.avro_options.schema	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.key_transformer.avro_options.schema_file_path	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.key_transformer.avro_options.schema_registry	*pipelines.SchemaRegistryConfig	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.key_transformer.avro_options.schema_registry.confluent_options	*pipelines.ConfluentSchemaRegistryOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.key_transformer.avro_options.schema_registry.confluent_options.subject	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.key_transformer.avro_options.schema_registry.connection_name	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.key_transformer.avro_options.schema_registry.protobuf_message_name	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.key_transformer.format	pipelines.TransformerFormat	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.key_transformer.input_column	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.key_transformer.json_options	*pipelines.JsonTransformerOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.key_transformer.json_options.as_variant	bool	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.key_transformer.json_options.schema	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.key_transformer.json_options.schema_evolution_mode	pipelines.FileIngestionOptionsSchemaEvolutionMode	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.key_transformer.json_options.schema_file_path	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.key_transformer.json_options.schema_hints	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.key_transformer.output_column	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.key_transformer.protobuf_options	*pipelines.ProtobufTransformerOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.key_transformer.protobuf_options.desc_file_path	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.key_transformer.protobuf_options.message_name	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.key_transformer.protobuf_options.parse_mode	pipelines.ParseMode	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.key_transformer.protobuf_options.recursive_fields_max_depth	int	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.key_transformer.protobuf_options.schema_registry	*pipelines.SchemaRegistryConfig	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.key_transformer.protobuf_options.schema_registry.confluent_options	*pipelines.ConfluentSchemaRegistryOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.key_transformer.protobuf_options.schema_registry.confluent_options.subject	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.key_transformer.protobuf_options.schema_registry.connection_name	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.key_transformer.protobuf_options.schema_registry.protobuf_message_name	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.max_offsets_per_trigger	int64	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.starting_offset	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.topic_pattern	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.topics	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.topics[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.value_transformer	*pipelines.Transformer	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.value_transformer.avro_options	*pipelines.AvroTransformerOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.value_transformer.avro_options.parse_mode	pipelines.ParseMode	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.value_transformer.avro_options.schema	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.value_transformer.avro_options.schema_file_path	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.value_transformer.avro_options.schema_registry	*pipelines.SchemaRegistryConfig	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.value_transformer.avro_options.schema_registry.confluent_options	*pipelines.ConfluentSchemaRegistryOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.value_transformer.avro_options.schema_registry.confluent_options.subject	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.value_transformer.avro_options.schema_registry.connection_name	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.value_transformer.avro_options.schema_registry.protobuf_message_name	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.value_transformer.format	pipelines.TransformerFormat	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.value_transformer.input_column	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.value_transformer.json_options	*pipelines.JsonTransformerOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.value_transformer.json_options.as_variant	bool	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.value_transformer.json_options.schema	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.value_transformer.json_options.schema_evolution_mode	pipelines.FileIngestionOptionsSchemaEvolutionMode	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.value_transformer.json_options.schema_file_path	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.value_transformer.json_options.schema_hints	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.value_transformer.output_column	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.value_transformer.protobuf_options	*pipelines.ProtobufTransformerOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.value_transformer.protobuf_options.desc_file_path	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.value_transformer.protobuf_options.message_name	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.value_transformer.protobuf_options.parse_mode	pipelines.ParseMode	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.value_transformer.protobuf_options.recursive_fields_max_depth	int	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.value_transformer.protobuf_options.schema_registry	*pipelines.SchemaRegistryConfig	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.value_transformer.protobuf_options.schema_registry.confluent_options	*pipelines.ConfluentSchemaRegistryOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.value_transformer.protobuf_options.schema_registry.confluent_options.subject	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.value_transformer.protobuf_options.schema_registry.connection_name	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.value_transformer.protobuf_options.schema_registry.protobuf_message_name	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.linkedin_ads_options	*pipelines.LinkedInAdsOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.linkedin_ads_options.custom_report_options	*pipelines.LinkedInAdsOptionsLinkedInAdsCustomReportOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.linkedin_ads_options.custom_report_options.entity_granularity	[]pipelines.LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsEntityGranularity	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.linkedin_ads_options.custom_report_options.entity_granularity[*]	pipelines.LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsEntityGranularity	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.linkedin_ads_options.custom_report_options.finder	pipelines.LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsFinder	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.linkedin_ads_options.custom_report_options.metrics	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.linkedin_ads_options.custom_report_options.metrics[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.linkedin_ads_options.custom_report_options.time_granularity	pipelines.LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsTimeGranularity	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.linkedin_ads_options.lookback_window_days	int	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.linkedin_ads_options.sync_start_date	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.marketo_options	*pipelines.MarketoOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.marketo_options.sync_start_date	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.meta_ads_options	*pipelines.MetaMarketingOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.meta_ads_options.action_attribution_windows	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.meta_ads_options.action_attribution_windows[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.meta_ads_options.action_breakdowns	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.meta_ads_options.action_breakdowns[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.meta_ads_options.action_report_time	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.meta_ads_options.breakdowns	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.meta_ads_options.breakdowns[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.meta_ads_options.custom_insights_lookback_window	int	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.meta_ads_options.custom_report_options	*pipelines.MetaMarketingOptionsMetaMarketingCustomReportOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.meta_ads_options.custom_report_options.action_attribution_windows	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.meta_ads_options.custom_report_options.action_attribution_windows[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.meta_ads_options.custom_report_options.action_breakdowns	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.meta_ads_options.custom_report_options.action_breakdowns[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.meta_ads_options.custom_report_options.action_report_time	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.meta_ads_options.custom_report_options.breakdowns	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.meta_ads_options.custom_report_options.breakdowns[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.meta_ads_options.custom_report_options.level	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.meta_ads_options.custom_report_options.time_increment	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.meta_ads_options.level	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.meta_ads_options.start_date	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.meta_ads_options.time_increment	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.outlook_options	*pipelines.OutlookOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.outlook_options.attachment_mode	pipelines.OutlookAttachmentMode	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.outlook_options.body_format	pipelines.OutlookBodyFormat	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.outlook_options.folder_filter	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.outlook_options.folder_filter[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.outlook_options.include_folders	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.outlook_options.include_folders[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.outlook_options.include_mailboxes	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.outlook_options.include_mailboxes[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.outlook_options.include_senders	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.outlook_options.include_senders[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.outlook_options.include_subjects	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.outlook_options.include_subjects[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.outlook_options.sender_filter	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.outlook_options.sender_filter[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.outlook_options.start_date	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.outlook_options.subject_filter	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.outlook_options.subject_filter[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.rabbitmq_options	*pipelines.RabbitmqOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.rabbitmq_options.queue	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.reddit_ads_options	*pipelines.RedditAdsOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.reddit_ads_options.custom_report_options	*pipelines.RedditAdsOptionsRedditAdsCustomReportOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.reddit_ads_options.custom_report_options.breakdowns	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.reddit_ads_options.custom_report_options.breakdowns[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.reddit_ads_options.custom_report_options.fields	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.reddit_ads_options.custom_report_options.fields[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.reddit_ads_options.lookback_window_days	int	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.reddit_ads_options.sync_start_date	string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.sharepoint_options	*pipelines.SharepointOptions	ALL
 resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.sharepoint_options.entity_type	pipelines.SharepointOptionsSharepointEntityType	ALL
 resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.sharepoint_options.file_ingestion_options	*pipelines.FileIngestionOptions	ALL
@@ -2462,7 +3755,17 @@ resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.sh
 resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.sharepoint_options.file_ingestion_options.schema_hints	string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.sharepoint_options.file_ingestion_options.single_variant_column	string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.sharepoint_options.url	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.smartsheet_options	*pipelines.SmartsheetOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.smartsheet_options.enforce_schema	bool	ALL
 resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.tiktok_ads_options	*pipelines.TikTokAdsOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.tiktok_ads_options.custom_report_options	*pipelines.TikTokAdsOptionsTikTokAdsCustomReportOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.tiktok_ads_options.custom_report_options.data_level	pipelines.TikTokAdsOptionsTikTokDataLevel	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.tiktok_ads_options.custom_report_options.dimensions	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.tiktok_ads_options.custom_report_options.dimensions[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.tiktok_ads_options.custom_report_options.metrics	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.tiktok_ads_options.custom_report_options.metrics[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.tiktok_ads_options.custom_report_options.query_lifetime	bool	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.tiktok_ads_options.custom_report_options.report_type	pipelines.TikTokAdsOptionsTikTokReportType	ALL
 resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.tiktok_ads_options.data_level	pipelines.TikTokAdsOptionsTikTokDataLevel	ALL
 resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.tiktok_ads_options.dimensions	[]string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.tiktok_ads_options.dimensions[*]	string	ALL
@@ -2472,6 +3775,8 @@ resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.ti
 resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.tiktok_ads_options.query_lifetime	bool	ALL
 resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.tiktok_ads_options.report_type	pipelines.TikTokAdsOptionsTikTokReportType	ALL
 resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.tiktok_ads_options.sync_start_date	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.zendesk_support_options	*pipelines.ZendeskSupportOptions	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.zendesk_support_options.start_date	string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].table.destination_catalog	string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].table.destination_schema	string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].table.destination_table	string	ALL
@@ -2482,6 +3787,9 @@ resources.pipelines.*.ingestion_definition.objects[*].table.table_configuration
 resources.pipelines.*.ingestion_definition.objects[*].table.table_configuration.auto_full_refresh_policy	*pipelines.AutoFullRefreshPolicy	ALL
 resources.pipelines.*.ingestion_definition.objects[*].table.table_configuration.auto_full_refresh_policy.enabled	bool	ALL
 resources.pipelines.*.ingestion_definition.objects[*].table.table_configuration.auto_full_refresh_policy.min_interval_hours	int	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.table_configuration.clustering_columns	[]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.table_configuration.clustering_columns[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.table_configuration.enable_auto_clustering	bool	ALL
 resources.pipelines.*.ingestion_definition.objects[*].table.table_configuration.exclude_columns	[]string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].table.table_configuration.exclude_columns[*]	string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].table.table_configuration.include_columns	[]string	ALL
@@ -2498,6 +3806,9 @@ resources.pipelines.*.ingestion_definition.objects[*].table.table_configuration.
 resources.pipelines.*.ingestion_definition.objects[*].table.table_configuration.scd_type	pipelines.TableSpecificConfigScdType	ALL
 resources.pipelines.*.ingestion_definition.objects[*].table.table_configuration.sequence_by	[]string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].table.table_configuration.sequence_by[*]	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.table_configuration.source_metadata_column	string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.table_configuration.table_properties	map[string]string	ALL
+resources.pipelines.*.ingestion_definition.objects[*].table.table_configuration.table_properties.*	string	ALL
 resources.pipelines.*.ingestion_definition.objects[*].table.table_configuration.workday_report_parameters	*pipelines.IngestionPipelineDefinitionWorkdayReportParameters	ALL
 resources.pipelines.*.ingestion_definition.objects[*].table.table_configuration.workday_report_parameters.incremental	bool	ALL
 resources.pipelines.*.ingestion_definition.objects[*].table.table_configuration.workday_report_parameters.parameters	map[string]string	ALL
@@ -2508,17 +3819,25 @@ resources.pipelines.*.ingestion_definition.objects[*].table.table_configuration.
 resources.pipelines.*.ingestion_definition.objects[*].table.table_configuration.workday_report_parameters.report_parameters[*].value	string	ALL
 resources.pipelines.*.ingestion_definition.source_configurations	[]pipelines.SourceConfig	ALL
 resources.pipelines.*.ingestion_definition.source_configurations[*]	pipelines.SourceConfig	ALL
+resources.pipelines.*.ingestion_definition.source_configurations[*].api_source_connector_config	*pipelines.ApiSourceConnectorConfig	ALL
+resources.pipelines.*.ingestion_definition.source_configurations[*].api_source_connector_config.configs	map[string]string	ALL
+resources.pipelines.*.ingestion_definition.source_configurations[*].api_source_connector_config.configs.*	string	ALL
 resources.pipelines.*.ingestion_definition.source_configurations[*].catalog	*pipelines.SourceCatalogConfig	ALL
 resources.pipelines.*.ingestion_definition.source_configurations[*].catalog.postgres	*pipelines.PostgresCatalogConfig	ALL
 resources.pipelines.*.ingestion_definition.source_configurations[*].catalog.postgres.slot_config	*pipelines.PostgresSlotConfig	ALL
 resources.pipelines.*.ingestion_definition.source_configurations[*].catalog.postgres.slot_config.publication_name	string	ALL
 resources.pipelines.*.ingestion_definition.source_configurations[*].catalog.postgres.slot_config.slot_name	string	ALL
 resources.pipelines.*.ingestion_definition.source_configurations[*].catalog.source_catalog	string	ALL
+resources.pipelines.*.ingestion_definition.source_configurations[*].google_ads_config	*pipelines.GoogleAdsConfig	ALL
+resources.pipelines.*.ingestion_definition.source_configurations[*].google_ads_config.manager_account_id	string	ALL
 resources.pipelines.*.ingestion_definition.source_type	pipelines.IngestionSourceType	ALL
 resources.pipelines.*.ingestion_definition.table_configuration	*pipelines.TableSpecificConfig	ALL
 resources.pipelines.*.ingestion_definition.table_configuration.auto_full_refresh_policy	*pipelines.AutoFullRefreshPolicy	ALL
 resources.pipelines.*.ingestion_definition.table_configuration.auto_full_refresh_policy.enabled	bool	ALL
 resources.pipelines.*.ingestion_definition.table_configuration.auto_full_refresh_policy.min_interval_hours	int	ALL
+resources.pipelines.*.ingestion_definition.table_configuration.clustering_columns	[]string	ALL
+resources.pipelines.*.ingestion_definition.table_configuration.clustering_columns[*]	string	ALL
+resources.pipelines.*.ingestion_definition.table_configuration.enable_auto_clustering	bool	ALL
 resources.pipelines.*.ingestion_definition.table_configuration.exclude_columns	[]string	ALL
 resources.pipelines.*.ingestion_definition.table_configuration.exclude_columns[*]	string	ALL
 resources.pipelines.*.ingestion_definition.table_configuration.include_columns	[]string	ALL
@@ -2535,6 +3854,9 @@ resources.pipelines.*.ingestion_definition.table_configuration.salesforce_includ
 resources.pipelines.*.ingestion_definition.table_configuration.scd_type	pipelines.TableSpecificConfigScdType	ALL
 resources.pipelines.*.ingestion_definition.table_configuration.sequence_by	[]string	ALL
 resources.pipelines.*.ingestion_definition.table_configuration.sequence_by[*]	string	ALL
+resources.pipelines.*.ingestion_definition.table_configuration.source_metadata_column	string	ALL
+resources.pipelines.*.ingestion_definition.table_configuration.table_properties	map[string]string	ALL
+resources.pipelines.*.ingestion_definition.table_configuration.table_properties.*	string	ALL
 resources.pipelines.*.ingestion_definition.table_configuration.workday_report_parameters	*pipelines.IngestionPipelineDefinitionWorkdayReportParameters	ALL
 resources.pipelines.*.ingestion_definition.table_configuration.workday_report_parameters.incremental	bool	ALL
 resources.pipelines.*.ingestion_definition.table_configuration.workday_report_parameters.parameters	map[string]string	ALL
@@ -2574,6 +3896,9 @@ resources.pipelines.*.notifications[*].alerts	[]string	ALL
 resources.pipelines.*.notifications[*].alerts[*]	string	ALL
 resources.pipelines.*.notifications[*].email_recipients	[]string	ALL
 resources.pipelines.*.notifications[*].email_recipients[*]	string	ALL
+resources.pipelines.*.parameters	map[string]string	ALL
+resources.pipelines.*.parameters.*	string	ALL
+resources.pipelines.*.parent_path	string	ALL
 resources.pipelines.*.photon	bool	ALL
 resources.pipelines.*.pipeline_id	string	REMOTE
 resources.pipelines.*.restart_window	*pipelines.RestartWindow	ALL
@@ -2583,11 +3908,13 @@ resources.pipelines.*.restart_window.start_hour	int	ALL
 resources.pipelines.*.restart_window.time_zone_id	string	ALL
 resources.pipelines.*.root_path	string	ALL
 resources.pipelines.*.run_as	*pipelines.RunAs	ALL
+resources.pipelines.*.run_as.group_name	string	ALL
 resources.pipelines.*.run_as.service_principal_name	string	ALL
 resources.pipelines.*.run_as.user_name	string	ALL
 resources.pipelines.*.run_as_user_name	string	REMOTE
 resources.pipelines.*.schema	string	ALL
 resources.pipelines.*.serverless	bool	ALL
+resources.pipelines.*.serverless_compute_id	string	ALL
 resources.pipelines.*.state	pipelines.PipelineState	REMOTE
 resources.pipelines.*.storage	string	ALL
 resources.pipelines.*.tags	map[string]string	ALL
@@ -2606,82 +3933,103 @@ resources.pipelines.*.permissions[*].group_name	string	ALL
 resources.pipelines.*.permissions[*].level	iam.PermissionLevel	ALL
 resources.pipelines.*.permissions[*].service_principal_name	string	ALL
 resources.pipelines.*.permissions[*].user_name	string	ALL
-resources.postgres_branches.*.branch_id	string	INPUT	STATE
+resources.postgres_branches.*.branch_id	string	ALL
 resources.postgres_branches.*.create_time	*time.Time	REMOTE
-resources.postgres_branches.*.expire_time	*time.Time	INPUT	STATE
+resources.postgres_branches.*.expire_time	*time.Time	ALL
 resources.postgres_branches.*.id	string	INPUT
-resources.postgres_branches.*.is_protected	bool	INPUT	STATE
+resources.postgres_branches.*.is_protected	bool	ALL
 resources.postgres_branches.*.lifecycle	resources.Lifecycle	INPUT
 resources.postgres_branches.*.lifecycle.prevent_destroy	bool	INPUT
 resources.postgres_branches.*.modified_status	string	INPUT
 resources.postgres_branches.*.name	string	REMOTE
-resources.postgres_branches.*.no_expiry	bool	INPUT	STATE
+resources.postgres_branches.*.no_expiry	bool	ALL
 resources.postgres_branches.*.parent	string	ALL
-resources.postgres_branches.*.source_branch	string	INPUT	STATE
-resources.postgres_branches.*.source_branch_lsn	string	INPUT	STATE
-resources.postgres_branches.*.source_branch_time	*time.Time	INPUT	STATE
-resources.postgres_branches.*.spec	*postgres.BranchSpec	REMOTE
-resources.postgres_branches.*.spec.expire_time	*time.Time	REMOTE
-resources.postgres_branches.*.spec.is_protected	bool	REMOTE
-resources.postgres_branches.*.spec.no_expiry	bool	REMOTE
-resources.postgres_branches.*.spec.source_branch	string	REMOTE
-resources.postgres_branches.*.spec.source_branch_lsn	string	REMOTE
-resources.postgres_branches.*.spec.source_branch_time	*time.Time	REMOTE
-resources.postgres_branches.*.spec.ttl	*duration.Duration	REMOTE
+resources.postgres_branches.*.purge_on_delete	bool	INPUT	STATE
+resources.postgres_branches.*.replace_existing	bool	INPUT	STATE
+resources.postgres_branches.*.source_branch	string	ALL
+resources.postgres_branches.*.source_branch_lsn	string	ALL
+resources.postgres_branches.*.source_branch_time	*time.Time	ALL
+resources.postgres_branches.*.source_snapshot	string	ALL
 resources.postgres_branches.*.status	*postgres.BranchStatus	REMOTE
+resources.postgres_branches.*.status.branch_id	string	REMOTE
 resources.postgres_branches.*.status.current_state	postgres.BranchStatusState	REMOTE
 resources.postgres_branches.*.status.default	bool	REMOTE
+resources.postgres_branches.*.status.delete_time	*time.Time	REMOTE
 resources.postgres_branches.*.status.expire_time	*time.Time	REMOTE
 resources.postgres_branches.*.status.is_protected	bool	REMOTE
 resources.postgres_branches.*.status.logical_size_bytes	int64	REMOTE
 resources.postgres_branches.*.status.pending_state	postgres.BranchStatusState	REMOTE
+resources.postgres_branches.*.status.purge_time	*time.Time	REMOTE
 resources.postgres_branches.*.status.source_branch	string	REMOTE
 resources.postgres_branches.*.status.source_branch_lsn	string	REMOTE
 resources.postgres_branches.*.status.source_branch_time	*time.Time	REMOTE
+resources.postgres_branches.*.status.source_snapshot	string	REMOTE
 resources.postgres_branches.*.status.state_change_time	*time.Time	REMOTE
-resources.postgres_branches.*.ttl	*duration.Duration	INPUT	STATE
+resources.postgres_branches.*.ttl	*duration.Duration	ALL
 resources.postgres_branches.*.uid	string	REMOTE
 resources.postgres_branches.*.update_time	*time.Time	REMOTE
 resources.postgres_branches.*.url	string	INPUT
-resources.postgres_endpoints.*.autoscaling_limit_max_cu	float64	INPUT	STATE
-resources.postgres_endpoints.*.autoscaling_limit_min_cu	float64	INPUT	STATE
+resources.postgres_catalogs.*.branch	string	ALL
+resources.postgres_catalogs.*.catalog_id	string	ALL
+resources.postgres_catalogs.*.create_database_if_missing	bool	ALL
+resources.postgres_catalogs.*.create_time	*time.Time	REMOTE
+resources.postgres_catalogs.*.id	string	INPUT
+resources.postgres_catalogs.*.lifecycle	resources.Lifecycle	INPUT
+resources.postgres_catalogs.*.lifecycle.prevent_destroy	bool	INPUT
+resources.postgres_catalogs.*.modified_status	string	INPUT
+resources.postgres_catalogs.*.name	string	REMOTE
+resources.postgres_catalogs.*.postgres_database	string	ALL
+resources.postgres_catalogs.*.status	*postgres.CatalogCatalogStatus	REMOTE
+resources.postgres_catalogs.*.status.branch	string	REMOTE
+resources.postgres_catalogs.*.status.postgres_database	string	REMOTE
+resources.postgres_catalogs.*.status.project	string	REMOTE
+resources.postgres_catalogs.*.uid	string	REMOTE
+resources.postgres_catalogs.*.update_time	*time.Time	REMOTE
+resources.postgres_catalogs.*.url	string	INPUT
+resources.postgres_databases.*.create_time	*time.Time	REMOTE
+resources.postgres_databases.*.database_id	string	ALL
+resources.postgres_databases.*.id	string	INPUT
+resources.postgres_databases.*.lifecycle	resources.Lifecycle	INPUT
+resources.postgres_databases.*.lifecycle.prevent_destroy	bool	INPUT
+resources.postgres_databases.*.modified_status	string	INPUT
+resources.postgres_databases.*.name	string	REMOTE
+resources.postgres_databases.*.parent	string	ALL
+resources.postgres_databases.*.postgres_database	string	ALL
+resources.postgres_databases.*.replace_existing	bool	INPUT	STATE
+resources.postgres_databases.*.role	string	ALL
+resources.postgres_databases.*.status	*postgres.DatabaseDatabaseStatus	REMOTE
+resources.postgres_databases.*.status.database_id	string	REMOTE
+resources.postgres_databases.*.status.postgres_database	string	REMOTE
+resources.postgres_databases.*.status.role	string	REMOTE
+resources.postgres_databases.*.update_time	*time.Time	REMOTE
+resources.postgres_databases.*.url	string	INPUT
+resources.postgres_endpoints.*.autoscaling_limit_max_cu	float64	ALL
+resources.postgres_endpoints.*.autoscaling_limit_min_cu	float64	ALL
 resources.postgres_endpoints.*.create_time	*time.Time	REMOTE
-resources.postgres_endpoints.*.disabled	bool	INPUT	STATE
-resources.postgres_endpoints.*.endpoint_id	string	INPUT	STATE
-resources.postgres_endpoints.*.endpoint_type	postgres.EndpointType	INPUT	STATE
-resources.postgres_endpoints.*.group	*postgres.EndpointGroupSpec	INPUT	STATE
-resources.postgres_endpoints.*.group.enable_readable_secondaries	bool	INPUT	STATE
-resources.postgres_endpoints.*.group.max	int	INPUT	STATE
-resources.postgres_endpoints.*.group.min	int	INPUT	STATE
+resources.postgres_endpoints.*.disabled	bool	ALL
+resources.postgres_endpoints.*.endpoint_id	string	ALL
+resources.postgres_endpoints.*.endpoint_type	postgres.EndpointType	ALL
+resources.postgres_endpoints.*.group	*postgres.EndpointGroupSpec	ALL
+resources.postgres_endpoints.*.group.enable_readable_secondaries	bool	ALL
+resources.postgres_endpoints.*.group.max	int	ALL
+resources.postgres_endpoints.*.group.min	int	ALL
 resources.postgres_endpoints.*.id	string	INPUT
 resources.postgres_endpoints.*.lifecycle	resources.Lifecycle	INPUT
 resources.postgres_endpoints.*.lifecycle.prevent_destroy	bool	INPUT
 resources.postgres_endpoints.*.modified_status	string	INPUT
 resources.postgres_endpoints.*.name	string	REMOTE
-resources.postgres_endpoints.*.no_suspension	bool	INPUT	STATE
+resources.postgres_endpoints.*.no_suspension	bool	ALL
 resources.postgres_endpoints.*.parent	string	ALL
-resources.postgres_endpoints.*.settings	*postgres.EndpointSettings	INPUT	STATE
-resources.postgres_endpoints.*.settings.pg_settings	map[string]string	INPUT	STATE
-resources.postgres_endpoints.*.settings.pg_settings.*	string	INPUT	STATE
-resources.postgres_endpoints.*.spec	*postgres.EndpointSpec	REMOTE
-resources.postgres_endpoints.*.spec.autoscaling_limit_max_cu	float64	REMOTE
-resources.postgres_endpoints.*.spec.autoscaling_limit_min_cu	float64	REMOTE
-resources.postgres_endpoints.*.spec.disabled	bool	REMOTE
-resources.postgres_endpoints.*.spec.endpoint_type	postgres.EndpointType	REMOTE
-resources.postgres_endpoints.*.spec.group	*postgres.EndpointGroupSpec	REMOTE
-resources.postgres_endpoints.*.spec.group.enable_readable_secondaries	bool	REMOTE
-resources.postgres_endpoints.*.spec.group.max	int	REMOTE
-resources.postgres_endpoints.*.spec.group.min	int	REMOTE
-resources.postgres_endpoints.*.spec.no_suspension	bool	REMOTE
-resources.postgres_endpoints.*.spec.settings	*postgres.EndpointSettings	REMOTE
-resources.postgres_endpoints.*.spec.settings.pg_settings	map[string]string	REMOTE
-resources.postgres_endpoints.*.spec.settings.pg_settings.*	string	REMOTE
-resources.postgres_endpoints.*.spec.suspend_timeout_duration	*duration.Duration	REMOTE
+resources.postgres_endpoints.*.replace_existing	bool	INPUT	STATE
+resources.postgres_endpoints.*.settings	*postgres.EndpointSettings	ALL
+resources.postgres_endpoints.*.settings.pg_settings	map[string]string	ALL
+resources.postgres_endpoints.*.settings.pg_settings.*	string	ALL
 resources.postgres_endpoints.*.status	*postgres.EndpointStatus	REMOTE
 resources.postgres_endpoints.*.status.autoscaling_limit_max_cu	float64	REMOTE
 resources.postgres_endpoints.*.status.autoscaling_limit_min_cu	float64	REMOTE
 resources.postgres_endpoints.*.status.current_state	postgres.EndpointStatusState	REMOTE
 resources.postgres_endpoints.*.status.disabled	bool	REMOTE
+resources.postgres_endpoints.*.status.endpoint_id	string	REMOTE
 resources.postgres_endpoints.*.status.endpoint_type	postgres.EndpointType	REMOTE
 resources.postgres_endpoints.*.status.group	*postgres.EndpointGroupStatus	REMOTE
 resources.postgres_endpoints.*.status.group.enable_readable_secondaries	bool	REMOTE
@@ -2690,65 +4038,58 @@ resources.postgres_endpoints.*.status.group.min	int	REMOTE
 resources.postgres_endpoints.*.status.hosts	*postgres.EndpointHosts	REMOTE
 resources.postgres_endpoints.*.status.hosts.host	string	REMOTE
 resources.postgres_endpoints.*.status.hosts.read_only_host	string	REMOTE
+resources.postgres_endpoints.*.status.hosts.read_only_pooled_host	string	REMOTE
+resources.postgres_endpoints.*.status.hosts.read_write_pooled_host	string	REMOTE
+resources.postgres_endpoints.*.status.last_active_time	*time.Time	REMOTE
 resources.postgres_endpoints.*.status.pending_state	postgres.EndpointStatusState	REMOTE
 resources.postgres_endpoints.*.status.settings	*postgres.EndpointSettings	REMOTE
 resources.postgres_endpoints.*.status.settings.pg_settings	map[string]string	REMOTE
 resources.postgres_endpoints.*.status.settings.pg_settings.*	string	REMOTE
 resources.postgres_endpoints.*.status.suspend_timeout_duration	*duration.Duration	REMOTE
-resources.postgres_endpoints.*.suspend_timeout_duration	*duration.Duration	INPUT	STATE
+resources.postgres_endpoints.*.suspend_timeout_duration	*duration.Duration	ALL
 resources.postgres_endpoints.*.uid	string	REMOTE
 resources.postgres_endpoints.*.update_time	*time.Time	REMOTE
 resources.postgres_endpoints.*.url	string	INPUT
-resources.postgres_projects.*.budget_policy_id	string	INPUT	STATE
+resources.postgres_projects.*.budget_policy_id	string	ALL
 resources.postgres_projects.*.create_time	*time.Time	REMOTE
-resources.postgres_projects.*.custom_tags	[]postgres.ProjectCustomTag	INPUT	STATE
-resources.postgres_projects.*.custom_tags[*]	postgres.ProjectCustomTag	INPUT	STATE
-resources.postgres_projects.*.custom_tags[*].key	string	INPUT	STATE
-resources.postgres_projects.*.custom_tags[*].value	string	INPUT	STATE
-resources.postgres_projects.*.default_branch	string	INPUT	STATE
-resources.postgres_projects.*.default_endpoint_settings	*postgres.ProjectDefaultEndpointSettings	INPUT	STATE
-resources.postgres_projects.*.default_endpoint_settings.autoscaling_limit_max_cu	float64	INPUT	STATE
-resources.postgres_projects.*.default_endpoint_settings.autoscaling_limit_min_cu	float64	INPUT	STATE
-resources.postgres_projects.*.default_endpoint_settings.no_suspension	bool	INPUT	STATE
-resources.postgres_projects.*.default_endpoint_settings.pg_settings	map[string]string	INPUT	STATE
-resources.postgres_projects.*.default_endpoint_settings.pg_settings.*	string	INPUT	STATE
-resources.postgres_projects.*.default_endpoint_settings.suspend_timeout_duration	*duration.Duration	INPUT	STATE
-resources.postgres_projects.*.display_name	string	INPUT	STATE
-resources.postgres_projects.*.enable_pg_native_login	bool	INPUT	STATE
-resources.postgres_projects.*.history_retention_duration	*duration.Duration	INPUT	STATE
+resources.postgres_projects.*.custom_tags	[]postgres.ProjectCustomTag	ALL
+resources.postgres_projects.*.custom_tags[*]	postgres.ProjectCustomTag	ALL
+resources.postgres_projects.*.custom_tags[*].key	string	ALL
+resources.postgres_projects.*.custom_tags[*].value	string	ALL
+resources.postgres_projects.*.default_branch	string	ALL
+resources.postgres_projects.*.default_endpoint_settings	*postgres.ProjectDefaultEndpointSettings	ALL
+resources.postgres_projects.*.default_endpoint_settings.autoscaling_limit_max_cu	float64	ALL
+resources.postgres_projects.*.default_endpoint_settings.autoscaling_limit_min_cu	float64	ALL
+resources.postgres_projects.*.default_endpoint_settings.no_suspension	bool	ALL
+resources.postgres_projects.*.default_endpoint_settings.pg_settings	map[string]string	ALL
+resources.postgres_projects.*.default_endpoint_settings.pg_settings.*	string	ALL
+resources.postgres_projects.*.default_endpoint_settings.suspend_timeout_duration	*duration.Duration	ALL
+resources.postgres_projects.*.delete_time	*time.Time	REMOTE
+resources.postgres_projects.*.display_name	string	ALL
+resources.postgres_projects.*.enable_pg_native_login	bool	ALL
+resources.postgres_projects.*.history_retention_duration	*duration.Duration	ALL
 resources.postgres_projects.*.id	string	INPUT
 resources.postgres_projects.*.initial_endpoint_spec	*postgres.InitialEndpointSpec	REMOTE
+resources.postgres_projects.*.initial_endpoint_spec.autoscaling_limit_max_cu	float64	REMOTE
+resources.postgres_projects.*.initial_endpoint_spec.autoscaling_limit_min_cu	float64	REMOTE
 resources.postgres_projects.*.initial_endpoint_spec.group	*postgres.EndpointGroupSpec	REMOTE
 resources.postgres_projects.*.initial_endpoint_spec.group.enable_readable_secondaries	bool	REMOTE
 resources.postgres_projects.*.initial_endpoint_spec.group.max	int	REMOTE
 resources.postgres_projects.*.initial_endpoint_spec.group.min	int	REMOTE
+resources.postgres_projects.*.initial_endpoint_spec.no_suspension	bool	REMOTE
+resources.postgres_projects.*.initial_endpoint_spec.suspend_timeout_duration	*duration.Duration	REMOTE
 resources.postgres_projects.*.lifecycle	resources.Lifecycle	INPUT
 resources.postgres_projects.*.lifecycle.prevent_destroy	bool	INPUT
 resources.postgres_projects.*.modified_status	string	INPUT
 resources.postgres_projects.*.name	string	REMOTE
-resources.postgres_projects.*.pg_version	int	INPUT	STATE
-resources.postgres_projects.*.project_id	string	INPUT	STATE
-resources.postgres_projects.*.spec	*postgres.ProjectSpec	REMOTE
-resources.postgres_projects.*.spec.budget_policy_id	string	REMOTE
-resources.postgres_projects.*.spec.custom_tags	[]postgres.ProjectCustomTag	REMOTE
-resources.postgres_projects.*.spec.custom_tags[*]	postgres.ProjectCustomTag	REMOTE
-resources.postgres_projects.*.spec.custom_tags[*].key	string	REMOTE
-resources.postgres_projects.*.spec.custom_tags[*].value	string	REMOTE
-resources.postgres_projects.*.spec.default_branch	string	REMOTE
-resources.postgres_projects.*.spec.default_endpoint_settings	*postgres.ProjectDefaultEndpointSettings	REMOTE
-resources.postgres_projects.*.spec.default_endpoint_settings.autoscaling_limit_max_cu	float64	REMOTE
-resources.postgres_projects.*.spec.default_endpoint_settings.autoscaling_limit_min_cu	float64	REMOTE
-resources.postgres_projects.*.spec.default_endpoint_settings.no_suspension	bool	REMOTE
-resources.postgres_projects.*.spec.default_endpoint_settings.pg_settings	map[string]string	REMOTE
-resources.postgres_projects.*.spec.default_endpoint_settings.pg_settings.*	string	REMOTE
-resources.postgres_projects.*.spec.default_endpoint_settings.suspend_timeout_duration	*duration.Duration	REMOTE
-resources.postgres_projects.*.spec.display_name	string	REMOTE
-resources.postgres_projects.*.spec.enable_pg_native_login	bool	REMOTE
-resources.postgres_projects.*.spec.history_retention_duration	*duration.Duration	REMOTE
-resources.postgres_projects.*.spec.pg_version	int	REMOTE
+resources.postgres_projects.*.pg_version	int	ALL
+resources.postgres_projects.*.project_id	string	ALL
+resources.postgres_projects.*.purge_on_delete	bool	INPUT	STATE
+resources.postgres_projects.*.purge_time	*time.Time	REMOTE
 resources.postgres_projects.*.status	*postgres.ProjectStatus	REMOTE
 resources.postgres_projects.*.status.branch_logical_size_limit_bytes	int64	REMOTE
 resources.postgres_projects.*.status.budget_policy_id	string	REMOTE
+resources.postgres_projects.*.status.compute_last_active_time	*time.Time	REMOTE
 resources.postgres_projects.*.status.custom_tags	[]postgres.ProjectCustomTag	REMOTE
 resources.postgres_projects.*.status.custom_tags[*]	postgres.ProjectCustomTag	REMOTE
 resources.postgres_projects.*.status.custom_tags[*].key	string	REMOTE
@@ -2766,6 +4107,7 @@ resources.postgres_projects.*.status.enable_pg_native_login	bool	REMOTE
 resources.postgres_projects.*.status.history_retention_duration	*duration.Duration	REMOTE
 resources.postgres_projects.*.status.owner	string	REMOTE
 resources.postgres_projects.*.status.pg_version	int	REMOTE
+resources.postgres_projects.*.status.project_id	string	REMOTE
 resources.postgres_projects.*.status.synthetic_storage_size_bytes	int64	REMOTE
 resources.postgres_projects.*.uid	string	REMOTE
 resources.postgres_projects.*.update_time	*time.Time	REMOTE
@@ -2776,6 +4118,111 @@ resources.postgres_projects.*.permissions[*].group_name	string	ALL
 resources.postgres_projects.*.permissions[*].level	iam.PermissionLevel	ALL
 resources.postgres_projects.*.permissions[*].service_principal_name	string	ALL
 resources.postgres_projects.*.permissions[*].user_name	string	ALL
+resources.postgres_roles.*.attributes	*postgres.RoleAttributes	ALL
+resources.postgres_roles.*.attributes.bypassrls	bool	ALL
+resources.postgres_roles.*.attributes.createdb	bool	ALL
+resources.postgres_roles.*.attributes.createrole	bool	ALL
+resources.postgres_roles.*.auth_method	postgres.RoleAuthMethod	ALL
+resources.postgres_roles.*.create_time	*time.Time	REMOTE
+resources.postgres_roles.*.id	string	INPUT
+resources.postgres_roles.*.identity_type	postgres.RoleIdentityType	ALL
+resources.postgres_roles.*.lifecycle	resources.Lifecycle	INPUT
+resources.postgres_roles.*.lifecycle.prevent_destroy	bool	INPUT
+resources.postgres_roles.*.membership_roles	[]postgres.RoleMembershipRole	ALL
+resources.postgres_roles.*.membership_roles[*]	postgres.RoleMembershipRole	ALL
+resources.postgres_roles.*.modified_status	string	INPUT
+resources.postgres_roles.*.name	string	REMOTE
+resources.postgres_roles.*.parent	string	ALL
+resources.postgres_roles.*.postgres_role	string	ALL
+resources.postgres_roles.*.replace_existing	bool	INPUT	STATE
+resources.postgres_roles.*.role_id	string	ALL
+resources.postgres_roles.*.status	*postgres.RoleRoleStatus	REMOTE
+resources.postgres_roles.*.status.attributes	*postgres.RoleAttributes	REMOTE
+resources.postgres_roles.*.status.attributes.bypassrls	bool	REMOTE
+resources.postgres_roles.*.status.attributes.createdb	bool	REMOTE
+resources.postgres_roles.*.status.attributes.createrole	bool	REMOTE
+resources.postgres_roles.*.status.auth_method	postgres.RoleAuthMethod	REMOTE
+resources.postgres_roles.*.status.identity_type	postgres.RoleIdentityType	REMOTE
+resources.postgres_roles.*.status.membership_roles	[]postgres.RoleMembershipRole	REMOTE
+resources.postgres_roles.*.status.membership_roles[*]	postgres.RoleMembershipRole	REMOTE
+resources.postgres_roles.*.status.postgres_role	string	REMOTE
+resources.postgres_roles.*.status.role_id	string	REMOTE
+resources.postgres_roles.*.update_time	*time.Time	REMOTE
+resources.postgres_roles.*.url	string	INPUT
+resources.postgres_snapshot_schedules.*.branch	string	ALL
+resources.postgres_snapshot_schedules.*.id	string	INPUT
+resources.postgres_snapshot_schedules.*.lifecycle	resources.Lifecycle	INPUT
+resources.postgres_snapshot_schedules.*.lifecycle.prevent_destroy	bool	INPUT
+resources.postgres_snapshot_schedules.*.modified_status	string	INPUT
+resources.postgres_snapshot_schedules.*.name	string	REMOTE
+resources.postgres_snapshot_schedules.*.schedule	[]postgres.ScheduleCadence	ALL
+resources.postgres_snapshot_schedules.*.schedule[*]	postgres.ScheduleCadence	ALL
+resources.postgres_snapshot_schedules.*.schedule[*].daily_schedule	*postgres.DailySchedule	ALL
+resources.postgres_snapshot_schedules.*.schedule[*].daily_schedule.hour	int	ALL
+resources.postgres_snapshot_schedules.*.schedule[*].monthly_schedule	*postgres.MonthlySchedule	ALL
+resources.postgres_snapshot_schedules.*.schedule[*].monthly_schedule.day	int	ALL
+resources.postgres_snapshot_schedules.*.schedule[*].monthly_schedule.hour	int	ALL
+resources.postgres_snapshot_schedules.*.schedule[*].retention	duration.Duration	ALL
+resources.postgres_snapshot_schedules.*.schedule[*].weekly_schedule	*postgres.WeeklySchedule	ALL
+resources.postgres_snapshot_schedules.*.schedule[*].weekly_schedule.day_of_week	postgres.DayOfWeek	ALL
+resources.postgres_snapshot_schedules.*.schedule[*].weekly_schedule.hour	int	ALL
+resources.postgres_snapshot_schedules.*.url	string	INPUT
+resources.postgres_synced_tables.*.accelerated_sync	bool	ALL
+resources.postgres_synced_tables.*.branch	string	ALL
+resources.postgres_synced_tables.*.create_database_objects_if_missing	bool	ALL
+resources.postgres_synced_tables.*.create_time	*time.Time	REMOTE
+resources.postgres_synced_tables.*.existing_pipeline_id	string	ALL
+resources.postgres_synced_tables.*.extra_columns	[]postgres.SyncedTableSyncedTableSpecExtraColumn	ALL
+resources.postgres_synced_tables.*.extra_columns[*]	postgres.SyncedTableSyncedTableSpecExtraColumn	ALL
+resources.postgres_synced_tables.*.extra_columns[*].column_name	string	ALL
+resources.postgres_synced_tables.*.extra_columns[*].column_type	string	ALL
+resources.postgres_synced_tables.*.extra_columns[*].compute	string	ALL
+resources.postgres_synced_tables.*.extra_columns[*].maintenance	postgres.SyncedTableSyncedTableSpecExtraColumnMaintenance	ALL
+resources.postgres_synced_tables.*.id	string	INPUT
+resources.postgres_synced_tables.*.lifecycle	resources.Lifecycle	INPUT
+resources.postgres_synced_tables.*.lifecycle.prevent_destroy	bool	INPUT
+resources.postgres_synced_tables.*.modified_status	string	INPUT
+resources.postgres_synced_tables.*.name	string	REMOTE
+resources.postgres_synced_tables.*.new_pipeline_spec	*postgres.NewPipelineSpec	ALL
+resources.postgres_synced_tables.*.new_pipeline_spec.budget_policy_id	string	ALL
+resources.postgres_synced_tables.*.new_pipeline_spec.pipeline_channel	postgres.NewPipelineSpecPipelineChannel	ALL
+resources.postgres_synced_tables.*.new_pipeline_spec.storage_catalog	string	ALL
+resources.postgres_synced_tables.*.new_pipeline_spec.storage_schema	string	ALL
+resources.postgres_synced_tables.*.postgres_database	string	ALL
+resources.postgres_synced_tables.*.primary_key_columns	[]string	ALL
+resources.postgres_synced_tables.*.primary_key_columns[*]	string	ALL
+resources.postgres_synced_tables.*.scheduling_policy	postgres.SyncedTableSyncedTableSpecSyncedTableSchedulingPolicy	ALL
+resources.postgres_synced_tables.*.source_table_full_name	string	ALL
+resources.postgres_synced_tables.*.status	*postgres.SyncedTableSyncedTableStatus	REMOTE
+resources.postgres_synced_tables.*.status.detailed_state	postgres.SyncedTableState	REMOTE
+resources.postgres_synced_tables.*.status.last_processed_commit_version	int64	REMOTE
+resources.postgres_synced_tables.*.status.last_sync	*postgres.SyncedTablePosition	REMOTE
+resources.postgres_synced_tables.*.status.last_sync.delta_table_sync_info	*postgres.DeltaTableSyncInfo	REMOTE
+resources.postgres_synced_tables.*.status.last_sync.delta_table_sync_info.delta_commit_time	*time.Time	REMOTE
+resources.postgres_synced_tables.*.status.last_sync.delta_table_sync_info.delta_commit_version	int64	REMOTE
+resources.postgres_synced_tables.*.status.last_sync.sync_end_time	*time.Time	REMOTE
+resources.postgres_synced_tables.*.status.last_sync.sync_start_time	*time.Time	REMOTE
+resources.postgres_synced_tables.*.status.last_sync_time	*time.Time	REMOTE
+resources.postgres_synced_tables.*.status.message	string	REMOTE
+resources.postgres_synced_tables.*.status.ongoing_sync_progress	*postgres.SyncedTablePipelineProgress	REMOTE
+resources.postgres_synced_tables.*.status.ongoing_sync_progress.estimated_completion_time_seconds	float64	REMOTE
+resources.postgres_synced_tables.*.status.ongoing_sync_progress.latest_version_currently_processing	int64	REMOTE
+resources.postgres_synced_tables.*.status.ongoing_sync_progress.sync_progress_completion	float64	REMOTE
+resources.postgres_synced_tables.*.status.ongoing_sync_progress.synced_row_count	int64	REMOTE
+resources.postgres_synced_tables.*.status.ongoing_sync_progress.total_row_count	int64	REMOTE
+resources.postgres_synced_tables.*.status.pipeline_id	string	REMOTE
+resources.postgres_synced_tables.*.status.project	string	REMOTE
+resources.postgres_synced_tables.*.status.provisioning_phase	postgres.ProvisioningPhase	REMOTE
+resources.postgres_synced_tables.*.status.unity_catalog_provisioning_state	postgres.ProvisioningInfoState	REMOTE
+resources.postgres_synced_tables.*.synced_table_id	string	ALL
+resources.postgres_synced_tables.*.timeseries_key	string	ALL
+resources.postgres_synced_tables.*.type_overrides	[]postgres.SyncedTableSyncedTableSpecTypeOverride	ALL
+resources.postgres_synced_tables.*.type_overrides[*]	postgres.SyncedTableSyncedTableSpecTypeOverride	ALL
+resources.postgres_synced_tables.*.type_overrides[*].column_name	string	ALL
+resources.postgres_synced_tables.*.type_overrides[*].pg_type	postgres.SyncedTableSyncedTableSpecPgSpecificType	ALL
+resources.postgres_synced_tables.*.type_overrides[*].size	int	ALL
+resources.postgres_synced_tables.*.uid	string	REMOTE
+resources.postgres_synced_tables.*.url	string	INPUT
 resources.quality_monitors.*.assets_dir	string	ALL
 resources.quality_monitors.*.baseline_table_name	string	ALL
 resources.quality_monitors.*.custom_metrics	[]catalog.MonitorMetric	ALL
@@ -2868,6 +4315,7 @@ resources.schemas.*.catalog_type	catalog.CatalogType	REMOTE
 resources.schemas.*.comment	string	ALL
 resources.schemas.*.created_at	int64	REMOTE
 resources.schemas.*.created_by	string	REMOTE
+resources.schemas.*.custom_max_retention_hours	int64	ALL
 resources.schemas.*.effective_predictive_optimization_flag	*catalog.EffectivePredictiveOptimizationFlag	REMOTE
 resources.schemas.*.effective_predictive_optimization_flag.inherited_from_name	string	REMOTE
 resources.schemas.*.effective_predictive_optimization_flag.inherited_from_type	catalog.EffectivePredictiveOptimizationFlagInheritedFromType	REMOTE
@@ -2895,27 +4343,53 @@ resources.schemas.*.grants[*]	catalog.PrivilegeAssignment	ALL
 resources.schemas.*.grants[*].principal	string	ALL
 resources.schemas.*.grants[*].privileges	[]catalog.Privilege	ALL
 resources.schemas.*.grants[*].privileges[*]	catalog.Privilege	ALL
-resources.secret_scopes.*.backend_azure_keyvault	*workspace.AzureKeyVaultSecretScopeMetadata	STATE
-resources.secret_scopes.*.backend_azure_keyvault.dns_name	string	STATE
-resources.secret_scopes.*.backend_azure_keyvault.resource_id	string	STATE
-resources.secret_scopes.*.backend_type	workspace.ScopeBackendType	INPUT	REMOTE
+resources.secret_scopes.*.backend_azure_keyvault	*workspace.AzureKeyVaultSecretScopeMetadata	REMOTE	STATE
+resources.secret_scopes.*.backend_azure_keyvault.dns_name	string	REMOTE	STATE
+resources.secret_scopes.*.backend_azure_keyvault.resource_id	string	REMOTE	STATE
+resources.secret_scopes.*.backend_type	workspace.ScopeBackendType	INPUT
 resources.secret_scopes.*.id	string	INPUT
 resources.secret_scopes.*.initial_manage_principal	string	STATE
-resources.secret_scopes.*.keyvault_metadata	*workspace.AzureKeyVaultSecretScopeMetadata	INPUT	REMOTE
-resources.secret_scopes.*.keyvault_metadata.dns_name	string	INPUT	REMOTE
-resources.secret_scopes.*.keyvault_metadata.resource_id	string	INPUT	REMOTE
+resources.secret_scopes.*.keyvault_metadata	*workspace.AzureKeyVaultSecretScopeMetadata	INPUT
+resources.secret_scopes.*.keyvault_metadata.dns_name	string	INPUT
+resources.secret_scopes.*.keyvault_metadata.resource_id	string	INPUT
 resources.secret_scopes.*.lifecycle	resources.Lifecycle	INPUT
 resources.secret_scopes.*.lifecycle.prevent_destroy	bool	INPUT
 resources.secret_scopes.*.modified_status	string	INPUT
 resources.secret_scopes.*.name	string	INPUT	REMOTE
-resources.secret_scopes.*.scope	string	STATE
-resources.secret_scopes.*.scope_backend_type	workspace.ScopeBackendType	STATE
+resources.secret_scopes.*.scope	string	REMOTE	STATE
+resources.secret_scopes.*.scope_backend_type	workspace.ScopeBackendType	REMOTE	STATE
 resources.secret_scopes.*.url	string	INPUT
 resources.secret_scopes.*.permissions.acls	[]workspace.AclItem	ALL
 resources.secret_scopes.*.permissions.acls[*]	workspace.AclItem	ALL
 resources.secret_scopes.*.permissions.acls[*].permission	workspace.AclPermission	ALL
 resources.secret_scopes.*.permissions.acls[*].principal	string	ALL
 resources.secret_scopes.*.permissions.scope_name	string	ALL
+resources.secrets.*.catalog_name	string	ALL
+resources.secrets.*.comment	string	ALL
+resources.secrets.*.create_time	*time.Time	ALL
+resources.secrets.*.created_by	string	ALL
+resources.secrets.*.effective_owner	string	ALL
+resources.secrets.*.effective_value	string	ALL
+resources.secrets.*.expire_time	*time.Time	ALL
+resources.secrets.*.full_name	string	ALL
+resources.secrets.*.id	string	INPUT
+resources.secrets.*.lifecycle	resources.Lifecycle	INPUT
+resources.secrets.*.lifecycle.prevent_destroy	bool	INPUT
+resources.secrets.*.metastore_id	string	ALL
+resources.secrets.*.modified_status	string	INPUT
+resources.secrets.*.name	string	ALL
+resources.secrets.*.owner	string	ALL
+resources.secrets.*.schema_name	string	ALL
+resources.secrets.*.update_time	*time.Time	ALL
+resources.secrets.*.updated_by	string	ALL
+resources.secrets.*.url	string	INPUT
+resources.secrets.*.value	string	ALL
+resources.secrets.*.grants.full_name	string	ALL
+resources.secrets.*.grants.securable_type	string	ALL
+resources.secrets.*.grants[*]	catalog.PrivilegeAssignment	ALL
+resources.secrets.*.grants[*].principal	string	ALL
+resources.secrets.*.grants[*].privileges	[]catalog.Privilege	ALL
+resources.secrets.*.grants[*].privileges[*]	catalog.Privilege	ALL
 resources.sql_warehouses.*.auto_stop_mins	int	ALL
 resources.sql_warehouses.*.channel	*sql.Channel	ALL
 resources.sql_warehouses.*.channel.dbsql_version	string	ALL
@@ -2937,8 +4411,11 @@ resources.sql_warehouses.*.health.summary	string	REMOTE
 resources.sql_warehouses.*.id	string	INPUT	REMOTE
 resources.sql_warehouses.*.instance_profile_arn	string	ALL
 resources.sql_warehouses.*.jdbc_url	string	REMOTE
+resources.sql_warehouses.*.lifecycle	*dresources.StateLifecycle	REMOTE	STATE
+resources.sql_warehouses.*.lifecycle	*resources.LifecycleWithStarted	INPUT
 resources.sql_warehouses.*.lifecycle	resources.Lifecycle	INPUT
 resources.sql_warehouses.*.lifecycle.prevent_destroy	bool	INPUT
+resources.sql_warehouses.*.lifecycle.started	*bool	ALL
 resources.sql_warehouses.*.max_num_clusters	int	ALL
 resources.sql_warehouses.*.min_num_clusters	int	ALL
 resources.sql_warehouses.*.modified_status	string	INPUT
@@ -2952,6 +4429,7 @@ resources.sql_warehouses.*.odbc_params.port	int	REMOTE
 resources.sql_warehouses.*.odbc_params.protocol	string	REMOTE
 resources.sql_warehouses.*.spot_instance_policy	sql.SpotInstancePolicy	ALL
 resources.sql_warehouses.*.state	sql.State	REMOTE
+resources.sql_warehouses.*.statement_timeout	int	ALL
 resources.sql_warehouses.*.tags	*sql.EndpointTags	ALL
 resources.sql_warehouses.*.tags.custom_tags	[]sql.EndpointTagPair	ALL
 resources.sql_warehouses.*.tags.custom_tags[*]	sql.EndpointTagPair	ALL
@@ -3017,6 +4495,7 @@ resources.synced_database_tables.*.logical_database_name	string	ALL
 resources.synced_database_tables.*.modified_status	string	INPUT
 resources.synced_database_tables.*.name	string	ALL
 resources.synced_database_tables.*.spec	*database.SyncedTableSpec	ALL
+resources.synced_database_tables.*.spec.accelerated_sync	bool	ALL
 resources.synced_database_tables.*.spec.create_database_objects_if_missing	bool	ALL
 resources.synced_database_tables.*.spec.existing_pipeline_id	string	ALL
 resources.synced_database_tables.*.spec.new_pipeline_spec	*database.NewPipelineSpec	ALL
@@ -3028,6 +4507,11 @@ resources.synced_database_tables.*.spec.primary_key_columns[*]	string	ALL
 resources.synced_database_tables.*.spec.scheduling_policy	database.SyncedTableSchedulingPolicy	ALL
 resources.synced_database_tables.*.spec.source_table_full_name	string	ALL
 resources.synced_database_tables.*.spec.timeseries_key	string	ALL
+resources.synced_database_tables.*.spec.type_overrides	[]database.SyncedTableSpecTypeOverride	ALL
+resources.synced_database_tables.*.spec.type_overrides[*]	database.SyncedTableSpecTypeOverride	ALL
+resources.synced_database_tables.*.spec.type_overrides[*].column_name	string	ALL
+resources.synced_database_tables.*.spec.type_overrides[*].pg_type	database.SyncedTableSpecPgSpecificType	ALL
+resources.synced_database_tables.*.spec.type_overrides[*].size	int	ALL
 resources.synced_database_tables.*.unity_catalog_provisioning_state	database.ProvisioningInfoState	ALL
 resources.synced_database_tables.*.url	string	INPUT
 resources.vector_search_endpoints.*.budget_policy_id	string	ALL
@@ -3048,13 +4532,13 @@ resources.vector_search_endpoints.*.last_updated_timestamp	int64	REMOTE
 resources.vector_search_endpoints.*.last_updated_user	string	REMOTE
 resources.vector_search_endpoints.*.lifecycle	resources.Lifecycle	INPUT
 resources.vector_search_endpoints.*.lifecycle.prevent_destroy	bool	INPUT
-resources.vector_search_endpoints.*.min_qps	int64	INPUT	STATE
 resources.vector_search_endpoints.*.modified_status	string	INPUT
 resources.vector_search_endpoints.*.name	string	ALL
 resources.vector_search_endpoints.*.num_indexes	int	REMOTE
 resources.vector_search_endpoints.*.scaling_info	*vectorsearch.EndpointScalingInfo	REMOTE
-resources.vector_search_endpoints.*.scaling_info.requested_min_qps	int64	REMOTE
+resources.vector_search_endpoints.*.scaling_info.requested_target_qps	int64	REMOTE
 resources.vector_search_endpoints.*.scaling_info.state	vectorsearch.ScalingChangeState	REMOTE
+resources.vector_search_endpoints.*.target_qps	int64	ALL
 resources.vector_search_endpoints.*.url	string	INPUT
 resources.vector_search_endpoints.*.usage_policy_id	string	INPUT	STATE
 resources.vector_search_endpoints.*.permissions.object_id	string	ALL
@@ -3063,6 +4547,60 @@ resources.vector_search_endpoints.*.permissions[*].group_name	string	ALL
 resources.vector_search_endpoints.*.permissions[*].level	iam.PermissionLevel	ALL
 resources.vector_search_endpoints.*.permissions[*].service_principal_name	string	ALL
 resources.vector_search_endpoints.*.permissions[*].user_name	string	ALL
+resources.vector_search_indexes.*.creator	string	REMOTE
+resources.vector_search_indexes.*.delta_sync_index_spec	*vectorsearch.DeltaSyncVectorIndexSpecRequest	INPUT	STATE
+resources.vector_search_indexes.*.delta_sync_index_spec	*vectorsearch.DeltaSyncVectorIndexSpecResponse	REMOTE
+resources.vector_search_indexes.*.delta_sync_index_spec.columns_to_index	[]string	ALL
+resources.vector_search_indexes.*.delta_sync_index_spec.columns_to_index[*]	string	ALL
+resources.vector_search_indexes.*.delta_sync_index_spec.columns_to_sync	[]string	ALL
+resources.vector_search_indexes.*.delta_sync_index_spec.columns_to_sync[*]	string	ALL
+resources.vector_search_indexes.*.delta_sync_index_spec.embedding_source_columns	[]vectorsearch.EmbeddingSourceColumn	ALL
+resources.vector_search_indexes.*.delta_sync_index_spec.embedding_source_columns[*]	vectorsearch.EmbeddingSourceColumn	ALL
+resources.vector_search_indexes.*.delta_sync_index_spec.embedding_source_columns[*].embedding_model_endpoint_name	string	ALL
+resources.vector_search_indexes.*.delta_sync_index_spec.embedding_source_columns[*].model_endpoint_name_for_query	string	ALL
+resources.vector_search_indexes.*.delta_sync_index_spec.embedding_source_columns[*].name	string	ALL
+resources.vector_search_indexes.*.delta_sync_index_spec.embedding_vector_columns	[]vectorsearch.EmbeddingVectorColumn	ALL
+resources.vector_search_indexes.*.delta_sync_index_spec.embedding_vector_columns[*]	vectorsearch.EmbeddingVectorColumn	ALL
+resources.vector_search_indexes.*.delta_sync_index_spec.embedding_vector_columns[*].embedding_dimension	int	ALL
+resources.vector_search_indexes.*.delta_sync_index_spec.embedding_vector_columns[*].name	string	ALL
+resources.vector_search_indexes.*.delta_sync_index_spec.embedding_writeback_table	string	ALL
+resources.vector_search_indexes.*.delta_sync_index_spec.pipeline_id	string	REMOTE
+resources.vector_search_indexes.*.delta_sync_index_spec.pipeline_type	vectorsearch.PipelineType	ALL
+resources.vector_search_indexes.*.delta_sync_index_spec.source_table	string	ALL
+resources.vector_search_indexes.*.direct_access_index_spec	*vectorsearch.DirectAccessVectorIndexSpec	ALL
+resources.vector_search_indexes.*.direct_access_index_spec.embedding_source_columns	[]vectorsearch.EmbeddingSourceColumn	ALL
+resources.vector_search_indexes.*.direct_access_index_spec.embedding_source_columns[*]	vectorsearch.EmbeddingSourceColumn	ALL
+resources.vector_search_indexes.*.direct_access_index_spec.embedding_source_columns[*].embedding_model_endpoint_name	string	ALL
+resources.vector_search_indexes.*.direct_access_index_spec.embedding_source_columns[*].model_endpoint_name_for_query	string	ALL
+resources.vector_search_indexes.*.direct_access_index_spec.embedding_source_columns[*].name	string	ALL
+resources.vector_search_indexes.*.direct_access_index_spec.embedding_vector_columns	[]vectorsearch.EmbeddingVectorColumn	ALL
+resources.vector_search_indexes.*.direct_access_index_spec.embedding_vector_columns[*]	vectorsearch.EmbeddingVectorColumn	ALL
+resources.vector_search_indexes.*.direct_access_index_spec.embedding_vector_columns[*].embedding_dimension	int	ALL
+resources.vector_search_indexes.*.direct_access_index_spec.embedding_vector_columns[*].name	string	ALL
+resources.vector_search_indexes.*.direct_access_index_spec.schema_json	string	ALL
+resources.vector_search_indexes.*.endpoint_id	string	REMOTE
+resources.vector_search_indexes.*.endpoint_name	string	ALL
+resources.vector_search_indexes.*.endpoint_uuid	string	REMOTE	STATE
+resources.vector_search_indexes.*.id	string	INPUT
+resources.vector_search_indexes.*.index_subtype	vectorsearch.IndexSubtype	ALL
+resources.vector_search_indexes.*.index_type	vectorsearch.VectorIndexType	ALL
+resources.vector_search_indexes.*.lifecycle	resources.Lifecycle	INPUT
+resources.vector_search_indexes.*.lifecycle.prevent_destroy	bool	INPUT
+resources.vector_search_indexes.*.modified_status	string	INPUT
+resources.vector_search_indexes.*.name	string	ALL
+resources.vector_search_indexes.*.primary_key	string	ALL
+resources.vector_search_indexes.*.status	*vectorsearch.VectorIndexStatus	REMOTE
+resources.vector_search_indexes.*.status.index_url	string	REMOTE
+resources.vector_search_indexes.*.status.indexed_row_count	int64	REMOTE
+resources.vector_search_indexes.*.status.message	string	REMOTE
+resources.vector_search_indexes.*.status.ready	bool	REMOTE
+resources.vector_search_indexes.*.url	string	INPUT
+resources.vector_search_indexes.*.grants.full_name	string	ALL
+resources.vector_search_indexes.*.grants.securable_type	string	ALL
+resources.vector_search_indexes.*.grants[*]	catalog.PrivilegeAssignment	ALL
+resources.vector_search_indexes.*.grants[*].principal	string	ALL
+resources.vector_search_indexes.*.grants[*].privileges	[]catalog.Privilege	ALL
+resources.vector_search_indexes.*.grants[*].privileges[*]	catalog.Privilege	ALL
 resources.volumes.*.access_point	string	REMOTE
 resources.volumes.*.browse_only	bool	REMOTE
 resources.volumes.*.catalog_name	string	ALL
@@ -3087,6 +4625,7 @@ resources.volumes.*.updated_at	int64	REMOTE
 resources.volumes.*.updated_by	string	REMOTE
 resources.volumes.*.url	string	INPUT
 resources.volumes.*.volume_id	string	REMOTE
+resources.volumes.*.volume_path	string	INPUT
 resources.volumes.*.volume_type	catalog.VolumeType	ALL
 resources.volumes.*.grants.full_name	string	ALL
 resources.volumes.*.grants.securable_type	string	ALL
diff --git a/acceptance/bundle/refschema/out.test.toml b/acceptance/bundle/refschema/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/refschema/out.test.toml
+++ b/acceptance/bundle/refschema/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/refschema/test.toml b/acceptance/bundle/refschema/test.toml
deleted file mode 100644
index 4564a92fedc..00000000000
--- a/acceptance/bundle/refschema/test.toml
+++ /dev/null
@@ -1,2 +0,0 @@
-Cloud = false
-Local = true
diff --git a/acceptance/bundle/resource_deps/bad_ref_string_to_int/out.plan.terraform.txt b/acceptance/bundle/resource_deps/bad_ref_string_to_int/out.plan.terraform.txt
deleted file mode 100644
index 07e73cf4a84..00000000000
--- a/acceptance/bundle/resource_deps/bad_ref_string_to_int/out.plan.terraform.txt
+++ /dev/null
@@ -1,14 +0,0 @@
-
->>> musterr [CLI] bundle plan
-Error: exit status 1
-
-Error: Incorrect attribute value type
-
-  on bundle.tf.json line 43, in resource.databricks_job.foo.task[0].run_job_task:
-  43:               "job_id": "${databricks_job.bar.name}"
-    ├────────────────
-    │ databricks_job.bar.name is "job bar"
-
-Inappropriate value for attribute "job_id": a number is required.
-
-
diff --git a/acceptance/bundle/resource_deps/bad_ref_string_to_int/out.plan.direct.txt b/acceptance/bundle/resource_deps/bad_ref_string_to_int/out.plan.txt
similarity index 100%
rename from acceptance/bundle/resource_deps/bad_ref_string_to_int/out.plan.direct.txt
rename to acceptance/bundle/resource_deps/bad_ref_string_to_int/out.plan.txt
diff --git a/acceptance/bundle/resource_deps/bad_ref_string_to_int/out.test.toml b/acceptance/bundle/resource_deps/bad_ref_string_to_int/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resource_deps/bad_ref_string_to_int/out.test.toml
+++ b/acceptance/bundle/resource_deps/bad_ref_string_to_int/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/bad_ref_string_to_int/script b/acceptance/bundle/resource_deps/bad_ref_string_to_int/script
index 3471c56628c..f486f04ba0b 100644
--- a/acceptance/bundle/resource_deps/bad_ref_string_to_int/script
+++ b/acceptance/bundle/resource_deps/bad_ref_string_to_int/script
@@ -1 +1 @@
-trace musterr $CLI bundle plan &> out.plan.$DATABRICKS_BUNDLE_ENGINE.txt
+trace musterr $CLI bundle plan &> out.plan.txt
diff --git a/acceptance/bundle/resource_deps/bad_ref_string_to_int/test.toml b/acceptance/bundle/resource_deps/bad_ref_string_to_int/test.toml
index 022acf3a195..96416f814ae 100644
--- a/acceptance/bundle/resource_deps/bad_ref_string_to_int/test.toml
+++ b/acceptance/bundle/resource_deps/bad_ref_string_to_int/test.toml
@@ -1,8 +1,3 @@
 RecordRequests = false
 
-[Env]
-DATABRICKS_CACHE_ENABLED = 'false'
-
-[[Repls]]
-Old = 'terraform.tfstate'
-New = 'resources.json'
+Env.DATABRICKS_CACHE_ENABLED = 'false'
diff --git a/acceptance/bundle/resource_deps/bad_syntax/out.deploy.direct.txt b/acceptance/bundle/resource_deps/bad_syntax/out.deploy.direct.txt
deleted file mode 100644
index 6bed0296b30..00000000000
--- a/acceptance/bundle/resource_deps/bad_syntax/out.deploy.direct.txt
+++ /dev/null
@@ -1,6 +0,0 @@
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
-Unexpected success
diff --git a/acceptance/bundle/resource_deps/bad_syntax/out.deploy.txt b/acceptance/bundle/resource_deps/bad_syntax/out.deploy.txt
new file mode 100644
index 00000000000..e24248ef46b
--- /dev/null
+++ b/acceptance/bundle/resource_deps/bad_syntax/out.deploy.txt
@@ -0,0 +1,7 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created volumes.bar
+Created volumes.foo
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+Unexpected success
diff --git a/acceptance/bundle/resource_deps/bad_syntax/out.plan.terraform.txt b/acceptance/bundle/resource_deps/bad_syntax/out.plan.terraform.txt
deleted file mode 100644
index b8f8078abac..00000000000
--- a/acceptance/bundle/resource_deps/bad_syntax/out.plan.terraform.txt
+++ /dev/null
@@ -1,10 +0,0 @@
-Error: exit status 1
-
-Error: Invalid attribute name
-
-  on bundle.tf.json line 22, in resource.databricks_volume.foo:
-  22:         "catalog_name": "${resources.volumes.bar.bad..syntax}",
-
-An attribute name is required after a dot.
-
-
diff --git a/acceptance/bundle/resource_deps/bad_syntax/out.plan.direct.txt b/acceptance/bundle/resource_deps/bad_syntax/out.plan.txt
similarity index 100%
rename from acceptance/bundle/resource_deps/bad_syntax/out.plan.direct.txt
rename to acceptance/bundle/resource_deps/bad_syntax/out.plan.txt
diff --git a/acceptance/bundle/resource_deps/bad_syntax/out.test.toml b/acceptance/bundle/resource_deps/bad_syntax/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resource_deps/bad_syntax/out.test.toml
+++ b/acceptance/bundle/resource_deps/bad_syntax/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/bad_syntax/output.txt b/acceptance/bundle/resource_deps/bad_syntax/output.txt
index 0e9d83b6431..6f8aff1ed98 100644
--- a/acceptance/bundle/resource_deps/bad_syntax/output.txt
+++ b/acceptance/bundle/resource_deps/bad_syntax/output.txt
@@ -6,12 +6,14 @@
       "catalog_name": "mycatalog",
       "name": "barname",
       "schema_name": "myschema",
+      "volume_path": "/Volumes/mycatalog/myschema/barname",
       "volume_type": "MANAGED"
     },
     "foo": {
       "catalog_name": "${resources.volumes.bar.bad..syntax}",
       "name": "myname",
       "schema_name": "${resources.volumes.bar.schema_name}",
+      "volume_path": "/Volumes/${resources.volumes.bar.bad..syntax}/myschema/myname",
       "volume_type": "MANAGED"
     }
   }
diff --git a/acceptance/bundle/resource_deps/bad_syntax/script b/acceptance/bundle/resource_deps/bad_syntax/script
index fe9628a126d..032d2a25441 100644
--- a/acceptance/bundle/resource_deps/bad_syntax/script
+++ b/acceptance/bundle/resource_deps/bad_syntax/script
@@ -1,3 +1,3 @@
 trace $CLI bundle validate -o json | jq .resources
-$CLI bundle plan &> out.plan.$DATABRICKS_BUNDLE_ENGINE.txt
-musterr $CLI bundle deploy &> out.deploy.$DATABRICKS_BUNDLE_ENGINE.txt
+$CLI bundle plan &> out.plan.txt
+musterr $CLI bundle deploy &> out.deploy.txt
diff --git a/acceptance/bundle/resource_deps/computed_volume_path/databricks.yml.tmpl b/acceptance/bundle/resource_deps/computed_volume_path/databricks.yml.tmpl
new file mode 100644
index 00000000000..ec1e2619848
--- /dev/null
+++ b/acceptance/bundle/resource_deps/computed_volume_path/databricks.yml.tmpl
@@ -0,0 +1,20 @@
+bundle:
+  name: testbundle-${UNIQUE_NAME}
+
+resources:
+  schemas:
+    my:
+      catalog_name: main
+      name: myschema-${UNIQUE_NAME}
+
+  volumes:
+    bar:
+      catalog_name: main
+      schema_name: myschema-${UNIQUE_NAME}
+      name: volumebar-${UNIQUE_NAME}
+
+    foo:
+      catalog_name: main
+      schema_name: myschema-${UNIQUE_NAME}
+      name: volumefoo-${UNIQUE_NAME}
+      comment: ${resources.volumes.bar.volume_path}
diff --git a/acceptance/bundle/resource_deps/computed_volume_path/out.test.toml b/acceptance/bundle/resource_deps/computed_volume_path/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resource_deps/computed_volume_path/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/computed_volume_path/output.txt b/acceptance/bundle/resource_deps/computed_volume_path/output.txt
new file mode 100644
index 00000000000..2db063aca34
--- /dev/null
+++ b/acceptance/bundle/resource_deps/computed_volume_path/output.txt
@@ -0,0 +1,36 @@
+
+>>> [CLI] bundle validate -o json
+{
+  "schemas": {
+    "my": {
+      "catalog_name": "main",
+      "name": "myschema-[UNIQUE_NAME]"
+    }
+  },
+  "volumes": {
+    "bar": {
+      "catalog_name": "main",
+      "name": "volumebar-[UNIQUE_NAME]",
+      "schema_name": "${resources.schemas.my.name}",
+      "volume_path": "/Volumes/main/myschema-[UNIQUE_NAME]/volumebar-[UNIQUE_NAME]",
+      "volume_type": "MANAGED"
+    },
+    "foo": {
+      "catalog_name": "main",
+      "comment": "/Volumes/main/myschema-[UNIQUE_NAME]/volumebar-[UNIQUE_NAME]",
+      "name": "volumefoo-[UNIQUE_NAME]",
+      "schema_name": "${resources.schemas.my.name}",
+      "volume_path": "/Volumes/main/myschema-[UNIQUE_NAME]/volumefoo-[UNIQUE_NAME]",
+      "volume_type": "MANAGED"
+    }
+  }
+}
+
+>>> [CLI] bundle plan
+create schemas.my
+create volumes.bar
+create volumes.foo
+
+Plan: 3 to add, 0 to change, 0 to delete, 0 unchanged
+
+>>> print_requests.py --get //unity
diff --git a/acceptance/bundle/resource_deps/computed_volume_path/script b/acceptance/bundle/resource_deps/computed_volume_path/script
new file mode 100644
index 00000000000..c6c051b389b
--- /dev/null
+++ b/acceptance/bundle/resource_deps/computed_volume_path/script
@@ -0,0 +1,4 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+trace $CLI bundle validate -o json | jq .resources
+trace $CLI bundle plan
+trace print_requests.py --get //unity
diff --git a/acceptance/bundle/resource_deps/create_error/out.deploy.direct.txt b/acceptance/bundle/resource_deps/create_error/out.deploy.direct.txt
deleted file mode 100644
index 40c9dce1038..00000000000
--- a/acceptance/bundle/resource_deps/create_error/out.deploy.direct.txt
+++ /dev/null
@@ -1,14 +0,0 @@
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Error: cannot create resources.jobs.foo: INJECTED (500 UNKNOWN)
-
-Endpoint: POST [DATABRICKS_URL]/api/2.2/jobs/create
-HTTP Status: 500 Internal Server Error
-API error_code: UNKNOWN
-API message: INJECTED
-
-Error: cannot create resources.jobs.bar: dependency failed: resources.jobs.foo
-
-Error: cannot create resources.jobs.baz: dependency failed: resources.jobs.foo
-
-Updating deployment state...
diff --git a/acceptance/bundle/resource_deps/create_error/out.deploy.terraform.txt b/acceptance/bundle/resource_deps/create_error/out.deploy.terraform.txt
deleted file mode 100644
index a09da8f06f1..00000000000
--- a/acceptance/bundle/resource_deps/create_error/out.deploy.terraform.txt
+++ /dev/null
@@ -1,13 +0,0 @@
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Error: terraform apply: exit status 1
-
-Error: cannot create job: INJECTED
-
-  with databricks_job.foo,
-  on bundle.tf.json line 56, in resource.databricks_job.foo:
-  56:       },
-
-
-
-Updating deployment state...
diff --git a/acceptance/bundle/resource_deps/create_error/out.deploy.txt b/acceptance/bundle/resource_deps/create_error/out.deploy.txt
new file mode 100644
index 00000000000..6dedb23b1e7
--- /dev/null
+++ b/acceptance/bundle/resource_deps/create_error/out.deploy.txt
@@ -0,0 +1,13 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Error: cannot create resources.jobs.foo: INJECTED (500 UNKNOWN)
+
+Endpoint: POST [DATABRICKS_URL]/api/2.2/jobs/create
+HTTP Status: 500 Internal Server Error
+API error_code: UNKNOWN
+API message: INJECTED
+
+Error: cannot create resources.jobs.bar: dependency failed: resources.jobs.foo
+
+Error: cannot create resources.jobs.baz: dependency failed: resources.jobs.foo
+
+Files: 0 uploaded, 0 deleted
diff --git a/acceptance/bundle/resource_deps/create_error/out.test.toml b/acceptance/bundle/resource_deps/create_error/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resource_deps/create_error/out.test.toml
+++ b/acceptance/bundle/resource_deps/create_error/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/create_error/output.txt b/acceptance/bundle/resource_deps/create_error/output.txt
index 38c5ef034f7..9c44fd808d2 100644
--- a/acceptance/bundle/resource_deps/create_error/output.txt
+++ b/acceptance/bundle/resource_deps/create_error/output.txt
@@ -7,7 +7,7 @@ create jobs.independent
 
 Plan: 4 to add, 0 to change, 0 to delete, 0 unchanged
 
->>> print_requests.py --sort //jobs
+>>> print_requests.py --nostamp --sort //jobs
 {
   "method": "POST",
   "path": "/api/2.2/jobs/create",
@@ -64,7 +64,7 @@ Resources:
       URL:  (not deployed)
     independent:
       Name: independent
-      URL:  [DATABRICKS_URL]/jobs/[INDEPENDENT_ID]?o=[NUMID]
+      URL:  [DATABRICKS_URL]/jobs/[INDEPENDENT_ID]?w=[WORKSPACE_ID]
 
 === Plan should still contain foo and bar
 >>> [CLI] bundle plan
@@ -75,7 +75,7 @@ create jobs.foo
 Plan: 3 to add, 0 to change, 0 to delete, 1 unchanged
 
 === Expecting no difference in the output between first and second deploy
->>> print_requests.py //jobs
+>>> print_requests.py --nostamp //jobs
 {
   "method": "POST",
   "path": "/api/2.2/jobs/create",
@@ -101,10 +101,9 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
 
->>> print_requests.py //jobs
+>>> print_requests.py --nostamp //jobs
 {
   "method": "POST",
   "path": "/api/2.2/jobs/delete",
diff --git a/acceptance/bundle/resource_deps/create_error/script b/acceptance/bundle/resource_deps/create_error/script
index d475fdaea78..99db55f4494 100644
--- a/acceptance/bundle/resource_deps/create_error/script
+++ b/acceptance/bundle/resource_deps/create_error/script
@@ -1,7 +1,7 @@
 echo "*" > .gitignore
 trace $CLI bundle plan 2>&1
-musterr $CLI bundle deploy &> out.deploy.$DATABRICKS_BUNDLE_ENGINE.txt
-trace print_requests.py --sort //jobs
+musterr $CLI bundle deploy -q &> out.deploy.txt  # -q: independent job races the failure
+trace print_requests.py --nostamp --sort //jobs
 
 trace $CLI bundle summary
 
@@ -11,12 +11,12 @@ replace_ids.py
 title "Plan should still contain foo and bar"
 trace $CLI bundle plan
 
-rm out.requests.txt
-musterr $CLI bundle deploy &> out.deploy2.$DATABRICKS_BUNDLE_ENGINE.txt
+rm "$OUT_REQUESTS"
+musterr $CLI bundle deploy -q &> out.deploy2.txt
 title "Expecting no difference in the output between first and second deploy"
-diff.py out.deploy.$DATABRICKS_BUNDLE_ENGINE.txt out.deploy2.$DATABRICKS_BUNDLE_ENGINE.txt
-rm out.deploy2.$DATABRICKS_BUNDLE_ENGINE.txt
-trace print_requests.py //jobs
+diff.py out.deploy.txt out.deploy2.txt
+rm out.deploy2.txt
+trace print_requests.py --nostamp //jobs
 
 trace $CLI bundle destroy --auto-approve
-trace print_requests.py //jobs
+trace print_requests.py --nostamp //jobs
diff --git a/acceptance/bundle/resource_deps/duplicate_ref/databricks.yml b/acceptance/bundle/resource_deps/duplicate_ref/databricks.yml
new file mode 100644
index 00000000000..cd607f26599
--- /dev/null
+++ b/acceptance/bundle/resource_deps/duplicate_ref/databricks.yml
@@ -0,0 +1,14 @@
+bundle:
+  name: test-bundle
+
+# The same reference appearing more than once within a single field:
+# - bar: input field reference (resolvable at plan time)
+# - baz: id reference (resolved after foo is created)
+resources:
+  pipelines:
+    foo:
+      name: pfoo
+    bar:
+      name: pbar ${resources.pipelines.foo.name} ${resources.pipelines.foo.name}
+    baz:
+      name: pbaz ${resources.pipelines.foo.id} ${resources.pipelines.foo.id}
diff --git a/acceptance/bundle/resource_deps/duplicate_ref/out.test.toml b/acceptance/bundle/resource_deps/duplicate_ref/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resource_deps/duplicate_ref/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/duplicate_ref/output.txt b/acceptance/bundle/resource_deps/duplicate_ref/output.txt
new file mode 100644
index 00000000000..0fb05fea6c9
--- /dev/null
+++ b/acceptance/bundle/resource_deps/duplicate_ref/output.txt
@@ -0,0 +1,55 @@
+
+>>> [CLI] bundle validate -o json
+{
+  "pipelines": {
+    "bar": {
+      "channel": "CURRENT",
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+      },
+      "edition": "ADVANCED",
+      "name": "pbar ${resources.pipelines.foo.name} ${resources.pipelines.foo.name}"
+    },
+    "baz": {
+      "channel": "CURRENT",
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+      },
+      "edition": "ADVANCED",
+      "name": "pbaz ${resources.pipelines.foo.id} ${resources.pipelines.foo.id}"
+    },
+    "foo": {
+      "channel": "CURRENT",
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+      },
+      "edition": "ADVANCED",
+      "name": "pfoo"
+    }
+  }
+}
+
+>>> [CLI] bundle plan
+create pipelines.bar
+create pipelines.baz
+create pipelines.foo
+
+Plan: 3 to add, 0 to change, 0 to delete, 0 unchanged
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created pipelines.bar
+Created pipelines.baz
+Created pipelines.foo
+Files: 1 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> jq -s [.[] | select(.path=="/api/2.0/pipelines" and .method=="POST") | .body.name] | sort [OUTPUT_DIR]/out.requests.txt
+[
+  "pbar pfoo pfoo",
+  "pbaz [UUID] [UUID]",
+  "pfoo"
+]
diff --git a/acceptance/bundle/resource_deps/duplicate_ref/script b/acceptance/bundle/resource_deps/duplicate_ref/script
new file mode 100644
index 00000000000..00fb0e235b3
--- /dev/null
+++ b/acceptance/bundle/resource_deps/duplicate_ref/script
@@ -0,0 +1,5 @@
+trace $CLI bundle validate -o json | jq .resources
+trace $CLI bundle plan
+trace $CLI bundle deploy
+trace jq -s '[.[] | select(.path=="/api/2.0/pipelines" and .method=="POST") | .body.name] | sort' "$OUT_REQUESTS"
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/resource_deps/escaped_ref/databricks.yml b/acceptance/bundle/resource_deps/escaped_ref/databricks.yml
new file mode 100644
index 00000000000..bbfcb2948dc
--- /dev/null
+++ b/acceptance/bundle/resource_deps/escaped_ref/databricks.yml
@@ -0,0 +1,26 @@
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    bar:
+      name: job bar
+    foo:
+      name: job foo
+      tasks:
+        - task_key: job_task
+          notebook_task:
+            notebook_path: /notebook
+            source: WORKSPACE
+            base_parameters:
+              # An escaped reference that looks like a resource path must not become a
+              # dependency on jobs.bar: foo's only depends_on edge comes from "real"
+              # below, and the API receives the literal "${resources.jobs.bar.id}".
+              escaped: $${resources.jobs.bar.id}
+              # A real reference still resolves.
+              real: ${resources.jobs.bar.id}
+              # Both in one string: the literal survives and the real one resolves.
+              mixed: $${runtime} ${resources.jobs.bar.id}
+              # Same name escaped and real in one string: substitution must not hit the
+              # escaped occurrence just because it appears first.
+              same_name: $${resources.jobs.bar.id} ${resources.jobs.bar.id}
diff --git a/acceptance/bundle/resource_deps/escaped_ref/out.test.toml b/acceptance/bundle/resource_deps/escaped_ref/out.test.toml
new file mode 100644
index 00000000000..f7fafbcc731
--- /dev/null
+++ b/acceptance/bundle/resource_deps/escaped_ref/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/resource_deps/escaped_ref/output.txt b/acceptance/bundle/resource_deps/escaped_ref/output.txt
new file mode 100644
index 00000000000..0bc8c20e1e8
--- /dev/null
+++ b/acceptance/bundle/resource_deps/escaped_ref/output.txt
@@ -0,0 +1,70 @@
+
+=== depends_on: only the real reference creates an edge
+>>> jq .plan | map_values(.depends_on) plan.json
+{
+  "resources.jobs.bar": null,
+  "resources.jobs.foo": [
+    {
+      "node": "resources.jobs.bar",
+      "label": "${resources.jobs.bar.id}"
+    }
+  ]
+}
+
+=== Payload: escaped stays literal, real is resolved
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created jobs.bar
+Created jobs.foo
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //jobs --sort --nostamp
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/create",
+  "body": {
+    "deployment": {
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+    },
+    "edit_mode": "UI_LOCKED",
+    "format": "MULTI_TASK",
+    "max_concurrent_runs": 1,
+    "name": "job bar",
+    "queue": {
+      "enabled": true
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/create",
+  "body": {
+    "deployment": {
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+    },
+    "edit_mode": "UI_LOCKED",
+    "format": "MULTI_TASK",
+    "max_concurrent_runs": 1,
+    "name": "job foo",
+    "queue": {
+      "enabled": true
+    },
+    "tasks": [
+      {
+        "notebook_task": {
+          "base_parameters": {
+            "escaped": "${resources.jobs.bar.id}",
+            "mixed": "${runtime} [BAR_ID]",
+            "real": "[BAR_ID]",
+            "same_name": "${resources.jobs.bar.id} [BAR_ID]"
+          },
+          "notebook_path": "/notebook",
+          "source": "WORKSPACE"
+        },
+        "task_key": "job_task"
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/resource_deps/escaped_ref/script b/acceptance/bundle/resource_deps/escaped_ref/script
new file mode 100644
index 00000000000..ef8244e7eeb
--- /dev/null
+++ b/acceptance/bundle/resource_deps/escaped_ref/script
@@ -0,0 +1,18 @@
+cleanup() {
+    $CLI bundle destroy --auto-approve &> LOG.destroy
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+title "depends_on: only the real reference creates an edge"
+$CLI bundle plan -o json > plan.json
+trace jq '.plan | map_values(.depends_on)' plan.json | nostamp
+
+# Not traced: the READPLAN variant adds "--plan ...", and the point of that variant is
+# that the payload below is identical either way.
+title "Payload: escaped stays literal, real is resolved\n"
+$CLI bundle deploy $(readplanarg plan.json)
+replace_ids.py
+# --nostamp: under deployment-history recording the job payload carries the DMS deployment
+# stamp; drop it so the assertion is the same whether or not recording is on.
+trace print_requests.py //jobs --sort --nostamp
diff --git a/acceptance/bundle/resource_deps/escaped_ref/test.toml b/acceptance/bundle/resource_deps/escaped_ref/test.toml
new file mode 100644
index 00000000000..93b8b0cd76d
--- /dev/null
+++ b/acceptance/bundle/resource_deps/escaped_ref/test.toml
@@ -0,0 +1,7 @@
+# depends_on is only present in the direct engine's plan JSON.
+
+# Also deploy from the saved plan, so the payload is asserted whether it is built
+# in-process or read back from a plan file.
+EnvMatrix.READPLAN = ["", "1"]
+
+Ignore = ["plan.json"]
diff --git a/acceptance/bundle/resource_deps/grant_ref/out.plan_create.direct.json b/acceptance/bundle/resource_deps/grant_ref/out.plan_create.direct.json
deleted file mode 100644
index 970fab66aeb..00000000000
--- a/acceptance/bundle/resource_deps/grant_ref/out.plan_create.direct.json
+++ /dev/null
@@ -1,97 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.schemas.schema_a": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "catalog_name": "main",
-          "name": "schema A"
-        }
-      }
-    },
-    "resources.schemas.schema_a.grants": {
-      "depends_on": [
-        {
-          "node": "resources.schemas.schema_a",
-          "label": "${resources.schemas.schema_a.id}"
-        },
-        {
-          "node": "resources.schemas.schema_b.grants",
-          "label": "${resources.schemas.schema_b.grants[0].principal}"
-        },
-        {
-          "node": "resources.schemas.schema_b.grants",
-          "label": "${resources.schemas.schema_b.grants[1].principal}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "securable_type": "schema",
-          "full_name": "",
-          "__embed__": [
-            {
-              "principal": "viewers",
-              "privileges": [
-                "USE_SCHEMA"
-              ]
-            },
-            {
-              "principal": "editors",
-              "privileges": [
-                "CREATE_TABLE"
-              ]
-            }
-          ]
-        },
-        "vars": {
-          "full_name": "${resources.schemas.schema_a.id}"
-        }
-      }
-    },
-    "resources.schemas.schema_b": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "catalog_name": "main",
-          "name": "schema B"
-        }
-      }
-    },
-    "resources.schemas.schema_b.grants": {
-      "depends_on": [
-        {
-          "node": "resources.schemas.schema_b",
-          "label": "${resources.schemas.schema_b.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "securable_type": "schema",
-          "full_name": "",
-          "__embed__": [
-            {
-              "principal": "viewers",
-              "privileges": [
-                "USE_SCHEMA"
-              ]
-            },
-            {
-              "principal": "editors",
-              "privileges": [
-                "CREATE_TABLE",
-                "USE_SCHEMA"
-              ]
-            }
-          ]
-        },
-        "vars": {
-          "full_name": "${resources.schemas.schema_b.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/grant_ref/out.plan_create.json b/acceptance/bundle/resource_deps/grant_ref/out.plan_create.json
new file mode 100644
index 00000000000..5d3a6e82575
--- /dev/null
+++ b/acceptance/bundle/resource_deps/grant_ref/out.plan_create.json
@@ -0,0 +1,97 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.schemas.schema_a": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "catalog_name": "main",
+          "name": "schema A"
+        }
+      }
+    },
+    "resources.schemas.schema_a.grants": {
+      "depends_on": [
+        {
+          "node": "resources.schemas.schema_a",
+          "label": "${resources.schemas.schema_a.id}"
+        },
+        {
+          "node": "resources.schemas.schema_b.grants",
+          "label": "${resources.schemas.schema_b.grants[0].principal}"
+        },
+        {
+          "node": "resources.schemas.schema_b.grants",
+          "label": "${resources.schemas.schema_b.grants[1].principal}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "securable_type": "schema",
+          "full_name": "",
+          "__embed__": [
+            {
+              "principal": "viewers",
+              "privileges": [
+                "USE_SCHEMA"
+              ]
+            },
+            {
+              "principal": "editors",
+              "privileges": [
+                "CREATE_TABLE"
+              ]
+            }
+          ]
+        },
+        "vars": {
+          "full_name": "${resources.schemas.schema_a.id}"
+        }
+      }
+    },
+    "resources.schemas.schema_b": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "catalog_name": "main",
+          "name": "schema B"
+        }
+      }
+    },
+    "resources.schemas.schema_b.grants": {
+      "depends_on": [
+        {
+          "node": "resources.schemas.schema_b",
+          "label": "${resources.schemas.schema_b.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "securable_type": "schema",
+          "full_name": "",
+          "__embed__": [
+            {
+              "principal": "viewers",
+              "privileges": [
+                "USE_SCHEMA"
+              ]
+            },
+            {
+              "principal": "editors",
+              "privileges": [
+                "CREATE_TABLE",
+                "USE_SCHEMA"
+              ]
+            }
+          ]
+        },
+        "vars": {
+          "full_name": "${resources.schemas.schema_b.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resource_deps/grant_ref/out.test.toml b/acceptance/bundle/resource_deps/grant_ref/out.test.toml
index e90b6d5d1ba..a927a5fbc06 100644
--- a/acceptance/bundle/resource_deps/grant_ref/out.test.toml
+++ b/acceptance/bundle/resource_deps/grant_ref/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/grant_ref/output.txt b/acceptance/bundle/resource_deps/grant_ref/output.txt
index 47cfaccbcbd..76d11455cb3 100644
--- a/acceptance/bundle/resource_deps/grant_ref/output.txt
+++ b/acceptance/bundle/resource_deps/grant_ref/output.txt
@@ -11,6 +11,9 @@ Plan: 4 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created schemas.schema_a
+Created schemas.schema_a.grants
+Created schemas.schema_b
+Created schemas.schema_b.grants
+Files: 2 uploaded, 0 deleted
+Resources: 4 created, 0 changed, 0 deleted, 0 unchanged
diff --git a/acceptance/bundle/resource_deps/grant_ref/script b/acceptance/bundle/resource_deps/grant_ref/script
index 82800b1654e..edaa505906d 100644
--- a/acceptance/bundle/resource_deps/grant_ref/script
+++ b/acceptance/bundle/resource_deps/grant_ref/script
@@ -1,4 +1,4 @@
 
 trace $CLI bundle plan
-trace $CLI bundle plan -o json > out.plan_create.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.plan_create.json
 trace $CLI bundle deploy
diff --git a/acceptance/bundle/resource_deps/grant_ref/test.toml b/acceptance/bundle/resource_deps/grant_ref/test.toml
index 790c13e6dc6..a030353d571 100644
--- a/acceptance/bundle/resource_deps/grant_ref/test.toml
+++ b/acceptance/bundle/resource_deps/grant_ref/test.toml
@@ -1,4 +1 @@
 RecordRequests = false
-
-[EnvMatrix]
-DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/resource_deps/id_chain/out.plan_create.direct.json b/acceptance/bundle/resource_deps/id_chain/out.plan_create.direct.json
deleted file mode 100644
index e74e3149214..00000000000
--- a/acceptance/bundle/resource_deps/id_chain/out.plan_create.direct.json
+++ /dev/null
@@ -1,137 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.a": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "description": "aa_desc",
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "aa",
-          "queue": {
-            "enabled": true
-          }
-        }
-      }
-    },
-    "resources.jobs.b": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.a",
-          "label": "${resources.jobs.a.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "description": "prefix ${resources.jobs.a.id}",
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "bb",
-          "queue": {
-            "enabled": true
-          }
-        },
-        "vars": {
-          "description": "prefix ${resources.jobs.a.id}"
-        }
-      }
-    },
-    "resources.jobs.c": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.b",
-          "label": "${resources.jobs.b.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "description": "prefix ${resources.jobs.b.id}",
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "cc",
-          "queue": {
-            "enabled": true
-          }
-        },
-        "vars": {
-          "description": "prefix ${resources.jobs.b.id}"
-        }
-      }
-    },
-    "resources.jobs.d": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.c",
-          "label": "${resources.jobs.c.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "description": "prefix ${resources.jobs.c.id}",
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "dd",
-          "queue": {
-            "enabled": true
-          }
-        },
-        "vars": {
-          "description": "prefix ${resources.jobs.c.id}"
-        }
-      }
-    },
-    "resources.jobs.e": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.d",
-          "label": "${resources.jobs.d.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "description": "prefix ${resources.jobs.d.id}",
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "ee",
-          "queue": {
-            "enabled": true
-          }
-        },
-        "vars": {
-          "description": "prefix ${resources.jobs.d.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/id_chain/out.plan_create.json b/acceptance/bundle/resource_deps/id_chain/out.plan_create.json
new file mode 100644
index 00000000000..a55e63abc45
--- /dev/null
+++ b/acceptance/bundle/resource_deps/id_chain/out.plan_create.json
@@ -0,0 +1,137 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.jobs.a": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "description": "aa_desc",
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "aa",
+          "queue": {
+            "enabled": true
+          }
+        }
+      }
+    },
+    "resources.jobs.b": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.a",
+          "label": "${resources.jobs.a.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "description": "prefix ${resources.jobs.a.id}",
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "bb",
+          "queue": {
+            "enabled": true
+          }
+        },
+        "vars": {
+          "description": "prefix ${resources.jobs.a.id}"
+        }
+      }
+    },
+    "resources.jobs.c": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.b",
+          "label": "${resources.jobs.b.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "description": "prefix ${resources.jobs.b.id}",
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "cc",
+          "queue": {
+            "enabled": true
+          }
+        },
+        "vars": {
+          "description": "prefix ${resources.jobs.b.id}"
+        }
+      }
+    },
+    "resources.jobs.d": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.c",
+          "label": "${resources.jobs.c.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "description": "prefix ${resources.jobs.c.id}",
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "dd",
+          "queue": {
+            "enabled": true
+          }
+        },
+        "vars": {
+          "description": "prefix ${resources.jobs.c.id}"
+        }
+      }
+    },
+    "resources.jobs.e": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.d",
+          "label": "${resources.jobs.d.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "description": "prefix ${resources.jobs.d.id}",
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "ee",
+          "queue": {
+            "enabled": true
+          }
+        },
+        "vars": {
+          "description": "prefix ${resources.jobs.d.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resource_deps/id_chain/out.plan_create.terraform.json b/acceptance/bundle/resource_deps/id_chain/out.plan_create.terraform.json
deleted file mode 100644
index c6f8f9f5b32..00000000000
--- a/acceptance/bundle/resource_deps/id_chain/out.plan_create.terraform.json
+++ /dev/null
@@ -1,20 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.a": {
-      "action": "create"
-    },
-    "resources.jobs.b": {
-      "action": "create"
-    },
-    "resources.jobs.c": {
-      "action": "create"
-    },
-    "resources.jobs.d": {
-      "action": "create"
-    },
-    "resources.jobs.e": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/id_chain/out.plan_skip.direct.json b/acceptance/bundle/resource_deps/id_chain/out.plan_skip.direct.json
deleted file mode 100644
index 340f12d6f38..00000000000
--- a/acceptance/bundle/resource_deps/id_chain/out.plan_skip.direct.json
+++ /dev/null
@@ -1,237 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 2,
-  "plan": {
-    "resources.jobs.a": {
-      "action": "skip",
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS][0],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-        },
-        "description": "aa_new_desc",
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_id": [NUMID],
-        "max_concurrent_runs": 1,
-        "name": "aa",
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "timeout_seconds": 0,
-        "webhook_notifications": {}
-      },
-      "changes": {
-        "email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "webhook_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        }
-      }
-    },
-    "resources.jobs.b": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.a",
-          "label": "${resources.jobs.a.id}"
-        }
-      ],
-      "action": "skip",
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS][1],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-        },
-        "description": "new_prefix [NUMID]",
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_id": [NUMID],
-        "max_concurrent_runs": 1,
-        "name": "bb",
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "timeout_seconds": 0,
-        "webhook_notifications": {}
-      },
-      "changes": {
-        "email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "webhook_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        }
-      }
-    },
-    "resources.jobs.c": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.b",
-          "label": "${resources.jobs.b.id}"
-        }
-      ],
-      "action": "skip",
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS][2],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-        },
-        "description": "new_prefix [NUMID]",
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_id": [NUMID],
-        "max_concurrent_runs": 1,
-        "name": "cc",
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "timeout_seconds": 0,
-        "webhook_notifications": {}
-      },
-      "changes": {
-        "email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "webhook_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        }
-      }
-    },
-    "resources.jobs.d": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.c",
-          "label": "${resources.jobs.c.id}"
-        }
-      ],
-      "action": "skip",
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS][3],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-        },
-        "description": "new_prefix [NUMID]",
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_id": [NUMID],
-        "max_concurrent_runs": 1,
-        "name": "dd",
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "timeout_seconds": 0,
-        "webhook_notifications": {}
-      },
-      "changes": {
-        "email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "webhook_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        }
-      }
-    },
-    "resources.jobs.e": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.d",
-          "label": "${resources.jobs.d.id}"
-        }
-      ],
-      "action": "skip",
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS][4],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-        },
-        "description": "new_prefix [NUMID]",
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_id": [NUMID],
-        "max_concurrent_runs": 1,
-        "name": "ee",
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "timeout_seconds": 0,
-        "webhook_notifications": {}
-      },
-      "changes": {
-        "email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "webhook_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/id_chain/out.plan_skip.json b/acceptance/bundle/resource_deps/id_chain/out.plan_skip.json
new file mode 100644
index 00000000000..34e6950925c
--- /dev/null
+++ b/acceptance/bundle/resource_deps/id_chain/out.plan_skip.json
@@ -0,0 +1,237 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 2,
+  "plan": {
+    "resources.jobs.a": {
+      "action": "skip",
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS][0],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "description": "aa_new_desc",
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_id": [A_ID],
+        "max_concurrent_runs": 1,
+        "name": "aa",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "timeout_seconds": 0,
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    },
+    "resources.jobs.b": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.a",
+          "label": "${resources.jobs.a.id}"
+        }
+      ],
+      "action": "skip",
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS][1],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "description": "new_prefix [A_ID]",
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_id": [B_ID],
+        "max_concurrent_runs": 1,
+        "name": "bb",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "timeout_seconds": 0,
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    },
+    "resources.jobs.c": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.b",
+          "label": "${resources.jobs.b.id}"
+        }
+      ],
+      "action": "skip",
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS][2],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "description": "new_prefix [B_ID]",
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_id": [C_ID],
+        "max_concurrent_runs": 1,
+        "name": "cc",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "timeout_seconds": 0,
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    },
+    "resources.jobs.d": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.c",
+          "label": "${resources.jobs.c.id}"
+        }
+      ],
+      "action": "skip",
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS][3],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "description": "new_prefix [C_ID]",
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_id": [D_ID],
+        "max_concurrent_runs": 1,
+        "name": "dd",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "timeout_seconds": 0,
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    },
+    "resources.jobs.e": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.d",
+          "label": "${resources.jobs.d.id}"
+        }
+      ],
+      "action": "skip",
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS][4],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "description": "new_prefix [D_ID]",
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_id": [E_ID],
+        "max_concurrent_runs": 1,
+        "name": "ee",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "timeout_seconds": 0,
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resource_deps/id_chain/out.plan_skip.terraform.json b/acceptance/bundle/resource_deps/id_chain/out.plan_skip.terraform.json
deleted file mode 100644
index 7a27dfb2510..00000000000
--- a/acceptance/bundle/resource_deps/id_chain/out.plan_skip.terraform.json
+++ /dev/null
@@ -1,20 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.a": {
-      "action": "skip"
-    },
-    "resources.jobs.b": {
-      "action": "skip"
-    },
-    "resources.jobs.c": {
-      "action": "skip"
-    },
-    "resources.jobs.d": {
-      "action": "skip"
-    },
-    "resources.jobs.e": {
-      "action": "skip"
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/id_chain/out.plan_update.direct.json b/acceptance/bundle/resource_deps/id_chain/out.plan_update.direct.json
deleted file mode 100644
index 982d34d71cc..00000000000
--- a/acceptance/bundle/resource_deps/id_chain/out.plan_update.direct.json
+++ /dev/null
@@ -1,347 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.jobs.a": {
-      "action": "update",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "description": "aa_new_desc",
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "aa",
-          "queue": {
-            "enabled": true
-          }
-        }
-      },
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS][0],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-        },
-        "description": "aa_desc",
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_id": [NUMID],
-        "max_concurrent_runs": 1,
-        "name": "aa",
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "timeout_seconds": 0,
-        "webhook_notifications": {}
-      },
-      "changes": {
-        "description": {
-          "action": "update",
-          "old": "aa_desc",
-          "new": "aa_new_desc",
-          "remote": "aa_desc"
-        },
-        "email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "webhook_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        }
-      }
-    },
-    "resources.jobs.b": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.a",
-          "label": "${resources.jobs.a.id}"
-        }
-      ],
-      "action": "update",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "description": "new_prefix [NUMID]",
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "bb",
-          "queue": {
-            "enabled": true
-          }
-        }
-      },
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS][1],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-        },
-        "description": "prefix [NUMID]",
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_id": [NUMID],
-        "max_concurrent_runs": 1,
-        "name": "bb",
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "timeout_seconds": 0,
-        "webhook_notifications": {}
-      },
-      "changes": {
-        "description": {
-          "action": "update",
-          "old": "prefix [NUMID]",
-          "new": "new_prefix [NUMID]",
-          "remote": "prefix [NUMID]"
-        },
-        "email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "webhook_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        }
-      }
-    },
-    "resources.jobs.c": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.b",
-          "label": "${resources.jobs.b.id}"
-        }
-      ],
-      "action": "update",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "description": "new_prefix [NUMID]",
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "cc",
-          "queue": {
-            "enabled": true
-          }
-        }
-      },
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS][2],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-        },
-        "description": "prefix [NUMID]",
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_id": [NUMID],
-        "max_concurrent_runs": 1,
-        "name": "cc",
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "timeout_seconds": 0,
-        "webhook_notifications": {}
-      },
-      "changes": {
-        "description": {
-          "action": "update",
-          "old": "prefix [NUMID]",
-          "new": "new_prefix [NUMID]",
-          "remote": "prefix [NUMID]"
-        },
-        "email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "webhook_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        }
-      }
-    },
-    "resources.jobs.d": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.c",
-          "label": "${resources.jobs.c.id}"
-        }
-      ],
-      "action": "update",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "description": "new_prefix [NUMID]",
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "dd",
-          "queue": {
-            "enabled": true
-          }
-        }
-      },
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS][3],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-        },
-        "description": "prefix [NUMID]",
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_id": [NUMID],
-        "max_concurrent_runs": 1,
-        "name": "dd",
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "timeout_seconds": 0,
-        "webhook_notifications": {}
-      },
-      "changes": {
-        "description": {
-          "action": "update",
-          "old": "prefix [NUMID]",
-          "new": "new_prefix [NUMID]",
-          "remote": "prefix [NUMID]"
-        },
-        "email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "webhook_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        }
-      }
-    },
-    "resources.jobs.e": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.d",
-          "label": "${resources.jobs.d.id}"
-        }
-      ],
-      "action": "update",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "description": "new_prefix [NUMID]",
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "ee",
-          "queue": {
-            "enabled": true
-          }
-        }
-      },
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS][4],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-        },
-        "description": "prefix [NUMID]",
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_id": [NUMID],
-        "max_concurrent_runs": 1,
-        "name": "ee",
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "timeout_seconds": 0,
-        "webhook_notifications": {}
-      },
-      "changes": {
-        "description": {
-          "action": "update",
-          "old": "prefix [NUMID]",
-          "new": "new_prefix [NUMID]",
-          "remote": "prefix [NUMID]"
-        },
-        "email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "webhook_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/id_chain/out.plan_update.json b/acceptance/bundle/resource_deps/id_chain/out.plan_update.json
new file mode 100644
index 00000000000..182fe955fca
--- /dev/null
+++ b/acceptance/bundle/resource_deps/id_chain/out.plan_update.json
@@ -0,0 +1,347 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.jobs.a": {
+      "action": "update",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "description": "aa_new_desc",
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "aa",
+          "queue": {
+            "enabled": true
+          }
+        }
+      },
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS][0],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "description": "aa_desc",
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_id": [A_ID],
+        "max_concurrent_runs": 1,
+        "name": "aa",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "timeout_seconds": 0,
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "description": {
+          "action": "update",
+          "old": "aa_desc",
+          "new": "aa_new_desc",
+          "remote": "aa_desc"
+        },
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    },
+    "resources.jobs.b": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.a",
+          "label": "${resources.jobs.a.id}"
+        }
+      ],
+      "action": "update",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "description": "new_prefix [A_ID]",
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "bb",
+          "queue": {
+            "enabled": true
+          }
+        }
+      },
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS][1],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "description": "prefix [A_ID]",
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_id": [B_ID],
+        "max_concurrent_runs": 1,
+        "name": "bb",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "timeout_seconds": 0,
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "description": {
+          "action": "update",
+          "old": "prefix [A_ID]",
+          "new": "new_prefix [A_ID]",
+          "remote": "prefix [A_ID]"
+        },
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    },
+    "resources.jobs.c": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.b",
+          "label": "${resources.jobs.b.id}"
+        }
+      ],
+      "action": "update",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "description": "new_prefix [B_ID]",
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "cc",
+          "queue": {
+            "enabled": true
+          }
+        }
+      },
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS][2],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "description": "prefix [B_ID]",
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_id": [C_ID],
+        "max_concurrent_runs": 1,
+        "name": "cc",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "timeout_seconds": 0,
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "description": {
+          "action": "update",
+          "old": "prefix [B_ID]",
+          "new": "new_prefix [B_ID]",
+          "remote": "prefix [B_ID]"
+        },
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    },
+    "resources.jobs.d": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.c",
+          "label": "${resources.jobs.c.id}"
+        }
+      ],
+      "action": "update",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "description": "new_prefix [C_ID]",
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "dd",
+          "queue": {
+            "enabled": true
+          }
+        }
+      },
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS][3],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "description": "prefix [C_ID]",
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_id": [D_ID],
+        "max_concurrent_runs": 1,
+        "name": "dd",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "timeout_seconds": 0,
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "description": {
+          "action": "update",
+          "old": "prefix [C_ID]",
+          "new": "new_prefix [C_ID]",
+          "remote": "prefix [C_ID]"
+        },
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    },
+    "resources.jobs.e": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.d",
+          "label": "${resources.jobs.d.id}"
+        }
+      ],
+      "action": "update",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "description": "new_prefix [D_ID]",
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "ee",
+          "queue": {
+            "enabled": true
+          }
+        }
+      },
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS][4],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "description": "prefix [D_ID]",
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_id": [E_ID],
+        "max_concurrent_runs": 1,
+        "name": "ee",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "timeout_seconds": 0,
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "description": {
+          "action": "update",
+          "old": "prefix [D_ID]",
+          "new": "new_prefix [D_ID]",
+          "remote": "prefix [D_ID]"
+        },
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resource_deps/id_chain/out.plan_update.terraform.json b/acceptance/bundle/resource_deps/id_chain/out.plan_update.terraform.json
deleted file mode 100644
index 51649ef6a4a..00000000000
--- a/acceptance/bundle/resource_deps/id_chain/out.plan_update.terraform.json
+++ /dev/null
@@ -1,20 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.a": {
-      "action": "update"
-    },
-    "resources.jobs.b": {
-      "action": "update"
-    },
-    "resources.jobs.c": {
-      "action": "update"
-    },
-    "resources.jobs.d": {
-      "action": "update"
-    },
-    "resources.jobs.e": {
-      "action": "update"
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/id_chain/out.test.toml b/acceptance/bundle/resource_deps/id_chain/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resource_deps/id_chain/out.test.toml
+++ b/acceptance/bundle/resource_deps/id_chain/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/id_chain/output.txt b/acceptance/bundle/resource_deps/id_chain/output.txt
index 62dfb09f18c..0197866cc28 100644
--- a/acceptance/bundle/resource_deps/id_chain/output.txt
+++ b/acceptance/bundle/resource_deps/id_chain/output.txt
@@ -14,9 +14,13 @@ Plan: 5 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.a
+Created jobs.b
+Created jobs.c
+Created jobs.d
+Created jobs.e
+Files: 2 uploaded, 0 deleted
+Resources: 5 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> print_requests_short
 "aa"
@@ -44,9 +48,13 @@ Plan: 0 to add, 5 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated jobs.a
+Updated jobs.b
+Updated jobs.c
+Updated jobs.d
+Updated jobs.e
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 5 changed, 0 deleted, 0 unchanged
 
 >>> print_requests_short
 "aa"
diff --git a/acceptance/bundle/resource_deps/id_chain/script b/acceptance/bundle/resource_deps/id_chain/script
index 244a5973158..e24a3dd4612 100644
--- a/acceptance/bundle/resource_deps/id_chain/script
+++ b/acceptance/bundle/resource_deps/id_chain/script
@@ -1,31 +1,32 @@
 print_all_requests() {
-    jq --sort-keys 'select(.path | contains("/jobs"))' < out.requests.txt
-    rm out.requests.txt
+    jq --sort-keys 'select(.path | contains("/jobs"))' < "$OUT_REQUESTS"
+    rm "$OUT_REQUESTS"
 }
 
 print_requests() {
-    jq --sort-keys 'select(.method != "GET" and (.path | contains("/jobs")))' < out.requests.txt
-    rm out.requests.txt
+    jq --sort-keys 'select(.method != "GET" and (.path | contains("/jobs")))' < "$OUT_REQUESTS"
+    rm "$OUT_REQUESTS"
 }
 
 print_requests_short() {
-    jq --sort-keys 'select(.method != "GET" and (.path | contains("/jobs"))) | (.body.name // .body.new_settings.name // empty)' < out.requests.txt
-    rm out.requests.txt
+    jq --sort-keys 'select(.method != "GET" and (.path | contains("/jobs"))) | (.body.name // .body.new_settings.name // empty)' < "$OUT_REQUESTS"
+    rm "$OUT_REQUESTS"
 }
 
 trace $CLI bundle plan
 trace print_requests
 
-$CLI bundle plan -o json > out.plan_create.$DATABRICKS_BUNDLE_ENGINE.json
+$CLI bundle plan -o json | nostamp > out.plan_create.json
 trace print_requests
 
 trace $CLI bundle deploy
+replace_ids.py
 trace print_requests_short
 
 trace update_file.py databricks.yml aa_desc aa_new_desc
 trace update_file.py databricks.yml prefix new_prefix
 
-$CLI bundle plan -o json > out.plan_update.$DATABRICKS_BUNDLE_ENGINE.json
+$CLI bundle plan -o json | nostamp > out.plan_update.json
 trace print_requests
 
 trace $CLI bundle plan
@@ -34,5 +35,5 @@ trace print_requests
 trace $CLI bundle deploy
 trace print_requests_short
 
-$CLI bundle plan -o json > out.plan_skip.$DATABRICKS_BUNDLE_ENGINE.json
+$CLI bundle plan -o json | nostamp > out.plan_skip.json
 trace print_requests
diff --git a/acceptance/bundle/resource_deps/id_star/out.plan_create.direct.json b/acceptance/bundle/resource_deps/id_star/out.plan_create.direct.json
deleted file mode 100644
index 65018208170..00000000000
--- a/acceptance/bundle/resource_deps/id_star/out.plan_create.direct.json
+++ /dev/null
@@ -1,137 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.a": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "description": "aa_desc",
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "aa",
-          "queue": {
-            "enabled": true
-          }
-        }
-      }
-    },
-    "resources.jobs.b": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.a",
-          "label": "${resources.jobs.a.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "description": "prefix ${resources.jobs.a.id}",
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "bb",
-          "queue": {
-            "enabled": true
-          }
-        },
-        "vars": {
-          "description": "prefix ${resources.jobs.a.id}"
-        }
-      }
-    },
-    "resources.jobs.c": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.a",
-          "label": "${resources.jobs.a.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "description": "prefix ${resources.jobs.a.id}",
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "cc",
-          "queue": {
-            "enabled": true
-          }
-        },
-        "vars": {
-          "description": "prefix ${resources.jobs.a.id}"
-        }
-      }
-    },
-    "resources.jobs.d": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.a",
-          "label": "${resources.jobs.a.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "description": "prefix ${resources.jobs.a.id}",
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "dd",
-          "queue": {
-            "enabled": true
-          }
-        },
-        "vars": {
-          "description": "prefix ${resources.jobs.a.id}"
-        }
-      }
-    },
-    "resources.jobs.e": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.a",
-          "label": "${resources.jobs.a.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "description": "prefix ${resources.jobs.a.id}",
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "ee",
-          "queue": {
-            "enabled": true
-          }
-        },
-        "vars": {
-          "description": "prefix ${resources.jobs.a.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/id_star/out.plan_create.json b/acceptance/bundle/resource_deps/id_star/out.plan_create.json
new file mode 100644
index 00000000000..b704f0b1ffa
--- /dev/null
+++ b/acceptance/bundle/resource_deps/id_star/out.plan_create.json
@@ -0,0 +1,137 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.jobs.a": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "description": "aa_desc",
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "aa",
+          "queue": {
+            "enabled": true
+          }
+        }
+      }
+    },
+    "resources.jobs.b": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.a",
+          "label": "${resources.jobs.a.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "description": "prefix ${resources.jobs.a.id}",
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "bb",
+          "queue": {
+            "enabled": true
+          }
+        },
+        "vars": {
+          "description": "prefix ${resources.jobs.a.id}"
+        }
+      }
+    },
+    "resources.jobs.c": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.a",
+          "label": "${resources.jobs.a.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "description": "prefix ${resources.jobs.a.id}",
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "cc",
+          "queue": {
+            "enabled": true
+          }
+        },
+        "vars": {
+          "description": "prefix ${resources.jobs.a.id}"
+        }
+      }
+    },
+    "resources.jobs.d": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.a",
+          "label": "${resources.jobs.a.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "description": "prefix ${resources.jobs.a.id}",
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "dd",
+          "queue": {
+            "enabled": true
+          }
+        },
+        "vars": {
+          "description": "prefix ${resources.jobs.a.id}"
+        }
+      }
+    },
+    "resources.jobs.e": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.a",
+          "label": "${resources.jobs.a.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "description": "prefix ${resources.jobs.a.id}",
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "ee",
+          "queue": {
+            "enabled": true
+          }
+        },
+        "vars": {
+          "description": "prefix ${resources.jobs.a.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resource_deps/id_star/out.plan_create.terraform.json b/acceptance/bundle/resource_deps/id_star/out.plan_create.terraform.json
deleted file mode 100644
index c6f8f9f5b32..00000000000
--- a/acceptance/bundle/resource_deps/id_star/out.plan_create.terraform.json
+++ /dev/null
@@ -1,20 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.a": {
-      "action": "create"
-    },
-    "resources.jobs.b": {
-      "action": "create"
-    },
-    "resources.jobs.c": {
-      "action": "create"
-    },
-    "resources.jobs.d": {
-      "action": "create"
-    },
-    "resources.jobs.e": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/id_star/out.test.toml b/acceptance/bundle/resource_deps/id_star/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resource_deps/id_star/out.test.toml
+++ b/acceptance/bundle/resource_deps/id_star/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/id_star/script b/acceptance/bundle/resource_deps/id_star/script
index 6b67f59b7b8..a88adbd12f0 100644
--- a/acceptance/bundle/resource_deps/id_star/script
+++ b/acceptance/bundle/resource_deps/id_star/script
@@ -1 +1 @@
-$CLI bundle plan -o json > out.plan_create.$DATABRICKS_BUNDLE_ENGINE.json
+$CLI bundle plan -o json | nostamp > out.plan_create.json
diff --git a/acceptance/bundle/resource_deps/immutable_field_ref/out.test.toml b/acceptance/bundle/resource_deps/immutable_field_ref/out.test.toml
index e90b6d5d1ba..a927a5fbc06 100644
--- a/acceptance/bundle/resource_deps/immutable_field_ref/out.test.toml
+++ b/acceptance/bundle/resource_deps/immutable_field_ref/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/immutable_field_ref/output.txt b/acceptance/bundle/resource_deps/immutable_field_ref/output.txt
index 0ce0b280a25..1d200739da4 100644
--- a/acceptance/bundle/resource_deps/immutable_field_ref/output.txt
+++ b/acceptance/bundle/resource_deps/immutable_field_ref/output.txt
@@ -1,9 +1,11 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.bar
+Created schemas.schema
+Created volumes.foo
+Files: 1 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> update_file.py databricks.yml comment1 comment2
 
diff --git a/acceptance/bundle/resource_deps/immutable_field_ref/test.toml b/acceptance/bundle/resource_deps/immutable_field_ref/test.toml
index c235be5d8ee..a030353d571 100644
--- a/acceptance/bundle/resource_deps/immutable_field_ref/test.toml
+++ b/acceptance/bundle/resource_deps/immutable_field_ref/test.toml
@@ -1,2 +1 @@
 RecordRequests = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/resource_deps/implicit_deps_model_serving_endpoint/out.test.toml b/acceptance/bundle/resource_deps/implicit_deps_model_serving_endpoint/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resource_deps/implicit_deps_model_serving_endpoint/out.test.toml
+++ b/acceptance/bundle/resource_deps/implicit_deps_model_serving_endpoint/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/implicit_deps_quality_monitor/out.test.toml b/acceptance/bundle/resource_deps/implicit_deps_quality_monitor/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resource_deps/implicit_deps_quality_monitor/out.test.toml
+++ b/acceptance/bundle/resource_deps/implicit_deps_quality_monitor/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/implicit_deps_registered_model/out.test.toml b/acceptance/bundle/resource_deps/implicit_deps_registered_model/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resource_deps/implicit_deps_registered_model/out.test.toml
+++ b/acceptance/bundle/resource_deps/implicit_deps_registered_model/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/implicit_deps_vector_search_index/databricks.yml b/acceptance/bundle/resource_deps/implicit_deps_vector_search_index/databricks.yml
new file mode 100644
index 00000000000..77114e26e34
--- /dev/null
+++ b/acceptance/bundle/resource_deps/implicit_deps_vector_search_index/databricks.yml
@@ -0,0 +1,41 @@
+bundle:
+  name: test-bundle
+
+# Tests implicit dependency detection for vector search indexes:
+# - name (format "catalog.schema.index") resolves the catalog and schema parts (my_index)
+# - a name that already contains a ${resources...} reference is left untouched; a mix of
+#   references and literals is not supported (mixed_ref_index, full_ref_index)
+resources:
+  catalogs:
+    my_catalog:
+      name: mycatalog
+  schemas:
+    my_schema:
+      catalog_name: mycatalog
+      name: myschema
+  vector_search_indexes:
+    my_index:
+      name: mycatalog.myschema.myindex
+      endpoint_name: my-endpoint
+      primary_key: id
+      index_type: DIRECT_ACCESS
+      direct_access_index_spec:
+        schema_json: '{"id":"integer","vector":"array<float>"}'
+    mixed_ref_index:
+      name: ${resources.catalogs.my_catalog.name}.myschema.myindex
+      endpoint_name: my-endpoint
+      primary_key: id
+      index_type: DIRECT_ACCESS
+      direct_access_index_spec:
+        schema_json: '{"id":"integer","vector":"array<float>"}'
+    full_ref_index:
+      name: ${resources.catalogs.my_catalog.name}.${resources.schemas.my_schema.name}.myindex
+      endpoint_name: my-endpoint
+      primary_key: id
+      index_type: DIRECT_ACCESS
+      direct_access_index_spec:
+        schema_json: '{"id":"integer","vector":"array<float>"}'
+
+targets:
+  dev:
+    mode: development
diff --git a/acceptance/bundle/resource_deps/implicit_deps_vector_search_index/out.test.toml b/acceptance/bundle/resource_deps/implicit_deps_vector_search_index/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resource_deps/implicit_deps_vector_search_index/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/implicit_deps_vector_search_index/output.txt b/acceptance/bundle/resource_deps/implicit_deps_vector_search_index/output.txt
new file mode 100644
index 00000000000..3cdf0b65221
--- /dev/null
+++ b/acceptance/bundle/resource_deps/implicit_deps_vector_search_index/output.txt
@@ -0,0 +1,44 @@
+
+>>> [CLI] bundle validate -t dev -o json
+{
+  "catalogs": {
+    "my_catalog": {
+      "name": "mycatalog"
+    }
+  },
+  "schemas": {
+    "my_schema": {
+      "catalog_name": "${resources.catalogs.my_catalog.name}",
+      "name": "dev_[USERNAME]_myschema"
+    }
+  },
+  "vector_search_indexes": {
+    "full_ref_index": {
+      "direct_access_index_spec": {
+        "schema_json": "{\"id\":\"integer\",\"vector\":\"array<float>\"}"
+      },
+      "endpoint_name": "my-endpoint",
+      "index_type": "DIRECT_ACCESS",
+      "name": "${resources.catalogs.my_catalog.name}.${resources.schemas.my_schema.name}.myindex",
+      "primary_key": "id"
+    },
+    "mixed_ref_index": {
+      "direct_access_index_spec": {
+        "schema_json": "{\"id\":\"integer\",\"vector\":\"array<float>\"}"
+      },
+      "endpoint_name": "my-endpoint",
+      "index_type": "DIRECT_ACCESS",
+      "name": "${resources.catalogs.my_catalog.name}.myschema.myindex",
+      "primary_key": "id"
+    },
+    "my_index": {
+      "direct_access_index_spec": {
+        "schema_json": "{\"id\":\"integer\",\"vector\":\"array<float>\"}"
+      },
+      "endpoint_name": "my-endpoint",
+      "index_type": "DIRECT_ACCESS",
+      "name": "${resources.catalogs.my_catalog.name}.${resources.schemas.my_schema.name}.myindex",
+      "primary_key": "id"
+    }
+  }
+}
diff --git a/acceptance/bundle/resource_deps/implicit_deps_vector_search_index/script b/acceptance/bundle/resource_deps/implicit_deps_vector_search_index/script
new file mode 100644
index 00000000000..30cb3ec2e5d
--- /dev/null
+++ b/acceptance/bundle/resource_deps/implicit_deps_vector_search_index/script
@@ -0,0 +1 @@
+trace $CLI bundle validate -t dev -o json | jq .resources
diff --git a/acceptance/bundle/resource_deps/implicit_deps_vector_search_index/test.toml b/acceptance/bundle/resource_deps/implicit_deps_vector_search_index/test.toml
new file mode 100644
index 00000000000..a030353d571
--- /dev/null
+++ b/acceptance/bundle/resource_deps/implicit_deps_vector_search_index/test.toml
@@ -0,0 +1 @@
+RecordRequests = false
diff --git a/acceptance/bundle/resource_deps/implicit_deps_volume/out.test.toml b/acceptance/bundle/resource_deps/implicit_deps_volume/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resource_deps/implicit_deps_volume/out.test.toml
+++ b/acceptance/bundle/resource_deps/implicit_deps_volume/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/implicit_deps_volume/output.txt b/acceptance/bundle/resource_deps/implicit_deps_volume/output.txt
index 2e454e81522..4258182b523 100644
--- a/acceptance/bundle/resource_deps/implicit_deps_volume/output.txt
+++ b/acceptance/bundle/resource_deps/implicit_deps_volume/output.txt
@@ -17,6 +17,7 @@
       "catalog_name": "${resources.catalogs.my_catalog.name}",
       "name": "myvolume",
       "schema_name": "${resources.schemas.my_schema.name}",
+      "volume_path": "/Volumes/mycatalog/dev_[USERNAME]_myschema/myvolume",
       "volume_type": "MANAGED"
     }
   }
diff --git a/acceptance/bundle/resource_deps/job_id/out.plan_create.direct.json b/acceptance/bundle/resource_deps/job_id/out.plan_create.direct.json
deleted file mode 100644
index fe8b631eb40..00000000000
--- a/acceptance/bundle/resource_deps/job_id/out.plan_create.direct.json
+++ /dev/null
@@ -1,59 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.bar": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "job bar",
-          "queue": {
-            "enabled": true
-          }
-        }
-      }
-    },
-    "resources.jobs.foo": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.bar",
-          "label": "${resources.jobs.bar.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "job foo",
-          "queue": {
-            "enabled": true
-          },
-          "tasks": [
-            {
-              "run_job_task": {
-                "job_id": 0
-              },
-              "task_key": "job_task"
-            }
-          ]
-        },
-        "vars": {
-          "tasks[0].run_job_task.job_id": "${resources.jobs.bar.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/job_id/out.plan_create.json b/acceptance/bundle/resource_deps/job_id/out.plan_create.json
new file mode 100644
index 00000000000..4ac131399c6
--- /dev/null
+++ b/acceptance/bundle/resource_deps/job_id/out.plan_create.json
@@ -0,0 +1,59 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.jobs.bar": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "job bar",
+          "queue": {
+            "enabled": true
+          }
+        }
+      }
+    },
+    "resources.jobs.foo": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.bar",
+          "label": "${resources.jobs.bar.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "job foo",
+          "queue": {
+            "enabled": true
+          },
+          "tasks": [
+            {
+              "run_job_task": {
+                "job_id": 0
+              },
+              "task_key": "job_task"
+            }
+          ]
+        },
+        "vars": {
+          "tasks[0].run_job_task.job_id": "${resources.jobs.bar.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resource_deps/job_id/out.plan_create.terraform.json b/acceptance/bundle/resource_deps/job_id/out.plan_create.terraform.json
deleted file mode 100644
index 5b7564f8e74..00000000000
--- a/acceptance/bundle/resource_deps/job_id/out.plan_create.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.bar": {
-      "action": "create"
-    },
-    "resources.jobs.foo": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/job_id/out.plan_delete.direct.json b/acceptance/bundle/resource_deps/job_id/out.plan_delete.direct.json
deleted file mode 100644
index 3ce1184d1e6..00000000000
--- a/acceptance/bundle/resource_deps/job_id/out.plan_delete.direct.json
+++ /dev/null
@@ -1,71 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.jobs.bar": {
-      "action": "delete",
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS][0],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-        },
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_id": [BAR_ID],
-        "max_concurrent_runs": 1,
-        "name": "job bar",
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "timeout_seconds": 0,
-        "webhook_notifications": {}
-      }
-    },
-    "resources.jobs.foo": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.bar",
-          "label": "${resources.jobs.bar.id}"
-        }
-      ],
-      "action": "delete",
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS][1],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-        },
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_id": [FOO_ID],
-        "max_concurrent_runs": 1,
-        "name": "job foo",
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "tasks": [
-          {
-            "email_notifications": {},
-            "run_if": "ALL_SUCCESS",
-            "run_job_task": {
-              "job_id": [BAR_ID]
-            },
-            "task_key": "job_task",
-            "timeout_seconds": 0
-          }
-        ],
-        "timeout_seconds": 0,
-        "webhook_notifications": {}
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/job_id/out.plan_delete.json b/acceptance/bundle/resource_deps/job_id/out.plan_delete.json
new file mode 100644
index 00000000000..ac3b30b9286
--- /dev/null
+++ b/acceptance/bundle/resource_deps/job_id/out.plan_delete.json
@@ -0,0 +1,71 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.jobs.bar": {
+      "action": "delete",
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS][0],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_id": [BAR_ID],
+        "max_concurrent_runs": 1,
+        "name": "job bar",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "timeout_seconds": 0,
+        "webhook_notifications": {}
+      }
+    },
+    "resources.jobs.foo": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.bar",
+          "label": "${resources.jobs.bar.id}"
+        }
+      ],
+      "action": "delete",
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS][1],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_id": [FOO_ID],
+        "max_concurrent_runs": 1,
+        "name": "job foo",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "tasks": [
+          {
+            "email_notifications": {},
+            "run_if": "ALL_SUCCESS",
+            "run_job_task": {
+              "job_id": [BAR_ID]
+            },
+            "task_key": "job_task",
+            "timeout_seconds": 0
+          }
+        ],
+        "timeout_seconds": 0,
+        "webhook_notifications": {}
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resource_deps/job_id/out.plan_delete.terraform.json b/acceptance/bundle/resource_deps/job_id/out.plan_delete.terraform.json
deleted file mode 100644
index 657721e008b..00000000000
--- a/acceptance/bundle/resource_deps/job_id/out.plan_delete.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.bar": {
-      "action": "delete"
-    },
-    "resources.jobs.foo": {
-      "action": "delete"
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/job_id/out.test.toml b/acceptance/bundle/resource_deps/job_id/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resource_deps/job_id/out.test.toml
+++ b/acceptance/bundle/resource_deps/job_id/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/job_id/output.txt b/acceptance/bundle/resource_deps/job_id/output.txt
index 89f0656f907..2fa896b10d4 100644
--- a/acceptance/bundle/resource_deps/job_id/output.txt
+++ b/acceptance/bundle/resource_deps/job_id/output.txt
@@ -9,11 +9,12 @@ Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.bar
+Created jobs.foo
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
->>> print_requests.py //jobs
+>>> print_requests.py --nostamp //jobs
 {
   "method": "POST",
   "path": "/api/2.2/jobs/create",
@@ -61,11 +62,12 @@ Deployment complete!
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Deleted jobs.bar
+Deleted jobs.foo
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 2 deleted, 0 unchanged
 
->>> print_requests.py //jobs
+>>> print_requests.py --nostamp //jobs
 {
   "method": "POST",
   "path": "/api/2.2/jobs/delete",
@@ -84,7 +86,6 @@ Deployment complete!
 >>> [CLI] bundle destroy --auto-approve
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 0 deleted
 
->>> print_requests.py //jobs
+>>> print_requests.py --nostamp //jobs
diff --git a/acceptance/bundle/resource_deps/job_id/script b/acceptance/bundle/resource_deps/job_id/script
index 3b033fe390a..8bff752d8b3 100644
--- a/acceptance/bundle/resource_deps/job_id/script
+++ b/acceptance/bundle/resource_deps/job_id/script
@@ -1,16 +1,16 @@
 
 trace $CLI bundle plan
-trace $CLI bundle plan -o json > out.plan_create.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.plan_create.json
 trace $CLI bundle deploy
-trace print_requests.py //jobs
+trace print_requests.py --nostamp //jobs
 
 foo_id=`read_id.py foo`
 bar_id=`read_id.py bar`
 
 cp empty.yml databricks.yml
-trace $CLI bundle plan -o json > out.plan_delete.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.plan_delete.json
 trace $CLI bundle deploy
-trace print_requests.py //jobs
+trace print_requests.py --nostamp //jobs
 
 trace $CLI bundle destroy --auto-approve
-trace print_requests.py //jobs
+trace print_requests.py --nostamp //jobs
diff --git a/acceptance/bundle/resource_deps/job_id_big_graph/delete_all/out.plan_delete.terraform.txt b/acceptance/bundle/resource_deps/job_id_big_graph/delete_all/out.plan_delete.terraform.txt
deleted file mode 100644
index c2e0cdc7d9a..00000000000
--- a/acceptance/bundle/resource_deps/job_id_big_graph/delete_all/out.plan_delete.terraform.txt
+++ /dev/null
@@ -1,14 +0,0 @@
-delete jobs.chain_bottom
-delete jobs.chain_mid
-delete jobs.chain_top
-delete jobs.diamond_bottom
-delete jobs.diamond_left
-delete jobs.diamond_right
-delete jobs.diamond_top
-delete jobs.independent1
-delete jobs.independent2
-delete jobs.multi_child
-delete jobs.multi_parent1
-delete jobs.multi_parent2
-
-Plan: 0 to add, 0 to change, 12 to delete, 0 unchanged
diff --git a/acceptance/bundle/resource_deps/job_id_big_graph/delete_all/out.plan_delete.direct.txt b/acceptance/bundle/resource_deps/job_id_big_graph/delete_all/out.plan_delete.txt
similarity index 100%
rename from acceptance/bundle/resource_deps/job_id_big_graph/delete_all/out.plan_delete.direct.txt
rename to acceptance/bundle/resource_deps/job_id_big_graph/delete_all/out.plan_delete.txt
diff --git a/acceptance/bundle/resource_deps/job_id_big_graph/delete_all/out.plan_sanity.direct.txt b/acceptance/bundle/resource_deps/job_id_big_graph/delete_all/out.plan_sanity.txt
similarity index 100%
rename from acceptance/bundle/resource_deps/job_id_big_graph/delete_all/out.plan_sanity.direct.txt
rename to acceptance/bundle/resource_deps/job_id_big_graph/delete_all/out.plan_sanity.txt
diff --git a/acceptance/bundle/resource_deps/job_id_big_graph/delete_all/out.test.toml b/acceptance/bundle/resource_deps/job_id_big_graph/delete_all/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resource_deps/job_id_big_graph/delete_all/out.test.toml
+++ b/acceptance/bundle/resource_deps/job_id_big_graph/delete_all/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/job_id_big_graph/delete_all/output.txt b/acceptance/bundle/resource_deps/job_id_big_graph/delete_all/output.txt
index b6c98142421..9e4478fb6c1 100644
--- a/acceptance/bundle/resource_deps/job_id_big_graph/delete_all/output.txt
+++ b/acceptance/bundle/resource_deps/job_id_big_graph/delete_all/output.txt
@@ -1,11 +1,22 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.chain_bottom
+Created jobs.chain_mid
+Created jobs.chain_top
+Created jobs.diamond_bottom
+Created jobs.diamond_left
+Created jobs.diamond_right
+Created jobs.diamond_top
+Created jobs.independent1
+Created jobs.independent2
+Created jobs.multi_child
+Created jobs.multi_parent1
+Created jobs.multi_parent2
+Files: 2 uploaded, 0 deleted
+Resources: 12 created, 0 changed, 0 deleted, 0 unchanged
 
->>> print_requests.py --sort //jobs
+>>> print_requests.py --nostamp --sort //jobs
 {
   "method": "POST",
   "path": "/api/2.2/jobs/create",
@@ -278,12 +289,22 @@ Deployment complete!
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Deleted jobs.chain_bottom
+Deleted jobs.chain_mid
+Deleted jobs.chain_top
+Deleted jobs.diamond_bottom
+Deleted jobs.diamond_left
+Deleted jobs.diamond_right
+Deleted jobs.diamond_top
+Deleted jobs.independent1
+Deleted jobs.independent2
+Deleted jobs.multi_child
+Deleted jobs.multi_parent1
+Deleted jobs.multi_parent2
+Files: 3 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 12 deleted, 0 unchanged
 
 >>> [CLI] bundle destroy --auto-approve
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 0 deleted
diff --git a/acceptance/bundle/resource_deps/job_id_big_graph/delete_all/script b/acceptance/bundle/resource_deps/job_id_big_graph/delete_all/script
index 4ff07b8b69e..d3ddd6dba67 100644
--- a/acceptance/bundle/resource_deps/job_id_big_graph/delete_all/script
+++ b/acceptance/bundle/resource_deps/job_id_big_graph/delete_all/script
@@ -1,19 +1,18 @@
 cp $TESTDIR/../databricks.yml .
 cp $TESTDIR/../empty.yml .
-echo "*" > .gitignore
 
 trace $CLI bundle deploy
-trace print_requests.py --sort //jobs
+trace print_requests.py --nostamp --sort //jobs
 
 replace_ids.py
 
 # Sanity check plan after deploy
-trace $CLI bundle plan > out.plan_sanity.$DATABRICKS_BUNDLE_ENGINE.txt
+trace $CLI bundle plan > out.plan_sanity.txt
 
 title "Delete all via empty.yml"
 cp empty.yml databricks.yml
-trace $CLI bundle plan > out.plan_delete.$DATABRICKS_BUNDLE_ENGINE.txt
+trace $CLI bundle plan > out.plan_delete.txt
 trace $CLI bundle deploy
 
 trace $CLI bundle destroy --auto-approve
-rm -f out.requests.txt
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/resource_deps/job_id_big_graph/destroy/out.plan_sanity.direct.txt b/acceptance/bundle/resource_deps/job_id_big_graph/destroy/out.plan_sanity.direct.txt
deleted file mode 100644
index 28f35f79666..00000000000
--- a/acceptance/bundle/resource_deps/job_id_big_graph/destroy/out.plan_sanity.direct.txt
+++ /dev/null
@@ -1 +0,0 @@
-Plan: 0 to add, 0 to change, 0 to delete, 12 unchanged
diff --git a/acceptance/bundle/resource_deps/job_id_big_graph/destroy/out.plan_sanity.terraform.txt b/acceptance/bundle/resource_deps/job_id_big_graph/destroy/out.plan_sanity.terraform.txt
deleted file mode 100644
index 28f35f79666..00000000000
--- a/acceptance/bundle/resource_deps/job_id_big_graph/destroy/out.plan_sanity.terraform.txt
+++ /dev/null
@@ -1 +0,0 @@
-Plan: 0 to add, 0 to change, 0 to delete, 12 unchanged
diff --git a/acceptance/bundle/resource_deps/job_id_big_graph/delete_all/out.plan_sanity.terraform.txt b/acceptance/bundle/resource_deps/job_id_big_graph/destroy/out.plan_sanity.txt
similarity index 100%
rename from acceptance/bundle/resource_deps/job_id_big_graph/delete_all/out.plan_sanity.terraform.txt
rename to acceptance/bundle/resource_deps/job_id_big_graph/destroy/out.plan_sanity.txt
diff --git a/acceptance/bundle/resource_deps/job_id_big_graph/destroy/out.test.toml b/acceptance/bundle/resource_deps/job_id_big_graph/destroy/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resource_deps/job_id_big_graph/destroy/out.test.toml
+++ b/acceptance/bundle/resource_deps/job_id_big_graph/destroy/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/job_id_big_graph/destroy/output.txt b/acceptance/bundle/resource_deps/job_id_big_graph/destroy/output.txt
index 72b7277ec76..ac7b7af1f78 100644
--- a/acceptance/bundle/resource_deps/job_id_big_graph/destroy/output.txt
+++ b/acceptance/bundle/resource_deps/job_id_big_graph/destroy/output.txt
@@ -1,11 +1,22 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.chain_bottom
+Created jobs.chain_mid
+Created jobs.chain_top
+Created jobs.diamond_bottom
+Created jobs.diamond_left
+Created jobs.diamond_right
+Created jobs.diamond_top
+Created jobs.independent1
+Created jobs.independent2
+Created jobs.multi_child
+Created jobs.multi_parent1
+Created jobs.multi_parent2
+Files: 1 uploaded, 0 deleted
+Resources: 12 created, 0 changed, 0 deleted, 0 unchanged
 
->>> print_requests.py --sort //jobs
+>>> print_requests.py --nostamp --sort //jobs
 {
   "method": "POST",
   "path": "/api/2.2/jobs/create",
@@ -291,5 +302,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 12 deleted
diff --git a/acceptance/bundle/resource_deps/job_id_big_graph/destroy/script b/acceptance/bundle/resource_deps/job_id_big_graph/destroy/script
index 090f2bd806f..e9645f97a5a 100644
--- a/acceptance/bundle/resource_deps/job_id_big_graph/destroy/script
+++ b/acceptance/bundle/resource_deps/job_id_big_graph/destroy/script
@@ -1,14 +1,13 @@
 cp $TESTDIR/../databricks.yml .
-echo "*" > .gitignore
 
 trace $CLI bundle deploy
-trace print_requests.py --sort //jobs
+trace print_requests.py --nostamp --sort //jobs
 
 replace_ids.py
 
 # Sanity check plan after deploy
-trace $CLI bundle plan > out.plan_sanity.$DATABRICKS_BUNDLE_ENGINE.txt
+trace $CLI bundle plan > out.plan_sanity.txt
 
 title "Destroy all via bundle destroy"
 trace $CLI bundle destroy --auto-approve
-rm -f out.requests.txt
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/resource_deps/job_id_delete_bar/out.deploy2.requests.direct.json b/acceptance/bundle/resource_deps/job_id_delete_bar/out.deploy2.requests.json
similarity index 100%
rename from acceptance/bundle/resource_deps/job_id_delete_bar/out.deploy2.requests.direct.json
rename to acceptance/bundle/resource_deps/job_id_delete_bar/out.deploy2.requests.json
diff --git a/acceptance/bundle/resource_deps/job_id_delete_bar/out.deploy2.requests.terraform.json b/acceptance/bundle/resource_deps/job_id_delete_bar/out.deploy2.requests.terraform.json
deleted file mode 100644
index 7b9df153286..00000000000
--- a/acceptance/bundle/resource_deps/job_id_delete_bar/out.deploy2.requests.terraform.json
+++ /dev/null
@@ -1,32 +0,0 @@
-{
-  "method": "POST",
-  "path": "/api/2.2/jobs/delete",
-  "body": {
-    "job_id": [BAR_ID]
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.2/jobs/reset",
-  "body": {
-    "job_id": [FOO_ID],
-    "new_settings": {
-      "deployment": {
-        "kind": "BUNDLE",
-        "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-      },
-      "edit_mode": "UI_LOCKED",
-      "email_notifications": {},
-      "format": "MULTI_TASK",
-      "max_concurrent_runs": 1,
-      "name": "job foo",
-      "queue": {
-        "enabled": true
-      },
-      "run_as": {
-        "user_name": "[USERNAME]"
-      },
-      "webhook_notifications": {}
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/job_id_delete_bar/out.plan_delete.direct.json b/acceptance/bundle/resource_deps/job_id_delete_bar/out.plan_delete.direct.json
deleted file mode 100644
index 288989ea84e..00000000000
--- a/acceptance/bundle/resource_deps/job_id_delete_bar/out.plan_delete.direct.json
+++ /dev/null
@@ -1,119 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.jobs.bar": {
-      "action": "delete",
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS][0],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-        },
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_id": [BAR_ID],
-        "max_concurrent_runs": 1,
-        "name": "job bar",
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "timeout_seconds": 0,
-        "webhook_notifications": {}
-      }
-    },
-    "resources.jobs.foo": {
-      "action": "update",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "job foo",
-          "queue": {
-            "enabled": true
-          }
-        }
-      },
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS][1],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-        },
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_id": [FOO_ID],
-        "max_concurrent_runs": 1,
-        "name": "job foo",
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "tasks": [
-          {
-            "email_notifications": {},
-            "run_if": "ALL_SUCCESS",
-            "run_job_task": {
-              "job_id": [BAR_ID]
-            },
-            "task_key": "job_task",
-            "timeout_seconds": 0
-          }
-        ],
-        "timeout_seconds": 0,
-        "webhook_notifications": {}
-      },
-      "changes": {
-        "email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks": {
-          "action": "update",
-          "old": [
-            {
-              "run_job_task": {
-                "job_id": [BAR_ID]
-              },
-              "task_key": "job_task"
-            }
-          ],
-          "remote": [
-            {
-              "email_notifications": {},
-              "run_if": "ALL_SUCCESS",
-              "run_job_task": {
-                "job_id": [BAR_ID]
-              },
-              "task_key": "job_task",
-              "timeout_seconds": 0
-            }
-          ]
-        },
-        "timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "webhook_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/job_id_delete_bar/out.plan_delete.json b/acceptance/bundle/resource_deps/job_id_delete_bar/out.plan_delete.json
new file mode 100644
index 00000000000..7bfd65fc731
--- /dev/null
+++ b/acceptance/bundle/resource_deps/job_id_delete_bar/out.plan_delete.json
@@ -0,0 +1,119 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.jobs.bar": {
+      "action": "delete",
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS][0],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_id": [BAR_ID],
+        "max_concurrent_runs": 1,
+        "name": "job bar",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "timeout_seconds": 0,
+        "webhook_notifications": {}
+      }
+    },
+    "resources.jobs.foo": {
+      "action": "update",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "job foo",
+          "queue": {
+            "enabled": true
+          }
+        }
+      },
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS][1],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_id": [FOO_ID],
+        "max_concurrent_runs": 1,
+        "name": "job foo",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "tasks": [
+          {
+            "email_notifications": {},
+            "run_if": "ALL_SUCCESS",
+            "run_job_task": {
+              "job_id": [BAR_ID]
+            },
+            "task_key": "job_task",
+            "timeout_seconds": 0
+          }
+        ],
+        "timeout_seconds": 0,
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks": {
+          "action": "update",
+          "old": [
+            {
+              "run_job_task": {
+                "job_id": [BAR_ID]
+              },
+              "task_key": "job_task"
+            }
+          ],
+          "remote": [
+            {
+              "email_notifications": {},
+              "run_if": "ALL_SUCCESS",
+              "run_job_task": {
+                "job_id": [BAR_ID]
+              },
+              "task_key": "job_task",
+              "timeout_seconds": 0
+            }
+          ]
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resource_deps/job_id_delete_bar/out.plan_delete.terraform.json b/acceptance/bundle/resource_deps/job_id_delete_bar/out.plan_delete.terraform.json
deleted file mode 100644
index ab94b77b145..00000000000
--- a/acceptance/bundle/resource_deps/job_id_delete_bar/out.plan_delete.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.bar": {
-      "action": "delete"
-    },
-    "resources.jobs.foo": {
-      "action": "update"
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/job_id_delete_bar/out.test.toml b/acceptance/bundle/resource_deps/job_id_delete_bar/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resource_deps/job_id_delete_bar/out.test.toml
+++ b/acceptance/bundle/resource_deps/job_id_delete_bar/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/job_id_delete_bar/output.txt b/acceptance/bundle/resource_deps/job_id_delete_bar/output.txt
index fdba7e0c427..879c77141ca 100644
--- a/acceptance/bundle/resource_deps/job_id_delete_bar/output.txt
+++ b/acceptance/bundle/resource_deps/job_id_delete_bar/output.txt
@@ -1,11 +1,12 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.bar
+Created jobs.foo
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
->>> print_requests.py //jobs
+>>> print_requests.py --nostamp //jobs
 {
   "method": "POST",
   "path": "/api/2.2/jobs/create",
@@ -54,11 +55,12 @@ Deployment complete!
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Deleted jobs.bar
+Updated jobs.foo
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 1 deleted, 0 unchanged
 
->>> print_requests.py --sort //jobs
+>>> print_requests.py --nostamp --sort //jobs
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
@@ -66,10 +68,9 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
 
->>> print_requests.py //jobs
+>>> print_requests.py --nostamp //jobs
 {
   "method": "POST",
   "path": "/api/2.2/jobs/delete",
diff --git a/acceptance/bundle/resource_deps/job_id_delete_bar/script b/acceptance/bundle/resource_deps/job_id_delete_bar/script
index 62bdc1e3fe9..ddccf53c38a 100644
--- a/acceptance/bundle/resource_deps/job_id_delete_bar/script
+++ b/acceptance/bundle/resource_deps/job_id_delete_bar/script
@@ -1,6 +1,5 @@
-echo "*" > .gitignore
 trace $CLI bundle deploy
-trace print_requests.py //jobs
+trace print_requests.py --nostamp //jobs
 
 foo_id=`read_id.py foo`
 
@@ -8,11 +7,11 @@ bar_id=`read_id.py bar`
 
 title "Delete bar, keep foo (foo config updated to not depend on bar)"
 cp only_foo.yml databricks.yml
-trace $CLI bundle plan -o json > out.plan_delete.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.plan_delete.json
 trace $CLI bundle deploy
 # Sort requests because foo's update and bar's delete have no dependency edge
 # (foo's dependency on bar was removed in only_foo.yml), so execution order is non-deterministic.
-trace print_requests.py --sort //jobs > out.deploy2.requests.$DATABRICKS_BUNDLE_ENGINE.json
+trace print_requests.py --nostamp --sort //jobs > out.deploy2.requests.json
 
 trace $CLI bundle destroy --auto-approve
-trace print_requests.py //jobs
+trace print_requests.py --nostamp //jobs
diff --git a/acceptance/bundle/resource_deps/job_id_delete_foo/out.plan_delete.direct.json b/acceptance/bundle/resource_deps/job_id_delete_foo/out.plan_delete.direct.json
deleted file mode 100644
index 8312f1ae76a..00000000000
--- a/acceptance/bundle/resource_deps/job_id_delete_foo/out.plan_delete.direct.json
+++ /dev/null
@@ -1,88 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.jobs.bar": {
-      "action": "skip",
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS][0],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-        },
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_id": [BAR_ID],
-        "max_concurrent_runs": 1,
-        "name": "job bar",
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "timeout_seconds": 0,
-        "webhook_notifications": {}
-      },
-      "changes": {
-        "email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "webhook_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        }
-      }
-    },
-    "resources.jobs.foo": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.bar",
-          "label": "${resources.jobs.bar.id}"
-        }
-      ],
-      "action": "delete",
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS][1],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-        },
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_id": [FOO_ID],
-        "max_concurrent_runs": 1,
-        "name": "job foo",
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "tasks": [
-          {
-            "email_notifications": {},
-            "run_if": "ALL_SUCCESS",
-            "run_job_task": {
-              "job_id": [BAR_ID]
-            },
-            "task_key": "job_task",
-            "timeout_seconds": 0
-          }
-        ],
-        "timeout_seconds": 0,
-        "webhook_notifications": {}
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/job_id_delete_foo/out.plan_delete.json b/acceptance/bundle/resource_deps/job_id_delete_foo/out.plan_delete.json
new file mode 100644
index 00000000000..2eaf14f4fd1
--- /dev/null
+++ b/acceptance/bundle/resource_deps/job_id_delete_foo/out.plan_delete.json
@@ -0,0 +1,88 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.jobs.bar": {
+      "action": "skip",
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS][0],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_id": [BAR_ID],
+        "max_concurrent_runs": 1,
+        "name": "job bar",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "timeout_seconds": 0,
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    },
+    "resources.jobs.foo": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.bar",
+          "label": "${resources.jobs.bar.id}"
+        }
+      ],
+      "action": "delete",
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS][1],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_id": [FOO_ID],
+        "max_concurrent_runs": 1,
+        "name": "job foo",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "tasks": [
+          {
+            "email_notifications": {},
+            "run_if": "ALL_SUCCESS",
+            "run_job_task": {
+              "job_id": [BAR_ID]
+            },
+            "task_key": "job_task",
+            "timeout_seconds": 0
+          }
+        ],
+        "timeout_seconds": 0,
+        "webhook_notifications": {}
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resource_deps/job_id_delete_foo/out.plan_delete.terraform.json b/acceptance/bundle/resource_deps/job_id_delete_foo/out.plan_delete.terraform.json
deleted file mode 100644
index 8d4a211caa1..00000000000
--- a/acceptance/bundle/resource_deps/job_id_delete_foo/out.plan_delete.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.bar": {
-      "action": "skip"
-    },
-    "resources.jobs.foo": {
-      "action": "delete"
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/job_id_delete_foo/out.test.toml b/acceptance/bundle/resource_deps/job_id_delete_foo/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resource_deps/job_id_delete_foo/out.test.toml
+++ b/acceptance/bundle/resource_deps/job_id_delete_foo/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/job_id_delete_foo/output.txt b/acceptance/bundle/resource_deps/job_id_delete_foo/output.txt
index dd604c51486..b126ba76227 100644
--- a/acceptance/bundle/resource_deps/job_id_delete_foo/output.txt
+++ b/acceptance/bundle/resource_deps/job_id_delete_foo/output.txt
@@ -1,11 +1,12 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.bar
+Created jobs.foo
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
->>> print_requests.py //jobs
+>>> print_requests.py --nostamp //jobs
 {
   "method": "POST",
   "path": "/api/2.2/jobs/create",
@@ -54,11 +55,11 @@ Deployment complete!
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Deleted jobs.foo
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 1 deleted, 1 unchanged
 
->>> print_requests.py //jobs
+>>> print_requests.py --nostamp //jobs
 {
   "method": "POST",
   "path": "/api/2.2/jobs/delete",
@@ -73,10 +74,9 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
 
->>> print_requests.py //jobs
+>>> print_requests.py --nostamp //jobs
 {
   "method": "POST",
   "path": "/api/2.2/jobs/delete",
diff --git a/acceptance/bundle/resource_deps/job_id_delete_foo/script b/acceptance/bundle/resource_deps/job_id_delete_foo/script
index 89e1d97bd38..eb7ff645436 100644
--- a/acceptance/bundle/resource_deps/job_id_delete_foo/script
+++ b/acceptance/bundle/resource_deps/job_id_delete_foo/script
@@ -1,6 +1,5 @@
-echo "*" > .gitignore
 trace $CLI bundle deploy
-trace print_requests.py //jobs
+trace print_requests.py --nostamp //jobs
 
 foo_id=`read_id.py foo`
 
@@ -8,9 +7,9 @@ bar_id=`read_id.py bar`
 
 title "Delete foo, keep bar"
 cp only_bar.yml databricks.yml
-trace $CLI bundle plan -o json > out.plan_delete.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.plan_delete.json
 trace $CLI bundle deploy
-trace print_requests.py //jobs
+trace print_requests.py --nostamp //jobs
 
 trace $CLI bundle destroy --auto-approve
-trace print_requests.py //jobs
+trace print_requests.py --nostamp //jobs
diff --git a/acceptance/bundle/resource_deps/job_tasks/databricks.yml b/acceptance/bundle/resource_deps/job_tasks/databricks.yml
index 11dd530947e..ce9824867c7 100644
--- a/acceptance/bundle/resource_deps/job_tasks/databricks.yml
+++ b/acceptance/bundle/resource_deps/job_tasks/databricks.yml
@@ -25,9 +25,8 @@ resources:
         - task_key: TestTask
           python_wheel_task:
             package_name: "my_test_code"
-            # for direct, the syntax follows SDK struct:
-            #entry_point: ${resources.jobs.test_job.tasks[0].python_wheel_task.entry_point}
-            # for terraform, the syntax follows TF model:
+            # TF path: "task" (singular) → "tasks" handled by direct engine translation.
+            # python_wheel_task[0]: TF list-block syntax; [0] on a struct is a no-op in structaccess.
             entry_point: ${resources.jobs.test_job.task[0].python_wheel_task[0].entry_point}
           environment_key: test_env
           libraries:
diff --git a/acceptance/bundle/resource_deps/job_tasks/out.telemetry.direct.txt b/acceptance/bundle/resource_deps/job_tasks/out.telemetry.direct.txt
deleted file mode 100644
index 410528fdf3f..00000000000
--- a/acceptance/bundle/resource_deps/job_tasks/out.telemetry.direct.txt
+++ /dev/null
@@ -1,12 +0,0 @@
-experimental.use_legacy_run_as false
-has_classic_interactive_compute false
-has_classic_job_compute false
-has_serverless_compute true
-local.cache.attempt true
-local.cache.miss true
-presets_name_prefix_is_set false
-python_wheel_wrapper_is_set false
-resref_jobs.tags.* true
-resref_jobs.tasks.python_wheel_task.entry_point true
-run_as_set false
-skip_artifact_cleanup false
diff --git a/acceptance/bundle/resource_deps/job_tasks/out.telemetry.terraform.txt b/acceptance/bundle/resource_deps/job_tasks/out.telemetry.terraform.txt
deleted file mode 100644
index 50371a06442..00000000000
--- a/acceptance/bundle/resource_deps/job_tasks/out.telemetry.terraform.txt
+++ /dev/null
@@ -1,12 +0,0 @@
-experimental.use_legacy_run_as false
-has_classic_interactive_compute false
-has_classic_job_compute false
-has_serverless_compute true
-local.cache.attempt true
-local.cache.miss true
-presets_name_prefix_is_set false
-python_wheel_wrapper_is_set false
-resref_jobs.tags.* true
-resreferr_jobs.task true
-run_as_set false
-skip_artifact_cleanup false
diff --git a/acceptance/bundle/resource_deps/job_tasks/out.test.toml b/acceptance/bundle/resource_deps/job_tasks/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resource_deps/job_tasks/out.test.toml
+++ b/acceptance/bundle/resource_deps/job_tasks/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/job_tasks/output.txt b/acceptance/bundle/resource_deps/job_tasks/output.txt
index 3ff91361fb4..f8c14742d70 100644
--- a/acceptance/bundle/resource_deps/job_tasks/output.txt
+++ b/acceptance/bundle/resource_deps/job_tasks/output.txt
@@ -2,8 +2,30 @@
 >>> [CLI] bundle deploy
 Uploading hello.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.foo
+Created jobs.test_job
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> print_telemetry_bool_values
+dms_compat_auto true
+dms_undeclared_deploying_user false
+dms_undeclared_group false
+dms_undeclared_other_user false
+dms_undeclared_service_principal false
+experimental.use_legacy_run_as false
+has_classic_interactive_compute false
+has_classic_job_compute false
+has_python_wheel_task true
+has_serverless_compute true
+local.cache.attempt true
+local.cache.miss true
+permissions_section_set false
+presets_name_prefix_is_set false
+python_wheel_wrapper_is_set false
+run_as_set false
+skip_artifact_cleanup false
+state_path_in_deployer_home true
+state_path_in_other_user_home false
+state_path_is_shared false
+state_path_other false
diff --git a/acceptance/bundle/resource_deps/job_tasks/script b/acceptance/bundle/resource_deps/job_tasks/script
index 48e1d2ad376..bbfbdfc5ea1 100644
--- a/acceptance/bundle/resource_deps/job_tasks/script
+++ b/acceptance/bundle/resource_deps/job_tasks/script
@@ -1,9 +1,4 @@
-if [ "$DATABRICKS_BUNDLE_ENGINE" == "direct" ]; then
-    # terraform has its own schema, direct uses bundle schema; here we replace TF syntax with bundle syntax:
-    update_file.py databricks.yml 'task[0].python_wheel_task[0].' 'tasks[0].python_wheel_task.'
-fi
-
 touch hello.whl
 trace $CLI bundle deploy
-trace print_telemetry_bool_values > out.telemetry.$DATABRICKS_BUNDLE_ENGINE.txt
-rm out.requests.txt hello.whl
+trace print_telemetry_bool_values
+rm "$OUT_REQUESTS" hello.whl
diff --git a/acceptance/bundle/resource_deps/jobs_update/out.deploy2.requests.direct.json b/acceptance/bundle/resource_deps/jobs_update/out.deploy2.requests.json
similarity index 100%
rename from acceptance/bundle/resource_deps/jobs_update/out.deploy2.requests.direct.json
rename to acceptance/bundle/resource_deps/jobs_update/out.deploy2.requests.json
diff --git a/acceptance/bundle/resource_deps/jobs_update/out.deploy2.requests.terraform.json b/acceptance/bundle/resource_deps/jobs_update/out.deploy2.requests.terraform.json
deleted file mode 100644
index 3b099ed5f68..00000000000
--- a/acceptance/bundle/resource_deps/jobs_update/out.deploy2.requests.terraform.json
+++ /dev/null
@@ -1,41 +0,0 @@
-{
-  "method": "POST",
-  "path": "/api/2.2/jobs/reset",
-  "body": {
-    "job_id": [FOO_ID],
-    "new_settings": {
-      "deployment": {
-        "kind": "BUNDLE",
-        "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-      },
-      "edit_mode": "UI_LOCKED",
-      "email_notifications": {},
-      "format": "MULTI_TASK",
-      "job_clusters": [
-        {
-          "job_cluster_key": "key",
-          "new_cluster": {
-            "num_workers": 0,
-            "spark_version": "13.3.x-scala2.12"
-          }
-        }
-      ],
-      "max_concurrent_runs": 1,
-      "name": "foo",
-      "queue": {
-        "enabled": true
-      },
-      "run_as": {
-        "user_name": "[USERNAME]"
-      },
-      "trigger": {
-        "pause_status": "UNPAUSED",
-        "periodic": {
-          "interval": 1,
-          "unit": "HOURS"
-        }
-      },
-      "webhook_notifications": {}
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/jobs_update/out.get_foo.direct.json b/acceptance/bundle/resource_deps/jobs_update/out.get_foo.json
similarity index 100%
rename from acceptance/bundle/resource_deps/jobs_update/out.get_foo.direct.json
rename to acceptance/bundle/resource_deps/jobs_update/out.get_foo.json
diff --git a/acceptance/bundle/resource_deps/jobs_update/out.get_foo.terraform.json b/acceptance/bundle/resource_deps/jobs_update/out.get_foo.terraform.json
deleted file mode 100644
index e20aea135c4..00000000000
--- a/acceptance/bundle/resource_deps/jobs_update/out.get_foo.terraform.json
+++ /dev/null
@@ -1,41 +0,0 @@
-{
-  "created_time": [UNIX_TIME_MILLIS],
-  "creator_user_name": "[USERNAME]",
-  "job_id": [FOO_ID],
-  "run_as_user_name": "[USERNAME]",
-  "settings": {
-    "deployment": {
-      "kind": "BUNDLE",
-      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-    },
-    "edit_mode": "UI_LOCKED",
-    "email_notifications": {},
-    "format": "MULTI_TASK",
-    "job_clusters": [
-      {
-        "job_cluster_key": "key",
-        "new_cluster": {
-          "num_workers": 0,
-          "spark_version": "13.3.x-scala2.12"
-        }
-      }
-    ],
-    "max_concurrent_runs": 1,
-    "name": "foo",
-    "queue": {
-      "enabled": true
-    },
-    "run_as": {
-      "user_name": "[USERNAME]"
-    },
-    "timeout_seconds": 0,
-    "trigger": {
-      "pause_status": "UNPAUSED",
-      "periodic": {
-        "interval": 1,
-        "unit": "HOURS"
-      }
-    },
-    "webhook_notifications": {}
-  }
-}
diff --git a/acceptance/bundle/resource_deps/jobs_update/out.test.toml b/acceptance/bundle/resource_deps/jobs_update/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resource_deps/jobs_update/out.test.toml
+++ b/acceptance/bundle/resource_deps/jobs_update/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/jobs_update/output.txt b/acceptance/bundle/resource_deps/jobs_update/output.txt
index edbfc2df2b3..47f5b942227 100644
--- a/acceptance/bundle/resource_deps/jobs_update/output.txt
+++ b/acceptance/bundle/resource_deps/jobs_update/output.txt
@@ -7,11 +7,12 @@ Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.bar
+Created jobs.foo
+Files: 1 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
->>> print_requests.py //jobs
+>>> print_requests.py --nostamp //jobs
 
 >>> [CLI] bundle plan
 Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
@@ -26,11 +27,11 @@ Plan: 0 to add, 1 to change, 0 to delete, 1 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated jobs.foo
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 1 unchanged
 
->>> print_requests.py //jobs
+>>> print_requests.py --nostamp //jobs
 
 >>> [CLI] bundle plan
 Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
@@ -70,10 +71,9 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 2 deleted
 
->>> print_requests.py //jobs
+>>> print_requests.py --nostamp //jobs
 {
   "method": "POST",
   "path": "/api/2.2/jobs/delete",
@@ -90,7 +90,7 @@ Destroy complete!
 }
 
 >>> musterr [CLI] jobs get [FOO_ID]
-Error: Not Found
+Error: Job [FOO_ID] does not exist.
 
 >>> musterr [CLI] jobs get [BAR_ID]
-Error: Not Found
+Error: Job [BAR_ID] does not exist.
diff --git a/acceptance/bundle/resource_deps/jobs_update/script b/acceptance/bundle/resource_deps/jobs_update/script
index 3cb808b187f..5e4c4bd95a0 100644
--- a/acceptance/bundle/resource_deps/jobs_update/script
+++ b/acceptance/bundle/resource_deps/jobs_update/script
@@ -1,8 +1,7 @@
 
-echo "*" > .gitignore
 trace $CLI bundle plan
 trace $CLI bundle deploy
-trace print_requests.py //jobs > out.deploy1.requests.json
+trace print_requests.py --nostamp //jobs > out.deploy1.requests.json
 
 foo_id=`read_id.py foo`
 
@@ -15,19 +14,19 @@ trace update_file.py databricks.yml DAYS HOURS
 trace $CLI bundle plan
 trace $CLI bundle deploy
 # per-engine output file because terraform adds output-only and server-side defaults fields into request and direct does not
-trace print_requests.py //jobs > out.deploy2.requests.$DATABRICKS_BUNDLE_ENGINE.json
+trace print_requests.py --nostamp //jobs > out.deploy2.requests.json
 trace $CLI bundle plan
 
 title "Fetch job ID and verify remote state"
 
 # Badness: output should not be different per engine; investigate if it's the same on cloud
-trace $CLI jobs get $foo_id > out.get_foo.$DATABRICKS_BUNDLE_ENGINE.json
-trace $CLI jobs get $bar_id
-rm out.requests.txt
+trace $CLI jobs get $foo_id | nostamp > out.get_foo.json
+trace $CLI jobs get $bar_id | nostamp
+rm "$OUT_REQUESTS"
 
 trace $CLI bundle destroy --auto-approve
-trace print_requests.py //jobs
+trace print_requests.py --nostamp //jobs
 
 trace musterr $CLI jobs get $foo_id
 trace musterr $CLI jobs get $bar_id
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/resource_deps/jobs_update_remote/out.plan_create.direct.json b/acceptance/bundle/resource_deps/jobs_update_remote/out.plan_create.direct.json
deleted file mode 100644
index 99d2abc2e6e..00000000000
--- a/acceptance/bundle/resource_deps/jobs_update_remote/out.plan_create.direct.json
+++ /dev/null
@@ -1,68 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.bar": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.foo",
-          "label": "${resources.jobs.foo.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "description": "depends on foo id ${resources.jobs.foo.id}",
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "bar",
-          "queue": {
-            "enabled": true
-          }
-        },
-        "vars": {
-          "description": "depends on foo id ${resources.jobs.foo.id}"
-        }
-      }
-    },
-    "resources.jobs.foo": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "job_clusters": [
-            {
-              "job_cluster_key": "key",
-              "new_cluster": {
-                "num_workers": 0,
-                "spark_version": "13.3.x-scala2.12"
-              }
-            }
-          ],
-          "max_concurrent_runs": 1,
-          "name": "foo",
-          "queue": {
-            "enabled": true
-          },
-          "trigger": {
-            "pause_status": "UNPAUSED",
-            "periodic": {
-              "interval": 1,
-              "unit": "DAYS"
-            }
-          }
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/jobs_update_remote/out.plan_create.json b/acceptance/bundle/resource_deps/jobs_update_remote/out.plan_create.json
new file mode 100644
index 00000000000..a672bdccb21
--- /dev/null
+++ b/acceptance/bundle/resource_deps/jobs_update_remote/out.plan_create.json
@@ -0,0 +1,68 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.jobs.bar": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.foo",
+          "label": "${resources.jobs.foo.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "description": "depends on foo id ${resources.jobs.foo.id}",
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "bar",
+          "queue": {
+            "enabled": true
+          }
+        },
+        "vars": {
+          "description": "depends on foo id ${resources.jobs.foo.id}"
+        }
+      }
+    },
+    "resources.jobs.foo": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "job_clusters": [
+            {
+              "job_cluster_key": "key",
+              "new_cluster": {
+                "num_workers": 0,
+                "spark_version": "13.3.x-scala2.12"
+              }
+            }
+          ],
+          "max_concurrent_runs": 1,
+          "name": "foo",
+          "queue": {
+            "enabled": true
+          },
+          "trigger": {
+            "pause_status": "UNPAUSED",
+            "periodic": {
+              "interval": 1,
+              "unit": "DAYS"
+            }
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resource_deps/jobs_update_remote/out.plan_create.terraform.json b/acceptance/bundle/resource_deps/jobs_update_remote/out.plan_create.terraform.json
deleted file mode 100644
index 5b7564f8e74..00000000000
--- a/acceptance/bundle/resource_deps/jobs_update_remote/out.plan_create.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.bar": {
-      "action": "create"
-    },
-    "resources.jobs.foo": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/jobs_update_remote/out.plan_update.direct.json b/acceptance/bundle/resource_deps/jobs_update_remote/out.plan_update.direct.json
deleted file mode 100644
index 06729cd4189..00000000000
--- a/acceptance/bundle/resource_deps/jobs_update_remote/out.plan_update.direct.json
+++ /dev/null
@@ -1,153 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.jobs.bar": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.foo",
-          "label": "${resources.jobs.foo.id}"
-        }
-      ],
-      "action": "skip",
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS][0],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-        },
-        "description": "depends on foo id [FOO_ID]",
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_id": [BAR_ID],
-        "max_concurrent_runs": 1,
-        "name": "bar",
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "timeout_seconds": 0,
-        "webhook_notifications": {}
-      },
-      "changes": {
-        "email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "webhook_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        }
-      }
-    },
-    "resources.jobs.foo": {
-      "action": "update",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "job_clusters": [
-            {
-              "job_cluster_key": "key",
-              "new_cluster": {
-                "num_workers": 0,
-                "spark_version": "13.3.x-scala2.12"
-              }
-            }
-          ],
-          "max_concurrent_runs": 1,
-          "name": "foo",
-          "queue": {
-            "enabled": true
-          },
-          "trigger": {
-            "pause_status": "UNPAUSED",
-            "periodic": {
-              "interval": 1,
-              "unit": "DAYS"
-            }
-          }
-        }
-      },
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS][1],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-        },
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_clusters": [
-          {
-            "job_cluster_key": "key",
-            "new_cluster": {
-              "spark_version": "13.3.x-scala2.12"
-            }
-          }
-        ],
-        "job_id": [FOO_ID],
-        "max_concurrent_runs": 1,
-        "name": "foo",
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "timeout_seconds": 0,
-        "trigger": {
-          "pause_status": "UNPAUSED",
-          "periodic": {
-            "interval": 1,
-            "unit": "HOURS"
-          }
-        },
-        "webhook_notifications": {}
-      },
-      "changes": {
-        "email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "job_clusters[job_cluster_key='key'].new_cluster.num_workers": {
-          "action": "skip",
-          "reason": "empty",
-          "old": 0,
-          "new": 0
-        },
-        "timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "trigger.periodic.unit": {
-          "action": "update",
-          "old": "DAYS",
-          "new": "DAYS",
-          "remote": "HOURS"
-        },
-        "webhook_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/jobs_update_remote/out.plan_update.json b/acceptance/bundle/resource_deps/jobs_update_remote/out.plan_update.json
new file mode 100644
index 00000000000..5f91a583afe
--- /dev/null
+++ b/acceptance/bundle/resource_deps/jobs_update_remote/out.plan_update.json
@@ -0,0 +1,153 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.jobs.bar": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.foo",
+          "label": "${resources.jobs.foo.id}"
+        }
+      ],
+      "action": "skip",
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS][0],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "description": "depends on foo id [FOO_ID]",
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_id": [BAR_ID],
+        "max_concurrent_runs": 1,
+        "name": "bar",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "timeout_seconds": 0,
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    },
+    "resources.jobs.foo": {
+      "action": "update",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "job_clusters": [
+            {
+              "job_cluster_key": "key",
+              "new_cluster": {
+                "num_workers": 0,
+                "spark_version": "13.3.x-scala2.12"
+              }
+            }
+          ],
+          "max_concurrent_runs": 1,
+          "name": "foo",
+          "queue": {
+            "enabled": true
+          },
+          "trigger": {
+            "pause_status": "UNPAUSED",
+            "periodic": {
+              "interval": 1,
+              "unit": "DAYS"
+            }
+          }
+        }
+      },
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS][1],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_clusters": [
+          {
+            "job_cluster_key": "key",
+            "new_cluster": {
+              "spark_version": "13.3.x-scala2.12"
+            }
+          }
+        ],
+        "job_id": [FOO_ID],
+        "max_concurrent_runs": 1,
+        "name": "foo",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "timeout_seconds": 0,
+        "trigger": {
+          "pause_status": "UNPAUSED",
+          "periodic": {
+            "interval": 1,
+            "unit": "HOURS"
+          }
+        },
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "job_clusters[job_cluster_key='key'].new_cluster.num_workers": {
+          "action": "skip",
+          "reason": "empty",
+          "old": 0,
+          "new": 0
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "trigger.periodic.unit": {
+          "action": "update",
+          "old": "DAYS",
+          "new": "DAYS",
+          "remote": "HOURS"
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resource_deps/jobs_update_remote/out.plan_update.terraform.json b/acceptance/bundle/resource_deps/jobs_update_remote/out.plan_update.terraform.json
deleted file mode 100644
index 8bb5a485e8a..00000000000
--- a/acceptance/bundle/resource_deps/jobs_update_remote/out.plan_update.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.bar": {
-      "action": "skip"
-    },
-    "resources.jobs.foo": {
-      "action": "update"
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/jobs_update_remote/out.test.toml b/acceptance/bundle/resource_deps/jobs_update_remote/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resource_deps/jobs_update_remote/out.test.toml
+++ b/acceptance/bundle/resource_deps/jobs_update_remote/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/jobs_update_remote/output.txt b/acceptance/bundle/resource_deps/jobs_update_remote/output.txt
index 8cd27e9c352..c0df8556b7a 100644
--- a/acceptance/bundle/resource_deps/jobs_update_remote/output.txt
+++ b/acceptance/bundle/resource_deps/jobs_update_remote/output.txt
@@ -1,11 +1,12 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.bar
+Created jobs.foo
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
->>> print_requests.py //jobs
+>>> print_requests.py --nostamp //jobs
 {
   "method": "POST",
   "path": "/api/2.2/jobs/create",
@@ -73,10 +74,9 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 2 deleted
 
->>> print_requests.py //jobs
+>>> print_requests.py --nostamp //jobs
 {
   "method": "POST",
   "path": "/api/2.2/jobs/reset",
diff --git a/acceptance/bundle/resource_deps/jobs_update_remote/script b/acceptance/bundle/resource_deps/jobs_update_remote/script
index 09572ae04be..8b827e07f03 100644
--- a/acceptance/bundle/resource_deps/jobs_update_remote/script
+++ b/acceptance/bundle/resource_deps/jobs_update_remote/script
@@ -1,7 +1,6 @@
-echo "*" > .gitignore
-$CLI bundle plan -o json > out.plan_create.$DATABRICKS_BUNDLE_ENGINE.json
+$CLI bundle plan -o json | nostamp > out.plan_create.json
 trace $CLI bundle deploy
-trace print_requests.py //jobs
+trace print_requests.py --nostamp //jobs
 
 trace $CLI bundle plan
 
@@ -13,7 +12,7 @@ bar_id=`read_id.py bar`
 title "Update trigger.periodic.unit remotely and re-deploy; jobs.bar is unchanged"
 trace envsubst < job_update.json > tmp.json && mv tmp.json job_update.json
 trace $CLI jobs reset --json @job_update.json
-$CLI bundle plan -o json > out.plan_update.$DATABRICKS_BUNDLE_ENGINE.json
+$CLI bundle plan -o json | nostamp > out.plan_update.json
 
 trace $CLI bundle destroy --auto-approve
-trace print_requests.py //jobs
+trace print_requests.py --nostamp //jobs
diff --git a/acceptance/bundle/resource_deps/loop_jobs/out.deploy.direct.txt b/acceptance/bundle/resource_deps/loop_jobs/out.deploy.direct.txt
deleted file mode 100644
index a700abc4986..00000000000
--- a/acceptance/bundle/resource_deps/loop_jobs/out.deploy.direct.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Error: cycle detected: resources.jobs.foo refers to resources.jobs.bar via ${resources.jobs.bar.id} which refers to resources.jobs.foo via ${resources.jobs.foo.id}
-
diff --git a/acceptance/bundle/resource_deps/loop_jobs/out.deploy.terraform.txt b/acceptance/bundle/resource_deps/loop_jobs/out.deploy.terraform.txt
deleted file mode 100644
index a60ee46bda7..00000000000
--- a/acceptance/bundle/resource_deps/loop_jobs/out.deploy.terraform.txt
+++ /dev/null
@@ -1,7 +0,0 @@
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Error: exit status 1
-
-Error: Cycle: databricks_job.foo, databricks_job.bar
-
-
-
diff --git a/acceptance/bundle/resource_deps/loop_jobs/out.deploy.txt b/acceptance/bundle/resource_deps/loop_jobs/out.deploy.txt
new file mode 100644
index 00000000000..e265307eb9b
--- /dev/null
+++ b/acceptance/bundle/resource_deps/loop_jobs/out.deploy.txt
@@ -0,0 +1,4 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Error: cycle detected: resources.jobs.foo refers to resources.jobs.bar via ${resources.jobs.bar.id} which refers to resources.jobs.foo via ${resources.jobs.foo.id}
+
+Files: 3 uploaded, 0 deleted
diff --git a/acceptance/bundle/resource_deps/loop_jobs/out.plan.terraform.txt b/acceptance/bundle/resource_deps/loop_jobs/out.plan.terraform.txt
deleted file mode 100644
index 083ada1adb3..00000000000
--- a/acceptance/bundle/resource_deps/loop_jobs/out.plan.terraform.txt
+++ /dev/null
@@ -1,6 +0,0 @@
-Error: exit status 1
-
-Error: Cycle: databricks_job.foo, databricks_job.bar
-
-
-
diff --git a/acceptance/bundle/resource_deps/loop_jobs/out.plan.direct.txt b/acceptance/bundle/resource_deps/loop_jobs/out.plan.txt
similarity index 100%
rename from acceptance/bundle/resource_deps/loop_jobs/out.plan.direct.txt
rename to acceptance/bundle/resource_deps/loop_jobs/out.plan.txt
diff --git a/acceptance/bundle/resource_deps/loop_jobs/out.test.toml b/acceptance/bundle/resource_deps/loop_jobs/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resource_deps/loop_jobs/out.test.toml
+++ b/acceptance/bundle/resource_deps/loop_jobs/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/loop_jobs/script b/acceptance/bundle/resource_deps/loop_jobs/script
index 6a4d602175a..2051d4e9606 100644
--- a/acceptance/bundle/resource_deps/loop_jobs/script
+++ b/acceptance/bundle/resource_deps/loop_jobs/script
@@ -1,4 +1,4 @@
 title "Badness: validate could detect this and fail as well"
 trace $CLI bundle validate
-musterr $CLI bundle plan &> out.plan.$DATABRICKS_BUNDLE_ENGINE.txt
-musterr $CLI bundle deploy &> out.deploy.$DATABRICKS_BUNDLE_ENGINE.txt
+musterr $CLI bundle plan &> out.plan.txt
+musterr $CLI bundle deploy &> out.deploy.txt
diff --git a/acceptance/bundle/resource_deps/loop_self/out.deploy.direct.txt b/acceptance/bundle/resource_deps/loop_self/out.deploy.direct.txt
deleted file mode 100644
index 5e7b406d2ec..00000000000
--- a/acceptance/bundle/resource_deps/loop_self/out.deploy.direct.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Error: cycle detected: resources.jobs.foo refers to itself via ${resources.jobs.foo.id}
-
diff --git a/acceptance/bundle/resource_deps/loop_self/out.deploy.terraform.txt b/acceptance/bundle/resource_deps/loop_self/out.deploy.terraform.txt
deleted file mode 100644
index 74773003d19..00000000000
--- a/acceptance/bundle/resource_deps/loop_self/out.deploy.terraform.txt
+++ /dev/null
@@ -1,18 +0,0 @@
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Error: exit status 1
-
-Error: Self-referential block
-
-  on bundle.tf.json line 23, in resource.databricks_job.foo:
-  23:         "name": "${databricks_job.foo.id}",
-
-Configuration for databricks_job.foo may not refer to itself.
-
-Error: Self-referential block
-
-  on bundle.tf.json line 23, in resource.databricks_job.foo:
-  23:         "name": "${databricks_job.foo.id}",
-
-Configuration for databricks_job.foo may not refer to itself.
-
-
diff --git a/acceptance/bundle/resource_deps/loop_self/out.deploy.txt b/acceptance/bundle/resource_deps/loop_self/out.deploy.txt
new file mode 100644
index 00000000000..98ba87930cd
--- /dev/null
+++ b/acceptance/bundle/resource_deps/loop_self/out.deploy.txt
@@ -0,0 +1,4 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Error: cycle detected: resources.jobs.foo refers to itself via ${resources.jobs.foo.id}
+
+Files: 3 uploaded, 0 deleted
diff --git a/acceptance/bundle/resource_deps/loop_self/out.plan.terraform.txt b/acceptance/bundle/resource_deps/loop_self/out.plan.terraform.txt
deleted file mode 100644
index 8434d76ae8a..00000000000
--- a/acceptance/bundle/resource_deps/loop_self/out.plan.terraform.txt
+++ /dev/null
@@ -1,17 +0,0 @@
-Error: exit status 1
-
-Error: Self-referential block
-
-  on bundle.tf.json line 23, in resource.databricks_job.foo:
-  23:         "name": "${databricks_job.foo.id}",
-
-Configuration for databricks_job.foo may not refer to itself.
-
-Error: Self-referential block
-
-  on bundle.tf.json line 23, in resource.databricks_job.foo:
-  23:         "name": "${databricks_job.foo.id}",
-
-Configuration for databricks_job.foo may not refer to itself.
-
-
diff --git a/acceptance/bundle/resource_deps/loop_self/out.plan.direct.txt b/acceptance/bundle/resource_deps/loop_self/out.plan.txt
similarity index 100%
rename from acceptance/bundle/resource_deps/loop_self/out.plan.direct.txt
rename to acceptance/bundle/resource_deps/loop_self/out.plan.txt
diff --git a/acceptance/bundle/resource_deps/loop_self/out.test.toml b/acceptance/bundle/resource_deps/loop_self/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resource_deps/loop_self/out.test.toml
+++ b/acceptance/bundle/resource_deps/loop_self/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/loop_self/script b/acceptance/bundle/resource_deps/loop_self/script
index d0d8b8e67a0..5475d19f368 100644
--- a/acceptance/bundle/resource_deps/loop_self/script
+++ b/acceptance/bundle/resource_deps/loop_self/script
@@ -1,4 +1,4 @@
 title "Badness: validate could detect this and fail as well"
 $CLI bundle validate
-musterr $CLI bundle plan &> out.plan.$DATABRICKS_BUNDLE_ENGINE.txt
-musterr $CLI bundle deploy &> out.deploy.$DATABRICKS_BUNDLE_ENGINE.txt
+musterr $CLI bundle plan &> out.plan.txt
+musterr $CLI bundle deploy &> out.deploy.txt
diff --git a/acceptance/bundle/resource_deps/missing_ingestion_definition/out.deploy.direct.txt b/acceptance/bundle/resource_deps/missing_ingestion_definition/out.deploy.direct.txt
deleted file mode 100644
index ca94099d2e5..00000000000
--- a/acceptance/bundle/resource_deps/missing_ingestion_definition/out.deploy.direct.txt
+++ /dev/null
@@ -1,7 +0,0 @@
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Error: cannot create resources.pipelines.bar: cannot resolve "${resources.pipelines.foo.ingestion_definition.connection_name}": ingestion_definition: cannot access nil value
-
-Updating deployment state...
-
-Exit code: 1
diff --git a/acceptance/bundle/resource_deps/missing_ingestion_definition/out.deploy.terraform.txt b/acceptance/bundle/resource_deps/missing_ingestion_definition/out.deploy.terraform.txt
deleted file mode 100644
index 6c234ec40ed..00000000000
--- a/acceptance/bundle/resource_deps/missing_ingestion_definition/out.deploy.terraform.txt
+++ /dev/null
@@ -1,16 +0,0 @@
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Error: exit status 1
-
-Error: Invalid index
-
-  on bundle.tf.json line 22, in resource.databricks_pipeline.bar:
-  22:         "name": "pbar ${databricks_pipeline.foo.ingestion_definition[0].connection_name}"
-    ├────────────────
-    │ databricks_pipeline.foo.ingestion_definition is empty list of object
-
-The given key does not identify an element in this collection value: the
-collection has no elements.
-
-
-
-Exit code: 1
diff --git a/acceptance/bundle/resource_deps/missing_ingestion_definition/out.deploy.txt b/acceptance/bundle/resource_deps/missing_ingestion_definition/out.deploy.txt
new file mode 100644
index 00000000000..6fec7af0183
--- /dev/null
+++ b/acceptance/bundle/resource_deps/missing_ingestion_definition/out.deploy.txt
@@ -0,0 +1,7 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created pipelines.foo
+Error: cannot create resources.pipelines.bar: cannot resolve "${resources.pipelines.foo.ingestion_definition.connection_name}": ingestion_definition: cannot access nil value
+
+Files: 4 uploaded, 0 deleted
+
+Exit code: 1
diff --git a/acceptance/bundle/resource_deps/missing_ingestion_definition/out.plan.terraform.txt b/acceptance/bundle/resource_deps/missing_ingestion_definition/out.plan.terraform.txt
deleted file mode 100644
index e603a9eb9ec..00000000000
--- a/acceptance/bundle/resource_deps/missing_ingestion_definition/out.plan.terraform.txt
+++ /dev/null
@@ -1,15 +0,0 @@
-Error: exit status 1
-
-Error: Invalid index
-
-  on bundle.tf.json line 22, in resource.databricks_pipeline.bar:
-  22:         "name": "pbar ${databricks_pipeline.foo.ingestion_definition[0].connection_name}"
-    ├────────────────
-    │ databricks_pipeline.foo.ingestion_definition is empty list of object
-
-The given key does not identify an element in this collection value: the
-collection has no elements.
-
-
-
-Exit code: 1
diff --git a/acceptance/bundle/resource_deps/missing_ingestion_definition/out.plan.direct.txt b/acceptance/bundle/resource_deps/missing_ingestion_definition/out.plan.txt
similarity index 100%
rename from acceptance/bundle/resource_deps/missing_ingestion_definition/out.plan.direct.txt
rename to acceptance/bundle/resource_deps/missing_ingestion_definition/out.plan.txt
diff --git a/acceptance/bundle/resource_deps/missing_ingestion_definition/out.test.toml b/acceptance/bundle/resource_deps/missing_ingestion_definition/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resource_deps/missing_ingestion_definition/out.test.toml
+++ b/acceptance/bundle/resource_deps/missing_ingestion_definition/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/missing_ingestion_definition/out.validate.direct.json b/acceptance/bundle/resource_deps/missing_ingestion_definition/out.validate.json
similarity index 100%
rename from acceptance/bundle/resource_deps/missing_ingestion_definition/out.validate.direct.json
rename to acceptance/bundle/resource_deps/missing_ingestion_definition/out.validate.json
diff --git a/acceptance/bundle/resource_deps/missing_ingestion_definition/out.validate.terraform.json b/acceptance/bundle/resource_deps/missing_ingestion_definition/out.validate.terraform.json
deleted file mode 100644
index 353cb4eb0d5..00000000000
--- a/acceptance/bundle/resource_deps/missing_ingestion_definition/out.validate.terraform.json
+++ /dev/null
@@ -1,20 +0,0 @@
-{
-  "bar": {
-    "channel": "CURRENT",
-    "deployment": {
-      "kind": "BUNDLE",
-      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-    },
-    "edition": "ADVANCED",
-    "name": "pbar ${resources.pipelines.foo.ingestion_definition[0].connection_name}"
-  },
-  "foo": {
-    "channel": "CURRENT",
-    "deployment": {
-      "kind": "BUNDLE",
-      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-    },
-    "edition": "ADVANCED",
-    "name": "pfoo"
-  }
-}
diff --git a/acceptance/bundle/resource_deps/missing_ingestion_definition/script b/acceptance/bundle/resource_deps/missing_ingestion_definition/script
index e6dff48b9ba..419d1552a20 100644
--- a/acceptance/bundle/resource_deps/missing_ingestion_definition/script
+++ b/acceptance/bundle/resource_deps/missing_ingestion_definition/script
@@ -1,9 +1,3 @@
-if [ "$DATABRICKS_BUNDLE_ENGINE" = "terraform" ]; then
-  grep -v "# direct engine syntax" databricks.yml > databricks.yml.tmp
-  update_file.py databricks.yml.tmp "#terraform syntax: " ""
-  mv databricks.yml.tmp databricks.yml
-fi
-
-$CLI bundle validate -o json | jq .resources.pipelines > out.validate.$DATABRICKS_BUNDLE_ENGINE.json
-errcode $CLI bundle plan &> out.plan.$DATABRICKS_BUNDLE_ENGINE.txt
-errcode $CLI bundle deploy &> out.deploy.$DATABRICKS_BUNDLE_ENGINE.txt
+$CLI bundle validate -o json | jq .resources.pipelines > out.validate.json
+errcode $CLI bundle plan &> out.plan.txt
+errcode $CLI bundle deploy &> out.deploy.txt
diff --git a/acceptance/bundle/resource_deps/missing_map_key/out.deploy.direct.txt b/acceptance/bundle/resource_deps/missing_map_key/out.deploy.direct.txt
deleted file mode 100644
index fce4ba9d5ab..00000000000
--- a/acceptance/bundle/resource_deps/missing_map_key/out.deploy.direct.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/state/default/files...
-Deploying resources...
-Error: cannot create resources.jobs.bar: cannot resolve "${resources.jobs.test.tasks[0].new_cluster.custom_tags.missing_tag}": tasks[0].new_cluster.custom_tags.missing_tag: key "missing_tag" not found in map
-
-Updating deployment state...
diff --git a/acceptance/bundle/resource_deps/missing_map_key/out.deploy.terraform.txt b/acceptance/bundle/resource_deps/missing_map_key/out.deploy.terraform.txt
deleted file mode 100644
index aa9cbb3d6aa..00000000000
--- a/acceptance/bundle/resource_deps/missing_map_key/out.deploy.terraform.txt
+++ /dev/null
@@ -1,13 +0,0 @@
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/state/default/files...
-Error: exit status 1
-
-Error: Missing map element
-
-  on bundle.tf.json line 23, in resource.databricks_job.bar:
-  23:         "name": "test ${databricks_job.test.task[0].new_cluster[0].custom_tags.missing_tag}",
-    ├────────────────
-    │ databricks_job.test.task[0].new_cluster[0].custom_tags is map of string with 1 element
-
-This map does not have an element with the key "missing_tag".
-
-
diff --git a/acceptance/bundle/resource_deps/missing_map_key/out.deploy.txt b/acceptance/bundle/resource_deps/missing_map_key/out.deploy.txt
new file mode 100644
index 00000000000..e0627d0797e
--- /dev/null
+++ b/acceptance/bundle/resource_deps/missing_map_key/out.deploy.txt
@@ -0,0 +1,5 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/state/default/files...
+Created jobs.test
+Error: cannot create resources.jobs.bar: cannot resolve "${resources.jobs.test.tasks[0].new_cluster.custom_tags.missing_tag}": tasks[0].new_cluster.custom_tags.missing_tag: key "missing_tag" not found in map
+
+Files: 4 uploaded, 0 deleted
diff --git a/acceptance/bundle/resource_deps/missing_map_key/out.plan.terraform.txt b/acceptance/bundle/resource_deps/missing_map_key/out.plan.terraform.txt
deleted file mode 100644
index 7f63edb902f..00000000000
--- a/acceptance/bundle/resource_deps/missing_map_key/out.plan.terraform.txt
+++ /dev/null
@@ -1,14 +0,0 @@
-Error: exit status 1
-
-Error: Missing map element
-
-  on bundle.tf.json line 23, in resource.databricks_job.bar:
-  23:         "name": "test ${databricks_job.test.task[0].new_cluster[0].custom_tags.missing_tag}",
-    ├────────────────
-    │ databricks_job.test.task[0].new_cluster[0].custom_tags is map of string with 1 element
-
-This map does not have an element with the key "missing_tag".
-
-
-
-Exit code: 1
diff --git a/acceptance/bundle/resource_deps/missing_map_key/out.plan.direct.txt b/acceptance/bundle/resource_deps/missing_map_key/out.plan.txt
similarity index 100%
rename from acceptance/bundle/resource_deps/missing_map_key/out.plan.direct.txt
rename to acceptance/bundle/resource_deps/missing_map_key/out.plan.txt
diff --git a/acceptance/bundle/resource_deps/missing_map_key/out.test.toml b/acceptance/bundle/resource_deps/missing_map_key/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resource_deps/missing_map_key/out.test.toml
+++ b/acceptance/bundle/resource_deps/missing_map_key/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/missing_map_key/out.validate.direct.json b/acceptance/bundle/resource_deps/missing_map_key/out.validate.json
similarity index 100%
rename from acceptance/bundle/resource_deps/missing_map_key/out.validate.direct.json
rename to acceptance/bundle/resource_deps/missing_map_key/out.validate.json
diff --git a/acceptance/bundle/resource_deps/missing_map_key/out.validate.terraform.json b/acceptance/bundle/resource_deps/missing_map_key/out.validate.terraform.json
deleted file mode 100644
index 3cdf58f84ea..00000000000
--- a/acceptance/bundle/resource_deps/missing_map_key/out.validate.terraform.json
+++ /dev/null
@@ -1,40 +0,0 @@
-{
-  "jobs": {
-    "bar": {
-      "deployment": {
-        "kind": "BUNDLE",
-        "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/state/default/state/metadata.json"
-      },
-      "edit_mode": "UI_LOCKED",
-      "format": "MULTI_TASK",
-      "max_concurrent_runs": 1,
-      "name": "test ${resources.jobs.test.task[0].new_cluster[0].custom_tags.missing_tag}",
-      "queue": {
-        "enabled": true
-      }
-    },
-    "test": {
-      "deployment": {
-        "kind": "BUNDLE",
-        "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/state/default/state/metadata.json"
-      },
-      "edit_mode": "UI_LOCKED",
-      "format": "MULTI_TASK",
-      "max_concurrent_runs": 1,
-      "name": "test",
-      "queue": {
-        "enabled": true
-      },
-      "tasks": [
-        {
-          "new_cluster": {
-            "custom_tags": {
-              "ResourceClass": "SingleNode"
-            }
-          },
-          "task_key": "test-task"
-        }
-      ]
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/missing_map_key/script b/acceptance/bundle/resource_deps/missing_map_key/script
index 408972edc3e..63cc9f67f4a 100644
--- a/acceptance/bundle/resource_deps/missing_map_key/script
+++ b/acceptance/bundle/resource_deps/missing_map_key/script
@@ -1,9 +1,3 @@
-if [ "$DATABRICKS_BUNDLE_ENGINE" = "terraform" ]; then
-  grep -v "# direct engine syntax" databricks.yml > databricks.yml.tmp
-  update_file.py databricks.yml.tmp "#terraform syntax: " ""
-  mv databricks.yml.tmp databricks.yml
-fi
-
-trace $CLI bundle validate -o json | jq .resources > out.validate.$DATABRICKS_BUNDLE_ENGINE.json
-errcode $CLI bundle plan &> out.plan.$DATABRICKS_BUNDLE_ENGINE.txt
-musterr $CLI bundle deploy &> out.deploy.$DATABRICKS_BUNDLE_ENGINE.txt
+trace $CLI bundle validate -o json | jq .resources > out.validate.json
+errcode $CLI bundle plan &> out.plan.txt
+musterr $CLI bundle deploy &> out.deploy.txt
diff --git a/acceptance/bundle/resource_deps/missing_string_field/out.test.toml b/acceptance/bundle/resource_deps/missing_string_field/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resource_deps/missing_string_field/out.test.toml
+++ b/acceptance/bundle/resource_deps/missing_string_field/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/missing_string_field/output.txt b/acceptance/bundle/resource_deps/missing_string_field/output.txt
index 83bf6f7168d..a9c947d8f4b 100644
--- a/acceptance/bundle/resource_deps/missing_string_field/output.txt
+++ b/acceptance/bundle/resource_deps/missing_string_field/output.txt
@@ -28,15 +28,16 @@ create pipelines.foo
 
 Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
 
->>> print_requests.py //pipeline
+>>> print_requests.py --nostamp //pipeline
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created pipelines.bar
+Created pipelines.foo
+Files: 1 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
->>> print_requests.py //pipeline
+>>> print_requests.py --nostamp //pipeline
 {
   "method": "POST",
   "path": "/api/2.0/pipelines",
diff --git a/acceptance/bundle/resource_deps/missing_string_field/script b/acceptance/bundle/resource_deps/missing_string_field/script
index a234d07b080..c526e980444 100644
--- a/acceptance/bundle/resource_deps/missing_string_field/script
+++ b/acceptance/bundle/resource_deps/missing_string_field/script
@@ -1,6 +1,6 @@
-trace $CLI bundle validate -o json | jq .resources
+trace $CLI bundle validate -o json | nostamp | jq .resources
 errcode $CLI bundle plan
-trace print_requests.py //pipeline
+trace print_requests.py --nostamp //pipeline
 
 trace $CLI bundle deploy
-trace print_requests.py //pipeline
+trace print_requests.py --nostamp //pipeline
diff --git a/acceptance/bundle/resource_deps/model_id_ref/databricks.yml b/acceptance/bundle/resource_deps/model_id_ref/databricks.yml
new file mode 100644
index 00000000000..7dedadc6432
--- /dev/null
+++ b/acceptance/bundle/resource_deps/model_id_ref/databricks.yml
@@ -0,0 +1,16 @@
+bundle:
+  name: test-bundle
+
+# A model's numeric ID is named registered_model_id in Terraform state and model_id in
+# direct state. terraform_dabs_map bridges the two names, so a reference to
+# registered_model_id resolves on both engines.
+resources:
+  models:
+    my_model:
+      name: my-model
+      description: my model
+
+  jobs:
+    consumer:
+      name: consumer
+      description: model id is ${resources.models.my_model.registered_model_id}
diff --git a/acceptance/bundle/resource_deps/model_id_ref/out.test.toml b/acceptance/bundle/resource_deps/model_id_ref/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resource_deps/model_id_ref/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/model_id_ref/output.txt b/acceptance/bundle/resource_deps/model_id_ref/output.txt
new file mode 100644
index 00000000000..ccbb4932369
--- /dev/null
+++ b/acceptance/bundle/resource_deps/model_id_ref/output.txt
@@ -0,0 +1,43 @@
+
+=== the consumer job implicitly depends on the model
+>>> [CLI] bundle plan
+create jobs.consumer
+create models.my_model
+
+Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
+
+=== after deploy, registered_model_id is resolved to the model's numeric id
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created jobs.consumer
+Created models.my_model
+Files: 1 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py --nostamp //mlflow/registered-models/create //jobs/create --sort
+{
+  "method": "POST",
+  "path": "/api/2.0/mlflow/registered-models/create",
+  "body": {
+    "description": "my model",
+    "name": "my-model"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/create",
+  "body": {
+    "deployment": {
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+    },
+    "description": "model id is [MY_MODEL_ID]",
+    "edit_mode": "UI_LOCKED",
+    "format": "MULTI_TASK",
+    "max_concurrent_runs": 1,
+    "name": "consumer",
+    "queue": {
+      "enabled": true
+    }
+  }
+}
diff --git a/acceptance/bundle/resource_deps/model_id_ref/script b/acceptance/bundle/resource_deps/model_id_ref/script
new file mode 100644
index 00000000000..3e2a1811b72
--- /dev/null
+++ b/acceptance/bundle/resource_deps/model_id_ref/script
@@ -0,0 +1,13 @@
+title "the consumer job implicitly depends on the model"
+trace $CLI bundle plan
+
+title "after deploy, registered_model_id is resolved to the model's numeric id"
+trace $CLI bundle deploy
+
+# Bind the model's exact numeric id to [MY_MODEL_ID] so the resolved reference is matched
+# precisely. The id comes from the API (independent
+# of the deploy engine), so terraform and direct must both resolve to this exact value.
+model_id=$($CLI model-registry get-model my-model | jq -r '.registered_model_databricks.id')
+add_repl "$model_id" MY_MODEL_ID
+
+trace print_requests.py --nostamp //mlflow/registered-models/create //jobs/create --sort
diff --git a/acceptance/bundle/resource_deps/non_existent_field/out.deploy.direct.txt b/acceptance/bundle/resource_deps/non_existent_field/out.deploy.direct.txt
deleted file mode 100644
index 841f33c1d2f..00000000000
--- a/acceptance/bundle/resource_deps/non_existent_field/out.deploy.direct.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Error: cannot plan resources.volumes.foo: cannot resolve "${resources.volumes.bar.non_existent}": schema mismatch: non_existent: field "non_existent" not found in catalog.CreateVolumeRequestContent; non_existent: field "non_existent" not found in catalog.VolumeInfo
-
-Error: planning failed
-
diff --git a/acceptance/bundle/resource_deps/non_existent_field/out.deploy.terraform.txt b/acceptance/bundle/resource_deps/non_existent_field/out.deploy.terraform.txt
deleted file mode 100644
index f8f7c004ba5..00000000000
--- a/acceptance/bundle/resource_deps/non_existent_field/out.deploy.terraform.txt
+++ /dev/null
@@ -1,12 +0,0 @@
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Error: exit status 1
-
-Error: Unsupported attribute
-
-  on bundle.tf.json line 22, in resource.databricks_volume.foo:
-  22:         "catalog_name": "${databricks_volume.bar.non_existent}",
-
-This object has no argument, nested block, or exported attribute named
-"non_existent".
-
-
diff --git a/acceptance/bundle/resource_deps/non_existent_field/out.deploy.txt b/acceptance/bundle/resource_deps/non_existent_field/out.deploy.txt
new file mode 100644
index 00000000000..8da224f9751
--- /dev/null
+++ b/acceptance/bundle/resource_deps/non_existent_field/out.deploy.txt
@@ -0,0 +1,6 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Error: cannot plan resources.volumes.foo: cannot resolve "${resources.volumes.bar.non_existent}": schema mismatch: non_existent: field "non_existent" not found in catalog.CreateVolumeRequestContent; non_existent: field "non_existent" not found in catalog.VolumeInfo
+
+Error: planning failed
+
+Files: 3 uploaded, 0 deleted
diff --git a/acceptance/bundle/resource_deps/non_existent_field/out.plan.terraform.txt b/acceptance/bundle/resource_deps/non_existent_field/out.plan.terraform.txt
deleted file mode 100644
index 4df0c4bcd61..00000000000
--- a/acceptance/bundle/resource_deps/non_existent_field/out.plan.terraform.txt
+++ /dev/null
@@ -1,11 +0,0 @@
-Error: exit status 1
-
-Error: Unsupported attribute
-
-  on bundle.tf.json line 22, in resource.databricks_volume.foo:
-  22:         "catalog_name": "${databricks_volume.bar.non_existent}",
-
-This object has no argument, nested block, or exported attribute named
-"non_existent".
-
-
diff --git a/acceptance/bundle/resource_deps/non_existent_field/out.plan.direct.txt b/acceptance/bundle/resource_deps/non_existent_field/out.plan.txt
similarity index 100%
rename from acceptance/bundle/resource_deps/non_existent_field/out.plan.direct.txt
rename to acceptance/bundle/resource_deps/non_existent_field/out.plan.txt
diff --git a/acceptance/bundle/resource_deps/non_existent_field/out.test.toml b/acceptance/bundle/resource_deps/non_existent_field/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resource_deps/non_existent_field/out.test.toml
+++ b/acceptance/bundle/resource_deps/non_existent_field/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/non_existent_field/output.txt b/acceptance/bundle/resource_deps/non_existent_field/output.txt
index ec7de848680..09d3f03d6d7 100644
--- a/acceptance/bundle/resource_deps/non_existent_field/output.txt
+++ b/acceptance/bundle/resource_deps/non_existent_field/output.txt
@@ -6,12 +6,14 @@
       "catalog_name": "mycatalog",
       "name": "barname",
       "schema_name": "myschema",
+      "volume_path": "/Volumes/mycatalog/myschema/barname",
       "volume_type": "MANAGED"
     },
     "foo": {
       "catalog_name": "${resources.volumes.bar.non_existent}",
       "name": "myname",
       "schema_name": "${resources.volumes.bar.schema_name}",
+      "volume_path": "/Volumes/${resources.volumes.bar.non_existent}/myschema/myname",
       "volume_type": "MANAGED"
     }
   }
diff --git a/acceptance/bundle/resource_deps/non_existent_field/script b/acceptance/bundle/resource_deps/non_existent_field/script
index 8ea06b0c199..1826f00396a 100644
--- a/acceptance/bundle/resource_deps/non_existent_field/script
+++ b/acceptance/bundle/resource_deps/non_existent_field/script
@@ -1,3 +1,3 @@
 trace $CLI bundle validate -o json | jq .resources
-musterr $CLI bundle plan &> out.plan.$DATABRICKS_BUNDLE_ENGINE.txt
-musterr $CLI bundle deploy &> out.deploy.$DATABRICKS_BUNDLE_ENGINE.txt
+musterr $CLI bundle plan &> out.plan.txt
+musterr $CLI bundle deploy &> out.deploy.txt
diff --git a/acceptance/bundle/resource_deps/permission_ref/out.plan_create.direct.json b/acceptance/bundle/resource_deps/permission_ref/out.plan_create.direct.json
deleted file mode 100644
index a21f8ea9017..00000000000
--- a/acceptance/bundle/resource_deps/permission_ref/out.plan_create.direct.json
+++ /dev/null
@@ -1,112 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.job_a": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "job A",
-          "queue": {
-            "enabled": true
-          }
-        }
-      }
-    },
-    "resources.jobs.job_a.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.job_a",
-          "label": "${resources.jobs.job_a.id}"
-        },
-        {
-          "node": "resources.jobs.job_b.permissions",
-          "label": "${resources.jobs.job_b.permissions[0].level}"
-        },
-        {
-          "node": "resources.jobs.job_b.permissions",
-          "label": "${resources.jobs.job_b.permissions[1].level}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "CAN_VIEW",
-              "group_name": "team-alpha"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "group_name": "team-beta"
-            },
-            {
-              "level": "IS_OWNER",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/jobs/${resources.jobs.job_a.id}"
-        }
-      }
-    },
-    "resources.jobs.job_b": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "job B",
-          "queue": {
-            "enabled": true
-          }
-        }
-      }
-    },
-    "resources.jobs.job_b.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.job_b",
-          "label": "${resources.jobs.job_b.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "CAN_VIEW",
-              "group_name": "viewers"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "group_name": "admins"
-            },
-            {
-              "level": "IS_OWNER",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/jobs/${resources.jobs.job_b.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/permission_ref/out.plan_create.json b/acceptance/bundle/resource_deps/permission_ref/out.plan_create.json
new file mode 100644
index 00000000000..37891be49e1
--- /dev/null
+++ b/acceptance/bundle/resource_deps/permission_ref/out.plan_create.json
@@ -0,0 +1,112 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.jobs.job_a": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "job A",
+          "queue": {
+            "enabled": true
+          }
+        }
+      }
+    },
+    "resources.jobs.job_a.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.job_a",
+          "label": "${resources.jobs.job_a.id}"
+        },
+        {
+          "node": "resources.jobs.job_b.permissions",
+          "label": "${resources.jobs.job_b.permissions[0].level}"
+        },
+        {
+          "node": "resources.jobs.job_b.permissions",
+          "label": "${resources.jobs.job_b.permissions[1].level}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "CAN_VIEW",
+              "group_name": "team-alpha"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "group_name": "team-beta"
+            },
+            {
+              "level": "IS_OWNER",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/jobs/${resources.jobs.job_a.id}"
+        }
+      }
+    },
+    "resources.jobs.job_b": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "job B",
+          "queue": {
+            "enabled": true
+          }
+        }
+      }
+    },
+    "resources.jobs.job_b.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.job_b",
+          "label": "${resources.jobs.job_b.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "CAN_VIEW",
+              "group_name": "viewers"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "group_name": "admins"
+            },
+            {
+              "level": "IS_OWNER",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/jobs/${resources.jobs.job_b.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resource_deps/permission_ref/out.test.toml b/acceptance/bundle/resource_deps/permission_ref/out.test.toml
index e90b6d5d1ba..a927a5fbc06 100644
--- a/acceptance/bundle/resource_deps/permission_ref/out.test.toml
+++ b/acceptance/bundle/resource_deps/permission_ref/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/permission_ref/output.txt b/acceptance/bundle/resource_deps/permission_ref/output.txt
index f6c17f880b9..1f45e18deb9 100644
--- a/acceptance/bundle/resource_deps/permission_ref/output.txt
+++ b/acceptance/bundle/resource_deps/permission_ref/output.txt
@@ -11,6 +11,9 @@ Plan: 4 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.job_a
+Created jobs.job_a.permissions
+Created jobs.job_b
+Created jobs.job_b.permissions
+Files: 2 uploaded, 0 deleted
+Resources: 4 created, 0 changed, 0 deleted, 0 unchanged
diff --git a/acceptance/bundle/resource_deps/permission_ref/script b/acceptance/bundle/resource_deps/permission_ref/script
index 82800b1654e..edaa505906d 100644
--- a/acceptance/bundle/resource_deps/permission_ref/script
+++ b/acceptance/bundle/resource_deps/permission_ref/script
@@ -1,4 +1,4 @@
 
 trace $CLI bundle plan
-trace $CLI bundle plan -o json > out.plan_create.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.plan_create.json
 trace $CLI bundle deploy
diff --git a/acceptance/bundle/resource_deps/permission_ref/test.toml b/acceptance/bundle/resource_deps/permission_ref/test.toml
index 790c13e6dc6..a030353d571 100644
--- a/acceptance/bundle/resource_deps/permission_ref/test.toml
+++ b/acceptance/bundle/resource_deps/permission_ref/test.toml
@@ -1,4 +1 @@
 RecordRequests = false
-
-[EnvMatrix]
-DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/resource_deps/pipelines_recreate/out.plan_create.direct.json b/acceptance/bundle/resource_deps/pipelines_recreate/out.plan_create.direct.json
deleted file mode 100644
index 89664e569a3..00000000000
--- a/acceptance/bundle/resource_deps/pipelines_recreate/out.plan_create.direct.json
+++ /dev/null
@@ -1,49 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.bar": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.foo",
-          "label": "${resources.pipelines.foo.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "description": "depends on foo id ${resources.pipelines.foo.id}",
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "job bar",
-          "queue": {
-            "enabled": true
-          }
-        },
-        "vars": {
-          "description": "depends on foo id ${resources.pipelines.foo.id}"
-        }
-      }
-    },
-    "resources.pipelines.foo": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "channel": "CURRENT",
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "edition": "ADVANCED",
-          "name": "pipeline foo",
-          "storage": "dbfs:/my-storage"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/pipelines_recreate/out.plan_create.json b/acceptance/bundle/resource_deps/pipelines_recreate/out.plan_create.json
new file mode 100644
index 00000000000..696b2272acd
--- /dev/null
+++ b/acceptance/bundle/resource_deps/pipelines_recreate/out.plan_create.json
@@ -0,0 +1,49 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.jobs.bar": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.foo",
+          "label": "${resources.pipelines.foo.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "description": "depends on foo id ${resources.pipelines.foo.id}",
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "job bar",
+          "queue": {
+            "enabled": true
+          }
+        },
+        "vars": {
+          "description": "depends on foo id ${resources.pipelines.foo.id}"
+        }
+      }
+    },
+    "resources.pipelines.foo": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "channel": "CURRENT",
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edition": "ADVANCED",
+          "name": "pipeline foo",
+          "storage": "dbfs:/my-storage"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resource_deps/pipelines_recreate/out.plan_create.terraform.json b/acceptance/bundle/resource_deps/pipelines_recreate/out.plan_create.terraform.json
deleted file mode 100644
index 0bf437419f3..00000000000
--- a/acceptance/bundle/resource_deps/pipelines_recreate/out.plan_create.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.bar": {
-      "action": "create"
-    },
-    "resources.pipelines.foo": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/pipelines_recreate/out.plan_noop.direct.json b/acceptance/bundle/resource_deps/pipelines_recreate/out.plan_noop.direct.json
deleted file mode 100644
index c05b54ab2b1..00000000000
--- a/acceptance/bundle/resource_deps/pipelines_recreate/out.plan_noop.direct.json
+++ /dev/null
@@ -1,75 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 2,
-  "plan": {
-    "resources.jobs.bar": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.foo",
-          "label": "${resources.pipelines.foo.id}"
-        }
-      ],
-      "action": "skip",
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS][0],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-        },
-        "description": "depends on foo id [FOO_ID_2]",
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_id": [BAR_ID],
-        "max_concurrent_runs": 1,
-        "name": "job bar",
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "timeout_seconds": 0,
-        "webhook_notifications": {}
-      },
-      "changes": {
-        "email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "webhook_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        }
-      }
-    },
-    "resources.pipelines.foo": {
-      "action": "skip",
-      "remote_state": {
-        "channel": "CURRENT",
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-        },
-        "edition": "ADVANCED",
-        "effective_publishing_mode": "DEFAULT_PUBLISHING_MODE",
-        "id": "[FOO_ID_2]",
-        "last_modified": [UNIX_TIME_MILLIS][1],
-        "name": "pipeline foo",
-        "pipeline_id": "[FOO_ID_2]",
-        "run_as_user_name": "[USERNAME]",
-        "state": "IDLE",
-        "storage": "dbfs:/my-new-storage"
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/pipelines_recreate/out.plan_noop.json b/acceptance/bundle/resource_deps/pipelines_recreate/out.plan_noop.json
new file mode 100644
index 00000000000..ab330c5e467
--- /dev/null
+++ b/acceptance/bundle/resource_deps/pipelines_recreate/out.plan_noop.json
@@ -0,0 +1,75 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 2,
+  "plan": {
+    "resources.jobs.bar": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.foo",
+          "label": "${resources.pipelines.foo.id}"
+        }
+      ],
+      "action": "skip",
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS][0],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "description": "depends on foo id [FOO_ID_2]",
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_id": [BAR_ID],
+        "max_concurrent_runs": 1,
+        "name": "job bar",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "timeout_seconds": 0,
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    },
+    "resources.pipelines.foo": {
+      "action": "skip",
+      "remote_state": {
+        "channel": "CURRENT",
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "edition": "ADVANCED",
+        "effective_publishing_mode": "DEFAULT_PUBLISHING_MODE",
+        "id": "[FOO_ID_2]",
+        "last_modified": [UNIX_TIME_MILLIS][1],
+        "name": "pipeline foo",
+        "pipeline_id": "[FOO_ID_2]",
+        "run_as_user_name": "[USERNAME]",
+        "state": "IDLE",
+        "storage": "dbfs:/my-new-storage"
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resource_deps/pipelines_recreate/out.plan_noop.terraform.json b/acceptance/bundle/resource_deps/pipelines_recreate/out.plan_noop.terraform.json
deleted file mode 100644
index 890fc98e089..00000000000
--- a/acceptance/bundle/resource_deps/pipelines_recreate/out.plan_noop.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.bar": {
-      "action": "skip"
-    },
-    "resources.pipelines.foo": {
-      "action": "skip"
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/pipelines_recreate/out.plan_update.direct.json b/acceptance/bundle/resource_deps/pipelines_recreate/out.plan_update.direct.json
deleted file mode 100644
index b23e7bb54be..00000000000
--- a/acceptance/bundle/resource_deps/pipelines_recreate/out.plan_update.direct.json
+++ /dev/null
@@ -1,121 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.jobs.bar": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.foo",
-          "label": "${resources.pipelines.foo.id}"
-        }
-      ],
-      "action": "update",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "description": "depends on foo id ${resources.pipelines.foo.id}",
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "job bar",
-          "queue": {
-            "enabled": true
-          }
-        },
-        "vars": {
-          "description": "depends on foo id ${resources.pipelines.foo.id}"
-        }
-      },
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS][0],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-        },
-        "description": "depends on foo id [FOO_ID]",
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_id": [BAR_ID],
-        "max_concurrent_runs": 1,
-        "name": "job bar",
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "timeout_seconds": 0,
-        "webhook_notifications": {}
-      },
-      "changes": {
-        "description": {
-          "action": "update",
-          "old": "depends on foo id [FOO_ID]",
-          "new": "depends on foo id ${resources.pipelines.foo.id}",
-          "remote": "depends on foo id [FOO_ID]"
-        },
-        "email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "webhook_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        }
-      }
-    },
-    "resources.pipelines.foo": {
-      "action": "recreate",
-      "new_state": {
-        "value": {
-          "channel": "CURRENT",
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "edition": "ADVANCED",
-          "name": "pipeline foo",
-          "storage": "dbfs:/my-new-storage"
-        }
-      },
-      "remote_state": {
-        "channel": "CURRENT",
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-        },
-        "edition": "ADVANCED",
-        "effective_publishing_mode": "DEFAULT_PUBLISHING_MODE",
-        "id": "[FOO_ID]",
-        "last_modified": [UNIX_TIME_MILLIS][1],
-        "name": "pipeline foo",
-        "pipeline_id": "[FOO_ID]",
-        "run_as_user_name": "[USERNAME]",
-        "state": "IDLE",
-        "storage": "dbfs:/my-storage"
-      },
-      "changes": {
-        "storage": {
-          "action": "recreate",
-          "reason": "immutable",
-          "old": "dbfs:/my-storage",
-          "new": "dbfs:/my-new-storage",
-          "remote": "dbfs:/my-storage"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/pipelines_recreate/out.plan_update.json b/acceptance/bundle/resource_deps/pipelines_recreate/out.plan_update.json
new file mode 100644
index 00000000000..86b6c325aee
--- /dev/null
+++ b/acceptance/bundle/resource_deps/pipelines_recreate/out.plan_update.json
@@ -0,0 +1,121 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.jobs.bar": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.foo",
+          "label": "${resources.pipelines.foo.id}"
+        }
+      ],
+      "action": "update",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "description": "depends on foo id ${resources.pipelines.foo.id}",
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "job bar",
+          "queue": {
+            "enabled": true
+          }
+        },
+        "vars": {
+          "description": "depends on foo id ${resources.pipelines.foo.id}"
+        }
+      },
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS][0],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "description": "depends on foo id [FOO_ID]",
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_id": [BAR_ID],
+        "max_concurrent_runs": 1,
+        "name": "job bar",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "timeout_seconds": 0,
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "description": {
+          "action": "update",
+          "old": "depends on foo id [FOO_ID]",
+          "new": "depends on foo id ${resources.pipelines.foo.id}",
+          "remote": "depends on foo id [FOO_ID]"
+        },
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    },
+    "resources.pipelines.foo": {
+      "action": "recreate",
+      "new_state": {
+        "value": {
+          "channel": "CURRENT",
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edition": "ADVANCED",
+          "name": "pipeline foo",
+          "storage": "dbfs:/my-new-storage"
+        }
+      },
+      "remote_state": {
+        "channel": "CURRENT",
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "edition": "ADVANCED",
+        "effective_publishing_mode": "DEFAULT_PUBLISHING_MODE",
+        "id": "[FOO_ID]",
+        "last_modified": [UNIX_TIME_MILLIS][1],
+        "name": "pipeline foo",
+        "pipeline_id": "[FOO_ID]",
+        "run_as_user_name": "[USERNAME]",
+        "state": "IDLE",
+        "storage": "dbfs:/my-storage"
+      },
+      "changes": {
+        "storage": {
+          "action": "recreate",
+          "reason": "immutable",
+          "old": "dbfs:/my-storage",
+          "new": "dbfs:/my-new-storage",
+          "remote": "dbfs:/my-storage"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resource_deps/pipelines_recreate/out.plan_update.terraform.json b/acceptance/bundle/resource_deps/pipelines_recreate/out.plan_update.terraform.json
deleted file mode 100644
index e30ab09b070..00000000000
--- a/acceptance/bundle/resource_deps/pipelines_recreate/out.plan_update.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.bar": {
-      "action": "update"
-    },
-    "resources.pipelines.foo": {
-      "action": "recreate"
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/pipelines_recreate/out.test.toml b/acceptance/bundle/resource_deps/pipelines_recreate/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resource_deps/pipelines_recreate/out.test.toml
+++ b/acceptance/bundle/resource_deps/pipelines_recreate/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/pipelines_recreate/out.update.requests.direct.json b/acceptance/bundle/resource_deps/pipelines_recreate/out.update.requests.json
similarity index 100%
rename from acceptance/bundle/resource_deps/pipelines_recreate/out.update.requests.direct.json
rename to acceptance/bundle/resource_deps/pipelines_recreate/out.update.requests.json
diff --git a/acceptance/bundle/resource_deps/pipelines_recreate/out.update.requests.terraform.json b/acceptance/bundle/resource_deps/pipelines_recreate/out.update.requests.terraform.json
deleted file mode 100644
index 972862518f2..00000000000
--- a/acceptance/bundle/resource_deps/pipelines_recreate/out.update.requests.terraform.json
+++ /dev/null
@@ -1,44 +0,0 @@
-{
-  "method": "DELETE",
-  "path": "/api/2.0/pipelines/[FOO_ID]"
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/pipelines",
-  "body": {
-    "channel": "CURRENT",
-    "deployment": {
-      "kind": "BUNDLE",
-      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-    },
-    "edition": "ADVANCED",
-    "name": "pipeline foo",
-    "storage": "dbfs:/my-new-storage"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.2/jobs/reset",
-  "body": {
-    "job_id": [BAR_ID],
-    "new_settings": {
-      "deployment": {
-        "kind": "BUNDLE",
-        "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-      },
-      "description": "depends on foo id [FOO_ID_2]",
-      "edit_mode": "UI_LOCKED",
-      "email_notifications": {},
-      "format": "MULTI_TASK",
-      "max_concurrent_runs": 1,
-      "name": "job bar",
-      "queue": {
-        "enabled": true
-      },
-      "run_as": {
-        "user_name": "[USERNAME]"
-      },
-      "webhook_notifications": {}
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/pipelines_recreate/output.txt b/acceptance/bundle/resource_deps/pipelines_recreate/output.txt
index 4bd50ca8a96..4ab49471753 100644
--- a/acceptance/bundle/resource_deps/pipelines_recreate/output.txt
+++ b/acceptance/bundle/resource_deps/pipelines_recreate/output.txt
@@ -7,11 +7,12 @@ Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.bar
+Created pipelines.foo
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
->>> print_requests.py //jobs //pipelines
+>>> print_requests.py --nostamp //jobs //pipelines ^//api/2.0/bundle
 
 >>> [CLI] bundle plan
 Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
@@ -33,11 +34,12 @@ Streaming Tables (STs) and Materialized Views (MVs) managed by them. Recreating
 restore the defined STs and MVs through full refresh. Note that recreation is necessary when pipeline
 properties such as the 'catalog' or 'storage' are changed:
   recreate resources.pipelines.foo
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Recreated pipelines.foo
+Updated jobs.bar
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 1 changed, 1 deleted, 0 unchanged
 
->>> print_requests.py //jobs //pipelines
+>>> print_requests.py --nostamp //jobs //pipelines ^//api/2.0/bundle
 
 === Fetch resource IDs and verify remote state
 >>> musterr [CLI] pipelines get [FOO_ID]
@@ -96,11 +98,10 @@ Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 2 unchanged
 
->>> print_requests.py //jobs //pipelines
+>>> print_requests.py --nostamp //jobs //pipelines ^//api/2.0/bundle
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
@@ -108,15 +109,14 @@ The following resources will be deleted:
   delete resources.pipelines.foo
 
 This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
-Streaming Tables (STs) and Materialized Views (MVs) managed by them:
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:
   delete resources.pipelines.foo
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 2 deleted
 
->>> print_requests.py //jobs //pipelines
+>>> print_requests.py --nostamp //jobs //pipelines ^//api/2.0/bundle
 {
   "method": "POST",
   "path": "/api/2.2/jobs/delete",
@@ -136,4 +136,4 @@ Error: The specified pipeline [FOO_ID] was not found.
 Error: The specified pipeline [FOO_ID_2] was not found.
 
 >>> musterr [CLI] jobs get [BAR_ID]
-Error: Not Found
+Error: Job [BAR_ID] does not exist.
diff --git a/acceptance/bundle/resource_deps/pipelines_recreate/script b/acceptance/bundle/resource_deps/pipelines_recreate/script
index 1a06b13bc24..acfb13cddec 100644
--- a/acceptance/bundle/resource_deps/pipelines_recreate/script
+++ b/acceptance/bundle/resource_deps/pipelines_recreate/script
@@ -1,9 +1,8 @@
 
-echo "*" > .gitignore
 trace $CLI bundle plan
-$CLI bundle plan -o json > out.plan_create.$DATABRICKS_BUNDLE_ENGINE.json
+$CLI bundle plan -o json | nostamp > out.plan_create.json
 trace $CLI bundle deploy
-trace print_requests.py //jobs //pipelines > out.create.requests.json
+trace print_requests.py --nostamp //jobs //pipelines '^//api/2.0/bundle' > out.create.requests.json
 
 foo_id=`read_id.py foo`
 
@@ -14,29 +13,29 @@ trace $CLI bundle plan  # empty
 title "Update storage, triggering recreate for pipeline; this means updating downstream deps"
 trace update_file.py databricks.yml "storage: dbfs:/my-storage" "storage: dbfs:/my-new-storage"
 trace $CLI bundle plan
-$CLI bundle plan -o json > out.plan_update.$DATABRICKS_BUNDLE_ENGINE.json
+$CLI bundle plan -o json | nostamp > out.plan_update.json
 trace $CLI bundle deploy --auto-approve
-trace print_requests.py //jobs //pipelines > out.update.requests.$DATABRICKS_BUNDLE_ENGINE.json
+trace print_requests.py --nostamp //jobs //pipelines '^//api/2.0/bundle' > out.update.requests.json
 
 foo_id_2=`read_id.py foo`
 
 title "Fetch resource IDs and verify remote state"
 
 trace musterr $CLI pipelines get $foo_id
-trace $CLI pipelines get $foo_id_2
-trace $CLI jobs get $bar_id | jq 'del(.settings.run_as)'
-rm out.requests.txt
+trace $CLI pipelines get $foo_id_2 | nostamp
+trace $CLI jobs get $bar_id | nostamp| jq 'del(.settings.run_as)'
+rm "$OUT_REQUESTS"
 
 title "Follow up plan & deploy do nothing"
 trace $CLI bundle plan
-$CLI bundle plan -o json > out.plan_noop.$DATABRICKS_BUNDLE_ENGINE.json
+$CLI bundle plan -o json | nostamp > out.plan_noop.json
 trace $CLI bundle deploy
-trace print_requests.py //jobs //pipelines
+trace print_requests.py --nostamp //jobs //pipelines '^//api/2.0/bundle'
 
 trace $CLI bundle destroy --auto-approve
-trace print_requests.py //jobs //pipelines
+trace print_requests.py --nostamp //jobs //pipelines '^//api/2.0/bundle'
 
 trace musterr $CLI pipelines get $foo_id
 trace musterr $CLI pipelines get $foo_id_2
 trace musterr $CLI jobs get $bar_id
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/resource_deps/present_ingestion_definition/out.plan.terraform.txt b/acceptance/bundle/resource_deps/present_ingestion_definition/out.plan.terraform.txt
deleted file mode 100644
index d084d3dd3a0..00000000000
--- a/acceptance/bundle/resource_deps/present_ingestion_definition/out.plan.terraform.txt
+++ /dev/null
@@ -1,13 +0,0 @@
-Error: exit status 1
-
-Error: Invalid operation
-
-  on bundle.tf.json line 22, in resource.databricks_pipeline.bar:
-  22:         "name": "pbar ${databricks_pipeline.foo.ingestion_definition.connection_name}"
-
-Block type "ingestion_definition" is represented by a list of objects, so it
-must be indexed using a numeric key, like .ingestion_definition[0].
-
-
-
-Exit code: 1
diff --git a/acceptance/bundle/resource_deps/present_ingestion_definition/out.plan.direct.txt b/acceptance/bundle/resource_deps/present_ingestion_definition/out.plan.txt
similarity index 100%
rename from acceptance/bundle/resource_deps/present_ingestion_definition/out.plan.direct.txt
rename to acceptance/bundle/resource_deps/present_ingestion_definition/out.plan.txt
diff --git a/acceptance/bundle/resource_deps/present_ingestion_definition/out.test.toml b/acceptance/bundle/resource_deps/present_ingestion_definition/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resource_deps/present_ingestion_definition/out.test.toml
+++ b/acceptance/bundle/resource_deps/present_ingestion_definition/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/present_ingestion_definition/script b/acceptance/bundle/resource_deps/present_ingestion_definition/script
index d12526234d0..22c47632357 100644
--- a/acceptance/bundle/resource_deps/present_ingestion_definition/script
+++ b/acceptance/bundle/resource_deps/present_ingestion_definition/script
@@ -1,2 +1,2 @@
 $CLI bundle validate -o json | jq .resources.pipelines.bar.name
-errcode $CLI bundle plan &> out.plan.$DATABRICKS_BUNDLE_ENGINE.txt
+errcode $CLI bundle plan &> out.plan.txt
diff --git a/acceptance/bundle/resource_deps/remote_app_url/out.test.toml b/acceptance/bundle/resource_deps/remote_app_url/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resource_deps/remote_app_url/out.test.toml
+++ b/acceptance/bundle/resource_deps/remote_app_url/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/remote_app_url/output.txt b/acceptance/bundle/resource_deps/remote_app_url/output.txt
index 81b300ab11f..503055861e5 100644
--- a/acceptance/bundle/resource_deps/remote_app_url/output.txt
+++ b/acceptance/bundle/resource_deps/remote_app_url/output.txt
@@ -1,12 +1,16 @@
 
 >>> [CLI] bundle validate
+Warning: There are no files to sync, please check your .gitignore and sync.exclude configuration
+  at sync.exclude
+  in databricks.yml:6:5
+
 Name: test-bundle
 Target: default
 Workspace:
   User: [USERNAME]
   Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Validation OK!
+Found 1 warning
 
 >>> [CLI] bundle plan
 create apps.myapp
@@ -14,7 +18,7 @@ create pipelines.mypipeline
 
 Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
 
->>> print_requests.py ^//import-file/
+>>> print_requests.py --nostamp ^//workspace/import ^//api/2.0/bundle
 {
   "method": "POST",
   "path": "/api/2.0/workspace/mkdirs",
@@ -25,11 +29,19 @@ Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created apps.myapp
+Created pipelines.mypipeline
+Files: 0 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
->>> print_requests.py ^//import-file/
+>>> print_requests.py --nostamp ^//workspace/import ^//api/2.0/bundle
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state"
+  }
+}
 {
   "method": "POST",
   "path": "/api/2.0/workspace/delete",
@@ -83,15 +95,14 @@ The following resources will be deleted:
   delete resources.pipelines.mypipeline
 
 This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
-Streaming Tables (STs) and Materialized Views (MVs) managed by them:
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:
   delete resources.pipelines.mypipeline
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 2 deleted
 
->>> print_requests.py --sort ^//import-file/
+>>> print_requests.py --nostamp --sort ^//workspace/import ^//api/2.0/bundle
 {
   "method": "DELETE",
   "path": "/api/2.0/apps/myapp"
@@ -100,6 +111,13 @@ Destroy complete!
   "method": "DELETE",
   "path": "/api/2.0/pipelines/[UUID]"
 }
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/delete",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle"
+  }
+}
 {
   "method": "POST",
   "path": "/api/2.0/workspace/delete",
diff --git a/acceptance/bundle/resource_deps/remote_app_url/script b/acceptance/bundle/resource_deps/remote_app_url/script
index d38692366b3..ccd83d2f06d 100644
--- a/acceptance/bundle/resource_deps/remote_app_url/script
+++ b/acceptance/bundle/resource_deps/remote_app_url/script
@@ -1,9 +1,9 @@
 trace $CLI bundle validate
 trace $CLI bundle plan
-trace print_requests.py '^//import-file/'
+trace print_requests.py --nostamp '^//workspace/import' '^//api/2.0/bundle'
 
 trace $CLI bundle deploy
-trace print_requests.py '^//import-file/'
+trace print_requests.py --nostamp '^//workspace/import' '^//api/2.0/bundle'
 
 trace $CLI bundle destroy --auto-approve
-trace print_requests.py --sort '^//import-file/'
+trace print_requests.py --nostamp --sort '^//workspace/import' '^//api/2.0/bundle'
diff --git a/acceptance/bundle/resource_deps/remote_field_storage_location/out.deploy.direct.txt b/acceptance/bundle/resource_deps/remote_field_storage_location/out.deploy.direct.txt
deleted file mode 100644
index 5a4539339c5..00000000000
--- a/acceptance/bundle/resource_deps/remote_field_storage_location/out.deploy.direct.txt
+++ /dev/null
@@ -1,6 +0,0 @@
-
->>> errcode [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/testbundle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
diff --git a/acceptance/bundle/resource_deps/remote_field_storage_location/out.deploy.requests.direct.json b/acceptance/bundle/resource_deps/remote_field_storage_location/out.deploy.requests.json
similarity index 100%
rename from acceptance/bundle/resource_deps/remote_field_storage_location/out.deploy.requests.direct.json
rename to acceptance/bundle/resource_deps/remote_field_storage_location/out.deploy.requests.json
diff --git a/acceptance/bundle/resource_deps/remote_field_storage_location/out.deploy.requests.terraform.json b/acceptance/bundle/resource_deps/remote_field_storage_location/out.deploy.requests.terraform.json
deleted file mode 100644
index d048e68d7be..00000000000
--- a/acceptance/bundle/resource_deps/remote_field_storage_location/out.deploy.requests.terraform.json
+++ /dev/null
@@ -1,26 +0,0 @@
-{
-  "method": "POST",
-  "path": "/api/2.1/unity-catalog/schemas",
-  "body": {
-    "catalog_name": "main",
-    "name": "myschema-[UNIQUE_NAME]"
-  }
-}
-{
-  "method": "GET",
-  "path": "/api/2.1/unity-catalog/schemas/main.myschema-[UNIQUE_NAME]"
-}
-{
-  "method": "POST",
-  "path": "/api/2.1/unity-catalog/volumes",
-  "body": {
-    "catalog_name": "main",
-    "name": "volumebar-[UNIQUE_NAME]",
-    "schema_name": "myschema-[UNIQUE_NAME]",
-    "volume_type": "MANAGED"
-  }
-}
-{
-  "method": "GET",
-  "path": "/api/2.1/unity-catalog/volumes/main.myschema-[UNIQUE_NAME].volumebar-[UNIQUE_NAME]"
-}
diff --git a/acceptance/bundle/resource_deps/remote_field_storage_location/out.deploy.terraform.txt b/acceptance/bundle/resource_deps/remote_field_storage_location/out.deploy.terraform.txt
deleted file mode 100644
index ae9fe8af8ed..00000000000
--- a/acceptance/bundle/resource_deps/remote_field_storage_location/out.deploy.terraform.txt
+++ /dev/null
@@ -1,21 +0,0 @@
-
->>> errcode [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/testbundle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Error: terraform apply: exit status 1
-
-Error: Provider produced inconsistent final plan
-
-When expanding the plan for databricks_volume.foo to include new values
-learned so far during apply, provider
-"registry.terraform.io/databricks/databricks" produced an invalid new value
-for .comment: was null, but now
-cty.StringVal("s3://[METASTORE_NAME]/metastore/[UUID]/volumes/[UUID]").
-
-This is a bug in the provider, which should be reported in the provider's own
-issue tracker.
-
-
-Updating deployment state...
-
-Exit code: 1
diff --git a/acceptance/bundle/resource_deps/remote_field_storage_location/out.deploy.txt b/acceptance/bundle/resource_deps/remote_field_storage_location/out.deploy.txt
new file mode 100644
index 00000000000..8f3386632ce
--- /dev/null
+++ b/acceptance/bundle/resource_deps/remote_field_storage_location/out.deploy.txt
@@ -0,0 +1,8 @@
+
+>>> errcode [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/testbundle-[UNIQUE_NAME]/default/files...
+Created schemas.my
+Created volumes.bar
+Created volumes.foo
+Files: 3 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
diff --git a/acceptance/bundle/resource_deps/remote_field_storage_location/out.destroy.direct.txt b/acceptance/bundle/resource_deps/remote_field_storage_location/out.destroy.direct.txt
deleted file mode 100644
index b4d427d4853..00000000000
--- a/acceptance/bundle/resource_deps/remote_field_storage_location/out.destroy.direct.txt
+++ /dev/null
@@ -1,19 +0,0 @@
-The following resources will be deleted:
-  delete resources.schemas.my
-  delete resources.volumes.bar
-  delete resources.volumes.foo
-
-This action will result in the deletion of the following UC schemas. Any underlying data may be lost:
-  delete resources.schemas.my
-
-This action will result in the deletion of the following volumes.
-For managed volumes, the files stored in the volume are also deleted from your
-cloud tenant within 30 days. For external volumes, the metadata about the volume
-is removed from the catalog, but the underlying files are not deleted:
-  delete resources.volumes.bar
-  delete resources.volumes.foo
-
-All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/testbundle-[UNIQUE_NAME]/default
-
-Deleting files...
-Destroy complete!
diff --git a/acceptance/bundle/resource_deps/remote_field_storage_location/out.destroy.terraform.txt b/acceptance/bundle/resource_deps/remote_field_storage_location/out.destroy.terraform.txt
deleted file mode 100644
index 8f89cda64c2..00000000000
--- a/acceptance/bundle/resource_deps/remote_field_storage_location/out.destroy.terraform.txt
+++ /dev/null
@@ -1,17 +0,0 @@
-The following resources will be deleted:
-  delete resources.schemas.my
-  delete resources.volumes.bar
-
-This action will result in the deletion of the following UC schemas. Any underlying data may be lost:
-  delete resources.schemas.my
-
-This action will result in the deletion of the following volumes.
-For managed volumes, the files stored in the volume are also deleted from your
-cloud tenant within 30 days. For external volumes, the metadata about the volume
-is removed from the catalog, but the underlying files are not deleted:
-  delete resources.volumes.bar
-
-All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/testbundle-[UNIQUE_NAME]/default
-
-Deleting files...
-Destroy complete!
diff --git a/acceptance/bundle/resource_deps/remote_field_storage_location/out.destroy.txt b/acceptance/bundle/resource_deps/remote_field_storage_location/out.destroy.txt
new file mode 100644
index 00000000000..e850f627d51
--- /dev/null
+++ b/acceptance/bundle/resource_deps/remote_field_storage_location/out.destroy.txt
@@ -0,0 +1,18 @@
+The following resources will be deleted:
+  delete resources.schemas.my
+  delete resources.volumes.bar
+  delete resources.volumes.foo
+
+This action will result in the deletion of the following UC schemas. Any underlying data may be lost:
+  delete resources.schemas.my
+
+This action will result in the deletion of the following volumes.
+For managed volumes, the files stored in the volume are also deleted from your
+cloud tenant within 30 days. For external volumes, the metadata about the volume
+is removed from the catalog, but the underlying files are not deleted:
+  delete resources.volumes.bar
+  delete resources.volumes.foo
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/testbundle-[UNIQUE_NAME]/default
+
+Destroy: 3 deleted
diff --git a/acceptance/bundle/resource_deps/remote_field_storage_location/out.destroy_requests.direct.json b/acceptance/bundle/resource_deps/remote_field_storage_location/out.destroy_requests.json
similarity index 100%
rename from acceptance/bundle/resource_deps/remote_field_storage_location/out.destroy_requests.direct.json
rename to acceptance/bundle/resource_deps/remote_field_storage_location/out.destroy_requests.json
diff --git a/acceptance/bundle/resource_deps/remote_field_storage_location/out.destroy_requests.terraform.json b/acceptance/bundle/resource_deps/remote_field_storage_location/out.destroy_requests.terraform.json
deleted file mode 100644
index b544cfb4611..00000000000
--- a/acceptance/bundle/resource_deps/remote_field_storage_location/out.destroy_requests.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "method": "DELETE",
-  "path": "/api/2.1/unity-catalog/schemas/main.myschema-[UNIQUE_NAME]",
-  "q": {
-    "force": "true"
-  }
-}
-{
-  "method": "DELETE",
-  "path": "/api/2.1/unity-catalog/volumes/main.myschema-[UNIQUE_NAME].volumebar-[UNIQUE_NAME]"
-}
diff --git a/acceptance/bundle/resource_deps/remote_field_storage_location/out.plan_after_deploy.terraform.txt b/acceptance/bundle/resource_deps/remote_field_storage_location/out.plan_after_deploy.terraform.txt
deleted file mode 100644
index 35041be6c3e..00000000000
--- a/acceptance/bundle/resource_deps/remote_field_storage_location/out.plan_after_deploy.terraform.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-create volumes.foo
-
-Plan: 1 to add, 0 to change, 0 to delete, 2 unchanged
diff --git a/acceptance/bundle/resource_deps/remote_field_storage_location/out.plan_after_deploy.direct.txt b/acceptance/bundle/resource_deps/remote_field_storage_location/out.plan_after_deploy.txt
similarity index 100%
rename from acceptance/bundle/resource_deps/remote_field_storage_location/out.plan_after_deploy.direct.txt
rename to acceptance/bundle/resource_deps/remote_field_storage_location/out.plan_after_deploy.txt
diff --git a/acceptance/bundle/resource_deps/remote_field_storage_location/out.test.toml b/acceptance/bundle/resource_deps/remote_field_storage_location/out.test.toml
index 8c738f635ac..ee153e82621 100644
--- a/acceptance/bundle/resource_deps/remote_field_storage_location/out.test.toml
+++ b/acceptance/bundle/resource_deps/remote_field_storage_location/out.test.toml
@@ -1,6 +1,4 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
 CloudEnvs.azure = false
 CloudEnvs.gcp = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/remote_field_storage_location/output.txt b/acceptance/bundle/resource_deps/remote_field_storage_location/output.txt
index ce5fcfb66ba..51bd4b30bc5 100644
--- a/acceptance/bundle/resource_deps/remote_field_storage_location/output.txt
+++ b/acceptance/bundle/resource_deps/remote_field_storage_location/output.txt
@@ -12,6 +12,7 @@
       "catalog_name": "main",
       "name": "volumebar-[UNIQUE_NAME]",
       "schema_name": "${resources.schemas.my.name}",
+      "volume_path": "/Volumes/main/myschema-[UNIQUE_NAME]/volumebar-[UNIQUE_NAME]",
       "volume_type": "MANAGED"
     },
     "foo": {
@@ -19,6 +20,7 @@
       "comment": "${resources.volumes.bar.storage_location}",
       "name": "volumefoo-[UNIQUE_NAME]",
       "schema_name": "${resources.schemas.my.name}",
+      "volume_path": "/Volumes/main/myschema-[UNIQUE_NAME]/volumefoo-[UNIQUE_NAME]",
       "volume_type": "MANAGED"
     }
   }
diff --git a/acceptance/bundle/resource_deps/remote_field_storage_location/script b/acceptance/bundle/resource_deps/remote_field_storage_location/script
index 30ed44956f0..f9b82b333e1 100644
--- a/acceptance/bundle/resource_deps/remote_field_storage_location/script
+++ b/acceptance/bundle/resource_deps/remote_field_storage_location/script
@@ -1,6 +1,6 @@
 cleanup() {
-    $CLI bundle destroy --auto-approve &> out.destroy.$DATABRICKS_BUNDLE_ENGINE.txt
-    print_requests.py --sort //unity &> out.destroy_requests.$DATABRICKS_BUNDLE_ENGINE.json
+    $CLI bundle destroy --auto-approve &> out.destroy.txt
+    print_requests.py --sort //unity &> out.destroy_requests.json
 }
 
 envsubst < databricks.yml.tmpl > databricks.yml
@@ -8,8 +8,8 @@ trace $CLI bundle validate -o json | jq .resources
 trace $CLI bundle plan
 trace print_requests.py --get //unity
 trap cleanup EXIT
-trace errcode $CLI bundle deploy &> out.deploy.$DATABRICKS_BUNDLE_ENGINE.txt
-print_requests.py --get //unity &> out.deploy.requests.$DATABRICKS_BUNDLE_ENGINE.json
+trace errcode $CLI bundle deploy &> out.deploy.txt
+print_requests.py --get //unity &> out.deploy.requests.json
 
 # Terraform could not deploy, so it still shows up here; direct shows no drift:
-$CLI bundle plan &> out.plan_after_deploy.$DATABRICKS_BUNDLE_ENGINE.txt
+$CLI bundle plan &> out.plan_after_deploy.txt
diff --git a/acceptance/bundle/resource_deps/remote_field_storage_location/test.toml b/acceptance/bundle/resource_deps/remote_field_storage_location/test.toml
index 9a519e7e9ca..d731f2382f9 100644
--- a/acceptance/bundle/resource_deps/remote_field_storage_location/test.toml
+++ b/acceptance/bundle/resource_deps/remote_field_storage_location/test.toml
@@ -1,6 +1,4 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
 
 # Each cloud has its specific storage url, we record AWS's one in the output (which is also emulated by Local):
 CloudEnvs.gcp = false
diff --git a/acceptance/bundle/resource_deps/remote_pipeline/out.plan_create.direct.json b/acceptance/bundle/resource_deps/remote_pipeline/out.plan_create.direct.json
deleted file mode 100644
index 0defc08aa4e..00000000000
--- a/acceptance/bundle/resource_deps/remote_pipeline/out.plan_create.direct.json
+++ /dev/null
@@ -1,89 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.foo1": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "channel": "CURRENT",
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "edition": "ADVANCED",
-          "name": "foo1 name"
-        }
-      }
-    },
-    "resources.pipelines.foo2": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.foo1",
-          "label": "${resources.pipelines.foo1.creator_user_name}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "channel": "CURRENT",
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "edition": "ADVANCED",
-          "name": "foo2 foo1.creator_user_name=${resources.pipelines.foo1.creator_user_name}"
-        },
-        "vars": {
-          "name": "foo2 foo1.creator_user_name=${resources.pipelines.foo1.creator_user_name}"
-        }
-      }
-    },
-    "resources.pipelines.foo3": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.foo2",
-          "label": "${resources.pipelines.foo2.state}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "channel": "CURRENT",
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "edition": "ADVANCED",
-          "name": "foo3 foo2.state=${resources.pipelines.foo2.state}"
-        },
-        "vars": {
-          "name": "foo3 foo2.state=${resources.pipelines.foo2.state}"
-        }
-      }
-    },
-    "resources.pipelines.foo4": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.foo3",
-          "label": "${resources.pipelines.foo3.last_modified}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "channel": "CURRENT",
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "edition": "ADVANCED",
-          "name": "foo4 foo3.last_modified=${resources.pipelines.foo3.last_modified}"
-        },
-        "vars": {
-          "name": "foo4 foo3.last_modified=${resources.pipelines.foo3.last_modified}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/remote_pipeline/out.plan_create.json b/acceptance/bundle/resource_deps/remote_pipeline/out.plan_create.json
new file mode 100644
index 00000000000..6a9eccbe9fe
--- /dev/null
+++ b/acceptance/bundle/resource_deps/remote_pipeline/out.plan_create.json
@@ -0,0 +1,89 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.pipelines.foo1": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "channel": "CURRENT",
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edition": "ADVANCED",
+          "name": "foo1 name"
+        }
+      }
+    },
+    "resources.pipelines.foo2": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.foo1",
+          "label": "${resources.pipelines.foo1.creator_user_name}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "channel": "CURRENT",
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edition": "ADVANCED",
+          "name": "foo2 foo1.creator_user_name=${resources.pipelines.foo1.creator_user_name}"
+        },
+        "vars": {
+          "name": "foo2 foo1.creator_user_name=${resources.pipelines.foo1.creator_user_name}"
+        }
+      }
+    },
+    "resources.pipelines.foo3": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.foo2",
+          "label": "${resources.pipelines.foo2.state}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "channel": "CURRENT",
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edition": "ADVANCED",
+          "name": "foo3 foo2.state=${resources.pipelines.foo2.state}"
+        },
+        "vars": {
+          "name": "foo3 foo2.state=${resources.pipelines.foo2.state}"
+        }
+      }
+    },
+    "resources.pipelines.foo4": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.foo3",
+          "label": "${resources.pipelines.foo3.last_modified}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "channel": "CURRENT",
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edition": "ADVANCED",
+          "name": "foo4 foo3.last_modified=${resources.pipelines.foo3.last_modified}"
+        },
+        "vars": {
+          "name": "foo4 foo3.last_modified=${resources.pipelines.foo3.last_modified}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resource_deps/remote_pipeline/out.plan_create.terraform.json b/acceptance/bundle/resource_deps/remote_pipeline/out.plan_create.terraform.json
deleted file mode 100644
index 5ae43f4aeac..00000000000
--- a/acceptance/bundle/resource_deps/remote_pipeline/out.plan_create.terraform.json
+++ /dev/null
@@ -1,17 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.foo1": {
-      "action": "create"
-    },
-    "resources.pipelines.foo2": {
-      "action": "create"
-    },
-    "resources.pipelines.foo3": {
-      "action": "create"
-    },
-    "resources.pipelines.foo4": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/remote_pipeline/out.plan_skip.direct.json b/acceptance/bundle/resource_deps/remote_pipeline/out.plan_skip.direct.json
deleted file mode 100644
index 3675496afba..00000000000
--- a/acceptance/bundle/resource_deps/remote_pipeline/out.plan_skip.direct.json
+++ /dev/null
@@ -1,134 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.pipelines.foo1": {
-      "action": "skip",
-      "remote_state": {
-        "channel": "CURRENT",
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-        },
-        "edition": "ADVANCED",
-        "effective_publishing_mode": "DEFAULT_PUBLISHING_MODE",
-        "id": "[UUID]",
-        "last_modified": [UNIX_TIME_MILLIS],
-        "name": "foo1 name",
-        "pipeline_id": "[UUID]",
-        "run_as_user_name": "[USERNAME]",
-        "state": "IDLE",
-        "storage": "dbfs:/pipelines/[UUID]"
-      },
-      "changes": {
-        "storage": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "dbfs:/pipelines/[UUID]"
-        }
-      }
-    },
-    "resources.pipelines.foo2": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.foo1",
-          "label": "${resources.pipelines.foo1.creator_user_name}"
-        }
-      ],
-      "action": "skip",
-      "remote_state": {
-        "channel": "CURRENT",
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-        },
-        "edition": "ADVANCED",
-        "effective_publishing_mode": "DEFAULT_PUBLISHING_MODE",
-        "id": "[UUID]",
-        "last_modified": [UNIX_TIME_MILLIS],
-        "name": "foo2 foo1.creator_user_name=[USERNAME]",
-        "pipeline_id": "[UUID]",
-        "run_as_user_name": "[USERNAME]",
-        "state": "IDLE",
-        "storage": "dbfs:/pipelines/[UUID]"
-      },
-      "changes": {
-        "storage": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "dbfs:/pipelines/[UUID]"
-        }
-      }
-    },
-    "resources.pipelines.foo3": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.foo2",
-          "label": "${resources.pipelines.foo2.state}"
-        }
-      ],
-      "action": "skip",
-      "remote_state": {
-        "channel": "CURRENT",
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-        },
-        "edition": "ADVANCED",
-        "effective_publishing_mode": "DEFAULT_PUBLISHING_MODE",
-        "id": "[UUID]",
-        "last_modified": [UNIX_TIME_MILLIS],
-        "name": "foo3 foo2.state=IDLE",
-        "pipeline_id": "[UUID]",
-        "run_as_user_name": "[USERNAME]",
-        "state": "IDLE",
-        "storage": "dbfs:/pipelines/[UUID]"
-      },
-      "changes": {
-        "storage": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "dbfs:/pipelines/[UUID]"
-        }
-      }
-    },
-    "resources.pipelines.foo4": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.foo3",
-          "label": "${resources.pipelines.foo3.last_modified}"
-        }
-      ],
-      "action": "skip",
-      "remote_state": {
-        "channel": "CURRENT",
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-        },
-        "edition": "ADVANCED",
-        "effective_publishing_mode": "DEFAULT_PUBLISHING_MODE",
-        "id": "[UUID]",
-        "last_modified": [UNIX_TIME_MILLIS],
-        "name": "foo4 foo3.last_modified=[UNIX_TIME_MILLIS]",
-        "pipeline_id": "[UUID]",
-        "run_as_user_name": "[USERNAME]",
-        "state": "IDLE",
-        "storage": "dbfs:/pipelines/[UUID]"
-      },
-      "changes": {
-        "storage": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "dbfs:/pipelines/[UUID]"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/remote_pipeline/out.plan_skip.json b/acceptance/bundle/resource_deps/remote_pipeline/out.plan_skip.json
new file mode 100644
index 00000000000..37e2b7f7193
--- /dev/null
+++ b/acceptance/bundle/resource_deps/remote_pipeline/out.plan_skip.json
@@ -0,0 +1,134 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.pipelines.foo1": {
+      "action": "skip",
+      "remote_state": {
+        "channel": "CURRENT",
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "edition": "ADVANCED",
+        "effective_publishing_mode": "DEFAULT_PUBLISHING_MODE",
+        "id": "[UUID]",
+        "last_modified": [UNIX_TIME_MILLIS],
+        "name": "foo1 name",
+        "pipeline_id": "[UUID]",
+        "run_as_user_name": "[USERNAME]",
+        "state": "IDLE",
+        "storage": "dbfs:/pipelines/[UUID]"
+      },
+      "changes": {
+        "storage": {
+          "action": "skip",
+          "reason": "immutable_backend_value",
+          "remote": "dbfs:/pipelines/[UUID]"
+        }
+      }
+    },
+    "resources.pipelines.foo2": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.foo1",
+          "label": "${resources.pipelines.foo1.creator_user_name}"
+        }
+      ],
+      "action": "skip",
+      "remote_state": {
+        "channel": "CURRENT",
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "edition": "ADVANCED",
+        "effective_publishing_mode": "DEFAULT_PUBLISHING_MODE",
+        "id": "[UUID]",
+        "last_modified": [UNIX_TIME_MILLIS],
+        "name": "foo2 foo1.creator_user_name=[USERNAME]",
+        "pipeline_id": "[UUID]",
+        "run_as_user_name": "[USERNAME]",
+        "state": "IDLE",
+        "storage": "dbfs:/pipelines/[UUID]"
+      },
+      "changes": {
+        "storage": {
+          "action": "skip",
+          "reason": "immutable_backend_value",
+          "remote": "dbfs:/pipelines/[UUID]"
+        }
+      }
+    },
+    "resources.pipelines.foo3": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.foo2",
+          "label": "${resources.pipelines.foo2.state}"
+        }
+      ],
+      "action": "skip",
+      "remote_state": {
+        "channel": "CURRENT",
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "edition": "ADVANCED",
+        "effective_publishing_mode": "DEFAULT_PUBLISHING_MODE",
+        "id": "[UUID]",
+        "last_modified": [UNIX_TIME_MILLIS],
+        "name": "foo3 foo2.state=IDLE",
+        "pipeline_id": "[UUID]",
+        "run_as_user_name": "[USERNAME]",
+        "state": "IDLE",
+        "storage": "dbfs:/pipelines/[UUID]"
+      },
+      "changes": {
+        "storage": {
+          "action": "skip",
+          "reason": "immutable_backend_value",
+          "remote": "dbfs:/pipelines/[UUID]"
+        }
+      }
+    },
+    "resources.pipelines.foo4": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.foo3",
+          "label": "${resources.pipelines.foo3.last_modified}"
+        }
+      ],
+      "action": "skip",
+      "remote_state": {
+        "channel": "CURRENT",
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "edition": "ADVANCED",
+        "effective_publishing_mode": "DEFAULT_PUBLISHING_MODE",
+        "id": "[UUID]",
+        "last_modified": [UNIX_TIME_MILLIS],
+        "name": "foo4 foo3.last_modified=[UNIX_TIME_MILLIS]",
+        "pipeline_id": "[UUID]",
+        "run_as_user_name": "[USERNAME]",
+        "state": "IDLE",
+        "storage": "dbfs:/pipelines/[UUID]"
+      },
+      "changes": {
+        "storage": {
+          "action": "skip",
+          "reason": "immutable_backend_value",
+          "remote": "dbfs:/pipelines/[UUID]"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resource_deps/remote_pipeline/out.plan_skip.terraform.json b/acceptance/bundle/resource_deps/remote_pipeline/out.plan_skip.terraform.json
deleted file mode 100644
index 83206a34918..00000000000
--- a/acceptance/bundle/resource_deps/remote_pipeline/out.plan_skip.terraform.json
+++ /dev/null
@@ -1,17 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.foo1": {
-      "action": "skip"
-    },
-    "resources.pipelines.foo2": {
-      "action": "skip"
-    },
-    "resources.pipelines.foo3": {
-      "action": "skip"
-    },
-    "resources.pipelines.foo4": {
-      "action": "skip"
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/remote_pipeline/out.test.toml b/acceptance/bundle/resource_deps/remote_pipeline/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resource_deps/remote_pipeline/out.test.toml
+++ b/acceptance/bundle/resource_deps/remote_pipeline/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/remote_pipeline/output.txt b/acceptance/bundle/resource_deps/remote_pipeline/output.txt
index 1f86775154e..2c4f1623749 100644
--- a/acceptance/bundle/resource_deps/remote_pipeline/output.txt
+++ b/acceptance/bundle/resource_deps/remote_pipeline/output.txt
@@ -1,9 +1,12 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created pipelines.foo1
+Created pipelines.foo2
+Created pipelines.foo3
+Created pipelines.foo4
+Files: 2 uploaded, 0 deleted
+Resources: 4 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> print_requests
 "foo1 name"
diff --git a/acceptance/bundle/resource_deps/remote_pipeline/script b/acceptance/bundle/resource_deps/remote_pipeline/script
index ae44dfd1229..55f8ea67ebd 100644
--- a/acceptance/bundle/resource_deps/remote_pipeline/script
+++ b/acceptance/bundle/resource_deps/remote_pipeline/script
@@ -1,10 +1,10 @@
 print_requests() {
-    jq --sort-keys 'select(.method != "GET" and (.path | contains("/pipeline"))) | (.body.name // empty)' < out.requests.txt
-    rm out.requests.txt
+    jq --sort-keys 'select(.method != "GET" and (.path | contains("/pipeline"))) | (.body.name // empty)' < "$OUT_REQUESTS"
+    rm "$OUT_REQUESTS"
 }
 
-$CLI bundle plan -o json > out.plan_create.$DATABRICKS_BUNDLE_ENGINE.json
+$CLI bundle plan -o json | nostamp > out.plan_create.json
 trace $CLI bundle deploy
 trace print_requests
-$CLI bundle plan -o json > out.plan_skip.$DATABRICKS_BUNDLE_ENGINE.json
+$CLI bundle plan -o json | nostamp > out.plan_skip.json
 trace print_requests
diff --git a/acceptance/bundle/resource_deps/resources_var/out.deploy.txt b/acceptance/bundle/resource_deps/resources_var/out.deploy.txt
index 6fc3bc4ae11..2e86facd5fc 100644
--- a/acceptance/bundle/resource_deps/resources_var/out.deploy.txt
+++ b/acceptance/bundle/resource_deps/resources_var/out.deploy.txt
@@ -1,6 +1,8 @@
 
 >>> errcode [CLI] bundle deploy -t dev
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/dev/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created pipelines.mypipeline
+Created volumes.bar
+Created volumes.foo
+Files: 3 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
diff --git a/acceptance/bundle/resource_deps/resources_var/out.plan.direct.json b/acceptance/bundle/resource_deps/resources_var/out.plan.direct.json
deleted file mode 100644
index 0fe8f7fe37d..00000000000
--- a/acceptance/bundle/resource_deps/resources_var/out.plan.direct.json
+++ /dev/null
@@ -1,70 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.mypipeline": {
-      "depends_on": [
-        {
-          "node": "resources.volumes.foo",
-          "label": "${resources.volumes.foo.catalog_name}"
-        },
-        {
-          "node": "resources.volumes.foo",
-          "label": "${resources.volumes.foo.name}"
-        },
-        {
-          "node": "resources.volumes.foo",
-          "label": "${resources.volumes.foo.schema_name}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "channel": "CURRENT",
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/dev/state/metadata.json"
-          },
-          "development": true,
-          "edition": "ADVANCED",
-          "name": "[dev [USERNAME]] pipeline for mycatalog.myschema.myname",
-          "tags": {
-            "dev": "[USERNAME]"
-          }
-        }
-      }
-    },
-    "resources.volumes.bar": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "catalog_name": "mycatalog",
-          "name": "barname",
-          "schema_name": "myschema",
-          "volume_type": "MANAGED"
-        }
-      }
-    },
-    "resources.volumes.foo": {
-      "depends_on": [
-        {
-          "node": "resources.volumes.bar",
-          "label": "${resources.volumes.bar.catalog_name}"
-        },
-        {
-          "node": "resources.volumes.bar",
-          "label": "${resources.volumes.bar.schema_name}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "catalog_name": "mycatalog",
-          "name": "myname",
-          "schema_name": "myschema",
-          "volume_type": "MANAGED"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/resources_var/out.plan.json b/acceptance/bundle/resource_deps/resources_var/out.plan.json
new file mode 100644
index 00000000000..b68a84e314c
--- /dev/null
+++ b/acceptance/bundle/resource_deps/resources_var/out.plan.json
@@ -0,0 +1,70 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.pipelines.mypipeline": {
+      "depends_on": [
+        {
+          "node": "resources.volumes.foo",
+          "label": "${resources.volumes.foo.catalog_name}"
+        },
+        {
+          "node": "resources.volumes.foo",
+          "label": "${resources.volumes.foo.name}"
+        },
+        {
+          "node": "resources.volumes.foo",
+          "label": "${resources.volumes.foo.schema_name}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "channel": "CURRENT",
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/dev/state/metadata.json"
+          },
+          "development": true,
+          "edition": "ADVANCED",
+          "name": "[dev [USERNAME]] pipeline for mycatalog.myschema.myname",
+          "tags": {
+            "dev": "[USERNAME]"
+          }
+        }
+      }
+    },
+    "resources.volumes.bar": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "catalog_name": "mycatalog",
+          "name": "barname",
+          "schema_name": "myschema",
+          "volume_type": "MANAGED"
+        }
+      }
+    },
+    "resources.volumes.foo": {
+      "depends_on": [
+        {
+          "node": "resources.volumes.bar",
+          "label": "${resources.volumes.bar.catalog_name}"
+        },
+        {
+          "node": "resources.volumes.bar",
+          "label": "${resources.volumes.bar.schema_name}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "catalog_name": "mycatalog",
+          "name": "myname",
+          "schema_name": "myschema",
+          "volume_type": "MANAGED"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resource_deps/resources_var/out.plan.terraform.json b/acceptance/bundle/resource_deps/resources_var/out.plan.terraform.json
deleted file mode 100644
index df821bd94fd..00000000000
--- a/acceptance/bundle/resource_deps/resources_var/out.plan.terraform.json
+++ /dev/null
@@ -1,14 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.mypipeline": {
-      "action": "create"
-    },
-    "resources.volumes.bar": {
-      "action": "create"
-    },
-    "resources.volumes.foo": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/resources_var/out.test.toml b/acceptance/bundle/resource_deps/resources_var/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resource_deps/resources_var/out.test.toml
+++ b/acceptance/bundle/resource_deps/resources_var/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/resources_var/output.txt b/acceptance/bundle/resource_deps/resources_var/output.txt
index cd34790c2ca..5538dc49ab2 100644
--- a/acceptance/bundle/resource_deps/resources_var/output.txt
+++ b/acceptance/bundle/resource_deps/resources_var/output.txt
@@ -21,31 +21,40 @@
       "catalog_name": "mycatalog",
       "name": "barname",
       "schema_name": "myschema",
+      "volume_path": "/Volumes/mycatalog/myschema/barname",
       "volume_type": "MANAGED"
     },
     "foo": {
       "catalog_name": "${resources.volumes.bar.catalog_name}",
       "name": "myname",
       "schema_name": "${resources.volumes.bar.schema_name}",
+      "volume_path": "/Volumes/mycatalog/myschema/myname",
       "volume_type": "MANAGED"
     }
   }
 }
 
->>> jq -s .[] | select(.path=="/api/2.0/pipelines") | .body.name out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.0/pipelines") | .body.name [OUTPUT_DIR]/out.requests.txt
 "[dev [USERNAME]] pipeline for mycatalog.myschema.myname"
 
 >>> print_telemetry_bool_values
+dms_compat_auto true
+dms_undeclared_deploying_user false
+dms_undeclared_group false
+dms_undeclared_other_user false
+dms_undeclared_service_principal false
 experimental.use_legacy_run_as false
 has_classic_interactive_compute false
 has_classic_job_compute false
 has_serverless_compute false
 local.cache.attempt true
 local.cache.hit true
+permissions_section_set false
 presets_name_prefix_is_set true
 python_wheel_wrapper_is_set false
-resref_volumes.catalog_name true
-resref_volumes.name true
-resref_volumes.schema_name true
 run_as_set false
 skip_artifact_cleanup false
+state_path_in_deployer_home true
+state_path_in_other_user_home false
+state_path_is_shared false
+state_path_other false
diff --git a/acceptance/bundle/resource_deps/resources_var/script b/acceptance/bundle/resource_deps/resources_var/script
index 5b195f9b2df..a5747dcd374 100644
--- a/acceptance/bundle/resource_deps/resources_var/script
+++ b/acceptance/bundle/resource_deps/resources_var/script
@@ -1,6 +1,6 @@
 trace $CLI bundle validate -t dev -o json | jq .resources
-$CLI bundle plan -o json > out.plan.$DATABRICKS_BUNDLE_ENGINE.json
+$CLI bundle plan -o json | nostamp > out.plan.json
 trace errcode $CLI bundle deploy -t dev &> out.deploy.txt
-trace jq -s '.[] | select(.path=="/api/2.0/pipelines") | .body.name' out.requests.txt
+trace jq -s '.[] | select(.path=="/api/2.0/pipelines") | .body.name' "$OUT_REQUESTS"
 trace print_telemetry_bool_values
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/resource_deps/resources_var_presets/out.test.toml b/acceptance/bundle/resource_deps/resources_var_presets/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resource_deps/resources_var_presets/out.test.toml
+++ b/acceptance/bundle/resource_deps/resources_var_presets/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/resources_var_presets/output.txt b/acceptance/bundle/resource_deps/resources_var_presets/output.txt
index 2b92bc9b097..7598641889d 100644
--- a/acceptance/bundle/resource_deps/resources_var_presets/output.txt
+++ b/acceptance/bundle/resource_deps/resources_var_presets/output.txt
@@ -30,9 +30,11 @@
 
 >>> [CLI] bundle deploy -t dev
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/dev/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created pipelines.mypipeline
+Created schemas.bar
+Created schemas.foo
+Files: 1 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
 
->>> jq -s .[] | select(.path=="/api/2.0/pipelines") | .body.name out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.0/pipelines") | .body.name [OUTPUT_DIR]/out.requests.txt
 "[dev [USERNAME]] pipeline for mycatalog.dev_[USERNAME]_dev_[USERNAME]_myschema"
diff --git a/acceptance/bundle/resource_deps/resources_var_presets/script b/acceptance/bundle/resource_deps/resources_var_presets/script
index 8d925628015..f4bf642936b 100644
--- a/acceptance/bundle/resource_deps/resources_var_presets/script
+++ b/acceptance/bundle/resource_deps/resources_var_presets/script
@@ -1,4 +1,4 @@
 trace $CLI bundle validate -t dev -o json | jq .resources
 trace $CLI bundle deploy -t dev
-trace jq -s '.[] | select(.path=="/api/2.0/pipelines") | .body.name' out.requests.txt
-rm out.requests.txt
+trace jq -s '.[] | select(.path=="/api/2.0/pipelines") | .body.name' "$OUT_REQUESTS"
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/resource_deps/resources_var_presets_implicit_deps/out.plan.direct.json b/acceptance/bundle/resource_deps/resources_var_presets_implicit_deps/out.plan.direct.json
deleted file mode 100644
index 058cd867d28..00000000000
--- a/acceptance/bundle/resource_deps/resources_var_presets_implicit_deps/out.plan.direct.json
+++ /dev/null
@@ -1,68 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.mypipeline": {
-      "depends_on": [
-        {
-          "node": "resources.volumes.foo",
-          "label": "${resources.volumes.foo.catalog_name}"
-        },
-        {
-          "node": "resources.volumes.foo",
-          "label": "${resources.volumes.foo.name}"
-        },
-        {
-          "node": "resources.volumes.foo",
-          "label": "${resources.volumes.foo.schema_name}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "channel": "CURRENT",
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/dev/state/metadata.json"
-          },
-          "development": true,
-          "edition": "ADVANCED",
-          "name": "[dev [USERNAME]] pipeline for mycatalog.dev_[USERNAME]_myschema.myname",
-          "tags": {
-            "dev": "[USERNAME]"
-          }
-        }
-      }
-    },
-    "resources.schemas.bar": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "catalog_name": "mycatalog",
-          "name": "dev_[USERNAME]_myschema"
-        }
-      }
-    },
-    "resources.volumes.foo": {
-      "depends_on": [
-        {
-          "node": "resources.schemas.bar",
-          "label": "${resources.schemas.bar.catalog_name}"
-        },
-        {
-          "node": "resources.schemas.bar",
-          "label": "${resources.schemas.bar.name}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "catalog_name": "mycatalog",
-          "name": "myname",
-          "schema_name": "dev_[USERNAME]_myschema",
-          "volume_type": "MANAGED"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/resources_var_presets_implicit_deps/out.plan.json b/acceptance/bundle/resource_deps/resources_var_presets_implicit_deps/out.plan.json
new file mode 100644
index 00000000000..9fbfdb1ec8d
--- /dev/null
+++ b/acceptance/bundle/resource_deps/resources_var_presets_implicit_deps/out.plan.json
@@ -0,0 +1,68 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.pipelines.mypipeline": {
+      "depends_on": [
+        {
+          "node": "resources.volumes.foo",
+          "label": "${resources.volumes.foo.catalog_name}"
+        },
+        {
+          "node": "resources.volumes.foo",
+          "label": "${resources.volumes.foo.name}"
+        },
+        {
+          "node": "resources.volumes.foo",
+          "label": "${resources.volumes.foo.schema_name}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "channel": "CURRENT",
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/dev/state/metadata.json"
+          },
+          "development": true,
+          "edition": "ADVANCED",
+          "name": "[dev [USERNAME]] pipeline for mycatalog.dev_[USERNAME]_myschema.myname",
+          "tags": {
+            "dev": "[USERNAME]"
+          }
+        }
+      }
+    },
+    "resources.schemas.bar": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "catalog_name": "mycatalog",
+          "name": "dev_[USERNAME]_myschema"
+        }
+      }
+    },
+    "resources.volumes.foo": {
+      "depends_on": [
+        {
+          "node": "resources.schemas.bar",
+          "label": "${resources.schemas.bar.catalog_name}"
+        },
+        {
+          "node": "resources.schemas.bar",
+          "label": "${resources.schemas.bar.name}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "catalog_name": "mycatalog",
+          "name": "myname",
+          "schema_name": "dev_[USERNAME]_myschema",
+          "volume_type": "MANAGED"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resource_deps/resources_var_presets_implicit_deps/out.plan.terraform.json b/acceptance/bundle/resource_deps/resources_var_presets_implicit_deps/out.plan.terraform.json
deleted file mode 100644
index 6dc89725820..00000000000
--- a/acceptance/bundle/resource_deps/resources_var_presets_implicit_deps/out.plan.terraform.json
+++ /dev/null
@@ -1,14 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.mypipeline": {
-      "action": "create"
-    },
-    "resources.schemas.bar": {
-      "action": "create"
-    },
-    "resources.volumes.foo": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resource_deps/resources_var_presets_implicit_deps/out.test.toml b/acceptance/bundle/resource_deps/resources_var_presets_implicit_deps/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resource_deps/resources_var_presets_implicit_deps/out.test.toml
+++ b/acceptance/bundle/resource_deps/resources_var_presets_implicit_deps/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/resources_var_presets_implicit_deps/output.txt b/acceptance/bundle/resource_deps/resources_var_presets_implicit_deps/output.txt
index 87533e080e7..a06cd56eb96 100644
--- a/acceptance/bundle/resource_deps/resources_var_presets_implicit_deps/output.txt
+++ b/acceptance/bundle/resource_deps/resources_var_presets_implicit_deps/output.txt
@@ -27,6 +27,7 @@
       "catalog_name": "${resources.schemas.bar.catalog_name}",
       "name": "myname",
       "schema_name": "${resources.schemas.bar.name}",
+      "volume_path": "/Volumes/mycatalog/dev_[USERNAME]_myschema/myname",
       "volume_type": "MANAGED"
     }
   }
@@ -34,9 +35,11 @@
 
 >>> [CLI] bundle deploy -t dev
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/dev/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created pipelines.mypipeline
+Created schemas.bar
+Created volumes.foo
+Files: 2 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
 
->>> jq -s .[] | select(.path=="/api/2.0/pipelines") | .body.name out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.0/pipelines") | .body.name [OUTPUT_DIR]/out.requests.txt
 "[dev [USERNAME]] pipeline for mycatalog.dev_[USERNAME]_myschema.myname"
diff --git a/acceptance/bundle/resource_deps/resources_var_presets_implicit_deps/script b/acceptance/bundle/resource_deps/resources_var_presets_implicit_deps/script
index 707ca1f347f..13892f9325e 100644
--- a/acceptance/bundle/resource_deps/resources_var_presets_implicit_deps/script
+++ b/acceptance/bundle/resource_deps/resources_var_presets_implicit_deps/script
@@ -1,5 +1,5 @@
 trace $CLI bundle validate -t dev -o json | jq .resources
-$CLI bundle plan -o json -t dev > out.plan.$DATABRICKS_BUNDLE_ENGINE.json
+$CLI bundle plan -o json -t dev | nostamp > out.plan.json
 trace $CLI bundle deploy -t dev
-trace jq -s '.[] | select(.path=="/api/2.0/pipelines") | .body.name' out.requests.txt
-rm out.requests.txt
+trace jq -s '.[] | select(.path=="/api/2.0/pipelines") | .body.name' "$OUT_REQUESTS"
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/resource_deps/run_state_resolution/apps/app/app.py b/acceptance/bundle/resource_deps/run_state_resolution/apps/app/app.py
new file mode 100644
index 00000000000..11b15b1a458
--- /dev/null
+++ b/acceptance/bundle/resource_deps/run_state_resolution/apps/app/app.py
@@ -0,0 +1 @@
+print("hello")
diff --git a/acceptance/bundle/resource_deps/run_state_resolution/apps/databricks.yml b/acceptance/bundle/resource_deps/run_state_resolution/apps/databricks.yml
new file mode 100644
index 00000000000..c87d4bdd4ca
--- /dev/null
+++ b/acceptance/bundle/resource_deps/run_state_resolution/apps/databricks.yml
@@ -0,0 +1,25 @@
+bundle:
+  name: test-bundle
+
+resources:
+  apps:
+    foo:
+      name: foo
+      source_code_path: ./app
+      # This reference must be resolved against state before the app is deployed on run.
+      resources:
+        - name: bar
+          job:
+            id: ${resources.jobs.bar.id}
+            permission: CAN_MANAGE_RUN
+  jobs:
+    bar:
+      name: bar
+    unrelated_job:
+      name: unrelated_job
+      tasks:
+        - task_key: run_baz
+          run_job_task:
+            job_id: ${resources.jobs.baz.id}
+    baz:
+      name: baz
diff --git a/acceptance/bundle/resource_deps/run_state_resolution/apps/out.test.toml b/acceptance/bundle/resource_deps/run_state_resolution/apps/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resource_deps/run_state_resolution/apps/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/run_state_resolution/apps/output.txt b/acceptance/bundle/resource_deps/run_state_resolution/apps/output.txt
new file mode 100644
index 00000000000..4fcc439cc6a
--- /dev/null
+++ b/acceptance/bundle/resource_deps/run_state_resolution/apps/output.txt
@@ -0,0 +1,17 @@
+
+>>> [CLI] bundle deploy --select foo,bar --auto-approve
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created apps.foo
+Created jobs.bar
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged, 2 not selected
+
+>>> [CLI] bundle run foo
+✓ Getting the status of the app foo
+✓ App is in UNAVAILABLE state
+✓ App compute is in STOPPED state
+✓ Starting the app foo
+✓ App is starting...
+✓ App is started!
+✓ Deployment succeeded
+You can access the app at foo-123.cloud.databricksapps.com
diff --git a/acceptance/bundle/resource_deps/run_state_resolution/apps/script b/acceptance/bundle/resource_deps/run_state_resolution/apps/script
new file mode 100644
index 00000000000..eb0e3b34acc
--- /dev/null
+++ b/acceptance/bundle/resource_deps/run_state_resolution/apps/script
@@ -0,0 +1,5 @@
+trace $CLI bundle deploy --select foo,bar --auto-approve
+# The app's ${resources.jobs.bar.id} reference IS resolved here (bar is deployed). bundle
+# run resolves references only within the app being run, so unrelated_job's reference to the
+# not-deployed baz is left untouched and no longer breaks the run.
+trace $CLI bundle run foo
diff --git a/acceptance/bundle/resource_deps/run_state_resolution/jobs/databricks.yml b/acceptance/bundle/resource_deps/run_state_resolution/jobs/databricks.yml
new file mode 100644
index 00000000000..4363677359f
--- /dev/null
+++ b/acceptance/bundle/resource_deps/run_state_resolution/jobs/databricks.yml
@@ -0,0 +1,15 @@
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    foo:
+      name: foo
+    bar:
+      name: bar
+    unrelated_job:
+      name: unrelated_job
+      tasks:
+        - task_key: run_bar
+          run_job_task:
+            job_id: ${resources.jobs.bar.id}
diff --git a/acceptance/bundle/resource_deps/run_state_resolution/jobs/out.test.toml b/acceptance/bundle/resource_deps/run_state_resolution/jobs/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resource_deps/run_state_resolution/jobs/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/run_state_resolution/jobs/output.txt b/acceptance/bundle/resource_deps/run_state_resolution/jobs/output.txt
new file mode 100644
index 00000000000..51d09a97042
--- /dev/null
+++ b/acceptance/bundle/resource_deps/run_state_resolution/jobs/output.txt
@@ -0,0 +1,12 @@
+
+>>> [CLI] bundle deploy --select jobs.foo --auto-approve
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created jobs.foo
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged, 2 not selected
+
+>>> [CLI] bundle run foo
+Run URL: [DATABRICKS_URL]/jobs/[FOO_ID]/runs/[RUN_ID]?o=[WORKSPACE_ID]
+
+[TIMESTAMP] "foo" RUNNING
+[TIMESTAMP] "foo" TERMINATED SUCCESS
diff --git a/acceptance/bundle/resource_deps/run_state_resolution/jobs/script b/acceptance/bundle/resource_deps/run_state_resolution/jobs/script
new file mode 100644
index 00000000000..e5f979967c6
--- /dev/null
+++ b/acceptance/bundle/resource_deps/run_state_resolution/jobs/script
@@ -0,0 +1,5 @@
+trace $CLI bundle deploy --select jobs.foo --auto-approve
+replace_ids.py
+# bundle run resolves ${resources.*} only within the resource being run, so unrelated_job's
+# reference to the not-deployed bar is left untouched and no longer breaks the run.
+trace $CLI bundle run foo
diff --git a/acceptance/bundle/resource_deps/run_state_resolution/jobs/test.toml b/acceptance/bundle/resource_deps/run_state_resolution/jobs/test.toml
new file mode 100644
index 00000000000..3c887dd20bf
--- /dev/null
+++ b/acceptance/bundle/resource_deps/run_state_resolution/jobs/test.toml
@@ -0,0 +1,3 @@
+[[Repls]]
+Old = '/runs/\d+'
+New = '/runs/[RUN_ID]'
diff --git a/acceptance/bundle/resource_deps/run_state_resolution/pipelines/databricks.yml b/acceptance/bundle/resource_deps/run_state_resolution/pipelines/databricks.yml
new file mode 100644
index 00000000000..939b49d1486
--- /dev/null
+++ b/acceptance/bundle/resource_deps/run_state_resolution/pipelines/databricks.yml
@@ -0,0 +1,19 @@
+bundle:
+  name: test-bundle
+
+resources:
+  pipelines:
+    foo:
+      name: foo
+      libraries:
+        - file:
+            path: pipeline_file.py
+  jobs:
+    bar:
+      name: bar
+    unrelated_job:
+      name: unrelated_job
+      tasks:
+        - task_key: run_bar
+          run_job_task:
+            job_id: ${resources.jobs.bar.id}
diff --git a/acceptance/bundle/resource_deps/run_state_resolution/pipelines/out.test.toml b/acceptance/bundle/resource_deps/run_state_resolution/pipelines/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resource_deps/run_state_resolution/pipelines/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/run_state_resolution/pipelines/output.txt b/acceptance/bundle/resource_deps/run_state_resolution/pipelines/output.txt
new file mode 100644
index 00000000000..d1458911a15
--- /dev/null
+++ b/acceptance/bundle/resource_deps/run_state_resolution/pipelines/output.txt
@@ -0,0 +1,11 @@
+
+>>> [CLI] bundle deploy --select pipelines.foo --auto-approve
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created pipelines.foo
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged, 2 not selected
+
+>>> [CLI] bundle run foo
+Update URL: [DATABRICKS_URL]/#joblist/pipelines/[UUID]/updates/[UUID]
+
+Update ID: [UUID]
diff --git a/acceptance/bundle/resource_deps/run_state_resolution/pipelines/pipeline_file.py b/acceptance/bundle/resource_deps/run_state_resolution/pipelines/pipeline_file.py
new file mode 100644
index 00000000000..5aec93751bc
--- /dev/null
+++ b/acceptance/bundle/resource_deps/run_state_resolution/pipelines/pipeline_file.py
@@ -0,0 +1 @@
+# placeholder pipeline source
diff --git a/acceptance/bundle/resource_deps/run_state_resolution/pipelines/script b/acceptance/bundle/resource_deps/run_state_resolution/pipelines/script
new file mode 100644
index 00000000000..48b9ae609cd
--- /dev/null
+++ b/acceptance/bundle/resource_deps/run_state_resolution/pipelines/script
@@ -0,0 +1,4 @@
+trace $CLI bundle deploy --select pipelines.foo --auto-approve
+# bundle run resolves ${resources.*} only within the resource being run, so unrelated_job's
+# reference to the not-deployed bar is left untouched and no longer breaks the run.
+trace $CLI bundle run foo
diff --git a/acceptance/bundle/resource_deps/run_state_resolution/test.toml b/acceptance/bundle/resource_deps/run_state_resolution/test.toml
new file mode 100644
index 00000000000..201b14705db
--- /dev/null
+++ b/acceptance/bundle/resource_deps/run_state_resolution/test.toml
@@ -0,0 +1,3 @@
+# These tests exercise `bundle run`, which (unlike validate/deploy) resolves
+# ${resources.*} references against deployment state. --select is direct-engine only.
+RecordRequests = false
diff --git a/acceptance/bundle/resource_deps/tf_path_only_error/databricks.yml b/acceptance/bundle/resource_deps/tf_path_only_error/databricks.yml
new file mode 100644
index 00000000000..358b9dceb4e
--- /dev/null
+++ b/acceptance/bundle/resource_deps/tf_path_only_error/databricks.yml
@@ -0,0 +1,10 @@
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    src:
+      name: source
+    dst:
+      # "always_running" is a Terraform-only field with no DABs equivalent.
+      name: ${resources.jobs.src.always_running}
diff --git a/acceptance/bundle/resource_deps/tf_path_only_error/out.deploy.txt b/acceptance/bundle/resource_deps/tf_path_only_error/out.deploy.txt
new file mode 100644
index 00000000000..b48f8b3cc25
--- /dev/null
+++ b/acceptance/bundle/resource_deps/tf_path_only_error/out.deploy.txt
@@ -0,0 +1,5 @@
+Error: "resources.jobs.src.always_running": Terraform-only field; cross-resource references to Terraform-only fields are not supported by the direct engine
+  in databricks.yml:10:13
+
+
+Exit code: 1
diff --git a/acceptance/bundle/resource_deps/tf_path_only_error/out.plan.txt b/acceptance/bundle/resource_deps/tf_path_only_error/out.plan.txt
new file mode 100644
index 00000000000..b48f8b3cc25
--- /dev/null
+++ b/acceptance/bundle/resource_deps/tf_path_only_error/out.plan.txt
@@ -0,0 +1,5 @@
+Error: "resources.jobs.src.always_running": Terraform-only field; cross-resource references to Terraform-only fields are not supported by the direct engine
+  in databricks.yml:10:13
+
+
+Exit code: 1
diff --git a/acceptance/bundle/resource_deps/tf_path_only_error/out.telemetry.txt b/acceptance/bundle/resource_deps/tf_path_only_error/out.telemetry.txt
new file mode 100644
index 00000000000..f9aa960d00f
--- /dev/null
+++ b/acceptance/bundle/resource_deps/tf_path_only_error/out.telemetry.txt
@@ -0,0 +1,6 @@
+experimental.use_legacy_run_as false
+has_tf_only_references true
+local.cache.attempt true
+local.cache.hit true
+presets_name_prefix_is_set false
+run_as_set false
diff --git a/acceptance/bundle/resource_deps/tf_path_only_error/out.test.toml b/acceptance/bundle/resource_deps/tf_path_only_error/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resource_deps/tf_path_only_error/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/tf_path_only_error/out.validate-terraform-env.txt b/acceptance/bundle/resource_deps/tf_path_only_error/out.validate-terraform-env.txt
new file mode 100644
index 00000000000..0adce33789d
--- /dev/null
+++ b/acceptance/bundle/resource_deps/tf_path_only_error/out.validate-terraform-env.txt
@@ -0,0 +1,9 @@
+Error: the Terraform deployment engine has been removed in Databricks CLI v1.20.0
+
+Unset the DATABRICKS_BUNDLE_ENGINE environment variable (or set it to "direct") to deploy with the direct engine; existing Terraform state is migrated automatically. To keep using Terraform, revert to Databricks CLI v1.19.x.
+See https://docs.databricks.com/dev-tools/bundles/direct for details
+
+Name: test-bundle
+Target: default
+
+Found 1 error
diff --git a/acceptance/bundle/resource_deps/tf_path_only_error/out.validate.txt b/acceptance/bundle/resource_deps/tf_path_only_error/out.validate.txt
new file mode 100644
index 00000000000..a100e759153
--- /dev/null
+++ b/acceptance/bundle/resource_deps/tf_path_only_error/out.validate.txt
@@ -0,0 +1,12 @@
+Error: "resources.jobs.src.always_running": Terraform-only field; cross-resource references to Terraform-only fields are not supported by the direct engine
+  in databricks.yml:10:13
+
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Found 1 error
+
+Exit code: 1
diff --git a/acceptance/selftest/envoutput/output.txt b/acceptance/bundle/resource_deps/tf_path_only_error/output.txt
similarity index 100%
rename from acceptance/selftest/envoutput/output.txt
rename to acceptance/bundle/resource_deps/tf_path_only_error/output.txt
diff --git a/acceptance/bundle/resource_deps/tf_path_only_error/script b/acceptance/bundle/resource_deps/tf_path_only_error/script
new file mode 100644
index 00000000000..4387cf756d9
--- /dev/null
+++ b/acceptance/bundle/resource_deps/tf_path_only_error/script
@@ -0,0 +1,8 @@
+errcode $CLI bundle validate > out.validate.txt 2>&1
+errcode $CLI bundle plan > out.plan.txt 2>&1
+errcode $CLI bundle deploy > out.deploy.txt 2>&1
+print_telemetry_bool_values > out.telemetry.txt
+rm "$OUT_REQUESTS"
+
+# The engine removal error comes before the Terraform-only reference error.
+DATABRICKS_BUNDLE_ENGINE=terraform musterr $CLI bundle validate > out.validate-terraform-env.txt 2>&1
diff --git a/acceptance/bundle/resource_deps/tf_path_only_error/test.toml b/acceptance/bundle/resource_deps/tf_path_only_error/test.toml
new file mode 100644
index 00000000000..159efe02696
--- /dev/null
+++ b/acceptance/bundle/resource_deps/tf_path_only_error/test.toml
@@ -0,0 +1 @@
+RecordRequests = true
diff --git a/acceptance/bundle/resource_deps/tf_path_renames/databricks.yml b/acceptance/bundle/resource_deps/tf_path_renames/databricks.yml
new file mode 100644
index 00000000000..ef6cf213871
--- /dev/null
+++ b/acceptance/bundle/resource_deps/tf_path_renames/databricks.yml
@@ -0,0 +1,38 @@
+bundle:
+  name: test-bundle
+
+resources:
+  pipelines:
+    src_pipeline:
+      name: source-pipeline
+      clusters:
+        - label: mycluster
+          num_workers: 1
+
+  jobs:
+    src_git:
+      name: src-git
+      git_source:
+        git_branch: main
+        git_url: https://github.com/databricks/cli
+        git_provider: gitHub
+    dst_git:
+      # "git_source[0].branch": git_source is a TF list-block ([0] required),
+      # "branch" is the TF field name for DABs "git_branch".
+      name: ${resources.jobs.src_git.git_source[0].branch}
+
+    src_tasks:
+      name: src-tasks
+      tasks:
+        - task_key: main
+          libraries:
+            - whl: /path/to/wheel.whl
+          notebook_task:
+            notebook_path: /Workspace/notebook
+    dst_tasks:
+      # "task[0].library[0].whl": "task" → "tasks", "library" → "libraries" (two renames).
+      name: ${resources.jobs.src_tasks.task[0].library[0].whl}
+
+    dst_pipeline:
+      # "cluster[0].label": "cluster" is TF name for DABs "clusters" on pipelines.
+      name: ${resources.pipelines.src_pipeline.cluster[0].label}
diff --git a/acceptance/bundle/resource_deps/tf_path_renames/out.plan.json b/acceptance/bundle/resource_deps/tf_path_renames/out.plan.json
new file mode 100644
index 00000000000..c46771a4cad
--- /dev/null
+++ b/acceptance/bundle/resource_deps/tf_path_renames/out.plan.json
@@ -0,0 +1,152 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.jobs.dst_git": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.src_git",
+          "label": "${resources.jobs.src_git.git_source[0].branch}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "main",
+          "queue": {
+            "enabled": true
+          }
+        }
+      }
+    },
+    "resources.jobs.dst_pipeline": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.src_pipeline",
+          "label": "${resources.pipelines.src_pipeline.cluster[0].label}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "mycluster",
+          "queue": {
+            "enabled": true
+          }
+        }
+      }
+    },
+    "resources.jobs.dst_tasks": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.src_tasks",
+          "label": "${resources.jobs.src_tasks.task[0].library[0].whl}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "/path/to/wheel.whl",
+          "queue": {
+            "enabled": true
+          }
+        }
+      }
+    },
+    "resources.jobs.src_git": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "git_source": {
+            "git_branch": "main",
+            "git_provider": "gitHub",
+            "git_url": "https://github.com/databricks/cli"
+          },
+          "max_concurrent_runs": 1,
+          "name": "src-git",
+          "queue": {
+            "enabled": true
+          }
+        }
+      }
+    },
+    "resources.jobs.src_tasks": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "src-tasks",
+          "queue": {
+            "enabled": true
+          },
+          "tasks": [
+            {
+              "libraries": [
+                {
+                  "whl": "/path/to/wheel.whl"
+                }
+              ],
+              "notebook_task": {
+                "notebook_path": "/Workspace/notebook"
+              },
+              "task_key": "main"
+            }
+          ]
+        }
+      }
+    },
+    "resources.pipelines.src_pipeline": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "channel": "CURRENT",
+          "clusters": [
+            {
+              "label": "mycluster",
+              "num_workers": 1
+            }
+          ],
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edition": "ADVANCED",
+          "name": "source-pipeline"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resource_deps/tf_path_renames/out.test.toml b/acceptance/bundle/resource_deps/tf_path_renames/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resource_deps/tf_path_renames/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/tf_path_renames/output.txt b/acceptance/bundle/resource_deps/tf_path_renames/output.txt
new file mode 100644
index 00000000000..12452a33b14
--- /dev/null
+++ b/acceptance/bundle/resource_deps/tf_path_renames/output.txt
@@ -0,0 +1,18 @@
+
+>>> [CLI] bundle plan -o json
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created jobs.dst_git
+Created jobs.dst_pipeline
+Created jobs.dst_tasks
+Created jobs.src_git
+Created jobs.src_tasks
+Created pipelines.src_pipeline
+Files: 2 uploaded, 0 deleted
+Resources: 6 created, 0 changed, 0 deleted, 0 unchanged
+/path/to/wheel.whl
+main
+mycluster
+src-git
+src-tasks
diff --git a/acceptance/bundle/resource_deps/tf_path_renames/script b/acceptance/bundle/resource_deps/tf_path_renames/script
new file mode 100644
index 00000000000..3d50a5ac7a7
--- /dev/null
+++ b/acceptance/bundle/resource_deps/tf_path_renames/script
@@ -0,0 +1,3 @@
+trace $CLI bundle plan -o json | nostamp > out.plan.json
+trace $CLI bundle deploy
+print_requests.py //jobs | jq -rs '[.[].body.name] | sort[]'
diff --git a/acceptance/bundle/resource_deps/underscore_key_reference/databricks.yml b/acceptance/bundle/resource_deps/underscore_key_reference/databricks.yml
new file mode 100644
index 00000000000..9bfba5abe3f
--- /dev/null
+++ b/acceptance/bundle/resource_deps/underscore_key_reference/databricks.yml
@@ -0,0 +1,16 @@
+bundle:
+  name: test-bundle
+
+# Reproduce: resource keys with a leading underscore caused "cannot parse" on the
+# direct engine because the reference regex required segments to start with a letter.
+resources:
+  jobs:
+    _job:
+      name: leading underscore
+      permissions:
+        - level: CAN_VIEW
+          group_name: users
+    _asset-bundle-deploymentjob:
+      name: leading underscore with hyphens
+    ref:
+      name: "a=${resources.jobs._job.id} b=${resources.jobs._asset-bundle-deploymentjob.id}"
diff --git a/acceptance/bundle/resource_deps/underscore_key_reference/out.test.toml b/acceptance/bundle/resource_deps/underscore_key_reference/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resource_deps/underscore_key_reference/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/underscore_key_reference/output.txt b/acceptance/bundle/resource_deps/underscore_key_reference/output.txt
new file mode 100644
index 00000000000..bcb34b27024
--- /dev/null
+++ b/acceptance/bundle/resource_deps/underscore_key_reference/output.txt
@@ -0,0 +1,9 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created jobs._asset-bundle-deploymentjob
+Created jobs._job
+Created jobs._job.permissions
+Created jobs.ref
+Files: 1 uploaded, 0 deleted
+Resources: 4 created, 0 changed, 0 deleted, 0 unchanged
diff --git a/acceptance/bundle/resource_deps/underscore_key_reference/script b/acceptance/bundle/resource_deps/underscore_key_reference/script
new file mode 100644
index 00000000000..68ebb78d775
--- /dev/null
+++ b/acceptance/bundle/resource_deps/underscore_key_reference/script
@@ -0,0 +1 @@
+trace $CLI bundle deploy
diff --git a/acceptance/bundle/resource_deps/underscore_key_reference/test.toml b/acceptance/bundle/resource_deps/underscore_key_reference/test.toml
new file mode 100644
index 00000000000..a030353d571
--- /dev/null
+++ b/acceptance/bundle/resource_deps/underscore_key_reference/test.toml
@@ -0,0 +1 @@
+RecordRequests = false
diff --git a/acceptance/bundle/resource_deps/unicode_reference/databricks.yml b/acceptance/bundle/resource_deps/unicode_reference/databricks.yml
new file mode 100644
index 00000000000..8c1e3c3170c
--- /dev/null
+++ b/acceptance/bundle/resource_deps/unicode_reference/databricks.yml
@@ -0,0 +1,9 @@
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    变量:
+      name: hello
+    foo:
+      name: ${resources.jobs.变量.id}
diff --git a/acceptance/bundle/resource_deps/unicode_reference/out.test.toml b/acceptance/bundle/resource_deps/unicode_reference/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resource_deps/unicode_reference/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/unicode_reference/output.txt b/acceptance/bundle/resource_deps/unicode_reference/output.txt
new file mode 100644
index 00000000000..969eade1b86
--- /dev/null
+++ b/acceptance/bundle/resource_deps/unicode_reference/output.txt
@@ -0,0 +1,38 @@
+
+=== Unicode job names resolve in resources references
+>>> [CLI] bundle validate
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Validation OK!
+
+>>> [CLI] bundle plan
+create jobs.foo
+create jobs.变量
+
+Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created jobs.foo
+Created jobs.变量
+Files: 1 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] bundle summary
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+Resources:
+  Jobs:
+    foo:
+      Name: ${resources.jobs.变量.id}
+      URL:  [DATABRICKS_URL]/jobs/[FOO_ID]?w=[WORKSPACE_ID]
+    变量:
+      Name: hello
+      URL:  [DATABRICKS_URL]/jobs/[变量_ID]?w=[WORKSPACE_ID]
diff --git a/acceptance/bundle/resource_deps/unicode_reference/script b/acceptance/bundle/resource_deps/unicode_reference/script
new file mode 100644
index 00000000000..b16b2154040
--- /dev/null
+++ b/acceptance/bundle/resource_deps/unicode_reference/script
@@ -0,0 +1,6 @@
+title "Unicode job names resolve in resources references"
+trace $CLI bundle validate
+trace $CLI bundle plan
+trace $CLI bundle deploy
+replace_ids.py
+trace $CLI bundle summary
diff --git a/acceptance/bundle/resource_deps/unicode_reference/test.toml b/acceptance/bundle/resource_deps/unicode_reference/test.toml
new file mode 100644
index 00000000000..30937384dac
--- /dev/null
+++ b/acceptance/bundle/resource_deps/unicode_reference/test.toml
@@ -0,0 +1,2 @@
+Badness = "Unicode job names resolve in resources references"
+RecordRequests = false
diff --git a/acceptance/bundle/resource_deps/volume_path_contains_id/databricks.yml b/acceptance/bundle/resource_deps/volume_path_contains_id/databricks.yml
new file mode 100644
index 00000000000..190e9411d01
--- /dev/null
+++ b/acceptance/bundle/resource_deps/volume_path_contains_id/databricks.yml
@@ -0,0 +1,29 @@
+bundle:
+  name: test-bundle
+
+# volume_path is a CLI-only computed field (not API state). When a component
+# (catalog_name, schema_name, name) is an unresolved ${...} reference, it stays
+# embedded in volume_path so it resolves later at plan/deploy.
+#
+# Chain under test: bar.name is a remote value (baz.id), so bar.volume_path is
+# computed at initialize with that reference intact; foo.comment picks up that
+# string and resolves at deploy to the fully-resolved path.
+#
+# baz.id is used instead of baz.storage_location because the resolved value
+# becomes bar's name, and the testserver can't route a name containing the
+# slashes of a storage_location URL.
+resources:
+  volumes:
+    baz:
+      catalog_name: mycatalog
+      schema_name: myschema
+      name: bazname
+    bar:
+      catalog_name: mycatalog
+      schema_name: myschema
+      name: ${resources.volumes.baz.id}
+    foo:
+      catalog_name: mycatalog
+      schema_name: myschema
+      name: fooname
+      comment: ${resources.volumes.bar.volume_path}
diff --git a/acceptance/bundle/resource_deps/volume_path_contains_id/out.deploy.requests.json b/acceptance/bundle/resource_deps/volume_path_contains_id/out.deploy.requests.json
new file mode 100644
index 00000000000..df6294fddfc
--- /dev/null
+++ b/acceptance/bundle/resource_deps/volume_path_contains_id/out.deploy.requests.json
@@ -0,0 +1,31 @@
+{
+  "method": "POST",
+  "path": "/api/2.1/unity-catalog/volumes",
+  "body": {
+    "catalog_name": "mycatalog",
+    "comment": "/Volumes/mycatalog/myschema/mycatalog.myschema.bazname",
+    "name": "fooname",
+    "schema_name": "myschema",
+    "volume_type": "MANAGED"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.1/unity-catalog/volumes",
+  "body": {
+    "catalog_name": "mycatalog",
+    "name": "bazname",
+    "schema_name": "myschema",
+    "volume_type": "MANAGED"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.1/unity-catalog/volumes",
+  "body": {
+    "catalog_name": "mycatalog",
+    "name": "mycatalog.myschema.bazname",
+    "schema_name": "myschema",
+    "volume_type": "MANAGED"
+  }
+}
diff --git a/acceptance/bundle/resource_deps/volume_path_contains_id/out.deploy.txt b/acceptance/bundle/resource_deps/volume_path_contains_id/out.deploy.txt
new file mode 100644
index 00000000000..2cca15035b3
--- /dev/null
+++ b/acceptance/bundle/resource_deps/volume_path_contains_id/out.deploy.txt
@@ -0,0 +1,8 @@
+
+>>> errcode [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created volumes.bar
+Created volumes.baz
+Created volumes.foo
+Files: 3 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
diff --git a/acceptance/bundle/resource_deps/volume_path_contains_id/out.destroy.txt b/acceptance/bundle/resource_deps/volume_path_contains_id/out.destroy.txt
new file mode 100644
index 00000000000..7e9a4dd2263
--- /dev/null
+++ b/acceptance/bundle/resource_deps/volume_path_contains_id/out.destroy.txt
@@ -0,0 +1,16 @@
+The following resources will be deleted:
+  delete resources.volumes.bar
+  delete resources.volumes.baz
+  delete resources.volumes.foo
+
+This action will result in the deletion of the following volumes.
+For managed volumes, the files stored in the volume are also deleted from your
+cloud tenant within 30 days. For external volumes, the metadata about the volume
+is removed from the catalog, but the underlying files are not deleted:
+  delete resources.volumes.bar
+  delete resources.volumes.baz
+  delete resources.volumes.foo
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Destroy: 3 deleted
diff --git a/acceptance/bundle/resource_deps/volume_path_contains_id/out.destroy_requests.json b/acceptance/bundle/resource_deps/volume_path_contains_id/out.destroy_requests.json
new file mode 100644
index 00000000000..b7a38b0bbb4
--- /dev/null
+++ b/acceptance/bundle/resource_deps/volume_path_contains_id/out.destroy_requests.json
@@ -0,0 +1,24 @@
+{
+  "method": "DELETE",
+  "path": "/api/2.1/unity-catalog/volumes/mycatalog.myschema.bazname"
+}
+{
+  "method": "DELETE",
+  "path": "/api/2.1/unity-catalog/volumes/mycatalog.myschema.fooname"
+}
+{
+  "method": "DELETE",
+  "path": "/api/2.1/unity-catalog/volumes/mycatalog.myschema.mycatalog.myschema.bazname"
+}
+{
+  "method": "GET",
+  "path": "/api/2.1/unity-catalog/volumes/mycatalog.myschema.bazname"
+}
+{
+  "method": "GET",
+  "path": "/api/2.1/unity-catalog/volumes/mycatalog.myschema.fooname"
+}
+{
+  "method": "GET",
+  "path": "/api/2.1/unity-catalog/volumes/mycatalog.myschema.mycatalog.myschema.bazname"
+}
diff --git a/acceptance/bundle/resource_deps/volume_path_contains_id/out.plan.json b/acceptance/bundle/resource_deps/volume_path_contains_id/out.plan.json
new file mode 100644
index 00000000000..e4f710635df
--- /dev/null
+++ b/acceptance/bundle/resource_deps/volume_path_contains_id/out.plan.json
@@ -0,0 +1,58 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.volumes.bar": {
+      "depends_on": [
+        {
+          "node": "resources.volumes.baz",
+          "label": "${resources.volumes.baz.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "catalog_name": "mycatalog",
+          "name": "${resources.volumes.baz.id}",
+          "schema_name": "myschema",
+          "volume_type": "MANAGED"
+        },
+        "vars": {
+          "name": "${resources.volumes.baz.id}"
+        }
+      }
+    },
+    "resources.volumes.baz": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "catalog_name": "mycatalog",
+          "name": "bazname",
+          "schema_name": "myschema",
+          "volume_type": "MANAGED"
+        }
+      }
+    },
+    "resources.volumes.foo": {
+      "depends_on": [
+        {
+          "node": "resources.volumes.baz",
+          "label": "${resources.volumes.baz.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "catalog_name": "mycatalog",
+          "comment": "/Volumes/mycatalog/myschema/${resources.volumes.baz.id}",
+          "name": "fooname",
+          "schema_name": "myschema",
+          "volume_type": "MANAGED"
+        },
+        "vars": {
+          "comment": "/Volumes/mycatalog/myschema/${resources.volumes.baz.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resource_deps/volume_path_contains_id/out.test.toml b/acceptance/bundle/resource_deps/volume_path_contains_id/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resource_deps/volume_path_contains_id/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/volume_path_contains_id/output.txt b/acceptance/bundle/resource_deps/volume_path_contains_id/output.txt
new file mode 100644
index 00000000000..8cbd00ede13
--- /dev/null
+++ b/acceptance/bundle/resource_deps/volume_path_contains_id/output.txt
@@ -0,0 +1,35 @@
+
+>>> [CLI] bundle validate -o json
+{
+  "volumes": {
+    "bar": {
+      "catalog_name": "mycatalog",
+      "name": "${resources.volumes.baz.id}",
+      "schema_name": "myschema",
+      "volume_path": "/Volumes/mycatalog/myschema/${resources.volumes.baz.id}",
+      "volume_type": "MANAGED"
+    },
+    "baz": {
+      "catalog_name": "mycatalog",
+      "name": "bazname",
+      "schema_name": "myschema",
+      "volume_path": "/Volumes/mycatalog/myschema/bazname",
+      "volume_type": "MANAGED"
+    },
+    "foo": {
+      "catalog_name": "mycatalog",
+      "comment": "/Volumes/mycatalog/myschema/${resources.volumes.baz.id}",
+      "name": "fooname",
+      "schema_name": "myschema",
+      "volume_path": "/Volumes/mycatalog/myschema/fooname",
+      "volume_type": "MANAGED"
+    }
+  }
+}
+
+>>> [CLI] bundle plan
+create volumes.bar
+create volumes.baz
+create volumes.foo
+
+Plan: 3 to add, 0 to change, 0 to delete, 0 unchanged
diff --git a/acceptance/bundle/resource_deps/volume_path_contains_id/script b/acceptance/bundle/resource_deps/volume_path_contains_id/script
new file mode 100644
index 00000000000..9ce52c2e087
--- /dev/null
+++ b/acceptance/bundle/resource_deps/volume_path_contains_id/script
@@ -0,0 +1,16 @@
+cleanup() {
+    $CLI bundle destroy --auto-approve &> out.destroy.txt
+    print_requests.py --sort --get //unity &> out.destroy_requests.json
+}
+
+trace $CLI bundle validate -o json | jq .resources
+trace $CLI bundle plan
+$CLI bundle plan -o json | nostamp > out.plan.json
+
+trap cleanup EXIT
+trace errcode $CLI bundle deploy &> out.deploy.txt
+
+# bar.name is created from baz.id (resolved during deploy), and foo.comment is
+# created with bar.volume_path, whose embedded baz.id reference also resolves
+# during deploy:
+print_requests.py --sort --get //unity &> out.deploy.requests.json
diff --git a/acceptance/bundle/resource_deps/volume_path_job_ref/databricks.yml.tmpl b/acceptance/bundle/resource_deps/volume_path_job_ref/databricks.yml.tmpl
new file mode 100644
index 00000000000..e4bc6a10eef
--- /dev/null
+++ b/acceptance/bundle/resource_deps/volume_path_job_ref/databricks.yml.tmpl
@@ -0,0 +1,32 @@
+bundle:
+  name: testbundle-${UNIQUE_NAME}
+
+# A job parameter references a bundle-managed volume's computed volume_path.
+# This is the motivating use case from databricks/cli#4233: other resources can
+# refer to ${resources.volumes.<key>.volume_path} instead of hardcoding the UC
+# path.
+#
+# Here the volume's schema_name and name are themselves references to another
+# job's remote creator_user_name, which is only known after deploy. So
+# volume_path is computed at initialize with those references embedded and the
+# whole chain (foo -> data.volume_path -> process) resolves at deploy.
+#
+# This is direct-engine only (the default): Terraform cannot export
+# creator_user_name as an attribute, so the embedded reference is unsupported
+# there. See test.toml for the engine restriction.
+resources:
+  jobs:
+    foo:
+      name: foo-${UNIQUE_NAME}
+
+    process:
+      name: process-${UNIQUE_NAME}
+      parameters:
+        - name: data_path
+          default: ${resources.volumes.data.volume_path}
+
+  volumes:
+    data:
+      catalog_name: main
+      schema_name: ${resources.jobs.foo.creator_user_name}
+      name: ${resources.jobs.foo.creator_user_name}
diff --git a/acceptance/bundle/resource_deps/volume_path_job_ref/out.deploy.requests.json b/acceptance/bundle/resource_deps/volume_path_job_ref/out.deploy.requests.json
new file mode 100644
index 00000000000..bf6b6289b68
--- /dev/null
+++ b/acceptance/bundle/resource_deps/volume_path_job_ref/out.deploy.requests.json
@@ -0,0 +1,40 @@
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/create",
+  "body": {
+    "deployment": {
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/testbundle-[UNIQUE_NAME]/default/state/metadata.json"
+    },
+    "edit_mode": "UI_LOCKED",
+    "format": "MULTI_TASK",
+    "max_concurrent_runs": 1,
+    "name": "foo-[UNIQUE_NAME]",
+    "queue": {
+      "enabled": true
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/create",
+  "body": {
+    "deployment": {
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/testbundle-[UNIQUE_NAME]/default/state/metadata.json"
+    },
+    "edit_mode": "UI_LOCKED",
+    "format": "MULTI_TASK",
+    "max_concurrent_runs": 1,
+    "name": "process-[UNIQUE_NAME]",
+    "parameters": [
+      {
+        "default": "/Volumes/main/[USERNAME]/[USERNAME]",
+        "name": "data_path"
+      }
+    ],
+    "queue": {
+      "enabled": true
+    }
+  }
+}
diff --git a/acceptance/bundle/resource_deps/volume_path_job_ref/out.deploy.txt b/acceptance/bundle/resource_deps/volume_path_job_ref/out.deploy.txt
new file mode 100644
index 00000000000..a390ac8daa6
--- /dev/null
+++ b/acceptance/bundle/resource_deps/volume_path_job_ref/out.deploy.txt
@@ -0,0 +1,8 @@
+
+>>> errcode [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/testbundle-[UNIQUE_NAME]/default/files...
+Created jobs.foo
+Created jobs.process
+Created volumes.data
+Files: 4 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
diff --git a/acceptance/bundle/resource_deps/volume_path_job_ref/out.plan.json b/acceptance/bundle/resource_deps/volume_path_job_ref/out.plan.json
new file mode 100644
index 00000000000..ed268732a02
--- /dev/null
+++ b/acceptance/bundle/resource_deps/volume_path_job_ref/out.plan.json
@@ -0,0 +1,78 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.jobs.foo": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/testbundle-[UNIQUE_NAME]/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "foo-[UNIQUE_NAME]",
+          "queue": {
+            "enabled": true
+          }
+        }
+      }
+    },
+    "resources.jobs.process": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.foo",
+          "label": "${resources.jobs.foo.creator_user_name}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/testbundle-[UNIQUE_NAME]/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "process-[UNIQUE_NAME]",
+          "parameters": [
+            {
+              "default": "/Volumes/main/${resources.jobs.foo.creator_user_name}/${resources.jobs.foo.creator_user_name}",
+              "name": "data_path"
+            }
+          ],
+          "queue": {
+            "enabled": true
+          }
+        },
+        "vars": {
+          "parameters[0].default": "/Volumes/main/${resources.jobs.foo.creator_user_name}/${resources.jobs.foo.creator_user_name}"
+        }
+      }
+    },
+    "resources.volumes.data": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.foo",
+          "label": "${resources.jobs.foo.creator_user_name}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "catalog_name": "main",
+          "name": "${resources.jobs.foo.creator_user_name}",
+          "schema_name": "${resources.jobs.foo.creator_user_name}",
+          "volume_type": "MANAGED"
+        },
+        "vars": {
+          "name": "${resources.jobs.foo.creator_user_name}",
+          "schema_name": "${resources.jobs.foo.creator_user_name}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resource_deps/volume_path_job_ref/out.test.toml b/acceptance/bundle/resource_deps/volume_path_job_ref/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resource_deps/volume_path_job_ref/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resource_deps/volume_path_job_ref/output.txt b/acceptance/bundle/resource_deps/volume_path_job_ref/output.txt
new file mode 100644
index 00000000000..b4cbd222f25
--- /dev/null
+++ b/acceptance/bundle/resource_deps/volume_path_job_ref/output.txt
@@ -0,0 +1,47 @@
+
+>>> [CLI] bundle validate -o json
+{
+  "foo": {
+    "deployment": {
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/testbundle-[UNIQUE_NAME]/default/state/metadata.json"
+    },
+    "edit_mode": "UI_LOCKED",
+    "format": "MULTI_TASK",
+    "max_concurrent_runs": 1,
+    "name": "foo-[UNIQUE_NAME]",
+    "queue": {
+      "enabled": true
+    }
+  },
+  "process": {
+    "deployment": {
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/testbundle-[UNIQUE_NAME]/default/state/metadata.json"
+    },
+    "edit_mode": "UI_LOCKED",
+    "format": "MULTI_TASK",
+    "max_concurrent_runs": 1,
+    "name": "process-[UNIQUE_NAME]",
+    "parameters": [
+      {
+        "default": "/Volumes/main/${resources.jobs.foo.creator_user_name}/${resources.jobs.foo.creator_user_name}",
+        "name": "data_path"
+      }
+    ],
+    "queue": {
+      "enabled": true
+    }
+  }
+}
+{
+  "data": {
+    "catalog_name": "main",
+    "name": "${resources.jobs.foo.creator_user_name}",
+    "schema_name": "${resources.jobs.foo.creator_user_name}",
+    "volume_path": "/Volumes/main/${resources.jobs.foo.creator_user_name}/${resources.jobs.foo.creator_user_name}",
+    "volume_type": "MANAGED"
+  }
+}
+
+>>> print_requests.py --nostamp //jobs
diff --git a/acceptance/bundle/resource_deps/volume_path_job_ref/script b/acceptance/bundle/resource_deps/volume_path_job_ref/script
new file mode 100644
index 00000000000..5298fc9cae6
--- /dev/null
+++ b/acceptance/bundle/resource_deps/volume_path_job_ref/script
@@ -0,0 +1,16 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+mkdir -p .databricks
+trace $CLI bundle validate -o json | nostamp | jq '.resources.jobs, .resources.volumes'
+
+# The job's data_path default references the volume's computed volume_path.
+# Record the JSON plan per engine to confirm the reference is resolved into the
+# planned new_state rather than left as ${resources...}.
+# Untraced: with &> the trace header lands in the file, leaving it unfilterable. Capture the raw
+# plan aside and stamp it out into the golden instead.
+errcode $CLI bundle plan -o json &> .databricks/tmp.plan.json
+nostamp < .databricks/tmp.plan.json > out.plan.json
+
+# Deploy and inspect the create-job request: the parameter default sent to
+# the Jobs API must be the interpolated volume_path.
+trace errcode $CLI bundle deploy &> out.deploy.txt
+trace print_requests.py --nostamp //jobs > out.deploy.requests.json
diff --git a/acceptance/bundle/resource_deps/volume_path_job_ref/test.toml b/acceptance/bundle/resource_deps/volume_path_job_ref/test.toml
new file mode 100644
index 00000000000..f4accc4579d
--- /dev/null
+++ b/acceptance/bundle/resource_deps/volume_path_job_ref/test.toml
@@ -0,0 +1,7 @@
+RecordRequests = true
+
+# Direct-engine only: this scenario embeds a reference to a remote field
+# (jobs.foo.creator_user_name, known only after deploy) into volume_path. The
+# direct engine resolves it at deploy; Terraform cannot export that attribute,
+# so the case is unsupported there (see CHANGELOG.md). Direct is the
+# default engine, so the motivating use case works out of the box.
diff --git a/acceptance/bundle/resources/alerts/basic/out.test.toml b/acceptance/bundle/resources/alerts/basic/out.test.toml
index c45d8e76a8e..44f7ede3514 100644
--- a/acceptance/bundle/resources/alerts/basic/out.test.toml
+++ b/acceptance/bundle/resources/alerts/basic/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 RunsOnDbr = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/alerts/basic/output.txt b/acceptance/bundle/resources/alerts/basic/output.txt
index 3a0c3cb7e37..3944c2a21ff 100644
--- a/acceptance/bundle/resources/alerts/basic/output.txt
+++ b/acceptance/bundle/resources/alerts/basic/output.txt
@@ -1,9 +1,10 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/alerts-basic-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created alerts.myalert
+Created alerts.myalert.permissions
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] alerts-v2 get-alert [ALERT_ID]
 {
@@ -58,8 +59,7 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/alerts-basic-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
 
 >>> [CLI] alerts-v2 get-alert [ALERT_ID]
 Error: Alert with ID '[ALERT_ID]' does not exist.
diff --git a/acceptance/bundle/resources/alerts/basic/script b/acceptance/bundle/resources/alerts/basic/script
index e8e4427e261..e47c734d1bd 100644
--- a/acceptance/bundle/resources/alerts/basic/script
+++ b/acceptance/bundle/resources/alerts/basic/script
@@ -4,7 +4,7 @@ trace $CLI bundle deploy
 
 alert_id=$($CLI bundle summary --output json | jq -r '.resources.alerts.myalert.id')
 
-echo "$alert_id:ALERT_ID" >> ACC_REPLS
+add_repl "$alert_id" ALERT_ID
 
 trace $CLI alerts-v2 get-alert $alert_id | jq '{display_name, lifecycle_state, custom_summary, evaluation, query_text, schedule, warehouse_id}'
 
diff --git a/acceptance/bundle/resources/alerts/basic/test.toml b/acceptance/bundle/resources/alerts/basic/test.toml
index 201cbfc6582..4ae6a3cb866 100644
--- a/acceptance/bundle/resources/alerts/basic/test.toml
+++ b/acceptance/bundle/resources/alerts/basic/test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 RecordRequests = false
 Ignore = [".databricks"]
diff --git a/acceptance/bundle/resources/alerts/with_file/out.test.toml b/acceptance/bundle/resources/alerts/with_file/out.test.toml
index 650836edeb3..0f167effef1 100644
--- a/acceptance/bundle/resources/alerts/with_file/out.test.toml
+++ b/acceptance/bundle/resources/alerts/with_file/out.test.toml
@@ -1,3 +1,2 @@
-Local = false
 Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/alerts/with_file/output.txt b/acceptance/bundle/resources/alerts/with_file/output.txt
index 2f89acfae88..637a6291c19 100644
--- a/acceptance/bundle/resources/alerts/with_file/output.txt
+++ b/acceptance/bundle/resources/alerts/with_file/output.txt
@@ -33,9 +33,9 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/alerts-with-file-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created alerts.myalert
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] alerts-v2 get-alert [ALERT_ID]
 {
@@ -70,7 +70,7 @@ Deployment complete!
 === assert that the uploaded alert file is the same as the local one
 >>> [CLI] workspace export /Workspace/Users/[USERNAME]/.bundle/alerts-with-file-[UNIQUE_NAME]/default/resources/myalert.dbalert.json
 
->>> diff exported_alert.dbalert.json alert.dbalert.json --strip-trailing-cr
+>>> diff local_normalized.json exported_normalized.json
 
 >>> [CLI] alerts-v2 get-alert [ALERT_ID]
 {
@@ -96,5 +96,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/alerts-with-file-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/alerts/with_file/script b/acceptance/bundle/resources/alerts/with_file/script
index 69209ba2d51..02a51e6d2cb 100755
--- a/acceptance/bundle/resources/alerts/with_file/script
+++ b/acceptance/bundle/resources/alerts/with_file/script
@@ -12,15 +12,21 @@ trace $CLI bundle deploy
 
 alert_id=$($CLI bundle summary --output json | jq -r '.resources.alerts.myalert.id')
 
-echo "$alert_id:ALERT_ID" >> ACC_REPLS
+add_repl "$alert_id" ALERT_ID
 
 trace $CLI alerts-v2 get-alert $alert_id | jq '{display_name, lifecycle_state, custom_summary, evaluation, query_text, schedule, warehouse_id}'
 
 alert_path=$($CLI bundle summary --output json | jq -r '.resources.alerts.myalert.parent_path')/myalert.dbalert.json
 title "assert that the uploaded alert file is the same as the local one"
 trace $CLI workspace export $alert_path > exported_alert.dbalert.json
-trace diff exported_alert.dbalert.json alert.dbalert.json --strip-trailing-cr
-rm exported_alert.dbalert.json
+# The backend re-serializes the alert file when materializing it in the workspace
+# (different key order, and numbers like 2.0 vs 2), so compare canonically with
+# sorted keys and normalized numbers rather than byte-for-byte.
+normalize_json() { jq -S 'walk(if type == "number" then . + 0 else . end)' "$1"; }
+normalize_json exported_alert.dbalert.json > exported_normalized.json
+normalize_json alert.dbalert.json > local_normalized.json
+trace diff local_normalized.json exported_normalized.json
+rm exported_alert.dbalert.json exported_normalized.json local_normalized.json
 
 trace $CLI alerts-v2 get-alert $alert_id | jq '{display_name, lifecycle_state}'
 
diff --git a/acceptance/bundle/resources/alerts/with_file/test.toml b/acceptance/bundle/resources/alerts/with_file/test.toml
index 487005b9ae5..3f3a5baee48 100644
--- a/acceptance/bundle/resources/alerts/with_file/test.toml
+++ b/acceptance/bundle/resources/alerts/with_file/test.toml
@@ -1,4 +1,3 @@
-Local = false
 Cloud = true
 RecordRequests = false
 Ignore = [".databricks"]
@@ -8,17 +7,13 @@ Ignore = [".databricks"]
 # See: https://github.com/databricks/cli/issues/4221
 TimeoutCloud = "5m"
 
-# redact ?o=[NUMID]. Different clouds can have different URL serialization, like [DATABRICKS_URL]/sql/alerts-v2/[ALERT_ID] vs [DATABRICKS_URL]/sql/alerts-v2/[ALERT_ID]?o=[NUMID].
-[[Repls]]
-Old = '\?o=\d+'
-New = ''
-Order = 0
-
-[EnvMatrix]
-  DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
-
-[Env]
 # MSYS2 automatically converts absolute paths like /Users/$username/$UNIQUE_NAME to
 # C:/Program Files/Git/Users/$username/UNIQUE_NAME before passing it to the CLI
 # Setting this environment variable prevents that conversion on windows.
-MSYS_NO_PATHCONV = "1"
+Env.MSYS_NO_PATHCONV = "1"
+
+# redact ?[ow]=[WORKSPACE_ID]. Different clouds can have different URL serialization, like [DATABRICKS_URL]/sql/alerts-v2/[ALERT_ID] vs [DATABRICKS_URL]/sql/alerts-v2/[ALERT_ID]?o=[WORKSPACE_ID].
+[[Repls]]
+Old = '\?[ow]=\[WORKSPACE_ID\]'
+New = ''
+Order = 1000
diff --git a/acceptance/bundle/resources/alerts/with_file_not_allowed_field_error/out.test.toml b/acceptance/bundle/resources/alerts/with_file_not_allowed_field_error/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/alerts/with_file_not_allowed_field_error/out.test.toml
+++ b/acceptance/bundle/resources/alerts/with_file_not_allowed_field_error/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/alerts/with_file_not_allowed_field_error/test.toml b/acceptance/bundle/resources/alerts/with_file_not_allowed_field_error/test.toml
index 5319b27bfce..e1290bad9f4 100644
--- a/acceptance/bundle/resources/alerts/with_file_not_allowed_field_error/test.toml
+++ b/acceptance/bundle/resources/alerts/with_file_not_allowed_field_error/test.toml
@@ -1,3 +1,2 @@
-Local = true
 RecordRequests = false
 Ignore = [".databricks"]
diff --git a/acceptance/bundle/resources/alerts/with_file_run_from_subdir/databricks.yml b/acceptance/bundle/resources/alerts/with_file_run_from_subdir/databricks.yml
new file mode 100644
index 00000000000..e09d7cc84da
--- /dev/null
+++ b/acceptance/bundle/resources/alerts/with_file_run_from_subdir/databricks.yml
@@ -0,0 +1,5 @@
+bundle:
+  name: alerts-with-file-run-from-subdir
+
+include:
+  - resources/*.yml
diff --git a/acceptance/bundle/resources/alerts/with_file_run_from_subdir/out.test.toml b/acceptance/bundle/resources/alerts/with_file_run_from_subdir/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/alerts/with_file_run_from_subdir/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/alerts/with_file_run_from_subdir/output.txt b/acceptance/bundle/resources/alerts/with_file_run_from_subdir/output.txt
new file mode 100644
index 00000000000..af27a587c49
--- /dev/null
+++ b/acceptance/bundle/resources/alerts/with_file_run_from_subdir/output.txt
@@ -0,0 +1,66 @@
+
+=== validate from the bundle root
+>>> [CLI] bundle validate -o json
+{
+  "custom_summary": "My alert from file",
+  "display_name": "myalert",
+  "evaluation": {
+    "comparison_operator": "EQUAL",
+    "notification": {
+      "notify_on_ok": false,
+      "retrigger_seconds": 1
+    },
+    "source": {
+      "aggregation": "MAX",
+      "display": "1",
+      "name": "1"
+    },
+    "threshold": {
+      "value": {
+        "double_value": 2
+      }
+    }
+  },
+  "file_path": "resources/alert.dbalert.json",
+  "parent_path": "/Workspace/Users/[USERNAME]/.bundle/alerts-with-file-run-from-subdir/default/resources",
+  "query_text": "select 2\n",
+  "schedule": {
+    "pause_status": "UNPAUSED",
+    "quartz_cron_schedule": "44 19 */1 * * ?",
+    "timezone_id": "Europe/Amsterdam"
+  },
+  "warehouse_id": "0123456789012345"
+}
+
+=== validate from a subdirectory of the bundle
+>>> [CLI] bundle validate -o json
+{
+  "custom_summary": "My alert from file",
+  "display_name": "myalert",
+  "evaluation": {
+    "comparison_operator": "EQUAL",
+    "notification": {
+      "notify_on_ok": false,
+      "retrigger_seconds": 1
+    },
+    "source": {
+      "aggregation": "MAX",
+      "display": "1",
+      "name": "1"
+    },
+    "threshold": {
+      "value": {
+        "double_value": 2
+      }
+    }
+  },
+  "file_path": "resources/alert.dbalert.json",
+  "parent_path": "/Workspace/Users/[USERNAME]/.bundle/alerts-with-file-run-from-subdir/default/resources",
+  "query_text": "select 2\n",
+  "schedule": {
+    "pause_status": "UNPAUSED",
+    "quartz_cron_schedule": "44 19 */1 * * ?",
+    "timezone_id": "Europe/Amsterdam"
+  },
+  "warehouse_id": "0123456789012345"
+}
diff --git a/acceptance/bundle/resources/alerts/with_file_run_from_subdir/resources/alert.dbalert.json b/acceptance/bundle/resources/alerts/with_file_run_from_subdir/resources/alert.dbalert.json
new file mode 100644
index 00000000000..ed097f13b52
--- /dev/null
+++ b/acceptance/bundle/resources/alerts/with_file_run_from_subdir/resources/alert.dbalert.json
@@ -0,0 +1,28 @@
+{
+  "custom_summary": "My alert from file",
+  "evaluation": {
+    "comparison_operator": "EQUAL",
+    "notification": {
+      "notify_on_ok": false,
+      "retrigger_seconds": 1
+    },
+    "source": {
+      "aggregation": "MAX",
+      "display": "1",
+      "name": "1"
+    },
+    "threshold": {
+      "value": {
+        "double_value": 2
+      }
+    }
+  },
+  "query_lines": [
+    "select 2"
+  ],
+  "schedule": {
+    "pause_status": "UNPAUSED",
+    "quartz_cron_schedule": "44 19 */1 * * ?",
+    "timezone_id": "Europe/Amsterdam"
+  }
+}
diff --git a/acceptance/bundle/resources/alerts/with_file_run_from_subdir/resources/alert.yml b/acceptance/bundle/resources/alerts/with_file_run_from_subdir/resources/alert.yml
new file mode 100644
index 00000000000..5212daae121
--- /dev/null
+++ b/acceptance/bundle/resources/alerts/with_file_run_from_subdir/resources/alert.yml
@@ -0,0 +1,6 @@
+resources:
+  alerts:
+    myalert:
+      warehouse_id: "0123456789012345"
+      display_name: "myalert"
+      file_path: ./alert.dbalert.json
diff --git a/acceptance/bundle/resources/alerts/with_file_run_from_subdir/script b/acceptance/bundle/resources/alerts/with_file_run_from_subdir/script
new file mode 100644
index 00000000000..5d07ea6e971
--- /dev/null
+++ b/acceptance/bundle/resources/alerts/with_file_run_from_subdir/script
@@ -0,0 +1,6 @@
+title "validate from the bundle root"
+trace $CLI bundle validate -o json | jq .resources.alerts.myalert
+
+title "validate from a subdirectory of the bundle"
+cd resources
+trace $CLI bundle validate -o json | jq .resources.alerts.myalert
diff --git a/acceptance/bundle/resources/alerts/with_file_run_from_subdir/test.toml b/acceptance/bundle/resources/alerts/with_file_run_from_subdir/test.toml
new file mode 100644
index 00000000000..e1290bad9f4
--- /dev/null
+++ b/acceptance/bundle/resources/alerts/with_file_run_from_subdir/test.toml
@@ -0,0 +1,2 @@
+RecordRequests = false
+Ignore = [".databricks"]
diff --git a/acceptance/bundle/resources/alerts/with_file_variable_interpolation_error/out.test.toml b/acceptance/bundle/resources/alerts/with_file_variable_interpolation_error/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/alerts/with_file_variable_interpolation_error/out.test.toml
+++ b/acceptance/bundle/resources/alerts/with_file_variable_interpolation_error/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/alerts/with_file_variable_interpolation_error/output.txt b/acceptance/bundle/resources/alerts/with_file_variable_interpolation_error/output.txt
index 8b63705221d..554f9cf1d7e 100644
--- a/acceptance/bundle/resources/alerts/with_file_variable_interpolation_error/output.txt
+++ b/acceptance/bundle/resources/alerts/with_file_variable_interpolation_error/output.txt
@@ -13,5 +13,3 @@ Workspace:
   Path: /Workspace/Users/[USERNAME]/.bundle/alerts-variable-error/default
 
 Found 1 error
-
-Exit code: 1
diff --git a/acceptance/bundle/resources/alerts/with_file_variable_interpolation_error/script b/acceptance/bundle/resources/alerts/with_file_variable_interpolation_error/script
index f52b452ee67..277355fe918 100755
--- a/acceptance/bundle/resources/alerts/with_file_variable_interpolation_error/script
+++ b/acceptance/bundle/resources/alerts/with_file_variable_interpolation_error/script
@@ -1 +1 @@
-errcode trace $CLI bundle validate
+musterr trace $CLI bundle validate
diff --git a/acceptance/bundle/resources/alerts/with_file_variable_interpolation_error/test.toml b/acceptance/bundle/resources/alerts/with_file_variable_interpolation_error/test.toml
index 5319b27bfce..e1290bad9f4 100644
--- a/acceptance/bundle/resources/alerts/with_file_variable_interpolation_error/test.toml
+++ b/acceptance/bundle/resources/alerts/with_file_variable_interpolation_error/test.toml
@@ -1,3 +1,2 @@
-Local = true
 RecordRequests = false
 Ignore = [".databricks"]
diff --git a/acceptance/bundle/resources/apps/config-drift-stopped/app/app.py b/acceptance/bundle/resources/apps/config-drift-stopped/app/app.py
new file mode 100644
index 00000000000..ad1e64f9fb0
--- /dev/null
+++ b/acceptance/bundle/resources/apps/config-drift-stopped/app/app.py
@@ -0,0 +1,5 @@
+import http.server, os
+
+http.server.HTTPServer(
+    ("", int(os.environ["DATABRICKS_APP_PORT"])), http.server.SimpleHTTPRequestHandler
+).serve_forever()
diff --git a/acceptance/bundle/resources/apps/config-drift-stopped/databricks.yml.tmpl b/acceptance/bundle/resources/apps/config-drift-stopped/databricks.yml.tmpl
new file mode 100644
index 00000000000..d6e5da23106
--- /dev/null
+++ b/acceptance/bundle/resources/apps/config-drift-stopped/databricks.yml.tmpl
@@ -0,0 +1,18 @@
+bundle:
+  name: config-drift-stopped-$UNIQUE_NAME
+
+resources:
+  apps:
+    myapp:
+      name: $UNIQUE_NAME
+      description: my_app
+      source_code_path: ./app
+      config:
+        command:
+          - python
+          - app.py
+        env:
+          - name: MY_VAR
+            value: original_value
+      lifecycle:
+        started: true
diff --git a/acceptance/bundle/resources/apps/config-drift-stopped/out.test.toml b/acceptance/bundle/resources/apps/config-drift-stopped/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/apps/config-drift-stopped/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/apps/config-drift-stopped/output.txt b/acceptance/bundle/resources/apps/config-drift-stopped/output.txt
new file mode 100644
index 00000000000..e04d8765834
--- /dev/null
+++ b/acceptance/bundle/resources/apps/config-drift-stopped/output.txt
@@ -0,0 +1,72 @@
+
+=== Deploy with started=true so the app has an active deployment
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/config-drift-stopped-[UNIQUE_NAME]/default/files...
+✓ Deployment succeeded
+Created apps.myapp
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Change config while running: drift is detected (active deployment present)
+>>> update_file.py databricks.yml original_value changed_value
+
+>>> [CLI] bundle plan -o json
+{
+  "config.env[0].value": {
+    "action": "update",
+    "old": "original_value",
+    "new": "changed_value",
+    "remote": "original_value"
+  }
+}
+
+=== Stop the app: the backend clears the active deployment
+>>> [CLI] apps stop [UNIQUE_NAME]
+"STOPPED"
+
+=== Same config change is now skipped: no active deployment to compare against
+>>> [CLI] bundle plan -o json
+{
+  "config": {
+    "action": "skip",
+    "reason": "no active deployment",
+    "old": {
+      "command": [
+        "python",
+        "app.py"
+      ],
+      "env": [
+        {
+          "name": "MY_VAR",
+          "value": "original_value"
+        }
+      ]
+    },
+    "new": {
+      "command": [
+        "python",
+        "app.py"
+      ],
+      "env": [
+        {
+          "name": "MY_VAR",
+          "value": "changed_value"
+        }
+      ]
+    }
+  },
+  "config.env[0].value": {
+    "action": "skip",
+    "reason": "no active deployment",
+    "old": "original_value",
+    "new": "changed_value"
+  }
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.apps.myapp
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/config-drift-stopped-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/apps/config-drift-stopped/script b/acceptance/bundle/resources/apps/config-drift-stopped/script
new file mode 100644
index 00000000000..12903f604fd
--- /dev/null
+++ b/acceptance/bundle/resources/apps/config-drift-stopped/script
@@ -0,0 +1,19 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+title "Deploy with started=true so the app has an active deployment"
+trace $CLI bundle deploy
+
+title "Change config while running: drift is detected (active deployment present)"
+trace update_file.py databricks.yml original_value changed_value
+trace $CLI bundle plan -o json | nostamp | jq '.plan[].changes | with_entries(select(.key | startswith("config")))'
+
+title "Stop the app: the backend clears the active deployment"
+trace $CLI apps stop $UNIQUE_NAME | jq '.compute_status.state'
+
+title "Same config change is now skipped: no active deployment to compare against"
+trace $CLI bundle plan -o json | nostamp | jq '.plan[].changes | with_entries(select(.key | startswith("config")))'
diff --git a/acceptance/bundle/resources/apps/config-drift-stopped/test.toml b/acceptance/bundle/resources/apps/config-drift-stopped/test.toml
new file mode 100644
index 00000000000..4dfeae062b1
--- /dev/null
+++ b/acceptance/bundle/resources/apps/config-drift-stopped/test.toml
@@ -0,0 +1,9 @@
+Cloud = false
+
+# Asserts plan classification, not requests; drop the inherited RecordRequests.
+RecordRequests = false
+
+Ignore = [".databricks", "databricks.yml"]
+
+# Direct engine only: the skip logic lives in OverrideChangeDesc. Mirrors
+# config-no-deployment.
diff --git a/acceptance/bundle/resources/apps/config-drift/out.test.toml b/acceptance/bundle/resources/apps/config-drift/out.test.toml
index e90b6d5d1ba..a927a5fbc06 100644
--- a/acceptance/bundle/resources/apps/config-drift/out.test.toml
+++ b/acceptance/bundle/resources/apps/config-drift/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/apps/config-drift/output.txt b/acceptance/bundle/resources/apps/config-drift/output.txt
index 6ad4310b318..e12c69659fc 100644
--- a/acceptance/bundle/resources/apps/config-drift/output.txt
+++ b/acceptance/bundle/resources/apps/config-drift/output.txt
@@ -1,9 +1,9 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/config-drift-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created apps.myapp
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 === Verify no drift after deploy
 >>> [CLI] bundle plan -o json
@@ -20,9 +20,9 @@ Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
 === Redeploy to fix drift
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/config-drift-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated apps.myapp
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
 === Verify no drift after fix
 >>> [CLI] bundle plan -o json
@@ -33,5 +33,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/config-drift-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/apps/config-drift/script b/acceptance/bundle/resources/apps/config-drift/script
index 4728255dc8f..2385b15675b 100644
--- a/acceptance/bundle/resources/apps/config-drift/script
+++ b/acceptance/bundle/resources/apps/config-drift/script
@@ -2,14 +2,13 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm -f out.requests.txt
 }
 trap cleanup EXIT
 
 trace $CLI bundle deploy
 
 title "Verify no drift after deploy"
-trace $CLI bundle plan -o json | jq '.plan."resources.apps.myapp".changes.config // .plan."resources.apps.myapp".changes' | jq 'del(.[] | select(.action == "skip"))' > out.plan.direct.json
+trace $CLI bundle plan -o json | nostamp | jq '.plan."resources.apps.myapp".changes.config // .plan."resources.apps.myapp".changes' | jq 'del(.[] | select(.action == "skip"))' > out.plan.direct.json
 
 SOURCE_CODE_PATH=$(trace $CLI apps get $UNIQUE_NAME --output json | jq -r '.active_deployment.source_code_path')
 
@@ -27,13 +26,13 @@ $CLI apps deploy $UNIQUE_NAME --no-wait --json '{
 title "Plan should detect config drift"
 trace $CLI bundle plan
 # Skip entries with action "skip"
-$CLI bundle plan -o json | jq '.plan."resources.apps.myapp".changes.config // .plan."resources.apps.myapp".changes' | jq 'del(.[] | select(.action == "skip"))' >> out.plan.direct.json
+$CLI bundle plan -o json | nostamp | jq '.plan."resources.apps.myapp".changes.config // .plan."resources.apps.myapp".changes' | jq 'del(.[] | select(.action == "skip"))' >> out.plan.direct.json
 
 title "Redeploy to fix drift"
 trace $CLI bundle deploy
 
 title "Verify no drift after fix"
-trace $CLI bundle plan -o json | jq '.plan."resources.apps.myapp".changes.config // .plan."resources.apps.myapp".changes' | jq 'del(.[] | select(.action == "skip"))' >> out.plan.direct.json
+trace $CLI bundle plan -o json | nostamp | jq '.plan."resources.apps.myapp".changes.config // .plan."resources.apps.myapp".changes' | jq 'del(.[] | select(.action == "skip"))' >> out.plan.direct.json
 
 # TODO: add test for git_source drift when git_source is supported in the Deploy API
 # Currently it fails with the error: Git source reference is required
diff --git a/acceptance/bundle/resources/apps/config-drift/test.toml b/acceptance/bundle/resources/apps/config-drift/test.toml
index bf01b60b180..05499ff9046 100644
--- a/acceptance/bundle/resources/apps/config-drift/test.toml
+++ b/acceptance/bundle/resources/apps/config-drift/test.toml
@@ -1,6 +1,5 @@
-Local = true
 Cloud = false # This currently fails on Cloud due to incorrect API behaviour.
-RecordRequests = true
+RecordRequests = false
 
 Ignore = [".databricks", "databricks.yml"]
 
@@ -9,6 +8,3 @@ Ignore = [".databricks", "databricks.yml"]
 [[Repls]]
 Old = '(?m)^✓ [^\n]*\n'
 New = ""
-
-[EnvMatrix]
-  DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/resources/apps/config-no-deployment/app/app.py b/acceptance/bundle/resources/apps/config-no-deployment/app/app.py
new file mode 100644
index 00000000000..96fa00a4f14
--- /dev/null
+++ b/acceptance/bundle/resources/apps/config-no-deployment/app/app.py
@@ -0,0 +1,10 @@
+import os
+
+from flask import Flask
+
+app = Flask(__name__)
+
+
+@app.route("/")
+def home():
+    return "Hello from config-no-deployment app!"
diff --git a/acceptance/bundle/resources/apps/config-no-deployment/app/app.yaml b/acceptance/bundle/resources/apps/config-no-deployment/app/app.yaml
new file mode 100644
index 00000000000..61471358dce
--- /dev/null
+++ b/acceptance/bundle/resources/apps/config-no-deployment/app/app.yaml
@@ -0,0 +1,3 @@
+command:
+  - python
+  - app.py
diff --git a/acceptance/bundle/resources/apps/config-no-deployment/databricks.yml b/acceptance/bundle/resources/apps/config-no-deployment/databricks.yml
new file mode 100644
index 00000000000..c730a8d1dd5
--- /dev/null
+++ b/acceptance/bundle/resources/apps/config-no-deployment/databricks.yml
@@ -0,0 +1,14 @@
+bundle:
+  name: app-config-no-deployment
+
+resources:
+  apps:
+    myapp:
+      name: test-app-config-no-deployment
+      description: my_app_description
+      source_code_path: ./app
+      config:
+        command: ["python", "app.py"]
+        env:
+          - name: MY_ENV_VAR
+            value: test_value
diff --git a/acceptance/bundle/resources/apps/config-no-deployment/out.test.toml b/acceptance/bundle/resources/apps/config-no-deployment/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/apps/config-no-deployment/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/apps/config-no-deployment/output.txt b/acceptance/bundle/resources/apps/config-no-deployment/output.txt
new file mode 100644
index 00000000000..4887cf920df
--- /dev/null
+++ b/acceptance/bundle/resources/apps/config-no-deployment/output.txt
@@ -0,0 +1,50 @@
+
+=== Deploy: app created with no_compute; config is not deployed until the app starts
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/app-config-no-deployment/default/files...
+Created apps.myapp
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Plan is a no-op: config/source_code_path drift is skipped while the app has no active deployment
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+=== Both deploy-only fields are skipped with reason "no active deployment"
+>>> [CLI] bundle plan -o json
+{
+  "config": {
+    "action": "skip",
+    "reason": "no active deployment",
+    "old": {
+      "command": [
+        "python",
+        "app.py"
+      ],
+      "env": [
+        {
+          "name": "MY_ENV_VAR",
+          "value": "test_value"
+        }
+      ]
+    },
+    "new": {
+      "command": [
+        "python",
+        "app.py"
+      ],
+      "env": [
+        {
+          "name": "MY_ENV_VAR",
+          "value": "test_value"
+        }
+      ]
+    }
+  },
+  "source_code_path": {
+    "action": "skip",
+    "reason": "no active deployment",
+    "old": "/Workspace/Users/[USERNAME]/.bundle/app-config-no-deployment/default/files/app",
+    "new": "/Workspace/Users/[USERNAME]/.bundle/app-config-no-deployment/default/files/app"
+  }
+}
diff --git a/acceptance/bundle/resources/apps/config-no-deployment/script b/acceptance/bundle/resources/apps/config-no-deployment/script
new file mode 100644
index 00000000000..226d8350b32
--- /dev/null
+++ b/acceptance/bundle/resources/apps/config-no-deployment/script
@@ -0,0 +1,9 @@
+
+title "Deploy: app created with no_compute; config is not deployed until the app starts"
+trace $CLI bundle deploy
+
+title "Plan is a no-op: config/source_code_path drift is skipped while the app has no active deployment"
+trace $CLI bundle plan | contains.py "Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged"
+
+title "Both deploy-only fields are skipped with reason \"no active deployment\""
+trace $CLI bundle plan -o json | nostamp | jq '.plan[].changes | {config, source_code_path}'
diff --git a/acceptance/bundle/resources/apps/config-no-deployment/test.toml b/acceptance/bundle/resources/apps/config-no-deployment/test.toml
new file mode 100644
index 00000000000..d9baa9e54ce
--- /dev/null
+++ b/acceptance/bundle/resources/apps/config-no-deployment/test.toml
@@ -0,0 +1,9 @@
+Cloud = false
+
+# Asserts plan classification, not requests; drop the inherited RecordRequests.
+RecordRequests = false
+
+Ignore = [".databricks"]
+
+# Direct engine only: the skip logic lives in OverrideChangeDesc. Mirrors
+# lifecycle-started-omitted.
diff --git a/acceptance/bundle/resources/apps/create_already_exists/out.test.toml b/acceptance/bundle/resources/apps/create_already_exists/out.test.toml
index e90b6d5d1ba..a927a5fbc06 100644
--- a/acceptance/bundle/resources/apps/create_already_exists/out.test.toml
+++ b/acceptance/bundle/resources/apps/create_already_exists/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/apps/create_already_exists/output.txt b/acceptance/bundle/resources/apps/create_already_exists/output.txt
index e4438d47b04..b8440469192 100644
--- a/acceptance/bundle/resources/apps/create_already_exists/output.txt
+++ b/acceptance/bundle/resources/apps/create_already_exists/output.txt
@@ -2,7 +2,7 @@
 >>> [CLI] apps create test-app-already-exists
 {
   "active_deployment": {
-    "deployment_id": "deploy-[NUMID]",
+    "deployment_id": "[APP_DEPLOYMENT_ID]",
     "source_code_path": "/Workspace/Users/[USERNAME]/test-app-already-exists",
     "status": {
       "message": "Deployment succeeded",
@@ -19,17 +19,17 @@
     "state": "ACTIVE"
   },
   "default_source_code_path": "/Workspace/Users/[USERNAME]/test-app-already-exists",
+  "forward_user_access_token": true,
   "id": "1000",
   "name": "test-app-already-exists",
   "service_principal_client_id": "[UUID]",
-  "service_principal_id": [NUMID],
+  "service_principal_id": [SERVICE_PRINCIPAL_ID],
   "service_principal_name": "app-test-app-already-exists",
   "url": "test-app-already-exists-123.cloud.databricksapps.com"
 }
 
 >>> musterr [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-app-already-exists/default/files...
-Deploying resources...
 Error: cannot create resources.apps.myapp: An app with the same name already exists: test-app-already-exists (409 RESOURCE_ALREADY_EXISTS)
 
 Endpoint: POST [DATABRICKS_URL]/api/2.0/apps?no_compute=true
@@ -37,7 +37,7 @@ HTTP Status: 409 Conflict
 API error_code: RESOURCE_ALREADY_EXISTS
 API message: An app with the same name already exists: test-app-already-exists
 
-Updating deployment state...
+Files: 2 uploaded, 0 deleted
 
 >>> [CLI] apps delete test-app-already-exists
 {
diff --git a/acceptance/bundle/resources/apps/create_already_exists/script b/acceptance/bundle/resources/apps/create_already_exists/script
index df26cb88959..845c56b830d 100644
--- a/acceptance/bundle/resources/apps/create_already_exists/script
+++ b/acceptance/bundle/resources/apps/create_already_exists/script
@@ -1,5 +1,8 @@
 # Create an app with the same name outside of bundle
-trace $CLI apps create test-app-already-exists
+trace $CLI apps create test-app-already-exists | tee app.json.tmp
+add_repl "$(sed -n 's/.*"deployment_id": "\(.*\)".*/\1/p' app.json.tmp)" APP_DEPLOYMENT_ID
+add_repl "$(sed -n 's/.*"service_principal_id": \([0-9]*\).*/\1/p' app.json.tmp)" SERVICE_PRINCIPAL_ID
+rm app.json.tmp
 
 # Bundle deploy should fail because app already exists and is not in DELETING state
 trace musterr $CLI bundle deploy
diff --git a/acceptance/bundle/resources/apps/create_already_exists/test.toml b/acceptance/bundle/resources/apps/create_already_exists/test.toml
index 613ff598f6b..262a6f41b15 100644
--- a/acceptance/bundle/resources/apps/create_already_exists/test.toml
+++ b/acceptance/bundle/resources/apps/create_already_exists/test.toml
@@ -1,6 +1,2 @@
-Local = true
 Cloud = false
 RecordRequests = false
-
-[EnvMatrix]
-  DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/resources/apps/default_description/out.test.toml b/acceptance/bundle/resources/apps/default_description/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/apps/default_description/out.test.toml
+++ b/acceptance/bundle/resources/apps/default_description/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/apps/default_description/output.txt b/acceptance/bundle/resources/apps/default_description/output.txt
index 89859e46ee1..a8260fca553 100644
--- a/acceptance/bundle/resources/apps/default_description/output.txt
+++ b/acceptance/bundle/resources/apps/default_description/output.txt
@@ -1,9 +1,9 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created apps.mykey
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> print_requests.py //apps
 {
diff --git a/acceptance/bundle/resources/apps/git-source-no-deployment/databricks.yml b/acceptance/bundle/resources/apps/git-source-no-deployment/databricks.yml
new file mode 100644
index 00000000000..d3711e17833
--- /dev/null
+++ b/acceptance/bundle/resources/apps/git-source-no-deployment/databricks.yml
@@ -0,0 +1,10 @@
+bundle:
+  name: app-git-source-no-deployment
+
+resources:
+  apps:
+    myapp:
+      name: test-app-git-source-no-deployment
+      description: my_app_description
+      git_source:
+        branch: main
diff --git a/acceptance/bundle/resources/apps/git-source-no-deployment/out.test.toml b/acceptance/bundle/resources/apps/git-source-no-deployment/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/apps/git-source-no-deployment/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/apps/git-source-no-deployment/output.txt b/acceptance/bundle/resources/apps/git-source-no-deployment/output.txt
new file mode 100644
index 00000000000..70a931d7fb0
--- /dev/null
+++ b/acceptance/bundle/resources/apps/git-source-no-deployment/output.txt
@@ -0,0 +1,26 @@
+
+=== Deploy: app created with no_compute; git_source is not deployed until the app starts
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/app-git-source-no-deployment/default/files...
+Created apps.myapp
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Plan is a no-op: git_source drift is skipped while the app has no active deployment
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+=== git_source is skipped with reason "no active deployment"
+>>> [CLI] bundle plan -o json
+{
+  "git_source": {
+    "action": "skip",
+    "reason": "no active deployment",
+    "old": {
+      "branch": "main"
+    },
+    "new": {
+      "branch": "main"
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/apps/git-source-no-deployment/script b/acceptance/bundle/resources/apps/git-source-no-deployment/script
new file mode 100644
index 00000000000..d2ef71d9315
--- /dev/null
+++ b/acceptance/bundle/resources/apps/git-source-no-deployment/script
@@ -0,0 +1,9 @@
+
+title "Deploy: app created with no_compute; git_source is not deployed until the app starts"
+trace $CLI bundle deploy
+
+title "Plan is a no-op: git_source drift is skipped while the app has no active deployment"
+trace $CLI bundle plan | contains.py "Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged"
+
+title "git_source is skipped with reason \"no active deployment\""
+trace $CLI bundle plan -o json | nostamp | jq '.plan[].changes | {git_source}'
diff --git a/acceptance/bundle/resources/apps/git-source-no-deployment/test.toml b/acceptance/bundle/resources/apps/git-source-no-deployment/test.toml
new file mode 100644
index 00000000000..9910ae755f3
--- /dev/null
+++ b/acceptance/bundle/resources/apps/git-source-no-deployment/test.toml
@@ -0,0 +1,9 @@
+Cloud = false
+
+# Asserts plan classification, not requests; drop the inherited RecordRequests.
+RecordRequests = false
+
+Ignore = [".databricks"]
+
+# Direct engine only: the skip logic lives in OverrideChangeDesc. Mirrors
+# config-no-deployment.
diff --git a/acceptance/bundle/resources/apps/immutable/app/app.py b/acceptance/bundle/resources/apps/immutable/app/app.py
new file mode 100644
index 00000000000..184b9c5c592
--- /dev/null
+++ b/acceptance/bundle/resources/apps/immutable/app/app.py
@@ -0,0 +1,3 @@
+import streamlit as st
+
+st.write("hello")
diff --git a/acceptance/bundle/resources/apps/immutable/databricks.yml.tmpl b/acceptance/bundle/resources/apps/immutable/databricks.yml.tmpl
new file mode 100644
index 00000000000..6b9b696ef01
--- /dev/null
+++ b/acceptance/bundle/resources/apps/immutable/databricks.yml.tmpl
@@ -0,0 +1,11 @@
+bundle:
+  name: test-bundle-immutable-app-$UNIQUE_NAME
+
+experimental:
+  immutable_folder: true
+
+resources:
+  apps:
+    my_app:
+      name: my-immutable-app
+      source_code_path: ./app
diff --git a/acceptance/bundle/resources/apps/immutable/out.test.toml b/acceptance/bundle/resources/apps/immutable/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/apps/immutable/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/apps/immutable/output.txt b/acceptance/bundle/resources/apps/immutable/output.txt
new file mode 100644
index 00000000000..c411677bca0
--- /dev/null
+++ b/acceptance/bundle/resources/apps/immutable/output.txt
@@ -0,0 +1,42 @@
+
+>>> [CLI] bundle deploy
+Created apps.my_app
+Created internal_immutable_snapshots.immutable
+Files: 0 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] bundle run my_app
+✓ Getting the status of the app my-immutable-app
+✓ App is in UNAVAILABLE state
+✓ App compute is in STOPPED state
+✓ Starting the app my-immutable-app
+✓ App is starting...
+✓ App is started!
+✓ Deployment succeeded
+You can access the app at my-immutable-app-123.cloud.databricksapps.com
+
+>>> print_requests.py //apps
+{
+  "method": "POST",
+  "path": "/api/2.0/apps",
+  "q": {
+    "no_compute": "true"
+  },
+  "body": {
+    "description": "",
+    "name": "my-immutable-app"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/apps/my-immutable-app/start",
+  "body": {}
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/apps/my-immutable-app/deployments",
+  "body": {
+    "mode": "SNAPSHOT",
+    "source_code_path": "/Workspace/Users/[UUID]/.snapshots/[SNAPSHOT_HASH]/[SNAPSHOT_HASH]/files/app"
+  }
+}
diff --git a/acceptance/bundle/resources/apps/immutable/script b/acceptance/bundle/resources/apps/immutable/script
new file mode 100644
index 00000000000..a64a9bdaf16
--- /dev/null
+++ b/acceptance/bundle/resources/apps/immutable/script
@@ -0,0 +1,13 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+trace $CLI bundle deploy
+trace $CLI bundle run my_app
+
+# Print the app requests to verify that source_code_path in the deployment
+# points to the content-addressed snapshot path rather than a local path.
+trace print_requests.py //apps
diff --git a/acceptance/bundle/resources/apps/immutable/test.toml b/acceptance/bundle/resources/apps/immutable/test.toml
new file mode 100644
index 00000000000..3a452c98e5d
--- /dev/null
+++ b/acceptance/bundle/resources/apps/immutable/test.toml
@@ -0,0 +1,17 @@
+Cloud = false # Temporary disable cloud tests until the API is fully available
+RecordRequests = true
+
+# immutable_folder only works with the direct engine.
+
+Ignore = [
+    "databricks.yml",
+    ".databricks",
+    ".venv",
+    "*.pyc",
+]
+
+# Normalize the content-addressed snapshot hash so the test doesn't need
+# to be updated whenever the bundle content changes.
+[[Repls]]
+Old = '[0-9a-f]{64}'
+New = '[SNAPSHOT_HASH]'
diff --git a/acceptance/bundle/resources/apps/inline_config/out.test.toml b/acceptance/bundle/resources/apps/inline_config/out.test.toml
index 650836edeb3..0f167effef1 100644
--- a/acceptance/bundle/resources/apps/inline_config/out.test.toml
+++ b/acceptance/bundle/resources/apps/inline_config/out.test.toml
@@ -1,3 +1,2 @@
-Local = false
 Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/apps/inline_config/output.txt b/acceptance/bundle/resources/apps/inline_config/output.txt
index 3df45fb89c7..a1abf2a1c77 100644
--- a/acceptance/bundle/resources/apps/inline_config/output.txt
+++ b/acceptance/bundle/resources/apps/inline_config/output.txt
@@ -1,9 +1,9 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/app-inline-config-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created apps.myapp
+Files: 4 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] apps get-deployment [UNIQUE_NAME] [DEPLOYMENT_ID]
 {
@@ -29,5 +29,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/app-inline-config-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/apps/inline_config/script b/acceptance/bundle/resources/apps/inline_config/script
index ec2af098e13..4050658d44b 100755
--- a/acceptance/bundle/resources/apps/inline_config/script
+++ b/acceptance/bundle/resources/apps/inline_config/script
@@ -2,7 +2,6 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm out.requests.txt
 }
 trap cleanup EXIT
 
@@ -12,6 +11,6 @@ APP_NAME=$($CLI bundle summary -o json | jq -r '.resources.apps.myapp.name')
 $CLI bundle run myapp > /dev/null 2>&1
 
 DEPLOYMENT_ID=$($CLI apps get "$APP_NAME" | jq -r '.active_deployment.deployment_id')
-echo $DEPLOYMENT_ID:DEPLOYMENT_ID >> ACC_REPLS
+add_repl "$DEPLOYMENT_ID" DEPLOYMENT_ID
 
 trace $CLI apps get-deployment "$APP_NAME" "$DEPLOYMENT_ID" | jq '{command, env_vars}'
diff --git a/acceptance/bundle/resources/apps/inline_config/test.toml b/acceptance/bundle/resources/apps/inline_config/test.toml
index 0bd19601805..4e990804066 100644
--- a/acceptance/bundle/resources/apps/inline_config/test.toml
+++ b/acceptance/bundle/resources/apps/inline_config/test.toml
@@ -1,2 +1,2 @@
-Local = false
+RecordRequests = false
 Cloud = true
diff --git a/acceptance/bundle/resources/apps/lifecycle-started-omitted/out.test.toml b/acceptance/bundle/resources/apps/lifecycle-started-omitted/out.test.toml
index 9cfad3fb0d5..0f167effef1 100644
--- a/acceptance/bundle/resources/apps/lifecycle-started-omitted/out.test.toml
+++ b/acceptance/bundle/resources/apps/lifecycle-started-omitted/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/apps/lifecycle-started-omitted/output.txt b/acceptance/bundle/resources/apps/lifecycle-started-omitted/output.txt
index c4b88e6634a..701f2a7743b 100644
--- a/acceptance/bundle/resources/apps/lifecycle-started-omitted/output.txt
+++ b/acceptance/bundle/resources/apps/lifecycle-started-omitted/output.txt
@@ -2,69 +2,67 @@
 === (started omitted) -> deploy: app created with no_compute=true, no start/stop requests
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/lifecycle-started-omitted-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created apps.mykey
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> print_app_requests
 {
-  "body": {
-    "description": "my_app_description",
-    "name": "[UNIQUE_NAME]"
-  },
   "method": "POST",
   "path": "/api/2.0/apps",
   "q": {
     "no_compute": "true"
+  },
+  "body": {
+    "description": "my_app_description",
+    "name": "[UNIQUE_NAME]"
   }
 }
 
 === (started omitted) -> started: false -> deploy: no start/stop requests
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/lifecycle-started-omitted-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
 
 >>> print_app_requests
 
 === started: false -> (started omitted) -> deploy: no start/stop requests
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/lifecycle-started-omitted-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
 
 >>> print_app_requests
 
 === (started omitted) -> started: true -> deploy: app started
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/lifecycle-started-omitted-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated apps.mykey
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
 >>> print_app_requests
 {
-  "body": {},
   "method": "POST",
-  "path": "/api/2.0/apps/[UNIQUE_NAME]/start"
+  "path": "/api/2.0/apps/[UNIQUE_NAME]/start",
+  "body": {}
 }
 {
+  "method": "POST",
+  "path": "/api/2.0/apps/[UNIQUE_NAME]/deployments",
   "body": {
     "mode": "SNAPSHOT",
     "source_code_path": "/Workspace/Users/[USERNAME]/.bundle/lifecycle-started-omitted-[UNIQUE_NAME]/default/files/app"
-  },
-  "method": "POST",
-  "path": "/api/2.0/apps/[UNIQUE_NAME]/deployments"
+  }
 }
 
 === started: true -> (started omitted) -> deploy: no start/stop requests (compute stays as-is)
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/lifecycle-started-omitted-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated apps.mykey
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
 >>> print_app_requests
 
@@ -76,5 +74,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/lifecycle-started-omitted-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/apps/lifecycle-started-omitted/script b/acceptance/bundle/resources/apps/lifecycle-started-omitted/script
index ca97563ffaf..00b2e1d844f 100644
--- a/acceptance/bundle/resources/apps/lifecycle-started-omitted/script
+++ b/acceptance/bundle/resources/apps/lifecycle-started-omitted/script
@@ -2,13 +2,12 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm -f out.requests.txt
+    rm -f "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
 print_app_requests() {
-    jq --sort-keys 'select(.method != "GET" and (.path | contains("/apps")))' < out.requests.txt
-    rm out.requests.txt
+    print_requests.py //apps
 }
 
 title "(started omitted) -> deploy: app created with no_compute=true, no start/stop requests"
@@ -80,6 +79,6 @@ trace $CLI bundle deploy
 trace print_app_requests
 
 title "(started omitted, app running) -> bundle plan shows no drift"
-$CLI bundle plan -o json > LOG.planjson
+$CLI bundle plan -o json | nostamp > LOG.planjson
 verify_no_drift.py LOG.planjson
 echo "Plan: no drift detected"
diff --git a/acceptance/bundle/resources/apps/lifecycle-started-omitted/test.toml b/acceptance/bundle/resources/apps/lifecycle-started-omitted/test.toml
index b5c148642af..67c1ebf56bf 100644
--- a/acceptance/bundle/resources/apps/lifecycle-started-omitted/test.toml
+++ b/acceptance/bundle/resources/apps/lifecycle-started-omitted/test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 RecordRequests = true
 
@@ -9,6 +8,3 @@ Ignore = [".databricks", "databricks.yml"]
 [[Repls]]
 Old = '(?m)^✓ [^\n]*\n'
 New = ""
-
-[EnvMatrix]
-  DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/resources/apps/lifecycle-started-terraform-error/databricks.yml.tmpl b/acceptance/bundle/resources/apps/lifecycle-started-terraform-error/databricks.yml.tmpl
deleted file mode 100644
index ee78dfc1502..00000000000
--- a/acceptance/bundle/resources/apps/lifecycle-started-terraform-error/databricks.yml.tmpl
+++ /dev/null
@@ -1,11 +0,0 @@
-bundle:
-  name: lifecycle-started-$UNIQUE_NAME
-
-resources:
-  apps:
-    myapp:
-      name: $UNIQUE_NAME
-      description: my_app_description
-      source_code_path: ./app
-      lifecycle:
-        started: true
diff --git a/acceptance/bundle/resources/apps/lifecycle-started-terraform-error/out.test.toml b/acceptance/bundle/resources/apps/lifecycle-started-terraform-error/out.test.toml
deleted file mode 100644
index 42c0997090a..00000000000
--- a/acceptance/bundle/resources/apps/lifecycle-started-terraform-error/out.test.toml
+++ /dev/null
@@ -1,3 +0,0 @@
-Local = true
-Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform"]
diff --git a/acceptance/bundle/resources/apps/lifecycle-started-terraform-error/output.txt b/acceptance/bundle/resources/apps/lifecycle-started-terraform-error/output.txt
deleted file mode 100644
index 80395fe51aa..00000000000
--- a/acceptance/bundle/resources/apps/lifecycle-started-terraform-error/output.txt
+++ /dev/null
@@ -1,16 +0,0 @@
-
-=== bundle plan fails with lifecycle.started on terraform engine
->>> errcode [CLI] bundle plan
-Error: lifecycle.started is only supported in direct deployment mode
-  in databricks.yml:11:18
-
-
-Exit code: 1
-
-=== bundle deploy fails with lifecycle.started on terraform engine
->>> errcode [CLI] bundle deploy
-Error: lifecycle.started is only supported in direct deployment mode
-  in databricks.yml:11:18
-
-
-Exit code: 1
diff --git a/acceptance/bundle/resources/apps/lifecycle-started-terraform-error/script b/acceptance/bundle/resources/apps/lifecycle-started-terraform-error/script
deleted file mode 100644
index 4fb2038cd28..00000000000
--- a/acceptance/bundle/resources/apps/lifecycle-started-terraform-error/script
+++ /dev/null
@@ -1,7 +0,0 @@
-envsubst < databricks.yml.tmpl > databricks.yml
-
-title "bundle plan fails with lifecycle.started on terraform engine"
-trace errcode $CLI bundle plan
-
-title "bundle deploy fails with lifecycle.started on terraform engine"
-trace errcode $CLI bundle deploy
diff --git a/acceptance/bundle/resources/apps/lifecycle-started-terraform-error/test.toml b/acceptance/bundle/resources/apps/lifecycle-started-terraform-error/test.toml
deleted file mode 100644
index 34b19e94a9b..00000000000
--- a/acceptance/bundle/resources/apps/lifecycle-started-terraform-error/test.toml
+++ /dev/null
@@ -1,6 +0,0 @@
-Local = true
-Cloud = true
-RecordRequests = false
-
-[EnvMatrix]
-  DATABRICKS_BUNDLE_ENGINE = ["terraform"]
diff --git a/acceptance/bundle/resources/apps/lifecycle-started-toggle/out.test.toml b/acceptance/bundle/resources/apps/lifecycle-started-toggle/out.test.toml
index 9cfad3fb0d5..0f167effef1 100644
--- a/acceptance/bundle/resources/apps/lifecycle-started-toggle/out.test.toml
+++ b/acceptance/bundle/resources/apps/lifecycle-started-toggle/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/apps/lifecycle-started-toggle/output.txt b/acceptance/bundle/resources/apps/lifecycle-started-toggle/output.txt
index 2f7ea7c2a84..b6631453d16 100644
--- a/acceptance/bundle/resources/apps/lifecycle-started-toggle/output.txt
+++ b/acceptance/bundle/resources/apps/lifecycle-started-toggle/output.txt
@@ -2,9 +2,9 @@
 === Deploy with started=false: app created without compute (no_compute=true)
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/lifecycle-started-toggle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created apps.mykey
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> print_app_requests
 {
@@ -27,9 +27,9 @@ Deployment complete!
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/lifecycle-started-toggle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated apps.mykey
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
 >>> print_app_requests
 {
@@ -54,9 +54,9 @@ Deployment complete!
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/lifecycle-started-toggle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated apps.mykey
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
 >>> print_app_requests
 {
@@ -74,5 +74,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/lifecycle-started-toggle-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/apps/lifecycle-started-toggle/script b/acceptance/bundle/resources/apps/lifecycle-started-toggle/script
index 7b5a2c8c32f..b2a1ad85a63 100644
--- a/acceptance/bundle/resources/apps/lifecycle-started-toggle/script
+++ b/acceptance/bundle/resources/apps/lifecycle-started-toggle/script
@@ -2,13 +2,13 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm -f out.requests.txt
+    rm -f "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
 print_app_requests() {
-    jq --sort-keys 'select(.method != "GET" and (.path | contains("/apps"))) | del(.body.url)' < out.requests.txt
-    rm out.requests.txt
+    jq --sort-keys 'select(.method != "GET" and (.path | contains("/apps")) and (.path | contains("/api/2.0/bundle") | not)) | del(.body.url)' < "$OUT_REQUESTS"
+    rm "$OUT_REQUESTS"
 }
 
 title "Deploy with started=false: app created without compute (no_compute=true)"
diff --git a/acceptance/bundle/resources/apps/lifecycle-started-toggle/test.toml b/acceptance/bundle/resources/apps/lifecycle-started-toggle/test.toml
index b5c148642af..67c1ebf56bf 100644
--- a/acceptance/bundle/resources/apps/lifecycle-started-toggle/test.toml
+++ b/acceptance/bundle/resources/apps/lifecycle-started-toggle/test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 RecordRequests = true
 
@@ -9,6 +8,3 @@ Ignore = [".databricks", "databricks.yml"]
 [[Repls]]
 Old = '(?m)^✓ [^\n]*\n'
 New = ""
-
-[EnvMatrix]
-  DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/resources/apps/lifecycle-started/out.test.toml b/acceptance/bundle/resources/apps/lifecycle-started/out.test.toml
index 9cfad3fb0d5..0f167effef1 100644
--- a/acceptance/bundle/resources/apps/lifecycle-started/out.test.toml
+++ b/acceptance/bundle/resources/apps/lifecycle-started/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/apps/lifecycle-started/output.txt b/acceptance/bundle/resources/apps/lifecycle-started/output.txt
index cfe10a2d65e..05c88f1cd78 100644
--- a/acceptance/bundle/resources/apps/lifecycle-started/output.txt
+++ b/acceptance/bundle/resources/apps/lifecycle-started/output.txt
@@ -2,9 +2,9 @@
 === Deploy with started=true: app created with compute running
 >>> errcode [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/lifecycle-started-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created apps.myapp
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> print_requests.py //apps
 {
@@ -32,11 +32,11 @@ Deployment complete!
 
 >>> errcode [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/lifecycle-started-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated apps.myapp
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
->>> print_requests.py //deployments
+>>> print_requests.py //deployments ^//api/2.0/bundle
 {
   "method": "POST",
   "path": "/api/2.0/apps/[UNIQUE_NAME]/deployments",
@@ -58,9 +58,9 @@ Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
 === Deploy fixes the drift: compute restarted
 >>> errcode [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/lifecycle-started-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated apps.myapp
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
 === Stop app externally, then deploy with started=false: app stays stopped
 >>> errcode [CLI] apps stop [UNIQUE_NAME]
@@ -72,9 +72,9 @@ Deployment complete!
 
 >>> errcode [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/lifecycle-started-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated apps.myapp
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
 >>> print_requests.py //apps
 {
@@ -90,7 +90,7 @@ Deployment complete!
       "description": "MY_APP_DESCRIPTION_2",
       "name": "[UNIQUE_NAME]"
     },
-    "update_mask": "description,budget_policy_id,usage_policy_id,resources,user_api_scopes,compute_size,git_repository,telemetry_export_destinations"
+    "update_mask": "description,budget_policy_id,usage_policy_id,resources,user_api_scopes,compute_size,compute_min_instances,compute_max_instances,git_repository,telemetry_export_destinations"
   }
 }
 
@@ -104,9 +104,9 @@ Deployment complete!
 
 >>> errcode [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/lifecycle-started-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated apps.myapp
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
 >>> print_requests.py //apps
 {
@@ -117,7 +117,7 @@ Deployment complete!
       "description": "MY_APP_DESCRIPTION_3",
       "name": "[UNIQUE_NAME]"
     },
-    "update_mask": "description,budget_policy_id,usage_policy_id,resources,user_api_scopes,compute_size,git_repository,telemetry_export_destinations"
+    "update_mask": "description,budget_policy_id,usage_policy_id,resources,user_api_scopes,compute_size,compute_min_instances,compute_max_instances,git_repository,telemetry_export_destinations"
   }
 }
 {
@@ -143,5 +143,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/lifecycle-started-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/apps/lifecycle-started/script b/acceptance/bundle/resources/apps/lifecycle-started/script
index 710dec5a10a..20d8a9e6fd7 100644
--- a/acceptance/bundle/resources/apps/lifecycle-started/script
+++ b/acceptance/bundle/resources/apps/lifecycle-started/script
@@ -2,21 +2,21 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm -f out.requests.txt
+    rm -f "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
 title "Deploy with started=true: app created with compute running"
 trace errcode $CLI bundle deploy
 trace print_requests.py //apps
-rm -f out.requests.txt
+rm -f "$OUT_REQUESTS"
 { trace errcode $CLI apps get $UNIQUE_NAME | jq '.compute_status.state'; } || true
 
 title "Re-deploy with description change: code deployed again"
 trace update_file.py databricks.yml my_app_description MY_APP_DESCRIPTION
 trace errcode $CLI bundle deploy
-trace print_requests.py //deployments
-rm -f out.requests.txt
+trace print_requests.py //deployments ^//api/2.0/bundle
+rm -f "$OUT_REQUESTS"
 
 title "Stop app externally while config says started=true: plan detects drift"
 { trace errcode $CLI apps stop $UNIQUE_NAME | jq '.compute_status.state'; } || true
@@ -24,7 +24,7 @@ trace $CLI bundle plan
 
 title "Deploy fixes the drift: compute restarted"
 trace errcode $CLI bundle deploy
-rm -f out.requests.txt
+rm -f "$OUT_REQUESTS"
 
 title "Stop app externally, then deploy with started=false: app stays stopped"
 { trace errcode $CLI apps stop $UNIQUE_NAME | jq '.compute_status.state'; } || true
@@ -32,7 +32,7 @@ trace update_file.py databricks.yml "started: true" "started: false"
 trace update_file.py databricks.yml MY_APP_DESCRIPTION MY_APP_DESCRIPTION_2
 trace errcode $CLI bundle deploy
 trace print_requests.py //apps
-rm -f out.requests.txt
+rm -f "$OUT_REQUESTS"
 { trace errcode $CLI apps get $UNIQUE_NAME | jq '.compute_status.state'; } || true
 
 title "Deploy with started=true: compute restarted and code deployed"
@@ -40,5 +40,5 @@ trace update_file.py databricks.yml "started: false" "started: true"
 trace update_file.py databricks.yml MY_APP_DESCRIPTION_2 MY_APP_DESCRIPTION_3
 trace errcode $CLI bundle deploy
 trace print_requests.py //apps
-rm -f out.requests.txt
+rm -f "$OUT_REQUESTS"
 { trace errcode $CLI apps get $UNIQUE_NAME | jq '.compute_status.state'; } || true
diff --git a/acceptance/bundle/resources/apps/lifecycle-started/test.toml b/acceptance/bundle/resources/apps/lifecycle-started/test.toml
index b5c148642af..67c1ebf56bf 100644
--- a/acceptance/bundle/resources/apps/lifecycle-started/test.toml
+++ b/acceptance/bundle/resources/apps/lifecycle-started/test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 RecordRequests = true
 
@@ -9,6 +8,3 @@ Ignore = [".databricks", "databricks.yml"]
 [[Repls]]
 Old = '(?m)^✓ [^\n]*\n'
 New = ""
-
-[EnvMatrix]
-  DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/resources/apps/readplan-lifecycle/app/app.py b/acceptance/bundle/resources/apps/readplan-lifecycle/app/app.py
new file mode 100644
index 00000000000..ad1e64f9fb0
--- /dev/null
+++ b/acceptance/bundle/resources/apps/readplan-lifecycle/app/app.py
@@ -0,0 +1,5 @@
+import http.server, os
+
+http.server.HTTPServer(
+    ("", int(os.environ["DATABRICKS_APP_PORT"])), http.server.SimpleHTTPRequestHandler
+).serve_forever()
diff --git a/acceptance/bundle/resources/apps/readplan-lifecycle/databricks.yml b/acceptance/bundle/resources/apps/readplan-lifecycle/databricks.yml
new file mode 100644
index 00000000000..0ee14d5371f
--- /dev/null
+++ b/acceptance/bundle/resources/apps/readplan-lifecycle/databricks.yml
@@ -0,0 +1,11 @@
+bundle:
+  name: test-bundle
+
+resources:
+  apps:
+    myapp:
+      name: myapp
+      description: initial
+      source_code_path: ./app
+      lifecycle:
+        started: true
diff --git a/acceptance/bundle/resources/apps/readplan-lifecycle/out.test.toml b/acceptance/bundle/resources/apps/readplan-lifecycle/out.test.toml
new file mode 100644
index 00000000000..f7fafbcc731
--- /dev/null
+++ b/acceptance/bundle/resources/apps/readplan-lifecycle/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/resources/apps/readplan-lifecycle/output.txt b/acceptance/bundle/resources/apps/readplan-lifecycle/output.txt
new file mode 100644
index 00000000000..fc9f8041709
--- /dev/null
+++ b/acceptance/bundle/resources/apps/readplan-lifecycle/output.txt
@@ -0,0 +1,24 @@
+
+=== Initial deploy: app created and started
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created apps.myapp
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //apps/myapp/start
+
+=== Change description and deploy from plan: no extra start
+>>> update_file.py databricks.yml description: initial description: updated
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Updated apps.myapp
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //apps/myapp/start
+The following resources will be deleted:
+  delete resources.apps.myapp
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/apps/readplan-lifecycle/script b/acceptance/bundle/resources/apps/readplan-lifecycle/script
new file mode 100644
index 00000000000..4730191ec66
--- /dev/null
+++ b/acceptance/bundle/resources/apps/readplan-lifecycle/script
@@ -0,0 +1,15 @@
+cleanup() {
+    $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+title "Initial deploy: app created and started"
+trace $CLI bundle deploy
+trace print_requests.py //apps/myapp/start
+
+title "Change description and deploy from plan: no extra start"
+trace update_file.py databricks.yml "description: initial" "description: updated"
+$CLI bundle plan -o json > tmp.plan.json
+$CLI bundle deploy $(readplanarg tmp.plan.json)
+trace print_requests.py //apps/myapp/start
diff --git a/acceptance/bundle/resources/apps/readplan-lifecycle/test.toml b/acceptance/bundle/resources/apps/readplan-lifecycle/test.toml
new file mode 100644
index 00000000000..bba2c801b7d
--- /dev/null
+++ b/acceptance/bundle/resources/apps/readplan-lifecycle/test.toml
@@ -0,0 +1,8 @@
+Cloud = false
+Ignore = [".databricks", "tmp.plan.json"]
+
+EnvMatrix.READPLAN = ["", "1"]
+
+[[Repls]]
+Old = '(?m)^✓ [^\n]*\n'
+New = ""
diff --git a/acceptance/bundle/resources/apps/resource-refs/out.test.toml b/acceptance/bundle/resources/apps/resource-refs/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/apps/resource-refs/out.test.toml
+++ b/acceptance/bundle/resources/apps/resource-refs/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/apps/resource-refs/output.txt b/acceptance/bundle/resources/apps/resource-refs/output.txt
index c2af531b97c..1690bee41eb 100644
--- a/acceptance/bundle/resources/apps/resource-refs/output.txt
+++ b/acceptance/bundle/resources/apps/resource-refs/output.txt
@@ -1,13 +1,15 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/resource-refs/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created apps.data_app
+Created jobs.example_job
+Created schemas.example
+Files: 2 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle run data_app
 ✓ Getting the status of the app data-app
-✓ App is in RUNNING state
+✓ App is in UNAVAILABLE state
 ✓ App compute is in STOPPED state
 ✓ Starting the app data-app
 ✓ App is starting...
@@ -52,7 +54,7 @@ You can access the app at data-app-123.cloud.databricksapps.com
       },
       {
         "name": "MY_EXAMPLE_JOB_ID",
-        "value": "[NUMID]"
+        "value": "[EXAMPLE_JOB_ID]"
       },
       {
         "name": "MY_EXAMPLE_VAR",
diff --git a/acceptance/bundle/resources/apps/resource-refs/script b/acceptance/bundle/resources/apps/resource-refs/script
index ace337470da..79ad39f683a 100644
--- a/acceptance/bundle/resources/apps/resource-refs/script
+++ b/acceptance/bundle/resources/apps/resource-refs/script
@@ -1,3 +1,4 @@
 trace $CLI bundle deploy
+read_id.py example_job > /dev/null
 trace $CLI bundle run data_app
 trace print_requests.py //apps
diff --git a/acceptance/bundle/resources/apps/resource-refs/test.toml b/acceptance/bundle/resources/apps/resource-refs/test.toml
deleted file mode 100644
index 7d36fb9dc18..00000000000
--- a/acceptance/bundle/resources/apps/resource-refs/test.toml
+++ /dev/null
@@ -1,2 +0,0 @@
-Local = true
-Cloud = false
diff --git a/acceptance/bundle/resources/apps/uc-securable-drift/app/app.py b/acceptance/bundle/resources/apps/uc-securable-drift/app/app.py
new file mode 100644
index 00000000000..ad1e64f9fb0
--- /dev/null
+++ b/acceptance/bundle/resources/apps/uc-securable-drift/app/app.py
@@ -0,0 +1,5 @@
+import http.server, os
+
+http.server.HTTPServer(
+    ("", int(os.environ["DATABRICKS_APP_PORT"])), http.server.SimpleHTTPRequestHandler
+).serve_forever()
diff --git a/acceptance/bundle/resources/apps/uc-securable-drift/databricks.yml b/acceptance/bundle/resources/apps/uc-securable-drift/databricks.yml
new file mode 100644
index 00000000000..48d0506c8a2
--- /dev/null
+++ b/acceptance/bundle/resources/apps/uc-securable-drift/databricks.yml
@@ -0,0 +1,19 @@
+bundle:
+  name: apps-uc-securable-drift
+
+resources:
+  apps:
+    myapp:
+      name: myapp
+      source_code_path: ./app
+      resources:
+        - name: my-table
+          uc_securable:
+            securable_full_name: main.default.my_table
+            securable_type: TABLE
+            permission: SELECT
+        - name: my-volume
+          uc_securable:
+            securable_full_name: main.default.my_volume
+            securable_type: VOLUME
+            permission: READ_VOLUME
diff --git a/acceptance/bundle/resources/apps/uc-securable-drift/out.test.toml b/acceptance/bundle/resources/apps/uc-securable-drift/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/apps/uc-securable-drift/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/apps/uc-securable-drift/output.txt b/acceptance/bundle/resources/apps/uc-securable-drift/output.txt
new file mode 100644
index 00000000000..2f4713ea9bf
--- /dev/null
+++ b/acceptance/bundle/resources/apps/uc-securable-drift/output.txt
@@ -0,0 +1,29 @@
+
+=== Deploy an app with UC TABLE and VOLUME securables
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/apps-uc-securable-drift/default/files...
+Created apps.myapp
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Re-plan is clean: the TABLE securable's server-computed securable_kind is output-only and must not drift
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+=== securable_kind is classified output-only (skip); the VOLUME securable has none
+>>> [CLI] bundle plan -o json
+{
+  "resources[0].uc_securable.securable_kind": {
+    "action": "skip",
+    "reason": "spec:output_only",
+    "remote": "TABLE_DELTA"
+  }
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.apps.myapp
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/apps-uc-securable-drift/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/apps/uc-securable-drift/script b/acceptance/bundle/resources/apps/uc-securable-drift/script
new file mode 100644
index 00000000000..fbf6a985213
--- /dev/null
+++ b/acceptance/bundle/resources/apps/uc-securable-drift/script
@@ -0,0 +1,13 @@
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+title "Deploy an app with UC TABLE and VOLUME securables"
+trace $CLI bundle deploy
+
+title "Re-plan is clean: the TABLE securable's server-computed securable_kind is output-only and must not drift"
+trace $CLI bundle plan | contains.py "Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged"
+
+title "securable_kind is classified output-only (skip); the VOLUME securable has none"
+trace $CLI bundle plan -o json | nostamp | jq '.plan."resources.apps.myapp".changes // {} | with_entries(select(.key | test("uc_securable")))'
diff --git a/acceptance/bundle/resources/apps/uc-securable-drift/test.toml b/acceptance/bundle/resources/apps/uc-securable-drift/test.toml
new file mode 100644
index 00000000000..b0e20067d7e
--- /dev/null
+++ b/acceptance/bundle/resources/apps/uc-securable-drift/test.toml
@@ -0,0 +1,6 @@
+# securable_kind drift is a direct-engine plan-classification concern, and the fake
+# server models the backend computing it on TABLE securables. A real workspace would
+# need the referenced UC table to exist, so this runs locally only.
+RecordRequests = false
+
+Ignore = [".databricks", "databricks.yml"]
diff --git a/acceptance/bundle/resources/apps/update/out.requests.direct.json b/acceptance/bundle/resources/apps/update/out.requests.direct.json
deleted file mode 100644
index e33ad270576..00000000000
--- a/acceptance/bundle/resources/apps/update/out.requests.direct.json
+++ /dev/null
@@ -1,43 +0,0 @@
-{
-  "body": {
-    "description": "my_app_description",
-    "name": "myappname"
-  },
-  "method": "POST",
-  "path": "/api/2.0/apps",
-  "q": {
-    "no_compute": "true"
-  }
-}
-{
-  "body": {
-    "app": {
-      "description": "MY_APP_DESCRIPTION",
-      "name": "myappname"
-    },
-    "update_mask": "description,budget_policy_id,usage_policy_id,resources,user_api_scopes,compute_size,git_repository,telemetry_export_destinations"
-  },
-  "method": "POST",
-  "path": "/api/2.0/apps/myappname/update"
-}
-{
-  "body": {},
-  "method": "DELETE",
-  "path": "/api/2.0/apps/myappname"
-}
-{
-  "body": {
-    "description": "MY_APP_DESCRIPTION",
-    "name": "mynewappname"
-  },
-  "method": "POST",
-  "path": "/api/2.0/apps",
-  "q": {
-    "no_compute": "true"
-  }
-}
-{
-  "body": {},
-  "method": "DELETE",
-  "path": "/api/2.0/apps/mynewappname"
-}
diff --git a/acceptance/bundle/resources/apps/update/out.requests.json b/acceptance/bundle/resources/apps/update/out.requests.json
new file mode 100644
index 00000000000..e68269ec514
--- /dev/null
+++ b/acceptance/bundle/resources/apps/update/out.requests.json
@@ -0,0 +1,41 @@
+{
+  "method": "POST",
+  "path": "/api/2.0/apps",
+  "q": {
+    "no_compute": "true"
+  },
+  "body": {
+    "description": "my_app_description",
+    "name": "myappname"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/apps/myappname/update",
+  "body": {
+    "app": {
+      "description": "MY_APP_DESCRIPTION",
+      "name": "myappname"
+    },
+    "update_mask": "description,budget_policy_id,usage_policy_id,resources,user_api_scopes,compute_size,compute_min_instances,compute_max_instances,git_repository,telemetry_export_destinations"
+  }
+}
+{
+  "method": "DELETE",
+  "path": "/api/2.0/apps/myappname"
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/apps",
+  "q": {
+    "no_compute": "true"
+  },
+  "body": {
+    "description": "MY_APP_DESCRIPTION",
+    "name": "mynewappname"
+  }
+}
+{
+  "method": "DELETE",
+  "path": "/api/2.0/apps/mynewappname"
+}
diff --git a/acceptance/bundle/resources/apps/update/out.requests.terraform.json b/acceptance/bundle/resources/apps/update/out.requests.terraform.json
deleted file mode 100644
index 98dfdcccdcd..00000000000
--- a/acceptance/bundle/resources/apps/update/out.requests.terraform.json
+++ /dev/null
@@ -1,43 +0,0 @@
-{
-  "body": {
-    "description": "my_app_description",
-    "name": "myappname"
-  },
-  "method": "POST",
-  "path": "/api/2.0/apps",
-  "q": {
-    "no_compute": "true"
-  }
-}
-{
-  "body": {
-    "description": "MY_APP_DESCRIPTION",
-    "name": "myappname",
-    "service_principal_client_id": "[UUID]",
-    "service_principal_id": [NUMID],
-    "service_principal_name": "app-myappname"
-  },
-  "method": "PATCH",
-  "path": "/api/2.0/apps/myappname"
-}
-{
-  "body": {},
-  "method": "DELETE",
-  "path": "/api/2.0/apps/myappname"
-}
-{
-  "body": {
-    "description": "MY_APP_DESCRIPTION",
-    "name": "mynewappname"
-  },
-  "method": "POST",
-  "path": "/api/2.0/apps",
-  "q": {
-    "no_compute": "true"
-  }
-}
-{
-  "body": {},
-  "method": "DELETE",
-  "path": "/api/2.0/apps/mynewappname"
-}
diff --git a/acceptance/bundle/resources/apps/update/out.test.toml b/acceptance/bundle/resources/apps/update/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/apps/update/out.test.toml
+++ b/acceptance/bundle/resources/apps/update/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/apps/update/output.txt b/acceptance/bundle/resources/apps/update/output.txt
index 021b10a9cdc..d0d9790878e 100644
--- a/acceptance/bundle/resources/apps/update/output.txt
+++ b/acceptance/bundle/resources/apps/update/output.txt
@@ -6,9 +6,9 @@ Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created apps.mykey
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> print_requests
 
@@ -34,9 +34,9 @@ Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated apps.mykey
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
 >>> print_requests
 
@@ -74,9 +74,9 @@ Resources:
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Recreated apps.mykey
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 0 unchanged
 
 >>> print_requests
 
@@ -101,7 +101,6 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
 
 >>> print_requests
diff --git a/acceptance/bundle/resources/apps/update/script b/acceptance/bundle/resources/apps/update/script
index a66ff34b8cb..f3578c95c54 100644
--- a/acceptance/bundle/resources/apps/update/script
+++ b/acceptance/bundle/resources/apps/update/script
@@ -1,19 +1,18 @@
 print_requests() {
     # url is output-only field that terraform adds but that is ignored by the backend
-    jq --sort-keys 'select(.method != "GET" and (.path | contains("/apps"))) | (.body.url = null | del(.body.url))' < out.requests.txt
-    rm out.requests.txt
+    print_requests.py //apps '^//api/2.0/bundle' --del-body url
 }
 
 trace $CLI bundle plan
 trace $CLI bundle deploy
-trace print_requests > out.requests.$DATABRICKS_BUNDLE_ENGINE.json
+trace print_requests > out.requests.json
 trace $CLI bundle summary
 
 title "Update description and re-deploy"
 trace update_file.py databricks.yml my_app_description MY_APP_DESCRIPTION
 trace $CLI bundle plan
 trace $CLI bundle deploy
-trace print_requests >> out.requests.$DATABRICKS_BUNDLE_ENGINE.json
+trace print_requests >> out.requests.json
 trace $CLI bundle summary
 
 title "Update name and re-deploy"
@@ -21,9 +20,9 @@ trace update_file.py databricks.yml myappname mynewappname
 trace $CLI bundle plan
 trace $CLI bundle summary
 trace $CLI bundle deploy
-trace print_requests >> out.requests.$DATABRICKS_BUNDLE_ENGINE.json
+trace print_requests >> out.requests.json
 
 trace $CLI bundle plan
 trace $CLI bundle summary
 trace $CLI bundle destroy --auto-approve
-trace print_requests >> out.requests.$DATABRICKS_BUNDLE_ENGINE.json
+trace print_requests >> out.requests.json
diff --git a/acceptance/bundle/resources/catalogs/auto-approve/out.test.toml b/acceptance/bundle/resources/catalogs/auto-approve/out.test.toml
index fe4076cdf9b..0f167effef1 100644
--- a/acceptance/bundle/resources/catalogs/auto-approve/out.test.toml
+++ b/acceptance/bundle/resources/catalogs/auto-approve/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/catalogs/auto-approve/output.txt b/acceptance/bundle/resources/catalogs/auto-approve/output.txt
index e0576f1b9e5..74d1a53ab73 100644
--- a/acceptance/bundle/resources/catalogs/auto-approve/output.txt
+++ b/acceptance/bundle/resources/catalogs/auto-approve/output.txt
@@ -1,9 +1,10 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created catalogs.bar
+Created schemas.foo
+Files: 4 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 === Assert the catalog is created
 >>> [CLI] catalogs get test-catalog-[UNIQUE_NAME]
@@ -41,6 +42,7 @@ Error: cannot plan resources.schemas.foo: cannot resolve "${resources.catalogs.b
 
 Error: planning failed
 
+Files: 1 uploaded, 1 deleted
 
 === Test cleanup
 >>> [CLI] bundle destroy --auto-approve
@@ -53,8 +55,7 @@ This action will result in the deletion of the following UC schemas. Any underly
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 2 deleted
 
 === Assert the catalog is deleted
 Exit code: 1
diff --git a/acceptance/bundle/resources/catalogs/auto-approve/test.toml b/acceptance/bundle/resources/catalogs/auto-approve/test.toml
index 2652084ff00..812d713d12d 100644
--- a/acceptance/bundle/resources/catalogs/auto-approve/test.toml
+++ b/acceptance/bundle/resources/catalogs/auto-approve/test.toml
@@ -1,7 +1,5 @@
-Local = true
 Cloud = true
 RecordRequests = false
-RequiresUnityCatalog = true
 
 Ignore = [
     ".databricks",
@@ -9,6 +7,3 @@ Ignore = [
     "catalog.yml",
     "test-file-*.txt",
 ]
-
-[EnvMatrix]
-  DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/resources/catalogs/basic/out.test.toml b/acceptance/bundle/resources/catalogs/basic/out.test.toml
index fe4076cdf9b..0f167effef1 100644
--- a/acceptance/bundle/resources/catalogs/basic/out.test.toml
+++ b/acceptance/bundle/resources/catalogs/basic/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/catalogs/basic/output.txt b/acceptance/bundle/resources/catalogs/basic/output.txt
index 1e703092424..fdc31856ca9 100644
--- a/acceptance/bundle/resources/catalogs/basic/output.txt
+++ b/acceptance/bundle/resources/catalogs/basic/output.txt
@@ -2,9 +2,9 @@
 === Deploy bundle with catalog
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created catalogs.test_catalog
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 === Assert the catalog is created
 >>> [CLI] catalogs get test_catalog_[UNIQUE_NAME]
@@ -20,9 +20,9 @@ Deployment complete!
 === Redeploy with updated comment
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated catalogs.test_catalog
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
 === Assert the catalog comment is updated
 >>> [CLI] catalogs get test_catalog_[UNIQUE_NAME]
@@ -38,7 +38,6 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
 
 === Assert the catalog is deleted
\ No newline at end of file
diff --git a/acceptance/bundle/resources/catalogs/basic/script b/acceptance/bundle/resources/catalogs/basic/script
index 3ce45404638..f5d2fd82486 100644
--- a/acceptance/bundle/resources/catalogs/basic/script
+++ b/acceptance/bundle/resources/catalogs/basic/script
@@ -15,7 +15,7 @@ title "Deploy bundle with catalog"
 trace $CLI bundle deploy
 
 title "Assert the catalog is created"
-trace $CLI catalogs get "${CATALOG_NAME}" | jq "{name, comment, properties}"
+trace $CLI catalogs get "${CATALOG_NAME}" | jq "{name, comment, properties}" | normalize_uc_payload.py
 
 title "Update catalog comment"
 update_file.py databricks.yml "This catalog was created from DABs" "Updated comment from DABs"
diff --git a/acceptance/bundle/resources/catalogs/basic/test.toml b/acceptance/bundle/resources/catalogs/basic/test.toml
index d2b122411f2..37e1006eb5a 100644
--- a/acceptance/bundle/resources/catalogs/basic/test.toml
+++ b/acceptance/bundle/resources/catalogs/basic/test.toml
@@ -1,12 +1,7 @@
-Local = true
 Cloud = true
 RecordRequests = false
-RequiresUnityCatalog = true
 
 Ignore = [
     ".databricks",
     "databricks.yml",
 ]
-
-[EnvMatrix]
-  DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/resources/catalogs/comment_out_of_band/databricks.yml.tmpl b/acceptance/bundle/resources/catalogs/comment_out_of_band/databricks.yml.tmpl
new file mode 100644
index 00000000000..b7fa6d6d952
--- /dev/null
+++ b/acceptance/bundle/resources/catalogs/comment_out_of_band/databricks.yml.tmpl
@@ -0,0 +1,7 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  catalogs:
+    catalog1:
+      name: test-catalog-$UNIQUE_NAME
diff --git a/acceptance/bundle/resources/catalogs/comment_out_of_band/out.test.toml b/acceptance/bundle/resources/catalogs/comment_out_of_band/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/catalogs/comment_out_of_band/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/catalogs/comment_out_of_band/output.txt b/acceptance/bundle/resources/catalogs/comment_out_of_band/output.txt
new file mode 100644
index 00000000000..58bebd5aac2
--- /dev/null
+++ b/acceptance/bundle/resources/catalogs/comment_out_of_band/output.txt
@@ -0,0 +1,60 @@
+
+=== Deploy a catalog that does not declare a comment
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Created catalogs.catalog1
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Set the comment out of band, the way Catalog Explorer does
+=== The remote comment is drift, so the plan updates the catalog
+>>> [CLI] bundle plan --output json
+{
+  "comment": {
+    "action": "update",
+    "remote": "set outside the bundle"
+  }
+}
+
+=== Redeploy clears the comment
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Updated catalogs.catalog1
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+=== The comment is gone
+>>> [CLI] api get /api/2.1/unity-catalog/catalogs/test-catalog-[UNIQUE_NAME]
+""
+
+=== Redeploy is a no-op
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
+
+=== The UpdateCatalog payloads the deploys sent
+>>> print_requests.py --method PATCH //unity-catalog/catalogs
+{
+  "method": "PATCH",
+  "path": "/api/2.1/unity-catalog/catalogs/test-catalog-[UNIQUE_NAME]",
+  "body": {
+    "comment": "set outside the bundle"
+  }
+}
+{
+  "method": "PATCH",
+  "path": "/api/2.1/unity-catalog/catalogs/test-catalog-[UNIQUE_NAME]",
+  "body": {
+    "comment": "",
+    "custom_max_retention_hours": 0
+  }
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.catalogs.catalog1
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/catalogs/comment_out_of_band/script b/acceptance/bundle/resources/catalogs/comment_out_of_band/script
new file mode 100644
index 00000000000..82820cc08da
--- /dev/null
+++ b/acceptance/bundle/resources/catalogs/comment_out_of_band/script
@@ -0,0 +1,32 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+CATALOG="test-catalog-${UNIQUE_NAME}"
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+
+    # Consume the destroy's requests so none are left recorded.
+    print_requests.py --method PATCH //unity-catalog/catalogs &> LOG.destroy_requests
+}
+trap cleanup EXIT
+
+title "Deploy a catalog that does not declare a comment"
+trace $CLI bundle deploy
+
+title "Set the comment out of band, the way Catalog Explorer does"
+MSYS_NO_PATHCONV=1 $CLI api patch "/api/2.1/unity-catalog/catalogs/$CATALOG" --json '{"comment":"set outside the bundle"}' > /dev/null
+
+title "The remote comment is drift, so the plan updates the catalog"
+trace $CLI bundle plan --output json | nostamp | jq '.plan[].changes' | normalize_uc_payload.py
+
+title "Redeploy clears the comment"
+trace $CLI bundle deploy
+
+title "The comment is gone"
+MSYS_NO_PATHCONV=1 trace $CLI api get "/api/2.1/unity-catalog/catalogs/$CATALOG" | jq '.comment'
+
+title "Redeploy is a no-op"
+trace $CLI bundle deploy
+
+title "The UpdateCatalog payloads the deploys sent"
+trace print_requests.py --method PATCH //unity-catalog/catalogs
diff --git a/acceptance/bundle/resources/catalogs/comment_out_of_band/test.toml b/acceptance/bundle/resources/catalogs/comment_out_of_band/test.toml
new file mode 100644
index 00000000000..47e0ed4dda2
--- /dev/null
+++ b/acceptance/bundle/resources/catalogs/comment_out_of_band/test.toml
@@ -0,0 +1,9 @@
+Cloud = true
+
+# UpdateCatalog payload construction is direct-engine-specific.
+
+Ignore = [
+    ".databricks",
+    ".gitignore",
+    "databricks.yml",
+]
diff --git a/acceptance/bundle/resources/catalogs/drift/managed_properties/databricks.yml b/acceptance/bundle/resources/catalogs/drift/managed_properties/databricks.yml
new file mode 100644
index 00000000000..f6136f4a7e2
--- /dev/null
+++ b/acceptance/bundle/resources/catalogs/drift/managed_properties/databricks.yml
@@ -0,0 +1,7 @@
+bundle:
+  name: test-bundle
+
+resources:
+  catalogs:
+    catalog1:
+      name: catalog_managed_defaults
diff --git a/acceptance/bundle/resources/catalogs/drift/managed_properties/out.test.toml b/acceptance/bundle/resources/catalogs/drift/managed_properties/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/catalogs/drift/managed_properties/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/catalogs/drift/managed_properties/output.txt b/acceptance/bundle/resources/catalogs/drift/managed_properties/output.txt
new file mode 100644
index 00000000000..5c22507bb39
--- /dev/null
+++ b/acceptance/bundle/resources/catalogs/drift/managed_properties/output.txt
@@ -0,0 +1,40 @@
+
+=== Initial deployment
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created catalogs.catalog1
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Plan is a no-op despite UC auto-populating managed properties
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+=== The remote-only properties map is skipped as a backend default (confirms the matched rule)
+>>> [CLI] bundle plan --output json
+{
+  "properties": {
+    "action": "skip",
+    "reason": "backend_default",
+    "remote": {
+      "unity.catalog.managed.delta.defaults.defaultClusterByAuto": "true",
+      "unity.catalog.managed.delta.defaults.delta.checkpointPolicy": "v2",
+      "unity.catalog.managed.delta.defaults.delta.enableRowTracking": "true",
+      "unity.catalog.managed.delta.defaults.delta.feature.catalogManaged": "supported",
+      "unity.catalog.managed.delta.defaults.delta.parquet.format.version": "2.12.0",
+      "unity.catalog.managed.delta.defaults.delta.parquet.format.version.afe.internal": "2.12.0",
+      "unity.catalog.managed.iceberg.defaults.delta.feature.catalogManaged": "true"
+    }
+  }
+}
+
+=== Redeploy is a no-op (no UpdateCatalog call)
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
+
+>>> print_requests.py //unity
+json.method = "POST";
+json.path = "/api/2.1/unity-catalog/catalogs";
+json.body.name = "catalog_managed_defaults";
diff --git a/acceptance/bundle/resources/catalogs/drift/managed_properties/script b/acceptance/bundle/resources/catalogs/drift/managed_properties/script
new file mode 100644
index 00000000000..9f8dd43d38b
--- /dev/null
+++ b/acceptance/bundle/resources/catalogs/drift/managed_properties/script
@@ -0,0 +1,13 @@
+
+title "Initial deployment"
+trace $CLI bundle deploy
+
+title "Plan is a no-op despite UC auto-populating managed properties"
+trace $CLI bundle plan | contains.py "Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged"
+
+title "The remote-only properties map is skipped as a backend default (confirms the matched rule)"
+trace $CLI bundle plan --output json | nostamp | jq '.plan[].changes'
+
+title "Redeploy is a no-op (no UpdateCatalog call)"
+trace $CLI bundle deploy
+trace print_requests.py //unity | gron.py | contains.py '!json.method = "PATCH"'
diff --git a/acceptance/bundle/resources/catalogs/drift/managed_properties/test.toml b/acceptance/bundle/resources/catalogs/drift/managed_properties/test.toml
new file mode 100644
index 00000000000..c847c5fb439
--- /dev/null
+++ b/acceptance/bundle/resources/catalogs/drift/managed_properties/test.toml
@@ -0,0 +1,4 @@
+RecordRequests = true
+
+# Terraform issues a spurious PATCH for enable_predictive_optimization on every
+# deploy, which is outside the scope of backend-default handling in catalogs.yml.
diff --git a/acceptance/bundle/resources/catalogs/empty-name/databricks.yml.tmpl b/acceptance/bundle/resources/catalogs/empty-name/databricks.yml.tmpl
new file mode 100644
index 00000000000..290f0ef2d0d
--- /dev/null
+++ b/acceptance/bundle/resources/catalogs/empty-name/databricks.yml.tmpl
@@ -0,0 +1,7 @@
+bundle:
+  name: catalog-empty-name-$UNIQUE_NAME
+
+resources:
+  catalogs:
+    mycatalog:
+      name: ""
diff --git a/acceptance/bundle/resources/catalogs/empty-name/out.test.toml b/acceptance/bundle/resources/catalogs/empty-name/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/catalogs/empty-name/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/catalogs/empty-name/output.txt b/acceptance/bundle/resources/catalogs/empty-name/output.txt
new file mode 100644
index 00000000000..0dc766af3db
--- /dev/null
+++ b/acceptance/bundle/resources/catalogs/empty-name/output.txt
@@ -0,0 +1,11 @@
+
+>>> musterr [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/catalog-empty-name-[UNIQUE_NAME]/default/files...
+Error: cannot create resources.catalogs.mycatalog: Invalid input: RPC CreateCatalog Field managedcatalog.CatalogInfo.name: name "" is not a valid name. Valid names cannot contain spaces, periods, forward slashes, or control characters. (400 INVALID_PARAMETER_VALUE)
+
+Endpoint: POST [DATABRICKS_URL]/api/2.1/unity-catalog/catalogs
+HTTP Status: 400 Bad Request
+API error_code: INVALID_PARAMETER_VALUE
+API message: Invalid input: RPC CreateCatalog Field managedcatalog.CatalogInfo.name: name "" is not a valid name. Valid names cannot contain spaces, periods, forward slashes, or control characters.
+
+Files: 2 uploaded, 0 deleted
diff --git a/acceptance/bundle/resources/catalogs/empty-name/script b/acceptance/bundle/resources/catalogs/empty-name/script
new file mode 100644
index 00000000000..dc9e56639a9
--- /dev/null
+++ b/acceptance/bundle/resources/catalogs/empty-name/script
@@ -0,0 +1,5 @@
+# The deploy fails only after the files are uploaded, so $UNIQUE_NAME in the bundle
+# name keeps concurrent cloud legs apart and lets the sweeper find what is left.
+envsubst < databricks.yml.tmpl > databricks.yml
+
+trace musterr $CLI bundle deploy
diff --git a/acceptance/bundle/resources/catalogs/empty-name/test.toml b/acceptance/bundle/resources/catalogs/empty-name/test.toml
new file mode 100644
index 00000000000..307b9b89bf9
--- /dev/null
+++ b/acceptance/bundle/resources/catalogs/empty-name/test.toml
@@ -0,0 +1,7 @@
+# The golden asserts UC's message verbatim, so run on cloud to catch it drifting.
+Cloud = true
+RecordRequests = false
+Ignore = [".databricks"]
+
+# Terraform rejects catalog resources before any API call, so there is nothing to
+# assert on that engine.
diff --git a/acceptance/bundle/resources/catalogs/with-schemas/out.test.toml b/acceptance/bundle/resources/catalogs/with-schemas/out.test.toml
index fe4076cdf9b..0f167effef1 100644
--- a/acceptance/bundle/resources/catalogs/with-schemas/out.test.toml
+++ b/acceptance/bundle/resources/catalogs/with-schemas/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/catalogs/with-schemas/output.txt b/acceptance/bundle/resources/catalogs/with-schemas/output.txt
index 8034f5eb2fa..07928270eb8 100644
--- a/acceptance/bundle/resources/catalogs/with-schemas/output.txt
+++ b/acceptance/bundle/resources/catalogs/with-schemas/output.txt
@@ -2,9 +2,10 @@
 === Deploy bundle with catalog and schema
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created catalogs.test_catalog
+Created schemas.test_schema
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 === Assert the catalog is created
 >>> [CLI] catalogs get test_catalog_[UNIQUE_NAME]
@@ -29,9 +30,9 @@ Deployment complete!
 === Redeploy with updated catalog
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated catalogs.test_catalog
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 1 unchanged
 
 === Assert catalog comment is updated
 >>> [CLI] catalogs get test_catalog_[UNIQUE_NAME]
@@ -57,8 +58,7 @@ This action will result in the deletion of the following UC schemas. Any underly
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 2 deleted
 
 === Assert schema is deleted
 === Assert the catalog is deleted
\ No newline at end of file
diff --git a/acceptance/bundle/resources/catalogs/with-schemas/script b/acceptance/bundle/resources/catalogs/with-schemas/script
index 66930927295..039a20fd670 100644
--- a/acceptance/bundle/resources/catalogs/with-schemas/script
+++ b/acceptance/bundle/resources/catalogs/with-schemas/script
@@ -19,7 +19,7 @@ title "Deploy bundle with catalog and schema"
 trace $CLI bundle deploy
 
 title "Assert the catalog is created"
-trace $CLI catalogs get "${CATALOG_NAME}" | jq "{name, comment, properties}"
+trace $CLI catalogs get "${CATALOG_NAME}" | jq "{name, comment, properties}" | normalize_uc_payload.py
 
 title "Assert schema is created in the custom catalog"
 trace $CLI schemas get "${SCHEMA_FULL_NAME}" | jq "{full_name, catalog_name, comment}"
diff --git a/acceptance/bundle/resources/catalogs/with-schemas/test.toml b/acceptance/bundle/resources/catalogs/with-schemas/test.toml
index d2b122411f2..37e1006eb5a 100644
--- a/acceptance/bundle/resources/catalogs/with-schemas/test.toml
+++ b/acceptance/bundle/resources/catalogs/with-schemas/test.toml
@@ -1,12 +1,7 @@
-Local = true
 Cloud = true
 RecordRequests = false
-RequiresUnityCatalog = true
 
 Ignore = [
     ".databricks",
     "databricks.yml",
 ]
-
-[EnvMatrix]
-  DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/resources/cluster_policies/backend_normalization/databricks.yml.tmpl b/acceptance/bundle/resources/cluster_policies/backend_normalization/databricks.yml.tmpl
new file mode 100644
index 00000000000..8e0c536a816
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/backend_normalization/databricks.yml.tmpl
@@ -0,0 +1,34 @@
+bundle:
+  name: cluster_policy_backend_normalization
+
+workspace:
+  root_path: ~/.bundle/$UNIQUE_NAME
+
+resources:
+  cluster_policies:
+    # Definition as a compact JSON string.
+    json_string:
+      name: probe_json_string-$UNIQUE_NAME
+      definition: '{"spark_version":{"type":"fixed","value":"13.3.x-scala2.12"}}'
+
+    # Definition as a multiline block-scalar JSON string.
+    multiline:
+      name: probe_multiline-$UNIQUE_NAME
+      definition: |-
+        {
+          "spark_version": {
+            "type": "fixed",
+            "value": "13.3.x-scala2.12"
+          }
+        }
+
+    # Definition as native YAML (normalized to compact JSON by the mutator before deploy).
+    yaml:
+      name: probe_yaml-$UNIQUE_NAME
+      definition:
+        spark_version:
+          type: fixed
+          value: 13.3.x-scala2.12
+        autotermination_minutes:
+          type: range
+          maxValue: 120
diff --git a/acceptance/bundle/resources/cluster_policies/backend_normalization/out.test.toml b/acceptance/bundle/resources/cluster_policies/backend_normalization/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/backend_normalization/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/cluster_policies/backend_normalization/output.txt b/acceptance/bundle/resources/cluster_policies/backend_normalization/output.txt
new file mode 100644
index 00000000000..61848083f68
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/backend_normalization/output.txt
@@ -0,0 +1,39 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Created cluster_policies.json_string
+Created cluster_policies.multiline
+Created cluster_policies.yaml
+Files: 2 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
+
+=== [json_string] definition returned by the backend (GET)
+>>> [CLI] cluster-policies get [JSON_STRING_ID] -o json
+{"spark_version":{"type":"fixed","value":"13.3.x-scala2.12"}}
+
+=== [multiline] definition returned by the backend (GET)
+>>> [CLI] cluster-policies get [MULTILINE_ID] -o json
+{
+  "spark_version": {
+    "type": "fixed",
+    "value": "13.3.x-scala2.12"
+  }
+}
+
+=== [yaml] definition returned by the backend (GET)
+>>> [CLI] cluster-policies get [YAML_ID] -o json
+{"autotermination_minutes":{"maxValue":120,"type":"range"},"spark_version":{"type":"fixed","value":"13.3.x-scala2.12"}}
+
+=== Plan after deploy: any drift means the backend reformatted a definition
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 3 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.cluster_policies.json_string
+  delete resources.cluster_policies.multiline
+  delete resources.cluster_policies.yaml
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 3 deleted
diff --git a/acceptance/bundle/resources/cluster_policies/backend_normalization/script b/acceptance/bundle/resources/cluster_policies/backend_normalization/script
new file mode 100644
index 00000000000..4100e517c44
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/backend_normalization/script
@@ -0,0 +1,21 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+trace $CLI bundle deploy
+
+# For each authoring style, print the definition string the backend returns on GET.
+# Compare it against what we sent to see whether the backend reformats the JSON.
+for name in json_string multiline yaml; do
+    pol_id=$(read_id.py "$name")
+    title "[$name] definition returned by the backend (GET)"
+    trace $CLI cluster-policies get "$pol_id" -o json | jq -r '.definition'
+done
+
+# yaml is normalized to compact JSON by the mutator, matching the string the backend
+# stores and returns, so it does not drift (plan below is a no-op).
+title "Plan after deploy: any drift means the backend reformatted a definition"
+trace $CLI bundle plan
diff --git a/acceptance/bundle/resources/cluster_policies/backend_normalization/test.toml b/acceptance/bundle/resources/cluster_policies/backend_normalization/test.toml
new file mode 100644
index 00000000000..b75424fcbd5
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/backend_normalization/test.toml
@@ -0,0 +1,5 @@
+RecordRequests = false
+Ignore = [
+    ".databricks",
+    "databricks.yml",
+]
diff --git a/acceptance/bundle/resources/cluster_policies/basic/databricks.yml.tmpl b/acceptance/bundle/resources/cluster_policies/basic/databricks.yml.tmpl
new file mode 100644
index 00000000000..3009f5a3b05
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/basic/databricks.yml.tmpl
@@ -0,0 +1,11 @@
+bundle:
+  name: test_cluster_policy
+
+workspace:
+  root_path: ~/.bundle/$UNIQUE_NAME
+
+resources:
+  cluster_policies:
+    test_cluster_policy:
+      name: my_cluster_policy-$UNIQUE_NAME
+      definition: '{"spark_version":{"type":"fixed","value":"13.3.x-scala2.12"}}'
diff --git a/acceptance/bundle/resources/cluster_policies/basic/out.test.toml b/acceptance/bundle/resources/cluster_policies/basic/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/basic/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/cluster_policies/basic/output.txt b/acceptance/bundle/resources/cluster_policies/basic/output.txt
new file mode 100644
index 00000000000..0ba76cc3b55
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/basic/output.txt
@@ -0,0 +1,125 @@
+
+>>> [CLI] bundle validate
+Name: test_cluster_policy
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Validation OK!
+
+>>> [CLI] bundle validate -o json
+{
+  "test_cluster_policy": {
+    "definition": "{\"spark_version\":{\"type\":\"fixed\",\"value\":\"13.3.x-scala2.12\"}}",
+    "name": "my_cluster_policy-[UNIQUE_NAME]"
+  }
+}
+
+>>> [CLI] bundle summary
+Name: test_cluster_policy
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+Resources:
+  Cluster Policies:
+    test_cluster_policy:
+      Name: my_cluster_policy-[UNIQUE_NAME]
+      URL:  (not deployed)
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Created cluster_policies.test_cluster_policy
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Verify the create request
+>>> print_requests.py //policies/clusters/create
+{
+  "method": "POST",
+  "path": "/api/2.0/policies/clusters/create",
+  "body": {
+    "definition": "{\"spark_version\":{\"type\":\"fixed\",\"value\":\"13.3.x-scala2.12\"}}",
+    "name": "my_cluster_policy-[UNIQUE_NAME]"
+  }
+}
+
+>>> [CLI] bundle summary
+Name: test_cluster_policy
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+Resources:
+  Cluster Policies:
+    test_cluster_policy:
+      Name: my_cluster_policy-[UNIQUE_NAME]
+      URL:  [DATABRICKS_URL]/compute/policies/[TEST_CLUSTER_POLICY_ID]?w=[WORKSPACE_ID]
+
+=== Update the cluster policy name
+>>> update_file.py databricks.yml my_cluster_policy my_cluster_policy_2
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Updated cluster_policies.test_cluster_policy
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+=== Verify the update request
+>>> print_requests.py //policies/clusters/edit
+{
+  "method": "POST",
+  "path": "/api/2.0/policies/clusters/edit",
+  "body": {
+    "definition": "{\"spark_version\":{\"type\":\"fixed\",\"value\":\"13.3.x-scala2.12\"}}",
+    "name": "my_cluster_policy_2-[UNIQUE_NAME]",
+    "policy_id": "[TEST_CLUSTER_POLICY_ID]"
+  }
+}
+
+>>> [CLI] bundle summary
+Name: test_cluster_policy
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+Resources:
+  Cluster Policies:
+    test_cluster_policy:
+      Name: my_cluster_policy_2-[UNIQUE_NAME]
+      URL:  [DATABRICKS_URL]/compute/policies/[TEST_CLUSTER_POLICY_ID]?w=[WORKSPACE_ID]
+
+=== Destroy the cluster policy
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.cluster_policies.test_cluster_policy
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 1 deleted
+
+=== Verify the destroy request
+>>> print_requests.py //policies/clusters/delete
+{
+  "method": "POST",
+  "path": "/api/2.0/policies/clusters/delete",
+  "body": {
+    "policy_id": "[TEST_CLUSTER_POLICY_ID]"
+  }
+}
+
+>>> [CLI] bundle summary
+Name: test_cluster_policy
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+Resources:
+  Cluster Policies:
+    test_cluster_policy:
+      Name: my_cluster_policy_2-[UNIQUE_NAME]
+      URL:  (not deployed)
+
+>>> [CLI] bundle destroy --auto-approve
+No active deployment found to destroy!
diff --git a/acceptance/bundle/resources/cluster_policies/basic/script b/acceptance/bundle/resources/cluster_policies/basic/script
new file mode 100644
index 00000000000..66c9a860c39
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/basic/script
@@ -0,0 +1,39 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+trace $CLI bundle validate
+trace $CLI bundle validate -o json | jq ".resources.cluster_policies"
+
+trace $CLI bundle summary
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+trace $CLI bundle deploy
+
+# Mask the server-assigned policy id: the real backend returns a hex id that the
+# built-in UUID replacement misses, so register it explicitly for cloud parity.
+read_id.py test_cluster_policy > /dev/null
+
+title "Verify the create request"
+trace print_requests.py //policies/clusters/create
+
+trace $CLI bundle summary
+
+title "Update the cluster policy name"
+trace update_file.py databricks.yml my_cluster_policy my_cluster_policy_2
+trace $CLI bundle deploy
+
+title "Verify the update request"
+trace print_requests.py //policies/clusters/edit
+
+trace $CLI bundle summary
+
+title "Destroy the cluster policy"
+trace $CLI bundle destroy --auto-approve
+
+title "Verify the destroy request"
+trace print_requests.py //policies/clusters/delete
+
+trace $CLI bundle summary
diff --git a/acceptance/bundle/resources/cluster_policies/definition_and_family_conflict/databricks.yml.tmpl b/acceptance/bundle/resources/cluster_policies/definition_and_family_conflict/databricks.yml.tmpl
new file mode 100644
index 00000000000..99b05c89fa3
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/definition_and_family_conflict/databricks.yml.tmpl
@@ -0,0 +1,13 @@
+bundle:
+  name: cluster_policy_definition_and_family_conflict
+
+workspace:
+  root_path: ~/.bundle/$UNIQUE_NAME
+
+resources:
+  cluster_policies:
+    pol:
+      name: my_conflict_policy-$UNIQUE_NAME
+      # definition and policy_family_id are mutually exclusive; the backend rejects both.
+      policy_family_id: personal-vm
+      definition: '{"spark_version":{"type":"fixed","value":"13.3.x-scala2.12"}}'
diff --git a/acceptance/bundle/resources/cluster_policies/definition_and_family_conflict/out.test.toml b/acceptance/bundle/resources/cluster_policies/definition_and_family_conflict/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/definition_and_family_conflict/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/cluster_policies/definition_and_family_conflict/output.txt b/acceptance/bundle/resources/cluster_policies/definition_and_family_conflict/output.txt
new file mode 100644
index 00000000000..8190a2eb970
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/definition_and_family_conflict/output.txt
@@ -0,0 +1,11 @@
+
+=== Deploying a policy with both definition and policy_family_id must fail
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Error: cannot create resources.cluster_policies.pol: policy_family_id and definition cannot be used together (400 INVALID_PARAMETER_VALUE)
+
+Endpoint: POST [DATABRICKS_URL]/api/2.0/policies/clusters/create
+HTTP Status: 400 Bad Request
+API error_code: INVALID_PARAMETER_VALUE
+API message: policy_family_id and definition cannot be used together
+
+Files: 2 uploaded, 0 deleted
diff --git a/acceptance/bundle/resources/cluster_policies/definition_and_family_conflict/script b/acceptance/bundle/resources/cluster_policies/definition_and_family_conflict/script
new file mode 100644
index 00000000000..4d83ab4b716
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/definition_and_family_conflict/script
@@ -0,0 +1,9 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    $CLI bundle destroy --auto-approve &> LOG.destroy || true
+}
+trap cleanup EXIT
+
+title "Deploying a policy with both definition and policy_family_id must fail\n"
+musterr $CLI bundle deploy
diff --git a/acceptance/bundle/resources/cluster_policies/definition_and_family_conflict/test.toml b/acceptance/bundle/resources/cluster_policies/definition_and_family_conflict/test.toml
new file mode 100644
index 00000000000..7b7a2740b28
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/definition_and_family_conflict/test.toml
@@ -0,0 +1,2 @@
+# This test only asserts the create error; recorded requests are noisy and differ by env.
+RecordRequests = false
diff --git a/acceptance/bundle/resources/cluster_policies/definition_multiline/databricks.yml.tmpl b/acceptance/bundle/resources/cluster_policies/definition_multiline/databricks.yml.tmpl
new file mode 100644
index 00000000000..b4d3637227c
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/definition_multiline/databricks.yml.tmpl
@@ -0,0 +1,17 @@
+bundle:
+  name: cluster_policy_definition_multiline
+
+workspace:
+  root_path: ~/.bundle/$UNIQUE_NAME
+
+resources:
+  cluster_policies:
+    pol:
+      name: my_policy-$UNIQUE_NAME
+      definition: |-
+        {
+          "spark_version": {
+            "type": "fixed",
+            "value": "13.3.x-scala2.12"
+          }
+        }
diff --git a/acceptance/bundle/resources/cluster_policies/definition_multiline/out.test.toml b/acceptance/bundle/resources/cluster_policies/definition_multiline/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/definition_multiline/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/cluster_policies/definition_multiline/output.txt b/acceptance/bundle/resources/cluster_policies/definition_multiline/output.txt
new file mode 100644
index 00000000000..321e18516f2
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/definition_multiline/output.txt
@@ -0,0 +1,33 @@
+
+>>> [CLI] bundle validate -o json
+{
+  "pol": {
+    "definition": "{\n  \"spark_version\": {\n    \"type\": \"fixed\",\n    \"value\": \"13.3.x-scala2.12\"\n  }\n}",
+    "name": "my_policy-[UNIQUE_NAME]"
+  }
+}
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Created cluster_policies.pol
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Create body preserves the block-scalar definition as a newline-escaped string
+>>> print_requests.py //policies/clusters
+{
+  "method": "POST",
+  "path": "/api/2.0/policies/clusters/create",
+  "body": {
+    "definition": "{\n  \"spark_version\": {\n    \"type\": \"fixed\",\n    \"value\": \"13.3.x-scala2.12\"\n  }\n}",
+    "name": "my_policy-[UNIQUE_NAME]"
+  }
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.cluster_policies.pol
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/cluster_policies/definition_multiline/script b/acceptance/bundle/resources/cluster_policies/definition_multiline/script
new file mode 100644
index 00000000000..79e4cad76d7
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/definition_multiline/script
@@ -0,0 +1,11 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+trace $CLI bundle validate -o json | jq ".resources.cluster_policies"
+
+trace $CLI bundle deploy
+
+title "Create body preserves the block-scalar definition as a newline-escaped string"
+trace print_requests.py //policies/clusters
+
+trace $CLI bundle destroy --auto-approve
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/resources/cluster_policies/definition_yaml/databricks.yml.tmpl b/acceptance/bundle/resources/cluster_policies/definition_yaml/databricks.yml.tmpl
new file mode 100644
index 00000000000..8ee11375ead
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/definition_yaml/databricks.yml.tmpl
@@ -0,0 +1,21 @@
+bundle:
+  name: cluster_policy_definition_yaml
+
+workspace:
+  root_path: ~/.bundle/$UNIQUE_NAME
+
+resources:
+  cluster_policies:
+    pol:
+      name: my_policy-$UNIQUE_NAME
+      definition:
+        spark_version:
+          type: fixed
+          value: 13.3.x-scala2.12
+        autotermination_minutes:
+          type: range
+          minValue: 10
+          maxValue: 120
+        enable_elastic_disk:
+          type: fixed
+          value: true
diff --git a/acceptance/bundle/resources/cluster_policies/definition_yaml/out.test.toml b/acceptance/bundle/resources/cluster_policies/definition_yaml/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/definition_yaml/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/cluster_policies/definition_yaml/output.txt b/acceptance/bundle/resources/cluster_policies/definition_yaml/output.txt
new file mode 100644
index 00000000000..68e3de9cffd
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/definition_yaml/output.txt
@@ -0,0 +1,33 @@
+
+>>> [CLI] bundle validate -o json
+{
+  "pol": {
+    "definition": "{\"autotermination_minutes\":{\"maxValue\":120,\"minValue\":10,\"type\":\"range\"},\"enable_elastic_disk\":{\"type\":\"fixed\",\"value\":true},\"spark_version\":{\"type\":\"fixed\",\"value\":\"13.3.x-scala2.12\"}}",
+    "name": "my_policy-[UNIQUE_NAME]"
+  }
+}
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Created cluster_policies.pol
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Native YAML definition serializes to compact JSON, preserving numbers and booleans as JSON types (not quoted strings)
+>>> print_requests.py //policies/clusters
+{
+  "method": "POST",
+  "path": "/api/2.0/policies/clusters/create",
+  "body": {
+    "definition": "{\"autotermination_minutes\":{\"maxValue\":120,\"minValue\":10,\"type\":\"range\"},\"enable_elastic_disk\":{\"type\":\"fixed\",\"value\":true},\"spark_version\":{\"type\":\"fixed\",\"value\":\"13.3.x-scala2.12\"}}",
+    "name": "my_policy-[UNIQUE_NAME]"
+  }
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.cluster_policies.pol
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/cluster_policies/definition_yaml/script b/acceptance/bundle/resources/cluster_policies/definition_yaml/script
new file mode 100644
index 00000000000..53bc344cb60
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/definition_yaml/script
@@ -0,0 +1,11 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+trace $CLI bundle validate -o json | jq ".resources.cluster_policies"
+
+trace $CLI bundle deploy
+
+title "Native YAML definition serializes to compact JSON, preserving numbers and booleans as JSON types (not quoted strings)"
+trace print_requests.py //policies/clusters
+
+trace $CLI bundle destroy --auto-approve
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/resources/cluster_policies/job_ref/databricks.yml b/acceptance/bundle/resources/cluster_policies/job_ref/databricks.yml
new file mode 100644
index 00000000000..7bc49b780c2
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/job_ref/databricks.yml
@@ -0,0 +1,24 @@
+bundle:
+  name: cluster_policy_job_ref
+
+resources:
+  cluster_policies:
+    pol:
+      name: my_policy
+      definition: |-
+        {
+          "spark_version": {
+            "type": "fixed",
+            "value": "13.3.x-scala2.12"
+          }
+        }
+
+  jobs:
+    j:
+      name: my_job
+      tasks:
+        - task_key: main
+          new_cluster:
+            policy_id: ${resources.cluster_policies.pol.id}
+            spark_version: 13.3.x-scala2.12
+            num_workers: 1
diff --git a/acceptance/bundle/resources/cluster_policies/job_ref/out.test.toml b/acceptance/bundle/resources/cluster_policies/job_ref/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/job_ref/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/cluster_policies/job_ref/output.txt b/acceptance/bundle/resources/cluster_policies/job_ref/output.txt
new file mode 100644
index 00000000000..1172c061bde
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/job_ref/output.txt
@@ -0,0 +1,124 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/cluster_policy_job_ref/default/files...
+Created cluster_policies.pol
+Created jobs.j
+Files: 1 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Deploy requests in dependency order: policy create precedes job create, job carries resolved policy id
+>>> print_requests.py //policies/clusters //jobs --nostamp
+{
+  "method": "POST",
+  "path": "/api/2.0/policies/clusters/create",
+  "body": {
+    "definition": "{\n  \"spark_version\": {\n    \"type\": \"fixed\",\n    \"value\": \"13.3.x-scala2.12\"\n  }\n}",
+    "name": "my_policy"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/create",
+  "body": {
+    "deployment": {
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/cluster_policy_job_ref/default/state/metadata.json"
+    },
+    "edit_mode": "UI_LOCKED",
+    "format": "MULTI_TASK",
+    "max_concurrent_runs": 1,
+    "name": "my_job",
+    "queue": {
+      "enabled": true
+    },
+    "tasks": [
+      {
+        "new_cluster": {
+          "num_workers": 1,
+          "policy_id": "[POL_ID]",
+          "spark_version": "13.3.x-scala2.12"
+        },
+        "task_key": "main"
+      }
+    ]
+  }
+}
+
+=== Update both the policy and the job
+>>> update_file.py databricks.yml my_policy my_policy_2
+
+>>> update_file.py databricks.yml my_job my_job_2
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/cluster_policy_job_ref/default/files...
+Updated cluster_policies.pol
+Updated jobs.j
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 2 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //policies/clusters //jobs --nostamp
+{
+  "method": "POST",
+  "path": "/api/2.0/policies/clusters/edit",
+  "body": {
+    "definition": "{\n  \"spark_version\": {\n    \"type\": \"fixed\",\n    \"value\": \"13.3.x-scala2.12\"\n  }\n}",
+    "name": "my_policy_2",
+    "policy_id": "[POL_ID]"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/reset",
+  "body": {
+    "job_id": [J_ID],
+    "new_settings": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/cluster_policy_job_ref/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "my_job_2",
+      "queue": {
+        "enabled": true
+      },
+      "tasks": [
+        {
+          "new_cluster": {
+            "num_workers": 1,
+            "policy_id": "[POL_ID]",
+            "spark_version": "13.3.x-scala2.12"
+          },
+          "task_key": "main"
+        }
+      ]
+    }
+  }
+}
+
+=== Destroy: job delete precedes policy delete
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.cluster_policies.pol
+  delete resources.jobs.j
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/cluster_policy_job_ref/default
+
+Destroy: 2 deleted
+
+>>> print_requests.py //policies/clusters //jobs --nostamp
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/delete",
+  "body": {
+    "job_id": [J_ID]
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/policies/clusters/delete",
+  "body": {
+    "policy_id": "[POL_ID]"
+  }
+}
diff --git a/acceptance/bundle/resources/cluster_policies/job_ref/script b/acceptance/bundle/resources/cluster_policies/job_ref/script
new file mode 100644
index 00000000000..5b273fb62aa
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/job_ref/script
@@ -0,0 +1,17 @@
+trace $CLI bundle deploy
+
+# Register [POL_ID] and [J_ID] so the resolved references are deterministic.
+replace_ids.py
+
+title "Deploy requests in dependency order: policy create precedes job create, job carries resolved policy id"
+trace print_requests.py //policies/clusters //jobs --nostamp
+
+title "Update both the policy and the job"
+trace update_file.py databricks.yml my_policy my_policy_2
+trace update_file.py databricks.yml my_job my_job_2
+trace $CLI bundle deploy
+trace print_requests.py //policies/clusters //jobs --nostamp
+
+title "Destroy: job delete precedes policy delete"
+trace $CLI bundle destroy --auto-approve
+trace print_requests.py //policies/clusters //jobs --nostamp
diff --git a/acceptance/bundle/resources/cluster_policies/job_ref/test.toml b/acceptance/bundle/resources/cluster_policies/job_ref/test.toml
new file mode 100644
index 00000000000..7c7ba8ececc
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/job_ref/test.toml
@@ -0,0 +1,4 @@
+# The job task defines only new_cluster and no task type (notebook_task, etc.), so the
+# real Jobs API rejects it ("No task defined"); the testserver doesn't validate. The task
+# type is irrelevant here since the test only checks policy-id resolution and create ordering.
+Cloud = false
diff --git a/acceptance/bundle/resources/cluster_policies/out_of_band_change/databricks.yml.tmpl b/acceptance/bundle/resources/cluster_policies/out_of_band_change/databricks.yml.tmpl
new file mode 100644
index 00000000000..ba5bd2d6d7d
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/out_of_band_change/databricks.yml.tmpl
@@ -0,0 +1,11 @@
+bundle:
+  name: test_cluster_policy_oob
+
+workspace:
+  root_path: ~/.bundle/$UNIQUE_NAME
+
+resources:
+  cluster_policies:
+    test_cluster_policy:
+      name: my_cluster_policy_oob-$UNIQUE_NAME
+      definition: '{"spark_version":{"type":"fixed","value":"13.3.x-scala2.12"}}'
diff --git a/acceptance/bundle/resources/cluster_policies/out_of_band_change/out.test.toml b/acceptance/bundle/resources/cluster_policies/out_of_band_change/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/out_of_band_change/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/cluster_policies/out_of_band_change/output.txt b/acceptance/bundle/resources/cluster_policies/out_of_band_change/output.txt
new file mode 100644
index 00000000000..d476def4bd3
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/out_of_band_change/output.txt
@@ -0,0 +1,50 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Created cluster_policies.test_cluster_policy
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Plan is a no-op immediately after deploy
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+=== Edit the policy definition out of band
+>>> [CLI] cluster-policies edit --json {"policy_id":"[TEST_CLUSTER_POLICY_ID]","name":"my_cluster_policy_oob-[UNIQUE_NAME]","definition":"{\"spark_version\":{\"type\":\"fixed\",\"value\":\"14.3.x-scala2.12\"}}"}
+
+=== Plan detects the drift
+>>> [CLI] bundle plan
+update cluster_policies.test_cluster_policy
+
+Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
+
+=== Redeploy reconciles the policy back to the configured definition
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Updated cluster_policies.test_cluster_policy
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+=== Verify the edit request restored the configured definition
+>>> print_requests.py //policies/clusters/edit
+{
+  "method": "POST",
+  "path": "/api/2.0/policies/clusters/edit",
+  "body": {
+    "definition": "{\"spark_version\":{\"type\":\"fixed\",\"value\":\"13.3.x-scala2.12\"}}",
+    "name": "my_cluster_policy_oob-[UNIQUE_NAME]",
+    "policy_id": "[TEST_CLUSTER_POLICY_ID]"
+  }
+}
+
+=== Plan is a no-op again
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.cluster_policies.test_cluster_policy
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/cluster_policies/out_of_band_change/script b/acceptance/bundle/resources/cluster_policies/out_of_band_change/script
new file mode 100644
index 00000000000..24e5fb79dac
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/out_of_band_change/script
@@ -0,0 +1,36 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+trace $CLI bundle deploy
+
+title "Plan is a no-op immediately after deploy"
+trace $CLI bundle plan
+
+policy_id="$(read_id.py test_cluster_policy)"
+
+# Simulate an out-of-band change: edit the policy definition directly through the
+# API, the way an admin would in the UI, without touching databricks.yml. The
+# recorded bundle state is now stale, so the next plan must detect the drift.
+title "Edit the policy definition out of band"
+trace $CLI cluster-policies edit --json '{"policy_id":"'"$policy_id"'","name":"my_cluster_policy_oob-'"$UNIQUE_NAME"'","definition":"{\"spark_version\":{\"type\":\"fixed\",\"value\":\"14.3.x-scala2.12\"}}"}'
+
+# Discard the out-of-band request so the verification below captures only the
+# reconciling edit issued by the redeploy.
+rm -f "$OUT_REQUESTS"
+
+title "Plan detects the drift"
+trace $CLI bundle plan
+
+title "Redeploy reconciles the policy back to the configured definition"
+trace $CLI bundle deploy
+
+title "Verify the edit request restored the configured definition"
+trace print_requests.py //policies/clusters/edit
+
+title "Plan is a no-op again"
+trace $CLI bundle plan
diff --git a/acceptance/bundle/resources/cluster_policies/out_of_band_change/test.toml b/acceptance/bundle/resources/cluster_policies/out_of_band_change/test.toml
new file mode 100644
index 00000000000..b03f24bc233
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/out_of_band_change/test.toml
@@ -0,0 +1,4 @@
+Ignore = [
+    ".databricks",
+    "databricks.yml",
+]
diff --git a/acceptance/bundle/resources/cluster_policies/permissions/levels/databricks.yml.tmpl b/acceptance/bundle/resources/cluster_policies/permissions/levels/databricks.yml.tmpl
new file mode 100644
index 00000000000..8ebdcb8c366
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/permissions/levels/databricks.yml.tmpl
@@ -0,0 +1,11 @@
+bundle:
+  name: cluster-policy-permission-levels-$UNIQUE_NAME
+
+resources:
+  cluster_policies:
+    test_cluster_policy:
+      name: my_cluster_policy-$UNIQUE_NAME
+      definition: '{"spark_version":{"type":"fixed","value":"13.3.x-scala2.12"}}'
+      permissions:
+        - level: CAN_USE
+          group_name: users
diff --git a/acceptance/bundle/resources/cluster_policies/permissions/levels/out.test.toml b/acceptance/bundle/resources/cluster_policies/permissions/levels/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/permissions/levels/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/cluster_policies/permissions/levels/output.txt b/acceptance/bundle/resources/cluster_policies/permissions/levels/output.txt
new file mode 100644
index 00000000000..37d4c20606e
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/permissions/levels/output.txt
@@ -0,0 +1,34 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/cluster-policy-permission-levels-[UNIQUE_NAME]/default/files...
+Created cluster_policies.test_cluster_policy
+Created cluster_policies.test_cluster_policy.permissions
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //permissions/cluster-policies
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/cluster-policies/[TEST_CLUSTER_POLICY_ID]",
+  "body": {
+    "access_control_list": [
+      {
+        "group_name": "users",
+        "permission_level": "CAN_USE"
+      }
+    ]
+  }
+}
+
+=== CAN_MANAGE is rejected
+>>> [CLI] bundle destroy --auto-approve
+Warning: invalid value "CAN_MANAGE" for enum field. Valid values are [CAN_USE]
+  at resources.cluster_policies.test_cluster_policy.permissions[0].level
+  in databricks.yml:10:18
+
+The following resources will be deleted:
+  delete resources.cluster_policies.test_cluster_policy
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/cluster-policy-permission-levels-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/cluster_policies/permissions/levels/script b/acceptance/bundle/resources/cluster_policies/permissions/levels/script
new file mode 100644
index 00000000000..a8ea0271534
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/permissions/levels/script
@@ -0,0 +1,20 @@
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+envsubst < databricks.yml.tmpl > databricks.yml
+
+# CAN_USE is accepted: deploy succeeds and the PUT carries CAN_USE.
+trace $CLI bundle deploy
+read_id.py test_cluster_policy > /dev/null
+trace print_requests.py //permissions/cluster-policies
+
+# CAN_MANAGE is rejected, so the redeploy fails with the backend's error.
+# Output goes to LOG (upload counts differ between the fake and cloud); the
+# error message is deterministic and asserted here.
+title "CAN_MANAGE is rejected"
+update_file.py databricks.yml CAN_USE CAN_MANAGE
+musterr $CLI bundle deploy &> LOG.deploy
+cat LOG.deploy | contains.py "Unknown Cluster Policy Permission Level: CAN_MANAGE" > /dev/null
diff --git a/acceptance/bundle/resources/cluster_policies/permissions/levels/test.toml b/acceptance/bundle/resources/cluster_policies/permissions/levels/test.toml
new file mode 100644
index 00000000000..3dd59d27d6c
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/permissions/levels/test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+Ignore = [".databricks", "databricks.yml"]
diff --git a/acceptance/bundle/resources/cluster_policies/permissions/out_of_band_deletion/databricks.yml b/acceptance/bundle/resources/cluster_policies/permissions/out_of_band_deletion/databricks.yml
new file mode 100644
index 00000000000..9615515a7c6
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/permissions/out_of_band_deletion/databricks.yml
@@ -0,0 +1,11 @@
+bundle:
+  name: test_cluster_policy_permissions_recreate
+
+resources:
+  cluster_policies:
+    test_cluster_policy:
+      name: my_cluster_policy
+      definition: '{"spark_version":{"type":"fixed","value":"13.3.x-scala2.12"}}'
+      permissions:
+        - level: CAN_USE
+          group_name: users
diff --git a/acceptance/bundle/resources/cluster_policies/permissions/out_of_band_deletion/out.test.toml b/acceptance/bundle/resources/cluster_policies/permissions/out_of_band_deletion/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/permissions/out_of_band_deletion/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/cluster_policies/permissions/out_of_band_deletion/output.txt b/acceptance/bundle/resources/cluster_policies/permissions/out_of_band_deletion/output.txt
new file mode 100644
index 00000000000..e64e6628d1b
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/permissions/out_of_band_deletion/output.txt
@@ -0,0 +1,56 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test_cluster_policy_permissions_recreate/default/files...
+Created cluster_policies.test_cluster_policy
+Created cluster_policies.test_cluster_policy.permissions
+Files: 1 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Permissions are set on the live policy
+>>> [CLI] api get /api/2.0/permissions/cluster-policies/[TEST_CLUSTER_POLICY_ID]
+{
+  "object_type": "cluster-policy",
+  "access_control_list": [
+    {
+      "all_permissions": [
+        {
+          "inherited": false,
+          "permission_level": "CAN_USE"
+        }
+      ],
+      "group_name": "users"
+    }
+  ]
+}
+
+=== Delete the policy out of band
+>>> [CLI] cluster-policies delete [TEST_CLUSTER_POLICY_ID]
+
+=== Permissions API still returns the ACLs for the deleted policy (no 404)
+>>> [CLI] api get /api/2.0/permissions/cluster-policies/[TEST_CLUSTER_POLICY_ID]
+{
+  "object_type": "cluster-policy",
+  "access_control_list": [
+    {
+      "all_permissions": [
+        {
+          "inherited": false,
+          "permission_level": "CAN_USE"
+        }
+      ],
+      "group_name": "users"
+    }
+  ]
+}
+
+=== Plan recreates the gone policy
+>>> [CLI] bundle plan
+create cluster_policies.test_cluster_policy
+update cluster_policies.test_cluster_policy.permissions
+
+Plan: 1 to add, 1 to change, 0 to delete, 0 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test_cluster_policy_permissions_recreate/default
+
+Destroy: 0 deleted
diff --git a/acceptance/bundle/resources/cluster_policies/permissions/out_of_band_deletion/script b/acceptance/bundle/resources/cluster_policies/permissions/out_of_band_deletion/script
new file mode 100644
index 00000000000..e455885a2e6
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/permissions/out_of_band_deletion/script
@@ -0,0 +1,24 @@
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+trace $CLI bundle deploy
+# Fetch the id via summary + add_repl (a shell function) rather than read_id.py:
+# MSYS_NO_PATHCONV mangles the PATH-resolved python script location on Windows.
+policy_id=$($CLI bundle summary --output json | jq -r '.resources.cluster_policies.test_cluster_policy.id')
+add_repl "$policy_id" TEST_CLUSTER_POLICY_ID
+
+title "Permissions are set on the live policy"
+trace $CLI api get /api/2.0/permissions/cluster-policies/$policy_id | jq '{object_type, access_control_list}'
+
+title "Delete the policy out of band"
+trace $CLI cluster-policies delete "$policy_id"
+
+# v1 quirk: the permissions endpoint keeps returning the ACLs for a deleted
+# cluster policy; it does not 404 the way a v2 cascade-deleted resource would.
+title "Permissions API still returns the ACLs for the deleted policy (no 404)"
+trace $CLI api get /api/2.0/permissions/cluster-policies/$policy_id | jq '{object_type, access_control_list}'
+
+title "Plan recreates the gone policy"
+trace $CLI bundle plan
diff --git a/acceptance/bundle/resources/cluster_policies/permissions/out_of_band_deletion/test.toml b/acceptance/bundle/resources/cluster_policies/permissions/out_of_band_deletion/test.toml
new file mode 100644
index 00000000000..557496316be
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/permissions/out_of_band_deletion/test.toml
@@ -0,0 +1,10 @@
+RecordRequests = false
+# Local-only: fixed policy name is not safe for concurrent cloud runs. Cloud
+# coverage of the permission behavior lives in the levels test.
+Cloud = false
+
+# `api get` is passed a leading-slash path; without this, Git Bash on Windows
+# rewrites /api/... to C:\Program Files\Git\api\... before the CLI sees it.
+Env.MSYS_NO_PATHCONV = "1"
+
+Ignore = [".databricks", "databricks.yml"]
diff --git a/acceptance/bundle/resources/cluster_policies/permissions/out_of_band_grant/databricks.yml b/acceptance/bundle/resources/cluster_policies/permissions/out_of_band_grant/databricks.yml
new file mode 100644
index 00000000000..0c151e08e51
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/permissions/out_of_band_grant/databricks.yml
@@ -0,0 +1,11 @@
+bundle:
+  name: test_cluster_policy_permissions_drift
+
+resources:
+  cluster_policies:
+    test_cluster_policy:
+      name: my_cluster_policy
+      definition: '{"spark_version":{"type":"fixed","value":"13.3.x-scala2.12"}}'
+      permissions:
+        - level: CAN_USE
+          group_name: users
diff --git a/acceptance/bundle/resources/cluster_policies/permissions/out_of_band_grant/out.test.toml b/acceptance/bundle/resources/cluster_policies/permissions/out_of_band_grant/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/permissions/out_of_band_grant/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/cluster_policies/permissions/out_of_band_grant/output.txt b/acceptance/bundle/resources/cluster_policies/permissions/out_of_band_grant/output.txt
new file mode 100644
index 00000000000..886ab1d7f1d
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/permissions/out_of_band_grant/output.txt
@@ -0,0 +1,78 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test_cluster_policy_permissions_drift/default/files...
+Created cluster_policies.test_cluster_policy
+Created cluster_policies.test_cluster_policy.permissions
+Files: 1 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Plan is a no-op immediately after deploy
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
+
+=== Grant an extra principal out of band
+>>> [CLI] cluster-policies set-permissions [TEST_CLUSTER_POLICY_ID] --json {"access_control_list":[{"group_name":"users","permission_level":"CAN_USE"},{"user_name":"intruder@example.com","permission_level":"CAN_USE"}]}
+{
+  "access_control_list": [
+    {
+      "all_permissions": [
+        {
+          "inherited": false,
+          "permission_level": "CAN_USE"
+        }
+      ],
+      "group_name": "users"
+    },
+    {
+      "all_permissions": [
+        {
+          "inherited": false,
+          "permission_level": "CAN_USE"
+        }
+      ],
+      "display_name": "intruder@example.com",
+      "user_name": "intruder@example.com"
+    }
+  ],
+  "object_id": "/cluster-policies/[TEST_CLUSTER_POLICY_ID]",
+  "object_type": "cluster-policy"
+}
+
+=== Plan detects the permission drift
+>>> [CLI] bundle plan
+update cluster_policies.test_cluster_policy.permissions
+
+Plan: 0 to add, 1 to change, 0 to delete, 1 unchanged
+
+=== Redeploy reconciles the ACL back to the configured grants
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test_cluster_policy_permissions_drift/default/files...
+Updated cluster_policies.test_cluster_policy.permissions
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 1 unchanged
+
+>>> print_requests.py //permissions/cluster-policies
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/cluster-policies/[TEST_CLUSTER_POLICY_ID]",
+  "body": {
+    "access_control_list": [
+      {
+        "group_name": "users",
+        "permission_level": "CAN_USE"
+      }
+    ]
+  }
+}
+
+=== Plan is a no-op again
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.cluster_policies.test_cluster_policy
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test_cluster_policy_permissions_drift/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/cluster_policies/permissions/out_of_band_grant/script b/acceptance/bundle/resources/cluster_policies/permissions/out_of_band_grant/script
new file mode 100644
index 00000000000..fd69a6ee970
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/permissions/out_of_band_grant/script
@@ -0,0 +1,33 @@
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+trace $CLI bundle deploy
+
+title "Plan is a no-op immediately after deploy"
+trace $CLI bundle plan
+
+policy_id="$(read_id.py test_cluster_policy)"
+
+# Simulate an out-of-band ACL change the way an admin would in the UI: grant an
+# extra principal directly through the permissions API without touching
+# databricks.yml. The recorded bundle state is now stale, so the next plan must
+# detect the drift.
+title "Grant an extra principal out of band"
+trace $CLI cluster-policies set-permissions "$policy_id" --json '{"access_control_list":[{"group_name":"users","permission_level":"CAN_USE"},{"user_name":"intruder@example.com","permission_level":"CAN_USE"}]}'
+
+# Discard the out-of-band request so the verification below captures only the
+# reconciling Set issued by the redeploy.
+rm -f "$OUT_REQUESTS"
+
+title "Plan detects the permission drift"
+trace $CLI bundle plan
+
+title "Redeploy reconciles the ACL back to the configured grants"
+trace $CLI bundle deploy
+trace print_requests.py //permissions/cluster-policies
+
+title "Plan is a no-op again"
+trace $CLI bundle plan
diff --git a/acceptance/bundle/resources/cluster_policies/permissions/out_of_band_grant/test.toml b/acceptance/bundle/resources/cluster_policies/permissions/out_of_band_grant/test.toml
new file mode 100644
index 00000000000..4a3471ddc43
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/permissions/out_of_band_grant/test.toml
@@ -0,0 +1,4 @@
+# Local-only: fixed policy name is not safe for concurrent cloud runs. Cloud
+# coverage of the permission behavior lives in the levels test.
+Cloud = false
+Ignore = [".databricks", "databricks.yml"]
diff --git a/acceptance/bundle/resources/cluster_policies/policy_family_definition/databricks.yml.tmpl b/acceptance/bundle/resources/cluster_policies/policy_family_definition/databricks.yml.tmpl
new file mode 100644
index 00000000000..d12ce7f8631
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/policy_family_definition/databricks.yml.tmpl
@@ -0,0 +1,13 @@
+bundle:
+  name: cluster_policy_family
+
+workspace:
+  root_path: ~/.bundle/$UNIQUE_NAME
+
+resources:
+  cluster_policies:
+    # Authored from a policy family with no definition. The backend computes the
+    # definition from the family and returns it on read; the config leaves it empty.
+    family_policy:
+      name: my_family_policy-$UNIQUE_NAME
+      policy_family_id: personal-vm
diff --git a/acceptance/bundle/resources/cluster_policies/policy_family_definition/out.test.toml b/acceptance/bundle/resources/cluster_policies/policy_family_definition/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/policy_family_definition/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/cluster_policies/policy_family_definition/output.txt b/acceptance/bundle/resources/cluster_policies/policy_family_definition/output.txt
new file mode 100644
index 00000000000..8389a962f28
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/policy_family_definition/output.txt
@@ -0,0 +1,26 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Created cluster_policies.family_policy
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Plan is a no-op after deploy (server-computed definition is not drift)
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+=== Redeploy issues no edit
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
+
+>>> print_requests.py //policies/clusters/edit
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.cluster_policies.family_policy
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/cluster_policies/policy_family_definition/script b/acceptance/bundle/resources/cluster_policies/policy_family_definition/script
new file mode 100644
index 00000000000..cb47db97a91
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/policy_family_definition/script
@@ -0,0 +1,21 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+trace $CLI bundle deploy
+
+# The backend computes `definition` from the policy family and returns it on read,
+# even though the config leaves definition empty. Because definition is declared as
+# a backend default, the server-computed value must not register as drift: without
+# it every plan would show an update and every deploy would re-issue an edit.
+title "Plan is a no-op after deploy (server-computed definition is not drift)"
+trace $CLI bundle plan
+
+title "Redeploy issues no edit"
+rm -f "$OUT_REQUESTS"
+trace $CLI bundle deploy
+trace print_requests.py //policies/clusters/edit
diff --git a/acceptance/bundle/resources/cluster_policies/policy_family_definition/test.toml b/acceptance/bundle/resources/cluster_policies/policy_family_definition/test.toml
new file mode 100644
index 00000000000..b03f24bc233
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/policy_family_definition/test.toml
@@ -0,0 +1,4 @@
+Ignore = [
+    ".databricks",
+    "databricks.yml",
+]
diff --git a/acceptance/bundle/resources/cluster_policies/policy_family_overrides/databricks.yml.tmpl b/acceptance/bundle/resources/cluster_policies/policy_family_overrides/databricks.yml.tmpl
new file mode 100644
index 00000000000..8dae1b8085c
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/policy_family_overrides/databricks.yml.tmpl
@@ -0,0 +1,37 @@
+bundle:
+  name: cluster_policy_overrides
+
+workspace:
+  root_path: ~/.bundle/$UNIQUE_NAME
+
+resources:
+  cluster_policies:
+    # Overrides as a compact JSON string.
+    json_string:
+      name: policy_json_string-$UNIQUE_NAME
+      policy_family_id: personal-vm
+      policy_family_definition_overrides: '{"autotermination_minutes":{"type":"fixed","value":30}}'
+
+    # Overrides as a multiline block-scalar JSON string (preserved verbatim).
+    multiline:
+      name: policy_multiline-$UNIQUE_NAME
+      policy_family_id: personal-vm
+      policy_family_definition_overrides: |-
+        {
+          "autotermination_minutes": {
+            "type": "fixed",
+            "value": 30
+          }
+        }
+
+    # Overrides as native YAML (normalized to compact JSON, numbers/booleans kept as JSON types).
+    yaml:
+      name: policy_yaml-$UNIQUE_NAME
+      policy_family_id: personal-vm
+      policy_family_definition_overrides:
+        autotermination_minutes:
+          type: fixed
+          value: 30
+        enable_elastic_disk:
+          type: fixed
+          value: true
diff --git a/acceptance/bundle/resources/cluster_policies/policy_family_overrides/out.test.toml b/acceptance/bundle/resources/cluster_policies/policy_family_overrides/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/policy_family_overrides/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/cluster_policies/policy_family_overrides/output.txt b/acceptance/bundle/resources/cluster_policies/policy_family_overrides/output.txt
new file mode 100644
index 00000000000..502906cf07d
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/policy_family_overrides/output.txt
@@ -0,0 +1,67 @@
+
+>>> [CLI] bundle validate -o json
+{
+  "json_string": {
+    "name": "policy_json_string-[UNIQUE_NAME]",
+    "policy_family_definition_overrides": "{\"autotermination_minutes\":{\"type\":\"fixed\",\"value\":30}}",
+    "policy_family_id": "personal-vm"
+  },
+  "multiline": {
+    "name": "policy_multiline-[UNIQUE_NAME]",
+    "policy_family_definition_overrides": "{\n  \"autotermination_minutes\": {\n    \"type\": \"fixed\",\n    \"value\": 30\n  }\n}",
+    "policy_family_id": "personal-vm"
+  },
+  "yaml": {
+    "name": "policy_yaml-[UNIQUE_NAME]",
+    "policy_family_definition_overrides": "{\"autotermination_minutes\":{\"type\":\"fixed\",\"value\":30},\"enable_elastic_disk\":{\"type\":\"fixed\",\"value\":true}}",
+    "policy_family_id": "personal-vm"
+  }
+}
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Created cluster_policies.json_string
+Created cluster_policies.multiline
+Created cluster_policies.yaml
+Files: 2 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Create bodies carry policy_family_id and overrides as a JSON string (YAML normalized, JSON preserved)
+>>> print_requests.py //policies/clusters/create --sort
+{
+  "method": "POST",
+  "path": "/api/2.0/policies/clusters/create",
+  "body": {
+    "name": "policy_json_string-[UNIQUE_NAME]",
+    "policy_family_definition_overrides": "{\"autotermination_minutes\":{\"type\":\"fixed\",\"value\":30}}",
+    "policy_family_id": "personal-vm"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/policies/clusters/create",
+  "body": {
+    "name": "policy_multiline-[UNIQUE_NAME]",
+    "policy_family_definition_overrides": "{\n  \"autotermination_minutes\": {\n    \"type\": \"fixed\",\n    \"value\": 30\n  }\n}",
+    "policy_family_id": "personal-vm"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/policies/clusters/create",
+  "body": {
+    "name": "policy_yaml-[UNIQUE_NAME]",
+    "policy_family_definition_overrides": "{\"autotermination_minutes\":{\"type\":\"fixed\",\"value\":30},\"enable_elastic_disk\":{\"type\":\"fixed\",\"value\":true}}",
+    "policy_family_id": "personal-vm"
+  }
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.cluster_policies.json_string
+  delete resources.cluster_policies.multiline
+  delete resources.cluster_policies.yaml
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 3 deleted
diff --git a/acceptance/bundle/resources/cluster_policies/policy_family_overrides/script b/acceptance/bundle/resources/cluster_policies/policy_family_overrides/script
new file mode 100644
index 00000000000..fcd1d1ec322
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/policy_family_overrides/script
@@ -0,0 +1,13 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+trace $CLI bundle validate -o json | jq ".resources.cluster_policies"
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+trace $CLI bundle deploy
+
+title "Create bodies carry policy_family_id and overrides as a JSON string (YAML normalized, JSON preserved)"
+trace print_requests.py //policies/clusters/create --sort
diff --git a/acceptance/bundle/resources/cluster_policies/test.toml b/acceptance/bundle/resources/cluster_policies/test.toml
new file mode 100644
index 00000000000..36c17b2ed41
--- /dev/null
+++ b/acceptance/bundle/resources/cluster_policies/test.toml
@@ -0,0 +1,5 @@
+Cloud = true
+
+Ignore = [
+    "databricks.yml",
+]
diff --git a/acceptance/bundle/resources/clusters/cluster_policy/databricks.yml.tmpl b/acceptance/bundle/resources/clusters/cluster_policy/databricks.yml.tmpl
new file mode 100644
index 00000000000..a049ea600b4
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/cluster_policy/databricks.yml.tmpl
@@ -0,0 +1,27 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+workspace:
+  root_path: ~/.bundle/$UNIQUE_NAME
+
+resources:
+  cluster_policies:
+    my_policy:
+      name: test-policy-$UNIQUE_NAME
+      definition:
+        # Only a map key: the clusters resource force-sends spark_version, so a scalar the
+        # config omits arrives as "" and a fixed policy rejects it. The scalar-supply case is
+        # covered by fixed_addition, whose job-cluster new_cluster fields are omitempty.
+        custom_tags.CostCenter:
+          type: fixed
+          value: from-policy
+
+  clusters:
+    my_cluster:
+      cluster_name: test-cluster-$UNIQUE_NAME
+      spark_version: $DEFAULT_SPARK_VERSION
+      node_type_id: $NODE_TYPE_ID
+      # Shared pool avoids a cold boot; the policy tag under test is unaffected.
+      instance_pool_id: $TEST_INSTANCE_POOL_ID
+      num_workers: 1
+      policy_id: ${resources.cluster_policies.my_policy.id}
diff --git a/acceptance/bundle/resources/clusters/cluster_policy/out.test.toml b/acceptance/bundle/resources/clusters/cluster_policy/out.test.toml
new file mode 100644
index 00000000000..8bfa768b35b
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/cluster_policy/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = true
+CloudSlow = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/clusters/cluster_policy/output.txt b/acceptance/bundle/resources/clusters/cluster_policy/output.txt
new file mode 100644
index 00000000000..07031d929bf
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/cluster_policy/output.txt
@@ -0,0 +1,34 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Created cluster_policies.my_policy
+Created clusters.my_cluster
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+=== A cluster policy tag on a standalone cluster is not drift
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
+
+=== ...classified remote_addition
+
+>>> [CLI] bundle plan -o json
+{
+  "custom_tags": {
+    "action": "skip",
+    "reason": "remote_addition",
+    "remote": {
+      "CostCenter": "from-policy"
+    }
+  }
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.cluster_policies.my_policy
+  delete resources.clusters.my_cluster
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/clusters/cluster_policy/script b/acceptance/bundle/resources/clusters/cluster_policy/script
new file mode 100644
index 00000000000..d32f03284ae
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/cluster_policy/script
@@ -0,0 +1,15 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+trace $CLI bundle deploy
+
+title "A cluster policy tag on a standalone cluster is not drift\n"
+trace $CLI bundle plan
+
+title "...classified remote_addition\n"
+trace $CLI bundle plan -o json | jq -S '.plan["resources.clusters.my_cluster"].changes
+  | with_entries(select(.key | test("custom_tags")))'
diff --git a/acceptance/bundle/resources/clusters/cluster_policy/test.toml b/acceptance/bundle/resources/clusters/cluster_policy/test.toml
new file mode 100644
index 00000000000..523edb2c8e0
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/cluster_policy/test.toml
@@ -0,0 +1,11 @@
+# The standalone clusters resource boots a real cluster at deploy, which is slow and has hit
+# capacity limits on cloud; CloudSlow keeps it out of the per-PR run (it still runs locally and
+# in the full cloud sweep). Output is projected to the policy tag so it is cloud-portable.
+Cloud = true
+CloudSlow = true
+
+RecordRequests = false
+
+Ignore = [
+    "databricks.yml",
+]
diff --git a/acceptance/bundle/resources/clusters/deploy/data_security_mode/databricks.yml.tmpl b/acceptance/bundle/resources/clusters/deploy/data_security_mode/databricks.yml.tmpl
index fdbc0eda4ef..c265f4efea4 100644
--- a/acceptance/bundle/resources/clusters/deploy/data_security_mode/databricks.yml.tmpl
+++ b/acceptance/bundle/resources/clusters/deploy/data_security_mode/databricks.yml.tmpl
@@ -10,6 +10,7 @@ resources:
       cluster_name: test-cluster-$UNIQUE_NAME
       spark_version: $DEFAULT_SPARK_VERSION
       node_type_id: $NODE_TYPE_ID
+      instance_pool_id: $TEST_INSTANCE_POOL_ID
       num_workers: 2
       spark_conf:
         "spark.executor.memory": "2g"
diff --git a/acceptance/bundle/resources/clusters/deploy/data_security_mode/out.test.toml b/acceptance/bundle/resources/clusters/deploy/data_security_mode/out.test.toml
index 5ad0addb75e..98ccab9aaeb 100644
--- a/acceptance/bundle/resources/clusters/deploy/data_security_mode/out.test.toml
+++ b/acceptance/bundle/resources/clusters/deploy/data_security_mode/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 RunsOnDbr = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/clusters/deploy/data_security_mode/output.txt b/acceptance/bundle/resources/clusters/deploy/data_security_mode/output.txt
index 9a6773a7548..1535ba9c21a 100644
--- a/acceptance/bundle/resources/clusters/deploy/data_security_mode/output.txt
+++ b/acceptance/bundle/resources/clusters/deploy/data_security_mode/output.txt
@@ -1,18 +1,17 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created clusters.test_cluster
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle plan
 Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
@@ -20,5 +19,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/clusters/deploy/data_security_mode/test.toml b/acceptance/bundle/resources/clusters/deploy/data_security_mode/test.toml
index 7a90c60d90b..b937e4738ca 100644
--- a/acceptance/bundle/resources/clusters/deploy/data_security_mode/test.toml
+++ b/acceptance/bundle/resources/clusters/deploy/data_security_mode/test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 RecordRequests = false
 RunsOnDbr = true
diff --git a/acceptance/bundle/resources/clusters/deploy/instance_pool/out.test.toml b/acceptance/bundle/resources/clusters/deploy/instance_pool/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/clusters/deploy/instance_pool/out.test.toml
+++ b/acceptance/bundle/resources/clusters/deploy/instance_pool/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/clusters/deploy/instance_pool/output.txt b/acceptance/bundle/resources/clusters/deploy/instance_pool/output.txt
index 40aff9189c0..3d95b26f400 100644
--- a/acceptance/bundle/resources/clusters/deploy/instance_pool/output.txt
+++ b/acceptance/bundle/resources/clusters/deploy/instance_pool/output.txt
@@ -1,9 +1,11 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-deploy-cluster-instance-pool/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created clusters.cluster1
+Created clusters.cluster2
+Created clusters.cluster3
+Files: 1 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> print_requests.py //clusters/create
 {
@@ -13,7 +15,7 @@ Deployment complete!
     "autotermination_minutes": 60,
     "aws_attributes": {},
     "cluster_name": "test-cluster-1",
-    "instance_pool_id": "ip-[NUMID]",
+    "instance_pool_id": "ip-1234567890",
     "num_workers": 2,
     "spark_conf": {
       "spark.executor.memory": "2g"
@@ -28,7 +30,7 @@ Deployment complete!
     "autotermination_minutes": 60,
     "azure_attributes": {},
     "cluster_name": "test-cluster-2",
-    "instance_pool_id": "ip-[NUMID]",
+    "instance_pool_id": "ip-1234567890",
     "num_workers": 2,
     "spark_conf": {
       "spark.executor.memory": "2g"
@@ -43,7 +45,7 @@ Deployment complete!
     "autotermination_minutes": 60,
     "cluster_name": "test-cluster-3",
     "gcp_attributes": {},
-    "instance_pool_id": "ip-[NUMID]",
+    "instance_pool_id": "ip-1234567890",
     "num_workers": 2,
     "spark_conf": {
       "spark.executor.memory": "2g"
diff --git a/acceptance/bundle/resources/clusters/deploy/instance_pool/test.toml b/acceptance/bundle/resources/clusters/deploy/instance_pool/test.toml
index 964a45f5c1f..ff23f111878 100644
--- a/acceptance/bundle/resources/clusters/deploy/instance_pool/test.toml
+++ b/acceptance/bundle/resources/clusters/deploy/instance_pool/test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
 RecordRequests = true
 
diff --git a/acceptance/bundle/resources/clusters/deploy/instance_pool_and_node_type/out.test.toml b/acceptance/bundle/resources/clusters/deploy/instance_pool_and_node_type/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/clusters/deploy/instance_pool_and_node_type/out.test.toml
+++ b/acceptance/bundle/resources/clusters/deploy/instance_pool_and_node_type/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/clusters/deploy/instance_pool_and_node_type/output.txt b/acceptance/bundle/resources/clusters/deploy/instance_pool_and_node_type/output.txt
index a1ddbdcf7db..375dae7c781 100644
--- a/acceptance/bundle/resources/clusters/deploy/instance_pool_and_node_type/output.txt
+++ b/acceptance/bundle/resources/clusters/deploy/instance_pool_and_node_type/output.txt
@@ -1,9 +1,9 @@
 
 >>> errcode [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-deploy-cluster-instance-pool/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created clusters.cluster1
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> print_requests.py //clusters/create
 {
@@ -13,7 +13,7 @@ Deployment complete!
     "autotermination_minutes": 60,
     "aws_attributes": {},
     "cluster_name": "test-cluster",
-    "instance_pool_id": "ip-[NUMID]",
+    "instance_pool_id": "ip-1234567890",
     "num_workers": 2,
     "spark_conf": {
       "spark.executor.memory": "2g"
diff --git a/acceptance/bundle/resources/clusters/deploy/instance_pool_and_node_type/test.toml b/acceptance/bundle/resources/clusters/deploy/instance_pool_and_node_type/test.toml
index 964a45f5c1f..ff23f111878 100644
--- a/acceptance/bundle/resources/clusters/deploy/instance_pool_and_node_type/test.toml
+++ b/acceptance/bundle/resources/clusters/deploy/instance_pool_and_node_type/test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
 RecordRequests = true
 
diff --git a/acceptance/bundle/resources/clusters/deploy/local_ssd_count/out.requests.direct.json b/acceptance/bundle/resources/clusters/deploy/local_ssd_count/out.requests.json
similarity index 100%
rename from acceptance/bundle/resources/clusters/deploy/local_ssd_count/out.requests.direct.json
rename to acceptance/bundle/resources/clusters/deploy/local_ssd_count/out.requests.json
diff --git a/acceptance/bundle/resources/clusters/deploy/local_ssd_count/out.requests.terraform.json b/acceptance/bundle/resources/clusters/deploy/local_ssd_count/out.requests.terraform.json
deleted file mode 100644
index f8ef61075c4..00000000000
--- a/acceptance/bundle/resources/clusters/deploy/local_ssd_count/out.requests.terraform.json
+++ /dev/null
@@ -1,15 +0,0 @@
-{
-  "method": "POST",
-  "path": "/api/2.1/clusters/create",
-  "body": {
-    "autotermination_minutes": 60,
-    "cluster_name": "test-cluster-[UNIQUE_NAME]",
-    "gcp_attributes": {
-      "availability": "PREEMPTIBLE_GCP",
-      "zone_id": "auto"
-    },
-    "node_type_id": "[NODE_TYPE_ID]",
-    "num_workers": 1,
-    "spark_version": "13.3.x-snapshot-scala2.12"
-  }
-}
diff --git a/acceptance/bundle/resources/clusters/deploy/local_ssd_count/out.result.terraform.txt b/acceptance/bundle/resources/clusters/deploy/local_ssd_count/out.result.terraform.txt
deleted file mode 100644
index b92f0cc5fa6..00000000000
--- a/acceptance/bundle/resources/clusters/deploy/local_ssd_count/out.result.terraform.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-json.gcp_attributes.availability = "PREEMPTIBLE_GCP";
-json.gcp_attributes.first_on_demand = 1;
-json.gcp_attributes.use_preemptible_executors = false;
-json.gcp_attributes.zone_id = "auto";
diff --git a/acceptance/bundle/resources/clusters/deploy/local_ssd_count/out.result.direct.txt b/acceptance/bundle/resources/clusters/deploy/local_ssd_count/out.result.txt
similarity index 100%
rename from acceptance/bundle/resources/clusters/deploy/local_ssd_count/out.result.direct.txt
rename to acceptance/bundle/resources/clusters/deploy/local_ssd_count/out.result.txt
diff --git a/acceptance/bundle/resources/clusters/deploy/local_ssd_count/out.test.toml b/acceptance/bundle/resources/clusters/deploy/local_ssd_count/out.test.toml
index 5a821e39edc..729951c6593 100644
--- a/acceptance/bundle/resources/clusters/deploy/local_ssd_count/out.test.toml
+++ b/acceptance/bundle/resources/clusters/deploy/local_ssd_count/out.test.toml
@@ -1,6 +1,5 @@
-Local = true
 Cloud = true
 CloudEnvs.aws = false
 CloudEnvs.azure = false
 CloudEnvs.gcp = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/clusters/deploy/local_ssd_count/output.txt b/acceptance/bundle/resources/clusters/deploy/local_ssd_count/output.txt
index 02285a52479..9c0498e8813 100644
--- a/acceptance/bundle/resources/clusters/deploy/local_ssd_count/output.txt
+++ b/acceptance/bundle/resources/clusters/deploy/local_ssd_count/output.txt
@@ -1,9 +1,9 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-ssd-count-0-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created clusters.test_cluster
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 === Cluster should exist after bundle deployment:
 
@@ -13,5 +13,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-ssd-count-0-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/clusters/deploy/local_ssd_count/script b/acceptance/bundle/resources/clusters/deploy/local_ssd_count/script
index aa76b105bf0..7455e441da8 100644
--- a/acceptance/bundle/resources/clusters/deploy/local_ssd_count/script
+++ b/acceptance/bundle/resources/clusters/deploy/local_ssd_count/script
@@ -2,13 +2,13 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm out.requests.txt
+    rm "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
 trace $CLI bundle deploy
-print_requests.py //cluster > out.requests.$DATABRICKS_BUNDLE_ENGINE.json
+print_requests.py //cluster > out.requests.json
 
 title "Cluster should exist after bundle deployment:\n"
 CLUSTER_ID=`read_id.py test_cluster`
-$CLI clusters get "${CLUSTER_ID}" | gron.py | grep json.gcp_attributes > out.result.$DATABRICKS_BUNDLE_ENGINE.txt
+$CLI clusters get "${CLUSTER_ID}" | gron.py | grep json.gcp_attributes > out.result.txt
diff --git a/acceptance/bundle/resources/clusters/deploy/local_ssd_count/test.toml b/acceptance/bundle/resources/clusters/deploy/local_ssd_count/test.toml
index b9098e1c7a8..3ef0b0c1bc8 100644
--- a/acceptance/bundle/resources/clusters/deploy/local_ssd_count/test.toml
+++ b/acceptance/bundle/resources/clusters/deploy/local_ssd_count/test.toml
@@ -1,5 +1,3 @@
-Badness = "In terraform, local_ssd_count field is not sent to backend"
-Local = true
 Cloud = true
 RecordRequests = true
 
diff --git a/acceptance/bundle/resources/clusters/deploy/local_ssd_count_update/databricks.yml b/acceptance/bundle/resources/clusters/deploy/local_ssd_count_update/databricks.yml
new file mode 100644
index 00000000000..1ae7ec6362f
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/deploy/local_ssd_count_update/databricks.yml
@@ -0,0 +1,14 @@
+bundle:
+  name: test-bundle
+
+resources:
+  clusters:
+    test_cluster:
+      cluster_name: test-cluster
+      spark_version: 13.3.x-scala2.12
+      node_type_id: n2-highmem-4
+      num_workers: 1
+      gcp_attributes:
+        availability: PREEMPTIBLE_GCP
+        zone_id: auto
+        #local_ssd_count: 0
diff --git a/acceptance/bundle/resources/clusters/deploy/local_ssd_count_update/out.test.toml b/acceptance/bundle/resources/clusters/deploy/local_ssd_count_update/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/deploy/local_ssd_count_update/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/clusters/deploy/local_ssd_count_update/output.txt b/acceptance/bundle/resources/clusters/deploy/local_ssd_count_update/output.txt
new file mode 100644
index 00000000000..0c44e1f2189
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/deploy/local_ssd_count_update/output.txt
@@ -0,0 +1,70 @@
+
+=== Deploy 1: create the cluster with gcp_attributes but no local_ssd_count
+
+>>> [CLI] bundle deploy -qq
+
+=== gcp_attributes sent on create (local_ssd_count absent):
+{
+  "availability": "PREEMPTIBLE_GCP",
+  "zone_id": "auto"
+}
+
+=== Now the user adds an explicit local_ssd_count: 0 to the config
+
+=== Deploy 2: bundle should detect and apply the local_ssd_count change
+
+>>> [CLI] bundle plan
+update clusters.test_cluster
+
+Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
+
+=== local_ssd_count change in the plan:
+{
+  "action": "update",
+  "new": 0
+}
+
+>>> [CLI] bundle deploy -qq
+
+=== gcp_attributes sent on update (empty means the change was NOT applied):
+{
+  "availability": "PREEMPTIBLE_GCP",
+  "local_ssd_count": 0,
+  "zone_id": "auto"
+}
+
+=== Deploy 3: no config change, should converge to a no-op
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+=== Now the user removes local_ssd_count again
+
+=== Deploy 4: removing the explicit 0 is a change, symmetric with setting it
+
+>>> [CLI] bundle plan
+update clusters.test_cluster
+
+Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
+
+=== local_ssd_count change in the plan:
+{
+  "action": "update",
+  "old": 0,
+  "remote": 0
+}
+
+>>> [CLI] bundle deploy -qq
+
+=== Deploy 5: no config change, should converge to a no-op
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.clusters.test_cluster
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/clusters/deploy/local_ssd_count_update/script b/acceptance/bundle/resources/clusters/deploy/local_ssd_count_update/script
new file mode 100644
index 00000000000..4ce07d742fc
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/deploy/local_ssd_count_update/script
@@ -0,0 +1,37 @@
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+title "Deploy 1: create the cluster with gcp_attributes but no local_ssd_count\n"
+trace $CLI bundle deploy -qq
+title "gcp_attributes sent on create (local_ssd_count absent):\n"
+print_requests.py //clusters/create | jq '.body.gcp_attributes'
+
+title "Now the user adds an explicit local_ssd_count: 0 to the config\n"
+update_file.py databricks.yml "#local_ssd_count: 0" "local_ssd_count: 0"
+
+title "Deploy 2: bundle should detect and apply the local_ssd_count change\n"
+trace $CLI bundle plan
+title "local_ssd_count change in the plan:\n"
+$CLI bundle plan -o json | jq '.plan[].changes["gcp_attributes.local_ssd_count"]'
+trace $CLI bundle deploy -qq
+
+title "gcp_attributes sent on update (empty means the change was NOT applied):\n"
+print_requests.py //clusters/edit | jq '.body.gcp_attributes'
+
+title "Deploy 3: no config change, should converge to a no-op\n"
+trace $CLI bundle plan
+
+title "Now the user removes local_ssd_count again\n"
+update_file.py databricks.yml "local_ssd_count: 0" "#local_ssd_count: 0"
+
+title "Deploy 4: removing the explicit 0 is a change, symmetric with setting it\n"
+trace $CLI bundle plan
+title "local_ssd_count change in the plan:\n"
+$CLI bundle plan -o json | jq '.plan[].changes["gcp_attributes.local_ssd_count"]'
+trace $CLI bundle deploy -qq
+
+title "Deploy 5: no config change, should converge to a no-op\n"
+trace $CLI bundle plan
diff --git a/acceptance/bundle/resources/clusters/deploy/local_ssd_count_update/test.toml b/acceptance/bundle/resources/clusters/deploy/local_ssd_count_update/test.toml
new file mode 100644
index 00000000000..9030035317f
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/deploy/local_ssd_count_update/test.toml
@@ -0,0 +1,9 @@
+Cloud = false
+RecordRequests = true
+
+# Terraform never sends local_ssd_count at all (databricks/terraform-provider-databricks#4089),
+# so the update-detection covered here is direct-engine only.
+
+Ignore = [
+    "databricks.yml",
+]
diff --git a/acceptance/bundle/resources/clusters/deploy/num_workers_absent/out.test.toml b/acceptance/bundle/resources/clusters/deploy/num_workers_absent/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/clusters/deploy/num_workers_absent/out.test.toml
+++ b/acceptance/bundle/resources/clusters/deploy/num_workers_absent/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/clusters/deploy/num_workers_absent/output.txt b/acceptance/bundle/resources/clusters/deploy/num_workers_absent/output.txt
index 28a1183e6dc..15c6c001ca7 100644
--- a/acceptance/bundle/resources/clusters/deploy/num_workers_absent/output.txt
+++ b/acceptance/bundle/resources/clusters/deploy/num_workers_absent/output.txt
@@ -1,9 +1,10 @@
 
 >>> errcode [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-deploy-cluster-num-workers-absent/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created clusters.cluster1
+Created clusters.cluster2
+Files: 1 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> print_requests.py //clusters/create
 {
diff --git a/acceptance/bundle/resources/clusters/deploy/num_workers_absent/test.toml b/acceptance/bundle/resources/clusters/deploy/num_workers_absent/test.toml
index 964a45f5c1f..ff23f111878 100644
--- a/acceptance/bundle/resources/clusters/deploy/num_workers_absent/test.toml
+++ b/acceptance/bundle/resources/clusters/deploy/num_workers_absent/test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
 RecordRequests = true
 
diff --git a/acceptance/bundle/resources/clusters/deploy/simple/databricks.yml.tmpl b/acceptance/bundle/resources/clusters/deploy/simple/databricks.yml.tmpl
index 74c340a2492..27ce766f1c6 100644
--- a/acceptance/bundle/resources/clusters/deploy/simple/databricks.yml.tmpl
+++ b/acceptance/bundle/resources/clusters/deploy/simple/databricks.yml.tmpl
@@ -10,6 +10,7 @@ resources:
       cluster_name: test-cluster-$UNIQUE_NAME
       spark_version: $DEFAULT_SPARK_VERSION
       node_type_id: $NODE_TYPE_ID
+      instance_pool_id: $TEST_INSTANCE_POOL_ID
       num_workers: 2
       spark_conf:
         "spark.executor.memory": "2g"
diff --git a/acceptance/bundle/resources/clusters/deploy/simple/out.test.toml b/acceptance/bundle/resources/clusters/deploy/simple/out.test.toml
index 5ad0addb75e..98ccab9aaeb 100644
--- a/acceptance/bundle/resources/clusters/deploy/simple/out.test.toml
+++ b/acceptance/bundle/resources/clusters/deploy/simple/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 RunsOnDbr = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/clusters/deploy/simple/output.txt b/acceptance/bundle/resources/clusters/deploy/simple/output.txt
index e1f1168c24d..4701cd316fc 100644
--- a/acceptance/bundle/resources/clusters/deploy/simple/output.txt
+++ b/acceptance/bundle/resources/clusters/deploy/simple/output.txt
@@ -1,9 +1,10 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created clusters.test_cluster
+Created jobs.foo
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 === Cluster should exist after bundle deployment:
 {
@@ -18,5 +19,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/clusters/deploy/simple/test.toml b/acceptance/bundle/resources/clusters/deploy/simple/test.toml
index 7a90c60d90b..b937e4738ca 100644
--- a/acceptance/bundle/resources/clusters/deploy/simple/test.toml
+++ b/acceptance/bundle/resources/clusters/deploy/simple/test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 RecordRequests = false
 RunsOnDbr = true
diff --git a/acceptance/bundle/resources/clusters/deploy/spot_bid_max_price_update/databricks.yml b/acceptance/bundle/resources/clusters/deploy/spot_bid_max_price_update/databricks.yml
new file mode 100644
index 00000000000..4d45bf1f2ae
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/deploy/spot_bid_max_price_update/databricks.yml
@@ -0,0 +1,13 @@
+bundle:
+  name: test-bundle
+
+resources:
+  clusters:
+    test_cluster:
+      cluster_name: test-cluster
+      spark_version: 13.3.x-scala2.12
+      node_type_id: n2-highmem-4
+      num_workers: 1
+      azure_attributes:
+        availability: SPOT_WITH_FALLBACK_AZURE
+        #spot_bid_max_price: 0
diff --git a/acceptance/bundle/resources/clusters/deploy/spot_bid_max_price_update/out.test.toml b/acceptance/bundle/resources/clusters/deploy/spot_bid_max_price_update/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/deploy/spot_bid_max_price_update/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/clusters/deploy/spot_bid_max_price_update/output.txt b/acceptance/bundle/resources/clusters/deploy/spot_bid_max_price_update/output.txt
new file mode 100644
index 00000000000..b6997db09ef
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/deploy/spot_bid_max_price_update/output.txt
@@ -0,0 +1,68 @@
+
+=== Deploy 1: create the cluster with azure_attributes but no spot_bid_max_price
+
+>>> [CLI] bundle deploy -qq
+
+=== azure_attributes sent on create (spot_bid_max_price absent):
+{
+  "availability": "SPOT_WITH_FALLBACK_AZURE"
+}
+
+=== Now the user adds an explicit spot_bid_max_price: 0 to the config
+
+=== Deploy 2: bundle should detect and apply the spot_bid_max_price change
+
+>>> [CLI] bundle plan
+update clusters.test_cluster
+
+Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
+
+=== spot_bid_max_price change in the plan:
+{
+  "action": "update",
+  "new": 0
+}
+
+>>> [CLI] bundle deploy -qq
+
+=== azure_attributes sent on update (empty means the change was NOT applied):
+{
+  "availability": "SPOT_WITH_FALLBACK_AZURE",
+  "spot_bid_max_price": 0
+}
+
+=== Deploy 3: no config change, should converge to a no-op
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+=== Now the user removes spot_bid_max_price again
+
+=== Deploy 4: removing the explicit 0 is a change, symmetric with setting it
+
+>>> [CLI] bundle plan
+update clusters.test_cluster
+
+Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
+
+=== spot_bid_max_price change in the plan:
+{
+  "action": "update",
+  "old": 0,
+  "remote": 0
+}
+
+>>> [CLI] bundle deploy -qq
+
+=== Deploy 5: no config change, should converge to a no-op
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.clusters.test_cluster
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/clusters/deploy/spot_bid_max_price_update/script b/acceptance/bundle/resources/clusters/deploy/spot_bid_max_price_update/script
new file mode 100644
index 00000000000..450f4e695fd
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/deploy/spot_bid_max_price_update/script
@@ -0,0 +1,37 @@
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+title "Deploy 1: create the cluster with azure_attributes but no spot_bid_max_price\n"
+trace $CLI bundle deploy -qq
+title "azure_attributes sent on create (spot_bid_max_price absent):\n"
+print_requests.py //clusters/create | jq '.body.azure_attributes'
+
+title "Now the user adds an explicit spot_bid_max_price: 0 to the config\n"
+update_file.py databricks.yml "#spot_bid_max_price: 0" "spot_bid_max_price: 0"
+
+title "Deploy 2: bundle should detect and apply the spot_bid_max_price change\n"
+trace $CLI bundle plan
+title "spot_bid_max_price change in the plan:\n"
+$CLI bundle plan -o json | jq '.plan[].changes["azure_attributes.spot_bid_max_price"]'
+trace $CLI bundle deploy -qq
+
+title "azure_attributes sent on update (empty means the change was NOT applied):\n"
+print_requests.py //clusters/edit | jq '.body.azure_attributes'
+
+title "Deploy 3: no config change, should converge to a no-op\n"
+trace $CLI bundle plan
+
+title "Now the user removes spot_bid_max_price again\n"
+update_file.py databricks.yml "spot_bid_max_price: 0" "#spot_bid_max_price: 0"
+
+title "Deploy 4: removing the explicit 0 is a change, symmetric with setting it\n"
+trace $CLI bundle plan
+title "spot_bid_max_price change in the plan:\n"
+$CLI bundle plan -o json | jq '.plan[].changes["azure_attributes.spot_bid_max_price"]'
+trace $CLI bundle deploy -qq
+
+title "Deploy 5: no config change, should converge to a no-op\n"
+trace $CLI bundle plan
diff --git a/acceptance/bundle/resources/clusters/deploy/spot_bid_max_price_update/test.toml b/acceptance/bundle/resources/clusters/deploy/spot_bid_max_price_update/test.toml
new file mode 100644
index 00000000000..503e1c23b26
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/deploy/spot_bid_max_price_update/test.toml
@@ -0,0 +1,9 @@
+Cloud = false
+RecordRequests = true
+
+# Detecting a config change to an explicit zero-value float (azure_attributes.spot_bid_max_price: 0)
+# is direct-engine behavior; the terraform engine handles zero values differently.
+
+Ignore = [
+    "databricks.yml",
+]
diff --git a/acceptance/bundle/resources/clusters/deploy/update-after-create/databricks.yml.tmpl b/acceptance/bundle/resources/clusters/deploy/update-after-create/databricks.yml.tmpl
index 78b5f25595f..c3f9beac6f4 100644
--- a/acceptance/bundle/resources/clusters/deploy/update-after-create/databricks.yml.tmpl
+++ b/acceptance/bundle/resources/clusters/deploy/update-after-create/databricks.yml.tmpl
@@ -10,6 +10,7 @@ resources:
       cluster_name: test-cluster-$UNIQUE_NAME
       spark_version: $DEFAULT_SPARK_VERSION
       node_type_id: $NODE_TYPE_ID
+      instance_pool_id: $TEST_INSTANCE_POOL_ID
       num_workers: 2
       spark_conf:
         "spark.executor.memory": "2g"
diff --git a/acceptance/bundle/resources/clusters/deploy/update-after-create/out.test.toml b/acceptance/bundle/resources/clusters/deploy/update-after-create/out.test.toml
index bbc7fcfd1bd..0f167effef1 100644
--- a/acceptance/bundle/resources/clusters/deploy/update-after-create/out.test.toml
+++ b/acceptance/bundle/resources/clusters/deploy/update-after-create/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/clusters/deploy/update-after-create/output.txt b/acceptance/bundle/resources/clusters/deploy/update-after-create/output.txt
index fe0c9b0f9e1..c4f8337b8bf 100644
--- a/acceptance/bundle/resources/clusters/deploy/update-after-create/output.txt
+++ b/acceptance/bundle/resources/clusters/deploy/update-after-create/output.txt
@@ -1,9 +1,9 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created clusters.test_cluster
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 === Cluster should exist after bundle deployment:
 {
@@ -20,9 +20,9 @@ Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated clusters.test_cluster
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
@@ -30,5 +30,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/clusters/deploy/update-after-create/script b/acceptance/bundle/resources/clusters/deploy/update-after-create/script
index 931cf598e98..05409a7ffcb 100644
--- a/acceptance/bundle/resources/clusters/deploy/update-after-create/script
+++ b/acceptance/bundle/resources/clusters/deploy/update-after-create/script
@@ -2,7 +2,6 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm -f out.requests.txt
 }
 trap cleanup EXIT
 
@@ -13,6 +12,8 @@ CLUSTER_ID=$($CLI bundle summary -o json | jq -r '.resources.clusters.test_clust
 $CLI clusters get "${CLUSTER_ID}" | jq '{cluster_name,num_workers}'
 
 title "Updating cluster should call update API\n"
-update_file.py databricks.yml "\"spark.executor.memory\": \"2g\"" "\"spark.executor.memory\": \"4g\""
+# The cluster routes through the shared instance pool (node type c5d.xlarge),
+# whose maximum executor heap is 3157 MB, so keep the bumped value under that.
+update_file.py databricks.yml "\"spark.executor.memory\": \"2g\"" "\"spark.executor.memory\": \"3g\""
 trace $CLI bundle plan
 trace $CLI bundle deploy
diff --git a/acceptance/bundle/resources/clusters/deploy/update-after-create/test.toml b/acceptance/bundle/resources/clusters/deploy/update-after-create/test.toml
index f69673a73eb..ab4e6e22a98 100644
--- a/acceptance/bundle/resources/clusters/deploy/update-after-create/test.toml
+++ b/acceptance/bundle/resources/clusters/deploy/update-after-create/test.toml
@@ -1,6 +1,5 @@
-Local = true
 Cloud = true
-RecordRequests = true
+RecordRequests = false
 
 Ignore = [
     "databricks.yml",
diff --git a/acceptance/bundle/resources/clusters/deploy/update-and-resize-autoscale/out.plan_.direct.json b/acceptance/bundle/resources/clusters/deploy/update-and-resize-autoscale/out.plan_.direct.json
deleted file mode 100644
index ea57340a313..00000000000
--- a/acceptance/bundle/resources/clusters/deploy/update-and-resize-autoscale/out.plan_.direct.json
+++ /dev/null
@@ -1,309 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.clusters.test_cluster": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "autotermination_minutes": 60,
-          "cluster_name": "test-cluster-[UNIQUE_NAME]",
-          "node_type_id": "[NODE_TYPE_ID]",
-          "num_workers": 2,
-          "spark_version": "13.3.x-snapshot-scala2.12"
-        }
-      }
-    }
-  }
-}
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.clusters.test_cluster": {
-      "action": "update",
-      "new_state": {
-        "value": {
-          "autoscale": {
-            "max_workers": 4,
-            "min_workers": 2
-          },
-          "autotermination_minutes": 60,
-          "cluster_name": "test-cluster-[UNIQUE_NAME]",
-          "node_type_id": "[NODE_TYPE_ID]",
-          "spark_version": "13.3.x-snapshot-scala2.12"
-        }
-      },
-      "remote_state": {
-        "autotermination_minutes": 60,
-        "aws_attributes": {
-          "availability": "SPOT_WITH_FALLBACK",
-          "zone_id": "us-east-1c"
-        },
-        "cluster_id": "[CLUSTER_ID]",
-        "cluster_name": "test-cluster-[UNIQUE_NAME]",
-        "driver_node_type_id": "[NODE_TYPE_ID]",
-        "enable_elastic_disk": false,
-        "node_type_id": "[NODE_TYPE_ID]",
-        "num_workers": 2,
-        "spark_version": "13.3.x-snapshot-scala2.12"
-      },
-      "changes": {
-        "autoscale": {
-          "action": "update",
-          "new": {
-            "max_workers": 4,
-            "min_workers": 2
-          }
-        },
-        "aws_attributes": {
-          "action": "skip",
-          "reason": "managed",
-          "remote": {
-            "availability": "SPOT_WITH_FALLBACK",
-            "zone_id": "us-east-1c"
-          }
-        },
-        "driver_node_type_id": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "[NODE_TYPE_ID]"
-        },
-        "enable_elastic_disk": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": false
-        },
-        "num_workers": {
-          "action": "update",
-          "old": 2,
-          "remote": 2
-        }
-      }
-    }
-  }
-}
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 2,
-  "plan": {
-    "resources.clusters.test_cluster": {
-      "action": "update",
-      "new_state": {
-        "value": {
-          "autoscale": {
-            "max_workers": 5,
-            "min_workers": 3
-          },
-          "autotermination_minutes": 60,
-          "cluster_name": "test-cluster-[UNIQUE_NAME]",
-          "node_type_id": "[NODE_TYPE_ID]",
-          "spark_version": "13.3.x-snapshot-scala2.12"
-        }
-      },
-      "remote_state": {
-        "autoscale": {
-          "max_workers": 4,
-          "min_workers": 2
-        },
-        "autotermination_minutes": 60,
-        "aws_attributes": {
-          "availability": "SPOT_WITH_FALLBACK",
-          "zone_id": "us-east-1c"
-        },
-        "cluster_id": "[CLUSTER_ID]",
-        "cluster_name": "test-cluster-[UNIQUE_NAME]",
-        "driver_node_type_id": "[NODE_TYPE_ID]",
-        "enable_elastic_disk": false,
-        "node_type_id": "[NODE_TYPE_ID]",
-        "spark_version": "13.3.x-snapshot-scala2.12"
-      },
-      "changes": {
-        "autoscale.max_workers": {
-          "action": "update",
-          "old": 4,
-          "new": 5,
-          "remote": 4
-        },
-        "autoscale.min_workers": {
-          "action": "update",
-          "old": 2,
-          "new": 3,
-          "remote": 2
-        },
-        "aws_attributes": {
-          "action": "skip",
-          "reason": "managed",
-          "remote": {
-            "availability": "SPOT_WITH_FALLBACK",
-            "zone_id": "us-east-1c"
-          }
-        },
-        "driver_node_type_id": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "[NODE_TYPE_ID]"
-        },
-        "enable_elastic_disk": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": false
-        }
-      }
-    }
-  }
-}
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 3,
-  "plan": {
-    "resources.clusters.test_cluster": {
-      "action": "resize",
-      "new_state": {
-        "value": {
-          "autoscale": {
-            "max_workers": 6,
-            "min_workers": 4
-          },
-          "autotermination_minutes": 60,
-          "cluster_name": "test-cluster-[UNIQUE_NAME]",
-          "node_type_id": "[NODE_TYPE_ID]",
-          "spark_version": "13.3.x-snapshot-scala2.12"
-        }
-      },
-      "remote_state": {
-        "autoscale": {
-          "max_workers": 5,
-          "min_workers": 3
-        },
-        "autotermination_minutes": 60,
-        "aws_attributes": {
-          "availability": "SPOT_WITH_FALLBACK",
-          "zone_id": "us-east-1c"
-        },
-        "cluster_id": "[CLUSTER_ID]",
-        "cluster_name": "test-cluster-[UNIQUE_NAME]",
-        "driver_node_type_id": "[NODE_TYPE_ID]",
-        "enable_elastic_disk": false,
-        "node_type_id": "[NODE_TYPE_ID]",
-        "spark_version": "13.3.x-snapshot-scala2.12",
-        "state": "RUNNING"
-      },
-      "changes": {
-        "autoscale.max_workers": {
-          "action": "resize",
-          "reason": "custom",
-          "old": 5,
-          "new": 6,
-          "remote": 5
-        },
-        "autoscale.min_workers": {
-          "action": "resize",
-          "reason": "custom",
-          "old": 3,
-          "new": 4,
-          "remote": 3
-        },
-        "aws_attributes": {
-          "action": "skip",
-          "reason": "managed",
-          "remote": {
-            "availability": "SPOT_WITH_FALLBACK",
-            "zone_id": "us-east-1c"
-          }
-        },
-        "driver_node_type_id": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "[NODE_TYPE_ID]"
-        },
-        "enable_elastic_disk": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": false
-        }
-      }
-    }
-  }
-}
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 4,
-  "plan": {
-    "resources.clusters.test_cluster": {
-      "action": "resize",
-      "new_state": {
-        "value": {
-          "autotermination_minutes": 60,
-          "cluster_name": "test-cluster-[UNIQUE_NAME]",
-          "node_type_id": "[NODE_TYPE_ID]",
-          "num_workers": 3,
-          "spark_version": "13.3.x-snapshot-scala2.12"
-        }
-      },
-      "remote_state": {
-        "autoscale": {
-          "max_workers": 6,
-          "min_workers": 4
-        },
-        "autotermination_minutes": 60,
-        "aws_attributes": {
-          "availability": "SPOT_WITH_FALLBACK",
-          "zone_id": "us-east-1c"
-        },
-        "cluster_id": "[CLUSTER_ID]",
-        "cluster_name": "test-cluster-[UNIQUE_NAME]",
-        "driver_node_type_id": "[NODE_TYPE_ID]",
-        "enable_elastic_disk": false,
-        "node_type_id": "[NODE_TYPE_ID]",
-        "spark_version": "13.3.x-snapshot-scala2.12",
-        "state": "RUNNING"
-      },
-      "changes": {
-        "autoscale": {
-          "action": "resize",
-          "reason": "custom",
-          "old": {
-            "max_workers": 6,
-            "min_workers": 4
-          },
-          "remote": {
-            "max_workers": 6,
-            "min_workers": 4
-          }
-        },
-        "aws_attributes": {
-          "action": "skip",
-          "reason": "managed",
-          "remote": {
-            "availability": "SPOT_WITH_FALLBACK",
-            "zone_id": "us-east-1c"
-          }
-        },
-        "driver_node_type_id": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "[NODE_TYPE_ID]"
-        },
-        "enable_elastic_disk": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": false
-        },
-        "num_workers": {
-          "action": "resize",
-          "reason": "custom",
-          "new": 3
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/clusters/deploy/update-and-resize-autoscale/out.plan_.json b/acceptance/bundle/resources/clusters/deploy/update-and-resize-autoscale/out.plan_.json
new file mode 100644
index 00000000000..9836cda3719
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/deploy/update-and-resize-autoscale/out.plan_.json
@@ -0,0 +1,351 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.clusters.test_cluster": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "autotermination_minutes": 60,
+          "cluster_name": "test-cluster-[UNIQUE_NAME]",
+          "node_type_id": "[NODE_TYPE_ID]",
+          "num_workers": 2,
+          "spark_version": "13.3.x-snapshot-scala2.12"
+        }
+      }
+    }
+  }
+}
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.clusters.test_cluster": {
+      "action": "update",
+      "new_state": {
+        "value": {
+          "autoscale": {
+            "max_workers": 4,
+            "min_workers": 2
+          },
+          "autotermination_minutes": 60,
+          "cluster_name": "test-cluster-[UNIQUE_NAME]",
+          "node_type_id": "[NODE_TYPE_ID]",
+          "spark_version": "13.3.x-snapshot-scala2.12"
+        }
+      },
+      "remote_state": {
+        "autotermination_minutes": 60,
+        "aws_attributes": {
+          "availability": "SPOT_WITH_FALLBACK",
+          "zone_id": "us-east-1c"
+        },
+        "cluster_id": "[CLUSTER_ID]",
+        "cluster_name": "test-cluster-[UNIQUE_NAME]",
+        "driver_node_type_id": "[NODE_TYPE_ID]",
+        "enable_elastic_disk": false,
+        "lifecycle": {
+          "started": false
+        },
+        "node_type_id": "[NODE_TYPE_ID]",
+        "num_workers": 2,
+        "spark_version": "13.3.x-snapshot-scala2.12",
+        "state": "TERMINATED"
+      },
+      "changes": {
+        "autoscale": {
+          "action": "update",
+          "new": {
+            "max_workers": 4,
+            "min_workers": 2
+          }
+        },
+        "aws_attributes": {
+          "action": "skip",
+          "reason": "managed",
+          "remote": {
+            "availability": "SPOT_WITH_FALLBACK",
+            "zone_id": "us-east-1c"
+          }
+        },
+        "driver_node_type_id": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": "[NODE_TYPE_ID]"
+        },
+        "enable_elastic_disk": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": false
+        },
+        "lifecycle": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": {
+            "started": false
+          }
+        },
+        "num_workers": {
+          "action": "update",
+          "old": 2,
+          "remote": 2
+        }
+      }
+    }
+  }
+}
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 2,
+  "plan": {
+    "resources.clusters.test_cluster": {
+      "action": "update",
+      "new_state": {
+        "value": {
+          "autoscale": {
+            "max_workers": 5,
+            "min_workers": 3
+          },
+          "autotermination_minutes": 60,
+          "cluster_name": "test-cluster-[UNIQUE_NAME]",
+          "node_type_id": "[NODE_TYPE_ID]",
+          "spark_version": "13.3.x-snapshot-scala2.12"
+        }
+      },
+      "remote_state": {
+        "autoscale": {
+          "max_workers": 4,
+          "min_workers": 2
+        },
+        "autotermination_minutes": 60,
+        "aws_attributes": {
+          "availability": "SPOT_WITH_FALLBACK",
+          "zone_id": "us-east-1c"
+        },
+        "cluster_id": "[CLUSTER_ID]",
+        "cluster_name": "test-cluster-[UNIQUE_NAME]",
+        "driver_node_type_id": "[NODE_TYPE_ID]",
+        "enable_elastic_disk": false,
+        "lifecycle": {
+          "started": false
+        },
+        "node_type_id": "[NODE_TYPE_ID]",
+        "spark_version": "13.3.x-snapshot-scala2.12",
+        "state": "TERMINATED"
+      },
+      "changes": {
+        "autoscale.max_workers": {
+          "action": "update",
+          "old": 4,
+          "new": 5,
+          "remote": 4
+        },
+        "autoscale.min_workers": {
+          "action": "update",
+          "old": 2,
+          "new": 3,
+          "remote": 2
+        },
+        "aws_attributes": {
+          "action": "skip",
+          "reason": "managed",
+          "remote": {
+            "availability": "SPOT_WITH_FALLBACK",
+            "zone_id": "us-east-1c"
+          }
+        },
+        "driver_node_type_id": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": "[NODE_TYPE_ID]"
+        },
+        "enable_elastic_disk": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": false
+        },
+        "lifecycle": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": {
+            "started": false
+          }
+        }
+      }
+    }
+  }
+}
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 3,
+  "plan": {
+    "resources.clusters.test_cluster": {
+      "action": "resize",
+      "new_state": {
+        "value": {
+          "autoscale": {
+            "max_workers": 6,
+            "min_workers": 4
+          },
+          "autotermination_minutes": 60,
+          "cluster_name": "test-cluster-[UNIQUE_NAME]",
+          "node_type_id": "[NODE_TYPE_ID]",
+          "spark_version": "13.3.x-snapshot-scala2.12"
+        }
+      },
+      "remote_state": {
+        "autoscale": {
+          "max_workers": 5,
+          "min_workers": 3
+        },
+        "autotermination_minutes": 60,
+        "aws_attributes": {
+          "availability": "SPOT_WITH_FALLBACK",
+          "zone_id": "us-east-1c"
+        },
+        "cluster_id": "[CLUSTER_ID]",
+        "cluster_name": "test-cluster-[UNIQUE_NAME]",
+        "driver_node_type_id": "[NODE_TYPE_ID]",
+        "enable_elastic_disk": false,
+        "lifecycle": {
+          "started": true
+        },
+        "node_type_id": "[NODE_TYPE_ID]",
+        "spark_version": "13.3.x-snapshot-scala2.12",
+        "state": "RUNNING"
+      },
+      "changes": {
+        "autoscale.max_workers": {
+          "action": "resize",
+          "reason": "custom",
+          "old": 5,
+          "new": 6,
+          "remote": 5
+        },
+        "autoscale.min_workers": {
+          "action": "resize",
+          "reason": "custom",
+          "old": 3,
+          "new": 4,
+          "remote": 3
+        },
+        "aws_attributes": {
+          "action": "skip",
+          "reason": "managed",
+          "remote": {
+            "availability": "SPOT_WITH_FALLBACK",
+            "zone_id": "us-east-1c"
+          }
+        },
+        "driver_node_type_id": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": "[NODE_TYPE_ID]"
+        },
+        "enable_elastic_disk": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": false
+        },
+        "lifecycle": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": {
+            "started": true
+          }
+        }
+      }
+    }
+  }
+}
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 4,
+  "plan": {
+    "resources.clusters.test_cluster": {
+      "action": "resize",
+      "new_state": {
+        "value": {
+          "autotermination_minutes": 60,
+          "cluster_name": "test-cluster-[UNIQUE_NAME]",
+          "node_type_id": "[NODE_TYPE_ID]",
+          "num_workers": 3,
+          "spark_version": "13.3.x-snapshot-scala2.12"
+        }
+      },
+      "remote_state": {
+        "autoscale": {
+          "max_workers": 6,
+          "min_workers": 4
+        },
+        "autotermination_minutes": 60,
+        "aws_attributes": {
+          "availability": "SPOT_WITH_FALLBACK",
+          "zone_id": "us-east-1c"
+        },
+        "cluster_id": "[CLUSTER_ID]",
+        "cluster_name": "test-cluster-[UNIQUE_NAME]",
+        "driver_node_type_id": "[NODE_TYPE_ID]",
+        "enable_elastic_disk": false,
+        "lifecycle": {
+          "started": true
+        },
+        "node_type_id": "[NODE_TYPE_ID]",
+        "spark_version": "13.3.x-snapshot-scala2.12",
+        "state": "RUNNING"
+      },
+      "changes": {
+        "autoscale": {
+          "action": "resize",
+          "reason": "custom",
+          "old": {
+            "max_workers": 6,
+            "min_workers": 4
+          },
+          "remote": {
+            "max_workers": 6,
+            "min_workers": 4
+          }
+        },
+        "aws_attributes": {
+          "action": "skip",
+          "reason": "managed",
+          "remote": {
+            "availability": "SPOT_WITH_FALLBACK",
+            "zone_id": "us-east-1c"
+          }
+        },
+        "driver_node_type_id": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": "[NODE_TYPE_ID]"
+        },
+        "enable_elastic_disk": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": false
+        },
+        "lifecycle": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": {
+            "started": true
+          }
+        },
+        "num_workers": {
+          "action": "resize",
+          "reason": "custom",
+          "new": 3
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/clusters/deploy/update-and-resize-autoscale/out.plan_.terraform.json b/acceptance/bundle/resources/clusters/deploy/update-and-resize-autoscale/out.plan_.terraform.json
deleted file mode 100644
index 0c92dfb4ad8..00000000000
--- a/acceptance/bundle/resources/clusters/deploy/update-and-resize-autoscale/out.plan_.terraform.json
+++ /dev/null
@@ -1,40 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.clusters.test_cluster": {
-      "action": "create"
-    }
-  }
-}
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.clusters.test_cluster": {
-      "action": "update"
-    }
-  }
-}
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.clusters.test_cluster": {
-      "action": "update"
-    }
-  }
-}
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.clusters.test_cluster": {
-      "action": "update"
-    }
-  }
-}
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.clusters.test_cluster": {
-      "action": "update"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/clusters/deploy/update-and-resize-autoscale/out.plan_.terraform.txt b/acceptance/bundle/resources/clusters/deploy/update-and-resize-autoscale/out.plan_.terraform.txt
deleted file mode 100644
index 73b40dacde6..00000000000
--- a/acceptance/bundle/resources/clusters/deploy/update-and-resize-autoscale/out.plan_.terraform.txt
+++ /dev/null
@@ -1,15 +0,0 @@
-create clusters.test_cluster
-
-Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
-update clusters.test_cluster
-
-Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
-update clusters.test_cluster
-
-Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
-update clusters.test_cluster
-
-Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
-update clusters.test_cluster
-
-Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
diff --git a/acceptance/bundle/resources/clusters/deploy/update-and-resize-autoscale/out.plan_.direct.txt b/acceptance/bundle/resources/clusters/deploy/update-and-resize-autoscale/out.plan_.txt
similarity index 100%
rename from acceptance/bundle/resources/clusters/deploy/update-and-resize-autoscale/out.plan_.direct.txt
rename to acceptance/bundle/resources/clusters/deploy/update-and-resize-autoscale/out.plan_.txt
diff --git a/acceptance/bundle/resources/clusters/deploy/update-and-resize-autoscale/out.test.toml b/acceptance/bundle/resources/clusters/deploy/update-and-resize-autoscale/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/clusters/deploy/update-and-resize-autoscale/out.test.toml
+++ b/acceptance/bundle/resources/clusters/deploy/update-and-resize-autoscale/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/clusters/deploy/update-and-resize-autoscale/output.txt b/acceptance/bundle/resources/clusters/deploy/update-and-resize-autoscale/output.txt
index 7aa65c2212e..e43ed62ce94 100644
--- a/acceptance/bundle/resources/clusters/deploy/update-and-resize-autoscale/output.txt
+++ b/acceptance/bundle/resources/clusters/deploy/update-and-resize-autoscale/output.txt
@@ -1,9 +1,8 @@
 
->>> [CLI] bundle deploy
+>>> [CLI] bundle deploy -q
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 5 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 === Cluster should exist with num_workers after bundle deployment:
 {
@@ -12,15 +11,19 @@ Deployment complete!
   "autoscale": null
 }
 
+=== Terminating the cluster
+{
+  "cluster_id": "[CLUSTER_ID]"
+}
+
 === Adding autoscale section should call update API on stopped cluster
 
->>> [CLI] bundle deploy
+>>> [CLI] bundle deploy -q
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 3 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
->>> jq select(.method == "POST" and (.path | contains("/clusters/edit"))) | del(.body.aws_attributes, .body.driver_node_type_id, .body.data_security_mode, .body.enable_elastic_disk) out.requests.txt
+>>> jq select(.method == "POST" and (.path | contains("/clusters/edit"))) | del(.body.aws_attributes, .body.driver_node_type_id, .body.data_security_mode, .body.enable_elastic_disk) [OUTPUT_DIR]/out.requests.txt
 {
   "method": "POST",
   "path": "/api/2.1/clusters/edit",
@@ -49,13 +52,12 @@ Deployment complete!
 
 === Changing autoscale should call update API on stopped cluster
 
->>> [CLI] bundle deploy
+>>> [CLI] bundle deploy -q
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 3 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
->>> jq select(.method == "POST" and (.path | contains("/clusters/edit"))) | del(.body.aws_attributes, .body.driver_node_type_id, .body.data_security_mode, .body.enable_elastic_disk) out.requests.txt
+>>> jq select(.method == "POST" and (.path | contains("/clusters/edit"))) | del(.body.aws_attributes, .body.driver_node_type_id, .body.data_security_mode, .body.enable_elastic_disk) [OUTPUT_DIR]/out.requests.txt
 {
   "method": "POST",
   "path": "/api/2.1/clusters/edit",
@@ -104,13 +106,12 @@ Deployment complete!
 
 === Changing autoscale should call resize API on running cluster
 
->>> [CLI] bundle deploy
+>>> [CLI] bundle deploy -q
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 3 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
->>> jq select(.method == "POST" and (.path | contains("/clusters/resize"))) out.requests.txt
+>>> jq select(.method == "POST" and (.path | contains("/clusters/resize"))) [OUTPUT_DIR]/out.requests.txt
 {
   "method": "POST",
   "path": "/api/2.1/clusters/resize",
@@ -135,13 +136,12 @@ Deployment complete!
 
 === Removing autoscale section should call resize API
 
->>> [CLI] bundle deploy
+>>> [CLI] bundle deploy -q
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 3 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
->>> jq select(.method == "POST" and (.path | contains("/clusters/resize"))) out.requests.txt
+>>> jq select(.method == "POST" and (.path | contains("/clusters/resize"))) [OUTPUT_DIR]/out.requests.txt
 {
   "method": "POST",
   "path": "/api/2.1/clusters/resize",
@@ -164,5 +164,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/clusters/deploy/update-and-resize-autoscale/script b/acceptance/bundle/resources/clusters/deploy/update-and-resize-autoscale/script
index f879f963f4e..e336ebc564f 100755
--- a/acceptance/bundle/resources/clusters/deploy/update-and-resize-autoscale/script
+++ b/acceptance/bundle/resources/clusters/deploy/update-and-resize-autoscale/script
@@ -2,28 +2,34 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm out.requests.txt
+    rm "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
-$CLI bundle plan > out.plan_.$DATABRICKS_BUNDLE_ENGINE.txt
-$CLI bundle plan -o json > out.plan_.$DATABRICKS_BUNDLE_ENGINE.json
-trace $CLI bundle deploy
+# Deploy with -q throughout: the engines name this action differently (direct reports
+# resize, terraform update), so the per-resource line would diverge. The Resources:
+# summary agrees, so it is kept rather than using -qq.
+$CLI bundle plan > out.plan_.txt
+$CLI bundle plan -o json | nostamp > out.plan_.json
+trace $CLI bundle deploy -q
 
 title "Cluster should exist with num_workers after bundle deployment:\n"
-CLUSTER_ID=$($CLI bundle summary -o json | jq -r '.resources.clusters.test_cluster.id')
-echo "$CLUSTER_ID:CLUSTER_ID" >> ACC_REPLS
+CLUSTER_ID=$($CLI bundle summary -o json | nostamp | jq -r '.resources.clusters.test_cluster.id')
+add_repl "$CLUSTER_ID" CLUSTER_ID
 $CLI clusters get "${CLUSTER_ID}" | jq '{cluster_name,num_workers,autoscale}'
 
+title "Terminating the cluster\n"
+$CLI clusters delete "${CLUSTER_ID}" | jq '{cluster_id}'
+
 title "Adding autoscale section should call update API on stopped cluster\n"
 update_file.py databricks.yml "      num_workers: 2" "      autoscale:
         min_workers: 2
         max_workers: 4"
-$CLI bundle plan >> out.plan_.$DATABRICKS_BUNDLE_ENGINE.txt
-$CLI bundle plan -o json >> out.plan_.$DATABRICKS_BUNDLE_ENGINE.json
-trace $CLI bundle deploy
-trace jq 'select(.method == "POST" and (.path | contains("/clusters/edit"))) | del(.body.aws_attributes, .body.driver_node_type_id, .body.data_security_mode, .body.enable_elastic_disk)' out.requests.txt
-rm out.requests.txt
+$CLI bundle plan >> out.plan_.txt
+$CLI bundle plan -o json | nostamp >> out.plan_.json
+trace $CLI bundle deploy -q
+trace jq 'select(.method == "POST" and (.path | contains("/clusters/edit"))) | del(.body.aws_attributes, .body.driver_node_type_id, .body.data_security_mode, .body.enable_elastic_disk)' "$OUT_REQUESTS"
+rm "$OUT_REQUESTS"
 
 title "Cluster should have autoscale\n"
 $CLI clusters get "${CLUSTER_ID}" | jq '{cluster_name,num_workers,autoscale}'
@@ -31,11 +37,11 @@ $CLI clusters get "${CLUSTER_ID}" | jq '{cluster_name,num_workers,autoscale}'
 title "Changing autoscale should call update API on stopped cluster\n"
 update_file.py databricks.yml "min_workers: 2" "min_workers: 3"
 update_file.py databricks.yml "max_workers: 4" "max_workers: 5"
-$CLI bundle plan >> out.plan_.$DATABRICKS_BUNDLE_ENGINE.txt
-$CLI bundle plan -o json >> out.plan_.$DATABRICKS_BUNDLE_ENGINE.json
-trace $CLI bundle deploy
-trace jq 'select(.method == "POST" and (.path | contains("/clusters/edit"))) | del(.body.aws_attributes, .body.driver_node_type_id, .body.data_security_mode, .body.enable_elastic_disk)' out.requests.txt
-rm out.requests.txt
+$CLI bundle plan >> out.plan_.txt
+$CLI bundle plan -o json | nostamp >> out.plan_.json
+trace $CLI bundle deploy -q
+trace jq 'select(.method == "POST" and (.path | contains("/clusters/edit"))) | del(.body.aws_attributes, .body.driver_node_type_id, .body.data_security_mode, .body.enable_elastic_disk)' "$OUT_REQUESTS"
+rm "$OUT_REQUESTS"
 
 title "Cluster should have new autoscale\n"
 $CLI clusters get "${CLUSTER_ID}" | jq '{cluster_name,num_workers,autoscale}'
@@ -46,11 +52,11 @@ $CLI clusters start "${CLUSTER_ID}"
 title "Changing autoscale should call resize API on running cluster\n"
 update_file.py databricks.yml "min_workers: 3" "min_workers: 4"
 update_file.py databricks.yml "max_workers: 5" "max_workers: 6"
-$CLI bundle plan >> out.plan_.$DATABRICKS_BUNDLE_ENGINE.txt
-$CLI bundle plan -o json >> out.plan_.$DATABRICKS_BUNDLE_ENGINE.json
-trace $CLI bundle deploy
-trace jq 'select(.method == "POST" and (.path | contains("/clusters/resize")))' out.requests.txt
-rm out.requests.txt
+$CLI bundle plan >> out.plan_.txt
+$CLI bundle plan -o json | nostamp >> out.plan_.json
+trace $CLI bundle deploy -q
+trace jq 'select(.method == "POST" and (.path | contains("/clusters/resize")))' "$OUT_REQUESTS"
+rm "$OUT_REQUESTS"
 
 title "Cluster should have new autoscale\n"
 $CLI clusters get "${CLUSTER_ID}" | jq '{cluster_name,num_workers,autoscale}'
@@ -59,11 +65,11 @@ title "Removing autoscale section should call resize API\n"
 update_file.py databricks.yml "      autoscale:
         min_workers: 4
         max_workers: 6" "      num_workers: 3"
-$CLI bundle plan >> out.plan_.$DATABRICKS_BUNDLE_ENGINE.txt
-$CLI bundle plan -o json >> out.plan_.$DATABRICKS_BUNDLE_ENGINE.json
-trace $CLI bundle deploy
-trace jq 'select(.method == "POST" and (.path | contains("/clusters/resize")))' out.requests.txt
-rm out.requests.txt
+$CLI bundle plan >> out.plan_.txt
+$CLI bundle plan -o json | nostamp >> out.plan_.json
+trace $CLI bundle deploy -q
+trace jq 'select(.method == "POST" and (.path | contains("/clusters/resize")))' "$OUT_REQUESTS"
+rm "$OUT_REQUESTS"
 
 title "Cluster should have num_workers\n"
 $CLI clusters get "${CLUSTER_ID}" | jq '{cluster_name,num_workers,autoscale}'
diff --git a/acceptance/bundle/resources/clusters/deploy/update-and-resize-autoscale/test.toml b/acceptance/bundle/resources/clusters/deploy/update-and-resize-autoscale/test.toml
index 3aa4a190502..8488476b7a3 100644
--- a/acceptance/bundle/resources/clusters/deploy/update-and-resize-autoscale/test.toml
+++ b/acceptance/bundle/resources/clusters/deploy/update-and-resize-autoscale/test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
 RecordRequests = true
 
diff --git a/acceptance/bundle/resources/clusters/deploy/update-and-resize/databricks.yml.tmpl b/acceptance/bundle/resources/clusters/deploy/update-and-resize/databricks.yml.tmpl
index c32af2055f9..614a9466f29 100644
--- a/acceptance/bundle/resources/clusters/deploy/update-and-resize/databricks.yml.tmpl
+++ b/acceptance/bundle/resources/clusters/deploy/update-and-resize/databricks.yml.tmpl
@@ -10,6 +10,7 @@ resources:
       cluster_name: test-cluster-$UNIQUE_NAME
       spark_version: $DEFAULT_SPARK_VERSION
       node_type_id: $NODE_TYPE_ID
+      instance_pool_id: $TEST_INSTANCE_POOL_ID
       num_workers: 2
       spark_conf:
         "spark.executor.memory": "2g"
diff --git a/acceptance/bundle/resources/clusters/deploy/update-and-resize/out.plan_.direct.json b/acceptance/bundle/resources/clusters/deploy/update-and-resize/out.plan_.direct.json
deleted file mode 100644
index acf0cfa65bf..00000000000
--- a/acceptance/bundle/resources/clusters/deploy/update-and-resize/out.plan_.direct.json
+++ /dev/null
@@ -1,229 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.clusters.test_cluster": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "autotermination_minutes": 60,
-          "cluster_name": "test-cluster-[UNIQUE_NAME]",
-          "node_type_id": "[NODE_TYPE_ID]",
-          "num_workers": 2,
-          "spark_conf": {
-            "spark.executor.memory": "2g"
-          },
-          "spark_version": "13.3.x-snapshot-scala2.12"
-        }
-      }
-    }
-  }
-}
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.clusters.test_cluster": {
-      "action": "update",
-      "new_state": {
-        "value": {
-          "autotermination_minutes": 60,
-          "cluster_name": "test-cluster-[UNIQUE_NAME]",
-          "node_type_id": "[NODE_TYPE_ID]",
-          "num_workers": 3,
-          "spark_conf": {
-            "spark.executor.memory": "2g"
-          },
-          "spark_version": "13.3.x-snapshot-scala2.12"
-        }
-      },
-      "remote_state": {
-        "autotermination_minutes": 60,
-        "aws_attributes": {
-          "availability": "SPOT_WITH_FALLBACK",
-          "zone_id": "us-east-1c"
-        },
-        "cluster_id": "[CLUSTER_ID]",
-        "cluster_name": "test-cluster-[UNIQUE_NAME]",
-        "driver_node_type_id": "[NODE_TYPE_ID]",
-        "enable_elastic_disk": false,
-        "node_type_id": "[NODE_TYPE_ID]",
-        "num_workers": 2,
-        "spark_conf": {
-          "spark.executor.memory": "2g"
-        },
-        "spark_version": "13.3.x-snapshot-scala2.12"
-      },
-      "changes": {
-        "aws_attributes": {
-          "action": "skip",
-          "reason": "managed",
-          "remote": {
-            "availability": "SPOT_WITH_FALLBACK",
-            "zone_id": "us-east-1c"
-          }
-        },
-        "driver_node_type_id": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "[NODE_TYPE_ID]"
-        },
-        "enable_elastic_disk": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": false
-        },
-        "num_workers": {
-          "action": "update",
-          "old": 2,
-          "new": 3,
-          "remote": 2
-        }
-      }
-    }
-  }
-}
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 2,
-  "plan": {
-    "resources.clusters.test_cluster": {
-      "action": "resize",
-      "new_state": {
-        "value": {
-          "autotermination_minutes": 60,
-          "cluster_name": "test-cluster-[UNIQUE_NAME]",
-          "node_type_id": "[NODE_TYPE_ID]",
-          "num_workers": 4,
-          "spark_conf": {
-            "spark.executor.memory": "2g"
-          },
-          "spark_version": "13.3.x-snapshot-scala2.12"
-        }
-      },
-      "remote_state": {
-        "autotermination_minutes": 60,
-        "aws_attributes": {
-          "availability": "SPOT_WITH_FALLBACK",
-          "zone_id": "us-east-1c"
-        },
-        "cluster_id": "[CLUSTER_ID]",
-        "cluster_name": "test-cluster-[UNIQUE_NAME]",
-        "driver_node_type_id": "[NODE_TYPE_ID]",
-        "enable_elastic_disk": false,
-        "node_type_id": "[NODE_TYPE_ID]",
-        "num_workers": 3,
-        "spark_conf": {
-          "spark.executor.memory": "2g"
-        },
-        "spark_version": "13.3.x-snapshot-scala2.12",
-        "state": "RUNNING"
-      },
-      "changes": {
-        "aws_attributes": {
-          "action": "skip",
-          "reason": "managed",
-          "remote": {
-            "availability": "SPOT_WITH_FALLBACK",
-            "zone_id": "us-east-1c"
-          }
-        },
-        "driver_node_type_id": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "[NODE_TYPE_ID]"
-        },
-        "enable_elastic_disk": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": false
-        },
-        "num_workers": {
-          "action": "resize",
-          "reason": "custom",
-          "old": 3,
-          "new": 4,
-          "remote": 3
-        }
-      }
-    }
-  }
-}
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 3,
-  "plan": {
-    "resources.clusters.test_cluster": {
-      "action": "update",
-      "new_state": {
-        "value": {
-          "autotermination_minutes": 60,
-          "cluster_name": "test-cluster-[UNIQUE_NAME]",
-          "node_type_id": "[NODE_TYPE_ID]",
-          "num_workers": 5,
-          "spark_conf": {
-            "spark.executor.memory": "4g"
-          },
-          "spark_version": "13.3.x-snapshot-scala2.12"
-        }
-      },
-      "remote_state": {
-        "autotermination_minutes": 60,
-        "aws_attributes": {
-          "availability": "SPOT_WITH_FALLBACK",
-          "zone_id": "us-east-1c"
-        },
-        "cluster_id": "[CLUSTER_ID]",
-        "cluster_name": "test-cluster-[UNIQUE_NAME]",
-        "driver_node_type_id": "[NODE_TYPE_ID]",
-        "enable_elastic_disk": false,
-        "node_type_id": "[NODE_TYPE_ID]",
-        "num_workers": 4,
-        "spark_conf": {
-          "spark.executor.memory": "2g"
-        },
-        "spark_version": "13.3.x-snapshot-scala2.12",
-        "state": "RUNNING"
-      },
-      "changes": {
-        "aws_attributes": {
-          "action": "skip",
-          "reason": "managed",
-          "remote": {
-            "availability": "SPOT_WITH_FALLBACK",
-            "zone_id": "us-east-1c"
-          }
-        },
-        "driver_node_type_id": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "[NODE_TYPE_ID]"
-        },
-        "enable_elastic_disk": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": false
-        },
-        "num_workers": {
-          "action": "resize",
-          "reason": "custom",
-          "old": 4,
-          "new": 5,
-          "remote": 4
-        },
-        "spark_conf['spark.executor.memory']": {
-          "action": "update",
-          "old": "2g",
-          "new": "4g",
-          "remote": "2g"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/clusters/deploy/update-and-resize/out.plan_.direct.txt b/acceptance/bundle/resources/clusters/deploy/update-and-resize/out.plan_.direct.txt
deleted file mode 100644
index 70123004a28..00000000000
--- a/acceptance/bundle/resources/clusters/deploy/update-and-resize/out.plan_.direct.txt
+++ /dev/null
@@ -1,12 +0,0 @@
-create clusters.test_cluster
-
-Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
-update clusters.test_cluster
-
-Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
-resize clusters.test_cluster
-
-Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
-update clusters.test_cluster
-
-Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
diff --git a/acceptance/bundle/resources/clusters/deploy/update-and-resize/out.plan_.json b/acceptance/bundle/resources/clusters/deploy/update-and-resize/out.plan_.json
new file mode 100644
index 00000000000..d456a1730b5
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/deploy/update-and-resize/out.plan_.json
@@ -0,0 +1,243 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.clusters.test_cluster": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "autotermination_minutes": 60,
+          "cluster_name": "test-cluster-[UNIQUE_NAME]",
+          "instance_pool_id": "[TEST_INSTANCE_POOL_ID]",
+          "num_workers": 2,
+          "spark_conf": {
+            "spark.executor.memory": "2g"
+          },
+          "spark_version": "13.3.x-snapshot-scala2.12"
+        }
+      }
+    }
+  }
+}
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.clusters.test_cluster": {
+      "action": "resize",
+      "new_state": {
+        "value": {
+          "autotermination_minutes": 60,
+          "cluster_name": "test-cluster-[UNIQUE_NAME]",
+          "instance_pool_id": "[TEST_INSTANCE_POOL_ID]",
+          "num_workers": 3,
+          "spark_conf": {
+            "spark.executor.memory": "2g"
+          },
+          "spark_version": "13.3.x-snapshot-scala2.12"
+        }
+      },
+      "remote_state": {
+        "autotermination_minutes": 60,
+        "aws_attributes": {
+          "availability": "SPOT_WITH_FALLBACK",
+          "zone_id": "us-east-1c"
+        },
+        "cluster_id": "[CLUSTER_ID]",
+        "cluster_name": "test-cluster-[UNIQUE_NAME]",
+        "enable_elastic_disk": false,
+        "instance_pool_id": "[TEST_INSTANCE_POOL_ID]",
+        "lifecycle": {
+          "started": true
+        },
+        "num_workers": 2,
+        "spark_conf": {
+          "spark.executor.memory": "2g"
+        },
+        "spark_version": "13.3.x-snapshot-scala2.12",
+        "state": "RUNNING"
+      },
+      "changes": {
+        "aws_attributes": {
+          "action": "skip",
+          "reason": "managed",
+          "remote": {
+            "availability": "SPOT_WITH_FALLBACK",
+            "zone_id": "us-east-1c"
+          }
+        },
+        "enable_elastic_disk": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": false
+        },
+        "lifecycle": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": {
+            "started": true
+          }
+        },
+        "num_workers": {
+          "action": "resize",
+          "reason": "custom",
+          "old": 2,
+          "new": 3,
+          "remote": 2
+        }
+      }
+    }
+  }
+}
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 2,
+  "plan": {
+    "resources.clusters.test_cluster": {
+      "action": "resize",
+      "new_state": {
+        "value": {
+          "autotermination_minutes": 60,
+          "cluster_name": "test-cluster-[UNIQUE_NAME]",
+          "instance_pool_id": "[TEST_INSTANCE_POOL_ID]",
+          "num_workers": 4,
+          "spark_conf": {
+            "spark.executor.memory": "2g"
+          },
+          "spark_version": "13.3.x-snapshot-scala2.12"
+        }
+      },
+      "remote_state": {
+        "autotermination_minutes": 60,
+        "aws_attributes": {
+          "availability": "SPOT_WITH_FALLBACK",
+          "zone_id": "us-east-1c"
+        },
+        "cluster_id": "[CLUSTER_ID]",
+        "cluster_name": "test-cluster-[UNIQUE_NAME]",
+        "enable_elastic_disk": false,
+        "instance_pool_id": "[TEST_INSTANCE_POOL_ID]",
+        "lifecycle": {
+          "started": true
+        },
+        "num_workers": 3,
+        "spark_conf": {
+          "spark.executor.memory": "2g"
+        },
+        "spark_version": "13.3.x-snapshot-scala2.12",
+        "state": "RUNNING"
+      },
+      "changes": {
+        "aws_attributes": {
+          "action": "skip",
+          "reason": "managed",
+          "remote": {
+            "availability": "SPOT_WITH_FALLBACK",
+            "zone_id": "us-east-1c"
+          }
+        },
+        "enable_elastic_disk": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": false
+        },
+        "lifecycle": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": {
+            "started": true
+          }
+        },
+        "num_workers": {
+          "action": "resize",
+          "reason": "custom",
+          "old": 3,
+          "new": 4,
+          "remote": 3
+        }
+      }
+    }
+  }
+}
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 3,
+  "plan": {
+    "resources.clusters.test_cluster": {
+      "action": "update",
+      "new_state": {
+        "value": {
+          "autotermination_minutes": 60,
+          "cluster_name": "test-cluster-[UNIQUE_NAME]",
+          "instance_pool_id": "[TEST_INSTANCE_POOL_ID]",
+          "num_workers": 5,
+          "spark_conf": {
+            "spark.executor.memory": "4g"
+          },
+          "spark_version": "13.3.x-snapshot-scala2.12"
+        }
+      },
+      "remote_state": {
+        "autotermination_minutes": 60,
+        "aws_attributes": {
+          "availability": "SPOT_WITH_FALLBACK",
+          "zone_id": "us-east-1c"
+        },
+        "cluster_id": "[CLUSTER_ID]",
+        "cluster_name": "test-cluster-[UNIQUE_NAME]",
+        "enable_elastic_disk": false,
+        "instance_pool_id": "[TEST_INSTANCE_POOL_ID]",
+        "lifecycle": {
+          "started": true
+        },
+        "num_workers": 4,
+        "spark_conf": {
+          "spark.executor.memory": "2g"
+        },
+        "spark_version": "13.3.x-snapshot-scala2.12",
+        "state": "RUNNING"
+      },
+      "changes": {
+        "aws_attributes": {
+          "action": "skip",
+          "reason": "managed",
+          "remote": {
+            "availability": "SPOT_WITH_FALLBACK",
+            "zone_id": "us-east-1c"
+          }
+        },
+        "enable_elastic_disk": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": false
+        },
+        "lifecycle": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": {
+            "started": true
+          }
+        },
+        "num_workers": {
+          "action": "resize",
+          "reason": "custom",
+          "old": 4,
+          "new": 5,
+          "remote": 4
+        },
+        "spark_conf['spark.executor.memory']": {
+          "action": "update",
+          "old": "2g",
+          "new": "4g",
+          "remote": "2g"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/clusters/deploy/update-and-resize/out.plan_.terraform.json b/acceptance/bundle/resources/clusters/deploy/update-and-resize/out.plan_.terraform.json
deleted file mode 100644
index 4dd9da9eb8d..00000000000
--- a/acceptance/bundle/resources/clusters/deploy/update-and-resize/out.plan_.terraform.json
+++ /dev/null
@@ -1,32 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.clusters.test_cluster": {
-      "action": "create"
-    }
-  }
-}
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.clusters.test_cluster": {
-      "action": "update"
-    }
-  }
-}
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.clusters.test_cluster": {
-      "action": "update"
-    }
-  }
-}
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.clusters.test_cluster": {
-      "action": "update"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/clusters/deploy/update-and-resize/out.plan_.terraform.txt b/acceptance/bundle/resources/clusters/deploy/update-and-resize/out.plan_.terraform.txt
deleted file mode 100644
index d51cd2abf07..00000000000
--- a/acceptance/bundle/resources/clusters/deploy/update-and-resize/out.plan_.terraform.txt
+++ /dev/null
@@ -1,12 +0,0 @@
-create clusters.test_cluster
-
-Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
-update clusters.test_cluster
-
-Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
-update clusters.test_cluster
-
-Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
-update clusters.test_cluster
-
-Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
diff --git a/acceptance/bundle/resources/clusters/deploy/update-and-resize/out.plan_.txt b/acceptance/bundle/resources/clusters/deploy/update-and-resize/out.plan_.txt
new file mode 100644
index 00000000000..111698a888e
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/deploy/update-and-resize/out.plan_.txt
@@ -0,0 +1,12 @@
+create clusters.test_cluster
+
+Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
+resize clusters.test_cluster
+
+Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
+resize clusters.test_cluster
+
+Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
+update clusters.test_cluster
+
+Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
diff --git a/acceptance/bundle/resources/clusters/deploy/update-and-resize/out.test.toml b/acceptance/bundle/resources/clusters/deploy/update-and-resize/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/clusters/deploy/update-and-resize/out.test.toml
+++ b/acceptance/bundle/resources/clusters/deploy/update-and-resize/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/clusters/deploy/update-and-resize/output.txt b/acceptance/bundle/resources/clusters/deploy/update-and-resize/output.txt
index c202d13080f..c5506f17efe 100644
--- a/acceptance/bundle/resources/clusters/deploy/update-and-resize/output.txt
+++ b/acceptance/bundle/resources/clusters/deploy/update-and-resize/output.txt
@@ -1,9 +1,8 @@
 
->>> [CLI] bundle deploy
+>>> [CLI] bundle deploy -q
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 5 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 === Cluster should exist after bundle deployment:
 {
@@ -13,28 +12,12 @@ Deployment complete!
 
 === Changing num_workers should call update API on stopped cluster
 
->>> [CLI] bundle deploy
+>>> [CLI] bundle deploy -q
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 3 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
->>> jq select(.method == "POST" and (.path | contains("/clusters/edit"))) | del(.body.aws_attributes, .body.driver_node_type_id, .body.data_security_mode, .body.enable_elastic_disk) out.requests.txt
-{
-  "method": "POST",
-  "path": "/api/2.1/clusters/edit",
-  "body": {
-    "autotermination_minutes": 60,
-    "cluster_id": "[CLUSTER_ID]",
-    "cluster_name": "test-cluster-[UNIQUE_NAME]",
-    "node_type_id": "[NODE_TYPE_ID]",
-    "num_workers": 3,
-    "spark_conf": {
-      "spark.executor.memory": "2g"
-    },
-    "spark_version": "13.3.x-snapshot-scala2.12"
-  }
-}
+>>> jq select(.method == "POST" and (.path | contains("/clusters/edit"))) | del(.body.aws_attributes, .body.driver_node_type_id, .body.data_security_mode, .body.enable_elastic_disk) [OUTPUT_DIR]/out.requests.txt
 
 === Cluster should have new num_workers
 {
@@ -51,9 +34,8 @@ Deployment complete!
   },
   "cluster_id": "[CLUSTER_ID]",
   "cluster_name": "test-cluster-[UNIQUE_NAME]",
-  "driver_node_type_id": "[NODE_TYPE_ID]",
   "enable_elastic_disk": false,
-  "node_type_id": "[NODE_TYPE_ID]",
+  "instance_pool_id": "[TEST_INSTANCE_POOL_ID]",
   "num_workers": 3,
   "spark_conf": {
     "spark.executor.memory": "2g"
@@ -64,13 +46,12 @@ Deployment complete!
 
 === Changing num_workers should call resize API on running cluster
 
->>> [CLI] bundle deploy
+>>> [CLI] bundle deploy -q
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 3 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
->>> jq select(.method == "POST" and (.path | contains("/clusters/resize"))) out.requests.txt
+>>> jq select(.method == "POST" and (.path | contains("/clusters/resize"))) [OUTPUT_DIR]/out.requests.txt
 {
   "method": "POST",
   "path": "/api/2.1/clusters/resize",
@@ -88,13 +69,12 @@ Deployment complete!
 
 === Changing num_workers and spark_conf should call update API
 
->>> [CLI] bundle deploy
+>>> [CLI] bundle deploy -q
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 3 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
->>> jq select(.method == "POST" and (.path | contains("/clusters/edit"))) | del(.body.aws_attributes, .body.driver_node_type_id, .body.data_security_mode, .body.enable_elastic_disk) out.requests.txt
+>>> jq select(.method == "POST" and (.path | contains("/clusters/edit"))) | del(.body.aws_attributes, .body.driver_node_type_id, .body.data_security_mode, .body.enable_elastic_disk) [OUTPUT_DIR]/out.requests.txt
 {
   "method": "POST",
   "path": "/api/2.1/clusters/edit",
@@ -102,7 +82,7 @@ Deployment complete!
     "autotermination_minutes": 60,
     "cluster_id": "[CLUSTER_ID]",
     "cluster_name": "test-cluster-[UNIQUE_NAME]",
-    "node_type_id": "[NODE_TYPE_ID]",
+    "instance_pool_id": "[TEST_INSTANCE_POOL_ID]",
     "num_workers": 5,
     "spark_conf": {
       "spark.executor.memory": "4g"
@@ -126,5 +106,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/clusters/deploy/update-and-resize/script b/acceptance/bundle/resources/clusters/deploy/update-and-resize/script
index f2d80d05de0..06d5ae378cc 100644
--- a/acceptance/bundle/resources/clusters/deploy/update-and-resize/script
+++ b/acceptance/bundle/resources/clusters/deploy/update-and-resize/script
@@ -2,26 +2,29 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm out.requests.txt
+    rm "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
-$CLI bundle plan > out.plan_.$DATABRICKS_BUNDLE_ENGINE.txt
-$CLI bundle plan -o json > out.plan_.$DATABRICKS_BUNDLE_ENGINE.json
-trace $CLI bundle deploy
+# Deploy with -q throughout: the engines name this action differently (direct reports
+# resize, terraform update), so the per-resource line would diverge. The Resources:
+# summary agrees, so it is kept rather than using -qq.
+$CLI bundle plan > out.plan_.txt
+$CLI bundle plan -o json | nostamp > out.plan_.json
+trace $CLI bundle deploy -q
 
 title "Cluster should exist after bundle deployment:\n"
-CLUSTER_ID=$($CLI bundle summary -o json | jq -r '.resources.clusters.test_cluster.id')
-echo "$CLUSTER_ID:CLUSTER_ID" >> ACC_REPLS
+CLUSTER_ID=$($CLI bundle summary -o json | nostamp | jq -r '.resources.clusters.test_cluster.id')
+add_repl "$CLUSTER_ID" CLUSTER_ID
 $CLI clusters get "${CLUSTER_ID}" | jq '{cluster_name,num_workers}'
 
 title "Changing num_workers should call update API on stopped cluster\n"
 update_file.py databricks.yml "num_workers: 2" "num_workers: 3"
-$CLI bundle plan >> out.plan_.$DATABRICKS_BUNDLE_ENGINE.txt
-$CLI bundle plan -o json >> out.plan_.$DATABRICKS_BUNDLE_ENGINE.json
-trace $CLI bundle deploy
-trace jq 'select(.method == "POST" and (.path | contains("/clusters/edit"))) | del(.body.aws_attributes, .body.driver_node_type_id, .body.data_security_mode, .body.enable_elastic_disk)' out.requests.txt
-rm out.requests.txt
+$CLI bundle plan >> out.plan_.txt
+$CLI bundle plan -o json | nostamp >> out.plan_.json
+trace $CLI bundle deploy -q
+trace jq 'select(.method == "POST" and (.path | contains("/clusters/edit"))) | del(.body.aws_attributes, .body.driver_node_type_id, .body.data_security_mode, .body.enable_elastic_disk)' "$OUT_REQUESTS"
+rm "$OUT_REQUESTS"
 
 title "Cluster should have new num_workers\n"
 $CLI clusters get "${CLUSTER_ID}" | jq '{cluster_name,num_workers}'
@@ -31,11 +34,11 @@ $CLI clusters start "${CLUSTER_ID}"
 
 title "Changing num_workers should call resize API on running cluster\n"
 update_file.py databricks.yml "num_workers: 3" "num_workers: 4"
-$CLI bundle plan >> out.plan_.$DATABRICKS_BUNDLE_ENGINE.txt
-$CLI bundle plan -o json >> out.plan_.$DATABRICKS_BUNDLE_ENGINE.json
-trace $CLI bundle deploy
-trace jq 'select(.method == "POST" and (.path | contains("/clusters/resize")))' out.requests.txt
-rm out.requests.txt
+$CLI bundle plan >> out.plan_.txt
+$CLI bundle plan -o json | nostamp >> out.plan_.json
+trace $CLI bundle deploy -q
+trace jq 'select(.method == "POST" and (.path | contains("/clusters/resize")))' "$OUT_REQUESTS"
+rm "$OUT_REQUESTS"
 
 title "Cluster should have new num_workers\n"
 $CLI clusters get "${CLUSTER_ID}" | jq '{cluster_name,num_workers}'
@@ -43,11 +46,11 @@ $CLI clusters get "${CLUSTER_ID}" | jq '{cluster_name,num_workers}'
 title "Changing num_workers and spark_conf should call update API\n"
 update_file.py databricks.yml "num_workers: 4" "num_workers: 5"
 update_file.py databricks.yml '"spark.executor.memory": "2g"' '"spark.executor.memory": "4g"'
-$CLI bundle plan >> out.plan_.$DATABRICKS_BUNDLE_ENGINE.txt
-$CLI bundle plan -o json >> out.plan_.$DATABRICKS_BUNDLE_ENGINE.json
-trace $CLI bundle deploy
-trace jq 'select(.method == "POST" and (.path | contains("/clusters/edit"))) | del(.body.aws_attributes, .body.driver_node_type_id, .body.data_security_mode, .body.enable_elastic_disk)' out.requests.txt
-rm out.requests.txt
+$CLI bundle plan >> out.plan_.txt
+$CLI bundle plan -o json | nostamp >> out.plan_.json
+trace $CLI bundle deploy -q
+trace jq 'select(.method == "POST" and (.path | contains("/clusters/edit"))) | del(.body.aws_attributes, .body.driver_node_type_id, .body.data_security_mode, .body.enable_elastic_disk)' "$OUT_REQUESTS"
+rm "$OUT_REQUESTS"
 
 title "Cluster should have new num_workers and spark_conf\n"
 $CLI clusters get "${CLUSTER_ID}" | jq '{cluster_name,num_workers,spark_conf}'
diff --git a/acceptance/bundle/resources/clusters/deploy/update-and-resize/test.toml b/acceptance/bundle/resources/clusters/deploy/update-and-resize/test.toml
index 3aa4a190502..8488476b7a3 100644
--- a/acceptance/bundle/resources/clusters/deploy/update-and-resize/test.toml
+++ b/acceptance/bundle/resources/clusters/deploy/update-and-resize/test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
 RecordRequests = true
 
diff --git a/acceptance/bundle/resources/clusters/deploy/use_preemptible_update/databricks.yml b/acceptance/bundle/resources/clusters/deploy/use_preemptible_update/databricks.yml
new file mode 100644
index 00000000000..b29cbbd0ed9
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/deploy/use_preemptible_update/databricks.yml
@@ -0,0 +1,14 @@
+bundle:
+  name: test-bundle
+
+resources:
+  clusters:
+    test_cluster:
+      cluster_name: test-cluster
+      spark_version: 13.3.x-scala2.12
+      node_type_id: n2-highmem-4
+      num_workers: 1
+      gcp_attributes:
+        availability: PREEMPTIBLE_GCP
+        zone_id: auto
+        #use_preemptible_executors: false
diff --git a/acceptance/bundle/resources/clusters/deploy/use_preemptible_update/out.test.toml b/acceptance/bundle/resources/clusters/deploy/use_preemptible_update/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/deploy/use_preemptible_update/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/clusters/deploy/use_preemptible_update/output.txt b/acceptance/bundle/resources/clusters/deploy/use_preemptible_update/output.txt
new file mode 100644
index 00000000000..afad5c5060f
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/deploy/use_preemptible_update/output.txt
@@ -0,0 +1,71 @@
+
+=== Deploy 1: create the cluster with gcp_attributes but no use_preemptible_executors
+
+>>> [CLI] bundle deploy -qq
+
+=== gcp_attributes sent on create (use_preemptible_executors absent):
+{
+  "availability": "PREEMPTIBLE_GCP",
+  "zone_id": "auto"
+}
+
+=== Now the user adds an explicit use_preemptible_executors: false to the config
+
+=== Deploy 2: bundle should detect and apply the use_preemptible_executors change
+
+>>> [CLI] bundle plan
+update clusters.test_cluster
+
+Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
+
+=== use_preemptible_executors change in the plan:
+{
+  "action": "update",
+  "new": false,
+  "remote": false
+}
+
+>>> [CLI] bundle deploy -qq
+
+=== gcp_attributes sent on update (empty means the change was NOT applied):
+{
+  "availability": "PREEMPTIBLE_GCP",
+  "use_preemptible_executors": false,
+  "zone_id": "auto"
+}
+
+=== Deploy 3: no config change, should converge to a no-op
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+=== Now the user removes use_preemptible_executors again
+
+=== Deploy 4: removing the explicit false is a change, symmetric with setting it
+
+>>> [CLI] bundle plan
+update clusters.test_cluster
+
+Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
+
+=== use_preemptible_executors change in the plan:
+{
+  "action": "update",
+  "old": false,
+  "remote": false
+}
+
+>>> [CLI] bundle deploy -qq
+
+=== Deploy 5: no config change, should converge to a no-op
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.clusters.test_cluster
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/clusters/deploy/use_preemptible_update/script b/acceptance/bundle/resources/clusters/deploy/use_preemptible_update/script
new file mode 100644
index 00000000000..d2598b7a7aa
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/deploy/use_preemptible_update/script
@@ -0,0 +1,37 @@
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+title "Deploy 1: create the cluster with gcp_attributes but no use_preemptible_executors\n"
+trace $CLI bundle deploy -qq
+title "gcp_attributes sent on create (use_preemptible_executors absent):\n"
+print_requests.py //clusters/create | jq '.body.gcp_attributes'
+
+title "Now the user adds an explicit use_preemptible_executors: false to the config\n"
+update_file.py databricks.yml "#use_preemptible_executors: false" "use_preemptible_executors: false"
+
+title "Deploy 2: bundle should detect and apply the use_preemptible_executors change\n"
+trace $CLI bundle plan
+title "use_preemptible_executors change in the plan:\n"
+$CLI bundle plan -o json | jq '.plan[].changes["gcp_attributes.use_preemptible_executors"]'
+trace $CLI bundle deploy -qq
+
+title "gcp_attributes sent on update (empty means the change was NOT applied):\n"
+print_requests.py //clusters/edit | jq '.body.gcp_attributes'
+
+title "Deploy 3: no config change, should converge to a no-op\n"
+trace $CLI bundle plan
+
+title "Now the user removes use_preemptible_executors again\n"
+update_file.py databricks.yml "use_preemptible_executors: false" "#use_preemptible_executors: false"
+
+title "Deploy 4: removing the explicit false is a change, symmetric with setting it\n"
+trace $CLI bundle plan
+title "use_preemptible_executors change in the plan:\n"
+$CLI bundle plan -o json | jq '.plan[].changes["gcp_attributes.use_preemptible_executors"]'
+trace $CLI bundle deploy -qq
+
+title "Deploy 5: no config change, should converge to a no-op\n"
+trace $CLI bundle plan
diff --git a/acceptance/bundle/resources/clusters/deploy/use_preemptible_update/test.toml b/acceptance/bundle/resources/clusters/deploy/use_preemptible_update/test.toml
new file mode 100644
index 00000000000..61052a62149
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/deploy/use_preemptible_update/test.toml
@@ -0,0 +1,9 @@
+Cloud = false
+RecordRequests = true
+
+# Detecting a config change to an explicit zero-value bool (gcp_attributes.use_preemptible_executors: false)
+# is direct-engine behavior; the terraform engine handles zero values differently.
+
+Ignore = [
+    "databricks.yml",
+]
diff --git a/acceptance/bundle/resources/clusters/deploy/workload_type/out.test.toml b/acceptance/bundle/resources/clusters/deploy/workload_type/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/clusters/deploy/workload_type/out.test.toml
+++ b/acceptance/bundle/resources/clusters/deploy/workload_type/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/clusters/deploy/workload_type/output.txt b/acceptance/bundle/resources/clusters/deploy/workload_type/output.txt
index 10e8896fac8..b3a24cffec3 100644
--- a/acceptance/bundle/resources/clusters/deploy/workload_type/output.txt
+++ b/acceptance/bundle/resources/clusters/deploy/workload_type/output.txt
@@ -1,9 +1,9 @@
 
 >>> errcode [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-deploy-cluster-workload-type/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created clusters.cluster1
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> print_requests.py //clusters/create
 {
diff --git a/acceptance/bundle/resources/clusters/deploy/workload_type/test.toml b/acceptance/bundle/resources/clusters/deploy/workload_type/test.toml
index 964a45f5c1f..ff23f111878 100644
--- a/acceptance/bundle/resources/clusters/deploy/workload_type/test.toml
+++ b/acceptance/bundle/resources/clusters/deploy/workload_type/test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
 RecordRequests = true
 
diff --git a/acceptance/bundle/resources/clusters/libraries-content-change/databricks.yml.tmpl b/acceptance/bundle/resources/clusters/libraries-content-change/databricks.yml.tmpl
new file mode 100644
index 00000000000..f5e3173e888
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/libraries-content-change/databricks.yml.tmpl
@@ -0,0 +1,23 @@
+bundle:
+  name: cluster-libraries-$UNIQUE_NAME
+
+workspace:
+  root_path: ~/.bundle/$UNIQUE_NAME
+
+artifacts:
+  my_test_code:
+    type: whl
+    path: .
+    # Use 'python' because 'python3' does not exist in Windows virtualenvs.
+    build: python setup.py bdist_wheel
+
+resources:
+  clusters:
+    mycluster:
+      cluster_name: mycluster-$UNIQUE_NAME
+      spark_version: $DEFAULT_SPARK_VERSION
+      node_type_id: $NODE_TYPE_ID
+      num_workers: 1
+      data_security_mode: $DATA_SECURITY_MODE
+      libraries:
+        - whl: ./dist/*.whl
diff --git a/acceptance/bundle/resources/clusters/libraries-content-change/my_test_code/__init__.py b/acceptance/bundle/resources/clusters/libraries-content-change/my_test_code/__init__.py
new file mode 100644
index 00000000000..909f1f3220d
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/libraries-content-change/my_test_code/__init__.py
@@ -0,0 +1,2 @@
+__version__ = "0.0.1"
+__author__ = "Databricks"
diff --git a/acceptance/bundle/resources/clusters/libraries-content-change/my_test_code/__main__.py b/acceptance/bundle/resources/clusters/libraries-content-change/my_test_code/__main__.py
new file mode 100644
index 00000000000..ea918ce2d53
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/libraries-content-change/my_test_code/__main__.py
@@ -0,0 +1,16 @@
+"""
+The entry point of the Python Wheel
+"""
+
+import sys
+
+
+def main():
+    # This method will print the provided arguments
+    print("Hello from my func")
+    print("Got arguments:")
+    print(sys.argv)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/acceptance/bundle/resources/clusters/libraries-content-change/out.test.toml b/acceptance/bundle/resources/clusters/libraries-content-change/out.test.toml
new file mode 100644
index 00000000000..844d5475d08
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/libraries-content-change/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudSlow = true
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/resources/clusters/libraries-content-change/output.txt b/acceptance/bundle/resources/clusters/libraries-content-change/output.txt
new file mode 100644
index 00000000000..ef3f8cf7c11
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/libraries-content-change/output.txt
@@ -0,0 +1,33 @@
+
+=== Deploy a cluster with a local wheel library
+OK: cluster created with wheel
+
+>>> print_requests.py //libraries/install
+{
+  "method": "POST",
+  "path": "/api/2.0/libraries/install",
+  "body": {
+    "cluster_id": "[UUID]",
+    "libraries": [
+      {
+        "whl": "/Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/artifacts/.internal/my_test_code-0.0.1-py3-none-any.whl"
+      }
+    ]
+  }
+}
+
+=== Badness: wheel code changes but version does not, so redeploy does not reinstall it
+>>> jq .plan["resources.clusters.mycluster"].action tmp.plan.json
+"skip"
+
+OK: redeployed without reinstalling the changed wheel (known limitation)
+
+>>> print_requests.py //libraries/install
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.clusters.mycluster
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/clusters/libraries-content-change/script b/acceptance/bundle/resources/clusters/libraries-content-change/script
new file mode 100644
index 00000000000..4dcfa152f27
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/libraries-content-change/script
@@ -0,0 +1,29 @@
+export DATA_SECURITY_MODE=USER_ISOLATION
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f out.requests.txt
+}
+trap cleanup EXIT
+
+# Deploy output goes to LOG (differs fake vs cloud); echo a pass line instead.
+title "Deploy a cluster with a local wheel library"
+$CLI bundle plan -o json > tmp.plan.json 2>>LOG.plan
+$CLI bundle deploy $(readplanarg tmp.plan.json) &> LOG.deploy
+cat LOG.deploy | contains.py "Created clusters.mycluster" > /dev/null
+printf '\n%s\n' "OK: cluster created with wheel"
+trace print_requests.py //libraries/install
+
+# Change only the wheel's code, keeping version 0.0.1 so the built filename - and
+# thus the uploaded workspace path - is byte-for-byte identical to the first deploy.
+title "Badness: wheel code changes but version does not, so redeploy does not reinstall it"
+update_file.py my_test_code/__main__.py "Hello from my func" "Hello from my func v2"
+$CLI bundle plan -o json > tmp.plan.json 2>>LOG.plan
+
+# The wheel path is unchanged, so the cluster plans as "skip" - the library change goes undetected and
+# the stale wheel keeps running.
+trace jq '.plan["resources.clusters.mycluster"].action' tmp.plan.json
+$CLI bundle deploy $(readplanarg tmp.plan.json) &> LOG.redeploy
+printf '\n%s\n' "OK: redeployed without reinstalling the changed wheel (known limitation)"
+trace print_requests.py //libraries/install
diff --git a/acceptance/bundle/resources/clusters/libraries-content-change/script.prepare b/acceptance/bundle/resources/clusters/libraries-content-change/script.prepare
new file mode 100644
index 00000000000..31e6de1dbf5
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/libraries-content-change/script.prepare
@@ -0,0 +1,3 @@
+uv venv -q .venv
+venv_activate
+uv pip install -q --no-index setuptools
diff --git a/acceptance/bundle/resources/clusters/libraries-content-change/setup.py b/acceptance/bundle/resources/clusters/libraries-content-change/setup.py
new file mode 100644
index 00000000000..8b48a92b4ce
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/libraries-content-change/setup.py
@@ -0,0 +1,15 @@
+from setuptools import setup, find_packages
+
+import my_test_code
+
+setup(
+    name="my_test_code",
+    version=my_test_code.__version__,
+    author=my_test_code.__author__,
+    url="https://databricks.com",
+    author_email="john.doe@databricks.com",
+    description="my example wheel",
+    packages=find_packages(include=["my_test_code"]),
+    entry_points={"group1": "run=my_test_code.__main__:main"},
+    install_requires=["setuptools"],
+)
diff --git a/acceptance/bundle/resources/clusters/libraries-content-change/test.toml b/acceptance/bundle/resources/clusters/libraries-content-change/test.toml
new file mode 100644
index 00000000000..2282cc3bbcf
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/libraries-content-change/test.toml
@@ -0,0 +1,13 @@
+Badness = "A local wheel whose contents change but whose version (and thus workspace path) does not is not detected in non-dev mode, so redeploy does not reinstall it; the stale wheel keeps running. See the TODO in bundle/direct/dresources/cluster.go DoUpdate."
+
+Cloud = true
+CloudSlow = true
+RecordRequests = true
+
+EnvMatrix.READPLAN = ["", "1"]
+
+Ignore = [".databricks", ".venv", "build", "dist", "my_test_code.egg-info", "databricks.yml", "tmp.plan.json"]
+
+[[Repls]]
+Old = "[0-9]{4}-[0-9]{6}-[0-9a-z]{8}"
+New = "[UUID]"
diff --git a/acceptance/bundle/resources/clusters/libraries-repo/databricks.yml.tmpl b/acceptance/bundle/resources/clusters/libraries-repo/databricks.yml.tmpl
new file mode 100644
index 00000000000..40f63c9241c
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/libraries-repo/databricks.yml.tmpl
@@ -0,0 +1,18 @@
+bundle:
+  name: cluster-libraries-repo-$UNIQUE_NAME
+
+workspace:
+  root_path: ~/.bundle/$UNIQUE_NAME
+
+resources:
+  clusters:
+    mycluster:
+      cluster_name: mycluster-$UNIQUE_NAME
+      spark_version: $DEFAULT_SPARK_VERSION
+      node_type_id: $NODE_TYPE_ID
+      instance_pool_id: $TEST_INSTANCE_POOL_ID
+      num_workers: 1
+      libraries:
+        - pypi:
+            package: requests
+            repo: https://pypi.org/simple
diff --git a/acceptance/bundle/resources/clusters/libraries-repo/out.test.toml b/acceptance/bundle/resources/clusters/libraries-repo/out.test.toml
new file mode 100644
index 00000000000..844d5475d08
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/libraries-repo/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudSlow = true
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/resources/clusters/libraries-repo/output.txt b/acceptance/bundle/resources/clusters/libraries-repo/output.txt
new file mode 100644
index 00000000000..03dfa68dc62
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/libraries-repo/output.txt
@@ -0,0 +1,21 @@
+
+=== Deploy creates the cluster and installs the pypi library
+OK: cluster created with pypi library
+
+=== Plan is a no-op after deploy: the repo round-trips
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+=== Changing only the repo is planned as an update
+>>> [CLI] bundle plan
+update clusters.mycluster
+
+Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.clusters.mycluster
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/clusters/libraries-repo/script b/acceptance/bundle/resources/clusters/libraries-repo/script
new file mode 100644
index 00000000000..c44c39e8b1f
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/libraries-repo/script
@@ -0,0 +1,21 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f out.requests.txt
+}
+trap cleanup EXIT
+
+# Deploy output goes to LOG (differs fake vs cloud); echo a pass line instead.
+title "Deploy creates the cluster and installs the pypi library"
+$CLI bundle plan -o json > tmp.plan.json 2>>LOG.plan
+$CLI bundle deploy $(readplanarg tmp.plan.json) &> LOG.deploy
+cat LOG.deploy | contains.py "Created clusters.mycluster" > /dev/null
+printf '\n%s\n' "OK: cluster created with pypi library"
+
+title "Plan is a no-op after deploy: the repo round-trips"
+trace $CLI bundle plan
+
+title "Changing only the repo is planned as an update"
+update_file.py databricks.yml "repo: https://pypi.org/simple" "repo: https://example.invalid/simple"
+trace $CLI bundle plan
diff --git a/acceptance/bundle/resources/clusters/libraries-repo/test.toml b/acceptance/bundle/resources/clusters/libraries-repo/test.toml
new file mode 100644
index 00000000000..2f3fd108383
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/libraries-repo/test.toml
@@ -0,0 +1,11 @@
+Cloud = true
+CloudSlow = true
+RecordRequests = false
+
+EnvMatrix.READPLAN = ["", "1"]
+
+Ignore = [".databricks", "databricks.yml", "tmp.plan.json"]
+
+[[Repls]]
+Old = "[0-9]{4}-[0-9]{6}-[0-9a-z]{8}"
+New = "[UUID]"
diff --git a/acceptance/bundle/resources/clusters/libraries-scenarios/databricks.yml.tmpl b/acceptance/bundle/resources/clusters/libraries-scenarios/databricks.yml.tmpl
new file mode 100644
index 00000000000..b5d17cb9690
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/libraries-scenarios/databricks.yml.tmpl
@@ -0,0 +1,13 @@
+bundle:
+  name: cluster-libraries-scenarios-$UNIQUE_NAME
+
+workspace:
+  root_path: ~/.bundle/$UNIQUE_NAME
+
+resources:
+  clusters:
+    mycluster:
+      cluster_name: mycluster-$UNIQUE_NAME
+      spark_version: $DEFAULT_SPARK_VERSION
+      node_type_id: $NODE_TYPE_ID
+      num_workers: 1
diff --git a/acceptance/bundle/resources/clusters/libraries-scenarios/out.test.toml b/acceptance/bundle/resources/clusters/libraries-scenarios/out.test.toml
new file mode 100644
index 00000000000..f7fafbcc731
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/libraries-scenarios/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/resources/clusters/libraries-scenarios/output.txt b/acceptance/bundle/resources/clusters/libraries-scenarios/output.txt
new file mode 100644
index 00000000000..c31dc73b484
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/libraries-scenarios/output.txt
@@ -0,0 +1,216 @@
+
+=== Deploy a cluster that declares no libraries
+OK: cluster created
+
+=== Out of band: a job run (or the UI) installs 'six' on the shared cluster
+>>> print_requests.py //libraries/install
+{
+  "method": "POST",
+  "path": "/api/2.0/libraries/install",
+  "body": {
+    "cluster_id": "[MYCLUSTER_ID]",
+    "libraries": [
+      {
+        "pypi": {
+          "package": "six"
+        }
+      }
+    ]
+  }
+}
+
+=== No libraries section: six is skipped as unmanaged, not drift
+>>> plan_libs
+{
+  "libraries": {
+    "action": "skip",
+    "reason": "unmanaged",
+    "remote": [
+      {
+        "pypi": {
+          "package": "six"
+        }
+      }
+    ]
+  }
+}
+
+=== Declare 'requests': plan installs it and uninstalls the out-of-band six
+>>> plan_libs
+{
+  "libraries": {
+    "action": "update",
+    "new": [
+      {
+        "pypi": {
+          "package": "requests"
+        }
+      }
+    ],
+    "remote": [
+      {
+        "pypi": {
+          "package": "six"
+        }
+      }
+    ]
+  },
+  "libraries[pypi='requests;']": {
+    "action": "update",
+    "new": {
+      "pypi": {
+        "package": "requests"
+      }
+    }
+  },
+  "libraries[pypi='six;']": {
+    "action": "update",
+    "remote": {
+      "pypi": {
+        "package": "six"
+      }
+    }
+  }
+}
+
+>>> print_requests.py //libraries/install //libraries/uninstall
+{
+  "method": "POST",
+  "path": "/api/2.0/libraries/uninstall",
+  "body": {
+    "cluster_id": "[MYCLUSTER_ID]",
+    "libraries": [
+      {
+        "pypi": {
+          "package": "six"
+        }
+      }
+    ]
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/libraries/install",
+  "body": {
+    "cluster_id": "[MYCLUSTER_ID]",
+    "libraries": [
+      {
+        "pypi": {
+          "package": "requests"
+        }
+      }
+    ]
+  }
+}
+
+=== Drift: 'requests' is uninstalled out of band; plan reinstalls the declared library
+>>> print_requests.py //libraries/uninstall
+{
+  "method": "POST",
+  "path": "/api/2.0/libraries/uninstall",
+  "body": {
+    "cluster_id": "[MYCLUSTER_ID]",
+    "libraries": [
+      {
+        "pypi": {
+          "package": "requests"
+        }
+      }
+    ]
+  }
+}
+
+>>> plan_libs
+{
+  "libraries": {
+    "action": "update",
+    "old": [
+      {
+        "pypi": {
+          "package": "requests"
+        }
+      }
+    ],
+    "new": [
+      {
+        "pypi": {
+          "package": "requests"
+        }
+      }
+    ]
+  }
+}
+
+>>> print_requests.py //libraries/install //libraries/uninstall
+{
+  "method": "POST",
+  "path": "/api/2.0/libraries/install",
+  "body": {
+    "cluster_id": "[MYCLUSTER_ID]",
+    "libraries": [
+      {
+        "pypi": {
+          "package": "requests"
+        }
+      }
+    ]
+  }
+}
+
+=== Remove the libraries section: libraries become unmanaged, requests stays installed, no install or uninstall
+>>> plan_libs
+{
+  "libraries": {
+    "action": "skip",
+    "reason": "unmanaged",
+    "old": [
+      {
+        "pypi": {
+          "package": "requests"
+        }
+      }
+    ],
+    "remote": [
+      {
+        "pypi": {
+          "package": "requests"
+        }
+      }
+    ]
+  }
+}
+
+>>> print_requests.py //libraries/uninstall //libraries/install
+
+=== No-op redeploy: libraries are unmanaged and nothing changes
+>>> plan_libs
+{
+  "libraries": {
+    "action": "skip",
+    "reason": "unmanaged",
+    "old": [
+      {
+        "pypi": {
+          "package": "requests"
+        }
+      }
+    ],
+    "remote": [
+      {
+        "pypi": {
+          "package": "requests"
+        }
+      }
+    ]
+  }
+}
+
+>>> print_requests.py //libraries/uninstall //libraries/install
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.clusters.mycluster
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/clusters/libraries-scenarios/script b/acceptance/bundle/resources/clusters/libraries-scenarios/script
new file mode 100644
index 00000000000..26e80df1b66
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/libraries-scenarios/script
@@ -0,0 +1,68 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f out.requests.txt tmp.plan.json
+}
+trap cleanup EXIT
+
+# Show the cluster's libraries plan entries; reading the saved plan keeps output identical across READPLAN.
+plan_libs() {
+    jq '.plan["resources.clusters.mycluster"].changes | with_entries(select(.key | startswith("libraries")))' tmp.plan.json
+}
+
+# Deploy output is verbose and differs plan/no-plan; send it to LOG and assert the key line.
+title "Deploy a cluster that declares no libraries"
+$CLI bundle plan -o json > tmp.plan.json 2>>LOG.plan
+$CLI bundle deploy $(readplanarg tmp.plan.json) &> LOG.deploy
+cat LOG.deploy | contains.py "Created clusters.mycluster" > /dev/null
+printf '\n%s\n' "OK: cluster created"
+
+# Server-generated cluster id, read from state to target the out-of-band calls.
+CLUSTER_ID=$(read_id.py mycluster)
+
+title "Out of band: a job run (or the UI) installs 'six' on the shared cluster"
+MSYS_NO_PATHCONV=1 $CLI api post /api/2.0/libraries/install --json "{\"cluster_id\": \"$CLUSTER_ID\", \"libraries\": [{\"pypi\": {\"package\": \"six\"}}]}" > /dev/null
+trace print_requests.py //libraries/install
+
+title "No libraries section: six is skipped as unmanaged, not drift"
+$CLI bundle plan -o json > tmp.plan.json 2>>LOG.plan
+trace plan_libs
+
+title "Declare 'requests': plan installs it and uninstalls the out-of-band six"
+update_file.py databricks.yml "      num_workers: 1" "      num_workers: 1
+      libraries:
+        - pypi:
+            package: requests"
+$CLI bundle plan -o json > tmp.plan.json 2>>LOG.plan
+trace plan_libs
+$CLI bundle deploy $(readplanarg tmp.plan.json) &> LOG.deploy
+cat LOG.deploy | contains.py "Updated clusters.mycluster" > /dev/null
+trace print_requests.py //libraries/install //libraries/uninstall
+
+title "Drift: 'requests' is uninstalled out of band; plan reinstalls the declared library"
+MSYS_NO_PATHCONV=1 $CLI api post /api/2.0/libraries/uninstall --json "{\"cluster_id\": \"$CLUSTER_ID\", \"libraries\": [{\"pypi\": {\"package\": \"requests\"}}]}" > /dev/null
+trace print_requests.py //libraries/uninstall
+$CLI bundle plan -o json > tmp.plan.json 2>>LOG.plan
+trace plan_libs
+$CLI bundle deploy $(readplanarg tmp.plan.json) &> LOG.deploy
+cat LOG.deploy | contains.py "Updated clusters.mycluster" > /dev/null
+trace print_requests.py //libraries/install //libraries/uninstall
+
+title "Remove the libraries section: libraries become unmanaged, requests stays installed, no install or uninstall"
+update_file.py databricks.yml "      num_workers: 1
+      libraries:
+        - pypi:
+            package: requests" "      num_workers: 1"
+$CLI bundle plan -o json > tmp.plan.json 2>>LOG.plan
+trace plan_libs
+$CLI bundle deploy $(readplanarg tmp.plan.json) &> LOG.deploy
+cat LOG.deploy | contains.py "1 unchanged" > /dev/null
+trace print_requests.py //libraries/uninstall //libraries/install
+
+title "No-op redeploy: libraries are unmanaged and nothing changes"
+$CLI bundle plan -o json > tmp.plan.json 2>>LOG.plan
+trace plan_libs
+$CLI bundle deploy $(readplanarg tmp.plan.json) &> LOG.deploy
+cat LOG.deploy | contains.py "1 unchanged" > /dev/null
+trace print_requests.py //libraries/uninstall //libraries/install
diff --git a/acceptance/bundle/resources/clusters/libraries-scenarios/test.toml b/acceptance/bundle/resources/clusters/libraries-scenarios/test.toml
new file mode 100644
index 00000000000..68d1a4140b4
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/libraries-scenarios/test.toml
@@ -0,0 +1,8 @@
+# Without a libraries section the cluster's libraries are unmanaged (skipped with reason `unmanaged`), so an out-of-band library (job task lib or API install) is not drift. With a section, every library on the cluster is managed: out-of-band ones are uninstalled, declared ones installed, and drift is corrected.
+# Local only: the out-of-band library is injected via the Libraries API, deterministic locally but racy on cloud (the job-installed variant runs on cloud in interactive_cluster_declared_libs).
+RecordRequests = true
+
+# READPLAN=1 feeds the serialized plan to `bundle deploy --plan`.
+EnvMatrix.READPLAN = ["", "1"]
+
+Ignore = [".databricks", "databricks.yml", "tmp.plan.json"]
diff --git a/acceptance/bundle/resources/clusters/libraries-stopped-cluster/databricks.yml.tmpl b/acceptance/bundle/resources/clusters/libraries-stopped-cluster/databricks.yml.tmpl
new file mode 100644
index 00000000000..705177abe13
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/libraries-stopped-cluster/databricks.yml.tmpl
@@ -0,0 +1,19 @@
+bundle:
+  name: cluster-libraries-stopped-$UNIQUE_NAME
+
+workspace:
+  root_path: ~/.bundle/$UNIQUE_NAME
+
+resources:
+  clusters:
+    mycluster:
+      cluster_name: mycluster-$UNIQUE_NAME
+      spark_version: $DEFAULT_SPARK_VERSION
+      node_type_id: $NODE_TYPE_ID
+      instance_pool_id: $TEST_INSTANCE_POOL_ID
+      num_workers: 1
+      lifecycle:
+        started: false
+      libraries:
+        - pypi:
+            package: requests
diff --git a/acceptance/bundle/resources/clusters/libraries-stopped-cluster/out.test.toml b/acceptance/bundle/resources/clusters/libraries-stopped-cluster/out.test.toml
new file mode 100644
index 00000000000..844d5475d08
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/libraries-stopped-cluster/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudSlow = true
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/resources/clusters/libraries-stopped-cluster/output.txt b/acceptance/bundle/resources/clusters/libraries-stopped-cluster/output.txt
new file mode 100644
index 00000000000..d7913bf1bb0
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/libraries-stopped-cluster/output.txt
@@ -0,0 +1,14 @@
+
+=== Deploy libraries on a started=false cluster
+OK: created on stopped cluster
+
+=== Change the libraries and redeploy the stopped cluster
+OK: libraries changed on stopped cluster
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.clusters.mycluster
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/clusters/libraries-stopped-cluster/script b/acceptance/bundle/resources/clusters/libraries-stopped-cluster/script
new file mode 100644
index 00000000000..ec6fea46d5f
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/libraries-stopped-cluster/script
@@ -0,0 +1,25 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f out.requests.txt
+}
+trap cleanup EXIT
+
+# Deploy output goes to LOG (differs fake vs cloud); echo a pass line instead.
+title "Deploy libraries on a started=false cluster"
+$CLI bundle plan -o json > tmp.plan.json 2>>LOG.plan
+$CLI bundle deploy $(readplanarg tmp.plan.json) &> LOG.deploy
+cat LOG.deploy | contains.py "Created clusters.mycluster" > /dev/null
+printf '\n%s\n' "OK: created on stopped cluster"
+
+title "Change the libraries and redeploy the stopped cluster"
+update_file.py databricks.yml "        - pypi:
+            package: requests" "        - pypi:
+            package: requests
+        - pypi:
+            package: numpy"
+$CLI bundle plan -o json > tmp.plan.json 2>>LOG.plan
+$CLI bundle deploy $(readplanarg tmp.plan.json) &> LOG.redeploy
+cat LOG.redeploy | contains.py "Updated clusters.mycluster" > /dev/null
+printf '\n%s\n' "OK: libraries changed on stopped cluster"
diff --git a/acceptance/bundle/resources/clusters/libraries-stopped-cluster/test.toml b/acceptance/bundle/resources/clusters/libraries-stopped-cluster/test.toml
new file mode 100644
index 00000000000..2f3fd108383
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/libraries-stopped-cluster/test.toml
@@ -0,0 +1,11 @@
+Cloud = true
+CloudSlow = true
+RecordRequests = false
+
+EnvMatrix.READPLAN = ["", "1"]
+
+Ignore = [".databricks", "databricks.yml", "tmp.plan.json"]
+
+[[Repls]]
+Old = "[0-9]{4}-[0-9]{6}-[0-9a-z]{8}"
+New = "[UUID]"
diff --git a/acceptance/bundle/resources/clusters/libraries-update/databricks.yml.tmpl b/acceptance/bundle/resources/clusters/libraries-update/databricks.yml.tmpl
new file mode 100644
index 00000000000..60dbf56bd16
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/libraries-update/databricks.yml.tmpl
@@ -0,0 +1,17 @@
+bundle:
+  name: cluster-libraries-update-$UNIQUE_NAME
+
+workspace:
+  root_path: ~/.bundle/$UNIQUE_NAME
+
+resources:
+  clusters:
+    mycluster:
+      cluster_name: mycluster-$UNIQUE_NAME
+      spark_version: $DEFAULT_SPARK_VERSION
+      node_type_id: $NODE_TYPE_ID
+      instance_pool_id: $TEST_INSTANCE_POOL_ID
+      num_workers: 1
+      libraries:
+        - pypi:
+            package: requests
diff --git a/acceptance/bundle/resources/clusters/libraries-update/out.test.toml b/acceptance/bundle/resources/clusters/libraries-update/out.test.toml
new file mode 100644
index 00000000000..844d5475d08
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/libraries-update/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudSlow = true
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/resources/clusters/libraries-update/output.txt b/acceptance/bundle/resources/clusters/libraries-update/output.txt
new file mode 100644
index 00000000000..64c9ac77476
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/libraries-update/output.txt
@@ -0,0 +1,69 @@
+
+=== Create: the declared library installs on the new cluster
+>>> print_requests.py //libraries/install
+{
+  "method": "POST",
+  "path": "/api/2.0/libraries/install",
+  "body": {
+    "cluster_id": "[UUID]",
+    "libraries": [
+      {
+        "pypi": {
+          "package": "requests"
+        }
+      }
+    ]
+  }
+}
+
+=== Update: adding a library installs the declared set on the running cluster
+>>> print_requests.py //libraries/install //libraries/uninstall
+{
+  "method": "POST",
+  "path": "/api/2.0/libraries/install",
+  "body": {
+    "cluster_id": "[UUID]",
+    "libraries": [
+      {
+        "pypi": {
+          "package": "requests"
+        }
+      },
+      {
+        "pypi": {
+          "package": "six"
+        }
+      }
+    ]
+  }
+}
+
+=== Delete: emptying the libraries list uninstalls them
+>>> print_requests.py //libraries/uninstall //libraries/install
+{
+  "method": "POST",
+  "path": "/api/2.0/libraries/uninstall",
+  "body": {
+    "cluster_id": "[UUID]",
+    "libraries": [
+      {
+        "pypi": {
+          "package": "requests"
+        }
+      },
+      {
+        "pypi": {
+          "package": "six"
+        }
+      }
+    ]
+  }
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.clusters.mycluster
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/clusters/libraries-update/script b/acceptance/bundle/resources/clusters/libraries-update/script
new file mode 100644
index 00000000000..9ee680a1e72
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/libraries-update/script
@@ -0,0 +1,39 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f out.requests.txt
+}
+trap cleanup EXIT
+
+# Deploy output goes to LOG (differs fake vs cloud); the recorded library requests are the proof.
+title "Create: the declared library installs on the new cluster"
+$CLI bundle plan -o json > tmp.plan.json 2>>LOG.plan
+$CLI bundle deploy $(readplanarg tmp.plan.json) &> LOG.create
+cat LOG.create | contains.py "Created clusters.mycluster" > /dev/null
+trace print_requests.py //libraries/install
+
+title "Update: adding a library installs the declared set on the running cluster"
+update_file.py databricks.yml "        - pypi:
+            package: requests" "        - pypi:
+            package: requests
+        - pypi:
+            package: six"
+$CLI bundle plan -o json > tmp.plan.json 2>>LOG.plan
+$CLI bundle deploy $(readplanarg tmp.plan.json) &> LOG.update
+cat LOG.update | contains.py "Updated clusters.mycluster" > /dev/null
+trace print_requests.py //libraries/install //libraries/uninstall
+
+# An empty list keeps the libraries managed, so it uninstalls them; dropping the section would leave them unmanaged.
+title "Delete: emptying the libraries list uninstalls them"
+update_file.py databricks.yml "      libraries:
+        - pypi:
+            package: requests
+        - pypi:
+            package: six
+" "      libraries: []
+"
+$CLI bundle plan -o json > tmp.plan.json 2>>LOG.plan
+$CLI bundle deploy $(readplanarg tmp.plan.json) &> LOG.remove
+cat LOG.remove | contains.py "Updated clusters.mycluster" > /dev/null
+trace print_requests.py //libraries/uninstall //libraries/install
diff --git a/acceptance/bundle/resources/clusters/libraries-update/test.toml b/acceptance/bundle/resources/clusters/libraries-update/test.toml
new file mode 100644
index 00000000000..00fa5346212
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/libraries-update/test.toml
@@ -0,0 +1,10 @@
+Cloud = true
+CloudSlow = true
+
+EnvMatrix.READPLAN = ["", "1"]
+
+Ignore = [".databricks", "databricks.yml", "tmp.plan.json"]
+
+[[Repls]]
+Old = "[0-9]{4}-[0-9]{6}-[0-9a-z]{8}"
+New = "[UUID]"
diff --git a/acceptance/bundle/resources/clusters/libraries/databricks.yml.tmpl b/acceptance/bundle/resources/clusters/libraries/databricks.yml.tmpl
new file mode 100644
index 00000000000..2364bafe42a
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/libraries/databricks.yml.tmpl
@@ -0,0 +1,25 @@
+bundle:
+  name: cluster-libraries-$UNIQUE_NAME
+
+workspace:
+  root_path: ~/.bundle/$UNIQUE_NAME
+
+artifacts:
+  my_test_code:
+    type: whl
+    path: .
+    # Use 'python' because 'python3' does not exist in Windows virtualenvs.
+    build: python setup.py bdist_wheel
+
+resources:
+  clusters:
+    mycluster:
+      cluster_name: mycluster-$UNIQUE_NAME
+      spark_version: $DEFAULT_SPARK_VERSION
+      node_type_id: $NODE_TYPE_ID
+      num_workers: 1
+      data_security_mode: $DATA_SECURITY_MODE
+      libraries:
+        - pypi:
+            package: requests
+        - whl: ./dist/*.whl
diff --git a/acceptance/bundle/resources/clusters/libraries/my_test_code/__init__.py b/acceptance/bundle/resources/clusters/libraries/my_test_code/__init__.py
new file mode 100644
index 00000000000..909f1f3220d
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/libraries/my_test_code/__init__.py
@@ -0,0 +1,2 @@
+__version__ = "0.0.1"
+__author__ = "Databricks"
diff --git a/acceptance/bundle/resources/clusters/libraries/my_test_code/__main__.py b/acceptance/bundle/resources/clusters/libraries/my_test_code/__main__.py
new file mode 100644
index 00000000000..ea918ce2d53
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/libraries/my_test_code/__main__.py
@@ -0,0 +1,16 @@
+"""
+The entry point of the Python Wheel
+"""
+
+import sys
+
+
+def main():
+    # This method will print the provided arguments
+    print("Hello from my func")
+    print("Got arguments:")
+    print(sys.argv)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/acceptance/bundle/resources/clusters/libraries/out.test.toml b/acceptance/bundle/resources/clusters/libraries/out.test.toml
new file mode 100644
index 00000000000..844d5475d08
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/libraries/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudSlow = true
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/resources/clusters/libraries/output.txt b/acceptance/bundle/resources/clusters/libraries/output.txt
new file mode 100644
index 00000000000..6e0dc533ca0
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/libraries/output.txt
@@ -0,0 +1,58 @@
+
+=== Deploy a cluster with a pypi and a local wheel library
+>>> jq .plan["resources.clusters.mycluster"].new_state.value.libraries tmp.plan.json
+[
+  {
+    "pypi": {
+      "package": "requests"
+    }
+  },
+  {
+    "whl": "/Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/artifacts/.internal/my_test_code-0.0.1-py3-none-any.whl"
+  }
+]
+
+OK: cluster created with libraries
+
+=== Libraries installed via the Libraries API (wheel rewritten to its uploaded path)
+>>> print_requests.py //libraries/install
+{
+  "method": "POST",
+  "path": "/api/2.0/libraries/install",
+  "body": {
+    "cluster_id": "[UUID]",
+    "libraries": [
+      {
+        "pypi": {
+          "package": "requests"
+        }
+      },
+      {
+        "whl": "/Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/artifacts/.internal/my_test_code-0.0.1-py3-none-any.whl"
+      }
+    ]
+  }
+}
+
+=== Removing the wheel and redeploying uninstalls it
+>>> print_requests.py //libraries/uninstall
+{
+  "method": "POST",
+  "path": "/api/2.0/libraries/uninstall",
+  "body": {
+    "cluster_id": "[UUID]",
+    "libraries": [
+      {
+        "whl": "/Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/artifacts/.internal/my_test_code-0.0.1-py3-none-any.whl"
+      }
+    ]
+  }
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.clusters.mycluster
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/clusters/libraries/script b/acceptance/bundle/resources/clusters/libraries/script
new file mode 100644
index 00000000000..ad202b5b699
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/libraries/script
@@ -0,0 +1,29 @@
+export DATA_SECURITY_MODE=USER_ISOLATION
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f out.requests.txt
+}
+trap cleanup EXIT
+
+# Deploy output goes to LOG (differs fake vs cloud); echo a pass line instead.
+title "Deploy a cluster with a pypi and a local wheel library"
+$CLI bundle plan -o json > tmp.plan.json 2>>LOG.plan
+
+# The plan carries the local wheel rewritten to its uploaded .internal/ path, so
+# `bundle deploy --plan` installs it without rebuilding.
+trace jq '.plan["resources.clusters.mycluster"].new_state.value.libraries' tmp.plan.json
+$CLI bundle deploy $(readplanarg tmp.plan.json) &> LOG.deploy
+cat LOG.deploy | contains.py "Created clusters.mycluster" > /dev/null
+printf '\n%s\n' "OK: cluster created with libraries"
+
+title "Libraries installed via the Libraries API (wheel rewritten to its uploaded path)"
+trace print_requests.py //libraries/install
+
+title "Removing the wheel and redeploying uninstalls it"
+update_file.py databricks.yml "        - whl: ./dist/*.whl" ""
+$CLI bundle plan -o json > tmp.plan.json 2>>LOG.plan
+$CLI bundle deploy $(readplanarg tmp.plan.json) &> LOG.redeploy
+cat LOG.redeploy | contains.py "Updated clusters.mycluster" > /dev/null
+trace print_requests.py //libraries/uninstall
diff --git a/acceptance/bundle/resources/clusters/libraries/script.prepare b/acceptance/bundle/resources/clusters/libraries/script.prepare
new file mode 100644
index 00000000000..31e6de1dbf5
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/libraries/script.prepare
@@ -0,0 +1,3 @@
+uv venv -q .venv
+venv_activate
+uv pip install -q --no-index setuptools
diff --git a/acceptance/bundle/resources/clusters/libraries/setup.py b/acceptance/bundle/resources/clusters/libraries/setup.py
new file mode 100644
index 00000000000..8b48a92b4ce
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/libraries/setup.py
@@ -0,0 +1,15 @@
+from setuptools import setup, find_packages
+
+import my_test_code
+
+setup(
+    name="my_test_code",
+    version=my_test_code.__version__,
+    author=my_test_code.__author__,
+    url="https://databricks.com",
+    author_email="john.doe@databricks.com",
+    description="my example wheel",
+    packages=find_packages(include=["my_test_code"]),
+    entry_points={"group1": "run=my_test_code.__main__:main"},
+    install_requires=["setuptools"],
+)
diff --git a/acceptance/bundle/resources/clusters/libraries/test.toml b/acceptance/bundle/resources/clusters/libraries/test.toml
new file mode 100644
index 00000000000..676176eae10
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/libraries/test.toml
@@ -0,0 +1,11 @@
+Cloud = true
+CloudSlow = true
+RecordRequests = true
+
+EnvMatrix.READPLAN = ["", "1"]
+
+Ignore = [".databricks", ".venv", "build", "dist", "my_test_code.egg-info", "databricks.yml", "tmp.plan.json"]
+
+[[Repls]]
+Old = "[0-9]{4}-[0-9]{6}-[0-9a-z]{8}"
+New = "[UUID]"
diff --git a/acceptance/bundle/resources/clusters/lifecycle-started-toggle/databricks.yml.tmpl b/acceptance/bundle/resources/clusters/lifecycle-started-toggle/databricks.yml.tmpl
new file mode 100644
index 00000000000..e83931637ee
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/lifecycle-started-toggle/databricks.yml.tmpl
@@ -0,0 +1,16 @@
+bundle:
+  name: lifecycle-started-toggle-$UNIQUE_NAME
+
+workspace:
+  root_path: ~/.bundle/$UNIQUE_NAME
+
+resources:
+  clusters:
+    mycluster:
+      cluster_name: $UNIQUE_NAME
+      spark_version: 15.4.x-scala2.12
+      node_type_id: $NODE_TYPE_ID
+      instance_pool_id: $TEST_INSTANCE_POOL_ID
+      num_workers: 1
+      lifecycle:
+        started: false
diff --git a/acceptance/bundle/resources/clusters/lifecycle-started-toggle/out.test.toml b/acceptance/bundle/resources/clusters/lifecycle-started-toggle/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/lifecycle-started-toggle/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/clusters/lifecycle-started-toggle/output.txt b/acceptance/bundle/resources/clusters/lifecycle-started-toggle/output.txt
new file mode 100644
index 00000000000..1f0daa04149
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/lifecycle-started-toggle/output.txt
@@ -0,0 +1,80 @@
+
+=== Deploy with started=false: cluster created and then stopped
+>>> errcode [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Created clusters.mycluster
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //clusters
+{
+  "method": "POST",
+  "path": "/api/2.1/clusters/create",
+  "body": {
+    "autotermination_minutes": 60,
+    "cluster_name": "[UNIQUE_NAME]",
+    "instance_pool_id": "[TEST_INSTANCE_POOL_ID]",
+    "num_workers": 1,
+    "spark_version": "15.4.x-scala2.12"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.1/clusters/delete",
+  "body": {
+    "cluster_id": "[UUID]"
+  }
+}
+
+>>> errcode [CLI] clusters get [UUID]
+"TERMINATED"
+
+=== Toggle started=false -> started=true: only Start should be called, no Edit
+>>> update_file.py databricks.yml started: false started: true
+
+>>> errcode [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Updated clusters.mycluster
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //clusters
+{
+  "method": "POST",
+  "path": "/api/2.1/clusters/start",
+  "body": {
+    "cluster_id": "[UUID]"
+  }
+}
+
+>>> errcode [CLI] clusters get [UUID]
+"RUNNING"
+
+=== Toggle started=true -> started=false: only Stop should be called, no Edit
+>>> update_file.py databricks.yml started: true started: false
+
+>>> errcode [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Updated clusters.mycluster
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //clusters
+{
+  "method": "POST",
+  "path": "/api/2.1/clusters/delete",
+  "body": {
+    "cluster_id": "[UUID]"
+  }
+}
+
+>>> errcode [CLI] clusters get [UUID]
+"TERMINATED"
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.clusters.mycluster
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/clusters/lifecycle-started-toggle/script b/acceptance/bundle/resources/clusters/lifecycle-started-toggle/script
new file mode 100644
index 00000000000..f539ed54c85
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/lifecycle-started-toggle/script
@@ -0,0 +1,28 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+title "Deploy with started=false: cluster created and then stopped"
+trace errcode $CLI bundle deploy
+CLUSTER_ID=$($CLI bundle summary -o json | jq -r '.resources.clusters.mycluster.id')
+trace print_requests.py //clusters
+rm -f "$OUT_REQUESTS"
+{ trace errcode $CLI clusters get "$CLUSTER_ID" | jq '.state'; } || true
+
+title "Toggle started=false -> started=true: only Start should be called, no Edit"
+trace update_file.py databricks.yml "started: false" "started: true"
+trace errcode $CLI bundle deploy
+trace print_requests.py //clusters
+rm -f "$OUT_REQUESTS"
+{ trace errcode $CLI clusters get "$CLUSTER_ID" | jq '.state'; } || true
+
+title "Toggle started=true -> started=false: only Stop should be called, no Edit"
+trace update_file.py databricks.yml "started: true" "started: false"
+trace errcode $CLI bundle deploy
+trace print_requests.py //clusters
+rm -f "$OUT_REQUESTS"
+{ trace errcode $CLI clusters get "$CLUSTER_ID" | jq '.state'; } || true
diff --git a/acceptance/bundle/resources/clusters/lifecycle-started-toggle/test.toml b/acceptance/bundle/resources/clusters/lifecycle-started-toggle/test.toml
new file mode 100644
index 00000000000..2d0e6ef346a
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/lifecycle-started-toggle/test.toml
@@ -0,0 +1,8 @@
+Cloud = true
+RecordRequests = true
+
+Ignore = [".databricks", "databricks.yml"]
+
+[[Repls]]
+Old = "[0-9]{4}-[0-9]{6}-[0-9a-z]{8}"
+New = "[UUID]"
diff --git a/acceptance/bundle/resources/clusters/lifecycle-started/databricks.yml.tmpl b/acceptance/bundle/resources/clusters/lifecycle-started/databricks.yml.tmpl
new file mode 100644
index 00000000000..cd0a5360ab8
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/lifecycle-started/databricks.yml.tmpl
@@ -0,0 +1,16 @@
+bundle:
+  name: lifecycle-started-$UNIQUE_NAME
+
+workspace:
+  root_path: ~/.bundle/$UNIQUE_NAME
+
+resources:
+  clusters:
+    mycluster:
+      cluster_name: $UNIQUE_NAME
+      spark_version: 15.4.x-scala2.12
+      node_type_id: $NODE_TYPE_ID
+      instance_pool_id: $TEST_INSTANCE_POOL_ID
+      num_workers: 1
+      lifecycle:
+        started: true
diff --git a/acceptance/bundle/resources/clusters/lifecycle-started/out.test.toml b/acceptance/bundle/resources/clusters/lifecycle-started/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/lifecycle-started/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/clusters/lifecycle-started/output.txt b/acceptance/bundle/resources/clusters/lifecycle-started/output.txt
new file mode 100644
index 00000000000..264c8a4ca31
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/lifecycle-started/output.txt
@@ -0,0 +1,110 @@
+
+=== Deploy with started=true: cluster created and running
+>>> errcode [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Created clusters.mycluster
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //clusters
+{
+  "method": "POST",
+  "path": "/api/2.1/clusters/create",
+  "body": {
+    "autotermination_minutes": 60,
+    "cluster_name": "[UNIQUE_NAME]",
+    "instance_pool_id": "[TEST_INSTANCE_POOL_ID]",
+    "num_workers": 1,
+    "spark_version": "15.4.x-scala2.12"
+  }
+}
+
+>>> errcode [CLI] clusters get [UUID]
+"RUNNING"
+
+=== Stop cluster externally while config says started=true: plan detects drift
+>>> errcode [CLI] clusters delete [UUID]
+"TERMINATED"
+
+>>> [CLI] bundle plan
+update clusters.mycluster
+
+Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
+
+=== Deploy fixes the drift: cluster restarted
+>>> errcode [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Updated clusters.mycluster
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //clusters
+{
+  "method": "POST",
+  "path": "/api/2.1/clusters/delete",
+  "body": {
+    "cluster_id": "[UUID]"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.1/clusters/start",
+  "body": {
+    "cluster_id": "[UUID]"
+  }
+}
+
+>>> errcode [CLI] clusters get [UUID]
+"RUNNING"
+
+=== Deploy with started=false while cluster is stopped: cluster stays terminated
+>>> errcode [CLI] clusters delete [UUID]
+"TERMINATED"
+
+>>> update_file.py databricks.yml started: true started: false
+
+>>> errcode [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
+
+>>> print_requests.py //clusters
+{
+  "method": "POST",
+  "path": "/api/2.1/clusters/delete",
+  "body": {
+    "cluster_id": "[UUID]"
+  }
+}
+
+>>> errcode [CLI] clusters get [UUID]
+"TERMINATED"
+
+=== Deploy with started=true: cluster restarted
+>>> update_file.py databricks.yml started: false started: true
+
+>>> errcode [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Updated clusters.mycluster
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //clusters
+{
+  "method": "POST",
+  "path": "/api/2.1/clusters/start",
+  "body": {
+    "cluster_id": "[UUID]"
+  }
+}
+
+>>> errcode [CLI] clusters get [UUID]
+"RUNNING"
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.clusters.mycluster
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/clusters/lifecycle-started/script b/acceptance/bundle/resources/clusters/lifecycle-started/script
new file mode 100644
index 00000000000..5fbde2e4d27
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/lifecycle-started/script
@@ -0,0 +1,39 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+title "Deploy with started=true: cluster created and running"
+trace errcode $CLI bundle deploy
+CLUSTER_ID=$($CLI bundle summary -o json | jq -r '.resources.clusters.mycluster.id')
+trace print_requests.py //clusters
+rm -f "$OUT_REQUESTS"
+{ trace errcode $CLI clusters get "$CLUSTER_ID" | jq '.state'; } || true
+
+title "Stop cluster externally while config says started=true: plan detects drift"
+{ trace errcode $CLI clusters delete "$CLUSTER_ID" | jq '.state'; } || true
+trace $CLI bundle plan
+
+title "Deploy fixes the drift: cluster restarted"
+trace errcode $CLI bundle deploy
+trace print_requests.py //clusters
+rm -f "$OUT_REQUESTS"
+{ trace errcode $CLI clusters get "$CLUSTER_ID" | jq '.state'; } || true
+
+title "Deploy with started=false while cluster is stopped: cluster stays terminated"
+{ trace errcode $CLI clusters delete "$CLUSTER_ID" | jq '.state'; } || true
+trace update_file.py databricks.yml "started: true" "started: false"
+trace errcode $CLI bundle deploy
+trace print_requests.py //clusters
+rm -f "$OUT_REQUESTS"
+{ trace errcode $CLI clusters get "$CLUSTER_ID" | jq '.state'; } || true
+
+title "Deploy with started=true: cluster restarted"
+trace update_file.py databricks.yml "started: false" "started: true"
+trace errcode $CLI bundle deploy
+trace print_requests.py //clusters
+rm -f "$OUT_REQUESTS"
+{ trace errcode $CLI clusters get "$CLUSTER_ID" | jq '.state'; } || true
diff --git a/acceptance/bundle/resources/clusters/lifecycle-started/test.toml b/acceptance/bundle/resources/clusters/lifecycle-started/test.toml
new file mode 100644
index 00000000000..2d0e6ef346a
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/lifecycle-started/test.toml
@@ -0,0 +1,8 @@
+Cloud = true
+RecordRequests = true
+
+Ignore = [".databricks", "databricks.yml"]
+
+[[Repls]]
+Old = "[0-9]{4}-[0-9]{6}-[0-9a-z]{8}"
+New = "[UUID]"
diff --git a/acceptance/bundle/resources/clusters/readplan-lifecycle/databricks.yml b/acceptance/bundle/resources/clusters/readplan-lifecycle/databricks.yml
new file mode 100644
index 00000000000..800e2f2c2de
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/readplan-lifecycle/databricks.yml
@@ -0,0 +1,13 @@
+bundle:
+  name: test-bundle
+
+resources:
+  clusters:
+    mycluster:
+      cluster_name: test-cluster
+      spark_version: 13.3.x-scala2.12
+      num_workers: 1
+      custom_tags:
+        env: original
+      lifecycle:
+        started: true
diff --git a/acceptance/bundle/resources/clusters/readplan-lifecycle/out.test.toml b/acceptance/bundle/resources/clusters/readplan-lifecycle/out.test.toml
new file mode 100644
index 00000000000..f7fafbcc731
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/readplan-lifecycle/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/resources/clusters/readplan-lifecycle/output.txt b/acceptance/bundle/resources/clusters/readplan-lifecycle/output.txt
new file mode 100644
index 00000000000..83736aac03a
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/readplan-lifecycle/output.txt
@@ -0,0 +1,24 @@
+
+=== Initial deploy: cluster created and running
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created clusters.mycluster
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //clusters/start
+
+=== Change tags and deploy from plan: no extra start
+>>> update_file.py databricks.yml env: original env: updated
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Updated clusters.mycluster
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //clusters/start
+The following resources will be deleted:
+  delete resources.clusters.mycluster
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/clusters/readplan-lifecycle/script b/acceptance/bundle/resources/clusters/readplan-lifecycle/script
new file mode 100644
index 00000000000..383316d33ba
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/readplan-lifecycle/script
@@ -0,0 +1,15 @@
+cleanup() {
+    $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+title "Initial deploy: cluster created and running"
+trace $CLI bundle deploy
+trace print_requests.py //clusters/start
+
+title "Change tags and deploy from plan: no extra start"
+trace update_file.py databricks.yml "env: original" "env: updated"
+$CLI bundle plan -o json > tmp.plan.json
+$CLI bundle deploy $(readplanarg tmp.plan.json)
+trace print_requests.py //clusters/start
diff --git a/acceptance/bundle/resources/clusters/readplan-lifecycle/test.toml b/acceptance/bundle/resources/clusters/readplan-lifecycle/test.toml
new file mode 100644
index 00000000000..5bad0f70d3c
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/readplan-lifecycle/test.toml
@@ -0,0 +1,8 @@
+Cloud = false
+Ignore = [".databricks", "tmp.plan.json"]
+
+EnvMatrix.READPLAN = ["", "1"]
+
+[[Repls]]
+Old = "[0-9]{4}-[0-9]{6}-[0-9a-z]{8}"
+New = "[CLUSTER-ID]"
diff --git a/acceptance/bundle/resources/clusters/resize-terminated-fallback/databricks.yml.tmpl b/acceptance/bundle/resources/clusters/resize-terminated-fallback/databricks.yml.tmpl
new file mode 100644
index 00000000000..ff3fa1211a1
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/resize-terminated-fallback/databricks.yml.tmpl
@@ -0,0 +1,14 @@
+bundle:
+  name: test-bundle
+
+workspace:
+  root_path: ~/.bundle/$UNIQUE_NAME
+
+resources:
+  clusters:
+    test_cluster:
+      cluster_name: test-cluster-$UNIQUE_NAME
+      spark_version: $DEFAULT_SPARK_VERSION
+      node_type_id: $NODE_TYPE_ID
+      instance_pool_id: $TEST_INSTANCE_POOL_ID
+      num_workers: 2
diff --git a/acceptance/bundle/resources/clusters/resize-terminated-fallback/out.test.toml b/acceptance/bundle/resources/clusters/resize-terminated-fallback/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/resize-terminated-fallback/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/clusters/resize-terminated-fallback/output.txt b/acceptance/bundle/resources/clusters/resize-terminated-fallback/output.txt
new file mode 100644
index 00000000000..1b7f5da4ee8
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/resize-terminated-fallback/output.txt
@@ -0,0 +1,65 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Created clusters.test_cluster
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Create a plan while cluster is running: should show resize
+
+>>> [CLI] bundle plan -o json
+
+=== Terminate the cluster before applying the saved plan
+
+>>> [CLI] clusters get [CLUSTER_ID]
+{
+  "cluster_name": "test-cluster-[UNIQUE_NAME]",
+  "num_workers": 2,
+  "state": "TERMINATED"
+}
+
+=== Apply saved plan: resize fails with INVALID_STATE, falls back to edit
+
+>>> [CLI] bundle deploy --plan plan.json
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Resized clusters.test_cluster
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //clusters/resize //clusters/edit
+{
+  "method": "POST",
+  "path": "/api/2.1/clusters/resize",
+  "body": {
+    "cluster_id": "[CLUSTER_ID]",
+    "num_workers": 3
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.1/clusters/edit",
+  "body": {
+    "autotermination_minutes": 60,
+    "cluster_id": "[CLUSTER_ID]",
+    "cluster_name": "test-cluster-[UNIQUE_NAME]",
+    "instance_pool_id": "[TEST_INSTANCE_POOL_ID]",
+    "num_workers": 3,
+    "spark_version": "13.3.x-snapshot-scala2.12"
+  }
+}
+
+=== Cluster should have new num_workers
+
+>>> [CLI] clusters get [CLUSTER_ID]
+{
+  "cluster_name": "test-cluster-[UNIQUE_NAME]",
+  "num_workers": 3
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.clusters.test_cluster
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/clusters/resize-terminated-fallback/script b/acceptance/bundle/resources/clusters/resize-terminated-fallback/script
new file mode 100644
index 00000000000..72399f2e419
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/resize-terminated-fallback/script
@@ -0,0 +1,27 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+trace $CLI bundle deploy
+
+CLUSTER_ID=$($CLI bundle summary -o json | jq -r '.resources.clusters.test_cluster.id')
+add_repl "$CLUSTER_ID" CLUSTER_ID
+
+title "Create a plan while cluster is running: should show resize\n"
+update_file.py databricks.yml "num_workers: 2" "num_workers: 3"
+trace $CLI bundle plan -o json > plan.json
+
+title "Terminate the cluster before applying the saved plan\n"
+$CLI clusters delete "$CLUSTER_ID" > /dev/null
+trace $CLI clusters get "$CLUSTER_ID" | jq '{cluster_name,num_workers,state}'
+
+title "Apply saved plan: resize fails with INVALID_STATE, falls back to edit\n"
+trace $CLI bundle deploy --plan plan.json
+trace print_requests.py //clusters/resize //clusters/edit
+
+title "Cluster should have new num_workers\n"
+trace $CLI clusters get "$CLUSTER_ID" | jq '{cluster_name,num_workers}'
diff --git a/acceptance/bundle/resources/clusters/resize-terminated-fallback/test.toml b/acceptance/bundle/resources/clusters/resize-terminated-fallback/test.toml
new file mode 100644
index 00000000000..7e11a4565e9
--- /dev/null
+++ b/acceptance/bundle/resources/clusters/resize-terminated-fallback/test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+RecordRequests = true
+
+Ignore = [".databricks", "databricks.yml", "plan.json"]
diff --git a/acceptance/bundle/resources/clusters/run/spark_python_task/out.test.toml b/acceptance/bundle/resources/clusters/run/spark_python_task/out.test.toml
index af50cb9b76b..542162e7f25 100644
--- a/acceptance/bundle/resources/clusters/run/spark_python_task/out.test.toml
+++ b/acceptance/bundle/resources/clusters/run/spark_python_task/out.test.toml
@@ -1,5 +1,4 @@
-Local = false
 Cloud = true
 CloudSlow = true
 RunsOnDbr = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/clusters/run/spark_python_task/output.txt b/acceptance/bundle/resources/clusters/run/spark_python_task/output.txt
index ed0bdb249dc..b0453085244 100644
--- a/acceptance/bundle/resources/clusters/run/spark_python_task/output.txt
+++ b/acceptance/bundle/resources/clusters/run/spark_python_task/output.txt
@@ -5,12 +5,13 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created clusters.test_cluster
+Created jobs.foo
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle run foo
-Run URL: [DATABRICKS_URL]/?o=[NUMID]#job/[FOO_ID]/run/[NUMID]
+Run URL: [DATABRICKS_URL]/jobs/[FOO_ID]/runs/[RUN_ID]?o=[WORKSPACE_ID]
 
 [TIMESTAMP] "test-job-with-cluster-[UNIQUE_NAME]" RUNNING
 [TIMESTAMP] "test-job-with-cluster-[UNIQUE_NAME]" TERMINATED SUCCESS
@@ -23,5 +24,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/clusters/run/spark_python_task/test.toml b/acceptance/bundle/resources/clusters/run/spark_python_task/test.toml
index 927221d7156..8c6e5133c82 100644
--- a/acceptance/bundle/resources/clusters/run/spark_python_task/test.toml
+++ b/acceptance/bundle/resources/clusters/run/spark_python_task/test.toml
@@ -1,4 +1,4 @@
-Local = false
+Cloud = true
 CloudSlow = true
 RecordRequests = false
 RunsOnDbr = true
@@ -10,8 +10,8 @@ Ignore = [
 ]
 
 [[Repls]]
-Old = '\d{5,}'
-New = "[NUMID]"
+Old = '/runs/\d+'
+New = '/runs/[RUN_ID]'
 
 [[Repls]]
 Old = '\\\\'
diff --git a/acceptance/bundle/resources/dashboards/change-embed-credentials/out.patch.requests.terraform.txt b/acceptance/bundle/resources/dashboards/change-embed-credentials/out.patch.requests.terraform.txt
deleted file mode 100644
index 761d19479b9..00000000000
--- a/acceptance/bundle/resources/dashboards/change-embed-credentials/out.patch.requests.terraform.txt
+++ /dev/null
@@ -1,16 +0,0 @@
-{
-  "method": "PATCH",
-  "path": "/api/2.0/lakeview/dashboards/[DASHBOARD_ID]",
-  "body": {
-    "create_time": "[TIMESTAMP]",
-    "dashboard_id": "[DASHBOARD_ID]",
-    "display_name": "test dashboard",
-    "etag": [ETAG],
-    "lifecycle_state": "ACTIVE",
-    "parent_path": "/Users/[USERNAME]/.bundle/change-embed-credentials-[UNIQUE_NAME]/default/resources",
-    "path": "/Users/[USERNAME]/.bundle/change-embed-credentials-[UNIQUE_NAME]/default/resources/test dashboard.lvdash.json",
-    "serialized_dashboard": "{}\n",
-    "update_time": "[TIMESTAMP]",
-    "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
-  }
-}
diff --git a/acceptance/bundle/resources/dashboards/change-embed-credentials/out.patch.requests.direct.txt b/acceptance/bundle/resources/dashboards/change-embed-credentials/out.patch.requests.txt
similarity index 100%
rename from acceptance/bundle/resources/dashboards/change-embed-credentials/out.patch.requests.direct.txt
rename to acceptance/bundle/resources/dashboards/change-embed-credentials/out.patch.requests.txt
diff --git a/acceptance/bundle/resources/dashboards/change-embed-credentials/out.test.toml b/acceptance/bundle/resources/dashboards/change-embed-credentials/out.test.toml
index 96be4fdfe9d..0f167effef1 100644
--- a/acceptance/bundle/resources/dashboards/change-embed-credentials/out.test.toml
+++ b/acceptance/bundle/resources/dashboards/change-embed-credentials/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = true
-RequiresWarehouse = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/dashboards/change-embed-credentials/output.txt b/acceptance/bundle/resources/dashboards/change-embed-credentials/output.txt
index 8b5d7dd6bf5..8a14d7e9071 100644
--- a/acceptance/bundle/resources/dashboards/change-embed-credentials/output.txt
+++ b/acceptance/bundle/resources/dashboards/change-embed-credentials/output.txt
@@ -6,11 +6,9 @@ Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/change-embed-credentials-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> [CLI] lakeview get [DASHBOARD_ID]
+Created dashboards.my_dashboard
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 {
   "display_name": "test dashboard",
   "lifecycle_state": "ACTIVE",
@@ -33,11 +31,9 @@ Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/change-embed-credentials-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> [CLI] lakeview get [DASHBOARD_ID]
+Updated dashboards.my_dashboard
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 {
   "display_name": "test dashboard",
   "lifecycle_state": "ACTIVE",
@@ -59,5 +55,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/change-embed-credentials-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/dashboards/change-embed-credentials/script b/acceptance/bundle/resources/dashboards/change-embed-credentials/script
index 640ca7da1ef..b22533e9348 100755
--- a/acceptance/bundle/resources/dashboards/change-embed-credentials/script
+++ b/acceptance/bundle/resources/dashboards/change-embed-credentials/script
@@ -2,7 +2,7 @@ export EMBED_CREDENTIALS="false"
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm out.requests.txt
+    rm "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
@@ -15,17 +15,16 @@ deploy_dashboard() {
     trace $CLI bundle deploy
     dashboard_id=$($CLI bundle summary --output json | jq -r '.resources.dashboards.my_dashboard.id')
 
-    trace $CLI lakeview get $dashboard_id | jq "{display_name, lifecycle_state, parent_path, path, serialized_dashboard, warehouse_id}"
+    DASHBOARD=$(retry $CLI lakeview get $dashboard_id)
+    add_repl "$dashboard_id" DASHBOARD_ID
+    add_repl "$(echo "$DASHBOARD" | jq -r '.etag')" ETAG
+    echo "$DASHBOARD" | jq "{display_name, lifecycle_state, parent_path, path, serialized_dashboard, warehouse_id}"
     trace $CLI lakeview get-published $dashboard_id | jq "{warehouse_id, embed_credentials}"
 }
 
 # Create the dashboard with embed_credentials=false
 deploy_dashboard
 
-# Capture the dashboard ID as a replacement.
-dashboard_id=$($CLI bundle summary --output json | jq -r '.resources.dashboards.my_dashboard.id')
-echo "$dashboard_id:DASHBOARD_ID" >> ACC_REPLS
-
 # Change embed_credentials to true - this should trigger an update
 export EMBED_CREDENTIALS="true"
 deploy_dashboard
@@ -33,12 +32,12 @@ deploy_dashboard
 # Print API requests made to create parent_path or create / update the dashboard.
 # Terraform serialized OUTPUT_ONLY fields in the request body while direct does not.
 # That's why we write the requests to separate files.
-cat out.requests.txt | \
+cat "$OUT_REQUESTS" | \
  jq 'select(.method == "PATCH")' | \
  jq 'select( (.path | contains("/api/2.0/lakeview/dashboards")) or ((.path == "/api/2.0/workspace/mkdirs") and (.body.path | contains("/default/resources"))))' \
- > out.patch.requests.$DATABRICKS_BUNDLE_ENGINE.txt
+ > out.patch.requests.txt
 
-cat out.requests.txt | \
+cat "$OUT_REQUESTS" | \
  jq 'select(.method == "POST")' | \
  jq 'select( (.path | contains("/api/2.0/lakeview/dashboards")) or ((.path == "/api/2.0/workspace/mkdirs") and (.body.path | contains("/default/resources"))))' \
  > out.post.requests.txt
diff --git a/acceptance/bundle/resources/dashboards/change-name/out.patch.requests.terraform.txt b/acceptance/bundle/resources/dashboards/change-name/out.patch.requests.terraform.txt
deleted file mode 100644
index 2e2e8bc108c..00000000000
--- a/acceptance/bundle/resources/dashboards/change-name/out.patch.requests.terraform.txt
+++ /dev/null
@@ -1,16 +0,0 @@
-{
-  "method": "PATCH",
-  "path": "/api/2.0/lakeview/dashboards/[DASHBOARD_ID]",
-  "body": {
-    "create_time": "[TIMESTAMP]",
-    "dashboard_id": "[DASHBOARD_ID]",
-    "display_name": "dashboard2",
-    "etag": [ETAG],
-    "lifecycle_state": "ACTIVE",
-    "parent_path": "/Users/[USERNAME]/.bundle/change-name-[UNIQUE_NAME]/default/resources",
-    "path": "/Users/[USERNAME]/.bundle/change-name-[UNIQUE_NAME]/default/resources/dashboard1.lvdash.json",
-    "serialized_dashboard": "{}\n",
-    "update_time": "[TIMESTAMP]",
-    "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
-  }
-}
diff --git a/acceptance/bundle/resources/dashboards/change-name/out.patch.requests.direct.txt b/acceptance/bundle/resources/dashboards/change-name/out.patch.requests.txt
similarity index 100%
rename from acceptance/bundle/resources/dashboards/change-name/out.patch.requests.direct.txt
rename to acceptance/bundle/resources/dashboards/change-name/out.patch.requests.txt
diff --git a/acceptance/bundle/resources/dashboards/change-name/out.test.toml b/acceptance/bundle/resources/dashboards/change-name/out.test.toml
index 96be4fdfe9d..0f167effef1 100644
--- a/acceptance/bundle/resources/dashboards/change-name/out.test.toml
+++ b/acceptance/bundle/resources/dashboards/change-name/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = true
-RequiresWarehouse = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/dashboards/change-name/output.txt b/acceptance/bundle/resources/dashboards/change-name/output.txt
index e2c01c32743..8527260307a 100644
--- a/acceptance/bundle/resources/dashboards/change-name/output.txt
+++ b/acceptance/bundle/resources/dashboards/change-name/output.txt
@@ -6,11 +6,9 @@ Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/change-name-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> [CLI] lakeview get [DASHBOARD_ID]
+Created dashboards.my_dashboard
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 {
   "display_name": "dashboard1",
   "lifecycle_state": "ACTIVE",
@@ -27,11 +25,9 @@ Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/change-name-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> [CLI] lakeview get [DASHBOARD_ID]
+Updated dashboards.my_dashboard
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 {
   "display_name": "dashboard2",
   "lifecycle_state": "ACTIVE",
@@ -47,5 +43,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/change-name-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/dashboards/change-name/script b/acceptance/bundle/resources/dashboards/change-name/script
index 5a20f19f7a3..60d9ccc0b43 100644
--- a/acceptance/bundle/resources/dashboards/change-name/script
+++ b/acceptance/bundle/resources/dashboards/change-name/script
@@ -2,7 +2,7 @@ export NAME="dashboard1"
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm out.requests.txt
+    rm "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
@@ -12,7 +12,10 @@ deploy_dashboard() {
     trace $CLI bundle plan
     trace $CLI bundle deploy
     dashboard_id=$($CLI bundle summary --output json | jq -r '.resources.dashboards.my_dashboard.id')
-    trace $CLI lakeview get $dashboard_id | jq '{display_name, lifecycle_state, parent_path, path, serialized_dashboard, warehouse_id}'
+    # Wait out eventual consistency: retry until the current name is visible (the read
+    # 404s on create and returns the stale name right after a rename).
+    DASHBOARD=$(retry --until "$NAME" $CLI lakeview get $dashboard_id)
+    echo "$DASHBOARD" | jq '{display_name, lifecycle_state, parent_path, path, serialized_dashboard, warehouse_id}'
 }
 
 # Create the dashboard
@@ -20,7 +23,8 @@ deploy_dashboard
 
 # Capture the dashboard ID as a replacement.
 dashboard_id=$($CLI bundle summary --output json | jq -r '.resources.dashboards.my_dashboard.id')
-echo "$dashboard_id:DASHBOARD_ID" >> ACC_REPLS
+add_repl "$dashboard_id" DASHBOARD_ID
+add_repl "$(echo "$DASHBOARD" | jq -r '.etag')" ETAG
 
 # Change the name
 export NAME="dashboard2"
@@ -29,12 +33,12 @@ deploy_dashboard
 # Print API requests made to create parent_path or create / update the dashboard.
 # Terraform serialized OUTPUT_ONLY fields in the request body while direct does not.
 # That's why we write the requests to separate files.
-cat out.requests.txt | \
+cat "$OUT_REQUESTS" | \
  jq 'select(.method == "PATCH")' | \
  jq 'select( (.path | contains("/api/2.0/lakeview/dashboards")) or ((.path == "/api/2.0/workspace/mkdirs") and (.body.path | contains("/default/resources"))))' \
- > out.patch.requests.$DATABRICKS_BUNDLE_ENGINE.txt
+ > out.patch.requests.txt
 
-cat out.requests.txt | \
+cat "$OUT_REQUESTS" | \
  jq 'select(.method == "POST")' | \
  jq 'select( (.path | contains("/api/2.0/lakeview/dashboards")) or ((.path == "/api/2.0/workspace/mkdirs") and (.body.path | contains("/default/resources"))))' \
  > out.post.requests.txt
diff --git a/acceptance/bundle/resources/dashboards/change-parent-path/out.plan_after_deploy.direct.txt b/acceptance/bundle/resources/dashboards/change-parent-path/out.plan_after_deploy.txt
similarity index 100%
rename from acceptance/bundle/resources/dashboards/change-parent-path/out.plan_after_deploy.direct.txt
rename to acceptance/bundle/resources/dashboards/change-parent-path/out.plan_after_deploy.txt
diff --git a/acceptance/bundle/resources/dashboards/change-parent-path/out.test.toml b/acceptance/bundle/resources/dashboards/change-parent-path/out.test.toml
index 96be4fdfe9d..0f167effef1 100644
--- a/acceptance/bundle/resources/dashboards/change-parent-path/out.test.toml
+++ b/acceptance/bundle/resources/dashboards/change-parent-path/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = true
-RequiresWarehouse = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/dashboards/change-parent-path/output.txt b/acceptance/bundle/resources/dashboards/change-parent-path/output.txt
index a7b26e91c57..d0d4f049ceb 100644
--- a/acceptance/bundle/resources/dashboards/change-parent-path/output.txt
+++ b/acceptance/bundle/resources/dashboards/change-parent-path/output.txt
@@ -6,11 +6,11 @@ Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy --auto-approve
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/change-parent-path-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created dashboards.my_dashboard
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
->>> [CLI] lakeview get [ORIGINAL_DASHBOARD_ID]
+>>> retry [CLI] lakeview get [ORIGINAL_DASHBOARD_ID]
 {
   "display_name": "test dashboard",
   "lifecycle_state": "ACTIVE",
@@ -31,11 +31,11 @@ Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/change-parent-path
 This action will result in the deletion or recreation of the following dashboards.
 This will result in changed IDs and permanent URLs of the dashboards that will be recreated:
   recreate resources.dashboards.my_dashboard
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Recreated dashboards.my_dashboard
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 0 unchanged
 
->>> [CLI] lakeview get [NEW_DASHBOARD_ID]
+>>> retry [CLI] lakeview get [NEW_DASHBOARD_ID]
 {
   "display_name": "test dashboard",
   "lifecycle_state": "ACTIVE",
@@ -51,5 +51,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/change-parent-path-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/dashboards/change-parent-path/script b/acceptance/bundle/resources/dashboards/change-parent-path/script
index 66c139ce5ca..353e0e1fa9b 100755
--- a/acceptance/bundle/resources/dashboards/change-parent-path/script
+++ b/acceptance/bundle/resources/dashboards/change-parent-path/script
@@ -5,7 +5,7 @@ export PARENT_PATH=" /Users/$USERNAME/.bundle/change-parent-path-$UNIQUE_NAME/de
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm out.requests.txt
+    rm "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 # Deploy the dashboard and capture the ID
@@ -14,7 +14,7 @@ deploy_dashboard() {
     trace $CLI bundle plan
     trace $CLI bundle deploy --auto-approve
     dashboard_id=$($CLI bundle summary --output json | jq -r '.resources.dashboards.my_dashboard.id')
-    trace $CLI lakeview get $dashboard_id | jq '{display_name, lifecycle_state, parent_path, path, serialized_dashboard, warehouse_id}'
+    trace retry $CLI lakeview get $dashboard_id | jq '{display_name, lifecycle_state, parent_path, path, serialized_dashboard, warehouse_id}'
 }
 
 # Create the dashboard with initial parent_path
@@ -22,7 +22,7 @@ deploy_dashboard
 
 # Capture the dashboard ID as a replacement.
 dashboard_id=$($CLI bundle summary --output json | jq -r '.resources.dashboards.my_dashboard.id')
-echo "$dashboard_id:ORIGINAL_DASHBOARD_ID" >> ACC_REPLS
+add_repl "$dashboard_id" ORIGINAL_DASHBOARD_ID
 
 # Change the parent_path - this should trigger a recreate (delete + create)
 export PARENT_PATH=" /Users/$USERNAME/.bundle/change-parent-path-$UNIQUE_NAME/default/resources2"
@@ -30,12 +30,12 @@ deploy_dashboard
 
 # Capture the new dashboard ID as a replacement.
 new_dashboard_id=$($CLI bundle summary --output json | jq -r '.resources.dashboards.my_dashboard.id')
-echo "$new_dashboard_id:NEW_DASHBOARD_ID" >> ACC_REPLS
+add_repl "$new_dashboard_id" NEW_DASHBOARD_ID
 
 # Print API requests made to create parent_path or create / update / delete the dashboard.
-cat out.requests.txt | \
+cat "$OUT_REQUESTS" | \
  jq 'select(.method == "POST" or .method == "PATCH" or .method == "DELETE")' | \
  jq 'select( (.path | contains("/api/2.0/lakeview/dashboards")) or ((.path == "/api/2.0/workspace/mkdirs") and (.body.path | contains("/default/resources"))))' \
  > out.dashboardrequests.txt
 
-$CLI bundle plan > out.plan_after_deploy.$DATABRICKS_BUNDLE_ENGINE.txt
+$CLI bundle plan > out.plan_after_deploy.txt
diff --git a/acceptance/bundle/resources/dashboards/change-serialized-dashboard/databricks.yml.tmpl b/acceptance/bundle/resources/dashboards/change-serialized-dashboard/databricks.yml.tmpl
index 6049574dd24..f01baed4a5b 100644
--- a/acceptance/bundle/resources/dashboards/change-serialized-dashboard/databricks.yml.tmpl
+++ b/acceptance/bundle/resources/dashboards/change-serialized-dashboard/databricks.yml.tmpl
@@ -1,6 +1,12 @@
 bundle:
   name: change-serialized-dashboard-$UNIQUE_NAME
 
+# out.* are test-capture files (recorded requests, state snapshots) written into the bundle
+# root; keep them out of the deploy so they don't perturb the "Files: N uploaded" count.
+sync:
+  exclude:
+    - "out.*"
+
 resources:
   dashboards:
     my_dashboard:
diff --git a/acceptance/bundle/resources/dashboards/change-serialized-dashboard/out.patch.requests.terraform.txt b/acceptance/bundle/resources/dashboards/change-serialized-dashboard/out.patch.requests.terraform.txt
deleted file mode 100644
index f53d8e447c5..00000000000
--- a/acceptance/bundle/resources/dashboards/change-serialized-dashboard/out.patch.requests.terraform.txt
+++ /dev/null
@@ -1,15 +0,0 @@
-{
-  "method": "PATCH",
-  "path": "/api/2.0/lakeview/dashboards/[DASHBOARD_ID]",
-  "body": {
-    "create_time": "[TIMESTAMP]",
-    "dashboard_id": "[DASHBOARD_ID]",
-    "display_name": "test dashboard",
-    "lifecycle_state": "ACTIVE",
-    "parent_path": "/Users/[USERNAME]/.bundle/change-serialized-dashboard-[UNIQUE_NAME]/default/resources",
-    "path": "/Users/[USERNAME]/.bundle/change-serialized-dashboard-[UNIQUE_NAME]/default/resources/test dashboard.lvdash.json",
-    "serialized_dashboard": "{\"pages\":[{\"name\":\"name2\",\"displayName\":\"name2\",\"pageType\":\"PAGE_TYPE_CANVAS\"}]}\n",
-    "update_time": "[TIMESTAMP]",
-    "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
-  }
-}
diff --git a/acceptance/bundle/resources/dashboards/change-serialized-dashboard/out.patch.requests.direct.txt b/acceptance/bundle/resources/dashboards/change-serialized-dashboard/out.patch.requests.txt
similarity index 100%
rename from acceptance/bundle/resources/dashboards/change-serialized-dashboard/out.patch.requests.direct.txt
rename to acceptance/bundle/resources/dashboards/change-serialized-dashboard/out.patch.requests.txt
diff --git a/acceptance/bundle/resources/dashboards/change-serialized-dashboard/out.state.txt b/acceptance/bundle/resources/dashboards/change-serialized-dashboard/out.state.txt
new file mode 100644
index 00000000000..95ff77084b0
--- /dev/null
+++ b/acceptance/bundle/resources/dashboards/change-serialized-dashboard/out.state.txt
@@ -0,0 +1 @@
+json.state.resources.dashboards.my_dashboard.state.serialized_dashboard = "sha256:[HASH]";
diff --git a/acceptance/bundle/resources/dashboards/change-serialized-dashboard/out.state_after_update.txt b/acceptance/bundle/resources/dashboards/change-serialized-dashboard/out.state_after_update.txt
new file mode 100644
index 00000000000..95ff77084b0
--- /dev/null
+++ b/acceptance/bundle/resources/dashboards/change-serialized-dashboard/out.state_after_update.txt
@@ -0,0 +1 @@
+json.state.resources.dashboards.my_dashboard.state.serialized_dashboard = "sha256:[HASH]";
diff --git a/acceptance/bundle/resources/dashboards/change-serialized-dashboard/out.test.toml b/acceptance/bundle/resources/dashboards/change-serialized-dashboard/out.test.toml
index 96be4fdfe9d..7a62f726f25 100644
--- a/acceptance/bundle/resources/dashboards/change-serialized-dashboard/out.test.toml
+++ b/acceptance/bundle/resources/dashboards/change-serialized-dashboard/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
-RequiresWarehouse = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/resources/dashboards/change-serialized-dashboard/output.txt b/acceptance/bundle/resources/dashboards/change-serialized-dashboard/output.txt
index 6b4f7051dca..063d796a32d 100644
--- a/acceptance/bundle/resources/dashboards/change-serialized-dashboard/output.txt
+++ b/acceptance/bundle/resources/dashboards/change-serialized-dashboard/output.txt
@@ -3,14 +3,10 @@
 create dashboards.my_dashboard
 
 Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
-
->>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/change-serialized-dashboard-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> [CLI] lakeview get [DASHBOARD_ID]
+Created dashboards.my_dashboard
+Files: 5 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 {
   "display_name": "test dashboard",
   "lifecycle_state": "ACTIVE",
@@ -18,26 +14,23 @@ Deployment complete!
   "path": "/Users/[USERNAME]/.bundle/change-serialized-dashboard-[UNIQUE_NAME]/default/resources/test dashboard.lvdash.json",
   "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
 }
-
->>> [CLI] lakeview get [DASHBOARD_ID]
 {
   "displayName": "name1",
   "name": "name1",
   "pageType": "PAGE_TYPE_CANVAS"
 }
 
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
 >>> [CLI] bundle plan
 update dashboards.my_dashboard
 
 Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
-
->>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/change-serialized-dashboard-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> [CLI] lakeview get [DASHBOARD_ID]
+Updated dashboards.my_dashboard
+Files: 3 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 {
   "display_name": "test dashboard",
   "lifecycle_state": "ACTIVE",
@@ -45,8 +38,6 @@ Deployment complete!
   "path": "/Users/[USERNAME]/.bundle/change-serialized-dashboard-[UNIQUE_NAME]/default/resources/test dashboard.lvdash.json",
   "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
 }
-
->>> [CLI] lakeview get [DASHBOARD_ID]
 {
   "displayName": "name2",
   "name": "name2",
@@ -59,5 +50,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/change-serialized-dashboard-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/dashboards/change-serialized-dashboard/script b/acceptance/bundle/resources/dashboards/change-serialized-dashboard/script
index 913b497ab46..dd47d279d32 100755
--- a/acceptance/bundle/resources/dashboards/change-serialized-dashboard/script
+++ b/acceptance/bundle/resources/dashboards/change-serialized-dashboard/script
@@ -1,6 +1,11 @@
+# The dashboards test.toml sets MSYS_NO_PATHCONV=1 so the CLI receives unmangled
+# /Users paths; unset it here so Windows Git Bash still converts the .py helper paths
+# (print_state.py, gron.py) it passes to python3. Matches unpublish-out-of-band.
+unset MSYS_NO_PATHCONV
+
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm out.requests.txt
+    rm "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
@@ -9,11 +14,15 @@ deploy_dashboard() {
     envsubst < databricks.yml.tmpl > databricks.yml
     envsubst < dashboard.tmpl > dash.lvdash.json
     trace $CLI bundle plan
-    trace $CLI bundle deploy
+    $CLI bundle plan -o json > tmp.plan.$PAGE_NAME.json
+    $CLI bundle deploy $(readplanarg tmp.plan.$PAGE_NAME.json)
     dashboard_id=$($CLI bundle summary --output json | jq -r '.resources.dashboards.my_dashboard.id')
 
-    trace $CLI lakeview get $dashboard_id | jq '{display_name, lifecycle_state, parent_path, path, warehouse_id}'
-    trace $CLI lakeview get $dashboard_id | jq '.serialized_dashboard | fromjson' | jq -S '.pages[0]'
+    # Wait out eventual consistency: retry until the current page is visible (the read
+    # 404s on create and returns the stale page right after the serialized update).
+    DASHBOARD=$(retry --until "$PAGE_NAME" $CLI lakeview get $dashboard_id)
+    echo "$DASHBOARD" | jq '{display_name, lifecycle_state, parent_path, path, warehouse_id}'
+    echo "$DASHBOARD" | jq '.serialized_dashboard | fromjson' | jq -S '.pages[0]'
 }
 
 # Create the dashboard with initial serialized_dashboard
@@ -22,23 +31,32 @@ deploy_dashboard
 
 # Capture the dashboard ID as a replacement.
 dashboard_id=$($CLI bundle summary --output json | jq -r '.resources.dashboards.my_dashboard.id')
-echo "$dashboard_id:DASHBOARD_ID" >> ACC_REPLS
+add_repl "$dashboard_id" DASHBOARD_ID
+
+# serialized_dashboard is stored in state as a content hash, not the full JSON. The full
+# content still reached the API (out.post.requests.txt) and stays in the plan's new_state.
+print_state.py | gron.py | grep serialized_dashboard > out.state.txt
+
+# No-op re-plan: the hash in state compares equal to the config, so the stored hash does not
+# produce a phantom serialized_dashboard update.
+trace $CLI bundle plan
 
 # Change the serialized_dashboard content - this should trigger an update (not recreate)
 export PAGE_NAME="name2"
 deploy_dashboard
 
+# The edit changes the content, so state holds the new hash.
+print_state.py | gron.py | grep serialized_dashboard > out.state_after_update.txt
+
 # Print API requests made to create parent_path or create / update the dashboard.
-# Terraform serialized OUTPUT_ONLY fields in the request body while direct does not.
-# That's why we write the requests to separate files.
 # Normalize \r\n to \n in the serialized_dashboard field to handle Windows line endings.
-cat out.requests.txt | \
+cat "$OUT_REQUESTS" | \
  jq 'select(.method == "PATCH")' | \
  jq 'select( (.path | contains("/api/2.0/lakeview/dashboards")) or ((.path == "/api/2.0/workspace/mkdirs") and (.body.path | contains("/default/resources"))))' | \
  sed 's/\\r\\n/\\n/g' \
- > out.patch.requests.$DATABRICKS_BUNDLE_ENGINE.txt
+ > out.patch.requests.txt
 
-cat out.requests.txt | \
+cat "$OUT_REQUESTS" | \
  jq 'select(.method == "POST")' | \
  jq 'select( (.path | contains("/api/2.0/lakeview/dashboards")) or ((.path == "/api/2.0/workspace/mkdirs") and (.body.path | contains("/default/resources"))))' | \
  sed 's/\\r\\n/\\n/g' \
diff --git a/acceptance/bundle/resources/dashboards/change-serialized-dashboard/test.toml b/acceptance/bundle/resources/dashboards/change-serialized-dashboard/test.toml
index 1fe7c58f6ac..b4084c98a86 100644
--- a/acceptance/bundle/resources/dashboards/change-serialized-dashboard/test.toml
+++ b/acceptance/bundle/resources/dashboards/change-serialized-dashboard/test.toml
@@ -1,10 +1,15 @@
 Ignore = [
     "databricks.yml",
     "dash.lvdash.json",
+    "tmp.plan.name1.json",
+    "tmp.plan.name2.json",
 ]
 
-[Env]
+# Deploying a saved plan must send the same full serialized_dashboard as an
+# in-memory plan; both variants share the request goldens below.
+EnvMatrix.READPLAN = ["", "1"]
+
 # MSYS2 automatically converts absolute paths like /Users/$username/$UNIQUE_NAME to
 # C:/Program Files/Git/Users/$username/UNIQUE_NAME before passing it to the CLI
 # Setting this environment variable prevents that conversion on windows.
-MSYS_NO_PATHCONV = "1"
+Env.MSYS_NO_PATHCONV = "1"
diff --git a/acceptance/bundle/resources/dashboards/change-serialized-inline/databricks.yml.tmpl b/acceptance/bundle/resources/dashboards/change-serialized-inline/databricks.yml.tmpl
new file mode 100644
index 00000000000..0942aa4f690
--- /dev/null
+++ b/acceptance/bundle/resources/dashboards/change-serialized-inline/databricks.yml.tmpl
@@ -0,0 +1,12 @@
+bundle:
+  name: change-serialized-inline-$UNIQUE_NAME
+
+resources:
+  dashboards:
+    inline_dash:
+      display_name: Inline Dash
+      warehouse_id: $TEST_DEFAULT_WAREHOUSE_ID
+      serialized_dashboard:        # inline YAML MAP = the non-string case
+        pages:
+          - name: page1
+            displayName: Page 1
diff --git a/acceptance/bundle/resources/dashboards/change-serialized-inline/out.plan.json b/acceptance/bundle/resources/dashboards/change-serialized-inline/out.plan.json
new file mode 100644
index 00000000000..f4532ccbb36
--- /dev/null
+++ b/acceptance/bundle/resources/dashboards/change-serialized-inline/out.plan.json
@@ -0,0 +1,74 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.dashboards.inline_dash": {
+      "action": "update",
+      "new_state": {
+        "value": {
+          "display_name": "Inline Dash",
+          "embed_credentials": false,
+          "parent_path": "/Workspace/Users/[USERNAME]/.bundle/change-serialized-inline-[UNIQUE_NAME]/default/resources",
+          "published": true,
+          "serialized_dashboard": "{\"pages\":[{\"displayName\":\"Page One\",\"name\":\"page1\"}]}",
+          "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
+        }
+      },
+      "remote_state": {
+        "create_time": "[TIMESTAMP]",
+        "dashboard_id": "[DASHBOARD_ID]",
+        "display_name": "Inline Dash",
+        "embed_credentials": false,
+        "etag": "80611980",
+        "lifecycle_state": "ACTIVE",
+        "parent_path": "/Workspace/Users/[USERNAME]/.bundle/change-serialized-inline-[UNIQUE_NAME]/default/resources",
+        "path": "/Users/[USERNAME]/.bundle/change-serialized-inline-[UNIQUE_NAME]/default/resources/Inline Dash.lvdash.json",
+        "published": true,
+        "serialized_dashboard": "{\"pages\":[{\"displayName\":\"Page 1\",\"name\":\"page1\",\"pageType\":\"PAGE_TYPE_CANVAS\"}]}\n",
+        "update_time": "[TIMESTAMP]",
+        "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
+      },
+      "changes": {
+        "create_time": {
+          "action": "skip",
+          "reason": "spec:output_only",
+          "remote": "[TIMESTAMP]"
+        },
+        "dashboard_id": {
+          "action": "skip",
+          "reason": "spec:output_only",
+          "remote": "[DASHBOARD_ID]"
+        },
+        "etag": {
+          "action": "skip",
+          "reason": "custom",
+          "old": "80611980",
+          "remote": "80611980"
+        },
+        "lifecycle_state": {
+          "action": "skip",
+          "reason": "spec:output_only",
+          "remote": "ACTIVE"
+        },
+        "path": {
+          "action": "skip",
+          "reason": "spec:output_only",
+          "remote": "/Users/[USERNAME]/.bundle/change-serialized-inline-[UNIQUE_NAME]/default/resources/Inline Dash.lvdash.json"
+        },
+        "serialized_dashboard": {
+          "action": "update",
+          "old": "{\"pages\":[{\"displayName\":\"Page 1\",\"name\":\"page1\"}]}",
+          "new": "{\"pages\":[{\"displayName\":\"Page One\",\"name\":\"page1\"}]}",
+          "remote": "sha256:[HASH]"
+        },
+        "update_time": {
+          "action": "skip",
+          "reason": "spec:output_only",
+          "remote": "[TIMESTAMP]"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/dashboards/change-serialized-inline/out.requests.txt b/acceptance/bundle/resources/dashboards/change-serialized-inline/out.requests.txt
new file mode 100644
index 00000000000..763f6fc22c7
--- /dev/null
+++ b/acceptance/bundle/resources/dashboards/change-serialized-inline/out.requests.txt
@@ -0,0 +1,18 @@
+{
+  "method": "PATCH",
+  "path": "/api/2.0/lakeview/dashboards/[DASHBOARD_ID]",
+  "body": {
+    "display_name": "Inline Dash",
+    "parent_path": "/Workspace/Users/[USERNAME]/.bundle/change-serialized-inline-[UNIQUE_NAME]/default/resources",
+    "serialized_dashboard": "{\"pages\":[{\"displayName\":\"Page One\",\"name\":\"page1\"}]}",
+    "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/lakeview/dashboards/[DASHBOARD_ID]/published",
+  "body": {
+    "embed_credentials": false,
+    "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
+  }
+}
diff --git a/acceptance/bundle/resources/dashboards/change-serialized-inline/out.test.toml b/acceptance/bundle/resources/dashboards/change-serialized-inline/out.test.toml
new file mode 100644
index 00000000000..f7fafbcc731
--- /dev/null
+++ b/acceptance/bundle/resources/dashboards/change-serialized-inline/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/resources/dashboards/change-serialized-inline/output.txt b/acceptance/bundle/resources/dashboards/change-serialized-inline/output.txt
new file mode 100644
index 00000000000..33ec79f8f0e
--- /dev/null
+++ b/acceptance/bundle/resources/dashboards/change-serialized-inline/output.txt
@@ -0,0 +1,27 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/change-serialized-inline-[UNIQUE_NAME]/default/files...
+Created dashboards.inline_dash
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] bundle plan
+update dashboards.inline_dash
+
+Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
+
+>>> [CLI] bundle plan -o json
+
+=== deploy the change
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/change-serialized-inline-[UNIQUE_NAME]/default/files...
+Updated dashboards.inline_dash
+Files: 3 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.dashboards.inline_dash
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/change-serialized-inline-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/dashboards/change-serialized-inline/script b/acceptance/bundle/resources/dashboards/change-serialized-inline/script
new file mode 100644
index 00000000000..f16a2584031
--- /dev/null
+++ b/acceptance/bundle/resources/dashboards/change-serialized-inline/script
@@ -0,0 +1,34 @@
+# Inherited MSYS_NO_PATHCONV breaks bare python helpers on Windows; this test doesn't need it.
+unset MSYS_NO_PATHCONV
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+# Deploy an inline-YAML-map dashboard.
+envsubst < databricks.yml.tmpl > databricks.yml
+trace $CLI bundle deploy
+
+rm "$OUT_REQUESTS"
+
+dashboard_id=$($CLI bundle summary --output json | jq -r '.resources.dashboards.inline_dash.id')
+add_repl "$dashboard_id" DASHBOARD_ID
+
+# Wait out eventual consistency before changing.
+retry --until "Page 1" $CLI lakeview get "$dashboard_id" > /dev/null
+
+update_file.py databricks.yml "Page 1" "Page One"
+
+trace $CLI bundle plan | contains.py "update" "!recreate"
+
+# Save raw plan (with DMS headers) to tmp file for deployment
+trace $CLI bundle plan -o json > plan_raw.json
+# Generate golden file by applying nostamp for comparison (discard output)
+cat plan_raw.json | nostamp > out.plan.json
+
+title "deploy the change\n"
+$CLI bundle deploy $(readplanarg plan_raw.json)
+
+print_requests.py //api/2.0/lakeview/dashboards > out.requests.txt
diff --git a/acceptance/bundle/resources/dashboards/change-serialized-inline/test.toml b/acceptance/bundle/resources/dashboards/change-serialized-inline/test.toml
new file mode 100644
index 00000000000..22538bf7980
--- /dev/null
+++ b/acceptance/bundle/resources/dashboards/change-serialized-inline/test.toml
@@ -0,0 +1,11 @@
+# the real API returns a pretty printed JSON output which causes
+# the test to fail, since we are testing CLI only feature, we can set to
+# Cloud = true
+Cloud = false
+
+Ignore = [
+    "databricks.yml",
+    "plan_raw.json",
+]
+
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/resources/dashboards/dataset-catalog-schema/out.plan.direct.json b/acceptance/bundle/resources/dashboards/dataset-catalog-schema/out.plan.direct.json
deleted file mode 100644
index dd36d61502f..00000000000
--- a/acceptance/bundle/resources/dashboards/dataset-catalog-schema/out.plan.direct.json
+++ /dev/null
@@ -1,50 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.dashboards.dashboard1": {
-      "action": "skip",
-      "remote_state": {
-        "create_time": "[TIMESTAMP]",
-        "dashboard_id": "[DASHBOARD_ID]",
-        "display_name": "test bundle-deploy-dashboard-dataset [UUID]",
-        "embed_credentials": true,
-        "etag": [ETAG],
-        "lifecycle_state": "ACTIVE",
-        "parent_path": "/Workspace/Users/[USERNAME]",
-        "path": "/Users/[USERNAME]/test bundle-deploy-dashboard-dataset [UUID].lvdash.json",
-        "published": true,
-        "serialized_dashboard": "[SERIALIZED_FIXTURE]",
-        "update_time": "[TIMESTAMP]",
-        "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
-      },
-      "changes": {
-        "dataset_catalog": {
-          "action": "skip",
-          "reason": "input_only",
-          "old": "main",
-          "new": "main"
-        },
-        "dataset_schema": {
-          "action": "skip",
-          "reason": "input_only",
-          "old": "default",
-          "new": "default"
-        },
-        "etag": {
-          "action": "skip",
-          "reason": "custom",
-          "old": [ETAG],
-          "remote": [ETAG]
-        },
-        "serialized_dashboard": {
-          "action": "skip",
-          "old": "[SERIALIZED_FIXTURE_OLD]",
-          "new": "[SERIALIZED_FIXTURE_NEW]"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/dashboards/dataset-catalog-schema/out.plan.json b/acceptance/bundle/resources/dashboards/dataset-catalog-schema/out.plan.json
new file mode 100644
index 00000000000..fa0567e471e
--- /dev/null
+++ b/acceptance/bundle/resources/dashboards/dataset-catalog-schema/out.plan.json
@@ -0,0 +1,75 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.dashboards.dashboard1": {
+      "action": "skip",
+      "remote_state": {
+        "create_time": "[TIMESTAMP]",
+        "dashboard_id": "[DASHBOARD_ID]",
+        "display_name": "test bundle-deploy-dashboard-dataset [UUID]",
+        "embed_credentials": true,
+        "etag": "[ETAG]",
+        "lifecycle_state": "ACTIVE",
+        "parent_path": "/Workspace/Users/[USERNAME]",
+        "path": "/Users/[USERNAME]/test bundle-deploy-dashboard-dataset [UUID].lvdash.json",
+        "published": true,
+        "serialized_dashboard": "[SERIALIZED_FIXTURE]",
+        "update_time": "[TIMESTAMP]",
+        "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
+      },
+      "changes": {
+        "create_time": {
+          "action": "skip",
+          "reason": "spec:output_only",
+          "remote": "[TIMESTAMP]"
+        },
+        "dashboard_id": {
+          "action": "skip",
+          "reason": "spec:output_only",
+          "remote": "[DASHBOARD_ID]"
+        },
+        "dataset_catalog": {
+          "action": "skip",
+          "reason": "input_only",
+          "old": "main",
+          "new": "main"
+        },
+        "dataset_schema": {
+          "action": "skip",
+          "reason": "input_only",
+          "old": "default",
+          "new": "default"
+        },
+        "etag": {
+          "action": "skip",
+          "reason": "custom",
+          "old": "[ETAG]",
+          "remote": "[ETAG]"
+        },
+        "lifecycle_state": {
+          "action": "skip",
+          "reason": "spec:output_only",
+          "remote": "ACTIVE"
+        },
+        "path": {
+          "action": "skip",
+          "reason": "spec:output_only",
+          "remote": "/Users/[USERNAME]/test bundle-deploy-dashboard-dataset [UUID].lvdash.json"
+        },
+        "serialized_dashboard": {
+          "action": "skip",
+          "old": "[SERIALIZED_FIXTURE_OLD]",
+          "new": "[SERIALIZED_FIXTURE_NEW]"
+        },
+        "update_time": {
+          "action": "skip",
+          "reason": "spec:output_only",
+          "remote": "[TIMESTAMP]"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/dashboards/dataset-catalog-schema/out.plan.terraform.json b/acceptance/bundle/resources/dashboards/dataset-catalog-schema/out.plan.terraform.json
deleted file mode 100644
index 01caf158011..00000000000
--- a/acceptance/bundle/resources/dashboards/dataset-catalog-schema/out.plan.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.dashboards.dashboard1": {
-      "action": "skip"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/dashboards/dataset-catalog-schema/out.post.requests.terraform.txt b/acceptance/bundle/resources/dashboards/dataset-catalog-schema/out.post.requests.terraform.txt
deleted file mode 100644
index 49f54fb76f6..00000000000
--- a/acceptance/bundle/resources/dashboards/dataset-catalog-schema/out.post.requests.terraform.txt
+++ /dev/null
@@ -1,14 +0,0 @@
-{
-  "method": "POST",
-  "path": "/api/2.0/lakeview/dashboards",
-  "q": {
-    "dataset_catalog": "main",
-    "dataset_schema": "default"
-  },
-  "body": {
-    "display_name": "test bundle-deploy-dashboard-dataset [UUID]",
-    "parent_path": "/Workspace/Users/[USERNAME]",
-    "serialized_dashboard": "{\n  \"pages\": [\n    {\n      \"name\": \"test_page\",\n      \"displayName\": \"Test Page\",\n      \"pageType\": \"PAGE_TYPE_CANVAS\"\n    }\n  ],\n  \"datasets\": [\n    {\n      \"name\": \"bf8f76f4\",\n      \"displayName\": \"Test Dataset\",\n      \"queryLines\": [\n        \"SELECT 1\\n\"\n      ],\n      \"catalog\": \"foobar\",\n      \"schema\": \"foobar\"\n    }\n  ]\n}\n",
-    "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
-  }
-}
diff --git a/acceptance/bundle/resources/dashboards/dataset-catalog-schema/out.post.requests.direct.txt b/acceptance/bundle/resources/dashboards/dataset-catalog-schema/out.post.requests.txt
similarity index 100%
rename from acceptance/bundle/resources/dashboards/dataset-catalog-schema/out.post.requests.direct.txt
rename to acceptance/bundle/resources/dashboards/dataset-catalog-schema/out.post.requests.txt
diff --git a/acceptance/bundle/resources/dashboards/dataset-catalog-schema/out.test.toml b/acceptance/bundle/resources/dashboards/dataset-catalog-schema/out.test.toml
index c2ac722e76a..0f167effef1 100644
--- a/acceptance/bundle/resources/dashboards/dataset-catalog-schema/out.test.toml
+++ b/acceptance/bundle/resources/dashboards/dataset-catalog-schema/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = true
-RequiresWarehouse = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/dashboards/dataset-catalog-schema/output.txt b/acceptance/bundle/resources/dashboards/dataset-catalog-schema/output.txt
index 4c7aa9d4903..01bc32268ae 100644
--- a/acceptance/bundle/resources/dashboards/dataset-catalog-schema/output.txt
+++ b/acceptance/bundle/resources/dashboards/dataset-catalog-schema/output.txt
@@ -1,18 +1,14 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-dashboard-dataset-test-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> [CLI] lakeview get [DASHBOARD_ID]
+Created dashboards.dashboard1
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 {
   "lifecycle_state": "ACTIVE",
   "parent_path": "/Users/[USERNAME]",
   "path": "/Users/[USERNAME]/test bundle-deploy-dashboard-dataset [UUID].lvdash.json"
 }
-
->>> [CLI] lakeview get [DASHBOARD_ID]
 {
   "catalog": "main",
   "schema": "default"
@@ -26,5 +22,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-dashboard-dataset-test-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/dashboards/dataset-catalog-schema/script b/acceptance/bundle/resources/dashboards/dataset-catalog-schema/script
index e4c6e6dfec7..07ad17aa69c 100755
--- a/acceptance/bundle/resources/dashboards/dataset-catalog-schema/script
+++ b/acceptance/bundle/resources/dashboards/dataset-catalog-schema/script
@@ -2,7 +2,7 @@
 DASHBOARD_DISPLAY_NAME="test bundle-deploy-dashboard-dataset $(uuid)"
 if [ -z "$CLOUD_ENV" ]; then
     export TEST_DEFAULT_WAREHOUSE_ID="warehouse-1234"
-    echo "warehouse-1234:TEST_DEFAULT_WAREHOUSE_ID" >> ACC_REPLS
+    add_repl "warehouse-1234" TEST_DEFAULT_WAREHOUSE_ID
 fi
 
 export DASHBOARD_DISPLAY_NAME
@@ -10,7 +10,7 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm -f out.requests.txt
+    rm -f "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
@@ -18,32 +18,34 @@ trace $CLI bundle deploy
 DASHBOARD_ID=$($CLI bundle summary --output json | jq -r '.resources.dashboards.dashboard1.id')
 
 # Capture the dashboard ID as a replacement.
-echo "$DASHBOARD_ID:DASHBOARD_ID" >> ACC_REPLS
+add_repl "$DASHBOARD_ID" DASHBOARD_ID
+DASHBOARD=$(retry $CLI lakeview get $DASHBOARD_ID)
+add_repl "$(echo "$DASHBOARD" | jq -r '.etag')" ETAG
 
-trace $CLI lakeview get $DASHBOARD_ID | jq '{lifecycle_state, parent_path, path}'
+echo "$DASHBOARD" | jq '{lifecycle_state, parent_path, path}'
 
 # Verify that the serialized_dashboard datasets have the overridden catalog/schema values.
 # The dataset_catalog and dataset_schema parameters should override the values in the datasets.
-trace $CLI lakeview get $DASHBOARD_ID | jq '.serialized_dashboard | fromjson | .datasets[] | {catalog, schema}'
+echo "$DASHBOARD" | jq '.serialized_dashboard | fromjson | .datasets[] | {catalog, schema}'
 
 # Verify that there is no drift right after deploy.
-trace $CLI bundle plan -o json > out.plan.$DATABRICKS_BUNDLE_ENGINE.json
+# Save raw plan (with DMS headers), then apply nostamp for golden file
+trace $CLI bundle plan -o json > plan_raw.json
+cat plan_raw.json | nostamp > out.plan.json
 
-# Modify the direct plan to replace "serialized_dashboard" with a fixture.
+# Modify the plan to replace "serialized_dashboard" with a fixture.
 # It is normalized on the backend so we cannot compare reliably across local and cloud.
-if [ "$DATABRICKS_BUNDLE_ENGINE" = "direct" ]; then
-    jq '.plan["resources.dashboards.dashboard1"].remote_state.serialized_dashboard |=
-       if . then "[SERIALIZED_FIXTURE]" else . end' \
-       out.plan.direct.json > out.plan.direct.json.tmp && mv out.plan.direct.json.tmp out.plan.direct.json
-    jq '.plan["resources.dashboards.dashboard1"].changes.serialized_dashboard |=
-       if . then {"action": .action, "old": "[SERIALIZED_FIXTURE_OLD]", "new": "[SERIALIZED_FIXTURE_NEW]"} else . end' \
-       out.plan.direct.json > out.plan.direct.json.tmp && mv out.plan.direct.json.tmp out.plan.direct.json
-fi
+jq '.plan["resources.dashboards.dashboard1"].remote_state.serialized_dashboard |=
+   if . then "[SERIALIZED_FIXTURE]" else . end' \
+   out.plan.json > out.plan.json.tmp && mv out.plan.json.tmp out.plan.json
+jq '.plan["resources.dashboards.dashboard1"].changes.serialized_dashboard |=
+   if . then {"action": .action, "old": "[SERIALIZED_FIXTURE_OLD]", "new": "[SERIALIZED_FIXTURE_NEW]"} else . end' \
+   out.plan.json > out.plan.json.tmp && mv out.plan.json.tmp out.plan.json
 
 # Print API requests made to create the dashboard.
 # This verifies that dataset_catalog and dataset_schema are passed to the API.
-cat out.requests.txt | \
+cat "$OUT_REQUESTS" | \
  jq 'select(.method == "POST")' | \
  jq 'select(.path | contains("/api/2.0/lakeview/dashboards"))' | \
  jq 'select(.path | contains("/published") | not)' \
- > out.post.requests.$DATABRICKS_BUNDLE_ENGINE.txt
+ > out.post.requests.txt
diff --git a/acceptance/bundle/resources/dashboards/dataset-catalog-schema/test.toml b/acceptance/bundle/resources/dashboards/dataset-catalog-schema/test.toml
index effbc209925..8100cbef11e 100644
--- a/acceptance/bundle/resources/dashboards/dataset-catalog-schema/test.toml
+++ b/acceptance/bundle/resources/dashboards/dataset-catalog-schema/test.toml
@@ -1,7 +1,6 @@
-Local = true
 Cloud = true
-RequiresWarehouse = true
 RecordRequests = true
 
-[EnvMatrix]
-  DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+Ignore = [
+    "plan_raw.json",
+]
diff --git a/acceptance/bundle/resources/dashboards/delete-trashed-out-of-band/out.plan.direct.json b/acceptance/bundle/resources/dashboards/delete-trashed-out-of-band/out.plan.direct.json
deleted file mode 100644
index dcc05760f7a..00000000000
--- a/acceptance/bundle/resources/dashboards/delete-trashed-out-of-band/out.plan.direct.json
+++ /dev/null
@@ -1,28 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.dashboards.dashboard1": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "display_name": "test bundle-deploy-dashboard [UNIQUE_NAME])",
-          "embed_credentials": false,
-          "parent_path": "/Workspace/Users/[USERNAME]/.bundle/delete-trashed-out-of-band-[UNIQUE_NAME]/default/resources",
-          "published": true,
-          "serialized_dashboard": "{\"pages\":[{\"name\":\"test-page\",\"displayName\":\"Test Dashboard\"}]}\n",
-          "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
-        }
-      },
-      "changes": {
-        "etag": {
-          "action": "update",
-          "reason": "custom",
-          "old": [ETAG]
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/dashboards/delete-trashed-out-of-band/out.plan.json b/acceptance/bundle/resources/dashboards/delete-trashed-out-of-band/out.plan.json
new file mode 100644
index 00000000000..a2e342108ae
--- /dev/null
+++ b/acceptance/bundle/resources/dashboards/delete-trashed-out-of-band/out.plan.json
@@ -0,0 +1,28 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.dashboards.dashboard1": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "display_name": "test bundle-deploy-dashboard [UNIQUE_NAME])",
+          "embed_credentials": false,
+          "parent_path": "/Workspace/Users/[USERNAME]/.bundle/delete-trashed-out-of-band-[UNIQUE_NAME]/default/resources",
+          "published": true,
+          "serialized_dashboard": "{\"pages\":[{\"name\":\"test-page\",\"displayName\":\"Test Dashboard\"}]}\n",
+          "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
+        }
+      },
+      "changes": {
+        "etag": {
+          "action": "update",
+          "reason": "custom",
+          "old": "[ETAG]"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/dashboards/delete-trashed-out-of-band/out.plan.terraform.json b/acceptance/bundle/resources/dashboards/delete-trashed-out-of-band/out.plan.terraform.json
deleted file mode 100644
index 9ca4538b727..00000000000
--- a/acceptance/bundle/resources/dashboards/delete-trashed-out-of-band/out.plan.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.dashboards.dashboard1": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/dashboards/delete-trashed-out-of-band/out.test.toml b/acceptance/bundle/resources/dashboards/delete-trashed-out-of-band/out.test.toml
index 7edd52865f7..98ccab9aaeb 100644
--- a/acceptance/bundle/resources/dashboards/delete-trashed-out-of-band/out.test.toml
+++ b/acceptance/bundle/resources/dashboards/delete-trashed-out-of-band/out.test.toml
@@ -1,5 +1,3 @@
-Local = true
 Cloud = true
-RequiresWarehouse = true
 RunsOnDbr = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/dashboards/delete-trashed-out-of-band/output.txt b/acceptance/bundle/resources/dashboards/delete-trashed-out-of-band/output.txt
index 1511a1c1187..00d1b86e91a 100644
--- a/acceptance/bundle/resources/dashboards/delete-trashed-out-of-band/output.txt
+++ b/acceptance/bundle/resources/dashboards/delete-trashed-out-of-band/output.txt
@@ -1,11 +1,9 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/delete-trashed-out-of-band-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> [CLI] lakeview get [DASHBOARD_ID]
+Created dashboards.dashboard1
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 {
   "lifecycle_state": "ACTIVE",
   "parent_path": "/Users/[USERNAME]/.bundle/delete-trashed-out-of-band-[UNIQUE_NAME]/default/resources"
@@ -20,8 +18,4 @@ Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle plan -o json
 
->>> [CLI] bundle destroy --auto-approve
-All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/delete-trashed-out-of-band-[UNIQUE_NAME]/default
-
-Deleting files...
-Destroy complete!
+>>> [CLI] bundle destroy --auto-approve -qq
diff --git a/acceptance/bundle/resources/dashboards/delete-trashed-out-of-band/script b/acceptance/bundle/resources/dashboards/delete-trashed-out-of-band/script
index 0868adbc13b..dae7cb2f68d 100755
--- a/acceptance/bundle/resources/dashboards/delete-trashed-out-of-band/script
+++ b/acceptance/bundle/resources/dashboards/delete-trashed-out-of-band/script
@@ -2,7 +2,7 @@ export DASHBOARD_DISPLAY_NAME="test bundle-deploy-dashboard $UNIQUE_NAME)"
 
 if [ -z "$CLOUD_ENV" ]; then
     export TEST_DEFAULT_WAREHOUSE_ID="warehouse-1234"
-    echo "warehouse-1234:TEST_DEFAULT_WAREHOUSE_ID" >> ACC_REPLS
+    add_repl "warehouse-1234" TEST_DEFAULT_WAREHOUSE_ID
 fi
 
 envsubst < databricks.yml.tmpl > databricks.yml
@@ -12,10 +12,12 @@ trace $CLI bundle deploy
 DASHBOARD_ID=$($CLI bundle summary --output json | jq -r '.resources.dashboards.dashboard1.id')
 
 # Capture the dashboard ID as a replacement.
-echo "$DASHBOARD_ID:DASHBOARD_ID" >> ACC_REPLS
+add_repl "$DASHBOARD_ID" DASHBOARD_ID
+DASHBOARD=$(retry $CLI lakeview get $DASHBOARD_ID)
+add_repl "$(echo "$DASHBOARD" | jq -r '.etag')" ETAG
 
 # Verify dashboard was deployed
-trace $CLI lakeview get $DASHBOARD_ID | jq '{lifecycle_state, parent_path}'
+echo "$DASHBOARD" | jq '{lifecycle_state, parent_path}'
 
 # Trash the dashboard out of band (simulating external deletion)
 # This should succeed
@@ -23,7 +25,11 @@ trace $CLI lakeview trash $DASHBOARD_ID
 
 trace $CLI bundle plan
 
-trace $CLI bundle plan -o json > out.plan.$DATABRICKS_BUNDLE_ENGINE.json
+# Save raw plan (with DMS headers), then apply nostamp for golden file
+trace $CLI bundle plan -o json > plan_raw.json
+cat plan_raw.json | nostamp > out.plan.json
 
-# Run destroy - should succeed even though dashboard is already trashed
-trace $CLI bundle destroy --auto-approve
+# Run destroy - should succeed even though dashboard is already trashed.
+# -qq drops the summary: terraform refreshes the trashed dashboard away and reports
+# "0 deleted" while direct still counts it as "1 deleted".
+trace $CLI bundle destroy --auto-approve -qq
diff --git a/acceptance/bundle/resources/dashboards/delete-trashed-out-of-band/test.toml b/acceptance/bundle/resources/dashboards/delete-trashed-out-of-band/test.toml
index 819b4103890..7163006b17c 100644
--- a/acceptance/bundle/resources/dashboards/delete-trashed-out-of-band/test.toml
+++ b/acceptance/bundle/resources/dashboards/delete-trashed-out-of-band/test.toml
@@ -1,9 +1,8 @@
-Local = true
 Cloud = true
-RequiresWarehouse = true
 RecordRequests = false
 RunsOnDbr = true
 
 Ignore = [
     "databricks.yml",
+    "plan_raw.json",
 ]
diff --git a/acceptance/bundle/resources/dashboards/destroy/out.test.toml b/acceptance/bundle/resources/dashboards/destroy/out.test.toml
index 7edd52865f7..98ccab9aaeb 100644
--- a/acceptance/bundle/resources/dashboards/destroy/out.test.toml
+++ b/acceptance/bundle/resources/dashboards/destroy/out.test.toml
@@ -1,5 +1,3 @@
-Local = true
 Cloud = true
-RequiresWarehouse = true
 RunsOnDbr = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/dashboards/destroy/output.txt b/acceptance/bundle/resources/dashboards/destroy/output.txt
index 8a8d8889a99..1adb1056d1c 100644
--- a/acceptance/bundle/resources/dashboards/destroy/output.txt
+++ b/acceptance/bundle/resources/dashboards/destroy/output.txt
@@ -1,11 +1,11 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/destroy-dashboard-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created dashboards.dashboard1
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
->>> [CLI] lakeview get [DASHBOARD_ID]
+>>> retry [CLI] lakeview get [DASHBOARD_ID]
 {
   "lifecycle_state": "ACTIVE",
   "parent_path": "/Users/[USERNAME]/.bundle/destroy-dashboard-[UNIQUE_NAME]/default/resources"
@@ -17,8 +17,7 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/destroy-dashboard-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
 
 >>> [CLI] lakeview get [DASHBOARD_ID]
 {
diff --git a/acceptance/bundle/resources/dashboards/destroy/script b/acceptance/bundle/resources/dashboards/destroy/script
index 04a7a66fe9a..e0419b0507e 100755
--- a/acceptance/bundle/resources/dashboards/destroy/script
+++ b/acceptance/bundle/resources/dashboards/destroy/script
@@ -11,10 +11,10 @@ trace $CLI bundle deploy
 DASHBOARD_ID=$($CLI bundle summary --output json | jq -r '.resources.dashboards.dashboard1.id')
 
 # Capture the dashboard ID as a replacement.
-echo "$DASHBOARD_ID:DASHBOARD_ID" >> ACC_REPLS
+add_repl "$DASHBOARD_ID" DASHBOARD_ID
 
 # Verify dashboard was deployed
-trace $CLI lakeview get $DASHBOARD_ID | jq '{lifecycle_state, parent_path}'
+trace retry $CLI lakeview get $DASHBOARD_ID | jq '{lifecycle_state, parent_path}'
 
 trace $CLI bundle destroy --auto-approve
 
diff --git a/acceptance/bundle/resources/dashboards/destroy/test.toml b/acceptance/bundle/resources/dashboards/destroy/test.toml
index 819b4103890..4d77b7783c8 100644
--- a/acceptance/bundle/resources/dashboards/destroy/test.toml
+++ b/acceptance/bundle/resources/dashboards/destroy/test.toml
@@ -1,6 +1,4 @@
-Local = true
 Cloud = true
-RequiresWarehouse = true
 RecordRequests = false
 RunsOnDbr = true
 
diff --git a/acceptance/bundle/resources/dashboards/detect-change/out.patch.requests.terraform.txt b/acceptance/bundle/resources/dashboards/detect-change/out.patch.requests.terraform.txt
deleted file mode 100644
index 65c491ab301..00000000000
--- a/acceptance/bundle/resources/dashboards/detect-change/out.patch.requests.terraform.txt
+++ /dev/null
@@ -1,23 +0,0 @@
-{
-  "method": "PATCH",
-  "path": "/api/2.0/lakeview/dashboards/[DASHBOARD_ID]",
-  "body": {
-    "serialized_dashboard": "{}",
-    "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
-  }
-}
-{
-  "method": "PATCH",
-  "path": "/api/2.0/lakeview/dashboards/[DASHBOARD_ID]",
-  "body": {
-    "create_time": "[TIMESTAMP]",
-    "dashboard_id": "[DASHBOARD_ID]",
-    "display_name": "test-dashboard-[UNIQUE_NAME]",
-    "lifecycle_state": "ACTIVE",
-    "parent_path": "/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/resources",
-    "path": "/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/resources/test-dashboard-[UNIQUE_NAME].lvdash.json",
-    "serialized_dashboard": "{\n  \"pages\": [\n    {\n      \"displayName\": \"New Page\",\n      \"layout\": [\n        {\n          \"position\": {\n            \"height\": 2,\n            \"width\": 6,\n            \"x\": 0,\n            \"y\": 0\n          },\n          \"widget\": {\n            \"name\": \"82eb9107\",\n            \"textbox_spec\": \"# I'm a title\"\n          }\n        },\n        {\n          \"position\": {\n            \"height\": 2,\n            \"width\": 6,\n            \"x\": 0,\n            \"y\": 2\n          },\n          \"widget\": {\n            \"name\": \"ffa6de4f\",\n            \"textbox_spec\": \"Text\"\n          }\n        }\n      ],\n      \"name\": \"fdd21a3c\"\n    }\n  ]\n}\n",
-    "update_time": "[TIMESTAMP]",
-    "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
-  }
-}
diff --git a/acceptance/bundle/resources/dashboards/detect-change/out.patch.requests.direct.txt b/acceptance/bundle/resources/dashboards/detect-change/out.patch.requests.txt
similarity index 100%
rename from acceptance/bundle/resources/dashboards/detect-change/out.patch.requests.direct.txt
rename to acceptance/bundle/resources/dashboards/detect-change/out.patch.requests.txt
diff --git a/acceptance/bundle/resources/dashboards/detect-change/out.plan.direct.json b/acceptance/bundle/resources/dashboards/detect-change/out.plan.direct.json
deleted file mode 100644
index 7af15357c25..00000000000
--- a/acceptance/bundle/resources/dashboards/detect-change/out.plan.direct.json
+++ /dev/null
@@ -1,49 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.dashboards.file_reference": {
-      "action": "update",
-      "new_state": {
-        "value": {
-          "display_name": "test-dashboard-[UNIQUE_NAME]",
-          "embed_credentials": false,
-          "parent_path": "/Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/resources",
-          "published": true,
-          "serialized_dashboard": "{\n  \"pages\": [\n    {\n      \"displayName\": \"New Page\",\n      \"layout\": [\n        {\n          \"position\": {\n            \"height\": 2,\n            \"width\": 6,\n            \"x\": 0,\n            \"y\": 0\n          },\n          \"widget\": {\n            \"name\": \"82eb9107\",\n            \"textbox_spec\": \"# I'm a title\"\n          }\n        },\n        {\n          \"position\": {\n            \"height\": 2,\n            \"width\": 6,\n            \"x\": 0,\n            \"y\": 2\n          },\n          \"widget\": {\n            \"name\": \"ffa6de4f\",\n            \"textbox_spec\": \"Text\"\n          }\n        }\n      ],\n      \"name\": \"fdd21a3c\"\n    }\n  ]\n}\n",
-          "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
-        }
-      },
-      "remote_state": {
-        "create_time": "[TIMESTAMP]",
-        "dashboard_id": "[DASHBOARD_ID]",
-        "display_name": "test-dashboard-[UNIQUE_NAME]",
-        "embed_credentials": false,
-        "etag": [ETAG],
-        "lifecycle_state": "ACTIVE",
-        "parent_path": "/Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/resources",
-        "path": "/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/resources/test-dashboard-[UNIQUE_NAME].lvdash.json",
-        "published": true,
-        "serialized_dashboard": "{}\n",
-        "update_time": "[TIMESTAMP]",
-        "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
-      },
-      "changes": {
-        "etag": {
-          "action": "update",
-          "old": [ETAG],
-          "remote": [ETAG]
-        },
-        "serialized_dashboard": {
-          "action": "skip",
-          "reason": "etag_based",
-          "old": "{\n  \"pages\": [\n    {\n      \"displayName\": \"New Page\",\n      \"layout\": [\n        {\n          \"position\": {\n            \"height\": 2,\n            \"width\": 6,\n            \"x\": 0,\n            \"y\": 0\n          },\n          \"widget\": {\n            \"name\": \"82eb9107\",\n            \"textbox_spec\": \"# I'm a title\"\n          }\n        },\n        {\n          \"position\": {\n            \"height\": 2,\n            \"width\": 6,\n            \"x\": 0,\n            \"y\": 2\n          },\n          \"widget\": {\n            \"name\": \"ffa6de4f\",\n            \"textbox_spec\": \"Text\"\n          }\n        }\n      ],\n      \"name\": \"fdd21a3c\"\n    }\n  ]\n}\n",
-          "new": "{\n  \"pages\": [\n    {\n      \"displayName\": \"New Page\",\n      \"layout\": [\n        {\n          \"position\": {\n            \"height\": 2,\n            \"width\": 6,\n            \"x\": 0,\n            \"y\": 0\n          },\n          \"widget\": {\n            \"name\": \"82eb9107\",\n            \"textbox_spec\": \"# I'm a title\"\n          }\n        },\n        {\n          \"position\": {\n            \"height\": 2,\n            \"width\": 6,\n            \"x\": 0,\n            \"y\": 2\n          },\n          \"widget\": {\n            \"name\": \"ffa6de4f\",\n            \"textbox_spec\": \"Text\"\n          }\n        }\n      ],\n      \"name\": \"fdd21a3c\"\n    }\n  ]\n}\n",
-          "remote": "{}\n"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/dashboards/detect-change/out.plan.json b/acceptance/bundle/resources/dashboards/detect-change/out.plan.json
new file mode 100644
index 00000000000..74462c9c567
--- /dev/null
+++ b/acceptance/bundle/resources/dashboards/detect-change/out.plan.json
@@ -0,0 +1,80 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.dashboards.file_reference": {
+      "action": "update",
+      "new_state": {
+        "value": {
+          "display_name": "test-dashboard-[UNIQUE_NAME]",
+          "embed_credentials": false,
+          "parent_path": "/Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/resources",
+          "published": true,
+          "serialized_dashboard": "{\n  \"pages\": [\n    {\n      \"displayName\": \"New Page\",\n      \"layout\": [\n        {\n          \"position\": {\n            \"height\": 2,\n            \"width\": 6,\n            \"x\": 0,\n            \"y\": 0\n          },\n          \"widget\": {\n            \"name\": \"82eb9107\",\n            \"textbox_spec\": \"# I'm a title\"\n          }\n        },\n        {\n          \"position\": {\n            \"height\": 2,\n            \"width\": 6,\n            \"x\": 0,\n            \"y\": 2\n          },\n          \"widget\": {\n            \"name\": \"ffa6de4f\",\n            \"textbox_spec\": \"Text\"\n          }\n        }\n      ],\n      \"name\": \"fdd21a3c\"\n    }\n  ]\n}\n",
+          "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
+        }
+      },
+      "remote_state": {
+        "create_time": "[TIMESTAMP]",
+        "dashboard_id": "[DASHBOARD_ID]",
+        "display_name": "test-dashboard-[UNIQUE_NAME]",
+        "embed_credentials": false,
+        "etag": "[ETAG_2]",
+        "lifecycle_state": "ACTIVE",
+        "parent_path": "/Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/resources",
+        "path": "/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/resources/test-dashboard-[UNIQUE_NAME].lvdash.json",
+        "published": false,
+        "serialized_dashboard": "{}\n",
+        "update_time": "[TIMESTAMP]",
+        "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
+      },
+      "changes": {
+        "create_time": {
+          "action": "skip",
+          "reason": "spec:output_only",
+          "remote": "[TIMESTAMP]"
+        },
+        "dashboard_id": {
+          "action": "skip",
+          "reason": "spec:output_only",
+          "remote": "[DASHBOARD_ID]"
+        },
+        "etag": {
+          "action": "update",
+          "old": "[ETAG_1]",
+          "remote": "[ETAG_2]"
+        },
+        "lifecycle_state": {
+          "action": "skip",
+          "reason": "spec:output_only",
+          "remote": "ACTIVE"
+        },
+        "path": {
+          "action": "skip",
+          "reason": "spec:output_only",
+          "remote": "/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/resources/test-dashboard-[UNIQUE_NAME].lvdash.json"
+        },
+        "published": {
+          "action": "update",
+          "old": true,
+          "new": true,
+          "remote": false
+        },
+        "serialized_dashboard": {
+          "action": "skip",
+          "reason": "etag_based",
+          "old": "sha256:[HASH][0]",
+          "new": "sha256:[HASH][0]",
+          "remote": "{}\n"
+        },
+        "update_time": {
+          "action": "skip",
+          "reason": "spec:output_only",
+          "remote": "[TIMESTAMP]"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/dashboards/detect-change/out.plan.terraform.json b/acceptance/bundle/resources/dashboards/detect-change/out.plan.terraform.json
deleted file mode 100644
index abf511c6a86..00000000000
--- a/acceptance/bundle/resources/dashboards/detect-change/out.plan.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.dashboards.file_reference": {
-      "action": "update"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/dashboards/detect-change/out.test.toml b/acceptance/bundle/resources/dashboards/detect-change/out.test.toml
index 96be4fdfe9d..0f167effef1 100644
--- a/acceptance/bundle/resources/dashboards/detect-change/out.test.toml
+++ b/acceptance/bundle/resources/dashboards/detect-change/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = true
-RequiresWarehouse = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/dashboards/detect-change/output.txt b/acceptance/bundle/resources/dashboards/detect-change/output.txt
index 53179be5169..06d6548f11e 100644
--- a/acceptance/bundle/resources/dashboards/detect-change/output.txt
+++ b/acceptance/bundle/resources/dashboards/detect-change/output.txt
@@ -12,9 +12,9 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created dashboards.file_reference
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 === Assert that the dashboard exists at the expected path and is, indeed, a dashboard:
 >>> [CLI] workspace get-status /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/resources/test-dashboard-[UNIQUE_NAME].lvdash.json
@@ -30,7 +30,7 @@ Deployment complete!
 {
   "display_name": "test-dashboard-[UNIQUE_NAME]",
   "embed_credentials": false,
-  "etag": [ETAG],
+  "etag": "[ETAG_1]",
   "file_path": "dashboard.lvdash.json",
   "id": "[DASHBOARD_ID]",
   "parent_path": "/Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/resources",
@@ -60,7 +60,8 @@ These modifications are untracked and will be overwritten on deploy.
 Make sure that the local dashboard definition matches what you intend to deploy
 before proceeding with the deployment.
 
-Run `databricks bundle deploy --force` to bypass this error.
+To overwrite the remote changes with your local version, use --force.
+The remote modifications will be lost.
 
 update dashboards.file_reference
 
@@ -77,7 +78,8 @@ These modifications are untracked and will be overwritten on deploy.
 Make sure that the local dashboard definition matches what you intend to deploy
 before proceeding with the deployment.
 
-Run `databricks bundle deploy --force` to bypass this error.
+To overwrite the remote changes with your local version, use --force.
+The remote modifications will be lost.
 
 
 >>> errcode [CLI] bundle deploy
@@ -91,7 +93,8 @@ These modifications are untracked and will be overwritten on deploy.
 Make sure that the local dashboard definition matches what you intend to deploy
 before proceeding with the deployment.
 
-Run `databricks bundle deploy --force` to bypass this error.
+To overwrite the remote changes with your local version, use --force.
+The remote modifications will be lost.
 
 
 Exit code: 1
@@ -99,9 +102,9 @@ Exit code: 1
 === Redeploy the bundle with the --force flag and confirm that the out of band modification is ignored:
 >>> errcode [CLI] bundle deploy --force
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated dashboards.file_reference
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
@@ -109,5 +112,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/dashboards/detect-change/script b/acceptance/bundle/resources/dashboards/detect-change/script
index ccf26142303..cdc1d201a15 100644
--- a/acceptance/bundle/resources/dashboards/detect-change/script
+++ b/acceptance/bundle/resources/dashboards/detect-change/script
@@ -2,7 +2,7 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm out.requests.txt
+    rm "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
@@ -21,20 +21,26 @@ trace cat out.summary.json
 DASHBOARD_ID=$(jq -r '.id' out.summary.json)
 
 # Capture the dashboard ID as a replacement.
-echo "$DASHBOARD_ID:DASHBOARD_ID" >> ACC_REPLS
+add_repl "$DASHBOARD_ID" DASHBOARD_ID
+DASHBOARD=$(retry $CLI lakeview get "$DASHBOARD_ID")
+add_repl "$(echo "$DASHBOARD" | jq -r '.etag')" ETAG_1
 
 rm out.summary.json
 title "Load the dashboard by its ID and confirm its display name: "
-$CLI lakeview get "${DASHBOARD_ID}" | jq '{display_name,page_display_name: (.serialized_dashboard | fromjson | .pages[0].displayName)}'
+echo "$DASHBOARD" | jq '{display_name,page_display_name: (.serialized_dashboard | fromjson | .pages[0].displayName)}'
 
 title "Make an out of band modification to the dashboard and confirm that it is detected:\n"
 RESOURCE_ID=$($CLI workspace get-status "${DASHBOARD_PATH}" | jq -r '.resource_id')
 DASHBOARD_JSON="{\"serialized_dashboard\": \"{}\", \"warehouse_id\": \"$TEST_DEFAULT_WAREHOUSE_ID\"}"
-$CLI lakeview update "${RESOURCE_ID}" --json "${DASHBOARD_JSON}" | jq '{lifecycle_state}'
+UPDATE_RESP=$($CLI lakeview update "${RESOURCE_ID}" --json "${DASHBOARD_JSON}")
+echo "$UPDATE_RESP" | jq '{lifecycle_state}'
+add_repl "$(echo "$UPDATE_RESP" | jq -r '.etag')" ETAG_2
 
 title "Try to redeploy the bundle and confirm that the out of band modification is detected:"
 trace $CLI bundle plan
-trace $CLI bundle plan -o json > out.plan.$DATABRICKS_BUNDLE_ENGINE.json
+# Save raw plan (with DMS headers), then apply nostamp for golden file
+trace $CLI bundle plan -o json > plan_raw.json
+cat plan_raw.json | nostamp > out.plan.json
 trace errcode $CLI bundle deploy
 
 title "Redeploy the bundle with the --force flag and confirm that the out of band modification is ignored:"
@@ -43,13 +49,13 @@ trace errcode $CLI bundle deploy --force
 # Extract PATCH requests. These differ between terraform and direct modes:
 # - Terraform includes output-only fields (create_time, dashboard_id, etag, lifecycle_state, path, update_time)
 # - Direct mode only sends input fields (display_name, parent_path, serialized_dashboard, warehouse_id)
-cat out.requests.txt | \
+cat "$OUT_REQUESTS" | \
  jq 'select(.method == "PATCH")' | \
  jq 'select( (.path | contains("/api/2.0/lakeview/dashboards")) or ((.path == "/api/2.0/workspace/mkdirs") and (.body.path | contains("/default/resources"))))' \
- > out.patch.requests.$DATABRICKS_BUNDLE_ENGINE.txt
+ > out.patch.requests.txt
 
 # POST requests are the same across both modes
-cat out.requests.txt | \
+cat "$OUT_REQUESTS" | \
  jq 'select(.method == "POST")' | \
  jq 'select( (.path | contains("/api/2.0/lakeview/dashboards")) or ((.path == "/api/2.0/workspace/mkdirs") and (.body.path | contains("/default/resources"))))' \
  > out.post.requests.txt
diff --git a/acceptance/bundle/resources/dashboards/detect-change/test.toml b/acceptance/bundle/resources/dashboards/detect-change/test.toml
index dd9353c1bc7..590c5448008 100644
--- a/acceptance/bundle/resources/dashboards/detect-change/test.toml
+++ b/acceptance/bundle/resources/dashboards/detect-change/test.toml
@@ -1,23 +1,27 @@
-Local = true
 Cloud = true
 
 Ignore = [
     "databricks.yml",
+    "plan_raw.json",
 ]
 
-[Env]
 # MSYS2 automatically converts absolute paths like /Users/$username/$UNIQUE_NAME to
 # C:/Program Files/Git/Users/$username/UNIQUE_NAME before passing it to the CLI
 # Setting this environment variable prevents that conversion on windows.
-MSYS_NO_PATHCONV = "1"
+Env.MSYS_NO_PATHCONV = "1"
+# This test makes an out-of-band update and then expects `bundle plan` to detect it.
+# Under eventual consistency the plan's own read (CheckDashboardsModifiedRemotely)
+# would observe the stale pre-update value and miss the change -- an engine-level read
+# that no test-level retry can fix -- so opt out of the simulation here.
+Env.INJECT_STALE_ON_DIRECT = "0"
 
 [[Repls]]
 Old = "[0-9a-z]{16,}"
 New = "[ALPHANUMID]"
 
 [[Repls]]
-# clean up ?o=<num> suffix after URL since not all workspaces have that
-Old = '\?o=\[(NUMID|ALPHANUMID)\]'
+# clean up ?[ow]=<num> suffix after URL since not all workspaces have that
+Old = '\?[ow]=\[(WORKSPACE_ID|ALPHANUMID)\]'
 New = ''
 Order = 1000
 
diff --git a/acceptance/bundle/resources/dashboards/generate_inplace/out.test.toml b/acceptance/bundle/resources/dashboards/generate_inplace/out.test.toml
index bbcef543fa6..98ccab9aaeb 100644
--- a/acceptance/bundle/resources/dashboards/generate_inplace/out.test.toml
+++ b/acceptance/bundle/resources/dashboards/generate_inplace/out.test.toml
@@ -1,5 +1,3 @@
-Local = false
 Cloud = true
-RequiresWarehouse = true
 RunsOnDbr = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/dashboards/generate_inplace/output.txt b/acceptance/bundle/resources/dashboards/generate_inplace/output.txt
index 1e38d3d5a1c..057eb238765 100644
--- a/acceptance/bundle/resources/dashboards/generate_inplace/output.txt
+++ b/acceptance/bundle/resources/dashboards/generate_inplace/output.txt
@@ -1,9 +1,9 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dashboard-replace-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created dashboards.already_exists
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 === Get current dashboard
 "{\n  \"uiSettings\": {\n    \"theme\": {\n      \"widgetHeaderAlignment\": \"ALIGNMENT_UNSPECIFIED\"\n    }\n  }\n}\n"
@@ -44,5 +44,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/dashboard-replace-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/dashboards/generate_inplace/script b/acceptance/bundle/resources/dashboards/generate_inplace/script
index e59a9dfd9bf..a8112a752a0 100644
--- a/acceptance/bundle/resources/dashboards/generate_inplace/script
+++ b/acceptance/bundle/resources/dashboards/generate_inplace/script
@@ -12,7 +12,7 @@ trap cleanup EXIT
 dashboard_id=$($CLI bundle summary -o json | jq .resources.dashboards.already_exists.id -r)
 
 title "Get current dashboard\n"
-$CLI lakeview get $dashboard_id | jq .serialized_dashboard
+retry $CLI lakeview get $dashboard_id | jq .serialized_dashboard
 
 title "Update dashboard\n"
 $CLI lakeview update $dashboard_id --display-name "Updated dashboard" | jq .serialized_dashboard
diff --git a/acceptance/bundle/resources/dashboards/generate_inplace/test.toml b/acceptance/bundle/resources/dashboards/generate_inplace/test.toml
index 731f8ff31b5..7d7ae48db25 100644
--- a/acceptance/bundle/resources/dashboards/generate_inplace/test.toml
+++ b/acceptance/bundle/resources/dashboards/generate_inplace/test.toml
@@ -1,7 +1,3 @@
 Cloud = true
-Local = false
 RecordRequests = false
 RunsOnDbr = true
-
-[EnvMatrix]
-  DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/bundle/resources/dashboards/nested-folders/out.test.toml b/acceptance/bundle/resources/dashboards/nested-folders/out.test.toml
index 7edd52865f7..31f264f361a 100644
--- a/acceptance/bundle/resources/dashboards/nested-folders/out.test.toml
+++ b/acceptance/bundle/resources/dashboards/nested-folders/out.test.toml
@@ -1,5 +1,4 @@
-Local = true
 Cloud = true
-RequiresWarehouse = true
 RunsOnDbr = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/resources/dashboards/nested-folders/output.txt b/acceptance/bundle/resources/dashboards/nested-folders/output.txt
index c1c2a79eb0b..0da529bb144 100644
--- a/acceptance/bundle/resources/dashboards/nested-folders/output.txt
+++ b/acceptance/bundle/resources/dashboards/nested-folders/output.txt
@@ -1,11 +1,9 @@
-
->>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-dashboard-nested-folders-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created dashboards.dashboard1
+Files: 6 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
->>> [CLI] lakeview get [DASHBOARD_ID]
+>>> retry [CLI] lakeview get [DASHBOARD_ID]
 {
   "lifecycle_state": "ACTIVE",
   "parent_path": "/Users/[USERNAME]",
@@ -27,5 +25,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-dashboard-nested-folders-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/dashboards/nested-folders/script b/acceptance/bundle/resources/dashboards/nested-folders/script
index d66e0c8404b..c5004f3d6a2 100644
--- a/acceptance/bundle/resources/dashboards/nested-folders/script
+++ b/acceptance/bundle/resources/dashboards/nested-folders/script
@@ -12,10 +12,11 @@ cleanup() {
 }
 trap cleanup EXIT
 
-trace $CLI bundle deploy
+$CLI bundle plan -o json > tmp.plan.json
+$CLI bundle deploy $(readplanarg tmp.plan.json)
 DASHBOARD_ID=$($CLI bundle summary --output json | jq -r '.resources.dashboards.dashboard1.id')
 
 # Capture the dashboard ID as a replacement.
-echo "$DASHBOARD_ID:DASHBOARD_ID" >> ACC_REPLS
+add_repl "$DASHBOARD_ID" DASHBOARD_ID
 
-trace $CLI lakeview get $DASHBOARD_ID | jq '{lifecycle_state, parent_path, path, serialized_dashboard: (.serialized_dashboard | fromjson | {pages: (.pages | map({name, displayName, pageType}))})}'
+trace retry $CLI lakeview get $DASHBOARD_ID | jq '{lifecycle_state, parent_path, path, serialized_dashboard: (.serialized_dashboard | fromjson | {pages: (.pages | map({name, displayName, pageType}))})}'
diff --git a/acceptance/bundle/resources/dashboards/nested-folders/test.toml b/acceptance/bundle/resources/dashboards/nested-folders/test.toml
index 3ca6ec1011a..5177c9e6553 100644
--- a/acceptance/bundle/resources/dashboards/nested-folders/test.toml
+++ b/acceptance/bundle/resources/dashboards/nested-folders/test.toml
@@ -1,15 +1,17 @@
 Badness = "Cannot read dashboard, expecting deployment to succeed"
-Local = true
 Cloud = true
-RequiresWarehouse = true
 RecordRequests = false
 RunsOnDbr = true
 
 Ignore = [
     "databricks.yml",
     "resources/dashboards.yml",
+    "tmp.plan.json",
 ]
 
+# Deploying a saved plan must send the same full serialized_dashboard, which the
+# lakeview get in the script reads back.
+EnvMatrix.READPLAN = ["", "1"]
 
 [[Repls]]
 # Windows:
diff --git a/acceptance/bundle/resources/dashboards/publish-failure-cleans-up-dashboard/out.dashboardrequests.txt b/acceptance/bundle/resources/dashboards/publish-failure-cleans-up-dashboard/out.dashboardrequests.txt
index a7051fa9465..3d6b7be0fe8 100644
--- a/acceptance/bundle/resources/dashboards/publish-failure-cleans-up-dashboard/out.dashboardrequests.txt
+++ b/acceptance/bundle/resources/dashboards/publish-failure-cleans-up-dashboard/out.dashboardrequests.txt
@@ -1,3 +1,10 @@
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/publish-failure-cleans-up-dashboard/default/state"
+  }
+}
 {
   "method": "POST",
   "path": "/api/2.0/workspace/mkdirs",
diff --git a/acceptance/bundle/resources/dashboards/publish-failure-cleans-up-dashboard/out.deploy.direct.txt b/acceptance/bundle/resources/dashboards/publish-failure-cleans-up-dashboard/out.deploy.direct.txt
deleted file mode 100644
index 84918b848bf..00000000000
--- a/acceptance/bundle/resources/dashboards/publish-failure-cleans-up-dashboard/out.deploy.direct.txt
+++ /dev/null
@@ -1,14 +0,0 @@
-
->>> [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/publish-failure-cleans-up-dashboard/default/files...
-Deploying resources...
-Error: cannot create resources.dashboards.dashboard1: Warehouse doesnotexist does not exist (400 RESOURCE_DOES_NOT_EXIST)
-
-Endpoint: POST [DATABRICKS_URL]/api/2.0/lakeview/dashboards/[DASHBOARD_ID]/published
-HTTP Status: 400 Bad Request
-API error_code: RESOURCE_DOES_NOT_EXIST
-API message: Warehouse doesnotexist does not exist
-
-Updating deployment state...
-
-Exit code: 1
diff --git a/acceptance/bundle/resources/dashboards/publish-failure-cleans-up-dashboard/out.deploy.terraform.txt b/acceptance/bundle/resources/dashboards/publish-failure-cleans-up-dashboard/out.deploy.terraform.txt
deleted file mode 100644
index 874b077b1e3..00000000000
--- a/acceptance/bundle/resources/dashboards/publish-failure-cleans-up-dashboard/out.deploy.terraform.txt
+++ /dev/null
@@ -1,17 +0,0 @@
-
->>> [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/publish-failure-cleans-up-dashboard/default/files...
-Deploying resources...
-Error: terraform apply: exit status 1
-
-Error: cannot create dashboard: Warehouse doesnotexist does not exist
-
-  with databricks_dashboard.dashboard1,
-  on bundle.tf.json line 21, in resource.databricks_dashboard.dashboard1:
-  21:       }
-
-
-
-Updating deployment state...
-
-Exit code: 1
diff --git a/acceptance/bundle/resources/dashboards/publish-failure-cleans-up-dashboard/out.deploy.txt b/acceptance/bundle/resources/dashboards/publish-failure-cleans-up-dashboard/out.deploy.txt
new file mode 100644
index 00000000000..5ed7521eb52
--- /dev/null
+++ b/acceptance/bundle/resources/dashboards/publish-failure-cleans-up-dashboard/out.deploy.txt
@@ -0,0 +1,11 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/publish-failure-cleans-up-dashboard/default/files...
+Error: cannot create resources.dashboards.dashboard1: Warehouse doesnotexist does not exist (400 RESOURCE_DOES_NOT_EXIST)
+
+Endpoint: POST [DATABRICKS_URL]/api/2.0/lakeview/dashboards/[DASHBOARD_ID]/published
+HTTP Status: 400 Bad Request
+API error_code: RESOURCE_DOES_NOT_EXIST
+API message: Warehouse doesnotexist does not exist
+
+Files: 5 uploaded, 0 deleted
+
+Exit code: 1
diff --git a/acceptance/bundle/resources/dashboards/publish-failure-cleans-up-dashboard/out.test.toml b/acceptance/bundle/resources/dashboards/publish-failure-cleans-up-dashboard/out.test.toml
index 8f6c4a03c57..f7fafbcc731 100644
--- a/acceptance/bundle/resources/dashboards/publish-failure-cleans-up-dashboard/out.test.toml
+++ b/acceptance/bundle/resources/dashboards/publish-failure-cleans-up-dashboard/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
-RequiresWarehouse = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/resources/dashboards/publish-failure-cleans-up-dashboard/script b/acceptance/bundle/resources/dashboards/publish-failure-cleans-up-dashboard/script
index 693a4320211..e9ad93d3079 100755
--- a/acceptance/bundle/resources/dashboards/publish-failure-cleans-up-dashboard/script
+++ b/acceptance/bundle/resources/dashboards/publish-failure-cleans-up-dashboard/script
@@ -2,7 +2,8 @@ export DASHBOARD_DISPLAY_NAME="test bundle-deploy-dashboard $UNIQUE_NAME)"
 envsubst < databricks.yml.tmpl > databricks.yml
 
 # Deploy the dashboard. The dashboard will be created but publish will fail because the warehouse does not exist.
-errcode trace $CLI bundle deploy &> out.deploy.$DATABRICKS_BUNDLE_ENGINE.txt
+$CLI bundle plan -o json > tmp.plan.json
+errcode $CLI bundle deploy $(readplanarg tmp.plan.json) &> out.deploy.txt
 
 trace $CLI bundle summary
 
diff --git a/acceptance/bundle/resources/dashboards/publish-failure-cleans-up-dashboard/test.toml b/acceptance/bundle/resources/dashboards/publish-failure-cleans-up-dashboard/test.toml
index a8ede7b099c..f5266a24dc8 100644
--- a/acceptance/bundle/resources/dashboards/publish-failure-cleans-up-dashboard/test.toml
+++ b/acceptance/bundle/resources/dashboards/publish-failure-cleans-up-dashboard/test.toml
@@ -1,7 +1,12 @@
 Cloud = false
-Local = true
 RecordRequests = true
 
+Ignore = ["tmp.plan.json"]
+
+# Applying a saved plan must reach the same publish failure and the same cleanup
+# DELETE as an in-memory plan; both variants share out.dashboardrequests.txt.
+EnvMatrix.READPLAN = ["", "1"]
+
 [[Server]]
 Pattern = "POST /api/2.0/lakeview/dashboards/{dashboard_id}/published"
 Response.StatusCode = 400
diff --git a/acceptance/bundle/resources/dashboards/publish-failure-stale-content/dashboard.lvdash.json b/acceptance/bundle/resources/dashboards/publish-failure-stale-content/dashboard.lvdash.json
new file mode 100644
index 00000000000..0bfc5797ff0
--- /dev/null
+++ b/acceptance/bundle/resources/dashboards/publish-failure-stale-content/dashboard.lvdash.json
@@ -0,0 +1 @@
+{"pages":[{"name":"test-page","displayName":"Test Dashboard"}]}
diff --git a/acceptance/bundle/resources/dashboards/publish-failure-stale-content/databricks.yml.tmpl b/acceptance/bundle/resources/dashboards/publish-failure-stale-content/databricks.yml.tmpl
new file mode 100644
index 00000000000..25e359dd010
--- /dev/null
+++ b/acceptance/bundle/resources/dashboards/publish-failure-stale-content/databricks.yml.tmpl
@@ -0,0 +1,9 @@
+bundle:
+  name: update-publish-failure-stale-content
+
+resources:
+  dashboards:
+    dashboard1:
+      display_name: my dashboard
+      warehouse_id: $TEST_DEFAULT_WAREHOUSE_ID
+      file_path: ./dashboard.lvdash.json
diff --git a/acceptance/bundle/resources/dashboards/publish-failure-stale-content/out.test.toml b/acceptance/bundle/resources/dashboards/publish-failure-stale-content/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/dashboards/publish-failure-stale-content/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/dashboards/publish-failure-stale-content/output.txt b/acceptance/bundle/resources/dashboards/publish-failure-stale-content/output.txt
new file mode 100644
index 00000000000..f57df03fe5e
--- /dev/null
+++ b/acceptance/bundle/resources/dashboards/publish-failure-stale-content/output.txt
@@ -0,0 +1,172 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-publish-failure-stale-content/default/files...
+Created dashboards.dashboard1
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+{
+  "display_name": "my dashboard",
+  "etag": "[ETAG_1]"
+}
+
+>>> [CLI] lakeview get-published [DASHBOARD1_ID]
+{
+  "display_name": "my dashboard"
+}
+
+>>> [CLI] bundle plan -o json
+json.plan.resources.dashboards.dashboard1.remote_state.etag = "[ETAG_1]";
+json.plan.resources.dashboards.dashboard1.remote_state.published = true;
+json.plan.resources.dashboards.dashboard1.changes.etag.action = "skip";
+json.plan.resources.dashboards.dashboard1.changes.etag.reason = "custom";
+json.plan.resources.dashboards.dashboard1.changes.etag.old = "[ETAG_1]";
+json.plan.resources.dashboards.dashboard1.changes.etag.remote = "[ETAG_1]";
+json.plan.resources.dashboards.dashboard1.changes.serialized_dashboard.reason = "etag_based";
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-publish-failure-stale-content/default/files...
+Error: cannot update resources.dashboards.dashboard1: updating id=[DASHBOARD1_ID]: Fault injected by test. (400 INJECTED)
+
+Endpoint: POST [DATABRICKS_URL]/api/2.0/lakeview/dashboards/[DASHBOARD1_ID]/published
+HTTP Status: 400 Bad Request
+API error_code: INJECTED
+API message: Fault injected by test.
+
+Files: 1 uploaded, 0 deleted
+
+Exit code: 1
+
+>>> print_requests.py //lakeview/dashboards
+{
+  "method": "PATCH",
+  "path": "/api/2.0/lakeview/dashboards/[DASHBOARD1_ID]",
+  "body": {
+    "display_name": "my dashboard renamed",
+    "parent_path": "/Workspace/Users/[USERNAME]/.bundle/update-publish-failure-stale-content/default/resources",
+    "serialized_dashboard": "{\"pages\":[{\"name\":\"test-page\",\"displayName\":\"Test Dashboard\"}]}\n",
+    "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/lakeview/dashboards/[DASHBOARD1_ID]/published",
+  "body": {
+    "embed_credentials": false,
+    "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
+  }
+}
+
+>>> [CLI] lakeview get [DASHBOARD1_ID]
+{
+  "display_name": "my dashboard renamed",
+  "etag": "[ETAG_2]"
+}
+
+>>> [CLI] lakeview get-published [DASHBOARD1_ID]
+{
+  "display_name": "my dashboard"
+}
+
+>>> [CLI] bundle plan -o json
+Warning: dashboard "dashboard1" has been modified remotely
+  at resources.dashboards.dashboard1
+  in databricks.yml:7:7
+
+This dashboard has been modified remotely since the last bundle deployment.
+These modifications are untracked and will be overwritten on deploy.
+
+Make sure that the local dashboard definition matches what you intend to deploy
+before proceeding with the deployment.
+
+To overwrite the remote changes with your local version, use --force.
+The remote modifications will be lost.
+
+json.plan.resources.dashboards.dashboard1.new_state.value.published = true;
+json.plan.resources.dashboards.dashboard1.remote_state.etag = "[ETAG_2]";
+json.plan.resources.dashboards.dashboard1.remote_state.published = false;
+json.plan.resources.dashboards.dashboard1.changes.etag.action = "update";
+json.plan.resources.dashboards.dashboard1.changes.etag.old = "[ETAG_1]";
+json.plan.resources.dashboards.dashboard1.changes.etag.remote = "[ETAG_2]";
+json.plan.resources.dashboards.dashboard1.changes.published.action = "update";
+json.plan.resources.dashboards.dashboard1.changes.published.old = true;
+json.plan.resources.dashboards.dashboard1.changes.published.new = true;
+json.plan.resources.dashboards.dashboard1.changes.published.remote = false;
+json.plan.resources.dashboards.dashboard1.changes.serialized_dashboard.reason = "etag_based";
+
+>>> [CLI] bundle deploy
+Error: dashboard "dashboard1" has been modified remotely
+  at resources.dashboards.dashboard1
+  in databricks.yml:7:7
+
+This dashboard has been modified remotely since the last bundle deployment.
+These modifications are untracked and will be overwritten on deploy.
+
+Make sure that the local dashboard definition matches what you intend to deploy
+before proceeding with the deployment.
+
+To overwrite the remote changes with your local version, use --force.
+The remote modifications will be lost.
+
+
+Exit code: 1
+
+>>> print_requests.py //lakeview/dashboards
+
+>>> [CLI] lakeview get [DASHBOARD1_ID]
+{
+  "display_name": "my dashboard renamed",
+  "etag": "[ETAG_2]"
+}
+
+>>> [CLI] lakeview get-published [DASHBOARD1_ID]
+{
+  "display_name": "my dashboard"
+}
+
+>>> [CLI] bundle deploy --force
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-publish-failure-stale-content/default/files...
+Updated dashboards.dashboard1
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //lakeview/dashboards
+{
+  "method": "PATCH",
+  "path": "/api/2.0/lakeview/dashboards/[DASHBOARD1_ID]",
+  "body": {
+    "display_name": "my dashboard renamed",
+    "parent_path": "/Workspace/Users/[USERNAME]/.bundle/update-publish-failure-stale-content/default/resources",
+    "serialized_dashboard": "{\"pages\":[{\"name\":\"test-page\",\"displayName\":\"Test Dashboard\"}]}\n",
+    "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/lakeview/dashboards/[DASHBOARD1_ID]/published",
+  "body": {
+    "embed_credentials": false,
+    "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
+  }
+}
+
+>>> [CLI] lakeview get [DASHBOARD1_ID]
+{
+  "display_name": "my dashboard renamed",
+  "etag": "[ETAG_3]"
+}
+
+>>> [CLI] lakeview get-published [DASHBOARD1_ID]
+{
+  "display_name": "my dashboard renamed"
+}
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.dashboards.dashboard1
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/update-publish-failure-stale-content/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/dashboards/publish-failure-stale-content/script b/acceptance/bundle/resources/dashboards/publish-failure-stale-content/script
new file mode 100644
index 00000000000..325b4afb422
--- /dev/null
+++ b/acceptance/bundle/resources/dashboards/publish-failure-stale-content/script
@@ -0,0 +1,56 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+unset MSYS_NO_PATHCONV
+
+# First deploy: dashboard is created and published successfully.
+trace $CLI bundle deploy
+DASHBOARD_ID=$(read_id.py dashboard1)
+DASHBOARD=$(retry $CLI lakeview get $DASHBOARD_ID)
+ETAG_1=$(echo "$DASHBOARD" | jq -r '.etag')
+add_repl "$ETAG_1" ETAG_1
+echo "$DASHBOARD" | jq '{display_name, etag}'
+trace $CLI lakeview get-published $DASHBOARD_ID | jq '{display_name}'
+trace $CLI bundle plan -o json | nostamp | gron.py | grep -E "etag|published"
+rm "$OUT_REQUESTS"
+
+# Inject a single publish failure for the update below.
+fault.py "POST /api/2.0/lakeview/dashboards/*" 400 0 1
+
+# Rename the dashboard to trigger an Update.
+update_file.py databricks.yml "my dashboard" "my dashboard renamed"
+
+# Deploy: PATCH succeeds (bumping the remote etag) but publish fails.
+# SaveState is only called on success, so state retains the pre-PATCH etag.
+errcode trace $CLI bundle deploy
+trace print_requests.py //lakeview/dashboards
+# The PATCH bumped the remote etag to ETAG_2; retry until it is visible (eventual consistency).
+ETAG_2=$(retry --until-not "$ETAG_1" $CLI lakeview get $DASHBOARD_ID | jq -r '.etag')
+add_repl "$ETAG_2" ETAG_2
+trace $CLI lakeview get $DASHBOARD_ID | jq '{display_name, etag}'
+trace $CLI lakeview get-published $DASHBOARD_ID | jq '{display_name}'
+trace $CLI bundle plan -o json | nostamp | gron.py | grep -E "etag|published"
+
+# Bug: re-running deploy fails with "modified remotely" because the stored etag
+# (pre-PATCH) no longer matches the remote etag (bumped by the PATCH above).
+# No API writes are attempted — the stale published content is stuck.
+errcode trace $CLI bundle deploy
+trace print_requests.py //lakeview/dashboards
+trace $CLI lakeview get $DASHBOARD_ID | jq '{display_name, etag}'
+trace $CLI lakeview get-published $DASHBOARD_ID | jq '{display_name}'
+
+# --force bypasses the etag check and forces a full re-deploy (PATCH + POST /published),
+# which fixes the stale published content.
+trace $CLI bundle deploy --force
+trace print_requests.py //lakeview/dashboards
+# --force did another PATCH; retry until the new etag is visible (eventual consistency).
+ETAG_3=$(retry --until-not "$ETAG_2" $CLI lakeview get $DASHBOARD_ID | jq -r '.etag')
+add_repl "$ETAG_3" ETAG_3
+trace $CLI lakeview get $DASHBOARD_ID | jq '{display_name, etag}'
+trace $CLI lakeview get-published $DASHBOARD_ID | jq '{display_name}'
+trace $CLI bundle plan
diff --git a/acceptance/bundle/resources/dashboards/publish-failure-stale-content/test.toml b/acceptance/bundle/resources/dashboards/publish-failure-stale-content/test.toml
new file mode 100644
index 00000000000..b02f297e0e6
--- /dev/null
+++ b/acceptance/bundle/resources/dashboards/publish-failure-stale-content/test.toml
@@ -0,0 +1,8 @@
+Badness = "after publish failure, re-deploy fails with 'modified remotely' instead of republishing; --force is required as a workaround"
+Cloud = false
+RecordRequests = true
+
+Ignore = [
+    ".databricks",
+    "databricks.yml",
+]
diff --git a/acceptance/bundle/resources/dashboards/republish-after-draft-update/dashboard.lvdash.json b/acceptance/bundle/resources/dashboards/republish-after-draft-update/dashboard.lvdash.json
new file mode 100644
index 00000000000..397a9a1259c
--- /dev/null
+++ b/acceptance/bundle/resources/dashboards/republish-after-draft-update/dashboard.lvdash.json
@@ -0,0 +1,34 @@
+{
+  "pages": [
+    {
+      "displayName": "New Page",
+      "layout": [
+        {
+          "position": {
+            "height": 2,
+            "width": 6,
+            "x": 0,
+            "y": 0
+          },
+          "widget": {
+            "name": "82eb9107",
+            "textbox_spec": "# I'm a title"
+          }
+        },
+        {
+          "position": {
+            "height": 2,
+            "width": 6,
+            "x": 0,
+            "y": 2
+          },
+          "widget": {
+            "name": "ffa6de4f",
+            "textbox_spec": "Text"
+          }
+        }
+      ],
+      "name": "fdd21a3c"
+    }
+  ]
+}
diff --git a/acceptance/bundle/resources/dashboards/republish-after-draft-update/databricks.yml.tmpl b/acceptance/bundle/resources/dashboards/republish-after-draft-update/databricks.yml.tmpl
new file mode 100644
index 00000000000..0fae00d3fcc
--- /dev/null
+++ b/acceptance/bundle/resources/dashboards/republish-after-draft-update/databricks.yml.tmpl
@@ -0,0 +1,12 @@
+bundle:
+  name: republish-after-draft-update
+
+workspace:
+  root_path: ~/.bundle/$UNIQUE_NAME
+
+resources:
+  dashboards:
+    dashboard1:
+      display_name: test-dashboard-$UNIQUE_NAME
+      file_path: ./dashboard.lvdash.json
+      warehouse_id: $TEST_DEFAULT_WAREHOUSE_ID
diff --git a/acceptance/bundle/resources/dashboards/republish-after-draft-update/out.test.toml b/acceptance/bundle/resources/dashboards/republish-after-draft-update/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/dashboards/republish-after-draft-update/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/dashboards/republish-after-draft-update/output.txt b/acceptance/bundle/resources/dashboards/republish-after-draft-update/output.txt
new file mode 100644
index 00000000000..4064ec231c7
--- /dev/null
+++ b/acceptance/bundle/resources/dashboards/republish-after-draft-update/output.txt
@@ -0,0 +1,40 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Created dashboards.dashboard1
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Plan right after deploy -- published is current, no change:
+>>> [CLI] bundle plan -o json
+null
+
+=== Plan after out-of-band draft update -- a republish is owed:
+>>> [CLI] bundle plan -o json
+Warning: dashboard "dashboard1" has been modified remotely
+  at resources.dashboards.dashboard1
+  in databricks.yml:10:7
+
+This dashboard has been modified remotely since the last bundle deployment.
+These modifications are untracked and will be overwritten on deploy.
+
+Make sure that the local dashboard definition matches what you intend to deploy
+before proceeding with the deployment.
+
+To overwrite the remote changes with your local version, use --force.
+The remote modifications will be lost.
+
+{
+  "action": "update",
+  "old": true,
+  "new": true,
+  "remote": false
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.dashboards.dashboard1
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/dashboards/republish-after-draft-update/script b/acceptance/bundle/resources/dashboards/republish-after-draft-update/script
new file mode 100644
index 00000000000..b6f0d91fa6c
--- /dev/null
+++ b/acceptance/bundle/resources/dashboards/republish-after-draft-update/script
@@ -0,0 +1,31 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+# This script passes no leading-slash paths to the CLI, so the inherited MSYS_NO_PATHCONV=1
+# is not needed; unset it so bin/*.py helpers resolve their own script path on Windows.
+unset MSYS_NO_PATHCONV
+
+# Deploy: the dashboard is created and published, so the published revision matches the
+# draft (revision_create_time >= update_time).
+trace $CLI bundle deploy
+DASHBOARD_ID=$(read_id.py dashboard1)
+
+# A clean re-plan is a no-op: the published content matches the draft.
+title "Plan right after deploy -- published is current, no change:"
+trace $CLI bundle plan -o json | nostamp | jq '.plan["resources.dashboards.dashboard1"].changes.published'
+
+# Make an out-of-band DRAFT update without republishing. This advances the draft's
+# update_time past the published revision_create_time, so the published content is now
+# stale. GetPublished still returns 200 (the previous revision), so the old
+# "published = (GetPublished succeeds)" check reported published=true and MISSED this --
+# the regression this test guards. The timestamp comparison reports published=false, so
+# the plan surfaces a pending republish (published: update, remote=false).
+DASHBOARD_JSON="{\"serialized_dashboard\": \"{}\", \"warehouse_id\": \"$TEST_DEFAULT_WAREHOUSE_ID\"}"
+$CLI lakeview update "$DASHBOARD_ID" --json "${DASHBOARD_JSON}" > /dev/null
+
+title "Plan after out-of-band draft update -- a republish is owed:"
+trace $CLI bundle plan -o json | nostamp | jq '.plan["resources.dashboards.dashboard1"].changes.published'
diff --git a/acceptance/bundle/resources/dashboards/republish-after-draft-update/test.toml b/acceptance/bundle/resources/dashboards/republish-after-draft-update/test.toml
new file mode 100644
index 00000000000..6d10f7f2be5
--- /dev/null
+++ b/acceptance/bundle/resources/dashboards/republish-after-draft-update/test.toml
@@ -0,0 +1,16 @@
+# Regression test for stale-publish detection. The dashboard "published" state is a
+# direct-engine concept derived from the publish/update timestamps, so run direct only.
+Cloud = false
+# This test asserts plan output, not the recorded request sequence, so keep request
+# recording off (inherited as true from the parent) to avoid flaky ordering.
+RecordRequests = false
+
+# This test makes an out-of-band draft update and expects `bundle plan` to detect that a
+# republish is owed. The inherited eventual-consistency simulation would make the plan's
+# own read observe stale values and mask the change, so opt out of it here.
+Env.INJECT_STALE_ON_DIRECT = "0"
+
+[[Repls]]
+Old = '2\d\d\d-\d\d-\d\d(T| )\d\d:\d\d:\d\d(\.\d+(Z|\+\d\d:\d\d)?)?Z'
+New = "[TIMESTAMP]"
+Order = 9
diff --git a/acceptance/bundle/resources/dashboards/serialized-inline/databricks.yml.tmpl b/acceptance/bundle/resources/dashboards/serialized-inline/databricks.yml.tmpl
new file mode 100644
index 00000000000..ca96f9fcf14
--- /dev/null
+++ b/acceptance/bundle/resources/dashboards/serialized-inline/databricks.yml.tmpl
@@ -0,0 +1,12 @@
+bundle:
+  name: dashboard-serialized-inline-$UNIQUE_NAME
+
+resources:
+  dashboards:
+    inline_dash:
+      display_name: Inline Dash
+      warehouse_id: $TEST_DEFAULT_WAREHOUSE_ID
+      serialized_dashboard:        # inline YAML MAP = the non-string case
+        pages:
+          - name: page1
+            displayName: Page 1
diff --git a/acceptance/bundle/resources/dashboards/serialized-inline/out.test.toml b/acceptance/bundle/resources/dashboards/serialized-inline/out.test.toml
new file mode 100644
index 00000000000..7a62f726f25
--- /dev/null
+++ b/acceptance/bundle/resources/dashboards/serialized-inline/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/resources/dashboards/serialized-inline/output.txt b/acceptance/bundle/resources/dashboards/serialized-inline/output.txt
new file mode 100644
index 00000000000..24083cbb777
--- /dev/null
+++ b/acceptance/bundle/resources/dashboards/serialized-inline/output.txt
@@ -0,0 +1,29 @@
+
+>>> [CLI] bundle plan
+create dashboards.inline_dash
+
+Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dashboard-serialized-inline-[UNIQUE_NAME]/default/files...
+Created dashboards.inline_dash
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //api/2.0/lakeview/dashboards
+{
+  "method": "POST",
+  "path": "/api/2.0/lakeview/dashboards",
+  "body": {
+    "display_name": "Inline Dash",
+    "parent_path": "/Workspace/Users/[USERNAME]/.bundle/dashboard-serialized-inline-[UNIQUE_NAME]/default/resources",
+    "serialized_dashboard": "{\"pages\":[{\"displayName\":\"Page 1\",\"name\":\"page1\"}]}",
+    "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/lakeview/dashboards/[INLINE_DASH_ID]/published",
+  "body": {
+    "embed_credentials": false,
+    "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
+  }
+}
diff --git a/acceptance/bundle/resources/dashboards/serialized-inline/script b/acceptance/bundle/resources/dashboards/serialized-inline/script
new file mode 100644
index 00000000000..95b91370efd
--- /dev/null
+++ b/acceptance/bundle/resources/dashboards/serialized-inline/script
@@ -0,0 +1,19 @@
+# Inherited MSYS_NO_PATHCONV breaks bare python helpers on Windows; this test doesn't need it.
+unset MSYS_NO_PATHCONV
+
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    # Cleanup; direct's destroy 404s on the stale GET and diverges, so keep it out of the diff.
+    $CLI bundle destroy --auto-approve &> LOG.destroy
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+trace $CLI bundle plan
+$CLI bundle plan -o json > tmp.plan.json
+$CLI bundle deploy $(readplanarg tmp.plan.json)
+replace_ids.py
+
+# Prove the inline YAML map reaches the API as a JSON string.
+trace print_requests.py //api/2.0/lakeview/dashboards
diff --git a/acceptance/bundle/resources/dashboards/serialized-inline/test.toml b/acceptance/bundle/resources/dashboards/serialized-inline/test.toml
new file mode 100644
index 00000000000..6f91063a6ee
--- /dev/null
+++ b/acceptance/bundle/resources/dashboards/serialized-inline/test.toml
@@ -0,0 +1,6 @@
+Ignore = [
+    "databricks.yml",
+    "tmp.plan.json",
+]
+
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/resources/dashboards/simple/out.plan.direct.json b/acceptance/bundle/resources/dashboards/simple/out.plan.direct.json
deleted file mode 100644
index 59ab070e00e..00000000000
--- a/acceptance/bundle/resources/dashboards/simple/out.plan.direct.json
+++ /dev/null
@@ -1,40 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.dashboards.dashboard1": {
-      "action": "skip",
-      "remote_state": {
-        "create_time": "[TIMESTAMP]",
-        "dashboard_id": "[DASHBOARD_ID]",
-        "display_name": "test bundle-deploy-dashboard [UUID]",
-        "embed_credentials": true,
-        "etag": [ETAG],
-        "lifecycle_state": "ACTIVE",
-        "parent_path": "/Workspace/Users/[USERNAME]",
-        "path": "/Users/[USERNAME]/test bundle-deploy-dashboard [UUID].lvdash.json",
-        "published": true,
-        "serialized_dashboard": "{}\n",
-        "update_time": "[TIMESTAMP]",
-        "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
-      },
-      "changes": {
-        "etag": {
-          "action": "skip",
-          "reason": "custom",
-          "old": [ETAG],
-          "remote": [ETAG]
-        },
-        "serialized_dashboard": {
-          "action": "skip",
-          "reason": "etag_based",
-          "old": "{ }\n",
-          "new": "{ }\n",
-          "remote": "{}\n"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/dashboards/simple/out.plan.json b/acceptance/bundle/resources/dashboards/simple/out.plan.json
new file mode 100644
index 00000000000..1f3d8674749
--- /dev/null
+++ b/acceptance/bundle/resources/dashboards/simple/out.plan.json
@@ -0,0 +1,65 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.dashboards.dashboard1": {
+      "action": "skip",
+      "remote_state": {
+        "create_time": "[TIMESTAMP]",
+        "dashboard_id": "[DASHBOARD_ID]",
+        "display_name": "test bundle-deploy-dashboard [UUID]",
+        "embed_credentials": true,
+        "etag": "[ETAG]",
+        "lifecycle_state": "ACTIVE",
+        "parent_path": "/Workspace/Users/[USERNAME]",
+        "path": "/Users/[USERNAME]/test bundle-deploy-dashboard [UUID].lvdash.json",
+        "published": true,
+        "serialized_dashboard": "{}\n",
+        "update_time": "[TIMESTAMP]",
+        "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
+      },
+      "changes": {
+        "create_time": {
+          "action": "skip",
+          "reason": "spec:output_only",
+          "remote": "[TIMESTAMP]"
+        },
+        "dashboard_id": {
+          "action": "skip",
+          "reason": "spec:output_only",
+          "remote": "[DASHBOARD_ID]"
+        },
+        "etag": {
+          "action": "skip",
+          "reason": "custom",
+          "old": "[ETAG]",
+          "remote": "[ETAG]"
+        },
+        "lifecycle_state": {
+          "action": "skip",
+          "reason": "spec:output_only",
+          "remote": "ACTIVE"
+        },
+        "path": {
+          "action": "skip",
+          "reason": "spec:output_only",
+          "remote": "/Users/[USERNAME]/test bundle-deploy-dashboard [UUID].lvdash.json"
+        },
+        "serialized_dashboard": {
+          "action": "skip",
+          "reason": "etag_based",
+          "old": "{ }\n",
+          "new": "{ }\n",
+          "remote": "{}\n"
+        },
+        "update_time": {
+          "action": "skip",
+          "reason": "spec:output_only",
+          "remote": "[TIMESTAMP]"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/dashboards/simple/out.plan.terraform.json b/acceptance/bundle/resources/dashboards/simple/out.plan.terraform.json
deleted file mode 100644
index 01caf158011..00000000000
--- a/acceptance/bundle/resources/dashboards/simple/out.plan.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.dashboards.dashboard1": {
-      "action": "skip"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/dashboards/simple/out.test.toml b/acceptance/bundle/resources/dashboards/simple/out.test.toml
index 7edd52865f7..98ccab9aaeb 100644
--- a/acceptance/bundle/resources/dashboards/simple/out.test.toml
+++ b/acceptance/bundle/resources/dashboards/simple/out.test.toml
@@ -1,5 +1,3 @@
-Local = true
 Cloud = true
-RequiresWarehouse = true
 RunsOnDbr = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/dashboards/simple/output.txt b/acceptance/bundle/resources/dashboards/simple/output.txt
index 7464a2e50f5..e866c069e5f 100644
--- a/acceptance/bundle/resources/dashboards/simple/output.txt
+++ b/acceptance/bundle/resources/dashboards/simple/output.txt
@@ -1,11 +1,9 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-dashboard-test-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> [CLI] lakeview get [DASHBOARD_ID]
+Created dashboards.dashboard1
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 {
   "lifecycle_state": "ACTIVE",
   "parent_path": "/Users/[USERNAME]",
@@ -21,5 +19,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-dashboard-test-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/dashboards/simple/script b/acceptance/bundle/resources/dashboards/simple/script
index f834edbeadd..c17660bedf7 100644
--- a/acceptance/bundle/resources/dashboards/simple/script
+++ b/acceptance/bundle/resources/dashboards/simple/script
@@ -1,7 +1,7 @@
 DASHBOARD_DISPLAY_NAME="test bundle-deploy-dashboard $(uuid)"
 if [ -z "$CLOUD_ENV" ]; then
     export TEST_DEFAULT_WAREHOUSE_ID="warehouse-1234"
-    echo "warehouse-1234:TEST_DEFAULT_WAREHOUSE_ID" >> ACC_REPLS
+    add_repl "warehouse-1234" TEST_DEFAULT_WAREHOUSE_ID
 fi
 
 export DASHBOARD_DISPLAY_NAME
@@ -16,10 +16,14 @@ trace $CLI bundle deploy
 DASHBOARD_ID=$($CLI bundle summary --output json | jq -r '.resources.dashboards.dashboard1.id')
 
 # Capture the dashboard ID as a replacement.
-echo "$DASHBOARD_ID:DASHBOARD_ID" >> ACC_REPLS
+add_repl "$DASHBOARD_ID" DASHBOARD_ID
+DASHBOARD=$(retry $CLI lakeview get $DASHBOARD_ID)
+add_repl "$(echo "$DASHBOARD" | jq -r '.etag')" ETAG
 
-trace $CLI lakeview get $DASHBOARD_ID | jq '{lifecycle_state, parent_path, path, serialized_dashboard}'
+echo "$DASHBOARD" | jq '{lifecycle_state, parent_path, path, serialized_dashboard}'
 
 # Verify that there is no drift right after deploy. We use |= to update the serialized_dashboard field in place to account
 # for formatting that the cloud server applies to the serialized_dashboard field.
-trace $CLI bundle plan -o json > out.plan.$DATABRICKS_BUNDLE_ENGINE.json
+# Save raw plan (with DMS headers), then apply nostamp for golden file
+trace $CLI bundle plan -o json > plan_raw.json
+cat plan_raw.json | nostamp > out.plan.json
diff --git a/acceptance/bundle/resources/dashboards/simple/test.toml b/acceptance/bundle/resources/dashboards/simple/test.toml
index 819b4103890..7163006b17c 100644
--- a/acceptance/bundle/resources/dashboards/simple/test.toml
+++ b/acceptance/bundle/resources/dashboards/simple/test.toml
@@ -1,9 +1,8 @@
-Local = true
 Cloud = true
-RequiresWarehouse = true
 RecordRequests = false
 RunsOnDbr = true
 
 Ignore = [
     "databricks.yml",
+    "plan_raw.json",
 ]
diff --git a/acceptance/bundle/resources/dashboards/simple_outside_bundle_root/out.test.toml b/acceptance/bundle/resources/dashboards/simple_outside_bundle_root/out.test.toml
index 7edd52865f7..98ccab9aaeb 100644
--- a/acceptance/bundle/resources/dashboards/simple_outside_bundle_root/out.test.toml
+++ b/acceptance/bundle/resources/dashboards/simple_outside_bundle_root/out.test.toml
@@ -1,5 +1,3 @@
-Local = true
 Cloud = true
-RequiresWarehouse = true
 RunsOnDbr = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/dashboards/simple_outside_bundle_root/output.txt b/acceptance/bundle/resources/dashboards/simple_outside_bundle_root/output.txt
index 6e16fb6ef0b..622d8111fea 100644
--- a/acceptance/bundle/resources/dashboards/simple_outside_bundle_root/output.txt
+++ b/acceptance/bundle/resources/dashboards/simple_outside_bundle_root/output.txt
@@ -1,11 +1,7 @@
 
->>> [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-dashboard-outside-bundle-root-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+>>> [CLI] bundle deploy -qq
 
->>> [CLI] lakeview get [DASHBOARD_ID]
+>>> retry [CLI] lakeview get [DASHBOARD_ID]
 {
   "lifecycle_state": "ACTIVE",
   "parent_path": "/Users/[USERNAME]",
@@ -19,5 +15,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-dashboard-outside-bundle-root-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/dashboards/simple_outside_bundle_root/script b/acceptance/bundle/resources/dashboards/simple_outside_bundle_root/script
index 34922031caa..7d4f814f70c 100644
--- a/acceptance/bundle/resources/dashboards/simple_outside_bundle_root/script
+++ b/acceptance/bundle/resources/dashboards/simple_outside_bundle_root/script
@@ -12,10 +12,10 @@ cleanup() {
 }
 trap cleanup EXIT
 
-trace $CLI bundle deploy
+trace $CLI bundle deploy -qq
 DASHBOARD_ID=$($CLI bundle summary --output json | jq -r '.resources.dashboards.dashboard1.id')
 
 # Capture the dashboard ID as a replacement.
-echo "$DASHBOARD_ID:DASHBOARD_ID" >> ACC_REPLS
+add_repl "$DASHBOARD_ID" DASHBOARD_ID
 
-trace $CLI lakeview get $DASHBOARD_ID | jq '{lifecycle_state, parent_path, path, serialized_dashboard}'
+trace retry $CLI lakeview get $DASHBOARD_ID | jq '{lifecycle_state, parent_path, path, serialized_dashboard}'
diff --git a/acceptance/bundle/resources/dashboards/simple_outside_bundle_root/test.toml b/acceptance/bundle/resources/dashboards/simple_outside_bundle_root/test.toml
index c1898ee8817..edc30b390e3 100644
--- a/acceptance/bundle/resources/dashboards/simple_outside_bundle_root/test.toml
+++ b/acceptance/bundle/resources/dashboards/simple_outside_bundle_root/test.toml
@@ -1,6 +1,4 @@
-Local = true
 Cloud = true
-RequiresWarehouse = true
 RecordRequests = false
 RunsOnDbr = true
 
@@ -9,7 +7,6 @@ Ignore = [
     "sample-dashboard.lvdash.json",
 ]
 
-
 [[Repls]]
 # Windows:
 Old = 'The system cannot find the file specified.'
diff --git a/acceptance/bundle/resources/dashboards/simple_syncroot/out.test.toml b/acceptance/bundle/resources/dashboards/simple_syncroot/out.test.toml
index 7edd52865f7..98ccab9aaeb 100644
--- a/acceptance/bundle/resources/dashboards/simple_syncroot/out.test.toml
+++ b/acceptance/bundle/resources/dashboards/simple_syncroot/out.test.toml
@@ -1,5 +1,3 @@
-Local = true
 Cloud = true
-RequiresWarehouse = true
 RunsOnDbr = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/dashboards/simple_syncroot/output.txt b/acceptance/bundle/resources/dashboards/simple_syncroot/output.txt
index 8bb6baeca54..a725a96753d 100644
--- a/acceptance/bundle/resources/dashboards/simple_syncroot/output.txt
+++ b/acceptance/bundle/resources/dashboards/simple_syncroot/output.txt
@@ -1,11 +1,7 @@
 
->>> [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-dashboard-test-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+>>> [CLI] bundle deploy -qq
 
->>> [CLI] lakeview get [DASHBOARD_ID]
+>>> retry [CLI] lakeview get [DASHBOARD_ID]
 {
   "lifecycle_state": "ACTIVE",
   "parent_path": "/Users/[USERNAME]",
@@ -19,5 +15,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-dashboard-test-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/dashboards/simple_syncroot/script b/acceptance/bundle/resources/dashboards/simple_syncroot/script
index 225394a94b5..63cfaa008ab 100644
--- a/acceptance/bundle/resources/dashboards/simple_syncroot/script
+++ b/acceptance/bundle/resources/dashboards/simple_syncroot/script
@@ -13,10 +13,10 @@ cleanup() {
 }
 trap cleanup EXIT
 
-trace $CLI bundle deploy
+trace $CLI bundle deploy -qq
 DASHBOARD_ID=$($CLI bundle summary --output json | jq -r '.resources.dashboards.dashboard1.id')
 
 # Capture the dashboard ID as a replacement.
-echo "$DASHBOARD_ID:DASHBOARD_ID" >> ACC_REPLS
+add_repl "$DASHBOARD_ID" DASHBOARD_ID
 
-trace $CLI lakeview get $DASHBOARD_ID | jq '{lifecycle_state, parent_path, path, serialized_dashboard}'
+trace retry $CLI lakeview get $DASHBOARD_ID | jq '{lifecycle_state, parent_path, path, serialized_dashboard}'
diff --git a/acceptance/bundle/resources/dashboards/simple_syncroot/test.toml b/acceptance/bundle/resources/dashboards/simple_syncroot/test.toml
index c1898ee8817..edc30b390e3 100644
--- a/acceptance/bundle/resources/dashboards/simple_syncroot/test.toml
+++ b/acceptance/bundle/resources/dashboards/simple_syncroot/test.toml
@@ -1,6 +1,4 @@
-Local = true
 Cloud = true
-RequiresWarehouse = true
 RecordRequests = false
 RunsOnDbr = true
 
@@ -9,7 +7,6 @@ Ignore = [
     "sample-dashboard.lvdash.json",
 ]
 
-
 [[Repls]]
 # Windows:
 Old = 'The system cannot find the file specified.'
diff --git a/acceptance/bundle/resources/dashboards/test.toml b/acceptance/bundle/resources/dashboards/test.toml
index d932390098f..c7131dd00e7 100644
--- a/acceptance/bundle/resources/dashboards/test.toml
+++ b/acceptance/bundle/resources/dashboards/test.toml
@@ -1,21 +1,17 @@
-Local = true
 Cloud = true
-RequiresWarehouse = true
 
-[EnvMatrix]
-  DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
-
-[Env]
 # MSYS2 automatically converts absolute paths like /Users/$username/$UNIQUE_NAME to
 # C:/Program Files/Git/Users/$username/UNIQUE_NAME before passing it to the CLI
 # Setting this environment variable prevents that conversion on windows.
-MSYS_NO_PATHCONV = "1"
-
-# Etag can be both negative and positive.
-[[Repls]]
-Old = "\"[-0-9]{8,}\""
-New = "[ETAG]"
+Env.MSYS_NO_PATHCONV = "1"
+# Direct-engine eventual consistency: the first GET of a freshly created dashboard
+# returns 404, so reads right after deploy must be retried (retry.py).
+Env.INJECT_STALE_ON_DIRECT = "1"
+# Widen retry.py's window well beyond its ~2s default (5 attempts x 500ms). retry.py's
+# loop is not scaled by TimeoutCIMultiplier (that only scales the overall test timeout),
+# and real dashboard rename/update eventual consistency on cloud regularly exceeds 2s,
+# which flaked these read-after-deploy checks. 20 attempts x 1000ms gives a ~20s window.
+Env.RETRY_MAX_ATTEMPTS = "20"
+Env.RETRY_INTERVAL_MS = "1000"
 
-[[Repls]]
-Old = "\"[0-9]{8,}\""
-New = "[ETAG]"
+Env.DATABRICKS_BUNDLE_ENGINE = "direct"
diff --git a/acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.get_published.terraform.txt b/acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.get_published.terraform.txt
deleted file mode 100644
index 82fdc2992ea..00000000000
--- a/acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.get_published.terraform.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-
->>> errcode [CLI] lakeview get-published [DASHBOARD1_ID]
-Error: Unable to find published dashboard [[DASHBOARD1_ID]]
-
-Exit code: 1
diff --git a/acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.get_published.direct.txt b/acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.get_published.txt
similarity index 100%
rename from acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.get_published.direct.txt
rename to acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.get_published.txt
diff --git a/acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.plan.direct.json b/acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.plan.direct.json
deleted file mode 100644
index 558a4ddcfd8..00000000000
--- a/acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.plan.direct.json
+++ /dev/null
@@ -1,56 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.dashboards.dashboard1": {
-      "action": "update",
-      "new_state": {
-        "value": {
-          "display_name": "test bundle-deploy-dashboard [UNIQUE_NAME]",
-          "embed_credentials": false,
-          "parent_path": "/Workspace/Users/[USERNAME]/.bundle/unpublish-out-of-band-[UNIQUE_NAME]/default/resources",
-          "published": true,
-          "serialized_dashboard": "{\"pages\":[{\"displayName\":\"Test Dashboard\",\"name\":\"test-page\"}]}",
-          "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
-        }
-      },
-      "remote_state": {
-        "create_time": "[TIMESTAMP]",
-        "dashboard_id": "[DASHBOARD1_ID]",
-        "display_name": "test bundle-deploy-dashboard [UNIQUE_NAME]",
-        "embed_credentials": false,
-        "etag": [ETAG],
-        "lifecycle_state": "ACTIVE",
-        "parent_path": "/Workspace/Users/[USERNAME]/.bundle/unpublish-out-of-band-[UNIQUE_NAME]/default/resources",
-        "path": "/Users/[USERNAME]/.bundle/unpublish-out-of-band-[UNIQUE_NAME]/default/resources/test bundle-deploy-dashboard [UNIQUE_NAME].lvdash.json",
-        "published": false,
-        "serialized_dashboard": "{\"pages\":[{\"displayName\":\"Test Dashboard\",\"name\":\"test-page\",\"pageType\":\"PAGE_TYPE_CANVAS\"}]}",
-        "update_time": "[TIMESTAMP]",
-        "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
-      },
-      "changes": {
-        "etag": {
-          "action": "skip",
-          "reason": "custom",
-          "old": [ETAG],
-          "remote": [ETAG]
-        },
-        "published": {
-          "action": "update",
-          "old": true,
-          "new": true,
-          "remote": false
-        },
-        "serialized_dashboard": {
-          "action": "skip",
-          "reason": "etag_based",
-          "old": "{\"pages\":[{\"displayName\":\"Test Dashboard\",\"name\":\"test-page\"}]}",
-          "new": "{\"pages\":[{\"displayName\":\"Test Dashboard\",\"name\":\"test-page\"}]}",
-          "remote": "{\"pages\":[{\"displayName\":\"Test Dashboard\",\"name\":\"test-page\",\"pageType\":\"PAGE_TYPE_CANVAS\"}]}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.plan.json b/acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.plan.json
new file mode 100644
index 00000000000..fadf6fe32eb
--- /dev/null
+++ b/acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.plan.json
@@ -0,0 +1,81 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.dashboards.dashboard1": {
+      "action": "update",
+      "new_state": {
+        "value": {
+          "display_name": "test bundle-deploy-dashboard [UNIQUE_NAME]",
+          "embed_credentials": false,
+          "parent_path": "/Workspace/Users/[USERNAME]/.bundle/unpublish-out-of-band-[UNIQUE_NAME]/default/resources",
+          "published": true,
+          "serialized_dashboard": "{\"pages\":[{\"displayName\":\"Test Dashboard\",\"name\":\"test-page\"}]}",
+          "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
+        }
+      },
+      "remote_state": {
+        "create_time": "[TIMESTAMP]",
+        "dashboard_id": "[DASHBOARD1_ID]",
+        "display_name": "test bundle-deploy-dashboard [UNIQUE_NAME]",
+        "embed_credentials": false,
+        "etag": "[ETAG]",
+        "lifecycle_state": "ACTIVE",
+        "parent_path": "/Workspace/Users/[USERNAME]/.bundle/unpublish-out-of-band-[UNIQUE_NAME]/default/resources",
+        "path": "/Users/[USERNAME]/.bundle/unpublish-out-of-band-[UNIQUE_NAME]/default/resources/test bundle-deploy-dashboard [UNIQUE_NAME].lvdash.json",
+        "published": false,
+        "serialized_dashboard": "{\"pages\":[{\"displayName\":\"Test Dashboard\",\"name\":\"test-page\",\"pageType\":\"PAGE_TYPE_CANVAS\"}]}",
+        "update_time": "[TIMESTAMP]",
+        "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
+      },
+      "changes": {
+        "create_time": {
+          "action": "skip",
+          "reason": "spec:output_only",
+          "remote": "[TIMESTAMP]"
+        },
+        "dashboard_id": {
+          "action": "skip",
+          "reason": "spec:output_only",
+          "remote": "[DASHBOARD1_ID]"
+        },
+        "etag": {
+          "action": "skip",
+          "reason": "custom",
+          "old": "[ETAG]",
+          "remote": "[ETAG]"
+        },
+        "lifecycle_state": {
+          "action": "skip",
+          "reason": "spec:output_only",
+          "remote": "ACTIVE"
+        },
+        "path": {
+          "action": "skip",
+          "reason": "spec:output_only",
+          "remote": "/Users/[USERNAME]/.bundle/unpublish-out-of-band-[UNIQUE_NAME]/default/resources/test bundle-deploy-dashboard [UNIQUE_NAME].lvdash.json"
+        },
+        "published": {
+          "action": "update",
+          "old": true,
+          "new": true,
+          "remote": false
+        },
+        "serialized_dashboard": {
+          "action": "skip",
+          "reason": "etag_based",
+          "old": "{\"pages\":[{\"displayName\":\"Test Dashboard\",\"name\":\"test-page\"}]}",
+          "new": "{\"pages\":[{\"displayName\":\"Test Dashboard\",\"name\":\"test-page\"}]}",
+          "remote": "sha256:[HASH]"
+        },
+        "update_time": {
+          "action": "skip",
+          "reason": "spec:output_only",
+          "remote": "[TIMESTAMP]"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.plan.terraform.json b/acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.plan.terraform.json
deleted file mode 100644
index 01caf158011..00000000000
--- a/acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.plan.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.dashboards.dashboard1": {
-      "action": "skip"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.plan.direct.txt b/acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.plan.txt
similarity index 100%
rename from acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.plan.direct.txt
rename to acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.plan.txt
diff --git a/acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.plan_initial.direct.json b/acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.plan_initial.direct.json
deleted file mode 100644
index b0591401f44..00000000000
--- a/acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.plan_initial.direct.json
+++ /dev/null
@@ -1,19 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.dashboards.dashboard1": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "display_name": "test bundle-deploy-dashboard [UNIQUE_NAME]",
-          "embed_credentials": false,
-          "parent_path": "/Workspace/Users/[USERNAME]/.bundle/unpublish-out-of-band-[UNIQUE_NAME]/default/resources",
-          "published": true,
-          "serialized_dashboard": "{\"pages\":[{\"name\":\"test-page\",\"displayName\":\"Test Dashboard\"}]}\n",
-          "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.plan_initial.json b/acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.plan_initial.json
new file mode 100644
index 00000000000..1584efd2131
--- /dev/null
+++ b/acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.plan_initial.json
@@ -0,0 +1,19 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.dashboards.dashboard1": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "display_name": "test bundle-deploy-dashboard [UNIQUE_NAME]",
+          "embed_credentials": false,
+          "parent_path": "/Workspace/Users/[USERNAME]/.bundle/unpublish-out-of-band-[UNIQUE_NAME]/default/resources",
+          "published": true,
+          "serialized_dashboard": "{\"pages\":[{\"name\":\"test-page\",\"displayName\":\"Test Dashboard\"}]}\n",
+          "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.plan_initial.terraform.json b/acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.plan_initial.terraform.json
deleted file mode 100644
index 9ca4538b727..00000000000
--- a/acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.plan_initial.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.dashboards.dashboard1": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.state.direct.json b/acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.state.json
similarity index 100%
rename from acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.state.direct.json
rename to acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.state.json
diff --git a/acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.state.terraform.json b/acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.state.terraform.json
deleted file mode 100644
index 2852fcd2935..00000000000
--- a/acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.state.terraform.json
+++ /dev/null
@@ -1,2 +0,0 @@
-            "parent_path": "/Users/[USERNAME]/.bundle/unpublish-out-of-band-[UNIQUE_NAME]/default/resources",
-            "path": "/Users/[USERNAME]/.bundle/unpublish-out-of-band-[UNIQUE_NAME]/default/resources/test bundle-deploy-dashboard [UNIQUE_NAME].lvdash.json",
diff --git a/acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.test.toml b/acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.test.toml
index 7edd52865f7..98ccab9aaeb 100644
--- a/acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.test.toml
+++ b/acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.test.toml
@@ -1,5 +1,3 @@
-Local = true
 Cloud = true
-RequiresWarehouse = true
 RunsOnDbr = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/dashboards/unpublish-out-of-band/output.txt b/acceptance/bundle/resources/dashboards/unpublish-out-of-band/output.txt
index d99c59e81be..5639bb2a465 100644
--- a/acceptance/bundle/resources/dashboards/unpublish-out-of-band/output.txt
+++ b/acceptance/bundle/resources/dashboards/unpublish-out-of-band/output.txt
@@ -1,11 +1,7 @@
 
 >>> [CLI] bundle plan -o json
 
->>> [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/unpublish-out-of-band-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+>>> [CLI] bundle deploy -qq
 
 >>> print_state.py
 
@@ -18,8 +14,4 @@ Deployment complete!
 
 >>> [CLI] bundle plan
 
->>> [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/unpublish-out-of-band-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+>>> [CLI] bundle deploy -qq
diff --git a/acceptance/bundle/resources/dashboards/unpublish-out-of-band/script b/acceptance/bundle/resources/dashboards/unpublish-out-of-band/script
index 3e75d6d0a9a..f41bee7b917 100644
--- a/acceptance/bundle/resources/dashboards/unpublish-out-of-band/script
+++ b/acceptance/bundle/resources/dashboards/unpublish-out-of-band/script
@@ -6,13 +6,16 @@ cleanup() {
 }
 trap cleanup EXIT
 
-trace $CLI bundle plan -o json > out.plan_initial.$DATABRICKS_BUNDLE_ENGINE.json
+# Save raw plan (with DMS headers), then apply nostamp for golden file
+trace $CLI bundle plan -o json > plan_raw_initial.json
+cat plan_raw_initial.json | nostamp > out.plan_initial.json
 
 # Deploy the dashboard
-trace $CLI bundle deploy
+trace $CLI bundle deploy -qq
 DASHBOARD_ID=$(read_id.py dashboard1)
+add_repl "$(retry $CLI lakeview get $DASHBOARD_ID | jq -r '.etag')" ETAG
 
-trace print_state.py | grep publish > out.state.$DATABRICKS_BUNDLE_ENGINE.json
+trace print_state.py | grep publish > out.state.json
 
 # Verify dashboard was deployed and is published
 trace $CLI lakeview get-published $DASHBOARD_ID | jq '{embed_credentials}'
@@ -22,11 +25,13 @@ trace $CLI lakeview unpublish $DASHBOARD_ID
 
 # Terraform: shows "skip" because it only reads draft state, not published state
 # Direct: shows "update" because Published field changes from false to true
-trace $CLI bundle plan > out.plan.$DATABRICKS_BUNDLE_ENGINE.txt
+trace $CLI bundle plan > out.plan.txt
 
-$CLI bundle plan -o json > out.plan.$DATABRICKS_BUNDLE_ENGINE.json
-json_in_json_normalize.py out.plan.$DATABRICKS_BUNDLE_ENGINE.json
+# Save raw plan (with DMS headers), then apply nostamp for golden file
+$CLI bundle plan -o json > plan_raw.json
+cat plan_raw.json | nostamp > out.plan.json
+json_in_json_normalize.py out.plan.json
 
-trace $CLI bundle deploy
+trace $CLI bundle deploy -qq
 
-trace errcode $CLI lakeview get-published $DASHBOARD_ID &> out.get_published.$DATABRICKS_BUNDLE_ENGINE.txt
+trace errcode $CLI lakeview get-published $DASHBOARD_ID &> out.get_published.txt
diff --git a/acceptance/bundle/resources/dashboards/unpublish-out-of-band/test.toml b/acceptance/bundle/resources/dashboards/unpublish-out-of-band/test.toml
index 819b4103890..22c43d1363e 100644
--- a/acceptance/bundle/resources/dashboards/unpublish-out-of-band/test.toml
+++ b/acceptance/bundle/resources/dashboards/unpublish-out-of-band/test.toml
@@ -1,9 +1,9 @@
-Local = true
 Cloud = true
-RequiresWarehouse = true
 RecordRequests = false
 RunsOnDbr = true
 
 Ignore = [
     "databricks.yml",
+    "plan_raw_initial.json",
+    "plan_raw.json",
 ]
diff --git a/acceptance/bundle/resources/database_catalogs/basic/out.test.toml b/acceptance/bundle/resources/database_catalogs/basic/out.test.toml
index 1f9d1fc1b75..7ce718742f8 100644
--- a/acceptance/bundle/resources/database_catalogs/basic/out.test.toml
+++ b/acceptance/bundle/resources/database_catalogs/basic/out.test.toml
@@ -1,7 +1,5 @@
-Local = true
 Cloud = true
 CloudSlow = true
-RequiresUnityCatalog = true
 RunsOnDbr = true
 CloudEnvs.gcp = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/database_catalogs/basic/output.txt b/acceptance/bundle/resources/database_catalogs/basic/output.txt
index ce8eb0746eb..31fbf8cc88e 100644
--- a/acceptance/bundle/resources/database_catalogs/basic/output.txt
+++ b/acceptance/bundle/resources/database_catalogs/basic/output.txt
@@ -24,9 +24,10 @@ Resources:
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-lakebase-catalog-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created database_catalogs.my_catalog
+Created database_instances.my_instance
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle summary
 Name: deploy-lakebase-catalog-[UNIQUE_NAME]
@@ -53,5 +54,4 @@ All data stored in them will be permanently lost:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-lakebase-catalog-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/database_catalogs/basic/test.toml b/acceptance/bundle/resources/database_catalogs/basic/test.toml
index 8d789f1c2c6..832f9c688ab 100644
--- a/acceptance/bundle/resources/database_catalogs/basic/test.toml
+++ b/acceptance/bundle/resources/database_catalogs/basic/test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 
 # Mitigates running into quota limits in workspaces
diff --git a/acceptance/bundle/resources/database_catalogs/recreate/databricks.yml.tmpl b/acceptance/bundle/resources/database_catalogs/recreate/databricks.yml.tmpl
new file mode 100644
index 00000000000..8d19b470d8b
--- /dev/null
+++ b/acceptance/bundle/resources/database_catalogs/recreate/databricks.yml.tmpl
@@ -0,0 +1,14 @@
+bundle:
+  name: deploy-lakebase-catalog-recreate-$UNIQUE_NAME
+
+resources:
+  database_instances:
+    my_instance:
+      name: test-db-catalog-recreate-$UNIQUE_NAME
+      capacity: CU_1
+  database_catalogs:
+    my_catalog:
+      database_instance_name: ${resources.database_instances.my_instance.name}
+      database_name: DBNAME_PLACEHOLDER
+      name: my_catalog_$UNIQUE_NAME
+      create_database_if_not_exists: true
diff --git a/acceptance/bundle/resources/database_catalogs/recreate/out.requests.recreate.txt b/acceptance/bundle/resources/database_catalogs/recreate/out.requests.recreate.txt
new file mode 100644
index 00000000000..f310847f609
--- /dev/null
+++ b/acceptance/bundle/resources/database_catalogs/recreate/out.requests.recreate.txt
@@ -0,0 +1,14 @@
+{
+  "method": "DELETE",
+  "path": "/api/2.0/database/catalogs/my_catalog_[UNIQUE_NAME]"
+}
+{
+  "body": {
+    "create_database_if_not_exists": true,
+    "database_instance_name": "test-db-catalog-recreate-[UNIQUE_NAME]",
+    "database_name": "my_database_v2",
+    "name": "my_catalog_[UNIQUE_NAME]"
+  },
+  "method": "POST",
+  "path": "/api/2.0/database/catalogs"
+}
diff --git a/acceptance/bundle/resources/database_catalogs/recreate/out.test.toml b/acceptance/bundle/resources/database_catalogs/recreate/out.test.toml
new file mode 100644
index 00000000000..f7840b7a1df
--- /dev/null
+++ b/acceptance/bundle/resources/database_catalogs/recreate/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/database_catalogs/recreate/output.txt b/acceptance/bundle/resources/database_catalogs/recreate/output.txt
new file mode 100644
index 00000000000..40b7bf2adec
--- /dev/null
+++ b/acceptance/bundle/resources/database_catalogs/recreate/output.txt
@@ -0,0 +1,32 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-lakebase-catalog-recreate-[UNIQUE_NAME]/default/files...
+Created database_catalogs.my_catalog
+Created database_instances.my_instance
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Change an immutable catalog field: no update API, so the plan recreates it
+>>> [CLI] bundle plan
+recreate database_catalogs.my_catalog
+
+Plan: 1 to add, 0 to change, 1 to delete, 1 unchanged
+
+>>> [CLI] bundle deploy --auto-approve
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-lakebase-catalog-recreate-[UNIQUE_NAME]/default/files...
+Recreated database_catalogs.my_catalog
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 1 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.database_catalogs.my_catalog
+  delete resources.database_instances.my_instance
+
+This action will result in the deletion of the following Lakebase database instances.
+All data stored in them will be permanently lost:
+  delete resources.database_instances.my_instance
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-lakebase-catalog-recreate-[UNIQUE_NAME]/default
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/database_catalogs/recreate/script b/acceptance/bundle/resources/database_catalogs/recreate/script
new file mode 100644
index 00000000000..893d9965553
--- /dev/null
+++ b/acceptance/bundle/resources/database_catalogs/recreate/script
@@ -0,0 +1,22 @@
+cleanup() {
+   trace $CLI bundle destroy --auto-approve
+   rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+envsubst < databricks.yml.tmpl | sed "s/DBNAME_PLACEHOLDER/my_database/" > databricks.yml
+
+trace $CLI bundle deploy
+rm -f "$OUT_REQUESTS"
+
+title "Change an immutable catalog field: no update API, so the plan recreates it"
+sed "s/my_database/my_database_v2/" databricks.yml > databricks.yml.new
+mv databricks.yml.new databricks.yml
+
+trace $CLI bundle plan
+trace $CLI bundle deploy --auto-approve
+
+# The change must be a DELETE of the old catalog plus a POST creating the new
+# one. A PATCH would return 501 (the bug this guards against).
+jq --sort-keys 'select(.method != "GET" and (.path | contains("/database/catalogs")))' < "$OUT_REQUESTS" > out.requests.recreate.txt
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/resources/database_catalogs/recreate/test.toml b/acceptance/bundle/resources/database_catalogs/recreate/test.toml
new file mode 100644
index 00000000000..3fc85054798
--- /dev/null
+++ b/acceptance/bundle/resources/database_catalogs/recreate/test.toml
@@ -0,0 +1,9 @@
+# The Database API has no UpdateDatabaseCatalog endpoint (PATCH returns 501), so
+# any field change must go through delete + create. The direct engine handles
+# this; the terraform path would need an upstream provider fix and is excluded.
+RecordRequests = true
+
+Ignore = [
+    "databricks.yml",
+    ".databricks",
+]
diff --git a/acceptance/bundle/resources/database_catalogs/test.toml b/acceptance/bundle/resources/database_catalogs/test.toml
index f0f6b0aa8cf..3653389f26d 100644
--- a/acceptance/bundle/resources/database_catalogs/test.toml
+++ b/acceptance/bundle/resources/database_catalogs/test.toml
@@ -1,2 +1 @@
-RequiresUnityCatalog = true
 CloudEnvs.gcp = false # lakebase is not available in GCP as of August 2025
diff --git a/acceptance/bundle/resources/database_instances/recreate/databricks.yml.tmpl b/acceptance/bundle/resources/database_instances/recreate/databricks.yml.tmpl
new file mode 100644
index 00000000000..e814a11b2d8
--- /dev/null
+++ b/acceptance/bundle/resources/database_instances/recreate/databricks.yml.tmpl
@@ -0,0 +1,11 @@
+bundle:
+  name: deploy-lakebase-recreate-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  database_instances:
+    my_database:
+      name: NAME_PLACEHOLDER
+      capacity: CU_1
diff --git a/acceptance/bundle/resources/database_instances/recreate/out.requests.rename.txt b/acceptance/bundle/resources/database_instances/recreate/out.requests.rename.txt
new file mode 100644
index 00000000000..ee03f77e80d
--- /dev/null
+++ b/acceptance/bundle/resources/database_instances/recreate/out.requests.rename.txt
@@ -0,0 +1,15 @@
+{
+  "method": "DELETE",
+  "path": "/api/2.0/database/instances/test-db-old-[UNIQUE_NAME]",
+  "q": {
+    "purge": "true"
+  }
+}
+{
+  "body": {
+    "capacity": "CU_1",
+    "name": "test-db-new-[UNIQUE_NAME]"
+  },
+  "method": "POST",
+  "path": "/api/2.0/database/instances"
+}
diff --git a/acceptance/bundle/resources/database_instances/recreate/out.test.toml b/acceptance/bundle/resources/database_instances/recreate/out.test.toml
new file mode 100644
index 00000000000..f7840b7a1df
--- /dev/null
+++ b/acceptance/bundle/resources/database_instances/recreate/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/database_instances/recreate/output.txt b/acceptance/bundle/resources/database_instances/recreate/output.txt
new file mode 100644
index 00000000000..dc6c194d76f
--- /dev/null
+++ b/acceptance/bundle/resources/database_instances/recreate/output.txt
@@ -0,0 +1,34 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-lakebase-recreate-[UNIQUE_NAME]/default/files...
+Created database_instances.my_database
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Rename the instance: name is immutable, so the plan recreates it
+>>> [CLI] bundle plan
+recreate database_instances.my_database
+
+Plan: 1 to add, 0 to change, 1 to delete, 0 unchanged
+
+>>> [CLI] bundle deploy --auto-approve
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-lakebase-recreate-[UNIQUE_NAME]/default/files...
+
+This action will result in the deletion or recreation of the following Lakebase database instances.
+All data stored in them will be permanently lost:
+  recreate resources.database_instances.my_database
+Recreated database_instances.my_database
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 0 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.database_instances.my_database
+
+This action will result in the deletion of the following Lakebase database instances.
+All data stored in them will be permanently lost:
+  delete resources.database_instances.my_database
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-lakebase-recreate-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/database_instances/recreate/script b/acceptance/bundle/resources/database_instances/recreate/script
new file mode 100644
index 00000000000..a30de3c86cf
--- /dev/null
+++ b/acceptance/bundle/resources/database_instances/recreate/script
@@ -0,0 +1,22 @@
+cleanup() {
+   trace $CLI bundle destroy --auto-approve
+   rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+envsubst < databricks.yml.tmpl | sed "s/NAME_PLACEHOLDER/test-db-old-${UNIQUE_NAME}/" > databricks.yml
+
+trace $CLI bundle deploy
+rm -f "$OUT_REQUESTS"
+
+title "Rename the instance: name is immutable, so the plan recreates it"
+sed "s/test-db-old-${UNIQUE_NAME}/test-db-new-${UNIQUE_NAME}/" databricks.yml > databricks.yml.new
+mv databricks.yml.new databricks.yml
+
+trace $CLI bundle plan
+trace $CLI bundle deploy --auto-approve
+
+# The rename must be a DELETE of the old instance plus a POST creating the new
+# one. A PATCH to the renamed instance would 404 (the bug this guards against).
+jq --sort-keys 'select(.method != "GET" and (.path | contains("/database/instances")))' < "$OUT_REQUESTS" > out.requests.rename.txt
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/resources/database_instances/recreate/test.toml b/acceptance/bundle/resources/database_instances/recreate/test.toml
new file mode 100644
index 00000000000..e4f979e5aa0
--- /dev/null
+++ b/acceptance/bundle/resources/database_instances/recreate/test.toml
@@ -0,0 +1,10 @@
+# A database instance name is immutable and the Database API has no rename
+# endpoint, so changing it must go through delete + create. Only the direct
+# engine handles this correctly; the terraform path needs an upstream provider
+# fix (marking name immutable in the spec) and is excluded here.
+RecordRequests = true
+
+Ignore = [
+    "databricks.yml",
+    ".databricks",
+]
diff --git a/acceptance/bundle/resources/database_instances/script.prepare b/acceptance/bundle/resources/database_instances/script.prepare
new file mode 100644
index 00000000000..ddfaf2b6b48
--- /dev/null
+++ b/acceptance/bundle/resources/database_instances/script.prepare
@@ -0,0 +1,6 @@
+# database_instance_fields is the allow-list of database-instance fields the
+# acceptance tests assert on. Anything the backend returns outside this list is
+# dropped, so a new field in the API response does not break the golden.
+database_instance_fields() {
+    jq '{capacity, creation_time, creator, effective_capacity, effective_enable_pg_native_login, effective_enable_readable_secondaries, effective_node_count, effective_retention_window_in_days, effective_stopped, name, pg_version, state, uid}'
+}
diff --git a/acceptance/bundle/resources/database_instances/single-instance/out.test.toml b/acceptance/bundle/resources/database_instances/single-instance/out.test.toml
index 12ab4ea7f78..7c3dd4f02ef 100644
--- a/acceptance/bundle/resources/database_instances/single-instance/out.test.toml
+++ b/acceptance/bundle/resources/database_instances/single-instance/out.test.toml
@@ -1,6 +1,4 @@
-Local = true
 Cloud = true
 CloudSlow = true
-RequiresUnityCatalog = true
 CloudEnvs.gcp = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/database_instances/single-instance/output.txt b/acceptance/bundle/resources/database_instances/single-instance/output.txt
index e6b8b506a71..7fe22e1aca6 100644
--- a/acceptance/bundle/resources/database_instances/single-instance/output.txt
+++ b/acceptance/bundle/resources/database_instances/single-instance/output.txt
@@ -22,9 +22,9 @@ Resources:
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-lakebase-single-instance-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created database_instances.my_database
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] database get-database-instance test-db-instance-single-[UNIQUE_NAME]
 {
@@ -65,5 +65,4 @@ All data stored in them will be permanently lost:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-lakebase-single-instance-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/database_instances/single-instance/script b/acceptance/bundle/resources/database_instances/single-instance/script
index 5f64fd2fcd3..1f3cb82511f 100644
--- a/acceptance/bundle/resources/database_instances/single-instance/script
+++ b/acceptance/bundle/resources/database_instances/single-instance/script
@@ -25,6 +25,6 @@ for i in {1..10}; do
 done
 
 # _dns fields are excluded since they differ between cloud envs
-trace $CLI database get-database-instance "test-db-instance-single-${UNIQUE_NAME}" | jq 'del(.read_only_dns, .read_write_dns)'
+trace $CLI database get-database-instance "test-db-instance-single-${UNIQUE_NAME}" | database_instance_fields
 
 trace $CLI bundle summary
diff --git a/acceptance/bundle/resources/database_instances/single-instance/test.toml b/acceptance/bundle/resources/database_instances/single-instance/test.toml
index 4640b352cfa..ef8d35d14b4 100644
--- a/acceptance/bundle/resources/database_instances/single-instance/test.toml
+++ b/acceptance/bundle/resources/database_instances/single-instance/test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 
 # Mitigates running into quota limits in workspaces
@@ -9,7 +8,7 @@ Ignore = [
 ]
 
 [[Repls]]
-# clean up ?o=<num> suffix after URL since not all workspaces have that
-Old = '\?o=\[(NUMID|ALPHANUMID)\]'
+# clean up ?[ow]=<num> suffix after URL since not all workspaces have that
+Old = '\?[ow]=\[(WORKSPACE_ID|ALPHANUMID)\]'
 New = ''
 Order = 1000
diff --git a/acceptance/bundle/resources/database_instances/test.toml b/acceptance/bundle/resources/database_instances/test.toml
index 1a4b0a2a1dd..9b0a8a115f2 100644
--- a/acceptance/bundle/resources/database_instances/test.toml
+++ b/acceptance/bundle/resources/database_instances/test.toml
@@ -1,3 +1,2 @@
-RequiresUnityCatalog = true
 RecordRequests = false
 CloudEnvs.gcp = false # lakebase is not available in GCP as of August 2025
diff --git a/acceptance/bundle/resources/experiments/basic/out.plan.direct.txt b/acceptance/bundle/resources/experiments/basic/out.plan.direct.txt
deleted file mode 100644
index c54c9d511c0..00000000000
--- a/acceptance/bundle/resources/experiments/basic/out.plan.direct.txt
+++ /dev/null
@@ -1 +0,0 @@
-Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
diff --git a/acceptance/bundle/resources/experiments/basic/out.plan.terraform.txt b/acceptance/bundle/resources/experiments/basic/out.plan.terraform.txt
deleted file mode 100644
index 986d3cf68cd..00000000000
--- a/acceptance/bundle/resources/experiments/basic/out.plan.terraform.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-update experiments.my_experiment
-
-Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
diff --git a/acceptance/bundle/resources/dashboards/change-parent-path/out.plan_after_deploy.terraform.txt b/acceptance/bundle/resources/experiments/basic/out.plan.txt
similarity index 100%
rename from acceptance/bundle/resources/dashboards/change-parent-path/out.plan_after_deploy.terraform.txt
rename to acceptance/bundle/resources/experiments/basic/out.plan.txt
diff --git a/acceptance/bundle/resources/experiments/basic/out.test.toml b/acceptance/bundle/resources/experiments/basic/out.test.toml
index 5ad0addb75e..98ccab9aaeb 100644
--- a/acceptance/bundle/resources/experiments/basic/out.test.toml
+++ b/acceptance/bundle/resources/experiments/basic/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 RunsOnDbr = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/experiments/basic/output.txt b/acceptance/bundle/resources/experiments/basic/output.txt
index 4b5fd591dfe..fc5ad8ebb98 100644
--- a/acceptance/bundle/resources/experiments/basic/output.txt
+++ b/acceptance/bundle/resources/experiments/basic/output.txt
@@ -11,13 +11,9 @@ create experiments.my_experiment
 
 Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
 
->>> [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/experiment-basic-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+>>> [CLI] bundle deploy -qq
 
->>> [CLI] experiments get-experiment [NUMID]
+>>> [CLI] experiments get-experiment [MY_EXPERIMENT_ID]
 {
   "name": "/Users/[USERNAME]/original-[UNIQUE_NAME]",
   "artifact_location": "s3://original-[UNIQUE_NAME]",
@@ -59,13 +55,9 @@ update experiments.my_experiment
 
 Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
 
->>> [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/experiment-basic-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+>>> [CLI] bundle deploy -qq
 
->>> [CLI] experiments get-experiment [NUMID]
+>>> [CLI] experiments get-experiment [MY_EXPERIMENT_ID]
 {
   "name": "/Users/[USERNAME]/new-name-[UNIQUE_NAME]",
   "artifact_location": "s3://original-[UNIQUE_NAME]",
@@ -107,13 +99,9 @@ recreate experiments.my_experiment
 
 Plan: 1 to add, 0 to change, 1 to delete, 0 unchanged
 
->>> [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/experiment-basic-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+>>> [CLI] bundle deploy -qq
 
->>> [CLI] experiments get-experiment [NUMID]
+>>> [CLI] experiments get-experiment [MY_EXPERIMENT_ID_3]
 {
   "name": "/Users/[USERNAME]/new-name-[UNIQUE_NAME]",
   "artifact_location": "s3://new-[UNIQUE_NAME]",
@@ -150,13 +138,9 @@ Deployment complete!
 
 >>> [CLI] bundle plan
 
->>> [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/experiment-basic-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+>>> [CLI] bundle deploy -qq
 
->>> [CLI] experiments get-experiment [NUMID]
+>>> [CLI] experiments get-experiment [MY_EXPERIMENT_ID_3]
 {
   "name": "/Users/[USERNAME]/new-name-[UNIQUE_NAME]",
   "artifact_location": "s3://new-[UNIQUE_NAME]",
@@ -194,5 +178,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/experiment-basic-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/experiments/basic/script b/acceptance/bundle/resources/experiments/basic/script
index 6bb96db86db..ab6ca3de78d 100755
--- a/acceptance/bundle/resources/experiments/basic/script
+++ b/acceptance/bundle/resources/experiments/basic/script
@@ -9,29 +9,29 @@ trace export EXPERIMENT_ARTIFACT_LOCATION="s3://original-${UNIQUE_NAME}"
 trace export EXPERIMENT_NAME_PREFIX="original"
 trace envsubst < templates/one_tag.tmpl > databricks.yml
 trace $CLI bundle plan
-trace $CLI bundle deploy
-experiment_id=$($CLI bundle summary --output json | jq -r '.resources.experiments.my_experiment.id')
+trace $CLI bundle deploy -qq
+experiment_id=$(read_id.py my_experiment)
 trace $CLI experiments get-experiment $experiment_id | jq '.experiment | {name, artifact_location, tags}'
 
 title "update the name"
 trace export EXPERIMENT_NAME_PREFIX="new-name"
 trace envsubst < templates/one_tag.tmpl > databricks.yml
 trace $CLI bundle plan
-trace $CLI bundle deploy
-experiment_id=$($CLI bundle summary --output json | jq -r '.resources.experiments.my_experiment.id')
+trace $CLI bundle deploy -qq
+experiment_id=$(read_id.py my_experiment)
 trace $CLI experiments get-experiment $experiment_id | jq '.experiment | {name, artifact_location, tags}'
 
 title "updating the artifact location should cause a recreation"
 trace export EXPERIMENT_ARTIFACT_LOCATION="s3://new-${UNIQUE_NAME}"
 trace envsubst < templates/one_tag.tmpl > databricks.yml
 trace $CLI bundle plan
-trace $CLI bundle deploy
-experiment_id=$($CLI bundle summary --output json | jq -r '.resources.experiments.my_experiment.id')
+trace $CLI bundle deploy -qq
+experiment_id=$(read_id.py my_experiment)
 trace $CLI experiments get-experiment $experiment_id | jq '.experiment | {name, artifact_location, tags}'
 
 title "adding a new tag should be a no-op"
 trace envsubst < templates/two_tag.tmpl > databricks.yml
-trace $CLI bundle plan > out.plan.$DATABRICKS_BUNDLE_ENGINE.txt
-trace $CLI bundle deploy
-experiment_id=$($CLI bundle summary --output json | jq -r '.resources.experiments.my_experiment.id')
+trace $CLI bundle plan > out.plan.txt
+trace $CLI bundle deploy -qq
+experiment_id=$(read_id.py my_experiment)
 trace $CLI experiments get-experiment $experiment_id | jq '.experiment | {name, artifact_location, tags}'
diff --git a/acceptance/bundle/resources/experiments/basic/test.toml b/acceptance/bundle/resources/experiments/basic/test.toml
index 89f6a633e94..7d7ae48db25 100644
--- a/acceptance/bundle/resources/experiments/basic/test.toml
+++ b/acceptance/bundle/resources/experiments/basic/test.toml
@@ -1,8 +1,3 @@
 Cloud = true
-Local = true
 RecordRequests = false
 RunsOnDbr = true
-
-[[Repls]]
-Old = '\d{3,}'
-New = "[NUMID]"
diff --git a/acceptance/bundle/resources/external_locations/comment_cleared/databricks.yml b/acceptance/bundle/resources/external_locations/comment_cleared/databricks.yml
new file mode 100644
index 00000000000..f7cd8e3811d
--- /dev/null
+++ b/acceptance/bundle/resources/external_locations/comment_cleared/databricks.yml
@@ -0,0 +1,10 @@
+bundle:
+  name: test-bundle
+
+resources:
+  external_locations:
+    location1:
+      name: myloc
+      url: s3://test-bucket/path
+      credential_name: test_storage_credential
+      comment: declared in the bundle
diff --git a/acceptance/bundle/resources/external_locations/comment_cleared/out.test.toml b/acceptance/bundle/resources/external_locations/comment_cleared/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/external_locations/comment_cleared/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/external_locations/comment_cleared/output.txt b/acceptance/bundle/resources/external_locations/comment_cleared/output.txt
new file mode 100644
index 00000000000..a7b39cb324d
--- /dev/null
+++ b/acceptance/bundle/resources/external_locations/comment_cleared/output.txt
@@ -0,0 +1,42 @@
+
+=== Deploy with a comment
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created external_locations.location1
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Remove the comment from the configuration and redeploy
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Updated external_locations.location1
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+=== The comment the bundle no longer declares
+>>> [CLI] api get /api/2.1/unity-catalog/external-locations/myloc
+""
+
+=== Redeploy
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+=== The UpdateExternalLocation payloads the deploys sent
+>>> print_requests.py --method PATCH //external-locations
+{
+  "method": "PATCH",
+  "path": "/api/2.1/unity-catalog/external-locations/myloc",
+  "body": {
+    "comment": "",
+    "credential_name": "test_storage_credential",
+    "url": "s3://test-bucket/path"
+  }
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.external_locations.location1
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/external_locations/comment_cleared/script b/acceptance/bundle/resources/external_locations/comment_cleared/script
new file mode 100644
index 00000000000..cebfa91eed7
--- /dev/null
+++ b/acceptance/bundle/resources/external_locations/comment_cleared/script
@@ -0,0 +1,24 @@
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+
+    # Consume the destroy's requests so none are left recorded.
+    print_requests.py --method PATCH //external-locations &> LOG.destroy_requests
+}
+trap cleanup EXIT
+
+title "Deploy with a comment"
+trace $CLI bundle deploy
+
+title "Remove the comment from the configuration and redeploy"
+update_file.py databricks.yml 'comment: declared in the bundle' ''
+trace $CLI bundle deploy
+
+title "The comment the bundle no longer declares"
+MSYS_NO_PATHCONV=1 trace $CLI api get "/api/2.1/unity-catalog/external-locations/myloc" | jq '.comment'
+
+title "Redeploy"
+trace $CLI bundle plan
+
+title "The UpdateExternalLocation payloads the deploys sent"
+trace print_requests.py --method PATCH //external-locations
diff --git a/acceptance/bundle/resources/external_locations/comment_cleared/test.toml b/acceptance/bundle/resources/external_locations/comment_cleared/test.toml
new file mode 100644
index 00000000000..7975e770d90
--- /dev/null
+++ b/acceptance/bundle/resources/external_locations/comment_cleared/test.toml
@@ -0,0 +1,13 @@
+# External locations need real storage credentials with cloud IAM setup, so this
+# only runs against the mock server (same as the parent test).
+Cloud = false
+# The parent test disables request recording; this one asserts on the payload.
+RecordRequests = true
+
+# UpdateExternalLocation payload construction is direct-engine-specific.
+
+Ignore = [
+    ".databricks",
+    ".gitignore",
+    "databricks.yml",
+]
diff --git a/acceptance/bundle/resources/external_locations/out.test.toml b/acceptance/bundle/resources/external_locations/out.test.toml
index 88423408186..a927a5fbc06 100644
--- a/acceptance/bundle/resources/external_locations/out.test.toml
+++ b/acceptance/bundle/resources/external_locations/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = false
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/external_locations/output.txt b/acceptance/bundle/resources/external_locations/output.txt
index c69c74e2c76..56858719e8e 100644
--- a/acceptance/bundle/resources/external_locations/output.txt
+++ b/acceptance/bundle/resources/external_locations/output.txt
@@ -10,9 +10,12 @@ Plan: 4 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created catalogs.test_catalog
+Created catalogs.test_catalog.grants
+Created external_locations.test_location
+Created external_locations.test_location.grants
+Files: 5 uploaded, 0 deleted
+Resources: 4 created, 0 changed, 0 deleted, 0 unchanged
 
 === Assert the catalog is created with grants
 >>> [CLI] catalogs get test_catalog_[UNIQUE_NAME]
@@ -68,9 +71,9 @@ Plan: 0 to add, 1 to change, 0 to delete, 3 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated external_locations.test_location
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 3 unchanged
 
 === Assert the external location comment is updated
 >>> [CLI] external-locations get test_ext_location_[UNIQUE_NAME]
@@ -88,9 +91,9 @@ Plan: 0 to add, 1 to change, 0 to delete, 3 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated catalogs.test_catalog
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 3 unchanged
 
 === Assert the catalog comment is updated
 >>> [CLI] catalogs get test_catalog_[UNIQUE_NAME]
@@ -107,5 +110,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/external_locations/test.toml b/acceptance/bundle/resources/external_locations/test.toml
index 55cc7b681f5..7c22912f15e 100644
--- a/acceptance/bundle/resources/external_locations/test.toml
+++ b/acceptance/bundle/resources/external_locations/test.toml
@@ -1,14 +1,9 @@
-Local = true
 # External locations require actual storage credentials with cloud IAM setup
 # which are environment-specific, so we only test locally with the mock server
 Cloud = false
 RecordRequests = false
-RequiresUnityCatalog = true
 
 Ignore = [
     ".databricks",
     "databricks.yml",
 ]
-
-[EnvMatrix]
-  DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/resources/features/basic/databricks.yml b/acceptance/bundle/resources/features/basic/databricks.yml
new file mode 100644
index 00000000000..cab7152110b
--- /dev/null
+++ b/acceptance/bundle/resources/features/basic/databricks.yml
@@ -0,0 +1,23 @@
+bundle:
+  name: test-bundle
+
+resources:
+  features:
+    feature1:
+      full_name: main.myschema.myfeature
+      description: DESCRIPTION1
+      source:
+        delta_table_source:
+          full_name: main.myschema.mysource
+      function:
+        aggregation_function:
+          count_function:
+            input: amount
+          time_window:
+            sliding:
+              window_duration: 604800s
+              slide_duration: 86400s
+      entities:
+        - name: account_id
+      timeseries_column:
+        name: event_ts
diff --git a/acceptance/bundle/resources/features/basic/out.test.toml b/acceptance/bundle/resources/features/basic/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/resources/features/basic/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/resources/features/basic/output.txt b/acceptance/bundle/resources/features/basic/output.txt
new file mode 100644
index 00000000000..5ee3a137ca8
--- /dev/null
+++ b/acceptance/bundle/resources/features/basic/output.txt
@@ -0,0 +1,211 @@
+
+=== Initial summary before deploy
+>>> [CLI] bundle summary -o json
+{
+  "description": "DESCRIPTION1",
+  "entities": [
+    {
+      "name": "account_id"
+    }
+  ],
+  "full_name": "main.myschema.myfeature",
+  "function": {
+    "aggregation_function": {
+      "count_function": {
+        "input": "amount"
+      },
+      "time_window": {
+        "sliding": {
+          "slide_duration": "86400s",
+          "window_duration": "604800s"
+        }
+      }
+    }
+  },
+  "modified_status": "created",
+  "source": {
+    "delta_table_source": {
+      "full_name": "main.myschema.mysource"
+    }
+  },
+  "timeseries_column": {
+    "name": "event_ts"
+  }
+}
+
+=== Verify it does not exist yet
+>>> musterr [CLI] feature-engineering get-feature main.myschema.myfeature
+Error: Resource ml.Feature not found: main.myschema.myfeature
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created features.feature1
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //feature-engineering
+{
+  "method": "POST",
+  "path": "/api/2.0/feature-engineering/features",
+  "body": {
+    "description": "DESCRIPTION1",
+    "entities": [
+      {
+        "name": "account_id"
+      }
+    ],
+    "full_name": "main.myschema.myfeature",
+    "function": {
+      "aggregation_function": {
+        "count_function": {
+          "input": "amount"
+        },
+        "time_window": {
+          "sliding": {
+            "slide_duration": "86400s",
+            "window_duration": "604800s"
+          }
+        }
+      }
+    },
+    "source": {
+      "delta_table_source": {
+        "full_name": "main.myschema.mysource"
+      }
+    },
+    "timeseries_column": {
+      "name": "event_ts"
+    }
+  }
+}
+
+=== Summary should show the id and the Catalog Explorer url
+>>> [CLI] bundle summary -o json
+{
+  "id": "main.myschema.myfeature",
+  "url": "[DATABRICKS_URL]/explore/data/features/main/myschema/myfeature?w=[WORKSPACE_ID]"
+}
+
+=== Verify deployment
+>>> [CLI] feature-engineering get-feature main.myschema.myfeature
+{
+  "full_name": "main.myschema.myfeature",
+  "description": "DESCRIPTION1",
+  "catalog_name": "main",
+  "schema_name": "myschema",
+  "name": "myfeature"
+}
+
+=== Update description (should update in place, not recreate)
+>>> update_file.py databricks.yml DESCRIPTION1 DESCRIPTION2
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Updated features.feature1
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //feature-engineering
+{
+  "method": "PATCH",
+  "path": "/api/2.0/feature-engineering/features/main.myschema.myfeature",
+  "q": {
+    "update_mask": "description"
+  },
+  "body": {
+    "description": "DESCRIPTION2",
+    "entities": [
+      {
+        "name": "account_id"
+      }
+    ],
+    "full_name": "main.myschema.myfeature",
+    "function": {
+      "aggregation_function": {
+        "count_function": {
+          "input": "amount"
+        },
+        "time_window": {
+          "sliding": {
+            "slide_duration": "86400s",
+            "window_duration": "604800s"
+          }
+        }
+      }
+    },
+    "source": {
+      "delta_table_source": {
+        "full_name": "main.myschema.mysource"
+      }
+    },
+    "timeseries_column": {
+      "name": "event_ts"
+    }
+  }
+}
+
+>>> [CLI] feature-engineering get-feature main.myschema.myfeature
+"DESCRIPTION2"
+
+=== Change an immutable field (should recreate)
+>>> update_file.py databricks.yml amount other_column
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Recreated features.feature1
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 0 unchanged
+
+>>> print_requests.py //feature-engineering
+{
+  "method": "DELETE",
+  "path": "/api/2.0/feature-engineering/features/main.myschema.myfeature"
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/feature-engineering/features",
+  "body": {
+    "description": "DESCRIPTION2",
+    "entities": [
+      {
+        "name": "account_id"
+      }
+    ],
+    "full_name": "main.myschema.myfeature",
+    "function": {
+      "aggregation_function": {
+        "count_function": {
+          "input": "other_column"
+        },
+        "time_window": {
+          "sliding": {
+            "slide_duration": "86400s",
+            "window_duration": "604800s"
+          }
+        }
+      }
+    },
+    "source": {
+      "delta_table_source": {
+        "full_name": "main.myschema.mysource"
+      }
+    },
+    "timeseries_column": {
+      "name": "event_ts"
+    }
+  }
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.features.feature1
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Destroy: 1 deleted
+
+>>> print_requests.py //feature-engineering
+{
+  "method": "DELETE",
+  "path": "/api/2.0/feature-engineering/features/main.myschema.myfeature"
+}
diff --git a/acceptance/bundle/resources/features/basic/script b/acceptance/bundle/resources/features/basic/script
new file mode 100755
index 00000000000..c254f898549
--- /dev/null
+++ b/acceptance/bundle/resources/features/basic/script
@@ -0,0 +1,30 @@
+title "Initial summary before deploy"
+trace $CLI bundle summary -o json | jq .resources.features.feature1
+
+title "Verify it does not exist yet"
+trace musterr $CLI feature-engineering get-feature main.myschema.myfeature
+
+trace $CLI bundle deploy
+trace print_requests.py //feature-engineering
+
+title "Summary should show the id and the Catalog Explorer url"
+trace $CLI bundle summary -o json | jq ".resources.features.feature1 | {id, url}"
+
+title "Verify deployment"
+trace $CLI feature-engineering get-feature main.myschema.myfeature | jq '{full_name, description, catalog_name, schema_name, name}'
+
+title "Update description (should update in place, not recreate)"
+trace update_file.py databricks.yml DESCRIPTION1 DESCRIPTION2
+trace $CLI bundle deploy
+trace print_requests.py //feature-engineering
+trace $CLI feature-engineering get-feature main.myschema.myfeature | jq .description
+
+title "Change an immutable field (should recreate)"
+trace update_file.py databricks.yml amount other_column
+trace $CLI bundle deploy
+trace print_requests.py //feature-engineering
+
+trace $CLI bundle destroy --auto-approve
+trace print_requests.py //feature-engineering
+
+rm -f out.requests.txt
diff --git a/acceptance/bundle/resources/features/basic/test.toml b/acceptance/bundle/resources/features/basic/test.toml
new file mode 100644
index 00000000000..bd4b66fe75e
--- /dev/null
+++ b/acceptance/bundle/resources/features/basic/test.toml
@@ -0,0 +1,3 @@
+Ignore = [
+    ".databricks",
+]
diff --git a/acceptance/bundle/resources/features/lifecycle/databricks.yml.tmpl b/acceptance/bundle/resources/features/lifecycle/databricks.yml.tmpl
new file mode 100644
index 00000000000..bde6fa2301b
--- /dev/null
+++ b/acceptance/bundle/resources/features/lifecycle/databricks.yml.tmpl
@@ -0,0 +1,23 @@
+bundle:
+  name: test-features-lifecycle-$UNIQUE_NAME
+
+resources:
+  features:
+    feature1:
+      full_name: $SCHEMA_FULL_NAME.feature_$UNIQUE_NAME
+      description: DESCRIPTION1
+      source:
+        delta_table_source:
+          full_name: $TABLE_NAME
+      function:
+        aggregation_function:
+          count_function:
+            input: value
+          time_window:
+            sliding:
+              window_duration: 604800s
+              slide_duration: 86400s
+      entities:
+        - name: id
+      timeseries_column:
+        name: timestamp
diff --git a/acceptance/bundle/resources/features/lifecycle/out.test.toml b/acceptance/bundle/resources/features/lifecycle/out.test.toml
new file mode 100644
index 00000000000..f68b4a89c36
--- /dev/null
+++ b/acceptance/bundle/resources/features/lifecycle/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/resources/features/lifecycle/output.txt b/acceptance/bundle/resources/features/lifecycle/output.txt
new file mode 100644
index 00000000000..144ebd4ef68
--- /dev/null
+++ b/acceptance/bundle/resources/features/lifecycle/output.txt
@@ -0,0 +1,40 @@
+
+>>> [CLI] schemas create feat_test_[UNIQUE_NAME] main -o json
+{
+  "full_name": "main.feat_test_[UNIQUE_NAME]"
+}
+
+>>> create_table.py main.feat_test_[UNIQUE_NAME].source_table
+Created table main.feat_test_[UNIQUE_NAME].source_table
+Inserted sample data into main.feat_test_[UNIQUE_NAME].source_table
+Table main.feat_test_[UNIQUE_NAME].source_table is now visible (catalog_name=main)
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-features-lifecycle-[UNIQUE_NAME]/default/files...
+Created features.feature1
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== A second plan on an unchanged bundle must report no changes
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+=== Update the description in place, then confirm the plan settles again
+>>> update_file.py databricks.yml DESCRIPTION1 DESCRIPTION2
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-features-lifecycle-[UNIQUE_NAME]/default/files...
+Updated features.feature1
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.features.feature1
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-features-lifecycle-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/features/lifecycle/script b/acceptance/bundle/resources/features/lifecycle/script
new file mode 100644
index 00000000000..3e539c4e8c1
--- /dev/null
+++ b/acceptance/bundle/resources/features/lifecycle/script
@@ -0,0 +1,24 @@
+SCHEMA_NAME="feat_test_${UNIQUE_NAME}"
+export SCHEMA_FULL_NAME="main.${SCHEMA_NAME}"
+export TABLE_NAME="${SCHEMA_FULL_NAME}.source_table"
+
+trace $CLI schemas create "$SCHEMA_NAME" main -o json | jq '{full_name}'
+trace create_table.py "$TABLE_NAME"
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    $CLI schemas delete "$SCHEMA_FULL_NAME" --force 2>/dev/null || true
+}
+trap cleanup EXIT
+
+envsubst < databricks.yml.tmpl > databricks.yml
+
+trace $CLI bundle deploy
+
+title "A second plan on an unchanged bundle must report no changes"
+trace $CLI bundle plan
+
+title "Update the description in place, then confirm the plan settles again"
+trace update_file.py databricks.yml DESCRIPTION1 DESCRIPTION2
+trace $CLI bundle deploy
+trace $CLI bundle plan
diff --git a/acceptance/bundle/resources/features/lifecycle/test.toml b/acceptance/bundle/resources/features/lifecycle/test.toml
new file mode 100644
index 00000000000..9c98d047fde
--- /dev/null
+++ b/acceptance/bundle/resources/features/lifecycle/test.toml
@@ -0,0 +1,11 @@
+Cloud = true
+
+Ignore = [
+    ".databricks",
+    "databricks.yml",
+]
+
+# Fake SQL endpoint so create_table.py works against the local test server too.
+[[Server]]
+Pattern = "POST /api/2.0/sql/statements/"
+Response.Body = '{"status": {"state": "SUCCEEDED"}, "manifest": {"schema": {"columns": []}}}'
diff --git a/acceptance/bundle/resources/features/remote-delete/databricks.yml b/acceptance/bundle/resources/features/remote-delete/databricks.yml
new file mode 100644
index 00000000000..59ad81a9d47
--- /dev/null
+++ b/acceptance/bundle/resources/features/remote-delete/databricks.yml
@@ -0,0 +1,18 @@
+bundle:
+  name: test-bundle
+
+resources:
+  features:
+    feature1:
+      full_name: main.myschema.myfeature
+      description: DESCRIPTION1
+      source:
+        delta_table_source:
+          full_name: main.myschema.mysource
+      function:
+        column_selection:
+          column: amount
+      entities:
+        - name: account_id
+      timeseries_column:
+        name: event_ts
diff --git a/acceptance/bundle/resources/features/remote-delete/out.test.toml b/acceptance/bundle/resources/features/remote-delete/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/resources/features/remote-delete/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/resources/features/remote-delete/output.txt b/acceptance/bundle/resources/features/remote-delete/output.txt
new file mode 100644
index 00000000000..3047716268a
--- /dev/null
+++ b/acceptance/bundle/resources/features/remote-delete/output.txt
@@ -0,0 +1,20 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created features.feature1
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Delete the feature out of band
+>>> [CLI] feature-engineering delete-feature main.myschema.myfeature
+
+=== Plan should detect the feature is gone and re-create it
+>>> [CLI] bundle plan
+create features.feature1
+
+Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Destroy: 0 deleted
diff --git a/acceptance/bundle/resources/features/remote-delete/script b/acceptance/bundle/resources/features/remote-delete/script
new file mode 100644
index 00000000000..6c0b2522ad1
--- /dev/null
+++ b/acceptance/bundle/resources/features/remote-delete/script
@@ -0,0 +1,9 @@
+trace $CLI bundle deploy
+
+title "Delete the feature out of band"
+trace $CLI feature-engineering delete-feature main.myschema.myfeature
+
+title "Plan should detect the feature is gone and re-create it"
+trace $CLI bundle plan
+
+trace $CLI bundle destroy --auto-approve
diff --git a/acceptance/bundle/resources/features/remote-delete/test.toml b/acceptance/bundle/resources/features/remote-delete/test.toml
new file mode 100644
index 00000000000..b65b456fa41
--- /dev/null
+++ b/acceptance/bundle/resources/features/remote-delete/test.toml
@@ -0,0 +1,9 @@
+# Local only: simulates an out-of-band delete with a fixed feature name, so it can't run against a
+# real workspace.
+Cloud = false
+
+RecordRequests = false
+
+Ignore = [
+    ".databricks",
+]
diff --git a/acceptance/bundle/resources/features/test.toml b/acceptance/bundle/resources/features/test.toml
new file mode 100644
index 00000000000..3713c736975
--- /dev/null
+++ b/acceptance/bundle/resources/features/test.toml
@@ -0,0 +1,3 @@
+# Deployment history has no "features." resource-key prefix, so the deploy fails before the feature
+# is created. See dmsResourceTypes in libs/testserver/bundledeployments.go, which mirrors Universe.
+EnvMatrixExclude.no_feature_dms = ["DMS=true"]
diff --git a/acceptance/bundle/resources/genie_spaces/change-serialized-space/databricks.yml.tmpl b/acceptance/bundle/resources/genie_spaces/change-serialized-space/databricks.yml.tmpl
new file mode 100644
index 00000000000..dccec3bac2c
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/change-serialized-space/databricks.yml.tmpl
@@ -0,0 +1,13 @@
+bundle:
+  name: change-serialized-space-$UNIQUE_NAME
+
+sync:
+  exclude:
+    - "out.*"
+
+resources:
+  genie_spaces:
+    my_space:
+      title: test genie space
+      warehouse_id: $TEST_DEFAULT_WAREHOUSE_ID
+      file_path: ./space.geniespace.json
diff --git a/acceptance/bundle/resources/genie_spaces/change-serialized-space/out.state.txt b/acceptance/bundle/resources/genie_spaces/change-serialized-space/out.state.txt
new file mode 100644
index 00000000000..e0540949692
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/change-serialized-space/out.state.txt
@@ -0,0 +1 @@
+json.state.resources.genie_spaces.my_space.state.serialized_space = "sha256:[HASH]";
diff --git a/acceptance/bundle/resources/genie_spaces/change-serialized-space/out.state_after_update.txt b/acceptance/bundle/resources/genie_spaces/change-serialized-space/out.state_after_update.txt
new file mode 100644
index 00000000000..e0540949692
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/change-serialized-space/out.state_after_update.txt
@@ -0,0 +1 @@
+json.state.resources.genie_spaces.my_space.state.serialized_space = "sha256:[HASH]";
diff --git a/acceptance/bundle/resources/genie_spaces/change-serialized-space/out.test.toml b/acceptance/bundle/resources/genie_spaces/change-serialized-space/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/change-serialized-space/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/genie_spaces/change-serialized-space/output.txt b/acceptance/bundle/resources/genie_spaces/change-serialized-space/output.txt
new file mode 100644
index 00000000000..9100e42528f
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/change-serialized-space/output.txt
@@ -0,0 +1,57 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/change-serialized-space-[UNIQUE_NAME]/default/files...
+Created genie_spaces.my_space
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Re-plan should be a no-op
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+=== Plan after changing serialized_space should show update
+>>> [CLI] bundle plan
+update genie_spaces.my_space
+
+Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/change-serialized-space-[UNIQUE_NAME]/default/files...
+Updated genie_spaces.my_space
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //api/2.0/genie/spaces --unique
+{
+  "method": "POST",
+  "path": "/api/2.0/genie/spaces",
+  "body": {
+    "parent_path": "/Workspace/Users/[USERNAME]/.bundle/change-serialized-space-[UNIQUE_NAME]/default/resources",
+    "serialized_space": "{\"version\":1,\"instructions\":{\"text_instructions\":[{\"id\":\"a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4\",\"content\":[\"Analyze sales orders by date\"]}]}}\n",
+    "title": "test genie space",
+    "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
+  }
+}
+{
+  "method": "PATCH",
+  "path": "/api/2.0/genie/spaces/[MY_SPACE_ID]",
+  "body": {
+    "description": "",
+    "parent_path": "/Workspace/Users/[USERNAME]/.bundle/change-serialized-space-[UNIQUE_NAME]/default/resources",
+    "serialized_space": "{\"version\":1,\"instructions\":{\"text_instructions\":[{\"id\":\"a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4\",\"content\":[\"Summarize sales revenue by month\"]}]}}\n",
+    "title": "test genie space",
+    "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
+  }
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.genie_spaces.my_space
+
+This action will result in the deletion of the following Genie spaces.
+The conversation history attached to them is permanently lost:
+  delete resources.genie_spaces.my_space
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/change-serialized-space-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/genie_spaces/change-serialized-space/script b/acceptance/bundle/resources/genie_spaces/change-serialized-space/script
new file mode 100644
index 00000000000..1c91bd164b9
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/change-serialized-space/script
@@ -0,0 +1,37 @@
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+envsubst < databricks.yml.tmpl > databricks.yml
+rm -f "$OUT_REQUESTS"
+
+# Deploy the Genie space with the initial serialized_space content.
+trace $CLI bundle deploy
+
+# Register the randomly-generated space ID as a replacement so the update PATCH path below
+# (/api/2.0/genie/spaces/<id>) is deterministic across runs.
+replace_ids.py
+
+# serialized_space is stored in state as a content hash, not the full JSON. The full
+# content still reaches the API (print_requests.py below) and stays in the plan's new_state.
+print_state.py | gron.py | grep serialized_space > out.state.txt
+
+# No-op re-plan: the stored hash compares equal to the config, so it does not produce a
+# phantom serialized_space update.
+title "Re-plan should be a no-op"
+trace $CLI bundle plan
+
+# Change the serialized_space content - this triggers an update (not a recreate).
+update_file.py space.geniespace.json "Analyze sales orders by date" "Summarize sales revenue by month"
+title "Plan after changing serialized_space should show update"
+trace $CLI bundle plan
+trace $CLI bundle deploy
+
+# The edit changes the content, so state holds the new hash.
+print_state.py | gron.py | grep serialized_space > out.state_after_update.txt
+
+# The full serialized_space content reached the create (POST) and update (PATCH) APIs.
+# --unique collapses the duplicate create the SDK retries on cloud (eventual consistency).
+trace print_requests.py //api/2.0/genie/spaces --unique
diff --git a/acceptance/bundle/resources/genie_spaces/change-serialized-space/space.geniespace.json b/acceptance/bundle/resources/genie_spaces/change-serialized-space/space.geniespace.json
new file mode 100644
index 00000000000..e5e8fc15008
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/change-serialized-space/space.geniespace.json
@@ -0,0 +1 @@
+{"version":1,"instructions":{"text_instructions":[{"id":"a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4","content":["Analyze sales orders by date"]}]}}
diff --git a/acceptance/bundle/resources/genie_spaces/change-serialized-space/test.toml b/acceptance/bundle/resources/genie_spaces/change-serialized-space/test.toml
new file mode 100644
index 00000000000..2dfa12c2e49
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/change-serialized-space/test.toml
@@ -0,0 +1,12 @@
+# Cloud = true is inherited from the parent
+RecordRequests = true
+
+Ignore = [
+    "databricks.yml",
+]
+
+# update_file.py rewrites the fixture in text mode, so on Windows the edited
+# serialized_space payload ends with \r\n; normalize it to the LF golden output.
+[[Repls]]
+Old = '\\r\\n'
+New = '\n'
diff --git a/acceptance/bundle/resources/genie_spaces/delete_warning/databricks.yml.tmpl b/acceptance/bundle/resources/genie_spaces/delete_warning/databricks.yml.tmpl
new file mode 100644
index 00000000000..9b527e7f44d
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/delete_warning/databricks.yml.tmpl
@@ -0,0 +1,9 @@
+bundle:
+  name: genie-delete-warning-$UNIQUE_NAME
+
+resources:
+  genie_spaces:
+    sales_analytics:
+      title: "Sales Analytics Genie"
+      warehouse_id: $TEST_DEFAULT_WAREHOUSE_ID
+      file_path: "sales_analytics.geniespace.json"
diff --git a/acceptance/bundle/resources/genie_spaces/delete_warning/no_space.yml.tmpl b/acceptance/bundle/resources/genie_spaces/delete_warning/no_space.yml.tmpl
new file mode 100644
index 00000000000..647bb33a0b5
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/delete_warning/no_space.yml.tmpl
@@ -0,0 +1,2 @@
+bundle:
+  name: genie-delete-warning-$UNIQUE_NAME
diff --git a/acceptance/bundle/resources/genie_spaces/delete_warning/out.test.toml b/acceptance/bundle/resources/genie_spaces/delete_warning/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/delete_warning/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/genie_spaces/delete_warning/output.txt b/acceptance/bundle/resources/genie_spaces/delete_warning/output.txt
new file mode 100644
index 00000000000..52720a7fcda
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/delete_warning/output.txt
@@ -0,0 +1,22 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/genie-delete-warning-[UNIQUE_NAME]/default/files...
+Created genie_spaces.sales_analytics
+Files: 4 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Deploying without the genie space warns before deleting it (chat history loss)
+>>> [CLI] bundle deploy --auto-approve
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/genie-delete-warning-[UNIQUE_NAME]/default/files...
+
+This action will result in the deletion or recreation of the following Genie spaces.
+The conversation history attached to a deleted space is permanently lost:
+  delete resources.genie_spaces.sales_analytics
+Deleted genie_spaces.sales_analytics
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 1 deleted, 0 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/genie-delete-warning-[UNIQUE_NAME]/default
+
+Destroy: 0 deleted
diff --git a/acceptance/bundle/resources/genie_spaces/delete_warning/sales_analytics.geniespace.json b/acceptance/bundle/resources/genie_spaces/delete_warning/sales_analytics.geniespace.json
new file mode 100644
index 00000000000..61a2092b1b7
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/delete_warning/sales_analytics.geniespace.json
@@ -0,0 +1,3 @@
+{
+  "version": 1
+}
diff --git a/acceptance/bundle/resources/genie_spaces/delete_warning/script b/acceptance/bundle/resources/genie_spaces/delete_warning/script
new file mode 100644
index 00000000000..1be25587904
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/delete_warning/script
@@ -0,0 +1,12 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+trace $CLI bundle deploy
+
+title "Deploying without the genie space warns before deleting it (chat history loss)"
+envsubst < no_space.yml.tmpl > databricks.yml
+trace $CLI bundle deploy --auto-approve
diff --git a/acceptance/bundle/resources/genie_spaces/delete_warning/test.toml b/acceptance/bundle/resources/genie_spaces/delete_warning/test.toml
new file mode 100644
index 00000000000..ce776382cbd
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/delete_warning/test.toml
@@ -0,0 +1,6 @@
+Cloud = false
+RecordRequests = false
+
+Ignore = [
+    "databricks.yml",
+]
diff --git a/acceptance/bundle/resources/genie_spaces/inline/databricks.yml.tmpl b/acceptance/bundle/resources/genie_spaces/inline/databricks.yml.tmpl
new file mode 100644
index 00000000000..121ee36c21f
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/inline/databricks.yml.tmpl
@@ -0,0 +1,21 @@
+bundle:
+  name: deploy-genie-space-inline-$UNIQUE_NAME
+
+resources:
+  genie_spaces:
+    sales_analytics:
+      title: "Sales Analytics Inline Genie"
+      description: "Inline serialized_space test"
+      warehouse_id: "test-warehouse-id"
+      serialized_space:
+        version: 1
+        config:
+          sample_questions:
+            - id: "sq-001"
+              question: ["What is the total revenue?"]
+        data_sources:
+          tables:
+            - identifier: "main.sales.orders"
+              column_configs:
+                - column_name: "amount"
+                  get_example_values: true
diff --git a/acceptance/bundle/resources/genie_spaces/inline/out.plan.json b/acceptance/bundle/resources/genie_spaces/inline/out.plan.json
new file mode 100644
index 00000000000..ec5340a256c
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/inline/out.plan.json
@@ -0,0 +1,34 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.genie_spaces.sales_analytics": {
+      "action": "skip",
+      "remote_state": {
+        "description": "Inline serialized_space test",
+        "etag": "1",
+        "parent_path": "/Workspace/Users/[USERNAME]/.bundle/deploy-genie-space-inline-[UNIQUE_NAME]/default/resources",
+        "serialized_space": "{\"config\":{\"sample_questions\":[{\"id\":\"sq-001\",\"question\":[\"What is the total revenue?\"]}]},\"data_sources\":{\"tables\":[{\"column_configs\":[{\"column_name\":\"amount\",\"get_example_values\":true}],\"identifier\":\"main.sales.orders\"}]},\"version\":2}",
+        "title": "Sales Analytics Inline Genie",
+        "warehouse_id": "test-warehouse-id"
+      },
+      "changes": {
+        "etag": {
+          "action": "skip",
+          "reason": "custom",
+          "old": "1",
+          "remote": "1"
+        },
+        "serialized_space": {
+          "action": "skip",
+          "reason": "etag_based",
+          "old": "sha256:[HASH][0]",
+          "new": "sha256:[HASH][0]",
+          "remote": "sha256:[HASH][1]"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/genie_spaces/inline/out.test.toml b/acceptance/bundle/resources/genie_spaces/inline/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/inline/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/genie_spaces/inline/output.txt b/acceptance/bundle/resources/genie_spaces/inline/output.txt
new file mode 100644
index 00000000000..c48bf71c535
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/inline/output.txt
@@ -0,0 +1,20 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-genie-space-inline-[UNIQUE_NAME]/default/files...
+Created genie_spaces.sales_analytics
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] bundle plan -o json
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.genie_spaces.sales_analytics
+
+This action will result in the deletion of the following Genie spaces.
+The conversation history attached to them is permanently lost:
+  delete resources.genie_spaces.sales_analytics
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-genie-space-inline-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/genie_spaces/inline/script b/acceptance/bundle/resources/genie_spaces/inline/script
new file mode 100644
index 00000000000..a342e6dc7de
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/inline/script
@@ -0,0 +1,18 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+trace $CLI bundle deploy
+GENIE_SPACE_ID=$($CLI bundle summary --output json | jq -r '.resources.genie_spaces.sales_analytics.id')
+
+# Capture the genie space ID as a replacement.
+add_repl "$GENIE_SPACE_ID" GENIE_SPACE_ID
+
+# Plan after deploy must be drift-free aside from input_only fields.
+# Without normalization the inline serialized_space leaves a map in the
+# config struct while state holds a string, and structdiff reports false
+# drift on every plan.
+trace $CLI bundle plan -o json | nostamp > out.plan.json
diff --git a/acceptance/bundle/resources/genie_spaces/inline/test.toml b/acceptance/bundle/resources/genie_spaces/inline/test.toml
new file mode 100644
index 00000000000..c16543b636a
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/inline/test.toml
@@ -0,0 +1,8 @@
+# Local-only: the inline serialized_space references tables (main.sales.orders)
+# that do not exist on a real workspace, so the backend rejects the create (403).
+Cloud = false
+RecordRequests = false
+
+Ignore = [
+    "databricks.yml",
+]
diff --git a/acceptance/bundle/resources/genie_spaces/parent_path_update/databricks.yml.tmpl b/acceptance/bundle/resources/genie_spaces/parent_path_update/databricks.yml.tmpl
new file mode 100644
index 00000000000..0efa8bc6935
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/parent_path_update/databricks.yml.tmpl
@@ -0,0 +1,11 @@
+bundle:
+  name: update-genie-space-$UNIQUE_NAME
+
+resources:
+  genie_spaces:
+    update_target:
+      title: "Update Target"
+      warehouse_id: $TEST_DEFAULT_WAREHOUSE_ID
+      parent_path: PARENT_PATH_PLACEHOLDER
+      serialized_space:
+        version: 1
diff --git a/acceptance/bundle/resources/genie_spaces/parent_path_update/out.test.toml b/acceptance/bundle/resources/genie_spaces/parent_path_update/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/parent_path_update/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/genie_spaces/parent_path_update/output.txt b/acceptance/bundle/resources/genie_spaces/parent_path_update/output.txt
new file mode 100644
index 00000000000..1d878f1f874
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/parent_path_update/output.txt
@@ -0,0 +1,24 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-genie-space-[UNIQUE_NAME]/default/files...
+Created genie_spaces.update_target
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Plan after changing parent_path should show update
+>>> [CLI] bundle plan
+update genie_spaces.update_target
+
+Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.genie_spaces.update_target
+
+This action will result in the deletion of the following Genie spaces.
+The conversation history attached to them is permanently lost:
+  delete resources.genie_spaces.update_target
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/update-genie-space-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/genie_spaces/parent_path_update/script b/acceptance/bundle/resources/genie_spaces/parent_path_update/script
new file mode 100644
index 00000000000..cc7359b67d9
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/parent_path_update/script
@@ -0,0 +1,14 @@
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+# Deploy with the original parent_path.
+envsubst < databricks.yml.tmpl | sed "s|PARENT_PATH_PLACEHOLDER|/Users/$CURRENT_USER_NAME/genie-old|" > databricks.yml
+trace $CLI bundle deploy
+
+# Change parent_path. The Genie update API moves the space to the new parent,
+# so the plan should show an update rather than a recreate (delete + create).
+envsubst < databricks.yml.tmpl | sed "s|PARENT_PATH_PLACEHOLDER|/Users/$CURRENT_USER_NAME/genie-new|" > databricks.yml
+title "Plan after changing parent_path should show update"
+trace $CLI bundle plan
diff --git a/acceptance/bundle/resources/genie_spaces/parent_path_update/test.toml b/acceptance/bundle/resources/genie_spaces/parent_path_update/test.toml
new file mode 100644
index 00000000000..ae35e046923
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/parent_path_update/test.toml
@@ -0,0 +1,5 @@
+RecordRequests = false
+
+Ignore = [
+    "databricks.yml",
+]
diff --git a/acceptance/bundle/resources/genie_spaces/recreate_when_gone/databricks.yml.tmpl b/acceptance/bundle/resources/genie_spaces/recreate_when_gone/databricks.yml.tmpl
new file mode 100644
index 00000000000..52d211cb7c2
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/recreate_when_gone/databricks.yml.tmpl
@@ -0,0 +1,10 @@
+bundle:
+  name: recreate-gone-genie-space-$UNIQUE_NAME
+
+resources:
+  genie_spaces:
+    sales_analytics:
+      title: "Recreate When Gone"
+      warehouse_id: $TEST_DEFAULT_WAREHOUSE_ID
+      serialized_space:
+        version: 1
diff --git a/acceptance/bundle/resources/genie_spaces/recreate_when_gone/out.test.toml b/acceptance/bundle/resources/genie_spaces/recreate_when_gone/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/recreate_when_gone/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/genie_spaces/recreate_when_gone/output.txt b/acceptance/bundle/resources/genie_spaces/recreate_when_gone/output.txt
new file mode 100644
index 00000000000..d346a1d8da3
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/recreate_when_gone/output.txt
@@ -0,0 +1,19 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/recreate-gone-genie-space-[UNIQUE_NAME]/default/files...
+Created genie_spaces.sales_analytics
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] genie trash-space [GENIE_SPACE_ID]
+
+=== Plan after remote deletion should recreate the space
+>>> [CLI] bundle plan
+create genie_spaces.sales_analytics
+
+Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/recreate-gone-genie-space-[UNIQUE_NAME]/default
+
+Destroy: 0 deleted
diff --git a/acceptance/bundle/resources/genie_spaces/recreate_when_gone/script b/acceptance/bundle/resources/genie_spaces/recreate_when_gone/script
new file mode 100644
index 00000000000..0ccb456f1cf
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/recreate_when_gone/script
@@ -0,0 +1,30 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+trace $CLI bundle deploy
+GENIE_SPACE_ID=$($CLI bundle summary --output json | jq -r '.resources.genie_spaces.sales_analytics.id')
+add_repl "$GENIE_SPACE_ID" GENIE_SPACE_ID
+
+# Delete the space out-of-band, simulating a UI deletion. The GET API then
+# returns 404, which the plan treats as "gone" so it recreates the space
+# instead of failing.
+trace $CLI genie trash-space $GENIE_SPACE_ID
+
+# On a real workspace trashing propagates asynchronously: GET keeps returning
+# the space as live for tens of seconds before flipping to 404 ("Space ... has
+# been trashed"). Poll until the deletion is visible so the plan below
+# deterministically sees the space as gone. The local mock trashes
+# synchronously, so the first probe already fails and the loop exits at once.
+for _ in {1..60}; do
+    if ! $CLI genie get-space $GENIE_SPACE_ID >> LOG.trash_poll 2>&1; then
+        break
+    fi
+    sleep 2
+done
+
+title "Plan after remote deletion should recreate the space"
+trace $CLI bundle plan
diff --git a/acceptance/bundle/resources/genie_spaces/recreate_when_gone/test.toml b/acceptance/bundle/resources/genie_spaces/recreate_when_gone/test.toml
new file mode 100644
index 00000000000..ae35e046923
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/recreate_when_gone/test.toml
@@ -0,0 +1,5 @@
+RecordRequests = false
+
+Ignore = [
+    "databricks.yml",
+]
diff --git a/acceptance/bundle/resources/genie_spaces/serialized_space/databricks.yml.tmpl b/acceptance/bundle/resources/genie_spaces/serialized_space/databricks.yml.tmpl
new file mode 100644
index 00000000000..c9ebe751145
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/serialized_space/databricks.yml.tmpl
@@ -0,0 +1,17 @@
+bundle:
+  name: genie-serialized-space-$UNIQUE_NAME
+
+resources:
+  genie_spaces:
+    from_file:
+      title: "From File"
+      warehouse_id: "test-warehouse-id"
+      file_path: "space.geniespace.json"
+    from_inline:
+      title: "From Inline"
+      warehouse_id: "test-warehouse-id"
+      serialized_space:
+        version: 1
+        data_sources:
+          tables:
+            - identifier: "main.sales.orders"
diff --git a/acceptance/bundle/resources/genie_spaces/serialized_space/out.create_requests.json b/acceptance/bundle/resources/genie_spaces/serialized_space/out.create_requests.json
new file mode 100644
index 00000000000..1ed6f9baf50
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/serialized_space/out.create_requests.json
@@ -0,0 +1,30 @@
+[
+  {
+    "title": "From File",
+    "serialized_space": "{\"version\": 1, \"data_sources\": {\"tables\": [{\"identifier\": \"main.sales.customers\"}]}}\n",
+    "parsed": {
+      "version": 1,
+      "data_sources": {
+        "tables": [
+          {
+            "identifier": "main.sales.customers"
+          }
+        ]
+      }
+    }
+  },
+  {
+    "title": "From Inline",
+    "serialized_space": "{\"data_sources\":{\"tables\":[{\"identifier\":\"main.sales.orders\"}]},\"version\":1}",
+    "parsed": {
+      "data_sources": {
+        "tables": [
+          {
+            "identifier": "main.sales.orders"
+          }
+        ]
+      },
+      "version": 1
+    }
+  }
+]
diff --git a/acceptance/bundle/resources/genie_spaces/serialized_space/out.test.toml b/acceptance/bundle/resources/genie_spaces/serialized_space/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/serialized_space/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/genie_spaces/serialized_space/output.txt b/acceptance/bundle/resources/genie_spaces/serialized_space/output.txt
new file mode 100644
index 00000000000..3d3c0274b92
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/serialized_space/output.txt
@@ -0,0 +1,21 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/genie-serialized-space-[UNIQUE_NAME]/default/files...
+Created genie_spaces.from_file
+Created genie_spaces.from_inline
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.genie_spaces.from_file
+  delete resources.genie_spaces.from_inline
+
+This action will result in the deletion of the following Genie spaces.
+The conversation history attached to them is permanently lost:
+  delete resources.genie_spaces.from_file
+  delete resources.genie_spaces.from_inline
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/genie-serialized-space-[UNIQUE_NAME]/default
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/genie_spaces/serialized_space/script b/acceptance/bundle/resources/genie_spaces/serialized_space/script
new file mode 100644
index 00000000000..4e098a67e7d
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/serialized_space/script
@@ -0,0 +1,21 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+rm -f "$OUT_REQUESTS"
+trace $CLI bundle deploy
+
+# Capture the serialized_space sent to the Genie create API:
+#   - from_file must be sent verbatim from space.geniespace.json.
+#   - from_inline must be the inline YAML rendered as valid JSON (the fromjson
+#     below fails the test if the payload is not valid JSON).
+jq -s '[.[] | select(.method == "POST" and .path == "/api/2.0/genie/spaces")
+        | {title: .body.title,
+           serialized_space: .body.serialized_space,
+           parsed: (.body.serialized_space | fromjson)}]
+       | sort_by(.title)' "$OUT_REQUESTS" > out.create_requests.json
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/resources/genie_spaces/serialized_space/space.geniespace.json b/acceptance/bundle/resources/genie_spaces/serialized_space/space.geniespace.json
new file mode 100644
index 00000000000..ef4a1508015
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/serialized_space/space.geniespace.json
@@ -0,0 +1 @@
+{"version": 1, "data_sources": {"tables": [{"identifier": "main.sales.customers"}]}}
diff --git a/acceptance/bundle/resources/genie_spaces/serialized_space/test.toml b/acceptance/bundle/resources/genie_spaces/serialized_space/test.toml
new file mode 100644
index 00000000000..8e35e1d2d1c
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/serialized_space/test.toml
@@ -0,0 +1,8 @@
+# Local-only: asserts on the recorded create-request payloads, which only the
+# local testserver captures (RecordRequests).
+Cloud = false
+RecordRequests = true
+
+Ignore = [
+    "databricks.yml",
+]
diff --git a/acceptance/bundle/resources/genie_spaces/simple/databricks.yml.tmpl b/acceptance/bundle/resources/genie_spaces/simple/databricks.yml.tmpl
new file mode 100644
index 00000000000..1b0081e40b6
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/simple/databricks.yml.tmpl
@@ -0,0 +1,10 @@
+bundle:
+  name: deploy-genie-space-test-$UNIQUE_NAME
+
+resources:
+  genie_spaces:
+    sales_analytics:
+      title: "Sales Analytics Genie"
+      description: "AI assistant for sales data analysis"
+      warehouse_id: $TEST_DEFAULT_WAREHOUSE_ID
+      file_path: "sales_analytics.geniespace.json"
diff --git a/acceptance/bundle/resources/genie_spaces/simple/out.test.toml b/acceptance/bundle/resources/genie_spaces/simple/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/simple/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/genie_spaces/simple/output.txt b/acceptance/bundle/resources/genie_spaces/simple/output.txt
new file mode 100644
index 00000000000..03133865032
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/simple/output.txt
@@ -0,0 +1,28 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-genie-space-test-[UNIQUE_NAME]/default/files...
+Created genie_spaces.sales_analytics
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] genie get-space [GENIE_SPACE_ID]
+{
+  "title": "Sales Analytics Genie",
+  "description": "AI assistant for sales data analysis",
+  "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
+}
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.genie_spaces.sales_analytics
+
+This action will result in the deletion of the following Genie spaces.
+The conversation history attached to them is permanently lost:
+  delete resources.genie_spaces.sales_analytics
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-genie-space-test-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/genie_spaces/simple/sales_analytics.geniespace.json b/acceptance/bundle/resources/genie_spaces/simple/sales_analytics.geniespace.json
new file mode 100644
index 00000000000..61a2092b1b7
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/simple/sales_analytics.geniespace.json
@@ -0,0 +1,3 @@
+{
+  "version": 1
+}
diff --git a/acceptance/bundle/resources/genie_spaces/simple/script b/acceptance/bundle/resources/genie_spaces/simple/script
new file mode 100644
index 00000000000..6ad76a8ab24
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/simple/script
@@ -0,0 +1,20 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+trace $CLI bundle deploy
+GENIE_SPACE_ID=$($CLI bundle summary --output json | jq -r '.resources.genie_spaces.sales_analytics.id')
+
+# Capture the genie space ID as a replacement.
+add_repl "$GENIE_SPACE_ID" GENIE_SPACE_ID
+
+trace $CLI genie get-space $GENIE_SPACE_ID | jq '{title, description, warehouse_id}'
+
+# Verify that there is no drift right after deploy. Text plan (not -o json) keeps
+# output identical between the mock and a real workspace: on cloud the backend
+# migrates the {"version":1} serialized_space to version 2 and the etag differs,
+# but the resource action stays "skip" so the rendered plan is the same.
+trace $CLI bundle plan
diff --git a/acceptance/bundle/resources/genie_spaces/simple/test.toml b/acceptance/bundle/resources/genie_spaces/simple/test.toml
new file mode 100644
index 00000000000..ae35e046923
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/simple/test.toml
@@ -0,0 +1,5 @@
+RecordRequests = false
+
+Ignore = [
+    "databricks.yml",
+]
diff --git a/acceptance/bundle/resources/genie_spaces/test.toml b/acceptance/bundle/resources/genie_spaces/test.toml
new file mode 100644
index 00000000000..855e2b1ce44
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/test.toml
@@ -0,0 +1,6 @@
+# Genie spaces are only deployed via the direct deployment engine.
+
+# Genie space lifecycle tests also run against a real workspace. They use a
+# minimal serialized_space ({"version": 1}) the backend accepts, plus a real
+# warehouse. Tests that can't run on cloud override this with Cloud = false.
+Cloud = true
diff --git a/acceptance/bundle/resources/genie_spaces/version_migration/databricks.yml.tmpl b/acceptance/bundle/resources/genie_spaces/version_migration/databricks.yml.tmpl
new file mode 100644
index 00000000000..a5a1c31dfb8
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/version_migration/databricks.yml.tmpl
@@ -0,0 +1,10 @@
+bundle:
+  name: genie-version-migration-$UNIQUE_NAME
+
+resources:
+  genie_spaces:
+    foo:
+      title: "Version Migration"
+      warehouse_id: $TEST_DEFAULT_WAREHOUSE_ID
+      serialized_space:
+        version: 1
diff --git a/acceptance/bundle/resources/genie_spaces/version_migration/out.test.toml b/acceptance/bundle/resources/genie_spaces/version_migration/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/version_migration/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/genie_spaces/version_migration/output.txt b/acceptance/bundle/resources/genie_spaces/version_migration/output.txt
new file mode 100644
index 00000000000..8b764650fcb
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/version_migration/output.txt
@@ -0,0 +1,29 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/genie-version-migration-[UNIQUE_NAME]/default/files...
+Created genie_spaces.foo
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Plan after deploy is drift-free despite the version 1 -> version 2 migration
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+=== serialized_space: local version 1, remote version 2, skipped (etag_based){
+  "action": "skip",
+  "reason": "etag_based",
+  "local_version": 1,
+  "remote_version": 2
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.genie_spaces.foo
+
+This action will result in the deletion of the following Genie spaces.
+The conversation history attached to them is permanently lost:
+  delete resources.genie_spaces.foo
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/genie-version-migration-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/genie_spaces/version_migration/script b/acceptance/bundle/resources/genie_spaces/version_migration/script
new file mode 100644
index 00000000000..2c7e0d56aae
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/version_migration/script
@@ -0,0 +1,26 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+trace $CLI bundle deploy
+
+# The backend migrates a version-1 serialized_space to version 2 on write and
+# returns an etag for the migrated (version 2) content. serialized_space is
+# ignore_remote_changes (etag_based), so the permanent local(v1)/remote(v2)
+# mismatch does not surface as drift: the resource action stays "skip" and a
+# re-plan reports no changes.
+title "Plan after deploy is drift-free despite the version 1 -> version 2 migration"
+trace $CLI bundle plan
+
+# The mismatch the etag masks: the local config stays version 1 while the remote
+# (and the etag guarding it) is version 2. The serialized_space change is
+# recorded but skipped via the etag_based rule.
+title "serialized_space: local version 1, remote version 2, skipped (etag_based)"
+$CLI bundle plan -o json | nostamp \
+  | jq '.plan["resources.genie_spaces.foo"].changes.serialized_space
+        | {action, reason,
+           local_version: (.new | fromjson | .version),
+           remote_version: (.remote | fromjson | .version)}'
diff --git a/acceptance/bundle/resources/genie_spaces/version_migration/test.toml b/acceptance/bundle/resources/genie_spaces/version_migration/test.toml
new file mode 100644
index 00000000000..ae35e046923
--- /dev/null
+++ b/acceptance/bundle/resources/genie_spaces/version_migration/test.toml
@@ -0,0 +1,5 @@
+RecordRequests = false
+
+Ignore = [
+    "databricks.yml",
+]
diff --git a/acceptance/bundle/resources/grants/catalogs/out.deploy1.requests.direct.json b/acceptance/bundle/resources/grants/catalogs/out.deploy1.requests.json
similarity index 100%
rename from acceptance/bundle/resources/grants/catalogs/out.deploy1.requests.direct.json
rename to acceptance/bundle/resources/grants/catalogs/out.deploy1.requests.json
diff --git a/acceptance/bundle/resources/grants/catalogs/out.deploy2.requests.direct.json b/acceptance/bundle/resources/grants/catalogs/out.deploy2.requests.json
similarity index 100%
rename from acceptance/bundle/resources/grants/catalogs/out.deploy2.requests.direct.json
rename to acceptance/bundle/resources/grants/catalogs/out.deploy2.requests.json
diff --git a/acceptance/bundle/resources/grants/volumes/out.destroy.requests.direct.json b/acceptance/bundle/resources/grants/catalogs/out.destroy.requests.json
similarity index 100%
rename from acceptance/bundle/resources/grants/volumes/out.destroy.requests.direct.json
rename to acceptance/bundle/resources/grants/catalogs/out.destroy.requests.json
diff --git a/acceptance/bundle/resources/grants/catalogs/out.plan1.direct.json b/acceptance/bundle/resources/grants/catalogs/out.plan1.direct.json
deleted file mode 100644
index 333e2928d53..00000000000
--- a/acceptance/bundle/resources/grants/catalogs/out.plan1.direct.json
+++ /dev/null
@@ -1,41 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.catalogs.grants_catalog": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "comment": "Test catalog for grants",
-          "name": "catalog_grants_[UNIQUE_NAME]"
-        }
-      }
-    },
-    "resources.catalogs.grants_catalog.grants": {
-      "depends_on": [
-        {
-          "node": "resources.catalogs.grants_catalog",
-          "label": "${resources.catalogs.grants_catalog.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "full_name": "",
-          "__embed__": [
-            {
-              "principal": "deco-test-user@databricks.com",
-              "privileges": [
-                "CREATE_SCHEMA",
-                "USE_CATALOG"
-              ]
-            }
-          ]
-        },
-        "vars": {
-          "full_name": "${resources.catalogs.grants_catalog.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/grants/catalogs/out.plan1.json b/acceptance/bundle/resources/grants/catalogs/out.plan1.json
new file mode 100644
index 00000000000..590ce37f61c
--- /dev/null
+++ b/acceptance/bundle/resources/grants/catalogs/out.plan1.json
@@ -0,0 +1,41 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.catalogs.grants_catalog": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "comment": "Test catalog for grants",
+          "name": "catalog_grants_[UNIQUE_NAME]"
+        }
+      }
+    },
+    "resources.catalogs.grants_catalog.grants": {
+      "depends_on": [
+        {
+          "node": "resources.catalogs.grants_catalog",
+          "label": "${resources.catalogs.grants_catalog.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "full_name": "",
+          "__embed__": [
+            {
+              "principal": "deco-test-user@databricks.com",
+              "privileges": [
+                "CREATE_SCHEMA",
+                "USE_CATALOG"
+              ]
+            }
+          ]
+        },
+        "vars": {
+          "full_name": "${resources.catalogs.grants_catalog.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/grants/catalogs/out.plan2.direct.json b/acceptance/bundle/resources/grants/catalogs/out.plan2.direct.json
deleted file mode 100644
index 33644c3f88a..00000000000
--- a/acceptance/bundle/resources/grants/catalogs/out.plan2.direct.json
+++ /dev/null
@@ -1,67 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.catalogs.grants_catalog": {
-      "action": "skip",
-      "remote_state": {
-        "catalog_type": "MANAGED_CATALOG",
-        "comment": "Test catalog for grants",
-        "full_name": "catalog_grants_[UNIQUE_NAME]",
-        "name": "catalog_grants_[UNIQUE_NAME]",
-        "owner": "[USERNAME]"
-      }
-    },
-    "resources.catalogs.grants_catalog.grants": {
-      "depends_on": [
-        {
-          "node": "resources.catalogs.grants_catalog",
-          "label": "${resources.catalogs.grants_catalog.id}"
-        }
-      ],
-      "action": "update",
-      "new_state": {
-        "value": {
-          "full_name": "catalog_grants_[UNIQUE_NAME]",
-          "__embed__": [
-            {
-              "principal": "deco-test-user@databricks.com",
-              "privileges": [
-                "USE_CATALOG",
-                "USE_SCHEMA"
-              ]
-            }
-          ]
-        }
-      },
-      "remote_state": {
-        "full_name": "catalog_grants_[UNIQUE_NAME]",
-        "__embed__": [
-          {
-            "principal": "deco-test-user@databricks.com",
-            "privileges": [
-              "CREATE_SCHEMA",
-              "USE_CATALOG"
-            ]
-          }
-        ]
-      },
-      "changes": {
-        "[principal='deco-test-user@databricks.com'].privileges[0]": {
-          "action": "update",
-          "old": "CREATE_SCHEMA",
-          "new": "USE_CATALOG",
-          "remote": "CREATE_SCHEMA"
-        },
-        "[principal='deco-test-user@databricks.com'].privileges[1]": {
-          "action": "update",
-          "old": "USE_CATALOG",
-          "new": "USE_SCHEMA",
-          "remote": "USE_CATALOG"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/grants/catalogs/out.plan2.json b/acceptance/bundle/resources/grants/catalogs/out.plan2.json
new file mode 100644
index 00000000000..92d227bc232
--- /dev/null
+++ b/acceptance/bundle/resources/grants/catalogs/out.plan2.json
@@ -0,0 +1,67 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.catalogs.grants_catalog": {
+      "action": "skip",
+      "remote_state": {
+        "catalog_type": "MANAGED_CATALOG",
+        "comment": "Test catalog for grants",
+        "full_name": "catalog_grants_[UNIQUE_NAME]",
+        "name": "catalog_grants_[UNIQUE_NAME]",
+        "owner": "[USERNAME]"
+      }
+    },
+    "resources.catalogs.grants_catalog.grants": {
+      "depends_on": [
+        {
+          "node": "resources.catalogs.grants_catalog",
+          "label": "${resources.catalogs.grants_catalog.id}"
+        }
+      ],
+      "action": "update",
+      "new_state": {
+        "value": {
+          "full_name": "catalog_grants_[UNIQUE_NAME]",
+          "__embed__": [
+            {
+              "principal": "deco-test-user@databricks.com",
+              "privileges": [
+                "USE_CATALOG",
+                "USE_SCHEMA"
+              ]
+            }
+          ]
+        }
+      },
+      "remote_state": {
+        "full_name": "catalog_grants_[UNIQUE_NAME]",
+        "__embed__": [
+          {
+            "principal": "deco-test-user@databricks.com",
+            "privileges": [
+              "CREATE_SCHEMA",
+              "USE_CATALOG"
+            ]
+          }
+        ]
+      },
+      "changes": {
+        "[principal='deco-test-user@databricks.com'].privileges[0]": {
+          "action": "update",
+          "old": "CREATE_SCHEMA",
+          "new": "USE_CATALOG",
+          "remote": "CREATE_SCHEMA"
+        },
+        "[principal='deco-test-user@databricks.com'].privileges[1]": {
+          "action": "update",
+          "old": "USE_CATALOG",
+          "new": "USE_SCHEMA",
+          "remote": "USE_CATALOG"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/grants/catalogs/out.test.toml b/acceptance/bundle/resources/grants/catalogs/out.test.toml
index fe4076cdf9b..0f167effef1 100644
--- a/acceptance/bundle/resources/grants/catalogs/out.test.toml
+++ b/acceptance/bundle/resources/grants/catalogs/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/grants/catalogs/output.txt b/acceptance/bundle/resources/grants/catalogs/output.txt
index 067bd10a705..c0cebc07c3e 100644
--- a/acceptance/bundle/resources/grants/catalogs/output.txt
+++ b/acceptance/bundle/resources/grants/catalogs/output.txt
@@ -11,9 +11,10 @@ Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/catalog-grants-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created catalogs.grants_catalog
+Created catalogs.grants_catalog.grants
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> print_requests.py //permissions
 
@@ -51,9 +52,9 @@ Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/catalog-grants-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated catalogs.grants_catalog.grants
+Files: 3 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 1 unchanged
 
 >>> print_requests.py //permissions
 
@@ -76,7 +77,6 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/catalog-grants-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
 
 >>> print_requests.py //permissions
diff --git a/acceptance/bundle/resources/grants/catalogs/script b/acceptance/bundle/resources/grants/catalogs/script
index b584555570f..712644486c2 100755
--- a/acceptance/bundle/resources/grants/catalogs/script
+++ b/acceptance/bundle/resources/grants/catalogs/script
@@ -1,11 +1,10 @@
 envsubst < databricks.yml.tmpl > databricks.yml
 
 trace $CLI bundle plan
-trace $CLI bundle plan -o json > out.plan1.$DATABRICKS_BUNDLE_ENGINE.json
-jq 'walk(if type == "object" then del(.created_at, .created_by, .updated_at, .updated_by, .metastore_id, .browse_only, .effective_predictive_optimization_flag, .enable_predictive_optimization, .isolation_mode, .securable_type) else . end)' out.plan1.$DATABRICKS_BUNDLE_ENGINE.json > tmp.json && mv tmp.json out.plan1.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp | normalize_uc_payload.py created_at created_by updated_at updated_by metastore_id browse_only effective_predictive_optimization_flag enable_predictive_optimization isolation_mode securable_type > out.plan1.json
 trace print_requests.py --get //permissions
 trace $CLI bundle deploy
-trace print_requests.py //permissions > out.deploy1.requests.$DATABRICKS_BUNDLE_ENGINE.json
+trace print_requests.py //permissions > out.deploy1.requests.json
 
 trace $CLI bundle plan
 
@@ -14,13 +13,12 @@ trace $CLI grants get catalog catalog_grants_$UNIQUE_NAME | jq --sort-keys
 
 update_file.py databricks.yml CREATE_SCHEMA USE_SCHEMA
 
-trace $CLI bundle plan -o json > out.plan2.$DATABRICKS_BUNDLE_ENGINE.json
-jq 'walk(if type == "object" then del(.created_at, .created_by, .updated_at, .updated_by, .metastore_id, .browse_only, .effective_predictive_optimization_flag, .enable_predictive_optimization, .isolation_mode, .securable_type) else . end)' out.plan2.$DATABRICKS_BUNDLE_ENGINE.json > tmp.json && mv tmp.json out.plan2.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp | normalize_uc_payload.py created_at created_by updated_at updated_by metastore_id browse_only effective_predictive_optimization_flag enable_predictive_optimization isolation_mode securable_type > out.plan2.json
 trace print_requests.py --get //permissions
 trace $CLI bundle deploy
-trace print_requests.py //permissions > out.deploy2.requests.$DATABRICKS_BUNDLE_ENGINE.json
+trace print_requests.py //permissions > out.deploy2.requests.json
 
 trace $CLI grants get catalog catalog_grants_$UNIQUE_NAME | jq --sort-keys
 
 trace $CLI bundle destroy --auto-approve
-trace print_requests.py //permissions > out.destroy.requests.$DATABRICKS_BUNDLE_ENGINE.json
+trace print_requests.py //permissions > out.destroy.requests.json
diff --git a/acceptance/bundle/resources/grants/catalogs/test.toml b/acceptance/bundle/resources/grants/catalogs/test.toml
deleted file mode 100644
index f32a7530744..00000000000
--- a/acceptance/bundle/resources/grants/catalogs/test.toml
+++ /dev/null
@@ -1,2 +0,0 @@
-[EnvMatrix]
-  DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/resources/grants/mcp_services/databricks.yml.tmpl b/acceptance/bundle/resources/grants/mcp_services/databricks.yml.tmpl
new file mode 100644
index 00000000000..57a4a6fab25
--- /dev/null
+++ b/acceptance/bundle/resources/grants/mcp_services/databricks.yml.tmpl
@@ -0,0 +1,12 @@
+bundle:
+  name: deploy-mcp-service-grants-$UNIQUE_NAME
+
+resources:
+  mcp_services:
+    my_mcp_service:
+      parent: schemas/main.myschema
+      mcp_service_id: myservice
+      comment: mycomment
+      grants:
+        - principal: deco-test-user@databricks.com
+          privileges: ["APPLY_TAG"]
diff --git a/acceptance/bundle/resources/grants/mcp_services/out.deploy1.requests.json b/acceptance/bundle/resources/grants/mcp_services/out.deploy1.requests.json
new file mode 100644
index 00000000000..6e62d295a5b
--- /dev/null
+++ b/acceptance/bundle/resources/grants/mcp_services/out.deploy1.requests.json
@@ -0,0 +1,17 @@
+{
+  "method": "PATCH",
+  "path": "/api/2.1/unity-catalog/permissions/mcp_service/main.myschema.myservice",
+  "body": {
+    "changes": [
+      {
+        "add": [
+          "APPLY_TAG"
+        ],
+        "principal": "deco-test-user@databricks.com",
+        "remove": [
+          "ALL_PRIVILEGES"
+        ]
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/apps/current_can_manage/out.requests.destroy.direct.json b/acceptance/bundle/resources/grants/mcp_services/out.destroy.requests.json
similarity index 100%
rename from acceptance/bundle/resources/permissions/apps/current_can_manage/out.requests.destroy.direct.json
rename to acceptance/bundle/resources/grants/mcp_services/out.destroy.requests.json
diff --git a/acceptance/bundle/resources/grants/mcp_services/out.plan1.json b/acceptance/bundle/resources/grants/mcp_services/out.plan1.json
new file mode 100644
index 00000000000..9150113092f
--- /dev/null
+++ b/acceptance/bundle/resources/grants/mcp_services/out.plan1.json
@@ -0,0 +1,42 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.mcp_services.my_mcp_service": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "comment": "mycomment",
+          "mcp_service_id": "myservice",
+          "parent": "schemas/main.myschema"
+        }
+      }
+    },
+    "resources.mcp_services.my_mcp_service.grants": {
+      "depends_on": [
+        {
+          "node": "resources.mcp_services.my_mcp_service",
+          "label": "${resources.mcp_services.my_mcp_service.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "securable_type": "mcp_service",
+          "full_name": "",
+          "__embed__": [
+            {
+              "principal": "deco-test-user@databricks.com",
+              "privileges": [
+                "APPLY_TAG"
+              ]
+            }
+          ]
+        },
+        "vars": {
+          "full_name": "${resources.mcp_services.my_mcp_service.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/grants/mcp_services/out.test.toml b/acceptance/bundle/resources/grants/mcp_services/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/grants/mcp_services/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/grants/mcp_services/output.txt b/acceptance/bundle/resources/grants/mcp_services/output.txt
new file mode 100644
index 00000000000..6a81a28bda8
--- /dev/null
+++ b/acceptance/bundle/resources/grants/mcp_services/output.txt
@@ -0,0 +1,35 @@
+
+>>> [CLI] bundle plan -o json
+
+>>> print_requests.py --get //permissions
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-mcp-service-grants-[UNIQUE_NAME]/default/files...
+Created mcp_services.my_mcp_service
+Created mcp_services.my_mcp_service.grants
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //permissions
+
+>>> [CLI] grants get mcp_service main.myschema.myservice
+{
+  "privilege_assignments": [
+    {
+      "principal": "deco-test-user@databricks.com",
+      "privileges": [
+        "APPLY_TAG"
+      ]
+    }
+  ]
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.mcp_services.my_mcp_service
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-mcp-service-grants-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
+
+>>> print_requests.py //permissions
diff --git a/acceptance/bundle/resources/grants/mcp_services/script b/acceptance/bundle/resources/grants/mcp_services/script
new file mode 100644
index 00000000000..eafb6a07c58
--- /dev/null
+++ b/acceptance/bundle/resources/grants/mcp_services/script
@@ -0,0 +1,12 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+trace $CLI bundle plan -o json | jq 'del(.features)' > out.plan1.json
+trace print_requests.py --get //permissions
+trace $CLI bundle deploy
+trace print_requests.py //permissions > out.deploy1.requests.json
+
+# Assert the end result: the grant is applied on the MCP service securable.
+trace $CLI grants get mcp_service main.myschema.myservice | jq --sort-keys
+
+trace $CLI bundle destroy --auto-approve
+trace print_requests.py //permissions > out.destroy.requests.json
diff --git a/acceptance/bundle/resources/grants/mcp_services/test.toml b/acceptance/bundle/resources/grants/mcp_services/test.toml
new file mode 100644
index 00000000000..9434ef4a40a
--- /dev/null
+++ b/acceptance/bundle/resources/grants/mcp_services/test.toml
@@ -0,0 +1,4 @@
+# AI Gateway securables are direct-engine only (no Terraform provider path), so
+# there is no direct-vs-terraform request divergence to reconcile on cloud;
+# compare the recorded requests locally instead.
+Cloud = false
diff --git a/acceptance/bundle/resources/grants/model_provider_services/databricks.yml.tmpl b/acceptance/bundle/resources/grants/model_provider_services/databricks.yml.tmpl
new file mode 100644
index 00000000000..a63044ba962
--- /dev/null
+++ b/acceptance/bundle/resources/grants/model_provider_services/databricks.yml.tmpl
@@ -0,0 +1,23 @@
+bundle:
+  name: deploy-model-provider-service-grants-$UNIQUE_NAME
+
+resources:
+  model_provider_services:
+    my_model_provider_service:
+      parent: schemas/main.myschema
+      model_provider_service_id: myservice
+      comment: mycomment
+      config:
+        provider_type: EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM
+        targets:
+          - model: gpt-4o
+            native_api_types:
+              - openai/v1/chat/completions
+        custom:
+          direct:
+            base_url: https://api.example.com/v1
+            api_key:
+              plaintext: dummy-api-key
+      grants:
+        - principal: deco-test-user@databricks.com
+          privileges: ["APPLY_TAG"]
diff --git a/acceptance/bundle/resources/grants/model_provider_services/out.deploy1.requests.json b/acceptance/bundle/resources/grants/model_provider_services/out.deploy1.requests.json
new file mode 100644
index 00000000000..afcc75cc24f
--- /dev/null
+++ b/acceptance/bundle/resources/grants/model_provider_services/out.deploy1.requests.json
@@ -0,0 +1,17 @@
+{
+  "method": "PATCH",
+  "path": "/api/2.1/unity-catalog/permissions/model_provider_service/main.myschema.myservice",
+  "body": {
+    "changes": [
+      {
+        "add": [
+          "APPLY_TAG"
+        ],
+        "principal": "deco-test-user@databricks.com",
+        "remove": [
+          "ALL_PRIVILEGES"
+        ]
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/apps/other_can_manage/out.requests.destroy.direct.json b/acceptance/bundle/resources/grants/model_provider_services/out.destroy.requests.json
similarity index 100%
rename from acceptance/bundle/resources/permissions/apps/other_can_manage/out.requests.destroy.direct.json
rename to acceptance/bundle/resources/grants/model_provider_services/out.destroy.requests.json
diff --git a/acceptance/bundle/resources/grants/model_provider_services/out.plan1.json b/acceptance/bundle/resources/grants/model_provider_services/out.plan1.json
new file mode 100644
index 00000000000..9c7ead61585
--- /dev/null
+++ b/acceptance/bundle/resources/grants/model_provider_services/out.plan1.json
@@ -0,0 +1,61 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.model_provider_services.my_model_provider_service": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "comment": "mycomment",
+          "config": {
+            "custom": {
+              "direct": {
+                "api_key": {
+                  "plaintext": "dummy-api-key"
+                },
+                "base_url": "https://api.example.com/v1"
+              }
+            },
+            "provider_type": "EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM",
+            "targets": [
+              {
+                "model": "gpt-4o",
+                "native_api_types": [
+                  "openai/v1/chat/completions"
+                ]
+              }
+            ]
+          },
+          "model_provider_service_id": "myservice",
+          "parent": "schemas/main.myschema"
+        }
+      }
+    },
+    "resources.model_provider_services.my_model_provider_service.grants": {
+      "depends_on": [
+        {
+          "node": "resources.model_provider_services.my_model_provider_service",
+          "label": "${resources.model_provider_services.my_model_provider_service.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "securable_type": "model_provider_service",
+          "full_name": "",
+          "__embed__": [
+            {
+              "principal": "deco-test-user@databricks.com",
+              "privileges": [
+                "APPLY_TAG"
+              ]
+            }
+          ]
+        },
+        "vars": {
+          "full_name": "${resources.model_provider_services.my_model_provider_service.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/grants/model_provider_services/out.test.toml b/acceptance/bundle/resources/grants/model_provider_services/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/grants/model_provider_services/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/grants/model_provider_services/output.txt b/acceptance/bundle/resources/grants/model_provider_services/output.txt
new file mode 100644
index 00000000000..686847fb1ac
--- /dev/null
+++ b/acceptance/bundle/resources/grants/model_provider_services/output.txt
@@ -0,0 +1,35 @@
+
+>>> [CLI] bundle plan -o json
+
+>>> print_requests.py --get //permissions
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-model-provider-service-grants-[UNIQUE_NAME]/default/files...
+Created model_provider_services.my_model_provider_service
+Created model_provider_services.my_model_provider_service.grants
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //permissions
+
+>>> [CLI] grants get model_provider_service main.myschema.myservice
+{
+  "privilege_assignments": [
+    {
+      "principal": "deco-test-user@databricks.com",
+      "privileges": [
+        "APPLY_TAG"
+      ]
+    }
+  ]
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.model_provider_services.my_model_provider_service
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-model-provider-service-grants-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
+
+>>> print_requests.py //permissions
diff --git a/acceptance/bundle/resources/grants/model_provider_services/script b/acceptance/bundle/resources/grants/model_provider_services/script
new file mode 100644
index 00000000000..7c9f39f37db
--- /dev/null
+++ b/acceptance/bundle/resources/grants/model_provider_services/script
@@ -0,0 +1,12 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+trace $CLI bundle plan -o json | jq 'del(.features)' > out.plan1.json
+trace print_requests.py --get //permissions
+trace $CLI bundle deploy
+trace print_requests.py //permissions > out.deploy1.requests.json
+
+# Assert the end result: the grant is applied on the model provider service securable.
+trace $CLI grants get model_provider_service main.myschema.myservice | jq --sort-keys
+
+trace $CLI bundle destroy --auto-approve
+trace print_requests.py //permissions > out.destroy.requests.json
diff --git a/acceptance/bundle/resources/grants/model_provider_services/test.toml b/acceptance/bundle/resources/grants/model_provider_services/test.toml
new file mode 100644
index 00000000000..9434ef4a40a
--- /dev/null
+++ b/acceptance/bundle/resources/grants/model_provider_services/test.toml
@@ -0,0 +1,4 @@
+# AI Gateway securables are direct-engine only (no Terraform provider path), so
+# there is no direct-vs-terraform request divergence to reconcile on cloud;
+# compare the recorded requests locally instead.
+Cloud = false
diff --git a/acceptance/bundle/resources/grants/model_services/databricks.yml.tmpl b/acceptance/bundle/resources/grants/model_services/databricks.yml.tmpl
new file mode 100644
index 00000000000..af6033b66dd
--- /dev/null
+++ b/acceptance/bundle/resources/grants/model_services/databricks.yml.tmpl
@@ -0,0 +1,12 @@
+bundle:
+  name: deploy-model-service-grants-$UNIQUE_NAME
+
+resources:
+  model_services:
+    my_model_service:
+      parent: schemas/main.myschema
+      model_service_id: myservice
+      comment: mycomment
+      grants:
+        - principal: deco-test-user@databricks.com
+          privileges: ["APPLY_TAG"]
diff --git a/acceptance/bundle/resources/grants/model_services/out.deploy1.requests.json b/acceptance/bundle/resources/grants/model_services/out.deploy1.requests.json
new file mode 100644
index 00000000000..0cc3d553954
--- /dev/null
+++ b/acceptance/bundle/resources/grants/model_services/out.deploy1.requests.json
@@ -0,0 +1,17 @@
+{
+  "method": "PATCH",
+  "path": "/api/2.1/unity-catalog/permissions/model_service/main.myschema.myservice",
+  "body": {
+    "changes": [
+      {
+        "add": [
+          "APPLY_TAG"
+        ],
+        "principal": "deco-test-user@databricks.com",
+        "remove": [
+          "ALL_PRIVILEGES"
+        ]
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/clusters/current_can_manage/out.requests.destroy.direct.json b/acceptance/bundle/resources/grants/model_services/out.destroy.requests.json
similarity index 100%
rename from acceptance/bundle/resources/permissions/clusters/current_can_manage/out.requests.destroy.direct.json
rename to acceptance/bundle/resources/grants/model_services/out.destroy.requests.json
diff --git a/acceptance/bundle/resources/grants/model_services/out.plan1.json b/acceptance/bundle/resources/grants/model_services/out.plan1.json
new file mode 100644
index 00000000000..8fcd09fb0eb
--- /dev/null
+++ b/acceptance/bundle/resources/grants/model_services/out.plan1.json
@@ -0,0 +1,42 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.model_services.my_model_service": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "comment": "mycomment",
+          "model_service_id": "myservice",
+          "parent": "schemas/main.myschema"
+        }
+      }
+    },
+    "resources.model_services.my_model_service.grants": {
+      "depends_on": [
+        {
+          "node": "resources.model_services.my_model_service",
+          "label": "${resources.model_services.my_model_service.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "securable_type": "model_service",
+          "full_name": "",
+          "__embed__": [
+            {
+              "principal": "deco-test-user@databricks.com",
+              "privileges": [
+                "APPLY_TAG"
+              ]
+            }
+          ]
+        },
+        "vars": {
+          "full_name": "${resources.model_services.my_model_service.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/grants/model_services/out.test.toml b/acceptance/bundle/resources/grants/model_services/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/grants/model_services/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/grants/model_services/output.txt b/acceptance/bundle/resources/grants/model_services/output.txt
new file mode 100644
index 00000000000..4161605ef23
--- /dev/null
+++ b/acceptance/bundle/resources/grants/model_services/output.txt
@@ -0,0 +1,35 @@
+
+>>> [CLI] bundle plan -o json
+
+>>> print_requests.py --get //permissions
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-model-service-grants-[UNIQUE_NAME]/default/files...
+Created model_services.my_model_service
+Created model_services.my_model_service.grants
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //permissions
+
+>>> [CLI] grants get model_service main.myschema.myservice
+{
+  "privilege_assignments": [
+    {
+      "principal": "deco-test-user@databricks.com",
+      "privileges": [
+        "APPLY_TAG"
+      ]
+    }
+  ]
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.model_services.my_model_service
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-model-service-grants-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
+
+>>> print_requests.py //permissions
diff --git a/acceptance/bundle/resources/grants/model_services/script b/acceptance/bundle/resources/grants/model_services/script
new file mode 100644
index 00000000000..60f6d70750c
--- /dev/null
+++ b/acceptance/bundle/resources/grants/model_services/script
@@ -0,0 +1,12 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+trace $CLI bundle plan -o json | jq 'del(.features)' > out.plan1.json
+trace print_requests.py --get //permissions
+trace $CLI bundle deploy
+trace print_requests.py //permissions > out.deploy1.requests.json
+
+# Assert the end result: the grant is applied on the model service securable.
+trace $CLI grants get model_service main.myschema.myservice | jq --sort-keys
+
+trace $CLI bundle destroy --auto-approve
+trace print_requests.py //permissions > out.destroy.requests.json
diff --git a/acceptance/bundle/resources/grants/model_services/test.toml b/acceptance/bundle/resources/grants/model_services/test.toml
new file mode 100644
index 00000000000..9434ef4a40a
--- /dev/null
+++ b/acceptance/bundle/resources/grants/model_services/test.toml
@@ -0,0 +1,4 @@
+# AI Gateway securables are direct-engine only (no Terraform provider path), so
+# there is no direct-vs-terraform request divergence to reconcile on cloud;
+# compare the recorded requests locally instead.
+Cloud = false
diff --git a/acceptance/bundle/resources/grants/registered_models/out.deploy1.requests.direct.json b/acceptance/bundle/resources/grants/registered_models/out.deploy1.requests.json
similarity index 100%
rename from acceptance/bundle/resources/grants/registered_models/out.deploy1.requests.direct.json
rename to acceptance/bundle/resources/grants/registered_models/out.deploy1.requests.json
diff --git a/acceptance/bundle/resources/grants/registered_models/out.deploy1.requests.terraform.json b/acceptance/bundle/resources/grants/registered_models/out.deploy1.requests.terraform.json
deleted file mode 100644
index 81ca56fd5da..00000000000
--- a/acceptance/bundle/resources/grants/registered_models/out.deploy1.requests.terraform.json
+++ /dev/null
@@ -1,14 +0,0 @@
-{
-  "method": "PATCH",
-  "path": "/api/2.1/unity-catalog/permissions/function/main.myschema_[UNIQUE_NAME].mymodel",
-  "body": {
-    "changes": [
-      {
-        "add": [
-          "APPLY_TAG"
-        ],
-        "principal": "deco-test-user@databricks.com"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/dashboards/create/out.requests.destroy.direct.json b/acceptance/bundle/resources/grants/registered_models/out.destroy.requests.json
similarity index 100%
rename from acceptance/bundle/resources/permissions/dashboards/create/out.requests.destroy.direct.json
rename to acceptance/bundle/resources/grants/registered_models/out.destroy.requests.json
diff --git a/acceptance/bundle/resources/grants/registered_models/out.destroy.requests.terraform.json b/acceptance/bundle/resources/grants/registered_models/out.destroy.requests.terraform.json
deleted file mode 100644
index a7b7aa0014e..00000000000
--- a/acceptance/bundle/resources/grants/registered_models/out.destroy.requests.terraform.json
+++ /dev/null
@@ -1,14 +0,0 @@
-{
-  "method": "PATCH",
-  "path": "/api/2.1/unity-catalog/permissions/function/main.myschema_[UNIQUE_NAME].mymodel",
-  "body": {
-    "changes": [
-      {
-        "principal": "deco-test-user@databricks.com",
-        "remove": [
-          "APPLY_TAG"
-        ]
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/grants/registered_models/out.plan1.direct.json b/acceptance/bundle/resources/grants/registered_models/out.plan1.direct.json
deleted file mode 100644
index 482faa449f7..00000000000
--- a/acceptance/bundle/resources/grants/registered_models/out.plan1.direct.json
+++ /dev/null
@@ -1,58 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.registered_models.my_registered_model": {
-      "depends_on": [
-        {
-          "node": "resources.schemas.my_schema",
-          "label": "${resources.schemas.my_schema.name}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "catalog_name": "main",
-          "comment": "mycomment",
-          "name": "mymodel",
-          "schema_name": "myschema_[UNIQUE_NAME]"
-        }
-      }
-    },
-    "resources.registered_models.my_registered_model.grants": {
-      "depends_on": [
-        {
-          "node": "resources.registered_models.my_registered_model",
-          "label": "${resources.registered_models.my_registered_model.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "securable_type": "function",
-          "full_name": "",
-          "__embed__": [
-            {
-              "principal": "deco-test-user@databricks.com",
-              "privileges": [
-                "APPLY_TAG"
-              ]
-            }
-          ]
-        },
-        "vars": {
-          "full_name": "${resources.registered_models.my_registered_model.id}"
-        }
-      }
-    },
-    "resources.schemas.my_schema": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "catalog_name": "main",
-          "name": "myschema_[UNIQUE_NAME]"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/grants/registered_models/out.plan1.json b/acceptance/bundle/resources/grants/registered_models/out.plan1.json
new file mode 100644
index 00000000000..3212aa76ea6
--- /dev/null
+++ b/acceptance/bundle/resources/grants/registered_models/out.plan1.json
@@ -0,0 +1,58 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.registered_models.my_registered_model": {
+      "depends_on": [
+        {
+          "node": "resources.schemas.my_schema",
+          "label": "${resources.schemas.my_schema.name}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "catalog_name": "main",
+          "comment": "mycomment",
+          "name": "mymodel",
+          "schema_name": "myschema_[UNIQUE_NAME]"
+        }
+      }
+    },
+    "resources.registered_models.my_registered_model.grants": {
+      "depends_on": [
+        {
+          "node": "resources.registered_models.my_registered_model",
+          "label": "${resources.registered_models.my_registered_model.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "securable_type": "function",
+          "full_name": "",
+          "__embed__": [
+            {
+              "principal": "deco-test-user@databricks.com",
+              "privileges": [
+                "APPLY_TAG"
+              ]
+            }
+          ]
+        },
+        "vars": {
+          "full_name": "${resources.registered_models.my_registered_model.id}"
+        }
+      }
+    },
+    "resources.schemas.my_schema": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "catalog_name": "main",
+          "name": "myschema_[UNIQUE_NAME]"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/grants/registered_models/out.plan1.terraform.json b/acceptance/bundle/resources/grants/registered_models/out.plan1.terraform.json
deleted file mode 100644
index 109bbcd08c8..00000000000
--- a/acceptance/bundle/resources/grants/registered_models/out.plan1.terraform.json
+++ /dev/null
@@ -1,14 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.registered_models.my_registered_model": {
-      "action": "create"
-    },
-    "resources.registered_models.my_registered_model.grants": {
-      "action": "create"
-    },
-    "resources.schemas.my_schema": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/grants/registered_models/out.test.toml b/acceptance/bundle/resources/grants/registered_models/out.test.toml
index e849ec85ace..0f167effef1 100644
--- a/acceptance/bundle/resources/grants/registered_models/out.test.toml
+++ b/acceptance/bundle/resources/grants/registered_models/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/grants/registered_models/output.txt b/acceptance/bundle/resources/grants/registered_models/output.txt
index cac10d76919..9c0adc9a866 100644
--- a/acceptance/bundle/resources/grants/registered_models/output.txt
+++ b/acceptance/bundle/resources/grants/registered_models/output.txt
@@ -5,9 +5,11 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-registered-models-basic-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created registered_models.my_registered_model
+Created registered_models.my_registered_model.grants
+Created schemas.my_schema
+Files: 3 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> print_requests.py //permissions
 
@@ -33,7 +35,6 @@ This action will result in the deletion of the following UC schemas. Any underly
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-registered-models-basic-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 2 deleted
 
 >>> print_requests.py //permissions
diff --git a/acceptance/bundle/resources/grants/registered_models/script b/acceptance/bundle/resources/grants/registered_models/script
index 98d73773afc..f47f85565de 100644
--- a/acceptance/bundle/resources/grants/registered_models/script
+++ b/acceptance/bundle/resources/grants/registered_models/script
@@ -1,12 +1,12 @@
 envsubst < databricks.yml.tmpl > databricks.yml
 
-trace $CLI bundle plan -o json > out.plan1.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.plan1.json
 trace print_requests.py --get //permissions
 trace $CLI bundle deploy
-trace print_requests.py //permissions > out.deploy1.requests.$DATABRICKS_BUNDLE_ENGINE.json
+trace print_requests.py //permissions > out.deploy1.requests.json
 
 # Since we're sending different requests between terraform and direct, assert that the end result is the same:
 trace $CLI grants get function main.myschema_$UNIQUE_NAME.mymodel | jq --sort-keys
 
 trace $CLI bundle destroy --auto-approve
-trace print_requests.py //permissions > out.destroy.requests.$DATABRICKS_BUNDLE_ENGINE.json
+trace print_requests.py //permissions > out.destroy.requests.json
diff --git a/acceptance/bundle/resources/grants/schemas/all_privileges/out.requests.terraform.txt b/acceptance/bundle/resources/grants/schemas/all_privileges/out.requests.terraform.txt
deleted file mode 100644
index 5fc2fe369b7..00000000000
--- a/acceptance/bundle/resources/grants/schemas/all_privileges/out.requests.terraform.txt
+++ /dev/null
@@ -1,26 +0,0 @@
-{
-  "method": "GET",
-  "path": "/api/2.1/unity-catalog/permissions/schema/main.schema_dup_grants_[UNIQUE_NAME]"
-}
-{
-  "method": "PATCH",
-  "path": "/api/2.1/unity-catalog/permissions/schema/main.schema_dup_grants_[UNIQUE_NAME]",
-  "body": {
-    "changes": [
-      {
-        "add": [
-          "ALL_PRIVILEGES"
-        ],
-        "principal": "deco-test-user@databricks.com"
-      }
-    ]
-  }
-}
-{
-  "method": "GET",
-  "path": "/api/2.1/unity-catalog/permissions/schema/main.schema_dup_grants_[UNIQUE_NAME]"
-}
-{
-  "method": "GET",
-  "path": "/api/2.1/unity-catalog/permissions/schema/main.schema_dup_grants_[UNIQUE_NAME]"
-}
diff --git a/acceptance/bundle/resources/grants/schemas/all_privileges/out.requests.direct.txt b/acceptance/bundle/resources/grants/schemas/all_privileges/out.requests.txt
similarity index 100%
rename from acceptance/bundle/resources/grants/schemas/all_privileges/out.requests.direct.txt
rename to acceptance/bundle/resources/grants/schemas/all_privileges/out.requests.txt
diff --git a/acceptance/bundle/resources/grants/schemas/all_privileges/out.test.toml b/acceptance/bundle/resources/grants/schemas/all_privileges/out.test.toml
index e849ec85ace..0f167effef1 100644
--- a/acceptance/bundle/resources/grants/schemas/all_privileges/out.test.toml
+++ b/acceptance/bundle/resources/grants/schemas/all_privileges/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/grants/schemas/all_privileges/output.txt b/acceptance/bundle/resources/grants/schemas/all_privileges/output.txt
index e88c30715f3..499dd38b143 100644
--- a/acceptance/bundle/resources/grants/schemas/all_privileges/output.txt
+++ b/acceptance/bundle/resources/grants/schemas/all_privileges/output.txt
@@ -1,7 +1,8 @@
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/schema-dup-grants-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created schemas.apps_schema
+Created schemas.apps_schema.grants
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
@@ -12,5 +13,4 @@ This action will result in the deletion of the following UC schemas. Any underly
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/schema-dup-grants-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/grants/schemas/all_privileges/script b/acceptance/bundle/resources/grants/schemas/all_privileges/script
index e8f6e243dd9..2c75f89b237 100644
--- a/acceptance/bundle/resources/grants/schemas/all_privileges/script
+++ b/acceptance/bundle/resources/grants/schemas/all_privileges/script
@@ -2,11 +2,11 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm -f out.requests.txt
+    rm -f "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
 # The direct engine puts ALL_PRIVILEGES in both the Add and Remove lists in the PATCH request,
 # which the backend rejects with "Duplicate privileges to add and delete".
 $CLI bundle deploy
-print_requests.py --get //permissions --keep > out.requests.$DATABRICKS_BUNDLE_ENGINE.txt
+print_requests.py --get //permissions --keep > out.requests.txt
diff --git a/acceptance/bundle/resources/grants/schemas/all_privileges_coexist/databricks.yml.tmpl b/acceptance/bundle/resources/grants/schemas/all_privileges_coexist/databricks.yml.tmpl
new file mode 100644
index 00000000000..8266f099163
--- /dev/null
+++ b/acceptance/bundle/resources/grants/schemas/all_privileges_coexist/databricks.yml.tmpl
@@ -0,0 +1,17 @@
+bundle:
+  name: schema-grants-all-privileges-coexist-$UNIQUE_NAME
+
+resources:
+  schemas:
+    grants_schema:
+      name: schema_all_priv_coexist_$UNIQUE_NAME
+      catalog_name: main
+      grants:
+        # Config declares only ALL_PRIVILEGES for the principal. Reproduces
+        # issue #6030: the backend also reports a concrete privilege for this
+        # principal (added out of band below / materialized for owners), and
+        # buildGrantChanges skips the ALL_PRIVILEGES removal, so the concrete
+        # privilege is never reconciled and the plan reports perpetual update.
+        - principal: $CURRENT_USER_NAME
+          privileges:
+            - ALL_PRIVILEGES
diff --git a/acceptance/bundle/resources/grants/schemas/duplicate_privileges/out.plan.direct.txt b/acceptance/bundle/resources/grants/schemas/all_privileges_coexist/out.plan.txt
similarity index 100%
rename from acceptance/bundle/resources/grants/schemas/duplicate_privileges/out.plan.direct.txt
rename to acceptance/bundle/resources/grants/schemas/all_privileges_coexist/out.plan.txt
diff --git a/acceptance/bundle/resources/grants/schemas/all_privileges_coexist/out.test.toml b/acceptance/bundle/resources/grants/schemas/all_privileges_coexist/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/grants/schemas/all_privileges_coexist/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/grants/schemas/all_privileges_coexist/output.txt b/acceptance/bundle/resources/grants/schemas/all_privileges_coexist/output.txt
new file mode 100644
index 00000000000..cccd4d9a14c
--- /dev/null
+++ b/acceptance/bundle/resources/grants/schemas/all_privileges_coexist/output.txt
@@ -0,0 +1,25 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/schema-grants-all-privileges-coexist-[UNIQUE_NAME]/default/files...
+Created schemas.grants_schema
+Created schemas.grants_schema.grants
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] grants update schema main.schema_all_priv_coexist_[UNIQUE_NAME] --json @update.resolved.json
+
+>>> [CLI] bundle deploy -qq
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
+
+>>> errcode [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.schemas.grants_schema
+
+This action will result in the deletion of the following UC schemas. Any underlying data may be lost:
+  delete resources.schemas.grants_schema
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/schema-grants-all-privileges-coexist-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/grants/schemas/all_privileges_coexist/script b/acceptance/bundle/resources/grants/schemas/all_privileges_coexist/script
new file mode 100644
index 00000000000..a7b1940d20b
--- /dev/null
+++ b/acceptance/bundle/resources/grants/schemas/all_privileges_coexist/script
@@ -0,0 +1,28 @@
+SCHEMA_FULL_NAME=main.schema_all_priv_coexist_$UNIQUE_NAME
+
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace errcode $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+trace $CLI bundle deploy
+
+# Out of band, grant a concrete privilege in addition to the ALL_PRIVILEGES that
+# the config declares for the same principal. This reproduces issue #6030: the
+# backend then reports both ALL_PRIVILEGES and the concrete privilege.
+envsubst < update.json > update.resolved.json
+trace $CLI grants update schema "$SCHEMA_FULL_NAME" --json @update.resolved.json > /dev/null
+
+# The first plan differs between engines: the direct engine treats ALL_PRIVILEGES
+# as implying every concrete privilege, so it reports no drift (issue #6030),
+# while terraform revokes the extra privilege to match the config exactly.
+trace $CLI bundle plan > out.plan.txt 2>&1
+
+# After deploying, both engines converge: the follow-up plan reports no changes.
+# The deploy summary itself still diverges here (terraform revokes the extra
+# privilege and reports 1 changed; direct sees no drift and reports it as
+# unchanged), so deploy with -qq to keep the output engine-stable.
+trace $CLI bundle deploy -qq
+trace $CLI bundle plan
diff --git a/acceptance/bundle/resources/grants/schemas/all_privileges_coexist/test.toml b/acceptance/bundle/resources/grants/schemas/all_privileges_coexist/test.toml
new file mode 100644
index 00000000000..16f1b926e21
--- /dev/null
+++ b/acceptance/bundle/resources/grants/schemas/all_privileges_coexist/test.toml
@@ -0,0 +1,2 @@
+RecordRequests = false
+Ignore = ['update.resolved.json']
diff --git a/acceptance/bundle/resources/grants/schemas/all_privileges_coexist/update.json b/acceptance/bundle/resources/grants/schemas/all_privileges_coexist/update.json
new file mode 100644
index 00000000000..d43aec70917
--- /dev/null
+++ b/acceptance/bundle/resources/grants/schemas/all_privileges_coexist/update.json
@@ -0,0 +1,8 @@
+{
+  "changes": [
+    {
+      "principal": "$CURRENT_USER_NAME",
+      "add": ["USE_SCHEMA"]
+    }
+  ]
+}
diff --git a/acceptance/bundle/resources/grants/schemas/all_privileges_manage/databricks.yml.tmpl b/acceptance/bundle/resources/grants/schemas/all_privileges_manage/databricks.yml.tmpl
new file mode 100644
index 00000000000..a1bfcbf0607
--- /dev/null
+++ b/acceptance/bundle/resources/grants/schemas/all_privileges_manage/databricks.yml.tmpl
@@ -0,0 +1,18 @@
+bundle:
+  name: schema-grants-all-privileges-manage-$UNIQUE_NAME
+
+resources:
+  schemas:
+    grants_schema:
+      name: schema_all_priv_manage_$UNIQUE_NAME
+      catalog_name: main
+      grants:
+        # Config declares both MANAGE and ALL_PRIVILEGES for the principal.
+        # ALL_PRIVILEGES does not imply MANAGE (UC treats MANAGE as a distinct
+        # privilege), so both must reach the backend. Reproduces the bug where
+        # normalizeAssignments collapses the list to just ALL_PRIVILEGES and
+        # silently drops MANAGE.
+        - principal: $CURRENT_USER_NAME
+          privileges:
+            - MANAGE
+            - ALL_PRIVILEGES
diff --git a/acceptance/bundle/resources/grants/schemas/all_privileges_manage/out.test.toml b/acceptance/bundle/resources/grants/schemas/all_privileges_manage/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/grants/schemas/all_privileges_manage/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/grants/schemas/all_privileges_manage/output.txt b/acceptance/bundle/resources/grants/schemas/all_privileges_manage/output.txt
new file mode 100644
index 00000000000..d31b6a0422e
--- /dev/null
+++ b/acceptance/bundle/resources/grants/schemas/all_privileges_manage/output.txt
@@ -0,0 +1,42 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/schema-grants-all-privileges-manage-[UNIQUE_NAME]/default/files...
+Created schemas.grants_schema
+Created schemas.grants_schema.grants
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py --method PATCH //permissions
+{
+  "method": "PATCH",
+  "path": "/api/2.1/unity-catalog/permissions/schema/main.schema_all_priv_manage_[UNIQUE_NAME]",
+  "body": {
+    "changes": [
+      {
+        "add": [
+          "ALL_PRIVILEGES",
+          "MANAGE"
+        ],
+        "principal": "[USERNAME]"
+      }
+    ]
+  }
+}
+
+>>> [CLI] grants get schema main.schema_all_priv_manage_[UNIQUE_NAME] -o json
+ALL_PRIVILEGES
+MANAGE
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
+
+>>> errcode [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.schemas.grants_schema
+
+This action will result in the deletion of the following UC schemas. Any underlying data may be lost:
+  delete resources.schemas.grants_schema
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/schema-grants-all-privileges-manage-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/grants/schemas/all_privileges_manage/script b/acceptance/bundle/resources/grants/schemas/all_privileges_manage/script
new file mode 100644
index 00000000000..786ee46d8a0
--- /dev/null
+++ b/acceptance/bundle/resources/grants/schemas/all_privileges_manage/script
@@ -0,0 +1,23 @@
+SCHEMA_FULL_NAME=main.schema_all_priv_manage_$UNIQUE_NAME
+
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace errcode $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+trace $CLI bundle deploy
+
+# The PATCH sent to the backend must add both MANAGE and ALL_PRIVILEGES: ALL_PRIVILEGES
+# does not imply MANAGE, so dropping MANAGE here silently strips the grant. Both engines
+# send the same request.
+trace print_requests.py --method PATCH //permissions
+
+# Read the grants back: both MANAGE and ALL_PRIVILEGES must be present. Privilege order
+# is backend-controlled, so extract and sort the principal's privileges into a stable list.
+trace $CLI grants get schema "$SCHEMA_FULL_NAME" -o json | jq -r ".privilege_assignments[] | select(.principal == env.CURRENT_USER_NAME) | .privileges[]" | sort
+
+# A follow-up plan must report no changes.
+trace $CLI bundle plan
diff --git a/acceptance/bundle/resources/grants/schemas/change_privilege/out.deploy1.requests.direct.json b/acceptance/bundle/resources/grants/schemas/change_privilege/out.deploy1.requests.json
similarity index 100%
rename from acceptance/bundle/resources/grants/schemas/change_privilege/out.deploy1.requests.direct.json
rename to acceptance/bundle/resources/grants/schemas/change_privilege/out.deploy1.requests.json
diff --git a/acceptance/bundle/resources/grants/schemas/change_privilege/out.deploy1.requests.terraform.json b/acceptance/bundle/resources/grants/schemas/change_privilege/out.deploy1.requests.terraform.json
deleted file mode 100644
index 8df50a099a6..00000000000
--- a/acceptance/bundle/resources/grants/schemas/change_privilege/out.deploy1.requests.terraform.json
+++ /dev/null
@@ -1,15 +0,0 @@
-{
-  "method": "PATCH",
-  "path": "/api/2.1/unity-catalog/permissions/schema/main.schema_grants_[UNIQUE_NAME]",
-  "body": {
-    "changes": [
-      {
-        "add": [
-          "CREATE_TABLE",
-          "USE_SCHEMA"
-        ],
-        "principal": "deco-test-user@databricks.com"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/grants/schemas/change_privilege/out.deploy2.requests.direct.json b/acceptance/bundle/resources/grants/schemas/change_privilege/out.deploy2.requests.json
similarity index 100%
rename from acceptance/bundle/resources/grants/schemas/change_privilege/out.deploy2.requests.direct.json
rename to acceptance/bundle/resources/grants/schemas/change_privilege/out.deploy2.requests.json
diff --git a/acceptance/bundle/resources/grants/schemas/change_privilege/out.deploy2.requests.terraform.json b/acceptance/bundle/resources/grants/schemas/change_privilege/out.deploy2.requests.terraform.json
deleted file mode 100644
index ed621fada48..00000000000
--- a/acceptance/bundle/resources/grants/schemas/change_privilege/out.deploy2.requests.terraform.json
+++ /dev/null
@@ -1,17 +0,0 @@
-{
-  "method": "PATCH",
-  "path": "/api/2.1/unity-catalog/permissions/schema/main.schema_grants_[UNIQUE_NAME]",
-  "body": {
-    "changes": [
-      {
-        "add": [
-          "APPLY_TAG"
-        ],
-        "principal": "deco-test-user@databricks.com",
-        "remove": [
-          "USE_SCHEMA"
-        ]
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/database_instances/current_can_manage/out.requests.destroy.direct.json b/acceptance/bundle/resources/grants/schemas/change_privilege/out.destroy.requests.json
similarity index 100%
rename from acceptance/bundle/resources/permissions/database_instances/current_can_manage/out.requests.destroy.direct.json
rename to acceptance/bundle/resources/grants/schemas/change_privilege/out.destroy.requests.json
diff --git a/acceptance/bundle/resources/grants/schemas/change_privilege/out.destroy.requests.terraform.json b/acceptance/bundle/resources/grants/schemas/change_privilege/out.destroy.requests.terraform.json
deleted file mode 100644
index 4c2f8a1b01d..00000000000
--- a/acceptance/bundle/resources/grants/schemas/change_privilege/out.destroy.requests.terraform.json
+++ /dev/null
@@ -1,15 +0,0 @@
-{
-  "method": "PATCH",
-  "path": "/api/2.1/unity-catalog/permissions/schema/main.schema_grants_[UNIQUE_NAME]",
-  "body": {
-    "changes": [
-      {
-        "principal": "deco-test-user@databricks.com",
-        "remove": [
-          "CREATE_TABLE",
-          "APPLY_TAG"
-        ]
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/grants/schemas/change_privilege/out.plan1.direct.json b/acceptance/bundle/resources/grants/schemas/change_privilege/out.plan1.direct.json
deleted file mode 100644
index c8d1428519c..00000000000
--- a/acceptance/bundle/resources/grants/schemas/change_privilege/out.plan1.direct.json
+++ /dev/null
@@ -1,42 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.schemas.grants_schema": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "catalog_name": "main",
-          "name": "schema_grants_[UNIQUE_NAME]"
-        }
-      }
-    },
-    "resources.schemas.grants_schema.grants": {
-      "depends_on": [
-        {
-          "node": "resources.schemas.grants_schema",
-          "label": "${resources.schemas.grants_schema.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "securable_type": "schema",
-          "full_name": "",
-          "__embed__": [
-            {
-              "principal": "deco-test-user@databricks.com",
-              "privileges": [
-                "CREATE_TABLE",
-                "USE_SCHEMA"
-              ]
-            }
-          ]
-        },
-        "vars": {
-          "full_name": "${resources.schemas.grants_schema.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/grants/schemas/change_privilege/out.plan1.json b/acceptance/bundle/resources/grants/schemas/change_privilege/out.plan1.json
new file mode 100644
index 00000000000..7008e57196e
--- /dev/null
+++ b/acceptance/bundle/resources/grants/schemas/change_privilege/out.plan1.json
@@ -0,0 +1,42 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.schemas.grants_schema": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "catalog_name": "main",
+          "name": "schema_grants_[UNIQUE_NAME]"
+        }
+      }
+    },
+    "resources.schemas.grants_schema.grants": {
+      "depends_on": [
+        {
+          "node": "resources.schemas.grants_schema",
+          "label": "${resources.schemas.grants_schema.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "securable_type": "schema",
+          "full_name": "",
+          "__embed__": [
+            {
+              "principal": "deco-test-user@databricks.com",
+              "privileges": [
+                "CREATE_TABLE",
+                "USE_SCHEMA"
+              ]
+            }
+          ]
+        },
+        "vars": {
+          "full_name": "${resources.schemas.grants_schema.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/grants/schemas/change_privilege/out.plan1.terraform.json b/acceptance/bundle/resources/grants/schemas/change_privilege/out.plan1.terraform.json
deleted file mode 100644
index 21023df4a3d..00000000000
--- a/acceptance/bundle/resources/grants/schemas/change_privilege/out.plan1.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.schemas.grants_schema": {
-      "action": "create"
-    },
-    "resources.schemas.grants_schema.grants": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/grants/schemas/change_privilege/out.plan2.direct.json b/acceptance/bundle/resources/grants/schemas/change_privilege/out.plan2.direct.json
deleted file mode 100644
index 65d5233c1b5..00000000000
--- a/acceptance/bundle/resources/grants/schemas/change_privilege/out.plan2.direct.json
+++ /dev/null
@@ -1,72 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.schemas.grants_schema": {
-      "action": "skip",
-      "remote_state": {
-        "browse_only": false,
-        "catalog_name": "main",
-        "catalog_type": "MANAGED_CATALOG",
-        "created_at": [UNIX_TIME_MILLIS],
-        "created_by": "[USERNAME]",
-        "full_name": "main.schema_grants_[UNIQUE_NAME]",
-        "name": "schema_grants_[UNIQUE_NAME]",
-        "owner": "[USERNAME]"
-      }
-    },
-    "resources.schemas.grants_schema.grants": {
-      "depends_on": [
-        {
-          "node": "resources.schemas.grants_schema",
-          "label": "${resources.schemas.grants_schema.id}"
-        }
-      ],
-      "action": "update",
-      "new_state": {
-        "value": {
-          "securable_type": "schema",
-          "full_name": "main.schema_grants_[UNIQUE_NAME]",
-          "__embed__": [
-            {
-              "principal": "deco-test-user@databricks.com",
-              "privileges": [
-                "APPLY_TAG",
-                "CREATE_TABLE"
-              ]
-            }
-          ]
-        }
-      },
-      "remote_state": {
-        "securable_type": "schema",
-        "full_name": "main.schema_grants_[UNIQUE_NAME]",
-        "__embed__": [
-          {
-            "principal": "deco-test-user@databricks.com",
-            "privileges": [
-              "CREATE_TABLE",
-              "USE_SCHEMA"
-            ]
-          }
-        ]
-      },
-      "changes": {
-        "[principal='deco-test-user@databricks.com'].privileges[0]": {
-          "action": "update",
-          "old": "CREATE_TABLE",
-          "new": "APPLY_TAG",
-          "remote": "CREATE_TABLE"
-        },
-        "[principal='deco-test-user@databricks.com'].privileges[1]": {
-          "action": "update",
-          "old": "USE_SCHEMA",
-          "new": "CREATE_TABLE",
-          "remote": "USE_SCHEMA"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/grants/schemas/change_privilege/out.plan2.json b/acceptance/bundle/resources/grants/schemas/change_privilege/out.plan2.json
new file mode 100644
index 00000000000..5a9c37ee3f1
--- /dev/null
+++ b/acceptance/bundle/resources/grants/schemas/change_privilege/out.plan2.json
@@ -0,0 +1,72 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.schemas.grants_schema": {
+      "action": "skip",
+      "remote_state": {
+        "browse_only": false,
+        "catalog_name": "main",
+        "catalog_type": "MANAGED_CATALOG",
+        "created_at": [UNIX_TIME_MILLIS],
+        "created_by": "[USERNAME]",
+        "full_name": "main.schema_grants_[UNIQUE_NAME]",
+        "name": "schema_grants_[UNIQUE_NAME]",
+        "owner": "[USERNAME]"
+      }
+    },
+    "resources.schemas.grants_schema.grants": {
+      "depends_on": [
+        {
+          "node": "resources.schemas.grants_schema",
+          "label": "${resources.schemas.grants_schema.id}"
+        }
+      ],
+      "action": "update",
+      "new_state": {
+        "value": {
+          "securable_type": "schema",
+          "full_name": "main.schema_grants_[UNIQUE_NAME]",
+          "__embed__": [
+            {
+              "principal": "deco-test-user@databricks.com",
+              "privileges": [
+                "APPLY_TAG",
+                "CREATE_TABLE"
+              ]
+            }
+          ]
+        }
+      },
+      "remote_state": {
+        "securable_type": "schema",
+        "full_name": "main.schema_grants_[UNIQUE_NAME]",
+        "__embed__": [
+          {
+            "principal": "deco-test-user@databricks.com",
+            "privileges": [
+              "CREATE_TABLE",
+              "USE_SCHEMA"
+            ]
+          }
+        ]
+      },
+      "changes": {
+        "[principal='deco-test-user@databricks.com'].privileges[0]": {
+          "action": "update",
+          "old": "CREATE_TABLE",
+          "new": "APPLY_TAG",
+          "remote": "CREATE_TABLE"
+        },
+        "[principal='deco-test-user@databricks.com'].privileges[1]": {
+          "action": "update",
+          "old": "USE_SCHEMA",
+          "new": "CREATE_TABLE",
+          "remote": "USE_SCHEMA"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/grants/schemas/change_privilege/out.plan2.terraform.json b/acceptance/bundle/resources/grants/schemas/change_privilege/out.plan2.terraform.json
deleted file mode 100644
index ea73a95ede0..00000000000
--- a/acceptance/bundle/resources/grants/schemas/change_privilege/out.plan2.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.schemas.grants_schema": {
-      "action": "skip"
-    },
-    "resources.schemas.grants_schema.grants": {
-      "action": "update"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/grants/schemas/change_privilege/out.test.toml b/acceptance/bundle/resources/grants/schemas/change_privilege/out.test.toml
index e849ec85ace..0f167effef1 100644
--- a/acceptance/bundle/resources/grants/schemas/change_privilege/out.test.toml
+++ b/acceptance/bundle/resources/grants/schemas/change_privilege/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/grants/schemas/change_privilege/output.txt b/acceptance/bundle/resources/grants/schemas/change_privilege/output.txt
index eb8ee21d641..e74593e93bd 100644
--- a/acceptance/bundle/resources/grants/schemas/change_privilege/output.txt
+++ b/acceptance/bundle/resources/grants/schemas/change_privilege/output.txt
@@ -11,9 +11,10 @@ Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/schema-grants-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created schemas.grants_schema
+Created schemas.grants_schema.grants
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> print_requests.py //permissions
 
@@ -51,9 +52,9 @@ Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/schema-grants-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated schemas.grants_schema.grants
+Files: 3 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 1 unchanged
 
 >>> print_requests.py //permissions
 
@@ -79,7 +80,6 @@ This action will result in the deletion of the following UC schemas. Any underly
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/schema-grants-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
 
 >>> print_requests.py //permissions
diff --git a/acceptance/bundle/resources/grants/schemas/change_privilege/script b/acceptance/bundle/resources/grants/schemas/change_privilege/script
index 0000f3eeb71..dfdd127c75e 100644
--- a/acceptance/bundle/resources/grants/schemas/change_privilege/script
+++ b/acceptance/bundle/resources/grants/schemas/change_privilege/script
@@ -1,10 +1,10 @@
 envsubst < databricks.yml.tmpl > databricks.yml
 
 trace $CLI bundle plan
-trace $CLI bundle plan -o json > out.plan1.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.plan1.json
 trace print_requests.py --get //permissions
 trace $CLI bundle deploy
-trace print_requests.py //permissions > out.deploy1.requests.$DATABRICKS_BUNDLE_ENGINE.json
+trace print_requests.py //permissions > out.deploy1.requests.json
 
 trace $CLI bundle plan
 
@@ -13,13 +13,12 @@ trace $CLI grants get schema main.schema_grants_$UNIQUE_NAME | jq --sort-keys
 
 update_file.py databricks.yml USE_SCHEMA APPLY_TAG
 
-trace $CLI bundle plan -o json > out.plan2.$DATABRICKS_BUNDLE_ENGINE.json
-jq 'walk(if type == "object" then del(.effective_predictive_optimization_flag, .enable_predictive_optimization, .metastore_id, .schema_id, .updated_at, .updated_by) else . end)' out.plan2.$DATABRICKS_BUNDLE_ENGINE.json > tmp.json && mv tmp.json out.plan2.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp | normalize_uc_payload.py effective_predictive_optimization_flag enable_predictive_optimization metastore_id schema_id updated_at updated_by > out.plan2.json
 trace print_requests.py --get //permissions
 trace $CLI bundle deploy
-trace print_requests.py //permissions > out.deploy2.requests.$DATABRICKS_BUNDLE_ENGINE.json
+trace print_requests.py //permissions > out.deploy2.requests.json
 
 trace $CLI grants get schema main.schema_grants_$UNIQUE_NAME | jq --sort-keys
 
 trace $CLI bundle destroy --auto-approve
-trace print_requests.py //permissions > out.destroy.requests.$DATABRICKS_BUNDLE_ENGINE.json
+trace print_requests.py //permissions > out.destroy.requests.json
diff --git a/acceptance/bundle/resources/grants/schemas/duplicate_principals/out.plan.direct.json b/acceptance/bundle/resources/grants/schemas/duplicate_principals/out.plan.direct.json
deleted file mode 100644
index 85d713a72e0..00000000000
--- a/acceptance/bundle/resources/grants/schemas/duplicate_principals/out.plan.direct.json
+++ /dev/null
@@ -1,52 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.schemas.apps_schema": {
-      "action": "skip",
-      "remote_state": {
-        "browse_only": false,
-        "catalog_name": "main",
-        "catalog_type": "MANAGED_CATALOG",
-        "created_at": [UNIX_TIME_MILLIS][0],
-        "created_by": "[USERNAME]",
-        "effective_predictive_optimization_flag": {
-          "inherited_from_name": "[METASTORE_NAME]",
-          "inherited_from_type": "METASTORE",
-          "value": "ENABLE"
-        },
-        "enable_predictive_optimization": "INHERIT",
-        "full_name": "main.schema_dup_grants_[UNIQUE_NAME]",
-        "metastore_id": "[UUID]",
-        "name": "schema_dup_grants_[UNIQUE_NAME]",
-        "owner": "[USERNAME]",
-        "schema_id": "[UUID]",
-        "updated_at": [UNIX_TIME_MILLIS][1],
-        "updated_by": "[USERNAME]"
-      }
-    },
-    "resources.schemas.apps_schema.grants": {
-      "depends_on": [
-        {
-          "node": "resources.schemas.apps_schema",
-          "label": "${resources.schemas.apps_schema.id}"
-        }
-      ],
-      "action": "skip",
-      "remote_state": {
-        "securable_type": "schema",
-        "full_name": "main.schema_dup_grants_[UNIQUE_NAME]",
-        "__embed__": [
-          {
-            "principal": "deco-test-user@databricks.com",
-            "privileges": [
-              "CREATE_TABLE"
-            ]
-          }
-        ]
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/grants/schemas/duplicate_principals/out.plan.json b/acceptance/bundle/resources/grants/schemas/duplicate_principals/out.plan.json
new file mode 100644
index 00000000000..4586c6ab570
--- /dev/null
+++ b/acceptance/bundle/resources/grants/schemas/duplicate_principals/out.plan.json
@@ -0,0 +1,45 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.schemas.apps_schema": {
+      "action": "skip",
+      "remote_state": {
+        "browse_only": false,
+        "catalog_name": "main",
+        "catalog_type": "MANAGED_CATALOG",
+        "created_at": [UNIX_TIME_MILLIS],
+        "created_by": "[USERNAME]",
+        "enable_predictive_optimization": "INHERIT",
+        "full_name": "main.schema_dup_grants_[UNIQUE_NAME]",
+        "metastore_id": "[UUID]",
+        "name": "schema_dup_grants_[UNIQUE_NAME]",
+        "owner": "[USERNAME]",
+        "schema_id": "[UUID]"
+      }
+    },
+    "resources.schemas.apps_schema.grants": {
+      "depends_on": [
+        {
+          "node": "resources.schemas.apps_schema",
+          "label": "${resources.schemas.apps_schema.id}"
+        }
+      ],
+      "action": "skip",
+      "remote_state": {
+        "securable_type": "schema",
+        "full_name": "main.schema_dup_grants_[UNIQUE_NAME]",
+        "__embed__": [
+          {
+            "principal": "deco-test-user@databricks.com",
+            "privileges": [
+              "CREATE_TABLE"
+            ]
+          }
+        ]
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/grants/schemas/duplicate_principals/out.plan.terraform.json b/acceptance/bundle/resources/grants/schemas/duplicate_principals/out.plan.terraform.json
deleted file mode 100644
index 2c8b806d1ec..00000000000
--- a/acceptance/bundle/resources/grants/schemas/duplicate_principals/out.plan.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.schemas.apps_schema": {
-      "action": "skip"
-    },
-    "resources.schemas.apps_schema.grants": {
-      "action": "skip"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/grants/schemas/duplicate_principals/out.requests.terraform.txt b/acceptance/bundle/resources/grants/schemas/duplicate_principals/out.requests.terraform.txt
deleted file mode 100644
index fdb92f6f3d5..00000000000
--- a/acceptance/bundle/resources/grants/schemas/duplicate_principals/out.requests.terraform.txt
+++ /dev/null
@@ -1,26 +0,0 @@
-{
-  "method": "GET",
-  "path": "/api/2.1/unity-catalog/permissions/schema/main.schema_dup_grants_[UNIQUE_NAME]"
-}
-{
-  "method": "PATCH",
-  "path": "/api/2.1/unity-catalog/permissions/schema/main.schema_dup_grants_[UNIQUE_NAME]",
-  "body": {
-    "changes": [
-      {
-        "add": [
-          "CREATE_TABLE"
-        ],
-        "principal": "deco-test-user@databricks.com"
-      }
-    ]
-  }
-}
-{
-  "method": "GET",
-  "path": "/api/2.1/unity-catalog/permissions/schema/main.schema_dup_grants_[UNIQUE_NAME]"
-}
-{
-  "method": "GET",
-  "path": "/api/2.1/unity-catalog/permissions/schema/main.schema_dup_grants_[UNIQUE_NAME]"
-}
diff --git a/acceptance/bundle/resources/grants/schemas/duplicate_principals/out.requests.direct.txt b/acceptance/bundle/resources/grants/schemas/duplicate_principals/out.requests.txt
similarity index 100%
rename from acceptance/bundle/resources/grants/schemas/duplicate_principals/out.requests.direct.txt
rename to acceptance/bundle/resources/grants/schemas/duplicate_principals/out.requests.txt
diff --git a/acceptance/bundle/resources/grants/schemas/duplicate_principals/out.test.toml b/acceptance/bundle/resources/grants/schemas/duplicate_principals/out.test.toml
index e849ec85ace..0f167effef1 100644
--- a/acceptance/bundle/resources/grants/schemas/duplicate_principals/out.test.toml
+++ b/acceptance/bundle/resources/grants/schemas/duplicate_principals/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/grants/schemas/duplicate_principals/output.txt b/acceptance/bundle/resources/grants/schemas/duplicate_principals/output.txt
index 3b1393adf5b..cf6ec356138 100644
--- a/acceptance/bundle/resources/grants/schemas/duplicate_principals/output.txt
+++ b/acceptance/bundle/resources/grants/schemas/duplicate_principals/output.txt
@@ -1,9 +1,10 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/schema-dup-grants-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created schemas.apps_schema
+Created schemas.apps_schema.grants
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle plan -o json
 
@@ -16,5 +17,4 @@ This action will result in the deletion of the following UC schemas. Any underly
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/schema-dup-grants-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/grants/schemas/duplicate_principals/script b/acceptance/bundle/resources/grants/schemas/duplicate_principals/script
index af3ef3b1376..df7108ec558 100644
--- a/acceptance/bundle/resources/grants/schemas/duplicate_principals/script
+++ b/acceptance/bundle/resources/grants/schemas/duplicate_principals/script
@@ -2,11 +2,13 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm -f out.requests.txt
+    rm -f "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
 # Same principal listed twice with the same privilege.
 trace $CLI bundle deploy
-print_requests.py --get //permissions --keep > out.requests.$DATABRICKS_BUNDLE_ENGINE.txt
-trace $CLI bundle plan -o json > out.plan.$DATABRICKS_BUNDLE_ENGINE.json
+print_requests.py --get //permissions --keep > out.requests.txt
+# effective_predictive_optimization_flag is inherited from the metastore and backend-controlled; drop it so the test does not depend on metastore settings.
+# updated_at/updated_by reflect UC's post-create system write that populates managed defaults, so on managed-defaults clouds they show a system principal rather than the creator; drop them.
+trace $CLI bundle plan -o json | nostamp | normalize_uc_payload.py effective_predictive_optimization_flag updated_at updated_by > out.plan.json
diff --git a/acceptance/bundle/resources/grants/schemas/duplicate_privileges/out.plan.terraform.txt b/acceptance/bundle/resources/grants/schemas/duplicate_privileges/out.plan.txt
similarity index 100%
rename from acceptance/bundle/resources/grants/schemas/duplicate_privileges/out.plan.terraform.txt
rename to acceptance/bundle/resources/grants/schemas/duplicate_privileges/out.plan.txt
diff --git a/acceptance/bundle/resources/grants/schemas/duplicate_privileges/out.requests.terraform.txt b/acceptance/bundle/resources/grants/schemas/duplicate_privileges/out.requests.terraform.txt
deleted file mode 100644
index fdb92f6f3d5..00000000000
--- a/acceptance/bundle/resources/grants/schemas/duplicate_privileges/out.requests.terraform.txt
+++ /dev/null
@@ -1,26 +0,0 @@
-{
-  "method": "GET",
-  "path": "/api/2.1/unity-catalog/permissions/schema/main.schema_dup_grants_[UNIQUE_NAME]"
-}
-{
-  "method": "PATCH",
-  "path": "/api/2.1/unity-catalog/permissions/schema/main.schema_dup_grants_[UNIQUE_NAME]",
-  "body": {
-    "changes": [
-      {
-        "add": [
-          "CREATE_TABLE"
-        ],
-        "principal": "deco-test-user@databricks.com"
-      }
-    ]
-  }
-}
-{
-  "method": "GET",
-  "path": "/api/2.1/unity-catalog/permissions/schema/main.schema_dup_grants_[UNIQUE_NAME]"
-}
-{
-  "method": "GET",
-  "path": "/api/2.1/unity-catalog/permissions/schema/main.schema_dup_grants_[UNIQUE_NAME]"
-}
diff --git a/acceptance/bundle/resources/grants/schemas/duplicate_privileges/out.requests.direct.txt b/acceptance/bundle/resources/grants/schemas/duplicate_privileges/out.requests.txt
similarity index 100%
rename from acceptance/bundle/resources/grants/schemas/duplicate_privileges/out.requests.direct.txt
rename to acceptance/bundle/resources/grants/schemas/duplicate_privileges/out.requests.txt
diff --git a/acceptance/bundle/resources/grants/schemas/duplicate_privileges/out.test.toml b/acceptance/bundle/resources/grants/schemas/duplicate_privileges/out.test.toml
index e849ec85ace..0f167effef1 100644
--- a/acceptance/bundle/resources/grants/schemas/duplicate_privileges/out.test.toml
+++ b/acceptance/bundle/resources/grants/schemas/duplicate_privileges/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/grants/schemas/duplicate_privileges/output.txt b/acceptance/bundle/resources/grants/schemas/duplicate_privileges/output.txt
index a537487dbd7..85dfeaed4b4 100644
--- a/acceptance/bundle/resources/grants/schemas/duplicate_privileges/output.txt
+++ b/acceptance/bundle/resources/grants/schemas/duplicate_privileges/output.txt
@@ -1,9 +1,10 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/schema-dup-grants-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created schemas.apps_schema
+Created schemas.apps_schema.grants
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
@@ -14,5 +15,4 @@ This action will result in the deletion of the following UC schemas. Any underly
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/schema-dup-grants-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/grants/schemas/duplicate_privileges/script b/acceptance/bundle/resources/grants/schemas/duplicate_privileges/script
index 6118156ba56..e8b3ea6f6df 100644
--- a/acceptance/bundle/resources/grants/schemas/duplicate_privileges/script
+++ b/acceptance/bundle/resources/grants/schemas/duplicate_privileges/script
@@ -2,11 +2,11 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm -f out.requests.txt
+    rm -f "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
 # Same privilege listed twice for the same principal in a single entry.
 trace $CLI bundle deploy
-print_requests.py --get //permissions --keep > out.requests.$DATABRICKS_BUNDLE_ENGINE.txt
-trace $CLI bundle plan > out.plan.$DATABRICKS_BUNDLE_ENGINE.txt 2>&1
+print_requests.py --get //permissions --keep > out.requests.txt
+trace $CLI bundle plan > out.plan.txt 2>&1
diff --git a/acceptance/bundle/resources/grants/schemas/empty_array/out.deploy.direct.txt b/acceptance/bundle/resources/grants/schemas/empty_array/out.deploy.direct.txt
deleted file mode 100644
index 6a435e4733d..00000000000
--- a/acceptance/bundle/resources/grants/schemas/empty_array/out.deploy.direct.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/schema-grants-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
diff --git a/acceptance/bundle/resources/grants/schemas/empty_array/out.deploy.terraform.txt b/acceptance/bundle/resources/grants/schemas/empty_array/out.deploy.terraform.txt
deleted file mode 100644
index c4605e6b9d1..00000000000
--- a/acceptance/bundle/resources/grants/schemas/empty_array/out.deploy.terraform.txt
+++ /dev/null
@@ -1,19 +0,0 @@
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/schema-grants-[UNIQUE_NAME]/default/files...
-Error: exit status 1
-
-Error: Missing required argument
-
-  with databricks_grants.schema_grants_schema,
-  on bundle.tf.json line 17, in resource.databricks_grants.schema_grants_schema:
-  17:         "grant": [
-  18:           {
-  19:             "principal": "deco-test-user@databricks.com",
-  20:             "privileges": null
-  21:           }
-  22:         ]
-
-The argument "grant.0.privileges" is required, but no definition was found.
-
-
-
-Exit code: 1
diff --git a/acceptance/bundle/resources/grants/schemas/empty_array/out.deploy1.requests.direct.json b/acceptance/bundle/resources/grants/schemas/empty_array/out.deploy1.requests.direct.json
deleted file mode 100644
index 6c720ca4c87..00000000000
--- a/acceptance/bundle/resources/grants/schemas/empty_array/out.deploy1.requests.direct.json
+++ /dev/null
@@ -1,14 +0,0 @@
-{
-  "method": "PATCH",
-  "path": "/api/2.1/unity-catalog/permissions/schema/main.schema_grants_[UNIQUE_NAME]",
-  "body": {
-    "changes": [
-      {
-        "principal": "deco-test-user@databricks.com",
-        "remove": [
-          "ALL_PRIVILEGES"
-        ]
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/grants/schemas/empty_array/out.plan1.direct.txt b/acceptance/bundle/resources/grants/schemas/empty_array/out.plan1.direct.txt
deleted file mode 100644
index 2a48dc2405e..00000000000
--- a/acceptance/bundle/resources/grants/schemas/empty_array/out.plan1.direct.txt
+++ /dev/null
@@ -1,38 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.schemas.grants_schema": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "catalog_name": "main",
-          "name": "schema_grants_[UNIQUE_NAME]"
-        }
-      }
-    },
-    "resources.schemas.grants_schema.grants": {
-      "depends_on": [
-        {
-          "node": "resources.schemas.grants_schema",
-          "label": "${resources.schemas.grants_schema.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "securable_type": "schema",
-          "full_name": "",
-          "__embed__": [
-            {
-              "principal": "deco-test-user@databricks.com"
-            }
-          ]
-        },
-        "vars": {
-          "full_name": "${resources.schemas.grants_schema.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/grants/schemas/empty_array/out.plan1.terraform.txt b/acceptance/bundle/resources/grants/schemas/empty_array/out.plan1.terraform.txt
deleted file mode 100644
index c2e037a3a8f..00000000000
--- a/acceptance/bundle/resources/grants/schemas/empty_array/out.plan1.terraform.txt
+++ /dev/null
@@ -1,18 +0,0 @@
-Error: exit status 1
-
-Error: Missing required argument
-
-  with databricks_grants.schema_grants_schema,
-  on bundle.tf.json line 17, in resource.databricks_grants.schema_grants_schema:
-  17:         "grant": [
-  18:           {
-  19:             "principal": "deco-test-user@databricks.com",
-  20:             "privileges": null
-  21:           }
-  22:         ]
-
-The argument "grant.0.privileges" is required, but no definition was found.
-
-
-
-Exit code: 1
diff --git a/acceptance/bundle/resources/grants/schemas/empty_array/out.test.toml b/acceptance/bundle/resources/grants/schemas/empty_array/out.test.toml
index e849ec85ace..0f167effef1 100644
--- a/acceptance/bundle/resources/grants/schemas/empty_array/out.test.toml
+++ b/acceptance/bundle/resources/grants/schemas/empty_array/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/grants/schemas/empty_array/output.txt b/acceptance/bundle/resources/grants/schemas/empty_array/output.txt
index e69de29bb2d..3305b087d98 100644
--- a/acceptance/bundle/resources/grants/schemas/empty_array/output.txt
+++ b/acceptance/bundle/resources/grants/schemas/empty_array/output.txt
@@ -0,0 +1,21 @@
+
+>>> [CLI] bundle validate
+Error: grant privileges is required
+  at resources.schemas.grants_schema.grants[0]
+  in databricks.yml:10:11
+
+Name: schema-grants-[UNIQUE_NAME]
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/schema-grants-[UNIQUE_NAME]/default
+
+Found 1 error
+
+>>> [CLI] bundle deploy
+Error: grant privileges is required
+  at resources.schemas.grants_schema.grants[0]
+  in databricks.yml:10:11
+
+
+>>> print_requests.py //unity-catalog
diff --git a/acceptance/bundle/resources/grants/schemas/empty_array/script b/acceptance/bundle/resources/grants/schemas/empty_array/script
index cf8541f96c2..15f2c294adf 100644
--- a/acceptance/bundle/resources/grants/schemas/empty_array/script
+++ b/acceptance/bundle/resources/grants/schemas/empty_array/script
@@ -1,6 +1,8 @@
 envsubst < databricks.yml.tmpl > databricks.yml
 
-errcode $CLI bundle plan -o json &> out.plan1.$DATABRICKS_BUNDLE_ENGINE.txt
-print_requests.py --get //permissions
-errcode $CLI bundle deploy &> out.deploy.$DATABRICKS_BUNDLE_ENGINE.txt
-print_requests.py //permissions > out.deploy1.requests.$DATABRICKS_BUNDLE_ENGINE.json
+# Empty privileges never converge (the backend drops principals with none), so reject early.
+musterr trace $CLI bundle validate
+
+# Deploy must abort at validation: no securable is created, so no partial deploy.
+musterr trace $CLI bundle deploy
+trace print_requests.py //unity-catalog
diff --git a/acceptance/bundle/resources/grants/schemas/manage_out_of_band/databricks.yml.tmpl b/acceptance/bundle/resources/grants/schemas/manage_out_of_band/databricks.yml.tmpl
new file mode 100644
index 00000000000..dfeb8eb099b
--- /dev/null
+++ b/acceptance/bundle/resources/grants/schemas/manage_out_of_band/databricks.yml.tmpl
@@ -0,0 +1,16 @@
+bundle:
+  name: schema-grants-manage-out-of-band-$UNIQUE_NAME
+
+resources:
+  schemas:
+    grants_schema:
+      name: schema_manage_oob_$UNIQUE_NAME
+      catalog_name: main
+      grants:
+        # Config declares only ALL_PRIVILEGES for the principal. MANAGE is granted
+        # out of band below; because ALL_PRIVILEGES does not imply MANAGE, the
+        # deploy must revoke it by name so the plan converges instead of reporting
+        # a perpetual update.
+        - principal: $CURRENT_USER_NAME
+          privileges:
+            - ALL_PRIVILEGES
diff --git a/acceptance/bundle/resources/grants/schemas/manage_out_of_band/out.test.toml b/acceptance/bundle/resources/grants/schemas/manage_out_of_band/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/grants/schemas/manage_out_of_band/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/grants/schemas/manage_out_of_band/output.txt b/acceptance/bundle/resources/grants/schemas/manage_out_of_band/output.txt
new file mode 100644
index 00000000000..5ad9c8e5c73
--- /dev/null
+++ b/acceptance/bundle/resources/grants/schemas/manage_out_of_band/output.txt
@@ -0,0 +1,30 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/schema-grants-manage-out-of-band-[UNIQUE_NAME]/default/files...
+Created schemas.grants_schema
+Created schemas.grants_schema.grants
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] grants update schema main.schema_manage_oob_[UNIQUE_NAME] --json @update.resolved.json
+
+>>> [CLI] bundle plan
+update schemas.grants_schema.grants
+
+Plan: 0 to add, 1 to change, 0 to delete, 1 unchanged
+
+>>> [CLI] bundle deploy -qq
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
+
+>>> errcode [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.schemas.grants_schema
+
+This action will result in the deletion of the following UC schemas. Any underlying data may be lost:
+  delete resources.schemas.grants_schema
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/schema-grants-manage-out-of-band-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/grants/schemas/manage_out_of_band/script b/acceptance/bundle/resources/grants/schemas/manage_out_of_band/script
new file mode 100644
index 00000000000..2e5c8f36761
--- /dev/null
+++ b/acceptance/bundle/resources/grants/schemas/manage_out_of_band/script
@@ -0,0 +1,29 @@
+SCHEMA_FULL_NAME=main.schema_manage_oob_$UNIQUE_NAME
+
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace errcode $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+trace $CLI bundle deploy
+
+# Out of band, grant MANAGE in addition to the ALL_PRIVILEGES the config declares
+# for the same principal. Unlike a concrete privilege, MANAGE is not implied by
+# ALL_PRIVILEGES, so it shows up as real drift the deploy must reconcile. Both
+# engines detect the same drift, so the plan output is identical between them.
+envsubst < update.json > update.resolved.json
+trace $CLI grants update schema "$SCHEMA_FULL_NAME" --json @update.resolved.json > /dev/null
+
+# The first plan reports drift: MANAGE is present remotely but not in the config.
+trace $CLI bundle plan
+
+# After deploying, both engines converge: the follow-up plan reports no changes.
+# The deploy summary diverges between engines (each revokes MANAGE its own way),
+# so deploy with -qq to keep the output engine-stable.
+trace $CLI bundle deploy -qq
+trace $CLI bundle plan
+
+# MANAGE must be gone; only ALL_PRIVILEGES remains.
+$CLI grants get schema "$SCHEMA_FULL_NAME" | gron.py --noindex | sort | contains.py ALL_PRIVILEGES '!MANAGE' > /dev/null
diff --git a/acceptance/bundle/resources/grants/schemas/manage_out_of_band/test.toml b/acceptance/bundle/resources/grants/schemas/manage_out_of_band/test.toml
new file mode 100644
index 00000000000..16f1b926e21
--- /dev/null
+++ b/acceptance/bundle/resources/grants/schemas/manage_out_of_band/test.toml
@@ -0,0 +1,2 @@
+RecordRequests = false
+Ignore = ['update.resolved.json']
diff --git a/acceptance/bundle/resources/grants/schemas/manage_out_of_band/update.json b/acceptance/bundle/resources/grants/schemas/manage_out_of_band/update.json
new file mode 100644
index 00000000000..495b51c6772
--- /dev/null
+++ b/acceptance/bundle/resources/grants/schemas/manage_out_of_band/update.json
@@ -0,0 +1,8 @@
+{
+  "changes": [
+    {
+      "principal": "$CURRENT_USER_NAME",
+      "add": ["MANAGE"]
+    }
+  ]
+}
diff --git a/acceptance/bundle/resources/grants/schemas/out_of_band_principal/out.embed.terraform.txt b/acceptance/bundle/resources/grants/schemas/out_of_band_principal/out.embed.terraform.txt
deleted file mode 100644
index c5b4eb68634..00000000000
--- a/acceptance/bundle/resources/grants/schemas/out_of_band_principal/out.embed.terraform.txt
+++ /dev/null
@@ -1 +0,0 @@
-json = null;
diff --git a/acceptance/bundle/resources/grants/schemas/out_of_band_principal/out.embed.direct.txt b/acceptance/bundle/resources/grants/schemas/out_of_band_principal/out.embed.txt
similarity index 100%
rename from acceptance/bundle/resources/grants/schemas/out_of_band_principal/out.embed.direct.txt
rename to acceptance/bundle/resources/grants/schemas/out_of_band_principal/out.embed.txt
diff --git a/acceptance/bundle/resources/grants/schemas/out_of_band_principal/out.plan.direct.json b/acceptance/bundle/resources/grants/schemas/out_of_band_principal/out.plan.direct.json
deleted file mode 100644
index 16cbf5fc15e..00000000000
--- a/acceptance/bundle/resources/grants/schemas/out_of_band_principal/out.plan.direct.json
+++ /dev/null
@@ -1,69 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.schemas.grants_schema": {
-      "action": "skip",
-      "remote_state": {
-        "browse_only": false,
-        "catalog_name": "main",
-        "catalog_type": "MANAGED_CATALOG",
-        "created_at": [UNIX_TIME_MILLIS][0],
-        "created_by": "[USERNAME]",
-        "effective_predictive_optimization_flag": {
-          "inherited_from_name": "[METASTORE_NAME]",
-          "inherited_from_type": "METASTORE",
-          "value": "ENABLE"
-        },
-        "enable_predictive_optimization": "INHERIT",
-        "full_name": "main.schema_out_of_band_principal_[UNIQUE_NAME]",
-        "metastore_id": "[UUID]",
-        "name": "schema_out_of_band_principal_[UNIQUE_NAME]",
-        "owner": "[USERNAME]",
-        "schema_id": "[UUID]",
-        "updated_at": [UNIX_TIME_MILLIS][1],
-        "updated_by": "[USERNAME]"
-      }
-    },
-    "resources.schemas.grants_schema.grants": {
-      "depends_on": [
-        {
-          "node": "resources.schemas.grants_schema",
-          "label": "${resources.schemas.grants_schema.id}"
-        }
-      ],
-      "action": "update",
-      "new_state": {
-        "value": {
-          "securable_type": "schema",
-          "full_name": "main.schema_out_of_band_principal_[UNIQUE_NAME]",
-          "__embed__": [
-            {
-              "principal": "[USERNAME]",
-              "privileges": [
-                "CREATE_TABLE"
-              ]
-            }
-          ]
-        }
-      },
-      "remote_state": {
-        "securable_type": "schema",
-        "full_name": "main.schema_out_of_band_principal_[UNIQUE_NAME]"
-      },
-      "changes": {
-        "[principal='deco-test-user@databricks.com']": {
-          "action": "update",
-          "remote": {
-            "principal": "deco-test-user@databricks.com",
-            "privileges": [
-              "USE_SCHEMA"
-            ]
-          }
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/grants/schemas/out_of_band_principal/out.plan.json b/acceptance/bundle/resources/grants/schemas/out_of_band_principal/out.plan.json
new file mode 100644
index 00000000000..038a187a8ed
--- /dev/null
+++ b/acceptance/bundle/resources/grants/schemas/out_of_band_principal/out.plan.json
@@ -0,0 +1,62 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.schemas.grants_schema": {
+      "action": "skip",
+      "remote_state": {
+        "browse_only": false,
+        "catalog_name": "main",
+        "catalog_type": "MANAGED_CATALOG",
+        "created_at": [UNIX_TIME_MILLIS],
+        "created_by": "[USERNAME]",
+        "enable_predictive_optimization": "INHERIT",
+        "full_name": "main.schema_out_of_band_principal_[UNIQUE_NAME]",
+        "metastore_id": "[UUID]",
+        "name": "schema_out_of_band_principal_[UNIQUE_NAME]",
+        "owner": "[USERNAME]",
+        "schema_id": "[UUID]"
+      }
+    },
+    "resources.schemas.grants_schema.grants": {
+      "depends_on": [
+        {
+          "node": "resources.schemas.grants_schema",
+          "label": "${resources.schemas.grants_schema.id}"
+        }
+      ],
+      "action": "update",
+      "new_state": {
+        "value": {
+          "securable_type": "schema",
+          "full_name": "main.schema_out_of_band_principal_[UNIQUE_NAME]",
+          "__embed__": [
+            {
+              "principal": "[USERNAME]",
+              "privileges": [
+                "CREATE_TABLE"
+              ]
+            }
+          ]
+        }
+      },
+      "remote_state": {
+        "securable_type": "schema",
+        "full_name": "main.schema_out_of_band_principal_[UNIQUE_NAME]"
+      },
+      "changes": {
+        "[principal='deco-test-user@databricks.com']": {
+          "action": "update",
+          "remote": {
+            "principal": "deco-test-user@databricks.com",
+            "privileges": [
+              "USE_SCHEMA"
+            ]
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/grants/schemas/out_of_band_principal/out.plan.terraform.json b/acceptance/bundle/resources/grants/schemas/out_of_band_principal/out.plan.terraform.json
deleted file mode 100644
index ea73a95ede0..00000000000
--- a/acceptance/bundle/resources/grants/schemas/out_of_band_principal/out.plan.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.schemas.grants_schema": {
-      "action": "skip"
-    },
-    "resources.schemas.grants_schema.grants": {
-      "action": "update"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/grants/schemas/out_of_band_principal/out.plan2.direct.json b/acceptance/bundle/resources/grants/schemas/out_of_band_principal/out.plan2.direct.json
deleted file mode 100644
index 4a4faa5d9e5..00000000000
--- a/acceptance/bundle/resources/grants/schemas/out_of_band_principal/out.plan2.direct.json
+++ /dev/null
@@ -1,52 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 2,
-  "plan": {
-    "resources.schemas.grants_schema": {
-      "action": "skip",
-      "remote_state": {
-        "browse_only": false,
-        "catalog_name": "main",
-        "catalog_type": "MANAGED_CATALOG",
-        "created_at": [UNIX_TIME_MILLIS][0],
-        "created_by": "[USERNAME]",
-        "effective_predictive_optimization_flag": {
-          "inherited_from_name": "[METASTORE_NAME]",
-          "inherited_from_type": "METASTORE",
-          "value": "ENABLE"
-        },
-        "enable_predictive_optimization": "INHERIT",
-        "full_name": "main.schema_out_of_band_principal_[UNIQUE_NAME]",
-        "metastore_id": "[UUID]",
-        "name": "schema_out_of_band_principal_[UNIQUE_NAME]",
-        "owner": "[USERNAME]",
-        "schema_id": "[UUID]",
-        "updated_at": [UNIX_TIME_MILLIS][1],
-        "updated_by": "[USERNAME]"
-      }
-    },
-    "resources.schemas.grants_schema.grants": {
-      "depends_on": [
-        {
-          "node": "resources.schemas.grants_schema",
-          "label": "${resources.schemas.grants_schema.id}"
-        }
-      ],
-      "action": "skip",
-      "remote_state": {
-        "securable_type": "schema",
-        "full_name": "main.schema_out_of_band_principal_[UNIQUE_NAME]",
-        "__embed__": [
-          {
-            "principal": "[USERNAME]",
-            "privileges": [
-              "CREATE_TABLE"
-            ]
-          }
-        ]
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/grants/schemas/out_of_band_principal/out.plan2.json b/acceptance/bundle/resources/grants/schemas/out_of_band_principal/out.plan2.json
new file mode 100644
index 00000000000..3b9720936dc
--- /dev/null
+++ b/acceptance/bundle/resources/grants/schemas/out_of_band_principal/out.plan2.json
@@ -0,0 +1,45 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 2,
+  "plan": {
+    "resources.schemas.grants_schema": {
+      "action": "skip",
+      "remote_state": {
+        "browse_only": false,
+        "catalog_name": "main",
+        "catalog_type": "MANAGED_CATALOG",
+        "created_at": [UNIX_TIME_MILLIS],
+        "created_by": "[USERNAME]",
+        "enable_predictive_optimization": "INHERIT",
+        "full_name": "main.schema_out_of_band_principal_[UNIQUE_NAME]",
+        "metastore_id": "[UUID]",
+        "name": "schema_out_of_band_principal_[UNIQUE_NAME]",
+        "owner": "[USERNAME]",
+        "schema_id": "[UUID]"
+      }
+    },
+    "resources.schemas.grants_schema.grants": {
+      "depends_on": [
+        {
+          "node": "resources.schemas.grants_schema",
+          "label": "${resources.schemas.grants_schema.id}"
+        }
+      ],
+      "action": "skip",
+      "remote_state": {
+        "securable_type": "schema",
+        "full_name": "main.schema_out_of_band_principal_[UNIQUE_NAME]",
+        "__embed__": [
+          {
+            "principal": "[USERNAME]",
+            "privileges": [
+              "CREATE_TABLE"
+            ]
+          }
+        ]
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/grants/schemas/out_of_band_principal/out.plan2.terraform.json b/acceptance/bundle/resources/grants/schemas/out_of_band_principal/out.plan2.terraform.json
deleted file mode 100644
index 9f3c906c0fa..00000000000
--- a/acceptance/bundle/resources/grants/schemas/out_of_band_principal/out.plan2.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.schemas.grants_schema": {
-      "action": "skip"
-    },
-    "resources.schemas.grants_schema.grants": {
-      "action": "skip"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/grants/schemas/out_of_band_principal/out.test.toml b/acceptance/bundle/resources/grants/schemas/out_of_band_principal/out.test.toml
index e849ec85ace..0f167effef1 100644
--- a/acceptance/bundle/resources/grants/schemas/out_of_band_principal/out.test.toml
+++ b/acceptance/bundle/resources/grants/schemas/out_of_band_principal/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/grants/schemas/out_of_band_principal/output.txt b/acceptance/bundle/resources/grants/schemas/out_of_band_principal/output.txt
index 269907e2fd0..eacdc186834 100644
--- a/acceptance/bundle/resources/grants/schemas/out_of_band_principal/output.txt
+++ b/acceptance/bundle/resources/grants/schemas/out_of_band_principal/output.txt
@@ -1,9 +1,10 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/schema-grants-out-of-band-principal-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created schemas.grants_schema
+Created schemas.grants_schema.grants
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] grants update schema main.schema_out_of_band_principal_[UNIQUE_NAME] --json @update.json
 
@@ -11,9 +12,9 @@ Deployment complete!
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/schema-grants-out-of-band-principal-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated schemas.grants_schema.grants
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 1 unchanged
 
 >>> [CLI] bundle plan -o json
 
@@ -26,5 +27,4 @@ This action will result in the deletion of the following UC schemas. Any underly
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/schema-grants-out-of-band-principal-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/grants/schemas/out_of_band_principal/script b/acceptance/bundle/resources/grants/schemas/out_of_band_principal/script
index 35622673035..459878e641a 100644
--- a/acceptance/bundle/resources/grants/schemas/out_of_band_principal/script
+++ b/acceptance/bundle/resources/grants/schemas/out_of_band_principal/script
@@ -5,17 +5,19 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
     trace errcode $CLI bundle destroy --auto-approve
-    rm -f out.requests.txt
 }
 trap cleanup EXIT
 
 trace $CLI bundle deploy
 trace $CLI grants update schema "$SCHEMA_FULL_NAME" --json @update.json > /dev/null
 $CLI grants get schema "$SCHEMA_FULL_NAME" | gron.py --noindex | sort | contains.py "$CURRENT_USER_NAME" 'deco-test-user@databricks.com' > /dev/null
-trace $CLI bundle plan -o json > out.plan.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.plan.json
 # remote_state.__embed__ order is non-deterministic; extract and sort separately into per-engine file
-jq '.plan["resources.schemas.grants_schema.grants"].remote_state.__embed__' out.plan.$DATABRICKS_BUNDLE_ENGINE.json | gron.py --noindex | sort_lines.py --repl > out.embed.$DATABRICKS_BUNDLE_ENGINE.txt
+jq '.plan["resources.schemas.grants_schema.grants"].remote_state.__embed__' out.plan.json | gron.py --noindex | sort_lines.py --repl > out.embed.txt
 tmp=$(mktemp)
-jq 'del(.plan["resources.schemas.grants_schema.grants"].remote_state.__embed__)' out.plan.$DATABRICKS_BUNDLE_ENGINE.json > "$tmp" && mv "$tmp" out.plan.$DATABRICKS_BUNDLE_ENGINE.json
+# __embed__ is extracted above; drop it so its non-deterministic order does not churn this golden.
+# effective_predictive_optimization_flag is inherited from the metastore and backend-controlled; drop it so the test does not depend on metastore settings.
+# updated_at/updated_by reflect UC's post-create system write that populates managed defaults, so on managed-defaults clouds they show a system principal rather than the creator; drop them.
+jq 'del(.plan["resources.schemas.grants_schema.grants"].remote_state.__embed__)' out.plan.json | normalize_uc_payload.py effective_predictive_optimization_flag updated_at updated_by > "$tmp" && mv "$tmp" out.plan.json
 trace $CLI bundle deploy
-trace $CLI bundle plan -o json > out.plan2.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp | normalize_uc_payload.py effective_predictive_optimization_flag updated_at updated_by > out.plan2.json
diff --git a/acceptance/bundle/resources/grants/schemas/out_of_band_principal/test.toml b/acceptance/bundle/resources/grants/schemas/out_of_band_principal/test.toml
new file mode 100644
index 00000000000..a030353d571
--- /dev/null
+++ b/acceptance/bundle/resources/grants/schemas/out_of_band_principal/test.toml
@@ -0,0 +1 @@
+RecordRequests = false
diff --git a/acceptance/bundle/resources/grants/schemas/remove_all/databricks.yml.tmpl b/acceptance/bundle/resources/grants/schemas/remove_all/databricks.yml.tmpl
new file mode 100644
index 00000000000..00752f7b34f
--- /dev/null
+++ b/acceptance/bundle/resources/grants/schemas/remove_all/databricks.yml.tmpl
@@ -0,0 +1,9 @@
+bundle:
+  name: schema-grants-remove-all-$UNIQUE_NAME
+
+resources:
+  schemas:
+    grants_schema:
+      name: schema_remove_all_$UNIQUE_NAME
+      catalog_name: main
+      grants: [{ principal: deco-test-user@databricks.com, privileges: [USE_SCHEMA] }]
diff --git a/acceptance/bundle/resources/grants/schemas/remove_all/out.plan.txt b/acceptance/bundle/resources/grants/schemas/remove_all/out.plan.txt
new file mode 100644
index 00000000000..354cac9a8a4
--- /dev/null
+++ b/acceptance/bundle/resources/grants/schemas/remove_all/out.plan.txt
@@ -0,0 +1,11 @@
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/schema-grants-remove-all-[UNIQUE_NAME]/default/files...
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
diff --git a/acceptance/bundle/resources/grants/schemas/remove_all/out.test.toml b/acceptance/bundle/resources/grants/schemas/remove_all/out.test.toml
new file mode 100644
index 00000000000..f68b4a89c36
--- /dev/null
+++ b/acceptance/bundle/resources/grants/schemas/remove_all/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/resources/grants/schemas/remove_all/output.txt b/acceptance/bundle/resources/grants/schemas/remove_all/output.txt
new file mode 100644
index 00000000000..2d6f7c22da1
--- /dev/null
+++ b/acceptance/bundle/resources/grants/schemas/remove_all/output.txt
@@ -0,0 +1,27 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/schema-grants-remove-all-[UNIQUE_NAME]/default/files...
+Created schemas.grants_schema
+Created schemas.grants_schema.grants
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] grants get schema main.schema_remove_all_[UNIQUE_NAME]
+json.privilege_assignments[].principal = "deco-test-user@databricks.com";
+json.privilege_assignments[].privileges[] = "USE_SCHEMA";
+
+>>> [CLI] bundle deploy -qq
+
+>>> [CLI] grants get schema main.schema_remove_all_[UNIQUE_NAME]
+json = {};
+
+>>> errcode [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.schemas.grants_schema
+
+This action will result in the deletion of the following UC schemas. Any underlying data may be lost:
+  delete resources.schemas.grants_schema
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/schema-grants-remove-all-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/grants/schemas/remove_all/script b/acceptance/bundle/resources/grants/schemas/remove_all/script
new file mode 100644
index 00000000000..8edc13a83a7
--- /dev/null
+++ b/acceptance/bundle/resources/grants/schemas/remove_all/script
@@ -0,0 +1,28 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace errcode $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+trace $CLI bundle deploy
+trace $CLI grants get schema main.schema_remove_all_$UNIQUE_NAME | gron.py --noindex | sort_lines.py --repl | contains.py 'deco-test-user@databricks.com'
+
+# Empty the whole list. The grants node has state here, so it must stay in the plan
+# and revoke; dropping it would move it to the delete branch where grants' no-op
+# DoDelete silently keeps the grant.
+update_file.py databricks.yml 'grants: [{ principal: deco-test-user@databricks.com, privileges: [USE_SCHEMA] }]' 'grants: []'
+
+# The engines classify emptying the grants list differently: terraform reports the
+# grants node as deleted, direct as updated. Deploy with -qq to keep this output
+# engine-stable; the grants read below is what this asserts.
+trace $CLI bundle deploy -qq
+trace $CLI grants get schema main.schema_remove_all_$UNIQUE_NAME | gron.py --noindex | sort_lines.py --repl | contains.py '!deco-test-user@databricks.com'
+
+# The revoking deploy drops the emptied grants node from state, so from here on both
+# engines plan the schema alone.
+{
+    trace $CLI bundle plan
+    trace $CLI bundle deploy
+    trace $CLI bundle plan
+} &> out.plan.txt
diff --git a/acceptance/bundle/resources/grants/schemas/remove_all/test.toml b/acceptance/bundle/resources/grants/schemas/remove_all/test.toml
new file mode 100644
index 00000000000..3931350e30a
--- /dev/null
+++ b/acceptance/bundle/resources/grants/schemas/remove_all/test.toml
@@ -0,0 +1,7 @@
+RecordRequests = false
+Badness = "Emptying a grants node cannot be deployed with deployment-history recording: apply calls DeleteState, which records a succeeded UPDATE carrying no state, and the service rejects that. This test is excluded from the recording variant until the fix records the emptied state instead of a delete."
+
+# Emptying a grants node is a known bug under DMS (deployment-history recording).
+# It records a succeeded UPDATE with no state, which the service rejects.
+# See: acceptance/bundle/dms/empty-grants
+EnvMatrixExclude.empty_grants_dms_bug = ["DMS=true"]
diff --git a/acceptance/bundle/resources/grants/schemas/remove_principal/out.grants.terraform.txt b/acceptance/bundle/resources/grants/schemas/remove_principal/out.grants.terraform.txt
deleted file mode 100644
index 0ef2f8e8b73..00000000000
--- a/acceptance/bundle/resources/grants/schemas/remove_principal/out.grants.terraform.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-json.privilege_assignments[].principal = "[USERNAME]";
-json.privilege_assignments[].privileges[] = "CREATE_TABLE";
diff --git a/acceptance/bundle/resources/grants/schemas/remove_principal/out.grants.direct.txt b/acceptance/bundle/resources/grants/schemas/remove_principal/out.grants.txt
similarity index 100%
rename from acceptance/bundle/resources/grants/schemas/remove_principal/out.grants.direct.txt
rename to acceptance/bundle/resources/grants/schemas/remove_principal/out.grants.txt
diff --git a/acceptance/bundle/resources/grants/schemas/remove_principal/out.test.toml b/acceptance/bundle/resources/grants/schemas/remove_principal/out.test.toml
index e849ec85ace..0f167effef1 100644
--- a/acceptance/bundle/resources/grants/schemas/remove_principal/out.test.toml
+++ b/acceptance/bundle/resources/grants/schemas/remove_principal/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/grants/schemas/remove_principal/output.txt b/acceptance/bundle/resources/grants/schemas/remove_principal/output.txt
index 83a506e161a..6b7d811d0e0 100644
--- a/acceptance/bundle/resources/grants/schemas/remove_principal/output.txt
+++ b/acceptance/bundle/resources/grants/schemas/remove_principal/output.txt
@@ -1,9 +1,10 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/schema-grants-remove-principal-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created schemas.grants_schema
+Created schemas.grants_schema.grants
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] grants get schema main.schema_remove_principal_[UNIQUE_NAME]
 json.privilege_assignments[].principal = "[USERNAME]";
@@ -13,9 +14,9 @@ json.privilege_assignments[].privileges[] = "USE_SCHEMA";
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/schema-grants-remove-principal-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated schemas.grants_schema.grants
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 1 unchanged
 
 >>> [CLI] grants get schema main.schema_remove_principal_[UNIQUE_NAME]
 
@@ -24,9 +25,8 @@ Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/schema-grants-remove-principal-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 2 unchanged
 
 >>> [CLI] bundle plan
 Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
@@ -40,5 +40,4 @@ This action will result in the deletion of the following UC schemas. Any underly
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/schema-grants-remove-principal-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/grants/schemas/remove_principal/script b/acceptance/bundle/resources/grants/schemas/remove_principal/script
index 2730c8ba97b..0eec4a65fe8 100644
--- a/acceptance/bundle/resources/grants/schemas/remove_principal/script
+++ b/acceptance/bundle/resources/grants/schemas/remove_principal/script
@@ -2,7 +2,6 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
     trace errcode $CLI bundle destroy --auto-approve
-    rm -f out.requests.txt
 }
 trap cleanup EXIT
 
@@ -12,7 +11,7 @@ trace $CLI grants get schema main.schema_remove_principal_$UNIQUE_NAME | gron.py
 grep -v 'TO_REMOVE' databricks.yml > tmp.yml && mv tmp.yml databricks.yml
 
 trace $CLI bundle deploy
-trace $CLI grants get schema main.schema_remove_principal_$UNIQUE_NAME | gron.py --noindex | sort_lines.py --repl | contains.py "$CURRENT_USER_NAME" '!deco-test-user@databricks.com' &> out.grants.$DATABRICKS_BUNDLE_ENGINE.txt
+trace $CLI grants get schema main.schema_remove_principal_$UNIQUE_NAME | gron.py --noindex | sort_lines.py --repl | contains.py "$CURRENT_USER_NAME" '!deco-test-user@databricks.com' &> out.grants.txt
 trace $CLI bundle plan
 trace $CLI bundle deploy
 trace $CLI bundle plan
diff --git a/acceptance/bundle/resources/grants/schemas/remove_principal/test.toml b/acceptance/bundle/resources/grants/schemas/remove_principal/test.toml
new file mode 100644
index 00000000000..a030353d571
--- /dev/null
+++ b/acceptance/bundle/resources/grants/schemas/remove_principal/test.toml
@@ -0,0 +1 @@
+RecordRequests = false
diff --git a/acceptance/bundle/resources/grants/schemas/remove_principal_manage/databricks.yml.tmpl b/acceptance/bundle/resources/grants/schemas/remove_principal_manage/databricks.yml.tmpl
new file mode 100644
index 00000000000..27841167cd3
--- /dev/null
+++ b/acceptance/bundle/resources/grants/schemas/remove_principal_manage/databricks.yml.tmpl
@@ -0,0 +1,18 @@
+bundle:
+  name: schema-grants-remove-principal-manage-$UNIQUE_NAME
+
+resources:
+  schemas:
+    grants_schema:
+      name: schema_remove_principal_manage_$UNIQUE_NAME
+      catalog_name: main
+      grants:
+        - principal: $CURRENT_USER_NAME
+          privileges:
+            - CREATE_TABLE
+        # This principal holds MANAGE, which ALL_PRIVILEGES does not imply. Removing
+        # it exercises the revocation path: buildGrantChanges must revoke MANAGE by
+        # name (not just via Remove: [ALL_PRIVILEGES], which the backend does not
+        # apply to MANAGE), otherwise the principal lingers and the plan never
+        # converges.
+        - { principal: deco-test-user@databricks.com, privileges: [MANAGE] } # TO_REMOVE
diff --git a/acceptance/bundle/resources/grants/schemas/remove_principal_manage/out.plan.changes.json b/acceptance/bundle/resources/grants/schemas/remove_principal_manage/out.plan.changes.json
new file mode 100644
index 00000000000..b88d41e1a1d
--- /dev/null
+++ b/acceptance/bundle/resources/grants/schemas/remove_principal_manage/out.plan.changes.json
@@ -0,0 +1,17 @@
+{
+  "[principal='deco-test-user@databricks.com']": {
+    "action": "update",
+    "old": {
+      "principal": "deco-test-user@databricks.com",
+      "privileges": [
+        "MANAGE"
+      ]
+    },
+    "remote": {
+      "principal": "deco-test-user@databricks.com",
+      "privileges": [
+        "MANAGE"
+      ]
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/grants/schemas/remove_principal_manage/out.requests.txt b/acceptance/bundle/resources/grants/schemas/remove_principal_manage/out.requests.txt
new file mode 100644
index 00000000000..484afe9c778
--- /dev/null
+++ b/acceptance/bundle/resources/grants/schemas/remove_principal_manage/out.requests.txt
@@ -0,0 +1,24 @@
+{
+  "method": "PATCH",
+  "path": "/api/2.1/unity-catalog/permissions/schema/main.schema_remove_principal_manage_[UNIQUE_NAME]",
+  "body": {
+    "changes": [
+      {
+        "add": [
+          "CREATE_TABLE"
+        ],
+        "principal": "[USERNAME]",
+        "remove": [
+          "ALL_PRIVILEGES"
+        ]
+      },
+      {
+        "principal": "deco-test-user@databricks.com",
+        "remove": [
+          "ALL_PRIVILEGES",
+          "MANAGE"
+        ]
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/resources/grants/schemas/remove_principal_manage/out.test.toml b/acceptance/bundle/resources/grants/schemas/remove_principal_manage/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/grants/schemas/remove_principal_manage/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/grants/schemas/remove_principal_manage/output.txt b/acceptance/bundle/resources/grants/schemas/remove_principal_manage/output.txt
new file mode 100644
index 00000000000..ebf93390e02
--- /dev/null
+++ b/acceptance/bundle/resources/grants/schemas/remove_principal_manage/output.txt
@@ -0,0 +1,33 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/schema-grants-remove-principal-manage-[UNIQUE_NAME]/default/files...
+Created schemas.grants_schema
+Created schemas.grants_schema.grants
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] grants get schema main.schema_remove_principal_manage_[UNIQUE_NAME]
+json.privilege_assignments[].principal = "[USERNAME]";
+json.privilege_assignments[].principal = "deco-test-user@databricks.com";
+json.privilege_assignments[].privileges[] = "CREATE_TABLE";
+json.privilege_assignments[].privileges[] = "MANAGE";
+
+>>> [CLI] bundle deploy -qq
+
+>>> [CLI] grants get schema main.schema_remove_principal_manage_[UNIQUE_NAME]
+json.privilege_assignments[].principal = "[USERNAME]";
+json.privilege_assignments[].privileges[] = "CREATE_TABLE";
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
+
+>>> errcode [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.schemas.grants_schema
+
+This action will result in the deletion of the following UC schemas. Any underlying data may be lost:
+  delete resources.schemas.grants_schema
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/schema-grants-remove-principal-manage-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/grants/schemas/remove_principal_manage/script b/acceptance/bundle/resources/grants/schemas/remove_principal_manage/script
new file mode 100644
index 00000000000..318e301c5ef
--- /dev/null
+++ b/acceptance/bundle/resources/grants/schemas/remove_principal_manage/script
@@ -0,0 +1,33 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace errcode $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+trace $CLI bundle deploy
+trace $CLI grants get schema main.schema_remove_principal_manage_$UNIQUE_NAME | gron.py --noindex | sort_lines.py --repl | contains.py "$CURRENT_USER_NAME" 'deco-test-user@databricks.com'
+
+# Flush the grant requests; we only want to record the revoke request below.
+print_requests.py --method PATCH //permissions > LOG.grant_requests
+
+# Remove the MANAGE principal from config.
+grep -v 'TO_REMOVE' databricks.yml > tmp.yml && mv tmp.yml databricks.yml
+
+# The plan revokes the removed principal; record the per-resource change diff.
+$CLI bundle plan -o json | jq '.plan["resources.schemas.grants_schema.grants"].changes' > out.plan.changes.json
+
+# Deploy with -qq: out.plan.changes.json is written into the bundle root above, so
+# excluding it keeps the "Files: N uploaded" count stable.
+trace $CLI bundle deploy -qq
+
+# The revoke request (engine-specific): the direct engine removes MANAGE by name in
+# addition to ALL_PRIVILEGES, terraform removes MANAGE directly. Removing only
+# ALL_PRIVILEGES would leave MANAGE behind on the backend.
+print_requests.py --method PATCH //permissions > out.requests.txt
+
+# The removed principal is gone, and the deploy converges (no perpetual update) on
+# both engines.
+trace $CLI grants get schema main.schema_remove_principal_manage_$UNIQUE_NAME | gron.py --noindex | sort_lines.py --repl
+trace $CLI bundle plan
diff --git a/acceptance/bundle/resources/grants/test.toml b/acceptance/bundle/resources/grants/test.toml
index 5f482f9bc54..1d670d98ea4 100644
--- a/acceptance/bundle/resources/grants/test.toml
+++ b/acceptance/bundle/resources/grants/test.toml
@@ -1,5 +1,4 @@
 # Because grants impl in direct uses different approach from terraform, we test the end result on the cloud rather than compare requests
 Cloud = true
-RequiresUnityCatalog = true
 RecordRequests = true
 Ignore = ['.databricks']
diff --git a/acceptance/bundle/resources/grants/volumes/out.deploy1.requests.direct.json b/acceptance/bundle/resources/grants/volumes/out.deploy1.requests.json
similarity index 100%
rename from acceptance/bundle/resources/grants/volumes/out.deploy1.requests.direct.json
rename to acceptance/bundle/resources/grants/volumes/out.deploy1.requests.json
diff --git a/acceptance/bundle/resources/grants/volumes/out.deploy1.requests.terraform.json b/acceptance/bundle/resources/grants/volumes/out.deploy1.requests.terraform.json
deleted file mode 100644
index 1e8bdf282a7..00000000000
--- a/acceptance/bundle/resources/grants/volumes/out.deploy1.requests.terraform.json
+++ /dev/null
@@ -1,15 +0,0 @@
-{
-  "method": "PATCH",
-  "path": "/api/2.1/unity-catalog/permissions/volume/main.schema_grants_[UNIQUE_NAME].volume_name",
-  "body": {
-    "changes": [
-      {
-        "add": [
-          "READ_VOLUME",
-          "WRITE_VOLUME"
-        ],
-        "principal": "deco-test-user@databricks.com"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/grants/volumes/out.deploy2.requests.direct.json b/acceptance/bundle/resources/grants/volumes/out.deploy2.requests.json
similarity index 100%
rename from acceptance/bundle/resources/grants/volumes/out.deploy2.requests.direct.json
rename to acceptance/bundle/resources/grants/volumes/out.deploy2.requests.json
diff --git a/acceptance/bundle/resources/grants/volumes/out.deploy2.requests.terraform.json b/acceptance/bundle/resources/grants/volumes/out.deploy2.requests.terraform.json
deleted file mode 100644
index 5a2ad0d6eab..00000000000
--- a/acceptance/bundle/resources/grants/volumes/out.deploy2.requests.terraform.json
+++ /dev/null
@@ -1,17 +0,0 @@
-{
-  "method": "PATCH",
-  "path": "/api/2.1/unity-catalog/permissions/volume/main.schema_grants_[UNIQUE_NAME].volume_name",
-  "body": {
-    "changes": [
-      {
-        "add": [
-          "MANAGE"
-        ],
-        "principal": "deco-test-user@databricks.com",
-        "remove": [
-          "WRITE_VOLUME"
-        ]
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/experiments/current_can_manage/out.requests.destroy.direct.json b/acceptance/bundle/resources/grants/volumes/out.destroy.requests.json
similarity index 100%
rename from acceptance/bundle/resources/permissions/experiments/current_can_manage/out.requests.destroy.direct.json
rename to acceptance/bundle/resources/grants/volumes/out.destroy.requests.json
diff --git a/acceptance/bundle/resources/grants/volumes/out.destroy.requests.terraform.json b/acceptance/bundle/resources/grants/volumes/out.destroy.requests.terraform.json
deleted file mode 100644
index 6dce8b24791..00000000000
--- a/acceptance/bundle/resources/grants/volumes/out.destroy.requests.terraform.json
+++ /dev/null
@@ -1,15 +0,0 @@
-{
-  "method": "PATCH",
-  "path": "/api/2.1/unity-catalog/permissions/volume/main.schema_grants_[UNIQUE_NAME].volume_name",
-  "body": {
-    "changes": [
-      {
-        "principal": "deco-test-user@databricks.com",
-        "remove": [
-          "READ_VOLUME",
-          "MANAGE"
-        ]
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/grants/volumes/out.plan1.direct.json b/acceptance/bundle/resources/grants/volumes/out.plan1.direct.json
deleted file mode 100644
index daae7c36ac6..00000000000
--- a/acceptance/bundle/resources/grants/volumes/out.plan1.direct.json
+++ /dev/null
@@ -1,59 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.schemas.grants_schema": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "catalog_name": "main",
-          "name": "schema_grants_[UNIQUE_NAME]"
-        }
-      }
-    },
-    "resources.volumes.grants_volume": {
-      "depends_on": [
-        {
-          "node": "resources.schemas.grants_schema",
-          "label": "${resources.schemas.grants_schema.name}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "catalog_name": "main",
-          "name": "volume_name",
-          "schema_name": "schema_grants_[UNIQUE_NAME]",
-          "volume_type": "MANAGED"
-        }
-      }
-    },
-    "resources.volumes.grants_volume.grants": {
-      "depends_on": [
-        {
-          "node": "resources.volumes.grants_volume",
-          "label": "${resources.volumes.grants_volume.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "securable_type": "volume",
-          "full_name": "",
-          "__embed__": [
-            {
-              "principal": "deco-test-user@databricks.com",
-              "privileges": [
-                "READ_VOLUME",
-                "WRITE_VOLUME"
-              ]
-            }
-          ]
-        },
-        "vars": {
-          "full_name": "${resources.volumes.grants_volume.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/grants/volumes/out.plan1.json b/acceptance/bundle/resources/grants/volumes/out.plan1.json
new file mode 100644
index 00000000000..0dffbf2c6bf
--- /dev/null
+++ b/acceptance/bundle/resources/grants/volumes/out.plan1.json
@@ -0,0 +1,59 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.schemas.grants_schema": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "catalog_name": "main",
+          "name": "schema_grants_[UNIQUE_NAME]"
+        }
+      }
+    },
+    "resources.volumes.grants_volume": {
+      "depends_on": [
+        {
+          "node": "resources.schemas.grants_schema",
+          "label": "${resources.schemas.grants_schema.name}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "catalog_name": "main",
+          "name": "volume_name",
+          "schema_name": "schema_grants_[UNIQUE_NAME]",
+          "volume_type": "MANAGED"
+        }
+      }
+    },
+    "resources.volumes.grants_volume.grants": {
+      "depends_on": [
+        {
+          "node": "resources.volumes.grants_volume",
+          "label": "${resources.volumes.grants_volume.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "securable_type": "volume",
+          "full_name": "",
+          "__embed__": [
+            {
+              "principal": "deco-test-user@databricks.com",
+              "privileges": [
+                "READ_VOLUME",
+                "WRITE_VOLUME"
+              ]
+            }
+          ]
+        },
+        "vars": {
+          "full_name": "${resources.volumes.grants_volume.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/grants/volumes/out.plan1.terraform.json b/acceptance/bundle/resources/grants/volumes/out.plan1.terraform.json
deleted file mode 100644
index d48c4eb3fd8..00000000000
--- a/acceptance/bundle/resources/grants/volumes/out.plan1.terraform.json
+++ /dev/null
@@ -1,14 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.schemas.grants_schema": {
-      "action": "create"
-    },
-    "resources.volumes.grants_volume": {
-      "action": "create"
-    },
-    "resources.volumes.grants_volume.grants": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/grants/volumes/out.plan2.direct.json b/acceptance/bundle/resources/grants/volumes/out.plan2.direct.json
deleted file mode 100644
index 01b0321ccd8..00000000000
--- a/acceptance/bundle/resources/grants/volumes/out.plan2.direct.json
+++ /dev/null
@@ -1,99 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.schemas.grants_schema": {
-      "action": "skip",
-      "remote_state": {
-        "browse_only": false,
-        "catalog_name": "main",
-        "catalog_type": "MANAGED_CATALOG",
-        "created_at": [UNIX_TIME_MILLIS][0],
-        "created_by": "[USERNAME]",
-        "full_name": "main.schema_grants_[UNIQUE_NAME]",
-        "name": "schema_grants_[UNIQUE_NAME]",
-        "owner": "[USERNAME]"
-      }
-    },
-    "resources.volumes.grants_volume": {
-      "depends_on": [
-        {
-          "node": "resources.schemas.grants_schema",
-          "label": "${resources.schemas.grants_schema.name}"
-        }
-      ],
-      "action": "skip",
-      "remote_state": {
-        "catalog_name": "main",
-        "created_at": [UNIX_TIME_MILLIS][1],
-        "created_by": "[USERNAME]",
-        "full_name": "main.schema_grants_[UNIQUE_NAME].volume_name",
-        "name": "volume_name",
-        "owner": "[USERNAME]",
-        "schema_name": "schema_grants_[UNIQUE_NAME]",
-        "storage_location": "s3://[METASTORE_NAME]/metastore/[UUID]/volumes/[UUID]",
-        "volume_type": "MANAGED"
-      },
-      "changes": {
-        "storage_location": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "s3://[METASTORE_NAME]/metastore/[UUID]/volumes/[UUID]"
-        }
-      }
-    },
-    "resources.volumes.grants_volume.grants": {
-      "depends_on": [
-        {
-          "node": "resources.volumes.grants_volume",
-          "label": "${resources.volumes.grants_volume.id}"
-        }
-      ],
-      "action": "update",
-      "new_state": {
-        "value": {
-          "securable_type": "volume",
-          "full_name": "main.schema_grants_[UNIQUE_NAME].volume_name",
-          "__embed__": [
-            {
-              "principal": "deco-test-user@databricks.com",
-              "privileges": [
-                "MANAGE",
-                "READ_VOLUME"
-              ]
-            }
-          ]
-        }
-      },
-      "remote_state": {
-        "securable_type": "volume",
-        "full_name": "main.schema_grants_[UNIQUE_NAME].volume_name",
-        "__embed__": [
-          {
-            "principal": "deco-test-user@databricks.com",
-            "privileges": [
-              "READ_VOLUME",
-              "WRITE_VOLUME"
-            ]
-          }
-        ]
-      },
-      "changes": {
-        "[principal='deco-test-user@databricks.com'].privileges[0]": {
-          "action": "update",
-          "old": "READ_VOLUME",
-          "new": "MANAGE",
-          "remote": "READ_VOLUME"
-        },
-        "[principal='deco-test-user@databricks.com'].privileges[1]": {
-          "action": "update",
-          "old": "WRITE_VOLUME",
-          "new": "READ_VOLUME",
-          "remote": "WRITE_VOLUME"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/grants/volumes/out.plan2.json b/acceptance/bundle/resources/grants/volumes/out.plan2.json
new file mode 100644
index 00000000000..198c6851573
--- /dev/null
+++ b/acceptance/bundle/resources/grants/volumes/out.plan2.json
@@ -0,0 +1,99 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.schemas.grants_schema": {
+      "action": "skip",
+      "remote_state": {
+        "browse_only": false,
+        "catalog_name": "main",
+        "catalog_type": "MANAGED_CATALOG",
+        "created_at": [UNIX_TIME_MILLIS][0],
+        "created_by": "[USERNAME]",
+        "full_name": "main.schema_grants_[UNIQUE_NAME]",
+        "name": "schema_grants_[UNIQUE_NAME]",
+        "owner": "[USERNAME]"
+      }
+    },
+    "resources.volumes.grants_volume": {
+      "depends_on": [
+        {
+          "node": "resources.schemas.grants_schema",
+          "label": "${resources.schemas.grants_schema.name}"
+        }
+      ],
+      "action": "skip",
+      "remote_state": {
+        "catalog_name": "main",
+        "created_at": [UNIX_TIME_MILLIS][1],
+        "created_by": "[USERNAME]",
+        "full_name": "main.schema_grants_[UNIQUE_NAME].volume_name",
+        "name": "volume_name",
+        "owner": "[USERNAME]",
+        "schema_name": "schema_grants_[UNIQUE_NAME]",
+        "storage_location": "s3://[METASTORE_NAME]/metastore/[UUID]/volumes/[UUID]",
+        "volume_type": "MANAGED"
+      },
+      "changes": {
+        "storage_location": {
+          "action": "skip",
+          "reason": "immutable_backend_value",
+          "remote": "s3://[METASTORE_NAME]/metastore/[UUID]/volumes/[UUID]"
+        }
+      }
+    },
+    "resources.volumes.grants_volume.grants": {
+      "depends_on": [
+        {
+          "node": "resources.volumes.grants_volume",
+          "label": "${resources.volumes.grants_volume.id}"
+        }
+      ],
+      "action": "update",
+      "new_state": {
+        "value": {
+          "securable_type": "volume",
+          "full_name": "main.schema_grants_[UNIQUE_NAME].volume_name",
+          "__embed__": [
+            {
+              "principal": "deco-test-user@databricks.com",
+              "privileges": [
+                "MANAGE",
+                "READ_VOLUME"
+              ]
+            }
+          ]
+        }
+      },
+      "remote_state": {
+        "securable_type": "volume",
+        "full_name": "main.schema_grants_[UNIQUE_NAME].volume_name",
+        "__embed__": [
+          {
+            "principal": "deco-test-user@databricks.com",
+            "privileges": [
+              "READ_VOLUME",
+              "WRITE_VOLUME"
+            ]
+          }
+        ]
+      },
+      "changes": {
+        "[principal='deco-test-user@databricks.com'].privileges[0]": {
+          "action": "update",
+          "old": "READ_VOLUME",
+          "new": "MANAGE",
+          "remote": "READ_VOLUME"
+        },
+        "[principal='deco-test-user@databricks.com'].privileges[1]": {
+          "action": "update",
+          "old": "WRITE_VOLUME",
+          "new": "READ_VOLUME",
+          "remote": "WRITE_VOLUME"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/grants/volumes/out.plan2.terraform.json b/acceptance/bundle/resources/grants/volumes/out.plan2.terraform.json
deleted file mode 100644
index b6d1117529e..00000000000
--- a/acceptance/bundle/resources/grants/volumes/out.plan2.terraform.json
+++ /dev/null
@@ -1,14 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.schemas.grants_schema": {
-      "action": "skip"
-    },
-    "resources.volumes.grants_volume": {
-      "action": "skip"
-    },
-    "resources.volumes.grants_volume.grants": {
-      "action": "update"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/grants/volumes/out.test.toml b/acceptance/bundle/resources/grants/volumes/out.test.toml
index e849ec85ace..0f167effef1 100644
--- a/acceptance/bundle/resources/grants/volumes/out.test.toml
+++ b/acceptance/bundle/resources/grants/volumes/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/grants/volumes/output.txt b/acceptance/bundle/resources/grants/volumes/output.txt
index 4cd3f2f7495..8f55736b569 100644
--- a/acceptance/bundle/resources/grants/volumes/output.txt
+++ b/acceptance/bundle/resources/grants/volumes/output.txt
@@ -3,9 +3,11 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/schema-grants-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created schemas.grants_schema
+Created volumes.grants_volume
+Created volumes.grants_volume.grants
+Files: 3 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> print_requests.py //permissions
 
@@ -26,9 +28,9 @@ Deployment complete!
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/schema-grants-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated volumes.grants_volume.grants
+Files: 3 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 2 unchanged
 
 >>> print_requests.py //permissions
 
@@ -61,7 +63,6 @@ is removed from the catalog, but the underlying files are not deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/schema-grants-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 2 deleted
 
 >>> print_requests.py //permissions
diff --git a/acceptance/bundle/resources/grants/volumes/script b/acceptance/bundle/resources/grants/volumes/script
index 2da24f4fe83..2bc0695cf57 100644
--- a/acceptance/bundle/resources/grants/volumes/script
+++ b/acceptance/bundle/resources/grants/volumes/script
@@ -1,8 +1,8 @@
 envsubst < databricks.yml.tmpl > databricks.yml
 
-trace $CLI bundle plan -o json > out.plan1.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.plan1.json
 trace $CLI bundle deploy
-trace print_requests.py //permissions > out.deploy1.requests.$DATABRICKS_BUNDLE_ENGINE.json
+trace print_requests.py //permissions > out.deploy1.requests.json
 
 # Since we're sending different requests between terraform and direct, assert that the end result is the same:
 trace $CLI grants get volume main.schema_grants_$UNIQUE_NAME.volume_name | jq --sort-keys
@@ -10,12 +10,11 @@ trace $CLI grants get volume main.schema_grants_$UNIQUE_NAME.volume_name | jq --
 update_file.py databricks.yml WRITE_VOLUME MANAGE
 
 # different on cloud vs local due to remote state
-trace $CLI bundle plan -o json > out.plan2.$DATABRICKS_BUNDLE_ENGINE.json
-jq 'walk(if type == "object" then del(.effective_predictive_optimization_flag, .enable_predictive_optimization, .metastore_id, .schema_id, .updated_at, .updated_by, .volume_id) else . end)' out.plan2.$DATABRICKS_BUNDLE_ENGINE.json > tmp.json && mv tmp.json out.plan2.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp | normalize_uc_payload.py effective_predictive_optimization_flag enable_predictive_optimization metastore_id schema_id updated_at updated_by volume_id > out.plan2.json
 trace $CLI bundle deploy
-trace print_requests.py //permissions > out.deploy2.requests.$DATABRICKS_BUNDLE_ENGINE.json
+trace print_requests.py //permissions > out.deploy2.requests.json
 
 trace $CLI grants get volume main.schema_grants_$UNIQUE_NAME.volume_name | jq --sort-keys
 
 trace $CLI bundle destroy --auto-approve
-trace print_requests.py //permissions > out.destroy.requests.$DATABRICKS_BUNDLE_ENGINE.json
+trace print_requests.py //permissions > out.destroy.requests.json
diff --git a/acceptance/bundle/resources/grants/volumes/test.toml b/acceptance/bundle/resources/grants/volumes/test.toml
index e249547d38d..670f5b0b0ff 100644
--- a/acceptance/bundle/resources/grants/volumes/test.toml
+++ b/acceptance/bundle/resources/grants/volumes/test.toml
@@ -3,3 +3,11 @@
 Old = 'abfss://decotestprod-unity-iso@decotestprodunityiso.dfs.core.windows.net'
 New = 's3://deco-uc-prod-isolated-aws-us-east-1/metastore'
 Order = -1
+
+[[Repls]]
+# Normalize GCP storage URL to match AWS format, before METASTORE_NAME replacement.
+# Unlike Azure, the gs:// URL carries the /metastore/... suffix directly after the
+# bucket, so only the bucket prefix is rewritten and the METASTORE_NAME repl finishes.
+Old = 'gs://deco-uc-prod-gcp-us-central1-isolated'
+New = 's3://deco-uc-prod-isolated-aws-us-east-1'
+Order = -1
diff --git a/acceptance/bundle/resources/independent/out.test.toml b/acceptance/bundle/resources/independent/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/independent/out.test.toml
+++ b/acceptance/bundle/resources/independent/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/independent/output.txt b/acceptance/bundle/resources/independent/output.txt
index 56e08e87b22..9a72b4ae0e5 100644
--- a/acceptance/bundle/resources/independent/output.txt
+++ b/acceptance/bundle/resources/independent/output.txt
@@ -1,4 +1,6 @@
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.foo
+Created pipelines.my
+Created volumes.volume1
+Files: 2 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
diff --git a/acceptance/bundle/resources/instance_pools/databricks.yml b/acceptance/bundle/resources/instance_pools/databricks.yml
new file mode 100644
index 00000000000..dd58ba4b0d0
--- /dev/null
+++ b/acceptance/bundle/resources/instance_pools/databricks.yml
@@ -0,0 +1,11 @@
+bundle:
+  name: test_instance_pool
+
+resources:
+  instance_pools:
+    test_instance_pool:
+      instance_pool_name: my_instance_pool
+      node_type_id: Standard_DS3_v2
+      min_idle_instances: 0
+      max_capacity: 5
+      idle_instance_autotermination_minutes: 60
diff --git a/acceptance/bundle/resources/instance_pools/out.test.toml b/acceptance/bundle/resources/instance_pools/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/instance_pools/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/instance_pools/output.txt b/acceptance/bundle/resources/instance_pools/output.txt
new file mode 100644
index 00000000000..950c7d70287
--- /dev/null
+++ b/acceptance/bundle/resources/instance_pools/output.txt
@@ -0,0 +1,134 @@
+
+>>> [CLI] bundle validate
+Name: test_instance_pool
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test_instance_pool/default
+
+Validation OK!
+
+>>> [CLI] bundle validate -o json
+{
+  "test_instance_pool": {
+    "idle_instance_autotermination_minutes": 60,
+    "instance_pool_name": "my_instance_pool",
+    "max_capacity": 5,
+    "min_idle_instances": 0,
+    "node_type_id": "Standard_DS3_v2"
+  }
+}
+
+>>> [CLI] bundle summary
+Name: test_instance_pool
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test_instance_pool/default
+Resources:
+  Instance Pools:
+    test_instance_pool:
+      Name: my_instance_pool
+      URL:  (not deployed)
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test_instance_pool/default/files...
+Created instance_pools.test_instance_pool
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Verify the create request
+>>> jq select(.method == "POST" and (.path | contains("/instance-pools/create"))) [OUTPUT_DIR]/out.requests.txt
+{
+  "method": "POST",
+  "path": "/api/2.0/instance-pools/create",
+  "body": {
+    "idle_instance_autotermination_minutes": 60,
+    "instance_pool_name": "my_instance_pool",
+    "max_capacity": 5,
+    "min_idle_instances": 0,
+    "node_type_id": "Standard_DS3_v2"
+  }
+}
+
+>>> [CLI] bundle summary
+Name: test_instance_pool
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test_instance_pool/default
+Resources:
+  Instance Pools:
+    test_instance_pool:
+      Name: my_instance_pool
+      URL:  [DATABRICKS_URL]/compute/instance-pools/[UUID]?w=[WORKSPACE_ID]
+
+=== Update the instance pool name
+>>> update_file.py databricks.yml my_instance_pool my_instance_pool_2
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test_instance_pool/default/files...
+Updated instance_pools.test_instance_pool
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+=== Verify the update request
+>>> jq select(.method == "POST" and (.path | contains("/instance-pools/edit"))) [OUTPUT_DIR]/out.requests.txt
+{
+  "method": "POST",
+  "path": "/api/2.0/instance-pools/edit",
+  "body": {
+    "idle_instance_autotermination_minutes": 60,
+    "instance_pool_id": "[UUID]",
+    "instance_pool_name": "my_instance_pool_2",
+    "max_capacity": 5,
+    "min_idle_instances": 0,
+    "node_type_id": "Standard_DS3_v2"
+  }
+}
+
+>>> [CLI] bundle summary
+Name: test_instance_pool
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test_instance_pool/default
+Resources:
+  Instance Pools:
+    test_instance_pool:
+      Name: my_instance_pool_2
+      URL:  [DATABRICKS_URL]/compute/instance-pools/[UUID]?w=[WORKSPACE_ID]
+
+=== Destroy the instance pool
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.instance_pools.test_instance_pool
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test_instance_pool/default
+
+Destroy: 1 deleted
+
+=== Verify the destroy request
+>>> jq select(.method == "POST" and (.path | contains("/instance-pools/delete"))) [OUTPUT_DIR]/out.requests.txt
+{
+  "method": "POST",
+  "path": "/api/2.0/instance-pools/delete",
+  "body": {
+    "instance_pool_id": "[UUID]"
+  }
+}
+
+>>> [CLI] bundle summary
+Name: test_instance_pool
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test_instance_pool/default
+Resources:
+  Instance Pools:
+    test_instance_pool:
+      Name: my_instance_pool_2
+      URL:  (not deployed)
+
+>>> [CLI] bundle destroy --auto-approve
+No active deployment found to destroy!
diff --git a/acceptance/bundle/resources/instance_pools/script b/acceptance/bundle/resources/instance_pools/script
new file mode 100644
index 00000000000..59bdf382361
--- /dev/null
+++ b/acceptance/bundle/resources/instance_pools/script
@@ -0,0 +1,33 @@
+trace $CLI bundle validate
+trace $CLI bundle validate -o json | jq ".resources.instance_pools"
+
+trace $CLI bundle summary
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+trace $CLI bundle deploy
+
+title "Verify the create request"
+trace jq 'select(.method == "POST" and (.path | contains("/instance-pools/create")))' "$OUT_REQUESTS"
+
+trace $CLI bundle summary
+
+title "Update the instance pool name"
+trace update_file.py databricks.yml my_instance_pool my_instance_pool_2
+trace $CLI bundle deploy
+
+title "Verify the update request"
+trace jq 'select(.method == "POST" and (.path | contains("/instance-pools/edit")))' "$OUT_REQUESTS"
+
+trace $CLI bundle summary
+
+title "Destroy the instance pool"
+trace $CLI bundle destroy --auto-approve
+
+title "Verify the destroy request"
+trace jq 'select(.method == "POST" and (.path | contains("/instance-pools/delete")))' "$OUT_REQUESTS"
+
+trace $CLI bundle summary
diff --git a/acceptance/bundle/resources/instance_pools/test.toml b/acceptance/bundle/resources/instance_pools/test.toml
new file mode 100644
index 00000000000..0b34135a1cd
--- /dev/null
+++ b/acceptance/bundle/resources/instance_pools/test.toml
@@ -0,0 +1,5 @@
+Cloud = false
+
+Ignore = [
+    "databricks.yml",
+]
diff --git a/acceptance/bundle/resources/job_runs/basic/databricks.yml b/acceptance/bundle/resources/job_runs/basic/databricks.yml
new file mode 100644
index 00000000000..5ea02d60dc2
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/basic/databricks.yml
@@ -0,0 +1,15 @@
+bundle:
+  name: job-runs-basic
+
+resources:
+  jobs:
+    my_job:
+      name: my-job
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: /Workspace/test
+
+  job_runs:
+    my_run:
+      job_id: ${resources.jobs.my_job.id}
diff --git a/acceptance/bundle/resources/job_runs/basic/out.test.toml b/acceptance/bundle/resources/job_runs/basic/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/basic/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/job_runs/basic/output.txt b/acceptance/bundle/resources/job_runs/basic/output.txt
new file mode 100644
index 00000000000..ba8bef3a0c8
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/basic/output.txt
@@ -0,0 +1,90 @@
+
+=== deploy triggers exactly one run
+>>> [CLI] bundle validate
+Name: job-runs-basic
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/job-runs-basic/default
+
+Validation OK!
+
+>>> [CLI] bundle plan
+create job_runs.my_run
+create jobs.my_job
+
+Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
+
+>>> [CLI] bundle summary
+Name: job-runs-basic
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/job-runs-basic/default
+Resources:
+  Job Runs:
+    my_run:
+      Name: 
+      URL:  (not deployed)
+  Jobs:
+    my_job:
+      Name: my-job
+      URL:  (not deployed)
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/job-runs-basic/default/files...
+Created jobs.my_job
+Output from job_runs.my_run: id=[MY_RUN_ID]: Run URL: [DATABRICKS_URL]/jobs/[MY_JOB_ID]/runs/[MY_RUN_ID]?o=[WORKSPACE_ID]
+Output from job_runs.my_run: id=[MY_RUN_ID]: SUCCESS
+Created job_runs.my_run
+Files: 1 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/job-runs-basic/default/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 2 unchanged
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
+
+>>> [CLI] bundle summary
+Name: job-runs-basic
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/job-runs-basic/default
+Resources:
+  Job Runs:
+    my_run:
+      Name: 
+      URL:  [DATABRICKS_URL]/jobs/[MY_JOB_ID]/runs/[MY_RUN_ID]?w=[WORKSPACE_ID]
+  Jobs:
+    my_job:
+      Name: my-job
+      URL:  [DATABRICKS_URL]/jobs/[MY_JOB_ID]?w=[WORKSPACE_ID]
+
+=== exactly one run-now request was made
+>>> print_requests.py //jobs/run-now
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/run-now",
+  "body": {
+    "idempotency_token": "[UUID]",
+    "job_id": [MY_JOB_ID]
+  }
+}
+
+=== the triggered run id is stored in state, without result_state
+>>> read_state.py job_runs my_run id result_state
+job_runs my_run id='[MY_RUN_ID]' result_state=None
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.my_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/job-runs-basic/default
+
+Destroy: 1 deleted
+
+>>> print_requests.py //jobs/runs/delete
diff --git a/acceptance/bundle/resources/job_runs/basic/script b/acceptance/bundle/resources/job_runs/basic/script
new file mode 100644
index 00000000000..2dd53b081db
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/basic/script
@@ -0,0 +1,27 @@
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    # destroy leaves the triggered run alone: no jobs/runs/delete (also unlinks "$OUT_REQUESTS")
+    trace print_requests.py //jobs/runs/delete
+}
+trap cleanup EXIT
+
+title "deploy triggers exactly one run"
+trace $CLI bundle validate
+trace $CLI bundle plan
+trace $CLI bundle summary
+trace $CLI bundle deploy
+
+# confirm that redeploy does not trigger a second run
+trace $CLI bundle deploy
+
+trace $CLI bundle plan
+trace $CLI bundle summary
+
+title "exactly one run-now request was made"
+trace print_requests.py //jobs/run-now
+
+# result_state is a planning sentinel and is cleared before SaveState.
+title "the triggered run id is stored in state, without result_state"
+trace read_state.py job_runs my_run id result_state
+read_id.py my_run > /dev/null
+read_id.py my_job > /dev/null
diff --git a/acceptance/bundle/resources/job_runs/destroy_unfinished_run/databricks.yml b/acceptance/bundle/resources/job_runs/destroy_unfinished_run/databricks.yml
new file mode 100644
index 00000000000..177a9ca2227
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/destroy_unfinished_run/databricks.yml
@@ -0,0 +1,15 @@
+bundle:
+  name: job-runs-destroy-unfinished-run
+
+resources:
+  jobs:
+    my_job:
+      name: my-job
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: /Workspace/test
+
+  job_runs:
+    my_run:
+      job_id: ${resources.jobs.my_job.id}
diff --git a/acceptance/bundle/resources/job_runs/destroy_unfinished_run/out.test.toml b/acceptance/bundle/resources/job_runs/destroy_unfinished_run/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/destroy_unfinished_run/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/job_runs/destroy_unfinished_run/output.txt b/acceptance/bundle/resources/job_runs/destroy_unfinished_run/output.txt
new file mode 100644
index 00000000000..6288dbd63c0
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/destroy_unfinished_run/output.txt
@@ -0,0 +1,29 @@
+
+=== the deploy stops waiting before the run finishes
+>>> errcode [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/job-runs-destroy-unfinished-run/default/files...
+Created jobs.my_job
+Error: cannot create resources.job_runs.my_run: waiting after creating id=[MY_RUN_ID]: Fault injected by test. (403 INJECTED)
+
+Endpoint: GET [DATABRICKS_URL]/api/2.2/jobs/runs/get?run_id=[MY_RUN_ID]
+HTTP Status: 403 Forbidden
+API error_code: INJECTED
+API message: Fault injected by test.
+
+Files: 1 uploaded, 0 deleted
+
+Exit code: 1
+
+>>> read_id.py my_run
+[MY_RUN_ID]
+
+=== destroy leaves the unfinished run alone
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.my_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/job-runs-destroy-unfinished-run/default
+
+Destroy: 1 deleted
+
+>>> print_requests.py //jobs/runs
diff --git a/acceptance/bundle/resources/job_runs/destroy_unfinished_run/script b/acceptance/bundle/resources/job_runs/destroy_unfinished_run/script
new file mode 100644
index 00000000000..0ec470ad9b3
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/destroy_unfinished_run/script
@@ -0,0 +1,18 @@
+cleanup() {
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+# The fault ends the deploy's wait while the run is still going, leaving an
+# in-progress run tracked in state, as an interrupted deploy would.
+fault.py "GET /api/2.2/jobs/runs/get" 403 0 1
+
+title "the deploy stops waiting before the run finishes"
+trace errcode $CLI bundle deploy
+trace read_id.py my_run
+
+# A run is a historical record, so destroy leaves it alone even while it is
+# still going: it only drops the state entry, with no cancel and no delete.
+title "destroy leaves the unfinished run alone"
+trace $CLI bundle destroy --auto-approve
+trace print_requests.py //jobs/runs
diff --git a/acceptance/bundle/resources/job_runs/failed_run/databricks.yml.tmpl b/acceptance/bundle/resources/job_runs/failed_run/databricks.yml.tmpl
new file mode 100644
index 00000000000..a2b382f501a
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/failed_run/databricks.yml.tmpl
@@ -0,0 +1,40 @@
+bundle:
+  name: job-runs-failed-run
+
+workspace:
+  root_path: ~/.bundle/$UNIQUE_NAME
+
+resources:
+  jobs:
+    my_job:
+      name: test-job-$UNIQUE_NAME
+      tasks:
+        # Serverless keeps the run to a few minutes: the Jobs API retries the
+        # failed task once before giving up on it.
+        - task_key: main
+          spark_python_task:
+            python_file: ./fail.py
+          environment_key: default
+
+      environments:
+        - environment_key: default
+          spec:
+            environment_version: "2"
+
+    # Reads the run's outcome, so the failing run aborts the deploy before this
+    # job is created. Separate from my_job, which my_run already depends on, to
+    # avoid a cycle.
+    downstream_job:
+      name: test-downstream-job-$UNIQUE_NAME
+      tags:
+        run_result: ${resources.job_runs.my_run.state.result_state}
+      tasks:
+        - task_key: main
+          condition_task:
+            op: EQUAL_TO
+            left: "1"
+            right: "1"
+
+  job_runs:
+    my_run:
+      job_id: ${resources.jobs.my_job.id}
diff --git a/acceptance/bundle/resources/job_runs/failed_run/fail.py b/acceptance/bundle/resources/job_runs/failed_run/fail.py
new file mode 100644
index 00000000000..fa56481ece5
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/failed_run/fail.py
@@ -0,0 +1 @@
+raise RuntimeError("intentional failure")
diff --git a/acceptance/bundle/resources/job_runs/failed_run/out.test.toml b/acceptance/bundle/resources/job_runs/failed_run/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/failed_run/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/job_runs/failed_run/output.txt b/acceptance/bundle/resources/job_runs/failed_run/output.txt
new file mode 100644
index 00000000000..44d3b17412a
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/failed_run/output.txt
@@ -0,0 +1,96 @@
+
+=== a run that finishes FAILED fails the deploy
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Created jobs.my_job
+Output from job_runs.my_run: id=[MY_RUN_ID]: Run URL: [RUN_URL]
+Error: cannot create resources.job_runs.my_run: waiting after creating id=[MY_RUN_ID]: run did not succeed: FAILED: Task main failed with message: Workload failed, see run output for details.
+task "main": RuntimeError: intentional failure
+run page: [RUN_URL]
+
+Error: cannot create resources.jobs.downstream_job: dependency failed: resources.job_runs.my_run
+
+Files: 3 uploaded, 0 deleted
+
+=== the failed run is recorded, and not having succeeded is drift
+>>> read_id.py my_run
+[MY_RUN_ID]
+
+>>> [CLI] bundle plan -o json
+{
+  "depends_on": [
+    {
+      "node": "resources.jobs.my_job",
+      "label": "${resources.jobs.my_job.id}"
+    }
+  ],
+  "action": "recreate",
+  "new_state": {
+    "value": {
+      "job_id": [MY_JOB_ID],
+      "result_state": "SUCCESS"
+    }
+  },
+  "remote_state": {
+    "job_id": [MY_JOB_ID],
+    "result_state": "FAILED",
+    "run_id": [MY_RUN_ID],
+    "run_name": "test-job-[UNIQUE_NAME]",
+    "run_page_url": "[RUN_URL]",
+    "run_type": "JOB_RUN",
+    "state": {
+      "life_cycle_state": "INTERNAL_ERROR",
+      "result_state": "FAILED",
+      "state_message": "Task main failed with message: Workload failed, see run output for details."
+    }
+  },
+  "changes": {
+    "result_state": {
+      "action": "recreate",
+      "reason": "immutable",
+      "new": "SUCCESS",
+      "remote": "FAILED"
+    }
+  }
+}
+
+=== so a redeploy runs the job again, and fails again
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Output from job_runs.my_run: id=[MY_RUN_ID_2]: Run URL: [RUN_URL]
+Error: cannot recreate resources.job_runs.my_run: waiting after creating id=[MY_RUN_ID_2]: run did not succeed: FAILED: Task main failed with message: Workload failed, see run output for details.
+task "main": RuntimeError: intentional failure
+run page: [RUN_URL]
+
+Error: cannot create resources.jobs.downstream_job: dependency failed: resources.job_runs.my_run
+
+Files: 0 uploaded, 0 deleted
+
+=== run-now was issued once per deploy, and the recreate left the failed run alone
+>>> print_requests.py --keep //jobs/run-now
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/run-now",
+  "body": {
+    "idempotency_token": "[UUID]",
+    "job_id": [MY_JOB_ID]
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/run-now",
+  "body": {
+    "idempotency_token": "[UUID]",
+    "job_id": [MY_JOB_ID]
+  }
+}
+
+>>> print_requests.py //jobs/runs/delete
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.my_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/job_runs/failed_run/script b/acceptance/bundle/resources/job_runs/failed_run/script
new file mode 100644
index 00000000000..d455d4b49fb
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/failed_run/script
@@ -0,0 +1,31 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+# The error names the failed task and the message the workspace reported for it,
+# and downstream_job is reported as a failed dependency because it reads the
+# run's result_state.
+title "a run that finishes FAILED fails the deploy"
+musterr trace $CLI bundle deploy
+
+# The framework saves the run id before WaitAfterCreate, so FAILED vs SUCCESS is drift.
+title "the failed run is recorded, and not having succeeded is drift"
+trace read_id.py my_run
+trace $CLI bundle plan -o json | nostamp | jq '.plan["resources.job_runs.my_run"]'
+
+# Name the job too, so the run-now bodies below say which number it is.
+read_id.py my_job > /dev/null
+
+title "so a redeploy runs the job again, and fails again"
+musterr trace $CLI bundle deploy
+read_id.py my_run > /dev/null
+
+# The recreate leaves the failed run [MY_RUN_ID] alone and triggers [MY_RUN_ID_2]:
+# a run is a historical record, not deleted, so no jobs/runs/delete is issued.
+title "run-now was issued once per deploy, and the recreate left the failed run alone"
+trace print_requests.py --keep //jobs/run-now
+trace print_requests.py //jobs/runs/delete
diff --git a/acceptance/bundle/resources/job_runs/failed_run/test.toml b/acceptance/bundle/resources/job_runs/failed_run/test.toml
new file mode 100644
index 00000000000..2b509b9b1ed
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/failed_run/test.toml
@@ -0,0 +1,26 @@
+# Runs the failing job for real, so the message the deploy names the task with is
+# one a workspace reported. Serverless needs Unity Catalog.
+Cloud = true
+
+# databricks.yml is rendered by the script, and the deploy fails mid-way, leaving
+# local deployment state behind.
+Ignore = [
+    ".databricks",
+    "databricks.yml",
+]
+
+# The host and the workspace selector in the run URL differ per workspace; the URL
+# form itself is covered by libs/workspaceurls.
+[[Repls]]
+Old = 'Run URL: .*'
+New = 'Run URL: [RUN_URL]'
+
+[[Repls]]
+Old = 'run page: .*'
+New = 'run page: [RUN_URL]'
+
+# [DATABRICKS_URL] is the recording proxy's host, not the workspace host the Jobs
+# API reports here.
+[[Repls]]
+Old = '"run_page_url": ".*"'
+New = '"run_page_url": "[RUN_URL]"'
diff --git a/acceptance/bundle/resources/job_runs/interrupted_run/databricks.yml b/acceptance/bundle/resources/job_runs/interrupted_run/databricks.yml
new file mode 100644
index 00000000000..506daeccca8
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/interrupted_run/databricks.yml
@@ -0,0 +1,15 @@
+bundle:
+  name: job-runs-interrupted-run
+
+resources:
+  jobs:
+    my_job:
+      name: my-job
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: /Workspace/test
+
+  job_runs:
+    my_run:
+      job_id: ${resources.jobs.my_job.id}
diff --git a/acceptance/bundle/resources/job_runs/interrupted_run/out.test.toml b/acceptance/bundle/resources/job_runs/interrupted_run/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/interrupted_run/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/job_runs/interrupted_run/output.txt b/acceptance/bundle/resources/job_runs/interrupted_run/output.txt
new file mode 100644
index 00000000000..7b911a49c38
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/interrupted_run/output.txt
@@ -0,0 +1,81 @@
+
+=== the deploy stops waiting before the run finishes
+>>> errcode [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/job-runs-interrupted-run/default/files...
+Created jobs.my_job
+Error: cannot create resources.job_runs.my_run: waiting after creating id=[MY_RUN_ID]: Fault injected by test. (403 INJECTED)
+
+Endpoint: GET [DATABRICKS_URL]/api/2.2/jobs/runs/get?run_id=[MY_RUN_ID]
+HTTP Status: 403 Forbidden
+API error_code: INJECTED
+API message: Fault injected by test.
+
+Files: 1 uploaded, 0 deleted
+
+Exit code: 1
+
+=== the abandoned run is still tracked
+>>> read_id.py my_job
+[MY_JOB_ID]
+
+>>> read_id.py my_run
+[MY_RUN_ID]
+
+>>> print_requests.py //jobs/run-now
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/run-now",
+  "body": {
+    "idempotency_token": "[UUID]",
+    "job_id": [MY_JOB_ID]
+  }
+}
+
+=== a run that is still going is skipped
+>>> jq .plan["resources.job_runs.my_run"] tmp.plan.json
+{
+  "depends_on": [
+    {
+      "node": "resources.jobs.my_job",
+      "label": "${resources.jobs.my_job.id}"
+    }
+  ],
+  "action": "skip",
+  "remote_state": {
+    "job_id": [MY_JOB_ID],
+    "run_id": [MY_RUN_ID],
+    "run_name": "my-job",
+    "run_page_url": "[DATABRICKS_URL]/jobs/[MY_JOB_ID]/runs/[MY_RUN_ID]?o=[WORKSPACE_ID]",
+    "run_type": "JOB_RUN",
+    "state": {
+      "life_cycle_state": "RUNNING"
+    }
+  },
+  "changes": {
+    "result_state": {
+      "action": "skip",
+      "reason": "run in progress",
+      "new": "SUCCESS"
+    }
+  }
+}
+
+=== Badness: the next deploy does not wait for that run
+>>> [CLI] bundle deploy --plan tmp.plan.json
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/job-runs-interrupted-run/default/files...
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 2 unchanged
+
+=== the same run is still tracked, and nothing was cancelled, deleted or triggered
+>>> read_state.py job_runs my_run id result_state
+job_runs my_run id='[MY_RUN_ID]' result_state=None
+
+>>> print_requests.py //jobs
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.my_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/job-runs-interrupted-run/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/job_runs/interrupted_run/script b/acceptance/bundle/resources/job_runs/interrupted_run/script
new file mode 100644
index 00000000000..5d82c41ff49
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/interrupted_run/script
@@ -0,0 +1,31 @@
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+# The fault hits the poll, not the run: it ends the deploy's wait while leaving the
+# run going, which is what an interrupted deploy leaves behind: the run id is
+# recorded in the state, but no outcome was ever observed.
+fault.py "GET /api/2.2/jobs/runs/get" 403 0 1
+
+title "the deploy stops waiting before the run finishes"
+trace errcode $CLI bundle deploy
+
+title "the abandoned run is still tracked"
+trace read_id.py my_job
+trace read_id.py my_run
+trace print_requests.py //jobs/run-now
+
+title "a run that is still going is skipped"
+$CLI bundle plan -o json > tmp.plan.json
+trace jq '.plan["resources.job_runs.my_run"]' tmp.plan.json
+
+# Replay the plan captured while the run was still going: a fresh plan would
+# re-read it, and the testserver would settle it on that GET.
+title "Badness: the next deploy does not wait for that run"
+trace $CLI bundle deploy --plan tmp.plan.json
+
+title "the same run is still tracked, and nothing was cancelled, deleted or triggered"
+trace read_state.py job_runs my_run id result_state
+trace print_requests.py //jobs
diff --git a/acceptance/bundle/resources/job_runs/interrupted_run/test.toml b/acceptance/bundle/resources/job_runs/interrupted_run/test.toml
new file mode 100644
index 00000000000..46de6c88c3c
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/interrupted_run/test.toml
@@ -0,0 +1,4 @@
+# The interruption is staged by injecting a fault into the testserver, so this
+# stays off cloud.
+Badness = "An in-progress run is planned as skip, so a deploy after an interrupted wait does not resume waiting for it to finish."
+Ignore = ["tmp.plan.json"]
diff --git a/acceptance/bundle/resources/job_runs/job_parameters/databricks.yml b/acceptance/bundle/resources/job_runs/job_parameters/databricks.yml
new file mode 100644
index 00000000000..fb6970b9286
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/job_parameters/databricks.yml
@@ -0,0 +1,26 @@
+bundle:
+  name: job-runs-job-parameters
+
+resources:
+  jobs:
+    my_job:
+      name: my-job
+      parameters:
+        - name: env
+          default: dev
+        - name: region
+          default: us
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: /Workspace/test
+
+  job_runs:
+    my_run:
+      job_id: ${resources.jobs.my_job.id}
+      # Override only one of the job's two parameters. GetRun resolves the full
+      # parameter set (including the un-overridden `region` default), so without
+      # job_parameters in ignore_remote_changes this drift would recreate the run
+      # on every plan.
+      job_parameters:
+        env: prod
diff --git a/acceptance/bundle/resources/job_runs/job_parameters/out.test.toml b/acceptance/bundle/resources/job_runs/job_parameters/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/job_parameters/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/job_runs/job_parameters/output.txt b/acceptance/bundle/resources/job_runs/job_parameters/output.txt
new file mode 100644
index 00000000000..d3c5ff16368
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/job_parameters/output.txt
@@ -0,0 +1,51 @@
+
+=== deploy triggers the run with only the overridden parameter
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/job-runs-job-parameters/default/files...
+Created jobs.my_job
+Output from job_runs.my_run: id=[MY_RUN_ID]: Run URL: [DATABRICKS_URL]/jobs/[MY_JOB_ID]/runs/[MY_RUN_ID]?o=[WORKSPACE_ID]
+Output from job_runs.my_run: id=[MY_RUN_ID]: SUCCESS
+Created job_runs.my_run
+Files: 1 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //jobs/run-now
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/run-now",
+  "body": {
+    "idempotency_token": "[UUID]",
+    "job_id": [MY_JOB_ID],
+    "job_parameters": {
+      "env": "prod"
+    }
+  }
+}
+
+=== plan is stable: the resolved job default does not look like drift
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
+
+>>> [CLI] bundle summary
+Name: job-runs-job-parameters
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/job-runs-job-parameters/default
+Resources:
+  Job Runs:
+    my_run:
+      Name: 
+      URL:  [DATABRICKS_URL]/jobs/[MY_JOB_ID]/runs/[MY_RUN_ID]?w=[WORKSPACE_ID]
+  Jobs:
+    my_job:
+      Name: my-job
+      URL:  [DATABRICKS_URL]/jobs/[MY_JOB_ID]?w=[WORKSPACE_ID]
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.my_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/job-runs-job-parameters/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/job_runs/job_parameters/script b/acceptance/bundle/resources/job_runs/job_parameters/script
new file mode 100644
index 00000000000..d73122d07f2
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/job_parameters/script
@@ -0,0 +1,19 @@
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+title "deploy triggers the run with only the overridden parameter"
+trace $CLI bundle deploy
+
+# Name the ids so the request body and the URLs below say which number is the job
+# and which is the run.
+read_id.py my_job > /dev/null
+read_id.py my_run > /dev/null
+
+trace print_requests.py //jobs/run-now
+
+title "plan is stable: the resolved job default does not look like drift"
+trace $CLI bundle plan
+trace $CLI bundle summary
diff --git a/acceptance/bundle/resources/job_runs/on_bundle_deploy/databricks.yml b/acceptance/bundle/resources/job_runs/on_bundle_deploy/databricks.yml
new file mode 100644
index 00000000000..0ca892109c3
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_bundle_deploy/databricks.yml
@@ -0,0 +1,18 @@
+bundle:
+  name: job-runs-on-bundle-deploy
+
+resources:
+  jobs:
+    my_job:
+      name: my-job
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: /Workspace/test
+
+  job_runs:
+    my_run:
+      job_id: ${resources.jobs.my_job.id}
+      lifecycle:
+        triggers:
+          - on_bundle_deploy: true
diff --git a/acceptance/bundle/resources/job_runs/on_bundle_deploy/out.test.toml b/acceptance/bundle/resources/job_runs/on_bundle_deploy/out.test.toml
new file mode 100644
index 00000000000..f7fafbcc731
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_bundle_deploy/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/resources/job_runs/on_bundle_deploy/output.txt b/acceptance/bundle/resources/job_runs/on_bundle_deploy/output.txt
new file mode 100644
index 00000000000..f910dffcc05
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_bundle_deploy/output.txt
@@ -0,0 +1,111 @@
+
+=== first deploy triggers a run
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/job-runs-on-bundle-deploy/default/files...
+Created jobs.my_job
+Output from job_runs.my_run: id=[MY_RUN_ID]: Run URL: [DATABRICKS_URL]/jobs/[MY_JOB_ID]/runs/[MY_RUN_ID]?o=[WORKSPACE_ID]
+Output from job_runs.my_run: id=[MY_RUN_ID]: SUCCESS
+Created job_runs.my_run
+Files: 1 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> read_id.py my_job
+[MY_JOB_ID]
+
+>>> print_requests.py //jobs/run-now
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/run-now",
+  "body": {
+    "idempotency_token": "[UUID]",
+    "job_id": [MY_JOB_ID]
+  }
+}
+
+=== redeploy re-fires with unchanged config
+>>> [CLI] bundle plan
+recreate job_runs.my_run
+
+Plan: 1 to add, 0 to change, 1 to delete, 1 unchanged
+
+>>> jq .plan["resources.job_runs.my_run"].changes tmp.plan.json
+{
+  "lifecycle.triggers_state.on_bundle_deploy": {
+    "action": "recreate",
+    "reason": "immutable",
+    "old": "[UUID]",
+    "new": "[UUID]"
+  },
+  "result_state": {
+    "action": "skip",
+    "reason": "remote_already_set",
+    "new": "SUCCESS",
+    "remote": "SUCCESS"
+  }
+}
+
+=== bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/job-runs-on-bundle-deploy/default/files...
+Output from job_runs.my_run: id=[MY_RUN_ID_2]: Run URL: [DATABRICKS_URL]/jobs/[MY_JOB_ID]/runs/[MY_RUN_ID_2]?o=[WORKSPACE_ID]
+Output from job_runs.my_run: id=[MY_RUN_ID_2]: SUCCESS
+Recreated job_runs.my_run
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 1 unchanged
+
+>>> [CLI] bundle summary
+Name: job-runs-on-bundle-deploy
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/job-runs-on-bundle-deploy/default
+Resources:
+  Job Runs:
+    my_run:
+      Name: 
+      URL:  [DATABRICKS_URL]/jobs/[MY_JOB_ID]/runs/[MY_RUN_ID_2]?w=[WORKSPACE_ID]
+  Jobs:
+    my_job:
+      Name: my-job
+      URL:  [DATABRICKS_URL]/jobs/[MY_JOB_ID]?w=[WORKSPACE_ID]
+
+=== second run-now after recreate
+>>> print_requests.py --keep //jobs/runs/delete
+
+>>> print_requests.py //jobs/run-now
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/run-now",
+  "body": {
+    "idempotency_token": "[UUID]",
+    "job_id": [MY_JOB_ID]
+  }
+}
+
+=== removing on_bundle_deploy is unchanged and does not run
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
+
+>>> jq .plan["resources.job_runs.my_run"].changes tmp.plan.json
+{
+  "result_state": {
+    "action": "skip",
+    "reason": "remote_already_set",
+    "new": "SUCCESS",
+    "remote": "SUCCESS"
+  }
+}
+
+=== bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/job-runs-on-bundle-deploy/default/files...
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 2 unchanged
+
+>>> print_requests.py //jobs/run-now
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.my_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/job-runs-on-bundle-deploy/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/job_runs/on_bundle_deploy/script b/acceptance/bundle/resources/job_runs/on_bundle_deploy/script
new file mode 100644
index 00000000000..10f95d176f4
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_bundle_deploy/script
@@ -0,0 +1,41 @@
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+title "first deploy triggers a run"
+trace $CLI bundle deploy
+trace read_id.py my_job
+# Name the first run so the second becomes [MY_RUN_ID_2].
+read_id.py my_run > /dev/null
+trace print_requests.py //jobs/run-now
+
+title "redeploy re-fires with unchanged config"
+trace $CLI bundle plan
+# Save the plan so the READPLAN=1 variant deploys the fingerprint minted here.
+# The deploys are not traced: readplanarg makes the command line differ per variant.
+$CLI bundle plan -o json > tmp.plan.json
+trace jq '.plan["resources.job_runs.my_run"].changes' tmp.plan.json
+title "bundle deploy\n"
+$CLI bundle deploy $(readplanarg tmp.plan.json)
+read_id.py my_run > /dev/null
+trace $CLI bundle summary
+
+title "second run-now after recreate"
+trace print_requests.py --keep //jobs/runs/delete
+trace print_requests.py //jobs/run-now
+
+title "removing on_bundle_deploy is unchanged and does not run"
+# Drop the lifecycle block so the next plan compares a nil fingerprint against
+# the UUID left in state. The removed trigger is skipped, never recreated.
+update_file.py databricks.yml "      lifecycle:
+        triggers:
+          - on_bundle_deploy: true
+" ""
+trace $CLI bundle plan
+$CLI bundle plan -o json > tmp.plan.json
+trace jq '.plan["resources.job_runs.my_run"].changes' tmp.plan.json
+title "bundle deploy\n"
+$CLI bundle deploy $(readplanarg tmp.plan.json)
+trace print_requests.py //jobs/run-now
diff --git a/acceptance/bundle/resources/job_runs/on_bundle_deploy/test.toml b/acceptance/bundle/resources/job_runs/on_bundle_deploy/test.toml
new file mode 100644
index 00000000000..663d9510c10
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_bundle_deploy/test.toml
@@ -0,0 +1,6 @@
+# Deploy both by re-planning and from a plan saved on disk, so the fingerprint
+# minted during planning is exercised across plan serialization.
+EnvMatrix.READPLAN = ["", "1"]
+
+# The saved plan embeds a fresh fingerprint on every run.
+Ignore = ["tmp.plan.json"]
diff --git a/acceptance/bundle/resources/job_runs/on_file_change/databricks.yml b/acceptance/bundle/resources/job_runs/on_file_change/databricks.yml
new file mode 100644
index 00000000000..0a6df75047a
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change/databricks.yml
@@ -0,0 +1,18 @@
+bundle:
+  name: job-runs-on-file-change
+
+resources:
+  jobs:
+    my_job:
+      name: my-job
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: /Workspace/test
+
+  job_runs:
+    my_run:
+      job_id: ${resources.jobs.my_job.id}
+      lifecycle:
+        triggers:
+          - on_file_change: seed.txt
diff --git a/acceptance/bundle/resources/job_runs/on_file_change/out.plan.create.json b/acceptance/bundle/resources/job_runs/on_file_change/out.plan.create.json
new file mode 100644
index 00000000000..8fb3fcdfd59
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change/out.plan.create.json
@@ -0,0 +1,57 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.job_runs.my_run": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.my_job",
+          "label": "${resources.jobs.my_job.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "job_id": 0,
+          "lifecycle": {
+            "triggers_state": {
+              "on_file_change": {
+                "seed.txt": "[FILE_HASH]"
+              }
+            }
+          },
+          "result_state": "SUCCESS"
+        },
+        "vars": {
+          "job_id": "${resources.jobs.my_job.id}"
+        }
+      }
+    },
+    "resources.jobs.my_job": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/job-runs-on-file-change/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "my-job",
+          "queue": {
+            "enabled": true
+          },
+          "tasks": [
+            {
+              "notebook_task": {
+                "notebook_path": "/Workspace/test"
+              },
+              "task_key": "main"
+            }
+          ]
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/job_runs/on_file_change/out.test.toml b/acceptance/bundle/resources/job_runs/on_file_change/out.test.toml
new file mode 100644
index 00000000000..f7fafbcc731
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/resources/job_runs/on_file_change/output.txt b/acceptance/bundle/resources/job_runs/on_file_change/output.txt
new file mode 100644
index 00000000000..cd580a8efa4
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change/output.txt
@@ -0,0 +1,256 @@
+
+=== first deploy triggers a run
+>>> [CLI] bundle plan -o json
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/job-runs-on-file-change/default/files...
+Created jobs.my_job
+Output from job_runs.my_run: id=[MY_RUN_ID]: Run URL: [DATABRICKS_URL]/jobs/[MY_JOB_ID]/runs/[MY_RUN_ID]?o=[WORKSPACE_ID]
+Output from job_runs.my_run: id=[MY_RUN_ID]: SUCCESS
+Created job_runs.my_run
+Files: 4 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> read_id.py my_job
+[MY_JOB_ID]
+
+>>> print_requests.py //jobs/run-now
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/run-now",
+  "body": {
+    "idempotency_token": "[UUID]",
+    "job_id": [MY_JOB_ID]
+  }
+}
+
+=== redeploy with unchanged file plans nothing
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/job-runs-on-file-change/default/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 2 unchanged
+
+>>> print_requests.py //jobs/run-now
+
+=== touch without content change plans nothing
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/job-runs-on-file-change/default/files...
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 2 unchanged
+
+>>> print_requests.py //jobs/run-now
+
+=== editing the file re-fires
+>>> jq .plan["resources.job_runs.my_run"] tmp.plan1.json
+{
+  "depends_on": [
+    {
+      "node": "resources.jobs.my_job",
+      "label": "${resources.jobs.my_job.id}"
+    }
+  ],
+  "action": "recreate",
+  "new_state": {
+    "value": {
+      "job_id": [MY_JOB_ID],
+      "lifecycle": {
+        "triggers_state": {
+          "on_file_change": {
+            "seed.txt": "[FILE_HASH][0]"
+          }
+        }
+      },
+      "result_state": "SUCCESS"
+    }
+  },
+  "remote_state": {
+    "job_id": [MY_JOB_ID],
+    "result_state": "SUCCESS",
+    "run_id": [MY_RUN_ID],
+    "run_name": "my-job",
+    "run_page_url": "[DATABRICKS_URL]/jobs/[MY_JOB_ID]/runs/[MY_RUN_ID]?o=[WORKSPACE_ID]",
+    "run_type": "JOB_RUN",
+    "state": {
+      "life_cycle_state": "TERMINATED",
+      "result_state": "SUCCESS"
+    }
+  },
+  "changes": {
+    "lifecycle.triggers_state.on_file_change['seed.txt']": {
+      "action": "recreate",
+      "reason": "immutable",
+      "old": "[FILE_HASH][1]",
+      "new": "[FILE_HASH][0]"
+    },
+    "result_state": {
+      "action": "skip",
+      "reason": "remote_already_set",
+      "new": "SUCCESS",
+      "remote": "SUCCESS"
+    }
+  }
+}
+
+=== bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/job-runs-on-file-change/default/files...
+Output from job_runs.my_run: id=[MY_RUN_ID_2]: Run URL: [DATABRICKS_URL]/jobs/[MY_JOB_ID]/runs/[MY_RUN_ID_2]?o=[WORKSPACE_ID]
+Output from job_runs.my_run: id=[MY_RUN_ID_2]: SUCCESS
+Recreated job_runs.my_run
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 1 unchanged
+
+>>> print_requests.py --keep //jobs/runs/delete
+
+>>> print_requests.py //jobs/run-now
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/run-now",
+  "body": {
+    "idempotency_token": "[UUID]",
+    "job_id": [MY_JOB_ID]
+  }
+}
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
+
+=== deleting the file warns and re-fires
+>>> [CLI] bundle plan -o json
+Warning: lifecycle.triggers.on_file_change: no synced files match "seed.txt"
+  in databricks.yml:18:29
+
+
+>>> jq .plan["resources.job_runs.my_run"] tmp.plan2.json
+{
+  "depends_on": [
+    {
+      "node": "resources.jobs.my_job",
+      "label": "${resources.jobs.my_job.id}"
+    }
+  ],
+  "action": "recreate",
+  "new_state": {
+    "value": {
+      "job_id": [MY_JOB_ID],
+      "lifecycle": {
+        "triggers_state": {
+          "on_file_change": {
+            "seed.txt": "[FILE_HASH][2]"
+          }
+        }
+      },
+      "result_state": "SUCCESS"
+    }
+  },
+  "remote_state": {
+    "job_id": [MY_JOB_ID],
+    "result_state": "SUCCESS",
+    "run_id": [MY_RUN_ID_2],
+    "run_name": "my-job",
+    "run_page_url": "[DATABRICKS_URL]/jobs/[MY_JOB_ID]/runs/[MY_RUN_ID_2]?o=[WORKSPACE_ID]",
+    "run_type": "JOB_RUN",
+    "state": {
+      "life_cycle_state": "TERMINATED",
+      "result_state": "SUCCESS"
+    }
+  },
+  "changes": {
+    "lifecycle.triggers_state.on_file_change['seed.txt']": {
+      "action": "recreate",
+      "reason": "immutable",
+      "old": "[FILE_HASH][0]",
+      "new": "[FILE_HASH][2]"
+    },
+    "result_state": {
+      "action": "skip",
+      "reason": "remote_already_set",
+      "new": "SUCCESS",
+      "remote": "SUCCESS"
+    }
+  }
+}
+Warning: lifecycle.triggers.on_file_change: no synced files match "seed.txt"
+  in databricks.yml:18:29
+
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/job-runs-on-file-change/default/files...
+Output from job_runs.my_run: id=[MY_RUN_ID_3]: Run URL: [DATABRICKS_URL]/jobs/[MY_JOB_ID]/runs/[MY_RUN_ID_3]?o=[WORKSPACE_ID]
+Output from job_runs.my_run: id=[MY_RUN_ID_3]: SUCCESS
+Recreated job_runs.my_run
+Files: 2 uploaded, 1 deleted
+Resources: 1 created, 0 changed, 1 deleted, 1 unchanged
+
+>>> print_requests.py //jobs/run-now
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/run-now",
+  "body": {
+    "idempotency_token": "[UUID]",
+    "job_id": [MY_JOB_ID]
+  }
+}
+
+>>> [CLI] bundle plan
+Warning: lifecycle.triggers.on_file_change: no synced files match "seed.txt"
+  in databricks.yml:18:29
+
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
+
+=== restoring the file re-fires again
+>>> [CLI] bundle plan -o json
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/job-runs-on-file-change/default/files...
+Output from job_runs.my_run: id=[MY_RUN_ID_4]: Run URL: [DATABRICKS_URL]/jobs/[MY_JOB_ID]/runs/[MY_RUN_ID_4]?o=[WORKSPACE_ID]
+Output from job_runs.my_run: id=[MY_RUN_ID_4]: SUCCESS
+Recreated job_runs.my_run
+Files: 2 uploaded, 1 deleted
+Resources: 1 created, 0 changed, 1 deleted, 1 unchanged
+
+>>> print_requests.py //jobs/run-now
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/run-now",
+  "body": {
+    "idempotency_token": "[UUID]",
+    "job_id": [MY_JOB_ID]
+  }
+}
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
+
+=== removing on_file_change is unchanged and does not run
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
+
+=== bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/job-runs-on-file-change/default/files...
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 2 unchanged
+
+>>> print_requests.py //jobs/run-now
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
+
+=== re-adding on_file_change does not re-fire an unchanged file
+>>> print_state.py
+{
+  "triggers_state": {
+    "on_file_change": {
+      "seed.txt": "[FILE_HASH][0]"
+    }
+  }
+}
+
+>>> [CLI] bundle plan -o json
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/job-runs-on-file-change/default/files...
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 2 unchanged
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.my_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/job-runs-on-file-change/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/job_runs/on_file_change/script b/acceptance/bundle/resources/job_runs/on_file_change/script
new file mode 100644
index 00000000000..6a3121450c8
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change/script
@@ -0,0 +1,83 @@
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+plan_no_changes() {
+    trace $CLI bundle plan | contains.py "0 to add, 0 to change"
+}
+
+title "first deploy triggers a run"
+# Deploy reads the raw plan so it keeps the DMS version_id it needs; the committed
+# golden is that plan with the DMS stamp stripped, so it matches across DMS variants.
+trace $CLI bundle plan -o json > tmp.plan.create.json
+nostamp < tmp.plan.create.json > out.plan.create.json
+$CLI bundle deploy $(readplanarg tmp.plan.create.json)
+trace read_id.py my_job
+# Name the first run so the recreated one becomes [MY_RUN_ID_2].
+read_id.py my_run > /dev/null
+trace print_requests.py //jobs/run-now
+
+title "redeploy with unchanged file plans nothing"
+trace $CLI bundle deploy
+trace print_requests.py //jobs/run-now
+
+title "touch without content change plans nothing"
+python -c "import os; os.utime('seed.txt', None)"
+trace $CLI bundle deploy
+trace print_requests.py //jobs/run-now
+
+title "editing the file re-fires"
+update_file.py seed.txt "v1" "v2"
+$CLI bundle plan -o json > tmp.plan1.json
+trace jq '.plan["resources.job_runs.my_run"]' tmp.plan1.json
+title "bundle deploy\n"
+$CLI bundle deploy $(readplanarg tmp.plan1.json)
+read_id.py my_run > /dev/null
+trace print_requests.py --keep //jobs/runs/delete
+trace print_requests.py //jobs/run-now
+plan_no_changes
+
+title "deleting the file warns and re-fires"
+mv seed.txt tmp.seed.txt
+trace $CLI bundle plan -o json > tmp.plan2.json
+trace jq '.plan["resources.job_runs.my_run"]' tmp.plan2.json
+$CLI bundle deploy $(readplanarg tmp.plan2.json)
+read_id.py my_run > /dev/null
+trace print_requests.py //jobs/run-now
+plan_no_changes
+
+title "restoring the file re-fires again"
+mv tmp.seed.txt seed.txt
+trace $CLI bundle plan -o json > tmp.plan3.json
+$CLI bundle deploy $(readplanarg tmp.plan3.json)
+read_id.py my_run > /dev/null
+trace print_requests.py //jobs/run-now
+plan_no_changes
+
+title "removing on_file_change is unchanged and does not run"
+update_file.py databricks.yml "      lifecycle:
+        triggers:
+          - on_file_change: seed.txt
+" ""
+trace $CLI bundle plan
+$CLI bundle plan -o json > tmp.plan4.json
+title "bundle deploy\n"
+$CLI bundle deploy $(readplanarg tmp.plan4.json)
+trace print_requests.py //jobs/run-now
+plan_no_changes
+
+title "re-adding on_file_change does not re-fire an unchanged file"
+# Removing the trigger left the last hash in state, so re-adding it compares
+# against that and only re-fires when the file changed while disarmed.
+trace print_state.py | jq '.state["resources.job_runs.my_run"].state.lifecycle'
+update_file.py databricks.yml '      job_id: ${resources.jobs.my_job.id}
+' '      job_id: ${resources.jobs.my_job.id}
+      lifecycle:
+        triggers:
+          - on_file_change: seed.txt
+'
+trace $CLI bundle plan -o json > tmp.plan5.json
+$CLI bundle deploy $(readplanarg tmp.plan5.json)
+plan_no_changes
diff --git a/acceptance/bundle/resources/job_runs/on_file_change/seed.txt b/acceptance/bundle/resources/job_runs/on_file_change/seed.txt
new file mode 100644
index 00000000000..626799f0f85
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change/seed.txt
@@ -0,0 +1 @@
+v1
diff --git a/acceptance/bundle/resources/job_runs/on_file_change/test.toml b/acceptance/bundle/resources/job_runs/on_file_change/test.toml
new file mode 100644
index 00000000000..4585bcedd0c
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change/test.toml
@@ -0,0 +1,12 @@
+# Deploy both by re-planning and from a plan saved on disk, so the hashes
+# computed during planning survive plan serialization.
+EnvMatrix.READPLAN = ["", "1"]
+
+Ignore = ["tmp.*.*"]
+
+# Content hashes are stable but unreadable. Distinct keeps different hashes
+# distinguishable.
+[[Repls]]
+Old = '[0-9a-f]{64}'
+New = '[FILE_HASH]'
+Distinct = true
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_build/databricks.yml b/acceptance/bundle/resources/job_runs/on_file_change_build/databricks.yml
new file mode 100644
index 00000000000..ddc7a4d8896
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_build/databricks.yml
@@ -0,0 +1,22 @@
+bundle:
+  name: job-runs-on-file-change-build
+
+experimental:
+  scripts:
+    prebuild: cp source.txt watched.txt
+
+resources:
+  jobs:
+    my_job:
+      name: my-job
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: /Workspace/test
+
+  job_runs:
+    my_run:
+      job_id: ${resources.jobs.my_job.id}
+      lifecycle:
+        triggers:
+          - on_file_change: watched.txt
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_build/out.test.toml b/acceptance/bundle/resources/job_runs/on_file_change_build/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_build/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_build/output.txt b/acceptance/bundle/resources/job_runs/on_file_change_build/output.txt
new file mode 100644
index 00000000000..8cde92e29b9
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_build/output.txt
@@ -0,0 +1,52 @@
+
+=== first deploy triggers a run
+>>> [CLI] bundle deploy
+Executing 'prebuild' script
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/job-runs-on-file-change-build/default/files...
+Created jobs.my_job
+Output from job_runs.my_run: id=[MY_RUN_ID]: Run URL: [DATABRICKS_URL]/jobs/[MY_JOB_ID]/runs/[MY_RUN_ID]?o=[WORKSPACE_ID]
+Output from job_runs.my_run: id=[MY_RUN_ID]: SUCCESS
+Created job_runs.my_run
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> read_id.py my_job
+[MY_JOB_ID]
+
+>>> print_requests.py //jobs/run-now
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/run-now",
+  "body": {
+    "idempotency_token": "[UUID]",
+    "job_id": [MY_JOB_ID]
+  }
+}
+
+=== a prebuild file change re-fires in the same deploy
+>>> [CLI] bundle deploy
+Executing 'prebuild' script
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/job-runs-on-file-change-build/default/files...
+Output from job_runs.my_run: id=[MY_RUN_ID_2]: Run URL: [DATABRICKS_URL]/jobs/[MY_JOB_ID]/runs/[MY_RUN_ID_2]?o=[WORKSPACE_ID]
+Output from job_runs.my_run: id=[MY_RUN_ID_2]: SUCCESS
+Recreated job_runs.my_run
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 1 unchanged
+
+>>> print_requests.py //jobs/run-now
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/run-now",
+  "body": {
+    "idempotency_token": "[UUID]",
+    "job_id": [MY_JOB_ID]
+  }
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.my_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/job-runs-on-file-change-build/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_build/script b/acceptance/bundle/resources/job_runs/on_file_change_build/script
new file mode 100644
index 00000000000..3e145d0f908
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_build/script
@@ -0,0 +1,18 @@
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+title "first deploy triggers a run"
+trace $CLI bundle deploy
+trace read_id.py my_job
+# Name the first run so the recreated one becomes [MY_RUN_ID_2].
+read_id.py my_run > /dev/null
+trace print_requests.py //jobs/run-now
+
+title "a prebuild file change re-fires in the same deploy"
+update_file.py source.txt "v1" "v2"
+trace $CLI bundle deploy
+read_id.py my_run > /dev/null
+trace print_requests.py //jobs/run-now
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_build/source.txt b/acceptance/bundle/resources/job_runs/on_file_change_build/source.txt
new file mode 100644
index 00000000000..626799f0f85
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_build/source.txt
@@ -0,0 +1 @@
+v1
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_build/watched.txt b/acceptance/bundle/resources/job_runs/on_file_change_build/watched.txt
new file mode 100644
index 00000000000..626799f0f85
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_build/watched.txt
@@ -0,0 +1 @@
+v1
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_errors/absolute_pattern.yml b/acceptance/bundle/resources/job_runs/on_file_change_errors/absolute_pattern.yml
new file mode 100644
index 00000000000..e0d709d3fac
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_errors/absolute_pattern.yml
@@ -0,0 +1,18 @@
+bundle:
+  name: job-runs-on-file-change-errors
+
+resources:
+  jobs:
+    my_job:
+      name: my-job
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: /Workspace/test
+
+  job_runs:
+    my_run:
+      job_id: ${resources.jobs.my_job.id}
+      lifecycle:
+        triggers:
+          - on_file_change: /tmp/seed.txt
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_errors/allexcluded/a.txt b/acceptance/bundle/resources/job_runs/on_file_change_errors/allexcluded/a.txt
new file mode 100644
index 00000000000..78981922613
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_errors/allexcluded/a.txt
@@ -0,0 +1 @@
+a
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_errors/databricks.yml b/acceptance/bundle/resources/job_runs/on_file_change_errors/databricks.yml
new file mode 100644
index 00000000000..0ce9819887c
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_errors/databricks.yml
@@ -0,0 +1,24 @@
+bundle:
+  name: job-runs-on-file-change-errors
+
+sync:
+  exclude:
+    - mixed/excluded.txt
+    # Literal path: the script rewrites the trigger by substring, and allexcluded/* would hit this line.
+    - allexcluded/a.txt
+
+resources:
+  jobs:
+    my_job:
+      name: my-job
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: /Workspace/test
+
+  job_runs:
+    my_run:
+      job_id: ${resources.jobs.my_job.id}
+      lifecycle:
+        triggers:
+          - on_file_change: ../shared/*.txt
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_errors/dirs/nested/keep.txt b/acceptance/bundle/resources/job_runs/on_file_change_errors/dirs/nested/keep.txt
new file mode 100644
index 00000000000..79c53955ef8
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_errors/dirs/nested/keep.txt
@@ -0,0 +1 @@
+nested
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_errors/mixed/excluded.txt b/acceptance/bundle/resources/job_runs/on_file_change_errors/mixed/excluded.txt
new file mode 100644
index 00000000000..bbde3dc9de9
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_errors/mixed/excluded.txt
@@ -0,0 +1 @@
+excluded
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_errors/mixed/nested/keep.txt b/acceptance/bundle/resources/job_runs/on_file_change_errors/mixed/nested/keep.txt
new file mode 100644
index 00000000000..2fa992c0b8b
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_errors/mixed/nested/keep.txt
@@ -0,0 +1 @@
+keep
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_errors/out.test.toml b/acceptance/bundle/resources/job_runs/on_file_change_errors/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_errors/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_errors/output.txt b/acceptance/bundle/resources/job_runs/on_file_change_errors/output.txt
new file mode 100644
index 00000000000..73f170fe8e9
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_errors/output.txt
@@ -0,0 +1,91 @@
+
+=== a pattern that escapes the sync root is rejected
+>>> musterr [CLI] bundle validate
+Error: lifecycle.triggers.on_file_change: pattern "../shared/*.txt" is not under the sync root
+  in databricks.yml:24:29
+
+Name: job-runs-on-file-change-errors
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/job-runs-on-file-change-errors/default
+
+Found 1 error
+
+=== a glob that only matches directories warns
+>>> [CLI] bundle validate
+Warning: lifecycle.triggers.on_file_change: no synced files match "dirs/*"
+  in databricks.yml:24:29
+
+Name: job-runs-on-file-change-errors
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/job-runs-on-file-change-errors/default
+
+Found 1 warning
+
+=== a glob matching a directory and an excluded file warns
+>>> [CLI] bundle validate
+Warning: lifecycle.triggers.on_file_change: no synced files match "mixed/*"
+  in databricks.yml:24:29
+
+Name: job-runs-on-file-change-errors
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/job-runs-on-file-change-errors/default
+
+Found 1 warning
+
+=== a glob matching only excluded files warns
+>>> [CLI] bundle validate
+Warning: lifecycle.triggers.on_file_change: no synced files match "allexcluded/*"
+  in databricks.yml:24:29
+
+Name: job-runs-on-file-change-errors
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/job-runs-on-file-change-errors/default
+
+Found 1 warning
+
+=== a pattern that matches nothing warns
+>>> [CLI] bundle validate
+Warning: lifecycle.triggers.on_file_change: no synced files match "missing/*.txt"
+  in databricks.yml:24:29
+
+Name: job-runs-on-file-change-errors
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/job-runs-on-file-change-errors/default
+
+Found 1 warning
+
+=== ** is not supported
+>>> musterr [CLI] bundle validate
+Error: lifecycle.triggers.on_file_change: ** in "src/**" is not supported; use * for a single directory level
+  in databricks.yml:24:29
+
+Name: job-runs-on-file-change-errors
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/job-runs-on-file-change-errors/default
+
+Found 1 error
+
+=== an absolute pattern is rejected
+>>> musterr [CLI] bundle validate
+Error: lifecycle.triggers.on_file_change: pattern "/tmp/seed.txt" must be relative to the defining YAML file
+  in databricks.yml:18:29
+
+Name: job-runs-on-file-change-errors
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/job-runs-on-file-change-errors/default
+
+Found 1 error
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_errors/script b/acceptance/bundle/resources/job_runs/on_file_change_errors/script
new file mode 100644
index 00000000000..faaa5de8d3c
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_errors/script
@@ -0,0 +1,31 @@
+title "a pattern that escapes the sync root is rejected"
+trace musterr $CLI bundle validate
+
+title "a glob that only matches directories warns"
+# dirs/* matches dirs/nested, a directory, so nothing is left to hash.
+update_file.py databricks.yml "../shared/*.txt" "dirs/*"
+trace $CLI bundle validate
+
+title "a glob matching a directory and an excluded file warns"
+# mixed/excluded.txt is dropped by sync.exclude; mixed/nested is a directory.
+update_file.py databricks.yml "dirs/*" "mixed/*"
+trace $CLI bundle validate
+
+title "a glob matching only excluded files warns"
+# Every match is dropped by sync.exclude.
+update_file.py databricks.yml "mixed/*" "allexcluded/*"
+trace $CLI bundle validate
+
+title "a pattern that matches nothing warns"
+update_file.py databricks.yml "allexcluded/*" "missing/*.txt"
+trace $CLI bundle validate
+
+title "** is not supported"
+update_file.py databricks.yml "missing/*.txt" "src/**"
+trace musterr $CLI bundle validate
+
+title "an absolute pattern is rejected"
+# Copied from a committed file rather than passed to update_file.py: Git Bash on
+# Windows rewrites a leading-slash argument into a Windows path.
+cp absolute_pattern.yml databricks.yml
+trace musterr $CLI bundle validate
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_errors/test.toml b/acceptance/bundle/resources/job_runs/on_file_change_errors/test.toml
new file mode 100644
index 00000000000..7b88d613d4c
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_errors/test.toml
@@ -0,0 +1,2 @@
+# The bundle is never deployed here, so there are no requests worth recording.
+RecordRequests = false
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_glob/databricks.yml b/acceptance/bundle/resources/job_runs/on_file_change_glob/databricks.yml
new file mode 100644
index 00000000000..d47fcf44049
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_glob/databricks.yml
@@ -0,0 +1,19 @@
+bundle:
+  name: job-runs-on-file-change-glob
+
+resources:
+  jobs:
+    my_job:
+      name: my-job
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: /Workspace/test
+
+  job_runs:
+    my_run:
+      job_id: ${resources.jobs.my_job.id}
+      lifecycle:
+        triggers:
+          - on_file_change: migrations/*
+          - on_file_change: mysubdir/*.txt
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_glob/dot_gitignore b/acceptance/bundle/resources/job_runs/on_file_change_glob/dot_gitignore
new file mode 100644
index 00000000000..57433d43f47
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_glob/dot_gitignore
@@ -0,0 +1,2 @@
+# Matches migrations/* but sync skips it, so a content edit must not re-fire.
+migrations/ignored.txt
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_glob/migrations/001.txt b/acceptance/bundle/resources/job_runs/on_file_change_glob/migrations/001.txt
new file mode 100644
index 00000000000..5626abf0f72
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_glob/migrations/001.txt
@@ -0,0 +1 @@
+one
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_glob/migrations/002.txt b/acceptance/bundle/resources/job_runs/on_file_change_glob/migrations/002.txt
new file mode 100644
index 00000000000..f719efd430d
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_glob/migrations/002.txt
@@ -0,0 +1 @@
+two
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_glob/migrations/archive/003.txt b/acceptance/bundle/resources/job_runs/on_file_change_glob/migrations/archive/003.txt
new file mode 100644
index 00000000000..2bdf67abb16
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_glob/migrations/archive/003.txt
@@ -0,0 +1 @@
+three
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_glob/migrations/ignored.txt b/acceptance/bundle/resources/job_runs/on_file_change_glob/migrations/ignored.txt
new file mode 100644
index 00000000000..ea10ec85c10
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_glob/migrations/ignored.txt
@@ -0,0 +1 @@
+ignored
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_glob/mysubdir/a.txt b/acceptance/bundle/resources/job_runs/on_file_change_glob/mysubdir/a.txt
new file mode 100644
index 00000000000..62e0af52c19
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_glob/mysubdir/a.txt
@@ -0,0 +1 @@
+sub
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_glob/out.test.toml b/acceptance/bundle/resources/job_runs/on_file_change_glob/out.test.toml
new file mode 100644
index 00000000000..f7fafbcc731
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_glob/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_glob/output.txt b/acceptance/bundle/resources/job_runs/on_file_change_glob/output.txt
new file mode 100644
index 00000000000..ed04ecb79d3
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_glob/output.txt
@@ -0,0 +1,150 @@
+
+=== deploy hashes the matched files
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/job-runs-on-file-change-glob/default/files...
+Created jobs.my_job
+Output from job_runs.my_run: id=[MY_RUN_ID]: Run URL: [DATABRICKS_URL]/jobs/[MY_JOB_ID]/runs/[MY_RUN_ID]?o=[WORKSPACE_ID]
+Output from job_runs.my_run: id=[MY_RUN_ID]: SUCCESS
+Created job_runs.my_run
+Files: 6 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> read_id.py my_job
+[MY_JOB_ID]
+
+>>> print_requests.py //jobs/run-now
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/run-now",
+  "body": {
+    "idempotency_token": "[UUID]",
+    "job_id": [MY_JOB_ID]
+  }
+}
+
+=== editing one matched file re-fires
+
+>>> jq .plan["resources.job_runs.my_run"].changes tmp.plan.json
+{
+  "lifecycle.triggers_state.on_file_change['migrations/*']": {
+    "action": "recreate",
+    "reason": "immutable",
+    "old": "[FILE_HASH][0]",
+    "new": "[FILE_HASH][1]"
+  },
+  "result_state": {
+    "action": "skip",
+    "reason": "remote_already_set",
+    "new": "SUCCESS",
+    "remote": "SUCCESS"
+  }
+}
+
+=== bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/job-runs-on-file-change-glob/default/files...
+Output from job_runs.my_run: id=[MY_RUN_ID_2]: Run URL: [DATABRICKS_URL]/jobs/[MY_JOB_ID]/runs/[MY_RUN_ID_2]?o=[WORKSPACE_ID]
+Output from job_runs.my_run: id=[MY_RUN_ID_2]: SUCCESS
+Recreated job_runs.my_run
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 1 unchanged
+
+>>> print_requests.py --keep //jobs/runs/delete
+
+>>> print_requests.py //jobs/run-now
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/run-now",
+  "body": {
+    "idempotency_token": "[UUID]",
+    "job_id": [MY_JOB_ID]
+  }
+}
+
+=== editing a file in a subdirectory re-fires
+
+>>> jq .plan["resources.job_runs.my_run"].changes tmp.plan.json
+{
+  "lifecycle.triggers_state.on_file_change['mysubdir/*.txt']": {
+    "action": "recreate",
+    "reason": "immutable",
+    "old": "[FILE_HASH][2]",
+    "new": "[FILE_HASH][3]"
+  },
+  "result_state": {
+    "action": "skip",
+    "reason": "remote_already_set",
+    "new": "SUCCESS",
+    "remote": "SUCCESS"
+  }
+}
+
+=== a new matching file re-fires
+
+>>> jq .plan["resources.job_runs.my_run"].changes tmp.plan.json
+{
+  "lifecycle.triggers_state.on_file_change['migrations/*']": {
+    "action": "recreate",
+    "reason": "immutable",
+    "old": "[FILE_HASH][1]",
+    "new": "[FILE_HASH][4]"
+  },
+  "result_state": {
+    "action": "skip",
+    "reason": "remote_already_set",
+    "new": "SUCCESS",
+    "remote": "SUCCESS"
+  }
+}
+
+=== removing a matched file re-fires
+
+>>> jq .plan["resources.job_runs.my_run"].changes tmp.plan.json
+{
+  "lifecycle.triggers_state.on_file_change['migrations/*']": {
+    "action": "recreate",
+    "reason": "immutable",
+    "old": "[FILE_HASH][1]",
+    "new": "[FILE_HASH][5]"
+  },
+  "result_state": {
+    "action": "skip",
+    "reason": "remote_already_set",
+    "new": "SUCCESS",
+    "remote": "SUCCESS"
+  }
+}
+
+=== editing a file below the glob does not re-fire
+
+>>> jq .plan["resources.job_runs.my_run"].changes tmp.plan.json
+{
+  "result_state": {
+    "action": "skip",
+    "reason": "remote_already_set",
+    "new": "SUCCESS",
+    "remote": "SUCCESS"
+  }
+}
+
+=== editing a gitignored file does not re-fire
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
+
+=== removing one pattern does not re-fire
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/job-runs-on-file-change-glob/default/files...
+Files: 5 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 2 unchanged
+
+>>> print_requests.py //jobs/run-now
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.my_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/job-runs-on-file-change-glob/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_glob/script b/acceptance/bundle/resources/job_runs/on_file_change_glob/script
new file mode 100644
index 00000000000..04a951a4bc2
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_glob/script
@@ -0,0 +1,67 @@
+# Fixture is named dot_gitignore so a real .gitignore does not affect git while developing.
+mv dot_gitignore .gitignore
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+# Plan once, print JSON changes, leave tmp.plan.json for readplanarg.
+changes() {
+    $CLI bundle plan -o json > tmp.plan.json
+    trace jq '.plan["resources.job_runs.my_run"].changes' tmp.plan.json
+}
+
+title "deploy hashes the matched files"
+trace $CLI bundle deploy
+trace read_id.py my_job
+read_id.py my_run > /dev/null
+trace print_requests.py //jobs/run-now
+
+title "editing one matched file re-fires\n"
+update_file.py migrations/001.txt "one" "one-edited"
+changes
+# The deploy is not traced: readplanarg makes the command line differ per variant.
+title "bundle deploy\n"
+$CLI bundle deploy $(readplanarg tmp.plan.json)
+read_id.py my_run > /dev/null
+trace print_requests.py --keep //jobs/runs/delete
+trace print_requests.py //jobs/run-now
+
+title "editing a file in a subdirectory re-fires\n"
+# printf keeps LF on Windows, where update_file.py's text-mode rewrite would
+# restore CRLF and leave the file hashing differently than the deploy above.
+printf 'sub-edited\n' > mysubdir/a.txt
+changes
+printf 'sub\n' > mysubdir/a.txt
+
+title "a new matching file re-fires\n"
+printf 'three\n' > migrations/003.txt
+changes
+rm migrations/003.txt
+
+title "removing a matched file re-fires\n"
+mv migrations/002.txt tmp.002.txt
+changes
+mv tmp.002.txt migrations/002.txt
+
+title "editing a file below the glob does not re-fire\n"
+# migrations/* matches the archive directory itself, which is skipped: the glob
+# does not descend into it.
+update_file.py migrations/archive/003.txt "three" "three-edited"
+changes
+update_file.py migrations/archive/003.txt "three-edited" "three"
+
+title "editing a gitignored file does not re-fire"
+update_file.py migrations/ignored.txt "ignored" "ignored-edited"
+trace $CLI bundle plan
+update_file.py migrations/ignored.txt "ignored-edited" "ignored"
+
+title "removing one pattern does not re-fire"
+cp databricks.yml tmp.databricks.yml
+update_file.py databricks.yml "          - on_file_change: mysubdir/*.txt" ""
+trace $CLI bundle plan
+trace $CLI bundle deploy
+trace print_requests.py //jobs/run-now
+mv tmp.databricks.yml databricks.yml
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_glob/test.toml b/acceptance/bundle/resources/job_runs/on_file_change_glob/test.toml
new file mode 100644
index 00000000000..98884820722
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_glob/test.toml
@@ -0,0 +1,11 @@
+# Deploy both by re-planning and from a plan saved on disk, so the hashes
+# computed during planning survive plan serialization.
+EnvMatrix.READPLAN = ["", "1"]
+
+Ignore = ["tmp.plan.json", "tmp.002.txt", "tmp.databricks.yml", ".gitignore"]
+
+# See on_file_change/test.toml: mask content hashes, keeping distinct hashes distinguishable.
+[[Repls]]
+Old = '[0-9a-f]{64}'
+New = '[FILE_HASH]'
+Distinct = true
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_include_sync_root/bundle/databricks.yml b/acceptance/bundle/resources/job_runs/on_file_change_include_sync_root/bundle/databricks.yml
new file mode 100644
index 00000000000..2bdd1c06d13
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_include_sync_root/bundle/databricks.yml
@@ -0,0 +1,19 @@
+bundle:
+  name: job-runs-on-file-change-include-sync-root
+
+include:
+  - resources/job_run.yml
+
+sync:
+  paths:
+    - .
+    - ../shared.txt
+
+resources:
+  jobs:
+    my_job:
+      name: my-job
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: /Workspace/test
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_include_sync_root/bundle/resources/job_run.yml b/acceptance/bundle/resources/job_runs/on_file_change_include_sync_root/bundle/resources/job_run.yml
new file mode 100644
index 00000000000..f6761be7e15
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_include_sync_root/bundle/resources/job_run.yml
@@ -0,0 +1,9 @@
+resources:
+  job_runs:
+    my_run:
+      job_id: ${resources.jobs.my_job.id}
+      lifecycle:
+        triggers:
+          - on_file_change: watched-resources.txt
+          - on_file_change: ../watched-bundle.txt
+          - on_file_change: ../../shared.txt
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_include_sync_root/bundle/resources/watched-resources.txt b/acceptance/bundle/resources/job_runs/on_file_change_include_sync_root/bundle/resources/watched-resources.txt
new file mode 100644
index 00000000000..8b4e79d3c47
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_include_sync_root/bundle/resources/watched-resources.txt
@@ -0,0 +1 @@
+include-v1
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_include_sync_root/bundle/watched-bundle.txt b/acceptance/bundle/resources/job_runs/on_file_change_include_sync_root/bundle/watched-bundle.txt
new file mode 100644
index 00000000000..6f22941eacf
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_include_sync_root/bundle/watched-bundle.txt
@@ -0,0 +1 @@
+bundle-v1
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_include_sync_root/out.test.toml b/acceptance/bundle/resources/job_runs/on_file_change_include_sync_root/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_include_sync_root/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_include_sync_root/output.txt b/acceptance/bundle/resources/job_runs/on_file_change_include_sync_root/output.txt
new file mode 100644
index 00000000000..664e42bf0c0
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_include_sync_root/output.txt
@@ -0,0 +1,76 @@
+
+=== first deploy
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/job-runs-on-file-change-include-sync-root/default/files...
+Created jobs.my_job
+Output from job_runs.my_run: id=[MY_RUN_ID]: Run URL: [DATABRICKS_URL]/jobs/[MY_JOB_ID]/runs/[MY_RUN_ID]?o=[WORKSPACE_ID]
+Output from job_runs.my_run: id=[MY_RUN_ID]: SUCCESS
+Created job_runs.my_run
+Files: 5 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> file_triggers
+{
+  "bundle/resources/watched-resources.txt": "[FILE_HASH][0]",
+  "bundle/watched-bundle.txt": "[FILE_HASH][1]",
+  "shared.txt": "[FILE_HASH][2]"
+}
+
+=== editing the file next to the included YAML re-fires
+>>> changes
+{
+  "lifecycle.triggers_state.on_file_change['bundle/resources/watched-resources.txt']": {
+    "action": "recreate",
+    "reason": "immutable",
+    "old": "[FILE_HASH][0]",
+    "new": "[FILE_HASH][3]"
+  },
+  "result_state": {
+    "action": "skip",
+    "reason": "remote_already_set",
+    "new": "SUCCESS",
+    "remote": "SUCCESS"
+  }
+}
+
+=== editing the file at the bundle root re-fires
+>>> changes
+{
+  "lifecycle.triggers_state.on_file_change['bundle/watched-bundle.txt']": {
+    "action": "recreate",
+    "reason": "immutable",
+    "old": "[FILE_HASH][1]",
+    "new": "[FILE_HASH][4]"
+  },
+  "result_state": {
+    "action": "skip",
+    "reason": "remote_already_set",
+    "new": "SUCCESS",
+    "remote": "SUCCESS"
+  }
+}
+
+=== editing the file at the sync root re-fires
+>>> changes
+{
+  "lifecycle.triggers_state.on_file_change['shared.txt']": {
+    "action": "recreate",
+    "reason": "immutable",
+    "old": "[FILE_HASH][2]",
+    "new": "[FILE_HASH][5]"
+  },
+  "result_state": {
+    "action": "skip",
+    "reason": "remote_already_set",
+    "new": "SUCCESS",
+    "remote": "SUCCESS"
+  }
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.my_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/job-runs-on-file-change-include-sync-root/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_include_sync_root/script b/acceptance/bundle/resources/job_runs/on_file_change_include_sync_root/script
new file mode 100644
index 00000000000..2edf57688cd
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_include_sync_root/script
@@ -0,0 +1,33 @@
+cleanup() {
+    withdir bundle trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+changes() {
+    withdir bundle $CLI bundle plan -o json | jq '.plan["resources.job_runs.my_run"].changes'
+}
+
+file_triggers() {
+    withdir bundle print_state.py | jq '.state["resources.job_runs.my_run"].state.lifecycle.triggers_state.on_file_change'
+}
+
+title "first deploy"
+withdir bundle trace $CLI bundle deploy
+withdir bundle replace_ids.py
+trace file_triggers
+
+title "editing the file next to the included YAML re-fires"
+# printf keeps LF on Windows, where update_file.py's text-mode rewrite uses CRLF.
+printf 'include-v2\n' > bundle/resources/watched-resources.txt
+trace changes
+printf 'include-v1\n' > bundle/resources/watched-resources.txt
+
+title "editing the file at the bundle root re-fires"
+printf 'bundle-v2\n' > bundle/watched-bundle.txt
+trace changes
+printf 'bundle-v1\n' > bundle/watched-bundle.txt
+
+title "editing the file at the sync root re-fires"
+printf 'parent-v2\n' > shared.txt
+trace changes
+printf 'parent-v1\n' > shared.txt
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_include_sync_root/shared.txt b/acceptance/bundle/resources/job_runs/on_file_change_include_sync_root/shared.txt
new file mode 100644
index 00000000000..4ddcc71c374
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_include_sync_root/shared.txt
@@ -0,0 +1 @@
+parent-v1
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_include_sync_root/test.toml b/acceptance/bundle/resources/job_runs/on_file_change_include_sync_root/test.toml
new file mode 100644
index 00000000000..19affe700d6
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_include_sync_root/test.toml
@@ -0,0 +1,8 @@
+RecordRequests = false
+Ignore = [".databricks"]
+
+# Mask content hashes; Distinct keeps them distinguishable.
+[[Repls]]
+Old = '[0-9a-f]{64}'
+New = '[FILE_HASH]'
+Distinct = true
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_predeploy/databricks.yml b/acceptance/bundle/resources/job_runs/on_file_change_predeploy/databricks.yml
new file mode 100644
index 00000000000..ca80131494b
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_predeploy/databricks.yml
@@ -0,0 +1,22 @@
+bundle:
+  name: job-runs-on-file-change-predeploy
+
+experimental:
+  scripts:
+    predeploy: cp source.txt watched.txt
+
+resources:
+  jobs:
+    my_job:
+      name: my-job
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: /Workspace/test
+
+  job_runs:
+    my_run:
+      job_id: ${resources.jobs.my_job.id}
+      lifecycle:
+        triggers:
+          - on_file_change: watched.txt
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_predeploy/out.test.toml b/acceptance/bundle/resources/job_runs/on_file_change_predeploy/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_predeploy/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_predeploy/output.txt b/acceptance/bundle/resources/job_runs/on_file_change_predeploy/output.txt
new file mode 100644
index 00000000000..bbf77481367
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_predeploy/output.txt
@@ -0,0 +1,52 @@
+
+=== first deploy triggers a run
+>>> [CLI] bundle deploy
+Executing 'predeploy' script
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/job-runs-on-file-change-predeploy/default/files...
+Created jobs.my_job
+Output from job_runs.my_run: id=[MY_RUN_ID]: Run URL: [DATABRICKS_URL]/jobs/[MY_JOB_ID]/runs/[MY_RUN_ID]?o=[WORKSPACE_ID]
+Output from job_runs.my_run: id=[MY_RUN_ID]: SUCCESS
+Created job_runs.my_run
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> read_id.py my_job
+[MY_JOB_ID]
+
+>>> print_requests.py //jobs/run-now
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/run-now",
+  "body": {
+    "idempotency_token": "[UUID]",
+    "job_id": [MY_JOB_ID]
+  }
+}
+
+=== a predeploy file change re-fires in the same deploy
+>>> [CLI] bundle deploy
+Executing 'predeploy' script
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/job-runs-on-file-change-predeploy/default/files...
+Output from job_runs.my_run: id=[MY_RUN_ID_2]: Run URL: [DATABRICKS_URL]/jobs/[MY_JOB_ID]/runs/[MY_RUN_ID_2]?o=[WORKSPACE_ID]
+Output from job_runs.my_run: id=[MY_RUN_ID_2]: SUCCESS
+Recreated job_runs.my_run
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 1 unchanged
+
+>>> print_requests.py //jobs/run-now
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/run-now",
+  "body": {
+    "idempotency_token": "[UUID]",
+    "job_id": [MY_JOB_ID]
+  }
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.my_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/job-runs-on-file-change-predeploy/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_predeploy/script b/acceptance/bundle/resources/job_runs/on_file_change_predeploy/script
new file mode 100644
index 00000000000..6a816dbf0b0
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_predeploy/script
@@ -0,0 +1,18 @@
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+title "first deploy triggers a run"
+trace $CLI bundle deploy
+trace read_id.py my_job
+# Name the first run so the recreated one becomes [MY_RUN_ID_2].
+read_id.py my_run > /dev/null
+trace print_requests.py //jobs/run-now
+
+title "a predeploy file change re-fires in the same deploy"
+update_file.py source.txt "v1" "v2"
+trace $CLI bundle deploy
+read_id.py my_run > /dev/null
+trace print_requests.py //jobs/run-now
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_predeploy/source.txt b/acceptance/bundle/resources/job_runs/on_file_change_predeploy/source.txt
new file mode 100644
index 00000000000..626799f0f85
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_predeploy/source.txt
@@ -0,0 +1 @@
+v1
diff --git a/acceptance/bundle/resources/job_runs/on_file_change_predeploy/watched.txt b/acceptance/bundle/resources/job_runs/on_file_change_predeploy/watched.txt
new file mode 100644
index 00000000000..626799f0f85
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/on_file_change_predeploy/watched.txt
@@ -0,0 +1 @@
+v1
diff --git a/acceptance/bundle/resources/job_runs/redeploy/databricks.yml b/acceptance/bundle/resources/job_runs/redeploy/databricks.yml
new file mode 100644
index 00000000000..370829ce20c
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/redeploy/databricks.yml
@@ -0,0 +1,17 @@
+bundle:
+  name: job-runs-redeploy
+
+resources:
+  jobs:
+    my_job:
+      name: my-job
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: /Workspace/test
+
+  job_runs:
+    my_run:
+      job_id: ${resources.jobs.my_job.id}
+      job_parameters:
+        env: dev
diff --git a/acceptance/bundle/resources/job_runs/redeploy/out.test.toml b/acceptance/bundle/resources/job_runs/redeploy/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/redeploy/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/job_runs/redeploy/output.txt b/acceptance/bundle/resources/job_runs/redeploy/output.txt
new file mode 100644
index 00000000000..577db05fae9
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/redeploy/output.txt
@@ -0,0 +1,143 @@
+
+=== initial deploy triggers the first run
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/job-runs-redeploy/default/files...
+Created jobs.my_job
+Output from job_runs.my_run: id=[MY_RUN_ID]: Run URL: [DATABRICKS_URL]/jobs/[MY_JOB_ID]/runs/[MY_RUN_ID]?o=[WORKSPACE_ID]
+Output from job_runs.my_run: id=[MY_RUN_ID]: SUCCESS
+Created job_runs.my_run
+Files: 1 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] bundle summary
+Name: job-runs-redeploy
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/job-runs-redeploy/default
+Resources:
+  Job Runs:
+    my_run:
+      Name: 
+      URL:  [DATABRICKS_URL]/jobs/[MY_JOB_ID]/runs/[MY_RUN_ID]?w=[WORKSPACE_ID]
+  Jobs:
+    my_job:
+      Name: my-job
+      URL:  [DATABRICKS_URL]/jobs/[MY_JOB_ID]?w=[WORKSPACE_ID]
+
+>>> read_id.py my_job
+[MY_JOB_ID]
+
+>>> print_requests.py //jobs/run-now
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/run-now",
+  "body": {
+    "idempotency_token": "[UUID]",
+    "job_id": [MY_JOB_ID],
+    "job_parameters": {
+      "env": "dev"
+    }
+  }
+}
+
+=== change the run configuration and redeploy
+>>> update_file.py databricks.yml env: dev env: prod
+
+>>> [CLI] bundle plan -o json
+{
+  "depends_on": [
+    {
+      "node": "resources.jobs.my_job",
+      "label": "${resources.jobs.my_job.id}"
+    }
+  ],
+  "action": "recreate",
+  "new_state": {
+    "value": {
+      "job_id": [MY_JOB_ID],
+      "job_parameters": {
+        "env": "prod"
+      },
+      "result_state": "SUCCESS"
+    }
+  },
+  "remote_state": {
+    "job_id": [MY_JOB_ID],
+    "job_parameters": {
+      "env": "dev"
+    },
+    "result_state": "SUCCESS",
+    "run_id": [MY_RUN_ID],
+    "run_name": "my-job",
+    "run_page_url": "[DATABRICKS_URL]/jobs/[MY_JOB_ID]/runs/[MY_RUN_ID]?o=[WORKSPACE_ID]",
+    "run_type": "JOB_RUN",
+    "state": {
+      "life_cycle_state": "TERMINATED",
+      "result_state": "SUCCESS"
+    }
+  },
+  "changes": {
+    "job_parameters['env']": {
+      "action": "recreate",
+      "reason": "immutable",
+      "old": "dev",
+      "new": "prod",
+      "remote": "dev"
+    },
+    "result_state": {
+      "action": "skip",
+      "reason": "remote_already_set",
+      "new": "SUCCESS",
+      "remote": "SUCCESS"
+    }
+  }
+}
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/job-runs-redeploy/default/files...
+Output from job_runs.my_run: id=[MY_RUN_ID_2]: Run URL: [DATABRICKS_URL]/jobs/[MY_JOB_ID]/runs/[MY_RUN_ID_2]?o=[WORKSPACE_ID]
+Output from job_runs.my_run: id=[MY_RUN_ID_2]: SUCCESS
+Recreated job_runs.my_run
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 1 unchanged
+
+>>> [CLI] bundle summary
+Name: job-runs-redeploy
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/job-runs-redeploy/default
+Resources:
+  Job Runs:
+    my_run:
+      Name: 
+      URL:  [DATABRICKS_URL]/jobs/[MY_JOB_ID]/runs/[MY_RUN_ID_2]?w=[WORKSPACE_ID]
+  Jobs:
+    my_job:
+      Name: my-job
+      URL:  [DATABRICKS_URL]/jobs/[MY_JOB_ID]?w=[WORKSPACE_ID]
+
+=== the config change triggered a second, different run and left the previous one alone
+>>> print_requests.py --keep //jobs/runs/delete
+
+>>> print_requests.py //jobs/run-now
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/run-now",
+  "body": {
+    "idempotency_token": "[UUID]",
+    "job_id": [MY_JOB_ID],
+    "job_parameters": {
+      "env": "prod"
+    }
+  }
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.my_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/job-runs-redeploy/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/job_runs/redeploy/script b/acceptance/bundle/resources/job_runs/redeploy/script
new file mode 100644
index 00000000000..fd1c3e5dc92
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/redeploy/script
@@ -0,0 +1,28 @@
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+title "initial deploy triggers the first run"
+trace $CLI bundle deploy
+trace $CLI bundle summary
+trace read_id.py my_job
+
+# Name the first run, so the second one below reads as [MY_RUN_ID_2] and the two
+# are told apart in the URLs and the run-now requests.
+read_id.py my_run > /dev/null
+
+trace print_requests.py //jobs/run-now
+
+title "change the run configuration and redeploy"
+trace update_file.py databricks.yml "env: dev" "env: prod"
+trace $CLI bundle plan -o json | nostamp | jq '.plan["resources.job_runs.my_run"]'
+trace $CLI bundle deploy
+read_id.py my_run > /dev/null
+trace $CLI bundle summary
+
+title "the config change triggered a second, different run and left the previous one alone"
+# The previous run is a historical record, so no jobs/runs/delete is issued.
+trace print_requests.py --keep //jobs/runs/delete
+trace print_requests.py //jobs/run-now
diff --git a/acceptance/bundle/resources/job_runs/retried_run_now/databricks.yml b/acceptance/bundle/resources/job_runs/retried_run_now/databricks.yml
new file mode 100644
index 00000000000..639983dce68
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/retried_run_now/databricks.yml
@@ -0,0 +1,15 @@
+bundle:
+  name: job-runs-retried-run-now
+
+resources:
+  jobs:
+    my_job:
+      name: my-job
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: /Workspace/test
+
+  job_runs:
+    my_run:
+      job_id: ${resources.jobs.my_job.id}
diff --git a/acceptance/bundle/resources/job_runs/retried_run_now/out.test.toml b/acceptance/bundle/resources/job_runs/retried_run_now/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/retried_run_now/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/job_runs/retried_run_now/output.txt b/acceptance/bundle/resources/job_runs/retried_run_now/output.txt
new file mode 100644
index 00000000000..bf30c0cb2c0
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/retried_run_now/output.txt
@@ -0,0 +1,47 @@
+
+=== the deploy succeeds, though its run-now was answered with a 503
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/job-runs-retried-run-now/default/files...
+Created jobs.my_job
+Output from job_runs.my_run: id=[MY_RUN_ID]: Run URL: [DATABRICKS_URL]/jobs/[MY_JOB_ID]/runs/[MY_RUN_ID]?o=[WORKSPACE_ID]
+Output from job_runs.my_run: id=[MY_RUN_ID]: SUCCESS
+Created job_runs.my_run
+Files: 1 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+=== run-now was sent twice, both times with the same token
+>>> read_id.py my_job
+[MY_JOB_ID]
+
+>>> print_requests.py //jobs/run-now
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/run-now",
+  "body": {
+    "idempotency_token": "[IDEMPOTENCY_TOKEN][0]",
+    "job_id": [MY_JOB_ID]
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/run-now",
+  "body": {
+    "idempotency_token": "[IDEMPOTENCY_TOKEN][0]",
+    "job_id": [MY_JOB_ID]
+  }
+}
+
+=== the second request was answered with the run the first one started
+>>> read_id.py my_run
+[MY_RUN_ID]
+
+>>> [CLI] jobs list-runs -o json
+1
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.my_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/job-runs-retried-run-now/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/job_runs/retried_run_now/script b/acceptance/bundle/resources/job_runs/retried_run_now/script
new file mode 100644
index 00000000000..9e258912528
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/retried_run_now/script
@@ -0,0 +1,20 @@
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+# Keep the run the handler started, replace only the response with a 503. The SDK
+# retries that status, so run-now is sent again while the first run already exists.
+fault.py --after-handler "POST /api/2.2/jobs/run-now" 503 0 1
+
+title "the deploy succeeds, though its run-now was answered with a 503"
+trace $CLI bundle deploy
+
+title "run-now was sent twice, both times with the same token"
+trace read_id.py my_job
+trace print_requests.py //jobs/run-now
+
+title "the second request was answered with the run the first one started"
+trace read_id.py my_run
+trace $CLI jobs list-runs -o json | jq length
diff --git a/acceptance/bundle/resources/job_runs/retried_run_now/test.toml b/acceptance/bundle/resources/job_runs/retried_run_now/test.toml
new file mode 100644
index 00000000000..fce68392ea1
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/retried_run_now/test.toml
@@ -0,0 +1,10 @@
+# Local only: the lost response is staged by injecting a fault into the testserver.
+Ignore = [".databricks"]
+
+# Number each distinct token so a reused token shows as [0] on both requests.
+# Leave the closing quote out of Old/New so Distinct's [0] lands inside the string.
+[[Repls]]
+Old = '"idempotency_token": "[0-9a-f-]{36}'
+New = '"idempotency_token": "[IDEMPOTENCY_TOKEN]'
+Distinct = true
+Order = -1
diff --git a/acceptance/bundle/resources/job_runs/wait/databricks.yml.tmpl b/acceptance/bundle/resources/job_runs/wait/databricks.yml.tmpl
new file mode 100644
index 00000000000..6d1f58cea51
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/wait/databricks.yml.tmpl
@@ -0,0 +1,49 @@
+bundle:
+  name: job-runs-wait
+
+workspace:
+  root_path: ~/.bundle/$UNIQUE_NAME
+
+resources:
+  jobs:
+    my_job:
+      name: test-job-$UNIQUE_NAME
+      parameters:
+        - name: env
+          default: dev
+        - name: region
+          default: us
+      tasks:
+        # Serverless keeps the run to about a minute.
+        - task_key: main
+          spark_python_task:
+            python_file: ./hello.py
+          environment_key: default
+
+      environments:
+        - environment_key: default
+          spec:
+            environment_version: "2"
+
+    # Reads the run's outcome, so its tag shows the deploy waited for the run
+    # before creating what depends on it. Separate from my_job, which my_run
+    # already depends on, to avoid a cycle.
+    downstream_job:
+      name: test-downstream-job-$UNIQUE_NAME
+      tags:
+        run_result: ${resources.job_runs.my_run.state.result_state}
+      tasks:
+        - task_key: main
+          condition_task:
+            op: EQUAL_TO
+            left: "1"
+            right: "1"
+
+  job_runs:
+    my_run:
+      job_id: ${resources.jobs.my_job.id}
+      # Override one of the job's two parameters: a real GetRun reports the full
+      # resolved set, including the region default, which ignore_remote_changes
+      # has to absorb.
+      job_parameters:
+        env: prod
diff --git a/acceptance/bundle/resources/job_runs/wait/hello.py b/acceptance/bundle/resources/job_runs/wait/hello.py
new file mode 100644
index 00000000000..93e0cef4a92
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/wait/hello.py
@@ -0,0 +1 @@
+print("hello from a job_run")
diff --git a/acceptance/bundle/resources/job_runs/wait/out.test.toml b/acceptance/bundle/resources/job_runs/wait/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/wait/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/job_runs/wait/output.txt b/acceptance/bundle/resources/job_runs/wait/output.txt
new file mode 100644
index 00000000000..0d7596a9462
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/wait/output.txt
@@ -0,0 +1,38 @@
+
+=== the deploy waits for the run to finish
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Created jobs.my_job
+Output from job_runs.my_run: id=[MY_RUN_ID]: Run URL: [RUN_URL]
+Output from job_runs.my_run: id=[MY_RUN_ID]: SUCCESS
+Created job_runs.my_run
+Created jobs.downstream_job
+Files: 3 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> read_id.py my_run
+[MY_RUN_ID]
+
+=== the downstream job was created with the run's result_state
+>>> [CLI] jobs get [DOWNSTREAM_JOB_ID] -o json
+SUCCESS
+
+=== nothing the run resolved is drift, so a redeploy starts no new run
+>>> [CLI] bundle plan -o json
+resources.job_runs.my_run skip
+resources.jobs.downstream_job skip
+resources.jobs.my_job skip
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 3 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.downstream_job
+  delete resources.jobs.my_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/job_runs/wait/script b/acceptance/bundle/resources/job_runs/wait/script
new file mode 100644
index 00000000000..79e9547c67b
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/wait/script
@@ -0,0 +1,19 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+title "the deploy waits for the run to finish"
+trace $CLI bundle deploy
+
+trace read_id.py my_run
+
+title "the downstream job was created with the run's result_state"
+downstream_id=$(read_id.py downstream_job)
+trace $CLI jobs get $downstream_id -o json | jq -r ".settings.tags.run_result"
+
+title "nothing the run resolved is drift, so a redeploy starts no new run"
+trace $CLI bundle plan -o json | nostamp | jq -r '.plan | to_entries[] | "\(.key) \(.value.action)"'
+trace $CLI bundle deploy
diff --git a/acceptance/bundle/resources/job_runs/wait/test.toml b/acceptance/bundle/resources/job_runs/wait/test.toml
new file mode 100644
index 00000000000..033fa9422b7
--- /dev/null
+++ b/acceptance/bundle/resources/job_runs/wait/test.toml
@@ -0,0 +1,15 @@
+# Runs the job for real on cloud. Serverless needs Unity Catalog.
+Cloud = true
+
+# The wait polls GetRun until the run is terminal, so the recorded requests
+# depend on how long the run takes.
+RecordRequests = false
+
+# databricks.yml is rendered by the script.
+Ignore = ["databricks.yml"]
+
+# The host and the workspace selector in the run URL differ per workspace; the URL
+# form itself is covered by libs/workspaceurls.
+[[Repls]]
+Old = 'Run URL: .*'
+New = 'Run URL: [RUN_URL]'
diff --git a/acceptance/bundle/resources/jobs/alert-task/out.test.toml b/acceptance/bundle/resources/jobs/alert-task/out.test.toml
index bbc7fcfd1bd..0f167effef1 100644
--- a/acceptance/bundle/resources/jobs/alert-task/out.test.toml
+++ b/acceptance/bundle/resources/jobs/alert-task/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/jobs/alert-task/output.txt b/acceptance/bundle/resources/jobs/alert-task/output.txt
index 569e0f98454..51c09db149d 100644
--- a/acceptance/bundle/resources/jobs/alert-task/output.txt
+++ b/acceptance/bundle/resources/jobs/alert-task/output.txt
@@ -1,9 +1,9 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/alert-task-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.my_job
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] jobs get [JOB_ID]
 {
@@ -17,5 +17,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/alert-task-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/jobs/alert-task/script b/acceptance/bundle/resources/jobs/alert-task/script
index f2d3d0fc9b2..1dcc1d37a0b 100644
--- a/acceptance/bundle/resources/jobs/alert-task/script
+++ b/acceptance/bundle/resources/jobs/alert-task/script
@@ -8,6 +8,6 @@ trap cleanup EXIT
 trace $CLI bundle deploy
 
 job_id=$($CLI bundle summary -o json | jq -r '.resources.jobs.my_job.id')
-echo "$job_id:JOB_ID" >> ACC_REPLS
+add_repl "$job_id" JOB_ID
 
 trace $CLI jobs get $job_id | jq '.settings.tasks[0].alert_task'
diff --git a/acceptance/bundle/resources/jobs/alert-task/test.toml b/acceptance/bundle/resources/jobs/alert-task/test.toml
index 838184afdd9..bcda26ceff6 100644
--- a/acceptance/bundle/resources/jobs/alert-task/test.toml
+++ b/acceptance/bundle/resources/jobs/alert-task/test.toml
@@ -1,7 +1,5 @@
-Local = true
 Cloud = true
 RecordRequests = false
 Ignore = ["databricks.yml", ".databricks"]
 
-[Env]
-MSYS_NO_PATHCONV = "1"
+Env.MSYS_NO_PATHCONV = "1"
diff --git a/acceptance/bundle/resources/jobs/big_id/out.plan.direct.json b/acceptance/bundle/resources/jobs/big_id/out.plan.direct.json
deleted file mode 100644
index 607ce2449cb..00000000000
--- a/acceptance/bundle/resources/jobs/big_id/out.plan.direct.json
+++ /dev/null
@@ -1,56 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.foo": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "Untitled",
-          "queue": {
-            "enabled": true
-          },
-          "tasks": [
-            {
-              "run_job_task": {
-                "job_id": [MAX_INT_64]
-              },
-              "task_key": "max(int64)"
-            },
-            {
-              "run_job_task": {
-                "job_id": [MAX_INT_64_MINUS_1]
-              },
-              "task_key": "max(int64) - 1"
-            },
-            {
-              "run_job_task": {
-                "job_id": [MAX_INT_64_MINUS_2]
-              },
-              "task_key": "max(int64) - 2"
-            },
-            {
-              "run_job_task": {
-                "job_id": [MIN_INT_64]
-              },
-              "task_key": "min(int64)"
-            },
-            {
-              "run_job_task": {
-                "job_id": [MIN_INT_64_MINUS_4]
-              },
-              "task_key": "min(int64) - 4"
-            }
-          ]
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/jobs/big_id/out.plan.json b/acceptance/bundle/resources/jobs/big_id/out.plan.json
new file mode 100644
index 00000000000..02ed51bb618
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/big_id/out.plan.json
@@ -0,0 +1,56 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.jobs.foo": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "Untitled",
+          "queue": {
+            "enabled": true
+          },
+          "tasks": [
+            {
+              "run_job_task": {
+                "job_id": [MAX_INT_64]
+              },
+              "task_key": "max(int64)"
+            },
+            {
+              "run_job_task": {
+                "job_id": [MAX_INT_64_MINUS_1]
+              },
+              "task_key": "max(int64) - 1"
+            },
+            {
+              "run_job_task": {
+                "job_id": [MAX_INT_64_MINUS_2]
+              },
+              "task_key": "max(int64) - 2"
+            },
+            {
+              "run_job_task": {
+                "job_id": [MIN_INT_64]
+              },
+              "task_key": "min(int64)"
+            },
+            {
+              "run_job_task": {
+                "job_id": [MIN_INT_64_MINUS_4]
+              },
+              "task_key": "min(int64) - 4"
+            }
+          ]
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/jobs/big_id/out.state.direct.json b/acceptance/bundle/resources/jobs/big_id/out.state.direct.json
deleted file mode 100644
index f8cf0ce5bf2..00000000000
--- a/acceptance/bundle/resources/jobs/big_id/out.state.direct.json
+++ /dev/null
@@ -1,56 +0,0 @@
-{
- "state_version": 2,
- "cli_version": "[DEV_VERSION]",
- "lineage": "[UUID]",
- "serial": 1,
- "state": {
-  "resources.jobs.foo": {
-   "__id__": "[NUMID]",
-   "state": {
-    "deployment": {
-     "kind": "BUNDLE",
-     "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-    },
-    "edit_mode": "UI_LOCKED",
-    "format": "MULTI_TASK",
-    "max_concurrent_runs": 1,
-    "name": "Untitled",
-    "queue": {
-     "enabled": true
-    },
-    "tasks": [
-     {
-      "run_job_task": {
-       "job_id": [MAX_INT_64]
-      },
-      "task_key": "max(int64)"
-     },
-     {
-      "run_job_task": {
-       "job_id": [MAX_INT_64_MINUS_1]
-      },
-      "task_key": "max(int64) - 1"
-     },
-     {
-      "run_job_task": {
-       "job_id": [MAX_INT_64_MINUS_2]
-      },
-      "task_key": "max(int64) - 2"
-     },
-     {
-      "run_job_task": {
-       "job_id": [MIN_INT_64]
-      },
-      "task_key": "min(int64)"
-     },
-     {
-      "run_job_task": {
-       "job_id": [MIN_INT_64_MINUS_4]
-      },
-      "task_key": "min(int64) - 4"
-     }
-    ]
-   }
-  }
- }
-}
diff --git a/acceptance/bundle/resources/jobs/big_id/out.state.json b/acceptance/bundle/resources/jobs/big_id/out.state.json
new file mode 100644
index 00000000000..b000f4ee5df
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/big_id/out.state.json
@@ -0,0 +1,56 @@
+{
+ "state_version": 3,
+ "cli_version": "[CLI_VERSION]",
+ "lineage": "[UUID]",
+ "serial": 1,
+ "state": {
+  "resources.jobs.foo": {
+   "__id__": "[FOO_ID]",
+   "state": {
+    "deployment": {
+     "kind": "BUNDLE",
+     "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+    },
+    "edit_mode": "UI_LOCKED",
+    "format": "MULTI_TASK",
+    "max_concurrent_runs": 1,
+    "name": "Untitled",
+    "queue": {
+     "enabled": true
+    },
+    "tasks": [
+     {
+      "run_job_task": {
+       "job_id": [MAX_INT_64]
+      },
+      "task_key": "max(int64)"
+     },
+     {
+      "run_job_task": {
+       "job_id": [MAX_INT_64_MINUS_1]
+      },
+      "task_key": "max(int64) - 1"
+     },
+     {
+      "run_job_task": {
+       "job_id": [MAX_INT_64_MINUS_2]
+      },
+      "task_key": "max(int64) - 2"
+     },
+     {
+      "run_job_task": {
+       "job_id": [MIN_INT_64]
+      },
+      "task_key": "min(int64)"
+     },
+     {
+      "run_job_task": {
+       "job_id": [MIN_INT_64_MINUS_4]
+      },
+      "task_key": "min(int64) - 4"
+     }
+    ]
+   }
+  }
+ }
+}
diff --git a/acceptance/bundle/resources/jobs/big_id/out.test.toml b/acceptance/bundle/resources/jobs/big_id/out.test.toml
index 71970b719d4..f7fafbcc731 100644
--- a/acceptance/bundle/resources/jobs/big_id/out.test.toml
+++ b/acceptance/bundle/resources/jobs/big_id/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
 EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/resources/jobs/big_id/output.txt b/acceptance/bundle/resources/jobs/big_id/output.txt
index 82ec469ca83..f14ccc9e22e 100644
--- a/acceptance/bundle/resources/jobs/big_id/output.txt
+++ b/acceptance/bundle/resources/jobs/big_id/output.txt
@@ -3,11 +3,11 @@
 
 >>> [CLI] bundle plan -o json
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.foo
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
->>> print_requests.py //jobs
+>>> print_requests.py //jobs --nostamp
 {
   "method": "POST",
   "path": "/api/2.2/jobs/create",
@@ -67,14 +67,13 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
 
->>> print_requests.py //jobs
+>>> print_requests.py //jobs --nostamp
 {
   "method": "POST",
   "path": "/api/2.2/jobs/delete",
   "body": {
-    "job_id": [NUMID]
+    "job_id": [FOO_ID]
   }
 }
diff --git a/acceptance/bundle/resources/jobs/big_id/script b/acceptance/bundle/resources/jobs/big_id/script
index 0b803cb1b8d..7463d436c45 100644
--- a/acceptance/bundle/resources/jobs/big_id/script
+++ b/acceptance/bundle/resources/jobs/big_id/script
@@ -1,8 +1,12 @@
+mkdir -p .databricks
+
 trace $CLI bundle validate -o json | jq .resources > out.validate.json
-trace $CLI bundle plan -o json > out.plan.$DATABRICKS_BUNDLE_ENGINE.json
-$CLI bundle deploy $(readplanarg out.plan.direct.json)
-trace print_requests.py //jobs
-print_state.py > out.state.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json > .databricks/tmp.plan.json
+nostamp < .databricks/tmp.plan.json > out.plan.json
+$CLI bundle deploy $(readplanarg .databricks/tmp.plan.json)
+replace_ids.py
+trace print_requests.py //jobs --nostamp
+print_state.py > out.state.json
 trace $CLI bundle plan | contains.py '0 to add, 0 to change, 0 to delete'
 trace $CLI bundle destroy --auto-approve
-trace print_requests.py //jobs
+trace print_requests.py //jobs --nostamp
diff --git a/acceptance/bundle/resources/jobs/big_id/test.toml b/acceptance/bundle/resources/jobs/big_id/test.toml
index 6dd4efd85d3..db52e480235 100644
--- a/acceptance/bundle/resources/jobs/big_id/test.toml
+++ b/acceptance/bundle/resources/jobs/big_id/test.toml
@@ -1,6 +1,5 @@
 # terraform fails with:
 #   panic: Error reading level state: strconv.ParseInt: parsing "[NUMID]": value out of range
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ['direct']
 EnvMatrix.READPLAN = ["", "1"]
 
 [[Repls]]
diff --git a/acceptance/bundle/resources/jobs/check-metadata/out.test.toml b/acceptance/bundle/resources/jobs/check-metadata/out.test.toml
index 650836edeb3..0f167effef1 100644
--- a/acceptance/bundle/resources/jobs/check-metadata/out.test.toml
+++ b/acceptance/bundle/resources/jobs/check-metadata/out.test.toml
@@ -1,3 +1,2 @@
-Local = false
 Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/jobs/check-metadata/output.txt b/acceptance/bundle/resources/jobs/check-metadata/output.txt
index c73e8e6f326..fd85689b6ef 100644
--- a/acceptance/bundle/resources/jobs/check-metadata/output.txt
+++ b/acceptance/bundle/resources/jobs/check-metadata/output.txt
@@ -8,9 +8,10 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.bar
+Created jobs.foo
+Files: 6 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 === Second summary, should have id and modified status should be absent
 >>> [CLI] bundle summary -o json
@@ -91,5 +92,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/jobs/check-metadata/script b/acceptance/bundle/resources/jobs/check-metadata/script
index 0445fa0bf84..a486009c74c 100644
--- a/acceptance/bundle/resources/jobs/check-metadata/script
+++ b/acceptance/bundle/resources/jobs/check-metadata/script
@@ -14,14 +14,14 @@ title "Second summary, should have id and modified status should be absent"
 trace $CLI bundle summary -o json | jq '.resources.jobs.foo | {id, modified_status}' > out.summary.json
 trace cat out.summary.json
 JOB_1_ID=$(jq -r '.id' out.summary.json)
-echo "$JOB_1_ID:JOB_1_ID" >> ACC_REPLS
+add_repl "$JOB_1_ID" JOB_1_ID
 rm out.summary.json
 title "Assert job 1 is created\n"
 $CLI jobs get "${JOB_1_ID}" | jq '{name: .settings.name}'
 
 title "Assert job 2 is created\n"
 JOB_2_ID=$($CLI bundle summary -o json | jq -r '.resources.jobs.bar.id')
-echo "$JOB_2_ID:JOB_2_ID" >> ACC_REPLS
+add_repl "$JOB_2_ID" JOB_2_ID
 $CLI jobs get "${JOB_2_ID}" | jq '{name: .settings.name}'
 
 title "Read metadata object from the workspace"
diff --git a/acceptance/bundle/resources/jobs/check-metadata/test.toml b/acceptance/bundle/resources/jobs/check-metadata/test.toml
index 8ba61c13225..e4db39ccc44 100644
--- a/acceptance/bundle/resources/jobs/check-metadata/test.toml
+++ b/acceptance/bundle/resources/jobs/check-metadata/test.toml
@@ -1,21 +1,20 @@
-Local = false
 Cloud = true
 RecordRequests = false
 
 Ignore = [
+    ".databricks",
     "databricks.yml",
     "a/b/resources.yml",
     "metadata.json",
 ]
 
-[Env]
 # MSYS2 automatically converts absolute paths like /Users/$username/$UNIQUE_NAME to
 # C:/Program Files/Git/Users/$username/UNIQUE_NAME before passing it to the CLI
 # Setting this environment variable prevents that conversion on windows.
-MSYS_NO_PATHCONV = "1"
+Env.MSYS_NO_PATHCONV = "1"
 
 [[Repls]]
-# clean up ?o=<num> suffix after URL since not all workspaces have that
-Old = '\?o=\[NUMID\]'
+# clean up ?[ow]=<num> suffix after URL since not all workspaces have that
+Old = '\?[ow]=\[WORKSPACE_ID\]'
 New = ''
 Order = 1000
diff --git a/acceptance/bundle/resources/jobs/cluster_policy/config_conflicts_policy/databricks.yml.tmpl b/acceptance/bundle/resources/jobs/cluster_policy/config_conflicts_policy/databricks.yml.tmpl
new file mode 100644
index 00000000000..fc16656ff3e
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/cluster_policy/config_conflicts_policy/databricks.yml.tmpl
@@ -0,0 +1,33 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+workspace:
+  root_path: ~/.bundle/$UNIQUE_NAME
+
+resources:
+  cluster_policies:
+    my_policy:
+      name: test-policy-$UNIQUE_NAME
+      definition:
+        custom_tags.CostCenter:
+          type: fixed
+          value: from-policy
+
+  jobs:
+    my_job:
+      name: test-job-$UNIQUE_NAME
+      job_clusters:
+        # The config sets the fixed attribute to a value the policy forbids.
+        - job_cluster_key: main
+          new_cluster:
+            policy_id: ${resources.cluster_policies.my_policy.id}
+            spark_version: $DEFAULT_SPARK_VERSION
+            node_type_id: $NODE_TYPE_ID
+            num_workers: 1
+            custom_tags:
+              CostCenter: not-what-the-policy-says
+      tasks:
+        - task_key: main
+          job_cluster_key: main
+          spark_python_task:
+            python_file: ./hello_world.py
diff --git a/acceptance/bundle/resources/jobs/cluster_policy/config_conflicts_policy/hello_world.py b/acceptance/bundle/resources/jobs/cluster_policy/config_conflicts_policy/hello_world.py
new file mode 100644
index 00000000000..11b15b1a458
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/cluster_policy/config_conflicts_policy/hello_world.py
@@ -0,0 +1 @@
+print("hello")
diff --git a/acceptance/bundle/resources/jobs/cluster_policy/config_conflicts_policy/out.test.toml b/acceptance/bundle/resources/jobs/cluster_policy/config_conflicts_policy/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/cluster_policy/config_conflicts_policy/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/jobs/cluster_policy/config_conflicts_policy/output.txt b/acceptance/bundle/resources/jobs/cluster_policy/config_conflicts_policy/output.txt
new file mode 100644
index 00000000000..b28170e7362
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/cluster_policy/config_conflicts_policy/output.txt
@@ -0,0 +1,22 @@
+
+=== A cluster tag contradicting a fixed policy value is rejected at create
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Created cluster_policies.my_policy
+Error: cannot create resources.jobs.my_job: Cluster validation error: Validation failed for custom_tags, CostCenter must be from-policy (is "not-what-the-policy-says") (400 INVALID_PARAMETER_VALUE)
+
+Endpoint: POST [DATABRICKS_URL]/api/2.2/jobs/create
+HTTP Status: 400 Bad Request
+API error_code: INVALID_PARAMETER_VALUE
+API message: Cluster validation error: Validation failed for custom_tags, CostCenter must be from-policy (is "not-what-the-policy-says")
+
+Files: 3 uploaded, 0 deleted
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.cluster_policies.my_policy
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/jobs/cluster_policy/config_conflicts_policy/script b/acceptance/bundle/resources/jobs/cluster_policy/config_conflicts_policy/script
new file mode 100644
index 00000000000..b8cb4a39cbf
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/cluster_policy/config_conflicts_policy/script
@@ -0,0 +1,9 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+title "A cluster tag contradicting a fixed policy value is rejected at create\n"
+musterr trace $CLI bundle deploy
diff --git a/acceptance/bundle/resources/jobs/cluster_policy/default_flag/databricks.yml.tmpl b/acceptance/bundle/resources/jobs/cluster_policy/default_flag/databricks.yml.tmpl
new file mode 100644
index 00000000000..c358664437f
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/cluster_policy/default_flag/databricks.yml.tmpl
@@ -0,0 +1,40 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+workspace:
+  root_path: ~/.bundle/$UNIQUE_NAME
+
+resources:
+  cluster_policies:
+    my_policy:
+      name: test-policy-$UNIQUE_NAME
+      definition:
+        # A defaultValue element: the backend fills it into an omitted attribute only when
+        # the request sets apply_policy_default_values (unlike a fixed element).
+        custom_tags.DefaultTag:
+          type: unlimited
+          defaultValue: from-default
+          isOptional: true
+
+  jobs:
+    my_job:
+      name: test-job-$UNIQUE_NAME
+      job_clusters:
+        - job_cluster_key: flag_off
+          new_cluster:
+            policy_id: ${resources.cluster_policies.my_policy.id}
+            spark_version: $DEFAULT_SPARK_VERSION
+            node_type_id: $NODE_TYPE_ID
+            num_workers: 1
+        - job_cluster_key: flag_on
+          new_cluster:
+            policy_id: ${resources.cluster_policies.my_policy.id}
+            apply_policy_default_values: true
+            spark_version: $DEFAULT_SPARK_VERSION
+            node_type_id: $NODE_TYPE_ID
+            num_workers: 1
+      tasks:
+        - task_key: main
+          job_cluster_key: flag_off
+          spark_python_task:
+            python_file: ./hello_world.py
diff --git a/acceptance/bundle/resources/jobs/cluster_policy/default_flag/hello_world.py b/acceptance/bundle/resources/jobs/cluster_policy/default_flag/hello_world.py
new file mode 100644
index 00000000000..11b15b1a458
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/cluster_policy/default_flag/hello_world.py
@@ -0,0 +1 @@
+print("hello")
diff --git a/acceptance/bundle/resources/jobs/cluster_policy/default_flag/out.test.toml b/acceptance/bundle/resources/jobs/cluster_policy/default_flag/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/cluster_policy/default_flag/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/jobs/cluster_policy/default_flag/output.txt b/acceptance/bundle/resources/jobs/cluster_policy/default_flag/output.txt
new file mode 100644
index 00000000000..0b92fbd4538
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/cluster_policy/default_flag/output.txt
@@ -0,0 +1,35 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Created cluster_policies.my_policy
+Created jobs.my_job
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+=== defaultValue is supplied only with apply_policy_default_values (flag_on), not flag_off
+[
+  {
+    "custom_tags": null,
+    "job_cluster_key": "flag_off"
+  },
+  {
+    "custom_tags": {
+      "DefaultTag": "from-default"
+    },
+    "job_cluster_key": "flag_on"
+  }
+]
+
+=== Neither is drift on a second plan
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.cluster_policies.my_policy
+  delete resources.jobs.my_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/jobs/cluster_policy/default_flag/script b/acceptance/bundle/resources/jobs/cluster_policy/default_flag/script
new file mode 100644
index 00000000000..f359b41276d
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/cluster_policy/default_flag/script
@@ -0,0 +1,16 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+trace $CLI bundle deploy
+job_id=$(read_id.py my_job)
+
+title "defaultValue is supplied only with apply_policy_default_values (flag_on), not flag_off\n"
+$CLI jobs get "$job_id" | jq -S '[.settings.job_clusters[]
+  | {job_cluster_key, custom_tags: .new_cluster.custom_tags}]'
+
+title "Neither is drift on a second plan\n"
+trace $CLI bundle plan
diff --git a/acceptance/bundle/resources/jobs/cluster_policy/fixed_addition/databricks.yml.tmpl b/acceptance/bundle/resources/jobs/cluster_policy/fixed_addition/databricks.yml.tmpl
new file mode 100644
index 00000000000..63ae19cddc1
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/cluster_policy/fixed_addition/databricks.yml.tmpl
@@ -0,0 +1,52 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+workspace:
+  root_path: ~/.bundle/$UNIQUE_NAME
+
+resources:
+  cluster_policies:
+    my_policy:
+      name: test-policy-$UNIQUE_NAME
+      definition:
+        # A fixed scalar and a fixed map key; every cluster below omits both, so the policy is
+        # the sole source and each supplied value must be classified remote_addition.
+        spark_version:
+          type: fixed
+          value: $DEFAULT_SPARK_VERSION
+        custom_tags.CostCenter:
+          type: fixed
+          value: from-policy
+
+  jobs:
+    my_job:
+      name: test-job-$UNIQUE_NAME
+      job_clusters:
+        - job_cluster_key: job_cluster
+          new_cluster:
+            policy_id: ${resources.cluster_policies.my_policy.id}
+            node_type_id: $NODE_TYPE_ID
+            num_workers: 1
+      tasks:
+        - task_key: on_job_cluster
+          job_cluster_key: job_cluster
+          spark_python_task:
+            python_file: ./hello_world.py
+        - task_key: task_cluster
+          new_cluster:
+            policy_id: ${resources.cluster_policies.my_policy.id}
+            node_type_id: $NODE_TYPE_ID
+            num_workers: 1
+          spark_python_task:
+            python_file: ./hello_world.py
+        - task_key: for_each
+          for_each_task:
+            inputs: "[1]"
+            task:
+              task_key: for_each_cluster
+              new_cluster:
+                policy_id: ${resources.cluster_policies.my_policy.id}
+                node_type_id: $NODE_TYPE_ID
+                num_workers: 1
+              spark_python_task:
+                python_file: ./hello_world.py
diff --git a/acceptance/bundle/resources/jobs/cluster_policy/fixed_addition/hello_world.py b/acceptance/bundle/resources/jobs/cluster_policy/fixed_addition/hello_world.py
new file mode 100644
index 00000000000..11b15b1a458
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/cluster_policy/fixed_addition/hello_world.py
@@ -0,0 +1 @@
+print("hello")
diff --git a/acceptance/bundle/resources/jobs/cluster_policy/fixed_addition/out.test.toml b/acceptance/bundle/resources/jobs/cluster_policy/fixed_addition/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/cluster_policy/fixed_addition/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/jobs/cluster_policy/fixed_addition/output.txt b/acceptance/bundle/resources/jobs/cluster_policy/fixed_addition/output.txt
new file mode 100644
index 00000000000..6aca041061f
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/cluster_policy/fixed_addition/output.txt
@@ -0,0 +1,63 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Created cluster_policies.my_policy
+Created jobs.my_job
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Policy-supplied spark_version and custom_tags are not drift at any cluster-spec location
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
+
+=== Each is classified remote_addition
+
+>>> [CLI] bundle plan -o json
+{
+  "job_clusters[job_cluster_key='job_cluster'].new_cluster.custom_tags": {
+    "action": "skip",
+    "reason": "remote_addition",
+    "remote": {
+      "CostCenter": "from-policy"
+    }
+  },
+  "job_clusters[job_cluster_key='job_cluster'].new_cluster.spark_version": {
+    "action": "skip",
+    "reason": "remote_addition",
+    "remote": "13.3.x-snapshot-scala2.12"
+  },
+  "tasks[task_key='for_each'].for_each_task.task.new_cluster.custom_tags": {
+    "action": "skip",
+    "reason": "remote_addition",
+    "remote": {
+      "CostCenter": "from-policy"
+    }
+  },
+  "tasks[task_key='for_each'].for_each_task.task.new_cluster.spark_version": {
+    "action": "skip",
+    "reason": "remote_addition",
+    "remote": "13.3.x-snapshot-scala2.12"
+  },
+  "tasks[task_key='task_cluster'].new_cluster.custom_tags": {
+    "action": "skip",
+    "reason": "remote_addition",
+    "remote": {
+      "CostCenter": "from-policy"
+    }
+  },
+  "tasks[task_key='task_cluster'].new_cluster.spark_version": {
+    "action": "skip",
+    "reason": "remote_addition",
+    "remote": "13.3.x-snapshot-scala2.12"
+  }
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.cluster_policies.my_policy
+  delete resources.jobs.my_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/jobs/cluster_policy/fixed_addition/script b/acceptance/bundle/resources/jobs/cluster_policy/fixed_addition/script
new file mode 100644
index 00000000000..3c6c5f02c10
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/cluster_policy/fixed_addition/script
@@ -0,0 +1,15 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+trace $CLI bundle deploy
+
+title "Policy-supplied spark_version and custom_tags are not drift at any cluster-spec location\n"
+trace $CLI bundle plan
+
+title "Each is classified remote_addition\n"
+trace $CLI bundle plan -o json | jq -S '.plan["resources.jobs.my_job"].changes
+  | with_entries(select(.key | test("custom_tags|spark_version")))'
diff --git a/acceptance/bundle/resources/jobs/cluster_policy/owned_tag_drift/databricks.yml.tmpl b/acceptance/bundle/resources/jobs/cluster_policy/owned_tag_drift/databricks.yml.tmpl
new file mode 100644
index 00000000000..0614a23657b
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/cluster_policy/owned_tag_drift/databricks.yml.tmpl
@@ -0,0 +1,35 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+workspace:
+  root_path: ~/.bundle/$UNIQUE_NAME
+
+resources:
+  cluster_policies:
+    my_policy:
+      name: test-policy-$UNIQUE_NAME
+      definition:
+        custom_tags.CostCenter:
+          type: fixed
+          value: from-policy
+
+  jobs:
+    # The config owns custom_tags.Mine. It is deliberately NOT a policy-governed tag: a fixed
+    # policy enforces on edit too, so an out-of-band change to the policy's own tag would be
+    # rejected (see config_conflicts_policy) and there would be no drifted state to observe.
+    my_job:
+      name: test-job-$UNIQUE_NAME
+      job_clusters:
+        - job_cluster_key: main
+          new_cluster:
+            policy_id: ${resources.cluster_policies.my_policy.id}
+            spark_version: $DEFAULT_SPARK_VERSION
+            node_type_id: $NODE_TYPE_ID
+            num_workers: 1
+            custom_tags:
+              Mine: mine
+      tasks:
+        - task_key: main
+          job_cluster_key: main
+          spark_python_task:
+            python_file: ./hello_world.py
diff --git a/acceptance/bundle/resources/jobs/cluster_policy/owned_tag_drift/hello_world.py b/acceptance/bundle/resources/jobs/cluster_policy/owned_tag_drift/hello_world.py
new file mode 100644
index 00000000000..11b15b1a458
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/cluster_policy/owned_tag_drift/hello_world.py
@@ -0,0 +1 @@
+print("hello")
diff --git a/acceptance/bundle/resources/jobs/cluster_policy/owned_tag_drift/out.test.toml b/acceptance/bundle/resources/jobs/cluster_policy/owned_tag_drift/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/cluster_policy/owned_tag_drift/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/jobs/cluster_policy/owned_tag_drift/output.txt b/acceptance/bundle/resources/jobs/cluster_policy/owned_tag_drift/output.txt
new file mode 100644
index 00000000000..33d79d43fe2
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/cluster_policy/owned_tag_drift/output.txt
@@ -0,0 +1,45 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Created cluster_policies.my_policy
+Created jobs.my_job
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+=== An out-of-band change to a config-owned tag is drift, even with a policy attached
+
+>>> [CLI] bundle plan
+update jobs.my_job
+
+Plan: 0 to add, 1 to change, 0 to delete, 1 unchanged
+
+=== Removing a config-owned tag is a change the user asked for, not a backend addition
+
+>>> update_file.py databricks.yml Mine: mine Other: other
+
+>>> [CLI] bundle plan -o json
+{
+  "job_clusters[job_cluster_key='main'].new_cluster.custom_tags['CostCenter']": {
+    "action": "skip",
+    "reason": "remote_addition",
+    "remote": "from-policy"
+  },
+  "job_clusters[job_cluster_key='main'].new_cluster.custom_tags['Mine']": {
+    "action": "update",
+    "old": "mine",
+    "remote": "changed-out-of-band"
+  },
+  "job_clusters[job_cluster_key='main'].new_cluster.custom_tags['Other']": {
+    "action": "update",
+    "new": "other"
+  }
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.cluster_policies.my_policy
+  delete resources.jobs.my_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/jobs/cluster_policy/owned_tag_drift/script b/acceptance/bundle/resources/jobs/cluster_policy/owned_tag_drift/script
new file mode 100644
index 00000000000..d86c89445ee
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/cluster_policy/owned_tag_drift/script
@@ -0,0 +1,21 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+trace $CLI bundle deploy
+job_id=$(read_id.py my_job)
+
+title "An out-of-band change to a config-owned tag is drift, even with a policy attached\n"
+edit_resource.py jobs "$job_id" <<'EOF'
+for jc in r["job_clusters"]:
+    jc["new_cluster"]["custom_tags"]["Mine"] = "changed-out-of-band"
+EOF
+trace $CLI bundle plan | contains.py "1 to change"
+
+title "Removing a config-owned tag is a change the user asked for, not a backend addition\n"
+trace update_file.py databricks.yml "Mine: mine" "Other: other"
+trace $CLI bundle plan -o json | jq -S '.plan["resources.jobs.my_job"].changes
+  | with_entries(select(.key | test("custom_tags")))'
diff --git a/acceptance/bundle/resources/jobs/cluster_policy/policy_id_scoping/databricks.yml.tmpl b/acceptance/bundle/resources/jobs/cluster_policy/policy_id_scoping/databricks.yml.tmpl
new file mode 100644
index 00000000000..61fc54a7c3b
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/cluster_policy/policy_id_scoping/databricks.yml.tmpl
@@ -0,0 +1,41 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+workspace:
+  root_path: ~/.bundle/$UNIQUE_NAME
+
+resources:
+  cluster_policies:
+    my_policy:
+      name: test-policy-$UNIQUE_NAME
+      definition:
+        custom_tags.CostCenter:
+          type: fixed
+          value: from-policy
+
+  # policy_id gates suppression per cluster spec, not per resource: the gated cluster's
+  # policy tag is skipped, while an out-of-band tag on the ungated sibling still surfaces.
+  jobs:
+    my_job:
+      name: test-job-$UNIQUE_NAME
+      job_clusters:
+        - job_cluster_key: gated
+          new_cluster:
+            policy_id: ${resources.cluster_policies.my_policy.id}
+            spark_version: $DEFAULT_SPARK_VERSION
+            node_type_id: $NODE_TYPE_ID
+            num_workers: 1
+        - job_cluster_key: ungated
+          new_cluster:
+            spark_version: $DEFAULT_SPARK_VERSION
+            node_type_id: $NODE_TYPE_ID
+            num_workers: 1
+      tasks:
+        - task_key: on_gated
+          job_cluster_key: gated
+          spark_python_task:
+            python_file: ./hello_world.py
+        - task_key: on_ungated
+          job_cluster_key: ungated
+          spark_python_task:
+            python_file: ./hello_world.py
diff --git a/acceptance/bundle/resources/jobs/cluster_policy/policy_id_scoping/hello_world.py b/acceptance/bundle/resources/jobs/cluster_policy/policy_id_scoping/hello_world.py
new file mode 100644
index 00000000000..11b15b1a458
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/cluster_policy/policy_id_scoping/hello_world.py
@@ -0,0 +1 @@
+print("hello")
diff --git a/acceptance/bundle/resources/jobs/cluster_policy/policy_id_scoping/out.test.toml b/acceptance/bundle/resources/jobs/cluster_policy/policy_id_scoping/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/cluster_policy/policy_id_scoping/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/jobs/cluster_policy/policy_id_scoping/output.txt b/acceptance/bundle/resources/jobs/cluster_policy/policy_id_scoping/output.txt
new file mode 100644
index 00000000000..004baa641d2
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/cluster_policy/policy_id_scoping/output.txt
@@ -0,0 +1,37 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Created cluster_policies.my_policy
+Created jobs.my_job
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Inject a remote-only tag on the ungated cluster (no policy_id) to show it is not gated
+
+=== The gated cluster's policy tag is skipped; the ungated cluster's tag is drift
+
+>>> [CLI] bundle plan -o json
+{
+  "job_clusters[job_cluster_key='gated'].new_cluster.custom_tags": {
+    "action": "skip",
+    "reason": "remote_addition",
+    "remote": {
+      "CostCenter": "from-policy"
+    }
+  },
+  "job_clusters[job_cluster_key='ungated'].new_cluster.custom_tags": {
+    "action": "update",
+    "remote": {
+      "Injected": "out-of-band"
+    }
+  }
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.cluster_policies.my_policy
+  delete resources.jobs.my_job
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/jobs/cluster_policy/policy_id_scoping/script b/acceptance/bundle/resources/jobs/cluster_policy/policy_id_scoping/script
new file mode 100644
index 00000000000..cdbdcaba7c0
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/cluster_policy/policy_id_scoping/script
@@ -0,0 +1,20 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+trace $CLI bundle deploy
+job_id=$(read_id.py my_job)
+
+title "Inject a remote-only tag on the ungated cluster (no policy_id) to show it is not gated\n"
+edit_resource.py jobs "$job_id" <<'EOF'
+for jc in r["job_clusters"]:
+    if jc["job_cluster_key"] == "ungated":
+        jc["new_cluster"]["custom_tags"] = {"Injected": "out-of-band"}
+EOF
+
+title "The gated cluster's policy tag is skipped; the ungated cluster's tag is drift\n"
+trace $CLI bundle plan -o json | jq -S '.plan["resources.jobs.my_job"].changes
+  | with_entries(select(.key | test("custom_tags")))'
diff --git a/acceptance/bundle/resources/jobs/cluster_policy/test.toml b/acceptance/bundle/resources/jobs/cluster_policy/test.toml
new file mode 100644
index 00000000000..63cb5b569cf
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/cluster_policy/test.toml
@@ -0,0 +1,10 @@
+# The drift-suppression under test is a direct-engine feature (bundle/direct), so restrict the
+# inherited engine matrix to direct. Cloud = true adds a real-workspace run; every test here
+# also runs locally against the testserver.
+Cloud = true
+
+RecordRequests = false
+
+Ignore = [
+    "databricks.yml",
+]
diff --git a/acceptance/bundle/resources/jobs/create-error/out.test.toml b/acceptance/bundle/resources/jobs/create-error/out.test.toml
index e90b6d5d1ba..a927a5fbc06 100644
--- a/acceptance/bundle/resources/jobs/create-error/out.test.toml
+++ b/acceptance/bundle/resources/jobs/create-error/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/jobs/create-error/output.txt b/acceptance/bundle/resources/jobs/create-error/output.txt
index 0fcd944efd2..1b4964953a5 100644
--- a/acceptance/bundle/resources/jobs/create-error/output.txt
+++ b/acceptance/bundle/resources/jobs/create-error/output.txt
@@ -1,7 +1,6 @@
 
 >>> musterr [CLI] bundle deploy --force-lock
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
 Error: cannot create resources.jobs.foo: Shared job cluster feature is only supported in multi-task jobs. (400 INVALID_PARAMETER_VALUE)
 
 Endpoint: POST [DATABRICKS_URL]/api/2.2/jobs/create
@@ -9,4 +8,24 @@ HTTP Status: 400 Bad Request
 API error_code: INVALID_PARAMETER_VALUE
 API message: Shared job cluster feature is only supported in multi-task jobs.
 
-Updating deployment state...
+Files: 1 uploaded, 0 deleted
+
+>>> musterr [CLI] bundle deploy --force-lock -q
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Error: cannot create resources.jobs.foo: Shared job cluster feature is only supported in multi-task jobs. (400 INVALID_PARAMETER_VALUE)
+
+Endpoint: POST [DATABRICKS_URL]/api/2.2/jobs/create
+HTTP Status: 400 Bad Request
+API error_code: INVALID_PARAMETER_VALUE
+API message: Shared job cluster feature is only supported in multi-task jobs.
+
+Files: 0 uploaded, 0 deleted
+
+>>> musterr [CLI] bundle deploy --force-lock -qq
+Error: cannot create resources.jobs.foo: Shared job cluster feature is only supported in multi-task jobs. (400 INVALID_PARAMETER_VALUE)
+
+Endpoint: POST [DATABRICKS_URL]/api/2.2/jobs/create
+HTTP Status: 400 Bad Request
+API error_code: INVALID_PARAMETER_VALUE
+API message: Shared job cluster feature is only supported in multi-task jobs.
+
diff --git a/acceptance/bundle/resources/jobs/create-error/script b/acceptance/bundle/resources/jobs/create-error/script
index 156bf21d730..9cd800ced67 100644
--- a/acceptance/bundle/resources/jobs/create-error/script
+++ b/acceptance/bundle/resources/jobs/create-error/script
@@ -1 +1,5 @@
 trace musterr $CLI bundle deploy --force-lock
+
+# -q and -qq reduce the summary but must not hide the create error.
+trace musterr $CLI bundle deploy --force-lock -q
+trace musterr $CLI bundle deploy --force-lock -qq
diff --git a/acceptance/bundle/resources/jobs/create-error/test.toml b/acceptance/bundle/resources/jobs/create-error/test.toml
index 450cadfab24..7b22301ecc1 100644
--- a/acceptance/bundle/resources/jobs/create-error/test.toml
+++ b/acceptance/bundle/resources/jobs/create-error/test.toml
@@ -18,7 +18,6 @@ RecordRequests = false
 #   25:           }
 #
 # At least 1 "new_cluster" blocks are required.
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
 
 [[Server]]
 Pattern = "POST /api/2.2/jobs/create"
diff --git a/acceptance/bundle/resources/jobs/delete_job/out.plan.direct.json b/acceptance/bundle/resources/jobs/delete_job/out.plan.direct.json
deleted file mode 100644
index 8d1518fc1a0..00000000000
--- a/acceptance/bundle/resources/jobs/delete_job/out.plan.direct.json
+++ /dev/null
@@ -1,71 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.jobs.job": {
-      "action": "delete",
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-        },
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_id": [NUMID],
-        "max_concurrent_runs": 1,
-        "name": "Untitled",
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "tasks": [
-          {
-            "email_notifications": {},
-            "existing_cluster_id": "0717-132531-5opeqon1",
-            "libraries": [
-              {
-                "whl": "/Workspace/Users/foo@bar.test/mywheel.whl"
-              }
-            ],
-            "python_wheel_task": {
-              "entry_point": "run",
-              "package_name": "whl"
-            },
-            "run_if": "ALL_SUCCESS",
-            "task_key": "TestTask1",
-            "timeout_seconds": 0
-          },
-          {
-            "email_notifications": {},
-            "for_each_task": {
-              "inputs": "[1]",
-              "task": {
-                "existing_cluster_id": "0717-132531-5opeqon1",
-                "libraries": [
-                  {
-                    "whl": "/Workspace/Users/foo@bar.test/mywheel.whl"
-                  }
-                ],
-                "python_wheel_task": {
-                  "entry_point": "run",
-                  "package_name": "whl"
-                },
-                "task_key": "TestTask2"
-              }
-            },
-            "run_if": "ALL_SUCCESS",
-            "task_key": "TestTask2",
-            "timeout_seconds": 0
-          }
-        ],
-        "timeout_seconds": 0,
-        "webhook_notifications": {}
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/jobs/delete_job/out.plan.json b/acceptance/bundle/resources/jobs/delete_job/out.plan.json
new file mode 100644
index 00000000000..c2b396b5d61
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/delete_job/out.plan.json
@@ -0,0 +1,71 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.jobs.job": {
+      "action": "delete",
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_id": [JOB_ID],
+        "max_concurrent_runs": 1,
+        "name": "Untitled",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "tasks": [
+          {
+            "email_notifications": {},
+            "existing_cluster_id": "0717-132531-5opeqon1",
+            "libraries": [
+              {
+                "whl": "/Workspace/Users/foo@bar.test/mywheel.whl"
+              }
+            ],
+            "python_wheel_task": {
+              "entry_point": "run",
+              "package_name": "whl"
+            },
+            "run_if": "ALL_SUCCESS",
+            "task_key": "TestTask1",
+            "timeout_seconds": 0
+          },
+          {
+            "email_notifications": {},
+            "for_each_task": {
+              "inputs": "[1]",
+              "task": {
+                "existing_cluster_id": "0717-132531-5opeqon1",
+                "libraries": [
+                  {
+                    "whl": "/Workspace/Users/foo@bar.test/mywheel.whl"
+                  }
+                ],
+                "python_wheel_task": {
+                  "entry_point": "run",
+                  "package_name": "whl"
+                },
+                "task_key": "TestTask2"
+              }
+            },
+            "run_if": "ALL_SUCCESS",
+            "task_key": "TestTask2",
+            "timeout_seconds": 0
+          }
+        ],
+        "timeout_seconds": 0,
+        "webhook_notifications": {}
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/jobs/delete_job/out.plan.terraform.json b/acceptance/bundle/resources/jobs/delete_job/out.plan.terraform.json
deleted file mode 100644
index fcafe01498d..00000000000
--- a/acceptance/bundle/resources/jobs/delete_job/out.plan.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.job": {
-      "action": "delete"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/jobs/delete_job/out.test.toml b/acceptance/bundle/resources/jobs/delete_job/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/jobs/delete_job/out.test.toml
+++ b/acceptance/bundle/resources/jobs/delete_job/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/jobs/delete_job/output.txt b/acceptance/bundle/resources/jobs/delete_job/output.txt
index 0fc5fc36e61..b57ef47f5d2 100644
--- a/acceptance/bundle/resources/jobs/delete_job/output.txt
+++ b/acceptance/bundle/resources/jobs/delete_job/output.txt
@@ -1,15 +1,15 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.job
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Deleted jobs.job
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 1 deleted, 0 unchanged
 {
   "method": "POST",
   "path": "/api/2.2/jobs/create",
@@ -65,6 +65,6 @@ Deployment complete!
   "method": "POST",
   "path": "/api/2.2/jobs/delete",
   "body": {
-    "job_id": [NUMID]
+    "job_id": [JOB_ID]
   }
 }
diff --git a/acceptance/bundle/resources/jobs/delete_job/script b/acceptance/bundle/resources/jobs/delete_job/script
index 022d90a82b7..ca8a8cd58d3 100644
--- a/acceptance/bundle/resources/jobs/delete_job/script
+++ b/acceptance/bundle/resources/jobs/delete_job/script
@@ -1,5 +1,6 @@
 trace $CLI bundle deploy
+replace_ids.py
 cp empty.yml databricks.yml
-$CLI bundle plan -o json > out.plan.$DATABRICKS_BUNDLE_ENGINE.json
+$CLI bundle plan -o json | nostamp > out.plan.json
 trace $CLI bundle deploy
-print_requests.py //jobs
+print_requests.py //jobs --nostamp
diff --git a/acceptance/bundle/resources/jobs/delete_task/out.plan_create.direct.json b/acceptance/bundle/resources/jobs/delete_task/out.plan_create.direct.json
deleted file mode 100644
index 5fd55841a57..00000000000
--- a/acceptance/bundle/resources/jobs/delete_task/out.plan_create.direct.json
+++ /dev/null
@@ -1,58 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.job": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "Untitled",
-          "queue": {
-            "enabled": true
-          },
-          "tasks": [
-            {
-              "existing_cluster_id": "0717-132531-5opeqon1",
-              "libraries": [
-                {
-                  "whl": "/Workspace/Users/foo@bar.test/mywheel.whl"
-                }
-              ],
-              "python_wheel_task": {
-                "entry_point": "run",
-                "package_name": "whl"
-              },
-              "task_key": "TestTask1"
-            },
-            {
-              "for_each_task": {
-                "inputs": "[1]",
-                "task": {
-                  "existing_cluster_id": "0717-132531-5opeqon1",
-                  "libraries": [
-                    {
-                      "whl": "/Workspace/Users/foo@bar.test/mywheel.whl"
-                    }
-                  ],
-                  "python_wheel_task": {
-                    "entry_point": "run",
-                    "package_name": "whl"
-                  },
-                  "task_key": "TestTask2"
-                }
-              },
-              "task_key": "TestTask2"
-            }
-          ]
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/jobs/delete_task/out.plan_create.json b/acceptance/bundle/resources/jobs/delete_task/out.plan_create.json
new file mode 100644
index 00000000000..9152be2843c
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/delete_task/out.plan_create.json
@@ -0,0 +1,58 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.jobs.job": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "Untitled",
+          "queue": {
+            "enabled": true
+          },
+          "tasks": [
+            {
+              "existing_cluster_id": "0717-132531-5opeqon1",
+              "libraries": [
+                {
+                  "whl": "/Workspace/Users/foo@bar.test/mywheel.whl"
+                }
+              ],
+              "python_wheel_task": {
+                "entry_point": "run",
+                "package_name": "whl"
+              },
+              "task_key": "TestTask1"
+            },
+            {
+              "for_each_task": {
+                "inputs": "[1]",
+                "task": {
+                  "existing_cluster_id": "0717-132531-5opeqon1",
+                  "libraries": [
+                    {
+                      "whl": "/Workspace/Users/foo@bar.test/mywheel.whl"
+                    }
+                  ],
+                  "python_wheel_task": {
+                    "entry_point": "run",
+                    "package_name": "whl"
+                  },
+                  "task_key": "TestTask2"
+                }
+              },
+              "task_key": "TestTask2"
+            }
+          ]
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/jobs/delete_task/out.plan_create.terraform.json b/acceptance/bundle/resources/jobs/delete_task/out.plan_create.terraform.json
deleted file mode 100644
index 85c0562240e..00000000000
--- a/acceptance/bundle/resources/jobs/delete_task/out.plan_create.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.job": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/jobs/delete_task/out.plan_update.direct.json b/acceptance/bundle/resources/jobs/delete_task/out.plan_update.direct.json
deleted file mode 100644
index 332c54a6efb..00000000000
--- a/acceptance/bundle/resources/jobs/delete_task/out.plan_update.direct.json
+++ /dev/null
@@ -1,171 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.jobs.job": {
-      "action": "update",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "Untitled",
-          "queue": {
-            "enabled": true
-          },
-          "tasks": [
-            {
-              "for_each_task": {
-                "inputs": "[1]",
-                "task": {
-                  "existing_cluster_id": "0717-132531-5opeqon1",
-                  "libraries": [
-                    {
-                      "whl": "/Workspace/Users/foo@bar.test/mywheel.whl"
-                    }
-                  ],
-                  "python_wheel_task": {
-                    "entry_point": "run",
-                    "package_name": "whl"
-                  },
-                  "task_key": "TestTask2"
-                }
-              },
-              "task_key": "TestTask2"
-            }
-          ]
-        }
-      },
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-        },
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_id": [NUMID],
-        "max_concurrent_runs": 1,
-        "name": "Untitled",
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "tasks": [
-          {
-            "email_notifications": {},
-            "existing_cluster_id": "0717-132531-5opeqon1",
-            "libraries": [
-              {
-                "whl": "/Workspace/Users/foo@bar.test/mywheel.whl"
-              }
-            ],
-            "python_wheel_task": {
-              "entry_point": "run",
-              "package_name": "whl"
-            },
-            "run_if": "ALL_SUCCESS",
-            "task_key": "TestTask1",
-            "timeout_seconds": 0
-          },
-          {
-            "email_notifications": {},
-            "for_each_task": {
-              "inputs": "[1]",
-              "task": {
-                "existing_cluster_id": "0717-132531-5opeqon1",
-                "libraries": [
-                  {
-                    "whl": "/Workspace/Users/foo@bar.test/mywheel.whl"
-                  }
-                ],
-                "python_wheel_task": {
-                  "entry_point": "run",
-                  "package_name": "whl"
-                },
-                "task_key": "TestTask2"
-              }
-            },
-            "run_if": "ALL_SUCCESS",
-            "task_key": "TestTask2",
-            "timeout_seconds": 0
-          }
-        ],
-        "timeout_seconds": 0,
-        "webhook_notifications": {}
-      },
-      "changes": {
-        "email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks[task_key='TestTask1']": {
-          "action": "update",
-          "old": {
-            "existing_cluster_id": "0717-132531-5opeqon1",
-            "libraries": [
-              {
-                "whl": "/Workspace/Users/foo@bar.test/mywheel.whl"
-              }
-            ],
-            "python_wheel_task": {
-              "entry_point": "run",
-              "package_name": "whl"
-            },
-            "task_key": "TestTask1"
-          },
-          "remote": {
-            "email_notifications": {},
-            "existing_cluster_id": "0717-132531-5opeqon1",
-            "libraries": [
-              {
-                "whl": "/Workspace/Users/foo@bar.test/mywheel.whl"
-              }
-            ],
-            "python_wheel_task": {
-              "entry_point": "run",
-              "package_name": "whl"
-            },
-            "run_if": "ALL_SUCCESS",
-            "task_key": "TestTask1",
-            "timeout_seconds": 0
-          }
-        },
-        "tasks[task_key='TestTask2'].email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks[task_key='TestTask2'].run_if": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "ALL_SUCCESS"
-        },
-        "tasks[task_key='TestTask2'].timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "webhook_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/jobs/delete_task/out.plan_update.json b/acceptance/bundle/resources/jobs/delete_task/out.plan_update.json
new file mode 100644
index 00000000000..61124e44ae6
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/delete_task/out.plan_update.json
@@ -0,0 +1,171 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.jobs.job": {
+      "action": "update",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "Untitled",
+          "queue": {
+            "enabled": true
+          },
+          "tasks": [
+            {
+              "for_each_task": {
+                "inputs": "[1]",
+                "task": {
+                  "existing_cluster_id": "0717-132531-5opeqon1",
+                  "libraries": [
+                    {
+                      "whl": "/Workspace/Users/foo@bar.test/mywheel.whl"
+                    }
+                  ],
+                  "python_wheel_task": {
+                    "entry_point": "run",
+                    "package_name": "whl"
+                  },
+                  "task_key": "TestTask2"
+                }
+              },
+              "task_key": "TestTask2"
+            }
+          ]
+        }
+      },
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_id": [JOB_ID],
+        "max_concurrent_runs": 1,
+        "name": "Untitled",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "tasks": [
+          {
+            "email_notifications": {},
+            "existing_cluster_id": "0717-132531-5opeqon1",
+            "libraries": [
+              {
+                "whl": "/Workspace/Users/foo@bar.test/mywheel.whl"
+              }
+            ],
+            "python_wheel_task": {
+              "entry_point": "run",
+              "package_name": "whl"
+            },
+            "run_if": "ALL_SUCCESS",
+            "task_key": "TestTask1",
+            "timeout_seconds": 0
+          },
+          {
+            "email_notifications": {},
+            "for_each_task": {
+              "inputs": "[1]",
+              "task": {
+                "existing_cluster_id": "0717-132531-5opeqon1",
+                "libraries": [
+                  {
+                    "whl": "/Workspace/Users/foo@bar.test/mywheel.whl"
+                  }
+                ],
+                "python_wheel_task": {
+                  "entry_point": "run",
+                  "package_name": "whl"
+                },
+                "task_key": "TestTask2"
+              }
+            },
+            "run_if": "ALL_SUCCESS",
+            "task_key": "TestTask2",
+            "timeout_seconds": 0
+          }
+        ],
+        "timeout_seconds": 0,
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='TestTask1']": {
+          "action": "update",
+          "old": {
+            "existing_cluster_id": "0717-132531-5opeqon1",
+            "libraries": [
+              {
+                "whl": "/Workspace/Users/foo@bar.test/mywheel.whl"
+              }
+            ],
+            "python_wheel_task": {
+              "entry_point": "run",
+              "package_name": "whl"
+            },
+            "task_key": "TestTask1"
+          },
+          "remote": {
+            "email_notifications": {},
+            "existing_cluster_id": "0717-132531-5opeqon1",
+            "libraries": [
+              {
+                "whl": "/Workspace/Users/foo@bar.test/mywheel.whl"
+              }
+            ],
+            "python_wheel_task": {
+              "entry_point": "run",
+              "package_name": "whl"
+            },
+            "run_if": "ALL_SUCCESS",
+            "task_key": "TestTask1",
+            "timeout_seconds": 0
+          }
+        },
+        "tasks[task_key='TestTask2'].email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='TestTask2'].run_if": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": "ALL_SUCCESS"
+        },
+        "tasks[task_key='TestTask2'].timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/jobs/delete_task/out.plan_update.terraform.json b/acceptance/bundle/resources/jobs/delete_task/out.plan_update.terraform.json
deleted file mode 100644
index b978b76c711..00000000000
--- a/acceptance/bundle/resources/jobs/delete_task/out.plan_update.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.job": {
-      "action": "update"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/jobs/delete_task/out.test.toml b/acceptance/bundle/resources/jobs/delete_task/out.test.toml
index 8ffbd40f24c..f7fafbcc731 100644
--- a/acceptance/bundle/resources/jobs/delete_task/out.test.toml
+++ b/acceptance/bundle/resources/jobs/delete_task/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
 EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/resources/jobs/delete_task/output.txt b/acceptance/bundle/resources/jobs/delete_task/output.txt
index eebf003d74b..83070a1b259 100644
--- a/acceptance/bundle/resources/jobs/delete_task/output.txt
+++ b/acceptance/bundle/resources/jobs/delete_task/output.txt
@@ -1,7 +1,7 @@
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.job
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> cat databricks.yml
 bundle:
@@ -23,6 +23,6 @@ resources:
               libraries:
                 - whl: /Workspace/Users/foo@bar.test/mywheel.whl
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated jobs.job
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
diff --git a/acceptance/bundle/resources/jobs/delete_task/script b/acceptance/bundle/resources/jobs/delete_task/script
index 29b856e5ceb..c7ad0ba8405 100644
--- a/acceptance/bundle/resources/jobs/delete_task/script
+++ b/acceptance/bundle/resources/jobs/delete_task/script
@@ -1,6 +1,12 @@
-$CLI bundle plan -o json > out.plan_create.$DATABRICKS_BUNDLE_ENGINE.json
-$CLI bundle deploy $(readplanarg out.plan_create.direct.json)
+# The raw plans the replays read go under .databricks, which sync skips.
+mkdir -p .databricks
+
+$CLI bundle plan -o json > .databricks/tmp.plan_create.json
+nostamp < .databricks/tmp.plan_create.json > out.plan_create.json
+$CLI bundle deploy $(readplanarg .databricks/tmp.plan_create.json)
+replace_ids.py
 grep -v TO_DELETE databricks.yml > tmp.yml && mv tmp.yml databricks.yml
 trace cat databricks.yml
-$CLI bundle plan -o json > out.plan_update.$DATABRICKS_BUNDLE_ENGINE.json
-$CLI bundle deploy $(readplanarg out.plan_update.direct.json)
+$CLI bundle plan -o json > .databricks/tmp.plan_update.json
+nostamp < .databricks/tmp.plan_update.json > out.plan_update.json
+$CLI bundle deploy $(readplanarg .databricks/tmp.plan_update.json)
diff --git a/acceptance/bundle/resources/jobs/double-underscore-keys/out.test.toml b/acceptance/bundle/resources/jobs/double-underscore-keys/out.test.toml
index 5ad0addb75e..98ccab9aaeb 100644
--- a/acceptance/bundle/resources/jobs/double-underscore-keys/out.test.toml
+++ b/acceptance/bundle/resources/jobs/double-underscore-keys/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 RunsOnDbr = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/jobs/double-underscore-keys/output.txt b/acceptance/bundle/resources/jobs/double-underscore-keys/output.txt
index 62f7afddc82..174e5b1ac57 100644
--- a/acceptance/bundle/resources/jobs/double-underscore-keys/output.txt
+++ b/acceptance/bundle/resources/jobs/double-underscore-keys/output.txt
@@ -10,9 +10,10 @@ Validation OK!
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-jobs-test-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.foo
+Created jobs.foo__bar
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
@@ -21,5 +22,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-jobs-test-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/jobs/double-underscore-keys/test.toml b/acceptance/bundle/resources/jobs/double-underscore-keys/test.toml
index c469454658b..4d77b7783c8 100644
--- a/acceptance/bundle/resources/jobs/double-underscore-keys/test.toml
+++ b/acceptance/bundle/resources/jobs/double-underscore-keys/test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 RecordRequests = false
 RunsOnDbr = true
diff --git a/acceptance/bundle/resources/jobs/fail-on-active-runs/out.test.toml b/acceptance/bundle/resources/jobs/fail-on-active-runs/out.test.toml
index 5ad0addb75e..98ccab9aaeb 100644
--- a/acceptance/bundle/resources/jobs/fail-on-active-runs/out.test.toml
+++ b/acceptance/bundle/resources/jobs/fail-on-active-runs/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 RunsOnDbr = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/jobs/fail-on-active-runs/output.txt b/acceptance/bundle/resources/jobs/fail-on-active-runs/output.txt
index cb83417dd70..5676ea96cc6 100644
--- a/acceptance/bundle/resources/jobs/fail-on-active-runs/output.txt
+++ b/acceptance/bundle/resources/jobs/fail-on-active-runs/output.txt
@@ -11,17 +11,16 @@ Validation OK!
 === deploy empty bundle
 >>> [CLI] bundle deploy --fail-on-active-runs
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-jobs-active-runs-test-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.foo
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 === Remove .databricks directory to simulate a fresh deployment
 === deploy empty bundle again
 >>> [CLI] bundle deploy --fail-on-active-runs
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-jobs-active-runs-test-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 3 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
@@ -29,5 +28,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-jobs-active-runs-test-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/jobs/fail-on-active-runs/test.toml b/acceptance/bundle/resources/jobs/fail-on-active-runs/test.toml
index c469454658b..4d77b7783c8 100644
--- a/acceptance/bundle/resources/jobs/fail-on-active-runs/test.toml
+++ b/acceptance/bundle/resources/jobs/fail-on-active-runs/test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 RecordRequests = false
 RunsOnDbr = true
diff --git a/acceptance/bundle/resources/jobs/git-source-python-task/databricks.yml b/acceptance/bundle/resources/jobs/git-source-python-task/databricks.yml
new file mode 100644
index 00000000000..73856829298
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/git-source-python-task/databricks.yml
@@ -0,0 +1,23 @@
+bundle:
+  name: git-source-python-task
+
+# A spark_python_task in a job with git_source uses a repo-relative python_file.
+# Path translation is skipped for git_source jobs, so the task must be sent with
+# source: GIT, otherwise the backend rejects the relative path with
+# "Invalid python file reference".
+resources:
+  jobs:
+    foo:
+      name: foo
+      git_source:
+        git_url: https://github.com/databricks/cli.git
+        git_provider: gitHub
+        git_branch: main
+      tasks:
+        - task_key: main
+          new_cluster:
+            spark_version: 15.4.x-scala2.12
+            node_type_id: Standard_DS3_v2
+            num_workers: 1
+          spark_python_task:
+            python_file: src/main.py
diff --git a/acceptance/bundle/resources/jobs/git-source-python-task/out.test.toml b/acceptance/bundle/resources/jobs/git-source-python-task/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/git-source-python-task/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/jobs/git-source-python-task/output.txt b/acceptance/bundle/resources/jobs/git-source-python-task/output.txt
new file mode 100644
index 00000000000..6cbe39f006e
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/git-source-python-task/output.txt
@@ -0,0 +1,12 @@
+
+>>> errcode [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/git-source-python-task/default/files...
+Created jobs.foo
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.tasks[0].spark_python_task [OUTPUT_DIR]/out.requests.txt
+{
+  "python_file": "src/main.py",
+  "source": "GIT"
+}
diff --git a/acceptance/bundle/resources/jobs/git-source-python-task/script b/acceptance/bundle/resources/jobs/git-source-python-task/script
new file mode 100644
index 00000000000..2662b2f6e78
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/git-source-python-task/script
@@ -0,0 +1,6 @@
+trace errcode $CLI bundle deploy
+
+# The task must be sent with source: GIT so the backend resolves python_file
+# against the git repo. Without it the relative path is rejected.
+trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.tasks[0].spark_python_task' "$OUT_REQUESTS"
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/resources/jobs/git-source-python-task/test.toml b/acceptance/bundle/resources/jobs/git-source-python-task/test.toml
new file mode 100644
index 00000000000..3ad5f6c52c9
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/git-source-python-task/test.toml
@@ -0,0 +1,5 @@
+Cloud = false
+RecordRequests = true
+
+# This behaviour only differs on the direct engine: terraform already stamps
+# source: GIT via tfdyn. Run direct only.
diff --git a/acceptance/bundle/resources/jobs/instance_pool_and_node_type/out.test.toml b/acceptance/bundle/resources/jobs/instance_pool_and_node_type/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/jobs/instance_pool_and_node_type/out.test.toml
+++ b/acceptance/bundle/resources/jobs/instance_pool_and_node_type/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/jobs/instance_pool_and_node_type/output.txt b/acceptance/bundle/resources/jobs/instance_pool_and_node_type/output.txt
index fb2387e9e72..529e44a26ee 100644
--- a/acceptance/bundle/resources/jobs/instance_pool_and_node_type/output.txt
+++ b/acceptance/bundle/resources/jobs/instance_pool_and_node_type/output.txt
@@ -43,11 +43,11 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.some_other_job
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
->>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.tasks out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | .body.tasks [OUTPUT_DIR]/out.requests.txt
 [
   {
     "new_cluster": {
diff --git a/acceptance/bundle/resources/jobs/instance_pool_and_node_type/script b/acceptance/bundle/resources/jobs/instance_pool_and_node_type/script
index 4f39d94ce7b..9bca2b48655 100644
--- a/acceptance/bundle/resources/jobs/instance_pool_and_node_type/script
+++ b/acceptance/bundle/resources/jobs/instance_pool_and_node_type/script
@@ -3,5 +3,5 @@ trace $CLI bundle summary -o json | jq .resources.jobs.some_other_job.tasks
 
 trace $CLI bundle deploy
 
-trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.tasks' out.requests.txt
-rm out.requests.txt
+trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | .body.tasks' "$OUT_REQUESTS"
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/resources/jobs/no-git-provider/out.deploy.direct.txt b/acceptance/bundle/resources/jobs/no-git-provider/out.deploy.direct.txt
deleted file mode 100644
index 41b7e6e0f61..00000000000
--- a/acceptance/bundle/resources/jobs/no-git-provider/out.deploy.direct.txt
+++ /dev/null
@@ -1,18 +0,0 @@
-
->>> errcode [CLI] bundle deploy --force-lock
-Warning: required field "git_provider" is not set
-  at resources.jobs.foo.git_source
-  in databricks.yml:12:9
-
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Error: cannot create resources.jobs.foo: git_source.git_provider must be one of: github,gitlab,bitbucketcloud,gitlabenterpriseedition,bitbucketserver,azuredevopsservices,githubenterprise,awscodecommit (400 INVALID_PARAMETER_VALUE)
-
-Endpoint: POST [DATABRICKS_URL]/api/2.2/jobs/create
-HTTP Status: 400 Bad Request
-API error_code: INVALID_PARAMETER_VALUE
-API message: git_source.git_provider must be one of: github,gitlab,bitbucketcloud,gitlabenterpriseedition,bitbucketserver,azuredevopsservices,githubenterprise,awscodecommit
-
-Updating deployment state...
-
-Exit code: 1
diff --git a/acceptance/bundle/resources/jobs/no-git-provider/out.deploy.terraform.txt b/acceptance/bundle/resources/jobs/no-git-provider/out.deploy.terraform.txt
deleted file mode 100644
index 852d5161eae..00000000000
--- a/acceptance/bundle/resources/jobs/no-git-provider/out.deploy.terraform.txt
+++ /dev/null
@@ -1,10 +0,0 @@
-
->>> errcode [CLI] bundle deploy --force-lock
-Warning: required field "git_provider" is not set
-  at resources.jobs.foo.git_source
-  in databricks.yml:12:9
-
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
diff --git a/acceptance/bundle/resources/jobs/no-git-provider/out.deploy.txt b/acceptance/bundle/resources/jobs/no-git-provider/out.deploy.txt
new file mode 100644
index 00000000000..19ff909c96e
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/no-git-provider/out.deploy.txt
@@ -0,0 +1,17 @@
+
+>>> errcode [CLI] bundle deploy --force-lock
+Warning: required field "git_provider" is not set
+  at resources.jobs.foo.git_source
+  in databricks.yml:12:9
+
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Error: cannot create resources.jobs.foo: git_source.git_provider must be one of: github,gitlab,bitbucketcloud,gitlabenterpriseedition,bitbucketserver,azuredevopsservices,githubenterprise,awscodecommit (400 INVALID_PARAMETER_VALUE)
+
+Endpoint: POST [DATABRICKS_URL]/api/2.2/jobs/create
+HTTP Status: 400 Bad Request
+API error_code: INVALID_PARAMETER_VALUE
+API message: git_source.git_provider must be one of: github,gitlab,bitbucketcloud,gitlabenterpriseedition,bitbucketserver,azuredevopsservices,githubenterprise,awscodecommit
+
+Files: 3 uploaded, 0 deleted
+
+Exit code: 1
diff --git a/acceptance/bundle/resources/jobs/no-git-provider/out.destroy.direct.txt b/acceptance/bundle/resources/jobs/no-git-provider/out.destroy.direct.txt
deleted file mode 100644
index ec2c1b08a3e..00000000000
--- a/acceptance/bundle/resources/jobs/no-git-provider/out.destroy.direct.txt
+++ /dev/null
@@ -1,10 +0,0 @@
-
->>> errcode [CLI] bundle destroy --auto-approve
-Warning: required field "git_provider" is not set
-  at resources.jobs.foo.git_source
-  in databricks.yml:12:9
-
-All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
-
-Deleting files...
-Destroy complete!
diff --git a/acceptance/bundle/resources/jobs/no-git-provider/out.destroy.terraform.txt b/acceptance/bundle/resources/jobs/no-git-provider/out.destroy.terraform.txt
deleted file mode 100644
index cf938a19d2e..00000000000
--- a/acceptance/bundle/resources/jobs/no-git-provider/out.destroy.terraform.txt
+++ /dev/null
@@ -1,13 +0,0 @@
-
->>> errcode [CLI] bundle destroy --auto-approve
-Warning: required field "git_provider" is not set
-  at resources.jobs.foo.git_source
-  in databricks.yml:12:9
-
-The following resources will be deleted:
-  delete resources.jobs.foo
-
-All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
-
-Deleting files...
-Destroy complete!
diff --git a/acceptance/bundle/resources/jobs/no-git-provider/out.destroy.txt b/acceptance/bundle/resources/jobs/no-git-provider/out.destroy.txt
new file mode 100644
index 00000000000..55ac39f3b69
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/no-git-provider/out.destroy.txt
@@ -0,0 +1,9 @@
+
+>>> errcode [CLI] bundle destroy --auto-approve
+Warning: required field "git_provider" is not set
+  at resources.jobs.foo.git_source
+  in databricks.yml:12:9
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 0 deleted
diff --git a/acceptance/bundle/resources/jobs/no-git-provider/out.test.toml b/acceptance/bundle/resources/jobs/no-git-provider/out.test.toml
index e5a4c7283a6..98ccab9aaeb 100644
--- a/acceptance/bundle/resources/jobs/no-git-provider/out.test.toml
+++ b/acceptance/bundle/resources/jobs/no-git-provider/out.test.toml
@@ -1,4 +1,3 @@
-Local = false
 Cloud = true
 RunsOnDbr = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/jobs/no-git-provider/script b/acceptance/bundle/resources/jobs/no-git-provider/script
index 7c78841a145..acaec1e9066 100644
--- a/acceptance/bundle/resources/jobs/no-git-provider/script
+++ b/acceptance/bundle/resources/jobs/no-git-provider/script
@@ -1,7 +1,7 @@
 envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
-    trace errcode $CLI bundle destroy --auto-approve > out.destroy.$DATABRICKS_BUNDLE_ENGINE.txt 2>&1
+    trace errcode $CLI bundle destroy --auto-approve > out.destroy.txt 2>&1
 }
 trap cleanup EXIT
-trace errcode $CLI bundle deploy --force-lock > out.deploy.$DATABRICKS_BUNDLE_ENGINE.txt 2>&1
+trace errcode $CLI bundle deploy --force-lock > out.deploy.txt 2>&1
diff --git a/acceptance/bundle/resources/jobs/no-git-provider/test.toml b/acceptance/bundle/resources/jobs/no-git-provider/test.toml
index ca29b496685..da31127635f 100644
--- a/acceptance/bundle/resources/jobs/no-git-provider/test.toml
+++ b/acceptance/bundle/resources/jobs/no-git-provider/test.toml
@@ -1,4 +1,3 @@
-Local = false
 Cloud = true
 
 RecordRequests = false
diff --git a/acceptance/bundle/resources/jobs/num_workers/out.test.toml b/acceptance/bundle/resources/jobs/num_workers/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/jobs/num_workers/out.test.toml
+++ b/acceptance/bundle/resources/jobs/num_workers/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/jobs/num_workers/output.txt b/acceptance/bundle/resources/jobs/num_workers/output.txt
index 16e4d600cd2..605314d8f88 100644
--- a/acceptance/bundle/resources/jobs/num_workers/output.txt
+++ b/acceptance/bundle/resources/jobs/num_workers/output.txt
@@ -17,11 +17,11 @@ are correctly set in the cluster specification:
   
 
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.sample_job
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
->>> print_requests.py //jobs
+>>> print_requests.py //jobs --nostamp
 {
   "method": "POST",
   "path": "/api/2.2/jobs/create",
diff --git a/acceptance/bundle/resources/jobs/num_workers/script b/acceptance/bundle/resources/jobs/num_workers/script
index 8e430e43063..68ae9ed8479 100644
--- a/acceptance/bundle/resources/jobs/num_workers/script
+++ b/acceptance/bundle/resources/jobs/num_workers/script
@@ -1,6 +1,6 @@
 envsubst < databricks.yml.tmpl > databricks.yml
 trace $CLI bundle deploy
-trace print_requests.py //jobs
+trace print_requests.py //jobs --nostamp
 
 trace $CLI bundle plan
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/resources/jobs/on_failure_empty_slice/out.plan.direct.json b/acceptance/bundle/resources/jobs/on_failure_empty_slice/out.plan.json
similarity index 100%
rename from acceptance/bundle/resources/jobs/on_failure_empty_slice/out.plan.direct.json
rename to acceptance/bundle/resources/jobs/on_failure_empty_slice/out.plan.json
diff --git a/acceptance/bundle/resources/jobs/on_failure_empty_slice/out.plan.terraform.json b/acceptance/bundle/resources/jobs/on_failure_empty_slice/out.plan.terraform.json
deleted file mode 100644
index a446e3e1aaa..00000000000
--- a/acceptance/bundle/resources/jobs/on_failure_empty_slice/out.plan.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.refresh_usage_logs": {
-      "action": "skip"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/jobs/on_failure_empty_slice/out.test.toml b/acceptance/bundle/resources/jobs/on_failure_empty_slice/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/jobs/on_failure_empty_slice/out.test.toml
+++ b/acceptance/bundle/resources/jobs/on_failure_empty_slice/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/jobs/on_failure_empty_slice/output.txt b/acceptance/bundle/resources/jobs/on_failure_empty_slice/output.txt
index 35870e42c3e..2ff2c10d1c9 100644
--- a/acceptance/bundle/resources/jobs/on_failure_empty_slice/output.txt
+++ b/acceptance/bundle/resources/jobs/on_failure_empty_slice/output.txt
@@ -6,8 +6,8 @@ Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/usage_logs/dev/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.refresh_usage_logs
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle plan -o json
diff --git a/acceptance/bundle/resources/jobs/on_failure_empty_slice/script b/acceptance/bundle/resources/jobs/on_failure_empty_slice/script
index e69f9fb5bab..f218f84fd3e 100644
--- a/acceptance/bundle/resources/jobs/on_failure_empty_slice/script
+++ b/acceptance/bundle/resources/jobs/on_failure_empty_slice/script
@@ -1,3 +1,3 @@
 trace $CLI bundle plan
 trace $CLI bundle deploy
-trace $CLI bundle plan -o json | jq '.plan."resources.jobs.refresh_usage_logs".changes // .' > out.plan.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp | jq '.plan."resources.jobs.refresh_usage_logs".changes // .' > out.plan.json
diff --git a/acceptance/bundle/resources/jobs/remote_add_tag/out.plan_post_update.direct.json b/acceptance/bundle/resources/jobs/remote_add_tag/out.plan_post_update.direct.json
deleted file mode 100644
index 15963bc0071..00000000000
--- a/acceptance/bundle/resources/jobs/remote_add_tag/out.plan_post_update.direct.json
+++ /dev/null
@@ -1,122 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.jobs.foo": {
-      "action": "update",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "My Wheel Job",
-          "queue": {
-            "enabled": true
-          },
-          "tags": {
-            "tag1": "tag value"
-          },
-          "tasks": [
-            {
-              "environment_key": "test_env",
-              "libraries": [
-                {
-                  "whl": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/hello.whl"
-                }
-              ],
-              "python_wheel_task": {
-                "entry_point": "run",
-                "package_name": "my_test_code"
-              },
-              "task_key": "TestTask"
-            }
-          ]
-        }
-      },
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-        },
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_id": [FOO_ID],
-        "max_concurrent_runs": 1,
-        "name": "My Wheel Job",
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "tags": {
-          "new_tag": "new_value",
-          "tag1": "tag value"
-        },
-        "tasks": [
-          {
-            "email_notifications": {},
-            "environment_key": "test_env",
-            "libraries": [
-              {
-                "whl": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/hello.whl"
-              }
-            ],
-            "python_wheel_task": {
-              "entry_point": "run",
-              "package_name": "my_test_code"
-            },
-            "run_if": "ALL_SUCCESS",
-            "task_key": "TestTask",
-            "timeout_seconds": 0
-          }
-        ],
-        "timeout_seconds": 0,
-        "webhook_notifications": {}
-      },
-      "changes": {
-        "email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tags['new_tag']": {
-          "action": "update",
-          "remote": "new_value"
-        },
-        "tasks[task_key='TestTask'].email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks[task_key='TestTask'].run_if": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "ALL_SUCCESS"
-        },
-        "tasks[task_key='TestTask'].timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "webhook_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/jobs/remote_add_tag/out.plan_post_update.json b/acceptance/bundle/resources/jobs/remote_add_tag/out.plan_post_update.json
new file mode 100644
index 00000000000..d52ca412cce
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/remote_add_tag/out.plan_post_update.json
@@ -0,0 +1,122 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.jobs.foo": {
+      "action": "update",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "My Wheel Job",
+          "queue": {
+            "enabled": true
+          },
+          "tags": {
+            "tag1": "tag value"
+          },
+          "tasks": [
+            {
+              "environment_key": "test_env",
+              "libraries": [
+                {
+                  "whl": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/hello.whl"
+                }
+              ],
+              "python_wheel_task": {
+                "entry_point": "run",
+                "package_name": "my_test_code"
+              },
+              "task_key": "TestTask"
+            }
+          ]
+        }
+      },
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_id": [FOO_ID],
+        "max_concurrent_runs": 1,
+        "name": "My Wheel Job",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "tags": {
+          "new_tag": "new_value",
+          "tag1": "tag value"
+        },
+        "tasks": [
+          {
+            "email_notifications": {},
+            "environment_key": "test_env",
+            "libraries": [
+              {
+                "whl": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal/hello.whl"
+              }
+            ],
+            "python_wheel_task": {
+              "entry_point": "run",
+              "package_name": "my_test_code"
+            },
+            "run_if": "ALL_SUCCESS",
+            "task_key": "TestTask",
+            "timeout_seconds": 0
+          }
+        ],
+        "timeout_seconds": 0,
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tags['new_tag']": {
+          "action": "update",
+          "remote": "new_value"
+        },
+        "tasks[task_key='TestTask'].email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='TestTask'].run_if": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": "ALL_SUCCESS"
+        },
+        "tasks[task_key='TestTask'].timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/jobs/remote_add_tag/out.plan_post_update.terraform.json b/acceptance/bundle/resources/jobs/remote_add_tag/out.plan_post_update.terraform.json
deleted file mode 100644
index 4e0ecc7bdaf..00000000000
--- a/acceptance/bundle/resources/jobs/remote_add_tag/out.plan_post_update.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.foo": {
-      "action": "update"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/jobs/remote_add_tag/out.test.toml b/acceptance/bundle/resources/jobs/remote_add_tag/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/jobs/remote_add_tag/out.test.toml
+++ b/acceptance/bundle/resources/jobs/remote_add_tag/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/jobs/remote_add_tag/output.txt b/acceptance/bundle/resources/jobs/remote_add_tag/output.txt
index 545c3e6de38..c6930f82f9f 100644
--- a/acceptance/bundle/resources/jobs/remote_add_tag/output.txt
+++ b/acceptance/bundle/resources/jobs/remote_add_tag/output.txt
@@ -3,9 +3,9 @@ create jobs.foo
 Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
 Uploading hello.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.foo
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 update jobs.foo
 
 Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
diff --git a/acceptance/bundle/resources/jobs/remote_add_tag/script b/acceptance/bundle/resources/jobs/remote_add_tag/script
index d7593e7b8f7..c60ed4571ce 100644
--- a/acceptance/bundle/resources/jobs/remote_add_tag/script
+++ b/acceptance/bundle/resources/jobs/remote_add_tag/script
@@ -8,4 +8,4 @@ r["tags"]["new_tag"] = "new_value"
 EOF
 
 $CLI bundle plan
-$CLI bundle plan -o json > out.plan_post_update.$DATABRICKS_BUNDLE_ENGINE.json
+$CLI bundle plan -o json | nostamp > out.plan_post_update.json
diff --git a/acceptance/bundle/resources/jobs/remote_delete/deploy/out.plan.direct.json b/acceptance/bundle/resources/jobs/remote_delete/deploy/out.plan.direct.json
deleted file mode 100644
index bc70acef44a..00000000000
--- a/acceptance/bundle/resources/jobs/remote_delete/deploy/out.plan.direct.json
+++ /dev/null
@@ -1,42 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.jobs.foo": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "job_clusters": [
-            {
-              "job_cluster_key": "key",
-              "new_cluster": {
-                "num_workers": 0,
-                "spark_version": "13.3.x-scala2.12"
-              }
-            }
-          ],
-          "max_concurrent_runs": 1,
-          "name": "foo",
-          "queue": {
-            "enabled": true
-          },
-          "trigger": {
-            "pause_status": "UNPAUSED",
-            "periodic": {
-              "interval": 1,
-              "unit": "DAYS"
-            }
-          }
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/jobs/remote_delete/deploy/out.plan.json b/acceptance/bundle/resources/jobs/remote_delete/deploy/out.plan.json
new file mode 100644
index 00000000000..da6e4c4bd49
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/remote_delete/deploy/out.plan.json
@@ -0,0 +1,42 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.jobs.foo": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "job_clusters": [
+            {
+              "job_cluster_key": "key",
+              "new_cluster": {
+                "num_workers": 0,
+                "spark_version": "13.3.x-scala2.12"
+              }
+            }
+          ],
+          "max_concurrent_runs": 1,
+          "name": "foo",
+          "queue": {
+            "enabled": true
+          },
+          "trigger": {
+            "pause_status": "UNPAUSED",
+            "periodic": {
+              "interval": 1,
+              "unit": "DAYS"
+            }
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/jobs/remote_delete/deploy/out.plan.terraform.json b/acceptance/bundle/resources/jobs/remote_delete/deploy/out.plan.terraform.json
deleted file mode 100644
index b1dce3fac0f..00000000000
--- a/acceptance/bundle/resources/jobs/remote_delete/deploy/out.plan.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.foo": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/jobs/remote_delete/deploy/out.test.toml b/acceptance/bundle/resources/jobs/remote_delete/deploy/out.test.toml
index 8ffbd40f24c..f7fafbcc731 100644
--- a/acceptance/bundle/resources/jobs/remote_delete/deploy/out.test.toml
+++ b/acceptance/bundle/resources/jobs/remote_delete/deploy/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
 EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/resources/jobs/remote_delete/deploy/output.txt b/acceptance/bundle/resources/jobs/remote_delete/deploy/output.txt
index 372a1c82f77..8a0866f2a8f 100644
--- a/acceptance/bundle/resources/jobs/remote_delete/deploy/output.txt
+++ b/acceptance/bundle/resources/jobs/remote_delete/deploy/output.txt
@@ -6,17 +6,17 @@ Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.foo
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
->>> [CLI] jobs delete [NUMID]
+>>> [CLI] jobs delete [FOO_ID]
 
 >>> [CLI] bundle plan
 create jobs.foo
 
 Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.foo
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
diff --git a/acceptance/bundle/resources/jobs/remote_delete/deploy/script b/acceptance/bundle/resources/jobs/remote_delete/deploy/script
index 2d56f371b12..e89d8a8bc0a 100644
--- a/acceptance/bundle/resources/jobs/remote_delete/deploy/script
+++ b/acceptance/bundle/resources/jobs/remote_delete/deploy/script
@@ -1,7 +1,12 @@
+# The raw plans the replays read go under .databricks, which sync skips.
+mkdir -p .databricks
+
 trace $CLI bundle plan
 trace $CLI bundle deploy
+replace_ids.py
 job_id=`$CLI bundle summary -o json | jq -r .resources.jobs.foo.id`
 trace $CLI jobs delete $job_id
 trace $CLI bundle plan
-$CLI bundle plan -o json &> out.plan.$DATABRICKS_BUNDLE_ENGINE.json
-$CLI bundle deploy $(readplanarg out.plan.direct.json)
+$CLI bundle plan -o json &> .databricks/tmp.plan.json
+nostamp < .databricks/tmp.plan.json > out.plan.json
+$CLI bundle deploy $(readplanarg .databricks/tmp.plan.json)
diff --git a/acceptance/bundle/resources/jobs/remote_delete/destroy/out.destroy.direct.txt b/acceptance/bundle/resources/jobs/remote_delete/destroy/out.destroy.direct.txt
deleted file mode 100644
index 1cea8f06419..00000000000
--- a/acceptance/bundle/resources/jobs/remote_delete/destroy/out.destroy.direct.txt
+++ /dev/null
@@ -1,6 +0,0 @@
-
->>> errcode [CLI] bundle destroy --auto-approve
-All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
-
-Deleting files...
-Destroy complete!
diff --git a/acceptance/bundle/resources/jobs/remote_delete/destroy/out.destroy.terraform.txt b/acceptance/bundle/resources/jobs/remote_delete/destroy/out.destroy.terraform.txt
deleted file mode 100644
index 1cea8f06419..00000000000
--- a/acceptance/bundle/resources/jobs/remote_delete/destroy/out.destroy.terraform.txt
+++ /dev/null
@@ -1,6 +0,0 @@
-
->>> errcode [CLI] bundle destroy --auto-approve
-All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
-
-Deleting files...
-Destroy complete!
diff --git a/acceptance/bundle/resources/jobs/remote_delete/destroy/out.test.toml b/acceptance/bundle/resources/jobs/remote_delete/destroy/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/jobs/remote_delete/destroy/out.test.toml
+++ b/acceptance/bundle/resources/jobs/remote_delete/destroy/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/jobs/remote_delete/destroy/output.txt b/acceptance/bundle/resources/jobs/remote_delete/destroy/output.txt
index 22db73b5b5b..e1d70157918 100644
--- a/acceptance/bundle/resources/jobs/remote_delete/destroy/output.txt
+++ b/acceptance/bundle/resources/jobs/remote_delete/destroy/output.txt
@@ -6,8 +6,13 @@ Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.foo
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
->>> [CLI] jobs delete [NUMID]
+>>> [CLI] jobs delete [FOO_ID]
+
+>>> errcode [CLI] bundle destroy --auto-approve
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Destroy: 0 deleted
diff --git a/acceptance/bundle/resources/jobs/remote_delete/destroy/script b/acceptance/bundle/resources/jobs/remote_delete/destroy/script
index f50be749359..a77232ebf39 100644
--- a/acceptance/bundle/resources/jobs/remote_delete/destroy/script
+++ b/acceptance/bundle/resources/jobs/remote_delete/destroy/script
@@ -1,5 +1,5 @@
 trace $CLI bundle plan
 trace $CLI bundle deploy
-job_id=`$CLI bundle summary -o json | jq -r .resources.jobs.foo.id`
+job_id=$(read_id.py foo)
 trace $CLI jobs delete $job_id
-trace errcode $CLI bundle destroy --auto-approve &> out.destroy.$DATABRICKS_BUNDLE_ENGINE.txt
+trace errcode $CLI bundle destroy --auto-approve
diff --git a/acceptance/bundle/resources/jobs/remote_delete/removed_from_config/bar.py b/acceptance/bundle/resources/jobs/remote_delete/removed_from_config/bar.py
new file mode 100644
index 00000000000..11b15b1a458
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/remote_delete/removed_from_config/bar.py
@@ -0,0 +1 @@
+print("hello")
diff --git a/acceptance/bundle/resources/jobs/remote_delete/removed_from_config/databricks.yml b/acceptance/bundle/resources/jobs/remote_delete/removed_from_config/databricks.yml
new file mode 100644
index 00000000000..fc261e691b6
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/remote_delete/removed_from_config/databricks.yml
@@ -0,0 +1,14 @@
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    foo:
+      name: foo
+
+  pipelines:
+    bar:
+      name: bar
+      libraries:
+        - file:
+            path: ./bar.py
diff --git a/acceptance/bundle/resources/jobs/remote_delete/removed_from_config/empty.yml b/acceptance/bundle/resources/jobs/remote_delete/removed_from_config/empty.yml
new file mode 100644
index 00000000000..f12a8955927
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/remote_delete/removed_from_config/empty.yml
@@ -0,0 +1,4 @@
+bundle:
+  name: test-bundle
+
+resources: {}
diff --git a/acceptance/bundle/resources/jobs/remote_delete/removed_from_config/out.deploy_removed.txt b/acceptance/bundle/resources/jobs/remote_delete/removed_from_config/out.deploy_removed.txt
new file mode 100644
index 00000000000..be8b0698ea5
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/remote_delete/removed_from_config/out.deploy_removed.txt
@@ -0,0 +1,5 @@
+
+>>> [CLI] bundle deploy --auto-approve
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Files: 4 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
diff --git a/acceptance/bundle/resources/jobs/remote_delete/removed_from_config/out.plan_removed.txt b/acceptance/bundle/resources/jobs/remote_delete/removed_from_config/out.plan_removed.txt
new file mode 100644
index 00000000000..ed49fd178e0
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/remote_delete/removed_from_config/out.plan_removed.txt
@@ -0,0 +1,3 @@
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 0 unchanged
diff --git a/acceptance/bundle/resources/jobs/remote_delete/removed_from_config/out.summary.txt b/acceptance/bundle/resources/jobs/remote_delete/removed_from_config/out.summary.txt
new file mode 100644
index 00000000000..e5b5bae68fe
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/remote_delete/removed_from_config/out.summary.txt
@@ -0,0 +1,8 @@
+
+>>> [CLI] bundle summary
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+Resources:
diff --git a/acceptance/bundle/resources/jobs/remote_delete/removed_from_config/out.test.toml b/acceptance/bundle/resources/jobs/remote_delete/removed_from_config/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/remote_delete/removed_from_config/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/jobs/remote_delete/removed_from_config/output.txt b/acceptance/bundle/resources/jobs/remote_delete/removed_from_config/output.txt
new file mode 100644
index 00000000000..8421384be39
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/remote_delete/removed_from_config/output.txt
@@ -0,0 +1,24 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created jobs.foo
+Created pipelines.bar
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] jobs delete [FOO_ID]
+
+>>> [CLI] pipelines delete [UUID]
+
+=== Remove resources from config, plan and deploy
+=== Plan and deploy again, then summary
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 0 unchanged
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
+
+=== No delete API calls for resources that are already gone remotely
+>>> print_requests.py //jobs/delete //pipelines/ --nostamp
diff --git a/acceptance/bundle/resources/jobs/remote_delete/removed_from_config/script b/acceptance/bundle/resources/jobs/remote_delete/removed_from_config/script
new file mode 100644
index 00000000000..eb7308ce7fd
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/remote_delete/removed_from_config/script
@@ -0,0 +1,21 @@
+trace $CLI bundle deploy
+job_id=$(read_id.py foo)
+pipeline_id=`$CLI bundle summary -o json | jq -r .resources.pipelines.bar.id`
+trace $CLI jobs delete $job_id
+trace $CLI pipelines delete $pipeline_id
+
+title "Remove resources from config, plan and deploy"
+# Engines diverge: direct plans deletes for the stale state entries; terraform keeps them in state, so its summary still lists them.
+cp empty.yml databricks.yml
+# Drain requests recorded so far; only requests made after the config removal matter below.
+print_requests.py --get // &> LOG.requests_setup
+trace $CLI bundle plan &> out.plan_removed.txt
+trace $CLI bundle deploy --auto-approve &> out.deploy_removed.txt
+
+title "Plan and deploy again, then summary"
+trace $CLI bundle plan
+trace $CLI bundle deploy
+trace $CLI bundle summary &> out.summary.txt
+
+title "No delete API calls for resources that are already gone remotely"
+trace print_requests.py //jobs/delete //pipelines/ --nostamp
diff --git a/acceptance/bundle/resources/jobs/remote_delete/removed_from_config/test.toml b/acceptance/bundle/resources/jobs/remote_delete/removed_from_config/test.toml
new file mode 100644
index 00000000000..159efe02696
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/remote_delete/removed_from_config/test.toml
@@ -0,0 +1 @@
+RecordRequests = true
diff --git a/acceptance/bundle/resources/jobs/remote_matches_config/out.plan.direct.json b/acceptance/bundle/resources/jobs/remote_matches_config/out.plan.direct.json
deleted file mode 100644
index 448eafd5d31..00000000000
--- a/acceptance/bundle/resources/jobs/remote_matches_config/out.plan.direct.json
+++ /dev/null
@@ -1,119 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.jobs.my_job": {
-      "action": "skip",
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-        },
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_id": [MY_JOB_ID],
-        "max_concurrent_runs": 2,
-        "name": "Test Job for Conflict Detection",
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "tags": {
-          "environment": "dev"
-        },
-        "tasks": [
-          {
-            "email_notifications": {},
-            "new_cluster": {
-              "aws_attributes": {
-                "availability": "SPOT_WITH_FALLBACK",
-                "zone_id": "us-east-1c"
-              },
-              "data_security_mode": "SINGLE_USER",
-              "enable_elastic_disk": false,
-              "node_type_id": "[NODE_TYPE_ID]",
-              "num_workers": 1,
-              "spark_version": "13.3.x-scala2.12"
-            },
-            "notebook_task": {
-              "notebook_path": "/Users/{{workspace_user_name}}/test_notebook",
-              "source": "WORKSPACE"
-            },
-            "run_if": "ALL_SUCCESS",
-            "task_key": "main_task",
-            "timeout_seconds": 0
-          }
-        ],
-        "timeout_seconds": 0,
-        "webhook_notifications": {}
-      },
-      "changes": {
-        "email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "max_concurrent_runs": {
-          "action": "skip",
-          "reason": "remote_already_set",
-          "old": 1,
-          "new": 2,
-          "remote": 2
-        },
-        "tasks[task_key='main_task'].email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks[task_key='main_task'].new_cluster.aws_attributes": {
-          "action": "skip",
-          "reason": "managed",
-          "remote": {
-            "availability": "SPOT_WITH_FALLBACK",
-            "zone_id": "us-east-1c"
-          }
-        },
-        "tasks[task_key='main_task'].new_cluster.data_security_mode": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "SINGLE_USER"
-        },
-        "tasks[task_key='main_task'].new_cluster.enable_elastic_disk": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": false
-        },
-        "tasks[task_key='main_task'].notebook_task.source": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "WORKSPACE"
-        },
-        "tasks[task_key='main_task'].run_if": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "ALL_SUCCESS"
-        },
-        "tasks[task_key='main_task'].timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "webhook_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/jobs/remote_matches_config/out.plan.json b/acceptance/bundle/resources/jobs/remote_matches_config/out.plan.json
new file mode 100644
index 00000000000..a1c295b4715
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/remote_matches_config/out.plan.json
@@ -0,0 +1,119 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.jobs.my_job": {
+      "action": "skip",
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_id": [MY_JOB_ID],
+        "max_concurrent_runs": 2,
+        "name": "Test Job for Conflict Detection",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "tags": {
+          "environment": "dev"
+        },
+        "tasks": [
+          {
+            "email_notifications": {},
+            "new_cluster": {
+              "aws_attributes": {
+                "availability": "SPOT_WITH_FALLBACK",
+                "zone_id": "us-east-1c"
+              },
+              "data_security_mode": "SINGLE_USER",
+              "enable_elastic_disk": false,
+              "node_type_id": "[NODE_TYPE_ID]",
+              "num_workers": 1,
+              "spark_version": "13.3.x-scala2.12"
+            },
+            "notebook_task": {
+              "notebook_path": "/Users/{{workspace_user_name}}/test_notebook",
+              "source": "WORKSPACE"
+            },
+            "run_if": "ALL_SUCCESS",
+            "task_key": "main_task",
+            "timeout_seconds": 0
+          }
+        ],
+        "timeout_seconds": 0,
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "max_concurrent_runs": {
+          "action": "skip",
+          "reason": "remote_already_set",
+          "old": 1,
+          "new": 2,
+          "remote": 2
+        },
+        "tasks[task_key='main_task'].email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='main_task'].new_cluster.aws_attributes": {
+          "action": "skip",
+          "reason": "managed",
+          "remote": {
+            "availability": "SPOT_WITH_FALLBACK",
+            "zone_id": "us-east-1c"
+          }
+        },
+        "tasks[task_key='main_task'].new_cluster.data_security_mode": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": "SINGLE_USER"
+        },
+        "tasks[task_key='main_task'].new_cluster.enable_elastic_disk": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": false
+        },
+        "tasks[task_key='main_task'].notebook_task.source": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": "WORKSPACE"
+        },
+        "tasks[task_key='main_task'].run_if": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": "ALL_SUCCESS"
+        },
+        "tasks[task_key='main_task'].timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/jobs/remote_matches_config/out.plan.terraform.json b/acceptance/bundle/resources/jobs/remote_matches_config/out.plan.terraform.json
deleted file mode 100644
index bc95d9ad4a2..00000000000
--- a/acceptance/bundle/resources/jobs/remote_matches_config/out.plan.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.my_job": {
-      "action": "skip"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/jobs/remote_matches_config/out.test.toml b/acceptance/bundle/resources/jobs/remote_matches_config/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/jobs/remote_matches_config/out.test.toml
+++ b/acceptance/bundle/resources/jobs/remote_matches_config/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/jobs/remote_matches_config/output.txt b/acceptance/bundle/resources/jobs/remote_matches_config/output.txt
index a067a141773..18763b94677 100644
--- a/acceptance/bundle/resources/jobs/remote_matches_config/output.txt
+++ b/acceptance/bundle/resources/jobs/remote_matches_config/output.txt
@@ -4,9 +4,9 @@ create jobs.my_job
 
 Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.my_job
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle plan
 Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
@@ -19,8 +19,7 @@ Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
 
->>> print_requests.py //jobs
+>>> print_requests.py //jobs --nostamp
diff --git a/acceptance/bundle/resources/jobs/remote_matches_config/script b/acceptance/bundle/resources/jobs/remote_matches_config/script
index 44a0eb849fe..3b3b62ad4a1 100755
--- a/acceptance/bundle/resources/jobs/remote_matches_config/script
+++ b/acceptance/bundle/resources/jobs/remote_matches_config/script
@@ -13,9 +13,9 @@ r["max_concurrent_runs"] = 2
 EOF
 
 trace $CLI bundle plan
-$CLI bundle plan -o json > out.plan.$DATABRICKS_BUNDLE_ENGINE.json
+$CLI bundle plan -o json | nostamp > out.plan.json
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
 # XXX READPLAN
 trace $CLI bundle deploy
-trace print_requests.py //jobs
+trace print_requests.py //jobs --nostamp
diff --git a/acceptance/bundle/resources/jobs/request-summary/databricks.yml b/acceptance/bundle/resources/jobs/request-summary/databricks.yml
new file mode 100644
index 00000000000..39117c19876
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/request-summary/databricks.yml
@@ -0,0 +1,7 @@
+bundle:
+  name: request-summary
+
+resources:
+  jobs:
+    foo:
+      name: foo
diff --git a/acceptance/bundle/resources/jobs/request-summary/out.test.toml b/acceptance/bundle/resources/jobs/request-summary/out.test.toml
new file mode 100644
index 00000000000..2ab253adc73
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/request-summary/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = []
diff --git a/acceptance/bundle/resources/jobs/request-summary/output.txt b/acceptance/bundle/resources/jobs/request-summary/output.txt
new file mode 100644
index 00000000000..0f0514c2e5c
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/request-summary/output.txt
@@ -0,0 +1,87 @@
+
+>>> [CLI] bundle plan
+create jobs.foo
+
+Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
+
+>>> print_requests
+GET /.well-known/databricks-config
+GET /api/2.0/preview/scim/v2/Me
+GET /api/2.0/workspace/export direct_download=true path=/Workspace/Users/[USERNAME]/.bundle/request-summary/default/state/deployment.json
+GET /api/2.0/workspace/export direct_download=true path=/Workspace/Users/[USERNAME]/.bundle/request-summary/default/state/resources.json
+GET /api/2.0/workspace/export direct_download=true path=/Workspace/Users/[USERNAME]/.bundle/request-summary/default/state/terraform.tfstate
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/request-summary/default/files...
+Created jobs.foo
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests
+GET /api/2.0/workspace/export direct_download=true path=/Workspace/Users/[USERNAME]/.bundle/request-summary/default/state/deploy.lock
+GET /api/2.0/workspace/export direct_download=true path=/Workspace/Users/[USERNAME]/.bundle/request-summary/default/state/deploy.lock
+GET /api/2.0/workspace/export direct_download=true path=/Workspace/Users/[USERNAME]/.bundle/request-summary/default/state/deployment.json
+GET /api/2.0/workspace/export direct_download=true path=/Workspace/Users/[USERNAME]/.bundle/request-summary/default/state/resources.json
+GET /api/2.0/workspace/export direct_download=true path=/Workspace/Users/[USERNAME]/.bundle/request-summary/default/state/terraform.tfstate
+GET /api/2.0/workspace/get-status path=/Workspace/Users/[USERNAME]/.bundle/request-summary/default/files
+GET /api/2.0/workspace/get-status path=/Workspace/Users/[USERNAME]/.bundle/request-summary/default/files
+GET /api/2.0/workspace/get-status path=/Workspace/Users/[USERNAME]/.bundle/request-summary/default/state/deploy.lock return_export_info=true
+GET /api/2.0/workspace/get-status path=/Workspace/Users/[USERNAME]/.bundle/request-summary/default/state/deploy.lock return_export_info=true
+GET /api/2.0/workspace/get-status path=/Workspace/Users/[USERNAME]/.bundle/request-summary/default/state/deploy.lock return_export_info=true
+POST /api/2.0/workspace/delete
+POST /api/2.0/workspace/delete
+POST /api/2.0/workspace/import
+POST /api/2.0/workspace/import
+POST /api/2.0/workspace/import
+POST /api/2.0/workspace/import
+POST /api/2.0/workspace/import
+POST /api/2.0/workspace/import
+POST /api/2.0/workspace/mkdirs
+POST /api/2.0/workspace/mkdirs
+POST /api/2.0/workspace/mkdirs
+POST /api/2.2/jobs/create
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/request-summary/default/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
+
+>>> print_requests
+GET /api/2.0/workspace/export direct_download=true path=/Workspace/Users/[USERNAME]/.bundle/request-summary/default/state/deploy.lock
+GET /api/2.0/workspace/export direct_download=true path=/Workspace/Users/[USERNAME]/.bundle/request-summary/default/state/deploy.lock
+GET /api/2.0/workspace/export direct_download=true path=/Workspace/Users/[USERNAME]/.bundle/request-summary/default/state/deployment.json
+GET /api/2.0/workspace/export direct_download=true path=/Workspace/Users/[USERNAME]/.bundle/request-summary/default/state/resources.json
+GET /api/2.0/workspace/export direct_download=true path=/Workspace/Users/[USERNAME]/.bundle/request-summary/default/state/terraform.tfstate
+GET /api/2.0/workspace/get-status path=/Workspace/Users/[USERNAME]/.bundle/request-summary/default/files
+GET /api/2.0/workspace/get-status path=/Workspace/Users/[USERNAME]/.bundle/request-summary/default/state/deploy.lock return_export_info=true
+GET /api/2.0/workspace/get-status path=/Workspace/Users/[USERNAME]/.bundle/request-summary/default/state/deploy.lock return_export_info=true
+GET /api/2.0/workspace/get-status path=/Workspace/Users/[USERNAME]/.bundle/request-summary/default/state/deploy.lock return_export_info=true
+GET /api/2.2/jobs/get job_id=[FOO_ID]
+POST /api/2.0/workspace/delete
+POST /api/2.0/workspace/delete
+POST /api/2.0/workspace/import
+POST /api/2.0/workspace/import
+POST /api/2.0/workspace/import
+POST /api/2.0/workspace/import
+POST /api/2.0/workspace/mkdirs
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.foo
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/request-summary/default
+
+Destroy: 1 deleted
+
+>>> print_requests
+GET /api/2.0/workspace/export direct_download=true path=/Workspace/Users/[USERNAME]/.bundle/request-summary/default/state/deploy.lock
+GET /api/2.0/workspace/export direct_download=true path=/Workspace/Users/[USERNAME]/.bundle/request-summary/default/state/resources.json
+GET /api/2.0/workspace/export direct_download=true path=/Workspace/Users/[USERNAME]/.bundle/request-summary/default/state/terraform.tfstate
+GET /api/2.0/workspace/get-status path=/Workspace/Users/[USERNAME]/.bundle/request-summary/default
+GET /api/2.0/workspace/get-status path=/Workspace/Users/[USERNAME]/.bundle/request-summary/default/state/deploy.lock return_export_info=true
+GET /api/2.0/workspace/get-status path=/Workspace/Users/[USERNAME]/.bundle/request-summary/default/state/deploy.lock return_export_info=true
+GET /api/2.2/jobs/get job_id=[FOO_ID]
+POST /api/2.0/workspace/delete
+POST /api/2.0/workspace/delete
+POST /api/2.0/workspace/import
+POST /api/2.2/jobs/delete
diff --git a/acceptance/bundle/resources/jobs/request-summary/script b/acceptance/bundle/resources/jobs/request-summary/script
new file mode 100644
index 00000000000..da096c0586f
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/request-summary/script
@@ -0,0 +1,20 @@
+# Every request each command makes, workspace file calls included, so a change in the
+# number of API calls shows up here. Sorted because state files and bundle files are
+# read and uploaded concurrently.
+print_requests() {
+    print_requests.py --get --summary --sort '^//telemetry-ext'
+}
+
+trace $CLI bundle plan
+trace print_requests
+
+trace $CLI bundle deploy
+read_id.py foo > /dev/null
+trace print_requests
+
+# State now exists remotely, so this deploy reads it back.
+trace $CLI bundle deploy
+trace print_requests
+
+trace $CLI bundle destroy --auto-approve
+trace print_requests
diff --git a/acceptance/bundle/resources/jobs/request-summary/test.toml b/acceptance/bundle/resources/jobs/request-summary/test.toml
new file mode 100644
index 00000000000..10ff66a420e
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/request-summary/test.toml
@@ -0,0 +1,2 @@
+# Deployment history adds its own lookups; this test pins down the plain state reads.
+EnvMatrix.DMS = []
diff --git a/acceptance/bundle/resources/jobs/shared-root-path/out.test.toml b/acceptance/bundle/resources/jobs/shared-root-path/out.test.toml
index e5a4c7283a6..98ccab9aaeb 100644
--- a/acceptance/bundle/resources/jobs/shared-root-path/out.test.toml
+++ b/acceptance/bundle/resources/jobs/shared-root-path/out.test.toml
@@ -1,4 +1,3 @@
-Local = false
 Cloud = true
 RunsOnDbr = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/jobs/shared-root-path/output.txt b/acceptance/bundle/resources/jobs/shared-root-path/output.txt
index b485c092416..6fa301ba223 100644
--- a/acceptance/bundle/resources/jobs/shared-root-path/output.txt
+++ b/acceptance/bundle/resources/jobs/shared-root-path/output.txt
@@ -5,9 +5,24 @@ Warning: the bundle root path /Workspace/Shared/[USERNAME]/.bundle/[UNIQUE_NAME]
 The bundle is configured to use /Workspace/Shared, which will give read/write access to all users. If this is intentional, add CAN_MANAGE for 'group_name: users' permission to your bundle configuration. If the deployment should be restricted, move it to a restricted folder such as /Workspace/Users/<username or principal name>.
 
 Uploading bundle files to /Workspace/Shared/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.foo
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] bundle deploy -q
+Warning: the bundle root path /Workspace/Shared/[USERNAME]/.bundle/[UNIQUE_NAME] is writable by all workspace users
+
+The bundle is configured to use /Workspace/Shared, which will give read/write access to all users. If this is intentional, add CAN_MANAGE for 'group_name: users' permission to your bundle configuration. If the deployment should be restricted, move it to a restricted folder such as /Workspace/Users/<username or principal name>.
+
+Uploading bundle files to /Workspace/Shared/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
+
+>>> [CLI] bundle deploy -qq
+Warning: the bundle root path /Workspace/Shared/[USERNAME]/.bundle/[UNIQUE_NAME] is writable by all workspace users
+
+The bundle is configured to use /Workspace/Shared, which will give read/write access to all users. If this is intentional, add CAN_MANAGE for 'group_name: users' permission to your bundle configuration. If the deployment should be restricted, move it to a restricted folder such as /Workspace/Users/<username or principal name>.
+
 
 >>> [CLI] bundle destroy --auto-approve
 Warning: the bundle root path /Workspace/Shared/[USERNAME]/.bundle/[UNIQUE_NAME] is writable by all workspace users
@@ -19,5 +34,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Shared/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/jobs/shared-root-path/script b/acceptance/bundle/resources/jobs/shared-root-path/script
index ac679ac5049..4e3e46c9300 100644
--- a/acceptance/bundle/resources/jobs/shared-root-path/script
+++ b/acceptance/bundle/resources/jobs/shared-root-path/script
@@ -6,3 +6,7 @@ cleanup() {
 trap cleanup EXIT
 
 trace $CLI bundle deploy
+
+# -q and -qq reduce the summary but must not hide the root-path warning.
+trace $CLI bundle deploy -q
+trace $CLI bundle deploy -qq
diff --git a/acceptance/bundle/resources/jobs/shared-root-path/test.toml b/acceptance/bundle/resources/jobs/shared-root-path/test.toml
index aec93687714..4d77b7783c8 100644
--- a/acceptance/bundle/resources/jobs/shared-root-path/test.toml
+++ b/acceptance/bundle/resources/jobs/shared-root-path/test.toml
@@ -1,4 +1,3 @@
-Local = false
 Cloud = true
 RecordRequests = false
 RunsOnDbr = true
diff --git a/acceptance/bundle/resources/jobs/tags_empty_map/out.plan.direct.json b/acceptance/bundle/resources/jobs/tags_empty_map/out.plan.json
similarity index 100%
rename from acceptance/bundle/resources/jobs/tags_empty_map/out.plan.direct.json
rename to acceptance/bundle/resources/jobs/tags_empty_map/out.plan.json
diff --git a/acceptance/bundle/resources/jobs/tags_empty_map/out.plan.terraform.json b/acceptance/bundle/resources/jobs/tags_empty_map/out.plan.terraform.json
deleted file mode 100644
index 4d132856f14..00000000000
--- a/acceptance/bundle/resources/jobs/tags_empty_map/out.plan.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.test_job": {
-      "action": "skip"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/jobs/tags_empty_map/out.test.toml b/acceptance/bundle/resources/jobs/tags_empty_map/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/jobs/tags_empty_map/out.test.toml
+++ b/acceptance/bundle/resources/jobs/tags_empty_map/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/jobs/tags_empty_map/output.txt b/acceptance/bundle/resources/jobs/tags_empty_map/output.txt
index 8ad5b060216..7fb553048af 100644
--- a/acceptance/bundle/resources/jobs/tags_empty_map/output.txt
+++ b/acceptance/bundle/resources/jobs/tags_empty_map/output.txt
@@ -6,8 +6,8 @@ Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/tags_empty_map/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.test_job
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle plan -o json
diff --git a/acceptance/bundle/resources/jobs/tags_empty_map/script b/acceptance/bundle/resources/jobs/tags_empty_map/script
index 61ebb0a9139..5708cef5ecb 100644
--- a/acceptance/bundle/resources/jobs/tags_empty_map/script
+++ b/acceptance/bundle/resources/jobs/tags_empty_map/script
@@ -1,3 +1,3 @@
 trace $CLI bundle plan
 trace $CLI bundle deploy
-trace $CLI bundle plan -o json | jq '.plan."resources.jobs.test_job".changes // .' > out.plan.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp | jq '.plan."resources.jobs.test_job".changes // .' > out.plan.json
diff --git a/acceptance/bundle/resources/jobs/task-source/out.git_job.direct.txt b/acceptance/bundle/resources/jobs/task-source/out.git_job.direct.txt
deleted file mode 100644
index 2dbb66f900d..00000000000
--- a/acceptance/bundle/resources/jobs/task-source/out.git_job.direct.txt
+++ /dev/null
@@ -1,172 +0,0 @@
-{
-  "deployment": {
-    "kind": "BUNDLE",
-    "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/task-source/default/state/metadata.json"
-  },
-  "edit_mode": "UI_LOCKED",
-  "format": "MULTI_TASK",
-  "git_source": {
-    "git_branch": "main",
-    "git_provider": "github",
-    "git_url": "https://github.com/databricks/cli.git"
-  },
-  "max_concurrent_runs": 1,
-  "name": "git_job",
-  "queue": {
-    "enabled": true
-  },
-  "tasks": [
-    {
-      "dbt_task": {
-        "commands": [
-          "dbt run"
-        ],
-        "project_directory": "./dbt_project"
-      },
-      "new_cluster": {
-        "custom_tags": {
-          "ResourceClass": "SingleNode"
-        },
-        "num_workers": 0,
-        "spark_conf": {
-          "spark.databricks.cluster.profile": "singleNode",
-          "spark.master": "local[*]"
-        },
-        "spark_version": "15.4.x-scala2.12"
-      },
-      "task_key": "test_task_dbt"
-    },
-    {
-      "for_each_task": {
-        "inputs": "[1]",
-        "task": {
-          "notebook_task": {
-            "notebook_path": "./notebook.py"
-          },
-          "task_key": "test_task_foreach_no_source"
-        }
-      },
-      "task_key": "test_task_foreach_no_source"
-    },
-    {
-      "for_each_task": {
-        "inputs": "[1]",
-        "task": {
-          "notebook_task": {
-            "notebook_path": "./notebook.py",
-            "source": "WORKSPACE"
-          },
-          "task_key": "test_task_foreach_workspace"
-        }
-      },
-      "task_key": "test_task_foreach_workspace"
-    },
-    {
-      "notebook_task": {
-        "notebook_path": "./notebook.py"
-      },
-      "task_key": "test_task_no_source"
-    },
-    {
-      "notebook_task": {
-        "notebook_path": "./notebook.py",
-        "source": "WORKSPACE"
-      },
-      "task_key": "test_task_source_workspace"
-    },
-    {
-      "sql_task": {
-        "file": {
-          "path": "./sql.sql"
-        },
-        "warehouse_id": "cafef00d"
-      },
-      "task_key": "test_task_sql"
-    }
-  ]
-}
-{
-  "job_id": [NUMID],
-  "new_settings": {
-    "deployment": {
-      "kind": "BUNDLE",
-      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/task-source/default/state/metadata.json"
-    },
-    "edit_mode": "UI_LOCKED",
-    "format": "MULTI_TASK",
-    "max_concurrent_runs": 1,
-    "name": "git_job",
-    "queue": {
-      "enabled": true
-    },
-    "tasks": [
-      {
-        "dbt_task": {
-          "commands": [
-            "dbt run"
-          ],
-          "project_directory": "/Workspace/Users/[USERNAME]/.bundle/task-source/default/files/dbt_project"
-        },
-        "new_cluster": {
-          "custom_tags": {
-            "ResourceClass": "SingleNode"
-          },
-          "num_workers": 0,
-          "spark_conf": {
-            "spark.databricks.cluster.profile": "singleNode",
-            "spark.master": "local[*]"
-          },
-          "spark_version": "15.4.x-scala2.12"
-        },
-        "task_key": "test_task_dbt"
-      },
-      {
-        "for_each_task": {
-          "inputs": "[1]",
-          "task": {
-            "notebook_task": {
-              "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/task-source/default/files/notebook"
-            },
-            "task_key": "test_task_foreach_no_source"
-          }
-        },
-        "task_key": "test_task_foreach_no_source"
-      },
-      {
-        "for_each_task": {
-          "inputs": "[1]",
-          "task": {
-            "notebook_task": {
-              "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/task-source/default/files/notebook",
-              "source": "WORKSPACE"
-            },
-            "task_key": "test_task_foreach_workspace"
-          }
-        },
-        "task_key": "test_task_foreach_workspace"
-      },
-      {
-        "notebook_task": {
-          "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/task-source/default/files/notebook"
-        },
-        "task_key": "test_task_no_source"
-      },
-      {
-        "notebook_task": {
-          "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/task-source/default/files/notebook",
-          "source": "WORKSPACE"
-        },
-        "task_key": "test_task_source_workspace"
-      },
-      {
-        "sql_task": {
-          "file": {
-            "path": "/Workspace/Users/[USERNAME]/.bundle/task-source/default/files/sql.sql"
-          },
-          "warehouse_id": "cafef00d"
-        },
-        "task_key": "test_task_sql"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/jobs/task-source/out.git_job.terraform.txt b/acceptance/bundle/resources/jobs/task-source/out.git_job.terraform.txt
deleted file mode 100644
index c1bd5634456..00000000000
--- a/acceptance/bundle/resources/jobs/task-source/out.git_job.terraform.txt
+++ /dev/null
@@ -1,204 +0,0 @@
-{
-  "deployment": {
-    "kind": "BUNDLE",
-    "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/task-source/default/state/metadata.json"
-  },
-  "edit_mode": "UI_LOCKED",
-  "format": "MULTI_TASK",
-  "git_source": {
-    "git_branch": "main",
-    "git_provider": "github",
-    "git_url": "https://github.com/databricks/cli.git"
-  },
-  "max_concurrent_runs": 1,
-  "name": "git_job",
-  "queue": {
-    "enabled": true
-  },
-  "tasks": [
-    {
-      "dbt_task": {
-        "commands": [
-          "dbt run"
-        ],
-        "project_directory": "./dbt_project",
-        "schema": "default",
-        "source": "GIT"
-      },
-      "new_cluster": {
-        "custom_tags": {
-          "ResourceClass": "SingleNode"
-        },
-        "num_workers": 0,
-        "spark_conf": {
-          "spark.databricks.cluster.profile": "singleNode",
-          "spark.master": "local[*]"
-        },
-        "spark_version": "15.4.x-scala2.12"
-      },
-      "task_key": "test_task_dbt"
-    },
-    {
-      "for_each_task": {
-        "inputs": "[1]",
-        "task": {
-          "notebook_task": {
-            "notebook_path": "./notebook.py",
-            "source": "GIT"
-          },
-          "task_key": "test_task_foreach_no_source"
-        }
-      },
-      "task_key": "test_task_foreach_no_source"
-    },
-    {
-      "for_each_task": {
-        "inputs": "[1]",
-        "task": {
-          "notebook_task": {
-            "notebook_path": "./notebook.py",
-            "source": "WORKSPACE"
-          },
-          "task_key": "test_task_foreach_workspace"
-        }
-      },
-      "task_key": "test_task_foreach_workspace"
-    },
-    {
-      "notebook_task": {
-        "notebook_path": "./notebook.py",
-        "source": "GIT"
-      },
-      "task_key": "test_task_no_source"
-    },
-    {
-      "notebook_task": {
-        "notebook_path": "./notebook.py",
-        "source": "WORKSPACE"
-      },
-      "task_key": "test_task_source_workspace"
-    },
-    {
-      "sql_task": {
-        "file": {
-          "path": "./sql.sql",
-          "source": "GIT"
-        },
-        "warehouse_id": "cafef00d"
-      },
-      "task_key": "test_task_sql"
-    }
-  ]
-}
-{
-  "job_id": [NUMID],
-  "new_settings": {
-    "deployment": {
-      "kind": "BUNDLE",
-      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/task-source/default/state/metadata.json"
-    },
-    "edit_mode": "UI_LOCKED",
-    "email_notifications": {},
-    "format": "MULTI_TASK",
-    "max_concurrent_runs": 1,
-    "name": "git_job",
-    "queue": {
-      "enabled": true
-    },
-    "run_as": {
-      "user_name": "[USERNAME]"
-    },
-    "tasks": [
-      {
-        "dbt_task": {
-          "commands": [
-            "dbt run"
-          ],
-          "project_directory": "/Workspace/Users/[USERNAME]/.bundle/task-source/default/files/dbt_project",
-          "schema": "default",
-          "source": "WORKSPACE"
-        },
-        "email_notifications": {},
-        "new_cluster": {
-          "aws_attributes": {
-            "availability": "SPOT_WITH_FALLBACK",
-            "zone_id": "us-east-1c"
-          },
-          "custom_tags": {
-            "ResourceClass": "SingleNode"
-          },
-          "data_security_mode": "SINGLE_USER",
-          "num_workers": 0,
-          "spark_conf": {
-            "spark.databricks.cluster.profile": "singleNode",
-            "spark.master": "local[*]"
-          },
-          "spark_version": "15.4.x-scala2.12"
-        },
-        "run_if": "ALL_SUCCESS",
-        "task_key": "test_task_dbt"
-      },
-      {
-        "email_notifications": {},
-        "for_each_task": {
-          "inputs": "[1]",
-          "task": {
-            "notebook_task": {
-              "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/task-source/default/files/notebook",
-              "source": "WORKSPACE"
-            },
-            "task_key": "test_task_foreach_no_source"
-          }
-        },
-        "run_if": "ALL_SUCCESS",
-        "task_key": "test_task_foreach_no_source"
-      },
-      {
-        "email_notifications": {},
-        "for_each_task": {
-          "inputs": "[1]",
-          "task": {
-            "notebook_task": {
-              "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/task-source/default/files/notebook",
-              "source": "WORKSPACE"
-            },
-            "task_key": "test_task_foreach_workspace"
-          }
-        },
-        "run_if": "ALL_SUCCESS",
-        "task_key": "test_task_foreach_workspace"
-      },
-      {
-        "email_notifications": {},
-        "notebook_task": {
-          "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/task-source/default/files/notebook",
-          "source": "WORKSPACE"
-        },
-        "run_if": "ALL_SUCCESS",
-        "task_key": "test_task_no_source"
-      },
-      {
-        "email_notifications": {},
-        "notebook_task": {
-          "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/task-source/default/files/notebook",
-          "source": "WORKSPACE"
-        },
-        "run_if": "ALL_SUCCESS",
-        "task_key": "test_task_source_workspace"
-      },
-      {
-        "email_notifications": {},
-        "run_if": "ALL_SUCCESS",
-        "sql_task": {
-          "file": {
-            "path": "/Workspace/Users/[USERNAME]/.bundle/task-source/default/files/sql.sql",
-            "source": "WORKSPACE"
-          },
-          "warehouse_id": "cafef00d"
-        },
-        "task_key": "test_task_sql"
-      }
-    ],
-    "webhook_notifications": {}
-  }
-}
diff --git a/acceptance/bundle/resources/jobs/task-source/out.git_job.txt b/acceptance/bundle/resources/jobs/task-source/out.git_job.txt
new file mode 100644
index 00000000000..0a9a22942c8
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/task-source/out.git_job.txt
@@ -0,0 +1,176 @@
+{
+  "deployment": {
+    "kind": "BUNDLE",
+    "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/task-source/default/state/metadata.json"
+  },
+  "edit_mode": "UI_LOCKED",
+  "format": "MULTI_TASK",
+  "git_source": {
+    "git_branch": "main",
+    "git_provider": "github",
+    "git_url": "https://github.com/databricks/cli.git"
+  },
+  "max_concurrent_runs": 1,
+  "name": "git_job",
+  "queue": {
+    "enabled": true
+  },
+  "tasks": [
+    {
+      "dbt_task": {
+        "commands": [
+          "dbt run"
+        ],
+        "project_directory": "./dbt_project",
+        "source": "GIT"
+      },
+      "new_cluster": {
+        "custom_tags": {
+          "ResourceClass": "SingleNode"
+        },
+        "num_workers": 0,
+        "spark_conf": {
+          "spark.databricks.cluster.profile": "singleNode",
+          "spark.master": "local[*]"
+        },
+        "spark_version": "15.4.x-scala2.12"
+      },
+      "task_key": "test_task_dbt"
+    },
+    {
+      "for_each_task": {
+        "inputs": "[1]",
+        "task": {
+          "notebook_task": {
+            "notebook_path": "./notebook.py",
+            "source": "GIT"
+          },
+          "task_key": "test_task_foreach_no_source"
+        }
+      },
+      "task_key": "test_task_foreach_no_source"
+    },
+    {
+      "for_each_task": {
+        "inputs": "[1]",
+        "task": {
+          "notebook_task": {
+            "notebook_path": "./notebook.py",
+            "source": "WORKSPACE"
+          },
+          "task_key": "test_task_foreach_workspace"
+        }
+      },
+      "task_key": "test_task_foreach_workspace"
+    },
+    {
+      "notebook_task": {
+        "notebook_path": "./notebook.py",
+        "source": "GIT"
+      },
+      "task_key": "test_task_no_source"
+    },
+    {
+      "notebook_task": {
+        "notebook_path": "./notebook.py",
+        "source": "WORKSPACE"
+      },
+      "task_key": "test_task_source_workspace"
+    },
+    {
+      "sql_task": {
+        "file": {
+          "path": "./sql.sql",
+          "source": "GIT"
+        },
+        "warehouse_id": "cafef00d"
+      },
+      "task_key": "test_task_sql"
+    }
+  ]
+}
+{
+  "job_id": [GIT_JOB_ID],
+  "new_settings": {
+    "deployment": {
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/task-source/default/state/metadata.json"
+    },
+    "edit_mode": "UI_LOCKED",
+    "format": "MULTI_TASK",
+    "max_concurrent_runs": 1,
+    "name": "git_job",
+    "queue": {
+      "enabled": true
+    },
+    "tasks": [
+      {
+        "dbt_task": {
+          "commands": [
+            "dbt run"
+          ],
+          "project_directory": "/Workspace/Users/[USERNAME]/.bundle/task-source/default/files/dbt_project"
+        },
+        "new_cluster": {
+          "custom_tags": {
+            "ResourceClass": "SingleNode"
+          },
+          "num_workers": 0,
+          "spark_conf": {
+            "spark.databricks.cluster.profile": "singleNode",
+            "spark.master": "local[*]"
+          },
+          "spark_version": "15.4.x-scala2.12"
+        },
+        "task_key": "test_task_dbt"
+      },
+      {
+        "for_each_task": {
+          "inputs": "[1]",
+          "task": {
+            "notebook_task": {
+              "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/task-source/default/files/notebook"
+            },
+            "task_key": "test_task_foreach_no_source"
+          }
+        },
+        "task_key": "test_task_foreach_no_source"
+      },
+      {
+        "for_each_task": {
+          "inputs": "[1]",
+          "task": {
+            "notebook_task": {
+              "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/task-source/default/files/notebook",
+              "source": "WORKSPACE"
+            },
+            "task_key": "test_task_foreach_workspace"
+          }
+        },
+        "task_key": "test_task_foreach_workspace"
+      },
+      {
+        "notebook_task": {
+          "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/task-source/default/files/notebook"
+        },
+        "task_key": "test_task_no_source"
+      },
+      {
+        "notebook_task": {
+          "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/task-source/default/files/notebook",
+          "source": "WORKSPACE"
+        },
+        "task_key": "test_task_source_workspace"
+      },
+      {
+        "sql_task": {
+          "file": {
+            "path": "/Workspace/Users/[USERNAME]/.bundle/task-source/default/files/sql.sql"
+          },
+          "warehouse_id": "cafef00d"
+        },
+        "task_key": "test_task_sql"
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/resources/jobs/task-source/out.test.toml b/acceptance/bundle/resources/jobs/task-source/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/jobs/task-source/out.test.toml
+++ b/acceptance/bundle/resources/jobs/task-source/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/jobs/task-source/out.workspace_job.terraform.txt b/acceptance/bundle/resources/jobs/task-source/out.workspace_job.terraform.txt
deleted file mode 100644
index de17310de77..00000000000
--- a/acceptance/bundle/resources/jobs/task-source/out.workspace_job.terraform.txt
+++ /dev/null
@@ -1,35 +0,0 @@
-{
-  "deployment": {
-    "kind": "BUNDLE",
-    "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/task-source/default/state/metadata.json"
-  },
-  "edit_mode": "UI_LOCKED",
-  "format": "MULTI_TASK",
-  "max_concurrent_runs": 1,
-  "name": "workspace_job",
-  "queue": {
-    "enabled": true
-  },
-  "tasks": [
-    {
-      "for_each_task": {
-        "inputs": "[1]",
-        "task": {
-          "notebook_task": {
-            "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/task-source/default/files/notebook",
-            "source": "WORKSPACE"
-          },
-          "task_key": "test_task_foreach_no_source"
-        }
-      },
-      "task_key": "test_task_foreach"
-    },
-    {
-      "notebook_task": {
-        "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/task-source/default/files/notebook",
-        "source": "WORKSPACE"
-      },
-      "task_key": "test_task_no_source"
-    }
-  ]
-}
diff --git a/acceptance/bundle/resources/jobs/task-source/out.workspace_job.direct.txt b/acceptance/bundle/resources/jobs/task-source/out.workspace_job.txt
similarity index 100%
rename from acceptance/bundle/resources/jobs/task-source/out.workspace_job.direct.txt
rename to acceptance/bundle/resources/jobs/task-source/out.workspace_job.txt
diff --git a/acceptance/bundle/resources/jobs/task-source/output.txt b/acceptance/bundle/resources/jobs/task-source/output.txt
index 1815edbc0eb..af8b71d6659 100644
--- a/acceptance/bundle/resources/jobs/task-source/output.txt
+++ b/acceptance/bundle/resources/jobs/task-source/output.txt
@@ -5,13 +5,14 @@ Warning: invalid value "github" for enum field. Valid values are [awsCodeCommit
   in databricks.yml:8:19
 
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/task-source/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.git_job
+Created jobs.workspace_job
+Files: 4 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
->>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | select(.body.name=="git_job") | .body out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | select(.body.name=="git_job") | .body | del(.deployment.deployment_id, .deployment.version_id) [OUTPUT_DIR]/out.requests.txt
 
->>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | select(.body.name=="workspace_job") | .body out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.2/jobs/create") | select(.body.name=="workspace_job") | .body | del(.deployment.deployment_id, .deployment.version_id) [OUTPUT_DIR]/out.requests.txt
 
 >>> [CLI] bundle plan
 update jobs.git_job
@@ -20,10 +21,10 @@ Plan: 0 to add, 1 to change, 0 to delete, 1 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/task-source/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated jobs.git_job
+Files: 3 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 1 unchanged
 
->>> jq -s .[] | select(.path=="/api/2.2/jobs/reset") | select(.body.new_settings.name=="git_job") | .body out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.2/jobs/reset") | select(.body.new_settings.name=="git_job") | .body | del(.new_settings.deployment.deployment_id, .new_settings.deployment.version_id) [OUTPUT_DIR]/out.requests.txt
 
->>> jq -s .[] | select(.path=="/api/2.2/jobs/reset") | select(.body.new_settings.name=="workspace_job") | .body out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.2/jobs/reset") | select(.body.new_settings.name=="workspace_job") | .body | del(.new_settings.deployment.deployment_id, .new_settings.deployment.version_id) [OUTPUT_DIR]/out.requests.txt
diff --git a/acceptance/bundle/resources/jobs/task-source/script b/acceptance/bundle/resources/jobs/task-source/script
index 838aac092c3..a1117297442 100644
--- a/acceptance/bundle/resources/jobs/task-source/script
+++ b/acceptance/bundle/resources/jobs/task-source/script
@@ -1,10 +1,11 @@
 trace $CLI bundle deploy
+replace_ids.py
 
 # For terraform we expect the task source to be explicitly set always
 # For direct we do not expect it to be set unless explicitly specified in the bundle config
-trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | select(.body.name=="git_job") | .body' out.requests.txt | jq --sort-keys > out.git_job.$DATABRICKS_BUNDLE_ENGINE.txt
-trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | select(.body.name=="workspace_job") | .body' out.requests.txt | jq --sort-keys > out.workspace_job.$DATABRICKS_BUNDLE_ENGINE.txt
-rm out.requests.txt
+trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | select(.body.name=="git_job") | .body | del(.deployment.deployment_id, .deployment.version_id)' "$OUT_REQUESTS" | jq --sort-keys > out.git_job.txt
+trace jq -s '.[] | select(.path=="/api/2.2/jobs/create") | select(.body.name=="workspace_job") | .body | del(.deployment.deployment_id, .deployment.version_id)' "$OUT_REQUESTS" | jq --sort-keys > out.workspace_job.txt
+rm "$OUT_REQUESTS"
 
 # Removing the git_source block and deploying again
 update_file.py databricks.yml '<<: *git_source' ''
@@ -13,7 +14,7 @@ trace $CLI bundle deploy
 
 # In direct mode update should not contain source unless explicitly specified in the bundle config
 # In terraform mode update should always contain source field
-trace jq -s '.[] | select(.path=="/api/2.2/jobs/reset") | select(.body.new_settings.name=="git_job") | .body' out.requests.txt | jq --sort-keys >> out.git_job.$DATABRICKS_BUNDLE_ENGINE.txt
-trace jq -s '.[] | select(.path=="/api/2.2/jobs/reset") | select(.body.new_settings.name=="workspace_job") | .body' out.requests.txt | jq --sort-keys >> out.workspace_job.$DATABRICKS_BUNDLE_ENGINE.txt
+trace jq -s '.[] | select(.path=="/api/2.2/jobs/reset") | select(.body.new_settings.name=="git_job") | .body | del(.new_settings.deployment.deployment_id, .new_settings.deployment.version_id)' "$OUT_REQUESTS" | jq --sort-keys >> out.git_job.txt
+trace jq -s '.[] | select(.path=="/api/2.2/jobs/reset") | select(.body.new_settings.name=="workspace_job") | .body | del(.new_settings.deployment.deployment_id, .new_settings.deployment.version_id)' "$OUT_REQUESTS" | jq --sort-keys >> out.workspace_job.txt
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/resources/jobs/task-source/test.toml b/acceptance/bundle/resources/jobs/task-source/test.toml
index 0657c49562c..7061886de47 100644
--- a/acceptance/bundle/resources/jobs/task-source/test.toml
+++ b/acceptance/bundle/resources/jobs/task-source/test.toml
@@ -1,3 +1,2 @@
 Cloud = false
-Local = true
 RecordRequests = true
diff --git a/acceptance/bundle/resources/jobs/tasks-reorder-locally/out.test.toml b/acceptance/bundle/resources/jobs/tasks-reorder-locally/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/jobs/tasks-reorder-locally/out.test.toml
+++ b/acceptance/bundle/resources/jobs/tasks-reorder-locally/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/jobs/tasks-reorder-locally/output.txt b/acceptance/bundle/resources/jobs/tasks-reorder-locally/output.txt
index 66ef56be745..08ee3f69510 100644
--- a/acceptance/bundle/resources/jobs/tasks-reorder-locally/output.txt
+++ b/acceptance/bundle/resources/jobs/tasks-reorder-locally/output.txt
@@ -6,9 +6,9 @@ Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.foo
+Files: 4 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle plan
 Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
@@ -18,9 +18,8 @@ Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
 
 >>> [CLI] bundle plan
 Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
diff --git a/acceptance/bundle/resources/jobs/update/out.plan_create.direct.json b/acceptance/bundle/resources/jobs/update/out.plan_create.direct.json
deleted file mode 100644
index 6385509c138..00000000000
--- a/acceptance/bundle/resources/jobs/update/out.plan_create.direct.json
+++ /dev/null
@@ -1,40 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.foo": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "job_clusters": [
-            {
-              "job_cluster_key": "key",
-              "new_cluster": {
-                "num_workers": 0,
-                "spark_version": "13.3.x-scala2.12"
-              }
-            }
-          ],
-          "max_concurrent_runs": 1,
-          "name": "foo",
-          "queue": {
-            "enabled": true
-          },
-          "trigger": {
-            "pause_status": "UNPAUSED",
-            "periodic": {
-              "interval": 1,
-              "unit": "DAYS"
-            }
-          }
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/jobs/update/out.plan_create.json b/acceptance/bundle/resources/jobs/update/out.plan_create.json
new file mode 100644
index 00000000000..d169b1f604f
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/update/out.plan_create.json
@@ -0,0 +1,40 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.jobs.foo": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "job_clusters": [
+            {
+              "job_cluster_key": "key",
+              "new_cluster": {
+                "num_workers": 0,
+                "spark_version": "13.3.x-scala2.12"
+              }
+            }
+          ],
+          "max_concurrent_runs": 1,
+          "name": "foo",
+          "queue": {
+            "enabled": true
+          },
+          "trigger": {
+            "pause_status": "UNPAUSED",
+            "periodic": {
+              "interval": 1,
+              "unit": "DAYS"
+            }
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/jobs/update/out.plan_create.terraform.json b/acceptance/bundle/resources/jobs/update/out.plan_create.terraform.json
deleted file mode 100644
index b1dce3fac0f..00000000000
--- a/acceptance/bundle/resources/jobs/update/out.plan_create.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.foo": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/jobs/update/out.plan_skip.direct.json b/acceptance/bundle/resources/jobs/update/out.plan_skip.direct.json
deleted file mode 100644
index ed8ef429444..00000000000
--- a/acceptance/bundle/resources/jobs/update/out.plan_skip.direct.json
+++ /dev/null
@@ -1,64 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.jobs.foo": {
-      "action": "skip",
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-        },
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_clusters": [
-          {
-            "job_cluster_key": "key",
-            "new_cluster": {
-              "num_workers": 0,
-              "spark_version": "13.3.x-scala2.12"
-            }
-          }
-        ],
-        "job_id": [FOO_ID],
-        "max_concurrent_runs": 1,
-        "name": "foo",
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "timeout_seconds": 0,
-        "trigger": {
-          "pause_status": "UNPAUSED",
-          "periodic": {
-            "interval": 1,
-            "unit": "DAYS"
-          }
-        },
-        "webhook_notifications": {}
-      },
-      "changes": {
-        "email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "webhook_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/jobs/update/out.plan_skip.json b/acceptance/bundle/resources/jobs/update/out.plan_skip.json
new file mode 100644
index 00000000000..cf8fe1d1816
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/update/out.plan_skip.json
@@ -0,0 +1,64 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.jobs.foo": {
+      "action": "skip",
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_clusters": [
+          {
+            "job_cluster_key": "key",
+            "new_cluster": {
+              "num_workers": 0,
+              "spark_version": "13.3.x-scala2.12"
+            }
+          }
+        ],
+        "job_id": [FOO_ID],
+        "max_concurrent_runs": 1,
+        "name": "foo",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "timeout_seconds": 0,
+        "trigger": {
+          "pause_status": "UNPAUSED",
+          "periodic": {
+            "interval": 1,
+            "unit": "DAYS"
+          }
+        },
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/jobs/update/out.plan_skip.terraform.json b/acceptance/bundle/resources/jobs/update/out.plan_skip.terraform.json
deleted file mode 100644
index fe932406c44..00000000000
--- a/acceptance/bundle/resources/jobs/update/out.plan_skip.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.foo": {
-      "action": "skip"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/jobs/update/out.plan_update.direct.json b/acceptance/bundle/resources/jobs/update/out.plan_update.direct.json
deleted file mode 100644
index bdb8e9f5e99..00000000000
--- a/acceptance/bundle/resources/jobs/update/out.plan_update.direct.json
+++ /dev/null
@@ -1,101 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 2,
-  "plan": {
-    "resources.jobs.foo": {
-      "action": "update",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "job_clusters": [
-            {
-              "job_cluster_key": "key",
-              "new_cluster": {
-                "num_workers": 0,
-                "spark_version": "13.3.x-scala2.12"
-              }
-            }
-          ],
-          "max_concurrent_runs": 1,
-          "name": "foo",
-          "queue": {
-            "enabled": true
-          },
-          "trigger": {
-            "pause_status": "UNPAUSED",
-            "periodic": {
-              "interval": 1,
-              "unit": "HOURS"
-            }
-          }
-        }
-      },
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-        },
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_clusters": [
-          {
-            "job_cluster_key": "key",
-            "new_cluster": {
-              "num_workers": 0,
-              "spark_version": "13.3.x-scala2.12"
-            }
-          }
-        ],
-        "job_id": [FOO_ID],
-        "max_concurrent_runs": 1,
-        "name": "foo",
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "timeout_seconds": 0,
-        "trigger": {
-          "pause_status": "UNPAUSED",
-          "periodic": {
-            "interval": 1,
-            "unit": "DAYS"
-          }
-        },
-        "webhook_notifications": {}
-      },
-      "changes": {
-        "email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "trigger.periodic.unit": {
-          "action": "update",
-          "old": "DAYS",
-          "new": "HOURS",
-          "remote": "DAYS"
-        },
-        "webhook_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/jobs/update/out.plan_update.json b/acceptance/bundle/resources/jobs/update/out.plan_update.json
new file mode 100644
index 00000000000..9409092f5aa
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/update/out.plan_update.json
@@ -0,0 +1,101 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.jobs.foo": {
+      "action": "update",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "job_clusters": [
+            {
+              "job_cluster_key": "key",
+              "new_cluster": {
+                "num_workers": 0,
+                "spark_version": "13.3.x-scala2.12"
+              }
+            }
+          ],
+          "max_concurrent_runs": 1,
+          "name": "foo",
+          "queue": {
+            "enabled": true
+          },
+          "trigger": {
+            "pause_status": "UNPAUSED",
+            "periodic": {
+              "interval": 1,
+              "unit": "HOURS"
+            }
+          }
+        }
+      },
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_clusters": [
+          {
+            "job_cluster_key": "key",
+            "new_cluster": {
+              "num_workers": 0,
+              "spark_version": "13.3.x-scala2.12"
+            }
+          }
+        ],
+        "job_id": [FOO_ID],
+        "max_concurrent_runs": 1,
+        "name": "foo",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "timeout_seconds": 0,
+        "trigger": {
+          "pause_status": "UNPAUSED",
+          "periodic": {
+            "interval": 1,
+            "unit": "DAYS"
+          }
+        },
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "trigger.periodic.unit": {
+          "action": "update",
+          "old": "DAYS",
+          "new": "HOURS",
+          "remote": "DAYS"
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/jobs/update/out.plan_update.terraform.json b/acceptance/bundle/resources/jobs/update/out.plan_update.terraform.json
deleted file mode 100644
index 4e0ecc7bdaf..00000000000
--- a/acceptance/bundle/resources/jobs/update/out.plan_update.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.foo": {
-      "action": "update"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/jobs/update/out.state.direct.json b/acceptance/bundle/resources/jobs/update/out.state.direct.json
deleted file mode 100644
index 785c0c13387..00000000000
--- a/acceptance/bundle/resources/jobs/update/out.state.direct.json
+++ /dev/null
@@ -1,40 +0,0 @@
-{
- "state_version": 2,
- "cli_version": "[DEV_VERSION]",
- "lineage": "[UUID]",
- "serial": 1,
- "state": {
-  "resources.jobs.foo": {
-   "__id__": "[FOO_ID]",
-   "state": {
-    "deployment": {
-     "kind": "BUNDLE",
-     "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-    },
-    "edit_mode": "UI_LOCKED",
-    "format": "MULTI_TASK",
-    "job_clusters": [
-     {
-      "job_cluster_key": "key",
-      "new_cluster": {
-       "num_workers": 0,
-       "spark_version": "13.3.x-scala2.12"
-      }
-     }
-    ],
-    "max_concurrent_runs": 1,
-    "name": "foo",
-    "queue": {
-     "enabled": true
-    },
-    "trigger": {
-     "pause_status": "UNPAUSED",
-     "periodic": {
-      "interval": 1,
-      "unit": "DAYS"
-     }
-    }
-   }
-  }
- }
-}
diff --git a/acceptance/bundle/resources/jobs/update/out.state.json b/acceptance/bundle/resources/jobs/update/out.state.json
new file mode 100644
index 00000000000..4897c138fc8
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/update/out.state.json
@@ -0,0 +1,40 @@
+{
+ "state_version": 3,
+ "cli_version": "[CLI_VERSION]",
+ "lineage": "[UUID]",
+ "serial": 1,
+ "state": {
+  "resources.jobs.foo": {
+   "__id__": "[FOO_ID]",
+   "state": {
+    "deployment": {
+     "kind": "BUNDLE",
+     "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+    },
+    "edit_mode": "UI_LOCKED",
+    "format": "MULTI_TASK",
+    "job_clusters": [
+     {
+      "job_cluster_key": "key",
+      "new_cluster": {
+       "num_workers": 0,
+       "spark_version": "13.3.x-scala2.12"
+      }
+     }
+    ],
+    "max_concurrent_runs": 1,
+    "name": "foo",
+    "queue": {
+     "enabled": true
+    },
+    "trigger": {
+     "pause_status": "UNPAUSED",
+     "periodic": {
+      "interval": 1,
+      "unit": "DAYS"
+     }
+    }
+   }
+  }
+ }
+}
diff --git a/acceptance/bundle/resources/jobs/update/out.state.terraform.json b/acceptance/bundle/resources/jobs/update/out.state.terraform.json
deleted file mode 100644
index 2c50ca82cbb..00000000000
--- a/acceptance/bundle/resources/jobs/update/out.state.terraform.json
+++ /dev/null
@@ -1,162 +0,0 @@
-{
-  "version": 4,
-  "terraform_version": "1.5.5",
-  "serial": 1,
-  "lineage": "[UUID]",
-  "outputs": {},
-  "resources": [
-    {
-      "mode": "managed",
-      "type": "databricks_job",
-      "name": "foo",
-      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
-      "instances": [
-        {
-          "schema_version": 2,
-          "attributes": {
-            "always_running": false,
-            "budget_policy_id": null,
-            "continuous": [],
-            "control_run_state": false,
-            "dbt_task": [],
-            "deployment": [
-              {
-                "kind": "BUNDLE",
-                "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-              }
-            ],
-            "description": null,
-            "edit_mode": "UI_LOCKED",
-            "email_notifications": [
-              {
-                "no_alert_for_skipped_runs": false,
-                "on_duration_warning_threshold_exceeded": [],
-                "on_failure": [],
-                "on_start": [],
-                "on_streaming_backlog_exceeded": [],
-                "on_success": []
-              }
-            ],
-            "environment": [],
-            "existing_cluster_id": null,
-            "format": "MULTI_TASK",
-            "git_source": [],
-            "health": [],
-            "id": "[FOO_ID]",
-            "job_cluster": [
-              {
-                "job_cluster_key": "key",
-                "new_cluster": [
-                  {
-                    "__apply_policy_default_values_allow_list": null,
-                    "apply_policy_default_values": false,
-                    "autoscale": [],
-                    "aws_attributes": [],
-                    "azure_attributes": [],
-                    "cluster_id": "",
-                    "cluster_log_conf": [],
-                    "cluster_mount_info": [],
-                    "cluster_name": "",
-                    "custom_tags": null,
-                    "data_security_mode": "",
-                    "docker_image": [],
-                    "driver_instance_pool_id": "",
-                    "driver_node_type_flexibility": [],
-                    "driver_node_type_id": "",
-                    "enable_elastic_disk": false,
-                    "enable_local_disk_encryption": false,
-                    "gcp_attributes": [],
-                    "idempotency_token": "",
-                    "init_scripts": [],
-                    "instance_pool_id": "",
-                    "is_single_node": false,
-                    "kind": "",
-                    "library": [],
-                    "node_type_id": "",
-                    "num_workers": 0,
-                    "policy_id": "",
-                    "provider_config": [],
-                    "remote_disk_throughput": 0,
-                    "runtime_engine": "",
-                    "single_user_name": "",
-                    "spark_conf": null,
-                    "spark_env_vars": null,
-                    "spark_version": "13.3.x-scala2.12",
-                    "ssh_public_keys": null,
-                    "total_initial_remote_disk_size": 0,
-                    "use_ml_runtime": false,
-                    "worker_node_type_flexibility": [],
-                    "workload_type": []
-                  }
-                ]
-              }
-            ],
-            "library": [],
-            "max_concurrent_runs": 1,
-            "max_retries": 0,
-            "min_retry_interval_millis": 0,
-            "name": "foo",
-            "new_cluster": [],
-            "notebook_task": [],
-            "notification_settings": [],
-            "parameter": [],
-            "performance_target": null,
-            "pipeline_task": [],
-            "provider_config": [],
-            "python_wheel_task": [],
-            "queue": [
-              {
-                "enabled": true
-              }
-            ],
-            "retry_on_timeout": false,
-            "run_as": [
-              {
-                "group_name": "",
-                "service_principal_name": "",
-                "user_name": "[USERNAME]"
-              }
-            ],
-            "run_job_task": [],
-            "schedule": [],
-            "spark_jar_task": [],
-            "spark_python_task": [],
-            "spark_submit_task": [],
-            "tags": null,
-            "task": [],
-            "timeout_seconds": 0,
-            "timeouts": null,
-            "trigger": [
-              {
-                "file_arrival": [],
-                "model": [],
-                "pause_status": "UNPAUSED",
-                "periodic": [
-                  {
-                    "interval": 1,
-                    "unit": "DAYS"
-                  }
-                ],
-                "table_update": []
-              }
-            ],
-            "url": "[DATABRICKS_URL]/#job/[FOO_ID]",
-            "usage_policy_id": null,
-            "webhook_notifications": [
-              {
-                "on_duration_warning_threshold_exceeded": [],
-                "on_failure": [],
-                "on_start": [],
-                "on_streaming_backlog_exceeded": [],
-                "on_success": []
-              }
-            ]
-          },
-          "sensitive_attributes": [],
-          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJ1cGRhdGUiOjE4MDAwMDAwMDAwMDB9LCJzY2hlbWFfdmVyc2lvbiI6IjIifQ=="
-        }
-      ]
-    }
-  ],
-  "check_results": null
-}
diff --git a/acceptance/bundle/resources/jobs/update/out.test.toml b/acceptance/bundle/resources/jobs/update/out.test.toml
index 8ffbd40f24c..f7fafbcc731 100644
--- a/acceptance/bundle/resources/jobs/update/out.test.toml
+++ b/acceptance/bundle/resources/jobs/update/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
 EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/resources/jobs/update/output.txt b/acceptance/bundle/resources/jobs/update/output.txt
index 88f25bf1745..e6fd753d0fc 100644
--- a/acceptance/bundle/resources/jobs/update/output.txt
+++ b/acceptance/bundle/resources/jobs/update/output.txt
@@ -4,22 +4,21 @@ create jobs.foo
 
 Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.foo
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
->>> print_requests.py //jobs
+>>> print_requests.py //jobs --nostamp
 
 >>> [CLI] bundle plan
 Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
 
 >>> [CLI] bundle plan -o json
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 3 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
 
->>> print_requests.py //jobs
+>>> print_requests.py //jobs --nostamp
 
 === Update trigger.periodic.unit and re-deploy
 >>> update_file.py databricks.yml DAYS HOURS
@@ -29,11 +28,11 @@ update jobs.foo
 
 Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated jobs.foo
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
->>> print_requests.py //jobs
+>>> print_requests.py //jobs --nostamp
 
 >>> [CLI] bundle plan
 Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
@@ -86,10 +85,9 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
 
->>> print_requests.py //jobs
+>>> print_requests.py //jobs --nostamp
 {
   "method": "POST",
   "path": "/api/2.2/jobs/delete",
@@ -99,4 +97,4 @@ Destroy complete!
 }
 
 >>> musterr [CLI] jobs get [FOO_ID]
-Error: Not Found
+Error: Job [FOO_ID] does not exist.
diff --git a/acceptance/bundle/resources/jobs/update/script b/acceptance/bundle/resources/jobs/update/script
index 270efcaea6d..3457ac99b25 100644
--- a/acceptance/bundle/resources/jobs/update/script
+++ b/acceptance/bundle/resources/jobs/update/script
@@ -1,23 +1,28 @@
-echo "*" > .gitignore
+# The raw plans the replays read go under .databricks, which sync skips.
+mkdir -p .databricks
+
 trace $CLI bundle plan
-$CLI bundle plan -o json > out.plan_create.$DATABRICKS_BUNDLE_ENGINE.json
-$CLI bundle deploy $(readplanarg out.plan_create.direct.json)
-trace print_requests.py //jobs > out.create.requests.json
+$CLI bundle plan -o json > .databricks/tmp.plan_create.json
+nostamp < .databricks/tmp.plan_create.json > out.plan_create.json
+$CLI bundle deploy $(readplanarg .databricks/tmp.plan_create.json)
+trace print_requests.py //jobs --nostamp > out.create.requests.json
 
-print_state.py > out.state.$DATABRICKS_BUNDLE_ENGINE.json
+print_state.py > out.state.json
 trace $CLI bundle plan
-trace $CLI bundle plan -o json > out.plan_skip.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json > .databricks/tmp.plan_skip.json
+nostamp < .databricks/tmp.plan_skip.json > out.plan_skip.json
 
-$CLI bundle deploy $(readplanarg out.plan_skip.direct.json)
-trace print_requests.py //jobs
+$CLI bundle deploy $(readplanarg .databricks/tmp.plan_skip.json)
+trace print_requests.py //jobs --nostamp
 
 title "Update trigger.periodic.unit and re-deploy"
 trace update_file.py databricks.yml DAYS HOURS
 trace $CLI bundle plan
-$CLI bundle plan -o json > out.plan_update.$DATABRICKS_BUNDLE_ENGINE.json
+$CLI bundle plan -o json > .databricks/tmp.plan_update.json
+nostamp < .databricks/tmp.plan_update.json > out.plan_update.json
 
-$CLI bundle deploy $(readplanarg out.plan_update.direct.json)
-trace print_requests.py //jobs | jq 'del(.body.new_settings.run_as, .body.new_settings.webhook_notifications, .body.new_settings.email_notifications)' > out.update.requests.json
+$CLI bundle deploy $(readplanarg .databricks/tmp.plan_update.json)
+trace print_requests.py //jobs --nostamp | jq 'del(.body.new_settings.run_as, .body.new_settings.webhook_notifications, .body.new_settings.email_notifications)' > out.update.requests.json
 
 trace $CLI bundle plan
 
@@ -25,12 +30,12 @@ title "Fetch job ID and verify remote state"
 
 ppid=`read_id.py foo`
 
-trace $CLI jobs get $ppid | jq 'del(.settings.run_as)'
-rm out.requests.txt
+trace $CLI jobs get $ppid | jq 'del(.settings.run_as)' | nostamp
+rm "$OUT_REQUESTS"
 
 title "Destroy the job and verify that it's removed from the state and from remote"
 trace $CLI bundle destroy --auto-approve
-trace print_requests.py //jobs
+trace print_requests.py //jobs --nostamp
 
 trace musterr $CLI jobs get $ppid
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/resources/jobs/update_single_node/out.plan_create.direct.json b/acceptance/bundle/resources/jobs/update_single_node/out.plan_create.direct.json
deleted file mode 100644
index 68a1a887c80..00000000000
--- a/acceptance/bundle/resources/jobs/update_single_node/out.plan_create.direct.json
+++ /dev/null
@@ -1,47 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.foo": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "job_clusters": [
-            {
-              "job_cluster_key": "key",
-              "new_cluster": {
-                "custom_tags": {
-                  "ResourceClass": "SingleNode"
-                },
-                "num_workers": 0,
-                "spark_conf": {
-                  "spark.databricks.cluster.profile": "singleNode",
-                  "spark.master": "local[*]"
-                },
-                "spark_version": "13.3.x-scala2.12"
-              }
-            }
-          ],
-          "max_concurrent_runs": 1,
-          "name": "foo",
-          "queue": {
-            "enabled": true
-          },
-          "trigger": {
-            "pause_status": "UNPAUSED",
-            "periodic": {
-              "interval": 1,
-              "unit": "DAYS"
-            }
-          }
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/jobs/update_single_node/out.plan_create.json b/acceptance/bundle/resources/jobs/update_single_node/out.plan_create.json
new file mode 100644
index 00000000000..23e83566fe9
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/update_single_node/out.plan_create.json
@@ -0,0 +1,47 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.jobs.foo": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "job_clusters": [
+            {
+              "job_cluster_key": "key",
+              "new_cluster": {
+                "custom_tags": {
+                  "ResourceClass": "SingleNode"
+                },
+                "num_workers": 0,
+                "spark_conf": {
+                  "spark.databricks.cluster.profile": "singleNode",
+                  "spark.master": "local[*]"
+                },
+                "spark_version": "13.3.x-scala2.12"
+              }
+            }
+          ],
+          "max_concurrent_runs": 1,
+          "name": "foo",
+          "queue": {
+            "enabled": true
+          },
+          "trigger": {
+            "pause_status": "UNPAUSED",
+            "periodic": {
+              "interval": 1,
+              "unit": "DAYS"
+            }
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/jobs/update_single_node/out.plan_create.terraform.json b/acceptance/bundle/resources/jobs/update_single_node/out.plan_create.terraform.json
deleted file mode 100644
index b1dce3fac0f..00000000000
--- a/acceptance/bundle/resources/jobs/update_single_node/out.plan_create.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.foo": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/jobs/update_single_node/out.plan_skip.direct.json b/acceptance/bundle/resources/jobs/update_single_node/out.plan_skip.direct.json
deleted file mode 100644
index 7b789f1a553..00000000000
--- a/acceptance/bundle/resources/jobs/update_single_node/out.plan_skip.direct.json
+++ /dev/null
@@ -1,71 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.jobs.foo": {
-      "action": "skip",
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-        },
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_clusters": [
-          {
-            "job_cluster_key": "key",
-            "new_cluster": {
-              "custom_tags": {
-                "ResourceClass": "SingleNode"
-              },
-              "num_workers": 0,
-              "spark_conf": {
-                "spark.databricks.cluster.profile": "singleNode",
-                "spark.master": "local[*]"
-              },
-              "spark_version": "13.3.x-scala2.12"
-            }
-          }
-        ],
-        "job_id": [FOO_ID],
-        "max_concurrent_runs": 1,
-        "name": "foo",
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "timeout_seconds": 0,
-        "trigger": {
-          "pause_status": "UNPAUSED",
-          "periodic": {
-            "interval": 1,
-            "unit": "DAYS"
-          }
-        },
-        "webhook_notifications": {}
-      },
-      "changes": {
-        "email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "webhook_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/jobs/update_single_node/out.plan_skip.json b/acceptance/bundle/resources/jobs/update_single_node/out.plan_skip.json
new file mode 100644
index 00000000000..c654c443693
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/update_single_node/out.plan_skip.json
@@ -0,0 +1,71 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.jobs.foo": {
+      "action": "skip",
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_clusters": [
+          {
+            "job_cluster_key": "key",
+            "new_cluster": {
+              "custom_tags": {
+                "ResourceClass": "SingleNode"
+              },
+              "num_workers": 0,
+              "spark_conf": {
+                "spark.databricks.cluster.profile": "singleNode",
+                "spark.master": "local[*]"
+              },
+              "spark_version": "13.3.x-scala2.12"
+            }
+          }
+        ],
+        "job_id": [FOO_ID],
+        "max_concurrent_runs": 1,
+        "name": "foo",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "timeout_seconds": 0,
+        "trigger": {
+          "pause_status": "UNPAUSED",
+          "periodic": {
+            "interval": 1,
+            "unit": "DAYS"
+          }
+        },
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/jobs/update_single_node/out.plan_skip.terraform.json b/acceptance/bundle/resources/jobs/update_single_node/out.plan_skip.terraform.json
deleted file mode 100644
index fe932406c44..00000000000
--- a/acceptance/bundle/resources/jobs/update_single_node/out.plan_skip.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.foo": {
-      "action": "skip"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/jobs/update_single_node/out.plan_update.direct.json b/acceptance/bundle/resources/jobs/update_single_node/out.plan_update.direct.json
deleted file mode 100644
index a3fe8d211c5..00000000000
--- a/acceptance/bundle/resources/jobs/update_single_node/out.plan_update.direct.json
+++ /dev/null
@@ -1,115 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.jobs.foo": {
-      "action": "update",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "job_clusters": [
-            {
-              "job_cluster_key": "key",
-              "new_cluster": {
-                "custom_tags": {
-                  "ResourceClass": "SingleNode"
-                },
-                "num_workers": 0,
-                "spark_conf": {
-                  "spark.databricks.cluster.profile": "singleNode",
-                  "spark.master": "local[*]"
-                },
-                "spark_version": "13.3.x-scala2.12"
-              }
-            }
-          ],
-          "max_concurrent_runs": 1,
-          "name": "foo",
-          "queue": {
-            "enabled": true
-          },
-          "trigger": {
-            "pause_status": "UNPAUSED",
-            "periodic": {
-              "interval": 1,
-              "unit": "HOURS"
-            }
-          }
-        }
-      },
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-        },
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_clusters": [
-          {
-            "job_cluster_key": "key",
-            "new_cluster": {
-              "custom_tags": {
-                "ResourceClass": "SingleNode"
-              },
-              "num_workers": 0,
-              "spark_conf": {
-                "spark.databricks.cluster.profile": "singleNode",
-                "spark.master": "local[*]"
-              },
-              "spark_version": "13.3.x-scala2.12"
-            }
-          }
-        ],
-        "job_id": [FOO_ID],
-        "max_concurrent_runs": 1,
-        "name": "foo",
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "timeout_seconds": 0,
-        "trigger": {
-          "pause_status": "UNPAUSED",
-          "periodic": {
-            "interval": 1,
-            "unit": "DAYS"
-          }
-        },
-        "webhook_notifications": {}
-      },
-      "changes": {
-        "email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "trigger.periodic.unit": {
-          "action": "update",
-          "old": "DAYS",
-          "new": "HOURS",
-          "remote": "DAYS"
-        },
-        "webhook_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/jobs/update_single_node/out.plan_update.json b/acceptance/bundle/resources/jobs/update_single_node/out.plan_update.json
new file mode 100644
index 00000000000..a8a72d9b48a
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/update_single_node/out.plan_update.json
@@ -0,0 +1,115 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.jobs.foo": {
+      "action": "update",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "job_clusters": [
+            {
+              "job_cluster_key": "key",
+              "new_cluster": {
+                "custom_tags": {
+                  "ResourceClass": "SingleNode"
+                },
+                "num_workers": 0,
+                "spark_conf": {
+                  "spark.databricks.cluster.profile": "singleNode",
+                  "spark.master": "local[*]"
+                },
+                "spark_version": "13.3.x-scala2.12"
+              }
+            }
+          ],
+          "max_concurrent_runs": 1,
+          "name": "foo",
+          "queue": {
+            "enabled": true
+          },
+          "trigger": {
+            "pause_status": "UNPAUSED",
+            "periodic": {
+              "interval": 1,
+              "unit": "HOURS"
+            }
+          }
+        }
+      },
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_clusters": [
+          {
+            "job_cluster_key": "key",
+            "new_cluster": {
+              "custom_tags": {
+                "ResourceClass": "SingleNode"
+              },
+              "num_workers": 0,
+              "spark_conf": {
+                "spark.databricks.cluster.profile": "singleNode",
+                "spark.master": "local[*]"
+              },
+              "spark_version": "13.3.x-scala2.12"
+            }
+          }
+        ],
+        "job_id": [FOO_ID],
+        "max_concurrent_runs": 1,
+        "name": "foo",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "timeout_seconds": 0,
+        "trigger": {
+          "pause_status": "UNPAUSED",
+          "periodic": {
+            "interval": 1,
+            "unit": "DAYS"
+          }
+        },
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "trigger.periodic.unit": {
+          "action": "update",
+          "old": "DAYS",
+          "new": "HOURS",
+          "remote": "DAYS"
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/jobs/update_single_node/out.plan_update.terraform.json b/acceptance/bundle/resources/jobs/update_single_node/out.plan_update.terraform.json
deleted file mode 100644
index 4e0ecc7bdaf..00000000000
--- a/acceptance/bundle/resources/jobs/update_single_node/out.plan_update.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.foo": {
-      "action": "update"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/jobs/update_single_node/out.test.toml b/acceptance/bundle/resources/jobs/update_single_node/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/jobs/update_single_node/out.test.toml
+++ b/acceptance/bundle/resources/jobs/update_single_node/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/jobs/update_single_node/out.update.requests.direct.json b/acceptance/bundle/resources/jobs/update_single_node/out.update.requests.json
similarity index 100%
rename from acceptance/bundle/resources/jobs/update_single_node/out.update.requests.direct.json
rename to acceptance/bundle/resources/jobs/update_single_node/out.update.requests.json
diff --git a/acceptance/bundle/resources/jobs/update_single_node/out.update.requests.terraform.json b/acceptance/bundle/resources/jobs/update_single_node/out.update.requests.terraform.json
deleted file mode 100644
index 3728e70da02..00000000000
--- a/acceptance/bundle/resources/jobs/update_single_node/out.update.requests.terraform.json
+++ /dev/null
@@ -1,48 +0,0 @@
-{
-  "method": "POST",
-  "path": "/api/2.2/jobs/reset",
-  "body": {
-    "job_id": [FOO_ID],
-    "new_settings": {
-      "deployment": {
-        "kind": "BUNDLE",
-        "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-      },
-      "edit_mode": "UI_LOCKED",
-      "email_notifications": {},
-      "format": "MULTI_TASK",
-      "job_clusters": [
-        {
-          "job_cluster_key": "key",
-          "new_cluster": {
-            "custom_tags": {
-              "ResourceClass": "SingleNode"
-            },
-            "num_workers": 0,
-            "spark_conf": {
-              "spark.databricks.cluster.profile": "singleNode",
-              "spark.master": "local[*]"
-            },
-            "spark_version": "13.3.x-scala2.12"
-          }
-        }
-      ],
-      "max_concurrent_runs": 1,
-      "name": "foo",
-      "queue": {
-        "enabled": true
-      },
-      "run_as": {
-        "user_name": "[USERNAME]"
-      },
-      "trigger": {
-        "pause_status": "UNPAUSED",
-        "periodic": {
-          "interval": 1,
-          "unit": "HOURS"
-        }
-      },
-      "webhook_notifications": {}
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/jobs/update_single_node/output.txt b/acceptance/bundle/resources/jobs/update_single_node/output.txt
index 08869c2c4f1..21ce8c8f446 100644
--- a/acceptance/bundle/resources/jobs/update_single_node/output.txt
+++ b/acceptance/bundle/resources/jobs/update_single_node/output.txt
@@ -6,11 +6,11 @@ Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.foo
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
->>> print_requests.py //jobs
+>>> print_requests.py //jobs --nostamp
 
 === Update trigger.periodic.unit and re-deploy
 >>> update_file.py databricks.yml DAYS HOURS
@@ -22,11 +22,11 @@ Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated jobs.foo
+Files: 4 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
->>> print_requests.py //jobs
+>>> print_requests.py //jobs --nostamp
 
 >>> [CLI] bundle plan
 Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
@@ -86,10 +86,9 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
 
->>> print_requests.py //jobs
+>>> print_requests.py //jobs --nostamp
 {
   "method": "POST",
   "path": "/api/2.2/jobs/delete",
@@ -99,4 +98,4 @@ Destroy complete!
 }
 
 >>> musterr [CLI] jobs get [FOO_ID]
-Error: Not Found
+Error: Job [FOO_ID] does not exist.
diff --git a/acceptance/bundle/resources/jobs/update_single_node/script b/acceptance/bundle/resources/jobs/update_single_node/script
index 9e84f677e73..5f0bb12ee55 100644
--- a/acceptance/bundle/resources/jobs/update_single_node/script
+++ b/acceptance/bundle/resources/jobs/update_single_node/script
@@ -1,17 +1,16 @@
-echo "*" > .gitignore
 trace $CLI bundle plan
-$CLI bundle plan -o json > out.plan_create.$DATABRICKS_BUNDLE_ENGINE.json
+$CLI bundle plan -o json | nostamp > out.plan_create.json
 trace $CLI bundle deploy
-$CLI bundle plan -o json > out.plan_skip.$DATABRICKS_BUNDLE_ENGINE.json
+$CLI bundle plan -o json | nostamp > out.plan_skip.json
 
-trace print_requests.py //jobs > out.create.requests.txt
+trace print_requests.py //jobs > out.create.requests.txt --nostamp
 
 title "Update trigger.periodic.unit and re-deploy"
 trace update_file.py databricks.yml DAYS HOURS
 trace $CLI bundle plan
-$CLI bundle plan -o json > out.plan_update.$DATABRICKS_BUNDLE_ENGINE.json
+$CLI bundle plan -o json | nostamp > out.plan_update.json
 trace $CLI bundle deploy
-trace print_requests.py //jobs > out.update.requests.$DATABRICKS_BUNDLE_ENGINE.json
+trace print_requests.py //jobs > out.update.requests.json --nostamp
 
 trace $CLI bundle plan
 
@@ -19,12 +18,12 @@ title "Fetch job ID and verify remote state"
 
 ppid=`read_id.py foo`
 
-trace $CLI jobs get $ppid | jq 'del(.settings.run_as)'
-rm out.requests.txt
+trace $CLI jobs get $ppid | jq 'del(.settings.run_as, .settings.deployment.deployment_id, .settings.deployment.version_id)'
+rm "$OUT_REQUESTS"
 
 title "Destroy the job and verify that it's removed from the state and from remote"
 trace $CLI bundle destroy --auto-approve
-trace print_requests.py //jobs
+trace print_requests.py //jobs --nostamp
 
 trace musterr $CLI jobs get $ppid
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/resources/jobs/webhook-reorder-remote/databricks.yml b/acceptance/bundle/resources/jobs/webhook-reorder-remote/databricks.yml
new file mode 100644
index 00000000000..32480227c48
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/webhook-reorder-remote/databricks.yml
@@ -0,0 +1,20 @@
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    my_job:
+      name: webhook reorder
+      webhook_notifications:
+        on_success:
+          - id: alpha
+          - id: beta
+          - id: gamma
+      tasks:
+        - task_key: main
+          run_job_task:
+            job_id: 123
+          webhook_notifications:
+            on_start:
+              - id: delta
+              - id: epsilon
diff --git a/acceptance/bundle/resources/jobs/webhook-reorder-remote/out.plan.json b/acceptance/bundle/resources/jobs/webhook-reorder-remote/out.plan.json
new file mode 100644
index 00000000000..d4a8e9cdc24
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/webhook-reorder-remote/out.plan.json
@@ -0,0 +1,27 @@
+{
+  "email_notifications": {
+    "action": "skip",
+    "reason": "empty",
+    "remote": {}
+  },
+  "tasks[task_key='main'].email_notifications": {
+    "action": "skip",
+    "reason": "empty",
+    "remote": {}
+  },
+  "tasks[task_key='main'].run_if": {
+    "action": "skip",
+    "reason": "backend_default",
+    "remote": "ALL_SUCCESS"
+  },
+  "tasks[task_key='main'].timeout_seconds": {
+    "action": "skip",
+    "reason": "empty",
+    "remote": 0
+  },
+  "timeout_seconds": {
+    "action": "skip",
+    "reason": "empty",
+    "remote": 0
+  }
+}
diff --git a/acceptance/bundle/resources/jobs/webhook-reorder-remote/out.test.toml b/acceptance/bundle/resources/jobs/webhook-reorder-remote/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/webhook-reorder-remote/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/jobs/webhook-reorder-remote/output.txt b/acceptance/bundle/resources/jobs/webhook-reorder-remote/output.txt
new file mode 100644
index 00000000000..ca47a5de237
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/webhook-reorder-remote/output.txt
@@ -0,0 +1,123 @@
+
+>>> [CLI] bundle plan
+create jobs.my_job
+
+Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created jobs.my_job
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+=== Remote returns webhook destinations in a different order
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+>>> print_requests.py //jobs --nostamp
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/create",
+  "body": {
+    "deployment": {
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+    },
+    "edit_mode": "UI_LOCKED",
+    "format": "MULTI_TASK",
+    "max_concurrent_runs": 1,
+    "name": "webhook reorder",
+    "queue": {
+      "enabled": true
+    },
+    "tasks": [
+      {
+        "run_job_task": {
+          "job_id": 123
+        },
+        "task_key": "main",
+        "webhook_notifications": {
+          "on_start": [
+            {
+              "id": "delta"
+            },
+            {
+              "id": "epsilon"
+            }
+          ]
+        }
+      }
+    ],
+    "webhook_notifications": {
+      "on_success": [
+        {
+          "id": "alpha"
+        },
+        {
+          "id": "beta"
+        },
+        {
+          "id": "gamma"
+        }
+      ]
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/reset",
+  "body": {
+    "job_id": [MY_JOB_ID],
+    "new_settings": {
+      "deployment": {
+        "kind": "BUNDLE",
+        "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+      },
+      "edit_mode": "UI_LOCKED",
+      "email_notifications": {},
+      "format": "MULTI_TASK",
+      "max_concurrent_runs": 1,
+      "name": "webhook reorder",
+      "queue": {
+        "enabled": true
+      },
+      "tasks": [
+        {
+          "email_notifications": {},
+          "run_if": "ALL_SUCCESS",
+          "run_job_task": {
+            "job_id": 123
+          },
+          "task_key": "main",
+          "timeout_seconds": 0,
+          "webhook_notifications": {
+            "on_start": [
+              {
+                "id": "epsilon"
+              },
+              {
+                "id": "delta"
+              }
+            ]
+          }
+        }
+      ],
+      "timeout_seconds": 0,
+      "webhook_notifications": {
+        "on_success": [
+          {
+            "id": "alpha"
+          },
+          {
+            "id": "gamma"
+          },
+          {
+            "id": "beta"
+          }
+        ]
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/jobs/webhook-reorder-remote/script b/acceptance/bundle/resources/jobs/webhook-reorder-remote/script
new file mode 100644
index 00000000000..64e56ce732e
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/webhook-reorder-remote/script
@@ -0,0 +1,19 @@
+trace $CLI bundle plan
+$CLI bundle deploy
+job_id="$(read_id.py my_job)"
+
+trace $CLI bundle plan | contains.py "0 to add, 0 to change, 0 to delete"
+
+title "Remote returns webhook destinations in a different order\n"
+edit_resource.py jobs "$job_id" <<EOF
+s = r["webhook_notifications"]["on_success"]
+s[:] = [s[0], s[2], s[1]]
+t = r["tasks"][0]["webhook_notifications"]["on_start"]
+t[:] = [t[1], t[0]]
+EOF
+
+# The reordered remote must not produce a phantom diff: on_* lists are diffed by id.
+trace $CLI bundle plan
+$CLI bundle plan -o json | nostamp | jq '.plan."resources.jobs.my_job".changes' > out.plan.json
+
+trace print_requests.py //jobs --nostamp
diff --git a/acceptance/bundle/resources/jobs/whole-block-overlap/databricks.yml b/acceptance/bundle/resources/jobs/whole-block-overlap/databricks.yml
new file mode 100644
index 00000000000..e2d6b9e42f8
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/whole-block-overlap/databricks.yml
@@ -0,0 +1,14 @@
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    my_job:
+      name: test-job
+      schedule:
+        quartz_cron_expression: "0 0 12 * * ?"
+        timezone_id: UTC
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: /nb
diff --git a/acceptance/bundle/resources/jobs/whole-block-overlap/out.plan.direct.json b/acceptance/bundle/resources/jobs/whole-block-overlap/out.plan.direct.json
new file mode 100644
index 00000000000..03edfb9f1d8
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/whole-block-overlap/out.plan.direct.json
@@ -0,0 +1,126 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.jobs.my_job": {
+      "action": "update",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "test-job",
+          "queue": {
+            "enabled": true
+          },
+          "schedule": {
+            "pause_status": "UNPAUSED",
+            "quartz_cron_expression": "0 0 12 * * ?",
+            "timezone_id": "America/New_York"
+          },
+          "tasks": [
+            {
+              "notebook_task": {
+                "notebook_path": "/nb"
+              },
+              "task_key": "main"
+            }
+          ]
+        }
+      },
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_id": [MY_JOB_ID],
+        "max_concurrent_runs": 1,
+        "name": "test-job",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "tasks": [
+          {
+            "email_notifications": {},
+            "notebook_task": {
+              "notebook_path": "/nb",
+              "source": "WORKSPACE"
+            },
+            "run_if": "ALL_SUCCESS",
+            "task_key": "main",
+            "timeout_seconds": 0
+          }
+        ],
+        "timeout_seconds": 0,
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "schedule": {
+          "action": "update",
+          "old": {
+            "pause_status": "UNPAUSED",
+            "quartz_cron_expression": "0 0 12 * * ?",
+            "timezone_id": "UTC"
+          },
+          "new": {
+            "pause_status": "UNPAUSED",
+            "quartz_cron_expression": "0 0 12 * * ?",
+            "timezone_id": "America/New_York"
+          }
+        },
+        "schedule.timezone_id": {
+          "action": "update",
+          "old": "UTC",
+          "new": "America/New_York"
+        },
+        "tasks[task_key='main'].email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='main'].notebook_task.source": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": "WORKSPACE"
+        },
+        "tasks[task_key='main'].run_if": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": "ALL_SUCCESS"
+        },
+        "tasks[task_key='main'].timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/jobs/whole-block-overlap/out.test.toml b/acceptance/bundle/resources/jobs/whole-block-overlap/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/whole-block-overlap/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/jobs/whole-block-overlap/output.txt b/acceptance/bundle/resources/jobs/whole-block-overlap/output.txt
new file mode 100644
index 00000000000..4f056f5bf40
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/whole-block-overlap/output.txt
@@ -0,0 +1,11 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created jobs.my_job
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] bundle plan
+update jobs.my_job
+
+Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
diff --git a/acceptance/bundle/resources/jobs/whole-block-overlap/script b/acceptance/bundle/resources/jobs/whole-block-overlap/script
new file mode 100644
index 00000000000..c9f858bba49
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/whole-block-overlap/script
@@ -0,0 +1,21 @@
+# Deploy a job with a schedule block; saved state and remote both have it.
+trace $CLI bundle deploy
+job_id="$(read_id.py my_job)"
+
+# Local change: a leaf inside the schedule block (saved state vs config differ at
+# schedule.timezone_id).
+update_file.py databricks.yml "timezone_id: UTC" "timezone_id: America/New_York"
+
+# Remote change: drop the whole schedule block out-of-band (remote vs config differ
+# at the schedule block level).
+edit_resource.py jobs $job_id <<EOF
+r["schedule"] = None
+EOF
+
+# The local diff is at the leaf (schedule.timezone_id) while the remote diff is at
+# the block (schedule = nil vs the configured block). structdiff records the remote
+# side as one block-level change instead of descending, so the plan's "changes"
+# carries BOTH the whole "schedule" block and the "schedule.timezone_id" leaf
+# instead of merging them into leaves.
+trace $CLI bundle plan
+$CLI bundle plan -o json | nostamp > out.plan.direct.json
diff --git a/acceptance/bundle/resources/jobs/whole-block-overlap/test.toml b/acceptance/bundle/resources/jobs/whole-block-overlap/test.toml
new file mode 100644
index 00000000000..e31bf48ee40
--- /dev/null
+++ b/acceptance/bundle/resources/jobs/whole-block-overlap/test.toml
@@ -0,0 +1,6 @@
+# Direct-only: the overlapping parent+child entries are a direct-engine changes-map
+# artifact (terraform emits no per-field changes).
+RecordRequests = false
+Ignore = [".databricks"]
+
+Badness = "The plan's 'changes' map carries BOTH the whole 'schedule' block and the 'schedule.timezone_id' leaf. The local diff (saved state vs config) is at the leaf while the remote diff (remote vs config) is at the block level (schedule dropped out-of-band), and structdiff records the remote side as one block-level change instead of descending, so the two never merge into leaves."
diff --git a/acceptance/bundle/resources/mcp_services/basic/databricks.yml b/acceptance/bundle/resources/mcp_services/basic/databricks.yml
new file mode 100644
index 00000000000..9b842c092b9
--- /dev/null
+++ b/acceptance/bundle/resources/mcp_services/basic/databricks.yml
@@ -0,0 +1,9 @@
+bundle:
+  name: test-bundle
+
+resources:
+  mcp_services:
+    mcp1:
+      parent: schemas/main.myschema
+      mcp_service_id: myservice
+      comment: COMMENT1
diff --git a/acceptance/bundle/resources/mcp_services/basic/out.test.toml b/acceptance/bundle/resources/mcp_services/basic/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/mcp_services/basic/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/mcp_services/basic/output.txt b/acceptance/bundle/resources/mcp_services/basic/output.txt
new file mode 100644
index 00000000000..1e569e8b020
--- /dev/null
+++ b/acceptance/bundle/resources/mcp_services/basic/output.txt
@@ -0,0 +1,92 @@
+
+=== Initial summary before deploy
+>>> [CLI] bundle summary -o json
+{
+  "comment": "COMMENT1",
+  "mcp_service_id": "myservice",
+  "modified_status": "created",
+  "parent": "schemas/main.myschema"
+}
+
+=== Verify it does not exist yet
+>>> musterr [CLI] ai-gateway get-mcp-service mcp-services/main.myschema.myservice
+Error: Resource catalog.McpService not found: main.myschema.myservice
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created mcp_services.mcp1
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //unity
+{
+  "method": "POST",
+  "path": "/api/2.1/unity-catalog/mcp-services",
+  "q": {
+    "mcp_service_id": "myservice",
+    "parent": "schemas/main.myschema"
+  },
+  "body": {
+    "comment": "COMMENT1"
+  }
+}
+
+=== Summary should show the id and the Catalog Explorer url
+>>> [CLI] bundle summary -o json
+{
+  "id": "main.myschema.myservice",
+  "url": "[DATABRICKS_URL]/explore/data/mcp-services/main/myschema/myservice?w=[WORKSPACE_ID]"
+}
+
+=== Verify deployment
+>>> [CLI] ai-gateway get-mcp-service mcp-services/main.myschema.myservice
+{
+  "name": "mcp-services/main.myschema.myservice",
+  "comment": "COMMENT1"
+}
+
+=== Update comment (should update in place, not recreate)
+>>> update_file.py databricks.yml COMMENT1 COMMENT2
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Updated mcp_services.mcp1
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //unity
+{
+  "method": "PATCH",
+  "path": "/api/2.1/unity-catalog/mcp-services/main.myschema.myservice",
+  "q": {
+    "update_mask": "*"
+  },
+  "body": {
+    "comment": "COMMENT2"
+  }
+}
+
+>>> [CLI] ai-gateway get-mcp-service mcp-services/main.myschema.myservice
+"COMMENT2"
+
+=== Change an immutable field (should plan a recreate)
+>>> update_file.py databricks.yml myservice myservice-renamed
+
+>>> [CLI] bundle plan
+recreate mcp_services.mcp1
+
+Plan: 1 to add, 0 to change, 1 to delete, 0 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.mcp_services.mcp1
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Destroy: 1 deleted
+
+>>> print_requests.py //unity
+{
+  "method": "DELETE",
+  "path": "/api/2.1/unity-catalog/mcp-services/main.myschema.myservice"
+}
diff --git a/acceptance/bundle/resources/mcp_services/basic/script b/acceptance/bundle/resources/mcp_services/basic/script
new file mode 100644
index 00000000000..eedd128b1e6
--- /dev/null
+++ b/acceptance/bundle/resources/mcp_services/basic/script
@@ -0,0 +1,29 @@
+title "Initial summary before deploy"
+trace $CLI bundle summary -o json | jq .resources.mcp_services.mcp1
+
+title "Verify it does not exist yet"
+trace musterr $CLI ai-gateway get-mcp-service mcp-services/main.myschema.myservice
+
+trace $CLI bundle deploy
+trace print_requests.py //unity
+
+title "Summary should show the id and the Catalog Explorer url"
+trace $CLI bundle summary -o json | jq ".resources.mcp_services.mcp1 | {id, url}"
+
+title "Verify deployment"
+trace $CLI ai-gateway get-mcp-service mcp-services/main.myschema.myservice | jq '{name, comment}'
+
+title "Update comment (should update in place, not recreate)"
+trace update_file.py databricks.yml COMMENT1 COMMENT2
+trace $CLI bundle deploy
+trace print_requests.py //unity
+trace $CLI ai-gateway get-mcp-service mcp-services/main.myschema.myservice | jq .comment
+
+title "Change an immutable field (should plan a recreate)"
+trace update_file.py databricks.yml myservice myservice-renamed
+trace $CLI bundle plan
+
+trace $CLI bundle destroy --auto-approve
+trace print_requests.py //unity
+
+rm -f out.requests.txt
diff --git a/acceptance/bundle/resources/mcp_services/basic/test.toml b/acceptance/bundle/resources/mcp_services/basic/test.toml
new file mode 100644
index 00000000000..116f2013783
--- /dev/null
+++ b/acceptance/bundle/resources/mcp_services/basic/test.toml
@@ -0,0 +1,7 @@
+# Local only: this test inspects the recorded request stream (print_requests),
+# which has no equivalent against a real workspace.
+Cloud = false
+
+Ignore = [
+    ".databricks",
+]
diff --git a/acceptance/bundle/resources/mcp_services/lifecycle/databricks.yml.tmpl b/acceptance/bundle/resources/mcp_services/lifecycle/databricks.yml.tmpl
new file mode 100644
index 00000000000..a2b2a48aedb
--- /dev/null
+++ b/acceptance/bundle/resources/mcp_services/lifecycle/databricks.yml.tmpl
@@ -0,0 +1,12 @@
+bundle:
+  name: deploy-mcp-service-test-$UNIQUE_NAME
+
+resources:
+  mcp_services:
+    mcp:
+      parent: schemas/main.default
+      mcp_service_id: test_mcp_$UNIQUE_NAME
+      comment: "Points at a UC connection hosting an MCP server"
+      config:
+        source_connection:
+          name: connections/main.default.mcp_conn_$UNIQUE_NAME
diff --git a/acceptance/bundle/resources/mcp_services/lifecycle/out.test.toml b/acceptance/bundle/resources/mcp_services/lifecycle/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/mcp_services/lifecycle/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/mcp_services/lifecycle/output.txt b/acceptance/bundle/resources/mcp_services/lifecycle/output.txt
new file mode 100644
index 00000000000..bee4b5fb0e5
--- /dev/null
+++ b/acceptance/bundle/resources/mcp_services/lifecycle/output.txt
@@ -0,0 +1,23 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-mcp-service-test-[UNIQUE_NAME]/default/files...
+Created mcp_services.mcp
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] ai-gateway get-mcp-service mcp-services/main.default.test_mcp_[UNIQUE_NAME]
+{
+  "name": "mcp-services/main.default.test_mcp_[UNIQUE_NAME]",
+  "comment": "Points at a UC connection hosting an MCP server"
+}
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.mcp_services.mcp
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-mcp-service-test-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/mcp_services/lifecycle/script b/acceptance/bundle/resources/mcp_services/lifecycle/script
new file mode 100644
index 00000000000..6e9514f3a38
--- /dev/null
+++ b/acceptance/bundle/resources/mcp_services/lifecycle/script
@@ -0,0 +1,36 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+CONN="mcp_conn_$UNIQUE_NAME"
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    # Only created on cloud (see below); tolerate its absence locally.
+    if [ -n "$CLOUD_ENV" ]; then
+        $CLI connections delete "main.default.$CONN" >/dev/null 2>&1 || true
+    fi
+}
+trap cleanup EXIT
+
+# On a real workspace the MCP service must point at an existing UC connection.
+# Use a SCHEMA-SCOPED connection (parent schemas/main.default): schema-level
+# connections need only schema privileges, not metastore CREATE CONNECTION.
+# is_mcp_connection is a metastore-level option (rejected on schema-level
+# connections), so this is a plain HTTP connection, which the mcp_service
+# accepts as its source_connection. The mock testserver doesn't validate
+# source_connection, so this only runs on cloud.
+if [ -n "$CLOUD_ENV" ]; then
+    # DEBUG (temporary): silent on success; prints the error if create fails.
+    if ! conn_out=$($CLI connections create --json "{\"name\":\"$CONN\",\"connection_type\":\"HTTP\",\"parent\":\"schemas/main.default\",\"options\":{\"host\":\"https://mcp-$UNIQUE_NAME.example.invalid\",\"port\":\"443\",\"base_path\":\"/mcp\",\"bearer_token\":\"dummy-token\"}}" 2>&1); then
+        echo "DEBUG connections create failed:"
+        echo "$conn_out"
+    fi
+fi
+
+trace $CLI bundle deploy
+
+MCP_ID=$($CLI bundle summary --output json | jq -r '.resources.mcp_services.mcp.id')
+
+trace $CLI ai-gateway get-mcp-service "mcp-services/$MCP_ID" | jq '{name, comment}'
+
+# Verify there is no drift right after deploy.
+trace $CLI bundle plan
diff --git a/acceptance/bundle/resources/mcp_services/lifecycle/test.toml b/acceptance/bundle/resources/mcp_services/lifecycle/test.toml
new file mode 100644
index 00000000000..f89c69a11cb
--- /dev/null
+++ b/acceptance/bundle/resources/mcp_services/lifecycle/test.toml
@@ -0,0 +1,12 @@
+# MCP service lifecycle, also runs against a real workspace. An MCP service must
+# point at an existing UC connection (config.source_connection). The script
+# creates a SCHEMA-SCOPED connection out-of-band on cloud (under the deploy
+# schema) and tears it down via trap: schema-level connections need only schema
+# privileges (not metastore CREATE CONNECTION). They can't set is_mcp_connection
+# (metastore-level only), but the mcp_service accepts a plain HTTP connection.
+RecordRequests = false
+
+Ignore = [
+    "databricks.yml",
+    ".databricks",
+]
diff --git a/acceptance/bundle/resources/mcp_services/remote-delete/databricks.yml b/acceptance/bundle/resources/mcp_services/remote-delete/databricks.yml
new file mode 100644
index 00000000000..9b842c092b9
--- /dev/null
+++ b/acceptance/bundle/resources/mcp_services/remote-delete/databricks.yml
@@ -0,0 +1,9 @@
+bundle:
+  name: test-bundle
+
+resources:
+  mcp_services:
+    mcp1:
+      parent: schemas/main.myschema
+      mcp_service_id: myservice
+      comment: COMMENT1
diff --git a/acceptance/bundle/resources/mcp_services/remote-delete/out.test.toml b/acceptance/bundle/resources/mcp_services/remote-delete/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/mcp_services/remote-delete/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/mcp_services/remote-delete/output.txt b/acceptance/bundle/resources/mcp_services/remote-delete/output.txt
new file mode 100644
index 00000000000..1abe12731aa
--- /dev/null
+++ b/acceptance/bundle/resources/mcp_services/remote-delete/output.txt
@@ -0,0 +1,20 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created mcp_services.mcp1
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Delete the resource out of band
+>>> [CLI] ai-gateway delete-mcp-service mcp-services/main.myschema.myservice
+
+=== Plan should detect the resource is gone and re-create it
+>>> [CLI] bundle plan
+create mcp_services.mcp1
+
+Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Destroy: 0 deleted
diff --git a/acceptance/bundle/resources/mcp_services/remote-delete/script b/acceptance/bundle/resources/mcp_services/remote-delete/script
new file mode 100644
index 00000000000..413e6174fd4
--- /dev/null
+++ b/acceptance/bundle/resources/mcp_services/remote-delete/script
@@ -0,0 +1,9 @@
+trace $CLI bundle deploy
+
+title "Delete the resource out of band"
+trace $CLI ai-gateway delete-mcp-service mcp-services/main.myschema.myservice
+
+title "Plan should detect the resource is gone and re-create it"
+trace $CLI bundle plan
+
+trace $CLI bundle destroy --auto-approve
diff --git a/acceptance/bundle/resources/mcp_services/remote-delete/test.toml b/acceptance/bundle/resources/mcp_services/remote-delete/test.toml
new file mode 100644
index 00000000000..17400e40cab
--- /dev/null
+++ b/acceptance/bundle/resources/mcp_services/remote-delete/test.toml
@@ -0,0 +1,9 @@
+# Local only: simulates an out-of-band delete with a fixed resource name, so it
+# can't run against a real workspace.
+Cloud = false
+
+RecordRequests = false
+
+Ignore = [
+    ".databricks",
+]
diff --git a/acceptance/bundle/resources/mcp_services/test.toml b/acceptance/bundle/resources/mcp_services/test.toml
new file mode 100644
index 00000000000..e2135896127
--- /dev/null
+++ b/acceptance/bundle/resources/mcp_services/test.toml
@@ -0,0 +1,6 @@
+# AI Gateway securables are only deployable via the direct deployment engine
+# (there is no Terraform provider path for them in bundles).
+
+# Lifecycle tests also run against a real workspace. Tests that inspect the
+# recorded request stream (e.g. basic) can't run on cloud and override this.
+Cloud = true
diff --git a/acceptance/bundle/resources/model_provider_services/basic/databricks.yml b/acceptance/bundle/resources/model_provider_services/basic/databricks.yml
new file mode 100644
index 00000000000..aeac81263d9
--- /dev/null
+++ b/acceptance/bundle/resources/model_provider_services/basic/databricks.yml
@@ -0,0 +1,20 @@
+bundle:
+  name: test-bundle
+
+resources:
+  model_provider_services:
+    mps1:
+      parent: schemas/main.myschema
+      model_provider_service_id: myservice
+      comment: COMMENT1
+      config:
+        provider_type: EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM
+        targets:
+          - model: gpt-4o
+            native_api_types:
+              - openai/v1/chat/completions
+        custom:
+          direct:
+            base_url: https://api.example.com/v1
+            api_key:
+              plaintext: dummy-api-key
diff --git a/acceptance/bundle/resources/model_provider_services/basic/out.test.toml b/acceptance/bundle/resources/model_provider_services/basic/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/model_provider_services/basic/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/model_provider_services/basic/output.txt b/acceptance/bundle/resources/model_provider_services/basic/output.txt
new file mode 100644
index 00000000000..6f61bef50bb
--- /dev/null
+++ b/acceptance/bundle/resources/model_provider_services/basic/output.txt
@@ -0,0 +1,149 @@
+
+=== Initial summary before deploy
+>>> [CLI] bundle summary -o json
+{
+  "comment": "COMMENT1",
+  "config": {
+    "custom": {
+      "direct": {
+        "api_key": {
+          "plaintext": "dummy-api-key"
+        },
+        "base_url": "https://api.example.com/v1"
+      }
+    },
+    "provider_type": "EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM",
+    "targets": [
+      {
+        "model": "gpt-4o",
+        "native_api_types": [
+          "openai/v1/chat/completions"
+        ]
+      }
+    ]
+  },
+  "model_provider_service_id": "myservice",
+  "modified_status": "created",
+  "parent": "schemas/main.myschema"
+}
+
+=== Verify it does not exist yet
+>>> musterr [CLI] ai-gateway get-model-provider-service model-provider-services/main.myschema.myservice
+Error: Resource catalog.ModelProviderService not found: main.myschema.myservice
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created model_provider_services.mps1
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //unity
+{
+  "method": "POST",
+  "path": "/api/2.1/unity-catalog/model-provider-services",
+  "q": {
+    "model_provider_service_id": "myservice",
+    "parent": "schemas/main.myschema"
+  },
+  "body": {
+    "comment": "COMMENT1",
+    "config": {
+      "custom": {
+        "direct": {
+          "api_key": {
+            "plaintext": "dummy-api-key"
+          },
+          "base_url": "https://api.example.com/v1"
+        }
+      },
+      "provider_type": "EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM",
+      "targets": [
+        {
+          "model": "gpt-4o",
+          "native_api_types": [
+            "openai/v1/chat/completions"
+          ]
+        }
+      ]
+    }
+  }
+}
+
+=== Summary should show the id and the Catalog Explorer url
+>>> [CLI] bundle summary -o json
+{
+  "id": "main.myschema.myservice",
+  "url": "[DATABRICKS_URL]/explore/data/model-provider-services/main/myschema/myservice?w=[WORKSPACE_ID]"
+}
+
+=== Verify deployment
+>>> [CLI] ai-gateway get-model-provider-service model-provider-services/main.myschema.myservice
+{
+  "name": "model-provider-services/main.myschema.myservice",
+  "comment": "COMMENT1"
+}
+
+=== Update comment (should update in place, not recreate)
+>>> update_file.py databricks.yml COMMENT1 COMMENT2
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Updated model_provider_services.mps1
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //unity
+{
+  "method": "PATCH",
+  "path": "/api/2.1/unity-catalog/model-provider-services/main.myschema.myservice",
+  "q": {
+    "update_mask": "*"
+  },
+  "body": {
+    "comment": "COMMENT2",
+    "config": {
+      "custom": {
+        "direct": {
+          "api_key": {
+            "plaintext": "dummy-api-key"
+          },
+          "base_url": "https://api.example.com/v1"
+        }
+      },
+      "provider_type": "EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM",
+      "targets": [
+        {
+          "model": "gpt-4o",
+          "native_api_types": [
+            "openai/v1/chat/completions"
+          ]
+        }
+      ]
+    }
+  }
+}
+
+>>> [CLI] ai-gateway get-model-provider-service model-provider-services/main.myschema.myservice
+"COMMENT2"
+
+=== Change an immutable field (should plan a recreate)
+>>> update_file.py databricks.yml EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM EXTERNAL_MODEL_PROVIDER_TYPE_ANTHROPIC
+
+>>> [CLI] bundle plan
+recreate model_provider_services.mps1
+
+Plan: 1 to add, 0 to change, 1 to delete, 0 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.model_provider_services.mps1
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Destroy: 1 deleted
+
+>>> print_requests.py //unity
+{
+  "method": "DELETE",
+  "path": "/api/2.1/unity-catalog/model-provider-services/main.myschema.myservice"
+}
diff --git a/acceptance/bundle/resources/model_provider_services/basic/script b/acceptance/bundle/resources/model_provider_services/basic/script
new file mode 100644
index 00000000000..f12527b141d
--- /dev/null
+++ b/acceptance/bundle/resources/model_provider_services/basic/script
@@ -0,0 +1,29 @@
+title "Initial summary before deploy"
+trace $CLI bundle summary -o json | jq .resources.model_provider_services.mps1
+
+title "Verify it does not exist yet"
+trace musterr $CLI ai-gateway get-model-provider-service model-provider-services/main.myschema.myservice
+
+trace $CLI bundle deploy
+trace print_requests.py //unity
+
+title "Summary should show the id and the Catalog Explorer url"
+trace $CLI bundle summary -o json | jq ".resources.model_provider_services.mps1 | {id, url}"
+
+title "Verify deployment"
+trace $CLI ai-gateway get-model-provider-service model-provider-services/main.myschema.myservice | jq '{name, comment}'
+
+title "Update comment (should update in place, not recreate)"
+trace update_file.py databricks.yml COMMENT1 COMMENT2
+trace $CLI bundle deploy
+trace print_requests.py //unity
+trace $CLI ai-gateway get-model-provider-service model-provider-services/main.myschema.myservice | jq .comment
+
+title "Change an immutable field (should plan a recreate)"
+trace update_file.py databricks.yml EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM EXTERNAL_MODEL_PROVIDER_TYPE_ANTHROPIC
+trace $CLI bundle plan
+
+trace $CLI bundle destroy --auto-approve
+trace print_requests.py //unity
+
+rm -f out.requests.txt
diff --git a/acceptance/bundle/resources/model_provider_services/basic/test.toml b/acceptance/bundle/resources/model_provider_services/basic/test.toml
new file mode 100644
index 00000000000..116f2013783
--- /dev/null
+++ b/acceptance/bundle/resources/model_provider_services/basic/test.toml
@@ -0,0 +1,7 @@
+# Local only: this test inspects the recorded request stream (print_requests),
+# which has no equivalent against a real workspace.
+Cloud = false
+
+Ignore = [
+    ".databricks",
+]
diff --git a/acceptance/bundle/resources/model_provider_services/lifecycle/databricks.yml.tmpl b/acceptance/bundle/resources/model_provider_services/lifecycle/databricks.yml.tmpl
new file mode 100644
index 00000000000..c7e4a7552c7
--- /dev/null
+++ b/acceptance/bundle/resources/model_provider_services/lifecycle/databricks.yml.tmpl
@@ -0,0 +1,19 @@
+bundle:
+  name: deploy-model-provider-service-test-$UNIQUE_NAME
+
+resources:
+  model_provider_services:
+    mps:
+      parent: schemas/main.default
+      model_provider_service_id: test_mps_$UNIQUE_NAME
+      comment: "Routes to a custom OpenAI-compatible provider"
+      config:
+        provider_type: EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM
+        targets:
+          - model: gpt-4o
+            native_api_types: ["openai/v1/chat/completions"]
+        custom:
+          direct:
+            base_url: https://api.example.com/v1
+            api_key:
+              plaintext: dummy-api-key
diff --git a/acceptance/bundle/resources/model_provider_services/lifecycle/out.test.toml b/acceptance/bundle/resources/model_provider_services/lifecycle/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/model_provider_services/lifecycle/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/model_provider_services/lifecycle/output.txt b/acceptance/bundle/resources/model_provider_services/lifecycle/output.txt
new file mode 100644
index 00000000000..55ab6573616
--- /dev/null
+++ b/acceptance/bundle/resources/model_provider_services/lifecycle/output.txt
@@ -0,0 +1,23 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-model-provider-service-test-[UNIQUE_NAME]/default/files...
+Created model_provider_services.mps
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] ai-gateway get-model-provider-service model-provider-services/main.default.test_mps_[UNIQUE_NAME]
+{
+  "name": "model-provider-services/main.default.test_mps_[UNIQUE_NAME]",
+  "comment": "Routes to a custom OpenAI-compatible provider"
+}
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.model_provider_services.mps
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-model-provider-service-test-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/model_provider_services/lifecycle/script b/acceptance/bundle/resources/model_provider_services/lifecycle/script
new file mode 100644
index 00000000000..634183f4759
--- /dev/null
+++ b/acceptance/bundle/resources/model_provider_services/lifecycle/script
@@ -0,0 +1,17 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+trace $CLI bundle deploy
+
+MPS_ID=$($CLI bundle summary --output json | jq -r '.resources.model_provider_services.mps.id')
+
+trace $CLI ai-gateway get-model-provider-service "model-provider-services/$MPS_ID" | jq '{name, comment}'
+
+# Verify there is no drift right after deploy. Text plan (not -o json) keeps the
+# output identical between the mock and a real workspace: the server populates
+# output-only fields but the resource action stays "unchanged".
+trace $CLI bundle plan
diff --git a/acceptance/bundle/resources/model_provider_services/lifecycle/test.toml b/acceptance/bundle/resources/model_provider_services/lifecycle/test.toml
new file mode 100644
index 00000000000..68085ea7337
--- /dev/null
+++ b/acceptance/bundle/resources/model_provider_services/lifecycle/test.toml
@@ -0,0 +1,9 @@
+# Model provider service lifecycle also runs against a real workspace. It uses a
+# custom OpenAI-compatible provider with placeholder base_url/api_key, the
+# smallest config the backend accepts (it cannot be created with only a comment).
+RecordRequests = false
+
+Ignore = [
+    "databricks.yml",
+    ".databricks",
+]
diff --git a/acceptance/bundle/resources/model_provider_services/remote-delete/databricks.yml b/acceptance/bundle/resources/model_provider_services/remote-delete/databricks.yml
new file mode 100644
index 00000000000..aeac81263d9
--- /dev/null
+++ b/acceptance/bundle/resources/model_provider_services/remote-delete/databricks.yml
@@ -0,0 +1,20 @@
+bundle:
+  name: test-bundle
+
+resources:
+  model_provider_services:
+    mps1:
+      parent: schemas/main.myschema
+      model_provider_service_id: myservice
+      comment: COMMENT1
+      config:
+        provider_type: EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM
+        targets:
+          - model: gpt-4o
+            native_api_types:
+              - openai/v1/chat/completions
+        custom:
+          direct:
+            base_url: https://api.example.com/v1
+            api_key:
+              plaintext: dummy-api-key
diff --git a/acceptance/bundle/resources/model_provider_services/remote-delete/out.test.toml b/acceptance/bundle/resources/model_provider_services/remote-delete/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/model_provider_services/remote-delete/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/model_provider_services/remote-delete/output.txt b/acceptance/bundle/resources/model_provider_services/remote-delete/output.txt
new file mode 100644
index 00000000000..49b01ec7128
--- /dev/null
+++ b/acceptance/bundle/resources/model_provider_services/remote-delete/output.txt
@@ -0,0 +1,20 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created model_provider_services.mps1
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Delete the resource out of band
+>>> [CLI] ai-gateway delete-model-provider-service model-provider-services/main.myschema.myservice
+
+=== Plan should detect the resource is gone and re-create it
+>>> [CLI] bundle plan
+create model_provider_services.mps1
+
+Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Destroy: 0 deleted
diff --git a/acceptance/bundle/resources/model_provider_services/remote-delete/script b/acceptance/bundle/resources/model_provider_services/remote-delete/script
new file mode 100644
index 00000000000..e7377733cc6
--- /dev/null
+++ b/acceptance/bundle/resources/model_provider_services/remote-delete/script
@@ -0,0 +1,9 @@
+trace $CLI bundle deploy
+
+title "Delete the resource out of band"
+trace $CLI ai-gateway delete-model-provider-service model-provider-services/main.myschema.myservice
+
+title "Plan should detect the resource is gone and re-create it"
+trace $CLI bundle plan
+
+trace $CLI bundle destroy --auto-approve
diff --git a/acceptance/bundle/resources/model_provider_services/remote-delete/test.toml b/acceptance/bundle/resources/model_provider_services/remote-delete/test.toml
new file mode 100644
index 00000000000..074377ab341
--- /dev/null
+++ b/acceptance/bundle/resources/model_provider_services/remote-delete/test.toml
@@ -0,0 +1,9 @@
+# Local only: simulates an out-of-band delete with a fixed resource name and no
+# cloud-valid config, so it can't run against a real workspace.
+Cloud = false
+
+RecordRequests = false
+
+Ignore = [
+    ".databricks",
+]
diff --git a/acceptance/bundle/resources/model_provider_services/test.toml b/acceptance/bundle/resources/model_provider_services/test.toml
new file mode 100644
index 00000000000..e2135896127
--- /dev/null
+++ b/acceptance/bundle/resources/model_provider_services/test.toml
@@ -0,0 +1,6 @@
+# AI Gateway securables are only deployable via the direct deployment engine
+# (there is no Terraform provider path for them in bundles).
+
+# Lifecycle tests also run against a real workspace. Tests that inspect the
+# recorded request stream (e.g. basic) can't run on cloud and override this.
+Cloud = true
diff --git a/acceptance/bundle/resources/model_services/basic/databricks.yml b/acceptance/bundle/resources/model_services/basic/databricks.yml
new file mode 100644
index 00000000000..3f82564f271
--- /dev/null
+++ b/acceptance/bundle/resources/model_services/basic/databricks.yml
@@ -0,0 +1,9 @@
+bundle:
+  name: test-bundle
+
+resources:
+  model_services:
+    ms1:
+      parent: schemas/main.myschema
+      model_service_id: myservice
+      comment: COMMENT1
diff --git a/acceptance/bundle/resources/model_services/basic/out.test.toml b/acceptance/bundle/resources/model_services/basic/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/model_services/basic/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/model_services/basic/output.txt b/acceptance/bundle/resources/model_services/basic/output.txt
new file mode 100644
index 00000000000..42d7686eee0
--- /dev/null
+++ b/acceptance/bundle/resources/model_services/basic/output.txt
@@ -0,0 +1,92 @@
+
+=== Initial summary before deploy
+>>> [CLI] bundle summary -o json
+{
+  "comment": "COMMENT1",
+  "model_service_id": "myservice",
+  "modified_status": "created",
+  "parent": "schemas/main.myschema"
+}
+
+=== Verify it does not exist yet
+>>> musterr [CLI] ai-gateway get-model-service model-services/main.myschema.myservice
+Error: Resource catalog.ModelService not found: main.myschema.myservice
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created model_services.ms1
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //unity
+{
+  "method": "POST",
+  "path": "/api/2.1/unity-catalog/model-services",
+  "q": {
+    "model_service_id": "myservice",
+    "parent": "schemas/main.myschema"
+  },
+  "body": {
+    "comment": "COMMENT1"
+  }
+}
+
+=== Summary should show the id and the Catalog Explorer url
+>>> [CLI] bundle summary -o json
+{
+  "id": "main.myschema.myservice",
+  "url": "[DATABRICKS_URL]/explore/data/model-services/main/myschema/myservice?w=[WORKSPACE_ID]"
+}
+
+=== Verify deployment
+>>> [CLI] ai-gateway get-model-service model-services/main.myschema.myservice
+{
+  "name": "model-services/main.myschema.myservice",
+  "comment": "COMMENT1"
+}
+
+=== Update comment (should update in place, not recreate)
+>>> update_file.py databricks.yml COMMENT1 COMMENT2
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Updated model_services.ms1
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //unity
+{
+  "method": "PATCH",
+  "path": "/api/2.1/unity-catalog/model-services/main.myschema.myservice",
+  "q": {
+    "update_mask": "*"
+  },
+  "body": {
+    "comment": "COMMENT2"
+  }
+}
+
+>>> [CLI] ai-gateway get-model-service model-services/main.myschema.myservice
+"COMMENT2"
+
+=== Change an immutable field (should plan a recreate)
+>>> update_file.py databricks.yml myservice myservice-renamed
+
+>>> [CLI] bundle plan
+recreate model_services.ms1
+
+Plan: 1 to add, 0 to change, 1 to delete, 0 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.model_services.ms1
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Destroy: 1 deleted
+
+>>> print_requests.py //unity
+{
+  "method": "DELETE",
+  "path": "/api/2.1/unity-catalog/model-services/main.myschema.myservice"
+}
diff --git a/acceptance/bundle/resources/model_services/basic/script b/acceptance/bundle/resources/model_services/basic/script
new file mode 100644
index 00000000000..f52a481086a
--- /dev/null
+++ b/acceptance/bundle/resources/model_services/basic/script
@@ -0,0 +1,29 @@
+title "Initial summary before deploy"
+trace $CLI bundle summary -o json | jq .resources.model_services.ms1
+
+title "Verify it does not exist yet"
+trace musterr $CLI ai-gateway get-model-service model-services/main.myschema.myservice
+
+trace $CLI bundle deploy
+trace print_requests.py //unity
+
+title "Summary should show the id and the Catalog Explorer url"
+trace $CLI bundle summary -o json | jq ".resources.model_services.ms1 | {id, url}"
+
+title "Verify deployment"
+trace $CLI ai-gateway get-model-service model-services/main.myschema.myservice | jq '{name, comment}'
+
+title "Update comment (should update in place, not recreate)"
+trace update_file.py databricks.yml COMMENT1 COMMENT2
+trace $CLI bundle deploy
+trace print_requests.py //unity
+trace $CLI ai-gateway get-model-service model-services/main.myschema.myservice | jq .comment
+
+title "Change an immutable field (should plan a recreate)"
+trace update_file.py databricks.yml myservice myservice-renamed
+trace $CLI bundle plan
+
+trace $CLI bundle destroy --auto-approve
+trace print_requests.py //unity
+
+rm -f out.requests.txt
diff --git a/acceptance/bundle/resources/model_services/basic/test.toml b/acceptance/bundle/resources/model_services/basic/test.toml
new file mode 100644
index 00000000000..116f2013783
--- /dev/null
+++ b/acceptance/bundle/resources/model_services/basic/test.toml
@@ -0,0 +1,7 @@
+# Local only: this test inspects the recorded request stream (print_requests),
+# which has no equivalent against a real workspace.
+Cloud = false
+
+Ignore = [
+    ".databricks",
+]
diff --git a/acceptance/bundle/resources/model_services/lifecycle/databricks.yml.tmpl b/acceptance/bundle/resources/model_services/lifecycle/databricks.yml.tmpl
new file mode 100644
index 00000000000..ad0a522fee8
--- /dev/null
+++ b/acceptance/bundle/resources/model_services/lifecycle/databricks.yml.tmpl
@@ -0,0 +1,17 @@
+bundle:
+  name: deploy-model-service-test-$UNIQUE_NAME
+
+resources:
+  model_services:
+    ms:
+      parent: schemas/main.default
+      model_service_id: test_ms_$UNIQUE_NAME
+      comment: "Routes chat traffic to a foundation model"
+      config:
+        routing:
+          destinations:
+            - name: primary
+              destination_type: DESTINATION_TYPE_PAY_PER_TOKEN_FOUNDATION_MODEL
+              pay_per_token_config:
+                model: models/system.ai.databricks-gpt-5
+              traffic_percentage: 100
diff --git a/acceptance/bundle/resources/model_services/lifecycle/out.test.toml b/acceptance/bundle/resources/model_services/lifecycle/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/model_services/lifecycle/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/model_services/lifecycle/output.txt b/acceptance/bundle/resources/model_services/lifecycle/output.txt
new file mode 100644
index 00000000000..84619322aa4
--- /dev/null
+++ b/acceptance/bundle/resources/model_services/lifecycle/output.txt
@@ -0,0 +1,23 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-model-service-test-[UNIQUE_NAME]/default/files...
+Created model_services.ms
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] ai-gateway get-model-service model-services/main.default.test_ms_[UNIQUE_NAME]
+{
+  "name": "model-services/main.default.test_ms_[UNIQUE_NAME]",
+  "comment": "Routes chat traffic to a foundation model"
+}
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.model_services.ms
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-model-service-test-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/model_services/lifecycle/script b/acceptance/bundle/resources/model_services/lifecycle/script
new file mode 100644
index 00000000000..ed9c256d01c
--- /dev/null
+++ b/acceptance/bundle/resources/model_services/lifecycle/script
@@ -0,0 +1,18 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+trace $CLI bundle deploy
+
+MODEL_SERVICE_ID=$($CLI bundle summary --output json | jq -r '.resources.model_services.ms.id')
+
+trace $CLI ai-gateway get-model-service "model-services/$MODEL_SERVICE_ID" | jq '{name, comment}'
+
+# Verify there is no drift right after deploy. Text plan (not -o json) keeps the
+# output identical between the mock and a real workspace: the server populates
+# output-only fields (owner, timestamps, resolved config) but the resource
+# action stays "unchanged", so the rendered plan is the same.
+trace $CLI bundle plan
diff --git a/acceptance/bundle/resources/model_services/lifecycle/test.toml b/acceptance/bundle/resources/model_services/lifecycle/test.toml
new file mode 100644
index 00000000000..402ecc18c7f
--- /dev/null
+++ b/acceptance/bundle/resources/model_services/lifecycle/test.toml
@@ -0,0 +1,9 @@
+# Model service lifecycle also runs against a real workspace. It uses a minimal
+# pay-per-token destination to a system.ai foundation model, the smallest config
+# the backend accepts (a model service cannot be created with only a comment).
+RecordRequests = false
+
+Ignore = [
+    "databricks.yml",
+    ".databricks",
+]
diff --git a/acceptance/bundle/resources/model_services/remote-delete/databricks.yml b/acceptance/bundle/resources/model_services/remote-delete/databricks.yml
new file mode 100644
index 00000000000..3f82564f271
--- /dev/null
+++ b/acceptance/bundle/resources/model_services/remote-delete/databricks.yml
@@ -0,0 +1,9 @@
+bundle:
+  name: test-bundle
+
+resources:
+  model_services:
+    ms1:
+      parent: schemas/main.myschema
+      model_service_id: myservice
+      comment: COMMENT1
diff --git a/acceptance/bundle/resources/model_services/remote-delete/out.test.toml b/acceptance/bundle/resources/model_services/remote-delete/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/model_services/remote-delete/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/model_services/remote-delete/output.txt b/acceptance/bundle/resources/model_services/remote-delete/output.txt
new file mode 100644
index 00000000000..7cedf83e463
--- /dev/null
+++ b/acceptance/bundle/resources/model_services/remote-delete/output.txt
@@ -0,0 +1,20 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created model_services.ms1
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Delete the resource out of band
+>>> [CLI] ai-gateway delete-model-service model-services/main.myschema.myservice
+
+=== Plan should detect the resource is gone and re-create it
+>>> [CLI] bundle plan
+create model_services.ms1
+
+Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Destroy: 0 deleted
diff --git a/acceptance/bundle/resources/model_services/remote-delete/script b/acceptance/bundle/resources/model_services/remote-delete/script
new file mode 100644
index 00000000000..ad9170ef687
--- /dev/null
+++ b/acceptance/bundle/resources/model_services/remote-delete/script
@@ -0,0 +1,9 @@
+trace $CLI bundle deploy
+
+title "Delete the resource out of band"
+trace $CLI ai-gateway delete-model-service model-services/main.myschema.myservice
+
+title "Plan should detect the resource is gone and re-create it"
+trace $CLI bundle plan
+
+trace $CLI bundle destroy --auto-approve
diff --git a/acceptance/bundle/resources/model_services/remote-delete/test.toml b/acceptance/bundle/resources/model_services/remote-delete/test.toml
new file mode 100644
index 00000000000..074377ab341
--- /dev/null
+++ b/acceptance/bundle/resources/model_services/remote-delete/test.toml
@@ -0,0 +1,9 @@
+# Local only: simulates an out-of-band delete with a fixed resource name and no
+# cloud-valid config, so it can't run against a real workspace.
+Cloud = false
+
+RecordRequests = false
+
+Ignore = [
+    ".databricks",
+]
diff --git a/acceptance/bundle/resources/model_services/test.toml b/acceptance/bundle/resources/model_services/test.toml
new file mode 100644
index 00000000000..e2135896127
--- /dev/null
+++ b/acceptance/bundle/resources/model_services/test.toml
@@ -0,0 +1,6 @@
+# AI Gateway securables are only deployable via the direct deployment engine
+# (there is no Terraform provider path for them in bundles).
+
+# Lifecycle tests also run against a real workspace. Tests that inspect the
+# recorded request stream (e.g. basic) can't run on cloud and override this.
+Cloud = true
diff --git a/acceptance/bundle/resources/model_serving_endpoints/basic/out.first-plan.direct.json b/acceptance/bundle/resources/model_serving_endpoints/basic/out.first-plan.direct.json
deleted file mode 100644
index 7f2a9ef3b63..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/basic/out.first-plan.direct.json
+++ /dev/null
@@ -1,41 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.model_serving_endpoints.my_endpoint": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "name": "[ENDPOINT_NAME_1]"
-        }
-      }
-    },
-    "resources.model_serving_endpoints.my_endpoint.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.model_serving_endpoints.my_endpoint",
-          "label": "${resources.model_serving_endpoints.my_endpoint.endpoint_id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "CAN_VIEW",
-              "user_name": "deco-test-user@databricks.com"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "service_principal_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/serving-endpoints/${resources.model_serving_endpoints.my_endpoint.endpoint_id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/basic/out.first-plan.terraform.json b/acceptance/bundle/resources/model_serving_endpoints/basic/out.first-plan.terraform.json
deleted file mode 100644
index ccefb6d6b46..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/basic/out.first-plan.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.model_serving_endpoints.my_endpoint": {
-      "action": "create"
-    },
-    "resources.model_serving_endpoints.my_endpoint.permissions": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/basic/out.first-plan.txt b/acceptance/bundle/resources/model_serving_endpoints/basic/out.first-plan.txt
new file mode 100644
index 00000000000..ec4d39e8dda
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/basic/out.first-plan.txt
@@ -0,0 +1,13 @@
+json.plan_version = [PLAN_VERSION];
+json.cli_version = "[CLI_VERSION]";
+json.plan.resources.model_serving_endpoints.my_endpoint.action = "create";
+json.plan.resources.model_serving_endpoints.my_endpoint.new_state.value.name = "[ENDPOINT_NAME_1]";
+json.plan.resources.model_serving_endpoints.my_endpoint.permissions.depends_on[0].node = "resources.model_serving_endpoints.my_endpoint";
+json.plan.resources.model_serving_endpoints.my_endpoint.permissions.depends_on[0].label = "${resources.model_serving_endpoints.my_endpoint.endpoint_id}";
+json.plan.resources.model_serving_endpoints.my_endpoint.permissions.action = "create";
+json.plan.resources.model_serving_endpoints.my_endpoint.permissions.new_state.value.object_id = "";
+json.plan.resources.model_serving_endpoints.my_endpoint.permissions.new_state.value.__embed__[0].level = "CAN_MANAGE";
+json.plan.resources.model_serving_endpoints.my_endpoint.permissions.new_state.value.__embed__[0].service_principal_name = "[USERNAME]";
+json.plan.resources.model_serving_endpoints.my_endpoint.permissions.new_state.value.__embed__[1].level = "CAN_VIEW";
+json.plan.resources.model_serving_endpoints.my_endpoint.permissions.new_state.value.__embed__[1].user_name = "deco-test-user@databricks.com";
+json.plan.resources.model_serving_endpoints.my_endpoint.permissions.new_state.vars.object_id = "/serving-endpoints/${resources.model_serving_endpoints.my_endpoint.endpoint_id}";
diff --git a/acceptance/bundle/resources/model_serving_endpoints/basic/out.first-requests.direct.json b/acceptance/bundle/resources/model_serving_endpoints/basic/out.first-requests.direct.json
deleted file mode 100644
index 1c0964aa6ec..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/basic/out.first-requests.direct.json
+++ /dev/null
@@ -1,23 +0,0 @@
-{
-  "method": "POST",
-  "path": "/api/2.0/serving-endpoints",
-  "body": {
-    "name": "[ENDPOINT_NAME_1]"
-  }
-}
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/serving-endpoints/[ENDPOINT_ID_1]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_VIEW",
-        "user_name": "deco-test-user@databricks.com"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "service_principal_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/basic/out.first-requests.terraform.json b/acceptance/bundle/resources/model_serving_endpoints/basic/out.first-requests.terraform.json
deleted file mode 100644
index d66fe66a2e6..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/basic/out.first-requests.terraform.json
+++ /dev/null
@@ -1,23 +0,0 @@
-{
-  "method": "POST",
-  "path": "/api/2.0/serving-endpoints",
-  "body": {
-    "name": "[ENDPOINT_NAME_1]"
-  }
-}
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/serving-endpoints/[ENDPOINT_ID_1]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_MANAGE",
-        "service_principal_name": "[USERNAME]"
-      },
-      {
-        "permission_level": "CAN_VIEW",
-        "user_name": "deco-test-user@databricks.com"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/basic/out.first-requests.txt b/acceptance/bundle/resources/model_serving_endpoints/basic/out.first-requests.txt
new file mode 100644
index 00000000000..ff4ff00fb8e
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/basic/out.first-requests.txt
@@ -0,0 +1,9 @@
+json[0].method = "POST";
+json[0].path = "/api/2.0/serving-endpoints";
+json[0].body.name = "[ENDPOINT_NAME_1]";
+json[1].method = "PUT";
+json[1].path = "/api/2.0/permissions/serving-endpoints/[ENDPOINT_ID_1]";
+json[1].body.access_control_list[0].permission_level = "CAN_MANAGE";
+json[1].body.access_control_list[0].service_principal_name = "[USERNAME]";
+json[1].body.access_control_list[1].permission_level = "CAN_VIEW";
+json[1].body.access_control_list[1].user_name = "deco-test-user@databricks.com";
diff --git a/acceptance/bundle/resources/model_serving_endpoints/basic/out.second-plan.direct.json b/acceptance/bundle/resources/model_serving_endpoints/basic/out.second-plan.direct.json
deleted file mode 100644
index 690eb2c000c..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/basic/out.second-plan.direct.json
+++ /dev/null
@@ -1,100 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.model_serving_endpoints.my_endpoint": {
-      "action": "recreate",
-      "new_state": {
-        "value": {
-          "name": "[ENDPOINT_NAME_2]"
-        }
-      },
-      "remote_state": {
-        "endpoint_details": {
-          "creation_timestamp": [UNIX_TIME_MILLIS][0],
-          "creator": "[USERNAME]",
-          "description": "",
-          "id": "[ENDPOINT_ID_1]",
-          "last_updated_timestamp": [UNIX_TIME_MILLIS][0],
-          "name": "[ENDPOINT_NAME_1]",
-          "permission_level": "CAN_MANAGE",
-          "route_optimized": false,
-          "state": {
-            "config_update": "NOT_UPDATING",
-            "ready": "NOT_READY"
-          }
-        },
-        "endpoint_id": "[ENDPOINT_ID_1]"
-      },
-      "changes": {
-        "description": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": ""
-        },
-        "name": {
-          "action": "recreate",
-          "reason": "immutable",
-          "old": "[ENDPOINT_NAME_1]",
-          "new": "[ENDPOINT_NAME_2]",
-          "remote": "[ENDPOINT_NAME_1]"
-        },
-        "route_optimized": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": false
-        }
-      }
-    },
-    "resources.model_serving_endpoints.my_endpoint.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.model_serving_endpoints.my_endpoint",
-          "label": "${resources.model_serving_endpoints.my_endpoint.endpoint_id}"
-        }
-      ],
-      "action": "update",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "CAN_VIEW",
-              "user_name": "deco-test-user@databricks.com"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "service_principal_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/serving-endpoints/${resources.model_serving_endpoints.my_endpoint.endpoint_id}"
-        }
-      },
-      "remote_state": {
-        "object_id": "/serving-endpoints/[ENDPOINT_ID_1]",
-        "__embed__": [
-          {
-            "level": "CAN_VIEW",
-            "user_name": "deco-test-user@databricks.com"
-          },
-          {
-            "level": "CAN_MANAGE",
-            "service_principal_name": "[USERNAME]"
-          }
-        ]
-      },
-      "changes": {
-        "object_id": {
-          "action": "update",
-          "old": "/serving-endpoints/[ENDPOINT_ID_1]",
-          "new": "",
-          "remote": "/serving-endpoints/[ENDPOINT_ID_1]"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/basic/out.second-plan.terraform.json b/acceptance/bundle/resources/model_serving_endpoints/basic/out.second-plan.terraform.json
deleted file mode 100644
index 0d50d236cc9..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/basic/out.second-plan.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.model_serving_endpoints.my_endpoint": {
-      "action": "recreate"
-    },
-    "resources.model_serving_endpoints.my_endpoint.permissions": {
-      "action": "recreate"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/basic/out.second-plan.txt b/acceptance/bundle/resources/model_serving_endpoints/basic/out.second-plan.txt
new file mode 100644
index 00000000000..60bca95b9ff
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/basic/out.second-plan.txt
@@ -0,0 +1,49 @@
+json.plan_version = [PLAN_VERSION];
+json.cli_version = "[CLI_VERSION]";
+json.lineage = "[UUID]";
+json.serial = 1;
+json.plan.resources.model_serving_endpoints.my_endpoint.action = "recreate";
+json.plan.resources.model_serving_endpoints.my_endpoint.new_state.value.name = "[ENDPOINT_NAME_2]";
+json.plan.resources.model_serving_endpoints.my_endpoint.remote_state.description = "";
+json.plan.resources.model_serving_endpoints.my_endpoint.remote_state.endpoint_details.creation_timestamp = [UNIX_TIME_MILLIS][0];
+json.plan.resources.model_serving_endpoints.my_endpoint.remote_state.endpoint_details.creator = "[USERNAME]";
+json.plan.resources.model_serving_endpoints.my_endpoint.remote_state.endpoint_details.description = "";
+json.plan.resources.model_serving_endpoints.my_endpoint.remote_state.endpoint_details.id = "[ENDPOINT_ID_1]";
+json.plan.resources.model_serving_endpoints.my_endpoint.remote_state.endpoint_details.last_updated_timestamp = [UNIX_TIME_MILLIS][0];
+json.plan.resources.model_serving_endpoints.my_endpoint.remote_state.endpoint_details.name = "[ENDPOINT_NAME_1]";
+json.plan.resources.model_serving_endpoints.my_endpoint.remote_state.endpoint_details.permission_level = "CAN_MANAGE";
+json.plan.resources.model_serving_endpoints.my_endpoint.remote_state.endpoint_details.route_optimized = false;
+json.plan.resources.model_serving_endpoints.my_endpoint.remote_state.endpoint_details.state.config_update = "NOT_UPDATING";
+json.plan.resources.model_serving_endpoints.my_endpoint.remote_state.endpoint_details.state.ready = "NOT_READY";
+json.plan.resources.model_serving_endpoints.my_endpoint.remote_state.endpoint_id = "[ENDPOINT_ID_1]";
+json.plan.resources.model_serving_endpoints.my_endpoint.remote_state.name = "[ENDPOINT_NAME_1]";
+json.plan.resources.model_serving_endpoints.my_endpoint.remote_state.route_optimized = false;
+json.plan.resources.model_serving_endpoints.my_endpoint.changes.description.action = "skip";
+json.plan.resources.model_serving_endpoints.my_endpoint.changes.description.reason = "empty";
+json.plan.resources.model_serving_endpoints.my_endpoint.changes.description.remote = "";
+json.plan.resources.model_serving_endpoints.my_endpoint.changes.name.action = "recreate";
+json.plan.resources.model_serving_endpoints.my_endpoint.changes.name.reason = "id_field";
+json.plan.resources.model_serving_endpoints.my_endpoint.changes.name.old = "[ENDPOINT_NAME_1]";
+json.plan.resources.model_serving_endpoints.my_endpoint.changes.name.new = "[ENDPOINT_NAME_2]";
+json.plan.resources.model_serving_endpoints.my_endpoint.changes.name.remote = "[ENDPOINT_NAME_1]";
+json.plan.resources.model_serving_endpoints.my_endpoint.changes.route_optimized.action = "skip";
+json.plan.resources.model_serving_endpoints.my_endpoint.changes.route_optimized.reason = "empty";
+json.plan.resources.model_serving_endpoints.my_endpoint.changes.route_optimized.remote = false;
+json.plan.resources.model_serving_endpoints.my_endpoint.permissions.depends_on[0].node = "resources.model_serving_endpoints.my_endpoint";
+json.plan.resources.model_serving_endpoints.my_endpoint.permissions.depends_on[0].label = "${resources.model_serving_endpoints.my_endpoint.endpoint_id}";
+json.plan.resources.model_serving_endpoints.my_endpoint.permissions.action = "update";
+json.plan.resources.model_serving_endpoints.my_endpoint.permissions.new_state.value.object_id = "";
+json.plan.resources.model_serving_endpoints.my_endpoint.permissions.new_state.value.__embed__[0].level = "CAN_MANAGE";
+json.plan.resources.model_serving_endpoints.my_endpoint.permissions.new_state.value.__embed__[0].service_principal_name = "[USERNAME]";
+json.plan.resources.model_serving_endpoints.my_endpoint.permissions.new_state.value.__embed__[1].level = "CAN_VIEW";
+json.plan.resources.model_serving_endpoints.my_endpoint.permissions.new_state.value.__embed__[1].user_name = "deco-test-user@databricks.com";
+json.plan.resources.model_serving_endpoints.my_endpoint.permissions.new_state.vars.object_id = "/serving-endpoints/${resources.model_serving_endpoints.my_endpoint.endpoint_id}";
+json.plan.resources.model_serving_endpoints.my_endpoint.permissions.remote_state.object_id = "/serving-endpoints/[ENDPOINT_ID_1]";
+json.plan.resources.model_serving_endpoints.my_endpoint.permissions.remote_state.__embed__[0].level = "CAN_MANAGE";
+json.plan.resources.model_serving_endpoints.my_endpoint.permissions.remote_state.__embed__[0].service_principal_name = "[USERNAME]";
+json.plan.resources.model_serving_endpoints.my_endpoint.permissions.remote_state.__embed__[1].level = "CAN_VIEW";
+json.plan.resources.model_serving_endpoints.my_endpoint.permissions.remote_state.__embed__[1].user_name = "deco-test-user@databricks.com";
+json.plan.resources.model_serving_endpoints.my_endpoint.permissions.changes.object_id.action = "update";
+json.plan.resources.model_serving_endpoints.my_endpoint.permissions.changes.object_id.old = "/serving-endpoints/[ENDPOINT_ID_1]";
+json.plan.resources.model_serving_endpoints.my_endpoint.permissions.changes.object_id.new = "";
+json.plan.resources.model_serving_endpoints.my_endpoint.permissions.changes.object_id.remote = "/serving-endpoints/[ENDPOINT_ID_1]";
diff --git a/acceptance/bundle/resources/model_serving_endpoints/basic/out.second-requests.direct.json b/acceptance/bundle/resources/model_serving_endpoints/basic/out.second-requests.direct.json
deleted file mode 100644
index a392327a811..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/basic/out.second-requests.direct.json
+++ /dev/null
@@ -1,27 +0,0 @@
-{
-  "method": "DELETE",
-  "path": "/api/2.0/serving-endpoints/[ENDPOINT_NAME_1]"
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/serving-endpoints",
-  "body": {
-    "name": "[ENDPOINT_NAME_2]"
-  }
-}
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/serving-endpoints/[ENDPOINT_ID_2]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_VIEW",
-        "user_name": "deco-test-user@databricks.com"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "service_principal_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/basic/out.second-requests.terraform.json b/acceptance/bundle/resources/model_serving_endpoints/basic/out.second-requests.terraform.json
deleted file mode 100644
index 8a2028f4504..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/basic/out.second-requests.terraform.json
+++ /dev/null
@@ -1,39 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/serving-endpoints/[ENDPOINT_ID_1]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_MANAGE",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
-{
-  "method": "DELETE",
-  "path": "/api/2.0/serving-endpoints/[ENDPOINT_NAME_1]"
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/serving-endpoints",
-  "body": {
-    "name": "[ENDPOINT_NAME_2]"
-  }
-}
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/serving-endpoints/[ENDPOINT_ID_2]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_MANAGE",
-        "service_principal_name": "[USERNAME]"
-      },
-      {
-        "permission_level": "CAN_VIEW",
-        "user_name": "deco-test-user@databricks.com"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/basic/out.second-requests.txt b/acceptance/bundle/resources/model_serving_endpoints/basic/out.second-requests.txt
new file mode 100644
index 00000000000..8f5318593a8
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/basic/out.second-requests.txt
@@ -0,0 +1,11 @@
+json[0].method = "DELETE";
+json[0].path = "/api/2.0/serving-endpoints/[ENDPOINT_NAME_1]";
+json[1].method = "POST";
+json[1].path = "/api/2.0/serving-endpoints";
+json[1].body.name = "[ENDPOINT_NAME_2]";
+json[2].method = "PUT";
+json[2].path = "/api/2.0/permissions/serving-endpoints/[ENDPOINT_ID_2]";
+json[2].body.access_control_list[0].permission_level = "CAN_MANAGE";
+json[2].body.access_control_list[0].service_principal_name = "[USERNAME]";
+json[2].body.access_control_list[1].permission_level = "CAN_VIEW";
+json[2].body.access_control_list[1].user_name = "deco-test-user@databricks.com";
diff --git a/acceptance/bundle/resources/model_serving_endpoints/basic/out.test.toml b/acceptance/bundle/resources/model_serving_endpoints/basic/out.test.toml
index 2d812727e32..0f167effef1 100644
--- a/acceptance/bundle/resources/model_serving_endpoints/basic/out.test.toml
+++ b/acceptance/bundle/resources/model_serving_endpoints/basic/out.test.toml
@@ -1,4 +1,2 @@
-Local = false
 Cloud = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/model_serving_endpoints/basic/output.txt b/acceptance/bundle/resources/model_serving_endpoints/basic/output.txt
index 7b3b010eedd..d4e80df1f81 100644
--- a/acceptance/bundle/resources/model_serving_endpoints/basic/output.txt
+++ b/acceptance/bundle/resources/model_serving_endpoints/basic/output.txt
@@ -1,13 +1,7 @@
 
 >>> [CLI] bundle plan -o json
 
->>> [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> print_requests.py //serving-endpoints
+>>> [CLI] bundle deploy -qq
 
 === Print the GET endpoint details
 {
@@ -17,13 +11,7 @@ Deployment complete!
 
 >>> [CLI] bundle plan -o json
 
->>> [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> print_requests.py //serving-endpoints
+>>> [CLI] bundle deploy -qq
 
 === Print the GET endpoint details
 {
@@ -37,5 +25,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/model_serving_endpoints/basic/script b/acceptance/bundle/resources/model_serving_endpoints/basic/script
index c06b058d59f..c12cb1bd8f2 100755
--- a/acceptance/bundle/resources/model_serving_endpoints/basic/script
+++ b/acceptance/bundle/resources/model_serving_endpoints/basic/script
@@ -4,36 +4,45 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm out.requests.txt
+    rm "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
-trace $CLI bundle plan -o json > out.first-plan.$DATABRICKS_BUNDLE_ENGINE.json
-trace $CLI bundle deploy
-trace print_requests.py //serving-endpoints > out.first-requests.$DATABRICKS_BUNDLE_ENGINE.json
-
-echo "$ENDPOINT_NAME:ENDPOINT_NAME_1" >> ACC_REPLS
+# Sort the permissions ACL (embedded in the plan under __embed__): the backend
+# returns ACL entries in a nondeterministic order, and the permissions resource
+# treats them as an unordered set keyed by principal (see KeyedSlices in
+# bundle/direct/dresources/permissions.go), so sorting keeps the plan golden
+# stable across runs. Same approach as secret_scopes/basic and the requests
+# sorting below.
+trace $CLI bundle plan -o json | nostamp | gron.py --sort-arrays __embed__ > out.first-plan.txt
+trace $CLI bundle deploy -qq
+# Sort access_control_list: the terraform engine stores it as a set whose order
+# depends on the (unmasked) principal value, so it differs between the local fake
+# SP and the real cloud SP. Sorting makes the recorded request stable across both.
+print_requests.py //serving-endpoints | gron.py --sort-arrays access_control_list > out.first-requests.txt
+
+add_repl "$ENDPOINT_NAME" ENDPOINT_NAME_1
 
 # Record the endpoint ID for the first endpoint
 get_output=$($CLI serving-endpoints get $ENDPOINT_NAME)
 endpoint_id=$(echo "$get_output" | jq -r '.id')
-echo "$endpoint_id:ENDPOINT_ID_1" >> ACC_REPLS
+add_repl "$endpoint_id" ENDPOINT_ID_1
 
 title "Print the GET endpoint details\n"
 echo "$get_output" | jq '{name, creator}'
 
 export ENDPOINT_NAME="test-endpoint-$UNIQUE_NAME-2"
 envsubst < databricks.yml.tmpl > databricks.yml
-trace $CLI bundle plan -o json > out.second-plan.$DATABRICKS_BUNDLE_ENGINE.json
-trace $CLI bundle deploy
-trace print_requests.py //serving-endpoints > out.second-requests.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp | gron.py --sort-arrays __embed__ > out.second-plan.txt
+trace $CLI bundle deploy -qq
+print_requests.py //serving-endpoints | gron.py --sort-arrays access_control_list > out.second-requests.txt
 
-echo "$ENDPOINT_NAME:ENDPOINT_NAME_2" >> ACC_REPLS
+add_repl "$ENDPOINT_NAME" ENDPOINT_NAME_2
 
 # Record the endpoint ID for the second endpoint
 get_output=$($CLI serving-endpoints get $ENDPOINT_NAME)
 endpoint_id=$(echo "$get_output" | jq -r '.id')
-echo "$endpoint_id:ENDPOINT_ID_2" >> ACC_REPLS
+add_repl "$endpoint_id" ENDPOINT_ID_2
 
 title "Print the GET endpoint details\n"
 echo "$get_output" | jq '{name, creator}'
diff --git a/acceptance/bundle/resources/model_serving_endpoints/basic/test.toml b/acceptance/bundle/resources/model_serving_endpoints/basic/test.toml
index 2aa692e7f24..0d8ebd3ecec 100644
--- a/acceptance/bundle/resources/model_serving_endpoints/basic/test.toml
+++ b/acceptance/bundle/resources/model_serving_endpoints/basic/test.toml
@@ -1,7 +1,7 @@
-Local = false
 Cloud = true
 RecordRequests = true
-RequiresUnityCatalog = true
 
-[EnvMatrix]
-  DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+# Cloud goldens were recorded under a service principal, so the deployer's
+# auto-added CAN_MANAGE ACL serializes as service_principal_name. Make the
+# local fake report the deployer as a service principal to match.
+IsServicePrincipal = true
diff --git a/acceptance/bundle/resources/model_serving_endpoints/drift/recreated_same_name/databricks.yml.tmpl b/acceptance/bundle/resources/model_serving_endpoints/drift/recreated_same_name/databricks.yml.tmpl
new file mode 100644
index 00000000000..8dcc1302127
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/drift/recreated_same_name/databricks.yml.tmpl
@@ -0,0 +1,13 @@
+bundle:
+  name: drift-mse-recreated-same-name-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  model_serving_endpoints:
+    my_endpoint:
+      name: mse-endpoint-$UNIQUE_NAME
+      permissions:
+        - level: CAN_VIEW
+          user_name: deco-test-user@databricks.com
diff --git a/acceptance/bundle/resources/model_serving_endpoints/drift/recreated_same_name/out.test.toml b/acceptance/bundle/resources/model_serving_endpoints/drift/recreated_same_name/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/drift/recreated_same_name/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/model_serving_endpoints/drift/recreated_same_name/output.txt b/acceptance/bundle/resources/model_serving_endpoints/drift/recreated_same_name/output.txt
new file mode 100644
index 00000000000..fdeba3e5dc4
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/drift/recreated_same_name/output.txt
@@ -0,0 +1,63 @@
+
+=== Initial deployment
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/drift-mse-recreated-same-name-[UNIQUE_NAME]/default/files...
+Created model_serving_endpoints.my_endpoint
+Created model_serving_endpoints.my_endpoint.permissions
+Files: 0 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] serving-endpoints get mse-endpoint-[UNIQUE_NAME]
+{
+  "name": "mse-endpoint-[UNIQUE_NAME]",
+  "creator": "[USERNAME]"
+}
+
+=== Delete and recreate remotely with the same name
+>>> [CLI] serving-endpoints delete mse-endpoint-[UNIQUE_NAME]
+
+>>> [CLI] serving-endpoints create mse-endpoint-[UNIQUE_NAME] --no-wait
+{
+  "name": "mse-endpoint-[UNIQUE_NAME]",
+  "creator": "[USERNAME]"
+}
+
+>>> [CLI] serving-endpoints get mse-endpoint-[UNIQUE_NAME]
+{
+  "name": "mse-endpoint-[UNIQUE_NAME]",
+  "creator": "[USERNAME]"
+}
+Original endpoint id: [ORIGINAL_ENDPOINT_ID]
+Remote recreated endpoint id: [REMOTE_RECREATED_ENDPOINT_ID]
+
+=== Plan after out-of-band recreate
+>>> [CLI] bundle plan
+update model_serving_endpoints.my_endpoint.permissions
+
+Plan: 0 to add, 1 to change, 0 to delete, 1 unchanged
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/drift-mse-recreated-same-name-[UNIQUE_NAME]/default/files...
+Updated model_serving_endpoints.my_endpoint.permissions
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 1 unchanged
+
+>>> [CLI] serving-endpoints get mse-endpoint-[UNIQUE_NAME]
+{
+  "name": "mse-endpoint-[UNIQUE_NAME]",
+  "creator": "[USERNAME]"
+}
+
+=== Persistent drift after deploy: V1 permissions API leaves an ACL on the deleted endpoint id, so plan keeps showing an update.
+>>> [CLI] bundle plan
+update model_serving_endpoints.my_endpoint.permissions
+
+Plan: 0 to add, 1 to change, 0 to delete, 1 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.model_serving_endpoints.my_endpoint
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/drift-mse-recreated-same-name-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/model_serving_endpoints/drift/recreated_same_name/script b/acceptance/bundle/resources/model_serving_endpoints/drift/recreated_same_name/script
new file mode 100644
index 00000000000..cdc3cb1de33
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/drift/recreated_same_name/script
@@ -0,0 +1,40 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+endpoint_name="mse-endpoint-${UNIQUE_NAME}"
+
+title "Initial deployment"
+trace $CLI bundle deploy
+
+original_endpoint_id=$($CLI serving-endpoints get "${endpoint_name}" | jq -r '.id')
+add_repl "$original_endpoint_id" "ORIGINAL_ENDPOINT_ID"
+trace $CLI serving-endpoints get "${endpoint_name}" | jq '{name, creator}'
+
+title "Delete and recreate remotely with the same name"
+trace $CLI serving-endpoints delete "${endpoint_name}"
+trace $CLI serving-endpoints create "${endpoint_name}" --no-wait | jq '{name, creator}'
+
+remote_recreated_endpoint_id=$($CLI serving-endpoints get "${endpoint_name}" | jq -r '.id')
+add_repl "$remote_recreated_endpoint_id" "REMOTE_RECREATED_ENDPOINT_ID"
+trace $CLI serving-endpoints get "${endpoint_name}" | jq '{name, creator}'
+
+printf "Original endpoint id: %s\n" "$original_endpoint_id"
+printf "Remote recreated endpoint id: %s\n" "$remote_recreated_endpoint_id"
+
+if [ "$original_endpoint_id" = "$remote_recreated_endpoint_id" ]; then
+    echo "Expected remote recreation to assign a different endpoint id" >&2
+    exit 1
+fi
+
+title "Plan after out-of-band recreate"
+trace $CLI bundle plan
+
+trace $CLI bundle deploy
+trace $CLI serving-endpoints get "${endpoint_name}" | jq '{name, creator}'
+
+title "Persistent drift after deploy: V1 permissions API leaves an ACL on the deleted endpoint id, so plan keeps showing an update."
+trace $CLI bundle plan
diff --git a/acceptance/bundle/resources/model_serving_endpoints/drift/recreated_same_name/test.toml b/acceptance/bundle/resources/model_serving_endpoints/drift/recreated_same_name/test.toml
new file mode 100644
index 00000000000..0423113d9fa
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/drift/recreated_same_name/test.toml
@@ -0,0 +1,4 @@
+Badness = "After deleting and recreating a model serving endpoint remotely with the same name but a different endpoint_id, bundle plan/deploy ends up with a permanent update on permissions because the V1 permissions API does not delete ACLs immediately when the parent is gone."
+
+Cloud = true
+RecordRequests = false
diff --git a/acceptance/bundle/resources/model_serving_endpoints/drift/telemetry_config_unmanaged/databricks.yml b/acceptance/bundle/resources/model_serving_endpoints/drift/telemetry_config_unmanaged/databricks.yml
new file mode 100644
index 00000000000..1291612ba80
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/drift/telemetry_config_unmanaged/databricks.yml
@@ -0,0 +1,14 @@
+bundle:
+  name: test-bundle
+
+resources:
+  model_serving_endpoints:
+    endpoint1:
+      name: test-endpoint
+      config:
+        served_entities:
+          - name: prod
+            entity_name: main.default.test_model
+            entity_version: "1"
+            workload_size: Small
+            scale_to_zero_enabled: true
diff --git a/acceptance/bundle/resources/model_serving_endpoints/drift/telemetry_config_unmanaged/out.test.toml b/acceptance/bundle/resources/model_serving_endpoints/drift/telemetry_config_unmanaged/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/drift/telemetry_config_unmanaged/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/model_serving_endpoints/drift/telemetry_config_unmanaged/output.txt b/acceptance/bundle/resources/model_serving_endpoints/drift/telemetry_config_unmanaged/output.txt
new file mode 100644
index 00000000000..4aec6358c5c
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/drift/telemetry_config_unmanaged/output.txt
@@ -0,0 +1,35 @@
+
+=== Deploy without telemetry_config
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created model_serving_endpoints.endpoint1
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Configure telemetry out of band
+=== Remote-only telemetry_config is not drift
+>>> [CLI] bundle plan --output json
+{
+  "telemetry_config": {
+    "action": "skip",
+    "reason": "backend_default",
+    "remote": {
+      "telemetry_profile_id": "[UUID]"
+    }
+  }
+}
+
+=== Deploy does not remove it
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
+
+>>> [CLI] api get /api/2.0/serving-endpoints/test-endpoint
+{
+  "telemetry_profile_id": "[UUID]"
+}
+
+=== Only the out-of-band telemetry PATCH was sent
+>>> print_requests.py --method PATCH --oneline //serving-endpoints
+{"method": "PATCH", "path": "/api/2.0/serving-endpoints/test-endpoint/telemetry-config", "body": {"telemetry_config": {"table_names": {"logs_table": "main.default.other_logs"}}}}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/drift/telemetry_config_unmanaged/script b/acceptance/bundle/resources/model_serving_endpoints/drift/telemetry_config_unmanaged/script
new file mode 100644
index 00000000000..ea0fabd6338
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/drift/telemetry_config_unmanaged/script
@@ -0,0 +1,16 @@
+
+title "Deploy without telemetry_config"
+trace $CLI bundle deploy
+
+title "Configure telemetry out of band"
+MSYS_NO_PATHCONV=1 $CLI api patch "/api/2.0/serving-endpoints/test-endpoint/telemetry-config" --json '{"telemetry_config": {"table_names": {"logs_table": "main.default.other_logs"}}}' > /dev/null
+
+title "Remote-only telemetry_config is not drift"
+trace $CLI bundle plan --output json | nostamp | jq '.plan[].changes | with_entries(select(.key | startswith("telemetry_config")))'
+
+title "Deploy does not remove it"
+trace $CLI bundle deploy
+MSYS_NO_PATHCONV=1 trace $CLI api get "/api/2.0/serving-endpoints/test-endpoint" | jq .telemetry_config
+
+title "Only the out-of-band telemetry PATCH was sent"
+trace print_requests.py --method PATCH --oneline //serving-endpoints
diff --git a/acceptance/bundle/resources/model_serving_endpoints/drift/telemetry_config_unmanaged/test.toml b/acceptance/bundle/resources/model_serving_endpoints/drift/telemetry_config_unmanaged/test.toml
new file mode 100644
index 00000000000..d6265602137
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/drift/telemetry_config_unmanaged/test.toml
@@ -0,0 +1,3 @@
+RecordRequests = true
+
+# Telemetry classification is direct-engine-specific.
diff --git a/acceptance/bundle/resources/model_serving_endpoints/drift/telemetry_config_with_config_update/databricks.yml b/acceptance/bundle/resources/model_serving_endpoints/drift/telemetry_config_with_config_update/databricks.yml
new file mode 100644
index 00000000000..889f5172c6a
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/drift/telemetry_config_with_config_update/databricks.yml
@@ -0,0 +1,19 @@
+bundle:
+  name: test-bundle
+
+resources:
+  model_serving_endpoints:
+    endpoint1:
+      name: test-endpoint
+      config:
+        served_entities:
+          - name: prod
+            entity_name: main.default.test_model
+            entity_version: "1"
+            workload_size: Small
+            scale_to_zero_enabled: true
+      telemetry_config: # TELEMETRY
+        table_names: # TELEMETRY
+          logs_table: main.default.test_logs # TELEMETRY
+        inference_table_config: # TELEMETRY
+          sampling_fraction: 0.5 # TELEMETRY
diff --git a/acceptance/bundle/resources/model_serving_endpoints/drift/telemetry_config_with_config_update/out.test.toml b/acceptance/bundle/resources/model_serving_endpoints/drift/telemetry_config_with_config_update/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/drift/telemetry_config_with_config_update/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/model_serving_endpoints/drift/telemetry_config_with_config_update/output.txt b/acceptance/bundle/resources/model_serving_endpoints/drift/telemetry_config_with_config_update/output.txt
new file mode 100644
index 00000000000..093d5875e98
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/drift/telemetry_config_with_config_update/output.txt
@@ -0,0 +1,45 @@
+
+=== Initial deployment
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created model_serving_endpoints.endpoint1
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Update config and telemetry_config
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Updated model_serving_endpoints.endpoint1
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+=== Plan converges
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+=== Request order: config PUT, poll, telemetry PATCH
+>>> print_requests.py --get --oneline //serving-endpoints
+1 {"method": "POST", "path": "/api/2.0/serving-endpoints", "body": {"config": {"served_entities": [{"entity_name": "main.default.test_model", "entity_version": "1", "name": "prod", "scale_to_zero_enabled": true, "workload_size": "Small"}]}, "name": "test-endpoint", "telemetry_config": {"inference_table_config": {"sampling_fraction": 0.5}, "table_names": {"logs_table": "main.default.test_logs"}}}}
+2 {"method": "GET", "path": "/api/2.0/serving-endpoints/test-endpoint"}
+1 {"method": "PUT", "path": "/api/2.0/serving-endpoints/test-endpoint/config", "body": {"served_entities": [{"entity_name": "main.default.test_model", "entity_version": "1", "name": "prod", "scale_to_zero_enabled": true, "workload_size": "Medium"}]}}
+2 {"method": "GET", "path": "/api/2.0/serving-endpoints/test-endpoint"}
+1 {"method": "PATCH", "path": "/api/2.0/serving-endpoints/test-endpoint/telemetry-config", "body": {"telemetry_config": {"inference_table_config": {"sampling_fraction": 0.9}, "table_names": {"logs_table": "main.default.test_logs"}}}}
+2 {"method": "GET", "path": "/api/2.0/serving-endpoints/test-endpoint"}
+
+=== Remove telemetry_config
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Updated model_serving_endpoints.endpoint1
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] api get /api/2.0/serving-endpoints/test-endpoint
+null
+
+=== Plan converges after removal
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+=== Removal sends an empty telemetry PATCH
+>>> print_requests.py --method PATCH --oneline //serving-endpoints
+{"method": "PATCH", "path": "/api/2.0/serving-endpoints/test-endpoint/telemetry-config", "body": {}}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/drift/telemetry_config_with_config_update/script b/acceptance/bundle/resources/model_serving_endpoints/drift/telemetry_config_with_config_update/script
new file mode 100644
index 00000000000..9b8bb3d543d
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/drift/telemetry_config_with_config_update/script
@@ -0,0 +1,25 @@
+
+title "Initial deployment"
+trace $CLI bundle deploy
+
+title "Update config and telemetry_config"
+update_file.py databricks.yml "workload_size: Small" "workload_size: Medium"
+update_file.py databricks.yml "sampling_fraction: 0.5" "sampling_fraction: 0.9"
+trace $CLI bundle deploy
+
+title "Plan converges"
+trace $CLI bundle plan | contains.py "Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged"
+
+title "Request order: config PUT, poll, telemetry PATCH"
+trace print_requests.py --get --oneline //serving-endpoints | uniq -c | sed 's/^ *//'
+
+title "Remove telemetry_config"
+grep -v TELEMETRY databricks.yml > updated.yml && mv updated.yml databricks.yml
+trace $CLI bundle deploy
+MSYS_NO_PATHCONV=1 trace $CLI api get "/api/2.0/serving-endpoints/test-endpoint" | jq .telemetry_config
+
+title "Plan converges after removal"
+trace $CLI bundle plan | contains.py "Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged"
+
+title "Removal sends an empty telemetry PATCH"
+trace print_requests.py --method PATCH --oneline //serving-endpoints
diff --git a/acceptance/bundle/resources/model_serving_endpoints/drift/telemetry_config_with_config_update/test.toml b/acceptance/bundle/resources/model_serving_endpoints/drift/telemetry_config_with_config_update/test.toml
new file mode 100644
index 00000000000..ef38bf79289
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/drift/telemetry_config_with_config_update/test.toml
@@ -0,0 +1,3 @@
+RecordRequests = true
+
+# Telemetry updates are direct-engine-specific.
diff --git a/acceptance/bundle/resources/model_serving_endpoints/drift/write_only/databricks.yml b/acceptance/bundle/resources/model_serving_endpoints/drift/write_only/databricks.yml
new file mode 100644
index 00000000000..b59365bd95c
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/drift/write_only/databricks.yml
@@ -0,0 +1,36 @@
+bundle:
+  name: test-bundle
+
+resources:
+  model_serving_endpoints:
+    endpoint1:
+      name: test-endpoint
+      config:
+        served_entities:
+          - name: prod
+            # burst_scaling_enabled is accepted on write but never returned on GET.
+            burst_scaling_enabled: true
+            external_model:
+              name: gpt-4o-mini
+              provider: openai
+              task: llm/v1/chat
+              openai_config:
+                # Write-only secret: the backend stores it and never echoes it back.
+                openai_api_key_plaintext: sk-test-plaintext-key
+          - name: prod-custom
+            external_model:
+              name: my-custom-model
+              provider: custom
+              task: llm/v1/chat
+              custom_provider_config:
+                custom_provider_url: https://custom-provider.example
+                api_key_auth:
+                  key: Authorization
+                  # Write-only secret nested a level deeper than the sibling *_config
+                  # plaintext keys; only reachable now that the generator descends past
+                  # the old depth-4 cap into the auth wrapper.
+                  value_plaintext: custom-plaintext-key
+        traffic_config:
+          routes:
+            - served_model_name: prod
+              traffic_percentage: 100
diff --git a/acceptance/bundle/resources/model_serving_endpoints/drift/write_only/out.test.toml b/acceptance/bundle/resources/model_serving_endpoints/drift/write_only/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/drift/write_only/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/model_serving_endpoints/drift/write_only/output.txt b/acceptance/bundle/resources/model_serving_endpoints/drift/write_only/output.txt
new file mode 100644
index 00000000000..c0f856ff6c5
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/drift/write_only/output.txt
@@ -0,0 +1,101 @@
+
+=== Initial deployment
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created model_serving_endpoints.endpoint1
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Plan is a no-op despite write-only secret and burst_scaling_enabled not round-tripping
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+=== The write-only fields are skipped as input_only (confirms the matched rules)
+>>> [CLI] bundle plan --output json
+{
+  "config.served_entities[0].burst_scaling_enabled": {
+    "action": "skip",
+    "reason": "spec:input_only",
+    "old": true,
+    "new": true,
+    "remote": false
+  },
+  "config.served_entities[0].external_model.openai_config.openai_api_key_plaintext": {
+    "action": "skip",
+    "reason": "spec:input_only",
+    "old": "sk-test-plaintext-key",
+    "new": "sk-test-plaintext-key",
+    "remote": ""
+  },
+  "config.served_entities[1].external_model.custom_provider_config.api_key_auth.value_plaintext": {
+    "action": "skip",
+    "reason": "spec:input_only",
+    "old": "custom-plaintext-key",
+    "new": "custom-plaintext-key",
+    "remote": ""
+  },
+  "description": {
+    "action": "skip",
+    "reason": "empty",
+    "remote": ""
+  },
+  "route_optimized": {
+    "action": "skip",
+    "reason": "empty",
+    "remote": false
+  }
+}
+
+=== Redeploy is a no-op (no config/ai-gateway/tags update calls)
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
+
+>>> print_requests.py //serving-endpoints
+{
+  "method": "POST",
+  "path": "/api/2.0/serving-endpoints",
+  "body": {
+    "config": {
+      "served_entities": [
+        {
+          "burst_scaling_enabled": true,
+          "external_model": {
+            "name": "gpt-4o-mini",
+            "openai_config": {
+              "openai_api_key_plaintext": "sk-test-plaintext-key"
+            },
+            "provider": "openai",
+            "task": "llm/v1/chat"
+          },
+          "name": "prod"
+        },
+        {
+          "external_model": {
+            "custom_provider_config": {
+              "api_key_auth": {
+                "key": "Authorization",
+                "value_plaintext": "custom-plaintext-key"
+              },
+              "custom_provider_url": "https://custom-provider.example"
+            },
+            "name": "my-custom-model",
+            "provider": "custom",
+            "task": "llm/v1/chat"
+          },
+          "name": "prod-custom"
+        }
+      ],
+      "traffic_config": {
+        "routes": [
+          {
+            "served_model_name": "prod",
+            "traffic_percentage": 100
+          }
+        ]
+      }
+    },
+    "name": "test-endpoint"
+  }
+}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/drift/write_only/script b/acceptance/bundle/resources/model_serving_endpoints/drift/write_only/script
new file mode 100644
index 00000000000..4cdc317a5e0
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/drift/write_only/script
@@ -0,0 +1,13 @@
+
+title "Initial deployment"
+trace $CLI bundle deploy
+
+title "Plan is a no-op despite write-only secret and burst_scaling_enabled not round-tripping"
+trace $CLI bundle plan | contains.py "Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged"
+
+title "The write-only fields are skipped as input_only (confirms the matched rules)"
+trace $CLI bundle plan --output json | nostamp | jq '.plan[].changes'
+
+title "Redeploy is a no-op (no config/ai-gateway/tags update calls)"
+trace $CLI bundle deploy
+trace print_requests.py //serving-endpoints
diff --git a/acceptance/bundle/resources/model_serving_endpoints/drift/write_only/test.toml b/acceptance/bundle/resources/model_serving_endpoints/drift/write_only/test.toml
new file mode 100644
index 00000000000..298d28d13a5
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/drift/write_only/test.toml
@@ -0,0 +1,4 @@
+RecordRequests = true
+
+# Scope this regression to the direct engine where the classification lives;
+# terraform models these write-only fields differently.
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/catalog-name/out.first-plan.direct.json b/acceptance/bundle/resources/model_serving_endpoints/recreate/catalog-name/out.first-plan.direct.json
deleted file mode 100644
index 0cf2159d88e..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/recreate/catalog-name/out.first-plan.direct.json
+++ /dev/null
@@ -1,34 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.model_serving_endpoints.test_endpoint": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "config": {
-            "auto_capture_config": {
-              "catalog_name": "main",
-              "schema_name": "default",
-              "table_name_prefix": "my_table"
-            },
-            "served_entities": [
-              {
-                "external_model": {
-                  "name": "gpt-4o-mini",
-                  "openai_config": {
-                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
-                  },
-                  "provider": "openai",
-                  "task": "llm/v1/chat"
-                },
-                "name": "prod"
-              }
-            ]
-          },
-          "name": "[ORIGINAL_ENDPOINT_ID]"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/catalog-name/out.first-plan.json b/acceptance/bundle/resources/model_serving_endpoints/recreate/catalog-name/out.first-plan.json
new file mode 100644
index 00000000000..d2c65641bbd
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/recreate/catalog-name/out.first-plan.json
@@ -0,0 +1,34 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.model_serving_endpoints.test_endpoint": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "config": {
+            "auto_capture_config": {
+              "catalog_name": "main",
+              "schema_name": "default",
+              "table_name_prefix": "my_table"
+            },
+            "served_entities": [
+              {
+                "external_model": {
+                  "name": "gpt-4o-mini",
+                  "openai_config": {
+                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
+                  },
+                  "provider": "openai",
+                  "task": "llm/v1/chat"
+                },
+                "name": "prod"
+              }
+            ]
+          },
+          "name": "[ORIGINAL_ENDPOINT_ID]"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/catalog-name/out.first-plan.terraform.json b/acceptance/bundle/resources/model_serving_endpoints/recreate/catalog-name/out.first-plan.terraform.json
deleted file mode 100644
index b516d88c656..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/recreate/catalog-name/out.first-plan.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.model_serving_endpoints.test_endpoint": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/catalog-name/out.second-plan.direct.json b/acceptance/bundle/resources/model_serving_endpoints/recreate/catalog-name/out.second-plan.direct.json
deleted file mode 100644
index 1c9610dd2fa..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/recreate/catalog-name/out.second-plan.direct.json
+++ /dev/null
@@ -1,84 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.model_serving_endpoints.test_endpoint": {
-      "action": "recreate",
-      "new_state": {
-        "value": {
-          "config": {
-            "auto_capture_config": {
-              "catalog_name": "other_catalog",
-              "schema_name": "default",
-              "table_name_prefix": "my_table"
-            },
-            "served_entities": [
-              {
-                "external_model": {
-                  "name": "gpt-4o-mini",
-                  "openai_config": {
-                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
-                  },
-                  "provider": "openai",
-                  "task": "llm/v1/chat"
-                },
-                "name": "prod"
-              }
-            ]
-          },
-          "name": "[ORIGINAL_ENDPOINT_ID]"
-        }
-      },
-      "remote_state": {
-        "endpoint_details": {
-          "config": {
-            "auto_capture_config": {
-              "catalog_name": "main",
-              "schema_name": "default",
-              "table_name_prefix": "my_table"
-            },
-            "served_entities": [
-              {
-                "external_model": {
-                  "name": "gpt-4o-mini",
-                  "openai_config": {
-                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
-                  },
-                  "provider": "openai",
-                  "task": "llm/v1/chat"
-                },
-                "name": "prod"
-              }
-            ]
-          },
-          "creator": "[USERNAME]",
-          "id": "[UUID]",
-          "name": "[ORIGINAL_ENDPOINT_ID]",
-          "permission_level": "CAN_MANAGE",
-          "route_optimized": false,
-          "state": {
-            "config_update": "NOT_UPDATING",
-            "ready": "NOT_READY"
-          }
-        },
-        "endpoint_id": "[UUID]"
-      },
-      "changes": {
-        "config.auto_capture_config.catalog_name": {
-          "action": "recreate",
-          "reason": "immutable",
-          "old": "main",
-          "new": "other_catalog",
-          "remote": "main"
-        },
-        "route_optimized": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": false
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/catalog-name/out.second-plan.json b/acceptance/bundle/resources/model_serving_endpoints/recreate/catalog-name/out.second-plan.json
new file mode 100644
index 00000000000..89686b87922
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/recreate/catalog-name/out.second-plan.json
@@ -0,0 +1,146 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.model_serving_endpoints.test_endpoint": {
+      "action": "recreate",
+      "new_state": {
+        "value": {
+          "config": {
+            "auto_capture_config": {
+              "catalog_name": "other_catalog",
+              "schema_name": "default",
+              "table_name_prefix": "my_table"
+            },
+            "served_entities": [
+              {
+                "external_model": {
+                  "name": "gpt-4o-mini",
+                  "openai_config": {
+                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
+                  },
+                  "provider": "openai",
+                  "task": "llm/v1/chat"
+                },
+                "name": "prod"
+              }
+            ]
+          },
+          "name": "[ORIGINAL_ENDPOINT_ID]"
+        }
+      },
+      "remote_state": {
+        "config": {
+          "auto_capture_config": {
+            "catalog_name": "main",
+            "schema_name": "default",
+            "table_name_prefix": "my_table"
+          },
+          "served_entities": [
+            {
+              "external_model": {
+                "name": "gpt-4o-mini",
+                "openai_config": {
+                  "openai_api_key": "{{secrets/test-scope/openai-key}}"
+                },
+                "provider": "openai",
+                "task": "llm/v1/chat"
+              },
+              "name": "prod"
+            }
+          ],
+          "traffic_config": {
+            "routes": [
+              {
+                "served_entity_name": "prod",
+                "served_model_name": "prod",
+                "traffic_percentage": 100
+              }
+            ]
+          }
+        },
+        "description": "",
+        "endpoint_details": {
+          "config": {
+            "auto_capture_config": {
+              "catalog_name": "main",
+              "schema_name": "default",
+              "table_name_prefix": "my_table"
+            },
+            "served_entities": [
+              {
+                "external_model": {
+                  "name": "gpt-4o-mini",
+                  "openai_config": {
+                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
+                  },
+                  "provider": "openai",
+                  "task": "llm/v1/chat"
+                },
+                "name": "prod"
+              }
+            ],
+            "traffic_config": {
+              "routes": [
+                {
+                  "served_entity_name": "prod",
+                  "served_model_name": "prod",
+                  "traffic_percentage": 100
+                }
+              ]
+            }
+          },
+          "creation_timestamp": [UNIX_TIME_MILLIS][0],
+          "creator": "[USERNAME]",
+          "description": "",
+          "id": "[UUID]",
+          "last_updated_timestamp": [UNIX_TIME_MILLIS][0],
+          "name": "[ORIGINAL_ENDPOINT_ID]",
+          "permission_level": "CAN_MANAGE",
+          "route_optimized": false,
+          "state": {
+            "config_update": "NOT_UPDATING",
+            "ready": "NOT_READY"
+          }
+        },
+        "endpoint_id": "[UUID]",
+        "name": "[ORIGINAL_ENDPOINT_ID]",
+        "route_optimized": false
+      },
+      "changes": {
+        "config.auto_capture_config.catalog_name": {
+          "action": "recreate",
+          "reason": "immutable",
+          "old": "main",
+          "new": "other_catalog",
+          "remote": "main"
+        },
+        "config.traffic_config": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": {
+            "routes": [
+              {
+                "served_entity_name": "prod",
+                "served_model_name": "prod",
+                "traffic_percentage": 100
+              }
+            ]
+          }
+        },
+        "description": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": ""
+        },
+        "route_optimized": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": false
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/catalog-name/out.second-plan.terraform.json b/acceptance/bundle/resources/model_serving_endpoints/recreate/catalog-name/out.second-plan.terraform.json
deleted file mode 100644
index 93d8386e798..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/recreate/catalog-name/out.second-plan.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.model_serving_endpoints.test_endpoint": {
-      "action": "recreate"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/catalog-name/out.test.toml b/acceptance/bundle/resources/model_serving_endpoints/recreate/catalog-name/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/model_serving_endpoints/recreate/catalog-name/out.test.toml
+++ b/acceptance/bundle/resources/model_serving_endpoints/recreate/catalog-name/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/catalog-name/output.txt b/acceptance/bundle/resources/model_serving_endpoints/recreate/catalog-name/output.txt
index 8193de57d94..29bb8435640 100644
--- a/acceptance/bundle/resources/model_serving_endpoints/recreate/catalog-name/output.txt
+++ b/acceptance/bundle/resources/model_serving_endpoints/recreate/catalog-name/output.txt
@@ -3,9 +3,9 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created model_serving_endpoints.test_endpoint
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> print_requests.py //serving-endpoints
 {
@@ -45,9 +45,9 @@ Deployment complete!
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Recreated model_serving_endpoints.test_endpoint
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 0 unchanged
 
 >>> print_requests.py //serving-endpoints
 {
@@ -91,5 +91,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/catalog-name/script b/acceptance/bundle/resources/model_serving_endpoints/recreate/catalog-name/script
index 90e71bb338d..031c7b0bcdb 100755
--- a/acceptance/bundle/resources/model_serving_endpoints/recreate/catalog-name/script
+++ b/acceptance/bundle/resources/model_serving_endpoints/recreate/catalog-name/script
@@ -2,25 +2,25 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm -f out.requests.txt
+    rm -f "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
-trace $CLI bundle plan -o json > out.first-plan.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.first-plan.json
 trace $CLI bundle deploy
 
 trace print_requests.py //serving-endpoints
 
 ENDPOINT_ID=$($CLI bundle summary -o json | jq -r '.resources.model_serving_endpoints.test_endpoint.id')
-echo "$ENDPOINT_ID:ORIGINAL_ENDPOINT_ID" >> ACC_REPLS
+add_repl "$ENDPOINT_ID" ORIGINAL_ENDPOINT_ID
 trace $CLI serving-endpoints get "${ENDPOINT_ID}" | jq '.config.auto_capture_config.catalog_name'
 
 trace update_file.py databricks.yml "catalog_name: main" "catalog_name: other_catalog"
-trace $CLI bundle plan -o json > out.second-plan.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.second-plan.json
 trace $CLI bundle deploy
 
 trace print_requests.py //serving-endpoints
 
 NEW_ENDPOINT_ID=$($CLI bundle summary -o json | jq -r '.resources.model_serving_endpoints.test_endpoint.id')
-echo "$NEW_ENDPOINT_ID:NEW_ENDPOINT_ID" >> ACC_REPLS
+add_repl "$NEW_ENDPOINT_ID" NEW_ENDPOINT_ID
 trace $CLI serving-endpoints get "${NEW_ENDPOINT_ID}" | jq '.config.auto_capture_config.catalog_name'
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/name-change/out.first-plan.direct.json b/acceptance/bundle/resources/model_serving_endpoints/recreate/name-change/out.first-plan.direct.json
deleted file mode 100644
index 8ce1685e33a..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/recreate/name-change/out.first-plan.direct.json
+++ /dev/null
@@ -1,29 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.model_serving_endpoints.test_endpoint": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "config": {
-            "served_entities": [
-              {
-                "external_model": {
-                  "name": "gpt-4o-mini",
-                  "openai_config": {
-                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
-                  },
-                  "provider": "openai",
-                  "task": "llm/v1/chat"
-                },
-                "name": "prod"
-              }
-            ]
-          },
-          "name": "[ORIGINAL_ENDPOINT_ID]"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/name-change/out.first-plan.json b/acceptance/bundle/resources/model_serving_endpoints/recreate/name-change/out.first-plan.json
new file mode 100644
index 00000000000..18c8c54abbe
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/recreate/name-change/out.first-plan.json
@@ -0,0 +1,29 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.model_serving_endpoints.test_endpoint": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "config": {
+            "served_entities": [
+              {
+                "external_model": {
+                  "name": "gpt-4o-mini",
+                  "openai_config": {
+                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
+                  },
+                  "provider": "openai",
+                  "task": "llm/v1/chat"
+                },
+                "name": "prod"
+              }
+            ]
+          },
+          "name": "[ORIGINAL_ENDPOINT_ID]"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/name-change/out.first-plan.terraform.json b/acceptance/bundle/resources/model_serving_endpoints/recreate/name-change/out.first-plan.terraform.json
deleted file mode 100644
index b516d88c656..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/recreate/name-change/out.first-plan.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.model_serving_endpoints.test_endpoint": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/name-change/out.second-plan.direct.json b/acceptance/bundle/resources/model_serving_endpoints/recreate/name-change/out.second-plan.direct.json
deleted file mode 100644
index 63445a9561d..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/recreate/name-change/out.second-plan.direct.json
+++ /dev/null
@@ -1,74 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.model_serving_endpoints.test_endpoint": {
-      "action": "recreate",
-      "new_state": {
-        "value": {
-          "config": {
-            "served_entities": [
-              {
-                "external_model": {
-                  "name": "gpt-4o-mini",
-                  "openai_config": {
-                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
-                  },
-                  "provider": "openai",
-                  "task": "llm/v1/chat"
-                },
-                "name": "prod"
-              }
-            ]
-          },
-          "name": "[NEW_ENDPOINT_ID]"
-        }
-      },
-      "remote_state": {
-        "endpoint_details": {
-          "config": {
-            "served_entities": [
-              {
-                "external_model": {
-                  "name": "gpt-4o-mini",
-                  "openai_config": {
-                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
-                  },
-                  "provider": "openai",
-                  "task": "llm/v1/chat"
-                },
-                "name": "prod"
-              }
-            ]
-          },
-          "creator": "[USERNAME]",
-          "id": "[UUID]",
-          "name": "[ORIGINAL_ENDPOINT_ID]",
-          "permission_level": "CAN_MANAGE",
-          "route_optimized": false,
-          "state": {
-            "config_update": "NOT_UPDATING",
-            "ready": "NOT_READY"
-          }
-        },
-        "endpoint_id": "[UUID]"
-      },
-      "changes": {
-        "name": {
-          "action": "recreate",
-          "reason": "immutable",
-          "old": "[ORIGINAL_ENDPOINT_ID]",
-          "new": "[NEW_ENDPOINT_ID]",
-          "remote": "[ORIGINAL_ENDPOINT_ID]"
-        },
-        "route_optimized": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": false
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/name-change/out.second-plan.json b/acceptance/bundle/resources/model_serving_endpoints/recreate/name-change/out.second-plan.json
new file mode 100644
index 00000000000..2a50d836ce7
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/recreate/name-change/out.second-plan.json
@@ -0,0 +1,131 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.model_serving_endpoints.test_endpoint": {
+      "action": "recreate",
+      "new_state": {
+        "value": {
+          "config": {
+            "served_entities": [
+              {
+                "external_model": {
+                  "name": "gpt-4o-mini",
+                  "openai_config": {
+                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
+                  },
+                  "provider": "openai",
+                  "task": "llm/v1/chat"
+                },
+                "name": "prod"
+              }
+            ]
+          },
+          "name": "[NEW_ENDPOINT_ID]"
+        }
+      },
+      "remote_state": {
+        "config": {
+          "served_entities": [
+            {
+              "external_model": {
+                "name": "gpt-4o-mini",
+                "openai_config": {
+                  "openai_api_key": "{{secrets/test-scope/openai-key}}"
+                },
+                "provider": "openai",
+                "task": "llm/v1/chat"
+              },
+              "name": "prod"
+            }
+          ],
+          "traffic_config": {
+            "routes": [
+              {
+                "served_entity_name": "prod",
+                "served_model_name": "prod",
+                "traffic_percentage": 100
+              }
+            ]
+          }
+        },
+        "description": "",
+        "endpoint_details": {
+          "config": {
+            "served_entities": [
+              {
+                "external_model": {
+                  "name": "gpt-4o-mini",
+                  "openai_config": {
+                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
+                  },
+                  "provider": "openai",
+                  "task": "llm/v1/chat"
+                },
+                "name": "prod"
+              }
+            ],
+            "traffic_config": {
+              "routes": [
+                {
+                  "served_entity_name": "prod",
+                  "served_model_name": "prod",
+                  "traffic_percentage": 100
+                }
+              ]
+            }
+          },
+          "creation_timestamp": [UNIX_TIME_MILLIS][0],
+          "creator": "[USERNAME]",
+          "description": "",
+          "id": "[UUID]",
+          "last_updated_timestamp": [UNIX_TIME_MILLIS][0],
+          "name": "[ORIGINAL_ENDPOINT_ID]",
+          "permission_level": "CAN_MANAGE",
+          "route_optimized": false,
+          "state": {
+            "config_update": "NOT_UPDATING",
+            "ready": "NOT_READY"
+          }
+        },
+        "endpoint_id": "[UUID]",
+        "name": "[ORIGINAL_ENDPOINT_ID]",
+        "route_optimized": false
+      },
+      "changes": {
+        "config.traffic_config": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": {
+            "routes": [
+              {
+                "served_entity_name": "prod",
+                "served_model_name": "prod",
+                "traffic_percentage": 100
+              }
+            ]
+          }
+        },
+        "description": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": ""
+        },
+        "name": {
+          "action": "recreate",
+          "reason": "id_field",
+          "old": "[ORIGINAL_ENDPOINT_ID]",
+          "new": "[NEW_ENDPOINT_ID]",
+          "remote": "[ORIGINAL_ENDPOINT_ID]"
+        },
+        "route_optimized": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": false
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/name-change/out.second-plan.terraform.json b/acceptance/bundle/resources/model_serving_endpoints/recreate/name-change/out.second-plan.terraform.json
deleted file mode 100644
index 93d8386e798..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/recreate/name-change/out.second-plan.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.model_serving_endpoints.test_endpoint": {
-      "action": "recreate"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/name-change/out.test.toml b/acceptance/bundle/resources/model_serving_endpoints/recreate/name-change/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/model_serving_endpoints/recreate/name-change/out.test.toml
+++ b/acceptance/bundle/resources/model_serving_endpoints/recreate/name-change/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/name-change/output.txt b/acceptance/bundle/resources/model_serving_endpoints/recreate/name-change/output.txt
index bb27a231f8d..ed7550752da 100644
--- a/acceptance/bundle/resources/model_serving_endpoints/recreate/name-change/output.txt
+++ b/acceptance/bundle/resources/model_serving_endpoints/recreate/name-change/output.txt
@@ -3,9 +3,9 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created model_serving_endpoints.test_endpoint
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> print_requests.py //serving-endpoints
 {
@@ -40,9 +40,9 @@ Deployment complete!
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Recreated model_serving_endpoints.test_endpoint
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 0 unchanged
 
 >>> print_requests.py //serving-endpoints
 {
@@ -81,5 +81,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/name-change/script b/acceptance/bundle/resources/model_serving_endpoints/recreate/name-change/script
index d772069d397..2d6d8e233a7 100755
--- a/acceptance/bundle/resources/model_serving_endpoints/recreate/name-change/script
+++ b/acceptance/bundle/resources/model_serving_endpoints/recreate/name-change/script
@@ -2,25 +2,25 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm -f out.requests.txt
+    rm -f "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
-trace $CLI bundle plan -o json > out.first-plan.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.first-plan.json
 trace $CLI bundle deploy
 
 trace print_requests.py //serving-endpoints
 
 ENDPOINT_ID=$($CLI bundle summary -o json | jq -r '.resources.model_serving_endpoints.test_endpoint.id')
-echo "$ENDPOINT_ID:ORIGINAL_ENDPOINT_ID" >> ACC_REPLS
+add_repl "$ENDPOINT_ID" ORIGINAL_ENDPOINT_ID
 trace $CLI serving-endpoints get "${ENDPOINT_ID}" | jq '.name'
 
 trace update_file.py databricks.yml "name: test-endpoint-$UNIQUE_NAME" "name: test-endpoint-2-$UNIQUE_NAME"
-trace $CLI bundle plan -o json > out.second-plan.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.second-plan.json
 trace $CLI bundle deploy
 
 trace print_requests.py //serving-endpoints
 
 NEW_ENDPOINT_ID=$($CLI bundle summary -o json | jq -r '.resources.model_serving_endpoints.test_endpoint.id')
-echo "$NEW_ENDPOINT_ID:NEW_ENDPOINT_ID" >> ACC_REPLS
+add_repl "$NEW_ENDPOINT_ID" NEW_ENDPOINT_ID
 trace $CLI serving-endpoints get "${NEW_ENDPOINT_ID}" | jq '.name'
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/out.first-get.direct.json b/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/out.first-get.json
similarity index 100%
rename from acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/out.first-get.direct.json
rename to acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/out.first-get.json
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/out.first-get.terraform.json b/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/out.first-get.terraform.json
deleted file mode 100644
index f74ee879216..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/out.first-get.terraform.json
+++ /dev/null
@@ -1,4 +0,0 @@
-{
-  "route_optimized": false,
-  "id": "[UUID]"
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/out.first-plan.direct.json b/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/out.first-plan.direct.json
deleted file mode 100644
index 629557feeb5..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/out.first-plan.direct.json
+++ /dev/null
@@ -1,26 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.model_serving_endpoints.test_endpoint": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "config": {
-            "served_entities": [
-              {
-                "entity_name": "system.ai.llama_v3_2_1b_instruct",
-                "entity_version": "1",
-                "name": "llama",
-                "scale_to_zero_enabled": true,
-                "workload_size": "Small"
-              }
-            ]
-          },
-          "name": "[ORIGINAL_ENDPOINT_ID]",
-          "route_optimized": false
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/out.first-plan.json b/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/out.first-plan.json
new file mode 100644
index 00000000000..c9afbeed1f4
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/out.first-plan.json
@@ -0,0 +1,26 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.model_serving_endpoints.test_endpoint": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "config": {
+            "served_entities": [
+              {
+                "entity_name": "system.ai.llama_v3_2_1b_instruct",
+                "entity_version": "1",
+                "name": "llama",
+                "scale_to_zero_enabled": true,
+                "workload_size": "Small"
+              }
+            ]
+          },
+          "name": "[ORIGINAL_ENDPOINT_ID]",
+          "route_optimized": false
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/out.first-plan.terraform.json b/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/out.first-plan.terraform.json
deleted file mode 100644
index b516d88c656..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/out.first-plan.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.model_serving_endpoints.test_endpoint": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/out.first-requests.direct.json b/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/out.first-requests.json
similarity index 100%
rename from acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/out.first-requests.direct.json
rename to acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/out.first-requests.json
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/out.first-requests.terraform.json b/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/out.first-requests.terraform.json
deleted file mode 100644
index 95e359ba4ee..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/out.first-requests.terraform.json
+++ /dev/null
@@ -1,18 +0,0 @@
-{
-  "method": "POST",
-  "path": "/api/2.0/serving-endpoints",
-  "body": {
-    "config": {
-      "served_entities": [
-        {
-          "entity_name": "system.ai.llama_v3_2_1b_instruct",
-          "entity_version": "1",
-          "name": "llama",
-          "scale_to_zero_enabled": true,
-          "workload_size": "Small"
-        }
-      ]
-    },
-    "name": "[ORIGINAL_ENDPOINT_ID]"
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/out.second-plan.direct.json b/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/out.second-plan.direct.json
deleted file mode 100644
index 5379c464648..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/out.second-plan.direct.json
+++ /dev/null
@@ -1,62 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.model_serving_endpoints.test_endpoint": {
-      "action": "recreate",
-      "new_state": {
-        "value": {
-          "config": {
-            "served_entities": [
-              {
-                "entity_name": "system.ai.llama_v3_2_1b_instruct",
-                "entity_version": "1",
-                "name": "llama",
-                "scale_to_zero_enabled": true,
-                "workload_size": "Small"
-              }
-            ]
-          },
-          "name": "[ORIGINAL_ENDPOINT_ID]",
-          "route_optimized": true
-        }
-      },
-      "remote_state": {
-        "endpoint_details": {
-          "config": {
-            "served_entities": [
-              {
-                "entity_name": "system.ai.llama_v3_2_1b_instruct",
-                "entity_version": "1",
-                "name": "llama",
-                "scale_to_zero_enabled": true,
-                "workload_size": "Small"
-              }
-            ]
-          },
-          "creator": "[USERNAME]",
-          "id": "[UUID]",
-          "name": "[ORIGINAL_ENDPOINT_ID]",
-          "permission_level": "CAN_MANAGE",
-          "route_optimized": false,
-          "state": {
-            "config_update": "NOT_UPDATING",
-            "ready": "NOT_READY"
-          }
-        },
-        "endpoint_id": "[UUID]"
-      },
-      "changes": {
-        "route_optimized": {
-          "action": "recreate",
-          "reason": "immutable",
-          "old": false,
-          "new": true,
-          "remote": false
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/out.second-plan.json b/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/out.second-plan.json
new file mode 100644
index 00000000000..b5555453219
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/out.second-plan.json
@@ -0,0 +1,115 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.model_serving_endpoints.test_endpoint": {
+      "action": "recreate",
+      "new_state": {
+        "value": {
+          "config": {
+            "served_entities": [
+              {
+                "entity_name": "system.ai.llama_v3_2_1b_instruct",
+                "entity_version": "1",
+                "name": "llama",
+                "scale_to_zero_enabled": true,
+                "workload_size": "Small"
+              }
+            ]
+          },
+          "name": "[ORIGINAL_ENDPOINT_ID]",
+          "route_optimized": true
+        }
+      },
+      "remote_state": {
+        "config": {
+          "served_entities": [
+            {
+              "entity_name": "system.ai.llama_v3_2_1b_instruct",
+              "entity_version": "1",
+              "name": "llama",
+              "scale_to_zero_enabled": true,
+              "workload_size": "Small"
+            }
+          ],
+          "traffic_config": {
+            "routes": [
+              {
+                "served_entity_name": "llama",
+                "served_model_name": "llama",
+                "traffic_percentage": 100
+              }
+            ]
+          }
+        },
+        "description": "",
+        "endpoint_details": {
+          "config": {
+            "served_entities": [
+              {
+                "entity_name": "system.ai.llama_v3_2_1b_instruct",
+                "entity_version": "1",
+                "name": "llama",
+                "scale_to_zero_enabled": true,
+                "workload_size": "Small"
+              }
+            ],
+            "traffic_config": {
+              "routes": [
+                {
+                  "served_entity_name": "llama",
+                  "served_model_name": "llama",
+                  "traffic_percentage": 100
+                }
+              ]
+            }
+          },
+          "creation_timestamp": [UNIX_TIME_MILLIS][0],
+          "creator": "[USERNAME]",
+          "description": "",
+          "id": "[UUID]",
+          "last_updated_timestamp": [UNIX_TIME_MILLIS][0],
+          "name": "[ORIGINAL_ENDPOINT_ID]",
+          "permission_level": "CAN_MANAGE",
+          "route_optimized": false,
+          "state": {
+            "config_update": "NOT_UPDATING",
+            "ready": "NOT_READY"
+          }
+        },
+        "endpoint_id": "[UUID]",
+        "name": "[ORIGINAL_ENDPOINT_ID]",
+        "route_optimized": false
+      },
+      "changes": {
+        "config.traffic_config": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": {
+            "routes": [
+              {
+                "served_entity_name": "llama",
+                "served_model_name": "llama",
+                "traffic_percentage": 100
+              }
+            ]
+          }
+        },
+        "description": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": ""
+        },
+        "route_optimized": {
+          "action": "recreate",
+          "reason": "immutable",
+          "old": false,
+          "new": true,
+          "remote": false
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/out.second-plan.terraform.json b/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/out.second-plan.terraform.json
deleted file mode 100644
index 93d8386e798..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/out.second-plan.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.model_serving_endpoints.test_endpoint": {
-      "action": "recreate"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/out.test.toml b/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/out.test.toml
+++ b/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/output.txt b/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/output.txt
index 2f784d9f37d..c0bc3f5ea66 100644
--- a/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/output.txt
+++ b/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/output.txt
@@ -3,9 +3,9 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created model_serving_endpoints.test_endpoint
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] serving-endpoints get [ORIGINAL_ENDPOINT_ID]
 
@@ -15,9 +15,9 @@ Deployment complete!
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Recreated model_serving_endpoints.test_endpoint
+Files: 4 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 0 unchanged
 
 >>> print_requests.py //serving-endpoints
 {
@@ -55,10 +55,22 @@ Deployment complete!
         "scale_to_zero_enabled": true,
         "workload_size": "Small"
       }
-    ]
+    ],
+    "traffic_config": {
+      "routes": [
+        {
+          "served_entity_name": "llama",
+          "served_model_name": "llama",
+          "traffic_percentage": 100
+        }
+      ]
+    }
   },
+  "creation_timestamp": [UNIX_TIME_MILLIS][0],
   "creator": "[USERNAME]",
+  "description": "",
   "id": "[UUID]",
+  "last_updated_timestamp": [UNIX_TIME_MILLIS][0],
   "name": "[ORIGINAL_ENDPOINT_ID]",
   "permission_level": "CAN_MANAGE",
   "route_optimized": true,
@@ -74,5 +86,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/script b/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/script
index fec000b7e18..ad983a61529 100755
--- a/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/script
+++ b/acceptance/bundle/resources/model_serving_endpoints/recreate/route-optimized/script
@@ -2,21 +2,21 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm -f out.requests.txt
+    rm -f "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
-trace $CLI bundle plan -o json > out.first-plan.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.first-plan.json
 trace $CLI bundle deploy
 
 ENDPOINT_ID=$($CLI bundle summary -o json | jq -r '.resources.model_serving_endpoints.test_endpoint.id')
-echo "$ENDPOINT_ID:ORIGINAL_ENDPOINT_ID" >> ACC_REPLS
-trace $CLI serving-endpoints get "${ENDPOINT_ID}" | jq '{route_optimized, id}' > out.first-get.$DATABRICKS_BUNDLE_ENGINE.json
+add_repl "$ENDPOINT_ID" ORIGINAL_ENDPOINT_ID
+trace $CLI serving-endpoints get "${ENDPOINT_ID}" | jq '{route_optimized, id}' > out.first-get.json
 
-print_requests.py //serving-endpoints > out.first-requests.$DATABRICKS_BUNDLE_ENGINE.json
+print_requests.py //serving-endpoints > out.first-requests.json
 
 trace update_file.py databricks.yml "route_optimized: false" "route_optimized: true"
-trace $CLI bundle plan -o json > out.second-plan.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.second-plan.json
 trace $CLI bundle deploy
 
 trace print_requests.py //serving-endpoints
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/schema-name/out.first-plan.direct.json b/acceptance/bundle/resources/model_serving_endpoints/recreate/schema-name/out.first-plan.direct.json
deleted file mode 100644
index 0cf2159d88e..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/recreate/schema-name/out.first-plan.direct.json
+++ /dev/null
@@ -1,34 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.model_serving_endpoints.test_endpoint": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "config": {
-            "auto_capture_config": {
-              "catalog_name": "main",
-              "schema_name": "default",
-              "table_name_prefix": "my_table"
-            },
-            "served_entities": [
-              {
-                "external_model": {
-                  "name": "gpt-4o-mini",
-                  "openai_config": {
-                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
-                  },
-                  "provider": "openai",
-                  "task": "llm/v1/chat"
-                },
-                "name": "prod"
-              }
-            ]
-          },
-          "name": "[ORIGINAL_ENDPOINT_ID]"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/schema-name/out.first-plan.json b/acceptance/bundle/resources/model_serving_endpoints/recreate/schema-name/out.first-plan.json
new file mode 100644
index 00000000000..d2c65641bbd
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/recreate/schema-name/out.first-plan.json
@@ -0,0 +1,34 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.model_serving_endpoints.test_endpoint": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "config": {
+            "auto_capture_config": {
+              "catalog_name": "main",
+              "schema_name": "default",
+              "table_name_prefix": "my_table"
+            },
+            "served_entities": [
+              {
+                "external_model": {
+                  "name": "gpt-4o-mini",
+                  "openai_config": {
+                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
+                  },
+                  "provider": "openai",
+                  "task": "llm/v1/chat"
+                },
+                "name": "prod"
+              }
+            ]
+          },
+          "name": "[ORIGINAL_ENDPOINT_ID]"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/schema-name/out.first-plan.terraform.json b/acceptance/bundle/resources/model_serving_endpoints/recreate/schema-name/out.first-plan.terraform.json
deleted file mode 100644
index b516d88c656..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/recreate/schema-name/out.first-plan.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.model_serving_endpoints.test_endpoint": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/schema-name/out.second-plan.direct.json b/acceptance/bundle/resources/model_serving_endpoints/recreate/schema-name/out.second-plan.direct.json
deleted file mode 100644
index 996ec9a09cb..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/recreate/schema-name/out.second-plan.direct.json
+++ /dev/null
@@ -1,84 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.model_serving_endpoints.test_endpoint": {
-      "action": "recreate",
-      "new_state": {
-        "value": {
-          "config": {
-            "auto_capture_config": {
-              "catalog_name": "main",
-              "schema_name": "other_schema",
-              "table_name_prefix": "my_table"
-            },
-            "served_entities": [
-              {
-                "external_model": {
-                  "name": "gpt-4o-mini",
-                  "openai_config": {
-                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
-                  },
-                  "provider": "openai",
-                  "task": "llm/v1/chat"
-                },
-                "name": "prod"
-              }
-            ]
-          },
-          "name": "[ORIGINAL_ENDPOINT_ID]"
-        }
-      },
-      "remote_state": {
-        "endpoint_details": {
-          "config": {
-            "auto_capture_config": {
-              "catalog_name": "main",
-              "schema_name": "default",
-              "table_name_prefix": "my_table"
-            },
-            "served_entities": [
-              {
-                "external_model": {
-                  "name": "gpt-4o-mini",
-                  "openai_config": {
-                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
-                  },
-                  "provider": "openai",
-                  "task": "llm/v1/chat"
-                },
-                "name": "prod"
-              }
-            ]
-          },
-          "creator": "[USERNAME]",
-          "id": "[UUID]",
-          "name": "[ORIGINAL_ENDPOINT_ID]",
-          "permission_level": "CAN_MANAGE",
-          "route_optimized": false,
-          "state": {
-            "config_update": "NOT_UPDATING",
-            "ready": "NOT_READY"
-          }
-        },
-        "endpoint_id": "[UUID]"
-      },
-      "changes": {
-        "config.auto_capture_config.schema_name": {
-          "action": "recreate",
-          "reason": "immutable",
-          "old": "default",
-          "new": "other_schema",
-          "remote": "default"
-        },
-        "route_optimized": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": false
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/schema-name/out.second-plan.json b/acceptance/bundle/resources/model_serving_endpoints/recreate/schema-name/out.second-plan.json
new file mode 100644
index 00000000000..0a2bc7bee2d
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/recreate/schema-name/out.second-plan.json
@@ -0,0 +1,146 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.model_serving_endpoints.test_endpoint": {
+      "action": "recreate",
+      "new_state": {
+        "value": {
+          "config": {
+            "auto_capture_config": {
+              "catalog_name": "main",
+              "schema_name": "other_schema",
+              "table_name_prefix": "my_table"
+            },
+            "served_entities": [
+              {
+                "external_model": {
+                  "name": "gpt-4o-mini",
+                  "openai_config": {
+                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
+                  },
+                  "provider": "openai",
+                  "task": "llm/v1/chat"
+                },
+                "name": "prod"
+              }
+            ]
+          },
+          "name": "[ORIGINAL_ENDPOINT_ID]"
+        }
+      },
+      "remote_state": {
+        "config": {
+          "auto_capture_config": {
+            "catalog_name": "main",
+            "schema_name": "default",
+            "table_name_prefix": "my_table"
+          },
+          "served_entities": [
+            {
+              "external_model": {
+                "name": "gpt-4o-mini",
+                "openai_config": {
+                  "openai_api_key": "{{secrets/test-scope/openai-key}}"
+                },
+                "provider": "openai",
+                "task": "llm/v1/chat"
+              },
+              "name": "prod"
+            }
+          ],
+          "traffic_config": {
+            "routes": [
+              {
+                "served_entity_name": "prod",
+                "served_model_name": "prod",
+                "traffic_percentage": 100
+              }
+            ]
+          }
+        },
+        "description": "",
+        "endpoint_details": {
+          "config": {
+            "auto_capture_config": {
+              "catalog_name": "main",
+              "schema_name": "default",
+              "table_name_prefix": "my_table"
+            },
+            "served_entities": [
+              {
+                "external_model": {
+                  "name": "gpt-4o-mini",
+                  "openai_config": {
+                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
+                  },
+                  "provider": "openai",
+                  "task": "llm/v1/chat"
+                },
+                "name": "prod"
+              }
+            ],
+            "traffic_config": {
+              "routes": [
+                {
+                  "served_entity_name": "prod",
+                  "served_model_name": "prod",
+                  "traffic_percentage": 100
+                }
+              ]
+            }
+          },
+          "creation_timestamp": [UNIX_TIME_MILLIS][0],
+          "creator": "[USERNAME]",
+          "description": "",
+          "id": "[UUID]",
+          "last_updated_timestamp": [UNIX_TIME_MILLIS][0],
+          "name": "[ORIGINAL_ENDPOINT_ID]",
+          "permission_level": "CAN_MANAGE",
+          "route_optimized": false,
+          "state": {
+            "config_update": "NOT_UPDATING",
+            "ready": "NOT_READY"
+          }
+        },
+        "endpoint_id": "[UUID]",
+        "name": "[ORIGINAL_ENDPOINT_ID]",
+        "route_optimized": false
+      },
+      "changes": {
+        "config.auto_capture_config.schema_name": {
+          "action": "recreate",
+          "reason": "immutable",
+          "old": "default",
+          "new": "other_schema",
+          "remote": "default"
+        },
+        "config.traffic_config": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": {
+            "routes": [
+              {
+                "served_entity_name": "prod",
+                "served_model_name": "prod",
+                "traffic_percentage": 100
+              }
+            ]
+          }
+        },
+        "description": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": ""
+        },
+        "route_optimized": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": false
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/schema-name/out.second-plan.terraform.json b/acceptance/bundle/resources/model_serving_endpoints/recreate/schema-name/out.second-plan.terraform.json
deleted file mode 100644
index 93d8386e798..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/recreate/schema-name/out.second-plan.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.model_serving_endpoints.test_endpoint": {
-      "action": "recreate"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/schema-name/out.test.toml b/acceptance/bundle/resources/model_serving_endpoints/recreate/schema-name/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/model_serving_endpoints/recreate/schema-name/out.test.toml
+++ b/acceptance/bundle/resources/model_serving_endpoints/recreate/schema-name/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/schema-name/output.txt b/acceptance/bundle/resources/model_serving_endpoints/recreate/schema-name/output.txt
index a248664401e..7d259924789 100644
--- a/acceptance/bundle/resources/model_serving_endpoints/recreate/schema-name/output.txt
+++ b/acceptance/bundle/resources/model_serving_endpoints/recreate/schema-name/output.txt
@@ -3,9 +3,9 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created model_serving_endpoints.test_endpoint
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> print_requests.py //serving-endpoints
 {
@@ -45,9 +45,9 @@ Deployment complete!
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Recreated model_serving_endpoints.test_endpoint
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 0 unchanged
 
 >>> print_requests.py //serving-endpoints
 {
@@ -91,5 +91,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/schema-name/script b/acceptance/bundle/resources/model_serving_endpoints/recreate/schema-name/script
index e02abe9aa71..eee4d6eb83f 100755
--- a/acceptance/bundle/resources/model_serving_endpoints/recreate/schema-name/script
+++ b/acceptance/bundle/resources/model_serving_endpoints/recreate/schema-name/script
@@ -2,25 +2,25 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm -f out.requests.txt
+    rm -f "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
-trace $CLI bundle plan -o json > out.first-plan.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.first-plan.json
 trace $CLI bundle deploy
 
 trace print_requests.py //serving-endpoints
 
 ENDPOINT_ID=$($CLI bundle summary -o json | jq -r '.resources.model_serving_endpoints.test_endpoint.id')
-echo "$ENDPOINT_ID:ORIGINAL_ENDPOINT_ID" >> ACC_REPLS
+add_repl "$ENDPOINT_ID" ORIGINAL_ENDPOINT_ID
 trace $CLI serving-endpoints get "${ENDPOINT_ID}" | jq '.config.auto_capture_config.schema_name'
 
 trace update_file.py databricks.yml "schema_name: default" "schema_name: other_schema"
-trace $CLI bundle plan -o json > out.second-plan.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.second-plan.json
 trace $CLI bundle deploy
 
 trace print_requests.py //serving-endpoints
 
 NEW_ENDPOINT_ID=$($CLI bundle summary -o json | jq -r '.resources.model_serving_endpoints.test_endpoint.id')
-echo "$NEW_ENDPOINT_ID:NEW_ENDPOINT_ID" >> ACC_REPLS
+add_repl "$NEW_ENDPOINT_ID" NEW_ENDPOINT_ID
 trace $CLI serving-endpoints get "${NEW_ENDPOINT_ID}" | jq '.config.auto_capture_config.schema_name'
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/table-prefix/out.first-plan.direct.json b/acceptance/bundle/resources/model_serving_endpoints/recreate/table-prefix/out.first-plan.direct.json
deleted file mode 100644
index 0cf2159d88e..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/recreate/table-prefix/out.first-plan.direct.json
+++ /dev/null
@@ -1,34 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.model_serving_endpoints.test_endpoint": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "config": {
-            "auto_capture_config": {
-              "catalog_name": "main",
-              "schema_name": "default",
-              "table_name_prefix": "my_table"
-            },
-            "served_entities": [
-              {
-                "external_model": {
-                  "name": "gpt-4o-mini",
-                  "openai_config": {
-                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
-                  },
-                  "provider": "openai",
-                  "task": "llm/v1/chat"
-                },
-                "name": "prod"
-              }
-            ]
-          },
-          "name": "[ORIGINAL_ENDPOINT_ID]"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/table-prefix/out.first-plan.json b/acceptance/bundle/resources/model_serving_endpoints/recreate/table-prefix/out.first-plan.json
new file mode 100644
index 00000000000..d2c65641bbd
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/recreate/table-prefix/out.first-plan.json
@@ -0,0 +1,34 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.model_serving_endpoints.test_endpoint": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "config": {
+            "auto_capture_config": {
+              "catalog_name": "main",
+              "schema_name": "default",
+              "table_name_prefix": "my_table"
+            },
+            "served_entities": [
+              {
+                "external_model": {
+                  "name": "gpt-4o-mini",
+                  "openai_config": {
+                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
+                  },
+                  "provider": "openai",
+                  "task": "llm/v1/chat"
+                },
+                "name": "prod"
+              }
+            ]
+          },
+          "name": "[ORIGINAL_ENDPOINT_ID]"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/table-prefix/out.first-plan.terraform.json b/acceptance/bundle/resources/model_serving_endpoints/recreate/table-prefix/out.first-plan.terraform.json
deleted file mode 100644
index b516d88c656..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/recreate/table-prefix/out.first-plan.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.model_serving_endpoints.test_endpoint": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/table-prefix/out.second-plan.direct.json b/acceptance/bundle/resources/model_serving_endpoints/recreate/table-prefix/out.second-plan.direct.json
deleted file mode 100644
index c57e2ac8bb8..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/recreate/table-prefix/out.second-plan.direct.json
+++ /dev/null
@@ -1,84 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.model_serving_endpoints.test_endpoint": {
-      "action": "recreate",
-      "new_state": {
-        "value": {
-          "config": {
-            "auto_capture_config": {
-              "catalog_name": "main",
-              "schema_name": "default",
-              "table_name_prefix": "other_table"
-            },
-            "served_entities": [
-              {
-                "external_model": {
-                  "name": "gpt-4o-mini",
-                  "openai_config": {
-                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
-                  },
-                  "provider": "openai",
-                  "task": "llm/v1/chat"
-                },
-                "name": "prod"
-              }
-            ]
-          },
-          "name": "[ORIGINAL_ENDPOINT_ID]"
-        }
-      },
-      "remote_state": {
-        "endpoint_details": {
-          "config": {
-            "auto_capture_config": {
-              "catalog_name": "main",
-              "schema_name": "default",
-              "table_name_prefix": "my_table"
-            },
-            "served_entities": [
-              {
-                "external_model": {
-                  "name": "gpt-4o-mini",
-                  "openai_config": {
-                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
-                  },
-                  "provider": "openai",
-                  "task": "llm/v1/chat"
-                },
-                "name": "prod"
-              }
-            ]
-          },
-          "creator": "[USERNAME]",
-          "id": "[UUID]",
-          "name": "[ORIGINAL_ENDPOINT_ID]",
-          "permission_level": "CAN_MANAGE",
-          "route_optimized": false,
-          "state": {
-            "config_update": "NOT_UPDATING",
-            "ready": "NOT_READY"
-          }
-        },
-        "endpoint_id": "[UUID]"
-      },
-      "changes": {
-        "config.auto_capture_config.table_name_prefix": {
-          "action": "recreate",
-          "reason": "immutable",
-          "old": "my_table",
-          "new": "other_table",
-          "remote": "my_table"
-        },
-        "route_optimized": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": false
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/table-prefix/out.second-plan.json b/acceptance/bundle/resources/model_serving_endpoints/recreate/table-prefix/out.second-plan.json
new file mode 100644
index 00000000000..6d2c9deccb6
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/recreate/table-prefix/out.second-plan.json
@@ -0,0 +1,146 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.model_serving_endpoints.test_endpoint": {
+      "action": "recreate",
+      "new_state": {
+        "value": {
+          "config": {
+            "auto_capture_config": {
+              "catalog_name": "main",
+              "schema_name": "default",
+              "table_name_prefix": "other_table"
+            },
+            "served_entities": [
+              {
+                "external_model": {
+                  "name": "gpt-4o-mini",
+                  "openai_config": {
+                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
+                  },
+                  "provider": "openai",
+                  "task": "llm/v1/chat"
+                },
+                "name": "prod"
+              }
+            ]
+          },
+          "name": "[ORIGINAL_ENDPOINT_ID]"
+        }
+      },
+      "remote_state": {
+        "config": {
+          "auto_capture_config": {
+            "catalog_name": "main",
+            "schema_name": "default",
+            "table_name_prefix": "my_table"
+          },
+          "served_entities": [
+            {
+              "external_model": {
+                "name": "gpt-4o-mini",
+                "openai_config": {
+                  "openai_api_key": "{{secrets/test-scope/openai-key}}"
+                },
+                "provider": "openai",
+                "task": "llm/v1/chat"
+              },
+              "name": "prod"
+            }
+          ],
+          "traffic_config": {
+            "routes": [
+              {
+                "served_entity_name": "prod",
+                "served_model_name": "prod",
+                "traffic_percentage": 100
+              }
+            ]
+          }
+        },
+        "description": "",
+        "endpoint_details": {
+          "config": {
+            "auto_capture_config": {
+              "catalog_name": "main",
+              "schema_name": "default",
+              "table_name_prefix": "my_table"
+            },
+            "served_entities": [
+              {
+                "external_model": {
+                  "name": "gpt-4o-mini",
+                  "openai_config": {
+                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
+                  },
+                  "provider": "openai",
+                  "task": "llm/v1/chat"
+                },
+                "name": "prod"
+              }
+            ],
+            "traffic_config": {
+              "routes": [
+                {
+                  "served_entity_name": "prod",
+                  "served_model_name": "prod",
+                  "traffic_percentage": 100
+                }
+              ]
+            }
+          },
+          "creation_timestamp": [UNIX_TIME_MILLIS][0],
+          "creator": "[USERNAME]",
+          "description": "",
+          "id": "[UUID]",
+          "last_updated_timestamp": [UNIX_TIME_MILLIS][0],
+          "name": "[ORIGINAL_ENDPOINT_ID]",
+          "permission_level": "CAN_MANAGE",
+          "route_optimized": false,
+          "state": {
+            "config_update": "NOT_UPDATING",
+            "ready": "NOT_READY"
+          }
+        },
+        "endpoint_id": "[UUID]",
+        "name": "[ORIGINAL_ENDPOINT_ID]",
+        "route_optimized": false
+      },
+      "changes": {
+        "config.auto_capture_config.table_name_prefix": {
+          "action": "recreate",
+          "reason": "immutable",
+          "old": "my_table",
+          "new": "other_table",
+          "remote": "my_table"
+        },
+        "config.traffic_config": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": {
+            "routes": [
+              {
+                "served_entity_name": "prod",
+                "served_model_name": "prod",
+                "traffic_percentage": 100
+              }
+            ]
+          }
+        },
+        "description": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": ""
+        },
+        "route_optimized": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": false
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/table-prefix/out.second-plan.terraform.json b/acceptance/bundle/resources/model_serving_endpoints/recreate/table-prefix/out.second-plan.terraform.json
deleted file mode 100644
index 93d8386e798..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/recreate/table-prefix/out.second-plan.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.model_serving_endpoints.test_endpoint": {
-      "action": "recreate"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/table-prefix/out.test.toml b/acceptance/bundle/resources/model_serving_endpoints/recreate/table-prefix/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/model_serving_endpoints/recreate/table-prefix/out.test.toml
+++ b/acceptance/bundle/resources/model_serving_endpoints/recreate/table-prefix/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/table-prefix/output.txt b/acceptance/bundle/resources/model_serving_endpoints/recreate/table-prefix/output.txt
index ec4ac2934d6..8d514685499 100644
--- a/acceptance/bundle/resources/model_serving_endpoints/recreate/table-prefix/output.txt
+++ b/acceptance/bundle/resources/model_serving_endpoints/recreate/table-prefix/output.txt
@@ -3,9 +3,9 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created model_serving_endpoints.test_endpoint
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> print_requests.py //serving-endpoints
 {
@@ -45,9 +45,9 @@ Deployment complete!
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Recreated model_serving_endpoints.test_endpoint
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 0 unchanged
 
 >>> print_requests.py //serving-endpoints
 {
@@ -91,5 +91,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/table-prefix/script b/acceptance/bundle/resources/model_serving_endpoints/recreate/table-prefix/script
index 7a41b3bfcb7..b2b596802c7 100755
--- a/acceptance/bundle/resources/model_serving_endpoints/recreate/table-prefix/script
+++ b/acceptance/bundle/resources/model_serving_endpoints/recreate/table-prefix/script
@@ -2,25 +2,25 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm -f out.requests.txt
+    rm -f "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
-trace $CLI bundle plan -o json > out.first-plan.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.first-plan.json
 trace $CLI bundle deploy
 
 trace print_requests.py //serving-endpoints
 
 ENDPOINT_ID=$($CLI bundle summary -o json | jq -r '.resources.model_serving_endpoints.test_endpoint.id')
-echo "$ENDPOINT_ID:ORIGINAL_ENDPOINT_ID" >> ACC_REPLS
+add_repl "$ENDPOINT_ID" ORIGINAL_ENDPOINT_ID
 trace $CLI serving-endpoints get "${ENDPOINT_ID}" | jq '.config.auto_capture_config.table_name_prefix'
 
 trace update_file.py databricks.yml "table_name_prefix: my_table" "table_name_prefix: other_table"
-trace $CLI bundle plan -o json > out.second-plan.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.second-plan.json
 trace $CLI bundle deploy
 
 trace print_requests.py //serving-endpoints
 
 NEW_ENDPOINT_ID=$($CLI bundle summary -o json | jq -r '.resources.model_serving_endpoints.test_endpoint.id')
-echo "$NEW_ENDPOINT_ID:NEW_ENDPOINT_ID" >> ACC_REPLS
+add_repl "$NEW_ENDPOINT_ID" NEW_ENDPOINT_ID
 trace $CLI serving-endpoints get "${NEW_ENDPOINT_ID}" | jq '.config.auto_capture_config.table_name_prefix'
diff --git a/acceptance/bundle/resources/model_serving_endpoints/recreate/test.toml b/acceptance/bundle/resources/model_serving_endpoints/recreate/test.toml
index 3aa4a190502..8488476b7a3 100644
--- a/acceptance/bundle/resources/model_serving_endpoints/recreate/test.toml
+++ b/acceptance/bundle/resources/model_serving_endpoints/recreate/test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
 RecordRequests = true
 
diff --git a/acceptance/bundle/resources/model_serving_endpoints/running-endpoint/out.plan.direct.txt b/acceptance/bundle/resources/model_serving_endpoints/running-endpoint/out.plan.direct.txt
deleted file mode 100644
index 2766de02d29..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/running-endpoint/out.plan.direct.txt
+++ /dev/null
@@ -1,25 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.model_serving_endpoints.my_endpoint": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "config": {
-            "served_entities": [
-              {
-                "entity_name": "system.ai.llama_v3_2_1b_instruct",
-                "entity_version": "[VERSION]",
-                "name": "llama",
-                "scale_to_zero_enabled": true,
-                "workload_size": "Small"
-              }
-            ]
-          },
-          "name": "test-endpoint-[UNIQUE_NAME]"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/running-endpoint/out.plan.terraform.txt b/acceptance/bundle/resources/model_serving_endpoints/running-endpoint/out.plan.terraform.txt
deleted file mode 100644
index 855ad4775fa..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/running-endpoint/out.plan.terraform.txt
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.model_serving_endpoints.my_endpoint": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/running-endpoint/out.plan.txt b/acceptance/bundle/resources/model_serving_endpoints/running-endpoint/out.plan.txt
new file mode 100644
index 00000000000..c2850d4964a
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/running-endpoint/out.plan.txt
@@ -0,0 +1,25 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.model_serving_endpoints.my_endpoint": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "config": {
+            "served_entities": [
+              {
+                "entity_name": "system.ai.llama_v3_2_1b_instruct",
+                "entity_version": "[VERSION]",
+                "name": "llama",
+                "scale_to_zero_enabled": true,
+                "workload_size": "Small"
+              }
+            ]
+          },
+          "name": "test-endpoint-[UNIQUE_NAME]"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/running-endpoint/out.test.toml b/acceptance/bundle/resources/model_serving_endpoints/running-endpoint/out.test.toml
index 68b04957a4c..7c3dd4f02ef 100644
--- a/acceptance/bundle/resources/model_serving_endpoints/running-endpoint/out.test.toml
+++ b/acceptance/bundle/resources/model_serving_endpoints/running-endpoint/out.test.toml
@@ -1,5 +1,4 @@
-Local = true
 Cloud = true
 CloudSlow = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+CloudEnvs.gcp = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/model_serving_endpoints/running-endpoint/output.txt b/acceptance/bundle/resources/model_serving_endpoints/running-endpoint/output.txt
index 470af7f02df..41d5cd758a7 100644
--- a/acceptance/bundle/resources/model_serving_endpoints/running-endpoint/output.txt
+++ b/acceptance/bundle/resources/model_serving_endpoints/running-endpoint/output.txt
@@ -3,9 +3,9 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created model_serving_endpoints.my_endpoint
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> print_requests.py //serving-endpoints
 {
@@ -43,5 +43,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/model_serving_endpoints/running-endpoint/script b/acceptance/bundle/resources/model_serving_endpoints/running-endpoint/script
index 8b420559c3d..93eb53d69a7 100644
--- a/acceptance/bundle/resources/model_serving_endpoints/running-endpoint/script
+++ b/acceptance/bundle/resources/model_serving_endpoints/running-endpoint/script
@@ -4,11 +4,11 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm out.requests.txt
+    rm "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
-trace $CLI bundle plan -o json > out.plan.$DATABRICKS_BUNDLE_ENGINE.txt
+trace $CLI bundle plan -o json | nostamp > out.plan.txt
 trace $CLI bundle deploy
 
 trace print_requests.py //serving-endpoints
diff --git a/acceptance/bundle/resources/model_serving_endpoints/running-endpoint/test.toml b/acceptance/bundle/resources/model_serving_endpoints/running-endpoint/test.toml
index 4fe8dadfd56..0cb8ee6421c 100644
--- a/acceptance/bundle/resources/model_serving_endpoints/running-endpoint/test.toml
+++ b/acceptance/bundle/resources/model_serving_endpoints/running-endpoint/test.toml
@@ -1,8 +1,10 @@
 Timeout = '30m'
 Cloud = true
-Local = true
 CloudSlow = true
-RequiresUnityCatalog = true
+
+# GCP test envs lack foundation-model / GPU serving capacity, so deploying this
+# real llama endpoint fails with UPDATE_FAILED after ~29 min. Skip on GCP.
+CloudEnvs.gcp = false
 
 [[Server]]
 Pattern = "GET /api/2.1/unity-catalog/models/system.ai.llama_v3_2_1b_instruct/versions"
diff --git a/acceptance/bundle/resources/model_serving_endpoints/update/ai-gateway/out.plan.direct.json b/acceptance/bundle/resources/model_serving_endpoints/update/ai-gateway/out.plan.direct.json
deleted file mode 100644
index b9228ef8c78..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/update/ai-gateway/out.plan.direct.json
+++ /dev/null
@@ -1,83 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.model_serving_endpoints.test_endpoint": {
-      "action": "update",
-      "new_state": {
-        "value": {
-          "ai_gateway": {
-            "inference_table_config": {
-              "catalog_name": "second-inference-catalog"
-            }
-          },
-          "config": {
-            "served_entities": [
-              {
-                "external_model": {
-                  "name": "gpt-4o-mini",
-                  "openai_config": {
-                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
-                  },
-                  "provider": "openai",
-                  "task": "llm/v1/chat"
-                },
-                "name": "prod"
-              }
-            ]
-          },
-          "name": "[ENDPOINT_ID]"
-        }
-      },
-      "remote_state": {
-        "endpoint_details": {
-          "ai_gateway": {
-            "inference_table_config": {
-              "catalog_name": "first-inference-catalog"
-            }
-          },
-          "config": {
-            "served_entities": [
-              {
-                "external_model": {
-                  "name": "gpt-4o-mini",
-                  "openai_config": {
-                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
-                  },
-                  "provider": "openai",
-                  "task": "llm/v1/chat"
-                },
-                "name": "prod"
-              }
-            ]
-          },
-          "creator": "[USERNAME]",
-          "id": "[UUID]",
-          "name": "[ENDPOINT_ID]",
-          "permission_level": "CAN_MANAGE",
-          "route_optimized": false,
-          "state": {
-            "config_update": "NOT_UPDATING",
-            "ready": "NOT_READY"
-          }
-        },
-        "endpoint_id": "[UUID]"
-      },
-      "changes": {
-        "ai_gateway.inference_table_config.catalog_name": {
-          "action": "update",
-          "old": "first-inference-catalog",
-          "new": "second-inference-catalog",
-          "remote": "first-inference-catalog"
-        },
-        "route_optimized": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": false
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/update/ai-gateway/out.plan.json b/acceptance/bundle/resources/model_serving_endpoints/update/ai-gateway/out.plan.json
new file mode 100644
index 00000000000..afe9fa25886
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/update/ai-gateway/out.plan.json
@@ -0,0 +1,145 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.model_serving_endpoints.test_endpoint": {
+      "action": "update",
+      "new_state": {
+        "value": {
+          "ai_gateway": {
+            "inference_table_config": {
+              "catalog_name": "second-inference-catalog"
+            }
+          },
+          "config": {
+            "served_entities": [
+              {
+                "external_model": {
+                  "name": "gpt-4o-mini",
+                  "openai_config": {
+                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
+                  },
+                  "provider": "openai",
+                  "task": "llm/v1/chat"
+                },
+                "name": "prod"
+              }
+            ]
+          },
+          "name": "[ENDPOINT_ID]"
+        }
+      },
+      "remote_state": {
+        "ai_gateway": {
+          "inference_table_config": {
+            "catalog_name": "first-inference-catalog"
+          }
+        },
+        "config": {
+          "served_entities": [
+            {
+              "external_model": {
+                "name": "gpt-4o-mini",
+                "openai_config": {
+                  "openai_api_key": "{{secrets/test-scope/openai-key}}"
+                },
+                "provider": "openai",
+                "task": "llm/v1/chat"
+              },
+              "name": "prod"
+            }
+          ],
+          "traffic_config": {
+            "routes": [
+              {
+                "served_entity_name": "prod",
+                "served_model_name": "prod",
+                "traffic_percentage": 100
+              }
+            ]
+          }
+        },
+        "description": "",
+        "endpoint_details": {
+          "ai_gateway": {
+            "inference_table_config": {
+              "catalog_name": "first-inference-catalog"
+            }
+          },
+          "config": {
+            "served_entities": [
+              {
+                "external_model": {
+                  "name": "gpt-4o-mini",
+                  "openai_config": {
+                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
+                  },
+                  "provider": "openai",
+                  "task": "llm/v1/chat"
+                },
+                "name": "prod"
+              }
+            ],
+            "traffic_config": {
+              "routes": [
+                {
+                  "served_entity_name": "prod",
+                  "served_model_name": "prod",
+                  "traffic_percentage": 100
+                }
+              ]
+            }
+          },
+          "creation_timestamp": [UNIX_TIME_MILLIS][0],
+          "creator": "[USERNAME]",
+          "description": "",
+          "id": "[UUID]",
+          "last_updated_timestamp": [UNIX_TIME_MILLIS][0],
+          "name": "[ENDPOINT_ID]",
+          "permission_level": "CAN_MANAGE",
+          "route_optimized": false,
+          "state": {
+            "config_update": "NOT_UPDATING",
+            "ready": "NOT_READY"
+          }
+        },
+        "endpoint_id": "[UUID]",
+        "name": "[ENDPOINT_ID]",
+        "route_optimized": false
+      },
+      "changes": {
+        "ai_gateway.inference_table_config.catalog_name": {
+          "action": "update",
+          "old": "first-inference-catalog",
+          "new": "second-inference-catalog",
+          "remote": "first-inference-catalog"
+        },
+        "config.traffic_config": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": {
+            "routes": [
+              {
+                "served_entity_name": "prod",
+                "served_model_name": "prod",
+                "traffic_percentage": 100
+              }
+            ]
+          }
+        },
+        "description": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": ""
+        },
+        "route_optimized": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": false
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/update/ai-gateway/out.plan.terraform.json b/acceptance/bundle/resources/model_serving_endpoints/update/ai-gateway/out.plan.terraform.json
deleted file mode 100644
index 0cbd4ed8187..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/update/ai-gateway/out.plan.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.model_serving_endpoints.test_endpoint": {
-      "action": "update"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/update/ai-gateway/out.test.toml b/acceptance/bundle/resources/model_serving_endpoints/update/ai-gateway/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/model_serving_endpoints/update/ai-gateway/out.test.toml
+++ b/acceptance/bundle/resources/model_serving_endpoints/update/ai-gateway/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/model_serving_endpoints/update/ai-gateway/output.txt b/acceptance/bundle/resources/model_serving_endpoints/update/ai-gateway/output.txt
index a9be82769c7..c7ca361a7db 100644
--- a/acceptance/bundle/resources/model_serving_endpoints/update/ai-gateway/output.txt
+++ b/acceptance/bundle/resources/model_serving_endpoints/update/ai-gateway/output.txt
@@ -1,9 +1,9 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created model_serving_endpoints.test_endpoint
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] serving-endpoints get [ENDPOINT_ID]
 {
@@ -18,9 +18,9 @@ Deployment complete!
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated model_serving_endpoints.test_endpoint
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
 >>> print_requests.py //serving-endpoints
 {
@@ -73,5 +73,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/model_serving_endpoints/update/ai-gateway/script b/acceptance/bundle/resources/model_serving_endpoints/update/ai-gateway/script
index 89877faef63..4caa4883ead 100755
--- a/acceptance/bundle/resources/model_serving_endpoints/update/ai-gateway/script
+++ b/acceptance/bundle/resources/model_serving_endpoints/update/ai-gateway/script
@@ -3,19 +3,19 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm -f out.requests.txt
+    rm -f "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
 trace $CLI bundle deploy
 
 ENDPOINT_ID=$($CLI bundle summary -o json | jq -r '.resources.model_serving_endpoints.test_endpoint.id')
-echo "$ENDPOINT_ID:ENDPOINT_ID" >> ACC_REPLS
+add_repl "$ENDPOINT_ID" ENDPOINT_ID
 trace $CLI serving-endpoints get "${ENDPOINT_ID}" | jq '.ai_gateway'
 
 trace update_file.py databricks.yml 'catalog_name: "first-inference-catalog"' 'catalog_name: "second-inference-catalog"'
 
-trace $CLI bundle plan -o json > out.plan.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.plan.json
 trace $CLI bundle deploy
 
 trace print_requests.py //serving-endpoints
diff --git a/acceptance/bundle/resources/model_serving_endpoints/update/both_gateway_and_tags/out.plan.direct.json b/acceptance/bundle/resources/model_serving_endpoints/update/both_gateway_and_tags/out.plan.direct.json
deleted file mode 100644
index 6dd458695a2..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/update/both_gateway_and_tags/out.plan.direct.json
+++ /dev/null
@@ -1,101 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.model_serving_endpoints.test_endpoint": {
-      "action": "update",
-      "new_state": {
-        "value": {
-          "ai_gateway": {
-            "inference_table_config": {
-              "catalog_name": "second-inference-catalog"
-            }
-          },
-          "config": {
-            "served_entities": [
-              {
-                "external_model": {
-                  "name": "gpt-4o-mini",
-                  "openai_config": {
-                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
-                  },
-                  "provider": "openai",
-                  "task": "llm/v1/chat"
-                },
-                "name": "prod"
-              }
-            ]
-          },
-          "name": "[ENDPOINT_ID]",
-          "tags": [
-            {
-              "key": "team",
-              "value": "my-team-two"
-            }
-          ]
-        }
-      },
-      "remote_state": {
-        "endpoint_details": {
-          "ai_gateway": {
-            "inference_table_config": {
-              "catalog_name": "first-inference-catalog"
-            }
-          },
-          "config": {
-            "served_entities": [
-              {
-                "external_model": {
-                  "name": "gpt-4o-mini",
-                  "openai_config": {
-                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
-                  },
-                  "provider": "openai",
-                  "task": "llm/v1/chat"
-                },
-                "name": "prod"
-              }
-            ]
-          },
-          "creator": "[USERNAME]",
-          "id": "[UUID]",
-          "name": "[ENDPOINT_ID]",
-          "permission_level": "CAN_MANAGE",
-          "route_optimized": false,
-          "state": {
-            "config_update": "NOT_UPDATING",
-            "ready": "NOT_READY"
-          },
-          "tags": [
-            {
-              "key": "team",
-              "value": "my-team-one"
-            }
-          ]
-        },
-        "endpoint_id": "[UUID]"
-      },
-      "changes": {
-        "ai_gateway.inference_table_config.catalog_name": {
-          "action": "update",
-          "old": "first-inference-catalog",
-          "new": "second-inference-catalog",
-          "remote": "first-inference-catalog"
-        },
-        "route_optimized": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": false
-        },
-        "tags[0].value": {
-          "action": "update",
-          "old": "my-team-one",
-          "new": "my-team-two",
-          "remote": "my-team-one"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/update/both_gateway_and_tags/out.plan.json b/acceptance/bundle/resources/model_serving_endpoints/update/both_gateway_and_tags/out.plan.json
new file mode 100644
index 00000000000..32c30ee2612
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/update/both_gateway_and_tags/out.plan.json
@@ -0,0 +1,169 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.model_serving_endpoints.test_endpoint": {
+      "action": "update",
+      "new_state": {
+        "value": {
+          "ai_gateway": {
+            "inference_table_config": {
+              "catalog_name": "second-inference-catalog"
+            }
+          },
+          "config": {
+            "served_entities": [
+              {
+                "external_model": {
+                  "name": "gpt-4o-mini",
+                  "openai_config": {
+                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
+                  },
+                  "provider": "openai",
+                  "task": "llm/v1/chat"
+                },
+                "name": "prod"
+              }
+            ]
+          },
+          "name": "[ENDPOINT_ID]",
+          "tags": [
+            {
+              "key": "team",
+              "value": "my-team-two"
+            }
+          ]
+        }
+      },
+      "remote_state": {
+        "ai_gateway": {
+          "inference_table_config": {
+            "catalog_name": "first-inference-catalog"
+          }
+        },
+        "config": {
+          "served_entities": [
+            {
+              "external_model": {
+                "name": "gpt-4o-mini",
+                "openai_config": {
+                  "openai_api_key": "{{secrets/test-scope/openai-key}}"
+                },
+                "provider": "openai",
+                "task": "llm/v1/chat"
+              },
+              "name": "prod"
+            }
+          ],
+          "traffic_config": {
+            "routes": [
+              {
+                "served_entity_name": "prod",
+                "served_model_name": "prod",
+                "traffic_percentage": 100
+              }
+            ]
+          }
+        },
+        "description": "",
+        "endpoint_details": {
+          "ai_gateway": {
+            "inference_table_config": {
+              "catalog_name": "first-inference-catalog"
+            }
+          },
+          "config": {
+            "served_entities": [
+              {
+                "external_model": {
+                  "name": "gpt-4o-mini",
+                  "openai_config": {
+                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
+                  },
+                  "provider": "openai",
+                  "task": "llm/v1/chat"
+                },
+                "name": "prod"
+              }
+            ],
+            "traffic_config": {
+              "routes": [
+                {
+                  "served_entity_name": "prod",
+                  "served_model_name": "prod",
+                  "traffic_percentage": 100
+                }
+              ]
+            }
+          },
+          "creation_timestamp": [UNIX_TIME_MILLIS][0],
+          "creator": "[USERNAME]",
+          "description": "",
+          "id": "[UUID]",
+          "last_updated_timestamp": [UNIX_TIME_MILLIS][0],
+          "name": "[ENDPOINT_ID]",
+          "permission_level": "CAN_MANAGE",
+          "route_optimized": false,
+          "state": {
+            "config_update": "NOT_UPDATING",
+            "ready": "NOT_READY"
+          },
+          "tags": [
+            {
+              "key": "team",
+              "value": "my-team-one"
+            }
+          ]
+        },
+        "endpoint_id": "[UUID]",
+        "name": "[ENDPOINT_ID]",
+        "route_optimized": false,
+        "tags": [
+          {
+            "key": "team",
+            "value": "my-team-one"
+          }
+        ]
+      },
+      "changes": {
+        "ai_gateway.inference_table_config.catalog_name": {
+          "action": "update",
+          "old": "first-inference-catalog",
+          "new": "second-inference-catalog",
+          "remote": "first-inference-catalog"
+        },
+        "config.traffic_config": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": {
+            "routes": [
+              {
+                "served_entity_name": "prod",
+                "served_model_name": "prod",
+                "traffic_percentage": 100
+              }
+            ]
+          }
+        },
+        "description": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": ""
+        },
+        "route_optimized": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": false
+        },
+        "tags[0].value": {
+          "action": "update",
+          "old": "my-team-one",
+          "new": "my-team-two",
+          "remote": "my-team-one"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/update/both_gateway_and_tags/out.plan.terraform.json b/acceptance/bundle/resources/model_serving_endpoints/update/both_gateway_and_tags/out.plan.terraform.json
deleted file mode 100644
index 0cbd4ed8187..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/update/both_gateway_and_tags/out.plan.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.model_serving_endpoints.test_endpoint": {
-      "action": "update"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/update/both_gateway_and_tags/out.test.toml b/acceptance/bundle/resources/model_serving_endpoints/update/both_gateway_and_tags/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/model_serving_endpoints/update/both_gateway_and_tags/out.test.toml
+++ b/acceptance/bundle/resources/model_serving_endpoints/update/both_gateway_and_tags/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/model_serving_endpoints/update/both_gateway_and_tags/output.txt b/acceptance/bundle/resources/model_serving_endpoints/update/both_gateway_and_tags/output.txt
index c4a7725fe9f..39df6500a61 100644
--- a/acceptance/bundle/resources/model_serving_endpoints/update/both_gateway_and_tags/output.txt
+++ b/acceptance/bundle/resources/model_serving_endpoints/update/both_gateway_and_tags/output.txt
@@ -1,9 +1,9 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created model_serving_endpoints.test_endpoint
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] serving-endpoints get [ENDPOINT_ID]
 {
@@ -19,7 +19,16 @@ Deployment complete!
       },
       "name": "prod"
     }
-  ]
+  ],
+  "traffic_config": {
+    "routes": [
+      {
+        "served_entity_name": "prod",
+        "served_model_name": "prod",
+        "traffic_percentage": 100
+      }
+    ]
+  }
 }
 
 >>> update_file.py databricks.yml value: my-team-one value: my-team-two
@@ -30,9 +39,9 @@ Deployment complete!
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated model_serving_endpoints.test_endpoint
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
 >>> print_requests.py //serving-endpoints
 {
@@ -104,7 +113,16 @@ Deployment complete!
       },
       "name": "prod"
     }
-  ]
+  ],
+  "traffic_config": {
+    "routes": [
+      {
+        "served_entity_name": "prod",
+        "served_model_name": "prod",
+        "traffic_percentage": 100
+      }
+    ]
+  }
 }
 
 >>> [CLI] bundle destroy --auto-approve
@@ -113,5 +131,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/model_serving_endpoints/update/both_gateway_and_tags/script b/acceptance/bundle/resources/model_serving_endpoints/update/both_gateway_and_tags/script
index d0743fbfb73..cba0af905d5 100755
--- a/acceptance/bundle/resources/model_serving_endpoints/update/both_gateway_and_tags/script
+++ b/acceptance/bundle/resources/model_serving_endpoints/update/both_gateway_and_tags/script
@@ -3,21 +3,21 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm -f out.requests.txt
+    rm -f "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
 trace $CLI bundle deploy
 
 ENDPOINT_ID=$($CLI bundle summary -o json | jq -r '.resources.model_serving_endpoints.test_endpoint.id')
-echo "$ENDPOINT_ID:ENDPOINT_ID" >> ACC_REPLS
+add_repl "$ENDPOINT_ID" ENDPOINT_ID
 trace $CLI serving-endpoints get "${ENDPOINT_ID}" | jq '.config'
 
 # Update two fields. The patch request should be called for both.
 trace update_file.py databricks.yml "value: my-team-one" "value: my-team-two"
 trace update_file.py databricks.yml 'catalog_name: "first-inference-catalog"' 'catalog_name: "second-inference-catalog"'
 
-trace $CLI bundle plan -o json > out.plan.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.plan.json
 trace $CLI bundle deploy
 
 trace print_requests.py //serving-endpoints
diff --git a/acceptance/bundle/resources/model_serving_endpoints/update/config/databricks.yml.tmpl b/acceptance/bundle/resources/model_serving_endpoints/update/config/databricks.yml.tmpl
index 726f5dce1f0..006e4221236 100644
--- a/acceptance/bundle/resources/model_serving_endpoints/update/config/databricks.yml.tmpl
+++ b/acceptance/bundle/resources/model_serving_endpoints/update/config/databricks.yml.tmpl
@@ -17,3 +17,10 @@ resources:
               task: llm/v1/chat
               openai_config:
                 openai_api_key: "{{secrets/test-scope/openai-key}}"
+        # Set explicitly so terraform and direct produce identical update requests:
+        # the backend defaults traffic_config, and terraform round-trips that default
+        # back into its config update while the direct engine sends only the user config.
+        traffic_config:
+          routes:
+            - served_model_name: prod
+              traffic_percentage: 100
diff --git a/acceptance/bundle/resources/model_serving_endpoints/update/config/out.plan.direct.json b/acceptance/bundle/resources/model_serving_endpoints/update/config/out.plan.direct.json
deleted file mode 100644
index 7b82abf6da8..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/update/config/out.plan.direct.json
+++ /dev/null
@@ -1,73 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.model_serving_endpoints.test_endpoint": {
-      "action": "update",
-      "new_state": {
-        "value": {
-          "config": {
-            "served_entities": [
-              {
-                "external_model": {
-                  "name": "gpt-5o-mini",
-                  "openai_config": {
-                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
-                  },
-                  "provider": "openai",
-                  "task": "llm/v1/chat"
-                },
-                "name": "prod"
-              }
-            ]
-          },
-          "name": "[ENDPOINT_ID]"
-        }
-      },
-      "remote_state": {
-        "endpoint_details": {
-          "config": {
-            "served_entities": [
-              {
-                "external_model": {
-                  "name": "gpt-4o-mini",
-                  "openai_config": {
-                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
-                  },
-                  "provider": "openai",
-                  "task": "llm/v1/chat"
-                },
-                "name": "prod"
-              }
-            ]
-          },
-          "creator": "[USERNAME]",
-          "id": "[UUID]",
-          "name": "[ENDPOINT_ID]",
-          "permission_level": "CAN_MANAGE",
-          "route_optimized": false,
-          "state": {
-            "config_update": "NOT_UPDATING",
-            "ready": "NOT_READY"
-          }
-        },
-        "endpoint_id": "[UUID]"
-      },
-      "changes": {
-        "config.served_entities[0].external_model.name": {
-          "action": "update",
-          "old": "gpt-4o-mini",
-          "new": "gpt-5o-mini",
-          "remote": "gpt-4o-mini"
-        },
-        "route_optimized": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": false
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/update/config/out.plan.json b/acceptance/bundle/resources/model_serving_endpoints/update/config/out.plan.json
new file mode 100644
index 00000000000..5b90f2088d6
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/update/config/out.plan.json
@@ -0,0 +1,123 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.model_serving_endpoints.test_endpoint": {
+      "action": "update",
+      "new_state": {
+        "value": {
+          "config": {
+            "served_entities": [
+              {
+                "external_model": {
+                  "name": "gpt-5o-mini",
+                  "openai_config": {
+                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
+                  },
+                  "provider": "openai",
+                  "task": "llm/v1/chat"
+                },
+                "name": "prod"
+              }
+            ],
+            "traffic_config": {
+              "routes": [
+                {
+                  "served_model_name": "prod",
+                  "traffic_percentage": 100
+                }
+              ]
+            }
+          },
+          "name": "[ENDPOINT_ID]"
+        }
+      },
+      "remote_state": {
+        "config": {
+          "served_entities": [
+            {
+              "external_model": {
+                "name": "gpt-4o-mini",
+                "openai_config": {
+                  "openai_api_key": "{{secrets/test-scope/openai-key}}"
+                },
+                "provider": "openai",
+                "task": "llm/v1/chat"
+              },
+              "name": "prod"
+            }
+          ],
+          "traffic_config": {
+            "routes": [
+              {
+                "served_model_name": "prod",
+                "traffic_percentage": 100
+              }
+            ]
+          }
+        },
+        "description": "",
+        "endpoint_details": {
+          "config": {
+            "served_entities": [
+              {
+                "external_model": {
+                  "name": "gpt-4o-mini",
+                  "openai_config": {
+                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
+                  },
+                  "provider": "openai",
+                  "task": "llm/v1/chat"
+                },
+                "name": "prod"
+              }
+            ],
+            "traffic_config": {
+              "routes": [
+                {
+                  "served_model_name": "prod",
+                  "traffic_percentage": 100
+                }
+              ]
+            }
+          },
+          "creation_timestamp": [UNIX_TIME_MILLIS][0],
+          "creator": "[USERNAME]",
+          "description": "",
+          "id": "[UUID]",
+          "last_updated_timestamp": [UNIX_TIME_MILLIS][0],
+          "name": "[ENDPOINT_ID]",
+          "permission_level": "CAN_MANAGE",
+          "route_optimized": false,
+          "state": {
+            "config_update": "NOT_UPDATING",
+            "ready": "NOT_READY"
+          }
+        },
+        "endpoint_id": "[UUID]",
+        "name": "[ENDPOINT_ID]",
+        "route_optimized": false
+      },
+      "changes": {
+        "config.served_entities[0].external_model.name": {
+          "action": "update",
+          "old": "gpt-4o-mini",
+          "new": "gpt-5o-mini",
+          "remote": "gpt-4o-mini"
+        },
+        "description": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": ""
+        },
+        "route_optimized": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": false
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/update/config/out.plan.terraform.json b/acceptance/bundle/resources/model_serving_endpoints/update/config/out.plan.terraform.json
deleted file mode 100644
index 0cbd4ed8187..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/update/config/out.plan.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.model_serving_endpoints.test_endpoint": {
-      "action": "update"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/update/config/out.test.toml b/acceptance/bundle/resources/model_serving_endpoints/update/config/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/model_serving_endpoints/update/config/out.test.toml
+++ b/acceptance/bundle/resources/model_serving_endpoints/update/config/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/model_serving_endpoints/update/config/output.txt b/acceptance/bundle/resources/model_serving_endpoints/update/config/output.txt
index 156936aa5fb..79c05120da8 100644
--- a/acceptance/bundle/resources/model_serving_endpoints/update/config/output.txt
+++ b/acceptance/bundle/resources/model_serving_endpoints/update/config/output.txt
@@ -1,9 +1,9 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created model_serving_endpoints.test_endpoint
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] serving-endpoints get [ENDPOINT_ID]
 {
@@ -19,7 +19,15 @@ Deployment complete!
       },
       "name": "prod"
     }
-  ]
+  ],
+  "traffic_config": {
+    "routes": [
+      {
+        "served_model_name": "prod",
+        "traffic_percentage": 100
+      }
+    ]
+  }
 }
 
 >>> update_file.py databricks.yml name: gpt-4o-mini name: gpt-5o-mini
@@ -28,9 +36,9 @@ Deployment complete!
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated model_serving_endpoints.test_endpoint
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
 >>> print_requests.py //serving-endpoints
 {
@@ -50,7 +58,15 @@ Deployment complete!
           },
           "name": "prod"
         }
-      ]
+      ],
+      "traffic_config": {
+        "routes": [
+          {
+            "served_model_name": "prod",
+            "traffic_percentage": 100
+          }
+        ]
+      }
     },
     "name": "[ENDPOINT_ID]"
   }
@@ -71,7 +87,15 @@ Deployment complete!
         },
         "name": "prod"
       }
-    ]
+    ],
+    "traffic_config": {
+      "routes": [
+        {
+          "served_model_name": "prod",
+          "traffic_percentage": 100
+        }
+      ]
+    }
   }
 }
 
@@ -89,7 +113,15 @@ Deployment complete!
       },
       "name": "prod"
     }
-  ]
+  ],
+  "traffic_config": {
+    "routes": [
+      {
+        "served_model_name": "prod",
+        "traffic_percentage": 100
+      }
+    ]
+  }
 }
 
 >>> [CLI] bundle destroy --auto-approve
@@ -98,5 +130,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/model_serving_endpoints/update/config/script b/acceptance/bundle/resources/model_serving_endpoints/update/config/script
index 3f28edc8438..844db16bd7b 100755
--- a/acceptance/bundle/resources/model_serving_endpoints/update/config/script
+++ b/acceptance/bundle/resources/model_serving_endpoints/update/config/script
@@ -3,19 +3,19 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm -f out.requests.txt
+    rm -f "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
 trace $CLI bundle deploy
 
 ENDPOINT_ID=$($CLI bundle summary -o json | jq -r '.resources.model_serving_endpoints.test_endpoint.id')
-echo "$ENDPOINT_ID:ENDPOINT_ID" >> ACC_REPLS
+add_repl "$ENDPOINT_ID" ENDPOINT_ID
 trace $CLI serving-endpoints get "${ENDPOINT_ID}" | jq '.config'
 
 trace update_file.py databricks.yml "name: gpt-4o-mini" "name: gpt-5o-mini"
 
-trace $CLI bundle plan -o json > out.plan.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.plan.json
 trace $CLI bundle deploy
 
 trace print_requests.py //serving-endpoints
diff --git a/acceptance/bundle/resources/model_serving_endpoints/update/email-notifications/out.get_email_notifications.direct.json b/acceptance/bundle/resources/model_serving_endpoints/update/email-notifications/out.get_email_notifications.json
similarity index 100%
rename from acceptance/bundle/resources/model_serving_endpoints/update/email-notifications/out.get_email_notifications.direct.json
rename to acceptance/bundle/resources/model_serving_endpoints/update/email-notifications/out.get_email_notifications.json
diff --git a/acceptance/bundle/resources/model_serving_endpoints/update/email-notifications/out.get_email_notifications.terraform.json b/acceptance/bundle/resources/model_serving_endpoints/update/email-notifications/out.get_email_notifications.terraform.json
deleted file mode 100644
index 76b5ef08c2c..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/update/email-notifications/out.get_email_notifications.terraform.json
+++ /dev/null
@@ -1,5 +0,0 @@
-{
-  "on_update_success": [
-    "user1@example.com"
-  ]
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/update/email-notifications/out.plan.direct.json b/acceptance/bundle/resources/model_serving_endpoints/update/email-notifications/out.plan.direct.json
deleted file mode 100644
index 26087d47805..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/update/email-notifications/out.plan.direct.json
+++ /dev/null
@@ -1,83 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.model_serving_endpoints.test_endpoint": {
-      "action": "update",
-      "new_state": {
-        "value": {
-          "config": {
-            "served_entities": [
-              {
-                "external_model": {
-                  "name": "gpt-4o-mini",
-                  "openai_config": {
-                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
-                  },
-                  "provider": "openai",
-                  "task": "llm/v1/chat"
-                },
-                "name": "prod"
-              }
-            ]
-          },
-          "email_notifications": {
-            "on_update_success": [
-              "user2@example.com"
-            ]
-          },
-          "name": "[ENDPOINT_ID]"
-        }
-      },
-      "remote_state": {
-        "endpoint_details": {
-          "config": {
-            "served_entities": [
-              {
-                "external_model": {
-                  "name": "gpt-4o-mini",
-                  "openai_config": {
-                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
-                  },
-                  "provider": "openai",
-                  "task": "llm/v1/chat"
-                },
-                "name": "prod"
-              }
-            ]
-          },
-          "creator": "[USERNAME]",
-          "email_notifications": {
-            "on_update_success": [
-              "user1@example.com"
-            ]
-          },
-          "id": "[UUID]",
-          "name": "[ENDPOINT_ID]",
-          "permission_level": "CAN_MANAGE",
-          "route_optimized": false,
-          "state": {
-            "config_update": "NOT_UPDATING",
-            "ready": "NOT_READY"
-          }
-        },
-        "endpoint_id": "[UUID]"
-      },
-      "changes": {
-        "email_notifications.on_update_success[0]": {
-          "action": "update",
-          "old": "user1@example.com",
-          "new": "user2@example.com",
-          "remote": "user1@example.com"
-        },
-        "route_optimized": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": false
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/update/email-notifications/out.plan.json b/acceptance/bundle/resources/model_serving_endpoints/update/email-notifications/out.plan.json
new file mode 100644
index 00000000000..0f860ce7ac3
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/update/email-notifications/out.plan.json
@@ -0,0 +1,145 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.model_serving_endpoints.test_endpoint": {
+      "action": "update",
+      "new_state": {
+        "value": {
+          "config": {
+            "served_entities": [
+              {
+                "external_model": {
+                  "name": "gpt-4o-mini",
+                  "openai_config": {
+                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
+                  },
+                  "provider": "openai",
+                  "task": "llm/v1/chat"
+                },
+                "name": "prod"
+              }
+            ]
+          },
+          "email_notifications": {
+            "on_update_success": [
+              "user2@example.com"
+            ]
+          },
+          "name": "[ENDPOINT_ID]"
+        }
+      },
+      "remote_state": {
+        "config": {
+          "served_entities": [
+            {
+              "external_model": {
+                "name": "gpt-4o-mini",
+                "openai_config": {
+                  "openai_api_key": "{{secrets/test-scope/openai-key}}"
+                },
+                "provider": "openai",
+                "task": "llm/v1/chat"
+              },
+              "name": "prod"
+            }
+          ],
+          "traffic_config": {
+            "routes": [
+              {
+                "served_entity_name": "prod",
+                "served_model_name": "prod",
+                "traffic_percentage": 100
+              }
+            ]
+          }
+        },
+        "description": "",
+        "email_notifications": {
+          "on_update_success": [
+            "user1@example.com"
+          ]
+        },
+        "endpoint_details": {
+          "config": {
+            "served_entities": [
+              {
+                "external_model": {
+                  "name": "gpt-4o-mini",
+                  "openai_config": {
+                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
+                  },
+                  "provider": "openai",
+                  "task": "llm/v1/chat"
+                },
+                "name": "prod"
+              }
+            ],
+            "traffic_config": {
+              "routes": [
+                {
+                  "served_entity_name": "prod",
+                  "served_model_name": "prod",
+                  "traffic_percentage": 100
+                }
+              ]
+            }
+          },
+          "creation_timestamp": [UNIX_TIME_MILLIS][0],
+          "creator": "[USERNAME]",
+          "description": "",
+          "email_notifications": {
+            "on_update_success": [
+              "user1@example.com"
+            ]
+          },
+          "id": "[UUID]",
+          "last_updated_timestamp": [UNIX_TIME_MILLIS][0],
+          "name": "[ENDPOINT_ID]",
+          "permission_level": "CAN_MANAGE",
+          "route_optimized": false,
+          "state": {
+            "config_update": "NOT_UPDATING",
+            "ready": "NOT_READY"
+          }
+        },
+        "endpoint_id": "[UUID]",
+        "name": "[ENDPOINT_ID]",
+        "route_optimized": false
+      },
+      "changes": {
+        "config.traffic_config": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": {
+            "routes": [
+              {
+                "served_entity_name": "prod",
+                "served_model_name": "prod",
+                "traffic_percentage": 100
+              }
+            ]
+          }
+        },
+        "description": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": ""
+        },
+        "email_notifications.on_update_success[0]": {
+          "action": "update",
+          "old": "user1@example.com",
+          "new": "user2@example.com",
+          "remote": "user1@example.com"
+        },
+        "route_optimized": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": false
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/update/email-notifications/out.plan.terraform.json b/acceptance/bundle/resources/model_serving_endpoints/update/email-notifications/out.plan.terraform.json
deleted file mode 100644
index 0cbd4ed8187..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/update/email-notifications/out.plan.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.model_serving_endpoints.test_endpoint": {
-      "action": "update"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/update/email-notifications/out.requests.direct.json b/acceptance/bundle/resources/model_serving_endpoints/update/email-notifications/out.requests.json
similarity index 100%
rename from acceptance/bundle/resources/model_serving_endpoints/update/email-notifications/out.requests.direct.json
rename to acceptance/bundle/resources/model_serving_endpoints/update/email-notifications/out.requests.json
diff --git a/acceptance/bundle/resources/model_serving_endpoints/update/email-notifications/out.requests.terraform.json b/acceptance/bundle/resources/model_serving_endpoints/update/email-notifications/out.requests.terraform.json
deleted file mode 100644
index 01f25716268..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/update/email-notifications/out.requests.terraform.json
+++ /dev/null
@@ -1,27 +0,0 @@
-{
-  "method": "POST",
-  "path": "/api/2.0/serving-endpoints",
-  "body": {
-    "config": {
-      "served_entities": [
-        {
-          "external_model": {
-            "name": "gpt-4o-mini",
-            "openai_config": {
-              "openai_api_key": "{{secrets/test-scope/openai-key}}"
-            },
-            "provider": "openai",
-            "task": "llm/v1/chat"
-          },
-          "name": "prod"
-        }
-      ]
-    },
-    "email_notifications": {
-      "on_update_success": [
-        "user1@example.com"
-      ]
-    },
-    "name": "[ENDPOINT_ID]"
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/update/email-notifications/out.test.toml b/acceptance/bundle/resources/model_serving_endpoints/update/email-notifications/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/model_serving_endpoints/update/email-notifications/out.test.toml
+++ b/acceptance/bundle/resources/model_serving_endpoints/update/email-notifications/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/model_serving_endpoints/update/email-notifications/output.txt b/acceptance/bundle/resources/model_serving_endpoints/update/email-notifications/output.txt
index 1bb4647dc00..a8d5f8628be 100644
--- a/acceptance/bundle/resources/model_serving_endpoints/update/email-notifications/output.txt
+++ b/acceptance/bundle/resources/model_serving_endpoints/update/email-notifications/output.txt
@@ -1,9 +1,9 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created model_serving_endpoints.test_endpoint
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] serving-endpoints get [ENDPOINT_ID]
 {
@@ -18,9 +18,9 @@ Deployment complete!
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated model_serving_endpoints.test_endpoint
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
 === There a bug in TF where it does not actually update the email notifications for a serving endpoint.
 >>> print_requests.py //serving-endpoints
@@ -33,5 +33,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/model_serving_endpoints/update/email-notifications/script b/acceptance/bundle/resources/model_serving_endpoints/update/email-notifications/script
index 15b43b4ffda..1219260f85e 100755
--- a/acceptance/bundle/resources/model_serving_endpoints/update/email-notifications/script
+++ b/acceptance/bundle/resources/model_serving_endpoints/update/email-notifications/script
@@ -3,23 +3,23 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm -f out.requests.txt
+    rm -f "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
 trace $CLI bundle deploy
 
 ENDPOINT_ID=$($CLI bundle summary -o json | jq -r '.resources.model_serving_endpoints.test_endpoint.id')
-echo "$ENDPOINT_ID:ENDPOINT_ID" >> ACC_REPLS
+add_repl "$ENDPOINT_ID" ENDPOINT_ID
 trace $CLI serving-endpoints get "${ENDPOINT_ID}" | jq '.email_notifications'
 
 # Update email_notifications - change the email address
 trace update_file.py databricks.yml "user1@example.com" "user2@example.com"
 
-trace $CLI bundle plan -o json > out.plan.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.plan.json
 trace $CLI bundle deploy
 
 title "There a bug in TF where it does not actually update the email notifications for a serving endpoint."
-trace print_requests.py //serving-endpoints > out.requests.$DATABRICKS_BUNDLE_ENGINE.json
+trace print_requests.py //serving-endpoints > out.requests.json
 
-trace $CLI serving-endpoints get "${ENDPOINT_ID}" | jq '.email_notifications' > out.get_email_notifications.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI serving-endpoints get "${ENDPOINT_ID}" | jq '.email_notifications' > out.get_email_notifications.json
diff --git a/acceptance/bundle/resources/model_serving_endpoints/update/tags/out.plan.direct.json b/acceptance/bundle/resources/model_serving_endpoints/update/tags/out.plan.direct.json
deleted file mode 100644
index 75bcde8e90f..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/update/tags/out.plan.direct.json
+++ /dev/null
@@ -1,85 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.model_serving_endpoints.test_endpoint": {
-      "action": "update",
-      "new_state": {
-        "value": {
-          "config": {
-            "served_entities": [
-              {
-                "external_model": {
-                  "name": "gpt-4o-mini",
-                  "openai_config": {
-                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
-                  },
-                  "provider": "openai",
-                  "task": "llm/v1/chat"
-                },
-                "name": "prod"
-              }
-            ]
-          },
-          "name": "[ENDPOINT_ID]",
-          "tags": [
-            {
-              "key": "team",
-              "value": "my-team-two"
-            }
-          ]
-        }
-      },
-      "remote_state": {
-        "endpoint_details": {
-          "config": {
-            "served_entities": [
-              {
-                "external_model": {
-                  "name": "gpt-4o-mini",
-                  "openai_config": {
-                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
-                  },
-                  "provider": "openai",
-                  "task": "llm/v1/chat"
-                },
-                "name": "prod"
-              }
-            ]
-          },
-          "creator": "[USERNAME]",
-          "id": "[UUID]",
-          "name": "[ENDPOINT_ID]",
-          "permission_level": "CAN_MANAGE",
-          "route_optimized": false,
-          "state": {
-            "config_update": "NOT_UPDATING",
-            "ready": "NOT_READY"
-          },
-          "tags": [
-            {
-              "key": "team",
-              "value": "my-team-one"
-            }
-          ]
-        },
-        "endpoint_id": "[UUID]"
-      },
-      "changes": {
-        "route_optimized": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": false
-        },
-        "tags[0].value": {
-          "action": "update",
-          "old": "my-team-one",
-          "new": "my-team-two",
-          "remote": "my-team-one"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/update/tags/out.plan.json b/acceptance/bundle/resources/model_serving_endpoints/update/tags/out.plan.json
new file mode 100644
index 00000000000..f8850241ddf
--- /dev/null
+++ b/acceptance/bundle/resources/model_serving_endpoints/update/tags/out.plan.json
@@ -0,0 +1,148 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.model_serving_endpoints.test_endpoint": {
+      "action": "update",
+      "new_state": {
+        "value": {
+          "config": {
+            "served_entities": [
+              {
+                "external_model": {
+                  "name": "gpt-4o-mini",
+                  "openai_config": {
+                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
+                  },
+                  "provider": "openai",
+                  "task": "llm/v1/chat"
+                },
+                "name": "prod"
+              }
+            ]
+          },
+          "name": "[ENDPOINT_ID]",
+          "tags": [
+            {
+              "key": "team",
+              "value": "my-team-two"
+            }
+          ]
+        }
+      },
+      "remote_state": {
+        "config": {
+          "served_entities": [
+            {
+              "external_model": {
+                "name": "gpt-4o-mini",
+                "openai_config": {
+                  "openai_api_key": "{{secrets/test-scope/openai-key}}"
+                },
+                "provider": "openai",
+                "task": "llm/v1/chat"
+              },
+              "name": "prod"
+            }
+          ],
+          "traffic_config": {
+            "routes": [
+              {
+                "served_entity_name": "prod",
+                "served_model_name": "prod",
+                "traffic_percentage": 100
+              }
+            ]
+          }
+        },
+        "description": "",
+        "endpoint_details": {
+          "config": {
+            "served_entities": [
+              {
+                "external_model": {
+                  "name": "gpt-4o-mini",
+                  "openai_config": {
+                    "openai_api_key": "{{secrets/test-scope/openai-key}}"
+                  },
+                  "provider": "openai",
+                  "task": "llm/v1/chat"
+                },
+                "name": "prod"
+              }
+            ],
+            "traffic_config": {
+              "routes": [
+                {
+                  "served_entity_name": "prod",
+                  "served_model_name": "prod",
+                  "traffic_percentage": 100
+                }
+              ]
+            }
+          },
+          "creation_timestamp": [UNIX_TIME_MILLIS][0],
+          "creator": "[USERNAME]",
+          "description": "",
+          "id": "[UUID]",
+          "last_updated_timestamp": [UNIX_TIME_MILLIS][0],
+          "name": "[ENDPOINT_ID]",
+          "permission_level": "CAN_MANAGE",
+          "route_optimized": false,
+          "state": {
+            "config_update": "NOT_UPDATING",
+            "ready": "NOT_READY"
+          },
+          "tags": [
+            {
+              "key": "team",
+              "value": "my-team-one"
+            }
+          ]
+        },
+        "endpoint_id": "[UUID]",
+        "name": "[ENDPOINT_ID]",
+        "route_optimized": false,
+        "tags": [
+          {
+            "key": "team",
+            "value": "my-team-one"
+          }
+        ]
+      },
+      "changes": {
+        "config.traffic_config": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": {
+            "routes": [
+              {
+                "served_entity_name": "prod",
+                "served_model_name": "prod",
+                "traffic_percentage": 100
+              }
+            ]
+          }
+        },
+        "description": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": ""
+        },
+        "route_optimized": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": false
+        },
+        "tags[0].value": {
+          "action": "update",
+          "old": "my-team-one",
+          "new": "my-team-two",
+          "remote": "my-team-one"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/update/tags/out.plan.terraform.json b/acceptance/bundle/resources/model_serving_endpoints/update/tags/out.plan.terraform.json
deleted file mode 100644
index 0cbd4ed8187..00000000000
--- a/acceptance/bundle/resources/model_serving_endpoints/update/tags/out.plan.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.model_serving_endpoints.test_endpoint": {
-      "action": "update"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/model_serving_endpoints/update/tags/out.test.toml b/acceptance/bundle/resources/model_serving_endpoints/update/tags/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/model_serving_endpoints/update/tags/out.test.toml
+++ b/acceptance/bundle/resources/model_serving_endpoints/update/tags/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/model_serving_endpoints/update/tags/output.txt b/acceptance/bundle/resources/model_serving_endpoints/update/tags/output.txt
index c651dfa5cc4..229d21f09ce 100644
--- a/acceptance/bundle/resources/model_serving_endpoints/update/tags/output.txt
+++ b/acceptance/bundle/resources/model_serving_endpoints/update/tags/output.txt
@@ -1,9 +1,9 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created model_serving_endpoints.test_endpoint
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] serving-endpoints get [ENDPOINT_ID]
 [
@@ -19,9 +19,9 @@ Deployment complete!
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated model_serving_endpoints.test_endpoint
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
 >>> print_requests.py //serving-endpoints
 {
@@ -79,5 +79,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/model_serving_endpoints/update/tags/script b/acceptance/bundle/resources/model_serving_endpoints/update/tags/script
index cb1286e3aaf..62b47ed18e2 100755
--- a/acceptance/bundle/resources/model_serving_endpoints/update/tags/script
+++ b/acceptance/bundle/resources/model_serving_endpoints/update/tags/script
@@ -3,19 +3,19 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm -f out.requests.txt
+    rm -f "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
 trace $CLI bundle deploy
 
 ENDPOINT_ID=$($CLI bundle summary -o json | jq -r '.resources.model_serving_endpoints.test_endpoint.id')
-echo "$ENDPOINT_ID:ENDPOINT_ID" >> ACC_REPLS
+add_repl "$ENDPOINT_ID" ENDPOINT_ID
 trace $CLI serving-endpoints get "${ENDPOINT_ID}" | jq '.tags'
 
 trace update_file.py databricks.yml "value: my-team-one" "value: my-team-two"
 
-trace $CLI bundle plan -o json > out.plan.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.plan.json
 trace $CLI bundle deploy
 
 trace print_requests.py //serving-endpoints
diff --git a/acceptance/bundle/resources/model_serving_endpoints/update/test.toml b/acceptance/bundle/resources/model_serving_endpoints/update/test.toml
index 3aa4a190502..8488476b7a3 100644
--- a/acceptance/bundle/resources/model_serving_endpoints/update/test.toml
+++ b/acceptance/bundle/resources/model_serving_endpoints/update/test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
 RecordRequests = true
 
diff --git a/acceptance/bundle/resources/models/basic/out.plan_update_tag.direct.txt b/acceptance/bundle/resources/models/basic/out.plan_update_tag.direct.txt
deleted file mode 100644
index c54c9d511c0..00000000000
--- a/acceptance/bundle/resources/models/basic/out.plan_update_tag.direct.txt
+++ /dev/null
@@ -1 +0,0 @@
-Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
diff --git a/acceptance/bundle/resources/models/basic/out.plan_update_tag.terraform.txt b/acceptance/bundle/resources/models/basic/out.plan_update_tag.terraform.txt
deleted file mode 100644
index 2949936e687..00000000000
--- a/acceptance/bundle/resources/models/basic/out.plan_update_tag.terraform.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-update models.my_model
-
-Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
diff --git a/acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.plan.terraform.txt b/acceptance/bundle/resources/models/basic/out.plan_update_tag.txt
similarity index 100%
rename from acceptance/bundle/resources/dashboards/unpublish-out-of-band/out.plan.terraform.txt
rename to acceptance/bundle/resources/models/basic/out.plan_update_tag.txt
diff --git a/acceptance/bundle/resources/models/basic/out.test.toml b/acceptance/bundle/resources/models/basic/out.test.toml
index 5ad0addb75e..98ccab9aaeb 100644
--- a/acceptance/bundle/resources/models/basic/out.test.toml
+++ b/acceptance/bundle/resources/models/basic/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 RunsOnDbr = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/models/basic/output.txt b/acceptance/bundle/resources/models/basic/output.txt
index 929a8a4cdfb..6727e0d9d9e 100644
--- a/acceptance/bundle/resources/models/basic/output.txt
+++ b/acceptance/bundle/resources/models/basic/output.txt
@@ -9,11 +9,7 @@ create models.my_model
 
 Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
 
->>> [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-models-basic-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+>>> [CLI] bundle deploy -qq
 
 >>> [CLI] model-registry get-model original-name-[UNIQUE_NAME]
 {
@@ -35,11 +31,7 @@ update models.my_model
 
 Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
 
->>> [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-models-basic-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+>>> [CLI] bundle deploy -qq
 
 >>> [CLI] model-registry get-model original-name-[UNIQUE_NAME]
 {
@@ -61,11 +53,7 @@ recreate models.my_model
 
 Plan: 1 to add, 0 to change, 1 to delete, 0 unchanged
 
->>> [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-models-basic-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+>>> [CLI] bundle deploy -qq
 
 >>> [CLI] model-registry get-model new-name-[UNIQUE_NAME]
 {
@@ -82,11 +70,7 @@ Deployment complete!
 === add a new tag, this should be a no-op; terraform does make an update request but since update request has no tags in it, it does nothing; direct skips request completely
 >>> [CLI] bundle plan
 
->>> [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-models-basic-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+>>> [CLI] bundle deploy -qq
 
 >>> [CLI] model-registry get-model new-name-[UNIQUE_NAME]
 {
@@ -106,5 +90,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-models-basic-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/models/basic/script b/acceptance/bundle/resources/models/basic/script
index 175f546340a..3752a9c2715 100644
--- a/acceptance/bundle/resources/models/basic/script
+++ b/acceptance/bundle/resources/models/basic/script
@@ -8,25 +8,25 @@ trace export MODEL_DESCRIPTION=original-description-$UNIQUE_NAME
 envsubst < templates/one_tag.tmpl > databricks.yml
 title "create a model"
 trace $CLI bundle plan
-trace $CLI bundle deploy
+trace $CLI bundle deploy -qq
 trace $CLI model-registry get-model $MODEL_NAME | jq '.registered_model_databricks | {name, description, tags}'
 
 trace export MODEL_DESCRIPTION=new-description-$UNIQUE_NAME
 envsubst < templates/one_tag.tmpl > databricks.yml
 title "update the description, this should update the description remotely as well"
 trace $CLI bundle plan
-trace $CLI bundle deploy
+trace $CLI bundle deploy -qq
 trace $CLI model-registry get-model $MODEL_NAME | jq '.registered_model_databricks | {name, description, tags}'
 
 trace export MODEL_NAME=new-name-$UNIQUE_NAME
 envsubst < templates/one_tag.tmpl > databricks.yml
 title "update the name, this should recreate the model with the new name"
 trace $CLI bundle plan
-trace $CLI bundle deploy
+trace $CLI bundle deploy -qq
 trace $CLI model-registry get-model $MODEL_NAME | jq '.registered_model_databricks | {name, description, tags}'
 
 title "add a new tag, this should be a no-op; terraform does make an update request but since update request has no tags in it, it does nothing; direct skips request completely"
 envsubst < templates/two_tag.tmpl > databricks.yml
-trace $CLI bundle plan > out.plan_update_tag.$DATABRICKS_BUNDLE_ENGINE.txt
-trace $CLI bundle deploy
+trace $CLI bundle plan > out.plan_update_tag.txt
+trace $CLI bundle deploy -qq
 trace $CLI model-registry get-model $MODEL_NAME | jq '.registered_model_databricks | {name, description, tags}'
diff --git a/acceptance/bundle/resources/models/basic/test.toml b/acceptance/bundle/resources/models/basic/test.toml
index 3ce090441c1..7d7ae48db25 100644
--- a/acceptance/bundle/resources/models/basic/test.toml
+++ b/acceptance/bundle/resources/models/basic/test.toml
@@ -1,4 +1,3 @@
 Cloud = true
-Local = true
 RecordRequests = false
 RunsOnDbr = true
diff --git a/acceptance/bundle/resources/models/empty-name/databricks.yml.tmpl b/acceptance/bundle/resources/models/empty-name/databricks.yml.tmpl
new file mode 100644
index 00000000000..a5fd377721f
--- /dev/null
+++ b/acceptance/bundle/resources/models/empty-name/databricks.yml.tmpl
@@ -0,0 +1,7 @@
+bundle:
+  name: model-empty-name-$UNIQUE_NAME
+
+resources:
+  models:
+    mymodel:
+      name: ""
diff --git a/acceptance/bundle/resources/models/empty-name/out.deploy.txt b/acceptance/bundle/resources/models/empty-name/out.deploy.txt
new file mode 100644
index 00000000000..c0048635a5c
--- /dev/null
+++ b/acceptance/bundle/resources/models/empty-name/out.deploy.txt
@@ -0,0 +1,11 @@
+
+>>> musterr [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/model-empty-name-[UNIQUE_NAME]/default/files...
+Error: cannot create resources.models.mymodel: Got an invalid name ''. Registered Model names cannot be empty strings. (400 INVALID_PARAMETER_VALUE)
+
+Endpoint: POST [DATABRICKS_URL]/api/2.0/mlflow/registered-models/create
+HTTP Status: 400 Bad Request
+API error_code: INVALID_PARAMETER_VALUE
+API message: Got an invalid name ''. Registered Model names cannot be empty strings.
+
+Files: 3 uploaded, 0 deleted
diff --git a/acceptance/bundle/resources/models/empty-name/out.test.toml b/acceptance/bundle/resources/models/empty-name/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/models/empty-name/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/selftest/subset_ancestor_engine/child/output.txt b/acceptance/bundle/resources/models/empty-name/output.txt
similarity index 100%
rename from acceptance/selftest/subset_ancestor_engine/child/output.txt
rename to acceptance/bundle/resources/models/empty-name/output.txt
diff --git a/acceptance/bundle/resources/models/empty-name/script b/acceptance/bundle/resources/models/empty-name/script
new file mode 100644
index 00000000000..aae85b29c38
--- /dev/null
+++ b/acceptance/bundle/resources/models/empty-name/script
@@ -0,0 +1,7 @@
+# The deploy fails only after the files are uploaded, so $UNIQUE_NAME in the bundle
+# name keeps concurrent cloud legs apart and lets the sweeper find what is left.
+envsubst < databricks.yml.tmpl > databricks.yml
+
+# Both engines reach the create call, but terraform wraps the message in its own
+# output, so the goldens are per-engine.
+trace musterr $CLI bundle deploy &> out.deploy.txt
diff --git a/acceptance/bundle/resources/models/empty-name/test.toml b/acceptance/bundle/resources/models/empty-name/test.toml
new file mode 100644
index 00000000000..64c48c920e6
--- /dev/null
+++ b/acceptance/bundle/resources/models/empty-name/test.toml
@@ -0,0 +1,4 @@
+# The golden asserts MLflow's message verbatim, so run on cloud to catch it drifting.
+Cloud = true
+RecordRequests = false
+Ignore = [".databricks"]
diff --git a/acceptance/bundle/resources/models/readplan-permissions/databricks.yml b/acceptance/bundle/resources/models/readplan-permissions/databricks.yml
new file mode 100644
index 00000000000..1d4e2f53e6a
--- /dev/null
+++ b/acceptance/bundle/resources/models/readplan-permissions/databricks.yml
@@ -0,0 +1,13 @@
+bundle:
+  name: test-bundle
+
+resources:
+  models:
+    mymodel:
+      name: test-model
+      description: initial # TO_REMOVE
+      permissions:
+        - level: CAN_READ
+          user_name: viewer@example.com
+        - level: CAN_MANAGE # TO_REMOVE
+          user_name: manager@example.test # TO_REMOVE
diff --git a/acceptance/bundle/resources/models/readplan-permissions/out.test.toml b/acceptance/bundle/resources/models/readplan-permissions/out.test.toml
new file mode 100644
index 00000000000..f7fafbcc731
--- /dev/null
+++ b/acceptance/bundle/resources/models/readplan-permissions/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/resources/models/readplan-permissions/output.txt b/acceptance/bundle/resources/models/readplan-permissions/output.txt
new file mode 100644
index 00000000000..a4e059b61a7
--- /dev/null
+++ b/acceptance/bundle/resources/models/readplan-permissions/output.txt
@@ -0,0 +1,62 @@
+
+=== Initial deploy: model created with permissions
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created models.mymodel
+Created models.mymodel.permissions
+Files: 1 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //permissions/registered-models
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/registered-models/[MODEL_ID]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "CAN_READ",
+        "user_name": "viewer@example.com"
+      },
+      {
+        "permission_level": "CAN_MANAGE",
+        "user_name": "manager@example.test"
+      },
+      {
+        "permission_level": "CAN_MANAGE",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
+
+=== Remove manager permission and description, deploy from planUploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Updated models.mymodel
+Updated models.mymodel.permissions
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 2 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //permissions/registered-models
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/registered-models/[MODEL_ID]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "CAN_READ",
+        "user_name": "viewer@example.com"
+      },
+      {
+        "permission_level": "CAN_MANAGE",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.models.mymodel
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/models/readplan-permissions/script b/acceptance/bundle/resources/models/readplan-permissions/script
new file mode 100644
index 00000000000..a7a2d16db97
--- /dev/null
+++ b/acceptance/bundle/resources/models/readplan-permissions/script
@@ -0,0 +1,23 @@
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+register_model_id() {
+    # Register the model's numeric ID so it appears as [MODEL_ID] in output
+    MODEL_ID=$($CLI model-registry get-model test-model | jq -r '.registered_model_databricks.id')
+    add_repl "$MODEL_ID" "MODEL_ID"
+}
+
+title "Initial deploy: model created with permissions"
+trace $CLI bundle deploy
+register_model_id
+trace print_requests.py //permissions/registered-models
+
+title "Remove manager permission and description, deploy from plan"
+grep -v TO_REMOVE databricks.yml > updated.yml && mv updated.yml databricks.yml
+$CLI bundle plan -o json > tmp.plan.json
+$CLI bundle deploy $(readplanarg tmp.plan.json)
+register_model_id
+trace print_requests.py //permissions/registered-models
diff --git a/acceptance/bundle/resources/models/readplan-permissions/test.toml b/acceptance/bundle/resources/models/readplan-permissions/test.toml
new file mode 100644
index 00000000000..454cb9038c2
--- /dev/null
+++ b/acceptance/bundle/resources/models/readplan-permissions/test.toml
@@ -0,0 +1,4 @@
+Cloud = false
+Ignore = [".databricks", "tmp.plan.json"]
+
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/resources/permissions/_script b/acceptance/bundle/resources/permissions/_script
index 90e6596c9a3..f388d49d4ed 100644
--- a/acceptance/bundle/resources/permissions/_script
+++ b/acceptance/bundle/resources/permissions/_script
@@ -1,16 +1,17 @@
-trace $CLI bundle validate -o json | jq .resources.$RESOURCE.foo.permissions
-rm out.requests.txt
+trace $CLI bundle validate -o json | nostamp.py | jq .resources.$RESOURCE.foo.permissions
+rm "$OUT_REQUESTS"
 
-$CLI bundle plan -o json > out.plan.$DATABRICKS_BUNDLE_ENGINE.json
+$CLI bundle plan -o json | nostamp.py > out.plan.json
 
 print_requests() {
-    jq -c < out.requests.txt | jq 'select(.method != "GET" and (.path | contains("permissions")))'
-    rm out.requests.txt
+    jq -c < "$OUT_REQUESTS" | jq 'select(.method != "GET" and (.path | contains("permissions")) and (.path | contains("/api/2.0/bundle") | not))'
+    rm "$OUT_REQUESTS"
 }
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
 trace $CLI bundle deploy
-print_requests > out.requests.deploy.$DATABRICKS_BUNDLE_ENGINE.json
+print_requests > out.requests.deploy.json
+replace_ids.py
 
 trace $CLI bundle destroy --auto-approve
-print_requests > out.requests.destroy.$DATABRICKS_BUNDLE_ENGINE.json
+print_requests > out.requests.destroy.json
diff --git a/acceptance/bundle/resources/permissions/analyze_requests.py b/acceptance/bundle/resources/permissions/analyze_requests.py
deleted file mode 100755
index 185b22df4f3..00000000000
--- a/acceptance/bundle/resources/permissions/analyze_requests.py
+++ /dev/null
@@ -1,133 +0,0 @@
-#!/usr/bin/env python3
-"""
-Analyze all requests recorded in subtests to highlight differences between direct and terraform.
-"""
-
-import json
-import re
-import sys
-import tomllib
-from pathlib import Path
-from difflib import unified_diff
-
-
-def read_json_many(file):
-    with open(file) as fobj:
-        s = fobj.read()
-
-    # fix invalid json due to replacement: x: [NUMID]  -->  x: "[NUMID]"
-    s = re.sub(r": \[(.*?)\]", r': "[\1]"', s)
-
-    result = []
-
-    try:
-        dec = json.JSONDecoder()
-        pos = 0
-        n = len(s)
-        while True:
-            # skip whitespace between objects
-            while pos < n and s[pos].isspace():
-                pos += 1
-            if pos >= n:
-                break
-            obj, idx = dec.raw_decode(s, pos)
-            result.append(obj)
-            pos = idx
-
-    except Exception as ex:
-        sys.exit(f"Failed to parse {file}: {ex}")
-
-    return result
-
-
-def normalize_acls(data):
-    """Recursively normalize ACLs in the data structure by sorting them."""
-    if isinstance(data, dict):
-        result = {}
-        for key, value in data.items():
-            if key == "access_control_list" and isinstance(value, list):
-                # Sort ACLs by all fields to normalize order
-                result[key] = sorted(value, key=lambda x: json.dumps(x, sort_keys=True))
-            else:
-                result[key] = normalize_acls(value)
-        return result
-    elif isinstance(data, list):
-        return [normalize_acls(item) for item in data]
-    else:
-        return data
-
-
-def compare_files(file1, file2):
-    """Compare two JSON files and return comparison result."""
-    data1 = read_json_many(file1)
-    data2 = read_json_many(file2)
-
-    if data1 == data2:
-        return "EXACT", ""
-
-    normalized1 = normalize_acls(data1)
-    normalized2 = normalize_acls(data2)
-
-    if normalized1 == normalized2:
-        return "MATCH", ""
-
-    json1_str = json.dumps(normalized1, indent=2, sort_keys=True)
-    json2_str = json.dumps(normalized2, indent=2, sort_keys=True)
-
-    diff_lines = list(
-        unified_diff(
-            json1_str.splitlines(keepends=True),
-            json2_str.splitlines(keepends=True),
-            fromfile=str(file1),
-            tofile=str(file2),
-            n=3,
-        )
-    )
-
-    return "DIFF ", "\n" + to_slash("".join(diff_lines).rstrip())
-
-
-def to_slash(x):
-    return str(x).replace("\\", "/")
-
-
-def load_supported_engines(path):
-    current = path
-    while True:
-        for name in ("out.test.toml", "test.toml"):
-            config_file = current / name
-            if config_file.exists():
-                with config_file.open("rb") as fobj:
-                    config = tomllib.load(fobj)
-                return set(config.get("EnvMatrix", {}).get("DATABRICKS_BUNDLE_ENGINE", []))
-        if current == Path("."):
-            return set()
-        current = current.parent
-
-
-def main():
-    current_dir = Path(".")
-
-    direct_files = list(current_dir.glob("**/*.direct.json"))
-
-    for direct_file in sorted(direct_files):
-        if direct_file.name.startswith("out.plan"):
-            # expected difference
-            continue
-
-        terraform_file = direct_file.parent / direct_file.name.replace(".direct.", ".terraform.")
-
-        fname = to_slash(direct_file)
-        supported_engines = load_supported_engines(direct_file.parent)
-
-        if terraform_file.exists():
-            result, diff = compare_files(direct_file, terraform_file)
-            print(result + " " + fname + diff)
-        elif "terraform" not in supported_engines:
-            print(f"DIRECT_ONLY {fname}")
-        else:
-            print(f"ERROR {fname}: Missing terraform file {to_slash(terraform_file)}")
-
-
-if __name__ == "__main__":
-    main()
diff --git a/acceptance/bundle/resources/permissions/apps/current_can_manage/out.plan.direct.json b/acceptance/bundle/resources/permissions/apps/current_can_manage/out.plan.direct.json
deleted file mode 100644
index 40c12a2c546..00000000000
--- a/acceptance/bundle/resources/permissions/apps/current_can_manage/out.plan.direct.json
+++ /dev/null
@@ -1,51 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.apps.foo": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "description": "",
-          "name": "foo",
-          "source_code_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files"
-        }
-      }
-    },
-    "resources.apps.foo.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.apps.foo",
-          "label": "${resources.apps.foo.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "CAN_USE",
-              "user_name": "viewer@example.com"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "group_name": "data-team"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "service_principal_name": "[UUID]"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/apps/${resources.apps.foo.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/apps/current_can_manage/out.plan.json b/acceptance/bundle/resources/permissions/apps/current_can_manage/out.plan.json
new file mode 100644
index 00000000000..d7f485235ca
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/apps/current_can_manage/out.plan.json
@@ -0,0 +1,51 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.apps.[FOO_ID]": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "description": "",
+          "name": "[FOO_ID]",
+          "source_code_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files"
+        }
+      }
+    },
+    "resources.apps.[FOO_ID].permissions": {
+      "depends_on": [
+        {
+          "node": "resources.apps.[FOO_ID]",
+          "label": "${resources.apps.[FOO_ID].id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "CAN_USE",
+              "user_name": "viewer@example.com"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "group_name": "data-team"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "service_principal_name": "[UUID]"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/apps/${resources.apps.[FOO_ID].id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/apps/current_can_manage/out.plan.terraform.json b/acceptance/bundle/resources/permissions/apps/current_can_manage/out.plan.terraform.json
deleted file mode 100644
index f7a928a418b..00000000000
--- a/acceptance/bundle/resources/permissions/apps/current_can_manage/out.plan.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.apps.foo": {
-      "action": "create"
-    },
-    "resources.apps.foo.permissions": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/apps/current_can_manage/out.requests.deploy.direct.json b/acceptance/bundle/resources/permissions/apps/current_can_manage/out.requests.deploy.direct.json
deleted file mode 100644
index 831cda2417a..00000000000
--- a/acceptance/bundle/resources/permissions/apps/current_can_manage/out.requests.deploy.direct.json
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/apps/foo",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_USE",
-        "user_name": "viewer@example.com"
-      },
-      {
-        "group_name": "data-team",
-        "permission_level": "CAN_MANAGE"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "service_principal_name": "[UUID]"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/apps/current_can_manage/out.requests.deploy.json b/acceptance/bundle/resources/permissions/apps/current_can_manage/out.requests.deploy.json
new file mode 100644
index 00000000000..5e322e3e472
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/apps/current_can_manage/out.requests.deploy.json
@@ -0,0 +1,24 @@
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/apps/[FOO_ID]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "CAN_USE",
+        "user_name": "viewer@example.com"
+      },
+      {
+        "group_name": "data-team",
+        "permission_level": "CAN_MANAGE"
+      },
+      {
+        "permission_level": "CAN_MANAGE",
+        "service_principal_name": "[UUID]"
+      },
+      {
+        "permission_level": "CAN_MANAGE",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/apps/current_can_manage/out.requests.deploy.terraform.json b/acceptance/bundle/resources/permissions/apps/current_can_manage/out.requests.deploy.terraform.json
deleted file mode 100644
index d8596961bb9..00000000000
--- a/acceptance/bundle/resources/permissions/apps/current_can_manage/out.requests.deploy.terraform.json
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/apps/foo",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_USE",
-        "user_name": "viewer@example.com"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "service_principal_name": "[UUID]"
-      },
-      {
-        "group_name": "data-team",
-        "permission_level": "CAN_MANAGE"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/current_can_manage/out.requests.destroy.direct.json b/acceptance/bundle/resources/permissions/apps/current_can_manage/out.requests.destroy.json
similarity index 100%
rename from acceptance/bundle/resources/permissions/jobs/current_can_manage/out.requests.destroy.direct.json
rename to acceptance/bundle/resources/permissions/apps/current_can_manage/out.requests.destroy.json
diff --git a/acceptance/bundle/resources/permissions/apps/current_can_manage/out.requests.destroy.terraform.json b/acceptance/bundle/resources/permissions/apps/current_can_manage/out.requests.destroy.terraform.json
deleted file mode 100644
index 93342c3b91e..00000000000
--- a/acceptance/bundle/resources/permissions/apps/current_can_manage/out.requests.destroy.terraform.json
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/apps/foo",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_MANAGE",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/apps/current_can_manage/out.test.toml b/acceptance/bundle/resources/permissions/apps/current_can_manage/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/permissions/apps/current_can_manage/out.test.toml
+++ b/acceptance/bundle/resources/permissions/apps/current_can_manage/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/permissions/apps/current_can_manage/output.txt b/acceptance/bundle/resources/permissions/apps/current_can_manage/output.txt
index bb226ca3f90..331a775ed9b 100644
--- a/acceptance/bundle/resources/permissions/apps/current_can_manage/output.txt
+++ b/acceptance/bundle/resources/permissions/apps/current_can_manage/output.txt
@@ -21,15 +21,15 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created apps.[FOO_ID]
+Created apps.[FOO_ID].permissions
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
-  delete resources.apps.foo
+  delete resources.apps.[FOO_ID]
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/permissions/apps/other_can_manage/out.plan.direct.json b/acceptance/bundle/resources/permissions/apps/other_can_manage/out.plan.direct.json
deleted file mode 100644
index 40c12a2c546..00000000000
--- a/acceptance/bundle/resources/permissions/apps/other_can_manage/out.plan.direct.json
+++ /dev/null
@@ -1,51 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.apps.foo": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "description": "",
-          "name": "foo",
-          "source_code_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files"
-        }
-      }
-    },
-    "resources.apps.foo.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.apps.foo",
-          "label": "${resources.apps.foo.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "CAN_USE",
-              "user_name": "viewer@example.com"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "group_name": "data-team"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "service_principal_name": "[UUID]"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/apps/${resources.apps.foo.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/apps/other_can_manage/out.plan.json b/acceptance/bundle/resources/permissions/apps/other_can_manage/out.plan.json
new file mode 100644
index 00000000000..d7f485235ca
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/apps/other_can_manage/out.plan.json
@@ -0,0 +1,51 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.apps.[FOO_ID]": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "description": "",
+          "name": "[FOO_ID]",
+          "source_code_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files"
+        }
+      }
+    },
+    "resources.apps.[FOO_ID].permissions": {
+      "depends_on": [
+        {
+          "node": "resources.apps.[FOO_ID]",
+          "label": "${resources.apps.[FOO_ID].id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "CAN_USE",
+              "user_name": "viewer@example.com"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "group_name": "data-team"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "service_principal_name": "[UUID]"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/apps/${resources.apps.[FOO_ID].id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/apps/other_can_manage/out.plan.terraform.json b/acceptance/bundle/resources/permissions/apps/other_can_manage/out.plan.terraform.json
deleted file mode 100644
index f7a928a418b..00000000000
--- a/acceptance/bundle/resources/permissions/apps/other_can_manage/out.plan.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.apps.foo": {
-      "action": "create"
-    },
-    "resources.apps.foo.permissions": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/apps/other_can_manage/out.requests.deploy.direct.json b/acceptance/bundle/resources/permissions/apps/other_can_manage/out.requests.deploy.direct.json
deleted file mode 100644
index 831cda2417a..00000000000
--- a/acceptance/bundle/resources/permissions/apps/other_can_manage/out.requests.deploy.direct.json
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/apps/foo",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_USE",
-        "user_name": "viewer@example.com"
-      },
-      {
-        "group_name": "data-team",
-        "permission_level": "CAN_MANAGE"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "service_principal_name": "[UUID]"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/apps/other_can_manage/out.requests.deploy.json b/acceptance/bundle/resources/permissions/apps/other_can_manage/out.requests.deploy.json
new file mode 100644
index 00000000000..5e322e3e472
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/apps/other_can_manage/out.requests.deploy.json
@@ -0,0 +1,24 @@
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/apps/[FOO_ID]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "CAN_USE",
+        "user_name": "viewer@example.com"
+      },
+      {
+        "group_name": "data-team",
+        "permission_level": "CAN_MANAGE"
+      },
+      {
+        "permission_level": "CAN_MANAGE",
+        "service_principal_name": "[UUID]"
+      },
+      {
+        "permission_level": "CAN_MANAGE",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/apps/other_can_manage/out.requests.deploy.terraform.json b/acceptance/bundle/resources/permissions/apps/other_can_manage/out.requests.deploy.terraform.json
deleted file mode 100644
index d8596961bb9..00000000000
--- a/acceptance/bundle/resources/permissions/apps/other_can_manage/out.requests.deploy.terraform.json
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/apps/foo",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_USE",
-        "user_name": "viewer@example.com"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "service_principal_name": "[UUID]"
-      },
-      {
-        "group_name": "data-team",
-        "permission_level": "CAN_MANAGE"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/current_is_owner/out.requests.destroy.direct.json b/acceptance/bundle/resources/permissions/apps/other_can_manage/out.requests.destroy.json
similarity index 100%
rename from acceptance/bundle/resources/permissions/jobs/current_is_owner/out.requests.destroy.direct.json
rename to acceptance/bundle/resources/permissions/apps/other_can_manage/out.requests.destroy.json
diff --git a/acceptance/bundle/resources/permissions/apps/other_can_manage/out.requests.destroy.terraform.json b/acceptance/bundle/resources/permissions/apps/other_can_manage/out.requests.destroy.terraform.json
deleted file mode 100644
index 93342c3b91e..00000000000
--- a/acceptance/bundle/resources/permissions/apps/other_can_manage/out.requests.destroy.terraform.json
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/apps/foo",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_MANAGE",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/apps/other_can_manage/out.test.toml b/acceptance/bundle/resources/permissions/apps/other_can_manage/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/permissions/apps/other_can_manage/out.test.toml
+++ b/acceptance/bundle/resources/permissions/apps/other_can_manage/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/permissions/apps/other_can_manage/output.txt b/acceptance/bundle/resources/permissions/apps/other_can_manage/output.txt
index bb226ca3f90..331a775ed9b 100644
--- a/acceptance/bundle/resources/permissions/apps/other_can_manage/output.txt
+++ b/acceptance/bundle/resources/permissions/apps/other_can_manage/output.txt
@@ -21,15 +21,15 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created apps.[FOO_ID]
+Created apps.[FOO_ID].permissions
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
-  delete resources.apps.foo
+  delete resources.apps.[FOO_ID]
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/permissions/clusters/current_can_manage/out.plan.direct.json b/acceptance/bundle/resources/permissions/clusters/current_can_manage/out.plan.direct.json
deleted file mode 100644
index 8f449f24bde..00000000000
--- a/acceptance/bundle/resources/permissions/clusters/current_can_manage/out.plan.direct.json
+++ /dev/null
@@ -1,53 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.clusters.foo": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "autotermination_minutes": 60,
-          "cluster_name": "test-cluster",
-          "node_type_id": "[NODE_TYPE_ID]",
-          "num_workers": 1,
-          "spark_version": "15.4.x-scala2.12"
-        }
-      }
-    },
-    "resources.clusters.foo.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.clusters.foo",
-          "label": "${resources.clusters.foo.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "CAN_ATTACH_TO",
-              "user_name": "viewer@example.com"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "group_name": "data-team"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "service_principal_name": "[UUID]"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/clusters/${resources.clusters.foo.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/clusters/current_can_manage/out.plan.json b/acceptance/bundle/resources/permissions/clusters/current_can_manage/out.plan.json
new file mode 100644
index 00000000000..165cce27206
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/clusters/current_can_manage/out.plan.json
@@ -0,0 +1,53 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.clusters.foo": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "autotermination_minutes": 60,
+          "cluster_name": "test-cluster",
+          "node_type_id": "[NODE_TYPE_ID]",
+          "num_workers": 1,
+          "spark_version": "15.4.x-scala2.12"
+        }
+      }
+    },
+    "resources.clusters.foo.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.clusters.foo",
+          "label": "${resources.clusters.foo.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "CAN_ATTACH_TO",
+              "user_name": "viewer@example.com"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "group_name": "data-team"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "service_principal_name": "[UUID]"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/clusters/${resources.clusters.foo.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/clusters/current_can_manage/out.plan.terraform.json b/acceptance/bundle/resources/permissions/clusters/current_can_manage/out.plan.terraform.json
deleted file mode 100644
index 2c3f436c3aa..00000000000
--- a/acceptance/bundle/resources/permissions/clusters/current_can_manage/out.plan.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.clusters.foo": {
-      "action": "create"
-    },
-    "resources.clusters.foo.permissions": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/clusters/current_can_manage/out.requests.deploy.direct.json b/acceptance/bundle/resources/permissions/clusters/current_can_manage/out.requests.deploy.direct.json
deleted file mode 100644
index 63cadc29463..00000000000
--- a/acceptance/bundle/resources/permissions/clusters/current_can_manage/out.requests.deploy.direct.json
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/clusters/[UUID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_ATTACH_TO",
-        "user_name": "viewer@example.com"
-      },
-      {
-        "group_name": "data-team",
-        "permission_level": "CAN_MANAGE"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "service_principal_name": "[UUID]"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/clusters/current_can_manage/out.requests.deploy.json b/acceptance/bundle/resources/permissions/clusters/current_can_manage/out.requests.deploy.json
new file mode 100644
index 00000000000..911f898ded8
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/clusters/current_can_manage/out.requests.deploy.json
@@ -0,0 +1,24 @@
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/clusters/[FOO_ID]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "CAN_ATTACH_TO",
+        "user_name": "viewer@example.com"
+      },
+      {
+        "group_name": "data-team",
+        "permission_level": "CAN_MANAGE"
+      },
+      {
+        "permission_level": "CAN_MANAGE",
+        "service_principal_name": "[UUID]"
+      },
+      {
+        "permission_level": "CAN_MANAGE",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/clusters/current_can_manage/out.requests.deploy.terraform.json b/acceptance/bundle/resources/permissions/clusters/current_can_manage/out.requests.deploy.terraform.json
deleted file mode 100644
index 0dcab25d2fc..00000000000
--- a/acceptance/bundle/resources/permissions/clusters/current_can_manage/out.requests.deploy.terraform.json
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/clusters/[UUID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_MANAGE",
-        "service_principal_name": "[UUID]"
-      },
-      {
-        "group_name": "data-team",
-        "permission_level": "CAN_MANAGE"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "user_name": "[USERNAME]"
-      },
-      {
-        "permission_level": "CAN_ATTACH_TO",
-        "user_name": "viewer@example.com"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/empty_list/out.requests.deploy.direct.json b/acceptance/bundle/resources/permissions/clusters/current_can_manage/out.requests.destroy.json
similarity index 100%
rename from acceptance/bundle/resources/permissions/jobs/empty_list/out.requests.deploy.direct.json
rename to acceptance/bundle/resources/permissions/clusters/current_can_manage/out.requests.destroy.json
diff --git a/acceptance/bundle/resources/permissions/clusters/current_can_manage/out.requests.destroy.terraform.json b/acceptance/bundle/resources/permissions/clusters/current_can_manage/out.requests.destroy.terraform.json
deleted file mode 100644
index ef3b016e1d9..00000000000
--- a/acceptance/bundle/resources/permissions/clusters/current_can_manage/out.requests.destroy.terraform.json
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/clusters/[UUID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_MANAGE",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/clusters/current_can_manage/out.test.toml b/acceptance/bundle/resources/permissions/clusters/current_can_manage/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/permissions/clusters/current_can_manage/out.test.toml
+++ b/acceptance/bundle/resources/permissions/clusters/current_can_manage/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/permissions/clusters/current_can_manage/output.txt b/acceptance/bundle/resources/permissions/clusters/current_can_manage/output.txt
index 09a0645407b..095b730a976 100644
--- a/acceptance/bundle/resources/permissions/clusters/current_can_manage/output.txt
+++ b/acceptance/bundle/resources/permissions/clusters/current_can_manage/output.txt
@@ -21,9 +21,10 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created clusters.foo
+Created clusters.foo.permissions
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
@@ -31,5 +32,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/permissions/clusters/target/out.requests.direct.json b/acceptance/bundle/resources/permissions/clusters/target/out.requests.json
similarity index 100%
rename from acceptance/bundle/resources/permissions/clusters/target/out.requests.direct.json
rename to acceptance/bundle/resources/permissions/clusters/target/out.requests.json
diff --git a/acceptance/bundle/resources/permissions/clusters/target/out.requests.terraform.json b/acceptance/bundle/resources/permissions/clusters/target/out.requests.terraform.json
deleted file mode 100644
index 776f05d2710..00000000000
--- a/acceptance/bundle/resources/permissions/clusters/target/out.requests.terraform.json
+++ /dev/null
@@ -1,38 +0,0 @@
-{
-  "method": "POST",
-  "path": "/api/2.1/clusters/create",
-  "body": {
-    "autotermination_minutes": 60,
-    "cluster_name": "[dev [USERNAME]] test-cluster",
-    "custom_tags": {
-      "dev": "[USERNAME]"
-    },
-    "node_type_id": "[NODE_TYPE_ID]",
-    "num_workers": 1,
-    "spark_version": "15.4.x-scala2.12"
-  }
-}
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/clusters/[UUID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_MANAGE",
-        "service_principal_name": "[UUID]"
-      },
-      {
-        "permission_level": "CAN_ATTACH_TO",
-        "service_principal_name": "[UUID]"
-      },
-      {
-        "permission_level": "CAN_RESTART",
-        "service_principal_name": "[UUID]"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/clusters/target/out.test.toml b/acceptance/bundle/resources/permissions/clusters/target/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/permissions/clusters/target/out.test.toml
+++ b/acceptance/bundle/resources/permissions/clusters/target/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/permissions/clusters/target/output.txt b/acceptance/bundle/resources/permissions/clusters/target/output.txt
index 66a79a8d830..37ff60bd025 100644
--- a/acceptance/bundle/resources/permissions/clusters/target/output.txt
+++ b/acceptance/bundle/resources/permissions/clusters/target/output.txt
@@ -59,8 +59,9 @@ See https://docs.databricks.com/dev-tools/bundles/permissions.html to learn more
   in databricks.yml:9:7
 
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/dev/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created clusters.cluster1
+Created clusters.cluster1.permissions
+Files: 1 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> print_requests.py //clusters
diff --git a/acceptance/bundle/resources/permissions/clusters/target/script b/acceptance/bundle/resources/permissions/clusters/target/script
index fbc59d852aa..821436b578a 100644
--- a/acceptance/bundle/resources/permissions/clusters/target/script
+++ b/acceptance/bundle/resources/permissions/clusters/target/script
@@ -1,3 +1,3 @@
 trace $CLI bundle validate -o json | jq .resources
 trace $CLI bundle deploy
-trace print_requests.py //clusters > out.requests.$DATABRICKS_BUNDLE_ENGINE.json
+trace print_requests.py //clusters > out.requests.json
diff --git a/acceptance/bundle/resources/permissions/dashboards/create/out.plan.direct.json b/acceptance/bundle/resources/permissions/dashboards/create/out.plan.direct.json
deleted file mode 100644
index 0fa7dd72385..00000000000
--- a/acceptance/bundle/resources/permissions/dashboards/create/out.plan.direct.json
+++ /dev/null
@@ -1,46 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.dashboards.foo": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "display_name": "test-dashboard-[UNIQUE_NAME]",
-          "embed_credentials": false,
-          "parent_path": "/Workspace/Users/[USERNAME]/folder1",
-          "published": true,
-          "serialized_dashboard": "{\"pages\":[{\"name\":\"page1\",\"displayName\":\"Page 1\"}]}",
-          "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
-        }
-      }
-    },
-    "resources.dashboards.foo.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.dashboards.foo",
-          "label": "${resources.dashboards.foo.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "CAN_READ",
-              "user_name": "deco-test-user@databricks.com"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "service_principal_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/dashboards/${resources.dashboards.foo.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/dashboards/create/out.plan.json b/acceptance/bundle/resources/permissions/dashboards/create/out.plan.json
new file mode 100644
index 00000000000..0b4079b26f4
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/dashboards/create/out.plan.json
@@ -0,0 +1,46 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.dashboards.foo": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "display_name": "test-dashboard-[UNIQUE_NAME]",
+          "embed_credentials": false,
+          "parent_path": "/Workspace/Users/[USERNAME]/folder1",
+          "published": true,
+          "serialized_dashboard": "{\"pages\":[{\"name\":\"page1\",\"displayName\":\"Page 1\"}]}",
+          "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
+        }
+      }
+    },
+    "resources.dashboards.foo.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.dashboards.foo",
+          "label": "${resources.dashboards.foo.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "CAN_READ",
+              "user_name": "deco-test-user@databricks.com"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "service_principal_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/dashboards/${resources.dashboards.foo.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/dashboards/create/out.plan.terraform.json b/acceptance/bundle/resources/permissions/dashboards/create/out.plan.terraform.json
deleted file mode 100644
index c3489e7b11d..00000000000
--- a/acceptance/bundle/resources/permissions/dashboards/create/out.plan.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.dashboards.foo": {
-      "action": "create"
-    },
-    "resources.dashboards.foo.permissions": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/dashboards/create/out.requests.deploy.direct.json b/acceptance/bundle/resources/permissions/dashboards/create/out.requests.deploy.json
similarity index 100%
rename from acceptance/bundle/resources/permissions/dashboards/create/out.requests.deploy.direct.json
rename to acceptance/bundle/resources/permissions/dashboards/create/out.requests.deploy.json
diff --git a/acceptance/bundle/resources/permissions/dashboards/create/out.requests.deploy.terraform.json b/acceptance/bundle/resources/permissions/dashboards/create/out.requests.deploy.terraform.json
deleted file mode 100644
index 262567c1be8..00000000000
--- a/acceptance/bundle/resources/permissions/dashboards/create/out.requests.deploy.terraform.json
+++ /dev/null
@@ -1,16 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/dashboards/[FOO_ID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_MANAGE",
-        "service_principal_name": "[USERNAME]"
-      },
-      {
-        "permission_level": "CAN_READ",
-        "user_name": "deco-test-user@databricks.com"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/empty_list/out.requests.deploy.terraform.json b/acceptance/bundle/resources/permissions/dashboards/create/out.requests.destroy.json
similarity index 100%
rename from acceptance/bundle/resources/permissions/jobs/empty_list/out.requests.deploy.terraform.json
rename to acceptance/bundle/resources/permissions/dashboards/create/out.requests.destroy.json
diff --git a/acceptance/bundle/resources/permissions/dashboards/create/out.requests.destroy.terraform.json b/acceptance/bundle/resources/permissions/dashboards/create/out.requests.destroy.terraform.json
deleted file mode 100644
index 75bac408916..00000000000
--- a/acceptance/bundle/resources/permissions/dashboards/create/out.requests.destroy.terraform.json
+++ /dev/null
@@ -1,5 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/dashboards/[FOO_ID]",
-  "body": {}
-}
diff --git a/acceptance/bundle/resources/permissions/dashboards/create/out.test.toml b/acceptance/bundle/resources/permissions/dashboards/create/out.test.toml
index 2cae6e8241f..669a6b593c4 100644
--- a/acceptance/bundle/resources/permissions/dashboards/create/out.test.toml
+++ b/acceptance/bundle/resources/permissions/dashboards/create/out.test.toml
@@ -1,5 +1,3 @@
-Local = false
 Cloud = true
-RequiresWarehouse = true
 CloudEnvs.gcp = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/permissions/dashboards/create/output.txt b/acceptance/bundle/resources/permissions/dashboards/create/output.txt
index a6765b13c6e..89ab7eb43b4 100644
--- a/acceptance/bundle/resources/permissions/dashboards/create/output.txt
+++ b/acceptance/bundle/resources/permissions/dashboards/create/output.txt
@@ -13,9 +13,10 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/dashboard-perm-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created dashboards.foo
+Created dashboards.foo.permissions
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
@@ -23,5 +24,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/dashboard-perm-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/permissions/dashboards/create/script b/acceptance/bundle/resources/permissions/dashboards/create/script
index 41f26f63604..e8d458ad200 100644
--- a/acceptance/bundle/resources/permissions/dashboards/create/script
+++ b/acceptance/bundle/resources/permissions/dashboards/create/script
@@ -5,17 +5,17 @@ fi
 envsubst < databricks.yml.tmpl > databricks.yml
 
 trace $CLI bundle validate -o json | jq .resources.dashboards.foo.permissions
-rm out.requests.txt
+rm "$OUT_REQUESTS"
 
-$CLI bundle plan --output json > out.plan.$DATABRICKS_BUNDLE_ENGINE.json
+$CLI bundle plan --output json | nostamp > out.plan.json
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
 trace $CLI bundle deploy
 
 # Add all resource IDs to runtime replacements to avoid pattern matching ambiguity
 replace_ids.py
 
-print_requests.py //permissions > out.requests.deploy.$DATABRICKS_BUNDLE_ENGINE.json
+print_requests.py //permissions > out.requests.deploy.json
 
 trace $CLI bundle destroy --auto-approve
-print_requests.py //permissions > out.requests.destroy.$DATABRICKS_BUNDLE_ENGINE.json
+print_requests.py //permissions > out.requests.destroy.json
diff --git a/acceptance/bundle/resources/permissions/dashboards/create/test.toml b/acceptance/bundle/resources/permissions/dashboards/create/test.toml
index c6ec6c1c835..0d6da584102 100644
--- a/acceptance/bundle/resources/permissions/dashboards/create/test.toml
+++ b/acceptance/bundle/resources/permissions/dashboards/create/test.toml
@@ -1,7 +1,9 @@
-Local = false
-RequiresWarehouse = true
 Cloud = true
 
+# Force the local deploy identity to a service principal so the auto-added
+# CAN_MANAGE ACL serializes as service_principal_name, matching the cloud golden.
+IsServicePrincipal = true
+
 # The current user on GCP is a user and not a SP. This causes different permissions to be set.
 # Thus we skip this test on GCP.
 CloudEnvs.gcp = false
diff --git a/acceptance/bundle/resources/permissions/database_instances/current_can_manage/out.plan.direct.json b/acceptance/bundle/resources/permissions/database_instances/current_can_manage/out.plan.direct.json
deleted file mode 100644
index 34e7be11b98..00000000000
--- a/acceptance/bundle/resources/permissions/database_instances/current_can_manage/out.plan.direct.json
+++ /dev/null
@@ -1,49 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.database_instances.foo": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "name": "test-db-instance"
-        }
-      }
-    },
-    "resources.database_instances.foo.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.database_instances.foo",
-          "label": "${resources.database_instances.foo.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "CAN_USE",
-              "user_name": "viewer@example.com"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "group_name": "data-team"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "service_principal_name": "[UUID]"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/database-instances/${resources.database_instances.foo.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/database_instances/current_can_manage/out.plan.json b/acceptance/bundle/resources/permissions/database_instances/current_can_manage/out.plan.json
new file mode 100644
index 00000000000..4f3da16cef9
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/database_instances/current_can_manage/out.plan.json
@@ -0,0 +1,49 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.database_instances.foo": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "name": "[FOO_ID]"
+        }
+      }
+    },
+    "resources.database_instances.foo.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.database_instances.foo",
+          "label": "${resources.database_instances.foo.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "CAN_USE",
+              "user_name": "viewer@example.com"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "group_name": "data-team"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "service_principal_name": "[UUID]"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/database-instances/${resources.database_instances.foo.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/database_instances/current_can_manage/out.plan.terraform.json b/acceptance/bundle/resources/permissions/database_instances/current_can_manage/out.plan.terraform.json
deleted file mode 100644
index 1c26032ae94..00000000000
--- a/acceptance/bundle/resources/permissions/database_instances/current_can_manage/out.plan.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.database_instances.foo": {
-      "action": "create"
-    },
-    "resources.database_instances.foo.permissions": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/database_instances/current_can_manage/out.requests.deploy.direct.json b/acceptance/bundle/resources/permissions/database_instances/current_can_manage/out.requests.deploy.direct.json
deleted file mode 100644
index 401bb4d72af..00000000000
--- a/acceptance/bundle/resources/permissions/database_instances/current_can_manage/out.requests.deploy.direct.json
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/database-instances/test-db-instance",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_USE",
-        "user_name": "viewer@example.com"
-      },
-      {
-        "group_name": "data-team",
-        "permission_level": "CAN_MANAGE"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "service_principal_name": "[UUID]"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/database_instances/current_can_manage/out.requests.deploy.json b/acceptance/bundle/resources/permissions/database_instances/current_can_manage/out.requests.deploy.json
new file mode 100644
index 00000000000..bbdbbef2ae3
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/database_instances/current_can_manage/out.requests.deploy.json
@@ -0,0 +1,24 @@
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/database-instances/[FOO_ID]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "CAN_USE",
+        "user_name": "viewer@example.com"
+      },
+      {
+        "group_name": "data-team",
+        "permission_level": "CAN_MANAGE"
+      },
+      {
+        "permission_level": "CAN_MANAGE",
+        "service_principal_name": "[UUID]"
+      },
+      {
+        "permission_level": "CAN_MANAGE",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/database_instances/current_can_manage/out.requests.deploy.terraform.json b/acceptance/bundle/resources/permissions/database_instances/current_can_manage/out.requests.deploy.terraform.json
deleted file mode 100644
index 102dd25bdce..00000000000
--- a/acceptance/bundle/resources/permissions/database_instances/current_can_manage/out.requests.deploy.terraform.json
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/database-instances/test-db-instance",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_USE",
-        "user_name": "viewer@example.com"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "service_principal_name": "[UUID]"
-      },
-      {
-        "group_name": "data-team",
-        "permission_level": "CAN_MANAGE"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/empty_list/out.requests.destroy.direct.json b/acceptance/bundle/resources/permissions/database_instances/current_can_manage/out.requests.destroy.json
similarity index 100%
rename from acceptance/bundle/resources/permissions/jobs/empty_list/out.requests.destroy.direct.json
rename to acceptance/bundle/resources/permissions/database_instances/current_can_manage/out.requests.destroy.json
diff --git a/acceptance/bundle/resources/permissions/database_instances/current_can_manage/out.requests.destroy.terraform.json b/acceptance/bundle/resources/permissions/database_instances/current_can_manage/out.requests.destroy.terraform.json
deleted file mode 100644
index fb2955430a0..00000000000
--- a/acceptance/bundle/resources/permissions/database_instances/current_can_manage/out.requests.destroy.terraform.json
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/database-instances/test-db-instance",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_MANAGE",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/database_instances/current_can_manage/out.test.toml b/acceptance/bundle/resources/permissions/database_instances/current_can_manage/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/permissions/database_instances/current_can_manage/out.test.toml
+++ b/acceptance/bundle/resources/permissions/database_instances/current_can_manage/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/permissions/database_instances/current_can_manage/output.txt b/acceptance/bundle/resources/permissions/database_instances/current_can_manage/output.txt
index 87a9a4f993c..cd5ba3c5c16 100644
--- a/acceptance/bundle/resources/permissions/database_instances/current_can_manage/output.txt
+++ b/acceptance/bundle/resources/permissions/database_instances/current_can_manage/output.txt
@@ -45,9 +45,10 @@ Warning: unknown field: instance_profile_arn
   in databricks.yml:9:7
 
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created database_instances.foo
+Created database_instances.foo.permissions
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle destroy --auto-approve
 Warning: unknown field: catalog_name
@@ -67,5 +68,4 @@ All data stored in them will be permanently lost:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/permissions/experiments/current_can_manage/out.plan.direct.json b/acceptance/bundle/resources/permissions/experiments/current_can_manage/out.plan.direct.json
deleted file mode 100644
index 72e314a25c7..00000000000
--- a/acceptance/bundle/resources/permissions/experiments/current_can_manage/out.plan.direct.json
+++ /dev/null
@@ -1,49 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.experiments.foo": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "name": "test-experiment"
-        }
-      }
-    },
-    "resources.experiments.foo.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.experiments.foo",
-          "label": "${resources.experiments.foo.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "CAN_READ",
-              "user_name": "viewer@example.com"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "group_name": "data-team"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "service_principal_name": "[UUID]"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/experiments/${resources.experiments.foo.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/experiments/current_can_manage/out.plan.json b/acceptance/bundle/resources/permissions/experiments/current_can_manage/out.plan.json
new file mode 100644
index 00000000000..54f7ce446ee
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/experiments/current_can_manage/out.plan.json
@@ -0,0 +1,49 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.experiments.foo": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "name": "test-experiment"
+        }
+      }
+    },
+    "resources.experiments.foo.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.experiments.foo",
+          "label": "${resources.experiments.foo.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "CAN_READ",
+              "user_name": "viewer@example.com"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "group_name": "data-team"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "service_principal_name": "[UUID]"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/experiments/${resources.experiments.foo.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/experiments/current_can_manage/out.plan.terraform.json b/acceptance/bundle/resources/permissions/experiments/current_can_manage/out.plan.terraform.json
deleted file mode 100644
index 00225fd3ec0..00000000000
--- a/acceptance/bundle/resources/permissions/experiments/current_can_manage/out.plan.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.experiments.foo": {
-      "action": "create"
-    },
-    "resources.experiments.foo.permissions": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/experiments/current_can_manage/out.requests.deploy.direct.json b/acceptance/bundle/resources/permissions/experiments/current_can_manage/out.requests.deploy.direct.json
deleted file mode 100644
index a8085e0a92c..00000000000
--- a/acceptance/bundle/resources/permissions/experiments/current_can_manage/out.requests.deploy.direct.json
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/experiments/[NUMID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_READ",
-        "user_name": "viewer@example.com"
-      },
-      {
-        "group_name": "data-team",
-        "permission_level": "CAN_MANAGE"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "service_principal_name": "[UUID]"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/experiments/current_can_manage/out.requests.deploy.json b/acceptance/bundle/resources/permissions/experiments/current_can_manage/out.requests.deploy.json
new file mode 100644
index 00000000000..624fdfe97c8
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/experiments/current_can_manage/out.requests.deploy.json
@@ -0,0 +1,24 @@
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/experiments/[FOO_ID]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "CAN_READ",
+        "user_name": "viewer@example.com"
+      },
+      {
+        "group_name": "data-team",
+        "permission_level": "CAN_MANAGE"
+      },
+      {
+        "permission_level": "CAN_MANAGE",
+        "service_principal_name": "[UUID]"
+      },
+      {
+        "permission_level": "CAN_MANAGE",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/experiments/current_can_manage/out.requests.deploy.terraform.json b/acceptance/bundle/resources/permissions/experiments/current_can_manage/out.requests.deploy.terraform.json
deleted file mode 100644
index e0c5cfe5a91..00000000000
--- a/acceptance/bundle/resources/permissions/experiments/current_can_manage/out.requests.deploy.terraform.json
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/experiments/[NUMID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_READ",
-        "user_name": "viewer@example.com"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "service_principal_name": "[UUID]"
-      },
-      {
-        "group_name": "data-team",
-        "permission_level": "CAN_MANAGE"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/empty_list/out.requests.destroy.terraform.json b/acceptance/bundle/resources/permissions/experiments/current_can_manage/out.requests.destroy.json
similarity index 100%
rename from acceptance/bundle/resources/permissions/jobs/empty_list/out.requests.destroy.terraform.json
rename to acceptance/bundle/resources/permissions/experiments/current_can_manage/out.requests.destroy.json
diff --git a/acceptance/bundle/resources/permissions/experiments/current_can_manage/out.requests.destroy.terraform.json b/acceptance/bundle/resources/permissions/experiments/current_can_manage/out.requests.destroy.terraform.json
deleted file mode 100644
index d1d042a2978..00000000000
--- a/acceptance/bundle/resources/permissions/experiments/current_can_manage/out.requests.destroy.terraform.json
+++ /dev/null
@@ -1,5 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/experiments/[NUMID]",
-  "body": {}
-}
diff --git a/acceptance/bundle/resources/permissions/experiments/current_can_manage/out.test.toml b/acceptance/bundle/resources/permissions/experiments/current_can_manage/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/permissions/experiments/current_can_manage/out.test.toml
+++ b/acceptance/bundle/resources/permissions/experiments/current_can_manage/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/permissions/experiments/current_can_manage/output.txt b/acceptance/bundle/resources/permissions/experiments/current_can_manage/output.txt
index 02c1a3930fb..3653f707d35 100644
--- a/acceptance/bundle/resources/permissions/experiments/current_can_manage/output.txt
+++ b/acceptance/bundle/resources/permissions/experiments/current_can_manage/output.txt
@@ -21,9 +21,10 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created experiments.foo
+Created experiments.foo.permissions
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
@@ -31,5 +32,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/permissions/factcheck/check_permissions.py b/acceptance/bundle/resources/permissions/factcheck/check_permissions.py
index a3e2afeef2b..9aab1097337 100644
--- a/acceptance/bundle/resources/permissions/factcheck/check_permissions.py
+++ b/acceptance/bundle/resources/permissions/factcheck/check_permissions.py
@@ -1,9 +1,8 @@
-import sys
+import json
 import os
 import pprint
-import json
 import subprocess
-
+import sys
 
 cli = os.environ["CLI"]
 
@@ -21,7 +20,7 @@ def run_json(cmd):
     try:
         return json.loads(result.stdout)
     except Exception as ex:
-        raise Error(f"{cmd} returned non-json: {ex}\n{result.stdout}")
+        raise Error(f"{cmd} returned non-json: {ex}\n{result.stdout}") from ex
 
 
 def test_permissions(target_user, resource_type, resource_id, levels, expected):
diff --git a/acceptance/bundle/resources/permissions/factcheck/databricks.yml.tmpl b/acceptance/bundle/resources/permissions/factcheck/databricks.yml.tmpl
index e049be4cb13..397f257a332 100644
--- a/acceptance/bundle/resources/permissions/factcheck/databricks.yml.tmpl
+++ b/acceptance/bundle/resources/permissions/factcheck/databricks.yml.tmpl
@@ -19,4 +19,5 @@ resources:
   sql_warehouses:
     warehouse:
       name: foo_$UNIQUE_NAME
-      cluster_size: Small
+      cluster_size: 2X-Small
+      auto_stop_mins: 10
diff --git a/acceptance/bundle/resources/permissions/factcheck/out.test.toml b/acceptance/bundle/resources/permissions/factcheck/out.test.toml
index 581c975b773..7ce718742f8 100644
--- a/acceptance/bundle/resources/permissions/factcheck/out.test.toml
+++ b/acceptance/bundle/resources/permissions/factcheck/out.test.toml
@@ -1,6 +1,5 @@
-Local = true
 Cloud = true
 CloudSlow = true
 RunsOnDbr = true
 CloudEnvs.gcp = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/permissions/factcheck/output.txt b/acceptance/bundle/resources/permissions/factcheck/output.txt
index a3ffd49498f..04bbb61ceb3 100644
--- a/acceptance/bundle/resources/permissions/factcheck/output.txt
+++ b/acceptance/bundle/resources/permissions/factcheck/output.txt
@@ -1,9 +1,10 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test_bundle_[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.job
+Created sql_warehouses.warehouse
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 === Permissions API simply takes the latest level in the request for a given principal
 jobs CAN_VIEW,CAN_MANAGE_RUN => CAN_MANAGE_RUN
@@ -29,5 +30,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test_bundle_[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/permissions/factcheck/script b/acceptance/bundle/resources/permissions/factcheck/script
index 9b17c99cb4a..cbddce58087 100644
--- a/acceptance/bundle/resources/permissions/factcheck/script
+++ b/acceptance/bundle/resources/permissions/factcheck/script
@@ -9,10 +9,10 @@ trap cleanup EXIT
 trace $CLI bundle deploy
 
 job_id=$($CLI bundle summary --output json | jq -r '.resources.jobs.job.id')
-echo "$job_id:JOB_ID" >> ACC_REPLS
+add_repl "$job_id" JOB_ID
 
 sql_warehouse_id=$($CLI bundle summary --output json | jq -r '.resources.sql_warehouses.warehouse.id')
-echo "$sql_warehouse_id:SQL_WAREHOUSE_ID" >> ACC_REPLS
+add_repl "$sql_warehouse_id" SQL_WAREHOUSE_ID
 
 user=deco-test-user@databricks.com
 
diff --git a/acceptance/bundle/resources/permissions/factcheck/test.toml b/acceptance/bundle/resources/permissions/factcheck/test.toml
index e28d280b8a9..f194bca8601 100644
--- a/acceptance/bundle/resources/permissions/factcheck/test.toml
+++ b/acceptance/bundle/resources/permissions/factcheck/test.toml
@@ -1,4 +1,4 @@
-Local = true
+Cloud = true
 CloudSlow = true
 RecordRequests = false
 RunsOnDbr = true
diff --git a/acceptance/bundle/resources/permissions/genie_spaces/current_can_manage/databricks.yml b/acceptance/bundle/resources/permissions/genie_spaces/current_can_manage/databricks.yml
new file mode 100644
index 00000000000..d9e1c56c35c
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/genie_spaces/current_can_manage/databricks.yml
@@ -0,0 +1,19 @@
+bundle:
+  name: test-bundle
+
+resources:
+  genie_spaces:
+    foo:
+      title: "Permissions Test Space"
+      warehouse_id: test-warehouse-id
+      parent_path: /Workspace/Users/tester@databricks.com
+      serialized_space: "{}"
+      permissions:
+        - level: CAN_READ
+          user_name: viewer@example.com
+        - level: CAN_MANAGE
+          group_name: data-team
+        - level: CAN_MANAGE
+          service_principal_name: f37d18cd-98a8-4db5-8112-12dd0a6bfe38
+        - level: CAN_MANAGE
+          user_name: tester@databricks.com
diff --git a/acceptance/bundle/resources/permissions/genie_spaces/current_can_manage/out.plan.json b/acceptance/bundle/resources/permissions/genie_spaces/current_can_manage/out.plan.json
new file mode 100644
index 00000000000..f79599cba2d
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/genie_spaces/current_can_manage/out.plan.json
@@ -0,0 +1,52 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.genie_spaces.foo": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "parent_path": "/Workspace/Users/[USERNAME]",
+          "serialized_space": "{}",
+          "title": "Permissions Test Space",
+          "warehouse_id": "test-warehouse-id"
+        }
+      }
+    },
+    "resources.genie_spaces.foo.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.genie_spaces.foo",
+          "label": "${resources.genie_spaces.foo.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "CAN_READ",
+              "user_name": "viewer@example.com"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "group_name": "data-team"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "service_principal_name": "[UUID]"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/genie/${resources.genie_spaces.foo.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/genie_spaces/current_can_manage/out.requests.deploy.json b/acceptance/bundle/resources/permissions/genie_spaces/current_can_manage/out.requests.deploy.json
new file mode 100644
index 00000000000..abcba718ab7
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/genie_spaces/current_can_manage/out.requests.deploy.json
@@ -0,0 +1,24 @@
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/genie/[FOO_ID]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "CAN_READ",
+        "user_name": "viewer@example.com"
+      },
+      {
+        "group_name": "data-team",
+        "permission_level": "CAN_MANAGE"
+      },
+      {
+        "permission_level": "CAN_MANAGE",
+        "service_principal_name": "[UUID]"
+      },
+      {
+        "permission_level": "CAN_MANAGE",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/jobs/other_can_manage/out.requests.destroy.direct.json b/acceptance/bundle/resources/permissions/genie_spaces/current_can_manage/out.requests.destroy.json
similarity index 100%
rename from acceptance/bundle/resources/permissions/jobs/other_can_manage/out.requests.destroy.direct.json
rename to acceptance/bundle/resources/permissions/genie_spaces/current_can_manage/out.requests.destroy.json
diff --git a/acceptance/bundle/resources/permissions/genie_spaces/current_can_manage/out.test.toml b/acceptance/bundle/resources/permissions/genie_spaces/current_can_manage/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/genie_spaces/current_can_manage/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/permissions/genie_spaces/current_can_manage/output.txt b/acceptance/bundle/resources/permissions/genie_spaces/current_can_manage/output.txt
new file mode 100644
index 00000000000..b662770eaca
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/genie_spaces/current_can_manage/output.txt
@@ -0,0 +1,39 @@
+
+>>> [CLI] bundle validate -o json
+[
+  {
+    "level": "CAN_READ",
+    "user_name": "viewer@example.com"
+  },
+  {
+    "group_name": "data-team",
+    "level": "CAN_MANAGE"
+  },
+  {
+    "level": "CAN_MANAGE",
+    "service_principal_name": "[UUID]"
+  },
+  {
+    "level": "CAN_MANAGE",
+    "user_name": "[USERNAME]"
+  }
+]
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created genie_spaces.foo
+Created genie_spaces.foo.permissions
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.genie_spaces.foo
+
+This action will result in the deletion of the following Genie spaces.
+The conversation history attached to them is permanently lost:
+  delete resources.genie_spaces.foo
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/permissions/genie_spaces/current_can_manage/script b/acceptance/bundle/resources/permissions/genie_spaces/current_can_manage/script
new file mode 100644
index 00000000000..d865fd5c6a8
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/genie_spaces/current_can_manage/script
@@ -0,0 +1,13 @@
+trace $CLI bundle validate -o json | jq .resources.genie_spaces.foo.permissions
+rm "$OUT_REQUESTS"
+
+$CLI bundle plan -o json | nostamp > out.plan.json
+
+rm "$OUT_REQUESTS"
+trace $CLI bundle deploy
+# Genie space IDs are random; normalize them in the recorded requests.
+replace_ids.py
+print_requests.py //permissions > out.requests.deploy.json
+
+trace $CLI bundle destroy --auto-approve
+print_requests.py //permissions > out.requests.destroy.json
diff --git a/acceptance/bundle/resources/permissions/genie_spaces/out_of_band_deletion/databricks.yml b/acceptance/bundle/resources/permissions/genie_spaces/out_of_band_deletion/databricks.yml
new file mode 100644
index 00000000000..e83f22c62f9
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/genie_spaces/out_of_band_deletion/databricks.yml
@@ -0,0 +1,16 @@
+bundle:
+  name: test-bundle
+
+resources:
+  genie_spaces:
+    foo:
+      title: "Out Of Band Deletion"
+      warehouse_id: test-warehouse-id
+      parent_path: /Workspace/Users/tester@databricks.com
+      serialized_space:
+        version: 1
+      permissions:
+        - level: CAN_MANAGE
+          user_name: tester@databricks.com
+        - level: CAN_READ
+          group_name: data-team
diff --git a/acceptance/bundle/resources/permissions/genie_spaces/out_of_band_deletion/out.test.toml b/acceptance/bundle/resources/permissions/genie_spaces/out_of_band_deletion/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/genie_spaces/out_of_band_deletion/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/permissions/genie_spaces/out_of_band_deletion/output.txt b/acceptance/bundle/resources/permissions/genie_spaces/out_of_band_deletion/output.txt
new file mode 100644
index 00000000000..b7972be4f1b
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/genie_spaces/out_of_band_deletion/output.txt
@@ -0,0 +1,76 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created genie_spaces.foo
+Created genie_spaces.foo.permissions
+Files: 1 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Permissions are set on the live space
+>>> [CLI] api get /api/2.0/permissions/genie/[GENIE_SPACE_ID]
+{
+  "object_type": "genie-space",
+  "access_control_list": [
+    {
+      "all_permissions": [
+        {
+          "inherited": false,
+          "permission_level": "CAN_MANAGE"
+        }
+      ],
+      "display_name": "[USERNAME]",
+      "user_name": "[USERNAME]"
+    },
+    {
+      "all_permissions": [
+        {
+          "inherited": false,
+          "permission_level": "CAN_READ"
+        }
+      ],
+      "group_name": "data-team"
+    }
+  ]
+}
+
+=== Trash the space out-of-band
+>>> [CLI] genie trash-space [GENIE_SPACE_ID]
+
+=== Permissions API still returns the ACLs for the trashed space (no 404)
+>>> [CLI] api get /api/2.0/permissions/genie/[GENIE_SPACE_ID]
+{
+  "object_type": "genie-space",
+  "access_control_list": [
+    {
+      "all_permissions": [
+        {
+          "inherited": false,
+          "permission_level": "CAN_MANAGE"
+        }
+      ],
+      "display_name": "[USERNAME]",
+      "user_name": "[USERNAME]"
+    },
+    {
+      "all_permissions": [
+        {
+          "inherited": false,
+          "permission_level": "CAN_READ"
+        }
+      ],
+      "group_name": "data-team"
+    }
+  ]
+}
+
+=== Plan recreates the gone space
+>>> [CLI] bundle plan
+create genie_spaces.foo
+update genie_spaces.foo.permissions
+
+Plan: 1 to add, 1 to change, 0 to delete, 0 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Destroy: 0 deleted
diff --git a/acceptance/bundle/resources/permissions/genie_spaces/out_of_band_deletion/script b/acceptance/bundle/resources/permissions/genie_spaces/out_of_band_deletion/script
new file mode 100644
index 00000000000..30130e75885
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/genie_spaces/out_of_band_deletion/script
@@ -0,0 +1,23 @@
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+trace $CLI bundle deploy
+SID=$($CLI bundle summary --output json | jq -r '.resources.genie_spaces.foo.id')
+add_repl "$SID" GENIE_SPACE_ID
+
+title "Permissions are set on the live space"
+trace $CLI api get /api/2.0/permissions/genie/$SID | jq '{object_type, access_control_list}'
+
+title "Trash the space out-of-band"
+trace $CLI genie trash-space $SID
+
+# Backend quirk: the genie permissions endpoint keeps returning the ACLs for a
+# trashed space; it does not 404 the way a cascade-deleted resource would. This
+# guards how permissions linger on a deleted genie space.
+title "Permissions API still returns the ACLs for the trashed space (no 404)"
+trace $CLI api get /api/2.0/permissions/genie/$SID | jq '{object_type, access_control_list}'
+
+title "Plan recreates the gone space"
+trace $CLI bundle plan
diff --git a/acceptance/bundle/resources/permissions/genie_spaces/out_of_band_deletion/test.toml b/acceptance/bundle/resources/permissions/genie_spaces/out_of_band_deletion/test.toml
new file mode 100644
index 00000000000..33a6169a591
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/genie_spaces/out_of_band_deletion/test.toml
@@ -0,0 +1,8 @@
+# Asserts the permission API's behavior on a trashed space via `api get` output,
+# not recorded request payloads, so request recording is off.
+RecordRequests = false
+
+# `api get` is passed a leading-slash path. Without this, MSYS (Git Bash on
+# Windows) rewrites /api/... to C:\Program Files\Git\api\... before the CLI
+# sees it, so the request misses the testserver stub.
+Env.MSYS_NO_PATHCONV = "1"
diff --git a/acceptance/bundle/resources/permissions/genie_spaces/test.toml b/acceptance/bundle/resources/permissions/genie_spaces/test.toml
new file mode 100644
index 00000000000..6b7855e10bc
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/genie_spaces/test.toml
@@ -0,0 +1,4 @@
+Env.RESOURCE = "genie_spaces" # for ../_script
+
+# Genie spaces only support the direct deployment engine.
+Env.DATABRICKS_BUNDLE_ENGINE = "direct"
diff --git a/acceptance/bundle/resources/permissions/jobs/added_remotely/out.plan.direct.json b/acceptance/bundle/resources/permissions/jobs/added_remotely/out.plan.direct.json
deleted file mode 100644
index d8b89012696..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/added_remotely/out.plan.direct.json
+++ /dev/null
@@ -1,125 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.jobs.job_with_permissions": {
-      "action": "skip",
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-        },
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_id": [JOB_WITH_PERMISSIONS_ID],
-        "max_concurrent_runs": 1,
-        "name": "job permissions added remotely",
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "tasks": [
-          {
-            "email_notifications": {},
-            "notebook_task": {
-              "notebook_path": "/Workspace/Users/user@example.com/notebook",
-              "source": "WORKSPACE"
-            },
-            "run_if": "ALL_SUCCESS",
-            "task_key": "main",
-            "timeout_seconds": 0
-          }
-        ],
-        "timeout_seconds": 0,
-        "webhook_notifications": {}
-      },
-      "changes": {
-        "email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks[task_key='main'].email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks[task_key='main'].run_if": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "ALL_SUCCESS"
-        },
-        "tasks[task_key='main'].timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "webhook_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        }
-      }
-    },
-    "resources.jobs.job_with_permissions.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.job_with_permissions",
-          "label": "${resources.jobs.job_with_permissions.id}"
-        }
-      ],
-      "action": "update",
-      "new_state": {
-        "value": {
-          "object_id": "/jobs/[JOB_WITH_PERMISSIONS_ID]",
-          "__embed__": [
-            {
-              "level": "CAN_VIEW",
-              "user_name": "viewer@example.com"
-            },
-            {
-              "level": "IS_OWNER",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        }
-      },
-      "remote_state": {
-        "object_id": "/jobs/[JOB_WITH_PERMISSIONS_ID]",
-        "__embed__": [
-          {
-            "level": "IS_OWNER",
-            "user_name": "[USERNAME]"
-          },
-          {
-            "level": "CAN_VIEW",
-            "user_name": "viewer@example.com"
-          },
-          {
-            "level": "CAN_MANAGE",
-            "group_name": "admin-team"
-          }
-        ]
-      },
-      "changes": {
-        "[group_name='admin-team']": {
-          "action": "update",
-          "remote": {
-            "level": "CAN_MANAGE",
-            "group_name": "admin-team"
-          }
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/added_remotely/out.plan.json b/acceptance/bundle/resources/permissions/jobs/added_remotely/out.plan.json
new file mode 100644
index 00000000000..30ef353f822
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/jobs/added_remotely/out.plan.json
@@ -0,0 +1,125 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.jobs.job_with_permissions": {
+      "action": "skip",
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_id": [JOB_WITH_PERMISSIONS_ID],
+        "max_concurrent_runs": 1,
+        "name": "job permissions added remotely",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "tasks": [
+          {
+            "email_notifications": {},
+            "notebook_task": {
+              "notebook_path": "/Workspace/Users/user@example.com/notebook",
+              "source": "WORKSPACE"
+            },
+            "run_if": "ALL_SUCCESS",
+            "task_key": "main",
+            "timeout_seconds": 0
+          }
+        ],
+        "timeout_seconds": 0,
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='main'].email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='main'].run_if": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": "ALL_SUCCESS"
+        },
+        "tasks[task_key='main'].timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    },
+    "resources.jobs.job_with_permissions.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.job_with_permissions",
+          "label": "${resources.jobs.job_with_permissions.id}"
+        }
+      ],
+      "action": "update",
+      "new_state": {
+        "value": {
+          "object_id": "/jobs/[JOB_WITH_PERMISSIONS_ID]",
+          "__embed__": [
+            {
+              "level": "CAN_VIEW",
+              "user_name": "viewer@example.com"
+            },
+            {
+              "level": "IS_OWNER",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        }
+      },
+      "remote_state": {
+        "object_id": "/jobs/[JOB_WITH_PERMISSIONS_ID]",
+        "__embed__": [
+          {
+            "level": "IS_OWNER",
+            "user_name": "[USERNAME]"
+          },
+          {
+            "level": "CAN_VIEW",
+            "user_name": "viewer@example.com"
+          },
+          {
+            "level": "CAN_MANAGE",
+            "group_name": "admin-team"
+          }
+        ]
+      },
+      "changes": {
+        "[group_name='admin-team']": {
+          "action": "update",
+          "remote": {
+            "level": "CAN_MANAGE",
+            "group_name": "admin-team"
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/jobs/added_remotely/out.plan.terraform.json b/acceptance/bundle/resources/permissions/jobs/added_remotely/out.plan.terraform.json
deleted file mode 100644
index a88eeedacc0..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/added_remotely/out.plan.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.job_with_permissions": {
-      "action": "skip"
-    },
-    "resources.jobs.job_with_permissions.permissions": {
-      "action": "update"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/added_remotely/out.test.toml b/acceptance/bundle/resources/permissions/jobs/added_remotely/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/permissions/jobs/added_remotely/out.test.toml
+++ b/acceptance/bundle/resources/permissions/jobs/added_remotely/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/permissions/jobs/added_remotely/output.txt b/acceptance/bundle/resources/permissions/jobs/added_remotely/output.txt
index c55126ce725..81b09d6fcb2 100644
--- a/acceptance/bundle/resources/permissions/jobs/added_remotely/output.txt
+++ b/acceptance/bundle/resources/permissions/jobs/added_remotely/output.txt
@@ -7,9 +7,10 @@ Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.job_with_permissions
+Created jobs.job_with_permissions.permissions
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle plan
 Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
@@ -113,9 +114,9 @@ Plan: 0 to add, 1 to change, 0 to delete, 1 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated jobs.job_with_permissions.permissions
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 1 unchanged
 
 >>> [CLI] bundle plan
 Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
diff --git a/acceptance/bundle/resources/permissions/jobs/added_remotely/script b/acceptance/bundle/resources/permissions/jobs/added_remotely/script
index 6e8f759cbb8..da4a85ca455 100644
--- a/acceptance/bundle/resources/permissions/jobs/added_remotely/script
+++ b/acceptance/bundle/resources/permissions/jobs/added_remotely/script
@@ -10,7 +10,7 @@ title "Add permissions out of band"
 trace $CLI permissions set jobs "$job_id" --json @remote_add.json
 
 trace $CLI bundle plan
-trace $CLI bundle plan -o json > out.plan.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.plan.json
 trace $CLI bundle deploy
 trace $CLI bundle plan
 
diff --git a/acceptance/bundle/resources/permissions/jobs/current_can_manage/out.plan.direct.json b/acceptance/bundle/resources/permissions/jobs/current_can_manage/out.plan.direct.json
deleted file mode 100644
index ed2a8fb2bef..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/current_can_manage/out.plan.direct.json
+++ /dev/null
@@ -1,68 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.foo": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "job1",
-          "queue": {
-            "enabled": true
-          },
-          "tasks": [
-            {
-              "notebook_task": {
-                "notebook_path": "/Workspace/Users/user@example.com/notebook",
-                "source": "WORKSPACE"
-              },
-              "task_key": "main"
-            }
-          ]
-        }
-      }
-    },
-    "resources.jobs.foo.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.foo",
-          "label": "${resources.jobs.foo.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "CAN_VIEW",
-              "user_name": "viewer@example.com"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "group_name": "data-team"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "service_principal_name": "[UUID]"
-            },
-            {
-              "level": "IS_OWNER",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/jobs/${resources.jobs.foo.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/current_can_manage/out.plan.json b/acceptance/bundle/resources/permissions/jobs/current_can_manage/out.plan.json
new file mode 100644
index 00000000000..eb77fd33747
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/jobs/current_can_manage/out.plan.json
@@ -0,0 +1,68 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.jobs.foo": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "job1",
+          "queue": {
+            "enabled": true
+          },
+          "tasks": [
+            {
+              "notebook_task": {
+                "notebook_path": "/Workspace/Users/user@example.com/notebook",
+                "source": "WORKSPACE"
+              },
+              "task_key": "main"
+            }
+          ]
+        }
+      }
+    },
+    "resources.jobs.foo.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.foo",
+          "label": "${resources.jobs.foo.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "CAN_VIEW",
+              "user_name": "viewer@example.com"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "group_name": "data-team"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "service_principal_name": "[UUID]"
+            },
+            {
+              "level": "IS_OWNER",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/jobs/${resources.jobs.foo.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/jobs/current_can_manage/out.plan.terraform.json b/acceptance/bundle/resources/permissions/jobs/current_can_manage/out.plan.terraform.json
deleted file mode 100644
index 41071059f89..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/current_can_manage/out.plan.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.foo": {
-      "action": "create"
-    },
-    "resources.jobs.foo.permissions": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/current_can_manage/out.requests.deploy.direct.json b/acceptance/bundle/resources/permissions/jobs/current_can_manage/out.requests.deploy.direct.json
deleted file mode 100644
index 5647c1a73b9..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/current_can_manage/out.requests.deploy.direct.json
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/jobs/[NUMID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_VIEW",
-        "user_name": "viewer@example.com"
-      },
-      {
-        "group_name": "data-team",
-        "permission_level": "CAN_MANAGE"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "service_principal_name": "[UUID]"
-      },
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/current_can_manage/out.requests.deploy.json b/acceptance/bundle/resources/permissions/jobs/current_can_manage/out.requests.deploy.json
new file mode 100644
index 00000000000..47781d53496
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/jobs/current_can_manage/out.requests.deploy.json
@@ -0,0 +1,24 @@
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/jobs/[FOO_ID]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "CAN_VIEW",
+        "user_name": "viewer@example.com"
+      },
+      {
+        "group_name": "data-team",
+        "permission_level": "CAN_MANAGE"
+      },
+      {
+        "permission_level": "CAN_MANAGE",
+        "service_principal_name": "[UUID]"
+      },
+      {
+        "permission_level": "IS_OWNER",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/jobs/current_can_manage/out.requests.deploy.terraform.json b/acceptance/bundle/resources/permissions/jobs/current_can_manage/out.requests.deploy.terraform.json
deleted file mode 100644
index 8c15422e36c..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/current_can_manage/out.requests.deploy.terraform.json
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/jobs/[NUMID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_VIEW",
-        "user_name": "viewer@example.com"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "service_principal_name": "[UUID]"
-      },
-      {
-        "group_name": "data-team",
-        "permission_level": "CAN_MANAGE"
-      },
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/other_is_owner/out.requests.destroy.direct.json b/acceptance/bundle/resources/permissions/jobs/current_can_manage/out.requests.destroy.json
similarity index 100%
rename from acceptance/bundle/resources/permissions/jobs/other_is_owner/out.requests.destroy.direct.json
rename to acceptance/bundle/resources/permissions/jobs/current_can_manage/out.requests.destroy.json
diff --git a/acceptance/bundle/resources/permissions/jobs/current_can_manage/out.requests.destroy.terraform.json b/acceptance/bundle/resources/permissions/jobs/current_can_manage/out.requests.destroy.terraform.json
deleted file mode 100644
index f7aa2dbaa0d..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/current_can_manage/out.requests.destroy.terraform.json
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/jobs/[NUMID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/current_can_manage/out.test.toml b/acceptance/bundle/resources/permissions/jobs/current_can_manage/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/permissions/jobs/current_can_manage/out.test.toml
+++ b/acceptance/bundle/resources/permissions/jobs/current_can_manage/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/permissions/jobs/current_can_manage/output.txt b/acceptance/bundle/resources/permissions/jobs/current_can_manage/output.txt
index 8d21073e1c8..29265355cd1 100644
--- a/acceptance/bundle/resources/permissions/jobs/current_can_manage/output.txt
+++ b/acceptance/bundle/resources/permissions/jobs/current_can_manage/output.txt
@@ -21,9 +21,10 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.foo
+Created jobs.foo.permissions
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
@@ -31,5 +32,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/permissions/jobs/current_can_manage_run/out.deploy.requests.json b/acceptance/bundle/resources/permissions/jobs/current_can_manage_run/out.deploy.requests.json
index 229ba30386a..d40073afd65 100644
--- a/acceptance/bundle/resources/permissions/jobs/current_can_manage_run/out.deploy.requests.json
+++ b/acceptance/bundle/resources/permissions/jobs/current_can_manage_run/out.deploy.requests.json
@@ -17,7 +17,7 @@
 }
 {
   "method": "PUT",
-  "path": "/api/2.0/permissions/jobs/[NUMID]",
+  "path": "/api/2.0/permissions/jobs/[INTERIM_GOLD_LAYER_JOB_ID]",
   "body": {
     "access_control_list": [
       {
diff --git a/acceptance/bundle/resources/permissions/jobs/current_can_manage_run/out.destroy.requests.direct.json b/acceptance/bundle/resources/permissions/jobs/current_can_manage_run/out.destroy.requests.direct.json
deleted file mode 100644
index 6564b6f8bde..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/current_can_manage_run/out.destroy.requests.direct.json
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-  "method": "POST",
-  "path": "/api/2.2/jobs/delete",
-  "body": {
-    "job_id": [NUMID]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/current_can_manage_run/out.destroy.requests.json b/acceptance/bundle/resources/permissions/jobs/current_can_manage_run/out.destroy.requests.json
new file mode 100644
index 00000000000..fa337fe39ce
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/jobs/current_can_manage_run/out.destroy.requests.json
@@ -0,0 +1,7 @@
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/delete",
+  "body": {
+    "job_id": [INTERIM_GOLD_LAYER_JOB_ID]
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/jobs/current_can_manage_run/out.destroy.requests.terraform.json b/acceptance/bundle/resources/permissions/jobs/current_can_manage_run/out.destroy.requests.terraform.json
deleted file mode 100644
index cd29de0d552..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/current_can_manage_run/out.destroy.requests.terraform.json
+++ /dev/null
@@ -1,19 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/jobs/[NUMID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.2/jobs/delete",
-  "body": {
-    "job_id": [NUMID]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/current_can_manage_run/out.plan.direct.txt b/acceptance/bundle/resources/permissions/jobs/current_can_manage_run/out.plan.direct.txt
deleted file mode 100644
index f0abdccb4fb..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/current_can_manage_run/out.plan.direct.txt
+++ /dev/null
@@ -1,66 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.jobs.interim_gold_layer_job": {
-      "action": "skip",
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/green/state/metadata.json"
-        },
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_id": [NUMID],
-        "max_concurrent_runs": 1,
-        "name": "Untitled",
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "timeout_seconds": 0,
-        "webhook_notifications": {}
-      },
-      "changes": {
-        "email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "webhook_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        }
-      }
-    },
-    "resources.jobs.interim_gold_layer_job.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.interim_gold_layer_job",
-          "label": "${resources.jobs.interim_gold_layer_job.id}"
-        }
-      ],
-      "action": "skip",
-      "remote_state": {
-        "object_id": "/jobs/[NUMID]",
-        "__embed__": [
-          {
-            "level": "IS_OWNER",
-            "service_principal_name": "[USERNAME]"
-          }
-        ]
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/current_can_manage_run/out.plan.terraform.txt b/acceptance/bundle/resources/permissions/jobs/current_can_manage_run/out.plan.terraform.txt
deleted file mode 100644
index d379ed72d90..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/current_can_manage_run/out.plan.terraform.txt
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.interim_gold_layer_job": {
-      "action": "skip"
-    },
-    "resources.jobs.interim_gold_layer_job.permissions": {
-      "action": "skip"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/current_can_manage_run/out.plan.txt b/acceptance/bundle/resources/permissions/jobs/current_can_manage_run/out.plan.txt
new file mode 100644
index 00000000000..461e74b2bd6
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/jobs/current_can_manage_run/out.plan.txt
@@ -0,0 +1,66 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.jobs.interim_gold_layer_job": {
+      "action": "skip",
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/green/state/metadata.json"
+        },
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_id": [INTERIM_GOLD_LAYER_JOB_ID],
+        "max_concurrent_runs": 1,
+        "name": "Untitled",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "timeout_seconds": 0,
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    },
+    "resources.jobs.interim_gold_layer_job.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.interim_gold_layer_job",
+          "label": "${resources.jobs.interim_gold_layer_job.id}"
+        }
+      ],
+      "action": "skip",
+      "remote_state": {
+        "object_id": "/jobs/[INTERIM_GOLD_LAYER_JOB_ID]",
+        "__embed__": [
+          {
+            "level": "IS_OWNER",
+            "service_principal_name": "[USERNAME]"
+          }
+        ]
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/jobs/current_can_manage_run/out.test.toml b/acceptance/bundle/resources/permissions/jobs/current_can_manage_run/out.test.toml
index 887e4650a78..669a6b593c4 100644
--- a/acceptance/bundle/resources/permissions/jobs/current_can_manage_run/out.test.toml
+++ b/acceptance/bundle/resources/permissions/jobs/current_can_manage_run/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 CloudEnvs.gcp = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/permissions/jobs/current_can_manage_run/output.txt b/acceptance/bundle/resources/permissions/jobs/current_can_manage_run/output.txt
index 91420fa9528..bb9515d93a6 100644
--- a/acceptance/bundle/resources/permissions/jobs/current_can_manage_run/output.txt
+++ b/acceptance/bundle/resources/permissions/jobs/current_can_manage_run/output.txt
@@ -26,9 +26,10 @@
 
 >>> errcode [CLI] bundle deploy -t green
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/green/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.interim_gold_layer_job
+Created jobs.interim_gold_layer_job.permissions
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle plan -o json -t green
 
@@ -38,5 +39,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/green
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/permissions/jobs/current_can_manage_run/script b/acceptance/bundle/resources/permissions/jobs/current_can_manage_run/script
index 96eaf8a4c75..9fd1c142a98 100644
--- a/acceptance/bundle/resources/permissions/jobs/current_can_manage_run/script
+++ b/acceptance/bundle/resources/permissions/jobs/current_can_manage_run/script
@@ -1,11 +1,12 @@
 envsubst < databricks.yml.tmpl > databricks.yml
 
-trace $CLI bundle validate -t green -o json | jq .resources
+trace $CLI bundle validate -t green -o json | nostamp | jq .resources
 trace errcode $CLI bundle deploy -t green
-print_requests.py //jobs &> out.deploy.requests.json
+replace_ids.py -t green
+print_requests.py //jobs --nostamp &> out.deploy.requests.json
 
 # check plan to ensure there is not drift
-trace $CLI bundle plan -o json -t green > out.plan.$DATABRICKS_BUNDLE_ENGINE.txt
+trace $CLI bundle plan -o json -t green | nostamp > out.plan.txt
 
 trace errcode $CLI bundle destroy -t green --auto-approve
-print_requests.py //jobs &> out.destroy.requests.$DATABRICKS_BUNDLE_ENGINE.json
+print_requests.py //jobs --nostamp &> out.destroy.requests.json
diff --git a/acceptance/bundle/resources/permissions/jobs/current_can_manage_run/test.toml b/acceptance/bundle/resources/permissions/jobs/current_can_manage_run/test.toml
index e3f6482b2df..44cc15cb450 100644
--- a/acceptance/bundle/resources/permissions/jobs/current_can_manage_run/test.toml
+++ b/acceptance/bundle/resources/permissions/jobs/current_can_manage_run/test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 IsServicePrincipal = true
 
diff --git a/acceptance/bundle/resources/permissions/jobs/current_is_owner/out.plan.direct.json b/acceptance/bundle/resources/permissions/jobs/current_is_owner/out.plan.direct.json
deleted file mode 100644
index 0aceec03d02..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/current_is_owner/out.plan.direct.json
+++ /dev/null
@@ -1,56 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.foo": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "job1",
-          "queue": {
-            "enabled": true
-          },
-          "tasks": [
-            {
-              "notebook_task": {
-                "notebook_path": "/Workspace/Users/user@example.com/notebook",
-                "source": "WORKSPACE"
-              },
-              "task_key": "main"
-            }
-          ]
-        }
-      }
-    },
-    "resources.jobs.foo.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.foo",
-          "label": "${resources.jobs.foo.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "IS_OWNER",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/jobs/${resources.jobs.foo.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/current_is_owner/out.plan.json b/acceptance/bundle/resources/permissions/jobs/current_is_owner/out.plan.json
new file mode 100644
index 00000000000..f22b7405f0c
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/jobs/current_is_owner/out.plan.json
@@ -0,0 +1,56 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.jobs.foo": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "job1",
+          "queue": {
+            "enabled": true
+          },
+          "tasks": [
+            {
+              "notebook_task": {
+                "notebook_path": "/Workspace/Users/user@example.com/notebook",
+                "source": "WORKSPACE"
+              },
+              "task_key": "main"
+            }
+          ]
+        }
+      }
+    },
+    "resources.jobs.foo.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.foo",
+          "label": "${resources.jobs.foo.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "IS_OWNER",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/jobs/${resources.jobs.foo.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/jobs/current_is_owner/out.plan.terraform.json b/acceptance/bundle/resources/permissions/jobs/current_is_owner/out.plan.terraform.json
deleted file mode 100644
index 41071059f89..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/current_is_owner/out.plan.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.foo": {
-      "action": "create"
-    },
-    "resources.jobs.foo.permissions": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/current_is_owner/out.requests.deploy.direct.json b/acceptance/bundle/resources/permissions/jobs/current_is_owner/out.requests.deploy.direct.json
deleted file mode 100644
index f7aa2dbaa0d..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/current_is_owner/out.requests.deploy.direct.json
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/jobs/[NUMID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/current_is_owner/out.requests.deploy.json b/acceptance/bundle/resources/permissions/jobs/current_is_owner/out.requests.deploy.json
new file mode 100644
index 00000000000..bbb8445b5a5
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/jobs/current_is_owner/out.requests.deploy.json
@@ -0,0 +1,12 @@
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/jobs/[FOO_ID]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "IS_OWNER",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/jobs/current_is_owner/out.requests.deploy.terraform.json b/acceptance/bundle/resources/permissions/jobs/current_is_owner/out.requests.deploy.terraform.json
deleted file mode 100644
index f7aa2dbaa0d..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/current_is_owner/out.requests.deploy.terraform.json
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/jobs/[NUMID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/update/out.requests_delete_all.direct.json b/acceptance/bundle/resources/permissions/jobs/current_is_owner/out.requests.destroy.json
similarity index 100%
rename from acceptance/bundle/resources/permissions/jobs/update/out.requests_delete_all.direct.json
rename to acceptance/bundle/resources/permissions/jobs/current_is_owner/out.requests.destroy.json
diff --git a/acceptance/bundle/resources/permissions/jobs/current_is_owner/out.requests.destroy.terraform.json b/acceptance/bundle/resources/permissions/jobs/current_is_owner/out.requests.destroy.terraform.json
deleted file mode 100644
index f7aa2dbaa0d..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/current_is_owner/out.requests.destroy.terraform.json
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/jobs/[NUMID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/current_is_owner/out.test.toml b/acceptance/bundle/resources/permissions/jobs/current_is_owner/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/permissions/jobs/current_is_owner/out.test.toml
+++ b/acceptance/bundle/resources/permissions/jobs/current_is_owner/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/permissions/jobs/current_is_owner/output.txt b/acceptance/bundle/resources/permissions/jobs/current_is_owner/output.txt
index 1e0de881407..a55aced6e70 100644
--- a/acceptance/bundle/resources/permissions/jobs/current_is_owner/output.txt
+++ b/acceptance/bundle/resources/permissions/jobs/current_is_owner/output.txt
@@ -9,9 +9,10 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.foo
+Created jobs.foo.permissions
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
@@ -19,5 +20,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/permissions/jobs/delete_one/out.plan_create.direct.json b/acceptance/bundle/resources/permissions/jobs/delete_one/out.plan_create.direct.json
deleted file mode 100644
index 10b578fb83e..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/delete_one/out.plan_create.direct.json
+++ /dev/null
@@ -1,68 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.job_with_permissions": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/state/metadata.json"
-          },
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "job with permissions",
-          "queue": {
-            "enabled": true
-          },
-          "tasks": [
-            {
-              "notebook_task": {
-                "notebook_path": "/Workspace/Users/tester@databricks.com/notebook",
-                "source": "WORKSPACE"
-              },
-              "task_key": "main"
-            }
-          ]
-        }
-      }
-    },
-    "resources.jobs.job_with_permissions.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.job_with_permissions",
-          "label": "${resources.jobs.job_with_permissions.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "CAN_MANAGE_RUN",
-              "user_name": "test-dabs-1@databricks.com"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "group_name": "test-dabs-group-1"
-            },
-            {
-              "level": "CAN_VIEW",
-              "user_name": "test-dabs-2@databricks.com"
-            },
-            {
-              "level": "IS_OWNER",
-              "service_principal_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/jobs/${resources.jobs.job_with_permissions.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/delete_one/out.plan_create.json b/acceptance/bundle/resources/permissions/jobs/delete_one/out.plan_create.json
new file mode 100644
index 00000000000..49edcf2ea8a
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/jobs/delete_one/out.plan_create.json
@@ -0,0 +1,68 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.jobs.job_with_permissions": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "job with permissions",
+          "queue": {
+            "enabled": true
+          },
+          "tasks": [
+            {
+              "notebook_task": {
+                "notebook_path": "/Workspace/Users/tester@databricks.com/notebook",
+                "source": "WORKSPACE"
+              },
+              "task_key": "main"
+            }
+          ]
+        }
+      }
+    },
+    "resources.jobs.job_with_permissions.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.job_with_permissions",
+          "label": "${resources.jobs.job_with_permissions.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "CAN_MANAGE_RUN",
+              "user_name": "test-dabs-1@databricks.com"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "group_name": "test-dabs-group-1"
+            },
+            {
+              "level": "CAN_VIEW",
+              "user_name": "test-dabs-2@databricks.com"
+            },
+            {
+              "level": "IS_OWNER",
+              "service_principal_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/jobs/${resources.jobs.job_with_permissions.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/jobs/delete_one/out.plan_create.terraform.json b/acceptance/bundle/resources/permissions/jobs/delete_one/out.plan_create.terraform.json
deleted file mode 100644
index 839b2168abe..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/delete_one/out.plan_create.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.job_with_permissions": {
-      "action": "create"
-    },
-    "resources.jobs.job_with_permissions.permissions": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/delete_one/out.requests_destroy.direct.json b/acceptance/bundle/resources/permissions/jobs/delete_one/out.requests_destroy.json
similarity index 100%
rename from acceptance/bundle/resources/permissions/jobs/delete_one/out.requests_destroy.direct.json
rename to acceptance/bundle/resources/permissions/jobs/delete_one/out.requests_destroy.json
diff --git a/acceptance/bundle/resources/permissions/jobs/delete_one/out.requests_destroy.terraform.json b/acceptance/bundle/resources/permissions/jobs/delete_one/out.requests_destroy.terraform.json
deleted file mode 100644
index f66a05564c6..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/delete_one/out.requests_destroy.terraform.json
+++ /dev/null
@@ -1,19 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/jobs/[JOB_WITH_PERMISSIONS_ID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.2/jobs/delete",
-  "body": {
-    "job_id": [JOB_WITH_PERMISSIONS_ID]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/delete_one/out.test.toml b/acceptance/bundle/resources/permissions/jobs/delete_one/out.test.toml
index e849ec85ace..0f167effef1 100644
--- a/acceptance/bundle/resources/permissions/jobs/delete_one/out.test.toml
+++ b/acceptance/bundle/resources/permissions/jobs/delete_one/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/permissions/jobs/delete_one/output.txt b/acceptance/bundle/resources/permissions/jobs/delete_one/output.txt
index 007d1a8c942..0f43c82ecbc 100644
--- a/acceptance/bundle/resources/permissions/jobs/delete_one/output.txt
+++ b/acceptance/bundle/resources/permissions/jobs/delete_one/output.txt
@@ -3,9 +3,10 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.job_with_permissions
+Created jobs.job_with_permissions.permissions
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle plan
 Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
@@ -14,9 +15,9 @@ Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated jobs.job_with_permissions.permissions
+Files: 3 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 1 unchanged
 
 >>> errcode [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
@@ -24,5 +25,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/permissions/jobs/delete_one/script b/acceptance/bundle/resources/permissions/jobs/delete_one/script
index b51fed3b894..ef6e2142e07 100644
--- a/acceptance/bundle/resources/permissions/jobs/delete_one/script
+++ b/acceptance/bundle/resources/permissions/jobs/delete_one/script
@@ -6,30 +6,30 @@ if [ -n "$CLOUD_ENV" ]; then
     $CLI users create --user-name test-dabs-2@databricks.com &> /dev/null || true
     $CLI groups create --display-name test-dabs-group-1 &> /dev/null || true
 fi
-rm -f out.requests.txt
+rm -f "$OUT_REQUESTS"
 
-trace $CLI bundle plan -o json > out.plan_create.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.plan_create.json
 
 cleanup() {
     trace errcode $CLI bundle destroy --auto-approve
-    print_requests.py //jobs/ > out.requests_destroy.$DATABRICKS_BUNDLE_ENGINE.json
+    print_requests.py --nostamp //jobs/ > out.requests_destroy.json
 }
 trap cleanup EXIT
 
 trace $CLI bundle deploy
-print_requests.py //jobs/ | gron.py --sort-arrays access_control_list > out.requests_create.txt
+print_requests.py --nostamp //jobs/ | gron.py --sort-arrays access_control_list > out.requests_create.txt
 
 trace $CLI bundle plan
 
 job_id="$(read_id.py job_with_permissions)"
 # display_name is omitted from cloud responses for freshly-created principals; drop it for parity with local mock.
 $CLI permissions get jobs "$job_id" | gron.py --sort-arrays access_control_list | grep -v display_name > out.permissions_create.txt
-rm -f out.requests.txt
+rm -f "$OUT_REQUESTS"
 
 title "Delete one permission and deploy again\n"
 grep -v DELETE databricks.yml > tmp.yml && mv tmp.yml databricks.yml
 trace $CLI bundle deploy
-print_requests.py //jobs/ | gron.py --sort-arrays access_control_list > out.requests_update.txt
+print_requests.py --nostamp //jobs/ | gron.py --sort-arrays access_control_list > out.requests_update.txt
 
 $CLI permissions get jobs "$job_id" | gron.py --sort-arrays access_control_list | grep -v display_name > out.permissions_update.txt
-rm -f out.requests.txt
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/resources/permissions/jobs/delete_one/test.toml b/acceptance/bundle/resources/permissions/jobs/delete_one/test.toml
index f993a98ecc7..e092f1593e9 100644
--- a/acceptance/bundle/resources/permissions/jobs/delete_one/test.toml
+++ b/acceptance/bundle/resources/permissions/jobs/delete_one/test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = true
 IsServicePrincipal = true
-RequiresUnityCatalog = true
diff --git a/acceptance/bundle/resources/permissions/jobs/deleted_remotely/out.plan_create.direct.json b/acceptance/bundle/resources/permissions/jobs/deleted_remotely/out.plan_create.direct.json
deleted file mode 100644
index 8d6a2b16688..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/deleted_remotely/out.plan_create.direct.json
+++ /dev/null
@@ -1,64 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.job_with_permissions": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/jobs-permissions-deleted-remotely/default/state/metadata.json"
-          },
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "job permissions deleted remotely",
-          "queue": {
-            "enabled": true
-          },
-          "tasks": [
-            {
-              "notebook_task": {
-                "notebook_path": "/Workspace/Users/user@example.com/notebook",
-                "source": "WORKSPACE"
-              },
-              "task_key": "main"
-            }
-          ]
-        }
-      }
-    },
-    "resources.jobs.job_with_permissions.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.job_with_permissions",
-          "label": "${resources.jobs.job_with_permissions.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "CAN_VIEW",
-              "user_name": "viewer@example.com"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "group_name": "data-team"
-            },
-            {
-              "level": "IS_OWNER",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/jobs/${resources.jobs.job_with_permissions.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/deleted_remotely/out.plan_create.json b/acceptance/bundle/resources/permissions/jobs/deleted_remotely/out.plan_create.json
new file mode 100644
index 00000000000..daa21cd2213
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/jobs/deleted_remotely/out.plan_create.json
@@ -0,0 +1,64 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.jobs.job_with_permissions": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/jobs-permissions-deleted-remotely/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "job permissions deleted remotely",
+          "queue": {
+            "enabled": true
+          },
+          "tasks": [
+            {
+              "notebook_task": {
+                "notebook_path": "/Workspace/Users/user@example.com/notebook",
+                "source": "WORKSPACE"
+              },
+              "task_key": "main"
+            }
+          ]
+        }
+      }
+    },
+    "resources.jobs.job_with_permissions.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.job_with_permissions",
+          "label": "${resources.jobs.job_with_permissions.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "CAN_VIEW",
+              "user_name": "viewer@example.com"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "group_name": "data-team"
+            },
+            {
+              "level": "IS_OWNER",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/jobs/${resources.jobs.job_with_permissions.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/jobs/deleted_remotely/out.plan_create.terraform.json b/acceptance/bundle/resources/permissions/jobs/deleted_remotely/out.plan_create.terraform.json
deleted file mode 100644
index 839b2168abe..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/deleted_remotely/out.plan_create.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.job_with_permissions": {
-      "action": "create"
-    },
-    "resources.jobs.job_with_permissions.permissions": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/deleted_remotely/out.plan_restore.direct.json b/acceptance/bundle/resources/permissions/jobs/deleted_remotely/out.plan_restore.direct.json
deleted file mode 100644
index eabc091bb36..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/deleted_remotely/out.plan_restore.direct.json
+++ /dev/null
@@ -1,136 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.jobs.job_with_permissions": {
-      "action": "skip",
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/jobs-permissions-deleted-remotely/default/state/metadata.json"
-        },
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_id": [JOB_WITH_PERMISSIONS_ID],
-        "max_concurrent_runs": 1,
-        "name": "job permissions deleted remotely",
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "tasks": [
-          {
-            "email_notifications": {},
-            "notebook_task": {
-              "notebook_path": "/Workspace/Users/user@example.com/notebook",
-              "source": "WORKSPACE"
-            },
-            "run_if": "ALL_SUCCESS",
-            "task_key": "main",
-            "timeout_seconds": 0
-          }
-        ],
-        "timeout_seconds": 0,
-        "webhook_notifications": {}
-      },
-      "changes": {
-        "email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks[task_key='main'].email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks[task_key='main'].run_if": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "ALL_SUCCESS"
-        },
-        "tasks[task_key='main'].timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "webhook_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        }
-      }
-    },
-    "resources.jobs.job_with_permissions.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.job_with_permissions",
-          "label": "${resources.jobs.job_with_permissions.id}"
-        }
-      ],
-      "action": "update",
-      "new_state": {
-        "value": {
-          "object_id": "/jobs/[JOB_WITH_PERMISSIONS_ID]",
-          "__embed__": [
-            {
-              "level": "CAN_VIEW",
-              "user_name": "viewer@example.com"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "group_name": "data-team"
-            },
-            {
-              "level": "IS_OWNER",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        }
-      },
-      "remote_state": {
-        "object_id": "/jobs/[JOB_WITH_PERMISSIONS_ID]",
-        "__embed__": [
-          {
-            "level": "IS_OWNER",
-            "user_name": "[USERNAME]"
-          }
-        ]
-      },
-      "changes": {
-        "[group_name='data-team']": {
-          "action": "update",
-          "old": {
-            "level": "CAN_MANAGE",
-            "group_name": "data-team"
-          },
-          "new": {
-            "level": "CAN_MANAGE",
-            "group_name": "data-team"
-          }
-        },
-        "[user_name='viewer@example.com']": {
-          "action": "update",
-          "old": {
-            "level": "CAN_VIEW",
-            "user_name": "viewer@example.com"
-          },
-          "new": {
-            "level": "CAN_VIEW",
-            "user_name": "viewer@example.com"
-          }
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/deleted_remotely/out.plan_restore.json b/acceptance/bundle/resources/permissions/jobs/deleted_remotely/out.plan_restore.json
new file mode 100644
index 00000000000..d3172a577fe
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/jobs/deleted_remotely/out.plan_restore.json
@@ -0,0 +1,136 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.jobs.job_with_permissions": {
+      "action": "skip",
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/jobs-permissions-deleted-remotely/default/state/metadata.json"
+        },
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_id": [JOB_WITH_PERMISSIONS_ID],
+        "max_concurrent_runs": 1,
+        "name": "job permissions deleted remotely",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "tasks": [
+          {
+            "email_notifications": {},
+            "notebook_task": {
+              "notebook_path": "/Workspace/Users/user@example.com/notebook",
+              "source": "WORKSPACE"
+            },
+            "run_if": "ALL_SUCCESS",
+            "task_key": "main",
+            "timeout_seconds": 0
+          }
+        ],
+        "timeout_seconds": 0,
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='main'].email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='main'].run_if": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": "ALL_SUCCESS"
+        },
+        "tasks[task_key='main'].timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    },
+    "resources.jobs.job_with_permissions.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.job_with_permissions",
+          "label": "${resources.jobs.job_with_permissions.id}"
+        }
+      ],
+      "action": "update",
+      "new_state": {
+        "value": {
+          "object_id": "/jobs/[JOB_WITH_PERMISSIONS_ID]",
+          "__embed__": [
+            {
+              "level": "CAN_VIEW",
+              "user_name": "viewer@example.com"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "group_name": "data-team"
+            },
+            {
+              "level": "IS_OWNER",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        }
+      },
+      "remote_state": {
+        "object_id": "/jobs/[JOB_WITH_PERMISSIONS_ID]",
+        "__embed__": [
+          {
+            "level": "IS_OWNER",
+            "user_name": "[USERNAME]"
+          }
+        ]
+      },
+      "changes": {
+        "[group_name='data-team']": {
+          "action": "update",
+          "old": {
+            "level": "CAN_MANAGE",
+            "group_name": "data-team"
+          },
+          "new": {
+            "level": "CAN_MANAGE",
+            "group_name": "data-team"
+          }
+        },
+        "[user_name='viewer@example.com']": {
+          "action": "update",
+          "old": {
+            "level": "CAN_VIEW",
+            "user_name": "viewer@example.com"
+          },
+          "new": {
+            "level": "CAN_VIEW",
+            "user_name": "viewer@example.com"
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/jobs/deleted_remotely/out.plan_restore.terraform.json b/acceptance/bundle/resources/permissions/jobs/deleted_remotely/out.plan_restore.terraform.json
deleted file mode 100644
index a88eeedacc0..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/deleted_remotely/out.plan_restore.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.job_with_permissions": {
-      "action": "skip"
-    },
-    "resources.jobs.job_with_permissions.permissions": {
-      "action": "update"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/deleted_remotely/out.test.toml b/acceptance/bundle/resources/permissions/jobs/deleted_remotely/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/permissions/jobs/deleted_remotely/out.test.toml
+++ b/acceptance/bundle/resources/permissions/jobs/deleted_remotely/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/permissions/jobs/deleted_remotely/output.txt b/acceptance/bundle/resources/permissions/jobs/deleted_remotely/output.txt
index 2493f03161d..3dbeecb21c7 100644
--- a/acceptance/bundle/resources/permissions/jobs/deleted_remotely/output.txt
+++ b/acceptance/bundle/resources/permissions/jobs/deleted_remotely/output.txt
@@ -3,11 +3,12 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/jobs-permissions-deleted-remotely/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.job_with_permissions
+Created jobs.job_with_permissions.permissions
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
->>> print_requests
+>>> print_requests.py --nostamp //jobs/
 
 >>> [CLI] permissions get jobs [JOB_WITH_PERMISSIONS_ID]
 {
@@ -89,7 +90,7 @@ Deployment complete!
   "object_type": "job"
 }
 
->>> print_requests
+>>> print_requests.py --nostamp //jobs/
 {
   "method": "PUT",
   "path": "/api/2.0/permissions/jobs/[JOB_WITH_PERMISSIONS_ID]",
@@ -107,11 +108,11 @@ Deployment complete!
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/jobs-permissions-deleted-remotely/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated jobs.job_with_permissions.permissions
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 1 unchanged
 
->>> print_requests
+>>> print_requests.py --nostamp //jobs/
 
 >>> [CLI] permissions get jobs [JOB_WITH_PERMISSIONS_ID]
 {
diff --git a/acceptance/bundle/resources/permissions/jobs/deleted_remotely/script b/acceptance/bundle/resources/permissions/jobs/deleted_remotely/script
index a21c8f9b11e..cd9293b8f19 100644
--- a/acceptance/bundle/resources/permissions/jobs/deleted_remotely/script
+++ b/acceptance/bundle/resources/permissions/jobs/deleted_remotely/script
@@ -1,24 +1,19 @@
-print_requests() {
-    jq 'select(.path | contains("/jobs/")) | select(.method != "GET")' < out.requests.txt
-    rm out.requests.txt
-}
-
-trace $CLI bundle plan -o json > out.plan_create.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.plan_create.json
 trace $CLI bundle deploy
-trace print_requests > out.requests_create.json
+trace print_requests.py --nostamp //jobs/ > out.requests_create.json
 
 job_id="$(read_id.py job_with_permissions)"
 
 trace $CLI permissions get jobs "$job_id"
-rm -f out.requests.txt
+rm -f "$OUT_REQUESTS"
 
 title "Delete permissions remotely"
 trace $CLI permissions set jobs "$job_id" --json @remote_delete.json
-trace print_requests
+trace print_requests.py --nostamp //jobs/
 
-trace $CLI bundle plan -o json > out.plan_restore.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.plan_restore.json
 trace $CLI bundle deploy
-trace print_requests > out.requests_restore.json
+trace print_requests.py --nostamp //jobs/ > out.requests_restore.json
 
 trace $CLI permissions get jobs "$job_id"
-rm -f out.requests.txt
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/with_permissions/out.destroy.direct.txt b/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/with_permissions/out.destroy.direct.txt
deleted file mode 100644
index 26b515960bb..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/with_permissions/out.destroy.direct.txt
+++ /dev/null
@@ -1,12 +0,0 @@
-
->>> errcode as-test-sp [CLI] bundle destroy --auto-approve
-Warn: reading resources.jobs.foo.permissions id="/jobs/[NUMID]": [UUID] does not have Manage permissions on Job with ID: ElasticJobId([NUMID]). Please contact the owner or an administrator for access.
-Warn: reading resources.jobs.foo id="[NUMID]": User [UUID] does not have View or Admin or Manage Run or Owner permissions on job [NUMID]
-The following resources will be deleted:
-  delete resources.jobs.foo
-
-All files and directories at the following location will be deleted: /Workspace/Users/[UUID]/.bundle/test-bundle-[UNIQUE_NAME]/default
-
-Warn: Ignoring permission error when deleting resources.jobs.foo id=[NUMID]: User [UUID] does not have Admin or Owner permissions on job [NUMID]
-Deleting files...
-Destroy complete!
diff --git a/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/with_permissions/out.destroy.terraform.txt b/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/with_permissions/out.destroy.terraform.txt
deleted file mode 100644
index 63df03545dd..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/with_permissions/out.destroy.terraform.txt
+++ /dev/null
@@ -1,14 +0,0 @@
-
->>> errcode as-test-sp [CLI] bundle destroy --auto-approve
-Error: exit status 1
-
-Error: cannot read job: User [UUID] does not have View or Admin or Manage Run or Owner permissions on job [NUMID]
-
-  with databricks_job.foo,
-  on bundle.tf.json line 27, in resource.databricks_job.foo:
-  27:       }
-
-
-
-
-Exit code: 1
diff --git a/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/with_permissions/out.destroy.txt b/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/with_permissions/out.destroy.txt
new file mode 100644
index 00000000000..f770ebfac73
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/with_permissions/out.destroy.txt
@@ -0,0 +1,10 @@
+
+>>> errcode as-test-sp [CLI] bundle destroy --auto-approve
+Warn: planning resources.jobs.foo: reading resources.jobs.foo id="[FOO_ID]": User [TEST_SP_APPLICATION_ID] does not have View or Admin or Manage Run or Owner permissions on job [FOO_ID]
+The following resources will be deleted:
+  delete resources.jobs.foo
+
+All files and directories at the following location will be deleted: /Workspace/Users/[TEST_SP_APPLICATION_ID]/.bundle/test-bundle-[UNIQUE_NAME]/default
+
+Warn: destroying resources.jobs.foo: Ignoring permission error when deleting resources.jobs.foo id=[FOO_ID]: User [TEST_SP_APPLICATION_ID] does not have Admin or Owner permissions on job [FOO_ID]
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/with_permissions/out.test.toml b/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/with_permissions/out.test.toml
index 4037e35bf87..5f2da118288 100644
--- a/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/with_permissions/out.test.toml
+++ b/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/with_permissions/out.test.toml
@@ -1,6 +1,5 @@
-Local = false
 Cloud = true
 RunsOnDbr = false
 CloudEnvs.azure = false
 CloudEnvs.gcp = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/with_permissions/output.txt b/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/with_permissions/output.txt
index 205ee91ea7c..f875db24c7a 100644
--- a/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/with_permissions/output.txt
+++ b/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/with_permissions/output.txt
@@ -5,20 +5,21 @@
 }
 
 >>> as-test-sp [CLI] current-user me
-"deco-test-spn"
+"[TEST_SP_APPLICATION_ID]"
 
 >>> [CLI] bundle destroy --auto-approve
 No active deployment found to destroy!
 
 >>> as-test-sp [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[UUID]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Uploading bundle files to /Workspace/Users/[TEST_SP_APPLICATION_ID]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Created jobs.foo
+Created jobs.foo.permissions
+Files: 4 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
->>> [CLI] permissions set jobs [NUMID] --json @take_ownership.json
+>>> [CLI] permissions set jobs [FOO_ID] --json @take_ownership.json
 
->>> [CLI] jobs delete [NUMID]
+>>> [CLI] jobs delete [FOO_ID]
 
->>> musterr [CLI] jobs get [NUMID]
-Error: Job [NUMID] does not exist.
+>>> musterr [CLI] jobs get [FOO_ID]
+Error: Job [FOO_ID] does not exist.
diff --git a/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/with_permissions/script b/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/with_permissions/script
index 94eb3132dbb..fae93344fc0 100644
--- a/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/with_permissions/script
+++ b/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/with_permissions/script
@@ -1,8 +1,19 @@
+if [ -z "${TEST_SP_APPLICATION_ID:-}" ]; then
+    # Falls back to the fixed userName the testserver reports for the as-test-sp
+    # guest, used whenever the env does not provide a real application_id (locally).
+    export TEST_SP_APPLICATION_ID="aaaaaaaa-bbbb-4ccc-dddd-eeeeeeeeeeee"
+fi
+# Mask the test SP's application_id (its userName) to a dedicated placeholder so
+# the assertion is env-independent instead of collapsing into the generic [UUID].
+add_repl "$TEST_SP_APPLICATION_ID" TEST_SP_APPLICATION_ID
+
 envsubst < databricks.yml.tmpl > databricks.yml
-envsubst < take_ownership.json.tmpl > take_ownership.json
+# Locally DATABRICKS_CLIENT_ID is unset; fall back to the current identity so the
+# owner matches cloud. Scoped to this command so CLI auth is unaffected.
+DATABRICKS_CLIENT_ID="${DATABRICKS_CLIENT_ID:-$CURRENT_USER_NAME}" envsubst < take_ownership.json.tmpl > take_ownership.json
 trace cat take_ownership.json
 
-trace as-test-sp $CLI current-user me | jq .displayName
+trace as-test-sp $CLI current-user me | jq .userName
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
@@ -11,7 +22,10 @@ cleanup EXIT
 
 trace as-test-sp $CLI bundle deploy
 
-job_id=$($CLI bundle summary --output json | jq -r '.resources.jobs.foo.id')
+# Read the summary as the deploying identity: under recording the state lives in that
+# identity's deployment record, which another identity does not resolve.
+job_id=$(as-test-sp $CLI bundle summary --output json | jq -r '.resources.jobs.foo.id')
+add_repl "$job_id" FOO_ID
 
 trace $CLI permissions set jobs $job_id --json @take_ownership.json > /dev/null
 
@@ -19,4 +33,4 @@ trace $CLI jobs delete $job_id
 trace musterr $CLI jobs get $job_id
 
 # This shows that even if job is deleted, you still get permission error when trying to delete it.
-trace errcode as-test-sp $CLI bundle destroy --auto-approve &> out.destroy.$DATABRICKS_BUNDLE_ENGINE.txt
+trace errcode as-test-sp $CLI bundle destroy --auto-approve &> out.destroy.txt
diff --git a/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/with_permissions/test.toml b/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/with_permissions/test.toml
index b6d371ec608..d7853968385 100644
--- a/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/with_permissions/test.toml
+++ b/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/with_permissions/test.toml
@@ -1,4 +1,3 @@
-Local = false
 Cloud = true
 RecordRequests = false
 CloudEnvs.gcp = false
diff --git a/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/without_permissions/out.destroy.direct.txt b/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/without_permissions/out.destroy.direct.txt
deleted file mode 100644
index bf1ebcb7376..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/without_permissions/out.destroy.direct.txt
+++ /dev/null
@@ -1,11 +0,0 @@
-
->>> errcode as-test-sp [CLI] bundle destroy --auto-approve
-Warn: reading resources.jobs.foo id="[NUMID]": User [UUID] does not have View or Admin or Manage Run or Owner permissions on job [NUMID]
-The following resources will be deleted:
-  delete resources.jobs.foo
-
-All files and directories at the following location will be deleted: /Workspace/Users/[UUID]/.bundle/test-bundle-[UNIQUE_NAME]/default
-
-Warn: Ignoring permission error when deleting resources.jobs.foo id=[NUMID]: User [UUID] does not have Admin or Owner permissions on job [NUMID]
-Deleting files...
-Destroy complete!
diff --git a/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/without_permissions/out.destroy.terraform.txt b/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/without_permissions/out.destroy.terraform.txt
deleted file mode 100644
index 63df03545dd..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/without_permissions/out.destroy.terraform.txt
+++ /dev/null
@@ -1,14 +0,0 @@
-
->>> errcode as-test-sp [CLI] bundle destroy --auto-approve
-Error: exit status 1
-
-Error: cannot read job: User [UUID] does not have View or Admin or Manage Run or Owner permissions on job [NUMID]
-
-  with databricks_job.foo,
-  on bundle.tf.json line 27, in resource.databricks_job.foo:
-  27:       }
-
-
-
-
-Exit code: 1
diff --git a/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/without_permissions/out.destroy.txt b/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/without_permissions/out.destroy.txt
new file mode 100644
index 00000000000..f770ebfac73
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/without_permissions/out.destroy.txt
@@ -0,0 +1,10 @@
+
+>>> errcode as-test-sp [CLI] bundle destroy --auto-approve
+Warn: planning resources.jobs.foo: reading resources.jobs.foo id="[FOO_ID]": User [TEST_SP_APPLICATION_ID] does not have View or Admin or Manage Run or Owner permissions on job [FOO_ID]
+The following resources will be deleted:
+  delete resources.jobs.foo
+
+All files and directories at the following location will be deleted: /Workspace/Users/[TEST_SP_APPLICATION_ID]/.bundle/test-bundle-[UNIQUE_NAME]/default
+
+Warn: destroying resources.jobs.foo: Ignoring permission error when deleting resources.jobs.foo id=[FOO_ID]: User [TEST_SP_APPLICATION_ID] does not have Admin or Owner permissions on job [FOO_ID]
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/without_permissions/out.test.toml b/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/without_permissions/out.test.toml
index 4037e35bf87..5f2da118288 100644
--- a/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/without_permissions/out.test.toml
+++ b/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/without_permissions/out.test.toml
@@ -1,6 +1,5 @@
-Local = false
 Cloud = true
 RunsOnDbr = false
 CloudEnvs.azure = false
 CloudEnvs.gcp = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/without_permissions/output.txt b/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/without_permissions/output.txt
index 205ee91ea7c..b9c92e84ee1 100644
--- a/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/without_permissions/output.txt
+++ b/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/without_permissions/output.txt
@@ -5,20 +5,20 @@
 }
 
 >>> as-test-sp [CLI] current-user me
-"deco-test-spn"
+"[TEST_SP_APPLICATION_ID]"
 
 >>> [CLI] bundle destroy --auto-approve
 No active deployment found to destroy!
 
 >>> as-test-sp [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[UUID]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Uploading bundle files to /Workspace/Users/[TEST_SP_APPLICATION_ID]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Created jobs.foo
+Files: 4 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
->>> [CLI] permissions set jobs [NUMID] --json @take_ownership.json
+>>> [CLI] permissions set jobs [FOO_ID] --json @take_ownership.json
 
->>> [CLI] jobs delete [NUMID]
+>>> [CLI] jobs delete [FOO_ID]
 
->>> musterr [CLI] jobs get [NUMID]
-Error: Job [NUMID] does not exist.
+>>> musterr [CLI] jobs get [FOO_ID]
+Error: Job [FOO_ID] does not exist.
diff --git a/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/without_permissions/script b/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/without_permissions/script
index 94eb3132dbb..fae93344fc0 100644
--- a/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/without_permissions/script
+++ b/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/without_permissions/script
@@ -1,8 +1,19 @@
+if [ -z "${TEST_SP_APPLICATION_ID:-}" ]; then
+    # Falls back to the fixed userName the testserver reports for the as-test-sp
+    # guest, used whenever the env does not provide a real application_id (locally).
+    export TEST_SP_APPLICATION_ID="aaaaaaaa-bbbb-4ccc-dddd-eeeeeeeeeeee"
+fi
+# Mask the test SP's application_id (its userName) to a dedicated placeholder so
+# the assertion is env-independent instead of collapsing into the generic [UUID].
+add_repl "$TEST_SP_APPLICATION_ID" TEST_SP_APPLICATION_ID
+
 envsubst < databricks.yml.tmpl > databricks.yml
-envsubst < take_ownership.json.tmpl > take_ownership.json
+# Locally DATABRICKS_CLIENT_ID is unset; fall back to the current identity so the
+# owner matches cloud. Scoped to this command so CLI auth is unaffected.
+DATABRICKS_CLIENT_ID="${DATABRICKS_CLIENT_ID:-$CURRENT_USER_NAME}" envsubst < take_ownership.json.tmpl > take_ownership.json
 trace cat take_ownership.json
 
-trace as-test-sp $CLI current-user me | jq .displayName
+trace as-test-sp $CLI current-user me | jq .userName
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
@@ -11,7 +22,10 @@ cleanup EXIT
 
 trace as-test-sp $CLI bundle deploy
 
-job_id=$($CLI bundle summary --output json | jq -r '.resources.jobs.foo.id')
+# Read the summary as the deploying identity: under recording the state lives in that
+# identity's deployment record, which another identity does not resolve.
+job_id=$(as-test-sp $CLI bundle summary --output json | jq -r '.resources.jobs.foo.id')
+add_repl "$job_id" FOO_ID
 
 trace $CLI permissions set jobs $job_id --json @take_ownership.json > /dev/null
 
@@ -19,4 +33,4 @@ trace $CLI jobs delete $job_id
 trace musterr $CLI jobs get $job_id
 
 # This shows that even if job is deleted, you still get permission error when trying to delete it.
-trace errcode as-test-sp $CLI bundle destroy --auto-approve &> out.destroy.$DATABRICKS_BUNDLE_ENGINE.txt
+trace errcode as-test-sp $CLI bundle destroy --auto-approve &> out.destroy.txt
diff --git a/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/without_permissions/test.toml b/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/without_permissions/test.toml
index b6d371ec608..d7853968385 100644
--- a/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/without_permissions/test.toml
+++ b/acceptance/bundle/resources/permissions/jobs/destroy_without_mgmtperms/without_permissions/test.toml
@@ -1,4 +1,3 @@
-Local = false
 Cloud = true
 RecordRequests = false
 CloudEnvs.gcp = false
diff --git a/acceptance/bundle/resources/permissions/jobs/empty_list/out.plan.direct.json b/acceptance/bundle/resources/permissions/jobs/empty_list/out.plan.direct.json
deleted file mode 100644
index e273c518dbb..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/empty_list/out.plan.direct.json
+++ /dev/null
@@ -1,33 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.foo": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "job1",
-          "queue": {
-            "enabled": true
-          },
-          "tasks": [
-            {
-              "notebook_task": {
-                "notebook_path": "/Workspace/Users/user@example.com/notebook",
-                "source": "WORKSPACE"
-              },
-              "task_key": "main"
-            }
-          ]
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/empty_list/out.plan.json b/acceptance/bundle/resources/permissions/jobs/empty_list/out.plan.json
new file mode 100644
index 00000000000..67f3f809b7d
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/jobs/empty_list/out.plan.json
@@ -0,0 +1,33 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.jobs.foo": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "job1",
+          "queue": {
+            "enabled": true
+          },
+          "tasks": [
+            {
+              "notebook_task": {
+                "notebook_path": "/Workspace/Users/user@example.com/notebook",
+                "source": "WORKSPACE"
+              },
+              "task_key": "main"
+            }
+          ]
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/jobs/empty_list/out.plan.terraform.json b/acceptance/bundle/resources/permissions/jobs/empty_list/out.plan.terraform.json
deleted file mode 100644
index b1dce3fac0f..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/empty_list/out.plan.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.foo": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/update/out.requests_set_empty.direct.json b/acceptance/bundle/resources/permissions/jobs/empty_list/out.requests.deploy.json
similarity index 100%
rename from acceptance/bundle/resources/permissions/jobs/update/out.requests_set_empty.direct.json
rename to acceptance/bundle/resources/permissions/jobs/empty_list/out.requests.deploy.json
diff --git a/acceptance/bundle/resources/permissions/jobs/update/out.requests_set_empty.terraform.json b/acceptance/bundle/resources/permissions/jobs/empty_list/out.requests.destroy.json
similarity index 100%
rename from acceptance/bundle/resources/permissions/jobs/update/out.requests_set_empty.terraform.json
rename to acceptance/bundle/resources/permissions/jobs/empty_list/out.requests.destroy.json
diff --git a/acceptance/bundle/resources/permissions/jobs/empty_list/out.test.toml b/acceptance/bundle/resources/permissions/jobs/empty_list/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/permissions/jobs/empty_list/out.test.toml
+++ b/acceptance/bundle/resources/permissions/jobs/empty_list/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/permissions/jobs/empty_list/output.txt b/acceptance/bundle/resources/permissions/jobs/empty_list/output.txt
index ec71aa04be9..474bb214214 100644
--- a/acceptance/bundle/resources/permissions/jobs/empty_list/output.txt
+++ b/acceptance/bundle/resources/permissions/jobs/empty_list/output.txt
@@ -4,9 +4,9 @@ null
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.foo
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
@@ -14,5 +14,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/permissions/jobs/other_can_manage/out.plan.direct.json b/acceptance/bundle/resources/permissions/jobs/other_can_manage/out.plan.direct.json
deleted file mode 100644
index ed2a8fb2bef..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/other_can_manage/out.plan.direct.json
+++ /dev/null
@@ -1,68 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.foo": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "job1",
-          "queue": {
-            "enabled": true
-          },
-          "tasks": [
-            {
-              "notebook_task": {
-                "notebook_path": "/Workspace/Users/user@example.com/notebook",
-                "source": "WORKSPACE"
-              },
-              "task_key": "main"
-            }
-          ]
-        }
-      }
-    },
-    "resources.jobs.foo.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.foo",
-          "label": "${resources.jobs.foo.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "CAN_VIEW",
-              "user_name": "viewer@example.com"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "group_name": "data-team"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "service_principal_name": "[UUID]"
-            },
-            {
-              "level": "IS_OWNER",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/jobs/${resources.jobs.foo.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/other_can_manage/out.plan.json b/acceptance/bundle/resources/permissions/jobs/other_can_manage/out.plan.json
new file mode 100644
index 00000000000..eb77fd33747
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/jobs/other_can_manage/out.plan.json
@@ -0,0 +1,68 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.jobs.foo": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "job1",
+          "queue": {
+            "enabled": true
+          },
+          "tasks": [
+            {
+              "notebook_task": {
+                "notebook_path": "/Workspace/Users/user@example.com/notebook",
+                "source": "WORKSPACE"
+              },
+              "task_key": "main"
+            }
+          ]
+        }
+      }
+    },
+    "resources.jobs.foo.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.foo",
+          "label": "${resources.jobs.foo.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "CAN_VIEW",
+              "user_name": "viewer@example.com"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "group_name": "data-team"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "service_principal_name": "[UUID]"
+            },
+            {
+              "level": "IS_OWNER",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/jobs/${resources.jobs.foo.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/jobs/other_can_manage/out.plan.terraform.json b/acceptance/bundle/resources/permissions/jobs/other_can_manage/out.plan.terraform.json
deleted file mode 100644
index 41071059f89..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/other_can_manage/out.plan.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.foo": {
-      "action": "create"
-    },
-    "resources.jobs.foo.permissions": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/other_can_manage/out.requests.deploy.direct.json b/acceptance/bundle/resources/permissions/jobs/other_can_manage/out.requests.deploy.direct.json
deleted file mode 100644
index 5647c1a73b9..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/other_can_manage/out.requests.deploy.direct.json
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/jobs/[NUMID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_VIEW",
-        "user_name": "viewer@example.com"
-      },
-      {
-        "group_name": "data-team",
-        "permission_level": "CAN_MANAGE"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "service_principal_name": "[UUID]"
-      },
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/other_can_manage/out.requests.deploy.json b/acceptance/bundle/resources/permissions/jobs/other_can_manage/out.requests.deploy.json
new file mode 100644
index 00000000000..47781d53496
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/jobs/other_can_manage/out.requests.deploy.json
@@ -0,0 +1,24 @@
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/jobs/[FOO_ID]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "CAN_VIEW",
+        "user_name": "viewer@example.com"
+      },
+      {
+        "group_name": "data-team",
+        "permission_level": "CAN_MANAGE"
+      },
+      {
+        "permission_level": "CAN_MANAGE",
+        "service_principal_name": "[UUID]"
+      },
+      {
+        "permission_level": "IS_OWNER",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/jobs/other_can_manage/out.requests.deploy.terraform.json b/acceptance/bundle/resources/permissions/jobs/other_can_manage/out.requests.deploy.terraform.json
deleted file mode 100644
index 8c15422e36c..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/other_can_manage/out.requests.deploy.terraform.json
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/jobs/[NUMID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_VIEW",
-        "user_name": "viewer@example.com"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "service_principal_name": "[UUID]"
-      },
-      {
-        "group_name": "data-team",
-        "permission_level": "CAN_MANAGE"
-      },
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/viewers/out.requests.destroy.direct.json b/acceptance/bundle/resources/permissions/jobs/other_can_manage/out.requests.destroy.json
similarity index 100%
rename from acceptance/bundle/resources/permissions/jobs/viewers/out.requests.destroy.direct.json
rename to acceptance/bundle/resources/permissions/jobs/other_can_manage/out.requests.destroy.json
diff --git a/acceptance/bundle/resources/permissions/jobs/other_can_manage/out.requests.destroy.terraform.json b/acceptance/bundle/resources/permissions/jobs/other_can_manage/out.requests.destroy.terraform.json
deleted file mode 100644
index f7aa2dbaa0d..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/other_can_manage/out.requests.destroy.terraform.json
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/jobs/[NUMID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/other_can_manage/out.test.toml b/acceptance/bundle/resources/permissions/jobs/other_can_manage/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/permissions/jobs/other_can_manage/out.test.toml
+++ b/acceptance/bundle/resources/permissions/jobs/other_can_manage/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/permissions/jobs/other_can_manage/output.txt b/acceptance/bundle/resources/permissions/jobs/other_can_manage/output.txt
index 8d21073e1c8..29265355cd1 100644
--- a/acceptance/bundle/resources/permissions/jobs/other_can_manage/output.txt
+++ b/acceptance/bundle/resources/permissions/jobs/other_can_manage/output.txt
@@ -21,9 +21,10 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.foo
+Created jobs.foo.permissions
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
@@ -31,5 +32,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/permissions/jobs/other_can_manage_run/out.deploy.requests.json b/acceptance/bundle/resources/permissions/jobs/other_can_manage_run/out.deploy.requests.json
index f73e509a376..8c03b139400 100644
--- a/acceptance/bundle/resources/permissions/jobs/other_can_manage_run/out.deploy.requests.json
+++ b/acceptance/bundle/resources/permissions/jobs/other_can_manage_run/out.deploy.requests.json
@@ -17,7 +17,7 @@
 }
 {
   "method": "PUT",
-  "path": "/api/2.0/permissions/jobs/[NUMID]",
+  "path": "/api/2.0/permissions/jobs/[INTERIM_GOLD_LAYER_JOB_ID]",
   "body": {
     "access_control_list": [
       {
diff --git a/acceptance/bundle/resources/permissions/jobs/other_can_manage_run/out.destroy.requests.direct.json b/acceptance/bundle/resources/permissions/jobs/other_can_manage_run/out.destroy.requests.direct.json
deleted file mode 100644
index 6564b6f8bde..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/other_can_manage_run/out.destroy.requests.direct.json
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-  "method": "POST",
-  "path": "/api/2.2/jobs/delete",
-  "body": {
-    "job_id": [NUMID]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/other_can_manage_run/out.destroy.requests.json b/acceptance/bundle/resources/permissions/jobs/other_can_manage_run/out.destroy.requests.json
new file mode 100644
index 00000000000..fa337fe39ce
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/jobs/other_can_manage_run/out.destroy.requests.json
@@ -0,0 +1,7 @@
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/delete",
+  "body": {
+    "job_id": [INTERIM_GOLD_LAYER_JOB_ID]
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/jobs/other_can_manage_run/out.destroy.requests.terraform.json b/acceptance/bundle/resources/permissions/jobs/other_can_manage_run/out.destroy.requests.terraform.json
deleted file mode 100644
index cd29de0d552..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/other_can_manage_run/out.destroy.requests.terraform.json
+++ /dev/null
@@ -1,19 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/jobs/[NUMID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.2/jobs/delete",
-  "body": {
-    "job_id": [NUMID]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/other_can_manage_run/out.test.toml b/acceptance/bundle/resources/permissions/jobs/other_can_manage_run/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/permissions/jobs/other_can_manage_run/out.test.toml
+++ b/acceptance/bundle/resources/permissions/jobs/other_can_manage_run/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/permissions/jobs/other_can_manage_run/output.txt b/acceptance/bundle/resources/permissions/jobs/other_can_manage_run/output.txt
index d4faa3048fe..fc7743001ff 100644
--- a/acceptance/bundle/resources/permissions/jobs/other_can_manage_run/output.txt
+++ b/acceptance/bundle/resources/permissions/jobs/other_can_manage_run/output.txt
@@ -30,9 +30,10 @@
 
 >>> errcode [CLI] bundle deploy -t green
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/green/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.interim_gold_layer_job
+Created jobs.interim_gold_layer_job.permissions
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> errcode [CLI] bundle destroy -t green --auto-approve
 The following resources will be deleted:
@@ -40,5 +41,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/green
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/permissions/jobs/other_can_manage_run/script b/acceptance/bundle/resources/permissions/jobs/other_can_manage_run/script
index 4c406d91cfa..3befc57af80 100644
--- a/acceptance/bundle/resources/permissions/jobs/other_can_manage_run/script
+++ b/acceptance/bundle/resources/permissions/jobs/other_can_manage_run/script
@@ -2,7 +2,8 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 trace $CLI bundle validate -t green -o json | jq .resources
 trace errcode $CLI bundle deploy -t green
-print_requests.py //jobs &> out.deploy.requests.json
+replace_ids.py -t green
+print_requests.py //jobs --nostamp &> out.deploy.requests.json
 
 trace errcode $CLI bundle destroy -t green --auto-approve
-print_requests.py //jobs &> out.destroy.requests.$DATABRICKS_BUNDLE_ENGINE.json
+print_requests.py //jobs --nostamp &> out.destroy.requests.json
diff --git a/acceptance/bundle/resources/permissions/jobs/other_can_manage_run/test.toml b/acceptance/bundle/resources/permissions/jobs/other_can_manage_run/test.toml
deleted file mode 100644
index 2713ce3c616..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/other_can_manage_run/test.toml
+++ /dev/null
@@ -1 +0,0 @@
-Local = true
diff --git a/acceptance/bundle/resources/permissions/jobs/other_is_owner/out.plan.direct.json b/acceptance/bundle/resources/permissions/jobs/other_is_owner/out.plan.direct.json
deleted file mode 100644
index 93bab7b3237..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/other_is_owner/out.plan.direct.json
+++ /dev/null
@@ -1,60 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.foo": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "job1",
-          "queue": {
-            "enabled": true
-          },
-          "tasks": [
-            {
-              "notebook_task": {
-                "notebook_path": "/Workspace/Users/user@example.com/notebook",
-                "source": "WORKSPACE"
-              },
-              "task_key": "main"
-            }
-          ]
-        }
-      }
-    },
-    "resources.jobs.foo.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.foo",
-          "label": "${resources.jobs.foo.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "IS_OWNER",
-              "user_name": "other_user@databricks.com"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/jobs/${resources.jobs.foo.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/other_is_owner/out.plan.json b/acceptance/bundle/resources/permissions/jobs/other_is_owner/out.plan.json
new file mode 100644
index 00000000000..a765ec398af
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/jobs/other_is_owner/out.plan.json
@@ -0,0 +1,60 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.jobs.foo": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "job1",
+          "queue": {
+            "enabled": true
+          },
+          "tasks": [
+            {
+              "notebook_task": {
+                "notebook_path": "/Workspace/Users/user@example.com/notebook",
+                "source": "WORKSPACE"
+              },
+              "task_key": "main"
+            }
+          ]
+        }
+      }
+    },
+    "resources.jobs.foo.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.foo",
+          "label": "${resources.jobs.foo.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "IS_OWNER",
+              "user_name": "other_user@databricks.com"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/jobs/${resources.jobs.foo.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/jobs/other_is_owner/out.plan.terraform.json b/acceptance/bundle/resources/permissions/jobs/other_is_owner/out.plan.terraform.json
deleted file mode 100644
index 41071059f89..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/other_is_owner/out.plan.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.foo": {
-      "action": "create"
-    },
-    "resources.jobs.foo.permissions": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/other_is_owner/out.requests.deploy.direct.json b/acceptance/bundle/resources/permissions/jobs/other_is_owner/out.requests.deploy.direct.json
deleted file mode 100644
index b1eb1519e87..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/other_is_owner/out.requests.deploy.direct.json
+++ /dev/null
@@ -1,16 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/jobs/[NUMID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "other_user@databricks.com"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/other_is_owner/out.requests.deploy.json b/acceptance/bundle/resources/permissions/jobs/other_is_owner/out.requests.deploy.json
new file mode 100644
index 00000000000..c43da51b594
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/jobs/other_is_owner/out.requests.deploy.json
@@ -0,0 +1,16 @@
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/jobs/[FOO_ID]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "IS_OWNER",
+        "user_name": "other_user@databricks.com"
+      },
+      {
+        "permission_level": "CAN_MANAGE",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/jobs/other_is_owner/out.requests.deploy.terraform.json b/acceptance/bundle/resources/permissions/jobs/other_is_owner/out.requests.deploy.terraform.json
deleted file mode 100644
index b1eb1519e87..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/other_is_owner/out.requests.deploy.terraform.json
+++ /dev/null
@@ -1,16 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/jobs/[NUMID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "other_user@databricks.com"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/models/current_can_manage/out.requests.destroy.direct.json b/acceptance/bundle/resources/permissions/jobs/other_is_owner/out.requests.destroy.json
similarity index 100%
rename from acceptance/bundle/resources/permissions/models/current_can_manage/out.requests.destroy.direct.json
rename to acceptance/bundle/resources/permissions/jobs/other_is_owner/out.requests.destroy.json
diff --git a/acceptance/bundle/resources/permissions/jobs/other_is_owner/out.requests.destroy.terraform.json b/acceptance/bundle/resources/permissions/jobs/other_is_owner/out.requests.destroy.terraform.json
deleted file mode 100644
index f7aa2dbaa0d..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/other_is_owner/out.requests.destroy.terraform.json
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/jobs/[NUMID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/other_is_owner/out.test.toml b/acceptance/bundle/resources/permissions/jobs/other_is_owner/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/permissions/jobs/other_is_owner/out.test.toml
+++ b/acceptance/bundle/resources/permissions/jobs/other_is_owner/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/permissions/jobs/other_is_owner/output.txt b/acceptance/bundle/resources/permissions/jobs/other_is_owner/output.txt
index 3c6e9775156..5b61e6a677b 100644
--- a/acceptance/bundle/resources/permissions/jobs/other_is_owner/output.txt
+++ b/acceptance/bundle/resources/permissions/jobs/other_is_owner/output.txt
@@ -13,9 +13,10 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.foo
+Created jobs.foo.permissions
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
@@ -23,5 +24,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/permissions/jobs/reorder_locally/out.test.toml b/acceptance/bundle/resources/permissions/jobs/reorder_locally/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/permissions/jobs/reorder_locally/out.test.toml
+++ b/acceptance/bundle/resources/permissions/jobs/reorder_locally/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/permissions/jobs/reorder_locally/output.txt b/acceptance/bundle/resources/permissions/jobs/reorder_locally/output.txt
index 73bedc7d337..0eb87dc9eab 100644
--- a/acceptance/bundle/resources/permissions/jobs/reorder_locally/output.txt
+++ b/acceptance/bundle/resources/permissions/jobs/reorder_locally/output.txt
@@ -1,18 +1,18 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.foo
+Created jobs.foo.permissions
+Files: 1 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle plan
 Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 2 unchanged
 
 >>> [CLI] bundle plan
 Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
diff --git a/acceptance/bundle/resources/permissions/jobs/reorder_remotely/out.test.toml b/acceptance/bundle/resources/permissions/jobs/reorder_remotely/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/permissions/jobs/reorder_remotely/out.test.toml
+++ b/acceptance/bundle/resources/permissions/jobs/reorder_remotely/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/permissions/jobs/reorder_remotely/output.txt b/acceptance/bundle/resources/permissions/jobs/reorder_remotely/output.txt
index b6052360bf7..faf5d38bdab 100644
--- a/acceptance/bundle/resources/permissions/jobs/reorder_remotely/output.txt
+++ b/acceptance/bundle/resources/permissions/jobs/reorder_remotely/output.txt
@@ -1,14 +1,15 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.foo
+Created jobs.foo.permissions
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle plan
 Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
 
->>> [CLI] permissions set jobs [NUMID] --json @reorder.json
+>>> [CLI] permissions set jobs [FOO_ID] --json @reorder.json
 
 >>> [CLI] bundle plan
 Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
diff --git a/acceptance/bundle/resources/permissions/jobs/reorder_remotely/script b/acceptance/bundle/resources/permissions/jobs/reorder_remotely/script
index 71389de5c9c..14ab774473d 100644
--- a/acceptance/bundle/resources/permissions/jobs/reorder_remotely/script
+++ b/acceptance/bundle/resources/permissions/jobs/reorder_remotely/script
@@ -1,7 +1,7 @@
 trace $CLI bundle deploy
 trace $CLI bundle plan | contains.py "2 unchanged"
 
-job_id=$($CLI bundle summary --output json | jq -r '.resources.jobs.foo.id')
+job_id=$(read_id.py foo)
 
 trace $CLI permissions set jobs $job_id --json @reorder.json > /dev/null
 
diff --git a/acceptance/bundle/resources/permissions/jobs/update/databricks.yml b/acceptance/bundle/resources/permissions/jobs/update/databricks.yml
index f92bf6da15a..33b69c81894 100644
--- a/acceptance/bundle/resources/permissions/jobs/update/databricks.yml
+++ b/acceptance/bundle/resources/permissions/jobs/update/databricks.yml
@@ -15,4 +15,4 @@ resources:
           user_name: viewer@example.com # PERMISSIONS
         - level: CAN_MANAGE # DELETE_ONE
           group_name: data-team # DELETE_ONE
-          # permissions: [] # EXPLICIT_EMPTY
+      # permissions: [] # EXPLICIT_EMPTY
diff --git a/acceptance/bundle/resources/permissions/jobs/update/out.plan_create.direct.json b/acceptance/bundle/resources/permissions/jobs/update/out.plan_create.direct.json
deleted file mode 100644
index 0d8250fd077..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/update/out.plan_create.direct.json
+++ /dev/null
@@ -1,64 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.job_with_permissions": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/jobs-permissions-test/default/state/metadata.json"
-          },
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "job with permissions",
-          "queue": {
-            "enabled": true
-          },
-          "tasks": [
-            {
-              "notebook_task": {
-                "notebook_path": "/Workspace/Users/user@example.com/notebook",
-                "source": "WORKSPACE"
-              },
-              "task_key": "main"
-            }
-          ]
-        }
-      }
-    },
-    "resources.jobs.job_with_permissions.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.job_with_permissions",
-          "label": "${resources.jobs.job_with_permissions.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "CAN_VIEW",
-              "user_name": "viewer@example.com"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "group_name": "data-team"
-            },
-            {
-              "level": "IS_OWNER",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/jobs/${resources.jobs.job_with_permissions.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/update/out.plan_create.json b/acceptance/bundle/resources/permissions/jobs/update/out.plan_create.json
new file mode 100644
index 00000000000..66d93b9d2f2
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/jobs/update/out.plan_create.json
@@ -0,0 +1,64 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.jobs.job_with_permissions": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/jobs-permissions-test/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "job with permissions",
+          "queue": {
+            "enabled": true
+          },
+          "tasks": [
+            {
+              "notebook_task": {
+                "notebook_path": "/Workspace/Users/user@example.com/notebook",
+                "source": "WORKSPACE"
+              },
+              "task_key": "main"
+            }
+          ]
+        }
+      }
+    },
+    "resources.jobs.job_with_permissions.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.job_with_permissions",
+          "label": "${resources.jobs.job_with_permissions.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "CAN_VIEW",
+              "user_name": "viewer@example.com"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "group_name": "data-team"
+            },
+            {
+              "level": "IS_OWNER",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/jobs/${resources.jobs.job_with_permissions.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/jobs/update/out.plan_create.terraform.json b/acceptance/bundle/resources/permissions/jobs/update/out.plan_create.terraform.json
deleted file mode 100644
index 839b2168abe..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/update/out.plan_create.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.job_with_permissions": {
-      "action": "create"
-    },
-    "resources.jobs.job_with_permissions.permissions": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/update/out.plan_delete_all.direct.json b/acceptance/bundle/resources/permissions/jobs/update/out.plan_delete_all.direct.json
deleted file mode 100644
index fe00099d2ae..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/update/out.plan_delete_all.direct.json
+++ /dev/null
@@ -1,97 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 3,
-  "plan": {
-    "resources.jobs.job_with_permissions": {
-      "action": "skip",
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/jobs-permissions-test/default/state/metadata.json"
-        },
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_id": [JOB_WITH_PERMISSIONS_ID],
-        "max_concurrent_runs": 1,
-        "name": "job with permissions",
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "tasks": [
-          {
-            "email_notifications": {},
-            "notebook_task": {
-              "notebook_path": "/Workspace/Users/user@example.com/notebook",
-              "source": "WORKSPACE"
-            },
-            "run_if": "ALL_SUCCESS",
-            "task_key": "main",
-            "timeout_seconds": 0
-          }
-        ],
-        "timeout_seconds": 0,
-        "webhook_notifications": {}
-      },
-      "changes": {
-        "email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks[task_key='main'].email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks[task_key='main'].run_if": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "ALL_SUCCESS"
-        },
-        "tasks[task_key='main'].timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "webhook_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        }
-      }
-    },
-    "resources.jobs.job_with_permissions.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.job_with_permissions",
-          "label": "${resources.jobs.job_with_permissions.id}"
-        }
-      ],
-      "action": "delete",
-      "remote_state": {
-        "object_id": "/jobs/[JOB_WITH_PERMISSIONS_ID]",
-        "__embed__": [
-          {
-            "level": "CAN_MANAGE",
-            "user_name": "viewer@example.com"
-          },
-          {
-            "level": "IS_OWNER",
-            "user_name": "[USERNAME]"
-          }
-        ]
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/update/out.plan_delete_all.json b/acceptance/bundle/resources/permissions/jobs/update/out.plan_delete_all.json
new file mode 100644
index 00000000000..b6cfa725c53
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/jobs/update/out.plan_delete_all.json
@@ -0,0 +1,85 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 3,
+  "plan": {
+    "resources.jobs.job_with_permissions": {
+      "action": "skip",
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/jobs-permissions-test/default/state/metadata.json"
+        },
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_id": [JOB_WITH_PERMISSIONS_ID],
+        "max_concurrent_runs": 1,
+        "name": "job with permissions",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "tasks": [
+          {
+            "email_notifications": {},
+            "notebook_task": {
+              "notebook_path": "/Workspace/Users/user@example.com/notebook",
+              "source": "WORKSPACE"
+            },
+            "run_if": "ALL_SUCCESS",
+            "task_key": "main",
+            "timeout_seconds": 0
+          }
+        ],
+        "timeout_seconds": 0,
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='main'].email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='main'].run_if": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": "ALL_SUCCESS"
+        },
+        "tasks[task_key='main'].timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    },
+    "resources.jobs.job_with_permissions.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.job_with_permissions",
+          "label": "${resources.jobs.job_with_permissions.id}"
+        }
+      ],
+      "action": "delete",
+      "state_only": true
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/jobs/update/out.plan_delete_all.terraform.json b/acceptance/bundle/resources/permissions/jobs/update/out.plan_delete_all.terraform.json
deleted file mode 100644
index 6283684f310..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/update/out.plan_delete_all.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.job_with_permissions": {
-      "action": "skip"
-    },
-    "resources.jobs.job_with_permissions.permissions": {
-      "action": "delete"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/update/out.plan_delete_one.direct.json b/acceptance/bundle/resources/permissions/jobs/update/out.plan_delete_one.direct.json
deleted file mode 100644
index 7c6b9f3f38f..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/update/out.plan_delete_one.direct.json
+++ /dev/null
@@ -1,129 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 2,
-  "plan": {
-    "resources.jobs.job_with_permissions": {
-      "action": "skip",
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/jobs-permissions-test/default/state/metadata.json"
-        },
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_id": [JOB_WITH_PERMISSIONS_ID],
-        "max_concurrent_runs": 1,
-        "name": "job with permissions",
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "tasks": [
-          {
-            "email_notifications": {},
-            "notebook_task": {
-              "notebook_path": "/Workspace/Users/user@example.com/notebook",
-              "source": "WORKSPACE"
-            },
-            "run_if": "ALL_SUCCESS",
-            "task_key": "main",
-            "timeout_seconds": 0
-          }
-        ],
-        "timeout_seconds": 0,
-        "webhook_notifications": {}
-      },
-      "changes": {
-        "email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks[task_key='main'].email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks[task_key='main'].run_if": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "ALL_SUCCESS"
-        },
-        "tasks[task_key='main'].timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "webhook_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        }
-      }
-    },
-    "resources.jobs.job_with_permissions.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.job_with_permissions",
-          "label": "${resources.jobs.job_with_permissions.id}"
-        }
-      ],
-      "action": "update",
-      "new_state": {
-        "value": {
-          "object_id": "/jobs/[JOB_WITH_PERMISSIONS_ID]",
-          "__embed__": [
-            {
-              "level": "CAN_MANAGE",
-              "user_name": "viewer@example.com"
-            },
-            {
-              "level": "IS_OWNER",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        }
-      },
-      "remote_state": {
-        "object_id": "/jobs/[JOB_WITH_PERMISSIONS_ID]",
-        "__embed__": [
-          {
-            "level": "CAN_MANAGE",
-            "user_name": "viewer@example.com"
-          },
-          {
-            "level": "CAN_MANAGE",
-            "group_name": "data-team"
-          },
-          {
-            "level": "IS_OWNER",
-            "user_name": "[USERNAME]"
-          }
-        ]
-      },
-      "changes": {
-        "[group_name='data-team']": {
-          "action": "update",
-          "old": {
-            "level": "CAN_MANAGE",
-            "group_name": "data-team"
-          },
-          "remote": {
-            "level": "CAN_MANAGE",
-            "group_name": "data-team"
-          }
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/update/out.plan_delete_one.json b/acceptance/bundle/resources/permissions/jobs/update/out.plan_delete_one.json
new file mode 100644
index 00000000000..2f685883af6
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/jobs/update/out.plan_delete_one.json
@@ -0,0 +1,129 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 2,
+  "plan": {
+    "resources.jobs.job_with_permissions": {
+      "action": "skip",
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/jobs-permissions-test/default/state/metadata.json"
+        },
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_id": [JOB_WITH_PERMISSIONS_ID],
+        "max_concurrent_runs": 1,
+        "name": "job with permissions",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "tasks": [
+          {
+            "email_notifications": {},
+            "notebook_task": {
+              "notebook_path": "/Workspace/Users/user@example.com/notebook",
+              "source": "WORKSPACE"
+            },
+            "run_if": "ALL_SUCCESS",
+            "task_key": "main",
+            "timeout_seconds": 0
+          }
+        ],
+        "timeout_seconds": 0,
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='main'].email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='main'].run_if": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": "ALL_SUCCESS"
+        },
+        "tasks[task_key='main'].timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    },
+    "resources.jobs.job_with_permissions.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.job_with_permissions",
+          "label": "${resources.jobs.job_with_permissions.id}"
+        }
+      ],
+      "action": "update",
+      "new_state": {
+        "value": {
+          "object_id": "/jobs/[JOB_WITH_PERMISSIONS_ID]",
+          "__embed__": [
+            {
+              "level": "CAN_MANAGE",
+              "user_name": "viewer@example.com"
+            },
+            {
+              "level": "IS_OWNER",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        }
+      },
+      "remote_state": {
+        "object_id": "/jobs/[JOB_WITH_PERMISSIONS_ID]",
+        "__embed__": [
+          {
+            "level": "CAN_MANAGE",
+            "user_name": "viewer@example.com"
+          },
+          {
+            "level": "CAN_MANAGE",
+            "group_name": "data-team"
+          },
+          {
+            "level": "IS_OWNER",
+            "user_name": "[USERNAME]"
+          }
+        ]
+      },
+      "changes": {
+        "[group_name='data-team']": {
+          "action": "update",
+          "old": {
+            "level": "CAN_MANAGE",
+            "group_name": "data-team"
+          },
+          "remote": {
+            "level": "CAN_MANAGE",
+            "group_name": "data-team"
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/jobs/update/out.plan_delete_one.terraform.json b/acceptance/bundle/resources/permissions/jobs/update/out.plan_delete_one.terraform.json
deleted file mode 100644
index a88eeedacc0..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/update/out.plan_delete_one.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.job_with_permissions": {
-      "action": "skip"
-    },
-    "resources.jobs.job_with_permissions.permissions": {
-      "action": "update"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/update/out.plan_post_create.direct.json b/acceptance/bundle/resources/permissions/jobs/update/out.plan_post_create.direct.json
deleted file mode 100644
index 5ccbd961e77..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/update/out.plan_post_create.direct.json
+++ /dev/null
@@ -1,101 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.jobs.job_with_permissions": {
-      "action": "skip",
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/jobs-permissions-test/default/state/metadata.json"
-        },
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_id": [JOB_WITH_PERMISSIONS_ID],
-        "max_concurrent_runs": 1,
-        "name": "job with permissions",
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "tasks": [
-          {
-            "email_notifications": {},
-            "notebook_task": {
-              "notebook_path": "/Workspace/Users/user@example.com/notebook",
-              "source": "WORKSPACE"
-            },
-            "run_if": "ALL_SUCCESS",
-            "task_key": "main",
-            "timeout_seconds": 0
-          }
-        ],
-        "timeout_seconds": 0,
-        "webhook_notifications": {}
-      },
-      "changes": {
-        "email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks[task_key='main'].email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks[task_key='main'].run_if": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "ALL_SUCCESS"
-        },
-        "tasks[task_key='main'].timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "webhook_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        }
-      }
-    },
-    "resources.jobs.job_with_permissions.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.job_with_permissions",
-          "label": "${resources.jobs.job_with_permissions.id}"
-        }
-      ],
-      "action": "skip",
-      "remote_state": {
-        "object_id": "/jobs/[JOB_WITH_PERMISSIONS_ID]",
-        "__embed__": [
-          {
-            "level": "CAN_VIEW",
-            "user_name": "viewer@example.com"
-          },
-          {
-            "level": "CAN_MANAGE",
-            "group_name": "data-team"
-          },
-          {
-            "level": "IS_OWNER",
-            "user_name": "[USERNAME]"
-          }
-        ]
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/update/out.plan_post_create.json b/acceptance/bundle/resources/permissions/jobs/update/out.plan_post_create.json
new file mode 100644
index 00000000000..86c1144b0da
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/jobs/update/out.plan_post_create.json
@@ -0,0 +1,101 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.jobs.job_with_permissions": {
+      "action": "skip",
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/jobs-permissions-test/default/state/metadata.json"
+        },
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_id": [JOB_WITH_PERMISSIONS_ID],
+        "max_concurrent_runs": 1,
+        "name": "job with permissions",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "tasks": [
+          {
+            "email_notifications": {},
+            "notebook_task": {
+              "notebook_path": "/Workspace/Users/user@example.com/notebook",
+              "source": "WORKSPACE"
+            },
+            "run_if": "ALL_SUCCESS",
+            "task_key": "main",
+            "timeout_seconds": 0
+          }
+        ],
+        "timeout_seconds": 0,
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='main'].email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='main'].run_if": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": "ALL_SUCCESS"
+        },
+        "tasks[task_key='main'].timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    },
+    "resources.jobs.job_with_permissions.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.job_with_permissions",
+          "label": "${resources.jobs.job_with_permissions.id}"
+        }
+      ],
+      "action": "skip",
+      "remote_state": {
+        "object_id": "/jobs/[JOB_WITH_PERMISSIONS_ID]",
+        "__embed__": [
+          {
+            "level": "CAN_VIEW",
+            "user_name": "viewer@example.com"
+          },
+          {
+            "level": "CAN_MANAGE",
+            "group_name": "data-team"
+          },
+          {
+            "level": "IS_OWNER",
+            "user_name": "[USERNAME]"
+          }
+        ]
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/jobs/update/out.plan_post_create.terraform.json b/acceptance/bundle/resources/permissions/jobs/update/out.plan_post_create.terraform.json
deleted file mode 100644
index a7c24672341..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/update/out.plan_post_create.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.job_with_permissions": {
-      "action": "skip"
-    },
-    "resources.jobs.job_with_permissions.permissions": {
-      "action": "skip"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/update/out.plan_restore.direct.json b/acceptance/bundle/resources/permissions/jobs/update/out.plan_restore.direct.json
deleted file mode 100644
index 62895573533..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/update/out.plan_restore.direct.json
+++ /dev/null
@@ -1,103 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 4,
-  "plan": {
-    "resources.jobs.job_with_permissions": {
-      "action": "skip",
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/jobs-permissions-test/default/state/metadata.json"
-        },
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_id": [JOB_WITH_PERMISSIONS_ID],
-        "max_concurrent_runs": 1,
-        "name": "job with permissions",
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "tasks": [
-          {
-            "email_notifications": {},
-            "notebook_task": {
-              "notebook_path": "/Workspace/Users/user@example.com/notebook",
-              "source": "WORKSPACE"
-            },
-            "run_if": "ALL_SUCCESS",
-            "task_key": "main",
-            "timeout_seconds": 0
-          }
-        ],
-        "timeout_seconds": 0,
-        "webhook_notifications": {}
-      },
-      "changes": {
-        "email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks[task_key='main'].email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks[task_key='main'].run_if": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "ALL_SUCCESS"
-        },
-        "tasks[task_key='main'].timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "webhook_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        }
-      }
-    },
-    "resources.jobs.job_with_permissions.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.job_with_permissions",
-          "label": "${resources.jobs.job_with_permissions.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "/jobs/[JOB_WITH_PERMISSIONS_ID]",
-          "__embed__": [
-            {
-              "level": "CAN_VIEW",
-              "user_name": "viewer@example.com"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "group_name": "data-team"
-            },
-            {
-              "level": "IS_OWNER",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/update/out.plan_restore.json b/acceptance/bundle/resources/permissions/jobs/update/out.plan_restore.json
new file mode 100644
index 00000000000..e62b14f7ce6
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/jobs/update/out.plan_restore.json
@@ -0,0 +1,103 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 4,
+  "plan": {
+    "resources.jobs.job_with_permissions": {
+      "action": "skip",
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/jobs-permissions-test/default/state/metadata.json"
+        },
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_id": [JOB_WITH_PERMISSIONS_ID],
+        "max_concurrent_runs": 1,
+        "name": "job with permissions",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "tasks": [
+          {
+            "email_notifications": {},
+            "notebook_task": {
+              "notebook_path": "/Workspace/Users/user@example.com/notebook",
+              "source": "WORKSPACE"
+            },
+            "run_if": "ALL_SUCCESS",
+            "task_key": "main",
+            "timeout_seconds": 0
+          }
+        ],
+        "timeout_seconds": 0,
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='main'].email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='main'].run_if": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": "ALL_SUCCESS"
+        },
+        "tasks[task_key='main'].timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    },
+    "resources.jobs.job_with_permissions.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.job_with_permissions",
+          "label": "${resources.jobs.job_with_permissions.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "/jobs/[JOB_WITH_PERMISSIONS_ID]",
+          "__embed__": [
+            {
+              "level": "CAN_VIEW",
+              "user_name": "viewer@example.com"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "group_name": "data-team"
+            },
+            {
+              "level": "IS_OWNER",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/jobs/update/out.plan_restore.terraform.json b/acceptance/bundle/resources/permissions/jobs/update/out.plan_restore.terraform.json
deleted file mode 100644
index 4575a4141d5..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/update/out.plan_restore.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.job_with_permissions": {
-      "action": "skip"
-    },
-    "resources.jobs.job_with_permissions.permissions": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/update/out.plan_set_empty.direct.json b/acceptance/bundle/resources/permissions/jobs/update/out.plan_set_empty.direct.json
deleted file mode 100644
index 458fb094883..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/update/out.plan_set_empty.direct.json
+++ /dev/null
@@ -1,101 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 5,
-  "plan": {
-    "resources.jobs.job_with_permissions": {
-      "action": "skip",
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/jobs-permissions-test/default/state/metadata.json"
-        },
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_id": [JOB_WITH_PERMISSIONS_ID],
-        "max_concurrent_runs": 1,
-        "name": "job with permissions",
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "tasks": [
-          {
-            "email_notifications": {},
-            "notebook_task": {
-              "notebook_path": "/Workspace/Users/user@example.com/notebook",
-              "source": "WORKSPACE"
-            },
-            "run_if": "ALL_SUCCESS",
-            "task_key": "main",
-            "timeout_seconds": 0
-          }
-        ],
-        "timeout_seconds": 0,
-        "webhook_notifications": {}
-      },
-      "changes": {
-        "email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks[task_key='main'].email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks[task_key='main'].run_if": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "ALL_SUCCESS"
-        },
-        "tasks[task_key='main'].timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "webhook_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        }
-      }
-    },
-    "resources.jobs.job_with_permissions.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.job_with_permissions",
-          "label": "${resources.jobs.job_with_permissions.id}"
-        }
-      ],
-      "action": "skip",
-      "remote_state": {
-        "object_id": "/jobs/[JOB_WITH_PERMISSIONS_ID]",
-        "__embed__": [
-          {
-            "level": "CAN_VIEW",
-            "user_name": "viewer@example.com"
-          },
-          {
-            "level": "CAN_MANAGE",
-            "group_name": "data-team"
-          },
-          {
-            "level": "IS_OWNER",
-            "user_name": "[USERNAME]"
-          }
-        ]
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/update/out.plan_set_empty.json b/acceptance/bundle/resources/permissions/jobs/update/out.plan_set_empty.json
new file mode 100644
index 00000000000..b01df3c6905
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/jobs/update/out.plan_set_empty.json
@@ -0,0 +1,85 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 5,
+  "plan": {
+    "resources.jobs.job_with_permissions": {
+      "action": "skip",
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/jobs-permissions-test/default/state/metadata.json"
+        },
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_id": [JOB_WITH_PERMISSIONS_ID],
+        "max_concurrent_runs": 1,
+        "name": "job with permissions",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "tasks": [
+          {
+            "email_notifications": {},
+            "notebook_task": {
+              "notebook_path": "/Workspace/Users/user@example.com/notebook",
+              "source": "WORKSPACE"
+            },
+            "run_if": "ALL_SUCCESS",
+            "task_key": "main",
+            "timeout_seconds": 0
+          }
+        ],
+        "timeout_seconds": 0,
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='main'].email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='main'].run_if": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": "ALL_SUCCESS"
+        },
+        "tasks[task_key='main'].timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    },
+    "resources.jobs.job_with_permissions.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.job_with_permissions",
+          "label": "${resources.jobs.job_with_permissions.id}"
+        }
+      ],
+      "action": "delete",
+      "state_only": true
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/jobs/update/out.plan_set_empty.terraform.json b/acceptance/bundle/resources/permissions/jobs/update/out.plan_set_empty.terraform.json
deleted file mode 100644
index a7c24672341..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/update/out.plan_set_empty.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.job_with_permissions": {
-      "action": "skip"
-    },
-    "resources.jobs.job_with_permissions.permissions": {
-      "action": "skip"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/update/out.plan_update.direct.json b/acceptance/bundle/resources/permissions/jobs/update/out.plan_update.direct.json
deleted file mode 100644
index a4638d7c51d..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/update/out.plan_update.direct.json
+++ /dev/null
@@ -1,128 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.jobs.job_with_permissions": {
-      "action": "skip",
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/jobs-permissions-test/default/state/metadata.json"
-        },
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_id": [JOB_WITH_PERMISSIONS_ID],
-        "max_concurrent_runs": 1,
-        "name": "job with permissions",
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "tasks": [
-          {
-            "email_notifications": {},
-            "notebook_task": {
-              "notebook_path": "/Workspace/Users/user@example.com/notebook",
-              "source": "WORKSPACE"
-            },
-            "run_if": "ALL_SUCCESS",
-            "task_key": "main",
-            "timeout_seconds": 0
-          }
-        ],
-        "timeout_seconds": 0,
-        "webhook_notifications": {}
-      },
-      "changes": {
-        "email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks[task_key='main'].email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks[task_key='main'].run_if": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "ALL_SUCCESS"
-        },
-        "tasks[task_key='main'].timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "webhook_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        }
-      }
-    },
-    "resources.jobs.job_with_permissions.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.job_with_permissions",
-          "label": "${resources.jobs.job_with_permissions.id}"
-        }
-      ],
-      "action": "update",
-      "new_state": {
-        "value": {
-          "object_id": "/jobs/[JOB_WITH_PERMISSIONS_ID]",
-          "__embed__": [
-            {
-              "level": "CAN_MANAGE",
-              "user_name": "viewer@example.com"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "group_name": "data-team"
-            },
-            {
-              "level": "IS_OWNER",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        }
-      },
-      "remote_state": {
-        "object_id": "/jobs/[JOB_WITH_PERMISSIONS_ID]",
-        "__embed__": [
-          {
-            "level": "CAN_VIEW",
-            "user_name": "viewer@example.com"
-          },
-          {
-            "level": "CAN_MANAGE",
-            "group_name": "data-team"
-          },
-          {
-            "level": "IS_OWNER",
-            "user_name": "[USERNAME]"
-          }
-        ]
-      },
-      "changes": {
-        "[user_name='viewer@example.com'].level": {
-          "action": "update",
-          "old": "CAN_VIEW",
-          "new": "CAN_MANAGE",
-          "remote": "CAN_VIEW"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/update/out.plan_update.json b/acceptance/bundle/resources/permissions/jobs/update/out.plan_update.json
new file mode 100644
index 00000000000..4c63a45fcd7
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/jobs/update/out.plan_update.json
@@ -0,0 +1,128 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.jobs.job_with_permissions": {
+      "action": "skip",
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/jobs-permissions-test/default/state/metadata.json"
+        },
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_id": [JOB_WITH_PERMISSIONS_ID],
+        "max_concurrent_runs": 1,
+        "name": "job with permissions",
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "tasks": [
+          {
+            "email_notifications": {},
+            "notebook_task": {
+              "notebook_path": "/Workspace/Users/user@example.com/notebook",
+              "source": "WORKSPACE"
+            },
+            "run_if": "ALL_SUCCESS",
+            "task_key": "main",
+            "timeout_seconds": 0
+          }
+        ],
+        "timeout_seconds": 0,
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='main'].email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='main'].run_if": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": "ALL_SUCCESS"
+        },
+        "tasks[task_key='main'].timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    },
+    "resources.jobs.job_with_permissions.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.job_with_permissions",
+          "label": "${resources.jobs.job_with_permissions.id}"
+        }
+      ],
+      "action": "update",
+      "new_state": {
+        "value": {
+          "object_id": "/jobs/[JOB_WITH_PERMISSIONS_ID]",
+          "__embed__": [
+            {
+              "level": "CAN_MANAGE",
+              "user_name": "viewer@example.com"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "group_name": "data-team"
+            },
+            {
+              "level": "IS_OWNER",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        }
+      },
+      "remote_state": {
+        "object_id": "/jobs/[JOB_WITH_PERMISSIONS_ID]",
+        "__embed__": [
+          {
+            "level": "CAN_VIEW",
+            "user_name": "viewer@example.com"
+          },
+          {
+            "level": "CAN_MANAGE",
+            "group_name": "data-team"
+          },
+          {
+            "level": "IS_OWNER",
+            "user_name": "[USERNAME]"
+          }
+        ]
+      },
+      "changes": {
+        "[user_name='viewer@example.com'].level": {
+          "action": "update",
+          "old": "CAN_VIEW",
+          "new": "CAN_MANAGE",
+          "remote": "CAN_VIEW"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/jobs/update/out.plan_update.terraform.json b/acceptance/bundle/resources/permissions/jobs/update/out.plan_update.terraform.json
deleted file mode 100644
index a88eeedacc0..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/update/out.plan_update.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.job_with_permissions": {
-      "action": "skip"
-    },
-    "resources.jobs.job_with_permissions.permissions": {
-      "action": "update"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/pipelines/current_can_manage/out.requests.destroy.direct.json b/acceptance/bundle/resources/permissions/jobs/update/out.requests_delete_all.json
similarity index 100%
rename from acceptance/bundle/resources/permissions/pipelines/current_can_manage/out.requests.destroy.direct.json
rename to acceptance/bundle/resources/permissions/jobs/update/out.requests_delete_all.json
diff --git a/acceptance/bundle/resources/permissions/jobs/update/out.requests_delete_all.terraform.json b/acceptance/bundle/resources/permissions/jobs/update/out.requests_delete_all.terraform.json
deleted file mode 100644
index 95d354f99a4..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/update/out.requests_delete_all.terraform.json
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/jobs/[JOB_WITH_PERMISSIONS_ID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/update/out.requests_destroy.direct.json b/acceptance/bundle/resources/permissions/jobs/update/out.requests_destroy.json
similarity index 100%
rename from acceptance/bundle/resources/permissions/jobs/update/out.requests_destroy.direct.json
rename to acceptance/bundle/resources/permissions/jobs/update/out.requests_destroy.json
diff --git a/acceptance/bundle/resources/permissions/jobs/update/out.requests_destroy.terraform.json b/acceptance/bundle/resources/permissions/jobs/update/out.requests_destroy.terraform.json
deleted file mode 100644
index f66a05564c6..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/update/out.requests_destroy.terraform.json
+++ /dev/null
@@ -1,19 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/jobs/[JOB_WITH_PERMISSIONS_ID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.2/jobs/delete",
-  "body": {
-    "job_id": [JOB_WITH_PERMISSIONS_ID]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/pipelines/current_can_manage/out.requests.destroy.terraform.json b/acceptance/bundle/resources/permissions/jobs/update/out.requests_set_empty.json
similarity index 100%
rename from acceptance/bundle/resources/permissions/pipelines/current_can_manage/out.requests.destroy.terraform.json
rename to acceptance/bundle/resources/permissions/jobs/update/out.requests_set_empty.json
diff --git a/acceptance/bundle/resources/permissions/jobs/update/out.test.toml b/acceptance/bundle/resources/permissions/jobs/update/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/permissions/jobs/update/out.test.toml
+++ b/acceptance/bundle/resources/permissions/jobs/update/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/permissions/jobs/update/output.txt b/acceptance/bundle/resources/permissions/jobs/update/output.txt
index 6fcfd6d03f3..1ed877b8f1a 100644
--- a/acceptance/bundle/resources/permissions/jobs/update/output.txt
+++ b/acceptance/bundle/resources/permissions/jobs/update/output.txt
@@ -9,11 +9,12 @@ Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/jobs-permissions-test/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.job_with_permissions
+Created jobs.job_with_permissions.permissions
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
->>> print_requests
+>>> print_requests.py --nostamp //jobs/
 
 >>> [CLI] bundle plan
 Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
@@ -75,11 +76,11 @@ Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/jobs-permissions-test/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated jobs.job_with_permissions.permissions
+Files: 4 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 1 unchanged
 
->>> print_requests
+>>> print_requests.py --nostamp //jobs/
 
 >>> [CLI] bundle plan
 Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
@@ -90,11 +91,11 @@ Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/jobs-permissions-test/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated jobs.job_with_permissions.permissions
+Files: 3 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 1 unchanged
 
->>> print_requests
+>>> print_requests.py --nostamp //jobs/
 
 >>> [CLI] bundle plan
 Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
@@ -105,11 +106,10 @@ Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/jobs-permissions-test/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 3 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
 
->>> print_requests
+>>> print_requests.py --nostamp //jobs/
 
 >>> [CLI] bundle plan
 Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
@@ -127,17 +127,17 @@ Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
 -          user_name: viewer@example.com # PERMISSIONS
 -        - level: CAN_MANAGE # DELETE_ONE
 -          group_name: data-team # DELETE_ONE
-           # permissions: [] # EXPLICIT_EMPTY
+       # permissions: [] # EXPLICIT_EMPTY
 
 >>> [CLI] bundle plan -o json
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/jobs-permissions-test/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.job_with_permissions.permissions
+Files: 2 uploaded, 1 deleted
+Resources: 1 created, 0 changed, 0 deleted, 1 unchanged
 
->>> print_requests
+>>> print_requests.py --nostamp //jobs/
 
 >>> [CLI] bundle plan
 Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
@@ -145,34 +145,20 @@ Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
 === Set permissions: []
 
 >>> [CLI] bundle plan -o json
-Warning: unknown field: permissions
-  at resources.jobs.job_with_permissions.permissions[1]
-  in databricks.yml:18:11
-
 
 >>> [CLI] bundle deploy
-Warning: unknown field: permissions
-  at resources.jobs.job_with_permissions.permissions[1]
-  in databricks.yml:18:11
-
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/jobs-permissions-test/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 3 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
 
->>> print_requests
+>>> print_requests.py --nostamp //jobs/
 
 >>> [CLI] bundle destroy --auto-approve
-Warning: unknown field: permissions
-  at resources.jobs.job_with_permissions.permissions[1]
-  in databricks.yml:18:11
-
 The following resources will be deleted:
   delete resources.jobs.job_with_permissions
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/jobs-permissions-test/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
 
->>> print_requests
+>>> print_requests.py --nostamp //jobs/
diff --git a/acceptance/bundle/resources/permissions/jobs/update/script b/acceptance/bundle/resources/permissions/jobs/update/script
index d13f5336ed7..0396e6b68e4 100644
--- a/acceptance/bundle/resources/permissions/jobs/update/script
+++ b/acceptance/bundle/resources/permissions/jobs/update/script
@@ -1,58 +1,53 @@
-print_requests() {
-    jq 'select(.path | contains("/jobs/")) | select(.method != "GET")' < out.requests.txt
-    rm out.requests.txt
-}
-
 cp databricks.yml databricks.yml.saved
 trace $CLI bundle plan
-trace $CLI bundle plan -o json > out.plan_create.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.plan_create.json
 trace $CLI bundle deploy
-trace print_requests > out.requests_create.json
+trace print_requests.py --nostamp //jobs/ > out.requests_create.json
 trace $CLI bundle plan
-trace $CLI bundle plan -o json > out.plan_post_create.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.plan_post_create.json
 
 job_id="$(read_id.py job_with_permissions)"
 
 trace $CLI permissions get jobs "$job_id"
-rm -f out.requests.txt
+rm -f "$OUT_REQUESTS"
 
 title "Update one permission and deploy again\n"
 update_file.py databricks.yml CAN_VIEW CAN_MANAGE
-trace $CLI bundle plan -o json > out.plan_update.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.plan_update.json
 trace $CLI bundle deploy
-trace print_requests > out.requests_update.json
+trace print_requests.py --nostamp //jobs/ > out.requests_update.json
 trace $CLI bundle plan
 
 title "Delete one permission and deploy again\n"
 grep -v DELETE_ONE databricks.yml > tmp.yml && mv tmp.yml databricks.yml
-trace $CLI bundle plan -o json > out.plan_delete_one.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.plan_delete_one.json
 trace $CLI bundle deploy
-trace print_requests > out.requests_delete_one.json
+trace print_requests.py --nostamp //jobs/ > out.requests_delete_one.json
 trace $CLI bundle plan
 
 title "Delete the whole block and deploy again\n"
 grep -v PERMISSIONS databricks.yml > tmp.yml && mv tmp.yml databricks.yml
-trace $CLI bundle plan -o json > out.plan_delete_all.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.plan_delete_all.json
 trace $CLI bundle deploy
-trace print_requests > out.requests_delete_all.$DATABRICKS_BUNDLE_ENGINE.json
+trace print_requests.py --nostamp //jobs/ > out.requests_delete_all.json
 trace $CLI bundle plan
 
 title "Restore original config\n"
 trace diff.py databricks.yml.saved databricks.yml
 
 mv databricks.yml.saved databricks.yml
-trace $CLI bundle plan -o json > out.plan_restore.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.plan_restore.json
 trace $CLI bundle deploy
-trace print_requests > out.requests_restore_original.json
+trace print_requests.py --nostamp //jobs/ > out.requests_restore_original.json
 trace $CLI bundle plan
 
 title "Set permissions: []\n"
-grep -v '(PERMISSIONS|DELETE_ONE)' databricks.yml > tmp.yml && mv tmp.yml databricks.yml
+grep -vE '(PERMISSIONS|DELETE_ONE)' databricks.yml > tmp.yml && mv tmp.yml databricks.yml
 update_file.py databricks.yml '# permissions: [] # EXPLICIT_EMPTY' 'permissions: [] # EXPLICIT_EMPTY'
-trace $CLI bundle plan -o json > out.plan_set_empty.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.plan_set_empty.json
 trace $CLI bundle deploy
-trace print_requests > out.requests_set_empty.$DATABRICKS_BUNDLE_ENGINE.json
+trace print_requests.py --nostamp //jobs/ > out.requests_set_empty.json
 
 trace $CLI bundle destroy --auto-approve
-trace print_requests > out.requests_destroy.$DATABRICKS_BUNDLE_ENGINE.json
+trace print_requests.py --nostamp //jobs/ > out.requests_destroy.json
 #rm -fr .databricks
diff --git a/acceptance/bundle/resources/permissions/jobs/viewers/out.plan.direct.json b/acceptance/bundle/resources/permissions/jobs/viewers/out.plan.direct.json
deleted file mode 100644
index 46444d2a87e..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/viewers/out.plan.direct.json
+++ /dev/null
@@ -1,68 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.foo": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "job1",
-          "queue": {
-            "enabled": true
-          },
-          "tasks": [
-            {
-              "notebook_task": {
-                "notebook_path": "/Workspace/Users/user@example.com/notebook",
-                "source": "WORKSPACE"
-              },
-              "task_key": "main"
-            }
-          ]
-        }
-      }
-    },
-    "resources.jobs.foo.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.foo",
-          "label": "${resources.jobs.foo.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "CAN_VIEW",
-              "user_name": "viewer@example.com"
-            },
-            {
-              "level": "CAN_VIEW",
-              "group_name": "data-team"
-            },
-            {
-              "level": "CAN_VIEW",
-              "service_principal_name": "[UUID]"
-            },
-            {
-              "level": "IS_OWNER",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/jobs/${resources.jobs.foo.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/viewers/out.plan.json b/acceptance/bundle/resources/permissions/jobs/viewers/out.plan.json
new file mode 100644
index 00000000000..29dcba9ab29
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/jobs/viewers/out.plan.json
@@ -0,0 +1,68 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.jobs.foo": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "job1",
+          "queue": {
+            "enabled": true
+          },
+          "tasks": [
+            {
+              "notebook_task": {
+                "notebook_path": "/Workspace/Users/user@example.com/notebook",
+                "source": "WORKSPACE"
+              },
+              "task_key": "main"
+            }
+          ]
+        }
+      }
+    },
+    "resources.jobs.foo.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.foo",
+          "label": "${resources.jobs.foo.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "CAN_VIEW",
+              "user_name": "viewer@example.com"
+            },
+            {
+              "level": "CAN_VIEW",
+              "group_name": "data-team"
+            },
+            {
+              "level": "CAN_VIEW",
+              "service_principal_name": "[UUID]"
+            },
+            {
+              "level": "IS_OWNER",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/jobs/${resources.jobs.foo.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/jobs/viewers/out.plan.terraform.json b/acceptance/bundle/resources/permissions/jobs/viewers/out.plan.terraform.json
deleted file mode 100644
index 41071059f89..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/viewers/out.plan.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.foo": {
-      "action": "create"
-    },
-    "resources.jobs.foo.permissions": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/viewers/out.requests.deploy.direct.json b/acceptance/bundle/resources/permissions/jobs/viewers/out.requests.deploy.direct.json
deleted file mode 100644
index 45768bac0d5..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/viewers/out.requests.deploy.direct.json
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/jobs/[NUMID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_VIEW",
-        "user_name": "viewer@example.com"
-      },
-      {
-        "group_name": "data-team",
-        "permission_level": "CAN_VIEW"
-      },
-      {
-        "permission_level": "CAN_VIEW",
-        "service_principal_name": "[UUID]"
-      },
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/viewers/out.requests.deploy.json b/acceptance/bundle/resources/permissions/jobs/viewers/out.requests.deploy.json
new file mode 100644
index 00000000000..6fcb88e628c
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/jobs/viewers/out.requests.deploy.json
@@ -0,0 +1,24 @@
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/jobs/[FOO_ID]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "CAN_VIEW",
+        "user_name": "viewer@example.com"
+      },
+      {
+        "group_name": "data-team",
+        "permission_level": "CAN_VIEW"
+      },
+      {
+        "permission_level": "CAN_VIEW",
+        "service_principal_name": "[UUID]"
+      },
+      {
+        "permission_level": "IS_OWNER",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/jobs/viewers/out.requests.deploy.terraform.json b/acceptance/bundle/resources/permissions/jobs/viewers/out.requests.deploy.terraform.json
deleted file mode 100644
index a4e11d7fb60..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/viewers/out.requests.deploy.terraform.json
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/jobs/[NUMID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_VIEW",
-        "service_principal_name": "[UUID]"
-      },
-      {
-        "permission_level": "CAN_VIEW",
-        "user_name": "viewer@example.com"
-      },
-      {
-        "group_name": "data-team",
-        "permission_level": "CAN_VIEW"
-      },
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/pipelines/current_is_owner/out.requests.destroy.direct.json b/acceptance/bundle/resources/permissions/jobs/viewers/out.requests.destroy.json
similarity index 100%
rename from acceptance/bundle/resources/permissions/pipelines/current_is_owner/out.requests.destroy.direct.json
rename to acceptance/bundle/resources/permissions/jobs/viewers/out.requests.destroy.json
diff --git a/acceptance/bundle/resources/permissions/jobs/viewers/out.requests.destroy.terraform.json b/acceptance/bundle/resources/permissions/jobs/viewers/out.requests.destroy.terraform.json
deleted file mode 100644
index f7aa2dbaa0d..00000000000
--- a/acceptance/bundle/resources/permissions/jobs/viewers/out.requests.destroy.terraform.json
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/jobs/[NUMID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/jobs/viewers/out.test.toml b/acceptance/bundle/resources/permissions/jobs/viewers/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/permissions/jobs/viewers/out.test.toml
+++ b/acceptance/bundle/resources/permissions/jobs/viewers/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/permissions/jobs/viewers/output.txt b/acceptance/bundle/resources/permissions/jobs/viewers/output.txt
index a880e3e813c..41d08a8ada1 100644
--- a/acceptance/bundle/resources/permissions/jobs/viewers/output.txt
+++ b/acceptance/bundle/resources/permissions/jobs/viewers/output.txt
@@ -21,9 +21,10 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.foo
+Created jobs.foo.permissions
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
@@ -31,5 +32,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/permissions/models/current_can_manage/out.deploy.txt b/acceptance/bundle/resources/permissions/models/current_can_manage/out.deploy.txt
index 0fd05668156..42a0c73fc32 100644
--- a/acceptance/bundle/resources/permissions/models/current_can_manage/out.deploy.txt
+++ b/acceptance/bundle/resources/permissions/models/current_can_manage/out.deploy.txt
@@ -1,6 +1,7 @@
 
 >>> errcode [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created models.foo
+Created models.foo.permissions
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
diff --git a/acceptance/bundle/resources/permissions/models/current_can_manage/out.plan.direct.json b/acceptance/bundle/resources/permissions/models/current_can_manage/out.plan.direct.json
deleted file mode 100644
index 52723d328fb..00000000000
--- a/acceptance/bundle/resources/permissions/models/current_can_manage/out.plan.direct.json
+++ /dev/null
@@ -1,49 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.models.foo": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "name": "test-model"
-        }
-      }
-    },
-    "resources.models.foo.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.models.foo",
-          "label": "${resources.models.foo.model_id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "CAN_READ",
-              "user_name": "viewer@example.com"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "group_name": "data-team"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "service_principal_name": "[UUID]"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/registered-models/${resources.models.foo.model_id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/models/current_can_manage/out.plan.json b/acceptance/bundle/resources/permissions/models/current_can_manage/out.plan.json
new file mode 100644
index 00000000000..b78fcdaa631
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/models/current_can_manage/out.plan.json
@@ -0,0 +1,49 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.models.foo": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "name": "test-model"
+        }
+      }
+    },
+    "resources.models.foo.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.models.foo",
+          "label": "${resources.models.foo.model_id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "CAN_READ",
+              "user_name": "viewer@example.com"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "group_name": "data-team"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "service_principal_name": "[UUID]"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/registered-models/${resources.models.foo.model_id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/models/current_can_manage/out.plan.terraform.json b/acceptance/bundle/resources/permissions/models/current_can_manage/out.plan.terraform.json
deleted file mode 100644
index c564bfda0ac..00000000000
--- a/acceptance/bundle/resources/permissions/models/current_can_manage/out.plan.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.models.foo": {
-      "action": "create"
-    },
-    "resources.models.foo.permissions": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/models/current_can_manage/out.requests.deploy.direct.json b/acceptance/bundle/resources/permissions/models/current_can_manage/out.requests.deploy.json
similarity index 100%
rename from acceptance/bundle/resources/permissions/models/current_can_manage/out.requests.deploy.direct.json
rename to acceptance/bundle/resources/permissions/models/current_can_manage/out.requests.deploy.json
diff --git a/acceptance/bundle/resources/permissions/models/current_can_manage/out.requests.deploy.terraform.json b/acceptance/bundle/resources/permissions/models/current_can_manage/out.requests.deploy.terraform.json
deleted file mode 100644
index 06c635ad4ad..00000000000
--- a/acceptance/bundle/resources/permissions/models/current_can_manage/out.requests.deploy.terraform.json
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/registered-models/[FOO_MODEL_ID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_READ",
-        "user_name": "viewer@example.com"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "service_principal_name": "[UUID]"
-      },
-      {
-        "group_name": "data-team",
-        "permission_level": "CAN_MANAGE"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/pipelines/current_is_owner/out.requests.destroy.terraform.json b/acceptance/bundle/resources/permissions/models/current_can_manage/out.requests.destroy.json
similarity index 100%
rename from acceptance/bundle/resources/permissions/pipelines/current_is_owner/out.requests.destroy.terraform.json
rename to acceptance/bundle/resources/permissions/models/current_can_manage/out.requests.destroy.json
diff --git a/acceptance/bundle/resources/permissions/models/current_can_manage/out.requests.destroy.terraform.json b/acceptance/bundle/resources/permissions/models/current_can_manage/out.requests.destroy.terraform.json
deleted file mode 100644
index 62901b29fba..00000000000
--- a/acceptance/bundle/resources/permissions/models/current_can_manage/out.requests.destroy.terraform.json
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/registered-models/[FOO_MODEL_ID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_MANAGE",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/models/current_can_manage/out.test.toml b/acceptance/bundle/resources/permissions/models/current_can_manage/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/permissions/models/current_can_manage/out.test.toml
+++ b/acceptance/bundle/resources/permissions/models/current_can_manage/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/permissions/models/current_can_manage/output.txt b/acceptance/bundle/resources/permissions/models/current_can_manage/output.txt
index fc2daa5fa4a..f65983f32d9 100644
--- a/acceptance/bundle/resources/permissions/models/current_can_manage/output.txt
+++ b/acceptance/bundle/resources/permissions/models/current_can_manage/output.txt
@@ -25,5 +25,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/permissions/models/current_can_manage/script b/acceptance/bundle/resources/permissions/models/current_can_manage/script
index 19146a993f3..e1f594d80ee 100644
--- a/acceptance/bundle/resources/permissions/models/current_can_manage/script
+++ b/acceptance/bundle/resources/permissions/models/current_can_manage/script
@@ -1,22 +1,17 @@
 trace $CLI bundle validate -o json | jq .resources.$RESOURCE.foo.permissions
-rm out.requests.txt
+rm "$OUT_REQUESTS"
 
-$CLI bundle plan -o json > out.plan.$DATABRICKS_BUNDLE_ENGINE.json
+$CLI bundle plan -o json | nostamp > out.plan.json
 
-print_requests() {
-    jq -c < out.requests.txt | jq 'select(.method != "GET" and (.path | contains("permissions")))'
-    rm out.requests.txt
-}
-
-rm out.requests.txt
+rm "$OUT_REQUESTS"
 trace errcode $CLI bundle deploy &> out.deploy.txt
 
 # Register the model's numeric ID for output replacement.
 # The permissions API uses the numeric ID, not the model name.
 MODEL_ID=$($CLI model-registry get-model test-model | jq -r '.registered_model_databricks.id')
-add_repl.py "$MODEL_ID" "FOO_MODEL_ID"
+add_repl "$MODEL_ID" "FOO_MODEL_ID"
 
-print_requests > out.requests.deploy.$DATABRICKS_BUNDLE_ENGINE.json
+print_requests.py //permissions > out.requests.deploy.json
 
 trace $CLI bundle destroy --auto-approve
-print_requests > out.requests.destroy.$DATABRICKS_BUNDLE_ENGINE.json
+print_requests.py //permissions > out.requests.destroy.json
diff --git a/acceptance/bundle/resources/permissions/models/test.toml b/acceptance/bundle/resources/permissions/models/test.toml
index d545b1b896d..5667d3073b9 100644
--- a/acceptance/bundle/resources/permissions/models/test.toml
+++ b/acceptance/bundle/resources/permissions/models/test.toml
@@ -1,2 +1,2 @@
 Env.RESOURCE = "models"  # for ../_script
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+Env.DATABRICKS_BUNDLE_ENGINE = "direct"
diff --git a/acceptance/bundle/resources/permissions/out.test.toml b/acceptance/bundle/resources/permissions/out.test.toml
deleted file mode 100644
index be193812ec2..00000000000
--- a/acceptance/bundle/resources/permissions/out.test.toml
+++ /dev/null
@@ -1,4 +0,0 @@
-Local = true
-Cloud = false
-Phase = 1
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/bundle/resources/permissions/output.txt b/acceptance/bundle/resources/permissions/output.txt
deleted file mode 100644
index 85eea2e6e9c..00000000000
--- a/acceptance/bundle/resources/permissions/output.txt
+++ /dev/null
@@ -1,391 +0,0 @@
-MATCH apps/current_can_manage/out.requests.deploy.direct.json
-DIFF  apps/current_can_manage/out.requests.destroy.direct.json
---- apps/current_can_manage/out.requests.destroy.direct.json
-+++ apps/current_can_manage/out.requests.destroy.terraform.json
-@@ -1 +1,14 @@
--[]+[
-+  {
-+    "body": {
-+      "access_control_list": [
-+        {
-+          "permission_level": "CAN_MANAGE",
-+          "user_name": "[USERNAME]"
-+        }
-+      ]
-+    },
-+    "method": "PUT",
-+    "path": "/api/2.0/permissions/apps/foo"
-+  }
-+]
-MATCH apps/other_can_manage/out.requests.deploy.direct.json
-DIFF  apps/other_can_manage/out.requests.destroy.direct.json
---- apps/other_can_manage/out.requests.destroy.direct.json
-+++ apps/other_can_manage/out.requests.destroy.terraform.json
-@@ -1 +1,14 @@
--[]+[
-+  {
-+    "body": {
-+      "access_control_list": [
-+        {
-+          "permission_level": "CAN_MANAGE",
-+          "user_name": "[USERNAME]"
-+        }
-+      ]
-+    },
-+    "method": "PUT",
-+    "path": "/api/2.0/permissions/apps/foo"
-+  }
-+]
-MATCH clusters/current_can_manage/out.requests.deploy.direct.json
-DIFF  clusters/current_can_manage/out.requests.destroy.direct.json
---- clusters/current_can_manage/out.requests.destroy.direct.json
-+++ clusters/current_can_manage/out.requests.destroy.terraform.json
-@@ -1 +1,14 @@
--[]+[
-+  {
-+    "body": {
-+      "access_control_list": [
-+        {
-+          "permission_level": "CAN_MANAGE",
-+          "user_name": "[USERNAME]"
-+        }
-+      ]
-+    },
-+    "method": "PUT",
-+    "path": "/api/2.0/permissions/clusters/[UUID]"
-+  }
-+]
-MATCH clusters/target/out.requests.direct.json
-MATCH dashboards/create/out.requests.deploy.direct.json
-DIFF  dashboards/create/out.requests.destroy.direct.json
---- dashboards/create/out.requests.destroy.direct.json
-+++ dashboards/create/out.requests.destroy.terraform.json
-@@ -1 +1,7 @@
--[]+[
-+  {
-+    "body": {},
-+    "method": "PUT",
-+    "path": "/api/2.0/permissions/dashboards/[FOO_ID]"
-+  }
-+]
-MATCH database_instances/current_can_manage/out.requests.deploy.direct.json
-DIFF  database_instances/current_can_manage/out.requests.destroy.direct.json
---- database_instances/current_can_manage/out.requests.destroy.direct.json
-+++ database_instances/current_can_manage/out.requests.destroy.terraform.json
-@@ -1 +1,14 @@
--[]+[
-+  {
-+    "body": {
-+      "access_control_list": [
-+        {
-+          "permission_level": "CAN_MANAGE",
-+          "user_name": "[USERNAME]"
-+        }
-+      ]
-+    },
-+    "method": "PUT",
-+    "path": "/api/2.0/permissions/database-instances/test-db-instance"
-+  }
-+]
-MATCH experiments/current_can_manage/out.requests.deploy.direct.json
-DIFF  experiments/current_can_manage/out.requests.destroy.direct.json
---- experiments/current_can_manage/out.requests.destroy.direct.json
-+++ experiments/current_can_manage/out.requests.destroy.terraform.json
-@@ -1 +1,7 @@
--[]+[
-+  {
-+    "body": {},
-+    "method": "PUT",
-+    "path": "/api/2.0/permissions/experiments/[NUMID]"
-+  }
-+]
-MATCH jobs/current_can_manage/out.requests.deploy.direct.json
-DIFF  jobs/current_can_manage/out.requests.destroy.direct.json
---- jobs/current_can_manage/out.requests.destroy.direct.json
-+++ jobs/current_can_manage/out.requests.destroy.terraform.json
-@@ -1 +1,14 @@
--[]+[
-+  {
-+    "body": {
-+      "access_control_list": [
-+        {
-+          "permission_level": "IS_OWNER",
-+          "user_name": "[USERNAME]"
-+        }
-+      ]
-+    },
-+    "method": "PUT",
-+    "path": "/api/2.0/permissions/jobs/[NUMID]"
-+  }
-+]
-DIFF  jobs/current_can_manage_run/out.destroy.requests.direct.json
---- jobs/current_can_manage_run/out.destroy.requests.direct.json
-+++ jobs/current_can_manage_run/out.destroy.requests.terraform.json
-@@ -1,4 +1,16 @@
- [
-+  {
-+    "body": {
-+      "access_control_list": [
-+        {
-+          "permission_level": "IS_OWNER",
-+          "user_name": "[USERNAME]"
-+        }
-+      ]
-+    },
-+    "method": "PUT",
-+    "path": "/api/2.0/permissions/jobs/[NUMID]"
-+  },
-   {
-     "body": {
-       "job_id": "[NUMID]"
-EXACT jobs/current_is_owner/out.requests.deploy.direct.json
-DIFF  jobs/current_is_owner/out.requests.destroy.direct.json
---- jobs/current_is_owner/out.requests.destroy.direct.json
-+++ jobs/current_is_owner/out.requests.destroy.terraform.json
-@@ -1 +1,14 @@
--[]+[
-+  {
-+    "body": {
-+      "access_control_list": [
-+        {
-+          "permission_level": "IS_OWNER",
-+          "user_name": "[USERNAME]"
-+        }
-+      ]
-+    },
-+    "method": "PUT",
-+    "path": "/api/2.0/permissions/jobs/[NUMID]"
-+  }
-+]
-DIFF  jobs/delete_one/out.requests_destroy.direct.json
---- jobs/delete_one/out.requests_destroy.direct.json
-+++ jobs/delete_one/out.requests_destroy.terraform.json
-@@ -1,4 +1,16 @@
- [
-+  {
-+    "body": {
-+      "access_control_list": [
-+        {
-+          "permission_level": "IS_OWNER",
-+          "user_name": "[USERNAME]"
-+        }
-+      ]
-+    },
-+    "method": "PUT",
-+    "path": "/api/2.0/permissions/jobs/[JOB_WITH_PERMISSIONS_ID]"
-+  },
-   {
-     "body": {
-       "job_id": "[JOB_WITH_PERMISSIONS_ID]"
-EXACT jobs/empty_list/out.requests.deploy.direct.json
-EXACT jobs/empty_list/out.requests.destroy.direct.json
-MATCH jobs/other_can_manage/out.requests.deploy.direct.json
-DIFF  jobs/other_can_manage/out.requests.destroy.direct.json
---- jobs/other_can_manage/out.requests.destroy.direct.json
-+++ jobs/other_can_manage/out.requests.destroy.terraform.json
-@@ -1 +1,14 @@
--[]+[
-+  {
-+    "body": {
-+      "access_control_list": [
-+        {
-+          "permission_level": "IS_OWNER",
-+          "user_name": "[USERNAME]"
-+        }
-+      ]
-+    },
-+    "method": "PUT",
-+    "path": "/api/2.0/permissions/jobs/[NUMID]"
-+  }
-+]
-DIFF  jobs/other_can_manage_run/out.destroy.requests.direct.json
---- jobs/other_can_manage_run/out.destroy.requests.direct.json
-+++ jobs/other_can_manage_run/out.destroy.requests.terraform.json
-@@ -1,4 +1,16 @@
- [
-+  {
-+    "body": {
-+      "access_control_list": [
-+        {
-+          "permission_level": "IS_OWNER",
-+          "user_name": "[USERNAME]"
-+        }
-+      ]
-+    },
-+    "method": "PUT",
-+    "path": "/api/2.0/permissions/jobs/[NUMID]"
-+  },
-   {
-     "body": {
-       "job_id": "[NUMID]"
-EXACT jobs/other_is_owner/out.requests.deploy.direct.json
-DIFF  jobs/other_is_owner/out.requests.destroy.direct.json
---- jobs/other_is_owner/out.requests.destroy.direct.json
-+++ jobs/other_is_owner/out.requests.destroy.terraform.json
-@@ -1 +1,14 @@
--[]+[
-+  {
-+    "body": {
-+      "access_control_list": [
-+        {
-+          "permission_level": "IS_OWNER",
-+          "user_name": "[USERNAME]"
-+        }
-+      ]
-+    },
-+    "method": "PUT",
-+    "path": "/api/2.0/permissions/jobs/[NUMID]"
-+  }
-+]
-DIFF  jobs/update/out.requests_delete_all.direct.json
---- jobs/update/out.requests_delete_all.direct.json
-+++ jobs/update/out.requests_delete_all.terraform.json
-@@ -1 +1,14 @@
--[]+[
-+  {
-+    "body": {
-+      "access_control_list": [
-+        {
-+          "permission_level": "IS_OWNER",
-+          "user_name": "[USERNAME]"
-+        }
-+      ]
-+    },
-+    "method": "PUT",
-+    "path": "/api/2.0/permissions/jobs/[JOB_WITH_PERMISSIONS_ID]"
-+  }
-+]
-DIFF  jobs/update/out.requests_destroy.direct.json
---- jobs/update/out.requests_destroy.direct.json
-+++ jobs/update/out.requests_destroy.terraform.json
-@@ -1,4 +1,16 @@
- [
-+  {
-+    "body": {
-+      "access_control_list": [
-+        {
-+          "permission_level": "IS_OWNER",
-+          "user_name": "[USERNAME]"
-+        }
-+      ]
-+    },
-+    "method": "PUT",
-+    "path": "/api/2.0/permissions/jobs/[JOB_WITH_PERMISSIONS_ID]"
-+  },
-   {
-     "body": {
-       "job_id": "[JOB_WITH_PERMISSIONS_ID]"
-EXACT jobs/update/out.requests_set_empty.direct.json
-MATCH jobs/viewers/out.requests.deploy.direct.json
-DIFF  jobs/viewers/out.requests.destroy.direct.json
---- jobs/viewers/out.requests.destroy.direct.json
-+++ jobs/viewers/out.requests.destroy.terraform.json
-@@ -1 +1,14 @@
--[]+[
-+  {
-+    "body": {
-+      "access_control_list": [
-+        {
-+          "permission_level": "IS_OWNER",
-+          "user_name": "[USERNAME]"
-+        }
-+      ]
-+    },
-+    "method": "PUT",
-+    "path": "/api/2.0/permissions/jobs/[NUMID]"
-+  }
-+]
-MATCH models/current_can_manage/out.requests.deploy.direct.json
-DIFF  models/current_can_manage/out.requests.destroy.direct.json
---- models/current_can_manage/out.requests.destroy.direct.json
-+++ models/current_can_manage/out.requests.destroy.terraform.json
-@@ -1 +1,14 @@
--[]+[
-+  {
-+    "body": {
-+      "access_control_list": [
-+        {
-+          "permission_level": "CAN_MANAGE",
-+          "user_name": "[USERNAME]"
-+        }
-+      ]
-+    },
-+    "method": "PUT",
-+    "path": "/api/2.0/permissions/registered-models/[FOO_MODEL_ID]"
-+  }
-+]
-MATCH pipelines/current_can_manage/out.requests.deploy.direct.json
-EXACT pipelines/current_can_manage/out.requests.destroy.direct.json
-EXACT pipelines/current_is_owner/out.requests.deploy.direct.json
-EXACT pipelines/current_is_owner/out.requests.destroy.direct.json
-EXACT pipelines/empty_list/out.requests.deploy.direct.json
-EXACT pipelines/empty_list/out.requests.destroy.direct.json
-MATCH pipelines/other_can_manage/out.requests.deploy.direct.json
-EXACT pipelines/other_can_manage/out.requests.destroy.direct.json
-EXACT pipelines/other_is_owner/out.requests.deploy.direct.json
-EXACT pipelines/other_is_owner/out.requests.destroy.direct.json
-MATCH postgres_projects/current_can_manage/out.requests.deploy.direct.json
-DIFF  postgres_projects/current_can_manage/out.requests.destroy.direct.json
---- postgres_projects/current_can_manage/out.requests.destroy.direct.json
-+++ postgres_projects/current_can_manage/out.requests.destroy.terraform.json
-@@ -1 +1,14 @@
--[]+[
-+  {
-+    "body": {
-+      "access_control_list": [
-+        {
-+          "permission_level": "CAN_MANAGE",
-+          "user_name": "[USERNAME]"
-+        }
-+      ]
-+    },
-+    "method": "PUT",
-+    "path": "/api/2.0/permissions/database-projects/test-project"
-+  }
-+]
-MATCH sql_warehouses/current_can_manage/out.requests.deploy.direct.json
-DIFF  sql_warehouses/current_can_manage/out.requests.destroy.direct.json
---- sql_warehouses/current_can_manage/out.requests.destroy.direct.json
-+++ sql_warehouses/current_can_manage/out.requests.destroy.terraform.json
-@@ -1 +1,18 @@
--[]+[
-+  {
-+    "body": {
-+      "access_control_list": [
-+        {
-+          "permission_level": "CAN_MANAGE",
-+          "user_name": "[USERNAME]"
-+        },
-+        {
-+          "permission_level": "IS_OWNER",
-+          "user_name": "[USERNAME]"
-+        }
-+      ]
-+    },
-+    "method": "PUT",
-+    "path": "/api/2.0/permissions/sql/warehouses/[UUID]"
-+  }
-+]
-EXACT target_permissions/out.requests_create.direct.json
-DIFF  target_permissions/out.requests_delete.direct.json
---- target_permissions/out.requests_delete.direct.json
-+++ target_permissions/out.requests_delete.terraform.json
-@@ -1,4 +1,16 @@
- [
-+  {
-+    "body": {
-+      "access_control_list": [
-+        {
-+          "permission_level": "IS_OWNER",
-+          "user_name": "[USERNAME]"
-+        }
-+      ]
-+    },
-+    "method": "PUT",
-+    "path": "/api/2.0/permissions/jobs/[NUMID]"
-+  },
-   {
-     "body": {
-       "job_id": "[NUMID]"
-DIRECT_ONLY vector_search_endpoints/current_can_manage/out.requests.deploy.direct.json
-DIRECT_ONLY vector_search_endpoints/current_can_manage/out.requests.destroy.direct.json
diff --git a/acceptance/bundle/resources/permissions/pipelines/504/create/databricks.yml b/acceptance/bundle/resources/permissions/pipelines/504/create/databricks.yml
new file mode 100644
index 00000000000..05d0681c885
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/pipelines/504/create/databricks.yml
@@ -0,0 +1,10 @@
+bundle:
+  name: test-bundle
+
+resources:
+  pipelines:
+    foo:
+      name: foo
+      permissions:
+        - level: CAN_VIEW
+          user_name: viewer@example.com
diff --git a/acceptance/bundle/resources/permissions/pipelines/504/create/out.test.toml b/acceptance/bundle/resources/permissions/pipelines/504/create/out.test.toml
new file mode 100644
index 00000000000..15c32f324ac
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/pipelines/504/create/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = []
diff --git a/acceptance/bundle/resources/permissions/pipelines/504/create/output.txt b/acceptance/bundle/resources/permissions/pipelines/504/create/output.txt
new file mode 100644
index 00000000000..731801f02ca
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/pipelines/504/create/output.txt
@@ -0,0 +1,10 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created pipelines.foo
+Warn: deploying resources.pipelines.foo.permissions: retrying after 504 Gateway Timeout from PUT /api/2.0/permissions/pipelines/[UUID]
+Created pipelines.foo.permissions
+Files: 1 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //api/2.0/permissions/pipelines
+"PUT /api/2.0/permissions/pipelines/[UUID]"
+"PUT /api/2.0/permissions/pipelines/[UUID]"
diff --git a/acceptance/bundle/resources/permissions/pipelines/504/create/script b/acceptance/bundle/resources/permissions/pipelines/504/create/script
new file mode 100644
index 00000000000..616aaeb8034
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/pipelines/504/create/script
@@ -0,0 +1,8 @@
+# Inject a single 504 on the first permissions PUT to simulate a transient error.
+# Permissions Set is idempotent, so DoCreate opts in via retrySafe and the deploy succeeds.
+fault.py "PUT /api/2.0/permissions/pipelines/*" 504 0 1
+
+$CLI bundle deploy
+
+# Two PUT requests should appear: the initial 504 and the successful retry.
+trace print_requests.py //api/2.0/permissions/pipelines | jq '.method + " " + .path'
diff --git a/acceptance/bundle/resources/permissions/pipelines/504/create/test.toml b/acceptance/bundle/resources/permissions/pipelines/504/create/test.toml
new file mode 100644
index 00000000000..159efe02696
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/pipelines/504/create/test.toml
@@ -0,0 +1 @@
+RecordRequests = true
diff --git a/acceptance/bundle/resources/permissions/pipelines/504/plan/databricks.yml b/acceptance/bundle/resources/permissions/pipelines/504/plan/databricks.yml
new file mode 100644
index 00000000000..05d0681c885
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/pipelines/504/plan/databricks.yml
@@ -0,0 +1,10 @@
+bundle:
+  name: test-bundle
+
+resources:
+  pipelines:
+    foo:
+      name: foo
+      permissions:
+        - level: CAN_VIEW
+          user_name: viewer@example.com
diff --git a/acceptance/bundle/resources/permissions/pipelines/504/plan/out.test.toml b/acceptance/bundle/resources/permissions/pipelines/504/plan/out.test.toml
new file mode 100644
index 00000000000..15c32f324ac
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/pipelines/504/plan/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = []
diff --git a/acceptance/bundle/resources/permissions/pipelines/504/plan/output.txt b/acceptance/bundle/resources/permissions/pipelines/504/plan/output.txt
new file mode 100644
index 00000000000..3bfb86fdf75
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/pipelines/504/plan/output.txt
@@ -0,0 +1,32 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created pipelines.foo
+Created pipelines.foo.permissions
+Files: 1 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] bundle plan
+Warn: planning resources.pipelines.foo.permissions: retrying after 504 Gateway Timeout from GET /api/2.0/permissions/pipelines/[UUID]
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
+
+>>> print_requests.py //api/2.0/permissions/pipelines --get --oneline
+2 {"method": "GET", "path": "/api/2.0/permissions/pipelines/[UUID]"}
+
+>>> [CLI] bundle plan
+Warn: planning resources.pipelines.foo.permissions: retrying after 504 Gateway Timeout from GET /api/2.0/permissions/pipelines/[UUID]
+Warn: planning resources.pipelines.foo.permissions: retrying after 504 Gateway Timeout from GET /api/2.0/permissions/pipelines/[UUID]
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
+3 {"method": "GET", "path": "/api/2.0/permissions/pipelines/[UUID]"}
+
+>>> musterr [CLI] bundle plan
+Warn: planning resources.pipelines.foo.permissions: retrying after 504 Gateway Timeout from GET /api/2.0/permissions/pipelines/[UUID]
+Warn: planning resources.pipelines.foo.permissions: retrying after 504 Gateway Timeout from GET /api/2.0/permissions/pipelines/[UUID]
+Error: cannot plan resources.pipelines.foo.permissions: reading id="/pipelines/[UUID]": Fault injected by test. (504 INJECTED)
+
+Endpoint: GET [DATABRICKS_URL]/api/2.0/permissions/pipelines/[UUID]?
+HTTP Status: 504 Gateway Timeout
+API error_code: INJECTED
+API message: Fault injected by test.
+
+Error: planning failed
+
+3 {"method": "GET", "path": "/api/2.0/permissions/pipelines/[UUID]"}
diff --git a/acceptance/bundle/resources/permissions/pipelines/504/plan/script b/acceptance/bundle/resources/permissions/pipelines/504/plan/script
new file mode 100644
index 00000000000..12e65049dd1
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/pipelines/504/plan/script
@@ -0,0 +1,15 @@
+# Deploy first so the permissions resource exists; plan reads it on subsequent runs.
+$CLI bundle deploy
+rm -f "$OUT_REQUESTS"
+
+fault.py "GET /api/2.0/permissions/pipelines/*" 504 0 1
+trace $CLI bundle plan
+trace print_requests.py //api/2.0/permissions/pipelines --get --oneline | uniq -c | sed 's/^ *//' | contains.py "2 "
+
+fault.py "GET /api/2.0/permissions/pipelines/*" 504 0 2
+trace $CLI bundle plan
+print_requests.py //api/2.0/permissions/pipelines --get --oneline | uniq -c | sed 's/^ *//' | contains.py "3 "
+
+fault.py "GET /api/2.0/permissions/pipelines/*" 504 0 3
+trace musterr $CLI bundle plan
+print_requests.py //api/2.0/permissions/pipelines --get --oneline | uniq -c | sed 's/^ *//' | contains.py "3 "
diff --git a/acceptance/bundle/resources/permissions/pipelines/504/test.toml b/acceptance/bundle/resources/permissions/pipelines/504/test.toml
new file mode 100644
index 00000000000..99ccafaf8e8
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/pipelines/504/test.toml
@@ -0,0 +1,5 @@
+Env.DATABRICKS_BUNDLE_ENGINE = "direct"
+EnvMatrix.READPLAN = []
+RecordRequests = true
+Env.DATABRICKS_BUNDLE_RETRY_INTERVAL_MS = "100"
+Env.DATABRICKS_BUNDLE_RETRY_DISABLE_WARNING = ""
diff --git a/acceptance/bundle/resources/permissions/pipelines/504/update/databricks.yml b/acceptance/bundle/resources/permissions/pipelines/504/update/databricks.yml
new file mode 100644
index 00000000000..05d0681c885
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/pipelines/504/update/databricks.yml
@@ -0,0 +1,10 @@
+bundle:
+  name: test-bundle
+
+resources:
+  pipelines:
+    foo:
+      name: foo
+      permissions:
+        - level: CAN_VIEW
+          user_name: viewer@example.com
diff --git a/acceptance/bundle/resources/permissions/pipelines/504/update/out.test.toml b/acceptance/bundle/resources/permissions/pipelines/504/update/out.test.toml
new file mode 100644
index 00000000000..15c32f324ac
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/pipelines/504/update/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = []
diff --git a/acceptance/bundle/resources/permissions/pipelines/504/update/output.txt b/acceptance/bundle/resources/permissions/pipelines/504/update/output.txt
new file mode 100644
index 00000000000..bc942a34a24
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/pipelines/504/update/output.txt
@@ -0,0 +1,18 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created pipelines.foo
+Created pipelines.foo.permissions
+Files: 1 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Warn: deploying resources.pipelines.foo.permissions: retrying after 504 Gateway Timeout from PUT /api/2.0/permissions/pipelines/[UUID]
+Updated pipelines.foo.permissions
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 1 unchanged
+
+>>> print_requests.py //api/2.0/permissions/pipelines
+"PUT /api/2.0/permissions/pipelines/[UUID]"
+"PUT /api/2.0/permissions/pipelines/[UUID]"
diff --git a/acceptance/bundle/resources/permissions/pipelines/504/update/script b/acceptance/bundle/resources/permissions/pipelines/504/update/script
new file mode 100644
index 00000000000..07f5b3dccf2
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/pipelines/504/update/script
@@ -0,0 +1,13 @@
+trace $CLI bundle deploy
+
+update_file.py databricks.yml CAN_VIEW CAN_MANAGE
+
+# Inject a single 504 on the first permissions PUT to simulate a transient error.
+# The retrying adapter should retry after DATABRICKS_BUNDLE_RETRY_INTERVAL_MS and succeed.
+fault.py "PUT /api/2.0/permissions/pipelines/*" 504 0 1
+
+rm "$OUT_REQUESTS"
+trace $CLI bundle deploy
+
+# Two PUT requests should appear: the initial 504 and the successful retry.
+trace print_requests.py //api/2.0/permissions/pipelines | jq '.method + " " + .path'
diff --git a/acceptance/bundle/resources/permissions/pipelines/current_can_manage/out.plan.direct.json b/acceptance/bundle/resources/permissions/pipelines/current_can_manage/out.plan.direct.json
deleted file mode 100644
index a8ebd11b309..00000000000
--- a/acceptance/bundle/resources/permissions/pipelines/current_can_manage/out.plan.direct.json
+++ /dev/null
@@ -1,55 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.foo": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "channel": "CURRENT",
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "edition": "ADVANCED",
-          "name": "foo"
-        }
-      }
-    },
-    "resources.pipelines.foo.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.foo",
-          "label": "${resources.pipelines.foo.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "CAN_VIEW",
-              "user_name": "viewer@example.com"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "group_name": "data-team"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "service_principal_name": "[UUID]"
-            },
-            {
-              "level": "IS_OWNER",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/pipelines/${resources.pipelines.foo.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/pipelines/current_can_manage/out.plan.json b/acceptance/bundle/resources/permissions/pipelines/current_can_manage/out.plan.json
new file mode 100644
index 00000000000..37b44208752
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/pipelines/current_can_manage/out.plan.json
@@ -0,0 +1,55 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.pipelines.foo": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "channel": "CURRENT",
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edition": "ADVANCED",
+          "name": "foo"
+        }
+      }
+    },
+    "resources.pipelines.foo.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.foo",
+          "label": "${resources.pipelines.foo.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "CAN_VIEW",
+              "user_name": "viewer@example.com"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "group_name": "data-team"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "service_principal_name": "[UUID]"
+            },
+            {
+              "level": "IS_OWNER",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/pipelines/${resources.pipelines.foo.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/pipelines/current_can_manage/out.plan.terraform.json b/acceptance/bundle/resources/permissions/pipelines/current_can_manage/out.plan.terraform.json
deleted file mode 100644
index 2d8b9083e6a..00000000000
--- a/acceptance/bundle/resources/permissions/pipelines/current_can_manage/out.plan.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.foo": {
-      "action": "create"
-    },
-    "resources.pipelines.foo.permissions": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/pipelines/current_can_manage/out.requests.deploy.direct.json b/acceptance/bundle/resources/permissions/pipelines/current_can_manage/out.requests.deploy.direct.json
deleted file mode 100644
index 42daa83bd86..00000000000
--- a/acceptance/bundle/resources/permissions/pipelines/current_can_manage/out.requests.deploy.direct.json
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/pipelines/[UUID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_VIEW",
-        "user_name": "viewer@example.com"
-      },
-      {
-        "group_name": "data-team",
-        "permission_level": "CAN_MANAGE"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "service_principal_name": "[UUID]"
-      },
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/pipelines/current_can_manage/out.requests.deploy.json b/acceptance/bundle/resources/permissions/pipelines/current_can_manage/out.requests.deploy.json
new file mode 100644
index 00000000000..3cf3626b1d8
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/pipelines/current_can_manage/out.requests.deploy.json
@@ -0,0 +1,24 @@
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/pipelines/[FOO_ID]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "CAN_VIEW",
+        "user_name": "viewer@example.com"
+      },
+      {
+        "group_name": "data-team",
+        "permission_level": "CAN_MANAGE"
+      },
+      {
+        "permission_level": "CAN_MANAGE",
+        "service_principal_name": "[UUID]"
+      },
+      {
+        "permission_level": "IS_OWNER",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/pipelines/current_can_manage/out.requests.deploy.terraform.json b/acceptance/bundle/resources/permissions/pipelines/current_can_manage/out.requests.deploy.terraform.json
deleted file mode 100644
index 336c18a3ad9..00000000000
--- a/acceptance/bundle/resources/permissions/pipelines/current_can_manage/out.requests.deploy.terraform.json
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/pipelines/[UUID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_VIEW",
-        "user_name": "viewer@example.com"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "service_principal_name": "[UUID]"
-      },
-      {
-        "group_name": "data-team",
-        "permission_level": "CAN_MANAGE"
-      },
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/pipelines/empty_list/out.requests.deploy.direct.json b/acceptance/bundle/resources/permissions/pipelines/current_can_manage/out.requests.destroy.json
similarity index 100%
rename from acceptance/bundle/resources/permissions/pipelines/empty_list/out.requests.deploy.direct.json
rename to acceptance/bundle/resources/permissions/pipelines/current_can_manage/out.requests.destroy.json
diff --git a/acceptance/bundle/resources/permissions/pipelines/current_can_manage/out.test.toml b/acceptance/bundle/resources/permissions/pipelines/current_can_manage/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/permissions/pipelines/current_can_manage/out.test.toml
+++ b/acceptance/bundle/resources/permissions/pipelines/current_can_manage/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/permissions/pipelines/current_can_manage/output.txt b/acceptance/bundle/resources/permissions/pipelines/current_can_manage/output.txt
index 2e15e6e4108..bde655873be 100644
--- a/acceptance/bundle/resources/permissions/pipelines/current_can_manage/output.txt
+++ b/acceptance/bundle/resources/permissions/pipelines/current_can_manage/output.txt
@@ -21,19 +21,19 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created pipelines.foo
+Created pipelines.foo.permissions
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
   delete resources.pipelines.foo
 
 This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
-Streaming Tables (STs) and Materialized Views (MVs) managed by them:
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:
   delete resources.pipelines.foo
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/permissions/pipelines/current_is_owner/out.plan.direct.json b/acceptance/bundle/resources/permissions/pipelines/current_is_owner/out.plan.direct.json
deleted file mode 100644
index b1c3bd84dad..00000000000
--- a/acceptance/bundle/resources/permissions/pipelines/current_is_owner/out.plan.direct.json
+++ /dev/null
@@ -1,43 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.foo": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "channel": "CURRENT",
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "edition": "ADVANCED",
-          "name": "foo"
-        }
-      }
-    },
-    "resources.pipelines.foo.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.foo",
-          "label": "${resources.pipelines.foo.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "IS_OWNER",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/pipelines/${resources.pipelines.foo.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/pipelines/current_is_owner/out.plan.json b/acceptance/bundle/resources/permissions/pipelines/current_is_owner/out.plan.json
new file mode 100644
index 00000000000..f70a476a37e
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/pipelines/current_is_owner/out.plan.json
@@ -0,0 +1,43 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.pipelines.foo": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "channel": "CURRENT",
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edition": "ADVANCED",
+          "name": "foo"
+        }
+      }
+    },
+    "resources.pipelines.foo.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.foo",
+          "label": "${resources.pipelines.foo.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "IS_OWNER",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/pipelines/${resources.pipelines.foo.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/pipelines/current_is_owner/out.plan.terraform.json b/acceptance/bundle/resources/permissions/pipelines/current_is_owner/out.plan.terraform.json
deleted file mode 100644
index 2d8b9083e6a..00000000000
--- a/acceptance/bundle/resources/permissions/pipelines/current_is_owner/out.plan.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.foo": {
-      "action": "create"
-    },
-    "resources.pipelines.foo.permissions": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/pipelines/current_is_owner/out.requests.deploy.direct.json b/acceptance/bundle/resources/permissions/pipelines/current_is_owner/out.requests.deploy.direct.json
deleted file mode 100644
index 578163835c1..00000000000
--- a/acceptance/bundle/resources/permissions/pipelines/current_is_owner/out.requests.deploy.direct.json
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/pipelines/[UUID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/pipelines/current_is_owner/out.requests.deploy.json b/acceptance/bundle/resources/permissions/pipelines/current_is_owner/out.requests.deploy.json
new file mode 100644
index 00000000000..432b096a2b0
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/pipelines/current_is_owner/out.requests.deploy.json
@@ -0,0 +1,12 @@
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/pipelines/[FOO_ID]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "IS_OWNER",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/pipelines/current_is_owner/out.requests.deploy.terraform.json b/acceptance/bundle/resources/permissions/pipelines/current_is_owner/out.requests.deploy.terraform.json
deleted file mode 100644
index 578163835c1..00000000000
--- a/acceptance/bundle/resources/permissions/pipelines/current_is_owner/out.requests.deploy.terraform.json
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/pipelines/[UUID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/pipelines/empty_list/out.requests.deploy.terraform.json b/acceptance/bundle/resources/permissions/pipelines/current_is_owner/out.requests.destroy.json
similarity index 100%
rename from acceptance/bundle/resources/permissions/pipelines/empty_list/out.requests.deploy.terraform.json
rename to acceptance/bundle/resources/permissions/pipelines/current_is_owner/out.requests.destroy.json
diff --git a/acceptance/bundle/resources/permissions/pipelines/current_is_owner/out.test.toml b/acceptance/bundle/resources/permissions/pipelines/current_is_owner/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/permissions/pipelines/current_is_owner/out.test.toml
+++ b/acceptance/bundle/resources/permissions/pipelines/current_is_owner/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/permissions/pipelines/current_is_owner/output.txt b/acceptance/bundle/resources/permissions/pipelines/current_is_owner/output.txt
index 89f7921475b..2bc18b8ef40 100644
--- a/acceptance/bundle/resources/permissions/pipelines/current_is_owner/output.txt
+++ b/acceptance/bundle/resources/permissions/pipelines/current_is_owner/output.txt
@@ -9,19 +9,19 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created pipelines.foo
+Created pipelines.foo.permissions
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
   delete resources.pipelines.foo
 
 This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
-Streaming Tables (STs) and Materialized Views (MVs) managed by them:
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:
   delete resources.pipelines.foo
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/permissions/pipelines/empty_list/out.plan.direct.json b/acceptance/bundle/resources/permissions/pipelines/empty_list/out.plan.direct.json
deleted file mode 100644
index 181b89b2a34..00000000000
--- a/acceptance/bundle/resources/permissions/pipelines/empty_list/out.plan.direct.json
+++ /dev/null
@@ -1,20 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.foo": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "channel": "CURRENT",
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "edition": "ADVANCED",
-          "name": "foo"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/pipelines/empty_list/out.plan.json b/acceptance/bundle/resources/permissions/pipelines/empty_list/out.plan.json
new file mode 100644
index 00000000000..21fe7845337
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/pipelines/empty_list/out.plan.json
@@ -0,0 +1,20 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.pipelines.foo": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "channel": "CURRENT",
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edition": "ADVANCED",
+          "name": "foo"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/pipelines/empty_list/out.plan.terraform.json b/acceptance/bundle/resources/permissions/pipelines/empty_list/out.plan.terraform.json
deleted file mode 100644
index 584da1b0af2..00000000000
--- a/acceptance/bundle/resources/permissions/pipelines/empty_list/out.plan.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.foo": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/pipelines/empty_list/out.requests.destroy.direct.json b/acceptance/bundle/resources/permissions/pipelines/empty_list/out.requests.deploy.json
similarity index 100%
rename from acceptance/bundle/resources/permissions/pipelines/empty_list/out.requests.destroy.direct.json
rename to acceptance/bundle/resources/permissions/pipelines/empty_list/out.requests.deploy.json
diff --git a/acceptance/bundle/resources/permissions/pipelines/empty_list/out.requests.destroy.terraform.json b/acceptance/bundle/resources/permissions/pipelines/empty_list/out.requests.destroy.json
similarity index 100%
rename from acceptance/bundle/resources/permissions/pipelines/empty_list/out.requests.destroy.terraform.json
rename to acceptance/bundle/resources/permissions/pipelines/empty_list/out.requests.destroy.json
diff --git a/acceptance/bundle/resources/permissions/pipelines/empty_list/out.test.toml b/acceptance/bundle/resources/permissions/pipelines/empty_list/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/permissions/pipelines/empty_list/out.test.toml
+++ b/acceptance/bundle/resources/permissions/pipelines/empty_list/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/permissions/pipelines/empty_list/output.txt b/acceptance/bundle/resources/permissions/pipelines/empty_list/output.txt
index 2f3ce99457f..fef7e1f54c8 100644
--- a/acceptance/bundle/resources/permissions/pipelines/empty_list/output.txt
+++ b/acceptance/bundle/resources/permissions/pipelines/empty_list/output.txt
@@ -4,19 +4,18 @@ null
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created pipelines.foo
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
   delete resources.pipelines.foo
 
 This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
-Streaming Tables (STs) and Materialized Views (MVs) managed by them:
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:
   delete resources.pipelines.foo
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/permissions/pipelines/other_can_manage/out.plan.direct.json b/acceptance/bundle/resources/permissions/pipelines/other_can_manage/out.plan.direct.json
deleted file mode 100644
index a8ebd11b309..00000000000
--- a/acceptance/bundle/resources/permissions/pipelines/other_can_manage/out.plan.direct.json
+++ /dev/null
@@ -1,55 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.foo": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "channel": "CURRENT",
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "edition": "ADVANCED",
-          "name": "foo"
-        }
-      }
-    },
-    "resources.pipelines.foo.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.foo",
-          "label": "${resources.pipelines.foo.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "CAN_VIEW",
-              "user_name": "viewer@example.com"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "group_name": "data-team"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "service_principal_name": "[UUID]"
-            },
-            {
-              "level": "IS_OWNER",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/pipelines/${resources.pipelines.foo.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/pipelines/other_can_manage/out.plan.json b/acceptance/bundle/resources/permissions/pipelines/other_can_manage/out.plan.json
new file mode 100644
index 00000000000..37b44208752
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/pipelines/other_can_manage/out.plan.json
@@ -0,0 +1,55 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.pipelines.foo": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "channel": "CURRENT",
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edition": "ADVANCED",
+          "name": "foo"
+        }
+      }
+    },
+    "resources.pipelines.foo.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.foo",
+          "label": "${resources.pipelines.foo.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "CAN_VIEW",
+              "user_name": "viewer@example.com"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "group_name": "data-team"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "service_principal_name": "[UUID]"
+            },
+            {
+              "level": "IS_OWNER",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/pipelines/${resources.pipelines.foo.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/pipelines/other_can_manage/out.plan.terraform.json b/acceptance/bundle/resources/permissions/pipelines/other_can_manage/out.plan.terraform.json
deleted file mode 100644
index 2d8b9083e6a..00000000000
--- a/acceptance/bundle/resources/permissions/pipelines/other_can_manage/out.plan.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.foo": {
-      "action": "create"
-    },
-    "resources.pipelines.foo.permissions": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/pipelines/other_can_manage/out.requests.deploy.direct.json b/acceptance/bundle/resources/permissions/pipelines/other_can_manage/out.requests.deploy.direct.json
deleted file mode 100644
index 42daa83bd86..00000000000
--- a/acceptance/bundle/resources/permissions/pipelines/other_can_manage/out.requests.deploy.direct.json
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/pipelines/[UUID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_VIEW",
-        "user_name": "viewer@example.com"
-      },
-      {
-        "group_name": "data-team",
-        "permission_level": "CAN_MANAGE"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "service_principal_name": "[UUID]"
-      },
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/pipelines/other_can_manage/out.requests.deploy.json b/acceptance/bundle/resources/permissions/pipelines/other_can_manage/out.requests.deploy.json
new file mode 100644
index 00000000000..3cf3626b1d8
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/pipelines/other_can_manage/out.requests.deploy.json
@@ -0,0 +1,24 @@
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/pipelines/[FOO_ID]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "CAN_VIEW",
+        "user_name": "viewer@example.com"
+      },
+      {
+        "group_name": "data-team",
+        "permission_level": "CAN_MANAGE"
+      },
+      {
+        "permission_level": "CAN_MANAGE",
+        "service_principal_name": "[UUID]"
+      },
+      {
+        "permission_level": "IS_OWNER",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/pipelines/other_can_manage/out.requests.deploy.terraform.json b/acceptance/bundle/resources/permissions/pipelines/other_can_manage/out.requests.deploy.terraform.json
deleted file mode 100644
index 336c18a3ad9..00000000000
--- a/acceptance/bundle/resources/permissions/pipelines/other_can_manage/out.requests.deploy.terraform.json
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/pipelines/[UUID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_VIEW",
-        "user_name": "viewer@example.com"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "service_principal_name": "[UUID]"
-      },
-      {
-        "group_name": "data-team",
-        "permission_level": "CAN_MANAGE"
-      },
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/pipelines/other_can_manage/out.requests.destroy.direct.json b/acceptance/bundle/resources/permissions/pipelines/other_can_manage/out.requests.destroy.json
similarity index 100%
rename from acceptance/bundle/resources/permissions/pipelines/other_can_manage/out.requests.destroy.direct.json
rename to acceptance/bundle/resources/permissions/pipelines/other_can_manage/out.requests.destroy.json
diff --git a/acceptance/bundle/resources/permissions/pipelines/other_can_manage/out.test.toml b/acceptance/bundle/resources/permissions/pipelines/other_can_manage/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/permissions/pipelines/other_can_manage/out.test.toml
+++ b/acceptance/bundle/resources/permissions/pipelines/other_can_manage/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/permissions/pipelines/other_can_manage/output.txt b/acceptance/bundle/resources/permissions/pipelines/other_can_manage/output.txt
index 2e15e6e4108..bde655873be 100644
--- a/acceptance/bundle/resources/permissions/pipelines/other_can_manage/output.txt
+++ b/acceptance/bundle/resources/permissions/pipelines/other_can_manage/output.txt
@@ -21,19 +21,19 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created pipelines.foo
+Created pipelines.foo.permissions
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
   delete resources.pipelines.foo
 
 This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
-Streaming Tables (STs) and Materialized Views (MVs) managed by them:
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:
   delete resources.pipelines.foo
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/permissions/pipelines/other_is_owner/out.plan.direct.json b/acceptance/bundle/resources/permissions/pipelines/other_is_owner/out.plan.direct.json
deleted file mode 100644
index 5d9f70cfc37..00000000000
--- a/acceptance/bundle/resources/permissions/pipelines/other_is_owner/out.plan.direct.json
+++ /dev/null
@@ -1,47 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.foo": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "channel": "CURRENT",
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
-          },
-          "edition": "ADVANCED",
-          "name": "foo"
-        }
-      }
-    },
-    "resources.pipelines.foo.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.foo",
-          "label": "${resources.pipelines.foo.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "IS_OWNER",
-              "user_name": "other_user@databricks.com"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/pipelines/${resources.pipelines.foo.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/pipelines/other_is_owner/out.plan.json b/acceptance/bundle/resources/permissions/pipelines/other_is_owner/out.plan.json
new file mode 100644
index 00000000000..6de5577c476
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/pipelines/other_is_owner/out.plan.json
@@ -0,0 +1,47 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.pipelines.foo": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "channel": "CURRENT",
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edition": "ADVANCED",
+          "name": "foo"
+        }
+      }
+    },
+    "resources.pipelines.foo.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.foo",
+          "label": "${resources.pipelines.foo.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "IS_OWNER",
+              "user_name": "other_user@databricks.com"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/pipelines/${resources.pipelines.foo.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/pipelines/other_is_owner/out.plan.terraform.json b/acceptance/bundle/resources/permissions/pipelines/other_is_owner/out.plan.terraform.json
deleted file mode 100644
index 2d8b9083e6a..00000000000
--- a/acceptance/bundle/resources/permissions/pipelines/other_is_owner/out.plan.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.foo": {
-      "action": "create"
-    },
-    "resources.pipelines.foo.permissions": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/pipelines/other_is_owner/out.requests.deploy.direct.json b/acceptance/bundle/resources/permissions/pipelines/other_is_owner/out.requests.deploy.direct.json
deleted file mode 100644
index 8925d4f66d4..00000000000
--- a/acceptance/bundle/resources/permissions/pipelines/other_is_owner/out.requests.deploy.direct.json
+++ /dev/null
@@ -1,16 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/pipelines/[UUID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "other_user@databricks.com"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/pipelines/other_is_owner/out.requests.deploy.json b/acceptance/bundle/resources/permissions/pipelines/other_is_owner/out.requests.deploy.json
new file mode 100644
index 00000000000..374e454b56e
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/pipelines/other_is_owner/out.requests.deploy.json
@@ -0,0 +1,16 @@
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/pipelines/[FOO_ID]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "IS_OWNER",
+        "user_name": "other_user@databricks.com"
+      },
+      {
+        "permission_level": "CAN_MANAGE",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/pipelines/other_is_owner/out.requests.deploy.terraform.json b/acceptance/bundle/resources/permissions/pipelines/other_is_owner/out.requests.deploy.terraform.json
deleted file mode 100644
index 8925d4f66d4..00000000000
--- a/acceptance/bundle/resources/permissions/pipelines/other_is_owner/out.requests.deploy.terraform.json
+++ /dev/null
@@ -1,16 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/pipelines/[UUID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "other_user@databricks.com"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/pipelines/other_can_manage/out.requests.destroy.terraform.json b/acceptance/bundle/resources/permissions/pipelines/other_is_owner/out.requests.destroy.json
similarity index 100%
rename from acceptance/bundle/resources/permissions/pipelines/other_can_manage/out.requests.destroy.terraform.json
rename to acceptance/bundle/resources/permissions/pipelines/other_is_owner/out.requests.destroy.json
diff --git a/acceptance/bundle/resources/permissions/pipelines/other_is_owner/out.test.toml b/acceptance/bundle/resources/permissions/pipelines/other_is_owner/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/permissions/pipelines/other_is_owner/out.test.toml
+++ b/acceptance/bundle/resources/permissions/pipelines/other_is_owner/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/permissions/pipelines/other_is_owner/output.txt b/acceptance/bundle/resources/permissions/pipelines/other_is_owner/output.txt
index 3b82b04aa94..b1bfa3af060 100644
--- a/acceptance/bundle/resources/permissions/pipelines/other_is_owner/output.txt
+++ b/acceptance/bundle/resources/permissions/pipelines/other_is_owner/output.txt
@@ -13,19 +13,19 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created pipelines.foo
+Created pipelines.foo.permissions
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
   delete resources.pipelines.foo
 
 This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
-Streaming Tables (STs) and Materialized Views (MVs) managed by them:
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:
   delete resources.pipelines.foo
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/permissions/pipelines/update/out.plan_create.direct.json b/acceptance/bundle/resources/permissions/pipelines/update/out.plan_create.direct.json
deleted file mode 100644
index 5ca8d81451a..00000000000
--- a/acceptance/bundle/resources/permissions/pipelines/update/out.plan_create.direct.json
+++ /dev/null
@@ -1,51 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.foo": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "channel": "CURRENT",
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/permissions-test/default/state/metadata.json"
-          },
-          "edition": "ADVANCED",
-          "name": "foo"
-        }
-      }
-    },
-    "resources.pipelines.foo.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.foo",
-          "label": "${resources.pipelines.foo.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "CAN_VIEW",
-              "user_name": "viewer@example.com"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "group_name": "data-team"
-            },
-            {
-              "level": "IS_OWNER",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/pipelines/${resources.pipelines.foo.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/pipelines/update/out.plan_create.json b/acceptance/bundle/resources/permissions/pipelines/update/out.plan_create.json
new file mode 100644
index 00000000000..791cee44006
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/pipelines/update/out.plan_create.json
@@ -0,0 +1,51 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.pipelines.foo": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "channel": "CURRENT",
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/permissions-test/default/state/metadata.json"
+          },
+          "edition": "ADVANCED",
+          "name": "foo"
+        }
+      }
+    },
+    "resources.pipelines.foo.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.foo",
+          "label": "${resources.pipelines.foo.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "CAN_VIEW",
+              "user_name": "viewer@example.com"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "group_name": "data-team"
+            },
+            {
+              "level": "IS_OWNER",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/pipelines/${resources.pipelines.foo.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/pipelines/update/out.plan_create.terraform.json b/acceptance/bundle/resources/permissions/pipelines/update/out.plan_create.terraform.json
deleted file mode 100644
index 2d8b9083e6a..00000000000
--- a/acceptance/bundle/resources/permissions/pipelines/update/out.plan_create.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.foo": {
-      "action": "create"
-    },
-    "resources.pipelines.foo.permissions": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/pipelines/update/out.plan_delete_all.direct.json b/acceptance/bundle/resources/permissions/pipelines/update/out.plan_delete_all.direct.json
deleted file mode 100644
index 8319454108d..00000000000
--- a/acceptance/bundle/resources/permissions/pipelines/update/out.plan_delete_all.direct.json
+++ /dev/null
@@ -1,57 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 3,
-  "plan": {
-    "resources.pipelines.foo": {
-      "action": "skip",
-      "remote_state": {
-        "channel": "CURRENT",
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/permissions-test/default/state/metadata.json"
-        },
-        "edition": "ADVANCED",
-        "effective_publishing_mode": "DEFAULT_PUBLISHING_MODE",
-        "id": "[FOO_ID]",
-        "last_modified": [UNIX_TIME_MILLIS],
-        "name": "foo",
-        "pipeline_id": "[FOO_ID]",
-        "run_as_user_name": "[USERNAME]",
-        "state": "IDLE",
-        "storage": "dbfs:/pipelines/[FOO_ID]"
-      },
-      "changes": {
-        "storage": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "dbfs:/pipelines/[FOO_ID]"
-        }
-      }
-    },
-    "resources.pipelines.foo.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.foo",
-          "label": "${resources.pipelines.foo.id}"
-        }
-      ],
-      "action": "delete",
-      "remote_state": {
-        "object_id": "/pipelines/[FOO_ID]",
-        "__embed__": [
-          {
-            "level": "CAN_MANAGE",
-            "user_name": "viewer@example.com"
-          },
-          {
-            "level": "IS_OWNER",
-            "user_name": "[USERNAME]"
-          }
-        ]
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/pipelines/update/out.plan_delete_all.json b/acceptance/bundle/resources/permissions/pipelines/update/out.plan_delete_all.json
new file mode 100644
index 00000000000..d7f0f05e93e
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/pipelines/update/out.plan_delete_all.json
@@ -0,0 +1,45 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 3,
+  "plan": {
+    "resources.pipelines.foo": {
+      "action": "skip",
+      "remote_state": {
+        "channel": "CURRENT",
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/permissions-test/default/state/metadata.json"
+        },
+        "edition": "ADVANCED",
+        "effective_publishing_mode": "DEFAULT_PUBLISHING_MODE",
+        "id": "[FOO_ID]",
+        "last_modified": [UNIX_TIME_MILLIS],
+        "name": "foo",
+        "pipeline_id": "[FOO_ID]",
+        "run_as_user_name": "[USERNAME]",
+        "state": "IDLE",
+        "storage": "dbfs:/pipelines/[FOO_ID]"
+      },
+      "changes": {
+        "storage": {
+          "action": "skip",
+          "reason": "immutable_backend_value",
+          "remote": "dbfs:/pipelines/[FOO_ID]"
+        }
+      }
+    },
+    "resources.pipelines.foo.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.foo",
+          "label": "${resources.pipelines.foo.id}"
+        }
+      ],
+      "action": "delete",
+      "state_only": true
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/pipelines/update/out.plan_delete_all.terraform.json b/acceptance/bundle/resources/permissions/pipelines/update/out.plan_delete_all.terraform.json
deleted file mode 100644
index aeddf476a1d..00000000000
--- a/acceptance/bundle/resources/permissions/pipelines/update/out.plan_delete_all.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.foo": {
-      "action": "skip"
-    },
-    "resources.pipelines.foo.permissions": {
-      "action": "delete"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/pipelines/update/out.plan_delete_one.direct.json b/acceptance/bundle/resources/permissions/pipelines/update/out.plan_delete_one.direct.json
deleted file mode 100644
index b1ac2a1f9b0..00000000000
--- a/acceptance/bundle/resources/permissions/pipelines/update/out.plan_delete_one.direct.json
+++ /dev/null
@@ -1,89 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 2,
-  "plan": {
-    "resources.pipelines.foo": {
-      "action": "skip",
-      "remote_state": {
-        "channel": "CURRENT",
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/permissions-test/default/state/metadata.json"
-        },
-        "edition": "ADVANCED",
-        "effective_publishing_mode": "DEFAULT_PUBLISHING_MODE",
-        "id": "[FOO_ID]",
-        "last_modified": [UNIX_TIME_MILLIS],
-        "name": "foo",
-        "pipeline_id": "[FOO_ID]",
-        "run_as_user_name": "[USERNAME]",
-        "state": "IDLE",
-        "storage": "dbfs:/pipelines/[FOO_ID]"
-      },
-      "changes": {
-        "storage": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "dbfs:/pipelines/[FOO_ID]"
-        }
-      }
-    },
-    "resources.pipelines.foo.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.foo",
-          "label": "${resources.pipelines.foo.id}"
-        }
-      ],
-      "action": "update",
-      "new_state": {
-        "value": {
-          "object_id": "/pipelines/[FOO_ID]",
-          "__embed__": [
-            {
-              "level": "CAN_MANAGE",
-              "user_name": "viewer@example.com"
-            },
-            {
-              "level": "IS_OWNER",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        }
-      },
-      "remote_state": {
-        "object_id": "/pipelines/[FOO_ID]",
-        "__embed__": [
-          {
-            "level": "CAN_MANAGE",
-            "user_name": "viewer@example.com"
-          },
-          {
-            "level": "CAN_MANAGE",
-            "group_name": "data-team"
-          },
-          {
-            "level": "IS_OWNER",
-            "user_name": "[USERNAME]"
-          }
-        ]
-      },
-      "changes": {
-        "[group_name='data-team']": {
-          "action": "update",
-          "old": {
-            "level": "CAN_MANAGE",
-            "group_name": "data-team"
-          },
-          "remote": {
-            "level": "CAN_MANAGE",
-            "group_name": "data-team"
-          }
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/pipelines/update/out.plan_delete_one.json b/acceptance/bundle/resources/permissions/pipelines/update/out.plan_delete_one.json
new file mode 100644
index 00000000000..3bf8a3cc617
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/pipelines/update/out.plan_delete_one.json
@@ -0,0 +1,89 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 2,
+  "plan": {
+    "resources.pipelines.foo": {
+      "action": "skip",
+      "remote_state": {
+        "channel": "CURRENT",
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/permissions-test/default/state/metadata.json"
+        },
+        "edition": "ADVANCED",
+        "effective_publishing_mode": "DEFAULT_PUBLISHING_MODE",
+        "id": "[FOO_ID]",
+        "last_modified": [UNIX_TIME_MILLIS],
+        "name": "foo",
+        "pipeline_id": "[FOO_ID]",
+        "run_as_user_name": "[USERNAME]",
+        "state": "IDLE",
+        "storage": "dbfs:/pipelines/[FOO_ID]"
+      },
+      "changes": {
+        "storage": {
+          "action": "skip",
+          "reason": "immutable_backend_value",
+          "remote": "dbfs:/pipelines/[FOO_ID]"
+        }
+      }
+    },
+    "resources.pipelines.foo.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.foo",
+          "label": "${resources.pipelines.foo.id}"
+        }
+      ],
+      "action": "update",
+      "new_state": {
+        "value": {
+          "object_id": "/pipelines/[FOO_ID]",
+          "__embed__": [
+            {
+              "level": "CAN_MANAGE",
+              "user_name": "viewer@example.com"
+            },
+            {
+              "level": "IS_OWNER",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        }
+      },
+      "remote_state": {
+        "object_id": "/pipelines/[FOO_ID]",
+        "__embed__": [
+          {
+            "level": "CAN_MANAGE",
+            "user_name": "viewer@example.com"
+          },
+          {
+            "level": "CAN_MANAGE",
+            "group_name": "data-team"
+          },
+          {
+            "level": "IS_OWNER",
+            "user_name": "[USERNAME]"
+          }
+        ]
+      },
+      "changes": {
+        "[group_name='data-team']": {
+          "action": "update",
+          "old": {
+            "level": "CAN_MANAGE",
+            "group_name": "data-team"
+          },
+          "remote": {
+            "level": "CAN_MANAGE",
+            "group_name": "data-team"
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/pipelines/update/out.plan_delete_one.terraform.json b/acceptance/bundle/resources/permissions/pipelines/update/out.plan_delete_one.terraform.json
deleted file mode 100644
index 48764b2a494..00000000000
--- a/acceptance/bundle/resources/permissions/pipelines/update/out.plan_delete_one.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.foo": {
-      "action": "skip"
-    },
-    "resources.pipelines.foo.permissions": {
-      "action": "update"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/pipelines/update/out.plan_restore.direct.json b/acceptance/bundle/resources/permissions/pipelines/update/out.plan_restore.direct.json
deleted file mode 100644
index ef758fc7bac..00000000000
--- a/acceptance/bundle/resources/permissions/pipelines/update/out.plan_restore.direct.json
+++ /dev/null
@@ -1,63 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 4,
-  "plan": {
-    "resources.pipelines.foo": {
-      "action": "skip",
-      "remote_state": {
-        "channel": "CURRENT",
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/permissions-test/default/state/metadata.json"
-        },
-        "edition": "ADVANCED",
-        "effective_publishing_mode": "DEFAULT_PUBLISHING_MODE",
-        "id": "[FOO_ID]",
-        "last_modified": [UNIX_TIME_MILLIS],
-        "name": "foo",
-        "pipeline_id": "[FOO_ID]",
-        "run_as_user_name": "[USERNAME]",
-        "state": "IDLE",
-        "storage": "dbfs:/pipelines/[FOO_ID]"
-      },
-      "changes": {
-        "storage": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "dbfs:/pipelines/[FOO_ID]"
-        }
-      }
-    },
-    "resources.pipelines.foo.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.foo",
-          "label": "${resources.pipelines.foo.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "/pipelines/[FOO_ID]",
-          "__embed__": [
-            {
-              "level": "CAN_VIEW",
-              "user_name": "viewer@example.com"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "group_name": "data-team"
-            },
-            {
-              "level": "IS_OWNER",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/pipelines/update/out.plan_restore.json b/acceptance/bundle/resources/permissions/pipelines/update/out.plan_restore.json
new file mode 100644
index 00000000000..bd9341b8f18
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/pipelines/update/out.plan_restore.json
@@ -0,0 +1,63 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 4,
+  "plan": {
+    "resources.pipelines.foo": {
+      "action": "skip",
+      "remote_state": {
+        "channel": "CURRENT",
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/permissions-test/default/state/metadata.json"
+        },
+        "edition": "ADVANCED",
+        "effective_publishing_mode": "DEFAULT_PUBLISHING_MODE",
+        "id": "[FOO_ID]",
+        "last_modified": [UNIX_TIME_MILLIS],
+        "name": "foo",
+        "pipeline_id": "[FOO_ID]",
+        "run_as_user_name": "[USERNAME]",
+        "state": "IDLE",
+        "storage": "dbfs:/pipelines/[FOO_ID]"
+      },
+      "changes": {
+        "storage": {
+          "action": "skip",
+          "reason": "immutable_backend_value",
+          "remote": "dbfs:/pipelines/[FOO_ID]"
+        }
+      }
+    },
+    "resources.pipelines.foo.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.foo",
+          "label": "${resources.pipelines.foo.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "/pipelines/[FOO_ID]",
+          "__embed__": [
+            {
+              "level": "CAN_VIEW",
+              "user_name": "viewer@example.com"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "group_name": "data-team"
+            },
+            {
+              "level": "IS_OWNER",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/pipelines/update/out.plan_restore.terraform.json b/acceptance/bundle/resources/permissions/pipelines/update/out.plan_restore.terraform.json
deleted file mode 100644
index 586aab21646..00000000000
--- a/acceptance/bundle/resources/permissions/pipelines/update/out.plan_restore.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.foo": {
-      "action": "skip"
-    },
-    "resources.pipelines.foo.permissions": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/pipelines/update/out.plan_update.direct.json b/acceptance/bundle/resources/permissions/pipelines/update/out.plan_update.direct.json
deleted file mode 100644
index 27a523900b2..00000000000
--- a/acceptance/bundle/resources/permissions/pipelines/update/out.plan_update.direct.json
+++ /dev/null
@@ -1,88 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.pipelines.foo": {
-      "action": "skip",
-      "remote_state": {
-        "channel": "CURRENT",
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/permissions-test/default/state/metadata.json"
-        },
-        "edition": "ADVANCED",
-        "effective_publishing_mode": "DEFAULT_PUBLISHING_MODE",
-        "id": "[FOO_ID]",
-        "last_modified": [UNIX_TIME_MILLIS],
-        "name": "foo",
-        "pipeline_id": "[FOO_ID]",
-        "run_as_user_name": "[USERNAME]",
-        "state": "IDLE",
-        "storage": "dbfs:/pipelines/[FOO_ID]"
-      },
-      "changes": {
-        "storage": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "dbfs:/pipelines/[FOO_ID]"
-        }
-      }
-    },
-    "resources.pipelines.foo.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.foo",
-          "label": "${resources.pipelines.foo.id}"
-        }
-      ],
-      "action": "update",
-      "new_state": {
-        "value": {
-          "object_id": "/pipelines/[FOO_ID]",
-          "__embed__": [
-            {
-              "level": "CAN_MANAGE",
-              "user_name": "viewer@example.com"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "group_name": "data-team"
-            },
-            {
-              "level": "IS_OWNER",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        }
-      },
-      "remote_state": {
-        "object_id": "/pipelines/[FOO_ID]",
-        "__embed__": [
-          {
-            "level": "CAN_VIEW",
-            "user_name": "viewer@example.com"
-          },
-          {
-            "level": "CAN_MANAGE",
-            "group_name": "data-team"
-          },
-          {
-            "level": "IS_OWNER",
-            "user_name": "[USERNAME]"
-          }
-        ]
-      },
-      "changes": {
-        "[user_name='viewer@example.com'].level": {
-          "action": "update",
-          "old": "CAN_VIEW",
-          "new": "CAN_MANAGE",
-          "remote": "CAN_VIEW"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/pipelines/update/out.plan_update.json b/acceptance/bundle/resources/permissions/pipelines/update/out.plan_update.json
new file mode 100644
index 00000000000..d5222ca0237
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/pipelines/update/out.plan_update.json
@@ -0,0 +1,88 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.pipelines.foo": {
+      "action": "skip",
+      "remote_state": {
+        "channel": "CURRENT",
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/permissions-test/default/state/metadata.json"
+        },
+        "edition": "ADVANCED",
+        "effective_publishing_mode": "DEFAULT_PUBLISHING_MODE",
+        "id": "[FOO_ID]",
+        "last_modified": [UNIX_TIME_MILLIS],
+        "name": "foo",
+        "pipeline_id": "[FOO_ID]",
+        "run_as_user_name": "[USERNAME]",
+        "state": "IDLE",
+        "storage": "dbfs:/pipelines/[FOO_ID]"
+      },
+      "changes": {
+        "storage": {
+          "action": "skip",
+          "reason": "immutable_backend_value",
+          "remote": "dbfs:/pipelines/[FOO_ID]"
+        }
+      }
+    },
+    "resources.pipelines.foo.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.foo",
+          "label": "${resources.pipelines.foo.id}"
+        }
+      ],
+      "action": "update",
+      "new_state": {
+        "value": {
+          "object_id": "/pipelines/[FOO_ID]",
+          "__embed__": [
+            {
+              "level": "CAN_MANAGE",
+              "user_name": "viewer@example.com"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "group_name": "data-team"
+            },
+            {
+              "level": "IS_OWNER",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        }
+      },
+      "remote_state": {
+        "object_id": "/pipelines/[FOO_ID]",
+        "__embed__": [
+          {
+            "level": "CAN_VIEW",
+            "user_name": "viewer@example.com"
+          },
+          {
+            "level": "CAN_MANAGE",
+            "group_name": "data-team"
+          },
+          {
+            "level": "IS_OWNER",
+            "user_name": "[USERNAME]"
+          }
+        ]
+      },
+      "changes": {
+        "[user_name='viewer@example.com'].level": {
+          "action": "update",
+          "old": "CAN_VIEW",
+          "new": "CAN_MANAGE",
+          "remote": "CAN_VIEW"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/pipelines/update/out.plan_update.terraform.json b/acceptance/bundle/resources/permissions/pipelines/update/out.plan_update.terraform.json
deleted file mode 100644
index 48764b2a494..00000000000
--- a/acceptance/bundle/resources/permissions/pipelines/update/out.plan_update.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.foo": {
-      "action": "skip"
-    },
-    "resources.pipelines.foo.permissions": {
-      "action": "update"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/pipelines/update/out.test.toml b/acceptance/bundle/resources/permissions/pipelines/update/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/permissions/pipelines/update/out.test.toml
+++ b/acceptance/bundle/resources/permissions/pipelines/update/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/permissions/pipelines/update/output.txt b/acceptance/bundle/resources/permissions/pipelines/update/output.txt
index 869c92cd5cb..b45ea26d4b5 100644
--- a/acceptance/bundle/resources/permissions/pipelines/update/output.txt
+++ b/acceptance/bundle/resources/permissions/pipelines/update/output.txt
@@ -3,11 +3,12 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/permissions-test/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created pipelines.foo
+Created pipelines.foo.permissions
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
->>> print_requests
+>>> print_requests.py --nostamp //pipeline ^//api/2.0/bundle
 
 >>> [CLI] bundle plan
 Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
@@ -55,11 +56,11 @@ Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/permissions-test/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated pipelines.foo.permissions
+Files: 3 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 1 unchanged
 
->>> print_requests
+>>> print_requests.py --nostamp //pipeline ^//api/2.0/bundle
 
 >>> [CLI] bundle plan
 Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
@@ -70,11 +71,11 @@ Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/permissions-test/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated pipelines.foo.permissions
+Files: 3 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 1 unchanged
 
->>> print_requests
+>>> print_requests.py --nostamp //pipeline ^//api/2.0/bundle
 
 >>> [CLI] bundle plan
 Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
@@ -94,11 +95,10 @@ resources:
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/permissions-test/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 3 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
 
->>> print_sorted_requests
+>>> print_requests.py --nostamp //pipeline ^//api/2.0/bundle --sort
 
 >>> [CLI] bundle plan
 Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
@@ -109,11 +109,11 @@ Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/permissions-test/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created pipelines.foo.permissions
+Files: 2 uploaded, 1 deleted
+Resources: 1 created, 0 changed, 0 deleted, 1 unchanged
 
->>> print_requests
+>>> print_requests.py --nostamp //pipeline ^//api/2.0/bundle
 
 >>> [CLI] bundle plan
 Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
@@ -123,10 +123,9 @@ The following resources will be deleted:
   delete resources.pipelines.foo
 
 This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
-Streaming Tables (STs) and Materialized Views (MVs) managed by them:
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:
   delete resources.pipelines.foo
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/permissions-test/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/permissions/pipelines/update/script b/acceptance/bundle/resources/permissions/pipelines/update/script
index 430521b2918..3be2be37147 100644
--- a/acceptance/bundle/resources/permissions/pipelines/update/script
+++ b/acceptance/bundle/resources/permissions/pipelines/update/script
@@ -1,53 +1,43 @@
-print_requests() {
-    jq 'select(.path | contains("/pipeline")) | select(.method != "GET")' < out.requests.txt
-    rm out.requests.txt
-}
-
-print_sorted_requests() {
-    jq -c < out.requests.txt | sort | jq --sort-keys 'select(.path | contains("/pipeline")) | select(.method != "GET")'
-    rm out.requests.txt
-}
-
-
 cp databricks.yml databricks.yml.saved
-trace $CLI bundle plan -o json > out.plan_create.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.plan_create.json
 trace $CLI bundle deploy
-trace print_requests > out.requests_create.json
+trace print_requests.py --nostamp //pipeline '^//api/2.0/bundle' > out.requests_create.json
 trace $CLI bundle plan
 
 pipeline_id="$(read_id.py foo)"
 
 trace $CLI permissions get pipelines "$pipeline_id"
-rm -f out.requests.txt
+rm -f "$OUT_REQUESTS"
 
 title "Update one permission and deploy again\n"
 update_file.py databricks.yml CAN_VIEW CAN_MANAGE
-trace $CLI bundle plan -o json > out.plan_update.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.plan_update.json
 trace $CLI bundle deploy
-trace print_requests > out.requests_update.json
+trace print_requests.py --nostamp //pipeline '^//api/2.0/bundle' > out.requests_update.json
 trace $CLI bundle plan
 
 title "Delete one permission and deploy again\n"
 grep -v DELETE_ONE databricks.yml > tmp.yml && mv tmp.yml databricks.yml
-trace $CLI bundle plan -o json > out.plan_delete_one.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.plan_delete_one.json
 trace $CLI bundle deploy
-trace print_requests > out.requests_delete_one.json
+trace print_requests.py --nostamp //pipeline '^//api/2.0/bundle' > out.requests_delete_one.json
 trace $CLI bundle plan
 
 title "Delete the whole block and deploy again\n"
 grep -v PERMISSIONS databricks.yml > tmp.yml && mv tmp.yml databricks.yml
 trace cat databricks.yml
-trace $CLI bundle plan -o json > out.plan_delete_all.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.plan_delete_all.json
 trace $CLI bundle deploy
-trace print_sorted_requests > out.requests_delete_all.json
+trace print_requests.py --nostamp //pipeline '^//api/2.0/bundle' --sort > out.requests_delete_all.json
 trace $CLI bundle plan
 
 title "Restore original config\n"
 mv databricks.yml.saved databricks.yml
-trace $CLI bundle plan -o json > out.plan_restore.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.plan_restore.json
 trace $CLI bundle deploy
-trace print_requests > out.requests_restore_original.json
+trace print_requests.py --nostamp //pipeline '^//api/2.0/bundle' > out.requests_restore_original.json
 trace $CLI bundle plan
 
 trace $CLI bundle destroy --auto-approve
-print_requests > out.requests_destroy.json
+print_requests.py --nostamp //pipeline '^//api/2.0/bundle' > out.requests_destroy.json
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/resources/permissions/postgres_projects/current_can_manage/out.plan.direct.json b/acceptance/bundle/resources/permissions/postgres_projects/current_can_manage/out.plan.direct.json
deleted file mode 100644
index 3fb4236c3c1..00000000000
--- a/acceptance/bundle/resources/permissions/postgres_projects/current_can_manage/out.plan.direct.json
+++ /dev/null
@@ -1,47 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.postgres_projects.foo": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "display_name": "Test Postgres Project",
-          "project_id": "test-project"
-        }
-      }
-    },
-    "resources.postgres_projects.foo.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.postgres_projects.foo",
-          "label": "${resources.postgres_projects.foo.project_id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "/database-projects/test-project",
-          "__embed__": [
-            {
-              "level": "CAN_USE",
-              "user_name": "viewer@example.com"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "group_name": "data-team"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "service_principal_name": "[UUID]"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/postgres_projects/current_can_manage/out.plan.json b/acceptance/bundle/resources/permissions/postgres_projects/current_can_manage/out.plan.json
new file mode 100644
index 00000000000..3aa2eb78cf0
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/postgres_projects/current_can_manage/out.plan.json
@@ -0,0 +1,47 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.postgres_projects.foo": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "display_name": "Test Postgres Project",
+          "project_id": "test-project"
+        }
+      }
+    },
+    "resources.postgres_projects.foo.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.postgres_projects.foo",
+          "label": "${resources.postgres_projects.foo.project_id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "/database-[FOO_ID]",
+          "__embed__": [
+            {
+              "level": "CAN_USE",
+              "user_name": "viewer@example.com"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "group_name": "data-team"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "service_principal_name": "[UUID]"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/postgres_projects/current_can_manage/out.plan.terraform.json b/acceptance/bundle/resources/permissions/postgres_projects/current_can_manage/out.plan.terraform.json
deleted file mode 100644
index c6e5e5c644d..00000000000
--- a/acceptance/bundle/resources/permissions/postgres_projects/current_can_manage/out.plan.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.postgres_projects.foo": {
-      "action": "create"
-    },
-    "resources.postgres_projects.foo.permissions": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/postgres_projects/current_can_manage/out.requests.deploy.direct.json b/acceptance/bundle/resources/permissions/postgres_projects/current_can_manage/out.requests.deploy.direct.json
deleted file mode 100644
index 673b537f7f4..00000000000
--- a/acceptance/bundle/resources/permissions/postgres_projects/current_can_manage/out.requests.deploy.direct.json
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/database-projects/test-project",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_USE",
-        "user_name": "viewer@example.com"
-      },
-      {
-        "group_name": "data-team",
-        "permission_level": "CAN_MANAGE"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "service_principal_name": "[UUID]"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/postgres_projects/current_can_manage/out.requests.deploy.json b/acceptance/bundle/resources/permissions/postgres_projects/current_can_manage/out.requests.deploy.json
new file mode 100644
index 00000000000..11f81a57efc
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/postgres_projects/current_can_manage/out.requests.deploy.json
@@ -0,0 +1,24 @@
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/database-[FOO_ID]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "CAN_USE",
+        "user_name": "viewer@example.com"
+      },
+      {
+        "group_name": "data-team",
+        "permission_level": "CAN_MANAGE"
+      },
+      {
+        "permission_level": "CAN_MANAGE",
+        "service_principal_name": "[UUID]"
+      },
+      {
+        "permission_level": "CAN_MANAGE",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/postgres_projects/current_can_manage/out.requests.deploy.terraform.json b/acceptance/bundle/resources/permissions/postgres_projects/current_can_manage/out.requests.deploy.terraform.json
deleted file mode 100644
index f554e966ccc..00000000000
--- a/acceptance/bundle/resources/permissions/postgres_projects/current_can_manage/out.requests.deploy.terraform.json
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/database-projects/test-project",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_USE",
-        "user_name": "viewer@example.com"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "service_principal_name": "[UUID]"
-      },
-      {
-        "group_name": "data-team",
-        "permission_level": "CAN_MANAGE"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/pipelines/other_is_owner/out.requests.destroy.direct.json b/acceptance/bundle/resources/permissions/postgres_projects/current_can_manage/out.requests.destroy.json
similarity index 100%
rename from acceptance/bundle/resources/permissions/pipelines/other_is_owner/out.requests.destroy.direct.json
rename to acceptance/bundle/resources/permissions/postgres_projects/current_can_manage/out.requests.destroy.json
diff --git a/acceptance/bundle/resources/permissions/postgres_projects/current_can_manage/out.requests.destroy.terraform.json b/acceptance/bundle/resources/permissions/postgres_projects/current_can_manage/out.requests.destroy.terraform.json
deleted file mode 100644
index 1df0a7fbeb0..00000000000
--- a/acceptance/bundle/resources/permissions/postgres_projects/current_can_manage/out.requests.destroy.terraform.json
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/database-projects/test-project",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_MANAGE",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/postgres_projects/current_can_manage/out.test.toml b/acceptance/bundle/resources/permissions/postgres_projects/current_can_manage/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/permissions/postgres_projects/current_can_manage/out.test.toml
+++ b/acceptance/bundle/resources/permissions/postgres_projects/current_can_manage/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/permissions/postgres_projects/current_can_manage/output.txt b/acceptance/bundle/resources/permissions/postgres_projects/current_can_manage/output.txt
index 876d077e601..f9dda135e95 100644
--- a/acceptance/bundle/resources/permissions/postgres_projects/current_can_manage/output.txt
+++ b/acceptance/bundle/resources/permissions/postgres_projects/current_can_manage/output.txt
@@ -21,9 +21,10 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created postgres_projects.foo
+Created postgres_projects.foo.permissions
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
@@ -35,5 +36,4 @@ all their branches, databases, and endpoints. All data stored in them will be pe
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/permissions/script b/acceptance/bundle/resources/permissions/script
deleted file mode 100644
index 6f7ce5fd609..00000000000
--- a/acceptance/bundle/resources/permissions/script
+++ /dev/null
@@ -1 +0,0 @@
-./analyze_requests.py
diff --git a/acceptance/bundle/resources/permissions/sql_warehouses/current_can_manage/out.plan.direct.json b/acceptance/bundle/resources/permissions/sql_warehouses/current_can_manage/out.plan.direct.json
deleted file mode 100644
index 0839262f232..00000000000
--- a/acceptance/bundle/resources/permissions/sql_warehouses/current_can_manage/out.plan.direct.json
+++ /dev/null
@@ -1,54 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.sql_warehouses.foo": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "auto_stop_mins": 120,
-          "cluster_size": "Small",
-          "enable_photon": true,
-          "max_num_clusters": 1,
-          "name": "foo",
-          "spot_instance_policy": "COST_OPTIMIZED"
-        }
-      }
-    },
-    "resources.sql_warehouses.foo.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.sql_warehouses.foo",
-          "label": "${resources.sql_warehouses.foo.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "CAN_VIEW",
-              "user_name": "viewer@example.com"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "group_name": "data-team"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "service_principal_name": "[UUID]"
-            },
-            {
-              "level": "IS_OWNER",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/sql/warehouses/${resources.sql_warehouses.foo.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/sql_warehouses/current_can_manage/out.plan.json b/acceptance/bundle/resources/permissions/sql_warehouses/current_can_manage/out.plan.json
new file mode 100644
index 00000000000..0510345c76f
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/sql_warehouses/current_can_manage/out.plan.json
@@ -0,0 +1,54 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.sql_warehouses.foo": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "auto_stop_mins": 120,
+          "cluster_size": "Small",
+          "enable_photon": true,
+          "max_num_clusters": 1,
+          "name": "foo",
+          "spot_instance_policy": "COST_OPTIMIZED"
+        }
+      }
+    },
+    "resources.sql_warehouses.foo.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.sql_warehouses.foo",
+          "label": "${resources.sql_warehouses.foo.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "CAN_VIEW",
+              "user_name": "viewer@example.com"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "group_name": "data-team"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "service_principal_name": "[UUID]"
+            },
+            {
+              "level": "IS_OWNER",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/sql/warehouses/${resources.sql_warehouses.foo.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/sql_warehouses/current_can_manage/out.plan.terraform.json b/acceptance/bundle/resources/permissions/sql_warehouses/current_can_manage/out.plan.terraform.json
deleted file mode 100644
index 71a3a999ae3..00000000000
--- a/acceptance/bundle/resources/permissions/sql_warehouses/current_can_manage/out.plan.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.sql_warehouses.foo": {
-      "action": "create"
-    },
-    "resources.sql_warehouses.foo.permissions": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/sql_warehouses/current_can_manage/out.requests.deploy.direct.json b/acceptance/bundle/resources/permissions/sql_warehouses/current_can_manage/out.requests.deploy.direct.json
deleted file mode 100644
index 2ef440a5941..00000000000
--- a/acceptance/bundle/resources/permissions/sql_warehouses/current_can_manage/out.requests.deploy.direct.json
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/sql/warehouses/[UUID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_VIEW",
-        "user_name": "viewer@example.com"
-      },
-      {
-        "group_name": "data-team",
-        "permission_level": "CAN_MANAGE"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "service_principal_name": "[UUID]"
-      },
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/sql_warehouses/current_can_manage/out.requests.deploy.json b/acceptance/bundle/resources/permissions/sql_warehouses/current_can_manage/out.requests.deploy.json
new file mode 100644
index 00000000000..78d825e1a16
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/sql_warehouses/current_can_manage/out.requests.deploy.json
@@ -0,0 +1,24 @@
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/sql/warehouses/[FOO_ID]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "CAN_VIEW",
+        "user_name": "viewer@example.com"
+      },
+      {
+        "group_name": "data-team",
+        "permission_level": "CAN_MANAGE"
+      },
+      {
+        "permission_level": "CAN_MANAGE",
+        "service_principal_name": "[UUID]"
+      },
+      {
+        "permission_level": "IS_OWNER",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/sql_warehouses/current_can_manage/out.requests.deploy.terraform.json b/acceptance/bundle/resources/permissions/sql_warehouses/current_can_manage/out.requests.deploy.terraform.json
deleted file mode 100644
index 6a598e5f14c..00000000000
--- a/acceptance/bundle/resources/permissions/sql_warehouses/current_can_manage/out.requests.deploy.terraform.json
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/sql/warehouses/[UUID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_VIEW",
-        "user_name": "viewer@example.com"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "service_principal_name": "[UUID]"
-      },
-      {
-        "group_name": "data-team",
-        "permission_level": "CAN_MANAGE"
-      },
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/pipelines/other_is_owner/out.requests.destroy.terraform.json b/acceptance/bundle/resources/permissions/sql_warehouses/current_can_manage/out.requests.destroy.json
similarity index 100%
rename from acceptance/bundle/resources/permissions/pipelines/other_is_owner/out.requests.destroy.terraform.json
rename to acceptance/bundle/resources/permissions/sql_warehouses/current_can_manage/out.requests.destroy.json
diff --git a/acceptance/bundle/resources/permissions/sql_warehouses/current_can_manage/out.requests.destroy.terraform.json b/acceptance/bundle/resources/permissions/sql_warehouses/current_can_manage/out.requests.destroy.terraform.json
deleted file mode 100644
index 2abb177cb6c..00000000000
--- a/acceptance/bundle/resources/permissions/sql_warehouses/current_can_manage/out.requests.destroy.terraform.json
+++ /dev/null
@@ -1,16 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/sql/warehouses/[UUID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_MANAGE",
-        "user_name": "[USERNAME]"
-      },
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/sql_warehouses/current_can_manage/out.test.toml b/acceptance/bundle/resources/permissions/sql_warehouses/current_can_manage/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/permissions/sql_warehouses/current_can_manage/out.test.toml
+++ b/acceptance/bundle/resources/permissions/sql_warehouses/current_can_manage/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/permissions/sql_warehouses/current_can_manage/output.txt b/acceptance/bundle/resources/permissions/sql_warehouses/current_can_manage/output.txt
index 1f057533795..c947301ae27 100644
--- a/acceptance/bundle/resources/permissions/sql_warehouses/current_can_manage/output.txt
+++ b/acceptance/bundle/resources/permissions/sql_warehouses/current_can_manage/output.txt
@@ -21,9 +21,10 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created sql_warehouses.foo
+Created sql_warehouses.foo.permissions
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
@@ -31,5 +32,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/permissions/target_permissions/out.plan.direct.json b/acceptance/bundle/resources/permissions/target_permissions/out.plan.direct.json
deleted file mode 100644
index 51e6d269e3c..00000000000
--- a/acceptance/bundle/resources/permissions/target_permissions/out.plan.direct.json
+++ /dev/null
@@ -1,56 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.foo": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/test-bundle/state/metadata.json"
-          },
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "foo",
-          "queue": {
-            "enabled": true
-          },
-          "tasks": [
-            {
-              "notebook_task": {
-                "notebook_path": "/Workspace/Users/user@example.com/notebook",
-                "source": "WORKSPACE"
-              },
-              "task_key": "main"
-            }
-          ]
-        }
-      }
-    },
-    "resources.jobs.foo.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.foo",
-          "label": "${resources.jobs.foo.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "IS_OWNER",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/jobs/${resources.jobs.foo.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/target_permissions/out.plan.json b/acceptance/bundle/resources/permissions/target_permissions/out.plan.json
new file mode 100644
index 00000000000..62477c968a1
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/target_permissions/out.plan.json
@@ -0,0 +1,56 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.jobs.foo": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/test-bundle/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "foo",
+          "queue": {
+            "enabled": true
+          },
+          "tasks": [
+            {
+              "notebook_task": {
+                "notebook_path": "/Workspace/Users/user@example.com/notebook",
+                "source": "WORKSPACE"
+              },
+              "task_key": "main"
+            }
+          ]
+        }
+      }
+    },
+    "resources.jobs.foo.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.foo",
+          "label": "${resources.jobs.foo.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "IS_OWNER",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/jobs/${resources.jobs.foo.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/target_permissions/out.plan.terraform.json b/acceptance/bundle/resources/permissions/target_permissions/out.plan.terraform.json
deleted file mode 100644
index 41071059f89..00000000000
--- a/acceptance/bundle/resources/permissions/target_permissions/out.plan.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.foo": {
-      "action": "create"
-    },
-    "resources.jobs.foo.permissions": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/target_permissions/out.requests_create.direct.json b/acceptance/bundle/resources/permissions/target_permissions/out.requests_create.direct.json
deleted file mode 100644
index 3c028edebe1..00000000000
--- a/acceptance/bundle/resources/permissions/target_permissions/out.requests_create.direct.json
+++ /dev/null
@@ -1,38 +0,0 @@
-{
-  "method": "POST",
-  "path": "/api/2.2/jobs/create",
-  "body": {
-    "deployment": {
-      "kind": "BUNDLE",
-      "metadata_file_path": "/Workspace/Users/[USERNAME]/test-bundle/state/metadata.json"
-    },
-    "edit_mode": "UI_LOCKED",
-    "format": "MULTI_TASK",
-    "max_concurrent_runs": 1,
-    "name": "foo",
-    "queue": {
-      "enabled": true
-    },
-    "tasks": [
-      {
-        "notebook_task": {
-          "notebook_path": "/Workspace/Users/user@example.com/notebook",
-          "source": "WORKSPACE"
-        },
-        "task_key": "main"
-      }
-    ]
-  }
-}
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/jobs/[NUMID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/target_permissions/out.requests_create.json b/acceptance/bundle/resources/permissions/target_permissions/out.requests_create.json
new file mode 100644
index 00000000000..828a03592a6
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/target_permissions/out.requests_create.json
@@ -0,0 +1,38 @@
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/create",
+  "body": {
+    "deployment": {
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/test-bundle/state/metadata.json"
+    },
+    "edit_mode": "UI_LOCKED",
+    "format": "MULTI_TASK",
+    "max_concurrent_runs": 1,
+    "name": "foo",
+    "queue": {
+      "enabled": true
+    },
+    "tasks": [
+      {
+        "notebook_task": {
+          "notebook_path": "/Workspace/Users/user@example.com/notebook",
+          "source": "WORKSPACE"
+        },
+        "task_key": "main"
+      }
+    ]
+  }
+}
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/jobs/[FOO_ID]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "IS_OWNER",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/target_permissions/out.requests_create.terraform.json b/acceptance/bundle/resources/permissions/target_permissions/out.requests_create.terraform.json
deleted file mode 100644
index 3c028edebe1..00000000000
--- a/acceptance/bundle/resources/permissions/target_permissions/out.requests_create.terraform.json
+++ /dev/null
@@ -1,38 +0,0 @@
-{
-  "method": "POST",
-  "path": "/api/2.2/jobs/create",
-  "body": {
-    "deployment": {
-      "kind": "BUNDLE",
-      "metadata_file_path": "/Workspace/Users/[USERNAME]/test-bundle/state/metadata.json"
-    },
-    "edit_mode": "UI_LOCKED",
-    "format": "MULTI_TASK",
-    "max_concurrent_runs": 1,
-    "name": "foo",
-    "queue": {
-      "enabled": true
-    },
-    "tasks": [
-      {
-        "notebook_task": {
-          "notebook_path": "/Workspace/Users/user@example.com/notebook",
-          "source": "WORKSPACE"
-        },
-        "task_key": "main"
-      }
-    ]
-  }
-}
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/jobs/[NUMID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/target_permissions/out.requests_delete.direct.json b/acceptance/bundle/resources/permissions/target_permissions/out.requests_delete.direct.json
deleted file mode 100644
index 6564b6f8bde..00000000000
--- a/acceptance/bundle/resources/permissions/target_permissions/out.requests_delete.direct.json
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-  "method": "POST",
-  "path": "/api/2.2/jobs/delete",
-  "body": {
-    "job_id": [NUMID]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/target_permissions/out.requests_delete.json b/acceptance/bundle/resources/permissions/target_permissions/out.requests_delete.json
new file mode 100644
index 00000000000..466f93063f4
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/target_permissions/out.requests_delete.json
@@ -0,0 +1,7 @@
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/delete",
+  "body": {
+    "job_id": [FOO_ID]
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/target_permissions/out.requests_delete.terraform.json b/acceptance/bundle/resources/permissions/target_permissions/out.requests_delete.terraform.json
deleted file mode 100644
index cd29de0d552..00000000000
--- a/acceptance/bundle/resources/permissions/target_permissions/out.requests_delete.terraform.json
+++ /dev/null
@@ -1,19 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/jobs/[NUMID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.2/jobs/delete",
-  "body": {
-    "job_id": [NUMID]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/target_permissions/out.test.toml b/acceptance/bundle/resources/permissions/target_permissions/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/permissions/target_permissions/out.test.toml
+++ b/acceptance/bundle/resources/permissions/target_permissions/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/permissions/target_permissions/output.txt b/acceptance/bundle/resources/permissions/target_permissions/output.txt
index 05faf19c98e..f8a92d10d75 100644
--- a/acceptance/bundle/resources/permissions/target_permissions/output.txt
+++ b/acceptance/bundle/resources/permissions/target_permissions/output.txt
@@ -7,9 +7,10 @@ Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/test-bundle/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.foo
+Created jobs.foo.permissions
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
@@ -17,5 +18,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/test-bundle
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/permissions/target_permissions/script b/acceptance/bundle/resources/permissions/target_permissions/script
index 2caf8dc733c..7a20b4d2447 100644
--- a/acceptance/bundle/resources/permissions/target_permissions/script
+++ b/acceptance/bundle/resources/permissions/target_permissions/script
@@ -1,17 +1,8 @@
-print_requests() {
-    jq 'select(.path | contains("/jobs/")) | select(.method != "GET")' < out.requests.txt
-    rm out.requests.txt
-}
-
-print_sorted_requests() {
-    jq -c < out.requests.txt | sort | jq --sort-keys 'select(.path | contains("/jobs/")) | select(.method != "GET")'
-    rm out.requests.txt
-}
-
 trace $CLI bundle plan
-$CLI bundle plan -o json > out.plan.$DATABRICKS_BUNDLE_ENGINE.json
+$CLI bundle plan -o json | nostamp > out.plan.json
 trace $CLI bundle deploy
-print_requests > out.requests_create.$DATABRICKS_BUNDLE_ENGINE.json
+replace_ids.py
+print_requests.py --nostamp //jobs/ > out.requests_create.json
 
 trace $CLI bundle destroy --auto-approve
-print_requests > out.requests_delete.$DATABRICKS_BUNDLE_ENGINE.json
+print_requests.py --nostamp //jobs/ > out.requests_delete.json
diff --git a/acceptance/bundle/resources/permissions/test.toml b/acceptance/bundle/resources/permissions/test.toml
index 7cb7c1def5a..4a1a3bb8f55 100644
--- a/acceptance/bundle/resources/permissions/test.toml
+++ b/acceptance/bundle/resources/permissions/test.toml
@@ -1,3 +1,2 @@
-Phase = 1
 RecordRequests = true
 Ignore = ['.databricks']
diff --git a/acceptance/bundle/resources/permissions/vector_search_endpoints/current_can_manage/out.plan.direct.json b/acceptance/bundle/resources/permissions/vector_search_endpoints/current_can_manage/out.plan.direct.json
deleted file mode 100644
index 2e15fc05560..00000000000
--- a/acceptance/bundle/resources/permissions/vector_search_endpoints/current_can_manage/out.plan.direct.json
+++ /dev/null
@@ -1,50 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.vector_search_endpoints.foo": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "endpoint_type": "STANDARD",
-          "name": "vs-permissions-endpoint"
-        }
-      }
-    },
-    "resources.vector_search_endpoints.foo.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.vector_search_endpoints.foo",
-          "label": "${resources.vector_search_endpoints.foo.endpoint_uuid}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "CAN_USE",
-              "user_name": "viewer@example.com"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "group_name": "data-team"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "service_principal_name": "[UUID]"
-            },
-            {
-              "level": "CAN_MANAGE",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/vector-search-endpoints/${resources.vector_search_endpoints.foo.endpoint_uuid}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/vector_search_endpoints/current_can_manage/out.plan.json b/acceptance/bundle/resources/permissions/vector_search_endpoints/current_can_manage/out.plan.json
new file mode 100644
index 00000000000..f24e8e5e618
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/vector_search_endpoints/current_can_manage/out.plan.json
@@ -0,0 +1,50 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.vector_search_endpoints.foo": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "endpoint_type": "STANDARD",
+          "name": "[FOO_ID]"
+        }
+      }
+    },
+    "resources.vector_search_endpoints.foo.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.vector_search_endpoints.foo",
+          "label": "${resources.vector_search_endpoints.foo.endpoint_uuid}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "CAN_USE",
+              "user_name": "viewer@example.com"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "group_name": "data-team"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "service_principal_name": "[UUID]"
+            },
+            {
+              "level": "CAN_MANAGE",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/vector-search-endpoints/${resources.vector_search_endpoints.foo.endpoint_uuid}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/vector_search_endpoints/current_can_manage/out.requests.deploy.direct.json b/acceptance/bundle/resources/permissions/vector_search_endpoints/current_can_manage/out.requests.deploy.direct.json
deleted file mode 100644
index 9118a4da780..00000000000
--- a/acceptance/bundle/resources/permissions/vector_search_endpoints/current_can_manage/out.requests.deploy.direct.json
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/vector-search-endpoints/[UUID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_USE",
-        "user_name": "viewer@example.com"
-      },
-      {
-        "group_name": "data-team",
-        "permission_level": "CAN_MANAGE"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "service_principal_name": "[UUID]"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/permissions/vector_search_endpoints/current_can_manage/out.requests.deploy.json b/acceptance/bundle/resources/permissions/vector_search_endpoints/current_can_manage/out.requests.deploy.json
new file mode 100644
index 00000000000..ecfc2c8ac50
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/vector_search_endpoints/current_can_manage/out.requests.deploy.json
@@ -0,0 +1,24 @@
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions[FOO_ID_2]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "CAN_USE",
+        "user_name": "viewer@example.com"
+      },
+      {
+        "group_name": "data-team",
+        "permission_level": "CAN_MANAGE"
+      },
+      {
+        "permission_level": "CAN_MANAGE",
+        "service_principal_name": "[UUID]"
+      },
+      {
+        "permission_level": "CAN_MANAGE",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/resources/permissions/vector_search_endpoints/current_can_manage/out.requests.destroy.direct.json b/acceptance/bundle/resources/permissions/vector_search_endpoints/current_can_manage/out.requests.destroy.direct.json
deleted file mode 100644
index 84c87416aa2..00000000000
--- a/acceptance/bundle/resources/permissions/vector_search_endpoints/current_can_manage/out.requests.destroy.direct.json
+++ /dev/null
@@ -1,4 +0,0 @@
-{
-  "method": "DELETE",
-  "path": "/api/2.0/vector-search/endpoints/vs-permissions-endpoint"
-}
diff --git a/acceptance/bundle/resources/permissions/vector_search_endpoints/current_can_manage/out.requests.destroy.json b/acceptance/bundle/resources/permissions/vector_search_endpoints/current_can_manage/out.requests.destroy.json
new file mode 100644
index 00000000000..371018d13bd
--- /dev/null
+++ b/acceptance/bundle/resources/permissions/vector_search_endpoints/current_can_manage/out.requests.destroy.json
@@ -0,0 +1,4 @@
+{
+  "method": "DELETE",
+  "path": "/api/2.0/vector-search/endpoints/[FOO_ID]"
+}
diff --git a/acceptance/bundle/resources/permissions/vector_search_endpoints/current_can_manage/out.test.toml b/acceptance/bundle/resources/permissions/vector_search_endpoints/current_can_manage/out.test.toml
index e90b6d5d1ba..a927a5fbc06 100644
--- a/acceptance/bundle/resources/permissions/vector_search_endpoints/current_can_manage/out.test.toml
+++ b/acceptance/bundle/resources/permissions/vector_search_endpoints/current_can_manage/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/permissions/vector_search_endpoints/current_can_manage/output.txt b/acceptance/bundle/resources/permissions/vector_search_endpoints/current_can_manage/output.txt
index 4e848ac23e6..2b5e380e368 100644
--- a/acceptance/bundle/resources/permissions/vector_search_endpoints/current_can_manage/output.txt
+++ b/acceptance/bundle/resources/permissions/vector_search_endpoints/current_can_manage/output.txt
@@ -21,9 +21,10 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created vector_search_endpoints.foo
+Created vector_search_endpoints.foo.permissions
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
@@ -31,5 +32,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/permissions/vector_search_endpoints/test.toml b/acceptance/bundle/resources/permissions/vector_search_endpoints/test.toml
index 1217a2ec963..36e97e484de 100644
--- a/acceptance/bundle/resources/permissions/vector_search_endpoints/test.toml
+++ b/acceptance/bundle/resources/permissions/vector_search_endpoints/test.toml
@@ -1,2 +1,2 @@
 Env.RESOURCE = "vector_search_endpoints" # for ../_script
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+Env.DATABRICKS_BUNDLE_ENGINE = "direct"
diff --git a/acceptance/bundle/resources/pipelines/allow-duplicate-names/out.test.toml b/acceptance/bundle/resources/pipelines/allow-duplicate-names/out.test.toml
index bbc7fcfd1bd..0f167effef1 100644
--- a/acceptance/bundle/resources/pipelines/allow-duplicate-names/out.test.toml
+++ b/acceptance/bundle/resources/pipelines/allow-duplicate-names/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/pipelines/allow-duplicate-names/output.txt b/acceptance/bundle/resources/pipelines/allow-duplicate-names/output.txt
index 278c60dabbc..24c659af1ec 100644
--- a/acceptance/bundle/resources/pipelines/allow-duplicate-names/output.txt
+++ b/acceptance/bundle/resources/pipelines/allow-duplicate-names/output.txt
@@ -1,12 +1,14 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/acc-bundle-deploy-pipeline-duplicate-names-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created pipelines.pipeline_one
+Files: 5 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
->>> print_requests
+>>> print_requests.py //pipelines --nostamp
 {
+  "method": "POST",
+  "path": "/api/2.0/pipelines",
   "body": {
     "libraries": [
       {
@@ -16,11 +18,11 @@ Deployment complete!
       }
     ],
     "name": "test-pipeline-same-name-[UNIQUE_NAME]"
-  },
-  "method": "POST",
-  "path": "/api/2.0/pipelines"
+  }
 }
 {
+  "method": "POST",
+  "path": "/api/2.0/pipelines",
   "body": {
     "allow_duplicate_names": true,
     "channel": "CURRENT",
@@ -37,9 +39,7 @@ Deployment complete!
       }
     ],
     "name": "test-pipeline-same-name-[UNIQUE_NAME]"
-  },
-  "method": "POST",
-  "path": "/api/2.0/pipelines"
+  }
 }
 
 >>> [CLI] bundle destroy --auto-approve
@@ -47,12 +47,11 @@ The following resources will be deleted:
   delete resources.pipelines.pipeline_one
 
 This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
-Streaming Tables (STs) and Materialized Views (MVs) managed by them:
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:
   delete resources.pipelines.pipeline_one
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/acc-bundle-deploy-pipeline-duplicate-names-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
 
 >>> [CLI] pipelines delete [UUID]
diff --git a/acceptance/bundle/resources/pipelines/allow-duplicate-names/script b/acceptance/bundle/resources/pipelines/allow-duplicate-names/script
index 6db327deec3..f1e8108b55c 100644
--- a/acceptance/bundle/resources/pipelines/allow-duplicate-names/script
+++ b/acceptance/bundle/resources/pipelines/allow-duplicate-names/script
@@ -5,7 +5,7 @@ touch foo.py
 cleanup() {
   trace $CLI bundle destroy --auto-approve
   trace $CLI pipelines delete ${PIPELINE_ID}
-  rm out.requests.txt
+  rm "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
@@ -16,7 +16,4 @@ export PIPELINE_ID
 # Deploy the bundle that has a pipeline with the same name:
 trace $CLI bundle deploy
 
-print_requests() {
-    jq --sort-keys 'select(.method != "GET" and (.path | contains("/pipelines")))' < out.requests.txt
-}
-trace print_requests
+trace print_requests.py //pipelines --nostamp
diff --git a/acceptance/bundle/resources/pipelines/auto-approve/out.test.toml b/acceptance/bundle/resources/pipelines/auto-approve/out.test.toml
index 5ad0addb75e..98ccab9aaeb 100644
--- a/acceptance/bundle/resources/pipelines/auto-approve/out.test.toml
+++ b/acceptance/bundle/resources/pipelines/auto-approve/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 RunsOnDbr = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/pipelines/auto-approve/output.txt b/acceptance/bundle/resources/pipelines/auto-approve/output.txt
index 5154a1206a3..3795c17db35 100644
--- a/acceptance/bundle/resources/pipelines/auto-approve/output.txt
+++ b/acceptance/bundle/resources/pipelines/auto-approve/output.txt
@@ -1,9 +1,10 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.foo
+Created pipelines.bar
+Files: 6 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 === Assert the pipeline is created
 >>> [CLI] pipelines get [UUID]
@@ -50,8 +51,11 @@ Streaming Tables (STs) and Materialized Views (MVs) managed by them. Recreating
 restore the defined STs and MVs through full refresh. Note that recreation is necessary when pipeline
 properties such as the 'catalog' or 'storage' are changed:
   delete resources.pipelines.bar
-Error: the deployment requires destructive actions, but current console does not support prompting. Please specify --auto-approve if you would like to skip prompts and proceed
+Error: the deployment requires destructive actions, but the current console does not support prompting.
+Deleting data assets such as schemas, pipelines, or volumes may cause permanent data loss and should be carefully reviewed.
+To proceed, use --auto-approve after reviewing the plan above.
 
+Files: 0 uploaded, 1 deleted
 
 Exit code: 1
 
@@ -61,10 +65,9 @@ The following resources will be deleted:
   delete resources.pipelines.bar
 
 This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
-Streaming Tables (STs) and Materialized Views (MVs) managed by them:
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:
   delete resources.pipelines.bar
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/pipelines/auto-approve/script b/acceptance/bundle/resources/pipelines/auto-approve/script
index 7c68356ea7c..f0b6c4f9044 100644
--- a/acceptance/bundle/resources/pipelines/auto-approve/script
+++ b/acceptance/bundle/resources/pipelines/auto-approve/script
@@ -9,12 +9,12 @@ trap cleanup EXIT
 trace $CLI bundle deploy
 
 title "Assert the pipeline is created"
-PIPELINE_ID=$($CLI bundle summary -o json | jq -r '.resources.pipelines.bar.id')
-trace $CLI pipelines get "${PIPELINE_ID}" | jq "{spec}"
+PIPELINE_ID=$($CLI bundle summary -o json | nostamp | jq -r '.resources.pipelines.bar.id')
+trace $CLI pipelines get "${PIPELINE_ID}" | nostamp| jq "{spec}"
 
 title "Assert the job is created"
-JOB_ID=$($CLI bundle summary -o json | jq -r '.resources.jobs.foo.id')
-$CLI jobs get "${JOB_ID}" | jq '{name: .settings.name}'
+JOB_ID=$($CLI bundle summary -o json | nostamp | jq -r '.resources.jobs.foo.id')
+$CLI jobs get "${JOB_ID}" | nostamp| jq '{name: .settings.name}'
 
 title "Remove resources from configuration."
 trace rm resources.yml
diff --git a/acceptance/bundle/resources/pipelines/auto-approve/test.toml b/acceptance/bundle/resources/pipelines/auto-approve/test.toml
index 1cf3c3c72c2..6c356f11a98 100644
--- a/acceptance/bundle/resources/pipelines/auto-approve/test.toml
+++ b/acceptance/bundle/resources/pipelines/auto-approve/test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 RecordRequests = false
 RunsOnDbr = true
diff --git a/acceptance/bundle/resources/pipelines/cluster_policy/databricks.yml.tmpl b/acceptance/bundle/resources/pipelines/cluster_policy/databricks.yml.tmpl
new file mode 100644
index 00000000000..7af2175aa84
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/cluster_policy/databricks.yml.tmpl
@@ -0,0 +1,29 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+workspace:
+  root_path: ~/.bundle/$UNIQUE_NAME
+
+resources:
+  cluster_policies:
+    my_policy:
+      name: test-policy-$UNIQUE_NAME
+      definition:
+        custom_tags.CostCenter:
+          type: fixed
+          value: from-policy
+
+  # A pipeline cluster carries policy_id too, but the Pipelines API does not expand the policy
+  # into the stored spec: it reads back exactly as authored, so there is no addition to suppress
+  # and no ignore_remote_additions rule for pipelines. This records that it simply converges.
+  pipelines:
+    my_pipeline:
+      name: test-pipeline-$UNIQUE_NAME
+      clusters:
+        - label: default
+          policy_id: ${resources.cluster_policies.my_policy.id}
+          node_type_id: $NODE_TYPE_ID
+          num_workers: 1
+      libraries:
+        - file:
+            path: ./hello_world.py
diff --git a/acceptance/bundle/resources/pipelines/cluster_policy/hello_world.py b/acceptance/bundle/resources/pipelines/cluster_policy/hello_world.py
new file mode 100644
index 00000000000..11b15b1a458
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/cluster_policy/hello_world.py
@@ -0,0 +1 @@
+print("hello")
diff --git a/acceptance/bundle/resources/pipelines/cluster_policy/out.test.toml b/acceptance/bundle/resources/pipelines/cluster_policy/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/cluster_policy/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/pipelines/cluster_policy/output.txt b/acceptance/bundle/resources/pipelines/cluster_policy/output.txt
new file mode 100644
index 00000000000..b337f807267
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/cluster_policy/output.txt
@@ -0,0 +1,25 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Created cluster_policies.my_policy
+Created pipelines.my_pipeline
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+=== A pipeline cluster with policy_id converges: the Pipelines API does not expand the policy
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.cluster_policies.my_policy
+  delete resources.pipelines.my_pipeline
+
+This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:
+  delete resources.pipelines.my_pipeline
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/pipelines/cluster_policy/script b/acceptance/bundle/resources/pipelines/cluster_policy/script
new file mode 100644
index 00000000000..dfe1ad7caa2
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/cluster_policy/script
@@ -0,0 +1,11 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+trace $CLI bundle deploy
+
+title "A pipeline cluster with policy_id converges: the Pipelines API does not expand the policy\n"
+trace $CLI bundle plan
diff --git a/acceptance/bundle/resources/pipelines/cluster_policy/test.toml b/acceptance/bundle/resources/pipelines/cluster_policy/test.toml
new file mode 100644
index 00000000000..02a953b2373
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/cluster_policy/test.toml
@@ -0,0 +1,7 @@
+Cloud = true
+
+RecordRequests = false
+
+Ignore = [
+    "databricks.yml",
+]
diff --git a/acceptance/bundle/resources/pipelines/drift/parameters/databricks.yml b/acceptance/bundle/resources/pipelines/drift/parameters/databricks.yml
new file mode 100644
index 00000000000..2e7d3d1bee7
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/drift/parameters/databricks.yml
@@ -0,0 +1,12 @@
+bundle:
+  name: pipeline-parameters
+
+resources:
+  pipelines:
+    my:
+      name: test-pipeline
+      parameters:
+        my_param: my_value
+      libraries:
+        - file:
+            path: "./foo.py"
diff --git a/acceptance/bundle/resources/permissions/postgres_projects/current_can_manage/out.requests.destroy.direct.json b/acceptance/bundle/resources/pipelines/drift/parameters/foo.py
similarity index 100%
rename from acceptance/bundle/resources/permissions/postgres_projects/current_can_manage/out.requests.destroy.direct.json
rename to acceptance/bundle/resources/pipelines/drift/parameters/foo.py
diff --git a/acceptance/bundle/resources/pipelines/drift/parameters/out.test.toml b/acceptance/bundle/resources/pipelines/drift/parameters/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/drift/parameters/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/pipelines/drift/parameters/output.txt b/acceptance/bundle/resources/pipelines/drift/parameters/output.txt
new file mode 100644
index 00000000000..46711138b98
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/drift/parameters/output.txt
@@ -0,0 +1,28 @@
+
+=== Initial deployment
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/pipeline-parameters/default/files...
+Created pipelines.my
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Plan is a no-op: pipeline parameters round-trip on read
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+=== Redeploy is a no-op (no update call)
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/pipeline-parameters/default/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
+
+>>> print_requests.py --nostamp //api/2.0/pipelines
+json.method = "POST";
+json.path = "/api/2.0/pipelines";
+json.body.channel = "CURRENT";
+json.body.deployment.kind = "BUNDLE";
+json.body.deployment.metadata_file_path = "/Workspace/Users/[USERNAME]/.bundle/pipeline-parameters/default/state/metadata.json";
+json.body.edition = "ADVANCED";
+json.body.libraries[0].file.path = "/Workspace/Users/[USERNAME]/.bundle/pipeline-parameters/default/files/foo.py";
+json.body.name = "test-pipeline";
+json.body.parameters.my_param = "my_value";
diff --git a/acceptance/bundle/resources/pipelines/drift/parameters/script b/acceptance/bundle/resources/pipelines/drift/parameters/script
new file mode 100644
index 00000000000..167c70e560d
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/drift/parameters/script
@@ -0,0 +1,10 @@
+
+title "Initial deployment"
+trace $CLI bundle deploy
+
+title "Plan is a no-op: pipeline parameters round-trip on read"
+trace $CLI bundle plan | contains.py "Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged"
+
+title "Redeploy is a no-op (no update call)"
+trace $CLI bundle deploy
+trace print_requests.py --nostamp //api/2.0/pipelines | gron.py | contains.py '!json.method = "PUT"'
diff --git a/acceptance/bundle/resources/pipelines/drift/parameters/test.toml b/acceptance/bundle/resources/pipelines/drift/parameters/test.toml
new file mode 100644
index 00000000000..db3c3dd039d
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/drift/parameters/test.toml
@@ -0,0 +1,4 @@
+RecordRequests = true
+
+# Direct engine only: the gap is in its read-back path (GetPipelineResponse.Parameters).
+# Terraform tracks parameters in its own state. Mirrors catalogs/drift/managed_properties.
diff --git a/acceptance/bundle/resources/pipelines/lakeflow-pipeline/out.test.toml b/acceptance/bundle/resources/pipelines/lakeflow-pipeline/out.test.toml
index bbc7fcfd1bd..0f167effef1 100644
--- a/acceptance/bundle/resources/pipelines/lakeflow-pipeline/out.test.toml
+++ b/acceptance/bundle/resources/pipelines/lakeflow-pipeline/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/pipelines/lakeflow-pipeline/output.txt b/acceptance/bundle/resources/pipelines/lakeflow-pipeline/output.txt
index 04129e78ce1..ee031f6609f 100644
--- a/acceptance/bundle/resources/pipelines/lakeflow-pipeline/output.txt
+++ b/acceptance/bundle/resources/pipelines/lakeflow-pipeline/output.txt
@@ -10,11 +10,11 @@ Validation OK!
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-pipeline-lakeflow-pipeline-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created pipelines.foo
+Files: 4 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
->>> jq -s .[] | select(.path=="/api/2.0/pipelines" and .method == "POST") | .body out.requests.txt
+>>> jq -s .[] | select(.path=="/api/2.0/pipelines" and .method == "POST") | .body [OUTPUT_DIR]/out.requests.txt
 {
   "channel": "CURRENT",
   "deployment": {
@@ -43,10 +43,9 @@ The following resources will be deleted:
   delete resources.pipelines.foo
 
 This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
-Streaming Tables (STs) and Materialized Views (MVs) managed by them:
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:
   delete resources.pipelines.foo
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-pipeline-lakeflow-pipeline-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/pipelines/lakeflow-pipeline/script b/acceptance/bundle/resources/pipelines/lakeflow-pipeline/script
index d380b57c974..61832825754 100644
--- a/acceptance/bundle/resources/pipelines/lakeflow-pipeline/script
+++ b/acceptance/bundle/resources/pipelines/lakeflow-pipeline/script
@@ -3,10 +3,10 @@ trace $CLI bundle validate
 
 cleanup() {
   trace $CLI bundle destroy --auto-approve
-  rm out.requests.txt
+  rm "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 trace $CLI bundle deploy
 
-trace jq -s '.[] | select(.path=="/api/2.0/pipelines" and .method == "POST") | .body' out.requests.txt
-rm out.requests.txt
+trace jq -s '.[] | select(.path=="/api/2.0/pipelines" and .method == "POST") | .body' "$OUT_REQUESTS" | nostamp
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/resources/pipelines/lakeflow-pipeline/test.toml b/acceptance/bundle/resources/pipelines/lakeflow-pipeline/test.toml
index 0ead6d87c28..398ca78f70b 100644
--- a/acceptance/bundle/resources/pipelines/lakeflow-pipeline/test.toml
+++ b/acceptance/bundle/resources/pipelines/lakeflow-pipeline/test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 RecordRequests = true
 
diff --git a/acceptance/bundle/resources/pipelines/num-workers-zero/out.deploy.direct.txt b/acceptance/bundle/resources/pipelines/num-workers-zero/out.deploy.direct.txt
deleted file mode 100644
index a2a2a872e76..00000000000
--- a/acceptance/bundle/resources/pipelines/num-workers-zero/out.deploy.direct.txt
+++ /dev/null
@@ -1,6 +0,0 @@
-
->>> [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/num-workers-zero/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
diff --git a/acceptance/bundle/resources/pipelines/num-workers-zero/out.deploy.terraform.txt b/acceptance/bundle/resources/pipelines/num-workers-zero/out.deploy.terraform.txt
deleted file mode 100644
index a2a2a872e76..00000000000
--- a/acceptance/bundle/resources/pipelines/num-workers-zero/out.deploy.terraform.txt
+++ /dev/null
@@ -1,6 +0,0 @@
-
->>> [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/num-workers-zero/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
diff --git a/acceptance/bundle/resources/pipelines/num-workers-zero/out.deploy.txt b/acceptance/bundle/resources/pipelines/num-workers-zero/out.deploy.txt
new file mode 100644
index 00000000000..44abc5f2579
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/num-workers-zero/out.deploy.txt
@@ -0,0 +1,6 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/num-workers-zero/default/files...
+Created pipelines.my
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
diff --git a/acceptance/bundle/resources/pipelines/num-workers-zero/out.requests.direct.txt b/acceptance/bundle/resources/pipelines/num-workers-zero/out.requests.direct.txt
deleted file mode 100644
index 62341cc543f..00000000000
--- a/acceptance/bundle/resources/pipelines/num-workers-zero/out.requests.direct.txt
+++ /dev/null
@@ -1,35 +0,0 @@
-
->>> errcode jq -s .[] | select(.method == "POST" and (.path | contains("/pipelines"))) out.requests.txt
-{
-  "method": "POST",
-  "path": "/api/2.0/pipelines",
-  "body": {
-    "channel": "CURRENT",
-    "clusters": [
-      {
-        "custom_tags": {
-          "ResourceClass": "SingleNode"
-        },
-        "label": "default",
-        "node_type_id": "[NODE_TYPE_ID]",
-        "spark_conf": {
-          "spark.databricks.cluster.profile": "singleNode",
-          "spark.master": "local[*]"
-        }
-      }
-    ],
-    "deployment": {
-      "kind": "BUNDLE",
-      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/num-workers-zero/default/state/metadata.json"
-    },
-    "edition": "ADVANCED",
-    "libraries": [
-      {
-        "file": {
-          "path": "/Workspace/Users/[USERNAME]/.bundle/num-workers-zero/default/files/foo.py"
-        }
-      }
-    ],
-    "name": "test-pipeline"
-  }
-}
diff --git a/acceptance/bundle/resources/pipelines/num-workers-zero/out.requests.terraform.txt b/acceptance/bundle/resources/pipelines/num-workers-zero/out.requests.terraform.txt
deleted file mode 100644
index 7bf55181288..00000000000
--- a/acceptance/bundle/resources/pipelines/num-workers-zero/out.requests.terraform.txt
+++ /dev/null
@@ -1,36 +0,0 @@
-
->>> errcode jq -s .[] | select(.method == "POST" and (.path | contains("/pipelines"))) out.requests.txt
-{
-  "method": "POST",
-  "path": "/api/2.0/pipelines",
-  "body": {
-    "channel": "CURRENT",
-    "clusters": [
-      {
-        "custom_tags": {
-          "ResourceClass": "SingleNode"
-        },
-        "label": "default",
-        "node_type_id": "[NODE_TYPE_ID]",
-        "num_workers": 0,
-        "spark_conf": {
-          "spark.databricks.cluster.profile": "singleNode",
-          "spark.master": "local[*]"
-        }
-      }
-    ],
-    "deployment": {
-      "kind": "BUNDLE",
-      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/num-workers-zero/default/state/metadata.json"
-    },
-    "edition": "ADVANCED",
-    "libraries": [
-      {
-        "file": {
-          "path": "/Workspace/Users/[USERNAME]/.bundle/num-workers-zero/default/files/foo.py"
-        }
-      }
-    ],
-    "name": "test-pipeline"
-  }
-}
diff --git a/acceptance/bundle/resources/pipelines/num-workers-zero/out.requests.txt b/acceptance/bundle/resources/pipelines/num-workers-zero/out.requests.txt
new file mode 100644
index 00000000000..547928989d9
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/num-workers-zero/out.requests.txt
@@ -0,0 +1,33 @@
+{
+  "method": "POST",
+  "path": "/api/2.0/pipelines",
+  "body": {
+    "channel": "CURRENT",
+    "clusters": [
+      {
+        "custom_tags": {
+          "ResourceClass": "SingleNode"
+        },
+        "label": "default",
+        "node_type_id": "[NODE_TYPE_ID]",
+        "spark_conf": {
+          "spark.databricks.cluster.profile": "singleNode",
+          "spark.master": "local[*]"
+        }
+      }
+    ],
+    "deployment": {
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/num-workers-zero/default/state/metadata.json"
+    },
+    "edition": "ADVANCED",
+    "libraries": [
+      {
+        "file": {
+          "path": "/Workspace/Users/[USERNAME]/.bundle/num-workers-zero/default/files/foo.py"
+        }
+      }
+    ],
+    "name": "test-pipeline"
+  }
+}
diff --git a/acceptance/bundle/resources/pipelines/num-workers-zero/out.test.toml b/acceptance/bundle/resources/pipelines/num-workers-zero/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/pipelines/num-workers-zero/out.test.toml
+++ b/acceptance/bundle/resources/pipelines/num-workers-zero/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/pipelines/num-workers-zero/output.txt b/acceptance/bundle/resources/pipelines/num-workers-zero/output.txt
index e69de29bb2d..8025f179cb0 100644
--- a/acceptance/bundle/resources/pipelines/num-workers-zero/output.txt
+++ b/acceptance/bundle/resources/pipelines/num-workers-zero/output.txt
@@ -0,0 +1,2 @@
+
+>>> errcode jq -s .[] | select(.method == "POST" and (.path | contains("/pipelines"))) [OUTPUT_DIR]/out.requests.txt
diff --git a/acceptance/bundle/resources/pipelines/num-workers-zero/script b/acceptance/bundle/resources/pipelines/num-workers-zero/script
index a33c1771e96..f7167174881 100644
--- a/acceptance/bundle/resources/pipelines/num-workers-zero/script
+++ b/acceptance/bundle/resources/pipelines/num-workers-zero/script
@@ -1,3 +1,3 @@
-trace $CLI bundle deploy > out.deploy.$DATABRICKS_BUNDLE_ENGINE.txt 2>&1
-trace errcode jq -s '.[] | select(.method == "POST" and (.path | contains("/pipelines")))' out.requests.txt > out.requests.$DATABRICKS_BUNDLE_ENGINE.txt 2>&1
-rm out.requests.txt
+trace $CLI bundle deploy > out.deploy.txt 2>&1
+trace errcode jq -s '.[] | select(.method == "POST" and (.path | contains("/pipelines")))' "$OUT_REQUESTS" | nostamp > out.requests.txt 2>&1
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/resources/pipelines/num-workers-zero/test.toml b/acceptance/bundle/resources/pipelines/num-workers-zero/test.toml
index 848ed3bd0ec..76325e19857 100644
--- a/acceptance/bundle/resources/pipelines/num-workers-zero/test.toml
+++ b/acceptance/bundle/resources/pipelines/num-workers-zero/test.toml
@@ -1,7 +1,3 @@
 Badness = "num_workers value 0 is not sent in the direct deployment"
-Local = true
 Cloud = false
 RecordRequests = true
-
-[EnvMatrix]
-  DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/bundle/resources/pipelines/photon-true/databricks.yml b/acceptance/bundle/resources/pipelines/photon-true/databricks.yml
new file mode 100644
index 00000000000..f30f43b7a53
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/photon-true/databricks.yml
@@ -0,0 +1,11 @@
+bundle:
+  name: photon-true
+
+resources:
+  pipelines:
+    my:
+      name: test-pipeline
+      photon: true
+      libraries:
+        - file:
+            path: "./foo.py"
diff --git a/acceptance/bundle/resources/permissions/sql_warehouses/current_can_manage/out.requests.destroy.direct.json b/acceptance/bundle/resources/pipelines/photon-true/foo.py
similarity index 100%
rename from acceptance/bundle/resources/permissions/sql_warehouses/current_can_manage/out.requests.destroy.direct.json
rename to acceptance/bundle/resources/pipelines/photon-true/foo.py
diff --git a/acceptance/bundle/resources/pipelines/photon-true/out.test.toml b/acceptance/bundle/resources/pipelines/photon-true/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/photon-true/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/pipelines/photon-true/output.txt b/acceptance/bundle/resources/pipelines/photon-true/output.txt
new file mode 100644
index 00000000000..0eeae37c545
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/photon-true/output.txt
@@ -0,0 +1,27 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/photon-true/default/files...
+Created pipelines.my
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+{
+  "method": "POST",
+  "path": "/api/2.0/pipelines",
+  "body": {
+    "channel": "CURRENT",
+    "deployment": {
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/photon-true/default/state/metadata.json"
+    },
+    "edition": "ADVANCED",
+    "libraries": [
+      {
+        "file": {
+          "path": "/Workspace/Users/[USERNAME]/.bundle/photon-true/default/files/foo.py"
+        }
+      }
+    ],
+    "name": "test-pipeline",
+    "photon": true
+  }
+}
diff --git a/acceptance/bundle/resources/pipelines/photon-true/script b/acceptance/bundle/resources/pipelines/photon-true/script
new file mode 100644
index 00000000000..3fe12431e65
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/photon-true/script
@@ -0,0 +1,2 @@
+trace $CLI bundle deploy
+print_requests.py --nostamp //api/2.0/pipelines
diff --git a/acceptance/bundle/resources/pipelines/photon-true/test.toml b/acceptance/bundle/resources/pipelines/photon-true/test.toml
new file mode 100644
index 00000000000..7061886de47
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/photon-true/test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+RecordRequests = true
diff --git a/acceptance/bundle/resources/pipelines/recreate-add-whole-block/databricks.yml.tmpl b/acceptance/bundle/resources/pipelines/recreate-add-whole-block/databricks.yml.tmpl
new file mode 100644
index 00000000000..62ec78713ac
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/recreate-add-whole-block/databricks.yml.tmpl
@@ -0,0 +1,15 @@
+bundle:
+  name: acc-$UNIQUE_NAME
+
+resources:
+  pipelines:
+    my:
+      name: test-pipeline-$UNIQUE_NAME
+      storage: dbfs:/pipelines/custom
+#TO_ADD:       ingestion_definition:
+#TO_ADD:         connection_name: my_connection
+#TO_ADD:         objects:
+#TO_ADD:           - {}
+      libraries:
+        - file:
+            path: "./foo.py"
diff --git a/acceptance/bundle/resources/pipelines/recreate-add-whole-block/out.plan.json b/acceptance/bundle/resources/pipelines/recreate-add-whole-block/out.plan.json
new file mode 100644
index 00000000000..345c3fb80fd
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/recreate-add-whole-block/out.plan.json
@@ -0,0 +1,72 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.pipelines.my": {
+      "action": "recreate",
+      "new_state": {
+        "value": {
+          "channel": "CURRENT",
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/state/metadata.json"
+          },
+          "edition": "ADVANCED",
+          "ingestion_definition": {
+            "connection_name": "my_connection",
+            "objects": [
+              {}
+            ]
+          },
+          "libraries": [
+            {
+              "file": {
+                "path": "/Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/files/foo.py"
+              }
+            }
+          ],
+          "name": "test-pipeline-[UNIQUE_NAME]",
+          "storage": "dbfs:/pipelines/custom"
+        }
+      },
+      "remote_state": {
+        "channel": "CURRENT",
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/state/metadata.json"
+        },
+        "edition": "ADVANCED",
+        "effective_publishing_mode": "DEFAULT_PUBLISHING_MODE",
+        "id": "[UUID]",
+        "last_modified": [UNIX_TIME_MILLIS],
+        "libraries": [
+          {
+            "file": {
+              "path": "/Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/files/foo.py"
+            }
+          }
+        ],
+        "name": "test-pipeline-[UNIQUE_NAME]",
+        "pipeline_id": "[UUID]",
+        "run_as_user_name": "[USERNAME]",
+        "state": "IDLE",
+        "storage": "dbfs:/pipelines/custom"
+      },
+      "changes": {
+        "ingestion_definition": {
+          "action": "recreate",
+          "reason": "immutable",
+          "new": {
+            "connection_name": "my_connection",
+            "objects": [
+              {}
+            ]
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/pipelines/recreate-add-whole-block/out.test.toml b/acceptance/bundle/resources/pipelines/recreate-add-whole-block/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/recreate-add-whole-block/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/pipelines/recreate-add-whole-block/output.txt b/acceptance/bundle/resources/pipelines/recreate-add-whole-block/output.txt
new file mode 100644
index 00000000000..c34da825289
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/recreate-add-whole-block/output.txt
@@ -0,0 +1,8 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/files...
+Created pipelines.my
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> update_file.py databricks.yml #TO_ADD:  
diff --git a/acceptance/bundle/resources/pipelines/recreate-add-whole-block/script b/acceptance/bundle/resources/pipelines/recreate-add-whole-block/script
new file mode 100644
index 00000000000..3a9b5734b5f
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/recreate-add-whole-block/script
@@ -0,0 +1,15 @@
+touch foo.py
+
+# The ingestion_definition block is commented out in the template with #TO_ADD:
+# markers, so phase 1 deploys a pipeline without it.
+envsubst < databricks.yml.tmpl > databricks.yml
+trace $CLI bundle deploy
+
+# Phase 2: add the whole ingestion_definition block by dropping the #TO_ADD:
+# markers. connection_name is immutable, so adding it must recreate the pipeline.
+trace update_file.py databricks.yml "#TO_ADD: " ""
+
+# Both engines recreate. structdiff records the added block as one change at
+# "ingestion_definition"; bidirectional rule matching relates that to the recreate
+# rule on the connection_name leaf. See the per-engine "changes"/"action" in the JSON.
+$CLI bundle plan -o json | nostamp > out.plan.json
diff --git a/acceptance/bundle/resources/pipelines/recreate-add-whole-block/test.toml b/acceptance/bundle/resources/pipelines/recreate-add-whole-block/test.toml
new file mode 100644
index 00000000000..c5c794c9c09
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/recreate-add-whole-block/test.toml
@@ -0,0 +1,6 @@
+RecordRequests = false
+# Runs on both engines: both recreate (connection_name is immutable). The direct
+# plan's per-engine "changes" map (out.plan.direct.json) shows the recreate keyed on
+# the ingestion_definition block via bidirectional rule matching; terraform's plan
+# JSON just carries the action.
+Ignore = ["foo.py", ".databricks"]
diff --git a/acceptance/bundle/resources/pipelines/recreate-keys/_script b/acceptance/bundle/resources/pipelines/recreate-keys/_script
index d1cb49b382c..c0c25bfafb9 100644
--- a/acceptance/bundle/resources/pipelines/recreate-keys/_script
+++ b/acceptance/bundle/resources/pipelines/recreate-keys/_script
@@ -2,28 +2,30 @@ trace cat databricks.yml
 touch foo.py
 touch bar.py
 trace $CLI bundle plan  # should show 'create'
-$CLI bundle plan -o json > out.plan_create.$DATABRICKS_BUNDLE_ENGINE.json
+$CLI bundle plan -o json | nostamp.py > out.plan_create.json
 trace $CLI bundle deploy
 
 ppid1=`read_id.py my`
 
 print_requests() {
-    jq --sort-keys 'select(.method != "GET" and (.path | contains("/pipelines")))' < out.requests.txt
-    rm -f out.requests.txt
+    # Excludes /api/2.0/bundle: a DMS operation path embeds the resource key, so it also
+    # contains "/pipelines".
+    jq --sort-keys 'select(.method != "GET" and (.path | contains("/pipelines")) and (.path | contains("/api/2.0/bundle") | not))' < "$OUT_REQUESTS" | nostamp.py
+    rm -f "$OUT_REQUESTS"
 }
 
 trace print_requests
 
 trace update_file.py databricks.yml $CONFIG_UPDATE
 trace $CLI bundle plan  # should show 'recreate'
-$CLI bundle plan -o json > out.plan_recreate.$DATABRICKS_BUNDLE_ENGINE.json
+$CLI bundle plan -o json | nostamp.py > out.plan_recreate.json
 trace $CLI bundle deploy --auto-approve
 trace print_requests
 
 title "Fetch pipeline ID and verify remote state"
 
 ppid2=`read_id.py my`
-trace $CLI pipelines get $ppid2
+trace $CLI pipelines get $ppid2 | nostamp.py
 
 title "Verify that original pipeline is gone"
 trace musterr $CLI pipelines get $ppid1
@@ -33,4 +35,4 @@ trace $CLI bundle destroy --auto-approve
 
 trace print_requests
 trace musterr $CLI pipelines get $ppid2
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/resources/pipelines/recreate-keys/change-ingestion-definition/out.plan_create.direct.json b/acceptance/bundle/resources/pipelines/recreate-keys/change-ingestion-definition/out.plan_create.direct.json
deleted file mode 100644
index bd540374432..00000000000
--- a/acceptance/bundle/resources/pipelines/recreate-keys/change-ingestion-definition/out.plan_create.direct.json
+++ /dev/null
@@ -1,33 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.my": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "channel": "CURRENT",
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/state/metadata.json"
-          },
-          "edition": "ADVANCED",
-          "ingestion_definition": {
-            "connection_name": "my_connection",
-            "objects": [
-              {}
-            ]
-          },
-          "libraries": [
-            {
-              "file": {
-                "path": "/Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/files/foo.py"
-              }
-            }
-          ],
-          "name": "test-pipeline-[UNIQUE_NAME]"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/pipelines/recreate-keys/change-ingestion-definition/out.plan_create.json b/acceptance/bundle/resources/pipelines/recreate-keys/change-ingestion-definition/out.plan_create.json
new file mode 100644
index 00000000000..c96673a3c8c
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/recreate-keys/change-ingestion-definition/out.plan_create.json
@@ -0,0 +1,33 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.pipelines.my": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "channel": "CURRENT",
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/state/metadata.json"
+          },
+          "edition": "ADVANCED",
+          "ingestion_definition": {
+            "connection_name": "my_connection",
+            "objects": [
+              {}
+            ]
+          },
+          "libraries": [
+            {
+              "file": {
+                "path": "/Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/files/foo.py"
+              }
+            }
+          ],
+          "name": "test-pipeline-[UNIQUE_NAME]"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/pipelines/recreate-keys/change-ingestion-definition/out.plan_create.terraform.json b/acceptance/bundle/resources/pipelines/recreate-keys/change-ingestion-definition/out.plan_create.terraform.json
deleted file mode 100644
index d50641b6a3f..00000000000
--- a/acceptance/bundle/resources/pipelines/recreate-keys/change-ingestion-definition/out.plan_create.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.my": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/pipelines/recreate-keys/change-ingestion-definition/out.plan_recreate.direct.json b/acceptance/bundle/resources/pipelines/recreate-keys/change-ingestion-definition/out.plan_recreate.direct.json
deleted file mode 100644
index ee6b7940b47..00000000000
--- a/acceptance/bundle/resources/pipelines/recreate-keys/change-ingestion-definition/out.plan_recreate.direct.json
+++ /dev/null
@@ -1,79 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.pipelines.my": {
-      "action": "recreate",
-      "new_state": {
-        "value": {
-          "channel": "CURRENT",
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/state/metadata.json"
-          },
-          "edition": "ADVANCED",
-          "ingestion_definition": {
-            "connection_name": "my_new_connection",
-            "objects": [
-              {}
-            ]
-          },
-          "libraries": [
-            {
-              "file": {
-                "path": "/Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/files/foo.py"
-              }
-            }
-          ],
-          "name": "test-pipeline-[UNIQUE_NAME]"
-        }
-      },
-      "remote_state": {
-        "channel": "CURRENT",
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/state/metadata.json"
-        },
-        "edition": "ADVANCED",
-        "effective_publishing_mode": "DEFAULT_PUBLISHING_MODE",
-        "id": "[MY_ID]",
-        "ingestion_definition": {
-          "connection_name": "my_connection",
-          "objects": [
-            {}
-          ]
-        },
-        "last_modified": [UNIX_TIME_MILLIS],
-        "libraries": [
-          {
-            "file": {
-              "path": "/Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/files/foo.py"
-            }
-          }
-        ],
-        "name": "test-pipeline-[UNIQUE_NAME]",
-        "pipeline_id": "[MY_ID]",
-        "run_as_user_name": "[USERNAME]",
-        "state": "IDLE",
-        "storage": "dbfs:/pipelines/[MY_ID]"
-      },
-      "changes": {
-        "ingestion_definition.connection_name": {
-          "action": "recreate",
-          "reason": "immutable",
-          "old": "my_connection",
-          "new": "my_new_connection",
-          "remote": "my_connection"
-        },
-        "storage": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "dbfs:/pipelines/[MY_ID]"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/pipelines/recreate-keys/change-ingestion-definition/out.plan_recreate.json b/acceptance/bundle/resources/pipelines/recreate-keys/change-ingestion-definition/out.plan_recreate.json
new file mode 100644
index 00000000000..a1eeb395141
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/recreate-keys/change-ingestion-definition/out.plan_recreate.json
@@ -0,0 +1,79 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.pipelines.my": {
+      "action": "recreate",
+      "new_state": {
+        "value": {
+          "channel": "CURRENT",
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/state/metadata.json"
+          },
+          "edition": "ADVANCED",
+          "ingestion_definition": {
+            "connection_name": "my_new_connection",
+            "objects": [
+              {}
+            ]
+          },
+          "libraries": [
+            {
+              "file": {
+                "path": "/Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/files/foo.py"
+              }
+            }
+          ],
+          "name": "test-pipeline-[UNIQUE_NAME]"
+        }
+      },
+      "remote_state": {
+        "channel": "CURRENT",
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/state/metadata.json"
+        },
+        "edition": "ADVANCED",
+        "effective_publishing_mode": "DEFAULT_PUBLISHING_MODE",
+        "id": "[MY_ID]",
+        "ingestion_definition": {
+          "connection_name": "my_connection",
+          "objects": [
+            {}
+          ]
+        },
+        "last_modified": [UNIX_TIME_MILLIS],
+        "libraries": [
+          {
+            "file": {
+              "path": "/Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/files/foo.py"
+            }
+          }
+        ],
+        "name": "test-pipeline-[UNIQUE_NAME]",
+        "pipeline_id": "[MY_ID]",
+        "run_as_user_name": "[USERNAME]",
+        "state": "IDLE",
+        "storage": "dbfs:/pipelines/[MY_ID]"
+      },
+      "changes": {
+        "ingestion_definition.connection_name": {
+          "action": "recreate",
+          "reason": "immutable",
+          "old": "my_connection",
+          "new": "my_new_connection",
+          "remote": "my_connection"
+        },
+        "storage": {
+          "action": "skip",
+          "reason": "immutable_backend_value",
+          "remote": "dbfs:/pipelines/[MY_ID]"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/pipelines/recreate-keys/change-ingestion-definition/out.plan_recreate.terraform.json b/acceptance/bundle/resources/pipelines/recreate-keys/change-ingestion-definition/out.plan_recreate.terraform.json
deleted file mode 100644
index ab8503084cd..00000000000
--- a/acceptance/bundle/resources/pipelines/recreate-keys/change-ingestion-definition/out.plan_recreate.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.my": {
-      "action": "recreate"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/pipelines/recreate-keys/change-ingestion-definition/out.test.toml b/acceptance/bundle/resources/pipelines/recreate-keys/change-ingestion-definition/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/pipelines/recreate-keys/change-ingestion-definition/out.test.toml
+++ b/acceptance/bundle/resources/pipelines/recreate-keys/change-ingestion-definition/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/pipelines/recreate-keys/change-ingestion-definition/output.txt b/acceptance/bundle/resources/pipelines/recreate-keys/change-ingestion-definition/output.txt
index 77bfdc09d32..831e9e36a7d 100644
--- a/acceptance/bundle/resources/pipelines/recreate-keys/change-ingestion-definition/output.txt
+++ b/acceptance/bundle/resources/pipelines/recreate-keys/change-ingestion-definition/output.txt
@@ -21,9 +21,9 @@ Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created pipelines.my
+Files: 4 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> print_requests
 {
@@ -68,9 +68,9 @@ Streaming Tables (STs) and Materialized Views (MVs) managed by them. Recreating
 restore the defined STs and MVs through full refresh. Note that recreation is necessary when pipeline
 properties such as the 'catalog' or 'storage' are changed:
   recreate resources.pipelines.my
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Recreated pipelines.my
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 0 unchanged
 
 >>> print_requests
 {
@@ -150,13 +150,12 @@ The following resources will be deleted:
   delete resources.pipelines.my
 
 This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
-Streaming Tables (STs) and Materialized Views (MVs) managed by them:
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:
   delete resources.pipelines.my
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
 
 >>> print_requests
 {
diff --git a/acceptance/bundle/resources/pipelines/recreate-keys/change-storage/out.plan_create.direct.json b/acceptance/bundle/resources/pipelines/recreate-keys/change-storage/out.plan_create.direct.json
deleted file mode 100644
index 542d8b77c44..00000000000
--- a/acceptance/bundle/resources/pipelines/recreate-keys/change-storage/out.plan_create.direct.json
+++ /dev/null
@@ -1,28 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.my": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "channel": "CURRENT",
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/state/metadata.json"
-          },
-          "edition": "ADVANCED",
-          "libraries": [
-            {
-              "file": {
-                "path": "/Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/files/foo.py"
-              }
-            }
-          ],
-          "name": "test-pipeline-[UNIQUE_NAME]",
-          "storage": "dbfs:/pipelines/custom"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/pipelines/recreate-keys/change-storage/out.plan_create.json b/acceptance/bundle/resources/pipelines/recreate-keys/change-storage/out.plan_create.json
new file mode 100644
index 00000000000..90a282be013
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/recreate-keys/change-storage/out.plan_create.json
@@ -0,0 +1,28 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.pipelines.my": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "channel": "CURRENT",
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/state/metadata.json"
+          },
+          "edition": "ADVANCED",
+          "libraries": [
+            {
+              "file": {
+                "path": "/Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/files/foo.py"
+              }
+            }
+          ],
+          "name": "test-pipeline-[UNIQUE_NAME]",
+          "storage": "dbfs:/pipelines/custom"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/pipelines/recreate-keys/change-storage/out.plan_create.terraform.json b/acceptance/bundle/resources/pipelines/recreate-keys/change-storage/out.plan_create.terraform.json
deleted file mode 100644
index d50641b6a3f..00000000000
--- a/acceptance/bundle/resources/pipelines/recreate-keys/change-storage/out.plan_create.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.my": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/pipelines/recreate-keys/change-storage/out.plan_recreate.direct.json b/acceptance/bundle/resources/pipelines/recreate-keys/change-storage/out.plan_recreate.direct.json
deleted file mode 100644
index 0d4a75b9d28..00000000000
--- a/acceptance/bundle/resources/pipelines/recreate-keys/change-storage/out.plan_recreate.direct.json
+++ /dev/null
@@ -1,63 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.pipelines.my": {
-      "action": "recreate",
-      "new_state": {
-        "value": {
-          "channel": "CURRENT",
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/state/metadata.json"
-          },
-          "edition": "ADVANCED",
-          "libraries": [
-            {
-              "file": {
-                "path": "/Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/files/foo.py"
-              }
-            }
-          ],
-          "name": "test-pipeline-[UNIQUE_NAME]",
-          "storage": "dbfs:/pipelines/newcustom"
-        }
-      },
-      "remote_state": {
-        "channel": "CURRENT",
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/state/metadata.json"
-        },
-        "edition": "ADVANCED",
-        "effective_publishing_mode": "DEFAULT_PUBLISHING_MODE",
-        "id": "[MY_ID]",
-        "last_modified": [UNIX_TIME_MILLIS],
-        "libraries": [
-          {
-            "file": {
-              "path": "/Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/files/foo.py"
-            }
-          }
-        ],
-        "name": "test-pipeline-[UNIQUE_NAME]",
-        "pipeline_id": "[MY_ID]",
-        "run_as_user_name": "[USERNAME]",
-        "state": "IDLE",
-        "storage": "dbfs:/pipelines/custom"
-      },
-      "changes": {
-        "storage": {
-          "action": "recreate",
-          "reason": "immutable",
-          "old": "dbfs:/pipelines/custom",
-          "new": "dbfs:/pipelines/newcustom",
-          "remote": "dbfs:/pipelines/custom"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/pipelines/recreate-keys/change-storage/out.plan_recreate.json b/acceptance/bundle/resources/pipelines/recreate-keys/change-storage/out.plan_recreate.json
new file mode 100644
index 00000000000..2169f607228
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/recreate-keys/change-storage/out.plan_recreate.json
@@ -0,0 +1,63 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.pipelines.my": {
+      "action": "recreate",
+      "new_state": {
+        "value": {
+          "channel": "CURRENT",
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/state/metadata.json"
+          },
+          "edition": "ADVANCED",
+          "libraries": [
+            {
+              "file": {
+                "path": "/Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/files/foo.py"
+              }
+            }
+          ],
+          "name": "test-pipeline-[UNIQUE_NAME]",
+          "storage": "dbfs:/pipelines/newcustom"
+        }
+      },
+      "remote_state": {
+        "channel": "CURRENT",
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/state/metadata.json"
+        },
+        "edition": "ADVANCED",
+        "effective_publishing_mode": "DEFAULT_PUBLISHING_MODE",
+        "id": "[MY_ID]",
+        "last_modified": [UNIX_TIME_MILLIS],
+        "libraries": [
+          {
+            "file": {
+              "path": "/Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/files/foo.py"
+            }
+          }
+        ],
+        "name": "test-pipeline-[UNIQUE_NAME]",
+        "pipeline_id": "[MY_ID]",
+        "run_as_user_name": "[USERNAME]",
+        "state": "IDLE",
+        "storage": "dbfs:/pipelines/custom"
+      },
+      "changes": {
+        "storage": {
+          "action": "recreate",
+          "reason": "immutable",
+          "old": "dbfs:/pipelines/custom",
+          "new": "dbfs:/pipelines/newcustom",
+          "remote": "dbfs:/pipelines/custom"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/pipelines/recreate-keys/change-storage/out.plan_recreate.terraform.json b/acceptance/bundle/resources/pipelines/recreate-keys/change-storage/out.plan_recreate.terraform.json
deleted file mode 100644
index ab8503084cd..00000000000
--- a/acceptance/bundle/resources/pipelines/recreate-keys/change-storage/out.plan_recreate.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.my": {
-      "action": "recreate"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/pipelines/recreate-keys/change-storage/out.test.toml b/acceptance/bundle/resources/pipelines/recreate-keys/change-storage/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/pipelines/recreate-keys/change-storage/out.test.toml
+++ b/acceptance/bundle/resources/pipelines/recreate-keys/change-storage/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/pipelines/recreate-keys/change-storage/output.txt b/acceptance/bundle/resources/pipelines/recreate-keys/change-storage/output.txt
index 74943571027..4152f08a59b 100644
--- a/acceptance/bundle/resources/pipelines/recreate-keys/change-storage/output.txt
+++ b/acceptance/bundle/resources/pipelines/recreate-keys/change-storage/output.txt
@@ -21,9 +21,9 @@ Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created pipelines.my
+Files: 4 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> print_requests
 {
@@ -63,9 +63,9 @@ Streaming Tables (STs) and Materialized Views (MVs) managed by them. Recreating
 restore the defined STs and MVs through full refresh. Note that recreation is necessary when pipeline
 properties such as the 'catalog' or 'storage' are changed:
   recreate resources.pipelines.my
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Recreated pipelines.my
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 0 unchanged
 
 >>> print_requests
 {
@@ -134,13 +134,12 @@ The following resources will be deleted:
   delete resources.pipelines.my
 
 This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
-Streaming Tables (STs) and Materialized Views (MVs) managed by them:
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:
   delete resources.pipelines.my
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
 
 >>> print_requests
 {
diff --git a/acceptance/bundle/resources/pipelines/recreate-remove-whole-block/databricks.yml.tmpl b/acceptance/bundle/resources/pipelines/recreate-remove-whole-block/databricks.yml.tmpl
new file mode 100644
index 00000000000..fba8fd9a15f
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/recreate-remove-whole-block/databricks.yml.tmpl
@@ -0,0 +1,15 @@
+bundle:
+  name: acc-$UNIQUE_NAME
+
+resources:
+  pipelines:
+    my:
+      name: test-pipeline-$UNIQUE_NAME
+      storage: dbfs:/pipelines/custom
+      ingestion_definition: # TO_DELETE
+        connection_name: my_connection # TO_DELETE
+        objects: # TO_DELETE
+          - {} # TO_DELETE
+      libraries:
+        - file:
+            path: "./foo.py"
diff --git a/acceptance/bundle/resources/pipelines/recreate-remove-whole-block/out.plan.json b/acceptance/bundle/resources/pipelines/recreate-remove-whole-block/out.plan.json
new file mode 100644
index 00000000000..e9d4cb5b6d8
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/recreate-remove-whole-block/out.plan.json
@@ -0,0 +1,78 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.pipelines.my": {
+      "action": "recreate",
+      "new_state": {
+        "value": {
+          "channel": "CURRENT",
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/state/metadata.json"
+          },
+          "edition": "ADVANCED",
+          "libraries": [
+            {
+              "file": {
+                "path": "/Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/files/foo.py"
+              }
+            }
+          ],
+          "name": "test-pipeline-[UNIQUE_NAME]",
+          "storage": "dbfs:/pipelines/custom"
+        }
+      },
+      "remote_state": {
+        "channel": "CURRENT",
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/state/metadata.json"
+        },
+        "edition": "ADVANCED",
+        "effective_publishing_mode": "DEFAULT_PUBLISHING_MODE",
+        "id": "[UUID]",
+        "ingestion_definition": {
+          "connection_name": "my_connection",
+          "objects": [
+            {}
+          ]
+        },
+        "last_modified": [UNIX_TIME_MILLIS],
+        "libraries": [
+          {
+            "file": {
+              "path": "/Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/files/foo.py"
+            }
+          }
+        ],
+        "name": "test-pipeline-[UNIQUE_NAME]",
+        "pipeline_id": "[UUID]",
+        "run_as_user_name": "[USERNAME]",
+        "state": "IDLE",
+        "storage": "dbfs:/pipelines/custom"
+      },
+      "changes": {
+        "ingestion_definition": {
+          "action": "recreate",
+          "reason": "immutable",
+          "old": {
+            "connection_name": "my_connection",
+            "objects": [
+              {}
+            ]
+          },
+          "remote": {
+            "connection_name": "my_connection",
+            "objects": [
+              {}
+            ]
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/pipelines/recreate-remove-whole-block/out.test.toml b/acceptance/bundle/resources/pipelines/recreate-remove-whole-block/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/recreate-remove-whole-block/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/pipelines/recreate-remove-whole-block/output.txt b/acceptance/bundle/resources/pipelines/recreate-remove-whole-block/output.txt
new file mode 100644
index 00000000000..560bd3a1333
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/recreate-remove-whole-block/output.txt
@@ -0,0 +1,6 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/files...
+Created pipelines.my
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
diff --git a/acceptance/bundle/resources/pipelines/recreate-remove-whole-block/script b/acceptance/bundle/resources/pipelines/recreate-remove-whole-block/script
new file mode 100644
index 00000000000..cf30f848cba
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/recreate-remove-whole-block/script
@@ -0,0 +1,15 @@
+touch foo.py
+
+# Phase 1: deploy with the whole ingestion_definition block (lines tagged
+# # TO_DELETE in the template).
+envsubst < databricks.yml.tmpl > databricks.yml
+trace $CLI bundle deploy
+
+# Phase 2: remove the whole ingestion_definition block by dropping the tagged
+# lines. connection_name is immutable, so removing it must recreate the pipeline.
+grep -v '# TO_DELETE' databricks.yml > databricks.yml.tmp && mv databricks.yml.tmp databricks.yml
+
+# Both engines recreate. structdiff records the removed block as one change at
+# "ingestion_definition"; bidirectional rule matching relates that to the recreate
+# rule on the connection_name leaf. See the per-engine "changes"/"action" in the JSON.
+$CLI bundle plan -o json | nostamp > out.plan.json
diff --git a/acceptance/bundle/resources/pipelines/recreate-remove-whole-block/test.toml b/acceptance/bundle/resources/pipelines/recreate-remove-whole-block/test.toml
new file mode 100644
index 00000000000..c5c794c9c09
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/recreate-remove-whole-block/test.toml
@@ -0,0 +1,6 @@
+RecordRequests = false
+# Runs on both engines: both recreate (connection_name is immutable). The direct
+# plan's per-engine "changes" map (out.plan.direct.json) shows the recreate keyed on
+# the ingestion_definition block via bidirectional rule matching; terraform's plan
+# JSON just carries the action.
+Ignore = ["foo.py", ".databricks"]
diff --git a/acceptance/bundle/resources/pipelines/recreate/databricks.yml.tmpl b/acceptance/bundle/resources/pipelines/recreate/databricks.yml.tmpl
index 7e19c759926..9dca81c0961 100644
--- a/acceptance/bundle/resources/pipelines/recreate/databricks.yml.tmpl
+++ b/acceptance/bundle/resources/pipelines/recreate/databricks.yml.tmpl
@@ -13,7 +13,7 @@ resources:
             path: ./nb.sql
       development: true
       catalog: main
-      target: ${resources.schemas.bar.id}
+      target: ${resources.schemas.bar.name}
 
   schemas:
     bar:
diff --git a/acceptance/bundle/resources/pipelines/recreate/out.test.toml b/acceptance/bundle/resources/pipelines/recreate/out.test.toml
index 6e3397efe53..98ccab9aaeb 100644
--- a/acceptance/bundle/resources/pipelines/recreate/out.test.toml
+++ b/acceptance/bundle/resources/pipelines/recreate/out.test.toml
@@ -1,5 +1,3 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
 RunsOnDbr = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/pipelines/recreate/output.txt b/acceptance/bundle/resources/pipelines/recreate/output.txt
index 8550395ff2a..3ee69c5c6c1 100644
--- a/acceptance/bundle/resources/pipelines/recreate/output.txt
+++ b/acceptance/bundle/resources/pipelines/recreate/output.txt
@@ -1,11 +1,20 @@
 
 >>> [CLI] bundle deploy
+Warning: The "development" property of pipelines is deprecated. Use "mode: development" in your databricks.yml instead. See https://docs.databricks.com/dev-tools/bundles/deployment-modes.
+  at resources.pipelines.foo.development
+  in databricks.yml:14:20
+
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created pipelines.foo
+Created schemas.bar
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Assert the pipeline is created with catalogWarning: The "development" property of pipelines is deprecated. Use "mode: development" in your databricks.yml instead. See https://docs.databricks.com/dev-tools/bundles/deployment-modes.
+  at resources.pipelines.foo.development
+  in databricks.yml:14:20
+
 
-=== Assert the pipeline is created with catalog
 >>> [CLI] pipelines get [UUID]
 {
   "spec": {
@@ -26,22 +35,30 @@ Deployment complete!
       }
     ],
     "name": "test-pipeline-[UNIQUE_NAME]",
-    "target": "main.test-schema-[UNIQUE_NAME]"
+    "target": "test-schema-[UNIQUE_NAME]"
   }
 }
 
 === Switch from catalog to storage (triggers recreation)
 >>> update_file.py databricks.yml catalog: main storage: dbfs:/my-storage
 
->>> update_file.py databricks.yml target: ${resources.schemas.bar.id} #target: ${resources.schemas.bar.id}
+>>> update_file.py databricks.yml target: ${resources.schemas.bar.name} #target: ${resources.schemas.bar.name}
 
 >>> [CLI] bundle plan
+Warning: The "development" property of pipelines is deprecated. Use "mode: development" in your databricks.yml instead. See https://docs.databricks.com/dev-tools/bundles/deployment-modes.
+  at resources.pipelines.foo.development
+  in databricks.yml:14:20
+
 recreate pipelines.foo
 
 Plan: 1 to add, 0 to change, 1 to delete, 1 unchanged
 
 === Redeploy the bundle (should recreate the pipeline)
 >>> errcode [CLI] bundle deploy --force-lock
+Warning: The "development" property of pipelines is deprecated. Use "mode: development" in your databricks.yml instead. See https://docs.databricks.com/dev-tools/bundles/deployment-modes.
+  at resources.pipelines.foo.development
+  in databricks.yml:14:20
+
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
 
 This action will result in the deletion or recreation of the following Lakeflow Spark Declarative Pipelines along with the
@@ -49,12 +66,19 @@ Streaming Tables (STs) and Materialized Views (MVs) managed by them. Recreating
 restore the defined STs and MVs through full refresh. Note that recreation is necessary when pipeline
 properties such as the 'catalog' or 'storage' are changed:
   recreate resources.pipelines.foo
-Error: the deployment requires destructive actions, but current console does not support prompting. Please specify --auto-approve if you would like to skip prompts and proceed
+Error: the deployment requires destructive actions, but the current console does not support prompting.
+Deleting data assets such as schemas, pipelines, or volumes may cause permanent data loss and should be carefully reviewed.
+To proceed, use --auto-approve after reviewing the plan above.
 
+Files: 1 uploaded, 0 deleted
 
 Exit code: 1
 
 >>> [CLI] bundle destroy --auto-approve
+Warning: The "development" property of pipelines is deprecated. Use "mode: development" in your databricks.yml instead. See https://docs.databricks.com/dev-tools/bundles/deployment-modes.
+  at resources.pipelines.foo.development
+  in databricks.yml:14:20
+
 The following resources will be deleted:
   delete resources.pipelines.foo
   delete resources.schemas.bar
@@ -63,10 +87,9 @@ This action will result in the deletion of the following UC schemas. Any underly
   delete resources.schemas.bar
 
 This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
-Streaming Tables (STs) and Materialized Views (MVs) managed by them:
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:
   delete resources.pipelines.foo
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/pipelines/recreate/script b/acceptance/bundle/resources/pipelines/recreate/script
index b9a6e148d23..0a814d08985 100644
--- a/acceptance/bundle/resources/pipelines/recreate/script
+++ b/acceptance/bundle/resources/pipelines/recreate/script
@@ -8,15 +8,15 @@ trap cleanup EXIT
 trace $CLI bundle deploy
 
 title "Assert the pipeline is created with catalog"
-PIPELINE_ID=$($CLI bundle summary -o json | jq -r '.resources.pipelines.foo.id')
-trace $CLI pipelines get "${PIPELINE_ID}" | jq "{spec}"
+PIPELINE_ID=$($CLI bundle summary -o json | nostamp | jq -r '.resources.pipelines.foo.id')
+trace $CLI pipelines get "${PIPELINE_ID}" | nostamp| jq "{spec}"
 
 # Note: In Terraform provider v1.98.0+, changing catalog no longer triggers recreation.
 # We switch to using storage location instead, which still triggers recreation.
 title "Switch from catalog to storage (triggers recreation)"
 trace update_file.py databricks.yml "catalog: main" "storage: dbfs:/my-storage"
 # Remove target reference since storage-based pipelines can't use it
-trace update_file.py databricks.yml "target: \${resources.schemas.bar.id}" "#target: \${resources.schemas.bar.id}"
+trace update_file.py databricks.yml "target: \${resources.schemas.bar.name}" "#target: \${resources.schemas.bar.name}"
 
 trace $CLI bundle plan 2>&1
 
diff --git a/acceptance/bundle/resources/pipelines/recreate/test.toml b/acceptance/bundle/resources/pipelines/recreate/test.toml
index b8d5d703d3c..6c356f11a98 100644
--- a/acceptance/bundle/resources/pipelines/recreate/test.toml
+++ b/acceptance/bundle/resources/pipelines/recreate/test.toml
@@ -1,8 +1,6 @@
-Local = true
 Cloud = true
 RecordRequests = false
 RunsOnDbr = true
-RequiresUnityCatalog = true
 
 Ignore = [
     "databricks.yml"
diff --git a/acceptance/bundle/resources/pipelines/remote_matches_config/databricks.yml b/acceptance/bundle/resources/pipelines/remote_matches_config/databricks.yml
new file mode 100644
index 00000000000..c8b9ac895e7
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/remote_matches_config/databricks.yml
@@ -0,0 +1,13 @@
+bundle:
+  name: test-bundle
+
+resources:
+  pipelines:
+    my_pipeline:
+      name: "Test Pipeline run_as guard"
+      serverless: true
+      libraries:
+        - notebook:
+            path: /Users/{{workspace_user_name}}/test_notebook
+      run_as:
+        user_name: original@example.test
diff --git a/acceptance/bundle/resources/pipelines/remote_matches_config/out.plan.json b/acceptance/bundle/resources/pipelines/remote_matches_config/out.plan.json
new file mode 100644
index 00000000000..af5bdbf016b
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/remote_matches_config/out.plan.json
@@ -0,0 +1,74 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.pipelines.my_pipeline": {
+      "action": "update",
+      "new_state": {
+        "value": {
+          "channel": "CURRENT",
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+          },
+          "edition": "ADVANCED",
+          "libraries": [
+            {
+              "notebook": {
+                "path": "/Users/{{workspace_user_name}}/test_notebook"
+              }
+            }
+          ],
+          "name": "Test Pipeline run_as guard",
+          "run_as": {
+            "user_name": "changed@example.test"
+          },
+          "serverless": true
+        }
+      },
+      "remote_state": {
+        "channel": "CURRENT",
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+        },
+        "edition": "ADVANCED",
+        "effective_publishing_mode": "DEFAULT_PUBLISHING_MODE",
+        "id": "[MY_PIPELINE_ID]",
+        "last_modified": [UNIX_TIME_MILLIS],
+        "libraries": [
+          {
+            "notebook": {
+              "path": "/Users/{{workspace_user_name}}/test_notebook"
+            }
+          }
+        ],
+        "name": "Test Pipeline run_as guard",
+        "pipeline_id": "[MY_PIPELINE_ID]",
+        "run_as": {
+          "user_name": "changed@example.test"
+        },
+        "run_as_user_name": "[USERNAME]",
+        "serverless": true,
+        "state": "IDLE",
+        "storage": "dbfs:/pipelines/[MY_PIPELINE_ID]"
+      },
+      "changes": {
+        "run_as.user_name": {
+          "action": "update",
+          "old": "original@example.test",
+          "new": "changed@example.test",
+          "remote": "changed@example.test"
+        },
+        "storage": {
+          "action": "skip",
+          "reason": "immutable_backend_value",
+          "remote": "dbfs:/pipelines/[MY_PIPELINE_ID]"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/pipelines/remote_matches_config/out.test.toml b/acceptance/bundle/resources/pipelines/remote_matches_config/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/remote_matches_config/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/pipelines/remote_matches_config/output.txt b/acceptance/bundle/resources/pipelines/remote_matches_config/output.txt
new file mode 100644
index 00000000000..774b5582008
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/remote_matches_config/output.txt
@@ -0,0 +1,13 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created pipelines.my_pipeline
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Make local change: run_as user -> changed@example.test
+=== Force remote run_as to match the new config value
+>>> [CLI] bundle plan
+update pipelines.my_pipeline
+
+Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
diff --git a/acceptance/bundle/resources/pipelines/remote_matches_config/script b/acceptance/bundle/resources/pipelines/remote_matches_config/script
new file mode 100644
index 00000000000..8f6b64629d5
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/remote_matches_config/script
@@ -0,0 +1,18 @@
+# run_as is declared ignore_remote_changes: input_only. This test forces the situation where
+# a genuine local change (state has run_as A, config changes it to B) coincides with remote
+# already reading back B. Before the RemoteAlreadySet input-only fix, remote == new wrongly
+# skipped the change (reason: remote_already_set); it must instead classify as an update.
+
+trace $CLI bundle deploy
+pipeline_id="$(read_id.py my_pipeline)"
+
+title "Make local change: run_as user -> changed@example.test"
+update_file.py databricks.yml "original@example.test" "changed@example.test"
+
+title "Force remote run_as to match the new config value"
+edit_resource.py pipelines "$pipeline_id" <<EOF
+r["run_as"] = {"user_name": "changed@example.test"}
+EOF
+
+trace $CLI bundle plan
+$CLI bundle plan -o json | nostamp > out.plan.json
diff --git a/acceptance/bundle/resources/pipelines/remote_matches_config/test.toml b/acceptance/bundle/resources/pipelines/remote_matches_config/test.toml
new file mode 100644
index 00000000000..e1290bad9f4
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/remote_matches_config/test.toml
@@ -0,0 +1,2 @@
+RecordRequests = false
+Ignore = [".databricks"]
diff --git a/acceptance/bundle/resources/pipelines/update/out.test.toml b/acceptance/bundle/resources/pipelines/update/out.test.toml
index bbc7fcfd1bd..0f167effef1 100644
--- a/acceptance/bundle/resources/pipelines/update/out.test.toml
+++ b/acceptance/bundle/resources/pipelines/update/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/pipelines/update/output.txt b/acceptance/bundle/resources/pipelines/update/output.txt
index 597df75da99..f84d08b7557 100644
--- a/acceptance/bundle/resources/pipelines/update/output.txt
+++ b/acceptance/bundle/resources/pipelines/update/output.txt
@@ -1,12 +1,14 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created pipelines.my
+Files: 4 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> print_requests
 {
+  "method": "POST",
+  "path": "/api/2.0/pipelines",
   "body": {
     "channel": "CURRENT",
     "deployment": {
@@ -22,9 +24,7 @@ Deployment complete!
       }
     ],
     "name": "test-pipeline-[UNIQUE_NAME]"
-  },
-  "method": "POST",
-  "path": "/api/2.0/pipelines"
+  }
 }
 pipelines my id='[MY_ID]' name='test-pipeline-[UNIQUE_NAME]'
 
@@ -32,9 +32,9 @@ pipelines my id='[MY_ID]' name='test-pipeline-[UNIQUE_NAME]'
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated pipelines.my
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
 === Fetch pipeline ID and verify remote state
 >>> [CLI] pipelines get [MY_ID]
@@ -72,20 +72,19 @@ The following resources will be deleted:
   delete resources.pipelines.my
 
 This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
-Streaming Tables (STs) and Materialized Views (MVs) managed by them:
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:
   delete resources.pipelines.my
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/acc-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
 
 >>> print_requests
 {
   "method": "DELETE",
   "path": "/api/2.0/pipelines/[MY_ID]"
 }
-State not found for pipelines.my
+State not found for pipelines.my in [STATE_LOCATION]
 
 >>> musterr [CLI] pipelines get [MY_ID]
 Error: The specified pipeline [MY_ID] was not found.
diff --git a/acceptance/bundle/resources/pipelines/update/script b/acceptance/bundle/resources/pipelines/update/script
index d801e604793..14a2aa0c94d 100644
--- a/acceptance/bundle/resources/pipelines/update/script
+++ b/acceptance/bundle/resources/pipelines/update/script
@@ -4,8 +4,7 @@ touch bar.py
 trace $CLI bundle deploy
 
 print_requests() {
-    jq --sort-keys 'select(.method != "GET" and (.path | contains("/pipelines")))' < out.requests.txt
-    rm out.requests.txt
+    print_requests.py //pipelines --nostamp
     read_state.py pipelines my id name
 }
 
@@ -17,17 +16,17 @@ trace $CLI bundle deploy
 # fields that it previously received from the backend.
 # The get call below verifies that it does not matter -- the pipeline is the same in the end.
 #trace print_requests
-rm out.requests.txt
+rm "$OUT_REQUESTS"
 
 title "Fetch pipeline ID and verify remote state"
 
 ppid=`read_id.py my`
-trace $CLI pipelines get $ppid
-rm out.requests.txt
+trace $CLI pipelines get $ppid | nostamp
+rm "$OUT_REQUESTS"
 
 title "Destroy the pipeline and verify that it's removed from the state and from remote"
 trace $CLI bundle destroy --auto-approve
 
 trace print_requests
 trace musterr $CLI pipelines get $ppid
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/resources/pipelines/update/test.toml b/acceptance/bundle/resources/pipelines/update/test.toml
index 653ecbfe781..6955faeaabd 100644
--- a/acceptance/bundle/resources/pipelines/update/test.toml
+++ b/acceptance/bundle/resources/pipelines/update/test.toml
@@ -1,3 +1,10 @@
 Timeout = '30s'
 Cloud = true
 Ignore = ["bar.py", "foo.py"]
+
+# read_state.py names where it looked for state, which differs per engine (a state file under
+# .databricks, or deployment history when recording); normalize the location so all variants
+# match. (?m) anchors $ to the message line, not the end of the whole output.
+[[Repls]]
+Old = '(?m) in (?:\.databricks/\S+|deployment history)$'
+New = ' in [STATE_LOCATION]'
diff --git a/acceptance/bundle/resources/pipelines/zero-value-fields/databricks.yml b/acceptance/bundle/resources/pipelines/zero-value-fields/databricks.yml
new file mode 100644
index 00000000000..6559797a86d
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/zero-value-fields/databricks.yml
@@ -0,0 +1,14 @@
+bundle:
+  name: zero-value-fields
+
+resources:
+  pipelines:
+    my:
+      name: test-pipeline
+      photon: false
+      serverless: false
+      continuous: false
+      development: false
+      libraries:
+        - file:
+            path: "./foo.py"
diff --git a/acceptance/bundle/telemetry/deploy/test.toml b/acceptance/bundle/resources/pipelines/zero-value-fields/foo.py
similarity index 100%
rename from acceptance/bundle/telemetry/deploy/test.toml
rename to acceptance/bundle/resources/pipelines/zero-value-fields/foo.py
diff --git a/acceptance/bundle/resources/pipelines/zero-value-fields/out.requests.txt b/acceptance/bundle/resources/pipelines/zero-value-fields/out.requests.txt
new file mode 100644
index 00000000000..e4b82109cf1
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/zero-value-fields/out.requests.txt
@@ -0,0 +1,24 @@
+{
+  "method": "POST",
+  "path": "/api/2.0/pipelines",
+  "body": {
+    "channel": "CURRENT",
+    "continuous": false,
+    "deployment": {
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/zero-value-fields/default/state/metadata.json"
+    },
+    "development": false,
+    "edition": "ADVANCED",
+    "libraries": [
+      {
+        "file": {
+          "path": "/Workspace/Users/[USERNAME]/.bundle/zero-value-fields/default/files/foo.py"
+        }
+      }
+    ],
+    "name": "test-pipeline",
+    "photon": false,
+    "serverless": false
+  }
+}
diff --git a/acceptance/bundle/resources/pipelines/zero-value-fields/out.test.toml b/acceptance/bundle/resources/pipelines/zero-value-fields/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/zero-value-fields/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/pipelines/zero-value-fields/output.txt b/acceptance/bundle/resources/pipelines/zero-value-fields/output.txt
new file mode 100644
index 00000000000..1b73b0cab2c
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/zero-value-fields/output.txt
@@ -0,0 +1,10 @@
+
+>>> [CLI] bundle deploy
+Warning: The "development" property of pipelines is deprecated. Use "mode: development" in your databricks.yml instead. See https://docs.databricks.com/dev-tools/bundles/deployment-modes.
+  at resources.pipelines.my.development
+  in databricks.yml:11:20
+
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/zero-value-fields/default/files...
+Created pipelines.my
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
diff --git a/acceptance/bundle/resources/pipelines/zero-value-fields/script b/acceptance/bundle/resources/pipelines/zero-value-fields/script
new file mode 100644
index 00000000000..9d0e88df7e7
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/zero-value-fields/script
@@ -0,0 +1,2 @@
+trace $CLI bundle deploy
+print_requests.py --nostamp //api/2.0/pipelines > out.requests.txt 2>&1
diff --git a/acceptance/bundle/resources/pipelines/zero-value-fields/test.toml b/acceptance/bundle/resources/pipelines/zero-value-fields/test.toml
new file mode 100644
index 00000000000..a6860e07879
--- /dev/null
+++ b/acceptance/bundle/resources/pipelines/zero-value-fields/test.toml
@@ -0,0 +1,3 @@
+Badness = "zero-value bool fields (photon, serverless, continuous, development) are not sent in the terraform deployment"
+Cloud = false
+RecordRequests = true
diff --git a/acceptance/bundle/resources/postgres_branches/basic/out.requests.direct.json b/acceptance/bundle/resources/postgres_branches/basic/out.requests.json
similarity index 100%
rename from acceptance/bundle/resources/postgres_branches/basic/out.requests.direct.json
rename to acceptance/bundle/resources/postgres_branches/basic/out.requests.json
diff --git a/acceptance/bundle/resources/postgres_branches/basic/out.requests.terraform.json b/acceptance/bundle/resources/postgres_branches/basic/out.requests.terraform.json
deleted file mode 100644
index ae5f9bab209..00000000000
--- a/acceptance/bundle/resources/postgres_branches/basic/out.requests.terraform.json
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  "method": "POST",
-  "path": "/api/2.0/postgres/projects",
-  "q": {
-    "project_id": "test-pg-proj-[UNIQUE_NAME]"
-  },
-  "body": {
-    "spec": {
-      "default_endpoint_settings": {
-        "autoscaling_limit_max_cu": 4,
-        "autoscaling_limit_min_cu": 0.5,
-        "suspend_timeout_duration": "300s"
-      },
-      "display_name": "Test Project for Branch",
-      "history_retention_duration": "604800s",
-      "pg_version": 16
-    }
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches",
-  "q": {
-    "branch_id": "main"
-  },
-  "body": {
-    "parent": "projects/test-pg-proj-[UNIQUE_NAME]",
-    "spec": {
-      "no_expiry": true
-    }
-  }
-}
-{
-  "method": "GET",
-  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main"
-}
diff --git a/acceptance/bundle/resources/postgres_branches/basic/out.test.toml b/acceptance/bundle/resources/postgres_branches/basic/out.test.toml
index 110f841fa05..ee153e82621 100644
--- a/acceptance/bundle/resources/postgres_branches/basic/out.test.toml
+++ b/acceptance/bundle/resources/postgres_branches/basic/out.test.toml
@@ -1,6 +1,4 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
 CloudEnvs.azure = false
 CloudEnvs.gcp = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_branches/basic/output.txt b/acceptance/bundle/resources/postgres_branches/basic/output.txt
index 9da42b6da2a..548caf6ac30 100644
--- a/acceptance/bundle/resources/postgres_branches/basic/output.txt
+++ b/acceptance/bundle/resources/postgres_branches/basic/output.txt
@@ -18,23 +18,24 @@ Resources:
   Postgres branches:
     main:
       Name: 
-      URL:  (not deployed)
   Postgres projects:
     my_project:
       Name: Test Project for Branch
-      URL:  (not deployed)
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-branch-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created postgres_branches.main
+Created postgres_projects.my_project
+Files: 0 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] postgres get-branch projects/test-pg-proj-[UNIQUE_NAME]/branches/main
 {
+  "branch_id": "main",
   "name": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
   "parent": "projects/test-pg-proj-[UNIQUE_NAME]",
   "status": {
+    "branch_id": "main",
     "current_state": "READY",
     "default": false,
     "is_protected": false,
@@ -55,14 +56,12 @@ Workspace:
 Resources:
   Postgres branches:
     main:
-      Name: 
-      URL:  (not deployed)
+      Name: projects/test-pg-proj-[UNIQUE_NAME]/branches/main
   Postgres projects:
     my_project:
       Name: Test Project for Branch
-      URL:  (not deployed)
 
->>> print_requests.py --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
@@ -79,5 +78,4 @@ All data stored in them will be permanently lost:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-branch-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/postgres_branches/basic/script b/acceptance/bundle/resources/postgres_branches/basic/script
index 0086234c2e5..5e498ea738e 100644
--- a/acceptance/bundle/resources/postgres_branches/basic/script
+++ b/acceptance/bundle/resources/postgres_branches/basic/script
@@ -2,7 +2,7 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
    trace $CLI bundle destroy --auto-approve
-   rm -f out.requests.txt
+   rm -f "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
@@ -10,15 +10,15 @@ trace $CLI bundle validate
 
 trace $CLI bundle summary
 
-rm -f out.requests.txt
+rm -f "$OUT_REQUESTS"
 trace $CLI bundle deploy
 
 # Get branch details
 project_name="projects/test-pg-proj-${UNIQUE_NAME}"
 branch_name="${project_name}/branches/main"
-trace $CLI postgres get-branch "${branch_name}" | jq 'del(.create_time, .update_time, .status.logical_size_bytes)'
+trace $CLI postgres get-branch "${branch_name}" | branch_fields
 
 trace $CLI bundle summary
 
 # Filter requests to only show postgres operations (exclude workspace, telemetry, and operation polling)
-trace print_requests.py --keep --get '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.$DATABRICKS_BUNDLE_ENGINE.json
+trace print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.json
diff --git a/acceptance/bundle/resources/postgres_branches/basic/test.toml b/acceptance/bundle/resources/postgres_branches/basic/test.toml
deleted file mode 100644
index f8b3bbe49dd..00000000000
--- a/acceptance/bundle/resources/postgres_branches/basic/test.toml
+++ /dev/null
@@ -1 +0,0 @@
-# All configuration inherited from parent test.toml
diff --git a/acceptance/bundle/resources/postgres_branches/purge_on_delete/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_branches/purge_on_delete/databricks.yml.tmpl
new file mode 100644
index 00000000000..fe20913512e
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/purge_on_delete/databricks.yml.tmpl
@@ -0,0 +1,28 @@
+bundle:
+  name: deploy-postgres-branch-purge-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+# A project with two branches side by side so the recorded destroy requests
+# make the purge_on_delete contrast obvious:
+#   - hard_delete:  purge_on_delete: true   -> DELETE …?purge=true
+#   - soft_delete:  field omitted (default) -> DELETE …    (no purge query)
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-$UNIQUE_NAME
+      display_name: "Test Project for Branch purge_on_delete"
+      pg_version: 16
+
+  postgres_branches:
+    hard_delete:
+      parent: ${resources.postgres_projects.my_project.id}
+      branch_id: test-pg-branch-hard-$UNIQUE_NAME
+      no_expiry: true
+      purge_on_delete: true
+
+    soft_delete:
+      parent: ${resources.postgres_projects.my_project.id}
+      branch_id: test-pg-branch-soft-$UNIQUE_NAME
+      no_expiry: true
diff --git a/acceptance/bundle/resources/postgres_branches/purge_on_delete/out.destroy.txt b/acceptance/bundle/resources/postgres_branches/purge_on_delete/out.destroy.txt
new file mode 100644
index 00000000000..1f456f888a5
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/purge_on_delete/out.destroy.txt
@@ -0,0 +1,17 @@
+The following resources will be deleted:
+  delete resources.postgres_branches.hard_delete
+  delete resources.postgres_branches.soft_delete
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase branches.
+All data stored in them will be permanently lost:
+  delete resources.postgres_branches.hard_delete
+  delete resources.postgres_branches.soft_delete
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-branch-purge-[UNIQUE_NAME]/default
+
+Destroy: 3 deleted
diff --git a/acceptance/bundle/resources/postgres_branches/purge_on_delete/out.requests.deploy.json b/acceptance/bundle/resources/postgres_branches/purge_on_delete/out.requests.deploy.json
new file mode 100644
index 00000000000..a2d9b93874c
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/purge_on_delete/out.requests.deploy.json
@@ -0,0 +1,45 @@
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/test-pg-branch-hard-[UNIQUE_NAME]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/test-pg-branch-soft-[UNIQUE_NAME]"
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects",
+  "q": {
+    "project_id": "test-pg-proj-[UNIQUE_NAME]"
+  },
+  "body": {
+    "spec": {
+      "display_name": "Test Project for Branch purge_on_delete",
+      "pg_version": 16
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches",
+  "q": {
+    "branch_id": "test-pg-branch-hard-[UNIQUE_NAME]"
+  },
+  "body": {
+    "spec": {
+      "no_expiry": true
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches",
+  "q": {
+    "branch_id": "test-pg-branch-soft-[UNIQUE_NAME]"
+  },
+  "body": {
+    "spec": {
+      "no_expiry": true
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_branches/purge_on_delete/out.requests.destroy.json b/acceptance/bundle/resources/postgres_branches/purge_on_delete/out.requests.destroy.json
new file mode 100644
index 00000000000..f4296d06190
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/purge_on_delete/out.requests.destroy.json
@@ -0,0 +1,27 @@
+{
+  "method": "DELETE",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
+}
+{
+  "method": "DELETE",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/test-pg-branch-hard-[UNIQUE_NAME]",
+  "q": {
+    "purge": "true"
+  }
+}
+{
+  "method": "DELETE",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/test-pg-branch-soft-[UNIQUE_NAME]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/test-pg-branch-hard-[UNIQUE_NAME]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/test-pg-branch-soft-[UNIQUE_NAME]"
+}
diff --git a/acceptance/bundle/resources/postgres_branches/purge_on_delete/out.test.toml b/acceptance/bundle/resources/postgres_branches/purge_on_delete/out.test.toml
new file mode 100644
index 00000000000..ee153e82621
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/purge_on_delete/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_branches/purge_on_delete/output.txt b/acceptance/bundle/resources/postgres_branches/purge_on_delete/output.txt
new file mode 100644
index 00000000000..b38d10cd744
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/purge_on_delete/output.txt
@@ -0,0 +1,58 @@
+
+>>> [CLI] bundle validate
+Name: deploy-postgres-branch-purge-[UNIQUE_NAME]
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-branch-purge-[UNIQUE_NAME]/default
+
+Validation OK!
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-branch-purge-[UNIQUE_NAME]/default/files...
+Created postgres_branches.hard_delete
+Created postgres_branches.soft_delete
+Created postgres_projects.my_project
+Files: 0 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] postgres get-branch projects/test-pg-proj-[UNIQUE_NAME]/branches/test-pg-branch-hard-[UNIQUE_NAME]
+{
+  "branch_id": "test-pg-branch-hard-[UNIQUE_NAME]",
+  "name": "projects/test-pg-proj-[UNIQUE_NAME]/branches/test-pg-branch-hard-[UNIQUE_NAME]",
+  "parent": "projects/test-pg-proj-[UNIQUE_NAME]",
+  "status": {
+    "branch_id": "test-pg-branch-hard-[UNIQUE_NAME]",
+    "current_state": "READY",
+    "default": false,
+    "is_protected": false,
+    "source_branch": "projects/test-pg-proj-[UNIQUE_NAME]/branches/production",
+    "source_branch_lsn": "[LSN]",
+    "source_branch_time": "[TIMESTAMP]",
+    "state_change_time": "[TIMESTAMP]"
+  },
+  "uid": "[BRANCH_UID]"
+}
+
+>>> [CLI] postgres get-branch projects/test-pg-proj-[UNIQUE_NAME]/branches/test-pg-branch-soft-[UNIQUE_NAME]
+{
+  "branch_id": "test-pg-branch-soft-[UNIQUE_NAME]",
+  "name": "projects/test-pg-proj-[UNIQUE_NAME]/branches/test-pg-branch-soft-[UNIQUE_NAME]",
+  "parent": "projects/test-pg-proj-[UNIQUE_NAME]",
+  "status": {
+    "branch_id": "test-pg-branch-soft-[UNIQUE_NAME]",
+    "current_state": "READY",
+    "default": false,
+    "is_protected": false,
+    "source_branch": "projects/test-pg-proj-[UNIQUE_NAME]/branches/production",
+    "source_branch_lsn": "[LSN]",
+    "source_branch_time": "[TIMESTAMP]",
+    "state_change_time": "[TIMESTAMP]"
+  },
+  "uid": "[BRANCH_UID]"
+}
+
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --sort --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+
+=== bundle destroy
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --sort --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
diff --git a/acceptance/bundle/resources/postgres_branches/purge_on_delete/script b/acceptance/bundle/resources/postgres_branches/purge_on_delete/script
new file mode 100644
index 00000000000..0a0b9b67823
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/purge_on_delete/script
@@ -0,0 +1,35 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+project_name="projects/test-pg-proj-${UNIQUE_NAME}"
+hard_branch="${project_name}/branches/test-pg-branch-hard-${UNIQUE_NAME}"
+soft_branch="${project_name}/branches/test-pg-branch-soft-${UNIQUE_NAME}"
+
+cleanup() {
+   # Belt-and-braces in case bundle destroy was skipped or partially failed.
+   # The soft-delete case leaves a record in the trash; --purge clears it.
+   $CLI postgres delete-branch --purge "${hard_branch}" 2>>LOG.delete-branch || true
+   $CLI postgres delete-branch --purge "${soft_branch}" 2>>LOG.delete-branch || true
+   $CLI postgres delete-project --purge "${project_name}" 2>>LOG.delete-project || true
+   rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+trace $CLI bundle validate
+
+rm -f "$OUT_REQUESTS"
+trace $CLI bundle deploy
+
+trace $CLI postgres get-branch "${hard_branch}" | branch_fields
+trace $CLI postgres get-branch "${soft_branch}" | branch_fields
+
+# Deploy requests are split per-engine: Terraform sends "parent" in the branch
+# create body, the direct engine sends it only as a query parameter.
+trace print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --sort --get '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.deploy.json
+
+# bundle destroy should send ?purge=true on the hard_delete branch and no
+# purge query on the soft_delete branch. Both DELETEs land in the recorded
+# requests so the contrast is visible in the diff.
+title "bundle destroy"
+$CLI bundle destroy --auto-approve > out.destroy.txt 2>&1 || true
+
+trace print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --sort --get '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.destroy.json
diff --git a/acceptance/bundle/resources/postgres_branches/purge_on_delete_transitions/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_branches/purge_on_delete_transitions/databricks.yml.tmpl
new file mode 100644
index 00000000000..a8bc2b191c9
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/purge_on_delete_transitions/databricks.yml.tmpl
@@ -0,0 +1,23 @@
+bundle:
+  name: pg-branch-purge-transitions-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+# Walks purge_on_delete through unset -> true -> false -> unset, deploying
+# at each step and inspecting the persisted state so reviewers can see that
+# state tracks the user's latest intent. The final destroy is a soft delete
+# (state has purge_on_delete unset), recorded for regression coverage.
+resources:
+  postgres_projects:
+    proj:
+      project_id: test-pg-proj-$UNIQUE_NAME
+      display_name: "Transitions test"
+      pg_version: 16
+
+  postgres_branches:
+    branch:
+      parent: ${resources.postgres_projects.proj.id}
+      branch_id: test-pg-branch-$UNIQUE_NAME
+      no_expiry: true
+      # PURGE_ON_DELETE
diff --git a/acceptance/bundle/resources/postgres_branches/purge_on_delete_transitions/out.destroy.txt b/acceptance/bundle/resources/postgres_branches/purge_on_delete_transitions/out.destroy.txt
new file mode 100644
index 00000000000..0d7119fe189
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/purge_on_delete_transitions/out.destroy.txt
@@ -0,0 +1,15 @@
+The following resources will be deleted:
+  delete resources.postgres_branches.branch
+  delete resources.postgres_projects.proj
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.proj
+
+This action will result in the deletion of the following Lakebase branches.
+All data stored in them will be permanently lost:
+  delete resources.postgres_branches.branch
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/pg-branch-purge-transitions-[UNIQUE_NAME]/default
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/postgres_branches/purge_on_delete_transitions/out.requests.destroy.json b/acceptance/bundle/resources/postgres_branches/purge_on_delete_transitions/out.requests.destroy.json
new file mode 100644
index 00000000000..ebefc7fdaa8
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/purge_on_delete_transitions/out.requests.destroy.json
@@ -0,0 +1,16 @@
+{
+  "method": "DELETE",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
+}
+{
+  "method": "DELETE",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/test-pg-branch-[UNIQUE_NAME]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/test-pg-branch-[UNIQUE_NAME]"
+}
diff --git a/acceptance/bundle/resources/postgres_branches/purge_on_delete_transitions/out.test.toml b/acceptance/bundle/resources/postgres_branches/purge_on_delete_transitions/out.test.toml
new file mode 100644
index 00000000000..ee153e82621
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/purge_on_delete_transitions/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_branches/purge_on_delete_transitions/output.txt b/acceptance/bundle/resources/postgres_branches/purge_on_delete_transitions/output.txt
new file mode 100644
index 00000000000..5441f61b43b
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/purge_on_delete_transitions/output.txt
@@ -0,0 +1,44 @@
+
+=== Step 1: deploy with purge_on_delete unset
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/pg-branch-purge-transitions-[UNIQUE_NAME]/default/files...
+Created postgres_branches.branch
+Created postgres_projects.proj
+Files: 0 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> get_purge
+(unset)
+
+=== Step 2: set purge_on_delete: true
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/pg-branch-purge-transitions-[UNIQUE_NAME]/default/files...
+Updated postgres_branches.branch
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 1 unchanged
+
+>>> get_purge
+json.state.resources.postgres_branches.branch.state.purge_on_delete = true;
+
+=== Step 3: flip to purge_on_delete: false
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/pg-branch-purge-transitions-[UNIQUE_NAME]/default/files...
+Updated postgres_branches.branch
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 1 unchanged
+
+>>> get_purge
+json.state.resources.postgres_branches.branch.state.purge_on_delete = false;
+
+=== Step 4: remove the line again
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/pg-branch-purge-transitions-[UNIQUE_NAME]/default/files...
+Updated postgres_branches.branch
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 1 unchanged
+
+>>> get_purge
+(unset)
+
+=== bundle destroy (branch DELETE must be a plain DELETE, no ?purge=true)
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --sort --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
diff --git a/acceptance/bundle/resources/postgres_branches/purge_on_delete_transitions/script b/acceptance/bundle/resources/postgres_branches/purge_on_delete_transitions/script
new file mode 100644
index 00000000000..916f33dc3a9
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/purge_on_delete_transitions/script
@@ -0,0 +1,45 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+project_name="projects/test-pg-proj-${UNIQUE_NAME}"
+branch_name="${project_name}/branches/test-pg-branch-${UNIQUE_NAME}"
+
+cleanup() {
+   # After this test the branch destroy should be a soft delete; --purge here
+   # so the trash entry doesn't linger past the test.
+   $CLI postgres delete-branch --purge "${branch_name}" 2>>LOG.delete-branch || true
+   $CLI postgres delete-project --purge "${project_name}" 2>>LOG.delete-project || true
+   rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+# Prints the persisted purge_on_delete assignment from the direct engine's
+# resources.json. The field is omitted from JSON when unset (omitempty +
+# ForceSendFields tracking), so an absent value falls back to "(unset)".
+get_purge() {
+  print_state.py | gron.py | grep 'postgres_branches.branch.state.purge_on_delete' || echo '(unset)'
+}
+
+title "Step 1: deploy with purge_on_delete unset"
+trace $CLI bundle deploy
+trace get_purge
+
+title "Step 2: set purge_on_delete: true"
+update_file.py databricks.yml "# PURGE_ON_DELETE" "purge_on_delete: true"
+trace $CLI bundle deploy
+trace get_purge
+
+title "Step 3: flip to purge_on_delete: false"
+update_file.py databricks.yml "purge_on_delete: true" "purge_on_delete: false"
+trace $CLI bundle deploy
+trace get_purge
+
+title "Step 4: remove the line again"
+update_file.py databricks.yml "purge_on_delete: false" "# PURGE_ON_DELETE"
+trace $CLI bundle deploy
+trace get_purge
+
+rm -f "$OUT_REQUESTS"
+
+title "bundle destroy (branch DELETE must be a plain DELETE, no ?purge=true)"
+$CLI bundle destroy --auto-approve > out.destroy.txt 2>&1 || true
+trace print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --sort --get '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.destroy.json
diff --git a/acceptance/bundle/resources/postgres_branches/recreate/out.get_branch.txt b/acceptance/bundle/resources/postgres_branches/recreate/out.get_branch.txt
index 46df9881704..cc97e7b3936 100644
--- a/acceptance/bundle/resources/postgres_branches/recreate/out.get_branch.txt
+++ b/acceptance/bundle/resources/postgres_branches/recreate/out.get_branch.txt
@@ -1,7 +1,9 @@
 {
+  "branch_id": "new-branch-[UNIQUE_NAME]",
   "name": "[MAIN_ID_2]",
   "parent": "projects/test-pg-proj-[UNIQUE_NAME]",
   "status": {
+    "branch_id": "new-branch-[UNIQUE_NAME]",
     "current_state": "READY",
     "default": false,
     "is_protected": false,
diff --git a/acceptance/bundle/resources/postgres_branches/recreate/out.requests.create.direct.txt b/acceptance/bundle/resources/postgres_branches/recreate/out.requests.create.direct.txt
deleted file mode 100644
index b9078ba35cd..00000000000
--- a/acceptance/bundle/resources/postgres_branches/recreate/out.requests.create.direct.txt
+++ /dev/null
@@ -1,31 +0,0 @@
-{
-  "body": {
-    "spec": {
-      "default_endpoint_settings": {
-        "autoscaling_limit_max_cu": 4,
-        "autoscaling_limit_min_cu": 0.5,
-        "suspend_timeout_duration": "300s"
-      },
-      "display_name": "Test Project",
-      "history_retention_duration": "604800s",
-      "pg_version": 16
-    }
-  },
-  "method": "POST",
-  "path": "/api/2.0/postgres/projects",
-  "q": {
-    "project_id": "test-pg-proj-[UNIQUE_NAME]"
-  }
-}
-{
-  "body": {
-    "spec": {
-      "no_expiry": true
-    }
-  },
-  "method": "POST",
-  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches",
-  "q": {
-    "branch_id": "old-branch-[UNIQUE_NAME]"
-  }
-}
diff --git a/acceptance/bundle/resources/postgres_branches/recreate/out.requests.create.terraform.txt b/acceptance/bundle/resources/postgres_branches/recreate/out.requests.create.terraform.txt
deleted file mode 100644
index 04d889a8385..00000000000
--- a/acceptance/bundle/resources/postgres_branches/recreate/out.requests.create.terraform.txt
+++ /dev/null
@@ -1,32 +0,0 @@
-{
-  "body": {
-    "spec": {
-      "default_endpoint_settings": {
-        "autoscaling_limit_max_cu": 4,
-        "autoscaling_limit_min_cu": 0.5,
-        "suspend_timeout_duration": "300s"
-      },
-      "display_name": "Test Project",
-      "history_retention_duration": "604800s",
-      "pg_version": 16
-    }
-  },
-  "method": "POST",
-  "path": "/api/2.0/postgres/projects",
-  "q": {
-    "project_id": "test-pg-proj-[UNIQUE_NAME]"
-  }
-}
-{
-  "body": {
-    "parent": "projects/test-pg-proj-[UNIQUE_NAME]",
-    "spec": {
-      "no_expiry": true
-    }
-  },
-  "method": "POST",
-  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches",
-  "q": {
-    "branch_id": "old-branch-[UNIQUE_NAME]"
-  }
-}
diff --git a/acceptance/bundle/resources/postgres_branches/recreate/out.requests.create.txt b/acceptance/bundle/resources/postgres_branches/recreate/out.requests.create.txt
new file mode 100644
index 00000000000..147d02d0355
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/recreate/out.requests.create.txt
@@ -0,0 +1,31 @@
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects",
+  "q": {
+    "project_id": "test-pg-proj-[UNIQUE_NAME]"
+  },
+  "body": {
+    "spec": {
+      "default_endpoint_settings": {
+        "autoscaling_limit_max_cu": 4,
+        "autoscaling_limit_min_cu": 0.5,
+        "suspend_timeout_duration": "300s"
+      },
+      "display_name": "Test Project",
+      "history_retention_duration": "604800s",
+      "pg_version": 16
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches",
+  "q": {
+    "branch_id": "old-branch-[UNIQUE_NAME]"
+  },
+  "body": {
+    "spec": {
+      "no_expiry": true
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_branches/recreate/out.requests.destroy.terraform.txt b/acceptance/bundle/resources/postgres_branches/recreate/out.requests.destroy.terraform.txt
deleted file mode 100644
index 69dc86caf68..00000000000
--- a/acceptance/bundle/resources/postgres_branches/recreate/out.requests.destroy.terraform.txt
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "method": "DELETE",
-  "path": "/api/2.0/postgres/[MAIN_ID_2]"
-}
-{
-  "method": "DELETE",
-  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
-}
diff --git a/acceptance/bundle/resources/postgres_branches/recreate/out.requests.destroy.direct.txt b/acceptance/bundle/resources/postgres_branches/recreate/out.requests.destroy.txt
similarity index 100%
rename from acceptance/bundle/resources/postgres_branches/recreate/out.requests.destroy.direct.txt
rename to acceptance/bundle/resources/postgres_branches/recreate/out.requests.destroy.txt
diff --git a/acceptance/bundle/resources/postgres_branches/recreate/out.requests.update.direct.txt b/acceptance/bundle/resources/postgres_branches/recreate/out.requests.update.direct.txt
deleted file mode 100644
index 9c8f1eefca3..00000000000
--- a/acceptance/bundle/resources/postgres_branches/recreate/out.requests.update.direct.txt
+++ /dev/null
@@ -1,16 +0,0 @@
-{
-  "method": "DELETE",
-  "path": "/api/2.0/postgres/[MAIN_ID]"
-}
-{
-  "body": {
-    "spec": {
-      "no_expiry": true
-    }
-  },
-  "method": "POST",
-  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches",
-  "q": {
-    "branch_id": "new-branch-[UNIQUE_NAME]"
-  }
-}
diff --git a/acceptance/bundle/resources/postgres_branches/recreate/out.requests.update.terraform.txt b/acceptance/bundle/resources/postgres_branches/recreate/out.requests.update.terraform.txt
deleted file mode 100644
index 3dbd3b1e286..00000000000
--- a/acceptance/bundle/resources/postgres_branches/recreate/out.requests.update.terraform.txt
+++ /dev/null
@@ -1,17 +0,0 @@
-{
-  "method": "DELETE",
-  "path": "/api/2.0/postgres/[MAIN_ID]"
-}
-{
-  "body": {
-    "parent": "projects/test-pg-proj-[UNIQUE_NAME]",
-    "spec": {
-      "no_expiry": true
-    }
-  },
-  "method": "POST",
-  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches",
-  "q": {
-    "branch_id": "new-branch-[UNIQUE_NAME]"
-  }
-}
diff --git a/acceptance/bundle/resources/postgres_branches/recreate/out.requests.update.txt b/acceptance/bundle/resources/postgres_branches/recreate/out.requests.update.txt
new file mode 100644
index 00000000000..2982e29445d
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/recreate/out.requests.update.txt
@@ -0,0 +1,16 @@
+{
+  "method": "DELETE",
+  "path": "/api/2.0/postgres/[MAIN_ID]"
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches",
+  "q": {
+    "branch_id": "new-branch-[UNIQUE_NAME]"
+  },
+  "body": {
+    "spec": {
+      "no_expiry": true
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_branches/recreate/out.test.toml b/acceptance/bundle/resources/postgres_branches/recreate/out.test.toml
index 110f841fa05..ee153e82621 100644
--- a/acceptance/bundle/resources/postgres_branches/recreate/out.test.toml
+++ b/acceptance/bundle/resources/postgres_branches/recreate/out.test.toml
@@ -1,6 +1,4 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
 CloudEnvs.azure = false
 CloudEnvs.gcp = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_branches/recreate/output.txt b/acceptance/bundle/resources/postgres_branches/recreate/output.txt
index bcc1528946b..78cf8d611dc 100644
--- a/acceptance/bundle/resources/postgres_branches/recreate/output.txt
+++ b/acceptance/bundle/resources/postgres_branches/recreate/output.txt
@@ -32,9 +32,10 @@ Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-branch-recreate-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created postgres_branches.main
+Created postgres_projects.my_project
+Files: 0 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 === Change branch_id (should trigger recreation in direct, update in terraform)
 >>> cat databricks.yml
@@ -68,9 +69,9 @@ Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-br
 This action will result in the deletion or recreation of the following Lakebase branches.
 All data stored in them will be permanently lost:
   recreate resources.postgres_branches.main
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Recreated postgres_branches.main
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 1 unchanged
 
 === Fetch new branch ID
 === Destroy and verify cleanup
@@ -89,8 +90,7 @@ All data stored in them will be permanently lost:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-branch-recreate-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 2 deleted
 
 >>> [CLI] bundle destroy --auto-approve
 No active deployment found to destroy!
diff --git a/acceptance/bundle/resources/postgres_branches/recreate/script b/acceptance/bundle/resources/postgres_branches/recreate/script
index f81650b2e77..d1d00d8f284 100755
--- a/acceptance/bundle/resources/postgres_branches/recreate/script
+++ b/acceptance/bundle/resources/postgres_branches/recreate/script
@@ -6,7 +6,7 @@ cleanup() {
    # Also try to delete the old branch directly in case it wasn't cleaned up
    $CLI postgres delete-branch "projects/test-pg-proj-${UNIQUE_NAME}/branches/old-branch-${UNIQUE_NAME}" 2>/dev/null || true
 
-   rm -f out.requests.txt
+   rm -f "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
@@ -16,18 +16,12 @@ envsubst < databricks.yml.tmpl | sed "s/BRANCH_ID_PLACEHOLDER/old-branch-${UNIQU
 trace cat databricks.yml
 
 trace $CLI bundle plan
-rm -f out.requests.txt
+rm -f "$OUT_REQUESTS"
 trace $CLI bundle deploy
 
 branch_id_1=`read_id.py main`
 
-print_requests() {
-    local name=$1
-    jq --sort-keys 'select(.method != "GET" and (.path | contains("/postgres")))' < out.requests.txt > out.requests.${name}.$DATABRICKS_BUNDLE_ENGINE.txt
-    rm -f out.requests.txt
-}
-
-print_requests create
+print_requests.py --del-body parent,project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.create.txt
 
 title "Change branch_id (should trigger recreation in direct, update in terraform)"
 sed "s/old-branch-${UNIQUE_NAME}/new-branch-${UNIQUE_NAME}/" databricks.yml > databricks.yml.new
@@ -39,17 +33,17 @@ trace cat databricks.yml
 $CLI bundle plan > out.plan.txt 2>&1
 trace $CLI bundle deploy --auto-approve
 
-print_requests update
+print_requests.py --del-body parent,project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.update.txt
 
 title "Fetch new branch ID"
 branch_id_2=`read_id.py main`
 # Get output differs between engines (different branch IDs)
-$CLI postgres get-branch $branch_id_2 | jq 'del(.create_time, .update_time, .status.logical_size_bytes)' > out.get_branch.txt
+$CLI postgres get-branch $branch_id_2 | branch_fields > out.get_branch.txt
 
 title "Destroy and verify cleanup"
 trace $CLI bundle destroy --auto-approve
 
-print_requests destroy
+print_requests.py --del-body parent,project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.destroy.txt
 
 # Clean up any orphaned old branch (terraform doesn't delete it on recreation)
 $CLI postgres delete-branch $branch_id_1 2>/dev/null || true
diff --git a/acceptance/bundle/resources/postgres_branches/recreate/test.toml b/acceptance/bundle/resources/postgres_branches/recreate/test.toml
index ea1db177791..76d7c84608e 100644
--- a/acceptance/bundle/resources/postgres_branches/recreate/test.toml
+++ b/acceptance/bundle/resources/postgres_branches/recreate/test.toml
@@ -1,5 +1,5 @@
 [[Repls]]
-# Normalize TraceId in error messages (run before default NUMID replacement at Order 9-10)
+# Normalize TraceId in error messages
 Old = 'TraceId: [a-f0-9]+'
 New = 'TraceId: [TRACE_ID]'
 Order = 1
diff --git a/acceptance/bundle/resources/postgres_branches/recreate_source_branch_time/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_branches/recreate_source_branch_time/databricks.yml.tmpl
new file mode 100644
index 00000000000..eb618dfb9e8
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/recreate_source_branch_time/databricks.yml.tmpl
@@ -0,0 +1,20 @@
+bundle:
+  name: recreate-postgres-branch-fork-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-$UNIQUE_NAME
+      display_name: "Test Project for Branch Fork Point"
+      pg_version: 16
+
+  postgres_branches:
+    dev_branch:
+      parent: ${resources.postgres_projects.my_project.id}
+      branch_id: dev-branch
+      no_expiry: true
+      source_branch: ${resources.postgres_projects.my_project.id}/branches/production
+      source_branch_time: "2026-01-01T00:00:00Z"
diff --git a/acceptance/bundle/resources/postgres_branches/recreate_source_branch_time/out.plan.json b/acceptance/bundle/resources/postgres_branches/recreate_source_branch_time/out.plan.json
new file mode 100644
index 00000000000..b3ad19c1b68
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/recreate_source_branch_time/out.plan.json
@@ -0,0 +1,23 @@
+{
+  "action": "recreate",
+  "changes": {
+    "no_expiry": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": true,
+      "new": true
+    },
+    "source_branch": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": "projects/test-pg-proj-[UNIQUE_NAME]/branches/production",
+      "new": "projects/test-pg-proj-[UNIQUE_NAME]/branches/production"
+    },
+    "source_branch_time": {
+      "action": "recreate",
+      "reason": "spec:immutable",
+      "old": "[FORK_TIME_BEFORE]",
+      "new": "[FORK_TIME_AFTER]"
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_branches/recreate_source_branch_time/out.requests.json b/acceptance/bundle/resources/postgres_branches/recreate_source_branch_time/out.requests.json
new file mode 100644
index 00000000000..453d1483684
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/recreate_source_branch_time/out.requests.json
@@ -0,0 +1,18 @@
+{
+  "method": "DELETE",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/dev-branch"
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches",
+  "q": {
+    "branch_id": "dev-branch"
+  },
+  "body": {
+    "spec": {
+      "no_expiry": true,
+      "source_branch": "projects/test-pg-proj-[UNIQUE_NAME]/branches/production",
+      "source_branch_time": "[FORK_TIME_AFTER]"
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_branches/recreate_source_branch_time/out.test.toml b/acceptance/bundle/resources/postgres_branches/recreate_source_branch_time/out.test.toml
new file mode 100644
index 00000000000..0faf51e59a4
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/recreate_source_branch_time/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = false
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_branches/recreate_source_branch_time/output.txt b/acceptance/bundle/resources/postgres_branches/recreate_source_branch_time/output.txt
new file mode 100644
index 00000000000..76b348aa3fc
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/recreate_source_branch_time/output.txt
@@ -0,0 +1,47 @@
+
+=== Initial deployment
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/recreate-postgres-branch-fork-[UNIQUE_NAME]/default/files...
+Created postgres_branches.dev_branch
+Created postgres_projects.my_project
+Files: 0 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Change the fork point: source_branch_time is immutable, so this recreates
+>>> update_file.py databricks.yml [FORK_TIME_BEFORE] [FORK_TIME_AFTER]
+
+>>> [CLI] bundle plan
+recreate postgres_branches.dev_branch
+
+Plan: 1 to add, 0 to change, 1 to delete, 1 unchanged
+
+>>> [CLI] bundle plan -o json
+
+>>> [CLI] bundle deploy --auto-approve
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/recreate-postgres-branch-fork-[UNIQUE_NAME]/default/files...
+
+This action will result in the deletion or recreation of the following Lakebase branches.
+All data stored in them will be permanently lost:
+  recreate resources.postgres_branches.dev_branch
+Recreated postgres_branches.dev_branch
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 1 unchanged
+
+>>> print_requests.py --del-body project_id,branch_id --sort //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.postgres_branches.dev_branch
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase branches.
+All data stored in them will be permanently lost:
+  delete resources.postgres_branches.dev_branch
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/recreate-postgres-branch-fork-[UNIQUE_NAME]/default
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/postgres_branches/recreate_source_branch_time/script b/acceptance/bundle/resources/postgres_branches/recreate_source_branch_time/script
new file mode 100644
index 00000000000..77aa4e0319b
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/recreate_source_branch_time/script
@@ -0,0 +1,19 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+   trace $CLI bundle destroy --auto-approve
+   rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+title "Initial deployment"
+trace $CLI bundle deploy
+rm -f "$OUT_REQUESTS"
+
+title "Change the fork point: source_branch_time is immutable, so this recreates"
+trace update_file.py databricks.yml "2026-01-01T00:00:00Z" "2026-02-01T00:00:00Z"
+trace $CLI bundle plan
+trace $CLI bundle plan -o json | nostamp | jq '.plan."resources.postgres_branches.dev_branch" | {action, changes}' > out.plan.json
+rm -f "$OUT_REQUESTS"
+trace $CLI bundle deploy --auto-approve
+trace print_requests.py --del-body project_id,branch_id --sort '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.json
diff --git a/acceptance/bundle/resources/postgres_branches/recreate_source_branch_time/test.toml b/acceptance/bundle/resources/postgres_branches/recreate_source_branch_time/test.toml
new file mode 100644
index 00000000000..d7e5a1aad54
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/recreate_source_branch_time/test.toml
@@ -0,0 +1,18 @@
+# Distinct from the other duration/timestamp tests: source_branch_time is
+# immutable, so a change recreates the branch rather than updating it. Before the
+# diffing fix the change was invisible and the branch was silently left on its old
+# fork point.
+#
+# Local only: the fork point has to be a real instant in the source branch's
+# history, so the literal timestamps here are not valid against a live workspace.
+Cloud = false
+
+[[Repls]]
+Old = '2026-01-01T00:00:00Z'
+New = '[FORK_TIME_BEFORE]'
+Order = 1
+
+[[Repls]]
+Old = '2026-02-01T00:00:00Z'
+New = '[FORK_TIME_AFTER]'
+Order = 1
diff --git a/acceptance/bundle/resources/postgres_branches/replace_existing/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_branches/replace_existing/databricks.yml.tmpl
new file mode 100644
index 00000000000..d55c43cb741
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/replace_existing/databricks.yml.tmpl
@@ -0,0 +1,24 @@
+bundle:
+  name: deploy-postgres-replace-branch-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-$UNIQUE_NAME
+      display_name: "Replace existing branch test"
+      pg_version: 16
+      history_retention_duration: "604800s"
+
+  # Take over the implicitly-created production branch with replace_existing
+  # and apply a non-default spec (no_expiry: true). The field is input-only
+  # and not surfaced in get-branch, but it is visible in the recorded
+  # request body so the diff confirms it was sent.
+  postgres_branches:
+    production:
+      parent: ${resources.postgres_projects.my_project.id}
+      branch_id: production
+      replace_existing: true
+      no_expiry: true
diff --git a/acceptance/bundle/resources/postgres_branches/replace_existing/out.destroy.txt b/acceptance/bundle/resources/postgres_branches/replace_existing/out.destroy.txt
new file mode 100644
index 00000000000..100e0a9a4b6
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/replace_existing/out.destroy.txt
@@ -0,0 +1,15 @@
+The following resources will be deleted:
+  delete resources.postgres_branches.production
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase branches.
+All data stored in them will be permanently lost:
+  delete resources.postgres_branches.production
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-replace-branch-[UNIQUE_NAME]/default
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/postgres_branches/replace_existing/out.requests.deploy.json b/acceptance/bundle/resources/postgres_branches/replace_existing/out.requests.deploy.json
new file mode 100644
index 00000000000..781311e084c
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/replace_existing/out.requests.deploy.json
@@ -0,0 +1,31 @@
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects",
+  "q": {
+    "project_id": "test-pg-proj-[UNIQUE_NAME]"
+  },
+  "body": {
+    "spec": {
+      "display_name": "Replace existing branch test",
+      "history_retention_duration": "604800s",
+      "pg_version": 16
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches",
+  "q": {
+    "branch_id": "production",
+    "replace_existing": "true"
+  },
+  "body": {
+    "spec": {
+      "no_expiry": true
+    }
+  }
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/production"
+}
diff --git a/acceptance/bundle/resources/postgres_branches/replace_existing/out.requests.destroy.json b/acceptance/bundle/resources/postgres_branches/replace_existing/out.requests.destroy.json
new file mode 100644
index 00000000000..1ddf631fc65
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/replace_existing/out.requests.destroy.json
@@ -0,0 +1,47 @@
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects",
+  "q": {
+    "project_id": "test-pg-proj-[UNIQUE_NAME]"
+  },
+  "body": {
+    "spec": {
+      "display_name": "Replace existing branch test",
+      "history_retention_duration": "604800s",
+      "pg_version": 16
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches",
+  "q": {
+    "branch_id": "production",
+    "replace_existing": "true"
+  },
+  "body": {
+    "spec": {
+      "no_expiry": true
+    }
+  }
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/production"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/production"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
+}
+{
+  "method": "DELETE",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/production"
+}
+{
+  "method": "DELETE",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
+}
diff --git a/acceptance/bundle/resources/postgres_branches/replace_existing/out.test.toml b/acceptance/bundle/resources/postgres_branches/replace_existing/out.test.toml
new file mode 100644
index 00000000000..ee153e82621
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/replace_existing/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_branches/replace_existing/output.txt b/acceptance/bundle/resources/postgres_branches/replace_existing/output.txt
new file mode 100644
index 00000000000..5f8d6a0823f
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/replace_existing/output.txt
@@ -0,0 +1,36 @@
+
+>>> [CLI] bundle validate
+Name: deploy-postgres-replace-branch-[UNIQUE_NAME]
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-replace-branch-[UNIQUE_NAME]/default
+
+Validation OK!
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-replace-branch-[UNIQUE_NAME]/default/files...
+Created postgres_branches.production
+Created postgres_projects.my_project
+Files: 0 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] postgres get-branch projects/test-pg-proj-[UNIQUE_NAME]/branches/production
+{
+  "branch_id": "production",
+  "name": "projects/test-pg-proj-[UNIQUE_NAME]/branches/production",
+  "parent": "projects/test-pg-proj-[UNIQUE_NAME]",
+  "status": {
+    "branch_id": "production",
+    "current_state": "READY",
+    "default": true,
+    "is_protected": false,
+    "state_change_time": "[TIMESTAMP]"
+  },
+  "uid": "[BRANCH_UID]"
+}
+
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+
+=== bundle destroy
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
diff --git a/acceptance/bundle/resources/postgres_branches/replace_existing/script b/acceptance/bundle/resources/postgres_branches/replace_existing/script
new file mode 100644
index 00000000000..e6e017e634e
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/replace_existing/script
@@ -0,0 +1,28 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+   # Belt-and-braces in case bundle destroy was skipped or partially failed.
+   $CLI postgres delete-project "projects/test-pg-proj-${UNIQUE_NAME}" 2>/dev/null || true
+   rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+trace $CLI bundle validate
+
+rm -f "$OUT_REQUESTS"
+trace $CLI bundle deploy
+
+# Confirm the implicit production branch is now under management.
+trace $CLI postgres get-branch "projects/test-pg-proj-${UNIQUE_NAME}/branches/production" | branch_fields
+
+trace print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.deploy.json
+
+# bundle destroy: the backend rejects independent deletion of the root
+# branch with a MANAGED_BY_PARENT marker; both engines disregard that
+# error and let the project delete cascade-clean the branch. Per-engine
+# output is captured so regressions in either engine's destroy flow show
+# up in the diff.
+title "bundle destroy"
+$CLI bundle destroy --auto-approve > out.destroy.txt 2>&1 || true
+
+trace print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.destroy.json
diff --git a/acceptance/bundle/resources/postgres_branches/script.prepare b/acceptance/bundle/resources/postgres_branches/script.prepare
new file mode 100644
index 00000000000..1eec1e9cb93
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/script.prepare
@@ -0,0 +1,10 @@
+# branch_fields is the allow-list of branch fields the acceptance tests assert
+# on. Anything the backend returns outside this list is dropped, so a new field
+# in the API response does not break the golden.
+#
+# The source_* provenance fields are present on branches forked from another
+# branch but absent on the default branch, so the null-drop keeps the projection
+# valid for both shapes.
+branch_fields() {
+    jq '{branch_id, name, parent, status: (.status | {branch_id, current_state, default, expire_time, is_protected, source_branch, source_branch_lsn, source_branch_time, state_change_time} | with_entries(select(.value != null))), uid}'
+}
diff --git a/acceptance/bundle/resources/postgres_branches/test.toml b/acceptance/bundle/resources/postgres_branches/test.toml
index 9a4d447f994..0f0b05f5fc6 100644
--- a/acceptance/bundle/resources/postgres_branches/test.toml
+++ b/acceptance/bundle/resources/postgres_branches/test.toml
@@ -1,13 +1,10 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
 
 # Lakebase v2 (postgres) is only available in AWS as of January 2026
 CloudEnvs.gcp = false
 CloudEnvs.azure = false
 
 # Run on both direct and Terraform modes
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
 
 Ignore = [
     "databricks.yml",
@@ -15,8 +12,8 @@ Ignore = [
 ]
 
 [[Repls]]
-# Clean up ?o=<num> suffix after URL since not all workspaces have that
-Old = '\?o=\[(NUMID|ALPHANUMID)\]'
+# Clean up ?[ow]=<num> suffix after URL since not all workspaces have that
+Old = '\?[ow]=\[(WORKSPACE_ID|ALPHANUMID)\]'
 New = ''
 Order = 1000
 
diff --git a/acceptance/bundle/resources/postgres_branches/update_expire_time/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_branches/update_expire_time/databricks.yml.tmpl
new file mode 100644
index 00000000000..7063e0c8683
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/update_expire_time/databricks.yml.tmpl
@@ -0,0 +1,18 @@
+bundle:
+  name: update-postgres-branch-expire-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-$UNIQUE_NAME
+      display_name: "Test Project for Branch Expire Update"
+      pg_version: 16
+
+  postgres_branches:
+    dev_branch:
+      parent: ${resources.postgres_projects.my_project.id}
+      branch_id: dev-branch
+      expire_time: "2030-01-01T00:00:00Z"
diff --git a/acceptance/bundle/resources/postgres_branches/update_expire_time/out.plan.json b/acceptance/bundle/resources/postgres_branches/update_expire_time/out.plan.json
new file mode 100644
index 00000000000..bfab97ba09a
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/update_expire_time/out.plan.json
@@ -0,0 +1,10 @@
+{
+  "action": "update",
+  "changes": {
+    "expire_time": {
+      "action": "update",
+      "old": "[EXPIRE_TIME_BEFORE]",
+      "new": "[EXPIRE_TIME_AFTER]"
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_branches/update_expire_time/out.requests.json b/acceptance/bundle/resources/postgres_branches/update_expire_time/out.requests.json
new file mode 100644
index 00000000000..4d9bc1cbd89
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/update_expire_time/out.requests.json
@@ -0,0 +1,12 @@
+{
+  "method": "PATCH",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/dev-branch",
+  "q": {
+    "update_mask": "spec.expiration"
+  },
+  "body": {
+    "spec": {
+      "expire_time": "[EXPIRE_TIME_AFTER]"
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_branches/update_expire_time/out.test.toml b/acceptance/bundle/resources/postgres_branches/update_expire_time/out.test.toml
new file mode 100644
index 00000000000..0faf51e59a4
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/update_expire_time/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = false
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_branches/update_expire_time/output.txt b/acceptance/bundle/resources/postgres_branches/update_expire_time/output.txt
new file mode 100644
index 00000000000..a87b943addc
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/update_expire_time/output.txt
@@ -0,0 +1,81 @@
+
+=== Initial deployment
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-postgres-branch-expire-[UNIQUE_NAME]/default/files...
+Created postgres_branches.dev_branch
+Created postgres_projects.my_project
+Files: 0 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] postgres get-branch projects/test-pg-proj-[UNIQUE_NAME]/branches/dev-branch
+{
+  "branch_id": "dev-branch",
+  "name": "projects/test-pg-proj-[UNIQUE_NAME]/branches/dev-branch",
+  "parent": "projects/test-pg-proj-[UNIQUE_NAME]",
+  "status": {
+    "branch_id": "dev-branch",
+    "current_state": "READY",
+    "default": false,
+    "expire_time": "[EXPIRE_TIME_BEFORE]",
+    "is_protected": false,
+    "source_branch": "projects/test-pg-proj-[UNIQUE_NAME]/branches/production",
+    "source_branch_lsn": "[LSN]",
+    "source_branch_time": "[TIMESTAMP]",
+    "state_change_time": "[TIMESTAMP]"
+  },
+  "uid": "[BRANCH_UID]"
+}
+
+=== Change expire_time and re-deploy
+>>> update_file.py databricks.yml [EXPIRE_TIME_BEFORE] [EXPIRE_TIME_AFTER]
+
+>>> [CLI] bundle plan
+update postgres_branches.dev_branch
+
+Plan: 0 to add, 1 to change, 0 to delete, 1 unchanged
+
+>>> [CLI] bundle plan -o json
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-postgres-branch-expire-[UNIQUE_NAME]/default/files...
+Updated postgres_branches.dev_branch
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 1 unchanged
+
+>>> print_requests.py --del-body project_id,branch_id --sort //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+
+>>> [CLI] postgres get-branch projects/test-pg-proj-[UNIQUE_NAME]/branches/dev-branch
+{
+  "branch_id": "dev-branch",
+  "name": "projects/test-pg-proj-[UNIQUE_NAME]/branches/dev-branch",
+  "parent": "projects/test-pg-proj-[UNIQUE_NAME]",
+  "status": {
+    "branch_id": "dev-branch",
+    "current_state": "READY",
+    "default": false,
+    "expire_time": "[EXPIRE_TIME_AFTER]",
+    "is_protected": false,
+    "source_branch": "projects/test-pg-proj-[UNIQUE_NAME]/branches/production",
+    "source_branch_lsn": "[LSN]",
+    "source_branch_time": "[TIMESTAMP]",
+    "state_change_time": "[TIMESTAMP]"
+  },
+  "uid": "[BRANCH_UID]"
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.postgres_branches.dev_branch
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase branches.
+All data stored in them will be permanently lost:
+  delete resources.postgres_branches.dev_branch
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/update-postgres-branch-expire-[UNIQUE_NAME]/default
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/postgres_branches/update_expire_time/script b/acceptance/bundle/resources/postgres_branches/update_expire_time/script
new file mode 100644
index 00000000000..efca002df59
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/update_expire_time/script
@@ -0,0 +1,26 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+   trace $CLI bundle destroy --auto-approve
+   rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+branch_name="projects/test-pg-proj-${UNIQUE_NAME}/branches/dev-branch"
+
+title "Initial deployment"
+trace $CLI bundle deploy
+rm -f "$OUT_REQUESTS"
+trace $CLI postgres get-branch "${branch_name}" | branch_fields
+
+title "Change expire_time and re-deploy"
+trace update_file.py databricks.yml "2030-01-01T00:00:00Z" "2031-06-15T12:00:00Z"
+
+# Only terraform applies it: expire_time is a member of the
+# expiration oneof, and the direct engine masks it under its own name. See test.toml.
+trace $CLI bundle plan
+trace $CLI bundle plan -o json | nostamp | jq '.plan."resources.postgres_branches.dev_branch" | {action, changes}' > out.plan.json
+rm -f "$OUT_REQUESTS"
+trace $CLI bundle deploy
+trace print_requests.py --del-body project_id,branch_id --sort '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.json
+trace $CLI postgres get-branch "${branch_name}" | branch_fields
diff --git a/acceptance/bundle/resources/postgres_branches/update_expire_time/test.toml b/acceptance/bundle/resources/postgres_branches/update_expire_time/test.toml
new file mode 100644
index 00000000000..b9330252d52
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/update_expire_time/test.toml
@@ -0,0 +1,24 @@
+# expire_time, ttl and no_expiry are three sides of one oneof, and the API accepts them
+# in update_mask only under the group name spec.expiration. Both engines apply the change;
+# out.requests.direct.json records the group mask the direct engine now sends.
+
+
+# Local only: a real workspace caps how far ahead a branch may expire and answers
+# these literal timestamps with 400 "expiration time exceeds the maximum
+# expiration time", so the branch is never created. A timestamp near enough to now
+# to be accepted would have to be computed per run, and the API normalizes what it
+# echoes back, so the golden could not assert the value. update_ttl covers the same
+# expiration oneof on cloud without that constraint.
+Cloud = false
+
+# The root test.toml collapses every timestamp to [TIMESTAMP], which would hide
+# the change under test.
+[[Repls]]
+Old = '2030-01-01T00:00:00Z'
+New = '[EXPIRE_TIME_BEFORE]'
+Order = 1
+
+[[Repls]]
+Old = '2031-06-15T12:00:00Z'
+New = '[EXPIRE_TIME_AFTER]'
+Order = 1
diff --git a/acceptance/bundle/resources/postgres_branches/update_protected/out.plan.create.direct.json b/acceptance/bundle/resources/postgres_branches/update_protected/out.plan.create.json
similarity index 100%
rename from acceptance/bundle/resources/postgres_branches/update_protected/out.plan.create.direct.json
rename to acceptance/bundle/resources/postgres_branches/update_protected/out.plan.create.json
diff --git a/acceptance/bundle/resources/postgres_branches/update_protected/out.plan.create.terraform.json b/acceptance/bundle/resources/postgres_branches/update_protected/out.plan.create.terraform.json
deleted file mode 100644
index b4425b9687c..00000000000
--- a/acceptance/bundle/resources/postgres_branches/update_protected/out.plan.create.terraform.json
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-  "action": "create"
-}
diff --git a/acceptance/bundle/resources/postgres_branches/update_protected/out.plan.no_change.direct.json b/acceptance/bundle/resources/postgres_branches/update_protected/out.plan.no_change.direct.json
deleted file mode 100644
index 32120ec36ed..00000000000
--- a/acceptance/bundle/resources/postgres_branches/update_protected/out.plan.no_change.direct.json
+++ /dev/null
@@ -1,39 +0,0 @@
-{
-  "depends_on": [
-    {
-      "node": "resources.postgres_projects.my_project",
-      "label": "${resources.postgres_projects.my_project.id}"
-    }
-  ],
-  "action": "skip",
-  "remote_state": {
-    "create_time": "[TIMESTAMP]",
-    "name": "[DEV_BRANCH_ID]",
-    "parent": "projects/test-pg-proj-[UNIQUE_NAME]",
-    "status": {
-      "current_state": "READY",
-      "default": false,
-      "is_protected": false,
-      "source_branch": "projects/test-pg-proj-[UNIQUE_NAME]/branches/production",
-      "source_branch_lsn": "[LSN]",
-      "source_branch_time": "[TIMESTAMP]",
-      "state_change_time": "[TIMESTAMP]"
-    },
-    "uid": "[BRANCH_UID]",
-    "update_time": "[TIMESTAMP]"
-  },
-  "changes": {
-    "is_protected": {
-      "action": "skip",
-      "reason": "empty",
-      "old": false,
-      "new": false
-    },
-    "no_expiry": {
-      "action": "skip",
-      "reason": "spec:input_only",
-      "old": true,
-      "new": true
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/postgres_branches/update_protected/out.plan.no_change.json b/acceptance/bundle/resources/postgres_branches/update_protected/out.plan.no_change.json
new file mode 100644
index 00000000000..ff7df005d4e
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/update_protected/out.plan.no_change.json
@@ -0,0 +1,41 @@
+{
+  "depends_on": [
+    {
+      "node": "resources.postgres_projects.my_project",
+      "label": "${resources.postgres_projects.my_project.id}"
+    }
+  ],
+  "action": "skip",
+  "remote_state": {
+    "branch_id": "dev-branch",
+    "create_time": "[TIMESTAMP]",
+    "name": "[DEV_BRANCH_ID]",
+    "parent": "projects/test-pg-proj-[UNIQUE_NAME]",
+    "status": {
+      "branch_id": "dev-branch",
+      "current_state": "READY",
+      "default": false,
+      "is_protected": false,
+      "source_branch": "projects/test-pg-proj-[UNIQUE_NAME]/branches/production",
+      "source_branch_lsn": "[LSN]",
+      "source_branch_time": "[TIMESTAMP]",
+      "state_change_time": "[TIMESTAMP]"
+    },
+    "uid": "[BRANCH_UID]",
+    "update_time": "[TIMESTAMP]"
+  },
+  "changes": {
+    "is_protected": {
+      "action": "skip",
+      "reason": "empty",
+      "old": false,
+      "new": false
+    },
+    "no_expiry": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": true,
+      "new": true
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_branches/update_protected/out.plan.no_change.terraform.json b/acceptance/bundle/resources/postgres_branches/update_protected/out.plan.no_change.terraform.json
deleted file mode 100644
index b2f23a5015f..00000000000
--- a/acceptance/bundle/resources/postgres_branches/update_protected/out.plan.no_change.terraform.json
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-  "action": "skip"
-}
diff --git a/acceptance/bundle/resources/postgres_branches/update_protected/out.plan.restore.direct.json b/acceptance/bundle/resources/postgres_branches/update_protected/out.plan.restore.direct.json
deleted file mode 100644
index 110fb1aea0f..00000000000
--- a/acceptance/bundle/resources/postgres_branches/update_protected/out.plan.restore.direct.json
+++ /dev/null
@@ -1,46 +0,0 @@
-{
-  "depends_on": [
-    {
-      "node": "resources.postgres_projects.my_project",
-      "label": "${resources.postgres_projects.my_project.id}"
-    }
-  ],
-  "action": "update",
-  "new_state": {
-    "value": {
-      "branch_id": "dev-branch",
-      "is_protected": false,
-      "no_expiry": true,
-      "parent": "projects/test-pg-proj-[UNIQUE_NAME]"
-    }
-  },
-  "remote_state": {
-    "create_time": "[TIMESTAMP]",
-    "name": "[DEV_BRANCH_ID]",
-    "parent": "projects/test-pg-proj-[UNIQUE_NAME]",
-    "status": {
-      "current_state": "READY",
-      "default": false,
-      "is_protected": true,
-      "source_branch": "projects/test-pg-proj-[UNIQUE_NAME]/branches/production",
-      "source_branch_lsn": "[LSN]",
-      "source_branch_time": "[TIMESTAMP]",
-      "state_change_time": "[TIMESTAMP]"
-    },
-    "uid": "[BRANCH_UID]",
-    "update_time": "[TIMESTAMP]"
-  },
-  "changes": {
-    "is_protected": {
-      "action": "update",
-      "old": true,
-      "new": false
-    },
-    "no_expiry": {
-      "action": "skip",
-      "reason": "spec:input_only",
-      "old": true,
-      "new": true
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/postgres_branches/update_protected/out.plan.restore.json b/acceptance/bundle/resources/postgres_branches/update_protected/out.plan.restore.json
new file mode 100644
index 00000000000..64acdc88a68
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/update_protected/out.plan.restore.json
@@ -0,0 +1,48 @@
+{
+  "depends_on": [
+    {
+      "node": "resources.postgres_projects.my_project",
+      "label": "${resources.postgres_projects.my_project.id}"
+    }
+  ],
+  "action": "update",
+  "new_state": {
+    "value": {
+      "branch_id": "dev-branch",
+      "is_protected": false,
+      "no_expiry": true,
+      "parent": "projects/test-pg-proj-[UNIQUE_NAME]"
+    }
+  },
+  "remote_state": {
+    "branch_id": "dev-branch",
+    "create_time": "[TIMESTAMP]",
+    "name": "[DEV_BRANCH_ID]",
+    "parent": "projects/test-pg-proj-[UNIQUE_NAME]",
+    "status": {
+      "branch_id": "dev-branch",
+      "current_state": "READY",
+      "default": false,
+      "is_protected": true,
+      "source_branch": "projects/test-pg-proj-[UNIQUE_NAME]/branches/production",
+      "source_branch_lsn": "[LSN]",
+      "source_branch_time": "[TIMESTAMP]",
+      "state_change_time": "[TIMESTAMP]"
+    },
+    "uid": "[BRANCH_UID]",
+    "update_time": "[TIMESTAMP]"
+  },
+  "changes": {
+    "is_protected": {
+      "action": "update",
+      "old": true,
+      "new": false
+    },
+    "no_expiry": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": true,
+      "new": true
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_branches/update_protected/out.plan.restore.terraform.json b/acceptance/bundle/resources/postgres_branches/update_protected/out.plan.restore.terraform.json
deleted file mode 100644
index 375b496fef0..00000000000
--- a/acceptance/bundle/resources/postgres_branches/update_protected/out.plan.restore.terraform.json
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-  "action": "update"
-}
diff --git a/acceptance/bundle/resources/postgres_branches/update_protected/out.plan.update.direct.json b/acceptance/bundle/resources/postgres_branches/update_protected/out.plan.update.direct.json
deleted file mode 100644
index 58169e75a32..00000000000
--- a/acceptance/bundle/resources/postgres_branches/update_protected/out.plan.update.direct.json
+++ /dev/null
@@ -1,46 +0,0 @@
-{
-  "depends_on": [
-    {
-      "node": "resources.postgres_projects.my_project",
-      "label": "${resources.postgres_projects.my_project.id}"
-    }
-  ],
-  "action": "update",
-  "new_state": {
-    "value": {
-      "branch_id": "dev-branch",
-      "is_protected": true,
-      "no_expiry": true,
-      "parent": "projects/test-pg-proj-[UNIQUE_NAME]"
-    }
-  },
-  "remote_state": {
-    "create_time": "[TIMESTAMP]",
-    "name": "[DEV_BRANCH_ID]",
-    "parent": "projects/test-pg-proj-[UNIQUE_NAME]",
-    "status": {
-      "current_state": "READY",
-      "default": false,
-      "is_protected": false,
-      "source_branch": "projects/test-pg-proj-[UNIQUE_NAME]/branches/production",
-      "source_branch_lsn": "[LSN]",
-      "source_branch_time": "[TIMESTAMP]",
-      "state_change_time": "[TIMESTAMP]"
-    },
-    "uid": "[BRANCH_UID]",
-    "update_time": "[TIMESTAMP]"
-  },
-  "changes": {
-    "is_protected": {
-      "action": "update",
-      "old": false,
-      "new": true
-    },
-    "no_expiry": {
-      "action": "skip",
-      "reason": "spec:input_only",
-      "old": true,
-      "new": true
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/postgres_branches/update_protected/out.plan.update.json b/acceptance/bundle/resources/postgres_branches/update_protected/out.plan.update.json
new file mode 100644
index 00000000000..6cc645dede6
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/update_protected/out.plan.update.json
@@ -0,0 +1,48 @@
+{
+  "depends_on": [
+    {
+      "node": "resources.postgres_projects.my_project",
+      "label": "${resources.postgres_projects.my_project.id}"
+    }
+  ],
+  "action": "update",
+  "new_state": {
+    "value": {
+      "branch_id": "dev-branch",
+      "is_protected": true,
+      "no_expiry": true,
+      "parent": "projects/test-pg-proj-[UNIQUE_NAME]"
+    }
+  },
+  "remote_state": {
+    "branch_id": "dev-branch",
+    "create_time": "[TIMESTAMP]",
+    "name": "[DEV_BRANCH_ID]",
+    "parent": "projects/test-pg-proj-[UNIQUE_NAME]",
+    "status": {
+      "branch_id": "dev-branch",
+      "current_state": "READY",
+      "default": false,
+      "is_protected": false,
+      "source_branch": "projects/test-pg-proj-[UNIQUE_NAME]/branches/production",
+      "source_branch_lsn": "[LSN]",
+      "source_branch_time": "[TIMESTAMP]",
+      "state_change_time": "[TIMESTAMP]"
+    },
+    "uid": "[BRANCH_UID]",
+    "update_time": "[TIMESTAMP]"
+  },
+  "changes": {
+    "is_protected": {
+      "action": "update",
+      "old": false,
+      "new": true
+    },
+    "no_expiry": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": true,
+      "new": true
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_branches/update_protected/out.plan.update.terraform.json b/acceptance/bundle/resources/postgres_branches/update_protected/out.plan.update.terraform.json
deleted file mode 100644
index 375b496fef0..00000000000
--- a/acceptance/bundle/resources/postgres_branches/update_protected/out.plan.update.terraform.json
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-  "action": "update"
-}
diff --git a/acceptance/bundle/resources/postgres_branches/update_protected/out.requests.create.direct.json b/acceptance/bundle/resources/postgres_branches/update_protected/out.requests.create.json
similarity index 100%
rename from acceptance/bundle/resources/postgres_branches/update_protected/out.requests.create.direct.json
rename to acceptance/bundle/resources/postgres_branches/update_protected/out.requests.create.json
diff --git a/acceptance/bundle/resources/postgres_branches/update_protected/out.requests.create.terraform.json b/acceptance/bundle/resources/postgres_branches/update_protected/out.requests.create.terraform.json
deleted file mode 100644
index 26aee6e3936..00000000000
--- a/acceptance/bundle/resources/postgres_branches/update_protected/out.requests.create.terraform.json
+++ /dev/null
@@ -1,33 +0,0 @@
-{
-  "method": "POST",
-  "path": "/api/2.0/postgres/projects",
-  "q": {
-    "project_id": "test-pg-proj-[UNIQUE_NAME]"
-  },
-  "body": {
-    "spec": {
-      "default_endpoint_settings": {
-        "autoscaling_limit_max_cu": 4,
-        "autoscaling_limit_min_cu": 0.5,
-        "suspend_timeout_duration": "300s"
-      },
-      "display_name": "Test Project for Branch Update",
-      "history_retention_duration": "604800s",
-      "pg_version": 16
-    }
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches",
-  "q": {
-    "branch_id": "dev-branch"
-  },
-  "body": {
-    "parent": "projects/test-pg-proj-[UNIQUE_NAME]",
-    "spec": {
-      "is_protected": false,
-      "no_expiry": true
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/postgres_branches/update_protected/out.requests.no_change.direct.json b/acceptance/bundle/resources/postgres_branches/update_protected/out.requests.no_change.json
similarity index 100%
rename from acceptance/bundle/resources/postgres_branches/update_protected/out.requests.no_change.direct.json
rename to acceptance/bundle/resources/postgres_branches/update_protected/out.requests.no_change.json
diff --git a/acceptance/bundle/resources/postgres_branches/update_protected/out.requests.no_change.terraform.json b/acceptance/bundle/resources/postgres_branches/update_protected/out.requests.no_change.terraform.json
deleted file mode 100644
index 23a3ae77747..00000000000
--- a/acceptance/bundle/resources/postgres_branches/update_protected/out.requests.no_change.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "method": "GET",
-  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
-}
-{
-  "method": "GET",
-  "path": "/api/2.0/postgres/[DEV_BRANCH_ID]"
-}
diff --git a/acceptance/bundle/resources/postgres_branches/update_protected/out.requests.restore.direct.json b/acceptance/bundle/resources/postgres_branches/update_protected/out.requests.restore.json
similarity index 100%
rename from acceptance/bundle/resources/postgres_branches/update_protected/out.requests.restore.direct.json
rename to acceptance/bundle/resources/postgres_branches/update_protected/out.requests.restore.json
diff --git a/acceptance/bundle/resources/postgres_branches/update_protected/out.requests.restore.terraform.json b/acceptance/bundle/resources/postgres_branches/update_protected/out.requests.restore.terraform.json
deleted file mode 100644
index 14a6068d6b3..00000000000
--- a/acceptance/bundle/resources/postgres_branches/update_protected/out.requests.restore.terraform.json
+++ /dev/null
@@ -1,23 +0,0 @@
-{
-  "method": "GET",
-  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
-}
-{
-  "method": "GET",
-  "path": "/api/2.0/postgres/[DEV_BRANCH_ID]"
-}
-{
-  "method": "PATCH",
-  "path": "/api/2.0/postgres/[DEV_BRANCH_ID]",
-  "q": {
-    "update_mask": "spec"
-  },
-  "body": {
-    "name": "[DEV_BRANCH_ID]",
-    "parent": "projects/test-pg-proj-[UNIQUE_NAME]",
-    "spec": {
-      "is_protected": false,
-      "no_expiry": true
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/postgres_branches/update_protected/out.requests.update.direct.json b/acceptance/bundle/resources/postgres_branches/update_protected/out.requests.update.json
similarity index 100%
rename from acceptance/bundle/resources/postgres_branches/update_protected/out.requests.update.direct.json
rename to acceptance/bundle/resources/postgres_branches/update_protected/out.requests.update.json
diff --git a/acceptance/bundle/resources/postgres_branches/update_protected/out.requests.update.terraform.json b/acceptance/bundle/resources/postgres_branches/update_protected/out.requests.update.terraform.json
deleted file mode 100644
index 1fbae288953..00000000000
--- a/acceptance/bundle/resources/postgres_branches/update_protected/out.requests.update.terraform.json
+++ /dev/null
@@ -1,23 +0,0 @@
-{
-  "method": "GET",
-  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
-}
-{
-  "method": "GET",
-  "path": "/api/2.0/postgres/[DEV_BRANCH_ID]"
-}
-{
-  "method": "PATCH",
-  "path": "/api/2.0/postgres/[DEV_BRANCH_ID]",
-  "q": {
-    "update_mask": "spec"
-  },
-  "body": {
-    "name": "[DEV_BRANCH_ID]",
-    "parent": "projects/test-pg-proj-[UNIQUE_NAME]",
-    "spec": {
-      "is_protected": true,
-      "no_expiry": true
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/postgres_branches/update_protected/out.test.toml b/acceptance/bundle/resources/postgres_branches/update_protected/out.test.toml
index 110f841fa05..ee153e82621 100644
--- a/acceptance/bundle/resources/postgres_branches/update_protected/out.test.toml
+++ b/acceptance/bundle/resources/postgres_branches/update_protected/out.test.toml
@@ -1,6 +1,4 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
 CloudEnvs.azure = false
 CloudEnvs.gcp = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_branches/update_protected/output.txt b/acceptance/bundle/resources/postgres_branches/update_protected/output.txt
index 7380da0adce..1a2eadd2c68 100644
--- a/acceptance/bundle/resources/postgres_branches/update_protected/output.txt
+++ b/acceptance/bundle/resources/postgres_branches/update_protected/output.txt
@@ -19,17 +19,20 @@ Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-postgres-branch-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created postgres_branches.dev_branch
+Created postgres_projects.my_project
+Files: 0 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
->>> print_requests.py --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
 
 >>> [CLI] postgres get-branch [DEV_BRANCH_ID]
 {
+  "branch_id": "dev-branch",
   "name": "[DEV_BRANCH_ID]",
   "parent": "projects/test-pg-proj-[UNIQUE_NAME]",
   "status": {
+    "branch_id": "dev-branch",
     "current_state": "READY",
     "default": false,
     "is_protected": false,
@@ -49,11 +52,10 @@ Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-postgres-branch-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 2 unchanged
 
->>> print_requests.py --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
 
 === Update is_protected to true and re-deploy
 >>> update_file.py databricks.yml is_protected: false is_protected: true
@@ -93,17 +95,19 @@ Plan: 0 to add, 1 to change, 0 to delete, 1 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-postgres-branch-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated postgres_branches.dev_branch
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 1 unchanged
 
->>> print_requests.py --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
 
 >>> [CLI] postgres get-branch [DEV_BRANCH_ID]
 {
+  "branch_id": "dev-branch",
   "name": "[DEV_BRANCH_ID]",
   "parent": "projects/test-pg-proj-[UNIQUE_NAME]",
   "status": {
+    "branch_id": "dev-branch",
     "current_state": "READY",
     "default": false,
     "is_protected": true,
@@ -127,17 +131,19 @@ Plan: 0 to add, 1 to change, 0 to delete, 1 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-postgres-branch-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated postgres_branches.dev_branch
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 1 unchanged
 
->>> print_requests.py --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
 
 >>> [CLI] postgres get-branch [DEV_BRANCH_ID]
 {
+  "branch_id": "dev-branch",
   "name": "[DEV_BRANCH_ID]",
   "parent": "projects/test-pg-proj-[UNIQUE_NAME]",
   "status": {
+    "branch_id": "dev-branch",
     "current_state": "READY",
     "default": false,
     "is_protected": false,
@@ -164,5 +170,4 @@ All data stored in them will be permanently lost:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/update-postgres-branch-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/postgres_branches/update_protected/script b/acceptance/bundle/resources/postgres_branches/update_protected/script
index cbdec19a6ca..a773aef576b 100755
--- a/acceptance/bundle/resources/postgres_branches/update_protected/script
+++ b/acceptance/bundle/resources/postgres_branches/update_protected/script
@@ -2,21 +2,21 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
    trace $CLI bundle destroy --auto-approve
-   rm -f out.requests.txt
+   rm -f "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
 print_requests() {
     local name=$1
-    trace print_requests.py --keep --get '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.${name}.$DATABRICKS_BUNDLE_ENGINE.json
-    rm -f out.requests.txt
+    trace print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.${name}.json
+    rm -f "$OUT_REQUESTS"
 }
 
 title "Initial deployment"
 trace $CLI bundle validate
 trace $CLI bundle plan
-trace $CLI bundle plan -o json | jq '.plan."resources.postgres_branches.dev_branch" // .' > out.plan.create.$DATABRICKS_BUNDLE_ENGINE.json
-rm -f out.requests.txt
+trace $CLI bundle plan -o json | nostamp | jq '.plan."resources.postgres_branches.dev_branch" // .' > out.plan.create.json
+rm -f "$OUT_REQUESTS"
 trace $CLI bundle deploy
 
 print_requests create
@@ -24,12 +24,12 @@ print_requests create
 project_name="projects/test-pg-proj-${UNIQUE_NAME}"
 branch_name="${project_name}/branches/dev-branch"
 branch_id_1=`read_id.py dev_branch`
-trace $CLI postgres get-branch "${branch_name}" | jq 'del(.create_time, .update_time, .status.logical_size_bytes)'
+trace $CLI postgres get-branch "${branch_name}" | branch_fields
 
 title "Verify no_change (no changes)"
 trace $CLI bundle plan
-trace $CLI bundle plan -o json | jq '(.plan."resources.postgres_branches.dev_branch" // .) | del(.remote_state.status.logical_size_bytes)' > out.plan.no_change.$DATABRICKS_BUNDLE_ENGINE.json
-rm -f out.requests.txt
+trace $CLI bundle plan -o json | nostamp | jq '(.plan."resources.postgres_branches.dev_branch" // .) | del(.remote_state.status.logical_size_bytes)' > out.plan.no_change.json
+rm -f "$OUT_REQUESTS"
 trace $CLI bundle deploy
 
 print_requests no_change
@@ -39,22 +39,22 @@ trace update_file.py databricks.yml "is_protected: false" "is_protected: true"
 trace cat databricks.yml
 
 trace $CLI bundle plan
-trace $CLI bundle plan -o json | jq '(.plan."resources.postgres_branches.dev_branch" // .) | del(.remote_state.status.logical_size_bytes)' > out.plan.update.$DATABRICKS_BUNDLE_ENGINE.json
-rm -f out.requests.txt
+trace $CLI bundle plan -o json | nostamp | jq '(.plan."resources.postgres_branches.dev_branch" // .) | del(.remote_state.status.logical_size_bytes)' > out.plan.update.json
+rm -f "$OUT_REQUESTS"
 trace $CLI bundle deploy
 
 print_requests update
 
 branch_id_2=`read_id.py dev_branch`
-trace $CLI postgres get-branch "${branch_name}" | jq 'del(.create_time, .update_time, .status.logical_size_bytes)'
+trace $CLI postgres get-branch "${branch_name}" | branch_fields
 
 title "Restore is_protected to false"
 trace update_file.py databricks.yml "is_protected: true" "is_protected: false"
 trace $CLI bundle plan
-trace $CLI bundle plan -o json | jq '(.plan."resources.postgres_branches.dev_branch" // .) | del(.remote_state.status.logical_size_bytes)' > out.plan.restore.$DATABRICKS_BUNDLE_ENGINE.json
-rm -f out.requests.txt
+trace $CLI bundle plan -o json | nostamp | jq '(.plan."resources.postgres_branches.dev_branch" // .) | del(.remote_state.status.logical_size_bytes)' > out.plan.restore.json
+rm -f "$OUT_REQUESTS"
 trace $CLI bundle deploy
 
 print_requests restore
 
-trace $CLI postgres get-branch "${branch_name}" | jq 'del(.create_time, .update_time, .status.logical_size_bytes)'
+trace $CLI postgres get-branch "${branch_name}" | branch_fields
diff --git a/acceptance/bundle/resources/postgres_branches/update_protected/test.toml b/acceptance/bundle/resources/postgres_branches/update_protected/test.toml
deleted file mode 100644
index f8b3bbe49dd..00000000000
--- a/acceptance/bundle/resources/postgres_branches/update_protected/test.toml
+++ /dev/null
@@ -1 +0,0 @@
-# All configuration inherited from parent test.toml
diff --git a/acceptance/bundle/resources/postgres_branches/update_ttl/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_branches/update_ttl/databricks.yml.tmpl
new file mode 100644
index 00000000000..f4e066b87a8
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/update_ttl/databricks.yml.tmpl
@@ -0,0 +1,18 @@
+bundle:
+  name: update-postgres-branch-ttl-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-$UNIQUE_NAME
+      display_name: "Test Project for Branch TTL Update"
+      pg_version: 16
+
+  postgres_branches:
+    dev_branch:
+      parent: ${resources.postgres_projects.my_project.id}
+      branch_id: dev-branch
+      ttl: 604800s
diff --git a/acceptance/bundle/resources/postgres_branches/update_ttl/out.plan.json b/acceptance/bundle/resources/postgres_branches/update_ttl/out.plan.json
new file mode 100644
index 00000000000..adac047f0ce
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/update_ttl/out.plan.json
@@ -0,0 +1,10 @@
+{
+  "action": "update",
+  "changes": {
+    "ttl": {
+      "action": "update",
+      "old": "604800s",
+      "new": "259200s"
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_branches/update_ttl/out.requests.json b/acceptance/bundle/resources/postgres_branches/update_ttl/out.requests.json
new file mode 100644
index 00000000000..433fadb089e
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/update_ttl/out.requests.json
@@ -0,0 +1,12 @@
+{
+  "method": "PATCH",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/dev-branch",
+  "q": {
+    "update_mask": "spec.expiration"
+  },
+  "body": {
+    "spec": {
+      "ttl": "259200s"
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_branches/update_ttl/out.test.toml b/acceptance/bundle/resources/postgres_branches/update_ttl/out.test.toml
new file mode 100644
index 00000000000..ee153e82621
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/update_ttl/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_branches/update_ttl/output.txt b/acceptance/bundle/resources/postgres_branches/update_ttl/output.txt
new file mode 100644
index 00000000000..a0f75d30074
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/update_ttl/output.txt
@@ -0,0 +1,43 @@
+
+=== Initial deployment
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-postgres-branch-ttl-[UNIQUE_NAME]/default/files...
+Created postgres_branches.dev_branch
+Created postgres_projects.my_project
+Files: 0 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Change ttl and re-deploy
+>>> update_file.py databricks.yml ttl: 604800s ttl: 259200s
+
+>>> [CLI] bundle plan
+update postgres_branches.dev_branch
+
+Plan: 0 to add, 1 to change, 0 to delete, 1 unchanged
+
+>>> [CLI] bundle plan -o json
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-postgres-branch-ttl-[UNIQUE_NAME]/default/files...
+Updated postgres_branches.dev_branch
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 1 unchanged
+
+>>> print_requests.py --del-body project_id,branch_id --sort //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.postgres_branches.dev_branch
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase branches.
+All data stored in them will be permanently lost:
+  delete resources.postgres_branches.dev_branch
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/update-postgres-branch-ttl-[UNIQUE_NAME]/default
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/postgres_branches/update_ttl/script b/acceptance/bundle/resources/postgres_branches/update_ttl/script
new file mode 100644
index 00000000000..b73330e31c9
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/update_ttl/script
@@ -0,0 +1,30 @@
+# ttl, expire_time and no_expiry are three sides of one oneof, and the API accepts them in
+# update_mask only under the group name spec.expiration. This is the cloud-covered case of
+# that oneof; update_expire_time is local only.
+
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+   trace $CLI bundle destroy --auto-approve
+   rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+title "Initial deployment"
+trace $CLI bundle deploy
+rm -f "$OUT_REQUESTS"
+
+title "Change ttl and re-deploy"
+trace update_file.py databricks.yml "ttl: 604800s" "ttl: 259200s"
+
+# Only terraform applies it: ttl is a member of the
+# expiration oneof, and the direct engine masks it under its own name.
+#
+# There is no read-back assertion: the API derives expire_time from
+# creation_time + ttl and never echoes ttl, which the testserver does not model.
+# The update_mask each engine sends is what this test is about.
+trace $CLI bundle plan
+trace $CLI bundle plan -o json | nostamp | jq '.plan."resources.postgres_branches.dev_branch" | {action, changes}' > out.plan.json
+rm -f "$OUT_REQUESTS"
+trace $CLI bundle deploy
+trace print_requests.py --del-body project_id,branch_id --sort '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.json
diff --git a/acceptance/bundle/resources/postgres_branches/without_branch_id/out.deploy.direct.txt b/acceptance/bundle/resources/postgres_branches/without_branch_id/out.deploy.direct.txt
deleted file mode 100644
index 44e75d1da0d..00000000000
--- a/acceptance/bundle/resources/postgres_branches/without_branch_id/out.deploy.direct.txt
+++ /dev/null
@@ -1,14 +0,0 @@
-Warning: required field "branch_id" is not set
-  at resources.postgres_branches.main
-  in databricks.yml:21:7
-
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-branch-no-id-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Error: cannot create resources.postgres_branches.main: Field 'branch_id' is required, expected non-default value (not "")! (400 INVALID_PARAMETER_VALUE)
-
-Endpoint: POST [DATABRICKS_URL]/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches
-HTTP Status: 400 Bad Request
-API error_code: INVALID_PARAMETER_VALUE
-API message: Field 'branch_id' is required, expected non-default value (not "")!
-
-Updating deployment state...
diff --git a/acceptance/bundle/resources/postgres_branches/without_branch_id/out.deploy.terraform.txt b/acceptance/bundle/resources/postgres_branches/without_branch_id/out.deploy.terraform.txt
deleted file mode 100644
index 661a2b02862..00000000000
--- a/acceptance/bundle/resources/postgres_branches/without_branch_id/out.deploy.terraform.txt
+++ /dev/null
@@ -1,15 +0,0 @@
-Warning: required field "branch_id" is not set
-  at resources.postgres_branches.main
-  in databricks.yml:21:7
-
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-branch-no-id-[UNIQUE_NAME]/default/files...
-Error: exit status 1
-
-Error: Missing required argument
-
-  on bundle.tf.json line 20, in resource.databricks_postgres_branch.main:
-  20:       }
-
-The argument "branch_id" is required, but no definition was found.
-
-
diff --git a/acceptance/bundle/resources/postgres_branches/without_branch_id/out.deploy.txt b/acceptance/bundle/resources/postgres_branches/without_branch_id/out.deploy.txt
new file mode 100644
index 00000000000..3118fd0daea
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_branches/without_branch_id/out.deploy.txt
@@ -0,0 +1,14 @@
+Warning: required field "branch_id" is not set
+  at resources.postgres_branches.main
+  in databricks.yml:21:7
+
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-branch-no-id-[UNIQUE_NAME]/default/files...
+Created postgres_projects.my_project
+Error: cannot create resources.postgres_branches.main: Field 'branch_id' is required, expected non-default value (not "")! (400 INVALID_PARAMETER_VALUE)
+
+Endpoint: POST [DATABRICKS_URL]/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches
+HTTP Status: 400 Bad Request
+API error_code: INVALID_PARAMETER_VALUE
+API message: Field 'branch_id' is required, expected non-default value (not "")!
+
+Files: 0 uploaded, 0 deleted
diff --git a/acceptance/bundle/resources/postgres_branches/without_branch_id/out.test.toml b/acceptance/bundle/resources/postgres_branches/without_branch_id/out.test.toml
index 110f841fa05..ee153e82621 100644
--- a/acceptance/bundle/resources/postgres_branches/without_branch_id/out.test.toml
+++ b/acceptance/bundle/resources/postgres_branches/without_branch_id/out.test.toml
@@ -1,6 +1,4 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
 CloudEnvs.azure = false
 CloudEnvs.gcp = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_branches/without_branch_id/script b/acceptance/bundle/resources/postgres_branches/without_branch_id/script
index 519a143b445..e72ccca30aa 100755
--- a/acceptance/bundle/resources/postgres_branches/without_branch_id/script
+++ b/acceptance/bundle/resources/postgres_branches/without_branch_id/script
@@ -2,11 +2,10 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
    $CLI bundle destroy --auto-approve > /dev/null 2>&1 || true
-   rm -f out.requests.txt
 }
 trap cleanup EXIT
 
 trace $CLI bundle validate
 
 # Deploy output differs between engines, so capture to per-engine file only
-$CLI bundle deploy > out.deploy.$DATABRICKS_BUNDLE_ENGINE.txt 2>&1 || true
+$CLI bundle deploy > out.deploy.txt 2>&1 || true
diff --git a/acceptance/bundle/resources/postgres_branches/without_branch_id/test.toml b/acceptance/bundle/resources/postgres_branches/without_branch_id/test.toml
index f8b3bbe49dd..a030353d571 100644
--- a/acceptance/bundle/resources/postgres_branches/without_branch_id/test.toml
+++ b/acceptance/bundle/resources/postgres_branches/without_branch_id/test.toml
@@ -1 +1 @@
-# All configuration inherited from parent test.toml
+RecordRequests = false
diff --git a/acceptance/bundle/resources/postgres_catalogs/basic/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_catalogs/basic/databricks.yml.tmpl
new file mode 100644
index 00000000000..b339f4c1354
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_catalogs/basic/databricks.yml.tmpl
@@ -0,0 +1,19 @@
+bundle:
+  name: deploy-postgres-catalog-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-$UNIQUE_NAME
+      display_name: "Test Project for Catalog"
+      pg_version: 16
+
+  postgres_catalogs:
+    my_catalog:
+      catalog_id: lakebase_test_$UNIQUE_NAME
+      branch: ${resources.postgres_projects.my_project.id}/branches/production
+      postgres_database: appdb
+      create_database_if_missing: true
diff --git a/acceptance/bundle/resources/postgres_catalogs/basic/out.requests.json b/acceptance/bundle/resources/postgres_catalogs/basic/out.requests.json
new file mode 100644
index 00000000000..891733f4150
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_catalogs/basic/out.requests.json
@@ -0,0 +1,31 @@
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects",
+  "q": {
+    "project_id": "test-pg-proj-[UNIQUE_NAME]"
+  },
+  "body": {
+    "spec": {
+      "display_name": "Test Project for Catalog",
+      "pg_version": 16
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/catalogs",
+  "q": {
+    "catalog_id": "lakebase_test_[UNIQUE_NAME]"
+  },
+  "body": {
+    "spec": {
+      "branch": "projects/test-pg-proj-[UNIQUE_NAME]/branches/production",
+      "create_database_if_missing": true,
+      "postgres_database": "appdb"
+    }
+  }
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/catalogs/lakebase_test_[UNIQUE_NAME]"
+}
diff --git a/acceptance/bundle/resources/postgres_catalogs/basic/out.test.toml b/acceptance/bundle/resources/postgres_catalogs/basic/out.test.toml
new file mode 100644
index 00000000000..ee153e82621
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_catalogs/basic/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_catalogs/basic/output.txt b/acceptance/bundle/resources/postgres_catalogs/basic/output.txt
new file mode 100644
index 00000000000..dbc8e80e82f
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_catalogs/basic/output.txt
@@ -0,0 +1,72 @@
+
+>>> [CLI] bundle validate
+Name: deploy-postgres-catalog-[UNIQUE_NAME]
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-catalog-[UNIQUE_NAME]/default
+
+Validation OK!
+
+>>> [CLI] bundle summary
+Name: deploy-postgres-catalog-[UNIQUE_NAME]
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-catalog-[UNIQUE_NAME]/default
+Resources:
+  Postgres catalogs:
+    my_catalog:
+      Name: lakebase_test_[UNIQUE_NAME]
+      URL:  [DATABRICKS_URL]/explore/data/lakebase_test_[UNIQUE_NAME]
+  Postgres projects:
+    my_project:
+      Name: Test Project for Catalog
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-catalog-[UNIQUE_NAME]/default/files...
+Created postgres_catalogs.my_catalog
+Created postgres_projects.my_project
+Files: 0 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] postgres get-catalog catalogs/lakebase_test_[UNIQUE_NAME]
+{
+  "catalog_id": "lakebase_test_[UNIQUE_NAME]",
+  "name": "catalogs/lakebase_test_[UNIQUE_NAME]",
+  "status": {
+    "branch": "projects/test-pg-proj-[UNIQUE_NAME]/branches/production",
+    "postgres_database": "appdb",
+    "project": "projects/test-pg-proj-[UNIQUE_NAME]"
+  }
+}
+
+>>> [CLI] bundle summary
+Name: deploy-postgres-catalog-[UNIQUE_NAME]
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-catalog-[UNIQUE_NAME]/default
+Resources:
+  Postgres catalogs:
+    my_catalog:
+      Name: lakebase_test_[UNIQUE_NAME]
+      URL:  [DATABRICKS_URL]/explore/data/lakebase_test_[UNIQUE_NAME]
+  Postgres projects:
+    my_project:
+      Name: Test Project for Catalog
+
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.postgres_catalogs.my_catalog
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.my_project
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-catalog-[UNIQUE_NAME]/default
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/postgres_catalogs/basic/script b/acceptance/bundle/resources/postgres_catalogs/basic/script
new file mode 100644
index 00000000000..1863fcfce53
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_catalogs/basic/script
@@ -0,0 +1,23 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+trace $CLI bundle validate
+
+trace $CLI bundle summary
+
+rm -f "$OUT_REQUESTS"
+trace $CLI bundle deploy
+
+# Get catalog details. Hide volatile fields so cloud and local match.
+catalog_name="catalogs/lakebase_test_${UNIQUE_NAME}"
+trace $CLI postgres get-catalog "${catalog_name}" | catalog_fields
+
+trace $CLI bundle summary
+
+# Filter requests to only show postgres operations (exclude workspace, telemetry, and operation polling).
+trace print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.json
diff --git a/acceptance/bundle/resources/postgres_catalogs/recreate/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_catalogs/recreate/databricks.yml.tmpl
new file mode 100644
index 00000000000..bf3c2b56576
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_catalogs/recreate/databricks.yml.tmpl
@@ -0,0 +1,19 @@
+bundle:
+  name: recreate-postgres-catalog-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-$UNIQUE_NAME
+      display_name: "Test Project for Catalog Recreate"
+      pg_version: 16
+
+  postgres_catalogs:
+    my_catalog:
+      catalog_id: lakebase_test_$UNIQUE_NAME
+      branch: ${resources.postgres_projects.my_project.id}/branches/production
+      postgres_database: $POSTGRES_DATABASE
+      create_database_if_missing: true
diff --git a/acceptance/bundle/resources/postgres_catalogs/recreate/out.test.toml b/acceptance/bundle/resources/postgres_catalogs/recreate/out.test.toml
new file mode 100644
index 00000000000..ee153e82621
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_catalogs/recreate/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_catalogs/recreate/output.txt b/acceptance/bundle/resources/postgres_catalogs/recreate/output.txt
new file mode 100644
index 00000000000..97ce24003be
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_catalogs/recreate/output.txt
@@ -0,0 +1,31 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/recreate-postgres-catalog-[UNIQUE_NAME]/default/files...
+Created postgres_catalogs.my_catalog
+Created postgres_projects.my_project
+Files: 0 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] bundle plan
+recreate postgres_catalogs.my_catalog
+
+Plan: 1 to add, 0 to change, 1 to delete, 1 unchanged
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/recreate-postgres-catalog-[UNIQUE_NAME]/default/files...
+Recreated postgres_catalogs.my_catalog
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 1 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.postgres_catalogs.my_catalog
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.my_project
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/recreate-postgres-catalog-[UNIQUE_NAME]/default
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/postgres_catalogs/recreate/script b/acceptance/bundle/resources/postgres_catalogs/recreate/script
new file mode 100644
index 00000000000..a232dcd9fa4
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_catalogs/recreate/script
@@ -0,0 +1,15 @@
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+export POSTGRES_DATABASE=appdb
+envsubst < databricks.yml.tmpl > databricks.yml
+trace $CLI bundle deploy
+
+# Toggle a recreate-on-change field; plan must show delete + create.
+export POSTGRES_DATABASE=otherdb
+envsubst < databricks.yml.tmpl > databricks.yml
+trace $CLI bundle plan | contains.py "Plan: 1 to add, 0 to change, 1 to delete, 1 unchanged"
+
+trace $CLI bundle deploy
diff --git a/acceptance/bundle/resources/postgres_catalogs/recreate/test.toml b/acceptance/bundle/resources/postgres_catalogs/recreate/test.toml
new file mode 100644
index 00000000000..a030353d571
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_catalogs/recreate/test.toml
@@ -0,0 +1 @@
+RecordRequests = false
diff --git a/acceptance/bundle/resources/postgres_catalogs/script.prepare b/acceptance/bundle/resources/postgres_catalogs/script.prepare
new file mode 100644
index 00000000000..86619233683
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_catalogs/script.prepare
@@ -0,0 +1,6 @@
+# catalog_fields is the allow-list of catalog fields the acceptance tests assert
+# on. Anything the backend returns outside this list is dropped, so a new field
+# in the API response does not break the golden.
+catalog_fields() {
+    jq '{catalog_id, name, status: (.status | {branch, postgres_database, project})}'
+}
diff --git a/acceptance/bundle/resources/postgres_catalogs/test.toml b/acceptance/bundle/resources/postgres_catalogs/test.toml
new file mode 100644
index 00000000000..ee6c20062ab
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_catalogs/test.toml
@@ -0,0 +1,22 @@
+Cloud = true
+
+# Lakebase v2 (postgres) is only available in AWS as of January 2026
+CloudEnvs.gcp = false
+CloudEnvs.azure = false
+
+Ignore = [
+    "databricks.yml",
+    ".databricks",
+]
+
+[[Repls]]
+# Clean up ?[ow]=<num> suffix after URL since not all workspaces have that
+Old = '\?[ow]=\[(WORKSPACE_ID|ALPHANUMID)\]'
+New = ''
+Order = 1000
+
+[[Repls]]
+# Normalize postgres operation IDs (unique per operation).
+Old = '/operations/[A-Za-z0-9+/=-]+'
+New = '/operations/[OPERATION_ID]'
+Order = 2000
diff --git a/acceptance/bundle/resources/postgres_databases/basic/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_databases/basic/databricks.yml.tmpl
new file mode 100644
index 00000000000..72750fed4db
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/basic/databricks.yml.tmpl
@@ -0,0 +1,35 @@
+bundle:
+  name: deploy-postgres-database-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-$UNIQUE_NAME
+      display_name: "Test Project for Database"
+      pg_version: 16
+      history_retention_duration: "604800s"
+
+  postgres_branches:
+    main:
+      parent: ${resources.postgres_projects.my_project.id}
+      branch_id: main
+      no_expiry: true
+
+  postgres_roles:
+    owner:
+      parent: ${resources.postgres_branches.main.id}
+      role_id: app-owner
+      postgres_role: app_owner
+
+  postgres_databases:
+    my_database:
+      parent: ${resources.postgres_branches.main.id}
+      database_id: my-database
+      postgres_database: app_db
+      # The live API requires `role`. Declare an explicit role so the bundle is
+      # portable across users (the auto-created project-owner role's id is
+      # derived from the creator's identity).
+      role: ${resources.postgres_roles.owner.id}
diff --git a/acceptance/bundle/resources/postgres_databases/basic/out.requests.json b/acceptance/bundle/resources/postgres_databases/basic/out.requests.json
new file mode 100644
index 00000000000..54b67db8049
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/basic/out.requests.json
@@ -0,0 +1,55 @@
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects",
+  "q": {
+    "project_id": "test-pg-proj-[UNIQUE_NAME]"
+  },
+  "body": {
+    "spec": {
+      "display_name": "Test Project for Database",
+      "history_retention_duration": "604800s",
+      "pg_version": 16
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches",
+  "q": {
+    "branch_id": "main"
+  },
+  "body": {
+    "spec": {
+      "no_expiry": true
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles",
+  "q": {
+    "role_id": "app-owner"
+  },
+  "body": {
+    "spec": {
+      "postgres_role": "app_owner"
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/databases",
+  "q": {
+    "database_id": "my-database"
+  },
+  "body": {
+    "spec": {
+      "postgres_database": "app_db",
+      "role": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/app-owner"
+    }
+  }
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/databases/my-database"
+}
diff --git a/acceptance/bundle/resources/postgres_databases/basic/out.test.toml b/acceptance/bundle/resources/postgres_databases/basic/out.test.toml
new file mode 100644
index 00000000000..ee153e82621
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/basic/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_databases/basic/output.txt b/acceptance/bundle/resources/postgres_databases/basic/output.txt
new file mode 100644
index 00000000000..be1b2be65a1
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/basic/output.txt
@@ -0,0 +1,95 @@
+
+>>> [CLI] bundle validate
+Name: deploy-postgres-database-[UNIQUE_NAME]
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-database-[UNIQUE_NAME]/default
+
+Validation OK!
+
+>>> [CLI] bundle summary
+Name: deploy-postgres-database-[UNIQUE_NAME]
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-database-[UNIQUE_NAME]/default
+Resources:
+  Postgres branches:
+    main:
+      Name: 
+  Postgres databases:
+    my_database:
+      Name: 
+  Postgres projects:
+    my_project:
+      Name: Test Project for Database
+  Postgres roles:
+    owner:
+      Name: 
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-database-[UNIQUE_NAME]/default/files...
+Created postgres_branches.main
+Created postgres_databases.my_database
+Created postgres_projects.my_project
+Created postgres_roles.owner
+Files: 0 uploaded, 0 deleted
+Resources: 4 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] postgres get-database projects/test-pg-proj-[UNIQUE_NAME]/branches/main/databases/my-database
+{
+  "database_id": "my-database",
+  "name": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main/databases/my-database",
+  "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
+  "status": {
+    "database_id": "my-database",
+    "postgres_database": "app_db",
+    "role": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/app-owner"
+  }
+}
+
+>>> [CLI] bundle summary
+Name: deploy-postgres-database-[UNIQUE_NAME]
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-database-[UNIQUE_NAME]/default
+Resources:
+  Postgres branches:
+    main:
+      Name: projects/test-pg-proj-[UNIQUE_NAME]/branches/main
+  Postgres databases:
+    my_database:
+      Name: projects/test-pg-proj-[UNIQUE_NAME]/branches/main/databases/my-database
+  Postgres projects:
+    my_project:
+      Name: Test Project for Database
+  Postgres roles:
+    owner:
+      Name: projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/app-owner
+
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.postgres_branches.main
+  delete resources.postgres_databases.my_database
+  delete resources.postgres_projects.my_project
+  delete resources.postgres_roles.owner
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase branches.
+All data stored in them will be permanently lost:
+  delete resources.postgres_branches.main
+
+This action will result in the deletion of the following Lakebase databases.
+All data stored in them will be permanently lost:
+  delete resources.postgres_databases.my_database
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-database-[UNIQUE_NAME]/default
+
+Destroy: 4 deleted
diff --git a/acceptance/bundle/resources/postgres_databases/basic/script b/acceptance/bundle/resources/postgres_databases/basic/script
new file mode 100644
index 00000000000..0be4dc9f3db
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/basic/script
@@ -0,0 +1,25 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+   trace $CLI bundle destroy --auto-approve
+   rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+trace $CLI bundle validate
+
+trace $CLI bundle summary
+
+rm -f "$OUT_REQUESTS"
+trace $CLI bundle deploy
+
+# Get database details
+project_name="projects/test-pg-proj-${UNIQUE_NAME}"
+branch_name="${project_name}/branches/main"
+database_name="${branch_name}/databases/my-database"
+trace $CLI postgres get-database "${database_name}" | database_fields
+
+trace $CLI bundle summary
+
+# Filter requests to only show postgres operations (exclude workspace, telemetry, and operation polling)
+trace print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.json
diff --git a/acceptance/bundle/resources/postgres_databases/live_errors/bad_database_id/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_databases/live_errors/bad_database_id/databricks.yml.tmpl
new file mode 100644
index 00000000000..d93f8eab8a7
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/live_errors/bad_database_id/databricks.yml.tmpl
@@ -0,0 +1,33 @@
+bundle:
+  name: bad-database-id-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-$UNIQUE_NAME
+      display_name: "Bad database_id error test"
+      pg_version: 16
+      history_retention_duration: "604800s"
+
+  postgres_branches:
+    main:
+      parent: ${resources.postgres_projects.my_project.id}
+      branch_id: main
+      no_expiry: true
+
+  postgres_roles:
+    owner:
+      parent: ${resources.postgres_branches.main.id}
+      role_id: app-owner
+      postgres_role: app_owner
+
+  postgres_databases:
+    my_database:
+      parent: ${resources.postgres_branches.main.id}
+      # database_id must be lowercase + DNS-safe; this violates RFC 1123.
+      database_id: Invalid_DB_ID
+      postgres_database: app_db
+      role: ${resources.postgres_roles.owner.id}
diff --git a/acceptance/bundle/resources/postgres_databases/live_errors/bad_database_id/out.test.toml b/acceptance/bundle/resources/postgres_databases/live_errors/bad_database_id/out.test.toml
new file mode 100644
index 00000000000..ee153e82621
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/live_errors/bad_database_id/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_databases/live_errors/bad_database_id/output.txt b/acceptance/bundle/resources/postgres_databases/live_errors/bad_database_id/output.txt
new file mode 100644
index 00000000000..7034fd62db6
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/live_errors/bad_database_id/output.txt
@@ -0,0 +1,30 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/bad-database-id-[UNIQUE_NAME]/default/files...
+Created postgres_branches.main
+Created postgres_projects.my_project
+Created postgres_roles.owner
+Error: cannot create resources.postgres_databases.my_database: Field database_id must match pattern ^[a-z]([a-z0-9-]{0,61}[a-z0-9])?$, got 'Invalid_DB_ID'. (400 INVALID_PARAMETER_VALUE)
+
+Endpoint: POST [DATABRICKS_URL]/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/databases?database_id=Invalid_DB_ID
+HTTP Status: 400 Bad Request
+API error_code: INVALID_PARAMETER_VALUE
+API message: Field database_id must match pattern ^[a-z]([a-z0-9-]{0,61}[a-z0-9])?$, got 'Invalid_DB_ID'.
+
+Files: 0 uploaded, 0 deleted
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.postgres_branches.main
+  delete resources.postgres_projects.my_project
+  delete resources.postgres_roles.owner
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase branches.
+All data stored in them will be permanently lost:
+  delete resources.postgres_branches.main
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/bad-database-id-[UNIQUE_NAME]/default
+
+Destroy: 3 deleted
diff --git a/acceptance/bundle/resources/postgres_databases/live_errors/bad_database_id/script b/acceptance/bundle/resources/postgres_databases/live_errors/bad_database_id/script
new file mode 100644
index 00000000000..7315f6f5d37
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/live_errors/bad_database_id/script
@@ -0,0 +1,8 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+   trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+musterr $CLI bundle deploy 2>&1 | contains.py "Field database_id must match pattern"
diff --git a/acceptance/bundle/resources/postgres_databases/live_errors/bad_database_id/test.toml b/acceptance/bundle/resources/postgres_databases/live_errors/bad_database_id/test.toml
new file mode 100644
index 00000000000..68b282e620a
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/live_errors/bad_database_id/test.toml
@@ -0,0 +1,8 @@
+# Stub the database create endpoint to reject a non-pattern database_id,
+# matching the live API behavior observed on aws-prod-ucws 2026-05-19:
+#   400 Bad Request: Field database_id must match pattern
+#     ^[a-z]([a-z0-9-]{0,61}[a-z0-9])?$, got '<value>'.
+[[Server]]
+Pattern = "POST /api/2.0/postgres/projects/{project_id}/branches/{branch_id}/databases"
+Response.StatusCode = 400
+Response.Body = '''{"error_code": "INVALID_PARAMETER_VALUE", "message": "Field database_id must match pattern ^[a-z]([a-z0-9-]{0,61}[a-z0-9])?$, got 'Invalid_DB_ID'."}'''
diff --git a/acceptance/bundle/resources/postgres_databases/live_errors/bad_role_ref/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_databases/live_errors/bad_role_ref/databricks.yml.tmpl
new file mode 100644
index 00000000000..2f096ac7d02
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/live_errors/bad_role_ref/databricks.yml.tmpl
@@ -0,0 +1,28 @@
+bundle:
+  name: bad-role-ref-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-$UNIQUE_NAME
+      display_name: "Bad role-ref error test"
+      pg_version: 16
+      history_retention_duration: "604800s"
+
+  postgres_branches:
+    main:
+      parent: ${resources.postgres_projects.my_project.id}
+      branch_id: main
+      no_expiry: true
+
+  postgres_databases:
+    my_database:
+      parent: ${resources.postgres_branches.main.id}
+      database_id: my-database
+      postgres_database: app_db
+      # The referenced role is never declared anywhere; the live API
+      # rejects database creation with "role not found".
+      role: ${resources.postgres_branches.main.id}/roles/does-not-exist
diff --git a/acceptance/bundle/resources/postgres_databases/live_errors/bad_role_ref/out.test.toml b/acceptance/bundle/resources/postgres_databases/live_errors/bad_role_ref/out.test.toml
new file mode 100644
index 00000000000..ee153e82621
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/live_errors/bad_role_ref/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_databases/live_errors/bad_role_ref/output.txt b/acceptance/bundle/resources/postgres_databases/live_errors/bad_role_ref/output.txt
new file mode 100644
index 00000000000..207518f3b3f
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/live_errors/bad_role_ref/output.txt
@@ -0,0 +1,28 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/bad-role-ref-[UNIQUE_NAME]/default/files...
+Created postgres_branches.main
+Created postgres_projects.my_project
+Error: cannot create resources.postgres_databases.my_database: role not found; role_id:"does-not-exist" [TraceId: [TRACE_ID]] (404 NOT_FOUND)
+
+Endpoint: POST [DATABRICKS_URL]/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/databases?database_id=my-database
+HTTP Status: 404 Not Found
+API error_code: NOT_FOUND
+API message: role not found; role_id:"does-not-exist" [TraceId: [TRACE_ID]]
+
+Files: 0 uploaded, 0 deleted
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.postgres_branches.main
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase branches.
+All data stored in them will be permanently lost:
+  delete resources.postgres_branches.main
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/bad-role-ref-[UNIQUE_NAME]/default
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/postgres_databases/live_errors/bad_role_ref/script b/acceptance/bundle/resources/postgres_databases/live_errors/bad_role_ref/script
new file mode 100644
index 00000000000..0d040869c10
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/live_errors/bad_role_ref/script
@@ -0,0 +1,8 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+   trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+musterr $CLI bundle deploy 2>&1 | contains.py "role not found"
diff --git a/acceptance/bundle/resources/postgres_databases/live_errors/bad_role_ref/test.toml b/acceptance/bundle/resources/postgres_databases/live_errors/bad_role_ref/test.toml
new file mode 100644
index 00000000000..4658193db32
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/live_errors/bad_role_ref/test.toml
@@ -0,0 +1,14 @@
+# Stub the database create endpoint to reject the unknown role reference,
+# matching the live API behavior observed on aws-prod-ucws 2026-05-19:
+#   404 Not Found: role not found; role_id:"<id>" [TraceId: <hex>]
+# The default testserver does not validate that the referenced role exists.
+[[Server]]
+Pattern = "POST /api/2.0/postgres/projects/{project_id}/branches/{branch_id}/databases"
+Response.StatusCode = 404
+Response.Body = '''{"error_code": "NOT_FOUND", "message": "role not found; role_id:\"does-not-exist\" [TraceId: [TRACE_ID]]"}'''
+
+[[Repls]]
+# Cloud responses include a "[TraceId: <hex>]" suffix on this error; normalize.
+Old = '\[TraceId: [a-f0-9]+\]'
+New = '[TraceId: [TRACE_ID]]'
+Order = 5
diff --git a/acceptance/bundle/resources/postgres_databases/live_errors/test.toml b/acceptance/bundle/resources/postgres_databases/live_errors/test.toml
new file mode 100644
index 00000000000..7881987de1f
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/live_errors/test.toml
@@ -0,0 +1,37 @@
+Cloud = true
+
+# Error-path tests only assert via output.txt; recording requests adds noise
+# (and on cloud, flaky timestamps/operation IDs).
+RecordRequests = false
+
+# Lakebase v2 (postgres) is only available in AWS as of January 2026
+CloudEnvs.gcp = false
+CloudEnvs.azure = false
+
+# Error-path tests don't iterate cleanly under terraform: the terraform engine
+# rolls back to its prior state on a partial failure, which makes the recorded
+# output diverge from the direct engine. Run them on direct only; the error
+# surface is the same regardless of engine.
+
+Ignore = [
+    "databricks.yml",
+    ".databricks",
+]
+
+[[Repls]]
+# Clean up ?o=<num> suffix after URL since not all workspaces have that
+Old = '\?o=\[(WORKSPACE_ID|ALPHANUMID)\]'
+New = ''
+Order = 1000
+
+[[Repls]]
+# Normalize branch UIDs (br-xxx-yyy-zzz format)
+Old = 'br-[a-z0-9-]+'
+New = '[BRANCH_UID]'
+Order = 1
+
+[[Repls]]
+# Normalize project UIDs (proj-xxx-yyy-zzz format)
+Old = 'proj-[a-z0-9]+-[a-z0-9]+-[a-z0-9]+-[a-z0-9]'
+New = '[PROJECT_UID]'
+Order = 1
diff --git a/acceptance/bundle/resources/postgres_databases/recreate/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_databases/recreate/databricks.yml.tmpl
new file mode 100644
index 00000000000..a4ce357b68a
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/recreate/databricks.yml.tmpl
@@ -0,0 +1,32 @@
+bundle:
+  name: deploy-postgres-database-recreate-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-$UNIQUE_NAME
+      display_name: "Test Project for Database"
+      pg_version: 16
+      history_retention_duration: "604800s"
+
+  postgres_branches:
+    main:
+      parent: ${resources.postgres_projects.my_project.id}
+      branch_id: main
+      no_expiry: true
+
+  postgres_roles:
+    owner:
+      parent: ${resources.postgres_branches.main.id}
+      role_id: app-owner
+      postgres_role: app_owner
+
+  postgres_databases:
+    my_database:
+      parent: ${resources.postgres_branches.main.id}
+      database_id: DATABASE_ID_PLACEHOLDER
+      postgres_database: app_db
+      role: ${resources.postgres_roles.owner.id}
diff --git a/acceptance/bundle/resources/postgres_databases/recreate/out.test.toml b/acceptance/bundle/resources/postgres_databases/recreate/out.test.toml
new file mode 100644
index 00000000000..ee153e82621
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/recreate/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_databases/recreate/output.txt b/acceptance/bundle/resources/postgres_databases/recreate/output.txt
new file mode 100644
index 00000000000..2619af86a8b
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/recreate/output.txt
@@ -0,0 +1,243 @@
+
+>>> cat databricks.yml
+bundle:
+  name: deploy-postgres-database-recreate-[UNIQUE_NAME]
+
+sync:
+  paths: []
+
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-[UNIQUE_NAME]
+      display_name: "Test Project for Database"
+      pg_version: 16
+      history_retention_duration: "604800s"
+
+  postgres_branches:
+    main:
+      parent: ${resources.postgres_projects.my_project.id}
+      branch_id: main
+      no_expiry: true
+
+  postgres_roles:
+    owner:
+      parent: ${resources.postgres_branches.main.id}
+      role_id: app-owner
+      postgres_role: app_owner
+
+  postgres_databases:
+    my_database:
+      parent: ${resources.postgres_branches.main.id}
+      database_id: test-database-[UNIQUE_NAME]
+      postgres_database: app_db
+      role: ${resources.postgres_roles.owner.id}
+
+>>> [CLI] bundle plan
+create postgres_branches.main
+create postgres_databases.my_database
+create postgres_projects.my_project
+create postgres_roles.owner
+
+Plan: 4 to add, 0 to change, 0 to delete, 0 unchanged
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-database-recreate-[UNIQUE_NAME]/default/files...
+Created postgres_branches.main
+Created postgres_databases.my_database
+Created postgres_projects.my_project
+Created postgres_roles.owner
+Files: 0 uploaded, 0 deleted
+Resources: 4 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py --unique --del-body parent,project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects",
+  "q": {
+    "project_id": "test-pg-proj-[UNIQUE_NAME]"
+  },
+  "body": {
+    "spec": {
+      "display_name": "Test Project for Database",
+      "history_retention_duration": "604800s",
+      "pg_version": 16
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches",
+  "q": {
+    "branch_id": "main"
+  },
+  "body": {
+    "spec": {
+      "no_expiry": true
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles",
+  "q": {
+    "role_id": "app-owner"
+  },
+  "body": {
+    "spec": {
+      "postgres_role": "app_owner"
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/databases",
+  "q": {
+    "database_id": "test-database-[UNIQUE_NAME]"
+  },
+  "body": {
+    "spec": {
+      "postgres_database": "app_db",
+      "role": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/app-owner"
+    }
+  }
+}
+
+>>> cat databricks.yml
+bundle:
+  name: deploy-postgres-database-recreate-[UNIQUE_NAME]
+
+sync:
+  paths: []
+
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-[UNIQUE_NAME]
+      display_name: "Test Project for Database"
+      pg_version: 16
+      history_retention_duration: "604800s"
+
+  postgres_branches:
+    main:
+      parent: ${resources.postgres_projects.my_project.id}
+      branch_id: main
+      no_expiry: true
+
+  postgres_roles:
+    owner:
+      parent: ${resources.postgres_branches.main.id}
+      role_id: app-owner
+      postgres_role: app_owner
+
+  postgres_databases:
+    my_database:
+      parent: ${resources.postgres_branches.main.id}
+      database_id: test-database-[UNIQUE_NAME]-v2
+      postgres_database: app_db
+      role: ${resources.postgres_roles.owner.id}
+
+>>> [CLI] bundle plan
+recreate postgres_databases.my_database
+
+Plan: 1 to add, 0 to change, 1 to delete, 3 unchanged
+
+=== Recreate requires approval: non-interactive deploy must abort, not silently delete the database
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-database-recreate-[UNIQUE_NAME]/default/files...
+
+This action will result in the deletion or recreation of the following Lakebase databases.
+All data stored in them will be permanently lost:
+  recreate resources.postgres_databases.my_database
+Error: the deployment requires destructive actions, but the current console does not support prompting.
+Deleting data assets such as schemas, pipelines, or volumes may cause permanent data loss and should be carefully reviewed.
+To proceed, use --auto-approve after reviewing the plan above.
+
+Files: 0 uploaded, 0 deleted
+
+>>> [CLI] bundle deploy --auto-approve
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-database-recreate-[UNIQUE_NAME]/default/files...
+
+This action will result in the deletion or recreation of the following Lakebase databases.
+All data stored in them will be permanently lost:
+  recreate resources.postgres_databases.my_database
+Recreated postgres_databases.my_database
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 3 unchanged
+
+>>> print_requests.py --unique --del-body parent,project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+{
+  "method": "DELETE",
+  "path": "/api/2.0/postgres/[MY_DATABASE_ID]"
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/databases",
+  "q": {
+    "database_id": "test-database-[UNIQUE_NAME]-v2"
+  },
+  "body": {
+    "spec": {
+      "postgres_database": "app_db",
+      "role": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/app-owner"
+    }
+  }
+}
+
+=== Fetch database and verify it exists after recreation
+>>> [CLI] postgres get-database [MY_DATABASE_ID]-v2
+{
+  "database_id": "test-database-[UNIQUE_NAME]-v2",
+  "name": "[MY_DATABASE_ID]-v2",
+  "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
+  "status": {
+    "database_id": "test-database-[UNIQUE_NAME]-v2",
+    "postgres_database": "app_db",
+    "role": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/app-owner"
+  }
+}
+
+=== Destroy and verify cleanup
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.postgres_branches.main
+  delete resources.postgres_databases.my_database
+  delete resources.postgres_projects.my_project
+  delete resources.postgres_roles.owner
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase branches.
+All data stored in them will be permanently lost:
+  delete resources.postgres_branches.main
+
+This action will result in the deletion of the following Lakebase databases.
+All data stored in them will be permanently lost:
+  delete resources.postgres_databases.my_database
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-database-recreate-[UNIQUE_NAME]/default
+
+Destroy: 4 deleted
+
+>>> print_requests.py --unique --del-body parent,project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+{
+  "method": "DELETE",
+  "path": "/api/2.0/postgres/[MY_DATABASE_ID]-v2"
+}
+{
+  "method": "DELETE",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/app-owner"
+}
+{
+  "method": "DELETE",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main"
+}
+{
+  "method": "DELETE",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
+}
+
+>>> [CLI] bundle destroy --auto-approve
+No active deployment found to destroy!
diff --git a/acceptance/bundle/resources/postgres_databases/recreate/script b/acceptance/bundle/resources/postgres_databases/recreate/script
new file mode 100644
index 00000000000..108ac2f69d1
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/recreate/script
@@ -0,0 +1,49 @@
+# Cleanup function to delete database and other resources
+cleanup() {
+   # Try to delete with current config
+   trace $CLI bundle destroy --auto-approve
+
+   # Also try to delete the databases directly in case they weren't cleaned up
+   $CLI postgres delete-database "projects/test-pg-proj-${UNIQUE_NAME}/branches/main/databases/test-database-${UNIQUE_NAME}" 2>/dev/null || true
+   $CLI postgres delete-database "projects/test-pg-proj-${UNIQUE_NAME}/branches/main/databases/test-database-${UNIQUE_NAME}-v2" 2>/dev/null || true
+
+   rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+# Deploy with first database_id
+envsubst < databricks.yml.tmpl | sed "s/DATABASE_ID_PLACEHOLDER/test-database-${UNIQUE_NAME}/" > databricks.yml
+
+trace cat databricks.yml
+
+trace $CLI bundle plan
+trace $CLI bundle deploy
+
+database_id_1=`read_id.py my_database`
+
+trace print_requests.py --unique --del-body parent,project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/'
+
+# Change database_id (should trigger recreation)
+envsubst < databricks.yml.tmpl | sed "s/DATABASE_ID_PLACEHOLDER/test-database-${UNIQUE_NAME}-v2/" > databricks.yml
+
+trace cat databricks.yml
+
+trace $CLI bundle plan
+
+title "Recreate requires approval: non-interactive deploy must abort, not silently delete the database"
+musterr trace $CLI bundle deploy
+
+trace $CLI bundle deploy --auto-approve
+
+trace print_requests.py --unique --del-body parent,project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/'
+
+title "Fetch database and verify it exists after recreation"
+
+database_id_2=`read_id.py my_database`
+# Verify the database was recreated (DELETE/POST in requests proves recreation)
+trace $CLI postgres get-database $database_id_2 | database_fields
+
+title "Destroy and verify cleanup"
+trace $CLI bundle destroy --auto-approve
+
+trace print_requests.py --unique --del-body parent,project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/'
diff --git a/acceptance/bundle/resources/postgres_databases/replace_existing/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_databases/replace_existing/databricks.yml.tmpl
new file mode 100644
index 00000000000..ae92537fea5
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/replace_existing/databricks.yml.tmpl
@@ -0,0 +1,40 @@
+bundle:
+  name: replace-existing-database-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-$UNIQUE_NAME
+      display_name: "Test Project for Database replace_existing"
+      pg_version: 16
+      history_retention_duration: "604800s"
+
+  postgres_branches:
+    main:
+      parent: ${resources.postgres_projects.my_project.id}
+      branch_id: main
+      no_expiry: true
+
+  postgres_roles:
+    owner:
+      parent: ${resources.postgres_branches.main.id}
+      role_id: app-owner
+      postgres_role: app_owner
+
+  # replace_existing takes over a database that already exists on the branch
+  # instead of erroring with ALREADY_EXISTS. The field is input-only and not
+  # surfaced in get-database, but it is visible in the recorded request body so
+  # the diff confirms it was sent.
+  postgres_databases:
+    my_database:
+      parent: ${resources.postgres_branches.main.id}
+      database_id: my-database
+      postgres_database: app_db
+      # The live API requires `role`. Declare an explicit role so the bundle is
+      # portable across users (the auto-created project-owner role's id is
+      # derived from the creator's identity).
+      role: ${resources.postgres_roles.owner.id}
+      replace_existing: true
diff --git a/acceptance/bundle/resources/postgres_databases/replace_existing/out.requests.deploy.json b/acceptance/bundle/resources/postgres_databases/replace_existing/out.requests.deploy.json
new file mode 100644
index 00000000000..c1dd61f0000
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/replace_existing/out.requests.deploy.json
@@ -0,0 +1,42 @@
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/app-owner"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/app-owner"
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/databases",
+  "q": {
+    "database_id": "my-database",
+    "replace_existing": "true"
+  },
+  "body": {
+    "spec": {
+      "postgres_database": "app_db",
+      "role": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/app-owner"
+    }
+  }
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/databases/my-database"
+}
diff --git a/acceptance/bundle/resources/postgres_databases/replace_existing/out.test.toml b/acceptance/bundle/resources/postgres_databases/replace_existing/out.test.toml
new file mode 100644
index 00000000000..a026907d175
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/replace_existing/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/resources/postgres_databases/replace_existing/output.txt b/acceptance/bundle/resources/postgres_databases/replace_existing/output.txt
new file mode 100644
index 00000000000..944668621bf
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/replace_existing/output.txt
@@ -0,0 +1,64 @@
+
+=== Deploy project, branch, role, and database
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/replace-existing-database-[UNIQUE_NAME]/default/files...
+Created postgres_branches.main
+Created postgres_databases.my_database
+Created postgres_projects.my_project
+Created postgres_roles.owner
+Files: 0 uploaded, 0 deleted
+Resources: 4 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Unbind the database: it now exists on the branch but is no longer tracked by the bundle
+>>> [CLI] bundle deployment unbind my_database
+
+=== Plan after unbind: the bundle wants to (re-)create the database
+>>> [CLI] bundle plan
+create postgres_databases.my_database
+
+Plan: 1 to add, 0 to change, 0 to delete, 3 unchanged
+
+=== Re-deploy: replace_existing adopts the already-existing database instead of erroring
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/replace-existing-database-[UNIQUE_NAME]/default/files...
+Created postgres_databases.my_database
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 3 unchanged
+
+=== Confirm the database is under management again
+>>> [CLI] postgres get-database projects/test-pg-proj-[UNIQUE_NAME]/branches/main/databases/my-database
+{
+  "database_id": "my-database",
+  "name": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main/databases/my-database",
+  "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
+  "status": {
+    "database_id": "my-database",
+    "postgres_database": "app_db",
+    "role": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/app-owner"
+  }
+}
+
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.postgres_branches.main
+  delete resources.postgres_databases.my_database
+  delete resources.postgres_projects.my_project
+  delete resources.postgres_roles.owner
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase branches.
+All data stored in them will be permanently lost:
+  delete resources.postgres_branches.main
+
+This action will result in the deletion of the following Lakebase databases.
+All data stored in them will be permanently lost:
+  delete resources.postgres_databases.my_database
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/replace-existing-database-[UNIQUE_NAME]/default
+
+Destroy: 4 deleted
diff --git a/acceptance/bundle/resources/postgres_databases/replace_existing/script b/acceptance/bundle/resources/postgres_databases/replace_existing/script
new file mode 100644
index 00000000000..2a824739a06
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/replace_existing/script
@@ -0,0 +1,27 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+   trace $CLI bundle destroy --auto-approve
+   rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+title "Deploy project, branch, role, and database"
+trace $CLI bundle deploy
+
+title "Unbind the database: it now exists on the branch but is no longer tracked by the bundle"
+# Mirrors a database that already exists on the branch but is not created or
+# owned by this bundle.
+trace $CLI bundle deployment unbind my_database
+
+title "Plan after unbind: the bundle wants to (re-)create the database"
+trace $CLI bundle plan
+
+title "Re-deploy: replace_existing adopts the already-existing database instead of erroring"
+rm -f "$OUT_REQUESTS"
+trace $CLI bundle deploy
+
+title "Confirm the database is under management again"
+trace $CLI postgres get-database "projects/test-pg-proj-${UNIQUE_NAME}/branches/main/databases/my-database" | database_fields
+
+trace print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.deploy.json
diff --git a/acceptance/bundle/resources/postgres_databases/replace_existing/test.toml b/acceptance/bundle/resources/postgres_databases/replace_existing/test.toml
new file mode 100644
index 00000000000..f77da87a11f
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/replace_existing/test.toml
@@ -0,0 +1,3 @@
+# `bundle unbind` does not yet drop the resource from what the deployment metadata service
+# reports, so the plan after the unbind still sees the database as tracked.
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/resources/postgres_databases/script.prepare b/acceptance/bundle/resources/postgres_databases/script.prepare
new file mode 100644
index 00000000000..e9530613dc4
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/script.prepare
@@ -0,0 +1,6 @@
+# database_fields is the allow-list of database fields the acceptance tests
+# assert on. Anything the backend returns outside this list is dropped, so a new
+# field in the API response does not break the golden.
+database_fields() {
+    jq '{database_id, name, parent, status: (.status | {database_id, postgres_database, role})}'
+}
diff --git a/acceptance/bundle/resources/postgres_databases/test.toml b/acceptance/bundle/resources/postgres_databases/test.toml
new file mode 100644
index 00000000000..8a46fed9249
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/test.toml
@@ -0,0 +1,42 @@
+Cloud = true
+
+# Lakebase v2 (postgres) is only available in AWS as of January 2026
+CloudEnvs.gcp = false
+CloudEnvs.azure = false
+
+# Run on both direct and Terraform modes
+
+Ignore = [
+    "databricks.yml",
+    ".databricks",
+]
+
+[[Repls]]
+# Clean up ?o=<num> suffix after URL since not all workspaces have that
+Old = '\?o=\[(WORKSPACE_ID|ALPHANUMID)\]'
+New = ''
+Order = 1000
+
+[[Repls]]
+# Normalize endpoint UIDs (ep-xxx-yyy format, supports both word-based and hex-based UIDs)
+Old = 'ep-[a-z0-9-]+'
+New = '[ENDPOINT_UID]'
+Order = 1
+
+[[Repls]]
+# Normalize branch UIDs (br-xxx-yyy-zzz format, supports both word-based and hex-based UIDs)
+Old = 'br-[a-z0-9-]+'
+New = '[BRANCH_UID]'
+Order = 1
+
+[[Repls]]
+# Normalize project UIDs (proj-xxx-yyy-zzz format, supports both word-based and hex-based UIDs)
+Old = 'proj-[a-z0-9]+-[a-z0-9]+-[a-z0-9]+-[a-z0-9]'
+New = '[PROJECT_UID]'
+Order = 1
+
+[[Repls]]
+# Normalize LSN values (format: 0/HEXVALUE or 0/0)
+Old = '"source_branch_lsn": "0/[A-F0-9]+"'
+New = '"source_branch_lsn": "[LSN]"'
+Order = 1
diff --git a/acceptance/bundle/resources/postgres_databases/update/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_databases/update/databricks.yml.tmpl
new file mode 100644
index 00000000000..52e26cc75b1
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/update/databricks.yml.tmpl
@@ -0,0 +1,32 @@
+bundle:
+  name: update-postgres-database-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-$UNIQUE_NAME
+      display_name: "Test Project for Database Update"
+      pg_version: 16
+      history_retention_duration: 604800s
+
+  postgres_branches:
+    main:
+      parent: ${resources.postgres_projects.my_project.id}
+      branch_id: main
+      no_expiry: true
+
+  postgres_roles:
+    owner:
+      parent: ${resources.postgres_branches.main.id}
+      role_id: app-owner
+      postgres_role: app_owner
+
+  postgres_databases:
+    my_database:
+      database_id: my-database
+      parent: ${resources.postgres_branches.main.id}
+      postgres_database: initial_db_name
+      role: ${resources.postgres_roles.owner.id}
diff --git a/acceptance/bundle/resources/postgres_databases/update/out.plan.create.json b/acceptance/bundle/resources/postgres_databases/update/out.plan.create.json
new file mode 100644
index 00000000000..2cb56d4a187
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/update/out.plan.create.json
@@ -0,0 +1,25 @@
+{
+  "depends_on": [
+    {
+      "node": "resources.postgres_branches.main",
+      "label": "${resources.postgres_branches.main.id}"
+    },
+    {
+      "node": "resources.postgres_roles.owner",
+      "label": "${resources.postgres_roles.owner.id}"
+    }
+  ],
+  "action": "create",
+  "new_state": {
+    "value": {
+      "database_id": "my-database",
+      "parent": "${resources.postgres_branches.main.id}",
+      "postgres_database": "initial_db_name",
+      "role": "${resources.postgres_roles.owner.id}"
+    },
+    "vars": {
+      "parent": "${resources.postgres_branches.main.id}",
+      "role": "${resources.postgres_roles.owner.id}"
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_databases/update/out.plan.no_change.json b/acceptance/bundle/resources/postgres_databases/update/out.plan.no_change.json
new file mode 100644
index 00000000000..002cec83a0e
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/update/out.plan.no_change.json
@@ -0,0 +1,41 @@
+{
+  "depends_on": [
+    {
+      "node": "resources.postgres_branches.main",
+      "label": "${resources.postgres_branches.main.id}"
+    },
+    {
+      "node": "resources.postgres_roles.owner",
+      "label": "${resources.postgres_roles.owner.id}"
+    }
+  ],
+  "action": "skip",
+  "remote_state": {
+    "create_time": "[TIMESTAMP]",
+    "database_id": "my-database",
+    "name": "[MY_DATABASE_ID]",
+    "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
+    "role": "",
+    "status": {
+      "database_id": "my-database",
+      "postgres_database": "initial_db_name",
+      "role": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/app-owner"
+    },
+    "update_time": "[TIMESTAMP]"
+  },
+  "changes": {
+    "postgres_database": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": "initial_db_name",
+      "new": "initial_db_name"
+    },
+    "role": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/app-owner",
+      "new": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/app-owner",
+      "remote": ""
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_databases/update/out.plan.restore.json b/acceptance/bundle/resources/postgres_databases/update/out.plan.restore.json
new file mode 100644
index 00000000000..1bd727c8de9
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/update/out.plan.restore.json
@@ -0,0 +1,48 @@
+{
+  "depends_on": [
+    {
+      "node": "resources.postgres_branches.main",
+      "label": "${resources.postgres_branches.main.id}"
+    },
+    {
+      "node": "resources.postgres_roles.owner",
+      "label": "${resources.postgres_roles.owner.id}"
+    }
+  ],
+  "action": "update",
+  "new_state": {
+    "value": {
+      "database_id": "my-database",
+      "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
+      "postgres_database": "initial_db_name",
+      "role": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/app-owner"
+    }
+  },
+  "remote_state": {
+    "create_time": "[TIMESTAMP]",
+    "database_id": "my-database",
+    "name": "[MY_DATABASE_ID]",
+    "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
+    "role": "",
+    "status": {
+      "database_id": "my-database",
+      "postgres_database": "renamed_db_name",
+      "role": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/app-owner"
+    },
+    "update_time": "[TIMESTAMP]"
+  },
+  "changes": {
+    "postgres_database": {
+      "action": "update",
+      "old": "renamed_db_name",
+      "new": "initial_db_name"
+    },
+    "role": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/app-owner",
+      "new": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/app-owner",
+      "remote": ""
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_databases/update/out.plan.update.json b/acceptance/bundle/resources/postgres_databases/update/out.plan.update.json
new file mode 100644
index 00000000000..9f104b5772c
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/update/out.plan.update.json
@@ -0,0 +1,48 @@
+{
+  "depends_on": [
+    {
+      "node": "resources.postgres_branches.main",
+      "label": "${resources.postgres_branches.main.id}"
+    },
+    {
+      "node": "resources.postgres_roles.owner",
+      "label": "${resources.postgres_roles.owner.id}"
+    }
+  ],
+  "action": "update",
+  "new_state": {
+    "value": {
+      "database_id": "my-database",
+      "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
+      "postgres_database": "renamed_db_name",
+      "role": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/app-owner"
+    }
+  },
+  "remote_state": {
+    "create_time": "[TIMESTAMP]",
+    "database_id": "my-database",
+    "name": "[MY_DATABASE_ID]",
+    "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
+    "role": "",
+    "status": {
+      "database_id": "my-database",
+      "postgres_database": "initial_db_name",
+      "role": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/app-owner"
+    },
+    "update_time": "[TIMESTAMP]"
+  },
+  "changes": {
+    "postgres_database": {
+      "action": "update",
+      "old": "initial_db_name",
+      "new": "renamed_db_name"
+    },
+    "role": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/app-owner",
+      "new": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/app-owner",
+      "remote": ""
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_databases/update/out.requests.create.json b/acceptance/bundle/resources/postgres_databases/update/out.requests.create.json
new file mode 100644
index 00000000000..15308c66f4e
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/update/out.requests.create.json
@@ -0,0 +1,51 @@
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects",
+  "q": {
+    "project_id": "test-pg-proj-[UNIQUE_NAME]"
+  },
+  "body": {
+    "spec": {
+      "display_name": "Test Project for Database Update",
+      "history_retention_duration": "604800s",
+      "pg_version": 16
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches",
+  "q": {
+    "branch_id": "main"
+  },
+  "body": {
+    "spec": {
+      "no_expiry": true
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles",
+  "q": {
+    "role_id": "app-owner"
+  },
+  "body": {
+    "spec": {
+      "postgres_role": "app_owner"
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/databases",
+  "q": {
+    "database_id": "my-database"
+  },
+  "body": {
+    "spec": {
+      "postgres_database": "initial_db_name",
+      "role": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/app-owner"
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_databases/update/out.requests.no_change.json b/acceptance/bundle/resources/postgres_databases/update/out.requests.no_change.json
new file mode 100644
index 00000000000..42d1bd84b95
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/update/out.requests.no_change.json
@@ -0,0 +1,28 @@
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/app-owner"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/[MY_DATABASE_ID]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/app-owner"
+}
diff --git a/acceptance/bundle/resources/postgres_databases/update/out.requests.restore.json b/acceptance/bundle/resources/postgres_databases/update/out.requests.restore.json
new file mode 100644
index 00000000000..05d035f3dc0
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/update/out.requests.restore.json
@@ -0,0 +1,41 @@
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/app-owner"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/[MY_DATABASE_ID]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/app-owner"
+}
+{
+  "method": "PATCH",
+  "path": "/api/2.0/postgres/[MY_DATABASE_ID]",
+  "q": {
+    "update_mask": "spec.postgres_database"
+  },
+  "body": {
+    "spec": {
+      "postgres_database": "initial_db_name",
+      "role": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/app-owner"
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_databases/update/out.requests.update.json b/acceptance/bundle/resources/postgres_databases/update/out.requests.update.json
new file mode 100644
index 00000000000..82d82c5a603
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/update/out.requests.update.json
@@ -0,0 +1,41 @@
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/app-owner"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/[MY_DATABASE_ID]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/app-owner"
+}
+{
+  "method": "PATCH",
+  "path": "/api/2.0/postgres/[MY_DATABASE_ID]",
+  "q": {
+    "update_mask": "spec.postgres_database"
+  },
+  "body": {
+    "spec": {
+      "postgres_database": "renamed_db_name",
+      "role": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/app-owner"
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_databases/update/out.test.toml b/acceptance/bundle/resources/postgres_databases/update/out.test.toml
new file mode 100644
index 00000000000..ee153e82621
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/update/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_databases/update/output.txt b/acceptance/bundle/resources/postgres_databases/update/output.txt
new file mode 100644
index 00000000000..b94e0180d7e
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/update/output.txt
@@ -0,0 +1,173 @@
+
+=== Initial deployment
+>>> [CLI] bundle validate
+Name: update-postgres-database-[UNIQUE_NAME]
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/update-postgres-database-[UNIQUE_NAME]/default
+
+Validation OK!
+
+>>> [CLI] bundle plan
+create postgres_branches.main
+create postgres_databases.my_database
+create postgres_projects.my_project
+create postgres_roles.owner
+
+Plan: 4 to add, 0 to change, 0 to delete, 0 unchanged
+
+>>> [CLI] bundle plan -o json
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-postgres-database-[UNIQUE_NAME]/default/files...
+Created postgres_branches.main
+Created postgres_databases.my_database
+Created postgres_projects.my_project
+Created postgres_roles.owner
+Files: 0 uploaded, 0 deleted
+Resources: 4 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+
+>>> [CLI] postgres get-database [MY_DATABASE_ID]
+{
+  "database_id": "my-database",
+  "name": "[MY_DATABASE_ID]",
+  "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
+  "status": {
+    "database_id": "my-database",
+    "postgres_database": "initial_db_name",
+    "role": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/app-owner"
+  }
+}
+
+=== Verify no changes
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 4 unchanged
+
+>>> [CLI] bundle plan -o json
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-postgres-database-[UNIQUE_NAME]/default/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 4 unchanged
+
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+
+=== Update postgres_database and re-deploy
+>>> update_file.py databricks.yml postgres_database: initial_db_name postgres_database: renamed_db_name
+
+>>> cat databricks.yml
+bundle:
+  name: update-postgres-database-[UNIQUE_NAME]
+
+sync:
+  paths: []
+
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-[UNIQUE_NAME]
+      display_name: "Test Project for Database Update"
+      pg_version: 16
+      history_retention_duration: 604800s
+
+  postgres_branches:
+    main:
+      parent: ${resources.postgres_projects.my_project.id}
+      branch_id: main
+      no_expiry: true
+
+  postgres_roles:
+    owner:
+      parent: ${resources.postgres_branches.main.id}
+      role_id: app-owner
+      postgres_role: app_owner
+
+  postgres_databases:
+    my_database:
+      database_id: my-database
+      parent: ${resources.postgres_branches.main.id}
+      postgres_database: renamed_db_name
+      role: ${resources.postgres_roles.owner.id}
+
+>>> [CLI] bundle plan
+update postgres_databases.my_database
+
+Plan: 0 to add, 1 to change, 0 to delete, 3 unchanged
+
+>>> [CLI] bundle plan -o json
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-postgres-database-[UNIQUE_NAME]/default/files...
+Updated postgres_databases.my_database
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 3 unchanged
+
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+
+>>> [CLI] postgres get-database [MY_DATABASE_ID]
+{
+  "database_id": "my-database",
+  "name": "[MY_DATABASE_ID]",
+  "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
+  "status": {
+    "database_id": "my-database",
+    "postgres_database": "renamed_db_name",
+    "role": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/app-owner"
+  }
+}
+
+=== Restore postgres_database to original value
+>>> update_file.py databricks.yml postgres_database: renamed_db_name postgres_database: initial_db_name
+
+>>> [CLI] bundle plan
+update postgres_databases.my_database
+
+Plan: 0 to add, 1 to change, 0 to delete, 3 unchanged
+
+>>> [CLI] bundle plan -o json
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-postgres-database-[UNIQUE_NAME]/default/files...
+Updated postgres_databases.my_database
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 3 unchanged
+
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+
+>>> [CLI] postgres get-database [MY_DATABASE_ID]
+{
+  "database_id": "my-database",
+  "name": "[MY_DATABASE_ID]",
+  "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
+  "status": {
+    "database_id": "my-database",
+    "postgres_database": "initial_db_name",
+    "role": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/app-owner"
+  }
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.postgres_branches.main
+  delete resources.postgres_databases.my_database
+  delete resources.postgres_projects.my_project
+  delete resources.postgres_roles.owner
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase branches.
+All data stored in them will be permanently lost:
+  delete resources.postgres_branches.main
+
+This action will result in the deletion of the following Lakebase databases.
+All data stored in them will be permanently lost:
+  delete resources.postgres_databases.my_database
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/update-postgres-database-[UNIQUE_NAME]/default
+
+Destroy: 4 deleted
diff --git a/acceptance/bundle/resources/postgres_databases/update/script b/acceptance/bundle/resources/postgres_databases/update/script
new file mode 100644
index 00000000000..96afa5b6714
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_databases/update/script
@@ -0,0 +1,61 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+   trace $CLI bundle destroy --auto-approve
+   rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+print_requests() {
+    local name=$1
+    trace print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.${name}.json
+    rm -f "$OUT_REQUESTS"
+}
+
+title "Initial deployment"
+trace $CLI bundle validate
+trace $CLI bundle plan
+trace $CLI bundle plan -o json | nostamp | jq '.plan."resources.postgres_databases.my_database" // .' > out.plan.create.json
+rm -f "$OUT_REQUESTS"
+trace $CLI bundle deploy
+
+print_requests create
+
+project_name="projects/test-pg-proj-${UNIQUE_NAME}"
+branch_name="${project_name}/branches/main"
+database_name="${branch_name}/databases/my-database"
+database_id_1=`read_id.py my_database`
+trace $CLI postgres get-database "${database_name}" | database_fields
+
+title "Verify no changes"
+trace $CLI bundle plan
+trace $CLI bundle plan -o json | nostamp | jq '.plan."resources.postgres_databases.my_database" // .' > out.plan.no_change.json
+rm -f "$OUT_REQUESTS"
+trace $CLI bundle deploy
+
+print_requests no_change
+
+title "Update postgres_database and re-deploy"
+trace update_file.py databricks.yml "postgres_database: initial_db_name" "postgres_database: renamed_db_name"
+trace cat databricks.yml
+
+trace $CLI bundle plan
+trace $CLI bundle plan -o json | nostamp | jq '.plan."resources.postgres_databases.my_database" // .' > out.plan.update.json
+rm -f "$OUT_REQUESTS"
+trace $CLI bundle deploy
+
+print_requests update
+
+database_id_2=`read_id.py my_database`
+trace $CLI postgres get-database "${database_name}" | database_fields
+
+title "Restore postgres_database to original value"
+trace update_file.py databricks.yml "postgres_database: renamed_db_name" "postgres_database: initial_db_name"
+trace $CLI bundle plan
+trace $CLI bundle plan -o json | nostamp | jq '.plan."resources.postgres_databases.my_database" // .' > out.plan.restore.json
+rm -f "$OUT_REQUESTS"
+trace $CLI bundle deploy
+
+print_requests restore
+
+trace $CLI postgres get-database "${database_name}" | database_fields
diff --git a/acceptance/bundle/resources/postgres_endpoints/add_settings/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_endpoints/add_settings/databricks.yml.tmpl
new file mode 100644
index 00000000000..cf88ee9dbea
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_endpoints/add_settings/databricks.yml.tmpl
@@ -0,0 +1,27 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-$UNIQUE_NAME
+      display_name: "Test Project for Endpoint settings Add"
+      pg_version: 16
+      history_retention_duration: 604800s
+
+  postgres_branches:
+    main:
+      parent: ${resources.postgres_projects.my_project.id}
+      branch_id: main
+      no_expiry: true
+
+  postgres_endpoints:
+    my_endpoint:
+      parent: ${resources.postgres_branches.main.id}
+      endpoint_id: my-endpoint
+      endpoint_type: ENDPOINT_TYPE_READ_ONLY
+      autoscaling_limit_min_cu: 0.5
+      autoscaling_limit_max_cu: 8
diff --git a/acceptance/bundle/resources/postgres_endpoints/add_settings/out.requests.json b/acceptance/bundle/resources/postgres_endpoints/add_settings/out.requests.json
new file mode 100644
index 00000000000..0693bf14f3b
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_endpoints/add_settings/out.requests.json
@@ -0,0 +1,19 @@
+{
+  "method": "PATCH",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/endpoints/my-endpoint",
+  "q": {
+    "update_mask": "spec.settings"
+  },
+  "body": {
+    "spec": {
+      "autoscaling_limit_max_cu": 8,
+      "autoscaling_limit_min_cu": 0.5,
+      "endpoint_type": "ENDPOINT_TYPE_READ_ONLY",
+      "settings": {
+        "pg_settings": {
+          "statement_timeout": "8000"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_endpoints/add_settings/out.test.toml b/acceptance/bundle/resources/postgres_endpoints/add_settings/out.test.toml
new file mode 100644
index 00000000000..ee153e82621
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_endpoints/add_settings/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_endpoints/add_settings/output.txt b/acceptance/bundle/resources/postgres_endpoints/add_settings/output.txt
new file mode 100644
index 00000000000..64e5b4d2d1d
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_endpoints/add_settings/output.txt
@@ -0,0 +1,45 @@
+
+=== Initial deployment with no settings block
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Created postgres_branches.main
+Created postgres_endpoints.my_endpoint
+Created postgres_projects.my_project
+Files: 0 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Add a settings block and re-deploy
+>>> [CLI] bundle plan
+update postgres_endpoints.my_endpoint
+
+Plan: 0 to add, 1 to change, 0 to delete, 2 unchanged
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Updated postgres_endpoints.my_endpoint
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 2 unchanged
+
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id --sort //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+
+=== Plan again: the addition must leave no drift behind
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 3 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.postgres_branches.main
+  delete resources.postgres_endpoints.my_endpoint
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase branches.
+All data stored in them will be permanently lost:
+  delete resources.postgres_branches.main
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
+
+Destroy: 3 deleted
diff --git a/acceptance/bundle/resources/postgres_endpoints/add_settings/script b/acceptance/bundle/resources/postgres_endpoints/add_settings/script
new file mode 100644
index 00000000000..a1bb85d40fc
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_endpoints/add_settings/script
@@ -0,0 +1,28 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+   trace $CLI bundle destroy --auto-approve
+   rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+title "Initial deployment with no settings block"
+trace $CLI bundle deploy
+rm -f "$OUT_REQUESTS"
+
+title "Add a settings block and re-deploy"
+# Going from absent to present leaves one change path, settings, with no children,
+# so the mask names the message itself. Verified against a real endpoint on
+# 2026-08-31 that update_mask=spec.settings is accepted.
+cat >> databricks.yml <<'YAML'
+      settings:
+        pg_settings:
+          statement_timeout: 8000
+YAML
+trace $CLI bundle plan
+trace $CLI bundle deploy
+
+trace print_requests.py --del-body project_id,branch_id,endpoint_id --sort '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.json
+
+title "Plan again: the addition must leave no drift behind"
+trace $CLI bundle plan
diff --git a/acceptance/bundle/resources/postgres_endpoints/basic/out.requests.direct.json b/acceptance/bundle/resources/postgres_endpoints/basic/out.requests.json
similarity index 100%
rename from acceptance/bundle/resources/postgres_endpoints/basic/out.requests.direct.json
rename to acceptance/bundle/resources/postgres_endpoints/basic/out.requests.json
diff --git a/acceptance/bundle/resources/postgres_endpoints/basic/out.requests.terraform.json b/acceptance/bundle/resources/postgres_endpoints/basic/out.requests.terraform.json
deleted file mode 100644
index 90fcc42649c..00000000000
--- a/acceptance/bundle/resources/postgres_endpoints/basic/out.requests.terraform.json
+++ /dev/null
@@ -1,51 +0,0 @@
-{
-  "method": "POST",
-  "path": "/api/2.0/postgres/projects",
-  "q": {
-    "project_id": "test-pg-proj-[UNIQUE_NAME]"
-  },
-  "body": {
-    "spec": {
-      "default_endpoint_settings": {
-        "autoscaling_limit_max_cu": 4,
-        "autoscaling_limit_min_cu": 0.5,
-        "suspend_timeout_duration": "300s"
-      },
-      "display_name": "Test Project for Endpoint",
-      "history_retention_duration": "604800s",
-      "pg_version": 16
-    }
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches",
-  "q": {
-    "branch_id": "main"
-  },
-  "body": {
-    "parent": "projects/test-pg-proj-[UNIQUE_NAME]",
-    "spec": {
-      "no_expiry": true
-    }
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/endpoints",
-  "q": {
-    "endpoint_id": "custom"
-  },
-  "body": {
-    "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
-    "spec": {
-      "autoscaling_limit_max_cu": 2,
-      "autoscaling_limit_min_cu": 0.5,
-      "endpoint_type": "ENDPOINT_TYPE_READ_ONLY"
-    }
-  }
-}
-{
-  "method": "GET",
-  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/endpoints/custom"
-}
diff --git a/acceptance/bundle/resources/postgres_endpoints/basic/out.test.toml b/acceptance/bundle/resources/postgres_endpoints/basic/out.test.toml
index 110f841fa05..ee153e82621 100644
--- a/acceptance/bundle/resources/postgres_endpoints/basic/out.test.toml
+++ b/acceptance/bundle/resources/postgres_endpoints/basic/out.test.toml
@@ -1,6 +1,4 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
 CloudEnvs.azure = false
 CloudEnvs.gcp = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_endpoints/basic/output.txt b/acceptance/bundle/resources/postgres_endpoints/basic/output.txt
index 898cb54c465..e407cd7ffe7 100644
--- a/acceptance/bundle/resources/postgres_endpoints/basic/output.txt
+++ b/acceptance/bundle/resources/postgres_endpoints/basic/output.txt
@@ -18,45 +18,34 @@ Resources:
   Postgres branches:
     main:
       Name: 
-      URL:  (not deployed)
   Postgres endpoints:
     custom:
       Name: 
-      URL:  (not deployed)
   Postgres projects:
     my_project:
       Name: Test Project for Endpoint
-      URL:  (not deployed)
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-endpoint-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created postgres_branches.main
+Created postgres_endpoints.custom
+Created postgres_projects.my_project
+Files: 0 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] postgres get-endpoint projects/test-pg-proj-[UNIQUE_NAME]/branches/main/endpoints/custom
 {
+  "endpoint_id": "custom",
   "name": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main/endpoints/custom",
   "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
+  "uid": "[ENDPOINT_UID]",
   "status": {
-    "autoscaling_limit_max_cu": 2,
-    "autoscaling_limit_min_cu": 0.5,
-    "current_state": "ACTIVE",
-    "disabled": false,
+    "endpoint_id": "custom",
     "endpoint_type": "ENDPOINT_TYPE_READ_ONLY",
-    "group": {
-      "enable_readable_secondaries": true,
-      "max": 1,
-      "min": 1
-    },
-    "hosts": {
-      "host": "[ENDPOINT_UID].database.us-east-1.cloud.databricks.com",
-      "read_only_host": "[ENDPOINT_UID].database.us-east-1.cloud.databricks.com"
-    },
-    "settings": {},
+    "autoscaling_limit_min_cu": 0.5,
+    "autoscaling_limit_max_cu": 2,
     "suspend_timeout_duration": "300s"
-  },
-  "uid": "[ENDPOINT_UID]"
+  }
 }
 
 >>> [CLI] bundle summary
@@ -68,18 +57,15 @@ Workspace:
 Resources:
   Postgres branches:
     main:
-      Name: 
-      URL:  (not deployed)
+      Name: projects/test-pg-proj-[UNIQUE_NAME]/branches/main
   Postgres endpoints:
     custom:
-      Name: 
-      URL:  (not deployed)
+      Name: projects/test-pg-proj-[UNIQUE_NAME]/branches/main/endpoints/custom
   Postgres projects:
     my_project:
       Name: Test Project for Endpoint
-      URL:  (not deployed)
 
->>> print_requests.py --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
@@ -97,5 +83,4 @@ All data stored in them will be permanently lost:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-endpoint-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 3 deleted
diff --git a/acceptance/bundle/resources/postgres_endpoints/basic/script b/acceptance/bundle/resources/postgres_endpoints/basic/script
index d1d39ec2915..bdb24f81251 100755
--- a/acceptance/bundle/resources/postgres_endpoints/basic/script
+++ b/acceptance/bundle/resources/postgres_endpoints/basic/script
@@ -2,7 +2,7 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
    trace $CLI bundle destroy --auto-approve
-   rm -f out.requests.txt
+   rm -f "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
@@ -10,16 +10,16 @@ trace $CLI bundle validate
 
 trace $CLI bundle summary
 
-rm -f out.requests.txt
+rm -f "$OUT_REQUESTS"
 trace $CLI bundle deploy
 
 # Get endpoint details
 project_name="projects/test-pg-proj-${UNIQUE_NAME}"
 branch_name="${project_name}/branches/main"
 endpoint_name="${branch_name}/endpoints/custom"
-trace $CLI postgres get-endpoint "${endpoint_name}" | jq 'del(.create_time, .update_time)'
+trace $CLI postgres get-endpoint "${endpoint_name}" | endpoint_fields
 
 trace $CLI bundle summary
 
 # Filter requests to only show postgres operations (exclude workspace, telemetry, and operation polling)
-trace print_requests.py --keep --get '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.$DATABRICKS_BUNDLE_ENGINE.json
+trace print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.json
diff --git a/acceptance/bundle/resources/postgres_endpoints/basic/test.toml b/acceptance/bundle/resources/postgres_endpoints/basic/test.toml
deleted file mode 100644
index f8b3bbe49dd..00000000000
--- a/acceptance/bundle/resources/postgres_endpoints/basic/test.toml
+++ /dev/null
@@ -1 +0,0 @@
-# All configuration inherited from parent test.toml
diff --git a/acceptance/bundle/resources/postgres_endpoints/recreate/out.test.toml b/acceptance/bundle/resources/postgres_endpoints/recreate/out.test.toml
index 4fe23e297fe..ee153e82621 100644
--- a/acceptance/bundle/resources/postgres_endpoints/recreate/out.test.toml
+++ b/acceptance/bundle/resources/postgres_endpoints/recreate/out.test.toml
@@ -1,6 +1,4 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
 CloudEnvs.azure = false
 CloudEnvs.gcp = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_endpoints/recreate/output.txt b/acceptance/bundle/resources/postgres_endpoints/recreate/output.txt
index 8b5725834e7..7ff6430ff42 100644
--- a/acceptance/bundle/resources/postgres_endpoints/recreate/output.txt
+++ b/acceptance/bundle/resources/postgres_endpoints/recreate/output.txt
@@ -41,12 +41,19 @@ Plan: 3 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-endpoint-recreate-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created postgres_branches.main
+Created postgres_endpoints.my_endpoint
+Created postgres_projects.my_project
+Files: 0 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
 
->>> print_requests
+>>> print_requests.py --unique --del-body parent,project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
 {
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects",
+  "q": {
+    "project_id": "test-pg-proj-[UNIQUE_NAME]"
+  },
   "body": {
     "spec": {
       "default_endpoint_settings": {
@@ -58,21 +65,34 @@ Deployment complete!
       "history_retention_duration": "604800s",
       "pg_version": 16
     }
-  },
-  "method": "POST",
-  "path": "/api/2.0/postgres/projects",
-  "q": {
-    "project_id": "test-pg-proj-[UNIQUE_NAME]"
   }
 }
-      "no_expiry": true
+{
+  "method": "POST",
   "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches",
+  "q": {
     "branch_id": "main"
+  },
+  "body": {
+    "spec": {
+      "no_expiry": true
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/endpoints",
+  "q": {
+    "endpoint_id": "test-endpoint-[UNIQUE_NAME]"
+  },
+  "body": {
+    "spec": {
       "autoscaling_limit_max_cu": 2,
       "autoscaling_limit_min_cu": 0.5,
       "endpoint_type": "ENDPOINT_TYPE_READ_ONLY"
-  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/endpoints",
-    "endpoint_id": "test-endpoint-[UNIQUE_NAME]"
+    }
+  }
+}
 
 >>> cat databricks.yml
 bundle:
@@ -114,27 +134,29 @@ Plan: 1 to add, 0 to change, 1 to delete, 2 unchanged
 
 >>> [CLI] bundle deploy --auto-approve
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-endpoint-recreate-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Recreated postgres_endpoints.my_endpoint
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 2 unchanged
 
->>> print_requests
+>>> print_requests.py --unique --del-body parent,project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
 {
   "method": "DELETE",
   "path": "/api/2.0/postgres/[MY_ENDPOINT_ID]"
 }
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/endpoints",
+  "q": {
+    "endpoint_id": "test-endpoint-[UNIQUE_NAME]-v2"
+  },
   "body": {
     "spec": {
       "autoscaling_limit_max_cu": 2,
       "autoscaling_limit_min_cu": 0.5,
       "endpoint_type": "ENDPOINT_TYPE_READ_ONLY"
     }
-  },
-  "method": "POST",
-  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/endpoints",
-  "q": {
-    "endpoint_id": "test-endpoint-[UNIQUE_NAME]-v2"
   }
+}
 
 === Fetch endpoint and verify it exists after recreation
 >>> [CLI] postgres get-endpoint [MY_ENDPOINT_ID]-v2
@@ -157,16 +179,21 @@ All data stored in them will be permanently lost:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-endpoint-recreate-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 3 deleted
 
->>> print_requests
+>>> print_requests.py --unique --del-body parent,project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
 {
   "method": "DELETE",
   "path": "/api/2.0/postgres/[MY_ENDPOINT_ID]-v2"
 }
+{
+  "method": "DELETE",
   "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main"
+}
+{
+  "method": "DELETE",
   "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
+}
 
 >>> [CLI] bundle destroy --auto-approve
 No active deployment found to destroy!
diff --git a/acceptance/bundle/resources/postgres_endpoints/recreate/script b/acceptance/bundle/resources/postgres_endpoints/recreate/script
index 4fb810c36d1..2339fb590df 100755
--- a/acceptance/bundle/resources/postgres_endpoints/recreate/script
+++ b/acceptance/bundle/resources/postgres_endpoints/recreate/script
@@ -7,7 +7,7 @@ cleanup() {
    $CLI postgres delete-endpoint "projects/test-pg-proj-${UNIQUE_NAME}/branches/main/endpoints/test-endpoint-${UNIQUE_NAME}" 2>/dev/null || true
    $CLI postgres delete-endpoint "projects/test-pg-proj-${UNIQUE_NAME}/branches/main/endpoints/test-endpoint-${UNIQUE_NAME}-v2" 2>/dev/null || true
 
-   rm -f out.requests.txt
+   rm -f "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
@@ -21,15 +21,7 @@ trace $CLI bundle deploy
 
 endpoint_id_1=`read_id.py my_endpoint`
 
-print_requests() {
-    # Filter postgres requests (excluding GET), remove parent field (differs between engines),
-    # then deduplicate consecutive retries
-    jq --sort-keys 'select(.method != "GET" and (.path | contains("/postgres"))) | del(.body.parent)' < out.requests.txt | \
-        awk '!seen[$0]++ {print}'
-    rm -f out.requests.txt
-}
-
-trace print_requests
+trace print_requests.py --unique --del-body parent,project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/'
 
 # Change endpoint_id (should trigger recreation)
 envsubst < databricks.yml.tmpl | sed "s/ENDPOINT_ID_PLACEHOLDER/test-endpoint-${UNIQUE_NAME}-v2/" > databricks.yml
@@ -39,7 +31,7 @@ trace cat databricks.yml
 trace $CLI bundle plan
 trace $CLI bundle deploy --auto-approve
 
-trace print_requests
+trace print_requests.py --unique --del-body parent,project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/'
 
 title "Fetch endpoint and verify it exists after recreation"
 
@@ -50,4 +42,4 @@ trace $CLI postgres get-endpoint $endpoint_id_2 | jq 'del(.create_time, .update_
 title "Destroy and verify cleanup"
 trace $CLI bundle destroy --auto-approve
 
-trace print_requests
+trace print_requests.py --unique --del-body parent,project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/'
diff --git a/acceptance/bundle/resources/postgres_endpoints/recreate/test.toml b/acceptance/bundle/resources/postgres_endpoints/recreate/test.toml
index 9116bfb7da6..7881eb59c2f 100644
--- a/acceptance/bundle/resources/postgres_endpoints/recreate/test.toml
+++ b/acceptance/bundle/resources/postgres_endpoints/recreate/test.toml
@@ -1,2 +1 @@
 Badness = "Terraform provider doesn't wait for endpoint reconciliation to complete after delete, causing subsequent create to fail with 'endpoint reconciliation still in progress'"
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/resources/postgres_endpoints/remove_suspend_timeout/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_endpoints/remove_suspend_timeout/databricks.yml.tmpl
new file mode 100644
index 00000000000..2f00032b4ca
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_endpoints/remove_suspend_timeout/databricks.yml.tmpl
@@ -0,0 +1,28 @@
+bundle:
+  name: remove-postgres-endpoint-suspend-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-$UNIQUE_NAME
+      display_name: "Test Project for Endpoint Suspend Timeout Update"
+      pg_version: 16
+      history_retention_duration: 604800s
+
+  postgres_branches:
+    main:
+      parent: ${resources.postgres_projects.my_project.id}
+      branch_id: main
+      no_expiry: true
+
+  postgres_endpoints:
+    my_endpoint:
+      parent: ${resources.postgres_branches.main.id}
+      endpoint_id: my-endpoint
+      endpoint_type: ENDPOINT_TYPE_READ_ONLY
+      autoscaling_limit_min_cu: 0.5
+      autoscaling_limit_max_cu: 8
+      suspend_timeout_duration: 300s
diff --git a/acceptance/bundle/resources/postgres_endpoints/remove_suspend_timeout/out.deploy.txt b/acceptance/bundle/resources/postgres_endpoints/remove_suspend_timeout/out.deploy.txt
new file mode 100644
index 00000000000..062615af571
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_endpoints/remove_suspend_timeout/out.deploy.txt
@@ -0,0 +1,11 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/remove-postgres-endpoint-suspend-[UNIQUE_NAME]/default/files...
+Error: cannot update resources.postgres_endpoints.my_endpoint: updating id=projects/test-pg-proj-[UNIQUE_NAME]/branches/main/endpoints/my-endpoint: Field 'spec.suspension' is in update_mask but not provided in request (400 INVALID_PARAMETER_VALUE)
+
+Endpoint: PATCH [DATABRICKS_URL]/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/endpoints/my-endpoint?update_mask=spec.suspension
+HTTP Status: 400 Bad Request
+API error_code: INVALID_PARAMETER_VALUE
+API message: Field 'spec.suspension' is in update_mask but not provided in request
+
+Files: 0 uploaded, 0 deleted
+
+Exit code: 1
diff --git a/acceptance/bundle/resources/postgres_endpoints/remove_suspend_timeout/out.plan.drift.json b/acceptance/bundle/resources/postgres_endpoints/remove_suspend_timeout/out.plan.drift.json
new file mode 100644
index 00000000000..77467bdb5d0
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_endpoints/remove_suspend_timeout/out.plan.drift.json
@@ -0,0 +1,28 @@
+{
+  "action": "update",
+  "changes": {
+    "autoscaling_limit_max_cu": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": 8,
+      "new": 8
+    },
+    "autoscaling_limit_min_cu": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": 0.5,
+      "new": 0.5
+    },
+    "endpoint_type": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": "ENDPOINT_TYPE_READ_ONLY",
+      "new": "ENDPOINT_TYPE_READ_ONLY",
+      "remote": ""
+    },
+    "suspend_timeout_duration": {
+      "action": "update",
+      "old": "300s"
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_endpoints/remove_suspend_timeout/out.plan.drift.txt b/acceptance/bundle/resources/postgres_endpoints/remove_suspend_timeout/out.plan.drift.txt
new file mode 100644
index 00000000000..20dbae59085
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_endpoints/remove_suspend_timeout/out.plan.drift.txt
@@ -0,0 +1,5 @@
+
+>>> [CLI] bundle plan
+update postgres_endpoints.my_endpoint
+
+Plan: 0 to add, 1 to change, 0 to delete, 2 unchanged
diff --git a/acceptance/bundle/resources/postgres_endpoints/remove_suspend_timeout/out.plan.json b/acceptance/bundle/resources/postgres_endpoints/remove_suspend_timeout/out.plan.json
new file mode 100644
index 00000000000..77467bdb5d0
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_endpoints/remove_suspend_timeout/out.plan.json
@@ -0,0 +1,28 @@
+{
+  "action": "update",
+  "changes": {
+    "autoscaling_limit_max_cu": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": 8,
+      "new": 8
+    },
+    "autoscaling_limit_min_cu": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": 0.5,
+      "new": 0.5
+    },
+    "endpoint_type": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": "ENDPOINT_TYPE_READ_ONLY",
+      "new": "ENDPOINT_TYPE_READ_ONLY",
+      "remote": ""
+    },
+    "suspend_timeout_duration": {
+      "action": "update",
+      "old": "300s"
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_endpoints/remove_suspend_timeout/out.requests.json b/acceptance/bundle/resources/postgres_endpoints/remove_suspend_timeout/out.requests.json
new file mode 100644
index 00000000000..56aefeeca6c
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_endpoints/remove_suspend_timeout/out.requests.json
@@ -0,0 +1,14 @@
+{
+  "method": "PATCH",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/endpoints/my-endpoint",
+  "q": {
+    "update_mask": "spec.suspension"
+  },
+  "body": {
+    "spec": {
+      "autoscaling_limit_max_cu": 8,
+      "autoscaling_limit_min_cu": 0.5,
+      "endpoint_type": "ENDPOINT_TYPE_READ_ONLY"
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_endpoints/remove_suspend_timeout/out.test.toml b/acceptance/bundle/resources/postgres_endpoints/remove_suspend_timeout/out.test.toml
new file mode 100644
index 00000000000..ee153e82621
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_endpoints/remove_suspend_timeout/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_endpoints/remove_suspend_timeout/output.txt b/acceptance/bundle/resources/postgres_endpoints/remove_suspend_timeout/output.txt
new file mode 100644
index 00000000000..09186727f10
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_endpoints/remove_suspend_timeout/output.txt
@@ -0,0 +1,71 @@
+
+=== Initial deployment with suspend_timeout_duration: 300s
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/remove-postgres-endpoint-suspend-[UNIQUE_NAME]/default/files...
+Created postgres_branches.main
+Created postgres_endpoints.my_endpoint
+Created postgres_projects.my_project
+Files: 0 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] postgres get-endpoint projects/test-pg-proj-[UNIQUE_NAME]/branches/main/endpoints/my-endpoint
+{
+  "endpoint_id": "my-endpoint",
+  "name": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main/endpoints/my-endpoint",
+  "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
+  "uid": "[ENDPOINT_UID]",
+  "status": {
+    "endpoint_id": "my-endpoint",
+    "endpoint_type": "ENDPOINT_TYPE_READ_ONLY",
+    "autoscaling_limit_min_cu": 0.5,
+    "autoscaling_limit_max_cu": 8,
+    "suspend_timeout_duration": "300s"
+  }
+}
+
+=== Remove suspend_timeout_duration: neither engine can apply it
+>>> update_file.py databricks.yml       suspend_timeout_duration: 300s 
+
+>>> [CLI] bundle plan
+update postgres_endpoints.my_endpoint
+
+Plan: 0 to add, 1 to change, 0 to delete, 2 unchanged
+
+>>> [CLI] bundle plan -o json
+
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id --sort //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+
+>>> [CLI] postgres get-endpoint projects/test-pg-proj-[UNIQUE_NAME]/branches/main/endpoints/my-endpoint
+{
+  "endpoint_id": "my-endpoint",
+  "name": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main/endpoints/my-endpoint",
+  "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
+  "uid": "[ENDPOINT_UID]",
+  "status": {
+    "endpoint_id": "my-endpoint",
+    "endpoint_type": "ENDPOINT_TYPE_READ_ONLY",
+    "autoscaling_limit_min_cu": 0.5,
+    "autoscaling_limit_max_cu": 8,
+    "suspend_timeout_duration": "300s"
+  }
+}
+
+>>> [CLI] bundle plan -o json
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.postgres_branches.main
+  delete resources.postgres_endpoints.my_endpoint
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase branches.
+All data stored in them will be permanently lost:
+  delete resources.postgres_branches.main
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/remove-postgres-endpoint-suspend-[UNIQUE_NAME]/default
+
+Destroy: 3 deleted
diff --git a/acceptance/bundle/resources/postgres_endpoints/remove_suspend_timeout/script b/acceptance/bundle/resources/postgres_endpoints/remove_suspend_timeout/script
new file mode 100644
index 00000000000..ecd4e1c3db9
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_endpoints/remove_suspend_timeout/script
@@ -0,0 +1,35 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+   trace $CLI bundle destroy --auto-approve
+   rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+endpoint_name="projects/test-pg-proj-${UNIQUE_NAME}/branches/main/endpoints/my-endpoint"
+
+title "Initial deployment with suspend_timeout_duration: 300s"
+trace $CLI bundle deploy
+rm -f "$OUT_REQUESTS"
+trace $CLI postgres get-endpoint "${endpoint_name}" | endpoint_fields
+
+title "Remove suspend_timeout_duration: neither engine can apply it"
+trace update_file.py databricks.yml "      suspend_timeout_duration: 300s" ""
+
+# Both engines plan the removal and neither applies it, but they fail differently, so the
+# deploy and the drift it leaves stay in per-engine files. The direct engine masks
+# spec.suspension with no member of that oneof in the body and the API rejects it; the
+# Terraform provider masks the whole spec, which the API accepts and then ignores. See
+# test.toml.
+trace $CLI bundle plan
+trace $CLI bundle plan -o json | nostamp | jq '.plan."resources.postgres_endpoints.my_endpoint" | {action, changes}' > out.plan.json
+rm -f "$OUT_REQUESTS"
+errcode $CLI bundle deploy &> out.deploy.txt
+trace print_requests.py --del-body project_id,branch_id,endpoint_id --sort '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.json
+
+# Read the endpoint back to see whether the removal reached it, then plan again to
+# record the drift it leaves behind: direct still has the removal pending and will
+# fail again on every deploy, terraform applied it and is clean.
+trace $CLI postgres get-endpoint "${endpoint_name}" | endpoint_fields
+trace $CLI bundle plan &> out.plan.drift.txt
+trace $CLI bundle plan -o json | nostamp | jq '.plan."resources.postgres_endpoints.my_endpoint" | {action, changes}' > out.plan.drift.json
diff --git a/acceptance/bundle/resources/postgres_endpoints/remove_suspend_timeout/test.toml b/acceptance/bundle/resources/postgres_endpoints/remove_suspend_timeout/test.toml
new file mode 100644
index 00000000000..e9fdc923eed
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_endpoints/remove_suspend_timeout/test.toml
@@ -0,0 +1,8 @@
+# The mask is now correct: suspend_timeout_duration is masked under its oneof group name
+# spec.suspension. The removal still cannot be applied, and that is a property of the API
+# rather than of the mask: a masked field has to be populated in the request body, so
+# dropping it from the bundle leaves nothing to send. Probed against a real workspace on
+# 2026-08-31 -- an absent value and an explicit null are both answered with "is in
+# update_mask but not provided in request". The only way to stop an endpoint suspending is
+# to set the other member of the oneof, no_suspension: true.
+Badness = "Removing suspend_timeout_duration cannot be applied: the API requires a masked field to be populated, so the removal fails on every deploy. Setting no_suspension: true instead is the supported way to express it"
diff --git a/acceptance/bundle/resources/postgres_endpoints/replace_existing/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_endpoints/replace_existing/databricks.yml.tmpl
new file mode 100644
index 00000000000..220d7b0077e
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_endpoints/replace_existing/databricks.yml.tmpl
@@ -0,0 +1,43 @@
+bundle:
+  name: deploy-postgres-replace-endpoint-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  # The project's default_endpoint_settings are inherited by every implicit
+  # primary endpoint. We set suspend_timeout_duration to 300s here so the
+  # primary endpoint of the "develop" branch below would otherwise come up
+  # with 300s.
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-$UNIQUE_NAME
+      display_name: "Replace existing endpoint test"
+      pg_version: 16
+      history_retention_duration: "604800s"
+      default_endpoint_settings:
+        autoscaling_limit_min_cu: 0.5
+        autoscaling_limit_max_cu: 4
+        suspend_timeout_duration: "300s"
+
+  # Non-default branch managed normally — the server auto-provisions its
+  # primary read-write endpoint with the project defaults above.
+  postgres_branches:
+    develop:
+      parent: ${resources.postgres_projects.my_project.id}
+      branch_id: develop
+      no_expiry: true
+
+  # Take over the implicitly-created primary endpoint of the develop branch
+  # and override the inherited suspend_timeout_duration (300s) with 600s. A
+  # successful deploy with 600s reflected in get-endpoint proves
+  # replace_existing applied the spec.
+  postgres_endpoints:
+    primary:
+      parent: ${resources.postgres_branches.develop.id}
+      endpoint_id: primary
+      replace_existing: true
+      endpoint_type: ENDPOINT_TYPE_READ_WRITE
+      autoscaling_limit_min_cu: 0.5
+      autoscaling_limit_max_cu: 4
+      suspend_timeout_duration: "600s"
diff --git a/acceptance/bundle/resources/postgres_endpoints/replace_existing/out.destroy.txt b/acceptance/bundle/resources/postgres_endpoints/replace_existing/out.destroy.txt
new file mode 100644
index 00000000000..58f199c143a
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_endpoints/replace_existing/out.destroy.txt
@@ -0,0 +1,16 @@
+The following resources will be deleted:
+  delete resources.postgres_branches.develop
+  delete resources.postgres_endpoints.primary
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase branches.
+All data stored in them will be permanently lost:
+  delete resources.postgres_branches.develop
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-replace-endpoint-[UNIQUE_NAME]/default
+
+Destroy: 3 deleted
diff --git a/acceptance/bundle/resources/postgres_endpoints/replace_existing/out.requests.deploy.json b/acceptance/bundle/resources/postgres_endpoints/replace_existing/out.requests.deploy.json
new file mode 100644
index 00000000000..28e0d2433a9
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_endpoints/replace_existing/out.requests.deploy.json
@@ -0,0 +1,55 @@
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects",
+  "q": {
+    "project_id": "test-pg-proj-[UNIQUE_NAME]"
+  },
+  "body": {
+    "spec": {
+      "default_endpoint_settings": {
+        "autoscaling_limit_max_cu": 4,
+        "autoscaling_limit_min_cu": 0.5,
+        "suspend_timeout_duration": "300s"
+      },
+      "display_name": "Replace existing endpoint test",
+      "history_retention_duration": "604800s",
+      "pg_version": 16
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches",
+  "q": {
+    "branch_id": "develop"
+  },
+  "body": {
+    "spec": {
+      "no_expiry": true
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/develop/endpoints",
+  "q": {
+    "endpoint_id": "primary",
+    "replace_existing": "true"
+  },
+  "body": {
+    "spec": {
+      "autoscaling_limit_max_cu": 4,
+      "autoscaling_limit_min_cu": 0.5,
+      "endpoint_type": "ENDPOINT_TYPE_READ_WRITE",
+      "suspend_timeout_duration": "600s"
+    }
+  }
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/develop/endpoints/primary"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/develop/endpoints/primary"
+}
diff --git a/acceptance/bundle/resources/postgres_endpoints/replace_existing/out.requests.destroy.json b/acceptance/bundle/resources/postgres_endpoints/replace_existing/out.requests.destroy.json
new file mode 100644
index 00000000000..51e48eb6b96
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_endpoints/replace_existing/out.requests.destroy.json
@@ -0,0 +1,79 @@
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects",
+  "q": {
+    "project_id": "test-pg-proj-[UNIQUE_NAME]"
+  },
+  "body": {
+    "spec": {
+      "default_endpoint_settings": {
+        "autoscaling_limit_max_cu": 4,
+        "autoscaling_limit_min_cu": 0.5,
+        "suspend_timeout_duration": "300s"
+      },
+      "display_name": "Replace existing endpoint test",
+      "history_retention_duration": "604800s",
+      "pg_version": 16
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches",
+  "q": {
+    "branch_id": "develop"
+  },
+  "body": {
+    "spec": {
+      "no_expiry": true
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/develop/endpoints",
+  "q": {
+    "endpoint_id": "primary",
+    "replace_existing": "true"
+  },
+  "body": {
+    "spec": {
+      "autoscaling_limit_max_cu": 4,
+      "autoscaling_limit_min_cu": 0.5,
+      "endpoint_type": "ENDPOINT_TYPE_READ_WRITE",
+      "suspend_timeout_duration": "600s"
+    }
+  }
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/develop/endpoints/primary"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/develop/endpoints/primary"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/develop/endpoints/primary"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/develop"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
+}
+{
+  "method": "DELETE",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/develop/endpoints/primary"
+}
+{
+  "method": "DELETE",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/develop"
+}
+{
+  "method": "DELETE",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
+}
diff --git a/acceptance/bundle/resources/postgres_endpoints/replace_existing/out.test.toml b/acceptance/bundle/resources/postgres_endpoints/replace_existing/out.test.toml
new file mode 100644
index 00000000000..ee153e82621
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_endpoints/replace_existing/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_endpoints/replace_existing/output.txt b/acceptance/bundle/resources/postgres_endpoints/replace_existing/output.txt
new file mode 100644
index 00000000000..61ae1fbba07
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_endpoints/replace_existing/output.txt
@@ -0,0 +1,37 @@
+
+>>> [CLI] bundle validate
+Name: deploy-postgres-replace-endpoint-[UNIQUE_NAME]
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-replace-endpoint-[UNIQUE_NAME]/default
+
+Validation OK!
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-replace-endpoint-[UNIQUE_NAME]/default/files...
+Created postgres_branches.develop
+Created postgres_endpoints.primary
+Created postgres_projects.my_project
+Files: 0 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] postgres get-endpoint projects/test-pg-proj-[UNIQUE_NAME]/branches/develop/endpoints/primary
+{
+  "endpoint_id": "primary",
+  "name": "projects/test-pg-proj-[UNIQUE_NAME]/branches/develop/endpoints/primary",
+  "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/develop",
+  "uid": "[ENDPOINT_UID]",
+  "status": {
+    "endpoint_id": "primary",
+    "endpoint_type": "ENDPOINT_TYPE_READ_WRITE",
+    "autoscaling_limit_min_cu": 0.5,
+    "autoscaling_limit_max_cu": 4,
+    "suspend_timeout_duration": "600s"
+  }
+}
+
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+
+=== bundle destroy
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
diff --git a/acceptance/bundle/resources/postgres_endpoints/replace_existing/script b/acceptance/bundle/resources/postgres_endpoints/replace_existing/script
new file mode 100644
index 00000000000..ec2575485cc
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_endpoints/replace_existing/script
@@ -0,0 +1,30 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+   # Belt-and-braces in case bundle destroy was skipped or partially failed.
+   $CLI postgres delete-project "projects/test-pg-proj-${UNIQUE_NAME}" 2>/dev/null || true
+   rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+trace $CLI bundle validate
+
+rm -f "$OUT_REQUESTS"
+trace $CLI bundle deploy
+
+# The implicit primary endpoint inherits suspend_timeout_duration from the
+# project default (300s). After deploy with replace_existing=true, the
+# bundle's spec must be applied: 600s.
+trace $CLI postgres get-endpoint "projects/test-pg-proj-${UNIQUE_NAME}/branches/develop/endpoints/primary" | endpoint_fields
+
+trace print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.deploy.json
+
+# bundle destroy: the backend rejects independent deletion of the primary
+# read-write endpoint with a MANAGED_BY_PARENT marker; both engines
+# disregard that error and let the parent branch delete cascade-clean the
+# endpoint. Per-engine output is captured so regressions in either
+# engine's destroy flow show up in the diff.
+title "bundle destroy"
+$CLI bundle destroy --auto-approve > out.destroy.txt 2>&1 || true
+
+trace print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.destroy.json
diff --git a/acceptance/bundle/resources/postgres_endpoints/script.prepare b/acceptance/bundle/resources/postgres_endpoints/script.prepare
new file mode 100644
index 00000000000..4feaa2b5caa
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_endpoints/script.prepare
@@ -0,0 +1,10 @@
+# endpoint_fields projects a `postgres get-endpoint` response (stdin) down to the
+# identifying fields plus the status fields the bundle spec controls. Server-
+# materialized status fields (hosts, current_state, group, settings,
+# last_active_time, ...) are deliberately dropped: they differ between the
+# testserver mock and the real backend, and the backend keeps adding new ones
+# over time. Asserting only these stable fields keeps local and cloud output
+# identical without chasing every backend field.
+endpoint_fields() {
+    jq '{endpoint_id, name, parent, uid, status: (.status | {endpoint_id, endpoint_type, autoscaling_limit_min_cu, autoscaling_limit_max_cu, suspend_timeout_duration})}'
+}
diff --git a/acceptance/bundle/resources/postgres_endpoints/test.toml b/acceptance/bundle/resources/postgres_endpoints/test.toml
index 66fd405c0c6..0b4642d0316 100644
--- a/acceptance/bundle/resources/postgres_endpoints/test.toml
+++ b/acceptance/bundle/resources/postgres_endpoints/test.toml
@@ -1,13 +1,10 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
 
 # Lakebase v2 (postgres) is only available in AWS as of January 2026
 CloudEnvs.gcp = false
 CloudEnvs.azure = false
 
 # Run on both direct and Terraform modes
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
 
 Ignore = [
     "databricks.yml",
@@ -15,8 +12,8 @@ Ignore = [
 ]
 
 [[Repls]]
-# Clean up ?o=<num> suffix after URL since not all workspaces have that
-Old = '\?o=\[(NUMID|ALPHANUMID)\]'
+# Clean up ?[ow]=<num> suffix after URL since not all workspaces have that
+Old = '\?[ow]=\[(WORKSPACE_ID|ALPHANUMID)\]'
 New = ''
 Order = 1000
 
diff --git a/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.plan.create.direct.json b/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.plan.create.json
similarity index 100%
rename from acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.plan.create.direct.json
rename to acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.plan.create.json
diff --git a/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.plan.create.terraform.json b/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.plan.create.terraform.json
deleted file mode 100644
index b4425b9687c..00000000000
--- a/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.plan.create.terraform.json
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-  "action": "create"
-}
diff --git a/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.plan.no_change.direct.json b/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.plan.no_change.direct.json
deleted file mode 100644
index 98cc8f8b22c..00000000000
--- a/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.plan.no_change.direct.json
+++ /dev/null
@@ -1,61 +0,0 @@
-{
-  "depends_on": [
-    {
-      "node": "resources.postgres_branches.main",
-      "label": "${resources.postgres_branches.main.id}"
-    }
-  ],
-  "action": "skip",
-  "remote_state": {
-    "create_time": "[TIMESTAMP]",
-    "name": "[MY_ENDPOINT_ID]",
-    "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
-    "status": {
-      "autoscaling_limit_max_cu": 8,
-      "autoscaling_limit_min_cu": 0.5,
-      "current_state": "ACTIVE",
-      "disabled": false,
-      "endpoint_type": "ENDPOINT_TYPE_READ_ONLY",
-      "group": {
-        "enable_readable_secondaries": true,
-        "max": 1,
-        "min": 1
-      },
-      "hosts": {
-        "host": "[ENDPOINT_UID].database.us-east-1.cloud.databricks.com",
-        "read_only_host": "[ENDPOINT_UID].database.us-east-1.cloud.databricks.com"
-      },
-      "settings": {},
-      "suspend_timeout_duration": "300s"
-    },
-    "uid": "[ENDPOINT_UID]",
-    "update_time": "[TIMESTAMP]"
-  },
-  "changes": {
-    "autoscaling_limit_max_cu": {
-      "action": "skip",
-      "reason": "spec:input_only",
-      "old": 8,
-      "new": 8
-    },
-    "autoscaling_limit_min_cu": {
-      "action": "skip",
-      "reason": "spec:input_only",
-      "old": 0.5,
-      "new": 0.5
-    },
-    "endpoint_type": {
-      "action": "skip",
-      "reason": "spec:input_only",
-      "old": "ENDPOINT_TYPE_READ_ONLY",
-      "new": "ENDPOINT_TYPE_READ_ONLY",
-      "remote": ""
-    },
-    "suspend_timeout_duration": {
-      "action": "skip",
-      "reason": "empty",
-      "old": "300s",
-      "new": "300s"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.plan.no_change.json b/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.plan.no_change.json
new file mode 100644
index 00000000000..10c8affb555
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.plan.no_change.json
@@ -0,0 +1,36 @@
+{
+  "depends_on": [
+    {
+      "node": "resources.postgres_branches.main",
+      "label": "${resources.postgres_branches.main.id}"
+    }
+  ],
+  "action": "skip",
+  "changes": {
+    "autoscaling_limit_max_cu": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": 8,
+      "new": 8
+    },
+    "autoscaling_limit_min_cu": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": 0.5,
+      "new": 0.5
+    },
+    "endpoint_type": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": "ENDPOINT_TYPE_READ_ONLY",
+      "new": "ENDPOINT_TYPE_READ_ONLY",
+      "remote": ""
+    },
+    "suspend_timeout_duration": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": "300s",
+      "new": "300s"
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.plan.no_change.terraform.json b/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.plan.no_change.terraform.json
deleted file mode 100644
index b2f23a5015f..00000000000
--- a/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.plan.no_change.terraform.json
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-  "action": "skip"
-}
diff --git a/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.plan.restore.direct.json b/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.plan.restore.direct.json
deleted file mode 100644
index 86fbbaa7a6b..00000000000
--- a/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.plan.restore.direct.json
+++ /dev/null
@@ -1,70 +0,0 @@
-{
-  "depends_on": [
-    {
-      "node": "resources.postgres_branches.main",
-      "label": "${resources.postgres_branches.main.id}"
-    }
-  ],
-  "action": "update",
-  "new_state": {
-    "value": {
-      "autoscaling_limit_max_cu": 8,
-      "autoscaling_limit_min_cu": 0.5,
-      "endpoint_id": "my-endpoint",
-      "endpoint_type": "ENDPOINT_TYPE_READ_ONLY",
-      "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
-      "suspend_timeout_duration": "300s"
-    }
-  },
-  "remote_state": {
-    "create_time": "[TIMESTAMP]",
-    "name": "[MY_ENDPOINT_ID]",
-    "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
-    "status": {
-      "autoscaling_limit_max_cu": 4,
-      "autoscaling_limit_min_cu": 0.5,
-      "current_state": "ACTIVE",
-      "disabled": false,
-      "endpoint_type": "ENDPOINT_TYPE_READ_ONLY",
-      "group": {
-        "enable_readable_secondaries": true,
-        "max": 1,
-        "min": 1
-      },
-      "hosts": {
-        "host": "[ENDPOINT_UID].database.us-east-1.cloud.databricks.com",
-        "read_only_host": "[ENDPOINT_UID].database.us-east-1.cloud.databricks.com"
-      },
-      "settings": {},
-      "suspend_timeout_duration": "300s"
-    },
-    "uid": "[ENDPOINT_UID]",
-    "update_time": "[TIMESTAMP]"
-  },
-  "changes": {
-    "autoscaling_limit_max_cu": {
-      "action": "update",
-      "old": 4,
-      "new": 8
-    },
-    "autoscaling_limit_min_cu": {
-      "action": "skip",
-      "reason": "spec:input_only",
-      "old": 0.5,
-      "new": 0.5
-    },
-    "endpoint_type": {
-      "action": "skip",
-      "reason": "spec:input_only",
-      "old": "ENDPOINT_TYPE_READ_ONLY",
-      "new": "ENDPOINT_TYPE_READ_ONLY",
-      "remote": ""
-    },
-    "suspend_timeout_duration": {
-      "action": "skip",
-      "reason": "empty",
-      "old": "300s",
-      "new": "300s"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.plan.restore.json b/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.plan.restore.json
new file mode 100644
index 00000000000..9228fd22296
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.plan.restore.json
@@ -0,0 +1,45 @@
+{
+  "depends_on": [
+    {
+      "node": "resources.postgres_branches.main",
+      "label": "${resources.postgres_branches.main.id}"
+    }
+  ],
+  "action": "update",
+  "new_state": {
+    "value": {
+      "autoscaling_limit_max_cu": 8,
+      "autoscaling_limit_min_cu": 0.5,
+      "endpoint_id": "my-endpoint",
+      "endpoint_type": "ENDPOINT_TYPE_READ_ONLY",
+      "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
+      "suspend_timeout_duration": "300s"
+    }
+  },
+  "changes": {
+    "autoscaling_limit_max_cu": {
+      "action": "update",
+      "old": 4,
+      "new": 8
+    },
+    "autoscaling_limit_min_cu": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": 0.5,
+      "new": 0.5
+    },
+    "endpoint_type": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": "ENDPOINT_TYPE_READ_ONLY",
+      "new": "ENDPOINT_TYPE_READ_ONLY",
+      "remote": ""
+    },
+    "suspend_timeout_duration": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": "300s",
+      "new": "300s"
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.plan.restore.terraform.json b/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.plan.restore.terraform.json
deleted file mode 100644
index 375b496fef0..00000000000
--- a/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.plan.restore.terraform.json
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-  "action": "update"
-}
diff --git a/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.plan.update.direct.json b/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.plan.update.direct.json
deleted file mode 100644
index 1ff9863d78f..00000000000
--- a/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.plan.update.direct.json
+++ /dev/null
@@ -1,70 +0,0 @@
-{
-  "depends_on": [
-    {
-      "node": "resources.postgres_branches.main",
-      "label": "${resources.postgres_branches.main.id}"
-    }
-  ],
-  "action": "update",
-  "new_state": {
-    "value": {
-      "autoscaling_limit_max_cu": 4,
-      "autoscaling_limit_min_cu": 0.5,
-      "endpoint_id": "my-endpoint",
-      "endpoint_type": "ENDPOINT_TYPE_READ_ONLY",
-      "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
-      "suspend_timeout_duration": "300s"
-    }
-  },
-  "remote_state": {
-    "create_time": "[TIMESTAMP]",
-    "name": "[MY_ENDPOINT_ID]",
-    "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
-    "status": {
-      "autoscaling_limit_max_cu": 8,
-      "autoscaling_limit_min_cu": 0.5,
-      "current_state": "ACTIVE",
-      "disabled": false,
-      "endpoint_type": "ENDPOINT_TYPE_READ_ONLY",
-      "group": {
-        "enable_readable_secondaries": true,
-        "max": 1,
-        "min": 1
-      },
-      "hosts": {
-        "host": "[ENDPOINT_UID].database.us-east-1.cloud.databricks.com",
-        "read_only_host": "[ENDPOINT_UID].database.us-east-1.cloud.databricks.com"
-      },
-      "settings": {},
-      "suspend_timeout_duration": "300s"
-    },
-    "uid": "[ENDPOINT_UID]",
-    "update_time": "[TIMESTAMP]"
-  },
-  "changes": {
-    "autoscaling_limit_max_cu": {
-      "action": "update",
-      "old": 8,
-      "new": 4
-    },
-    "autoscaling_limit_min_cu": {
-      "action": "skip",
-      "reason": "spec:input_only",
-      "old": 0.5,
-      "new": 0.5
-    },
-    "endpoint_type": {
-      "action": "skip",
-      "reason": "spec:input_only",
-      "old": "ENDPOINT_TYPE_READ_ONLY",
-      "new": "ENDPOINT_TYPE_READ_ONLY",
-      "remote": ""
-    },
-    "suspend_timeout_duration": {
-      "action": "skip",
-      "reason": "empty",
-      "old": "300s",
-      "new": "300s"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.plan.update.json b/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.plan.update.json
new file mode 100644
index 00000000000..af255584b89
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.plan.update.json
@@ -0,0 +1,45 @@
+{
+  "depends_on": [
+    {
+      "node": "resources.postgres_branches.main",
+      "label": "${resources.postgres_branches.main.id}"
+    }
+  ],
+  "action": "update",
+  "new_state": {
+    "value": {
+      "autoscaling_limit_max_cu": 4,
+      "autoscaling_limit_min_cu": 0.5,
+      "endpoint_id": "my-endpoint",
+      "endpoint_type": "ENDPOINT_TYPE_READ_ONLY",
+      "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
+      "suspend_timeout_duration": "300s"
+    }
+  },
+  "changes": {
+    "autoscaling_limit_max_cu": {
+      "action": "update",
+      "old": 8,
+      "new": 4
+    },
+    "autoscaling_limit_min_cu": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": 0.5,
+      "new": 0.5
+    },
+    "endpoint_type": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": "ENDPOINT_TYPE_READ_ONLY",
+      "new": "ENDPOINT_TYPE_READ_ONLY",
+      "remote": ""
+    },
+    "suspend_timeout_duration": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": "300s",
+      "new": "300s"
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.plan.update.terraform.json b/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.plan.update.terraform.json
deleted file mode 100644
index 375b496fef0..00000000000
--- a/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.plan.update.terraform.json
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-  "action": "update"
-}
diff --git a/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.requests.create.direct.json b/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.requests.create.json
similarity index 100%
rename from acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.requests.create.direct.json
rename to acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.requests.create.json
diff --git a/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.requests.create.terraform.json b/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.requests.create.terraform.json
deleted file mode 100644
index 1337f660525..00000000000
--- a/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.requests.create.terraform.json
+++ /dev/null
@@ -1,43 +0,0 @@
-{
-  "method": "POST",
-  "path": "/api/2.0/postgres/projects",
-  "q": {
-    "project_id": "test-pg-proj-[UNIQUE_NAME]"
-  },
-  "body": {
-    "spec": {
-      "display_name": "Test Project for Endpoint Update",
-      "history_retention_duration": "604800s",
-      "pg_version": 16
-    }
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches",
-  "q": {
-    "branch_id": "main"
-  },
-  "body": {
-    "parent": "projects/test-pg-proj-[UNIQUE_NAME]",
-    "spec": {
-      "no_expiry": true
-    }
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/endpoints",
-  "q": {
-    "endpoint_id": "my-endpoint"
-  },
-  "body": {
-    "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
-    "spec": {
-      "autoscaling_limit_max_cu": 8,
-      "autoscaling_limit_min_cu": 0.5,
-      "endpoint_type": "ENDPOINT_TYPE_READ_ONLY",
-      "suspend_timeout_duration": "300s"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.requests.no_change.direct.json b/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.requests.no_change.json
similarity index 100%
rename from acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.requests.no_change.direct.json
rename to acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.requests.no_change.json
diff --git a/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.requests.no_change.terraform.json b/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.requests.no_change.terraform.json
deleted file mode 100644
index e7dafa1da70..00000000000
--- a/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.requests.no_change.terraform.json
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "method": "GET",
-  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
-}
-{
-  "method": "GET",
-  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main"
-}
-{
-  "method": "GET",
-  "path": "/api/2.0/postgres/[MY_ENDPOINT_ID]"
-}
diff --git a/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.requests.restore.direct.json b/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.requests.restore.json
similarity index 100%
rename from acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.requests.restore.direct.json
rename to acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.requests.restore.json
diff --git a/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.requests.restore.terraform.json b/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.requests.restore.terraform.json
deleted file mode 100644
index e551ed5eeae..00000000000
--- a/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.requests.restore.terraform.json
+++ /dev/null
@@ -1,29 +0,0 @@
-{
-  "method": "GET",
-  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
-}
-{
-  "method": "GET",
-  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main"
-}
-{
-  "method": "GET",
-  "path": "/api/2.0/postgres/[MY_ENDPOINT_ID]"
-}
-{
-  "method": "PATCH",
-  "path": "/api/2.0/postgres/[MY_ENDPOINT_ID]",
-  "q": {
-    "update_mask": "spec"
-  },
-  "body": {
-    "name": "[MY_ENDPOINT_ID]",
-    "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
-    "spec": {
-      "autoscaling_limit_max_cu": 8,
-      "autoscaling_limit_min_cu": 0.5,
-      "endpoint_type": "ENDPOINT_TYPE_READ_ONLY",
-      "suspend_timeout_duration": "300s"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.requests.update.direct.json b/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.requests.update.json
similarity index 100%
rename from acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.requests.update.direct.json
rename to acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.requests.update.json
diff --git a/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.requests.update.terraform.json b/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.requests.update.terraform.json
deleted file mode 100644
index 26c0897d868..00000000000
--- a/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.requests.update.terraform.json
+++ /dev/null
@@ -1,29 +0,0 @@
-{
-  "method": "GET",
-  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
-}
-{
-  "method": "GET",
-  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main"
-}
-{
-  "method": "GET",
-  "path": "/api/2.0/postgres/[MY_ENDPOINT_ID]"
-}
-{
-  "method": "PATCH",
-  "path": "/api/2.0/postgres/[MY_ENDPOINT_ID]",
-  "q": {
-    "update_mask": "spec"
-  },
-  "body": {
-    "name": "[MY_ENDPOINT_ID]",
-    "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
-    "spec": {
-      "autoscaling_limit_max_cu": 4,
-      "autoscaling_limit_min_cu": 0.5,
-      "endpoint_type": "ENDPOINT_TYPE_READ_ONLY",
-      "suspend_timeout_duration": "300s"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.test.toml b/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.test.toml
index 110f841fa05..ee153e82621 100644
--- a/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.test.toml
+++ b/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/out.test.toml
@@ -1,6 +1,4 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
 CloudEnvs.azure = false
 CloudEnvs.gcp = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/output.txt b/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/output.txt
index 9192423fa68..1a613bbb5b8 100644
--- a/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/output.txt
+++ b/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/output.txt
@@ -20,35 +20,27 @@ Plan: 3 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-postgres-endpoint-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created postgres_branches.main
+Created postgres_endpoints.my_endpoint
+Created postgres_projects.my_project
+Files: 0 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
 
->>> print_requests.py --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
 
 >>> [CLI] postgres get-endpoint [MY_ENDPOINT_ID]
 {
+  "endpoint_id": "my-endpoint",
   "name": "[MY_ENDPOINT_ID]",
   "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
+  "uid": "[ENDPOINT_UID]",
   "status": {
-    "autoscaling_limit_max_cu": 8,
-    "autoscaling_limit_min_cu": 0.5,
-    "current_state": "ACTIVE",
-    "disabled": false,
+    "endpoint_id": "my-endpoint",
     "endpoint_type": "ENDPOINT_TYPE_READ_ONLY",
-    "group": {
-      "enable_readable_secondaries": true,
-      "max": 1,
-      "min": 1
-    },
-    "hosts": {
-      "host": "[ENDPOINT_UID].database.us-east-1.cloud.databricks.com",
-      "read_only_host": "[ENDPOINT_UID].database.us-east-1.cloud.databricks.com"
-    },
-    "settings": {},
+    "autoscaling_limit_min_cu": 0.5,
+    "autoscaling_limit_max_cu": 8,
     "suspend_timeout_duration": "300s"
-  },
-  "uid": "[ENDPOINT_UID]"
+  }
 }
 
 === Verify no changes
@@ -59,11 +51,10 @@ Plan: 0 to add, 0 to change, 0 to delete, 3 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-postgres-endpoint-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 3 unchanged
 
->>> print_requests.py --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
 
 === Update endpoint autoscaling and re-deploy
 >>> update_file.py databricks.yml autoscaling_limit_max_cu: 8 autoscaling_limit_max_cu: 4
@@ -107,35 +98,25 @@ Plan: 0 to add, 1 to change, 0 to delete, 2 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-postgres-endpoint-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated postgres_endpoints.my_endpoint
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 2 unchanged
 
->>> print_requests.py --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
 
 >>> [CLI] postgres get-endpoint [MY_ENDPOINT_ID]
 {
+  "endpoint_id": "my-endpoint",
   "name": "[MY_ENDPOINT_ID]",
   "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
+  "uid": "[ENDPOINT_UID]",
   "status": {
-    "autoscaling_limit_max_cu": 4,
-    "autoscaling_limit_min_cu": 0.5,
-    "current_state": "ACTIVE",
-    "disabled": false,
+    "endpoint_id": "my-endpoint",
     "endpoint_type": "ENDPOINT_TYPE_READ_ONLY",
-    "group": {
-      "enable_readable_secondaries": true,
-      "max": 1,
-      "min": 1
-    },
-    "hosts": {
-      "host": "[ENDPOINT_UID].database.us-east-1.cloud.databricks.com",
-      "read_only_host": "[ENDPOINT_UID].database.us-east-1.cloud.databricks.com"
-    },
-    "settings": {},
+    "autoscaling_limit_min_cu": 0.5,
+    "autoscaling_limit_max_cu": 4,
     "suspend_timeout_duration": "300s"
-  },
-  "uid": "[ENDPOINT_UID]"
+  }
 }
 
 === Restore endpoint autoscaling to original value
@@ -150,35 +131,25 @@ Plan: 0 to add, 1 to change, 0 to delete, 2 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-postgres-endpoint-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated postgres_endpoints.my_endpoint
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 2 unchanged
 
->>> print_requests.py --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
 
 >>> [CLI] postgres get-endpoint [MY_ENDPOINT_ID]
 {
+  "endpoint_id": "my-endpoint",
   "name": "[MY_ENDPOINT_ID]",
   "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
+  "uid": "[ENDPOINT_UID]",
   "status": {
-    "autoscaling_limit_max_cu": 8,
-    "autoscaling_limit_min_cu": 0.5,
-    "current_state": "ACTIVE",
-    "disabled": false,
+    "endpoint_id": "my-endpoint",
     "endpoint_type": "ENDPOINT_TYPE_READ_ONLY",
-    "group": {
-      "enable_readable_secondaries": true,
-      "max": 1,
-      "min": 1
-    },
-    "hosts": {
-      "host": "[ENDPOINT_UID].database.us-east-1.cloud.databricks.com",
-      "read_only_host": "[ENDPOINT_UID].database.us-east-1.cloud.databricks.com"
-    },
-    "settings": {},
+    "autoscaling_limit_min_cu": 0.5,
+    "autoscaling_limit_max_cu": 8,
     "suspend_timeout_duration": "300s"
-  },
-  "uid": "[ENDPOINT_UID]"
+  }
 }
 
 >>> [CLI] bundle destroy --auto-approve
@@ -197,5 +168,4 @@ All data stored in them will be permanently lost:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/update-postgres-endpoint-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 3 deleted
diff --git a/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/script b/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/script
index 07f1b9141b1..7862d827bdb 100755
--- a/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/script
+++ b/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/script
@@ -2,21 +2,21 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
    trace $CLI bundle destroy --auto-approve
-   rm -f out.requests.txt
+   rm -f "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
 print_requests() {
     local name=$1
-    trace print_requests.py --keep --get '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.${name}.$DATABRICKS_BUNDLE_ENGINE.json
-    rm -f out.requests.txt
+    trace print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.${name}.json
+    rm -f "$OUT_REQUESTS"
 }
 
 title "Initial deployment"
 trace $CLI bundle validate
 trace $CLI bundle plan
-trace $CLI bundle plan -o json | jq '.plan."resources.postgres_endpoints.my_endpoint" // .' > out.plan.create.$DATABRICKS_BUNDLE_ENGINE.json
-rm -f out.requests.txt
+trace $CLI bundle plan -o json | nostamp | jq '.plan."resources.postgres_endpoints.my_endpoint" // . | del(.remote_state)' > out.plan.create.json
+rm -f "$OUT_REQUESTS"
 trace $CLI bundle deploy
 
 print_requests create
@@ -25,12 +25,12 @@ project_name="projects/test-pg-proj-${UNIQUE_NAME}"
 branch_name="${project_name}/branches/main"
 endpoint_name="${branch_name}/endpoints/my-endpoint"
 endpoint_id_1=`read_id.py my_endpoint`
-trace $CLI postgres get-endpoint "${endpoint_name}" | jq 'del(.create_time, .update_time, .reconciling)'
+trace $CLI postgres get-endpoint "${endpoint_name}" | endpoint_fields
 
 title "Verify no changes"
 trace $CLI bundle plan
-trace $CLI bundle plan -o json | jq '.plan."resources.postgres_endpoints.my_endpoint" // .' > out.plan.no_change.$DATABRICKS_BUNDLE_ENGINE.json
-rm -f out.requests.txt
+trace $CLI bundle plan -o json | nostamp | jq '.plan."resources.postgres_endpoints.my_endpoint" // . | del(.remote_state)' > out.plan.no_change.json
+rm -f "$OUT_REQUESTS"
 trace $CLI bundle deploy
 
 print_requests no_change
@@ -40,22 +40,22 @@ trace update_file.py databricks.yml "autoscaling_limit_max_cu: 8" "autoscaling_l
 trace cat databricks.yml
 
 trace $CLI bundle plan
-trace $CLI bundle plan -o json | jq '.plan."resources.postgres_endpoints.my_endpoint" // .' > out.plan.update.$DATABRICKS_BUNDLE_ENGINE.json
-rm -f out.requests.txt
+trace $CLI bundle plan -o json | nostamp | jq '.plan."resources.postgres_endpoints.my_endpoint" // . | del(.remote_state)' > out.plan.update.json
+rm -f "$OUT_REQUESTS"
 trace $CLI bundle deploy
 
 print_requests update
 
 endpoint_id_2=`read_id.py my_endpoint`
-trace $CLI postgres get-endpoint "${endpoint_name}" | jq 'del(.create_time, .update_time, .reconciling)'
+trace $CLI postgres get-endpoint "${endpoint_name}" | endpoint_fields
 
 title "Restore endpoint autoscaling to original value"
 trace update_file.py databricks.yml "autoscaling_limit_max_cu: 4" "autoscaling_limit_max_cu: 8"
 trace $CLI bundle plan
-trace $CLI bundle plan -o json | jq '.plan."resources.postgres_endpoints.my_endpoint" // .' > out.plan.restore.$DATABRICKS_BUNDLE_ENGINE.json
-rm -f out.requests.txt
+trace $CLI bundle plan -o json | nostamp | jq '.plan."resources.postgres_endpoints.my_endpoint" // . | del(.remote_state)' > out.plan.restore.json
+rm -f "$OUT_REQUESTS"
 trace $CLI bundle deploy
 
 print_requests restore
 
-trace $CLI postgres get-endpoint "${endpoint_name}" | jq 'del(.create_time, .update_time, .reconciling)'
+trace $CLI postgres get-endpoint "${endpoint_name}" | endpoint_fields
diff --git a/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/test.toml b/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/test.toml
deleted file mode 100644
index f8b3bbe49dd..00000000000
--- a/acceptance/bundle/resources/postgres_endpoints/update_autoscaling/test.toml
+++ /dev/null
@@ -1 +0,0 @@
-# All configuration inherited from parent test.toml
diff --git a/acceptance/bundle/resources/postgres_endpoints/update_pg_settings/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_endpoints/update_pg_settings/databricks.yml.tmpl
new file mode 100644
index 00000000000..57e210af5c7
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_endpoints/update_pg_settings/databricks.yml.tmpl
@@ -0,0 +1,30 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-$UNIQUE_NAME
+      display_name: "Test Project for Endpoint pg_settings Update"
+      pg_version: 16
+      history_retention_duration: 604800s
+
+  postgres_branches:
+    main:
+      parent: ${resources.postgres_projects.my_project.id}
+      branch_id: main
+      no_expiry: true
+
+  postgres_endpoints:
+    my_endpoint:
+      parent: ${resources.postgres_branches.main.id}
+      endpoint_id: my-endpoint
+      endpoint_type: ENDPOINT_TYPE_READ_ONLY
+      autoscaling_limit_min_cu: 0.5
+      autoscaling_limit_max_cu: 8
+      settings:
+        pg_settings:
+          statement_timeout: 8000
diff --git a/acceptance/bundle/resources/postgres_endpoints/update_pg_settings/out.plan.json b/acceptance/bundle/resources/postgres_endpoints/update_pg_settings/out.plan.json
new file mode 100644
index 00000000000..1cb37958265
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_endpoints/update_pg_settings/out.plan.json
@@ -0,0 +1,42 @@
+{
+  "action": "update",
+  "changes": {
+    "autoscaling_limit_max_cu": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": 8,
+      "new": 8
+    },
+    "autoscaling_limit_min_cu": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": 0.5,
+      "new": 0.5
+    },
+    "endpoint_type": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": "ENDPOINT_TYPE_READ_ONLY",
+      "new": "ENDPOINT_TYPE_READ_ONLY",
+      "remote": ""
+    },
+    "settings": {
+      "action": "update",
+      "old": {
+        "pg_settings": {
+          "statement_timeout": "8000"
+        }
+      },
+      "new": {
+        "pg_settings": {
+          "statement_timeout": "16000"
+        }
+      }
+    },
+    "settings.pg_settings['statement_timeout']": {
+      "action": "update",
+      "old": "8000",
+      "new": "16000"
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_endpoints/update_pg_settings/out.requests.json b/acceptance/bundle/resources/postgres_endpoints/update_pg_settings/out.requests.json
new file mode 100644
index 00000000000..8e87c6f1861
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_endpoints/update_pg_settings/out.requests.json
@@ -0,0 +1,19 @@
+{
+  "method": "PATCH",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/endpoints/my-endpoint",
+  "q": {
+    "update_mask": "spec.settings.pg_settings"
+  },
+  "body": {
+    "spec": {
+      "autoscaling_limit_max_cu": 8,
+      "autoscaling_limit_min_cu": 0.5,
+      "endpoint_type": "ENDPOINT_TYPE_READ_ONLY",
+      "settings": {
+        "pg_settings": {
+          "statement_timeout": "16000"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_endpoints/update_pg_settings/out.test.toml b/acceptance/bundle/resources/postgres_endpoints/update_pg_settings/out.test.toml
new file mode 100644
index 00000000000..ee153e82621
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_endpoints/update_pg_settings/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_endpoints/update_pg_settings/output.txt b/acceptance/bundle/resources/postgres_endpoints/update_pg_settings/output.txt
new file mode 100644
index 00000000000..8bc4e2561b9
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_endpoints/update_pg_settings/output.txt
@@ -0,0 +1,49 @@
+
+=== Initial deployment with pg_settings.statement_timeout: 8000
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Created postgres_branches.main
+Created postgres_endpoints.my_endpoint
+Created postgres_projects.my_project
+Files: 0 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Change the value of one pg_settings key
+>>> update_file.py databricks.yml statement_timeout: 8000 statement_timeout: 16000
+
+>>> [CLI] bundle plan
+update postgres_endpoints.my_endpoint
+
+Plan: 0 to add, 1 to change, 0 to delete, 2 unchanged
+
+>>> [CLI] bundle plan -o json
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Updated postgres_endpoints.my_endpoint
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 2 unchanged
+
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id --sort //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+
+=== Plan again: the change must leave no drift behind
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 3 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.postgres_branches.main
+  delete resources.postgres_endpoints.my_endpoint
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase branches.
+All data stored in them will be permanently lost:
+  delete resources.postgres_branches.main
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
+
+Destroy: 3 deleted
diff --git a/acceptance/bundle/resources/postgres_endpoints/update_pg_settings/script b/acceptance/bundle/resources/postgres_endpoints/update_pg_settings/script
new file mode 100644
index 00000000000..936c97f018b
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_endpoints/update_pg_settings/script
@@ -0,0 +1,33 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+   trace $CLI bundle destroy --auto-approve
+   rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+endpoint_name="projects/test-pg-proj-${UNIQUE_NAME}/branches/main/endpoints/my-endpoint"
+
+title "Initial deployment with pg_settings.statement_timeout: 8000"
+trace $CLI bundle deploy
+rm -f "$OUT_REQUESTS"
+
+title "Change the value of one pg_settings key"
+trace update_file.py databricks.yml "statement_timeout: 8000" "statement_timeout: 16000"
+
+# pg_settings is a map, and the plan diffs maps entry by entry, so the changed path
+# is settings.pg_settings['statement_timeout']. A map or repeated field is
+# addressable only as a whole, so it has to be masked as spec.settings.pg_settings.
+# Verified against a real workspace on 2026-08-31: spec.settings and
+# spec.settings.pg_settings are both accepted, while an indexed path is answered with
+# 400 "Unknown field path in update_mask".
+trace $CLI bundle plan
+trace $CLI bundle plan -o json | nostamp | jq '.plan."resources.postgres_endpoints.my_endpoint" | {action, changes}' > out.plan.json
+rm -f "$OUT_REQUESTS"
+trace $CLI bundle deploy
+
+# The mask each engine sends: direct names the map, terraform replaces the whole spec.
+trace print_requests.py --del-body project_id,branch_id,endpoint_id --sort '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.json
+
+title "Plan again: the change must leave no drift behind"
+trace $CLI bundle plan
diff --git a/acceptance/bundle/resources/postgres_endpoints/update_suspend_timeout/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_endpoints/update_suspend_timeout/databricks.yml.tmpl
new file mode 100644
index 00000000000..dfd5bdd1127
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_endpoints/update_suspend_timeout/databricks.yml.tmpl
@@ -0,0 +1,28 @@
+bundle:
+  name: update-postgres-endpoint-suspend-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-$UNIQUE_NAME
+      display_name: "Test Project for Endpoint Suspend Timeout Update"
+      pg_version: 16
+      history_retention_duration: 604800s
+
+  postgres_branches:
+    main:
+      parent: ${resources.postgres_projects.my_project.id}
+      branch_id: main
+      no_expiry: true
+
+  postgres_endpoints:
+    my_endpoint:
+      parent: ${resources.postgres_branches.main.id}
+      endpoint_id: my-endpoint
+      endpoint_type: ENDPOINT_TYPE_READ_ONLY
+      autoscaling_limit_min_cu: 0.5
+      autoscaling_limit_max_cu: 8
+      suspend_timeout_duration: 300s
diff --git a/acceptance/bundle/resources/postgres_endpoints/update_suspend_timeout/out.plan.json b/acceptance/bundle/resources/postgres_endpoints/update_suspend_timeout/out.plan.json
new file mode 100644
index 00000000000..0ec428d2dab
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_endpoints/update_suspend_timeout/out.plan.json
@@ -0,0 +1,29 @@
+{
+  "action": "update",
+  "changes": {
+    "autoscaling_limit_max_cu": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": 8,
+      "new": 8
+    },
+    "autoscaling_limit_min_cu": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": 0.5,
+      "new": 0.5
+    },
+    "endpoint_type": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": "ENDPOINT_TYPE_READ_ONLY",
+      "new": "ENDPOINT_TYPE_READ_ONLY",
+      "remote": ""
+    },
+    "suspend_timeout_duration": {
+      "action": "update",
+      "old": "300s",
+      "new": "600s"
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_endpoints/update_suspend_timeout/out.requests.json b/acceptance/bundle/resources/postgres_endpoints/update_suspend_timeout/out.requests.json
new file mode 100644
index 00000000000..3acf526f897
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_endpoints/update_suspend_timeout/out.requests.json
@@ -0,0 +1,15 @@
+{
+  "method": "PATCH",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/endpoints/my-endpoint",
+  "q": {
+    "update_mask": "spec.suspension"
+  },
+  "body": {
+    "spec": {
+      "autoscaling_limit_max_cu": 8,
+      "autoscaling_limit_min_cu": 0.5,
+      "endpoint_type": "ENDPOINT_TYPE_READ_ONLY",
+      "suspend_timeout_duration": "600s"
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_endpoints/update_suspend_timeout/out.test.toml b/acceptance/bundle/resources/postgres_endpoints/update_suspend_timeout/out.test.toml
new file mode 100644
index 00000000000..ee153e82621
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_endpoints/update_suspend_timeout/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_endpoints/update_suspend_timeout/output.txt b/acceptance/bundle/resources/postgres_endpoints/update_suspend_timeout/output.txt
new file mode 100644
index 00000000000..68c0c87cbbb
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_endpoints/update_suspend_timeout/output.txt
@@ -0,0 +1,76 @@
+
+=== Initial deployment with suspend_timeout_duration: 300s
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-postgres-endpoint-suspend-[UNIQUE_NAME]/default/files...
+Created postgres_branches.main
+Created postgres_endpoints.my_endpoint
+Created postgres_projects.my_project
+Files: 0 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] postgres get-endpoint projects/test-pg-proj-[UNIQUE_NAME]/branches/main/endpoints/my-endpoint
+{
+  "endpoint_id": "my-endpoint",
+  "name": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main/endpoints/my-endpoint",
+  "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
+  "uid": "[ENDPOINT_UID]",
+  "status": {
+    "endpoint_id": "my-endpoint",
+    "endpoint_type": "ENDPOINT_TYPE_READ_ONLY",
+    "autoscaling_limit_min_cu": 0.5,
+    "autoscaling_limit_max_cu": 8,
+    "suspend_timeout_duration": "300s"
+  }
+}
+
+=== Change suspend_timeout_duration to 600s
+>>> update_file.py databricks.yml suspend_timeout_duration: 300s suspend_timeout_duration: 600s
+
+=== Plan and deploy
+>>> [CLI] bundle plan
+update postgres_endpoints.my_endpoint
+
+Plan: 0 to add, 1 to change, 0 to delete, 2 unchanged
+
+>>> [CLI] bundle plan -o json
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-postgres-endpoint-suspend-[UNIQUE_NAME]/default/files...
+Updated postgres_endpoints.my_endpoint
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 2 unchanged
+
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id --sort //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+
+>>> [CLI] postgres get-endpoint projects/test-pg-proj-[UNIQUE_NAME]/branches/main/endpoints/my-endpoint
+{
+  "endpoint_id": "my-endpoint",
+  "name": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main/endpoints/my-endpoint",
+  "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
+  "uid": "[ENDPOINT_UID]",
+  "status": {
+    "endpoint_id": "my-endpoint",
+    "endpoint_type": "ENDPOINT_TYPE_READ_ONLY",
+    "autoscaling_limit_min_cu": 0.5,
+    "autoscaling_limit_max_cu": 8,
+    "suspend_timeout_duration": "600s"
+  }
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.postgres_branches.main
+  delete resources.postgres_endpoints.my_endpoint
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase branches.
+All data stored in them will be permanently lost:
+  delete resources.postgres_branches.main
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/update-postgres-endpoint-suspend-[UNIQUE_NAME]/default
+
+Destroy: 3 deleted
diff --git a/acceptance/bundle/resources/postgres_endpoints/update_suspend_timeout/script b/acceptance/bundle/resources/postgres_endpoints/update_suspend_timeout/script
new file mode 100644
index 00000000000..8c6653dd7ff
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_endpoints/update_suspend_timeout/script
@@ -0,0 +1,36 @@
+# suspend_timeout_duration and no_suspension are two sides of one oneof, and the API
+# accepts them in update_mask only under the group name spec.suspension. out.requests.*.json
+# shows both engines applying the change: direct masks the group, the Terraform provider
+# masks the whole spec.
+
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+   trace $CLI bundle destroy --auto-approve
+   rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+endpoint_name="projects/test-pg-proj-${UNIQUE_NAME}/branches/main/endpoints/my-endpoint"
+
+title "Initial deployment with suspend_timeout_duration: 300s"
+trace $CLI bundle deploy
+rm -f "$OUT_REQUESTS"
+trace $CLI postgres get-endpoint "${endpoint_name}" | endpoint_fields
+
+title "Change suspend_timeout_duration to 600s"
+trace update_file.py databricks.yml "suspend_timeout_duration: 300s" "suspend_timeout_duration: 600s"
+
+title "Plan and deploy"
+
+# Both engines apply the change; only the mask they send differs, so out.requests
+# is the one per-engine file left.
+trace $CLI bundle plan
+trace $CLI bundle plan -o json | nostamp | jq '.plan."resources.postgres_endpoints.my_endpoint" | {action, changes}' > out.plan.json
+rm -f "$OUT_REQUESTS"
+trace $CLI bundle deploy
+
+# The update_mask each engine sends is the whole point of this test.
+trace print_requests.py --del-body project_id,branch_id,endpoint_id --sort '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.json
+
+trace $CLI postgres get-endpoint "${endpoint_name}" | endpoint_fields
diff --git a/acceptance/bundle/resources/postgres_endpoints/without_endpoint_id/out.deploy.direct.txt b/acceptance/bundle/resources/postgres_endpoints/without_endpoint_id/out.deploy.direct.txt
deleted file mode 100644
index 615af8b12bb..00000000000
--- a/acceptance/bundle/resources/postgres_endpoints/without_endpoint_id/out.deploy.direct.txt
+++ /dev/null
@@ -1,14 +0,0 @@
-Warning: required field "endpoint_id" is not set
-  at resources.postgres_endpoints.primary
-  in databricks.yml:27:7
-
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-endpoint-no-id-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Error: cannot create resources.postgres_endpoints.primary: Field 'endpoint_id' is required, expected non-default value (not "")! (400 INVALID_PARAMETER_VALUE)
-
-Endpoint: POST [DATABRICKS_URL]/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/endpoints
-HTTP Status: 400 Bad Request
-API error_code: INVALID_PARAMETER_VALUE
-API message: Field 'endpoint_id' is required, expected non-default value (not "")!
-
-Updating deployment state...
diff --git a/acceptance/bundle/resources/postgres_endpoints/without_endpoint_id/out.deploy.terraform.txt b/acceptance/bundle/resources/postgres_endpoints/without_endpoint_id/out.deploy.terraform.txt
deleted file mode 100644
index 5ae324b74eb..00000000000
--- a/acceptance/bundle/resources/postgres_endpoints/without_endpoint_id/out.deploy.terraform.txt
+++ /dev/null
@@ -1,15 +0,0 @@
-Warning: required field "endpoint_id" is not set
-  at resources.postgres_endpoints.primary
-  in databricks.yml:27:7
-
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-endpoint-no-id-[UNIQUE_NAME]/default/files...
-Error: exit status 1
-
-Error: Missing required argument
-
-  on bundle.tf.json line 31, in resource.databricks_postgres_endpoint.primary:
-  31:       }
-
-The argument "endpoint_id" is required, but no definition was found.
-
-
diff --git a/acceptance/bundle/resources/postgres_endpoints/without_endpoint_id/out.deploy.txt b/acceptance/bundle/resources/postgres_endpoints/without_endpoint_id/out.deploy.txt
new file mode 100644
index 00000000000..6aebf11934d
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_endpoints/without_endpoint_id/out.deploy.txt
@@ -0,0 +1,15 @@
+Warning: required field "endpoint_id" is not set
+  at resources.postgres_endpoints.primary
+  in databricks.yml:27:7
+
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-endpoint-no-id-[UNIQUE_NAME]/default/files...
+Created postgres_branches.main
+Created postgres_projects.my_project
+Error: cannot create resources.postgres_endpoints.primary: Field 'endpoint_id' is required, expected non-default value (not "")! (400 INVALID_PARAMETER_VALUE)
+
+Endpoint: POST [DATABRICKS_URL]/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/endpoints
+HTTP Status: 400 Bad Request
+API error_code: INVALID_PARAMETER_VALUE
+API message: Field 'endpoint_id' is required, expected non-default value (not "")!
+
+Files: 0 uploaded, 0 deleted
diff --git a/acceptance/bundle/resources/postgres_endpoints/without_endpoint_id/out.test.toml b/acceptance/bundle/resources/postgres_endpoints/without_endpoint_id/out.test.toml
index 110f841fa05..ee153e82621 100644
--- a/acceptance/bundle/resources/postgres_endpoints/without_endpoint_id/out.test.toml
+++ b/acceptance/bundle/resources/postgres_endpoints/without_endpoint_id/out.test.toml
@@ -1,6 +1,4 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
 CloudEnvs.azure = false
 CloudEnvs.gcp = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_endpoints/without_endpoint_id/script b/acceptance/bundle/resources/postgres_endpoints/without_endpoint_id/script
index 519a143b445..e72ccca30aa 100755
--- a/acceptance/bundle/resources/postgres_endpoints/without_endpoint_id/script
+++ b/acceptance/bundle/resources/postgres_endpoints/without_endpoint_id/script
@@ -2,11 +2,10 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
    $CLI bundle destroy --auto-approve > /dev/null 2>&1 || true
-   rm -f out.requests.txt
 }
 trap cleanup EXIT
 
 trace $CLI bundle validate
 
 # Deploy output differs between engines, so capture to per-engine file only
-$CLI bundle deploy > out.deploy.$DATABRICKS_BUNDLE_ENGINE.txt 2>&1 || true
+$CLI bundle deploy > out.deploy.txt 2>&1 || true
diff --git a/acceptance/bundle/resources/postgres_endpoints/without_endpoint_id/test.toml b/acceptance/bundle/resources/postgres_endpoints/without_endpoint_id/test.toml
index f8b3bbe49dd..a030353d571 100644
--- a/acceptance/bundle/resources/postgres_endpoints/without_endpoint_id/test.toml
+++ b/acceptance/bundle/resources/postgres_endpoints/without_endpoint_id/test.toml
@@ -1 +1 @@
-# All configuration inherited from parent test.toml
+RecordRequests = false
diff --git a/acceptance/bundle/resources/postgres_projects/add_default_endpoint_settings/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_projects/add_default_endpoint_settings/databricks.yml.tmpl
new file mode 100644
index 00000000000..ffeed8f7aab
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/add_default_endpoint_settings/databricks.yml.tmpl
@@ -0,0 +1,16 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-$UNIQUE_NAME
+      display_name: "Test Project for Adding Default Endpoint Settings"
+      pg_version: 16
+      history_retention_duration: 604800s
+#TO_ADD:       default_endpoint_settings:
+#TO_ADD:         autoscaling_limit_min_cu: 0.5
+#TO_ADD:         autoscaling_limit_max_cu: 4
diff --git a/acceptance/bundle/resources/postgres_projects/add_default_endpoint_settings/out.deploy.txt b/acceptance/bundle/resources/postgres_projects/add_default_endpoint_settings/out.deploy.txt
new file mode 100644
index 00000000000..e9fa2b4da16
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/add_default_endpoint_settings/out.deploy.txt
@@ -0,0 +1,11 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Error: cannot update resources.postgres_projects.my_project: updating id=projects/test-pg-proj-[UNIQUE_NAME]: Field 'spec.default_endpoint_settings.suspension' is in update_mask but not provided in request (400 INVALID_PARAMETER_VALUE)
+
+Endpoint: PATCH [DATABRICKS_URL]/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]?update_mask=spec.default_endpoint_settings
+HTTP Status: 400 Bad Request
+API error_code: INVALID_PARAMETER_VALUE
+API message: Field 'spec.default_endpoint_settings.suspension' is in update_mask but not provided in request
+
+Files: 0 uploaded, 0 deleted
+
+Exit code: 1
diff --git a/acceptance/bundle/resources/postgres_projects/add_default_endpoint_settings/out.plan.json b/acceptance/bundle/resources/postgres_projects/add_default_endpoint_settings/out.plan.json
new file mode 100644
index 00000000000..90a8ddd5c91
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/add_default_endpoint_settings/out.plan.json
@@ -0,0 +1,73 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.postgres_projects.my_project": {
+      "action": "update",
+      "new_state": {
+        "value": {
+          "default_endpoint_settings": {
+            "autoscaling_limit_max_cu": 4,
+            "autoscaling_limit_min_cu": 0.5
+          },
+          "display_name": "Test Project for Adding Default Endpoint Settings",
+          "history_retention_duration": "604800s",
+          "pg_version": 16,
+          "project_id": "test-pg-proj-[UNIQUE_NAME]"
+        }
+      },
+      "remote_state": {
+        "create_time": "[TIMESTAMP]",
+        "name": "projects/test-pg-proj-[UNIQUE_NAME]",
+        "project_id": "test-pg-proj-[UNIQUE_NAME]",
+        "status": {
+          "branch_logical_size_limit_bytes": [BRANCH_SIZE_LIMIT],
+          "default_branch": "projects/test-pg-proj-[UNIQUE_NAME]/branches/production",
+          "default_endpoint_settings": {
+            "autoscaling_limit_max_cu": 1,
+            "autoscaling_limit_min_cu": 1,
+            "suspend_timeout_duration": "86400s"
+          },
+          "display_name": "Test Project for Adding Default Endpoint Settings",
+          "enable_pg_native_login": false,
+          "history_retention_duration": "604800s",
+          "owner": "[USERNAME]",
+          "pg_version": 16,
+          "project_id": "test-pg-proj-[UNIQUE_NAME]",
+          "synthetic_storage_size_bytes": 0
+        },
+        "uid": "[UUID]",
+        "update_time": "[TIMESTAMP]"
+      },
+      "changes": {
+        "default_endpoint_settings": {
+          "action": "update",
+          "new": {
+            "autoscaling_limit_max_cu": 4,
+            "autoscaling_limit_min_cu": 0.5
+          }
+        },
+        "display_name": {
+          "action": "skip",
+          "reason": "spec:input_only",
+          "old": "Test Project for Adding Default Endpoint Settings",
+          "new": "Test Project for Adding Default Endpoint Settings"
+        },
+        "history_retention_duration": {
+          "action": "skip",
+          "reason": "spec:input_only",
+          "old": "604800s",
+          "new": "604800s"
+        },
+        "pg_version": {
+          "action": "skip",
+          "reason": "spec:input_only",
+          "old": 16,
+          "new": 16
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_projects/add_default_endpoint_settings/out.test.toml b/acceptance/bundle/resources/postgres_projects/add_default_endpoint_settings/out.test.toml
new file mode 100644
index 00000000000..ee153e82621
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/add_default_endpoint_settings/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_projects/add_default_endpoint_settings/output.txt b/acceptance/bundle/resources/postgres_projects/add_default_endpoint_settings/output.txt
new file mode 100644
index 00000000000..a7947234202
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/add_default_endpoint_settings/output.txt
@@ -0,0 +1,22 @@
+
+=== Initial deployment with no default_endpoint_settings block
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Created postgres_projects.my_project
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Add the whole default_endpoint_settings block and re-deploy
+>>> update_file.py databricks.yml #TO_ADD:  
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.my_project
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/postgres_projects/add_default_endpoint_settings/script b/acceptance/bundle/resources/postgres_projects/add_default_endpoint_settings/script
new file mode 100644
index 00000000000..7c442d6aae7
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/add_default_endpoint_settings/script
@@ -0,0 +1,24 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+   trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+title "Initial deployment with no default_endpoint_settings block"
+trace $CLI bundle deploy
+
+title "Add the whole default_endpoint_settings block and re-deploy"
+trace update_file.py databricks.yml "#TO_ADD: " ""
+
+# The direct plan's "changes" map is the structdiff artifact: it records one
+# change at path default_endpoint_settings (the whole block) instead of descending
+# to its leaves. (The top-level plan verdict is 'update' on both engines.)
+$CLI bundle plan -o json | nostamp > out.plan.json
+
+# The consequence shows up at deploy time, which diverges by engine, so route it to
+# per-engine files. Masking the whole message means the API requires the suspension
+# oneof in the body (see dresources/util.go), so the direct deploy FAILS with a 400;
+# terraform masks the leaf spec.default_endpoint_settings.autoscaling_limit_max_cu
+# and succeeds.
+errcode $CLI bundle deploy > out.deploy.txt 2>&1
diff --git a/acceptance/bundle/resources/postgres_projects/add_default_endpoint_settings/test.toml b/acceptance/bundle/resources/postgres_projects/add_default_endpoint_settings/test.toml
new file mode 100644
index 00000000000..648bd82593e
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/add_default_endpoint_settings/test.toml
@@ -0,0 +1,8 @@
+RecordRequests = false
+# Inherits Cloud = true from the parent. On a real workspace this validates that the
+# API still rejects a message-level update_mask exactly as the testserver models it
+# (libs/testserver/postgres.go, probed 2026-08-31): the direct deploy is expected to
+# 400 there (tolerated by errcode), while terraform masks the leaf and succeeds. Runs
+# on both engines; the divergent plan/deploy are routed to per-engine files.
+
+Badness = "On the direct engine, adding the whole default_endpoint_settings block produces update_mask=spec.default_endpoint_settings (the enclosing message) instead of the leaf spec.default_endpoint_settings.autoscaling_limit_max_cu, and the deploy FAILS with 400: 'Field spec.default_endpoint_settings.suspension is in update_mask but not provided in request'. Root cause: structdiff records one change at the block level instead of descending to leaves, so collectUpdatePathsWithPrefix masks the message. Terraform masks the leaf and succeeds."
diff --git a/acceptance/bundle/resources/postgres_projects/basic/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_projects/basic/databricks.yml.tmpl
index 140b9116c0e..c399622a738 100644
--- a/acceptance/bundle/resources/postgres_projects/basic/databricks.yml.tmpl
+++ b/acceptance/bundle/resources/postgres_projects/basic/databricks.yml.tmpl
@@ -9,6 +9,7 @@ resources:
     my_project:
       project_id: test-pg-proj-$UNIQUE_NAME
       display_name: "Test Postgres Project"
+      enable_pg_native_login: false
       pg_version: 16
       history_retention_duration: "604800s"
       default_endpoint_settings:
diff --git a/acceptance/bundle/resources/postgres_projects/basic/out.requests.json b/acceptance/bundle/resources/postgres_projects/basic/out.requests.json
index 938ae44f313..3ab697ae02a 100644
--- a/acceptance/bundle/resources/postgres_projects/basic/out.requests.json
+++ b/acceptance/bundle/resources/postgres_projects/basic/out.requests.json
@@ -12,6 +12,7 @@
         "suspend_timeout_duration": "300s"
       },
       "display_name": "Test Postgres Project",
+      "enable_pg_native_login": false,
       "history_retention_duration": "604800s",
       "pg_version": 16
     }
diff --git a/acceptance/bundle/resources/postgres_projects/basic/out.test.toml b/acceptance/bundle/resources/postgres_projects/basic/out.test.toml
index 110f841fa05..ee153e82621 100644
--- a/acceptance/bundle/resources/postgres_projects/basic/out.test.toml
+++ b/acceptance/bundle/resources/postgres_projects/basic/out.test.toml
@@ -1,6 +1,4 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
 CloudEnvs.azure = false
 CloudEnvs.gcp = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_projects/basic/output.txt b/acceptance/bundle/resources/postgres_projects/basic/output.txt
index 919f56ab17a..b9f0a693743 100644
--- a/acceptance/bundle/resources/postgres_projects/basic/output.txt
+++ b/acceptance/bundle/resources/postgres_projects/basic/output.txt
@@ -18,19 +18,19 @@ Resources:
   Postgres projects:
     my_project:
       Name: Test Postgres Project
-      URL:  (not deployed)
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-single-project-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created postgres_projects.my_project
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] postgres get-project projects/test-pg-proj-[UNIQUE_NAME]
 {
   "name": "projects/test-pg-proj-[UNIQUE_NAME]",
+  "project_id": "test-pg-proj-[UNIQUE_NAME]",
   "status": {
-    "branch_logical_size_limit_bytes": [NUMID],
+    "branch_logical_size_limit_bytes": [BRANCH_SIZE_LIMIT],
     "default_branch": "projects/test-pg-proj-[UNIQUE_NAME]/branches/production",
     "default_endpoint_settings": {
       "autoscaling_limit_max_cu": 4,
@@ -38,10 +38,11 @@ Deployment complete!
       "suspend_timeout_duration": "300s"
     },
     "display_name": "Test Postgres Project",
-    "enable_pg_native_login": true,
+    "enable_pg_native_login": false,
     "history_retention_duration": "604800s",
     "owner": "[USERNAME]",
     "pg_version": 16,
+    "project_id": "test-pg-proj-[UNIQUE_NAME]",
     "synthetic_storage_size_bytes": 0
   },
   "uid": "[UUID]"
@@ -57,9 +58,8 @@ Resources:
   Postgres projects:
     my_project:
       Name: Test Postgres Project
-      URL:  (not deployed)
 
->>> print_requests.py --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
@@ -71,5 +71,4 @@ all their branches, databases, and endpoints. All data stored in them will be pe
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-single-project-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/postgres_projects/basic/script b/acceptance/bundle/resources/postgres_projects/basic/script
index 46b0c884629..fe9968ef048 100755
--- a/acceptance/bundle/resources/postgres_projects/basic/script
+++ b/acceptance/bundle/resources/postgres_projects/basic/script
@@ -2,7 +2,7 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
    trace $CLI bundle destroy --auto-approve
-   rm -f out.requests.txt
+   rm -f "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
@@ -10,15 +10,15 @@ trace $CLI bundle validate
 
 trace $CLI bundle summary
 
-rm -f out.requests.txt
+rm -f "$OUT_REQUESTS"
 trace $CLI bundle deploy
 
 # Direct mode already waits for the project to be READY during deployment
 # Get project details - exclude timestamps that vary
-trace $CLI postgres get-project "projects/test-pg-proj-${UNIQUE_NAME}" | jq 'del(.create_time, .update_time)'
+trace $CLI postgres get-project "projects/test-pg-proj-${UNIQUE_NAME}" | project_fields
 
 trace $CLI bundle summary
 
 # Filter requests to only show postgres API operations (exclude workspace, telemetry, and operation polling)
-# Keep the original out.requests.txt for debugging
-trace print_requests.py --keep --get '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.json
+# Keep the original "$OUT_REQUESTS" for debugging
+trace print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.json
diff --git a/acceptance/bundle/resources/postgres_projects/basic/test.toml b/acceptance/bundle/resources/postgres_projects/basic/test.toml
deleted file mode 100644
index f8b3bbe49dd..00000000000
--- a/acceptance/bundle/resources/postgres_projects/basic/test.toml
+++ /dev/null
@@ -1 +0,0 @@
-# All configuration inherited from parent test.toml
diff --git a/acceptance/bundle/resources/postgres_projects/factcheck/test.toml b/acceptance/bundle/resources/postgres_projects/factcheck/test.toml
new file mode 100644
index 00000000000..7bcd836ad30
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/factcheck/test.toml
@@ -0,0 +1,16 @@
+# Raw-API factcheck: the same updates run under update_mask=* and update_mask=spec,
+# to document where the two masks agree and differ against the real API. No bundle,
+# no engine — run once.
+EnvMatrix.DMS = []
+
+[[Repls]]
+# * reports the first field missing from the body; which one is not contractual.
+Old = "Field 'spec\\.[a-z_.]+' is in update_mask but not provided"
+New = "Field '[SPEC_FIELD]' is in update_mask but not provided"
+Order = 1
+
+[[Repls]]
+# The whole-spec 500 carries a per-request trace id.
+Old = '\[TraceId: [0-9a-f]+\]'
+New = '[TraceId: [TRACE_ID]]'
+Order = 1
diff --git a/acceptance/bundle/resources/postgres_projects/factcheck/update_mask_spec/out.test.toml b/acceptance/bundle/resources/postgres_projects/factcheck/update_mask_spec/out.test.toml
new file mode 100644
index 00000000000..7306462483a
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/factcheck/update_mask_spec/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = []
diff --git a/acceptance/bundle/resources/postgres_projects/factcheck/update_mask_spec/output.txt b/acceptance/bundle/resources/postgres_projects/factcheck/update_mask_spec/output.txt
new file mode 100644
index 00000000000..315e46f8061
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/factcheck/update_mask_spec/output.txt
@@ -0,0 +1,150 @@
+
+=== Create accepts a minimal body; the server materializes the rest
+>>> [CLI] postgres get-project projects/factcheck-spec-[UNIQUE_NAME]
+{
+  "name": "projects/factcheck-spec-[UNIQUE_NAME]",
+  "project_id": "factcheck-spec-[UNIQUE_NAME]",
+  "status": {
+    "branch_logical_size_limit_bytes": [BRANCH_SIZE_LIMIT],
+    "default_branch": "projects/factcheck-spec-[UNIQUE_NAME]/branches/production",
+    "default_endpoint_settings": {
+      "autoscaling_limit_max_cu": 1,
+      "autoscaling_limit_min_cu": 1,
+      "suspend_timeout_duration": "86400s"
+    },
+    "display_name": "orig",
+    "enable_pg_native_login": false,
+    "history_retention_duration": "604800s",
+    "owner": "[USERNAME]",
+    "pg_version": 16,
+    "project_id": "factcheck-spec-[UNIQUE_NAME]",
+    "synthetic_storage_size_bytes": 0
+  },
+  "uid": "[UUID]"
+}
+
+=== update_mask=spec with a partial body (omits history_retention_duration + default_endpoint_settings)
+>>> [CLI] postgres update-project projects/factcheck-spec-[UNIQUE_NAME] spec --json {"spec":{"display_name":"changed","pg_version":16}}
+{
+  "name": "projects/factcheck-spec-[UNIQUE_NAME]",
+  "project_id": "factcheck-spec-[UNIQUE_NAME]",
+  "status": {
+    "branch_logical_size_limit_bytes": [BRANCH_SIZE_LIMIT],
+    "default_branch": "projects/factcheck-spec-[UNIQUE_NAME]/branches/production",
+    "default_endpoint_settings": {
+      "autoscaling_limit_max_cu": 1,
+      "autoscaling_limit_min_cu": 1,
+      "suspend_timeout_duration": "86400s"
+    },
+    "display_name": "changed",
+    "enable_pg_native_login": false,
+    "history_retention_duration": "604800s",
+    "owner": "[USERNAME]",
+    "pg_version": 16,
+    "project_id": "factcheck-spec-[UNIQUE_NAME]",
+    "synthetic_storage_size_bytes": 0
+  },
+  "uid": "[UUID]"
+}
+
+>>> print_requests.py //postgres/projects --method PATCH
+{
+  "method": "PATCH",
+  "path": "/api/2.0/postgres/projects/factcheck-spec-[UNIQUE_NAME]",
+  "q": {
+    "update_mask": "spec"
+  },
+  "body": {
+    "spec": {
+      "display_name": "changed",
+      "pg_version": 16
+    }
+  }
+}
+
+=== Set default_endpoint_settings to a non-default value (leaf mask)
+>>> [CLI] postgres get-project projects/factcheck-spec-[UNIQUE_NAME]
+{
+  "name": "projects/factcheck-spec-[UNIQUE_NAME]",
+  "project_id": "factcheck-spec-[UNIQUE_NAME]",
+  "status": {
+    "branch_logical_size_limit_bytes": [BRANCH_SIZE_LIMIT],
+    "default_branch": "projects/factcheck-spec-[UNIQUE_NAME]/branches/production",
+    "default_endpoint_settings": {
+      "autoscaling_limit_max_cu": 4,
+      "autoscaling_limit_min_cu": 0.5,
+      "suspend_timeout_duration": "300s"
+    },
+    "display_name": "changed",
+    "enable_pg_native_login": false,
+    "history_retention_duration": "604800s",
+    "owner": "[USERNAME]",
+    "pg_version": 16,
+    "project_id": "factcheck-spec-[UNIQUE_NAME]",
+    "synthetic_storage_size_bytes": 0
+  },
+  "uid": "[UUID]"
+}
+
+>>> print_requests.py //postgres/projects --method PATCH
+{
+  "method": "PATCH",
+  "path": "/api/2.0/postgres/projects/factcheck-spec-[UNIQUE_NAME]",
+  "q": {
+    "update_mask": "spec.default_endpoint_settings.autoscaling_limit_min_cu,spec.default_endpoint_settings.autoscaling_limit_max_cu,spec.default_endpoint_settings.suspension"
+  },
+  "body": {
+    "spec": {
+      "default_endpoint_settings": {
+        "autoscaling_limit_max_cu": 4,
+        "autoscaling_limit_min_cu": 0.5,
+        "suspend_timeout_duration": "300s"
+      }
+    }
+  }
+}
+
+=== update_mask=spec with a body that now omits the non-default default_endpoint_settings
+>>> [CLI] postgres update-project projects/factcheck-spec-[UNIQUE_NAME] spec --json {"spec":{"display_name":"changed2","pg_version":16,"history_retention_duration":"604800s"}}
+Error: The request could not be processed. Please try again later and contact Databricks if the problem persists. [TraceId: [TRACE_ID]]
+
+Exit code: 1
+
+>>> print_requests.py //postgres/projects --method PATCH
+{
+  "method": "PATCH",
+  "path": "/api/2.0/postgres/projects/factcheck-spec-[UNIQUE_NAME]",
+  "q": {
+    "update_mask": "spec"
+  },
+  "body": {
+    "spec": {
+      "display_name": "changed2",
+      "history_retention_duration": "604800s",
+      "pg_version": 16
+    }
+  }
+}
+
+>>> [CLI] postgres get-project projects/factcheck-spec-[UNIQUE_NAME]
+{
+  "name": "projects/factcheck-spec-[UNIQUE_NAME]",
+  "project_id": "factcheck-spec-[UNIQUE_NAME]",
+  "status": {
+    "branch_logical_size_limit_bytes": [BRANCH_SIZE_LIMIT],
+    "default_branch": "projects/factcheck-spec-[UNIQUE_NAME]/branches/production",
+    "default_endpoint_settings": {
+      "autoscaling_limit_max_cu": 4,
+      "autoscaling_limit_min_cu": 0.5,
+      "suspend_timeout_duration": "300s"
+    },
+    "display_name": "changed2",
+    "enable_pg_native_login": false,
+    "history_retention_duration": "604800s",
+    "owner": "[USERNAME]",
+    "pg_version": 16,
+    "project_id": "factcheck-spec-[UNIQUE_NAME]",
+    "synthetic_storage_size_bytes": 0
+  },
+  "uid": "[UUID]"
+}
diff --git a/acceptance/bundle/resources/postgres_projects/factcheck/update_mask_spec/script b/acceptance/bundle/resources/postgres_projects/factcheck/update_mask_spec/script
new file mode 100644
index 00000000000..a31e1f57ccd
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/factcheck/update_mask_spec/script
@@ -0,0 +1,44 @@
+# What update_mask=spec accepts on a postgres project, via raw $CLI (no bundle).
+# Identical sequence to ../update_mask_star, but masking spec instead of *; diff
+# the two output.txt files to see where the masks agree and differ. After each
+# update print_requests.py shows the exact PATCH sent.
+#
+# To run this outside the acceptance harness (against a real workspace), stub the
+# harness-provided helpers, then `bash` this file:
+#   export CLI=databricks UNIQUE_NAME=$(date +%s)
+#   trace()   { echo "+ $*" >&2; "$@"; }
+#   errcode() { "$@" || echo "Exit code: $?"; }
+#   title()   { printf '\n=== %s\n' "$*"; }
+#   project_fields()    { jq '{name, project_id, status}'; }
+#   print_requests.py() { :; }   # harness-only request recorder; no-op standalone
+
+pid="factcheck-spec-${UNIQUE_NAME}"
+name="projects/${pid}"
+
+cleanup() {
+    $CLI postgres delete-project "$name" --purge --no-wait &> LOG.cleanup || true
+    rm -f out.requests.txt
+}
+trap cleanup EXIT
+
+title "Create accepts a minimal body; the server materializes the rest"
+$CLI postgres create-project "$pid" --json '{"spec":{"display_name":"orig","pg_version":16}}' &> LOG.create
+trace $CLI postgres get-project "$name" | project_fields
+
+title "update_mask=spec with a partial body (omits history_retention_duration + default_endpoint_settings)"
+# spec is a patch, not a replace: it applies what is present and leaves the rest.
+errcode trace $CLI postgres update-project "$name" spec --json '{"spec":{"display_name":"changed","pg_version":16}}' | project_fields
+trace print_requests.py //postgres/projects --method PATCH
+
+title "Set default_endpoint_settings to a non-default value (leaf mask)"
+$CLI postgres update-project "$name" 'spec.default_endpoint_settings.autoscaling_limit_min_cu,spec.default_endpoint_settings.autoscaling_limit_max_cu,spec.default_endpoint_settings.suspension' --json '{"spec":{"default_endpoint_settings":{"autoscaling_limit_min_cu":0.5,"autoscaling_limit_max_cu":4,"suspend_timeout_duration":"300s"}}}' &> LOG.setup
+trace $CLI postgres get-project "$name" | project_fields
+trace print_requests.py //postgres/projects --method PATCH
+
+title "update_mask=spec with a body that now omits the non-default default_endpoint_settings"
+# 500: masking the whole spec resets the omitted sub-message and its emptied autoscaling
+# limits fail validation. The other fields are applied first, so it is a partial write —
+# the final read below shows display_name changed to changed2 while the response errored.
+errcode trace $CLI postgres update-project "$name" spec --json '{"spec":{"display_name":"changed2","pg_version":16,"history_retention_duration":"604800s"}}' | project_fields
+trace print_requests.py //postgres/projects --method PATCH
+trace $CLI postgres get-project "$name" | project_fields
diff --git a/acceptance/bundle/resources/postgres_projects/factcheck/update_mask_star/out.test.toml b/acceptance/bundle/resources/postgres_projects/factcheck/update_mask_star/out.test.toml
new file mode 100644
index 00000000000..7306462483a
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/factcheck/update_mask_star/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = []
diff --git a/acceptance/bundle/resources/postgres_projects/factcheck/update_mask_star/output.txt b/acceptance/bundle/resources/postgres_projects/factcheck/update_mask_star/output.txt
new file mode 100644
index 00000000000..e968375589b
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/factcheck/update_mask_star/output.txt
@@ -0,0 +1,132 @@
+
+=== Create accepts a minimal body; the server materializes the rest
+>>> [CLI] postgres get-project projects/factcheck-star-[UNIQUE_NAME]
+{
+  "name": "projects/factcheck-star-[UNIQUE_NAME]",
+  "project_id": "factcheck-star-[UNIQUE_NAME]",
+  "status": {
+    "branch_logical_size_limit_bytes": [BRANCH_SIZE_LIMIT],
+    "default_branch": "projects/factcheck-star-[UNIQUE_NAME]/branches/production",
+    "default_endpoint_settings": {
+      "autoscaling_limit_max_cu": 1,
+      "autoscaling_limit_min_cu": 1,
+      "suspend_timeout_duration": "86400s"
+    },
+    "display_name": "orig",
+    "enable_pg_native_login": false,
+    "history_retention_duration": "604800s",
+    "owner": "[USERNAME]",
+    "pg_version": 16,
+    "project_id": "factcheck-star-[UNIQUE_NAME]",
+    "synthetic_storage_size_bytes": 0
+  },
+  "uid": "[UUID]"
+}
+
+=== update_mask=* with a partial body (omits history_retention_duration + default_endpoint_settings)
+>>> [CLI] postgres update-project projects/factcheck-star-[UNIQUE_NAME] * --json {"spec":{"display_name":"changed","pg_version":16}}
+Error: Field '[SPEC_FIELD]' is in update_mask but not provided in request
+
+Exit code: 1
+
+>>> print_requests.py //postgres/projects --method PATCH
+{
+  "method": "PATCH",
+  "path": "/api/2.0/postgres/projects/factcheck-star-[UNIQUE_NAME]",
+  "q": {
+    "update_mask": "*"
+  },
+  "body": {
+    "spec": {
+      "display_name": "changed",
+      "pg_version": 16
+    }
+  }
+}
+
+=== Set default_endpoint_settings to a non-default value (leaf mask)
+>>> [CLI] postgres get-project projects/factcheck-star-[UNIQUE_NAME]
+{
+  "name": "projects/factcheck-star-[UNIQUE_NAME]",
+  "project_id": "factcheck-star-[UNIQUE_NAME]",
+  "status": {
+    "branch_logical_size_limit_bytes": [BRANCH_SIZE_LIMIT],
+    "default_branch": "projects/factcheck-star-[UNIQUE_NAME]/branches/production",
+    "default_endpoint_settings": {
+      "autoscaling_limit_max_cu": 4,
+      "autoscaling_limit_min_cu": 0.5,
+      "suspend_timeout_duration": "300s"
+    },
+    "display_name": "orig",
+    "enable_pg_native_login": false,
+    "history_retention_duration": "604800s",
+    "owner": "[USERNAME]",
+    "pg_version": 16,
+    "project_id": "factcheck-star-[UNIQUE_NAME]",
+    "synthetic_storage_size_bytes": 0
+  },
+  "uid": "[UUID]"
+}
+
+>>> print_requests.py //postgres/projects --method PATCH
+{
+  "method": "PATCH",
+  "path": "/api/2.0/postgres/projects/factcheck-star-[UNIQUE_NAME]",
+  "q": {
+    "update_mask": "spec.default_endpoint_settings.autoscaling_limit_min_cu,spec.default_endpoint_settings.autoscaling_limit_max_cu,spec.default_endpoint_settings.suspension"
+  },
+  "body": {
+    "spec": {
+      "default_endpoint_settings": {
+        "autoscaling_limit_max_cu": 4,
+        "autoscaling_limit_min_cu": 0.5,
+        "suspend_timeout_duration": "300s"
+      }
+    }
+  }
+}
+
+=== update_mask=* with a body that now omits the non-default default_endpoint_settings
+>>> [CLI] postgres update-project projects/factcheck-star-[UNIQUE_NAME] * --json {"spec":{"display_name":"changed2","pg_version":16,"history_retention_duration":"604800s"}}
+Error: Field '[SPEC_FIELD]' is in update_mask but not provided in request
+
+Exit code: 1
+
+>>> print_requests.py //postgres/projects --method PATCH
+{
+  "method": "PATCH",
+  "path": "/api/2.0/postgres/projects/factcheck-star-[UNIQUE_NAME]",
+  "q": {
+    "update_mask": "*"
+  },
+  "body": {
+    "spec": {
+      "display_name": "changed2",
+      "history_retention_duration": "604800s",
+      "pg_version": 16
+    }
+  }
+}
+
+>>> [CLI] postgres get-project projects/factcheck-star-[UNIQUE_NAME]
+{
+  "name": "projects/factcheck-star-[UNIQUE_NAME]",
+  "project_id": "factcheck-star-[UNIQUE_NAME]",
+  "status": {
+    "branch_logical_size_limit_bytes": [BRANCH_SIZE_LIMIT],
+    "default_branch": "projects/factcheck-star-[UNIQUE_NAME]/branches/production",
+    "default_endpoint_settings": {
+      "autoscaling_limit_max_cu": 4,
+      "autoscaling_limit_min_cu": 0.5,
+      "suspend_timeout_duration": "300s"
+    },
+    "display_name": "orig",
+    "enable_pg_native_login": false,
+    "history_retention_duration": "604800s",
+    "owner": "[USERNAME]",
+    "pg_version": 16,
+    "project_id": "factcheck-star-[UNIQUE_NAME]",
+    "synthetic_storage_size_bytes": 0
+  },
+  "uid": "[UUID]"
+}
diff --git a/acceptance/bundle/resources/postgres_projects/factcheck/update_mask_star/script b/acceptance/bundle/resources/postgres_projects/factcheck/update_mask_star/script
new file mode 100644
index 00000000000..8afce5004d1
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/factcheck/update_mask_star/script
@@ -0,0 +1,43 @@
+# What update_mask=* accepts on a postgres project, via raw $CLI (no bundle).
+# The same sequence runs in ../update_mask_spec under update_mask=spec; diff the
+# two output.txt files to see where the masks agree and differ. After each update
+# print_requests.py shows the exact PATCH sent (proving, e.g., that '*' reaches the
+# wire literally as update_mask=* rather than being shell-expanded).
+#
+# To run this outside the acceptance harness (against a real workspace), stub the
+# harness-provided helpers, then `bash` this file:
+#   export CLI=databricks UNIQUE_NAME=$(date +%s)
+#   trace()   { echo "+ $*" >&2; "$@"; }
+#   errcode() { "$@" || echo "Exit code: $?"; }
+#   title()   { printf '\n=== %s\n' "$*"; }
+#   project_fields()    { jq '{name, project_id, status}'; }
+#   print_requests.py() { :; }   # harness-only request recorder; no-op standalone
+
+pid="factcheck-star-${UNIQUE_NAME}"
+name="projects/${pid}"
+
+cleanup() {
+    $CLI postgres delete-project "$name" --purge --no-wait &> LOG.cleanup || true
+    rm -f out.requests.txt
+}
+trap cleanup EXIT
+
+title "Create accepts a minimal body; the server materializes the rest"
+$CLI postgres create-project "$pid" --json '{"spec":{"display_name":"orig","pg_version":16}}' &> LOG.create
+trace $CLI postgres get-project "$name" | project_fields
+
+title "update_mask=* with a partial body (omits history_retention_duration + default_endpoint_settings)"
+# * requires every field, so it rejects this body field by field.
+errcode trace $CLI postgres update-project "$name" '*' --json '{"spec":{"display_name":"changed","pg_version":16}}' | project_fields
+trace print_requests.py //postgres/projects --method PATCH
+
+title "Set default_endpoint_settings to a non-default value (leaf mask)"
+$CLI postgres update-project "$name" 'spec.default_endpoint_settings.autoscaling_limit_min_cu,spec.default_endpoint_settings.autoscaling_limit_max_cu,spec.default_endpoint_settings.suspension' --json '{"spec":{"default_endpoint_settings":{"autoscaling_limit_min_cu":0.5,"autoscaling_limit_max_cu":4,"suspend_timeout_duration":"300s"}}}' &> LOG.setup
+trace $CLI postgres get-project "$name" | project_fields
+trace print_requests.py //postgres/projects --method PATCH
+
+title "update_mask=* with a body that now omits the non-default default_endpoint_settings"
+# Still rejected: * demands every field regardless of what changed.
+errcode trace $CLI postgres update-project "$name" '*' --json '{"spec":{"display_name":"changed2","pg_version":16,"history_retention_duration":"604800s"}}' | project_fields
+trace print_requests.py //postgres/projects --method PATCH
+trace $CLI postgres get-project "$name" | project_fields
diff --git a/acceptance/bundle/resources/postgres_projects/purge_on_delete/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_projects/purge_on_delete/databricks.yml.tmpl
new file mode 100644
index 00000000000..44f05b0c885
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/purge_on_delete/databricks.yml.tmpl
@@ -0,0 +1,22 @@
+bundle:
+  name: deploy-postgres-purge-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+# Two projects side by side so the recorded destroy requests make the
+# purge_on_delete contrast obvious:
+#   - hard_delete:  purge_on_delete: true   -> DELETE …?purge=true
+#   - soft_delete:  field omitted (default) -> DELETE …    (no purge query)
+resources:
+  postgres_projects:
+    hard_delete:
+      project_id: test-pg-proj-hard-$UNIQUE_NAME
+      display_name: "purge_on_delete = true"
+      pg_version: 16
+      purge_on_delete: true
+
+    soft_delete:
+      project_id: test-pg-proj-soft-$UNIQUE_NAME
+      display_name: "purge_on_delete unset (soft delete)"
+      pg_version: 16
diff --git a/acceptance/bundle/resources/postgres_projects/purge_on_delete/out.destroy.txt b/acceptance/bundle/resources/postgres_projects/purge_on_delete/out.destroy.txt
new file mode 100644
index 00000000000..4945b3240dd
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/purge_on_delete/out.destroy.txt
@@ -0,0 +1,12 @@
+The following resources will be deleted:
+  delete resources.postgres_projects.hard_delete
+  delete resources.postgres_projects.soft_delete
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.hard_delete
+  delete resources.postgres_projects.soft_delete
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-purge-[UNIQUE_NAME]/default
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/postgres_projects/purge_on_delete/out.requests.deploy.json b/acceptance/bundle/resources/postgres_projects/purge_on_delete/out.requests.deploy.json
new file mode 100644
index 00000000000..a86773f6673
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/purge_on_delete/out.requests.deploy.json
@@ -0,0 +1,34 @@
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-hard-[UNIQUE_NAME]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-soft-[UNIQUE_NAME]"
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects",
+  "q": {
+    "project_id": "test-pg-proj-hard-[UNIQUE_NAME]"
+  },
+  "body": {
+    "spec": {
+      "display_name": "purge_on_delete = true",
+      "pg_version": 16
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects",
+  "q": {
+    "project_id": "test-pg-proj-soft-[UNIQUE_NAME]"
+  },
+  "body": {
+    "spec": {
+      "display_name": "purge_on_delete unset (soft delete)",
+      "pg_version": 16
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_projects/purge_on_delete/out.requests.destroy.json b/acceptance/bundle/resources/postgres_projects/purge_on_delete/out.requests.destroy.json
new file mode 100644
index 00000000000..dac7481daa0
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/purge_on_delete/out.requests.destroy.json
@@ -0,0 +1,19 @@
+{
+  "method": "DELETE",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-hard-[UNIQUE_NAME]",
+  "q": {
+    "purge": "true"
+  }
+}
+{
+  "method": "DELETE",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-soft-[UNIQUE_NAME]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-hard-[UNIQUE_NAME]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-soft-[UNIQUE_NAME]"
+}
diff --git a/acceptance/bundle/resources/postgres_projects/purge_on_delete/out.test.toml b/acceptance/bundle/resources/postgres_projects/purge_on_delete/out.test.toml
new file mode 100644
index 00000000000..ee153e82621
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/purge_on_delete/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_projects/purge_on_delete/output.txt b/acceptance/bundle/resources/postgres_projects/purge_on_delete/output.txt
new file mode 100644
index 00000000000..d0a4f3b91b8
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/purge_on_delete/output.txt
@@ -0,0 +1,67 @@
+
+>>> [CLI] bundle validate
+Name: deploy-postgres-purge-[UNIQUE_NAME]
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-purge-[UNIQUE_NAME]/default
+
+Validation OK!
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-purge-[UNIQUE_NAME]/default/files...
+Created postgres_projects.hard_delete
+Created postgres_projects.soft_delete
+Files: 0 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] postgres get-project projects/test-pg-proj-hard-[UNIQUE_NAME]
+{
+  "name": "projects/test-pg-proj-hard-[UNIQUE_NAME]",
+  "project_id": "test-pg-proj-hard-[UNIQUE_NAME]",
+  "status": {
+    "branch_logical_size_limit_bytes": [BRANCH_SIZE_LIMIT],
+    "default_branch": "projects/test-pg-proj-hard-[UNIQUE_NAME]/branches/production",
+    "default_endpoint_settings": {
+      "autoscaling_limit_max_cu": 1,
+      "autoscaling_limit_min_cu": 1,
+      "suspend_timeout_duration": "86400s"
+    },
+    "display_name": "purge_on_delete = true",
+    "enable_pg_native_login": false,
+    "history_retention_duration": "604800s",
+    "owner": "[USERNAME]",
+    "pg_version": 16,
+    "project_id": "test-pg-proj-hard-[UNIQUE_NAME]",
+    "synthetic_storage_size_bytes": 0
+  },
+  "uid": "[UUID]"
+}
+
+>>> [CLI] postgres get-project projects/test-pg-proj-soft-[UNIQUE_NAME]
+{
+  "name": "projects/test-pg-proj-soft-[UNIQUE_NAME]",
+  "project_id": "test-pg-proj-soft-[UNIQUE_NAME]",
+  "status": {
+    "branch_logical_size_limit_bytes": [BRANCH_SIZE_LIMIT],
+    "default_branch": "projects/test-pg-proj-soft-[UNIQUE_NAME]/branches/production",
+    "default_endpoint_settings": {
+      "autoscaling_limit_max_cu": 1,
+      "autoscaling_limit_min_cu": 1,
+      "suspend_timeout_duration": "86400s"
+    },
+    "display_name": "purge_on_delete unset (soft delete)",
+    "enable_pg_native_login": false,
+    "history_retention_duration": "604800s",
+    "owner": "[USERNAME]",
+    "pg_version": 16,
+    "project_id": "test-pg-proj-soft-[UNIQUE_NAME]",
+    "synthetic_storage_size_bytes": 0
+  },
+  "uid": "[UUID]"
+}
+
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --sort --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+
+=== bundle destroy
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --sort --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
diff --git a/acceptance/bundle/resources/postgres_projects/purge_on_delete/script b/acceptance/bundle/resources/postgres_projects/purge_on_delete/script
new file mode 100644
index 00000000000..5d965405116
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/purge_on_delete/script
@@ -0,0 +1,28 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+   # Belt-and-braces in case bundle destroy was skipped or partially failed.
+   # The soft-delete case leaves a record in the trash; --purge clears it.
+   $CLI postgres delete-project --purge "projects/test-pg-proj-hard-${UNIQUE_NAME}" 2>>LOG.delete-project || true
+   $CLI postgres delete-project --purge "projects/test-pg-proj-soft-${UNIQUE_NAME}" 2>>LOG.delete-project || true
+   rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+trace $CLI bundle validate
+
+rm -f "$OUT_REQUESTS"
+trace $CLI bundle deploy
+
+trace $CLI postgres get-project "projects/test-pg-proj-hard-${UNIQUE_NAME}" | project_fields
+trace $CLI postgres get-project "projects/test-pg-proj-soft-${UNIQUE_NAME}" | project_fields
+
+trace print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --sort --get '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.deploy.json
+
+# bundle destroy should send ?purge=true on the hard_delete project and no
+# purge query on the soft_delete project. Both DELETEs land in the recorded
+# requests so the contrast is visible in the diff.
+title "bundle destroy"
+$CLI bundle destroy --auto-approve > out.destroy.txt 2>&1 || true
+
+trace print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --sort --get '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.destroy.json
diff --git a/acceptance/bundle/resources/postgres_projects/purge_on_delete_transitions/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_projects/purge_on_delete_transitions/databricks.yml.tmpl
new file mode 100644
index 00000000000..7e98f348702
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/purge_on_delete_transitions/databricks.yml.tmpl
@@ -0,0 +1,17 @@
+bundle:
+  name: pg-purge-transitions-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+# Walks purge_on_delete through unset -> true -> false -> unset, deploying
+# at each step and inspecting the persisted state so reviewers can see that
+# state tracks the user's latest intent. The final destroy is a soft delete
+# (state has purge_on_delete unset), recorded for regression coverage.
+resources:
+  postgres_projects:
+    proj:
+      project_id: test-pg-proj-$UNIQUE_NAME
+      display_name: "Transitions test"
+      pg_version: 16
+      # PURGE_ON_DELETE
diff --git a/acceptance/bundle/resources/postgres_projects/purge_on_delete_transitions/out.destroy.txt b/acceptance/bundle/resources/postgres_projects/purge_on_delete_transitions/out.destroy.txt
new file mode 100644
index 00000000000..8af80c7c83b
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/purge_on_delete_transitions/out.destroy.txt
@@ -0,0 +1,10 @@
+The following resources will be deleted:
+  delete resources.postgres_projects.proj
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.proj
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/pg-purge-transitions-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/postgres_projects/purge_on_delete_transitions/out.requests.destroy.json b/acceptance/bundle/resources/postgres_projects/purge_on_delete_transitions/out.requests.destroy.json
new file mode 100644
index 00000000000..99384cda436
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/purge_on_delete_transitions/out.requests.destroy.json
@@ -0,0 +1,8 @@
+{
+  "method": "DELETE",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
+}
diff --git a/acceptance/bundle/resources/postgres_projects/purge_on_delete_transitions/out.test.toml b/acceptance/bundle/resources/postgres_projects/purge_on_delete_transitions/out.test.toml
new file mode 100644
index 00000000000..ee153e82621
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/purge_on_delete_transitions/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_projects/purge_on_delete_transitions/output.txt b/acceptance/bundle/resources/postgres_projects/purge_on_delete_transitions/output.txt
new file mode 100644
index 00000000000..f4d53b0ce18
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/purge_on_delete_transitions/output.txt
@@ -0,0 +1,43 @@
+
+=== Step 1: deploy with purge_on_delete unset
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/pg-purge-transitions-[UNIQUE_NAME]/default/files...
+Created postgres_projects.proj
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> get_purge
+(unset)
+
+=== Step 2: set purge_on_delete: true
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/pg-purge-transitions-[UNIQUE_NAME]/default/files...
+Updated postgres_projects.proj
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+>>> get_purge
+json.state.resources.postgres_projects.proj.state.purge_on_delete = true;
+
+=== Step 3: flip to purge_on_delete: false
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/pg-purge-transitions-[UNIQUE_NAME]/default/files...
+Updated postgres_projects.proj
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+>>> get_purge
+json.state.resources.postgres_projects.proj.state.purge_on_delete = false;
+
+=== Step 4: remove the line again
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/pg-purge-transitions-[UNIQUE_NAME]/default/files...
+Updated postgres_projects.proj
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+>>> get_purge
+(unset)
+
+=== bundle destroy (must be a plain DELETE, no ?purge=true)
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --sort --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
diff --git a/acceptance/bundle/resources/postgres_projects/purge_on_delete_transitions/script b/acceptance/bundle/resources/postgres_projects/purge_on_delete_transitions/script
new file mode 100644
index 00000000000..e80b4922cd9
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/purge_on_delete_transitions/script
@@ -0,0 +1,41 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+   # After this test the destroy should be a soft delete; --purge here so the
+   # trash entry doesn't linger past the test.
+   $CLI postgres delete-project --purge "projects/test-pg-proj-${UNIQUE_NAME}" 2>>LOG.delete-project || true
+   rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+# Prints the persisted purge_on_delete assignment from the direct engine's
+# resources.json. The field is omitted from JSON when unset (omitempty +
+# ForceSendFields tracking), so an absent value falls back to "(unset)".
+get_purge() {
+  print_state.py | gron.py | grep purge_on_delete || echo '(unset)'
+}
+
+title "Step 1: deploy with purge_on_delete unset"
+trace $CLI bundle deploy
+trace get_purge
+
+title "Step 2: set purge_on_delete: true"
+update_file.py databricks.yml "# PURGE_ON_DELETE" "purge_on_delete: true"
+trace $CLI bundle deploy
+trace get_purge
+
+title "Step 3: flip to purge_on_delete: false"
+update_file.py databricks.yml "purge_on_delete: true" "purge_on_delete: false"
+trace $CLI bundle deploy
+trace get_purge
+
+title "Step 4: remove the line again"
+update_file.py databricks.yml "purge_on_delete: false" "# PURGE_ON_DELETE"
+trace $CLI bundle deploy
+trace get_purge
+
+rm -f "$OUT_REQUESTS"
+
+title "bundle destroy (must be a plain DELETE, no ?purge=true)"
+$CLI bundle destroy --auto-approve > out.destroy.txt 2>&1 || true
+trace print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --sort --get '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.destroy.json
diff --git a/acceptance/bundle/resources/postgres_projects/recreate/out.get_project.txt b/acceptance/bundle/resources/postgres_projects/recreate/out.get_project.txt
index 463738d93e1..be906bc896d 100644
--- a/acceptance/bundle/resources/postgres_projects/recreate/out.get_project.txt
+++ b/acceptance/bundle/resources/postgres_projects/recreate/out.get_project.txt
@@ -1,8 +1,8 @@
 {
-  "create_time": "[TIMESTAMP]",
   "name": "[MY_PROJECT_ID_2]",
+  "project_id": "test-pg-new-[UNIQUE_NAME]",
   "status": {
-    "branch_logical_size_limit_bytes": [NUMID],
+    "branch_logical_size_limit_bytes": [BRANCH_SIZE_LIMIT],
     "default_branch": "[MY_PROJECT_ID_2]/branches/production",
     "default_endpoint_settings": {
       "autoscaling_limit_max_cu": 4,
@@ -10,12 +10,12 @@
       "suspend_timeout_duration": "300s"
     },
     "display_name": "Test Recreate",
-    "enable_pg_native_login": true,
+    "enable_pg_native_login": false,
     "history_retention_duration": "604800s",
     "owner": "[USERNAME]",
     "pg_version": 16,
+    "project_id": "test-pg-new-[UNIQUE_NAME]",
     "synthetic_storage_size_bytes": 0
   },
-  "uid": "[UUID]",
-  "update_time": "[TIMESTAMP]"
+  "uid": "[UUID]"
 }
diff --git a/acceptance/bundle/resources/postgres_projects/recreate/out.requests.create.txt b/acceptance/bundle/resources/postgres_projects/recreate/out.requests.create.txt
index e0bb397af98..4ee3402fd27 100644
--- a/acceptance/bundle/resources/postgres_projects/recreate/out.requests.create.txt
+++ b/acceptance/bundle/resources/postgres_projects/recreate/out.requests.create.txt
@@ -1,4 +1,9 @@
 {
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects",
+  "q": {
+    "project_id": "test-pg-old-[UNIQUE_NAME]"
+  },
   "body": {
     "spec": {
       "default_endpoint_settings": {
@@ -10,10 +15,5 @@
       "history_retention_duration": "604800s",
       "pg_version": 16
     }
-  },
-  "method": "POST",
-  "path": "/api/2.0/postgres/projects",
-  "q": {
-    "project_id": "test-pg-old-[UNIQUE_NAME]"
   }
 }
diff --git a/acceptance/bundle/resources/postgres_projects/recreate/out.requests.update.txt b/acceptance/bundle/resources/postgres_projects/recreate/out.requests.update.txt
index a15cfde30f8..fc8b1d408cf 100644
--- a/acceptance/bundle/resources/postgres_projects/recreate/out.requests.update.txt
+++ b/acceptance/bundle/resources/postgres_projects/recreate/out.requests.update.txt
@@ -3,6 +3,11 @@
   "path": "/api/2.0/postgres/[MY_PROJECT_ID]"
 }
 {
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects",
+  "q": {
+    "project_id": "test-pg-new-[UNIQUE_NAME]"
+  },
   "body": {
     "spec": {
       "default_endpoint_settings": {
@@ -14,10 +19,5 @@
       "history_retention_duration": "604800s",
       "pg_version": 16
     }
-  },
-  "method": "POST",
-  "path": "/api/2.0/postgres/projects",
-  "q": {
-    "project_id": "test-pg-new-[UNIQUE_NAME]"
   }
 }
diff --git a/acceptance/bundle/resources/postgres_projects/recreate/out.test.toml b/acceptance/bundle/resources/postgres_projects/recreate/out.test.toml
index 110f841fa05..ee153e82621 100644
--- a/acceptance/bundle/resources/postgres_projects/recreate/out.test.toml
+++ b/acceptance/bundle/resources/postgres_projects/recreate/out.test.toml
@@ -1,6 +1,4 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
 CloudEnvs.azure = false
 CloudEnvs.gcp = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_projects/recreate/output.txt b/acceptance/bundle/resources/postgres_projects/recreate/output.txt
index dad581aa51e..eb9d70a8a15 100644
--- a/acceptance/bundle/resources/postgres_projects/recreate/output.txt
+++ b/acceptance/bundle/resources/postgres_projects/recreate/output.txt
@@ -25,9 +25,9 @@ Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-recreate-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created postgres_projects.my_project
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 === Change project_id (should trigger recreation in direct, update in terraform)
 >>> cat databricks.yml
@@ -55,9 +55,9 @@ Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-re
 This action will result in the deletion or recreation of the following Lakebase projects along with
 all their branches, databases, and endpoints. All data stored in them will be permanently lost:
   recreate resources.postgres_projects.my_project
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Recreated postgres_projects.my_project
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 0 unchanged
 
 === Fetch new project ID
 === Destroy and verify cleanup
@@ -71,8 +71,10 @@ all their branches, databases, and endpoints. All data stored in them will be pe
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-recreate-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
+
+=== Old project is gone after recreate
+Old project is deleted
 
 >>> [CLI] bundle destroy --auto-approve
 No active deployment found to destroy!
diff --git a/acceptance/bundle/resources/postgres_projects/recreate/script b/acceptance/bundle/resources/postgres_projects/recreate/script
index 422b6257001..3d539655db2 100644
--- a/acceptance/bundle/resources/postgres_projects/recreate/script
+++ b/acceptance/bundle/resources/postgres_projects/recreate/script
@@ -6,7 +6,7 @@ cleanup() {
    # Also try to delete the old project directly in case it wasn't cleaned up
    $CLI postgres delete-project "projects/test-pg-old-${UNIQUE_NAME}" 2>/dev/null || true
 
-   rm -f out.requests.txt
+   rm -f "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
@@ -16,18 +16,12 @@ envsubst < databricks.yml.tmpl | sed "s/PROJECT_ID_PLACEHOLDER/test-pg-old-${UNI
 trace cat databricks.yml
 
 trace $CLI bundle plan
-rm -f out.requests.txt
+rm -f "$OUT_REQUESTS"
 trace $CLI bundle deploy
 
 project_id_1=`read_id.py my_project`
 
-print_requests() {
-    local name=$1
-    jq --sort-keys 'select(.method != "GET" and (.path | contains("/postgres")))' < out.requests.txt > out.requests.${name}.txt
-    rm -f out.requests.txt
-}
-
-print_requests create
+print_requests.py --del-body parent,project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.create.txt
 
 title "Change project_id (should trigger recreation in direct, update in terraform)"
 sed "s/test-pg-old-${UNIQUE_NAME}/test-pg-new-${UNIQUE_NAME}/" databricks.yml > databricks.yml.new
@@ -39,17 +33,21 @@ trace cat databricks.yml
 $CLI bundle plan > out.plan.txt 2>&1
 trace $CLI bundle deploy --auto-approve
 
-print_requests update
+print_requests.py --del-body parent,project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.update.txt
 
 title "Fetch new project ID"
 project_id_2=`read_id.py my_project`
 # Get output differs between engines (different project IDs)
-$CLI postgres get-project $project_id_2 > out.get_project.txt
+$CLI postgres get-project $project_id_2 | project_fields > out.get_project.txt
 
 title "Destroy and verify cleanup"
 trace $CLI bundle destroy --auto-approve
 
-print_requests destroy
+print_requests.py --del-body parent,project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.destroy.txt
 
-# Clean up any orphaned old project (terraform doesn't delete it on recreation)
-$CLI postgres delete-project $project_id_1 2>/dev/null || true
+title "Old project is gone after recreate"
+echo
+# Local testserver returns not found; the cloud soft-deletes and returns the project with delete_time set.
+errcode $CLI postgres get-project $project_id_1 &> old_project.tmp
+grep -q -e 'not found' -e '"delete_time"' old_project.tmp && echo "Old project is deleted" || echo "Old project still exists"
+rm old_project.tmp
diff --git a/acceptance/bundle/resources/postgres_projects/recreate/test.toml b/acceptance/bundle/resources/postgres_projects/recreate/test.toml
index ea1db177791..76d7c84608e 100644
--- a/acceptance/bundle/resources/postgres_projects/recreate/test.toml
+++ b/acceptance/bundle/resources/postgres_projects/recreate/test.toml
@@ -1,5 +1,5 @@
 [[Repls]]
-# Normalize TraceId in error messages (run before default NUMID replacement at Order 9-10)
+# Normalize TraceId in error messages
 Old = 'TraceId: [a-f0-9]+'
 New = 'TraceId: [TRACE_ID]'
 Order = 1
diff --git a/acceptance/bundle/resources/postgres_projects/remove_history_retention/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_projects/remove_history_retention/databricks.yml.tmpl
new file mode 100644
index 00000000000..39e4df1dc88
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/remove_history_retention/databricks.yml.tmpl
@@ -0,0 +1,13 @@
+bundle:
+  name: remove-postgres-project-retention-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-$UNIQUE_NAME
+      display_name: "Test Project for History Retention Update"
+      pg_version: 16
+      history_retention_duration: 604800s
diff --git a/acceptance/bundle/resources/postgres_projects/remove_history_retention/out.deploy.txt b/acceptance/bundle/resources/postgres_projects/remove_history_retention/out.deploy.txt
new file mode 100644
index 00000000000..43f53f98801
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/remove_history_retention/out.deploy.txt
@@ -0,0 +1,11 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/remove-postgres-project-retention-[UNIQUE_NAME]/default/files...
+Error: cannot update resources.postgres_projects.my_project: updating id=projects/test-pg-proj-[UNIQUE_NAME]: Field 'spec.history_retention_duration' is in update_mask but not provided in request (400 INVALID_PARAMETER_VALUE)
+
+Endpoint: PATCH [DATABRICKS_URL]/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]?update_mask=spec.history_retention_duration
+HTTP Status: 400 Bad Request
+API error_code: INVALID_PARAMETER_VALUE
+API message: Field 'spec.history_retention_duration' is in update_mask but not provided in request
+
+Files: 0 uploaded, 0 deleted
+
+Exit code: 1
diff --git a/acceptance/bundle/resources/postgres_projects/remove_history_retention/out.plan.drift.json b/acceptance/bundle/resources/postgres_projects/remove_history_retention/out.plan.drift.json
new file mode 100644
index 00000000000..156a5dd37d3
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/remove_history_retention/out.plan.drift.json
@@ -0,0 +1,21 @@
+{
+  "action": "update",
+  "changes": {
+    "display_name": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": "Test Project for History Retention Update",
+      "new": "Test Project for History Retention Update"
+    },
+    "history_retention_duration": {
+      "action": "update",
+      "old": "604800s"
+    },
+    "pg_version": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": 16,
+      "new": 16
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_projects/remove_history_retention/out.plan.drift.txt b/acceptance/bundle/resources/postgres_projects/remove_history_retention/out.plan.drift.txt
new file mode 100644
index 00000000000..a622ace9faa
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/remove_history_retention/out.plan.drift.txt
@@ -0,0 +1,5 @@
+
+>>> [CLI] bundle plan
+update postgres_projects.my_project
+
+Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
diff --git a/acceptance/bundle/resources/postgres_projects/remove_history_retention/out.plan.json b/acceptance/bundle/resources/postgres_projects/remove_history_retention/out.plan.json
new file mode 100644
index 00000000000..156a5dd37d3
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/remove_history_retention/out.plan.json
@@ -0,0 +1,21 @@
+{
+  "action": "update",
+  "changes": {
+    "display_name": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": "Test Project for History Retention Update",
+      "new": "Test Project for History Retention Update"
+    },
+    "history_retention_duration": {
+      "action": "update",
+      "old": "604800s"
+    },
+    "pg_version": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": 16,
+      "new": 16
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_projects/remove_history_retention/out.project.txt b/acceptance/bundle/resources/postgres_projects/remove_history_retention/out.project.txt
new file mode 100644
index 00000000000..fc67fa188ff
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/remove_history_retention/out.project.txt
@@ -0,0 +1,21 @@
+{
+  "name": "projects/test-pg-proj-[UNIQUE_NAME]",
+  "project_id": "test-pg-proj-[UNIQUE_NAME]",
+  "status": {
+    "branch_logical_size_limit_bytes": [BRANCH_SIZE_LIMIT],
+    "default_branch": "projects/test-pg-proj-[UNIQUE_NAME]/branches/production",
+    "default_endpoint_settings": {
+      "autoscaling_limit_max_cu": 1,
+      "autoscaling_limit_min_cu": 1,
+      "suspend_timeout_duration": "86400s"
+    },
+    "display_name": "Test Project for History Retention Update",
+    "enable_pg_native_login": false,
+    "history_retention_duration": "604800s",
+    "owner": "[USERNAME]",
+    "pg_version": 16,
+    "project_id": "test-pg-proj-[UNIQUE_NAME]",
+    "synthetic_storage_size_bytes": 0
+  },
+  "uid": "[UUID]"
+}
diff --git a/acceptance/bundle/resources/postgres_projects/remove_history_retention/out.requests.json b/acceptance/bundle/resources/postgres_projects/remove_history_retention/out.requests.json
new file mode 100644
index 00000000000..3db270dc252
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/remove_history_retention/out.requests.json
@@ -0,0 +1,13 @@
+{
+  "method": "PATCH",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]",
+  "q": {
+    "update_mask": "spec.history_retention_duration"
+  },
+  "body": {
+    "spec": {
+      "display_name": "Test Project for History Retention Update",
+      "pg_version": 16
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_projects/remove_history_retention/out.test.toml b/acceptance/bundle/resources/postgres_projects/remove_history_retention/out.test.toml
new file mode 100644
index 00000000000..ee153e82621
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/remove_history_retention/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_projects/remove_history_retention/output.txt b/acceptance/bundle/resources/postgres_projects/remove_history_retention/output.txt
new file mode 100644
index 00000000000..ec3dd1a62e4
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/remove_history_retention/output.txt
@@ -0,0 +1,58 @@
+
+=== Initial deployment with history_retention_duration: 604800s
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/remove-postgres-project-retention-[UNIQUE_NAME]/default/files...
+Created postgres_projects.my_project
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] postgres get-project projects/test-pg-proj-[UNIQUE_NAME]
+{
+  "name": "projects/test-pg-proj-[UNIQUE_NAME]",
+  "project_id": "test-pg-proj-[UNIQUE_NAME]",
+  "status": {
+    "branch_logical_size_limit_bytes": [BRANCH_SIZE_LIMIT],
+    "default_branch": "projects/test-pg-proj-[UNIQUE_NAME]/branches/production",
+    "default_endpoint_settings": {
+      "autoscaling_limit_max_cu": 1,
+      "autoscaling_limit_min_cu": 1,
+      "suspend_timeout_duration": "86400s"
+    },
+    "display_name": "Test Project for History Retention Update",
+    "enable_pg_native_login": false,
+    "history_retention_duration": "604800s",
+    "owner": "[USERNAME]",
+    "pg_version": 16,
+    "project_id": "test-pg-proj-[UNIQUE_NAME]",
+    "synthetic_storage_size_bytes": 0
+  },
+  "uid": "[UUID]"
+}
+
+=== Remove history_retention_duration and re-deploy
+>>> update_file.py databricks.yml       history_retention_duration: 604800s 
+
+>>> [CLI] bundle plan
+update postgres_projects.my_project
+
+Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
+
+>>> [CLI] bundle plan -o json
+
+>>> print_requests.py --del-body project_id --sort //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+
+>>> [CLI] postgres get-project projects/test-pg-proj-[UNIQUE_NAME]
+
+>>> [CLI] bundle plan -o json
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.my_project
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/remove-postgres-project-retention-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/postgres_projects/remove_history_retention/script b/acceptance/bundle/resources/postgres_projects/remove_history_retention/script
new file mode 100644
index 00000000000..99ff406c0c0
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/remove_history_retention/script
@@ -0,0 +1,28 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+   trace $CLI bundle destroy --auto-approve
+   rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+project_name="projects/test-pg-proj-${UNIQUE_NAME}"
+
+title "Initial deployment with history_retention_duration: 604800s"
+trace $CLI bundle deploy
+rm -f "$OUT_REQUESTS"
+trace $CLI postgres get-project "${project_name}" | project_fields
+
+title "Remove history_retention_duration and re-deploy"
+trace update_file.py databricks.yml "      history_retention_duration: 604800s" ""
+trace $CLI bundle plan
+trace $CLI bundle plan -o json | nostamp | jq '.plan."resources.postgres_projects.my_project" | {action, changes}' > out.plan.json
+rm -f "$OUT_REQUESTS"
+errcode $CLI bundle deploy &> out.deploy.txt
+trace print_requests.py --del-body project_id --sort '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.json
+
+# Read the project back to see whether the removal reached it, then plan again to
+# record the drift it leaves behind.
+trace $CLI postgres get-project "${project_name}" | project_fields > out.project.txt
+trace $CLI bundle plan &> out.plan.drift.txt
+trace $CLI bundle plan -o json | nostamp | jq '.plan."resources.postgres_projects.my_project" | {action, changes}' > out.plan.drift.json
diff --git a/acceptance/bundle/resources/postgres_projects/remove_history_retention/test.toml b/acceptance/bundle/resources/postgres_projects/remove_history_retention/test.toml
new file mode 100644
index 00000000000..efa6e2c01e2
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/remove_history_retention/test.toml
@@ -0,0 +1,7 @@
+# Removing history_retention_duration is rejected. The engine names the field in
+# update_mask and omits it from the body, and the API requires every masked field to
+# carry a value: 400 "Field 'spec.history_retention_duration' is in update_mask but
+# not provided in request" (verified against a real workspace on 2026-08-28). The old
+# value therefore stays in state, so out.plan.drift.direct.json shows the same
+# removal pending again, and every later deploy fails the same way.
+Badness = "Removing history_retention_duration fails: the field is named in update_mask but omitted from the body, which the API rejects, so the removal can never be applied and every later deploy retries and fails"
diff --git a/acceptance/bundle/resources/postgres_projects/script.prepare b/acceptance/bundle/resources/postgres_projects/script.prepare
new file mode 100644
index 00000000000..1386ff1169c
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/script.prepare
@@ -0,0 +1,6 @@
+# project_fields is the allow-list of project fields the acceptance tests assert
+# on. Anything the backend returns outside this list is dropped, so a new field
+# in the API response does not break the golden.
+project_fields() {
+    jq '{name, project_id, status: (.status | {branch_logical_size_limit_bytes, default_branch, default_endpoint_settings, display_name, enable_pg_native_login, history_retention_duration, owner, pg_version, project_id, synthetic_storage_size_bytes}), uid}'
+}
diff --git a/acceptance/bundle/resources/postgres_projects/test.toml b/acceptance/bundle/resources/postgres_projects/test.toml
index 4e67bd684f3..0f0da63edf4 100644
--- a/acceptance/bundle/resources/postgres_projects/test.toml
+++ b/acceptance/bundle/resources/postgres_projects/test.toml
@@ -1,13 +1,10 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
 
 # Lakebase v2 (postgres) is only available in AWS as of January 2026
 CloudEnvs.gcp = false
 CloudEnvs.azure = false
 
 # Run on both direct and Terraform modes
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
 
 Ignore = [
     "databricks.yml",
@@ -15,8 +12,8 @@ Ignore = [
 ]
 
 [[Repls]]
-# Clean up ?o=<num> suffix after URL since not all workspaces have that
-Old = '\?o=\[(NUMID|ALPHANUMID)\]'
+# Clean up ?[ow]=<num> suffix after URL since not all workspaces have that
+Old = '\?[ow]=\[(WORKSPACE_ID|ALPHANUMID)\]'
 New = ''
 Order = 1000
 
@@ -31,3 +28,8 @@ Order = 1
 Old = '/operations/[A-Za-z0-9+/=]+'
 New = '/operations/[OPERATION_ID]'
 Order = 2000
+
+[[Repls]]
+# Backend default that differs per cloud (8 TiB on the testserver and gcp, 32 TiB on aws).
+Old = '"branch_logical_size_limit_bytes": \d+'
+New = '"branch_logical_size_limit_bytes": [BRANCH_SIZE_LIMIT]'
diff --git a/acceptance/bundle/resources/postgres_projects/update_default_endpoint_autoscaling/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_projects/update_default_endpoint_autoscaling/databricks.yml.tmpl
new file mode 100644
index 00000000000..ae1d307483a
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/update_default_endpoint_autoscaling/databricks.yml.tmpl
@@ -0,0 +1,16 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-$UNIQUE_NAME
+      display_name: "Test Project for Default Endpoint Autoscaling"
+      pg_version: 16
+      history_retention_duration: 604800s
+      default_endpoint_settings:
+        autoscaling_limit_min_cu: 0.5
+        autoscaling_limit_max_cu: 4
diff --git a/acceptance/bundle/resources/postgres_projects/update_default_endpoint_autoscaling/out.requests.json b/acceptance/bundle/resources/postgres_projects/update_default_endpoint_autoscaling/out.requests.json
new file mode 100644
index 00000000000..326ad9eea01
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/update_default_endpoint_autoscaling/out.requests.json
@@ -0,0 +1,18 @@
+{
+  "method": "PATCH",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]",
+  "q": {
+    "update_mask": "spec.default_endpoint_settings.autoscaling_limit_max_cu"
+  },
+  "body": {
+    "spec": {
+      "default_endpoint_settings": {
+        "autoscaling_limit_max_cu": 8,
+        "autoscaling_limit_min_cu": 0.5
+      },
+      "display_name": "Test Project for Default Endpoint Autoscaling",
+      "history_retention_duration": "604800s",
+      "pg_version": 16
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_projects/update_default_endpoint_autoscaling/out.test.toml b/acceptance/bundle/resources/postgres_projects/update_default_endpoint_autoscaling/out.test.toml
new file mode 100644
index 00000000000..ee153e82621
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/update_default_endpoint_autoscaling/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_projects/update_default_endpoint_autoscaling/output.txt b/acceptance/bundle/resources/postgres_projects/update_default_endpoint_autoscaling/output.txt
new file mode 100644
index 00000000000..8863b8bc2c0
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/update_default_endpoint_autoscaling/output.txt
@@ -0,0 +1,46 @@
+
+=== Initial deployment
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Created postgres_projects.my_project
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Change one field inside default_endpoint_settings
+>>> update_file.py databricks.yml autoscaling_limit_max_cu: 4 autoscaling_limit_max_cu: 8
+
+>>> [CLI] bundle plan
+update postgres_projects.my_project
+
+Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Updated postgres_projects.my_project
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py --del-body project_id --sort //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+
+>>> [CLI] postgres get-project projects/test-pg-proj-[UNIQUE_NAME]
+{
+  "autoscaling_limit_max_cu": 8,
+  "autoscaling_limit_min_cu": 0.5,
+  "suspend_timeout_duration": "86400s"
+}
+
+=== Plan again: the change must leave no drift behind
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.my_project
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/postgres_projects/update_default_endpoint_autoscaling/script b/acceptance/bundle/resources/postgres_projects/update_default_endpoint_autoscaling/script
new file mode 100644
index 00000000000..12c11b7408b
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/update_default_endpoint_autoscaling/script
@@ -0,0 +1,28 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+   trace $CLI bundle destroy --auto-approve
+   rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+project_name="projects/test-pg-proj-${UNIQUE_NAME}"
+
+title "Initial deployment"
+trace $CLI bundle deploy
+rm -f "$OUT_REQUESTS"
+
+title "Change one field inside default_endpoint_settings"
+# The bundle declares no suspension field, which is what makes this a regression test:
+# masking the enclosing message asks the API to replace it wholesale, and the API then
+# requires the suspension oneof to be populated in the body. Only the leaf may be masked.
+trace update_file.py databricks.yml "autoscaling_limit_max_cu: 4" "autoscaling_limit_max_cu: 8"
+
+trace $CLI bundle plan
+trace $CLI bundle deploy
+
+trace print_requests.py --del-body project_id --sort '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.json
+trace $CLI postgres get-project "${project_name}" | jq '.status.default_endpoint_settings'
+
+title "Plan again: the change must leave no drift behind"
+trace $CLI bundle plan
diff --git a/acceptance/bundle/resources/postgres_projects/update_default_endpoint_suspend/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_projects/update_default_endpoint_suspend/databricks.yml.tmpl
new file mode 100644
index 00000000000..5838a3c1849
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/update_default_endpoint_suspend/databricks.yml.tmpl
@@ -0,0 +1,16 @@
+bundle:
+  name: update-postgres-project-default-suspend-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-$UNIQUE_NAME
+      display_name: "Test Project for Default Endpoint Suspend Update"
+      pg_version: 16
+      default_endpoint_settings:
+        autoscaling_limit_min_cu: 0.5
+        autoscaling_limit_max_cu: 4
+        suspend_timeout_duration: 300s
diff --git a/acceptance/bundle/resources/postgres_projects/update_default_endpoint_suspend/out.plan.json b/acceptance/bundle/resources/postgres_projects/update_default_endpoint_suspend/out.plan.json
new file mode 100644
index 00000000000..2ea5de81e29
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/update_default_endpoint_suspend/out.plan.json
@@ -0,0 +1,35 @@
+{
+  "action": "update",
+  "changes": {
+    "default_endpoint_settings": {
+      "action": "update",
+      "old": {
+        "autoscaling_limit_max_cu": 4,
+        "autoscaling_limit_min_cu": 0.5,
+        "suspend_timeout_duration": "300s"
+      },
+      "new": {
+        "autoscaling_limit_max_cu": 4,
+        "autoscaling_limit_min_cu": 0.5,
+        "suspend_timeout_duration": "600s"
+      }
+    },
+    "default_endpoint_settings.suspend_timeout_duration": {
+      "action": "update",
+      "old": "300s",
+      "new": "600s"
+    },
+    "display_name": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": "Test Project for Default Endpoint Suspend Update",
+      "new": "Test Project for Default Endpoint Suspend Update"
+    },
+    "pg_version": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": 16,
+      "new": 16
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_projects/update_default_endpoint_suspend/out.requests.json b/acceptance/bundle/resources/postgres_projects/update_default_endpoint_suspend/out.requests.json
new file mode 100644
index 00000000000..3747f87142d
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/update_default_endpoint_suspend/out.requests.json
@@ -0,0 +1,18 @@
+{
+  "method": "PATCH",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]",
+  "q": {
+    "update_mask": "spec.default_endpoint_settings.suspension"
+  },
+  "body": {
+    "spec": {
+      "default_endpoint_settings": {
+        "autoscaling_limit_max_cu": 4,
+        "autoscaling_limit_min_cu": 0.5,
+        "suspend_timeout_duration": "600s"
+      },
+      "display_name": "Test Project for Default Endpoint Suspend Update",
+      "pg_version": 16
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_projects/update_default_endpoint_suspend/out.test.toml b/acceptance/bundle/resources/postgres_projects/update_default_endpoint_suspend/out.test.toml
new file mode 100644
index 00000000000..ee153e82621
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/update_default_endpoint_suspend/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_projects/update_default_endpoint_suspend/output.txt b/acceptance/bundle/resources/postgres_projects/update_default_endpoint_suspend/output.txt
new file mode 100644
index 00000000000..e074e12a5e7
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/update_default_endpoint_suspend/output.txt
@@ -0,0 +1,83 @@
+
+=== Initial deployment
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-postgres-project-default-suspend-[UNIQUE_NAME]/default/files...
+Created postgres_projects.my_project
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] postgres get-project projects/test-pg-proj-[UNIQUE_NAME]
+{
+  "name": "projects/test-pg-proj-[UNIQUE_NAME]",
+  "project_id": "test-pg-proj-[UNIQUE_NAME]",
+  "status": {
+    "branch_logical_size_limit_bytes": [BRANCH_SIZE_LIMIT],
+    "default_branch": "projects/test-pg-proj-[UNIQUE_NAME]/branches/production",
+    "default_endpoint_settings": {
+      "autoscaling_limit_max_cu": 4,
+      "autoscaling_limit_min_cu": 0.5,
+      "suspend_timeout_duration": "300s"
+    },
+    "display_name": "Test Project for Default Endpoint Suspend Update",
+    "enable_pg_native_login": false,
+    "history_retention_duration": "604800s",
+    "owner": "[USERNAME]",
+    "pg_version": 16,
+    "project_id": "test-pg-proj-[UNIQUE_NAME]",
+    "synthetic_storage_size_bytes": 0
+  },
+  "uid": "[UUID]"
+}
+
+=== Change default_endpoint_settings.suspend_timeout_duration and re-deploy
+>>> update_file.py databricks.yml suspend_timeout_duration: 300s suspend_timeout_duration: 600s
+
+>>> [CLI] bundle plan
+update postgres_projects.my_project
+
+Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
+
+>>> [CLI] bundle plan -o json
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-postgres-project-default-suspend-[UNIQUE_NAME]/default/files...
+Updated postgres_projects.my_project
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py --del-body project_id --sort //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+
+>>> [CLI] postgres get-project projects/test-pg-proj-[UNIQUE_NAME]
+{
+  "name": "projects/test-pg-proj-[UNIQUE_NAME]",
+  "project_id": "test-pg-proj-[UNIQUE_NAME]",
+  "status": {
+    "branch_logical_size_limit_bytes": [BRANCH_SIZE_LIMIT],
+    "default_branch": "projects/test-pg-proj-[UNIQUE_NAME]/branches/production",
+    "default_endpoint_settings": {
+      "autoscaling_limit_max_cu": 4,
+      "autoscaling_limit_min_cu": 0.5,
+      "suspend_timeout_duration": "600s"
+    },
+    "display_name": "Test Project for Default Endpoint Suspend Update",
+    "enable_pg_native_login": false,
+    "history_retention_duration": "604800s",
+    "owner": "[USERNAME]",
+    "pg_version": 16,
+    "project_id": "test-pg-proj-[UNIQUE_NAME]",
+    "synthetic_storage_size_bytes": 0
+  },
+  "uid": "[UUID]"
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.my_project
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/update-postgres-project-default-suspend-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/postgres_projects/update_default_endpoint_suspend/script b/acceptance/bundle/resources/postgres_projects/update_default_endpoint_suspend/script
new file mode 100644
index 00000000000..21dafdc6c7e
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/update_default_endpoint_suspend/script
@@ -0,0 +1,32 @@
+# default_endpoint_settings.no_suspension and .suspend_timeout_duration are two sides of one
+# oneof, and the API accepts them in update_mask only under the group name
+# spec.default_endpoint_settings.suspension. Same oneof as
+# postgres_endpoints/update_suspend_timeout, one level of nesting down.
+
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+   trace $CLI bundle destroy --auto-approve
+   rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+project_name="projects/test-pg-proj-${UNIQUE_NAME}"
+
+title "Initial deployment"
+trace $CLI bundle deploy
+rm -f "$OUT_REQUESTS"
+trace $CLI postgres get-project "${project_name}" | project_fields
+
+title "Change default_endpoint_settings.suspend_timeout_duration and re-deploy"
+trace update_file.py databricks.yml "suspend_timeout_duration: 300s" "suspend_timeout_duration: 600s"
+
+# Only terraform applies it: suspend_timeout_duration is a
+# member of the suspension oneof, nested under default_endpoint_settings, and the
+# direct engine masks it under its own name. See test.toml.
+trace $CLI bundle plan
+trace $CLI bundle plan -o json | nostamp | jq '.plan."resources.postgres_projects.my_project" | {action, changes}' > out.plan.json
+rm -f "$OUT_REQUESTS"
+trace $CLI bundle deploy
+trace print_requests.py --del-body project_id --sort '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.json
+trace $CLI postgres get-project "${project_name}" | project_fields
diff --git a/acceptance/bundle/resources/postgres_projects/update_display_name/out.plan.create.direct.json b/acceptance/bundle/resources/postgres_projects/update_display_name/out.plan.create.json
similarity index 100%
rename from acceptance/bundle/resources/postgres_projects/update_display_name/out.plan.create.direct.json
rename to acceptance/bundle/resources/postgres_projects/update_display_name/out.plan.create.json
diff --git a/acceptance/bundle/resources/postgres_projects/update_display_name/out.plan.create.terraform.json b/acceptance/bundle/resources/postgres_projects/update_display_name/out.plan.create.terraform.json
deleted file mode 100644
index b4425b9687c..00000000000
--- a/acceptance/bundle/resources/postgres_projects/update_display_name/out.plan.create.terraform.json
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-  "action": "create"
-}
diff --git a/acceptance/bundle/resources/postgres_projects/update_display_name/out.plan.no_change.direct.json b/acceptance/bundle/resources/postgres_projects/update_display_name/out.plan.no_change.direct.json
deleted file mode 100644
index 927916f980c..00000000000
--- a/acceptance/bundle/resources/postgres_projects/update_display_name/out.plan.no_change.direct.json
+++ /dev/null
@@ -1,58 +0,0 @@
-{
-  "action": "skip",
-  "remote_state": {
-    "create_time": "[TIMESTAMP]",
-    "name": "[MY_PROJECT_ID]",
-    "status": {
-      "branch_logical_size_limit_bytes": [NUMID],
-      "default_branch": "[MY_PROJECT_ID]/branches/production",
-      "default_endpoint_settings": {
-        "autoscaling_limit_max_cu": 4,
-        "autoscaling_limit_min_cu": 0.5,
-        "suspend_timeout_duration": "300s"
-      },
-      "display_name": "Original Name",
-      "enable_pg_native_login": true,
-      "history_retention_duration": "604800s",
-      "owner": "[USERNAME]",
-      "pg_version": 16,
-      "synthetic_storage_size_bytes": 0
-    },
-    "uid": "[UUID]",
-    "update_time": "[TIMESTAMP]"
-  },
-  "changes": {
-    "default_endpoint_settings": {
-      "action": "skip",
-      "reason": "spec:input_only",
-      "old": {
-        "autoscaling_limit_max_cu": 4,
-        "autoscaling_limit_min_cu": 0.5,
-        "suspend_timeout_duration": "300s"
-      },
-      "new": {
-        "autoscaling_limit_max_cu": 4,
-        "autoscaling_limit_min_cu": 0.5,
-        "suspend_timeout_duration": "300s"
-      }
-    },
-    "display_name": {
-      "action": "skip",
-      "reason": "spec:input_only",
-      "old": "Original Name",
-      "new": "Original Name"
-    },
-    "history_retention_duration": {
-      "action": "skip",
-      "reason": "empty",
-      "old": "604800s",
-      "new": "604800s"
-    },
-    "pg_version": {
-      "action": "skip",
-      "reason": "spec:input_only",
-      "old": 16,
-      "new": 16
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/postgres_projects/update_display_name/out.plan.no_change.json b/acceptance/bundle/resources/postgres_projects/update_display_name/out.plan.no_change.json
new file mode 100644
index 00000000000..0336f39f4a1
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/update_display_name/out.plan.no_change.json
@@ -0,0 +1,60 @@
+{
+  "action": "skip",
+  "remote_state": {
+    "create_time": "[TIMESTAMP]",
+    "name": "[MY_PROJECT_ID]",
+    "project_id": "test-pg-proj-[UNIQUE_NAME]",
+    "status": {
+      "branch_logical_size_limit_bytes": [BRANCH_SIZE_LIMIT],
+      "default_branch": "[MY_PROJECT_ID]/branches/production",
+      "default_endpoint_settings": {
+        "autoscaling_limit_max_cu": 4,
+        "autoscaling_limit_min_cu": 0.5,
+        "suspend_timeout_duration": "300s"
+      },
+      "display_name": "Original Name",
+      "enable_pg_native_login": false,
+      "history_retention_duration": "604800s",
+      "owner": "[USERNAME]",
+      "pg_version": 16,
+      "project_id": "test-pg-proj-[UNIQUE_NAME]",
+      "synthetic_storage_size_bytes": 0
+    },
+    "uid": "[UUID]",
+    "update_time": "[TIMESTAMP]"
+  },
+  "changes": {
+    "default_endpoint_settings": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": {
+        "autoscaling_limit_max_cu": 4,
+        "autoscaling_limit_min_cu": 0.5,
+        "suspend_timeout_duration": "300s"
+      },
+      "new": {
+        "autoscaling_limit_max_cu": 4,
+        "autoscaling_limit_min_cu": 0.5,
+        "suspend_timeout_duration": "300s"
+      }
+    },
+    "display_name": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": "Original Name",
+      "new": "Original Name"
+    },
+    "history_retention_duration": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": "604800s",
+      "new": "604800s"
+    },
+    "pg_version": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": 16,
+      "new": 16
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_projects/update_display_name/out.plan.no_change.terraform.json b/acceptance/bundle/resources/postgres_projects/update_display_name/out.plan.no_change.terraform.json
deleted file mode 100644
index b2f23a5015f..00000000000
--- a/acceptance/bundle/resources/postgres_projects/update_display_name/out.plan.no_change.terraform.json
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-  "action": "skip"
-}
diff --git a/acceptance/bundle/resources/postgres_projects/update_display_name/out.plan.restore.direct.json b/acceptance/bundle/resources/postgres_projects/update_display_name/out.plan.restore.direct.json
deleted file mode 100644
index 7791dc5e524..00000000000
--- a/acceptance/bundle/resources/postgres_projects/update_display_name/out.plan.restore.direct.json
+++ /dev/null
@@ -1,70 +0,0 @@
-{
-  "action": "update",
-  "new_state": {
-    "value": {
-      "default_endpoint_settings": {
-        "autoscaling_limit_max_cu": 4,
-        "autoscaling_limit_min_cu": 0.5,
-        "suspend_timeout_duration": "300s"
-      },
-      "display_name": "Original Name",
-      "history_retention_duration": "604800s",
-      "pg_version": 16,
-      "project_id": "test-pg-proj-[UNIQUE_NAME]"
-    }
-  },
-  "remote_state": {
-    "create_time": "[TIMESTAMP]",
-    "name": "[MY_PROJECT_ID]",
-    "status": {
-      "branch_logical_size_limit_bytes": [NUMID],
-      "default_branch": "[MY_PROJECT_ID]/branches/production",
-      "default_endpoint_settings": {
-        "autoscaling_limit_max_cu": 4,
-        "autoscaling_limit_min_cu": 0.5,
-        "suspend_timeout_duration": "300s"
-      },
-      "display_name": "Updated Name",
-      "enable_pg_native_login": true,
-      "history_retention_duration": "604800s",
-      "owner": "[USERNAME]",
-      "pg_version": 16,
-      "synthetic_storage_size_bytes": 0
-    },
-    "uid": "[UUID]",
-    "update_time": "[TIMESTAMP]"
-  },
-  "changes": {
-    "default_endpoint_settings": {
-      "action": "skip",
-      "reason": "spec:input_only",
-      "old": {
-        "autoscaling_limit_max_cu": 4,
-        "autoscaling_limit_min_cu": 0.5,
-        "suspend_timeout_duration": "300s"
-      },
-      "new": {
-        "autoscaling_limit_max_cu": 4,
-        "autoscaling_limit_min_cu": 0.5,
-        "suspend_timeout_duration": "300s"
-      }
-    },
-    "display_name": {
-      "action": "update",
-      "old": "Updated Name",
-      "new": "Original Name"
-    },
-    "history_retention_duration": {
-      "action": "skip",
-      "reason": "empty",
-      "old": "604800s",
-      "new": "604800s"
-    },
-    "pg_version": {
-      "action": "skip",
-      "reason": "spec:input_only",
-      "old": 16,
-      "new": 16
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/postgres_projects/update_display_name/out.plan.restore.json b/acceptance/bundle/resources/postgres_projects/update_display_name/out.plan.restore.json
new file mode 100644
index 00000000000..92ddb203f42
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/update_display_name/out.plan.restore.json
@@ -0,0 +1,72 @@
+{
+  "action": "update",
+  "new_state": {
+    "value": {
+      "default_endpoint_settings": {
+        "autoscaling_limit_max_cu": 4,
+        "autoscaling_limit_min_cu": 0.5,
+        "suspend_timeout_duration": "300s"
+      },
+      "display_name": "Original Name",
+      "history_retention_duration": "604800s",
+      "pg_version": 16,
+      "project_id": "test-pg-proj-[UNIQUE_NAME]"
+    }
+  },
+  "remote_state": {
+    "create_time": "[TIMESTAMP]",
+    "name": "[MY_PROJECT_ID]",
+    "project_id": "test-pg-proj-[UNIQUE_NAME]",
+    "status": {
+      "branch_logical_size_limit_bytes": [BRANCH_SIZE_LIMIT],
+      "default_branch": "[MY_PROJECT_ID]/branches/production",
+      "default_endpoint_settings": {
+        "autoscaling_limit_max_cu": 4,
+        "autoscaling_limit_min_cu": 0.5,
+        "suspend_timeout_duration": "300s"
+      },
+      "display_name": "Updated Name",
+      "enable_pg_native_login": false,
+      "history_retention_duration": "604800s",
+      "owner": "[USERNAME]",
+      "pg_version": 16,
+      "project_id": "test-pg-proj-[UNIQUE_NAME]",
+      "synthetic_storage_size_bytes": 0
+    },
+    "uid": "[UUID]",
+    "update_time": "[TIMESTAMP]"
+  },
+  "changes": {
+    "default_endpoint_settings": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": {
+        "autoscaling_limit_max_cu": 4,
+        "autoscaling_limit_min_cu": 0.5,
+        "suspend_timeout_duration": "300s"
+      },
+      "new": {
+        "autoscaling_limit_max_cu": 4,
+        "autoscaling_limit_min_cu": 0.5,
+        "suspend_timeout_duration": "300s"
+      }
+    },
+    "display_name": {
+      "action": "update",
+      "old": "Updated Name",
+      "new": "Original Name"
+    },
+    "history_retention_duration": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": "604800s",
+      "new": "604800s"
+    },
+    "pg_version": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": 16,
+      "new": 16
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_projects/update_display_name/out.plan.restore.terraform.json b/acceptance/bundle/resources/postgres_projects/update_display_name/out.plan.restore.terraform.json
deleted file mode 100644
index 375b496fef0..00000000000
--- a/acceptance/bundle/resources/postgres_projects/update_display_name/out.plan.restore.terraform.json
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-  "action": "update"
-}
diff --git a/acceptance/bundle/resources/postgres_projects/update_display_name/out.plan.update.direct.json b/acceptance/bundle/resources/postgres_projects/update_display_name/out.plan.update.direct.json
deleted file mode 100644
index a7791f9b56b..00000000000
--- a/acceptance/bundle/resources/postgres_projects/update_display_name/out.plan.update.direct.json
+++ /dev/null
@@ -1,70 +0,0 @@
-{
-  "action": "update",
-  "new_state": {
-    "value": {
-      "default_endpoint_settings": {
-        "autoscaling_limit_max_cu": 4,
-        "autoscaling_limit_min_cu": 0.5,
-        "suspend_timeout_duration": "300s"
-      },
-      "display_name": "Updated Name",
-      "history_retention_duration": "604800s",
-      "pg_version": 16,
-      "project_id": "test-pg-proj-[UNIQUE_NAME]"
-    }
-  },
-  "remote_state": {
-    "create_time": "[TIMESTAMP]",
-    "name": "[MY_PROJECT_ID]",
-    "status": {
-      "branch_logical_size_limit_bytes": [NUMID],
-      "default_branch": "[MY_PROJECT_ID]/branches/production",
-      "default_endpoint_settings": {
-        "autoscaling_limit_max_cu": 4,
-        "autoscaling_limit_min_cu": 0.5,
-        "suspend_timeout_duration": "300s"
-      },
-      "display_name": "Original Name",
-      "enable_pg_native_login": true,
-      "history_retention_duration": "604800s",
-      "owner": "[USERNAME]",
-      "pg_version": 16,
-      "synthetic_storage_size_bytes": 0
-    },
-    "uid": "[UUID]",
-    "update_time": "[TIMESTAMP]"
-  },
-  "changes": {
-    "default_endpoint_settings": {
-      "action": "skip",
-      "reason": "spec:input_only",
-      "old": {
-        "autoscaling_limit_max_cu": 4,
-        "autoscaling_limit_min_cu": 0.5,
-        "suspend_timeout_duration": "300s"
-      },
-      "new": {
-        "autoscaling_limit_max_cu": 4,
-        "autoscaling_limit_min_cu": 0.5,
-        "suspend_timeout_duration": "300s"
-      }
-    },
-    "display_name": {
-      "action": "update",
-      "old": "Original Name",
-      "new": "Updated Name"
-    },
-    "history_retention_duration": {
-      "action": "skip",
-      "reason": "empty",
-      "old": "604800s",
-      "new": "604800s"
-    },
-    "pg_version": {
-      "action": "skip",
-      "reason": "spec:input_only",
-      "old": 16,
-      "new": 16
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/postgres_projects/update_display_name/out.plan.update.json b/acceptance/bundle/resources/postgres_projects/update_display_name/out.plan.update.json
new file mode 100644
index 00000000000..771d76a009f
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/update_display_name/out.plan.update.json
@@ -0,0 +1,72 @@
+{
+  "action": "update",
+  "new_state": {
+    "value": {
+      "default_endpoint_settings": {
+        "autoscaling_limit_max_cu": 4,
+        "autoscaling_limit_min_cu": 0.5,
+        "suspend_timeout_duration": "300s"
+      },
+      "display_name": "Updated Name",
+      "history_retention_duration": "604800s",
+      "pg_version": 16,
+      "project_id": "test-pg-proj-[UNIQUE_NAME]"
+    }
+  },
+  "remote_state": {
+    "create_time": "[TIMESTAMP]",
+    "name": "[MY_PROJECT_ID]",
+    "project_id": "test-pg-proj-[UNIQUE_NAME]",
+    "status": {
+      "branch_logical_size_limit_bytes": [BRANCH_SIZE_LIMIT],
+      "default_branch": "[MY_PROJECT_ID]/branches/production",
+      "default_endpoint_settings": {
+        "autoscaling_limit_max_cu": 4,
+        "autoscaling_limit_min_cu": 0.5,
+        "suspend_timeout_duration": "300s"
+      },
+      "display_name": "Original Name",
+      "enable_pg_native_login": false,
+      "history_retention_duration": "604800s",
+      "owner": "[USERNAME]",
+      "pg_version": 16,
+      "project_id": "test-pg-proj-[UNIQUE_NAME]",
+      "synthetic_storage_size_bytes": 0
+    },
+    "uid": "[UUID]",
+    "update_time": "[TIMESTAMP]"
+  },
+  "changes": {
+    "default_endpoint_settings": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": {
+        "autoscaling_limit_max_cu": 4,
+        "autoscaling_limit_min_cu": 0.5,
+        "suspend_timeout_duration": "300s"
+      },
+      "new": {
+        "autoscaling_limit_max_cu": 4,
+        "autoscaling_limit_min_cu": 0.5,
+        "suspend_timeout_duration": "300s"
+      }
+    },
+    "display_name": {
+      "action": "update",
+      "old": "Original Name",
+      "new": "Updated Name"
+    },
+    "history_retention_duration": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": "604800s",
+      "new": "604800s"
+    },
+    "pg_version": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": 16,
+      "new": 16
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_projects/update_display_name/out.plan.update.terraform.json b/acceptance/bundle/resources/postgres_projects/update_display_name/out.plan.update.terraform.json
deleted file mode 100644
index 375b496fef0..00000000000
--- a/acceptance/bundle/resources/postgres_projects/update_display_name/out.plan.update.terraform.json
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-  "action": "update"
-}
diff --git a/acceptance/bundle/resources/postgres_projects/update_display_name/out.requests.create.direct.json b/acceptance/bundle/resources/postgres_projects/update_display_name/out.requests.create.json
similarity index 100%
rename from acceptance/bundle/resources/postgres_projects/update_display_name/out.requests.create.direct.json
rename to acceptance/bundle/resources/postgres_projects/update_display_name/out.requests.create.json
diff --git a/acceptance/bundle/resources/postgres_projects/update_display_name/out.requests.create.terraform.json b/acceptance/bundle/resources/postgres_projects/update_display_name/out.requests.create.terraform.json
deleted file mode 100644
index c9d08e089ba..00000000000
--- a/acceptance/bundle/resources/postgres_projects/update_display_name/out.requests.create.terraform.json
+++ /dev/null
@@ -1,19 +0,0 @@
-{
-  "method": "POST",
-  "path": "/api/2.0/postgres/projects",
-  "q": {
-    "project_id": "test-pg-proj-[UNIQUE_NAME]"
-  },
-  "body": {
-    "spec": {
-      "default_endpoint_settings": {
-        "autoscaling_limit_max_cu": 4,
-        "autoscaling_limit_min_cu": 0.5,
-        "suspend_timeout_duration": "300s"
-      },
-      "display_name": "Original Name",
-      "history_retention_duration": "604800s",
-      "pg_version": 16
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/postgres_projects/update_display_name/out.requests.no_change.direct.json b/acceptance/bundle/resources/postgres_projects/update_display_name/out.requests.no_change.json
similarity index 100%
rename from acceptance/bundle/resources/postgres_projects/update_display_name/out.requests.no_change.direct.json
rename to acceptance/bundle/resources/postgres_projects/update_display_name/out.requests.no_change.json
diff --git a/acceptance/bundle/resources/postgres_projects/update_display_name/out.requests.no_change.terraform.json b/acceptance/bundle/resources/postgres_projects/update_display_name/out.requests.no_change.terraform.json
deleted file mode 100644
index 1d6880d333b..00000000000
--- a/acceptance/bundle/resources/postgres_projects/update_display_name/out.requests.no_change.terraform.json
+++ /dev/null
@@ -1,4 +0,0 @@
-{
-  "method": "GET",
-  "path": "/api/2.0/postgres/[MY_PROJECT_ID]"
-}
diff --git a/acceptance/bundle/resources/postgres_projects/update_display_name/out.requests.restore.direct.json b/acceptance/bundle/resources/postgres_projects/update_display_name/out.requests.restore.json
similarity index 100%
rename from acceptance/bundle/resources/postgres_projects/update_display_name/out.requests.restore.direct.json
rename to acceptance/bundle/resources/postgres_projects/update_display_name/out.requests.restore.json
diff --git a/acceptance/bundle/resources/postgres_projects/update_display_name/out.requests.restore.terraform.json b/acceptance/bundle/resources/postgres_projects/update_display_name/out.requests.restore.terraform.json
deleted file mode 100644
index aabcba8c34e..00000000000
--- a/acceptance/bundle/resources/postgres_projects/update_display_name/out.requests.restore.terraform.json
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  "method": "GET",
-  "path": "/api/2.0/postgres/[MY_PROJECT_ID]"
-}
-{
-  "method": "PATCH",
-  "path": "/api/2.0/postgres/[MY_PROJECT_ID]",
-  "q": {
-    "update_mask": "spec"
-  },
-  "body": {
-    "name": "[MY_PROJECT_ID]",
-    "spec": {
-      "default_endpoint_settings": {
-        "autoscaling_limit_max_cu": 4,
-        "autoscaling_limit_min_cu": 0.5,
-        "suspend_timeout_duration": "300s"
-      },
-      "display_name": "Original Name",
-      "history_retention_duration": "604800s",
-      "pg_version": 16
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/postgres_projects/update_display_name/out.requests.update.direct.json b/acceptance/bundle/resources/postgres_projects/update_display_name/out.requests.update.json
similarity index 100%
rename from acceptance/bundle/resources/postgres_projects/update_display_name/out.requests.update.direct.json
rename to acceptance/bundle/resources/postgres_projects/update_display_name/out.requests.update.json
diff --git a/acceptance/bundle/resources/postgres_projects/update_display_name/out.requests.update.terraform.json b/acceptance/bundle/resources/postgres_projects/update_display_name/out.requests.update.terraform.json
deleted file mode 100644
index d68d893ad28..00000000000
--- a/acceptance/bundle/resources/postgres_projects/update_display_name/out.requests.update.terraform.json
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  "method": "GET",
-  "path": "/api/2.0/postgres/[MY_PROJECT_ID]"
-}
-{
-  "method": "PATCH",
-  "path": "/api/2.0/postgres/[MY_PROJECT_ID]",
-  "q": {
-    "update_mask": "spec"
-  },
-  "body": {
-    "name": "[MY_PROJECT_ID]",
-    "spec": {
-      "default_endpoint_settings": {
-        "autoscaling_limit_max_cu": 4,
-        "autoscaling_limit_min_cu": 0.5,
-        "suspend_timeout_duration": "300s"
-      },
-      "display_name": "Updated Name",
-      "history_retention_duration": "604800s",
-      "pg_version": 16
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/postgres_projects/update_display_name/out.test.toml b/acceptance/bundle/resources/postgres_projects/update_display_name/out.test.toml
index 110f841fa05..ee153e82621 100644
--- a/acceptance/bundle/resources/postgres_projects/update_display_name/out.test.toml
+++ b/acceptance/bundle/resources/postgres_projects/update_display_name/out.test.toml
@@ -1,6 +1,4 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
 CloudEnvs.azure = false
 CloudEnvs.gcp = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_projects/update_display_name/output.txt b/acceptance/bundle/resources/postgres_projects/update_display_name/output.txt
index 6397e689f54..874ecf991fb 100644
--- a/acceptance/bundle/resources/postgres_projects/update_display_name/output.txt
+++ b/acceptance/bundle/resources/postgres_projects/update_display_name/output.txt
@@ -18,17 +18,18 @@ Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-postgres-project-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created postgres_projects.my_project
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
->>> print_requests.py --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
 
 >>> [CLI] postgres get-project [MY_PROJECT_ID]
 {
   "name": "[MY_PROJECT_ID]",
+  "project_id": "test-pg-proj-[UNIQUE_NAME]",
   "status": {
-    "branch_logical_size_limit_bytes": [NUMID],
+    "branch_logical_size_limit_bytes": [BRANCH_SIZE_LIMIT],
     "default_branch": "[MY_PROJECT_ID]/branches/production",
     "default_endpoint_settings": {
       "autoscaling_limit_max_cu": 4,
@@ -36,10 +37,11 @@ Deployment complete!
       "suspend_timeout_duration": "300s"
     },
     "display_name": "Original Name",
-    "enable_pg_native_login": true,
+    "enable_pg_native_login": false,
     "history_retention_duration": "604800s",
     "owner": "[USERNAME]",
     "pg_version": 16,
+    "project_id": "test-pg-proj-[UNIQUE_NAME]",
     "synthetic_storage_size_bytes": 0
   },
   "uid": "[UUID]"
@@ -53,11 +55,10 @@ Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-postgres-project-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
 
->>> print_requests.py --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
 
 === Update display_name and re-deploy
 >>> update_file.py databricks.yml Original Name Updated Name
@@ -90,17 +91,18 @@ Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-postgres-project-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated postgres_projects.my_project
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
->>> print_requests.py --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
 
 >>> [CLI] postgres get-project [MY_PROJECT_ID]
 {
   "name": "[MY_PROJECT_ID]",
+  "project_id": "test-pg-proj-[UNIQUE_NAME]",
   "status": {
-    "branch_logical_size_limit_bytes": [NUMID],
+    "branch_logical_size_limit_bytes": [BRANCH_SIZE_LIMIT],
     "default_branch": "[MY_PROJECT_ID]/branches/production",
     "default_endpoint_settings": {
       "autoscaling_limit_max_cu": 4,
@@ -108,10 +110,11 @@ Deployment complete!
       "suspend_timeout_duration": "300s"
     },
     "display_name": "Updated Name",
-    "enable_pg_native_login": true,
+    "enable_pg_native_login": false,
     "history_retention_duration": "604800s",
     "owner": "[USERNAME]",
     "pg_version": 16,
+    "project_id": "test-pg-proj-[UNIQUE_NAME]",
     "synthetic_storage_size_bytes": 0
   },
   "uid": "[UUID]"
@@ -129,17 +132,18 @@ Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-postgres-project-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated postgres_projects.my_project
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
->>> print_requests.py --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
 
 >>> [CLI] postgres get-project [MY_PROJECT_ID]
 {
   "name": "[MY_PROJECT_ID]",
+  "project_id": "test-pg-proj-[UNIQUE_NAME]",
   "status": {
-    "branch_logical_size_limit_bytes": [NUMID],
+    "branch_logical_size_limit_bytes": [BRANCH_SIZE_LIMIT],
     "default_branch": "[MY_PROJECT_ID]/branches/production",
     "default_endpoint_settings": {
       "autoscaling_limit_max_cu": 4,
@@ -147,10 +151,11 @@ Deployment complete!
       "suspend_timeout_duration": "300s"
     },
     "display_name": "Original Name",
-    "enable_pg_native_login": true,
+    "enable_pg_native_login": false,
     "history_retention_duration": "604800s",
     "owner": "[USERNAME]",
     "pg_version": 16,
+    "project_id": "test-pg-proj-[UNIQUE_NAME]",
     "synthetic_storage_size_bytes": 0
   },
   "uid": "[UUID]"
@@ -166,5 +171,4 @@ all their branches, databases, and endpoints. All data stored in them will be pe
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/update-postgres-project-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/postgres_projects/update_display_name/script b/acceptance/bundle/resources/postgres_projects/update_display_name/script
index 88c26610f29..766891a7e50 100755
--- a/acceptance/bundle/resources/postgres_projects/update_display_name/script
+++ b/acceptance/bundle/resources/postgres_projects/update_display_name/script
@@ -2,33 +2,33 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
    trace $CLI bundle destroy --auto-approve
-   rm -f out.requests.txt
+   rm -f "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
 print_requests() {
     local name=$1
-    trace print_requests.py --keep --get '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.${name}.$DATABRICKS_BUNDLE_ENGINE.json
-    rm -f out.requests.txt
+    trace print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.${name}.json
+    rm -f "$OUT_REQUESTS"
 }
 
 title "Initial deployment"
 trace $CLI bundle validate
 trace $CLI bundle plan
-trace $CLI bundle plan -o json | jq '.plan."resources.postgres_projects.my_project" // .' > out.plan.create.$DATABRICKS_BUNDLE_ENGINE.json
-rm -f out.requests.txt
+trace $CLI bundle plan -o json | nostamp | jq '.plan."resources.postgres_projects.my_project" // .' > out.plan.create.json
+rm -f "$OUT_REQUESTS"
 trace $CLI bundle deploy
 
 print_requests create
 
 project_name="projects/test-pg-proj-${UNIQUE_NAME}"
 project_id_1=`read_id.py my_project`
-trace $CLI postgres get-project "${project_name}" | jq 'del(.create_time, .update_time)'
+trace $CLI postgres get-project "${project_name}" | project_fields
 
 title "Verify no changes"
 trace $CLI bundle plan
-trace $CLI bundle plan -o json | jq '.plan."resources.postgres_projects.my_project" // .' > out.plan.no_change.$DATABRICKS_BUNDLE_ENGINE.json
-rm -f out.requests.txt
+trace $CLI bundle plan -o json | nostamp | jq '.plan."resources.postgres_projects.my_project" // .' > out.plan.no_change.json
+rm -f "$OUT_REQUESTS"
 trace $CLI bundle deploy
 
 print_requests no_change
@@ -38,22 +38,22 @@ trace update_file.py databricks.yml "Original Name" "Updated Name"
 trace cat databricks.yml
 
 trace $CLI bundle plan
-trace $CLI bundle plan -o json | jq '.plan."resources.postgres_projects.my_project" // .' > out.plan.update.$DATABRICKS_BUNDLE_ENGINE.json
-rm -f out.requests.txt
+trace $CLI bundle plan -o json | nostamp | jq '.plan."resources.postgres_projects.my_project" // .' > out.plan.update.json
+rm -f "$OUT_REQUESTS"
 trace $CLI bundle deploy
 
 print_requests update
 
 project_id_2=`read_id.py my_project`
-trace $CLI postgres get-project "${project_name}" | jq 'del(.create_time, .update_time)'
+trace $CLI postgres get-project "${project_name}" | project_fields
 
 title "Restore display_name to original value"
 trace update_file.py databricks.yml "Updated Name" "Original Name"
 trace $CLI bundle plan
-trace $CLI bundle plan -o json | jq '.plan."resources.postgres_projects.my_project" // .' > out.plan.restore.$DATABRICKS_BUNDLE_ENGINE.json
-rm -f out.requests.txt
+trace $CLI bundle plan -o json | nostamp | jq '.plan."resources.postgres_projects.my_project" // .' > out.plan.restore.json
+rm -f "$OUT_REQUESTS"
 trace $CLI bundle deploy
 
 print_requests restore
 
-trace $CLI postgres get-project "${project_name}" | jq 'del(.create_time, .update_time)'
+trace $CLI postgres get-project "${project_name}" | project_fields
diff --git a/acceptance/bundle/resources/postgres_projects/update_display_name/test.toml b/acceptance/bundle/resources/postgres_projects/update_display_name/test.toml
deleted file mode 100644
index f8b3bbe49dd..00000000000
--- a/acceptance/bundle/resources/postgres_projects/update_display_name/test.toml
+++ /dev/null
@@ -1 +0,0 @@
-# All configuration inherited from parent test.toml
diff --git a/acceptance/bundle/resources/postgres_projects/update_history_retention/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_projects/update_history_retention/databricks.yml.tmpl
new file mode 100644
index 00000000000..0773ac89e3a
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/update_history_retention/databricks.yml.tmpl
@@ -0,0 +1,13 @@
+bundle:
+  name: update-postgres-project-retention-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-$UNIQUE_NAME
+      display_name: "Test Project for History Retention Update"
+      pg_version: 16
+      history_retention_duration: 604800s
diff --git a/acceptance/bundle/resources/postgres_projects/update_history_retention/out.plan.json b/acceptance/bundle/resources/postgres_projects/update_history_retention/out.plan.json
new file mode 100644
index 00000000000..20a9729d18d
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/update_history_retention/out.plan.json
@@ -0,0 +1,22 @@
+{
+  "action": "update",
+  "changes": {
+    "display_name": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": "Test Project for History Retention Update",
+      "new": "Test Project for History Retention Update"
+    },
+    "history_retention_duration": {
+      "action": "update",
+      "old": "604800s",
+      "new": "259200s"
+    },
+    "pg_version": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": 16,
+      "new": 16
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_projects/update_history_retention/out.requests.json b/acceptance/bundle/resources/postgres_projects/update_history_retention/out.requests.json
new file mode 100644
index 00000000000..1b3837bd47f
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/update_history_retention/out.requests.json
@@ -0,0 +1,14 @@
+{
+  "method": "PATCH",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]",
+  "q": {
+    "update_mask": "spec.history_retention_duration"
+  },
+  "body": {
+    "spec": {
+      "display_name": "Test Project for History Retention Update",
+      "history_retention_duration": "259200s",
+      "pg_version": 16
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_projects/update_history_retention/out.test.toml b/acceptance/bundle/resources/postgres_projects/update_history_retention/out.test.toml
new file mode 100644
index 00000000000..ee153e82621
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/update_history_retention/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_projects/update_history_retention/output.txt b/acceptance/bundle/resources/postgres_projects/update_history_retention/output.txt
new file mode 100644
index 00000000000..71fbe88c3b9
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/update_history_retention/output.txt
@@ -0,0 +1,83 @@
+
+=== Initial deployment with history_retention_duration: 604800s
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-postgres-project-retention-[UNIQUE_NAME]/default/files...
+Created postgres_projects.my_project
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] postgres get-project projects/test-pg-proj-[UNIQUE_NAME]
+{
+  "name": "projects/test-pg-proj-[UNIQUE_NAME]",
+  "project_id": "test-pg-proj-[UNIQUE_NAME]",
+  "status": {
+    "branch_logical_size_limit_bytes": [BRANCH_SIZE_LIMIT],
+    "default_branch": "projects/test-pg-proj-[UNIQUE_NAME]/branches/production",
+    "default_endpoint_settings": {
+      "autoscaling_limit_max_cu": 1,
+      "autoscaling_limit_min_cu": 1,
+      "suspend_timeout_duration": "86400s"
+    },
+    "display_name": "Test Project for History Retention Update",
+    "enable_pg_native_login": false,
+    "history_retention_duration": "604800s",
+    "owner": "[USERNAME]",
+    "pg_version": 16,
+    "project_id": "test-pg-proj-[UNIQUE_NAME]",
+    "synthetic_storage_size_bytes": 0
+  },
+  "uid": "[UUID]"
+}
+
+=== Change history_retention_duration to 259200s and re-deploy
+>>> update_file.py databricks.yml history_retention_duration: 604800s history_retention_duration: 259200s
+
+>>> [CLI] bundle plan
+update postgres_projects.my_project
+
+Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
+
+>>> [CLI] bundle plan -o json
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-postgres-project-retention-[UNIQUE_NAME]/default/files...
+Updated postgres_projects.my_project
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py --del-body project_id --sort //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+
+>>> [CLI] postgres get-project projects/test-pg-proj-[UNIQUE_NAME]
+{
+  "name": "projects/test-pg-proj-[UNIQUE_NAME]",
+  "project_id": "test-pg-proj-[UNIQUE_NAME]",
+  "status": {
+    "branch_logical_size_limit_bytes": [BRANCH_SIZE_LIMIT],
+    "default_branch": "projects/test-pg-proj-[UNIQUE_NAME]/branches/production",
+    "default_endpoint_settings": {
+      "autoscaling_limit_max_cu": 1,
+      "autoscaling_limit_min_cu": 1,
+      "suspend_timeout_duration": "86400s"
+    },
+    "display_name": "Test Project for History Retention Update",
+    "enable_pg_native_login": false,
+    "history_retention_duration": "259200s",
+    "owner": "[USERNAME]",
+    "pg_version": 16,
+    "project_id": "test-pg-proj-[UNIQUE_NAME]",
+    "synthetic_storage_size_bytes": 0
+  },
+  "uid": "[UUID]"
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.my_project
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/update-postgres-project-retention-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/postgres_projects/update_history_retention/script b/acceptance/bundle/resources/postgres_projects/update_history_retention/script
new file mode 100644
index 00000000000..115a7ed034e
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/update_history_retention/script
@@ -0,0 +1,27 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+   trace $CLI bundle destroy --auto-approve
+   rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+project_name="projects/test-pg-proj-${UNIQUE_NAME}"
+
+title "Initial deployment with history_retention_duration: 604800s"
+trace $CLI bundle deploy
+rm -f "$OUT_REQUESTS"
+trace $CLI postgres get-project "${project_name}" | project_fields
+
+title "Change history_retention_duration to 259200s and re-deploy"
+trace update_file.py databricks.yml "history_retention_duration: 604800s" "history_retention_duration: 259200s"
+trace $CLI bundle plan
+trace $CLI bundle plan -o json | nostamp | jq '.plan."resources.postgres_projects.my_project" | {action, changes}' > out.plan.json
+rm -f "$OUT_REQUESTS"
+trace $CLI bundle deploy
+
+# Unlike the suspension oneof, history_retention_duration is masked under its own
+# name, so the direct engine's update_mask is accepted and the change applies.
+trace print_requests.py --del-body project_id --sort '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.json
+
+trace $CLI postgres get-project "${project_name}" | project_fields
diff --git a/acceptance/bundle/resources/postgres_projects/update_keeps_children/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_projects/update_keeps_children/databricks.yml.tmpl
new file mode 100644
index 00000000000..850cf1c84a4
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/update_keeps_children/databricks.yml.tmpl
@@ -0,0 +1,28 @@
+bundle:
+  name: update-keeps-children-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+# Children wire themselves to the project/branch via ${...name}, the idiomatic
+# pattern used throughout acceptance/bundle/invariant/configs/postgres_*.yml.tmpl.
+# Both parent fields are immutable id_fields, so a spurious diff on the .name
+# reference would recreate the child. Regression for ES-2202624.
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-$UNIQUE_NAME
+      display_name: "Original Name"
+      pg_version: 16
+
+  postgres_branches:
+    my_branch:
+      parent: ${resources.postgres_projects.my_project.name}
+      branch_id: test-branch
+      no_expiry: true
+
+  postgres_roles:
+    my_role:
+      parent: ${resources.postgres_branches.my_branch.name}
+      role_id: test-role
+      postgres_role: app_role
diff --git a/acceptance/bundle/resources/postgres_projects/update_keeps_children/out.test.toml b/acceptance/bundle/resources/postgres_projects/update_keeps_children/out.test.toml
new file mode 100644
index 00000000000..ee153e82621
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/update_keeps_children/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_projects/update_keeps_children/output.txt b/acceptance/bundle/resources/postgres_projects/update_keeps_children/output.txt
new file mode 100644
index 00000000000..37bb70a4cfd
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/update_keeps_children/output.txt
@@ -0,0 +1,41 @@
+
+=== Initial deployment (project + branch + role)
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-keeps-children-[UNIQUE_NAME]/default/files...
+Created postgres_branches.my_branch
+Created postgres_projects.my_project
+Created postgres_roles.my_role
+Files: 0 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
+
+=== In-place project update must not recreate the branch or role
+>>> update_file.py databricks.yml Original Name Updated Name
+
+>>> [CLI] bundle plan
+update postgres_projects.my_project
+
+Plan: 0 to add, 1 to change, 0 to delete, 2 unchanged
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-keeps-children-[UNIQUE_NAME]/default/files...
+Updated postgres_projects.my_project
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 2 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.postgres_branches.my_branch
+  delete resources.postgres_projects.my_project
+  delete resources.postgres_roles.my_role
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase branches.
+All data stored in them will be permanently lost:
+  delete resources.postgres_branches.my_branch
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/update-keeps-children-[UNIQUE_NAME]/default
+
+Destroy: 3 deleted
diff --git a/acceptance/bundle/resources/postgres_projects/update_keeps_children/script b/acceptance/bundle/resources/postgres_projects/update_keeps_children/script
new file mode 100644
index 00000000000..a5d12a39a38
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/update_keeps_children/script
@@ -0,0 +1,18 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+title "Initial deployment (project + branch + role)"
+trace $CLI bundle deploy
+
+# ES-2202624: an in-place project update (display_name only) must leave the
+# branch and role — which reference the project/branch .name as their immutable
+# parent — unchanged, not recreated.
+title "In-place project update must not recreate the branch or role"
+trace update_file.py databricks.yml "Original Name" "Updated Name"
+trace $CLI bundle plan
+trace $CLI bundle deploy
diff --git a/acceptance/bundle/resources/postgres_projects/update_keeps_children/test.toml b/acceptance/bundle/resources/postgres_projects/update_keeps_children/test.toml
new file mode 100644
index 00000000000..a030353d571
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/update_keeps_children/test.toml
@@ -0,0 +1 @@
+RecordRequests = false
diff --git a/acceptance/bundle/resources/postgres_projects/without_project_id/out.deploy.direct.txt b/acceptance/bundle/resources/postgres_projects/without_project_id/out.deploy.direct.txt
deleted file mode 100644
index 79d1f7200e1..00000000000
--- a/acceptance/bundle/resources/postgres_projects/without_project_id/out.deploy.direct.txt
+++ /dev/null
@@ -1,14 +0,0 @@
-Warning: required field "project_id" is not set
-  at resources.postgres_projects.my_project
-  in databricks.yml:10:7
-
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-no-id-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Error: cannot create resources.postgres_projects.my_project: Field 'project_id' is required, expected non-default value (not "")! (400 INVALID_PARAMETER_VALUE)
-
-Endpoint: POST [DATABRICKS_URL]/api/2.0/postgres/projects
-HTTP Status: 400 Bad Request
-API error_code: INVALID_PARAMETER_VALUE
-API message: Field 'project_id' is required, expected non-default value (not "")!
-
-Updating deployment state...
diff --git a/acceptance/bundle/resources/postgres_projects/without_project_id/out.deploy.terraform.txt b/acceptance/bundle/resources/postgres_projects/without_project_id/out.deploy.terraform.txt
deleted file mode 100644
index 4527016d6ea..00000000000
--- a/acceptance/bundle/resources/postgres_projects/without_project_id/out.deploy.terraform.txt
+++ /dev/null
@@ -1,15 +0,0 @@
-Warning: required field "project_id" is not set
-  at resources.postgres_projects.my_project
-  in databricks.yml:10:7
-
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-no-id-[UNIQUE_NAME]/default/files...
-Error: exit status 1
-
-Error: Missing required argument
-
-  on bundle.tf.json line 26, in resource.databricks_postgres_project.my_project:
-  26:       }
-
-The argument "project_id" is required, but no definition was found.
-
-
diff --git a/acceptance/bundle/resources/postgres_projects/without_project_id/out.deploy.txt b/acceptance/bundle/resources/postgres_projects/without_project_id/out.deploy.txt
new file mode 100644
index 00000000000..53dd9bc68f4
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_projects/without_project_id/out.deploy.txt
@@ -0,0 +1,13 @@
+Warning: required field "project_id" is not set
+  at resources.postgres_projects.my_project
+  in databricks.yml:10:7
+
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-no-id-[UNIQUE_NAME]/default/files...
+Error: cannot create resources.postgres_projects.my_project: Field 'project_id' is required, expected non-default value (not "")! (400 INVALID_PARAMETER_VALUE)
+
+Endpoint: POST [DATABRICKS_URL]/api/2.0/postgres/projects
+HTTP Status: 400 Bad Request
+API error_code: INVALID_PARAMETER_VALUE
+API message: Field 'project_id' is required, expected non-default value (not "")!
+
+Files: 0 uploaded, 0 deleted
diff --git a/acceptance/bundle/resources/postgres_projects/without_project_id/out.test.toml b/acceptance/bundle/resources/postgres_projects/without_project_id/out.test.toml
index 110f841fa05..ee153e82621 100644
--- a/acceptance/bundle/resources/postgres_projects/without_project_id/out.test.toml
+++ b/acceptance/bundle/resources/postgres_projects/without_project_id/out.test.toml
@@ -1,6 +1,4 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
 CloudEnvs.azure = false
 CloudEnvs.gcp = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct", "terraform"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_projects/without_project_id/script b/acceptance/bundle/resources/postgres_projects/without_project_id/script
index 112f4071ada..1a7b0ae6894 100644
--- a/acceptance/bundle/resources/postgres_projects/without_project_id/script
+++ b/acceptance/bundle/resources/postgres_projects/without_project_id/script
@@ -3,4 +3,4 @@ envsubst < databricks.yml.tmpl > databricks.yml
 trace $CLI bundle validate
 
 # Deploy output differs between engines, so capture to per-engine file only
-$CLI bundle deploy > out.deploy.$DATABRICKS_BUNDLE_ENGINE.txt 2>&1 || true
+$CLI bundle deploy > out.deploy.txt 2>&1 || true
diff --git a/acceptance/bundle/resources/postgres_roles/basic/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_roles/basic/databricks.yml.tmpl
new file mode 100644
index 00000000000..bba8e0d7d94
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/basic/databricks.yml.tmpl
@@ -0,0 +1,27 @@
+bundle:
+  name: deploy-postgres-role-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-$UNIQUE_NAME
+      display_name: "Test Project for Role"
+      pg_version: 16
+      history_retention_duration: "604800s"
+
+  postgres_branches:
+    main:
+      parent: ${resources.postgres_projects.my_project.id}
+      branch_id: main
+      no_expiry: true
+
+  postgres_roles:
+    my_role:
+      parent: ${resources.postgres_branches.main.id}
+      role_id: test-role
+      postgres_role: app_role
+      attributes:
+        createdb: true
diff --git a/acceptance/bundle/resources/postgres_roles/basic/out.requests.json b/acceptance/bundle/resources/postgres_roles/basic/out.requests.json
new file mode 100644
index 00000000000..67bf2b4cc52
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/basic/out.requests.json
@@ -0,0 +1,45 @@
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects",
+  "q": {
+    "project_id": "test-pg-proj-[UNIQUE_NAME]"
+  },
+  "body": {
+    "spec": {
+      "display_name": "Test Project for Role",
+      "history_retention_duration": "604800s",
+      "pg_version": 16
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches",
+  "q": {
+    "branch_id": "main"
+  },
+  "body": {
+    "spec": {
+      "no_expiry": true
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles",
+  "q": {
+    "role_id": "test-role"
+  },
+  "body": {
+    "spec": {
+      "attributes": {
+        "createdb": true
+      },
+      "postgres_role": "app_role"
+    }
+  }
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/test-role"
+}
diff --git a/acceptance/bundle/resources/postgres_roles/basic/out.test.toml b/acceptance/bundle/resources/postgres_roles/basic/out.test.toml
new file mode 100644
index 00000000000..ee153e82621
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/basic/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_roles/basic/output.txt b/acceptance/bundle/resources/postgres_roles/basic/output.txt
new file mode 100644
index 00000000000..14911ec09ad
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/basic/output.txt
@@ -0,0 +1,92 @@
+
+>>> [CLI] bundle validate
+Name: deploy-postgres-role-[UNIQUE_NAME]
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-role-[UNIQUE_NAME]/default
+
+Validation OK!
+
+>>> [CLI] bundle summary
+Name: deploy-postgres-role-[UNIQUE_NAME]
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-role-[UNIQUE_NAME]/default
+Resources:
+  Postgres branches:
+    main:
+      Name: 
+  Postgres projects:
+    my_project:
+      Name: Test Project for Role
+  Postgres roles:
+    my_role:
+      Name: 
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-role-[UNIQUE_NAME]/default/files...
+Created postgres_branches.main
+Created postgres_projects.my_project
+Created postgres_roles.my_role
+Files: 0 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] postgres get-role projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/test-role
+{
+  "name": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/test-role",
+  "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
+  "role_id": "test-role",
+  "status": {
+    "attributes": {
+      "bypassrls": false,
+      "createdb": true,
+      "createrole": false
+    },
+    "auth_method": "PG_PASSWORD_SCRAM_SHA_256",
+    "identity_type": "IDENTITY_TYPE_UNSPECIFIED",
+    "postgres_role": "app_role",
+    "role_id": "test-role"
+  }
+}
+
+>>> musterr [CLI] bundle open my_role
+Error: this resource type does not have a URL
+
+>>> [CLI] bundle summary
+Name: deploy-postgres-role-[UNIQUE_NAME]
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-role-[UNIQUE_NAME]/default
+Resources:
+  Postgres branches:
+    main:
+      Name: projects/test-pg-proj-[UNIQUE_NAME]/branches/main
+  Postgres projects:
+    my_project:
+      Name: Test Project for Role
+  Postgres roles:
+    my_role:
+      Name: projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/test-role
+
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.postgres_branches.main
+  delete resources.postgres_projects.my_project
+  delete resources.postgres_roles.my_role
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase branches.
+All data stored in them will be permanently lost:
+  delete resources.postgres_branches.main
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-role-[UNIQUE_NAME]/default
+
+Destroy: 3 deleted
diff --git a/acceptance/bundle/resources/postgres_roles/basic/script b/acceptance/bundle/resources/postgres_roles/basic/script
new file mode 100644
index 00000000000..ebb54463a07
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/basic/script
@@ -0,0 +1,29 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+   trace $CLI bundle destroy --auto-approve
+   rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+trace $CLI bundle validate
+
+trace $CLI bundle summary
+
+rm -f "$OUT_REQUESTS"
+trace $CLI bundle deploy
+
+# Get role details
+project_name="projects/test-pg-proj-${UNIQUE_NAME}"
+branch_name="${project_name}/branches/main"
+role_name="${branch_name}/roles/test-role"
+trace $CLI postgres get-role "${role_name}" | role_fields
+
+# Postgres roles have no workspace URL, so opening one reports that rather than
+# suggesting a deploy.
+trace musterr $CLI bundle open my_role
+
+trace $CLI bundle summary
+
+# Filter requests to only show postgres operations (exclude workspace, telemetry, and operation polling)
+trace print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.json
diff --git a/acceptance/bundle/resources/postgres_roles/inherited-role-bind/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_roles/inherited-role-bind/databricks.yml.tmpl
new file mode 100644
index 00000000000..09e24359bc4
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/inherited-role-bind/databricks.yml.tmpl
@@ -0,0 +1,25 @@
+bundle:
+  name: inherited-role-bind-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-$UNIQUE_NAME
+      display_name: "Test Project for Role Inheritance"
+      pg_version: 16
+      history_retention_duration: 604800s
+
+  postgres_branches:
+    main:
+      parent: ${resources.postgres_projects.my_project.id}
+      branch_id: main
+      no_expiry: true
+
+  postgres_roles:
+    my_role:
+      parent: ${resources.postgres_branches.main.id}
+      role_id: test-role
+      postgres_role: app_role
diff --git a/acceptance/bundle/resources/postgres_roles/inherited-role-bind/out.test.toml b/acceptance/bundle/resources/postgres_roles/inherited-role-bind/out.test.toml
new file mode 100644
index 00000000000..18f5005f731
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/inherited-role-bind/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = false
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/resources/postgres_roles/inherited-role-bind/output.txt b/acceptance/bundle/resources/postgres_roles/inherited-role-bind/output.txt
new file mode 100644
index 00000000000..f3f4318a653
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/inherited-role-bind/output.txt
@@ -0,0 +1,41 @@
+
+=== Deploy project, branch, and role
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/inherited-role-bind-[UNIQUE_NAME]/default/files...
+Created postgres_branches.main
+Created postgres_projects.my_project
+Created postgres_roles.my_role
+Files: 0 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Unbind the role: it now exists on the branch but is untracked
+>>> [CLI] bundle deployment unbind my_role
+
+=== Bind the existing role to take explicit ownership of it
+>>> [CLI] bundle deployment bind my_role projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/test-role --auto-approve
+Successfully bound postgres_role with an id 'projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/test-role'
+Run 'bundle deploy' to deploy changes to your workspace
+
+=== Re-deploy now succeeds: the role is managed, not re-created
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/inherited-role-bind-[UNIQUE_NAME]/default/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 3 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.postgres_branches.main
+  delete resources.postgres_projects.my_project
+  delete resources.postgres_roles.my_role
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase branches.
+All data stored in them will be permanently lost:
+  delete resources.postgres_branches.main
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/inherited-role-bind-[UNIQUE_NAME]/default
+
+Destroy: 3 deleted
diff --git a/acceptance/bundle/resources/postgres_roles/inherited-role-bind/script b/acceptance/bundle/resources/postgres_roles/inherited-role-bind/script
new file mode 100644
index 00000000000..2ab55515360
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/inherited-role-bind/script
@@ -0,0 +1,22 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+   trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+title "Deploy project, branch, and role"
+trace $CLI bundle deploy
+
+title "Unbind the role: it now exists on the branch but is untracked"
+# Stages the state a child branch lands in: the role exists (it would be
+# inherited from the parent) but the bundle does not own it. The testserver
+# does not model branch role inheritance, so we stage it via unbind.
+trace $CLI bundle deployment unbind my_role
+
+title "Bind the existing role to take explicit ownership of it"
+role_name="projects/test-pg-proj-${UNIQUE_NAME}/branches/main/roles/test-role"
+trace $CLI bundle deployment bind my_role "${role_name}" --auto-approve
+
+title "Re-deploy now succeeds: the role is managed, not re-created"
+trace $CLI bundle deploy
diff --git a/acceptance/bundle/resources/postgres_roles/inherited-role-bind/test.toml b/acceptance/bundle/resources/postgres_roles/inherited-role-bind/test.toml
new file mode 100644
index 00000000000..18dc918d1e1
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/inherited-role-bind/test.toml
@@ -0,0 +1,13 @@
+RecordRequests = false
+# Companion to inherited-role-conflict: shows the supported escape hatch.
+# `bundle deployment bind` takes ownership of a pre-existing (e.g. inherited)
+# role so the next deploy manages it instead of trying to create it.
+
+# Inheritance is staged locally via unbind; not run on cloud.
+Cloud = false
+
+# bind/deploy are engine-agnostic here; run on direct for a single stable output.
+
+# bind and unbind refuse to run when deployment history recording is on, so the
+# escape hatch this test covers is not available there yet.
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/resources/postgres_roles/inherited-role-conflict/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_roles/inherited-role-conflict/databricks.yml.tmpl
new file mode 100644
index 00000000000..adf6ac40023
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/inherited-role-conflict/databricks.yml.tmpl
@@ -0,0 +1,25 @@
+bundle:
+  name: inherited-role-conflict-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-$UNIQUE_NAME
+      display_name: "Test Project for Role Inheritance"
+      pg_version: 16
+      history_retention_duration: 604800s
+
+  postgres_branches:
+    main:
+      parent: ${resources.postgres_projects.my_project.id}
+      branch_id: main
+      no_expiry: true
+
+  postgres_roles:
+    my_role:
+      parent: ${resources.postgres_branches.main.id}
+      role_id: test-role
+      postgres_role: app_role
diff --git a/acceptance/bundle/resources/postgres_roles/inherited-role-conflict/out.test.toml b/acceptance/bundle/resources/postgres_roles/inherited-role-conflict/out.test.toml
new file mode 100644
index 00000000000..18f5005f731
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/inherited-role-conflict/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = false
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/resources/postgres_roles/inherited-role-conflict/output.txt b/acceptance/bundle/resources/postgres_roles/inherited-role-conflict/output.txt
new file mode 100644
index 00000000000..f6f94cb232d
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/inherited-role-conflict/output.txt
@@ -0,0 +1,49 @@
+
+=== Deploy project, branch, and role
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/inherited-role-conflict-[UNIQUE_NAME]/default/files...
+Created postgres_branches.main
+Created postgres_projects.my_project
+Created postgres_roles.my_role
+Files: 0 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Unbind the role: it now exists on the branch but is no longer tracked by the bundle
+>>> [CLI] bundle deployment unbind my_role
+
+=== Plan after unbind: the bundle wants to (re-)create the role
+>>> [CLI] bundle plan
+create postgres_roles.my_role
+
+Plan: 1 to add, 0 to change, 0 to delete, 2 unchanged
+
+=== Re-deploy: creating the already-existing role fails
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/inherited-role-conflict-[UNIQUE_NAME]/default/files...
+Error: cannot create resources.postgres_roles.my_role: role with that name already exists (400 BAD_REQUEST)
+
+Endpoint: POST [DATABRICKS_URL]/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles?role_id=test-role
+HTTP Status: 400 Bad Request
+API error_code: BAD_REQUEST
+API message: role with that name already exists
+
+Files: 0 uploaded, 0 deleted
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.postgres_branches.main
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase branches.
+All data stored in them will be permanently lost:
+  delete resources.postgres_branches.main
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/inherited-role-conflict-[UNIQUE_NAME]/default
+
+Destroy: 2 deleted
+
+Exit code: 1
diff --git a/acceptance/bundle/resources/postgres_roles/inherited-role-conflict/script b/acceptance/bundle/resources/postgres_roles/inherited-role-conflict/script
new file mode 100644
index 00000000000..91c6f486de3
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/inherited-role-conflict/script
@@ -0,0 +1,20 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+   trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+title "Deploy project, branch, and role"
+trace $CLI bundle deploy
+
+title "Unbind the role: it now exists on the branch but is no longer tracked by the bundle"
+# Mirrors an inherited role on a child branch: present on the branch, but not
+# created or owned by this bundle.
+trace $CLI bundle deployment unbind my_role
+
+title "Plan after unbind: the bundle wants to (re-)create the role"
+trace $CLI bundle plan
+
+title "Re-deploy: creating the already-existing role fails"
+trace $CLI bundle deploy
diff --git a/acceptance/bundle/resources/postgres_roles/inherited-role-conflict/test.toml b/acceptance/bundle/resources/postgres_roles/inherited-role-conflict/test.toml
new file mode 100644
index 00000000000..02597575447
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/inherited-role-conflict/test.toml
@@ -0,0 +1,11 @@
+RecordRequests = false
+Badness = "Reproduces the conflict a bundle hits when it declares a Postgres role that already exists on the branch — the situation on a child branch, which inherits the parent's roles at creation (verified on dogfood 2026-06-10). The bundle plans to create the role and the API rejects it with HTTP 400 'role with that name already exists'. This is the intended interim behavior: until a replace_existing flag lets a bundle take explicit ownership of an existing role, the supported escape hatch is `bundle deployment bind` (see the inherited-role-bind test). The testserver does not model branch role inheritance, so the pre-existing role is staged via `bundle deployment unbind`; the test is therefore local-only."
+
+# Inheritance is staged locally via unbind; not run on cloud.
+Cloud = false
+
+# Deploy error wording differs between engines; the conflict itself is engine-agnostic.
+
+# `bundle unbind` does not yet drop the resource from what the deployment metadata service
+# reports, so the role staged above still looks tracked.
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/resources/postgres_roles/recreate-postgres-role/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_roles/recreate-postgres-role/databricks.yml.tmpl
new file mode 100644
index 00000000000..7a85f471b06
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/recreate-postgres-role/databricks.yml.tmpl
@@ -0,0 +1,25 @@
+bundle:
+  name: deploy-postgres-role-recreate-postgres-role-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-$UNIQUE_NAME
+      display_name: "Test Project for Role"
+      pg_version: 16
+      history_retention_duration: "604800s"
+
+  postgres_branches:
+    main:
+      parent: ${resources.postgres_projects.my_project.id}
+      branch_id: main
+      no_expiry: true
+
+  postgres_roles:
+    my_role:
+      parent: ${resources.postgres_branches.main.id}
+      role_id: test-role-$UNIQUE_NAME
+      postgres_role: POSTGRES_ROLE_PLACEHOLDER
diff --git a/acceptance/bundle/resources/postgres_roles/recreate-postgres-role/out.test.toml b/acceptance/bundle/resources/postgres_roles/recreate-postgres-role/out.test.toml
new file mode 100644
index 00000000000..ee153e82621
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/recreate-postgres-role/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_roles/recreate-postgres-role/output.txt b/acceptance/bundle/resources/postgres_roles/recreate-postgres-role/output.txt
new file mode 100644
index 00000000000..8743a283141
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/recreate-postgres-role/output.txt
@@ -0,0 +1,193 @@
+
+>>> cat databricks.yml
+bundle:
+  name: deploy-postgres-role-recreate-postgres-role-[UNIQUE_NAME]
+
+sync:
+  paths: []
+
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-[UNIQUE_NAME]
+      display_name: "Test Project for Role"
+      pg_version: 16
+      history_retention_duration: "604800s"
+
+  postgres_branches:
+    main:
+      parent: ${resources.postgres_projects.my_project.id}
+      branch_id: main
+      no_expiry: true
+
+  postgres_roles:
+    my_role:
+      parent: ${resources.postgres_branches.main.id}
+      role_id: test-role-[UNIQUE_NAME]
+      postgres_role: app_role_v1
+
+>>> [CLI] bundle plan
+create postgres_branches.main
+create postgres_projects.my_project
+create postgres_roles.my_role
+
+Plan: 3 to add, 0 to change, 0 to delete, 0 unchanged
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-role-recreate-postgres-role-[UNIQUE_NAME]/default/files...
+Created postgres_branches.main
+Created postgres_projects.my_project
+Created postgres_roles.my_role
+Files: 0 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py --unique --del-body parent,project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects",
+  "q": {
+    "project_id": "test-pg-proj-[UNIQUE_NAME]"
+  },
+  "body": {
+    "spec": {
+      "display_name": "Test Project for Role",
+      "history_retention_duration": "604800s",
+      "pg_version": 16
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches",
+  "q": {
+    "branch_id": "main"
+  },
+  "body": {
+    "spec": {
+      "no_expiry": true
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles",
+  "q": {
+    "role_id": "test-role-[UNIQUE_NAME]"
+  },
+  "body": {
+    "spec": {
+      "postgres_role": "app_role_v1"
+    }
+  }
+}
+
+>>> cat databricks.yml
+bundle:
+  name: deploy-postgres-role-recreate-postgres-role-[UNIQUE_NAME]
+
+sync:
+  paths: []
+
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-[UNIQUE_NAME]
+      display_name: "Test Project for Role"
+      pg_version: 16
+      history_retention_duration: "604800s"
+
+  postgres_branches:
+    main:
+      parent: ${resources.postgres_projects.my_project.id}
+      branch_id: main
+      no_expiry: true
+
+  postgres_roles:
+    my_role:
+      parent: ${resources.postgres_branches.main.id}
+      role_id: test-role-[UNIQUE_NAME]
+      postgres_role: app_role_v2
+
+>>> [CLI] bundle plan
+recreate postgres_roles.my_role
+
+Plan: 1 to add, 0 to change, 1 to delete, 2 unchanged
+
+>>> [CLI] bundle deploy --auto-approve
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-role-recreate-postgres-role-[UNIQUE_NAME]/default/files...
+Recreated postgres_roles.my_role
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 2 unchanged
+
+>>> print_requests.py --unique --del-body parent,project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+{
+  "method": "DELETE",
+  "path": "/api/2.0/postgres/[MY_ROLE_ID]"
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles",
+  "q": {
+    "role_id": "test-role-[UNIQUE_NAME]"
+  },
+  "body": {
+    "spec": {
+      "postgres_role": "app_role_v2"
+    }
+  }
+}
+
+=== Fetch role and verify the new postgres_role value is live
+>>> [CLI] postgres get-role [MY_ROLE_ID]
+{
+  "name": "[MY_ROLE_ID]",
+  "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
+  "role_id": "test-role-[UNIQUE_NAME]",
+  "status": {
+    "attributes": {
+      "bypassrls": false,
+      "createdb": false,
+      "createrole": false
+    },
+    "auth_method": "PG_PASSWORD_SCRAM_SHA_256",
+    "identity_type": "IDENTITY_TYPE_UNSPECIFIED",
+    "postgres_role": "app_role_v2",
+    "role_id": "test-role-[UNIQUE_NAME]"
+  }
+}
+
+=== Destroy and verify cleanup
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.postgres_branches.main
+  delete resources.postgres_projects.my_project
+  delete resources.postgres_roles.my_role
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase branches.
+All data stored in them will be permanently lost:
+  delete resources.postgres_branches.main
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-role-recreate-postgres-role-[UNIQUE_NAME]/default
+
+Destroy: 3 deleted
+
+>>> print_requests.py --unique --del-body parent,project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+{
+  "method": "DELETE",
+  "path": "/api/2.0/postgres/[MY_ROLE_ID]"
+}
+{
+  "method": "DELETE",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main"
+}
+{
+  "method": "DELETE",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
+}
+
+>>> [CLI] bundle destroy --auto-approve
+No active deployment found to destroy!
diff --git a/acceptance/bundle/resources/postgres_roles/recreate-postgres-role/script b/acceptance/bundle/resources/postgres_roles/recreate-postgres-role/script
new file mode 100644
index 00000000000..bcbb56aad86
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/recreate-postgres-role/script
@@ -0,0 +1,40 @@
+cleanup() {
+   trace $CLI bundle destroy --auto-approve
+
+   # Best-effort cleanup if a deploy left the role behind.
+   $CLI postgres delete-role "projects/test-pg-proj-${UNIQUE_NAME}/branches/main/roles/test-role-${UNIQUE_NAME}" 2>/dev/null || true
+
+   rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+# Deploy with the first postgres_role value.
+envsubst < databricks.yml.tmpl | sed "s/POSTGRES_ROLE_PLACEHOLDER/app_role_v1/" > databricks.yml
+
+trace cat databricks.yml
+
+trace $CLI bundle plan
+trace $CLI bundle deploy
+
+trace print_requests.py --unique --del-body parent,project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/'
+
+# Change postgres_role; the backend rejects this field in update_mask, so the
+# plan must show delete + create rather than an in-place PATCH.
+envsubst < databricks.yml.tmpl | sed "s/POSTGRES_ROLE_PLACEHOLDER/app_role_v2/" > databricks.yml
+
+trace cat databricks.yml
+
+trace $CLI bundle plan
+trace $CLI bundle deploy --auto-approve
+
+trace print_requests.py --unique --del-body parent,project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/'
+
+title "Fetch role and verify the new postgres_role value is live"
+
+role_name=`read_id.py my_role`
+trace $CLI postgres get-role $role_name | role_fields
+
+title "Destroy and verify cleanup"
+trace $CLI bundle destroy --auto-approve
+
+trace print_requests.py --unique --del-body parent,project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/'
diff --git a/acceptance/bundle/resources/postgres_roles/recreate-postgres-role/test.toml b/acceptance/bundle/resources/postgres_roles/recreate-postgres-role/test.toml
new file mode 100644
index 00000000000..55033fb27fc
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/recreate-postgres-role/test.toml
@@ -0,0 +1 @@
+Badness = "Terraform provider treats spec.postgres_role as updateable and sends update_mask=spec instead of recreating; backend silently no-ops the change. Direct engine correctly recreates."
diff --git a/acceptance/bundle/resources/postgres_roles/recreate/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_roles/recreate/databricks.yml.tmpl
new file mode 100644
index 00000000000..2daa730fbef
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/recreate/databricks.yml.tmpl
@@ -0,0 +1,25 @@
+bundle:
+  name: deploy-postgres-role-recreate-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-$UNIQUE_NAME
+      display_name: "Test Project for Role"
+      pg_version: 16
+      history_retention_duration: "604800s"
+
+  postgres_branches:
+    main:
+      parent: ${resources.postgres_projects.my_project.id}
+      branch_id: main
+      no_expiry: true
+
+  postgres_roles:
+    my_role:
+      parent: ${resources.postgres_branches.main.id}
+      role_id: ROLE_ID_PLACEHOLDER
+      postgres_role: app_role
diff --git a/acceptance/bundle/resources/postgres_roles/recreate/out.test.toml b/acceptance/bundle/resources/postgres_roles/recreate/out.test.toml
new file mode 100644
index 00000000000..ee153e82621
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/recreate/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_roles/recreate/output.txt b/acceptance/bundle/resources/postgres_roles/recreate/output.txt
new file mode 100644
index 00000000000..dc0c7e73f6d
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/recreate/output.txt
@@ -0,0 +1,193 @@
+
+>>> cat databricks.yml
+bundle:
+  name: deploy-postgres-role-recreate-[UNIQUE_NAME]
+
+sync:
+  paths: []
+
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-[UNIQUE_NAME]
+      display_name: "Test Project for Role"
+      pg_version: 16
+      history_retention_duration: "604800s"
+
+  postgres_branches:
+    main:
+      parent: ${resources.postgres_projects.my_project.id}
+      branch_id: main
+      no_expiry: true
+
+  postgres_roles:
+    my_role:
+      parent: ${resources.postgres_branches.main.id}
+      role_id: test-role-[UNIQUE_NAME]
+      postgres_role: app_role
+
+>>> [CLI] bundle plan
+create postgres_branches.main
+create postgres_projects.my_project
+create postgres_roles.my_role
+
+Plan: 3 to add, 0 to change, 0 to delete, 0 unchanged
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-role-recreate-[UNIQUE_NAME]/default/files...
+Created postgres_branches.main
+Created postgres_projects.my_project
+Created postgres_roles.my_role
+Files: 0 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py --unique --del-body parent,project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects",
+  "q": {
+    "project_id": "test-pg-proj-[UNIQUE_NAME]"
+  },
+  "body": {
+    "spec": {
+      "display_name": "Test Project for Role",
+      "history_retention_duration": "604800s",
+      "pg_version": 16
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches",
+  "q": {
+    "branch_id": "main"
+  },
+  "body": {
+    "spec": {
+      "no_expiry": true
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles",
+  "q": {
+    "role_id": "test-role-[UNIQUE_NAME]"
+  },
+  "body": {
+    "spec": {
+      "postgres_role": "app_role"
+    }
+  }
+}
+
+>>> cat databricks.yml
+bundle:
+  name: deploy-postgres-role-recreate-[UNIQUE_NAME]
+
+sync:
+  paths: []
+
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-[UNIQUE_NAME]
+      display_name: "Test Project for Role"
+      pg_version: 16
+      history_retention_duration: "604800s"
+
+  postgres_branches:
+    main:
+      parent: ${resources.postgres_projects.my_project.id}
+      branch_id: main
+      no_expiry: true
+
+  postgres_roles:
+    my_role:
+      parent: ${resources.postgres_branches.main.id}
+      role_id: test-role-[UNIQUE_NAME]-v2
+      postgres_role: app_role
+
+>>> [CLI] bundle plan
+recreate postgres_roles.my_role
+
+Plan: 1 to add, 0 to change, 1 to delete, 2 unchanged
+
+>>> [CLI] bundle deploy --auto-approve
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-role-recreate-[UNIQUE_NAME]/default/files...
+Recreated postgres_roles.my_role
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 2 unchanged
+
+>>> print_requests.py --unique --del-body parent,project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+{
+  "method": "DELETE",
+  "path": "/api/2.0/postgres/[MY_ROLE_ID]"
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles",
+  "q": {
+    "role_id": "test-role-[UNIQUE_NAME]-v2"
+  },
+  "body": {
+    "spec": {
+      "postgres_role": "app_role"
+    }
+  }
+}
+
+=== Fetch role and verify it exists after recreation
+>>> [CLI] postgres get-role [MY_ROLE_ID]-v2
+{
+  "name": "[MY_ROLE_ID]-v2",
+  "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
+  "role_id": "test-role-[UNIQUE_NAME]-v2",
+  "status": {
+    "attributes": {
+      "bypassrls": false,
+      "createdb": false,
+      "createrole": false
+    },
+    "auth_method": "PG_PASSWORD_SCRAM_SHA_256",
+    "identity_type": "IDENTITY_TYPE_UNSPECIFIED",
+    "postgres_role": "app_role",
+    "role_id": "test-role-[UNIQUE_NAME]-v2"
+  }
+}
+
+=== Destroy and verify cleanup
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.postgres_branches.main
+  delete resources.postgres_projects.my_project
+  delete resources.postgres_roles.my_role
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase branches.
+All data stored in them will be permanently lost:
+  delete resources.postgres_branches.main
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-role-recreate-[UNIQUE_NAME]/default
+
+Destroy: 3 deleted
+
+>>> print_requests.py --unique --del-body parent,project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+{
+  "method": "DELETE",
+  "path": "/api/2.0/postgres/[MY_ROLE_ID]-v2"
+}
+{
+  "method": "DELETE",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main"
+}
+{
+  "method": "DELETE",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
+}
+
+>>> [CLI] bundle destroy --auto-approve
+No active deployment found to destroy!
diff --git a/acceptance/bundle/resources/postgres_roles/recreate/script b/acceptance/bundle/resources/postgres_roles/recreate/script
new file mode 100644
index 00000000000..74c3a7362e7
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/recreate/script
@@ -0,0 +1,42 @@
+cleanup() {
+   trace $CLI bundle destroy --auto-approve
+
+   # Best-effort cleanup if a deploy left a role behind under either id.
+   $CLI postgres delete-role "projects/test-pg-proj-${UNIQUE_NAME}/branches/main/roles/test-role-${UNIQUE_NAME}" 2>/dev/null || true
+   $CLI postgres delete-role "projects/test-pg-proj-${UNIQUE_NAME}/branches/main/roles/test-role-${UNIQUE_NAME}-v2" 2>/dev/null || true
+
+   rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+# Deploy with first role_id
+envsubst < databricks.yml.tmpl | sed "s/ROLE_ID_PLACEHOLDER/test-role-${UNIQUE_NAME}/" > databricks.yml
+
+trace cat databricks.yml
+
+trace $CLI bundle plan
+trace $CLI bundle deploy
+
+role_id_1=`read_id.py my_role`
+
+trace print_requests.py --unique --del-body parent,project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/'
+
+# Change role_id (encoded in name); should trigger recreation.
+envsubst < databricks.yml.tmpl | sed "s/ROLE_ID_PLACEHOLDER/test-role-${UNIQUE_NAME}-v2/" > databricks.yml
+
+trace cat databricks.yml
+
+trace $CLI bundle plan
+trace $CLI bundle deploy --auto-approve
+
+trace print_requests.py --unique --del-body parent,project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/'
+
+title "Fetch role and verify it exists after recreation"
+
+role_id_2=`read_id.py my_role`
+trace $CLI postgres get-role $role_id_2 | role_fields
+
+title "Destroy and verify cleanup"
+trace $CLI bundle destroy --auto-approve
+
+trace print_requests.py --unique --del-body parent,project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/'
diff --git a/acceptance/bundle/resources/postgres_roles/replace_existing/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_roles/replace_existing/databricks.yml.tmpl
new file mode 100644
index 00000000000..55fa325caa5
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/replace_existing/databricks.yml.tmpl
@@ -0,0 +1,30 @@
+bundle:
+  name: replace-existing-role-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-$UNIQUE_NAME
+      display_name: "Test Project for Role replace_existing"
+      pg_version: 16
+      history_retention_duration: 604800s
+
+  postgres_branches:
+    main:
+      parent: ${resources.postgres_projects.my_project.id}
+      branch_id: main
+      no_expiry: true
+
+  # replace_existing takes over a role that already exists on the branch (e.g.
+  # inherited from the parent branch) instead of erroring with ALREADY_EXISTS.
+  # The field is input-only and not surfaced in get-role, but it is visible in
+  # the recorded request body so the diff confirms it was sent.
+  postgres_roles:
+    my_role:
+      parent: ${resources.postgres_branches.main.id}
+      role_id: test-role
+      postgres_role: app_role
+      replace_existing: true
diff --git a/acceptance/bundle/resources/postgres_roles/replace_existing/out.requests.deploy.json b/acceptance/bundle/resources/postgres_roles/replace_existing/out.requests.deploy.json
new file mode 100644
index 00000000000..5f289588af5
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/replace_existing/out.requests.deploy.json
@@ -0,0 +1,33 @@
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main"
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles",
+  "q": {
+    "replace_existing": "true",
+    "role_id": "test-role"
+  },
+  "body": {
+    "spec": {
+      "postgres_role": "app_role"
+    }
+  }
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/test-role"
+}
diff --git a/acceptance/bundle/resources/postgres_roles/replace_existing/out.test.toml b/acceptance/bundle/resources/postgres_roles/replace_existing/out.test.toml
new file mode 100644
index 00000000000..a026907d175
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/replace_existing/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/resources/postgres_roles/replace_existing/output.txt b/acceptance/bundle/resources/postgres_roles/replace_existing/output.txt
new file mode 100644
index 00000000000..4073ac96ab0
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/replace_existing/output.txt
@@ -0,0 +1,64 @@
+
+=== Deploy project, branch, and role
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/replace-existing-role-[UNIQUE_NAME]/default/files...
+Created postgres_branches.main
+Created postgres_projects.my_project
+Created postgres_roles.my_role
+Files: 0 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Unbind the role: it now exists on the branch but is no longer tracked by the bundle
+>>> [CLI] bundle deployment unbind my_role
+
+=== Plan after unbind: the bundle wants to (re-)create the role
+>>> [CLI] bundle plan
+create postgres_roles.my_role
+
+Plan: 1 to add, 0 to change, 0 to delete, 2 unchanged
+
+=== Re-deploy: replace_existing adopts the already-existing role instead of erroring
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/replace-existing-role-[UNIQUE_NAME]/default/files...
+Created postgres_roles.my_role
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 2 unchanged
+
+=== Confirm the role is under management again
+>>> [CLI] postgres get-role projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/test-role
+{
+  "name": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/test-role",
+  "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
+  "role_id": "test-role",
+  "status": {
+    "attributes": {
+      "bypassrls": false,
+      "createdb": false,
+      "createrole": false
+    },
+    "auth_method": "PG_PASSWORD_SCRAM_SHA_256",
+    "identity_type": "IDENTITY_TYPE_UNSPECIFIED",
+    "postgres_role": "app_role",
+    "role_id": "test-role"
+  }
+}
+
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.postgres_branches.main
+  delete resources.postgres_projects.my_project
+  delete resources.postgres_roles.my_role
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase branches.
+All data stored in them will be permanently lost:
+  delete resources.postgres_branches.main
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/replace-existing-role-[UNIQUE_NAME]/default
+
+Destroy: 3 deleted
diff --git a/acceptance/bundle/resources/postgres_roles/replace_existing/script b/acceptance/bundle/resources/postgres_roles/replace_existing/script
new file mode 100644
index 00000000000..211e0f6458f
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/replace_existing/script
@@ -0,0 +1,27 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+   trace $CLI bundle destroy --auto-approve
+   rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+title "Deploy project, branch, and role"
+trace $CLI bundle deploy
+
+title "Unbind the role: it now exists on the branch but is no longer tracked by the bundle"
+# Mirrors an inherited role on a child branch: present on the branch, but not
+# created or owned by this bundle.
+trace $CLI bundle deployment unbind my_role
+
+title "Plan after unbind: the bundle wants to (re-)create the role"
+trace $CLI bundle plan
+
+title "Re-deploy: replace_existing adopts the already-existing role instead of erroring"
+rm -f "$OUT_REQUESTS"
+trace $CLI bundle deploy
+
+title "Confirm the role is under management again"
+trace $CLI postgres get-role "projects/test-pg-proj-${UNIQUE_NAME}/branches/main/roles/test-role" | role_fields
+
+trace print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.deploy.json
diff --git a/acceptance/bundle/resources/postgres_roles/replace_existing/test.toml b/acceptance/bundle/resources/postgres_roles/replace_existing/test.toml
new file mode 100644
index 00000000000..ca4bbbef122
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/replace_existing/test.toml
@@ -0,0 +1,3 @@
+# `bundle unbind` does not yet drop the resource from what the deployment metadata service
+# reports, so the plan after the unbind still sees the role as tracked.
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/resources/postgres_roles/script.prepare b/acceptance/bundle/resources/postgres_roles/script.prepare
new file mode 100644
index 00000000000..e3a4fb4d76f
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/script.prepare
@@ -0,0 +1,6 @@
+# role_fields is the allow-list of role fields the acceptance tests assert on.
+# Anything the backend returns outside this list is dropped, so a new field in
+# the API response does not break the golden.
+role_fields() {
+    jq '{name, parent, role_id, status: (.status | {attributes, auth_method, identity_type, postgres_role, role_id})}'
+}
diff --git a/acceptance/bundle/resources/postgres_roles/test.toml b/acceptance/bundle/resources/postgres_roles/test.toml
new file mode 100644
index 00000000000..8c1145246b1
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/test.toml
@@ -0,0 +1,36 @@
+Cloud = true
+
+# Lakebase v2 (postgres) is only available in AWS as of January 2026
+CloudEnvs.gcp = false
+CloudEnvs.azure = false
+
+# Run on both direct and Terraform modes
+
+Ignore = [
+    "databricks.yml",
+    ".databricks",
+]
+
+[[Repls]]
+# Clean up ?o=<num> suffix after URL since not all workspaces have that
+Old = '\?o=\[(WORKSPACE_ID|ALPHANUMID)\]'
+New = ''
+Order = 1000
+
+[[Repls]]
+# Normalize branch UIDs (br-xxx-yyy-zzz format, supports both word-based and hex-based UIDs)
+Old = 'br-[a-z0-9-]+'
+New = '[BRANCH_UID]'
+Order = 1
+
+[[Repls]]
+# Normalize project UIDs (proj-xxx-yyy-zzz format)
+Old = 'proj-[a-z0-9]+-[a-z0-9]+-[a-z0-9]+-[a-z0-9]'
+New = '[PROJECT_UID]'
+Order = 1
+
+[[Repls]]
+# Normalize LSN values (format: 0/HEXVALUE or 0/0)
+Old = '"source_branch_lsn": "0/[A-F0-9]+"'
+New = '"source_branch_lsn": "[LSN]"'
+Order = 1
diff --git a/acceptance/bundle/resources/postgres_roles/update/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_roles/update/databricks.yml.tmpl
new file mode 100644
index 00000000000..f0ca4e48870
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/update/databricks.yml.tmpl
@@ -0,0 +1,27 @@
+bundle:
+  name: update-postgres-role-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-$UNIQUE_NAME
+      display_name: "Test Project for Role Update"
+      pg_version: 16
+      history_retention_duration: 604800s
+
+  postgres_branches:
+    main:
+      parent: ${resources.postgres_projects.my_project.id}
+      branch_id: main
+      no_expiry: true
+
+  postgres_roles:
+    my_role:
+      parent: ${resources.postgres_branches.main.id}
+      role_id: test-role
+      postgres_role: app_role
+      attributes:
+        createdb: false
diff --git a/acceptance/bundle/resources/postgres_roles/update/out.plan.create.json b/acceptance/bundle/resources/postgres_roles/update/out.plan.create.json
new file mode 100644
index 00000000000..d79dbc488a0
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/update/out.plan.create.json
@@ -0,0 +1,22 @@
+{
+  "depends_on": [
+    {
+      "node": "resources.postgres_branches.main",
+      "label": "${resources.postgres_branches.main.id}"
+    }
+  ],
+  "action": "create",
+  "new_state": {
+    "value": {
+      "attributes": {
+        "createdb": false
+      },
+      "parent": "${resources.postgres_branches.main.id}",
+      "postgres_role": "app_role",
+      "role_id": "test-role"
+    },
+    "vars": {
+      "parent": "${resources.postgres_branches.main.id}"
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_roles/update/out.plan.no_change.json b/acceptance/bundle/resources/postgres_roles/update/out.plan.no_change.json
new file mode 100644
index 00000000000..16cc6bd6a72
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/update/out.plan.no_change.json
@@ -0,0 +1,45 @@
+{
+  "depends_on": [
+    {
+      "node": "resources.postgres_branches.main",
+      "label": "${resources.postgres_branches.main.id}"
+    }
+  ],
+  "action": "skip",
+  "remote_state": {
+    "create_time": "[TIMESTAMP]",
+    "name": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/test-role",
+    "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
+    "role_id": "test-role",
+    "status": {
+      "attributes": {
+        "bypassrls": false,
+        "createdb": false,
+        "createrole": false
+      },
+      "auth_method": "PG_PASSWORD_SCRAM_SHA_256",
+      "identity_type": "IDENTITY_TYPE_UNSPECIFIED",
+      "postgres_role": "app_role",
+      "role_id": "test-role"
+    },
+    "update_time": "[TIMESTAMP]"
+  },
+  "changes": {
+    "attributes": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": {
+        "createdb": false
+      },
+      "new": {
+        "createdb": false
+      }
+    },
+    "postgres_role": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": "app_role",
+      "new": "app_role"
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_roles/update/out.plan.restore.json b/acceptance/bundle/resources/postgres_roles/update/out.plan.restore.json
new file mode 100644
index 00000000000..e6ff6664b92
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/update/out.plan.restore.json
@@ -0,0 +1,59 @@
+{
+  "depends_on": [
+    {
+      "node": "resources.postgres_branches.main",
+      "label": "${resources.postgres_branches.main.id}"
+    }
+  ],
+  "action": "update",
+  "new_state": {
+    "value": {
+      "attributes": {
+        "createdb": false
+      },
+      "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
+      "postgres_role": "app_role",
+      "role_id": "test-role"
+    }
+  },
+  "remote_state": {
+    "create_time": "[TIMESTAMP]",
+    "name": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/test-role",
+    "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
+    "role_id": "test-role",
+    "status": {
+      "attributes": {
+        "bypassrls": false,
+        "createdb": true,
+        "createrole": false
+      },
+      "auth_method": "PG_PASSWORD_SCRAM_SHA_256",
+      "identity_type": "IDENTITY_TYPE_UNSPECIFIED",
+      "postgres_role": "app_role",
+      "role_id": "test-role"
+    },
+    "update_time": "[TIMESTAMP]"
+  },
+  "changes": {
+    "attributes": {
+      "action": "update",
+      "old": {
+        "createdb": true
+      },
+      "new": {
+        "createdb": false
+      }
+    },
+    "attributes.createdb": {
+      "action": "update",
+      "old": true,
+      "new": false
+    },
+    "postgres_role": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": "app_role",
+      "new": "app_role"
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_roles/update/out.plan.update.json b/acceptance/bundle/resources/postgres_roles/update/out.plan.update.json
new file mode 100644
index 00000000000..76b67ee2de5
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/update/out.plan.update.json
@@ -0,0 +1,59 @@
+{
+  "depends_on": [
+    {
+      "node": "resources.postgres_branches.main",
+      "label": "${resources.postgres_branches.main.id}"
+    }
+  ],
+  "action": "update",
+  "new_state": {
+    "value": {
+      "attributes": {
+        "createdb": true
+      },
+      "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
+      "postgres_role": "app_role",
+      "role_id": "test-role"
+    }
+  },
+  "remote_state": {
+    "create_time": "[TIMESTAMP]",
+    "name": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/test-role",
+    "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
+    "role_id": "test-role",
+    "status": {
+      "attributes": {
+        "bypassrls": false,
+        "createdb": false,
+        "createrole": false
+      },
+      "auth_method": "PG_PASSWORD_SCRAM_SHA_256",
+      "identity_type": "IDENTITY_TYPE_UNSPECIFIED",
+      "postgres_role": "app_role",
+      "role_id": "test-role"
+    },
+    "update_time": "[TIMESTAMP]"
+  },
+  "changes": {
+    "attributes": {
+      "action": "update",
+      "old": {
+        "createdb": false
+      },
+      "new": {
+        "createdb": true
+      }
+    },
+    "attributes.createdb": {
+      "action": "update",
+      "old": false,
+      "new": true
+    },
+    "postgres_role": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "old": "app_role",
+      "new": "app_role"
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_roles/update/out.requests.create.json b/acceptance/bundle/resources/postgres_roles/update/out.requests.create.json
new file mode 100644
index 00000000000..b102e4bb50a
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/update/out.requests.create.json
@@ -0,0 +1,41 @@
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects",
+  "q": {
+    "project_id": "test-pg-proj-[UNIQUE_NAME]"
+  },
+  "body": {
+    "spec": {
+      "display_name": "Test Project for Role Update",
+      "history_retention_duration": "604800s",
+      "pg_version": 16
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches",
+  "q": {
+    "branch_id": "main"
+  },
+  "body": {
+    "spec": {
+      "no_expiry": true
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles",
+  "q": {
+    "role_id": "test-role"
+  },
+  "body": {
+    "spec": {
+      "attributes": {
+        "createdb": false
+      },
+      "postgres_role": "app_role"
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_roles/update/out.requests.no_change.json b/acceptance/bundle/resources/postgres_roles/update/out.requests.no_change.json
new file mode 100644
index 00000000000..1d23ba72202
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/update/out.requests.no_change.json
@@ -0,0 +1,20 @@
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/test-role"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main"
+}
diff --git a/acceptance/bundle/resources/postgres_roles/update/out.requests.restore.json b/acceptance/bundle/resources/postgres_roles/update/out.requests.restore.json
new file mode 100644
index 00000000000..198552d19ed
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/update/out.requests.restore.json
@@ -0,0 +1,35 @@
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/test-role"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main"
+}
+{
+  "method": "PATCH",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/test-role",
+  "q": {
+    "update_mask": "spec.attributes.createdb"
+  },
+  "body": {
+    "spec": {
+      "attributes": {
+        "createdb": false
+      },
+      "postgres_role": "app_role"
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_roles/update/out.requests.update.json b/acceptance/bundle/resources/postgres_roles/update/out.requests.update.json
new file mode 100644
index 00000000000..cdf033ce54f
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/update/out.requests.update.json
@@ -0,0 +1,35 @@
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/test-role"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main"
+}
+{
+  "method": "PATCH",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/test-role",
+  "q": {
+    "update_mask": "spec.attributes.createdb"
+  },
+  "body": {
+    "spec": {
+      "attributes": {
+        "createdb": true
+      },
+      "postgres_role": "app_role"
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_roles/update/out.test.toml b/acceptance/bundle/resources/postgres_roles/update/out.test.toml
new file mode 100644
index 00000000000..ee153e82621
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/update/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_roles/update/output.txt b/acceptance/bundle/resources/postgres_roles/update/output.txt
new file mode 100644
index 00000000000..f95c6c0118e
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/update/output.txt
@@ -0,0 +1,179 @@
+
+=== Initial deployment
+>>> [CLI] bundle validate
+Name: update-postgres-role-[UNIQUE_NAME]
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/update-postgres-role-[UNIQUE_NAME]/default
+
+Validation OK!
+
+>>> [CLI] bundle plan
+create postgres_branches.main
+create postgres_projects.my_project
+create postgres_roles.my_role
+
+Plan: 3 to add, 0 to change, 0 to delete, 0 unchanged
+
+>>> [CLI] bundle plan -o json
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-postgres-role-[UNIQUE_NAME]/default/files...
+Created postgres_branches.main
+Created postgres_projects.my_project
+Created postgres_roles.my_role
+Files: 0 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+
+>>> [CLI] postgres get-role projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/test-role
+{
+  "name": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/test-role",
+  "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
+  "role_id": "test-role",
+  "status": {
+    "attributes": {
+      "bypassrls": false,
+      "createdb": false,
+      "createrole": false
+    },
+    "auth_method": "PG_PASSWORD_SCRAM_SHA_256",
+    "identity_type": "IDENTITY_TYPE_UNSPECIFIED",
+    "postgres_role": "app_role",
+    "role_id": "test-role"
+  }
+}
+
+=== Verify no changes
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 3 unchanged
+
+>>> [CLI] bundle plan -o json
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-postgres-role-[UNIQUE_NAME]/default/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 3 unchanged
+
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+
+=== Toggle attributes.createdb and re-deploy
+>>> update_file.py databricks.yml createdb: false createdb: true
+
+>>> cat databricks.yml
+bundle:
+  name: update-postgres-role-[UNIQUE_NAME]
+
+sync:
+  paths: []
+
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-[UNIQUE_NAME]
+      display_name: "Test Project for Role Update"
+      pg_version: 16
+      history_retention_duration: 604800s
+
+  postgres_branches:
+    main:
+      parent: ${resources.postgres_projects.my_project.id}
+      branch_id: main
+      no_expiry: true
+
+  postgres_roles:
+    my_role:
+      parent: ${resources.postgres_branches.main.id}
+      role_id: test-role
+      postgres_role: app_role
+      attributes:
+        createdb: true
+
+>>> [CLI] bundle plan
+update postgres_roles.my_role
+
+Plan: 0 to add, 1 to change, 0 to delete, 2 unchanged
+
+>>> [CLI] bundle plan -o json
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-postgres-role-[UNIQUE_NAME]/default/files...
+Updated postgres_roles.my_role
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 2 unchanged
+
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+
+>>> [CLI] postgres get-role projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/test-role
+{
+  "name": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/test-role",
+  "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
+  "role_id": "test-role",
+  "status": {
+    "attributes": {
+      "bypassrls": false,
+      "createdb": true,
+      "createrole": false
+    },
+    "auth_method": "PG_PASSWORD_SCRAM_SHA_256",
+    "identity_type": "IDENTITY_TYPE_UNSPECIFIED",
+    "postgres_role": "app_role",
+    "role_id": "test-role"
+  }
+}
+
+=== Restore attributes.createdb to original value
+>>> update_file.py databricks.yml createdb: true createdb: false
+
+>>> [CLI] bundle plan
+update postgres_roles.my_role
+
+Plan: 0 to add, 1 to change, 0 to delete, 2 unchanged
+
+>>> [CLI] bundle plan -o json
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-postgres-role-[UNIQUE_NAME]/default/files...
+Updated postgres_roles.my_role
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 2 unchanged
+
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+
+>>> [CLI] postgres get-role projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/test-role
+{
+  "name": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main/roles/test-role",
+  "parent": "projects/test-pg-proj-[UNIQUE_NAME]/branches/main",
+  "role_id": "test-role",
+  "status": {
+    "attributes": {
+      "bypassrls": false,
+      "createdb": false,
+      "createrole": false
+    },
+    "auth_method": "PG_PASSWORD_SCRAM_SHA_256",
+    "identity_type": "IDENTITY_TYPE_UNSPECIFIED",
+    "postgres_role": "app_role",
+    "role_id": "test-role"
+  }
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.postgres_branches.main
+  delete resources.postgres_projects.my_project
+  delete resources.postgres_roles.my_role
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase branches.
+All data stored in them will be permanently lost:
+  delete resources.postgres_branches.main
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/update-postgres-role-[UNIQUE_NAME]/default
+
+Destroy: 3 deleted
diff --git a/acceptance/bundle/resources/postgres_roles/update/script b/acceptance/bundle/resources/postgres_roles/update/script
new file mode 100644
index 00000000000..0c81dd423e0
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_roles/update/script
@@ -0,0 +1,59 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+   trace $CLI bundle destroy --auto-approve
+   rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+print_requests() {
+    local name=$1
+    trace print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.${name}.json
+    rm -f "$OUT_REQUESTS"
+}
+
+title "Initial deployment"
+trace $CLI bundle validate
+trace $CLI bundle plan
+trace $CLI bundle plan -o json | nostamp | jq '.plan."resources.postgres_roles.my_role" // .' > out.plan.create.json
+rm -f "$OUT_REQUESTS"
+trace $CLI bundle deploy
+
+print_requests create
+
+project_name="projects/test-pg-proj-${UNIQUE_NAME}"
+branch_name="${project_name}/branches/main"
+role_name="${branch_name}/roles/test-role"
+trace $CLI postgres get-role "${role_name}" | role_fields
+
+title "Verify no changes"
+trace $CLI bundle plan
+trace $CLI bundle plan -o json | nostamp | jq '.plan."resources.postgres_roles.my_role" // .' > out.plan.no_change.json
+rm -f "$OUT_REQUESTS"
+trace $CLI bundle deploy
+
+print_requests no_change
+
+title "Toggle attributes.createdb and re-deploy"
+trace update_file.py databricks.yml "createdb: false" "createdb: true"
+trace cat databricks.yml
+
+trace $CLI bundle plan
+trace $CLI bundle plan -o json | nostamp | jq '.plan."resources.postgres_roles.my_role" // .' > out.plan.update.json
+rm -f "$OUT_REQUESTS"
+trace $CLI bundle deploy
+
+print_requests update
+
+trace $CLI postgres get-role "${role_name}" | role_fields
+
+title "Restore attributes.createdb to original value"
+trace update_file.py databricks.yml "createdb: true" "createdb: false"
+trace $CLI bundle plan
+trace $CLI bundle plan -o json | nostamp | jq '.plan."resources.postgres_roles.my_role" // .' > out.plan.restore.json
+rm -f "$OUT_REQUESTS"
+trace $CLI bundle deploy
+
+print_requests restore
+
+trace $CLI postgres get-role "${role_name}" | role_fields
diff --git a/acceptance/bundle/resources/postgres_snapshot_schedules/basic/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_snapshot_schedules/basic/databricks.yml.tmpl
new file mode 100644
index 00000000000..7b23ed6078f
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_snapshot_schedules/basic/databricks.yml.tmpl
@@ -0,0 +1,22 @@
+bundle:
+  name: deploy-pg-ss-basic-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-$UNIQUE_NAME
+      display_name: "Test Project for Snapshot Schedules"
+      pg_version: 16
+
+  postgres_snapshot_schedules:
+    main_schedule:
+      # Snapshots are only allowed on the project's root branch (the implicitly
+      # created "production" branch).
+      branch: ${resources.postgres_projects.my_project.id}/branches/production
+      schedule:
+        - daily_schedule:
+            hour: 3
+          retention: "604800s"
diff --git a/acceptance/bundle/resources/postgres_snapshot_schedules/basic/out.requests.create.txt b/acceptance/bundle/resources/postgres_snapshot_schedules/basic/out.requests.create.txt
new file mode 100644
index 00000000000..7a674e8d1bc
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_snapshot_schedules/basic/out.requests.create.txt
@@ -0,0 +1,34 @@
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/production/snapshot-schedule"
+}
+{
+  "method": "PATCH",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/production/snapshot-schedule",
+  "q": {
+    "update_mask": "schedule"
+  },
+  "body": {
+    "schedule": [
+      {
+        "daily_schedule": {
+          "hour": 3
+        },
+        "retention": "604800s"
+      }
+    ]
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects",
+  "q": {
+    "project_id": "test-pg-proj-[UNIQUE_NAME]"
+  },
+  "body": {
+    "spec": {
+      "display_name": "Test Project for Snapshot Schedules",
+      "pg_version": 16
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_snapshot_schedules/basic/out.requests.remove.txt b/acceptance/bundle/resources/postgres_snapshot_schedules/basic/out.requests.remove.txt
new file mode 100644
index 00000000000..8449f260878
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_snapshot_schedules/basic/out.requests.remove.txt
@@ -0,0 +1,20 @@
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/production/snapshot-schedule"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/production/snapshot-schedule"
+}
+{
+  "method": "PATCH",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/production/snapshot-schedule",
+  "q": {
+    "update_mask": "schedule"
+  },
+  "body": {}
+}
diff --git a/acceptance/bundle/resources/postgres_snapshot_schedules/basic/out.requests.update.txt b/acceptance/bundle/resources/postgres_snapshot_schedules/basic/out.requests.update.txt
new file mode 100644
index 00000000000..75841ac1e2a
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_snapshot_schedules/basic/out.requests.update.txt
@@ -0,0 +1,33 @@
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/production/snapshot-schedule"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/production/snapshot-schedule"
+}
+{
+  "method": "PATCH",
+  "path": "/api/2.0/postgres/projects/test-pg-proj-[UNIQUE_NAME]/branches/production/snapshot-schedule",
+  "q": {
+    "update_mask": "schedule"
+  },
+  "body": {
+    "schedule": [
+      {
+        "daily_schedule": {
+          "hour": 5
+        },
+        "retention": "604800s"
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/resources/postgres_snapshot_schedules/basic/out.test.toml b/acceptance/bundle/resources/postgres_snapshot_schedules/basic/out.test.toml
new file mode 100644
index 00000000000..ee153e82621
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_snapshot_schedules/basic/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_snapshot_schedules/basic/output.txt b/acceptance/bundle/resources/postgres_snapshot_schedules/basic/output.txt
new file mode 100644
index 00000000000..c0ecf60045f
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_snapshot_schedules/basic/output.txt
@@ -0,0 +1,85 @@
+
+=== Create with a snapshot schedule
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-pg-ss-basic-[UNIQUE_NAME]/default/files...
+Created postgres_projects.my_project
+Created postgres_snapshot_schedules.main_schedule
+Files: 0 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] postgres get-snapshot-schedule projects/test-pg-proj-[UNIQUE_NAME]/branches/production/snapshot-schedule
+{
+  "name": "projects/test-pg-proj-[UNIQUE_NAME]/branches/production/snapshot-schedule",
+  "schedule": [
+    {
+      "daily_schedule": {
+        "hour": 3
+      },
+      "retention": "604800s"
+    }
+  ]
+}
+
+=== Update the schedule cadence
+>>> [CLI] bundle deploy --auto-approve
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-pg-ss-basic-[UNIQUE_NAME]/default/files...
+Updated postgres_snapshot_schedules.main_schedule
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 1 unchanged
+
+>>> [CLI] postgres get-snapshot-schedule projects/test-pg-proj-[UNIQUE_NAME]/branches/production/snapshot-schedule
+{
+  "name": "projects/test-pg-proj-[UNIQUE_NAME]/branches/production/snapshot-schedule",
+  "schedule": [
+    {
+      "daily_schedule": {
+        "hour": 5
+      },
+      "retention": "604800s"
+    }
+  ]
+}
+
+=== Remove the snapshot schedule resource (disables automatic snapshots)
+>>> cat databricks.yml
+bundle:
+  name: deploy-pg-ss-basic-[UNIQUE_NAME]
+
+sync:
+  paths: []
+
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-[UNIQUE_NAME]
+      display_name: "Test Project for Snapshot Schedules"
+      pg_version: 16
+
+
+>>> [CLI] bundle deploy --auto-approve
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-pg-ss-basic-[UNIQUE_NAME]/default/files...
+Deleted postgres_snapshot_schedules.main_schedule
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 1 deleted, 1 unchanged
+
+>>> [CLI] postgres get-snapshot-schedule projects/test-pg-proj-[UNIQUE_NAME]/branches/production/snapshot-schedule
+{
+  "name": "projects/test-pg-proj-[UNIQUE_NAME]/branches/production/snapshot-schedule",
+  "schedule": null
+}
+
+=== Plan again to confirm no drift after removal
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.postgres_projects.my_project
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.my_project
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-pg-ss-basic-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/postgres_snapshot_schedules/basic/script b/acceptance/bundle/resources/postgres_snapshot_schedules/basic/script
new file mode 100644
index 00000000000..7f0fb2587c5
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_snapshot_schedules/basic/script
@@ -0,0 +1,30 @@
+cleanup() {
+   trace $CLI bundle destroy --auto-approve
+   rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+schedule_name="projects/test-pg-proj-${UNIQUE_NAME}/branches/production/snapshot-schedule"
+
+title "Create with a snapshot schedule"
+envsubst < databricks.yml.tmpl > databricks.yml
+rm -f "$OUT_REQUESTS"
+trace $CLI bundle deploy
+trace $CLI postgres get-snapshot-schedule "${schedule_name}" | snapshot_schedule_fields
+print_requests.py --del-body parent,project_id,branch_id --sort --get '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.create.txt
+
+title "Update the schedule cadence"
+sed "s/hour: 3/hour: 5/" databricks.yml > databricks.yml.new && mv databricks.yml.new databricks.yml
+trace $CLI bundle deploy --auto-approve
+trace $CLI postgres get-snapshot-schedule "${schedule_name}" | snapshot_schedule_fields
+print_requests.py --del-body parent,project_id,branch_id --sort --get '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.update.txt
+
+title "Remove the snapshot schedule resource (disables automatic snapshots)"
+sed '/postgres_snapshot_schedules:/,$d' databricks.yml > databricks.yml.new && mv databricks.yml.new databricks.yml
+trace cat databricks.yml
+trace $CLI bundle deploy --auto-approve
+trace $CLI postgres get-snapshot-schedule "${schedule_name}" | snapshot_schedule_fields
+print_requests.py --del-body parent,project_id,branch_id --sort --get '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.remove.txt
+
+title "Plan again to confirm no drift after removal"
+trace $CLI bundle plan
diff --git a/acceptance/bundle/resources/postgres_snapshot_schedules/out-of-band/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_snapshot_schedules/out-of-band/databricks.yml.tmpl
new file mode 100644
index 00000000000..110aaa95432
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_snapshot_schedules/out-of-band/databricks.yml.tmpl
@@ -0,0 +1,22 @@
+bundle:
+  name: deploy-pg-ss-oob-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-$UNIQUE_NAME
+      display_name: "Test Project for Snapshot Schedules"
+      pg_version: 16
+
+  postgres_snapshot_schedules:
+    main_schedule:
+      # Snapshots are only allowed on the project's root branch (the implicitly
+      # created "production" branch).
+      branch: ${resources.postgres_projects.my_project.id}/branches/production
+      schedule:
+        - daily_schedule:
+            hour: 3
+          retention: "604800s"
diff --git a/acceptance/bundle/resources/postgres_snapshot_schedules/out-of-band/out.test.toml b/acceptance/bundle/resources/postgres_snapshot_schedules/out-of-band/out.test.toml
new file mode 100644
index 00000000000..ee153e82621
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_snapshot_schedules/out-of-band/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_snapshot_schedules/out-of-band/output.txt b/acceptance/bundle/resources/postgres_snapshot_schedules/out-of-band/output.txt
new file mode 100644
index 00000000000..e11ac76f602
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_snapshot_schedules/out-of-band/output.txt
@@ -0,0 +1,74 @@
+
+=== Deploy with a snapshot schedule
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-pg-ss-oob-[UNIQUE_NAME]/default/files...
+Created postgres_projects.my_project
+Created postgres_snapshot_schedules.main_schedule
+Files: 0 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] postgres get-snapshot-schedule projects/test-pg-proj-[UNIQUE_NAME]/branches/production/snapshot-schedule
+{
+  "name": "projects/test-pg-proj-[UNIQUE_NAME]/branches/production/snapshot-schedule",
+  "schedule": [
+    {
+      "daily_schedule": {
+        "hour": 3
+      },
+      "retention": "604800s"
+    }
+  ]
+}
+
+=== Change the schedule out of band via a direct API call
+>>> [CLI] postgres update-snapshot-schedule projects/test-pg-proj-[UNIQUE_NAME]/branches/production/snapshot-schedule schedule --json {"schedule":[{"daily_schedule":{"hour":9},"retention":"604800s"}]}
+{
+  "name": "projects/test-pg-proj-[UNIQUE_NAME]/branches/production/snapshot-schedule",
+  "schedule": [
+    {
+      "daily_schedule": {
+        "hour": 9
+      },
+      "retention": "604800s"
+    }
+  ]
+}
+
+=== Plan detects the drift
+>>> [CLI] bundle plan
+update postgres_snapshot_schedules.main_schedule
+
+Plan: 0 to add, 1 to change, 0 to delete, 1 unchanged
+
+=== Deploy reconciles the schedule back to the configured cadence
+>>> [CLI] bundle deploy --auto-approve
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-pg-ss-oob-[UNIQUE_NAME]/default/files...
+Updated postgres_snapshot_schedules.main_schedule
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 1 unchanged
+
+>>> [CLI] postgres get-snapshot-schedule projects/test-pg-proj-[UNIQUE_NAME]/branches/production/snapshot-schedule
+{
+  "name": "projects/test-pg-proj-[UNIQUE_NAME]/branches/production/snapshot-schedule",
+  "schedule": [
+    {
+      "daily_schedule": {
+        "hour": 3
+      },
+      "retention": "604800s"
+    }
+  ]
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.postgres_projects.my_project
+  delete resources.postgres_snapshot_schedules.main_schedule
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.my_project
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-pg-ss-oob-[UNIQUE_NAME]/default
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/postgres_snapshot_schedules/out-of-band/script b/acceptance/bundle/resources/postgres_snapshot_schedules/out-of-band/script
new file mode 100644
index 00000000000..563f339418a
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_snapshot_schedules/out-of-band/script
@@ -0,0 +1,21 @@
+cleanup() {
+   trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+schedule_name="projects/test-pg-proj-${UNIQUE_NAME}/branches/production/snapshot-schedule"
+
+title "Deploy with a snapshot schedule"
+envsubst < databricks.yml.tmpl > databricks.yml
+trace $CLI bundle deploy
+trace $CLI postgres get-snapshot-schedule "${schedule_name}" | snapshot_schedule_fields
+
+title "Change the schedule out of band via a direct API call"
+trace $CLI postgres update-snapshot-schedule "${schedule_name}" schedule --json '{"schedule":[{"daily_schedule":{"hour":9},"retention":"604800s"}]}' | snapshot_schedule_fields
+
+title "Plan detects the drift"
+trace $CLI bundle plan
+
+title "Deploy reconciles the schedule back to the configured cadence"
+trace $CLI bundle deploy --auto-approve
+trace $CLI postgres get-snapshot-schedule "${schedule_name}" | snapshot_schedule_fields
diff --git a/acceptance/bundle/resources/postgres_snapshot_schedules/out-of-band/test.toml b/acceptance/bundle/resources/postgres_snapshot_schedules/out-of-band/test.toml
new file mode 100644
index 00000000000..a030353d571
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_snapshot_schedules/out-of-band/test.toml
@@ -0,0 +1 @@
+RecordRequests = false
diff --git a/acceptance/bundle/resources/postgres_snapshot_schedules/script.prepare b/acceptance/bundle/resources/postgres_snapshot_schedules/script.prepare
new file mode 100644
index 00000000000..ce34a2474d5
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_snapshot_schedules/script.prepare
@@ -0,0 +1,6 @@
+# snapshot_schedule_fields is the allow-list of snapshot-schedule fields the
+# acceptance tests assert on. Anything the backend returns outside this list is
+# dropped, so a new field in the API response does not break the golden.
+snapshot_schedule_fields() {
+    jq '{name, schedule}'
+}
diff --git a/acceptance/bundle/resources/postgres_snapshot_schedules/test.toml b/acceptance/bundle/resources/postgres_snapshot_schedules/test.toml
new file mode 100644
index 00000000000..e3ff8d8a1b1
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_snapshot_schedules/test.toml
@@ -0,0 +1,15 @@
+Cloud = true
+
+# Lakebase v2 (postgres) is only available in AWS as of January 2026
+CloudEnvs.gcp = false
+CloudEnvs.azure = false
+
+# The snapshot schedule was added to the Postgres API in databricks-sdk-go
+# v0.177.0, which the pinned Terraform provider does not yet include, so there is
+# no databricks_..._snapshot_schedule resource to deploy through. Run the direct
+# engine only until the provider catches up.
+
+Ignore = [
+    "databricks.yml",
+    ".databricks",
+]
diff --git a/acceptance/bundle/resources/postgres_synced_tables/basic/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_synced_tables/basic/databricks.yml.tmpl
new file mode 100644
index 00000000000..9d14a96d86e
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_synced_tables/basic/databricks.yml.tmpl
@@ -0,0 +1,38 @@
+bundle:
+  name: deploy-postgres-synced-table-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  schemas:
+    pipeline_storage:
+      name: pipeline_storage_$UNIQUE_NAME
+      catalog_name: main
+      comment: "Pipeline storage for the synced-table test"
+
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-$UNIQUE_NAME
+      display_name: "Test Project for Synced Table"
+      pg_version: 17
+
+  postgres_catalogs:
+    my_catalog:
+      catalog_id: lakebase_test_$UNIQUE_NAME
+      branch: ${resources.postgres_projects.my_project.id}/branches/production
+      postgres_database: appdb
+      create_database_if_missing: true
+
+  postgres_synced_tables:
+    my_table:
+      synced_table_id: ${resources.postgres_catalogs.my_catalog.catalog_id}.public.trips_synced
+      source_table_full_name: main.source_$UNIQUE_NAME.trips_source
+      primary_key_columns: ["tpep_pickup_datetime"]
+      scheduling_policy: SNAPSHOT
+      postgres_database: appdb
+      branch: ${resources.postgres_projects.my_project.id}/branches/production
+      create_database_objects_if_missing: true
+      new_pipeline_spec:
+        storage_catalog: ${resources.schemas.pipeline_storage.catalog_name}
+        storage_schema: ${resources.schemas.pipeline_storage.name}
diff --git a/acceptance/bundle/resources/postgres_synced_tables/basic/out.requests.json b/acceptance/bundle/resources/postgres_synced_tables/basic/out.requests.json
new file mode 100644
index 00000000000..4e85c53cd99
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_synced_tables/basic/out.requests.json
@@ -0,0 +1,54 @@
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects",
+  "q": {
+    "project_id": "test-pg-proj-[UNIQUE_NAME]"
+  },
+  "body": {
+    "spec": {
+      "display_name": "Test Project for Synced Table",
+      "pg_version": 17
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/catalogs",
+  "q": {
+    "catalog_id": "lakebase_test_[UNIQUE_NAME]"
+  },
+  "body": {
+    "spec": {
+      "branch": "projects/test-pg-proj-[UNIQUE_NAME]/branches/production",
+      "create_database_if_missing": true,
+      "postgres_database": "appdb"
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/synced_tables",
+  "q": {
+    "synced_table_id": "lakebase_test_[UNIQUE_NAME].public.trips_synced"
+  },
+  "body": {
+    "spec": {
+      "branch": "projects/test-pg-proj-[UNIQUE_NAME]/branches/production",
+      "create_database_objects_if_missing": true,
+      "new_pipeline_spec": {
+        "storage_catalog": "main",
+        "storage_schema": "pipeline_storage_[UNIQUE_NAME]"
+      },
+      "postgres_database": "appdb",
+      "primary_key_columns": [
+        "tpep_pickup_datetime"
+      ],
+      "scheduling_policy": "SNAPSHOT",
+      "source_table_full_name": "main.source_[UNIQUE_NAME].trips_source"
+    }
+  }
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/postgres/synced_tables/lakebase_test_[UNIQUE_NAME].public.trips_synced"
+}
diff --git a/acceptance/bundle/resources/postgres_synced_tables/basic/out.test.toml b/acceptance/bundle/resources/postgres_synced_tables/basic/out.test.toml
new file mode 100644
index 00000000000..ee153e82621
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_synced_tables/basic/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_synced_tables/basic/output.txt b/acceptance/bundle/resources/postgres_synced_tables/basic/output.txt
new file mode 100644
index 00000000000..9916219e124
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_synced_tables/basic/output.txt
@@ -0,0 +1,95 @@
+Creating temporary source table: main.source_[UNIQUE_NAME].trips_source
+{
+  "full_name": "main.source_[UNIQUE_NAME]"
+}
+
+>>> [CLI] bundle validate
+Name: deploy-postgres-synced-table-[UNIQUE_NAME]
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-synced-table-[UNIQUE_NAME]/default
+
+Validation OK!
+
+>>> [CLI] bundle summary
+Name: deploy-postgres-synced-table-[UNIQUE_NAME]
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-synced-table-[UNIQUE_NAME]/default
+Resources:
+  Postgres catalogs:
+    my_catalog:
+      Name: lakebase_test_[UNIQUE_NAME]
+      URL:  [DATABRICKS_URL]/explore/data/lakebase_test_[UNIQUE_NAME]
+  Postgres projects:
+    my_project:
+      Name: Test Project for Synced Table
+  Postgres synced tables:
+    my_table:
+      Name: ${resources.postgres_catalogs.my_catalog.catalog_id}.public.trips_synced
+      URL:  (not deployed)
+  Schemas:
+    pipeline_storage:
+      Name: pipeline_storage_[UNIQUE_NAME]
+      URL:  (not deployed)
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-synced-table-[UNIQUE_NAME]/default/files...
+Created postgres_catalogs.my_catalog
+Created postgres_projects.my_project
+Created postgres_synced_tables.my_table
+Created schemas.pipeline_storage
+Files: 0 uploaded, 0 deleted
+Resources: 4 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] postgres get-synced-table synced_tables/lakebase_test_[UNIQUE_NAME].public.trips_synced
+{
+  "name": "synced_tables/lakebase_test_[UNIQUE_NAME].public.trips_synced",
+  "unity_catalog_provisioning_state": "ACTIVE"
+}
+
+>>> [CLI] bundle summary
+Name: deploy-postgres-synced-table-[UNIQUE_NAME]
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-synced-table-[UNIQUE_NAME]/default
+Resources:
+  Postgres catalogs:
+    my_catalog:
+      Name: lakebase_test_[UNIQUE_NAME]
+      URL:  [DATABRICKS_URL]/explore/data/lakebase_test_[UNIQUE_NAME]
+  Postgres projects:
+    my_project:
+      Name: Test Project for Synced Table
+  Postgres synced tables:
+    my_table:
+      Name: lakebase_test_[UNIQUE_NAME].public.trips_synced
+      URL:  [DATABRICKS_URL]/explore/data/lakebase_test_[UNIQUE_NAME]/public/trips_synced
+  Schemas:
+    pipeline_storage:
+      Name: pipeline_storage_[UNIQUE_NAME]
+      URL:  [DATABRICKS_URL]/explore/data/main/pipeline_storage_[UNIQUE_NAME]
+
+>>> print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get //postgres ^//workspace-files/ ^//workspace/ ^//telemetry-ext ^//operations/
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.postgres_catalogs.my_catalog
+  delete resources.postgres_projects.my_project
+  delete resources.postgres_synced_tables.my_table
+  delete resources.schemas.pipeline_storage
+
+This action will result in the deletion of the following UC schemas. Any underlying data may be lost:
+  delete resources.schemas.pipeline_storage
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.my_project
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-postgres-synced-table-[UNIQUE_NAME]/default
+
+Destroy: 4 deleted
+Cleaning up temporary source table
diff --git a/acceptance/bundle/resources/postgres_synced_tables/basic/script b/acceptance/bundle/resources/postgres_synced_tables/basic/script
new file mode 100644
index 00000000000..7ce35fa0fbd
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_synced_tables/basic/script
@@ -0,0 +1,39 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+# Create a per-test source schema + table. We can't read samples.nyctaxi.trips
+# directly because shared workspaces hit the "20 synced tables per source table"
+# limit (same reason synced_database_tables takes this approach).
+echo "Creating temporary source table: main.source_$UNIQUE_NAME.trips_source"
+$CLI schemas create source_$UNIQUE_NAME main -o json | jq '{full_name}'
+MSYS_NO_PATHCONV=1 $CLI api post "/api/2.0/sql/statements/" --json "{
+    \"warehouse_id\": \"$TEST_DEFAULT_WAREHOUSE_ID\",
+    \"statement\": \"CREATE TABLE main.source_$UNIQUE_NAME.trips_source AS SELECT * FROM samples.nyctaxi.trips LIMIT 10\",
+    \"wait_timeout\": \"45s\"
+  }" > /dev/null
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    echo "Cleaning up temporary source table"
+    $CLI tables delete main.source_$UNIQUE_NAME.trips_source || true
+    $CLI schemas delete main.source_$UNIQUE_NAME || true
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+trace $CLI bundle validate
+
+trace $CLI bundle summary
+
+rm -f "$OUT_REQUESTS"
+trace $CLI bundle deploy
+
+# Keep only the deterministic identity + provisioning-state. detailed_state
+# varies with pipeline-provisioning timing on cloud, ongoing_sync_progress and
+# project only appear there, and create_time/update_time/uid/pipeline_id are
+# random per run.
+trace $CLI postgres get-synced-table "synced_tables/lakebase_test_${UNIQUE_NAME}.public.trips_synced" | jq '{name, unity_catalog_provisioning_state: .status.unity_catalog_provisioning_state}'
+
+trace $CLI bundle summary
+
+# Filter requests to only show postgres operations (exclude workspace, telemetry, and operation polling).
+trace print_requests.py --del-body project_id,branch_id,endpoint_id,database_id,role_id,catalog_id,synced_table_id --keep --get '//postgres' '^//workspace-files/' '^//workspace/' '^//telemetry-ext' '^//operations/' > out.requests.json
diff --git a/acceptance/bundle/resources/postgres_synced_tables/recreate/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_synced_tables/recreate/databricks.yml.tmpl
new file mode 100644
index 00000000000..40a350d53fa
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_synced_tables/recreate/databricks.yml.tmpl
@@ -0,0 +1,39 @@
+bundle:
+  name: recreate-postgres-synced-table-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  schemas:
+    pipeline_storage:
+      name: pipeline_storage_$UNIQUE_NAME
+      catalog_name: main
+      comment: "Pipeline storage for the synced-table recreate test"
+
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-$UNIQUE_NAME
+      display_name: "Test Project for Synced Table Recreate"
+      pg_version: 17
+
+  postgres_catalogs:
+    my_catalog:
+      catalog_id: lakebase_test_$UNIQUE_NAME
+      branch: ${resources.postgres_projects.my_project.id}/branches/production
+      postgres_database: appdb
+      create_database_if_missing: true
+
+  postgres_synced_tables:
+    my_table:
+      synced_table_id: ${resources.postgres_catalogs.my_catalog.catalog_id}.public.trips_synced
+      source_table_full_name: main.source_$UNIQUE_NAME.trips_source
+      primary_key_columns: ["tpep_pickup_datetime"]
+      scheduling_policy: SNAPSHOT
+      postgres_database: appdb
+      branch: ${resources.postgres_projects.my_project.id}/branches/production
+      create_database_objects_if_missing: true
+      timeseries_key: $TIMESERIES_KEY
+      new_pipeline_spec:
+        storage_catalog: ${resources.schemas.pipeline_storage.catalog_name}
+        storage_schema: ${resources.schemas.pipeline_storage.name}
diff --git a/acceptance/bundle/resources/postgres_synced_tables/recreate/out.test.toml b/acceptance/bundle/resources/postgres_synced_tables/recreate/out.test.toml
new file mode 100644
index 00000000000..ee153e82621
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_synced_tables/recreate/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_synced_tables/recreate/output.txt b/acceptance/bundle/resources/postgres_synced_tables/recreate/output.txt
new file mode 100644
index 00000000000..9f76f730db0
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_synced_tables/recreate/output.txt
@@ -0,0 +1,43 @@
+Creating temporary source table: main.source_[UNIQUE_NAME].trips_source
+{
+  "full_name": "main.source_[UNIQUE_NAME]"
+}
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/recreate-postgres-synced-table-[UNIQUE_NAME]/default/files...
+Created postgres_catalogs.my_catalog
+Created postgres_projects.my_project
+Created postgres_synced_tables.my_table
+Created schemas.pipeline_storage
+Files: 0 uploaded, 0 deleted
+Resources: 4 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] bundle plan
+recreate postgres_synced_tables.my_table
+
+Plan: 1 to add, 0 to change, 1 to delete, 3 unchanged
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/recreate-postgres-synced-table-[UNIQUE_NAME]/default/files...
+Recreated postgres_synced_tables.my_table
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 3 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.postgres_catalogs.my_catalog
+  delete resources.postgres_projects.my_project
+  delete resources.postgres_synced_tables.my_table
+  delete resources.schemas.pipeline_storage
+
+This action will result in the deletion of the following UC schemas. Any underlying data may be lost:
+  delete resources.schemas.pipeline_storage
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.my_project
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/recreate-postgres-synced-table-[UNIQUE_NAME]/default
+
+Destroy: 4 deleted
+Cleaning up temporary source table
diff --git a/acceptance/bundle/resources/postgres_synced_tables/recreate/script b/acceptance/bundle/resources/postgres_synced_tables/recreate/script
new file mode 100644
index 00000000000..85275490aa2
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_synced_tables/recreate/script
@@ -0,0 +1,29 @@
+# Per-test source table to avoid the 20-synced-tables-per-source-table limit.
+echo "Creating temporary source table: main.source_$UNIQUE_NAME.trips_source"
+$CLI schemas create source_$UNIQUE_NAME main -o json | jq '{full_name}'
+MSYS_NO_PATHCONV=1 $CLI api post "/api/2.0/sql/statements/" --json "{
+    \"warehouse_id\": \"$TEST_DEFAULT_WAREHOUSE_ID\",
+    \"statement\": \"CREATE TABLE main.source_$UNIQUE_NAME.trips_source AS SELECT * FROM samples.nyctaxi.trips LIMIT 10\",
+    \"wait_timeout\": \"45s\"
+  }" > /dev/null
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    echo "Cleaning up temporary source table"
+    $CLI tables delete main.source_$UNIQUE_NAME.trips_source || true
+    $CLI schemas delete main.source_$UNIQUE_NAME || true
+}
+trap cleanup EXIT
+
+export TIMESERIES_KEY=tpep_pickup_datetime
+envsubst < databricks.yml.tmpl > databricks.yml
+trace $CLI bundle deploy
+
+# Toggle a recreate-on-change field; plan must show delete + create.
+# We toggle timeseries_key (not scheduling_policy) so we don't need CDF
+# on the source.
+export TIMESERIES_KEY=tpep_dropoff_datetime
+envsubst < databricks.yml.tmpl > databricks.yml
+trace $CLI bundle plan | contains.py "Plan: 1 to add, 0 to change, 1 to delete, 3 unchanged"
+
+trace $CLI bundle deploy
diff --git a/acceptance/bundle/resources/postgres_synced_tables/recreate/test.toml b/acceptance/bundle/resources/postgres_synced_tables/recreate/test.toml
new file mode 100644
index 00000000000..a030353d571
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_synced_tables/recreate/test.toml
@@ -0,0 +1 @@
+RecordRequests = false
diff --git a/acceptance/bundle/resources/postgres_synced_tables/recreate_capped/databricks.yml.tmpl b/acceptance/bundle/resources/postgres_synced_tables/recreate_capped/databricks.yml.tmpl
new file mode 100644
index 00000000000..15a14677bb8
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_synced_tables/recreate_capped/databricks.yml.tmpl
@@ -0,0 +1,39 @@
+bundle:
+  name: recreate-capped-postgres-synced-table-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  schemas:
+    pipeline_storage:
+      name: pipeline_storage_$UNIQUE_NAME
+      catalog_name: main
+      comment: "Pipeline storage for the synced-table recreate test"
+
+  postgres_projects:
+    my_project:
+      project_id: test-pg-proj-$UNIQUE_NAME
+      display_name: "Test Project for Synced Table Recreate"
+      pg_version: 17
+
+  postgres_catalogs:
+    my_catalog:
+      catalog_id: lakebase_test_$UNIQUE_NAME
+      branch: ${resources.postgres_projects.my_project.id}/branches/production
+      postgres_database: appdb
+      create_database_if_missing: true
+
+  postgres_synced_tables:
+    my_table:
+      synced_table_id: ${resources.postgres_catalogs.my_catalog.catalog_id}.public.trips_synced
+      source_table_full_name: main.source_$UNIQUE_NAME.trips_source
+      primary_key_columns: ["tpep_pickup_datetime"]
+      scheduling_policy: SNAPSHOT
+      postgres_database: appdb
+      branch: ${resources.postgres_projects.my_project.id}/branches/production
+      create_database_objects_if_missing: true
+      timeseries_key: $TIMESERIES_KEY
+      new_pipeline_spec:
+        storage_catalog: ${resources.schemas.pipeline_storage.catalog_name}
+        storage_schema: ${resources.schemas.pipeline_storage.name}
diff --git a/acceptance/bundle/resources/postgres_synced_tables/recreate_capped/out.test.toml b/acceptance/bundle/resources/postgres_synced_tables/recreate_capped/out.test.toml
new file mode 100644
index 00000000000..0faf51e59a4
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_synced_tables/recreate_capped/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = false
+CloudEnvs.azure = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/postgres_synced_tables/recreate_capped/output.txt b/acceptance/bundle/resources/postgres_synced_tables/recreate_capped/output.txt
new file mode 100644
index 00000000000..0ba65f672e9
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_synced_tables/recreate_capped/output.txt
@@ -0,0 +1,35 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/recreate-capped-postgres-synced-table-[UNIQUE_NAME]/default/files...
+Created postgres_catalogs.my_catalog
+Created postgres_projects.my_project
+Created postgres_synced_tables.my_table
+Created schemas.pipeline_storage
+Files: 0 uploaded, 0 deleted
+Resources: 4 created, 0 changed, 0 deleted, 0 unchanged
+
+=== The delete never completes; the capped wait times out and the recreate fails
+>>> DATABRICKS_BUNDLE_RESOURCE_MAX_WAIT=1 errcode [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/recreate-capped-postgres-synced-table-[UNIQUE_NAME]/default/files...
+Error: cannot recreate resources.postgres_synced_tables.my_table: waiting after deleting id=synced_tables/lakebase_test_[UNIQUE_NAME].public.trips_synced: timed out: synced table still exists, waiting for deletion to complete
+
+Files: 0 uploaded, 0 deleted
+
+Exit code: 1
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.postgres_catalogs.my_catalog
+  delete resources.postgres_projects.my_project
+  delete resources.schemas.pipeline_storage
+
+This action will result in the deletion of the following UC schemas. Any underlying data may be lost:
+  delete resources.schemas.pipeline_storage
+
+This action will result in the deletion of the following Lakebase projects along with
+all their branches, databases, and endpoints. All data stored in them will be permanently lost:
+  delete resources.postgres_projects.my_project
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/recreate-capped-postgres-synced-table-[UNIQUE_NAME]/default
+
+Destroy: 3 deleted
diff --git a/acceptance/bundle/resources/postgres_synced_tables/recreate_capped/script b/acceptance/bundle/resources/postgres_synced_tables/recreate_capped/script
new file mode 100644
index 00000000000..eef8b8b1fba
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_synced_tables/recreate_capped/script
@@ -0,0 +1,16 @@
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+export TIMESERIES_KEY=tpep_pickup_datetime
+envsubst < databricks.yml.tmpl > databricks.yml
+trace $CLI bundle deploy
+
+title "The delete never completes; the capped wait times out and the recreate fails"
+# The testserver leaves the synced table in DELETING forever, so the post-delete poll
+# would wait indefinitely. Capping it to 1s makes the wait time out, which fails the
+# recreate. errcode keeps the script going so cleanup still runs.
+export TIMESERIES_KEY=tpep_dropoff_datetime
+envsubst < databricks.yml.tmpl > databricks.yml
+trace DATABRICKS_BUNDLE_RESOURCE_MAX_WAIT=1 errcode $CLI bundle deploy
diff --git a/acceptance/bundle/resources/postgres_synced_tables/recreate_capped/test.toml b/acceptance/bundle/resources/postgres_synced_tables/recreate_capped/test.toml
new file mode 100644
index 00000000000..079a4b5476a
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_synced_tables/recreate_capped/test.toml
@@ -0,0 +1,11 @@
+RecordRequests = false
+# Local-only, direct-only: exercises the DATABRICKS_BUNDLE_RESOURCE_MAX_WAIT cap on the
+# synced-table recreate delete-wait. INJECT_STALE_ON_DIRECT makes the testserver's synced
+# table deletion never complete (it stays DELETING), so the post-delete poll would wait
+# forever; capping it to 1s makes the wait time out, which fails the recreate. Verifies
+# the cap and the resulting error are rendered.
+# Not run on cloud (would need a real source table) or on terraform (recreates without
+# polling — the flag is direct-only). The recreate itself is covered against a real
+# workspace by ../recreate.
+Cloud = false
+Env.INJECT_STALE_ON_DIRECT = "1"
diff --git a/acceptance/bundle/resources/postgres_synced_tables/test.toml b/acceptance/bundle/resources/postgres_synced_tables/test.toml
new file mode 100644
index 00000000000..46260a85a59
--- /dev/null
+++ b/acceptance/bundle/resources/postgres_synced_tables/test.toml
@@ -0,0 +1,25 @@
+Cloud = true
+
+# Lakebase v2 (postgres) is only available in AWS as of January 2026
+CloudEnvs.gcp = false
+CloudEnvs.azure = false
+
+Ignore = [
+    "databricks.yml",
+    ".databricks",
+]
+
+[[Repls]]
+# Clean up ?[ow]=<num> suffix after URL since not all workspaces have that
+Old = '\?[ow]=\[(WORKSPACE_ID|ALPHANUMID)\]'
+New = ''
+Order = 1000
+
+# Fake SQL endpoint for the per-test source table create in script.
+[[Server]]
+Pattern = "POST /api/2.0/sql/statements/"
+Response.Body = '{"status": {"state": "SUCCEEDED"}, "manifest": {"schema": {"columns": []}}}'
+
+[[Server]]
+Pattern = "DELETE /api/2.1/unity-catalog/tables/{full_name}"
+Response.Body = '{"status": "OK"}'
diff --git a/acceptance/bundle/resources/quality_monitors/change_assets_dir/out.deploy.direct.txt b/acceptance/bundle/resources/quality_monitors/change_assets_dir/out.deploy.direct.txt
deleted file mode 100644
index 1268e736e17..00000000000
--- a/acceptance/bundle/resources/quality_monitors/change_assets_dir/out.deploy.direct.txt
+++ /dev/null
@@ -1,6 +0,0 @@
-
->>> errcode [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/quality-monitor-update-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
diff --git a/acceptance/bundle/resources/quality_monitors/change_assets_dir/out.deploy.requests.direct.json b/acceptance/bundle/resources/quality_monitors/change_assets_dir/out.deploy.requests.json
similarity index 100%
rename from acceptance/bundle/resources/quality_monitors/change_assets_dir/out.deploy.requests.direct.json
rename to acceptance/bundle/resources/quality_monitors/change_assets_dir/out.deploy.requests.json
diff --git a/acceptance/bundle/resources/quality_monitors/change_assets_dir/out.deploy.requests.terraform.json b/acceptance/bundle/resources/quality_monitors/change_assets_dir/out.deploy.requests.terraform.json
deleted file mode 100644
index db37d531e33..00000000000
--- a/acceptance/bundle/resources/quality_monitors/change_assets_dir/out.deploy.requests.terraform.json
+++ /dev/null
@@ -1,9 +0,0 @@
-{
-  "method": "PUT",
-  "path": "/api/2.1/unity-catalog/tables/main.qm_test_[UNIQUE_NAME].test_table/monitor",
-  "body": {
-    "dashboard_id": "(redacted)",
-    "output_schema_name": "main.qm_test_[UNIQUE_NAME]",
-    "snapshot": {}
-  }
-}
diff --git a/acceptance/bundle/resources/quality_monitors/change_assets_dir/out.deploy.terraform.txt b/acceptance/bundle/resources/quality_monitors/change_assets_dir/out.deploy.terraform.txt
deleted file mode 100644
index 99c0d7d2d86..00000000000
--- a/acceptance/bundle/resources/quality_monitors/change_assets_dir/out.deploy.terraform.txt
+++ /dev/null
@@ -1,22 +0,0 @@
-
->>> errcode [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/quality-monitor-update-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Error: terraform apply: exit status 1
-
-Error: Provider produced inconsistent result after apply
-
-When applying changes to databricks_quality_monitor.monitor1, provider
-"provider[\"registry.terraform.io/databricks/databricks\"]" produced an
-unexpected new value: .assets_dir: was
-cty.StringVal("/Workspace/Users/[USERNAME]/monitor_assets2_[UNIQUE_NAME]"),
-but now
-cty.StringVal("/Workspace/Users/[USERNAME]/monitor_assets_[UNIQUE_NAME]").
-
-This is a bug in the provider, which should be reported in the provider's own
-issue tracker.
-
-
-Updating deployment state...
-
-Exit code: 1
diff --git a/acceptance/bundle/resources/quality_monitors/change_assets_dir/out.deploy.txt b/acceptance/bundle/resources/quality_monitors/change_assets_dir/out.deploy.txt
new file mode 100644
index 00000000000..d260584b524
--- /dev/null
+++ b/acceptance/bundle/resources/quality_monitors/change_assets_dir/out.deploy.txt
@@ -0,0 +1,6 @@
+
+>>> errcode [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/quality-monitor-update-[UNIQUE_NAME]/default/files...
+Recreated quality_monitors.monitor1
+Files: 4 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 0 unchanged
diff --git a/acceptance/bundle/resources/quality_monitors/change_assets_dir/out.plan.direct.json b/acceptance/bundle/resources/quality_monitors/change_assets_dir/out.plan.direct.json
deleted file mode 100644
index 2f837c11f0d..00000000000
--- a/acceptance/bundle/resources/quality_monitors/change_assets_dir/out.plan.direct.json
+++ /dev/null
@@ -1,48 +0,0 @@
-
->>> errcode [CLI] bundle plan -o json
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.quality_monitors.monitor1": {
-      "action": "recreate",
-      "new_state": {
-        "value": {
-          "assets_dir": "/Workspace/Users/[USERNAME]/monitor_assets2_[UNIQUE_NAME]",
-          "output_schema_name": "main.qm_test_[UNIQUE_NAME]",
-          "snapshot": {},
-          "table_name": "main.qm_test_[UNIQUE_NAME].test_table",
-          "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
-        }
-      },
-      "remote_state": {
-        "assets_dir": "/Workspace/Users/[USERNAME]/monitor_assets_[UNIQUE_NAME]",
-        "dashboard_id": "(redacted)",
-        "drift_metrics_table_name": "main.qm_test_[UNIQUE_NAME].test_table_drift_metrics",
-        "monitor_version": 0,
-        "output_schema_name": "main.qm_test_[UNIQUE_NAME]",
-        "profile_metrics_table_name": "main.qm_test_[UNIQUE_NAME].test_table_profile_metrics",
-        "snapshot": {},
-        "status": "MONITOR_STATUS_ACTIVE",
-        "table_name": "main.qm_test_[UNIQUE_NAME].test_table"
-      },
-      "changes": {
-        "assets_dir": {
-          "action": "recreate",
-          "reason": "immutable",
-          "old": "/Workspace/Users/[USERNAME]/monitor_assets_[UNIQUE_NAME]",
-          "new": "/Workspace/Users/[USERNAME]/monitor_assets2_[UNIQUE_NAME]",
-          "remote": "/Workspace/Users/[USERNAME]/monitor_assets_[UNIQUE_NAME]"
-        },
-        "warehouse_id": {
-          "action": "skip",
-          "reason": "input_only",
-          "old": "[TEST_DEFAULT_WAREHOUSE_ID]",
-          "new": "[TEST_DEFAULT_WAREHOUSE_ID]"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/quality_monitors/change_assets_dir/out.plan.json b/acceptance/bundle/resources/quality_monitors/change_assets_dir/out.plan.json
new file mode 100644
index 00000000000..0471f4d7f85
--- /dev/null
+++ b/acceptance/bundle/resources/quality_monitors/change_assets_dir/out.plan.json
@@ -0,0 +1,46 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.quality_monitors.monitor1": {
+      "action": "recreate",
+      "new_state": {
+        "value": {
+          "assets_dir": "/Workspace/Users/[USERNAME]/monitor_assets2_[UNIQUE_NAME]",
+          "output_schema_name": "main.qm_test_[UNIQUE_NAME]",
+          "snapshot": {},
+          "table_name": "main.qm_test_[UNIQUE_NAME].test_table",
+          "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
+        }
+      },
+      "remote_state": {
+        "assets_dir": "/Workspace/Users/[USERNAME]/monitor_assets_[UNIQUE_NAME]",
+        "dashboard_id": "(redacted)",
+        "drift_metrics_table_name": "main.qm_test_[UNIQUE_NAME].test_table_drift_metrics",
+        "monitor_version": 0,
+        "output_schema_name": "main.qm_test_[UNIQUE_NAME]",
+        "profile_metrics_table_name": "main.qm_test_[UNIQUE_NAME].test_table_profile_metrics",
+        "snapshot": {},
+        "status": "MONITOR_STATUS_ACTIVE",
+        "table_name": "main.qm_test_[UNIQUE_NAME].test_table"
+      },
+      "changes": {
+        "assets_dir": {
+          "action": "recreate",
+          "reason": "immutable",
+          "old": "/Workspace/Users/[USERNAME]/monitor_assets_[UNIQUE_NAME]",
+          "new": "/Workspace/Users/[USERNAME]/monitor_assets2_[UNIQUE_NAME]",
+          "remote": "/Workspace/Users/[USERNAME]/monitor_assets_[UNIQUE_NAME]"
+        },
+        "warehouse_id": {
+          "action": "skip",
+          "reason": "missing_in_remote",
+          "old": "[TEST_DEFAULT_WAREHOUSE_ID]",
+          "new": "[TEST_DEFAULT_WAREHOUSE_ID]"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/quality_monitors/change_assets_dir/out.plan.terraform.json b/acceptance/bundle/resources/quality_monitors/change_assets_dir/out.plan.terraform.json
deleted file mode 100644
index 9100ef4bfd1..00000000000
--- a/acceptance/bundle/resources/quality_monitors/change_assets_dir/out.plan.terraform.json
+++ /dev/null
@@ -1,10 +0,0 @@
-
->>> errcode [CLI] bundle plan -o json
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.quality_monitors.monitor1": {
-      "action": "update"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/quality_monitors/change_assets_dir/out.plan.terraform.txt b/acceptance/bundle/resources/quality_monitors/change_assets_dir/out.plan.terraform.txt
deleted file mode 100644
index f84d2e70af7..00000000000
--- a/acceptance/bundle/resources/quality_monitors/change_assets_dir/out.plan.terraform.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-
->>> errcode [CLI] bundle plan
-update quality_monitors.monitor1
-
-Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
diff --git a/acceptance/bundle/resources/quality_monitors/change_assets_dir/out.plan.direct.txt b/acceptance/bundle/resources/quality_monitors/change_assets_dir/out.plan.txt
similarity index 100%
rename from acceptance/bundle/resources/quality_monitors/change_assets_dir/out.plan.direct.txt
rename to acceptance/bundle/resources/quality_monitors/change_assets_dir/out.plan.txt
diff --git a/acceptance/bundle/resources/quality_monitors/change_assets_dir/out.plan_after_deploy.terraform.txt b/acceptance/bundle/resources/quality_monitors/change_assets_dir/out.plan_after_deploy.terraform.txt
deleted file mode 100644
index f84d2e70af7..00000000000
--- a/acceptance/bundle/resources/quality_monitors/change_assets_dir/out.plan_after_deploy.terraform.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-
->>> errcode [CLI] bundle plan
-update quality_monitors.monitor1
-
-Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
diff --git a/acceptance/bundle/resources/quality_monitors/change_assets_dir/out.plan_after_deploy.direct.txt b/acceptance/bundle/resources/quality_monitors/change_assets_dir/out.plan_after_deploy.txt
similarity index 100%
rename from acceptance/bundle/resources/quality_monitors/change_assets_dir/out.plan_after_deploy.direct.txt
rename to acceptance/bundle/resources/quality_monitors/change_assets_dir/out.plan_after_deploy.txt
diff --git a/acceptance/bundle/resources/quality_monitors/change_assets_dir/out.test.toml b/acceptance/bundle/resources/quality_monitors/change_assets_dir/out.test.toml
index e849ec85ace..0f167effef1 100644
--- a/acceptance/bundle/resources/quality_monitors/change_assets_dir/out.test.toml
+++ b/acceptance/bundle/resources/quality_monitors/change_assets_dir/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/quality_monitors/change_assets_dir/output.txt b/acceptance/bundle/resources/quality_monitors/change_assets_dir/output.txt
index 08f6c53ae17..9795d322b3e 100644
--- a/acceptance/bundle/resources/quality_monitors/change_assets_dir/output.txt
+++ b/acceptance/bundle/resources/quality_monitors/change_assets_dir/output.txt
@@ -16,14 +16,14 @@ Table main.qm_test_[UNIQUE_NAME].test_table is now visible (catalog_name=main)
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/quality-monitor-update-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created quality_monitors.monitor1
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle plan
 Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
 
->>> print_requests.py ^//import-file/ ^//workspace/ ^//telemetry-ext
+>>> print_requests.py ^//api/2.0/bundle ^//workspace/ ^//telemetry-ext
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
@@ -31,5 +31,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/quality-monitor-update-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/quality_monitors/change_assets_dir/script b/acceptance/bundle/resources/quality_monitors/change_assets_dir/script
index 6caf49a7f4e..70fe4992c16 100644
--- a/acceptance/bundle/resources/quality_monitors/change_assets_dir/script
+++ b/acceptance/bundle/resources/quality_monitors/change_assets_dir/script
@@ -1,3 +1,5 @@
+mkdir -p .databricks
+
 SCHEMA_NAME="main.qm_test_${UNIQUE_NAME}"
 TABLE_NAME="${SCHEMA_NAME}.test_table"
 
@@ -9,7 +11,7 @@ cleanup() {
     trace $CLI bundle destroy --auto-approve
     $CLI schemas delete "$SCHEMA_NAME" --force 2>/dev/null || true
     $CLI schemas delete "qm_test_${UNIQUE_NAME}_2" --force 2>/dev/null || true
-    rm -f out.requests.txt
+    rm -f "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
@@ -21,10 +23,13 @@ trace $CLI bundle plan | contains.py "1 unchanged"
 
 update_file.py databricks.yml "assets_dir: /Workspace/Users/$CURRENT_USER_NAME/monitor_assets_$UNIQUE_NAME" "assets_dir: /Workspace/Users/$CURRENT_USER_NAME/monitor_assets2_$UNIQUE_NAME"
 
-trace errcode $CLI bundle plan &> out.plan.$DATABRICKS_BUNDLE_ENGINE.txt
-trace errcode $CLI bundle plan -o json &> out.plan.$DATABRICKS_BUNDLE_ENGINE.json
+trace errcode $CLI bundle plan &> out.plan.txt
+# Untraced: with &> the trace header lands in the file, leaving it unfilterable. Capture the raw
+# plan aside and stamp it out into the golden instead.
+errcode $CLI bundle plan -o json &> .databricks/tmp.plan.json
+nostamp < .databricks/tmp.plan.json > out.plan.json
 
-rm out.requests.txt
-trace errcode $CLI bundle deploy &> out.deploy.$DATABRICKS_BUNDLE_ENGINE.txt
-trace print_requests.py '^//import-file/' '^//workspace/' '^//telemetry-ext' > out.deploy.requests.$DATABRICKS_BUNDLE_ENGINE.json
-trace errcode $CLI bundle plan &> out.plan_after_deploy.$DATABRICKS_BUNDLE_ENGINE.txt
+rm "$OUT_REQUESTS"
+trace errcode $CLI bundle deploy &> out.deploy.txt
+trace print_requests.py '^//api/2.0/bundle' '^//workspace/' '^//telemetry-ext' > out.deploy.requests.json
+trace errcode $CLI bundle plan &> out.plan_after_deploy.txt
diff --git a/acceptance/bundle/resources/quality_monitors/change_output_schema_name/out.plan.direct.json b/acceptance/bundle/resources/quality_monitors/change_output_schema_name/out.plan.direct.json
deleted file mode 100644
index c4705197b10..00000000000
--- a/acceptance/bundle/resources/quality_monitors/change_output_schema_name/out.plan.direct.json
+++ /dev/null
@@ -1,45 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.quality_monitors.monitor1": {
-      "action": "update",
-      "new_state": {
-        "value": {
-          "assets_dir": "/Workspace/Users/[USERNAME]/monitor_assets_[UNIQUE_NAME]",
-          "output_schema_name": "main.qm_test_[UNIQUE_NAME]_2",
-          "snapshot": {},
-          "table_name": "main.qm_test_[UNIQUE_NAME].test_table",
-          "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
-        }
-      },
-      "remote_state": {
-        "assets_dir": "/Workspace/Users/[USERNAME]/monitor_assets_[UNIQUE_NAME]",
-        "dashboard_id": "(redacted)",
-        "drift_metrics_table_name": "main.qm_test_[UNIQUE_NAME].test_table_drift_metrics",
-        "monitor_version": 0,
-        "output_schema_name": "main.qm_test_[UNIQUE_NAME]",
-        "profile_metrics_table_name": "main.qm_test_[UNIQUE_NAME].test_table_profile_metrics",
-        "snapshot": {},
-        "status": "MONITOR_STATUS_ACTIVE",
-        "table_name": "main.qm_test_[UNIQUE_NAME].test_table"
-      },
-      "changes": {
-        "output_schema_name": {
-          "action": "update",
-          "old": "main.qm_test_[UNIQUE_NAME]",
-          "new": "main.qm_test_[UNIQUE_NAME]_2",
-          "remote": "main.qm_test_[UNIQUE_NAME]"
-        },
-        "warehouse_id": {
-          "action": "skip",
-          "reason": "input_only",
-          "old": "[TEST_DEFAULT_WAREHOUSE_ID]",
-          "new": "[TEST_DEFAULT_WAREHOUSE_ID]"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/quality_monitors/change_output_schema_name/out.plan.json b/acceptance/bundle/resources/quality_monitors/change_output_schema_name/out.plan.json
new file mode 100644
index 00000000000..7d37b225a2a
--- /dev/null
+++ b/acceptance/bundle/resources/quality_monitors/change_output_schema_name/out.plan.json
@@ -0,0 +1,45 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.quality_monitors.monitor1": {
+      "action": "update",
+      "new_state": {
+        "value": {
+          "assets_dir": "/Workspace/Users/[USERNAME]/monitor_assets_[UNIQUE_NAME]",
+          "output_schema_name": "main.qm_test_[UNIQUE_NAME]_2",
+          "snapshot": {},
+          "table_name": "main.qm_test_[UNIQUE_NAME].test_table",
+          "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
+        }
+      },
+      "remote_state": {
+        "assets_dir": "/Workspace/Users/[USERNAME]/monitor_assets_[UNIQUE_NAME]",
+        "dashboard_id": "(redacted)",
+        "drift_metrics_table_name": "main.qm_test_[UNIQUE_NAME].test_table_drift_metrics",
+        "monitor_version": 0,
+        "output_schema_name": "main.qm_test_[UNIQUE_NAME]",
+        "profile_metrics_table_name": "main.qm_test_[UNIQUE_NAME].test_table_profile_metrics",
+        "snapshot": {},
+        "status": "MONITOR_STATUS_ACTIVE",
+        "table_name": "main.qm_test_[UNIQUE_NAME].test_table"
+      },
+      "changes": {
+        "output_schema_name": {
+          "action": "update",
+          "old": "main.qm_test_[UNIQUE_NAME]",
+          "new": "main.qm_test_[UNIQUE_NAME]_2",
+          "remote": "main.qm_test_[UNIQUE_NAME]"
+        },
+        "warehouse_id": {
+          "action": "skip",
+          "reason": "missing_in_remote",
+          "old": "[TEST_DEFAULT_WAREHOUSE_ID]",
+          "new": "[TEST_DEFAULT_WAREHOUSE_ID]"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/quality_monitors/change_output_schema_name/out.plan.terraform.json b/acceptance/bundle/resources/quality_monitors/change_output_schema_name/out.plan.terraform.json
deleted file mode 100644
index 7855cb55a99..00000000000
--- a/acceptance/bundle/resources/quality_monitors/change_output_schema_name/out.plan.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.quality_monitors.monitor1": {
-      "action": "update"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/quality_monitors/change_output_schema_name/out.test.toml b/acceptance/bundle/resources/quality_monitors/change_output_schema_name/out.test.toml
index e849ec85ace..0f167effef1 100644
--- a/acceptance/bundle/resources/quality_monitors/change_output_schema_name/out.test.toml
+++ b/acceptance/bundle/resources/quality_monitors/change_output_schema_name/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/quality_monitors/change_output_schema_name/output.txt b/acceptance/bundle/resources/quality_monitors/change_output_schema_name/output.txt
index d67ee41975f..a23a2445c8b 100644
--- a/acceptance/bundle/resources/quality_monitors/change_output_schema_name/output.txt
+++ b/acceptance/bundle/resources/quality_monitors/change_output_schema_name/output.txt
@@ -16,9 +16,9 @@ Table main.qm_test_[UNIQUE_NAME].test_table is now visible (catalog_name=main)
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/quality-monitor-update-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created quality_monitors.monitor1
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle plan
 Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
@@ -32,11 +32,11 @@ Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/quality-monitor-update-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated quality_monitors.monitor1
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
->>> print_requests.py ^//import-file/ ^//workspace/ ^//telemetry-ext
+>>> print_requests.py ^//api/2.0/bundle ^//workspace/ ^//telemetry-ext
 
 >>> [CLI] bundle plan
 Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
@@ -47,5 +47,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/quality-monitor-update-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/quality_monitors/change_output_schema_name/script b/acceptance/bundle/resources/quality_monitors/change_output_schema_name/script
index 72c57e08401..a4104e4d387 100644
--- a/acceptance/bundle/resources/quality_monitors/change_output_schema_name/script
+++ b/acceptance/bundle/resources/quality_monitors/change_output_schema_name/script
@@ -9,7 +9,7 @@ cleanup() {
     trace $CLI bundle destroy --auto-approve
     $CLI schemas delete "$SCHEMA_NAME" --force 2>/dev/null || true
     $CLI schemas delete "qm_test_${UNIQUE_NAME}_2" --force 2>/dev/null || true
-    rm -f out.requests.txt
+    rm -f "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
@@ -22,11 +22,11 @@ trace $CLI bundle plan | contains.py "1 unchanged"
 update_file.py databricks.yml "output_schema_name: main.qm_test_${UNIQUE_NAME}" "output_schema_name: main.qm_test_${UNIQUE_NAME}_2"
 
 trace $CLI bundle plan | contains.py "1 to change"
-trace $CLI bundle plan -o json > out.plan.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.plan.json
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
 trace $CLI bundle deploy
 # dashboard_id is output only field that terraform adds
-trace print_requests.py '^//import-file/' '^//workspace/' '^//telemetry-ext' | grep -v '"dashboard_id":' > out.deploy.requests.json
+trace print_requests.py '^//api/2.0/bundle' '^//workspace/' '^//telemetry-ext' | grep -v '"dashboard_id":' > out.deploy.requests.json
 
 trace $CLI bundle plan | contains.py "1 unchanged"
diff --git a/acceptance/bundle/resources/quality_monitors/change_table_name/out.deploy.direct.txt b/acceptance/bundle/resources/quality_monitors/change_table_name/out.deploy.direct.txt
deleted file mode 100644
index 1268e736e17..00000000000
--- a/acceptance/bundle/resources/quality_monitors/change_table_name/out.deploy.direct.txt
+++ /dev/null
@@ -1,6 +0,0 @@
-
->>> errcode [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/quality-monitor-update-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
diff --git a/acceptance/bundle/resources/quality_monitors/change_table_name/out.deploy.requests.direct.json b/acceptance/bundle/resources/quality_monitors/change_table_name/out.deploy.requests.json
similarity index 100%
rename from acceptance/bundle/resources/quality_monitors/change_table_name/out.deploy.requests.direct.json
rename to acceptance/bundle/resources/quality_monitors/change_table_name/out.deploy.requests.json
diff --git a/acceptance/bundle/resources/quality_monitors/change_table_name/out.deploy.txt b/acceptance/bundle/resources/quality_monitors/change_table_name/out.deploy.txt
new file mode 100644
index 00000000000..d260584b524
--- /dev/null
+++ b/acceptance/bundle/resources/quality_monitors/change_table_name/out.deploy.txt
@@ -0,0 +1,6 @@
+
+>>> errcode [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/quality-monitor-update-[UNIQUE_NAME]/default/files...
+Recreated quality_monitors.monitor1
+Files: 4 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 0 unchanged
diff --git a/acceptance/bundle/resources/quality_monitors/change_table_name/out.get.direct.json b/acceptance/bundle/resources/quality_monitors/change_table_name/out.get.json
similarity index 100%
rename from acceptance/bundle/resources/quality_monitors/change_table_name/out.get.direct.json
rename to acceptance/bundle/resources/quality_monitors/change_table_name/out.get.json
diff --git a/acceptance/bundle/resources/quality_monitors/change_table_name/out.plan.direct.json b/acceptance/bundle/resources/quality_monitors/change_table_name/out.plan.direct.json
deleted file mode 100644
index 8d70f68dc7e..00000000000
--- a/acceptance/bundle/resources/quality_monitors/change_table_name/out.plan.direct.json
+++ /dev/null
@@ -1,48 +0,0 @@
-
->>> errcode [CLI] bundle plan -o json
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.quality_monitors.monitor1": {
-      "action": "recreate",
-      "new_state": {
-        "value": {
-          "assets_dir": "/Workspace/Users/[USERNAME]/monitor_assets_[UNIQUE_NAME]",
-          "output_schema_name": "main.qm_test_[UNIQUE_NAME]",
-          "snapshot": {},
-          "table_name": "main.qm_test_[UNIQUE_NAME].test_table_2",
-          "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
-        }
-      },
-      "remote_state": {
-        "assets_dir": "/Workspace/Users/[USERNAME]/monitor_assets_[UNIQUE_NAME]",
-        "dashboard_id": "(redacted)",
-        "drift_metrics_table_name": "main.qm_test_[UNIQUE_NAME].test_table_drift_metrics",
-        "monitor_version": 0,
-        "output_schema_name": "main.qm_test_[UNIQUE_NAME]",
-        "profile_metrics_table_name": "main.qm_test_[UNIQUE_NAME].test_table_profile_metrics",
-        "snapshot": {},
-        "status": "MONITOR_STATUS_ACTIVE",
-        "table_name": "main.qm_test_[UNIQUE_NAME].test_table"
-      },
-      "changes": {
-        "table_name": {
-          "action": "recreate",
-          "reason": "immutable",
-          "old": "main.qm_test_[UNIQUE_NAME].test_table",
-          "new": "main.qm_test_[UNIQUE_NAME].test_table_2",
-          "remote": "main.qm_test_[UNIQUE_NAME].test_table"
-        },
-        "warehouse_id": {
-          "action": "skip",
-          "reason": "input_only",
-          "old": "[TEST_DEFAULT_WAREHOUSE_ID]",
-          "new": "[TEST_DEFAULT_WAREHOUSE_ID]"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/quality_monitors/change_table_name/out.plan.json b/acceptance/bundle/resources/quality_monitors/change_table_name/out.plan.json
new file mode 100644
index 00000000000..850061e1c60
--- /dev/null
+++ b/acceptance/bundle/resources/quality_monitors/change_table_name/out.plan.json
@@ -0,0 +1,46 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.quality_monitors.monitor1": {
+      "action": "recreate",
+      "new_state": {
+        "value": {
+          "assets_dir": "/Workspace/Users/[USERNAME]/monitor_assets_[UNIQUE_NAME]",
+          "output_schema_name": "main.qm_test_[UNIQUE_NAME]",
+          "snapshot": {},
+          "table_name": "main.qm_test_[UNIQUE_NAME].test_table_2",
+          "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
+        }
+      },
+      "remote_state": {
+        "assets_dir": "/Workspace/Users/[USERNAME]/monitor_assets_[UNIQUE_NAME]",
+        "dashboard_id": "(redacted)",
+        "drift_metrics_table_name": "main.qm_test_[UNIQUE_NAME].test_table_drift_metrics",
+        "monitor_version": 0,
+        "output_schema_name": "main.qm_test_[UNIQUE_NAME]",
+        "profile_metrics_table_name": "main.qm_test_[UNIQUE_NAME].test_table_profile_metrics",
+        "snapshot": {},
+        "status": "MONITOR_STATUS_ACTIVE",
+        "table_name": "main.qm_test_[UNIQUE_NAME].test_table"
+      },
+      "changes": {
+        "table_name": {
+          "action": "recreate",
+          "reason": "id_field",
+          "old": "main.qm_test_[UNIQUE_NAME].test_table",
+          "new": "main.qm_test_[UNIQUE_NAME].test_table_2",
+          "remote": "main.qm_test_[UNIQUE_NAME].test_table"
+        },
+        "warehouse_id": {
+          "action": "skip",
+          "reason": "missing_in_remote",
+          "old": "[TEST_DEFAULT_WAREHOUSE_ID]",
+          "new": "[TEST_DEFAULT_WAREHOUSE_ID]"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/quality_monitors/change_table_name/out.plan.direct.txt b/acceptance/bundle/resources/quality_monitors/change_table_name/out.plan.txt
similarity index 100%
rename from acceptance/bundle/resources/quality_monitors/change_table_name/out.plan.direct.txt
rename to acceptance/bundle/resources/quality_monitors/change_table_name/out.plan.txt
diff --git a/acceptance/bundle/resources/quality_monitors/change_table_name/out.plan_after_deploy.direct.txt b/acceptance/bundle/resources/quality_monitors/change_table_name/out.plan_after_deploy.txt
similarity index 100%
rename from acceptance/bundle/resources/quality_monitors/change_table_name/out.plan_after_deploy.direct.txt
rename to acceptance/bundle/resources/quality_monitors/change_table_name/out.plan_after_deploy.txt
diff --git a/acceptance/bundle/resources/quality_monitors/change_table_name/out.test.toml b/acceptance/bundle/resources/quality_monitors/change_table_name/out.test.toml
index fe4076cdf9b..0f167effef1 100644
--- a/acceptance/bundle/resources/quality_monitors/change_table_name/out.test.toml
+++ b/acceptance/bundle/resources/quality_monitors/change_table_name/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/quality_monitors/change_table_name/output.txt b/acceptance/bundle/resources/quality_monitors/change_table_name/output.txt
index 879222aa8a4..beba3487430 100644
--- a/acceptance/bundle/resources/quality_monitors/change_table_name/output.txt
+++ b/acceptance/bundle/resources/quality_monitors/change_table_name/output.txt
@@ -16,14 +16,14 @@ Table main.qm_test_[UNIQUE_NAME].test_table_2 is now visible (catalog_name=main)
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/quality-monitor-update-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created quality_monitors.monitor1
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle plan
 Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
 
->>> print_requests.py ^//import-file/ ^//workspace/ ^//telemetry-ext
+>>> print_requests.py ^//api/2.0/bundle ^//workspace/ ^//telemetry-ext
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
@@ -31,5 +31,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/quality-monitor-update-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/quality_monitors/change_table_name/script b/acceptance/bundle/resources/quality_monitors/change_table_name/script
index 891aece1c11..a17d8b114d4 100644
--- a/acceptance/bundle/resources/quality_monitors/change_table_name/script
+++ b/acceptance/bundle/resources/quality_monitors/change_table_name/script
@@ -1,3 +1,5 @@
+mkdir -p .databricks
+
 SCHEMA_NAME="main.qm_test_${UNIQUE_NAME}"
 TABLE_NAME="${SCHEMA_NAME}.test_table"
 
@@ -9,7 +11,7 @@ cleanup() {
     trace $CLI bundle destroy --auto-approve
     $CLI schemas delete "$SCHEMA_NAME" --force 2>/dev/null || true
     $CLI schemas delete "qm_test_${UNIQUE_NAME}_2" --force 2>/dev/null || true
-    rm -f out.requests.txt
+    rm -f "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
@@ -21,12 +23,15 @@ trace $CLI bundle plan | contains.py "1 unchanged"
 
 update_file.py databricks.yml "table_name: $TABLE_NAME" "table_name: ${TABLE_NAME}_2"
 
-trace errcode $CLI bundle plan &> out.plan.$DATABRICKS_BUNDLE_ENGINE.txt
-trace errcode $CLI bundle plan -o json &> out.plan.$DATABRICKS_BUNDLE_ENGINE.json
+trace errcode $CLI bundle plan &> out.plan.txt
+# Untraced: with &> the trace header lands in the file, leaving it unfilterable. Capture the raw
+# plan aside and stamp it out into the golden instead.
+errcode $CLI bundle plan -o json &> .databricks/tmp.plan.json
+nostamp < .databricks/tmp.plan.json > out.plan.json
 
-rm out.requests.txt
-trace errcode $CLI bundle deploy &> out.deploy.$DATABRICKS_BUNDLE_ENGINE.txt
-trace print_requests.py '^//import-file/' '^//workspace/' '^//telemetry-ext' > out.deploy.requests.$DATABRICKS_BUNDLE_ENGINE.json
-trace errcode $CLI bundle plan &> out.plan_after_deploy.$DATABRICKS_BUNDLE_ENGINE.txt
+rm "$OUT_REQUESTS"
+trace errcode $CLI bundle deploy &> out.deploy.txt
+trace print_requests.py '^//api/2.0/bundle' '^//workspace/' '^//telemetry-ext' > out.deploy.requests.json
+trace errcode $CLI bundle plan &> out.plan_after_deploy.txt
 
-trace errcode $CLI quality-monitors get ${TABLE_NAME}_2 2> /dev/null > out.get.$DATABRICKS_BUNDLE_ENGINE.json
+trace errcode $CLI quality-monitors get ${TABLE_NAME}_2 2> /dev/null > out.get.json
diff --git a/acceptance/bundle/resources/quality_monitors/change_table_name/test.toml b/acceptance/bundle/resources/quality_monitors/change_table_name/test.toml
deleted file mode 100644
index 7e03ffedd9a..00000000000
--- a/acceptance/bundle/resources/quality_monitors/change_table_name/test.toml
+++ /dev/null
@@ -1,2 +0,0 @@
-# this does not work on terraform
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/resources/quality_monitors/create/out.deploy.direct.txt b/acceptance/bundle/resources/quality_monitors/create/out.deploy.direct.txt
deleted file mode 100644
index af5c31de3b1..00000000000
--- a/acceptance/bundle/resources/quality_monitors/create/out.deploy.direct.txt
+++ /dev/null
@@ -1,6 +0,0 @@
-
->>> [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/quality-monitor-update-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
diff --git a/acceptance/bundle/resources/quality_monitors/create/out.deploy.terraform.txt b/acceptance/bundle/resources/quality_monitors/create/out.deploy.terraform.txt
deleted file mode 100644
index af5c31de3b1..00000000000
--- a/acceptance/bundle/resources/quality_monitors/create/out.deploy.terraform.txt
+++ /dev/null
@@ -1,6 +0,0 @@
-
->>> [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/quality-monitor-update-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
diff --git a/acceptance/bundle/resources/quality_monitors/create/out.deploy.txt b/acceptance/bundle/resources/quality_monitors/create/out.deploy.txt
new file mode 100644
index 00000000000..b15226f0322
--- /dev/null
+++ b/acceptance/bundle/resources/quality_monitors/create/out.deploy.txt
@@ -0,0 +1,6 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/quality-monitor-update-[UNIQUE_NAME]/default/files...
+Created quality_monitors.monitor1
+Files: 4 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
diff --git a/acceptance/bundle/resources/quality_monitors/create/out.plan_create.direct.json b/acceptance/bundle/resources/quality_monitors/create/out.plan_create.direct.json
deleted file mode 100644
index 2c81e968648..00000000000
--- a/acceptance/bundle/resources/quality_monitors/create/out.plan_create.direct.json
+++ /dev/null
@@ -1,18 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.quality_monitors.monitor1": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "assets_dir": "/Workspace/Users/[USERNAME]/monitor_assets_[UNIQUE_NAME]",
-          "output_schema_name": "main.qm_test_[UNIQUE_NAME]",
-          "snapshot": {},
-          "table_name": "main.qm_test_[UNIQUE_NAME].test_table",
-          "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/quality_monitors/create/out.plan_create.json b/acceptance/bundle/resources/quality_monitors/create/out.plan_create.json
new file mode 100644
index 00000000000..59fadb45243
--- /dev/null
+++ b/acceptance/bundle/resources/quality_monitors/create/out.plan_create.json
@@ -0,0 +1,18 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.quality_monitors.monitor1": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "assets_dir": "/Workspace/Users/[USERNAME]/monitor_assets_[UNIQUE_NAME]",
+          "output_schema_name": "main.qm_test_[UNIQUE_NAME]",
+          "snapshot": {},
+          "table_name": "main.qm_test_[UNIQUE_NAME].test_table",
+          "warehouse_id": "[TEST_DEFAULT_WAREHOUSE_ID]"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/quality_monitors/create/out.plan_create.terraform.json b/acceptance/bundle/resources/quality_monitors/create/out.plan_create.terraform.json
deleted file mode 100644
index a0ebeeb4b0b..00000000000
--- a/acceptance/bundle/resources/quality_monitors/create/out.plan_create.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.quality_monitors.monitor1": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/quality_monitors/create/out.plan_noop.direct.json b/acceptance/bundle/resources/quality_monitors/create/out.plan_noop.direct.json
deleted file mode 100644
index 88053374383..00000000000
--- a/acceptance/bundle/resources/quality_monitors/create/out.plan_noop.direct.json
+++ /dev/null
@@ -1,30 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.quality_monitors.monitor1": {
-      "action": "skip",
-      "remote_state": {
-        "assets_dir": "/Workspace/Users/[USERNAME]/monitor_assets_[UNIQUE_NAME]",
-        "dashboard_id": "(redacted)",
-        "drift_metrics_table_name": "main.qm_test_[UNIQUE_NAME].test_table_drift_metrics",
-        "monitor_version": 0,
-        "output_schema_name": "main.qm_test_[UNIQUE_NAME]",
-        "profile_metrics_table_name": "main.qm_test_[UNIQUE_NAME].test_table_profile_metrics",
-        "snapshot": {},
-        "status": "MONITOR_STATUS_ACTIVE",
-        "table_name": "main.qm_test_[UNIQUE_NAME].test_table"
-      },
-      "changes": {
-        "warehouse_id": {
-          "action": "skip",
-          "reason": "input_only",
-          "old": "[TEST_DEFAULT_WAREHOUSE_ID]",
-          "new": "[TEST_DEFAULT_WAREHOUSE_ID]"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/quality_monitors/create/out.plan_noop.json b/acceptance/bundle/resources/quality_monitors/create/out.plan_noop.json
new file mode 100644
index 00000000000..310bb1515b3
--- /dev/null
+++ b/acceptance/bundle/resources/quality_monitors/create/out.plan_noop.json
@@ -0,0 +1,30 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.quality_monitors.monitor1": {
+      "action": "skip",
+      "remote_state": {
+        "assets_dir": "/Workspace/Users/[USERNAME]/monitor_assets_[UNIQUE_NAME]",
+        "dashboard_id": "(redacted)",
+        "drift_metrics_table_name": "main.qm_test_[UNIQUE_NAME].test_table_drift_metrics",
+        "monitor_version": 0,
+        "output_schema_name": "main.qm_test_[UNIQUE_NAME]",
+        "profile_metrics_table_name": "main.qm_test_[UNIQUE_NAME].test_table_profile_metrics",
+        "snapshot": {},
+        "status": "MONITOR_STATUS_ACTIVE",
+        "table_name": "main.qm_test_[UNIQUE_NAME].test_table"
+      },
+      "changes": {
+        "warehouse_id": {
+          "action": "skip",
+          "reason": "missing_in_remote",
+          "old": "[TEST_DEFAULT_WAREHOUSE_ID]",
+          "new": "[TEST_DEFAULT_WAREHOUSE_ID]"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/quality_monitors/create/out.plan_noop.terraform.json b/acceptance/bundle/resources/quality_monitors/create/out.plan_noop.terraform.json
deleted file mode 100644
index 7c485333f27..00000000000
--- a/acceptance/bundle/resources/quality_monitors/create/out.plan_noop.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.quality_monitors.monitor1": {
-      "action": "skip"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/quality_monitors/create/out.state.terraform.txt b/acceptance/bundle/resources/quality_monitors/create/out.state.terraform.txt
deleted file mode 100644
index dbdd758797b..00000000000
--- a/acceptance/bundle/resources/quality_monitors/create/out.state.terraform.txt
+++ /dev/null
@@ -1,6 +0,0 @@
-      "name": "monitor1",
-            "baseline_table_name": null,
-            "drift_metrics_table_name": "main.qm_test_[UNIQUE_NAME].test_table_drift_metrics",
-            "output_schema_name": "main.qm_test_[UNIQUE_NAME]",
-            "profile_metrics_table_name": "main.qm_test_[UNIQUE_NAME].test_table_profile_metrics",
-            "table_name": "main.qm_test_[UNIQUE_NAME].test_table",
diff --git a/acceptance/bundle/resources/quality_monitors/create/out.state.direct.txt b/acceptance/bundle/resources/quality_monitors/create/out.state.txt
similarity index 100%
rename from acceptance/bundle/resources/quality_monitors/create/out.state.direct.txt
rename to acceptance/bundle/resources/quality_monitors/create/out.state.txt
diff --git a/acceptance/bundle/resources/quality_monitors/create/out.test.toml b/acceptance/bundle/resources/quality_monitors/create/out.test.toml
index e849ec85ace..0f167effef1 100644
--- a/acceptance/bundle/resources/quality_monitors/create/out.test.toml
+++ b/acceptance/bundle/resources/quality_monitors/create/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/quality_monitors/create/output.txt b/acceptance/bundle/resources/quality_monitors/create/output.txt
index 8037d5ec9cc..5d1b3497525 100644
--- a/acceptance/bundle/resources/quality_monitors/create/output.txt
+++ b/acceptance/bundle/resources/quality_monitors/create/output.txt
@@ -16,7 +16,7 @@ Table main.qm_test_[UNIQUE_NAME].test_table is now visible (catalog_name=main)
 
 >>> [CLI] bundle plan -o json
 
->>> print_requests.py ^//import-file/ ^//workspace/ ^//telemetry-ext
+>>> print_requests.py ^//api/2.0/bundle ^//workspace/ ^//telemetry-ext
 
 >>> [CLI] bundle plan -o json
 
@@ -26,5 +26,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/quality-monitor-update-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/quality_monitors/create/script b/acceptance/bundle/resources/quality_monitors/create/script
index 78c7853b264..1a3a60b1381 100644
--- a/acceptance/bundle/resources/quality_monitors/create/script
+++ b/acceptance/bundle/resources/quality_monitors/create/script
@@ -11,19 +11,19 @@ cleanup() {
     # Clean up schemas and table (suppress errors since they may already be gone)
     $CLI schemas delete "$SCHEMA_NAME" --force 2>/dev/null || true
     $CLI schemas delete "qm_test_${UNIQUE_NAME}_2" --force 2>/dev/null || true
-    rm -f out.requests.txt
+    rm -f "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
 envsubst < databricks.yml.tmpl > databricks.yml
 
-trace $CLI bundle plan -o json > out.plan_create.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.plan_create.json
 
-rm out.requests.txt
-trace $CLI bundle deploy &> out.deploy.$DATABRICKS_BUNDLE_ENGINE.txt
-trace print_requests.py '^//import-file/' '^//workspace/' '^//telemetry-ext' > out.deploy.requests.json
+rm "$OUT_REQUESTS"
+trace $CLI bundle deploy &> out.deploy.txt
+trace print_requests.py '^//api/2.0/bundle' '^//workspace/' '^//telemetry-ext' > out.deploy.requests.json
 
 # store state to ensure we have table_name there
-print_state.py | grep name > out.state.$DATABRICKS_BUNDLE_ENGINE.txt
+print_state.py | grep name > out.state.txt
 
-trace $CLI bundle plan -o json > out.plan_noop.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -o json | nostamp > out.plan_noop.json
diff --git a/acceptance/bundle/resources/quality_monitors/test.toml b/acceptance/bundle/resources/quality_monitors/test.toml
index e0d535ddc22..4e383d30499 100644
--- a/acceptance/bundle/resources/quality_monitors/test.toml
+++ b/acceptance/bundle/resources/quality_monitors/test.toml
@@ -1,17 +1,12 @@
 # Test quality monitor output_schema_name updates
 Cloud = true
-Local = true
-RequiresUnityCatalog = true
 RecordRequests = true
 
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
-
 # Fake SQL endpoint for local tests
 [[Server]]
 Pattern = "POST /api/2.0/sql/statements/"
 Response.Body = '{"status": {"state": "SUCCEEDED"}, "manifest": {"schema": {"columns": []}}}'
 
-
 [[Repls]]
 Old = '"dashboard_id":\s*"[0-9a-f]+",'
 New = '"dashboard_id": "(redacted)",'
diff --git a/acceptance/bundle/resources/registered_models/aliases_converge/databricks.yml.tmpl b/acceptance/bundle/resources/registered_models/aliases_converge/databricks.yml.tmpl
new file mode 100644
index 00000000000..43550247edc
--- /dev/null
+++ b/acceptance/bundle/resources/registered_models/aliases_converge/databricks.yml.tmpl
@@ -0,0 +1,16 @@
+bundle:
+  name: deploy-registered-models-aliases-$UNIQUE_NAME
+
+resources:
+  registered_models:
+    my_registered_model:
+      name: my-registered-model-aliases-$UNIQUE_NAME
+      comment: $COMMENT
+      catalog_name: main
+      schema_name: default
+      # Aliases live on model versions and GET does not echo them back
+      # (DoRead uses IncludeAliases=false), so a config that sets them used to
+      # report a perpetual in-place update and never converge.
+      aliases:
+        - alias_name: champion
+          id: alias-champion
diff --git a/acceptance/bundle/resources/registered_models/aliases_converge/out.test.toml b/acceptance/bundle/resources/registered_models/aliases_converge/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/registered_models/aliases_converge/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/registered_models/aliases_converge/output.txt b/acceptance/bundle/resources/registered_models/aliases_converge/output.txt
new file mode 100644
index 00000000000..af7b9aae061
--- /dev/null
+++ b/acceptance/bundle/resources/registered_models/aliases_converge/output.txt
@@ -0,0 +1,56 @@
+
+>>> export COMMENT=original comment
+
+=== Initial deployment with aliases set
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-registered-models-aliases-[UNIQUE_NAME]/default/files...
+Created registered_models.my_registered_model
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Plan is a no-op: GET never echoes aliases, so they must not drift
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+=== The config-set aliases are skipped as input_only (confirms the matched rule)
+>>> [CLI] bundle plan --output json
+{
+  "action": "skip",
+  "reason": "input_only",
+  "old": [
+    {
+      "alias_name": "champion",
+      "id": "alias-champion"
+    }
+  ],
+  "new": [
+    {
+      "alias_name": "champion",
+      "id": "alias-champion"
+    }
+  ]
+}
+
+=== Edit the comment: an in-place update, not a recreate
+>>> [CLI] bundle plan
+update registered_models.my_registered_model
+
+Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-registered-models-aliases-[UNIQUE_NAME]/default/files...
+Updated registered_models.my_registered_model
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+=== Re-plan after the edit converges: no further changes
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.registered_models.my_registered_model
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-registered-models-aliases-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/registered_models/aliases_converge/script b/acceptance/bundle/resources/registered_models/aliases_converge/script
new file mode 100644
index 00000000000..5e5f70f5cc7
--- /dev/null
+++ b/acceptance/bundle/resources/registered_models/aliases_converge/script
@@ -0,0 +1,26 @@
+
+trace export COMMENT="original comment"
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+title "Initial deployment with aliases set"
+trace $CLI bundle deploy
+
+title "Plan is a no-op: GET never echoes aliases, so they must not drift"
+trace $CLI bundle plan | contains.py "Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged"
+
+title "The config-set aliases are skipped as input_only (confirms the matched rule)"
+trace $CLI bundle plan --output json | nostamp | jq '.plan[].changes.aliases'
+
+title "Edit the comment: an in-place update, not a recreate"
+export COMMENT="updated comment"
+envsubst < databricks.yml.tmpl > databricks.yml
+trace $CLI bundle plan | contains.py "Plan: 0 to add, 1 to change, 0 to delete"
+trace $CLI bundle deploy
+
+title "Re-plan after the edit converges: no further changes"
+trace $CLI bundle plan | contains.py "Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged"
diff --git a/acceptance/bundle/resources/registered_models/aliases_converge/test.toml b/acceptance/bundle/resources/registered_models/aliases_converge/test.toml
new file mode 100644
index 00000000000..85af31f8076
--- /dev/null
+++ b/acceptance/bundle/resources/registered_models/aliases_converge/test.toml
@@ -0,0 +1,4 @@
+RecordRequests = false
+
+# The aliases input_only classification lives in the direct engine, so scope
+# this regression there.
diff --git a/acceptance/bundle/resources/registered_models/basic/out.test.toml b/acceptance/bundle/resources/registered_models/basic/out.test.toml
index 6e3397efe53..98ccab9aaeb 100644
--- a/acceptance/bundle/resources/registered_models/basic/out.test.toml
+++ b/acceptance/bundle/resources/registered_models/basic/out.test.toml
@@ -1,5 +1,3 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
 RunsOnDbr = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/registered_models/basic/output.txt b/acceptance/bundle/resources/registered_models/basic/output.txt
index 8ba7d5758bd..0cfe7b53077 100644
--- a/acceptance/bundle/resources/registered_models/basic/output.txt
+++ b/acceptance/bundle/resources/registered_models/basic/output.txt
@@ -26,9 +26,9 @@ Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-registered-models-basic-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created registered_models.my_registered_model
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] registered-models get main.default.my-registered-model-[UNIQUE_NAME]
 {
@@ -46,9 +46,9 @@ Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-registered-models-basic-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated registered_models.my_registered_model
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] registered-models get main.default.my-registered-model-[UNIQUE_NAME]
 {
@@ -66,9 +66,9 @@ Plan: 1 to add, 0 to change, 1 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-registered-models-basic-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Recreated registered_models.my_registered_model
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 0 unchanged
 
 >>> [CLI] registered-models get main.default.my-registered-model-updated-[UNIQUE_NAME]
 {
@@ -86,9 +86,9 @@ Plan: 1 to add, 0 to change, 1 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-registered-models-basic-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Recreated registered_models.my_registered_model
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 0 unchanged
 
 >>> [CLI] registered-models get mycatalog-[UNIQUE_NAME].default.my-registered-model-updated-[UNIQUE_NAME]
 {
@@ -106,9 +106,9 @@ Plan: 1 to add, 0 to change, 1 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-registered-models-basic-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Recreated registered_models.my_registered_model
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 0 unchanged
 
 >>> [CLI] registered-models get mycatalog-[UNIQUE_NAME].myschema-[UNIQUE_NAME].my-registered-model-updated-[UNIQUE_NAME]
 {
@@ -124,8 +124,7 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-registered-models-basic-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
 
 >>> [CLI] schemas delete mycatalog-[UNIQUE_NAME].myschema-[UNIQUE_NAME] --force
 
diff --git a/acceptance/bundle/resources/registered_models/basic/script b/acceptance/bundle/resources/registered_models/basic/script
index 42313057e0b..61dff74182c 100644
--- a/acceptance/bundle/resources/registered_models/basic/script
+++ b/acceptance/bundle/resources/registered_models/basic/script
@@ -20,7 +20,7 @@ trap cleanup EXIT
 deploy_registered_model() {
     trace $CLI bundle plan
     trace $CLI bundle deploy
-    registered_model_id=$($CLI bundle summary --output json | jq -r '.resources.registered_models.my_registered_model.id')
+    registered_model_id=$($CLI bundle summary --output json | nostamp | jq -r '.resources.registered_models.my_registered_model.id')
     trace $CLI registered-models get "${registered_model_id}" | jq '{name, comment, catalog_name, schema_name}'
 }
 
diff --git a/acceptance/bundle/resources/registered_models/basic/test.toml b/acceptance/bundle/resources/registered_models/basic/test.toml
index 33508ef3272..7d7ae48db25 100644
--- a/acceptance/bundle/resources/registered_models/basic/test.toml
+++ b/acceptance/bundle/resources/registered_models/basic/test.toml
@@ -1,5 +1,3 @@
 Cloud = true
-Local = true
 RecordRequests = false
 RunsOnDbr = true
-RequiresUnityCatalog = true
diff --git a/acceptance/bundle/resources/registered_models/comment_cleared/databricks.yml.tmpl b/acceptance/bundle/resources/registered_models/comment_cleared/databricks.yml.tmpl
new file mode 100644
index 00000000000..de63e932c48
--- /dev/null
+++ b/acceptance/bundle/resources/registered_models/comment_cleared/databricks.yml.tmpl
@@ -0,0 +1,14 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  schemas:
+    schema1:
+      catalog_name: main
+      name: test-schema-$UNIQUE_NAME
+  registered_models:
+    model1:
+      name: test-model-$UNIQUE_NAME
+      catalog_name: main
+      schema_name: ${resources.schemas.schema1.name}
+      comment: declared in the bundle
diff --git a/acceptance/bundle/resources/registered_models/comment_cleared/out.test.toml b/acceptance/bundle/resources/registered_models/comment_cleared/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/registered_models/comment_cleared/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/registered_models/comment_cleared/output.txt b/acceptance/bundle/resources/registered_models/comment_cleared/output.txt
new file mode 100644
index 00000000000..76ef93f002f
--- /dev/null
+++ b/acceptance/bundle/resources/registered_models/comment_cleared/output.txt
@@ -0,0 +1,48 @@
+
+=== Deploy with a comment
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Created registered_models.model1
+Created schemas.schema1
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Remove the comment from the configuration and redeploy
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Updated registered_models.model1
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 1 unchanged
+
+=== The comment the bundle no longer declares
+>>> [CLI] api get /api/2.1/unity-catalog/models/main.test-schema-[UNIQUE_NAME].test-model-[UNIQUE_NAME]
+""
+
+=== Redeploy
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
+
+=== The UpdateRegisteredModel payloads the deploys sent
+>>> print_requests.py --method PATCH //unity-catalog/models
+{
+  "method": "PATCH",
+  "path": "/api/2.1/unity-catalog/models/main.test-schema-[UNIQUE_NAME].test-model-[UNIQUE_NAME]",
+  "body": {
+    "catalog_name": "main",
+    "comment": "",
+    "name": "test-model-[UNIQUE_NAME]",
+    "schema_name": "test-schema-[UNIQUE_NAME]"
+  }
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.registered_models.model1
+  delete resources.schemas.schema1
+
+This action will result in the deletion of the following UC schemas. Any underlying data may be lost:
+  delete resources.schemas.schema1
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/registered_models/comment_cleared/script b/acceptance/bundle/resources/registered_models/comment_cleared/script
new file mode 100644
index 00000000000..1c1694a6bff
--- /dev/null
+++ b/acceptance/bundle/resources/registered_models/comment_cleared/script
@@ -0,0 +1,27 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+MODEL="main.test-schema-${UNIQUE_NAME}.test-model-${UNIQUE_NAME}"
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+
+    # Consume the destroy's requests so none are left recorded.
+    print_requests.py --method PATCH //unity-catalog/models &> LOG.destroy_requests
+}
+trap cleanup EXIT
+
+title "Deploy with a comment"
+trace $CLI bundle deploy
+
+title "Remove the comment from the configuration and redeploy"
+update_file.py databricks.yml 'comment: declared in the bundle' ''
+trace $CLI bundle deploy
+
+title "The comment the bundle no longer declares"
+MSYS_NO_PATHCONV=1 trace $CLI api get "/api/2.1/unity-catalog/models/$MODEL" | jq '.comment'
+
+title "Redeploy"
+trace $CLI bundle plan
+
+title "The UpdateRegisteredModel payloads the deploys sent"
+trace print_requests.py --method PATCH //unity-catalog/models
diff --git a/acceptance/bundle/resources/registered_models/comment_cleared/test.toml b/acceptance/bundle/resources/registered_models/comment_cleared/test.toml
new file mode 100644
index 00000000000..1a06951fb71
--- /dev/null
+++ b/acceptance/bundle/resources/registered_models/comment_cleared/test.toml
@@ -0,0 +1,9 @@
+Cloud = true
+
+# UpdateRegisteredModel payload construction is direct-engine-specific.
+
+Ignore = [
+    ".databricks",
+    ".gitignore",
+    "databricks.yml",
+]
diff --git a/acceptance/bundle/resources/registered_models/drift/browse_only/databricks.yml b/acceptance/bundle/resources/registered_models/drift/browse_only/databricks.yml
new file mode 100644
index 00000000000..29179257ee8
--- /dev/null
+++ b/acceptance/bundle/resources/registered_models/drift/browse_only/databricks.yml
@@ -0,0 +1,10 @@
+bundle:
+  name: test-bundle
+
+resources:
+  registered_models:
+    model1:
+      name: model_browse_only
+      catalog_name: main
+      schema_name: default
+      comment: original comment
diff --git a/acceptance/bundle/resources/registered_models/drift/browse_only/out.test.toml b/acceptance/bundle/resources/registered_models/drift/browse_only/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/registered_models/drift/browse_only/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/registered_models/drift/browse_only/output.txt b/acceptance/bundle/resources/registered_models/drift/browse_only/output.txt
new file mode 100644
index 00000000000..33aa6f879e5
--- /dev/null
+++ b/acceptance/bundle/resources/registered_models/drift/browse_only/output.txt
@@ -0,0 +1,33 @@
+
+=== Initial deployment
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created registered_models.model1
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Plan is a no-op despite the backend computing browse_only
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+=== The remote-only browse_only is skipped as output_only (confirms the matched rule)
+>>> [CLI] bundle plan --output json
+{
+  "action": "skip",
+  "reason": "spec:output_only",
+  "remote": true
+}
+
+=== Redeploy is a no-op (no UpdateRegisteredModel call)
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
+
+>>> print_requests.py //unity
+json.method = "POST";
+json.path = "/api/2.1/unity-catalog/models";
+json.body.catalog_name = "main";
+json.body.comment = "original comment";
+json.body.name = "model_browse_only";
+json.body.schema_name = "default";
diff --git a/acceptance/bundle/resources/registered_models/drift/browse_only/script b/acceptance/bundle/resources/registered_models/drift/browse_only/script
new file mode 100644
index 00000000000..e6db1dad545
--- /dev/null
+++ b/acceptance/bundle/resources/registered_models/drift/browse_only/script
@@ -0,0 +1,13 @@
+
+title "Initial deployment"
+trace $CLI bundle deploy
+
+title "Plan is a no-op despite the backend computing browse_only"
+trace $CLI bundle plan | contains.py "Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged"
+
+title "The remote-only browse_only is skipped as output_only (confirms the matched rule)"
+trace $CLI bundle plan --output json | nostamp | jq '.plan[].changes.browse_only'
+
+title "Redeploy is a no-op (no UpdateRegisteredModel call)"
+trace $CLI bundle deploy
+trace print_requests.py //unity | gron.py | contains.py '!json.method = "PATCH"'
diff --git a/acceptance/bundle/resources/registered_models/drift/browse_only/test.toml b/acceptance/bundle/resources/registered_models/drift/browse_only/test.toml
new file mode 100644
index 00000000000..50f2c0e20df
--- /dev/null
+++ b/acceptance/bundle/resources/registered_models/drift/browse_only/test.toml
@@ -0,0 +1,4 @@
+RecordRequests = true
+
+# Terraform does not model browse_only as an output-only field the same way, so
+# scope this regression to the direct engine where the classification lives.
diff --git a/acceptance/bundle/resources/schemas/auto-approve/out.test.toml b/acceptance/bundle/resources/schemas/auto-approve/out.test.toml
index 6e3397efe53..98ccab9aaeb 100644
--- a/acceptance/bundle/resources/schemas/auto-approve/out.test.toml
+++ b/acceptance/bundle/resources/schemas/auto-approve/out.test.toml
@@ -1,5 +1,3 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
 RunsOnDbr = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/schemas/auto-approve/output.txt b/acceptance/bundle/resources/schemas/auto-approve/output.txt
index 6a773f60cae..1b520137437 100644
--- a/acceptance/bundle/resources/schemas/auto-approve/output.txt
+++ b/acceptance/bundle/resources/schemas/auto-approve/output.txt
@@ -1,9 +1,14 @@
 
 >>> [CLI] bundle deploy
+Warning: The "development" property of pipelines is deprecated. Use "mode: development" in your databricks.yml instead. See https://docs.databricks.com/dev-tools/bundles/deployment-modes.
+  at resources.pipelines.foo.development
+  in databricks.yml:14:20
+
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created pipelines.foo
+Created schemas.bar
+Files: 5 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 === Assert the schema is created
 >>> [CLI] schemas get main.test-schema-[UNIQUE_NAME]
@@ -12,7 +17,11 @@ Deployment complete!
   "comment": "This schema was created from DABs"
 }
 
-=== Assert the pipeline is created and uses the schema
+=== Assert the pipeline is created and uses the schemaWarning: The "development" property of pipelines is deprecated. Use "mode: development" in your databricks.yml instead. See https://docs.databricks.com/dev-tools/bundles/deployment-modes.
+  at resources.pipelines.foo.development
+  in databricks.yml:14:20
+
+
 >>> [CLI] pipelines get [UUID]
 {
   "spec": {
@@ -33,7 +42,7 @@ Deployment complete!
       }
     ],
     "name": "test-pipeline-[UNIQUE_NAME]",
-    "target": "main.test-schema-[UNIQUE_NAME]"
+    "target": "test-schema-[UNIQUE_NAME]"
   }
 }
 
@@ -53,15 +62,26 @@ test-file-[UNIQUE_NAME].txt -> dbfs:/Volumes/main/test-schema-[UNIQUE_NAME]/test
 
 === Try to redeploy the bundle - should fail without --auto-approve
 >>> [CLI] bundle deploy
+Warning: The "development" property of pipelines is deprecated. Use "mode: development" in your databricks.yml instead. See https://docs.databricks.com/dev-tools/bundles/deployment-modes.
+  at resources.pipelines.foo.development
+  in databricks.yml:14:20
+
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
 
 This action will result in the deletion or recreation of the following UC schemas. Any underlying data may be lost:
   delete resources.schemas.bar
-Error: the deployment requires destructive actions, but current console does not support prompting. Please specify --auto-approve if you would like to skip prompts and proceed
+Error: the deployment requires destructive actions, but the current console does not support prompting.
+Deleting data assets such as schemas, pipelines, or volumes may cause permanent data loss and should be carefully reviewed.
+To proceed, use --auto-approve after reviewing the plan above.
 
+Files: 1 uploaded, 1 deleted
 
 === Test cleanup
 >>> [CLI] bundle destroy --auto-approve
+Warning: The "development" property of pipelines is deprecated. Use "mode: development" in your databricks.yml instead. See https://docs.databricks.com/dev-tools/bundles/deployment-modes.
+  at resources.pipelines.foo.development
+  in databricks.yml:14:20
+
 The following resources will be deleted:
   delete resources.pipelines.foo
   delete resources.schemas.bar
@@ -70,13 +90,12 @@ This action will result in the deletion of the following UC schemas. Any underly
   delete resources.schemas.bar
 
 This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
-Streaming Tables (STs) and Materialized Views (MVs) managed by them:
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:
   delete resources.pipelines.foo
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 2 deleted
 
 === Assert the schema is deleted
 Exit code: 1
diff --git a/acceptance/bundle/resources/schemas/auto-approve/schema.yml.tmpl b/acceptance/bundle/resources/schemas/auto-approve/schema.yml.tmpl
index d446bbea23c..e3418ca3590 100644
--- a/acceptance/bundle/resources/schemas/auto-approve/schema.yml.tmpl
+++ b/acceptance/bundle/resources/schemas/auto-approve/schema.yml.tmpl
@@ -10,5 +10,5 @@ targets:
     resources:
       pipelines:
         foo:
-          target: ${resources.schemas.bar.id}
+          target: ${resources.schemas.bar.name}
           catalog: main
diff --git a/acceptance/bundle/resources/schemas/auto-approve/script b/acceptance/bundle/resources/schemas/auto-approve/script
index 9ea9f4fc410..f2f2b6cbade 100644
--- a/acceptance/bundle/resources/schemas/auto-approve/script
+++ b/acceptance/bundle/resources/schemas/auto-approve/script
@@ -20,8 +20,8 @@ title "Assert the schema is created"
 trace $CLI schemas get "${CATALOG_NAME}.${SCHEMA_NAME}" | jq "{full_name, comment}"
 
 title "Assert the pipeline is created and uses the schema"
-PIPELINE_ID=$($CLI bundle summary -o json | jq -r '.resources.pipelines.foo.id')
-trace $CLI pipelines get "${PIPELINE_ID}" | jq "{spec}"
+PIPELINE_ID=$($CLI bundle summary -o json | nostamp | jq -r '.resources.pipelines.foo.id')
+trace $CLI pipelines get "${PIPELINE_ID}" | nostamp| jq "{spec}"
 
 title "Create a volume in the schema, and add a file to it. This ensures that the
      schema has some data in it and deletion will fail unless the generated
diff --git a/acceptance/bundle/resources/schemas/auto-approve/test.toml b/acceptance/bundle/resources/schemas/auto-approve/test.toml
index 150da453b7e..eab8fea3966 100644
--- a/acceptance/bundle/resources/schemas/auto-approve/test.toml
+++ b/acceptance/bundle/resources/schemas/auto-approve/test.toml
@@ -1,8 +1,6 @@
-Local = true
 Cloud = true
 RecordRequests = false
 RunsOnDbr = true
-RequiresUnityCatalog = true
 
 Ignore = [
     ".databricks",
diff --git a/acceptance/bundle/resources/schemas/comment_out_of_band/databricks.yml.tmpl b/acceptance/bundle/resources/schemas/comment_out_of_band/databricks.yml.tmpl
new file mode 100644
index 00000000000..50720b62560
--- /dev/null
+++ b/acceptance/bundle/resources/schemas/comment_out_of_band/databricks.yml.tmpl
@@ -0,0 +1,8 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  schemas:
+    schema1:
+      catalog_name: main
+      name: test-schema-$UNIQUE_NAME
diff --git a/acceptance/bundle/resources/schemas/comment_out_of_band/out.test.toml b/acceptance/bundle/resources/schemas/comment_out_of_band/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/schemas/comment_out_of_band/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/schemas/comment_out_of_band/output.txt b/acceptance/bundle/resources/schemas/comment_out_of_band/output.txt
new file mode 100644
index 00000000000..ff470fc8acd
--- /dev/null
+++ b/acceptance/bundle/resources/schemas/comment_out_of_band/output.txt
@@ -0,0 +1,63 @@
+
+=== Deploy a schema that does not declare a comment
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Created schemas.schema1
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Set the comment out of band, the way Catalog Explorer does
+=== The remote comment is drift, so the plan updates the schema
+>>> [CLI] bundle plan --output json
+{
+  "comment": {
+    "action": "update",
+    "remote": "set outside the bundle"
+  }
+}
+
+=== Redeploy clears the comment
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Updated schemas.schema1
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+=== The comment is gone
+>>> [CLI] api get /api/2.1/unity-catalog/schemas/main.test-schema-[UNIQUE_NAME]
+""
+
+=== Redeploy is a no-op
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
+
+=== The UpdateSchema payloads the deploys sent
+>>> print_requests.py --method PATCH //unity-catalog/schemas
+{
+  "method": "PATCH",
+  "path": "/api/2.1/unity-catalog/schemas/main.test-schema-[UNIQUE_NAME]",
+  "body": {
+    "comment": "set outside the bundle"
+  }
+}
+{
+  "method": "PATCH",
+  "path": "/api/2.1/unity-catalog/schemas/main.test-schema-[UNIQUE_NAME]",
+  "body": {
+    "comment": "",
+    "custom_max_retention_hours": 0
+  }
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.schemas.schema1
+
+This action will result in the deletion of the following UC schemas. Any underlying data may be lost:
+  delete resources.schemas.schema1
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/schemas/comment_out_of_band/script b/acceptance/bundle/resources/schemas/comment_out_of_band/script
new file mode 100644
index 00000000000..bfa4bc548b4
--- /dev/null
+++ b/acceptance/bundle/resources/schemas/comment_out_of_band/script
@@ -0,0 +1,32 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+SCHEMA="main.test-schema-${UNIQUE_NAME}"
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+
+    # Consume the destroy's requests so none are left recorded.
+    print_requests.py --method PATCH //unity-catalog/schemas &> LOG.destroy_requests
+}
+trap cleanup EXIT
+
+title "Deploy a schema that does not declare a comment"
+trace $CLI bundle deploy
+
+title "Set the comment out of band, the way Catalog Explorer does"
+MSYS_NO_PATHCONV=1 $CLI api patch "/api/2.1/unity-catalog/schemas/$SCHEMA" --json '{"comment":"set outside the bundle"}' > /dev/null
+
+title "The remote comment is drift, so the plan updates the schema"
+trace $CLI bundle plan --output json | nostamp | jq '.plan[].changes' | normalize_uc_payload.py
+
+title "Redeploy clears the comment"
+trace $CLI bundle deploy
+
+title "The comment is gone"
+MSYS_NO_PATHCONV=1 trace $CLI api get "/api/2.1/unity-catalog/schemas/$SCHEMA" | jq '.comment'
+
+title "Redeploy is a no-op"
+trace $CLI bundle deploy
+
+title "The UpdateSchema payloads the deploys sent"
+trace print_requests.py --method PATCH //unity-catalog/schemas
diff --git a/acceptance/bundle/resources/schemas/comment_out_of_band/test.toml b/acceptance/bundle/resources/schemas/comment_out_of_band/test.toml
new file mode 100644
index 00000000000..0b48c6a3619
--- /dev/null
+++ b/acceptance/bundle/resources/schemas/comment_out_of_band/test.toml
@@ -0,0 +1,9 @@
+Cloud = true
+
+# UpdateSchema payload construction is direct-engine-specific.
+
+Ignore = [
+    ".databricks",
+    ".gitignore",
+    "databricks.yml",
+]
diff --git a/acceptance/bundle/resources/schemas/drift/managed_properties/databricks.yml b/acceptance/bundle/resources/schemas/drift/managed_properties/databricks.yml
new file mode 100644
index 00000000000..5ab0d85ca59
--- /dev/null
+++ b/acceptance/bundle/resources/schemas/drift/managed_properties/databricks.yml
@@ -0,0 +1,8 @@
+bundle:
+  name: test-bundle
+
+resources:
+  schemas:
+    schema1:
+      name: schema_managed_defaults
+      catalog_name: main
diff --git a/acceptance/bundle/resources/schemas/drift/managed_properties/out.test.toml b/acceptance/bundle/resources/schemas/drift/managed_properties/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/schemas/drift/managed_properties/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/schemas/drift/managed_properties/output.txt b/acceptance/bundle/resources/schemas/drift/managed_properties/output.txt
new file mode 100644
index 00000000000..66b4711e1d6
--- /dev/null
+++ b/acceptance/bundle/resources/schemas/drift/managed_properties/output.txt
@@ -0,0 +1,41 @@
+
+=== Initial deployment
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created schemas.schema1
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Plan is a no-op despite UC auto-populating managed properties
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+
+=== The remote-only properties map is skipped as a backend default (confirms the matched rule)
+>>> [CLI] bundle plan --output json
+{
+  "properties": {
+    "action": "skip",
+    "reason": "backend_default",
+    "remote": {
+      "unity.catalog.managed.delta.defaults.defaultClusterByAuto": "true",
+      "unity.catalog.managed.delta.defaults.delta.checkpointPolicy": "v2",
+      "unity.catalog.managed.delta.defaults.delta.enableRowTracking": "true",
+      "unity.catalog.managed.delta.defaults.delta.feature.catalogManaged": "supported",
+      "unity.catalog.managed.delta.defaults.delta.parquet.format.version": "2.12.0",
+      "unity.catalog.managed.delta.defaults.delta.parquet.format.version.afe.internal": "2.12.0",
+      "unity.catalog.managed.iceberg.defaults.delta.feature.catalogManaged": "true"
+    }
+  }
+}
+
+=== Redeploy is a no-op (no UpdateSchema call)
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
+
+>>> print_requests.py //unity
+json.method = "POST";
+json.path = "/api/2.1/unity-catalog/schemas";
+json.body.catalog_name = "main";
+json.body.name = "schema_managed_defaults";
diff --git a/acceptance/bundle/resources/schemas/drift/managed_properties/script b/acceptance/bundle/resources/schemas/drift/managed_properties/script
new file mode 100644
index 00000000000..858650e72a1
--- /dev/null
+++ b/acceptance/bundle/resources/schemas/drift/managed_properties/script
@@ -0,0 +1,13 @@
+
+title "Initial deployment"
+trace $CLI bundle deploy
+
+title "Plan is a no-op despite UC auto-populating managed properties"
+trace $CLI bundle plan | contains.py "Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged"
+
+title "The remote-only properties map is skipped as a backend default (confirms the matched rule)"
+trace $CLI bundle plan --output json | nostamp | jq '.plan[].changes'
+
+title "Redeploy is a no-op (no UpdateSchema call)"
+trace $CLI bundle deploy
+trace print_requests.py //unity | gron.py | contains.py '!json.method = "PATCH"'
diff --git a/acceptance/bundle/resources/schemas/drift/managed_properties/test.toml b/acceptance/bundle/resources/schemas/drift/managed_properties/test.toml
new file mode 100644
index 00000000000..a51c65be14e
--- /dev/null
+++ b/acceptance/bundle/resources/schemas/drift/managed_properties/test.toml
@@ -0,0 +1,4 @@
+RecordRequests = true
+
+# Terraform issues a spurious PATCH for enable_predictive_optimization on every
+# deploy, which is outside the scope of backend-default handling in schemas.yml.
diff --git a/acceptance/bundle/resources/schemas/recreate/out.test.toml b/acceptance/bundle/resources/schemas/recreate/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/schemas/recreate/out.test.toml
+++ b/acceptance/bundle/resources/schemas/recreate/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/schemas/recreate/output.txt b/acceptance/bundle/resources/schemas/recreate/output.txt
index 7c173eb11f0..8cbfb7e6731 100644
--- a/acceptance/bundle/resources/schemas/recreate/output.txt
+++ b/acceptance/bundle/resources/schemas/recreate/output.txt
@@ -1,11 +1,11 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created schemas.schema1
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
->>> print_requests
+>>> print_requests.py //unity
 {
   "method": "POST",
   "path": "/api/2.1/unity-catalog/schemas",
@@ -23,7 +23,7 @@ Deployment complete!
     "comment": "COMMENT1",
     "id": "main.myschema",
     "name": "myschema",
-    "url": "[DATABRICKS_URL]/explore/data/main/myschema?o=[NUMID]"
+    "url": "[DATABRICKS_URL]/explore/data/main/myschema?w=[WORKSPACE_ID]"
   }
 }
 
@@ -40,11 +40,11 @@ Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/defaul
 
 This action will result in the deletion or recreation of the following UC schemas. Any underlying data may be lost:
   recreate resources.schemas.schema1
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Recreated schemas.schema1
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 0 unchanged
 
->>> print_requests
+>>> print_requests.py //unity
 {
   "method": "DELETE",
   "path": "/api/2.1/unity-catalog/schemas/main.myschema",
@@ -63,7 +63,7 @@ Deployment complete!
 }
 
 >>> musterr [CLI] schemas get main.myschema
-Error: Resource catalog.SchemaInfo not found: main.myschema
+Error: Schema 'main.myschema' does not exist.
 
 >>> [CLI] schemas get newmain.myschema
 {
@@ -71,7 +71,7 @@ Error: Resource catalog.SchemaInfo not found: main.myschema
   "catalog_name": "newmain",
   "catalog_type": "MANAGED_CATALOG",
   "comment": "COMMENT1",
-  "created_at": [UNIX_TIME_MILLIS][0],
+  "created_at": [UNIX_TIME_MILLIS],
   "created_by": "[USERNAME]",
   "effective_predictive_optimization_flag": {
     "inherited_from_name": "[METASTORE_NAME]",
@@ -83,7 +83,5 @@ Error: Resource catalog.SchemaInfo not found: main.myschema
   "metastore_id": "[UUID]",
   "name": "myschema",
   "owner": "[USERNAME]",
-  "schema_id": "[UUID]",
-  "updated_at": [UNIX_TIME_MILLIS][0],
-  "updated_by": "[USERNAME]"
+  "schema_id": "[UUID]"
 }
diff --git a/acceptance/bundle/resources/schemas/recreate/script b/acceptance/bundle/resources/schemas/recreate/script
index cadbfa29a7f..9d9c8dd8cdb 100644
--- a/acceptance/bundle/resources/schemas/recreate/script
+++ b/acceptance/bundle/resources/schemas/recreate/script
@@ -1,20 +1,15 @@
-echo "*" > .gitignore
 trace $CLI bundle deploy
 
-print_requests() {
-    jq 'select(.method != "GET" and (.path | contains("/unity")))' < out.requests.txt
-    rm out.requests.txt
-}
-
-trace print_requests
+trace print_requests.py //unity
 trace $CLI bundle summary -o json | jq .resources.schemas
 
 title "Update catalog_name and re-deploy"
 trace update_file.py databricks.yml "catalog_name: main" "catalog_name: newmain"
 trace $CLI bundle plan | contains.py recreate
 trace $CLI bundle deploy --auto-approve
-trace print_requests
+trace print_requests.py //unity
 
 trace musterr $CLI schemas get main.myschema
-trace $CLI schemas get newmain.myschema
-rm out.requests.txt
+# updated_at/updated_by reflect UC's post-create system write that populates managed defaults, so on managed-defaults clouds they show a system principal rather than the creator; drop them (the managed properties map is pruned automatically).
+trace $CLI schemas get newmain.myschema | normalize_uc_payload.py updated_at updated_by
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/resources/schemas/update/out.test.toml b/acceptance/bundle/resources/schemas/update/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/schemas/update/out.test.toml
+++ b/acceptance/bundle/resources/schemas/update/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/schemas/update/output.txt b/acceptance/bundle/resources/schemas/update/output.txt
index d8d35b6bf4a..ab18f7e09c7 100644
--- a/acceptance/bundle/resources/schemas/update/output.txt
+++ b/acceptance/bundle/resources/schemas/update/output.txt
@@ -1,9 +1,9 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created schemas.schema1
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> print_requests.py //unity
 {
@@ -22,9 +22,9 @@ schemas schema1 id='main.myschema' name='myschema' catalog_name='main' comment='
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated schemas.schema1
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
 >>> print_requests.py //unity
 json.method = "PATCH";
@@ -37,9 +37,9 @@ schemas schema1 id='main.myschema' name='myschema' catalog_name='main' comment='
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated schemas.schema1
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
 >>> print_requests.py //unity
 json.method = "PATCH";
diff --git a/acceptance/bundle/resources/schemas/update/script b/acceptance/bundle/resources/schemas/update/script
index 733ed7eb9df..c235c22b399 100644
--- a/acceptance/bundle/resources/schemas/update/script
+++ b/acceptance/bundle/resources/schemas/update/script
@@ -1,4 +1,3 @@
-echo "*" > .gitignore
 trace $CLI bundle deploy
 
 trace print_requests.py //unity
@@ -9,13 +8,13 @@ trace update_file.py databricks.yml COMMENT1 COMMENT2
 trace $CLI bundle deploy
 # Why the first time request match for direct & terraform, the requests from second deploy no longer match:
 # Terraform also sends "enable_predictive_optimization": "INHERIT" which is remote value that it stored in the state.
-trace print_requests.py //unity | gron.py | grep -v enable_predictive_optimization
+trace print_requests.py //unity | gron.py | grep -vE 'enable_predictive_optimization|custom_max_retention_hours'
 read_state.py schemas schema1 id name catalog_name comment
 
 title "Restore comment to original value and re-deploy"
 trace update_file.py databricks.yml COMMENT2 COMMENT1
 trace $CLI bundle deploy
-trace print_requests.py //unity | gron.py | grep -v enable_predictive_optimization
+trace print_requests.py //unity | gron.py | grep -vE 'enable_predictive_optimization|custom_max_retention_hours'
 read_state.py schemas schema1 id name catalog_name comment
 
-rm -f out.requests.txt
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/resources/secret_scopes/backend-type/out.test.toml b/acceptance/bundle/resources/secret_scopes/backend-type/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/secret_scopes/backend-type/out.test.toml
+++ b/acceptance/bundle/resources/secret_scopes/backend-type/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/secret_scopes/backend-type/output.txt b/acceptance/bundle/resources/secret_scopes/backend-type/output.txt
index 732a5db3602..f54bb54b247 100644
--- a/acceptance/bundle/resources/secret_scopes/backend-type/output.txt
+++ b/acceptance/bundle/resources/secret_scopes/backend-type/output.txt
@@ -1,9 +1,5 @@
 
->>> [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-secret-scope-azure-backend/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+>>> [CLI] bundle deploy -qq
 
 >>> print_requests.py //secrets
 {
diff --git a/acceptance/bundle/resources/secret_scopes/backend-type/script b/acceptance/bundle/resources/secret_scopes/backend-type/script
index 571f95bc0c9..7a0c9fc19ea 100644
--- a/acceptance/bundle/resources/secret_scopes/backend-type/script
+++ b/acceptance/bundle/resources/secret_scopes/backend-type/script
@@ -1,2 +1,2 @@
-trace $CLI bundle deploy
+trace $CLI bundle deploy -qq
 trace print_requests.py //secrets
diff --git a/acceptance/bundle/resources/secret_scopes/backend-type/test.toml b/acceptance/bundle/resources/secret_scopes/backend-type/test.toml
index 34ad85ab0fb..c9137ee00b7 100644
--- a/acceptance/bundle/resources/secret_scopes/backend-type/test.toml
+++ b/acceptance/bundle/resources/secret_scopes/backend-type/test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
 
 RecordRequests = true
diff --git a/acceptance/bundle/resources/secret_scopes/basic/out.plan1.direct.txt b/acceptance/bundle/resources/secret_scopes/basic/out.plan1.direct.txt
deleted file mode 100644
index 977ea6d0ef8..00000000000
--- a/acceptance/bundle/resources/secret_scopes/basic/out.plan1.direct.txt
+++ /dev/null
@@ -1,14 +0,0 @@
-json.plan_version = 2;
-json.cli_version = "[DEV_VERSION]";
-json.plan.resources.secret_scopes.my_scope.action = "create";
-json.plan.resources.secret_scopes.my_scope.new_state.value.scope = "test-scope-[UNIQUE_NAME]-1";
-json.plan.resources.secret_scopes.my_scope.new_state.value.scope_backend_type = "DATABRICKS";
-json.plan.resources.secret_scopes.my_scope.permissions.depends_on[0].node = "resources.secret_scopes.my_scope";
-json.plan.resources.secret_scopes.my_scope.permissions.depends_on[0].label = "${resources.secret_scopes.my_scope.name}";
-json.plan.resources.secret_scopes.my_scope.permissions.action = "create";
-json.plan.resources.secret_scopes.my_scope.permissions.new_state.value.scope_name = "";
-json.plan.resources.secret_scopes.my_scope.permissions.new_state.value.acls[0].permission = "MANAGE";
-json.plan.resources.secret_scopes.my_scope.permissions.new_state.value.acls[0].principal = "[USERNAME]";
-json.plan.resources.secret_scopes.my_scope.permissions.new_state.value.acls[1].permission = "WRITE";
-json.plan.resources.secret_scopes.my_scope.permissions.new_state.value.acls[1].principal = "deco-test-user@databricks.com";
-json.plan.resources.secret_scopes.my_scope.permissions.new_state.vars.scope_name = "${resources.secret_scopes.my_scope.name}";
diff --git a/acceptance/bundle/resources/secret_scopes/basic/out.plan1.terraform.txt b/acceptance/bundle/resources/secret_scopes/basic/out.plan1.terraform.txt
deleted file mode 100644
index c681ad6bb05..00000000000
--- a/acceptance/bundle/resources/secret_scopes/basic/out.plan1.terraform.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-json.cli_version = "[DEV_VERSION]";
-json.plan.resources.secret_scopes.my_scope.action = "create";
-json.plan.resources.secret_scopes.my_scope.permissions.action = "create";
diff --git a/acceptance/bundle/resources/secret_scopes/basic/out.plan1.txt b/acceptance/bundle/resources/secret_scopes/basic/out.plan1.txt
new file mode 100644
index 00000000000..4b52a6b8140
--- /dev/null
+++ b/acceptance/bundle/resources/secret_scopes/basic/out.plan1.txt
@@ -0,0 +1,14 @@
+json.plan_version = [PLAN_VERSION];
+json.cli_version = "[CLI_VERSION]";
+json.plan.resources.secret_scopes.my_scope.action = "create";
+json.plan.resources.secret_scopes.my_scope.new_state.value.scope = "test-scope-[UNIQUE_NAME]-1";
+json.plan.resources.secret_scopes.my_scope.new_state.value.scope_backend_type = "DATABRICKS";
+json.plan.resources.secret_scopes.my_scope.permissions.depends_on[0].node = "resources.secret_scopes.my_scope";
+json.plan.resources.secret_scopes.my_scope.permissions.depends_on[0].label = "${resources.secret_scopes.my_scope.name}";
+json.plan.resources.secret_scopes.my_scope.permissions.action = "create";
+json.plan.resources.secret_scopes.my_scope.permissions.new_state.value.scope_name = "";
+json.plan.resources.secret_scopes.my_scope.permissions.new_state.value.acls[0].permission = "MANAGE";
+json.plan.resources.secret_scopes.my_scope.permissions.new_state.value.acls[0].principal = "[USERNAME]";
+json.plan.resources.secret_scopes.my_scope.permissions.new_state.value.acls[1].permission = "WRITE";
+json.plan.resources.secret_scopes.my_scope.permissions.new_state.value.acls[1].principal = "deco-test-user@databricks.com";
+json.plan.resources.secret_scopes.my_scope.permissions.new_state.vars.scope_name = "${resources.secret_scopes.my_scope.name}";
diff --git a/acceptance/bundle/resources/secret_scopes/basic/out.plan2.direct.txt b/acceptance/bundle/resources/secret_scopes/basic/out.plan2.direct.txt
deleted file mode 100644
index 6eb60bdf463..00000000000
--- a/acceptance/bundle/resources/secret_scopes/basic/out.plan2.direct.txt
+++ /dev/null
@@ -1,33 +0,0 @@
-json.plan_version = 2;
-json.cli_version = "[DEV_VERSION]";
-json.lineage = "[UUID]";
-json.serial = 1;
-json.plan.resources.secret_scopes.my_scope.action = "recreate";
-json.plan.resources.secret_scopes.my_scope.new_state.value.scope = "test-scope-[UNIQUE_NAME]-2";
-json.plan.resources.secret_scopes.my_scope.new_state.value.scope_backend_type = "DATABRICKS";
-json.plan.resources.secret_scopes.my_scope.remote_state.backend_type = "DATABRICKS";
-json.plan.resources.secret_scopes.my_scope.remote_state.name = "test-scope-[UNIQUE_NAME]-1";
-json.plan.resources.secret_scopes.my_scope.changes.scope.action = "recreate";
-json.plan.resources.secret_scopes.my_scope.changes.scope.reason = "immutable";
-json.plan.resources.secret_scopes.my_scope.changes.scope.old = "test-scope-[UNIQUE_NAME]-1";
-json.plan.resources.secret_scopes.my_scope.changes.scope.new = "test-scope-[UNIQUE_NAME]-2";
-json.plan.resources.secret_scopes.my_scope.changes.scope.remote = "test-scope-[UNIQUE_NAME]-1";
-json.plan.resources.secret_scopes.my_scope.permissions.depends_on[0].node = "resources.secret_scopes.my_scope";
-json.plan.resources.secret_scopes.my_scope.permissions.depends_on[0].label = "${resources.secret_scopes.my_scope.name}";
-json.plan.resources.secret_scopes.my_scope.permissions.action = "update_id";
-json.plan.resources.secret_scopes.my_scope.permissions.new_state.value.scope_name = "";
-json.plan.resources.secret_scopes.my_scope.permissions.new_state.value.acls[0].permission = "MANAGE";
-json.plan.resources.secret_scopes.my_scope.permissions.new_state.value.acls[0].principal = "[USERNAME]";
-json.plan.resources.secret_scopes.my_scope.permissions.new_state.value.acls[1].permission = "WRITE";
-json.plan.resources.secret_scopes.my_scope.permissions.new_state.value.acls[1].principal = "deco-test-user@databricks.com";
-json.plan.resources.secret_scopes.my_scope.permissions.new_state.vars.scope_name = "${resources.secret_scopes.my_scope.name}";
-json.plan.resources.secret_scopes.my_scope.permissions.remote_state.scope_name = "test-scope-[UNIQUE_NAME]-1";
-json.plan.resources.secret_scopes.my_scope.permissions.remote_state.acls[0].permission = "MANAGE";
-json.plan.resources.secret_scopes.my_scope.permissions.remote_state.acls[0].principal = "[USERNAME]";
-json.plan.resources.secret_scopes.my_scope.permissions.remote_state.acls[1].permission = "WRITE";
-json.plan.resources.secret_scopes.my_scope.permissions.remote_state.acls[1].principal = "deco-test-user@databricks.com";
-json.plan.resources.secret_scopes.my_scope.permissions.changes.scope_name.action = "update_id";
-json.plan.resources.secret_scopes.my_scope.permissions.changes.scope_name.reason = "id_changes";
-json.plan.resources.secret_scopes.my_scope.permissions.changes.scope_name.old = "test-scope-[UNIQUE_NAME]-1";
-json.plan.resources.secret_scopes.my_scope.permissions.changes.scope_name.new = "";
-json.plan.resources.secret_scopes.my_scope.permissions.changes.scope_name.remote = "test-scope-[UNIQUE_NAME]-1";
diff --git a/acceptance/bundle/resources/secret_scopes/basic/out.plan2.terraform.txt b/acceptance/bundle/resources/secret_scopes/basic/out.plan2.terraform.txt
deleted file mode 100644
index 0ea7642fdd8..00000000000
--- a/acceptance/bundle/resources/secret_scopes/basic/out.plan2.terraform.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-json.cli_version = "[DEV_VERSION]";
-json.plan.resources.secret_scopes.my_scope.action = "recreate";
-json.plan.resources.secret_scopes.my_scope.permissions.action = "recreate";
diff --git a/acceptance/bundle/resources/secret_scopes/basic/out.plan2.txt b/acceptance/bundle/resources/secret_scopes/basic/out.plan2.txt
new file mode 100644
index 00000000000..3e7653fee52
--- /dev/null
+++ b/acceptance/bundle/resources/secret_scopes/basic/out.plan2.txt
@@ -0,0 +1,34 @@
+json.plan_version = [PLAN_VERSION];
+json.cli_version = "[CLI_VERSION]";
+json.lineage = "[UUID]";
+json.serial = 1;
+json.plan.resources.secret_scopes.my_scope.action = "recreate";
+json.plan.resources.secret_scopes.my_scope.new_state.value.scope = "test-scope-[UNIQUE_NAME]-2";
+json.plan.resources.secret_scopes.my_scope.new_state.value.scope_backend_type = "DATABRICKS";
+json.plan.resources.secret_scopes.my_scope.remote_state.name = "test-scope-[UNIQUE_NAME]-1";
+json.plan.resources.secret_scopes.my_scope.remote_state.scope = "test-scope-[UNIQUE_NAME]-1";
+json.plan.resources.secret_scopes.my_scope.remote_state.scope_backend_type = "DATABRICKS";
+json.plan.resources.secret_scopes.my_scope.changes.scope.action = "recreate";
+json.plan.resources.secret_scopes.my_scope.changes.scope.reason = "id_field";
+json.plan.resources.secret_scopes.my_scope.changes.scope.old = "test-scope-[UNIQUE_NAME]-1";
+json.plan.resources.secret_scopes.my_scope.changes.scope.new = "test-scope-[UNIQUE_NAME]-2";
+json.plan.resources.secret_scopes.my_scope.changes.scope.remote = "test-scope-[UNIQUE_NAME]-1";
+json.plan.resources.secret_scopes.my_scope.permissions.depends_on[0].node = "resources.secret_scopes.my_scope";
+json.plan.resources.secret_scopes.my_scope.permissions.depends_on[0].label = "${resources.secret_scopes.my_scope.name}";
+json.plan.resources.secret_scopes.my_scope.permissions.action = "update_id";
+json.plan.resources.secret_scopes.my_scope.permissions.new_state.value.scope_name = "";
+json.plan.resources.secret_scopes.my_scope.permissions.new_state.value.acls[0].permission = "MANAGE";
+json.plan.resources.secret_scopes.my_scope.permissions.new_state.value.acls[0].principal = "[USERNAME]";
+json.plan.resources.secret_scopes.my_scope.permissions.new_state.value.acls[1].permission = "WRITE";
+json.plan.resources.secret_scopes.my_scope.permissions.new_state.value.acls[1].principal = "deco-test-user@databricks.com";
+json.plan.resources.secret_scopes.my_scope.permissions.new_state.vars.scope_name = "${resources.secret_scopes.my_scope.name}";
+json.plan.resources.secret_scopes.my_scope.permissions.remote_state.scope_name = "test-scope-[UNIQUE_NAME]-1";
+json.plan.resources.secret_scopes.my_scope.permissions.remote_state.acls[0].permission = "MANAGE";
+json.plan.resources.secret_scopes.my_scope.permissions.remote_state.acls[0].principal = "[USERNAME]";
+json.plan.resources.secret_scopes.my_scope.permissions.remote_state.acls[1].permission = "WRITE";
+json.plan.resources.secret_scopes.my_scope.permissions.remote_state.acls[1].principal = "deco-test-user@databricks.com";
+json.plan.resources.secret_scopes.my_scope.permissions.changes.scope_name.action = "update_id";
+json.plan.resources.secret_scopes.my_scope.permissions.changes.scope_name.reason = "id_changes";
+json.plan.resources.secret_scopes.my_scope.permissions.changes.scope_name.old = "test-scope-[UNIQUE_NAME]-1";
+json.plan.resources.secret_scopes.my_scope.permissions.changes.scope_name.new = "";
+json.plan.resources.secret_scopes.my_scope.permissions.changes.scope_name.remote = "test-scope-[UNIQUE_NAME]-1";
diff --git a/acceptance/bundle/resources/secret_scopes/basic/out.plan_verify_no_drift.direct.txt b/acceptance/bundle/resources/secret_scopes/basic/out.plan_verify_no_drift.direct.txt
deleted file mode 100644
index e23e73418a4..00000000000
--- a/acceptance/bundle/resources/secret_scopes/basic/out.plan_verify_no_drift.direct.txt
+++ /dev/null
@@ -1,15 +0,0 @@
-json.plan_version = 2;
-json.cli_version = "[DEV_VERSION]";
-json.lineage = "[UUID]";
-json.serial = 2;
-json.plan.resources.secret_scopes.my_scope.action = "skip";
-json.plan.resources.secret_scopes.my_scope.remote_state.backend_type = "DATABRICKS";
-json.plan.resources.secret_scopes.my_scope.remote_state.name = "test-scope-[UNIQUE_NAME]-2";
-json.plan.resources.secret_scopes.my_scope.permissions.depends_on[0].node = "resources.secret_scopes.my_scope";
-json.plan.resources.secret_scopes.my_scope.permissions.depends_on[0].label = "${resources.secret_scopes.my_scope.name}";
-json.plan.resources.secret_scopes.my_scope.permissions.action = "skip";
-json.plan.resources.secret_scopes.my_scope.permissions.remote_state.scope_name = "test-scope-[UNIQUE_NAME]-2";
-json.plan.resources.secret_scopes.my_scope.permissions.remote_state.acls[0].permission = "MANAGE";
-json.plan.resources.secret_scopes.my_scope.permissions.remote_state.acls[0].principal = "[USERNAME]";
-json.plan.resources.secret_scopes.my_scope.permissions.remote_state.acls[1].permission = "WRITE";
-json.plan.resources.secret_scopes.my_scope.permissions.remote_state.acls[1].principal = "deco-test-user@databricks.com";
diff --git a/acceptance/bundle/resources/secret_scopes/basic/out.plan_verify_no_drift.terraform.txt b/acceptance/bundle/resources/secret_scopes/basic/out.plan_verify_no_drift.terraform.txt
deleted file mode 100644
index 953b4317b2e..00000000000
--- a/acceptance/bundle/resources/secret_scopes/basic/out.plan_verify_no_drift.terraform.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-json.cli_version = "[DEV_VERSION]";
-json.plan.resources.secret_scopes.my_scope.action = "skip";
-json.plan.resources.secret_scopes.my_scope.permissions.action = "skip";
diff --git a/acceptance/bundle/resources/secret_scopes/basic/out.plan_verify_no_drift.txt b/acceptance/bundle/resources/secret_scopes/basic/out.plan_verify_no_drift.txt
new file mode 100644
index 00000000000..adf81265d69
--- /dev/null
+++ b/acceptance/bundle/resources/secret_scopes/basic/out.plan_verify_no_drift.txt
@@ -0,0 +1,16 @@
+json.plan_version = [PLAN_VERSION];
+json.cli_version = "[CLI_VERSION]";
+json.lineage = "[UUID]";
+json.serial = 2;
+json.plan.resources.secret_scopes.my_scope.action = "skip";
+json.plan.resources.secret_scopes.my_scope.remote_state.name = "test-scope-[UNIQUE_NAME]-2";
+json.plan.resources.secret_scopes.my_scope.remote_state.scope = "test-scope-[UNIQUE_NAME]-2";
+json.plan.resources.secret_scopes.my_scope.remote_state.scope_backend_type = "DATABRICKS";
+json.plan.resources.secret_scopes.my_scope.permissions.depends_on[0].node = "resources.secret_scopes.my_scope";
+json.plan.resources.secret_scopes.my_scope.permissions.depends_on[0].label = "${resources.secret_scopes.my_scope.name}";
+json.plan.resources.secret_scopes.my_scope.permissions.action = "skip";
+json.plan.resources.secret_scopes.my_scope.permissions.remote_state.scope_name = "test-scope-[UNIQUE_NAME]-2";
+json.plan.resources.secret_scopes.my_scope.permissions.remote_state.acls[0].permission = "MANAGE";
+json.plan.resources.secret_scopes.my_scope.permissions.remote_state.acls[0].principal = "[USERNAME]";
+json.plan.resources.secret_scopes.my_scope.permissions.remote_state.acls[1].permission = "WRITE";
+json.plan.resources.secret_scopes.my_scope.permissions.remote_state.acls[1].principal = "deco-test-user@databricks.com";
diff --git a/acceptance/bundle/resources/secret_scopes/basic/out.recreate-requests.terraform.txt b/acceptance/bundle/resources/secret_scopes/basic/out.recreate-requests.terraform.txt
deleted file mode 100644
index efe7030cb94..00000000000
--- a/acceptance/bundle/resources/secret_scopes/basic/out.recreate-requests.terraform.txt
+++ /dev/null
@@ -1,32 +0,0 @@
-{
-  "method": "POST",
-  "path": "/api/2.0/secrets/acls/delete",
-  "body": {
-    "principal": "deco-test-user@databricks.com",
-    "scope": "test-scope-[UNIQUE_NAME]-1"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/secrets/scopes/delete",
-  "body": {
-    "scope": "test-scope-[UNIQUE_NAME]-1"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/secrets/scopes/create",
-  "body": {
-    "scope": "test-scope-[UNIQUE_NAME]-2",
-    "scope_backend_type": "DATABRICKS"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/secrets/acls/put",
-  "body": {
-    "permission": "WRITE",
-    "principal": "deco-test-user@databricks.com",
-    "scope": "test-scope-[UNIQUE_NAME]-2"
-  }
-}
diff --git a/acceptance/bundle/resources/secret_scopes/basic/out.recreate-requests.direct.txt b/acceptance/bundle/resources/secret_scopes/basic/out.recreate-requests.txt
similarity index 100%
rename from acceptance/bundle/resources/secret_scopes/basic/out.recreate-requests.direct.txt
rename to acceptance/bundle/resources/secret_scopes/basic/out.recreate-requests.txt
diff --git a/acceptance/bundle/resources/secret_scopes/basic/out.test.toml b/acceptance/bundle/resources/secret_scopes/basic/out.test.toml
index bbc7fcfd1bd..0f167effef1 100644
--- a/acceptance/bundle/resources/secret_scopes/basic/out.test.toml
+++ b/acceptance/bundle/resources/secret_scopes/basic/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/secret_scopes/basic/output.txt b/acceptance/bundle/resources/secret_scopes/basic/output.txt
index 9b6f7f340a5..c432f2996de 100644
--- a/acceptance/bundle/resources/secret_scopes/basic/output.txt
+++ b/acceptance/bundle/resources/secret_scopes/basic/output.txt
@@ -2,11 +2,7 @@
 === create the secret scope
 >>> [CLI] bundle plan -o json
 
->>> [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/secret-scope-basic-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+>>> [CLI] bundle deploy -qq
 
 >>> [CLI] secrets list-scopes -o json
 {
@@ -58,11 +54,7 @@ Deployment complete!
 === update the name of the scope (should recreate)
 >>> [CLI] bundle plan -o json
 
->>> [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/secret-scope-basic-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+>>> [CLI] bundle deploy -qq
 
 >>> print_requests.py //secrets
 
@@ -105,5 +97,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/secret-scope-basic-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/secret_scopes/basic/script b/acceptance/bundle/resources/secret_scopes/basic/script
index ad967e1ba27..e034e35a34d 100755
--- a/acceptance/bundle/resources/secret_scopes/basic/script
+++ b/acceptance/bundle/resources/secret_scopes/basic/script
@@ -4,13 +4,13 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm out.requests.txt
+    rm "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
 title "create the secret scope"
-trace $CLI bundle plan -o json | gron.py --sort-arrays acls > out.plan1.$DATABRICKS_BUNDLE_ENGINE.txt
-trace $CLI bundle deploy
+trace $CLI bundle plan -o json | nostamp | gron.py --sort-arrays acls > out.plan1.txt
+trace $CLI bundle deploy -qq
 
 scope_name=$($CLI bundle summary --output json | jq -r '.resources.secret_scopes.my_scope.name')
 trace $CLI secrets list-scopes -o json | jq ".[] | select(.name == \"$scope_name\")"
@@ -26,11 +26,11 @@ title "update the name of the scope (should recreate)"
 export SECRET_SCOPE_NAME="test-scope-$UNIQUE_NAME-2"
 envsubst < databricks.yml.tmpl > databricks.yml
 
-trace $CLI bundle plan -o json | gron.py --sort-arrays acls > out.plan2.$DATABRICKS_BUNDLE_ENGINE.txt
-trace $CLI bundle deploy
+trace $CLI bundle plan -o json | nostamp | gron.py --sort-arrays acls > out.plan2.txt
+trace $CLI bundle deploy -qq
 
 # Capture API requests for verification. Terraform cleans up ACLs before deleting the scope, but direct does not, hence the difference in requests.
-trace print_requests.py //secrets > out.recreate-requests.$DATABRICKS_BUNDLE_ENGINE.txt
+trace print_requests.py //secrets > out.recreate-requests.txt
 
 scope_name=$($CLI bundle summary --output json | jq -r '.resources.secret_scopes.my_scope.name')
 trace $CLI secrets list-scopes -o json | jq ".[] | select(.name == \"$scope_name\")"
@@ -43,4 +43,4 @@ trace $CLI secrets list-acls $scope_name | jq -c '.[]' | sort
 trace print_requests.py //secrets
 
 title "verify there's no persistent drift"
-trace $CLI bundle plan -o json | gron.py --sort-arrays acls > out.plan_verify_no_drift.$DATABRICKS_BUNDLE_ENGINE.txt
+trace $CLI bundle plan -o json | nostamp | gron.py --sort-arrays acls > out.plan_verify_no_drift.txt
diff --git a/acceptance/bundle/resources/secret_scopes/basic/test.toml b/acceptance/bundle/resources/secret_scopes/basic/test.toml
index d76cbba0680..9ec920789a2 100644
--- a/acceptance/bundle/resources/secret_scopes/basic/test.toml
+++ b/acceptance/bundle/resources/secret_scopes/basic/test.toml
@@ -1,4 +1,3 @@
 Cloud = true
-Local = true
 RecordRequests = true
 IsServicePrincipal = true
diff --git a/acceptance/bundle/resources/secret_scopes/delete_scope/out.deploy.requests.txt b/acceptance/bundle/resources/secret_scopes/delete_scope/out.deploy.requests.txt
index 2d469e4abce..1943374afeb 100644
--- a/acceptance/bundle/resources/secret_scopes/delete_scope/out.deploy.requests.txt
+++ b/acceptance/bundle/resources/secret_scopes/delete_scope/out.deploy.requests.txt
@@ -1,5 +1,5 @@
 
->>> print_requests.py ^//import-file/ ^//workspace/ ^//telemetry-ext
+>>> print_requests.py ^//api/2.0/bundle ^//workspace/ ^//telemetry-ext
 {
   "method": "POST",
   "path": "/api/2.0/secrets/scopes/delete",
diff --git a/acceptance/bundle/resources/secret_scopes/delete_scope/out.plan.direct.txt b/acceptance/bundle/resources/secret_scopes/delete_scope/out.plan.direct.txt
deleted file mode 100644
index 6270ea89c0b..00000000000
--- a/acceptance/bundle/resources/secret_scopes/delete_scope/out.plan.direct.txt
+++ /dev/null
@@ -1,6 +0,0 @@
-
->>> [CLI] bundle plan
-delete secret_scopes.second
-delete secret_scopes.second.permissions
-
-Plan: 0 to add, 0 to change, 2 to delete, 2 unchanged
diff --git a/acceptance/bundle/resources/secret_scopes/delete_scope/out.plan.terraform.txt b/acceptance/bundle/resources/secret_scopes/delete_scope/out.plan.terraform.txt
deleted file mode 100644
index 1307df4e1a6..00000000000
--- a/acceptance/bundle/resources/secret_scopes/delete_scope/out.plan.terraform.txt
+++ /dev/null
@@ -1,6 +0,0 @@
-
->>> [CLI] bundle plan
-delete secret_scopes.second
-delete secret_scopes.second.permissions
-
-Plan: 0 to add, 0 to change, 2 to delete, 1 unchanged
diff --git a/acceptance/bundle/resources/secret_scopes/delete_scope/out.plan.txt b/acceptance/bundle/resources/secret_scopes/delete_scope/out.plan.txt
new file mode 100644
index 00000000000..be33e1f2267
--- /dev/null
+++ b/acceptance/bundle/resources/secret_scopes/delete_scope/out.plan.txt
@@ -0,0 +1,5 @@
+
+>>> [CLI] bundle plan
+delete secret_scopes.second
+
+Plan: 0 to add, 0 to change, 1 to delete, 2 unchanged
diff --git a/acceptance/bundle/resources/secret_scopes/delete_scope/out.test.toml b/acceptance/bundle/resources/secret_scopes/delete_scope/out.test.toml
index bbc7fcfd1bd..0f167effef1 100644
--- a/acceptance/bundle/resources/secret_scopes/delete_scope/out.test.toml
+++ b/acceptance/bundle/resources/secret_scopes/delete_scope/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/secret_scopes/delete_scope/output.txt b/acceptance/bundle/resources/secret_scopes/delete_scope/output.txt
index 18025f0a0fd..8540e39661a 100644
--- a/acceptance/bundle/resources/secret_scopes/delete_scope/output.txt
+++ b/acceptance/bundle/resources/secret_scopes/delete_scope/output.txt
@@ -1,16 +1,8 @@
 
 === create the secret scope
->>> [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/secret-scope-basic-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+>>> [CLI] bundle deploy -qq
 
->>> [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/secret-scope-basic-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+>>> [CLI] bundle deploy -qq
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
@@ -18,5 +10,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/secret-scope-basic-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/secret_scopes/delete_scope/script b/acceptance/bundle/resources/secret_scopes/delete_scope/script
index b12e98775a3..8d04d13a33f 100755
--- a/acceptance/bundle/resources/secret_scopes/delete_scope/script
+++ b/acceptance/bundle/resources/secret_scopes/delete_scope/script
@@ -2,17 +2,17 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm out.requests.txt
+    rm "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
 title "create the secret scope"
-trace $CLI bundle deploy
+trace $CLI bundle deploy -qq
 
 grep -v DELETE < databricks.yml > databricks.yml.tmp && mv databricks.yml.tmp databricks.yml
 
-trace $CLI bundle plan &> out.plan.$DATABRICKS_BUNDLE_ENGINE.txt
-rm out.requests.txt
+trace $CLI bundle plan &> out.plan.txt
+rm "$OUT_REQUESTS"
 
-trace $CLI bundle deploy
-trace print_requests.py '^//import-file/' '^//workspace/' '^//telemetry-ext' &> out.deploy.requests.txt
+trace $CLI bundle deploy -qq
+trace print_requests.py '^//api/2.0/bundle' '^//workspace/' '^//telemetry-ext' &> out.deploy.requests.txt
diff --git a/acceptance/bundle/resources/secret_scopes/delete_scope/test.toml b/acceptance/bundle/resources/secret_scopes/delete_scope/test.toml
index 3730eb79df4..ff9f96e2553 100644
--- a/acceptance/bundle/resources/secret_scopes/delete_scope/test.toml
+++ b/acceptance/bundle/resources/secret_scopes/delete_scope/test.toml
@@ -1,3 +1,2 @@
 Cloud = true
-Local = true
 RecordRequests = true
diff --git a/acceptance/bundle/resources/secret_scopes/deleted_remotely/databricks.yml b/acceptance/bundle/resources/secret_scopes/deleted_remotely/databricks.yml
new file mode 100644
index 00000000000..7037926e3dc
--- /dev/null
+++ b/acceptance/bundle/resources/secret_scopes/deleted_remotely/databricks.yml
@@ -0,0 +1,8 @@
+bundle:
+  name: test-bundle
+
+resources:
+  secret_scopes:
+    my_scope:
+      name: test-scope
+      backend_type: "DATABRICKS"
diff --git a/acceptance/bundle/resources/secret_scopes/deleted_remotely/out.test.toml b/acceptance/bundle/resources/secret_scopes/deleted_remotely/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/secret_scopes/deleted_remotely/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/secret_scopes/deleted_remotely/output.txt b/acceptance/bundle/resources/secret_scopes/deleted_remotely/output.txt
new file mode 100644
index 00000000000..07ff6eaf942
--- /dev/null
+++ b/acceptance/bundle/resources/secret_scopes/deleted_remotely/output.txt
@@ -0,0 +1,26 @@
+
+>>> [CLI] bundle deploy -qq
+
+=== delete the scope outside of the bundle
+>>> [CLI] secrets delete-scope test-scope
+
+=== plan should recreate the scope
+>>> [CLI] bundle plan
+create secret_scopes.my_scope
+create secret_scopes.my_scope.permissions
+
+Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
+
+=== deploy should recreate the scope
+>>> [CLI] bundle deploy -qq
+
+>>> [CLI] secrets list-scopes -o json
+test-scope
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.secret_scopes.my_scope
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/secret_scopes/deleted_remotely/script b/acceptance/bundle/resources/secret_scopes/deleted_remotely/script
new file mode 100644
index 00000000000..81af4f0b1a8
--- /dev/null
+++ b/acceptance/bundle/resources/secret_scopes/deleted_remotely/script
@@ -0,0 +1,16 @@
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+trace $CLI bundle deploy -qq
+
+title "delete the scope outside of the bundle"
+trace $CLI secrets delete-scope test-scope
+
+title "plan should recreate the scope"
+trace $CLI bundle plan
+
+title "deploy should recreate the scope"
+trace $CLI bundle deploy -qq
+trace $CLI secrets list-scopes -o json | jq -r '.[].name'
diff --git a/acceptance/bundle/resources/secret_scopes/deleted_remotely/test.toml b/acceptance/bundle/resources/secret_scopes/deleted_remotely/test.toml
new file mode 100644
index 00000000000..3ae6cbce741
--- /dev/null
+++ b/acceptance/bundle/resources/secret_scopes/deleted_remotely/test.toml
@@ -0,0 +1,2 @@
+RecordRequests = false
+Env.DATABRICKS_BUNDLE_ENGINE = "direct"
diff --git a/acceptance/bundle/resources/secret_scopes/permissions-collapse/out.plan.direct.txt b/acceptance/bundle/resources/secret_scopes/permissions-collapse/out.plan.txt
similarity index 100%
rename from acceptance/bundle/resources/secret_scopes/permissions-collapse/out.plan.direct.txt
rename to acceptance/bundle/resources/secret_scopes/permissions-collapse/out.plan.txt
diff --git a/acceptance/bundle/resources/secret_scopes/permissions-collapse/out.test.toml b/acceptance/bundle/resources/secret_scopes/permissions-collapse/out.test.toml
index 6fc644d5164..67a16a8bcf3 100644
--- a/acceptance/bundle/resources/secret_scopes/permissions-collapse/out.test.toml
+++ b/acceptance/bundle/resources/secret_scopes/permissions-collapse/out.test.toml
@@ -1,5 +1,4 @@
-Local = true
 Cloud = true
 RunsOnDbr = true
 CloudEnvs.gcp = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/secret_scopes/permissions-collapse/output.txt b/acceptance/bundle/resources/secret_scopes/permissions-collapse/output.txt
index b487f27076f..a26b36f3e3d 100644
--- a/acceptance/bundle/resources/secret_scopes/permissions-collapse/output.txt
+++ b/acceptance/bundle/resources/secret_scopes/permissions-collapse/output.txt
@@ -4,9 +4,10 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/secret-scope-collapse-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created secret_scopes.my_scope
+Created secret_scopes.my_scope.permissions
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] secrets list-scopes -o json
 {
@@ -26,5 +27,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/secret-scope-collapse-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/secret_scopes/permissions-collapse/script b/acceptance/bundle/resources/secret_scopes/permissions-collapse/script
index 6c2b4366c35..1b0040a2cbb 100755
--- a/acceptance/bundle/resources/secret_scopes/permissions-collapse/script
+++ b/acceptance/bundle/resources/secret_scopes/permissions-collapse/script
@@ -8,7 +8,7 @@ cleanup() {
 trap cleanup EXIT
 
 title "create secret scope with duplicate permissions"
-trace $CLI bundle plan > out.plan.$DATABRICKS_BUNDLE_ENGINE.txt
+trace $CLI bundle plan > out.plan.txt
 trace $CLI bundle deploy
 
 scope_name=$($CLI bundle summary --output json | jq -r '.resources.secret_scopes.my_scope.name')
diff --git a/acceptance/bundle/resources/secret_scopes/permissions-collapse/test.toml b/acceptance/bundle/resources/secret_scopes/permissions-collapse/test.toml
index 1574268725f..d927cd90be4 100644
--- a/acceptance/bundle/resources/secret_scopes/permissions-collapse/test.toml
+++ b/acceptance/bundle/resources/secret_scopes/permissions-collapse/test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 RecordRequests = false
 RunsOnDbr = true
@@ -6,6 +5,3 @@ IsServicePrincipal = true
 
 # The current user on GCP is not a service principal. This causes diverging output since we set permissions for the current user. Thus we skip this test on GCP.
 CloudEnvs.gcp = false
-
-[EnvMatrix]
-  DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/resources/secret_scopes/permissions/out.plan.recreate.terraform.txt b/acceptance/bundle/resources/secret_scopes/permissions/out.plan.recreate.terraform.txt
deleted file mode 100644
index 6126244cbe3..00000000000
--- a/acceptance/bundle/resources/secret_scopes/permissions/out.plan.recreate.terraform.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-recreate secret_scopes.my_scope
-recreate secret_scopes.my_scope.permissions
-
-Plan: 2 to add, 0 to change, 2 to delete, 0 unchanged
diff --git a/acceptance/bundle/resources/secret_scopes/permissions/out.plan.recreate.direct.txt b/acceptance/bundle/resources/secret_scopes/permissions/out.plan.recreate.txt
similarity index 100%
rename from acceptance/bundle/resources/secret_scopes/permissions/out.plan.recreate.direct.txt
rename to acceptance/bundle/resources/secret_scopes/permissions/out.plan.recreate.txt
diff --git a/acceptance/bundle/resources/secret_scopes/permissions/out.test.toml b/acceptance/bundle/resources/secret_scopes/permissions/out.test.toml
index 6b858c4df47..67a16a8bcf3 100644
--- a/acceptance/bundle/resources/secret_scopes/permissions/out.test.toml
+++ b/acceptance/bundle/resources/secret_scopes/permissions/out.test.toml
@@ -1,5 +1,4 @@
-Local = true
 Cloud = true
 RunsOnDbr = true
 CloudEnvs.gcp = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/secret_scopes/permissions/output.txt b/acceptance/bundle/resources/secret_scopes/permissions/output.txt
index 8ea0a7cfe8e..998becfd22f 100644
--- a/acceptance/bundle/resources/secret_scopes/permissions/output.txt
+++ b/acceptance/bundle/resources/secret_scopes/permissions/output.txt
@@ -5,11 +5,7 @@
 === create secret scope with permissions
 >>> [CLI] bundle plan
 
->>> [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/secret-scope-permissions-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+>>> [CLI] bundle deploy -qq
 
 >>> [CLI] secrets list-scopes -o json
 {
@@ -26,11 +22,7 @@ Deployment complete!
 === update permissions (remove sp, change permission for user, add users and remove deco-test-group)
 >>> [CLI] bundle plan
 
->>> [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/secret-scope-permissions-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+>>> [CLI] bundle deploy -qq
 
 >>> [CLI] secrets list-acls test-scope-permissions-[UNIQUE_NAME]
 {"permission":"MANAGE","principal":"[USERNAME]"}
@@ -40,11 +32,7 @@ Deployment complete!
 === change scope name (should recreate scope and update permissions)
 >>> [CLI] bundle plan
 
->>> [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/secret-scope-permissions-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+>>> [CLI] bundle deploy -qq
 
 >>> [CLI] secrets list-scopes -o json
 {
@@ -63,5 +51,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/secret-scope-permissions-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/secret_scopes/permissions/script b/acceptance/bundle/resources/secret_scopes/permissions/script
index 2b866baa75b..8f8b8308d24 100755
--- a/acceptance/bundle/resources/secret_scopes/permissions/script
+++ b/acceptance/bundle/resources/secret_scopes/permissions/script
@@ -2,7 +2,7 @@ if [ -z "$CLOUD_ENV" ]; then
     export TEST_SP_APPLICATION_ID="22222222-2222-2222-2222-222222222222"
 fi
 
-echo "$TEST_SP_APPLICATION_ID:TEST_SP_APPLICATION_ID" >> ACC_REPLS
+add_repl "$TEST_SP_APPLICATION_ID" TEST_SP_APPLICATION_ID
 
 export SECRET_SCOPE_NAME="test-scope-permissions-$UNIQUE_NAME"
 
@@ -37,7 +37,7 @@ trap cleanup EXIT
 
 title "create secret scope with permissions"
 trace $CLI bundle plan > out.plan.create.txt
-trace $CLI bundle deploy
+trace $CLI bundle deploy -qq
 scope_name=$($CLI bundle summary --output json | jq -r '.resources.secret_scopes.my_scope.name')
 
 trace $CLI secrets list-scopes -o json | jq ".[] | select(.name == \"$scope_name\")"
@@ -61,14 +61,14 @@ resources:
 EOF
 envsubst < databricks.yml.tmpl > databricks.yml
 trace $CLI bundle plan > out.plan.update.txt
-trace $CLI bundle deploy
+trace $CLI bundle deploy -qq
 trace $CLI secrets list-acls $scope_name | jq -c '.[]' | sort
 
 title "change scope name (should recreate scope and update permissions)"
 export SECRET_SCOPE_NAME="test-scope-permissions-$UNIQUE_NAME-2"
 envsubst < databricks.yml.tmpl > databricks.yml
-trace $CLI bundle plan > out.plan.recreate.$DATABRICKS_BUNDLE_ENGINE.txt
-trace $CLI bundle deploy
+trace $CLI bundle plan > out.plan.recreate.txt
+trace $CLI bundle deploy -qq
 scope_name=$($CLI bundle summary --output json | jq -r '.resources.secret_scopes.my_scope.name')
 trace $CLI secrets list-scopes -o json | jq ".[] | select(.name == \"$scope_name\")"
 trace $CLI secrets list-acls $scope_name | jq -c '.[]' | sort
diff --git a/acceptance/bundle/resources/secret_scopes/permissions/test.toml b/acceptance/bundle/resources/secret_scopes/permissions/test.toml
index 1e9000d21e1..bd233304f24 100644
--- a/acceptance/bundle/resources/secret_scopes/permissions/test.toml
+++ b/acceptance/bundle/resources/secret_scopes/permissions/test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 RecordRequests = false
 RunsOnDbr = true
diff --git a/acceptance/bundle/resources/secrets/basic/databricks.yml.tmpl b/acceptance/bundle/resources/secrets/basic/databricks.yml.tmpl
new file mode 100644
index 00000000000..16d033b6042
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/basic/databricks.yml.tmpl
@@ -0,0 +1,15 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+variables:
+  secret_value:
+    description: "Test secret value"
+
+resources:
+  secrets:
+    secret1:
+      catalog_name: main
+      schema_name: default
+      name: test_secret_${UNIQUE_NAME}
+      value: ${var.secret_value}
+      comment: "Test secret for acceptance testing"
diff --git a/acceptance/bundle/resources/secrets/basic/out.test.toml b/acceptance/bundle/resources/secrets/basic/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/basic/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/secrets/basic/output.txt b/acceptance/bundle/resources/secrets/basic/output.txt
new file mode 100644
index 00000000000..a01530e1b66
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/basic/output.txt
@@ -0,0 +1,113 @@
+
+>>> [CLI] bundle validate --var secret_value=initial-secret-value -o json
+
+>>> cat validate.json
+{
+  "secret1": {
+    "catalog_name": "main",
+    "comment": "Test secret for acceptance testing",
+    "name": "test_secret_[UNIQUE_NAME]",
+    "schema_name": "default",
+    "value": "[redacted]"
+  }
+}
+
+>>> cat validate.json
+{
+  "secret_value": {
+    "description": "Test secret value",
+    "value": "[redacted]"
+  }
+}
+
+>>> [CLI] bundle summary --var secret_value=initial-secret-value
+Name: test-bundle-[UNIQUE_NAME]
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
+Resources:
+  Secrets:
+    secret1:
+      Name: main.default.test_secret_[UNIQUE_NAME]
+      URL:  (not deployed)
+
+>>> [CLI] bundle deploy --var secret_value=initial-secret-value
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Created secrets.secret1
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //unity-catalog
+{
+  "method": "POST",
+  "path": "/api/2.1/unity-catalog/secrets",
+  "body": {
+    "catalog_name": "main",
+    "comment": "Test secret for acceptance testing",
+    "name": "test_secret_[UNIQUE_NAME]",
+    "schema_name": "default",
+    "value": "initial-secret-value"
+  }
+}
+secrets secret1 catalog_name='main' schema_name='default' name='test_secret_[UNIQUE_NAME]' comment='Test secret for acceptance testing' value='' effective_value=None
+
+=== Update comment and re-deploy
+>>> update_file.py databricks.yml Test secret for acceptance testing Updated comment
+
+>>> [CLI] bundle deploy --var secret_value=initial-secret-value
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Updated secrets.secret1
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //unity-catalog
+{
+  "method": "PATCH",
+  "path": "/api/2.1/unity-catalog/secrets/main.default.test_secret_[UNIQUE_NAME]",
+  "q": {
+    "update_mask": "*"
+  },
+  "body": {
+    "catalog_name": "main",
+    "comment": "Updated comment",
+    "name": "test_secret_[UNIQUE_NAME]",
+    "schema_name": "default",
+    "value": "initial-secret-value"
+  }
+}
+secrets secret1 catalog_name='main' schema_name='default' name='test_secret_[UNIQUE_NAME]' comment='Updated comment' value='' effective_value=None
+
+=== Restore comment and re-deploy
+>>> update_file.py databricks.yml Updated comment Test secret for acceptance testing
+
+>>> [CLI] bundle deploy --var secret_value=initial-secret-value
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Updated secrets.secret1
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //unity-catalog
+{
+  "method": "PATCH",
+  "path": "/api/2.1/unity-catalog/secrets/main.default.test_secret_[UNIQUE_NAME]",
+  "q": {
+    "update_mask": "*"
+  },
+  "body": {
+    "catalog_name": "main",
+    "comment": "Test secret for acceptance testing",
+    "name": "test_secret_[UNIQUE_NAME]",
+    "schema_name": "default",
+    "value": "initial-secret-value"
+  }
+}
+secrets secret1 catalog_name='main' schema_name='default' name='test_secret_[UNIQUE_NAME]' comment='Test secret for acceptance testing' value='' effective_value=None
+
+>>> [CLI] bundle destroy --auto-approve --var secret_value=initial-secret-value
+The following resources will be deleted:
+  delete resources.secrets.secret1
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/secrets/basic/script b/acceptance/bundle/resources/secrets/basic/script
new file mode 100755
index 00000000000..f3e21135353
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/basic/script
@@ -0,0 +1,32 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve --var secret_value=initial-secret-value
+    rm "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+trace $CLI bundle validate --var secret_value=initial-secret-value -o json > validate.json
+trace cat validate.json | jq -r ".resources.secrets"
+trace cat validate.json | jq -r ".variables"
+rm validate.json
+
+trace $CLI bundle summary --var secret_value=initial-secret-value
+trace $CLI bundle deploy --var secret_value=initial-secret-value
+
+trace print_requests.py //unity-catalog
+read_state.py secrets secret1 catalog_name schema_name name comment value effective_value
+
+title "Update comment and re-deploy"
+trace update_file.py databricks.yml "Test secret for acceptance testing" "Updated comment"
+trace $CLI bundle deploy --var secret_value=initial-secret-value
+trace print_requests.py //unity-catalog
+read_state.py secrets secret1 catalog_name schema_name name comment value effective_value
+
+title "Restore comment and re-deploy"
+trace update_file.py databricks.yml "Updated comment" "Test secret for acceptance testing"
+trace $CLI bundle deploy --var secret_value=initial-secret-value
+trace print_requests.py //unity-catalog
+read_state.py secrets secret1 catalog_name schema_name name comment value effective_value
+
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/resources/secrets/basic/test.toml b/acceptance/bundle/resources/secrets/basic/test.toml
new file mode 100644
index 00000000000..48fe22b99ac
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/basic/test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+RecordRequests = true
+
+Ignore = [".databricks"]
diff --git a/acceptance/bundle/resources/secrets/remove-expire-time/databricks.yml.tmpl b/acceptance/bundle/resources/secrets/remove-expire-time/databricks.yml.tmpl
new file mode 100644
index 00000000000..094a9de6a89
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/remove-expire-time/databricks.yml.tmpl
@@ -0,0 +1,15 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+variables:
+  secret_value:
+    description: "Test secret value"
+
+resources:
+  secrets:
+    secret1:
+      catalog_name: main
+      schema_name: default
+      name: test_secret_${UNIQUE_NAME}
+      value: ${var.secret_value}
+      expire_time: "2030-01-01T00:00:00Z"
diff --git a/acceptance/bundle/resources/secrets/remove-expire-time/out.plan.drift.json b/acceptance/bundle/resources/secrets/remove-expire-time/out.plan.drift.json
new file mode 100644
index 00000000000..c42ccac5651
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/remove-expire-time/out.plan.drift.json
@@ -0,0 +1,21 @@
+{
+  "action": "update",
+  "changes": {
+    "expire_time": {
+      "action": "update",
+      "remote": "[EXPIRE_TIME_BEFORE]"
+    },
+    "owner": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "remote": "[USERNAME]"
+    },
+    "value": {
+      "action": "skip",
+      "reason": "custom",
+      "old": "",
+      "new": "[redacted]",
+      "remote": "[redacted]"
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/secrets/remove-expire-time/out.plan.json b/acceptance/bundle/resources/secrets/remove-expire-time/out.plan.json
new file mode 100644
index 00000000000..a3722f74ae4
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/remove-expire-time/out.plan.json
@@ -0,0 +1,22 @@
+{
+  "action": "update",
+  "changes": {
+    "expire_time": {
+      "action": "update",
+      "old": "[EXPIRE_TIME_BEFORE]",
+      "remote": "[EXPIRE_TIME_BEFORE]"
+    },
+    "owner": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "remote": "[USERNAME]"
+    },
+    "value": {
+      "action": "skip",
+      "reason": "custom",
+      "old": "",
+      "new": "[redacted]",
+      "remote": "[redacted]"
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/secrets/remove-expire-time/out.test.toml b/acceptance/bundle/resources/secrets/remove-expire-time/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/remove-expire-time/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/secrets/remove-expire-time/output.txt b/acceptance/bundle/resources/secrets/remove-expire-time/output.txt
new file mode 100644
index 00000000000..7807d0f3646
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/remove-expire-time/output.txt
@@ -0,0 +1,69 @@
+
+>>> [CLI] bundle deploy --var secret_value=secret-value
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Created secrets.secret1
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //unity-catalog
+{
+  "method": "POST",
+  "path": "/api/2.1/unity-catalog/secrets",
+  "body": {
+    "catalog_name": "main",
+    "expire_time": "[EXPIRE_TIME_BEFORE]",
+    "name": "test_secret_[UNIQUE_NAME]",
+    "schema_name": "default",
+    "value": "secret-value"
+  }
+}
+secrets secret1 name='test_secret_[UNIQUE_NAME]' expire_time='[EXPIRE_TIME_BEFORE]'
+
+=== Remove expire_time and re-deploy
+>>> update_file.py databricks.yml       expire_time: "[EXPIRE_TIME_BEFORE]" 
+
+>>> [CLI] bundle plan --var secret_value=secret-value
+update secrets.secret1
+
+Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
+
+>>> [CLI] bundle plan --var secret_value=secret-value -o json
+
+>>> [CLI] bundle deploy --var secret_value=secret-value
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Updated secrets.secret1
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //unity-catalog
+{
+  "method": "PATCH",
+  "path": "/api/2.1/unity-catalog/secrets/main.default.test_secret_[UNIQUE_NAME]",
+  "q": {
+    "update_mask": "*"
+  },
+  "body": {
+    "catalog_name": "main",
+    "comment": "",
+    "name": "test_secret_[UNIQUE_NAME]",
+    "schema_name": "default",
+    "value": "secret-value"
+  }
+}
+secrets secret1 name='test_secret_[UNIQUE_NAME]' expire_time=None
+
+=== Plan again to record any drift the removal leaves behind
+>>> [CLI] bundle plan --var secret_value=secret-value
+update secrets.secret1
+
+Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
+
+>>> [CLI] bundle plan --var secret_value=secret-value -o json
+
+>>> [CLI] bundle destroy --auto-approve --var secret_value=initial-secret-value
+The following resources will be deleted:
+  delete resources.secrets.secret1
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/secrets/remove-expire-time/script b/acceptance/bundle/resources/secrets/remove-expire-time/script
new file mode 100644
index 00000000000..f2b45353654
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/remove-expire-time/script
@@ -0,0 +1,28 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve --var secret_value=initial-secret-value
+    rm "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+trace $CLI bundle deploy --var secret_value=secret-value
+trace print_requests.py //unity-catalog
+read_state.py secrets secret1 name expire_time
+
+title "Remove expire_time and re-deploy"
+trace update_file.py databricks.yml '      expire_time: "2030-01-01T00:00:00Z"' ""
+trace $CLI bundle plan --var secret_value=secret-value
+# Project to expire_time (the field this test is about): the full changes set now carries
+# output-only fields whose remote values differ between the testserver and a real workspace
+# (metastore_id, comment, timestamps), which is noise here and breaks the Cloud run.
+trace $CLI bundle plan --var secret_value=secret-value -o json | nostamp | jq '.plan."resources.secrets.secret1" | {action, changes: (.changes | {expire_time, owner, value})}' > out.plan.json
+trace $CLI bundle deploy --var secret_value=secret-value
+trace print_requests.py //unity-catalog
+read_state.py secrets secret1 name expire_time
+
+title "Plan again to record any drift the removal leaves behind"
+trace $CLI bundle plan --var secret_value=secret-value
+trace $CLI bundle plan --var secret_value=secret-value -o json | nostamp | jq '.plan."resources.secrets.secret1" | {action, changes: (.changes | {expire_time, owner, value})}' > out.plan.drift.json
+
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/resources/secrets/remove-expire-time/test.toml b/acceptance/bundle/resources/secrets/remove-expire-time/test.toml
new file mode 100644
index 00000000000..bd0b28fcf6a
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/remove-expire-time/test.toml
@@ -0,0 +1,24 @@
+RecordRequests = true
+
+Ignore = [".databricks", ".gitignore"]
+
+# Secrets are only implemented in the direct engine.
+
+# secrets/basic runs on cloud, so the expire_time semantics here are verified
+# against a real workspace too.
+Cloud = true
+
+# Removing expire_time does not take effect: the engine masks the whole secret with
+# update_mask=* and omits the field, and the API keeps the previous value (verified
+# against a real workspace on 2026-08-25). Unlike the postgres project case the
+# difference is at least visible, because the secret GET echoes expire_time, so every
+# later plan asks for the removal again. out.plan.drift.direct.json records that.
+Badness = "Removing expire_time never takes effect: the API keeps the previous value, so deploy reports success and every later plan asks for the removal again"
+
+# The root test.toml collapses every timestamp to [TIMESTAMP], which would hide the
+# value this test removes. Label it distinctly instead; Order below the root rule's
+# 10 makes this win.
+[[Repls]]
+Old = '2030-01-01T00:00:00Z'
+New = '[EXPIRE_TIME_BEFORE]'
+Order = 1
diff --git a/acceptance/bundle/resources/secrets/update-expire-time/databricks.yml.tmpl b/acceptance/bundle/resources/secrets/update-expire-time/databricks.yml.tmpl
new file mode 100644
index 00000000000..094a9de6a89
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/update-expire-time/databricks.yml.tmpl
@@ -0,0 +1,15 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+variables:
+  secret_value:
+    description: "Test secret value"
+
+resources:
+  secrets:
+    secret1:
+      catalog_name: main
+      schema_name: default
+      name: test_secret_${UNIQUE_NAME}
+      value: ${var.secret_value}
+      expire_time: "2030-01-01T00:00:00Z"
diff --git a/acceptance/bundle/resources/secrets/update-expire-time/out.plan.json b/acceptance/bundle/resources/secrets/update-expire-time/out.plan.json
new file mode 100644
index 00000000000..2da131f5384
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/update-expire-time/out.plan.json
@@ -0,0 +1,23 @@
+{
+  "action": "update",
+  "changes": {
+    "expire_time": {
+      "action": "update",
+      "old": "[EXPIRE_TIME_BEFORE]",
+      "new": "[EXPIRE_TIME_AFTER]",
+      "remote": "[EXPIRE_TIME_BEFORE]"
+    },
+    "owner": {
+      "action": "skip",
+      "reason": "spec:input_only",
+      "remote": "[USERNAME]"
+    },
+    "value": {
+      "action": "skip",
+      "reason": "custom",
+      "old": "",
+      "new": "[redacted]",
+      "remote": "[redacted]"
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/secrets/update-expire-time/out.test.toml b/acceptance/bundle/resources/secrets/update-expire-time/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/update-expire-time/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/secrets/update-expire-time/output.txt b/acceptance/bundle/resources/secrets/update-expire-time/output.txt
new file mode 100644
index 00000000000..b852342db4f
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/update-expire-time/output.txt
@@ -0,0 +1,62 @@
+
+>>> [CLI] bundle deploy --var secret_value=secret-value
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Created secrets.secret1
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //unity-catalog
+{
+  "method": "POST",
+  "path": "/api/2.1/unity-catalog/secrets",
+  "body": {
+    "catalog_name": "main",
+    "expire_time": "[EXPIRE_TIME_BEFORE]",
+    "name": "test_secret_[UNIQUE_NAME]",
+    "schema_name": "default",
+    "value": "secret-value"
+  }
+}
+secrets secret1 name='test_secret_[UNIQUE_NAME]' expire_time='[EXPIRE_TIME_BEFORE]'
+
+=== Change expire_time and re-deploy
+>>> update_file.py databricks.yml [EXPIRE_TIME_BEFORE] [EXPIRE_TIME_AFTER]
+
+>>> [CLI] bundle plan --var secret_value=secret-value
+update secrets.secret1
+
+Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
+
+>>> [CLI] bundle plan --var secret_value=secret-value -o json
+
+>>> [CLI] bundle deploy --var secret_value=secret-value
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Updated secrets.secret1
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //unity-catalog
+{
+  "method": "PATCH",
+  "path": "/api/2.1/unity-catalog/secrets/main.default.test_secret_[UNIQUE_NAME]",
+  "q": {
+    "update_mask": "*"
+  },
+  "body": {
+    "catalog_name": "main",
+    "comment": "",
+    "expire_time": "[EXPIRE_TIME_AFTER]",
+    "name": "test_secret_[UNIQUE_NAME]",
+    "schema_name": "default",
+    "value": "secret-value"
+  }
+}
+secrets secret1 name='test_secret_[UNIQUE_NAME]' expire_time='[EXPIRE_TIME_AFTER]'
+
+>>> [CLI] bundle destroy --auto-approve --var secret_value=initial-secret-value
+The following resources will be deleted:
+  delete resources.secrets.secret1
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/secrets/update-expire-time/script b/acceptance/bundle/resources/secrets/update-expire-time/script
new file mode 100644
index 00000000000..daa9bfc1c6e
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/update-expire-time/script
@@ -0,0 +1,24 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve --var secret_value=initial-secret-value
+    rm "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+trace $CLI bundle deploy --var secret_value=secret-value
+trace print_requests.py //unity-catalog
+read_state.py secrets secret1 name expire_time
+
+title "Change expire_time and re-deploy"
+trace update_file.py databricks.yml "2030-01-01T00:00:00Z" "2031-06-15T12:00:00Z"
+trace $CLI bundle plan --var secret_value=secret-value
+# Project to expire_time (the field this test is about): the full changes set now carries
+# output-only fields whose remote values differ between the testserver and a real workspace
+# (metastore_id, comment, timestamps), which is noise here and breaks the Cloud run.
+trace $CLI bundle plan --var secret_value=secret-value -o json | nostamp | jq '.plan."resources.secrets.secret1" | {action, changes: (.changes | {expire_time, owner, value})}' > out.plan.json
+trace $CLI bundle deploy --var secret_value=secret-value
+trace print_requests.py //unity-catalog
+read_state.py secrets secret1 name expire_time
+
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/resources/secrets/update-expire-time/test.toml b/acceptance/bundle/resources/secrets/update-expire-time/test.toml
new file mode 100644
index 00000000000..4e6b4e8964e
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/update-expire-time/test.toml
@@ -0,0 +1,22 @@
+RecordRequests = true
+
+Ignore = [".databricks", ".gitignore"]
+
+# Secrets are only implemented in the direct engine.
+
+# secrets/basic runs on cloud, so the expire_time semantics here are verified
+# against a real workspace too.
+Cloud = true
+
+# The root test.toml collapses every timestamp to [TIMESTAMP], which would hide
+# the change this test is about. Label the two values distinctly instead; Order
+# below the root rule's 10 makes these win.
+[[Repls]]
+Old = '2030-01-01T00:00:00Z'
+New = '[EXPIRE_TIME_BEFORE]'
+Order = 1
+
+[[Repls]]
+Old = '2031-06-15T12:00:00Z'
+New = '[EXPIRE_TIME_AFTER]'
+Order = 1
diff --git a/acceptance/bundle/resources/secrets/update-value/databricks.yml b/acceptance/bundle/resources/secrets/update-value/databricks.yml
new file mode 100644
index 00000000000..314e22db6ed
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/update-value/databricks.yml
@@ -0,0 +1,15 @@
+bundle:
+  name: test-bundle
+
+variables:
+  secret_value:
+    description: "Test secret value"
+
+resources:
+  secrets:
+    secret1:
+      catalog_name: main
+      schema_name: default
+      name: test_secret
+      value: ${var.secret_value}
+      comment: "Test secret"
diff --git a/acceptance/bundle/resources/secrets/update-value/out.test.toml b/acceptance/bundle/resources/secrets/update-value/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/update-value/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/secrets/update-value/output.txt b/acceptance/bundle/resources/secrets/update-value/output.txt
new file mode 100644
index 00000000000..8f12f1e007a
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/update-value/output.txt
@@ -0,0 +1,170 @@
+
+>>> [CLI] bundle plan --var secret_value=initial-secret-value -o json
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.secrets.secret1": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "catalog_name": "main",
+          "comment": "Test secret",
+          "name": "test_secret",
+          "schema_name": "default",
+          "value": "[redacted]"
+        }
+      }
+    }
+  }
+}
+
+>>> [CLI] bundle deploy --var secret_value=initial-secret-value
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created secrets.secret1
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //unity-catalog
+{
+  "method": "POST",
+  "path": "/api/2.1/unity-catalog/secrets",
+  "body": {
+    "catalog_name": "main",
+    "comment": "Test secret",
+    "name": "test_secret",
+    "schema_name": "default",
+    "value": "initial-secret-value"
+  }
+}
+secrets secret1 catalog_name='main' schema_name='default' name='test_secret' comment='Test secret' value=''
+
+=== Update secret value by passing a different variable value
+>>> [CLI] bundle plan --var secret_value=updated-secret-value -o json
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.secrets.secret1": {
+      "action": "update",
+      "new_state": {
+        "value": {
+          "catalog_name": "main",
+          "comment": "Test secret",
+          "name": "test_secret",
+          "schema_name": "default",
+          "value": "[redacted]"
+        }
+      },
+      "remote_state": {
+        "catalog_name": "main",
+        "comment": "Test secret",
+        "create_time": "[TIMESTAMP]",
+        "created_by": "[USERNAME]",
+        "effective_owner": "[USERNAME]",
+        "effective_value": "[redacted]",
+        "full_name": "main.default.test_secret",
+        "metastore_id": "test-metastore-id",
+        "name": "test_secret",
+        "owner": "[USERNAME]",
+        "schema_name": "default",
+        "update_time": "[TIMESTAMP]",
+        "updated_by": "[USERNAME]",
+        "value": "[redacted]"
+      },
+      "changes": {
+        "create_time": {
+          "action": "skip",
+          "reason": "spec:output_only",
+          "remote": "[TIMESTAMP]"
+        },
+        "created_by": {
+          "action": "skip",
+          "reason": "spec:output_only",
+          "remote": "[USERNAME]"
+        },
+        "effective_owner": {
+          "action": "skip",
+          "reason": "spec:output_only",
+          "remote": "[USERNAME]"
+        },
+        "effective_value": {
+          "action": "skip",
+          "reason": "spec:output_only",
+          "remote": "[redacted]"
+        },
+        "full_name": {
+          "action": "skip",
+          "reason": "spec:output_only",
+          "remote": "main.default.test_secret"
+        },
+        "metastore_id": {
+          "action": "skip",
+          "reason": "spec:output_only",
+          "remote": "test-metastore-id"
+        },
+        "owner": {
+          "action": "skip",
+          "reason": "spec:input_only",
+          "remote": "[USERNAME]"
+        },
+        "update_time": {
+          "action": "skip",
+          "reason": "spec:output_only",
+          "remote": "[TIMESTAMP]"
+        },
+        "updated_by": {
+          "action": "skip",
+          "reason": "spec:output_only",
+          "remote": "[USERNAME]"
+        },
+        "value": {
+          "action": "update",
+          "old": "",
+          "new": "[redacted]",
+          "remote": "[redacted]"
+        }
+      }
+    }
+  }
+}
+
+>>> [CLI] bundle deploy --var secret_value=updated-secret-value
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Updated secrets.secret1
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //unity-catalog
+{
+  "method": "PATCH",
+  "path": "/api/2.1/unity-catalog/secrets/main.default.test_secret",
+  "q": {
+    "update_mask": "*"
+  },
+  "body": {
+    "catalog_name": "main",
+    "comment": "Test secret",
+    "name": "test_secret",
+    "schema_name": "default",
+    "value": "updated-secret-value"
+  }
+}
+secrets secret1 catalog_name='main' schema_name='default' name='test_secret' comment='Test secret' value=''
+
+=== Verify state does not contain actual secret value
+>>> print_state.py
+{
+  "resources.secrets.secret1": {
+    "__id__": "main.default.test_secret",
+    "state": {
+      "catalog_name": "main",
+      "comment": "Test secret",
+      "name": "test_secret",
+      "schema_name": "default",
+      "value": ""
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/secrets/update-value/script b/acceptance/bundle/resources/secrets/update-value/script
new file mode 100755
index 00000000000..4ac8c946a23
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/update-value/script
@@ -0,0 +1,16 @@
+trace $CLI bundle plan --var secret_value=initial-secret-value -o json | nostamp
+trace $CLI bundle deploy --var secret_value=initial-secret-value
+
+trace print_requests.py //unity-catalog
+read_state.py secrets secret1 catalog_name schema_name name comment value
+
+title "Update secret value by passing a different variable value"
+trace $CLI bundle plan --var secret_value=updated-secret-value -o json | nostamp
+trace $CLI bundle deploy --var secret_value=updated-secret-value
+trace print_requests.py //unity-catalog
+read_state.py secrets secret1 catalog_name schema_name name comment value
+
+title "Verify state does not contain actual secret value"
+{ trace print_state.py | jq .state | contains.py "!initial-secret-value" "!updated-secret-value"; } || true
+
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/resources/secrets/update-value/test.toml b/acceptance/bundle/resources/secrets/update-value/test.toml
new file mode 100644
index 00000000000..3fada8d1657
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/update-value/test.toml
@@ -0,0 +1,4 @@
+Cloud = false
+RecordRequests = true
+
+Ignore = [".databricks", ".gitignore"]
diff --git a/acceptance/bundle/resources/secrets/validate-no-plain-text-default/databricks.yml b/acceptance/bundle/resources/secrets/validate-no-plain-text-default/databricks.yml
new file mode 100644
index 00000000000..aee031ac950
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/validate-no-plain-text-default/databricks.yml
@@ -0,0 +1,15 @@
+bundle:
+  name: test-bundle
+
+variables:
+  secret_value:
+    description: "Test secret value"
+    default: "plain-text-default-not-allowed"
+
+resources:
+  secrets:
+    secret1:
+      catalog_name: main
+      schema_name: default
+      name: test_secret
+      value: ${var.secret_value}
diff --git a/acceptance/bundle/resources/secrets/validate-no-plain-text-default/out.test.toml b/acceptance/bundle/resources/secrets/validate-no-plain-text-default/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/validate-no-plain-text-default/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/secrets/validate-no-plain-text-default/output.txt b/acceptance/bundle/resources/secrets/validate-no-plain-text-default/output.txt
new file mode 100644
index 00000000000..a8242e1fec1
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/validate-no-plain-text-default/output.txt
@@ -0,0 +1,14 @@
+
+=== Deploy should fail when variable used for secret has a default value
+>>> [CLI] bundle deploy
+Error: Variable used for secret value must not have a default value
+  at resources.secrets.secret1.value
+  in databricks.yml:7:14
+     databricks.yml:15:14
+
+The variable "secret_value" used for the secret "secret1" must not have a default value.
+A default value is stored in plain text in the configuration file, which defeats the purpose of using a variable reference for a secret.
+Remove the default value and pass the secret value at deployment time using "--var", the BUNDLE_VAR_secret_value environment variable, or a variable overrides file.
+
+
+Exit code: 1
diff --git a/acceptance/bundle/resources/secrets/validate-no-plain-text-default/script b/acceptance/bundle/resources/secrets/validate-no-plain-text-default/script
new file mode 100644
index 00000000000..f4095fe7141
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/validate-no-plain-text-default/script
@@ -0,0 +1,4 @@
+title "Deploy should fail when variable used for secret has a default value"
+trace $CLI bundle deploy 2>&1 | contains.py \
+  "Variable used for secret value must not have a default value" \
+  "default value is stored in plain text"
diff --git a/acceptance/bundle/resources/secrets/validate-no-plain-text-default/test.toml b/acceptance/bundle/resources/secrets/validate-no-plain-text-default/test.toml
new file mode 100644
index 00000000000..4e86fd8ba52
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/validate-no-plain-text-default/test.toml
@@ -0,0 +1,4 @@
+Cloud = false
+RecordRequests = false
+
+Ignore = [".databricks"]
diff --git a/acceptance/bundle/resources/secrets/validate-no-plain-text/databricks.yml b/acceptance/bundle/resources/secrets/validate-no-plain-text/databricks.yml
new file mode 100644
index 00000000000..d183373d3b0
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/validate-no-plain-text/databricks.yml
@@ -0,0 +1,20 @@
+bundle:
+  name: test-bundle
+
+resources:
+  catalogs:
+    test_catalog:
+      name: ${workspace.resource_prefix}_catalog
+
+  schemas:
+    test_schema:
+      name: ${workspace.resource_prefix}_schema
+      catalog_name: ${resources.catalogs.test_catalog.name}
+
+  secrets:
+    secret1:
+      catalog_name: ${resources.catalogs.test_catalog.name}
+      schema_name: ${resources.schemas.test_schema.name}
+      name: test_secret
+      value: "plain-text-secret-not-allowed"
+      comment: "This should fail validation"
diff --git a/acceptance/bundle/resources/secrets/validate-no-plain-text/out.test.toml b/acceptance/bundle/resources/secrets/validate-no-plain-text/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/validate-no-plain-text/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/secrets/validate-no-plain-text/output.txt b/acceptance/bundle/resources/secrets/validate-no-plain-text/output.txt
new file mode 100644
index 00000000000..582ae14bb48
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/validate-no-plain-text/output.txt
@@ -0,0 +1,13 @@
+
+=== Deploy should fail due to plain text secret value
+>>> [CLI] bundle deploy
+Error: Secret value must be a variable reference
+  at resources.secrets.secret1.value
+  in databricks.yml:19:14
+
+The secret value for "secret1" must be a variable reference (e.g., ${var.my_secret}).
+Plain text secret values are not allowed to prevent leaking secrets in configuration files.
+Use bundle variables to pass secret values at deployment time.
+
+
+Exit code: 1
diff --git a/acceptance/bundle/resources/secrets/validate-no-plain-text/script b/acceptance/bundle/resources/secrets/validate-no-plain-text/script
new file mode 100755
index 00000000000..309005d41ab
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/validate-no-plain-text/script
@@ -0,0 +1,4 @@
+title "Deploy should fail due to plain text secret value"
+trace $CLI bundle deploy 2>&1 | contains.py \
+  "Secret value must be a variable reference" \
+  "Plain text secret values are not allowed"
diff --git a/acceptance/bundle/resources/secrets/validate-no-plain-text/test.toml b/acceptance/bundle/resources/secrets/validate-no-plain-text/test.toml
new file mode 100644
index 00000000000..4e86fd8ba52
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/validate-no-plain-text/test.toml
@@ -0,0 +1,4 @@
+Cloud = false
+RecordRequests = false
+
+Ignore = [".databricks"]
diff --git a/acceptance/bundle/resources/secrets/validate-secret-is-string/databricks.yml b/acceptance/bundle/resources/secrets/validate-secret-is-string/databricks.yml
new file mode 100644
index 00000000000..c312e959fbc
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/validate-secret-is-string/databricks.yml
@@ -0,0 +1,13 @@
+bundle:
+  name: test-bundle
+
+resources:
+  secrets:
+    secret1:
+      catalog_name: main
+      schema_name: default
+      name: test_secret
+      value:
+        - hello
+        - world
+      comment: "This should fail validation"
diff --git a/acceptance/bundle/resources/secrets/validate-secret-is-string/out.test.toml b/acceptance/bundle/resources/secrets/validate-secret-is-string/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/validate-secret-is-string/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/secrets/validate-secret-is-string/output.txt b/acceptance/bundle/resources/secrets/validate-secret-is-string/output.txt
new file mode 100644
index 00000000000..07cfd2978b5
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/validate-secret-is-string/output.txt
@@ -0,0 +1,14 @@
+
+=== Deploy should fail due to plain text secret value
+>>> [CLI] bundle deploy
+Warning: expected string, found sequence
+  at resources.secrets.secret1.value
+  in databricks.yml:11:9
+
+Error: Secret value must be a string
+  at resources.secrets.secret1.value
+
+The secret value for "secret1" must be a string.
+
+
+Exit code: 1
diff --git a/acceptance/bundle/resources/secrets/validate-secret-is-string/script b/acceptance/bundle/resources/secrets/validate-secret-is-string/script
new file mode 100755
index 00000000000..cc724cd5692
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/validate-secret-is-string/script
@@ -0,0 +1,2 @@
+title "Deploy should fail due to plain text secret value"
+trace $CLI bundle deploy
diff --git a/acceptance/bundle/resources/secrets/validate-secret-is-string/test.toml b/acceptance/bundle/resources/secrets/validate-secret-is-string/test.toml
new file mode 100644
index 00000000000..4e86fd8ba52
--- /dev/null
+++ b/acceptance/bundle/resources/secrets/validate-secret-is-string/test.toml
@@ -0,0 +1,4 @@
+Cloud = false
+RecordRequests = false
+
+Ignore = [".databricks"]
diff --git a/acceptance/bundle/resources/sql_warehouses/lifecycle-started-edit/databricks.yml.tmpl b/acceptance/bundle/resources/sql_warehouses/lifecycle-started-edit/databricks.yml.tmpl
new file mode 100644
index 00000000000..ce2db8adb30
--- /dev/null
+++ b/acceptance/bundle/resources/sql_warehouses/lifecycle-started-edit/databricks.yml.tmpl
@@ -0,0 +1,14 @@
+bundle:
+  name: lifecycle-started-edit-$UNIQUE_NAME
+
+workspace:
+  root_path: ~/.bundle/$UNIQUE_NAME
+
+resources:
+  sql_warehouses:
+    mywarehouse:
+      name: $UNIQUE_NAME
+      cluster_size: "2X-Small"
+      auto_stop_mins: 10
+      lifecycle:
+        started: false
diff --git a/acceptance/bundle/resources/sql_warehouses/lifecycle-started-edit/out.test.toml b/acceptance/bundle/resources/sql_warehouses/lifecycle-started-edit/out.test.toml
new file mode 100644
index 00000000000..8bfa768b35b
--- /dev/null
+++ b/acceptance/bundle/resources/sql_warehouses/lifecycle-started-edit/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = true
+CloudSlow = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/sql_warehouses/lifecycle-started-edit/output.txt b/acceptance/bundle/resources/sql_warehouses/lifecycle-started-edit/output.txt
new file mode 100644
index 00000000000..4e16305a146
--- /dev/null
+++ b/acceptance/bundle/resources/sql_warehouses/lifecycle-started-edit/output.txt
@@ -0,0 +1,68 @@
+
+=== Deploy with started=false: warehouse created and then stopped
+>>> errcode [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Created sql_warehouses.mywarehouse
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //sql/warehouses
+{
+  "method": "POST",
+  "path": "/api/2.0/sql/warehouses",
+  "body": {
+    "auto_stop_mins": 10,
+    "cluster_size": "2X-Small",
+    "enable_photon": true,
+    "max_num_clusters": 1,
+    "name": "[UNIQUE_NAME]",
+    "spot_instance_policy": "COST_OPTIMIZED"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/sql/warehouses/[WAREHOUSE_ID]/stop",
+  "body": {}
+}
+
+>>> errcode [CLI] warehouses get [WAREHOUSE_ID]
+"STOPPED"
+
+=== Edit a field with started=false: Edit restarts the warehouse, so a Stop must follow
+>>> update_file.py databricks.yml auto_stop_mins: 10 auto_stop_mins: 20
+
+>>> errcode [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Updated sql_warehouses.mywarehouse
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //sql/warehouses
+{
+  "method": "POST",
+  "path": "/api/2.0/sql/warehouses/[WAREHOUSE_ID]/edit",
+  "body": {
+    "auto_stop_mins": 20,
+    "cluster_size": "2X-Small",
+    "enable_photon": true,
+    "max_num_clusters": 1,
+    "name": "[UNIQUE_NAME]",
+    "spot_instance_policy": "COST_OPTIMIZED"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/sql/warehouses/[WAREHOUSE_ID]/stop",
+  "body": {}
+}
+
+>>> errcode [CLI] warehouses get [WAREHOUSE_ID]
+"STOPPED"
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.sql_warehouses.mywarehouse
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/sql_warehouses/lifecycle-started-edit/script b/acceptance/bundle/resources/sql_warehouses/lifecycle-started-edit/script
new file mode 100644
index 00000000000..53b32751b1f
--- /dev/null
+++ b/acceptance/bundle/resources/sql_warehouses/lifecycle-started-edit/script
@@ -0,0 +1,25 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+title "Deploy with started=false: warehouse created and then stopped"
+trace errcode $CLI bundle deploy
+WAREHOUSE_ID=$($CLI bundle summary -o json | jq -r '.resources.sql_warehouses.mywarehouse.id')
+add_repl "$WAREHOUSE_ID" "WAREHOUSE_ID"
+trace print_requests.py //sql/warehouses
+rm -f "$OUT_REQUESTS"
+{ trace errcode $CLI warehouses get "$WAREHOUSE_ID" | jq '.state'; } || true
+
+# Editing a warehouse restarts it: Edit's long-running op waits for RUNNING
+# (SDK WaitGetWarehouseRunning), so a started=false config must follow the Edit
+# with a Stop. Before the fix this redeploy hung waiting for STOPPED.
+title "Edit a field with started=false: Edit restarts the warehouse, so a Stop must follow"
+trace update_file.py databricks.yml "auto_stop_mins: 10" "auto_stop_mins: 20"
+trace errcode $CLI bundle deploy
+trace print_requests.py //sql/warehouses
+rm -f "$OUT_REQUESTS"
+{ trace errcode $CLI warehouses get "$WAREHOUSE_ID" | jq '.state'; } || true
diff --git a/acceptance/bundle/resources/sql_warehouses/lifecycle-started-edit/test.toml b/acceptance/bundle/resources/sql_warehouses/lifecycle-started-edit/test.toml
new file mode 100644
index 00000000000..b6ef0492c6a
--- /dev/null
+++ b/acceptance/bundle/resources/sql_warehouses/lifecycle-started-edit/test.toml
@@ -0,0 +1,9 @@
+RecordRequests = true
+
+# Starting warehouses is slow, so run on cloud nightly (CloudSlow) instead of every PR
+# to confirm the real Edit-restarts behaviour without per-PR timeouts. The parent
+# disables Cloud, so re-enable it here alongside CloudSlow.
+Cloud = true
+CloudSlow = true
+
+Ignore = [".databricks", "databricks.yml"]
diff --git a/acceptance/bundle/resources/sql_warehouses/lifecycle-started-toggle/databricks.yml.tmpl b/acceptance/bundle/resources/sql_warehouses/lifecycle-started-toggle/databricks.yml.tmpl
new file mode 100644
index 00000000000..a00485190ff
--- /dev/null
+++ b/acceptance/bundle/resources/sql_warehouses/lifecycle-started-toggle/databricks.yml.tmpl
@@ -0,0 +1,14 @@
+bundle:
+  name: lifecycle-started-toggle-$UNIQUE_NAME
+
+workspace:
+  root_path: ~/.bundle/$UNIQUE_NAME
+
+resources:
+  sql_warehouses:
+    mywarehouse:
+      name: $UNIQUE_NAME
+      cluster_size: "2X-Small"
+      auto_stop_mins: 10
+      lifecycle:
+        started: false
diff --git a/acceptance/bundle/resources/sql_warehouses/lifecycle-started-toggle/out.test.toml b/acceptance/bundle/resources/sql_warehouses/lifecycle-started-toggle/out.test.toml
new file mode 100644
index 00000000000..403a04639c4
--- /dev/null
+++ b/acceptance/bundle/resources/sql_warehouses/lifecycle-started-toggle/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+CloudSlow = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/sql_warehouses/lifecycle-started-toggle/output.txt b/acceptance/bundle/resources/sql_warehouses/lifecycle-started-toggle/output.txt
new file mode 100644
index 00000000000..c0eaf7285cc
--- /dev/null
+++ b/acceptance/bundle/resources/sql_warehouses/lifecycle-started-toggle/output.txt
@@ -0,0 +1,75 @@
+
+=== Deploy with started=false: warehouse created and then stopped
+>>> errcode [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Created sql_warehouses.mywarehouse
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //sql/warehouses
+{
+  "method": "POST",
+  "path": "/api/2.0/sql/warehouses",
+  "body": {
+    "auto_stop_mins": 10,
+    "cluster_size": "2X-Small",
+    "enable_photon": true,
+    "max_num_clusters": 1,
+    "name": "[UNIQUE_NAME]",
+    "spot_instance_policy": "COST_OPTIMIZED"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/sql/warehouses/[WAREHOUSE_ID]/stop",
+  "body": {}
+}
+
+>>> errcode [CLI] warehouses get [WAREHOUSE_ID]
+"STOPPED"
+
+=== Toggle started=false -> started=true: only Start should be called, no Edit
+>>> update_file.py databricks.yml started: false started: true
+
+>>> errcode [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Updated sql_warehouses.mywarehouse
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //sql/warehouses
+{
+  "method": "POST",
+  "path": "/api/2.0/sql/warehouses/[WAREHOUSE_ID]/start",
+  "body": {}
+}
+
+>>> errcode [CLI] warehouses get [WAREHOUSE_ID]
+"RUNNING"
+
+=== Toggle started=true -> started=false: only Stop should be called, no Edit
+>>> update_file.py databricks.yml started: true started: false
+
+>>> errcode [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Updated sql_warehouses.mywarehouse
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //sql/warehouses
+{
+  "method": "POST",
+  "path": "/api/2.0/sql/warehouses/[WAREHOUSE_ID]/stop",
+  "body": {}
+}
+
+>>> errcode [CLI] warehouses get [WAREHOUSE_ID]
+"STOPPED"
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.sql_warehouses.mywarehouse
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/sql_warehouses/lifecycle-started-toggle/script b/acceptance/bundle/resources/sql_warehouses/lifecycle-started-toggle/script
new file mode 100644
index 00000000000..779c194e1bf
--- /dev/null
+++ b/acceptance/bundle/resources/sql_warehouses/lifecycle-started-toggle/script
@@ -0,0 +1,29 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+title "Deploy with started=false: warehouse created and then stopped"
+trace errcode $CLI bundle deploy
+WAREHOUSE_ID=$($CLI bundle summary -o json | jq -r '.resources.sql_warehouses.mywarehouse.id')
+add_repl "$WAREHOUSE_ID" "WAREHOUSE_ID"
+trace print_requests.py //sql/warehouses
+rm -f "$OUT_REQUESTS"
+{ trace errcode $CLI warehouses get "$WAREHOUSE_ID" | jq '.state'; } || true
+
+title "Toggle started=false -> started=true: only Start should be called, no Edit"
+trace update_file.py databricks.yml "started: false" "started: true"
+trace errcode $CLI bundle deploy
+trace print_requests.py //sql/warehouses
+rm -f "$OUT_REQUESTS"
+{ trace errcode $CLI warehouses get "$WAREHOUSE_ID" | jq '.state'; } || true
+
+title "Toggle started=true -> started=false: only Stop should be called, no Edit"
+trace update_file.py databricks.yml "started: true" "started: false"
+trace errcode $CLI bundle deploy
+trace print_requests.py //sql/warehouses
+rm -f "$OUT_REQUESTS"
+{ trace errcode $CLI warehouses get "$WAREHOUSE_ID" | jq '.state'; } || true
diff --git a/acceptance/bundle/resources/sql_warehouses/lifecycle-started-toggle/test.toml b/acceptance/bundle/resources/sql_warehouses/lifecycle-started-toggle/test.toml
new file mode 100644
index 00000000000..a13cf8200a4
--- /dev/null
+++ b/acceptance/bundle/resources/sql_warehouses/lifecycle-started-toggle/test.toml
@@ -0,0 +1,7 @@
+RecordRequests = true
+
+# Starting warehouses can take a while on infra under load.
+# Omit this test to avoid timeouts.
+Cloud = false
+
+Ignore = [".databricks", "databricks.yml"]
diff --git a/acceptance/bundle/resources/sql_warehouses/lifecycle-started/databricks.yml.tmpl b/acceptance/bundle/resources/sql_warehouses/lifecycle-started/databricks.yml.tmpl
new file mode 100644
index 00000000000..cfcc45c621f
--- /dev/null
+++ b/acceptance/bundle/resources/sql_warehouses/lifecycle-started/databricks.yml.tmpl
@@ -0,0 +1,14 @@
+bundle:
+  name: lifecycle-started-$UNIQUE_NAME
+
+workspace:
+  root_path: ~/.bundle/$UNIQUE_NAME
+
+resources:
+  sql_warehouses:
+    mywarehouse:
+      name: $UNIQUE_NAME
+      cluster_size: "2X-Small"
+      auto_stop_mins: 10
+      lifecycle:
+        started: true
diff --git a/acceptance/bundle/resources/sql_warehouses/lifecycle-started/out.test.toml b/acceptance/bundle/resources/sql_warehouses/lifecycle-started/out.test.toml
new file mode 100644
index 00000000000..403a04639c4
--- /dev/null
+++ b/acceptance/bundle/resources/sql_warehouses/lifecycle-started/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+CloudSlow = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/sql_warehouses/lifecycle-started/output.txt b/acceptance/bundle/resources/sql_warehouses/lifecycle-started/output.txt
new file mode 100644
index 00000000000..13b09684797
--- /dev/null
+++ b/acceptance/bundle/resources/sql_warehouses/lifecycle-started/output.txt
@@ -0,0 +1,103 @@
+
+=== Deploy with started=true: warehouse created and running
+>>> errcode [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Created sql_warehouses.mywarehouse
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //sql/warehouses
+{
+  "method": "POST",
+  "path": "/api/2.0/sql/warehouses",
+  "body": {
+    "auto_stop_mins": 10,
+    "cluster_size": "2X-Small",
+    "enable_photon": true,
+    "max_num_clusters": 1,
+    "name": "[UNIQUE_NAME]",
+    "spot_instance_policy": "COST_OPTIMIZED"
+  }
+}
+
+>>> errcode [CLI] warehouses get [WAREHOUSE_ID]
+"RUNNING"
+
+=== Stop warehouse externally while config says started=true: plan detects drift
+>>> errcode [CLI] warehouses stop [WAREHOUSE_ID]
+"STOPPED"
+
+>>> [CLI] bundle plan
+update sql_warehouses.mywarehouse
+
+Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
+
+=== Deploy fixes the drift: warehouse restarted
+>>> errcode [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Updated sql_warehouses.mywarehouse
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //sql/warehouses
+{
+  "method": "POST",
+  "path": "/api/2.0/sql/warehouses/[WAREHOUSE_ID]/stop",
+  "body": {}
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/sql/warehouses/[WAREHOUSE_ID]/start",
+  "body": {}
+}
+
+>>> errcode [CLI] warehouses get [WAREHOUSE_ID]
+"RUNNING"
+
+=== Deploy with started=false while warehouse is stopped: warehouse stays stopped
+>>> errcode [CLI] warehouses stop [WAREHOUSE_ID]
+"STOPPED"
+
+>>> update_file.py databricks.yml started: true started: false
+
+>>> errcode [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
+
+>>> print_requests.py //sql/warehouses
+{
+  "method": "POST",
+  "path": "/api/2.0/sql/warehouses/[WAREHOUSE_ID]/stop",
+  "body": {}
+}
+
+>>> errcode [CLI] warehouses get [WAREHOUSE_ID]
+"STOPPED"
+
+=== Deploy with started=true: warehouse restarted
+>>> update_file.py databricks.yml started: false started: true
+
+>>> errcode [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]/files...
+Updated sql_warehouses.mywarehouse
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //sql/warehouses
+{
+  "method": "POST",
+  "path": "/api/2.0/sql/warehouses/[WAREHOUSE_ID]/start",
+  "body": {}
+}
+
+>>> errcode [CLI] warehouses get [WAREHOUSE_ID]
+"RUNNING"
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.sql_warehouses.mywarehouse
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/[UNIQUE_NAME]
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/sql_warehouses/lifecycle-started/script b/acceptance/bundle/resources/sql_warehouses/lifecycle-started/script
new file mode 100644
index 00000000000..b9cf6cd8e05
--- /dev/null
+++ b/acceptance/bundle/resources/sql_warehouses/lifecycle-started/script
@@ -0,0 +1,41 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+title "Deploy with started=true: warehouse created and running"
+trace errcode $CLI bundle deploy
+WAREHOUSE_ID=$($CLI bundle summary -o json | jq -r '.resources.sql_warehouses.mywarehouse.id')
+add_repl "$WAREHOUSE_ID" "WAREHOUSE_ID"
+
+trace print_requests.py //sql/warehouses
+rm -f "$OUT_REQUESTS"
+{ trace errcode $CLI warehouses get "$WAREHOUSE_ID" | jq '.state'; } || true
+
+title "Stop warehouse externally while config says started=true: plan detects drift"
+{ trace errcode $CLI warehouses stop "$WAREHOUSE_ID" | jq '.state'; } || true
+trace $CLI bundle plan
+
+title "Deploy fixes the drift: warehouse restarted"
+trace errcode $CLI bundle deploy
+trace print_requests.py //sql/warehouses
+rm -f "$OUT_REQUESTS"
+{ trace errcode $CLI warehouses get "$WAREHOUSE_ID" | jq '.state'; } || true
+
+title "Deploy with started=false while warehouse is stopped: warehouse stays stopped"
+{ trace errcode $CLI warehouses stop "$WAREHOUSE_ID" | jq '.state'; } || true
+trace update_file.py databricks.yml "started: true" "started: false"
+trace errcode $CLI bundle deploy
+trace print_requests.py //sql/warehouses
+rm -f "$OUT_REQUESTS"
+{ trace errcode $CLI warehouses get "$WAREHOUSE_ID" | jq '.state'; } || true
+
+title "Deploy with started=true: warehouse restarted"
+trace update_file.py databricks.yml "started: false" "started: true"
+trace errcode $CLI bundle deploy
+trace print_requests.py //sql/warehouses
+rm -f "$OUT_REQUESTS"
+{ trace errcode $CLI warehouses get "$WAREHOUSE_ID" | jq '.state'; } || true
diff --git a/acceptance/bundle/resources/sql_warehouses/lifecycle-started/test.toml b/acceptance/bundle/resources/sql_warehouses/lifecycle-started/test.toml
new file mode 100644
index 00000000000..a13cf8200a4
--- /dev/null
+++ b/acceptance/bundle/resources/sql_warehouses/lifecycle-started/test.toml
@@ -0,0 +1,7 @@
+RecordRequests = true
+
+# Starting warehouses can take a while on infra under load.
+# Omit this test to avoid timeouts.
+Cloud = false
+
+Ignore = [".databricks", "databricks.yml"]
diff --git a/acceptance/bundle/resources/sql_warehouses/out.test.toml b/acceptance/bundle/resources/sql_warehouses/out.test.toml
index 355ae0775bc..403a04639c4 100644
--- a/acceptance/bundle/resources/sql_warehouses/out.test.toml
+++ b/acceptance/bundle/resources/sql_warehouses/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
 CloudSlow = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/sql_warehouses/output.txt b/acceptance/bundle/resources/sql_warehouses/output.txt
index a39c625f723..5a109c71211 100644
--- a/acceptance/bundle/resources/sql_warehouses/output.txt
+++ b/acceptance/bundle/resources/sql_warehouses/output.txt
@@ -36,12 +36,12 @@ Resources:
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test_sql_warehouse/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created sql_warehouses.test_sql_warehouse
+Files: 10 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 === Verify the create request
->>> jq select(.method == "POST" and (.path | contains("/sql/warehouses"))) out.requests.txt
+>>> jq select(.method == "POST" and (.path | contains("/sql/warehouses"))) [OUTPUT_DIR]/out.requests.txt
 {
   "method": "POST",
   "path": "/api/2.0/sql/warehouses",
@@ -67,19 +67,19 @@ Resources:
   SQL Warehouses:
     test_sql_warehouse:
       Name: sql_warehouse_name
-      URL:  [DATABRICKS_URL]/sql/warehouses/[UUID]?o=[NUMID]
+      URL:  [DATABRICKS_URL]/sql/warehouses/[UUID]?w=[WORKSPACE_ID]
 
 === Update the warehouse name
 >>> update_file.py databricks.yml sql_warehouse_name sql_warehouse_name_2
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test_sql_warehouse/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated sql_warehouses.test_sql_warehouse
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
 === Verify the update request
->>> jq select(.method == "POST" and (.path | contains("/sql/warehouses")) and (.body."name" == "sql_warehouse_name_2")) | del(.body.creator_name, .body.warehouse_type) out.requests.txt
+>>> jq select(.method == "POST" and (.path | contains("/sql/warehouses")) and (.body."name" == "sql_warehouse_name_2")) | del(.body.creator_name, .body.warehouse_type) [OUTPUT_DIR]/out.requests.txt
 {
   "method": "POST",
   "path": "/api/2.0/sql/warehouses/[UUID]/edit",
@@ -105,7 +105,7 @@ Resources:
   SQL Warehouses:
     test_sql_warehouse:
       Name: sql_warehouse_name_2
-      URL:  [DATABRICKS_URL]/sql/warehouses/[UUID]?o=[NUMID]
+      URL:  [DATABRICKS_URL]/sql/warehouses/[UUID]?w=[WORKSPACE_ID]
 
 === Destroy the warehouse
 >>> [CLI] bundle destroy --auto-approve
@@ -114,11 +114,10 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test_sql_warehouse/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
 
 === Verify the destroy request
->>> jq select(.method == "DELETE" and (.path | contains("/sql/warehouses"))) out.requests.txt
+>>> jq select(.method == "DELETE" and (.path | contains("/sql/warehouses"))) [OUTPUT_DIR]/out.requests.txt
 {
   "method": "DELETE",
   "path": "/api/2.0/sql/warehouses/[UUID]"
diff --git a/acceptance/bundle/resources/sql_warehouses/script b/acceptance/bundle/resources/sql_warehouses/script
index b1d488f36da..9b105e04fff 100644
--- a/acceptance/bundle/resources/sql_warehouses/script
+++ b/acceptance/bundle/resources/sql_warehouses/script
@@ -5,13 +5,13 @@ trace $CLI bundle summary
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm out.requests.txt
+    rm "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 trace $CLI bundle deploy
 
 title "Verify the create request"
-trace jq 'select(.method == "POST" and (.path | contains("/sql/warehouses")))' out.requests.txt
+trace jq 'select(.method == "POST" and (.path | contains("/sql/warehouses")))' "$OUT_REQUESTS"
 
 trace $CLI bundle summary
 
@@ -20,7 +20,7 @@ trace update_file.py databricks.yml sql_warehouse_name sql_warehouse_name_2
 trace $CLI bundle deploy
 
 title "Verify the update request"
-trace jq 'select(.method == "POST" and (.path | contains("/sql/warehouses")) and (.body."name" == "sql_warehouse_name_2")) | del(.body.creator_name, .body.warehouse_type)' out.requests.txt
+trace jq 'select(.method == "POST" and (.path | contains("/sql/warehouses")) and (.body."name" == "sql_warehouse_name_2")) | del(.body.creator_name, .body.warehouse_type)' "$OUT_REQUESTS"
 
 trace $CLI bundle summary
 
@@ -28,8 +28,8 @@ title "Destroy the warehouse"
 trace $CLI bundle destroy --auto-approve
 
 title "Verify the destroy request"
-trace jq 'select(.method == "DELETE" and (.path | contains("/sql/warehouses")))' out.requests.txt
+trace jq 'select(.method == "DELETE" and (.path | contains("/sql/warehouses")))' "$OUT_REQUESTS"
 
 trace $CLI bundle summary
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/resources/sql_warehouses/test.toml b/acceptance/bundle/resources/sql_warehouses/test.toml
index 123de2c97e3..690c7a860c3 100644
--- a/acceptance/bundle/resources/sql_warehouses/test.toml
+++ b/acceptance/bundle/resources/sql_warehouses/test.toml
@@ -1,5 +1,4 @@
 Cloud = false
-Local = true
 CloudSlow = false
 RecordRequests = true
 
diff --git a/acceptance/bundle/resources/synced_database_tables/basic/out.test.toml b/acceptance/bundle/resources/synced_database_tables/basic/out.test.toml
index e991fce9180..23cf24e68f4 100644
--- a/acceptance/bundle/resources/synced_database_tables/basic/out.test.toml
+++ b/acceptance/bundle/resources/synced_database_tables/basic/out.test.toml
@@ -1,6 +1,4 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
 RunsOnDbr = false
 CloudEnvs.gcp = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/synced_database_tables/basic/output.txt b/acceptance/bundle/resources/synced_database_tables/basic/output.txt
index b1fac3c7678..41edf2a32dd 100644
--- a/acceptance/bundle/resources/synced_database_tables/basic/output.txt
+++ b/acceptance/bundle/resources/synced_database_tables/basic/output.txt
@@ -34,9 +34,11 @@ Validation OK!
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-lakebase-synced-table-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created database_catalogs.my_catalog
+Created database_instances.my_instance
+Created synced_database_tables.my_synced_table
+Files: 2 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle summary
 
@@ -60,6 +62,5 @@ The synced data in the destination database will be lost (the source table is pr
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-lakebase-synced-table-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 3 deleted
 Cleaning up temporary source table
diff --git a/acceptance/bundle/resources/synced_database_tables/basic/test.toml b/acceptance/bundle/resources/synced_database_tables/basic/test.toml
index 191670590b5..41b51ae04a0 100644
--- a/acceptance/bundle/resources/synced_database_tables/basic/test.toml
+++ b/acceptance/bundle/resources/synced_database_tables/basic/test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = true
 Badness = "post deployment, bundle summary should print actual name that is fully resolved"
 
@@ -9,8 +8,8 @@ RecordRequests = false
 RunsOnDbr = false
 
 [[Repls]]
-# clean up ?o=<num> suffix after URL since not all workspaces have that
-Old = '\?o=\[(NUMID|ALPHANUMID)\]'
+# clean up ?[ow]=<num> suffix after URL since not all workspaces have that
+Old = '\?[ow]=\[(WORKSPACE_ID|ALPHANUMID)\]'
 New = ''
 Order = 1000
 
diff --git a/acceptance/bundle/resources/synced_database_tables/recreate/databricks.yml.tmpl b/acceptance/bundle/resources/synced_database_tables/recreate/databricks.yml.tmpl
new file mode 100644
index 00000000000..243df2f1033
--- /dev/null
+++ b/acceptance/bundle/resources/synced_database_tables/recreate/databricks.yml.tmpl
@@ -0,0 +1,24 @@
+bundle:
+  name: deploy-lakebase-synced-recreate-$UNIQUE_NAME
+
+resources:
+  database_instances:
+    my_instance:
+      name: test-db-synced-recreate-$UNIQUE_NAME
+      capacity: CU_1
+  database_catalogs:
+    my_catalog:
+      database_instance_name: ${resources.database_instances.my_instance.name}
+      database_name: my_database
+      name: my_catalog_$UNIQUE_NAME
+      create_database_if_not_exists: true
+  synced_database_tables:
+    my_synced_table:
+      name: ${resources.database_catalogs.my_catalog.name}.${resources.database_catalogs.my_catalog.database_name}.my_synced_table
+      database_instance_name: ${resources.database_instances.my_instance.name}
+      logical_database_name: ${resources.database_catalogs.my_catalog.database_name}
+      spec:
+        source_table_full_name: "main.test_schema.trips_source"
+        scheduling_policy: POLICY_PLACEHOLDER
+        primary_key_columns:
+          - id
diff --git a/acceptance/bundle/resources/synced_database_tables/recreate/out.requests.recreate.txt b/acceptance/bundle/resources/synced_database_tables/recreate/out.requests.recreate.txt
new file mode 100644
index 00000000000..04f7c103547
--- /dev/null
+++ b/acceptance/bundle/resources/synced_database_tables/recreate/out.requests.recreate.txt
@@ -0,0 +1,20 @@
+{
+  "method": "DELETE",
+  "path": "/api/2.0/database/synced_tables/my_catalog_[UNIQUE_NAME].my_database.my_synced_table"
+}
+{
+  "body": {
+    "database_instance_name": "test-db-synced-recreate-[UNIQUE_NAME]",
+    "logical_database_name": "my_database",
+    "name": "my_catalog_[UNIQUE_NAME].my_database.my_synced_table",
+    "spec": {
+      "primary_key_columns": [
+        "id"
+      ],
+      "scheduling_policy": "TRIGGERED",
+      "source_table_full_name": "main.test_schema.trips_source"
+    }
+  },
+  "method": "POST",
+  "path": "/api/2.0/database/synced_tables"
+}
diff --git a/acceptance/bundle/resources/synced_database_tables/recreate/out.test.toml b/acceptance/bundle/resources/synced_database_tables/recreate/out.test.toml
new file mode 100644
index 00000000000..f7840b7a1df
--- /dev/null
+++ b/acceptance/bundle/resources/synced_database_tables/recreate/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+CloudEnvs.gcp = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/synced_database_tables/recreate/output.txt b/acceptance/bundle/resources/synced_database_tables/recreate/output.txt
new file mode 100644
index 00000000000..03e95138a2f
--- /dev/null
+++ b/acceptance/bundle/resources/synced_database_tables/recreate/output.txt
@@ -0,0 +1,42 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-lakebase-synced-recreate-[UNIQUE_NAME]/default/files...
+Created database_catalogs.my_catalog
+Created database_instances.my_instance
+Created synced_database_tables.my_synced_table
+Files: 2 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Change an immutable synced-table field: no update API, so the plan recreates it
+>>> [CLI] bundle plan
+recreate synced_database_tables.my_synced_table
+
+Plan: 1 to add, 0 to change, 1 to delete, 2 unchanged
+
+>>> [CLI] bundle deploy --auto-approve
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-lakebase-synced-recreate-[UNIQUE_NAME]/default/files...
+
+This action will result in the deletion or recreation of the following synced database tables.
+The synced data in the destination database will be lost (the source table is preserved):
+  recreate resources.synced_database_tables.my_synced_table
+Recreated synced_database_tables.my_synced_table
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 2 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.database_catalogs.my_catalog
+  delete resources.database_instances.my_instance
+  delete resources.synced_database_tables.my_synced_table
+
+This action will result in the deletion of the following Lakebase database instances.
+All data stored in them will be permanently lost:
+  delete resources.database_instances.my_instance
+
+This action will result in the deletion of the following synced database tables.
+The synced data in the destination database will be lost (the source table is preserved):
+  delete resources.synced_database_tables.my_synced_table
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-lakebase-synced-recreate-[UNIQUE_NAME]/default
+
+Destroy: 3 deleted
diff --git a/acceptance/bundle/resources/synced_database_tables/recreate/script b/acceptance/bundle/resources/synced_database_tables/recreate/script
new file mode 100644
index 00000000000..7dc60584037
--- /dev/null
+++ b/acceptance/bundle/resources/synced_database_tables/recreate/script
@@ -0,0 +1,22 @@
+cleanup() {
+   trace $CLI bundle destroy --auto-approve
+   rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+envsubst < databricks.yml.tmpl | sed "s/POLICY_PLACEHOLDER/SNAPSHOT/" > databricks.yml
+
+trace $CLI bundle deploy
+rm -f "$OUT_REQUESTS"
+
+title "Change an immutable synced-table field: no update API, so the plan recreates it"
+sed "s/scheduling_policy: SNAPSHOT/scheduling_policy: TRIGGERED/" databricks.yml > databricks.yml.new
+mv databricks.yml.new databricks.yml
+
+trace $CLI bundle plan
+trace $CLI bundle deploy --auto-approve
+
+# The change must be a DELETE of the old synced table plus a POST creating the
+# new one. A PATCH would return 501 (the bug this guards against).
+jq --sort-keys 'select(.method != "GET" and (.path | contains("/database/synced_tables")))' < "$OUT_REQUESTS" > out.requests.recreate.txt
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/resources/synced_database_tables/recreate/test.toml b/acceptance/bundle/resources/synced_database_tables/recreate/test.toml
new file mode 100644
index 00000000000..3c1096e8207
--- /dev/null
+++ b/acceptance/bundle/resources/synced_database_tables/recreate/test.toml
@@ -0,0 +1,9 @@
+# The Database API has no UpdateSyncedDatabaseTable endpoint (PATCH returns 501),
+# so any field change must go through delete + create. The direct engine handles
+# this; the terraform path would need an upstream provider fix and is excluded.
+RecordRequests = true
+
+Ignore = [
+    "databricks.yml",
+    ".databricks",
+]
diff --git a/acceptance/bundle/resources/synced_database_tables/test.toml b/acceptance/bundle/resources/synced_database_tables/test.toml
index f0f6b0aa8cf..3653389f26d 100644
--- a/acceptance/bundle/resources/synced_database_tables/test.toml
+++ b/acceptance/bundle/resources/synced_database_tables/test.toml
@@ -1,2 +1 @@
-RequiresUnityCatalog = true
 CloudEnvs.gcp = false # lakebase is not available in GCP as of August 2025
diff --git a/acceptance/bundle/resources/vector_search_endpoints/basic/out.requests.direct.json b/acceptance/bundle/resources/vector_search_endpoints/basic/out.requests.json
similarity index 100%
rename from acceptance/bundle/resources/vector_search_endpoints/basic/out.requests.direct.json
rename to acceptance/bundle/resources/vector_search_endpoints/basic/out.requests.json
diff --git a/acceptance/bundle/resources/vector_search_endpoints/basic/out.test.toml b/acceptance/bundle/resources/vector_search_endpoints/basic/out.test.toml
index fe4076cdf9b..0f167effef1 100644
--- a/acceptance/bundle/resources/vector_search_endpoints/basic/out.test.toml
+++ b/acceptance/bundle/resources/vector_search_endpoints/basic/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/vector_search_endpoints/basic/output.txt b/acceptance/bundle/resources/vector_search_endpoints/basic/output.txt
index d3c70f81e40..df292d51699 100644
--- a/acceptance/bundle/resources/vector_search_endpoints/basic/output.txt
+++ b/acceptance/bundle/resources/vector_search_endpoints/basic/output.txt
@@ -18,13 +18,13 @@ Resources:
   Vector Search Endpoints:
     my_endpoint:
       Name: vs-endpoint-[UNIQUE_NAME]
-      URL:  [DATABRICKS_URL]/compute/vector-search/vs-endpoint-[UNIQUE_NAME]?o=[NUMID]
+      URL:  [DATABRICKS_URL]/compute/vector-search/vs-endpoint-[UNIQUE_NAME]?w=[WORKSPACE_ID]
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-vs-endpoint-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created vector_search_endpoints.my_endpoint
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] vector-search-endpoints get-endpoint vs-endpoint-[UNIQUE_NAME]
 {
@@ -42,7 +42,7 @@ Resources:
   Vector Search Endpoints:
     my_endpoint:
       Name: vs-endpoint-[UNIQUE_NAME]
-      URL:  [DATABRICKS_URL]/compute/vector-search/vs-endpoint-[UNIQUE_NAME]?o=[NUMID]
+      URL:  [DATABRICKS_URL]/compute/vector-search/vs-endpoint-[UNIQUE_NAME]?w=[WORKSPACE_ID]
 
 >>> print_requests.py //vector-search/endpoints
 
@@ -52,5 +52,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-vs-endpoint-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/vector_search_endpoints/basic/script b/acceptance/bundle/resources/vector_search_endpoints/basic/script
index e68232aab32..8e0e7b750f9 100644
--- a/acceptance/bundle/resources/vector_search_endpoints/basic/script
+++ b/acceptance/bundle/resources/vector_search_endpoints/basic/script
@@ -2,7 +2,7 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm -f out.requests.txt
+    rm -f "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
@@ -10,7 +10,7 @@ trace $CLI bundle validate
 
 trace $CLI bundle summary
 
-rm -f out.requests.txt
+rm -f "$OUT_REQUESTS"
 trace $CLI bundle deploy
 
 # Get endpoint details
@@ -19,4 +19,4 @@ trace $CLI vector-search-endpoints get-endpoint "${endpoint_name}" | jq '{name,
 
 trace $CLI bundle summary
 
-trace print_requests.py //vector-search/endpoints > out.requests.$DATABRICKS_BUNDLE_ENGINE.json
+trace print_requests.py //vector-search/endpoints > out.requests.json
diff --git a/acceptance/bundle/resources/vector_search_endpoints/basic/test.toml b/acceptance/bundle/resources/vector_search_endpoints/basic/test.toml
deleted file mode 100644
index f8b3bbe49dd..00000000000
--- a/acceptance/bundle/resources/vector_search_endpoints/basic/test.toml
+++ /dev/null
@@ -1 +0,0 @@
-# All configuration inherited from parent test.toml
diff --git a/acceptance/bundle/resources/vector_search_endpoints/drift/budget_policy/out.test.toml b/acceptance/bundle/resources/vector_search_endpoints/drift/budget_policy/out.test.toml
index 88423408186..a927a5fbc06 100644
--- a/acceptance/bundle/resources/vector_search_endpoints/drift/budget_policy/out.test.toml
+++ b/acceptance/bundle/resources/vector_search_endpoints/drift/budget_policy/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = false
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/vector_search_endpoints/drift/budget_policy/output.txt b/acceptance/bundle/resources/vector_search_endpoints/drift/budget_policy/output.txt
index 45555a83ff1..4c2d7b3ddeb 100644
--- a/acceptance/bundle/resources/vector_search_endpoints/drift/budget_policy/output.txt
+++ b/acceptance/bundle/resources/vector_search_endpoints/drift/budget_policy/output.txt
@@ -2,9 +2,9 @@
 === Initial deployment (no budget_policy_id)
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/drift-vs-endpoint-budget-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created vector_search_endpoints.my_endpoint
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 === Simulate remote drift: set budget_policy_id outside the bundle
 >>> [CLI] vector-search-endpoints update-endpoint-budget-policy vs-endpoint-[UNIQUE_NAME] remote-policy
@@ -12,11 +12,9 @@ Deployment complete!
   "effective_budget_policy_id": "remote-policy"
 }
 
-=== Plan detects drift and proposes update
+=== budget_policy_id drift is ignored (effective vs requested mismatch)
 >>> [CLI] bundle plan
-update vector_search_endpoints.my_endpoint
-
-Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
@@ -24,5 +22,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/drift-vs-endpoint-budget-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/vector_search_endpoints/drift/budget_policy/script b/acceptance/bundle/resources/vector_search_endpoints/drift/budget_policy/script
index c02467d6528..90b1babb10f 100644
--- a/acceptance/bundle/resources/vector_search_endpoints/drift/budget_policy/script
+++ b/acceptance/bundle/resources/vector_search_endpoints/drift/budget_policy/script
@@ -2,7 +2,6 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm -f out.requests.txt
 }
 trap cleanup EXIT
 
@@ -14,5 +13,5 @@ endpoint_name="vs-endpoint-${UNIQUE_NAME}"
 title "Simulate remote drift: set budget_policy_id outside the bundle"
 trace $CLI vector-search-endpoints update-endpoint-budget-policy "${endpoint_name}" "remote-policy"
 
-title "Plan detects drift and proposes update"
-trace $CLI bundle plan | contains.py "Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged"
+title "budget_policy_id drift is ignored (effective vs requested mismatch)"
+trace $CLI bundle plan | contains.py "Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged"
diff --git a/acceptance/bundle/resources/vector_search_endpoints/drift/budget_policy/test.toml b/acceptance/bundle/resources/vector_search_endpoints/drift/budget_policy/test.toml
index 18b1a88417e..396c1fe099e 100644
--- a/acceptance/bundle/resources/vector_search_endpoints/drift/budget_policy/test.toml
+++ b/acceptance/bundle/resources/vector_search_endpoints/drift/budget_policy/test.toml
@@ -1 +1,2 @@
+RecordRequests = false
 Cloud = false
diff --git a/acceptance/bundle/resources/vector_search_endpoints/drift/min_qps/databricks.yml.tmpl b/acceptance/bundle/resources/vector_search_endpoints/drift/min_qps/databricks.yml.tmpl
deleted file mode 100644
index 7936e98b23d..00000000000
--- a/acceptance/bundle/resources/vector_search_endpoints/drift/min_qps/databricks.yml.tmpl
+++ /dev/null
@@ -1,12 +0,0 @@
-bundle:
-  name: drift-vs-endpoint-min-qps-$UNIQUE_NAME
-
-sync:
-  paths: []
-
-resources:
-  vector_search_endpoints:
-    my_endpoint:
-      name: vs-endpoint-$UNIQUE_NAME
-      endpoint_type: STANDARD
-      min_qps: 1
diff --git a/acceptance/bundle/resources/vector_search_endpoints/drift/min_qps/out.plan.direct.json b/acceptance/bundle/resources/vector_search_endpoints/drift/min_qps/out.plan.direct.json
deleted file mode 100644
index 93aa4f1a24d..00000000000
--- a/acceptance/bundle/resources/vector_search_endpoints/drift/min_qps/out.plan.direct.json
+++ /dev/null
@@ -1,15 +0,0 @@
-{
-  "plan": {
-    "resources.vector_search_endpoints.my_endpoint": {
-      "action": "update",
-      "changes": {
-        "min_qps": {
-          "action": "update",
-          "old": 1,
-          "new": 1,
-          "remote": 5
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/vector_search_endpoints/drift/min_qps/out.test.toml b/acceptance/bundle/resources/vector_search_endpoints/drift/min_qps/out.test.toml
deleted file mode 100644
index 88423408186..00000000000
--- a/acceptance/bundle/resources/vector_search_endpoints/drift/min_qps/out.test.toml
+++ /dev/null
@@ -1,4 +0,0 @@
-Local = true
-Cloud = false
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/resources/vector_search_endpoints/drift/min_qps/output.txt b/acceptance/bundle/resources/vector_search_endpoints/drift/min_qps/output.txt
deleted file mode 100644
index 5a5f6d22f0c..00000000000
--- a/acceptance/bundle/resources/vector_search_endpoints/drift/min_qps/output.txt
+++ /dev/null
@@ -1,62 +0,0 @@
-
-=== Initial deployment
->>> [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/drift-vs-endpoint-min-qps-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
-=== Simulate remote drift: change min_qps to 5 outside the bundle
->>> [CLI] vector-search-endpoints patch-endpoint vs-endpoint-[UNIQUE_NAME] --min-qps 5
-{
-  "creation_timestamp": [UNIX_TIME_MILLIS][0],
-  "creator": "[USERNAME]",
-  "endpoint_status": {
-    "state": "ONLINE"
-  },
-  "endpoint_type": "STANDARD",
-  "id": "[UUID]",
-  "last_updated_timestamp": [UNIX_TIME_MILLIS][1],
-  "last_updated_user": "[USERNAME]",
-  "name": "vs-endpoint-[UNIQUE_NAME]",
-  "scaling_info": {
-    "requested_min_qps": 5
-  }
-}
-
-=== Plan detects drift and proposes update
->>> [CLI] bundle plan
-update vector_search_endpoints.my_endpoint
-
-Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
-
-=== Deploy restores min_qps to 1
->>> [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/drift-vs-endpoint-min-qps-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> print_requests.py //vector-search/endpoints
-{
-  "method": "PATCH",
-  "path": "/api/2.0/vector-search/endpoints/vs-endpoint-[UNIQUE_NAME]",
-  "body": {
-    "min_qps": 1
-  }
-}
-
->>> [CLI] vector-search-endpoints get-endpoint vs-endpoint-[UNIQUE_NAME]
-{
-  "name": "vs-endpoint-[UNIQUE_NAME]",
-  "endpoint_type": "STANDARD"
-}
-
->>> [CLI] bundle destroy --auto-approve
-The following resources will be deleted:
-  delete resources.vector_search_endpoints.my_endpoint
-
-All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/drift-vs-endpoint-min-qps-[UNIQUE_NAME]/default
-
-Deleting files...
-Destroy complete!
diff --git a/acceptance/bundle/resources/vector_search_endpoints/drift/min_qps/script b/acceptance/bundle/resources/vector_search_endpoints/drift/min_qps/script
deleted file mode 100644
index 81e86fefcb2..00000000000
--- a/acceptance/bundle/resources/vector_search_endpoints/drift/min_qps/script
+++ /dev/null
@@ -1,26 +0,0 @@
-envsubst < databricks.yml.tmpl > databricks.yml
-
-cleanup() {
-    trace $CLI bundle destroy --auto-approve
-    rm -f out.requests.txt
-}
-trap cleanup EXIT
-
-title "Initial deployment"
-trace $CLI bundle deploy
-
-endpoint_name="vs-endpoint-${UNIQUE_NAME}"
-
-title "Simulate remote drift: change min_qps to 5 outside the bundle"
-trace $CLI vector-search-endpoints patch-endpoint "${endpoint_name}" --min-qps 5
-
-title "Plan detects drift and proposes update"
-trace $CLI bundle plan | contains.py "Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged"
-$CLI bundle plan --output json | jq '{plan: .plan | map_values({action, changes})}' > out.plan.$DATABRICKS_BUNDLE_ENGINE.json
-
-title "Deploy restores min_qps to 1"
-rm -f out.requests.txt
-trace $CLI bundle deploy
-trace print_requests.py '//vector-search/endpoints'
-
-trace $CLI vector-search-endpoints get-endpoint "${endpoint_name}" | jq '{name, endpoint_type}'
diff --git a/acceptance/bundle/resources/vector_search_endpoints/drift/recreated_same_name/databricks.yml.tmpl b/acceptance/bundle/resources/vector_search_endpoints/drift/recreated_same_name/databricks.yml.tmpl
index b67caeebad6..914f4af6e3d 100644
--- a/acceptance/bundle/resources/vector_search_endpoints/drift/recreated_same_name/databricks.yml.tmpl
+++ b/acceptance/bundle/resources/vector_search_endpoints/drift/recreated_same_name/databricks.yml.tmpl
@@ -9,6 +9,3 @@ resources:
     my_endpoint:
       name: vs-endpoint-$UNIQUE_NAME
       endpoint_type: STANDARD
-      permissions:
-        - level: CAN_USE
-          group_name: admins
diff --git a/acceptance/bundle/resources/vector_search_endpoints/drift/recreated_same_name/out.test.toml b/acceptance/bundle/resources/vector_search_endpoints/drift/recreated_same_name/out.test.toml
index fe4076cdf9b..0f167effef1 100644
--- a/acceptance/bundle/resources/vector_search_endpoints/drift/recreated_same_name/out.test.toml
+++ b/acceptance/bundle/resources/vector_search_endpoints/drift/recreated_same_name/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/vector_search_endpoints/drift/recreated_same_name/output.txt b/acceptance/bundle/resources/vector_search_endpoints/drift/recreated_same_name/output.txt
index dece842119f..94f4e96054c 100644
--- a/acceptance/bundle/resources/vector_search_endpoints/drift/recreated_same_name/output.txt
+++ b/acceptance/bundle/resources/vector_search_endpoints/drift/recreated_same_name/output.txt
@@ -2,9 +2,9 @@
 === Initial deployment
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/drift-vs-endpoint-recreated-same-name-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created vector_search_endpoints.my_endpoint
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] vector-search-endpoints get-endpoint vs-endpoint-[UNIQUE_NAME]
 {
@@ -34,15 +34,12 @@ Remote recreated endpoint UUID: [REMOTE_RECREATED_ENDPOINT_UUID]
 
 === Plan after out-of-band recreate
 >>> [CLI] bundle plan
-create vector_search_endpoints.my_endpoint.permissions
-
-Plan: 1 to add, 0 to change, 0 to delete, 1 unchanged
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/drift-vs-endpoint-recreated-same-name-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
 
 >>> [CLI] vector-search-endpoints get-endpoint vs-endpoint-[UNIQUE_NAME]
 {
@@ -53,7 +50,7 @@ Deployment complete!
 
 === Verify no permanent drift after deploy
 >>> [CLI] bundle plan
-Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
@@ -61,5 +58,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/drift-vs-endpoint-recreated-same-name-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/vector_search_endpoints/drift/recreated_same_name/script b/acceptance/bundle/resources/vector_search_endpoints/drift/recreated_same_name/script
index dbef9250f28..a9cf6ed0a9b 100644
--- a/acceptance/bundle/resources/vector_search_endpoints/drift/recreated_same_name/script
+++ b/acceptance/bundle/resources/vector_search_endpoints/drift/recreated_same_name/script
@@ -2,7 +2,6 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm -f out.requests.txt
 }
 trap cleanup EXIT
 
@@ -12,7 +11,7 @@ title "Initial deployment"
 trace $CLI bundle deploy
 
 original_endpoint_uuid=$($CLI vector-search-endpoints get-endpoint "${endpoint_name}" | jq -r '.id')
-add_repl.py "$original_endpoint_uuid" "ORIGINAL_ENDPOINT_UUID"
+add_repl "$original_endpoint_uuid" "ORIGINAL_ENDPOINT_UUID"
 trace $CLI vector-search-endpoints get-endpoint "${endpoint_name}" | jq '{id, name, endpoint_type}'
 
 title "Delete and recreate remotely with the same name"
@@ -20,7 +19,7 @@ trace $CLI vector-search-endpoints delete-endpoint "${endpoint_name}"
 trace $CLI vector-search-endpoints create-endpoint "${endpoint_name}" STANDARD | jq '{id, name, endpoint_type}'
 
 remote_recreated_endpoint_uuid=$($CLI vector-search-endpoints get-endpoint "${endpoint_name}" | jq -r '.id')
-add_repl.py "$remote_recreated_endpoint_uuid" "REMOTE_RECREATED_ENDPOINT_UUID"
+add_repl "$remote_recreated_endpoint_uuid" "REMOTE_RECREATED_ENDPOINT_UUID"
 trace $CLI vector-search-endpoints get-endpoint "${endpoint_name}" | jq '{id, name, endpoint_type}'
 
 printf "Original endpoint UUID: %s\n" "$original_endpoint_uuid"
diff --git a/acceptance/bundle/resources/vector_search_endpoints/drift/target_qps/databricks.yml.tmpl b/acceptance/bundle/resources/vector_search_endpoints/drift/target_qps/databricks.yml.tmpl
new file mode 100644
index 00000000000..3999d01fe3b
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_endpoints/drift/target_qps/databricks.yml.tmpl
@@ -0,0 +1,12 @@
+bundle:
+  name: drift-vs-endpoint-target-qps-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  vector_search_endpoints:
+    my_endpoint:
+      name: vs-endpoint-$UNIQUE_NAME
+      endpoint_type: STANDARD
+      target_qps: 1
diff --git a/acceptance/bundle/resources/vector_search_endpoints/drift/target_qps/out.plan.json b/acceptance/bundle/resources/vector_search_endpoints/drift/target_qps/out.plan.json
new file mode 100644
index 00000000000..0d942ffd26d
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_endpoints/drift/target_qps/out.plan.json
@@ -0,0 +1,15 @@
+{
+  "plan": {
+    "resources.vector_search_endpoints.my_endpoint": {
+      "action": "update",
+      "changes": {
+        "target_qps": {
+          "action": "update",
+          "old": 1,
+          "new": 1,
+          "remote": 5
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/vector_search_endpoints/drift/target_qps/out.test.toml b/acceptance/bundle/resources/vector_search_endpoints/drift/target_qps/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_endpoints/drift/target_qps/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/vector_search_endpoints/drift/target_qps/output.txt b/acceptance/bundle/resources/vector_search_endpoints/drift/target_qps/output.txt
new file mode 100644
index 00000000000..8e7a03dce0d
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_endpoints/drift/target_qps/output.txt
@@ -0,0 +1,61 @@
+
+=== Initial deployment
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/drift-vs-endpoint-target-qps-[UNIQUE_NAME]/default/files...
+Created vector_search_endpoints.my_endpoint
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Simulate remote drift: change target_qps to 5 outside the bundle
+>>> [CLI] vector-search-endpoints patch-endpoint vs-endpoint-[UNIQUE_NAME] --target-qps 5
+{
+  "creation_timestamp": [UNIX_TIME_MILLIS][0],
+  "creator": "[USERNAME]",
+  "endpoint_status": {
+    "state": "ONLINE"
+  },
+  "endpoint_type": "STANDARD",
+  "id": "[UUID]",
+  "last_updated_timestamp": [UNIX_TIME_MILLIS][1],
+  "last_updated_user": "[USERNAME]",
+  "name": "vs-endpoint-[UNIQUE_NAME]",
+  "scaling_info": {
+    "requested_target_qps": 5
+  }
+}
+
+=== Plan detects drift and proposes update
+>>> [CLI] bundle plan
+update vector_search_endpoints.my_endpoint
+
+Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
+
+=== Deploy restores target_qps to 1
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/drift-vs-endpoint-target-qps-[UNIQUE_NAME]/default/files...
+Updated vector_search_endpoints.my_endpoint
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //vector-search/endpoints
+{
+  "method": "PATCH",
+  "path": "/api/2.0/vector-search/endpoints/vs-endpoint-[UNIQUE_NAME]",
+  "body": {
+    "target_qps": 1
+  }
+}
+
+>>> [CLI] vector-search-endpoints get-endpoint vs-endpoint-[UNIQUE_NAME]
+{
+  "name": "vs-endpoint-[UNIQUE_NAME]",
+  "endpoint_type": "STANDARD"
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.vector_search_endpoints.my_endpoint
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/drift-vs-endpoint-target-qps-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/vector_search_endpoints/drift/target_qps/script b/acceptance/bundle/resources/vector_search_endpoints/drift/target_qps/script
new file mode 100644
index 00000000000..d241f664d68
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_endpoints/drift/target_qps/script
@@ -0,0 +1,26 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+title "Initial deployment"
+trace $CLI bundle deploy
+
+endpoint_name="vs-endpoint-${UNIQUE_NAME}"
+
+title "Simulate remote drift: change target_qps to 5 outside the bundle"
+trace $CLI vector-search-endpoints patch-endpoint "${endpoint_name}" --target-qps 5
+
+title "Plan detects drift and proposes update"
+trace $CLI bundle plan | contains.py "Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged"
+$CLI bundle plan --output json | nostamp | jq '{plan: .plan | map_values({action, changes})}' > out.plan.json
+
+title "Deploy restores target_qps to 1"
+rm -f "$OUT_REQUESTS"
+trace $CLI bundle deploy
+trace print_requests.py '//vector-search/endpoints'
+
+trace $CLI vector-search-endpoints get-endpoint "${endpoint_name}" | jq '{name, endpoint_type}'
diff --git a/acceptance/bundle/resources/vector_search_endpoints/drift/target_qps/test.toml b/acceptance/bundle/resources/vector_search_endpoints/drift/target_qps/test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_endpoints/drift/target_qps/test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/bundle/resources/vector_search_endpoints/recreate/create-fails/out.test.toml b/acceptance/bundle/resources/vector_search_endpoints/recreate/create-fails/out.test.toml
index 88423408186..a927a5fbc06 100644
--- a/acceptance/bundle/resources/vector_search_endpoints/recreate/create-fails/out.test.toml
+++ b/acceptance/bundle/resources/vector_search_endpoints/recreate/create-fails/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = false
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/vector_search_endpoints/recreate/create-fails/output.txt b/acceptance/bundle/resources/vector_search_endpoints/recreate/create-fails/output.txt
index 67b3cb6182c..c2ae0b7a92a 100644
--- a/acceptance/bundle/resources/vector_search_endpoints/recreate/create-fails/output.txt
+++ b/acceptance/bundle/resources/vector_search_endpoints/recreate/create-fails/output.txt
@@ -2,9 +2,10 @@
 === Initial deploy creates two endpoints with distinct names
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/recreate-create-fails-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created vector_search_endpoints.blocker_endpoint
+Created vector_search_endpoints.my_endpoint
+Files: 0 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 === Edit my_endpoint: rename onto blocker_endpoint's name and switch endpoint_type to trigger Recreate
 >>> update_file.py databricks.yml vs-endpoint-a-[UNIQUE_NAME] vs-endpoint-b-[UNIQUE_NAME]
@@ -14,7 +15,6 @@ Deployment complete!
 === Deploy: Recreate of my_endpoint runs Delete (ok) then Create (409, name taken by blocker)
 >>> [CLI] bundle deploy --auto-approve
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/recreate-create-fails-[UNIQUE_NAME]/default/files...
-Deploying resources...
 Error: cannot recreate resources.vector_search_endpoints.my_endpoint: Vector search endpoint with name vs-endpoint-b-[UNIQUE_NAME] already exists (409 RESOURCE_ALREADY_EXISTS)
 
 Endpoint: POST [DATABRICKS_URL]/api/2.0/vector-search/endpoints
@@ -22,7 +22,7 @@ HTTP Status: 409 Conflict
 API error_code: RESOURCE_ALREADY_EXISTS
 API message: Vector search endpoint with name vs-endpoint-b-[UNIQUE_NAME] already exists
 
-Updating deployment state...
+Files: 0 uploaded, 0 deleted
 
 Exit code: 1
 
@@ -38,5 +38,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/recreate-create-fails-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/vector_search_endpoints/recreate/create-fails/script b/acceptance/bundle/resources/vector_search_endpoints/recreate/create-fails/script
index b48a7e7a3cf..db6be236ed9 100644
--- a/acceptance/bundle/resources/vector_search_endpoints/recreate/create-fails/script
+++ b/acceptance/bundle/resources/vector_search_endpoints/recreate/create-fails/script
@@ -2,7 +2,6 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve || true
-    rm -f out.requests.txt
 }
 trap cleanup EXIT
 
diff --git a/acceptance/bundle/resources/vector_search_endpoints/recreate/create-fails/test.toml b/acceptance/bundle/resources/vector_search_endpoints/recreate/create-fails/test.toml
index 18b1a88417e..396c1fe099e 100644
--- a/acceptance/bundle/resources/vector_search_endpoints/recreate/create-fails/test.toml
+++ b/acceptance/bundle/resources/vector_search_endpoints/recreate/create-fails/test.toml
@@ -1 +1,2 @@
+RecordRequests = false
 Cloud = false
diff --git a/acceptance/bundle/resources/vector_search_endpoints/recreate/endpoint_type/out.requests.create.direct.json b/acceptance/bundle/resources/vector_search_endpoints/recreate/endpoint_type/out.requests.create.json
similarity index 100%
rename from acceptance/bundle/resources/vector_search_endpoints/recreate/endpoint_type/out.requests.create.direct.json
rename to acceptance/bundle/resources/vector_search_endpoints/recreate/endpoint_type/out.requests.create.json
diff --git a/acceptance/bundle/resources/vector_search_endpoints/recreate/endpoint_type/out.requests.recreate.direct.json b/acceptance/bundle/resources/vector_search_endpoints/recreate/endpoint_type/out.requests.recreate.json
similarity index 100%
rename from acceptance/bundle/resources/vector_search_endpoints/recreate/endpoint_type/out.requests.recreate.direct.json
rename to acceptance/bundle/resources/vector_search_endpoints/recreate/endpoint_type/out.requests.recreate.json
diff --git a/acceptance/bundle/resources/vector_search_endpoints/recreate/endpoint_type/out.test.toml b/acceptance/bundle/resources/vector_search_endpoints/recreate/endpoint_type/out.test.toml
index 88423408186..a927a5fbc06 100644
--- a/acceptance/bundle/resources/vector_search_endpoints/recreate/endpoint_type/out.test.toml
+++ b/acceptance/bundle/resources/vector_search_endpoints/recreate/endpoint_type/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = false
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/vector_search_endpoints/recreate/endpoint_type/output.txt b/acceptance/bundle/resources/vector_search_endpoints/recreate/endpoint_type/output.txt
index c86cd5a682b..22ca8a55cf6 100644
--- a/acceptance/bundle/resources/vector_search_endpoints/recreate/endpoint_type/output.txt
+++ b/acceptance/bundle/resources/vector_search_endpoints/recreate/endpoint_type/output.txt
@@ -2,9 +2,9 @@
 === Initial deployment with STANDARD endpoint_type
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/recreate-vs-endpoint-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created vector_search_endpoints.my_endpoint
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> print_requests.py --keep //vector-search/endpoints
 
@@ -18,9 +18,9 @@ Plan: 1 to add, 0 to change, 1 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy --auto-approve
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/recreate-vs-endpoint-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Recreated vector_search_endpoints.my_endpoint
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 0 unchanged
 
 >>> print_requests.py --keep //vector-search/endpoints
 
@@ -36,5 +36,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/recreate-vs-endpoint-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/vector_search_endpoints/recreate/endpoint_type/script b/acceptance/bundle/resources/vector_search_endpoints/recreate/endpoint_type/script
index b3920cacbbd..7d26c1eb0a3 100644
--- a/acceptance/bundle/resources/vector_search_endpoints/recreate/endpoint_type/script
+++ b/acceptance/bundle/resources/vector_search_endpoints/recreate/endpoint_type/script
@@ -2,18 +2,18 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm -f out.requests.txt
+    rm -f "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
 print_requests() {
     local name=$1
-    trace print_requests.py --keep '//vector-search/endpoints' > out.requests.${name}.$DATABRICKS_BUNDLE_ENGINE.json
-    rm -f out.requests.txt
+    trace print_requests.py --keep '//vector-search/endpoints' > out.requests.${name}.json
+    rm -f "$OUT_REQUESTS"
 }
 
 title "Initial deployment with STANDARD endpoint_type"
-rm -f out.requests.txt
+rm -f "$OUT_REQUESTS"
 trace $CLI bundle deploy
 
 print_requests create
@@ -22,7 +22,7 @@ title "Change endpoint_type (should trigger recreation)"
 trace update_file.py databricks.yml "endpoint_type: STANDARD" "endpoint_type: STORAGE_OPTIMIZED"
 
 trace $CLI bundle plan
-rm -f out.requests.txt
+rm -f "$OUT_REQUESTS"
 trace $CLI bundle deploy --auto-approve
 
 print_requests recreate
diff --git a/acceptance/bundle/resources/vector_search_endpoints/test.toml b/acceptance/bundle/resources/vector_search_endpoints/test.toml
index aed959c0621..0eba324f09d 100644
--- a/acceptance/bundle/resources/vector_search_endpoints/test.toml
+++ b/acceptance/bundle/resources/vector_search_endpoints/test.toml
@@ -1,9 +1,6 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
 
 # Vector Search endpoints are only available in direct mode (no Terraform provider)
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
 
 Ignore = [
     "databricks.yml",
diff --git a/acceptance/bundle/resources/vector_search_endpoints/update/budget_policy/out.requests.create.direct.json b/acceptance/bundle/resources/vector_search_endpoints/update/budget_policy/out.requests.create.json
similarity index 100%
rename from acceptance/bundle/resources/vector_search_endpoints/update/budget_policy/out.requests.create.direct.json
rename to acceptance/bundle/resources/vector_search_endpoints/update/budget_policy/out.requests.create.json
diff --git a/acceptance/bundle/resources/vector_search_endpoints/update/budget_policy/out.requests.update.direct.json b/acceptance/bundle/resources/vector_search_endpoints/update/budget_policy/out.requests.update.json
similarity index 100%
rename from acceptance/bundle/resources/vector_search_endpoints/update/budget_policy/out.requests.update.direct.json
rename to acceptance/bundle/resources/vector_search_endpoints/update/budget_policy/out.requests.update.json
diff --git a/acceptance/bundle/resources/vector_search_endpoints/update/budget_policy/out.test.toml b/acceptance/bundle/resources/vector_search_endpoints/update/budget_policy/out.test.toml
index 88423408186..a927a5fbc06 100644
--- a/acceptance/bundle/resources/vector_search_endpoints/update/budget_policy/out.test.toml
+++ b/acceptance/bundle/resources/vector_search_endpoints/update/budget_policy/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = false
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/vector_search_endpoints/update/budget_policy/output.txt b/acceptance/bundle/resources/vector_search_endpoints/update/budget_policy/output.txt
index 3b2bb7bf1cf..017c9052b9b 100644
--- a/acceptance/bundle/resources/vector_search_endpoints/update/budget_policy/output.txt
+++ b/acceptance/bundle/resources/vector_search_endpoints/update/budget_policy/output.txt
@@ -2,9 +2,9 @@
 === Initial deployment (no budget policy)
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-vs-endpoint-budget-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created vector_search_endpoints.my_endpoint
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> print_requests.py --keep //vector-search/endpoints
 
@@ -19,9 +19,9 @@ Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-vs-endpoint-budget-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated vector_search_endpoints.my_endpoint
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
 >>> print_requests.py --keep //vector-search/endpoints
 
@@ -31,5 +31,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/update-vs-endpoint-budget-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/vector_search_endpoints/update/budget_policy/script b/acceptance/bundle/resources/vector_search_endpoints/update/budget_policy/script
index 8d19b9f60c8..3b520933649 100644
--- a/acceptance/bundle/resources/vector_search_endpoints/update/budget_policy/script
+++ b/acceptance/bundle/resources/vector_search_endpoints/update/budget_policy/script
@@ -2,18 +2,18 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm -f out.requests.txt
+    rm -f "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
 print_requests() {
     local name=$1
-    trace print_requests.py --keep '//vector-search/endpoints' > out.requests.${name}.$DATABRICKS_BUNDLE_ENGINE.json
-    rm -f out.requests.txt
+    trace print_requests.py --keep '//vector-search/endpoints' > out.requests.${name}.json
+    rm -f "$OUT_REQUESTS"
 }
 
 title "Initial deployment (no budget policy)"
-rm -f out.requests.txt
+rm -f "$OUT_REQUESTS"
 trace $CLI bundle deploy
 
 print_requests create
@@ -23,7 +23,7 @@ trace update_file.py databricks.yml "endpoint_type: STANDARD" "endpoint_type: ST
       budget_policy_id: test-policy-id"
 
 trace $CLI bundle plan
-rm -f out.requests.txt
+rm -f "$OUT_REQUESTS"
 trace $CLI bundle deploy
 
 print_requests update
diff --git a/acceptance/bundle/resources/vector_search_endpoints/update/min_qps/databricks.yml.tmpl b/acceptance/bundle/resources/vector_search_endpoints/update/min_qps/databricks.yml.tmpl
deleted file mode 100644
index 7c326b69d51..00000000000
--- a/acceptance/bundle/resources/vector_search_endpoints/update/min_qps/databricks.yml.tmpl
+++ /dev/null
@@ -1,15 +0,0 @@
-bundle:
-  name: update-vs-endpoint-min-qps-$UNIQUE_NAME
-
-sync:
-  paths: []
-
-resources:
-  vector_search_endpoints:
-    my_endpoint:
-      name: vs-endpoint-$UNIQUE_NAME
-      endpoint_type: STANDARD
-      min_qps: 1
-      permissions:
-        - level: CAN_USE
-          group_name: admins
diff --git a/acceptance/bundle/resources/vector_search_endpoints/update/min_qps/out.requests.create.direct.json b/acceptance/bundle/resources/vector_search_endpoints/update/min_qps/out.requests.create.direct.json
deleted file mode 100644
index 0a1d51a3512..00000000000
--- a/acceptance/bundle/resources/vector_search_endpoints/update/min_qps/out.requests.create.direct.json
+++ /dev/null
@@ -1,25 +0,0 @@
-{
-  "method": "POST",
-  "path": "/api/2.0/vector-search/endpoints",
-  "body": {
-    "endpoint_type": "STANDARD",
-    "min_qps": 1,
-    "name": "vs-endpoint-[UNIQUE_NAME]"
-  }
-}
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/vector-search-endpoints/[UUID]",
-  "body": {
-    "access_control_list": [
-      {
-        "group_name": "admins",
-        "permission_level": "CAN_USE"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/vector_search_endpoints/update/min_qps/out.requests.update.direct.json b/acceptance/bundle/resources/vector_search_endpoints/update/min_qps/out.requests.update.direct.json
deleted file mode 100644
index 24876c67bed..00000000000
--- a/acceptance/bundle/resources/vector_search_endpoints/update/min_qps/out.requests.update.direct.json
+++ /dev/null
@@ -1,23 +0,0 @@
-{
-  "method": "PATCH",
-  "path": "/api/2.0/vector-search/endpoints/vs-endpoint-[UNIQUE_NAME]",
-  "body": {
-    "min_qps": 2
-  }
-}
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/vector-search-endpoints/[UUID]",
-  "body": {
-    "access_control_list": [
-      {
-        "group_name": "admins",
-        "permission_level": "CAN_USE"
-      },
-      {
-        "permission_level": "CAN_MANAGE",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/resources/vector_search_endpoints/update/min_qps/out.test.toml b/acceptance/bundle/resources/vector_search_endpoints/update/min_qps/out.test.toml
deleted file mode 100644
index 88423408186..00000000000
--- a/acceptance/bundle/resources/vector_search_endpoints/update/min_qps/out.test.toml
+++ /dev/null
@@ -1,4 +0,0 @@
-Local = true
-Cloud = false
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/resources/vector_search_endpoints/update/min_qps/output.txt b/acceptance/bundle/resources/vector_search_endpoints/update/min_qps/output.txt
deleted file mode 100644
index 8dec120bc4a..00000000000
--- a/acceptance/bundle/resources/vector_search_endpoints/update/min_qps/output.txt
+++ /dev/null
@@ -1,47 +0,0 @@
-
-=== Initial deployment
->>> [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-vs-endpoint-min-qps-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> print_requests.py //vector-search/endpoints //permissions
-
->>> [CLI] vector-search-endpoints get-endpoint vs-endpoint-[UNIQUE_NAME]
-{
-  "name": "vs-endpoint-[UNIQUE_NAME]",
-  "endpoint_type": "STANDARD"
-}
-
-=== Update min_qps
->>> update_file.py databricks.yml min_qps: 1 min_qps: 2
-
->>> [CLI] bundle plan
-update vector_search_endpoints.my_endpoint
-update vector_search_endpoints.my_endpoint.permissions
-
-Plan: 0 to add, 2 to change, 0 to delete, 0 unchanged
-
->>> [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-vs-endpoint-min-qps-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> print_requests.py //vector-search/endpoints //permissions
-
->>> [CLI] vector-search-endpoints get-endpoint vs-endpoint-[UNIQUE_NAME]
-{
-  "name": "vs-endpoint-[UNIQUE_NAME]",
-  "endpoint_type": "STANDARD"
-}
-
->>> [CLI] bundle destroy --auto-approve
-The following resources will be deleted:
-  delete resources.vector_search_endpoints.my_endpoint
-
-All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/update-vs-endpoint-min-qps-[UNIQUE_NAME]/default
-
-Deleting files...
-Destroy complete!
diff --git a/acceptance/bundle/resources/vector_search_endpoints/update/min_qps/script b/acceptance/bundle/resources/vector_search_endpoints/update/min_qps/script
deleted file mode 100644
index c21d64b9d97..00000000000
--- a/acceptance/bundle/resources/vector_search_endpoints/update/min_qps/script
+++ /dev/null
@@ -1,32 +0,0 @@
-envsubst < databricks.yml.tmpl > databricks.yml
-
-cleanup() {
-    trace $CLI bundle destroy --auto-approve
-    rm -f out.requests.txt
-}
-trap cleanup EXIT
-
-print_requests() {
-    local name=$1
-    trace print_requests.py '//vector-search/endpoints' '//permissions' > out.requests.${name}.$DATABRICKS_BUNDLE_ENGINE.json
-}
-
-title "Initial deployment"
-rm -f out.requests.txt
-trace $CLI bundle deploy
-
-print_requests create
-
-endpoint_name="vs-endpoint-${UNIQUE_NAME}"
-trace $CLI vector-search-endpoints get-endpoint "${endpoint_name}" | jq '{name, endpoint_type}'
-
-title "Update min_qps"
-trace update_file.py databricks.yml "min_qps: 1" "min_qps: 2"
-
-trace $CLI bundle plan
-rm -f out.requests.txt
-trace $CLI bundle deploy
-
-print_requests update
-
-trace $CLI vector-search-endpoints get-endpoint "${endpoint_name}" | jq '{name, endpoint_type}'
diff --git a/acceptance/bundle/resources/vector_search_endpoints/update/target_qps/databricks.yml.tmpl b/acceptance/bundle/resources/vector_search_endpoints/update/target_qps/databricks.yml.tmpl
new file mode 100644
index 00000000000..71272f0325a
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_endpoints/update/target_qps/databricks.yml.tmpl
@@ -0,0 +1,15 @@
+bundle:
+  name: update-vs-endpoint-target-qps-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  vector_search_endpoints:
+    my_endpoint:
+      name: vs-endpoint-$UNIQUE_NAME
+      endpoint_type: STANDARD
+      target_qps: 1
+      permissions:
+        - level: CAN_USE
+          group_name: admins
diff --git a/acceptance/bundle/resources/vector_search_endpoints/update/target_qps/out.requests.create.json b/acceptance/bundle/resources/vector_search_endpoints/update/target_qps/out.requests.create.json
new file mode 100644
index 00000000000..7e7209e51e5
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_endpoints/update/target_qps/out.requests.create.json
@@ -0,0 +1,25 @@
+{
+  "method": "POST",
+  "path": "/api/2.0/vector-search/endpoints",
+  "body": {
+    "endpoint_type": "STANDARD",
+    "name": "vs-endpoint-[UNIQUE_NAME]",
+    "target_qps": 1
+  }
+}
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/vector-search-endpoints/[UUID]",
+  "body": {
+    "access_control_list": [
+      {
+        "group_name": "admins",
+        "permission_level": "CAN_USE"
+      },
+      {
+        "permission_level": "CAN_MANAGE",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/resources/vector_search_endpoints/update/target_qps/out.requests.update.json b/acceptance/bundle/resources/vector_search_endpoints/update/target_qps/out.requests.update.json
new file mode 100644
index 00000000000..b361b6e4357
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_endpoints/update/target_qps/out.requests.update.json
@@ -0,0 +1,23 @@
+{
+  "method": "PATCH",
+  "path": "/api/2.0/vector-search/endpoints/vs-endpoint-[UNIQUE_NAME]",
+  "body": {
+    "target_qps": 2
+  }
+}
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/vector-search-endpoints/[UUID]",
+  "body": {
+    "access_control_list": [
+      {
+        "group_name": "admins",
+        "permission_level": "CAN_USE"
+      },
+      {
+        "permission_level": "CAN_MANAGE",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/resources/vector_search_endpoints/update/target_qps/out.test.toml b/acceptance/bundle/resources/vector_search_endpoints/update/target_qps/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_endpoints/update/target_qps/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/vector_search_endpoints/update/target_qps/output.txt b/acceptance/bundle/resources/vector_search_endpoints/update/target_qps/output.txt
new file mode 100644
index 00000000000..44bbd77a910
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_endpoints/update/target_qps/output.txt
@@ -0,0 +1,48 @@
+
+=== Initial deployment
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-vs-endpoint-target-qps-[UNIQUE_NAME]/default/files...
+Created vector_search_endpoints.my_endpoint
+Created vector_search_endpoints.my_endpoint.permissions
+Files: 0 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //vector-search/endpoints //permissions
+
+>>> [CLI] vector-search-endpoints get-endpoint vs-endpoint-[UNIQUE_NAME]
+{
+  "name": "vs-endpoint-[UNIQUE_NAME]",
+  "endpoint_type": "STANDARD"
+}
+
+=== Update target_qps
+>>> update_file.py databricks.yml target_qps: 1 target_qps: 2
+
+>>> [CLI] bundle plan
+update vector_search_endpoints.my_endpoint
+update vector_search_endpoints.my_endpoint.permissions
+
+Plan: 0 to add, 2 to change, 0 to delete, 0 unchanged
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/update-vs-endpoint-target-qps-[UNIQUE_NAME]/default/files...
+Updated vector_search_endpoints.my_endpoint
+Updated vector_search_endpoints.my_endpoint.permissions
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 2 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //vector-search/endpoints //permissions
+
+>>> [CLI] vector-search-endpoints get-endpoint vs-endpoint-[UNIQUE_NAME]
+{
+  "name": "vs-endpoint-[UNIQUE_NAME]",
+  "endpoint_type": "STANDARD"
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.vector_search_endpoints.my_endpoint
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/update-vs-endpoint-target-qps-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/resources/vector_search_endpoints/update/target_qps/script b/acceptance/bundle/resources/vector_search_endpoints/update/target_qps/script
new file mode 100644
index 00000000000..155f56caae9
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_endpoints/update/target_qps/script
@@ -0,0 +1,32 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+print_requests() {
+    local name=$1
+    trace print_requests.py '//vector-search/endpoints' '//permissions' > out.requests.${name}.json
+}
+
+title "Initial deployment"
+rm -f "$OUT_REQUESTS"
+trace $CLI bundle deploy
+
+print_requests create
+
+endpoint_name="vs-endpoint-${UNIQUE_NAME}"
+trace $CLI vector-search-endpoints get-endpoint "${endpoint_name}" | jq '{name, endpoint_type}'
+
+title "Update target_qps"
+trace update_file.py databricks.yml "target_qps: 1" "target_qps: 2"
+
+trace $CLI bundle plan
+rm -f "$OUT_REQUESTS"
+trace $CLI bundle deploy
+
+print_requests update
+
+trace $CLI vector-search-endpoints get-endpoint "${endpoint_name}" | jq '{name, endpoint_type}'
diff --git a/acceptance/bundle/resources/vector_search_endpoints/update/min_qps/test.toml b/acceptance/bundle/resources/vector_search_endpoints/update/target_qps/test.toml
similarity index 100%
rename from acceptance/bundle/resources/vector_search_endpoints/update/min_qps/test.toml
rename to acceptance/bundle/resources/vector_search_endpoints/update/target_qps/test.toml
diff --git a/acceptance/bundle/resources/vector_search_indexes/basic/databricks.yml.tmpl b/acceptance/bundle/resources/vector_search_indexes/basic/databricks.yml.tmpl
new file mode 100644
index 00000000000..e16993d7019
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/basic/databricks.yml.tmpl
@@ -0,0 +1,22 @@
+bundle:
+  name: deploy-vs-index-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  vector_search_endpoints:
+    my_endpoint:
+      name: vs-endpoint-$UNIQUE_NAME
+      endpoint_type: STANDARD
+  vector_search_indexes:
+    my_index:
+      name: main.default.vs_index_$UNIQUE_NAME
+      endpoint_name: ${resources.vector_search_endpoints.my_endpoint.name}
+      primary_key: id
+      index_type: DIRECT_ACCESS
+      direct_access_index_spec:
+        schema_json: '{"id":"integer","vector":"array<float>"}'
+        embedding_vector_columns:
+          - name: vector
+            embedding_dimension: 768
diff --git a/acceptance/bundle/resources/vector_search_indexes/basic/out.requests.json b/acceptance/bundle/resources/vector_search_indexes/basic/out.requests.json
new file mode 100644
index 00000000000..c16d428a3f8
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/basic/out.requests.json
@@ -0,0 +1,19 @@
+{
+  "method": "POST",
+  "path": "/api/2.0/vector-search/indexes",
+  "body": {
+    "direct_access_index_spec": {
+      "embedding_vector_columns": [
+        {
+          "embedding_dimension": 768,
+          "name": "vector"
+        }
+      ],
+      "schema_json": "{\"id\":\"integer\",\"vector\":\"array<float>\"}"
+    },
+    "endpoint_name": "vs-endpoint-[UNIQUE_NAME]",
+    "index_type": "DIRECT_ACCESS",
+    "name": "main.default.vs_index_[UNIQUE_NAME]",
+    "primary_key": "id"
+  }
+}
diff --git a/acceptance/bundle/resources/vector_search_indexes/basic/out.test.toml b/acceptance/bundle/resources/vector_search_indexes/basic/out.test.toml
new file mode 100644
index 00000000000..ea4733e76f6
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/basic/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = true
+CloudSlow = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/vector_search_indexes/basic/output.txt b/acceptance/bundle/resources/vector_search_indexes/basic/output.txt
new file mode 100644
index 00000000000..41a6096ef09
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/basic/output.txt
@@ -0,0 +1,72 @@
+
+>>> [CLI] bundle validate
+Name: deploy-vs-index-[UNIQUE_NAME]
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/deploy-vs-index-[UNIQUE_NAME]/default
+
+Validation OK!
+
+>>> [CLI] bundle summary
+Name: deploy-vs-index-[UNIQUE_NAME]
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/deploy-vs-index-[UNIQUE_NAME]/default
+Resources:
+  Vector Search Endpoints:
+    my_endpoint:
+      Name: vs-endpoint-[UNIQUE_NAME]
+      URL:  [DATABRICKS_URL]/compute/vector-search/vs-endpoint-[UNIQUE_NAME]?w=[WORKSPACE_ID]
+  Vector Search Indexes:
+    my_index:
+      Name: main.default.vs_index_[UNIQUE_NAME]
+      URL:  [DATABRICKS_URL]/explore/data/main/default/vs_index_[UNIQUE_NAME]?w=[WORKSPACE_ID]
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-vs-index-[UNIQUE_NAME]/default/files...
+Created vector_search_endpoints.my_endpoint
+Created vector_search_indexes.my_index
+Files: 0 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] vector-search-indexes get-index main.default.vs_index_[UNIQUE_NAME]
+{
+  "name": "main.default.vs_index_[UNIQUE_NAME]",
+  "endpoint_name": "vs-endpoint-[UNIQUE_NAME]",
+  "index_type": "DIRECT_ACCESS",
+  "primary_key": "id"
+}
+
+>>> [CLI] bundle summary
+Name: deploy-vs-index-[UNIQUE_NAME]
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/deploy-vs-index-[UNIQUE_NAME]/default
+Resources:
+  Vector Search Endpoints:
+    my_endpoint:
+      Name: vs-endpoint-[UNIQUE_NAME]
+      URL:  [DATABRICKS_URL]/compute/vector-search/vs-endpoint-[UNIQUE_NAME]?w=[WORKSPACE_ID]
+  Vector Search Indexes:
+    my_index:
+      Name: main.default.vs_index_[UNIQUE_NAME]
+      URL:  [DATABRICKS_URL]/explore/data/main/default/vs_index_[UNIQUE_NAME]?w=[WORKSPACE_ID]
+
+>>> print_requests.py //vector-search/indexes
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.vector_search_endpoints.my_endpoint
+  delete resources.vector_search_indexes.my_index
+
+This action will result in the deletion of the following Vector Search indexes.
+For Delta Sync indexes, the source Delta Table is preserved but the embedding pipeline is removed.
+For Direct Access indexes, all upserted vectors are permanently lost:
+  delete resources.vector_search_indexes.my_index
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-vs-index-[UNIQUE_NAME]/default
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/vector_search_indexes/basic/script b/acceptance/bundle/resources/vector_search_indexes/basic/script
new file mode 100644
index 00000000000..3f86d9c3a1b
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/basic/script
@@ -0,0 +1,22 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+trace $CLI bundle validate
+
+trace $CLI bundle summary
+
+rm -f "$OUT_REQUESTS"
+trace $CLI bundle deploy
+
+# Get index details
+index_name="main.default.vs_index_${UNIQUE_NAME}"
+trace $CLI vector-search-indexes get-index "${index_name}" | jq '{name, endpoint_name, index_type, primary_key}'
+
+trace $CLI bundle summary
+
+trace print_requests.py //vector-search/indexes > out.requests.json
diff --git a/acceptance/bundle/resources/vector_search_indexes/basic/test.toml b/acceptance/bundle/resources/vector_search_indexes/basic/test.toml
new file mode 100644
index 00000000000..17aee8dafd4
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/basic/test.toml
@@ -0,0 +1,17 @@
+# Index provisioning takes ~30 minutes, which exceeded the test timeout and made this the
+# slowest test in the cloud job. Nothing here depends on the index being queryable — the
+# assertions only need it to exist — so cap the wait instead. The cap is what this test's
+# runtime now consists of (~2x cap: once on create, once on delete), so keep it small.
+Env.DATABRICKS_BUNDLE_RESOURCE_MAX_WAIT = "30"
+
+# With the wait capped this is no longer slow, so run it on every PR rather than only in the
+# nightly job. The parent sets CloudSlow=true for the tests that still wait ~30 minutes.
+CloudSlow = false
+Cloud = true
+
+# The cap makes deploy warn that it stopped waiting. Drop the line rather than baking it into
+# the golden: it is a property of this test's configuration, not of the behaviour under test.
+# Trailing \n so the whole line goes, leaving no blank line behind.
+[[Repls]]
+Old = 'Warn: [^\n]*Stopped waiting[^\n]*\n'
+New = ''
diff --git a/acceptance/bundle/resources/vector_search_indexes/drift/deleted_remotely/databricks.yml.tmpl b/acceptance/bundle/resources/vector_search_indexes/drift/deleted_remotely/databricks.yml.tmpl
new file mode 100644
index 00000000000..43999b39c69
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/drift/deleted_remotely/databricks.yml.tmpl
@@ -0,0 +1,22 @@
+bundle:
+  name: drift-vs-index-deleted-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  vector_search_endpoints:
+    my_endpoint:
+      name: vs-endpoint-$UNIQUE_NAME
+      endpoint_type: STANDARD
+  vector_search_indexes:
+    my_index:
+      name: main.default.vs_index_$UNIQUE_NAME
+      endpoint_name: ${resources.vector_search_endpoints.my_endpoint.name}
+      primary_key: id
+      index_type: DIRECT_ACCESS
+      direct_access_index_spec:
+        schema_json: '{"id":"integer","vector":"array<float>"}'
+        embedding_vector_columns:
+          - name: vector
+            embedding_dimension: 768
diff --git a/acceptance/bundle/resources/vector_search_indexes/drift/deleted_remotely/out.test.toml b/acceptance/bundle/resources/vector_search_indexes/drift/deleted_remotely/out.test.toml
new file mode 100644
index 00000000000..0eea50f8645
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/drift/deleted_remotely/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+CloudSlow = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/vector_search_indexes/drift/deleted_remotely/output.txt b/acceptance/bundle/resources/vector_search_indexes/drift/deleted_remotely/output.txt
new file mode 100644
index 00000000000..b5aed53ad30
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/drift/deleted_remotely/output.txt
@@ -0,0 +1,46 @@
+
+=== Initial deployment
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/drift-vs-index-deleted-[UNIQUE_NAME]/default/files...
+Created vector_search_endpoints.my_endpoint
+Created vector_search_indexes.my_index
+Files: 0 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Simulate remote deletion
+>>> [CLI] vector-search-indexes delete-index main.default.vs_index_[UNIQUE_NAME]
+
+=== Plan detects missing resource and proposes creation
+>>> [CLI] bundle plan
+create vector_search_indexes.my_index
+
+Plan: 1 to add, 0 to change, 0 to delete, 1 unchanged
+
+=== Deploy recreates the index
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/drift-vs-index-deleted-[UNIQUE_NAME]/default/files...
+Created vector_search_indexes.my_index
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 1 unchanged
+
+>>> [CLI] vector-search-indexes get-index main.default.vs_index_[UNIQUE_NAME]
+{
+  "name": "main.default.vs_index_[UNIQUE_NAME]",
+  "endpoint_name": "vs-endpoint-[UNIQUE_NAME]",
+  "index_type": "DIRECT_ACCESS",
+  "primary_key": "id"
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.vector_search_endpoints.my_endpoint
+  delete resources.vector_search_indexes.my_index
+
+This action will result in the deletion of the following Vector Search indexes.
+For Delta Sync indexes, the source Delta Table is preserved but the embedding pipeline is removed.
+For Direct Access indexes, all upserted vectors are permanently lost:
+  delete resources.vector_search_indexes.my_index
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/drift-vs-index-deleted-[UNIQUE_NAME]/default
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/vector_search_indexes/drift/deleted_remotely/script b/acceptance/bundle/resources/vector_search_indexes/drift/deleted_remotely/script
new file mode 100644
index 00000000000..3d113961bb1
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/drift/deleted_remotely/script
@@ -0,0 +1,20 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+index_name="main.default.vs_index_${UNIQUE_NAME}"
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+title "Initial deployment"
+trace $CLI bundle deploy
+
+title "Simulate remote deletion"
+trace $CLI vector-search-indexes delete-index "${index_name}"
+
+title "Plan detects missing resource and proposes creation"
+trace $CLI bundle plan | contains.py "create vector_search_indexes.my_index"
+
+title "Deploy recreates the index"
+trace $CLI bundle deploy
+trace $CLI vector-search-indexes get-index "${index_name}" | jq '{name, endpoint_name, index_type, primary_key}'
diff --git a/acceptance/bundle/resources/vector_search_indexes/drift/deleted_remotely/test.toml b/acceptance/bundle/resources/vector_search_indexes/drift/deleted_remotely/test.toml
new file mode 100644
index 00000000000..396c1fe099e
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/drift/deleted_remotely/test.toml
@@ -0,0 +1,2 @@
+RecordRequests = false
+Cloud = false
diff --git a/acceptance/bundle/resources/vector_search_indexes/drift/orphaned_endpoint/databricks.yml.tmpl b/acceptance/bundle/resources/vector_search_indexes/drift/orphaned_endpoint/databricks.yml.tmpl
new file mode 100644
index 00000000000..d12336c7e94
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/drift/orphaned_endpoint/databricks.yml.tmpl
@@ -0,0 +1,22 @@
+bundle:
+  name: drift-vs-index-orphaned-endpoint-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  vector_search_endpoints:
+    vs_endpoint:
+      name: vs-endpoint-$UNIQUE_NAME
+      endpoint_type: STANDARD
+  vector_search_indexes:
+    my_index:
+      name: main.default.vs_index_$UNIQUE_NAME
+      endpoint_name: ${resources.vector_search_endpoints.vs_endpoint.name}
+      primary_key: id
+      index_type: DIRECT_ACCESS
+      direct_access_index_spec:
+        schema_json: '{"id":"integer","vector":"array<float>"}'
+        embedding_vector_columns:
+          - name: vector
+            embedding_dimension: 768
diff --git a/acceptance/bundle/resources/vector_search_indexes/drift/orphaned_endpoint/out.test.toml b/acceptance/bundle/resources/vector_search_indexes/drift/orphaned_endpoint/out.test.toml
new file mode 100644
index 00000000000..0eea50f8645
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/drift/orphaned_endpoint/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+CloudSlow = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/vector_search_indexes/drift/orphaned_endpoint/output.txt b/acceptance/bundle/resources/vector_search_indexes/drift/orphaned_endpoint/output.txt
new file mode 100644
index 00000000000..2f0118a9743
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/drift/orphaned_endpoint/output.txt
@@ -0,0 +1,53 @@
+
+=== Initial deployment
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/drift-vs-index-orphaned-endpoint-[UNIQUE_NAME]/default/files...
+Created vector_search_endpoints.vs_endpoint
+Created vector_search_indexes.my_index
+Files: 0 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Simulate remote endpoint deletion (index is orphaned, still exists by name)
+>>> [CLI] vector-search-endpoints delete-endpoint vs-endpoint-[UNIQUE_NAME]
+
+=== Plan must cascade-recreate the index because its endpoint is being recreated
+>>> [CLI] bundle plan
+create vector_search_endpoints.vs_endpoint
+recreate vector_search_indexes.my_index
+
+Plan: 2 to add, 0 to change, 1 to delete, 0 unchanged
+
+=== Deploy recreates endpoint and rebinds index
+>>> [CLI] bundle deploy --auto-approve
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/drift-vs-index-orphaned-endpoint-[UNIQUE_NAME]/default/files...
+
+This action will result in the deletion or recreation of the following Vector Search indexes.
+Recreating a Delta Sync index re-runs the full embedding pipeline; recreating a Direct Access
+index drops all upserted vectors. Both can be expensive to rebuild:
+  recreate resources.vector_search_indexes.my_index
+Created vector_search_endpoints.vs_endpoint
+Recreated vector_search_indexes.my_index
+Files: 0 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 1 deleted, 0 unchanged
+
+>>> [CLI] vector-search-indexes get-index main.default.vs_index_[UNIQUE_NAME]
+{
+  "name": "main.default.vs_index_[UNIQUE_NAME]",
+  "endpoint_name": "vs-endpoint-[UNIQUE_NAME]",
+  "index_type": "DIRECT_ACCESS",
+  "primary_key": "id"
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.vector_search_endpoints.vs_endpoint
+  delete resources.vector_search_indexes.my_index
+
+This action will result in the deletion of the following Vector Search indexes.
+For Delta Sync indexes, the source Delta Table is preserved but the embedding pipeline is removed.
+For Direct Access indexes, all upserted vectors are permanently lost:
+  delete resources.vector_search_indexes.my_index
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/drift-vs-index-orphaned-endpoint-[UNIQUE_NAME]/default
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/vector_search_indexes/drift/orphaned_endpoint/script b/acceptance/bundle/resources/vector_search_indexes/drift/orphaned_endpoint/script
new file mode 100644
index 00000000000..f4334fa46cc
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/drift/orphaned_endpoint/script
@@ -0,0 +1,21 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+endpoint_name="vs-endpoint-${UNIQUE_NAME}"
+index_name="main.default.vs_index_${UNIQUE_NAME}"
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+title "Initial deployment"
+trace $CLI bundle deploy
+
+title "Simulate remote endpoint deletion (index is orphaned, still exists by name)"
+trace $CLI vector-search-endpoints delete-endpoint "${endpoint_name}"
+
+title "Plan must cascade-recreate the index because its endpoint is being recreated"
+trace $CLI bundle plan | contains.py "create vector_search_endpoints.vs_endpoint" "recreate vector_search_indexes.my_index"
+
+title "Deploy recreates endpoint and rebinds index"
+trace $CLI bundle deploy --auto-approve
+trace $CLI vector-search-indexes get-index "${index_name}" | jq '{name, endpoint_name, index_type, primary_key}'
diff --git a/acceptance/bundle/resources/vector_search_indexes/drift/orphaned_endpoint/test.toml b/acceptance/bundle/resources/vector_search_indexes/drift/orphaned_endpoint/test.toml
new file mode 100644
index 00000000000..396c1fe099e
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/drift/orphaned_endpoint/test.toml
@@ -0,0 +1,2 @@
+RecordRequests = false
+Cloud = false
diff --git a/acceptance/bundle/resources/vector_search_indexes/grants/select/databricks.yml.tmpl b/acceptance/bundle/resources/vector_search_indexes/grants/select/databricks.yml.tmpl
new file mode 100644
index 00000000000..c0619e93eed
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/grants/select/databricks.yml.tmpl
@@ -0,0 +1,26 @@
+bundle:
+  name: vs-index-grants-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  vector_search_endpoints:
+    my_endpoint:
+      name: vs-endpoint-$UNIQUE_NAME
+      endpoint_type: STANDARD
+  vector_search_indexes:
+    my_index:
+      name: main.default.vs_index_$UNIQUE_NAME
+      endpoint_name: ${resources.vector_search_endpoints.my_endpoint.name}
+      primary_key: id
+      index_type: DIRECT_ACCESS
+      direct_access_index_spec:
+        schema_json: '{"id":"integer","vector":"array<float>"}'
+        embedding_vector_columns:
+          - name: vector
+            embedding_dimension: 768
+      grants:
+        - principal: deco-test-user@databricks.com
+          privileges:
+            - SELECT
diff --git a/acceptance/bundle/resources/vector_search_indexes/grants/select/out.requests.json b/acceptance/bundle/resources/vector_search_indexes/grants/select/out.requests.json
new file mode 100644
index 00000000000..66c0fe79100
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/grants/select/out.requests.json
@@ -0,0 +1,36 @@
+{
+  "method": "POST",
+  "path": "/api/2.0/vector-search/indexes",
+  "body": {
+    "direct_access_index_spec": {
+      "embedding_vector_columns": [
+        {
+          "embedding_dimension": 768,
+          "name": "vector"
+        }
+      ],
+      "schema_json": "{\"id\":\"integer\",\"vector\":\"array<float>\"}"
+    },
+    "endpoint_name": "vs-endpoint-[UNIQUE_NAME]",
+    "index_type": "DIRECT_ACCESS",
+    "name": "main.default.vs_index_[UNIQUE_NAME]",
+    "primary_key": "id"
+  }
+}
+{
+  "method": "PATCH",
+  "path": "/api/2.1/unity-catalog/permissions/table/main.default.vs_index_[UNIQUE_NAME]",
+  "body": {
+    "changes": [
+      {
+        "add": [
+          "SELECT"
+        ],
+        "principal": "deco-test-user@databricks.com",
+        "remove": [
+          "ALL_PRIVILEGES"
+        ]
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/resources/vector_search_indexes/grants/select/out.test.toml b/acceptance/bundle/resources/vector_search_indexes/grants/select/out.test.toml
new file mode 100644
index 00000000000..ea4733e76f6
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/grants/select/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = true
+CloudSlow = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/vector_search_indexes/grants/select/output.txt b/acceptance/bundle/resources/vector_search_indexes/grants/select/output.txt
new file mode 100644
index 00000000000..14fa8a3d48b
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/grants/select/output.txt
@@ -0,0 +1,46 @@
+
+>>> [CLI] bundle plan
+create vector_search_endpoints.my_endpoint
+create vector_search_indexes.my_index
+create vector_search_indexes.my_index.grants
+
+Plan: 3 to add, 0 to change, 0 to delete, 0 unchanged
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/vs-index-grants-[UNIQUE_NAME]/default/files...
+Created vector_search_endpoints.my_endpoint
+Created vector_search_indexes.my_index
+Created vector_search_indexes.my_index.grants
+Files: 0 uploaded, 0 deleted
+Resources: 3 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 3 unchanged
+
+>>> [CLI] grants get table main.default.vs_index_[UNIQUE_NAME]
+{
+  "privilege_assignments": [
+    {
+      "principal": "deco-test-user@databricks.com",
+      "privileges": [
+        "SELECT"
+      ]
+    }
+  ]
+}
+
+>>> print_requests.py //vector-search/indexes //permissions
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.vector_search_endpoints.my_endpoint
+  delete resources.vector_search_indexes.my_index
+
+This action will result in the deletion of the following Vector Search indexes.
+For Delta Sync indexes, the source Delta Table is preserved but the embedding pipeline is removed.
+For Direct Access indexes, all upserted vectors are permanently lost:
+  delete resources.vector_search_indexes.my_index
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/vs-index-grants-[UNIQUE_NAME]/default
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/vector_search_indexes/grants/select/script b/acceptance/bundle/resources/vector_search_indexes/grants/select/script
new file mode 100644
index 00000000000..d6963772f80
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/grants/select/script
@@ -0,0 +1,19 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+index_name="main.default.vs_index_${UNIQUE_NAME}"
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+trace $CLI bundle plan
+
+rm -f "$OUT_REQUESTS"
+trace $CLI bundle deploy
+
+trace $CLI bundle plan
+
+trace $CLI grants get table "${index_name}" | jq --sort-keys
+
+trace print_requests.py '//vector-search/indexes' '//permissions' > out.requests.json
diff --git a/acceptance/bundle/resources/vector_search_indexes/grants/select/test.toml b/acceptance/bundle/resources/vector_search_indexes/grants/select/test.toml
new file mode 100644
index 00000000000..891efdc4e12
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/grants/select/test.toml
@@ -0,0 +1,14 @@
+RecordRequests = true
+
+# The index's only dependent is its own grants child, which needs the index id but not a
+# provisioned index, so the wait is capped here too. Runtime becomes ~2x the cap.
+Env.DATABRICKS_BUNDLE_RESOURCE_MAX_WAIT = "30"
+
+# No longer slow once the wait is capped, so run it on every PR.
+CloudSlow = false
+Cloud = true
+
+# See basic/test.toml: the cap makes deploy warn that it stopped waiting.
+[[Repls]]
+Old = 'Warn: [^\n]*Stopped waiting[^\n]*\n'
+New = ''
diff --git a/acceptance/bundle/resources/vector_search_indexes/recreate/embedding_dimension/databricks.yml.tmpl b/acceptance/bundle/resources/vector_search_indexes/recreate/embedding_dimension/databricks.yml.tmpl
new file mode 100644
index 00000000000..e16993d7019
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/recreate/embedding_dimension/databricks.yml.tmpl
@@ -0,0 +1,22 @@
+bundle:
+  name: deploy-vs-index-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  vector_search_endpoints:
+    my_endpoint:
+      name: vs-endpoint-$UNIQUE_NAME
+      endpoint_type: STANDARD
+  vector_search_indexes:
+    my_index:
+      name: main.default.vs_index_$UNIQUE_NAME
+      endpoint_name: ${resources.vector_search_endpoints.my_endpoint.name}
+      primary_key: id
+      index_type: DIRECT_ACCESS
+      direct_access_index_spec:
+        schema_json: '{"id":"integer","vector":"array<float>"}'
+        embedding_vector_columns:
+          - name: vector
+            embedding_dimension: 768
diff --git a/acceptance/bundle/resources/vector_search_indexes/recreate/embedding_dimension/out.requests.create.json b/acceptance/bundle/resources/vector_search_indexes/recreate/embedding_dimension/out.requests.create.json
new file mode 100644
index 00000000000..880b58413d4
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/recreate/embedding_dimension/out.requests.create.json
@@ -0,0 +1,23 @@
+{
+  "method": "POST",
+  "path": "/api/2.0/vector-search/indexes",
+  "body": {
+    "direct_access_index_spec": {
+      "embedding_vector_columns": [
+        {
+          "embedding_dimension": 768,
+          "name": "vector"
+        }
+      ],
+      "schema_json": "{\"id\":\"integer\",\"vector\":\"array<float>\"}"
+    },
+    "endpoint_name": "vs-endpoint-[UNIQUE_NAME]",
+    "index_type": "DIRECT_ACCESS",
+    "name": "main.default.vs_index_[UNIQUE_NAME]",
+    "primary_key": "id"
+  }
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/vector-search/indexes/main.default.vs_index_[UNIQUE_NAME]"
+}
diff --git a/acceptance/bundle/resources/vector_search_indexes/recreate/embedding_dimension/out.requests.recreate.json b/acceptance/bundle/resources/vector_search_indexes/recreate/embedding_dimension/out.requests.recreate.json
new file mode 100644
index 00000000000..ffce16dd741
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/recreate/embedding_dimension/out.requests.recreate.json
@@ -0,0 +1,35 @@
+{
+  "method": "GET",
+  "path": "/api/2.0/vector-search/indexes/main.default.vs_index_[UNIQUE_NAME]"
+}
+{
+  "method": "DELETE",
+  "path": "/api/2.0/vector-search/indexes/main.default.vs_index_[UNIQUE_NAME]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/vector-search/indexes/main.default.vs_index_[UNIQUE_NAME]"
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/vector-search/indexes",
+  "body": {
+    "direct_access_index_spec": {
+      "embedding_vector_columns": [
+        {
+          "embedding_dimension": 384,
+          "name": "vector"
+        }
+      ],
+      "schema_json": "{\"id\":\"integer\",\"vector\":\"array<float>\"}"
+    },
+    "endpoint_name": "vs-endpoint-[UNIQUE_NAME]",
+    "index_type": "DIRECT_ACCESS",
+    "name": "main.default.vs_index_[UNIQUE_NAME]",
+    "primary_key": "id"
+  }
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/vector-search/indexes/main.default.vs_index_[UNIQUE_NAME]"
+}
diff --git a/acceptance/bundle/resources/vector_search_indexes/recreate/embedding_dimension/out.test.toml b/acceptance/bundle/resources/vector_search_indexes/recreate/embedding_dimension/out.test.toml
new file mode 100644
index 00000000000..8bfa768b35b
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/recreate/embedding_dimension/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = true
+CloudSlow = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/vector_search_indexes/recreate/embedding_dimension/output.txt b/acceptance/bundle/resources/vector_search_indexes/recreate/embedding_dimension/output.txt
new file mode 100644
index 00000000000..cdb909152fd
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/recreate/embedding_dimension/output.txt
@@ -0,0 +1,53 @@
+
+=== Initial deployment
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-vs-index-[UNIQUE_NAME]/default/files...
+Created vector_search_endpoints.my_endpoint
+Created vector_search_indexes.my_index
+Files: 0 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py --get --unique //vector-search/indexes
+
+=== Change embedding_dimension (should trigger recreation)
+>>> update_file.py databricks.yml embedding_dimension: 768 embedding_dimension: 384
+
+>>> [CLI] bundle plan
+recreate vector_search_indexes.my_index
+
+Plan: 1 to add, 0 to change, 1 to delete, 1 unchanged
+
+>>> [CLI] bundle deploy --auto-approve
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-vs-index-[UNIQUE_NAME]/default/files...
+
+This action will result in the deletion or recreation of the following Vector Search indexes.
+Recreating a Delta Sync index re-runs the full embedding pipeline; recreating a Direct Access
+index drops all upserted vectors. Both can be expensive to rebuild:
+  recreate resources.vector_search_indexes.my_index
+Recreated vector_search_indexes.my_index
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 1 unchanged
+
+>>> print_requests.py --get --unique //vector-search/indexes
+
+>>> [CLI] vector-search-indexes get-index main.default.vs_index_[UNIQUE_NAME]
+{
+  "name": "main.default.vs_index_[UNIQUE_NAME]",
+  "endpoint_name": "vs-endpoint-[UNIQUE_NAME]",
+  "index_type": "DIRECT_ACCESS",
+  "primary_key": "id"
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.vector_search_endpoints.my_endpoint
+  delete resources.vector_search_indexes.my_index
+
+This action will result in the deletion of the following Vector Search indexes.
+For Delta Sync indexes, the source Delta Table is preserved but the embedding pipeline is removed.
+For Direct Access indexes, all upserted vectors are permanently lost:
+  delete resources.vector_search_indexes.my_index
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-vs-index-[UNIQUE_NAME]/default
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/vector_search_indexes/recreate/embedding_dimension/script b/acceptance/bundle/resources/vector_search_indexes/recreate/embedding_dimension/script
new file mode 100644
index 00000000000..0bb618e4895
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/recreate/embedding_dimension/script
@@ -0,0 +1,37 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+print_requests() {
+    local name=$1
+    # --get so the GET poll from WaitAfterDelete shows up in the recreate log;
+    # without that, removing the wait would silently still pass against the
+    # testserver (which finishes deletion synchronously) — the GET in the log
+    # is the assertion that the wait actually fired.
+    # --unique collapses the repeated identical poll GETs (one on the testserver,
+    # many on a real workspace that provisions asynchronously) to a stable count.
+    trace print_requests.py --get --unique '//vector-search/indexes' > out.requests.${name}.json
+    rm -f "$OUT_REQUESTS"
+}
+
+title "Initial deployment"
+rm -f "$OUT_REQUESTS"
+trace $CLI bundle deploy
+
+print_requests create
+
+title "Change embedding_dimension (should trigger recreation)"
+trace update_file.py databricks.yml "embedding_dimension: 768" "embedding_dimension: 384"
+
+trace $CLI bundle plan
+rm -f "$OUT_REQUESTS"
+trace $CLI bundle deploy --auto-approve
+
+print_requests recreate
+
+index_name="main.default.vs_index_${UNIQUE_NAME}"
+trace $CLI vector-search-indexes get-index "${index_name}" | jq '{name, endpoint_name, index_type, primary_key}'
diff --git a/acceptance/bundle/resources/vector_search_indexes/recreate/pending_deletion/databricks.yml.tmpl b/acceptance/bundle/resources/vector_search_indexes/recreate/pending_deletion/databricks.yml.tmpl
new file mode 100644
index 00000000000..ba0a3c7f859
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/recreate/pending_deletion/databricks.yml.tmpl
@@ -0,0 +1,24 @@
+bundle:
+  name: deploy-vs-index-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  vector_search_endpoints:
+    my_endpoint:
+      name: vs-endpoint-$UNIQUE_NAME
+      endpoint_type: STANDARD
+  vector_search_indexes:
+    my_index:
+      # The testserver simulates the two-phase backend deletion only for index
+      # names containing vs_index_pending_deletion (indexNamePendingDeletion).
+      name: main.default.vs_index_pending_deletion_$UNIQUE_NAME
+      endpoint_name: ${resources.vector_search_endpoints.my_endpoint.name}
+      primary_key: id
+      index_type: DIRECT_ACCESS
+      direct_access_index_spec:
+        schema_json: '{"id":"integer","vector":"array<float>"}'
+        embedding_vector_columns:
+          - name: vector
+            embedding_dimension: 768
diff --git a/acceptance/bundle/resources/vector_search_indexes/recreate/pending_deletion/out.test.toml b/acceptance/bundle/resources/vector_search_indexes/recreate/pending_deletion/out.test.toml
new file mode 100644
index 00000000000..0eea50f8645
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/recreate/pending_deletion/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+CloudSlow = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/vector_search_indexes/recreate/pending_deletion/output.txt b/acceptance/bundle/resources/vector_search_indexes/recreate/pending_deletion/output.txt
new file mode 100644
index 00000000000..a175c2dcae3
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/recreate/pending_deletion/output.txt
@@ -0,0 +1,92 @@
+
+=== Initial deployment
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-vs-index-[UNIQUE_NAME]/default/files...
+Created vector_search_endpoints.my_endpoint
+Created vector_search_indexes.my_index
+Files: 0 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Change embedding_dimension (recreate: DELETE then CREATE the same name)
+>>> update_file.py databricks.yml embedding_dimension: 768 embedding_dimension: 384
+
+>>> [CLI] bundle deploy --auto-approve
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-vs-index-[UNIQUE_NAME]/default/files...
+
+This action will result in the deletion or recreation of the following Vector Search indexes.
+Recreating a Delta Sync index re-runs the full embedding pipeline; recreating a Direct Access
+index drops all upserted vectors. Both can be expensive to rebuild:
+  recreate resources.vector_search_indexes.my_index
+Recreated vector_search_indexes.my_index
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 1 unchanged
+
+>>> print_requests.py --get //vector-search/indexes
+{
+  "method": "GET",
+  "path": "/api/2.0/vector-search/indexes/main.default.vs_index_pending_deletion_[UNIQUE_NAME]"
+}
+{
+  "method": "DELETE",
+  "path": "/api/2.0/vector-search/indexes/main.default.vs_index_pending_deletion_[UNIQUE_NAME]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/vector-search/indexes/main.default.vs_index_pending_deletion_[UNIQUE_NAME]"
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/vector-search/indexes",
+  "body": {
+    "direct_access_index_spec": {
+      "embedding_vector_columns": [
+        {
+          "embedding_dimension": 384,
+          "name": "vector"
+        }
+      ],
+      "schema_json": "{\"id\":\"integer\",\"vector\":\"array<float>\"}"
+    },
+    "endpoint_name": "vs-endpoint-[UNIQUE_NAME]",
+    "index_type": "DIRECT_ACCESS",
+    "name": "main.default.vs_index_pending_deletion_[UNIQUE_NAME]",
+    "primary_key": "id"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/vector-search/indexes",
+  "body": {
+    "direct_access_index_spec": {
+      "embedding_vector_columns": [
+        {
+          "embedding_dimension": 384,
+          "name": "vector"
+        }
+      ],
+      "schema_json": "{\"id\":\"integer\",\"vector\":\"array<float>\"}"
+    },
+    "endpoint_name": "vs-endpoint-[UNIQUE_NAME]",
+    "index_type": "DIRECT_ACCESS",
+    "name": "main.default.vs_index_pending_deletion_[UNIQUE_NAME]",
+    "primary_key": "id"
+  }
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/vector-search/indexes/main.default.vs_index_pending_deletion_[UNIQUE_NAME]"
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.vector_search_endpoints.my_endpoint
+  delete resources.vector_search_indexes.my_index
+
+This action will result in the deletion of the following Vector Search indexes.
+For Delta Sync indexes, the source Delta Table is preserved but the embedding pipeline is removed.
+For Direct Access indexes, all upserted vectors are permanently lost:
+  delete resources.vector_search_indexes.my_index
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-vs-index-[UNIQUE_NAME]/default
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/vector_search_indexes/recreate/pending_deletion/script b/acceptance/bundle/resources/vector_search_indexes/recreate/pending_deletion/script
new file mode 100644
index 00000000000..738f6a07761
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/recreate/pending_deletion/script
@@ -0,0 +1,23 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+title "Initial deployment"
+trace $CLI bundle deploy
+
+title "Change embedding_dimension (recreate: DELETE then CREATE the same name)"
+trace update_file.py databricks.yml "embedding_dimension: 768" "embedding_dimension: 384"
+
+rm -f "$OUT_REQUESTS"
+trace $CLI bundle deploy --auto-approve
+
+# The name is released only after the index stops being visible on GET, so
+# WaitAfterDelete's poll returns before CREATE is allowed. The first POST here is
+# the rejected one; the second, identical POST is the assertion that createIndex
+# retries instead of failing the deploy — hence no --unique, which would collapse
+# the two into one. --get shows the WaitAfterDelete poll too.
+trace print_requests.py --get //vector-search/indexes
diff --git a/acceptance/bundle/resources/vector_search_indexes/recreate/pending_deletion/test.toml b/acceptance/bundle/resources/vector_search_indexes/recreate/pending_deletion/test.toml
new file mode 100644
index 00000000000..3ed9d70679f
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/recreate/pending_deletion/test.toml
@@ -0,0 +1,2 @@
+# The two-phase deletion race is simulated by the testserver, so this only runs locally.
+Cloud = false
diff --git a/acceptance/bundle/resources/vector_search_indexes/recreate/with_endpoint/databricks.yml.tmpl b/acceptance/bundle/resources/vector_search_indexes/recreate/with_endpoint/databricks.yml.tmpl
new file mode 100644
index 00000000000..33438f1d351
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/recreate/with_endpoint/databricks.yml.tmpl
@@ -0,0 +1,22 @@
+bundle:
+  name: deploy-vs-index-with-endpoint-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  vector_search_endpoints:
+    my_endpoint:
+      name: vs-endpoint-$UNIQUE_NAME
+      endpoint_type: STANDARD
+  vector_search_indexes:
+    my_index:
+      name: main.default.vs_index_$UNIQUE_NAME
+      endpoint_name: ${resources.vector_search_endpoints.my_endpoint.name}
+      primary_key: id
+      index_type: DIRECT_ACCESS
+      direct_access_index_spec:
+        schema_json: '{"id":"integer","vector":"array<float>"}'
+        embedding_vector_columns:
+          - name: vector
+            embedding_dimension: 768
diff --git a/acceptance/bundle/resources/vector_search_indexes/recreate/with_endpoint/out.test.toml b/acceptance/bundle/resources/vector_search_indexes/recreate/with_endpoint/out.test.toml
new file mode 100644
index 00000000000..0eea50f8645
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/recreate/with_endpoint/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+CloudSlow = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/vector_search_indexes/recreate/with_endpoint/output.txt b/acceptance/bundle/resources/vector_search_indexes/recreate/with_endpoint/output.txt
new file mode 100644
index 00000000000..777eace89a2
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/recreate/with_endpoint/output.txt
@@ -0,0 +1,159 @@
+
+=== Initial deployment with STANDARD endpoint_type
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-vs-index-with-endpoint-[UNIQUE_NAME]/default/files...
+Created vector_search_endpoints.my_endpoint
+Created vector_search_indexes.my_index
+Files: 0 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Change endpoint_type (recreates endpoint; index recreate cascade is not yet implemented)
+>>> update_file.py databricks.yml endpoint_type: STANDARD endpoint_type: STORAGE_OPTIMIZED
+
+>>> [CLI] bundle plan
+recreate vector_search_endpoints.my_endpoint
+
+Plan: 1 to add, 0 to change, 1 to delete, 1 unchanged
+
+>>> [CLI] bundle plan --output json
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.vector_search_endpoints.my_endpoint": {
+      "action": "recreate",
+      "new_state": {
+        "value": {
+          "endpoint_type": "STORAGE_OPTIMIZED",
+          "name": "vs-endpoint-[UNIQUE_NAME]"
+        }
+      },
+      "remote_state": {
+        "creation_timestamp": [UNIX_TIME_MILLIS][0],
+        "creator": "[USERNAME]",
+        "endpoint_status": {
+          "state": "ONLINE"
+        },
+        "endpoint_type": "STANDARD",
+        "endpoint_uuid": "[UUID]",
+        "id": "[UUID]",
+        "last_updated_timestamp": [UNIX_TIME_MILLIS][0],
+        "last_updated_user": "[USERNAME]",
+        "name": "vs-endpoint-[UNIQUE_NAME]",
+        "scaling_info": {}
+      },
+      "changes": {
+        "endpoint_type": {
+          "action": "recreate",
+          "reason": "immutable",
+          "old": "STANDARD",
+          "new": "STORAGE_OPTIMIZED",
+          "remote": "STANDARD"
+        }
+      }
+    },
+    "resources.vector_search_indexes.my_index": {
+      "depends_on": [
+        {
+          "node": "resources.vector_search_endpoints.my_endpoint",
+          "label": "${resources.vector_search_endpoints.my_endpoint.name}"
+        }
+      ],
+      "action": "skip",
+      "remote_state": {
+        "creator": "[USERNAME]",
+        "direct_access_index_spec": {
+          "embedding_vector_columns": [
+            {
+              "embedding_dimension": 768,
+              "name": "vector"
+            }
+          ],
+          "schema_json": "{\"id\":\"int\",\"vector\":\"array<float>\"}"
+        },
+        "endpoint_name": "vs-endpoint-[UNIQUE_NAME]",
+        "endpoint_uuid": "[UUID]",
+        "index_subtype": "HYBRID",
+        "index_type": "DIRECT_ACCESS",
+        "name": "main.default.vs_index_[UNIQUE_NAME]",
+        "primary_key": "id",
+        "status": {
+          "ready": true
+        }
+      },
+      "changes": {
+        "direct_access_index_spec.schema_json": {
+          "action": "skip",
+          "reason": "normalized_by_backend",
+          "old": "{\"id\":\"integer\",\"vector\":\"array<float>\"}",
+          "new": "{\"id\":\"integer\",\"vector\":\"array<float>\"}",
+          "remote": "{\"id\":\"int\",\"vector\":\"array<float>\"}"
+        },
+        "endpoint_uuid": {
+          "action": "skip",
+          "reason": "state-only field",
+          "old": "[UUID]",
+          "remote": "[UUID]"
+        },
+        "index_subtype": {
+          "action": "skip",
+          "reason": "immutable_backend_value",
+          "remote": "HYBRID"
+        }
+      }
+    }
+  }
+}
+
+>>> [CLI] bundle deploy --auto-approve
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-vs-index-with-endpoint-[UNIQUE_NAME]/default/files...
+Recreated vector_search_endpoints.my_endpoint
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 1 unchanged
+
+>>> [CLI] vector-search-endpoints get-endpoint vs-endpoint-[UNIQUE_NAME]
+{
+  "name": "vs-endpoint-[UNIQUE_NAME]",
+  "endpoint_type": "STORAGE_OPTIMIZED"
+}
+
+>>> [CLI] vector-search-indexes get-index main.default.vs_index_[UNIQUE_NAME]
+{
+  "name": "main.default.vs_index_[UNIQUE_NAME]",
+  "endpoint_name": "vs-endpoint-[UNIQUE_NAME]",
+  "index_type": "DIRECT_ACCESS",
+  "primary_key": "id"
+}
+
+=== Re-plan exposes the leftover drift: the index still points at the old endpoint UUID
+>>> [CLI] bundle plan
+recreate vector_search_indexes.my_index
+
+Plan: 1 to add, 0 to change, 1 to delete, 1 unchanged
+
+>>> [CLI] bundle deploy --auto-approve
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-vs-index-with-endpoint-[UNIQUE_NAME]/default/files...
+
+This action will result in the deletion or recreation of the following Vector Search indexes.
+Recreating a Delta Sync index re-runs the full embedding pipeline; recreating a Direct Access
+index drops all upserted vectors. Both can be expensive to rebuild:
+  recreate resources.vector_search_indexes.my_index
+Recreated vector_search_indexes.my_index
+Files: 0 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 1 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.vector_search_endpoints.my_endpoint
+  delete resources.vector_search_indexes.my_index
+
+This action will result in the deletion of the following Vector Search indexes.
+For Delta Sync indexes, the source Delta Table is preserved but the embedding pipeline is removed.
+For Direct Access indexes, all upserted vectors are permanently lost:
+  delete resources.vector_search_indexes.my_index
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/deploy-vs-index-with-endpoint-[UNIQUE_NAME]/default
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/vector_search_indexes/recreate/with_endpoint/script b/acceptance/bundle/resources/vector_search_indexes/recreate/with_endpoint/script
new file mode 100644
index 00000000000..9f6b78699f5
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/recreate/with_endpoint/script
@@ -0,0 +1,26 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+title "Initial deployment with STANDARD endpoint_type"
+trace $CLI bundle deploy
+
+title "Change endpoint_type (recreates endpoint; index recreate cascade is not yet implemented)"
+trace update_file.py databricks.yml "endpoint_type: STANDARD" "endpoint_type: STORAGE_OPTIMIZED"
+
+trace $CLI bundle plan
+trace $CLI bundle plan --output json | nostamp
+trace $CLI bundle deploy --auto-approve
+
+# Verify final state of both resources.
+endpoint_name="vs-endpoint-${UNIQUE_NAME}"
+index_name="main.default.vs_index_${UNIQUE_NAME}"
+trace $CLI vector-search-endpoints get-endpoint "${endpoint_name}" | jq '{name, endpoint_type}'
+trace $CLI vector-search-indexes get-index "${index_name}" | jq '{name, endpoint_name, index_type, primary_key}'
+
+title "Re-plan exposes the leftover drift: the index still points at the old endpoint UUID"
+trace $CLI bundle plan
+trace $CLI bundle deploy --auto-approve
diff --git a/acceptance/bundle/resources/vector_search_indexes/recreate/with_endpoint/test.toml b/acceptance/bundle/resources/vector_search_indexes/recreate/with_endpoint/test.toml
new file mode 100644
index 00000000000..5203c9b5338
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/recreate/with_endpoint/test.toml
@@ -0,0 +1,4 @@
+RecordRequests = false
+Cloud = false
+
+Badness = "Recreating a vector_search_endpoint does not cascade to its dependent vector_search_indexes. The first deploy recreates the endpoint and leaves the index attached to a stale endpoint UUID; a second plan/deploy is required to reconcile the index. Follow-up will add a generic per-resource recreate cascade rule to the framework."
diff --git a/acceptance/bundle/resources/vector_search_indexes/schema_normalization/databricks.yml.tmpl b/acceptance/bundle/resources/vector_search_indexes/schema_normalization/databricks.yml.tmpl
new file mode 100644
index 00000000000..d4725692991
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/schema_normalization/databricks.yml.tmpl
@@ -0,0 +1,22 @@
+bundle:
+  name: vs-index-schema-$UNIQUE_NAME
+
+sync:
+  paths: []
+
+resources:
+  vector_search_endpoints:
+    my_endpoint:
+      name: vs-endpoint-$UNIQUE_NAME
+      endpoint_type: STANDARD
+  vector_search_indexes:
+    my_index:
+      name: main.default.vs_index_$UNIQUE_NAME
+      endpoint_name: ${resources.vector_search_endpoints.my_endpoint.name}
+      primary_key: id
+      index_type: DIRECT_ACCESS
+      direct_access_index_spec:
+        schema_json: '{"id":"integer","count":"long","small":"short","tiny":"byte","tags":"array<integer>","score":"float","label":"string","vector":"array<float>"}'
+        embedding_vector_columns:
+          - name: vector
+            embedding_dimension: 768
diff --git a/acceptance/bundle/resources/vector_search_indexes/schema_normalization/out.test.toml b/acceptance/bundle/resources/vector_search_indexes/schema_normalization/out.test.toml
new file mode 100644
index 00000000000..ea4733e76f6
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/schema_normalization/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = true
+CloudSlow = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/vector_search_indexes/schema_normalization/output.txt b/acceptance/bundle/resources/vector_search_indexes/schema_normalization/output.txt
new file mode 100644
index 00000000000..596c188baa7
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/schema_normalization/output.txt
@@ -0,0 +1,27 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/vs-index-schema-[UNIQUE_NAME]/default/files...
+Created vector_search_endpoints.my_endpoint
+Created vector_search_indexes.my_index
+Files: 0 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] vector-search-indexes get-index main.default.vs_index_[UNIQUE_NAME]
+{"count":"bigint","id":"int","label":"string","score":"float","small":"smallint","tags":"array<int>","tiny":"tinyint","vector":"array<float>"}
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.vector_search_endpoints.my_endpoint
+  delete resources.vector_search_indexes.my_index
+
+This action will result in the deletion of the following Vector Search indexes.
+For Delta Sync indexes, the source Delta Table is preserved but the embedding pipeline is removed.
+For Direct Access indexes, all upserted vectors are permanently lost:
+  delete resources.vector_search_indexes.my_index
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/vs-index-schema-[UNIQUE_NAME]/default
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/vector_search_indexes/schema_normalization/script b/acceptance/bundle/resources/vector_search_indexes/schema_normalization/script
new file mode 100644
index 00000000000..dd88932d02c
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/schema_normalization/script
@@ -0,0 +1,18 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+trace $CLI bundle deploy
+
+# The backend (and the test server) rewrite the schema on create, so get-index
+# returns Spark type names, not the config literal. The backend does not
+# guarantee column order, so sort keys to keep this comparison stable.
+index_name="main.default.vs_index_${UNIQUE_NAME}"
+trace $CLI vector-search-indexes get-index "${index_name}" | jq -rcS '.direct_access_index_spec.schema_json | fromjson'
+
+# Re-plan must be a no-op: remote changes to schema_json are ignored
+# (ignore_remote_changes), so the immutable spec does not plan a recreate.
+trace $CLI bundle plan
diff --git a/acceptance/bundle/resources/vector_search_indexes/schema_normalization/test.toml b/acceptance/bundle/resources/vector_search_indexes/schema_normalization/test.toml
new file mode 100644
index 00000000000..7c20b959295
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/schema_normalization/test.toml
@@ -0,0 +1,14 @@
+RecordRequests = false
+# The assertion here is that the *backend* rewrites schema_json into Spark type names, which
+# the test server only mimics, so the cloud run is the one that matters -- see #6352, which
+# removed the superfluous Cloud = false. Inheriting CloudSlow = true left it nightly-only at
+# 12-18 minutes per env, all of it waiting for the index. Nothing here needs a queryable index,
+# only the created spec and a clean re-plan, so cap the wait and run it on every PR instead.
+Cloud = true
+CloudSlow = false
+Env.DATABRICKS_BUNDLE_RESOURCE_MAX_WAIT = "30"
+
+# The cap makes deploy warn that it stopped waiting; see ../basic/test.toml.
+[[Repls]]
+Old = 'Warn: [^\n]*Stopped waiting[^\n]*\n'
+New = ''
diff --git a/acceptance/bundle/resources/vector_search_indexes/test.toml b/acceptance/bundle/resources/vector_search_indexes/test.toml
new file mode 100644
index 00000000000..a5ef9f285f7
--- /dev/null
+++ b/acceptance/bundle/resources/vector_search_indexes/test.toml
@@ -0,0 +1,11 @@
+Cloud = true
+
+# Vector Search indexes are slow to create, so only run them in the nightly (non-short) cloud job.
+CloudSlow = true
+
+# Vector Search indexes are only available in direct mode (no Terraform provider)
+
+Ignore = [
+    "databricks.yml",
+    ".databricks",
+]
diff --git a/acceptance/bundle/resources/volumes/catalog-var-ref/out.test.toml b/acceptance/bundle/resources/volumes/catalog-var-ref/out.test.toml
index e90b6d5d1ba..a927a5fbc06 100644
--- a/acceptance/bundle/resources/volumes/catalog-var-ref/out.test.toml
+++ b/acceptance/bundle/resources/volumes/catalog-var-ref/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/volumes/catalog-var-ref/output.txt b/acceptance/bundle/resources/volumes/catalog-var-ref/output.txt
index e16db7ed268..fc328043bea 100644
--- a/acceptance/bundle/resources/volumes/catalog-var-ref/output.txt
+++ b/acceptance/bundle/resources/volumes/catalog-var-ref/output.txt
@@ -1,6 +1,6 @@
 {
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
   "plan": {
     "resources.catalogs.main_catalog": {
       "action": "create",
diff --git a/acceptance/bundle/resources/volumes/catalog-var-ref/script b/acceptance/bundle/resources/volumes/catalog-var-ref/script
index 7f1b6190766..a8e18ad23b7 100644
--- a/acceptance/bundle/resources/volumes/catalog-var-ref/script
+++ b/acceptance/bundle/resources/volumes/catalog-var-ref/script
@@ -1 +1 @@
-$CLI bundle plan -o json
+$CLI bundle plan -o json | nostamp
diff --git a/acceptance/bundle/resources/volumes/catalog-var-ref/test.toml b/acceptance/bundle/resources/volumes/catalog-var-ref/test.toml
index 613ff598f6b..262a6f41b15 100644
--- a/acceptance/bundle/resources/volumes/catalog-var-ref/test.toml
+++ b/acceptance/bundle/resources/volumes/catalog-var-ref/test.toml
@@ -1,6 +1,2 @@
-Local = true
 Cloud = false
 RecordRequests = false
-
-[EnvMatrix]
-  DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/resources/volumes/change-comment/out.test.toml b/acceptance/bundle/resources/volumes/change-comment/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/volumes/change-comment/out.test.toml
+++ b/acceptance/bundle/resources/volumes/change-comment/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/volumes/change-comment/output.txt b/acceptance/bundle/resources/volumes/change-comment/output.txt
index 51ea42102d1..275ccb5f70d 100644
--- a/acceptance/bundle/resources/volumes/change-comment/output.txt
+++ b/acceptance/bundle/resources/volumes/change-comment/output.txt
@@ -7,20 +7,21 @@
   "modified_status": "created",
   "name": "myvolume",
   "schema_name": "myschema",
+  "volume_path": "/Volumes/main/myschema/myvolume",
   "volume_type": "MANAGED"
 }
 
 === Verify volume does not exist
 >>> musterr [CLI] volumes read main.myschema.myvolume
-Error: Resource catalog.VolumeInfo not found: main.myschema.myvolume
+Error: Volume 'main.myschema.myvolume' does not exist.
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created volumes.volume1
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
->>> print_requests
+>>> print_requests.py //unity
 {
   "method": "POST",
   "path": "/api/2.1/unity-catalog/volumes",
@@ -35,7 +36,7 @@ Deployment complete!
 
 === Summary should now show id and url
 "main.myschema.myvolume"
-"[DATABRICKS_URL]/explore/data/volumes/main/myschema/myvolume?o=[NUMID]"
+"[DATABRICKS_URL]/explore/data/volumes/main/myschema/myvolume?w=[WORKSPACE_ID]"
 
 === Verify deployment
 >>> [CLI] volumes read main.myschema.myvolume
@@ -64,17 +65,18 @@ Deployment complete!
   "id": "main.myschema.myvolume",
   "name": "myvolume",
   "schema_name": "myschema",
-  "url": "[DATABRICKS_URL]/explore/data/volumes/main/myschema/myvolume?o=[NUMID]",
+  "url": "[DATABRICKS_URL]/explore/data/volumes/main/myschema/myvolume?w=[WORKSPACE_ID]",
+  "volume_path": "/Volumes/main/myschema/myvolume",
   "volume_type": "MANAGED"
 }
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated volumes.volume1
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
->>> print_requests
+>>> print_requests.py //unity
 {
   "method": "PATCH",
   "path": "/api/2.1/unity-catalog/volumes/main.myschema.myvolume",
@@ -99,22 +101,22 @@ is removed from the catalog, but the underlying files are not deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
 
->>> print_requests
+>>> print_requests.py //unity
 {
   "method": "DELETE",
   "path": "/api/2.1/unity-catalog/volumes/main.myschema.myvolume"
 }
 
 >>> musterr [CLI] volumes read main.myschema.myvolume
-Error: Resource catalog.VolumeInfo not found: main.myschema.myvolume
+Error: Volume 'main.myschema.myvolume' does not exist.
 {
   "catalog_name": "main",
   "comment": "COMMENT2",
   "modified_status": "created",
   "name": "myvolume",
   "schema_name": "myschema",
+  "volume_path": "/Volumes/main/myschema/myvolume",
   "volume_type": "MANAGED"
 }
diff --git a/acceptance/bundle/resources/volumes/change-comment/script b/acceptance/bundle/resources/volumes/change-comment/script
index aa237582ac3..913d5acdf90 100644
--- a/acceptance/bundle/resources/volumes/change-comment/script
+++ b/acceptance/bundle/resources/volumes/change-comment/script
@@ -6,12 +6,7 @@ trace musterr $CLI volumes read main.myschema.myvolume
 
 trace $CLI bundle deploy
 
-print_requests() {
-    jq 'select(.method != "GET" and (.path | contains("/unity")))' < out.requests.txt
-    rm out.requests.txt
-}
-
-trace print_requests
+trace print_requests.py //unity
 
 title "Summary should now show id and url\n"
 $CLI bundle summary -o json | jq .resources.volumes.volume1.id
@@ -27,15 +22,15 @@ title "Summary should show modified_status=modified and show the same id\n"
 $CLI bundle summary -o json | jq .resources.volumes.volume1
 
 trace $CLI bundle deploy
-trace print_requests
+trace print_requests.py //unity
 
 title "Verify updated deployment: should show new comment"
 trace $CLI volumes read main.myschema.myvolume | jq .comment
 
 trace $CLI bundle destroy --auto-approve
-trace print_requests
+trace print_requests.py //unity
 
 trace musterr $CLI volumes read main.myschema.myvolume
 $CLI bundle summary -o json | jq .resources.volumes.volume1
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/resources/volumes/change-name/out.plan.direct.json b/acceptance/bundle/resources/volumes/change-name/out.plan.direct.json
deleted file mode 100644
index b130d77646b..00000000000
--- a/acceptance/bundle/resources/volumes/change-name/out.plan.direct.json
+++ /dev/null
@@ -1,48 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.volumes.volume1": {
-      "action": "update_id",
-      "new_state": {
-        "value": {
-          "catalog_name": "main",
-          "comment": "COMMENT1",
-          "name": "mynewvolume",
-          "schema_name": "myschema",
-          "volume_type": "MANAGED"
-        }
-      },
-      "remote_state": {
-        "catalog_name": "main",
-        "comment": "COMMENT1",
-        "created_at": [UNIX_TIME_MILLIS][0],
-        "created_by": "[USERNAME]",
-        "full_name": "main.myschema.myvolume",
-        "name": "myvolume",
-        "owner": "[USERNAME]",
-        "schema_name": "myschema",
-        "storage_location": "s3://[METASTORE_NAME]/metastore/[UUID]/volumes/[UUID]",
-        "updated_at": [UNIX_TIME_MILLIS][0],
-        "volume_id": "[UUID]",
-        "volume_type": "MANAGED"
-      },
-      "changes": {
-        "name": {
-          "action": "update_id",
-          "reason": "id_changes",
-          "old": "myvolume",
-          "new": "mynewvolume",
-          "remote": "myvolume"
-        },
-        "storage_location": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "s3://[METASTORE_NAME]/metastore/[UUID]/volumes/[UUID]"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/volumes/change-name/out.plan.json b/acceptance/bundle/resources/volumes/change-name/out.plan.json
new file mode 100644
index 00000000000..eb9308f572b
--- /dev/null
+++ b/acceptance/bundle/resources/volumes/change-name/out.plan.json
@@ -0,0 +1,48 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.volumes.volume1": {
+      "action": "update_id",
+      "new_state": {
+        "value": {
+          "catalog_name": "main",
+          "comment": "COMMENT1",
+          "name": "mynewvolume",
+          "schema_name": "myschema",
+          "volume_type": "MANAGED"
+        }
+      },
+      "remote_state": {
+        "catalog_name": "main",
+        "comment": "COMMENT1",
+        "created_at": [UNIX_TIME_MILLIS][0],
+        "created_by": "[USERNAME]",
+        "full_name": "main.myschema.myvolume",
+        "name": "myvolume",
+        "owner": "[USERNAME]",
+        "schema_name": "myschema",
+        "storage_location": "s3://[METASTORE_NAME]/metastore/[UUID]/volumes/[UUID]",
+        "updated_at": [UNIX_TIME_MILLIS][0],
+        "volume_id": "[UUID]",
+        "volume_type": "MANAGED"
+      },
+      "changes": {
+        "name": {
+          "action": "update_id",
+          "reason": "id_changes",
+          "old": "myvolume",
+          "new": "mynewvolume",
+          "remote": "myvolume"
+        },
+        "storage_location": {
+          "action": "skip",
+          "reason": "immutable_backend_value",
+          "remote": "s3://[METASTORE_NAME]/metastore/[UUID]/volumes/[UUID]"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/volumes/change-name/out.plan.terraform.json b/acceptance/bundle/resources/volumes/change-name/out.plan.terraform.json
deleted file mode 100644
index 42692853c4a..00000000000
--- a/acceptance/bundle/resources/volumes/change-name/out.plan.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.volumes.volume1": {
-      "action": "update"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/volumes/change-name/out.test.toml b/acceptance/bundle/resources/volumes/change-name/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/volumes/change-name/out.test.toml
+++ b/acceptance/bundle/resources/volumes/change-name/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/volumes/change-name/output.txt b/acceptance/bundle/resources/volumes/change-name/output.txt
index e34fadd4a61..417cd36f6fd 100644
--- a/acceptance/bundle/resources/volumes/change-name/output.txt
+++ b/acceptance/bundle/resources/volumes/change-name/output.txt
@@ -1,11 +1,11 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created volumes.volume1
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
->>> print_requests
+>>> print_requests.py //unity
 {
   "method": "POST",
   "path": "/api/2.1/unity-catalog/volumes",
@@ -27,7 +27,8 @@ Deployment complete!
       "id": "main.myschema.myvolume",
       "name": "myvolume",
       "schema_name": "myschema",
-      "url": "[DATABRICKS_URL]/explore/data/volumes/main/myschema/myvolume?o=[NUMID]",
+      "url": "[DATABRICKS_URL]/explore/data/volumes/main/myschema/myvolume?w=[WORKSPACE_ID]",
+      "volume_path": "/Volumes/main/myschema/myvolume",
       "volume_type": "MANAGED"
     }
   }
@@ -43,11 +44,11 @@ Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated volumes.volume1
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
->>> print_requests
+>>> print_requests.py //unity
 {
   "method": "PATCH",
   "path": "/api/2.1/unity-catalog/volumes/main.myschema.myvolume",
@@ -75,4 +76,4 @@ Deployment complete!
 }
 
 >>> musterr [CLI] volumes read main.myschema.myvolume
-Error: Resource catalog.VolumeInfo not found: main.myschema.myvolume
+Error: Volume 'main.myschema.myvolume' does not exist.
diff --git a/acceptance/bundle/resources/volumes/change-name/script b/acceptance/bundle/resources/volumes/change-name/script
index bc012c0a396..e2c2c5ea7ba 100644
--- a/acceptance/bundle/resources/volumes/change-name/script
+++ b/acceptance/bundle/resources/volumes/change-name/script
@@ -1,11 +1,6 @@
 trace $CLI bundle deploy
 
-print_requests() {
-    jq 'select(.method != "GET" and (.path | contains("/unity")))' < out.requests.txt
-    rm out.requests.txt
-}
-
-trace print_requests
+trace print_requests.py //unity
 
 title "Summary should now show id and url\n"
 $CLI bundle summary -o json | jq .resources
@@ -15,10 +10,10 @@ trace update_file.py databricks.yml myvolume mynewvolume
 
 trace $CLI bundle plan
 # terraform marks this as "update", direct marks this as "update_with_id"
-$CLI bundle plan -o json > out.plan.$DATABRICKS_BUNDLE_ENGINE.json
+$CLI bundle plan -o json | nostamp > out.plan.json
 trace $CLI bundle deploy
-trace print_requests
+trace print_requests.py //unity
 
 trace $CLI volumes read main.myschema.mynewvolume
 trace musterr $CLI volumes read main.myschema.myvolume
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/resources/volumes/change-schema-name/out.requests.txt b/acceptance/bundle/resources/volumes/change-schema-name/out.requests.txt
deleted file mode 100644
index 0c03eb00fd1..00000000000
--- a/acceptance/bundle/resources/volumes/change-schema-name/out.requests.txt
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "method": "GET",
-  "path": "/api/2.1/unity-catalog/volumes/main.myschema.myvolume"
-}
-{
-  "method": "GET",
-  "path": "/api/2.1/unity-catalog/volumes/main.myschema.mynewvolume"
-}
diff --git a/acceptance/bundle/resources/volumes/change-schema-name/out.test.toml b/acceptance/bundle/resources/volumes/change-schema-name/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/volumes/change-schema-name/out.test.toml
+++ b/acceptance/bundle/resources/volumes/change-schema-name/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/volumes/change-schema-name/output.txt b/acceptance/bundle/resources/volumes/change-schema-name/output.txt
index 4d5145da9e2..7791b740c98 100644
--- a/acceptance/bundle/resources/volumes/change-schema-name/output.txt
+++ b/acceptance/bundle/resources/volumes/change-schema-name/output.txt
@@ -1,11 +1,11 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created volumes.volume1
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
->>> print_requests
+>>> print_requests.py //unity
 {
   "method": "POST",
   "path": "/api/2.1/unity-catalog/volumes",
@@ -27,7 +27,8 @@ Deployment complete!
       "id": "main.myschema.myvolume",
       "name": "myvolume",
       "schema_name": "myschema",
-      "url": "[DATABRICKS_URL]/explore/data/volumes/main/myschema/myvolume?o=[NUMID]",
+      "url": "[DATABRICKS_URL]/explore/data/volumes/main/myschema/myvolume?w=[WORKSPACE_ID]",
+      "volume_path": "/Volumes/main/myschema/myvolume",
       "volume_type": "MANAGED"
     }
   }
@@ -49,11 +50,11 @@ For managed volumes, the files stored in the volume are also deleted from your
 cloud tenant within 30 days. For external volumes, the metadata about the volume
 is removed from the catalog, but the underlying files are not deleted:
   recreate resources.volumes.volume1
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Recreated volumes.volume1
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 1 deleted, 0 unchanged
 
->>> print_requests
+>>> print_requests.py //unity
 {
   "method": "DELETE",
   "path": "/api/2.1/unity-catalog/volumes/main.myschema.myvolume"
@@ -71,9 +72,9 @@ Deployment complete!
 }
 
 >>> musterr [CLI] volumes read main.myschema.myvolume
-Error: Resource catalog.VolumeInfo not found: main.myschema.myvolume
+Error: Volume 'main.myschema.myvolume' does not exist.
 
 >>> [CLI] volumes read main.myschema.mynewvolume
-Error: Resource catalog.VolumeInfo not found: main.myschema.mynewvolume
+Error: Volume 'main.myschema.mynewvolume' does not exist.
 
 Exit code: 1
diff --git a/acceptance/bundle/resources/volumes/change-schema-name/script b/acceptance/bundle/resources/volumes/change-schema-name/script
index 088998d8b0f..c369e53fff9 100644
--- a/acceptance/bundle/resources/volumes/change-schema-name/script
+++ b/acceptance/bundle/resources/volumes/change-schema-name/script
@@ -1,11 +1,6 @@
 trace $CLI bundle deploy
 
-print_requests() {
-    jq 'select(.method != "GET" and (.path | contains("/unity")))' < out.requests.txt
-    rm out.requests.txt
-}
-
-trace print_requests
+trace print_requests.py //unity
 
 title "Summary should now show id and url\n"
 $CLI bundle summary -o json | jq .resources
@@ -15,8 +10,8 @@ trace update_file.py databricks.yml myschema mynewschema
 
 trace $CLI bundle plan | contains.py recreate
 trace $CLI bundle deploy --auto-approve
-trace print_requests
+trace print_requests.py //unity
 
 trace musterr $CLI volumes read main.myschema.myvolume
 trace $CLI volumes read main.myschema.mynewvolume
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/resources/volumes/comment_out_of_band/databricks.yml.tmpl b/acceptance/bundle/resources/volumes/comment_out_of_band/databricks.yml.tmpl
new file mode 100644
index 00000000000..084b752f4a8
--- /dev/null
+++ b/acceptance/bundle/resources/volumes/comment_out_of_band/databricks.yml.tmpl
@@ -0,0 +1,13 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  schemas:
+    schema1:
+      catalog_name: main
+      name: test-schema-$UNIQUE_NAME
+  volumes:
+    volume1:
+      catalog_name: main
+      schema_name: ${resources.schemas.schema1.name}
+      name: test-volume-$UNIQUE_NAME
diff --git a/acceptance/bundle/resources/volumes/comment_out_of_band/out.test.toml b/acceptance/bundle/resources/volumes/comment_out_of_band/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/volumes/comment_out_of_band/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/volumes/comment_out_of_band/output.txt b/acceptance/bundle/resources/volumes/comment_out_of_band/output.txt
new file mode 100644
index 00000000000..b6619370518
--- /dev/null
+++ b/acceptance/bundle/resources/volumes/comment_out_of_band/output.txt
@@ -0,0 +1,75 @@
+
+=== Deploy a volume that does not declare a comment
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Created schemas.schema1
+Created volumes.volume1
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Set the comment out of band, the way Catalog Explorer does
+=== The remote comment is drift, so the plan updates the volume
+>>> [CLI] bundle plan --output json
+{
+  "comment": {
+    "action": "update",
+    "remote": "set outside the bundle"
+  },
+  "storage_location": {
+    "action": "skip",
+    "reason": "immutable_backend_value",
+    "remote": "s3://[METASTORE_NAME]/metastore/[UUID]/volumes/[UUID]"
+  }
+}
+
+=== Redeploy clears the comment
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Updated volumes.volume1
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 1 unchanged
+
+=== The comment is gone
+>>> [CLI] api get /api/2.1/unity-catalog/volumes/main.test-schema-[UNIQUE_NAME].test-volume-[UNIQUE_NAME]
+""
+
+=== Redeploy is a no-op
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 2 unchanged
+
+=== The UpdateVolume payloads the deploys sent
+>>> print_requests.py --method PATCH //unity-catalog/volumes
+{
+  "method": "PATCH",
+  "path": "/api/2.1/unity-catalog/volumes/main.test-schema-[UNIQUE_NAME].test-volume-[UNIQUE_NAME]",
+  "body": {
+    "comment": "set outside the bundle"
+  }
+}
+{
+  "method": "PATCH",
+  "path": "/api/2.1/unity-catalog/volumes/main.test-schema-[UNIQUE_NAME].test-volume-[UNIQUE_NAME]",
+  "body": {
+    "comment": ""
+  }
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.schemas.schema1
+  delete resources.volumes.volume1
+
+This action will result in the deletion of the following UC schemas. Any underlying data may be lost:
+  delete resources.schemas.schema1
+
+This action will result in the deletion of the following volumes.
+For managed volumes, the files stored in the volume are also deleted from your
+cloud tenant within 30 days. For external volumes, the metadata about the volume
+is removed from the catalog, but the underlying files are not deleted:
+  delete resources.volumes.volume1
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/volumes/comment_out_of_band/script b/acceptance/bundle/resources/volumes/comment_out_of_band/script
new file mode 100644
index 00000000000..64b188acd38
--- /dev/null
+++ b/acceptance/bundle/resources/volumes/comment_out_of_band/script
@@ -0,0 +1,32 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+VOLUME="main.test-schema-${UNIQUE_NAME}.test-volume-${UNIQUE_NAME}"
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+
+    # Consume the destroy's requests so none are left recorded.
+    print_requests.py --method PATCH //unity-catalog/volumes &> LOG.destroy_requests
+}
+trap cleanup EXIT
+
+title "Deploy a volume that does not declare a comment"
+trace $CLI bundle deploy
+
+title "Set the comment out of band, the way Catalog Explorer does"
+MSYS_NO_PATHCONV=1 $CLI api patch "/api/2.1/unity-catalog/volumes/$VOLUME" --json '{"comment":"set outside the bundle"}' > /dev/null
+
+title "The remote comment is drift, so the plan updates the volume"
+trace $CLI bundle plan --output json | nostamp | jq '.plan["resources.volumes.volume1"].changes'
+
+title "Redeploy clears the comment"
+trace $CLI bundle deploy
+
+title "The comment is gone"
+MSYS_NO_PATHCONV=1 trace $CLI api get "/api/2.1/unity-catalog/volumes/$VOLUME" | jq '.comment'
+
+title "Redeploy is a no-op"
+trace $CLI bundle deploy
+
+title "The UpdateVolume payloads the deploys sent"
+trace print_requests.py --method PATCH //unity-catalog/volumes
diff --git a/acceptance/bundle/resources/volumes/comment_out_of_band/test.toml b/acceptance/bundle/resources/volumes/comment_out_of_band/test.toml
new file mode 100644
index 00000000000..bec3515e848
--- /dev/null
+++ b/acceptance/bundle/resources/volumes/comment_out_of_band/test.toml
@@ -0,0 +1,22 @@
+Cloud = true
+
+# UpdateVolume payload construction is direct-engine-specific.
+
+Ignore = [
+    ".databricks",
+    ".gitignore",
+    "databricks.yml",
+]
+
+# The plan records the backend-generated storage_location, whose scheme and bucket differ
+# per cloud. Normalize to the AWS form before the METASTORE_NAME repl, same as
+# grants/volumes/test.toml.
+[[Repls]]
+Old = 'abfss://decotestprod-unity-iso@decotestprodunityiso.dfs.core.windows.net'
+New = 's3://deco-uc-prod-isolated-aws-us-east-1/metastore'
+Order = -1
+
+[[Repls]]
+Old = 'gs://deco-uc-prod-gcp-us-central1-isolated'
+New = 's3://deco-uc-prod-isolated-aws-us-east-1'
+Order = -1
diff --git a/acceptance/bundle/resources/volumes/comment_with_rename/databricks.yml.tmpl b/acceptance/bundle/resources/volumes/comment_with_rename/databricks.yml.tmpl
new file mode 100644
index 00000000000..9c7779e59f2
--- /dev/null
+++ b/acceptance/bundle/resources/volumes/comment_with_rename/databricks.yml.tmpl
@@ -0,0 +1,13 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  schemas:
+    schema1:
+      catalog_name: main
+      name: test-schema-$UNIQUE_NAME
+  volumes:
+    volume1:
+      catalog_name: main
+      schema_name: ${resources.schemas.schema1.name}
+      name: vol_one
diff --git a/acceptance/bundle/resources/volumes/comment_with_rename/out.test.toml b/acceptance/bundle/resources/volumes/comment_with_rename/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/volumes/comment_with_rename/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/volumes/comment_with_rename/output.txt b/acceptance/bundle/resources/volumes/comment_with_rename/output.txt
new file mode 100644
index 00000000000..224755056d0
--- /dev/null
+++ b/acceptance/bundle/resources/volumes/comment_with_rename/output.txt
@@ -0,0 +1,58 @@
+
+=== Deploy a volume that does not declare a comment
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Created schemas.schema1
+Created volumes.volume1
+Files: 2 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Set the comment out of band, then rename the volume in the same deploy
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Updated volumes.volume1
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 1 unchanged
+
+=== The rename and the clear both landed, so it converges in one pass
+>>> [CLI] api get /api/2.1/unity-catalog/volumes/main.test-schema-[UNIQUE_NAME].vol_two
+""
+
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
+
+=== The rename carried the cleared comment alongside new_name
+>>> print_requests.py --method PATCH //unity-catalog/volumes
+{
+  "method": "PATCH",
+  "path": "/api/2.1/unity-catalog/volumes/main.test-schema-[UNIQUE_NAME].vol_one",
+  "body": {
+    "comment": "set outside the bundle"
+  }
+}
+{
+  "method": "PATCH",
+  "path": "/api/2.1/unity-catalog/volumes/main.test-schema-[UNIQUE_NAME].vol_one",
+  "body": {
+    "comment": "",
+    "new_name": "vol_two"
+  }
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.schemas.schema1
+  delete resources.volumes.volume1
+
+This action will result in the deletion of the following UC schemas. Any underlying data may be lost:
+  delete resources.schemas.schema1
+
+This action will result in the deletion of the following volumes.
+For managed volumes, the files stored in the volume are also deleted from your
+cloud tenant within 30 days. For external volumes, the metadata about the volume
+is removed from the catalog, but the underlying files are not deleted:
+  delete resources.volumes.volume1
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/resources/volumes/comment_with_rename/script b/acceptance/bundle/resources/volumes/comment_with_rename/script
new file mode 100644
index 00000000000..d23b0f5f425
--- /dev/null
+++ b/acceptance/bundle/resources/volumes/comment_with_rename/script
@@ -0,0 +1,26 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+VOLUME="main.test-schema-${UNIQUE_NAME}.vol_one"
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+
+    # Consume the destroy's requests so none are left recorded.
+    print_requests.py --method PATCH //unity-catalog/volumes &> LOG.destroy_requests
+}
+trap cleanup EXIT
+
+title "Deploy a volume that does not declare a comment"
+trace $CLI bundle deploy
+
+title "Set the comment out of band, then rename the volume in the same deploy"
+MSYS_NO_PATHCONV=1 $CLI api patch "/api/2.1/unity-catalog/volumes/$VOLUME" --json '{"comment":"set outside the bundle"}' > /dev/null
+update_file.py databricks.yml 'name: vol_one' 'name: vol_two'
+trace $CLI bundle deploy
+
+title "The rename and the clear both landed, so it converges in one pass"
+MSYS_NO_PATHCONV=1 trace $CLI api get "/api/2.1/unity-catalog/volumes/main.test-schema-${UNIQUE_NAME}.vol_two" | jq '.comment'
+trace $CLI bundle plan | contains.py "Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged"
+
+title "The rename carried the cleared comment alongside new_name"
+trace print_requests.py --method PATCH //unity-catalog/volumes
diff --git a/acceptance/bundle/resources/volumes/comment_with_rename/test.toml b/acceptance/bundle/resources/volumes/comment_with_rename/test.toml
new file mode 100644
index 00000000000..b7a6b3114ba
--- /dev/null
+++ b/acceptance/bundle/resources/volumes/comment_with_rename/test.toml
@@ -0,0 +1,9 @@
+Cloud = true
+
+# UpdateVolume payload construction is direct-engine-specific.
+
+Ignore = [
+    ".databricks",
+    ".gitignore",
+    "databricks.yml",
+]
diff --git a/acceptance/bundle/resources/volumes/recreate/out.test.toml b/acceptance/bundle/resources/volumes/recreate/out.test.toml
index 30aca39e5f2..98ccab9aaeb 100644
--- a/acceptance/bundle/resources/volumes/recreate/out.test.toml
+++ b/acceptance/bundle/resources/volumes/recreate/out.test.toml
@@ -1,5 +1,3 @@
-Local = false
 Cloud = true
-RequiresUnityCatalog = true
 RunsOnDbr = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/volumes/recreate/output.txt b/acceptance/bundle/resources/volumes/recreate/output.txt
index 494e9ff538d..fed59b1a868 100644
--- a/acceptance/bundle/resources/volumes/recreate/output.txt
+++ b/acceptance/bundle/resources/volumes/recreate/output.txt
@@ -8,11 +8,7 @@ Workspace:
 
 Validation OK!
 
->>> [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-uc-volumes-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+>>> [CLI] bundle deploy -qq
 
 === Assert the volume is created successfully
 >>> [CLI] volumes read main.schema1-[UNIQUE_NAME].my_volume
@@ -28,7 +24,7 @@ Deployment complete!
 {
   "privilege_assignments": [
     {
-      "principal":"account users",
+      "principal": "account users",
       "privileges": [
         "WRITE_VOLUME"
       ]
@@ -45,23 +41,22 @@ For managed volumes, the files stored in the volume are also deleted from your
 cloud tenant within 30 days. For external volumes, the metadata about the volume
 is removed from the catalog, but the underlying files are not deleted:
   recreate resources.volumes.foo
-Error: the deployment requires destructive actions, but current console does not support prompting. Please specify --auto-approve if you would like to skip prompts and proceed
+Error: the deployment requires destructive actions, but the current console does not support prompting.
+Deleting data assets such as schemas, pipelines, or volumes may cause permanent data loss and should be carefully reviewed.
+To proceed, use --auto-approve after reviewing the plan above.
 
+Files: 0 uploaded, 0 deleted
 
 Exit code: 1
 
 === Successfully recreate the volume with --auto-approve
->>> [CLI] bundle deploy --var=schema_name=${resources.schemas.schema2.name} --auto-approve
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-uc-volumes-[UNIQUE_NAME]/default/files...
+>>> [CLI] bundle deploy --var=schema_name=${resources.schemas.schema2.name} --auto-approve -qq
 
 This action will result in the deletion or recreation of the following volumes.
 For managed volumes, the files stored in the volume are also deleted from your
 cloud tenant within 30 days. For external volumes, the metadata about the volume
 is removed from the catalog, but the underlying files are not deleted:
   recreate resources.volumes.foo
-Deploying resources...
-Updating deployment state...
-Deployment complete!
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
@@ -81,5 +76,4 @@ is removed from the catalog, but the underlying files are not deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-uc-volumes-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 3 deleted
diff --git a/acceptance/bundle/resources/volumes/recreate/script b/acceptance/bundle/resources/volumes/recreate/script
index 79f51d7d49f..5e1b2e779ee 100644
--- a/acceptance/bundle/resources/volumes/recreate/script
+++ b/acceptance/bundle/resources/volumes/recreate/script
@@ -6,7 +6,7 @@ cleanup() {
 trap cleanup EXIT
 
 trace $CLI bundle validate
-trace $CLI bundle deploy
+trace $CLI bundle deploy -qq
 
 title "Assert the volume is created successfully"
 CATALOG_NAME="main"
@@ -22,4 +22,4 @@ title "Recreation of the volume without --auto-approve should fail since prompti
 trace errcode $CLI bundle deploy --var=schema_name='${resources.schemas.schema2.name}'
 
 title "Successfully recreate the volume with --auto-approve"
-trace $CLI bundle deploy --var=schema_name='${resources.schemas.schema2.name}' --auto-approve
+trace $CLI bundle deploy --var=schema_name='${resources.schemas.schema2.name}' --auto-approve -qq
diff --git a/acceptance/bundle/resources/volumes/recreate/test.toml b/acceptance/bundle/resources/volumes/recreate/test.toml
index d02128672ce..4d77b7783c8 100644
--- a/acceptance/bundle/resources/volumes/recreate/test.toml
+++ b/acceptance/bundle/resources/volumes/recreate/test.toml
@@ -1,8 +1,6 @@
-Local = false
 Cloud = true
 RecordRequests = false
 RunsOnDbr = true
-RequiresUnityCatalog = true
 
 Ignore = [
     "databricks.yml",
diff --git a/acceptance/bundle/resources/volumes/remote-change-name/out.plan_create.direct.json b/acceptance/bundle/resources/volumes/remote-change-name/out.plan_create.direct.json
deleted file mode 100644
index 4f44f4f6423..00000000000
--- a/acceptance/bundle/resources/volumes/remote-change-name/out.plan_create.direct.json
+++ /dev/null
@@ -1,17 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.volumes.foo": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "catalog_name": "mycatalog",
-          "name": "myname",
-          "schema_name": "myschema",
-          "volume_type": "MANAGED"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/volumes/remote-change-name/out.plan_create.json b/acceptance/bundle/resources/volumes/remote-change-name/out.plan_create.json
new file mode 100644
index 00000000000..91ed4f65226
--- /dev/null
+++ b/acceptance/bundle/resources/volumes/remote-change-name/out.plan_create.json
@@ -0,0 +1,17 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.volumes.foo": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "catalog_name": "mycatalog",
+          "name": "myname",
+          "schema_name": "myschema",
+          "volume_type": "MANAGED"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/resources/volumes/remote-change-name/out.plan_create.terraform.json b/acceptance/bundle/resources/volumes/remote-change-name/out.plan_create.terraform.json
deleted file mode 100644
index cd79ddf9538..00000000000
--- a/acceptance/bundle/resources/volumes/remote-change-name/out.plan_create.terraform.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.volumes.foo": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/resources/volumes/remote-change-name/out.test.toml b/acceptance/bundle/resources/volumes/remote-change-name/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/volumes/remote-change-name/out.test.toml
+++ b/acceptance/bundle/resources/volumes/remote-change-name/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/volumes/remote-change-name/output.txt b/acceptance/bundle/resources/volumes/remote-change-name/output.txt
index fb8551f5bc4..3bdbb6d7fe5 100644
--- a/acceptance/bundle/resources/volumes/remote-change-name/output.txt
+++ b/acceptance/bundle/resources/volumes/remote-change-name/output.txt
@@ -1,9 +1,9 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created volumes.foo
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] volumes update mycatalog.myschema.myname --json {"new_name": "my_new_name"}
 {
diff --git a/acceptance/bundle/resources/volumes/remote-change-name/script b/acceptance/bundle/resources/volumes/remote-change-name/script
index 2485737fdf4..a509529495e 100644
--- a/acceptance/bundle/resources/volumes/remote-change-name/script
+++ b/acceptance/bundle/resources/volumes/remote-change-name/script
@@ -1,4 +1,4 @@
-$CLI bundle plan -o json > out.plan_create.$DATABRICKS_BUNDLE_ENGINE.json
+$CLI bundle plan -o json | nostamp > out.plan_create.json
 trace $CLI bundle deploy
 
 trace $CLI volumes update mycatalog.myschema.myname --json '{"new_name": "my_new_name"}'
diff --git a/acceptance/bundle/resources/volumes/remote-delete/out.test.toml b/acceptance/bundle/resources/volumes/remote-delete/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/resources/volumes/remote-delete/out.test.toml
+++ b/acceptance/bundle/resources/volumes/remote-delete/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/volumes/remote-delete/output.txt b/acceptance/bundle/resources/volumes/remote-delete/output.txt
index 5758e143d18..9799f34bc69 100644
--- a/acceptance/bundle/resources/volumes/remote-delete/output.txt
+++ b/acceptance/bundle/resources/volumes/remote-delete/output.txt
@@ -1,9 +1,9 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created volumes.foo
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] volumes delete mycatalog.myschema.myname
 
diff --git a/acceptance/bundle/resources/volumes/set-storage-location/out.deploy.direct.txt b/acceptance/bundle/resources/volumes/set-storage-location/out.deploy.direct.txt
deleted file mode 100644
index 00fd1cddacd..00000000000
--- a/acceptance/bundle/resources/volumes/set-storage-location/out.deploy.direct.txt
+++ /dev/null
@@ -1,12 +0,0 @@
-
->>> musterr [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/testbundle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Error: cannot create resources.volumes.volume1: CreateVolume storage_location can not be provided. (400 INVALID_PARAMETER_VALUE)
-
-Endpoint: POST [DATABRICKS_URL]/api/2.1/unity-catalog/volumes
-HTTP Status: 400 Bad Request
-API error_code: INVALID_PARAMETER_VALUE
-API message: CreateVolume storage_location can not be provided.
-
-Updating deployment state...
diff --git a/acceptance/bundle/resources/volumes/set-storage-location/out.deploy.terraform.txt b/acceptance/bundle/resources/volumes/set-storage-location/out.deploy.terraform.txt
deleted file mode 100644
index c79e8d6843c..00000000000
--- a/acceptance/bundle/resources/volumes/set-storage-location/out.deploy.terraform.txt
+++ /dev/null
@@ -1,15 +0,0 @@
-
->>> musterr [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/testbundle-[UNIQUE_NAME]/default/files...
-Deploying resources...
-Error: terraform apply: exit status 1
-
-Error: cannot create volume: CreateVolume storage_location can not be provided.
-
-  with databricks_volume.volume1,
-  on bundle.tf.json line 29, in resource.databricks_volume.volume1:
-  29:       }
-
-
-
-Updating deployment state...
diff --git a/acceptance/bundle/resources/volumes/set-storage-location/out.deploy.txt b/acceptance/bundle/resources/volumes/set-storage-location/out.deploy.txt
new file mode 100644
index 00000000000..d92adb87392
--- /dev/null
+++ b/acceptance/bundle/resources/volumes/set-storage-location/out.deploy.txt
@@ -0,0 +1,12 @@
+
+>>> musterr [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/testbundle-[UNIQUE_NAME]/default/files...
+Created schemas.myschema
+Error: cannot create resources.volumes.volume1: CreateVolume storage_location can not be provided. (400 INVALID_PARAMETER_VALUE)
+
+Endpoint: POST [DATABRICKS_URL]/api/2.1/unity-catalog/volumes
+HTTP Status: 400 Bad Request
+API error_code: INVALID_PARAMETER_VALUE
+API message: CreateVolume storage_location can not be provided.
+
+Files: 3 uploaded, 0 deleted
diff --git a/acceptance/bundle/resources/volumes/set-storage-location/out.test.toml b/acceptance/bundle/resources/volumes/set-storage-location/out.test.toml
index 8c738f635ac..ee153e82621 100644
--- a/acceptance/bundle/resources/volumes/set-storage-location/out.test.toml
+++ b/acceptance/bundle/resources/volumes/set-storage-location/out.test.toml
@@ -1,6 +1,4 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
 CloudEnvs.azure = false
 CloudEnvs.gcp = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/volumes/set-storage-location/output.txt b/acceptance/bundle/resources/volumes/set-storage-location/output.txt
index 7a463920be2..620b16f3859 100644
--- a/acceptance/bundle/resources/volumes/set-storage-location/output.txt
+++ b/acceptance/bundle/resources/volumes/set-storage-location/output.txt
@@ -5,9 +5,9 @@ create volumes.volume1
 
 Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
 
->>> print_requests
+>>> print_requests.py //unity
 
->>> print_requests
+>>> print_requests.py //unity
 {
   "method": "POST",
   "path": "/api/2.1/unity-catalog/schemas",
@@ -38,10 +38,9 @@ This action will result in the deletion of the following UC schemas. Any underly
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/testbundle-[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
 
->>> print_requests
+>>> print_requests.py //unity
 {
   "method": "DELETE",
   "path": "/api/2.1/unity-catalog/schemas/main.testschema-[UNIQUE_NAME]",
diff --git a/acceptance/bundle/resources/volumes/set-storage-location/script b/acceptance/bundle/resources/volumes/set-storage-location/script
index 3ae0d89ae63..84c828500be 100644
--- a/acceptance/bundle/resources/volumes/set-storage-location/script
+++ b/acceptance/bundle/resources/volumes/set-storage-location/script
@@ -1,19 +1,14 @@
-print_requests() {
-    jq 'select(.method != "GET" and (.path | contains("/unity")))' < out.requests.txt
-    rm out.requests.txt
-}
-
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    trace print_requests
+    trace print_requests.py //unity
 }
 
 envsubst < databricks.yml.tmpl > databricks.yml
 
 trace $CLI bundle plan
-trace print_requests
+trace print_requests.py //unity
 
 trap cleanup EXIT
 
-trace musterr $CLI bundle deploy &> out.deploy.$DATABRICKS_BUNDLE_ENGINE.txt
-trace print_requests
+trace musterr $CLI bundle deploy &> out.deploy.txt
+trace print_requests.py //unity
diff --git a/acceptance/bundle/resources/volumes/set-storage-location/test.toml b/acceptance/bundle/resources/volumes/set-storage-location/test.toml
index 80c50954835..b31854427d4 100644
--- a/acceptance/bundle/resources/volumes/set-storage-location/test.toml
+++ b/acceptance/bundle/resources/volumes/set-storage-location/test.toml
@@ -1,6 +1,4 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
 CloudEnvs.gcp = false
 CloudEnvs.azure = false
 Ignore = [
diff --git a/acceptance/bundle/resources/volumes/set-volume-path/databricks.yml b/acceptance/bundle/resources/volumes/set-volume-path/databricks.yml
new file mode 100644
index 00000000000..19b19377fd8
--- /dev/null
+++ b/acceptance/bundle/resources/volumes/set-volume-path/databricks.yml
@@ -0,0 +1,12 @@
+bundle:
+  name: test-bundle
+
+# volume_path is computed and read-only. Setting it explicitly must be rejected
+# rather than silently overwritten with the computed path.
+resources:
+  volumes:
+    volume1:
+      catalog_name: main
+      schema_name: myschema
+      name: myvolume
+      volume_path: /Volumes/bogus/path/set-by-user
diff --git a/acceptance/bundle/resources/volumes/set-volume-path/out.test.toml b/acceptance/bundle/resources/volumes/set-volume-path/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/resources/volumes/set-volume-path/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/resources/volumes/set-volume-path/output.txt b/acceptance/bundle/resources/volumes/set-volume-path/output.txt
new file mode 100644
index 00000000000..a312ea1b1de
--- /dev/null
+++ b/acceptance/bundle/resources/volumes/set-volume-path/output.txt
@@ -0,0 +1,13 @@
+
+>>> errcode [CLI] bundle validate
+Error: resources.volumes.volume1.volume_path is computed and read-only; remove it from the configuration
+
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Found 1 error
+
+Exit code: 1
diff --git a/acceptance/bundle/resources/volumes/set-volume-path/script b/acceptance/bundle/resources/volumes/set-volume-path/script
new file mode 100644
index 00000000000..9ecda517f9b
--- /dev/null
+++ b/acceptance/bundle/resources/volumes/set-volume-path/script
@@ -0,0 +1 @@
+trace errcode $CLI bundle validate
diff --git a/acceptance/bundle/resources/volumes/set-volume-path/test.toml b/acceptance/bundle/resources/volumes/set-volume-path/test.toml
new file mode 100644
index 00000000000..a030353d571
--- /dev/null
+++ b/acceptance/bundle/resources/volumes/set-volume-path/test.toml
@@ -0,0 +1 @@
+RecordRequests = false
diff --git a/acceptance/bundle/resources/volumes/uppercase-name/databricks.yml.tmpl b/acceptance/bundle/resources/volumes/uppercase-name/databricks.yml.tmpl
new file mode 100644
index 00000000000..8cba673167f
--- /dev/null
+++ b/acceptance/bundle/resources/volumes/uppercase-name/databricks.yml.tmpl
@@ -0,0 +1,15 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  schemas:
+    schema1:
+      catalog_name: main
+      name: MySCHEMA_$UNIQUE_NAME
+
+  volumes:
+    vol1:
+      catalog_name: main
+      schema_name: MySCHEMA_$UNIQUE_NAME
+      name: MyVOLUME
+      volume_type: MANAGED
diff --git a/acceptance/bundle/resources/volumes/uppercase-name/out.deploy.txt b/acceptance/bundle/resources/volumes/uppercase-name/out.deploy.txt
new file mode 100644
index 00000000000..bba6a759059
--- /dev/null
+++ b/acceptance/bundle/resources/volumes/uppercase-name/out.deploy.txt
@@ -0,0 +1,61 @@
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Created schemas.schema1
+Created volumes.vol1
+Files: 0 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+{
+  "method": "POST",
+  "path": "/api/2.1/unity-catalog/schemas",
+  "body": {
+    "catalog_name": "main",
+    "name": "MySCHEMA_[UNIQUE_NAME]"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.1/unity-catalog/volumes",
+  "body": {
+    "catalog_name": "main",
+    "name": "MyVOLUME",
+    "schema_name": "MySCHEMA_[UNIQUE_NAME]",
+    "volume_type": "MANAGED"
+  }
+}
+=== Bundle summary shows lowercase IDs after UC normalizes names
+{
+  "schema_id": "main.myschema_[UNIQUE_NAME]",
+  "volume_id": "main.myschema_[UNIQUE_NAME].myvolume"
+}
+=== Plan on no-op redeploy: mixed-case names are skipped, not recreated
+[
+  {
+    "resource": "resources.schemas.schema1",
+    "changes": {
+      "name": {
+        "action": "skip",
+        "reason": "id_field"
+      }
+    }
+  },
+  {
+    "resource": "resources.volumes.vol1",
+    "changes": {
+      "name": {
+        "action": "skip",
+        "reason": "id_changes"
+      },
+      "schema_name": {
+        "action": "skip",
+        "reason": "id_field"
+      },
+      "storage_location": {
+        "action": "skip",
+        "reason": "immutable_backend_value"
+      }
+    }
+  }
+]
+=== Redeploy without changes - should be a no-op
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 2 unchanged
diff --git a/acceptance/bundle/resources/volumes/uppercase-name/out.test.toml b/acceptance/bundle/resources/volumes/uppercase-name/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/resources/volumes/uppercase-name/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/panic/test.toml b/acceptance/bundle/resources/volumes/uppercase-name/output.txt
similarity index 100%
rename from acceptance/panic/test.toml
rename to acceptance/bundle/resources/volumes/uppercase-name/output.txt
diff --git a/acceptance/bundle/resources/volumes/uppercase-name/script b/acceptance/bundle/resources/volumes/uppercase-name/script
new file mode 100644
index 00000000000..37663bb0147
--- /dev/null
+++ b/acceptance/bundle/resources/volumes/uppercase-name/script
@@ -0,0 +1,31 @@
+echo "*" > .gitignore
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    $CLI bundle destroy --auto-approve &> LOG.destroy
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+errcode $CLI bundle deploy &> out.deploy.txt
+print_requests.py //unity-catalog >> out.deploy.txt
+
+echo "=== Bundle summary shows lowercase IDs after UC normalizes names" >> out.deploy.txt
+$CLI bundle summary -o json \
+    | jq '{schema_id: .resources.schemas.schema1.id, volume_id: .resources.volumes.vol1.id}' \
+    >> out.deploy.txt
+
+echo "=== Plan on no-op redeploy: mixed-case names are skipped, not recreated" >> out.deploy.txt
+# UC injects managed-default properties on the schema via an async system write
+# seconds after create, so the schema's `properties` change is present
+# nondeterministically. Prune it with normalize_uc_payload.py before reshaping so
+# the golden is stable. See #6027 and #6040.
+$CLI bundle plan -o json | nostamp \
+    | normalize_uc_payload.py \
+    | jq '.plan | to_entries | map({resource: .key, changes: (.value.changes // {} | map_values({action, reason}))})' \
+    >> out.deploy.txt
+
+echo "=== Redeploy without changes - should be a no-op" >> out.deploy.txt
+# &>> requires bash 4+; macOS CI runs the stock bash 3.2, so use >> ... 2>&1.
+errcode $CLI bundle deploy >> out.deploy.txt 2>&1
+print_requests.py //unity-catalog >> out.deploy.txt
diff --git a/acceptance/bundle/resources/volumes/uppercase-name/test.toml b/acceptance/bundle/resources/volumes/uppercase-name/test.toml
new file mode 100644
index 00000000000..a26bade48d0
--- /dev/null
+++ b/acceptance/bundle/resources/volumes/uppercase-name/test.toml
@@ -0,0 +1,6 @@
+Cloud = true
+
+Ignore = [
+    ".databricks",
+    "databricks.yml",
+]
diff --git a/acceptance/bundle/root/env-not-a-directory/notadir.txt b/acceptance/bundle/root/env-not-a-directory/notadir.txt
new file mode 100644
index 00000000000..c6f4f7ff362
--- /dev/null
+++ b/acceptance/bundle/root/env-not-a-directory/notadir.txt
@@ -0,0 +1 @@
+This file exists so DATABRICKS_BUNDLE_ROOT can point at a non-directory.
diff --git a/acceptance/bundle/root/env-not-a-directory/out.test.toml b/acceptance/bundle/root/env-not-a-directory/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/root/env-not-a-directory/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/root/env-not-a-directory/output.txt b/acceptance/bundle/root/env-not-a-directory/output.txt
new file mode 100644
index 00000000000..8b5cb62e60a
--- /dev/null
+++ b/acceptance/bundle/root/env-not-a-directory/output.txt
@@ -0,0 +1,7 @@
+
+>>> DATABRICKS_BUNDLE_ROOT=notadir.txt [CLI] bundle validate
+Error: Invalid bundle root DATABRICKS_BUNDLE_ROOT="notadir.txt": not a directory
+
+The DATABRICKS_BUNDLE_ROOT environment variable must point to an existing directory that contains a bundle configuration file.
+
+Found 1 error
diff --git a/acceptance/bundle/root/env-not-a-directory/script b/acceptance/bundle/root/env-not-a-directory/script
new file mode 100644
index 00000000000..2e32754f685
--- /dev/null
+++ b/acceptance/bundle/root/env-not-a-directory/script
@@ -0,0 +1,2 @@
+# DATABRICKS_BUNDLE_ROOT points at a file rather than a directory.
+musterr trace DATABRICKS_BUNDLE_ROOT=notadir.txt $CLI bundle validate
diff --git a/acceptance/bundle/root/env-not-found/out.test.toml b/acceptance/bundle/root/env-not-found/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/root/env-not-found/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/root/env-not-found/output.txt b/acceptance/bundle/root/env-not-found/output.txt
new file mode 100644
index 00000000000..96a2b6eaa6a
--- /dev/null
+++ b/acceptance/bundle/root/env-not-found/output.txt
@@ -0,0 +1,7 @@
+
+>>> DATABRICKS_BUNDLE_ROOT=doesnotexist [CLI] bundle validate
+Error: Invalid bundle root DATABRICKS_BUNDLE_ROOT="doesnotexist": stat doesnotexist: no such file or directory
+
+The DATABRICKS_BUNDLE_ROOT environment variable must point to an existing directory that contains a bundle configuration file.
+
+Found 1 error
diff --git a/acceptance/bundle/root/env-not-found/script b/acceptance/bundle/root/env-not-found/script
new file mode 100644
index 00000000000..0ec0aa8be94
--- /dev/null
+++ b/acceptance/bundle/root/env-not-found/script
@@ -0,0 +1,2 @@
+# DATABRICKS_BUNDLE_ROOT points at a path that does not exist: os.Stat fails.
+musterr trace DATABRICKS_BUNDLE_ROOT=doesnotexist $CLI bundle validate
diff --git a/acceptance/bundle/root/env-not-found/test.toml b/acceptance/bundle/root/env-not-found/test.toml
new file mode 100644
index 00000000000..ff98f4a0103
--- /dev/null
+++ b/acceptance/bundle/root/env-not-found/test.toml
@@ -0,0 +1,4 @@
+# Normalize the os.Stat error message from Windows.
+[[Repls]]
+Old = "GetFileAttributesEx doesnotexist: The system cannot find the file specified."
+New = "stat doesnotexist: no such file or directory"
diff --git a/acceptance/bundle/root/not-found/out.test.toml b/acceptance/bundle/root/not-found/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/root/not-found/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/root/not-found/output.txt b/acceptance/bundle/root/not-found/output.txt
new file mode 100644
index 00000000000..92659e3f642
--- /dev/null
+++ b/acceptance/bundle/root/not-found/output.txt
@@ -0,0 +1,8 @@
+
+>>> [CLI] bundle validate
+Error: Unable to locate the bundle root: databricks.yml not found.
+
+Run this command from a directory that contains a bundle, or set the DATABRICKS_BUNDLE_ROOT environment variable to the bundle root directory.
+Alternatively, create a new bundle with 'databricks bundle init'.
+
+Found 1 error
diff --git a/acceptance/bundle/root/not-found/script b/acceptance/bundle/root/not-found/script
new file mode 100644
index 00000000000..2b0f66adc1c
--- /dev/null
+++ b/acceptance/bundle/root/not-found/script
@@ -0,0 +1,2 @@
+# No databricks.yml in this directory or any parent: getRootWithTraversal fails.
+musterr trace $CLI bundle validate
diff --git a/acceptance/bundle/root/real-empty-dir/out.test.toml b/acceptance/bundle/root/real-empty-dir/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/root/real-empty-dir/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/root/real-empty-dir/output.txt b/acceptance/bundle/root/real-empty-dir/output.txt
new file mode 100644
index 00000000000..ef8ba923919
--- /dev/null
+++ b/acceptance/bundle/root/real-empty-dir/output.txt
@@ -0,0 +1,7 @@
+
+>>> DATABRICKS_BUNDLE_ROOT=emptydir [CLI] bundle validate
+Error: Invalid bundle root DATABRICKS_BUNDLE_ROOT="emptydir": databricks.yml not found
+
+The DATABRICKS_BUNDLE_ROOT environment variable must point to an existing directory that contains a bundle configuration file.
+
+Found 1 error
diff --git a/acceptance/bundle/root/real-empty-dir/script b/acceptance/bundle/root/real-empty-dir/script
new file mode 100644
index 00000000000..e533074c03c
--- /dev/null
+++ b/acceptance/bundle/root/real-empty-dir/script
@@ -0,0 +1,3 @@
+# DATABRICKS_BUNDLE_ROOT points at an existing directory that has no databricks.yml.
+mkdir emptydir
+musterr trace DATABRICKS_BUNDLE_ROOT=emptydir $CLI bundle validate
diff --git a/acceptance/bundle/root/real-empty-dir/test.toml b/acceptance/bundle/root/real-empty-dir/test.toml
new file mode 100644
index 00000000000..0ca19575506
--- /dev/null
+++ b/acceptance/bundle/root/real-empty-dir/test.toml
@@ -0,0 +1 @@
+Ignore = ["emptydir"]
diff --git a/acceptance/bundle/root/test.toml b/acceptance/bundle/root/test.toml
new file mode 100644
index 00000000000..35b8cfe69d9
--- /dev/null
+++ b/acceptance/bundle/root/test.toml
@@ -0,0 +1,4 @@
+Cloud = false
+
+# These errors originate in bundle/root.go before any engine is selected,
+# so they are identical for both deployment engines.
diff --git a/acceptance/bundle/run/app-with-job/databricks.yml.tmpl b/acceptance/bundle/run/app-with-job/databricks.yml.tmpl
index 1c98ab3e77d..6715bf28a90 100644
--- a/acceptance/bundle/run/app-with-job/databricks.yml.tmpl
+++ b/acceptance/bundle/run/app-with-job/databricks.yml.tmpl
@@ -30,6 +30,7 @@ resources:
             num_workers: 1
             spark_version: $DEFAULT_SPARK_VERSION
             node_type_id: $NODE_TYPE_ID
+            instance_pool_id: $TEST_INSTANCE_POOL_ID
             data_security_mode: USER_ISOLATION
           spark_python_task:
             python_file: ./hello_world.py
diff --git a/acceptance/bundle/run/app-with-job/out.test.toml b/acceptance/bundle/run/app-with-job/out.test.toml
index 9ff781c1f13..8bfa768b35b 100644
--- a/acceptance/bundle/run/app-with-job/out.test.toml
+++ b/acceptance/bundle/run/app-with-job/out.test.toml
@@ -1,4 +1,3 @@
-Local = false
 Cloud = true
 CloudSlow = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run/app-with-job/output.txt b/acceptance/bundle/run/app-with-job/output.txt
index 19594302a86..e57ad4ae313 100644
--- a/acceptance/bundle/run/app-with-job/output.txt
+++ b/acceptance/bundle/run/app-with-job/output.txt
@@ -10,9 +10,10 @@ Validation OK!
 
 >>> [CLI] bundle deploy --force-lock --auto-approve
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/app-with-job-[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created apps.test_app
+Created jobs.foo
+Files: 5 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 === App should exist after bundle deployment
 >>> [CLI] apps get app-[UNIQUE_NAME]
@@ -36,7 +37,7 @@ env:
 
 === Try to run the app
 
->>> cat out.app-run
+>>> cat LOG.run.txt
 
 === App should be in the running state
 >>> [CLI] apps get app-[UNIQUE_NAME]
@@ -70,7 +71,7 @@ env:
 
 === Try to run the app again
 
->>> cat out.app-run
+>>> cat LOG.run.txt
 
 === App should be in the running state
 >>> [CLI] apps get app-[UNIQUE_NAME]
@@ -84,9 +85,8 @@ env:
 === Redeploy it again just to check that it can be redeployed
 >>> [CLI] bundle deploy --force-lock --auto-approve
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/app-with-job-[UNIQUE_NAME]/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 2 unchanged
 
 >>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
@@ -95,5 +95,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/app-with-job-[UNIQUE_NAME]
 
-Deleting files...
-Destroy complete!
+Destroy: 2 deleted
diff --git a/acceptance/bundle/run/app-with-job/script b/acceptance/bundle/run/app-with-job/script
index c340f796c43..f0b41a2881e 100644
--- a/acceptance/bundle/run/app-with-job/script
+++ b/acceptance/bundle/run/app-with-job/script
@@ -2,7 +2,6 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm out.app-run
 }
 trap cleanup EXIT
 
@@ -17,8 +16,8 @@ title "Check app config"
 trace $CLI workspace export "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/app-with-job-${UNIQUE_NAME}/files/app/app.yml"
 
 title "Try to run the app\n"
-$CLI bundle run test_app &> out.app-run
-trace cat out.app-run | grep -q "${APP_URL}"
+$CLI bundle run test_app &> LOG.run.txt
+trace cat LOG.run.txt | grep -q "${APP_URL}"
 
 title "App should be in the running state"
 trace $CLI apps get "app-${UNIQUE_NAME}" | jq '{app_status}'
@@ -28,8 +27,8 @@ trace $CLI apps stop "app-${UNIQUE_NAME}" | jq '{compute_status}'
 trace $CLI apps get "app-${UNIQUE_NAME}" | jq '{app_status,compute_status}'
 
 title "Try to run the app again\n"
-$CLI bundle run test_app &> out.app-run
-trace cat out.app-run | grep -q "${APP_URL}"
+$CLI bundle run test_app &> LOG.run.txt
+trace cat LOG.run.txt | grep -q "${APP_URL}"
 
 title "App should be in the running state"
 trace $CLI apps get "app-${UNIQUE_NAME}" | jq '{app_status}'
diff --git a/acceptance/bundle/run/app-with-job/test.toml b/acceptance/bundle/run/app-with-job/test.toml
index 61735428b3c..beead4f5cb0 100644
--- a/acceptance/bundle/run/app-with-job/test.toml
+++ b/acceptance/bundle/run/app-with-job/test.toml
@@ -1,5 +1,3 @@
-Local = false
-
 #
 # On June 18 2025 it was taking:
 # - 160-180 seconds to start an application in this test
@@ -7,14 +5,14 @@ Local = false
 # - 10-20 seconds to deploy the bundle
 # This test includes 2 application starts, and it is taking aroung 420 seconds to complete the entire test
 #
+Cloud = true
 CloudSlow = true
 
 Ignore = [
     'databricks.yml',
 ]
 
-[Env]
 # MSYS2 automatically converts absolute paths like /Users/$username/$UNIQUE_NAME to
 # C:/Program Files/Git/Users/$username/UNIQUE_NAME before passing it to the CLI
 # Setting this environment variable prevents that conversion on windows.
-MSYS_NO_PATHCONV = "1"
+Env.MSYS_NO_PATHCONV = "1"
diff --git a/acceptance/bundle/run/basic/out.test.toml b/acceptance/bundle/run/basic/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run/basic/out.test.toml
+++ b/acceptance/bundle/run/basic/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run/basic/output.txt b/acceptance/bundle/run/basic/output.txt
index 5c3d3c4d12a..9ae6068709a 100644
--- a/acceptance/bundle/run/basic/output.txt
+++ b/acceptance/bundle/run/basic/output.txt
@@ -8,15 +8,16 @@ Exit code: 1
 === deploy and run resource
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/caterpillar/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.foo
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle run foo
-Run URL: [DATABRICKS_URL]/?o=[NUMID]#job/[NUMID]/run/[NUMID]
+Run URL: [DATABRICKS_URL]/jobs/[FOO_ID]/runs/[RUN_ID]?o=[WORKSPACE_ID]
 
 [TIMESTAMP] "foo" RUNNING
 [TIMESTAMP] "foo" TERMINATED SUCCESS
+1
 
 === no resource key with --
 >>> [CLI] bundle run --
@@ -26,10 +27,11 @@ Exit code: 1
 
 === resource key with parameters
 >>> [CLI] bundle run foo -- arg1 arg2
-Run URL: [DATABRICKS_URL]/?o=[NUMID]#job/[NUMID]/run/[NUMID]
+Run URL: [DATABRICKS_URL]/jobs/[FOO_ID]/runs/[RUN_ID]?o=[WORKSPACE_ID]
 
 [TIMESTAMP] "foo" RUNNING
 [TIMESTAMP] "foo" TERMINATED SUCCESS
+1
 
 === inline script
 >>> [CLI] bundle run -- echo hello
diff --git a/acceptance/bundle/run/basic/script b/acceptance/bundle/run/basic/script
index a7f6d361924..29fa197375b 100644
--- a/acceptance/bundle/run/basic/script
+++ b/acceptance/bundle/run/basic/script
@@ -3,6 +3,7 @@ errcode trace $CLI bundle run
 
 title "deploy and run resource"
 errcode trace $CLI bundle deploy
+replace_ids.py
 
 errcode trace $CLI bundle run foo
 
diff --git a/acceptance/bundle/run/basic/test.toml b/acceptance/bundle/run/basic/test.toml
new file mode 100644
index 00000000000..3c887dd20bf
--- /dev/null
+++ b/acceptance/bundle/run/basic/test.toml
@@ -0,0 +1,3 @@
+[[Repls]]
+Old = '/runs/\d+'
+New = '/runs/[RUN_ID]'
diff --git a/acceptance/bundle/run/development-mode-changes/databricks.yml b/acceptance/bundle/run/development-mode-changes/databricks.yml
new file mode 100644
index 00000000000..43e44abe912
--- /dev/null
+++ b/acceptance/bundle/run/development-mode-changes/databricks.yml
@@ -0,0 +1,21 @@
+bundle:
+  name: test-pipeline-dev-mode-changes
+
+resources:
+  pipelines:
+    my_pipeline:
+      name: test-pipeline-dev-mode-changes
+      libraries:
+        - file:
+            path: pipeline_file.py
+
+targets:
+  dev_false:
+    mode: development
+    resources:
+      pipelines:
+        my_pipeline:
+          development: false
+  switch_to_dev: {}
+  switch_from_dev: {mode: development}
+  ui_toggle: {mode: development}
diff --git a/acceptance/bundle/run/development-mode-changes/out.test.toml b/acceptance/bundle/run/development-mode-changes/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/run/development-mode-changes/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run/development-mode-changes/output.txt b/acceptance/bundle/run/development-mode-changes/output.txt
new file mode 100644
index 00000000000..c238681ff50
--- /dev/null
+++ b/acceptance/bundle/run/development-mode-changes/output.txt
@@ -0,0 +1,105 @@
+
+=== mode: development with pipeline development: false: deploy and run both use development: true
+>>> [CLI] bundle deploy -t dev_false
+Warning: The "development" property of pipelines is deprecated. Use "mode: development" in your databricks.yml instead. See https://docs.databricks.com/dev-tools/bundles/deployment-modes.
+  at resources.pipelines.my_pipeline.development
+  in databricks.yml:18:24
+
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-pipeline-dev-mode-changes/dev_false/files...
+Created pipelines.my_pipeline
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //pipelines
+{
+  "path": "/api/2.0/pipelines",
+  "development": true
+}
+
+>>> [CLI] bundle run my_pipeline -t dev_false
+Warning: The "development" property of pipelines is deprecated. Use "mode: development" in your databricks.yml instead. See https://docs.databricks.com/dev-tools/bundles/deployment-modes.
+  at resources.pipelines.my_pipeline.development
+  in databricks.yml:18:24
+
+Update URL: [DATABRICKS_URL]/#joblist/pipelines/[UUID]/updates/[UUID]
+
+Update ID: [UUID]
+
+>>> print_requests.py //pipelines
+{
+  "method": "POST",
+  "path": "/api/2.0/pipelines/[UUID]/updates",
+  "body": {
+    "development": true
+  }
+}
+
+=== Switched to mode: development without redeploying: run sends development: true
+>>> [CLI] bundle deploy -t switch_to_dev
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-pipeline-dev-mode-changes/switch_to_dev/files...
+Created pipelines.my_pipeline
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> update_file.py databricks.yml switch_to_dev: {} switch_to_dev: {mode: development}
+
+>>> [CLI] bundle run my_pipeline -t switch_to_dev
+Update URL: [DATABRICKS_URL]/#joblist/pipelines/[UUID]/updates/[UUID]
+
+Update ID: [UUID]
+
+>>> print_requests.py //pipelines
+{
+  "method": "POST",
+  "path": "/api/2.0/pipelines/[UUID]/updates",
+  "body": {
+    "development": true
+  }
+}
+
+=== Switched away from mode: development without redeploying: run does not send development
+>>> [CLI] bundle deploy -t switch_from_dev
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-pipeline-dev-mode-changes/switch_from_dev/files...
+Created pipelines.my_pipeline
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> update_file.py databricks.yml switch_from_dev: {mode: development} switch_from_dev: {}
+
+>>> [CLI] bundle run my_pipeline -t switch_from_dev
+Update URL: [DATABRICKS_URL]/#joblist/pipelines/[UUID]/updates/[UUID]
+
+Update ID: [UUID]
+
+>>> print_requests.py //pipelines
+{
+  "method": "POST",
+  "path": "/api/2.0/pipelines/[UUID]/updates",
+  "body": {}
+}
+
+=== Pipeline switched to production outside the bundle: run on a development target sends development: true
+>>> [CLI] bundle deploy -t ui_toggle
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-pipeline-dev-mode-changes/ui_toggle/files...
+Created pipelines.my_pipeline
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> DATABRICKS_BUNDLE_TARGET=ui_toggle edit_resource.py pipelines [MY_PIPELINE_ID]
+
+>>> DATABRICKS_BUNDLE_TARGET=ui_toggle [CLI] pipelines get [MY_PIPELINE_ID]
+false
+
+>>> [CLI] bundle run my_pipeline -t ui_toggle
+Update URL: [DATABRICKS_URL]/#joblist/pipelines/[MY_PIPELINE_ID]/updates/[UUID]
+
+Update ID: [UUID]
+
+>>> print_requests.py //pipelines
+{
+  "method": "POST",
+  "path": "/api/2.0/pipelines/[MY_PIPELINE_ID]/updates",
+  "body": {
+    "development": true
+  }
+}
diff --git a/acceptance/bundle/run/development-mode-changes/pipeline_file.py b/acceptance/bundle/run/development-mode-changes/pipeline_file.py
new file mode 100644
index 00000000000..aa0c44e3f6d
--- /dev/null
+++ b/acceptance/bundle/run/development-mode-changes/pipeline_file.py
@@ -0,0 +1,7 @@
+import dlt
+from pyspark.sql import SparkSession
+
+
+@dlt.table
+def my_table():
+    return spark.range(10)
diff --git a/acceptance/bundle/run/development-mode-changes/script b/acceptance/bundle/run/development-mode-changes/script
new file mode 100644
index 00000000000..f4523c4a0e3
--- /dev/null
+++ b/acceptance/bundle/run/development-mode-changes/script
@@ -0,0 +1,31 @@
+title "mode: development with pipeline development: false: deploy and run both use development: true"
+trace $CLI bundle deploy -t dev_false
+trace print_requests.py //pipelines | jq '{path, development: .body.development}'
+trace $CLI bundle run my_pipeline -t dev_false
+trace print_requests.py //pipelines
+
+title "Switched to mode: development without redeploying: run sends development: true"
+trace $CLI bundle deploy -t switch_to_dev
+rm "$OUT_REQUESTS"
+trace update_file.py databricks.yml "switch_to_dev: {}" "switch_to_dev: {mode: development}"
+trace $CLI bundle run my_pipeline -t switch_to_dev
+trace print_requests.py //pipelines
+
+title "Switched away from mode: development without redeploying: run does not send development"
+trace $CLI bundle deploy -t switch_from_dev
+rm "$OUT_REQUESTS"
+trace update_file.py databricks.yml "switch_from_dev: {mode: development}" "switch_from_dev: {}"
+trace $CLI bundle run my_pipeline -t switch_from_dev
+trace print_requests.py //pipelines
+
+title "Pipeline switched to production outside the bundle: run on a development target sends development: true"
+trace $CLI bundle deploy -t ui_toggle
+pipeline_id="$($CLI bundle summary -t ui_toggle -o json | jq -r '.resources.pipelines.my_pipeline.id')"
+add_repl "$pipeline_id" MY_PIPELINE_ID
+trace DATABRICKS_BUNDLE_TARGET=ui_toggle edit_resource.py pipelines "$pipeline_id" <<EOT
+r["development"] = False
+EOT
+trace DATABRICKS_BUNDLE_TARGET=ui_toggle $CLI pipelines get "$pipeline_id" | jq '.spec.development'
+rm "$OUT_REQUESTS"
+trace $CLI bundle run my_pipeline -t ui_toggle
+trace print_requests.py //pipelines
diff --git a/acceptance/bundle/run/development-mode-changes/test.toml b/acceptance/bundle/run/development-mode-changes/test.toml
new file mode 100644
index 00000000000..159efe02696
--- /dev/null
+++ b/acceptance/bundle/run/development-mode-changes/test.toml
@@ -0,0 +1 @@
+RecordRequests = true
diff --git a/acceptance/bundle/run/development-mode/databricks.yml b/acceptance/bundle/run/development-mode/databricks.yml
new file mode 100644
index 00000000000..020fa98d2e0
--- /dev/null
+++ b/acceptance/bundle/run/development-mode/databricks.yml
@@ -0,0 +1,20 @@
+bundle:
+  name: test-pipeline-dev-mode
+
+resources:
+  pipelines:
+    my_pipeline:
+      name: test-pipeline-dev-mode
+      libraries:
+        - file:
+            path: pipeline_file.py
+
+targets:
+  prod:
+    default: true
+  dev:
+    mode: development
+  dev_preset_off:
+    mode: development
+    presets:
+      pipelines_development: false
diff --git a/acceptance/bundle/run/development-mode/out.test.toml b/acceptance/bundle/run/development-mode/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/run/development-mode/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run/development-mode/output.txt b/acceptance/bundle/run/development-mode/output.txt
new file mode 100644
index 00000000000..aae6f729a98
--- /dev/null
+++ b/acceptance/bundle/run/development-mode/output.txt
@@ -0,0 +1,83 @@
+
+=== Production target: update does not send development
+>>> [CLI] bundle deploy -t prod
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-pipeline-dev-mode/prod/files...
+Created pipelines.my_pipeline
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] bundle run my_pipeline -t prod
+Update URL: [DATABRICKS_URL]/#joblist/pipelines/[UUID]/updates/[UUID]
+
+Update ID: [UUID]
+
+>>> print_requests.py //pipelines
+{
+  "method": "POST",
+  "path": "/api/2.0/pipelines/[UUID]/updates",
+  "body": {}
+}
+
+=== Development target: update sends development: true
+>>> [CLI] bundle deploy -t dev
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-pipeline-dev-mode/dev/files...
+Created pipelines.my_pipeline
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] bundle run my_pipeline -t dev
+Update URL: [DATABRICKS_URL]/#joblist/pipelines/[UUID]/updates/[UUID]
+
+Update ID: [UUID]
+
+>>> print_requests.py //pipelines
+{
+  "method": "POST",
+  "path": "/api/2.0/pipelines/[UUID]/updates",
+  "body": {
+    "development": true
+  }
+}
+
+=== Development target via pipelines run: update sends development: true
+>>> [CLI] pipelines run my_pipeline -t dev
+Recommendation: This command runs the last deployed version of the code
+
+If you've made local changes, run 'databricks pipelines deploy' first to ensure they are included.
+
+Update URL: [DATABRICKS_URL]/#joblist/pipelines/[UUID]/updates/[UUID]
+
+Update ID: [UUID]
+
+Update for pipeline completed successfully.
+
+Pipeline configurations for this update:
+• All tables are refreshed
+
+>>> print_requests.py //pipelines
+{
+  "method": "POST",
+  "path": "/api/2.0/pipelines/[UUID]/updates",
+  "body": {
+    "development": true
+  }
+}
+
+=== Development target with pipelines_development preset disabled: update does not send development
+>>> [CLI] bundle deploy -t dev_preset_off
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-pipeline-dev-mode/dev_preset_off/files...
+Created pipelines.my_pipeline
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] bundle run my_pipeline -t dev_preset_off
+Update URL: [DATABRICKS_URL]/#joblist/pipelines/[UUID]/updates/[UUID]
+
+Update ID: [UUID]
+
+>>> print_requests.py //pipelines
+{
+  "method": "POST",
+  "path": "/api/2.0/pipelines/[UUID]/updates",
+  "body": {}
+}
diff --git a/acceptance/bundle/run/development-mode/pipeline_file.py b/acceptance/bundle/run/development-mode/pipeline_file.py
new file mode 100644
index 00000000000..aa0c44e3f6d
--- /dev/null
+++ b/acceptance/bundle/run/development-mode/pipeline_file.py
@@ -0,0 +1,7 @@
+import dlt
+from pyspark.sql import SparkSession
+
+
+@dlt.table
+def my_table():
+    return spark.range(10)
diff --git a/acceptance/bundle/run/development-mode/script b/acceptance/bundle/run/development-mode/script
new file mode 100644
index 00000000000..5e11d0053be
--- /dev/null
+++ b/acceptance/bundle/run/development-mode/script
@@ -0,0 +1,21 @@
+title "Production target: update does not send development"
+trace $CLI bundle deploy -t prod
+rm "$OUT_REQUESTS"
+trace $CLI bundle run my_pipeline -t prod
+trace print_requests.py //pipelines
+
+title "Development target: update sends development: true"
+trace $CLI bundle deploy -t dev
+rm "$OUT_REQUESTS"
+trace $CLI bundle run my_pipeline -t dev
+trace print_requests.py //pipelines
+
+title "Development target via pipelines run: update sends development: true"
+trace $CLI pipelines run my_pipeline -t dev
+trace print_requests.py //pipelines
+
+title "Development target with pipelines_development preset disabled: update does not send development"
+trace $CLI bundle deploy -t dev_preset_off
+rm "$OUT_REQUESTS"
+trace $CLI bundle run my_pipeline -t dev_preset_off
+trace print_requests.py //pipelines
diff --git a/acceptance/bundle/run/development-mode/test.toml b/acceptance/bundle/run/development-mode/test.toml
new file mode 100644
index 00000000000..159efe02696
--- /dev/null
+++ b/acceptance/bundle/run/development-mode/test.toml
@@ -0,0 +1 @@
+RecordRequests = true
diff --git a/acceptance/bundle/run/development-override/databricks.yml b/acceptance/bundle/run/development-override/databricks.yml
new file mode 100644
index 00000000000..b2fd0b96c07
--- /dev/null
+++ b/acceptance/bundle/run/development-override/databricks.yml
@@ -0,0 +1,15 @@
+bundle:
+  name: test-pipeline-dev-override
+
+resources:
+  pipelines:
+    my_pipeline:
+      name: test-pipeline-dev-override
+      development: true
+      libraries:
+        - file:
+            path: pipeline_file.py
+
+targets:
+  prod:
+    default: true
diff --git a/acceptance/bundle/run/development-override/out.test.toml b/acceptance/bundle/run/development-override/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/run/development-override/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run/development-override/output.txt b/acceptance/bundle/run/development-override/output.txt
new file mode 100644
index 00000000000..7110012790f
--- /dev/null
+++ b/acceptance/bundle/run/development-override/output.txt
@@ -0,0 +1,34 @@
+
+=== Deploy warns about the deprecated property and passes development: true through
+>>> [CLI] bundle deploy
+Warning: The "development" property of pipelines is deprecated. Use "mode: development" in your databricks.yml instead. See https://docs.databricks.com/dev-tools/bundles/deployment-modes.
+  at resources.pipelines.my_pipeline.development
+  in databricks.yml:8:20
+
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-pipeline-dev-override/prod/files...
+Created pipelines.my_pipeline
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //pipelines
+{
+  "path": "/api/2.0/pipelines",
+  "development": true
+}
+
+=== Run on a non-development target does not send development; the pipeline-level value applies
+>>> [CLI] bundle run my_pipeline
+Warning: The "development" property of pipelines is deprecated. Use "mode: development" in your databricks.yml instead. See https://docs.databricks.com/dev-tools/bundles/deployment-modes.
+  at resources.pipelines.my_pipeline.development
+  in databricks.yml:8:20
+
+Update URL: [DATABRICKS_URL]/#joblist/pipelines/[UUID]/updates/[UUID]
+
+Update ID: [UUID]
+
+>>> print_requests.py //pipelines
+{
+  "method": "POST",
+  "path": "/api/2.0/pipelines/[UUID]/updates",
+  "body": {}
+}
diff --git a/acceptance/bundle/run/development-override/pipeline_file.py b/acceptance/bundle/run/development-override/pipeline_file.py
new file mode 100644
index 00000000000..aa0c44e3f6d
--- /dev/null
+++ b/acceptance/bundle/run/development-override/pipeline_file.py
@@ -0,0 +1,7 @@
+import dlt
+from pyspark.sql import SparkSession
+
+
+@dlt.table
+def my_table():
+    return spark.range(10)
diff --git a/acceptance/bundle/run/development-override/script b/acceptance/bundle/run/development-override/script
new file mode 100644
index 00000000000..a47250dff01
--- /dev/null
+++ b/acceptance/bundle/run/development-override/script
@@ -0,0 +1,7 @@
+title "Deploy warns about the deprecated property and passes development: true through"
+trace $CLI bundle deploy
+trace print_requests.py //pipelines | jq '{path, development: .body.development}'
+
+title "Run on a non-development target does not send development; the pipeline-level value applies"
+trace $CLI bundle run my_pipeline
+trace print_requests.py //pipelines
diff --git a/acceptance/bundle/run/development-override/test.toml b/acceptance/bundle/run/development-override/test.toml
new file mode 100644
index 00000000000..159efe02696
--- /dev/null
+++ b/acceptance/bundle/run/development-override/test.toml
@@ -0,0 +1 @@
+RecordRequests = true
diff --git a/acceptance/bundle/run/diagnostics/out.test.toml b/acceptance/bundle/run/diagnostics/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run/diagnostics/out.test.toml
+++ b/acceptance/bundle/run/diagnostics/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run/inline-script/basic/out.test.toml b/acceptance/bundle/run/inline-script/basic/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run/inline-script/basic/out.test.toml
+++ b/acceptance/bundle/run/inline-script/basic/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run/inline-script/cwd/out.test.toml b/acceptance/bundle/run/inline-script/cwd/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run/inline-script/cwd/out.test.toml
+++ b/acceptance/bundle/run/inline-script/cwd/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run/inline-script/databricks-cli/profile-is-passed/from_flag/out.requests.txt b/acceptance/bundle/run/inline-script/databricks-cli/profile-is-passed/from_flag/out.requests.txt
deleted file mode 100644
index 0c01e54a7b1..00000000000
--- a/acceptance/bundle/run/inline-script/databricks-cli/profile-is-passed/from_flag/out.requests.txt
+++ /dev/null
@@ -1,41 +0,0 @@
-{
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "method": "GET",
-  "path": "/oidc/.well-known/oauth-authorization-server"
-}
-{
-  "headers": {
-    "Authorization": [
-      "Basic [ENCODED_AUTH]"
-    ]
-  },
-  "method": "POST",
-  "path": "/oidc/v1/token",
-  "raw_body": "grant_type=client_credentials\u0026scope=all-apis"
-}
-{
-  "method": "GET",
-  "path": "/oidc/.well-known/oauth-authorization-server"
-}
-{
-  "headers": {
-    "Authorization": [
-      "Basic [ENCODED_AUTH]"
-    ]
-  },
-  "method": "POST",
-  "path": "/oidc/v1/token",
-  "raw_body": "grant_type=client_credentials\u0026scope=all-apis"
-}
-{
-  "headers": {
-    "Authorization": [
-      "Bearer oauth-token"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/preview/scim/v2/Me"
-}
diff --git a/acceptance/bundle/run/inline-script/databricks-cli/profile-is-passed/from_flag/out.test.toml b/acceptance/bundle/run/inline-script/databricks-cli/profile-is-passed/from_flag/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run/inline-script/databricks-cli/profile-is-passed/from_flag/out.test.toml
+++ b/acceptance/bundle/run/inline-script/databricks-cli/profile-is-passed/from_flag/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run/inline-script/databricks-cli/profile-is-passed/from_flag/output.txt b/acceptance/bundle/run/inline-script/databricks-cli/profile-is-passed/from_flag/output.txt
index 0962b43283c..1a1ce7f1c67 100644
--- a/acceptance/bundle/run/inline-script/databricks-cli/profile-is-passed/from_flag/output.txt
+++ b/acceptance/bundle/run/inline-script/databricks-cli/profile-is-passed/from_flag/output.txt
@@ -4,3 +4,46 @@
   "id": "[USERID]",
   "userName": "[USERNAME]"
 }
+
+>>> print_requests.py --get //
+{
+  "method": "GET",
+  "path": "/.well-known/databricks-config"
+}
+{
+  "method": "GET",
+  "path": "/oidc/.well-known/oauth-authorization-server"
+}
+{
+  "headers": {
+    "Authorization": [
+      "Basic [ENCODED_AUTH]"
+    ]
+  },
+  "method": "POST",
+  "path": "/oidc/v1/token",
+  "raw_body": "grant_type=client_credentials&scope=all-apis"
+}
+{
+  "method": "GET",
+  "path": "/oidc/.well-known/oauth-authorization-server"
+}
+{
+  "headers": {
+    "Authorization": [
+      "Basic [ENCODED_AUTH]"
+    ]
+  },
+  "method": "POST",
+  "path": "/oidc/v1/token",
+  "raw_body": "grant_type=client_credentials&scope=all-apis"
+}
+{
+  "headers": {
+    "Authorization": [
+      "Bearer oauth-token"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/preview/scim/v2/Me"
+}
diff --git a/acceptance/bundle/run/inline-script/databricks-cli/profile-is-passed/from_flag/script b/acceptance/bundle/run/inline-script/databricks-cli/profile-is-passed/from_flag/script
index 41049c25f48..3d593f18a1a 100644
--- a/acceptance/bundle/run/inline-script/databricks-cli/profile-is-passed/from_flag/script
+++ b/acceptance/bundle/run/inline-script/databricks-cli/profile-is-passed/from_flag/script
@@ -8,3 +8,5 @@ unset DATABRICKS_TOKEN
 
 # This should use myprofile, which uses oauth.
 trace $CLI bundle run --profile myprofile -- $CLI current-user me
+
+trace print_requests.py --get //
diff --git a/acceptance/bundle/run/inline-script/databricks-cli/target-is-passed/default/out.requests.txt b/acceptance/bundle/run/inline-script/databricks-cli/target-is-passed/default/out.requests.txt
deleted file mode 100644
index 0c815411ae9..00000000000
--- a/acceptance/bundle/run/inline-script/databricks-cli/target-is-passed/default/out.requests.txt
+++ /dev/null
@@ -1,49 +0,0 @@
-{
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "headers": {
-    "Authorization": [
-      "Bearer [DATABRICKS_TOKEN]"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/preview/scim/v2/Me"
-}
-{
-  "headers": {
-    "Authorization": [
-      "Bearer [DATABRICKS_TOKEN]"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/pat/files"
-  }
-}
-{
-  "headers": {
-    "Authorization": [
-      "Bearer [DATABRICKS_TOKEN]"
-    ]
-  },
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/pat/files"
-  }
-}
-{
-  "headers": {
-    "Authorization": [
-      "Bearer [DATABRICKS_TOKEN]"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/pat/files"
-  }
-}
diff --git a/acceptance/bundle/run/inline-script/databricks-cli/target-is-passed/default/out.test.toml b/acceptance/bundle/run/inline-script/databricks-cli/target-is-passed/default/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run/inline-script/databricks-cli/target-is-passed/default/out.test.toml
+++ b/acceptance/bundle/run/inline-script/databricks-cli/target-is-passed/default/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run/inline-script/databricks-cli/target-is-passed/default/output.txt b/acceptance/bundle/run/inline-script/databricks-cli/target-is-passed/default/output.txt
index 513329a539b..067706823b6 100644
--- a/acceptance/bundle/run/inline-script/databricks-cli/target-is-passed/default/output.txt
+++ b/acceptance/bundle/run/inline-script/databricks-cli/target-is-passed/default/output.txt
@@ -1,3 +1,54 @@
 
 >>> [CLI] bundle run -- [CLI] bundle validate -o json
 "pat"
+
+>>> print_requests.py --get //
+{
+  "method": "GET",
+  "path": "/.well-known/databricks-config"
+}
+{
+  "headers": {
+    "Authorization": [
+      "Bearer [DATABRICKS_TOKEN]"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/preview/scim/v2/Me"
+}
+{
+  "headers": {
+    "Authorization": [
+      "Bearer [DATABRICKS_TOKEN]"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/workspace/get-status",
+  "q": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/pat/files"
+  }
+}
+{
+  "headers": {
+    "Authorization": [
+      "Bearer [DATABRICKS_TOKEN]"
+    ]
+  },
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/pat/files"
+  }
+}
+{
+  "headers": {
+    "Authorization": [
+      "Bearer [DATABRICKS_TOKEN]"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/workspace/get-status",
+  "q": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/pat/files"
+  }
+}
diff --git a/acceptance/bundle/run/inline-script/databricks-cli/target-is-passed/default/script b/acceptance/bundle/run/inline-script/databricks-cli/target-is-passed/default/script
index 16b75725145..39d64d5d4ab 100644
--- a/acceptance/bundle/run/inline-script/databricks-cli/target-is-passed/default/script
+++ b/acceptance/bundle/run/inline-script/databricks-cli/target-is-passed/default/script
@@ -8,3 +8,5 @@ unset DATABRICKS_TOKEN
 
 # Should use default target, which is pat based authentication
 trace $CLI bundle run -- $CLI bundle validate -o json| jq .bundle.target
+
+trace print_requests.py --get //
diff --git a/acceptance/bundle/run/inline-script/databricks-cli/target-is-passed/from_flag/out.requests.txt b/acceptance/bundle/run/inline-script/databricks-cli/target-is-passed/from_flag/out.requests.txt
deleted file mode 100644
index 6ba1aad2544..00000000000
--- a/acceptance/bundle/run/inline-script/databricks-cli/target-is-passed/from_flag/out.requests.txt
+++ /dev/null
@@ -1,77 +0,0 @@
-{
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "method": "GET",
-  "path": "/oidc/.well-known/oauth-authorization-server"
-}
-{
-  "headers": {
-    "Authorization": [
-      "Basic [ENCODED_AUTH]"
-    ]
-  },
-  "method": "POST",
-  "path": "/oidc/v1/token",
-  "raw_body": "grant_type=client_credentials\u0026scope=all-apis"
-}
-{
-  "method": "GET",
-  "path": "/oidc/.well-known/oauth-authorization-server"
-}
-{
-  "headers": {
-    "Authorization": [
-      "Basic [ENCODED_AUTH]"
-    ]
-  },
-  "method": "POST",
-  "path": "/oidc/v1/token",
-  "raw_body": "grant_type=client_credentials\u0026scope=all-apis"
-}
-{
-  "headers": {
-    "Authorization": [
-      "Bearer oauth-token"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/preview/scim/v2/Me"
-}
-{
-  "headers": {
-    "Authorization": [
-      "Bearer oauth-token"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/oauth/files"
-  }
-}
-{
-  "headers": {
-    "Authorization": [
-      "Bearer oauth-token"
-    ]
-  },
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/oauth/files"
-  }
-}
-{
-  "headers": {
-    "Authorization": [
-      "Bearer oauth-token"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/oauth/files"
-  }
-}
diff --git a/acceptance/bundle/run/inline-script/databricks-cli/target-is-passed/from_flag/out.test.toml b/acceptance/bundle/run/inline-script/databricks-cli/target-is-passed/from_flag/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run/inline-script/databricks-cli/target-is-passed/from_flag/out.test.toml
+++ b/acceptance/bundle/run/inline-script/databricks-cli/target-is-passed/from_flag/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run/inline-script/databricks-cli/target-is-passed/from_flag/output.txt b/acceptance/bundle/run/inline-script/databricks-cli/target-is-passed/from_flag/output.txt
index fb8a3292890..dcc90ffb748 100644
--- a/acceptance/bundle/run/inline-script/databricks-cli/target-is-passed/from_flag/output.txt
+++ b/acceptance/bundle/run/inline-script/databricks-cli/target-is-passed/from_flag/output.txt
@@ -1,3 +1,82 @@
 
 >>> [CLI] bundle run -t oauth -- [CLI] bundle validate -o json
 "oauth"
+
+>>> print_requests.py --get //
+{
+  "method": "GET",
+  "path": "/.well-known/databricks-config"
+}
+{
+  "method": "GET",
+  "path": "/oidc/.well-known/oauth-authorization-server"
+}
+{
+  "headers": {
+    "Authorization": [
+      "Basic [ENCODED_AUTH]"
+    ]
+  },
+  "method": "POST",
+  "path": "/oidc/v1/token",
+  "raw_body": "grant_type=client_credentials&scope=all-apis"
+}
+{
+  "method": "GET",
+  "path": "/oidc/.well-known/oauth-authorization-server"
+}
+{
+  "headers": {
+    "Authorization": [
+      "Basic [ENCODED_AUTH]"
+    ]
+  },
+  "method": "POST",
+  "path": "/oidc/v1/token",
+  "raw_body": "grant_type=client_credentials&scope=all-apis"
+}
+{
+  "headers": {
+    "Authorization": [
+      "Bearer oauth-token"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/preview/scim/v2/Me"
+}
+{
+  "headers": {
+    "Authorization": [
+      "Bearer oauth-token"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/workspace/get-status",
+  "q": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/oauth/files"
+  }
+}
+{
+  "headers": {
+    "Authorization": [
+      "Bearer oauth-token"
+    ]
+  },
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/oauth/files"
+  }
+}
+{
+  "headers": {
+    "Authorization": [
+      "Bearer oauth-token"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/workspace/get-status",
+  "q": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/oauth/files"
+  }
+}
diff --git a/acceptance/bundle/run/inline-script/databricks-cli/target-is-passed/from_flag/script b/acceptance/bundle/run/inline-script/databricks-cli/target-is-passed/from_flag/script
index 62c438ff012..2c6a71c7954 100644
--- a/acceptance/bundle/run/inline-script/databricks-cli/target-is-passed/from_flag/script
+++ b/acceptance/bundle/run/inline-script/databricks-cli/target-is-passed/from_flag/script
@@ -8,3 +8,5 @@ unset DATABRICKS_TOKEN
 
 # Explicitly select oauth target
 trace $CLI bundle run -t oauth -- $CLI bundle validate -o json| jq .bundle.target
+
+trace print_requests.py --get //
diff --git a/acceptance/bundle/run/inline-script/no-auth/out.test.toml b/acceptance/bundle/run/inline-script/no-auth/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run/inline-script/no-auth/out.test.toml
+++ b/acceptance/bundle/run/inline-script/no-auth/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run/inline-script/no-bundle/out.test.toml b/acceptance/bundle/run/inline-script/no-bundle/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run/inline-script/no-bundle/out.test.toml
+++ b/acceptance/bundle/run/inline-script/no-bundle/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run/inline-script/no-bundle/output.txt b/acceptance/bundle/run/inline-script/no-bundle/output.txt
index 870f682634f..d8c327966c1 100644
--- a/acceptance/bundle/run/inline-script/no-bundle/output.txt
+++ b/acceptance/bundle/run/inline-script/no-bundle/output.txt
@@ -1,6 +1,9 @@
 
 >>> [CLI] bundle run -- echo hello
-Error: unable to locate bundle root: databricks.yml not found
+Error: Unable to locate the bundle root: databricks.yml not found.
+
+Run this command from a directory that contains a bundle, or set the DATABRICKS_BUNDLE_ROOT environment variable to the bundle root directory.
+Alternatively, create a new bundle with 'databricks bundle init'.
 
 
 Exit code: 1
diff --git a/acceptance/bundle/run/inline-script/no-separator/out.test.toml b/acceptance/bundle/run/inline-script/no-separator/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run/inline-script/no-separator/out.test.toml
+++ b/acceptance/bundle/run/inline-script/no-separator/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run/inline-script/no-separator/output.txt b/acceptance/bundle/run/inline-script/no-separator/output.txt
index 7a35cab72e4..a592daf3a53 100644
--- a/acceptance/bundle/run/inline-script/no-separator/output.txt
+++ b/acceptance/bundle/run/inline-script/no-separator/output.txt
@@ -1,6 +1,9 @@
 
 >>> [CLI] bundle run echo hello
-Error: unable to locate bundle root: databricks.yml not found
+Error: Unable to locate the bundle root: databricks.yml not found.
+
+Run this command from a directory that contains a bundle, or set the DATABRICKS_BUNDLE_ROOT environment variable to the bundle root directory.
+Alternatively, create a new bundle with 'databricks bundle init'.
 
 
 Exit code: 1
diff --git a/acceptance/bundle/run/inline-script/test.toml b/acceptance/bundle/run/inline-script/test.toml
deleted file mode 100644
index 4564a92fedc..00000000000
--- a/acceptance/bundle/run/inline-script/test.toml
+++ /dev/null
@@ -1,2 +0,0 @@
-Cloud = false
-Local = true
diff --git a/acceptance/bundle/run/job-ref-job-id/databricks.yml b/acceptance/bundle/run/job-ref-job-id/databricks.yml
new file mode 100644
index 00000000000..3b06625845f
--- /dev/null
+++ b/acceptance/bundle/run/job-ref-job-id/databricks.yml
@@ -0,0 +1,13 @@
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    bar:
+      name: job bar
+    foo:
+      name: job foo
+      tasks:
+        - task_key: job_task
+          run_job_task:
+            job_id: ${resources.jobs.bar.id}
diff --git a/acceptance/bundle/run/job-ref-job-id/out.test.toml b/acceptance/bundle/run/job-ref-job-id/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/run/job-ref-job-id/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run/job-ref-job-id/output.txt b/acceptance/bundle/run/job-ref-job-id/output.txt
new file mode 100644
index 00000000000..b1c11ca57a2
--- /dev/null
+++ b/acceptance/bundle/run/job-ref-job-id/output.txt
@@ -0,0 +1,20 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created jobs.bar
+Created jobs.foo
+Files: 1 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+=== foo's task points at bar's job id
+>>> [CLI] jobs get [FOO_ID]
+{
+  "job_id": [BAR_ID]
+}
+
+=== run resolves the referenced job id into the int job_id field
+>>> [CLI] bundle run foo
+Run URL: [DATABRICKS_URL]/jobs/[FOO_ID]/runs/[RUN_ID]?o=[WORKSPACE_ID]
+
+[TIMESTAMP] "job foo" RUNNING
+[TIMESTAMP] "job foo" TERMINATED SUCCESS
diff --git a/acceptance/bundle/run/job-ref-job-id/script b/acceptance/bundle/run/job-ref-job-id/script
new file mode 100644
index 00000000000..49f312b9790
--- /dev/null
+++ b/acceptance/bundle/run/job-ref-job-id/script
@@ -0,0 +1,8 @@
+trace $CLI bundle deploy
+replace_ids.py
+
+title "foo's task points at bar's job id"
+trace $CLI jobs get $(read_id.py foo) | jq '.settings.tasks[0].run_job_task'
+
+title "run resolves the referenced job id into the int job_id field"
+trace $CLI bundle run foo
diff --git a/acceptance/bundle/run/job-ref-job-id/test.toml b/acceptance/bundle/run/job-ref-job-id/test.toml
new file mode 100644
index 00000000000..3c887dd20bf
--- /dev/null
+++ b/acceptance/bundle/run/job-ref-job-id/test.toml
@@ -0,0 +1,3 @@
+[[Repls]]
+Old = '/runs/\d+'
+New = '/runs/[RUN_ID]'
diff --git a/acceptance/bundle/run/jobs/partial_run/out.test.toml b/acceptance/bundle/run/jobs/partial_run/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run/jobs/partial_run/out.test.toml
+++ b/acceptance/bundle/run/jobs/partial_run/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run/jobs/partial_run/output.txt b/acceptance/bundle/run/jobs/partial_run/output.txt
index c9cc043cfe7..2fe779143a5 100644
--- a/acceptance/bundle/run/jobs/partial_run/output.txt
+++ b/acceptance/bundle/run/jobs/partial_run/output.txt
@@ -1,12 +1,12 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/partial_run/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.my_job
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle run my_job --only task_1
-Run URL: [DATABRICKS_URL]/?o=[NUMID]#job/[NUMID]/run/[NUMID]
+Run URL: [DATABRICKS_URL]/jobs/[MY_JOB_ID]/runs/[RUN_ID]?o=[WORKSPACE_ID]
 
 [TIMESTAMP] "my_job" RUNNING
 [TIMESTAMP] "my_job" TERMINATED SUCCESS
@@ -20,20 +20,20 @@ Task task_2:
 Hello from notebook2!
 
 
->>> print_requests
+>>> print_requests.py //jobs/run-now
 {
+  "method": "POST",
+  "path": "/api/2.2/jobs/run-now",
   "body": {
-    "job_id": [NUMID],
+    "job_id": [MY_JOB_ID],
     "only": [
       "task_1"
     ]
-  },
-  "method": "POST",
-  "path": "/api/2.2/jobs/run-now"
+  }
 }
 
 >>> [CLI] bundle run my_job --only task_1,task_2
-Run URL: [DATABRICKS_URL]/?o=[NUMID]#job/[NUMID]/run/[NUMID]
+Run URL: [DATABRICKS_URL]/jobs/[MY_JOB_ID]/runs/[RUN_ID]?o=[WORKSPACE_ID]
 
 [TIMESTAMP] "my_job" RUNNING
 [TIMESTAMP] "my_job" TERMINATED SUCCESS
@@ -47,21 +47,21 @@ Task task_2:
 Hello from notebook2!
 
 
->>> print_requests
+>>> print_requests.py //jobs/run-now
 {
+  "method": "POST",
+  "path": "/api/2.2/jobs/run-now",
   "body": {
-    "job_id": [NUMID],
+    "job_id": [MY_JOB_ID],
     "only": [
       "task_1",
       "task_2"
     ]
-  },
-  "method": "POST",
-  "path": "/api/2.2/jobs/run-now"
+  }
 }
 
 >>> [CLI] bundle run my_job
-Run URL: [DATABRICKS_URL]/?o=[NUMID]#job/[NUMID]/run/[NUMID]
+Run URL: [DATABRICKS_URL]/jobs/[MY_JOB_ID]/runs/[RUN_ID]?o=[WORKSPACE_ID]
 
 [TIMESTAMP] "my_job" RUNNING
 [TIMESTAMP] "my_job" TERMINATED SUCCESS
@@ -75,13 +75,13 @@ Task task_2:
 Hello from notebook2!
 
 
->>> print_requests
+>>> print_requests.py //jobs/run-now
 {
-  "body": {
-    "job_id": [NUMID]
-  },
   "method": "POST",
-  "path": "/api/2.2/jobs/run-now"
+  "path": "/api/2.2/jobs/run-now",
+  "body": {
+    "job_id": [MY_JOB_ID]
+  }
 }
 
 >>> musterr [CLI] bundle run my_job --only non_existent_task
@@ -91,7 +91,7 @@ Error: task "non_existent_task" not found in job "my_job"
 Error: task "non_existent_task" not found in job "my_job"
 
 >>> [CLI] bundle run my_job --only task1.table1,task2>,task3>table3
-Run URL: [DATABRICKS_URL]/?o=[NUMID]#job/[NUMID]/run/[NUMID]
+Run URL: [DATABRICKS_URL]/jobs/[MY_JOB_ID]/runs/[RUN_ID]?o=[WORKSPACE_ID]
 
 [TIMESTAMP] "my_job" RUNNING
 [TIMESTAMP] "my_job" TERMINATED SUCCESS
@@ -105,16 +105,44 @@ Task task_2:
 Hello from notebook2!
 
 
->>> print_requests
+>>> print_requests.py //jobs/run-now
 {
+  "method": "POST",
+  "path": "/api/2.2/jobs/run-now",
   "body": {
-    "job_id": [NUMID],
+    "job_id": [MY_JOB_ID],
     "only": [
       "task1.table1",
       "task2>",
       "task3>table3"
     ]
-  },
+  }
+}
+
+>>> [CLI] bundle run my_job --only +task_1,task_2+
+Run URL: [DATABRICKS_URL]/jobs/[MY_JOB_ID]/runs/[RUN_ID]?o=[WORKSPACE_ID]
+
+[TIMESTAMP] "my_job" RUNNING
+[TIMESTAMP] "my_job" TERMINATED SUCCESS
+Output:
+=======
+Task task_1:
+Hello from notebook1!
+
+=======
+Task task_2:
+Hello from notebook2!
+
+
+>>> print_requests.py //jobs/run-now
+{
   "method": "POST",
-  "path": "/api/2.2/jobs/run-now"
+  "path": "/api/2.2/jobs/run-now",
+  "body": {
+    "job_id": [MY_JOB_ID],
+    "only": [
+      "+task_1",
+      "task_2+"
+    ]
+  }
 }
diff --git a/acceptance/bundle/run/jobs/partial_run/script b/acceptance/bundle/run/jobs/partial_run/script
index 833ada53062..9c1b6069942 100644
--- a/acceptance/bundle/run/jobs/partial_run/script
+++ b/acceptance/bundle/run/jobs/partial_run/script
@@ -1,18 +1,14 @@
-print_requests() {
-    jq --sort-keys 'select(.path | contains("/jobs/run-now"))' < out.requests.txt
-    rm out.requests.txt
-}
-
 trace $CLI bundle deploy
+replace_ids.py
 
 trace $CLI bundle run my_job --only task_1
-trace print_requests
+trace print_requests.py //jobs/run-now
 
 trace $CLI bundle run my_job --only task_1,task_2
-trace print_requests
+trace print_requests.py //jobs/run-now
 
 trace $CLI bundle run my_job
-trace print_requests
+trace print_requests.py //jobs/run-now
 
 # We expect an error because the task does not exist
 trace musterr $CLI bundle run my_job --only non_existent_task
@@ -22,4 +18,8 @@ trace musterr $CLI bundle run my_job --only non_existent_task,task_1
 
 # We expect these values to be send through
 trace $CLI bundle run my_job --only "task1.table1,task2>,task3>table3"
-trace print_requests
+trace print_requests.py //jobs/run-now
+
+# + modifiers (run upstream/downstream tasks) are forwarded unchanged
+trace $CLI bundle run my_job --only "+task_1,task_2+"
+trace print_requests.py //jobs/run-now
diff --git a/acceptance/bundle/run/jobs/partial_run/test.toml b/acceptance/bundle/run/jobs/partial_run/test.toml
index 34ad85ab0fb..ee0a86da975 100644
--- a/acceptance/bundle/run/jobs/partial_run/test.toml
+++ b/acceptance/bundle/run/jobs/partial_run/test.toml
@@ -1,4 +1,7 @@
-Local = true
 Cloud = false
 
 RecordRequests = true
+
+[[Repls]]
+Old = '/runs/\d+'
+New = '/runs/[RUN_ID]'
diff --git a/acceptance/bundle/run/no-state/out.test.toml b/acceptance/bundle/run/no-state/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run/no-state/out.test.toml
+++ b/acceptance/bundle/run/no-state/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run/refresh-flags/out.test.toml b/acceptance/bundle/run/refresh-flags/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run/refresh-flags/out.test.toml
+++ b/acceptance/bundle/run/refresh-flags/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run/refresh-flags/output.txt b/acceptance/bundle/run/refresh-flags/output.txt
index 34d23f77407..694608a5810 100644
--- a/acceptance/bundle/run/refresh-flags/output.txt
+++ b/acceptance/bundle/run/refresh-flags/output.txt
@@ -1,9 +1,9 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-run-flags/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created pipelines.my_pipeline
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 === Running pipeline with --refresh flag and specific tables
 >>> [CLI] bundle run my_pipeline --refresh table1,table2
@@ -11,16 +11,16 @@ Update URL: [DATABRICKS_URL]/#joblist/pipelines/[UUID]/updates/[UUID]
 
 Update ID: [UUID]
 
->>> print_requests
+>>> print_requests.py //pipelines
 {
+  "method": "POST",
+  "path": "/api/2.0/pipelines/[UUID]/updates",
   "body": {
     "refresh_selection": [
       "table1",
       "table2"
     ]
-  },
-  "method": "POST",
-  "path": "/api/2.0/pipelines/[UUID]/updates"
+  }
 }
 
 === Running pipeline with --full-refresh-all flag
@@ -29,13 +29,13 @@ Update URL: [DATABRICKS_URL]/#joblist/pipelines/[UUID]/updates/[UUID]
 
 Update ID: [UUID]
 
->>> print_requests
+>>> print_requests.py //pipelines
 {
+  "method": "POST",
+  "path": "/api/2.0/pipelines/[UUID]/updates",
   "body": {
     "full_refresh": true
-  },
-  "method": "POST",
-  "path": "/api/2.0/pipelines/[UUID]/updates"
+  }
 }
 
 === Running pipeline with --full-refresh flag and specific tables
@@ -44,16 +44,16 @@ Update URL: [DATABRICKS_URL]/#joblist/pipelines/[UUID]/updates/[UUID]
 
 Update ID: [UUID]
 
->>> print_requests
+>>> print_requests.py //pipelines
 {
+  "method": "POST",
+  "path": "/api/2.0/pipelines/[UUID]/updates",
   "body": {
     "full_refresh_selection": [
       "table1",
       "table2"
     ]
-  },
-  "method": "POST",
-  "path": "/api/2.0/pipelines/[UUID]/updates"
+  }
 }
 
 === Running pipeline with --full-refresh flag and --refresh flag
@@ -62,8 +62,10 @@ Update URL: [DATABRICKS_URL]/#joblist/pipelines/[UUID]/updates/[UUID]
 
 Update ID: [UUID]
 
->>> print_requests
+>>> print_requests.py //pipelines
 {
+  "method": "POST",
+  "path": "/api/2.0/pipelines/[UUID]/updates",
   "body": {
     "full_refresh_selection": [
       "table1",
@@ -73,7 +75,5 @@ Update ID: [UUID]
       "table3",
       "table4"
     ]
-  },
-  "method": "POST",
-  "path": "/api/2.0/pipelines/[UUID]/updates"
+  }
 }
diff --git a/acceptance/bundle/run/refresh-flags/script b/acceptance/bundle/run/refresh-flags/script
index ba3de195693..7c788c42239 100644
--- a/acceptance/bundle/run/refresh-flags/script
+++ b/acceptance/bundle/run/refresh-flags/script
@@ -1,23 +1,18 @@
-print_requests() {
-    jq --sort-keys 'select(.method != "GET" and (.path | contains("/pipelines")))' < out.requests.txt
-    rm out.requests.txt
-}
-
 trace $CLI bundle deploy
-rm out.requests.txt
+rm "$OUT_REQUESTS"
 
 title "Running pipeline with --refresh flag and specific tables"
 trace $CLI bundle run my_pipeline --refresh table1,table2
-trace print_requests
+trace print_requests.py //pipelines
 
 title "Running pipeline with --full-refresh-all flag"
 trace $CLI bundle run my_pipeline --full-refresh-all
-trace print_requests
+trace print_requests.py //pipelines
 
 title "Running pipeline with --full-refresh flag and specific tables"
 trace $CLI bundle run my_pipeline --full-refresh table1,table2
-trace print_requests
+trace print_requests.py //pipelines
 
 title "Running pipeline with --full-refresh flag and --refresh flag"
 trace $CLI bundle run my_pipeline --full-refresh table1,table2 --refresh table3,table4
-trace print_requests
+trace print_requests.py //pipelines
diff --git a/acceptance/bundle/run/scripts/basic/out.test.toml b/acceptance/bundle/run/scripts/basic/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run/scripts/basic/out.test.toml
+++ b/acceptance/bundle/run/scripts/basic/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run/scripts/cwd/out.test.toml b/acceptance/bundle/run/scripts/cwd/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run/scripts/cwd/out.test.toml
+++ b/acceptance/bundle/run/scripts/cwd/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run/scripts/databricks-cli/profile-is-passed/from_flag/out.requests.txt b/acceptance/bundle/run/scripts/databricks-cli/profile-is-passed/from_flag/out.requests.txt
deleted file mode 100644
index 90cb7d14ba0..00000000000
--- a/acceptance/bundle/run/scripts/databricks-cli/profile-is-passed/from_flag/out.requests.txt
+++ /dev/null
@@ -1,54 +0,0 @@
-{
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "method": "GET",
-  "path": "/oidc/.well-known/oauth-authorization-server"
-}
-{
-  "headers": {
-    "Authorization": [
-      "Basic [ENCODED_AUTH]"
-    ]
-  },
-  "method": "POST",
-  "path": "/oidc/v1/token",
-  "raw_body": "grant_type=client_credentials\u0026scope=all-apis"
-}
-{
-  "headers": {
-    "Authorization": [
-      "Bearer oauth-token"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/preview/scim/v2/Me"
-}
-{
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "method": "GET",
-  "path": "/oidc/.well-known/oauth-authorization-server"
-}
-{
-  "headers": {
-    "Authorization": [
-      "Basic [ENCODED_AUTH]"
-    ]
-  },
-  "method": "POST",
-  "path": "/oidc/v1/token",
-  "raw_body": "grant_type=client_credentials\u0026scope=all-apis"
-}
-{
-  "headers": {
-    "Authorization": [
-      "Bearer oauth-token"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/preview/scim/v2/Me"
-}
diff --git a/acceptance/bundle/run/scripts/databricks-cli/profile-is-passed/from_flag/out.test.toml b/acceptance/bundle/run/scripts/databricks-cli/profile-is-passed/from_flag/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run/scripts/databricks-cli/profile-is-passed/from_flag/out.test.toml
+++ b/acceptance/bundle/run/scripts/databricks-cli/profile-is-passed/from_flag/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run/scripts/databricks-cli/profile-is-passed/from_flag/output.txt b/acceptance/bundle/run/scripts/databricks-cli/profile-is-passed/from_flag/output.txt
index c64ea6b2ea0..2d9c8b6521d 100644
--- a/acceptance/bundle/run/scripts/databricks-cli/profile-is-passed/from_flag/output.txt
+++ b/acceptance/bundle/run/scripts/databricks-cli/profile-is-passed/from_flag/output.txt
@@ -4,3 +4,59 @@
   "id": "[USERID]",
   "userName": "[USERNAME]"
 }
+
+>>> print_requests.py --get //
+{
+  "method": "GET",
+  "path": "/.well-known/databricks-config"
+}
+{
+  "method": "GET",
+  "path": "/oidc/.well-known/oauth-authorization-server"
+}
+{
+  "headers": {
+    "Authorization": [
+      "Basic [ENCODED_AUTH]"
+    ]
+  },
+  "method": "POST",
+  "path": "/oidc/v1/token",
+  "raw_body": "grant_type=client_credentials&scope=all-apis"
+}
+{
+  "headers": {
+    "Authorization": [
+      "Bearer oauth-token"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/preview/scim/v2/Me"
+}
+{
+  "method": "GET",
+  "path": "/.well-known/databricks-config"
+}
+{
+  "method": "GET",
+  "path": "/oidc/.well-known/oauth-authorization-server"
+}
+{
+  "headers": {
+    "Authorization": [
+      "Basic [ENCODED_AUTH]"
+    ]
+  },
+  "method": "POST",
+  "path": "/oidc/v1/token",
+  "raw_body": "grant_type=client_credentials&scope=all-apis"
+}
+{
+  "headers": {
+    "Authorization": [
+      "Bearer oauth-token"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/preview/scim/v2/Me"
+}
diff --git a/acceptance/bundle/run/scripts/databricks-cli/profile-is-passed/from_flag/script b/acceptance/bundle/run/scripts/databricks-cli/profile-is-passed/from_flag/script
index b6846aec15b..6127ba341ce 100644
--- a/acceptance/bundle/run/scripts/databricks-cli/profile-is-passed/from_flag/script
+++ b/acceptance/bundle/run/scripts/databricks-cli/profile-is-passed/from_flag/script
@@ -8,3 +8,5 @@ unset DATABRICKS_TOKEN
 
 # This should use myprofile, which uses oauth.
 trace $CLI bundle run me --profile myprofile
+
+trace print_requests.py --get //
diff --git a/acceptance/bundle/run/scripts/databricks-cli/target-is-passed/default/out.requests.txt b/acceptance/bundle/run/scripts/databricks-cli/target-is-passed/default/out.requests.txt
deleted file mode 100644
index 93542472ac5..00000000000
--- a/acceptance/bundle/run/scripts/databricks-cli/target-is-passed/default/out.requests.txt
+++ /dev/null
@@ -1,62 +0,0 @@
-{
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "headers": {
-    "Authorization": [
-      "Bearer [DATABRICKS_TOKEN]"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/preview/scim/v2/Me"
-}
-{
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "headers": {
-    "Authorization": [
-      "Bearer [DATABRICKS_TOKEN]"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/preview/scim/v2/Me"
-}
-{
-  "headers": {
-    "Authorization": [
-      "Bearer [DATABRICKS_TOKEN]"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/foobar/pat/files"
-  }
-}
-{
-  "headers": {
-    "Authorization": [
-      "Bearer [DATABRICKS_TOKEN]"
-    ]
-  },
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/foobar/pat/files"
-  }
-}
-{
-  "headers": {
-    "Authorization": [
-      "Bearer [DATABRICKS_TOKEN]"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/foobar/pat/files"
-  }
-}
diff --git a/acceptance/bundle/run/scripts/databricks-cli/target-is-passed/default/out.test.toml b/acceptance/bundle/run/scripts/databricks-cli/target-is-passed/default/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run/scripts/databricks-cli/target-is-passed/default/out.test.toml
+++ b/acceptance/bundle/run/scripts/databricks-cli/target-is-passed/default/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run/scripts/databricks-cli/target-is-passed/default/output.txt b/acceptance/bundle/run/scripts/databricks-cli/target-is-passed/default/output.txt
index 891c4628862..64073379aa6 100644
--- a/acceptance/bundle/run/scripts/databricks-cli/target-is-passed/default/output.txt
+++ b/acceptance/bundle/run/scripts/databricks-cli/target-is-passed/default/output.txt
@@ -1,3 +1,67 @@
 
 >>> [CLI] bundle run validate
 "pat"
+
+>>> print_requests.py --get //
+{
+  "method": "GET",
+  "path": "/.well-known/databricks-config"
+}
+{
+  "headers": {
+    "Authorization": [
+      "Bearer [DATABRICKS_TOKEN]"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/preview/scim/v2/Me"
+}
+{
+  "method": "GET",
+  "path": "/.well-known/databricks-config"
+}
+{
+  "headers": {
+    "Authorization": [
+      "Bearer [DATABRICKS_TOKEN]"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/preview/scim/v2/Me"
+}
+{
+  "headers": {
+    "Authorization": [
+      "Bearer [DATABRICKS_TOKEN]"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/workspace/get-status",
+  "q": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/foobar/pat/files"
+  }
+}
+{
+  "headers": {
+    "Authorization": [
+      "Bearer [DATABRICKS_TOKEN]"
+    ]
+  },
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/foobar/pat/files"
+  }
+}
+{
+  "headers": {
+    "Authorization": [
+      "Bearer [DATABRICKS_TOKEN]"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/workspace/get-status",
+  "q": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/foobar/pat/files"
+  }
+}
diff --git a/acceptance/bundle/run/scripts/databricks-cli/target-is-passed/default/script b/acceptance/bundle/run/scripts/databricks-cli/target-is-passed/default/script
index ce1f6f67a18..d7fcb94402a 100644
--- a/acceptance/bundle/run/scripts/databricks-cli/target-is-passed/default/script
+++ b/acceptance/bundle/run/scripts/databricks-cli/target-is-passed/default/script
@@ -8,3 +8,5 @@ unset DATABRICKS_TOKEN
 
 # Should use default target, which is pat based authentication
 trace $CLI bundle run validate | jq .bundle.target
+
+trace print_requests.py --get //
diff --git a/acceptance/bundle/run/scripts/databricks-cli/target-is-passed/from_flag/out.requests.txt b/acceptance/bundle/run/scripts/databricks-cli/target-is-passed/from_flag/out.requests.txt
deleted file mode 100644
index 6ce820c124f..00000000000
--- a/acceptance/bundle/run/scripts/databricks-cli/target-is-passed/from_flag/out.requests.txt
+++ /dev/null
@@ -1,90 +0,0 @@
-{
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "method": "GET",
-  "path": "/oidc/.well-known/oauth-authorization-server"
-}
-{
-  "headers": {
-    "Authorization": [
-      "Basic [ENCODED_AUTH]"
-    ]
-  },
-  "method": "POST",
-  "path": "/oidc/v1/token",
-  "raw_body": "grant_type=client_credentials\u0026scope=all-apis"
-}
-{
-  "headers": {
-    "Authorization": [
-      "Bearer oauth-token"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/preview/scim/v2/Me"
-}
-{
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "method": "GET",
-  "path": "/oidc/.well-known/oauth-authorization-server"
-}
-{
-  "headers": {
-    "Authorization": [
-      "Basic [ENCODED_AUTH]"
-    ]
-  },
-  "method": "POST",
-  "path": "/oidc/v1/token",
-  "raw_body": "grant_type=client_credentials\u0026scope=all-apis"
-}
-{
-  "headers": {
-    "Authorization": [
-      "Bearer oauth-token"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/preview/scim/v2/Me"
-}
-{
-  "headers": {
-    "Authorization": [
-      "Bearer oauth-token"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/foobar/oauth/files"
-  }
-}
-{
-  "headers": {
-    "Authorization": [
-      "Bearer oauth-token"
-    ]
-  },
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/foobar/oauth/files"
-  }
-}
-{
-  "headers": {
-    "Authorization": [
-      "Bearer oauth-token"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/foobar/oauth/files"
-  }
-}
diff --git a/acceptance/bundle/run/scripts/databricks-cli/target-is-passed/from_flag/out.test.toml b/acceptance/bundle/run/scripts/databricks-cli/target-is-passed/from_flag/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run/scripts/databricks-cli/target-is-passed/from_flag/out.test.toml
+++ b/acceptance/bundle/run/scripts/databricks-cli/target-is-passed/from_flag/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run/scripts/databricks-cli/target-is-passed/from_flag/output.txt b/acceptance/bundle/run/scripts/databricks-cli/target-is-passed/from_flag/output.txt
index 60412ab33db..91d2b39a321 100644
--- a/acceptance/bundle/run/scripts/databricks-cli/target-is-passed/from_flag/output.txt
+++ b/acceptance/bundle/run/scripts/databricks-cli/target-is-passed/from_flag/output.txt
@@ -1,3 +1,95 @@
 
 >>> [CLI] bundle run validate -t oauth
 "oauth"
+
+>>> print_requests.py --get //
+{
+  "method": "GET",
+  "path": "/.well-known/databricks-config"
+}
+{
+  "method": "GET",
+  "path": "/oidc/.well-known/oauth-authorization-server"
+}
+{
+  "headers": {
+    "Authorization": [
+      "Basic [ENCODED_AUTH]"
+    ]
+  },
+  "method": "POST",
+  "path": "/oidc/v1/token",
+  "raw_body": "grant_type=client_credentials&scope=all-apis"
+}
+{
+  "headers": {
+    "Authorization": [
+      "Bearer oauth-token"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/preview/scim/v2/Me"
+}
+{
+  "method": "GET",
+  "path": "/.well-known/databricks-config"
+}
+{
+  "method": "GET",
+  "path": "/oidc/.well-known/oauth-authorization-server"
+}
+{
+  "headers": {
+    "Authorization": [
+      "Basic [ENCODED_AUTH]"
+    ]
+  },
+  "method": "POST",
+  "path": "/oidc/v1/token",
+  "raw_body": "grant_type=client_credentials&scope=all-apis"
+}
+{
+  "headers": {
+    "Authorization": [
+      "Bearer oauth-token"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/preview/scim/v2/Me"
+}
+{
+  "headers": {
+    "Authorization": [
+      "Bearer oauth-token"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/workspace/get-status",
+  "q": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/foobar/oauth/files"
+  }
+}
+{
+  "headers": {
+    "Authorization": [
+      "Bearer oauth-token"
+    ]
+  },
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/foobar/oauth/files"
+  }
+}
+{
+  "headers": {
+    "Authorization": [
+      "Bearer oauth-token"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/workspace/get-status",
+  "q": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/foobar/oauth/files"
+  }
+}
diff --git a/acceptance/bundle/run/scripts/databricks-cli/target-is-passed/from_flag/script b/acceptance/bundle/run/scripts/databricks-cli/target-is-passed/from_flag/script
index 64c268ae06e..e06cae7baeb 100644
--- a/acceptance/bundle/run/scripts/databricks-cli/target-is-passed/from_flag/script
+++ b/acceptance/bundle/run/scripts/databricks-cli/target-is-passed/from_flag/script
@@ -10,3 +10,5 @@ unset DATABRICKS_TOKEN
 # both the right target and the right auth credentials are
 # being passed to the script invocation.
 trace $CLI bundle run validate -t oauth | jq .bundle.target
+
+trace print_requests.py --get //
diff --git a/acceptance/bundle/run/scripts/databricks-cli/test.toml b/acceptance/bundle/run/scripts/databricks-cli/test.toml
index e42dd928e61..4abee885c9c 100644
--- a/acceptance/bundle/run/scripts/databricks-cli/test.toml
+++ b/acceptance/bundle/run/scripts/databricks-cli/test.toml
@@ -1,11 +1,10 @@
 RecordRequests = true
 IncludeRequestHeaders = ["Authorization"]
 
-[Env]
-DATABRICKS_CACHE_ENABLED = 'false'
-
+Env.DATABRICKS_CACHE_ENABLED = 'false'
 # "client_id:client_secret" in base64 is Y2xpZW50X2lkOmNsaWVudF9zZWNyZXQ=, expect to
 # see this in Authorization header
+
 [[Repls]]
 Old = "Y2xpZW50X2lkOmNsaWVudF9zZWNyZXQ="
 New = "[ENCODED_AUTH]"
diff --git a/acceptance/bundle/run/scripts/env-bad-prefix/databricks.yml b/acceptance/bundle/run/scripts/env-bad-prefix/databricks.yml
new file mode 100644
index 00000000000..c771fb55473
--- /dev/null
+++ b/acceptance/bundle/run/scripts/env-bad-prefix/databricks.yml
@@ -0,0 +1,14 @@
+bundle:
+  name: script-env-bad-prefix
+
+resources:
+  jobs:
+    my_job:
+      name: my-job
+
+scripts:
+  bad:
+    env:
+      JOB_ID: ${resources.jobs.my_job.id}
+      UNKNOWN: ${something.else}
+    content: echo "$JOB_ID $UNKNOWN"
diff --git a/acceptance/bundle/run/scripts/env-bad-prefix/out.test.toml b/acceptance/bundle/run/scripts/env-bad-prefix/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/run/scripts/env-bad-prefix/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run/scripts/env-bad-prefix/output.txt b/acceptance/bundle/run/scripts/env-bad-prefix/output.txt
new file mode 100644
index 00000000000..fe3b3f27bfc
--- /dev/null
+++ b/acceptance/bundle/run/scripts/env-bad-prefix/output.txt
@@ -0,0 +1,14 @@
+
+>>> [CLI] bundle validate
+Error: ${resources.jobs.my_job.id} cannot be used in scripts.bad.env.JOB_ID; only ${bundle.*}, ${workspace.*}, and ${var.*} are resolved before scripts execute
+  at scripts.bad.env.JOB_ID
+  in databricks.yml:12:15
+
+Error: ${something.else} cannot be used in scripts.bad.env.UNKNOWN; only ${bundle.*}, ${workspace.*}, and ${var.*} are resolved before scripts execute
+  at scripts.bad.env.UNKNOWN
+  in databricks.yml:13:16
+
+Name: script-env-bad-prefix
+Target: default
+
+Found 2 errors
diff --git a/acceptance/bundle/run/scripts/env-bad-prefix/script b/acceptance/bundle/run/scripts/env-bad-prefix/script
new file mode 100644
index 00000000000..277355fe918
--- /dev/null
+++ b/acceptance/bundle/run/scripts/env-bad-prefix/script
@@ -0,0 +1 @@
+musterr trace $CLI bundle validate
diff --git a/acceptance/bundle/run/scripts/env-bad-prefix/test.toml b/acceptance/bundle/run/scripts/env-bad-prefix/test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/bundle/run/scripts/env-bad-prefix/test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/bundle/run/scripts/env-precedence/databricks.yml b/acceptance/bundle/run/scripts/env-precedence/databricks.yml
new file mode 100644
index 00000000000..504d7dc07d8
--- /dev/null
+++ b/acceptance/bundle/run/scripts/env-precedence/databricks.yml
@@ -0,0 +1,14 @@
+bundle:
+  name: script-env-precedence
+
+targets:
+  default:
+    default: true
+
+# A script's env: entry must win over the DATABRICKS_BUNDLE_TARGET variable the
+# CLI injects into the script process (executeScript appends env: last).
+scripts:
+  show_target:
+    env:
+      DATABRICKS_BUNDLE_TARGET: from-script-env
+    content: echo "target=$DATABRICKS_BUNDLE_TARGET"
diff --git a/acceptance/bundle/run/scripts/env-precedence/out.test.toml b/acceptance/bundle/run/scripts/env-precedence/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/run/scripts/env-precedence/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run/scripts/env-precedence/output.txt b/acceptance/bundle/run/scripts/env-precedence/output.txt
new file mode 100644
index 00000000000..6155dd27777
--- /dev/null
+++ b/acceptance/bundle/run/scripts/env-precedence/output.txt
@@ -0,0 +1,3 @@
+
+>>> [CLI] bundle run show_target
+target=from-script-env
diff --git a/acceptance/bundle/run/scripts/env-precedence/script b/acceptance/bundle/run/scripts/env-precedence/script
new file mode 100644
index 00000000000..d3972eef664
--- /dev/null
+++ b/acceptance/bundle/run/scripts/env-precedence/script
@@ -0,0 +1 @@
+trace $CLI bundle run show_target
diff --git a/acceptance/bundle/run/scripts/env-precedence/test.toml b/acceptance/bundle/run/scripts/env-precedence/test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/bundle/run/scripts/env-precedence/test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/bundle/run/scripts/env-section/databricks.yml b/acceptance/bundle/run/scripts/env-section/databricks.yml
new file mode 100644
index 00000000000..3938b15deb5
--- /dev/null
+++ b/acceptance/bundle/run/scripts/env-section/databricks.yml
@@ -0,0 +1,21 @@
+bundle:
+  name: script-env-section
+
+variables:
+  region:
+    default: us-west-2
+  database:
+    default: mydb
+
+scripts:
+  show_env:
+    env:
+      BUNDLE_NAME: ${bundle.name}
+      REGION: ${var.region}
+      DATABASE: ${var.database}
+      MIXED: "region=${var.region};db=${var.database}"
+    content: |-
+      echo "bundle=$BUNDLE_NAME"
+      echo "region=$REGION"
+      echo "database=$DATABASE"
+      echo "mixed=$MIXED"
diff --git a/acceptance/bundle/run/scripts/env-section/out.test.toml b/acceptance/bundle/run/scripts/env-section/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/run/scripts/env-section/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run/scripts/env-section/output.txt b/acceptance/bundle/run/scripts/env-section/output.txt
new file mode 100644
index 00000000000..335d9028fbe
--- /dev/null
+++ b/acceptance/bundle/run/scripts/env-section/output.txt
@@ -0,0 +1,6 @@
+
+>>> [CLI] bundle run show_env
+bundle=script-env-section
+region=us-west-2
+database=mydb
+mixed=region=us-west-2;db=mydb
diff --git a/acceptance/bundle/run/scripts/env-section/script b/acceptance/bundle/run/scripts/env-section/script
new file mode 100644
index 00000000000..e25d0638fb7
--- /dev/null
+++ b/acceptance/bundle/run/scripts/env-section/script
@@ -0,0 +1 @@
+trace $CLI bundle run show_env
diff --git a/acceptance/bundle/run/scripts/env-section/test.toml b/acceptance/bundle/run/scripts/env-section/test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/bundle/run/scripts/env-section/test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/bundle/run/scripts/exit_code/out.test.toml b/acceptance/bundle/run/scripts/exit_code/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run/scripts/exit_code/out.test.toml
+++ b/acceptance/bundle/run/scripts/exit_code/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run/scripts/io/out.test.toml b/acceptance/bundle/run/scripts/io/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run/scripts/io/out.test.toml
+++ b/acceptance/bundle/run/scripts/io/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run/scripts/no-auth/out.test.toml b/acceptance/bundle/run/scripts/no-auth/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run/scripts/no-auth/out.test.toml
+++ b/acceptance/bundle/run/scripts/no-auth/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run/scripts/no-interpolation/out.test.toml b/acceptance/bundle/run/scripts/no-interpolation/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run/scripts/no-interpolation/out.test.toml
+++ b/acceptance/bundle/run/scripts/no-interpolation/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run/scripts/no-interpolation/output.txt b/acceptance/bundle/run/scripts/no-interpolation/output.txt
index 45bc397bdb7..16c28a71706 100644
--- a/acceptance/bundle/run/scripts/no-interpolation/output.txt
+++ b/acceptance/bundle/run/scripts/no-interpolation/output.txt
@@ -1,40 +1,64 @@
 
 >>> [CLI] bundle deploy
-Error: Found ${FOO} in script one. Interpolation syntax ${...} is not allowed in scripts
+Error: Found ${FOO} in script one.content. Interpolation syntax ${...} is not supported in script content
   at scripts.one.content
   in databricks.yml:6:14
 
-We do not support the ${...} interpolation syntax in scripts because
-it's ambiguous whether it's a variable reference or reference to an
-environment variable.
+The ${...} syntax is not allowed in script content. To use a bundle value,
+declare an environment variable in the script's "env:" section and reference it
+from "content" with $NAME:
 
-Error: Found ${var.BAR} in script two. Interpolation syntax ${...} is not allowed in scripts
+  scripts:
+    one:
+      env:
+        MY_VAR: ${var.foo}
+      content: echo "$MY_VAR"
+
+Error: Found ${var.BAR} in script two.content. Interpolation syntax ${...} is not supported in script content
   at scripts.two.content
   in databricks.yml:8:14
 
-We do not support the ${...} interpolation syntax in scripts because
-it's ambiguous whether it's a variable reference or reference to an
-environment variable.
+The ${...} syntax is not allowed in script content. To use a bundle value,
+declare an environment variable in the script's "env:" section and reference it
+from "content" with $NAME:
+
+  scripts:
+    two:
+      env:
+        MY_VAR: ${var.foo}
+      content: echo "$MY_VAR"
 
 
 Exit code: 1
 
 >>> [CLI] bundle run foo
-Error: Found ${FOO} in script one. Interpolation syntax ${...} is not allowed in scripts
+Error: Found ${FOO} in script one.content. Interpolation syntax ${...} is not supported in script content
   at scripts.one.content
   in databricks.yml:6:14
 
-We do not support the ${...} interpolation syntax in scripts because
-it's ambiguous whether it's a variable reference or reference to an
-environment variable.
+The ${...} syntax is not allowed in script content. To use a bundle value,
+declare an environment variable in the script's "env:" section and reference it
+from "content" with $NAME:
 
-Error: Found ${var.BAR} in script two. Interpolation syntax ${...} is not allowed in scripts
+  scripts:
+    one:
+      env:
+        MY_VAR: ${var.foo}
+      content: echo "$MY_VAR"
+
+Error: Found ${var.BAR} in script two.content. Interpolation syntax ${...} is not supported in script content
   at scripts.two.content
   in databricks.yml:8:14
 
-We do not support the ${...} interpolation syntax in scripts because
-it's ambiguous whether it's a variable reference or reference to an
-environment variable.
+The ${...} syntax is not allowed in script content. To use a bundle value,
+declare an environment variable in the script's "env:" section and reference it
+from "content" with $NAME:
+
+  scripts:
+    two:
+      env:
+        MY_VAR: ${var.foo}
+      content: echo "$MY_VAR"
 
 
 Exit code: 1
diff --git a/acceptance/bundle/run/scripts/no_content/out.test.toml b/acceptance/bundle/run/scripts/no_content/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run/scripts/no_content/out.test.toml
+++ b/acceptance/bundle/run/scripts/no_content/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run/scripts/shell/envvar/out.test.toml b/acceptance/bundle/run/scripts/shell/envvar/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run/scripts/shell/envvar/out.test.toml
+++ b/acceptance/bundle/run/scripts/shell/envvar/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run/scripts/shell/math/out.test.toml b/acceptance/bundle/run/scripts/shell/math/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run/scripts/shell/math/out.test.toml
+++ b/acceptance/bundle/run/scripts/shell/math/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run/scripts/unique_keys/duplicate_resource_and_script_name_root/out.test.toml b/acceptance/bundle/run/scripts/unique_keys/duplicate_resource_and_script_name_root/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run/scripts/unique_keys/duplicate_resource_and_script_name_root/out.test.toml
+++ b/acceptance/bundle/run/scripts/unique_keys/duplicate_resource_and_script_name_root/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run/scripts/unique_keys/duplicate_resource_and_script_name_root/output.txt b/acceptance/bundle/run/scripts/unique_keys/duplicate_resource_and_script_name_root/output.txt
index ccc96861549..a2bae4a4f69 100644
--- a/acceptance/bundle/run/scripts/unique_keys/duplicate_resource_and_script_name_root/output.txt
+++ b/acceptance/bundle/run/scripts/unique_keys/duplicate_resource_and_script_name_root/output.txt
@@ -10,8 +10,6 @@ Name: test
 
 Found 1 error
 
-Exit code: 1
-
 >>> [CLI] bundle run foo
 Error: multiple resources or scripts have been defined with the same key: foo
   at resources.jobs.foo
@@ -19,5 +17,3 @@ Error: multiple resources or scripts have been defined with the same key: foo
   in databricks.yml:9:5
      databricks.yml:15:7
 
-
-Exit code: 1
diff --git a/acceptance/bundle/run/scripts/unique_keys/duplicate_resource_and_script_name_root/script b/acceptance/bundle/run/scripts/unique_keys/duplicate_resource_and_script_name_root/script
index 4c87f36259e..2f13ca05f0f 100644
--- a/acceptance/bundle/run/scripts/unique_keys/duplicate_resource_and_script_name_root/script
+++ b/acceptance/bundle/run/scripts/unique_keys/duplicate_resource_and_script_name_root/script
@@ -1,3 +1,3 @@
-errcode trace $CLI bundle validate
+musterr trace $CLI bundle validate
 
-errcode trace $CLI bundle run foo
+musterr trace $CLI bundle run foo
diff --git a/acceptance/bundle/run/scripts/unique_keys/duplicate_resource_and_script_subconfigurations/out.test.toml b/acceptance/bundle/run/scripts/unique_keys/duplicate_resource_and_script_subconfigurations/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run/scripts/unique_keys/duplicate_resource_and_script_subconfigurations/out.test.toml
+++ b/acceptance/bundle/run/scripts/unique_keys/duplicate_resource_and_script_subconfigurations/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run/scripts/unique_keys/duplicate_resource_and_script_subconfigurations/output.txt b/acceptance/bundle/run/scripts/unique_keys/duplicate_resource_and_script_subconfigurations/output.txt
index f3076886e60..9c80bfbd622 100644
--- a/acceptance/bundle/run/scripts/unique_keys/duplicate_resource_and_script_subconfigurations/output.txt
+++ b/acceptance/bundle/run/scripts/unique_keys/duplicate_resource_and_script_subconfigurations/output.txt
@@ -10,8 +10,6 @@ Name: test
 
 Found 1 error
 
-Exit code: 1
-
 >>> [CLI] bundle run foo
 Error: multiple resources or scripts have been defined with the same key: foo
   at resources.pipelines.foo
@@ -19,5 +17,3 @@ Error: multiple resources or scripts have been defined with the same key: foo
   in resource.yml:4:7
      script.yml:3:5
 
-
-Exit code: 1
diff --git a/acceptance/bundle/run/scripts/unique_keys/duplicate_resource_and_script_subconfigurations/script b/acceptance/bundle/run/scripts/unique_keys/duplicate_resource_and_script_subconfigurations/script
index 4c87f36259e..2f13ca05f0f 100644
--- a/acceptance/bundle/run/scripts/unique_keys/duplicate_resource_and_script_subconfigurations/script
+++ b/acceptance/bundle/run/scripts/unique_keys/duplicate_resource_and_script_subconfigurations/script
@@ -1,3 +1,3 @@
-errcode trace $CLI bundle validate
+musterr trace $CLI bundle validate
 
-errcode trace $CLI bundle run foo
+musterr trace $CLI bundle run foo
diff --git a/acceptance/bundle/run/scripts/unique_keys/duplicate_script_names_in_subconfiguration/out.test.toml b/acceptance/bundle/run/scripts/unique_keys/duplicate_script_names_in_subconfiguration/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run/scripts/unique_keys/duplicate_script_names_in_subconfiguration/out.test.toml
+++ b/acceptance/bundle/run/scripts/unique_keys/duplicate_script_names_in_subconfiguration/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run/scripts/unique_keys/duplicate_script_names_in_subconfiguration/output.txt b/acceptance/bundle/run/scripts/unique_keys/duplicate_script_names_in_subconfiguration/output.txt
index 4834307e9f8..9cad499cb40 100644
--- a/acceptance/bundle/run/scripts/unique_keys/duplicate_script_names_in_subconfiguration/output.txt
+++ b/acceptance/bundle/run/scripts/unique_keys/duplicate_script_names_in_subconfiguration/output.txt
@@ -9,13 +9,9 @@ Name: test
 
 Found 1 error
 
-Exit code: 1
-
 >>> [CLI] bundle run foo
 Error: multiple resources or scripts have been defined with the same key: foo
   at scripts.foo
   in script1.yml:3:5
      script2.yml:3:5
 
-
-Exit code: 1
diff --git a/acceptance/bundle/run/scripts/unique_keys/duplicate_script_names_in_subconfiguration/script b/acceptance/bundle/run/scripts/unique_keys/duplicate_script_names_in_subconfiguration/script
index 4c87f36259e..2f13ca05f0f 100644
--- a/acceptance/bundle/run/scripts/unique_keys/duplicate_script_names_in_subconfiguration/script
+++ b/acceptance/bundle/run/scripts/unique_keys/duplicate_script_names_in_subconfiguration/script
@@ -1,3 +1,3 @@
-errcode trace $CLI bundle validate
+musterr trace $CLI bundle validate
 
-errcode trace $CLI bundle run foo
+musterr trace $CLI bundle run foo
diff --git a/acceptance/bundle/run/state-wiped/out.test.toml b/acceptance/bundle/run/state-wiped/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run/state-wiped/out.test.toml
+++ b/acceptance/bundle/run/state-wiped/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run/state-wiped/output.txt b/acceptance/bundle/run/state-wiped/output.txt
index 2214445a11b..894e4148455 100644
--- a/acceptance/bundle/run/state-wiped/output.txt
+++ b/acceptance/bundle/run/state-wiped/output.txt
@@ -5,12 +5,12 @@ Error: resource not found or not yet deployed. Did you forget to run 'databricks
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/caterpillar/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.foo
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle run foo
-Run URL: [DATABRICKS_URL]/?o=[NUMID]#job/[NUMID]/run/[NUMID]
+Run URL: [DATABRICKS_URL]/jobs/[FOO_ID]/runs/[RUN_ID]?o=[WORKSPACE_ID]
 
 [TIMESTAMP] "foo" RUNNING
 [TIMESTAMP] "foo" TERMINATED SUCCESS
@@ -19,7 +19,7 @@ Run URL: [DATABRICKS_URL]/?o=[NUMID]#job/[NUMID]/run/[NUMID]
 >>> rm -fr .databricks
 
 >>> [CLI] bundle run foo
-Run URL: [DATABRICKS_URL]/?o=[NUMID]#job/[NUMID]/run/[NUMID]
+Run URL: [DATABRICKS_URL]/jobs/[FOO_ID]/runs/[RUN_ID]?o=[WORKSPACE_ID]
 
 [TIMESTAMP] "foo" RUNNING
 [TIMESTAMP] "foo" TERMINATED SUCCESS
diff --git a/acceptance/bundle/run/state-wiped/script b/acceptance/bundle/run/state-wiped/script
index 537c9ca6ddf..e3b6ae29356 100644
--- a/acceptance/bundle/run/state-wiped/script
+++ b/acceptance/bundle/run/state-wiped/script
@@ -1,5 +1,6 @@
 trace musterr $CLI bundle run foo
 trace $CLI bundle deploy
+replace_ids.py
 
 trace $CLI bundle run foo
 
diff --git a/acceptance/bundle/run/state-wiped/test.toml b/acceptance/bundle/run/state-wiped/test.toml
new file mode 100644
index 00000000000..3c887dd20bf
--- /dev/null
+++ b/acceptance/bundle/run/state-wiped/test.toml
@@ -0,0 +1,3 @@
+[[Repls]]
+Old = '/runs/\d+'
+New = '/runs/[RUN_ID]'
diff --git a/acceptance/bundle/run_as/allowed/regular_user/out.test.toml b/acceptance/bundle/run_as/allowed/regular_user/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run_as/allowed/regular_user/out.test.toml
+++ b/acceptance/bundle/run_as/allowed/regular_user/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run_as/allowed/service_principal/out.test.toml b/acceptance/bundle/run_as/allowed/service_principal/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run_as/allowed/service_principal/out.test.toml
+++ b/acceptance/bundle/run_as/allowed/service_principal/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run_as/dashboard_embed/out.test.toml b/acceptance/bundle/run_as/dashboard_embed/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run_as/dashboard_embed/out.test.toml
+++ b/acceptance/bundle/run_as/dashboard_embed/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run_as/empty_override/out.test.toml b/acceptance/bundle/run_as/empty_override/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run_as/empty_override/out.test.toml
+++ b/acceptance/bundle/run_as/empty_override/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run_as/empty_run_as/out.test.toml b/acceptance/bundle/run_as/empty_run_as/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run_as/empty_run_as/out.test.toml
+++ b/acceptance/bundle/run_as/empty_run_as/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run_as/empty_run_as_dict/out.test.toml b/acceptance/bundle/run_as/empty_run_as_dict/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run_as/empty_run_as_dict/out.test.toml
+++ b/acceptance/bundle/run_as/empty_run_as_dict/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run_as/empty_run_as_dict/output.txt b/acceptance/bundle/run_as/empty_run_as_dict/output.txt
index 63762765fb5..88363707b5c 100644
--- a/acceptance/bundle/run_as/empty_run_as_dict/output.txt
+++ b/acceptance/bundle/run_as/empty_run_as_dict/output.txt
@@ -1,4 +1,4 @@
-Error: run_as section must specify exactly one identity. Neither service_principal_name nor user_name is specified
+Error: run_as section must specify exactly one non-empty identity: user_name, service_principal_name, or group_name
   in databricks.yml:4:9
 
   "run_as": {},
diff --git a/acceptance/bundle/run_as/empty_sp/out.test.toml b/acceptance/bundle/run_as/empty_sp/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run_as/empty_sp/out.test.toml
+++ b/acceptance/bundle/run_as/empty_sp/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run_as/empty_sp/output.txt b/acceptance/bundle/run_as/empty_sp/output.txt
index f5808a912e8..2664376966e 100644
--- a/acceptance/bundle/run_as/empty_sp/output.txt
+++ b/acceptance/bundle/run_as/empty_sp/output.txt
@@ -1,4 +1,4 @@
-Error: run_as section must specify exactly one identity. Neither service_principal_name nor user_name is specified
+Error: run_as section must specify exactly one non-empty identity: user_name, service_principal_name, or group_name
   in databricks.yml:5:3
 
 {
diff --git a/acceptance/bundle/run_as/empty_user/out.test.toml b/acceptance/bundle/run_as/empty_user/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run_as/empty_user/out.test.toml
+++ b/acceptance/bundle/run_as/empty_user/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run_as/empty_user/output.txt b/acceptance/bundle/run_as/empty_user/output.txt
index 77aa2920022..509819dff0a 100644
--- a/acceptance/bundle/run_as/empty_user/output.txt
+++ b/acceptance/bundle/run_as/empty_user/output.txt
@@ -1,4 +1,4 @@
-Error: run_as section must specify exactly one identity. Neither service_principal_name nor user_name is specified
+Error: run_as section must specify exactly one non-empty identity: user_name, service_principal_name, or group_name
   in databricks.yml:5:3
 
 {
diff --git a/acceptance/bundle/run_as/empty_user_and_sp/out.test.toml b/acceptance/bundle/run_as/empty_user_and_sp/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run_as/empty_user_and_sp/out.test.toml
+++ b/acceptance/bundle/run_as/empty_user_and_sp/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run_as/empty_user_and_sp/output.txt b/acceptance/bundle/run_as/empty_user_and_sp/output.txt
index 31712da26ba..0d330606fee 100644
--- a/acceptance/bundle/run_as/empty_user_and_sp/output.txt
+++ b/acceptance/bundle/run_as/empty_user_and_sp/output.txt
@@ -1,4 +1,4 @@
-Error: run_as section must specify exactly one identity. Neither service_principal_name nor user_name is specified
+Error: run_as section must specify exactly one non-empty identity: user_name, service_principal_name, or group_name
   in databricks.yml:5:3
 
 {
diff --git a/acceptance/bundle/run_as/invalid_both_sp_and_user/out.test.toml b/acceptance/bundle/run_as/invalid_both_sp_and_user/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run_as/invalid_both_sp_and_user/out.test.toml
+++ b/acceptance/bundle/run_as/invalid_both_sp_and_user/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run_as/invalid_both_sp_and_user/output.txt b/acceptance/bundle/run_as/invalid_both_sp_and_user/output.txt
index 78188b8260c..3634b730576 100644
--- a/acceptance/bundle/run_as/invalid_both_sp_and_user/output.txt
+++ b/acceptance/bundle/run_as/invalid_both_sp_and_user/output.txt
@@ -1,4 +1,4 @@
-Error: run_as section cannot specify both user_name and service_principal_name
+Error: run_as section must specify exactly one non-empty identity: user_name, service_principal_name, or group_name
   in databricks.yml:6:3
 
 Name: run_as
diff --git a/acceptance/bundle/run_as/job_default/.gitignore b/acceptance/bundle/run_as/job_default/.gitignore
deleted file mode 100644
index ad75d16418e..00000000000
--- a/acceptance/bundle/run_as/job_default/.gitignore
+++ /dev/null
@@ -1 +0,0 @@
-out.requests.txt
diff --git a/acceptance/bundle/run_as/job_default/out.test.toml b/acceptance/bundle/run_as/job_default/out.test.toml
index 00d03354554..0f167effef1 100644
--- a/acceptance/bundle/run_as/job_default/out.test.toml
+++ b/acceptance/bundle/run_as/job_default/out.test.toml
@@ -1,3 +1,2 @@
-Local = false
 Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run_as/job_default/output.txt b/acceptance/bundle/run_as/job_default/output.txt
index 137a49cbd82..e8fa5630934 100644
--- a/acceptance/bundle/run_as/job_default/output.txt
+++ b/acceptance/bundle/run_as/job_default/output.txt
@@ -2,11 +2,11 @@
 === Deploy with run_as
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/run_as_job_default_[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.job_with_run_as
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
->>> print_requests.py //jobs
+>>> print_requests.py --nostamp //jobs
 {
   "method": "POST",
   "path": "/api/2.2/jobs/create",
@@ -41,7 +41,7 @@ Deployment complete!
   }
 }
 
->>> [CLI] jobs get [NUMID]
+>>> [CLI] jobs get [JOB_WITH_RUN_AS_ID]
 {
   "user_name": "deco-test-user@databricks.com"
 }
@@ -54,16 +54,16 @@ Plan: 0 to add, 1 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/run_as_job_default_[UNIQUE_NAME]/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Updated jobs.job_with_run_as
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
 
->>> print_requests.py //jobs
+>>> print_requests.py --nostamp //jobs
 {
   "method": "POST",
   "path": "/api/2.2/jobs/reset",
   "body": {
-    "job_id": [NUMID],
+    "job_id": [JOB_WITH_RUN_AS_ID],
     "new_settings": {
       "deployment": {
         "kind": "BUNDLE",
@@ -93,7 +93,7 @@ Deployment complete!
   }
 }
 
->>> [CLI] jobs get [NUMID]
+>>> [CLI] jobs get [JOB_WITH_RUN_AS_ID]
 {
   "user_name": "deco-test-user@databricks.com"
 }
@@ -104,5 +104,4 @@ The following resources will be deleted:
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/run_as_job_default_[UNIQUE_NAME]/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/bundle/run_as/job_default/script b/acceptance/bundle/run_as/job_default/script
index 3e80f98838e..04355896bff 100644
--- a/acceptance/bundle/run_as/job_default/script
+++ b/acceptance/bundle/run_as/job_default/script
@@ -2,14 +2,14 @@ envsubst < databricks.yml.tmpl > databricks.yml
 
 cleanup() {
     trace $CLI bundle destroy --auto-approve
-    rm -f out.requests.txt
+    rm -f "$OUT_REQUESTS"
 }
 trap cleanup EXIT
 
 title "Deploy with run_as"
 trace $CLI bundle deploy
-trace print_requests.py //jobs | contains.py "!GET" "POST"
-JOB_ID=$($CLI bundle summary -o json | jq -r '.resources.jobs.job_with_run_as.id')
+trace print_requests.py --nostamp //jobs | contains.py "!GET" "POST"
+JOB_ID=$(read_id.py job_with_run_as)
 trace $CLI jobs get $JOB_ID | jq -r '.settings.run_as'
 
 update_file.py databricks.yml "run_as:
@@ -18,5 +18,5 @@ update_file.py databricks.yml "run_as:
 title "Remove run_as and redeploy"
 trace $CLI bundle plan
 trace $CLI bundle deploy
-trace print_requests.py //jobs | contains.py "!GET" "POST"
+trace print_requests.py --nostamp //jobs | contains.py "!GET" "POST"
 trace $CLI jobs get $JOB_ID | jq -r '.settings.run_as'
diff --git a/acceptance/bundle/run_as/job_default/test.toml b/acceptance/bundle/run_as/job_default/test.toml
index 5d119a2dd7b..9aaa963719f 100644
--- a/acceptance/bundle/run_as/job_default/test.toml
+++ b/acceptance/bundle/run_as/job_default/test.toml
@@ -1,9 +1,5 @@
 Badness = "run_as is still set even though it's not in bundle and not in reset request"
 Ignore = [".databricks/.gitignore"]
 
-Local = false
 Cloud = true
 RecordRequests = true
-
-[EnvMatrix]
-  DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/run_as/model_serving_different/out.test.toml b/acceptance/bundle/run_as/model_serving_different/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run_as/model_serving_different/out.test.toml
+++ b/acceptance/bundle/run_as/model_serving_different/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run_as/model_serving_matching/out.test.toml b/acceptance/bundle/run_as/model_serving_matching/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run_as/model_serving_matching/out.test.toml
+++ b/acceptance/bundle/run_as/model_serving_matching/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run_as/out.test.toml b/acceptance/bundle/run_as/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run_as/out.test.toml
+++ b/acceptance/bundle/run_as/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run_as/pipelines/_script b/acceptance/bundle/run_as/pipelines/_script
index ad875a39a75..48345141741 100644
--- a/acceptance/bundle/run_as/pipelines/_script
+++ b/acceptance/bundle/run_as/pipelines/_script
@@ -1,6 +1,6 @@
 print_requests() {
-    jq --sort-keys 'select(.method != "GET" and (.path | contains("/pipelines")))' < out.requests.txt
-    rm out.requests.txt
+    jq --sort-keys 'select(.method != "GET" and (.path | contains("/pipelines")) and (.path | contains("/api/2.0/bundle") | not))' < "$OUT_REQUESTS" | nostamp.py
+    rm "$OUT_REQUESTS"
 }
 
 targets=("t_user_name" "t_user_name_different" "t_service_principal_name" "t_service_principal_name_different")
@@ -15,10 +15,10 @@ for target in "${targets[@]}"; do
     trace $CLI bundle plan -t $target
 
     # Debug plan
-    $CLI bundle plan -o json -t $target > out.plan_$target.$DATABRICKS_BUNDLE_ENGINE.json
+    $CLI bundle plan -o json -t $target | nostamp.py > out.plan_$target.json
 
     # Deploy
-    rm -f out.requests.txt
+    rm -f "$OUT_REQUESTS"
     trace $CLI bundle deploy -t $target
     print_requests > out.requests_$target.json
 done
diff --git a/acceptance/bundle/run_as/pipelines/regular_user/out.plan_t_service_principal_name.direct.json b/acceptance/bundle/run_as/pipelines/regular_user/out.plan_t_service_principal_name.direct.json
deleted file mode 100644
index 6ec418be19a..00000000000
--- a/acceptance/bundle/run_as/pipelines/regular_user/out.plan_t_service_principal_name.direct.json
+++ /dev/null
@@ -1,61 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.nyc_taxi_pipeline": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "channel": "CURRENT",
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/run_as/t_service_principal_name/state/metadata.json"
-          },
-          "edition": "ADVANCED",
-          "libraries": [
-            {
-              "notebook": {
-                "path": "/Workspace/Users/[USERNAME]/.bundle/run_as/t_service_principal_name/files/dlt/nyc_taxi_loader"
-              }
-            }
-          ],
-          "name": "nyc taxi loader",
-          "run_as": {
-            "service_principal_name": "[UUID]"
-          }
-        }
-      }
-    },
-    "resources.pipelines.nyc_taxi_pipeline.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.nyc_taxi_pipeline",
-          "label": "${resources.pipelines.nyc_taxi_pipeline.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "CAN_VIEW",
-              "service_principal_name": "my_service_principal"
-            },
-            {
-              "level": "CAN_VIEW",
-              "user_name": "different@databricks.com"
-            },
-            {
-              "level": "IS_OWNER",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/pipelines/${resources.pipelines.nyc_taxi_pipeline.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/run_as/pipelines/regular_user/out.plan_t_service_principal_name.json b/acceptance/bundle/run_as/pipelines/regular_user/out.plan_t_service_principal_name.json
new file mode 100644
index 00000000000..2ef869ccde5
--- /dev/null
+++ b/acceptance/bundle/run_as/pipelines/regular_user/out.plan_t_service_principal_name.json
@@ -0,0 +1,61 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.pipelines.nyc_taxi_pipeline": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "channel": "CURRENT",
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/run_as/t_service_principal_name/state/metadata.json"
+          },
+          "edition": "ADVANCED",
+          "libraries": [
+            {
+              "notebook": {
+                "path": "/Workspace/Users/[USERNAME]/.bundle/run_as/t_service_principal_name/files/dlt/nyc_taxi_loader"
+              }
+            }
+          ],
+          "name": "nyc taxi loader",
+          "run_as": {
+            "service_principal_name": "[UUID]"
+          }
+        }
+      }
+    },
+    "resources.pipelines.nyc_taxi_pipeline.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.nyc_taxi_pipeline",
+          "label": "${resources.pipelines.nyc_taxi_pipeline.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "CAN_VIEW",
+              "service_principal_name": "my_service_principal"
+            },
+            {
+              "level": "CAN_VIEW",
+              "user_name": "different@databricks.com"
+            },
+            {
+              "level": "IS_OWNER",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/pipelines/${resources.pipelines.nyc_taxi_pipeline.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/run_as/pipelines/regular_user/out.plan_t_service_principal_name.terraform.json b/acceptance/bundle/run_as/pipelines/regular_user/out.plan_t_service_principal_name.terraform.json
deleted file mode 100644
index 6716f74d4fa..00000000000
--- a/acceptance/bundle/run_as/pipelines/regular_user/out.plan_t_service_principal_name.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.nyc_taxi_pipeline": {
-      "action": "create"
-    },
-    "resources.pipelines.nyc_taxi_pipeline.permissions": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/run_as/pipelines/regular_user/out.plan_t_service_principal_name_different.direct.json b/acceptance/bundle/run_as/pipelines/regular_user/out.plan_t_service_principal_name_different.direct.json
deleted file mode 100644
index d6a01a8b688..00000000000
--- a/acceptance/bundle/run_as/pipelines/regular_user/out.plan_t_service_principal_name_different.direct.json
+++ /dev/null
@@ -1,61 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.nyc_taxi_pipeline": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "channel": "CURRENT",
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/run_as/t_service_principal_name_different/state/metadata.json"
-          },
-          "edition": "ADVANCED",
-          "libraries": [
-            {
-              "notebook": {
-                "path": "/Workspace/Users/[USERNAME]/.bundle/run_as/t_service_principal_name_different/files/dlt/nyc_taxi_loader"
-              }
-            }
-          ],
-          "name": "nyc taxi loader",
-          "run_as": {
-            "user_name": "[UUID]"
-          }
-        }
-      }
-    },
-    "resources.pipelines.nyc_taxi_pipeline.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.nyc_taxi_pipeline",
-          "label": "${resources.pipelines.nyc_taxi_pipeline.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "CAN_VIEW",
-              "service_principal_name": "my_service_principal"
-            },
-            {
-              "level": "CAN_VIEW",
-              "user_name": "different@databricks.com"
-            },
-            {
-              "level": "IS_OWNER",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/pipelines/${resources.pipelines.nyc_taxi_pipeline.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/run_as/pipelines/regular_user/out.plan_t_service_principal_name_different.json b/acceptance/bundle/run_as/pipelines/regular_user/out.plan_t_service_principal_name_different.json
new file mode 100644
index 00000000000..530eb3584ad
--- /dev/null
+++ b/acceptance/bundle/run_as/pipelines/regular_user/out.plan_t_service_principal_name_different.json
@@ -0,0 +1,61 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.pipelines.nyc_taxi_pipeline": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "channel": "CURRENT",
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/run_as/t_service_principal_name_different/state/metadata.json"
+          },
+          "edition": "ADVANCED",
+          "libraries": [
+            {
+              "notebook": {
+                "path": "/Workspace/Users/[USERNAME]/.bundle/run_as/t_service_principal_name_different/files/dlt/nyc_taxi_loader"
+              }
+            }
+          ],
+          "name": "nyc taxi loader",
+          "run_as": {
+            "user_name": "[UUID]"
+          }
+        }
+      }
+    },
+    "resources.pipelines.nyc_taxi_pipeline.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.nyc_taxi_pipeline",
+          "label": "${resources.pipelines.nyc_taxi_pipeline.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "CAN_VIEW",
+              "service_principal_name": "my_service_principal"
+            },
+            {
+              "level": "CAN_VIEW",
+              "user_name": "different@databricks.com"
+            },
+            {
+              "level": "IS_OWNER",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/pipelines/${resources.pipelines.nyc_taxi_pipeline.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/run_as/pipelines/regular_user/out.plan_t_service_principal_name_different.terraform.json b/acceptance/bundle/run_as/pipelines/regular_user/out.plan_t_service_principal_name_different.terraform.json
deleted file mode 100644
index 6716f74d4fa..00000000000
--- a/acceptance/bundle/run_as/pipelines/regular_user/out.plan_t_service_principal_name_different.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.nyc_taxi_pipeline": {
-      "action": "create"
-    },
-    "resources.pipelines.nyc_taxi_pipeline.permissions": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/run_as/pipelines/regular_user/out.plan_t_user_name.direct.json b/acceptance/bundle/run_as/pipelines/regular_user/out.plan_t_user_name.direct.json
deleted file mode 100644
index ed467b48927..00000000000
--- a/acceptance/bundle/run_as/pipelines/regular_user/out.plan_t_user_name.direct.json
+++ /dev/null
@@ -1,61 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.nyc_taxi_pipeline": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "channel": "CURRENT",
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/run_as/t_user_name/state/metadata.json"
-          },
-          "edition": "ADVANCED",
-          "libraries": [
-            {
-              "notebook": {
-                "path": "/Workspace/Users/[USERNAME]/.bundle/run_as/t_user_name/files/dlt/nyc_taxi_loader"
-              }
-            }
-          ],
-          "name": "nyc taxi loader",
-          "run_as": {
-            "user_name": "[USERNAME]"
-          }
-        }
-      }
-    },
-    "resources.pipelines.nyc_taxi_pipeline.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.nyc_taxi_pipeline",
-          "label": "${resources.pipelines.nyc_taxi_pipeline.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "CAN_VIEW",
-              "service_principal_name": "my_service_principal"
-            },
-            {
-              "level": "CAN_VIEW",
-              "user_name": "different@databricks.com"
-            },
-            {
-              "level": "IS_OWNER",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/pipelines/${resources.pipelines.nyc_taxi_pipeline.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/run_as/pipelines/regular_user/out.plan_t_user_name.json b/acceptance/bundle/run_as/pipelines/regular_user/out.plan_t_user_name.json
new file mode 100644
index 00000000000..59caae39355
--- /dev/null
+++ b/acceptance/bundle/run_as/pipelines/regular_user/out.plan_t_user_name.json
@@ -0,0 +1,61 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.pipelines.nyc_taxi_pipeline": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "channel": "CURRENT",
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/run_as/t_user_name/state/metadata.json"
+          },
+          "edition": "ADVANCED",
+          "libraries": [
+            {
+              "notebook": {
+                "path": "/Workspace/Users/[USERNAME]/.bundle/run_as/t_user_name/files/dlt/nyc_taxi_loader"
+              }
+            }
+          ],
+          "name": "nyc taxi loader",
+          "run_as": {
+            "user_name": "[USERNAME]"
+          }
+        }
+      }
+    },
+    "resources.pipelines.nyc_taxi_pipeline.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.nyc_taxi_pipeline",
+          "label": "${resources.pipelines.nyc_taxi_pipeline.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "CAN_VIEW",
+              "service_principal_name": "my_service_principal"
+            },
+            {
+              "level": "CAN_VIEW",
+              "user_name": "different@databricks.com"
+            },
+            {
+              "level": "IS_OWNER",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/pipelines/${resources.pipelines.nyc_taxi_pipeline.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/run_as/pipelines/regular_user/out.plan_t_user_name.terraform.json b/acceptance/bundle/run_as/pipelines/regular_user/out.plan_t_user_name.terraform.json
deleted file mode 100644
index 6716f74d4fa..00000000000
--- a/acceptance/bundle/run_as/pipelines/regular_user/out.plan_t_user_name.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.nyc_taxi_pipeline": {
-      "action": "create"
-    },
-    "resources.pipelines.nyc_taxi_pipeline.permissions": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/run_as/pipelines/regular_user/out.plan_t_user_name_different.direct.json b/acceptance/bundle/run_as/pipelines/regular_user/out.plan_t_user_name_different.direct.json
deleted file mode 100644
index 402b2d6149b..00000000000
--- a/acceptance/bundle/run_as/pipelines/regular_user/out.plan_t_user_name_different.direct.json
+++ /dev/null
@@ -1,61 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.nyc_taxi_pipeline": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "channel": "CURRENT",
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/run_as/t_user_name_different/state/metadata.json"
-          },
-          "edition": "ADVANCED",
-          "libraries": [
-            {
-              "notebook": {
-                "path": "/Workspace/Users/[USERNAME]/.bundle/run_as/t_user_name_different/files/dlt/nyc_taxi_loader"
-              }
-            }
-          ],
-          "name": "nyc taxi loader",
-          "run_as": {
-            "user_name": "different@databricks.com"
-          }
-        }
-      }
-    },
-    "resources.pipelines.nyc_taxi_pipeline.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.nyc_taxi_pipeline",
-          "label": "${resources.pipelines.nyc_taxi_pipeline.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "CAN_VIEW",
-              "service_principal_name": "my_service_principal"
-            },
-            {
-              "level": "CAN_VIEW",
-              "user_name": "different@databricks.com"
-            },
-            {
-              "level": "IS_OWNER",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/pipelines/${resources.pipelines.nyc_taxi_pipeline.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/run_as/pipelines/regular_user/out.plan_t_user_name_different.json b/acceptance/bundle/run_as/pipelines/regular_user/out.plan_t_user_name_different.json
new file mode 100644
index 00000000000..73e78d7ff49
--- /dev/null
+++ b/acceptance/bundle/run_as/pipelines/regular_user/out.plan_t_user_name_different.json
@@ -0,0 +1,61 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.pipelines.nyc_taxi_pipeline": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "channel": "CURRENT",
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/run_as/t_user_name_different/state/metadata.json"
+          },
+          "edition": "ADVANCED",
+          "libraries": [
+            {
+              "notebook": {
+                "path": "/Workspace/Users/[USERNAME]/.bundle/run_as/t_user_name_different/files/dlt/nyc_taxi_loader"
+              }
+            }
+          ],
+          "name": "nyc taxi loader",
+          "run_as": {
+            "user_name": "different@databricks.com"
+          }
+        }
+      }
+    },
+    "resources.pipelines.nyc_taxi_pipeline.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.nyc_taxi_pipeline",
+          "label": "${resources.pipelines.nyc_taxi_pipeline.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "CAN_VIEW",
+              "service_principal_name": "my_service_principal"
+            },
+            {
+              "level": "CAN_VIEW",
+              "user_name": "different@databricks.com"
+            },
+            {
+              "level": "IS_OWNER",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/pipelines/${resources.pipelines.nyc_taxi_pipeline.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/run_as/pipelines/regular_user/out.plan_t_user_name_different.terraform.json b/acceptance/bundle/run_as/pipelines/regular_user/out.plan_t_user_name_different.terraform.json
deleted file mode 100644
index 6716f74d4fa..00000000000
--- a/acceptance/bundle/run_as/pipelines/regular_user/out.plan_t_user_name_different.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.nyc_taxi_pipeline": {
-      "action": "create"
-    },
-    "resources.pipelines.nyc_taxi_pipeline.permissions": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/run_as/pipelines/regular_user/out.test.toml b/acceptance/bundle/run_as/pipelines/regular_user/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run_as/pipelines/regular_user/out.test.toml
+++ b/acceptance/bundle/run_as/pipelines/regular_user/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run_as/pipelines/regular_user/output.txt b/acceptance/bundle/run_as/pipelines/regular_user/output.txt
index 6baedcbb908..21faafb4d57 100644
--- a/acceptance/bundle/run_as/pipelines/regular_user/output.txt
+++ b/acceptance/bundle/run_as/pipelines/regular_user/output.txt
@@ -18,9 +18,10 @@ Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy -t t_user_name
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/run_as/t_user_name/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created pipelines.nyc_taxi_pipeline
+Created pipelines.nyc_taxi_pipeline.permissions
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 \nProcessing target: t_user_name_different
 
 >>> [CLI] bundle validate -t t_user_name_different
@@ -40,9 +41,10 @@ Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy -t t_user_name_different
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/run_as/t_user_name_different/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created pipelines.nyc_taxi_pipeline
+Created pipelines.nyc_taxi_pipeline.permissions
+Files: 5 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 \nProcessing target: t_service_principal_name
 
 >>> [CLI] bundle validate -t t_service_principal_name
@@ -62,9 +64,10 @@ Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy -t t_service_principal_name
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/run_as/t_service_principal_name/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created pipelines.nyc_taxi_pipeline
+Created pipelines.nyc_taxi_pipeline.permissions
+Files: 7 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 \nProcessing target: t_service_principal_name_different
 
 >>> [CLI] bundle validate -t t_service_principal_name_different
@@ -84,6 +87,7 @@ Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy -t t_service_principal_name_different
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/run_as/t_service_principal_name_different/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created pipelines.nyc_taxi_pipeline
+Created pipelines.nyc_taxi_pipeline.permissions
+Files: 9 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
diff --git a/acceptance/bundle/run_as/pipelines/service_principal/out.plan_t_service_principal_name.direct.json b/acceptance/bundle/run_as/pipelines/service_principal/out.plan_t_service_principal_name.direct.json
deleted file mode 100644
index 16aee24495c..00000000000
--- a/acceptance/bundle/run_as/pipelines/service_principal/out.plan_t_service_principal_name.direct.json
+++ /dev/null
@@ -1,61 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.nyc_taxi_pipeline": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "channel": "CURRENT",
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/run_as/t_service_principal_name/state/metadata.json"
-          },
-          "edition": "ADVANCED",
-          "libraries": [
-            {
-              "notebook": {
-                "path": "/Workspace/Users/[USERNAME]/.bundle/run_as/t_service_principal_name/files/dlt/nyc_taxi_loader"
-              }
-            }
-          ],
-          "name": "nyc taxi loader",
-          "run_as": {
-            "service_principal_name": "[USERNAME]"
-          }
-        }
-      }
-    },
-    "resources.pipelines.nyc_taxi_pipeline.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.nyc_taxi_pipeline",
-          "label": "${resources.pipelines.nyc_taxi_pipeline.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "CAN_VIEW",
-              "service_principal_name": "my_service_principal"
-            },
-            {
-              "level": "CAN_VIEW",
-              "user_name": "different@databricks.com"
-            },
-            {
-              "level": "IS_OWNER",
-              "service_principal_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/pipelines/${resources.pipelines.nyc_taxi_pipeline.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/run_as/pipelines/service_principal/out.plan_t_service_principal_name.json b/acceptance/bundle/run_as/pipelines/service_principal/out.plan_t_service_principal_name.json
new file mode 100644
index 00000000000..c9ea7a11405
--- /dev/null
+++ b/acceptance/bundle/run_as/pipelines/service_principal/out.plan_t_service_principal_name.json
@@ -0,0 +1,61 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.pipelines.nyc_taxi_pipeline": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "channel": "CURRENT",
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/run_as/t_service_principal_name/state/metadata.json"
+          },
+          "edition": "ADVANCED",
+          "libraries": [
+            {
+              "notebook": {
+                "path": "/Workspace/Users/[USERNAME]/.bundle/run_as/t_service_principal_name/files/dlt/nyc_taxi_loader"
+              }
+            }
+          ],
+          "name": "nyc taxi loader",
+          "run_as": {
+            "service_principal_name": "[USERNAME]"
+          }
+        }
+      }
+    },
+    "resources.pipelines.nyc_taxi_pipeline.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.nyc_taxi_pipeline",
+          "label": "${resources.pipelines.nyc_taxi_pipeline.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "CAN_VIEW",
+              "service_principal_name": "my_service_principal"
+            },
+            {
+              "level": "CAN_VIEW",
+              "user_name": "different@databricks.com"
+            },
+            {
+              "level": "IS_OWNER",
+              "service_principal_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/pipelines/${resources.pipelines.nyc_taxi_pipeline.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/run_as/pipelines/service_principal/out.plan_t_service_principal_name.terraform.json b/acceptance/bundle/run_as/pipelines/service_principal/out.plan_t_service_principal_name.terraform.json
deleted file mode 100644
index 6716f74d4fa..00000000000
--- a/acceptance/bundle/run_as/pipelines/service_principal/out.plan_t_service_principal_name.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.nyc_taxi_pipeline": {
-      "action": "create"
-    },
-    "resources.pipelines.nyc_taxi_pipeline.permissions": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/run_as/pipelines/service_principal/out.plan_t_service_principal_name_different.direct.json b/acceptance/bundle/run_as/pipelines/service_principal/out.plan_t_service_principal_name_different.direct.json
deleted file mode 100644
index 75ad66649b4..00000000000
--- a/acceptance/bundle/run_as/pipelines/service_principal/out.plan_t_service_principal_name_different.direct.json
+++ /dev/null
@@ -1,61 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.nyc_taxi_pipeline": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "channel": "CURRENT",
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/run_as/t_service_principal_name_different/state/metadata.json"
-          },
-          "edition": "ADVANCED",
-          "libraries": [
-            {
-              "notebook": {
-                "path": "/Workspace/Users/[USERNAME]/.bundle/run_as/t_service_principal_name_different/files/dlt/nyc_taxi_loader"
-              }
-            }
-          ],
-          "name": "nyc taxi loader",
-          "run_as": {
-            "user_name": "[UUID]"
-          }
-        }
-      }
-    },
-    "resources.pipelines.nyc_taxi_pipeline.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.nyc_taxi_pipeline",
-          "label": "${resources.pipelines.nyc_taxi_pipeline.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "CAN_VIEW",
-              "service_principal_name": "my_service_principal"
-            },
-            {
-              "level": "CAN_VIEW",
-              "user_name": "different@databricks.com"
-            },
-            {
-              "level": "IS_OWNER",
-              "service_principal_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/pipelines/${resources.pipelines.nyc_taxi_pipeline.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/run_as/pipelines/service_principal/out.plan_t_service_principal_name_different.json b/acceptance/bundle/run_as/pipelines/service_principal/out.plan_t_service_principal_name_different.json
new file mode 100644
index 00000000000..313da5328f1
--- /dev/null
+++ b/acceptance/bundle/run_as/pipelines/service_principal/out.plan_t_service_principal_name_different.json
@@ -0,0 +1,61 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.pipelines.nyc_taxi_pipeline": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "channel": "CURRENT",
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/run_as/t_service_principal_name_different/state/metadata.json"
+          },
+          "edition": "ADVANCED",
+          "libraries": [
+            {
+              "notebook": {
+                "path": "/Workspace/Users/[USERNAME]/.bundle/run_as/t_service_principal_name_different/files/dlt/nyc_taxi_loader"
+              }
+            }
+          ],
+          "name": "nyc taxi loader",
+          "run_as": {
+            "user_name": "[UUID]"
+          }
+        }
+      }
+    },
+    "resources.pipelines.nyc_taxi_pipeline.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.nyc_taxi_pipeline",
+          "label": "${resources.pipelines.nyc_taxi_pipeline.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "CAN_VIEW",
+              "service_principal_name": "my_service_principal"
+            },
+            {
+              "level": "CAN_VIEW",
+              "user_name": "different@databricks.com"
+            },
+            {
+              "level": "IS_OWNER",
+              "service_principal_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/pipelines/${resources.pipelines.nyc_taxi_pipeline.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/run_as/pipelines/service_principal/out.plan_t_service_principal_name_different.terraform.json b/acceptance/bundle/run_as/pipelines/service_principal/out.plan_t_service_principal_name_different.terraform.json
deleted file mode 100644
index 6716f74d4fa..00000000000
--- a/acceptance/bundle/run_as/pipelines/service_principal/out.plan_t_service_principal_name_different.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.nyc_taxi_pipeline": {
-      "action": "create"
-    },
-    "resources.pipelines.nyc_taxi_pipeline.permissions": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/run_as/pipelines/service_principal/out.plan_t_user_name.direct.json b/acceptance/bundle/run_as/pipelines/service_principal/out.plan_t_user_name.direct.json
deleted file mode 100644
index 239e6993940..00000000000
--- a/acceptance/bundle/run_as/pipelines/service_principal/out.plan_t_user_name.direct.json
+++ /dev/null
@@ -1,61 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.nyc_taxi_pipeline": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "channel": "CURRENT",
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/run_as/t_user_name/state/metadata.json"
-          },
-          "edition": "ADVANCED",
-          "libraries": [
-            {
-              "notebook": {
-                "path": "/Workspace/Users/[USERNAME]/.bundle/run_as/t_user_name/files/dlt/nyc_taxi_loader"
-              }
-            }
-          ],
-          "name": "nyc taxi loader",
-          "run_as": {
-            "user_name": "tester@databricks.com"
-          }
-        }
-      }
-    },
-    "resources.pipelines.nyc_taxi_pipeline.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.nyc_taxi_pipeline",
-          "label": "${resources.pipelines.nyc_taxi_pipeline.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "CAN_VIEW",
-              "service_principal_name": "my_service_principal"
-            },
-            {
-              "level": "CAN_VIEW",
-              "user_name": "different@databricks.com"
-            },
-            {
-              "level": "IS_OWNER",
-              "service_principal_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/pipelines/${resources.pipelines.nyc_taxi_pipeline.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/run_as/pipelines/service_principal/out.plan_t_user_name.json b/acceptance/bundle/run_as/pipelines/service_principal/out.plan_t_user_name.json
new file mode 100644
index 00000000000..c813a21c989
--- /dev/null
+++ b/acceptance/bundle/run_as/pipelines/service_principal/out.plan_t_user_name.json
@@ -0,0 +1,61 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.pipelines.nyc_taxi_pipeline": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "channel": "CURRENT",
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/run_as/t_user_name/state/metadata.json"
+          },
+          "edition": "ADVANCED",
+          "libraries": [
+            {
+              "notebook": {
+                "path": "/Workspace/Users/[USERNAME]/.bundle/run_as/t_user_name/files/dlt/nyc_taxi_loader"
+              }
+            }
+          ],
+          "name": "nyc taxi loader",
+          "run_as": {
+            "user_name": "tester@databricks.com"
+          }
+        }
+      }
+    },
+    "resources.pipelines.nyc_taxi_pipeline.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.nyc_taxi_pipeline",
+          "label": "${resources.pipelines.nyc_taxi_pipeline.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "CAN_VIEW",
+              "service_principal_name": "my_service_principal"
+            },
+            {
+              "level": "CAN_VIEW",
+              "user_name": "different@databricks.com"
+            },
+            {
+              "level": "IS_OWNER",
+              "service_principal_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/pipelines/${resources.pipelines.nyc_taxi_pipeline.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/run_as/pipelines/service_principal/out.plan_t_user_name.terraform.json b/acceptance/bundle/run_as/pipelines/service_principal/out.plan_t_user_name.terraform.json
deleted file mode 100644
index 6716f74d4fa..00000000000
--- a/acceptance/bundle/run_as/pipelines/service_principal/out.plan_t_user_name.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.nyc_taxi_pipeline": {
-      "action": "create"
-    },
-    "resources.pipelines.nyc_taxi_pipeline.permissions": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/run_as/pipelines/service_principal/out.plan_t_user_name_different.direct.json b/acceptance/bundle/run_as/pipelines/service_principal/out.plan_t_user_name_different.direct.json
deleted file mode 100644
index 3db3ccc2b18..00000000000
--- a/acceptance/bundle/run_as/pipelines/service_principal/out.plan_t_user_name_different.direct.json
+++ /dev/null
@@ -1,61 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.nyc_taxi_pipeline": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "channel": "CURRENT",
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/run_as/t_user_name_different/state/metadata.json"
-          },
-          "edition": "ADVANCED",
-          "libraries": [
-            {
-              "notebook": {
-                "path": "/Workspace/Users/[USERNAME]/.bundle/run_as/t_user_name_different/files/dlt/nyc_taxi_loader"
-              }
-            }
-          ],
-          "name": "nyc taxi loader",
-          "run_as": {
-            "user_name": "different@databricks.com"
-          }
-        }
-      }
-    },
-    "resources.pipelines.nyc_taxi_pipeline.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.nyc_taxi_pipeline",
-          "label": "${resources.pipelines.nyc_taxi_pipeline.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "CAN_VIEW",
-              "service_principal_name": "my_service_principal"
-            },
-            {
-              "level": "CAN_VIEW",
-              "user_name": "different@databricks.com"
-            },
-            {
-              "level": "IS_OWNER",
-              "service_principal_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/pipelines/${resources.pipelines.nyc_taxi_pipeline.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/run_as/pipelines/service_principal/out.plan_t_user_name_different.json b/acceptance/bundle/run_as/pipelines/service_principal/out.plan_t_user_name_different.json
new file mode 100644
index 00000000000..e066c98eab8
--- /dev/null
+++ b/acceptance/bundle/run_as/pipelines/service_principal/out.plan_t_user_name_different.json
@@ -0,0 +1,61 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.pipelines.nyc_taxi_pipeline": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "channel": "CURRENT",
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/run_as/t_user_name_different/state/metadata.json"
+          },
+          "edition": "ADVANCED",
+          "libraries": [
+            {
+              "notebook": {
+                "path": "/Workspace/Users/[USERNAME]/.bundle/run_as/t_user_name_different/files/dlt/nyc_taxi_loader"
+              }
+            }
+          ],
+          "name": "nyc taxi loader",
+          "run_as": {
+            "user_name": "different@databricks.com"
+          }
+        }
+      }
+    },
+    "resources.pipelines.nyc_taxi_pipeline.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.nyc_taxi_pipeline",
+          "label": "${resources.pipelines.nyc_taxi_pipeline.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "CAN_VIEW",
+              "service_principal_name": "my_service_principal"
+            },
+            {
+              "level": "CAN_VIEW",
+              "user_name": "different@databricks.com"
+            },
+            {
+              "level": "IS_OWNER",
+              "service_principal_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/pipelines/${resources.pipelines.nyc_taxi_pipeline.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/run_as/pipelines/service_principal/out.plan_t_user_name_different.terraform.json b/acceptance/bundle/run_as/pipelines/service_principal/out.plan_t_user_name_different.terraform.json
deleted file mode 100644
index 6716f74d4fa..00000000000
--- a/acceptance/bundle/run_as/pipelines/service_principal/out.plan_t_user_name_different.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.pipelines.nyc_taxi_pipeline": {
-      "action": "create"
-    },
-    "resources.pipelines.nyc_taxi_pipeline.permissions": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/run_as/pipelines/service_principal/out.test.toml b/acceptance/bundle/run_as/pipelines/service_principal/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run_as/pipelines/service_principal/out.test.toml
+++ b/acceptance/bundle/run_as/pipelines/service_principal/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/run_as/pipelines/service_principal/output.txt b/acceptance/bundle/run_as/pipelines/service_principal/output.txt
index 6baedcbb908..21faafb4d57 100644
--- a/acceptance/bundle/run_as/pipelines/service_principal/output.txt
+++ b/acceptance/bundle/run_as/pipelines/service_principal/output.txt
@@ -18,9 +18,10 @@ Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy -t t_user_name
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/run_as/t_user_name/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created pipelines.nyc_taxi_pipeline
+Created pipelines.nyc_taxi_pipeline.permissions
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 \nProcessing target: t_user_name_different
 
 >>> [CLI] bundle validate -t t_user_name_different
@@ -40,9 +41,10 @@ Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy -t t_user_name_different
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/run_as/t_user_name_different/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created pipelines.nyc_taxi_pipeline
+Created pipelines.nyc_taxi_pipeline.permissions
+Files: 5 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 \nProcessing target: t_service_principal_name
 
 >>> [CLI] bundle validate -t t_service_principal_name
@@ -62,9 +64,10 @@ Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy -t t_service_principal_name
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/run_as/t_service_principal_name/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created pipelines.nyc_taxi_pipeline
+Created pipelines.nyc_taxi_pipeline.permissions
+Files: 7 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 \nProcessing target: t_service_principal_name_different
 
 >>> [CLI] bundle validate -t t_service_principal_name_different
@@ -84,6 +87,7 @@ Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy -t t_service_principal_name_different
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/run_as/t_service_principal_name_different/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created pipelines.nyc_taxi_pipeline
+Created pipelines.nyc_taxi_pipeline.permissions
+Files: 9 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
diff --git a/acceptance/bundle/run_as/pipelines_legacy/out.test.toml b/acceptance/bundle/run_as/pipelines_legacy/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/run_as/pipelines_legacy/out.test.toml
+++ b/acceptance/bundle/run_as/pipelines_legacy/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/scripts/databricks.yml b/acceptance/bundle/scripts/databricks.yml
index 6421e2b5941..b545b0e208b 100644
--- a/acceptance/bundle/scripts/databricks.yml
+++ b/acceptance/bundle/scripts/databricks.yml
@@ -8,4 +8,4 @@ experimental:
     prebuild: "python3 ./myscript.py 0 prebuild"
     postbuild: "python3 ./myscript.py 0 postbuild"
     predeploy: "python3 ./myscript.py 0 predeploy"
-    postdeploy: "python3 ./myscript.py 0 postdeploy"
+    postdeploy: "python3 ./myscript.py $POSTDEPLOY_EXITCODE postdeploy"
diff --git a/acceptance/bundle/scripts/no-trailing-newline/databricks.yml b/acceptance/bundle/scripts/no-trailing-newline/databricks.yml
new file mode 100644
index 00000000000..3f4116151da
--- /dev/null
+++ b/acceptance/bundle/scripts/no-trailing-newline/databricks.yml
@@ -0,0 +1,6 @@
+bundle:
+  name: scripts_no_trailing_newline
+
+experimental:
+  scripts:
+    preinit: "python3 ./myscript.py"
diff --git a/acceptance/bundle/scripts/no-trailing-newline/myscript.py b/acceptance/bundle/scripts/no-trailing-newline/myscript.py
new file mode 100644
index 00000000000..c8937dbf853
--- /dev/null
+++ b/acceptance/bundle/scripts/no-trailing-newline/myscript.py
@@ -0,0 +1,5 @@
+import sys
+
+sys.stdout.write("line 1\n")
+sys.stdout.write("line 2\n")
+sys.stdout.write("line without newline")
diff --git a/acceptance/bundle/scripts/no-trailing-newline/out.test.toml b/acceptance/bundle/scripts/no-trailing-newline/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/scripts/no-trailing-newline/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/scripts/no-trailing-newline/output.txt b/acceptance/bundle/scripts/no-trailing-newline/output.txt
new file mode 100644
index 00000000000..49ccb792374
--- /dev/null
+++ b/acceptance/bundle/scripts/no-trailing-newline/output.txt
@@ -0,0 +1,13 @@
+
+>>> [CLI] bundle validate
+Executing 'preinit' script
+line 1
+line 2
+line without newline
+Name: scripts_no_trailing_newline
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/scripts_no_trailing_newline/default
+
+Validation OK!
diff --git a/acceptance/bundle/validate/definitions_yaml_anchors/script b/acceptance/bundle/scripts/no-trailing-newline/script
similarity index 100%
rename from acceptance/bundle/validate/definitions_yaml_anchors/script
rename to acceptance/bundle/scripts/no-trailing-newline/script
diff --git a/acceptance/bundle/scripts/out.test.toml b/acceptance/bundle/scripts/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/scripts/out.test.toml
+++ b/acceptance/bundle/scripts/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/scripts/output.txt b/acceptance/bundle/scripts/output.txt
index 68afb2feccb..5ef46ac243e 100644
--- a/acceptance/bundle/scripts/output.txt
+++ b/acceptance/bundle/scripts/output.txt
@@ -26,7 +26,7 @@ Found 1 error
 
 Exit code: 1
 
->>> EXITCODE=0 errcode [CLI] bundle deploy
+>>> EXITCODE=0 POSTDEPLOY_EXITCODE=0 errcode [CLI] bundle deploy
 Executing 'preinit' script
 from myscript.py 0 preinit: hello stdout!
 from myscript.py 0 preinit: hello stderr!
@@ -43,8 +43,35 @@ Executing 'predeploy' script
 from myscript.py 0 predeploy: hello stdout!
 from myscript.py 0 predeploy: hello stderr!
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/scripts/default/files...
-Deploying resources...
-Deployment complete!
+Files: 9 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
 Executing 'postdeploy' script
 from myscript.py 0 postdeploy: hello stdout!
 from myscript.py 0 postdeploy: hello stderr!
+
+>>> EXITCODE=0 POSTDEPLOY_EXITCODE=1 errcode [CLI] bundle deploy
+Executing 'preinit' script
+from myscript.py 0 preinit: hello stdout!
+from myscript.py 0 preinit: hello stderr!
+Executing 'postinit' script
+from myscript.py 0 postinit: hello stdout!
+from myscript.py 0 postinit: hello stderr!
+Executing 'prebuild' script
+from myscript.py 0 prebuild: hello stdout!
+from myscript.py 0 prebuild: hello stderr!
+Executing 'postbuild' script
+from myscript.py 0 postbuild: hello stdout!
+from myscript.py 0 postbuild: hello stderr!
+Executing 'predeploy' script
+from myscript.py 0 predeploy: hello stdout!
+from myscript.py 0 predeploy: hello stderr!
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/scripts/default/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
+Executing 'postdeploy' script
+from myscript.py 1 postdeploy: hello stdout!
+from myscript.py 1 postdeploy: hello stderr!
+Error: failed to execute script: exit status 1
+
+
+Exit code: 1
diff --git a/acceptance/bundle/scripts/restricted-execution/out.test.toml b/acceptance/bundle/scripts/restricted-execution/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/scripts/restricted-execution/out.test.toml
+++ b/acceptance/bundle/scripts/restricted-execution/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/scripts/restricted-execution/output.txt b/acceptance/bundle/scripts/restricted-execution/output.txt
index f377edba7cb..57cbd1e88e3 100644
--- a/acceptance/bundle/scripts/restricted-execution/output.txt
+++ b/acceptance/bundle/scripts/restricted-execution/output.txt
@@ -12,8 +12,8 @@ postbuild value_from_env
 Executing 'predeploy' script
 predeploy value_from_env
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/scripts_with_restricted_execution/default/files...
-Deploying resources...
-Deployment complete!
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
 Executing 'postdeploy' script
 postdeploy value_from_env
 
diff --git a/acceptance/bundle/scripts/script b/acceptance/bundle/scripts/script
index de07d277ea9..59e7a0f4dba 100644
--- a/acceptance/bundle/scripts/script
+++ b/acceptance/bundle/scripts/script
@@ -1,3 +1,7 @@
 trace EXITCODE=0 errcode $CLI bundle validate
 trace EXITCODE=1 errcode $CLI bundle validate
-trace EXITCODE=0 errcode $CLI bundle deploy
+trace EXITCODE=0 POSTDEPLOY_EXITCODE=0 errcode $CLI bundle deploy
+
+# A failing postdeploy script still reports the deploy summary (the resources were
+# already applied), and the script's failure still propagates as a nonzero exit.
+trace EXITCODE=0 POSTDEPLOY_EXITCODE=1 errcode $CLI bundle deploy
diff --git a/acceptance/bundle/select/ambiguous/databricks.yml b/acceptance/bundle/select/ambiguous/databricks.yml
new file mode 100644
index 00000000000..27962d00d55
--- /dev/null
+++ b/acceptance/bundle/select/ambiguous/databricks.yml
@@ -0,0 +1,13 @@
+bundle:
+  name: select-ambiguous
+
+# "thing" is defined as both a job and a pipeline. This is what an ambiguous
+# --select selector would resolve to, but UniqueResourceKeys rejects it at load
+# time, so the bundle never reaches selector resolution.
+resources:
+  jobs:
+    thing:
+      name: job-thing
+  pipelines:
+    thing:
+      name: pipeline-thing
diff --git a/acceptance/bundle/select/ambiguous/out.test.toml b/acceptance/bundle/select/ambiguous/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/select/ambiguous/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/select/ambiguous/output.txt b/acceptance/bundle/select/ambiguous/output.txt
new file mode 100644
index 00000000000..7dfcae53017
--- /dev/null
+++ b/acceptance/bundle/select/ambiguous/output.txt
@@ -0,0 +1,16 @@
+
+>>> musterr [CLI] bundle plan --select thing
+Error: multiple resources or scripts have been defined with the same key: thing
+  at resources.jobs.thing
+     resources.pipelines.thing
+  in databricks.yml:10:7
+     databricks.yml:13:7
+
+
+>>> musterr [CLI] bundle deploy --select thing
+Error: multiple resources or scripts have been defined with the same key: thing
+  at resources.jobs.thing
+     resources.pipelines.thing
+  in databricks.yml:10:7
+     databricks.yml:13:7
+
diff --git a/acceptance/bundle/select/ambiguous/script b/acceptance/bundle/select/ambiguous/script
new file mode 100644
index 00000000000..6f5afbc33d6
--- /dev/null
+++ b/acceptance/bundle/select/ambiguous/script
@@ -0,0 +1,2 @@
+trace musterr $CLI bundle plan --select thing
+trace musterr $CLI bundle deploy --select thing
diff --git a/acceptance/bundle/select/basic/databricks.yml.tmpl b/acceptance/bundle/select/basic/databricks.yml.tmpl
new file mode 100644
index 00000000000..228b695e072
--- /dev/null
+++ b/acceptance/bundle/select/basic/databricks.yml.tmpl
@@ -0,0 +1,17 @@
+bundle:
+  name: select-$UNIQUE_NAME
+
+resources:
+  jobs:
+    bar:
+      name: bar-$UNIQUE_NAME
+
+    foo:
+      name: foo-$UNIQUE_NAME
+      tasks:
+        - task_key: run_bar
+          run_job_task:
+            job_id: ${resources.jobs.bar.id}
+
+    baz:
+      name: baz-$UNIQUE_NAME
diff --git a/acceptance/bundle/select/basic/out.test.toml b/acceptance/bundle/select/basic/out.test.toml
new file mode 100644
index 00000000000..7a62f726f25
--- /dev/null
+++ b/acceptance/bundle/select/basic/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/select/basic/output.txt b/acceptance/bundle/select/basic/output.txt
new file mode 100644
index 00000000000..89f66b3d78f
--- /dev/null
+++ b/acceptance/bundle/select/basic/output.txt
@@ -0,0 +1,141 @@
+
+>>> [CLI] bundle plan --select bar
+create jobs.bar
+
+Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged, 2 not selected
+
+>>> [CLI] bundle plan --select jobs.bar --select jobs.baz
+create jobs.bar
+create jobs.baz
+
+Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged, 1 not selected
+
+>>> [CLI] bundle plan --select jobs.bar,jobs.baz
+create jobs.bar
+create jobs.baz
+
+Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged, 1 not selected
+
+>>> [CLI] bundle plan --select jobs.foo
+create jobs.bar
+create jobs.foo
+
+Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged, 1 not selected
+
+=== bundle deploy --select jobs.foo
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/select-[UNIQUE_NAME]/default/files...
+Created jobs.bar
+Created jobs.foo
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged, 1 not selected
+
+=== Telemetry:
+select_used true
+
+>>> print_requests.py --nostamp --sort //jobs
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/create",
+  "body": {
+    "deployment": {
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/select-[UNIQUE_NAME]/default/state/metadata.json"
+    },
+    "edit_mode": "UI_LOCKED",
+    "format": "MULTI_TASK",
+    "max_concurrent_runs": 1,
+    "name": "bar-[UNIQUE_NAME]",
+    "queue": {
+      "enabled": true
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/create",
+  "body": {
+    "deployment": {
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/select-[UNIQUE_NAME]/default/state/metadata.json"
+    },
+    "edit_mode": "UI_LOCKED",
+    "format": "MULTI_TASK",
+    "max_concurrent_runs": 1,
+    "name": "foo-[UNIQUE_NAME]",
+    "queue": {
+      "enabled": true
+    },
+    "tasks": [
+      {
+        "run_job_task": {
+          "job_id": [BAR_ID]
+        },
+        "task_key": "run_bar"
+      }
+    ]
+  }
+}
+
+>>> [CLI] bundle summary
+Name: select-[UNIQUE_NAME]
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/select-[UNIQUE_NAME]/default
+Resources:
+  Jobs:
+    bar:
+      Name: bar-[UNIQUE_NAME]
+      URL:  [DATABRICKS_URL]/jobs/[BAR_ID]?w=[WORKSPACE_ID]
+    baz:
+      Name: baz-[UNIQUE_NAME]
+      URL:  (not deployed)
+    foo:
+      Name: foo-[UNIQUE_NAME]
+      URL:  [DATABRICKS_URL]/jobs/[FOO_ID]?w=[WORKSPACE_ID]
+
+=== Full plan after partial deploy
+>>> [CLI] bundle plan
+create jobs.baz
+
+Plan: 1 to add, 0 to change, 0 to delete, 2 unchanged
+
+=== Full deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/select-[UNIQUE_NAME]/default/files...
+Created jobs.baz
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 2 unchanged
+
+>>> print_requests.py --nostamp --sort //jobs
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/create",
+  "body": {
+    "deployment": {
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/select-[UNIQUE_NAME]/default/state/metadata.json"
+    },
+    "edit_mode": "UI_LOCKED",
+    "format": "MULTI_TASK",
+    "max_concurrent_runs": 1,
+    "name": "baz-[UNIQUE_NAME]",
+    "queue": {
+      "enabled": true
+    }
+  }
+}
+
+=== Full plan again
+>>> [CLI] bundle plan
+Plan: 0 to add, 0 to change, 0 to delete, 3 unchanged
+
+=== Destroy
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.bar
+  delete resources.jobs.baz
+  delete resources.jobs.foo
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/select-[UNIQUE_NAME]/default
+
+Destroy: 3 deleted
diff --git a/acceptance/bundle/select/basic/script b/acceptance/bundle/select/basic/script
new file mode 100644
index 00000000000..3b7aa10b34d
--- /dev/null
+++ b/acceptance/bundle/select/basic/script
@@ -0,0 +1,48 @@
+envsubst '$UNIQUE_NAME' < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    title "Destroy"
+    trace $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+# --- selector resolution ---
+# Unqualified name, unique across resource types.
+trace $CLI bundle plan --select bar
+# Repeated --select.
+trace $CLI bundle plan --select jobs.bar --select jobs.baz
+# Comma-separated --select (equivalent to repeating the flag).
+trace $CLI bundle plan --select jobs.bar,jobs.baz
+# Qualified name; foo pulls in its dependency bar but not the independent baz.
+trace $CLI bundle plan --select jobs.foo
+
+# --- partial deploy ---
+# Serialize the filtered plan to a temp file (kept out of the recorded output: the
+# JSON embeds remote state that differs between local and cloud), then deploy it:
+# inline, or via --plan (READPLAN=1). The deploy is not traced because readplanarg
+# varies the command line between READPLAN variants, which must produce identical output.
+$CLI bundle plan --select jobs.foo -o json > plan.json
+title "bundle deploy --select jobs.foo\n"
+$CLI bundle deploy --select jobs.foo $(readplanarg plan.json)
+replace_ids.py
+# The deploy reports that --select was used via telemetry.
+title "Telemetry:\n"
+print_telemetry_bool_values | grep '^select_used '
+# Only bar and foo were created, never baz.
+trace print_requests.py --nostamp --sort //jobs
+# Summary after the partial deploy: foo and bar are deployed, baz is not.
+trace $CLI bundle summary
+
+# --- full plan/deploy after the partial deploy ---
+# foo and bar are already deployed, so only baz remains to create.
+title "Full plan after partial deploy"
+trace $CLI bundle plan
+$CLI bundle plan -o json > plan-full.json
+title "Full deploy\n"
+$CLI bundle deploy $(readplanarg plan-full.json)
+# Only baz is created this time.
+trace print_requests.py --nostamp --sort //jobs
+# Everything is deployed now: no changes.
+title "Full plan again"
+trace $CLI bundle plan
diff --git a/acceptance/bundle/select/basic/test.toml b/acceptance/bundle/select/basic/test.toml
new file mode 100644
index 00000000000..1c81ca40790
--- /dev/null
+++ b/acceptance/bundle/select/basic/test.toml
@@ -0,0 +1,9 @@
+Cloud = true
+RecordRequests = true
+# --select is only supported by the direct engine, so this happy-path test runs on
+# direct only.
+# Also run a variant that deploys a serialized (already filtered) plan via --plan.
+EnvMatrix.READPLAN = ["", "1"]
+# databricks.yml and the serialized plans are generated at runtime; the plan JSON
+# is kept out of the recorded output because it embeds local/cloud-specific state.
+Ignore = [".databricks", ".gitignore", "databricks.yml", "plan.json", "plan-full.json"]
diff --git a/acceptance/bundle/select/grants_permissions/databricks.yml.tmpl b/acceptance/bundle/select/grants_permissions/databricks.yml.tmpl
new file mode 100644
index 00000000000..c31a0df1c6e
--- /dev/null
+++ b/acceptance/bundle/select/grants_permissions/databricks.yml.tmpl
@@ -0,0 +1,19 @@
+bundle:
+  name: select-subnodes-$UNIQUE_NAME
+
+resources:
+  jobs:
+    my_job:
+      name: my_job-$UNIQUE_NAME
+      permissions:
+        - level: CAN_VIEW
+          user_name: viewer@example.com
+
+  schemas:
+    my_schema:
+      catalog_name: main
+      name: my_schema_$UNIQUE_NAME
+      grants:
+        - principal: deco-test-user@databricks.com
+          privileges:
+            - ALL_PRIVILEGES
diff --git a/acceptance/bundle/select/grants_permissions/out.test.toml b/acceptance/bundle/select/grants_permissions/out.test.toml
new file mode 100644
index 00000000000..f7fafbcc731
--- /dev/null
+++ b/acceptance/bundle/select/grants_permissions/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/select/grants_permissions/output.txt b/acceptance/bundle/select/grants_permissions/output.txt
new file mode 100644
index 00000000000..6ada2c1689b
--- /dev/null
+++ b/acceptance/bundle/select/grants_permissions/output.txt
@@ -0,0 +1,79 @@
+
+>>> [CLI] bundle plan --select jobs.my_job
+create jobs.my_job
+create jobs.my_job.permissions
+
+Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged, 2 not selected
+
+>>> [CLI] bundle plan --select schemas.my_schema
+create schemas.my_schema
+create schemas.my_schema.grants
+
+Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged, 2 not selected
+
+>>> [CLI] bundle plan --select jobs.my_job.permissions
+Error: no such resource: jobs.my_job.permissions
+
+
+>>> [CLI] bundle plan --select schemas.my_schema.grants
+Error: no such resource: schemas.my_schema.grants
+
+
+=== bundle deploy --select jobs.my_job
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/select-subnodes-[UNIQUE_NAME]/default/files...
+Created jobs.my_job
+Created jobs.my_job.permissions
+Files: 3 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged, 2 not selected
+
+=== bundle deploy --select schemas.my_schema
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/select-subnodes-[UNIQUE_NAME]/default/files...
+Created schemas.my_schema
+Created schemas.my_schema.grants
+Files: 1 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged, 2 not selected
+
+>>> print_requests.py --sort //permissions
+{
+  "method": "PATCH",
+  "path": "/api/2.1/unity-catalog/permissions/schema/[MY_SCHEMA_ID]",
+  "body": {
+    "changes": [
+      {
+        "add": [
+          "ALL_PRIVILEGES"
+        ],
+        "principal": "deco-test-user@databricks.com"
+      }
+    ]
+  }
+}
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/jobs/[MY_JOB_ID]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "CAN_VIEW",
+        "user_name": "viewer@example.com"
+      },
+      {
+        "permission_level": "IS_OWNER",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
+
+=== Destroy
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.my_job
+  delete resources.schemas.my_schema
+
+This action will result in the deletion of the following UC schemas. Any underlying data may be lost:
+  delete resources.schemas.my_schema
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/select-subnodes-[UNIQUE_NAME]/default
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/select/grants_permissions/script b/acceptance/bundle/select/grants_permissions/script
new file mode 100644
index 00000000000..7856742c6cf
--- /dev/null
+++ b/acceptance/bundle/select/grants_permissions/script
@@ -0,0 +1,31 @@
+envsubst '$UNIQUE_NAME' < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    title "Destroy"
+    trace $CLI bundle destroy --auto-approve
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+# Selecting a resource pulls in its grants/permissions sub-nodes even though the
+# dependency edge runs sub-node -> parent, so the plan would never reach them from
+# the parent otherwise (issue #5794).
+trace $CLI bundle plan --select jobs.my_job
+trace $CLI bundle plan --select schemas.my_schema
+
+# Grants and permissions sub-nodes are not addressable via --select.
+musterr trace $CLI bundle plan --select jobs.my_job.permissions
+musterr trace $CLI bundle plan --select schemas.my_schema.grants
+
+# Deploying a selected resource applies its permissions/grants too.
+$CLI bundle plan --select jobs.my_job -o json > plan-job.json
+title "bundle deploy --select jobs.my_job\n"
+$CLI bundle deploy --select jobs.my_job $(readplanarg plan-job.json)
+
+$CLI bundle plan --select schemas.my_schema -o json > plan-schema.json
+title "bundle deploy --select schemas.my_schema\n"
+$CLI bundle deploy --select schemas.my_schema $(readplanarg plan-schema.json)
+replace_ids.py
+
+# Assert the permissions PUT and grants PATCH were emitted for the selected resources.
+trace print_requests.py --sort //permissions
diff --git a/acceptance/bundle/select/grants_permissions/test.toml b/acceptance/bundle/select/grants_permissions/test.toml
new file mode 100644
index 00000000000..a6919333d49
--- /dev/null
+++ b/acceptance/bundle/select/grants_permissions/test.toml
@@ -0,0 +1,12 @@
+# Local-only: exercises --select (issue #5794) end to end against the testserver.
+# It deploys a schema, so it needs a UC metastore; --select is direct-engine only.
+# The bundle name deliberately avoids the "permissions" token used in the
+# print_requests.py filter: on Windows, Git Bash mangles the leading "//" of
+# "//permissions" so the filter degrades to the bare substring "permissions", which
+# would otherwise also match the bundle's own file-upload paths. (We can't set
+# MSYS_NO_PATHCONV to keep the "//" intact, because that breaks the python helper's
+# own path resolution -- see the env -u workaround in acceptance/script.prepare.)
+Cloud = false
+RecordRequests = true
+EnvMatrix.READPLAN = ["", "1"]
+Ignore = [".databricks", ".gitignore", "databricks.yml", "plan-job.json", "plan-schema.json"]
diff --git a/acceptance/bundle/select/missing/databricks.yml b/acceptance/bundle/select/missing/databricks.yml
new file mode 100644
index 00000000000..e093f64dd7e
--- /dev/null
+++ b/acceptance/bundle/select/missing/databricks.yml
@@ -0,0 +1,7 @@
+bundle:
+  name: select-errors
+
+resources:
+  jobs:
+    my_job:
+      name: my-job
diff --git a/acceptance/bundle/select/missing/out.test.toml b/acceptance/bundle/select/missing/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/select/missing/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/select/missing/output.txt b/acceptance/bundle/select/missing/output.txt
new file mode 100644
index 00000000000..de64d7bb511
--- /dev/null
+++ b/acceptance/bundle/select/missing/output.txt
@@ -0,0 +1,8 @@
+
+>>> [CLI] bundle plan --select no_such_resource
+Error: no such resource: no_such_resource
+
+
+>>> [CLI] bundle plan --select jobs.no_such_job
+Error: no such resource: jobs.no_such_job
+
diff --git a/acceptance/bundle/select/missing/script b/acceptance/bundle/select/missing/script
new file mode 100644
index 00000000000..878e547cec7
--- /dev/null
+++ b/acceptance/bundle/select/missing/script
@@ -0,0 +1,8 @@
+# Selectors are resolved by the ResolveSelect mutator during initialize, before the
+# engine is known, so these errors are identical on both engines.
+
+# Unqualified name that matches no resource.
+musterr trace $CLI bundle plan --select no_such_resource
+
+# Qualified name whose resource does not exist.
+musterr trace $CLI bundle plan --select jobs.no_such_job
diff --git a/acceptance/bundle/select/plan_file_survives_not_selected/databricks.yml.tmpl b/acceptance/bundle/select/plan_file_survives_not_selected/databricks.yml.tmpl
new file mode 100644
index 00000000000..d67074e8d1d
--- /dev/null
+++ b/acceptance/bundle/select/plan_file_survives_not_selected/databricks.yml.tmpl
@@ -0,0 +1,13 @@
+bundle:
+  name: select-plan-$UNIQUE_NAME
+
+resources:
+  jobs:
+    foo:
+      name: foo-$UNIQUE_NAME
+
+    bar:
+      name: bar-$UNIQUE_NAME
+
+    baz:
+      name: baz-$UNIQUE_NAME
diff --git a/acceptance/bundle/select/plan_file_survives_not_selected/out.test.toml b/acceptance/bundle/select/plan_file_survives_not_selected/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/select/plan_file_survives_not_selected/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/select/plan_file_survives_not_selected/output.txt b/acceptance/bundle/select/plan_file_survives_not_selected/output.txt
new file mode 100644
index 00000000000..f350b38e54d
--- /dev/null
+++ b/acceptance/bundle/select/plan_file_survives_not_selected/output.txt
@@ -0,0 +1,16 @@
+
+=== bundle deploy --plan (no --select)
+
+>>> [CLI] bundle deploy --plan plan.json
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/select-plan-[UNIQUE_NAME]/default/files...
+Created jobs.foo
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged, 2 not selected
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.jobs.foo
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/select-plan-[UNIQUE_NAME]/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/select/plan_file_survives_not_selected/script b/acceptance/bundle/select/plan_file_survives_not_selected/script
new file mode 100644
index 00000000000..908aeb6ad1d
--- /dev/null
+++ b/acceptance/bundle/select/plan_file_survives_not_selected/script
@@ -0,0 +1,16 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace $CLI bundle destroy --auto-approve
+}
+trap cleanup EXIT
+
+# Filter to one of three jobs and serialize the plan. The plan file records
+# not_selected=2. (Kept out of recorded output: the JSON embeds remote state.)
+$CLI bundle plan --select jobs.foo -o json > plan.json
+
+# Deploy from the plan file WITHOUT re-passing --select. b.Select is empty here,
+# so the ", 2 not selected" suffix must come from the serialized plan.NotSelected,
+# not from the flag. This is the regression guard for that wiring.
+title "bundle deploy --plan (no --select)\n"
+trace $CLI bundle deploy --plan plan.json
diff --git a/acceptance/bundle/select/plan_file_survives_not_selected/test.toml b/acceptance/bundle/select/plan_file_survives_not_selected/test.toml
new file mode 100644
index 00000000000..5fff653db11
--- /dev/null
+++ b/acceptance/bundle/select/plan_file_survives_not_selected/test.toml
@@ -0,0 +1,2 @@
+# --select is only supported by the direct engine.
+Ignore = [".databricks", ".gitignore", "databricks.yml", "plan.json"]
diff --git a/acceptance/bundle/select/test.toml b/acceptance/bundle/select/test.toml
new file mode 100644
index 00000000000..0e7bfa11a8a
--- /dev/null
+++ b/acceptance/bundle/select/test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+Ignore = [".databricks", ".gitignore"]
diff --git a/acceptance/bundle/state/bad_env/out.test.toml b/acceptance/bundle/state/bad_env/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/state/bad_env/out.test.toml
+++ b/acceptance/bundle/state/bad_env/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/state/bad_env/output.txt b/acceptance/bundle/state/bad_env/output.txt
index 5a88b62f95e..68190faa62a 100644
--- a/acceptance/bundle/state/bad_env/output.txt
+++ b/acceptance/bundle/state/bad_env/output.txt
@@ -1,12 +1,21 @@
 
 >>> musterr [CLI] bundle plan
-Error: unexpected setting for DATABRICKS_BUNDLE_ENGINE="abc" (expected 'terraform' or 'direct')
+Error: unexpected setting for DATABRICKS_BUNDLE_ENGINE="abc" (expected 'direct')
 
 >>> musterr [CLI] bundle deploy
-Error: unexpected setting for DATABRICKS_BUNDLE_ENGINE="abc" (expected 'terraform' or 'direct')
+Error: unexpected setting for DATABRICKS_BUNDLE_ENGINE="abc" (expected 'direct')
 
->>> musterr [CLI] bundle summary
-Error: unexpected setting for DATABRICKS_BUNDLE_ENGINE="abc" (expected 'terraform' or 'direct')
+>>> [CLI] bundle summary
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+Resources:
+  Schemas:
+    foo:
+      Name: foo
+      URL:  (not deployed)
 
 >>> musterr [CLI] bundle destroy --auto-approve
-Error: unexpected setting for DATABRICKS_BUNDLE_ENGINE="abc" (expected 'terraform' or 'direct')
+Error: unexpected setting for DATABRICKS_BUNDLE_ENGINE="abc" (expected 'direct')
diff --git a/acceptance/bundle/state/bad_env/script b/acceptance/bundle/state/bad_env/script
index fce3a3a0f85..a509ad748c8 100644
--- a/acceptance/bundle/state/bad_env/script
+++ b/acceptance/bundle/state/bad_env/script
@@ -1,5 +1,6 @@
 export DATABRICKS_BUNDLE_ENGINE=abc
 trace musterr $CLI bundle plan
 trace musterr $CLI bundle deploy
-trace musterr $CLI bundle summary
+# summary does not check DATABRICKS_BUNDLE_ENGINE
+trace $CLI bundle summary
 trace musterr $CLI bundle destroy --auto-approve
diff --git a/acceptance/bundle/state/bad_json_local/out.test.toml b/acceptance/bundle/state/bad_json_local/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/state/bad_json_local/out.test.toml
+++ b/acceptance/bundle/state/bad_json_local/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/state/basic/out.state.txt b/acceptance/bundle/state/basic/out.state.txt
index a661214a12d..88f0a216b86 100644
--- a/acceptance/bundle/state/basic/out.state.txt
+++ b/acceptance/bundle/state/basic/out.state.txt
@@ -1,8 +1,48 @@
 {
   "method": "GET",
-  "path": "/api/2.0/workspace-files/Workspace/Users/[USERNAME]/.bundle/state/default/state/STATE_FILENAME"
+  "path": "/api/2.0/workspace/export",
+  "q": {
+    "direct_download": "true",
+    "path": "/Workspace/Users/[USERNAME]/.bundle/state/default/state/STATE_FILENAME"
+  }
 }
 {
   "method": "GET",
-  "path": "/api/2.0/workspace-files/Workspace/Users/[USERNAME]/.bundle/state/default/state/deployment.json"
+  "path": "/api/2.0/workspace/export",
+  "q": {
+    "direct_download": "true",
+    "path": "/Workspace/Users/[USERNAME]/.bundle/state/default/state/STATE_FILENAME"
+  }
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/workspace/export",
+  "q": {
+    "direct_download": "true",
+    "path": "/Workspace/Users/[USERNAME]/.bundle/state/default/state/deployment.json"
+  }
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/workspace/export",
+  "q": {
+    "direct_download": "true",
+    "path": "/Workspace/Users/[USERNAME]/.bundle/state/default/state/STATE_FILENAME"
+  }
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/workspace/export",
+  "q": {
+    "direct_download": "true",
+    "path": "/Workspace/Users/[USERNAME]/.bundle/state/default/state/STATE_FILENAME"
+  }
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/workspace/export",
+  "q": {
+    "direct_download": "true",
+    "path": "/Workspace/Users/[USERNAME]/.bundle/state/default/state/deployment.json"
+  }
 }
diff --git a/acceptance/bundle/state/basic/out.test.toml b/acceptance/bundle/state/basic/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/state/basic/out.test.toml
+++ b/acceptance/bundle/state/basic/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/state/basic/output.txt b/acceptance/bundle/state/basic/output.txt
index ac13a7ba417..1711b68f9c1 100644
--- a/acceptance/bundle/state/basic/output.txt
+++ b/acceptance/bundle/state/basic/output.txt
@@ -1,12 +1,11 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/state/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.test
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/state/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
diff --git a/acceptance/bundle/state/basic/script b/acceptance/bundle/state/basic/script
index f1587f56145..a3798ba9722 100644
--- a/acceptance/bundle/state/basic/script
+++ b/acceptance/bundle/state/basic/script
@@ -1,4 +1,4 @@
 trace $CLI bundle deploy
 trace $CLI bundle deploy # We do 2 deploys because only 2nd deploy will pull state from remote after 1st created it
-jq 'select(.path | test("/api/2.0/workspace-files/Workspace/Users/.*/.bundle/state/default/state/"))' out.requests.txt > out.state.txt
-rm out.requests.txt
+jq 'select(.path == "/api/2.0/workspace/export" and (.q.path | test("/.bundle/state/default/state/")) and (.q.path | test("deploy.lock") | not))' "$OUT_REQUESTS" > out.state.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/state/directory_at_state_path/databricks.yml.tmpl b/acceptance/bundle/state/directory_at_state_path/databricks.yml.tmpl
new file mode 100644
index 00000000000..ea466a3f18d
--- /dev/null
+++ b/acceptance/bundle/state/directory_at_state_path/databricks.yml.tmpl
@@ -0,0 +1,7 @@
+bundle:
+  name: directory-at-state-path-$UNIQUE_NAME
+
+resources:
+  jobs:
+    foo:
+      name: foo
diff --git a/acceptance/bundle/state/directory_at_state_path/out.test.toml b/acceptance/bundle/state/directory_at_state_path/out.test.toml
new file mode 100644
index 00000000000..0f167effef1
--- /dev/null
+++ b/acceptance/bundle/state/directory_at_state_path/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/state/directory_at_state_path/output.txt b/acceptance/bundle/state/directory_at_state_path/output.txt
new file mode 100644
index 00000000000..9acde0d0b1a
--- /dev/null
+++ b/acceptance/bundle/state/directory_at_state_path/output.txt
@@ -0,0 +1,4 @@
+
+>>> musterr [CLI] bundle plan
+Error: reading resources.json: not a file: the workspace has a directory at this path
+
diff --git a/acceptance/bundle/state/directory_at_state_path/script b/acceptance/bundle/state/directory_at_state_path/script
new file mode 100644
index 00000000000..f7ff13bc41f
--- /dev/null
+++ b/acceptance/bundle/state/directory_at_state_path/script
@@ -0,0 +1,14 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+# Something else created a directory where the CLI keeps its state file.
+state_path=$($CLI bundle validate -o json | jq -r .workspace.state_path)
+# MSYS_NO_PATHCONV stops Git Bash on Windows from rewriting the /Workspace/... argument into a local path.
+MSYS_NO_PATHCONV=1 $CLI workspace mkdirs "$state_path/resources.json"
+
+cleanup() {
+    MSYS_NO_PATHCONV=1 $CLI workspace delete --recursive "$($CLI bundle validate -o json | jq -r .workspace.root_path)"
+    rm -f "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+trace musterr $CLI bundle plan
diff --git a/acceptance/bundle/state/directory_at_state_path/test.toml b/acceptance/bundle/state/directory_at_state_path/test.toml
new file mode 100644
index 00000000000..c489ad5f0c8
--- /dev/null
+++ b/acceptance/bundle/state/directory_at_state_path/test.toml
@@ -0,0 +1,2 @@
+# Exercises the real workspace's export of a directory, which returns a ZIP archive.
+Cloud = true
diff --git a/acceptance/bundle/state/engine_default/databricks.yml b/acceptance/bundle/state/engine_default/databricks.yml
new file mode 100644
index 00000000000..17b7e9c575f
--- /dev/null
+++ b/acceptance/bundle/state/engine_default/databricks.yml
@@ -0,0 +1,8 @@
+bundle:
+  name: test-engine-default
+
+resources:
+  schemas:
+    foo:
+      catalog_name: bar
+      name: foo
diff --git a/acceptance/bundle/state/engine_default/out.test.toml b/acceptance/bundle/state/engine_default/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/state/engine_default/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/state/engine_default/output.txt b/acceptance/bundle/state/engine_default/output.txt
new file mode 100644
index 00000000000..13f315325c3
--- /dev/null
+++ b/acceptance/bundle/state/engine_default/output.txt
@@ -0,0 +1,11 @@
+
+=== No engine configured and no state: deploy defaults to the direct engine
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-engine-default/default/files...
+Created schemas.foo
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_requests.py //api/2.1/unity-catalog/schemas
+"cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
diff --git a/acceptance/bundle/state/engine_default/script b/acceptance/bundle/state/engine_default/script
new file mode 100644
index 00000000000..cadf288994a
--- /dev/null
+++ b/acceptance/bundle/state/engine_default/script
@@ -0,0 +1,4 @@
+title 'No engine configured and no state: deploy defaults to the direct engine\n'
+unset DATABRICKS_BUNDLE_ENGINE
+trace $CLI bundle deploy
+trace print_requests.py //api/2.1/unity-catalog/schemas | jq '.headers["User-Agent"][0]' | contains.py 'engine/direct' '!terraform' '!tf-provider'
diff --git a/acceptance/bundle/state/engine_default/test.toml b/acceptance/bundle/state/engine_default/test.toml
new file mode 100644
index 00000000000..4a7b9fe775c
--- /dev/null
+++ b/acceptance/bundle/state/engine_default/test.toml
@@ -0,0 +1,8 @@
+RecordRequests = true
+IncludeRequestHeaders = ["User-Agent"]
+Ignore = [".databricks"]
+
+# Run once (not per-engine); the script unsets DATABRICKS_BUNDLE_ENGINE to
+# exercise the default. "direct" (rather than []) keeps the test in the
+# engine-filtered CI runs.
+Env.DATABRICKS_BUNDLE_ENGINE = "direct"
diff --git a/acceptance/bundle/state/engine_mismatch/out.test.toml b/acceptance/bundle/state/engine_mismatch/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/state/engine_mismatch/out.test.toml
+++ b/acceptance/bundle/state/engine_mismatch/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/state/engine_mismatch/output.txt b/acceptance/bundle/state/engine_mismatch/output.txt
index 365f4ef27a9..92b102b8005 100644
--- a/acceptance/bundle/state/engine_mismatch/output.txt
+++ b/acceptance/bundle/state/engine_mismatch/output.txt
@@ -1,20 +1,10 @@
 
-=== Config mismatch with state: warning expected
+=== Direct opt-in with terraform state on disk: debug states reports without warning
 
 >>> [CLI] bundle debug states
-Warning: Deployment engine "direct" configured in bundle.engine setting at [TEST_TMP_DIR]/databricks.yml:3:11 does not match the existing state (engine "terraform"). Using "terraform" engine from the existing state.
-
-Available state files:
-- [TEST_TMP_DIR]/.databricks/bundle/default/terraform/terraform.tfstate: local terraform state serial=1 lineage="test-lineage"
-
 [TEST_TMP_DIR]/.databricks/bundle/default/terraform/terraform.tfstate: local terraform state serial=1 lineage="test-lineage"
 
-=== Invalid env var with config set: no error, config takes priority
+=== Invalid env var with config set: config takes priority, still no warning
 
 >>> DATABRICKS_BUNDLE_ENGINE=bla [CLI] bundle debug states
-Warning: Deployment engine "direct" configured in bundle.engine setting at [TEST_TMP_DIR]/databricks.yml:3:11 does not match the existing state (engine "terraform"). Using "terraform" engine from the existing state.
-
-Available state files:
-- [TEST_TMP_DIR]/.databricks/bundle/default/terraform/terraform.tfstate: local terraform state serial=1 lineage="test-lineage"
-
 [TEST_TMP_DIR]/.databricks/bundle/default/terraform/terraform.tfstate: local terraform state serial=1 lineage="test-lineage"
diff --git a/acceptance/bundle/state/engine_mismatch/script b/acceptance/bundle/state/engine_mismatch/script
index 44866772471..450ef1835eb 100644
--- a/acceptance/bundle/state/engine_mismatch/script
+++ b/acceptance/bundle/state/engine_mismatch/script
@@ -1,9 +1,11 @@
 mkdir -p .databricks/bundle/default/terraform
 echo '{"serial": 1, "lineage": "test-lineage"}' > .databricks/bundle/default/terraform/terraform.tfstate
 
-title 'Config mismatch with state: warning expected\n'
+# `bundle debug states` doesn't deploy; it should just report the state without
+# a mismatch warning. The "will attempt to migrate" hint belongs to deploy only.
+title 'Direct opt-in with terraform state on disk: debug states reports without warning\n'
 unset DATABRICKS_BUNDLE_ENGINE
 trace $CLI bundle debug states
 
-title 'Invalid env var with config set: no error, config takes priority\n'
+title 'Invalid env var with config set: config takes priority, still no warning\n'
 trace DATABRICKS_BUNDLE_ENGINE=bla $CLI bundle debug states
diff --git a/acceptance/bundle/state/feature_flags/accept_new/databricks.yml b/acceptance/bundle/state/feature_flags/accept_new/databricks.yml
new file mode 100644
index 00000000000..5134dbcc12c
--- /dev/null
+++ b/acceptance/bundle/state/feature_flags/accept_new/databricks.yml
@@ -0,0 +1,7 @@
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    my_job:
+      name: "my job"
diff --git a/acceptance/bundle/state/feature_flags/accept_new/out.test.toml b/acceptance/bundle/state/feature_flags/accept_new/out.test.toml
new file mode 100644
index 00000000000..a8bb70d979c
--- /dev/null
+++ b/acceptance/bundle/state/feature_flags/accept_new/out.test.toml
@@ -0,0 +1,8 @@
+Cloud = false
+EnvMatrix.DMS = [""]
+EnvMatrix.STATE_FILE = [
+  "resources.v2.json",
+  "resources.v3.json",
+  "resources.v2.deployment_history.json",
+  "resources.v3.deployment_history.json"
+]
diff --git a/acceptance/bundle/state/feature_flags/accept_new/output.txt b/acceptance/bundle/state/feature_flags/accept_new/output.txt
new file mode 100644
index 00000000000..5fd06174094
--- /dev/null
+++ b/acceptance/bundle/state/feature_flags/accept_new/output.txt
@@ -0,0 +1,16 @@
+
+>>> [CLI] bundle plan
+create jobs.my_job
+
+Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
+
+>>> cmp [STATE_FILE] .databricks/bundle/default/resources.json
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created jobs.my_job
+Files: 5 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> jq .state_version .databricks/bundle/default/resources.json
+3
diff --git a/acceptance/bundle/state/feature_flags/accept_new/resources.v2.deployment_history.json b/acceptance/bundle/state/feature_flags/accept_new/resources.v2.deployment_history.json
new file mode 100644
index 00000000000..307c4cdfb55
--- /dev/null
+++ b/acceptance/bundle/state/feature_flags/accept_new/resources.v2.deployment_history.json
@@ -0,0 +1,10 @@
+{
+ "state_version": 2,
+ "features": {
+  "deployment_history": {}
+ },
+ "cli_version": "0.0.0-dev",
+ "lineage": "test-lineage",
+ "serial": 0,
+ "state": {}
+}
diff --git a/acceptance/bundle/state/feature_flags/accept_new/resources.v2.json b/acceptance/bundle/state/feature_flags/accept_new/resources.v2.json
new file mode 100644
index 00000000000..876fdaf19ce
--- /dev/null
+++ b/acceptance/bundle/state/feature_flags/accept_new/resources.v2.json
@@ -0,0 +1,8 @@
+{
+ "state_version": 2,
+ "features": {},
+ "cli_version": "0.0.0-dev",
+ "lineage": "test-lineage",
+ "serial": 1,
+ "state": {}
+}
diff --git a/acceptance/bundle/state/feature_flags/accept_new/resources.v3.deployment_history.json b/acceptance/bundle/state/feature_flags/accept_new/resources.v3.deployment_history.json
new file mode 100644
index 00000000000..fd2fa4b1e35
--- /dev/null
+++ b/acceptance/bundle/state/feature_flags/accept_new/resources.v3.deployment_history.json
@@ -0,0 +1,10 @@
+{
+ "state_version": 3,
+ "features": {
+  "deployment_history": {}
+ },
+ "cli_version": "0.0.0-dev",
+ "lineage": "test-lineage",
+ "serial": 0,
+ "state": {}
+}
diff --git a/acceptance/bundle/state/feature_flags/accept_new/resources.v3.json b/acceptance/bundle/state/feature_flags/accept_new/resources.v3.json
new file mode 100644
index 00000000000..b20c97aa074
--- /dev/null
+++ b/acceptance/bundle/state/feature_flags/accept_new/resources.v3.json
@@ -0,0 +1,8 @@
+{
+ "state_version": 3,
+ "features": {},
+ "cli_version": "0.0.0-dev",
+ "lineage": "test-lineage",
+ "serial": 1,
+ "state": {}
+}
diff --git a/acceptance/bundle/state/feature_flags/accept_new/script b/acceptance/bundle/state/feature_flags/accept_new/script
new file mode 100644
index 00000000000..4928c4c2c6f
--- /dev/null
+++ b/acceptance/bundle/state/feature_flags/accept_new/script
@@ -0,0 +1,13 @@
+mkdir -p .databricks/bundle/default
+cp "$STATE_FILE" .databricks/bundle/default/resources.json
+
+DATABRICKS_BUNDLE_DEPLOYMENT_HISTORY=$(jq '.features | has("deployment_history")' "$STATE_FILE")
+export DATABRICKS_BUNDLE_DEPLOYMENT_HISTORY
+
+trace $CLI bundle plan | contains.py "Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged"
+trace cmp "$STATE_FILE" .databricks/bundle/default/resources.json
+
+trace $CLI bundle deploy
+trace jq '.state_version' .databricks/bundle/default/resources.json
+# Deployment upgrades the version and preserves the input's feature flags.
+diff <(jq -S '.features' "$STATE_FILE") <(jq -S '.features // {}' .databricks/bundle/default/resources.json)
diff --git a/acceptance/bundle/state/feature_flags/accept_new/test.toml b/acceptance/bundle/state/feature_flags/accept_new/test.toml
new file mode 100644
index 00000000000..55933de2377
--- /dev/null
+++ b/acceptance/bundle/state/feature_flags/accept_new/test.toml
@@ -0,0 +1 @@
+EnvMatrix.STATE_FILE = ["resources.v2.json", "resources.v3.json", "resources.v2.deployment_history.json", "resources.v3.deployment_history.json"]
diff --git a/acceptance/bundle/state/feature_flags/accept_old/databricks.yml b/acceptance/bundle/state/feature_flags/accept_old/databricks.yml
new file mode 100644
index 00000000000..5134dbcc12c
--- /dev/null
+++ b/acceptance/bundle/state/feature_flags/accept_old/databricks.yml
@@ -0,0 +1,7 @@
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    my_job:
+      name: "my job"
diff --git a/acceptance/bundle/state/feature_flags/accept_old/out.test.toml b/acceptance/bundle/state/feature_flags/accept_old/out.test.toml
new file mode 100644
index 00000000000..262e49f0549
--- /dev/null
+++ b/acceptance/bundle/state/feature_flags/accept_old/out.test.toml
@@ -0,0 +1,8 @@
+Cloud = false
+EnvMatrix.DMS = [""]
+EnvMatrix.STATE_FILE = [
+  "resources.v2.json",
+  "resources.v2.future_feature.json",
+  "resources.v2.deployment_history.json",
+  "resources.v3.json"
+]
diff --git a/acceptance/bundle/state/feature_flags/accept_old/output.txt b/acceptance/bundle/state/feature_flags/accept_old/output.txt
new file mode 100644
index 00000000000..5ac51c952d0
--- /dev/null
+++ b/acceptance/bundle/state/feature_flags/accept_old/output.txt
@@ -0,0 +1,7 @@
+
+>>> [CLI_1_8] bundle plan
+create jobs.my_job
+
+Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
+
+>>> cmp [STATE_FILE] .databricks/bundle/default/resources.json
diff --git a/acceptance/bundle/state/feature_flags/accept_old/resources.v2.deployment_history.json b/acceptance/bundle/state/feature_flags/accept_old/resources.v2.deployment_history.json
new file mode 100644
index 00000000000..294508f75e7
--- /dev/null
+++ b/acceptance/bundle/state/feature_flags/accept_old/resources.v2.deployment_history.json
@@ -0,0 +1,10 @@
+{
+ "state_version": 2,
+ "features": {
+  "deployment_history": {}
+ },
+ "cli_version": "0.0.0-dev",
+ "lineage": "test-lineage",
+ "serial": 1,
+ "state": {}
+}
diff --git a/acceptance/bundle/state/feature_flags/accept_old/resources.v2.future_feature.json b/acceptance/bundle/state/feature_flags/accept_old/resources.v2.future_feature.json
new file mode 100644
index 00000000000..acc2ec9823d
--- /dev/null
+++ b/acceptance/bundle/state/feature_flags/accept_old/resources.v2.future_feature.json
@@ -0,0 +1,10 @@
+{
+ "state_version": 2,
+ "features": {
+  "future_feature": {}
+ },
+ "cli_version": "0.0.0-dev",
+ "lineage": "test-lineage",
+ "serial": 1,
+ "state": {}
+}
diff --git a/acceptance/bundle/state/feature_flags/accept_old/resources.v2.json b/acceptance/bundle/state/feature_flags/accept_old/resources.v2.json
new file mode 100644
index 00000000000..876fdaf19ce
--- /dev/null
+++ b/acceptance/bundle/state/feature_flags/accept_old/resources.v2.json
@@ -0,0 +1,8 @@
+{
+ "state_version": 2,
+ "features": {},
+ "cli_version": "0.0.0-dev",
+ "lineage": "test-lineage",
+ "serial": 1,
+ "state": {}
+}
diff --git a/acceptance/bundle/state/feature_flags/accept_old/resources.v3.json b/acceptance/bundle/state/feature_flags/accept_old/resources.v3.json
new file mode 100644
index 00000000000..b20c97aa074
--- /dev/null
+++ b/acceptance/bundle/state/feature_flags/accept_old/resources.v3.json
@@ -0,0 +1,8 @@
+{
+ "state_version": 3,
+ "features": {},
+ "cli_version": "0.0.0-dev",
+ "lineage": "test-lineage",
+ "serial": 1,
+ "state": {}
+}
diff --git a/acceptance/bundle/state/feature_flags/accept_old/script b/acceptance/bundle/state/feature_flags/accept_old/script
new file mode 100644
index 00000000000..5b753c4212d
--- /dev/null
+++ b/acceptance/bundle/state/feature_flags/accept_old/script
@@ -0,0 +1,5 @@
+mkdir -p .databricks/bundle/default
+cp "$STATE_FILE" .databricks/bundle/default/resources.json
+
+trace $CLI_1_8 bundle plan | contains.py "Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged"
+trace cmp "$STATE_FILE" .databricks/bundle/default/resources.json
diff --git a/acceptance/bundle/state/feature_flags/accept_old/test.toml b/acceptance/bundle/state/feature_flags/accept_old/test.toml
new file mode 100644
index 00000000000..f7d4af44c7b
--- /dev/null
+++ b/acceptance/bundle/state/feature_flags/accept_old/test.toml
@@ -0,0 +1,2 @@
+# CLI v1.8.0 ignores feature flags in version 2 state.
+EnvMatrix.STATE_FILE = ["resources.v2.json", "resources.v2.future_feature.json", "resources.v2.deployment_history.json", "resources.v3.json"]
diff --git a/acceptance/bundle/state/feature_flags/reject_new/databricks.yml b/acceptance/bundle/state/feature_flags/reject_new/databricks.yml
new file mode 100644
index 00000000000..5134dbcc12c
--- /dev/null
+++ b/acceptance/bundle/state/feature_flags/reject_new/databricks.yml
@@ -0,0 +1,7 @@
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    my_job:
+      name: "my job"
diff --git a/acceptance/bundle/state/feature_flags/reject_new/out.test.toml b/acceptance/bundle/state/feature_flags/reject_new/out.test.toml
new file mode 100644
index 00000000000..61185395437
--- /dev/null
+++ b/acceptance/bundle/state/feature_flags/reject_new/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = [""]
+EnvMatrix.STATE_FILE = ["resources.v2.future_feature.json", "resources.v3.future_feature.json"]
diff --git a/acceptance/bundle/state/feature_flags/reject_new/output.txt b/acceptance/bundle/state/feature_flags/reject_new/output.txt
new file mode 100644
index 00000000000..35eb79cf7e7
--- /dev/null
+++ b/acceptance/bundle/state/feature_flags/reject_new/output.txt
@@ -0,0 +1,6 @@
+
+>>> musterr [CLI] bundle plan
+Error: migrating state [TEST_TMP_DIR]/.databricks/bundle/default/resources.json: the deployment state requires features this CLI does not support: future_feature; upgrade to the latest CLI version and see https://docs.databricks.com/aws/en/dev-tools/bundles/state-features#state-features for more information
+
+
+>>> cmp [STATE_FILE] .databricks/bundle/default/resources.json
diff --git a/acceptance/bundle/state/feature_flags/reject_new/resources.v2.future_feature.json b/acceptance/bundle/state/feature_flags/reject_new/resources.v2.future_feature.json
new file mode 100644
index 00000000000..acc2ec9823d
--- /dev/null
+++ b/acceptance/bundle/state/feature_flags/reject_new/resources.v2.future_feature.json
@@ -0,0 +1,10 @@
+{
+ "state_version": 2,
+ "features": {
+  "future_feature": {}
+ },
+ "cli_version": "0.0.0-dev",
+ "lineage": "test-lineage",
+ "serial": 1,
+ "state": {}
+}
diff --git a/acceptance/bundle/state/feature_flags/reject_new/resources.v3.future_feature.json b/acceptance/bundle/state/feature_flags/reject_new/resources.v3.future_feature.json
new file mode 100644
index 00000000000..b844b098a70
--- /dev/null
+++ b/acceptance/bundle/state/feature_flags/reject_new/resources.v3.future_feature.json
@@ -0,0 +1,10 @@
+{
+ "state_version": 3,
+ "features": {
+  "future_feature": {}
+ },
+ "cli_version": "0.0.0-dev",
+ "lineage": "test-lineage",
+ "serial": 1,
+ "state": {}
+}
diff --git a/acceptance/bundle/state/feature_flags/reject_new/script b/acceptance/bundle/state/feature_flags/reject_new/script
new file mode 100644
index 00000000000..979cebdcf5a
--- /dev/null
+++ b/acceptance/bundle/state/feature_flags/reject_new/script
@@ -0,0 +1,5 @@
+mkdir -p .databricks/bundle/default
+cp "$STATE_FILE" .databricks/bundle/default/resources.json
+
+trace musterr $CLI bundle plan 2>&1 | contains.py "requires features this CLI does not support: future_feature"
+trace cmp "$STATE_FILE" .databricks/bundle/default/resources.json
diff --git a/acceptance/bundle/state/feature_flags/reject_new/test.toml b/acceptance/bundle/state/feature_flags/reject_new/test.toml
new file mode 100644
index 00000000000..84e88afe36c
--- /dev/null
+++ b/acceptance/bundle/state/feature_flags/reject_new/test.toml
@@ -0,0 +1 @@
+EnvMatrix.STATE_FILE = ["resources.v2.future_feature.json", "resources.v3.future_feature.json"]
diff --git a/acceptance/bundle/state/feature_flags/reject_old/databricks.yml b/acceptance/bundle/state/feature_flags/reject_old/databricks.yml
new file mode 100644
index 00000000000..5134dbcc12c
--- /dev/null
+++ b/acceptance/bundle/state/feature_flags/reject_old/databricks.yml
@@ -0,0 +1,7 @@
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    my_job:
+      name: "my job"
diff --git a/acceptance/bundle/state/feature_flags/reject_old/out.test.toml b/acceptance/bundle/state/feature_flags/reject_old/out.test.toml
new file mode 100644
index 00000000000..45e38cd3073
--- /dev/null
+++ b/acceptance/bundle/state/feature_flags/reject_old/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DMS = [""]
+EnvMatrix.FEATURE = ["future_feature", "deployment_history"]
diff --git a/acceptance/bundle/state/feature_flags/reject_old/output.txt b/acceptance/bundle/state/feature_flags/reject_old/output.txt
new file mode 100644
index 00000000000..f4e77bc90c5
--- /dev/null
+++ b/acceptance/bundle/state/feature_flags/reject_old/output.txt
@@ -0,0 +1,6 @@
+
+>>> musterr [CLI_1_8] bundle plan
+Error: migrating state [TEST_TMP_DIR]/.databricks/bundle/default/resources.json: the deployment state requires features this CLI does not support: [FEATURE]; upgrade to the latest CLI version and see https://docs.databricks.com/aws/en/dev-tools/bundles/state-features#state-features for more information
+
+
+>>> cmp resources.v3.[FEATURE].json .databricks/bundle/default/resources.json
diff --git a/acceptance/bundle/state/feature_flags/reject_old/resources.v3.deployment_history.json b/acceptance/bundle/state/feature_flags/reject_old/resources.v3.deployment_history.json
new file mode 100644
index 00000000000..1e47559efd8
--- /dev/null
+++ b/acceptance/bundle/state/feature_flags/reject_old/resources.v3.deployment_history.json
@@ -0,0 +1,10 @@
+{
+ "state_version": 3,
+ "features": {
+  "deployment_history": {}
+ },
+ "cli_version": "0.0.0-dev",
+ "lineage": "test-lineage",
+ "serial": 1,
+ "state": {}
+}
diff --git a/acceptance/bundle/state/feature_flags/reject_old/resources.v3.future_feature.json b/acceptance/bundle/state/feature_flags/reject_old/resources.v3.future_feature.json
new file mode 100644
index 00000000000..b844b098a70
--- /dev/null
+++ b/acceptance/bundle/state/feature_flags/reject_old/resources.v3.future_feature.json
@@ -0,0 +1,10 @@
+{
+ "state_version": 3,
+ "features": {
+  "future_feature": {}
+ },
+ "cli_version": "0.0.0-dev",
+ "lineage": "test-lineage",
+ "serial": 1,
+ "state": {}
+}
diff --git a/acceptance/bundle/state/feature_flags/reject_old/script b/acceptance/bundle/state/feature_flags/reject_old/script
new file mode 100644
index 00000000000..f3b49e0c453
--- /dev/null
+++ b/acceptance/bundle/state/feature_flags/reject_old/script
@@ -0,0 +1,5 @@
+mkdir -p .databricks/bundle/default
+cp "resources.v3.$FEATURE.json" .databricks/bundle/default/resources.json
+
+trace musterr $CLI_1_8 bundle plan 2>&1 | contains.py "requires features this CLI does not support: $FEATURE"
+trace cmp "resources.v3.$FEATURE.json" .databricks/bundle/default/resources.json
diff --git a/acceptance/bundle/state/feature_flags/reject_old/test.toml b/acceptance/bundle/state/feature_flags/reject_old/test.toml
new file mode 100644
index 00000000000..5fc4cac284e
--- /dev/null
+++ b/acceptance/bundle/state/feature_flags/reject_old/test.toml
@@ -0,0 +1 @@
+EnvMatrix.FEATURE = ["future_feature", "deployment_history"]
diff --git a/acceptance/bundle/state/feature_flags/test.toml b/acceptance/bundle/state/feature_flags/test.toml
new file mode 100644
index 00000000000..a6daca5de91
--- /dev/null
+++ b/acceptance/bundle/state/feature_flags/test.toml
@@ -0,0 +1,5 @@
+Ignore = [".databricks"]
+
+EnvMatrix.DMS = [""]
+
+# New-CLI tests use the source build; pin them to this week's release (v1.17.0) once published.
diff --git a/acceptance/bundle/state/force_pull_commands/databricks.yml b/acceptance/bundle/state/force_pull_commands/databricks.yml
new file mode 100644
index 00000000000..0d4ab71b68b
--- /dev/null
+++ b/acceptance/bundle/state/force_pull_commands/databricks.yml
@@ -0,0 +1,16 @@
+bundle:
+  name: force-pull-commands
+
+resources:
+  jobs:
+    foo:
+      name: foo
+      tasks:
+        - task_key: task
+          spark_python_task:
+            python_file: ./foo.py
+          environment_key: default
+      environments:
+        - environment_key: default
+          spec:
+            client: "2"
diff --git a/acceptance/bundle/state/force_pull_commands/foo.py b/acceptance/bundle/state/force_pull_commands/foo.py
new file mode 100644
index 00000000000..11b15b1a458
--- /dev/null
+++ b/acceptance/bundle/state/force_pull_commands/foo.py
@@ -0,0 +1 @@
+print("hello")
diff --git a/acceptance/bundle/state/force_pull_commands/out.test.toml b/acceptance/bundle/state/force_pull_commands/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/state/force_pull_commands/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/state/force_pull_commands/output.txt b/acceptance/bundle/state/force_pull_commands/output.txt
new file mode 100644
index 00000000000..9f5d004ce19
--- /dev/null
+++ b/acceptance/bundle/state/force_pull_commands/output.txt
@@ -0,0 +1,57 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/force-pull-commands/default/files...
+Created jobs.foo
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+=== Use a fake browser that just prints the URL it would have opened
+=== bundle summary without --force-pull: no remote state read
+
+>>> [CLI] bundle summary
+
+=== bundle summary --force-pull: remote state read
+
+>>> [CLI] bundle summary --force-pull
+{
+  "method": "GET",
+  "path": "/api/2.0/workspace/export",
+  "q": {
+    "direct_download": "true",
+    "path": "/Workspace/Users/[USERNAME]/.bundle/force-pull-commands/default/state/STATE_FILENAME"
+  }
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/workspace/export",
+  "q": {
+    "direct_download": "true",
+    "path": "/Workspace/Users/[USERNAME]/.bundle/force-pull-commands/default/state/STATE_FILENAME"
+  }
+}
+
+=== bundle open without --force-pull: no remote state read
+
+>>> [CLI] bundle open foo
+Opening browser at [DATABRICKS_URL]/jobs/[FOO_ID]?w=[WORKSPACE_ID]
+
+=== bundle open --force-pull: remote state read
+
+>>> [CLI] bundle open foo --force-pull
+Opening browser at [DATABRICKS_URL]/jobs/[FOO_ID]?w=[WORKSPACE_ID]
+{
+  "method": "GET",
+  "path": "/api/2.0/workspace/export",
+  "q": {
+    "direct_download": "true",
+    "path": "/Workspace/Users/[USERNAME]/.bundle/force-pull-commands/default/state/STATE_FILENAME"
+  }
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/workspace/export",
+  "q": {
+    "direct_download": "true",
+    "path": "/Workspace/Users/[USERNAME]/.bundle/force-pull-commands/default/state/STATE_FILENAME"
+  }
+}
diff --git a/acceptance/bundle/state/force_pull_commands/script b/acceptance/bundle/state/force_pull_commands/script
new file mode 100644
index 00000000000..19b0748d61e
--- /dev/null
+++ b/acceptance/bundle/state/force_pull_commands/script
@@ -0,0 +1,30 @@
+trace $CLI bundle deploy > /dev/null
+replace_ids.py
+rm -f "$OUT_REQUESTS"
+
+title "Use a fake browser that just prints the URL it would have opened"
+export BROWSER="echo_browser.py"
+
+# touch "$OUT_REQUESTS" before each print_requests.py call: the commands without
+# --force-pull make zero HTTP requests, so the file is never created and
+# print_requests.py would otherwise exit with "File not found".
+
+title "bundle summary without --force-pull: no remote state read\n"
+trace $CLI bundle summary > /dev/null
+touch "$OUT_REQUESTS"
+print_requests.py --get //workspace/export
+
+title "bundle summary --force-pull: remote state read\n"
+trace $CLI bundle summary --force-pull > /dev/null
+touch "$OUT_REQUESTS"
+print_requests.py --get //workspace/export
+
+title "bundle open without --force-pull: no remote state read\n"
+trace $CLI bundle open foo > /dev/null
+touch "$OUT_REQUESTS"
+print_requests.py --get //workspace/export
+
+title "bundle open --force-pull: remote state read\n"
+trace $CLI bundle open foo --force-pull > /dev/null
+touch "$OUT_REQUESTS"
+print_requests.py --get //workspace/export
diff --git a/acceptance/bundle/state/force_pull_commands/test.toml b/acceptance/bundle/state/force_pull_commands/test.toml
new file mode 100644
index 00000000000..7b9e47c1f4f
--- /dev/null
+++ b/acceptance/bundle/state/force_pull_commands/test.toml
@@ -0,0 +1,8 @@
+Cloud = false
+RecordRequests = true
+
+Ignore = [".databricks"]
+
+[[Repls]]
+Old = '(resources\.json|terraform\.tfstate)'
+New = 'STATE_FILENAME'
diff --git a/acceptance/bundle/state/future_version/out.test.toml b/acceptance/bundle/state/future_version/out.test.toml
index e90b6d5d1ba..fa44d14b3ae 100644
--- a/acceptance/bundle/state/future_version/out.test.toml
+++ b/acceptance/bundle/state/future_version/out.test.toml
@@ -1,3 +1,3 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
+EnvMatrix.STATE_FILE = ["resources.future.json", "resources.future_with_feature.json"]
diff --git a/acceptance/bundle/state/future_version/output.txt b/acceptance/bundle/state/future_version/output.txt
index 7cf98129ee9..5929ce8d6c8 100644
--- a/acceptance/bundle/state/future_version/output.txt
+++ b/acceptance/bundle/state/future_version/output.txt
@@ -1,3 +1,6 @@
-state version 999 is newer than supported version 2; upgrade the CLI
 
-Exit code: 1
+>>> musterr [CLI] bundle plan
+Error: migrating state [TEST_TMP_DIR]/.databricks/bundle/default/resources.json: state version 999 is newer than supported version 3; upgrade the CLI
+
+
+>>> cmp [STATE_FILE] .databricks/bundle/default/resources.json
diff --git a/acceptance/bundle/state/future_version/resources.future_with_feature.json b/acceptance/bundle/state/future_version/resources.future_with_feature.json
new file mode 100644
index 00000000000..e1118814c48
--- /dev/null
+++ b/acceptance/bundle/state/future_version/resources.future_with_feature.json
@@ -0,0 +1,10 @@
+{
+ "state_version": 999,
+ "cli_version": "99.0.0",
+ "lineage": "test-lineage",
+ "serial": 1,
+ "state": {},
+ "features": {
+  "future_feature": {}
+ }
+}
diff --git a/acceptance/bundle/state/future_version/script b/acceptance/bundle/state/future_version/script
index 85fdf969f72..b3bba844e28 100644
--- a/acceptance/bundle/state/future_version/script
+++ b/acceptance/bundle/state/future_version/script
@@ -1,4 +1,5 @@
 mkdir -p .databricks/bundle/default
-cp resources.future.json .databricks/bundle/default/resources.json
+cp "$STATE_FILE" .databricks/bundle/default/resources.json
 
-trace $CLI bundle plan 2>&1 | grep -o 'state version.*'
+trace musterr $CLI bundle plan 2>&1 | contains.py "state version 999 is newer than supported version 3; upgrade the CLI" "!requires features this CLI does not support"
+trace cmp "$STATE_FILE" .databricks/bundle/default/resources.json
diff --git a/acceptance/bundle/state/future_version/test.toml b/acceptance/bundle/state/future_version/test.toml
index 7fc493d51a4..99c7f8da11f 100644
--- a/acceptance/bundle/state/future_version/test.toml
+++ b/acceptance/bundle/state/future_version/test.toml
@@ -1,4 +1,3 @@
 Ignore = [".databricks"]
 
-[EnvMatrix]
-DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.STATE_FILE = ["resources.future.json", "resources.future_with_feature.json"]
diff --git a/acceptance/bundle/state/lineage_different/out.test.toml b/acceptance/bundle/state/lineage_different/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/state/lineage_different/out.test.toml
+++ b/acceptance/bundle/state/lineage_different/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/state/newer_cli_version/databricks.yml b/acceptance/bundle/state/newer_cli_version/databricks.yml
new file mode 100644
index 00000000000..5134dbcc12c
--- /dev/null
+++ b/acceptance/bundle/state/newer_cli_version/databricks.yml
@@ -0,0 +1,7 @@
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    my_job:
+      name: "my job"
diff --git a/acceptance/bundle/state/newer_cli_version/out.test.toml b/acceptance/bundle/state/newer_cli_version/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/state/newer_cli_version/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/state/newer_cli_version/output.txt b/acceptance/bundle/state/newer_cli_version/output.txt
new file mode 100644
index 00000000000..cfe256b2c2c
--- /dev/null
+++ b/acceptance/bundle/state/newer_cli_version/output.txt
@@ -0,0 +1,15 @@
+
+=== State written by a newer CLI: warn, but proceed
+
+>>> [CLI] bundle plan
+Warn: State was last deployed with CLI version 99.0.0 but current version is [CLI_VERSION]
+create jobs.my_job
+
+Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
+
+=== State written by this CLI: no warning
+
+>>> [CLI] bundle plan
+create jobs.my_job
+
+Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
diff --git a/acceptance/bundle/state/newer_cli_version/resources.newer.json b/acceptance/bundle/state/newer_cli_version/resources.newer.json
new file mode 100644
index 00000000000..2105aa89d83
--- /dev/null
+++ b/acceptance/bundle/state/newer_cli_version/resources.newer.json
@@ -0,0 +1,7 @@
+{
+ "state_version": 2,
+ "cli_version": "99.0.0",
+ "lineage": "test-lineage",
+ "serial": 1,
+ "state": {}
+}
diff --git a/acceptance/bundle/state/newer_cli_version/script b/acceptance/bundle/state/newer_cli_version/script
new file mode 100644
index 00000000000..172dc126cb3
--- /dev/null
+++ b/acceptance/bundle/state/newer_cli_version/script
@@ -0,0 +1,11 @@
+title "State written by a newer CLI: warn, but proceed\n"
+mkdir -p .databricks/bundle/default
+cp resources.newer.json .databricks/bundle/default/resources.json
+trace $CLI bundle plan
+
+title "State written by this CLI: no warning\n"
+# The running version is only known at test time, so derive the state's
+# cli_version from the binary itself rather than committing it as a fixture.
+version=$($CLI version | sed 's/^Databricks CLI v//')
+jq --arg v "$version" '.cli_version = $v' resources.newer.json > .databricks/bundle/default/resources.json
+trace $CLI bundle plan
diff --git a/acceptance/bundle/state/newer_cli_version/test.toml b/acceptance/bundle/state/newer_cli_version/test.toml
new file mode 100644
index 00000000000..e1f865c624d
--- /dev/null
+++ b/acceptance/bundle/state/newer_cli_version/test.toml
@@ -0,0 +1,5 @@
+Ignore = [".databricks"]
+
+# The warning is emitted when reading the direct engine's resources.json.
+# This fixture seeds file-backed state; DMS mismatch behavior is covered under bundle/dms.
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/state/permission_level_migration/out.plan.direct.json b/acceptance/bundle/state/permission_level_migration/out.plan.direct.json
index 34c7dedf444..e02d691b171 100644
--- a/acceptance/bundle/state/permission_level_migration/out.plan.direct.json
+++ b/acceptance/bundle/state/permission_level_migration/out.plan.direct.json
@@ -1,6 +1,6 @@
 {
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
   "lineage": "test-lineage",
   "serial": 1,
   "plan": {
diff --git a/acceptance/bundle/state/permission_level_migration/out.test.toml b/acceptance/bundle/state/permission_level_migration/out.test.toml
index e90b6d5d1ba..19b5b15d11f 100644
--- a/acceptance/bundle/state/permission_level_migration/out.test.toml
+++ b/acceptance/bundle/state/permission_level_migration/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/state/permission_level_migration/output.txt b/acceptance/bundle/state/permission_level_migration/output.txt
index f289e0bc42a..c642fb01f52 100644
--- a/acceptance/bundle/state/permission_level_migration/output.txt
+++ b/acceptance/bundle/state/permission_level_migration/output.txt
@@ -5,20 +5,21 @@
 === Deploy (migrates state)
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.my_job
+Updated jobs.my_job.permissions
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 1 changed, 0 deleted, 0 unchanged
 
 === Print state after deploy
 >>> print_state.py
 {
- "state_version": 2,
- "cli_version": "[DEV_VERSION]",
+ "state_version": 3,
+ "cli_version": "[CLI_VERSION]",
  "lineage": "test-lineage",
  "serial": 2,
  "state": {
   "resources.jobs.my_job": {
-   "__id__": "[NUMID]",
+   "__id__": "[MY_JOB_ID]",
    "state": {
     "deployment": {
      "kind": "BUNDLE",
@@ -36,7 +37,7 @@ Deployment complete!
   "resources.jobs.my_job.permissions": {
    "__id__": "/jobs/123",
    "state": {
-    "object_id": "/jobs/[NUMID]",
+    "object_id": "/jobs/[MY_JOB_ID]",
     "__embed__": [
      {
       "level": "CAN_VIEW",
diff --git a/acceptance/bundle/state/permission_level_migration/resources.v1.json b/acceptance/bundle/state/permission_level_migration/resources.v1.json
index 78766b3be93..99f0842d3e8 100644
--- a/acceptance/bundle/state/permission_level_migration/resources.v1.json
+++ b/acceptance/bundle/state/permission_level_migration/resources.v1.json
@@ -1,6 +1,6 @@
 {
  "state_version": 1,
- "cli_version": "0.0.0-dev",
+ "cli_version": "0.0.0-test",
  "lineage": "test-lineage",
  "serial": 1,
  "state": {
diff --git a/acceptance/bundle/state/permission_level_migration/script b/acceptance/bundle/state/permission_level_migration/script
index c317985fc88..e03dd05504e 100644
--- a/acceptance/bundle/state/permission_level_migration/script
+++ b/acceptance/bundle/state/permission_level_migration/script
@@ -9,10 +9,11 @@ mkdir -p .databricks/bundle/default
 cp resources.v1.json .databricks/bundle/default/resources.json
 
 title "Plan with old v1 state"
-trace $CLI bundle plan -o json > out.plan.direct.json
+trace $CLI bundle plan -o json | nostamp > out.plan.direct.json
 
 title "Deploy (migrates state)"
 trace $CLI bundle deploy
+read_id.py my_job > /dev/null
 
 title "Print state after deploy"
-trace print_state.py
+trace print_state.py | nostamp --indent 1
diff --git a/acceptance/bundle/state/permission_level_migration/test.toml b/acceptance/bundle/state/permission_level_migration/test.toml
index 7fc493d51a4..4b4f83c101f 100644
--- a/acceptance/bundle/state/permission_level_migration/test.toml
+++ b/acceptance/bundle/state/permission_level_migration/test.toml
@@ -1,4 +1,6 @@
-Ignore = [".databricks"]
+# Recording needs a bundle it has seen from the start. This test seeds a state file,
+# so recording refuses it. TODO(DMS): drop this once existing state can be
+# handed over to the service (see the TODO in dstate.Open).
+EnvMatrix.DMS = [""]
 
-[EnvMatrix]
-DATABRICKS_BUNDLE_ENGINE = ["direct"]
+Ignore = [".databricks"]
diff --git a/acceptance/bundle/state/same_serial/out.test.toml b/acceptance/bundle/state/same_serial/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/state/same_serial/out.test.toml
+++ b/acceptance/bundle/state/same_serial/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/state/state_present/databricks.yml b/acceptance/bundle/state/state_present/databricks.yml
index 1b2e54dca47..30d1ade858b 100644
--- a/acceptance/bundle/state/state_present/databricks.yml
+++ b/acceptance/bundle/state/state_present/databricks.yml
@@ -3,6 +3,7 @@ bundle:
 
 resources:
   schemas:
-    foo:
-      catalog_name: bar
-      name: foo
+    my_schema:
+      name: myschema
+      catalog_name: main
+      storage_root: s3://mybucket/init
diff --git a/acceptance/bundle/state/state_present/out.test.toml b/acceptance/bundle/state/state_present/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/state/state_present/out.test.toml
+++ b/acceptance/bundle/state/state_present/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/state/state_present/output.txt b/acceptance/bundle/state/state_present/output.txt
index 706b54a67a0..4a9e949378c 100644
--- a/acceptance/bundle/state/state_present/output.txt
+++ b/acceptance/bundle/state/state_present/output.txt
@@ -1,104 +1,64 @@
 
-=== Terraform state is present, env var mismatch warns but uses state engine
+=== Terraform state present: the direct default migrates it to the direct engine
 
->>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-
->>> print_requests.py //api/2.1/unity-catalog/schemas
-"databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5 sdk/sdkv2 resource/schema auth/pat"
-
->>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+>>> replay_tfstate.py terraform-requests.json terraform.tfstate
 
->>> print_requests.py --get //api/2.1/unity-catalog/schemas
-"databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5 sdk/sdkv2 resource/schema auth/pat"
-
-=== Adding resources.json with lower serial does not change anything
->>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle plan
+>>> [CLI] bundle plan
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
 Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
 
->>> DATABRICKS_BUNDLE_ENGINE=terraform [CLI] bundle plan
-Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
+>>> print_requests.py --get //api/2.1/unity-catalog/schemas
+"replay_tfstate.py"
+"cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none lineage/ARgQbIVroS5 auth/pat"
+"cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none lineage/ARgQbIVroS5 engine/direct auth/pat"
 
->>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle plan
+=== A resources.json with a lower serial does not win: the terraform state still migrates
+>>> [CLI] bundle plan
+Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).
 Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
 
-=== Adding resources.json with higher serial, env var mismatch warns but uses state engine
-
->>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle plan
-create schemas.foo
+=== A resources.json with a higher serial wins: the direct state is authoritative, no migration
 
-Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
-
->>> DATABRICKS_BUNDLE_ENGINE=terraform [CLI] bundle plan
-create schemas.foo
+>>> [CLI] bundle plan
+create schemas.my_schema
 
 Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
 
->>> DATABRICKS_BUNDLE_ENGINE=terraform [CLI] bundle deploy
+>>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created schemas.my_schema
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
->>> DATABRICKS_BUNDLE_ENGINE=terraform [CLI] bundle destroy --auto-approve
+>>> print_requests.py //api/2.1/unity-catalog/schemas
+"cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct lineage/ARgQbIVroS5 auth/pat"
+
+>>> [CLI] bundle destroy --auto-approve
 The following resources will be deleted:
-  delete resources.schemas.foo
+  delete resources.schemas.my_schema
 
 This action will result in the deletion of the following UC schemas. Any underlying data may be lost:
-  delete resources.schemas.foo
+  delete resources.schemas.my_schema
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
 
->>> DATABRICKS_BUNDLE_ENGINE=direct [CLI] bundle deploy
+>>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created schemas.my_schema
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> print_requests.py //api/2.1/unity-catalog/schemas
-"cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
+"cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
 
 >>> print_state.py
-3
-13
-contains error: '11' not found in the output.
-
->>> DATABRICKS_BUNDLE_ENGINE=terraform [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+1
 
->>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle deploy
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+>>> [CLI] bundle debug states
+[TEST_TMP_DIR]/.databricks/bundle/default/resources.json: local direct state serial=1 lineage="[UUID]"
 
->>> print_requests.py --get //api/2.1/unity-catalog/schemas
-"cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
-"cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
-
->>> print_state.py
-3
-15
-contains error: '12' not found in the output.
-
->>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle debug states
-[TEST_TMP_DIR]/.databricks/bundle/default/terraform/terraform.tfstate: local terraform state serial=3 lineage="test-lineage"
-[TEST_TMP_DIR]/.databricks/bundle/default/resources.json: local direct state serial=15 lineage="test-lineage"
-
->>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle debug states --force-pull
-[TEST_TMP_DIR]/.databricks/bundle/default/terraform/terraform.tfstate: local terraform state serial=3 lineage="test-lineage"
-resources.json: remote direct state serial=15 lineage="test-lineage"
-[TEST_TMP_DIR]/.databricks/bundle/default/resources.json: local direct state serial=15 lineage="test-lineage"
+>>> [CLI] bundle debug states --force-pull
+resources.json: remote direct state serial=1 lineage="[UUID]"
+[TEST_TMP_DIR]/.databricks/bundle/default/resources.json: local direct state serial=1 lineage="[UUID]"
diff --git a/acceptance/bundle/state/state_present/script b/acceptance/bundle/state/state_present/script
index 36395a3ef3a..40d2f72e440 100644
--- a/acceptance/bundle/state/state_present/script
+++ b/acceptance/bundle/state/state_present/script
@@ -1,44 +1,44 @@
-title 'Terraform state is present, env var mismatch warns but uses state engine\n'
-mkdir -p .databricks/bundle/default/terraform
-echo '{"version": 4, "serial": 1, "lineage": "test-lineage"}' > .databricks/bundle/default/terraform/terraform.tfstate
-
-trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle deploy
-trace print_requests.py //api/2.1/unity-catalog/schemas | jq '.headers["User-Agent"][0]' | contains.py 'terraform' 'tf-provider' '!direct'
-
-# empty is the same as "terraform" here
-trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle deploy
-trace print_requests.py --get //api/2.1/unity-catalog/schemas | jq '.headers["User-Agent"][0]' | contains.py 'terraform' '!direct'
-
-title 'Adding resources.json with lower serial does not change anything'
-rm .databricks/bundle/default/terraform/terraform.tfstate
-echo '{"serial": 0, "lineage": "test-lineage"}' > .databricks/bundle/default/resources.json
-trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle plan
-trace DATABRICKS_BUNDLE_ENGINE=terraform $CLI bundle plan
-trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle plan
-
-rm out.requests.txt
-title 'Adding resources.json with higher serial, env var mismatch warns but uses state engine\n'
-echo '{"serial": 10, "lineage": "test-lineage"}' > .databricks/bundle/default/resources.json
-trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle plan
-#trace print_requests.py --get //api/2.1/unity-catalog/schemas | jq '.headers["User-Agent"][0]' | contains.py 'engine/direct' '!terraform' '!tf-provider'
-
-trace DATABRICKS_BUNDLE_ENGINE=terraform $CLI bundle plan
-trace DATABRICKS_BUNDLE_ENGINE=terraform $CLI bundle deploy
-trace DATABRICKS_BUNDLE_ENGINE=terraform $CLI bundle destroy --auto-approve
-
-rm out.requests.txt
-trace DATABRICKS_BUNDLE_ENGINE=direct $CLI bundle deploy
-trace print_requests.py //api/2.1/unity-catalog/schemas | jq '.headers["User-Agent"][0]' | contains.py 'engine/direct' '!terraform' '!tf-provider'
-trace print_state.py | jq .serial | contains.py "11"
-
-trace DATABRICKS_BUNDLE_ENGINE=terraform $CLI bundle deploy
-#trace print_requests.py --get //api/2.1/unity-catalog/schemas | jq '.headers["User-Agent"][0]' | contains.py 'engine/direct' '!terraform' '!tf-provider'
-
-trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle deploy
-trace print_requests.py --get //api/2.1/unity-catalog/schemas | jq '.headers["User-Agent"][0]' | contains.py 'engine/direct' '!terraform' '!tf-provider'
-trace print_state.py | jq .serial | contains.py "12"
-
-trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle debug states
-trace DATABRICKS_BUNDLE_ENGINE= $CLI bundle debug states --force-pull
-
-rm out.requests.txt
+title 'Terraform state present: the direct default migrates it to the direct engine\n'
+# Keep the committed fixtures (and generated files) out of `bundle deploy`'s upload.
+printf '%s\n' '.gitignore' 'out.*' 'terraform*.tfstate' 'terraform*-requests.json' > .gitignore
+
+# The terraform engine was removed in v1.20.0, so replay a prior terraform deployment (captured once
+# from a real terraform run) to reconstruct the terraform-shaped state locally, standing in for a
+# `DATABRICKS_BUNDLE_ENGINE=terraform bundle deploy`.
+trace replay_tfstate.py terraform-requests.json terraform.tfstate
+
+# The serial-resolution cases below add a direct state (resources.json); it must share the terraform
+# state's lineage, or the two are rejected as unrelated ("lineage mismatch") before serials matter.
+lineage=$(jq -r .lineage .databricks/bundle/default/terraform/terraform.tfstate)
+
+# An empty env var defaults to direct, which migrates the terraform state in memory (no commit), so
+# plan runs on direct and finds the schema unchanged.
+trace $CLI bundle plan
+trace print_requests.py --get //api/2.1/unity-catalog/schemas | jq '.headers["User-Agent"][0]' | contains.py 'engine/direct' '!tf-provider'
+
+title 'A resources.json with a lower serial does not win: the terraform state still migrates'
+echo "{\"serial\": 0, \"lineage\": \"$lineage\"}" > .databricks/bundle/default/resources.json
+trace $CLI bundle plan
+
+rm "$OUT_REQUESTS"
+title 'A resources.json with a higher serial wins: the direct state is authoritative, no migration\n'
+echo "{\"serial\": 10, \"lineage\": \"$lineage\"}" > .databricks/bundle/default/resources.json
+# serial 10 outranks the terraform state (serial 1), so direct wins; its (empty) state plans to
+# create the schema, and every schemas request carries the direct-engine User-Agent, not terraform.
+trace $CLI bundle plan
+trace $CLI bundle deploy
+trace print_requests.py //api/2.1/unity-catalog/schemas | jq '.headers["User-Agent"][0]' | contains.py 'engine/direct' '!tf-provider'
+trace $CLI bundle destroy --auto-approve
+
+rm "$OUT_REQUESTS"
+# The destroy tore everything down: it removed all local state (both engines) and the remote
+# deployment - a destroy does not preserve a superseded terraform state for a later deploy to
+# resurrect. So this deploy starts fresh on the direct engine: nothing to migrate, serial 1.
+trace $CLI bundle deploy
+trace print_requests.py //api/2.1/unity-catalog/schemas | jq '.headers["User-Agent"][0]' | contains.py 'engine/direct' '!tf-provider'
+trace print_state.py | jq .serial
+
+trace $CLI bundle debug states
+trace $CLI bundle debug states --force-pull
+
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/state/state_present/terraform-requests.json b/acceptance/bundle/state/state_present/terraform-requests.json
new file mode 100644
index 00000000000..0c3e56abc30
--- /dev/null
+++ b/acceptance/bundle/state/state_present/terraform-requests.json
@@ -0,0 +1,11 @@
+[
+  {
+    "method": "POST",
+    "path": "/api/2.1/unity-catalog/schemas",
+    "body": {
+      "catalog_name": "main",
+      "name": "myschema",
+      "storage_root": "s3://mybucket/init"
+    }
+  }
+]
diff --git a/acceptance/bundle/state/state_present/terraform.tfstate b/acceptance/bundle/state/state_present/terraform.tfstate
new file mode 100644
index 00000000000..90a6b74d9e4
--- /dev/null
+++ b/acceptance/bundle/state/state_present/terraform.tfstate
@@ -0,0 +1,41 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.5",
+  "serial": 1,
+  "lineage": "ed6ea4b1-1168-2291-5f1b-45c0c5698c28",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "databricks_schema",
+      "name": "my_schema",
+      "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "catalog_name": "main",
+            "comment": null,
+            "enable_predictive_optimization": "INHERIT",
+            "force_destroy": true,
+            "id": "main.myschema",
+            "metastore_id": "120efa64-9b68-46ba-be38-f319458430d2",
+            "name": "myschema",
+            "owner": "tester@databricks.com",
+            "properties": null,
+            "provider_config": [
+              {
+                "workspace_id": "900800700600"
+              }
+            ],
+            "schema_id": "79fe88b1-3e30-0048-79fe-88b13e300049",
+            "storage_root": "s3://mybucket/init"
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA=="
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/acceptance/bundle/state/state_present/test.toml b/acceptance/bundle/state/state_present/test.toml
index e25c2749483..4eb81f64745 100644
--- a/acceptance/bundle/state/state_present/test.toml
+++ b/acceptance/bundle/state/state_present/test.toml
@@ -1,2 +1,8 @@
+# This test replays a terraform-state fixture and migrates it to direct. Migrating a terraform
+# state is not supported with deployment-history recording, so it only runs without it.
+EnvMatrix.DMS = [""]
+
 RecordRequests = true
 IncludeRequestHeaders = ["User-Agent"]
+
+Ignore = [".databricks", ".gitignore"]
diff --git a/acceptance/bundle/strict_profile_match/config_file/account.databrickscfg b/acceptance/bundle/strict_profile_match/config_file/account.databrickscfg
new file mode 100644
index 00000000000..9cf5f28ce8b
--- /dev/null
+++ b/acceptance/bundle/strict_profile_match/config_file/account.databrickscfg
@@ -0,0 +1,7 @@
+[workspace_custom_host]
+host = $CUSTOM_HOST
+workspace_id = $WORKSPACE_ID
+
+[account_custom_host]
+host = $CUSTOM_HOST
+account_id = test-account
diff --git a/acceptance/bundle/strict_profile_match/config_file/ambiguous.databrickscfg b/acceptance/bundle/strict_profile_match/config_file/ambiguous.databrickscfg
new file mode 100644
index 00000000000..ec959750f7e
--- /dev/null
+++ b/acceptance/bundle/strict_profile_match/config_file/ambiguous.databrickscfg
@@ -0,0 +1,5 @@
+[DEFAULT]
+host = $CLASSIC_HOST
+
+[workspace_classic]
+host = $CLASSIC_HOST
diff --git a/acceptance/bundle/strict_profile_match/config_file/databricks.yml b/acceptance/bundle/strict_profile_match/config_file/databricks.yml
new file mode 100644
index 00000000000..bc8060bb92a
--- /dev/null
+++ b/acceptance/bundle/strict_profile_match/config_file/databricks.yml
@@ -0,0 +1,20 @@
+bundle:
+  name: strict-profile-match
+
+include:
+  - scripts.yml
+
+targets:
+  classic:
+    default: true
+    workspace:
+      host: $CLASSIC_HOST
+  custom_host:
+    workspace:
+      host: $CUSTOM_HOST/?o=$WORKSPACE_ID
+  custom_host_without_workspace_id:
+    workspace:
+      host: $CUSTOM_HOST
+  no_host_with_workspace_id:
+    workspace:
+      workspace_id: "$WORKSPACE_ID"
diff --git a/acceptance/bundle/strict_profile_match/config_file/out.test.toml b/acceptance/bundle/strict_profile_match/config_file/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/strict_profile_match/config_file/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/strict_profile_match/config_file/output.txt b/acceptance/bundle/strict_profile_match/config_file/output.txt
new file mode 100644
index 00000000000..6814e82e21d
--- /dev/null
+++ b/acceptance/bundle/strict_profile_match/config_file/output.txt
@@ -0,0 +1,52 @@
+
+=== A target that matches several profiles, including [DEFAULT], is rejected
+>>> errcode env DATABRICKS_CONFIG_FILE=[TEST_TMP_DIR]/ambiguous.databrickscfg [CLI] bundle validate -t classic
+Error: cannot resolve bundle auth configuration: resolve: strict profile matching: multiple profiles match host [DATABRICKS_URL]: DEFAULT, workspace_classic. Config: host=[DATABRICKS_URL], config_file=[TEST_TMP_DIR]/ambiguous.databrickscfg, databricks_cli_path=[CLI]. Env: DATABRICKS_CONFIG_FILE, DATABRICKS_CLI_PATH
+
+Name: strict-profile-match
+Target: classic
+Workspace:
+  Host: [DATABRICKS_URL]
+
+Found 1 error
+
+Exit code: 1
+
+=== Account profiles are skipped
+>>> errcode env DATABRICKS_CONFIG_FILE=[TEST_TMP_DIR]/account.databrickscfg [CLI] bundle run -t custom_host show_auth
+profile=workspace_custom_host host=[CUSTOM_HOST] workspace_id=[WORKSPACE_ID]
+
+>>> errcode env DATABRICKS_CONFIG_FILE=[TEST_TMP_DIR]/account.databrickscfg [CLI] bundle validate -t custom_host_without_workspace_id
+Error: cannot resolve bundle auth configuration: resolve: strict profile matching: host [CUSTOM_HOST] requires a workspace ID; set workspace.workspace_id or add ?o=<workspace-id> to workspace.host. Config: host=[CUSTOM_HOST], config_file=[TEST_TMP_DIR]/account.databrickscfg, databricks_cli_path=[CLI]. Env: DATABRICKS_CONFIG_FILE, DATABRICKS_CLI_PATH
+
+Name: strict-profile-match
+Target: custom_host_without_workspace_id
+Workspace:
+  Host: [CUSTOM_HOST]
+
+Found 1 error
+
+Exit code: 1
+
+>>> errcode env DATABRICKS_CONFIG_FILE=[TEST_TMP_DIR]/account.databrickscfg [CLI] bundle validate -t no_host_with_workspace_id -p account_custom_host
+Error: cannot resolve bundle auth configuration: resolve: strict profile matching: account_custom_host is not a workspace profile with a host in the config file. Config: workspace_id=[WORKSPACE_ID], profile=account_custom_host, config_file=[TEST_TMP_DIR]/account.databrickscfg, databricks_cli_path=[CLI]. Env: DATABRICKS_CONFIG_FILE, DATABRICKS_CLI_PATH
+
+Name: strict-profile-match
+Target: no_host_with_workspace_id
+
+Found 1 error
+
+Exit code: 1
+
+=== A missing config file is rejected
+>>> errcode env DATABRICKS_CONFIG_FILE=[TEST_TMP_DIR]/missing.databrickscfg [CLI] bundle validate -t classic
+Error: cannot resolve bundle auth configuration: resolve: strict profile matching: config file [TEST_TMP_DIR]/missing.databrickscfg not found. Config: host=[DATABRICKS_URL], config_file=[TEST_TMP_DIR]/missing.databrickscfg, databricks_cli_path=[CLI]. Env: DATABRICKS_CONFIG_FILE, DATABRICKS_CLI_PATH
+
+Name: strict-profile-match
+Target: classic
+Workspace:
+  Host: [DATABRICKS_URL]
+
+Found 1 error
+
+Exit code: 1
diff --git a/acceptance/bundle/strict_profile_match/config_file/script b/acceptance/bundle/strict_profile_match/config_file/script
new file mode 100644
index 00000000000..7f18be0fd6f
--- /dev/null
+++ b/acceptance/bundle/strict_profile_match/config_file/script
@@ -0,0 +1,10 @@
+title "A target that matches several profiles, including [DEFAULT], is rejected"
+trace errcode env DATABRICKS_CONFIG_FILE=$TEST_TMP_DIR/ambiguous.databrickscfg $CLI bundle validate -t classic
+
+title "Account profiles are skipped"
+trace errcode env DATABRICKS_CONFIG_FILE=$TEST_TMP_DIR/account.databrickscfg $CLI bundle run -t custom_host show_auth
+trace errcode env DATABRICKS_CONFIG_FILE=$TEST_TMP_DIR/account.databrickscfg $CLI bundle validate -t custom_host_without_workspace_id
+trace errcode env DATABRICKS_CONFIG_FILE=$TEST_TMP_DIR/account.databrickscfg $CLI bundle validate -t no_host_with_workspace_id -p account_custom_host
+
+title "A missing config file is rejected"
+trace errcode env DATABRICKS_CONFIG_FILE=$TEST_TMP_DIR/missing.databrickscfg $CLI bundle validate -t classic
diff --git a/acceptance/bundle/strict_profile_match/default_profile/host/databricks.yml b/acceptance/bundle/strict_profile_match/default_profile/host/databricks.yml
new file mode 100644
index 00000000000..1e4db490d1f
--- /dev/null
+++ b/acceptance/bundle/strict_profile_match/default_profile/host/databricks.yml
@@ -0,0 +1,23 @@
+bundle:
+  name: strict-profile-match
+
+include:
+  - scripts.yml
+
+targets:
+  classic:
+    default: true
+    workspace:
+      host: $CLASSIC_HOST
+  classic_with_workspace_id:
+    workspace:
+      host: $CLASSIC_HOST/?o=$WORKSPACE_ID
+  custom_host:
+    workspace:
+      host: $CUSTOM_HOST/?o=$WORKSPACE_ID
+  classic_other_workspace:
+    workspace:
+      host: $CLASSIC_HOST/?o=2222222222
+  custom_host_without_workspace_id:
+    workspace:
+      host: $CUSTOM_HOST
diff --git a/acceptance/bundle/strict_profile_match/default_profile/host/out.test.toml b/acceptance/bundle/strict_profile_match/default_profile/host/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/strict_profile_match/default_profile/host/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/strict_profile_match/default_profile/host/output.txt b/acceptance/bundle/strict_profile_match/default_profile/host/output.txt
new file mode 100644
index 00000000000..2d194ce17e2
--- /dev/null
+++ b/acceptance/bundle/strict_profile_match/default_profile/host/output.txt
@@ -0,0 +1,38 @@
+
+=== Target classic matches by host, not the default profile
+>>> errcode [CLI] bundle run -t classic show_auth
+profile=workspace_classic host=[DATABRICKS_URL] workspace_id=[WORKSPACE_ID]
+
+=== Target classic_with_workspace_id matches by host, not the default profile
+>>> errcode [CLI] bundle run -t classic_with_workspace_id show_auth
+profile=workspace_classic_id host=[DATABRICKS_URL] workspace_id=[WORKSPACE_ID]
+
+=== Target custom_host matches by host, not the default profile
+>>> errcode [CLI] bundle run -t custom_host show_auth
+profile=workspace_custom_host host=[CUSTOM_HOST] workspace_id=[WORKSPACE_ID]
+
+=== Target classic_other_workspace is rejected
+>>> errcode [CLI] bundle validate -t classic_other_workspace
+Error: cannot resolve bundle auth configuration: resolve: strict profile matching: no profile for host [DATABRICKS_URL] has workspace_id 2222222222. Config: host=[DATABRICKS_URL], workspace_id=2222222222, config_file=[TEST_TMP_DIR]/.databrickscfg, databricks_cli_path=[CLI]. Env: DATABRICKS_CONFIG_FILE, DATABRICKS_CLI_PATH
+
+Name: strict-profile-match
+Target: classic_other_workspace
+Workspace:
+  Host: [DATABRICKS_URL]
+
+Found 1 error
+
+Exit code: 1
+
+=== Target custom_host_without_workspace_id is rejected
+>>> errcode [CLI] bundle validate -t custom_host_without_workspace_id
+Error: cannot resolve bundle auth configuration: resolve: strict profile matching: host [CUSTOM_HOST] requires a workspace ID; set workspace.workspace_id or add ?o=<workspace-id> to workspace.host. Config: host=[CUSTOM_HOST], config_file=[TEST_TMP_DIR]/.databrickscfg, databricks_cli_path=[CLI]. Env: DATABRICKS_CONFIG_FILE, DATABRICKS_CLI_PATH
+
+Name: strict-profile-match
+Target: custom_host_without_workspace_id
+Workspace:
+  Host: [CUSTOM_HOST]
+
+Found 1 error
+
+Exit code: 1
diff --git a/acceptance/bundle/strict_profile_match/default_profile/host/script b/acceptance/bundle/strict_profile_match/default_profile/host/script
new file mode 100644
index 00000000000..eab4042b160
--- /dev/null
+++ b/acceptance/bundle/strict_profile_match/default_profile/host/script
@@ -0,0 +1,9 @@
+for target in classic classic_with_workspace_id custom_host; do
+  title "Target $target matches by host, not the default profile"
+  trace errcode $CLI bundle run -t $target show_auth
+done
+
+for target in classic_other_workspace custom_host_without_workspace_id; do
+  title "Target $target is rejected"
+  trace errcode $CLI bundle validate -t $target
+done
diff --git a/acceptance/bundle/strict_profile_match/default_profile/no_host/databricks.yml b/acceptance/bundle/strict_profile_match/default_profile/no_host/databricks.yml
new file mode 100644
index 00000000000..50e55023dea
--- /dev/null
+++ b/acceptance/bundle/strict_profile_match/default_profile/no_host/databricks.yml
@@ -0,0 +1,15 @@
+bundle:
+  name: strict-profile-match
+
+include:
+  - scripts.yml
+
+targets:
+  no_host:
+    default: true
+  no_host_with_workspace_id:
+    workspace:
+      workspace_id: "$WORKSPACE_ID"
+  no_host_other_workspace:
+    workspace:
+      workspace_id: "2222222222"
diff --git a/acceptance/bundle/strict_profile_match/default_profile/no_host/out.test.toml b/acceptance/bundle/strict_profile_match/default_profile/no_host/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/strict_profile_match/default_profile/no_host/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/strict_profile_match/default_profile/no_host/output.txt b/acceptance/bundle/strict_profile_match/default_profile/no_host/output.txt
new file mode 100644
index 00000000000..614d59ce296
--- /dev/null
+++ b/acceptance/bundle/strict_profile_match/default_profile/no_host/output.txt
@@ -0,0 +1,19 @@
+
+=== Target no_host uses the default profile
+>>> errcode [CLI] bundle run -t no_host show_auth
+profile=workspace_classic_id host=[DATABRICKS_URL] workspace_id=[WORKSPACE_ID]
+
+=== Target no_host_with_workspace_id uses the default profile
+>>> errcode [CLI] bundle run -t no_host_with_workspace_id show_auth
+profile=workspace_classic_id host=[DATABRICKS_URL] workspace_id=[WORKSPACE_ID]
+
+=== Target no_host_other_workspace is rejected
+>>> errcode [CLI] bundle validate -t no_host_other_workspace
+Error: cannot resolve bundle auth configuration: resolve: strict profile matching: profile workspace_classic_id does not have workspace_id 2222222222. Config: workspace_id=2222222222, profile=workspace_classic_id, config_file=[TEST_TMP_DIR]/.databrickscfg, databricks_cli_path=[CLI]. Env: DATABRICKS_CONFIG_FILE, DATABRICKS_CLI_PATH
+
+Name: strict-profile-match
+Target: no_host_other_workspace
+
+Found 1 error
+
+Exit code: 1
diff --git a/acceptance/bundle/strict_profile_match/default_profile/no_host/script b/acceptance/bundle/strict_profile_match/default_profile/no_host/script
new file mode 100644
index 00000000000..bd2c1553569
--- /dev/null
+++ b/acceptance/bundle/strict_profile_match/default_profile/no_host/script
@@ -0,0 +1,7 @@
+for target in no_host no_host_with_workspace_id; do
+  title "Target $target uses the default profile"
+  trace errcode $CLI bundle run -t $target show_auth
+done
+
+title "Target no_host_other_workspace is rejected"
+trace errcode $CLI bundle validate -t no_host_other_workspace
diff --git a/acceptance/bundle/strict_profile_match/default_profile/script.prepare b/acceptance/bundle/strict_profile_match/default_profile/script.prepare
new file mode 100644
index 00000000000..47ae352d5b8
--- /dev/null
+++ b/acceptance/bundle/strict_profile_match/default_profile/script.prepare
@@ -0,0 +1,2 @@
+# The usual three profiles with workspace_classic_id as the default profile.
+{ printf '[__settings__]\ndefault_profile = workspace_classic_id\n\n'; cat .databrickscfg; } > out && mv out .databrickscfg
diff --git a/acceptance/bundle/strict_profile_match/disabled/databricks.yml b/acceptance/bundle/strict_profile_match/disabled/databricks.yml
new file mode 100644
index 00000000000..a9118bbd4cb
--- /dev/null
+++ b/acceptance/bundle/strict_profile_match/disabled/databricks.yml
@@ -0,0 +1,7 @@
+bundle:
+  name: strict-profile-match
+
+targets:
+  custom_host_other_workspace:
+    workspace:
+      host: $CUSTOM_HOST/?o=2222222222
diff --git a/acceptance/bundle/strict_profile_match/disabled/out.test.toml b/acceptance/bundle/strict_profile_match/disabled/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/strict_profile_match/disabled/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/strict_profile_match/disabled/output.txt b/acceptance/bundle/strict_profile_match/disabled/output.txt
new file mode 100644
index 00000000000..27c5f5f642b
--- /dev/null
+++ b/acceptance/bundle/strict_profile_match/disabled/output.txt
@@ -0,0 +1,22 @@
+
+=== Without strict mode, the environment token is used for a custom host of another workspace
+>>> errcode [CLI] bundle validate -t custom_host_other_workspace
+Name: strict-profile-match
+Target: custom_host_other_workspace
+Workspace:
+  Host: [CUSTOM_HOST]/?o=2222222222
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/strict-profile-match/custom_host_other_workspace
+
+Validation OK!
+
+=== The variable is read as a boolean, so false leaves strict mode off
+>>> errcode env DATABRICKS_BUNDLE_STRICT_PROFILE_MATCH=false [CLI] bundle validate -t custom_host_other_workspace
+Name: strict-profile-match
+Target: custom_host_other_workspace
+Workspace:
+  Host: [CUSTOM_HOST]/?o=2222222222
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/strict-profile-match/custom_host_other_workspace
+
+Validation OK!
diff --git a/acceptance/bundle/strict_profile_match/disabled/script b/acceptance/bundle/strict_profile_match/disabled/script
new file mode 100644
index 00000000000..cc740c3100c
--- /dev/null
+++ b/acceptance/bundle/strict_profile_match/disabled/script
@@ -0,0 +1,7 @@
+unset DATABRICKS_BUNDLE_STRICT_PROFILE_MATCH
+
+title "Without strict mode, the environment token is used for a custom host of another workspace"
+trace errcode $CLI bundle validate -t custom_host_other_workspace
+
+title "The variable is read as a boolean, so false leaves strict mode off"
+trace errcode env DATABRICKS_BUNDLE_STRICT_PROFILE_MATCH=false $CLI bundle validate -t custom_host_other_workspace
diff --git a/acceptance/bundle/strict_profile_match/host/databricks.yml b/acceptance/bundle/strict_profile_match/host/databricks.yml
new file mode 100644
index 00000000000..5643f1b38c2
--- /dev/null
+++ b/acceptance/bundle/strict_profile_match/host/databricks.yml
@@ -0,0 +1,33 @@
+bundle:
+  name: strict-profile-match
+
+include:
+  - scripts.yml
+
+targets:
+  classic:
+    default: true
+    workspace:
+      host: $CLASSIC_HOST
+  classic_with_workspace_id:
+    workspace:
+      host: $CLASSIC_HOST/?o=$WORKSPACE_ID
+  classic_other_workspace:
+    workspace:
+      host: $CLASSIC_HOST/?o=2222222222
+  custom_host:
+    workspace:
+      host: $CUSTOM_HOST/?o=$WORKSPACE_ID
+  custom_host_workspace_id_field:
+    workspace:
+      host: $CUSTOM_HOST
+      workspace_id: "$WORKSPACE_ID"
+  custom_host_without_workspace_id:
+    workspace:
+      host: $CUSTOM_HOST
+  custom_host_other_workspace:
+    workspace:
+      host: $CUSTOM_HOST/?o=2222222222
+  unknown_host:
+    workspace:
+      host: https://unknown.test
diff --git a/acceptance/bundle/strict_profile_match/host/out.test.toml b/acceptance/bundle/strict_profile_match/host/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/strict_profile_match/host/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/strict_profile_match/host/output.txt b/acceptance/bundle/strict_profile_match/host/output.txt
new file mode 100644
index 00000000000..6c3dcbeefab
--- /dev/null
+++ b/acceptance/bundle/strict_profile_match/host/output.txt
@@ -0,0 +1,68 @@
+
+=== Target classic matches one profile
+>>> errcode [CLI] bundle run -t classic show_auth
+profile=workspace_classic host=[DATABRICKS_URL] workspace_id=[WORKSPACE_ID]
+
+=== Target classic_with_workspace_id matches one profile
+>>> errcode [CLI] bundle run -t classic_with_workspace_id show_auth
+profile=workspace_classic_id host=[DATABRICKS_URL] workspace_id=[WORKSPACE_ID]
+
+=== Target custom_host matches one profile
+>>> errcode [CLI] bundle run -t custom_host show_auth
+profile=workspace_custom_host host=[CUSTOM_HOST] workspace_id=[WORKSPACE_ID]
+
+=== Target custom_host_workspace_id_field matches one profile
+>>> errcode [CLI] bundle run -t custom_host_workspace_id_field show_auth
+profile=workspace_custom_host host=[CUSTOM_HOST] workspace_id=[WORKSPACE_ID]
+
+=== Target classic_other_workspace is rejected
+>>> errcode [CLI] bundle validate -t classic_other_workspace
+Error: cannot resolve bundle auth configuration: resolve: strict profile matching: no profile for host [DATABRICKS_URL] has workspace_id 2222222222. Config: host=[DATABRICKS_URL], workspace_id=2222222222, config_file=[TEST_TMP_DIR]/.databrickscfg, databricks_cli_path=[CLI]. Env: DATABRICKS_CONFIG_FILE, DATABRICKS_CLI_PATH
+
+Name: strict-profile-match
+Target: classic_other_workspace
+Workspace:
+  Host: [DATABRICKS_URL]
+
+Found 1 error
+
+Exit code: 1
+
+=== Target custom_host_without_workspace_id is rejected
+>>> errcode [CLI] bundle validate -t custom_host_without_workspace_id
+Error: cannot resolve bundle auth configuration: resolve: strict profile matching: host [CUSTOM_HOST] requires a workspace ID; set workspace.workspace_id or add ?o=<workspace-id> to workspace.host. Config: host=[CUSTOM_HOST], config_file=[TEST_TMP_DIR]/.databrickscfg, databricks_cli_path=[CLI]. Env: DATABRICKS_CONFIG_FILE, DATABRICKS_CLI_PATH
+
+Name: strict-profile-match
+Target: custom_host_without_workspace_id
+Workspace:
+  Host: [CUSTOM_HOST]
+
+Found 1 error
+
+Exit code: 1
+
+=== Target custom_host_other_workspace is rejected
+>>> errcode [CLI] bundle validate -t custom_host_other_workspace
+Error: cannot resolve bundle auth configuration: resolve: strict profile matching: no profile for host [CUSTOM_HOST] has workspace_id 2222222222. Config: host=[CUSTOM_HOST], workspace_id=2222222222, config_file=[TEST_TMP_DIR]/.databrickscfg, databricks_cli_path=[CLI]. Env: DATABRICKS_CONFIG_FILE, DATABRICKS_CLI_PATH
+
+Name: strict-profile-match
+Target: custom_host_other_workspace
+Workspace:
+  Host: [CUSTOM_HOST]
+
+Found 1 error
+
+Exit code: 1
+
+=== Target unknown_host is rejected
+>>> errcode [CLI] bundle validate -t unknown_host
+Error: cannot resolve bundle auth configuration: resolve: strict profile matching: no workspace profile matches host https://unknown.test. Config: host=https://unknown.test, config_file=[TEST_TMP_DIR]/.databrickscfg, databricks_cli_path=[CLI]. Env: DATABRICKS_CONFIG_FILE, DATABRICKS_CLI_PATH
+
+Name: strict-profile-match
+Target: unknown_host
+Workspace:
+  Host: https://unknown.test
+
+Found 1 error
+
+Exit code: 1
diff --git a/acceptance/bundle/strict_profile_match/host/script b/acceptance/bundle/strict_profile_match/host/script
new file mode 100644
index 00000000000..1a5e32067eb
--- /dev/null
+++ b/acceptance/bundle/strict_profile_match/host/script
@@ -0,0 +1,9 @@
+for target in classic classic_with_workspace_id custom_host custom_host_workspace_id_field; do
+  title "Target $target matches one profile"
+  trace errcode $CLI bundle run -t $target show_auth
+done
+
+for target in classic_other_workspace custom_host_without_workspace_id custom_host_other_workspace unknown_host; do
+  title "Target $target is rejected"
+  trace errcode $CLI bundle validate -t $target
+done
diff --git a/acceptance/bundle/strict_profile_match/no_host/databricks.yml b/acceptance/bundle/strict_profile_match/no_host/databricks.yml
new file mode 100644
index 00000000000..c2ddb8ac686
--- /dev/null
+++ b/acceptance/bundle/strict_profile_match/no_host/databricks.yml
@@ -0,0 +1,15 @@
+bundle:
+  name: strict-profile-match
+
+include:
+  - scripts.yml
+
+targets:
+  no_host:
+    default: true
+  no_host_with_profile:
+    workspace:
+      profile: workspace_custom_host
+  no_host_with_workspace_id:
+    workspace:
+      workspace_id: "$WORKSPACE_ID"
diff --git a/acceptance/bundle/strict_profile_match/no_host/default.databrickscfg b/acceptance/bundle/strict_profile_match/no_host/default.databrickscfg
new file mode 100644
index 00000000000..74109863fed
--- /dev/null
+++ b/acceptance/bundle/strict_profile_match/no_host/default.databrickscfg
@@ -0,0 +1,9 @@
+[__settings__]
+default_profile = workspace_classic
+
+[workspace_classic]
+host = $CLASSIC_HOST
+
+[workspace_custom_host]
+host = $CUSTOM_HOST
+workspace_id = $WORKSPACE_ID
diff --git a/acceptance/bundle/strict_profile_match/no_host/out.test.toml b/acceptance/bundle/strict_profile_match/no_host/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/strict_profile_match/no_host/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/strict_profile_match/no_host/output.txt b/acceptance/bundle/strict_profile_match/no_host/output.txt
new file mode 100644
index 00000000000..087e9743cb1
--- /dev/null
+++ b/acceptance/bundle/strict_profile_match/no_host/output.txt
@@ -0,0 +1,42 @@
+
+=== A target without a host, workspace ID or profile resolves as without strict mode
+>>> errcode env DATABRICKS_HOST=[DATABRICKS_URL] [CLI] bundle run -t no_host show_auth
+profile= host=[DATABRICKS_URL] workspace_id=[WORKSPACE_ID]
+
+=== A target without a host uses the explicit profile
+>>> errcode [CLI] bundle run -t no_host -p workspace_custom_host show_auth
+profile=workspace_custom_host host=[CUSTOM_HOST] workspace_id=[WORKSPACE_ID]
+
+=== A target without a host uses workspace.profile
+>>> errcode [CLI] bundle run -t no_host_with_profile show_auth
+profile=workspace_custom_host host=[CUSTOM_HOST] workspace_id=[WORKSPACE_ID]
+
+=== A target without a host uses the default profile
+>>> errcode env DATABRICKS_CONFIG_FILE=[TEST_TMP_DIR]/default.databrickscfg [CLI] bundle run -t no_host show_auth
+profile=workspace_classic host=[DATABRICKS_URL] workspace_id=[WORKSPACE_ID]
+
+=== A target without a host accepts a profile with the target's workspace ID
+>>> errcode [CLI] bundle run -t no_host_with_workspace_id -p workspace_classic_id show_auth
+profile=workspace_classic_id host=[DATABRICKS_URL] workspace_id=[WORKSPACE_ID]
+
+=== A target without a host rejects a profile without the target's workspace ID
+>>> errcode env DATABRICKS_CONFIG_FILE=[TEST_TMP_DIR]/default.databrickscfg [CLI] bundle validate -t no_host_with_workspace_id
+Error: cannot resolve bundle auth configuration: resolve: strict profile matching: profile workspace_classic does not have workspace_id [WORKSPACE_ID]. Config: workspace_id=[WORKSPACE_ID], profile=workspace_classic, config_file=[TEST_TMP_DIR]/default.databrickscfg, databricks_cli_path=[CLI]. Env: DATABRICKS_CONFIG_FILE, DATABRICKS_CLI_PATH
+
+Name: strict-profile-match
+Target: no_host_with_workspace_id
+
+Found 1 error
+
+Exit code: 1
+
+=== A target without a host rejects an unknown profile
+>>> errcode [CLI] bundle validate -t no_host -p my-local-profile
+Error: cannot resolve bundle auth configuration: resolve: [TEST_TMP_DIR]/.databrickscfg has no my-local-profile profile configured. Config: profile=my-local-profile, config_file=[TEST_TMP_DIR]/.databrickscfg, databricks_cli_path=[CLI]. Env: DATABRICKS_CONFIG_FILE, DATABRICKS_CLI_PATH
+
+Name: strict-profile-match
+Target: no_host
+
+Found 1 error
+
+Exit code: 1
diff --git a/acceptance/bundle/strict_profile_match/no_host/script b/acceptance/bundle/strict_profile_match/no_host/script
new file mode 100644
index 00000000000..c6e351a83b0
--- /dev/null
+++ b/acceptance/bundle/strict_profile_match/no_host/script
@@ -0,0 +1,21 @@
+# A target without a host gets its host from a profile selected by name.
+title "A target without a host, workspace ID or profile resolves as without strict mode"
+trace errcode env DATABRICKS_HOST=$CLASSIC_HOST $CLI bundle run -t no_host show_auth
+
+title "A target without a host uses the explicit profile"
+trace errcode $CLI bundle run -t no_host -p workspace_custom_host show_auth
+
+title "A target without a host uses workspace.profile"
+trace errcode $CLI bundle run -t no_host_with_profile show_auth
+
+title "A target without a host uses the default profile"
+trace errcode env DATABRICKS_CONFIG_FILE=$TEST_TMP_DIR/default.databrickscfg $CLI bundle run -t no_host show_auth
+
+title "A target without a host accepts a profile with the target's workspace ID"
+trace errcode $CLI bundle run -t no_host_with_workspace_id -p workspace_classic_id show_auth
+
+title "A target without a host rejects a profile without the target's workspace ID"
+trace errcode env DATABRICKS_CONFIG_FILE=$TEST_TMP_DIR/default.databrickscfg $CLI bundle validate -t no_host_with_workspace_id
+
+title "A target without a host rejects an unknown profile"
+trace errcode $CLI bundle validate -t no_host -p my-local-profile
diff --git a/acceptance/bundle/strict_profile_match/profile/databricks.yml b/acceptance/bundle/strict_profile_match/profile/databricks.yml
new file mode 100644
index 00000000000..add5e199d45
--- /dev/null
+++ b/acceptance/bundle/strict_profile_match/profile/databricks.yml
@@ -0,0 +1,22 @@
+bundle:
+  name: strict-profile-match
+
+include:
+  - scripts.yml
+
+targets:
+  classic:
+    default: true
+    workspace:
+      host: $CLASSIC_HOST
+  classic_with_matching_profile:
+    workspace:
+      host: $CLASSIC_HOST
+      profile: workspace_classic
+  classic_with_profile:
+    workspace:
+      host: $CLASSIC_HOST
+      profile: my-local-profile
+  custom_host:
+    workspace:
+      host: $CUSTOM_HOST/?o=$WORKSPACE_ID
diff --git a/acceptance/bundle/strict_profile_match/profile/out.test.toml b/acceptance/bundle/strict_profile_match/profile/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/strict_profile_match/profile/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/strict_profile_match/profile/output.txt b/acceptance/bundle/strict_profile_match/profile/output.txt
new file mode 100644
index 00000000000..f73f8a1aa10
--- /dev/null
+++ b/acceptance/bundle/strict_profile_match/profile/output.txt
@@ -0,0 +1,42 @@
+
+=== A workspace.profile that matches the target is accepted
+>>> errcode [CLI] bundle run -t classic_with_matching_profile show_auth
+profile=workspace_classic host=[DATABRICKS_URL] workspace_id=[WORKSPACE_ID]
+
+=== A workspace.profile that doesn't match the target is rejected
+>>> errcode [CLI] bundle validate -t classic_with_profile
+Error: cannot resolve bundle auth configuration: resolve: strict profile matching: profile my-local-profile does not match profile workspace_classic selected for host [DATABRICKS_URL]. Config: host=[DATABRICKS_URL], profile=my-local-profile, config_file=[TEST_TMP_DIR]/.databrickscfg, databricks_cli_path=[CLI]. Env: DATABRICKS_CONFIG_FILE, DATABRICKS_CLI_PATH
+
+Name: strict-profile-match
+Target: classic_with_profile
+Workspace:
+  Host: [DATABRICKS_URL]
+
+Found 1 error
+
+Exit code: 1
+
+=== An explicit profile that matches the target is accepted
+>>> errcode [CLI] bundle run -t classic -p workspace_classic show_auth
+profile=workspace_classic host=[DATABRICKS_URL] workspace_id=[WORKSPACE_ID]
+
+=== An explicit profile that doesn't match the target is rejected
+>>> errcode [CLI] bundle validate -t classic -p workspace_classic_id
+Error: cannot resolve bundle auth configuration: resolve: strict profile matching: profile workspace_classic_id does not match profile workspace_classic selected for host [DATABRICKS_URL]. Config: host=[DATABRICKS_URL], profile=workspace_classic_id, config_file=[TEST_TMP_DIR]/.databrickscfg, databricks_cli_path=[CLI]. Env: DATABRICKS_CONFIG_FILE, DATABRICKS_CLI_PATH
+
+Name: strict-profile-match
+Target: classic
+Workspace:
+  Host: [DATABRICKS_URL]
+
+Found 1 error
+
+Exit code: 1
+
+=== An explicit profile wins over workspace.profile, as without strict mode
+>>> errcode [CLI] bundle run -t classic_with_profile -p workspace_classic show_auth
+profile=workspace_classic host=[DATABRICKS_URL] workspace_id=[WORKSPACE_ID]
+
+=== A CLI started from a bundle script uses the selected profile
+>>> errcode [CLI] bundle run -t custom_host nested_validate
+workspace_custom_host
diff --git a/acceptance/bundle/strict_profile_match/profile/script b/acceptance/bundle/strict_profile_match/profile/script
new file mode 100644
index 00000000000..1ba9d0ece26
--- /dev/null
+++ b/acceptance/bundle/strict_profile_match/profile/script
@@ -0,0 +1,17 @@
+title "A workspace.profile that matches the target is accepted"
+trace errcode $CLI bundle run -t classic_with_matching_profile show_auth
+
+title "A workspace.profile that doesn't match the target is rejected"
+trace errcode $CLI bundle validate -t classic_with_profile
+
+title "An explicit profile that matches the target is accepted"
+trace errcode $CLI bundle run -t classic -p workspace_classic show_auth
+
+title "An explicit profile that doesn't match the target is rejected"
+trace errcode $CLI bundle validate -t classic -p workspace_classic_id
+
+title "An explicit profile wins over workspace.profile, as without strict mode"
+trace errcode $CLI bundle run -t classic_with_profile -p workspace_classic show_auth
+
+title "A CLI started from a bundle script uses the selected profile"
+trace errcode $CLI bundle run -t custom_host nested_validate
diff --git a/acceptance/bundle/strict_profile_match/script.prepare b/acceptance/bundle/strict_profile_match/script.prepare
new file mode 100644
index 00000000000..c31a052f2c8
--- /dev/null
+++ b/acceptance/bundle/strict_profile_match/script.prepare
@@ -0,0 +1,45 @@
+# The test server is reachable as both 127.0.0.1 and localhost. The first stands
+# in for a host that serves one workspace, the second for a custom host shared
+# by several workspaces of an account.
+export CLASSIC_HOST=$DATABRICKS_HOST
+export CUSTOM_HOST=${DATABRICKS_HOST/127.0.0.1/localhost}
+add_repl "$CUSTOM_HOST" CUSTOM_HOST
+
+# The workspace ID that the test server reports for its workspace.
+export WORKSPACE_ID=$(curl -s "$DATABRICKS_HOST/.well-known/databricks-config" | jq -r .workspace_id)
+
+# Each profile allows one pair of host and workspace ID; the custom host has no
+# profile without a workspace ID. Tests that need other profiles have their own
+# config files.
+cat > .databrickscfg <<EOF
+[workspace_classic]
+host = $CLASSIC_HOST
+
+[workspace_classic_id]
+host = $CLASSIC_HOST
+workspace_id = $WORKSPACE_ID
+
+[workspace_custom_host]
+host = $CUSTOM_HOST
+workspace_id = $WORKSPACE_ID
+EOF
+
+# show_auth prints the auth that a bundle script receives, which shows the
+# selected profile. The file is not substituted, so bash expands $CLI.
+cat > scripts.yml <<'EOF'
+scripts:
+  show_auth:
+    content: echo "profile=$DATABRICKS_CONFIG_PROFILE host=$DATABRICKS_HOST workspace_id=$DATABRICKS_WORKSPACE_ID"
+  nested_validate:
+    content: $CLI bundle validate -o json | jq -r .workspace.profile
+EOF
+
+for f in databricks.yml *.databrickscfg; do
+  [ -f "$f" ] || continue
+  envsubst < "$f" > out && mv out "$f"
+done
+
+# Credentials come only from DATABRICKS_TOKEN.
+unset DATABRICKS_HOST
+export DATABRICKS_CONFIG_FILE=$TEST_TMP_DIR/.databrickscfg
+export DATABRICKS_BUNDLE_STRICT_PROFILE_MATCH=1
diff --git a/acceptance/bundle/strict_profile_match/test.toml b/acceptance/bundle/strict_profile_match/test.toml
new file mode 100644
index 00000000000..1b57908b531
--- /dev/null
+++ b/acceptance/bundle/strict_profile_match/test.toml
@@ -0,0 +1,2 @@
+# Written by script.prepare.
+Ignore = [".databrickscfg", "scripts.yml"]
diff --git a/acceptance/bundle/summary/engine-terraform/databricks.yml b/acceptance/bundle/summary/engine-terraform/databricks.yml
new file mode 100644
index 00000000000..06f4c135b48
--- /dev/null
+++ b/acceptance/bundle/summary/engine-terraform/databricks.yml
@@ -0,0 +1,8 @@
+bundle:
+  name: test-bundle
+  engine: terraform
+
+resources:
+  jobs:
+    my_job:
+      name: my job
diff --git a/acceptance/bundle/summary/engine-terraform/out.test.toml b/acceptance/bundle/summary/engine-terraform/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/summary/engine-terraform/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/summary/engine-terraform/output.txt b/acceptance/bundle/summary/engine-terraform/output.txt
new file mode 100644
index 00000000000..815ccf11750
--- /dev/null
+++ b/acceptance/bundle/summary/engine-terraform/output.txt
@@ -0,0 +1,90 @@
+
+>>> [CLI] bundle summary
+Warning: the Terraform deployment engine has been removed in Databricks CLI v1.20.0
+  in databricks.yml:3:11
+
+Remove the "bundle.engine" setting (or set it to "direct") to deploy with the direct engine; existing Terraform state is migrated automatically. To keep using Terraform, revert to Databricks CLI v1.19.x.
+See https://docs.databricks.com/dev-tools/bundles/direct for details
+
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+Resources:
+  Jobs:
+    my_job:
+      Name: my job
+      URL:  (not deployed)
+
+>>> [CLI] bundle summary -o json
+Warning: the Terraform deployment engine has been removed in Databricks CLI v1.20.0
+  in databricks.yml:3:11
+
+Remove the "bundle.engine" setting (or set it to "direct") to deploy with the direct engine; existing Terraform state is migrated automatically. To keep using Terraform, revert to Databricks CLI v1.19.x.
+See https://docs.databricks.com/dev-tools/bundles/direct for details
+
+"terraform"
+
+>>> musterr [CLI] bundle validate
+Error: the Terraform deployment engine has been removed in Databricks CLI v1.20.0
+  in databricks.yml:3:11
+
+Remove the "bundle.engine" setting (or set it to "direct") to deploy with the direct engine; existing Terraform state is migrated automatically. To keep using Terraform, revert to Databricks CLI v1.19.x.
+See https://docs.databricks.com/dev-tools/bundles/direct for details
+
+Name: test-bundle
+Target: default
+
+Found 1 error
+
+>>> musterr [CLI] bundle validate -o json
+Error: the Terraform deployment engine has been removed in Databricks CLI v1.20.0
+  in databricks.yml:3:11
+
+Remove the "bundle.engine" setting (or set it to "direct") to deploy with the direct engine; existing Terraform state is migrated automatically. To keep using Terraform, revert to Databricks CLI v1.19.x.
+See https://docs.databricks.com/dev-tools/bundles/direct for details
+
+{
+  "engine": "terraform",
+  "environment": "default",
+  "name": "test-bundle",
+  "target": "default"
+}
+
+>>> update_file.py databricks.yml   engine: terraform 
+
+>>> [CLI] bundle summary
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+Resources:
+  Jobs:
+    my_job:
+      Name: my job
+      URL:  (not deployed)
+
+>>> musterr [CLI] bundle validate
+Error: the Terraform deployment engine has been removed in Databricks CLI v1.20.0
+
+Unset the DATABRICKS_BUNDLE_ENGINE environment variable (or set it to "direct") to deploy with the direct engine; existing Terraform state is migrated automatically. To keep using Terraform, revert to Databricks CLI v1.19.x.
+See https://docs.databricks.com/dev-tools/bundles/direct for details
+
+Name: test-bundle
+Target: default
+
+Found 1 error
+
+>>> musterr [CLI] bundle validate -o json
+Error: the Terraform deployment engine has been removed in Databricks CLI v1.20.0
+
+Unset the DATABRICKS_BUNDLE_ENGINE environment variable (or set it to "direct") to deploy with the direct engine; existing Terraform state is migrated automatically. To keep using Terraform, revert to Databricks CLI v1.19.x.
+See https://docs.databricks.com/dev-tools/bundles/direct for details
+
+{
+  "environment": "default",
+  "name": "test-bundle",
+  "target": "default"
+}
diff --git a/acceptance/bundle/summary/engine-terraform/script b/acceptance/bundle/summary/engine-terraform/script
new file mode 100644
index 00000000000..bf03d3b291e
--- /dev/null
+++ b/acceptance/bundle/summary/engine-terraform/script
@@ -0,0 +1,11 @@
+trace $CLI bundle summary
+trace $CLI bundle summary -o json | jq .bundle.engine
+# Other commands still reject engine: terraform.
+trace musterr $CLI bundle validate
+trace musterr $CLI bundle validate -o json | jq .bundle
+
+# The env var is not checked by summary (bundle.engine is removed first, since it takes priority over the env var).
+trace update_file.py databricks.yml "  engine: terraform" ""
+DATABRICKS_BUNDLE_ENGINE=terraform trace $CLI bundle summary
+DATABRICKS_BUNDLE_ENGINE=terraform trace musterr $CLI bundle validate
+DATABRICKS_BUNDLE_ENGINE=terraform trace musterr $CLI bundle validate -o json | jq .bundle
diff --git a/acceptance/bundle/summary/missing-libraries-file-path/out.test.toml b/acceptance/bundle/summary/missing-libraries-file-path/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/summary/missing-libraries-file-path/out.test.toml
+++ b/acceptance/bundle/summary/missing-libraries-file-path/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/summary/modified_status/out.test.toml b/acceptance/bundle/summary/modified_status/out.test.toml
index 7f4e2c0ca80..81fed133e17 100644
--- a/acceptance/bundle/summary/modified_status/out.test.toml
+++ b/acceptance/bundle/summary/modified_status/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
 EnvMatrix.VARIANT = ["empty_resources.yml", "no_resources.yml"]
diff --git a/acceptance/bundle/summary/modified_status/output.txt b/acceptance/bundle/summary/modified_status/output.txt
index 82bc66bf9f1..59d922c8b85 100644
--- a/acceptance/bundle/summary/modified_status/output.txt
+++ b/acceptance/bundle/summary/modified_status/output.txt
@@ -69,9 +69,12 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created alerts.my_alert
+Created pipelines.my_pipeline
+Created schemas.my_schema
+Created sql_warehouses.my_sql_warehouse
+Files: 4 uploaded, 0 deleted
+Resources: 4 created, 0 changed, 0 deleted, 0 unchanged
 
 === Post-deployment view of resources with id and without modified_status
 >>> [CLI] bundle summary -o json
@@ -97,7 +100,7 @@ Deployment complete!
         "quartz_cron_schedule": "44 19 */1 * * ?",
         "timezone_id": "Europe/Amsterdam"
       },
-      "url": "[DATABRICKS_URL]/sql/alerts-v2/[UUID]?o=[NUMID]",
+      "url": "[DATABRICKS_URL]/sql/alerts-v2/[UUID]?w=[WORKSPACE_ID]",
       "warehouse_id": "aaaaaaaaaaaaaaaa"
     }
   },
@@ -118,7 +121,7 @@ Deployment complete!
         }
       ],
       "name": "test-pipeline",
-      "url": "[DATABRICKS_URL]/pipelines/[UUID]?o=[NUMID]"
+      "url": "[DATABRICKS_URL]/pipelines/[UUID]?w=[WORKSPACE_ID]"
     }
   },
   "schemas": {
@@ -127,7 +130,7 @@ Deployment complete!
       "comment": "COMMENT1",
       "id": "main.test-schema",
       "name": "test-schema",
-      "url": "[DATABRICKS_URL]/explore/data/main/test-schema?o=[NUMID]"
+      "url": "[DATABRICKS_URL]/explore/data/main/test-schema?w=[WORKSPACE_ID]"
     }
   },
   "sql_warehouses": {
@@ -140,7 +143,7 @@ Deployment complete!
       "max_num_clusters": 1,
       "name": "test-sql-warehouse",
       "spot_instance_policy": "COST_OPTIMIZED",
-      "url": "[DATABRICKS_URL]/sql/warehouses/[UUID]?o=[NUMID]"
+      "url": "[DATABRICKS_URL]/sql/warehouses/[UUID]?w=[WORKSPACE_ID]"
     }
   }
 }
@@ -152,28 +155,28 @@ Deployment complete!
     "my_alert": {
       "id": "[UUID]",
       "modified_status": "deleted",
-      "url": "[DATABRICKS_URL]/sql/alerts-v2/[UUID]?o=[NUMID]"
+      "url": "[DATABRICKS_URL]/sql/alerts-v2/[UUID]?w=[WORKSPACE_ID]"
     }
   },
   "pipelines": {
     "my_pipeline": {
       "id": "[UUID]",
       "modified_status": "deleted",
-      "url": "[DATABRICKS_URL]/pipelines/[UUID]?o=[NUMID]"
+      "url": "[DATABRICKS_URL]/pipelines/[UUID]?w=[WORKSPACE_ID]"
     }
   },
   "schemas": {
     "my_schema": {
       "id": "main.test-schema",
       "modified_status": "deleted",
-      "url": "[DATABRICKS_URL]/explore/data/main/test-schema?o=[NUMID]"
+      "url": "[DATABRICKS_URL]/explore/data/main/test-schema?w=[WORKSPACE_ID]"
     }
   },
   "sql_warehouses": {
     "my_sql_warehouse": {
       "id": "[UUID]",
       "modified_status": "deleted",
-      "url": "[DATABRICKS_URL]/sql/warehouses/[UUID]?o=[NUMID]"
+      "url": "[DATABRICKS_URL]/sql/warehouses/[UUID]?w=[WORKSPACE_ID]"
     }
   }
 }
@@ -189,13 +192,12 @@ This action will result in the deletion of the following UC schemas. Any underly
   delete resources.schemas.my_schema
 
 This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
-Streaming Tables (STs) and Materialized Views (MVs) managed by them:
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:
   delete resources.pipelines.my_pipeline
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 4 deleted
 
 >>> [CLI] bundle summary -o json
 {}
diff --git a/acceptance/bundle/summary/modified_status/script b/acceptance/bundle/summary/modified_status/script
index 4da723c08eb..22149b2c76b 100644
--- a/acceptance/bundle/summary/modified_status/script
+++ b/acceptance/bundle/summary/modified_status/script
@@ -1,14 +1,14 @@
 title "Initial view of resources without id and modified_status=created"
-trace $CLI bundle summary -o json | jq .resources
+trace $CLI bundle summary -o json | nostamp | jq .resources
 
 trace $CLI bundle deploy
 
 title "Post-deployment view of resources with id and without modified_status"
-trace $CLI bundle summary -o json | jq .resources
+trace $CLI bundle summary -o json | nostamp | jq .resources
 mv $VARIANT databricks.yml
 
 title "Expecting all resources to have modified_status=deleted"
-trace $CLI bundle summary -o json | jq .resources
+trace $CLI bundle summary -o json | nostamp | jq .resources
 
 trace $CLI bundle destroy --auto-approve
-trace $CLI bundle summary -o json | jq .resources
+trace $CLI bundle summary -o json | nostamp | jq .resources
diff --git a/acceptance/bundle/summary/show-full-config/databricks.yml b/acceptance/bundle/summary/show-full-config/databricks.yml
deleted file mode 100644
index 08ac0519c7c..00000000000
--- a/acceptance/bundle/summary/show-full-config/databricks.yml
+++ /dev/null
@@ -1,19 +0,0 @@
-bundle:
-  name: test-bundle
-
-include:
-  - targets/*.yml
-  - resources/*.yml
-
-variables:
-  mode:
-    default: development
-  default:
-    default: false
-
-targets:
-  also_default:
-    mode: development
-    default: true
-    workspace:
-      host: https://example.com
diff --git a/acceptance/bundle/summary/show-full-config/out.test.toml b/acceptance/bundle/summary/show-full-config/out.test.toml
deleted file mode 100644
index f784a183258..00000000000
--- a/acceptance/bundle/summary/show-full-config/out.test.toml
+++ /dev/null
@@ -1,3 +0,0 @@
-Local = true
-Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/bundle/summary/show-full-config/output.txt b/acceptance/bundle/summary/show-full-config/output.txt
deleted file mode 100644
index 81654d82306..00000000000
--- a/acceptance/bundle/summary/show-full-config/output.txt
+++ /dev/null
@@ -1,135 +0,0 @@
-
->>> [CLI] bundle summary --show-full-config --include-locations
-{
-  "__locations": {
-    "files": [
-      "databricks.yml",
-      "resources/my_dashboard.dashboard.yml",
-      "targets/default.yml",
-      "targets/not_default.yml",
-      "targets/variable_default.yml",
-      "targets/variable_mode.yml"
-    ],
-    "locations": {
-      "bundle": [
-        [
-          0,
-          2,
-          3
-        ]
-      ],
-      "include": [
-        [
-          0,
-          5,
-          3
-        ]
-      ],
-      "resources": [
-        [
-          1,
-          2,
-          3
-        ]
-      ],
-      "resources.dashboards": [
-        [
-          1,
-          3,
-          5
-        ]
-      ],
-      "resources.dashboards.my_dashboard": [
-        [
-          1,
-          4,
-          7
-        ]
-      ],
-      "targets": [
-        [
-          0,
-          15,
-          3
-        ],
-        [
-          2,
-          2,
-          3
-        ],
-        [
-          3,
-          2,
-          3
-        ],
-        [
-          4,
-          2,
-          3
-        ],
-        [
-          5,
-          2,
-          3
-        ]
-      ],
-      "variables": [
-        [
-          0,
-          9,
-          3
-        ]
-      ]
-    },
-    "version": 1
-  },
-  "bundle": {
-    "name": "test-bundle"
-  },
-  "include": [
-    "targets/default.yml",
-    "targets/not_default.yml",
-    "targets/variable_default.yml",
-    "targets/variable_mode.yml",
-    "resources/my_dashboard.dashboard.yml"
-  ],
-  "resources": {
-    "dashboards": {
-      "my_dashboard": {
-        "display_name": "My Dashboard",
-        "file_path": "../src/my_dashboard.lvdash.json",
-        "warehouse_id": "[NUMID]abcdef"
-      }
-    }
-  },
-  "targets": {
-    "also_default": {
-      "default": true,
-      "mode": "development",
-      "workspace": {
-        "host": "https://example.com"
-      }
-    },
-    "default": {
-      "default": true,
-      "mode": "development"
-    },
-    "not_default": {
-      "mode": "production"
-    },
-    "variable_default": {
-      "default": "${var.default}"
-    },
-    "variable_mode": {
-      "mode": "${var.mode}"
-    }
-  },
-  "variables": {
-    "default": {
-      "default": false
-    },
-    "mode": {
-      "default": "development"
-    }
-  }
-}
diff --git a/acceptance/bundle/summary/show-full-config/resources/my_dashboard.dashboard.yml b/acceptance/bundle/summary/show-full-config/resources/my_dashboard.dashboard.yml
deleted file mode 100644
index 07ff8d8f75e..00000000000
--- a/acceptance/bundle/summary/show-full-config/resources/my_dashboard.dashboard.yml
+++ /dev/null
@@ -1,6 +0,0 @@
-resources:
-  dashboards:
-    my_dashboard:
-      display_name: My Dashboard
-      file_path: ../src/my_dashboard.lvdash.json
-      warehouse_id: 1234567890abcdef
diff --git a/acceptance/bundle/summary/show-full-config/script b/acceptance/bundle/summary/show-full-config/script
deleted file mode 100644
index eccfb0544cb..00000000000
--- a/acceptance/bundle/summary/show-full-config/script
+++ /dev/null
@@ -1 +0,0 @@
-trace $CLI bundle summary --show-full-config --include-locations
diff --git a/acceptance/bundle/summary/show-full-config/targets/default.yml b/acceptance/bundle/summary/show-full-config/targets/default.yml
deleted file mode 100644
index 7dd22abd892..00000000000
--- a/acceptance/bundle/summary/show-full-config/targets/default.yml
+++ /dev/null
@@ -1,4 +0,0 @@
-targets:
-  default:
-    mode: development
-    default: true
diff --git a/acceptance/bundle/summary/show-full-config/targets/not_default.yml b/acceptance/bundle/summary/show-full-config/targets/not_default.yml
deleted file mode 100644
index 44f4a59fabc..00000000000
--- a/acceptance/bundle/summary/show-full-config/targets/not_default.yml
+++ /dev/null
@@ -1,3 +0,0 @@
-targets:
-  not_default:
-    mode: production
diff --git a/acceptance/bundle/summary/show-full-config/targets/variable_default.yml b/acceptance/bundle/summary/show-full-config/targets/variable_default.yml
deleted file mode 100644
index 3b086d8bfb1..00000000000
--- a/acceptance/bundle/summary/show-full-config/targets/variable_default.yml
+++ /dev/null
@@ -1,3 +0,0 @@
-targets:
-  variable_default:
-    default: ${var.default}
diff --git a/acceptance/bundle/summary/show-full-config/targets/variable_mode.yml b/acceptance/bundle/summary/show-full-config/targets/variable_mode.yml
deleted file mode 100644
index 2d0339c4b11..00000000000
--- a/acceptance/bundle/summary/show-full-config/targets/variable_mode.yml
+++ /dev/null
@@ -1,3 +0,0 @@
-targets:
-  variable_mode:
-    mode: ${var.mode}
diff --git a/acceptance/bundle/summary/show-full-config/test.toml b/acceptance/bundle/summary/show-full-config/test.toml
deleted file mode 100644
index 9cf9b33ecab..00000000000
--- a/acceptance/bundle/summary/show-full-config/test.toml
+++ /dev/null
@@ -1,3 +0,0 @@
-[[Repls]]
-Old = '\\\\'
-New = '/'
diff --git a/acceptance/bundle/sync-default-output/databricks.yml b/acceptance/bundle/sync-default-output/databricks.yml
new file mode 100644
index 00000000000..576d7a9ef25
--- /dev/null
+++ b/acceptance/bundle/sync-default-output/databricks.yml
@@ -0,0 +1,2 @@
+bundle:
+  name: test-bundle
diff --git a/acceptance/bundle/sync-default-output/out.test.toml b/acceptance/bundle/sync-default-output/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/sync-default-output/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/sync-default-output/output.txt b/acceptance/bundle/sync-default-output/output.txt
new file mode 100644
index 00000000000..1f6908b8f09
--- /dev/null
+++ b/acceptance/bundle/sync-default-output/output.txt
@@ -0,0 +1,9 @@
+
+>>> [CLI] bundle sync
+Action: PUT: .gitignore, databricks.yml, project-folder/app.py, project-folder/query.sql
+Initial Sync Complete
+Uploaded .gitignore
+Uploaded databricks.yml
+Uploaded project-folder
+Uploaded project-folder/app.py
+Uploaded project-folder/query.sql
diff --git a/acceptance/bundle/sync-default-output/script b/acceptance/bundle/sync-default-output/script
new file mode 100644
index 00000000000..a8acd192699
--- /dev/null
+++ b/acceptance/bundle/sync-default-output/script
@@ -0,0 +1,15 @@
+mkdir "project-folder"
+touch "project-folder/app.py" "project-folder/query.sql"
+cat > .gitignore << EOF
+output.txt
+EOF
+
+cleanup() {
+  rm .gitignore
+  rm -rf project-folder .git .databricks
+}
+trap cleanup EXIT
+
+# bundle sync installs a text output handler by default (no --output flag),
+# matching the standalone sync command. See issue #6499.
+trace $CLI bundle sync | sort
diff --git a/acceptance/bundle/sync-upload-edge-cases/databricks.yml b/acceptance/bundle/sync-upload-edge-cases/databricks.yml
new file mode 100644
index 00000000000..2261ff177c7
--- /dev/null
+++ b/acceptance/bundle/sync-upload-edge-cases/databricks.yml
@@ -0,0 +1,2 @@
+bundle:
+  name: upload-edge-cases
diff --git a/acceptance/bundle/sync-upload-edge-cases/ipyNb.ipynb b/acceptance/bundle/sync-upload-edge-cases/ipyNb.ipynb
new file mode 100644
index 00000000000..d2d581029fb
--- /dev/null
+++ b/acceptance/bundle/sync-upload-edge-cases/ipyNb.ipynb
@@ -0,0 +1,35 @@
+{
+ "cells": [
+  {
+   "cell_type": "code",
+   "execution_count": 0,
+   "metadata": {
+    "application/vnd.databricks.v1+cell": {
+     "cellMetadata": {},
+     "inputWidgets": {},
+     "nuid": "05030541-8399-4226-a499-f11b4910888c",
+     "showTitle": false,
+     "title": ""
+    }
+   },
+   "outputs": [],
+   "source": [
+    "# Hello world!"
+   ]
+  }
+ ],
+ "metadata": {
+  "application/vnd.databricks.v1+notebook": {
+   "dashboards": [],
+   "language": "python",
+   "notebookMetadata": {
+    "pythonIndentUnit": 2
+   },
+   "notebookName": "py_ipynb",
+   "notebookOrigID": 4221142147066610,
+   "widgets": {}
+  }
+ },
+ "nbformat": 4,
+ "nbformat_minor": 0
+}
diff --git a/acceptance/bundle/sync-upload-edge-cases/out.test.toml b/acceptance/bundle/sync-upload-edge-cases/out.test.toml
new file mode 100644
index 00000000000..59b56a2037c
--- /dev/null
+++ b/acceptance/bundle/sync-upload-edge-cases/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/sync-upload-edge-cases/output.txt b/acceptance/bundle/sync-upload-edge-cases/output.txt
new file mode 100644
index 00000000000..9cda650785a
--- /dev/null
+++ b/acceptance/bundle/sync-upload-edge-cases/output.txt
@@ -0,0 +1,194 @@
+
+>>> [CLI] bundle sync --output text
+Action: PUT: .gitignore, archive.zip, dashboard.lvdash.json, databricks.yml, empty.txt, héllo.txt, ipyNb.ipynb, job.dbjob.json, large.bin, plain-script.py, pyNb.py, query.lwquery.ipynb, scalaNb.scala, space.geniespace.json, sqlNb.sql, with spaces.txt
+Initial Sync Complete
+Uploaded .gitignore
+Uploaded archive.zip
+Uploaded dashboard.lvdash.json
+Uploaded databricks.yml
+Uploaded empty.txt
+Uploaded héllo.txt
+Uploaded ipyNb.ipynb
+Uploaded job.dbjob.json
+Uploaded large.bin
+Uploaded plain-script.py
+Uploaded pyNb.py
+Uploaded query.lwquery.ipynb
+Uploaded scalaNb.scala
+Uploaded space.geniespace.json
+Uploaded sqlNb.sql
+Uploaded with spaces.txt
+
+=== workspace state after sync — assert object_type and language for each upload
+>>> MSYS_NO_PATHCONV=1 [CLI] workspace list -o json /Workspace/Users/[USERNAME]/.bundle/upload-edge-cases/default/files
+{
+  "name": ".gitignore",
+  "object_type": "FILE",
+  "language": null
+}
+{
+  "name": "archive.zip",
+  "object_type": "FILE",
+  "language": null
+}
+{
+  "name": "dashboard.lvdash.json",
+  "object_type": "FILE",
+  "language": null
+}
+{
+  "name": "databricks.yml",
+  "object_type": "FILE",
+  "language": null
+}
+{
+  "name": "empty.txt",
+  "object_type": "FILE",
+  "language": null
+}
+{
+  "name": "héllo.txt",
+  "object_type": "FILE",
+  "language": null
+}
+{
+  "name": "ipyNb",
+  "object_type": "NOTEBOOK",
+  "language": "PYTHON"
+}
+{
+  "name": "job.dbjob.json",
+  "object_type": "FILE",
+  "language": null
+}
+{
+  "name": "large.bin",
+  "object_type": "FILE",
+  "language": null
+}
+{
+  "name": "plain-script.py",
+  "object_type": "FILE",
+  "language": null
+}
+{
+  "name": "pyNb",
+  "object_type": "NOTEBOOK",
+  "language": "PYTHON"
+}
+{
+  "name": "query.lwquery",
+  "object_type": "NOTEBOOK",
+  "language": "PYTHON"
+}
+{
+  "name": "scalaNb",
+  "object_type": "NOTEBOOK",
+  "language": "SCALA"
+}
+{
+  "name": "space.geniespace.json",
+  "object_type": "FILE",
+  "language": null
+}
+{
+  "name": "sqlNb",
+  "object_type": "NOTEBOOK",
+  "language": "SQL"
+}
+{
+  "name": "with spaces.txt",
+  "object_type": "FILE",
+  "language": null
+}
+
+=== the .zip is uploaded with the legacy import-file endpoint
+>>> print_requests.py //workspace-files/import-file --del-field raw_body --keep
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/upload-edge-cases/default/files/archive.zip",
+  "q": {
+    "overwrite": "true"
+  }
+}
+
+=== uploaded paths from each multipart POST /workspace/import (sorted)
+>>> print_workspace_imports
+/Workspace/Users/[USERNAME]/.bundle/upload-edge-cases/default/files/.gitignore
+/Workspace/Users/[USERNAME]/.bundle/upload-edge-cases/default/files/dashboard.lvdash.json
+/Workspace/Users/[USERNAME]/.bundle/upload-edge-cases/default/files/databricks.yml
+/Workspace/Users/[USERNAME]/.bundle/upload-edge-cases/default/files/empty.txt
+/Workspace/Users/[USERNAME]/.bundle/upload-edge-cases/default/files/héllo.txt
+/Workspace/Users/[USERNAME]/.bundle/upload-edge-cases/default/files/ipyNb
+/Workspace/Users/[USERNAME]/.bundle/upload-edge-cases/default/files/job.dbjob.json
+/Workspace/Users/[USERNAME]/.bundle/upload-edge-cases/default/files/large.bin
+/Workspace/Users/[USERNAME]/.bundle/upload-edge-cases/default/files/plain-script.py
+/Workspace/Users/[USERNAME]/.bundle/upload-edge-cases/default/files/pyNb
+/Workspace/Users/[USERNAME]/.bundle/upload-edge-cases/default/files/query.lwquery
+/Workspace/Users/[USERNAME]/.bundle/upload-edge-cases/default/files/scalaNb
+/Workspace/Users/[USERNAME]/.bundle/upload-edge-cases/default/files/space.geniespace.json
+/Workspace/Users/[USERNAME]/.bundle/upload-edge-cases/default/files/sqlNb
+/Workspace/Users/[USERNAME]/.bundle/upload-edge-cases/default/files/with spaces.txt
+
+=== format per upload: SOURCE/JUPYTER for notebooks, AUTO for dashboards, RAW for everything else
+>>> jq -rs 
+  map(select(.path == "/api/2.0/workspace/import")) |
+  map(select(.body.multipart_form.path | test("/files/"))) |
+  map({name: (.body.multipart_form.path | sub(".*/"; "")), format: .body.multipart_form.format}) |
+  sort_by(.name) | .[] | "\(.format) \(.name)"
+ [OUTPUT_DIR]/out.requests.txt
+RAW .gitignore
+AUTO dashboard.lvdash.json
+RAW databricks.yml
+RAW empty.txt
+RAW héllo.txt
+JUPYTER ipyNb
+RAW job.dbjob.json
+RAW large.bin
+RAW plain-script.py
+SOURCE pyNb
+JUPYTER query.lwquery
+SOURCE scalaNb
+RAW space.geniespace.json
+SOURCE sqlNb
+RAW with spaces.txt
+
+=== recorded content for the small text inputs
+>>> jq -rs 
+  map(select(.path == "/api/2.0/workspace/import")) |
+  map(select(.body.multipart_form.path | test("/(pyNb|sqlNb|scalaNb|plain-script\\.py|héllo\\.txt|with spaces\\.txt|empty\\.txt|dashboard\\.lvdash\\.json)$"))) |
+  map({path: (.body.multipart_form.path | sub(".*/"; "")), content: .body.multipart_form.content}) |
+  sort_by(.path) | .[]
+ [OUTPUT_DIR]/out.requests.txt
+{
+  "path": "dashboard.lvdash.json",
+  "content": "{\"datasets\":[],\"pages\":[]}\n"
+}
+{
+  "path": "empty.txt",
+  "content": ""
+}
+{
+  "path": "héllo.txt",
+  "content": "hello, naïve world\n"
+}
+{
+  "path": "plain-script.py",
+  "content": "print(\"plain script, no header\")\n"
+}
+{
+  "path": "pyNb",
+  "content": "# Databricks notebook source\nprint(\"hello\")\n"
+}
+{
+  "path": "scalaNb",
+  "content": "// Databricks notebook source\nprintln(\"hello\")\n"
+}
+{
+  "path": "sqlNb",
+  "content": "-- Databricks notebook source\nSELECT 1\n"
+}
+{
+  "path": "with spaces.txt",
+  "content": "hello, world\n"
+}
diff --git a/acceptance/bundle/sync-upload-edge-cases/query.lwquery.ipynb b/acceptance/bundle/sync-upload-edge-cases/query.lwquery.ipynb
new file mode 100644
index 00000000000..d2d581029fb
--- /dev/null
+++ b/acceptance/bundle/sync-upload-edge-cases/query.lwquery.ipynb
@@ -0,0 +1,35 @@
+{
+ "cells": [
+  {
+   "cell_type": "code",
+   "execution_count": 0,
+   "metadata": {
+    "application/vnd.databricks.v1+cell": {
+     "cellMetadata": {},
+     "inputWidgets": {},
+     "nuid": "05030541-8399-4226-a499-f11b4910888c",
+     "showTitle": false,
+     "title": ""
+    }
+   },
+   "outputs": [],
+   "source": [
+    "# Hello world!"
+   ]
+  }
+ ],
+ "metadata": {
+  "application/vnd.databricks.v1+notebook": {
+   "dashboards": [],
+   "language": "python",
+   "notebookMetadata": {
+    "pythonIndentUnit": 2
+   },
+   "notebookName": "py_ipynb",
+   "notebookOrigID": 4221142147066610,
+   "widgets": {}
+  }
+ },
+ "nbformat": 4,
+ "nbformat_minor": 0
+}
diff --git a/acceptance/bundle/sync-upload-edge-cases/script b/acceptance/bundle/sync-upload-edge-cases/script
new file mode 100644
index 00000000000..77c6708d27f
--- /dev/null
+++ b/acceptance/bundle/sync-upload-edge-cases/script
@@ -0,0 +1,112 @@
+# Confidence checks that /workspace/import is a drop-in for the legacy import-file:
+# verify the CLI's multipart upload pipeline handles the cases that differ between the
+# two endpoints — large content (>10 MB), empty content, varied extensions/object types,
+# and non-ASCII / spaced filenames in the multipart `path` field.
+
+# Exclude framework-generated and script-internal files from the sync. We only want the
+# inputs we explicitly generate below to show up in the recorded uploads.
+cat > .gitignore <<'EOF'
+script
+output.txt
+out.requests.txt
+repls.json
+test.toml
+.databricks
+EOF
+
+# 12 MiB binary file, over the 10 MB cap on the JSON-body variant's base64 `content`
+# field. The multipart variant this test exercises has no such cap. Generated
+# dynamically to keep the repo small.
+python3 -c "open('large.bin', 'wb').write(b'\\0' * (12 * 1024 * 1024))"
+
+# Empty file (multipart encodes an empty `content` part — distinct from JSON's empty string).
+touch empty.txt
+
+# Python notebook: the CLI detects the header and imports it with format=SOURCE at the
+# path with .py stripped.
+cat > pyNb.py <<'EOF'
+# Databricks notebook source
+print("hello")
+EOF
+
+# SQL notebook: -- comment header, .sql extension, Language=SQL on the workspace side.
+cat > sqlNb.sql <<'EOF'
+-- Databricks notebook source
+SELECT 1
+EOF
+
+# Scala notebook: // comment header, .scala extension, Language=SCALA.
+cat > scalaNb.scala <<'EOF'
+// Databricks notebook source
+println("hello")
+EOF
+
+# ipyNb.ipynb and query.lwquery.ipynb are committed Jupyter notebooks. The second name
+# ends in a suffix /workspace/import reserves for another asset type; it must still
+# import as a notebook.
+
+# Plain .py without the source header — should land as FILE, not NOTEBOOK,
+# even though the extension is .py.
+cat > plain-script.py <<'EOF'
+print("plain script, no header")
+EOF
+
+# Lakeview dashboard descriptor: uploaded with format=AUTO, which the real /workspace/import
+# imports as object_type=DASHBOARD and preserves the .lvdash.json extension. The testserver
+# doesn't emulate that and stores it as a generic FILE — but the upload-side request shape
+# (which is what this test asserts) is identical.
+echo '{"datasets":[],"pages":[]}' > dashboard.lvdash.json
+
+# Names format=AUTO would map to asset types /workspace/import cannot create
+# ("Requested node type [UNKNOWN] is not supported"). They must still sync as files.
+echo '{}' > space.geniespace.json
+echo '{}' > job.dbjob.json
+
+# A .zip goes through the legacy import-file endpoint, which extracts it into its parent
+# directory (inner.txt next to the archive). The testserver doesn't emulate that and stores
+# the archive as a FILE. /workspace/import would instead create a folder at the archive's
+# path that cannot be overwritten on the next sync.
+python3 -c "import zipfile; zipfile.ZipFile('archive.zip', 'w').writestr('inner.txt', 'hello')"
+
+# Non-ASCII filename. Multipart encodes filenames with RFC 5987 / quoted-string rules,
+# distinct from URL-encoding in the legacy import-file endpoint.
+echo "hello, naïve world" > "héllo.txt"
+
+# Filename with a space.
+echo "hello, world" > "with spaces.txt"
+
+trace $CLI bundle sync --output text 2>&1 | sort
+
+title "workspace state after sync — assert object_type and language for each upload"
+remote_files=$($CLI bundle summary -o json 2>/dev/null | jq -r .workspace.file_path)
+# MSYS_NO_PATHCONV stops Git Bash on Windows from rewriting the leading-slash
+# workspace path into a C:/Program Files/... filesystem path before it
+# reaches the CLI.
+trace MSYS_NO_PATHCONV=1 $CLI workspace list -o json "$remote_files" |
+  jq 'sort_by(.path) | .[] | {name: (.path | sub(".*/"; "")), object_type, language}'
+
+title "the .zip is uploaded with the legacy import-file endpoint"
+trace print_requests.py //workspace-files/import-file --del-field raw_body --keep
+
+title "uploaded paths from each multipart POST /workspace/import (sorted)"
+trace print_workspace_imports | sort
+
+title "format per upload: SOURCE/JUPYTER for notebooks, AUTO for dashboards, RAW for everything else"
+trace jq -rs '
+  map(select(.path == "/api/2.0/workspace/import")) |
+  map(select(.body.multipart_form.path | test("/files/"))) |
+  map({name: (.body.multipart_form.path | sub(".*/"; "")), format: .body.multipart_form.format}) |
+  sort_by(.name) | .[] | "\(.format) \(.name)"
+' "$OUT_REQUESTS"
+
+title "recorded content for the small text inputs"
+trace jq -rs '
+  map(select(.path == "/api/2.0/workspace/import")) |
+  map(select(.body.multipart_form.path | test("/(pyNb|sqlNb|scalaNb|plain-script\\.py|héllo\\.txt|with spaces\\.txt|empty\\.txt|dashboard\\.lvdash\\.json)$"))) |
+  map({path: (.body.multipart_form.path | sub(".*/"; "")), content: .body.multipart_form.content}) |
+  sort_by(.path) | .[]
+' "$OUT_REQUESTS"
+
+# Drop the recorded requests; their workspace-prefixed paths are noisy and the
+# assertions above already pin the relevant fields.
+rm "$OUT_REQUESTS" .gitignore
diff --git a/acceptance/bundle/sync-upload-edge-cases/test.toml b/acceptance/bundle/sync-upload-edge-cases/test.toml
new file mode 100644
index 00000000000..2b1b33806af
--- /dev/null
+++ b/acceptance/bundle/sync-upload-edge-cases/test.toml
@@ -0,0 +1,21 @@
+RecordRequests = true
+
+# All sync uploads go through the same /workspace/import multipart code path; running
+# both engine variants is unnecessary here.
+EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+
+Ignore = [
+  "large.bin",
+  "empty.txt",
+  "pyNb.py",
+  "sqlNb.sql",
+  "scalaNb.scala",
+  "plain-script.py",
+  "dashboard.lvdash.json",
+  "space.geniespace.json",
+  "job.dbjob.json",
+  "archive.zip",
+  "héllo.txt",
+  "with spaces.txt",
+  ".databricks",
+]
diff --git a/acceptance/bundle/sync/dryrun/out.test.toml b/acceptance/bundle/sync/dryrun/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/sync/dryrun/out.test.toml
+++ b/acceptance/bundle/sync/dryrun/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/sync/dryrun/script b/acceptance/bundle/sync/dryrun/script
index 10b501d9de4..296c19985cd 100644
--- a/acceptance/bundle/sync/dryrun/script
+++ b/acceptance/bundle/sync/dryrun/script
@@ -3,9 +3,7 @@ touch "project-folder/app.yaml" "project-folder/app.py" "project-folder/query.sq
 touch "ignored-folder/script.py" "ignored-folder/folder1/script.py"
 cat > .gitignore << EOF
 ignored-folder/
-script
 output.txt
-repls.json
 EOF
 
 cleanup() {
diff --git a/acceptance/bundle/sync/out.test.toml b/acceptance/bundle/sync/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/sync/out.test.toml
+++ b/acceptance/bundle/sync/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/sync/output.txt b/acceptance/bundle/sync/output.txt
index 6ff42f41918..ca0b5b7258d 100644
--- a/acceptance/bundle/sync/output.txt
+++ b/acceptance/bundle/sync/output.txt
@@ -1,6 +1,6 @@
 
 >>> [CLI] bundle sync --output text
-Action: PUT: .gitignore, databricks.yml, dryrun/databricks.yml, dryrun/out.test.toml, ignored-folder/folder1/script.py, ignored-folder/script.py
+Action: PUT: .gitignore, databricks.yml, dryrun/databricks.yml, dryrun/out.test.toml, ignored-folder/folder1/script.py, ignored-folder/script.py, upload-504/databricks.yml, upload-504/out.test.toml
 Initial Sync Complete
 Uploaded .gitignore
 Uploaded databricks.yml
@@ -10,3 +10,6 @@ Uploaded dryrun/out.test.toml
 Uploaded ignored-folder/folder1
 Uploaded ignored-folder/folder1/script.py
 Uploaded ignored-folder/script.py
+Uploaded upload-504
+Uploaded upload-504/databricks.yml
+Uploaded upload-504/out.test.toml
diff --git a/acceptance/bundle/sync/script b/acceptance/bundle/sync/script
index b3fb2a7d62a..c4f9f8d2229 100644
--- a/acceptance/bundle/sync/script
+++ b/acceptance/bundle/sync/script
@@ -3,9 +3,7 @@ touch "project-folder/app.yaml" "project-folder/app.py" "project-folder/query.sq
 touch "ignored-folder/script.py" "ignored-folder/folder1/script.py"
 cat > .gitignore << EOF
 ignored-folder/
-script
 output.txt
-repls.json
 EOF
 
 cleanup() {
diff --git a/acceptance/bundle/sync/upload-504/databricks.yml b/acceptance/bundle/sync/upload-504/databricks.yml
new file mode 100644
index 00000000000..576d7a9ef25
--- /dev/null
+++ b/acceptance/bundle/sync/upload-504/databricks.yml
@@ -0,0 +1,2 @@
+bundle:
+  name: test-bundle
diff --git a/acceptance/bundle/sync/upload-504/out.test.toml b/acceptance/bundle/sync/upload-504/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/sync/upload-504/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/sync/upload-504/output.txt b/acceptance/bundle/sync/upload-504/output.txt
new file mode 100644
index 00000000000..af7934522d1
--- /dev/null
+++ b/acceptance/bundle/sync/upload-504/output.txt
@@ -0,0 +1,6 @@
+Action: PUT: databricks.yml
+Warn: retrying after 504 Gateway Timeout from POST /api/2.0/workspace/import: failed to upload /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/databricks.yml: Fault injected by test.
+Uploaded databricks.yml
+Initial Sync Complete
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/databricks.yml
+/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/databricks.yml
diff --git a/acceptance/bundle/sync/upload-504/script b/acceptance/bundle/sync/upload-504/script
new file mode 100644
index 00000000000..d4e9e5d1b51
--- /dev/null
+++ b/acceptance/bundle/sync/upload-504/script
@@ -0,0 +1,7 @@
+# Inject a single 504 on the first file upload. Uploads overwrite, so they are retried and the sync succeeds.
+fault.py "POST /api/2.0/workspace/import" 504 0 1
+
+$CLI bundle sync
+
+# databricks.yml is the only file. Two requests for it should appear: the initial 504 and the successful retry.
+print_requests.py //api/2.0/workspace/import | jq -r .body.multipart_form.path
diff --git a/acceptance/bundle/sync/upload-504/test.toml b/acceptance/bundle/sync/upload-504/test.toml
new file mode 100644
index 00000000000..7d496b2f139
--- /dev/null
+++ b/acceptance/bundle/sync/upload-504/test.toml
@@ -0,0 +1,3 @@
+RecordRequests = true
+Env.DATABRICKS_BUNDLE_RETRY_INTERVAL_MS = "100"
+Env.DATABRICKS_BUNDLE_RETRY_DISABLE_WARNING = ""
diff --git a/acceptance/bundle/syncroot/dotdot-git/out.test.toml b/acceptance/bundle/syncroot/dotdot-git/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/syncroot/dotdot-git/out.test.toml
+++ b/acceptance/bundle/syncroot/dotdot-git/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/syncroot/dotdot-git/output.txt b/acceptance/bundle/syncroot/dotdot-git/output.txt
index fe3091b4bde..d21e1f25839 100644
--- a/acceptance/bundle/syncroot/dotdot-git/output.txt
+++ b/acceptance/bundle/syncroot/dotdot-git/output.txt
@@ -7,5 +7,3 @@ Workspace:
   Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
 Found 1 error
-
-Exit code: 1
diff --git a/acceptance/bundle/syncroot/dotdot-git/script b/acceptance/bundle/syncroot/dotdot-git/script
index 278e7710109..2cfcbcdb3c3 100644
--- a/acceptance/bundle/syncroot/dotdot-git/script
+++ b/acceptance/bundle/syncroot/dotdot-git/script
@@ -3,6 +3,6 @@ mkdir myrepo
 cd myrepo
 cp ../databricks.yml .
 git-repo-init
-errcode $CLI bundle validate
+musterr $CLI bundle validate
 cd ..
 rm -fr myrepo
diff --git a/acceptance/bundle/syncroot/dotdot-nogit/out.test.toml b/acceptance/bundle/syncroot/dotdot-nogit/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/syncroot/dotdot-nogit/out.test.toml
+++ b/acceptance/bundle/syncroot/dotdot-nogit/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/syncroot/dotdot-patterns/app/databricks.yml b/acceptance/bundle/syncroot/dotdot-patterns/app/databricks.yml
new file mode 100644
index 00000000000..20ee87a84f6
--- /dev/null
+++ b/acceptance/bundle/syncroot/dotdot-patterns/app/databricks.yml
@@ -0,0 +1,12 @@
+bundle:
+  name: test-bundle
+
+sync:
+  paths:
+    - ../shared
+    - .
+  include:
+    - ../shared/*.py
+  exclude:
+    - tests/**
+    - missing/**
diff --git a/acceptance/bundle/syncroot/dotdot-patterns/app/tests/test_main.py b/acceptance/bundle/syncroot/dotdot-patterns/app/tests/test_main.py
new file mode 100644
index 00000000000..d3c8e2f347b
--- /dev/null
+++ b/acceptance/bundle/syncroot/dotdot-patterns/app/tests/test_main.py
@@ -0,0 +1,2 @@
+def test_main():
+    pass
diff --git a/acceptance/bundle/syncroot/dotdot-patterns/out.test.toml b/acceptance/bundle/syncroot/dotdot-patterns/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/syncroot/dotdot-patterns/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/syncroot/dotdot-patterns/output.txt b/acceptance/bundle/syncroot/dotdot-patterns/output.txt
new file mode 100644
index 00000000000..1a886131866
--- /dev/null
+++ b/acceptance/bundle/syncroot/dotdot-patterns/output.txt
@@ -0,0 +1,32 @@
+
+>>> [CLI] bundle validate
+Warning: Pattern app/missing/** does not match any files
+  at sync.exclude[1]
+  in databricks.yml:12:7
+
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Found 1 warning
+
+>>> [CLI] bundle validate -o json
+Warning: Pattern app/missing/** does not match any files
+  at sync.exclude[1]
+  in databricks.yml:12:7
+
+{
+  "exclude": [
+    "app/tests/**",
+    "app/missing/**"
+  ],
+  "include": [
+    "shared/*.py"
+  ],
+  "paths": [
+    "shared",
+    "app"
+  ]
+}
diff --git a/acceptance/bundle/syncroot/dotdot-patterns/script b/acceptance/bundle/syncroot/dotdot-patterns/script
new file mode 100644
index 00000000000..9cf16520e1d
--- /dev/null
+++ b/acceptance/bundle/syncroot/dotdot-patterns/script
@@ -0,0 +1,5 @@
+# The sync root is the parent directory, so include/exclude patterns are rewritten
+# relative to it. Only missing/** should be reported as not matching any files.
+cd app
+trace $CLI bundle validate
+trace $CLI bundle validate -o json | jq '.sync'
diff --git a/acceptance/bundle/syncroot/dotdot-patterns/shared/lib.py b/acceptance/bundle/syncroot/dotdot-patterns/shared/lib.py
new file mode 100644
index 00000000000..5db6c330ead
--- /dev/null
+++ b/acceptance/bundle/syncroot/dotdot-patterns/shared/lib.py
@@ -0,0 +1 @@
+print("shared")
diff --git a/acceptance/bundle/syncroot/dotdot-patterns/test.toml b/acceptance/bundle/syncroot/dotdot-patterns/test.toml
new file mode 100644
index 00000000000..601384fdf96
--- /dev/null
+++ b/acceptance/bundle/syncroot/dotdot-patterns/test.toml
@@ -0,0 +1 @@
+Ignore = [".databricks"]
diff --git a/acceptance/bundle/telemetry/config-remote-sync-error/databricks.yml b/acceptance/bundle/telemetry/config-remote-sync-error/databricks.yml
new file mode 100644
index 00000000000..c0c9f880163
--- /dev/null
+++ b/acceptance/bundle/telemetry/config-remote-sync-error/databricks.yml
@@ -0,0 +1,11 @@
+bundle:
+  name: config-remote-sync-telemetry-error
+
+resources:
+  jobs:
+    foo:
+      name: test job
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: /Workspace/Users/tester@databricks.com/notebook
diff --git a/acceptance/bundle/telemetry/config-remote-sync-error/out.test.toml b/acceptance/bundle/telemetry/config-remote-sync-error/out.test.toml
new file mode 100644
index 00000000000..aadf9e4a151
--- /dev/null
+++ b/acceptance/bundle/telemetry/config-remote-sync-error/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+GOOS.windows = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/telemetry/config-remote-sync-error/output.txt b/acceptance/bundle/telemetry/config-remote-sync-error/output.txt
new file mode 100644
index 00000000000..17cfa15ab04
--- /dev/null
+++ b/acceptance/bundle/telemetry/config-remote-sync-error/output.txt
@@ -0,0 +1,12 @@
+
+>>> musterr [CLI] bundle config-remote-sync
+Error: the Terraform deployment engine has been removed in Databricks CLI v1.20.0
+
+Unset the DATABRICKS_BUNDLE_ENGINE environment variable (or set it to "direct") to deploy with the direct engine; existing Terraform state is migrated automatically. To keep using Terraform, revert to Databricks CLI v1.19.x.
+See https://docs.databricks.com/dev-tools/bundles/direct for details
+
+>>> cat [OUTPUT_DIR]/out.requests.txt
+{
+  "error_message": "the Terraform deployment engine has been removed in Databricks CLI v1.20.0\n\nUnset the DATABRICKS_BUNDLE_ENGINE environment variable (or set it to \"direct\") to deploy with the direct engine; existing Terraform state is migrated automatically. To keep using Terraform, revert to Databricks CLI v1.19.x.\nSee https://docs.databricks.com/dev-tools/bundles/direct for details",
+  "error_category": "BUNDLE_LOAD_FAILED"
+}
diff --git a/acceptance/bundle/telemetry/config-remote-sync-error/script b/acceptance/bundle/telemetry/config-remote-sync-error/script
new file mode 100644
index 00000000000..e7aef3000d6
--- /dev/null
+++ b/acceptance/bundle/telemetry/config-remote-sync-error/script
@@ -0,0 +1,6 @@
+# config-remote-sync on the removed terraform engine fails at bundle load.
+trace musterr $CLI bundle config-remote-sync
+
+trace cat "$OUT_REQUESTS" | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log.bundle_config_remote_sync_event | select(. != null)'
+
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/telemetry/config-remote-sync-error/test.toml b/acceptance/bundle/telemetry/config-remote-sync-error/test.toml
new file mode 100644
index 00000000000..541248f7d85
--- /dev/null
+++ b/acceptance/bundle/telemetry/config-remote-sync-error/test.toml
@@ -0,0 +1,6 @@
+# config-remote-sync is not supported on Windows.
+GOOS.windows = false
+
+# The terraform engine was removed: config-remote-sync rejects it at bundle load
+# and telemetry records the BUNDLE_LOAD_FAILED payload.
+Env.DATABRICKS_BUNDLE_ENGINE = "terraform"
diff --git a/acceptance/bundle/telemetry/config-remote-sync-not-in-config/databricks.yml b/acceptance/bundle/telemetry/config-remote-sync-not-in-config/databricks.yml
new file mode 100644
index 00000000000..cbfaea6e7eb
--- /dev/null
+++ b/acceptance/bundle/telemetry/config-remote-sync-not-in-config/databricks.yml
@@ -0,0 +1,11 @@
+bundle:
+  name: config-remote-sync-not-in-config
+
+resources:
+  jobs:
+    foo:
+      name: test job
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: /Workspace/Users/tester@databricks.com/notebook
diff --git a/acceptance/bundle/telemetry/config-remote-sync-not-in-config/out.test.toml b/acceptance/bundle/telemetry/config-remote-sync-not-in-config/out.test.toml
new file mode 100644
index 00000000000..aadf9e4a151
--- /dev/null
+++ b/acceptance/bundle/telemetry/config-remote-sync-not-in-config/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+GOOS.windows = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/telemetry/config-remote-sync-not-in-config/output.txt b/acceptance/bundle/telemetry/config-remote-sync-not-in-config/output.txt
new file mode 100644
index 00000000000..66f437595af
--- /dev/null
+++ b/acceptance/bundle/telemetry/config-remote-sync-not-in-config/output.txt
@@ -0,0 +1,21 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/config-remote-sync-not-in-config/default/files...
+Created jobs.foo
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] bundle config-remote-sync --select-ids jobs:[FOO_ID] -o json
+{
+  "status": "failed",
+  "error": "deployed resources missing from the bundle configuration (renamed or removed since the last deploy): resources.jobs.foo",
+  "errorCode": "RESOURCE_NOT_IN_CONFIG",
+  "files": null,
+  "changes": {}
+}
+
+>>> cat [OUTPUT_DIR]/out.requests.txt
+{
+  "error_message": "deployed resources missing from the bundle configuration (renamed or removed since the last deploy): resources.jobs.foo",
+  "error_category": "RESOURCE_NOT_IN_CONFIG"
+}
diff --git a/acceptance/bundle/telemetry/config-remote-sync-not-in-config/script b/acceptance/bundle/telemetry/config-remote-sync-not-in-config/script
new file mode 100644
index 00000000000..cfb98fa135a
--- /dev/null
+++ b/acceptance/bundle/telemetry/config-remote-sync-not-in-config/script
@@ -0,0 +1,11 @@
+trace $CLI bundle deploy
+job_id="$(read_id.py foo)"
+
+# The deployed job's key is renamed locally, so the config no longer has it.
+update_file.py databricks.yml "    foo:" "    bar:"
+
+trace $CLI bundle config-remote-sync --select-ids "jobs:$job_id" -o json
+
+trace cat "$OUT_REQUESTS" | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log.bundle_config_remote_sync_event | select(. != null) | {error_message, error_category}'
+
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/telemetry/config-remote-sync-not-in-config/test.toml b/acceptance/bundle/telemetry/config-remote-sync-not-in-config/test.toml
new file mode 100644
index 00000000000..97b2a8e4d49
--- /dev/null
+++ b/acceptance/bundle/telemetry/config-remote-sync-not-in-config/test.toml
@@ -0,0 +1,2 @@
+# config-remote-sync is not supported on Windows.
+GOOS.windows = false
diff --git a/acceptance/bundle/telemetry/config-remote-sync-recreate/databricks.yml b/acceptance/bundle/telemetry/config-remote-sync-recreate/databricks.yml
new file mode 100644
index 00000000000..ba8a696ceb8
--- /dev/null
+++ b/acceptance/bundle/telemetry/config-remote-sync-recreate/databricks.yml
@@ -0,0 +1,16 @@
+bundle:
+  name: config-remote-sync-recreate
+
+resources:
+  pipelines:
+    foo:
+      name: test pipeline
+      # ingestion_definition.connection_name is immutable (recreate_on_changes):
+      # a remote change to it means the next deploy would delete + recreate the
+      # pipeline. (storage, the other immutable pipeline field, is skipped by
+      # configsync because the backend auto-generates it, so it can't be used
+      # here.)
+      ingestion_definition:
+        connection_name: my_connection
+        objects:
+          - {}
diff --git a/acceptance/bundle/telemetry/config-remote-sync-recreate/out.test.toml b/acceptance/bundle/telemetry/config-remote-sync-recreate/out.test.toml
new file mode 100644
index 00000000000..aadf9e4a151
--- /dev/null
+++ b/acceptance/bundle/telemetry/config-remote-sync-recreate/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+GOOS.windows = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/telemetry/config-remote-sync-recreate/output.txt b/acceptance/bundle/telemetry/config-remote-sync-recreate/output.txt
new file mode 100644
index 00000000000..39e27d0f075
--- /dev/null
+++ b/acceptance/bundle/telemetry/config-remote-sync-recreate/output.txt
@@ -0,0 +1,39 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/config-remote-sync-recreate/default/files...
+Created pipelines.foo
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] bundle config-remote-sync
+Detected changes in 1 resource(s):
+
+Resource: resources.pipelines.foo
+  ingestion_definition.connection_name: replace
+
+
+
+>>> cat [OUTPUT_DIR]/out.requests.txt
+{
+  "engine": "direct",
+  "changes_total": 1,
+  "replace_count": 1,
+  "recreate_forcing_changes": 1,
+  "resource_changes": [
+    {
+      "resource_type": "pipelines",
+      "changes_count": 1,
+      "replace_count": 1
+    }
+  ],
+  "files_changed_count": 1,
+  "state_serial": 1,
+  "state_lineage": "[UUID]",
+  "state_source": "local",
+  "states_available_count": 2,
+  "state_resource_ids": {
+    "resource_pipeline_ids": [
+      "[FOO_ID]"
+    ]
+  }
+}
diff --git a/acceptance/bundle/telemetry/config-remote-sync-recreate/script b/acceptance/bundle/telemetry/config-remote-sync-recreate/script
new file mode 100644
index 00000000000..2694359afe5
--- /dev/null
+++ b/acceptance/bundle/telemetry/config-remote-sync-recreate/script
@@ -0,0 +1,15 @@
+trace $CLI bundle deploy
+
+pipeline_id="$(read_id.py foo)"
+
+# Change the immutable ingestion_definition.connection_name remotely.
+# config-remote-sync would sync this into config, so recreate_forcing_changes is 1.
+edit_resource.py pipelines $pipeline_id <<EOF
+r["ingestion_definition"]["connection_name"] = "my_new_connection"
+EOF
+
+trace $CLI bundle config-remote-sync
+
+trace cat "$OUT_REQUESTS" | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log.bundle_config_remote_sync_event | select(. != null)'
+
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/telemetry/config-remote-sync-recreate/test.toml b/acceptance/bundle/telemetry/config-remote-sync-recreate/test.toml
new file mode 100644
index 00000000000..da2ddce254e
--- /dev/null
+++ b/acceptance/bundle/telemetry/config-remote-sync-recreate/test.toml
@@ -0,0 +1,6 @@
+# config-remote-sync is not supported on Windows.
+GOOS.windows = false
+
+# Pinned to the direct engine (see config-remote-sync/test.toml): telemetry is
+# engine-agnostic above the state layer, and recreate_forcing_changes is derived
+# from the resource lifecycle metadata, not from which engine read the state.
diff --git a/acceptance/bundle/telemetry/config-remote-sync-save/databricks.yml b/acceptance/bundle/telemetry/config-remote-sync-save/databricks.yml
new file mode 100644
index 00000000000..80d05fe88aa
--- /dev/null
+++ b/acceptance/bundle/telemetry/config-remote-sync-save/databricks.yml
@@ -0,0 +1,11 @@
+bundle:
+  name: config-remote-sync-save
+
+resources:
+  jobs:
+    foo:
+      name: test job
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: /Workspace/Users/tester@databricks.com/notebook
diff --git a/acceptance/bundle/telemetry/config-remote-sync-save/out.test.toml b/acceptance/bundle/telemetry/config-remote-sync-save/out.test.toml
new file mode 100644
index 00000000000..aadf9e4a151
--- /dev/null
+++ b/acceptance/bundle/telemetry/config-remote-sync-save/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+GOOS.windows = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/telemetry/config-remote-sync-save/output.txt b/acceptance/bundle/telemetry/config-remote-sync-save/output.txt
new file mode 100644
index 00000000000..530b2535442
--- /dev/null
+++ b/acceptance/bundle/telemetry/config-remote-sync-save/output.txt
@@ -0,0 +1,41 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/config-remote-sync-save/default/files...
+Created jobs.foo
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] bundle config-remote-sync --save
+Detected changes in 1 resource(s):
+
+Resource: resources.jobs.foo
+  name: replace
+
+
+
+>>> cat [OUTPUT_DIR]/out.requests.txt
+{
+  "save": true,
+  "engine": "direct",
+  "changes_total": 1,
+  "replace_count": 1,
+  "overwritten_local_edits": 1,
+  "resource_changes": [
+    {
+      "resource_type": "jobs",
+      "changes_count": 1,
+      "replace_count": 1
+    }
+  ],
+  "files_changed_count": 1,
+  "files_written_count": 1,
+  "state_serial": 1,
+  "state_lineage": "[UUID]",
+  "state_source": "local",
+  "states_available_count": 2,
+  "state_resource_ids": {
+    "resource_job_ids": [
+      "[FOO_ID]"
+    ]
+  }
+}
diff --git a/acceptance/bundle/telemetry/config-remote-sync-save/script b/acceptance/bundle/telemetry/config-remote-sync-save/script
new file mode 100644
index 00000000000..95480e39d40
--- /dev/null
+++ b/acceptance/bundle/telemetry/config-remote-sync-save/script
@@ -0,0 +1,13 @@
+trace $CLI bundle deploy
+replace_ids.py
+
+# Edit the job name locally (not deployed) so the local config diverges from the
+# deployed state. config-remote-sync --save then overwrites that pending edit,
+# exercising save, files_written_count, and overwritten_local_edits.
+update_file.py databricks.yml "test job" "locally edited job name"
+
+trace $CLI bundle config-remote-sync --save
+
+trace cat "$OUT_REQUESTS" | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log.bundle_config_remote_sync_event | select(. != null)'
+
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/telemetry/config-remote-sync-save/test.toml b/acceptance/bundle/telemetry/config-remote-sync-save/test.toml
new file mode 100644
index 00000000000..a25e7b5b36f
--- /dev/null
+++ b/acceptance/bundle/telemetry/config-remote-sync-save/test.toml
@@ -0,0 +1,8 @@
+# --save rewrites databricks.yml; it's a mutated input, not asserted output.
+Ignore = ["databricks.yml", "databricks.yml.backup"]
+
+# config-remote-sync is not supported on Windows.
+GOOS.windows = false
+
+# overwritten_local_edits is computed from the per-field deployed base, which
+# only the direct engine materializes (the terraform sync snapshot is empty).
diff --git a/acceptance/bundle/telemetry/config-remote-sync-skipped-state/databricks.yml b/acceptance/bundle/telemetry/config-remote-sync-skipped-state/databricks.yml
new file mode 100644
index 00000000000..5d666546ce2
--- /dev/null
+++ b/acceptance/bundle/telemetry/config-remote-sync-skipped-state/databricks.yml
@@ -0,0 +1,11 @@
+bundle:
+  name: config-remote-sync-skipped-state
+
+resources:
+  jobs:
+    foo:
+      name: test job
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: /Workspace/Users/tester@databricks.com/notebook
diff --git a/acceptance/bundle/telemetry/config-remote-sync-skipped-state/out.test.toml b/acceptance/bundle/telemetry/config-remote-sync-skipped-state/out.test.toml
new file mode 100644
index 00000000000..aadf9e4a151
--- /dev/null
+++ b/acceptance/bundle/telemetry/config-remote-sync-skipped-state/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+GOOS.windows = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/telemetry/config-remote-sync-skipped-state/output.txt b/acceptance/bundle/telemetry/config-remote-sync-skipped-state/output.txt
new file mode 100644
index 00000000000..8a7fc20b9fc
--- /dev/null
+++ b/acceptance/bundle/telemetry/config-remote-sync-skipped-state/output.txt
@@ -0,0 +1,14 @@
+
+>>> errcode [CLI] bundle config-remote-sync -o json
+{
+  "status": "failed",
+  "error": "the Terraform deployment engine has been removed in Databricks CLI v1.20.0\n\nUnset the DATABRICKS_BUNDLE_ENGINE environment variable (or set it to \"direct\") to deploy with the direct engine; existing Terraform state is migrated automatically. To keep using Terraform, revert to Databricks CLI v1.19.x.\nSee https://docs.databricks.com/dev-tools/bundles/direct for details",
+  "files": null,
+  "changes": {}
+}
+
+>>> cat [OUTPUT_DIR]/out.requests.txt
+{
+  "error_message": "the Terraform deployment engine has been removed in Databricks CLI v1.20.0\n\nUnset the DATABRICKS_BUNDLE_ENGINE environment variable (or set it to \"direct\") to deploy with the direct engine; existing Terraform state is migrated automatically. To keep using Terraform, revert to Databricks CLI v1.19.x.\nSee https://docs.databricks.com/dev-tools/bundles/direct for details",
+  "error_category": "BUNDLE_LOAD_FAILED"
+}
diff --git a/acceptance/bundle/telemetry/config-remote-sync-skipped-state/script b/acceptance/bundle/telemetry/config-remote-sync-skipped-state/script
new file mode 100644
index 00000000000..9b0bdb4daa2
--- /dev/null
+++ b/acceptance/bundle/telemetry/config-remote-sync-skipped-state/script
@@ -0,0 +1,7 @@
+# config-remote-sync -o json on the removed terraform engine: in JSON mode the
+# command exits 0 and reports status failed; telemetry records the error payload.
+trace errcode $CLI bundle config-remote-sync -o json
+
+trace cat "$OUT_REQUESTS" | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log.bundle_config_remote_sync_event | select(. != null)'
+
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/telemetry/config-remote-sync-skipped-state/test.toml b/acceptance/bundle/telemetry/config-remote-sync-skipped-state/test.toml
new file mode 100644
index 00000000000..541248f7d85
--- /dev/null
+++ b/acceptance/bundle/telemetry/config-remote-sync-skipped-state/test.toml
@@ -0,0 +1,6 @@
+# config-remote-sync is not supported on Windows.
+GOOS.windows = false
+
+# The terraform engine was removed: config-remote-sync rejects it at bundle load
+# and telemetry records the BUNDLE_LOAD_FAILED payload.
+Env.DATABRICKS_BUNDLE_ENGINE = "terraform"
diff --git a/acceptance/bundle/telemetry/config-remote-sync/databricks.yml b/acceptance/bundle/telemetry/config-remote-sync/databricks.yml
new file mode 100644
index 00000000000..543dc4129bd
--- /dev/null
+++ b/acceptance/bundle/telemetry/config-remote-sync/databricks.yml
@@ -0,0 +1,11 @@
+bundle:
+  name: config-remote-sync-telemetry
+
+resources:
+  jobs:
+    foo:
+      name: test job
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: /Workspace/Users/tester@databricks.com/notebook
diff --git a/acceptance/bundle/telemetry/config-remote-sync/out.test.toml b/acceptance/bundle/telemetry/config-remote-sync/out.test.toml
new file mode 100644
index 00000000000..aadf9e4a151
--- /dev/null
+++ b/acceptance/bundle/telemetry/config-remote-sync/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+GOOS.windows = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/telemetry/config-remote-sync/output.txt b/acceptance/bundle/telemetry/config-remote-sync/output.txt
new file mode 100644
index 00000000000..157b4cb6d79
--- /dev/null
+++ b/acceptance/bundle/telemetry/config-remote-sync/output.txt
@@ -0,0 +1,41 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/config-remote-sync-telemetry/default/files...
+Created jobs.foo
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] bundle config-remote-sync
+Detected changes in 1 resource(s):
+
+Resource: resources.jobs.foo
+  name: replace
+
+
+
+>>> cat [OUTPUT_DIR]/out.requests.txt
+{
+  "engine": "direct",
+  "changes_total": 1,
+  "replace_count": 1,
+  "resource_changes": [
+    {
+      "resource_type": "jobs",
+      "changes_count": 1,
+      "replace_count": 1
+    }
+  ],
+  "files_changed_count": 1,
+  "state_serial": 1,
+  "state_lineage": "[UUID]",
+  "state_source": "local",
+  "states_available_count": 2,
+  "state_resource_ids": {
+    "resource_job_ids": [
+      "[FOO_ID]"
+    ]
+  }
+}
+
+>>> cat [OUTPUT_DIR]/out.requests.txt
+"[LINEAGE_HASH]"
diff --git a/acceptance/bundle/telemetry/config-remote-sync/script b/acceptance/bundle/telemetry/config-remote-sync/script
new file mode 100644
index 00000000000..48ac2856a70
--- /dev/null
+++ b/acceptance/bundle/telemetry/config-remote-sync/script
@@ -0,0 +1,16 @@
+trace $CLI bundle deploy
+read_lineage.py
+
+job_id="$(read_id.py foo)"
+edit_resource.py jobs $job_id <<EOF
+r["name"] = "renamed remotely"
+EOF
+
+trace $CLI bundle config-remote-sync
+
+trace cat "$OUT_REQUESTS" | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log.bundle_config_remote_sync_event | select(. != null)'
+
+# The execution context of every event carries the hash of the state lineage.
+trace cat "$OUT_REQUESTS" | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log | select(.bundle_config_remote_sync_event != null) | .execution_context.state_lineage_hash'
+
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/telemetry/config-remote-sync/test.toml b/acceptance/bundle/telemetry/config-remote-sync/test.toml
new file mode 100644
index 00000000000..9f16a3927fe
--- /dev/null
+++ b/acceptance/bundle/telemetry/config-remote-sync/test.toml
@@ -0,0 +1,8 @@
+# config-remote-sync is not supported on Windows.
+GOOS.windows = false
+
+# Pinned to the direct engine. The terraform path of config-remote-sync reads
+# the experimental yaml-sync state snapshot, which only the cloud test harness
+# supports (all terraform config-remote-sync coverage lives in the Cloud=true
+# acceptance/bundle/config-remote-sync tests). Direct is the default engine for
+# new bundles, and the telemetry is engine-agnostic above the state layer.
diff --git a/acceptance/bundle/telemetry/deploy-ai-runtime-task/databricks.yml b/acceptance/bundle/telemetry/deploy-ai-runtime-task/databricks.yml
new file mode 100644
index 00000000000..f2159fcce50
--- /dev/null
+++ b/acceptance/bundle/telemetry/deploy-ai-runtime-task/databricks.yml
@@ -0,0 +1,25 @@
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    job:
+      name: "[${bundle.target}] AI Runtime Job"
+      # Present so the ai_runtime_task_scheduled telemetry bool is exercised.
+      schedule:
+        quartz_cron_expression: "0 0 12 * * ?"
+        timezone_id: UTC
+      environments:
+        - environment_key: default
+          spec:
+            environment_version: "4"
+      tasks:
+        - task_key: train
+          environment_key: default
+          ai_runtime_task:
+            experiment: my-experiment
+            deployments:
+              - command_path: /Workspace/Shared/command.sh
+                compute:
+                  accelerator_type: GPU_1xA10
+                  accelerator_count: 1
diff --git a/acceptance/bundle/telemetry/deploy-ai-runtime-task/out.test.toml b/acceptance/bundle/telemetry/deploy-ai-runtime-task/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/telemetry/deploy-ai-runtime-task/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/telemetry/deploy-ai-runtime-task/output.txt b/acceptance/bundle/telemetry/deploy-ai-runtime-task/output.txt
new file mode 100644
index 00000000000..b7ca57c6b7a
--- /dev/null
+++ b/acceptance/bundle/telemetry/deploy-ai-runtime-task/output.txt
@@ -0,0 +1,22 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Created jobs.job
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> cat [OUTPUT_DIR]/out.requests.txt
+[
+  {
+    "key": "ai_runtime_task_multitask",
+    "value": false
+  },
+  {
+    "key": "ai_runtime_task_scheduled",
+    "value": true
+  },
+  {
+    "key": "has_ai_runtime_task",
+    "value": true
+  }
+]
diff --git a/acceptance/bundle/telemetry/deploy-ai-runtime-task/script b/acceptance/bundle/telemetry/deploy-ai-runtime-task/script
new file mode 100644
index 00000000000..e16013fc9c7
--- /dev/null
+++ b/acceptance/bundle/telemetry/deploy-ai-runtime-task/script
@@ -0,0 +1,7 @@
+trace $CLI bundle deploy
+
+# Only the task-type / ai_runtime_task telemetry keys, so this golden does not
+# churn when unrelated bool_values change.
+trace cat "$OUT_REQUESTS" | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log.bundle_deploy_event.experimental.bool_values | map(select((.key | test("_task$")) or (.key | startswith("ai_runtime_")))) | sort_by(.key)'
+
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/telemetry/deploy-app-lifecycle-started/databricks.yml b/acceptance/bundle/telemetry/deploy-app-lifecycle-started/databricks.yml
new file mode 100644
index 00000000000..73279b89f9b
--- /dev/null
+++ b/acceptance/bundle/telemetry/deploy-app-lifecycle-started/databricks.yml
@@ -0,0 +1,10 @@
+bundle:
+  name: test-bundle
+
+resources:
+  apps:
+    myapp:
+      name: my-app
+      source_code_path: .
+      lifecycle:
+        started: true
diff --git a/acceptance/bundle/telemetry/deploy-app-lifecycle-started/out.test.toml b/acceptance/bundle/telemetry/deploy-app-lifecycle-started/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/telemetry/deploy-app-lifecycle-started/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/telemetry/deploy-app-lifecycle-started/output.txt b/acceptance/bundle/telemetry/deploy-app-lifecycle-started/output.txt
new file mode 100644
index 00000000000..b70ab61ef9b
--- /dev/null
+++ b/acceptance/bundle/telemetry/deploy-app-lifecycle-started/output.txt
@@ -0,0 +1,101 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+✓ Deployment succeeded
+Created apps.myapp
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> cat [OUTPUT_DIR]/out.requests.txt
+{
+  "bool_values": [
+    {
+      "key": "local.cache.attempt",
+      "value": true
+    },
+    {
+      "key": "local.cache.miss",
+      "value": true
+    },
+    {
+      "key": "experimental.use_legacy_run_as",
+      "value": false
+    },
+    {
+      "key": "run_as_set",
+      "value": false
+    },
+    {
+      "key": "presets_name_prefix_is_set",
+      "value": false
+    },
+    {
+      "key": "python_wheel_wrapper_is_set",
+      "value": false
+    },
+    {
+      "key": "skip_artifact_cleanup",
+      "value": false
+    },
+    {
+      "key": "state_path_is_shared",
+      "value": false
+    },
+    {
+      "key": "permissions_section_set",
+      "value": false
+    },
+    {
+      "key": "state_path_in_deployer_home",
+      "value": true
+    },
+    {
+      "key": "state_path_in_other_user_home",
+      "value": false
+    },
+    {
+      "key": "state_path_other",
+      "value": false
+    },
+    {
+      "key": "dms_undeclared_deploying_user",
+      "value": false
+    },
+    {
+      "key": "dms_undeclared_other_user",
+      "value": false
+    },
+    {
+      "key": "dms_undeclared_service_principal",
+      "value": false
+    },
+    {
+      "key": "dms_undeclared_group",
+      "value": false
+    },
+    {
+      "key": "dms_compat_auto",
+      "value": true
+    },
+    {
+      "key": "has_serverless_compute",
+      "value": false
+    },
+    {
+      "key": "has_classic_job_compute",
+      "value": false
+    },
+    {
+      "key": "has_classic_interactive_compute",
+      "value": false
+    },
+    {
+      "key": "deployment_history_enabled",
+      "value": false
+    },
+    {
+      "key": "app_lifecycle_started",
+      "value": true
+    }
+  ]
+}
diff --git a/acceptance/bundle/telemetry/deploy-app-lifecycle-started/script b/acceptance/bundle/telemetry/deploy-app-lifecycle-started/script
new file mode 100644
index 00000000000..a454001b8f9
--- /dev/null
+++ b/acceptance/bundle/telemetry/deploy-app-lifecycle-started/script
@@ -0,0 +1,5 @@
+trace $CLI bundle deploy
+
+trace cat "$OUT_REQUESTS" | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log.bundle_deploy_event.experimental | {bool_values}'
+
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/telemetry/deploy-artifact-path-type/out.test.toml b/acceptance/bundle/telemetry/deploy-artifact-path-type/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/telemetry/deploy-artifact-path-type/out.test.toml
+++ b/acceptance/bundle/telemetry/deploy-artifact-path-type/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/telemetry/deploy-artifact-path-type/output.txt b/acceptance/bundle/telemetry/deploy-artifact-path-type/output.txt
index a03920c3fdc..7dce1c17162 100644
--- a/acceptance/bundle/telemetry/deploy-artifact-path-type/output.txt
+++ b/acceptance/bundle/telemetry/deploy-artifact-path-type/output.txt
@@ -1,15 +1,15 @@
 
 >>> [CLI] bundle deploy -t one
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/one/files...
-Deploying resources...
-Deployment complete!
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle deploy -t two
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/two/files...
-Deploying resources...
-Deployment complete!
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
 
->>> cat out.requests.txt
+>>> cat [OUTPUT_DIR]/out.requests.txt
 {
   "workspace_artifact_path_type": "WORKSPACE_FILE_SYSTEM"
 }
diff --git a/acceptance/bundle/telemetry/deploy-artifact-path-type/script b/acceptance/bundle/telemetry/deploy-artifact-path-type/script
index d1a63928a67..5a3a68ff114 100644
--- a/acceptance/bundle/telemetry/deploy-artifact-path-type/script
+++ b/acceptance/bundle/telemetry/deploy-artifact-path-type/script
@@ -2,6 +2,6 @@ trace $CLI bundle deploy -t one
 
 trace $CLI bundle deploy -t two
 
-trace cat out.requests.txt | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log.bundle_deploy_event.experimental | {workspace_artifact_path_type}'
+trace cat "$OUT_REQUESTS" | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log.bundle_deploy_event.experimental | {workspace_artifact_path_type}'
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/telemetry/deploy-artifacts-variables/out.test.toml b/acceptance/bundle/telemetry/deploy-artifacts-variables/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/telemetry/deploy-artifacts-variables/out.test.toml
+++ b/acceptance/bundle/telemetry/deploy-artifacts-variables/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/telemetry/deploy-artifacts-variables/output.txt b/acceptance/bundle/telemetry/deploy-artifacts-variables/output.txt
index ec277538c50..ba5bba6a5ab 100644
--- a/acceptance/bundle/telemetry/deploy-artifacts-variables/output.txt
+++ b/acceptance/bundle/telemetry/deploy-artifacts-variables/output.txt
@@ -3,23 +3,23 @@
 Building test_artifact...
 Uploading databricks.yml...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-artifacts-variables/dev/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.test-job
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 === No artifact metrics expected
->>> cat out.requests.txt
+>>> cat [OUTPUT_DIR]/out.requests.txt
 
 >>> [CLI] bundle deploy -t prod
 Building test_artifact...
 Uploading databricks.yml...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-artifacts-variables/prod/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.test-job
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 === Artifact metrics expected
->>> cat out.requests.txt
+>>> cat [OUTPUT_DIR]/out.requests.txt
 {
   "key": "artifacts_reference_used",
   "value": true
diff --git a/acceptance/bundle/telemetry/deploy-artifacts-variables/script b/acceptance/bundle/telemetry/deploy-artifacts-variables/script
index 1088102801c..b4b02d07718 100644
--- a/acceptance/bundle/telemetry/deploy-artifacts-variables/script
+++ b/acceptance/bundle/telemetry/deploy-artifacts-variables/script
@@ -1,11 +1,11 @@
 trace $CLI bundle deploy -t dev
 
 title "No artifact metrics expected"
-trace cat out.requests.txt | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log.bundle_deploy_event.experimental.bool_values[] | select(.key == "artifacts_reference_used")'
+trace cat "$OUT_REQUESTS" | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log.bundle_deploy_event.experimental.bool_values[] | select(.key == "artifacts_reference_used")'
 
 trace $CLI bundle deploy -t prod
 
 title "Artifact metrics expected"
-trace cat out.requests.txt | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log.bundle_deploy_event.experimental.bool_values[] | select(.key == "artifacts_reference_used")'
+trace cat "$OUT_REQUESTS" | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log.bundle_deploy_event.experimental.bool_values[] | select(.key == "artifacts_reference_used")'
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/telemetry/deploy-compute-type/out.test.toml b/acceptance/bundle/telemetry/deploy-compute-type/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/telemetry/deploy-compute-type/out.test.toml
+++ b/acceptance/bundle/telemetry/deploy-compute-type/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/telemetry/deploy-compute-type/output.txt b/acceptance/bundle/telemetry/deploy-compute-type/output.txt
index a424df8ce1d..453fffeaae2 100644
--- a/acceptance/bundle/telemetry/deploy-compute-type/output.txt
+++ b/acceptance/bundle/telemetry/deploy-compute-type/output.txt
@@ -1,98 +1,57 @@
 
 >>> [CLI] bundle deploy -t one
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-compute-type/one/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.my_job
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle deploy -t two
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/deploy-compute-type/two/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.my_job
+Files: 3 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
->>> cat out.requests.txt
-[
-  {
-    "key": "local.cache.attempt",
-    "value": true
-  },
-  {
-    "key": "local.cache.miss",
-    "value": true
-  },
-  {
-    "key": "experimental.use_legacy_run_as",
-    "value": false
-  },
-  {
-    "key": "run_as_set",
-    "value": false
-  },
-  {
-    "key": "presets_name_prefix_is_set",
-    "value": false
-  },
-  {
-    "key": "python_wheel_wrapper_is_set",
-    "value": false
-  },
-  {
-    "key": "skip_artifact_cleanup",
-    "value": false
-  },
-  {
-    "key": "has_serverless_compute",
-    "value": true
-  },
-  {
-    "key": "has_classic_job_compute",
-    "value": true
-  },
-  {
-    "key": "has_classic_interactive_compute",
-    "value": true
-  }
-]
-[
-  {
-    "key": "local.cache.attempt",
-    "value": true
-  },
-  {
-    "key": "local.cache.hit",
-    "value": true
-  },
-  {
-    "key": "experimental.use_legacy_run_as",
-    "value": false
-  },
-  {
-    "key": "run_as_set",
-    "value": false
-  },
-  {
-    "key": "presets_name_prefix_is_set",
-    "value": false
-  },
-  {
-    "key": "python_wheel_wrapper_is_set",
-    "value": false
-  },
-  {
-    "key": "skip_artifact_cleanup",
-    "value": false
-  },
-  {
-    "key": "has_serverless_compute",
-    "value": true
-  },
-  {
-    "key": "has_classic_job_compute",
-    "value": false
-  },
-  {
-    "key": "has_classic_interactive_compute",
-    "value": false
-  }
-]
+>>> print_telemetry_bool_values
+dms_compat_auto true
+dms_compat_auto true
+dms_undeclared_deploying_user false
+dms_undeclared_deploying_user false
+dms_undeclared_group false
+dms_undeclared_group false
+dms_undeclared_other_user false
+dms_undeclared_other_user false
+dms_undeclared_service_principal false
+dms_undeclared_service_principal false
+experimental.use_legacy_run_as false
+experimental.use_legacy_run_as false
+has_classic_interactive_compute false
+has_classic_interactive_compute true
+has_classic_job_compute false
+has_classic_job_compute true
+has_notebook_task true
+has_serverless_compute true
+has_serverless_compute true
+has_spark_python_task true
+has_spark_python_task true
+local.cache.attempt true
+local.cache.attempt true
+local.cache.hit true
+local.cache.miss true
+permissions_section_set false
+permissions_section_set false
+presets_name_prefix_is_set false
+presets_name_prefix_is_set false
+python_wheel_wrapper_is_set false
+python_wheel_wrapper_is_set false
+run_as_set false
+run_as_set false
+skip_artifact_cleanup false
+skip_artifact_cleanup false
+state_path_in_deployer_home true
+state_path_in_deployer_home true
+state_path_in_other_user_home false
+state_path_in_other_user_home false
+state_path_is_shared false
+state_path_is_shared false
+state_path_other false
+state_path_other false
diff --git a/acceptance/bundle/telemetry/deploy-compute-type/script b/acceptance/bundle/telemetry/deploy-compute-type/script
index cfe8cba93be..66c51b992ab 100644
--- a/acceptance/bundle/telemetry/deploy-compute-type/script
+++ b/acceptance/bundle/telemetry/deploy-compute-type/script
@@ -1,6 +1,6 @@
 trace $CLI bundle deploy -t one
 trace $CLI bundle deploy -t two
 
-trace cat out.requests.txt | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log.bundle_deploy_event.experimental.bool_values'
+trace print_telemetry_bool_values
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/telemetry/deploy-config-file-count/out.test.toml b/acceptance/bundle/telemetry/deploy-config-file-count/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/telemetry/deploy-config-file-count/out.test.toml
+++ b/acceptance/bundle/telemetry/deploy-config-file-count/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/telemetry/deploy-config-file-count/output.txt b/acceptance/bundle/telemetry/deploy-config-file-count/output.txt
index 909e8d6c705..8b79891eb02 100644
--- a/acceptance/bundle/telemetry/deploy-config-file-count/output.txt
+++ b/acceptance/bundle/telemetry/deploy-config-file-count/output.txt
@@ -1,10 +1,10 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Deployment complete!
+Files: 4 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
 
->>> cat out.requests.txt
+>>> cat [OUTPUT_DIR]/out.requests.txt
 {
   "configuration_file_count": 4
 }
diff --git a/acceptance/bundle/telemetry/deploy-config-file-count/script b/acceptance/bundle/telemetry/deploy-config-file-count/script
index c495bdcb071..a0767f36da3 100644
--- a/acceptance/bundle/telemetry/deploy-config-file-count/script
+++ b/acceptance/bundle/telemetry/deploy-config-file-count/script
@@ -1,5 +1,5 @@
 trace $CLI bundle deploy
 
-trace cat out.requests.txt | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log.bundle_deploy_event.experimental | {configuration_file_count}'
+trace cat "$OUT_REQUESTS" | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log.bundle_deploy_event.experimental | {configuration_file_count}'
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/telemetry/deploy-error-message/out.test.toml b/acceptance/bundle/telemetry/deploy-error-message/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/telemetry/deploy-error-message/out.test.toml
+++ b/acceptance/bundle/telemetry/deploy-error-message/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/telemetry/deploy-error-message/output.txt b/acceptance/bundle/telemetry/deploy-error-message/output.txt
index bb7f609143d..bdb457438c4 100644
--- a/acceptance/bundle/telemetry/deploy-error-message/output.txt
+++ b/acceptance/bundle/telemetry/deploy-error-message/output.txt
@@ -5,5 +5,5 @@ Error: no value assigned to required variable myvar. Variables are usually assig
 
 Exit code: 1
 
->>> cat out.requests.txt
+>>> cat [OUTPUT_DIR]/out.requests.txt
 no value assigned to required variable myvar. Variables are usually assigned in databricks.yml, and they can be overridden using "--var", the BUNDLE_VAR_myvar environment variable, or [REDACTED_REL_PATH](json)
diff --git a/acceptance/bundle/telemetry/deploy-error-message/script b/acceptance/bundle/telemetry/deploy-error-message/script
index 8c5e853386b..862a6efa2e3 100644
--- a/acceptance/bundle/telemetry/deploy-error-message/script
+++ b/acceptance/bundle/telemetry/deploy-error-message/script
@@ -1,5 +1,5 @@
 errcode trace $CLI bundle deploy
 
-trace cat out.requests.txt | jq -r 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log.bundle_deploy_event.error_message'
+trace cat "$OUT_REQUESTS" | jq -r 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log.bundle_deploy_event.error_message'
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/telemetry/deploy-error/out.telemetry.txt b/acceptance/bundle/telemetry/deploy-error/out.telemetry.txt
index b3eff6a16f4..c1e2060774a 100644
--- a/acceptance/bundle/telemetry/deploy-error/out.telemetry.txt
+++ b/acceptance/bundle/telemetry/deploy-error/out.telemetry.txt
@@ -1,7 +1,7 @@
 {
   "execution_context": {
     "cmd_exec_id": "[CMD-EXEC-ID]",
-    "version": "[DEV_VERSION]",
+    "version": "[CLI_VERSION]",
     "command": "bundle_deploy",
     "operating_system": "[OS]",
     "execution_time_ms": SMALL_INT,
diff --git a/acceptance/bundle/telemetry/deploy-error/out.test.toml b/acceptance/bundle/telemetry/deploy-error/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/telemetry/deploy-error/out.test.toml
+++ b/acceptance/bundle/telemetry/deploy-error/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/telemetry/deploy-error/output.txt b/acceptance/bundle/telemetry/deploy-error/output.txt
index 5728b1d45d4..8382a2832b4 100644
--- a/acceptance/bundle/telemetry/deploy-error/output.txt
+++ b/acceptance/bundle/telemetry/deploy-error/output.txt
@@ -5,4 +5,4 @@ Error: unable to define default workspace root: bundle name not defined
 
 Exit code: 1
 
->>> cat out.requests.txt
+>>> cat [OUTPUT_DIR]/out.requests.txt
diff --git a/acceptance/bundle/telemetry/deploy-error/script b/acceptance/bundle/telemetry/deploy-error/script
index 642cb0ef7dc..ebc0e9667fa 100644
--- a/acceptance/bundle/telemetry/deploy-error/script
+++ b/acceptance/bundle/telemetry/deploy-error/script
@@ -1,9 +1,9 @@
 errcode trace $CLI bundle deploy
 
-trace cat out.requests.txt | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log | {execution_context}' > out.telemetry.txt
+trace cat "$OUT_REQUESTS" | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log | {execution_context}' > out.telemetry.txt
 
 cmd_exec_id=$(extract_command_exec_id.py)
 
 update_file.py out.telemetry.txt $cmd_exec_id  '[CMD-EXEC-ID]'
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/telemetry/deploy-experimental/out.test.toml b/acceptance/bundle/telemetry/deploy-experimental/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/telemetry/deploy-experimental/out.test.toml
+++ b/acceptance/bundle/telemetry/deploy-experimental/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/telemetry/deploy-experimental/output.txt b/acceptance/bundle/telemetry/deploy-experimental/output.txt
index cf7a2358da7..baa7f5a4721 100644
--- a/acceptance/bundle/telemetry/deploy-experimental/output.txt
+++ b/acceptance/bundle/telemetry/deploy-experimental/output.txt
@@ -5,52 +5,29 @@ Warning: You are using the legacy mode of run_as. The support for this mode is e
   in databricks.yml:5:22
 
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.foo
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
->>> cat out.requests.txt
-{
-  "bool_values": [
-    {
-      "key": "local.cache.attempt",
-      "value": true
-    },
-    {
-      "key": "local.cache.miss",
-      "value": true
-    },
-    {
-      "key": "experimental.use_legacy_run_as",
-      "value": true
-    },
-    {
-      "key": "run_as_set",
-      "value": true
-    },
-    {
-      "key": "presets_name_prefix_is_set",
-      "value": false
-    },
-    {
-      "key": "python_wheel_wrapper_is_set",
-      "value": false
-    },
-    {
-      "key": "skip_artifact_cleanup",
-      "value": false
-    },
-    {
-      "key": "has_serverless_compute",
-      "value": false
-    },
-    {
-      "key": "has_classic_job_compute",
-      "value": false
-    },
-    {
-      "key": "has_classic_interactive_compute",
-      "value": true
-    }
-  ]
-}
+>>> print_telemetry_bool_values
+dms_compat_auto true
+dms_undeclared_deploying_user false
+dms_undeclared_group false
+dms_undeclared_other_user false
+dms_undeclared_service_principal false
+experimental.use_legacy_run_as true
+has_classic_interactive_compute true
+has_classic_job_compute false
+has_serverless_compute false
+has_spark_python_task true
+local.cache.attempt true
+local.cache.miss true
+permissions_section_set false
+presets_name_prefix_is_set false
+python_wheel_wrapper_is_set false
+run_as_set true
+skip_artifact_cleanup false
+state_path_in_deployer_home true
+state_path_in_other_user_home false
+state_path_is_shared false
+state_path_other false
diff --git a/acceptance/bundle/telemetry/deploy-experimental/script b/acceptance/bundle/telemetry/deploy-experimental/script
index 67a3ba6299e..7a2162c783e 100644
--- a/acceptance/bundle/telemetry/deploy-experimental/script
+++ b/acceptance/bundle/telemetry/deploy-experimental/script
@@ -1,5 +1,5 @@
 trace $CLI bundle deploy
 
-trace cat out.requests.txt | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log.bundle_deploy_event.experimental | {bool_values}'
+trace print_telemetry_bool_values
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/telemetry/deploy-failed-engine-unknown/databricks.yml b/acceptance/bundle/telemetry/deploy-failed-engine-unknown/databricks.yml
new file mode 100644
index 00000000000..44996a4e040
--- /dev/null
+++ b/acceptance/bundle/telemetry/deploy-failed-engine-unknown/databricks.yml
@@ -0,0 +1,15 @@
+bundle:
+  name: test-bundle
+  uuid: 11111111-2222-3333-4444-555555555555
+
+# Restrict the sync to a single file under src/ so the file upload (and thus the
+# forced failure below) is deterministic and does not sweep up acceptance-harness
+# files written during the run.
+sync:
+  paths:
+    - src
+
+resources:
+  jobs:
+    job_one:
+      name: job one
diff --git a/acceptance/bundle/telemetry/deploy-failed-engine-unknown/out.resources_metadata.txt b/acceptance/bundle/telemetry/deploy-failed-engine-unknown/out.resources_metadata.txt
new file mode 100644
index 00000000000..a403bee65c8
--- /dev/null
+++ b/acceptance/bundle/telemetry/deploy-failed-engine-unknown/out.resources_metadata.txt
@@ -0,0 +1,9 @@
+{
+  "state_engine": "direct",
+  "resources": [
+    {
+      "resource_type": "jobs",
+      "count": 1
+    }
+  ]
+}
diff --git a/acceptance/bundle/telemetry/deploy-failed-engine-unknown/out.test.toml b/acceptance/bundle/telemetry/deploy-failed-engine-unknown/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/telemetry/deploy-failed-engine-unknown/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/telemetry/deploy-failed-engine-unknown/output.txt b/acceptance/bundle/telemetry/deploy-failed-engine-unknown/output.txt
new file mode 100644
index 00000000000..df5252aa3d7
--- /dev/null
+++ b/acceptance/bundle/telemetry/deploy-failed-engine-unknown/output.txt
@@ -0,0 +1,12 @@
+
+>>> [CLI] bundle deploy
+Error: Failed to acquire deployment lock: failed to upload /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock: Internal error
+Error: failed to upload /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock: Internal error (500 INTERNAL_ERROR)
+
+Endpoint: POST [DATABRICKS_URL]/api/2.0/workspace/import
+HTTP Status: 500 Internal Server Error
+API error_code: INTERNAL_ERROR
+API message: Internal error
+
+
+Exit code: 1
diff --git a/acceptance/bundle/telemetry/deploy-failed-engine-unknown/script b/acceptance/bundle/telemetry/deploy-failed-engine-unknown/script
new file mode 100644
index 00000000000..2031cba0e21
--- /dev/null
+++ b/acceptance/bundle/telemetry/deploy-failed-engine-unknown/script
@@ -0,0 +1,13 @@
+errcode trace $CLI bundle deploy
+
+cat "$OUT_REQUESTS" | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson' > telemetry.json
+
+# The deploy fails before deployCore runs (the deployment-lock write is stubbed to
+# 500), yet resources_metadata still reports state_engine: b.Metrics.StateEngine is
+# set as soon as the deployment state is pulled, not only inside deployCore. Before
+# that fix state_engine was empty on this path, which the dashboard showed as
+# engine="unknown". state_engine is engine-specific, so capture it per-engine.
+cat telemetry.json | jq '.entry.databricks_cli_log.bundle_deploy_event.resources_metadata' > out.resources_metadata.txt
+
+rm "$OUT_REQUESTS"
+rm telemetry.json
diff --git a/acceptance/bundle/telemetry/deploy-failed-engine-unknown/src/file.txt b/acceptance/bundle/telemetry/deploy-failed-engine-unknown/src/file.txt
new file mode 100644
index 00000000000..ce013625030
--- /dev/null
+++ b/acceptance/bundle/telemetry/deploy-failed-engine-unknown/src/file.txt
@@ -0,0 +1 @@
+hello
diff --git a/acceptance/bundle/telemetry/deploy-failed-engine-unknown/test.toml b/acceptance/bundle/telemetry/deploy-failed-engine-unknown/test.toml
new file mode 100644
index 00000000000..1e685cca603
--- /dev/null
+++ b/acceptance/bundle/telemetry/deploy-failed-engine-unknown/test.toml
@@ -0,0 +1,17 @@
+# A deploy that fails before it starts applying resources (here it fails while
+# acquiring the deployment lock) still emits a bundle_deploy_event via the deferred
+# LogDeployTelemetry in cmd/bundle/utils/process.go. b.Metrics.StateEngine is set as
+# soon as the deployment state is pulled, so resources_metadata reports the engine
+# even though deployCore never runs on this path. Before that fix state_engine was
+# empty here, which the dashboard surfaced as engine="unknown".
+#
+# The stubbed endpoint is the one the workspace filer writes through, so the first
+# write - the deploy.lock file in lock.Acquire - is what fails here. A failed deploy
+# records no per-resource state sizes for either engine, so resources_metadata
+# diverges across the engine matrix only in state_engine; it is captured per-engine.
+Cloud = false
+
+[[Server]]
+Pattern = "POST /api/2.0/workspace/import"
+Response.StatusCode = 500
+Response.Body = '''{"error_code": "INTERNAL_ERROR", "message": "Internal error"}'''
diff --git a/acceptance/bundle/telemetry/deploy-failed-state-pull/.databricks/bundle/default/resources.json b/acceptance/bundle/telemetry/deploy-failed-state-pull/.databricks/bundle/default/resources.json
new file mode 100644
index 00000000000..d22af0c978a
--- /dev/null
+++ b/acceptance/bundle/telemetry/deploy-failed-state-pull/.databricks/bundle/default/resources.json
@@ -0,0 +1 @@
+this is not valid state json
diff --git a/acceptance/bundle/telemetry/deploy-failed-state-pull/databricks.yml b/acceptance/bundle/telemetry/deploy-failed-state-pull/databricks.yml
new file mode 100644
index 00000000000..9c21260c193
--- /dev/null
+++ b/acceptance/bundle/telemetry/deploy-failed-state-pull/databricks.yml
@@ -0,0 +1,8 @@
+bundle:
+  name: test-bundle
+  uuid: 11111111-2222-3333-4444-555555555555
+
+resources:
+  jobs:
+    job_one:
+      name: job one
diff --git a/acceptance/bundle/telemetry/deploy-failed-state-pull/out.resources_metadata.txt b/acceptance/bundle/telemetry/deploy-failed-state-pull/out.resources_metadata.txt
new file mode 100644
index 00000000000..a403bee65c8
--- /dev/null
+++ b/acceptance/bundle/telemetry/deploy-failed-state-pull/out.resources_metadata.txt
@@ -0,0 +1,9 @@
+{
+  "state_engine": "direct",
+  "resources": [
+    {
+      "resource_type": "jobs",
+      "count": 1
+    }
+  ]
+}
diff --git a/acceptance/bundle/telemetry/deploy-failed-state-pull/out.test.toml b/acceptance/bundle/telemetry/deploy-failed-state-pull/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/telemetry/deploy-failed-state-pull/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/telemetry/deploy-failed-state-pull/output.txt b/acceptance/bundle/telemetry/deploy-failed-state-pull/output.txt
new file mode 100644
index 00000000000..8a83b3a8a8a
--- /dev/null
+++ b/acceptance/bundle/telemetry/deploy-failed-state-pull/output.txt
@@ -0,0 +1,6 @@
+
+>>> [CLI] bundle deploy
+Error: parsing [TEST_TMP_DIR]/.databricks/bundle/default/resources.json: invalid character 'h' in literal true (expecting 'r')
+
+
+Exit code: 1
diff --git a/acceptance/bundle/telemetry/deploy-failed-state-pull/script b/acceptance/bundle/telemetry/deploy-failed-state-pull/script
new file mode 100644
index 00000000000..82dbddd40f5
--- /dev/null
+++ b/acceptance/bundle/telemetry/deploy-failed-state-pull/script
@@ -0,0 +1,13 @@
+errcode trace $CLI bundle deploy
+
+cat "$OUT_REQUESTS" | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson' > telemetry.json
+
+# resources_metadata reports state_engine even though the deploy failed while pulling
+# the state: b.Metrics.StateEngine is set from the requested engine before the pull.
+# state_engine is engine-specific, so capture it per-engine. state_file_size_bytes is
+# dropped: it is os.Stat of the (committed) resources.json, whose byte count can shift
+# with line-ending conversion across platforms.
+cat telemetry.json | jq '.entry.databricks_cli_log.bundle_deploy_event.resources_metadata | if . then del(.state_file_size_bytes) else . end' > out.resources_metadata.txt
+
+rm "$OUT_REQUESTS"
+rm telemetry.json
diff --git a/acceptance/bundle/telemetry/deploy-failed-state-pull/test.toml b/acceptance/bundle/telemetry/deploy-failed-state-pull/test.toml
new file mode 100644
index 00000000000..45a917f44e8
--- /dev/null
+++ b/acceptance/bundle/telemetry/deploy-failed-state-pull/test.toml
@@ -0,0 +1,13 @@
+# A deploy that fails while pulling the deployment state - before the state's engine
+# is known - still emits a bundle_deploy_event via the deferred LogDeployTelemetry.
+# b.Metrics.StateEngine is set from the requested engine as soon as it is resolved
+# (before the state pull), so resources_metadata reports the engine here too. Without
+# that early assignment state_engine was empty on this path, which the dashboard
+# surfaced as engine="unknown".
+#
+# The committed .databricks/bundle/default/resources.json holds invalid JSON, so the
+# local state read fails to parse and the pull errors out before the state's engine is
+# determined. The engine reported is the requested one, which the acceptance matrix
+# varies, so resources_metadata is captured per-engine.
+Cloud = false
+Ignore = [".databricks"]
diff --git a/acceptance/bundle/telemetry/deploy-mode/out.test.toml b/acceptance/bundle/telemetry/deploy-mode/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/telemetry/deploy-mode/out.test.toml
+++ b/acceptance/bundle/telemetry/deploy-mode/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/telemetry/deploy-mode/output.txt b/acceptance/bundle/telemetry/deploy-mode/output.txt
index 99e7fbb699a..5d8c9ad8fd3 100644
--- a/acceptance/bundle/telemetry/deploy-mode/output.txt
+++ b/acceptance/bundle/telemetry/deploy-mode/output.txt
@@ -1,8 +1,8 @@
 
 >>> [CLI] bundle deploy -t dev
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/dev/files...
-Deploying resources...
-Deployment complete!
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle deploy -t prod
 Recommendation: target with 'mode: production' should set 'workspace.root_path' to make sure only one copy is deployed
@@ -12,10 +12,10 @@ A common practice is to use a username or principal name in this path, i.e. use
   root_path: /Workspace/Users/[USERNAME]/.bundle/${bundle.name}/${bundle.target}
 
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/prod/files...
-Deploying resources...
-Deployment complete!
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
 
->>> cat out.requests.txt
+>>> cat [OUTPUT_DIR]/out.requests.txt
 {
   "bundle_mode": "DEVELOPMENT"
 }
diff --git a/acceptance/bundle/telemetry/deploy-mode/script b/acceptance/bundle/telemetry/deploy-mode/script
index f7257769ac1..82299828e12 100644
--- a/acceptance/bundle/telemetry/deploy-mode/script
+++ b/acceptance/bundle/telemetry/deploy-mode/script
@@ -2,6 +2,6 @@ trace $CLI bundle deploy -t dev
 
 trace $CLI bundle deploy -t prod
 
-trace cat out.requests.txt | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log.bundle_deploy_event.experimental | {bundle_mode}'
+trace cat "$OUT_REQUESTS" | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log.bundle_deploy_event.experimental | {bundle_mode}'
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/telemetry/deploy-name-prefix/custom/out.test.toml b/acceptance/bundle/telemetry/deploy-name-prefix/custom/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/telemetry/deploy-name-prefix/custom/out.test.toml
+++ b/acceptance/bundle/telemetry/deploy-name-prefix/custom/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/telemetry/deploy-name-prefix/custom/output.txt b/acceptance/bundle/telemetry/deploy-name-prefix/custom/output.txt
index 31ff8e9cf7e..f71dbd423dc 100644
--- a/acceptance/bundle/telemetry/deploy-name-prefix/custom/output.txt
+++ b/acceptance/bundle/telemetry/deploy-name-prefix/custom/output.txt
@@ -1,52 +1,28 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/custom-prefix/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created schemas.foo
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
->>> cat out.requests.txt
-{
-  "bool_values": [
-    {
-      "key": "local.cache.attempt",
-      "value": true
-    },
-    {
-      "key": "local.cache.miss",
-      "value": true
-    },
-    {
-      "key": "experimental.use_legacy_run_as",
-      "value": false
-    },
-    {
-      "key": "run_as_set",
-      "value": false
-    },
-    {
-      "key": "presets_name_prefix_is_set",
-      "value": true
-    },
-    {
-      "key": "python_wheel_wrapper_is_set",
-      "value": false
-    },
-    {
-      "key": "skip_artifact_cleanup",
-      "value": false
-    },
-    {
-      "key": "has_serverless_compute",
-      "value": false
-    },
-    {
-      "key": "has_classic_job_compute",
-      "value": false
-    },
-    {
-      "key": "has_classic_interactive_compute",
-      "value": false
-    }
-  ]
-}
+>>> print_telemetry_bool_values
+dms_compat_auto true
+dms_undeclared_deploying_user false
+dms_undeclared_group false
+dms_undeclared_other_user false
+dms_undeclared_service_principal false
+experimental.use_legacy_run_as false
+has_classic_interactive_compute false
+has_classic_job_compute false
+has_serverless_compute false
+local.cache.attempt true
+local.cache.miss true
+permissions_section_set false
+presets_name_prefix_is_set true
+python_wheel_wrapper_is_set false
+run_as_set false
+skip_artifact_cleanup false
+state_path_in_deployer_home true
+state_path_in_other_user_home false
+state_path_is_shared false
+state_path_other false
diff --git a/acceptance/bundle/telemetry/deploy-name-prefix/custom/script b/acceptance/bundle/telemetry/deploy-name-prefix/custom/script
index 67a3ba6299e..7a2162c783e 100644
--- a/acceptance/bundle/telemetry/deploy-name-prefix/custom/script
+++ b/acceptance/bundle/telemetry/deploy-name-prefix/custom/script
@@ -1,5 +1,5 @@
 trace $CLI bundle deploy
 
-trace cat out.requests.txt | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log.bundle_deploy_event.experimental | {bool_values}'
+trace print_telemetry_bool_values
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/telemetry/deploy-name-prefix/mode-development/out.test.toml b/acceptance/bundle/telemetry/deploy-name-prefix/mode-development/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/telemetry/deploy-name-prefix/mode-development/out.test.toml
+++ b/acceptance/bundle/telemetry/deploy-name-prefix/mode-development/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/telemetry/deploy-name-prefix/mode-development/output.txt b/acceptance/bundle/telemetry/deploy-name-prefix/mode-development/output.txt
index 39b671bec32..ae9172ced5b 100644
--- a/acceptance/bundle/telemetry/deploy-name-prefix/mode-development/output.txt
+++ b/acceptance/bundle/telemetry/deploy-name-prefix/mode-development/output.txt
@@ -1,52 +1,28 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/development-prefix/development/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created schemas.foo
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
->>> cat out.requests.txt
-{
-  "bool_values": [
-    {
-      "key": "local.cache.attempt",
-      "value": true
-    },
-    {
-      "key": "local.cache.miss",
-      "value": true
-    },
-    {
-      "key": "experimental.use_legacy_run_as",
-      "value": false
-    },
-    {
-      "key": "run_as_set",
-      "value": false
-    },
-    {
-      "key": "presets_name_prefix_is_set",
-      "value": true
-    },
-    {
-      "key": "python_wheel_wrapper_is_set",
-      "value": false
-    },
-    {
-      "key": "skip_artifact_cleanup",
-      "value": false
-    },
-    {
-      "key": "has_serverless_compute",
-      "value": false
-    },
-    {
-      "key": "has_classic_job_compute",
-      "value": false
-    },
-    {
-      "key": "has_classic_interactive_compute",
-      "value": false
-    }
-  ]
-}
+>>> print_telemetry_bool_values
+dms_compat_auto true
+dms_undeclared_deploying_user false
+dms_undeclared_group false
+dms_undeclared_other_user false
+dms_undeclared_service_principal false
+experimental.use_legacy_run_as false
+has_classic_interactive_compute false
+has_classic_job_compute false
+has_serverless_compute false
+local.cache.attempt true
+local.cache.miss true
+permissions_section_set false
+presets_name_prefix_is_set true
+python_wheel_wrapper_is_set false
+run_as_set false
+skip_artifact_cleanup false
+state_path_in_deployer_home true
+state_path_in_other_user_home false
+state_path_is_shared false
+state_path_other false
diff --git a/acceptance/bundle/telemetry/deploy-name-prefix/mode-development/script b/acceptance/bundle/telemetry/deploy-name-prefix/mode-development/script
index 67a3ba6299e..7a2162c783e 100644
--- a/acceptance/bundle/telemetry/deploy-name-prefix/mode-development/script
+++ b/acceptance/bundle/telemetry/deploy-name-prefix/mode-development/script
@@ -1,5 +1,5 @@
 trace $CLI bundle deploy
 
-trace cat out.requests.txt | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log.bundle_deploy_event.experimental | {bool_values}'
+trace print_telemetry_bool_values
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/telemetry/deploy-no-uuid/out.test.toml b/acceptance/bundle/telemetry/deploy-no-uuid/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/telemetry/deploy-no-uuid/out.test.toml
+++ b/acceptance/bundle/telemetry/deploy-no-uuid/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/telemetry/deploy-no-uuid/output.txt b/acceptance/bundle/telemetry/deploy-no-uuid/output.txt
index 7f14a3bdd74..26a8fcdd414 100644
--- a/acceptance/bundle/telemetry/deploy-no-uuid/output.txt
+++ b/acceptance/bundle/telemetry/deploy-no-uuid/output.txt
@@ -1,8 +1,8 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.job_one
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
->>> cat out.requests.txt
+>>> cat [OUTPUT_DIR]/out.requests.txt
diff --git a/acceptance/bundle/telemetry/deploy-no-uuid/script b/acceptance/bundle/telemetry/deploy-no-uuid/script
index 501b3dd76a9..f560be1b643 100644
--- a/acceptance/bundle/telemetry/deploy-no-uuid/script
+++ b/acceptance/bundle/telemetry/deploy-no-uuid/script
@@ -1,7 +1,7 @@
 trace $CLI bundle deploy
 
-trace cat out.requests.txt | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log.bundle_deploy_event | {bundle_uuid}' > out.telemetry.txt
+trace cat "$OUT_REQUESTS" | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log.bundle_deploy_event | {bundle_uuid}' > out.telemetry.txt
 
 update_file.py out.telemetry.txt "00000000-0000-0000-0000-000000000000"  '[ZERO_UUID]'
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/telemetry/deploy-run-as/out.test.toml b/acceptance/bundle/telemetry/deploy-run-as/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/telemetry/deploy-run-as/out.test.toml
+++ b/acceptance/bundle/telemetry/deploy-run-as/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/telemetry/deploy-run-as/output.txt b/acceptance/bundle/telemetry/deploy-run-as/output.txt
index 9dc650550cc..e6b42026853 100644
--- a/acceptance/bundle/telemetry/deploy-run-as/output.txt
+++ b/acceptance/bundle/telemetry/deploy-run-as/output.txt
@@ -1,11 +1,11 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.test_job
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
->>> cat out.requests.txt
+>>> cat [OUTPUT_DIR]/out.requests.txt
 
 >>> cat telemetry.json
 {
diff --git a/acceptance/bundle/telemetry/deploy-run-as/script b/acceptance/bundle/telemetry/deploy-run-as/script
index 697baaed6f7..7b09b768ccd 100644
--- a/acceptance/bundle/telemetry/deploy-run-as/script
+++ b/acceptance/bundle/telemetry/deploy-run-as/script
@@ -1,8 +1,8 @@
 trace $CLI bundle deploy
 
-trace cat out.requests.txt | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson' > telemetry.json
+trace cat "$OUT_REQUESTS" | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson' > telemetry.json
 
 trace cat telemetry.json | jq '.entry.databricks_cli_log.bundle_deploy_event.experimental.bool_values[] | select(.key == "run_as_set")'
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
 rm telemetry.json
diff --git a/acceptance/bundle/telemetry/deploy-run-as/test.toml b/acceptance/bundle/telemetry/deploy-run-as/test.toml
deleted file mode 100644
index 7d36fb9dc18..00000000000
--- a/acceptance/bundle/telemetry/deploy-run-as/test.toml
+++ /dev/null
@@ -1,2 +0,0 @@
-Local = true
-Cloud = false
diff --git a/acceptance/bundle/telemetry/deploy-target-count/out.test.toml b/acceptance/bundle/telemetry/deploy-target-count/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/telemetry/deploy-target-count/out.test.toml
+++ b/acceptance/bundle/telemetry/deploy-target-count/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/telemetry/deploy-target-count/output.txt b/acceptance/bundle/telemetry/deploy-target-count/output.txt
index 31581169f2c..65a679e37fa 100644
--- a/acceptance/bundle/telemetry/deploy-target-count/output.txt
+++ b/acceptance/bundle/telemetry/deploy-target-count/output.txt
@@ -1,10 +1,10 @@
 
 >>> [CLI] bundle deploy -t one
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/one/files...
-Deploying resources...
-Deployment complete!
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
 
->>> cat out.requests.txt
+>>> cat [OUTPUT_DIR]/out.requests.txt
 {
   "target_count": 3
 }
diff --git a/acceptance/bundle/telemetry/deploy-target-count/script b/acceptance/bundle/telemetry/deploy-target-count/script
index 3022a2b5e49..2ec746e3ffd 100644
--- a/acceptance/bundle/telemetry/deploy-target-count/script
+++ b/acceptance/bundle/telemetry/deploy-target-count/script
@@ -1,5 +1,5 @@
 trace $CLI bundle deploy -t one
 
-trace cat out.requests.txt | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log.bundle_deploy_event.experimental | {target_count}'
+trace cat "$OUT_REQUESTS" | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log.bundle_deploy_event.experimental | {target_count}'
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/telemetry/deploy-variable-count/out.test.toml b/acceptance/bundle/telemetry/deploy-variable-count/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/telemetry/deploy-variable-count/out.test.toml
+++ b/acceptance/bundle/telemetry/deploy-variable-count/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/telemetry/deploy-variable-count/output.txt b/acceptance/bundle/telemetry/deploy-variable-count/output.txt
index be4840e69ef..f9a433e5007 100644
--- a/acceptance/bundle/telemetry/deploy-variable-count/output.txt
+++ b/acceptance/bundle/telemetry/deploy-variable-count/output.txt
@@ -1,10 +1,10 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Deployment complete!
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
 
->>> cat out.requests.txt
+>>> cat [OUTPUT_DIR]/out.requests.txt
 {
   "variable_count": 6,
   "lookup_variable_count": 2,
diff --git a/acceptance/bundle/telemetry/deploy-variable-count/script b/acceptance/bundle/telemetry/deploy-variable-count/script
index dad762899a2..ee4f3e29e4a 100644
--- a/acceptance/bundle/telemetry/deploy-variable-count/script
+++ b/acceptance/bundle/telemetry/deploy-variable-count/script
@@ -1,5 +1,5 @@
 trace $CLI bundle deploy
 
-trace cat out.requests.txt | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs.[] | fromjson | .entry.databricks_cli_log.bundle_deploy_event.experimental | {variable_count, lookup_variable_count, complex_variable_count}'
+trace cat "$OUT_REQUESTS" | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs.[] | fromjson | .entry.databricks_cli_log.bundle_deploy_event.experimental | {variable_count, lookup_variable_count, complex_variable_count}'
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/telemetry/deploy-whl-artifacts/out.test.toml b/acceptance/bundle/telemetry/deploy-whl-artifacts/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/telemetry/deploy-whl-artifacts/out.test.toml
+++ b/acceptance/bundle/telemetry/deploy-whl-artifacts/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/telemetry/deploy-whl-artifacts/output.txt b/acceptance/bundle/telemetry/deploy-whl-artifacts/output.txt
index a9b8ce4ae6e..3e3f4d9d66e 100644
--- a/acceptance/bundle/telemetry/deploy-whl-artifacts/output.txt
+++ b/acceptance/bundle/telemetry/deploy-whl-artifacts/output.txt
@@ -3,98 +3,53 @@
 Building test...
 Uploading my_test_code/dist/my_test_code-0.0.1-py3-none-any.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/one/files...
-Deploying resources...
-Deployment complete!
+Files: 6 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle deploy -t two
 Building test...
 Uploading .databricks/bundle/two/patched_wheels/test_my_test_code/my_test_code-0.0.1+[UNIX_TIME_NANOS]-py3-none-any.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/two/files...
-Deploying resources...
-Deployment complete!
+Files: 6 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
 
->>> cat out.requests.txt
-{
-  "bool_values": [
-    {
-      "key": "local.cache.attempt",
-      "value": true
-    },
-    {
-      "key": "local.cache.miss",
-      "value": true
-    },
-    {
-      "key": "artifact_build_command_is_set",
-      "value": false
-    },
-    {
-      "key": "artifact_files_is_set",
-      "value": false
-    },
-    {
-      "key": "python_wheel_wrapper_is_set",
-      "value": false
-    },
-    {
-      "key": "skip_artifact_cleanup",
-      "value": false
-    },
-    {
-      "key": "has_serverless_compute",
-      "value": false
-    },
-    {
-      "key": "has_classic_job_compute",
-      "value": false
-    },
-    {
-      "key": "has_classic_interactive_compute",
-      "value": false
-    }
-  ]
-}
-{
-  "bool_values": [
-    {
-      "key": "local.cache.attempt",
-      "value": true
-    },
-    {
-      "key": "local.cache.hit",
-      "value": true
-    },
-    {
-      "key": "artifact_build_command_is_set",
-      "value": true
-    },
-    {
-      "key": "artifact_files_is_set",
-      "value": true
-    },
-    {
-      "key": "artifact_dynamic_version_is_set",
-      "value": true
-    },
-    {
-      "key": "python_wheel_wrapper_is_set",
-      "value": true
-    },
-    {
-      "key": "skip_artifact_cleanup",
-      "value": true
-    },
-    {
-      "key": "has_serverless_compute",
-      "value": false
-    },
-    {
-      "key": "has_classic_job_compute",
-      "value": false
-    },
-    {
-      "key": "has_classic_interactive_compute",
-      "value": false
-    }
-  ]
-}
+>>> print_telemetry_bool_values
+artifact_build_command_is_set false
+artifact_build_command_is_set true
+artifact_dynamic_version_is_set true
+artifact_files_is_set false
+artifact_files_is_set true
+dms_compat_auto true
+dms_compat_auto true
+dms_undeclared_deploying_user false
+dms_undeclared_deploying_user false
+dms_undeclared_group false
+dms_undeclared_group false
+dms_undeclared_other_user false
+dms_undeclared_other_user false
+dms_undeclared_service_principal false
+dms_undeclared_service_principal false
+has_classic_interactive_compute false
+has_classic_interactive_compute false
+has_classic_job_compute false
+has_classic_job_compute false
+has_serverless_compute false
+has_serverless_compute false
+local.cache.attempt true
+local.cache.attempt true
+local.cache.hit true
+local.cache.miss true
+permissions_section_set false
+permissions_section_set false
+python_wheel_wrapper_is_set false
+python_wheel_wrapper_is_set true
+skip_artifact_cleanup false
+skip_artifact_cleanup true
+state_path_in_deployer_home true
+state_path_in_deployer_home true
+state_path_in_other_user_home false
+state_path_in_other_user_home false
+state_path_is_shared false
+state_path_is_shared false
+state_path_other false
+state_path_other false
diff --git a/acceptance/bundle/telemetry/deploy-whl-artifacts/script b/acceptance/bundle/telemetry/deploy-whl-artifacts/script
index 078fa94cdd3..a27bbd0113c 100644
--- a/acceptance/bundle/telemetry/deploy-whl-artifacts/script
+++ b/acceptance/bundle/telemetry/deploy-whl-artifacts/script
@@ -6,6 +6,6 @@ trace $CLI bundle deploy -t one
 
 trace $CLI bundle deploy -t two
 
-trace cat out.requests.txt | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log.bundle_deploy_event.experimental | {bool_values}'
+trace print_telemetry_bool_values
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/telemetry/deploy-workspace-folder-permissions/databricks.yml b/acceptance/bundle/telemetry/deploy-workspace-folder-permissions/databricks.yml
new file mode 100644
index 00000000000..ac728ed8a0f
--- /dev/null
+++ b/acceptance/bundle/telemetry/deploy-workspace-folder-permissions/databricks.yml
@@ -0,0 +1,58 @@
+bundle:
+  name: test-bundle
+
+# The deploying user is tester@databricks.com. A workspace folder under
+# /Workspace/Users/<owner> grants <owner> CAN_MANAGE, which the deploy observes as
+# inherited access in the SetPermissions response.
+targets:
+  # No permissions section: the migration mirrors the state folder's ACLs onto the
+  # deployment, so access is preserved wherever the state lives.
+  no_permissions:
+    default: true
+
+  # The deploying user (the home owner of the state folder) is declared.
+  user_declared:
+    permissions:
+      - user_name: ${workspace.current_user.userName}
+        level: CAN_MANAGE
+
+  # The deploying user (the home owner, with inherited CAN_MANAGE) is the only
+  # undeclared writer, so the migration could preserve them by granting the deployer.
+  user_not_declared:
+    permissions:
+      - group_name: team
+        level: CAN_MANAGE
+
+  # The state lives under another user's home, where that user has inherited CAN_MANAGE
+  # that the bundle does not declare.
+  other_user_not_declared:
+    permissions:
+      - user_name: ${workspace.current_user.userName}
+        level: CAN_MANAGE
+    workspace:
+      state_path: /Workspace/Users/other@example.com/test-bundle-state
+
+  # The state lives in a non-home, non-shared workspace folder.
+  workspace_other:
+    permissions:
+      - user_name: ${workspace.current_user.userName}
+        level: CAN_MANAGE
+    workspace:
+      state_path: /Workspace/teams/test-bundle-state
+
+  # A shared state folder is writable by all workspace users; that access is declared
+  # via group_name: users CAN_MANAGE.
+  shared_users_can_manage:
+    permissions:
+      - group_name: users
+        level: CAN_MANAGE
+    workspace:
+      state_path: /Workspace/Shared/test-bundle-state
+
+  # A shared state folder without group_name: users CAN_MANAGE declared.
+  shared_not_declared:
+    permissions:
+      - user_name: ${workspace.current_user.userName}
+        level: CAN_MANAGE
+    workspace:
+      state_path: /Workspace/Shared/test-bundle-state
diff --git a/acceptance/bundle/telemetry/deploy-workspace-folder-permissions/out.test.toml b/acceptance/bundle/telemetry/deploy-workspace-folder-permissions/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/telemetry/deploy-workspace-folder-permissions/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/telemetry/deploy-workspace-folder-permissions/output.txt b/acceptance/bundle/telemetry/deploy-workspace-folder-permissions/output.txt
new file mode 100644
index 00000000000..32b813560a0
--- /dev/null
+++ b/acceptance/bundle/telemetry/deploy-workspace-folder-permissions/output.txt
@@ -0,0 +1,143 @@
+
+>>> [CLI] bundle deploy -t no_permissions
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/no_permissions/files...
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_telemetry_bool_values
+dms_compat_auto true
+dms_undeclared_deploying_user false
+dms_undeclared_group false
+dms_undeclared_other_user false
+dms_undeclared_service_principal false
+permissions_section_set false
+state_path_in_deployer_home true
+state_path_in_other_user_home false
+state_path_is_shared false
+state_path_other false
+
+>>> [CLI] bundle deploy -t user_declared
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/user_declared/files...
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_telemetry_bool_values
+dms_compat_auto true
+dms_undeclared_deploying_user false
+dms_undeclared_group false
+dms_undeclared_other_user false
+dms_undeclared_service_principal false
+permissions_section_set true
+state_path_in_deployer_home true
+state_path_in_other_user_home false
+state_path_is_shared false
+state_path_other false
+
+>>> [CLI] bundle deploy -t user_not_declared
+Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
+If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
+
+Consider using a adding a top-level permissions section such as the following:
+
+  permissions:
+    - user_name: [USERNAME]
+      level: CAN_MANAGE
+
+See https://docs.databricks.com/dev-tools/bundles/permissions.html to learn more about permission configuration.
+  in databricks.yml:23:7
+
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/user_not_declared/files...
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_telemetry_bool_values
+dms_compat_only_self_undeclared true
+dms_undeclared_deploying_user true
+dms_undeclared_group false
+dms_undeclared_other_user false
+dms_undeclared_service_principal false
+permissions_section_set true
+state_path_in_deployer_home true
+state_path_in_other_user_home false
+state_path_is_shared false
+state_path_other false
+
+>>> [CLI] bundle deploy -t other_user_not_declared
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/other_user_not_declared/files...
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_telemetry_bool_values
+dms_compat_not true
+dms_undeclared_deploying_user false
+dms_undeclared_group false
+dms_undeclared_other_user true
+dms_undeclared_service_principal false
+permissions_section_set true
+state_path_in_deployer_home false
+state_path_in_other_user_home true
+state_path_is_shared false
+state_path_other false
+
+>>> [CLI] bundle deploy -t workspace_other
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/workspace_other/files...
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_telemetry_bool_values
+dms_compat_auto true
+dms_undeclared_deploying_user false
+dms_undeclared_group false
+dms_undeclared_other_user false
+dms_undeclared_service_principal false
+permissions_section_set true
+state_path_in_deployer_home false
+state_path_in_other_user_home false
+state_path_is_shared false
+state_path_other true
+
+>>> [CLI] bundle deploy -t shared_users_can_manage
+Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
+If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
+
+Consider using a adding a top-level permissions section such as the following:
+
+  permissions:
+    - user_name: [USERNAME]
+      level: CAN_MANAGE
+
+See https://docs.databricks.com/dev-tools/bundles/permissions.html to learn more about permission configuration.
+  in databricks.yml:47:7
+
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/shared_users_can_manage/files...
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_telemetry_bool_values
+dms_compat_auto true
+dms_undeclared_deploying_user false
+dms_undeclared_group false
+dms_undeclared_other_user false
+dms_undeclared_service_principal false
+permissions_section_set true
+state_path_in_deployer_home false
+state_path_in_other_user_home false
+state_path_is_shared true
+state_path_other false
+
+>>> [CLI] bundle deploy -t shared_not_declared
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/shared_not_declared/files...
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> print_telemetry_bool_values
+dms_compat_not true
+dms_undeclared_deploying_user false
+dms_undeclared_group true
+dms_undeclared_other_user false
+dms_undeclared_service_principal false
+permissions_section_set true
+state_path_in_deployer_home false
+state_path_in_other_user_home false
+state_path_is_shared true
+state_path_other false
diff --git a/acceptance/bundle/telemetry/deploy-workspace-folder-permissions/script b/acceptance/bundle/telemetry/deploy-workspace-folder-permissions/script
new file mode 100644
index 00000000000..6af35df7846
--- /dev/null
+++ b/acceptance/bundle/telemetry/deploy-workspace-folder-permissions/script
@@ -0,0 +1,12 @@
+for target in \
+	no_permissions \
+	user_declared \
+	user_not_declared \
+	other_user_not_declared \
+	workspace_other \
+	shared_users_can_manage \
+	shared_not_declared; do
+	trace $CLI bundle deploy -t "$target"
+	trace print_telemetry_bool_values | grep -E "state_path|permissions_section|dms_"
+	rm "$OUT_REQUESTS"
+done
diff --git a/acceptance/bundle/telemetry/deploy/databricks.yml b/acceptance/bundle/telemetry/deploy/databricks.yml
index 3a20a11c291..1f9769b5496 100644
--- a/acceptance/bundle/telemetry/deploy/databricks.yml
+++ b/acceptance/bundle/telemetry/deploy/databricks.yml
@@ -2,6 +2,15 @@ bundle:
   name: test-bundle
   uuid: 11111111-2222-3333-4444-555555555555
 
+# Restrict the upload to a fixed set of files under src/ so upload_file_count and
+# upload_file_sizes in the telemetry event are deterministic. Without this the sync
+# would also sweep up acceptance-harness files written during the run
+# (out.requests.txt, output.txt, ...), whose sizes vary. The src/ files span three
+# size buckets (small, ~1.4 KiB, ~6 KiB) so the histogram has multiple non-zero entries.
+sync:
+  paths:
+    - src
+
 resources:
   jobs:
     job_one:
diff --git a/acceptance/bundle/telemetry/deploy/out.engine.txt b/acceptance/bundle/telemetry/deploy/out.engine.txt
new file mode 100644
index 00000000000..fe51488c706
--- /dev/null
+++ b/acceptance/bundle/telemetry/deploy/out.engine.txt
@@ -0,0 +1 @@
+[]
diff --git a/acceptance/bundle/telemetry/deploy/out.resources_metadata.txt b/acceptance/bundle/telemetry/deploy/out.resources_metadata.txt
new file mode 100644
index 00000000000..551a48fa89b
--- /dev/null
+++ b/acceptance/bundle/telemetry/deploy/out.resources_metadata.txt
@@ -0,0 +1,19 @@
+{
+  "state_engine": "direct",
+  "resources": [
+    {
+      "resource_type": "jobs",
+      "count": 3,
+      "state_size_max_bytes": 256,
+      "state_size_mean_bytes": 254,
+      "state_size_median_bytes": 254
+    },
+    {
+      "resource_type": "pipelines",
+      "count": 2,
+      "state_size_max_bytes": 205,
+      "state_size_mean_bytes": 205,
+      "state_size_median_bytes": 205
+    }
+  ]
+}
diff --git a/acceptance/bundle/telemetry/deploy/out.telemetry.txt b/acceptance/bundle/telemetry/deploy/out.telemetry.txt
index f945233dd16..45a366836f1 100644
--- a/acceptance/bundle/telemetry/deploy/out.telemetry.txt
+++ b/acceptance/bundle/telemetry/deploy/out.telemetry.txt
@@ -4,7 +4,7 @@
     "databricks_cli_log": {
       "execution_context": {
         "cmd_exec_id": "[CMD-EXEC-ID]",
-        "version": "[DEV_VERSION]",
+        "version": "[CLI_VERSION]",
         "command": "bundle_deploy",
         "operating_system": "[OS]",
         "execution_time_ms": SMALL_INT,
@@ -27,13 +27,13 @@
         "resource_dashboard_count": 0,
         "resource_app_count": 0,
         "resource_job_ids": [
-          "[NUMID]",
-          "[NUMID]",
-          "[NUMID]"
+          "[JOB_ONE_ID]",
+          "[JOB_THREE_ID]",
+          "[JOB_TWO_ID]"
         ],
         "resource_pipeline_ids": [
-          "[UUID]",
-          "[UUID]"
+          "[PIPELINE_ONE_ID]",
+          "[PIPELINE_TWO_ID]"
         ],
         "experimental": {
           "configuration_file_count": 1,
@@ -70,6 +70,46 @@
               "key": "skip_artifact_cleanup",
               "value": false
             },
+            {
+              "key": "state_path_is_shared",
+              "value": false
+            },
+            {
+              "key": "permissions_section_set",
+              "value": false
+            },
+            {
+              "key": "state_path_in_deployer_home",
+              "value": true
+            },
+            {
+              "key": "state_path_in_other_user_home",
+              "value": false
+            },
+            {
+              "key": "state_path_other",
+              "value": false
+            },
+            {
+              "key": "dms_undeclared_deploying_user",
+              "value": false
+            },
+            {
+              "key": "dms_undeclared_other_user",
+              "value": false
+            },
+            {
+              "key": "dms_undeclared_service_principal",
+              "value": false
+            },
+            {
+              "key": "dms_undeclared_group",
+              "value": false
+            },
+            {
+              "key": "dms_compat_auto",
+              "value": true
+            },
             {
               "key": "has_serverless_compute",
               "value": false
@@ -81,10 +121,37 @@
             {
               "key": "has_classic_interactive_compute",
               "value": false
+            },
+            {
+              "key": "deployment_history_enabled",
+              "value": false
             }
           ],
           "bundle_mode": "TYPE_UNSPECIFIED",
           "workspace_artifact_path_type": "WORKSPACE_FILE_SYSTEM",
+          "upload_file_count": 4,
+          "upload_file_sizes": [
+            2,
+            0,
+            0,
+            1,
+            0,
+            1,
+            0,
+            0,
+            0,
+            0,
+            0,
+            0,
+            0,
+            0,
+            0,
+            0,
+            0,
+            0,
+            0,
+            0
+          ],
           "local_cache_measurements_ms": [...redacted...]
         }
       }
diff --git a/acceptance/bundle/telemetry/deploy/out.test.toml b/acceptance/bundle/telemetry/deploy/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/telemetry/deploy/out.test.toml
+++ b/acceptance/bundle/telemetry/deploy/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/telemetry/deploy/output.txt b/acceptance/bundle/telemetry/deploy/output.txt
index cf5dd1e434e..f442634c52b 100644
--- a/acceptance/bundle/telemetry/deploy/output.txt
+++ b/acceptance/bundle/telemetry/deploy/output.txt
@@ -1,12 +1,18 @@
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.job_one
+Created jobs.job_three
+Created jobs.job_two
+Created pipelines.pipeline_one
+Created pipelines.pipeline_two
+Files: 4 uploaded, 0 deleted
+Resources: 5 created, 0 changed, 0 deleted, 0 unchanged
 
->>> cat out.requests.txt
+>>> cat [OUTPUT_DIR]/out.requests.txt
 
 === Assert that mutator execution times are being recorded
 >>> cat telemetry.json
 true
+
+=== Assert the terraform engine opt-in is reported
\ No newline at end of file
diff --git a/acceptance/bundle/telemetry/deploy/script b/acceptance/bundle/telemetry/deploy/script
index de0ac667187..ef428a814a1 100644
--- a/acceptance/bundle/telemetry/deploy/script
+++ b/acceptance/bundle/telemetry/deploy/script
@@ -1,6 +1,7 @@
 trace $CLI bundle deploy
+replace_ids.py
 
-trace cat out.requests.txt | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson' > telemetry.json
+trace cat "$OUT_REQUESTS" | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson' > telemetry.json
 
 # Assert that the telemetry mechanism is working and recording mutator execution times.
 # We only check that at least one mutator execution time is recorded to avoid flakiness on fast machines
@@ -8,9 +9,30 @@ trace cat out.requests.txt | jq 'select(has("path") and .path == "/telemetry-ext
 title "Assert that mutator execution times are being recorded"
 trace cat telemetry.json | jq ' .entry.databricks_cli_log.bundle_deploy_event.experimental.bundle_mutator_execution_time_ms | length > 0'
 
+# resources_metadata carries counts for both engines but sizes only for direct, so
+# it diverges across the DATABRICKS_BUNDLE_ENGINE matrix: capture it per-engine and
+# omit it from the engine-agnostic out.telemetry.txt below. Sizes are deterministic
+# for a fixed config and asserted exactly. state_file_size_bytes is dropped because
+# it is os.Stat of resources.json, whose header embeds the CLI version string
+# (<version>-dev+<sha> on linux/macos vs <version>-dev on windows).
+cat telemetry.json | jq '.entry.databricks_cli_log.bundle_deploy_event.resources_metadata | if . then del(.state_file_size_bytes) else . end' > out.resources_metadata.txt
+
+# engine_terraform_env reflects DATABRICKS_BUNDLE_ENGINE, which the acceptance
+# matrix sets per variant, so it diverges across the matrix. Capture the
+# engine_terraform_* keys per-engine and drop them from the engine-agnostic
+# out.telemetry.txt below.
+title "Assert the terraform engine opt-in is reported"
+cat telemetry.json | jq '[.entry.databricks_cli_log.bundle_deploy_event.experimental.bool_values[] | select(.key | startswith("engine_terraform_"))]' > out.engine.txt
+
 # bundle_mutator_execution_time_ms can have variable number of entries depending upon the runtime of the mutators. Thus we omit it from
 # being asserted here.
-cat telemetry.json | jq 'del(.entry.databricks_cli_log.bundle_deploy_event.experimental.bundle_mutator_execution_time_ms)' > out.telemetry.txt
+#
+# upload_file_count and upload_file_sizes are asserted here and kept deterministic by
+# the sync.paths restriction in databricks.yml (see the comment there).
+# The resource ids are listed in creation order, which varies because resources are created in
+# parallel. Sort them by resource key so the order is stable.
+ids=$($CLI bundle summary -o json | jq '[.resources[] | to_entries[] | {key: (.value.id | tostring), value: .key}] | from_entries')
+cat telemetry.json | jq --argjson ids "$ids" 'del(.entry.databricks_cli_log.bundle_deploy_event.experimental.bundle_mutator_execution_time_ms, .entry.databricks_cli_log.bundle_deploy_event.resources_metadata) | .entry.databricks_cli_log.bundle_deploy_event.experimental.bool_values |= map(select(.key | startswith("engine_terraform_") | not)) | .entry.databricks_cli_log.bundle_deploy_event |= (.resource_job_ids |= sort_by($ids[.]) | .resource_pipeline_ids |= sort_by($ids[.]))' > out.telemetry.txt
 
 cmd_exec_id=$(extract_command_exec_id.py)
 deployment_id=$(cat .databricks/bundle/default/deployment.json | jq -r .id)
@@ -19,5 +41,5 @@ update_file.py out.telemetry.txt $cmd_exec_id  '[CMD-EXEC-ID]'
 update_file.py out.telemetry.txt "11111111-2222-3333-4444-555555555555"  '[BUNDLE_UUID]'
 update_file.py out.telemetry.txt $deployment_id  '[DEPLOYMENT_ID]'
 
-rm out.requests.txt
+rm "$OUT_REQUESTS"
 rm telemetry.json
diff --git a/acceptance/bundle/telemetry/deploy/src/big.txt b/acceptance/bundle/telemetry/deploy/src/big.txt
new file mode 100644
index 00000000000..5942b384009
--- /dev/null
+++ b/acceptance/bundle/telemetry/deploy/src/big.txt
@@ -0,0 +1 @@
+01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678
diff --git a/acceptance/bundle/telemetry/deploy/src/medium.txt b/acceptance/bundle/telemetry/deploy/src/medium.txt
new file mode 100644
index 00000000000..596f55c05de
--- /dev/null
+++ b/acceptance/bundle/telemetry/deploy/src/medium.txt
@@ -0,0 +1 @@
+01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678
diff --git a/acceptance/bundle/telemetry/deploy/src/small1.py b/acceptance/bundle/telemetry/deploy/src/small1.py
new file mode 100644
index 00000000000..5ca906e3505
--- /dev/null
+++ b/acceptance/bundle/telemetry/deploy/src/small1.py
@@ -0,0 +1 @@
+print("hello from small1")
diff --git a/acceptance/bundle/telemetry/deploy/src/small2.py b/acceptance/bundle/telemetry/deploy/src/small2.py
new file mode 100644
index 00000000000..758b2a6d631
--- /dev/null
+++ b/acceptance/bundle/telemetry/deploy/src/small2.py
@@ -0,0 +1 @@
+print("hello from small2")
diff --git a/acceptance/bundle/telemetry/test.toml b/acceptance/bundle/telemetry/test.toml
index 14453c07f92..ba5f7a2f8a6 100644
--- a/acceptance/bundle/telemetry/test.toml
+++ b/acceptance/bundle/telemetry/test.toml
@@ -1,8 +1,13 @@
 RecordRequests = true
 IncludeRequestHeaders = ["User-Agent"]
 
-[Env]
-DATABRICKS_CACHE_ENABLED = 'false'
+# Telemetry reports numbers about the state that recording legitimately changes: the byte size of
+# the serialized state, which the deployment stamp grows, and the state serial, which comes from the
+# deployment's recorded version rather than the file. Those numbers are the assertion here, so there
+# is nothing to normalize.
+EnvMatrix.DMS = [""]
+
+Env.DATABRICKS_CACHE_ENABLED = 'false'
 
 [[Repls]]
 Old = '"execution_time_ms": \d{1,5},'
diff --git a/acceptance/bundle/templates-machinery/helper_upper_lower/out.test.toml b/acceptance/bundle/templates-machinery/helper_upper_lower/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/templates-machinery/helper_upper_lower/out.test.toml
+++ b/acceptance/bundle/templates-machinery/helper_upper_lower/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/templates-machinery/helper_username/out.test.toml b/acceptance/bundle/templates-machinery/helper_username/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/templates-machinery/helper_username/out.test.toml
+++ b/acceptance/bundle/templates-machinery/helper_username/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/templates-machinery/helpers-error/out.test.toml b/acceptance/bundle/templates-machinery/helpers-error/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/templates-machinery/helpers-error/out.test.toml
+++ b/acceptance/bundle/templates-machinery/helpers-error/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/templates-machinery/number-precision/out.test.toml b/acceptance/bundle/templates-machinery/number-precision/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/templates-machinery/number-precision/out.test.toml
+++ b/acceptance/bundle/templates-machinery/number-precision/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/templates-machinery/supported-url/out.test.toml b/acceptance/bundle/templates-machinery/supported-url/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/templates-machinery/supported-url/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/templates-machinery/supported-url/output.txt b/acceptance/bundle/templates-machinery/supported-url/output.txt
new file mode 100644
index 00000000000..959b4c6fb82
--- /dev/null
+++ b/acceptance/bundle/templates-machinery/supported-url/output.txt
@@ -0,0 +1,4 @@
+
+=== https:// URL is recognized as a Git URL
+=== ssh:// URL is recognized as a Git URL
+=== git@ URL is recognized as a Git URL
\ No newline at end of file
diff --git a/acceptance/bundle/templates-machinery/supported-url/script b/acceptance/bundle/templates-machinery/supported-url/script
new file mode 100644
index 00000000000..e1465d61516
--- /dev/null
+++ b/acceptance/bundle/templates-machinery/supported-url/script
@@ -0,0 +1,17 @@
+# These hosts do not resolve (.invalid is reserved by RFC 6761), so the clone
+# fails fast without network access. The point of the test is that these URLs
+# are recognized as Git URLs and a clone is attempted, rather than being misread
+# as local template paths (which would report a "not a bundle template" error
+# instead). The git error text varies by platform, so we route it to LOG
+# (excluded from the diff) and assert the invariant with contains.py.
+title "https:// URL is recognized as a Git URL"
+errcode $CLI bundle init https://nonexistent.databricks.invalid/databricks/cli &> LOG.https
+contains.py "git clone https://nonexistent.databricks.invalid/databricks/cli" "!not a bundle template" < LOG.https > /dev/null
+
+title "ssh:// URL is recognized as a Git URL"
+errcode $CLI bundle init ssh://git@nonexistent.databricks.invalid/databricks/cli &> LOG.ssh
+contains.py "git clone ssh://git@nonexistent.databricks.invalid/databricks/cli" "!not a bundle template" < LOG.ssh > /dev/null
+
+title "git@ URL is recognized as a Git URL"
+errcode $CLI bundle init git@nonexistent.databricks.invalid:databricks/cli.git &> LOG.git
+contains.py "git clone git@nonexistent.databricks.invalid:databricks/cli.git" "!not a bundle template" < LOG.git > /dev/null
diff --git a/acceptance/bundle/templates-machinery/unsupported-url/out.test.toml b/acceptance/bundle/templates-machinery/unsupported-url/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/templates-machinery/unsupported-url/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/templates-machinery/unsupported-url/output.txt b/acceptance/bundle/templates-machinery/unsupported-url/output.txt
new file mode 100644
index 00000000000..53b7362a7db
--- /dev/null
+++ b/acceptance/bundle/templates-machinery/unsupported-url/output.txt
@@ -0,0 +1,12 @@
+
+>>> musterr [CLI] bundle init http://github.com/databricks/cli
+Error: unsupported protocol in Git URL "http://github.com/databricks/cli": only https://, ssh://, git@ URLs are supported
+
+>>> musterr [CLI] bundle init git://github.com/databricks/cli
+Error: unsupported protocol in Git URL "git://github.com/databricks/cli": only https://, ssh://, git@ URLs are supported
+
+>>> musterr [CLI] bundle init ftp://github.com/databricks/cli
+Error: unsupported protocol in Git URL "ftp://github.com/databricks/cli": only https://, ssh://, git@ URLs are supported
+
+>>> musterr [CLI] bundle init ftps://github.com/databricks/cli
+Error: unsupported protocol in Git URL "ftps://github.com/databricks/cli": only https://, ssh://, git@ URLs are supported
diff --git a/acceptance/bundle/templates-machinery/unsupported-url/script b/acceptance/bundle/templates-machinery/unsupported-url/script
new file mode 100644
index 00000000000..ccb5a3d9c11
--- /dev/null
+++ b/acceptance/bundle/templates-machinery/unsupported-url/script
@@ -0,0 +1,4 @@
+trace musterr $CLI bundle init http://github.com/databricks/cli
+trace musterr $CLI bundle init git://github.com/databricks/cli
+trace musterr $CLI bundle init ftp://github.com/databricks/cli
+trace musterr $CLI bundle init ftps://github.com/databricks/cli
diff --git a/acceptance/bundle/templates-machinery/wrong-path/out.test.toml b/acceptance/bundle/templates-machinery/wrong-path/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/templates-machinery/wrong-path/out.test.toml
+++ b/acceptance/bundle/templates-machinery/wrong-path/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/templates-machinery/wrong-url/out.test.toml b/acceptance/bundle/templates-machinery/wrong-url/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/templates-machinery/wrong-url/out.test.toml
+++ b/acceptance/bundle/templates-machinery/wrong-url/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/templates-machinery/wrong-url/output.txt b/acceptance/bundle/templates-machinery/wrong-url/output.txt
index 07c7c38f2f3..c59301c3887 100644
--- a/acceptance/bundle/templates-machinery/wrong-url/output.txt
+++ b/acceptance/bundle/templates-machinery/wrong-url/output.txt
@@ -1,5 +1,5 @@
-Error: git clone failed: git clone https://invalid-domain-123.databricks.com/hello/world (redacted) --no-tags --depth=1: exit status 128. Cloning into '(redacted)'...
-fatal: repository 'https://invalid-domain-123.databricks.com/hello/world/' not found
+Error: git clone failed: git clone https://invalid-domain-123.databricks.invalid/hello/world (redacted) --no-tags --depth=1: exit status 128. Cloning into '(redacted)'...
+fatal: unable to access 'https://invalid-domain-123.databricks.invalid/hello/world/': (redacted)
 
 
 Exit code: 1
diff --git a/acceptance/bundle/templates-machinery/wrong-url/script b/acceptance/bundle/templates-machinery/wrong-url/script
index e9bc0f4f607..709839fa805 100644
--- a/acceptance/bundle/templates-machinery/wrong-url/script
+++ b/acceptance/bundle/templates-machinery/wrong-url/script
@@ -1,2 +1,2 @@
 export NO_COLOR=1
-$CLI bundle init https://invalid-domain-123.databricks.com/hello/world
+$CLI bundle init https://invalid-domain-123.databricks.invalid/hello/world
diff --git a/acceptance/bundle/templates-machinery/wrong-url/test.toml b/acceptance/bundle/templates-machinery/wrong-url/test.toml
index 7211fcb0be9..b1d2d700cc5 100644
--- a/acceptance/bundle/templates-machinery/wrong-url/test.toml
+++ b/acceptance/bundle/templates-machinery/wrong-url/test.toml
@@ -6,24 +6,15 @@ New = '/'
 Old = '/world-[0-9]+'
 New = '/world-123456'
 
-[[Repls]]
-# Depends on system configuration and git version.
-# Examples:
-# - fatal: unable to access 'https://invalid-domain-123.databricks.com/hello/world/': SSL: no alternative certificate ...
-# - fatal: unable to access 'https://invalid-domain-123.databricks.com/hello/world/': SSL: certificate subject name ...
-# - fatal: repository 'https://invalid-domain-123.databricks.com/hello/world/' not found
-Old = "fatal: unable to access 'https://invalid-domain-123.databricks.com/hello/world/': .*"
-New = "fatal: repository 'https://invalid-domain-123.databricks.com/hello/world/' not found"
-
-[[Repls]]
-# Git redirection error (appears in some CI environments)
-Old = '''fatal: unable to update url base from redirection:\n  asked for: [^\n]+\n   redirect: [^\n]+'''
-New = "fatal: repository 'https://invalid-domain-123.databricks.com/hello/world/' not found"
-
 [[Repls]]
 Old = '''Cloning into '[^']+''''
 New = '''Cloning into '(redacted)''''
 
 [[Repls]]
-Old = '''git clone https://invalid-domain-123.databricks.com/hello/world [^ ]+'''
-New = '''git clone https://invalid-domain-123.databricks.com/hello/world (redacted)'''
+Old = '''git clone https://invalid-domain-123.databricks.invalid/hello/world [^ ]+'''
+New = '''git clone https://invalid-domain-123.databricks.invalid/hello/world (redacted)'''
+
+[[Repls]]
+# Normalize any proxy/DNS/TLS error for the invalid domain into a stable form.
+Old = "fatal: unable to access 'https://invalid-domain-123.databricks.invalid/hello/world/': .*"
+New = "fatal: unable to access 'https://invalid-domain-123.databricks.invalid/hello/world/': (redacted)"
diff --git a/acceptance/bundle/templates/app-appkit/input-version.json b/acceptance/bundle/templates/app-appkit/input-version.json
new file mode 100644
index 00000000000..9e6199e9c3c
--- /dev/null
+++ b/acceptance/bundle/templates/app-appkit/input-version.json
@@ -0,0 +1,4 @@
+{
+  "project_name": "appkit-bundle-test",
+  "version": "0.76.1"
+}
diff --git a/acceptance/bundle/templates/app-appkit/input.json b/acceptance/bundle/templates/app-appkit/input.json
new file mode 100644
index 00000000000..e6bf923499b
--- /dev/null
+++ b/acceptance/bundle/templates/app-appkit/input.json
@@ -0,0 +1,5 @@
+{
+  "project_name": "appkit-bundle-test",
+  "app_description": "AppKit bundle initialization test",
+  "skip_install": true
+}
diff --git a/acceptance/bundle/templates/app-appkit/out.test.toml b/acceptance/bundle/templates/app-appkit/out.test.toml
new file mode 100644
index 00000000000..27ec2a7fcd6
--- /dev/null
+++ b/acceptance/bundle/templates/app-appkit/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/templates/app-appkit/output.txt b/acceptance/bundle/templates/app-appkit/output.txt
new file mode 100644
index 00000000000..c2fe65dc66f
--- /dev/null
+++ b/acceptance/bundle/templates/app-appkit/output.txt
@@ -0,0 +1,63 @@
+
+=== Missing project name fails without a terminal
+>>> musterr [CLI] bundle init app-appkit
+Error: app-appkit requires project_name in --config-file in non-interactive mode
+
+=== Unsupported template directory fails before initialization
+>>> musterr [CLI] bundle init app-appkit --template-dir template
+Error: --template-dir is not supported for app-appkit; use databricks apps init --template for a custom AppKit template
+
+=== Version and branch cannot be combined
+>>> musterr [CLI] bundle init app-appkit --config-file input-version.json --branch main
+Error: version in --config-file cannot be combined with --tag or --branch
+
+=== JSON output is unsupported
+>>> musterr [CLI] bundle init app-appkit --config-file input.json -o json
+Error: -o json is not supported for app-appkit; use text output
+
+=== Initialize AppKit from a config file without a terminal
+>>> [CLI] bundle init app-appkit --config-file input.json --output-dir output
+✔ Creating project
+
+✔ Project created successfully!
+
+  Location: [TEST_TMP_DIR]/output/appkit-bundle-test
+  Files: 5
+
+  Next steps:
+
+    cd appkit-bundle-test
+    pnpm install --frozen-lockfile && pnpm run dev
+
+
+>>> [CLI] bundle validate
+Name: appkit-bundle-test
+Target: default
+Workspace:
+  Host: [DATABRICKS_URL]
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/appkit-bundle-test/default
+
+Validation OK!
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/appkit-bundle-test/default/files...
+✓ Deployment succeeded
+Created apps.app
+Files: 5 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+
+>>> [CLI] apps get appkit-bundle-test -o json
+{
+  "name": "appkit-bundle-test",
+  "compute_state": "ACTIVE",
+  "deployment_state": "SUCCEEDED"
+}
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.apps.app
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/appkit-bundle-test/default
+
+Destroy: 1 deleted
diff --git a/acceptance/bundle/templates/app-appkit/output/appkit-bundle-test/app.yaml b/acceptance/bundle/templates/app-appkit/output/appkit-bundle-test/app.yaml
new file mode 100644
index 00000000000..f474313bb13
--- /dev/null
+++ b/acceptance/bundle/templates/app-appkit/output/appkit-bundle-test/app.yaml
@@ -0,0 +1 @@
+command: ["npm", "run", "start"]
diff --git a/acceptance/bundle/templates/app-appkit/output/appkit-bundle-test/appkit.plugins.json b/acceptance/bundle/templates/app-appkit/output/appkit-bundle-test/appkit.plugins.json
new file mode 100644
index 00000000000..d391f596241
--- /dev/null
+++ b/acceptance/bundle/templates/app-appkit/output/appkit-bundle-test/appkit.plugins.json
@@ -0,0 +1,16 @@
+{
+  "version": "2.0",
+  "plugins": {
+    "server": {
+      "name": "server",
+      "displayName": "Server",
+      "description": "HTTP server",
+      "package": "@databricks/appkit",
+      "requiredByTemplate": true,
+      "resources": {
+        "required": [],
+        "optional": []
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/templates/app-appkit/output/appkit-bundle-test/databricks.yml b/acceptance/bundle/templates/app-appkit/output/appkit-bundle-test/databricks.yml
new file mode 100644
index 00000000000..f0bdad79cdd
--- /dev/null
+++ b/acceptance/bundle/templates/app-appkit/output/appkit-bundle-test/databricks.yml
@@ -0,0 +1,17 @@
+bundle:
+  name: appkit-bundle-test
+
+resources:
+  apps:
+    app:
+      name: appkit-bundle-test
+      description: AppKit bundle initialization test
+      source_code_path: ./
+      lifecycle:
+        started: true
+
+targets:
+  default:
+    default: true
+    workspace:
+      host: [DATABRICKS_URL]
diff --git a/acceptance/bundle/templates/app-appkit/output/appkit-bundle-test/package.json b/acceptance/bundle/templates/app-appkit/output/appkit-bundle-test/package.json
new file mode 100644
index 00000000000..8f9f012cf8d
--- /dev/null
+++ b/acceptance/bundle/templates/app-appkit/output/appkit-bundle-test/package.json
@@ -0,0 +1,13 @@
+{
+  "name": "appkit-bundle-test",
+  "version": "1.0.0",
+  "type": "module",
+  "description": "AppKit bundle initialization test",
+  "scripts": {
+    "start": "node server.js"
+  },
+  "dependencies": {
+    "@databricks/appkit": "0.57.0"
+  },
+  "packageManager": "pnpm@11.0.8"
+}
diff --git a/acceptance/bundle/templates/app-appkit/output/appkit-bundle-test/server.js b/acceptance/bundle/templates/app-appkit/output/appkit-bundle-test/server.js
new file mode 100644
index 00000000000..e0a132b230a
--- /dev/null
+++ b/acceptance/bundle/templates/app-appkit/output/appkit-bundle-test/server.js
@@ -0,0 +1,5 @@
+import { createApp, server } from '@databricks/appkit';
+
+createApp({
+  plugins: [server(),],
+}).catch(console.error);
diff --git a/acceptance/bundle/templates/app-appkit/script b/acceptance/bundle/templates/app-appkit/script
new file mode 100644
index 00000000000..6c4ff1b0b84
--- /dev/null
+++ b/acceptance/bundle/templates/app-appkit/script
@@ -0,0 +1,25 @@
+export DATABRICKS_APPKIT_TEMPLATE_PATH="$TESTDIR/template"
+
+title "Missing project name fails without a terminal"
+trace musterr $CLI bundle init app-appkit < /dev/null
+
+title "Unsupported template directory fails before initialization"
+trace musterr $CLI bundle init app-appkit --template-dir template < /dev/null
+
+title "Version and branch cannot be combined"
+trace musterr $CLI bundle init app-appkit --config-file input-version.json --branch main < /dev/null
+
+title "JSON output is unsupported"
+trace musterr $CLI bundle init app-appkit --config-file input.json -o json < /dev/null
+
+title "Initialize AppKit from a config file without a terminal"
+trace $CLI bundle init app-appkit --config-file input.json --output-dir output < /dev/null
+test ! -d output/appkit-bundle-test/node_modules
+
+cd output/appkit-bundle-test
+
+trace $CLI bundle validate < /dev/null
+trace $CLI bundle deploy < /dev/null
+trace $CLI apps get appkit-bundle-test -o json | jq '{name, compute_state: .compute_status.state, deployment_state: .active_deployment.status.state}'
+trace $CLI bundle destroy --auto-approve < /dev/null
+rm -r .databricks
diff --git a/acceptance/bundle/templates/app-appkit/template/app.yaml b/acceptance/bundle/templates/app-appkit/template/app.yaml
new file mode 100644
index 00000000000..f474313bb13
--- /dev/null
+++ b/acceptance/bundle/templates/app-appkit/template/app.yaml
@@ -0,0 +1 @@
+command: ["npm", "run", "start"]
diff --git a/acceptance/bundle/templates/app-appkit/template/appkit.plugins.json b/acceptance/bundle/templates/app-appkit/template/appkit.plugins.json
new file mode 100644
index 00000000000..d391f596241
--- /dev/null
+++ b/acceptance/bundle/templates/app-appkit/template/appkit.plugins.json
@@ -0,0 +1,16 @@
+{
+  "version": "2.0",
+  "plugins": {
+    "server": {
+      "name": "server",
+      "displayName": "Server",
+      "description": "HTTP server",
+      "package": "@databricks/appkit",
+      "requiredByTemplate": true,
+      "resources": {
+        "required": [],
+        "optional": []
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/templates/app-appkit/template/databricks.yml.tmpl b/acceptance/bundle/templates/app-appkit/template/databricks.yml.tmpl
new file mode 100644
index 00000000000..b7afbfd83d0
--- /dev/null
+++ b/acceptance/bundle/templates/app-appkit/template/databricks.yml.tmpl
@@ -0,0 +1,17 @@
+bundle:
+  name: {{.projectName}}
+
+resources:
+  apps:
+    app:
+      name: {{.projectName}}
+      description: {{.appDescription}}
+      source_code_path: ./
+      lifecycle:
+        started: true
+
+targets:
+  default:
+    default: true
+    workspace:
+      host: {{.workspaceHost}}
diff --git a/acceptance/bundle/templates/app-appkit/template/package.json b/acceptance/bundle/templates/app-appkit/template/package.json
new file mode 100644
index 00000000000..292e1a0ac95
--- /dev/null
+++ b/acceptance/bundle/templates/app-appkit/template/package.json
@@ -0,0 +1,12 @@
+{
+  "name": "{{.projectName}}",
+  "version": "1.0.0",
+  "type": "module",
+  "description": "{{.appDescription}}",
+  "scripts": {
+    "start": "node server.js"
+  },
+  "dependencies": {
+    "@databricks/appkit": "0.57.0"
+  }
+}
diff --git a/acceptance/bundle/templates/app-appkit/template/server.js b/acceptance/bundle/templates/app-appkit/template/server.js
new file mode 100644
index 00000000000..67f9aab20d3
--- /dev/null
+++ b/acceptance/bundle/templates/app-appkit/template/server.js
@@ -0,0 +1,5 @@
+import { createApp{{range $name, $_ := .plugins}}, {{$name}}{{end}} } from '@databricks/appkit';
+
+createApp({
+  plugins: [{{range $name, $_ := .plugins}}{{$name}}(),{{end}}],
+}).catch(console.error);
diff --git a/acceptance/bundle/templates/app-appkit/test.toml b/acceptance/bundle/templates/app-appkit/test.toml
new file mode 100644
index 00000000000..9609e1af299
--- /dev/null
+++ b/acceptance/bundle/templates/app-appkit/test.toml
@@ -0,0 +1 @@
+EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/templates/dbt-sql-classic/input.json b/acceptance/bundle/templates/dbt-sql-classic/input.json
new file mode 100644
index 00000000000..51090158dda
--- /dev/null
+++ b/acceptance/bundle/templates/dbt-sql-classic/input.json
@@ -0,0 +1,7 @@
+{
+    "project_name": "my_dbt_sql",
+    "http_path": "/sql/2.0/warehouses/f00dcafe",
+    "default_catalog": "main",
+    "personal_schemas": "yes",
+    "serverless": "no"
+}
diff --git a/acceptance/bundle/templates/dbt-sql-classic/out.test.toml b/acceptance/bundle/templates/dbt-sql-classic/out.test.toml
new file mode 100644
index 00000000000..bbd44e1b741
--- /dev/null
+++ b/acceptance/bundle/templates/dbt-sql-classic/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+Phase = 1
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/templates/dbt-sql-classic/output.txt b/acceptance/bundle/templates/dbt-sql-classic/output.txt
new file mode 100644
index 00000000000..66c5cf492e0
--- /dev/null
+++ b/acceptance/bundle/templates/dbt-sql-classic/output.txt
@@ -0,0 +1,45 @@
+
+>>> [CLI] bundle init dbt-sql --config-file ./input.json --output-dir output
+
+Welcome to the dbt template for Declarative Automation Bundles!
+
+A workspace was selected based on your current profile. For information about how to change this, see https://docs.databricks.com/dev-tools/cli/profiles.html.
+workspace_host: [DATABRICKS_URL]
+
+📊 Your new project has been created in the 'my_dbt_sql' directory!
+If you already have dbt installed, just type 'cd my_dbt_sql; dbt init' to get started.
+Refer to the README.md file for full "getting started" guide and production setup instructions.
+
+
+>>> diff.py [TESTROOT]/bundle/templates/dbt-sql-classic/../dbt-sql/output/my_dbt_sql/resources/my_dbt_sql.job.yml output/my_dbt_sql/resources/my_dbt_sql.job.yml
+--- [TESTROOT]/bundle/templates/dbt-sql-classic/../dbt-sql/output/my_dbt_sql/resources/my_dbt_sql.job.yml
++++ output/my_dbt_sql/resources/my_dbt_sql.job.yml
+@@ -16,5 +16,4 @@
+       tasks:
+         - task_key: dbt
+-          environment_key: default
+           dbt_task:
+             project_directory: ../
+@@ -27,8 +26,16 @@
+               - 'dbt run --target=${bundle.target} --vars "{ dev_schema: ${workspace.current_user.short_name} }"'
+
+-      environments:
+-        - environment_key: default
+-          spec:
+-            environment_version: "5"
+-            dependencies:
+-              - dbt-databricks>=1.8.0,<2.0.0
++          libraries:
++            - pypi:
++                package: dbt-databricks>=1.8.0,<2.0.0
++
++          new_cluster:
++            spark_version: 16.4.x-scala2.12
++            node_type_id: [NODE_TYPE_ID]
++            data_security_mode: DATA_SECURITY_MODE_AUTO
++            num_workers: 0
++            spark_conf:
++              spark.master: "local[*, 4]"
++              spark.databricks.cluster.profile: singleNode
++            custom_tags:
++              ResourceClass: SingleNode
diff --git a/acceptance/bundle/templates/dbt-sql-classic/script b/acceptance/bundle/templates/dbt-sql-classic/script
new file mode 100644
index 00000000000..a9c1fb43ffc
--- /dev/null
+++ b/acceptance/bundle/templates/dbt-sql-classic/script
@@ -0,0 +1,7 @@
+# With serverless: no, the dbt-sql job runs on a classic new_cluster instead of a
+# serverless environment. Only the job resource differs from the serverless dbt-sql
+# variant, so we diff just that file against the dbt-sql golden. This locks in the
+# new_cluster spark_version (latest_lts_dbr_version).
+trace $CLI bundle init dbt-sql --config-file ./input.json --output-dir output
+trace diff.py $TESTDIR/../dbt-sql/output/my_dbt_sql/resources/my_dbt_sql.job.yml output/my_dbt_sql/resources/my_dbt_sql.job.yml
+rm -fr output
diff --git a/acceptance/bundle/templates/dbt-sql-classic/test.toml b/acceptance/bundle/templates/dbt-sql-classic/test.toml
new file mode 100644
index 00000000000..1c6129f1565
--- /dev/null
+++ b/acceptance/bundle/templates/dbt-sql-classic/test.toml
@@ -0,0 +1,3 @@
+# This test reads the sibling dbt-sql test's committed golden via $TESTDIR, so it
+# must run in phase 1 (after phase 0 regenerates that golden in update mode).
+Phase = 1
diff --git a/acceptance/bundle/templates/dbt-sql/out.test.toml b/acceptance/bundle/templates/dbt-sql/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/templates/dbt-sql/out.test.toml
+++ b/acceptance/bundle/templates/dbt-sql/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/templates/dbt-sql/output/my_dbt_sql/AGENTS.md b/acceptance/bundle/templates/dbt-sql/output/my_dbt_sql/AGENTS.md
new file mode 100644
index 00000000000..fdcca98a432
--- /dev/null
+++ b/acceptance/bundle/templates/dbt-sql/output/my_dbt_sql/AGENTS.md
@@ -0,0 +1,25 @@
+# Declarative Automation Bundles Project
+
+This project uses Declarative Automation Bundles (DABs) for deployment. Add project-specific instructions below.
+
+## For AI Agents: Use Databricks AI Tools
+
+**BEFORE any other action, read the `databricks-core` skill.**
+
+It sets you up to work with this project reliably: CLI authentication, profile
+selection, data discovery, and the bundle deployment workflow. Without it,
+results are often slower and less accurate.
+
+If this skill is not available (Databricks AI Tools are not installed), you can install them for your coding agent in seconds:
+
+```bash
+databricks aitools install
+```
+
+If the CLI is not installed, see: https://docs.databricks.com/dev-tools/cli/install
+
+---
+
+## Project Instructions
+
+<!-- Add your project-specific instructions, coding conventions, or notes here -->
diff --git a/acceptance/bundle/templates/dbt-sql/output/my_dbt_sql/dbt_project.yml b/acceptance/bundle/templates/dbt-sql/output/my_dbt_sql/dbt_project.yml
index 74044e47b74..4a472241985 100644
--- a/acceptance/bundle/templates/dbt-sql/output/my_dbt_sql/dbt_project.yml
+++ b/acceptance/bundle/templates/dbt-sql/output/my_dbt_sql/dbt_project.yml
@@ -6,7 +6,7 @@ config-version: 2
 profile: 'my_dbt_sql'
 
 # These configurations specify where dbt should look for different types of files.
-# For Databricks asset bundles, we put everything in src, as you may have
+# For Declarative Automation Bundles, we put everything in src, as you may have
 # non-dbt resources in your project.
 model-paths: ["src/models"]
 analysis-paths: ["src/analyses"]
diff --git a/acceptance/bundle/templates/dbt-sql/output/my_dbt_sql/resources/my_dbt_sql.job.yml b/acceptance/bundle/templates/dbt-sql/output/my_dbt_sql/resources/my_dbt_sql.job.yml
index d01c17860a1..9cb376adf5c 100644
--- a/acceptance/bundle/templates/dbt-sql/output/my_dbt_sql/resources/my_dbt_sql.job.yml
+++ b/acceptance/bundle/templates/dbt-sql/output/my_dbt_sql/resources/my_dbt_sql.job.yml
@@ -29,6 +29,6 @@ resources:
       environments:
         - environment_key: default
           spec:
-            environment_version: "4"
+            environment_version: "5"
             dependencies:
               - dbt-databricks>=1.8.0,<2.0.0
diff --git a/acceptance/bundle/templates/default-minimal/out.test.toml b/acceptance/bundle/templates/default-minimal/out.test.toml
deleted file mode 100644
index f784a183258..00000000000
--- a/acceptance/bundle/templates/default-minimal/out.test.toml
+++ /dev/null
@@ -1,3 +0,0 @@
-Local = true
-Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/bundle/templates/default-minimal/output.txt b/acceptance/bundle/templates/default-minimal/output.txt
deleted file mode 100644
index 5d0538b0382..00000000000
--- a/acceptance/bundle/templates/default-minimal/output.txt
+++ /dev/null
@@ -1,33 +0,0 @@
-
->>> [CLI] bundle init default-minimal --config-file ./input.json --output-dir output
-Welcome to the minimal Databricks Asset Bundle template!
-
-This template creates a minimal project structure without sample code, ideal for advanced users.
-(For getting started with Python or SQL code, use the default-python or default-sql templates instead.)
-
-Your workspace at [DATABRICKS_URL] is used for initialization.
-(See https://docs.databricks.com/dev-tools/cli/profiles.html for how to change your profile.)
-
-✨ Your new project has been created in the 'my_default_minimal' directory!
-
-To get started, refer to the project README.md file and the documentation at https://docs.databricks.com/dev-tools/bundles/index.html.
-
->>> [CLI] bundle validate -t dev
-Name: my_default_minimal
-Target: dev
-Workspace:
-  Host: [DATABRICKS_URL]
-  User: [USERNAME]
-  Path: /Workspace/Users/[USERNAME]/.bundle/my_default_minimal/dev
-
-Validation OK!
-
->>> [CLI] bundle validate -t prod
-Name: my_default_minimal
-Target: prod
-Workspace:
-  Host: [DATABRICKS_URL]
-  User: [USERNAME]
-  Path: /Workspace/Users/[USERNAME]/.bundle/my_default_minimal/prod
-
-Validation OK!
diff --git a/acceptance/bundle/templates/default-minimal/output/my_default_minimal/.vscode/extensions.json b/acceptance/bundle/templates/default-minimal/output/my_default_minimal/.vscode/extensions.json
deleted file mode 100644
index 5ba48e79c9b..00000000000
--- a/acceptance/bundle/templates/default-minimal/output/my_default_minimal/.vscode/extensions.json
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-    "recommendations": [
-        "databricks.databricks",
-        "redhat.vscode-yaml",
-        "charliermarsh.ruff"
-    ]
-}
diff --git a/acceptance/bundle/templates/default-minimal/output/my_default_minimal/README.md b/acceptance/bundle/templates/default-minimal/output/my_default_minimal/README.md
deleted file mode 100644
index 4304687ae33..00000000000
--- a/acceptance/bundle/templates/default-minimal/output/my_default_minimal/README.md
+++ /dev/null
@@ -1,54 +0,0 @@
-# my_default_minimal
-
-The 'my_default_minimal' project was generated by using the default-minimal template.
-
-* `src/`: SQL source code for this project.
-* `resources/`:  Resource configurations (jobs, pipelines, etc.)
-
-## Getting started
-
-Choose how you want to work on this project:
-
-(a) Directly in your Databricks workspace, see
-    https://docs.databricks.com/dev-tools/bundles/workspace.
-
-(b) Locally with an IDE like Cursor or VS Code, see
-    https://docs.databricks.com/dev-tools/vscode-ext.html.
-
-(c) With command line tools, see https://docs.databricks.com/dev-tools/cli/databricks-cli.html
-
-If you're developing with an IDE, dependencies for this project should be installed using uv:
-
-*  Make sure you have the UV package manager installed.
-   It's an alternative to tools like pip: https://docs.astral.sh/uv/getting-started/installation/.
-*  Run `uv sync --dev` to install the project's dependencies.
-
-
-# Using this project using the CLI
-
-The Databricks workspace and IDE extensions provide a graphical interface for working
-with this project. It's also possible to interact with it directly using the CLI:
-
-1. Authenticate to your Databricks workspace, if you have not done so already:
-    ```
-    $ databricks configure
-    ```
-
-2. To deploy a development copy of this project, type:
-    ```
-    $ databricks bundle deploy --target dev
-    ```
-    (Note that "dev" is the default target, so the `--target` parameter
-    is optional here.)
-
-    This deploys everything that's defined for this project.
-
-3. Similarly, to deploy a production copy, type:
-   ```
-   $ databricks bundle deploy --target prod
-   ```
-
-4. To run a job or pipeline, use the "run" command:
-   ```
-   $ databricks bundle run
-   ```
diff --git a/acceptance/bundle/templates/default-minimal/output/my_default_minimal/databricks.yml b/acceptance/bundle/templates/default-minimal/output/my_default_minimal/databricks.yml
deleted file mode 100644
index c10c7416920..00000000000
--- a/acceptance/bundle/templates/default-minimal/output/my_default_minimal/databricks.yml
+++ /dev/null
@@ -1,41 +0,0 @@
-# This is a Databricks asset bundle definition for my_default_minimal.
-# See https://docs.databricks.com/dev-tools/bundles/index.html for documentation.
-bundle:
-  name: my_default_minimal
-  uuid: [UUID]
-
-include:
-  - resources/*.yml
-
-# Variable declarations. These variables are assigned in the dev/prod targets below.
-variables:
-  catalog:
-    description: The catalog to use
-  schema:
-    description: The schema to use
-
-targets:
-  dev:
-    # The default target uses 'mode: development' to create a development copy.
-    # - Deployed resources get prefixed with '[dev my_user_name]'
-    # - Any job schedules and triggers are paused by default.
-    # See also https://docs.databricks.com/dev-tools/bundles/deployment-modes.html.
-    mode: development
-    default: true
-    workspace:
-      host: [DATABRICKS_URL]
-    variables:
-      catalog: hive_metastore
-      schema: ${workspace.current_user.short_name}
-  prod:
-    mode: production
-    workspace:
-      host: [DATABRICKS_URL]
-      # We explicitly deploy to /Workspace/Users/[USERNAME] to make sure we only have a single copy.
-      root_path: /Workspace/Users/[USERNAME]/.bundle/${bundle.name}/${bundle.target}
-    variables:
-      catalog: hive_metastore
-      schema: prod
-    permissions:
-      - user_name: [USERNAME]
-        level: CAN_MANAGE
diff --git a/acceptance/bundle/templates/default-minimal/python/input.json b/acceptance/bundle/templates/default-minimal/python/input.json
new file mode 100644
index 00000000000..c620c3159b5
--- /dev/null
+++ b/acceptance/bundle/templates/default-minimal/python/input.json
@@ -0,0 +1,4 @@
+{
+    "project_name": "my_default_minimal",
+    "language_choice": "python"
+}
diff --git a/acceptance/bundle/templates/default-minimal/python/out.test.toml b/acceptance/bundle/templates/default-minimal/python/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/templates/default-minimal/python/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/templates/default-minimal/python/output.txt b/acceptance/bundle/templates/default-minimal/python/output.txt
new file mode 100644
index 00000000000..2632de13bc3
--- /dev/null
+++ b/acceptance/bundle/templates/default-minimal/python/output.txt
@@ -0,0 +1,47 @@
+
+>>> [CLI] bundle init default-minimal --config-file ./input.json --output-dir output -o json
+Welcome to the minimal Declarative Automation Bundle template!
+
+This template creates a minimal project structure without sample code, ideal for advanced users.
+(For getting started with Python or SQL code, use the default-python or default-sql templates instead.)
+
+Your workspace at [DATABRICKS_URL] is used for initialization.
+(See https://docs.databricks.com/dev-tools/cli/profiles.html for how to change your profile.)
+
+✨ Your new project has been created in the 'my_default_minimal' directory!
+
+To get started, refer to the project README.md file and the documentation at https://docs.databricks.com/dev-tools/bundles/index.html.
+{
+  "outputs": [
+    "my_default_minimal/.gitignore",
+    "my_default_minimal/.vscode/__builtins__.pyi",
+    "my_default_minimal/.vscode/extensions.json",
+    "my_default_minimal/.vscode/settings.json",
+    "my_default_minimal/AGENTS.md",
+    "my_default_minimal/README.md",
+    "my_default_minimal/databricks.yml",
+    "my_default_minimal/fixtures/.gitkeep",
+    "my_default_minimal/pyproject.toml",
+    "my_default_minimal/tests/conftest.py"
+  ]
+}
+
+>>> [CLI] bundle validate -t dev
+Name: my_default_minimal
+Target: dev
+Workspace:
+  Host: [DATABRICKS_URL]
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/my_default_minimal/dev
+
+Validation OK!
+
+>>> [CLI] bundle validate -t prod
+Name: my_default_minimal
+Target: prod
+Workspace:
+  Host: [DATABRICKS_URL]
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/my_default_minimal/prod
+
+Validation OK!
diff --git a/acceptance/bundle/templates/default-minimal/output/my_default_minimal/.vscode/__builtins__.pyi b/acceptance/bundle/templates/default-minimal/python/output/my_default_minimal/.vscode/__builtins__.pyi
similarity index 100%
rename from acceptance/bundle/templates/default-minimal/output/my_default_minimal/.vscode/__builtins__.pyi
rename to acceptance/bundle/templates/default-minimal/python/output/my_default_minimal/.vscode/__builtins__.pyi
diff --git a/acceptance/bundle/templates/default-minimal/python/output/my_default_minimal/.vscode/extensions.json b/acceptance/bundle/templates/default-minimal/python/output/my_default_minimal/.vscode/extensions.json
new file mode 100644
index 00000000000..b958aacfcb4
--- /dev/null
+++ b/acceptance/bundle/templates/default-minimal/python/output/my_default_minimal/.vscode/extensions.json
@@ -0,0 +1,7 @@
+{
+    "recommendations": [
+        "charliermarsh.ruff",
+        "databricks.databricks",
+        "redhat.vscode-yaml"
+    ]
+}
diff --git a/acceptance/bundle/templates/default-minimal/output/my_default_minimal/.vscode/settings.json b/acceptance/bundle/templates/default-minimal/python/output/my_default_minimal/.vscode/settings.json
similarity index 100%
rename from acceptance/bundle/templates/default-minimal/output/my_default_minimal/.vscode/settings.json
rename to acceptance/bundle/templates/default-minimal/python/output/my_default_minimal/.vscode/settings.json
diff --git a/acceptance/bundle/templates/default-minimal/python/output/my_default_minimal/AGENTS.md b/acceptance/bundle/templates/default-minimal/python/output/my_default_minimal/AGENTS.md
new file mode 100644
index 00000000000..fdcca98a432
--- /dev/null
+++ b/acceptance/bundle/templates/default-minimal/python/output/my_default_minimal/AGENTS.md
@@ -0,0 +1,25 @@
+# Declarative Automation Bundles Project
+
+This project uses Declarative Automation Bundles (DABs) for deployment. Add project-specific instructions below.
+
+## For AI Agents: Use Databricks AI Tools
+
+**BEFORE any other action, read the `databricks-core` skill.**
+
+It sets you up to work with this project reliably: CLI authentication, profile
+selection, data discovery, and the bundle deployment workflow. Without it,
+results are often slower and less accurate.
+
+If this skill is not available (Databricks AI Tools are not installed), you can install them for your coding agent in seconds:
+
+```bash
+databricks aitools install
+```
+
+If the CLI is not installed, see: https://docs.databricks.com/dev-tools/cli/install
+
+---
+
+## Project Instructions
+
+<!-- Add your project-specific instructions, coding conventions, or notes here -->
diff --git a/acceptance/bundle/templates/default-minimal/python/output/my_default_minimal/README.md b/acceptance/bundle/templates/default-minimal/python/output/my_default_minimal/README.md
new file mode 100644
index 00000000000..8af9ac7e000
--- /dev/null
+++ b/acceptance/bundle/templates/default-minimal/python/output/my_default_minimal/README.md
@@ -0,0 +1,62 @@
+# my_default_minimal
+
+The 'my_default_minimal' project was generated by using the default-minimal template.
+
+* `src/`: Python source code for this project.
+* `resources/`:  Resource configurations (jobs, pipelines, etc.)
+* `tests/`: Unit tests for the shared Python code.
+* `fixtures/`: Fixtures for data sets (primarily used for testing).
+
+
+## Getting started
+
+Choose how you want to work on this project:
+
+(a) Directly in your Databricks workspace, see
+    https://docs.databricks.com/dev-tools/bundles/workspace.
+
+(b) Locally with an IDE like Cursor or VS Code, see
+    https://docs.databricks.com/dev-tools/vscode-ext.html.
+
+(c) With command line tools, see https://docs.databricks.com/dev-tools/cli/databricks-cli.html
+
+If you're developing with an IDE, dependencies for this project should be installed using uv:
+
+*  Make sure you have the UV package manager installed.
+   It's an alternative to tools like pip: https://docs.astral.sh/uv/getting-started/installation/.
+*  Run `uv sync --dev` to install the project's dependencies.
+
+
+# Using this project using the CLI
+
+The Databricks workspace and IDE extensions provide a graphical interface for working
+with this project. It's also possible to interact with it directly using the CLI:
+
+1. Authenticate to your Databricks workspace, if you have not done so already:
+    ```
+    $ databricks configure
+    ```
+
+2. To deploy a development copy of this project, type:
+    ```
+    $ databricks bundle deploy --target dev
+    ```
+    (Note that "dev" is the default target, so the `--target` parameter
+    is optional here.)
+
+    This deploys everything that's defined for this project.
+
+3. Similarly, to deploy a production copy, type:
+   ```
+   $ databricks bundle deploy --target prod
+   ```
+
+4. To run a job or pipeline, use the "run" command:
+   ```
+   $ databricks bundle run
+   ```
+
+5. Finally, to run tests locally, use `pytest`:
+   ```
+   $ uv run pytest
+   ```
diff --git a/acceptance/bundle/templates/default-minimal/python/output/my_default_minimal/databricks.yml b/acceptance/bundle/templates/default-minimal/python/output/my_default_minimal/databricks.yml
new file mode 100644
index 00000000000..ec72bde8b31
--- /dev/null
+++ b/acceptance/bundle/templates/default-minimal/python/output/my_default_minimal/databricks.yml
@@ -0,0 +1,41 @@
+# This is a Declarative Automation Bundle definition for my_default_minimal.
+# See https://docs.databricks.com/dev-tools/bundles/index.html for documentation.
+bundle:
+  name: my_default_minimal
+  uuid: [UUID]
+
+include:
+  - resources/*.yml
+
+# Variable declarations. These variables are assigned in the dev/prod targets below.
+variables:
+  catalog:
+    description: The catalog to use
+  schema:
+    description: The schema to use
+
+targets:
+  dev:
+    # The default target uses 'mode: development' to create a development copy.
+    # - Deployed resources get prefixed with '[dev my_user_name]'
+    # - Any job schedules and triggers are paused by default.
+    # See also https://docs.databricks.com/dev-tools/bundles/deployment-modes.html.
+    mode: development
+    default: true
+    workspace:
+      host: [DATABRICKS_URL]
+    variables:
+      catalog: hive_metastore
+      schema: ${workspace.current_user.short_name}
+  prod:
+    mode: production
+    workspace:
+      host: [DATABRICKS_URL]
+      # We explicitly deploy to /Workspace/Users/[USERNAME] to make sure we only have a single copy.
+      root_path: /Workspace/Users/[USERNAME]/.bundle/${bundle.name}/${bundle.target}
+    variables:
+      catalog: hive_metastore
+      schema: prod
+    permissions:
+      - user_name: [USERNAME]
+        level: CAN_MANAGE
diff --git a/acceptance/bundle/templates/default-minimal/python/output/my_default_minimal/fixtures/.gitkeep b/acceptance/bundle/templates/default-minimal/python/output/my_default_minimal/fixtures/.gitkeep
new file mode 100644
index 00000000000..77a906614cb
--- /dev/null
+++ b/acceptance/bundle/templates/default-minimal/python/output/my_default_minimal/fixtures/.gitkeep
@@ -0,0 +1,9 @@
+# Test fixtures directory
+
+Add JSON or CSV files here. In tests, use them with `load_fixture()`:
+
+```
+def test_using_fixture(load_fixture):
+    data = load_fixture("my_data.json")
+    assert len(data) >= 1
+```
diff --git a/acceptance/bundle/templates/default-minimal/output/my_default_minimal/out.gitignore b/acceptance/bundle/templates/default-minimal/python/output/my_default_minimal/out.gitignore
similarity index 100%
rename from acceptance/bundle/templates/default-minimal/output/my_default_minimal/out.gitignore
rename to acceptance/bundle/templates/default-minimal/python/output/my_default_minimal/out.gitignore
diff --git a/acceptance/bundle/templates/default-minimal/python/output/my_default_minimal/pyproject.toml b/acceptance/bundle/templates/default-minimal/python/output/my_default_minimal/pyproject.toml
new file mode 100644
index 00000000000..9d08d0e9641
--- /dev/null
+++ b/acceptance/bundle/templates/default-minimal/python/output/my_default_minimal/pyproject.toml
@@ -0,0 +1,34 @@
+[project]
+name = "my_default_minimal"
+version = "0.0.1"
+authors = [{ name = "[USERNAME]" }]
+requires-python = ">=3.12,<3.13"
+dependencies = [
+    # Any dependencies for jobs and pipelines in this project can be added here
+    # See also https://docs.databricks.com/dev-tools/bundles/library-dependencies
+    #
+    # LIMITATION: for pipelines, dependencies are cached during development;
+    # add dependencies to the 'environment' section of your pipeline.yml file instead
+]
+
+[dependency-groups]
+dev = [
+    "pytest",
+    "ruff",
+    "databricks-dlt",
+    "databricks-connect>=16.4,<16.5",
+    "ipykernel",
+]
+
+[project.scripts]
+main = "my_default_minimal.main:main"
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src"]
+
+[tool.ruff]
+line-length = 120
diff --git a/acceptance/bundle/templates/default-minimal/python/output/my_default_minimal/tests/conftest.py b/acceptance/bundle/templates/default-minimal/python/output/my_default_minimal/tests/conftest.py
new file mode 100644
index 00000000000..72ebfeb5666
--- /dev/null
+++ b/acceptance/bundle/templates/default-minimal/python/output/my_default_minimal/tests/conftest.py
@@ -0,0 +1,94 @@
+"""This file configures pytest, initializes Databricks Connect, and provides fixtures for Spark and loading test data."""
+
+import os, sys, pathlib
+from contextlib import contextmanager
+
+
+try:
+    from databricks.connect import DatabricksSession
+    from databricks.sdk import WorkspaceClient
+    from pyspark.sql import SparkSession
+    import pytest
+    import json
+    import csv
+    import os
+except ImportError:
+    raise ImportError(
+        "Test dependencies not found.\n\nRun tests using 'uv run pytest'. See http://docs.astral.sh/uv to learn more about uv."
+    )
+
+
+@pytest.fixture()
+def spark() -> SparkSession:
+    """Provide a SparkSession fixture for tests.
+
+    Minimal example:
+        def test_uses_spark(spark):
+            df = spark.createDataFrame([(1,)], ["x"])
+            assert df.count() == 1
+    """
+    return DatabricksSession.builder.getOrCreate()
+
+
+@pytest.fixture()
+def load_fixture(spark: SparkSession):
+    """Provide a callable to load JSON or CSV from fixtures/ directory.
+
+    Example usage:
+
+        def test_using_fixture(load_fixture):
+            data = load_fixture("my_data.json")
+            assert data.count() >= 1
+    """
+
+    def _loader(filename: str):
+        path = pathlib.Path(__file__).parent.parent / "fixtures" / filename
+        suffix = path.suffix.lower()
+        if suffix == ".json":
+            rows = json.loads(path.read_text())
+            return spark.createDataFrame(rows)
+        if suffix == ".csv":
+            with path.open(newline="") as f:
+                rows = list(csv.DictReader(f))
+            return spark.createDataFrame(rows)
+        raise ValueError(f"Unsupported fixture type for: {filename}")
+
+    return _loader
+
+
+def _enable_fallback_compute():
+    """Enable serverless compute if no compute is specified."""
+    conf = WorkspaceClient().config
+    if conf.serverless_compute_id or conf.cluster_id or os.environ.get("SPARK_REMOTE"):
+        return
+
+    url = "https://docs.databricks.com/dev-tools/databricks-connect/cluster-config"
+    print("☁️ no compute specified, falling back to serverless compute", file=sys.stderr)
+    print(f"  see {url} for manual configuration", file=sys.stdout)
+
+    os.environ["DATABRICKS_SERVERLESS_COMPUTE_ID"] = "auto"
+
+
+@contextmanager
+def _allow_stderr_output(config: pytest.Config):
+    """Temporarily disable pytest output capture."""
+    capman = config.pluginmanager.get_plugin("capturemanager")
+    if capman:
+        with capman.global_and_fixture_disabled():
+            yield
+    else:
+        yield
+
+
+def pytest_configure(config: pytest.Config):
+    """Configure pytest session."""
+    with _allow_stderr_output(config):
+        _enable_fallback_compute()
+
+        # Initialize Spark session eagerly, so it is available even when
+        # SparkSession.builder.getOrCreate() is used. For DB Connect 15+,
+        # we validate version compatibility with the remote cluster.
+        if hasattr(DatabricksSession.builder, "validateSession"):
+            DatabricksSession.builder.validateSession().getOrCreate()
+        else:
+            DatabricksSession.builder.getOrCreate()
diff --git a/acceptance/bundle/templates/default-minimal/python/script b/acceptance/bundle/templates/default-minimal/python/script
new file mode 100644
index 00000000000..5d1d9459e88
--- /dev/null
+++ b/acceptance/bundle/templates/default-minimal/python/script
@@ -0,0 +1,16 @@
+trace $CLI bundle init default-minimal --config-file ./input.json --output-dir output -o json
+
+cd output/my_default_minimal
+
+# Verify that empty directories are preserved
+[ -d "src" ] || exit 1
+[ -d "resources" ] || exit 1
+
+trace $CLI bundle validate -t dev
+trace $CLI bundle validate -t prod
+
+# Do not affect this repository's git behaviour #2318
+mv .gitignore out.gitignore
+rm -r .databricks
+
+cd ../../
diff --git a/acceptance/bundle/templates/default-minimal/skip/input.json b/acceptance/bundle/templates/default-minimal/skip/input.json
new file mode 100644
index 00000000000..b66e679822d
--- /dev/null
+++ b/acceptance/bundle/templates/default-minimal/skip/input.json
@@ -0,0 +1,4 @@
+{
+    "project_name": "my_default_minimal",
+    "language_choice": "skip"
+}
diff --git a/acceptance/bundle/templates/default-minimal/skip/out.test.toml b/acceptance/bundle/templates/default-minimal/skip/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/templates/default-minimal/skip/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/templates/default-minimal/skip/output.txt b/acceptance/bundle/templates/default-minimal/skip/output.txt
new file mode 100644
index 00000000000..06eb69b9a11
--- /dev/null
+++ b/acceptance/bundle/templates/default-minimal/skip/output.txt
@@ -0,0 +1,33 @@
+
+>>> [CLI] bundle init default-minimal --config-file ./input.json --output-dir output
+Welcome to the minimal Declarative Automation Bundle template!
+
+This template creates a minimal project structure without sample code, ideal for advanced users.
+(For getting started with Python or SQL code, use the default-python or default-sql templates instead.)
+
+Your workspace at [DATABRICKS_URL] is used for initialization.
+(See https://docs.databricks.com/dev-tools/cli/profiles.html for how to change your profile.)
+
+✨ Your new project has been created in the 'my_default_minimal' directory!
+
+To get started, refer to the project README.md file and the documentation at https://docs.databricks.com/dev-tools/bundles/index.html.
+
+>>> [CLI] bundle validate -t dev
+Name: my_default_minimal
+Target: dev
+Workspace:
+  Host: [DATABRICKS_URL]
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/my_default_minimal/dev
+
+Validation OK!
+
+>>> [CLI] bundle validate -t prod
+Name: my_default_minimal
+Target: prod
+Workspace:
+  Host: [DATABRICKS_URL]
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/my_default_minimal/prod
+
+Validation OK!
diff --git a/acceptance/bundle/templates/default-minimal/skip/output/my_default_minimal/.vscode/extensions.json b/acceptance/bundle/templates/default-minimal/skip/output/my_default_minimal/.vscode/extensions.json
new file mode 100644
index 00000000000..1f39c330871
--- /dev/null
+++ b/acceptance/bundle/templates/default-minimal/skip/output/my_default_minimal/.vscode/extensions.json
@@ -0,0 +1,6 @@
+{
+    "recommendations": [
+        "databricks.databricks",
+        "redhat.vscode-yaml"
+    ]
+}
diff --git a/acceptance/bundle/templates/default-minimal/skip/output/my_default_minimal/.vscode/settings.json b/acceptance/bundle/templates/default-minimal/skip/output/my_default_minimal/.vscode/settings.json
new file mode 100644
index 00000000000..d3e814885cb
--- /dev/null
+++ b/acceptance/bundle/templates/default-minimal/skip/output/my_default_minimal/.vscode/settings.json
@@ -0,0 +1,5 @@
+{
+    "files.associations": {
+        "**/.gitkeep": "markdown"
+    },
+}
diff --git a/acceptance/bundle/templates/default-minimal/skip/output/my_default_minimal/AGENTS.md b/acceptance/bundle/templates/default-minimal/skip/output/my_default_minimal/AGENTS.md
new file mode 100644
index 00000000000..fdcca98a432
--- /dev/null
+++ b/acceptance/bundle/templates/default-minimal/skip/output/my_default_minimal/AGENTS.md
@@ -0,0 +1,25 @@
+# Declarative Automation Bundles Project
+
+This project uses Declarative Automation Bundles (DABs) for deployment. Add project-specific instructions below.
+
+## For AI Agents: Use Databricks AI Tools
+
+**BEFORE any other action, read the `databricks-core` skill.**
+
+It sets you up to work with this project reliably: CLI authentication, profile
+selection, data discovery, and the bundle deployment workflow. Without it,
+results are often slower and less accurate.
+
+If this skill is not available (Databricks AI Tools are not installed), you can install them for your coding agent in seconds:
+
+```bash
+databricks aitools install
+```
+
+If the CLI is not installed, see: https://docs.databricks.com/dev-tools/cli/install
+
+---
+
+## Project Instructions
+
+<!-- Add your project-specific instructions, coding conventions, or notes here -->
diff --git a/acceptance/bundle/templates/default-minimal/skip/output/my_default_minimal/README.md b/acceptance/bundle/templates/default-minimal/skip/output/my_default_minimal/README.md
new file mode 100644
index 00000000000..420f11cf53b
--- /dev/null
+++ b/acceptance/bundle/templates/default-minimal/skip/output/my_default_minimal/README.md
@@ -0,0 +1,47 @@
+# my_default_minimal
+
+The 'my_default_minimal' project was generated by using the default-minimal template.
+
+* `src/`: Any source code for this project.
+* `resources/`:  Resource configurations (jobs, pipelines, etc.)
+
+## Getting started
+
+Choose how you want to work on this project:
+
+(a) Directly in your Databricks workspace, see
+    https://docs.databricks.com/dev-tools/bundles/workspace.
+
+(b) Locally with an IDE like Cursor or VS Code, see
+    https://docs.databricks.com/dev-tools/vscode-ext.html.
+
+(c) With command line tools, see https://docs.databricks.com/dev-tools/cli/databricks-cli.html
+
+# Using this project using the CLI
+
+The Databricks workspace and IDE extensions provide a graphical interface for working
+with this project. It's also possible to interact with it directly using the CLI:
+
+1. Authenticate to your Databricks workspace, if you have not done so already:
+    ```
+    $ databricks configure
+    ```
+
+2. To deploy a development copy of this project, type:
+    ```
+    $ databricks bundle deploy --target dev
+    ```
+    (Note that "dev" is the default target, so the `--target` parameter
+    is optional here.)
+
+    This deploys everything that's defined for this project.
+
+3. Similarly, to deploy a production copy, type:
+   ```
+   $ databricks bundle deploy --target prod
+   ```
+
+4. To run a job or pipeline, use the "run" command:
+   ```
+   $ databricks bundle run
+   ```
diff --git a/acceptance/bundle/templates/default-minimal/skip/output/my_default_minimal/databricks.yml b/acceptance/bundle/templates/default-minimal/skip/output/my_default_minimal/databricks.yml
new file mode 100644
index 00000000000..ec72bde8b31
--- /dev/null
+++ b/acceptance/bundle/templates/default-minimal/skip/output/my_default_minimal/databricks.yml
@@ -0,0 +1,41 @@
+# This is a Declarative Automation Bundle definition for my_default_minimal.
+# See https://docs.databricks.com/dev-tools/bundles/index.html for documentation.
+bundle:
+  name: my_default_minimal
+  uuid: [UUID]
+
+include:
+  - resources/*.yml
+
+# Variable declarations. These variables are assigned in the dev/prod targets below.
+variables:
+  catalog:
+    description: The catalog to use
+  schema:
+    description: The schema to use
+
+targets:
+  dev:
+    # The default target uses 'mode: development' to create a development copy.
+    # - Deployed resources get prefixed with '[dev my_user_name]'
+    # - Any job schedules and triggers are paused by default.
+    # See also https://docs.databricks.com/dev-tools/bundles/deployment-modes.html.
+    mode: development
+    default: true
+    workspace:
+      host: [DATABRICKS_URL]
+    variables:
+      catalog: hive_metastore
+      schema: ${workspace.current_user.short_name}
+  prod:
+    mode: production
+    workspace:
+      host: [DATABRICKS_URL]
+      # We explicitly deploy to /Workspace/Users/[USERNAME] to make sure we only have a single copy.
+      root_path: /Workspace/Users/[USERNAME]/.bundle/${bundle.name}/${bundle.target}
+    variables:
+      catalog: hive_metastore
+      schema: prod
+    permissions:
+      - user_name: [USERNAME]
+        level: CAN_MANAGE
diff --git a/acceptance/bundle/templates/default-minimal/skip/output/my_default_minimal/out.gitignore b/acceptance/bundle/templates/default-minimal/skip/output/my_default_minimal/out.gitignore
new file mode 100644
index 00000000000..622a8811a7b
--- /dev/null
+++ b/acceptance/bundle/templates/default-minimal/skip/output/my_default_minimal/out.gitignore
@@ -0,0 +1,5 @@
+.databricks/
+scratch/**
+!scratch/README.md
+**/explorations/**
+**/!explorations/README.md
diff --git a/acceptance/bundle/templates/default-minimal/script b/acceptance/bundle/templates/default-minimal/skip/script
similarity index 100%
rename from acceptance/bundle/templates/default-minimal/script
rename to acceptance/bundle/templates/default-minimal/skip/script
diff --git a/acceptance/bundle/templates/default-minimal/input.json b/acceptance/bundle/templates/default-minimal/sql/input.json
similarity index 100%
rename from acceptance/bundle/templates/default-minimal/input.json
rename to acceptance/bundle/templates/default-minimal/sql/input.json
diff --git a/acceptance/bundle/templates/default-minimal/sql/out.test.toml b/acceptance/bundle/templates/default-minimal/sql/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/templates/default-minimal/sql/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/templates/default-minimal/sql/output.txt b/acceptance/bundle/templates/default-minimal/sql/output.txt
new file mode 100644
index 00000000000..06eb69b9a11
--- /dev/null
+++ b/acceptance/bundle/templates/default-minimal/sql/output.txt
@@ -0,0 +1,33 @@
+
+>>> [CLI] bundle init default-minimal --config-file ./input.json --output-dir output
+Welcome to the minimal Declarative Automation Bundle template!
+
+This template creates a minimal project structure without sample code, ideal for advanced users.
+(For getting started with Python or SQL code, use the default-python or default-sql templates instead.)
+
+Your workspace at [DATABRICKS_URL] is used for initialization.
+(See https://docs.databricks.com/dev-tools/cli/profiles.html for how to change your profile.)
+
+✨ Your new project has been created in the 'my_default_minimal' directory!
+
+To get started, refer to the project README.md file and the documentation at https://docs.databricks.com/dev-tools/bundles/index.html.
+
+>>> [CLI] bundle validate -t dev
+Name: my_default_minimal
+Target: dev
+Workspace:
+  Host: [DATABRICKS_URL]
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/my_default_minimal/dev
+
+Validation OK!
+
+>>> [CLI] bundle validate -t prod
+Name: my_default_minimal
+Target: prod
+Workspace:
+  Host: [DATABRICKS_URL]
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/my_default_minimal/prod
+
+Validation OK!
diff --git a/acceptance/bundle/templates/default-minimal/sql/output/my_default_minimal/.vscode/extensions.json b/acceptance/bundle/templates/default-minimal/sql/output/my_default_minimal/.vscode/extensions.json
new file mode 100644
index 00000000000..1f39c330871
--- /dev/null
+++ b/acceptance/bundle/templates/default-minimal/sql/output/my_default_minimal/.vscode/extensions.json
@@ -0,0 +1,6 @@
+{
+    "recommendations": [
+        "databricks.databricks",
+        "redhat.vscode-yaml"
+    ]
+}
diff --git a/acceptance/bundle/templates/default-minimal/sql/output/my_default_minimal/.vscode/settings.json b/acceptance/bundle/templates/default-minimal/sql/output/my_default_minimal/.vscode/settings.json
new file mode 100644
index 00000000000..d3e814885cb
--- /dev/null
+++ b/acceptance/bundle/templates/default-minimal/sql/output/my_default_minimal/.vscode/settings.json
@@ -0,0 +1,5 @@
+{
+    "files.associations": {
+        "**/.gitkeep": "markdown"
+    },
+}
diff --git a/acceptance/bundle/templates/default-minimal/sql/output/my_default_minimal/AGENTS.md b/acceptance/bundle/templates/default-minimal/sql/output/my_default_minimal/AGENTS.md
new file mode 100644
index 00000000000..fdcca98a432
--- /dev/null
+++ b/acceptance/bundle/templates/default-minimal/sql/output/my_default_minimal/AGENTS.md
@@ -0,0 +1,25 @@
+# Declarative Automation Bundles Project
+
+This project uses Declarative Automation Bundles (DABs) for deployment. Add project-specific instructions below.
+
+## For AI Agents: Use Databricks AI Tools
+
+**BEFORE any other action, read the `databricks-core` skill.**
+
+It sets you up to work with this project reliably: CLI authentication, profile
+selection, data discovery, and the bundle deployment workflow. Without it,
+results are often slower and less accurate.
+
+If this skill is not available (Databricks AI Tools are not installed), you can install them for your coding agent in seconds:
+
+```bash
+databricks aitools install
+```
+
+If the CLI is not installed, see: https://docs.databricks.com/dev-tools/cli/install
+
+---
+
+## Project Instructions
+
+<!-- Add your project-specific instructions, coding conventions, or notes here -->
diff --git a/acceptance/bundle/templates/default-minimal/sql/output/my_default_minimal/README.md b/acceptance/bundle/templates/default-minimal/sql/output/my_default_minimal/README.md
new file mode 100644
index 00000000000..ace4bdc7d74
--- /dev/null
+++ b/acceptance/bundle/templates/default-minimal/sql/output/my_default_minimal/README.md
@@ -0,0 +1,47 @@
+# my_default_minimal
+
+The 'my_default_minimal' project was generated by using the default-minimal template.
+
+* `src/`: SQL source code for this project.
+* `resources/`:  Resource configurations (jobs, pipelines, etc.)
+
+## Getting started
+
+Choose how you want to work on this project:
+
+(a) Directly in your Databricks workspace, see
+    https://docs.databricks.com/dev-tools/bundles/workspace.
+
+(b) Locally with an IDE like Cursor or VS Code, see
+    https://docs.databricks.com/dev-tools/vscode-ext.html.
+
+(c) With command line tools, see https://docs.databricks.com/dev-tools/cli/databricks-cli.html
+
+# Using this project using the CLI
+
+The Databricks workspace and IDE extensions provide a graphical interface for working
+with this project. It's also possible to interact with it directly using the CLI:
+
+1. Authenticate to your Databricks workspace, if you have not done so already:
+    ```
+    $ databricks configure
+    ```
+
+2. To deploy a development copy of this project, type:
+    ```
+    $ databricks bundle deploy --target dev
+    ```
+    (Note that "dev" is the default target, so the `--target` parameter
+    is optional here.)
+
+    This deploys everything that's defined for this project.
+
+3. Similarly, to deploy a production copy, type:
+   ```
+   $ databricks bundle deploy --target prod
+   ```
+
+4. To run a job or pipeline, use the "run" command:
+   ```
+   $ databricks bundle run
+   ```
diff --git a/acceptance/bundle/templates/default-minimal/sql/output/my_default_minimal/databricks.yml b/acceptance/bundle/templates/default-minimal/sql/output/my_default_minimal/databricks.yml
new file mode 100644
index 00000000000..ec72bde8b31
--- /dev/null
+++ b/acceptance/bundle/templates/default-minimal/sql/output/my_default_minimal/databricks.yml
@@ -0,0 +1,41 @@
+# This is a Declarative Automation Bundle definition for my_default_minimal.
+# See https://docs.databricks.com/dev-tools/bundles/index.html for documentation.
+bundle:
+  name: my_default_minimal
+  uuid: [UUID]
+
+include:
+  - resources/*.yml
+
+# Variable declarations. These variables are assigned in the dev/prod targets below.
+variables:
+  catalog:
+    description: The catalog to use
+  schema:
+    description: The schema to use
+
+targets:
+  dev:
+    # The default target uses 'mode: development' to create a development copy.
+    # - Deployed resources get prefixed with '[dev my_user_name]'
+    # - Any job schedules and triggers are paused by default.
+    # See also https://docs.databricks.com/dev-tools/bundles/deployment-modes.html.
+    mode: development
+    default: true
+    workspace:
+      host: [DATABRICKS_URL]
+    variables:
+      catalog: hive_metastore
+      schema: ${workspace.current_user.short_name}
+  prod:
+    mode: production
+    workspace:
+      host: [DATABRICKS_URL]
+      # We explicitly deploy to /Workspace/Users/[USERNAME] to make sure we only have a single copy.
+      root_path: /Workspace/Users/[USERNAME]/.bundle/${bundle.name}/${bundle.target}
+    variables:
+      catalog: hive_metastore
+      schema: prod
+    permissions:
+      - user_name: [USERNAME]
+        level: CAN_MANAGE
diff --git a/acceptance/bundle/templates/default-minimal/sql/output/my_default_minimal/out.gitignore b/acceptance/bundle/templates/default-minimal/sql/output/my_default_minimal/out.gitignore
new file mode 100644
index 00000000000..622a8811a7b
--- /dev/null
+++ b/acceptance/bundle/templates/default-minimal/sql/output/my_default_minimal/out.gitignore
@@ -0,0 +1,5 @@
+.databricks/
+scratch/**
+!scratch/README.md
+**/explorations/**
+**/!explorations/README.md
diff --git a/acceptance/bundle/templates/default-minimal/sql/script b/acceptance/bundle/templates/default-minimal/sql/script
new file mode 100644
index 00000000000..bce20c6ed9d
--- /dev/null
+++ b/acceptance/bundle/templates/default-minimal/sql/script
@@ -0,0 +1,16 @@
+trace $CLI bundle init default-minimal --config-file ./input.json --output-dir output
+
+cd output/my_default_minimal
+
+# Verify that empty directories are preserved
+[ -d "src" ] || exit 1
+[ -d "resources" ] || exit 1
+
+trace $CLI bundle validate -t dev
+trace $CLI bundle validate -t prod
+
+# Do not affect this repository's git behaviour #2318
+mv .gitignore out.gitignore
+rm -r .databricks
+
+cd ../../
diff --git a/acceptance/bundle/templates/default-python/azure-government/out.test.toml b/acceptance/bundle/templates/default-python/azure-government/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/templates/default-python/azure-government/out.test.toml
+++ b/acceptance/bundle/templates/default-python/azure-government/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/templates/default-python/classic/out.compare-vs-serverless.diff b/acceptance/bundle/templates/default-python/classic/out.compare-vs-serverless.diff
index c2f088267a5..edcb07b0fab 100644
--- a/acceptance/bundle/templates/default-python/classic/out.compare-vs-serverless.diff
+++ b/acceptance/bundle/templates/default-python/classic/out.compare-vs-serverless.diff
@@ -51,7 +51,7 @@
 -      environments:
 -        - environment_key: default
 -          spec:
--            environment_version: "4"
+-            environment_version: "5"
 -            dependencies:
 -              # By default we just include the .whl file generated for the my_default_python package.
 -              # See https://docs.databricks.com/dev-tools/bundles/library-dependencies.html
@@ -62,7 +62,7 @@
 +          new_cluster:
 +            spark_version: 16.4.x-scala2.12
 +            node_type_id: [NODE_TYPE_ID]
-+            data_security_mode: SINGLE_USER
++            data_security_mode: DATA_SECURITY_MODE_AUTO
 +            autoscale:
 +              min_workers: 1
 +              max_workers: 4
diff --git a/acceptance/bundle/templates/default-python/classic/out.plan_after_deploy_dev.direct.json b/acceptance/bundle/templates/default-python/classic/out.plan_after_deploy_dev.direct.json
deleted file mode 100644
index 6bbf30ca079..00000000000
--- a/acceptance/bundle/templates/default-python/classic/out.plan_after_deploy_dev.direct.json
+++ /dev/null
@@ -1,352 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.jobs.sample_job": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.my_default_python_etl",
-          "label": "${resources.pipelines.my_default_python_etl.id}"
-        }
-      ],
-      "action": "update",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/state/metadata.json"
-          },
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "job_clusters": [
-            {
-              "job_cluster_key": "job_cluster",
-              "new_cluster": {
-                "autoscale": {
-                  "max_workers": 4,
-                  "min_workers": 1
-                },
-                "data_security_mode": "SINGLE_USER",
-                "node_type_id": "[NODE_TYPE_ID]",
-                "spark_version": "16.4.x-scala2.12"
-              }
-            }
-          ],
-          "max_concurrent_runs": 4,
-          "name": "[dev [USERNAME]] sample_job",
-          "parameters": [
-            {
-              "default": "hive_metastore",
-              "name": "catalog"
-            },
-            {
-              "default": "[USERNAME]",
-              "name": "schema"
-            }
-          ],
-          "queue": {
-            "enabled": true
-          },
-          "tags": {
-            "dev": "[USERNAME]"
-          },
-          "tasks": [
-            {
-              "job_cluster_key": "job_cluster",
-              "libraries": [
-                {
-                  "whl": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl"
-                }
-              ],
-              "notebook_task": {
-                "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/sample_notebook"
-              },
-              "task_key": "notebook_task"
-            },
-            {
-              "depends_on": [
-                {
-                  "task_key": "notebook_task"
-                }
-              ],
-              "job_cluster_key": "job_cluster",
-              "libraries": [
-                {
-                  "whl": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl"
-                }
-              ],
-              "python_wheel_task": {
-                "entry_point": "main",
-                "package_name": "my_default_python",
-                "parameters": [
-                  "--catalog",
-                  "hive_metastore",
-                  "--schema",
-                  "[USERNAME]"
-                ]
-              },
-              "task_key": "python_wheel_task"
-            },
-            {
-              "depends_on": [
-                {
-                  "task_key": "notebook_task"
-                }
-              ],
-              "pipeline_task": {
-                "pipeline_id": "[UUID]"
-              },
-              "task_key": "refresh_pipeline"
-            }
-          ],
-          "trigger": {
-            "pause_status": "PAUSED",
-            "periodic": {
-              "interval": 1,
-              "unit": "DAYS"
-            }
-          }
-        }
-      },
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS][0],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/state/metadata.json"
-        },
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_clusters": [
-          {
-            "job_cluster_key": "job_cluster",
-            "new_cluster": {
-              "autoscale": {
-                "max_workers": 4,
-                "min_workers": 1
-              },
-              "data_security_mode": "SINGLE_USER",
-              "node_type_id": "[NODE_TYPE_ID]",
-              "spark_version": "16.4.x-scala2.12"
-            }
-          }
-        ],
-        "job_id": [NUMID],
-        "max_concurrent_runs": 4,
-        "name": "[dev [USERNAME]] sample_job",
-        "parameters": [
-          {
-            "default": "hive_metastore",
-            "name": "catalog"
-          },
-          {
-            "default": "[USERNAME]",
-            "name": "schema"
-          }
-        ],
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "tags": {
-          "dev": "[USERNAME]"
-        },
-        "tasks": [
-          {
-            "email_notifications": {},
-            "job_cluster_key": "job_cluster",
-            "libraries": [
-              {
-                "whl": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][1]-py3-none-any.whl"
-              }
-            ],
-            "notebook_task": {
-              "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/sample_notebook",
-              "source": "WORKSPACE"
-            },
-            "run_if": "ALL_SUCCESS",
-            "task_key": "notebook_task",
-            "timeout_seconds": 0
-          },
-          {
-            "depends_on": [
-              {
-                "task_key": "notebook_task"
-              }
-            ],
-            "email_notifications": {},
-            "job_cluster_key": "job_cluster",
-            "libraries": [
-              {
-                "whl": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][1]-py3-none-any.whl"
-              }
-            ],
-            "python_wheel_task": {
-              "entry_point": "main",
-              "package_name": "my_default_python",
-              "parameters": [
-                "--catalog",
-                "hive_metastore",
-                "--schema",
-                "[USERNAME]"
-              ]
-            },
-            "run_if": "ALL_SUCCESS",
-            "task_key": "python_wheel_task",
-            "timeout_seconds": 0
-          },
-          {
-            "depends_on": [
-              {
-                "task_key": "notebook_task"
-              }
-            ],
-            "email_notifications": {},
-            "pipeline_task": {
-              "pipeline_id": "[UUID]"
-            },
-            "run_if": "ALL_SUCCESS",
-            "task_key": "refresh_pipeline",
-            "timeout_seconds": 0
-          }
-        ],
-        "timeout_seconds": 0,
-        "trigger": {
-          "pause_status": "PAUSED",
-          "periodic": {
-            "interval": 1,
-            "unit": "DAYS"
-          }
-        },
-        "webhook_notifications": {}
-      },
-      "changes": {
-        "email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks[task_key='notebook_task'].email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks[task_key='notebook_task'].libraries[0].whl": {
-          "action": "update",
-          "old": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][1]-py3-none-any.whl",
-          "new": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl",
-          "remote": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][1]-py3-none-any.whl"
-        },
-        "tasks[task_key='notebook_task'].notebook_task.source": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "WORKSPACE"
-        },
-        "tasks[task_key='notebook_task'].run_if": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "ALL_SUCCESS"
-        },
-        "tasks[task_key='notebook_task'].timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "tasks[task_key='python_wheel_task'].email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks[task_key='python_wheel_task'].libraries[0].whl": {
-          "action": "update",
-          "old": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][1]-py3-none-any.whl",
-          "new": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl",
-          "remote": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][1]-py3-none-any.whl"
-        },
-        "tasks[task_key='python_wheel_task'].run_if": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "ALL_SUCCESS"
-        },
-        "tasks[task_key='python_wheel_task'].timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "tasks[task_key='refresh_pipeline'].email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks[task_key='refresh_pipeline'].run_if": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "ALL_SUCCESS"
-        },
-        "tasks[task_key='refresh_pipeline'].timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "webhook_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        }
-      }
-    },
-    "resources.pipelines.my_default_python_etl": {
-      "action": "skip",
-      "remote_state": {
-        "channel": "CURRENT",
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/state/metadata.json"
-        },
-        "development": true,
-        "edition": "ADVANCED",
-        "effective_publishing_mode": "DEFAULT_PUBLISHING_MODE",
-        "environment": {
-          "dependencies": [
-            "--editable /Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files"
-          ]
-        },
-        "id": "[UUID]",
-        "last_modified": [UNIX_TIME_MILLIS][1],
-        "libraries": [
-          {
-            "glob": {
-              "include": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python_etl/transformations/**"
-            }
-          }
-        ],
-        "name": "[dev [USERNAME]] my_default_python_etl",
-        "pipeline_id": "[UUID]",
-        "root_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python_etl",
-        "run_as_user_name": "[USERNAME]",
-        "schema": "[USERNAME]",
-        "state": "IDLE",
-        "storage": "dbfs:/pipelines/[UUID]",
-        "tags": {
-          "dev": "[USERNAME]"
-        }
-      },
-      "changes": {
-        "storage": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "dbfs:/pipelines/[UUID]"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/templates/default-python/classic/out.plan_after_deploy_dev.json b/acceptance/bundle/templates/default-python/classic/out.plan_after_deploy_dev.json
new file mode 100644
index 00000000000..b83830d569f
--- /dev/null
+++ b/acceptance/bundle/templates/default-python/classic/out.plan_after_deploy_dev.json
@@ -0,0 +1,352 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.jobs.sample_job": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.my_default_python_etl",
+          "label": "${resources.pipelines.my_default_python_etl.id}"
+        }
+      ],
+      "action": "update",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "job_clusters": [
+            {
+              "job_cluster_key": "job_cluster",
+              "new_cluster": {
+                "autoscale": {
+                  "max_workers": 4,
+                  "min_workers": 1
+                },
+                "data_security_mode": "DATA_SECURITY_MODE_AUTO",
+                "node_type_id": "[NODE_TYPE_ID]",
+                "spark_version": "16.4.x-scala2.12"
+              }
+            }
+          ],
+          "max_concurrent_runs": 4,
+          "name": "[dev [USERNAME]] sample_job",
+          "parameters": [
+            {
+              "default": "hive_metastore",
+              "name": "catalog"
+            },
+            {
+              "default": "[USERNAME]",
+              "name": "schema"
+            }
+          ],
+          "queue": {
+            "enabled": true
+          },
+          "tags": {
+            "dev": "[USERNAME]"
+          },
+          "tasks": [
+            {
+              "job_cluster_key": "job_cluster",
+              "libraries": [
+                {
+                  "whl": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl"
+                }
+              ],
+              "notebook_task": {
+                "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/sample_notebook"
+              },
+              "task_key": "notebook_task"
+            },
+            {
+              "depends_on": [
+                {
+                  "task_key": "notebook_task"
+                }
+              ],
+              "job_cluster_key": "job_cluster",
+              "libraries": [
+                {
+                  "whl": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl"
+                }
+              ],
+              "python_wheel_task": {
+                "entry_point": "main",
+                "package_name": "my_default_python",
+                "parameters": [
+                  "--catalog",
+                  "hive_metastore",
+                  "--schema",
+                  "[USERNAME]"
+                ]
+              },
+              "task_key": "python_wheel_task"
+            },
+            {
+              "depends_on": [
+                {
+                  "task_key": "notebook_task"
+                }
+              ],
+              "pipeline_task": {
+                "pipeline_id": "[UUID]"
+              },
+              "task_key": "refresh_pipeline"
+            }
+          ],
+          "trigger": {
+            "pause_status": "PAUSED",
+            "periodic": {
+              "interval": 1,
+              "unit": "DAYS"
+            }
+          }
+        }
+      },
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS][0],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/state/metadata.json"
+        },
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_clusters": [
+          {
+            "job_cluster_key": "job_cluster",
+            "new_cluster": {
+              "autoscale": {
+                "max_workers": 4,
+                "min_workers": 1
+              },
+              "data_security_mode": "DATA_SECURITY_MODE_AUTO",
+              "node_type_id": "[NODE_TYPE_ID]",
+              "spark_version": "16.4.x-scala2.12"
+            }
+          }
+        ],
+        "job_id": [SAMPLE_JOB_ID],
+        "max_concurrent_runs": 4,
+        "name": "[dev [USERNAME]] sample_job",
+        "parameters": [
+          {
+            "default": "hive_metastore",
+            "name": "catalog"
+          },
+          {
+            "default": "[USERNAME]",
+            "name": "schema"
+          }
+        ],
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "tags": {
+          "dev": "[USERNAME]"
+        },
+        "tasks": [
+          {
+            "email_notifications": {},
+            "job_cluster_key": "job_cluster",
+            "libraries": [
+              {
+                "whl": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][1]-py3-none-any.whl"
+              }
+            ],
+            "notebook_task": {
+              "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/sample_notebook",
+              "source": "WORKSPACE"
+            },
+            "run_if": "ALL_SUCCESS",
+            "task_key": "notebook_task",
+            "timeout_seconds": 0
+          },
+          {
+            "depends_on": [
+              {
+                "task_key": "notebook_task"
+              }
+            ],
+            "email_notifications": {},
+            "job_cluster_key": "job_cluster",
+            "libraries": [
+              {
+                "whl": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][1]-py3-none-any.whl"
+              }
+            ],
+            "python_wheel_task": {
+              "entry_point": "main",
+              "package_name": "my_default_python",
+              "parameters": [
+                "--catalog",
+                "hive_metastore",
+                "--schema",
+                "[USERNAME]"
+              ]
+            },
+            "run_if": "ALL_SUCCESS",
+            "task_key": "python_wheel_task",
+            "timeout_seconds": 0
+          },
+          {
+            "depends_on": [
+              {
+                "task_key": "notebook_task"
+              }
+            ],
+            "email_notifications": {},
+            "pipeline_task": {
+              "pipeline_id": "[UUID]"
+            },
+            "run_if": "ALL_SUCCESS",
+            "task_key": "refresh_pipeline",
+            "timeout_seconds": 0
+          }
+        ],
+        "timeout_seconds": 0,
+        "trigger": {
+          "pause_status": "PAUSED",
+          "periodic": {
+            "interval": 1,
+            "unit": "DAYS"
+          }
+        },
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='notebook_task'].email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='notebook_task'].libraries[0].whl": {
+          "action": "update",
+          "old": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][1]-py3-none-any.whl",
+          "new": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl",
+          "remote": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][1]-py3-none-any.whl"
+        },
+        "tasks[task_key='notebook_task'].notebook_task.source": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": "WORKSPACE"
+        },
+        "tasks[task_key='notebook_task'].run_if": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": "ALL_SUCCESS"
+        },
+        "tasks[task_key='notebook_task'].timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "tasks[task_key='python_wheel_task'].email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='python_wheel_task'].libraries[0].whl": {
+          "action": "update",
+          "old": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][1]-py3-none-any.whl",
+          "new": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl",
+          "remote": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][1]-py3-none-any.whl"
+        },
+        "tasks[task_key='python_wheel_task'].run_if": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": "ALL_SUCCESS"
+        },
+        "tasks[task_key='python_wheel_task'].timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "tasks[task_key='refresh_pipeline'].email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='refresh_pipeline'].run_if": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": "ALL_SUCCESS"
+        },
+        "tasks[task_key='refresh_pipeline'].timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    },
+    "resources.pipelines.my_default_python_etl": {
+      "action": "skip",
+      "remote_state": {
+        "channel": "CURRENT",
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/state/metadata.json"
+        },
+        "development": true,
+        "edition": "ADVANCED",
+        "effective_publishing_mode": "DEFAULT_PUBLISHING_MODE",
+        "environment": {
+          "dependencies": [
+            "--editable /Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files"
+          ]
+        },
+        "id": "[UUID]",
+        "last_modified": [UNIX_TIME_MILLIS][1],
+        "libraries": [
+          {
+            "glob": {
+              "include": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python_etl/transformations/**"
+            }
+          }
+        ],
+        "name": "[dev [USERNAME]] my_default_python_etl",
+        "pipeline_id": "[UUID]",
+        "root_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python_etl",
+        "run_as_user_name": "[USERNAME]",
+        "schema": "[USERNAME]",
+        "state": "IDLE",
+        "storage": "dbfs:/pipelines/[UUID]",
+        "tags": {
+          "dev": "[USERNAME]"
+        }
+      },
+      "changes": {
+        "storage": {
+          "action": "skip",
+          "reason": "immutable_backend_value",
+          "remote": "dbfs:/pipelines/[UUID]"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/templates/default-python/classic/out.plan_after_deploy_dev.terraform.json b/acceptance/bundle/templates/default-python/classic/out.plan_after_deploy_dev.terraform.json
deleted file mode 100644
index 11b2490b09c..00000000000
--- a/acceptance/bundle/templates/default-python/classic/out.plan_after_deploy_dev.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.sample_job": {
-      "action": "update"
-    },
-    "resources.pipelines.my_default_python_etl": {
-      "action": "skip"
-    }
-  }
-}
diff --git a/acceptance/bundle/templates/default-python/classic/out.plan_after_deploy_prod.direct.json b/acceptance/bundle/templates/default-python/classic/out.plan_after_deploy_prod.direct.json
deleted file mode 100644
index 6cf49d4bdef..00000000000
--- a/acceptance/bundle/templates/default-python/classic/out.plan_after_deploy_prod.direct.json
+++ /dev/null
@@ -1,271 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.jobs.sample_job": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.my_default_python_etl",
-          "label": "${resources.pipelines.my_default_python_etl.id}"
-        }
-      ],
-      "action": "skip",
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS][0],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/state/metadata.json"
-        },
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "format": "MULTI_TASK",
-        "job_clusters": [
-          {
-            "job_cluster_key": "job_cluster",
-            "new_cluster": {
-              "autoscale": {
-                "max_workers": 4,
-                "min_workers": 1
-              },
-              "data_security_mode": "SINGLE_USER",
-              "node_type_id": "[NODE_TYPE_ID]",
-              "spark_version": "16.4.x-scala2.12"
-            }
-          }
-        ],
-        "job_id": [NUMID],
-        "max_concurrent_runs": 1,
-        "name": "sample_job",
-        "parameters": [
-          {
-            "default": "hive_metastore",
-            "name": "catalog"
-          },
-          {
-            "default": "prod",
-            "name": "schema"
-          }
-        ],
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "tasks": [
-          {
-            "email_notifications": {},
-            "job_cluster_key": "job_cluster",
-            "libraries": [
-              {
-                "whl": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/artifacts/.internal/my_default_python-0.0.1-py3-none-any.whl"
-              }
-            ],
-            "notebook_task": {
-              "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/sample_notebook",
-              "source": "WORKSPACE"
-            },
-            "run_if": "ALL_SUCCESS",
-            "task_key": "notebook_task",
-            "timeout_seconds": 0
-          },
-          {
-            "depends_on": [
-              {
-                "task_key": "notebook_task"
-              }
-            ],
-            "email_notifications": {},
-            "job_cluster_key": "job_cluster",
-            "libraries": [
-              {
-                "whl": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/artifacts/.internal/my_default_python-0.0.1-py3-none-any.whl"
-              }
-            ],
-            "python_wheel_task": {
-              "entry_point": "main",
-              "package_name": "my_default_python",
-              "parameters": [
-                "--catalog",
-                "hive_metastore",
-                "--schema",
-                "prod"
-              ]
-            },
-            "run_if": "ALL_SUCCESS",
-            "task_key": "python_wheel_task",
-            "timeout_seconds": 0
-          },
-          {
-            "depends_on": [
-              {
-                "task_key": "notebook_task"
-              }
-            ],
-            "email_notifications": {},
-            "pipeline_task": {
-              "pipeline_id": "[UUID]"
-            },
-            "run_if": "ALL_SUCCESS",
-            "task_key": "refresh_pipeline",
-            "timeout_seconds": 0
-          }
-        ],
-        "timeout_seconds": 0,
-        "trigger": {
-          "pause_status": "UNPAUSED",
-          "periodic": {
-            "interval": 1,
-            "unit": "DAYS"
-          }
-        },
-        "webhook_notifications": {}
-      },
-      "changes": {
-        "email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks[task_key='notebook_task'].email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks[task_key='notebook_task'].notebook_task.source": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "WORKSPACE"
-        },
-        "tasks[task_key='notebook_task'].run_if": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "ALL_SUCCESS"
-        },
-        "tasks[task_key='notebook_task'].timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "tasks[task_key='python_wheel_task'].email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks[task_key='python_wheel_task'].run_if": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "ALL_SUCCESS"
-        },
-        "tasks[task_key='python_wheel_task'].timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "tasks[task_key='refresh_pipeline'].email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks[task_key='refresh_pipeline'].run_if": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "ALL_SUCCESS"
-        },
-        "tasks[task_key='refresh_pipeline'].timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "webhook_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        }
-      }
-    },
-    "resources.jobs.sample_job.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.sample_job",
-          "label": "${resources.jobs.sample_job.id}"
-        }
-      ],
-      "action": "skip",
-      "remote_state": {
-        "object_id": "/jobs/[NUMID]",
-        "__embed__": [
-          {
-            "level": "IS_OWNER",
-            "user_name": "[USERNAME]"
-          }
-        ]
-      }
-    },
-    "resources.pipelines.my_default_python_etl": {
-      "action": "skip",
-      "remote_state": {
-        "channel": "CURRENT",
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/state/metadata.json"
-        },
-        "edition": "ADVANCED",
-        "effective_publishing_mode": "DEFAULT_PUBLISHING_MODE",
-        "environment": {
-          "dependencies": [
-            "--editable /Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files"
-          ]
-        },
-        "id": "[UUID]",
-        "last_modified": [UNIX_TIME_MILLIS][1],
-        "libraries": [
-          {
-            "glob": {
-              "include": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python_etl/transformations/**"
-            }
-          }
-        ],
-        "name": "my_default_python_etl",
-        "pipeline_id": "[UUID]",
-        "root_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python_etl",
-        "run_as_user_name": "[USERNAME]",
-        "schema": "prod",
-        "state": "IDLE",
-        "storage": "dbfs:/pipelines/[UUID]"
-      },
-      "changes": {
-        "storage": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "dbfs:/pipelines/[UUID]"
-        }
-      }
-    },
-    "resources.pipelines.my_default_python_etl.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.my_default_python_etl",
-          "label": "${resources.pipelines.my_default_python_etl.id}"
-        }
-      ],
-      "action": "skip",
-      "remote_state": {
-        "object_id": "/pipelines/[UUID]",
-        "__embed__": [
-          {
-            "level": "IS_OWNER",
-            "user_name": "[USERNAME]"
-          }
-        ]
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/templates/default-python/classic/out.plan_after_deploy_prod.json b/acceptance/bundle/templates/default-python/classic/out.plan_after_deploy_prod.json
new file mode 100644
index 00000000000..e781152f464
--- /dev/null
+++ b/acceptance/bundle/templates/default-python/classic/out.plan_after_deploy_prod.json
@@ -0,0 +1,271 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.jobs.sample_job": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.my_default_python_etl",
+          "label": "${resources.pipelines.my_default_python_etl.id}"
+        }
+      ],
+      "action": "skip",
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS][0],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/state/metadata.json"
+        },
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "format": "MULTI_TASK",
+        "job_clusters": [
+          {
+            "job_cluster_key": "job_cluster",
+            "new_cluster": {
+              "autoscale": {
+                "max_workers": 4,
+                "min_workers": 1
+              },
+              "data_security_mode": "DATA_SECURITY_MODE_AUTO",
+              "node_type_id": "[NODE_TYPE_ID]",
+              "spark_version": "16.4.x-scala2.12"
+            }
+          }
+        ],
+        "job_id": [SAMPLE_JOB_ID_2],
+        "max_concurrent_runs": 1,
+        "name": "sample_job",
+        "parameters": [
+          {
+            "default": "hive_metastore",
+            "name": "catalog"
+          },
+          {
+            "default": "prod",
+            "name": "schema"
+          }
+        ],
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "tasks": [
+          {
+            "email_notifications": {},
+            "job_cluster_key": "job_cluster",
+            "libraries": [
+              {
+                "whl": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/artifacts/.internal/my_default_python-0.0.1-py3-none-any.whl"
+              }
+            ],
+            "notebook_task": {
+              "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/sample_notebook",
+              "source": "WORKSPACE"
+            },
+            "run_if": "ALL_SUCCESS",
+            "task_key": "notebook_task",
+            "timeout_seconds": 0
+          },
+          {
+            "depends_on": [
+              {
+                "task_key": "notebook_task"
+              }
+            ],
+            "email_notifications": {},
+            "job_cluster_key": "job_cluster",
+            "libraries": [
+              {
+                "whl": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/artifacts/.internal/my_default_python-0.0.1-py3-none-any.whl"
+              }
+            ],
+            "python_wheel_task": {
+              "entry_point": "main",
+              "package_name": "my_default_python",
+              "parameters": [
+                "--catalog",
+                "hive_metastore",
+                "--schema",
+                "prod"
+              ]
+            },
+            "run_if": "ALL_SUCCESS",
+            "task_key": "python_wheel_task",
+            "timeout_seconds": 0
+          },
+          {
+            "depends_on": [
+              {
+                "task_key": "notebook_task"
+              }
+            ],
+            "email_notifications": {},
+            "pipeline_task": {
+              "pipeline_id": "[UUID]"
+            },
+            "run_if": "ALL_SUCCESS",
+            "task_key": "refresh_pipeline",
+            "timeout_seconds": 0
+          }
+        ],
+        "timeout_seconds": 0,
+        "trigger": {
+          "pause_status": "UNPAUSED",
+          "periodic": {
+            "interval": 1,
+            "unit": "DAYS"
+          }
+        },
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='notebook_task'].email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='notebook_task'].notebook_task.source": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": "WORKSPACE"
+        },
+        "tasks[task_key='notebook_task'].run_if": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": "ALL_SUCCESS"
+        },
+        "tasks[task_key='notebook_task'].timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "tasks[task_key='python_wheel_task'].email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='python_wheel_task'].run_if": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": "ALL_SUCCESS"
+        },
+        "tasks[task_key='python_wheel_task'].timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "tasks[task_key='refresh_pipeline'].email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='refresh_pipeline'].run_if": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": "ALL_SUCCESS"
+        },
+        "tasks[task_key='refresh_pipeline'].timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    },
+    "resources.jobs.sample_job.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.sample_job",
+          "label": "${resources.jobs.sample_job.id}"
+        }
+      ],
+      "action": "skip",
+      "remote_state": {
+        "object_id": "/jobs/[SAMPLE_JOB_ID_2]",
+        "__embed__": [
+          {
+            "level": "IS_OWNER",
+            "user_name": "[USERNAME]"
+          }
+        ]
+      }
+    },
+    "resources.pipelines.my_default_python_etl": {
+      "action": "skip",
+      "remote_state": {
+        "channel": "CURRENT",
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/state/metadata.json"
+        },
+        "edition": "ADVANCED",
+        "effective_publishing_mode": "DEFAULT_PUBLISHING_MODE",
+        "environment": {
+          "dependencies": [
+            "--editable /Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files"
+          ]
+        },
+        "id": "[UUID]",
+        "last_modified": [UNIX_TIME_MILLIS][1],
+        "libraries": [
+          {
+            "glob": {
+              "include": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python_etl/transformations/**"
+            }
+          }
+        ],
+        "name": "my_default_python_etl",
+        "pipeline_id": "[UUID]",
+        "root_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python_etl",
+        "run_as_user_name": "[USERNAME]",
+        "schema": "prod",
+        "state": "IDLE",
+        "storage": "dbfs:/pipelines/[UUID]"
+      },
+      "changes": {
+        "storage": {
+          "action": "skip",
+          "reason": "immutable_backend_value",
+          "remote": "dbfs:/pipelines/[UUID]"
+        }
+      }
+    },
+    "resources.pipelines.my_default_python_etl.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.my_default_python_etl",
+          "label": "${resources.pipelines.my_default_python_etl.id}"
+        }
+      ],
+      "action": "skip",
+      "remote_state": {
+        "object_id": "/pipelines/[UUID]",
+        "__embed__": [
+          {
+            "level": "IS_OWNER",
+            "user_name": "[USERNAME]"
+          }
+        ]
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/templates/default-python/classic/out.plan_after_deploy_prod.terraform.json b/acceptance/bundle/templates/default-python/classic/out.plan_after_deploy_prod.terraform.json
deleted file mode 100644
index 103b8a29e32..00000000000
--- a/acceptance/bundle/templates/default-python/classic/out.plan_after_deploy_prod.terraform.json
+++ /dev/null
@@ -1,17 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.sample_job": {
-      "action": "skip"
-    },
-    "resources.jobs.sample_job.permissions": {
-      "action": "skip"
-    },
-    "resources.pipelines.my_default_python_etl": {
-      "action": "skip"
-    },
-    "resources.pipelines.my_default_python_etl.permissions": {
-      "action": "skip"
-    }
-  }
-}
diff --git a/acceptance/bundle/templates/default-python/classic/out.plan_dev.direct.json b/acceptance/bundle/templates/default-python/classic/out.plan_dev.direct.json
deleted file mode 100644
index 15fbeb41e8a..00000000000
--- a/acceptance/bundle/templates/default-python/classic/out.plan_dev.direct.json
+++ /dev/null
@@ -1,148 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.sample_job": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.my_default_python_etl",
-          "label": "${resources.pipelines.my_default_python_etl.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/state/metadata.json"
-          },
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "job_clusters": [
-            {
-              "job_cluster_key": "job_cluster",
-              "new_cluster": {
-                "autoscale": {
-                  "max_workers": 4,
-                  "min_workers": 1
-                },
-                "data_security_mode": "SINGLE_USER",
-                "node_type_id": "[NODE_TYPE_ID]",
-                "spark_version": "16.4.x-scala2.12"
-              }
-            }
-          ],
-          "max_concurrent_runs": 4,
-          "name": "[dev [USERNAME]] sample_job",
-          "parameters": [
-            {
-              "default": "hive_metastore",
-              "name": "catalog"
-            },
-            {
-              "default": "[USERNAME]",
-              "name": "schema"
-            }
-          ],
-          "queue": {
-            "enabled": true
-          },
-          "tags": {
-            "dev": "[USERNAME]"
-          },
-          "tasks": [
-            {
-              "job_cluster_key": "job_cluster",
-              "libraries": [
-                {
-                  "whl": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl"
-                }
-              ],
-              "notebook_task": {
-                "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/sample_notebook"
-              },
-              "task_key": "notebook_task"
-            },
-            {
-              "depends_on": [
-                {
-                  "task_key": "notebook_task"
-                }
-              ],
-              "job_cluster_key": "job_cluster",
-              "libraries": [
-                {
-                  "whl": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl"
-                }
-              ],
-              "python_wheel_task": {
-                "entry_point": "main",
-                "package_name": "my_default_python",
-                "parameters": [
-                  "--catalog",
-                  "hive_metastore",
-                  "--schema",
-                  "[USERNAME]"
-                ]
-              },
-              "task_key": "python_wheel_task"
-            },
-            {
-              "depends_on": [
-                {
-                  "task_key": "notebook_task"
-                }
-              ],
-              "pipeline_task": {
-                "pipeline_id": "${resources.pipelines.my_default_python_etl.id}"
-              },
-              "task_key": "refresh_pipeline"
-            }
-          ],
-          "trigger": {
-            "pause_status": "PAUSED",
-            "periodic": {
-              "interval": 1,
-              "unit": "DAYS"
-            }
-          }
-        },
-        "vars": {
-          "tasks[2].pipeline_task.pipeline_id": "${resources.pipelines.my_default_python_etl.id}"
-        }
-      }
-    },
-    "resources.pipelines.my_default_python_etl": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "channel": "CURRENT",
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/state/metadata.json"
-          },
-          "development": true,
-          "edition": "ADVANCED",
-          "environment": {
-            "dependencies": [
-              "--editable /Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files"
-            ]
-          },
-          "libraries": [
-            {
-              "glob": {
-                "include": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python_etl/transformations/**"
-              }
-            }
-          ],
-          "name": "[dev [USERNAME]] my_default_python_etl",
-          "root_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python_etl",
-          "schema": "[USERNAME]",
-          "tags": {
-            "dev": "[USERNAME]"
-          }
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/templates/default-python/classic/out.plan_dev.json b/acceptance/bundle/templates/default-python/classic/out.plan_dev.json
new file mode 100644
index 00000000000..12ce3f987f5
--- /dev/null
+++ b/acceptance/bundle/templates/default-python/classic/out.plan_dev.json
@@ -0,0 +1,148 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.jobs.sample_job": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.my_default_python_etl",
+          "label": "${resources.pipelines.my_default_python_etl.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "job_clusters": [
+            {
+              "job_cluster_key": "job_cluster",
+              "new_cluster": {
+                "autoscale": {
+                  "max_workers": 4,
+                  "min_workers": 1
+                },
+                "data_security_mode": "DATA_SECURITY_MODE_AUTO",
+                "node_type_id": "[NODE_TYPE_ID]",
+                "spark_version": "16.4.x-scala2.12"
+              }
+            }
+          ],
+          "max_concurrent_runs": 4,
+          "name": "[dev [USERNAME]] sample_job",
+          "parameters": [
+            {
+              "default": "hive_metastore",
+              "name": "catalog"
+            },
+            {
+              "default": "[USERNAME]",
+              "name": "schema"
+            }
+          ],
+          "queue": {
+            "enabled": true
+          },
+          "tags": {
+            "dev": "[USERNAME]"
+          },
+          "tasks": [
+            {
+              "job_cluster_key": "job_cluster",
+              "libraries": [
+                {
+                  "whl": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl"
+                }
+              ],
+              "notebook_task": {
+                "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/sample_notebook"
+              },
+              "task_key": "notebook_task"
+            },
+            {
+              "depends_on": [
+                {
+                  "task_key": "notebook_task"
+                }
+              ],
+              "job_cluster_key": "job_cluster",
+              "libraries": [
+                {
+                  "whl": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl"
+                }
+              ],
+              "python_wheel_task": {
+                "entry_point": "main",
+                "package_name": "my_default_python",
+                "parameters": [
+                  "--catalog",
+                  "hive_metastore",
+                  "--schema",
+                  "[USERNAME]"
+                ]
+              },
+              "task_key": "python_wheel_task"
+            },
+            {
+              "depends_on": [
+                {
+                  "task_key": "notebook_task"
+                }
+              ],
+              "pipeline_task": {
+                "pipeline_id": "${resources.pipelines.my_default_python_etl.id}"
+              },
+              "task_key": "refresh_pipeline"
+            }
+          ],
+          "trigger": {
+            "pause_status": "PAUSED",
+            "periodic": {
+              "interval": 1,
+              "unit": "DAYS"
+            }
+          }
+        },
+        "vars": {
+          "tasks[2].pipeline_task.pipeline_id": "${resources.pipelines.my_default_python_etl.id}"
+        }
+      }
+    },
+    "resources.pipelines.my_default_python_etl": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "channel": "CURRENT",
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/state/metadata.json"
+          },
+          "development": true,
+          "edition": "ADVANCED",
+          "environment": {
+            "dependencies": [
+              "--editable /Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files"
+            ]
+          },
+          "libraries": [
+            {
+              "glob": {
+                "include": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python_etl/transformations/**"
+              }
+            }
+          ],
+          "name": "[dev [USERNAME]] my_default_python_etl",
+          "root_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python_etl",
+          "schema": "[USERNAME]",
+          "tags": {
+            "dev": "[USERNAME]"
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/templates/default-python/classic/out.plan_dev.terraform.json b/acceptance/bundle/templates/default-python/classic/out.plan_dev.terraform.json
deleted file mode 100644
index 8c17fc10856..00000000000
--- a/acceptance/bundle/templates/default-python/classic/out.plan_dev.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.sample_job": {
-      "action": "create"
-    },
-    "resources.pipelines.my_default_python_etl": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/templates/default-python/classic/out.plan_prod.direct.json b/acceptance/bundle/templates/default-python/classic/out.plan_prod.direct.json
deleted file mode 100644
index 7aade166fbd..00000000000
--- a/acceptance/bundle/templates/default-python/classic/out.plan_prod.direct.json
+++ /dev/null
@@ -1,187 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.sample_job": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.my_default_python_etl",
-          "label": "${resources.pipelines.my_default_python_etl.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/state/metadata.json"
-          },
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "job_clusters": [
-            {
-              "job_cluster_key": "job_cluster",
-              "new_cluster": {
-                "autoscale": {
-                  "max_workers": 4,
-                  "min_workers": 1
-                },
-                "data_security_mode": "SINGLE_USER",
-                "node_type_id": "[NODE_TYPE_ID]",
-                "spark_version": "16.4.x-scala2.12"
-              }
-            }
-          ],
-          "max_concurrent_runs": 1,
-          "name": "sample_job",
-          "parameters": [
-            {
-              "default": "hive_metastore",
-              "name": "catalog"
-            },
-            {
-              "default": "prod",
-              "name": "schema"
-            }
-          ],
-          "queue": {
-            "enabled": true
-          },
-          "tasks": [
-            {
-              "job_cluster_key": "job_cluster",
-              "libraries": [
-                {
-                  "whl": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/artifacts/.internal/my_default_python-0.0.1-py3-none-any.whl"
-                }
-              ],
-              "notebook_task": {
-                "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/sample_notebook"
-              },
-              "task_key": "notebook_task"
-            },
-            {
-              "depends_on": [
-                {
-                  "task_key": "notebook_task"
-                }
-              ],
-              "job_cluster_key": "job_cluster",
-              "libraries": [
-                {
-                  "whl": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/artifacts/.internal/my_default_python-0.0.1-py3-none-any.whl"
-                }
-              ],
-              "python_wheel_task": {
-                "entry_point": "main",
-                "package_name": "my_default_python",
-                "parameters": [
-                  "--catalog",
-                  "hive_metastore",
-                  "--schema",
-                  "prod"
-                ]
-              },
-              "task_key": "python_wheel_task"
-            },
-            {
-              "depends_on": [
-                {
-                  "task_key": "notebook_task"
-                }
-              ],
-              "pipeline_task": {
-                "pipeline_id": "${resources.pipelines.my_default_python_etl.id}"
-              },
-              "task_key": "refresh_pipeline"
-            }
-          ],
-          "trigger": {
-            "pause_status": "UNPAUSED",
-            "periodic": {
-              "interval": 1,
-              "unit": "DAYS"
-            }
-          }
-        },
-        "vars": {
-          "tasks[2].pipeline_task.pipeline_id": "${resources.pipelines.my_default_python_etl.id}"
-        }
-      }
-    },
-    "resources.jobs.sample_job.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.sample_job",
-          "label": "${resources.jobs.sample_job.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "IS_OWNER",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/jobs/${resources.jobs.sample_job.id}"
-        }
-      }
-    },
-    "resources.pipelines.my_default_python_etl": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "channel": "CURRENT",
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/state/metadata.json"
-          },
-          "edition": "ADVANCED",
-          "environment": {
-            "dependencies": [
-              "--editable /Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files"
-            ]
-          },
-          "libraries": [
-            {
-              "glob": {
-                "include": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python_etl/transformations/**"
-              }
-            }
-          ],
-          "name": "my_default_python_etl",
-          "root_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python_etl",
-          "schema": "prod"
-        }
-      }
-    },
-    "resources.pipelines.my_default_python_etl.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.my_default_python_etl",
-          "label": "${resources.pipelines.my_default_python_etl.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "IS_OWNER",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/pipelines/${resources.pipelines.my_default_python_etl.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/templates/default-python/classic/out.plan_prod.json b/acceptance/bundle/templates/default-python/classic/out.plan_prod.json
new file mode 100644
index 00000000000..20e33bf4620
--- /dev/null
+++ b/acceptance/bundle/templates/default-python/classic/out.plan_prod.json
@@ -0,0 +1,187 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.jobs.sample_job": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.my_default_python_etl",
+          "label": "${resources.pipelines.my_default_python_etl.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "job_clusters": [
+            {
+              "job_cluster_key": "job_cluster",
+              "new_cluster": {
+                "autoscale": {
+                  "max_workers": 4,
+                  "min_workers": 1
+                },
+                "data_security_mode": "DATA_SECURITY_MODE_AUTO",
+                "node_type_id": "[NODE_TYPE_ID]",
+                "spark_version": "16.4.x-scala2.12"
+              }
+            }
+          ],
+          "max_concurrent_runs": 1,
+          "name": "sample_job",
+          "parameters": [
+            {
+              "default": "hive_metastore",
+              "name": "catalog"
+            },
+            {
+              "default": "prod",
+              "name": "schema"
+            }
+          ],
+          "queue": {
+            "enabled": true
+          },
+          "tasks": [
+            {
+              "job_cluster_key": "job_cluster",
+              "libraries": [
+                {
+                  "whl": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/artifacts/.internal/my_default_python-0.0.1-py3-none-any.whl"
+                }
+              ],
+              "notebook_task": {
+                "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/sample_notebook"
+              },
+              "task_key": "notebook_task"
+            },
+            {
+              "depends_on": [
+                {
+                  "task_key": "notebook_task"
+                }
+              ],
+              "job_cluster_key": "job_cluster",
+              "libraries": [
+                {
+                  "whl": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/artifacts/.internal/my_default_python-0.0.1-py3-none-any.whl"
+                }
+              ],
+              "python_wheel_task": {
+                "entry_point": "main",
+                "package_name": "my_default_python",
+                "parameters": [
+                  "--catalog",
+                  "hive_metastore",
+                  "--schema",
+                  "prod"
+                ]
+              },
+              "task_key": "python_wheel_task"
+            },
+            {
+              "depends_on": [
+                {
+                  "task_key": "notebook_task"
+                }
+              ],
+              "pipeline_task": {
+                "pipeline_id": "${resources.pipelines.my_default_python_etl.id}"
+              },
+              "task_key": "refresh_pipeline"
+            }
+          ],
+          "trigger": {
+            "pause_status": "UNPAUSED",
+            "periodic": {
+              "interval": 1,
+              "unit": "DAYS"
+            }
+          }
+        },
+        "vars": {
+          "tasks[2].pipeline_task.pipeline_id": "${resources.pipelines.my_default_python_etl.id}"
+        }
+      }
+    },
+    "resources.jobs.sample_job.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.sample_job",
+          "label": "${resources.jobs.sample_job.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "IS_OWNER",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/jobs/${resources.jobs.sample_job.id}"
+        }
+      }
+    },
+    "resources.pipelines.my_default_python_etl": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "channel": "CURRENT",
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/state/metadata.json"
+          },
+          "edition": "ADVANCED",
+          "environment": {
+            "dependencies": [
+              "--editable /Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files"
+            ]
+          },
+          "libraries": [
+            {
+              "glob": {
+                "include": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python_etl/transformations/**"
+              }
+            }
+          ],
+          "name": "my_default_python_etl",
+          "root_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python_etl",
+          "schema": "prod"
+        }
+      }
+    },
+    "resources.pipelines.my_default_python_etl.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.my_default_python_etl",
+          "label": "${resources.pipelines.my_default_python_etl.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "IS_OWNER",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/pipelines/${resources.pipelines.my_default_python_etl.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/templates/default-python/classic/out.plan_prod.terraform.json b/acceptance/bundle/templates/default-python/classic/out.plan_prod.terraform.json
deleted file mode 100644
index 175c9e38130..00000000000
--- a/acceptance/bundle/templates/default-python/classic/out.plan_prod.terraform.json
+++ /dev/null
@@ -1,17 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.sample_job": {
-      "action": "create"
-    },
-    "resources.jobs.sample_job.permissions": {
-      "action": "create"
-    },
-    "resources.pipelines.my_default_python_etl": {
-      "action": "create"
-    },
-    "resources.pipelines.my_default_python_etl.permissions": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/templates/default-python/classic/out.requests.dev.direct.txt b/acceptance/bundle/templates/default-python/classic/out.requests.dev.direct.txt
deleted file mode 100644
index 8aef0941978..00000000000
--- a/acceptance/bundle/templates/default-python/classic/out.requests.dev.direct.txt
+++ /dev/null
@@ -1,188 +0,0 @@
-{
-  "method": "POST",
-  "path": "/api/2.0/pipelines",
-  "body": {
-    "channel": "CURRENT",
-    "deployment": {
-      "kind": "BUNDLE",
-      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/state/metadata.json"
-    },
-    "development": true,
-    "edition": "ADVANCED",
-    "environment": {
-      "dependencies": [
-        "--editable /Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files"
-      ]
-    },
-    "libraries": [
-      {
-        "glob": {
-          "include": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python_etl/transformations/**"
-        }
-      }
-    ],
-    "name": "[dev [USERNAME]] my_default_python_etl",
-    "root_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python_etl",
-    "schema": "[USERNAME]",
-    "tags": {
-      "dev": "[USERNAME]"
-    }
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/delete",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal",
-    "recursive": true
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/.vscode"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/fixtures"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/resources"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python_etl/transformations"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/tests"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.2/jobs/create",
-  "body": {
-    "deployment": {
-      "kind": "BUNDLE",
-      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/state/metadata.json"
-    },
-    "edit_mode": "UI_LOCKED",
-    "format": "MULTI_TASK",
-    "job_clusters": [
-      {
-        "job_cluster_key": "job_cluster",
-        "new_cluster": {
-          "autoscale": {
-            "max_workers": 4,
-            "min_workers": 1
-          },
-          "data_security_mode": "SINGLE_USER",
-          "node_type_id": "[NODE_TYPE_ID]",
-          "spark_version": "16.4.x-scala2.12"
-        }
-      }
-    ],
-    "max_concurrent_runs": 4,
-    "name": "[dev [USERNAME]] sample_job",
-    "parameters": [
-      {
-        "default": "hive_metastore",
-        "name": "catalog"
-      },
-      {
-        "default": "[USERNAME]",
-        "name": "schema"
-      }
-    ],
-    "queue": {
-      "enabled": true
-    },
-    "tags": {
-      "dev": "[USERNAME]"
-    },
-    "tasks": [
-      {
-        "job_cluster_key": "job_cluster",
-        "libraries": [
-          {
-            "whl": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl"
-          }
-        ],
-        "notebook_task": {
-          "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/sample_notebook"
-        },
-        "task_key": "notebook_task"
-      },
-      {
-        "depends_on": [
-          {
-            "task_key": "notebook_task"
-          }
-        ],
-        "job_cluster_key": "job_cluster",
-        "libraries": [
-          {
-            "whl": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl"
-          }
-        ],
-        "python_wheel_task": {
-          "entry_point": "main",
-          "package_name": "my_default_python",
-          "parameters": [
-            "--catalog",
-            "hive_metastore",
-            "--schema",
-            "[USERNAME]"
-          ]
-        },
-        "task_key": "python_wheel_task"
-      },
-      {
-        "depends_on": [
-          {
-            "task_key": "notebook_task"
-          }
-        ],
-        "pipeline_task": {
-          "pipeline_id": "[UUID]"
-        },
-        "task_key": "refresh_pipeline"
-      }
-    ],
-    "trigger": {
-      "pause_status": "PAUSED",
-      "periodic": {
-        "interval": 1,
-        "unit": "DAYS"
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/templates/default-python/classic/out.requests.dev.terraform.txt b/acceptance/bundle/templates/default-python/classic/out.requests.dev.terraform.txt
deleted file mode 100644
index 6bac5cd3731..00000000000
--- a/acceptance/bundle/templates/default-python/classic/out.requests.dev.terraform.txt
+++ /dev/null
@@ -1,189 +0,0 @@
-{
-  "method": "POST",
-  "path": "/api/2.0/pipelines",
-  "body": {
-    "channel": "CURRENT",
-    "deployment": {
-      "kind": "BUNDLE",
-      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/state/metadata.json"
-    },
-    "development": true,
-    "edition": "ADVANCED",
-    "environment": {
-      "dependencies": [
-        "--editable /Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files"
-      ]
-    },
-    "libraries": [
-      {
-        "glob": {
-          "include": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python_etl/transformations/**"
-        }
-      }
-    ],
-    "name": "[dev [USERNAME]] my_default_python_etl",
-    "root_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python_etl",
-    "schema": "[USERNAME]",
-    "tags": {
-      "dev": "[USERNAME]"
-    }
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/delete",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal",
-    "recursive": true
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/.vscode"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/fixtures"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/resources"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python_etl/transformations"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/tests"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.2/jobs/create",
-  "body": {
-    "deployment": {
-      "kind": "BUNDLE",
-      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/state/metadata.json"
-    },
-    "edit_mode": "UI_LOCKED",
-    "format": "MULTI_TASK",
-    "job_clusters": [
-      {
-        "job_cluster_key": "job_cluster",
-        "new_cluster": {
-          "autoscale": {
-            "max_workers": 4,
-            "min_workers": 1
-          },
-          "data_security_mode": "SINGLE_USER",
-          "node_type_id": "[NODE_TYPE_ID]",
-          "spark_version": "16.4.x-scala2.12"
-        }
-      }
-    ],
-    "max_concurrent_runs": 4,
-    "name": "[dev [USERNAME]] sample_job",
-    "parameters": [
-      {
-        "default": "hive_metastore",
-        "name": "catalog"
-      },
-      {
-        "default": "[USERNAME]",
-        "name": "schema"
-      }
-    ],
-    "queue": {
-      "enabled": true
-    },
-    "tags": {
-      "dev": "[USERNAME]"
-    },
-    "tasks": [
-      {
-        "job_cluster_key": "job_cluster",
-        "libraries": [
-          {
-            "whl": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl"
-          }
-        ],
-        "notebook_task": {
-          "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/sample_notebook",
-          "source": "WORKSPACE"
-        },
-        "task_key": "notebook_task"
-      },
-      {
-        "depends_on": [
-          {
-            "task_key": "notebook_task"
-          }
-        ],
-        "job_cluster_key": "job_cluster",
-        "libraries": [
-          {
-            "whl": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl"
-          }
-        ],
-        "python_wheel_task": {
-          "entry_point": "main",
-          "package_name": "my_default_python",
-          "parameters": [
-            "--catalog",
-            "hive_metastore",
-            "--schema",
-            "[USERNAME]"
-          ]
-        },
-        "task_key": "python_wheel_task"
-      },
-      {
-        "depends_on": [
-          {
-            "task_key": "notebook_task"
-          }
-        ],
-        "pipeline_task": {
-          "pipeline_id": "[UUID]"
-        },
-        "task_key": "refresh_pipeline"
-      }
-    ],
-    "trigger": {
-      "pause_status": "PAUSED",
-      "periodic": {
-        "interval": 1,
-        "unit": "DAYS"
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/templates/default-python/classic/out.requests.dev.txt b/acceptance/bundle/templates/default-python/classic/out.requests.dev.txt
new file mode 100644
index 00000000000..43ac10e32b4
--- /dev/null
+++ b/acceptance/bundle/templates/default-python/classic/out.requests.dev.txt
@@ -0,0 +1,195 @@
+{
+  "method": "POST",
+  "path": "/api/2.0/pipelines",
+  "body": {
+    "channel": "CURRENT",
+    "deployment": {
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/state/metadata.json"
+    },
+    "development": true,
+    "edition": "ADVANCED",
+    "environment": {
+      "dependencies": [
+        "--editable /Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files"
+      ]
+    },
+    "libraries": [
+      {
+        "glob": {
+          "include": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python_etl/transformations/**"
+        }
+      }
+    ],
+    "name": "[dev [USERNAME]] my_default_python_etl",
+    "root_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python_etl",
+    "schema": "[USERNAME]",
+    "tags": {
+      "dev": "[USERNAME]"
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/delete",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal",
+    "recursive": true
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/.vscode"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/fixtures"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/resources"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python_etl/transformations"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/tests"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/state"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/create",
+  "body": {
+    "deployment": {
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/state/metadata.json"
+    },
+    "edit_mode": "UI_LOCKED",
+    "format": "MULTI_TASK",
+    "job_clusters": [
+      {
+        "job_cluster_key": "job_cluster",
+        "new_cluster": {
+          "autoscale": {
+            "max_workers": 4,
+            "min_workers": 1
+          },
+          "data_security_mode": "DATA_SECURITY_MODE_AUTO",
+          "node_type_id": "[NODE_TYPE_ID]",
+          "spark_version": "16.4.x-scala2.12"
+        }
+      }
+    ],
+    "max_concurrent_runs": 4,
+    "name": "[dev [USERNAME]] sample_job",
+    "parameters": [
+      {
+        "default": "hive_metastore",
+        "name": "catalog"
+      },
+      {
+        "default": "[USERNAME]",
+        "name": "schema"
+      }
+    ],
+    "queue": {
+      "enabled": true
+    },
+    "tags": {
+      "dev": "[USERNAME]"
+    },
+    "tasks": [
+      {
+        "job_cluster_key": "job_cluster",
+        "libraries": [
+          {
+            "whl": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl"
+          }
+        ],
+        "notebook_task": {
+          "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/sample_notebook"
+        },
+        "task_key": "notebook_task"
+      },
+      {
+        "depends_on": [
+          {
+            "task_key": "notebook_task"
+          }
+        ],
+        "job_cluster_key": "job_cluster",
+        "libraries": [
+          {
+            "whl": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1+[UNIX_TIME_NANOS][0]-py3-none-any.whl"
+          }
+        ],
+        "python_wheel_task": {
+          "entry_point": "main",
+          "package_name": "my_default_python",
+          "parameters": [
+            "--catalog",
+            "hive_metastore",
+            "--schema",
+            "[USERNAME]"
+          ]
+        },
+        "task_key": "python_wheel_task"
+      },
+      {
+        "depends_on": [
+          {
+            "task_key": "notebook_task"
+          }
+        ],
+        "pipeline_task": {
+          "pipeline_id": "[UUID]"
+        },
+        "task_key": "refresh_pipeline"
+      }
+    ],
+    "trigger": {
+      "pause_status": "PAUSED",
+      "periodic": {
+        "interval": 1,
+        "unit": "DAYS"
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/templates/default-python/classic/out.requests.prod.direct.txt b/acceptance/bundle/templates/default-python/classic/out.requests.prod.direct.txt
deleted file mode 100644
index b774a9e716f..00000000000
--- a/acceptance/bundle/templates/default-python/classic/out.requests.prod.direct.txt
+++ /dev/null
@@ -1,224 +0,0 @@
-{
-  "method": "POST",
-  "path": "/api/2.0/pipelines",
-  "body": {
-    "channel": "CURRENT",
-    "deployment": {
-      "kind": "BUNDLE",
-      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/state/metadata.json"
-    },
-    "edition": "ADVANCED",
-    "environment": {
-      "dependencies": [
-        "--editable /Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files"
-      ]
-    },
-    "libraries": [
-      {
-        "glob": {
-          "include": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python_etl/transformations/**"
-        }
-      }
-    ],
-    "name": "my_default_python_etl",
-    "root_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python_etl",
-    "schema": "prod"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/delete",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/artifacts/.internal",
-    "recursive": true
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/delete",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/state/deploy.lock"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/artifacts/.internal"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/.vscode"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/fixtures"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/resources"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python_etl/transformations"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/tests"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.2/jobs/create",
-  "body": {
-    "deployment": {
-      "kind": "BUNDLE",
-      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/state/metadata.json"
-    },
-    "edit_mode": "UI_LOCKED",
-    "format": "MULTI_TASK",
-    "job_clusters": [
-      {
-        "job_cluster_key": "job_cluster",
-        "new_cluster": {
-          "autoscale": {
-            "max_workers": 4,
-            "min_workers": 1
-          },
-          "data_security_mode": "SINGLE_USER",
-          "node_type_id": "[NODE_TYPE_ID]",
-          "spark_version": "16.4.x-scala2.12"
-        }
-      }
-    ],
-    "max_concurrent_runs": 1,
-    "name": "sample_job",
-    "parameters": [
-      {
-        "default": "hive_metastore",
-        "name": "catalog"
-      },
-      {
-        "default": "prod",
-        "name": "schema"
-      }
-    ],
-    "queue": {
-      "enabled": true
-    },
-    "tasks": [
-      {
-        "job_cluster_key": "job_cluster",
-        "libraries": [
-          {
-            "whl": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/artifacts/.internal/my_default_python-0.0.1-py3-none-any.whl"
-          }
-        ],
-        "notebook_task": {
-          "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/sample_notebook"
-        },
-        "task_key": "notebook_task"
-      },
-      {
-        "depends_on": [
-          {
-            "task_key": "notebook_task"
-          }
-        ],
-        "job_cluster_key": "job_cluster",
-        "libraries": [
-          {
-            "whl": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/artifacts/.internal/my_default_python-0.0.1-py3-none-any.whl"
-          }
-        ],
-        "python_wheel_task": {
-          "entry_point": "main",
-          "package_name": "my_default_python",
-          "parameters": [
-            "--catalog",
-            "hive_metastore",
-            "--schema",
-            "prod"
-          ]
-        },
-        "task_key": "python_wheel_task"
-      },
-      {
-        "depends_on": [
-          {
-            "task_key": "notebook_task"
-          }
-        ],
-        "pipeline_task": {
-          "pipeline_id": "[UUID]"
-        },
-        "task_key": "refresh_pipeline"
-      }
-    ],
-    "trigger": {
-      "pause_status": "UNPAUSED",
-      "periodic": {
-        "interval": 1,
-        "unit": "DAYS"
-      }
-    }
-  }
-}
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/directories/[NUMID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_MANAGE",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/jobs/[NUMID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/pipelines/[UUID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/templates/default-python/classic/out.requests.prod.terraform.txt b/acceptance/bundle/templates/default-python/classic/out.requests.prod.terraform.txt
deleted file mode 100644
index c6d26be2604..00000000000
--- a/acceptance/bundle/templates/default-python/classic/out.requests.prod.terraform.txt
+++ /dev/null
@@ -1,225 +0,0 @@
-{
-  "method": "POST",
-  "path": "/api/2.0/pipelines",
-  "body": {
-    "channel": "CURRENT",
-    "deployment": {
-      "kind": "BUNDLE",
-      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/state/metadata.json"
-    },
-    "edition": "ADVANCED",
-    "environment": {
-      "dependencies": [
-        "--editable /Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files"
-      ]
-    },
-    "libraries": [
-      {
-        "glob": {
-          "include": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python_etl/transformations/**"
-        }
-      }
-    ],
-    "name": "my_default_python_etl",
-    "root_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python_etl",
-    "schema": "prod"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/delete",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/artifacts/.internal",
-    "recursive": true
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/delete",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/state/deploy.lock"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/artifacts/.internal"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/.vscode"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/fixtures"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/resources"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python_etl/transformations"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/tests"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.2/jobs/create",
-  "body": {
-    "deployment": {
-      "kind": "BUNDLE",
-      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/state/metadata.json"
-    },
-    "edit_mode": "UI_LOCKED",
-    "format": "MULTI_TASK",
-    "job_clusters": [
-      {
-        "job_cluster_key": "job_cluster",
-        "new_cluster": {
-          "autoscale": {
-            "max_workers": 4,
-            "min_workers": 1
-          },
-          "data_security_mode": "SINGLE_USER",
-          "node_type_id": "[NODE_TYPE_ID]",
-          "spark_version": "16.4.x-scala2.12"
-        }
-      }
-    ],
-    "max_concurrent_runs": 1,
-    "name": "sample_job",
-    "parameters": [
-      {
-        "default": "hive_metastore",
-        "name": "catalog"
-      },
-      {
-        "default": "prod",
-        "name": "schema"
-      }
-    ],
-    "queue": {
-      "enabled": true
-    },
-    "tasks": [
-      {
-        "job_cluster_key": "job_cluster",
-        "libraries": [
-          {
-            "whl": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/artifacts/.internal/my_default_python-0.0.1-py3-none-any.whl"
-          }
-        ],
-        "notebook_task": {
-          "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/sample_notebook",
-          "source": "WORKSPACE"
-        },
-        "task_key": "notebook_task"
-      },
-      {
-        "depends_on": [
-          {
-            "task_key": "notebook_task"
-          }
-        ],
-        "job_cluster_key": "job_cluster",
-        "libraries": [
-          {
-            "whl": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/artifacts/.internal/my_default_python-0.0.1-py3-none-any.whl"
-          }
-        ],
-        "python_wheel_task": {
-          "entry_point": "main",
-          "package_name": "my_default_python",
-          "parameters": [
-            "--catalog",
-            "hive_metastore",
-            "--schema",
-            "prod"
-          ]
-        },
-        "task_key": "python_wheel_task"
-      },
-      {
-        "depends_on": [
-          {
-            "task_key": "notebook_task"
-          }
-        ],
-        "pipeline_task": {
-          "pipeline_id": "[UUID]"
-        },
-        "task_key": "refresh_pipeline"
-      }
-    ],
-    "trigger": {
-      "pause_status": "UNPAUSED",
-      "periodic": {
-        "interval": 1,
-        "unit": "DAYS"
-      }
-    }
-  }
-}
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/directories/[NUMID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_MANAGE",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/jobs/[NUMID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/pipelines/[UUID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/templates/default-python/classic/out.requests.prod.txt b/acceptance/bundle/templates/default-python/classic/out.requests.prod.txt
new file mode 100644
index 00000000000..886e527e396
--- /dev/null
+++ b/acceptance/bundle/templates/default-python/classic/out.requests.prod.txt
@@ -0,0 +1,231 @@
+{
+  "method": "POST",
+  "path": "/api/2.0/pipelines",
+  "body": {
+    "channel": "CURRENT",
+    "deployment": {
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/state/metadata.json"
+    },
+    "edition": "ADVANCED",
+    "environment": {
+      "dependencies": [
+        "--editable /Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files"
+      ]
+    },
+    "libraries": [
+      {
+        "glob": {
+          "include": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python_etl/transformations/**"
+        }
+      }
+    ],
+    "name": "my_default_python_etl",
+    "root_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python_etl",
+    "schema": "prod"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/delete",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/artifacts/.internal",
+    "recursive": true
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/delete",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/state/deploy.lock"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/artifacts/.internal"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/.vscode"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/fixtures"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/resources"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python_etl/transformations"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/tests"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/state"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/create",
+  "body": {
+    "deployment": {
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/state/metadata.json"
+    },
+    "edit_mode": "UI_LOCKED",
+    "format": "MULTI_TASK",
+    "job_clusters": [
+      {
+        "job_cluster_key": "job_cluster",
+        "new_cluster": {
+          "autoscale": {
+            "max_workers": 4,
+            "min_workers": 1
+          },
+          "data_security_mode": "DATA_SECURITY_MODE_AUTO",
+          "node_type_id": "[NODE_TYPE_ID]",
+          "spark_version": "16.4.x-scala2.12"
+        }
+      }
+    ],
+    "max_concurrent_runs": 1,
+    "name": "sample_job",
+    "parameters": [
+      {
+        "default": "hive_metastore",
+        "name": "catalog"
+      },
+      {
+        "default": "prod",
+        "name": "schema"
+      }
+    ],
+    "queue": {
+      "enabled": true
+    },
+    "tasks": [
+      {
+        "job_cluster_key": "job_cluster",
+        "libraries": [
+          {
+            "whl": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/artifacts/.internal/my_default_python-0.0.1-py3-none-any.whl"
+          }
+        ],
+        "notebook_task": {
+          "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/sample_notebook"
+        },
+        "task_key": "notebook_task"
+      },
+      {
+        "depends_on": [
+          {
+            "task_key": "notebook_task"
+          }
+        ],
+        "job_cluster_key": "job_cluster",
+        "libraries": [
+          {
+            "whl": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/artifacts/.internal/my_default_python-0.0.1-py3-none-any.whl"
+          }
+        ],
+        "python_wheel_task": {
+          "entry_point": "main",
+          "package_name": "my_default_python",
+          "parameters": [
+            "--catalog",
+            "hive_metastore",
+            "--schema",
+            "prod"
+          ]
+        },
+        "task_key": "python_wheel_task"
+      },
+      {
+        "depends_on": [
+          {
+            "task_key": "notebook_task"
+          }
+        ],
+        "pipeline_task": {
+          "pipeline_id": "[UUID]"
+        },
+        "task_key": "refresh_pipeline"
+      }
+    ],
+    "trigger": {
+      "pause_status": "UNPAUSED",
+      "periodic": {
+        "interval": 1,
+        "unit": "DAYS"
+      }
+    }
+  }
+}
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/directories/[PROD_ROOT_DIR_ID]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "CAN_MANAGE",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/jobs/[SAMPLE_JOB_ID_2]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "IS_OWNER",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/pipelines/[UUID]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "IS_OWNER",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/templates/default-python/classic/out.test.toml b/acceptance/bundle/templates/default-python/classic/out.test.toml
index 2f44fc0b7cc..df52b105a0d 100644
--- a/acceptance/bundle/templates/default-python/classic/out.test.toml
+++ b/acceptance/bundle/templates/default-python/classic/out.test.toml
@@ -1,5 +1,4 @@
-Local = true
 Cloud = false
 Phase = 1
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
 EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/templates/default-python/classic/output.txt b/acceptance/bundle/templates/default-python/classic/output.txt
index 2a301801d86..873557670ea 100644
--- a/acceptance/bundle/templates/default-python/classic/output.txt
+++ b/acceptance/bundle/templates/default-python/classic/output.txt
@@ -50,9 +50,10 @@ Plan: 4 to add, 0 to change, 0 to delete, 0 unchanged
 Building python_artifact...
 Building python_artifact...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.sample_job
+Created pipelines.my_default_python_etl
+Files: 20 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle plan -t dev
 Building python_artifact...
@@ -63,9 +64,12 @@ Plan: 0 to add, 1 to change, 0 to delete, 1 unchanged
 >>> [CLI] bundle plan -t dev -o json
 Building python_artifact...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.sample_job
+Created jobs.sample_job.permissions
+Created pipelines.my_default_python_etl
+Created pipelines.my_default_python_etl.permissions
+Files: 20 uploaded, 0 deleted
+Resources: 4 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle plan -t prod
 Building python_artifact...
diff --git a/acceptance/bundle/templates/default-python/classic/output/my_default_python/.vscode/extensions.json b/acceptance/bundle/templates/default-python/classic/output/my_default_python/.vscode/extensions.json
index 5ba48e79c9b..b958aacfcb4 100644
--- a/acceptance/bundle/templates/default-python/classic/output/my_default_python/.vscode/extensions.json
+++ b/acceptance/bundle/templates/default-python/classic/output/my_default_python/.vscode/extensions.json
@@ -1,7 +1,7 @@
 {
     "recommendations": [
+        "charliermarsh.ruff",
         "databricks.databricks",
-        "redhat.vscode-yaml",
-        "charliermarsh.ruff"
+        "redhat.vscode-yaml"
     ]
 }
diff --git a/acceptance/bundle/templates/default-python/classic/output/my_default_python/AGENTS.md b/acceptance/bundle/templates/default-python/classic/output/my_default_python/AGENTS.md
new file mode 100644
index 00000000000..fdcca98a432
--- /dev/null
+++ b/acceptance/bundle/templates/default-python/classic/output/my_default_python/AGENTS.md
@@ -0,0 +1,25 @@
+# Declarative Automation Bundles Project
+
+This project uses Declarative Automation Bundles (DABs) for deployment. Add project-specific instructions below.
+
+## For AI Agents: Use Databricks AI Tools
+
+**BEFORE any other action, read the `databricks-core` skill.**
+
+It sets you up to work with this project reliably: CLI authentication, profile
+selection, data discovery, and the bundle deployment workflow. Without it,
+results are often slower and less accurate.
+
+If this skill is not available (Databricks AI Tools are not installed), you can install them for your coding agent in seconds:
+
+```bash
+databricks aitools install
+```
+
+If the CLI is not installed, see: https://docs.databricks.com/dev-tools/cli/install
+
+---
+
+## Project Instructions
+
+<!-- Add your project-specific instructions, coding conventions, or notes here -->
diff --git a/acceptance/bundle/templates/default-python/classic/output/my_default_python/databricks.yml b/acceptance/bundle/templates/default-python/classic/output/my_default_python/databricks.yml
index fe79065310e..d5abd8c8fa4 100644
--- a/acceptance/bundle/templates/default-python/classic/output/my_default_python/databricks.yml
+++ b/acceptance/bundle/templates/default-python/classic/output/my_default_python/databricks.yml
@@ -1,4 +1,4 @@
-# This is a Databricks asset bundle definition for my_default_python.
+# This is a Declarative Automation Bundle definition for my_default_python.
 # See https://docs.databricks.com/dev-tools/bundles/index.html for documentation.
 bundle:
   name: my_default_python
diff --git a/acceptance/bundle/templates/default-python/classic/output/my_default_python/pyproject.toml b/acceptance/bundle/templates/default-python/classic/output/my_default_python/pyproject.toml
index 3c4c2062763..e8bb641abd4 100644
--- a/acceptance/bundle/templates/default-python/classic/output/my_default_python/pyproject.toml
+++ b/acceptance/bundle/templates/default-python/classic/output/my_default_python/pyproject.toml
@@ -2,7 +2,7 @@
 name = "my_default_python"
 version = "0.0.1"
 authors = [{ name = "[USERNAME]" }]
-requires-python = ">=3.10,<3.13"
+requires-python = ">=3.12,<3.13"
 dependencies = [
     # Any dependencies for jobs and pipelines in this project can be added here
     # See also https://docs.databricks.com/dev-tools/bundles/library-dependencies
@@ -16,7 +16,7 @@ dev = [
     "pytest",
     "ruff",
     "databricks-dlt",
-    "databricks-connect>=15.4,<15.5",
+    "databricks-connect>=16.4,<16.5",
     "ipykernel",
 ]
 
diff --git a/acceptance/bundle/templates/default-python/classic/output/my_default_python/resources/sample_job.job.yml b/acceptance/bundle/templates/default-python/classic/output/my_default_python/resources/sample_job.job.yml
index 1c62e20bc46..7f7289b632d 100644
--- a/acceptance/bundle/templates/default-python/classic/output/my_default_python/resources/sample_job.job.yml
+++ b/acceptance/bundle/templates/default-python/classic/output/my_default_python/resources/sample_job.job.yml
@@ -59,7 +59,7 @@ resources:
           new_cluster:
             spark_version: 16.4.x-scala2.12
             node_type_id: [NODE_TYPE_ID]
-            data_security_mode: SINGLE_USER
+            data_security_mode: DATA_SECURITY_MODE_AUTO
             autoscale:
               min_workers: 1
               max_workers: 4
diff --git a/acceptance/bundle/templates/default-python/classic/output/my_default_python/src/my_default_python/main.py b/acceptance/bundle/templates/default-python/classic/output/my_default_python/src/my_default_python/main.py
index 1b1f3803907..a1247306831 100644
--- a/acceptance/bundle/templates/default-python/classic/output/my_default_python/src/my_default_python/main.py
+++ b/acceptance/bundle/templates/default-python/classic/output/my_default_python/src/my_default_python/main.py
@@ -13,8 +13,8 @@ def main():
     args = parser.parse_args()
 
     # Set the default catalog and schema
-    spark.sql(f"USE CATALOG {args.catalog}")
-    spark.sql(f"USE SCHEMA {args.schema}")
+    spark.sql(f"USE CATALOG `{args.catalog}`")
+    spark.sql(f"USE SCHEMA `{args.schema}`")
 
     # Example: just find all taxis from a sample catalog
     taxis.find_all_taxis().show(5)
diff --git a/acceptance/bundle/templates/default-python/classic/output/my_default_python/src/my_default_python_etl/README.md b/acceptance/bundle/templates/default-python/classic/output/my_default_python/src/my_default_python_etl/README.md
index 17f7212f888..5b41468debe 100644
--- a/acceptance/bundle/templates/default-python/classic/output/my_default_python/src/my_default_python_etl/README.md
+++ b/acceptance/bundle/templates/default-python/classic/output/my_default_python/src/my_default_python_etl/README.md
@@ -15,6 +15,6 @@ To get started, go to the `transformations` folder -- most of the relevant sourc
 * Take a look at the sample called "sample_trips_my_default_python.py" to get familiar with the syntax.
   Read more about the syntax at https://docs.databricks.com/dlt/python-ref.html.
 * If you're using the workspace UI, use `Run file` to run and preview a single transformation.
-* If you're using the CLI, use `databricks bundle run my_default_python_etl --select sample_trips_my_default_python` to run a single transformation.
+* If you're using the CLI, use `databricks bundle run my_default_python_etl --refresh sample_trips_my_default_python` to run a single transformation.
 
 For more tutorials and reference material, see https://docs.databricks.com/dlt.
diff --git a/acceptance/bundle/templates/default-python/classic/output/my_default_python/src/sample_notebook.ipynb b/acceptance/bundle/templates/default-python/classic/output/my_default_python/src/sample_notebook.ipynb
index d5e4804cb80..ea9c0a8404a 100644
--- a/acceptance/bundle/templates/default-python/classic/output/my_default_python/src/sample_notebook.ipynb
+++ b/acceptance/bundle/templates/default-python/classic/output/my_default_python/src/sample_notebook.ipynb
@@ -34,8 +34,8 @@
     "# Set default catalog and schema\n",
     "catalog = dbutils.widgets.get(\"catalog\")\n",
     "schema = dbutils.widgets.get(\"schema\")\n",
-    "spark.sql(f\"USE CATALOG {catalog}\")\n",
-    "spark.sql(f\"USE SCHEMA {schema}\")"
+    "spark.sql(f\"USE CATALOG `{catalog}`\")\n",
+    "spark.sql(f\"USE SCHEMA `{schema}`\")"
    ]
   },
   {
@@ -72,7 +72,7 @@
     "dependencies": [
      "--editable .."
     ],
-    "environment_version": "4"
+    "environment_version": "5"
    },
    "language": "python",
    "notebookMetadata": {
@@ -82,7 +82,7 @@
    "widgets": {
     "catalog": {
      "currentValue": "hive_metastore",
-     "nuid": "c4t4l0g-w1dg-3t12-3456-[NUMID]",
+     "nuid": "c4t4l0g-w1dg-3t12-3456-789012345678",
      "typedWidgetInfo": {
       "autoCreated": false,
       "defaultValue": "hive_metastore",
@@ -108,7 +108,7 @@
     },
     "schema": {
      "currentValue": "[USERNAME]",
-     "nuid": "5ch3m4-w1dg-3t98-7654-[NUMID]",
+     "nuid": "5ch3m4-w1dg-3t98-7654-321098765432",
      "typedWidgetInfo": {
       "autoCreated": false,
       "defaultValue": "default",
diff --git a/acceptance/bundle/templates/default-python/classic/script b/acceptance/bundle/templates/default-python/classic/script
index 6b79c6f2251..2f91efecbe1 100644
--- a/acceptance/bundle/templates/default-python/classic/script
+++ b/acceptance/bundle/templates/default-python/classic/script
@@ -7,27 +7,32 @@ trace $CLI bundle validate -t prod
 trace $CLI bundle plan -t dev
 trace $CLI bundle plan -t prod
 
-$CLI bundle plan -o json -t dev > ../../out.plan_dev.$DATABRICKS_BUNDLE_ENGINE.json
-$CLI bundle plan -o json -t prod > ../../out.plan_prod.$DATABRICKS_BUNDLE_ENGINE.json
+$CLI bundle plan -o json -t dev | nostamp > ../../out.plan_dev.json
+$CLI bundle plan -o json -t prod | nostamp > ../../out.plan_prod.json
 
-rm ../../out.requests.txt
+rm "$OUT_REQUESTS"
 # With --plan variant we don't build artifacts, so we can filter out relevant log lines
-$CLI bundle deploy -t dev $(readplanarg ../../out.plan_dev.direct.json) 2>&1 | grep -vE '^Building python_artifact|^Uploading .databricks'
-print_requests.py --sort '^//import-file/' '^//telemetry-ext' > ../../out.requests.dev.$DATABRICKS_BUNDLE_ENGINE.txt
+$CLI bundle deploy -t dev $(readplanarg ../../out.plan_dev.json) 2>&1 | grep -vE '^Building python_artifact|^Uploading .databricks'
+print_requests.py --sort '^//workspace/import' '^//telemetry-ext' > ../../out.requests.dev.txt
+read_id.py -t dev sample_job > /dev/null
 trace $CLI bundle plan -t dev  # check if if there is drift
-trace $CLI bundle plan -t dev -o json > ../../out.plan_after_deploy_dev.$DATABRICKS_BUNDLE_ENGINE.json
-
-$CLI bundle deploy -t prod $(readplanarg ../../out.plan_prod.direct.json) 2>&1 | grep -vE '^Building python_artifact|^Uploading dist'
-print_requests.py --sort '^//import-file/' '^//telemetry-ext' > ../../out.requests.prod.$DATABRICKS_BUNDLE_ENGINE.txt
+trace $CLI bundle plan -t dev -o json | nostamp > ../../out.plan_after_deploy_dev.json
+
+$CLI bundle deploy -t prod $(readplanarg ../../out.plan_prod.json) 2>&1 | grep -vE '^Building python_artifact|^Uploading dist'
+print_requests.py --sort '^//workspace/import' '^//telemetry-ext' > ../../out.requests.prod.txt
+read_id.py -t prod sample_job > /dev/null
+# Extracted with python, not jq: the id exceeds 2^53 and jq 1.6 rounds it.
+root_dir_id=$(MSYS_NO_PATHCONV=1 $CLI workspace get-status "/Workspace/Users/${CURRENT_USER_NAME}/.bundle/my_default_python/prod" -o json | python3 -c 'import sys, json; print(json.load(sys.stdin)["object_id"])')
+add_repl "$root_dir_id" PROD_ROOT_DIR_ID
 trace $CLI bundle plan -t prod  # check if there is drift
-trace $CLI bundle plan -t prod -o json > ../../out.plan_after_deploy_prod.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -t prod -o json | nostamp > ../../out.plan_after_deploy_prod.json
 
 # Do not affect this repository's git behaviour #2318
 mv .gitignore out.gitignore
 rm -r .databricks dist
 
 cd ../../
-rm out.requests.txt
+rm "$OUT_REQUESTS"
 
 # Calculate the difference from the serverless template
 diff.py $TESTDIR/../serverless/output output/ > out.compare-vs-serverless.diff
diff --git a/acceptance/bundle/templates/default-python/combinations/check_output.py b/acceptance/bundle/templates/default-python/combinations/check_output.py
index fc4b70ee629..0d25fc004f6 100755
--- a/acceptance/bundle/templates/default-python/combinations/check_output.py
+++ b/acceptance/bundle/templates/default-python/combinations/check_output.py
@@ -9,8 +9,10 @@
 READPLAN = os.environ["READPLAN"] != ""
 
 CLOUD_ENV = os.environ.get("CLOUD_ENV")
-if CLOUD_ENV and SERVERLESS and not os.environ.get("TEST_METASTORE_ID"):
-    sys.exit(f"SKIP_TEST SERVERLESS=yes but TEST_METASTORE_ID is empty in this env {CLOUD_ENV=}")
+if CLOUD_ENV and SERVERLESS:
+    # Serverless needs Unity Catalog. Every cloud test env has a metastore, so
+    # crash here rather than silently skipping if one ever stops providing it.
+    os.environ["TEST_METASTORE_ID"]
 
 BUILDING = "Building python_artifact"
 UPLOADING_WHL = re.compile(r"^Uploading .*whl\.\.\.$", re.M)
@@ -22,7 +24,8 @@ def is_printable_line(line):
     if line.startswith(BUILDING):
         return False
 
-    # only shown when include_python=yes and READPLAN is not set
+    # shown when include_python=yes (READPLAN=0: after build; READPLAN=1: pre-built wheel)
+    # filtered from output.txt to keep goldens stable across variants
     if UPLOADING_WHL.match(line):
         return False
 
@@ -37,9 +40,16 @@ def is_printable_line(line):
 try:
     assert p.returncode == 0, p.returncode
     assert p.stdout == ""
-    if INCLUDE_PYTHON and not READPLAN:
-        assert BUILDING in p.stderr, BUILDING
+    if INCLUDE_PYTHON:
+        # The wheel is always uploaded when Python is included — whether the build
+        # command ran (READPLAN=0) or FindLibraries discovered the pre-built wheel
+        # from plan time (READPLAN=1).
         assert UPLOADING_WHL.search(p.stderr), UPLOADING_WHL
+        if READPLAN:
+            # With --plan the build command is not re-run.
+            assert BUILDING not in p.stderr, BUILDING
+        else:
+            assert BUILDING in p.stderr, BUILDING
     else:
         assert BUILDING not in p.stderr, BUILDING
         assert not UPLOADING_WHL.search(p.stderr), UPLOADING_WHL
diff --git a/acceptance/bundle/templates/default-python/combinations/classic/out.test.toml b/acceptance/bundle/templates/default-python/combinations/classic/out.test.toml
index 9f9b4934ffe..c63e2f59510 100644
--- a/acceptance/bundle/templates/default-python/combinations/classic/out.test.toml
+++ b/acceptance/bundle/templates/default-python/combinations/classic/out.test.toml
@@ -1,7 +1,6 @@
-Local = true
 Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
 EnvMatrix.DLT = ["yes", "no"]
+EnvMatrix.DMS = [""]
 EnvMatrix.NBOOK = ["yes", "no"]
 EnvMatrix.PY = ["yes", "no"]
 EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/templates/default-python/combinations/classic/output.txt b/acceptance/bundle/templates/default-python/combinations/classic/output.txt
index 634b857f961..930848ad17d 100644
--- a/acceptance/bundle/templates/default-python/combinations/classic/output.txt
+++ b/acceptance/bundle/templates/default-python/combinations/classic/output.txt
@@ -34,12 +34,18 @@ Workspace:
 
 Validation OK!
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/X[UNIQUE_NAME]/dev/files...
-Deploying resources...
-Deployment complete!
-Deleting files...
-Destroy complete!
+Created jobs.sample_job
+Created pipelines.X[UNIQUE_NAME]_etl
+Files: 22 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+Destroy: 2 deleted
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/X[UNIQUE_NAME]/prod/files...
-Deploying resources...
-Deployment complete!
-Deleting files...
-Destroy complete!
+Created jobs.sample_job
+Created jobs.sample_job.permissions
+Created pipelines.X[UNIQUE_NAME]_etl
+Created pipelines.X[UNIQUE_NAME]_etl.permissions
+Files: 24 uploaded, 0 deleted
+Resources: 4 created, 0 changed, 0 deleted, 0 unchanged
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/templates/default-python/combinations/serverless/out.test.toml b/acceptance/bundle/templates/default-python/combinations/serverless/out.test.toml
index 9f9b4934ffe..c63e2f59510 100644
--- a/acceptance/bundle/templates/default-python/combinations/serverless/out.test.toml
+++ b/acceptance/bundle/templates/default-python/combinations/serverless/out.test.toml
@@ -1,7 +1,6 @@
-Local = true
 Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
 EnvMatrix.DLT = ["yes", "no"]
+EnvMatrix.DMS = [""]
 EnvMatrix.NBOOK = ["yes", "no"]
 EnvMatrix.PY = ["yes", "no"]
 EnvMatrix.READPLAN = ["", "1"]
diff --git a/acceptance/bundle/templates/default-python/combinations/serverless/output.txt b/acceptance/bundle/templates/default-python/combinations/serverless/output.txt
index 634b857f961..930848ad17d 100644
--- a/acceptance/bundle/templates/default-python/combinations/serverless/output.txt
+++ b/acceptance/bundle/templates/default-python/combinations/serverless/output.txt
@@ -34,12 +34,18 @@ Workspace:
 
 Validation OK!
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/X[UNIQUE_NAME]/dev/files...
-Deploying resources...
-Deployment complete!
-Deleting files...
-Destroy complete!
+Created jobs.sample_job
+Created pipelines.X[UNIQUE_NAME]_etl
+Files: 22 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+
+Destroy: 2 deleted
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/X[UNIQUE_NAME]/prod/files...
-Deploying resources...
-Deployment complete!
-Deleting files...
-Destroy complete!
+Created jobs.sample_job
+Created jobs.sample_job.permissions
+Created pipelines.X[UNIQUE_NAME]_etl
+Created pipelines.X[UNIQUE_NAME]_etl.permissions
+Files: 24 uploaded, 0 deleted
+Resources: 4 created, 0 changed, 0 deleted, 0 unchanged
+
+Destroy: 2 deleted
diff --git a/acceptance/bundle/templates/default-python/fail-missing-uv/out.test.toml b/acceptance/bundle/templates/default-python/fail-missing-uv/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/templates/default-python/fail-missing-uv/out.test.toml
+++ b/acceptance/bundle/templates/default-python/fail-missing-uv/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/templates/default-python/fail-missing-uv/test.toml b/acceptance/bundle/templates/default-python/fail-missing-uv/test.toml
index 2f7c45f0abc..d2a4893d584 100644
--- a/acceptance/bundle/templates/default-python/fail-missing-uv/test.toml
+++ b/acceptance/bundle/templates/default-python/fail-missing-uv/test.toml
@@ -1,6 +1,5 @@
 Badness = "The error message is not ideal: it reports a generic build failure or 'command not found' instead of a clear message that 'uv' is missing from the environment."
 
-Local = true
 Cloud = false
 
 # Replace the uv not found error for portability
diff --git a/acceptance/bundle/templates/default-python/integration_classic/out.plan_dev.direct.json b/acceptance/bundle/templates/default-python/integration_classic/out.plan_dev.direct.json
deleted file mode 100644
index 1b78b8047ff..00000000000
--- a/acceptance/bundle/templates/default-python/integration_classic/out.plan_dev.direct.json
+++ /dev/null
@@ -1,148 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.sample_job": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.project_name_[UNIQUE_NAME]_etl",
-          "label": "${resources.pipelines.project_name_[UNIQUE_NAME]_etl.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/dev/state/metadata.json"
-          },
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "job_clusters": [
-            {
-              "job_cluster_key": "job_cluster",
-              "new_cluster": {
-                "autoscale": {
-                  "max_workers": 4,
-                  "min_workers": 1
-                },
-                "data_security_mode": "SINGLE_USER",
-                "node_type_id": "[NODE_TYPE_ID]",
-                "spark_version": "16.4.x-scala2.12"
-              }
-            }
-          ],
-          "max_concurrent_runs": 4,
-          "name": "[dev [USERNAME]] sample_job",
-          "parameters": [
-            {
-              "default": "hive_metastore",
-              "name": "catalog"
-            },
-            {
-              "default": "[USERNAME]",
-              "name": "schema"
-            }
-          ],
-          "queue": {
-            "enabled": true
-          },
-          "tags": {
-            "dev": "[USERNAME]"
-          },
-          "tasks": [
-            {
-              "job_cluster_key": "job_cluster",
-              "libraries": [
-                {
-                  "whl": "/Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/dev/artifacts/.internal/project_name_[UNIQUE_NAME]-0.0.1+[NUMID]-py3-none-any.whl"
-                }
-              ],
-              "notebook_task": {
-                "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/dev/files/src/sample_notebook"
-              },
-              "task_key": "notebook_task"
-            },
-            {
-              "depends_on": [
-                {
-                  "task_key": "notebook_task"
-                }
-              ],
-              "job_cluster_key": "job_cluster",
-              "libraries": [
-                {
-                  "whl": "/Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/dev/artifacts/.internal/project_name_[UNIQUE_NAME]-0.0.1+[NUMID]-py3-none-any.whl"
-                }
-              ],
-              "python_wheel_task": {
-                "entry_point": "main",
-                "package_name": "project_name_[UNIQUE_NAME]",
-                "parameters": [
-                  "--catalog",
-                  "hive_metastore",
-                  "--schema",
-                  "[USERNAME]"
-                ]
-              },
-              "task_key": "python_wheel_task"
-            },
-            {
-              "depends_on": [
-                {
-                  "task_key": "notebook_task"
-                }
-              ],
-              "pipeline_task": {
-                "pipeline_id": "${resources.pipelines.project_name_[UNIQUE_NAME]_etl.id}"
-              },
-              "task_key": "refresh_pipeline"
-            }
-          ],
-          "trigger": {
-            "pause_status": "PAUSED",
-            "periodic": {
-              "interval": 1,
-              "unit": "DAYS"
-            }
-          }
-        },
-        "vars": {
-          "tasks[2].pipeline_task.pipeline_id": "${resources.pipelines.project_name_[UNIQUE_NAME]_etl.id}"
-        }
-      }
-    },
-    "resources.pipelines.project_name_[UNIQUE_NAME]_etl": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "channel": "CURRENT",
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/dev/state/metadata.json"
-          },
-          "development": true,
-          "edition": "ADVANCED",
-          "environment": {
-            "dependencies": [
-              "--editable /Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/dev/files"
-            ]
-          },
-          "libraries": [
-            {
-              "glob": {
-                "include": "/Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/dev/files/src/project_name_[UNIQUE_NAME]_etl/transformations/**"
-              }
-            }
-          ],
-          "name": "[dev [USERNAME]] project_name_[UNIQUE_NAME]_etl",
-          "root_path": "/Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/dev/files/src/project_name_[UNIQUE_NAME]_etl",
-          "schema": "[USERNAME]",
-          "tags": {
-            "dev": "[USERNAME]"
-          }
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/templates/default-python/integration_classic/out.plan_dev.json b/acceptance/bundle/templates/default-python/integration_classic/out.plan_dev.json
new file mode 100644
index 00000000000..9dadfe9cd8c
--- /dev/null
+++ b/acceptance/bundle/templates/default-python/integration_classic/out.plan_dev.json
@@ -0,0 +1,148 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.jobs.sample_job": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.project_name_[UNIQUE_NAME]_etl",
+          "label": "${resources.pipelines.project_name_[UNIQUE_NAME]_etl.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/dev/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "job_clusters": [
+            {
+              "job_cluster_key": "job_cluster",
+              "new_cluster": {
+                "autoscale": {
+                  "max_workers": 4,
+                  "min_workers": 1
+                },
+                "data_security_mode": "DATA_SECURITY_MODE_AUTO",
+                "node_type_id": "[NODE_TYPE_ID]",
+                "spark_version": "16.4.x-scala2.12"
+              }
+            }
+          ],
+          "max_concurrent_runs": 4,
+          "name": "[dev [USERNAME]] sample_job",
+          "parameters": [
+            {
+              "default": "hive_metastore",
+              "name": "catalog"
+            },
+            {
+              "default": "[USERNAME]",
+              "name": "schema"
+            }
+          ],
+          "queue": {
+            "enabled": true
+          },
+          "tags": {
+            "dev": "[USERNAME]"
+          },
+          "tasks": [
+            {
+              "job_cluster_key": "job_cluster",
+              "libraries": [
+                {
+                  "whl": "/Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/dev/artifacts/.internal/project_name_[UNIQUE_NAME]-0.0.1+[WHEEL_BUILD]-py3-none-any.whl"
+                }
+              ],
+              "notebook_task": {
+                "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/dev/files/src/sample_notebook"
+              },
+              "task_key": "notebook_task"
+            },
+            {
+              "depends_on": [
+                {
+                  "task_key": "notebook_task"
+                }
+              ],
+              "job_cluster_key": "job_cluster",
+              "libraries": [
+                {
+                  "whl": "/Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/dev/artifacts/.internal/project_name_[UNIQUE_NAME]-0.0.1+[WHEEL_BUILD]-py3-none-any.whl"
+                }
+              ],
+              "python_wheel_task": {
+                "entry_point": "main",
+                "package_name": "project_name_[UNIQUE_NAME]",
+                "parameters": [
+                  "--catalog",
+                  "hive_metastore",
+                  "--schema",
+                  "[USERNAME]"
+                ]
+              },
+              "task_key": "python_wheel_task"
+            },
+            {
+              "depends_on": [
+                {
+                  "task_key": "notebook_task"
+                }
+              ],
+              "pipeline_task": {
+                "pipeline_id": "${resources.pipelines.project_name_[UNIQUE_NAME]_etl.id}"
+              },
+              "task_key": "refresh_pipeline"
+            }
+          ],
+          "trigger": {
+            "pause_status": "PAUSED",
+            "periodic": {
+              "interval": 1,
+              "unit": "DAYS"
+            }
+          }
+        },
+        "vars": {
+          "tasks[2].pipeline_task.pipeline_id": "${resources.pipelines.project_name_[UNIQUE_NAME]_etl.id}"
+        }
+      }
+    },
+    "resources.pipelines.project_name_[UNIQUE_NAME]_etl": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "channel": "CURRENT",
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/dev/state/metadata.json"
+          },
+          "development": true,
+          "edition": "ADVANCED",
+          "environment": {
+            "dependencies": [
+              "--editable /Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/dev/files"
+            ]
+          },
+          "libraries": [
+            {
+              "glob": {
+                "include": "/Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/dev/files/src/project_name_[UNIQUE_NAME]_etl/transformations/**"
+              }
+            }
+          ],
+          "name": "[dev [USERNAME]] project_name_[UNIQUE_NAME]_etl",
+          "root_path": "/Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/dev/files/src/project_name_[UNIQUE_NAME]_etl",
+          "schema": "[USERNAME]",
+          "tags": {
+            "dev": "[USERNAME]"
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/templates/default-python/integration_classic/out.plan_dev.terraform.json b/acceptance/bundle/templates/default-python/integration_classic/out.plan_dev.terraform.json
deleted file mode 100644
index c3d50874474..00000000000
--- a/acceptance/bundle/templates/default-python/integration_classic/out.plan_dev.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.sample_job": {
-      "action": "create"
-    },
-    "resources.pipelines.project_name_[UNIQUE_NAME]_etl": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/templates/default-python/integration_classic/out.plan_prod.direct.json b/acceptance/bundle/templates/default-python/integration_classic/out.plan_prod.direct.json
deleted file mode 100644
index a84ff329c95..00000000000
--- a/acceptance/bundle/templates/default-python/integration_classic/out.plan_prod.direct.json
+++ /dev/null
@@ -1,187 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.sample_job": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.project_name_[UNIQUE_NAME]_etl",
-          "label": "${resources.pipelines.project_name_[UNIQUE_NAME]_etl.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/prod/state/metadata.json"
-          },
-          "edit_mode": "UI_LOCKED",
-          "format": "MULTI_TASK",
-          "job_clusters": [
-            {
-              "job_cluster_key": "job_cluster",
-              "new_cluster": {
-                "autoscale": {
-                  "max_workers": 4,
-                  "min_workers": 1
-                },
-                "data_security_mode": "SINGLE_USER",
-                "node_type_id": "[NODE_TYPE_ID]",
-                "spark_version": "16.4.x-scala2.12"
-              }
-            }
-          ],
-          "max_concurrent_runs": 1,
-          "name": "sample_job",
-          "parameters": [
-            {
-              "default": "hive_metastore",
-              "name": "catalog"
-            },
-            {
-              "default": "prod",
-              "name": "schema"
-            }
-          ],
-          "queue": {
-            "enabled": true
-          },
-          "tasks": [
-            {
-              "job_cluster_key": "job_cluster",
-              "libraries": [
-                {
-                  "whl": "/Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/prod/artifacts/.internal/project_name_[UNIQUE_NAME]-0.0.1-py3-none-any.whl"
-                }
-              ],
-              "notebook_task": {
-                "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/prod/files/src/sample_notebook"
-              },
-              "task_key": "notebook_task"
-            },
-            {
-              "depends_on": [
-                {
-                  "task_key": "notebook_task"
-                }
-              ],
-              "job_cluster_key": "job_cluster",
-              "libraries": [
-                {
-                  "whl": "/Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/prod/artifacts/.internal/project_name_[UNIQUE_NAME]-0.0.1-py3-none-any.whl"
-                }
-              ],
-              "python_wheel_task": {
-                "entry_point": "main",
-                "package_name": "project_name_[UNIQUE_NAME]",
-                "parameters": [
-                  "--catalog",
-                  "hive_metastore",
-                  "--schema",
-                  "prod"
-                ]
-              },
-              "task_key": "python_wheel_task"
-            },
-            {
-              "depends_on": [
-                {
-                  "task_key": "notebook_task"
-                }
-              ],
-              "pipeline_task": {
-                "pipeline_id": "${resources.pipelines.project_name_[UNIQUE_NAME]_etl.id}"
-              },
-              "task_key": "refresh_pipeline"
-            }
-          ],
-          "trigger": {
-            "pause_status": "UNPAUSED",
-            "periodic": {
-              "interval": 1,
-              "unit": "DAYS"
-            }
-          }
-        },
-        "vars": {
-          "tasks[2].pipeline_task.pipeline_id": "${resources.pipelines.project_name_[UNIQUE_NAME]_etl.id}"
-        }
-      }
-    },
-    "resources.jobs.sample_job.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.sample_job",
-          "label": "${resources.jobs.sample_job.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "IS_OWNER",
-              "service_principal_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/jobs/${resources.jobs.sample_job.id}"
-        }
-      }
-    },
-    "resources.pipelines.project_name_[UNIQUE_NAME]_etl": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "channel": "CURRENT",
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/prod/state/metadata.json"
-          },
-          "edition": "ADVANCED",
-          "environment": {
-            "dependencies": [
-              "--editable /Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/prod/files"
-            ]
-          },
-          "libraries": [
-            {
-              "glob": {
-                "include": "/Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/prod/files/src/project_name_[UNIQUE_NAME]_etl/transformations/**"
-              }
-            }
-          ],
-          "name": "project_name_[UNIQUE_NAME]_etl",
-          "root_path": "/Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/prod/files/src/project_name_[UNIQUE_NAME]_etl",
-          "schema": "prod"
-        }
-      }
-    },
-    "resources.pipelines.project_name_[UNIQUE_NAME]_etl.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.project_name_[UNIQUE_NAME]_etl",
-          "label": "${resources.pipelines.project_name_[UNIQUE_NAME]_etl.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "IS_OWNER",
-              "service_principal_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/pipelines/${resources.pipelines.project_name_[UNIQUE_NAME]_etl.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/templates/default-python/integration_classic/out.plan_prod.json b/acceptance/bundle/templates/default-python/integration_classic/out.plan_prod.json
new file mode 100644
index 00000000000..9f57d18ed24
--- /dev/null
+++ b/acceptance/bundle/templates/default-python/integration_classic/out.plan_prod.json
@@ -0,0 +1,187 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.jobs.sample_job": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.project_name_[UNIQUE_NAME]_etl",
+          "label": "${resources.pipelines.project_name_[UNIQUE_NAME]_etl.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/prod/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "format": "MULTI_TASK",
+          "job_clusters": [
+            {
+              "job_cluster_key": "job_cluster",
+              "new_cluster": {
+                "autoscale": {
+                  "max_workers": 4,
+                  "min_workers": 1
+                },
+                "data_security_mode": "DATA_SECURITY_MODE_AUTO",
+                "node_type_id": "[NODE_TYPE_ID]",
+                "spark_version": "16.4.x-scala2.12"
+              }
+            }
+          ],
+          "max_concurrent_runs": 1,
+          "name": "sample_job",
+          "parameters": [
+            {
+              "default": "hive_metastore",
+              "name": "catalog"
+            },
+            {
+              "default": "prod",
+              "name": "schema"
+            }
+          ],
+          "queue": {
+            "enabled": true
+          },
+          "tasks": [
+            {
+              "job_cluster_key": "job_cluster",
+              "libraries": [
+                {
+                  "whl": "/Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/prod/artifacts/.internal/project_name_[UNIQUE_NAME]-0.0.1-py3-none-any.whl"
+                }
+              ],
+              "notebook_task": {
+                "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/prod/files/src/sample_notebook"
+              },
+              "task_key": "notebook_task"
+            },
+            {
+              "depends_on": [
+                {
+                  "task_key": "notebook_task"
+                }
+              ],
+              "job_cluster_key": "job_cluster",
+              "libraries": [
+                {
+                  "whl": "/Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/prod/artifacts/.internal/project_name_[UNIQUE_NAME]-0.0.1-py3-none-any.whl"
+                }
+              ],
+              "python_wheel_task": {
+                "entry_point": "main",
+                "package_name": "project_name_[UNIQUE_NAME]",
+                "parameters": [
+                  "--catalog",
+                  "hive_metastore",
+                  "--schema",
+                  "prod"
+                ]
+              },
+              "task_key": "python_wheel_task"
+            },
+            {
+              "depends_on": [
+                {
+                  "task_key": "notebook_task"
+                }
+              ],
+              "pipeline_task": {
+                "pipeline_id": "${resources.pipelines.project_name_[UNIQUE_NAME]_etl.id}"
+              },
+              "task_key": "refresh_pipeline"
+            }
+          ],
+          "trigger": {
+            "pause_status": "UNPAUSED",
+            "periodic": {
+              "interval": 1,
+              "unit": "DAYS"
+            }
+          }
+        },
+        "vars": {
+          "tasks[2].pipeline_task.pipeline_id": "${resources.pipelines.project_name_[UNIQUE_NAME]_etl.id}"
+        }
+      }
+    },
+    "resources.jobs.sample_job.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.sample_job",
+          "label": "${resources.jobs.sample_job.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "IS_OWNER",
+              "service_principal_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/jobs/${resources.jobs.sample_job.id}"
+        }
+      }
+    },
+    "resources.pipelines.project_name_[UNIQUE_NAME]_etl": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "channel": "CURRENT",
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/prod/state/metadata.json"
+          },
+          "edition": "ADVANCED",
+          "environment": {
+            "dependencies": [
+              "--editable /Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/prod/files"
+            ]
+          },
+          "libraries": [
+            {
+              "glob": {
+                "include": "/Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/prod/files/src/project_name_[UNIQUE_NAME]_etl/transformations/**"
+              }
+            }
+          ],
+          "name": "project_name_[UNIQUE_NAME]_etl",
+          "root_path": "/Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/prod/files/src/project_name_[UNIQUE_NAME]_etl",
+          "schema": "prod"
+        }
+      }
+    },
+    "resources.pipelines.project_name_[UNIQUE_NAME]_etl.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.project_name_[UNIQUE_NAME]_etl",
+          "label": "${resources.pipelines.project_name_[UNIQUE_NAME]_etl.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "IS_OWNER",
+              "service_principal_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/pipelines/${resources.pipelines.project_name_[UNIQUE_NAME]_etl.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/templates/default-python/integration_classic/out.plan_prod.terraform.json b/acceptance/bundle/templates/default-python/integration_classic/out.plan_prod.terraform.json
deleted file mode 100644
index 079f2ed9fb9..00000000000
--- a/acceptance/bundle/templates/default-python/integration_classic/out.plan_prod.terraform.json
+++ /dev/null
@@ -1,17 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.sample_job": {
-      "action": "create"
-    },
-    "resources.jobs.sample_job.permissions": {
-      "action": "create"
-    },
-    "resources.pipelines.project_name_[UNIQUE_NAME]_etl": {
-      "action": "create"
-    },
-    "resources.pipelines.project_name_[UNIQUE_NAME]_etl.permissions": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/templates/default-python/integration_classic/out.test.toml b/acceptance/bundle/templates/default-python/integration_classic/out.test.toml
index 50677b5f636..f80b30b9403 100644
--- a/acceptance/bundle/templates/default-python/integration_classic/out.test.toml
+++ b/acceptance/bundle/templates/default-python/integration_classic/out.test.toml
@@ -1,6 +1,5 @@
-Local = true
 Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
 EnvMatrix.UV_PYTHON = [
   "3.9",
   "3.10",
diff --git a/acceptance/bundle/templates/default-python/integration_classic/out.validate.dev.json b/acceptance/bundle/templates/default-python/integration_classic/out.validate.dev.json
index e6bac5b9c28..2f26870ead2 100644
--- a/acceptance/bundle/templates/default-python/integration_classic/out.validate.dev.json
+++ b/acceptance/bundle/templates/default-python/integration_classic/out.validate.dev.json
@@ -58,7 +58,7 @@
                 "max_workers": 4,
                 "min_workers": 1
               },
-              "data_security_mode": "SINGLE_USER",
+              "data_security_mode": "DATA_SECURITY_MODE_AUTO",
               "node_type_id": "[NODE_TYPE_ID]",
               "spark_version": "16.4.x-scala2.12"
             }
diff --git a/acceptance/bundle/templates/default-python/integration_classic/output.txt b/acceptance/bundle/templates/default-python/integration_classic/output.txt
index 2206b10cd25..f3a56f4b4ae 100644
--- a/acceptance/bundle/templates/default-python/integration_classic/output.txt
+++ b/acceptance/bundle/templates/default-python/integration_classic/output.txt
@@ -30,11 +30,12 @@ Building python_artifact...
 
 >>> [CLI] bundle deploy -t dev
 Building python_artifact...
-Uploading .databricks/bundle/dev/patched_wheels/python_artifact_project_name_[UNIQUE_NAME]/project_name_[UNIQUE_NAME]-0.0.1+[NUMID]-py3-none-any.whl...
+Uploading .databricks/bundle/dev/patched_wheels/python_artifact_project_name_[UNIQUE_NAME]/project_name_[UNIQUE_NAME]-0.0.1+[WHEEL_BUILD]-py3-none-any.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/dev/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.sample_job
+Created pipelines.project_name_[UNIQUE_NAME]_etl
+Files: 20 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle summary -t dev
 Name: project_name_[UNIQUE_NAME]
@@ -47,11 +48,11 @@ Resources:
   Jobs:
     sample_job:
       Name: [dev [USERNAME]] sample_job
-      URL:  [DATABRICKS_URL]/jobs/[NUMID]
+      URL:  [DATABRICKS_URL]/jobs/[SAMPLE_JOB_ID]
   Pipelines:
     project_name_[UNIQUE_NAME]_etl:
       Name: [dev [USERNAME]] project_name_[UNIQUE_NAME]_etl
-      URL:  [DATABRICKS_URL]/pipelines/[UUID]
+      URL:  [DATABRICKS_URL]/pipelines/[PROJECT_NAME_UNIQUE_NAME_ETL_ID]
 
 >>> [CLI] bundle summary -t dev -o json
 
@@ -61,7 +62,7 @@ Resources:
 @@ -51,4 +51,5 @@
          "edit_mode": "UI_LOCKED",
          "format": "MULTI_TASK",
-+        "id": "[NUMID]",
++        "id": "[SAMPLE_JOB_ID]",
          "job_clusters": [
            {
 @@ -138,5 +139,6 @@
@@ -69,13 +70,13 @@ Resources:
            }
 -        }
 +        },
-+        "url": "[DATABRICKS_URL]/jobs/[NUMID]"
++        "url": "[DATABRICKS_URL]/jobs/[SAMPLE_JOB_ID]"
        }
      },
 @@ -155,4 +157,5 @@
            ]
          },
-+        "id": "[UUID]",
++        "id": "[PROJECT_NAME_UNIQUE_NAME_ETL_ID]",
          "libraries": [
            {
 @@ -167,5 +170,6 @@
@@ -83,7 +84,7 @@ Resources:
            "dev": "[USERNAME]"
 -        }
 +        },
-+        "url": "[DATABRICKS_URL]/pipelines/[UUID]"
++        "url": "[DATABRICKS_URL]/pipelines/[PROJECT_NAME_UNIQUE_NAME_ETL_ID]"
        }
      }
 
@@ -93,13 +94,12 @@ The following resources will be deleted:
   delete resources.pipelines.project_name_[UNIQUE_NAME]_etl
 
 This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
-Streaming Tables (STs) and Materialized Views (MVs) managed by them:
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:
   delete resources.pipelines.project_name_[UNIQUE_NAME]_etl
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/dev
 
-Deleting files...
-Destroy complete!
+Destroy: 2 deleted
 
 >>> [CLI] bundle validate -t prod
 Name: project_name_[UNIQUE_NAME]
@@ -290,9 +290,12 @@ Building python_artifact...
 Building python_artifact...
 Uploading dist/project_name_[UNIQUE_NAME]-0.0.1-py3-none-any.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/prod/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.sample_job
+Created jobs.sample_job.permissions
+Created pipelines.project_name_[UNIQUE_NAME]_etl
+Created pipelines.project_name_[UNIQUE_NAME]_etl.permissions
+Files: 20 uploaded, 0 deleted
+Resources: 4 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle summary -t prod
 Name: project_name_[UNIQUE_NAME]
@@ -305,11 +308,11 @@ Resources:
   Jobs:
     sample_job:
       Name: sample_job
-      URL:  [DATABRICKS_URL]/jobs/[NUMID]
+      URL:  [DATABRICKS_URL]/jobs/[SAMPLE_JOB_ID_2]
   Pipelines:
     project_name_[UNIQUE_NAME]_etl:
       Name: project_name_[UNIQUE_NAME]_etl
-      URL:  [DATABRICKS_URL]/pipelines/[UUID]
+      URL:  [DATABRICKS_URL]/pipelines/[PROJECT_NAME_UNIQUE_NAME_ETL_ID_2]
 
 >>> [CLI] bundle summary -t prod -o json
 
@@ -363,13 +366,18 @@ Resources:
 +  ],
    "resources": {
      "jobs": {
-@@ -47,5 +37,5 @@
+@@ -47,9 +37,9 @@
          "deployment": {
            "kind": "BUNDLE",
 -          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/dev/state/metadata.json"
 +          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/prod/state/metadata.json"
          },
          "edit_mode": "UI_LOCKED",
+         "format": "MULTI_TASK",
+-        "id": "[SAMPLE_JOB_ID]",
++        "id": "[SAMPLE_JOB_ID_2]",
+         "job_clusters": [
+           {
 @@ -66,6 +56,6 @@
            }
          ],
@@ -421,7 +429,14 @@ Resources:
 +          "pause_status": "UNPAUSED",
            "periodic": {
              "interval": 1,
-@@ -148,11 +141,10 @@
+@@ -140,5 +133,5 @@
+           }
+         },
+-        "url": "[DATABRICKS_URL]/jobs/[SAMPLE_JOB_ID]"
++        "url": "[DATABRICKS_URL]/jobs/[SAMPLE_JOB_ID_2]"
+       }
+     },
+@@ -148,28 +141,30 @@
          "deployment": {
            "kind": "BUNDLE",
 -          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/dev/state/metadata.json"
@@ -435,7 +450,9 @@ Resources:
 +            "--editable /Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/prod/files"
            ]
          },
-@@ -161,14 +153,17 @@
+-        "id": "[PROJECT_NAME_UNIQUE_NAME_ETL_ID]",
++        "id": "[PROJECT_NAME_UNIQUE_NAME_ETL_ID_2]",
+         "libraries": [
            {
              "glob": {
 -              "include": "/Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/dev/files/src/project_name_[UNIQUE_NAME]_etl/transformations/**"
@@ -449,6 +466,7 @@ Resources:
 -        "tags": {
 -          "dev": "[USERNAME]"
 -        },
+-        "url": "[DATABRICKS_URL]/pipelines/[PROJECT_NAME_UNIQUE_NAME_ETL_ID]"
 +        "name": "project_name_[UNIQUE_NAME]_etl",
 +        "permissions": [
 +          {
@@ -458,8 +476,9 @@ Resources:
 +        ],
 +        "root_path": "/Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/prod/files/src/project_name_[UNIQUE_NAME]_etl",
 +        "schema": "prod",
-         "url": "[DATABRICKS_URL]/pipelines/[UUID]"
++        "url": "[DATABRICKS_URL]/pipelines/[PROJECT_NAME_UNIQUE_NAME_ETL_ID_2]"
        }
+     }
 @@ -187,16 +182,16 @@
      },
      "schema": {
@@ -491,10 +510,9 @@ The following resources will be deleted:
   delete resources.pipelines.project_name_[UNIQUE_NAME]_etl
 
 This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
-Streaming Tables (STs) and Materialized Views (MVs) managed by them:
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:
   delete resources.pipelines.project_name_[UNIQUE_NAME]_etl
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/project_name_[UNIQUE_NAME]/prod
 
-Deleting files...
-Destroy complete!
+Destroy: 2 deleted
diff --git a/acceptance/bundle/templates/default-python/integration_classic/script b/acceptance/bundle/templates/default-python/integration_classic/script
index 50b39d6ffce..d47fcaf1786 100644
--- a/acceptance/bundle/templates/default-python/integration_classic/script
+++ b/acceptance/bundle/templates/default-python/integration_classic/script
@@ -17,8 +17,9 @@ trap "trace $CLI bundle destroy -t dev --auto-approve" EXIT
 
 trace $CLI bundle validate -t dev
 trace $CLI bundle validate -t dev -o json | jq -S "del($JQ_DELETE)" > ../out.validate.dev.json
-$CLI bundle plan -o json -t dev > ../out.plan_dev.$DATABRICKS_BUNDLE_ENGINE.json
+$CLI bundle plan -o json -t dev | nostamp > ../out.plan_dev.json
 trace $CLI bundle deploy -t dev
+replace_ids.py -t dev
 trace $CLI bundle summary -t dev
 trace $CLI bundle summary -t dev -o json | jq -S "del($JQ_DELETE)" > ../out.summary.dev.json
 trace diff.py ../out.validate.dev.json ../out.summary.dev.json
@@ -30,8 +31,9 @@ trace $CLI bundle validate -t prod
 trace $CLI bundle validate -t prod -o json | jq -S "del($JQ_DELETE)" > ../out.validate.prod.json
 trace diff.py ../out.validate.dev.json ../out.validate.prod.json
 rm ../out.validate.prod.json
-$CLI bundle plan -o json -t prod > ../out.plan_prod.$DATABRICKS_BUNDLE_ENGINE.json
+$CLI bundle plan -o json -t prod | nostamp > ../out.plan_prod.json
 trace $CLI bundle deploy -t prod
+replace_ids.py -t prod
 trace $CLI bundle summary -t prod
 trace $CLI bundle summary -t prod -o json | jq -S "del($JQ_DELETE)" > ../out.summary.prod.json
 trace diff.py ../out.summary.dev.json ../out.summary.prod.json
diff --git a/acceptance/bundle/templates/default-python/integration_classic/test.toml b/acceptance/bundle/templates/default-python/integration_classic/test.toml
index a2371aec563..541c9919997 100644
--- a/acceptance/bundle/templates/default-python/integration_classic/test.toml
+++ b/acceptance/bundle/templates/default-python/integration_classic/test.toml
@@ -16,9 +16,9 @@ EnvMatrix.UV_PYTHON = [
 EnvRepl.UV_PYTHON = true
 
 [[Repls]]
-# for some reason leading number is lost converting "%H%M%S" 061234 to 61234
-Old = '\d{5,}'
-New = '[NUMID]'
+# The patched wheel version carries a build timestamp.
+Old = '0\.0\.1\+\d+'
+New = '0.0.1+[WHEEL_BUILD]'
 
 [[Repls]]
 Old = 'Standard_D3_v2'
@@ -34,8 +34,8 @@ Old = "python setup.py bdist_wheel"
 New = "python3 setup.py bdist_wheel"
 
 [[Repls]]
-# clean up ?o=<num> suffix after URL since not all workspaces have that
-Old = '\?o=\[NUMID\]'
+# clean up ?[ow]=<num> suffix after URL since not all workspaces have that
+Old = '\?[ow]=\[WORKSPACE_ID\]'
 New = ''
 Order = 1000
 
diff --git a/acceptance/bundle/templates/default-python/no-uc/out.test.toml b/acceptance/bundle/templates/default-python/no-uc/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/templates/default-python/no-uc/out.test.toml
+++ b/acceptance/bundle/templates/default-python/no-uc/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/templates/default-python/serverless-customcatalog/out.test.toml b/acceptance/bundle/templates/default-python/serverless-customcatalog/out.test.toml
index be193812ec2..bbd44e1b741 100644
--- a/acceptance/bundle/templates/default-python/serverless-customcatalog/out.test.toml
+++ b/acceptance/bundle/templates/default-python/serverless-customcatalog/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
 Phase = 1
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/templates/default-python/serverless-customcatalog/output.txt b/acceptance/bundle/templates/default-python/serverless-customcatalog/output.txt
index 5142d961643..3fe9b24b805 100644
--- a/acceptance/bundle/templates/default-python/serverless-customcatalog/output.txt
+++ b/acceptance/bundle/templates/default-python/serverless-customcatalog/output.txt
@@ -55,7 +55,7 @@ To get started, refer to the project README.md file and the documentation at htt
      "catalog": {
 -     "currentValue": "hive_metastore",
 +     "currentValue": "customcatalog",
-      "nuid": "c4t4l0g-w1dg-3t12-3456-[NUMID]",
+      "nuid": "c4t4l0g-w1dg-3t12-3456-789012345678",
       "typedWidgetInfo": {
        "autoCreated": false,
 -      "defaultValue": "hive_metastore",
diff --git a/acceptance/bundle/templates/default-python/serverless/out.plan_after_deploy_dev.direct.json b/acceptance/bundle/templates/default-python/serverless/out.plan_after_deploy_dev.direct.json
deleted file mode 100644
index 9fd6c6d458a..00000000000
--- a/acceptance/bundle/templates/default-python/serverless/out.plan_after_deploy_dev.direct.json
+++ /dev/null
@@ -1,222 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.jobs.sample_job": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.my_default_python_etl",
-          "label": "${resources.pipelines.my_default_python_etl.id}"
-        }
-      ],
-      "action": "skip",
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS][0],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/state/metadata.json"
-        },
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "environments": [
-          {
-            "environment_key": "default",
-            "spec": {
-              "dependencies": [
-                "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1-py3-none-any.whl"
-              ],
-              "environment_version": "4"
-            }
-          }
-        ],
-        "format": "MULTI_TASK",
-        "job_id": [NUMID],
-        "max_concurrent_runs": 4,
-        "name": "[dev [USERNAME]] sample_job",
-        "parameters": [
-          {
-            "default": "hive_metastore",
-            "name": "catalog"
-          },
-          {
-            "default": "[USERNAME]",
-            "name": "schema"
-          }
-        ],
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "tags": {
-          "dev": "[USERNAME]"
-        },
-        "tasks": [
-          {
-            "email_notifications": {},
-            "notebook_task": {
-              "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/sample_notebook",
-              "source": "WORKSPACE"
-            },
-            "run_if": "ALL_SUCCESS",
-            "task_key": "notebook_task",
-            "timeout_seconds": 0
-          },
-          {
-            "depends_on": [
-              {
-                "task_key": "notebook_task"
-              }
-            ],
-            "email_notifications": {},
-            "environment_key": "default",
-            "python_wheel_task": {
-              "entry_point": "main",
-              "package_name": "my_default_python",
-              "parameters": [
-                "--catalog",
-                "hive_metastore",
-                "--schema",
-                "[USERNAME]"
-              ]
-            },
-            "run_if": "ALL_SUCCESS",
-            "task_key": "python_wheel_task",
-            "timeout_seconds": 0
-          },
-          {
-            "depends_on": [
-              {
-                "task_key": "notebook_task"
-              }
-            ],
-            "email_notifications": {},
-            "pipeline_task": {
-              "pipeline_id": "[UUID]"
-            },
-            "run_if": "ALL_SUCCESS",
-            "task_key": "refresh_pipeline",
-            "timeout_seconds": 0
-          }
-        ],
-        "timeout_seconds": 0,
-        "trigger": {
-          "pause_status": "PAUSED",
-          "periodic": {
-            "interval": 1,
-            "unit": "DAYS"
-          }
-        },
-        "webhook_notifications": {}
-      },
-      "changes": {
-        "email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks[task_key='notebook_task'].email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks[task_key='notebook_task'].notebook_task.source": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "WORKSPACE"
-        },
-        "tasks[task_key='notebook_task'].run_if": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "ALL_SUCCESS"
-        },
-        "tasks[task_key='notebook_task'].timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "tasks[task_key='python_wheel_task'].email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks[task_key='python_wheel_task'].run_if": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "ALL_SUCCESS"
-        },
-        "tasks[task_key='python_wheel_task'].timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "tasks[task_key='refresh_pipeline'].email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks[task_key='refresh_pipeline'].run_if": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "ALL_SUCCESS"
-        },
-        "tasks[task_key='refresh_pipeline'].timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "webhook_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        }
-      }
-    },
-    "resources.pipelines.my_default_python_etl": {
-      "action": "skip",
-      "remote_state": {
-        "catalog": "main",
-        "channel": "CURRENT",
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/state/metadata.json"
-        },
-        "development": true,
-        "edition": "ADVANCED",
-        "effective_publishing_mode": "DEFAULT_PUBLISHING_MODE",
-        "environment": {
-          "dependencies": [
-            "--editable /Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files"
-          ]
-        },
-        "id": "[UUID]",
-        "last_modified": [UNIX_TIME_MILLIS][1],
-        "libraries": [
-          {
-            "glob": {
-              "include": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python_etl/transformations/**"
-            }
-          }
-        ],
-        "name": "[dev [USERNAME]] my_default_python_etl",
-        "pipeline_id": "[UUID]",
-        "root_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python_etl",
-        "run_as_user_name": "[USERNAME]",
-        "schema": "[USERNAME]",
-        "serverless": true,
-        "state": "IDLE",
-        "tags": {
-          "dev": "[USERNAME]"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/templates/default-python/serverless/out.plan_after_deploy_dev.json b/acceptance/bundle/templates/default-python/serverless/out.plan_after_deploy_dev.json
new file mode 100644
index 00000000000..4ab34f76543
--- /dev/null
+++ b/acceptance/bundle/templates/default-python/serverless/out.plan_after_deploy_dev.json
@@ -0,0 +1,222 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.jobs.sample_job": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.my_default_python_etl",
+          "label": "${resources.pipelines.my_default_python_etl.id}"
+        }
+      ],
+      "action": "skip",
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS][0],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/state/metadata.json"
+        },
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "environments": [
+          {
+            "environment_key": "default",
+            "spec": {
+              "dependencies": [
+                "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1-py3-none-any.whl"
+              ],
+              "environment_version": "5"
+            }
+          }
+        ],
+        "format": "MULTI_TASK",
+        "job_id": [SAMPLE_JOB_ID],
+        "max_concurrent_runs": 4,
+        "name": "[dev [USERNAME]] sample_job",
+        "parameters": [
+          {
+            "default": "hive_metastore",
+            "name": "catalog"
+          },
+          {
+            "default": "[USERNAME]",
+            "name": "schema"
+          }
+        ],
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "tags": {
+          "dev": "[USERNAME]"
+        },
+        "tasks": [
+          {
+            "email_notifications": {},
+            "notebook_task": {
+              "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/sample_notebook",
+              "source": "WORKSPACE"
+            },
+            "run_if": "ALL_SUCCESS",
+            "task_key": "notebook_task",
+            "timeout_seconds": 0
+          },
+          {
+            "depends_on": [
+              {
+                "task_key": "notebook_task"
+              }
+            ],
+            "email_notifications": {},
+            "environment_key": "default",
+            "python_wheel_task": {
+              "entry_point": "main",
+              "package_name": "my_default_python",
+              "parameters": [
+                "--catalog",
+                "hive_metastore",
+                "--schema",
+                "[USERNAME]"
+              ]
+            },
+            "run_if": "ALL_SUCCESS",
+            "task_key": "python_wheel_task",
+            "timeout_seconds": 0
+          },
+          {
+            "depends_on": [
+              {
+                "task_key": "notebook_task"
+              }
+            ],
+            "email_notifications": {},
+            "pipeline_task": {
+              "pipeline_id": "[MY_DEFAULT_PYTHON_ETL_ID]"
+            },
+            "run_if": "ALL_SUCCESS",
+            "task_key": "refresh_pipeline",
+            "timeout_seconds": 0
+          }
+        ],
+        "timeout_seconds": 0,
+        "trigger": {
+          "pause_status": "PAUSED",
+          "periodic": {
+            "interval": 1,
+            "unit": "DAYS"
+          }
+        },
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='notebook_task'].email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='notebook_task'].notebook_task.source": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": "WORKSPACE"
+        },
+        "tasks[task_key='notebook_task'].run_if": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": "ALL_SUCCESS"
+        },
+        "tasks[task_key='notebook_task'].timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "tasks[task_key='python_wheel_task'].email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='python_wheel_task'].run_if": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": "ALL_SUCCESS"
+        },
+        "tasks[task_key='python_wheel_task'].timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "tasks[task_key='refresh_pipeline'].email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='refresh_pipeline'].run_if": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": "ALL_SUCCESS"
+        },
+        "tasks[task_key='refresh_pipeline'].timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    },
+    "resources.pipelines.my_default_python_etl": {
+      "action": "skip",
+      "remote_state": {
+        "catalog": "main",
+        "channel": "CURRENT",
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/state/metadata.json"
+        },
+        "development": true,
+        "edition": "ADVANCED",
+        "effective_publishing_mode": "DEFAULT_PUBLISHING_MODE",
+        "environment": {
+          "dependencies": [
+            "--editable /Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files"
+          ]
+        },
+        "id": "[MY_DEFAULT_PYTHON_ETL_ID]",
+        "last_modified": [UNIX_TIME_MILLIS][1],
+        "libraries": [
+          {
+            "glob": {
+              "include": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python_etl/transformations/**"
+            }
+          }
+        ],
+        "name": "[dev [USERNAME]] my_default_python_etl",
+        "pipeline_id": "[MY_DEFAULT_PYTHON_ETL_ID]",
+        "root_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python_etl",
+        "run_as_user_name": "[USERNAME]",
+        "schema": "[USERNAME]",
+        "serverless": true,
+        "state": "IDLE",
+        "tags": {
+          "dev": "[USERNAME]"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/templates/default-python/serverless/out.plan_after_deploy_dev.terraform.json b/acceptance/bundle/templates/default-python/serverless/out.plan_after_deploy_dev.terraform.json
deleted file mode 100644
index 77667551756..00000000000
--- a/acceptance/bundle/templates/default-python/serverless/out.plan_after_deploy_dev.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.sample_job": {
-      "action": "skip"
-    },
-    "resources.pipelines.my_default_python_etl": {
-      "action": "skip"
-    }
-  }
-}
diff --git a/acceptance/bundle/templates/default-python/serverless/out.plan_after_deploy_prod.direct.json b/acceptance/bundle/templates/default-python/serverless/out.plan_after_deploy_prod.direct.json
deleted file mode 100644
index 6479c5362e0..00000000000
--- a/acceptance/bundle/templates/default-python/serverless/out.plan_after_deploy_prod.direct.json
+++ /dev/null
@@ -1,251 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "lineage": "[UUID]",
-  "serial": 1,
-  "plan": {
-    "resources.jobs.sample_job": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.my_default_python_etl",
-          "label": "${resources.pipelines.my_default_python_etl.id}"
-        }
-      ],
-      "action": "skip",
-      "remote_state": {
-        "created_time": [UNIX_TIME_MILLIS][0],
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/state/metadata.json"
-        },
-        "edit_mode": "UI_LOCKED",
-        "email_notifications": {},
-        "environments": [
-          {
-            "environment_key": "default",
-            "spec": {
-              "dependencies": [
-                "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/artifacts/.internal/my_default_python-0.0.1-py3-none-any.whl"
-              ],
-              "environment_version": "4"
-            }
-          }
-        ],
-        "format": "MULTI_TASK",
-        "job_id": [NUMID],
-        "max_concurrent_runs": 1,
-        "name": "sample_job",
-        "parameters": [
-          {
-            "default": "hive_metastore",
-            "name": "catalog"
-          },
-          {
-            "default": "prod",
-            "name": "schema"
-          }
-        ],
-        "queue": {
-          "enabled": true
-        },
-        "run_as_user_name": "[USERNAME]",
-        "tasks": [
-          {
-            "email_notifications": {},
-            "notebook_task": {
-              "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/sample_notebook",
-              "source": "WORKSPACE"
-            },
-            "run_if": "ALL_SUCCESS",
-            "task_key": "notebook_task",
-            "timeout_seconds": 0
-          },
-          {
-            "depends_on": [
-              {
-                "task_key": "notebook_task"
-              }
-            ],
-            "email_notifications": {},
-            "environment_key": "default",
-            "python_wheel_task": {
-              "entry_point": "main",
-              "package_name": "my_default_python",
-              "parameters": [
-                "--catalog",
-                "hive_metastore",
-                "--schema",
-                "prod"
-              ]
-            },
-            "run_if": "ALL_SUCCESS",
-            "task_key": "python_wheel_task",
-            "timeout_seconds": 0
-          },
-          {
-            "depends_on": [
-              {
-                "task_key": "notebook_task"
-              }
-            ],
-            "email_notifications": {},
-            "pipeline_task": {
-              "pipeline_id": "[UUID]"
-            },
-            "run_if": "ALL_SUCCESS",
-            "task_key": "refresh_pipeline",
-            "timeout_seconds": 0
-          }
-        ],
-        "timeout_seconds": 0,
-        "trigger": {
-          "pause_status": "UNPAUSED",
-          "periodic": {
-            "interval": 1,
-            "unit": "DAYS"
-          }
-        },
-        "webhook_notifications": {}
-      },
-      "changes": {
-        "email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks[task_key='notebook_task'].email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks[task_key='notebook_task'].notebook_task.source": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "WORKSPACE"
-        },
-        "tasks[task_key='notebook_task'].run_if": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "ALL_SUCCESS"
-        },
-        "tasks[task_key='notebook_task'].timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "tasks[task_key='python_wheel_task'].email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks[task_key='python_wheel_task'].run_if": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "ALL_SUCCESS"
-        },
-        "tasks[task_key='python_wheel_task'].timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "tasks[task_key='refresh_pipeline'].email_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        },
-        "tasks[task_key='refresh_pipeline'].run_if": {
-          "action": "skip",
-          "reason": "backend_default",
-          "remote": "ALL_SUCCESS"
-        },
-        "tasks[task_key='refresh_pipeline'].timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "timeout_seconds": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": 0
-        },
-        "webhook_notifications": {
-          "action": "skip",
-          "reason": "empty",
-          "remote": {}
-        }
-      }
-    },
-    "resources.jobs.sample_job.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.sample_job",
-          "label": "${resources.jobs.sample_job.id}"
-        }
-      ],
-      "action": "skip",
-      "remote_state": {
-        "object_id": "/jobs/[NUMID]",
-        "__embed__": [
-          {
-            "level": "IS_OWNER",
-            "user_name": "[USERNAME]"
-          }
-        ]
-      }
-    },
-    "resources.pipelines.my_default_python_etl": {
-      "action": "skip",
-      "remote_state": {
-        "catalog": "main",
-        "channel": "CURRENT",
-        "creator_user_name": "[USERNAME]",
-        "deployment": {
-          "kind": "BUNDLE",
-          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/state/metadata.json"
-        },
-        "edition": "ADVANCED",
-        "effective_publishing_mode": "DEFAULT_PUBLISHING_MODE",
-        "environment": {
-          "dependencies": [
-            "--editable /Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files"
-          ]
-        },
-        "id": "[UUID]",
-        "last_modified": [UNIX_TIME_MILLIS][1],
-        "libraries": [
-          {
-            "glob": {
-              "include": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python_etl/transformations/**"
-            }
-          }
-        ],
-        "name": "my_default_python_etl",
-        "pipeline_id": "[UUID]",
-        "root_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python_etl",
-        "run_as_user_name": "[USERNAME]",
-        "schema": "prod",
-        "serverless": true,
-        "state": "IDLE"
-      }
-    },
-    "resources.pipelines.my_default_python_etl.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.my_default_python_etl",
-          "label": "${resources.pipelines.my_default_python_etl.id}"
-        }
-      ],
-      "action": "skip",
-      "remote_state": {
-        "object_id": "/pipelines/[UUID]",
-        "__embed__": [
-          {
-            "level": "IS_OWNER",
-            "user_name": "[USERNAME]"
-          }
-        ]
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/templates/default-python/serverless/out.plan_after_deploy_prod.json b/acceptance/bundle/templates/default-python/serverless/out.plan_after_deploy_prod.json
new file mode 100644
index 00000000000..57c1c81b2af
--- /dev/null
+++ b/acceptance/bundle/templates/default-python/serverless/out.plan_after_deploy_prod.json
@@ -0,0 +1,251 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "lineage": "[UUID]",
+  "serial": 1,
+  "plan": {
+    "resources.jobs.sample_job": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.my_default_python_etl",
+          "label": "${resources.pipelines.my_default_python_etl.id}"
+        }
+      ],
+      "action": "skip",
+      "remote_state": {
+        "created_time": [UNIX_TIME_MILLIS][0],
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/state/metadata.json"
+        },
+        "edit_mode": "UI_LOCKED",
+        "email_notifications": {},
+        "environments": [
+          {
+            "environment_key": "default",
+            "spec": {
+              "dependencies": [
+                "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/artifacts/.internal/my_default_python-0.0.1-py3-none-any.whl"
+              ],
+              "environment_version": "5"
+            }
+          }
+        ],
+        "format": "MULTI_TASK",
+        "job_id": [SAMPLE_JOB_ID_2],
+        "max_concurrent_runs": 1,
+        "name": "sample_job",
+        "parameters": [
+          {
+            "default": "hive_metastore",
+            "name": "catalog"
+          },
+          {
+            "default": "prod",
+            "name": "schema"
+          }
+        ],
+        "queue": {
+          "enabled": true
+        },
+        "run_as_user_name": "[USERNAME]",
+        "tasks": [
+          {
+            "email_notifications": {},
+            "notebook_task": {
+              "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/sample_notebook",
+              "source": "WORKSPACE"
+            },
+            "run_if": "ALL_SUCCESS",
+            "task_key": "notebook_task",
+            "timeout_seconds": 0
+          },
+          {
+            "depends_on": [
+              {
+                "task_key": "notebook_task"
+              }
+            ],
+            "email_notifications": {},
+            "environment_key": "default",
+            "python_wheel_task": {
+              "entry_point": "main",
+              "package_name": "my_default_python",
+              "parameters": [
+                "--catalog",
+                "hive_metastore",
+                "--schema",
+                "prod"
+              ]
+            },
+            "run_if": "ALL_SUCCESS",
+            "task_key": "python_wheel_task",
+            "timeout_seconds": 0
+          },
+          {
+            "depends_on": [
+              {
+                "task_key": "notebook_task"
+              }
+            ],
+            "email_notifications": {},
+            "pipeline_task": {
+              "pipeline_id": "[MY_DEFAULT_PYTHON_ETL_ID_2]"
+            },
+            "run_if": "ALL_SUCCESS",
+            "task_key": "refresh_pipeline",
+            "timeout_seconds": 0
+          }
+        ],
+        "timeout_seconds": 0,
+        "trigger": {
+          "pause_status": "UNPAUSED",
+          "periodic": {
+            "interval": 1,
+            "unit": "DAYS"
+          }
+        },
+        "webhook_notifications": {}
+      },
+      "changes": {
+        "email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='notebook_task'].email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='notebook_task'].notebook_task.source": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": "WORKSPACE"
+        },
+        "tasks[task_key='notebook_task'].run_if": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": "ALL_SUCCESS"
+        },
+        "tasks[task_key='notebook_task'].timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "tasks[task_key='python_wheel_task'].email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='python_wheel_task'].run_if": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": "ALL_SUCCESS"
+        },
+        "tasks[task_key='python_wheel_task'].timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "tasks[task_key='refresh_pipeline'].email_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        },
+        "tasks[task_key='refresh_pipeline'].run_if": {
+          "action": "skip",
+          "reason": "backend_default",
+          "remote": "ALL_SUCCESS"
+        },
+        "tasks[task_key='refresh_pipeline'].timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "timeout_seconds": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": 0
+        },
+        "webhook_notifications": {
+          "action": "skip",
+          "reason": "empty",
+          "remote": {}
+        }
+      }
+    },
+    "resources.jobs.sample_job.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.sample_job",
+          "label": "${resources.jobs.sample_job.id}"
+        }
+      ],
+      "action": "skip",
+      "remote_state": {
+        "object_id": "/jobs/[SAMPLE_JOB_ID_2]",
+        "__embed__": [
+          {
+            "level": "IS_OWNER",
+            "user_name": "[USERNAME]"
+          }
+        ]
+      }
+    },
+    "resources.pipelines.my_default_python_etl": {
+      "action": "skip",
+      "remote_state": {
+        "catalog": "main",
+        "channel": "CURRENT",
+        "creator_user_name": "[USERNAME]",
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/state/metadata.json"
+        },
+        "edition": "ADVANCED",
+        "effective_publishing_mode": "DEFAULT_PUBLISHING_MODE",
+        "environment": {
+          "dependencies": [
+            "--editable /Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files"
+          ]
+        },
+        "id": "[MY_DEFAULT_PYTHON_ETL_ID_2]",
+        "last_modified": [UNIX_TIME_MILLIS][1],
+        "libraries": [
+          {
+            "glob": {
+              "include": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python_etl/transformations/**"
+            }
+          }
+        ],
+        "name": "my_default_python_etl",
+        "pipeline_id": "[MY_DEFAULT_PYTHON_ETL_ID_2]",
+        "root_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python_etl",
+        "run_as_user_name": "[USERNAME]",
+        "schema": "prod",
+        "serverless": true,
+        "state": "IDLE"
+      }
+    },
+    "resources.pipelines.my_default_python_etl.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.my_default_python_etl",
+          "label": "${resources.pipelines.my_default_python_etl.id}"
+        }
+      ],
+      "action": "skip",
+      "remote_state": {
+        "object_id": "/pipelines/[MY_DEFAULT_PYTHON_ETL_ID_2]",
+        "__embed__": [
+          {
+            "level": "IS_OWNER",
+            "user_name": "[USERNAME]"
+          }
+        ]
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/templates/default-python/serverless/out.plan_after_deploy_prod.terraform.json b/acceptance/bundle/templates/default-python/serverless/out.plan_after_deploy_prod.terraform.json
deleted file mode 100644
index 103b8a29e32..00000000000
--- a/acceptance/bundle/templates/default-python/serverless/out.plan_after_deploy_prod.terraform.json
+++ /dev/null
@@ -1,17 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.sample_job": {
-      "action": "skip"
-    },
-    "resources.jobs.sample_job.permissions": {
-      "action": "skip"
-    },
-    "resources.pipelines.my_default_python_etl": {
-      "action": "skip"
-    },
-    "resources.pipelines.my_default_python_etl.permissions": {
-      "action": "skip"
-    }
-  }
-}
diff --git a/acceptance/bundle/templates/default-python/serverless/out.plan_dev.direct.json b/acceptance/bundle/templates/default-python/serverless/out.plan_dev.direct.json
deleted file mode 100644
index 5387836449d..00000000000
--- a/acceptance/bundle/templates/default-python/serverless/out.plan_dev.direct.json
+++ /dev/null
@@ -1,136 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.sample_job": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.my_default_python_etl",
-          "label": "${resources.pipelines.my_default_python_etl.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/state/metadata.json"
-          },
-          "edit_mode": "UI_LOCKED",
-          "environments": [
-            {
-              "environment_key": "default",
-              "spec": {
-                "dependencies": [
-                  "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1-py3-none-any.whl"
-                ],
-                "environment_version": "4"
-              }
-            }
-          ],
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 4,
-          "name": "[dev [USERNAME]] sample_job",
-          "parameters": [
-            {
-              "default": "hive_metastore",
-              "name": "catalog"
-            },
-            {
-              "default": "[USERNAME]",
-              "name": "schema"
-            }
-          ],
-          "queue": {
-            "enabled": true
-          },
-          "tags": {
-            "dev": "[USERNAME]"
-          },
-          "tasks": [
-            {
-              "notebook_task": {
-                "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/sample_notebook"
-              },
-              "task_key": "notebook_task"
-            },
-            {
-              "depends_on": [
-                {
-                  "task_key": "notebook_task"
-                }
-              ],
-              "environment_key": "default",
-              "python_wheel_task": {
-                "entry_point": "main",
-                "package_name": "my_default_python",
-                "parameters": [
-                  "--catalog",
-                  "hive_metastore",
-                  "--schema",
-                  "[USERNAME]"
-                ]
-              },
-              "task_key": "python_wheel_task"
-            },
-            {
-              "depends_on": [
-                {
-                  "task_key": "notebook_task"
-                }
-              ],
-              "pipeline_task": {
-                "pipeline_id": "${resources.pipelines.my_default_python_etl.id}"
-              },
-              "task_key": "refresh_pipeline"
-            }
-          ],
-          "trigger": {
-            "pause_status": "PAUSED",
-            "periodic": {
-              "interval": 1,
-              "unit": "DAYS"
-            }
-          }
-        },
-        "vars": {
-          "tasks[2].pipeline_task.pipeline_id": "${resources.pipelines.my_default_python_etl.id}"
-        }
-      }
-    },
-    "resources.pipelines.my_default_python_etl": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "catalog": "main",
-          "channel": "CURRENT",
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/state/metadata.json"
-          },
-          "development": true,
-          "edition": "ADVANCED",
-          "environment": {
-            "dependencies": [
-              "--editable /Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files"
-            ]
-          },
-          "libraries": [
-            {
-              "glob": {
-                "include": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python_etl/transformations/**"
-              }
-            }
-          ],
-          "name": "[dev [USERNAME]] my_default_python_etl",
-          "root_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python_etl",
-          "schema": "[USERNAME]",
-          "serverless": true,
-          "tags": {
-            "dev": "[USERNAME]"
-          }
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/templates/default-python/serverless/out.plan_dev.json b/acceptance/bundle/templates/default-python/serverless/out.plan_dev.json
new file mode 100644
index 00000000000..02a7e3244de
--- /dev/null
+++ b/acceptance/bundle/templates/default-python/serverless/out.plan_dev.json
@@ -0,0 +1,136 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.jobs.sample_job": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.my_default_python_etl",
+          "label": "${resources.pipelines.my_default_python_etl.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "environments": [
+            {
+              "environment_key": "default",
+              "spec": {
+                "dependencies": [
+                  "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1-py3-none-any.whl"
+                ],
+                "environment_version": "5"
+              }
+            }
+          ],
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 4,
+          "name": "[dev [USERNAME]] sample_job",
+          "parameters": [
+            {
+              "default": "hive_metastore",
+              "name": "catalog"
+            },
+            {
+              "default": "[USERNAME]",
+              "name": "schema"
+            }
+          ],
+          "queue": {
+            "enabled": true
+          },
+          "tags": {
+            "dev": "[USERNAME]"
+          },
+          "tasks": [
+            {
+              "notebook_task": {
+                "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/sample_notebook"
+              },
+              "task_key": "notebook_task"
+            },
+            {
+              "depends_on": [
+                {
+                  "task_key": "notebook_task"
+                }
+              ],
+              "environment_key": "default",
+              "python_wheel_task": {
+                "entry_point": "main",
+                "package_name": "my_default_python",
+                "parameters": [
+                  "--catalog",
+                  "hive_metastore",
+                  "--schema",
+                  "[USERNAME]"
+                ]
+              },
+              "task_key": "python_wheel_task"
+            },
+            {
+              "depends_on": [
+                {
+                  "task_key": "notebook_task"
+                }
+              ],
+              "pipeline_task": {
+                "pipeline_id": "${resources.pipelines.my_default_python_etl.id}"
+              },
+              "task_key": "refresh_pipeline"
+            }
+          ],
+          "trigger": {
+            "pause_status": "PAUSED",
+            "periodic": {
+              "interval": 1,
+              "unit": "DAYS"
+            }
+          }
+        },
+        "vars": {
+          "tasks[2].pipeline_task.pipeline_id": "${resources.pipelines.my_default_python_etl.id}"
+        }
+      }
+    },
+    "resources.pipelines.my_default_python_etl": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "catalog": "main",
+          "channel": "CURRENT",
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/state/metadata.json"
+          },
+          "development": true,
+          "edition": "ADVANCED",
+          "environment": {
+            "dependencies": [
+              "--editable /Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files"
+            ]
+          },
+          "libraries": [
+            {
+              "glob": {
+                "include": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python_etl/transformations/**"
+              }
+            }
+          ],
+          "name": "[dev [USERNAME]] my_default_python_etl",
+          "root_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python_etl",
+          "schema": "[USERNAME]",
+          "serverless": true,
+          "tags": {
+            "dev": "[USERNAME]"
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/templates/default-python/serverless/out.plan_dev.terraform.json b/acceptance/bundle/templates/default-python/serverless/out.plan_dev.terraform.json
deleted file mode 100644
index 8c17fc10856..00000000000
--- a/acceptance/bundle/templates/default-python/serverless/out.plan_dev.terraform.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.sample_job": {
-      "action": "create"
-    },
-    "resources.pipelines.my_default_python_etl": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/templates/default-python/serverless/out.plan_prod.direct.json b/acceptance/bundle/templates/default-python/serverless/out.plan_prod.direct.json
deleted file mode 100644
index 100e1f14a47..00000000000
--- a/acceptance/bundle/templates/default-python/serverless/out.plan_prod.direct.json
+++ /dev/null
@@ -1,175 +0,0 @@
-{
-  "plan_version": 2,
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.sample_job": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.my_default_python_etl",
-          "label": "${resources.pipelines.my_default_python_etl.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/state/metadata.json"
-          },
-          "edit_mode": "UI_LOCKED",
-          "environments": [
-            {
-              "environment_key": "default",
-              "spec": {
-                "dependencies": [
-                  "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/artifacts/.internal/my_default_python-0.0.1-py3-none-any.whl"
-                ],
-                "environment_version": "4"
-              }
-            }
-          ],
-          "format": "MULTI_TASK",
-          "max_concurrent_runs": 1,
-          "name": "sample_job",
-          "parameters": [
-            {
-              "default": "hive_metastore",
-              "name": "catalog"
-            },
-            {
-              "default": "prod",
-              "name": "schema"
-            }
-          ],
-          "queue": {
-            "enabled": true
-          },
-          "tasks": [
-            {
-              "notebook_task": {
-                "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/sample_notebook"
-              },
-              "task_key": "notebook_task"
-            },
-            {
-              "depends_on": [
-                {
-                  "task_key": "notebook_task"
-                }
-              ],
-              "environment_key": "default",
-              "python_wheel_task": {
-                "entry_point": "main",
-                "package_name": "my_default_python",
-                "parameters": [
-                  "--catalog",
-                  "hive_metastore",
-                  "--schema",
-                  "prod"
-                ]
-              },
-              "task_key": "python_wheel_task"
-            },
-            {
-              "depends_on": [
-                {
-                  "task_key": "notebook_task"
-                }
-              ],
-              "pipeline_task": {
-                "pipeline_id": "${resources.pipelines.my_default_python_etl.id}"
-              },
-              "task_key": "refresh_pipeline"
-            }
-          ],
-          "trigger": {
-            "pause_status": "UNPAUSED",
-            "periodic": {
-              "interval": 1,
-              "unit": "DAYS"
-            }
-          }
-        },
-        "vars": {
-          "tasks[2].pipeline_task.pipeline_id": "${resources.pipelines.my_default_python_etl.id}"
-        }
-      }
-    },
-    "resources.jobs.sample_job.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.jobs.sample_job",
-          "label": "${resources.jobs.sample_job.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "IS_OWNER",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/jobs/${resources.jobs.sample_job.id}"
-        }
-      }
-    },
-    "resources.pipelines.my_default_python_etl": {
-      "action": "create",
-      "new_state": {
-        "value": {
-          "catalog": "main",
-          "channel": "CURRENT",
-          "deployment": {
-            "kind": "BUNDLE",
-            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/state/metadata.json"
-          },
-          "edition": "ADVANCED",
-          "environment": {
-            "dependencies": [
-              "--editable /Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files"
-            ]
-          },
-          "libraries": [
-            {
-              "glob": {
-                "include": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python_etl/transformations/**"
-              }
-            }
-          ],
-          "name": "my_default_python_etl",
-          "root_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python_etl",
-          "schema": "prod",
-          "serverless": true
-        }
-      }
-    },
-    "resources.pipelines.my_default_python_etl.permissions": {
-      "depends_on": [
-        {
-          "node": "resources.pipelines.my_default_python_etl",
-          "label": "${resources.pipelines.my_default_python_etl.id}"
-        }
-      ],
-      "action": "create",
-      "new_state": {
-        "value": {
-          "object_id": "",
-          "__embed__": [
-            {
-              "level": "IS_OWNER",
-              "user_name": "[USERNAME]"
-            }
-          ]
-        },
-        "vars": {
-          "object_id": "/pipelines/${resources.pipelines.my_default_python_etl.id}"
-        }
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/templates/default-python/serverless/out.plan_prod.json b/acceptance/bundle/templates/default-python/serverless/out.plan_prod.json
new file mode 100644
index 00000000000..9d636f14ccc
--- /dev/null
+++ b/acceptance/bundle/templates/default-python/serverless/out.plan_prod.json
@@ -0,0 +1,175 @@
+{
+  "plan_version": [PLAN_VERSION],
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.jobs.sample_job": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.my_default_python_etl",
+          "label": "${resources.pipelines.my_default_python_etl.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/state/metadata.json"
+          },
+          "edit_mode": "UI_LOCKED",
+          "environments": [
+            {
+              "environment_key": "default",
+              "spec": {
+                "dependencies": [
+                  "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/artifacts/.internal/my_default_python-0.0.1-py3-none-any.whl"
+                ],
+                "environment_version": "5"
+              }
+            }
+          ],
+          "format": "MULTI_TASK",
+          "max_concurrent_runs": 1,
+          "name": "sample_job",
+          "parameters": [
+            {
+              "default": "hive_metastore",
+              "name": "catalog"
+            },
+            {
+              "default": "prod",
+              "name": "schema"
+            }
+          ],
+          "queue": {
+            "enabled": true
+          },
+          "tasks": [
+            {
+              "notebook_task": {
+                "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/sample_notebook"
+              },
+              "task_key": "notebook_task"
+            },
+            {
+              "depends_on": [
+                {
+                  "task_key": "notebook_task"
+                }
+              ],
+              "environment_key": "default",
+              "python_wheel_task": {
+                "entry_point": "main",
+                "package_name": "my_default_python",
+                "parameters": [
+                  "--catalog",
+                  "hive_metastore",
+                  "--schema",
+                  "prod"
+                ]
+              },
+              "task_key": "python_wheel_task"
+            },
+            {
+              "depends_on": [
+                {
+                  "task_key": "notebook_task"
+                }
+              ],
+              "pipeline_task": {
+                "pipeline_id": "${resources.pipelines.my_default_python_etl.id}"
+              },
+              "task_key": "refresh_pipeline"
+            }
+          ],
+          "trigger": {
+            "pause_status": "UNPAUSED",
+            "periodic": {
+              "interval": 1,
+              "unit": "DAYS"
+            }
+          }
+        },
+        "vars": {
+          "tasks[2].pipeline_task.pipeline_id": "${resources.pipelines.my_default_python_etl.id}"
+        }
+      }
+    },
+    "resources.jobs.sample_job.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.sample_job",
+          "label": "${resources.jobs.sample_job.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "IS_OWNER",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/jobs/${resources.jobs.sample_job.id}"
+        }
+      }
+    },
+    "resources.pipelines.my_default_python_etl": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "catalog": "main",
+          "channel": "CURRENT",
+          "deployment": {
+            "kind": "BUNDLE",
+            "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/state/metadata.json"
+          },
+          "edition": "ADVANCED",
+          "environment": {
+            "dependencies": [
+              "--editable /Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files"
+            ]
+          },
+          "libraries": [
+            {
+              "glob": {
+                "include": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python_etl/transformations/**"
+              }
+            }
+          ],
+          "name": "my_default_python_etl",
+          "root_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python_etl",
+          "schema": "prod",
+          "serverless": true
+        }
+      }
+    },
+    "resources.pipelines.my_default_python_etl.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.my_default_python_etl",
+          "label": "${resources.pipelines.my_default_python_etl.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "IS_OWNER",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/pipelines/${resources.pipelines.my_default_python_etl.id}"
+        }
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/templates/default-python/serverless/out.plan_prod.terraform.json b/acceptance/bundle/templates/default-python/serverless/out.plan_prod.terraform.json
deleted file mode 100644
index 175c9e38130..00000000000
--- a/acceptance/bundle/templates/default-python/serverless/out.plan_prod.terraform.json
+++ /dev/null
@@ -1,17 +0,0 @@
-{
-  "cli_version": "[DEV_VERSION]",
-  "plan": {
-    "resources.jobs.sample_job": {
-      "action": "create"
-    },
-    "resources.jobs.sample_job.permissions": {
-      "action": "create"
-    },
-    "resources.pipelines.my_default_python_etl": {
-      "action": "create"
-    },
-    "resources.pipelines.my_default_python_etl.permissions": {
-      "action": "create"
-    }
-  }
-}
diff --git a/acceptance/bundle/templates/default-python/serverless/out.requests.dev.direct.txt b/acceptance/bundle/templates/default-python/serverless/out.requests.dev.direct.txt
deleted file mode 100644
index c5d9ae4c6b2..00000000000
--- a/acceptance/bundle/templates/default-python/serverless/out.requests.dev.direct.txt
+++ /dev/null
@@ -1,176 +0,0 @@
-{
-  "method": "POST",
-  "path": "/api/2.0/pipelines",
-  "body": {
-    "catalog": "main",
-    "channel": "CURRENT",
-    "deployment": {
-      "kind": "BUNDLE",
-      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/state/metadata.json"
-    },
-    "development": true,
-    "edition": "ADVANCED",
-    "environment": {
-      "dependencies": [
-        "--editable /Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files"
-      ]
-    },
-    "libraries": [
-      {
-        "glob": {
-          "include": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python_etl/transformations/**"
-        }
-      }
-    ],
-    "name": "[dev [USERNAME]] my_default_python_etl",
-    "root_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python_etl",
-    "schema": "[USERNAME]",
-    "serverless": true,
-    "tags": {
-      "dev": "[USERNAME]"
-    }
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/delete",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal",
-    "recursive": true
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/.vscode"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/fixtures"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/resources"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python_etl/transformations"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/tests"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.2/jobs/create",
-  "body": {
-    "deployment": {
-      "kind": "BUNDLE",
-      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/state/metadata.json"
-    },
-    "edit_mode": "UI_LOCKED",
-    "environments": [
-      {
-        "environment_key": "default",
-        "spec": {
-          "dependencies": [
-            "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1-py3-none-any.whl"
-          ],
-          "environment_version": "4"
-        }
-      }
-    ],
-    "format": "MULTI_TASK",
-    "max_concurrent_runs": 4,
-    "name": "[dev [USERNAME]] sample_job",
-    "parameters": [
-      {
-        "default": "hive_metastore",
-        "name": "catalog"
-      },
-      {
-        "default": "[USERNAME]",
-        "name": "schema"
-      }
-    ],
-    "queue": {
-      "enabled": true
-    },
-    "tags": {
-      "dev": "[USERNAME]"
-    },
-    "tasks": [
-      {
-        "notebook_task": {
-          "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/sample_notebook"
-        },
-        "task_key": "notebook_task"
-      },
-      {
-        "depends_on": [
-          {
-            "task_key": "notebook_task"
-          }
-        ],
-        "environment_key": "default",
-        "python_wheel_task": {
-          "entry_point": "main",
-          "package_name": "my_default_python",
-          "parameters": [
-            "--catalog",
-            "hive_metastore",
-            "--schema",
-            "[USERNAME]"
-          ]
-        },
-        "task_key": "python_wheel_task"
-      },
-      {
-        "depends_on": [
-          {
-            "task_key": "notebook_task"
-          }
-        ],
-        "pipeline_task": {
-          "pipeline_id": "[UUID]"
-        },
-        "task_key": "refresh_pipeline"
-      }
-    ],
-    "trigger": {
-      "pause_status": "PAUSED",
-      "periodic": {
-        "interval": 1,
-        "unit": "DAYS"
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/templates/default-python/serverless/out.requests.dev.terraform.txt b/acceptance/bundle/templates/default-python/serverless/out.requests.dev.terraform.txt
deleted file mode 100644
index 4dfb549b054..00000000000
--- a/acceptance/bundle/templates/default-python/serverless/out.requests.dev.terraform.txt
+++ /dev/null
@@ -1,177 +0,0 @@
-{
-  "method": "POST",
-  "path": "/api/2.0/pipelines",
-  "body": {
-    "catalog": "main",
-    "channel": "CURRENT",
-    "deployment": {
-      "kind": "BUNDLE",
-      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/state/metadata.json"
-    },
-    "development": true,
-    "edition": "ADVANCED",
-    "environment": {
-      "dependencies": [
-        "--editable /Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files"
-      ]
-    },
-    "libraries": [
-      {
-        "glob": {
-          "include": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python_etl/transformations/**"
-        }
-      }
-    ],
-    "name": "[dev [USERNAME]] my_default_python_etl",
-    "root_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python_etl",
-    "schema": "[USERNAME]",
-    "serverless": true,
-    "tags": {
-      "dev": "[USERNAME]"
-    }
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/delete",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal",
-    "recursive": true
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/.vscode"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/fixtures"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/resources"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python_etl/transformations"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/tests"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.2/jobs/create",
-  "body": {
-    "deployment": {
-      "kind": "BUNDLE",
-      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/state/metadata.json"
-    },
-    "edit_mode": "UI_LOCKED",
-    "environments": [
-      {
-        "environment_key": "default",
-        "spec": {
-          "dependencies": [
-            "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1-py3-none-any.whl"
-          ],
-          "environment_version": "4"
-        }
-      }
-    ],
-    "format": "MULTI_TASK",
-    "max_concurrent_runs": 4,
-    "name": "[dev [USERNAME]] sample_job",
-    "parameters": [
-      {
-        "default": "hive_metastore",
-        "name": "catalog"
-      },
-      {
-        "default": "[USERNAME]",
-        "name": "schema"
-      }
-    ],
-    "queue": {
-      "enabled": true
-    },
-    "tags": {
-      "dev": "[USERNAME]"
-    },
-    "tasks": [
-      {
-        "notebook_task": {
-          "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/sample_notebook",
-          "source": "WORKSPACE"
-        },
-        "task_key": "notebook_task"
-      },
-      {
-        "depends_on": [
-          {
-            "task_key": "notebook_task"
-          }
-        ],
-        "environment_key": "default",
-        "python_wheel_task": {
-          "entry_point": "main",
-          "package_name": "my_default_python",
-          "parameters": [
-            "--catalog",
-            "hive_metastore",
-            "--schema",
-            "[USERNAME]"
-          ]
-        },
-        "task_key": "python_wheel_task"
-      },
-      {
-        "depends_on": [
-          {
-            "task_key": "notebook_task"
-          }
-        ],
-        "pipeline_task": {
-          "pipeline_id": "[UUID]"
-        },
-        "task_key": "refresh_pipeline"
-      }
-    ],
-    "trigger": {
-      "pause_status": "PAUSED",
-      "periodic": {
-        "interval": 1,
-        "unit": "DAYS"
-      }
-    }
-  }
-}
diff --git a/acceptance/bundle/templates/default-python/serverless/out.requests.dev.txt b/acceptance/bundle/templates/default-python/serverless/out.requests.dev.txt
new file mode 100644
index 00000000000..873fa7fd1df
--- /dev/null
+++ b/acceptance/bundle/templates/default-python/serverless/out.requests.dev.txt
@@ -0,0 +1,183 @@
+{
+  "method": "POST",
+  "path": "/api/2.0/pipelines",
+  "body": {
+    "catalog": "main",
+    "channel": "CURRENT",
+    "deployment": {
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/state/metadata.json"
+    },
+    "development": true,
+    "edition": "ADVANCED",
+    "environment": {
+      "dependencies": [
+        "--editable /Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files"
+      ]
+    },
+    "libraries": [
+      {
+        "glob": {
+          "include": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python_etl/transformations/**"
+        }
+      }
+    ],
+    "name": "[dev [USERNAME]] my_default_python_etl",
+    "root_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python_etl",
+    "schema": "[USERNAME]",
+    "serverless": true,
+    "tags": {
+      "dev": "[USERNAME]"
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/delete",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal",
+    "recursive": true
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/.vscode"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/fixtures"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/resources"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/my_default_python_etl/transformations"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/tests"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/state"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/create",
+  "body": {
+    "deployment": {
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/state/metadata.json"
+    },
+    "edit_mode": "UI_LOCKED",
+    "environments": [
+      {
+        "environment_key": "default",
+        "spec": {
+          "dependencies": [
+            "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/artifacts/.internal/my_default_python-0.0.1-py3-none-any.whl"
+          ],
+          "environment_version": "5"
+        }
+      }
+    ],
+    "format": "MULTI_TASK",
+    "max_concurrent_runs": 4,
+    "name": "[dev [USERNAME]] sample_job",
+    "parameters": [
+      {
+        "default": "hive_metastore",
+        "name": "catalog"
+      },
+      {
+        "default": "[USERNAME]",
+        "name": "schema"
+      }
+    ],
+    "queue": {
+      "enabled": true
+    },
+    "tags": {
+      "dev": "[USERNAME]"
+    },
+    "tasks": [
+      {
+        "notebook_task": {
+          "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files/src/sample_notebook"
+        },
+        "task_key": "notebook_task"
+      },
+      {
+        "depends_on": [
+          {
+            "task_key": "notebook_task"
+          }
+        ],
+        "environment_key": "default",
+        "python_wheel_task": {
+          "entry_point": "main",
+          "package_name": "my_default_python",
+          "parameters": [
+            "--catalog",
+            "hive_metastore",
+            "--schema",
+            "[USERNAME]"
+          ]
+        },
+        "task_key": "python_wheel_task"
+      },
+      {
+        "depends_on": [
+          {
+            "task_key": "notebook_task"
+          }
+        ],
+        "pipeline_task": {
+          "pipeline_id": "[MY_DEFAULT_PYTHON_ETL_ID]"
+        },
+        "task_key": "refresh_pipeline"
+      }
+    ],
+    "trigger": {
+      "pause_status": "PAUSED",
+      "periodic": {
+        "interval": 1,
+        "unit": "DAYS"
+      }
+    }
+  }
+}
diff --git a/acceptance/bundle/templates/default-python/serverless/out.requests.prod.direct.txt b/acceptance/bundle/templates/default-python/serverless/out.requests.prod.direct.txt
deleted file mode 100644
index d7a761ae4cc..00000000000
--- a/acceptance/bundle/templates/default-python/serverless/out.requests.prod.direct.txt
+++ /dev/null
@@ -1,212 +0,0 @@
-{
-  "method": "POST",
-  "path": "/api/2.0/pipelines",
-  "body": {
-    "catalog": "main",
-    "channel": "CURRENT",
-    "deployment": {
-      "kind": "BUNDLE",
-      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/state/metadata.json"
-    },
-    "edition": "ADVANCED",
-    "environment": {
-      "dependencies": [
-        "--editable /Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files"
-      ]
-    },
-    "libraries": [
-      {
-        "glob": {
-          "include": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python_etl/transformations/**"
-        }
-      }
-    ],
-    "name": "my_default_python_etl",
-    "root_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python_etl",
-    "schema": "prod",
-    "serverless": true
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/delete",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/artifacts/.internal",
-    "recursive": true
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/delete",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/state/deploy.lock"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/artifacts/.internal"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/.vscode"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/fixtures"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/resources"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python_etl/transformations"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/tests"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.2/jobs/create",
-  "body": {
-    "deployment": {
-      "kind": "BUNDLE",
-      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/state/metadata.json"
-    },
-    "edit_mode": "UI_LOCKED",
-    "environments": [
-      {
-        "environment_key": "default",
-        "spec": {
-          "dependencies": [
-            "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/artifacts/.internal/my_default_python-0.0.1-py3-none-any.whl"
-          ],
-          "environment_version": "4"
-        }
-      }
-    ],
-    "format": "MULTI_TASK",
-    "max_concurrent_runs": 1,
-    "name": "sample_job",
-    "parameters": [
-      {
-        "default": "hive_metastore",
-        "name": "catalog"
-      },
-      {
-        "default": "prod",
-        "name": "schema"
-      }
-    ],
-    "queue": {
-      "enabled": true
-    },
-    "tasks": [
-      {
-        "notebook_task": {
-          "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/sample_notebook"
-        },
-        "task_key": "notebook_task"
-      },
-      {
-        "depends_on": [
-          {
-            "task_key": "notebook_task"
-          }
-        ],
-        "environment_key": "default",
-        "python_wheel_task": {
-          "entry_point": "main",
-          "package_name": "my_default_python",
-          "parameters": [
-            "--catalog",
-            "hive_metastore",
-            "--schema",
-            "prod"
-          ]
-        },
-        "task_key": "python_wheel_task"
-      },
-      {
-        "depends_on": [
-          {
-            "task_key": "notebook_task"
-          }
-        ],
-        "pipeline_task": {
-          "pipeline_id": "[UUID]"
-        },
-        "task_key": "refresh_pipeline"
-      }
-    ],
-    "trigger": {
-      "pause_status": "UNPAUSED",
-      "periodic": {
-        "interval": 1,
-        "unit": "DAYS"
-      }
-    }
-  }
-}
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/directories/[NUMID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_MANAGE",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/jobs/[NUMID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/pipelines/[UUID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/templates/default-python/serverless/out.requests.prod.terraform.txt b/acceptance/bundle/templates/default-python/serverless/out.requests.prod.terraform.txt
deleted file mode 100644
index ae401a3c97a..00000000000
--- a/acceptance/bundle/templates/default-python/serverless/out.requests.prod.terraform.txt
+++ /dev/null
@@ -1,213 +0,0 @@
-{
-  "method": "POST",
-  "path": "/api/2.0/pipelines",
-  "body": {
-    "catalog": "main",
-    "channel": "CURRENT",
-    "deployment": {
-      "kind": "BUNDLE",
-      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/state/metadata.json"
-    },
-    "edition": "ADVANCED",
-    "environment": {
-      "dependencies": [
-        "--editable /Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files"
-      ]
-    },
-    "libraries": [
-      {
-        "glob": {
-          "include": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python_etl/transformations/**"
-        }
-      }
-    ],
-    "name": "my_default_python_etl",
-    "root_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python_etl",
-    "schema": "prod",
-    "serverless": true
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/delete",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/artifacts/.internal",
-    "recursive": true
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/delete",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/state/deploy.lock"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/artifacts/.internal"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/.vscode"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/fixtures"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/resources"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python_etl/transformations"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/tests"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.2/jobs/create",
-  "body": {
-    "deployment": {
-      "kind": "BUNDLE",
-      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/state/metadata.json"
-    },
-    "edit_mode": "UI_LOCKED",
-    "environments": [
-      {
-        "environment_key": "default",
-        "spec": {
-          "dependencies": [
-            "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/artifacts/.internal/my_default_python-0.0.1-py3-none-any.whl"
-          ],
-          "environment_version": "4"
-        }
-      }
-    ],
-    "format": "MULTI_TASK",
-    "max_concurrent_runs": 1,
-    "name": "sample_job",
-    "parameters": [
-      {
-        "default": "hive_metastore",
-        "name": "catalog"
-      },
-      {
-        "default": "prod",
-        "name": "schema"
-      }
-    ],
-    "queue": {
-      "enabled": true
-    },
-    "tasks": [
-      {
-        "notebook_task": {
-          "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/sample_notebook",
-          "source": "WORKSPACE"
-        },
-        "task_key": "notebook_task"
-      },
-      {
-        "depends_on": [
-          {
-            "task_key": "notebook_task"
-          }
-        ],
-        "environment_key": "default",
-        "python_wheel_task": {
-          "entry_point": "main",
-          "package_name": "my_default_python",
-          "parameters": [
-            "--catalog",
-            "hive_metastore",
-            "--schema",
-            "prod"
-          ]
-        },
-        "task_key": "python_wheel_task"
-      },
-      {
-        "depends_on": [
-          {
-            "task_key": "notebook_task"
-          }
-        ],
-        "pipeline_task": {
-          "pipeline_id": "[UUID]"
-        },
-        "task_key": "refresh_pipeline"
-      }
-    ],
-    "trigger": {
-      "pause_status": "UNPAUSED",
-      "periodic": {
-        "interval": 1,
-        "unit": "DAYS"
-      }
-    }
-  }
-}
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/directories/[NUMID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "CAN_MANAGE",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/jobs/[NUMID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
-{
-  "method": "PUT",
-  "path": "/api/2.0/permissions/pipelines/[UUID]",
-  "body": {
-    "access_control_list": [
-      {
-        "permission_level": "IS_OWNER",
-        "user_name": "[USERNAME]"
-      }
-    ]
-  }
-}
diff --git a/acceptance/bundle/templates/default-python/serverless/out.requests.prod.txt b/acceptance/bundle/templates/default-python/serverless/out.requests.prod.txt
new file mode 100644
index 00000000000..98a8721ee74
--- /dev/null
+++ b/acceptance/bundle/templates/default-python/serverless/out.requests.prod.txt
@@ -0,0 +1,219 @@
+{
+  "method": "POST",
+  "path": "/api/2.0/pipelines",
+  "body": {
+    "catalog": "main",
+    "channel": "CURRENT",
+    "deployment": {
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/state/metadata.json"
+    },
+    "edition": "ADVANCED",
+    "environment": {
+      "dependencies": [
+        "--editable /Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files"
+      ]
+    },
+    "libraries": [
+      {
+        "glob": {
+          "include": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python_etl/transformations/**"
+        }
+      }
+    ],
+    "name": "my_default_python_etl",
+    "root_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python_etl",
+    "schema": "prod",
+    "serverless": true
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/delete",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/artifacts/.internal",
+    "recursive": true
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/delete",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/state/deploy.lock"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/artifacts/.internal"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/.vscode"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/fixtures"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/resources"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/my_default_python_etl/transformations"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/tests"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/state"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/create",
+  "body": {
+    "deployment": {
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/state/metadata.json"
+    },
+    "edit_mode": "UI_LOCKED",
+    "environments": [
+      {
+        "environment_key": "default",
+        "spec": {
+          "dependencies": [
+            "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/artifacts/.internal/my_default_python-0.0.1-py3-none-any.whl"
+          ],
+          "environment_version": "5"
+        }
+      }
+    ],
+    "format": "MULTI_TASK",
+    "max_concurrent_runs": 1,
+    "name": "sample_job",
+    "parameters": [
+      {
+        "default": "hive_metastore",
+        "name": "catalog"
+      },
+      {
+        "default": "prod",
+        "name": "schema"
+      }
+    ],
+    "queue": {
+      "enabled": true
+    },
+    "tasks": [
+      {
+        "notebook_task": {
+          "notebook_path": "/Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files/src/sample_notebook"
+        },
+        "task_key": "notebook_task"
+      },
+      {
+        "depends_on": [
+          {
+            "task_key": "notebook_task"
+          }
+        ],
+        "environment_key": "default",
+        "python_wheel_task": {
+          "entry_point": "main",
+          "package_name": "my_default_python",
+          "parameters": [
+            "--catalog",
+            "hive_metastore",
+            "--schema",
+            "prod"
+          ]
+        },
+        "task_key": "python_wheel_task"
+      },
+      {
+        "depends_on": [
+          {
+            "task_key": "notebook_task"
+          }
+        ],
+        "pipeline_task": {
+          "pipeline_id": "[MY_DEFAULT_PYTHON_ETL_ID_2]"
+        },
+        "task_key": "refresh_pipeline"
+      }
+    ],
+    "trigger": {
+      "pause_status": "UNPAUSED",
+      "periodic": {
+        "interval": 1,
+        "unit": "DAYS"
+      }
+    }
+  }
+}
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/directories/[DIRECTORY_ID]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "CAN_MANAGE",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/jobs/[SAMPLE_JOB_ID_2]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "IS_OWNER",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/pipelines/[MY_DEFAULT_PYTHON_ETL_ID_2]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "IS_OWNER",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/templates/default-python/serverless/out.test.toml b/acceptance/bundle/templates/default-python/serverless/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/templates/default-python/serverless/out.test.toml
+++ b/acceptance/bundle/templates/default-python/serverless/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/templates/default-python/serverless/output.txt b/acceptance/bundle/templates/default-python/serverless/output.txt
index 1b8abcf31ff..1a92c10eeeb 100644
--- a/acceptance/bundle/templates/default-python/serverless/output.txt
+++ b/acceptance/bundle/templates/default-python/serverless/output.txt
@@ -54,9 +54,10 @@ Building python_artifact...
 Building python_artifact...
 Uploading dist/my_default_python-0.0.1-py3-none-any.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/my_default_python/dev/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.sample_job
+Created pipelines.my_default_python_etl
+Files: 20 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle plan -t dev
 Building python_artifact...
@@ -69,9 +70,12 @@ Building python_artifact...
 Building python_artifact...
 Uploading dist/my_default_python-0.0.1-py3-none-any.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/my_default_python/prod/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.sample_job
+Created jobs.sample_job.permissions
+Created pipelines.my_default_python_etl
+Created pipelines.my_default_python_etl.permissions
+Files: 20 uploaded, 0 deleted
+Resources: 4 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> [CLI] bundle plan -t prod
 Building python_artifact...
diff --git a/acceptance/bundle/templates/default-python/serverless/output/my_default_python/.vscode/extensions.json b/acceptance/bundle/templates/default-python/serverless/output/my_default_python/.vscode/extensions.json
index 5ba48e79c9b..b958aacfcb4 100644
--- a/acceptance/bundle/templates/default-python/serverless/output/my_default_python/.vscode/extensions.json
+++ b/acceptance/bundle/templates/default-python/serverless/output/my_default_python/.vscode/extensions.json
@@ -1,7 +1,7 @@
 {
     "recommendations": [
+        "charliermarsh.ruff",
         "databricks.databricks",
-        "redhat.vscode-yaml",
-        "charliermarsh.ruff"
+        "redhat.vscode-yaml"
     ]
 }
diff --git a/acceptance/bundle/templates/default-python/serverless/output/my_default_python/AGENTS.md b/acceptance/bundle/templates/default-python/serverless/output/my_default_python/AGENTS.md
new file mode 100644
index 00000000000..fdcca98a432
--- /dev/null
+++ b/acceptance/bundle/templates/default-python/serverless/output/my_default_python/AGENTS.md
@@ -0,0 +1,25 @@
+# Declarative Automation Bundles Project
+
+This project uses Declarative Automation Bundles (DABs) for deployment. Add project-specific instructions below.
+
+## For AI Agents: Use Databricks AI Tools
+
+**BEFORE any other action, read the `databricks-core` skill.**
+
+It sets you up to work with this project reliably: CLI authentication, profile
+selection, data discovery, and the bundle deployment workflow. Without it,
+results are often slower and less accurate.
+
+If this skill is not available (Databricks AI Tools are not installed), you can install them for your coding agent in seconds:
+
+```bash
+databricks aitools install
+```
+
+If the CLI is not installed, see: https://docs.databricks.com/dev-tools/cli/install
+
+---
+
+## Project Instructions
+
+<!-- Add your project-specific instructions, coding conventions, or notes here -->
diff --git a/acceptance/bundle/templates/default-python/serverless/output/my_default_python/databricks.yml b/acceptance/bundle/templates/default-python/serverless/output/my_default_python/databricks.yml
index 2683348b94f..b8ad3140314 100644
--- a/acceptance/bundle/templates/default-python/serverless/output/my_default_python/databricks.yml
+++ b/acceptance/bundle/templates/default-python/serverless/output/my_default_python/databricks.yml
@@ -1,4 +1,4 @@
-# This is a Databricks asset bundle definition for my_default_python.
+# This is a Declarative Automation Bundle definition for my_default_python.
 # See https://docs.databricks.com/dev-tools/bundles/index.html for documentation.
 bundle:
   name: my_default_python
diff --git a/acceptance/bundle/templates/default-python/serverless/output/my_default_python/pyproject.toml b/acceptance/bundle/templates/default-python/serverless/output/my_default_python/pyproject.toml
index 3c4c2062763..e8bb641abd4 100644
--- a/acceptance/bundle/templates/default-python/serverless/output/my_default_python/pyproject.toml
+++ b/acceptance/bundle/templates/default-python/serverless/output/my_default_python/pyproject.toml
@@ -2,7 +2,7 @@
 name = "my_default_python"
 version = "0.0.1"
 authors = [{ name = "[USERNAME]" }]
-requires-python = ">=3.10,<3.13"
+requires-python = ">=3.12,<3.13"
 dependencies = [
     # Any dependencies for jobs and pipelines in this project can be added here
     # See also https://docs.databricks.com/dev-tools/bundles/library-dependencies
@@ -16,7 +16,7 @@ dev = [
     "pytest",
     "ruff",
     "databricks-dlt",
-    "databricks-connect>=15.4,<15.5",
+    "databricks-connect>=16.4,<16.5",
     "ipykernel",
 ]
 
diff --git a/acceptance/bundle/templates/default-python/serverless/output/my_default_python/resources/sample_job.job.yml b/acceptance/bundle/templates/default-python/serverless/output/my_default_python/resources/sample_job.job.yml
index c64690910f4..16716edb640 100644
--- a/acceptance/bundle/templates/default-python/serverless/output/my_default_python/resources/sample_job.job.yml
+++ b/acceptance/bundle/templates/default-python/serverless/output/my_default_python/resources/sample_job.job.yml
@@ -46,7 +46,7 @@ resources:
       environments:
         - environment_key: default
           spec:
-            environment_version: "4"
+            environment_version: "5"
             dependencies:
               # By default we just include the .whl file generated for the my_default_python package.
               # See https://docs.databricks.com/dev-tools/bundles/library-dependencies.html
diff --git a/acceptance/bundle/templates/default-python/serverless/output/my_default_python/src/my_default_python/main.py b/acceptance/bundle/templates/default-python/serverless/output/my_default_python/src/my_default_python/main.py
index 1b1f3803907..a1247306831 100644
--- a/acceptance/bundle/templates/default-python/serverless/output/my_default_python/src/my_default_python/main.py
+++ b/acceptance/bundle/templates/default-python/serverless/output/my_default_python/src/my_default_python/main.py
@@ -13,8 +13,8 @@ def main():
     args = parser.parse_args()
 
     # Set the default catalog and schema
-    spark.sql(f"USE CATALOG {args.catalog}")
-    spark.sql(f"USE SCHEMA {args.schema}")
+    spark.sql(f"USE CATALOG `{args.catalog}`")
+    spark.sql(f"USE SCHEMA `{args.schema}`")
 
     # Example: just find all taxis from a sample catalog
     taxis.find_all_taxis().show(5)
diff --git a/acceptance/bundle/templates/default-python/serverless/output/my_default_python/src/my_default_python_etl/README.md b/acceptance/bundle/templates/default-python/serverless/output/my_default_python/src/my_default_python_etl/README.md
index 17f7212f888..5b41468debe 100644
--- a/acceptance/bundle/templates/default-python/serverless/output/my_default_python/src/my_default_python_etl/README.md
+++ b/acceptance/bundle/templates/default-python/serverless/output/my_default_python/src/my_default_python_etl/README.md
@@ -15,6 +15,6 @@ To get started, go to the `transformations` folder -- most of the relevant sourc
 * Take a look at the sample called "sample_trips_my_default_python.py" to get familiar with the syntax.
   Read more about the syntax at https://docs.databricks.com/dlt/python-ref.html.
 * If you're using the workspace UI, use `Run file` to run and preview a single transformation.
-* If you're using the CLI, use `databricks bundle run my_default_python_etl --select sample_trips_my_default_python` to run a single transformation.
+* If you're using the CLI, use `databricks bundle run my_default_python_etl --refresh sample_trips_my_default_python` to run a single transformation.
 
 For more tutorials and reference material, see https://docs.databricks.com/dlt.
diff --git a/acceptance/bundle/templates/default-python/serverless/output/my_default_python/src/sample_notebook.ipynb b/acceptance/bundle/templates/default-python/serverless/output/my_default_python/src/sample_notebook.ipynb
index d5e4804cb80..ea9c0a8404a 100644
--- a/acceptance/bundle/templates/default-python/serverless/output/my_default_python/src/sample_notebook.ipynb
+++ b/acceptance/bundle/templates/default-python/serverless/output/my_default_python/src/sample_notebook.ipynb
@@ -34,8 +34,8 @@
     "# Set default catalog and schema\n",
     "catalog = dbutils.widgets.get(\"catalog\")\n",
     "schema = dbutils.widgets.get(\"schema\")\n",
-    "spark.sql(f\"USE CATALOG {catalog}\")\n",
-    "spark.sql(f\"USE SCHEMA {schema}\")"
+    "spark.sql(f\"USE CATALOG `{catalog}`\")\n",
+    "spark.sql(f\"USE SCHEMA `{schema}`\")"
    ]
   },
   {
@@ -72,7 +72,7 @@
     "dependencies": [
      "--editable .."
     ],
-    "environment_version": "4"
+    "environment_version": "5"
    },
    "language": "python",
    "notebookMetadata": {
@@ -82,7 +82,7 @@
    "widgets": {
     "catalog": {
      "currentValue": "hive_metastore",
-     "nuid": "c4t4l0g-w1dg-3t12-3456-[NUMID]",
+     "nuid": "c4t4l0g-w1dg-3t12-3456-789012345678",
      "typedWidgetInfo": {
       "autoCreated": false,
       "defaultValue": "hive_metastore",
@@ -108,7 +108,7 @@
     },
     "schema": {
      "currentValue": "[USERNAME]",
-     "nuid": "5ch3m4-w1dg-3t98-7654-[NUMID]",
+     "nuid": "5ch3m4-w1dg-3t98-7654-321098765432",
      "typedWidgetInfo": {
       "autoCreated": false,
       "defaultValue": "default",
diff --git a/acceptance/bundle/templates/default-python/serverless/script b/acceptance/bundle/templates/default-python/serverless/script
index 86272b4a266..a5d2a395976 100644
--- a/acceptance/bundle/templates/default-python/serverless/script
+++ b/acceptance/bundle/templates/default-python/serverless/script
@@ -7,23 +7,25 @@ trace $CLI bundle validate -t prod
 trace $CLI bundle plan -t dev
 trace $CLI bundle plan -t prod
 
-$CLI bundle plan -o json -t dev > ../../out.plan_dev.$DATABRICKS_BUNDLE_ENGINE.json
-$CLI bundle plan -o json -t prod > ../../out.plan_prod.$DATABRICKS_BUNDLE_ENGINE.json
+$CLI bundle plan -o json -t dev | nostamp > ../../out.plan_dev.json
+$CLI bundle plan -o json -t prod | nostamp > ../../out.plan_prod.json
 
-rm ../../out.requests.txt
+rm "$OUT_REQUESTS"
 trace $CLI bundle deploy -t dev
-print_requests.py --sort '^//import-file/' '^//telemetry-ext' > ../../out.requests.dev.$DATABRICKS_BUNDLE_ENGINE.txt
+replace_ids.py -t dev
+print_requests.py --sort '^//workspace/import' '^//telemetry-ext' > ../../out.requests.dev.txt
 trace $CLI bundle plan -t dev  # check if if there is drift
-trace $CLI bundle plan -t dev -o json > ../../out.plan_after_deploy_dev.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -t dev -o json | nostamp > ../../out.plan_after_deploy_dev.json
 
 trace $CLI bundle deploy -t prod
-print_requests.py --sort '^//import-file/' '^//telemetry-ext' > ../../out.requests.prod.$DATABRICKS_BUNDLE_ENGINE.txt
+replace_ids.py -t prod
+print_requests.py --sort '^//workspace/import' '^//telemetry-ext' > ../../out.requests.prod.txt
 trace $CLI bundle plan -t prod  # check if there is drift
-trace $CLI bundle plan -t prod -o json > ../../out.plan_after_deploy_prod.$DATABRICKS_BUNDLE_ENGINE.json
+trace $CLI bundle plan -t prod -o json | nostamp > ../../out.plan_after_deploy_prod.json
 
 # Do not affect this repository's git behaviour #2318
 mv .gitignore out.gitignore
 rm -fr .databricks dist
 
 cd ../../
-rm out.requests.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/templates/default-python/serverless/test.toml b/acceptance/bundle/templates/default-python/serverless/test.toml
index 159efe02696..2d59bea68ed 100644
--- a/acceptance/bundle/templates/default-python/serverless/test.toml
+++ b/acceptance/bundle/templates/default-python/serverless/test.toml
@@ -1 +1,5 @@
 RecordRequests = true
+
+[[Repls]]
+Old = '/permissions/directories/\d+'
+New = '/permissions/directories/[DIRECTORY_ID]'
diff --git a/acceptance/bundle/templates/default-scala-classic/input.json b/acceptance/bundle/templates/default-scala-classic/input.json
new file mode 100644
index 00000000000..c728d78f632
--- /dev/null
+++ b/acceptance/bundle/templates/default-scala-classic/input.json
@@ -0,0 +1,7 @@
+{
+    "project_name": "my_default_scala",
+    "compute_type": "standard cluster",
+    "artifacts_dest_path": "/Volumes/test-folder",
+    "default_catalog": "main",
+    "personal_schemas": "yes"
+}
diff --git a/acceptance/bundle/templates/default-scala-classic/out.test.toml b/acceptance/bundle/templates/default-scala-classic/out.test.toml
new file mode 100644
index 00000000000..bbd44e1b741
--- /dev/null
+++ b/acceptance/bundle/templates/default-scala-classic/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+Phase = 1
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/templates/default-scala-classic/output.txt b/acceptance/bundle/templates/default-scala-classic/output.txt
new file mode 100644
index 00000000000..6ceb22ee71b
--- /dev/null
+++ b/acceptance/bundle/templates/default-scala-classic/output.txt
@@ -0,0 +1,53 @@
+
+>>> [CLI] bundle init default-scala --config-file ./input.json --output-dir actual
+
+Welcome to the default-scala template for Declarative Automation Bundles!
+
+A workspace was selected based on your current profile. For information about how to change this, see https://docs.databricks.com/dev-tools/cli/profiles.html.
+workspace_host: [DATABRICKS_URL]
+
+✨ Your new project has been created in the 'my_default_scala' directory!
+
+Please refer to the README.md file for "getting started" instructions.
+See also the documentation at https://docs.databricks.com/dev-tools/bundles/index.html.
+
+>>> diff.py [TESTROOT]/bundle/templates/default-scala-classic/../default-scala/output actual
+--- [TESTROOT]/bundle/templates/default-scala-classic/../default-scala/output/my_default_scala/README.md
++++ actual/my_default_scala/README.md
+@@ -91,3 +91,7 @@
+
+ ### Job configuration
+-This project uses serverless compute. No cluster setup is required.
++This project uses standard compute for the job cluster. Standard compute requires Unity Catalog volume JAR paths to be allowlisted by your workspace admin.
++
++If you want to use an existing cluster instead, replace `job_cluster_key` in the task configuration with `existing_cluster_id: <your_cluster_id>` in the job YAML file.
++
++You can also customize the cluster configuration (node type, worker count, Spark version) in the `job_clusters` section of the job YAML file.
+--- [TESTROOT]/bundle/templates/default-scala-classic/../default-scala/output/my_default_scala/resources/my_default_scala.job.yml
++++ actual/my_default_scala/resources/my_default_scala.job.yml
+@@ -12,4 +12,5 @@
+       tasks:
+         - task_key: main_task
++          job_cluster_key: job_cluster
+           spark_jar_task:
+             main_class_name: com.examples.Main
+@@ -19,9 +20,12 @@
+               - "--schema"
+               - "{{job.parameters.schema}}"
+-          environment_key: default
+-      environments:
+-        - environment_key: default
+-          spec:
+-            environment_version: "5"
+-            java_dependencies:
+-              - ${workspace.artifact_path}/.internal/my_default_scala-assembly-0.1.jar
++          libraries:
++            - jar: ${workspace.artifact_path}/.internal/my_default_scala-assembly-0.1.jar
++      job_clusters:
++        - job_cluster_key: job_cluster
++          new_cluster:
++            spark_version: 17.3.x-scala2.13
++            node_type_id: [NODE_TYPE_ID]
++            autoscale:
++              min_workers: 1
++              max_workers: 4
diff --git a/acceptance/bundle/templates/default-scala-classic/script b/acceptance/bundle/templates/default-scala-classic/script
new file mode 100644
index 00000000000..bd78b5eda8d
--- /dev/null
+++ b/acceptance/bundle/templates/default-scala-classic/script
@@ -0,0 +1,6 @@
+# With standard cluster compute, default-scala renders classic-cluster job and
+# README content instead of their serverless variants. Compare the complete output
+# without committing a duplicate golden tree.
+trace $CLI bundle init default-scala --config-file ./input.json --output-dir actual
+mv actual/my_default_scala/.gitignore actual/my_default_scala/out.gitignore
+trace diff.py $TESTDIR/../default-scala/output actual
diff --git a/acceptance/bundle/templates/default-scala-classic/test.toml b/acceptance/bundle/templates/default-scala-classic/test.toml
new file mode 100644
index 00000000000..3a2b664868a
--- /dev/null
+++ b/acceptance/bundle/templates/default-scala-classic/test.toml
@@ -0,0 +1,4 @@
+# This test reads the sibling default-scala test's committed golden via $TESTDIR, so it
+# must run in phase 1 (after phase 0 regenerates that golden in update mode).
+Phase = 1
+Ignore = ["actual"]
diff --git a/acceptance/bundle/templates/default-scala/out.test.toml b/acceptance/bundle/templates/default-scala/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/templates/default-scala/out.test.toml
+++ b/acceptance/bundle/templates/default-scala/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/templates/default-scala/output/my_default_scala/AGENTS.md b/acceptance/bundle/templates/default-scala/output/my_default_scala/AGENTS.md
new file mode 100644
index 00000000000..fdcca98a432
--- /dev/null
+++ b/acceptance/bundle/templates/default-scala/output/my_default_scala/AGENTS.md
@@ -0,0 +1,25 @@
+# Declarative Automation Bundles Project
+
+This project uses Declarative Automation Bundles (DABs) for deployment. Add project-specific instructions below.
+
+## For AI Agents: Use Databricks AI Tools
+
+**BEFORE any other action, read the `databricks-core` skill.**
+
+It sets you up to work with this project reliably: CLI authentication, profile
+selection, data discovery, and the bundle deployment workflow. Without it,
+results are often slower and less accurate.
+
+If this skill is not available (Databricks AI Tools are not installed), you can install them for your coding agent in seconds:
+
+```bash
+databricks aitools install
+```
+
+If the CLI is not installed, see: https://docs.databricks.com/dev-tools/cli/install
+
+---
+
+## Project Instructions
+
+<!-- Add your project-specific instructions, coding conventions, or notes here -->
diff --git a/acceptance/bundle/templates/default-scala/output/my_default_scala/build.sbt b/acceptance/bundle/templates/default-scala/output/my_default_scala/build.sbt
index 7d4a7215439..7adfb0ba1b1 100644
--- a/acceptance/bundle/templates/default-scala/output/my_default_scala/build.sbt
+++ b/acceptance/bundle/templates/default-scala/output/my_default_scala/build.sbt
@@ -6,7 +6,7 @@ name := "my_default_scala"
 organization := "com.examples"
 version := "0.1"
 
-libraryDependencies += "com.databricks" %% "databricks-connect" % "17.0.+"
+libraryDependencies += "com.databricks" %% "databricks-connect" % "17.3.+"
 libraryDependencies += "org.slf4j" % "slf4j-simple" % "2.0.16"
 
 libraryDependencies += "org.scalatest" %% "scalatest" % "3.2.19" % Test
diff --git a/acceptance/bundle/templates/default-scala/output/my_default_scala/databricks.yml b/acceptance/bundle/templates/default-scala/output/my_default_scala/databricks.yml
index fa88835b65a..9c979f25424 100644
--- a/acceptance/bundle/templates/default-scala/output/my_default_scala/databricks.yml
+++ b/acceptance/bundle/templates/default-scala/output/my_default_scala/databricks.yml
@@ -1,4 +1,4 @@
-# This is a Databricks asset bundle definition for my_default_scala.
+# This is a Declarative Automation Bundle definition for my_default_scala.
 # See https://docs.databricks.com/dev-tools/bundles/index.html for documentation.
 bundle:
   name: my_default_scala
diff --git a/acceptance/bundle/templates/default-scala/output/my_default_scala/resources/my_default_scala.job.yml b/acceptance/bundle/templates/default-scala/output/my_default_scala/resources/my_default_scala.job.yml
index 3e40cd1629c..97d9e9bbbd4 100644
--- a/acceptance/bundle/templates/default-scala/output/my_default_scala/resources/my_default_scala.job.yml
+++ b/acceptance/bundle/templates/default-scala/output/my_default_scala/resources/my_default_scala.job.yml
@@ -22,6 +22,6 @@ resources:
       environments:
         - environment_key: default
           spec:
-            environment_version: "4-scala-preview"
+            environment_version: "5"
             java_dependencies:
               - ${workspace.artifact_path}/.internal/my_default_scala-assembly-0.1.jar
diff --git a/acceptance/bundle/templates/default-scala/output/my_default_scala/src/main/scala/com/examples/Main.scala b/acceptance/bundle/templates/default-scala/output/my_default_scala/src/main/scala/com/examples/Main.scala
index a0068937c55..e1433db22b1 100644
--- a/acceptance/bundle/templates/default-scala/output/my_default_scala/src/main/scala/com/examples/Main.scala
+++ b/acceptance/bundle/templates/default-scala/output/my_default_scala/src/main/scala/com/examples/Main.scala
@@ -21,12 +21,12 @@ object Main {
 
   private def setCatalogAndSchema(spark: SparkSession, args: Array[String]): Unit = {
     getFromArgs(args, "catalog").foreach { catalog =>
-      spark.sql(s"USE CATALOG $catalog")
+      spark.sql(s"USE CATALOG `$catalog`")
       println(s"Using catalog: $catalog")
     }
 
     getFromArgs(args, "schema").foreach { schema =>
-      spark.sql(s"USE SCHEMA $schema")
+      spark.sql(s"USE SCHEMA `$schema`")
       println(s"Using schema: $schema")
     }
   }
diff --git a/acceptance/bundle/templates/default-sql-catalog-dash/input-invalid-catalog.json b/acceptance/bundle/templates/default-sql-catalog-dash/input-invalid-catalog.json
new file mode 100644
index 00000000000..e34d8b952c7
--- /dev/null
+++ b/acceptance/bundle/templates/default-sql-catalog-dash/input-invalid-catalog.json
@@ -0,0 +1,6 @@
+{
+    "project_name": "my_default_sql",
+    "http_path": "/sql/2.0/warehouses/f00dcafe",
+    "default_catalog": "-bad",
+    "personal_schemas": "yes"
+}
diff --git a/acceptance/bundle/templates/default-sql-catalog-dash/input-invalid-schema.json b/acceptance/bundle/templates/default-sql-catalog-dash/input-invalid-schema.json
new file mode 100644
index 00000000000..9a263f72c66
--- /dev/null
+++ b/acceptance/bundle/templates/default-sql-catalog-dash/input-invalid-schema.json
@@ -0,0 +1,7 @@
+{
+    "project_name": "my_default_sql",
+    "http_path": "/sql/2.0/warehouses/f00dcafe",
+    "default_catalog": "main",
+    "personal_schemas": "no, I will customize the schema configuration later in databricks.yml",
+    "shared_schema": "-bad"
+}
diff --git a/acceptance/bundle/templates/default-sql-catalog-dash/input.json b/acceptance/bundle/templates/default-sql-catalog-dash/input.json
new file mode 100644
index 00000000000..e5e49627cf2
--- /dev/null
+++ b/acceptance/bundle/templates/default-sql-catalog-dash/input.json
@@ -0,0 +1,7 @@
+{
+    "project_name": "my_default_sql",
+    "http_path": "/sql/2.0/warehouses/f00dcafe",
+    "default_catalog": "my-catalog",
+    "personal_schemas": "no, I will customize the schema configuration later in databricks.yml",
+    "shared_schema": "my-schema"
+}
diff --git a/acceptance/bundle/templates/default-sql-catalog-dash/out.test.toml b/acceptance/bundle/templates/default-sql-catalog-dash/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/templates/default-sql-catalog-dash/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/templates/default-sql-catalog-dash/output.txt b/acceptance/bundle/templates/default-sql-catalog-dash/output.txt
new file mode 100644
index 00000000000..23a18c5d02c
--- /dev/null
+++ b/acceptance/bundle/templates/default-sql-catalog-dash/output.txt
@@ -0,0 +1,36 @@
+
+>>> [CLI] bundle init default-sql --config-file ./input.json --output-dir output
+
+Welcome to the default SQL template for Declarative Automation Bundles!
+
+A workspace was selected based on your current profile. For information about how to change this, see https://docs.databricks.com/dev-tools/cli/profiles.html.
+workspace_host: [DATABRICKS_URL]
+
+✨ Your new project has been created in the 'my_default_sql' directory!
+
+Please refer to the README.md file for "getting started" instructions.
+See also the documentation at https://docs.databricks.com/dev-tools/bundles/index.html.
+
+>>> diff.py [TESTROOT]/bundle/templates/default-sql-catalog-dash/../default-sql/output/my_default_sql/databricks.yml output/my_default_sql/databricks.yml
+--- [TESTROOT]/bundle/templates/default-sql-catalog-dash/../default-sql/output/my_default_sql/databricks.yml
++++ output/my_default_sql/databricks.yml
+@@ -29,6 +29,6 @@
+     variables:
+       warehouse_id: f00dcafe
+-      catalog: main
+-      schema: ${workspace.current_user.short_name}
++      catalog: my-catalog
++      schema: my-schema
+
+   prod:
+@@ -40,6 +40,6 @@
+     variables:
+       warehouse_id: f00dcafe
+-      catalog: main
+-      schema: default
++      catalog: my-catalog
++      schema: my-schema
+     permissions:
+       - user_name: [USERNAME]
+Error: failed to load config from file ./input-invalid-catalog.json: invalid value for default_catalog: "-bad". Invalid catalog name.
+Error: failed to load config from file ./input-invalid-schema.json: invalid value for shared_schema: "-bad". Invalid schema name.
diff --git a/acceptance/bundle/templates/default-sql-catalog-dash/script b/acceptance/bundle/templates/default-sql-catalog-dash/script
new file mode 100644
index 00000000000..68377267e22
--- /dev/null
+++ b/acceptance/bundle/templates/default-sql-catalog-dash/script
@@ -0,0 +1,11 @@
+# Unity Catalog catalog and schema names may contain dashes. Verify that bundle
+# init accepts them and writes them into databricks.yml. The generated SQL
+# escapes these names with IDENTIFIER() (see default-sql/output/.../src/*.sql).
+trace $CLI bundle init default-sql --config-file ./input.json --output-dir output
+trace diff.py $TESTDIR/../default-sql/output/my_default_sql/databricks.yml output/my_default_sql/databricks.yml
+rm -fr output
+
+# Names that violate the Unity Catalog naming rules are rejected at init time.
+musterr $CLI bundle init default-sql --config-file ./input-invalid-catalog.json --output-dir output
+musterr $CLI bundle init default-sql --config-file ./input-invalid-schema.json --output-dir output
+rm -fr output
diff --git a/acceptance/bundle/templates/default-sql/out.test.toml b/acceptance/bundle/templates/default-sql/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/templates/default-sql/out.test.toml
+++ b/acceptance/bundle/templates/default-sql/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/templates/default-sql/output/my_default_sql/AGENTS.md b/acceptance/bundle/templates/default-sql/output/my_default_sql/AGENTS.md
new file mode 100644
index 00000000000..fdcca98a432
--- /dev/null
+++ b/acceptance/bundle/templates/default-sql/output/my_default_sql/AGENTS.md
@@ -0,0 +1,25 @@
+# Declarative Automation Bundles Project
+
+This project uses Declarative Automation Bundles (DABs) for deployment. Add project-specific instructions below.
+
+## For AI Agents: Use Databricks AI Tools
+
+**BEFORE any other action, read the `databricks-core` skill.**
+
+It sets you up to work with this project reliably: CLI authentication, profile
+selection, data discovery, and the bundle deployment workflow. Without it,
+results are often slower and less accurate.
+
+If this skill is not available (Databricks AI Tools are not installed), you can install them for your coding agent in seconds:
+
+```bash
+databricks aitools install
+```
+
+If the CLI is not installed, see: https://docs.databricks.com/dev-tools/cli/install
+
+---
+
+## Project Instructions
+
+<!-- Add your project-specific instructions, coding conventions, or notes here -->
diff --git a/acceptance/bundle/templates/default-sql/output/my_default_sql/databricks.yml b/acceptance/bundle/templates/default-sql/output/my_default_sql/databricks.yml
index 07562ce7ad1..965975a424a 100644
--- a/acceptance/bundle/templates/default-sql/output/my_default_sql/databricks.yml
+++ b/acceptance/bundle/templates/default-sql/output/my_default_sql/databricks.yml
@@ -1,4 +1,4 @@
-# This is a Databricks asset bundle definition for my_default_sql.
+# This is a Declarative Automation Bundle definition for my_default_sql.
 # See https://docs.databricks.com/dev-tools/bundles/index.html for documentation.
 bundle:
   name: my_default_sql
diff --git a/acceptance/bundle/templates/default-sql/output/my_default_sql/src/orders_daily.sql b/acceptance/bundle/templates/default-sql/output/my_default_sql/src/orders_daily.sql
index 27bf1eed460..2e1a1868325 100644
--- a/acceptance/bundle/templates/default-sql/output/my_default_sql/src/orders_daily.sql
+++ b/acceptance/bundle/templates/default-sql/output/my_default_sql/src/orders_daily.sql
@@ -1,6 +1,6 @@
 -- This query is executed using Databricks Jobs (see resources/my_default_sql_sql.job.yml)
 
-USE CATALOG {{catalog}};
+USE CATALOG `{{catalog}}`;
 USE IDENTIFIER({{schema}});
 
 CREATE OR REPLACE MATERIALIZED VIEW
diff --git a/acceptance/bundle/templates/default-sql/output/my_default_sql/src/orders_raw.sql b/acceptance/bundle/templates/default-sql/output/my_default_sql/src/orders_raw.sql
index d0d1afa6604..457d051df0d 100644
--- a/acceptance/bundle/templates/default-sql/output/my_default_sql/src/orders_raw.sql
+++ b/acceptance/bundle/templates/default-sql/output/my_default_sql/src/orders_raw.sql
@@ -3,7 +3,7 @@
 -- The streaming table below ingests all JSON files in /databricks-datasets/retail-org/sales_orders/
 -- See also https://docs.databricks.com/sql/language-manual/sql-ref-syntax-ddl-create-streaming-table.html
 
-USE CATALOG {{catalog}};
+USE CATALOG `{{catalog}}`;
 USE IDENTIFIER({{schema}});
 
 CREATE OR REFRESH STREAMING TABLE
diff --git a/acceptance/bundle/templates/deployment-history/input.dbt-sql.json b/acceptance/bundle/templates/deployment-history/input.dbt-sql.json
new file mode 100644
index 00000000000..8a0fef4dcd4
--- /dev/null
+++ b/acceptance/bundle/templates/deployment-history/input.dbt-sql.json
@@ -0,0 +1,3 @@
+{
+    "project_name": "my_dbt_sql"
+}
diff --git a/acceptance/bundle/templates/deployment-history/input.default-python.json b/acceptance/bundle/templates/deployment-history/input.default-python.json
new file mode 100644
index 00000000000..697fc31dd1b
--- /dev/null
+++ b/acceptance/bundle/templates/deployment-history/input.default-python.json
@@ -0,0 +1,3 @@
+{
+    "project_name": "my_default_python"
+}
diff --git a/acceptance/bundle/templates/deployment-history/input.default-scala.json b/acceptance/bundle/templates/deployment-history/input.default-scala.json
new file mode 100644
index 00000000000..f35206cac89
--- /dev/null
+++ b/acceptance/bundle/templates/deployment-history/input.default-scala.json
@@ -0,0 +1,4 @@
+{
+    "project_name": "my_default_scala",
+    "artifacts_dest_path": "/Volumes/test-folder"
+}
diff --git a/acceptance/bundle/templates/deployment-history/input.default-sql.json b/acceptance/bundle/templates/deployment-history/input.default-sql.json
new file mode 100644
index 00000000000..5bb0b317d93
--- /dev/null
+++ b/acceptance/bundle/templates/deployment-history/input.default-sql.json
@@ -0,0 +1,3 @@
+{
+    "project_name": "my_default_sql"
+}
diff --git a/acceptance/bundle/templates/deployment-history/input.lakeflow-integrations.json b/acceptance/bundle/templates/deployment-history/input.lakeflow-integrations.json
new file mode 100644
index 00000000000..f88b7d45310
--- /dev/null
+++ b/acceptance/bundle/templates/deployment-history/input.lakeflow-integrations.json
@@ -0,0 +1,3 @@
+{
+    "project_name": "my_lakeflow_integrations"
+}
diff --git a/acceptance/bundle/templates/deployment-history/out.default-python.databricks.yml b/acceptance/bundle/templates/deployment-history/out.default-python.databricks.yml
new file mode 100644
index 00000000000..1de7c602976
--- /dev/null
+++ b/acceptance/bundle/templates/deployment-history/out.default-python.databricks.yml
@@ -0,0 +1,49 @@
+# This is a Declarative Automation Bundle definition for my_default_python.
+# See https://docs.databricks.com/dev-tools/bundles/index.html for documentation.
+bundle:
+  name: my_default_python
+  uuid: [BUNDLE_UUID]
+
+experimental:
+  deployment_history: true
+
+include:
+  - resources/*.yml
+
+artifacts:
+  python_artifact:
+    type: whl
+    build: uv build --wheel
+
+# Variable declarations. These variables are assigned in the dev/prod targets below.
+variables:
+  catalog:
+    description: The catalog to use
+  schema:
+    description: The schema to use
+
+targets:
+  dev:
+    # The default target uses 'mode: development' to create a development copy.
+    # - Deployed resources get prefixed with '[dev my_user_name]'
+    # - Any job schedules and triggers are paused by default.
+    # See also https://docs.databricks.com/dev-tools/bundles/deployment-modes.html.
+    mode: development
+    default: true
+    workspace:
+      host: [DATABRICKS_URL]
+    variables:
+      catalog: hive_metastore
+      schema: ${workspace.current_user.short_name}
+  prod:
+    mode: production
+    workspace:
+      host: [DATABRICKS_URL]
+      # We explicitly deploy to /Workspace/Users/[USERNAME] to make sure we only have a single copy.
+      root_path: /Workspace/Users/[USERNAME]/.bundle/${bundle.name}/${bundle.target}
+    variables:
+      catalog: hive_metastore
+      schema: prod
+    permissions:
+      - user_name: [USERNAME]
+        level: CAN_MANAGE
diff --git a/acceptance/bundle/templates/deployment-history/out.test.toml b/acceptance/bundle/templates/deployment-history/out.test.toml
new file mode 100644
index 00000000000..88e6fbd847c
--- /dev/null
+++ b/acceptance/bundle/templates/deployment-history/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["true"]
diff --git a/acceptance/bundle/templates/deployment-history/output.txt b/acceptance/bundle/templates/deployment-history/output.txt
new file mode 100644
index 00000000000..a6f06bdcb77
--- /dev/null
+++ b/acceptance/bundle/templates/deployment-history/output.txt
@@ -0,0 +1,70 @@
+Welcome to the default Python template for Declarative Automation Bundles!
+
+Answer the following questions to customize your project.
+You can always change your configuration in the databricks.yml file later.
+
+Note that [DATABRICKS_URL] is used for initialization.
+(For information on how to change your profile, see https://docs.databricks.com/dev-tools/cli/profiles.html.)
+
+✨ Your new project has been created in the 'my_default_python' directory!
+
+To get started, refer to the project README.md file and the documentation at https://docs.databricks.com/dev-tools/bundles/index.html.
+
+>>> grep -A1 ^experimental: output/default-python/my_default_python/databricks.yml
+experimental:
+  deployment_history: true
+
+Welcome to the default SQL template for Declarative Automation Bundles!
+
+A workspace was selected based on your current profile. For information about how to change this, see https://docs.databricks.com/dev-tools/cli/profiles.html.
+workspace_host: [DATABRICKS_URL]
+
+✨ Your new project has been created in the 'my_default_sql' directory!
+
+Please refer to the README.md file for "getting started" instructions.
+See also the documentation at https://docs.databricks.com/dev-tools/bundles/index.html.
+
+>>> grep -A1 ^experimental: output/default-sql/my_default_sql/databricks.yml
+experimental:
+  deployment_history: true
+
+Welcome to the default-scala template for Declarative Automation Bundles!
+
+A workspace was selected based on your current profile. For information about how to change this, see https://docs.databricks.com/dev-tools/cli/profiles.html.
+workspace_host: [DATABRICKS_URL]
+
+✨ Your new project has been created in the 'my_default_scala' directory!
+
+Please refer to the README.md file for "getting started" instructions.
+See also the documentation at https://docs.databricks.com/dev-tools/bundles/index.html.
+
+>>> grep -A1 ^experimental: output/default-scala/my_default_scala/databricks.yml
+experimental:
+  deployment_history: true
+
+Welcome to the dbt template for Declarative Automation Bundles!
+
+A workspace was selected based on your current profile. For information about how to change this, see https://docs.databricks.com/dev-tools/cli/profiles.html.
+workspace_host: [DATABRICKS_URL]
+
+📊 Your new project has been created in the 'my_dbt_sql' directory!
+If you already have dbt installed, just type 'cd my_dbt_sql; dbt init' to get started.
+Refer to the README.md file for full "getting started" guide and production setup instructions.
+
+
+>>> grep -A1 ^experimental: output/dbt-sql/my_dbt_sql/databricks.yml
+experimental:
+  deployment_history: true
+Welcome to the Lakeflow integrations template!
+
+
+✨ Your new project has been created in the 'my_lakeflow_integrations' directory!
+
+Please refer to the README.md file for "getting started" instructions.
+
+>>> grep -A1 ^experimental: output/lakeflow-integrations/my_lakeflow_integrations/databricks.yml
+experimental:
+  deployment_history: true
+
+>>> [CLI] bundle validate -o json
+json.experimental.deployment_history = true;
diff --git a/acceptance/bundle/templates/deployment-history/script b/acceptance/bundle/templates/deployment-history/script
new file mode 100644
index 00000000000..6a5762952ff
--- /dev/null
+++ b/acceptance/bundle/templates/deployment-history/script
@@ -0,0 +1,17 @@
+# The env var in test.toml opts every built-in template into recording deployment history.
+
+# Leaving the generated projects behind would add their .gitignore files to this repo, see #2318.
+trap 'rm -rf output' EXIT
+
+for template in default-python default-sql default-scala dbt-sql lakeflow-integrations; do
+    $CLI bundle init "$template" --config-file "input.$template.json" --output-dir "output/$template"
+    trace grep -A1 '^experimental:' output/$template/*/databricks.yml
+done
+
+# Check that a generated project still loads and keeps the field through validation.
+# This applies to the field rather than to the layout, so one template is enough.
+(cd output/default-python/my_default_python && trace $CLI bundle validate -o json | gron.py | grep experimental)
+
+# Keep one file in full to assert where the stanza lands in the document.
+mv output/default-python/my_default_python/databricks.yml out.default-python.databricks.yml
+add_repl "$(grep -o 'uuid: .*' out.default-python.databricks.yml | cut -d ' ' -f2)" BUNDLE_UUID
diff --git a/acceptance/bundle/templates/deployment-history/test.toml b/acceptance/bundle/templates/deployment-history/test.toml
new file mode 100644
index 00000000000..62ba92d2b61
--- /dev/null
+++ b/acceptance/bundle/templates/deployment-history/test.toml
@@ -0,0 +1,5 @@
+Env.DATABRICKS_BUNDLE_INIT_DEPLOYMENT_HISTORY = "true"
+
+# What is under test is what `bundle init` writes, so one engine is enough.
+
+EnvMatrix.DMS = ["true"]
diff --git a/acceptance/bundle/templates/lakeflow-integrations/input.json b/acceptance/bundle/templates/lakeflow-integrations/input.json
new file mode 100644
index 00000000000..f88b7d45310
--- /dev/null
+++ b/acceptance/bundle/templates/lakeflow-integrations/input.json
@@ -0,0 +1,3 @@
+{
+    "project_name": "my_lakeflow_integrations"
+}
diff --git a/acceptance/bundle/templates/lakeflow-integrations/out.test.toml b/acceptance/bundle/templates/lakeflow-integrations/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/templates/lakeflow-integrations/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/templates/lakeflow-integrations/output.txt b/acceptance/bundle/templates/lakeflow-integrations/output.txt
new file mode 100644
index 00000000000..2a4e773c907
--- /dev/null
+++ b/acceptance/bundle/templates/lakeflow-integrations/output.txt
@@ -0,0 +1,40 @@
+
+>>> [CLI] bundle init lakeflow-integrations --config-file ./input.json --output-dir output
+Welcome to the Lakeflow integrations template!
+
+
+✨ Your new project has been created in the 'my_lakeflow_integrations' directory!
+
+Please refer to the README.md file for "getting started" instructions.
+
+>>> [CLI] bundle validate -t dev
+Name: my_lakeflow_integrations
+Target: dev
+Workspace:
+  Host: [DATABRICKS_URL]
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/my_lakeflow_integrations/dev
+
+Validation OK!
+
+>>> [CLI] bundle validate -t prod
+Name: my_lakeflow_integrations
+Target: prod
+Workspace:
+  Host: [DATABRICKS_URL]
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/my_lakeflow_integrations/prod
+
+Validation OK!
+
+>>> [CLI] bundle deploy -t dev
+Building lakeflow_integrations_yaml...
+Building python_artifact...
+Uploading __generated__/my_lakeflow_integrations.examples.slack.send_slack_message.yml...
+Uploading __generated__/my_lakeflow_integrations.examples.wait_for_run_sensor.WaitForRunSensor.yml...
+Uploading dist/my_lakeflow_integrations-0.0.1-py3-none-any.whl...
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/my_lakeflow_integrations/dev/files...
+Created jobs.send_slack_message
+Created jobs.wait_for_run_sensor
+Files: 11 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
diff --git a/acceptance/bundle/templates/lakeflow-integrations/output/my_lakeflow_integrations/README.md b/acceptance/bundle/templates/lakeflow-integrations/output/my_lakeflow_integrations/README.md
new file mode 100644
index 00000000000..671ad41f535
--- /dev/null
+++ b/acceptance/bundle/templates/lakeflow-integrations/output/my_lakeflow_integrations/README.md
@@ -0,0 +1,24 @@
+# my_lakeflow_integrations
+
+A Declarative Automation Bundles project that extends Lakeflow Jobs with custom integrations.
+
+This bundle ships with runnable examples under `src/my_lakeflow_integrations/examples/` and
+corresponding job definitions under `resources/`:
+
+| Example | Type | What it does |
+| --- | --- | --- |
+| `slack.send_slack_message` | Function | Posts a message to Slack through a Unity Catalog connection. |
+| `wait_for_run_sensor.WaitForRunSensor` | Sensor | Polls a job run until it reaches a terminal state. |
+
+## Getting started
+
+1. Open this bundle in a Databricks workspace.
+2. Click the **deployments rocket** 🚀 in the left sidebar to open the
+   **Deployments** panel, then click **Deploy**.
+3. To run a deployed job, hover over the resource in the **Deployments** panel
+   and click **Run**.
+
+## Documentation
+
+* [Declarative Automation Bundles](https://docs.databricks.com/aws/en/dev-tools/bundles/workspace-bundles)
+* [Declarative Automation Bundles configuration reference](https://docs.databricks.com/aws/en/dev-tools/bundles/reference)
diff --git a/acceptance/bundle/templates/lakeflow-integrations/output/my_lakeflow_integrations/databricks.yml b/acceptance/bundle/templates/lakeflow-integrations/output/my_lakeflow_integrations/databricks.yml
new file mode 100644
index 00000000000..02aa0c5ad78
--- /dev/null
+++ b/acceptance/bundle/templates/lakeflow-integrations/output/my_lakeflow_integrations/databricks.yml
@@ -0,0 +1,49 @@
+# This is a Declarative Automation Bundle definition for my_lakeflow_integrations.
+# See https://docs.databricks.com/dev-tools/bundles/index.html for documentation.
+bundle:
+  name: my_lakeflow_integrations
+  uuid: [UUID]
+  engine: direct
+
+include:
+  - resources/*.yml
+
+artifacts:
+  python_artifact:
+    type: whl
+    build: uv build --wheel
+  lakeflow_integrations_yaml:
+    # inlined Python so the build is portable across Linux/Mac/Windows
+    build: >
+      uv run python -c "import shutil;
+      shutil.rmtree('__generated__', ignore_errors=True);
+      from databricks.lakeflow.integrations.generator.generate import main;
+      main([
+        '--package-module', 'my_lakeflow_integrations',
+        '--output-dir', '__generated__',
+        '--environment-version', '5',
+        '--environment-key', 'my_lakeflow_integrations_environment',
+        '--dependency', '${workspace.artifact_path}/.internal/my_lakeflow_integrations-0.0.1-py3-none-any.whl',
+      ])"
+    files:
+      - {"source": "__generated__/*.yml",}
+
+targets:
+  dev:
+    # The default target uses 'mode: development' to create a development copy.
+    # - Deployed resources get prefixed with '[dev my_user_name]'
+    # - Any job schedules and triggers are paused by default.
+    # See also https://docs.databricks.com/dev-tools/bundles/deployment-modes.html.
+    mode: development
+    default: true
+    workspace:
+      host: [DATABRICKS_URL]
+  prod:
+    mode: production
+    workspace:
+      host: [DATABRICKS_URL]
+      # We explicitly deploy to /Workspace/Users/[USERNAME] to make sure we only have a single copy.
+      root_path: /Workspace/Users/[USERNAME]/.bundle/${bundle.name}/${bundle.target}
+    permissions:
+      - user_name: [USERNAME]
+        level: CAN_MANAGE
diff --git a/acceptance/bundle/templates/lakeflow-integrations/output/my_lakeflow_integrations/out.gitignore b/acceptance/bundle/templates/lakeflow-integrations/output/my_lakeflow_integrations/out.gitignore
new file mode 100644
index 00000000000..4a0b67f112d
--- /dev/null
+++ b/acceptance/bundle/templates/lakeflow-integrations/output/my_lakeflow_integrations/out.gitignore
@@ -0,0 +1,7 @@
+.databricks/
+build/
+dist/
+__pycache__/
+*.egg-info
+.venv/
+__generated__/
diff --git a/acceptance/bundle/templates/lakeflow-integrations/output/my_lakeflow_integrations/pyproject.toml b/acceptance/bundle/templates/lakeflow-integrations/output/my_lakeflow_integrations/pyproject.toml
new file mode 100644
index 00000000000..ad46ab6ebd4
--- /dev/null
+++ b/acceptance/bundle/templates/lakeflow-integrations/output/my_lakeflow_integrations/pyproject.toml
@@ -0,0 +1,29 @@
+[project]
+name = "my_lakeflow_integrations"
+version = "0.0.1"
+authors = []
+requires-python = ">=3.12,<3.13"
+dependencies = [
+    # Any dependencies for jobs and pipelines in this project can be added here
+    # See also https://docs.databricks.com/dev-tools/bundles/library-dependencies
+    "databricks-lakeflow-integrations>=0.0.3,<0.1",
+]
+
+[tool.hatch.build.targets.wheel]
+packages = [
+    "src/my_lakeflow_integrations",
+]
+
+[dependency-groups]
+dev = [
+    # libraries part of serverless environment
+    "requests",
+    "databricks-sdk"
+]
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.ruff]
+line-length = 120
diff --git a/acceptance/bundle/templates/lakeflow-integrations/output/my_lakeflow_integrations/resources/send_slack_message.job.yml b/acceptance/bundle/templates/lakeflow-integrations/output/my_lakeflow_integrations/resources/send_slack_message.job.yml
new file mode 100644
index 00000000000..bb64af9d278
--- /dev/null
+++ b/acceptance/bundle/templates/lakeflow-integrations/output/my_lakeflow_integrations/resources/send_slack_message.job.yml
@@ -0,0 +1,24 @@
+resources:
+  jobs:
+    send_slack_message:
+      name: "[example] send_slack_message"
+
+      tasks:
+        - task_key: slack
+          environment_key: my_lakeflow_integrations_environment
+          python_operator_task:
+            main: my_lakeflow_integrations.examples.slack.send_slack_message
+            parameters:
+              - name: "conn_id"
+                value: "CHANGEME"
+              - name: "text"
+                value: "Hello, World"
+              - name: "channel"
+                value: "CHANGEME"
+
+      environments:
+        - environment_key: my_lakeflow_integrations_environment
+          spec:
+            environment_version: "5"
+            dependencies:
+              - ../dist/*.whl
diff --git a/acceptance/bundle/templates/lakeflow-integrations/output/my_lakeflow_integrations/resources/wait_for_run_sensor.job.yml b/acceptance/bundle/templates/lakeflow-integrations/output/my_lakeflow_integrations/resources/wait_for_run_sensor.job.yml
new file mode 100644
index 00000000000..ed340fb7e92
--- /dev/null
+++ b/acceptance/bundle/templates/lakeflow-integrations/output/my_lakeflow_integrations/resources/wait_for_run_sensor.job.yml
@@ -0,0 +1,20 @@
+resources:
+  jobs:
+    wait_for_run_sensor:
+      name: "[example] wait_for_run_sensor"
+
+      tasks:
+        - task_key: wait_for_run_sensor
+          environment_key: my_lakeflow_integrations_environment
+          python_operator_task:
+            main: my_lakeflow_integrations.examples.wait_for_run_sensor.WaitForRunSensor
+            parameters:
+              - name: "run_id"
+                value: "CHANGEME"
+
+      environments:
+        - environment_key: my_lakeflow_integrations_environment
+          spec:
+            environment_version: "5"
+            dependencies:
+              - ../dist/*.whl
diff --git a/acceptance/pipelines/e2e/test.toml b/acceptance/bundle/templates/lakeflow-integrations/output/my_lakeflow_integrations/src/my_lakeflow_integrations/__init__.py
similarity index 100%
rename from acceptance/pipelines/e2e/test.toml
rename to acceptance/bundle/templates/lakeflow-integrations/output/my_lakeflow_integrations/src/my_lakeflow_integrations/__init__.py
diff --git a/acceptance/bundle/templates/lakeflow-integrations/output/my_lakeflow_integrations/src/my_lakeflow_integrations/examples/__init__.py b/acceptance/bundle/templates/lakeflow-integrations/output/my_lakeflow_integrations/src/my_lakeflow_integrations/examples/__init__.py
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/acceptance/bundle/templates/lakeflow-integrations/output/my_lakeflow_integrations/src/my_lakeflow_integrations/examples/slack.py b/acceptance/bundle/templates/lakeflow-integrations/output/my_lakeflow_integrations/src/my_lakeflow_integrations/examples/slack.py
new file mode 100644
index 00000000000..8834a752e4f
--- /dev/null
+++ b/acceptance/bundle/templates/lakeflow-integrations/output/my_lakeflow_integrations/src/my_lakeflow_integrations/examples/slack.py
@@ -0,0 +1,27 @@
+import requests
+from databricks.sdk import WorkspaceClient
+from databricks.lakeflow.integrations import integration
+
+
+@integration(display_name="Send Slack message")
+def send_slack_message(
+    text: str,
+    conn_id: str,
+    channel: str,  # Example: "C0A874NCL8N"
+):
+    w = WorkspaceClient()
+
+    response = requests.post(
+        f"{w.config.host}/api/2.0/unity-catalog/connections/{conn_id}/proxy/chat.postMessage",
+        headers={
+            **w.config.authenticate(),
+            "Accept": "application/json",
+            "Content-Type": "application/json",
+            "Accept-Encoding": "identity",  # ask for no compression
+        },
+        json={
+            "channel": channel,
+            "text": text,
+        },
+    )
+    print(response.json())
diff --git a/acceptance/bundle/templates/lakeflow-integrations/output/my_lakeflow_integrations/src/my_lakeflow_integrations/examples/wait_for_run_sensor.py b/acceptance/bundle/templates/lakeflow-integrations/output/my_lakeflow_integrations/src/my_lakeflow_integrations/examples/wait_for_run_sensor.py
new file mode 100644
index 00000000000..35e2c945d4a
--- /dev/null
+++ b/acceptance/bundle/templates/lakeflow-integrations/output/my_lakeflow_integrations/src/my_lakeflow_integrations/examples/wait_for_run_sensor.py
@@ -0,0 +1,28 @@
+import datetime
+
+from databricks.lakeflow.integrations import integration, Context, Sensor, SensorResult
+from databricks.sdk import WorkspaceClient
+
+
+@integration(display_name="Wait for run")
+class WaitForRunSensor(Sensor):
+    run_id: str
+
+    def __init__(self, run_id: str):
+        self.run_id = run_id
+
+    def poll(self, ctx: Context) -> SensorResult:
+        from databricks.sdk.runtime import dbutils
+
+        w = WorkspaceClient()
+
+        run = w.jobs.get_run(run_id=int(self.run_id))
+        result_state = run.state.result_state if run.state else None
+
+        if result_state is not None:
+            dbutils.jobs.taskValues.set("result_state", result_state.name)
+            return SensorResult.completed()
+        else:
+            print("Running", run.run_page_url)
+            print("Waiting for a minute...")
+            return SensorResult.deferred(duration=datetime.timedelta(minutes=1))
diff --git a/acceptance/bundle/templates/lakeflow-integrations/script b/acceptance/bundle/templates/lakeflow-integrations/script
new file mode 100644
index 00000000000..0b0925e7cfc
--- /dev/null
+++ b/acceptance/bundle/templates/lakeflow-integrations/script
@@ -0,0 +1,37 @@
+WHEELS_DIR="$PWD/wheels"
+STUB_WHEELS_SRC="$PWD/stub-wheels"
+
+cleanup() {
+    # Do not affect this repository's git behaviour #2318
+    [ -f .gitignore ] && mv .gitignore out.gitignore
+    rm -rf .databricks dist __generated__ .venv uv.lock
+    rm -rf "$WHEELS_DIR"
+}
+
+# The example modules import `requests` and `databricks.sdk` at module top level,
+# but the acceptance harness runs uv offline against a fixed find-links dir that
+# only has databricks-lakeflow-integrations. Build stub wheels for these two
+# packages from `stub-wheels/` into a per-test find-links dir that also
+# symlinks the real vendored wheels, and point UV_FIND_LINKS at it.
+mkdir -p "$WHEELS_DIR"
+for whl in "$VENDORED_PY_PACKAGES"/*.whl; do
+    ln -sf "$whl" "$WHEELS_DIR/$(basename "$whl")"
+done
+uv build --wheel --quiet --out-dir "$WHEELS_DIR" "$STUB_WHEELS_SRC/requests"
+uv build --wheel --quiet --out-dir "$WHEELS_DIR" "$STUB_WHEELS_SRC/databricks-sdk"
+
+export UV_FIND_LINKS="$WHEELS_DIR"
+
+trace $CLI bundle init lakeflow-integrations --config-file ./input.json --output-dir output
+
+cd output/my_lakeflow_integrations
+trap cleanup EXIT
+
+trace $CLI bundle validate -t dev
+trace $CLI bundle validate -t prod
+
+trace $CLI bundle deploy -t dev
+
+# FIXME: debug why no artifacts are uploaded on Windows
+# title "artifacts uploaded to .internal"
+# trace $CLI workspace list /Workspace/Users/$CURRENT_USER_NAME/.bundle/my_lakeflow_integrations/dev/artifacts/.internal --output json | jq '[.[] | .path] | sort | .[]'
diff --git a/acceptance/bundle/templates/lakeflow-integrations/stub-wheels/databricks-sdk/pyproject.toml b/acceptance/bundle/templates/lakeflow-integrations/stub-wheels/databricks-sdk/pyproject.toml
new file mode 100644
index 00000000000..391b1a6d00a
--- /dev/null
+++ b/acceptance/bundle/templates/lakeflow-integrations/stub-wheels/databricks-sdk/pyproject.toml
@@ -0,0 +1,11 @@
+[project]
+name = "databricks-sdk"
+version = "0.0.0"
+requires-python = ">=3.10"
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/databricks"]
diff --git a/acceptance/bundle/templates/lakeflow-integrations/stub-wheels/databricks-sdk/src/databricks/sdk/__init__.py b/acceptance/bundle/templates/lakeflow-integrations/stub-wheels/databricks-sdk/src/databricks/sdk/__init__.py
new file mode 100644
index 00000000000..551ad4b4cc6
--- /dev/null
+++ b/acceptance/bundle/templates/lakeflow-integrations/stub-wheels/databricks-sdk/src/databricks/sdk/__init__.py
@@ -0,0 +1,2 @@
+class WorkspaceClient:
+    def __init__(self, *args, **kwargs): ...
diff --git a/acceptance/bundle/templates/lakeflow-integrations/stub-wheels/databricks-sdk/src/databricks/sdk/runtime/__init__.py b/acceptance/bundle/templates/lakeflow-integrations/stub-wheels/databricks-sdk/src/databricks/sdk/runtime/__init__.py
new file mode 100644
index 00000000000..beb784ac061
--- /dev/null
+++ b/acceptance/bundle/templates/lakeflow-integrations/stub-wheels/databricks-sdk/src/databricks/sdk/runtime/__init__.py
@@ -0,0 +1 @@
+dbutils = None
diff --git a/acceptance/bundle/templates/lakeflow-integrations/stub-wheels/requests/pyproject.toml b/acceptance/bundle/templates/lakeflow-integrations/stub-wheels/requests/pyproject.toml
new file mode 100644
index 00000000000..db7519a09be
--- /dev/null
+++ b/acceptance/bundle/templates/lakeflow-integrations/stub-wheels/requests/pyproject.toml
@@ -0,0 +1,11 @@
+[project]
+name = "requests"
+version = "0.0.0"
+requires-python = ">=3.10"
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/requests"]
diff --git a/acceptance/bundle/templates/lakeflow-integrations/stub-wheels/requests/src/requests/__init__.py b/acceptance/bundle/templates/lakeflow-integrations/stub-wheels/requests/src/requests/__init__.py
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/acceptance/bundle/templates/lakeflow-integrations/test.toml b/acceptance/bundle/templates/lakeflow-integrations/test.toml
new file mode 100644
index 00000000000..4f062314290
--- /dev/null
+++ b/acceptance/bundle/templates/lakeflow-integrations/test.toml
@@ -0,0 +1,4 @@
+Cloud = false
+
+# databricks-lakeflow-integrations requires Python 3.12+.
+Env.UV_PYTHON = "3.12"
diff --git a/acceptance/bundle/templates/lakeflow-pipelines/python/out.test.toml b/acceptance/bundle/templates/lakeflow-pipelines/python/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/templates/lakeflow-pipelines/python/out.test.toml
+++ b/acceptance/bundle/templates/lakeflow-pipelines/python/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/templates/lakeflow-pipelines/python/output/my_lakeflow_pipelines/.vscode/extensions.json b/acceptance/bundle/templates/lakeflow-pipelines/python/output/my_lakeflow_pipelines/.vscode/extensions.json
index 5ba48e79c9b..b958aacfcb4 100644
--- a/acceptance/bundle/templates/lakeflow-pipelines/python/output/my_lakeflow_pipelines/.vscode/extensions.json
+++ b/acceptance/bundle/templates/lakeflow-pipelines/python/output/my_lakeflow_pipelines/.vscode/extensions.json
@@ -1,7 +1,7 @@
 {
     "recommendations": [
+        "charliermarsh.ruff",
         "databricks.databricks",
-        "redhat.vscode-yaml",
-        "charliermarsh.ruff"
+        "redhat.vscode-yaml"
     ]
 }
diff --git a/acceptance/bundle/templates/lakeflow-pipelines/python/output/my_lakeflow_pipelines/AGENTS.md b/acceptance/bundle/templates/lakeflow-pipelines/python/output/my_lakeflow_pipelines/AGENTS.md
new file mode 100644
index 00000000000..fdcca98a432
--- /dev/null
+++ b/acceptance/bundle/templates/lakeflow-pipelines/python/output/my_lakeflow_pipelines/AGENTS.md
@@ -0,0 +1,25 @@
+# Declarative Automation Bundles Project
+
+This project uses Declarative Automation Bundles (DABs) for deployment. Add project-specific instructions below.
+
+## For AI Agents: Use Databricks AI Tools
+
+**BEFORE any other action, read the `databricks-core` skill.**
+
+It sets you up to work with this project reliably: CLI authentication, profile
+selection, data discovery, and the bundle deployment workflow. Without it,
+results are often slower and less accurate.
+
+If this skill is not available (Databricks AI Tools are not installed), you can install them for your coding agent in seconds:
+
+```bash
+databricks aitools install
+```
+
+If the CLI is not installed, see: https://docs.databricks.com/dev-tools/cli/install
+
+---
+
+## Project Instructions
+
+<!-- Add your project-specific instructions, coding conventions, or notes here -->
diff --git a/acceptance/bundle/templates/lakeflow-pipelines/python/output/my_lakeflow_pipelines/databricks.yml b/acceptance/bundle/templates/lakeflow-pipelines/python/output/my_lakeflow_pipelines/databricks.yml
index 9df14beed6c..a86e4e792a1 100644
--- a/acceptance/bundle/templates/lakeflow-pipelines/python/output/my_lakeflow_pipelines/databricks.yml
+++ b/acceptance/bundle/templates/lakeflow-pipelines/python/output/my_lakeflow_pipelines/databricks.yml
@@ -1,4 +1,4 @@
-# This is a Databricks asset bundle definition for my_lakeflow_pipelines.
+# This is a Declarative Automation Bundle definition for my_lakeflow_pipelines.
 # See https://docs.databricks.com/dev-tools/bundles/index.html for documentation.
 bundle:
   name: my_lakeflow_pipelines
diff --git a/acceptance/bundle/templates/lakeflow-pipelines/python/output/my_lakeflow_pipelines/pyproject.toml b/acceptance/bundle/templates/lakeflow-pipelines/python/output/my_lakeflow_pipelines/pyproject.toml
index e3e451122da..62b9edf788e 100644
--- a/acceptance/bundle/templates/lakeflow-pipelines/python/output/my_lakeflow_pipelines/pyproject.toml
+++ b/acceptance/bundle/templates/lakeflow-pipelines/python/output/my_lakeflow_pipelines/pyproject.toml
@@ -2,7 +2,7 @@
 name = "my_lakeflow_pipelines"
 version = "0.0.1"
 authors = [{ name = "[USERNAME]" }]
-requires-python = ">=3.10,<3.13"
+requires-python = ">=3.12,<3.13"
 dependencies = [
     # Any dependencies for jobs and pipelines in this project can be added here
     # See also https://docs.databricks.com/dev-tools/bundles/library-dependencies
@@ -16,7 +16,7 @@ dev = [
     "pytest",
     "ruff",
     "databricks-dlt",
-    "databricks-connect>=15.4,<15.5",
+    "databricks-connect>=16.4,<16.5",
     "ipykernel",
 ]
 
diff --git a/acceptance/bundle/templates/lakeflow-pipelines/python/output/my_lakeflow_pipelines/resources/sample_job.job.yml b/acceptance/bundle/templates/lakeflow-pipelines/python/output/my_lakeflow_pipelines/resources/sample_job.job.yml
index 98800715652..aa5204356ea 100644
--- a/acceptance/bundle/templates/lakeflow-pipelines/python/output/my_lakeflow_pipelines/resources/sample_job.job.yml
+++ b/acceptance/bundle/templates/lakeflow-pipelines/python/output/my_lakeflow_pipelines/resources/sample_job.job.yml
@@ -29,4 +29,4 @@ resources:
       environments:
         - environment_key: default
           spec:
-            environment_version: "4"
+            environment_version: "5"
diff --git a/acceptance/bundle/templates/lakeflow-pipelines/python/output/my_lakeflow_pipelines/src/my_lakeflow_pipelines_etl/README.md b/acceptance/bundle/templates/lakeflow-pipelines/python/output/my_lakeflow_pipelines/src/my_lakeflow_pipelines_etl/README.md
index c675a73a2c0..a11175dec16 100644
--- a/acceptance/bundle/templates/lakeflow-pipelines/python/output/my_lakeflow_pipelines/src/my_lakeflow_pipelines_etl/README.md
+++ b/acceptance/bundle/templates/lakeflow-pipelines/python/output/my_lakeflow_pipelines/src/my_lakeflow_pipelines_etl/README.md
@@ -15,6 +15,6 @@ To get started, go to the `transformations` folder -- most of the relevant sourc
 * Take a look at the sample called "sample_trips_my_lakeflow_pipelines.py" to get familiar with the syntax.
   Read more about the syntax at https://docs.databricks.com/dlt/python-ref.html.
 * If you're using the workspace UI, use `Run file` to run and preview a single transformation.
-* If you're using the CLI, use `databricks bundle run my_lakeflow_pipelines_etl --select sample_trips_my_lakeflow_pipelines` to run a single transformation.
+* If you're using the CLI, use `databricks bundle run my_lakeflow_pipelines_etl --refresh sample_trips_my_lakeflow_pipelines` to run a single transformation.
 
 For more tutorials and reference material, see https://docs.databricks.com/dlt.
diff --git a/acceptance/bundle/templates/lakeflow-pipelines/sql/out.test.toml b/acceptance/bundle/templates/lakeflow-pipelines/sql/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/templates/lakeflow-pipelines/sql/out.test.toml
+++ b/acceptance/bundle/templates/lakeflow-pipelines/sql/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/templates/lakeflow-pipelines/sql/output/my_lakeflow_pipelines/.vscode/__builtins__.pyi b/acceptance/bundle/templates/lakeflow-pipelines/sql/output/my_lakeflow_pipelines/.vscode/__builtins__.pyi
deleted file mode 100644
index 0edd5181bc5..00000000000
--- a/acceptance/bundle/templates/lakeflow-pipelines/sql/output/my_lakeflow_pipelines/.vscode/__builtins__.pyi
+++ /dev/null
@@ -1,3 +0,0 @@
-# Typings for Pylance in Visual Studio Code
-# see https://github.com/microsoft/pyright/blob/main/docs/builtins.md
-from databricks.sdk.runtime import *
diff --git a/acceptance/bundle/templates/lakeflow-pipelines/sql/output/my_lakeflow_pipelines/.vscode/extensions.json b/acceptance/bundle/templates/lakeflow-pipelines/sql/output/my_lakeflow_pipelines/.vscode/extensions.json
index 5ba48e79c9b..1f39c330871 100644
--- a/acceptance/bundle/templates/lakeflow-pipelines/sql/output/my_lakeflow_pipelines/.vscode/extensions.json
+++ b/acceptance/bundle/templates/lakeflow-pipelines/sql/output/my_lakeflow_pipelines/.vscode/extensions.json
@@ -1,7 +1,6 @@
 {
     "recommendations": [
         "databricks.databricks",
-        "redhat.vscode-yaml",
-        "charliermarsh.ruff"
+        "redhat.vscode-yaml"
     ]
 }
diff --git a/acceptance/bundle/templates/lakeflow-pipelines/sql/output/my_lakeflow_pipelines/.vscode/settings.json b/acceptance/bundle/templates/lakeflow-pipelines/sql/output/my_lakeflow_pipelines/.vscode/settings.json
index d73c73b5705..d3e814885cb 100644
--- a/acceptance/bundle/templates/lakeflow-pipelines/sql/output/my_lakeflow_pipelines/.vscode/settings.json
+++ b/acceptance/bundle/templates/lakeflow-pipelines/sql/output/my_lakeflow_pipelines/.vscode/settings.json
@@ -1,39 +1,5 @@
 {
-    "jupyter.interactiveWindow.cellMarker.codeRegex": "^# COMMAND ----------|^# Databricks notebook source|^(#\\s*%%|#\\s*\\<codecell\\>|#\\s*In\\[\\d*?\\]|#\\s*In\\[ \\])",
-    "jupyter.interactiveWindow.cellMarker.default": "# COMMAND ----------",
-    "python.testing.pytestArgs": [
-        "."
-    ],
-    "files.exclude": {
-        "**/*.egg-info": true,
-        "**/__pycache__": true,
-        ".pytest_cache": true,
-        "dist": true,
-    },
     "files.associations": {
         "**/.gitkeep": "markdown"
     },
-
-    // Pylance settings (VS Code)
-    // Set typeCheckingMode to "basic" to enable type checking!
-    "python.analysis.typeCheckingMode": "off",
-    "python.analysis.extraPaths": ["src", "lib", "resources"],
-    "python.analysis.diagnosticMode": "workspace",
-    "python.analysis.stubPath": ".vscode",
-
-    // Pyright settings (Cursor)
-    // Set typeCheckingMode to "basic" to enable type checking!
-    "cursorpyright.analysis.typeCheckingMode": "off",
-    "cursorpyright.analysis.extraPaths": ["src", "lib", "resources"],
-    "cursorpyright.analysis.diagnosticMode": "workspace",
-    "cursorpyright.analysis.stubPath": ".vscode",
-
-    // General Python settings
-    "python.defaultInterpreterPath": "./.venv/bin/python",
-    "python.testing.unittestEnabled": false,
-    "python.testing.pytestEnabled": true,
-    "[python]": {
-        "editor.defaultFormatter": "charliermarsh.ruff",
-        "editor.formatOnSave": true,
-    },
 }
diff --git a/acceptance/bundle/templates/lakeflow-pipelines/sql/output/my_lakeflow_pipelines/AGENTS.md b/acceptance/bundle/templates/lakeflow-pipelines/sql/output/my_lakeflow_pipelines/AGENTS.md
new file mode 100644
index 00000000000..fdcca98a432
--- /dev/null
+++ b/acceptance/bundle/templates/lakeflow-pipelines/sql/output/my_lakeflow_pipelines/AGENTS.md
@@ -0,0 +1,25 @@
+# Declarative Automation Bundles Project
+
+This project uses Declarative Automation Bundles (DABs) for deployment. Add project-specific instructions below.
+
+## For AI Agents: Use Databricks AI Tools
+
+**BEFORE any other action, read the `databricks-core` skill.**
+
+It sets you up to work with this project reliably: CLI authentication, profile
+selection, data discovery, and the bundle deployment workflow. Without it,
+results are often slower and less accurate.
+
+If this skill is not available (Databricks AI Tools are not installed), you can install them for your coding agent in seconds:
+
+```bash
+databricks aitools install
+```
+
+If the CLI is not installed, see: https://docs.databricks.com/dev-tools/cli/install
+
+---
+
+## Project Instructions
+
+<!-- Add your project-specific instructions, coding conventions, or notes here -->
diff --git a/acceptance/bundle/templates/lakeflow-pipelines/sql/output/my_lakeflow_pipelines/databricks.yml b/acceptance/bundle/templates/lakeflow-pipelines/sql/output/my_lakeflow_pipelines/databricks.yml
index 9df14beed6c..a86e4e792a1 100644
--- a/acceptance/bundle/templates/lakeflow-pipelines/sql/output/my_lakeflow_pipelines/databricks.yml
+++ b/acceptance/bundle/templates/lakeflow-pipelines/sql/output/my_lakeflow_pipelines/databricks.yml
@@ -1,4 +1,4 @@
-# This is a Databricks asset bundle definition for my_lakeflow_pipelines.
+# This is a Declarative Automation Bundle definition for my_lakeflow_pipelines.
 # See https://docs.databricks.com/dev-tools/bundles/index.html for documentation.
 bundle:
   name: my_lakeflow_pipelines
diff --git a/acceptance/bundle/templates/lakeflow-pipelines/sql/output/my_lakeflow_pipelines/out.gitignore b/acceptance/bundle/templates/lakeflow-pipelines/sql/output/my_lakeflow_pipelines/out.gitignore
index e566c51f740..622a8811a7b 100644
--- a/acceptance/bundle/templates/lakeflow-pipelines/sql/output/my_lakeflow_pipelines/out.gitignore
+++ b/acceptance/bundle/templates/lakeflow-pipelines/sql/output/my_lakeflow_pipelines/out.gitignore
@@ -1,9 +1,4 @@
 .databricks/
-build/
-dist/
-__pycache__/
-*.egg-info
-.venv/
 scratch/**
 !scratch/README.md
 **/explorations/**
diff --git a/acceptance/bundle/templates/lakeflow-pipelines/sql/output/my_lakeflow_pipelines/resources/sample_job.job.yml b/acceptance/bundle/templates/lakeflow-pipelines/sql/output/my_lakeflow_pipelines/resources/sample_job.job.yml
index 98800715652..aa5204356ea 100644
--- a/acceptance/bundle/templates/lakeflow-pipelines/sql/output/my_lakeflow_pipelines/resources/sample_job.job.yml
+++ b/acceptance/bundle/templates/lakeflow-pipelines/sql/output/my_lakeflow_pipelines/resources/sample_job.job.yml
@@ -29,4 +29,4 @@ resources:
       environments:
         - environment_key: default
           spec:
-            environment_version: "4"
+            environment_version: "5"
diff --git a/acceptance/bundle/templates/lakeflow-pipelines/sql/output/my_lakeflow_pipelines/src/my_lakeflow_pipelines_etl/README.md b/acceptance/bundle/templates/lakeflow-pipelines/sql/output/my_lakeflow_pipelines/src/my_lakeflow_pipelines_etl/README.md
index c675a73a2c0..a11175dec16 100644
--- a/acceptance/bundle/templates/lakeflow-pipelines/sql/output/my_lakeflow_pipelines/src/my_lakeflow_pipelines_etl/README.md
+++ b/acceptance/bundle/templates/lakeflow-pipelines/sql/output/my_lakeflow_pipelines/src/my_lakeflow_pipelines_etl/README.md
@@ -15,6 +15,6 @@ To get started, go to the `transformations` folder -- most of the relevant sourc
 * Take a look at the sample called "sample_trips_my_lakeflow_pipelines.py" to get familiar with the syntax.
   Read more about the syntax at https://docs.databricks.com/dlt/python-ref.html.
 * If you're using the workspace UI, use `Run file` to run and preview a single transformation.
-* If you're using the CLI, use `databricks bundle run my_lakeflow_pipelines_etl --select sample_trips_my_lakeflow_pipelines` to run a single transformation.
+* If you're using the CLI, use `databricks bundle run my_lakeflow_pipelines_etl --refresh sample_trips_my_lakeflow_pipelines` to run a single transformation.
 
 For more tutorials and reference material, see https://docs.databricks.com/dlt.
diff --git a/acceptance/bundle/templates/nested-output/databricks_template_schema.json b/acceptance/bundle/templates/nested-output/databricks_template_schema.json
new file mode 100644
index 00000000000..516c764bd77
--- /dev/null
+++ b/acceptance/bundle/templates/nested-output/databricks_template_schema.json
@@ -0,0 +1,20 @@
+{
+    "properties": {
+        "group": {
+            "type": "string",
+            "description": "The group the project belongs to"
+        },
+        "project_name": {
+            "type": "string",
+            "description": "The name of the project"
+        },
+        "language": {
+            "type": "string",
+            "description": "The language of the project",
+            "enum": [
+                "python",
+                "sql"
+            ]
+        }
+    }
+}
diff --git a/acceptance/bundle/templates/nested-output/input.json b/acceptance/bundle/templates/nested-output/input.json
new file mode 100644
index 00000000000..69c5222ddaa
--- /dev/null
+++ b/acceptance/bundle/templates/nested-output/input.json
@@ -0,0 +1,5 @@
+{
+    "group": "alpha",
+    "project_name": "yz",
+    "language": "python"
+}
diff --git a/acceptance/bundle/templates/nested-output/out.test.toml b/acceptance/bundle/templates/nested-output/out.test.toml
new file mode 100644
index 00000000000..19b5b15d11f
--- /dev/null
+++ b/acceptance/bundle/templates/nested-output/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/templates/nested-output/output.txt b/acceptance/bundle/templates/nested-output/output.txt
new file mode 100644
index 00000000000..e5ad6e7e797
--- /dev/null
+++ b/acceptance/bundle/templates/nested-output/output.txt
@@ -0,0 +1,6 @@
+{
+  "outputs": [
+    "projects/alpha/yz/databricks.yml",
+    "projects/alpha/yz/src/yz.py"
+  ]
+}
diff --git a/acceptance/bundle/templates/nested-output/script b/acceptance/bundle/templates/nested-output/script
new file mode 100644
index 00000000000..ea02653a9bb
--- /dev/null
+++ b/acceptance/bundle/templates/nested-output/script
@@ -0,0 +1,13 @@
+# A custom template whose output path is nested: the outputs are under
+# projects/<group>/<project_name>, not under <project_name> at the output root.
+#
+# stderr is dropped so that the golden output only pins the JSON payload; the
+# success message is printed to stderr and would otherwise interleave with it.
+trace $CLI bundle init . --config-file input.json --output-dir output -o json 2>/dev/null
+
+# The bundle is written to the nested directory, and the CLI does not create a
+# stray top-level directory named after the project.
+[ -f "output/projects/alpha/yz/databricks.yml" ] || exit 1
+[ ! -e "output/yz" ] || exit 1
+
+rm -r output
diff --git a/acceptance/bundle/templates/nested-output/template/__preamble.tmpl b/acceptance/bundle/templates/nested-output/template/__preamble.tmpl
new file mode 100644
index 00000000000..b3f1f8f5967
--- /dev/null
+++ b/acceptance/bundle/templates/nested-output/template/__preamble.tmpl
@@ -0,0 +1,6 @@
+{{skip "__preamble"}}
+{{if eq .language "python"}}
+  {{skip "projects/{{.group}}/{{.project_name}}/{{.project_name}}.sql"}}
+{{else}}
+  {{skip "projects/{{.group}}/{{.project_name}}/src"}}
+{{end}}
diff --git a/acceptance/bundle/templates/nested-output/template/projects/{{.group}}/{{.project_name}}/databricks.yml.tmpl b/acceptance/bundle/templates/nested-output/template/projects/{{.group}}/{{.project_name}}/databricks.yml.tmpl
new file mode 100644
index 00000000000..ab0616e4386
--- /dev/null
+++ b/acceptance/bundle/templates/nested-output/template/projects/{{.group}}/{{.project_name}}/databricks.yml.tmpl
@@ -0,0 +1,2 @@
+bundle:
+  name: {{.project_name}}
diff --git a/acceptance/bundle/templates/nested-output/template/projects/{{.group}}/{{.project_name}}/src/{{.project_name}}.py.tmpl b/acceptance/bundle/templates/nested-output/template/projects/{{.group}}/{{.project_name}}/src/{{.project_name}}.py.tmpl
new file mode 100644
index 00000000000..7e687d6a2d9
--- /dev/null
+++ b/acceptance/bundle/templates/nested-output/template/projects/{{.group}}/{{.project_name}}/src/{{.project_name}}.py.tmpl
@@ -0,0 +1 @@
+print("{{.project_name}}")
diff --git a/acceptance/bundle/templates/nested-output/template/projects/{{.group}}/{{.project_name}}/{{.project_name}}.sql.tmpl b/acceptance/bundle/templates/nested-output/template/projects/{{.group}}/{{.project_name}}/{{.project_name}}.sql.tmpl
new file mode 100644
index 00000000000..b253b7bb9df
--- /dev/null
+++ b/acceptance/bundle/templates/nested-output/template/projects/{{.group}}/{{.project_name}}/{{.project_name}}.sql.tmpl
@@ -0,0 +1 @@
+SELECT '{{.project_name}}'
diff --git a/acceptance/bundle/templates/pydabs/check-consistency/out.test.toml b/acceptance/bundle/templates/pydabs/check-consistency/out.test.toml
index 88bd948e0a9..60811c86cb4 100644
--- a/acceptance/bundle/templates/pydabs/check-consistency/out.test.toml
+++ b/acceptance/bundle/templates/pydabs/check-consistency/out.test.toml
@@ -1,6 +1,5 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
 EnvMatrix.INCLUDE_JOB = ["yes", "no"]
 EnvMatrix.INCLUDE_PIPELINE = ["yes", "no"]
 EnvMatrix.INCLUDE_PYTHON = ["yes", "no"]
diff --git a/acceptance/bundle/templates/pydabs/check-consistency/test.toml b/acceptance/bundle/templates/pydabs/check-consistency/test.toml
index e65971c43f0..93f92779e7a 100644
--- a/acceptance/bundle/templates/pydabs/check-consistency/test.toml
+++ b/acceptance/bundle/templates/pydabs/check-consistency/test.toml
@@ -1,5 +1,4 @@
-[EnvMatrix]
-INCLUDE_JOB = ["yes", "no"]
-INCLUDE_PIPELINE = ["yes", "no"]
-INCLUDE_PYTHON = ["yes", "no"]
-SERVERLESS = ["yes", "no"]
+EnvMatrix.INCLUDE_JOB = ["yes", "no"]
+EnvMatrix.INCLUDE_PIPELINE = ["yes", "no"]
+EnvMatrix.INCLUDE_PYTHON = ["yes", "no"]
+EnvMatrix.SERVERLESS = ["yes", "no"]
diff --git a/acceptance/bundle/templates/pydabs/check-formatting/out.test.toml b/acceptance/bundle/templates/pydabs/check-formatting/out.test.toml
index 88bd948e0a9..60811c86cb4 100644
--- a/acceptance/bundle/templates/pydabs/check-formatting/out.test.toml
+++ b/acceptance/bundle/templates/pydabs/check-formatting/out.test.toml
@@ -1,6 +1,5 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
 EnvMatrix.INCLUDE_JOB = ["yes", "no"]
 EnvMatrix.INCLUDE_PIPELINE = ["yes", "no"]
 EnvMatrix.INCLUDE_PYTHON = ["yes", "no"]
diff --git a/acceptance/bundle/templates/pydabs/check-formatting/test.toml b/acceptance/bundle/templates/pydabs/check-formatting/test.toml
index 887fd8ea87c..cd3cf82a8a1 100644
--- a/acceptance/bundle/templates/pydabs/check-formatting/test.toml
+++ b/acceptance/bundle/templates/pydabs/check-formatting/test.toml
@@ -2,8 +2,7 @@ Ignore = [
     '.ruff_cache',
 ]
 
-[EnvMatrix]
-INCLUDE_JOB = ["yes", "no"]
-INCLUDE_PIPELINE = ["yes", "no"]
-INCLUDE_PYTHON = ["yes", "no"]
-SERVERLESS = ["yes", "no"]
+EnvMatrix.INCLUDE_JOB = ["yes", "no"]
+EnvMatrix.INCLUDE_PIPELINE = ["yes", "no"]
+EnvMatrix.INCLUDE_PYTHON = ["yes", "no"]
+EnvMatrix.SERVERLESS = ["yes", "no"]
diff --git a/acceptance/bundle/templates/pydabs/deploy-classic/out.test.toml b/acceptance/bundle/templates/pydabs/deploy-classic/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/templates/pydabs/deploy-classic/out.test.toml
+++ b/acceptance/bundle/templates/pydabs/deploy-classic/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/templates/pydabs/deploy-classic/output.txt b/acceptance/bundle/templates/pydabs/deploy-classic/output.txt
index f79f8337c74..74c19b9af3d 100644
--- a/acceptance/bundle/templates/pydabs/deploy-classic/output.txt
+++ b/acceptance/bundle/templates/pydabs/deploy-classic/output.txt
@@ -20,6 +20,7 @@ To get started, refer to the project README.md file and the documentation at htt
 Building python_artifact...
 Uploading .databricks/bundle/dev/patched_wheels/python_artifact_my_pydabs/my_pydabs-0.0.1+[UNIX_TIME_NANOS]-py3-none-any.whl...
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/my_pydabs/dev/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created jobs.sample_job
+Created pipelines.my_pydabs_etl
+Files: 21 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
diff --git a/acceptance/bundle/templates/pydabs/init-classic/out.test.toml b/acceptance/bundle/templates/pydabs/init-classic/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/templates/pydabs/init-classic/out.test.toml
+++ b/acceptance/bundle/templates/pydabs/init-classic/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/templates/pydabs/init-classic/output/my_pydabs/databricks.yml b/acceptance/bundle/templates/pydabs/init-classic/output/my_pydabs/databricks.yml
index 8bb7b985107..299ee6fd9ac 100644
--- a/acceptance/bundle/templates/pydabs/init-classic/output/my_pydabs/databricks.yml
+++ b/acceptance/bundle/templates/pydabs/init-classic/output/my_pydabs/databricks.yml
@@ -1,4 +1,4 @@
-# This is a Databricks asset bundle definition for my_pydabs.
+# This is a Declarative Automation Bundle definition for my_pydabs.
 # See https://docs.databricks.com/dev-tools/bundles/index.html for documentation.
 bundle:
   name: my_pydabs
diff --git a/acceptance/bundle/templates/pydabs/init-classic/output/my_pydabs/pyproject.toml b/acceptance/bundle/templates/pydabs/init-classic/output/my_pydabs/pyproject.toml
index eea1c50a649..bd5be00a97a 100644
--- a/acceptance/bundle/templates/pydabs/init-classic/output/my_pydabs/pyproject.toml
+++ b/acceptance/bundle/templates/pydabs/init-classic/output/my_pydabs/pyproject.toml
@@ -2,7 +2,7 @@
 name = "my_pydabs"
 version = "0.0.1"
 authors = [{ name = "[USERNAME]" }]
-requires-python = ">=3.10,<3.13"
+requires-python = ">=3.12,<3.13"
 dependencies = [
     # Any dependencies for jobs and pipelines in this project can be added here
     # See also https://docs.databricks.com/dev-tools/bundles/library-dependencies
@@ -16,9 +16,9 @@ dev = [
     "pytest",
     "ruff",
     "databricks-dlt",
-    "databricks-connect>=15.4,<15.5",
+    "databricks-connect>=16.4,<16.5",
     "ipykernel",
-    "databricks-bundles==x.y.z",
+    "databricks-bundles==0.0.0",
 ]
 
 [project.scripts]
diff --git a/acceptance/bundle/templates/pydabs/init-classic/output/my_pydabs/resources/sample_job.py b/acceptance/bundle/templates/pydabs/init-classic/output/my_pydabs/resources/sample_job.py
index 028489e4b92..4234470aedf 100644
--- a/acceptance/bundle/templates/pydabs/init-classic/output/my_pydabs/resources/sample_job.py
+++ b/acceptance/bundle/templates/pydabs/init-classic/output/my_pydabs/resources/sample_job.py
@@ -82,7 +82,7 @@
                 "new_cluster": {
                     "spark_version": "16.4.x-scala2.12",
                     "node_type_id": "[NODE_TYPE_ID]",
-                    "data_security_mode": "SINGLE_USER",
+                    "data_security_mode": "DATA_SECURITY_MODE_AUTO",
                     "autoscale": {
                         "min_workers": 1,
                         "max_workers": 4,
diff --git a/acceptance/bundle/templates/pydabs/test.toml b/acceptance/bundle/templates/pydabs/test.toml
index 51537c52ecc..986a03893b3 100644
--- a/acceptance/bundle/templates/pydabs/test.toml
+++ b/acceptance/bundle/templates/pydabs/test.toml
@@ -1,9 +1,12 @@
 Timeout = '40s'
 TimeoutWindows = '120s'
 
-Local = true
 Cloud = false
 
+# Mask the real databricks-bundles version so the golden pyproject.toml does not
+# churn on every release. The placeholder must stay valid PEP 440: Dependabot's
+# dependency-graph submission scans this generated manifest and aborts the whole
+# pip/uv graph job on an unparseable version (the old "x.y.z" did exactly that).
 [[Repls]]
-Old = '"databricks-bundles==0.\d+.\d+"'
-New = '"databricks-bundles==x.y.z"'
+Old = '"databricks-bundles==\d+\.\d+\.\d+"'
+New = '"databricks-bundles==0.0.0"'
diff --git a/acceptance/bundle/templates/telemetry/custom-template/out.requests.txt b/acceptance/bundle/templates/telemetry/custom-template/out.requests.txt
deleted file mode 100644
index 321ab066c57..00000000000
--- a/acceptance/bundle/templates/telemetry/custom-template/out.requests.txt
+++ /dev/null
@@ -1,25 +0,0 @@
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]"
-    ]
-  },
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_init cmd-exec-id/[CMD-EXEC-ID] interactive/none auth/pat"
-    ]
-  },
-  "method": "POST",
-  "path": "/telemetry-ext",
-  "body": {
-    "uploadTime": [UNIX_TIME_MILLIS],
-    "items": [],
-    "protoLogs": [
-      "{\"frontend_log_event_id\":\"[UUID]\",\"entry\":{\"databricks_cli_log\":{\"execution_context\":{\"cmd_exec_id\":\"[CMD-EXEC-ID]\",\"version\":\"[DEV_VERSION]\",\"command\":\"bundle_init\",\"operating_system\":\"[OS]\",\"execution_time_ms\":\"SMALL_INT\",\"exit_code\":0},\"bundle_init_event\":{\"bundle_uuid\":\"[BUNDLE-UUID]\",\"template_name\":\"custom\"}}}}"
-    ]
-  }
-}
diff --git a/acceptance/bundle/templates/telemetry/custom-template/out.test.toml b/acceptance/bundle/templates/telemetry/custom-template/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/templates/telemetry/custom-template/out.test.toml
+++ b/acceptance/bundle/templates/telemetry/custom-template/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/templates/telemetry/custom-template/output.txt b/acceptance/bundle/templates/telemetry/custom-template/output.txt
index 6c81fc77dc9..b2382d17e80 100644
--- a/acceptance/bundle/templates/telemetry/custom-template/output.txt
+++ b/acceptance/bundle/templates/telemetry/custom-template/output.txt
@@ -2,14 +2,14 @@
 >>> [CLI] bundle init . --config-file input.json --output-dir output
 ✨ Successfully initialized template
 
->>> cat out.requests.txt
+>>> cat [OUTPUT_DIR]/out.requests.txt
 {
   "frontend_log_event_id": "[UUID]",
   "entry": {
     "databricks_cli_log": {
       "execution_context": {
         "cmd_exec_id": "[CMD-EXEC-ID]",
-        "version": "[DEV_VERSION]",
+        "version": "[CLI_VERSION]",
         "command": "bundle_init",
         "operating_system": "[OS]",
         "execution_time_ms": SMALL_INT,
diff --git a/acceptance/bundle/templates/telemetry/custom-template/script b/acceptance/bundle/templates/telemetry/custom-template/script
index 893eb1e6759..0ee808e8539 100644
--- a/acceptance/bundle/templates/telemetry/custom-template/script
+++ b/acceptance/bundle/templates/telemetry/custom-template/script
@@ -8,9 +8,9 @@ rm -r output
 cmd_exec_id=$(extract_command_exec_id.py)
 bundle_uuid=$(cat out.databricks.yml | grep -o 'uuid: [^\n]*' | cut -d ' ' -f2)
 
-update_file.py out.requests.txt $cmd_exec_id  '[CMD-EXEC-ID]'
-update_file.py out.requests.txt $bundle_uuid '[BUNDLE-UUID]'
+update_file.py "$OUT_REQUESTS" $cmd_exec_id  '[CMD-EXEC-ID]'
+update_file.py "$OUT_REQUESTS" $bundle_uuid '[BUNDLE-UUID]'
 update_file.py out.databricks.yml $bundle_uuid '[BUNDLE-UUID]'
 
 # pretty print the telemetry payload.
-trace cat out.requests.txt | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson'
+trace cat "$OUT_REQUESTS" | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson'
diff --git a/acceptance/bundle/templates/telemetry/dbt-sql/out.requests.txt b/acceptance/bundle/templates/telemetry/dbt-sql/out.requests.txt
deleted file mode 100644
index 34ccec28997..00000000000
--- a/acceptance/bundle/templates/telemetry/dbt-sql/out.requests.txt
+++ /dev/null
@@ -1,43 +0,0 @@
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]"
-    ]
-  },
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_init cmd-exec-id/[CMD-EXEC-ID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/preview/scim/v2/Me"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_init cmd-exec-id/[CMD-EXEC-ID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.1/unity-catalog/current-metastore-assignment"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_init cmd-exec-id/[CMD-EXEC-ID] interactive/none auth/pat"
-    ]
-  },
-  "method": "POST",
-  "path": "/telemetry-ext",
-  "body": {
-    "uploadTime": [UNIX_TIME_MILLIS],
-    "items": [],
-    "protoLogs": [
-      "{\"frontend_log_event_id\":\"[UUID]\",\"entry\":{\"databricks_cli_log\":{\"execution_context\":{\"cmd_exec_id\":\"[CMD-EXEC-ID]\",\"version\":\"[DEV_VERSION]\",\"command\":\"bundle_init\",\"operating_system\":\"[OS]\",\"execution_time_ms\":\"SMALL_INT\",\"exit_code\":0},\"bundle_init_event\":{\"bundle_uuid\":\"[BUNDLE-UUID]\",\"template_name\":\"dbt-sql\",\"template_enum_args\":[{\"key\":\"personal_schemas\",\"value\":\"yes\"},{\"key\":\"serverless\",\"value\":\"yes\"}]}}}}"
-    ]
-  }
-}
diff --git a/acceptance/bundle/templates/telemetry/dbt-sql/out.test.toml b/acceptance/bundle/templates/telemetry/dbt-sql/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/templates/telemetry/dbt-sql/out.test.toml
+++ b/acceptance/bundle/templates/telemetry/dbt-sql/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/templates/telemetry/dbt-sql/output.txt b/acceptance/bundle/templates/telemetry/dbt-sql/output.txt
index 092d7557f21..74e0bac9312 100644
--- a/acceptance/bundle/templates/telemetry/dbt-sql/output.txt
+++ b/acceptance/bundle/templates/telemetry/dbt-sql/output.txt
@@ -9,14 +9,14 @@ If you already have dbt installed, just type 'cd my_dbt_sql; dbt init' to get st
 Refer to the README.md file for full "getting started" guide and production setup instructions.
 
 
->>> cat out.requests.txt
+>>> cat [OUTPUT_DIR]/out.requests.txt
 {
   "frontend_log_event_id": "[UUID]",
   "entry": {
     "databricks_cli_log": {
       "execution_context": {
         "cmd_exec_id": "[CMD-EXEC-ID]",
-        "version": "[DEV_VERSION]",
+        "version": "[CLI_VERSION]",
         "command": "bundle_init",
         "operating_system": "[OS]",
         "execution_time_ms": SMALL_INT,
diff --git a/acceptance/bundle/templates/telemetry/dbt-sql/script b/acceptance/bundle/templates/telemetry/dbt-sql/script
index 5669be644e4..cd511570ccc 100644
--- a/acceptance/bundle/templates/telemetry/dbt-sql/script
+++ b/acceptance/bundle/templates/telemetry/dbt-sql/script
@@ -8,9 +8,9 @@ rm -r output
 cmd_exec_id=$(extract_command_exec_id.py)
 bundle_uuid=$(cat out.databricks.yml | grep -o 'uuid: [^\n]*' | cut -d ' ' -f2)
 
-update_file.py out.requests.txt $cmd_exec_id  '[CMD-EXEC-ID]'
-update_file.py out.requests.txt $bundle_uuid '[BUNDLE-UUID]'
+update_file.py "$OUT_REQUESTS" $cmd_exec_id  '[CMD-EXEC-ID]'
+update_file.py "$OUT_REQUESTS" $bundle_uuid '[BUNDLE-UUID]'
 update_file.py out.databricks.yml $bundle_uuid '[BUNDLE-UUID]'
 
 # pretty print the telemetry payload.
-trace cat out.requests.txt | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson'
+trace cat "$OUT_REQUESTS" | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson'
diff --git a/acceptance/bundle/templates/telemetry/default-python/out.databricks.yml b/acceptance/bundle/templates/telemetry/default-python/out.databricks.yml
index 2e00b00b9e4..964e6e704f4 100644
--- a/acceptance/bundle/templates/telemetry/default-python/out.databricks.yml
+++ b/acceptance/bundle/templates/telemetry/default-python/out.databricks.yml
@@ -1,4 +1,4 @@
-# This is a Databricks asset bundle definition for my_default_python.
+# This is a Declarative Automation Bundle definition for my_default_python.
 # See https://docs.databricks.com/dev-tools/bundles/index.html for documentation.
 bundle:
   name: my_default_python
diff --git a/acceptance/bundle/templates/telemetry/default-python/out.requests.txt b/acceptance/bundle/templates/telemetry/default-python/out.requests.txt
deleted file mode 100644
index 932cb465bcc..00000000000
--- a/acceptance/bundle/templates/telemetry/default-python/out.requests.txt
+++ /dev/null
@@ -1,43 +0,0 @@
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]"
-    ]
-  },
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_init cmd-exec-id/[CMD-EXEC-ID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.1/unity-catalog/current-metastore-assignment"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_init cmd-exec-id/[CMD-EXEC-ID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/preview/scim/v2/Me"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_init cmd-exec-id/[CMD-EXEC-ID] interactive/none auth/pat"
-    ]
-  },
-  "method": "POST",
-  "path": "/telemetry-ext",
-  "body": {
-    "uploadTime": [UNIX_TIME_MILLIS],
-    "items": [],
-    "protoLogs": [
-      "{\"frontend_log_event_id\":\"[UUID]\",\"entry\":{\"databricks_cli_log\":{\"execution_context\":{\"cmd_exec_id\":\"[CMD-EXEC-ID]\",\"version\":\"[DEV_VERSION]\",\"command\":\"bundle_init\",\"operating_system\":\"[OS]\",\"execution_time_ms\":\"SMALL_INT\",\"exit_code\":0},\"bundle_init_event\":{\"bundle_uuid\":\"[BUNDLE-UUID]\",\"template_name\":\"default-python\",\"template_enum_args\":[{\"key\":\"include_job\",\"value\":\"yes\"},{\"key\":\"include_pipeline\",\"value\":\"yes\"},{\"key\":\"include_python\",\"value\":\"yes\"},{\"key\":\"language\",\"value\":\"python\"},{\"key\":\"personal_schemas\",\"value\":\"yes\"},{\"key\":\"serverless\",\"value\":\"no\"}]}}}}"
-    ]
-  }
-}
diff --git a/acceptance/bundle/templates/telemetry/default-python/out.test.toml b/acceptance/bundle/templates/telemetry/default-python/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/templates/telemetry/default-python/out.test.toml
+++ b/acceptance/bundle/templates/telemetry/default-python/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/templates/telemetry/default-python/output.txt b/acceptance/bundle/templates/telemetry/default-python/output.txt
index c1f9e4f0825..c8212408e6d 100644
--- a/acceptance/bundle/templates/telemetry/default-python/output.txt
+++ b/acceptance/bundle/templates/telemetry/default-python/output.txt
@@ -10,14 +10,14 @@ Note that [DATABRICKS_URL] is used for initialization.
 
 To get started, refer to the project README.md file and the documentation at https://docs.databricks.com/dev-tools/bundles/index.html.
 
->>> cat out.requests.txt
+>>> cat [OUTPUT_DIR]/out.requests.txt
 {
   "frontend_log_event_id": "[UUID]",
   "entry": {
     "databricks_cli_log": {
       "execution_context": {
         "cmd_exec_id": "[CMD-EXEC-ID]",
-        "version": "[DEV_VERSION]",
+        "version": "[CLI_VERSION]",
         "command": "bundle_init",
         "operating_system": "[OS]",
         "execution_time_ms": SMALL_INT,
diff --git a/acceptance/bundle/templates/telemetry/default-python/script b/acceptance/bundle/templates/telemetry/default-python/script
index 99def52ca18..d271416661e 100644
--- a/acceptance/bundle/templates/telemetry/default-python/script
+++ b/acceptance/bundle/templates/telemetry/default-python/script
@@ -8,9 +8,9 @@ rm -r output
 cmd_exec_id=$(extract_command_exec_id.py)
 bundle_uuid=$(cat out.databricks.yml | grep -o 'uuid: [^\n]*' | cut -d ' ' -f2)
 
-update_file.py out.requests.txt $cmd_exec_id  '[CMD-EXEC-ID]'
-update_file.py out.requests.txt $bundle_uuid '[BUNDLE-UUID]'
+update_file.py "$OUT_REQUESTS" $cmd_exec_id  '[CMD-EXEC-ID]'
+update_file.py "$OUT_REQUESTS" $bundle_uuid '[BUNDLE-UUID]'
 update_file.py out.databricks.yml $bundle_uuid '[BUNDLE-UUID]'
 
 # pretty print the telemetry payload.
-trace cat out.requests.txt | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson'
+trace cat "$OUT_REQUESTS" | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson'
diff --git a/acceptance/bundle/templates/telemetry/default-sql/out.databricks.yml b/acceptance/bundle/templates/telemetry/default-sql/out.databricks.yml
index 49704391ea6..bdc9573808d 100644
--- a/acceptance/bundle/templates/telemetry/default-sql/out.databricks.yml
+++ b/acceptance/bundle/templates/telemetry/default-sql/out.databricks.yml
@@ -1,4 +1,4 @@
-# This is a Databricks asset bundle definition for my_default_sql.
+# This is a Declarative Automation Bundle definition for my_default_sql.
 # See https://docs.databricks.com/dev-tools/bundles/index.html for documentation.
 bundle:
   name: my_default_sql
diff --git a/acceptance/bundle/templates/telemetry/default-sql/out.requests.txt b/acceptance/bundle/templates/telemetry/default-sql/out.requests.txt
deleted file mode 100644
index 459bbc63e66..00000000000
--- a/acceptance/bundle/templates/telemetry/default-sql/out.requests.txt
+++ /dev/null
@@ -1,34 +0,0 @@
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]"
-    ]
-  },
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_init cmd-exec-id/[CMD-EXEC-ID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/preview/scim/v2/Me"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_init cmd-exec-id/[CMD-EXEC-ID] interactive/none auth/pat"
-    ]
-  },
-  "method": "POST",
-  "path": "/telemetry-ext",
-  "body": {
-    "uploadTime": [UNIX_TIME_MILLIS],
-    "items": [],
-    "protoLogs": [
-      "{\"frontend_log_event_id\":\"[UUID]\",\"entry\":{\"databricks_cli_log\":{\"execution_context\":{\"cmd_exec_id\":\"[CMD-EXEC-ID]\",\"version\":\"[DEV_VERSION]\",\"command\":\"bundle_init\",\"operating_system\":\"[OS]\",\"execution_time_ms\":\"SMALL_INT\",\"exit_code\":0},\"bundle_init_event\":{\"bundle_uuid\":\"[BUNDLE-UUID]\",\"template_name\":\"default-sql\",\"template_enum_args\":[{\"key\":\"personal_schemas\",\"value\":\"yes\"}]}}}}"
-    ]
-  }
-}
diff --git a/acceptance/bundle/templates/telemetry/default-sql/out.test.toml b/acceptance/bundle/templates/telemetry/default-sql/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/templates/telemetry/default-sql/out.test.toml
+++ b/acceptance/bundle/templates/telemetry/default-sql/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/templates/telemetry/default-sql/output.txt b/acceptance/bundle/templates/telemetry/default-sql/output.txt
index 907e24fc872..775d86933af 100644
--- a/acceptance/bundle/templates/telemetry/default-sql/output.txt
+++ b/acceptance/bundle/templates/telemetry/default-sql/output.txt
@@ -9,14 +9,14 @@ workspace_host: [DATABRICKS_URL]
 Please refer to the README.md file for "getting started" instructions.
 See also the documentation at https://docs.databricks.com/dev-tools/bundles/index.html.
 
->>> cat out.requests.txt
+>>> cat [OUTPUT_DIR]/out.requests.txt
 {
   "frontend_log_event_id": "[UUID]",
   "entry": {
     "databricks_cli_log": {
       "execution_context": {
         "cmd_exec_id": "[CMD-EXEC-ID]",
-        "version": "[DEV_VERSION]",
+        "version": "[CLI_VERSION]",
         "command": "bundle_init",
         "operating_system": "[OS]",
         "execution_time_ms": SMALL_INT,
diff --git a/acceptance/bundle/templates/telemetry/default-sql/script b/acceptance/bundle/templates/telemetry/default-sql/script
index d0ca9dae9ab..002638985e8 100644
--- a/acceptance/bundle/templates/telemetry/default-sql/script
+++ b/acceptance/bundle/templates/telemetry/default-sql/script
@@ -8,9 +8,9 @@ rm -r output
 cmd_exec_id=$(extract_command_exec_id.py)
 bundle_uuid=$(cat out.databricks.yml | grep -o 'uuid: [^\n]*' | cut -d ' ' -f2)
 
-update_file.py out.requests.txt $cmd_exec_id  '[CMD-EXEC-ID]'
-update_file.py out.requests.txt $bundle_uuid '[BUNDLE-UUID]'
+update_file.py "$OUT_REQUESTS" $cmd_exec_id  '[CMD-EXEC-ID]'
+update_file.py "$OUT_REQUESTS" $bundle_uuid '[BUNDLE-UUID]'
 update_file.py out.databricks.yml $bundle_uuid '[BUNDLE-UUID]'
 
 # pretty print the telemetry payload.
-trace cat out.requests.txt | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson'
+trace cat "$OUT_REQUESTS" | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson'
diff --git a/acceptance/bundle/templates/test.toml b/acceptance/bundle/templates/test.toml
index 977f3725d01..0bd852bf020 100644
--- a/acceptance/bundle/templates/test.toml
+++ b/acceptance/bundle/templates/test.toml
@@ -1,5 +1,9 @@
 # Local-only: At the moment, there are many differences across different envs w.r.t to catalog use, node type and so on.
 
+# Template tests materialize and deploy full projects, taking tens of seconds each.
+# Recording adds minutes without new coverage the rest of the suite provides.
+EnvMatrix.DMS = [""]
+
 [[Server]]
 Pattern = "POST /telemetry-ext"
 Response.Body = '''
diff --git a/acceptance/bundle/test.toml b/acceptance/bundle/test.toml
index fca8259a3b5..20200b31ab9 100644
--- a/acceptance/bundle/test.toml
+++ b/acceptance/bundle/test.toml
@@ -1,10 +1,23 @@
-# This allows recording per-deployment output files, e.g. $CLI bundle deploy > out.$DATABRICKS_BUNDLE_ENGINE.txt
-EnvVaryOutput = "DATABRICKS_BUNDLE_ENGINE"
+# Runs the whole bundle suite with deployment history recording on, so the deployment metadata
+# service (DMS) is exercised by every test rather than only the handful under bundle/dms. CI gives
+# the DMS=true variant its own cell ("directdms"), so the plain cell still runs each test once; a
+# local run covers both.
+EnvMatrix.DMS = ["", "true"]
+
+# The DMS run asserts the same golden files as the plain run.
+EnvRepl.DMS = false
+
+Ignore = ["databricks.yml"]
 
 # The lowest Python version we support. Alternative to "uv run --python 3.10"
 Env.UV_PYTHON = "3.10"
 
-Ignore = ["databricks.yml"]
+# The link a recorded deploy prints, dropped so a test asserts the same output whether or
+# not recording is on. The URL itself is covered by workspaceurls.TestDeploymentURL, and
+# the calls behind it by the bundle/dms tests.
+[[Repls]]
+Old = '(?m)^Current Deployment Version: .*\n'
+New = ''
 
 # User-agent:
 [[Repls]]
@@ -22,3 +35,13 @@ New = 'os/[OS]'
 [[Repls]]
 Old = ' cicd/github'
 New = ''
+
+# Mask the serialized_dashboard content hash before the generic numeric/id rules can
+# nibble digit-runs out of the hex (Order below their default). Distinct numbers the
+# hashes, so old==new stays one token and a differing remote gets another
+# (e.g. [HASH][0] vs [HASH][1]).
+[[Repls]]
+Old = "sha256:[0-9a-f]{64}"
+New = "sha256:[HASH]"
+Order = -1
+Distinct = true
diff --git a/acceptance/bundle/trampoline/warning_message/out.test.toml b/acceptance/bundle/trampoline/warning_message/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/trampoline/warning_message/out.test.toml
+++ b/acceptance/bundle/trampoline/warning_message/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/trampoline/warning_message_with_new_spark/out.test.toml b/acceptance/bundle/trampoline/warning_message_with_new_spark/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/trampoline/warning_message_with_new_spark/out.test.toml
+++ b/acceptance/bundle/trampoline/warning_message_with_new_spark/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/trampoline/warning_message_with_old_spark/out.test.toml b/acceptance/bundle/trampoline/warning_message_with_old_spark/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/trampoline/warning_message_with_old_spark/out.test.toml
+++ b/acceptance/bundle/trampoline/warning_message_with_old_spark/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/undefined_resources/out.test.toml b/acceptance/bundle/undefined_resources/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/undefined_resources/out.test.toml
+++ b/acceptance/bundle/undefined_resources/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/upload/internal_server_error/out.test.toml b/acceptance/bundle/upload/internal_server_error/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/upload/internal_server_error/out.test.toml
+++ b/acceptance/bundle/upload/internal_server_error/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/upload/internal_server_error/output.txt b/acceptance/bundle/upload/internal_server_error/output.txt
index 5cde6aad650..2ae3634f94b 100644
--- a/acceptance/bundle/upload/internal_server_error/output.txt
+++ b/acceptance/bundle/upload/internal_server_error/output.txt
@@ -1,8 +1,10 @@
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Error: Internal Server Error (500)
+Warn: retrying after 500 Internal Server Error from POST /api/2.0/workspace/import: failed to upload /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/file_to_upload.txt: Fault injected by test.
+Warn: retrying after 500 Internal Server Error from POST /api/2.0/workspace/import: failed to upload /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/file_to_upload.txt: Fault injected by test.
+Error: failed to upload /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/file_to_upload.txt: Fault injected by test. (500 INJECTED)
 
-Endpoint: POST [DATABRICKS_URL]/api/2.0/workspace-files/import-file/Workspace%2FUsers%2F[USERNAME]%2F.bundle%2Ftest-bundle%2Fdefault%2Ffiles%2Ffile_to_upload.txt?overwrite=true
+Endpoint: POST [DATABRICKS_URL]/api/2.0/workspace/import
 HTTP Status: 500 Internal Server Error
-API error_code: 
-API message: Internal Server Error
+API error_code: INJECTED
+API message: Fault injected by test.
 
diff --git a/acceptance/bundle/upload/internal_server_error/script b/acceptance/bundle/upload/internal_server_error/script
index c1a222958e1..78c57ef8a94 100644
--- a/acceptance/bundle/upload/internal_server_error/script
+++ b/acceptance/bundle/upload/internal_server_error/script
@@ -1 +1,2 @@
+fault.py --body-contains "Users/$CURRENT_USER_NAME/.bundle/test-bundle/default/files/file_to_upload.txt" "POST /api/2.0/workspace/import" 500 0 1000
 musterr $CLI bundle deploy
diff --git a/acceptance/bundle/upload/internal_server_error/test.toml b/acceptance/bundle/upload/internal_server_error/test.toml
index 8ff8501b6de..838bbee034f 100644
--- a/acceptance/bundle/upload/internal_server_error/test.toml
+++ b/acceptance/bundle/upload/internal_server_error/test.toml
@@ -1,3 +1,2 @@
-[[Server]]
-Pattern = "POST /api/2.0/workspace-files/import-file/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/files/file_to_upload.txt"
-Response.StatusCode = 500
+Env.DATABRICKS_BUNDLE_RETRY_INTERVAL_MS = "100"
+Env.DATABRICKS_BUNDLE_RETRY_DISABLE_WARNING = ""
diff --git a/acceptance/bundle/upload/timeout/databricks.yml b/acceptance/bundle/upload/timeout/databricks.yml
index da51addc852..e4287db850d 100644
--- a/acceptance/bundle/upload/timeout/databricks.yml
+++ b/acceptance/bundle/upload/timeout/databricks.yml
@@ -4,6 +4,3 @@ bundle:
 sync:
   include:
     - files_to_upload.txt
-  exclude:
-    - "out*"
-    - "test.toml"
diff --git a/acceptance/bundle/upload/timeout/out.test.toml b/acceptance/bundle/upload/timeout/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/upload/timeout/out.test.toml
+++ b/acceptance/bundle/upload/timeout/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/upload/timeout/output.txt b/acceptance/bundle/upload/timeout/output.txt
index c314a247707..0c779d73dc2 100644
--- a/acceptance/bundle/upload/timeout/output.txt
+++ b/acceptance/bundle/upload/timeout/output.txt
@@ -1,3 +1,3 @@
-Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Error: Post "[DATABRICKS_URL]/api/2.0/workspace-files/import-file/Workspace%2FUsers%2F[USERNAME]%2F.bundle%2Ftest-bundle%2Fdefault%2Ffiles%2Ffile_to_upload.txt?overwrite=true": request timed out after 5s of inactivity
+Error: Failed to acquire deployment lock: failed to upload /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock: Post "[DATABRICKS_URL]/api/2.0/workspace/import": request timed out after 5s of inactivity
+Error: failed to upload /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock: Post "[DATABRICKS_URL]/api/2.0/workspace/import": request timed out after 5s of inactivity
 
diff --git a/acceptance/bundle/upload/timeout/test.toml b/acceptance/bundle/upload/timeout/test.toml
index de2d8ce015b..f0abd08ecbc 100644
--- a/acceptance/bundle/upload/timeout/test.toml
+++ b/acceptance/bundle/upload/timeout/test.toml
@@ -1,8 +1,7 @@
-[Env]
-DATABRICKS_BUNDLE_HTTP_TIMEOUT_SECONDS = "5"
+Env.DATABRICKS_BUNDLE_HTTP_TIMEOUT_SECONDS = "5"
 
 [[Server]]
 # CLI aborts after a single attempt when the HTTP timeout fires.
 Delay = "30s"
-Pattern = "POST /api/2.0/workspace-files/import-file/Workspace/Users/tester@databricks.com/.bundle/test-bundle/default/files/file_to_upload.txt"
+Pattern = "POST /api/2.0/workspace/import"
 Response.StatusCode = 200
diff --git a/acceptance/bundle/user_agent/out.test.toml b/acceptance/bundle/user_agent/out.test.toml
index be193812ec2..bbd44e1b741 100644
--- a/acceptance/bundle/user_agent/out.test.toml
+++ b/acceptance/bundle/user_agent/out.test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
 Phase = 1
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/user_agent/output.txt b/acceptance/bundle/user_agent/output.txt
index bf128624271..4f84546f174 100644
--- a/acceptance/bundle/user_agent/output.txt
+++ b/acceptance/bundle/user_agent/output.txt
@@ -1,136 +1,60 @@
-MISS	deploy.direct	/api/2.0/preview/scim/v2/Me	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	deploy.direct	/api/2.0/workspace/get-status	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	deploy.direct	/api/2.0/workspace/get-status	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none auth/pat'
-OK  	deploy.direct	/api/2.0/workspace/export	engine/direct
-OK  	deploy.direct	/api/2.0/workspace/export	engine/direct
-OK  	deploy.direct	/api/2.0/workspace/get-status	engine/direct
-OK  	deploy.direct	/api/2.0/workspace/get-status	engine/direct
-OK  	deploy.direct	/api/2.0/workspace/get-status	engine/direct
-OK  	deploy.direct	/api/2.0/workspace/get-status	engine/direct
-OK  	deploy.direct	/api/2.0/workspace/get-status	engine/direct
-OK  	deploy.direct	/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/empty.py	engine/direct
-OK  	deploy.direct	/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock	engine/direct
-OK  	deploy.direct	/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deployment.json	engine/direct
-OK  	deploy.direct	/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json	engine/direct
-OK  	deploy.direct	/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/resources.json	engine/direct
-OK  	deploy.direct	/api/2.0/workspace/delete	engine/direct
-OK  	deploy.direct	/api/2.0/workspace/delete	engine/direct
-OK  	deploy.direct	/api/2.0/workspace/mkdirs	engine/direct
-OK  	deploy.direct	/api/2.1/unity-catalog/schemas	engine/direct
-MISS	deploy.direct	/.well-known/databricks-config	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]'
-MISS	deploy.terraform	/api/2.0/preview/scim/v2/Me	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	deploy.terraform	/api/2.0/workspace/get-status	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	deploy.terraform	/api/2.0/workspace/get-status	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none auth/pat'
-OK  	deploy.terraform	/api/2.0/workspace/export	engine/terraform
-OK  	deploy.terraform	/api/2.0/workspace/export	engine/terraform
-OK  	deploy.terraform	/api/2.0/workspace/get-status	engine/terraform
-OK  	deploy.terraform	/api/2.0/workspace/get-status	engine/terraform
-OK  	deploy.terraform	/api/2.0/workspace/get-status	engine/terraform
-OK  	deploy.terraform	/api/2.0/workspace/get-status	engine/terraform
-OK  	deploy.terraform	/api/2.0/workspace/get-status	engine/terraform
-OK  	deploy.terraform	/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/empty.py	engine/terraform
-OK  	deploy.terraform	/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock	engine/terraform
-OK  	deploy.terraform	/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deployment.json	engine/terraform
-OK  	deploy.terraform	/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json	engine/terraform
-OK  	deploy.terraform	/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate	engine/terraform
-OK  	deploy.terraform	/api/2.0/workspace/delete	engine/terraform
-OK  	deploy.terraform	/api/2.0/workspace/delete	engine/terraform
-OK  	deploy.terraform	/api/2.0/workspace/mkdirs	engine/terraform
-MISS	deploy.terraform	/.well-known/databricks-config	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]'
-MISS	deploy.terraform	/api/2.1/unity-catalog/schemas/mycatalog.myschema	'databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5 sdk/sdkv2 resource/schema auth/pat'
-MISS	deploy.terraform	/api/2.1/unity-catalog/schemas	'databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5 sdk/sdkv2 resource/schema auth/pat'
-MISS	deploy.terraform	/.well-known/databricks-config	'databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5'
-MISS	deploy.terraform	/.well-known/databricks-config	'databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5'
-MISS	deploy.terraform	/.well-known/databricks-config	'databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5'
-MISS	deploy.terraform	/.well-known/databricks-config	'databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5'
-MISS	destroy.direct	/api/2.0/preview/scim/v2/Me	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	destroy.direct	/api/2.0/workspace-files/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/resources.json	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	destroy.direct	/api/2.0/workspace/get-status	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	destroy.direct	/api/2.0/workspace/get-status	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none auth/pat'
-OK  	destroy.direct	/api/2.1/unity-catalog/schemas/mycatalog.myschema	engine/direct
-OK  	destroy.direct	/api/2.0/workspace/export	engine/direct
-OK  	destroy.direct	/api/2.0/workspace/get-status	engine/direct
-OK  	destroy.direct	/api/2.0/workspace/get-status	engine/direct
-OK  	destroy.direct	/api/2.0/workspace/get-status	engine/direct
-OK  	destroy.direct	/api/2.1/unity-catalog/schemas/mycatalog.myschema	engine/direct
-OK  	destroy.direct	/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock	engine/direct
-OK  	destroy.direct	/api/2.0/workspace/delete	engine/direct
-MISS	destroy.direct	/.well-known/databricks-config	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]'
-MISS	destroy.terraform	/api/2.0/preview/scim/v2/Me	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	destroy.terraform	/api/2.0/workspace-files/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	destroy.terraform	/api/2.0/workspace/get-status	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	destroy.terraform	/api/2.0/workspace/get-status	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none auth/pat'
-OK  	destroy.terraform	/api/2.0/workspace/export	engine/terraform
-OK  	destroy.terraform	/api/2.0/workspace/get-status	engine/terraform
-OK  	destroy.terraform	/api/2.0/workspace/get-status	engine/terraform
-OK  	destroy.terraform	/api/2.0/workspace/get-status	engine/terraform
-OK  	destroy.terraform	/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock	engine/terraform
-OK  	destroy.terraform	/api/2.0/workspace/delete	engine/terraform
-MISS	destroy.terraform	/.well-known/databricks-config	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]'
-MISS	destroy.terraform	/api/2.1/unity-catalog/schemas/mycatalog.myschema	'databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5 sdk/sdkv2 resource/schema auth/pat'
-MISS	destroy.terraform	/api/2.1/unity-catalog/current-metastore-assignment	'databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5 sdk/sdkv2 resource/schema auth/pat'
-MISS	destroy.terraform	/api/2.1/unity-catalog/schemas/mycatalog.myschema	'databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5 sdk/sdkv2 resource/schema auth/pat'
-MISS	destroy.terraform	/.well-known/databricks-config	'databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5'
-MISS	destroy.terraform	/.well-known/databricks-config	'databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5'
-MISS	destroy.terraform	/.well-known/databricks-config	'databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5'
-MISS	destroy.terraform	/.well-known/databricks-config	'databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5'
-MISS	destroy.terraform	/.well-known/databricks-config	'databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5'
-MISS	destroy.terraform	/.well-known/databricks-config	'databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5'
-MISS	plan.direct	/api/2.0/preview/scim/v2/Me	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	plan.direct	/api/2.0/workspace/get-status	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	plan.direct	/api/2.0/workspace/get-status	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat'
-OK  	plan.direct	/api/2.0/workspace/get-status	engine/direct
-MISS	plan.direct	/.well-known/databricks-config	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]'
-MISS	plan.terraform	/api/2.0/preview/scim/v2/Me	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	plan.terraform	/api/2.0/workspace/get-status	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	plan.terraform	/api/2.0/workspace/get-status	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat'
-OK  	plan.terraform	/api/2.0/workspace/get-status	engine/terraform
-MISS	plan.terraform	/.well-known/databricks-config	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]'
-MISS	plan.terraform	/.well-known/databricks-config	'databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5'
-MISS	plan.terraform	/.well-known/databricks-config	'databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5'
-MISS	plan2.direct	/api/2.0/preview/scim/v2/Me	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	plan2.direct	/api/2.0/workspace-files/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/resources.json	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	plan2.direct	/api/2.0/workspace/get-status	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	plan2.direct	/api/2.0/workspace/get-status	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat'
-OK  	plan2.direct	/api/2.0/workspace-files/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deployment.json	engine/direct
-OK  	plan2.direct	/api/2.0/workspace/get-status	engine/direct
-OK  	plan2.direct	/api/2.1/unity-catalog/schemas/mycatalog.myschema	engine/direct
-MISS	plan2.direct	/.well-known/databricks-config	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]'
-MISS	plan2.terraform	/api/2.0/preview/scim/v2/Me	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	plan2.terraform	/api/2.0/workspace-files/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	plan2.terraform	/api/2.0/workspace/get-status	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	plan2.terraform	/api/2.0/workspace/get-status	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat'
-OK  	plan2.terraform	/api/2.0/workspace-files/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deployment.json	engine/terraform
-OK  	plan2.terraform	/api/2.0/workspace/get-status	engine/terraform
-MISS	plan2.terraform	/.well-known/databricks-config	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]'
-MISS	plan2.terraform	/api/2.1/unity-catalog/schemas/mycatalog.myschema	'databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5 sdk/sdkv2 resource/schema auth/pat'
-MISS	plan2.terraform	/.well-known/databricks-config	'databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5'
-MISS	plan2.terraform	/.well-known/databricks-config	'databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5'
-MISS	run.direct	/api/2.0/preview/scim/v2/Me	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_run cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	run.direct	/api/2.0/workspace-files/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/resources.json	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_run cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	run.direct	/api/2.0/workspace/get-status	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_run cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	run.direct	/api/2.0/workspace/get-status	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_run cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	run.direct	/.well-known/databricks-config	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]'
-MISS	run.terraform	/api/2.0/preview/scim/v2/Me	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_run cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	run.terraform	/api/2.0/workspace-files/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_run cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	run.terraform	/api/2.0/workspace/get-status	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_run cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	run.terraform	/api/2.0/workspace/get-status	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_run cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	run.terraform	/.well-known/databricks-config	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]'
-MISS	summary.direct	/api/2.0/preview/scim/v2/Me	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_summary cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	summary.direct	/api/2.0/workspace/get-status	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_summary cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	summary.direct	/api/2.0/workspace/get-status	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_summary cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	summary.direct	/.well-known/databricks-config	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]'
-MISS	summary.terraform	/api/2.0/preview/scim/v2/Me	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_summary cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	summary.terraform	/api/2.0/workspace/get-status	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_summary cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	summary.terraform	/api/2.0/workspace/get-status	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_summary cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	summary.terraform	/.well-known/databricks-config	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]'
-MISS	validate.direct	/api/2.0/preview/scim/v2/Me	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_validate cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	validate.direct	/api/2.0/workspace/get-status	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_validate cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	validate.direct	/api/2.0/workspace/get-status	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_validate cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	validate.direct	/api/2.0/workspace/mkdirs	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_validate cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	validate.direct	/.well-known/databricks-config	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]'
-MISS	validate.terraform	/api/2.0/preview/scim/v2/Me	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_validate cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	validate.terraform	/api/2.0/workspace/get-status	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_validate cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	validate.terraform	/api/2.0/workspace/get-status	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_validate cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	validate.terraform	/api/2.0/workspace/mkdirs	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_validate cmd-exec-id/[UUID] interactive/none auth/pat'
-MISS	validate.terraform	/.well-known/databricks-config	'cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]'
+MISS	deploy	/api/2.0/preview/scim/v2/Me	'cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none auth/pat'
+MISS	deploy	/api/2.0/workspace/export	'cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none auth/pat'
+MISS	deploy	/api/2.0/workspace/export	'cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none auth/pat'
+OK  	deploy	/api/2.0/workspace/export	engine/direct
+OK  	deploy	/api/2.0/workspace/export	engine/direct
+OK  	deploy	/api/2.0/workspace/export	engine/direct
+OK  	deploy	/api/2.0/workspace/get-status	engine/direct
+OK  	deploy	/api/2.0/workspace/get-status	engine/direct
+OK  	deploy	/api/2.0/workspace/get-status	engine/direct
+OK  	deploy	/api/2.0/workspace/get-status	engine/direct
+OK  	deploy	/api/2.0/workspace/delete	engine/direct
+OK  	deploy	/api/2.0/workspace/delete	engine/direct
+OK  	deploy	/api/2.0/workspace/import	engine/direct
+OK  	deploy	/api/2.0/workspace/import	engine/direct
+OK  	deploy	/api/2.0/workspace/import	engine/direct
+OK  	deploy	/api/2.0/workspace/import	engine/direct
+OK  	deploy	/api/2.0/workspace/import	engine/direct
+OK  	deploy	/api/2.0/workspace/import	engine/direct
+OK  	deploy	/api/2.0/workspace/mkdirs	engine/direct
+OK  	deploy	/api/2.0/workspace/mkdirs	engine/direct
+OK  	deploy	/api/2.1/unity-catalog/schemas	engine/direct
+MISS	deploy	/.well-known/databricks-config	'cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]'
+MISS	destroy	/api/2.0/preview/scim/v2/Me	'cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none auth/pat'
+MISS	destroy	/api/2.0/workspace/export	'cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none auth/pat'
+MISS	destroy	/api/2.0/workspace/export	'cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none auth/pat'
+OK  	destroy	/api/2.1/unity-catalog/schemas/mycatalog.myschema	engine/direct
+OK  	destroy	/api/2.0/workspace/export	engine/direct
+OK  	destroy	/api/2.0/workspace/get-status	engine/direct
+OK  	destroy	/api/2.0/workspace/get-status	engine/direct
+OK  	destroy	/api/2.0/workspace/get-status	engine/direct
+OK  	destroy	/api/2.1/unity-catalog/schemas/mycatalog.myschema	engine/direct
+OK  	destroy	/api/2.0/workspace/delete	engine/direct
+OK  	destroy	/api/2.0/workspace/delete	engine/direct
+OK  	destroy	/api/2.0/workspace/import	engine/direct
+MISS	destroy	/.well-known/databricks-config	'cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]'
+MISS	plan	/api/2.0/preview/scim/v2/Me	'cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat'
+MISS	plan	/api/2.0/workspace/export	'cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat'
+MISS	plan	/api/2.0/workspace/export	'cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat'
+OK  	plan	/api/2.0/workspace/export	engine/direct
+MISS	plan	/.well-known/databricks-config	'cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]'
+MISS	plan2	/api/2.0/preview/scim/v2/Me	'cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat'
+MISS	plan2	/api/2.0/workspace/export	'cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat'
+MISS	plan2	/api/2.0/workspace/export	'cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat'
+OK  	plan2	/api/2.0/workspace/export	engine/direct
+OK  	plan2	/api/2.1/unity-catalog/schemas/mycatalog.myschema	engine/direct
+MISS	plan2	/.well-known/databricks-config	'cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]'
+MISS	run	/api/2.0/preview/scim/v2/Me	'cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_run cmd-exec-id/[UUID] interactive/none auth/pat'
+MISS	run	/api/2.0/workspace/export	'cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_run cmd-exec-id/[UUID] interactive/none auth/pat'
+MISS	run	/api/2.0/workspace/export	'cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_run cmd-exec-id/[UUID] interactive/none auth/pat'
+MISS	run	/.well-known/databricks-config	'cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]'
+MISS	summary	/api/2.0/preview/scim/v2/Me	'cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_summary cmd-exec-id/[UUID] interactive/none auth/pat'
+MISS	summary	/api/2.0/workspace/export	'cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_summary cmd-exec-id/[UUID] interactive/none auth/pat'
+MISS	summary	/api/2.0/workspace/export	'cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_summary cmd-exec-id/[UUID] interactive/none auth/pat'
+OK  	summary	/api/2.0/preview/scim/v2/Me	engine/direct
+MISS	summary	/.well-known/databricks-config	'cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]'
+MISS	validate	/api/2.0/preview/scim/v2/Me	'cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_validate cmd-exec-id/[UUID] interactive/none auth/pat'
+MISS	validate	/api/2.0/workspace/get-status	'cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_validate cmd-exec-id/[UUID] interactive/none auth/pat'
+MISS	validate	/api/2.0/workspace/get-status	'cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_validate cmd-exec-id/[UUID] interactive/none auth/pat'
+MISS	validate	/api/2.0/workspace/mkdirs	'cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_validate cmd-exec-id/[UUID] interactive/none auth/pat'
+MISS	validate	/.well-known/databricks-config	'cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]'
diff --git a/acceptance/bundle/user_agent/simple/out.requests.deploy.direct.json b/acceptance/bundle/user_agent/simple/out.requests.deploy.direct.json
deleted file mode 100644
index cc39aad6e9b..00000000000
--- a/acceptance/bundle/user_agent/simple/out.requests.deploy.direct.json
+++ /dev/null
@@ -1,298 +0,0 @@
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/preview/scim/v2/Me"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/resources.json",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/export",
-  "q": {
-    "direct_download": "true",
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/export",
-  "q": {
-    "direct_download": "true",
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deployment.json",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
-    ]
-  },
-  "method": "POST",
-  "path": "/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/empty.py",
-  "q": {
-    "overwrite": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
-    ]
-  },
-  "method": "POST",
-  "path": "/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock",
-  "q": {
-    "overwrite": "false"
-  },
-  "body": {
-    "ID": "[UUID]",
-    "AcquisitionTime": "[TIMESTAMP]",
-    "IsForced": false,
-    "User": "[USERNAME]"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
-    ]
-  },
-  "method": "POST",
-  "path": "/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deployment.json",
-  "q": {
-    "overwrite": "true"
-  },
-  "body": {
-    "version": 1,
-    "seq": 1,
-    "cli_version": "[DEV_VERSION]",
-    "timestamp": "[TIMESTAMP]",
-    "files": [
-      {
-        "local_path": "empty.py",
-        "is_notebook": false
-      }
-    ],
-    "id": "[UUID]"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
-    ]
-  },
-  "method": "POST",
-  "path": "/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json",
-  "q": {
-    "overwrite": "true"
-  },
-  "body": {
-    "version": 1,
-    "config": {
-      "bundle": {
-        "name": "test-bundle",
-        "target": "default",
-        "git": {
-          "bundle_root_path": "."
-        }
-      },
-      "workspace": {
-        "file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files"
-      },
-      "resources": {},
-      "presets": {
-        "source_linked_deployment": false
-      }
-    },
-    "extra": {}
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
-    ]
-  },
-  "method": "POST",
-  "path": "/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/resources.json",
-  "q": {
-    "overwrite": "true"
-  },
-  "body": {
-    "state_version": 2,
-    "cli_version": "[DEV_VERSION]",
-    "lineage": "[UUID]",
-    "serial": 1,
-    "state": {
-      "resources.schemas.foo": {
-        "__id__": "mycatalog.myschema",
-        "state": {
-          "catalog_name": "mycatalog",
-          "name": "myschema"
-        }
-      }
-    }
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
-    ]
-  },
-  "method": "POST",
-  "path": "/api/2.0/workspace/delete",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal",
-    "recursive": true
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
-    ]
-  },
-  "method": "POST",
-  "path": "/api/2.0/workspace/delete",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
-    ]
-  },
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
-    ]
-  },
-  "method": "POST",
-  "path": "/api/2.1/unity-catalog/schemas",
-  "body": {
-    "catalog_name": "mycatalog",
-    "name": "myschema"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]"
-    ]
-  },
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
diff --git a/acceptance/bundle/user_agent/simple/out.requests.deploy.json b/acceptance/bundle/user_agent/simple/out.requests.deploy.json
new file mode 100644
index 00000000000..43b23a566c3
--- /dev/null
+++ b/acceptance/bundle/user_agent/simple/out.requests.deploy.json
@@ -0,0 +1,296 @@
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/preview/scim/v2/Me"
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/workspace/export",
+  "q": {
+    "direct_download": "true",
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/resources.json"
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/workspace/export",
+  "q": {
+    "direct_download": "true",
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate"
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/workspace/export",
+  "q": {
+    "direct_download": "true",
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock"
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/workspace/export",
+  "q": {
+    "direct_download": "true",
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock"
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/workspace/export",
+  "q": {
+    "direct_download": "true",
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deployment.json"
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/workspace/get-status",
+  "q": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files"
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/workspace/get-status",
+  "q": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock",
+    "return_export_info": "true"
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/workspace/get-status",
+  "q": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock",
+    "return_export_info": "true"
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/workspace/get-status",
+  "q": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock",
+    "return_export_info": "true"
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
+    ]
+  },
+  "method": "POST",
+  "path": "/api/2.0/workspace/delete",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal",
+    "recursive": true
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
+    ]
+  },
+  "method": "POST",
+  "path": "/api/2.0/workspace/delete",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock"
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
+    ]
+  },
+  "method": "POST",
+  "path": "/api/2.0/workspace/import",
+  "body": {
+    "multipart_form": {
+      "content": "",
+      "format": "RAW",
+      "overwrite": "true",
+      "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/empty.py"
+    }
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
+    ]
+  },
+  "method": "POST",
+  "path": "/api/2.0/workspace/import",
+  "body": {
+    "multipart_form": {
+      "content": "{\"ID\":\"[UUID]\",\"AcquisitionTime\":\"[TIMESTAMP]\",\"IsForced\":false,\"User\":\"[USERNAME]\"}",
+      "format": "RAW",
+      "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock"
+    }
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
+    ]
+  },
+  "method": "POST",
+  "path": "/api/2.0/workspace/import",
+  "body": {
+    "multipart_form": {
+      "content": "{\"ID\":\"[UUID]\",\"AcquisitionTime\":\"[TIMESTAMP]\",\"IsForced\":false,\"User\":\"[USERNAME]\"}",
+      "format": "RAW",
+      "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock"
+    }
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
+    ]
+  },
+  "method": "POST",
+  "path": "/api/2.0/workspace/import",
+  "body": {
+    "multipart_form": {
+      "content": "{\"version\":1,\"seq\":1,\"cli_version\":\"[CLI_VERSION]\",\"timestamp\":\"[TIMESTAMP]\",\"files\":[{\"local_path\":\"empty.py\",\"is_notebook\":false}],\"id\":\"[UUID]\"}",
+      "format": "RAW",
+      "overwrite": "true",
+      "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deployment.json"
+    }
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
+    ]
+  },
+  "method": "POST",
+  "path": "/api/2.0/workspace/import",
+  "body": {
+    "multipart_form": {
+      "content": "{\n  \"version\": 1,\n  \"config\": {\n    \"bundle\": {\n      \"name\": \"test-bundle\",\n      \"target\": \"default\",\n      \"git\": {\n        \"bundle_root_path\": \".\"\n      }\n    },\n    \"workspace\": {\n      \"file_path\": \"/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files\"\n    },\n    \"resources\": {},\n    \"presets\": {\n      \"source_linked_deployment\": false\n    }\n  },\n  \"extra\": {}\n}",
+      "format": "RAW",
+      "overwrite": "true",
+      "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json"
+    }
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
+    ]
+  },
+  "method": "POST",
+  "path": "/api/2.0/workspace/import",
+  "body": {
+    "multipart_form": {
+      "content": "{\n \"state_version\": 3,\n \"cli_version\": \"[CLI_VERSION]\",\n \"lineage\": \"[UUID]\",\n \"serial\": 1,\n \"state\": {\n  \"resources.schemas.foo\": {\n   \"__id__\": \"mycatalog.myschema\",\n   \"state\": {\n    \"catalog_name\": \"mycatalog\",\n    \"name\": \"myschema\"\n   }\n  }\n }\n}",
+      "format": "RAW",
+      "overwrite": "true",
+      "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/resources.json"
+    }
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
+    ]
+  },
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal"
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
+    ]
+  },
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state"
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
+    ]
+  },
+  "method": "POST",
+  "path": "/api/2.1/unity-catalog/schemas",
+  "body": {
+    "catalog_name": "mycatalog",
+    "name": "myschema"
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]"
+    ]
+  },
+  "method": "GET",
+  "path": "/.well-known/databricks-config"
+}
diff --git a/acceptance/bundle/user_agent/simple/out.requests.deploy.terraform.json b/acceptance/bundle/user_agent/simple/out.requests.deploy.terraform.json
deleted file mode 100644
index 435b188af3b..00000000000
--- a/acceptance/bundle/user_agent/simple/out.requests.deploy.terraform.json
+++ /dev/null
@@ -1,365 +0,0 @@
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/preview/scim/v2/Me"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/resources.json",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/terraform auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/export",
-  "q": {
-    "direct_download": "true",
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/terraform auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/export",
-  "q": {
-    "direct_download": "true",
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/terraform auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/terraform auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/terraform auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/terraform auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/terraform auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deployment.json",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/terraform auth/pat"
-    ]
-  },
-  "method": "POST",
-  "path": "/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/empty.py",
-  "q": {
-    "overwrite": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/terraform auth/pat"
-    ]
-  },
-  "method": "POST",
-  "path": "/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock",
-  "q": {
-    "overwrite": "false"
-  },
-  "body": {
-    "ID": "[UUID]",
-    "AcquisitionTime": "[TIMESTAMP]",
-    "IsForced": false,
-    "User": "[USERNAME]"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/terraform auth/pat"
-    ]
-  },
-  "method": "POST",
-  "path": "/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deployment.json",
-  "q": {
-    "overwrite": "true"
-  },
-  "body": {
-    "version": 1,
-    "seq": 1,
-    "cli_version": "[DEV_VERSION]",
-    "timestamp": "[TIMESTAMP]",
-    "files": [
-      {
-        "local_path": "empty.py",
-        "is_notebook": false
-      }
-    ],
-    "id": "[UUID]"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/terraform auth/pat"
-    ]
-  },
-  "method": "POST",
-  "path": "/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/metadata.json",
-  "q": {
-    "overwrite": "true"
-  },
-  "body": {
-    "version": 1,
-    "config": {
-      "bundle": {
-        "name": "test-bundle",
-        "target": "default",
-        "git": {
-          "bundle_root_path": "."
-        }
-      },
-      "workspace": {
-        "file_path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files"
-      },
-      "resources": {},
-      "presets": {
-        "source_linked_deployment": false
-      }
-    },
-    "extra": {}
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/terraform auth/pat"
-    ]
-  },
-  "method": "POST",
-  "path": "/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate",
-  "q": {
-    "overwrite": "true"
-  },
-  "body": {
-    "version": 4,
-    "terraform_version": "1.5.5",
-    "serial": 1,
-    "lineage": "[UUID]",
-    "outputs": {},
-    "resources": [
-      {
-        "mode": "managed",
-        "type": "databricks_schema",
-        "name": "foo",
-        "provider": "provider[\"registry.terraform.io/databricks/databricks\"]",
-        "instances": [
-          {
-            "schema_version": 0,
-            "attributes": {
-              "catalog_name": "mycatalog",
-              "comment": null,
-              "enable_predictive_optimization": "INHERIT",
-              "force_destroy": true,
-              "id": "mycatalog.myschema",
-              "metastore_id": "[UUID]",
-              "name": "myschema",
-              "owner": "[USERNAME]",
-              "properties": null,
-              "provider_config": [],
-              "schema_id": "[UUID]",
-              "storage_root": null
-            },
-            "sensitive_attributes": [],
-            "private": "bnVsbA=="
-          }
-        ]
-      }
-    ],
-    "check_results": null
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/terraform auth/pat"
-    ]
-  },
-  "method": "POST",
-  "path": "/api/2.0/workspace/delete",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal",
-    "recursive": true
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/terraform auth/pat"
-    ]
-  },
-  "method": "POST",
-  "path": "/api/2.0/workspace/delete",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_deploy cmd-exec-id/[UUID] interactive/none engine/terraform auth/pat"
-    ]
-  },
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/artifacts/.internal"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]"
-    ]
-  },
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5 sdk/sdkv2 resource/schema auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.1/unity-catalog/schemas/mycatalog.myschema"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5 sdk/sdkv2 resource/schema auth/pat"
-    ]
-  },
-  "method": "POST",
-  "path": "/api/2.1/unity-catalog/schemas",
-  "body": {
-    "catalog_name": "mycatalog",
-    "name": "myschema"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5"
-    ]
-  },
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5"
-    ]
-  },
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5"
-    ]
-  },
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5"
-    ]
-  },
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
diff --git a/acceptance/bundle/user_agent/simple/out.requests.destroy.direct.json b/acceptance/bundle/user_agent/simple/out.requests.destroy.direct.json
deleted file mode 100644
index 24f3c5bf136..00000000000
--- a/acceptance/bundle/user_agent/simple/out.requests.destroy.direct.json
+++ /dev/null
@@ -1,156 +0,0 @@
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/preview/scim/v2/Me"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace-files/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/resources.json"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/resources.json",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
-    ]
-  },
-  "method": "DELETE",
-  "path": "/api/2.1/unity-catalog/schemas/mycatalog.myschema",
-  "q": {
-    "force": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/export",
-  "q": {
-    "direct_download": "true",
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.1/unity-catalog/schemas/mycatalog.myschema"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
-    ]
-  },
-  "method": "POST",
-  "path": "/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock",
-  "q": {
-    "overwrite": "false"
-  },
-  "body": {
-    "ID": "[UUID]",
-    "AcquisitionTime": "[TIMESTAMP]",
-    "IsForced": false,
-    "User": "[USERNAME]"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
-    ]
-  },
-  "method": "POST",
-  "path": "/api/2.0/workspace/delete",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default",
-    "recursive": true
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]"
-    ]
-  },
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
diff --git a/acceptance/bundle/user_agent/simple/out.requests.destroy.json b/acceptance/bundle/user_agent/simple/out.requests.destroy.json
new file mode 100644
index 00000000000..90328199953
--- /dev/null
+++ b/acceptance/bundle/user_agent/simple/out.requests.destroy.json
@@ -0,0 +1,157 @@
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/preview/scim/v2/Me"
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/workspace/export",
+  "q": {
+    "direct_download": "true",
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/resources.json"
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/workspace/export",
+  "q": {
+    "direct_download": "true",
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate"
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none engine/direct lineage/[LINEAGE_HASH] auth/pat"
+    ]
+  },
+  "method": "DELETE",
+  "path": "/api/2.1/unity-catalog/schemas/mycatalog.myschema",
+  "q": {
+    "force": "true"
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none engine/direct lineage/[LINEAGE_HASH] auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/workspace/export",
+  "q": {
+    "direct_download": "true",
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock"
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none engine/direct lineage/[LINEAGE_HASH] auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/workspace/get-status",
+  "q": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default"
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none engine/direct lineage/[LINEAGE_HASH] auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/workspace/get-status",
+  "q": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock",
+    "return_export_info": "true"
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none engine/direct lineage/[LINEAGE_HASH] auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/workspace/get-status",
+  "q": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock",
+    "return_export_info": "true"
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none engine/direct lineage/[LINEAGE_HASH] auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.1/unity-catalog/schemas/mycatalog.myschema"
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none engine/direct lineage/[LINEAGE_HASH] auth/pat"
+    ]
+  },
+  "method": "POST",
+  "path": "/api/2.0/workspace/delete",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle"
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none engine/direct lineage/[LINEAGE_HASH] auth/pat"
+    ]
+  },
+  "method": "POST",
+  "path": "/api/2.0/workspace/delete",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default",
+    "recursive": true
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none engine/direct lineage/[LINEAGE_HASH] auth/pat"
+    ]
+  },
+  "method": "POST",
+  "path": "/api/2.0/workspace/import",
+  "body": {
+    "multipart_form": {
+      "content": "{\"ID\":\"[UUID]\",\"AcquisitionTime\":\"[TIMESTAMP]\",\"IsForced\":false,\"User\":\"[USERNAME]\"}",
+      "format": "RAW",
+      "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock"
+    }
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]"
+    ]
+  },
+  "method": "GET",
+  "path": "/.well-known/databricks-config"
+}
diff --git a/acceptance/bundle/user_agent/simple/out.requests.destroy.terraform.json b/acceptance/bundle/user_agent/simple/out.requests.destroy.terraform.json
deleted file mode 100644
index f8ab210ec72..00000000000
--- a/acceptance/bundle/user_agent/simple/out.requests.destroy.terraform.json
+++ /dev/null
@@ -1,219 +0,0 @@
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/preview/scim/v2/Me"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace-files/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/resources.json",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none engine/terraform auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/export",
-  "q": {
-    "direct_download": "true",
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none engine/terraform auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none engine/terraform auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none engine/terraform auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none engine/terraform auth/pat"
-    ]
-  },
-  "method": "POST",
-  "path": "/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deploy.lock",
-  "q": {
-    "overwrite": "false"
-  },
-  "body": {
-    "ID": "[UUID]",
-    "AcquisitionTime": "[TIMESTAMP]",
-    "IsForced": false,
-    "User": "[USERNAME]"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_destroy cmd-exec-id/[UUID] interactive/none engine/terraform auth/pat"
-    ]
-  },
-  "method": "POST",
-  "path": "/api/2.0/workspace/delete",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default",
-    "recursive": true
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]"
-    ]
-  },
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5 sdk/sdkv2 resource/schema auth/pat"
-    ]
-  },
-  "method": "DELETE",
-  "path": "/api/2.1/unity-catalog/schemas/mycatalog.myschema",
-  "q": {
-    "force": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5 sdk/sdkv2 resource/schema auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.1/unity-catalog/current-metastore-assignment"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5 sdk/sdkv2 resource/schema auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.1/unity-catalog/schemas/mycatalog.myschema"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5"
-    ]
-  },
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5"
-    ]
-  },
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5"
-    ]
-  },
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5"
-    ]
-  },
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5"
-    ]
-  },
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5"
-    ]
-  },
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
diff --git a/acceptance/bundle/user_agent/simple/out.requests.plan.direct.json b/acceptance/bundle/user_agent/simple/out.requests.plan.direct.json
deleted file mode 100644
index 614f55e04a5..00000000000
--- a/acceptance/bundle/user_agent/simple/out.requests.plan.direct.json
+++ /dev/null
@@ -1,57 +0,0 @@
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/preview/scim/v2/Me"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/resources.json",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deployment.json",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]"
-    ]
-  },
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
diff --git a/acceptance/bundle/user_agent/simple/out.requests.plan.json b/acceptance/bundle/user_agent/simple/out.requests.plan.json
new file mode 100644
index 00000000000..8658a9f41f4
--- /dev/null
+++ b/acceptance/bundle/user_agent/simple/out.requests.plan.json
@@ -0,0 +1,57 @@
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/preview/scim/v2/Me"
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/workspace/export",
+  "q": {
+    "direct_download": "true",
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/resources.json"
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/workspace/export",
+  "q": {
+    "direct_download": "true",
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate"
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/workspace/export",
+  "q": {
+    "direct_download": "true",
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deployment.json"
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]"
+    ]
+  },
+  "method": "GET",
+  "path": "/.well-known/databricks-config"
+}
diff --git a/acceptance/bundle/user_agent/simple/out.requests.plan.terraform.json b/acceptance/bundle/user_agent/simple/out.requests.plan.terraform.json
deleted file mode 100644
index 11daf62e9ed..00000000000
--- a/acceptance/bundle/user_agent/simple/out.requests.plan.terraform.json
+++ /dev/null
@@ -1,75 +0,0 @@
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/preview/scim/v2/Me"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/resources.json",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none engine/terraform auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deployment.json",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]"
-    ]
-  },
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5"
-    ]
-  },
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5"
-    ]
-  },
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
diff --git a/acceptance/bundle/user_agent/simple/out.requests.plan2.direct.json b/acceptance/bundle/user_agent/simple/out.requests.plan2.direct.json
deleted file mode 100644
index 42543acc23d..00000000000
--- a/acceptance/bundle/user_agent/simple/out.requests.plan2.direct.json
+++ /dev/null
@@ -1,84 +0,0 @@
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/preview/scim/v2/Me"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace-files/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/resources.json"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/resources.json",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace-files/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deployment.json"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deployment.json",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.1/unity-catalog/schemas/mycatalog.myschema"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]"
-    ]
-  },
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
diff --git a/acceptance/bundle/user_agent/simple/out.requests.plan2.json b/acceptance/bundle/user_agent/simple/out.requests.plan2.json
new file mode 100644
index 00000000000..27810cf9e61
--- /dev/null
+++ b/acceptance/bundle/user_agent/simple/out.requests.plan2.json
@@ -0,0 +1,66 @@
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/preview/scim/v2/Me"
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/workspace/export",
+  "q": {
+    "direct_download": "true",
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/resources.json"
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/workspace/export",
+  "q": {
+    "direct_download": "true",
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate"
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none engine/direct lineage/[LINEAGE_HASH] auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/workspace/export",
+  "q": {
+    "direct_download": "true",
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deployment.json"
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none engine/direct lineage/[LINEAGE_HASH] auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.1/unity-catalog/schemas/mycatalog.myschema"
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]"
+    ]
+  },
+  "method": "GET",
+  "path": "/.well-known/databricks-config"
+}
diff --git a/acceptance/bundle/user_agent/simple/out.requests.plan2.terraform.json b/acceptance/bundle/user_agent/simple/out.requests.plan2.terraform.json
deleted file mode 100644
index 75f4620ef48..00000000000
--- a/acceptance/bundle/user_agent/simple/out.requests.plan2.terraform.json
+++ /dev/null
@@ -1,102 +0,0 @@
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/preview/scim/v2/Me"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace-files/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/resources.json",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none engine/terraform auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace-files/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deployment.json"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_plan cmd-exec-id/[UUID] interactive/none engine/terraform auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/deployment.json",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]"
-    ]
-  },
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5 sdk/sdkv2 resource/schema auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.1/unity-catalog/schemas/mycatalog.myschema"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5"
-    ]
-  },
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "databricks-tf-provider/1.113.0 databricks-sdk-go/[SDK_VERSION] go/1.24.0 os/[OS] cli/[DEV_VERSION] terraform/1.5.5"
-    ]
-  },
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
diff --git a/acceptance/bundle/user_agent/simple/out.requests.run.direct.json b/acceptance/bundle/user_agent/simple/out.requests.run.direct.json
deleted file mode 100644
index 86f7e607a2d..00000000000
--- a/acceptance/bundle/user_agent/simple/out.requests.run.direct.json
+++ /dev/null
@@ -1,53 +0,0 @@
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_run cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/preview/scim/v2/Me"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_run cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace-files/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/resources.json"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_run cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/resources.json",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_run cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]"
-    ]
-  },
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
diff --git a/acceptance/bundle/user_agent/simple/out.requests.run.json b/acceptance/bundle/user_agent/simple/out.requests.run.json
new file mode 100644
index 00000000000..ace799d7c7e
--- /dev/null
+++ b/acceptance/bundle/user_agent/simple/out.requests.run.json
@@ -0,0 +1,44 @@
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_run cmd-exec-id/[UUID] interactive/none auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/preview/scim/v2/Me"
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_run cmd-exec-id/[UUID] interactive/none auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/workspace/export",
+  "q": {
+    "direct_download": "true",
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/resources.json"
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_run cmd-exec-id/[UUID] interactive/none auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/workspace/export",
+  "q": {
+    "direct_download": "true",
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate"
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]"
+    ]
+  },
+  "method": "GET",
+  "path": "/.well-known/databricks-config"
+}
diff --git a/acceptance/bundle/user_agent/simple/out.requests.run.terraform.json b/acceptance/bundle/user_agent/simple/out.requests.run.terraform.json
deleted file mode 100644
index 62c5a994a1a..00000000000
--- a/acceptance/bundle/user_agent/simple/out.requests.run.terraform.json
+++ /dev/null
@@ -1,53 +0,0 @@
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_run cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/preview/scim/v2/Me"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_run cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace-files/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_run cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/resources.json",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_run cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]"
-    ]
-  },
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
diff --git a/acceptance/bundle/user_agent/simple/out.requests.summary.direct.json b/acceptance/bundle/user_agent/simple/out.requests.summary.direct.json
deleted file mode 100644
index 3a3e2db9e9a..00000000000
--- a/acceptance/bundle/user_agent/simple/out.requests.summary.direct.json
+++ /dev/null
@@ -1,44 +0,0 @@
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_summary cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/preview/scim/v2/Me"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_summary cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/resources.json",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_summary cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]"
-    ]
-  },
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
diff --git a/acceptance/bundle/user_agent/simple/out.requests.summary.json b/acceptance/bundle/user_agent/simple/out.requests.summary.json
new file mode 100644
index 00000000000..6182e907b70
--- /dev/null
+++ b/acceptance/bundle/user_agent/simple/out.requests.summary.json
@@ -0,0 +1,56 @@
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_summary cmd-exec-id/[UUID] interactive/none auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/preview/scim/v2/Me"
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_summary cmd-exec-id/[UUID] interactive/none auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/workspace/export",
+  "q": {
+    "direct_download": "true",
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/resources.json"
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_summary cmd-exec-id/[UUID] interactive/none auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/workspace/export",
+  "q": {
+    "direct_download": "true",
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate"
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_summary cmd-exec-id/[UUID] interactive/none engine/direct auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/preview/scim/v2/Me",
+  "q": {
+    "excludedAttributes": "entitlements"
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]"
+    ]
+  },
+  "method": "GET",
+  "path": "/.well-known/databricks-config"
+}
diff --git a/acceptance/bundle/user_agent/simple/out.requests.summary.terraform.json b/acceptance/bundle/user_agent/simple/out.requests.summary.terraform.json
deleted file mode 100644
index 3a3e2db9e9a..00000000000
--- a/acceptance/bundle/user_agent/simple/out.requests.summary.terraform.json
+++ /dev/null
@@ -1,44 +0,0 @@
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_summary cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/preview/scim/v2/Me"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_summary cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/resources.json",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_summary cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/state/terraform.tfstate",
-    "return_export_info": "true"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]"
-    ]
-  },
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
diff --git a/acceptance/bundle/user_agent/simple/out.requests.validate.direct.json b/acceptance/bundle/user_agent/simple/out.requests.validate.direct.json
deleted file mode 100644
index 8c64d6f74a5..00000000000
--- a/acceptance/bundle/user_agent/simple/out.requests.validate.direct.json
+++ /dev/null
@@ -1,54 +0,0 @@
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_validate cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/preview/scim/v2/Me"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_validate cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_validate cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_validate cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]"
-    ]
-  },
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
diff --git a/acceptance/bundle/user_agent/simple/out.requests.validate.json b/acceptance/bundle/user_agent/simple/out.requests.validate.json
new file mode 100644
index 00000000000..5750f79f473
--- /dev/null
+++ b/acceptance/bundle/user_agent/simple/out.requests.validate.json
@@ -0,0 +1,54 @@
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_validate cmd-exec-id/[UUID] interactive/none auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/preview/scim/v2/Me"
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_validate cmd-exec-id/[UUID] interactive/none auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/workspace/get-status",
+  "q": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files"
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_validate cmd-exec-id/[UUID] interactive/none auth/pat"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/workspace/get-status",
+  "q": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files"
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_validate cmd-exec-id/[UUID] interactive/none auth/pat"
+    ]
+  },
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs",
+  "body": {
+    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files"
+  }
+}
+{
+  "headers": {
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]"
+    ]
+  },
+  "method": "GET",
+  "path": "/.well-known/databricks-config"
+}
diff --git a/acceptance/bundle/user_agent/simple/out.requests.validate.terraform.json b/acceptance/bundle/user_agent/simple/out.requests.validate.terraform.json
deleted file mode 100644
index 8c64d6f74a5..00000000000
--- a/acceptance/bundle/user_agent/simple/out.requests.validate.terraform.json
+++ /dev/null
@@ -1,54 +0,0 @@
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_validate cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/preview/scim/v2/Me"
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_validate cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_validate cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/bundle_validate cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files"
-  }
-}
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]"
-    ]
-  },
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
diff --git a/acceptance/bundle/user_agent/simple/out.test.toml b/acceptance/bundle/user_agent/simple/out.test.toml
index f784a183258..19b5b15d11f 100644
--- a/acceptance/bundle/user_agent/simple/out.test.toml
+++ b/acceptance/bundle/user_agent/simple/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = [""]
diff --git a/acceptance/bundle/user_agent/simple/output.txt b/acceptance/bundle/user_agent/simple/output.txt
index 493c4f9f8f5..cd0e2103dad 100644
--- a/acceptance/bundle/user_agent/simple/output.txt
+++ b/acceptance/bundle/user_agent/simple/output.txt
@@ -33,9 +33,9 @@ Plan: 1 to add, 0 to change, 0 to delete, 0 unchanged
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Created schemas.foo
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> print_requests.py --sort --get ^//telemetry-ext
 
@@ -58,7 +58,6 @@ This action will result in the deletion of the following UC schemas. Any underly
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
 
 >>> print_requests.py --sort --get
diff --git a/acceptance/bundle/user_agent/simple/script b/acceptance/bundle/user_agent/simple/script
index b1458b4a4c5..e679cf6c21b 100644
--- a/acceptance/bundle/user_agent/simple/script
+++ b/acceptance/bundle/user_agent/simple/script
@@ -1,20 +1,21 @@
 trace $CLI bundle validate
-trace print_requests.py --sort --get > out.requests.validate.$DATABRICKS_BUNDLE_ENGINE.json
+trace print_requests.py --sort --get > out.requests.validate.json
 
 trace $CLI bundle summary
-trace print_requests.py --sort --get > out.requests.summary.$DATABRICKS_BUNDLE_ENGINE.json
+trace print_requests.py --sort --get > out.requests.summary.json
 
 trace $CLI bundle plan
-trace print_requests.py --sort --get > out.requests.plan.$DATABRICKS_BUNDLE_ENGINE.json
+trace print_requests.py --sort --get > out.requests.plan.json
 
 trace $CLI bundle deploy
-trace print_requests.py --sort --get '^//telemetry-ext' > out.requests.deploy.$DATABRICKS_BUNDLE_ENGINE.json
+read_lineage.py
+trace print_requests.py --sort --get '^//telemetry-ext' > out.requests.deploy.json
 
 trace $CLI bundle plan
-trace print_requests.py --sort --get > out.requests.plan2.$DATABRICKS_BUNDLE_ENGINE.json
+trace print_requests.py --sort --get > out.requests.plan2.json
 
 musterr trace $CLI bundle run foo
-trace print_requests.py --sort --get > out.requests.run.$DATABRICKS_BUNDLE_ENGINE.json
+trace print_requests.py --sort --get > out.requests.run.json
 
 trace $CLI bundle destroy --auto-approve
-trace print_requests.py --sort --get > out.requests.destroy.$DATABRICKS_BUNDLE_ENGINE.json
+trace print_requests.py --sort --get > out.requests.destroy.json
diff --git a/acceptance/bundle/user_agent/simple/test.toml b/acceptance/bundle/user_agent/simple/test.toml
index a5939ce5642..a92f32d6760 100644
--- a/acceptance/bundle/user_agent/simple/test.toml
+++ b/acceptance/bundle/user_agent/simple/test.toml
@@ -1,7 +1,3 @@
 RecordRequests = true
-Local = true
 IncludeRequestHeaders = ["User-Agent"]
 Ignore = [".databricks"]
-
-[EnvMatrix]
-DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/bundle/user_agent/test.toml b/acceptance/bundle/user_agent/test.toml
index a9f876b6b77..fc020a2b87b 100644
--- a/acceptance/bundle/user_agent/test.toml
+++ b/acceptance/bundle/user_agent/test.toml
@@ -1,7 +1,10 @@
 Phase = 1
 RecordRequests = true
-Local = true
 IncludeRequestHeaders = ["User-Agent"]
 
-[Env]
-DATABRICKS_CACHE_ENABLED = 'false'
+# This test asserts the User-Agent on every single request the CLI makes, so recording's
+# extra calls belong in the golden rather than being filtered out - but they are the same
+# header the existing requests already cover, so the DMS run only adds entries to maintain.
+EnvMatrix.DMS = [""]
+
+Env.DATABRICKS_CACHE_ENABLED = 'false'
diff --git a/acceptance/bundle/user_agent/verify.py b/acceptance/bundle/user_agent/verify.py
index 04be528c874..40cb1bcb1fb 100755
--- a/acceptance/bundle/user_agent/verify.py
+++ b/acceptance/bundle/user_agent/verify.py
@@ -3,13 +3,12 @@
 Summarize requests logs. For each log write OK if User-Agent has the right engine/ tag and MISS if not.
 """
 
-import os
-import sys
 import json
+import os
 import subprocess
+import sys
 from pathlib import Path
 
-
 TESTROOT = Path(os.environ["TESTROOT"])
 
 
@@ -22,12 +21,11 @@ def extract_engine(s):
 
 
 def check_user_agent(fname):
-    if ".terraform." in fname:
-        expected = "engine/terraform"
-    elif ".direct" in fname:
-        expected = "engine/direct"
-    else:
+    # The CI matrix no longer varies the engine, so the recorded-request files are no longer
+    # engine-suffixed; every deploy runs on the direct engine now.
+    if "out.requests." not in fname:
         return
+    expected = "engine/direct"
 
     printer = TESTROOT / "bin" / "print_requests.py"
 
diff --git a/acceptance/bundle/validate/app_resource_duplicate_name_location/databricks.yml b/acceptance/bundle/validate/app_resource_duplicate_name_location/databricks.yml
new file mode 100644
index 00000000000..7ae4a68fa02
--- /dev/null
+++ b/acceptance/bundle/validate/app_resource_duplicate_name_location/databricks.yml
@@ -0,0 +1,17 @@
+bundle:
+  name: test-bundle
+
+resources:
+  apps:
+    app:
+      name: test-app
+      source_code_path: .
+      resources:
+        - name: job
+          job:
+            id: "1"
+            permission: INVALID
+        - name: job
+          job:
+            id: "2"
+            permission: INVALID
diff --git a/acceptance/bundle/validate/app_resource_duplicate_name_location/out.test.toml b/acceptance/bundle/validate/app_resource_duplicate_name_location/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/app_resource_duplicate_name_location/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/app_resource_duplicate_name_location/output.txt b/acceptance/bundle/validate/app_resource_duplicate_name_location/output.txt
new file mode 100644
index 00000000000..a8eac9a3ace
--- /dev/null
+++ b/acceptance/bundle/validate/app_resource_duplicate_name_location/output.txt
@@ -0,0 +1,28 @@
+
+>>> [CLI] bundle validate
+Warning: invalid value "INVALID" for enum field. Valid values are [CAN_MANAGE CAN_MANAGE_RUN CAN_VIEW IS_OWNER]
+  at resources.apps.app.resources[0].job.permission
+  in databricks.yml:13:25
+
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Found 1 warning
+
+>>> [CLI] bundle validate -o json
+Warning: invalid value "INVALID" for enum field. Valid values are [CAN_MANAGE CAN_MANAGE_RUN CAN_VIEW IS_OWNER]
+  at resources.apps.app.resources[0].job.permission
+  in databricks.yml:13:25
+
+[
+  {
+    "job": {
+      "id": "2",
+      "permission": "INVALID"
+    },
+    "name": "job"
+  }
+]
diff --git a/acceptance/bundle/validate/app_resource_duplicate_name_location/script b/acceptance/bundle/validate/app_resource_duplicate_name_location/script
new file mode 100644
index 00000000000..3531c01dcef
--- /dev/null
+++ b/acceptance/bundle/validate/app_resource_duplicate_name_location/script
@@ -0,0 +1,5 @@
+# A diagnostic on a field of a duplicated app resource entry points at the first entry when the duplicate's value is the same.
+errcode trace $CLI bundle validate
+
+# The entries are merged by name, the later one wins.
+trace $CLI bundle validate -o json | jq .resources.apps.app.resources
diff --git a/acceptance/bundle/validate/catalog_requires_direct_mode/databricks.yml b/acceptance/bundle/validate/catalog_requires_direct_mode/databricks.yml
deleted file mode 100644
index d215964bb77..00000000000
--- a/acceptance/bundle/validate/catalog_requires_direct_mode/databricks.yml
+++ /dev/null
@@ -1,8 +0,0 @@
-bundle:
-  name: "catalog_validation_test"
-
-resources:
-  catalogs:
-    test_catalog:
-      name: "test_catalog"
-      comment: "This should fail in Terraform mode"
diff --git a/acceptance/bundle/validate/catalog_requires_direct_mode/out.test.toml b/acceptance/bundle/validate/catalog_requires_direct_mode/out.test.toml
deleted file mode 100644
index 65156e0457c..00000000000
--- a/acceptance/bundle/validate/catalog_requires_direct_mode/out.test.toml
+++ /dev/null
@@ -1,3 +0,0 @@
-Local = true
-Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform"]
diff --git a/acceptance/bundle/validate/catalog_requires_direct_mode/output.txt b/acceptance/bundle/validate/catalog_requires_direct_mode/output.txt
deleted file mode 100644
index 2bddbc154b0..00000000000
--- a/acceptance/bundle/validate/catalog_requires_direct_mode/output.txt
+++ /dev/null
@@ -1,8 +0,0 @@
-Error: Catalog resources are only supported with direct deployment mode
-  in databricks.yml:6:5
-
-Catalog resources require direct deployment mode. Please set the DATABRICKS_BUNDLE_ENGINE environment variable to 'direct' to use catalog resources.
-Learn more at https://docs.databricks.com/dev-tools/bundles/direct
-
-
-Exit code: 1
diff --git a/acceptance/bundle/validate/catalog_requires_direct_mode/script b/acceptance/bundle/validate/catalog_requires_direct_mode/script
deleted file mode 100755
index b260e836a71..00000000000
--- a/acceptance/bundle/validate/catalog_requires_direct_mode/script
+++ /dev/null
@@ -1 +0,0 @@
-$CLI bundle plan
diff --git a/acceptance/bundle/validate/catalog_requires_direct_mode/test.toml b/acceptance/bundle/validate/catalog_requires_direct_mode/test.toml
deleted file mode 100644
index f59176e360b..00000000000
--- a/acceptance/bundle/validate/catalog_requires_direct_mode/test.toml
+++ /dev/null
@@ -1,7 +0,0 @@
-Local = true
-Cloud = false
-
-Ignore = [".databricks"]
-
-[EnvMatrix]
-  DATABRICKS_BUNDLE_ENGINE = ["terraform"]
diff --git a/acceptance/bundle/validate/compute_id_location/databricks.yml b/acceptance/bundle/validate/compute_id_location/databricks.yml
new file mode 100644
index 00000000000..b6a32c6c39c
--- /dev/null
+++ b/acceptance/bundle/validate/compute_id_location/databricks.yml
@@ -0,0 +1,9 @@
+bundle:
+  name: test-bundle
+  compute_id: root-cluster
+
+targets:
+  dev:
+    compute_id: dev-cluster
+  other:
+    default: true
diff --git a/acceptance/bundle/validate/compute_id_location/out.test.toml b/acceptance/bundle/validate/compute_id_location/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/compute_id_location/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/compute_id_location/output.txt b/acceptance/bundle/validate/compute_id_location/output.txt
new file mode 100644
index 00000000000..559b500c30a
--- /dev/null
+++ b/acceptance/bundle/validate/compute_id_location/output.txt
@@ -0,0 +1,36 @@
+
+=== default target without compute_id
+>>> [CLI] bundle validate
+Warning: compute_id is deprecated, please use cluster_id instead
+  at bundle.compute_id
+  in databricks.yml:3:15
+
+Warning: compute_id is deprecated, please use cluster_id instead
+  at targets.dev.compute_id
+  in databricks.yml:7:17
+
+Name: test-bundle
+Target: other
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/other
+
+Found 2 warnings
+
+=== target with compute_id
+>>> [CLI] bundle validate -t dev
+Warning: compute_id is deprecated, please use cluster_id instead
+  at bundle.compute_id
+  in databricks.yml:3:15
+
+Warning: compute_id is deprecated, please use cluster_id instead
+  at targets.dev.compute_id
+  in databricks.yml:7:17
+
+Name: test-bundle
+Target: dev
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/dev
+
+Found 2 warnings
diff --git a/acceptance/bundle/validate/compute_id_location/script b/acceptance/bundle/validate/compute_id_location/script
new file mode 100644
index 00000000000..44c1cf2f4ba
--- /dev/null
+++ b/acceptance/bundle/validate/compute_id_location/script
@@ -0,0 +1,5 @@
+title "default target without compute_id"
+trace $CLI bundle validate
+
+title "target with compute_id"
+trace $CLI bundle validate -t dev
diff --git a/acceptance/bundle/validate/compute_id_location/test.toml b/acceptance/bundle/validate/compute_id_location/test.toml
new file mode 100644
index 00000000000..efba9a37db6
--- /dev/null
+++ b/acceptance/bundle/validate/compute_id_location/test.toml
@@ -0,0 +1 @@
+Badness = "A target-level compute_id is reported even when that target is not selected: the deprecation is rewritten for every target before target selection."
diff --git a/acceptance/bundle/validate/dashboard_defaults/out.test.toml b/acceptance/bundle/validate/dashboard_defaults/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/validate/dashboard_defaults/out.test.toml
+++ b/acceptance/bundle/validate/dashboard_defaults/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/dashboard_key_special_chars/databricks.yml b/acceptance/bundle/validate/dashboard_key_special_chars/databricks.yml
new file mode 100644
index 00000000000..b052b780d11
--- /dev/null
+++ b/acceptance/bundle/validate/dashboard_key_special_chars/databricks.yml
@@ -0,0 +1,14 @@
+bundle:
+  name: test-bundle
+
+targets:
+  bracket:
+    resources:
+      dashboards:
+        "reports[":
+          serialized_dashboard: "{}"
+  comma:
+    resources:
+      dashboards:
+        "a,b":
+          serialized_dashboard: "{}"
diff --git a/acceptance/bundle/validate/dashboard_key_special_chars/out.test.toml b/acceptance/bundle/validate/dashboard_key_special_chars/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/dashboard_key_special_chars/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/dashboard_key_special_chars/output.txt b/acceptance/bundle/validate/dashboard_key_special_chars/output.txt
new file mode 100644
index 00000000000..7c66843a334
--- /dev/null
+++ b/acceptance/bundle/validate/dashboard_key_special_chars/output.txt
@@ -0,0 +1,38 @@
+
+>>> [CLI] bundle validate -t bracket
+Error: dashboard display_name is required
+  at resources.dashboards['reports[']
+  in databricks.yml:9:11
+
+Error: dashboard warehouse_id is required
+  at resources.dashboards['reports[']
+  in databricks.yml:9:11
+
+Name: test-bundle
+Target: bracket
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/bracket
+
+Found 2 errors
+
+Exit code: 1
+
+>>> [CLI] bundle validate -t comma
+Error: dashboard display_name is required
+  at resources.dashboards['a,b']
+  in databricks.yml:14:11
+
+Error: dashboard warehouse_id is required
+  at resources.dashboards['a,b']
+  in databricks.yml:14:11
+
+Name: test-bundle
+Target: comma
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/comma
+
+Found 2 errors
+
+Exit code: 1
diff --git a/acceptance/bundle/validate/dashboard_key_special_chars/script b/acceptance/bundle/validate/dashboard_key_special_chars/script
new file mode 100644
index 00000000000..85c1fa07a03
--- /dev/null
+++ b/acceptance/bundle/validate/dashboard_key_special_chars/script
@@ -0,0 +1,9 @@
+# Dashboards missing display_name / warehouse_id must be reported even when the
+# resource key contains characters that are path syntax ("[", ","). The required-field
+# check looks the dashboard up by path, so a key that does not survive being turned
+# into a path string would silently drop these errors.
+#
+# Each key is in its own target: with both in one config the errors are reported in
+# a nondeterministic order.
+errcode trace $CLI bundle validate -t bracket
+errcode trace $CLI bundle validate -t comma
diff --git a/acceptance/bundle/validate/dashboard_required_name/out.test.toml b/acceptance/bundle/validate/dashboard_required_name/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/validate/dashboard_required_name/out.test.toml
+++ b/acceptance/bundle/validate/dashboard_required_name/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/dashboard_required_warehouse_id/out.test.toml b/acceptance/bundle/validate/dashboard_required_warehouse_id/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/validate/dashboard_required_warehouse_id/out.test.toml
+++ b/acceptance/bundle/validate/dashboard_required_warehouse_id/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/definitions_yaml_anchors/out.test.toml b/acceptance/bundle/validate/definitions_yaml_anchors/out.test.toml
deleted file mode 100644
index f784a183258..00000000000
--- a/acceptance/bundle/validate/definitions_yaml_anchors/out.test.toml
+++ /dev/null
@@ -1,3 +0,0 @@
-Local = true
-Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/bundle/validate/duplicate_yaml_merge_key/out.test.toml b/acceptance/bundle/validate/duplicate_yaml_merge_key/out.test.toml
deleted file mode 100644
index f784a183258..00000000000
--- a/acceptance/bundle/validate/duplicate_yaml_merge_key/out.test.toml
+++ /dev/null
@@ -1,3 +0,0 @@
-Local = true
-Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/bundle/validate/empty_resources/empty_def/out.test.toml b/acceptance/bundle/validate/empty_resources/empty_def/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/validate/empty_resources/empty_def/out.test.toml
+++ b/acceptance/bundle/validate/empty_resources/empty_def/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/empty_resources/empty_dict/out.test.toml b/acceptance/bundle/validate/empty_resources/empty_dict/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/validate/empty_resources/empty_dict/out.test.toml
+++ b/acceptance/bundle/validate/empty_resources/empty_dict/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/empty_resources/empty_dict/output.txt b/acceptance/bundle/validate/empty_resources/empty_dict/output.txt
index efbf60ca1ae..0ff8111602e 100644
--- a/acceptance/bundle/validate/empty_resources/empty_dict/output.txt
+++ b/acceptance/bundle/validate/empty_resources/empty_dict/output.txt
@@ -109,6 +109,7 @@ Warning: required field "schema_name" is not set
 {
   "volumes": {
     "rname": {
+      "volume_path": "/Volumes///",
       "volume_type": "MANAGED"
     }
   }
@@ -160,6 +161,10 @@ app resource 'rname' should have either source_code_path or git_source field
 }
 
 === resources.sql_warehouses.rname ===
+Error: sql_warehouse name is required
+  at resources.sql_warehouses.rname
+  in databricks.yml:6:12
+
 {
   "sql_warehouses": {
     "rname": {
diff --git a/acceptance/bundle/validate/empty_resources/null/out.test.toml b/acceptance/bundle/validate/empty_resources/null/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/validate/empty_resources/null/out.test.toml
+++ b/acceptance/bundle/validate/empty_resources/null/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/empty_resources/with_grants/out.test.toml b/acceptance/bundle/validate/empty_resources/with_grants/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/validate/empty_resources/with_grants/out.test.toml
+++ b/acceptance/bundle/validate/empty_resources/with_grants/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/empty_resources/with_grants/output.txt b/acceptance/bundle/validate/empty_resources/with_grants/output.txt
index e9d371b33d5..38c4dc55d19 100644
--- a/acceptance/bundle/validate/empty_resources/with_grants/output.txt
+++ b/acceptance/bundle/validate/empty_resources/with_grants/output.txt
@@ -134,6 +134,7 @@ Warning: required field "schema_name" is not set
   "volumes": {
     "rname": {
       "grants": [],
+      "volume_path": "/Volumes///",
       "volume_type": "MANAGED"
     }
   }
@@ -201,6 +202,10 @@ Warning: unknown field: grants
   at resources.sql_warehouses.rname
   in databricks.yml:7:7
 
+Error: sql_warehouse name is required
+  at resources.sql_warehouses.rname
+  in databricks.yml:7:7
+
 {
   "sql_warehouses": {
     "rname": {
diff --git a/acceptance/bundle/validate/empty_resources/with_permissions/out.test.toml b/acceptance/bundle/validate/empty_resources/with_permissions/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/validate/empty_resources/with_permissions/out.test.toml
+++ b/acceptance/bundle/validate/empty_resources/with_permissions/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/empty_resources/with_permissions/output.txt b/acceptance/bundle/validate/empty_resources/with_permissions/output.txt
index 28957886423..cef0b18baa3 100644
--- a/acceptance/bundle/validate/empty_resources/with_permissions/output.txt
+++ b/acceptance/bundle/validate/empty_resources/with_permissions/output.txt
@@ -125,6 +125,7 @@ Warning: required field "schema_name" is not set
 {
   "volumes": {
     "rname": {
+      "volume_path": "/Volumes///",
       "volume_type": "MANAGED"
     }
   }
@@ -176,6 +177,10 @@ app resource 'rname' should have either source_code_path or git_source field
 }
 
 === resources.sql_warehouses.rname ===
+Error: sql_warehouse name is required
+  at resources.sql_warehouses.rname
+  in databricks.yml:7:7
+
 {
   "sql_warehouses": {
     "rname": {
diff --git a/acceptance/bundle/validate/empty_tasks/databricks.yml b/acceptance/bundle/validate/empty_tasks/databricks.yml
new file mode 100644
index 00000000000..50865a75a65
--- /dev/null
+++ b/acceptance/bundle/validate/empty_tasks/databricks.yml
@@ -0,0 +1,16 @@
+bundle:
+  name: empty_tasks
+
+resources:
+  jobs:
+    empty_tasks:
+      name: job with empty tasks
+      tasks:
+    valid:
+      name: valid job
+      tasks:
+        - task_key: t
+          sql_task:
+            warehouse_id: w123
+            query:
+              query_id: abc
diff --git a/acceptance/bundle/validate/empty_tasks/out.test.toml b/acceptance/bundle/validate/empty_tasks/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/empty_tasks/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/empty_tasks/output.txt b/acceptance/bundle/validate/empty_tasks/output.txt
new file mode 100644
index 00000000000..36e6a7e63a8
--- /dev/null
+++ b/acceptance/bundle/validate/empty_tasks/output.txt
@@ -0,0 +1,42 @@
+
+>>> [CLI] bundle validate -o json
+{
+  "empty_tasks": {
+    "deployment": {
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/empty_tasks/default/state/metadata.json"
+    },
+    "edit_mode": "UI_LOCKED",
+    "format": "MULTI_TASK",
+    "max_concurrent_runs": 1,
+    "name": "job with empty tasks",
+    "queue": {
+      "enabled": true
+    },
+    "tasks": null
+  },
+  "valid": {
+    "deployment": {
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/empty_tasks/default/state/metadata.json"
+    },
+    "edit_mode": "UI_LOCKED",
+    "format": "MULTI_TASK",
+    "max_concurrent_runs": 1,
+    "name": "valid job",
+    "queue": {
+      "enabled": true
+    },
+    "tasks": [
+      {
+        "sql_task": {
+          "query": {
+            "query_id": "abc"
+          },
+          "warehouse_id": "w123"
+        },
+        "task_key": "t"
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/validate/empty_tasks/script b/acceptance/bundle/validate/empty_tasks/script
new file mode 100644
index 00000000000..350756f76d0
--- /dev/null
+++ b/acceptance/bundle/validate/empty_tasks/script
@@ -0,0 +1 @@
+trace $CLI bundle validate -o json | jq .resources.jobs
diff --git a/acceptance/bundle/validate/engine-config-valid/out.test.toml b/acceptance/bundle/validate/engine-config-valid/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/validate/engine-config-valid/out.test.toml
+++ b/acceptance/bundle/validate/engine-config-valid/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/engine-config-valid/output.txt b/acceptance/bundle/validate/engine-config-valid/output.txt
index e07d8c553f2..e3b138ac1ce 100644
--- a/acceptance/bundle/validate/engine-config-valid/output.txt
+++ b/acceptance/bundle/validate/engine-config-valid/output.txt
@@ -8,11 +8,26 @@ Workspace:
 
 Validation OK!
 
->>> [CLI] bundle validate -t terraform-target
+>>> musterr [CLI] bundle validate -t terraform-target
+Error: the Terraform deployment engine has been removed in Databricks CLI v1.20.0
+  in databricks.yml:10:15
+
+Remove the "bundle.engine" setting (or set it to "direct") to deploy with the direct engine; existing Terraform state is migrated automatically. To keep using Terraform, revert to Databricks CLI v1.19.x.
+See https://docs.databricks.com/dev-tools/bundles/direct for details
+
 Name: test-engine-config-valid
 Target: terraform-target
-Workspace:
-  User: [USERNAME]
-  Path: /Workspace/Users/[USERNAME]/.bundle/test-engine-config-valid/terraform-target
 
-Validation OK!
+Found 1 error
+
+>>> musterr [CLI] bundle validate -t terraform-target
+Error: the Terraform deployment engine has been removed in Databricks CLI v1.20.0
+  in databricks.yml:10:15
+
+Remove the "bundle.engine" setting (or set it to "direct") to deploy with the direct engine; existing Terraform state is migrated automatically. To keep using Terraform, revert to Databricks CLI v1.19.x.
+See https://docs.databricks.com/dev-tools/bundles/direct for details
+
+Name: test-engine-config-valid
+Target: terraform-target
+
+Found 1 error
diff --git a/acceptance/bundle/validate/engine-config-valid/script b/acceptance/bundle/validate/engine-config-valid/script
index aa3ad1dd318..e42a2846147 100644
--- a/acceptance/bundle/validate/engine-config-valid/script
+++ b/acceptance/bundle/validate/engine-config-valid/script
@@ -1,2 +1,6 @@
 trace $CLI bundle validate
-trace $CLI bundle validate -t terraform-target
+# engine: terraform was removed in v1.20.0, so the terraform-target now fails validation.
+trace musterr $CLI bundle validate -t terraform-target
+
+# bundle.engine takes priority over the env var, so the error names the config setting even when both say terraform.
+DATABRICKS_BUNDLE_ENGINE=terraform trace musterr $CLI bundle validate -t terraform-target
diff --git a/acceptance/bundle/validate/enum/out.test.toml b/acceptance/bundle/validate/enum/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/validate/enum/out.test.toml
+++ b/acceptance/bundle/validate/enum/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/enum_resource_refs/out.test.toml b/acceptance/bundle/validate/enum_resource_refs/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/validate/enum_resource_refs/out.test.toml
+++ b/acceptance/bundle/validate/enum_resource_refs/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/genie_space_complex/databricks.yml b/acceptance/bundle/validate/genie_space_complex/databricks.yml
new file mode 100644
index 00000000000..94c5fc7188c
--- /dev/null
+++ b/acceptance/bundle/validate/genie_space_complex/databricks.yml
@@ -0,0 +1,51 @@
+bundle:
+  name: genie-space-complex
+
+workspace:
+  resource_path: /foo/bar
+
+resources:
+  genie_spaces:
+    # Test with all features enabled
+    full_featured:
+      warehouse_id: "my-warehouse-1234"
+      title: "Full Featured Genie Space"
+      description: "A comprehensive test of all genie space features"
+      file_path: ./full_featured.geniespace.json
+
+    # Test with inline serialized_space (YAML syntax)
+    inline_yaml:
+      warehouse_id: "my-warehouse-1234"
+      title: "Inline YAML Genie Space"
+      serialized_space:
+        version: 1
+        data_sources:
+          tables:
+            - identifier: main.schema.table1
+              column_configs:
+                - column_name: id
+                  get_example_values: true
+                  build_value_dictionary: true
+                - column_name: name
+                  get_example_values: true
+        instructions:
+          text_instructions:
+            - id: inst-001
+              content:
+                - "This is a text instruction.\n"
+                - "It spans multiple lines."
+          example_question_sqls:
+            - id: eq-001
+              question:
+                - "How many records are there?"
+              sql:
+                - "SELECT COUNT(*) FROM main.schema.table1"
+
+    # Test with empty but valid structure
+    minimal_valid:
+      warehouse_id: "my-warehouse-1234"
+      title: "Minimal Valid"
+      serialized_space:
+        version: 1
+        data_sources:
+          tables: []
diff --git a/acceptance/bundle/validate/genie_space_complex/full_featured.geniespace.json b/acceptance/bundle/validate/genie_space_complex/full_featured.geniespace.json
new file mode 100644
index 00000000000..9c9221d8328
--- /dev/null
+++ b/acceptance/bundle/validate/genie_space_complex/full_featured.geniespace.json
@@ -0,0 +1,160 @@
+{
+  "version": 1,
+  "config": {
+    "sample_questions": [
+      {
+        "id": "sq-001",
+        "question": ["What is the total revenue?"]
+      },
+      {
+        "id": "sq-002",
+        "question": ["Show me the top customers"]
+      }
+    ]
+  },
+  "data_sources": {
+    "tables": [
+      {
+        "identifier": "main.sales.orders",
+        "column_configs": [
+          {
+            "column_name": "order_id",
+            "get_example_values": true,
+            "build_value_dictionary": true
+          },
+          {
+            "column_name": "customer_id",
+            "get_example_values": true
+          },
+          {
+            "column_name": "amount",
+            "get_example_values": false
+          }
+        ]
+      },
+      {
+        "identifier": "main.sales.customers"
+      }
+    ]
+  },
+  "instructions": {
+    "text_instructions": [
+      {
+        "id": "ti-001",
+        "content": [
+          "This genie space analyzes sales data.\n",
+          "Always filter by date when querying orders.\n",
+          "Use customer_name instead of customer_id in results."
+        ]
+      }
+    ],
+    "example_question_sqls": [
+      {
+        "id": "eq-001",
+        "question": ["What are the top customers by revenue?"],
+        "sql": [
+          "SELECT\n",
+          "  c.customer_name,\n",
+          "  SUM(o.amount) AS total_revenue\n",
+          "FROM main.sales.orders o\n",
+          "JOIN main.sales.customers c ON o.customer_id = c.id\n",
+          "WHERE o.order_date >= :start_date\n",
+          "GROUP BY c.customer_name\n",
+          "ORDER BY total_revenue DESC\n",
+          "LIMIT :limit"
+        ],
+        "parameters": [
+          {
+            "name": "start_date",
+            "type_hint": "STRING",
+            "description": ["Start date for the analysis period"],
+            "default_value": {
+              "values": ["2024-01-01"]
+            }
+          },
+          {
+            "name": "limit",
+            "type_hint": "INTEGER",
+            "description": ["Number of customers to return"],
+            "default_value": {
+              "values": ["10"]
+            }
+          }
+        ]
+      },
+      {
+        "id": "eq-002",
+        "question": ["Calculate daily revenue"],
+        "sql": [
+          "SELECT\n",
+          "  order_date,\n",
+          "  SUM(amount) AS daily_revenue\n",
+          "FROM main.sales.orders\n",
+          "GROUP BY order_date\n",
+          "ORDER BY order_date"
+        ]
+      }
+    ],
+    "sql_snippets": {
+      "measures": [
+        {
+          "id": "m-001",
+          "alias": "total_revenue",
+          "sql": ["SUM(orders.amount)"],
+          "display_name": "Total Revenue"
+        },
+        {
+          "id": "m-002",
+          "alias": "order_count",
+          "sql": ["COUNT(orders.order_id)"],
+          "display_name": "Order Count"
+        }
+      ]
+    },
+    "sql_functions": [
+      {
+        "id": "sf-001",
+        "identifier": "main.analytics.calculate_churn"
+      }
+    ]
+  },
+  "benchmarks": {
+    "questions": [
+      {
+        "id": "bq-001",
+        "question": ["What is the monthly revenue trend?"],
+        "answer": [
+          {
+            "format": "SQL",
+            "content": [
+              "SELECT\n",
+              "  DATE_TRUNC('month', order_date) AS month,\n",
+              "  SUM(amount) AS revenue\n",
+              "FROM main.sales.orders\n",
+              "GROUP BY 1\n",
+              "ORDER BY 1"
+            ]
+          }
+        ]
+      },
+      {
+        "id": "bq-002",
+        "question": ["Which customers have the highest average order value?"],
+        "answer": [
+          {
+            "format": "SQL",
+            "content": [
+              "SELECT\n",
+              "  customer_id,\n",
+              "  AVG(amount) AS avg_order_value\n",
+              "FROM main.sales.orders\n",
+              "GROUP BY customer_id\n",
+              "ORDER BY avg_order_value DESC\n",
+              "LIMIT 10"
+            ]
+          }
+        ]
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/validate/genie_space_complex/out.test.toml b/acceptance/bundle/validate/genie_space_complex/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/genie_space_complex/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/genie_space_complex/output.txt b/acceptance/bundle/validate/genie_space_complex/output.txt
new file mode 100644
index 00000000000..4a0747210cc
--- /dev/null
+++ b/acceptance/bundle/validate/genie_space_complex/output.txt
@@ -0,0 +1,22 @@
+{
+  "full_featured": {
+    "title": "Full Featured Genie Space",
+    "warehouse_id": "my-warehouse-1234",
+    "serialized_space_is_string": true
+  },
+  "inline_yaml": {
+    "title": "Inline YAML Genie Space",
+    "serialized_space_type": "string",
+    "parsed": {
+      "tables_count": 1,
+      "has_column_configs": true,
+      "has_text_instructions": true
+    }
+  },
+  "minimal_valid": {
+    "title": "Minimal Valid",
+    "parsed": {
+      "tables_count": 0
+    }
+  }
+}
diff --git a/acceptance/bundle/validate/genie_space_complex/script b/acceptance/bundle/validate/genie_space_complex/script
new file mode 100644
index 00000000000..4feab1e373b
--- /dev/null
+++ b/acceptance/bundle/validate/genie_space_complex/script
@@ -0,0 +1,26 @@
+# Validate complex genie spaces. ConfigureGenieSpaceSerializedSpace
+# normalizes inline serialized_space YAML to a JSON string so the field has
+# the same shape as the file_path code path; the script parses the JSON
+# back to verify that the original structure is preserved.
+$CLI bundle validate -o json | jq '{
+  full_featured: .resources.genie_spaces.full_featured | {
+    title,
+    warehouse_id,
+    serialized_space_is_string: (.serialized_space | type == "string")
+  },
+  inline_yaml: .resources.genie_spaces.inline_yaml | {
+    title,
+    serialized_space_type: (.serialized_space | type),
+    parsed: (.serialized_space | fromjson) | {
+      tables_count: (.data_sources.tables | length),
+      has_column_configs: ((.data_sources.tables[0].column_configs | length) > 0),
+      has_text_instructions: ((.instructions.text_instructions | length) > 0)
+    }
+  },
+  minimal_valid: .resources.genie_spaces.minimal_valid | {
+    title,
+    parsed: (.serialized_space | fromjson) | {
+      tables_count: (.data_sources.tables | length)
+    }
+  }
+}'
diff --git a/acceptance/bundle/validate/genie_space_defaults/databricks.yml b/acceptance/bundle/validate/genie_space_defaults/databricks.yml
new file mode 100644
index 00000000000..7e4b87d35e6
--- /dev/null
+++ b/acceptance/bundle/validate/genie_space_defaults/databricks.yml
@@ -0,0 +1,30 @@
+bundle:
+  name: test-bundle
+
+workspace:
+  resource_path: /foo/bar
+
+resources:
+  genie_spaces:
+    empty_string:
+      warehouse_id: "my-warehouse-1234"
+      title: "empty-string"
+      serialized_space: "{}"
+
+      # unchanged
+      parent_path: ""
+
+    non_empty_string:
+      warehouse_id: "my-warehouse-1234"
+      title: "non-empty-string"
+      serialized_space: "{}"
+
+      # unchanged
+      parent_path: "already-set"
+
+    default_parent_path:
+      warehouse_id: "my-warehouse-1234"
+      title: "default-parent-path"
+      serialized_space: "{}"
+
+      # parent_path set to default
diff --git a/acceptance/bundle/validate/genie_space_defaults/out.test.toml b/acceptance/bundle/validate/genie_space_defaults/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/genie_space_defaults/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/genie_space_defaults/output.txt b/acceptance/bundle/validate/genie_space_defaults/output.txt
new file mode 100644
index 00000000000..13105c91b76
--- /dev/null
+++ b/acceptance/bundle/validate/genie_space_defaults/output.txt
@@ -0,0 +1,14 @@
+{
+  "default_parent_path": {
+    "title": "default-parent-path",
+    "parent_path": "/Workspace/foo/bar"
+  },
+  "empty_string": {
+    "title": "empty-string",
+    "parent_path": "/Workspace"
+  },
+  "non_empty_string": {
+    "title": "non-empty-string",
+    "parent_path": "/Workspace/already-set"
+  }
+}
diff --git a/acceptance/bundle/validate/genie_space_defaults/script b/acceptance/bundle/validate/genie_space_defaults/script
new file mode 100644
index 00000000000..eebc582f136
--- /dev/null
+++ b/acceptance/bundle/validate/genie_space_defaults/script
@@ -0,0 +1 @@
+$CLI bundle validate -o json | jq '.resources.genie_spaces | map_values({title: .title, parent_path: .parent_path})'
diff --git a/acceptance/bundle/validate/genie_space_file_path_and_inline/contents.geniespace.json b/acceptance/bundle/validate/genie_space_file_path_and_inline/contents.geniespace.json
new file mode 100644
index 00000000000..cb608f6e9c4
--- /dev/null
+++ b/acceptance/bundle/validate/genie_space_file_path_and_inline/contents.geniespace.json
@@ -0,0 +1 @@
+{"version": 1}
diff --git a/acceptance/bundle/validate/genie_space_file_path_and_inline/databricks.yml b/acceptance/bundle/validate/genie_space_file_path_and_inline/databricks.yml
new file mode 100644
index 00000000000..ca57e978d83
--- /dev/null
+++ b/acceptance/bundle/validate/genie_space_file_path_and_inline/databricks.yml
@@ -0,0 +1,11 @@
+bundle:
+  name: genie-space-file-path-and-inline
+
+resources:
+  genie_spaces:
+    both_set:
+      title: "Both set"
+      warehouse_id: "test-warehouse-id"
+      file_path: "./contents.geniespace.json"
+      serialized_space:
+        version: 1
diff --git a/acceptance/bundle/validate/genie_space_file_path_and_inline/out.test.toml b/acceptance/bundle/validate/genie_space_file_path_and_inline/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/genie_space_file_path_and_inline/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/genie_space_file_path_and_inline/output.txt b/acceptance/bundle/validate/genie_space_file_path_and_inline/output.txt
new file mode 100644
index 00000000000..97a3b452a17
--- /dev/null
+++ b/acceptance/bundle/validate/genie_space_file_path_and_inline/output.txt
@@ -0,0 +1,12 @@
+
+>>> [CLI] bundle validate
+Error: both file_path and serialized_space are set; specify only one
+  in databricks.yml:11:9
+
+Name: genie-space-file-path-and-inline
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/genie-space-file-path-and-inline/default
+
+Found 1 error
diff --git a/acceptance/bundle/validate/genie_space_file_path_and_inline/script b/acceptance/bundle/validate/genie_space_file_path_and_inline/script
new file mode 100644
index 00000000000..277355fe918
--- /dev/null
+++ b/acceptance/bundle/validate/genie_space_file_path_and_inline/script
@@ -0,0 +1 @@
+musterr trace $CLI bundle validate
diff --git a/acceptance/bundle/validate/genie_space_file_path_and_inline/test.toml b/acceptance/bundle/validate/genie_space_file_path_and_inline/test.toml
new file mode 100644
index 00000000000..d4476c35182
--- /dev/null
+++ b/acceptance/bundle/validate/genie_space_file_path_and_inline/test.toml
@@ -0,0 +1,4 @@
+Cloud = false
+
+# Genie spaces only support direct deployment engine.
+Env.DATABRICKS_BUNDLE_ENGINE = "direct"
diff --git a/acceptance/bundle/validate/grants_required_principal/databricks.yml b/acceptance/bundle/validate/grants_required_principal/databricks.yml
new file mode 100644
index 00000000000..9db93a59066
--- /dev/null
+++ b/acceptance/bundle/validate/grants_required_principal/databricks.yml
@@ -0,0 +1,20 @@
+bundle:
+  name: test-bundle
+
+resources:
+  catalogs:
+    my_catalog:
+      name: my_catalog
+      grants:
+        # Missing principal: rejected.
+        - privileges:
+            - ALL_PRIVILEGES
+  schemas:
+    my_schema:
+      catalog_name: my_catalog
+      name: my_schema
+      grants:
+        # Valid grant (principal set).
+        - principal: alice@example.com
+          privileges:
+            - USE_SCHEMA
diff --git a/acceptance/bundle/validate/grants_required_principal/out.test.toml b/acceptance/bundle/validate/grants_required_principal/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/grants_required_principal/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/grants_required_principal/output.txt b/acceptance/bundle/validate/grants_required_principal/output.txt
new file mode 100644
index 00000000000..3e838701d52
--- /dev/null
+++ b/acceptance/bundle/validate/grants_required_principal/output.txt
@@ -0,0 +1,21 @@
+
+>>> [CLI] bundle validate
+Error: grant principal is required
+  at resources.catalogs.my_catalog.grants[0]
+  in databricks.yml:10:11
+
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Found 1 error
+
+>>> [CLI] bundle deploy
+Error: grant principal is required
+  at resources.catalogs.my_catalog.grants[0]
+  in databricks.yml:10:11
+
+
+>>> print_requests.py //unity-catalog
diff --git a/acceptance/bundle/validate/grants_required_principal/script b/acceptance/bundle/validate/grants_required_principal/script
new file mode 100644
index 00000000000..7a50a4a6021
--- /dev/null
+++ b/acceptance/bundle/validate/grants_required_principal/script
@@ -0,0 +1,7 @@
+musterr trace $CLI bundle validate
+
+# Deploy must abort at validation: no securable is created, so no partial deploy.
+musterr trace $CLI bundle deploy
+trace print_requests.py //unity-catalog
+
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/validate/grants_required_principal/test.toml b/acceptance/bundle/validate/grants_required_principal/test.toml
new file mode 100644
index 00000000000..b8dcf0b131e
--- /dev/null
+++ b/acceptance/bundle/validate/grants_required_principal/test.toml
@@ -0,0 +1,3 @@
+RecordRequests = true
+
+# Catalogs and schemas are only supported by the direct engine.
diff --git a/acceptance/bundle/validate/immutable_folder_permissions/databricks.yml b/acceptance/bundle/validate/immutable_folder_permissions/databricks.yml
new file mode 100644
index 00000000000..9d9cb5407eb
--- /dev/null
+++ b/acceptance/bundle/validate/immutable_folder_permissions/databricks.yml
@@ -0,0 +1,9 @@
+bundle:
+  name: my-bundle
+
+experimental:
+  immutable_folder: true
+
+permissions:
+  - level: CAN_VIEW
+    user_name: viewer@example.com
diff --git a/acceptance/bundle/validate/immutable_folder_permissions/out.test.toml b/acceptance/bundle/validate/immutable_folder_permissions/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/immutable_folder_permissions/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/immutable_folder_permissions/output.txt b/acceptance/bundle/validate/immutable_folder_permissions/output.txt
new file mode 100644
index 00000000000..73c193f0520
--- /dev/null
+++ b/acceptance/bundle/validate/immutable_folder_permissions/output.txt
@@ -0,0 +1,21 @@
+
+>>> [CLI] bundle validate
+Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
+If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
+
+Consider using a adding a top-level permissions section such as the following:
+
+  permissions:
+    - user_name: [USERNAME]
+      level: CAN_MANAGE
+
+See https://docs.databricks.com/dev-tools/bundles/permissions.html to learn more about permission configuration.
+  in databricks.yml:8:3
+
+Name: my-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/my-bundle/default
+
+Found 1 recommendation
diff --git a/acceptance/bundle/validate/immutable_folder_permissions/script b/acceptance/bundle/validate/immutable_folder_permissions/script
new file mode 100644
index 00000000000..408f51f529f
--- /dev/null
+++ b/acceptance/bundle/validate/immutable_folder_permissions/script
@@ -0,0 +1,3 @@
+# file_path and artifact_path point into the snapshot, which does not exist until deploy,
+# so validate must not check their folder permissions.
+trace $CLI bundle validate
diff --git a/acceptance/bundle/validate/immutable_folder_permissions/test.toml b/acceptance/bundle/validate/immutable_folder_permissions/test.toml
new file mode 100644
index 00000000000..8f238a7f609
--- /dev/null
+++ b/acceptance/bundle/validate/immutable_folder_permissions/test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+Ignore = [".databricks"]
diff --git a/acceptance/bundle/validate/immutable_workspace_paths/databricks.yml b/acceptance/bundle/validate/immutable_workspace_paths/databricks.yml
new file mode 100644
index 00000000000..997dc455b8f
--- /dev/null
+++ b/acceptance/bundle/validate/immutable_workspace_paths/databricks.yml
@@ -0,0 +1,23 @@
+bundle:
+  name: my-bundle
+
+experimental:
+  immutable_folder: true
+
+resources:
+  jobs:
+    my_job:
+      name: my job
+      tasks:
+        - task_key: my_task
+          existing_cluster_id: "0101-120000-aaaaaaaa"
+          spark_python_task:
+            python_file: ./src/main.py
+        - task_key: my_ai_runtime_task
+          ai_runtime_task:
+            experiment: my-experiment
+            deployments:
+              - command_path: ./src/main.py
+                compute:
+                  accelerator_type: GPU_1xA10
+                  accelerator_count: 1
diff --git a/acceptance/bundle/validate/immutable_workspace_paths/out.test.toml b/acceptance/bundle/validate/immutable_workspace_paths/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/immutable_workspace_paths/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/immutable_workspace_paths/output.txt b/acceptance/bundle/validate/immutable_workspace_paths/output.txt
new file mode 100644
index 00000000000..2da05989620
--- /dev/null
+++ b/acceptance/bundle/validate/immutable_workspace_paths/output.txt
@@ -0,0 +1,41 @@
+
+>>> [CLI] bundle validate -o json
+{
+  "workspace": {
+    "artifact_path": "${resources.internal_immutable_snapshots.immutable.full_path}/artifacts",
+    "current_user": {
+      "domain_friendly_name": "[USERNAME]",
+      "id": "[USERID]",
+      "short_name": "[USERNAME]",
+      "userName": "[USERNAME]"
+    },
+    "file_path": "${resources.internal_immutable_snapshots.immutable.full_path}/files",
+    "resource_path": "/Workspace/Users/[USERNAME]/.bundle/my-bundle/default/resources",
+    "root_path": "/Workspace/Users/[USERNAME]/.bundle/my-bundle/default",
+    "state_path": "/Workspace/Users/[USERNAME]/.bundle/my-bundle/default/state"
+  },
+  "tasks": [
+    {
+      "ai_runtime_task": {
+        "deployments": [
+          {
+            "command_path": "${resources.internal_immutable_snapshots.immutable.full_path}/files/src/main.py",
+            "compute": {
+              "accelerator_count": 1,
+              "accelerator_type": "GPU_1xA10"
+            }
+          }
+        ],
+        "experiment": "my-experiment"
+      },
+      "task_key": "my_ai_runtime_task"
+    },
+    {
+      "existing_cluster_id": "0101-120000-aaaaaaaa",
+      "spark_python_task": {
+        "python_file": "${resources.internal_immutable_snapshots.immutable.full_path}/files/src/main.py"
+      },
+      "task_key": "my_task"
+    }
+  ]
+}
diff --git a/acceptance/bundle/validate/immutable_workspace_paths/script b/acceptance/bundle/validate/immutable_workspace_paths/script
new file mode 100644
index 00000000000..df056fa9b99
--- /dev/null
+++ b/acceptance/bundle/validate/immutable_workspace_paths/script
@@ -0,0 +1 @@
+trace $CLI bundle validate -o json | jq '{workspace: .workspace, tasks: .resources.jobs.my_job.tasks}'
diff --git a/acceptance/bundle/validate/immutable_workspace_paths/src/main.py b/acceptance/bundle/validate/immutable_workspace_paths/src/main.py
new file mode 100644
index 00000000000..11b15b1a458
--- /dev/null
+++ b/acceptance/bundle/validate/immutable_workspace_paths/src/main.py
@@ -0,0 +1 @@
+print("hello")
diff --git a/acceptance/bundle/validate/immutable_workspace_paths/test.toml b/acceptance/bundle/validate/immutable_workspace_paths/test.toml
new file mode 100644
index 00000000000..8f238a7f609
--- /dev/null
+++ b/acceptance/bundle/validate/immutable_workspace_paths/test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+Ignore = [".databricks"]
diff --git a/acceptance/bundle/validate/include_locations/out.test.toml b/acceptance/bundle/validate/include_locations/out.test.toml
deleted file mode 100644
index f784a183258..00000000000
--- a/acceptance/bundle/validate/include_locations/out.test.toml
+++ /dev/null
@@ -1,3 +0,0 @@
-Local = true
-Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/bundle/validate/includes/clears_unforced_preset_values/databricks.yml b/acceptance/bundle/validate/includes/clears_unforced_preset_values/databricks.yml
new file mode 100644
index 00000000000..0a6c0479fee
--- /dev/null
+++ b/acceptance/bundle/validate/includes/clears_unforced_preset_values/databricks.yml
@@ -0,0 +1,15 @@
+bundle:
+  name: test-bundle
+
+include:
+  - override.yml
+
+presets:
+  name_prefix: "base-"
+  jobs_max_concurrent_runs: 7
+  artifacts_dynamic_version: true
+
+resources:
+  jobs:
+    j:
+      name: job
diff --git a/acceptance/bundle/validate/includes/clears_unforced_preset_values/out.test.toml b/acceptance/bundle/validate/includes/clears_unforced_preset_values/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/includes/clears_unforced_preset_values/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/includes/clears_unforced_preset_values/output.txt b/acceptance/bundle/validate/includes/clears_unforced_preset_values/output.txt
new file mode 100644
index 00000000000..a2e1bac25ce
--- /dev/null
+++ b/acceptance/bundle/validate/includes/clears_unforced_preset_values/output.txt
@@ -0,0 +1,13 @@
+
+>>> [CLI] bundle validate -o json
+{
+  "presets": {
+    "artifacts_dynamic_version": false,
+    "jobs_max_concurrent_runs": 0,
+    "name_prefix": ""
+  },
+  "job": {
+    "name": "job",
+    "max_concurrent_runs": 1
+  }
+}
diff --git a/acceptance/bundle/validate/includes/clears_unforced_preset_values/override.yml b/acceptance/bundle/validate/includes/clears_unforced_preset_values/override.yml
new file mode 100644
index 00000000000..dc413ce0648
--- /dev/null
+++ b/acceptance/bundle/validate/includes/clears_unforced_preset_values/override.yml
@@ -0,0 +1,4 @@
+presets:
+  name_prefix: ""
+  jobs_max_concurrent_runs: 0
+  artifacts_dynamic_version: false
diff --git a/acceptance/bundle/validate/includes/clears_unforced_preset_values/script b/acceptance/bundle/validate/includes/clears_unforced_preset_values/script
new file mode 100644
index 00000000000..c8d6c1aace9
--- /dev/null
+++ b/acceptance/bundle/validate/includes/clears_unforced_preset_values/script
@@ -0,0 +1,2 @@
+# An include can override fields with "", 0 and false.
+trace $CLI bundle validate -o json | jq '{presets, job: (.resources.jobs.j | {name, max_concurrent_runs})}'
diff --git a/acceptance/bundle/validate/include_locations/databricks.yml b/acceptance/bundle/validate/includes/locations/databricks.yml
similarity index 100%
rename from acceptance/bundle/validate/include_locations/databricks.yml
rename to acceptance/bundle/validate/includes/locations/databricks.yml
diff --git a/acceptance/bundle/validate/includes/locations/out.test.toml b/acceptance/bundle/validate/includes/locations/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/includes/locations/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/include_locations/output.dev.json b/acceptance/bundle/validate/includes/locations/output.dev.json
similarity index 100%
rename from acceptance/bundle/validate/include_locations/output.dev.json
rename to acceptance/bundle/validate/includes/locations/output.dev.json
diff --git a/acceptance/bundle/validate/include_locations/output.prod.json b/acceptance/bundle/validate/includes/locations/output.prod.json
similarity index 100%
rename from acceptance/bundle/validate/include_locations/output.prod.json
rename to acceptance/bundle/validate/includes/locations/output.prod.json
diff --git a/acceptance/bundle/validate/include_locations/output.txt b/acceptance/bundle/validate/includes/locations/output.txt
similarity index 100%
rename from acceptance/bundle/validate/include_locations/output.txt
rename to acceptance/bundle/validate/includes/locations/output.txt
diff --git a/acceptance/bundle/validate/include_locations/override.yml b/acceptance/bundle/validate/includes/locations/override.yml
similarity index 100%
rename from acceptance/bundle/validate/include_locations/override.yml
rename to acceptance/bundle/validate/includes/locations/override.yml
diff --git a/acceptance/bundle/validate/include_locations/resources/job.yml b/acceptance/bundle/validate/includes/locations/resources/job.yml
similarity index 100%
rename from acceptance/bundle/validate/include_locations/resources/job.yml
rename to acceptance/bundle/validate/includes/locations/resources/job.yml
diff --git a/acceptance/bundle/validate/include_locations/script b/acceptance/bundle/validate/includes/locations/script
similarity index 100%
rename from acceptance/bundle/validate/include_locations/script
rename to acceptance/bundle/validate/includes/locations/script
diff --git a/acceptance/bundle/validate/include_locations/src/dev.py b/acceptance/bundle/validate/includes/locations/src/dev.py
similarity index 100%
rename from acceptance/bundle/validate/include_locations/src/dev.py
rename to acceptance/bundle/validate/includes/locations/src/dev.py
diff --git a/acceptance/bundle/validate/include_locations/src/prod.py b/acceptance/bundle/validate/includes/locations/src/prod.py
similarity index 100%
rename from acceptance/bundle/validate/include_locations/src/prod.py
rename to acceptance/bundle/validate/includes/locations/src/prod.py
diff --git a/acceptance/bundle/validate/includes/merge_failure_short_circuits_diagnostics/a.yml b/acceptance/bundle/validate/includes/merge_failure_short_circuits_diagnostics/a.yml
new file mode 100644
index 00000000000..5a6fbc1e893
--- /dev/null
+++ b/acceptance/bundle/validate/includes/merge_failure_short_circuits_diagnostics/a.yml
@@ -0,0 +1,3 @@
+variables:
+  x:
+    default: incompatible-scalar
diff --git a/acceptance/bundle/validate/includes/merge_failure_short_circuits_diagnostics/b.yml b/acceptance/bundle/validate/includes/merge_failure_short_circuits_diagnostics/b.yml
new file mode 100644
index 00000000000..61f0de50e9e
--- /dev/null
+++ b/acceptance/bundle/validate/includes/merge_failure_short_circuits_diagnostics/b.yml
@@ -0,0 +1,2 @@
+bundle:
+  unexpected_after_failure: true
diff --git a/acceptance/bundle/validate/includes/merge_failure_short_circuits_diagnostics/databricks.yml b/acceptance/bundle/validate/includes/merge_failure_short_circuits_diagnostics/databricks.yml
new file mode 100644
index 00000000000..fdd8bfa87b3
--- /dev/null
+++ b/acceptance/bundle/validate/includes/merge_failure_short_circuits_diagnostics/databricks.yml
@@ -0,0 +1,12 @@
+bundle:
+  name: test-bundle
+
+include:
+  - a.yml
+  - b.yml
+
+variables:
+  x:
+    type: complex
+    default:
+      key: value
diff --git a/acceptance/bundle/validate/includes/merge_failure_short_circuits_diagnostics/out.test.toml b/acceptance/bundle/validate/includes/merge_failure_short_circuits_diagnostics/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/includes/merge_failure_short_circuits_diagnostics/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/includes/merge_failure_short_circuits_diagnostics/output.txt b/acceptance/bundle/validate/includes/merge_failure_short_circuits_diagnostics/output.txt
new file mode 100644
index 00000000000..f5f6443e809
--- /dev/null
+++ b/acceptance/bundle/validate/includes/merge_failure_short_circuits_diagnostics/output.txt
@@ -0,0 +1,9 @@
+
+>>> [CLI] bundle validate
+Error: cannot merge map with string
+
+Name: test-bundle
+
+Found 1 error
+
+Exit code: 1
diff --git a/acceptance/bundle/validate/includes/merge_failure_short_circuits_diagnostics/script b/acceptance/bundle/validate/includes/merge_failure_short_circuits_diagnostics/script
new file mode 100644
index 00000000000..6f34e8010d2
--- /dev/null
+++ b/acceptance/bundle/validate/includes/merge_failure_short_circuits_diagnostics/script
@@ -0,0 +1,2 @@
+# Includes after one that fails to merge do not report their diagnostics.
+errcode trace $CLI bundle validate
diff --git a/acceptance/bundle/validate/includes/merge_failure_short_circuits_diagnostics/test.toml b/acceptance/bundle/validate/includes/merge_failure_short_circuits_diagnostics/test.toml
new file mode 100644
index 00000000000..b11d0b76cd4
--- /dev/null
+++ b/acceptance/bundle/validate/includes/merge_failure_short_circuits_diagnostics/test.toml
@@ -0,0 +1 @@
+Badness = "The merge error has no location or path, and diagnostics of includes loaded after the failed merge (the unknown field in b.yml) are not reported, although they do not depend on the merge."
diff --git a/acceptance/bundle/validate/invalid-engine-bundle/out.test.toml b/acceptance/bundle/validate/invalid-engine-bundle/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/validate/invalid-engine-bundle/out.test.toml
+++ b/acceptance/bundle/validate/invalid-engine-bundle/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/invalid-engine-bundle/output.txt b/acceptance/bundle/validate/invalid-engine-bundle/output.txt
index 8784614498a..e76e18b693b 100644
--- a/acceptance/bundle/validate/invalid-engine-bundle/output.txt
+++ b/acceptance/bundle/validate/invalid-engine-bundle/output.txt
@@ -1,6 +1,6 @@
 
 >>> [CLI] bundle validate
-Error: invalid value "invalid_engine" for bundle.engine (expected "terraform" or "direct")
+Error: invalid value "invalid_engine" for bundle.engine (expected "direct")
   in databricks.yml:3:11
 
 Name: test-engine-config
diff --git a/acceptance/bundle/validate/invalid-engine-target/out.test.toml b/acceptance/bundle/validate/invalid-engine-target/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/validate/invalid-engine-target/out.test.toml
+++ b/acceptance/bundle/validate/invalid-engine-target/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/invalid-engine-target/output.txt b/acceptance/bundle/validate/invalid-engine-target/output.txt
index f0607b47c3e..c44d9dea7b6 100644
--- a/acceptance/bundle/validate/invalid-engine-target/output.txt
+++ b/acceptance/bundle/validate/invalid-engine-target/output.txt
@@ -1,6 +1,6 @@
 
 >>> [CLI] bundle validate
-Error: invalid value "invalid_engine" for bundle.engine (expected "terraform" or "direct")
+Error: invalid value "invalid_engine" for bundle.engine (expected "direct")
   in databricks.yml:7:15
 
 Name: test-engine-config
diff --git a/acceptance/bundle/validate/job-references/out.test.toml b/acceptance/bundle/validate/job-references/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/validate/job-references/out.test.toml
+++ b/acceptance/bundle/validate/job-references/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/lifecycle_override/databricks.yml b/acceptance/bundle/validate/lifecycle_override/databricks.yml
new file mode 100644
index 00000000000..242874319d3
--- /dev/null
+++ b/acceptance/bundle/validate/lifecycle_override/databricks.yml
@@ -0,0 +1,33 @@
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    j:
+      name: job
+      tasks:
+        - task_key: task
+          notebook_task:
+            notebook_path: /notebook
+      lifecycle:
+        prevent_destroy: true
+
+  clusters:
+    c:
+      spark_version: "15.4.x-scala2.12"
+      node_type_id: "i3.xlarge"
+      num_workers: 2
+      lifecycle:
+        prevent_destroy: true
+
+targets:
+  dev:
+    resources:
+      jobs:
+        j:
+          lifecycle:
+            prevent_destroy: false
+      clusters:
+        c:
+          lifecycle:
+            prevent_destroy: false
diff --git a/acceptance/bundle/validate/lifecycle_override/out.test.toml b/acceptance/bundle/validate/lifecycle_override/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/lifecycle_override/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/lifecycle_override/output.txt b/acceptance/bundle/validate/lifecycle_override/output.txt
new file mode 100644
index 00000000000..6062c603c5c
--- /dev/null
+++ b/acceptance/bundle/validate/lifecycle_override/output.txt
@@ -0,0 +1,6 @@
+
+>>> [CLI] bundle validate -t dev -o json
+{
+  "job_prevent_destroy": false,
+  "cluster_prevent_destroy": false
+}
diff --git a/acceptance/bundle/validate/lifecycle_override/script b/acceptance/bundle/validate/lifecycle_override/script
new file mode 100644
index 00000000000..12de3d7d803
--- /dev/null
+++ b/acceptance/bundle/validate/lifecycle_override/script
@@ -0,0 +1,2 @@
+# The target override prevent_destroy: false wins over the base prevent_destroy: true
+trace $CLI bundle validate -t dev -o json | jq '{job_prevent_destroy: .resources.jobs.j.lifecycle.prevent_destroy, cluster_prevent_destroy: .resources.clusters.c.lifecycle.prevent_destroy}'
diff --git a/acceptance/bundle/validate/model_serving_both_fields_error/out.test.toml b/acceptance/bundle/validate/model_serving_both_fields_error/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/validate/model_serving_both_fields_error/out.test.toml
+++ b/acceptance/bundle/validate/model_serving_both_fields_error/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/model_serving_conversion/out.test.toml b/acceptance/bundle/validate/model_serving_conversion/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/validate/model_serving_conversion/out.test.toml
+++ b/acceptance/bundle/validate/model_serving_conversion/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/models/missing_name/out.test.toml b/acceptance/bundle/validate/models/missing_name/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/validate/models/missing_name/out.test.toml
+++ b/acceptance/bundle/validate/models/missing_name/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/models/user_id/out.test.toml b/acceptance/bundle/validate/models/user_id/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/validate/models/user_id/out.test.toml
+++ b/acceptance/bundle/validate/models/user_id/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/no_dashboard_etag/out.test.toml b/acceptance/bundle/validate/no_dashboard_etag/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/validate/no_dashboard_etag/out.test.toml
+++ b/acceptance/bundle/validate/no_dashboard_etag/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/no_genie_space_etag/databricks.yml b/acceptance/bundle/validate/no_genie_space_etag/databricks.yml
new file mode 100644
index 00000000000..846608ec580
--- /dev/null
+++ b/acceptance/bundle/validate/no_genie_space_etag/databricks.yml
@@ -0,0 +1,10 @@
+bundle:
+  name: test-bundle
+
+resources:
+  genie_spaces:
+    foobar:
+      title: foobar
+      etag: "1234567890"
+      warehouse_id: "my-warehouse-1234"
+      serialized_space: "{}"
diff --git a/acceptance/bundle/validate/no_genie_space_etag/out.test.toml b/acceptance/bundle/validate/no_genie_space_etag/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/no_genie_space_etag/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/no_genie_space_etag/output.txt b/acceptance/bundle/validate/no_genie_space_etag/output.txt
new file mode 100644
index 00000000000..7598e08e3b0
--- /dev/null
+++ b/acceptance/bundle/validate/no_genie_space_etag/output.txt
@@ -0,0 +1,13 @@
+
+>>> [CLI] bundle validate
+Error: genie space "foobar" has an etag set. Etags must not be set in bundle configuration
+  at resources.genie_spaces.foobar
+  in databricks.yml:7:7
+
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Found 1 error
diff --git a/acceptance/bundle/validate/no_genie_space_etag/script b/acceptance/bundle/validate/no_genie_space_etag/script
new file mode 100644
index 00000000000..277355fe918
--- /dev/null
+++ b/acceptance/bundle/validate/no_genie_space_etag/script
@@ -0,0 +1 @@
+musterr trace $CLI bundle validate
diff --git a/acceptance/bundle/validate/nulls/resources_container/databricks.yml b/acceptance/bundle/validate/nulls/resources_container/databricks.yml
new file mode 100644
index 00000000000..339364daf47
--- /dev/null
+++ b/acceptance/bundle/validate/nulls/resources_container/databricks.yml
@@ -0,0 +1,4 @@
+bundle:
+  name: test-bundle
+
+resources: null
diff --git a/acceptance/bundle/validate/nulls/resources_container/out.test.toml b/acceptance/bundle/validate/nulls/resources_container/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/nulls/resources_container/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/nulls/resources_container/output.txt b/acceptance/bundle/validate/nulls/resources_container/output.txt
new file mode 100644
index 00000000000..1241151fda5
--- /dev/null
+++ b/acceptance/bundle/validate/nulls/resources_container/output.txt
@@ -0,0 +1,9 @@
+
+>>> [CLI] bundle validate
+Error: expected a map at "resources", found nil
+
+Name: test-bundle
+
+Found 1 error
+
+Exit code: 1
diff --git a/acceptance/bundle/validate/nulls/resources_container/script b/acceptance/bundle/validate/nulls/resources_container/script
new file mode 100644
index 00000000000..253cc3d205d
--- /dev/null
+++ b/acceptance/bundle/validate/nulls/resources_container/script
@@ -0,0 +1,2 @@
+# resources: null is rejected.
+errcode trace $CLI bundle validate
diff --git a/acceptance/bundle/validate/nulls/resources_container/test.toml b/acceptance/bundle/validate/nulls/resources_container/test.toml
new file mode 100644
index 00000000000..022e0f2c7e9
--- /dev/null
+++ b/acceptance/bundle/validate/nulls/resources_container/test.toml
@@ -0,0 +1 @@
+Badness = 'An empty (null) resources section is an error without a location, while empty targets, variables or sync sections are accepted.'
diff --git a/acceptance/bundle/validate/nulls/schedule_default_materialization/databricks.yml b/acceptance/bundle/validate/nulls/schedule_default_materialization/databricks.yml
new file mode 100644
index 00000000000..d68996de3ce
--- /dev/null
+++ b/acceptance/bundle/validate/nulls/schedule_default_materialization/databricks.yml
@@ -0,0 +1,8 @@
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    j:
+      name: test
+      schedule: null
diff --git a/acceptance/bundle/validate/nulls/schedule_default_materialization/out.test.toml b/acceptance/bundle/validate/nulls/schedule_default_materialization/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/nulls/schedule_default_materialization/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/nulls/schedule_default_materialization/output.txt b/acceptance/bundle/validate/nulls/schedule_default_materialization/output.txt
new file mode 100644
index 00000000000..8cc844569f5
--- /dev/null
+++ b/acceptance/bundle/validate/nulls/schedule_default_materialization/output.txt
@@ -0,0 +1,13 @@
+
+>>> [CLI] bundle validate -o json
+Warning: required field "quartz_cron_expression" is not set
+  at resources.jobs.j.schedule
+  in databricks.yml:8:17
+
+Warning: required field "timezone_id" is not set
+  at resources.jobs.j.schedule
+  in databricks.yml:8:17
+
+{
+  "schedule": null
+}
diff --git a/acceptance/bundle/validate/nulls/schedule_default_materialization/script b/acceptance/bundle/validate/nulls/schedule_default_materialization/script
new file mode 100644
index 00000000000..0c5e31164ff
--- /dev/null
+++ b/acceptance/bundle/validate/nulls/schedule_default_materialization/script
@@ -0,0 +1,2 @@
+# Defaults are not applied under an explicitly null block (schedule stays null).
+trace $CLI bundle validate -o json | jq '.resources.jobs.j | {schedule}'
diff --git a/acceptance/bundle/validate/nulls/schedule_default_materialization/test.toml b/acceptance/bundle/validate/nulls/schedule_default_materialization/test.toml
new file mode 100644
index 00000000000..68e81befdb7
--- /dev/null
+++ b/acceptance/bundle/validate/nulls/schedule_default_materialization/test.toml
@@ -0,0 +1 @@
+Badness = 'An explicitly null schedule is reported as missing its required fields.'
diff --git a/acceptance/bundle/validate/override_effective_location/databricks.yml b/acceptance/bundle/validate/override_effective_location/databricks.yml
new file mode 100644
index 00000000000..65bb7a5bd13
--- /dev/null
+++ b/acceptance/bundle/validate/override_effective_location/databricks.yml
@@ -0,0 +1,21 @@
+bundle:
+  name: test-bundle
+  engine: direct
+
+presets:
+  trigger_pause_status: PAUSED
+  name_prefix: "${workspace.current_user.short_name}_"
+
+targets:
+  bad_engine:
+    bundle:
+      engine: invalid_value
+  dev_trigger:
+    mode: development
+    default: true
+    presets:
+      trigger_pause_status: UNPAUSED
+  dev_prefix:
+    mode: development
+    presets:
+      name_prefix: nouser_
diff --git a/acceptance/bundle/validate/override_effective_location/out.test.toml b/acceptance/bundle/validate/override_effective_location/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/override_effective_location/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/override_effective_location/output.txt b/acceptance/bundle/validate/override_effective_location/output.txt
new file mode 100644
index 00000000000..e3fa5193367
--- /dev/null
+++ b/acceptance/bundle/validate/override_effective_location/output.txt
@@ -0,0 +1,42 @@
+
+=== engine overridden in target
+>>> [CLI] bundle validate -t bad_engine
+Error: invalid value "invalid_value" for bundle.engine (expected "direct")
+  in databricks.yml:12:15
+
+Name: test-bundle
+Target: bad_engine
+
+Found 1 error
+
+Exit code: 1
+
+=== trigger_pause_status overridden in development target
+>>> [CLI] bundle validate -t dev_trigger
+Error: target with 'mode: development' cannot set trigger pause status to UNPAUSED by default
+  in databricks.yml:17:29
+
+Name: test-bundle
+Target: dev_trigger
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/dev_trigger
+
+Found 1 error
+
+Exit code: 1
+
+=== name_prefix overridden in development target
+>>> [CLI] bundle validate -t dev_prefix
+Error: prefix should contain the current username or ${workspace.current_user.short_name} to ensure uniqueness when using 'mode: development'
+  in databricks.yml:21:20
+
+Name: test-bundle
+Target: dev_prefix
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/dev_prefix
+
+Found 1 error
+
+Exit code: 1
diff --git a/acceptance/bundle/validate/override_effective_location/script b/acceptance/bundle/validate/override_effective_location/script
new file mode 100644
index 00000000000..b3ebee43c0f
--- /dev/null
+++ b/acceptance/bundle/validate/override_effective_location/script
@@ -0,0 +1,8 @@
+title "engine overridden in target"
+errcode trace $CLI bundle validate -t bad_engine
+
+title "trigger_pause_status overridden in development target"
+errcode trace $CLI bundle validate -t dev_trigger
+
+title "name_prefix overridden in development target"
+errcode trace $CLI bundle validate -t dev_prefix
diff --git a/acceptance/bundle/validate/permissions/out.test.toml b/acceptance/bundle/validate/permissions/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/validate/permissions/out.test.toml
+++ b/acceptance/bundle/validate/permissions/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/permissions_overlap/databricks.yml b/acceptance/bundle/validate/permissions_overlap/databricks.yml
new file mode 100644
index 00000000000..fe7c061a1f2
--- /dev/null
+++ b/acceptance/bundle/validate/permissions_overlap/databricks.yml
@@ -0,0 +1,27 @@
+bundle:
+  name: test-bundle
+
+permissions:
+  - level: CAN_MANAGE
+    user_name: overlap@example.com
+  - level: CAN_VIEW
+    group_name: some_group
+
+resources:
+  jobs:
+    overlapping_job:
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: /Workspace/Users/user@example.com/notebook
+            source: WORKSPACE
+      permissions:
+        - level: CAN_VIEW
+          user_name: overlap@example.com
+
+    other_job:
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: /Workspace/Users/user@example.com/notebook
+            source: WORKSPACE
diff --git a/acceptance/bundle/validate/permissions_overlap/out.test.toml b/acceptance/bundle/validate/permissions_overlap/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/permissions_overlap/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/permissions_overlap/output.txt b/acceptance/bundle/validate/permissions_overlap/output.txt
new file mode 100644
index 00000000000..43b95ddd440
--- /dev/null
+++ b/acceptance/bundle/validate/permissions_overlap/output.txt
@@ -0,0 +1,44 @@
+Warning: 'jobs' already has permissions set for 'overlap@example.com' user name
+
+Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
+If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
+
+Consider using a adding a top-level permissions section such as the following:
+
+  permissions:
+    - user_name: [USERNAME]
+      level: CAN_MANAGE
+
+See https://docs.databricks.com/dev-tools/bundles/permissions.html to learn more about permission configuration.
+  in databricks.yml:5:3
+
+{
+  "other_job": [
+    {
+      "level": "CAN_MANAGE",
+      "user_name": "overlap@example.com"
+    },
+    {
+      "group_name": "some_group",
+      "level": "CAN_VIEW"
+    },
+    {
+      "level": "IS_OWNER",
+      "user_name": "[USERNAME]"
+    }
+  ],
+  "overlapping_job": [
+    {
+      "level": "CAN_VIEW",
+      "user_name": "overlap@example.com"
+    },
+    {
+      "group_name": "some_group",
+      "level": "CAN_VIEW"
+    },
+    {
+      "level": "IS_OWNER",
+      "user_name": "[USERNAME]"
+    }
+  ]
+}
diff --git a/acceptance/bundle/validate/permissions_overlap/script b/acceptance/bundle/validate/permissions_overlap/script
new file mode 100644
index 00000000000..da6c2e46463
--- /dev/null
+++ b/acceptance/bundle/validate/permissions_overlap/script
@@ -0,0 +1 @@
+$CLI bundle validate -o json | jq '.resources.jobs | map_values(.permissions)'
diff --git a/acceptance/bundle/validate/pipeline_development_reference/databricks.yml b/acceptance/bundle/validate/pipeline_development_reference/databricks.yml
new file mode 100644
index 00000000000..59bf09ca3d5
--- /dev/null
+++ b/acceptance/bundle/validate/pipeline_development_reference/databricks.yml
@@ -0,0 +1,10 @@
+bundle:
+  name: test-bundle
+
+resources:
+  pipelines:
+    other:
+      name: other
+    main:
+      name: main
+      development: ${resources.pipelines.other.development}
diff --git a/acceptance/bundle/validate/pipeline_development_reference/out.test.toml b/acceptance/bundle/validate/pipeline_development_reference/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/pipeline_development_reference/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/pipeline_development_reference/output.txt b/acceptance/bundle/validate/pipeline_development_reference/output.txt
new file mode 100644
index 00000000000..f808fa83528
--- /dev/null
+++ b/acceptance/bundle/validate/pipeline_development_reference/output.txt
@@ -0,0 +1,14 @@
+
+>>> [CLI] bundle validate
+Warning: The "development" property of pipelines is deprecated. Use "mode: development" in your databricks.yml instead. See https://docs.databricks.com/dev-tools/bundles/deployment-modes.
+  at resources.pipelines.main.development
+  in databricks.yml:10:20
+
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Found 1 warning
+"${resources.pipelines.other.development}"
diff --git a/acceptance/bundle/validate/pipeline_development_reference/script b/acceptance/bundle/validate/pipeline_development_reference/script
new file mode 100644
index 00000000000..c72489ac254
--- /dev/null
+++ b/acceptance/bundle/validate/pipeline_development_reference/script
@@ -0,0 +1,3 @@
+trace $CLI bundle validate
+
+trace $CLI bundle validate -o json 2>/dev/null | jq .resources.pipelines.main.development
diff --git a/acceptance/bundle/validate/presets_max_concurrent_runs/out.test.toml b/acceptance/bundle/validate/presets_max_concurrent_runs/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/validate/presets_max_concurrent_runs/out.test.toml
+++ b/acceptance/bundle/validate/presets_max_concurrent_runs/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/presets_name_prefix/databricks.yml.tmpl b/acceptance/bundle/validate/presets_name_prefix/databricks.yml.tmpl
index 36cd2dcad88..d30bfab79f9 100644
--- a/acceptance/bundle/validate/presets_name_prefix/databricks.yml.tmpl
+++ b/acceptance/bundle/validate/presets_name_prefix/databricks.yml.tmpl
@@ -24,5 +24,17 @@ resources:
     model1:
       name: model 1
 
+  vector_search_endpoints:
+    vs_endpoint:
+      name: vs_endpoint
+      endpoint_type: STANDARD
+
+  vector_search_indexes:
+    vs_index:
+      name: my_catalog.my_schema.my_index
+      endpoint_name: vs_endpoint
+      primary_key: id
+      index_type: DELTA_SYNC
+
 presets:
   name_prefix: "$PREFIX"
diff --git a/acceptance/bundle/validate/presets_name_prefix/out.test.toml b/acceptance/bundle/validate/presets_name_prefix/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/validate/presets_name_prefix/out.test.toml
+++ b/acceptance/bundle/validate/presets_name_prefix/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/presets_name_prefix/output.txt b/acceptance/bundle/validate/presets_name_prefix/output.txt
index 9fb8cf7ee39..f7d3e8d2053 100644
--- a/acceptance/bundle/validate/presets_name_prefix/output.txt
+++ b/acceptance/bundle/validate/presets_name_prefix/output.txt
@@ -30,11 +30,26 @@
       "name": "prefixschema1"
     }
   },
+  "vector_search_endpoints": {
+    "vs_endpoint": {
+      "endpoint_type": "STANDARD",
+      "name": "vs_endpoint"
+    }
+  },
+  "vector_search_indexes": {
+    "vs_index": {
+      "endpoint_name": "vs_endpoint",
+      "index_type": "DELTA_SYNC",
+      "name": "my_catalog.my_schema.my_index",
+      "primary_key": "id"
+    }
+  },
   "volumes": {
     "volume1": {
       "catalog_name": "catalog1",
       "name": "volume1",
       "schema_name": "schema1",
+      "volume_path": "/Volumes/catalog1/schema1/volume1",
       "volume_type": "MANAGED"
     }
   }
@@ -71,11 +86,26 @@
       "name": "prefix_schema1"
     }
   },
+  "vector_search_endpoints": {
+    "vs_endpoint": {
+      "endpoint_type": "STANDARD",
+      "name": "vs_endpoint"
+    }
+  },
+  "vector_search_indexes": {
+    "vs_index": {
+      "endpoint_name": "vs_endpoint",
+      "index_type": "DELTA_SYNC",
+      "name": "my_catalog.my_schema.my_index",
+      "primary_key": "id"
+    }
+  },
   "volumes": {
     "volume1": {
       "catalog_name": "catalog1",
       "name": "volume1",
       "schema_name": "schema1",
+      "volume_path": "/Volumes/catalog1/schema1/volume1",
       "volume_type": "MANAGED"
     }
   }
@@ -112,11 +142,26 @@
       "name": "schema1"
     }
   },
+  "vector_search_endpoints": {
+    "vs_endpoint": {
+      "endpoint_type": "STANDARD",
+      "name": "vs_endpoint"
+    }
+  },
+  "vector_search_indexes": {
+    "vs_index": {
+      "endpoint_name": "vs_endpoint",
+      "index_type": "DELTA_SYNC",
+      "name": "my_catalog.my_schema.my_index",
+      "primary_key": "id"
+    }
+  },
   "volumes": {
     "volume1": {
       "catalog_name": "catalog1",
       "name": "volume1",
       "schema_name": "schema1",
+      "volume_path": "/Volumes/catalog1/schema1/volume1",
       "volume_type": "MANAGED"
     }
   }
diff --git a/acceptance/bundle/validate/presets_name_prefix_dev/out.test.toml b/acceptance/bundle/validate/presets_name_prefix_dev/out.test.toml
index e90b6d5d1ba..a927a5fbc06 100644
--- a/acceptance/bundle/validate/presets_name_prefix_dev/out.test.toml
+++ b/acceptance/bundle/validate/presets_name_prefix_dev/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/presets_name_prefix_dev/out.with_empty_prefix.json b/acceptance/bundle/validate/presets_name_prefix_dev/out.with_empty_prefix.json
index cf1745cc2f0..258b6b938ab 100644
--- a/acceptance/bundle/validate/presets_name_prefix_dev/out.with_empty_prefix.json
+++ b/acceptance/bundle/validate/presets_name_prefix_dev/out.with_empty_prefix.json
@@ -63,6 +63,7 @@
         "catalog_name": "catalog1",
         "name": "volume1",
         "schema_name": "schema1",
+        "volume_path": "/Volumes/catalog1/schema1/volume1",
         "volume_type": "MANAGED"
       }
     }
diff --git a/acceptance/bundle/validate/presets_name_prefix_dev/out.with_nil_prefix.json b/acceptance/bundle/validate/presets_name_prefix_dev/out.with_nil_prefix.json
index cf1745cc2f0..258b6b938ab 100644
--- a/acceptance/bundle/validate/presets_name_prefix_dev/out.with_nil_prefix.json
+++ b/acceptance/bundle/validate/presets_name_prefix_dev/out.with_nil_prefix.json
@@ -63,6 +63,7 @@
         "catalog_name": "catalog1",
         "name": "volume1",
         "schema_name": "schema1",
+        "volume_path": "/Volumes/catalog1/schema1/volume1",
         "volume_type": "MANAGED"
       }
     }
diff --git a/acceptance/bundle/validate/presets_name_prefix_dev/out.with_static_prefix.json b/acceptance/bundle/validate/presets_name_prefix_dev/out.with_static_prefix.json
index eff500341a0..3fe9aeea34a 100644
--- a/acceptance/bundle/validate/presets_name_prefix_dev/out.with_static_prefix.json
+++ b/acceptance/bundle/validate/presets_name_prefix_dev/out.with_static_prefix.json
@@ -57,6 +57,7 @@
         "catalog_name": "catalog1",
         "name": "volume1",
         "schema_name": "schema1",
+        "volume_path": "/Volumes/catalog1/schema1/volume1",
         "volume_type": "MANAGED"
       }
     }
diff --git a/acceptance/bundle/validate/presets_name_prefix_dev/out.without_presets.json b/acceptance/bundle/validate/presets_name_prefix_dev/out.without_presets.json
index cf1745cc2f0..258b6b938ab 100644
--- a/acceptance/bundle/validate/presets_name_prefix_dev/out.without_presets.json
+++ b/acceptance/bundle/validate/presets_name_prefix_dev/out.without_presets.json
@@ -63,6 +63,7 @@
         "catalog_name": "catalog1",
         "name": "volume1",
         "schema_name": "schema1",
+        "volume_path": "/Volumes/catalog1/schema1/volume1",
         "volume_type": "MANAGED"
       }
     }
diff --git a/acceptance/bundle/validate/presets_name_prefix_dev/test.toml b/acceptance/bundle/validate/presets_name_prefix_dev/test.toml
index b51c615678e..570413a5d19 100644
--- a/acceptance/bundle/validate/presets_name_prefix_dev/test.toml
+++ b/acceptance/bundle/validate/presets_name_prefix_dev/test.toml
@@ -9,4 +9,3 @@ Badness = "Setting name_prefix to empty string has no effect, setting to nil rai
 #                +    }
 #                   },
 # Disabling terraform since we're not planning or deploying there, one is enough.
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/bundle/validate/presets_tags/out.test.toml b/acceptance/bundle/validate/presets_tags/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/validate/presets_tags/out.test.toml
+++ b/acceptance/bundle/validate/presets_tags/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/references/resolved_invalid_map_value/databricks.yml b/acceptance/bundle/validate/references/resolved_invalid_map_value/databricks.yml
new file mode 100644
index 00000000000..3fffd4ad478
--- /dev/null
+++ b/acceptance/bundle/validate/references/resolved_invalid_map_value/databricks.yml
@@ -0,0 +1,16 @@
+bundle:
+  name: test-bundle
+
+variables:
+  bad:
+    type: complex
+    default:
+      x: 1
+
+resources:
+  jobs:
+    j:
+      name: test
+      tags:
+        "bad.key[0]": ${var.bad}
+        good: ok
diff --git a/acceptance/bundle/validate/references/resolved_invalid_map_value/out.test.toml b/acceptance/bundle/validate/references/resolved_invalid_map_value/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/references/resolved_invalid_map_value/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/references/resolved_invalid_map_value/output.txt b/acceptance/bundle/validate/references/resolved_invalid_map_value/output.txt
new file mode 100644
index 00000000000..07bfe6c7450
--- /dev/null
+++ b/acceptance/bundle/validate/references/resolved_invalid_map_value/output.txt
@@ -0,0 +1,9 @@
+
+>>> [CLI] bundle validate -o json
+Warning: expected string, found map
+  at resources.jobs.j.tags['bad.key[0]']
+  in databricks.yml:15:23
+
+{
+  "good": "ok"
+}
diff --git a/acceptance/bundle/validate/references/resolved_invalid_map_value/script b/acceptance/bundle/validate/references/resolved_invalid_map_value/script
new file mode 100644
index 00000000000..835edef52e9
--- /dev/null
+++ b/acceptance/bundle/validate/references/resolved_invalid_map_value/script
@@ -0,0 +1,2 @@
+# A map value whose reference resolves to the wrong type is dropped, with a warning at its path.
+trace $CLI bundle validate -o json | jq .resources.jobs.j.tags
diff --git a/acceptance/bundle/validate/references/resolved_invalid_sequence_item/databricks.yml b/acceptance/bundle/validate/references/resolved_invalid_sequence_item/databricks.yml
new file mode 100644
index 00000000000..90dd5f6d362
--- /dev/null
+++ b/acceptance/bundle/validate/references/resolved_invalid_sequence_item/databricks.yml
@@ -0,0 +1,15 @@
+bundle:
+  name: test-bundle
+
+variables:
+  bad:
+    type: complex
+    default:
+      x: 1
+
+resources:
+  jobs:
+    j:
+      name: test
+      email_notifications:
+        on_failure: ["${var.bad}", "ok@example.test"]
diff --git a/acceptance/bundle/validate/references/resolved_invalid_sequence_item/out.test.toml b/acceptance/bundle/validate/references/resolved_invalid_sequence_item/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/references/resolved_invalid_sequence_item/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/references/resolved_invalid_sequence_item/output.txt b/acceptance/bundle/validate/references/resolved_invalid_sequence_item/output.txt
new file mode 100644
index 00000000000..03952e879af
--- /dev/null
+++ b/acceptance/bundle/validate/references/resolved_invalid_sequence_item/output.txt
@@ -0,0 +1,11 @@
+
+>>> [CLI] bundle validate -o json
+Warning: expected string, found map
+  at resources.jobs.j.email_notifications.on_failure[0]
+  in databricks.yml:15:22
+
+{
+  "on_failure": [
+    "ok@example.test"
+  ]
+}
diff --git a/acceptance/bundle/validate/references/resolved_invalid_sequence_item/script b/acceptance/bundle/validate/references/resolved_invalid_sequence_item/script
new file mode 100644
index 00000000000..61ba88b4d75
--- /dev/null
+++ b/acceptance/bundle/validate/references/resolved_invalid_sequence_item/script
@@ -0,0 +1,2 @@
+# A list element whose reference resolves to the wrong type is dropped, with a warning at its path.
+trace $CLI bundle validate -o json | jq .resources.jobs.j.email_notifications
diff --git a/acceptance/bundle/validate/references/to_omitted_struct_defaults/databricks.yml b/acceptance/bundle/validate/references/to_omitted_struct_defaults/databricks.yml
new file mode 100644
index 00000000000..b3d428b5e16
--- /dev/null
+++ b/acceptance/bundle/validate/references/to_omitted_struct_defaults/databricks.yml
@@ -0,0 +1,7 @@
+bundle:
+  name: test-bundle
+
+variables:
+  git_info:
+    type: complex
+    default: ${bundle.git}
diff --git a/acceptance/bundle/validate/references/to_omitted_struct_defaults/out.test.toml b/acceptance/bundle/validate/references/to_omitted_struct_defaults/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/references/to_omitted_struct_defaults/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/references/to_omitted_struct_defaults/output.txt b/acceptance/bundle/validate/references/to_omitted_struct_defaults/output.txt
new file mode 100644
index 00000000000..479ce92fe43
--- /dev/null
+++ b/acceptance/bundle/validate/references/to_omitted_struct_defaults/output.txt
@@ -0,0 +1,19 @@
+
+>>> [CLI] bundle validate -o json
+{
+  "default": {
+    "actual_branch": "",
+    "branch": "",
+    "bundle_root_path": ".",
+    "commit": "",
+    "origin_url": ""
+  },
+  "type": "complex",
+  "value": {
+    "actual_branch": "",
+    "branch": "",
+    "bundle_root_path": ".",
+    "commit": "",
+    "origin_url": ""
+  }
+}
diff --git a/acceptance/bundle/validate/references/to_omitted_struct_defaults/script b/acceptance/bundle/validate/references/to_omitted_struct_defaults/script
new file mode 100644
index 00000000000..cb09a7b5bec
--- /dev/null
+++ b/acceptance/bundle/validate/references/to_omitted_struct_defaults/script
@@ -0,0 +1,3 @@
+# A reference to a struct that is not set in the configuration (here outside a git repository)
+# resolves to the struct with its fields filled in, as empty values.
+trace $CLI bundle validate -o json | jq .variables.git_info
diff --git a/acceptance/bundle/validate/required/out.test.toml b/acceptance/bundle/validate/required/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/validate/required/out.test.toml
+++ b/acceptance/bundle/validate/required/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/reserved_deployment_fields/databricks.yml b/acceptance/bundle/validate/reserved_deployment_fields/databricks.yml
new file mode 100644
index 00000000000..7215146813d
--- /dev/null
+++ b/acceptance/bundle/validate/reserved_deployment_fields/databricks.yml
@@ -0,0 +1,18 @@
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    my_job:
+      name: my_job
+      deployment:
+        kind: BUNDLE
+        deployment_id: "dep-123"
+        version_id: "ver-456"
+  pipelines:
+    my_pipeline:
+      name: my_pipeline
+      deployment:
+        kind: BUNDLE
+        deployment_id: "dep-789"
+        version_id: "ver-012"
diff --git a/acceptance/bundle/validate/reserved_deployment_fields/out.test.toml b/acceptance/bundle/validate/reserved_deployment_fields/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/reserved_deployment_fields/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/reserved_deployment_fields/output.txt b/acceptance/bundle/validate/reserved_deployment_fields/output.txt
new file mode 100644
index 00000000000..60903b25f44
--- /dev/null
+++ b/acceptance/bundle/validate/reserved_deployment_fields/output.txt
@@ -0,0 +1,27 @@
+
+>>> [CLI] bundle validate
+Error: deployment_id must not be set in bundle configuration; it is managed by Declarative Automation Bundles
+  at resources.jobs.my_job.deployment.deployment_id
+  in databricks.yml:10:24
+
+Error: version_id must not be set in bundle configuration; it is managed by Declarative Automation Bundles
+  at resources.jobs.my_job.deployment.version_id
+  in databricks.yml:11:21
+
+Error: deployment_id must not be set in bundle configuration; it is managed by Declarative Automation Bundles
+  at resources.pipelines.my_pipeline.deployment.deployment_id
+  in databricks.yml:17:24
+
+Error: version_id must not be set in bundle configuration; it is managed by Declarative Automation Bundles
+  at resources.pipelines.my_pipeline.deployment.version_id
+  in databricks.yml:18:21
+
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Found 4 errors
+
+Exit code: 1
diff --git a/acceptance/bundle/validate/reserved_deployment_fields/script b/acceptance/bundle/validate/reserved_deployment_fields/script
new file mode 100644
index 00000000000..5350876150f
--- /dev/null
+++ b/acceptance/bundle/validate/reserved_deployment_fields/script
@@ -0,0 +1 @@
+trace $CLI bundle validate
diff --git a/acceptance/bundle/validate/reserved_job_run_idempotency_token/databricks.yml b/acceptance/bundle/validate/reserved_job_run_idempotency_token/databricks.yml
new file mode 100644
index 00000000000..35aa4321ad5
--- /dev/null
+++ b/acceptance/bundle/validate/reserved_job_run_idempotency_token/databricks.yml
@@ -0,0 +1,8 @@
+bundle:
+  name: test-bundle
+
+resources:
+  job_runs:
+    my_run:
+      job_id: 1234567890
+      idempotency_token: "mine"
diff --git a/acceptance/bundle/validate/reserved_job_run_idempotency_token/out.test.toml b/acceptance/bundle/validate/reserved_job_run_idempotency_token/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/reserved_job_run_idempotency_token/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/reserved_job_run_idempotency_token/output.txt b/acceptance/bundle/validate/reserved_job_run_idempotency_token/output.txt
new file mode 100644
index 00000000000..7a6c87af7ed
--- /dev/null
+++ b/acceptance/bundle/validate/reserved_job_run_idempotency_token/output.txt
@@ -0,0 +1,15 @@
+
+>>> [CLI] bundle validate
+Error: idempotency_token must not be set in bundle configuration; the CLI sets it on each run-now request
+  at resources.job_runs.my_run.idempotency_token
+  in databricks.yml:8:26
+
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Found 1 error
+
+Exit code: 1
diff --git a/acceptance/bundle/validate/reserved_job_run_idempotency_token/script b/acceptance/bundle/validate/reserved_job_run_idempotency_token/script
new file mode 100644
index 00000000000..5350876150f
--- /dev/null
+++ b/acceptance/bundle/validate/reserved_job_run_idempotency_token/script
@@ -0,0 +1 @@
+trace $CLI bundle validate
diff --git a/acceptance/bundle/validate/secret_scope_invalid_permission_level/databricks.yml b/acceptance/bundle/validate/secret_scope_invalid_permission_level/databricks.yml
new file mode 100644
index 00000000000..b80dc842d6e
--- /dev/null
+++ b/acceptance/bundle/validate/secret_scope_invalid_permission_level/databricks.yml
@@ -0,0 +1,18 @@
+bundle:
+  name: test-bundle
+
+resources:
+  secret_scopes:
+    bad_levels:
+      name: test-scope-bad-levels
+      permissions:
+        # YAML int is coerced to string; must still fail enum validation.
+        - level: 12
+          group_name: users
+        - level: fuzz_badlevel
+          service_principal_name: 12345678-1234-1234-1234-123456789abc
+    valid:
+      name: test-scope-valid
+      permissions:
+        - level: READ
+          group_name: users
diff --git a/acceptance/bundle/validate/secret_scope_invalid_permission_level/out.test.toml b/acceptance/bundle/validate/secret_scope_invalid_permission_level/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/secret_scope_invalid_permission_level/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/secret_scope_invalid_permission_level/output.txt b/acceptance/bundle/validate/secret_scope_invalid_permission_level/output.txt
new file mode 100644
index 00000000000..eec035d2671
--- /dev/null
+++ b/acceptance/bundle/validate/secret_scope_invalid_permission_level/output.txt
@@ -0,0 +1,31 @@
+
+>>> [CLI] bundle validate
+Warning: invalid value "12" for enum field. Valid values are [READ WRITE MANAGE]
+  at resources.secret_scopes.bad_levels.permissions[0].level
+
+Warning: invalid value "fuzz_badlevel" for enum field. Valid values are [READ WRITE MANAGE]
+  at resources.secret_scopes.bad_levels.permissions[1].level
+
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Found 2 warnings
+
+>>> [CLI] bundle validate --strict
+Warning: invalid value "12" for enum field. Valid values are [READ WRITE MANAGE]
+  at resources.secret_scopes.bad_levels.permissions[0].level
+
+Warning: invalid value "fuzz_badlevel" for enum field. Valid values are [READ WRITE MANAGE]
+  at resources.secret_scopes.bad_levels.permissions[1].level
+
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Found 2 warnings
+Error: 2 warnings were found. Warnings are treated as errors in strict mode
diff --git a/acceptance/bundle/validate/secret_scope_invalid_permission_level/script b/acceptance/bundle/validate/secret_scope_invalid_permission_level/script
new file mode 100644
index 00000000000..9bfb2b86d2c
--- /dev/null
+++ b/acceptance/bundle/validate/secret_scope_invalid_permission_level/script
@@ -0,0 +1,3 @@
+# Invalid levels warn (same as other enum fields); --strict must fail.
+trace $CLI bundle validate
+musterr trace $CLI bundle validate --strict
diff --git a/acceptance/bundle/validate/secret_scope_required_principal/databricks.yml b/acceptance/bundle/validate/secret_scope_required_principal/databricks.yml
new file mode 100644
index 00000000000..0e33e50deca
--- /dev/null
+++ b/acceptance/bundle/validate/secret_scope_required_principal/databricks.yml
@@ -0,0 +1,27 @@
+bundle:
+  name: test-bundle
+
+resources:
+  secret_scopes:
+    no_principal:
+      name: test-scope-no-principal
+      permissions:
+        # Missing principal: rejected.
+        - level: READ
+    empty_principal:
+      name: test-scope-empty-principal
+      permissions:
+        # Empty principal: rejected.
+        - level: READ
+          group_name: ""
+    wrong_type_principal:
+      name: test-scope-wrong-type-principal
+      permissions:
+        # Wrong-typed principal: normalization drops it, so treated as missing.
+        - level: READ
+          group_name: []
+    valid:
+      name: test-scope-valid
+      permissions:
+        - level: READ
+          group_name: users
diff --git a/acceptance/bundle/validate/secret_scope_required_principal/out.test.toml b/acceptance/bundle/validate/secret_scope_required_principal/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/secret_scope_required_principal/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/secret_scope_required_principal/output.txt b/acceptance/bundle/validate/secret_scope_required_principal/output.txt
new file mode 100644
index 00000000000..987ce601cb6
--- /dev/null
+++ b/acceptance/bundle/validate/secret_scope_required_principal/output.txt
@@ -0,0 +1,57 @@
+
+>>> [CLI] bundle validate
+Warning: expected string, found sequence
+  at resources.secret_scopes.wrong_type_principal.permissions[0].group_name
+  in databricks.yml:22:23
+
+Error: secret scope permission principal is required
+  at resources.secret_scopes.empty_principal.permissions[0]
+  in databricks.yml:12:7
+
+Set one of user_name, group_name or service_principal_name
+
+Error: secret scope permission principal is required
+  at resources.secret_scopes.wrong_type_principal.permissions[0]
+  in databricks.yml:18:7
+
+Set one of user_name, group_name or service_principal_name
+
+Error: secret scope permission principal is required
+  at resources.secret_scopes.no_principal.permissions[0]
+  in databricks.yml:7:7
+
+Set one of user_name, group_name or service_principal_name
+
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Found 3 errors and 1 warning
+
+>>> [CLI] bundle deploy
+Warning: expected string, found sequence
+  at resources.secret_scopes.wrong_type_principal.permissions[0].group_name
+  in databricks.yml:22:23
+
+Error: secret scope permission principal is required
+  at resources.secret_scopes.empty_principal.permissions[0]
+  in databricks.yml:12:7
+
+Set one of user_name, group_name or service_principal_name
+
+Error: secret scope permission principal is required
+  at resources.secret_scopes.wrong_type_principal.permissions[0]
+  in databricks.yml:18:7
+
+Set one of user_name, group_name or service_principal_name
+
+Error: secret scope permission principal is required
+  at resources.secret_scopes.no_principal.permissions[0]
+  in databricks.yml:7:7
+
+Set one of user_name, group_name or service_principal_name
+
+
+>>> print_requests.py //secrets
diff --git a/acceptance/bundle/validate/secret_scope_required_principal/script b/acceptance/bundle/validate/secret_scope_required_principal/script
new file mode 100644
index 00000000000..e71645276d3
--- /dev/null
+++ b/acceptance/bundle/validate/secret_scope_required_principal/script
@@ -0,0 +1,9 @@
+# Without the fix, validate only warns; deploy fails later in SecretScopeFixups (direct)
+# or leaves empty-principal ACLs that destroy cannot remove (terraform).
+musterr trace $CLI bundle validate
+
+# Deploy must abort at validation: no scope is created, so no partial deploy.
+musterr trace $CLI bundle deploy
+trace print_requests.py //secrets
+
+rm -f "$OUT_REQUESTS"
diff --git a/acceptance/bundle/validate/secret_scope_required_principal/test.toml b/acceptance/bundle/validate/secret_scope_required_principal/test.toml
new file mode 100644
index 00000000000..159efe02696
--- /dev/null
+++ b/acceptance/bundle/validate/secret_scope_required_principal/test.toml
@@ -0,0 +1 @@
+RecordRequests = true
diff --git a/acceptance/bundle/validate/snapshot_resource_not_allowed/databricks.yml b/acceptance/bundle/validate/snapshot_resource_not_allowed/databricks.yml
new file mode 100644
index 00000000000..7e9ba6bfb48
--- /dev/null
+++ b/acceptance/bundle/validate/snapshot_resource_not_allowed/databricks.yml
@@ -0,0 +1,8 @@
+bundle:
+  name: snapshot_resource_not_allowed
+
+resources:
+  internal_immutable_snapshots:
+    immutable:
+      bundle_id: 123
+      zip_path: /tmp/snapshot.zip
diff --git a/acceptance/bundle/validate/snapshot_resource_not_allowed/out.test.toml b/acceptance/bundle/validate/snapshot_resource_not_allowed/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/snapshot_resource_not_allowed/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/snapshot_resource_not_allowed/output.txt b/acceptance/bundle/validate/snapshot_resource_not_allowed/output.txt
new file mode 100644
index 00000000000..072f2c3c94b
--- /dev/null
+++ b/acceptance/bundle/validate/snapshot_resource_not_allowed/output.txt
@@ -0,0 +1,12 @@
+
+>>> [CLI] bundle validate
+Error: Internal resources cannot be set in bundle configuration
+  at resources
+  in databricks.yml:5:3
+
+Name: snapshot_resource_not_allowed
+Target: default
+
+Found 1 error
+
+Exit code: 1
diff --git a/acceptance/bundle/validate/snapshot_resource_not_allowed/script b/acceptance/bundle/validate/snapshot_resource_not_allowed/script
new file mode 100644
index 00000000000..5350876150f
--- /dev/null
+++ b/acceptance/bundle/validate/snapshot_resource_not_allowed/script
@@ -0,0 +1 @@
+trace $CLI bundle validate
diff --git a/acceptance/bundle/validate/sql_warehouse_required_name/databricks.yml b/acceptance/bundle/validate/sql_warehouse_required_name/databricks.yml
new file mode 100644
index 00000000000..9941a3085a4
--- /dev/null
+++ b/acceptance/bundle/validate/sql_warehouse_required_name/databricks.yml
@@ -0,0 +1,12 @@
+bundle:
+  name: test-bundle
+
+resources:
+  sql_warehouses:
+    # Missing name (required by the backend).
+    my_warehouse:
+      cluster_size: "2X-Small"
+    # Whitespace-only name, treated as missing (name.trim.nonEmpty).
+    blank_warehouse:
+      name: "   "
+      cluster_size: "2X-Small"
diff --git a/acceptance/bundle/validate/sql_warehouse_required_name/out.test.toml b/acceptance/bundle/validate/sql_warehouse_required_name/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/sql_warehouse_required_name/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/sql_warehouse_required_name/output.txt b/acceptance/bundle/validate/sql_warehouse_required_name/output.txt
new file mode 100644
index 00000000000..fc66fed24e1
--- /dev/null
+++ b/acceptance/bundle/validate/sql_warehouse_required_name/output.txt
@@ -0,0 +1,19 @@
+
+>>> [CLI] bundle validate
+Error: sql_warehouse name is required
+  at resources.sql_warehouses.blank_warehouse
+  in databricks.yml:11:7
+
+Error: sql_warehouse name is required
+  at resources.sql_warehouses.my_warehouse
+  in databricks.yml:8:7
+
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Found 2 errors
+
+Exit code: 1
diff --git a/acceptance/bundle/validate/sql_warehouse_required_name/script b/acceptance/bundle/validate/sql_warehouse_required_name/script
new file mode 100644
index 00000000000..5350876150f
--- /dev/null
+++ b/acceptance/bundle/validate/sql_warehouse_required_name/script
@@ -0,0 +1 @@
+trace $CLI bundle validate
diff --git a/acceptance/bundle/validate/strict/out.test.toml b/acceptance/bundle/validate/strict/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/validate/strict/out.test.toml
+++ b/acceptance/bundle/validate/strict/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/strict/output.txt b/acceptance/bundle/validate/strict/output.txt
index ca25c721f59..7385a89d571 100644
--- a/acceptance/bundle/validate/strict/output.txt
+++ b/acceptance/bundle/validate/strict/output.txt
@@ -24,7 +24,7 @@ Workspace:
   Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/foo
 
 Found 1 warning
-Error: 1 warning was found. Warnings are not allowed in strict mode
+Error: 1 warning was found. Warnings are treated as errors in strict mode
 
 Exit code: 1
 
@@ -33,7 +33,7 @@ Warning: invalid value "INVALID_TYPE" for enum field. Valid values are [complex]
   at variables.my_variable.type
   in databricks.yml:6:11
 
-Warning: invalid value "INVALID_TYPE" for enum field. Valid values are [whl jar]
+Warning: invalid value "INVALID_TYPE" for enum field. Valid values are [whl jar tgz]
   at artifacts.my_artifact.type
   in databricks.yml:16:15
 
@@ -44,6 +44,6 @@ Workspace:
   Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/bar
 
 Found 2 warnings
-Error: 2 warnings were found. Warnings are not allowed in strict mode
+Error: 2 warnings were found. Warnings are treated as errors in strict mode
 
 Exit code: 1
diff --git a/acceptance/bundle/validate/sync_patterns/out.sync.txt b/acceptance/bundle/validate/sync_patterns/out.sync.txt
index ac5aba9ab29..bbac212feb3 100644
--- a/acceptance/bundle/validate/sync_patterns/out.sync.txt
+++ b/acceptance/bundle/validate/sync_patterns/out.sync.txt
@@ -1,7 +1,12 @@
 {
   "method": "POST",
-  "path": "/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/conf/dir/test.yml",
-  "q": {
-    "overwrite": "true"
+  "path": "/api/2.0/workspace/import",
+  "body": {
+    "multipart_form": {
+      "content": "",
+      "format": "RAW",
+      "overwrite": "true",
+      "path": "/Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files/conf/dir/test.yml"
+    }
   }
 }
diff --git a/acceptance/bundle/validate/sync_patterns/out.test.toml b/acceptance/bundle/validate/sync_patterns/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/validate/sync_patterns/out.test.toml
+++ b/acceptance/bundle/validate/sync_patterns/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/sync_patterns/output.txt b/acceptance/bundle/validate/sync_patterns/output.txt
index b35859d86a9..7c981083516 100644
--- a/acceptance/bundle/validate/sync_patterns/output.txt
+++ b/acceptance/bundle/validate/sync_patterns/output.txt
@@ -23,5 +23,5 @@ Validation OK!
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
-Deploying resources...
-Deployment complete!
+Files: 2 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
diff --git a/acceptance/bundle/validate/sync_patterns/script b/acceptance/bundle/validate/sync_patterns/script
index d2aae85444a..f44ee310433 100644
--- a/acceptance/bundle/validate/sync_patterns/script
+++ b/acceptance/bundle/validate/sync_patterns/script
@@ -1,5 +1,5 @@
 trace $CLI bundle validate
 trace $CLI bundle validate -o json | jq '.sync'
 trace $CLI bundle deploy
-jq 'select(.path | test("dir/test.yml"))' out.requests.txt  > out.sync.txt
-rm out.requests.txt
+jq 'select(.body.multipart_form.path | strings | test("dir/test.yml"))' "$OUT_REQUESTS"  > out.sync.txt
+rm "$OUT_REQUESTS"
diff --git a/acceptance/bundle/validate/targets/inherited_from_root_merge/databricks.yml b/acceptance/bundle/validate/targets/inherited_from_root_merge/databricks.yml
new file mode 100644
index 00000000000..e5a45a569c9
--- /dev/null
+++ b/acceptance/bundle/validate/targets/inherited_from_root_merge/databricks.yml
@@ -0,0 +1,15 @@
+bundle:
+  name: test-bundle
+
+variables:
+  x:
+    default: base
+
+definitions:
+  root_defaults: &root_defaults
+    targets:
+      dev:
+        variables:
+          x: overridden
+
+<<: *root_defaults
diff --git a/acceptance/bundle/validate/targets/inherited_from_root_merge/out.test.toml b/acceptance/bundle/validate/targets/inherited_from_root_merge/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/targets/inherited_from_root_merge/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/targets/inherited_from_root_merge/output.txt b/acceptance/bundle/validate/targets/inherited_from_root_merge/output.txt
new file mode 100644
index 00000000000..d3be1ebf0eb
--- /dev/null
+++ b/acceptance/bundle/validate/targets/inherited_from_root_merge/output.txt
@@ -0,0 +1,6 @@
+
+>>> [CLI] bundle validate -t dev -o json
+{
+  "default": "overridden",
+  "value": "overridden"
+}
diff --git a/acceptance/bundle/validate/targets/inherited_from_root_merge/script b/acceptance/bundle/validate/targets/inherited_from_root_merge/script
new file mode 100644
index 00000000000..b51a0e30bfe
--- /dev/null
+++ b/acceptance/bundle/validate/targets/inherited_from_root_merge/script
@@ -0,0 +1,2 @@
+# Target variable shorthands in a targets section inherited through a root merge key are applied.
+trace $CLI bundle validate -t dev -o json | jq .variables.x
diff --git a/acceptance/bundle/validate/targets/scalar_rewrite_diagnostic/databricks.yml b/acceptance/bundle/validate/targets/scalar_rewrite_diagnostic/databricks.yml
new file mode 100644
index 00000000000..2583829e912
--- /dev/null
+++ b/acceptance/bundle/validate/targets/scalar_rewrite_diagnostic/databricks.yml
@@ -0,0 +1,4 @@
+bundle:
+  name: test-bundle
+
+targets: false
diff --git a/acceptance/bundle/validate/targets/scalar_rewrite_diagnostic/out.test.toml b/acceptance/bundle/validate/targets/scalar_rewrite_diagnostic/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/targets/scalar_rewrite_diagnostic/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/targets/scalar_rewrite_diagnostic/output.txt b/acceptance/bundle/validate/targets/scalar_rewrite_diagnostic/output.txt
new file mode 100644
index 00000000000..8020d180559
--- /dev/null
+++ b/acceptance/bundle/validate/targets/scalar_rewrite_diagnostic/output.txt
@@ -0,0 +1,8 @@
+
+>>> [CLI] bundle validate
+Error: failed to rewrite [TEST_TMP_DIR]/databricks.yml: expected a map or sequence, found bool
+
+
+Found 1 error
+
+Exit code: 1
diff --git a/acceptance/bundle/validate/targets/scalar_rewrite_diagnostic/script b/acceptance/bundle/validate/targets/scalar_rewrite_diagnostic/script
new file mode 100644
index 00000000000..4f218738be7
--- /dev/null
+++ b/acceptance/bundle/validate/targets/scalar_rewrite_diagnostic/script
@@ -0,0 +1,2 @@
+# A scalar targets section is an error.
+errcode trace $CLI bundle validate
diff --git a/acceptance/bundle/validate/targets/scalar_rewrite_diagnostic/test.toml b/acceptance/bundle/validate/targets/scalar_rewrite_diagnostic/test.toml
new file mode 100644
index 00000000000..b1bb8151234
--- /dev/null
+++ b/acceptance/bundle/validate/targets/scalar_rewrite_diagnostic/test.toml
@@ -0,0 +1 @@
+Badness = 'The error names an internal step ("failed to rewrite") and has no location, instead of reporting a type error at targets.'
diff --git a/acceptance/bundle/validate/targets/test.toml b/acceptance/bundle/validate/targets/test.toml
new file mode 100644
index 00000000000..e9cede5e28a
--- /dev/null
+++ b/acceptance/bundle/validate/targets/test.toml
@@ -0,0 +1,4 @@
+# Errors for invalid YAML print the full path of the file; normalize Windows separators.
+[[Repls]]
+Old = '\\'
+New = '/'
diff --git a/acceptance/bundle/validate/task_source_empty_string/databricks.yml b/acceptance/bundle/validate/task_source_empty_string/databricks.yml
new file mode 100644
index 00000000000..03e95eb7307
--- /dev/null
+++ b/acceptance/bundle/validate/task_source_empty_string/databricks.yml
@@ -0,0 +1,16 @@
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    my_job:
+      name: my job
+      git_source:
+        git_url: https://github.com/databricks/cli
+        git_provider: gitHub
+        git_branch: main
+      tasks:
+        - task_key: main
+          notebook_task:
+            notebook_path: ./notebook
+            source: ""
diff --git a/acceptance/bundle/validate/task_source_empty_string/out.test.toml b/acceptance/bundle/validate/task_source_empty_string/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/task_source_empty_string/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/task_source_empty_string/output.txt b/acceptance/bundle/validate/task_source_empty_string/output.txt
new file mode 100644
index 00000000000..997343d5302
--- /dev/null
+++ b/acceptance/bundle/validate/task_source_empty_string/output.txt
@@ -0,0 +1,10 @@
+
+>>> [CLI] bundle validate -o json
+[
+  {
+    "notebook_task": {
+      "notebook_path": "./notebook"
+    },
+    "task_key": "main"
+  }
+]
diff --git a/acceptance/bundle/validate/task_source_empty_string/script b/acceptance/bundle/validate/task_source_empty_string/script
new file mode 100644
index 00000000000..b6b3d99b901
--- /dev/null
+++ b/acceptance/bundle/validate/task_source_empty_string/script
@@ -0,0 +1 @@
+trace $CLI bundle validate -o json | jq .resources.jobs.my_job.tasks
diff --git a/acceptance/bundle/validate/terraform-config-deprecated/databricks.yml b/acceptance/bundle/validate/terraform-config-deprecated/databricks.yml
new file mode 100644
index 00000000000..469cdccba96
--- /dev/null
+++ b/acceptance/bundle/validate/terraform-config-deprecated/databricks.yml
@@ -0,0 +1,12 @@
+bundle:
+  name: test-bundle
+  terraform:
+    exec_path: /usr/local/bin/terraform
+
+targets:
+  default:
+    default: true
+  override:
+    bundle:
+      terraform:
+        exec_path: /opt/terraform
diff --git a/acceptance/bundle/validate/terraform-config-deprecated/out.test.toml b/acceptance/bundle/validate/terraform-config-deprecated/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/terraform-config-deprecated/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/terraform-config-deprecated/output.txt b/acceptance/bundle/validate/terraform-config-deprecated/output.txt
new file mode 100644
index 00000000000..b7625bf1ea7
--- /dev/null
+++ b/acceptance/bundle/validate/terraform-config-deprecated/output.txt
@@ -0,0 +1,27 @@
+
+>>> [CLI] bundle validate
+Warning: bundle.terraform is deprecated and has no effect: the Terraform deployment engine has been removed in Databricks CLI v1.20.0
+  at bundle.terraform
+  in databricks.yml:4:5
+
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Found 1 warning
+
+>>> [CLI] bundle validate -t override
+Warning: bundle.terraform is deprecated and has no effect: the Terraform deployment engine has been removed in Databricks CLI v1.20.0
+  at bundle.terraform
+  in databricks.yml:4:5
+     databricks.yml:12:9
+
+Name: test-bundle
+Target: override
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/override
+
+Found 1 warning
diff --git a/acceptance/bundle/validate/terraform-config-deprecated/script b/acceptance/bundle/validate/terraform-config-deprecated/script
new file mode 100644
index 00000000000..154b519b0f0
--- /dev/null
+++ b/acceptance/bundle/validate/terraform-config-deprecated/script
@@ -0,0 +1,2 @@
+trace $CLI bundle validate
+trace $CLI bundle validate -t override
diff --git a/acceptance/bundle/validate/terraform-config-deprecated/test.toml b/acceptance/bundle/validate/terraform-config-deprecated/test.toml
new file mode 100644
index 00000000000..601384fdf96
--- /dev/null
+++ b/acceptance/bundle/validate/terraform-config-deprecated/test.toml
@@ -0,0 +1 @@
+Ignore = [".databricks"]
diff --git a/acceptance/bundle/validate/var_in_bundle_name/out.test.toml b/acceptance/bundle/validate/var_in_bundle_name/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/validate/var_in_bundle_name/out.test.toml
+++ b/acceptance/bundle/validate/var_in_bundle_name/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/variables/complex_default_merge/a.yml b/acceptance/bundle/validate/variables/complex_default_merge/a.yml
new file mode 100644
index 00000000000..1022dfa415f
--- /dev/null
+++ b/acceptance/bundle/validate/variables/complex_default_merge/a.yml
@@ -0,0 +1,6 @@
+variables:
+  libs:
+    type: complex
+    default:
+      - one
+      - two
diff --git a/acceptance/bundle/validate/variables/complex_default_merge/b.yml b/acceptance/bundle/validate/variables/complex_default_merge/b.yml
new file mode 100644
index 00000000000..b455cc0fe07
--- /dev/null
+++ b/acceptance/bundle/validate/variables/complex_default_merge/b.yml
@@ -0,0 +1,5 @@
+variables:
+  libs:
+    type: complex
+    default:
+      - three
diff --git a/acceptance/bundle/validate/variables/complex_default_merge/databricks.yml b/acceptance/bundle/validate/variables/complex_default_merge/databricks.yml
new file mode 100644
index 00000000000..e125367ca46
--- /dev/null
+++ b/acceptance/bundle/validate/variables/complex_default_merge/databricks.yml
@@ -0,0 +1,6 @@
+bundle:
+  name: test-bundle
+
+include:
+  - a.yml
+  - b.yml
diff --git a/acceptance/bundle/validate/variables/complex_default_merge/out.test.toml b/acceptance/bundle/validate/variables/complex_default_merge/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/variables/complex_default_merge/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/variables/complex_default_merge/output.txt b/acceptance/bundle/validate/variables/complex_default_merge/output.txt
new file mode 100644
index 00000000000..f6b13647c94
--- /dev/null
+++ b/acceptance/bundle/validate/variables/complex_default_merge/output.txt
@@ -0,0 +1,15 @@
+
+>>> [CLI] bundle validate -o json
+{
+  "default": [
+    "one",
+    "two",
+    "three"
+  ],
+  "type": "complex",
+  "value": [
+    "one",
+    "two",
+    "three"
+  ]
+}
diff --git a/acceptance/bundle/validate/variables/complex_default_merge/script b/acceptance/bundle/validate/variables/complex_default_merge/script
new file mode 100644
index 00000000000..f7e09655323
--- /dev/null
+++ b/acceptance/bundle/validate/variables/complex_default_merge/script
@@ -0,0 +1 @@
+trace $CLI bundle validate -o json | jq .variables.libs
diff --git a/acceptance/bundle/validate/variables/complex_default_nested_timestamp/databricks.yml b/acceptance/bundle/validate/variables/complex_default_nested_timestamp/databricks.yml
new file mode 100644
index 00000000000..43221f5f33a
--- /dev/null
+++ b/acceptance/bundle/validate/variables/complex_default_nested_timestamp/databricks.yml
@@ -0,0 +1,8 @@
+bundle:
+  name: test-bundle
+
+variables:
+  payload:
+    type: complex
+    default:
+      created: 2020-01-02
diff --git a/acceptance/bundle/validate/variables/complex_default_nested_timestamp/out.test.toml b/acceptance/bundle/validate/variables/complex_default_nested_timestamp/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/variables/complex_default_nested_timestamp/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/variables/complex_default_nested_timestamp/output.txt b/acceptance/bundle/validate/variables/complex_default_nested_timestamp/output.txt
new file mode 100644
index 00000000000..3c236fb1c2b
--- /dev/null
+++ b/acceptance/bundle/validate/variables/complex_default_nested_timestamp/output.txt
@@ -0,0 +1,10 @@
+
+>>> [CLI] bundle validate
+Warn: unable to convert typed configuration to dynamic configuration: cannot convert struct field to dynamic type "time": src=time.Date(2020, time.January, 2, 0, 0, 0, 0, time.UTC) ref=time.Date(2020, time.January, 2, 0, 0, 0, 0, time.UTC)
+Error: exit error: cannot convert struct field to dynamic type "time": src=time.Date(2020, time.January, 2, 0, 0, 0, 0, time.UTC) ref=time.Date(2020, time.January, 2, 0, 0, 0, 0, time.UTC)
+
+Name: test-bundle
+
+Found 1 error
+
+Exit code: 1
diff --git a/acceptance/bundle/validate/variables/complex_default_nested_timestamp/script b/acceptance/bundle/validate/variables/complex_default_nested_timestamp/script
new file mode 100644
index 00000000000..e4d20dafe80
--- /dev/null
+++ b/acceptance/bundle/validate/variables/complex_default_nested_timestamp/script
@@ -0,0 +1,2 @@
+# A timestamp nested inside a complex variable default.
+errcode trace $CLI bundle validate
diff --git a/acceptance/bundle/validate/variables/complex_default_nested_timestamp/test.toml b/acceptance/bundle/validate/variables/complex_default_nested_timestamp/test.toml
new file mode 100644
index 00000000000..b1b00a5e46a
--- /dev/null
+++ b/acceptance/bundle/validate/variables/complex_default_nested_timestamp/test.toml
@@ -0,0 +1 @@
+Badness = "A valid config fails with an internal conversion error: the nested timestamp cannot be converted back to the dynamic configuration."
diff --git a/acceptance/bundle/validate/variables/complex_unknown_field_location/databricks.yml b/acceptance/bundle/validate/variables/complex_unknown_field_location/databricks.yml
new file mode 100644
index 00000000000..a337abdcff1
--- /dev/null
+++ b/acceptance/bundle/validate/variables/complex_unknown_field_location/databricks.yml
@@ -0,0 +1,13 @@
+bundle:
+  name: test-bundle
+
+variables:
+  job_config:
+    type: complex
+    default:
+      name: test
+      misspelled_field: value
+
+resources:
+  jobs:
+    j: ${var.job_config}
diff --git a/acceptance/bundle/validate/variables/complex_unknown_field_location/out.test.toml b/acceptance/bundle/validate/variables/complex_unknown_field_location/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/variables/complex_unknown_field_location/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/variables/complex_unknown_field_location/output.txt b/acceptance/bundle/validate/variables/complex_unknown_field_location/output.txt
new file mode 100644
index 00000000000..118399cba34
--- /dev/null
+++ b/acceptance/bundle/validate/variables/complex_unknown_field_location/output.txt
@@ -0,0 +1,13 @@
+
+>>> [CLI] bundle validate
+Warning: unknown field: misspelled_field
+  at resources.jobs.j
+  in databricks.yml:9:7
+
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Found 1 warning
diff --git a/acceptance/bundle/validate/variables/complex_unknown_field_location/script b/acceptance/bundle/validate/variables/complex_unknown_field_location/script
new file mode 100644
index 00000000000..4b8218079e8
--- /dev/null
+++ b/acceptance/bundle/validate/variables/complex_unknown_field_location/script
@@ -0,0 +1,2 @@
+# An unknown field inside a complex variable used as a whole resource keeps the location of its key.
+errcode trace $CLI bundle validate
diff --git a/acceptance/bundle/validate/variables/overrides_file_complex_path/databricks.yml b/acceptance/bundle/validate/variables/overrides_file_complex_path/databricks.yml
new file mode 100644
index 00000000000..abeb913a709
--- /dev/null
+++ b/acceptance/bundle/validate/variables/overrides_file_complex_path/databricks.yml
@@ -0,0 +1,17 @@
+bundle:
+  name: test-bundle
+
+variables:
+  task:
+    type: complex
+
+resources:
+  jobs:
+    my_job:
+      name: my job
+      tasks:
+        - ${var.task}
+
+targets:
+  default:
+    default: true
diff --git a/acceptance/bundle/validate/variables/overrides_file_complex_path/out.test.toml b/acceptance/bundle/validate/variables/overrides_file_complex_path/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/variables/overrides_file_complex_path/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/variables/overrides_file_complex_path/output.txt b/acceptance/bundle/validate/variables/overrides_file_complex_path/output.txt
new file mode 100644
index 00000000000..91342a421cb
--- /dev/null
+++ b/acceptance/bundle/validate/variables/overrides_file_complex_path/output.txt
@@ -0,0 +1,20 @@
+
+>>> [CLI] bundle validate -o json
+Error: file .databricks/bundle/default/src/main.py not found
+
+
+Exit code: 1
+[
+  {
+    "existing_cluster_id": "0123-456789-abcdefgh",
+    "libraries": [
+      {
+        "whl": ".databricks/bundle/default/src/lib.whl"
+      }
+    ],
+    "spark_python_task": {
+      "python_file": ".databricks/bundle/default/src/main.py"
+    },
+    "task_key": "main"
+  }
+]
diff --git a/acceptance/bundle/validate/variables/overrides_file_complex_path/script b/acceptance/bundle/validate/variables/overrides_file_complex_path/script
new file mode 100644
index 00000000000..ade57be3b05
--- /dev/null
+++ b/acceptance/bundle/validate/variables/overrides_file_complex_path/script
@@ -0,0 +1,3 @@
+mkdir -p .databricks/bundle/default
+mv variable-overrides.json .databricks/bundle/default/
+errcode trace $CLI bundle validate -o json | jq '.resources.jobs.my_job.tasks'
diff --git a/acceptance/bundle/validate/variables/overrides_file_complex_path/src/lib.whl b/acceptance/bundle/validate/variables/overrides_file_complex_path/src/lib.whl
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/acceptance/bundle/validate/variables/overrides_file_complex_path/src/main.py b/acceptance/bundle/validate/variables/overrides_file_complex_path/src/main.py
new file mode 100644
index 00000000000..b80e3222ab2
--- /dev/null
+++ b/acceptance/bundle/validate/variables/overrides_file_complex_path/src/main.py
@@ -0,0 +1 @@
+print("hi")
diff --git a/acceptance/bundle/validate/variables/overrides_file_complex_path/test.toml b/acceptance/bundle/validate/variables/overrides_file_complex_path/test.toml
new file mode 100644
index 00000000000..ca5df96f13e
--- /dev/null
+++ b/acceptance/bundle/validate/variables/overrides_file_complex_path/test.toml
@@ -0,0 +1,5 @@
+Badness = "Relative paths in variable-overrides.json resolve inconsistently: task files are resolved against the bundle root (with an error), libraries relative to the overrides file."
+
+[[Repls]]
+Old = '\\'
+New = '/'
diff --git a/acceptance/bundle/validate/variables/overrides_file_complex_path/variable-overrides.json b/acceptance/bundle/validate/variables/overrides_file_complex_path/variable-overrides.json
new file mode 100644
index 00000000000..3a44bf858e0
--- /dev/null
+++ b/acceptance/bundle/validate/variables/overrides_file_complex_path/variable-overrides.json
@@ -0,0 +1,14 @@
+{
+  "task": {
+    "task_key": "main",
+    "existing_cluster_id": "0123-456789-abcdefgh",
+    "spark_python_task": {
+      "python_file": "./src/main.py"
+    },
+    "libraries": [
+      {
+        "whl": "./src/lib.whl"
+      }
+    ]
+  }
+}
diff --git a/acceptance/bundle/validate/variables/target_inherited_from_target_merge/databricks.yml b/acceptance/bundle/validate/variables/target_inherited_from_target_merge/databricks.yml
new file mode 100644
index 00000000000..497c570326c
--- /dev/null
+++ b/acceptance/bundle/validate/variables/target_inherited_from_target_merge/databricks.yml
@@ -0,0 +1,15 @@
+bundle:
+  name: test-bundle
+
+variables:
+  x:
+    default: base
+
+definitions:
+  target_defaults: &target_defaults
+    variables:
+      x: overridden
+
+targets:
+  dev:
+    <<: *target_defaults
diff --git a/acceptance/bundle/validate/variables/target_inherited_from_target_merge/out.test.toml b/acceptance/bundle/validate/variables/target_inherited_from_target_merge/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/variables/target_inherited_from_target_merge/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/variables/target_inherited_from_target_merge/output.txt b/acceptance/bundle/validate/variables/target_inherited_from_target_merge/output.txt
new file mode 100644
index 00000000000..d3be1ebf0eb
--- /dev/null
+++ b/acceptance/bundle/validate/variables/target_inherited_from_target_merge/output.txt
@@ -0,0 +1,6 @@
+
+>>> [CLI] bundle validate -t dev -o json
+{
+  "default": "overridden",
+  "value": "overridden"
+}
diff --git a/acceptance/bundle/validate/variables/target_inherited_from_target_merge/script b/acceptance/bundle/validate/variables/target_inherited_from_target_merge/script
new file mode 100644
index 00000000000..4339582a088
--- /dev/null
+++ b/acceptance/bundle/validate/variables/target_inherited_from_target_merge/script
@@ -0,0 +1,2 @@
+# Target variable shorthands inherited through a merge key on the target are applied.
+trace $CLI bundle validate -t dev -o json | jq .variables.x
diff --git a/acceptance/bundle/validate/variables/target_timestamp_shorthand/databricks.yml b/acceptance/bundle/validate/variables/target_timestamp_shorthand/databricks.yml
new file mode 100644
index 00000000000..84eeb5183bd
--- /dev/null
+++ b/acceptance/bundle/validate/variables/target_timestamp_shorthand/databricks.yml
@@ -0,0 +1,11 @@
+bundle:
+  name: test-bundle
+
+variables:
+  x:
+    default: base
+
+targets:
+  dev:
+    variables:
+      x: 2020-01-02
diff --git a/acceptance/bundle/validate/variables/target_timestamp_shorthand/out.test.toml b/acceptance/bundle/validate/variables/target_timestamp_shorthand/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/variables/target_timestamp_shorthand/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/variables/target_timestamp_shorthand/output.txt b/acceptance/bundle/validate/variables/target_timestamp_shorthand/output.txt
new file mode 100644
index 00000000000..07eae4cbd80
--- /dev/null
+++ b/acceptance/bundle/validate/variables/target_timestamp_shorthand/output.txt
@@ -0,0 +1,10 @@
+
+>>> [CLI] bundle validate -t dev -o json
+Warning: expected map, found time
+  at targets.dev.variables.x
+  in databricks.yml:11:10
+
+{
+  "default": "base",
+  "value": "base"
+}
diff --git a/acceptance/bundle/validate/variables/target_timestamp_shorthand/script b/acceptance/bundle/validate/variables/target_timestamp_shorthand/script
new file mode 100644
index 00000000000..e5418dbd3df
--- /dev/null
+++ b/acceptance/bundle/validate/variables/target_timestamp_shorthand/script
@@ -0,0 +1,2 @@
+# A timestamp as a target variable shorthand.
+trace $CLI bundle validate -t dev -o json | jq .variables.x
diff --git a/acceptance/bundle/validate/variables/target_timestamp_shorthand/test.toml b/acceptance/bundle/validate/variables/target_timestamp_shorthand/test.toml
new file mode 100644
index 00000000000..83f0c9957ac
--- /dev/null
+++ b/acceptance/bundle/validate/variables/target_timestamp_shorthand/test.toml
@@ -0,0 +1 @@
+Badness = 'The timestamp shorthand is dropped with "expected map, found time" instead of being used as the default.'
diff --git a/acceptance/bundle/validate/volume_defaults/out.test.toml b/acceptance/bundle/validate/volume_defaults/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/validate/volume_defaults/out.test.toml
+++ b/acceptance/bundle/validate/volume_defaults/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/volume_defaults/output.txt b/acceptance/bundle/validate/volume_defaults/output.txt
index cb6213ead25..ecdbd7ae7b7 100644
--- a/acceptance/bundle/validate/volume_defaults/output.txt
+++ b/acceptance/bundle/validate/volume_defaults/output.txt
@@ -44,13 +44,16 @@ Warning: invalid value "already-set" for enum field. Valid values are [EXTERNAL
 
 {
   "v1": {
+    "volume_path": "/Volumes///",
     "volume_type": ""
   },
   "v2": {
+    "volume_path": "/Volumes///",
     "volume_type": "already-set"
   },
   "v3": {
     "comment": "hello",
+    "volume_path": "/Volumes///",
     "volume_type": "MANAGED"
   }
 }
diff --git a/acceptance/bundle/validate/yaml_anchors/alias_mutates_complex_default/databricks.yml b/acceptance/bundle/validate/yaml_anchors/alias_mutates_complex_default/databricks.yml
new file mode 100644
index 00000000000..87f970afec3
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/alias_mutates_complex_default/databricks.yml
@@ -0,0 +1,14 @@
+bundle:
+  name: test-bundle
+
+variables:
+  x:
+    default: base
+  payload:
+    type: complex
+    default: &overrides
+      x: overridden
+
+targets:
+  dev:
+    variables: *overrides
diff --git a/acceptance/bundle/validate/yaml_anchors/alias_mutates_complex_default/out.test.toml b/acceptance/bundle/validate/yaml_anchors/alias_mutates_complex_default/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/alias_mutates_complex_default/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/yaml_anchors/alias_mutates_complex_default/output.txt b/acceptance/bundle/validate/yaml_anchors/alias_mutates_complex_default/output.txt
new file mode 100644
index 00000000000..e324cc30cf1
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/alias_mutates_complex_default/output.txt
@@ -0,0 +1,17 @@
+
+>>> [CLI] bundle validate -t dev -o json
+{
+  "x": {
+    "default": "overridden",
+    "value": "overridden"
+  },
+  "payload": {
+    "default": {
+      "x": "overridden"
+    },
+    "type": "complex",
+    "value": {
+      "x": "overridden"
+    }
+  }
+}
diff --git a/acceptance/bundle/validate/yaml_anchors/alias_mutates_complex_default/script b/acceptance/bundle/validate/yaml_anchors/alias_mutates_complex_default/script
new file mode 100644
index 00000000000..56f3e365324
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/alias_mutates_complex_default/script
@@ -0,0 +1,2 @@
+# Target variables given as an alias of a complex default do not change that default.
+trace $CLI bundle validate -t dev -o json | jq '.variables | {x, payload}'
diff --git a/acceptance/bundle/validate/yaml_anchors/containers/databricks.yml b/acceptance/bundle/validate/yaml_anchors/containers/databricks.yml
new file mode 100644
index 00000000000..a82d4fe7202
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/containers/databricks.yml
@@ -0,0 +1,48 @@
+bundle:
+  name: test-bundle
+
+# This test verifies that anchors grouped in a list or a map do not trigger
+# "unknown field" warnings. The suppression recurses into containers whose
+# elements are all anchors. A container that also holds a non-anchor element is
+# not suppressed: it is reported as an unknown field, since it is more likely a
+# misplaced configuration value than a block of reusable anchors.
+
+task_defaults: &task_defaults
+  max_retries: 3
+
+# List of anchors.
+parameter_items:
+  - &p_first
+    name: first
+    default: one
+  - &p_second
+    name: second
+    default: two
+
+# Map of anchors.
+parameter_map:
+  entry: &p_map_entry
+    name: first
+
+# Container nested inside a container: a map whose value is a list of anchors.
+nested_parameters:
+  group:
+    - &p_nested
+      name: nested
+
+# Mixed container: one anchor and one non-anchor element. This is reported as an
+# unknown field because not all elements are anchor containers.
+mixed_parameters:
+  - &p_mixed
+    name: mixed
+  - name: plain
+
+resources:
+  jobs:
+    my_job:
+      name: "test job with anchors"
+      tasks:
+        - task_key: "main"
+          <<: *task_defaults
+          notebook_task:
+            notebook_path: "/some/notebook"
diff --git a/acceptance/bundle/validate/yaml_anchors/containers/out.test.toml b/acceptance/bundle/validate/yaml_anchors/containers/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/containers/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/yaml_anchors/containers/output.txt b/acceptance/bundle/validate/yaml_anchors/containers/output.txt
new file mode 100644
index 00000000000..86ae905e85f
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/containers/output.txt
@@ -0,0 +1,12 @@
+
+>>> [CLI] bundle validate
+Warning: unknown field: mixed_parameters
+  in databricks.yml:35:1
+
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Found 1 warning
diff --git a/acceptance/bundle/validate/yaml_anchors/containers/script b/acceptance/bundle/validate/yaml_anchors/containers/script
new file mode 100644
index 00000000000..5350876150f
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/containers/script
@@ -0,0 +1 @@
+trace $CLI bundle validate
diff --git a/acceptance/bundle/validate/yaml_anchors/cycle_nested/databricks.yml b/acceptance/bundle/validate/yaml_anchors/cycle_nested/databricks.yml
new file mode 100644
index 00000000000..41bfacdc5b5
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/cycle_nested/databricks.yml
@@ -0,0 +1,8 @@
+bundle:
+  name: test-bundle
+
+variables:
+  v:
+    default: &x
+      a:
+        - *x
diff --git a/acceptance/bundle/validate/yaml_anchors/cycle_nested/out.test.toml b/acceptance/bundle/validate/yaml_anchors/cycle_nested/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/cycle_nested/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/yaml_anchors/cycle_nested/output.txt b/acceptance/bundle/validate/yaml_anchors/cycle_nested/output.txt
new file mode 100644
index 00000000000..8226094673d
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/cycle_nested/output.txt
@@ -0,0 +1,8 @@
+
+>>> [CLI] bundle validate
+Error: failed to load [TEST_TMP_DIR]/databricks.yml: yaml ([TEST_TMP_DIR]/databricks.yml:8:11): cyclic reference to anchor "x"
+
+
+Found 1 error
+
+Exit code: 1
diff --git a/acceptance/bundle/validate/yaml_anchors/cycle_nested/script b/acceptance/bundle/validate/yaml_anchors/cycle_nested/script
new file mode 100644
index 00000000000..f52b452ee67
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/cycle_nested/script
@@ -0,0 +1 @@
+errcode trace $CLI bundle validate
diff --git a/acceptance/bundle/paths/fallback/test.toml b/acceptance/bundle/validate/yaml_anchors/cycle_nested/test.toml
similarity index 100%
rename from acceptance/bundle/paths/fallback/test.toml
rename to acceptance/bundle/validate/yaml_anchors/cycle_nested/test.toml
diff --git a/acceptance/bundle/validate/definitions_yaml_anchors/databricks.yml b/acceptance/bundle/validate/yaml_anchors/definitions/databricks.yml
similarity index 100%
rename from acceptance/bundle/validate/definitions_yaml_anchors/databricks.yml
rename to acceptance/bundle/validate/yaml_anchors/definitions/databricks.yml
diff --git a/acceptance/bundle/validate/yaml_anchors/definitions/out.test.toml b/acceptance/bundle/validate/yaml_anchors/definitions/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/definitions/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/definitions_yaml_anchors/output.txt b/acceptance/bundle/validate/yaml_anchors/definitions/output.txt
similarity index 100%
rename from acceptance/bundle/validate/definitions_yaml_anchors/output.txt
rename to acceptance/bundle/validate/yaml_anchors/definitions/output.txt
diff --git a/acceptance/bundle/validate/yaml_anchors/definitions/script b/acceptance/bundle/validate/yaml_anchors/definitions/script
new file mode 100644
index 00000000000..5350876150f
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/definitions/script
@@ -0,0 +1 @@
+trace $CLI bundle validate
diff --git a/acceptance/bundle/validate/duplicate_yaml_merge_key/databricks.yml b/acceptance/bundle/validate/yaml_anchors/duplicate_merge_key_in_cluster/databricks.yml
similarity index 100%
rename from acceptance/bundle/validate/duplicate_yaml_merge_key/databricks.yml
rename to acceptance/bundle/validate/yaml_anchors/duplicate_merge_key_in_cluster/databricks.yml
diff --git a/acceptance/bundle/validate/yaml_anchors/duplicate_merge_key_in_cluster/out.test.toml b/acceptance/bundle/validate/yaml_anchors/duplicate_merge_key_in_cluster/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/duplicate_merge_key_in_cluster/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/duplicate_yaml_merge_key/output.txt b/acceptance/bundle/validate/yaml_anchors/duplicate_merge_key_in_cluster/output.txt
similarity index 100%
rename from acceptance/bundle/validate/duplicate_yaml_merge_key/output.txt
rename to acceptance/bundle/validate/yaml_anchors/duplicate_merge_key_in_cluster/output.txt
diff --git a/acceptance/bundle/validate/duplicate_yaml_merge_key/script b/acceptance/bundle/validate/yaml_anchors/duplicate_merge_key_in_cluster/script
similarity index 100%
rename from acceptance/bundle/validate/duplicate_yaml_merge_key/script
rename to acceptance/bundle/validate/yaml_anchors/duplicate_merge_key_in_cluster/script
diff --git a/acceptance/bundle/validate/yaml_anchors/duplicate_merge_keys/databricks.yml b/acceptance/bundle/validate/yaml_anchors/duplicate_merge_keys/databricks.yml
new file mode 100644
index 00000000000..638c26ee0ad
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/duplicate_merge_keys/databricks.yml
@@ -0,0 +1,18 @@
+bundle:
+  name: test-bundle
+
+variables:
+  x:
+    default: base
+
+definitions:
+  a: &a
+    x: first
+  b: &b
+    x: second
+
+targets:
+  dev:
+    variables:
+      <<: *a
+      <<: *b
diff --git a/acceptance/bundle/validate/yaml_anchors/duplicate_merge_keys/out.test.toml b/acceptance/bundle/validate/yaml_anchors/duplicate_merge_keys/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/duplicate_merge_keys/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/yaml_anchors/duplicate_merge_keys/output.txt b/acceptance/bundle/validate/yaml_anchors/duplicate_merge_keys/output.txt
new file mode 100644
index 00000000000..2efbf8faf73
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/duplicate_merge_keys/output.txt
@@ -0,0 +1,9 @@
+
+>>> [CLI] bundle validate -t dev
+Error: duplicate YAML merge key ('<<') is not allowed; to merge multiple maps, use a sequence: '<<: [*anchor1, *anchor2]'
+  in databricks.yml:18:7
+
+
+Found 1 error
+
+Exit code: 1
diff --git a/acceptance/bundle/validate/yaml_anchors/duplicate_merge_keys/script b/acceptance/bundle/validate/yaml_anchors/duplicate_merge_keys/script
new file mode 100644
index 00000000000..e316f5883d8
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/duplicate_merge_keys/script
@@ -0,0 +1,2 @@
+# Two '<<' keys in target variables are an error.
+errcode trace $CLI bundle validate -t dev
diff --git a/acceptance/bundle/validate/yaml_anchors/inline_merge_mapping/databricks.yml b/acceptance/bundle/validate/yaml_anchors/inline_merge_mapping/databricks.yml
new file mode 100644
index 00000000000..c79cadfe0a8
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/inline_merge_mapping/databricks.yml
@@ -0,0 +1,11 @@
+bundle:
+  name: test-bundle
+
+variables:
+  x:
+    default: base
+
+targets:
+  dev:
+    variables:
+      <<: {x: overridden}
diff --git a/acceptance/bundle/validate/yaml_anchors/inline_merge_mapping/out.test.toml b/acceptance/bundle/validate/yaml_anchors/inline_merge_mapping/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/inline_merge_mapping/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/yaml_anchors/inline_merge_mapping/output.txt b/acceptance/bundle/validate/yaml_anchors/inline_merge_mapping/output.txt
new file mode 100644
index 00000000000..85dc1ee379b
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/inline_merge_mapping/output.txt
@@ -0,0 +1,8 @@
+
+>>> [CLI] bundle validate
+Error: failed to load [TEST_TMP_DIR]/databricks.yml: yaml ([TEST_TMP_DIR]/databricks.yml:11:11): map merge requires map or sequence of maps as the value
+
+
+Found 1 error
+
+Exit code: 1
diff --git a/acceptance/bundle/validate/yaml_anchors/inline_merge_mapping/script b/acceptance/bundle/validate/yaml_anchors/inline_merge_mapping/script
new file mode 100644
index 00000000000..1724b135e5e
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/inline_merge_mapping/script
@@ -0,0 +1,2 @@
+# An inline mapping as the value of '<<' in target variables.
+errcode trace $CLI bundle validate
diff --git a/acceptance/bundle/validate/yaml_anchors/inline_merge_mapping/test.toml b/acceptance/bundle/validate/yaml_anchors/inline_merge_mapping/test.toml
new file mode 100644
index 00000000000..84101454028
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/inline_merge_mapping/test.toml
@@ -0,0 +1 @@
+Badness = "The YAML merge key spec allows a single mapping as the value of the merge key, but it is rejected."
diff --git a/acceptance/bundle/validate/yaml_anchors/invalid_merge_sequence_member/databricks.yml b/acceptance/bundle/validate/yaml_anchors/invalid_merge_sequence_member/databricks.yml
new file mode 100644
index 00000000000..2c0bf7fe5b8
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/invalid_merge_sequence_member/databricks.yml
@@ -0,0 +1,15 @@
+bundle:
+  name: test-bundle
+
+variables:
+  x:
+    default: base
+
+definitions:
+  overrides: &overrides
+    x: overridden
+
+targets:
+  dev:
+    variables:
+      <<: [*overrides, 17]
diff --git a/acceptance/bundle/validate/yaml_anchors/invalid_merge_sequence_member/out.test.toml b/acceptance/bundle/validate/yaml_anchors/invalid_merge_sequence_member/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/invalid_merge_sequence_member/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/yaml_anchors/invalid_merge_sequence_member/output.txt b/acceptance/bundle/validate/yaml_anchors/invalid_merge_sequence_member/output.txt
new file mode 100644
index 00000000000..770f0193a58
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/invalid_merge_sequence_member/output.txt
@@ -0,0 +1,8 @@
+
+>>> [CLI] bundle validate -t dev
+Error: failed to load [TEST_TMP_DIR]/databricks.yml: yaml ([TEST_TMP_DIR]/databricks.yml:15:11): map merge requires map or sequence of maps as the value
+
+
+Found 1 error
+
+Exit code: 1
diff --git a/acceptance/bundle/validate/yaml_anchors/invalid_merge_sequence_member/script b/acceptance/bundle/validate/yaml_anchors/invalid_merge_sequence_member/script
new file mode 100644
index 00000000000..497e2fefa39
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/invalid_merge_sequence_member/script
@@ -0,0 +1,2 @@
+# A scalar among the maps merged with '<<: [...]' is an error.
+errcode trace $CLI bundle validate -t dev
diff --git a/acceptance/bundle/validate/yaml_anchors/target_variable_full_def/databricks.yml b/acceptance/bundle/validate/yaml_anchors/target_variable_full_def/databricks.yml
new file mode 100644
index 00000000000..f7bac987ac3
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/target_variable_full_def/databricks.yml
@@ -0,0 +1,13 @@
+bundle:
+  name: test-bundle
+
+variables:
+  x: &x
+    default: old
+
+targets:
+  dev:
+    variables:
+      x:
+        <<: *x
+        default: new
diff --git a/acceptance/bundle/validate/yaml_anchors/target_variable_full_def/out.test.toml b/acceptance/bundle/validate/yaml_anchors/target_variable_full_def/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/target_variable_full_def/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/yaml_anchors/target_variable_full_def/output.txt b/acceptance/bundle/validate/yaml_anchors/target_variable_full_def/output.txt
new file mode 100644
index 00000000000..d9ce0976398
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/target_variable_full_def/output.txt
@@ -0,0 +1,6 @@
+
+>>> [CLI] bundle validate -t dev -o json
+{
+  "default": "new",
+  "value": "new"
+}
diff --git a/acceptance/bundle/validate/yaml_anchors/target_variable_full_def/script b/acceptance/bundle/validate/yaml_anchors/target_variable_full_def/script
new file mode 100644
index 00000000000..9f33dba3103
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/target_variable_full_def/script
@@ -0,0 +1 @@
+trace $CLI bundle validate -t dev -o json | jq .variables.x
diff --git a/acceptance/bundle/validate/yaml_anchors/target_variable_precedence/databricks.yml b/acceptance/bundle/validate/yaml_anchors/target_variable_precedence/databricks.yml
new file mode 100644
index 00000000000..d4e45925b2d
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/target_variable_precedence/databricks.yml
@@ -0,0 +1,16 @@
+bundle:
+  name: test-bundle
+
+variables:
+  x:
+
+definitions:
+  a: &a
+    x: from-a
+  b: &b
+    x: from-b
+
+targets:
+  dev:
+    variables:
+      <<: [*a, *b]
diff --git a/acceptance/bundle/validate/yaml_anchors/target_variable_precedence/out.test.toml b/acceptance/bundle/validate/yaml_anchors/target_variable_precedence/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/target_variable_precedence/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/yaml_anchors/target_variable_precedence/output.txt b/acceptance/bundle/validate/yaml_anchors/target_variable_precedence/output.txt
new file mode 100644
index 00000000000..e8bc246c483
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/target_variable_precedence/output.txt
@@ -0,0 +1,8 @@
+
+>>> [CLI] bundle validate -t dev -o json
+{
+  "x": {
+    "default": "from-b",
+    "value": "from-b"
+  }
+}
diff --git a/acceptance/bundle/validate/yaml_anchors/target_variable_precedence/script b/acceptance/bundle/validate/yaml_anchors/target_variable_precedence/script
new file mode 100644
index 00000000000..ab024d811b0
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/target_variable_precedence/script
@@ -0,0 +1 @@
+trace $CLI bundle validate -t dev -o json | jq .variables
diff --git a/acceptance/bundle/validate/yaml_anchors/target_variable_precedence/test.toml b/acceptance/bundle/validate/yaml_anchors/target_variable_precedence/test.toml
new file mode 100644
index 00000000000..5fba7c799c1
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/target_variable_precedence/test.toml
@@ -0,0 +1 @@
+Badness = "With <<: [*a, *b] the later anchor wins; the YAML merge key spec gives precedence to the earlier one."
diff --git a/acceptance/bundle/validate/yaml_anchors/target_variable_shorthand_alias/databricks.yml b/acceptance/bundle/validate/yaml_anchors/target_variable_shorthand_alias/databricks.yml
new file mode 100644
index 00000000000..dab70888e89
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/target_variable_shorthand_alias/databricks.yml
@@ -0,0 +1,22 @@
+bundle:
+  name: test-bundle
+
+variables:
+  env:
+  region:
+  size:
+  other:
+
+definitions:
+  dev_env: &dev "dev-value"
+  common: &common
+    region: us-east-1
+    size: small
+
+targets:
+  dev:
+    variables:
+      env: *dev
+      <<: *common
+      size: large
+      other: plain
diff --git a/acceptance/bundle/validate/yaml_anchors/target_variable_shorthand_alias/out.test.toml b/acceptance/bundle/validate/yaml_anchors/target_variable_shorthand_alias/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/target_variable_shorthand_alias/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/yaml_anchors/target_variable_shorthand_alias/output.txt b/acceptance/bundle/validate/yaml_anchors/target_variable_shorthand_alias/output.txt
new file mode 100644
index 00000000000..73f378fee1c
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/target_variable_shorthand_alias/output.txt
@@ -0,0 +1,20 @@
+
+>>> [CLI] bundle validate -t dev -o json
+{
+  "env": {
+    "default": "dev-value",
+    "value": "dev-value"
+  },
+  "other": {
+    "default": "plain",
+    "value": "plain"
+  },
+  "region": {
+    "default": "us-east-1",
+    "value": "us-east-1"
+  },
+  "size": {
+    "default": "large",
+    "value": "large"
+  }
+}
diff --git a/acceptance/bundle/validate/yaml_anchors/target_variable_shorthand_alias/script b/acceptance/bundle/validate/yaml_anchors/target_variable_shorthand_alias/script
new file mode 100644
index 00000000000..ab024d811b0
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/target_variable_shorthand_alias/script
@@ -0,0 +1 @@
+trace $CLI bundle validate -t dev -o json | jq .variables
diff --git a/acceptance/bundle/validate/yaml_anchors/test.toml b/acceptance/bundle/validate/yaml_anchors/test.toml
new file mode 100644
index 00000000000..e9cede5e28a
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_anchors/test.toml
@@ -0,0 +1,4 @@
+# Errors for invalid YAML print the full path of the file; normalize Windows separators.
+[[Repls]]
+Old = '\\'
+New = '/'
diff --git a/acceptance/bundle/validate/yaml_duplicate_keys/resource_fields/databricks.yml b/acceptance/bundle/validate/yaml_duplicate_keys/resource_fields/databricks.yml
new file mode 100644
index 00000000000..d29746866db
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_duplicate_keys/resource_fields/databricks.yml
@@ -0,0 +1,16 @@
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    j:
+      name: first
+      max_concurrent_runs: 1
+      tags:
+        a: one
+        shared: first
+      name: second
+      max_concurrent_runs: 5
+      tags:
+        b: two
+        shared: second
diff --git a/acceptance/bundle/validate/yaml_duplicate_keys/resource_fields/out.test.toml b/acceptance/bundle/validate/yaml_duplicate_keys/resource_fields/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_duplicate_keys/resource_fields/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/yaml_duplicate_keys/resource_fields/output.txt b/acceptance/bundle/validate/yaml_duplicate_keys/resource_fields/output.txt
new file mode 100644
index 00000000000..c395fba7081
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_duplicate_keys/resource_fields/output.txt
@@ -0,0 +1,19 @@
+
+>>> [CLI] bundle validate
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Validation OK!
+
+>>> [CLI] bundle validate -o json
+{
+  "name": "second",
+  "max_concurrent_runs": 5,
+  "tags": {
+    "b": "two",
+    "shared": "second"
+  }
+}
diff --git a/acceptance/bundle/validate/yaml_duplicate_keys/resource_fields/script b/acceptance/bundle/validate/yaml_duplicate_keys/resource_fields/script
new file mode 100644
index 00000000000..7b6d7caa93b
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_duplicate_keys/resource_fields/script
@@ -0,0 +1,5 @@
+# Duplicate keys in a mapping are accepted without a warning, although YAML requires keys to be unique.
+trace $CLI bundle validate
+
+# The later value replaces the earlier one as a whole: maps are not merged ("a" is gone).
+trace $CLI bundle validate -o json | jq '.resources.jobs.j | {name, max_concurrent_runs, tags}'
diff --git a/acceptance/bundle/validate/yaml_duplicate_keys/resource_fields/test.toml b/acceptance/bundle/validate/yaml_duplicate_keys/resource_fields/test.toml
new file mode 100644
index 00000000000..af65b8438c4
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_duplicate_keys/resource_fields/test.toml
@@ -0,0 +1 @@
+Badness = "Duplicate keys are accepted silently (the later one wins); YAML requires keys to be unique."
diff --git a/acceptance/bundle/validate/yaml_duplicate_keys/shadowed_invalid_subtree/databricks.yml b/acceptance/bundle/validate/yaml_duplicate_keys/shadowed_invalid_subtree/databricks.yml
new file mode 100644
index 00000000000..03d9373eed1
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_duplicate_keys/shadowed_invalid_subtree/databricks.yml
@@ -0,0 +1,11 @@
+bundle:
+  name: test-bundle
+
+resources:
+  jobs:
+    j:
+      name: test
+      tags:
+        7: invalid-key
+      tags:
+        good: ok
diff --git a/acceptance/bundle/validate/yaml_duplicate_keys/shadowed_invalid_subtree/out.test.toml b/acceptance/bundle/validate/yaml_duplicate_keys/shadowed_invalid_subtree/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_duplicate_keys/shadowed_invalid_subtree/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/yaml_duplicate_keys/shadowed_invalid_subtree/output.txt b/acceptance/bundle/validate/yaml_duplicate_keys/shadowed_invalid_subtree/output.txt
new file mode 100644
index 00000000000..8c0f7149fad
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_duplicate_keys/shadowed_invalid_subtree/output.txt
@@ -0,0 +1,8 @@
+
+>>> [CLI] bundle validate
+Error: failed to load [TEST_TMP_DIR]/databricks.yml: yaml ([TEST_TMP_DIR]/databricks.yml:9:9): invalid key tag: !!int
+
+
+Found 1 error
+
+Exit code: 1
diff --git a/acceptance/bundle/validate/yaml_duplicate_keys/shadowed_invalid_subtree/script b/acceptance/bundle/validate/yaml_duplicate_keys/shadowed_invalid_subtree/script
new file mode 100644
index 00000000000..58b74e2f574
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_duplicate_keys/shadowed_invalid_subtree/script
@@ -0,0 +1,2 @@
+# A value replaced by a later duplicate key is still loaded, so its invalid (integer) key is rejected.
+errcode trace $CLI bundle validate
diff --git a/acceptance/bundle/validate/yaml_duplicate_keys/shadowed_invalid_subtree/test.toml b/acceptance/bundle/validate/yaml_duplicate_keys/shadowed_invalid_subtree/test.toml
new file mode 100644
index 00000000000..bad67f27bd1
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_duplicate_keys/shadowed_invalid_subtree/test.toml
@@ -0,0 +1 @@
+Badness = 'The duplicate tags key is accepted silently (the later one wins); YAML requires keys to be unique.'
diff --git a/acceptance/bundle/validate/yaml_duplicate_keys/target_variable_default/databricks.yml b/acceptance/bundle/validate/yaml_duplicate_keys/target_variable_default/databricks.yml
new file mode 100644
index 00000000000..38c97681a98
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_duplicate_keys/target_variable_default/databricks.yml
@@ -0,0 +1,13 @@
+bundle:
+  name: test-bundle
+
+variables:
+  x:
+    default: base
+
+targets:
+  dev:
+    variables:
+      x:
+        default: first
+        default: second
diff --git a/acceptance/bundle/validate/yaml_duplicate_keys/target_variable_default/out.test.toml b/acceptance/bundle/validate/yaml_duplicate_keys/target_variable_default/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_duplicate_keys/target_variable_default/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/validate/yaml_duplicate_keys/target_variable_default/output.txt b/acceptance/bundle/validate/yaml_duplicate_keys/target_variable_default/output.txt
new file mode 100644
index 00000000000..5c429a0449c
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_duplicate_keys/target_variable_default/output.txt
@@ -0,0 +1,6 @@
+
+>>> [CLI] bundle validate -t dev -o json
+{
+  "default": "second",
+  "value": "second"
+}
diff --git a/acceptance/bundle/validate/yaml_duplicate_keys/target_variable_default/script b/acceptance/bundle/validate/yaml_duplicate_keys/target_variable_default/script
new file mode 100644
index 00000000000..771eda950ef
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_duplicate_keys/target_variable_default/script
@@ -0,0 +1,2 @@
+# With a duplicate default key in a target variable override, the last one wins and it is a full definition.
+trace $CLI bundle validate -t dev -o json | jq .variables.x
diff --git a/acceptance/bundle/validate/yaml_duplicate_keys/target_variable_default/test.toml b/acceptance/bundle/validate/yaml_duplicate_keys/target_variable_default/test.toml
new file mode 100644
index 00000000000..42d04e8a1ef
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_duplicate_keys/target_variable_default/test.toml
@@ -0,0 +1 @@
+Badness = 'The duplicate default key is accepted silently (the later one wins); YAML requires keys to be unique.'
diff --git a/acceptance/bundle/validate/yaml_duplicate_keys/test.toml b/acceptance/bundle/validate/yaml_duplicate_keys/test.toml
new file mode 100644
index 00000000000..e9cede5e28a
--- /dev/null
+++ b/acceptance/bundle/validate/yaml_duplicate_keys/test.toml
@@ -0,0 +1,4 @@
+# Errors for invalid YAML print the full path of the file; normalize Windows separators.
+[[Repls]]
+Old = '\\'
+New = '/'
diff --git a/acceptance/bundle/variables/arg-repeat/out.test.toml b/acceptance/bundle/variables/arg-repeat/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/variables/arg-repeat/out.test.toml
+++ b/acceptance/bundle/variables/arg-repeat/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/variables/arg-repeat/output.txt b/acceptance/bundle/variables/arg-repeat/output.txt
index 4b97d70a153..dafadc8e4aa 100644
--- a/acceptance/bundle/variables/arg-repeat/output.txt
+++ b/acceptance/bundle/variables/arg-repeat/output.txt
@@ -7,12 +7,10 @@
   }
 }
 
->>> errcode [CLI] bundle validate --var a=one --var a=two
+>>> musterr [CLI] bundle validate --var a=one --var a=two
 Error: failed to assign two to a: variable has already been assigned value: one
 
 Name: arg-repeat
 Target: default
 
 Found 1 error
-
-Exit code: 1
diff --git a/acceptance/bundle/variables/arg-repeat/script b/acceptance/bundle/variables/arg-repeat/script
index 3e03dbcb121..d74ff35c362 100644
--- a/acceptance/bundle/variables/arg-repeat/script
+++ b/acceptance/bundle/variables/arg-repeat/script
@@ -1,2 +1,2 @@
 trace errcode $CLI bundle validate --var a=one -o json | jq .variables
-trace errcode $CLI bundle validate --var a=one --var a=two
+trace musterr $CLI bundle validate --var a=one --var a=two
diff --git a/acceptance/bundle/variables/complex-cross-ref/out.test.toml b/acceptance/bundle/variables/complex-cross-ref/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/variables/complex-cross-ref/out.test.toml
+++ b/acceptance/bundle/variables/complex-cross-ref/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/variables/complex-cycle-self/out.test.toml b/acceptance/bundle/variables/complex-cycle-self/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/variables/complex-cycle-self/out.test.toml
+++ b/acceptance/bundle/variables/complex-cycle-self/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/variables/complex-cycle/out.test.toml b/acceptance/bundle/variables/complex-cycle/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/variables/complex-cycle/out.test.toml
+++ b/acceptance/bundle/variables/complex-cycle/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/variables/complex-simple/out.test.toml b/acceptance/bundle/variables/complex-simple/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/variables/complex-simple/out.test.toml
+++ b/acceptance/bundle/variables/complex-simple/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/variables/complex-transitive-deep/out.test.toml b/acceptance/bundle/variables/complex-transitive-deep/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/variables/complex-transitive-deep/out.test.toml
+++ b/acceptance/bundle/variables/complex-transitive-deep/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/variables/complex-transitive-deeper/out.test.toml b/acceptance/bundle/variables/complex-transitive-deeper/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/variables/complex-transitive-deeper/out.test.toml
+++ b/acceptance/bundle/variables/complex-transitive-deeper/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/variables/complex-transitive/out.test.toml b/acceptance/bundle/variables/complex-transitive/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/variables/complex-transitive/out.test.toml
+++ b/acceptance/bundle/variables/complex-transitive/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/variables/complex-with-var-reference/out.test.toml b/acceptance/bundle/variables/complex-with-var-reference/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/variables/complex-with-var-reference/out.test.toml
+++ b/acceptance/bundle/variables/complex-with-var-reference/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/variables/complex-within-complex/out.test.toml b/acceptance/bundle/variables/complex-within-complex/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/variables/complex-within-complex/out.test.toml
+++ b/acceptance/bundle/variables/complex-within-complex/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/variables/complex/out.test.toml b/acceptance/bundle/variables/complex/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/variables/complex/out.test.toml
+++ b/acceptance/bundle/variables/complex/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/variables/complex_multiple_files/out.test.toml b/acceptance/bundle/variables/complex_multiple_files/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/variables/complex_multiple_files/out.test.toml
+++ b/acceptance/bundle/variables/complex_multiple_files/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/variables/cycle/out.test.toml b/acceptance/bundle/variables/cycle/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/variables/cycle/out.test.toml
+++ b/acceptance/bundle/variables/cycle/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/variables/double_underscore/out.test.toml b/acceptance/bundle/variables/double_underscore/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/variables/double_underscore/out.test.toml
+++ b/acceptance/bundle/variables/double_underscore/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/variables/empty/out.test.toml b/acceptance/bundle/variables/empty/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/variables/empty/out.test.toml
+++ b/acceptance/bundle/variables/empty/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/variables/env_overrides/out.test.toml b/acceptance/bundle/variables/env_overrides/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/variables/env_overrides/out.test.toml
+++ b/acceptance/bundle/variables/env_overrides/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/variables/file-defaults/out.test.toml b/acceptance/bundle/variables/file-defaults/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/variables/file-defaults/out.test.toml
+++ b/acceptance/bundle/variables/file-defaults/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/variables/git-branch/out.test.toml b/acceptance/bundle/variables/git-branch/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/variables/git-branch/out.test.toml
+++ b/acceptance/bundle/variables/git-branch/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/variables/host/out.test.toml b/acceptance/bundle/variables/host/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/variables/host/out.test.toml
+++ b/acceptance/bundle/variables/host/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/variables/int/out.test.toml b/acceptance/bundle/variables/int/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/variables/int/out.test.toml
+++ b/acceptance/bundle/variables/int/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/variables/issue_2436/out.test.toml b/acceptance/bundle/variables/issue_2436/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/variables/issue_2436/out.test.toml
+++ b/acceptance/bundle/variables/issue_2436/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/variables/issue_2436/output.txt b/acceptance/bundle/variables/issue_2436/output.txt
index 66484db6849..cd4c8e61f62 100644
--- a/acceptance/bundle/variables/issue_2436/output.txt
+++ b/acceptance/bundle/variables/issue_2436/output.txt
@@ -1,4 +1,4 @@
-Warning: Ignoring Databricks CLI version constraint for development build. Required: >= 0.229.0, current: [DEV_VERSION]
+Warning: Ignoring Databricks CLI version constraint for development build. Required: >= 0.229.0, current: [CLI_VERSION]
 
 Error: failed to perform target override for target=dev: failed to merge target=dev field=resources: cannot merge string with sequence
 
diff --git a/acceptance/bundle/variables/issue_3039_lookup_with_ref/out.test.toml b/acceptance/bundle/variables/issue_3039_lookup_with_ref/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/variables/issue_3039_lookup_with_ref/out.test.toml
+++ b/acceptance/bundle/variables/issue_3039_lookup_with_ref/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/variables/lookup/databricks.yml b/acceptance/bundle/variables/lookup/databricks.yml
deleted file mode 100644
index c7d1b4d47b3..00000000000
--- a/acceptance/bundle/variables/lookup/databricks.yml
+++ /dev/null
@@ -1,10 +0,0 @@
-bundle:
-  name: test-bundle
-
-variables:
-  sp:
-    lookup:
-      service_principal: "deco-test-spn"
-
-  result:
-    default: ${var.sp}
diff --git a/acceptance/bundle/variables/lookup/databricks.yml.tmpl b/acceptance/bundle/variables/lookup/databricks.yml.tmpl
new file mode 100644
index 00000000000..4ab508f4f74
--- /dev/null
+++ b/acceptance/bundle/variables/lookup/databricks.yml.tmpl
@@ -0,0 +1,10 @@
+bundle:
+  name: test-bundle
+
+variables:
+  sp:
+    lookup:
+      service_principal: "$TEST_SP_DISPLAY_NAME"
+
+  result:
+    default: ${var.sp}
diff --git a/acceptance/bundle/variables/lookup/out.test.toml b/acceptance/bundle/variables/lookup/out.test.toml
index bbc7fcfd1bd..0f167effef1 100644
--- a/acceptance/bundle/variables/lookup/out.test.toml
+++ b/acceptance/bundle/variables/lookup/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/variables/lookup/output.txt b/acceptance/bundle/variables/lookup/output.txt
index 1cfc0904411..cefd19e596d 100644
--- a/acceptance/bundle/variables/lookup/output.txt
+++ b/acceptance/bundle/variables/lookup/output.txt
@@ -7,7 +7,7 @@
   },
   "sp": {
     "lookup": {
-      "service_principal": "deco-test-spn"
+      "service_principal": "[TEST_SP_DISPLAY_NAME]"
     },
     "value": "[UUID]"
   }
diff --git a/acceptance/bundle/variables/lookup/script b/acceptance/bundle/variables/lookup/script
index 5a066dfada4..58e451daaed 100644
--- a/acceptance/bundle/variables/lookup/script
+++ b/acceptance/bundle/variables/lookup/script
@@ -1 +1,8 @@
+# The SP display name to look up differs per environment; TEST_SP_DISPLAY_NAME is
+# provisioned in the cloud env, and we fall back to the name the local testserver
+# reports so the test passes in both. Mask it to a stable placeholder either way.
+export TEST_SP_DISPLAY_NAME="${TEST_SP_DISPLAY_NAME:-deco-test-spn}"
+add_repl "$TEST_SP_DISPLAY_NAME" TEST_SP_DISPLAY_NAME
+envsubst < databricks.yml.tmpl > databricks.yml
+
 trace $CLI bundle validate -o json | jq '.variables'
diff --git a/acceptance/bundle/variables/lookup/test.toml b/acceptance/bundle/variables/lookup/test.toml
index 485bf96ec51..e4729fbd8c7 100644
--- a/acceptance/bundle/variables/lookup/test.toml
+++ b/acceptance/bundle/variables/lookup/test.toml
@@ -1,6 +1,9 @@
-Local = true
 Cloud = true
 
+Ignore = [
+    "databricks.yml",
+]
+
 [[Server]]
 Pattern = "GET /api/2.0/preview/scim/v2/ServicePrincipals"
 Response.Body = '''{
diff --git a/acceptance/bundle/variables/prepend-workspace-var/databricks.yml b/acceptance/bundle/variables/prepend-workspace-var/databricks.yml
index 1b6f60c86a9..d0dd3cf4220 100644
--- a/acceptance/bundle/variables/prepend-workspace-var/databricks.yml
+++ b/acceptance/bundle/variables/prepend-workspace-var/databricks.yml
@@ -7,7 +7,7 @@ workspace:
 
 variables:
   workspace_root:
-    description: "root directory in the Databricks workspace to store the asset bundle and associated artifacts"
+    description: "root directory in the Databricks workspace to store the Declarative Automation Bundle and associated artifacts"
     default: /Users/${workspace.current_user.userName}
 
 targets:
diff --git a/acceptance/bundle/variables/prepend-workspace-var/out.test.toml b/acceptance/bundle/variables/prepend-workspace-var/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/variables/prepend-workspace-var/out.test.toml
+++ b/acceptance/bundle/variables/prepend-workspace-var/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/variables/prepend-workspace-var/output.txt b/acceptance/bundle/variables/prepend-workspace-var/output.txt
index 657ebe4d847..81a62f511ea 100644
--- a/acceptance/bundle/variables/prepend-workspace-var/output.txt
+++ b/acceptance/bundle/variables/prepend-workspace-var/output.txt
@@ -52,7 +52,7 @@ Warning: required field "package_name" is not set
   "variables": {
     "workspace_root": {
       "default": "/Users/[USERNAME]",
-      "description": "root directory in the Databricks workspace to store the asset bundle and associated artifacts",
+      "description": "root directory in the Databricks workspace to store the Declarative Automation Bundle and associated artifacts",
       "value": "/Users/[USERNAME]"
     }
   },
diff --git a/acceptance/bundle/variables/reference-typo/double-nested-typo-multiple/databricks.yml b/acceptance/bundle/variables/reference-typo/double-nested-typo-multiple/databricks.yml
new file mode 100644
index 00000000000..284414fb427
--- /dev/null
+++ b/acceptance/bundle/variables/reference-typo/double-nested-typo-multiple/databricks.yml
@@ -0,0 +1,21 @@
+bundle:
+  name: reference-typo-double-nested-typo-multiple
+
+variables:
+  cluster:
+    type: complex
+    default:
+      spark_version: "13.2.x"
+  clusters:
+    type: complex
+    default:
+      spark_version: "13.2.x"
+
+resources:
+  jobs:
+    one:
+      # Two typos in a single reference across nesting layers, where the outermost
+      # key "clustr" is within distance 2 of both "cluster" and "clusters". The
+      # lookup fails at the outermost key, so both are suggested and the inner typo
+      # ("spark_versio") is never reached.
+      name: ${var.clustr.spark_versio}
diff --git a/acceptance/bundle/variables/reference-typo/double-nested-typo/databricks.yml b/acceptance/bundle/variables/reference-typo/double-nested-typo/databricks.yml
new file mode 100644
index 00000000000..627adcff302
--- /dev/null
+++ b/acceptance/bundle/variables/reference-typo/double-nested-typo/databricks.yml
@@ -0,0 +1,16 @@
+bundle:
+  name: reference-typo-double-nested-typo
+
+variables:
+  cluster:
+    type: complex
+    default:
+      spark_version: "13.2.x"
+
+resources:
+  jobs:
+    one:
+      # Two typos in a single reference across nesting layers: "clustr" (cluster)
+      # and "spark_versio" (spark_version). The lookup fails at the outermost key,
+      # so only "cluster" is suggested; the inner typo is never reached.
+      name: ${var.clustr.spark_versio}
diff --git a/acceptance/bundle/variables/reference-typo/multiple-typos/databricks.yml b/acceptance/bundle/variables/reference-typo/multiple-typos/databricks.yml
new file mode 100644
index 00000000000..53b7d7ffeba
--- /dev/null
+++ b/acceptance/bundle/variables/reference-typo/multiple-typos/databricks.yml
@@ -0,0 +1,21 @@
+bundle:
+  name: reference-typo-multiple-typos
+
+variables:
+  cluster:
+    type: complex
+    default:
+      spark_version: "13.2.x"
+      node_type_id: Standard_DS3_v2
+
+resources:
+  jobs:
+    # Two typos in references to a complex (nested) variable. References are
+    # resolved in sorted order of their config path, and resolution stops at the
+    # first unresolved one, so only job "a" is reported even though "b" is wrong too.
+    a:
+      # Deeply nested typo: ${var.cluster.spark_versio} should be spark_version.
+      name: ${var.cluster.spark_versio}
+    b:
+      # Typo at the variable name: ${var.clustr.node_type_id} should be cluster.
+      name: ${var.clustr.node_type_id}
diff --git a/acceptance/bundle/variables/reference-typo/multiple/databricks.yml b/acceptance/bundle/variables/reference-typo/multiple/databricks.yml
new file mode 100644
index 00000000000..2071ff28c32
--- /dev/null
+++ b/acceptance/bundle/variables/reference-typo/multiple/databricks.yml
@@ -0,0 +1,14 @@
+bundle:
+  name: reference-typo-multiple
+
+variables:
+  host:
+    default: https://example.test
+  hosts:
+    default: https://example.test
+
+resources:
+  jobs:
+    one:
+      # "hst" is within edit distance 2 of both "host" and "hosts"
+      name: ${var.hst}
diff --git a/acceptance/bundle/variables/reference-typo/non-var-multiple/databricks.yml b/acceptance/bundle/variables/reference-typo/non-var-multiple/databricks.yml
new file mode 100644
index 00000000000..0f43e908687
--- /dev/null
+++ b/acceptance/bundle/variables/reference-typo/non-var-multiple/databricks.yml
@@ -0,0 +1,9 @@
+bundle:
+  name: reference-typo-non-var-multiple
+
+resources:
+  jobs:
+    one:
+      # A non-"var" reference. "stot_path" is within edit distance 2 of both
+      # workspace.root_path and workspace.state_path
+      name: ${workspace.stot_path}
diff --git a/acceptance/bundle/variables/reference-typo/out.test.toml b/acceptance/bundle/variables/reference-typo/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/variables/reference-typo/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/variables/reference-typo/output.txt b/acceptance/bundle/variables/reference-typo/output.txt
new file mode 100644
index 00000000000..72de565c011
--- /dev/null
+++ b/acceptance/bundle/variables/reference-typo/output.txt
@@ -0,0 +1,99 @@
+
+=== Typo of a defined variable: single suggestion
+
+>>> [CLI] bundle validate
+Error: reference does not exist: ${var.hst}
+
+did you mean:
+  ${var.host}
+
+Name: reference-typo
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/reference-typo/default
+
+Found 1 error
+
+=== Typo close to two defined variables: multiple suggestions
+
+>>> [CLI] bundle validate
+Error: reference does not exist: ${var.hst}
+
+did you mean one of:
+  ${var.host}
+  ${var.hosts}
+
+Name: reference-typo-multiple
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/reference-typo-multiple/default
+
+Found 1 error
+
+=== Typo in a non-variable reference (workspace field): multiple suggestions
+
+>>> [CLI] bundle validate
+Error: reference does not exist: ${workspace.stot_path}
+
+did you mean one of:
+  ${workspace.root_path}
+  ${workspace.state_path}
+
+Name: reference-typo-non-var-multiple
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/reference-typo-non-var-multiple/default
+
+Found 1 error
+
+=== Nested complex variable with multiple typos: only the first is reported
+
+>>> [CLI] bundle validate
+Error: reference does not exist: ${var.cluster.spark_versio}
+
+did you mean:
+  ${var.cluster.spark_version}
+
+Name: reference-typo-multiple-typos
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/reference-typo-multiple-typos/default
+
+Found 1 error
+
+=== Two typos in one reference: lookup fails at the outermost key
+
+>>> [CLI] bundle validate
+Error: reference does not exist: ${var.clustr.spark_versio}
+
+did you mean:
+  ${var.cluster.spark_versio}
+
+Name: reference-typo-double-nested-typo
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/reference-typo-double-nested-typo/default
+
+Found 1 error
+
+=== Two typos in one reference, outermost close to two variables: multiple suggestions
+
+>>> [CLI] bundle validate
+Error: reference does not exist: ${var.clustr.spark_versio}
+
+did you mean one of:
+  ${var.cluster.spark_versio}
+  ${var.clusters.spark_versio}
+
+Name: reference-typo-double-nested-typo-multiple
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/reference-typo-double-nested-typo-multiple/default
+
+Found 1 error
diff --git a/acceptance/bundle/variables/reference-typo/script b/acceptance/bundle/variables/reference-typo/script
new file mode 100644
index 00000000000..5fb854524c5
--- /dev/null
+++ b/acceptance/bundle/variables/reference-typo/script
@@ -0,0 +1,17 @@
+title "Typo of a defined variable: single suggestion\n"
+withdir single musterr trace $CLI bundle validate
+
+title "Typo close to two defined variables: multiple suggestions\n"
+withdir multiple musterr trace $CLI bundle validate
+
+title "Typo in a non-variable reference (workspace field): multiple suggestions\n"
+withdir non-var-multiple musterr trace $CLI bundle validate
+
+title "Nested complex variable with multiple typos: only the first is reported\n"
+withdir multiple-typos musterr trace $CLI bundle validate
+
+title "Two typos in one reference: lookup fails at the outermost key\n"
+withdir double-nested-typo musterr trace $CLI bundle validate
+
+title "Two typos in one reference, outermost close to two variables: multiple suggestions\n"
+withdir double-nested-typo-multiple musterr trace $CLI bundle validate
diff --git a/acceptance/bundle/variables/reference-typo/single/databricks.yml b/acceptance/bundle/variables/reference-typo/single/databricks.yml
new file mode 100644
index 00000000000..6e4a3b438d1
--- /dev/null
+++ b/acceptance/bundle/variables/reference-typo/single/databricks.yml
@@ -0,0 +1,12 @@
+bundle:
+  name: reference-typo
+
+variables:
+  host:
+    default: https://example.test
+
+resources:
+  jobs:
+    one:
+      # "hst" is a typo of the "host" variable defined above
+      name: ${var.hst}
diff --git a/acceptance/bundle/variables/resolve-builtin/databricks.yml b/acceptance/bundle/variables/resolve-builtin/databricks.yml
index 4bb71c8db44..c358df84fe2 100644
--- a/acceptance/bundle/variables/resolve-builtin/databricks.yml
+++ b/acceptance/bundle/variables/resolve-builtin/databricks.yml
@@ -2,5 +2,5 @@ bundle:
   name: TestResolveVariableReferences
 
 workspace:
-  root_path: "${bundle.name}/bar"
+  root_path: "/${bundle.name}/bar"
   file_path: "${workspace.root_path}/baz"
diff --git a/acceptance/bundle/variables/resolve-builtin/out.test.toml b/acceptance/bundle/variables/resolve-builtin/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/variables/resolve-builtin/out.test.toml
+++ b/acceptance/bundle/variables/resolve-builtin/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/variables/resolve-builtin/output.txt b/acceptance/bundle/variables/resolve-builtin/output.txt
index f37a2a19e39..769decea0ad 100644
--- a/acceptance/bundle/variables/resolve-builtin/output.txt
+++ b/acceptance/bundle/variables/resolve-builtin/output.txt
@@ -1,7 +1,7 @@
 {
-  "artifact_path": "TestResolveVariableReferences/bar/artifacts",
-  "file_path": "TestResolveVariableReferences/bar/baz",
-  "resource_path": "TestResolveVariableReferences/bar/resources",
-  "root_path": "TestResolveVariableReferences/bar",
-  "state_path": "TestResolveVariableReferences/bar/state"
+  "artifact_path": "/Workspace/TestResolveVariableReferences/bar/artifacts",
+  "file_path": "/Workspace/TestResolveVariableReferences/bar/baz",
+  "resource_path": "/Workspace/TestResolveVariableReferences/bar/resources",
+  "root_path": "/Workspace/TestResolveVariableReferences/bar",
+  "state_path": "/Workspace/TestResolveVariableReferences/bar/state"
 }
diff --git a/acceptance/bundle/variables/resolve-empty/out.test.toml b/acceptance/bundle/variables/resolve-empty/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/variables/resolve-empty/out.test.toml
+++ b/acceptance/bundle/variables/resolve-empty/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/variables/resolve-field-within-complex/out.test.toml b/acceptance/bundle/variables/resolve-field-within-complex/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/variables/resolve-field-within-complex/out.test.toml
+++ b/acceptance/bundle/variables/resolve-field-within-complex/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/variables/resolve-nonstrings/out.test.toml b/acceptance/bundle/variables/resolve-nonstrings/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/variables/resolve-nonstrings/out.test.toml
+++ b/acceptance/bundle/variables/resolve-nonstrings/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/variables/resolve-resources-fields/out.test.toml b/acceptance/bundle/variables/resolve-resources-fields/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/variables/resolve-resources-fields/out.test.toml
+++ b/acceptance/bundle/variables/resolve-resources-fields/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/variables/resolve-vars-in-root-path/databricks.yml b/acceptance/bundle/variables/resolve-vars-in-root-path/databricks.yml
index 6a45de33076..b555742ddc6 100644
--- a/acceptance/bundle/variables/resolve-vars-in-root-path/databricks.yml
+++ b/acceptance/bundle/variables/resolve-vars-in-root-path/databricks.yml
@@ -2,7 +2,7 @@ bundle:
   name: TestResolveVariableReferencesToBundleVariables
 
 workspace:
-  root_path: "${bundle.name}/${var.foo}"
+  root_path: "/${bundle.name}/${var.foo}"
 
 variables:
   foo:
diff --git a/acceptance/bundle/variables/resolve-vars-in-root-path/out.test.toml b/acceptance/bundle/variables/resolve-vars-in-root-path/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/variables/resolve-vars-in-root-path/out.test.toml
+++ b/acceptance/bundle/variables/resolve-vars-in-root-path/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/variables/resolve-vars-in-root-path/output.txt b/acceptance/bundle/variables/resolve-vars-in-root-path/output.txt
index fb828d82678..fd25be92f5c 100644
--- a/acceptance/bundle/variables/resolve-vars-in-root-path/output.txt
+++ b/acceptance/bundle/variables/resolve-vars-in-root-path/output.txt
@@ -1,7 +1,7 @@
 {
-  "artifact_path": "TestResolveVariableReferencesToBundleVariables/bar/artifacts",
-  "file_path": "TestResolveVariableReferencesToBundleVariables/bar/files",
-  "resource_path": "TestResolveVariableReferencesToBundleVariables/bar/resources",
-  "root_path": "TestResolveVariableReferencesToBundleVariables/bar",
-  "state_path": "TestResolveVariableReferencesToBundleVariables/bar/state"
+  "artifact_path": "/Workspace/TestResolveVariableReferencesToBundleVariables/bar/artifacts",
+  "file_path": "/Workspace/TestResolveVariableReferencesToBundleVariables/bar/files",
+  "resource_path": "/Workspace/TestResolveVariableReferencesToBundleVariables/bar/resources",
+  "root_path": "/Workspace/TestResolveVariableReferencesToBundleVariables/bar",
+  "state_path": "/Workspace/TestResolveVariableReferencesToBundleVariables/bar/state"
 }
diff --git a/acceptance/bundle/variables/test.toml b/acceptance/bundle/variables/test.toml
deleted file mode 100644
index f5945bd6205..00000000000
--- a/acceptance/bundle/variables/test.toml
+++ /dev/null
@@ -1,2 +0,0 @@
-# The tests here intend to test variable interpolation via "bundle validate".
-# Even though "bundle validate" does a few API calls, that's not the focus there.
diff --git a/acceptance/bundle/variables/unicode_reference/databricks.yml b/acceptance/bundle/variables/unicode_reference/databricks.yml
new file mode 100644
index 00000000000..e513139038e
--- /dev/null
+++ b/acceptance/bundle/variables/unicode_reference/databricks.yml
@@ -0,0 +1,11 @@
+bundle:
+  name: unicode-vars
+
+variables:
+  变量:
+    default: hello
+
+resources:
+  jobs:
+    foo:
+      name: ${var.变量}
diff --git a/acceptance/bundle/variables/unicode_reference/out.test.toml b/acceptance/bundle/variables/unicode_reference/out.test.toml
new file mode 100644
index 00000000000..a927a5fbc06
--- /dev/null
+++ b/acceptance/bundle/variables/unicode_reference/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/variables/unicode_reference/output.txt b/acceptance/bundle/variables/unicode_reference/output.txt
new file mode 100644
index 00000000000..8485b73b618
--- /dev/null
+++ b/acceptance/bundle/variables/unicode_reference/output.txt
@@ -0,0 +1,3 @@
+
+>>> [CLI] bundle validate -o json
+"hello"
diff --git a/acceptance/bundle/variables/unicode_reference/script b/acceptance/bundle/variables/unicode_reference/script
new file mode 100644
index 00000000000..8d47fefd775
--- /dev/null
+++ b/acceptance/bundle/variables/unicode_reference/script
@@ -0,0 +1 @@
+trace $CLI bundle validate -o json | jq .resources.jobs.foo.name
diff --git a/acceptance/bundle/variables/vanilla/out.test.toml b/acceptance/bundle/variables/vanilla/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/variables/vanilla/out.test.toml
+++ b/acceptance/bundle/variables/vanilla/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/variables/var_in_var/out.test.toml b/acceptance/bundle/variables/var_in_var/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/variables/var_in_var/out.test.toml
+++ b/acceptance/bundle/variables/var_in_var/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/variables/variable_in_resource_key/out.test.toml b/acceptance/bundle/variables/variable_in_resource_key/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/variables/variable_in_resource_key/out.test.toml
+++ b/acceptance/bundle/variables/variable_in_resource_key/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/variables/variable_in_resource_key/output.txt b/acceptance/bundle/variables/variable_in_resource_key/output.txt
index 6fc17dc855d..841db2e41c5 100644
--- a/acceptance/bundle/variables/variable_in_resource_key/output.txt
+++ b/acceptance/bundle/variables/variable_in_resource_key/output.txt
@@ -1,13 +1,13 @@
 Warning: unknown field: ${var.env}
-  at targets.dev.resources.jobs.${var.env}_job_2
+  at targets.dev.resources.jobs['${var.env}_job_2']
   in databricks.yml:21:11
 
 Error: resource key "${var.env}_job" must not contain variable references
-  at resources.jobs.${var.env}_job
+  at resources.jobs['${var.env}_job']
   in databricks.yml:12:7
 
 Error: resource key "${var.env}_job_2" must not contain variable references
-  at targets.dev.resources.jobs.${var.env}_job_2
+  at targets.dev.resources.jobs['${var.env}_job_2']
   in databricks.yml:20:11
 
 
diff --git a/acceptance/bundle/variables/variable_overrides_in_target/out.test.toml b/acceptance/bundle/variables/variable_overrides_in_target/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/variables/variable_overrides_in_target/out.test.toml
+++ b/acceptance/bundle/variables/variable_overrides_in_target/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/variables/without_definition/out.test.toml b/acceptance/bundle/variables/without_definition/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/variables/without_definition/out.test.toml
+++ b/acceptance/bundle/variables/without_definition/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/volume_path/invalid_file/out.test.toml b/acceptance/bundle/volume_path/invalid_file/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/volume_path/invalid_file/out.test.toml
+++ b/acceptance/bundle/volume_path/invalid_file/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/volume_path/invalid_resource/out.test.toml b/acceptance/bundle/volume_path/invalid_resource/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/volume_path/invalid_resource/out.test.toml
+++ b/acceptance/bundle/volume_path/invalid_resource/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/volume_path/invalid_root/out.test.toml b/acceptance/bundle/volume_path/invalid_root/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/volume_path/invalid_root/out.test.toml
+++ b/acceptance/bundle/volume_path/invalid_root/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/volume_path/invalid_state/out.test.toml b/acceptance/bundle/volume_path/invalid_state/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/volume_path/invalid_state/out.test.toml
+++ b/acceptance/bundle/volume_path/invalid_state/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/bundle/volume_path/valid/out.test.toml b/acceptance/bundle/volume_path/valid/out.test.toml
index f784a183258..a927a5fbc06 100644
--- a/acceptance/bundle/volume_path/valid/out.test.toml
+++ b/acceptance/bundle/volume_path/valid/out.test.toml
@@ -1,3 +1,2 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
+EnvMatrix.DMS = ["", "true"]
diff --git a/acceptance/cache/clear/out.test.toml b/acceptance/cache/clear/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cache/clear/out.test.toml
+++ b/acceptance/cache/clear/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cache/clear/test.toml b/acceptance/cache/clear/test.toml
index e7fe814fc9e..5ef8c24629a 100644
--- a/acceptance/cache/clear/test.toml
+++ b/acceptance/cache/clear/test.toml
@@ -1,6 +1,4 @@
 Cloud = false
-Local = true
-
 # Redact structured logging fields from debug output
 [[Repls]]
 Old = ' pid=[0-9]+'
diff --git a/acceptance/cache/simple/out.test.toml b/acceptance/cache/simple/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cache/simple/out.test.toml
+++ b/acceptance/cache/simple/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cache/simple/output.txt b/acceptance/cache/simple/output.txt
index 2206ffdbc71..64fe62f815f 100644
--- a/acceptance/cache/simple/output.txt
+++ b/acceptance/cache/simple/output.txt
@@ -17,8 +17,8 @@
 
 >>> [CLI] bundle deploy -p dogfood
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/exploratory-cache-test/default/files...
-Deploying resources...
-Deployment complete!
+Files: 3 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 0 unchanged
 
 >>> print_telemetry_bool_values
 local.cache.attempt true
diff --git a/acceptance/cache/simple/script b/acceptance/cache/simple/script
index a2907174bf3..700183f096d 100644
--- a/acceptance/cache/simple/script
+++ b/acceptance/cache/simple/script
@@ -12,5 +12,5 @@ title "Bundle deploy should send telemetry values\n"
 trace $CLI bundle deploy -p dogfood
 
 trace print_telemetry_bool_values | grep "local.cache"
-rm out.requests.txt
+rm "$OUT_REQUESTS"
 rm -rf "${DATABRICKS_CACHE_DIR}"
diff --git a/acceptance/cache/simple/test.toml b/acceptance/cache/simple/test.toml
index 08cabc87be6..2b3504e534a 100644
--- a/acceptance/cache/simple/test.toml
+++ b/acceptance/cache/simple/test.toml
@@ -1,6 +1,4 @@
 Cloud = false
-Local = true
-
 RecordRequests = true
 
 # Redact structured logging fields from debug output
diff --git a/acceptance/cleanup/main.go b/acceptance/cleanup/main.go
new file mode 100644
index 00000000000..3dd70824332
--- /dev/null
+++ b/acceptance/cleanup/main.go
@@ -0,0 +1,196 @@
+// Package main implements a standalone bundle cleanup program. It is invoked as a
+// separate always()-triggered workflow job (see cli-isolated-tests.yml in
+// databricks-eng/eng-dev-ecosystem) so it runs even when a test job times out or
+// is cancelled — unlike a t.Cleanup, which go test skips in those cases.
+package main
+
+import (
+	"context"
+	"errors"
+	"flag"
+	"fmt"
+	"os"
+	"os/exec"
+	"path"
+	"path/filepath"
+	"regexp"
+	"slices"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/databricks/cli/libs/env"
+	"github.com/databricks/cli/libs/iamutil"
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/service/workspace"
+)
+
+// ciRunID matches a valid GITHUB_RUN_ID (same cap as acceptance_test.go).
+var ciRunID = regexp.MustCompile(`^[0-9]{1,11}$`)
+
+func main() {
+	ctx := context.Background()
+	var cliPath string
+	flag.StringVar(&cliPath, "cli", "", "path to databricks CLI binary (required)")
+	flag.Parse()
+
+	if cliPath == "" {
+		log.Errorf(ctx, "-cli: path to databricks CLI binary is required")
+	}
+
+	runID := env.Get(ctx, "GITHUB_RUN_ID")
+	if !ciRunID.MatchString(runID) {
+		log.Errorf(ctx, "GITHUB_RUN_ID %q is not a valid run id (must be 1-11 digits)", runID)
+	}
+	prefix := "ci" + runID + "x"
+
+	if err := cleanBundles(ctx, cliPath, prefix); err != nil {
+		log.Errorf(ctx, "failed to clean bundles: %s", err)
+	}
+}
+
+// cleanBundles finds every bundle this run deployed under the current user's
+// ~/.bundle directory (identified by the run's prefix) and destroys each one.
+func cleanBundles(ctx context.Context, execPath, prefix string) error {
+	start := time.Now()
+
+	w, err := databricks.NewWorkspaceClient()
+	if err != nil {
+		return fmt.Errorf("cannot create workspace client: %w", err)
+	}
+
+	me, err := iamutil.GetCurrentUser(ctx, w)
+	if err != nil {
+		return fmt.Errorf("cannot resolve current user: %w", err)
+	}
+
+	// Tests deploy under the user's home .bundle by default, but some set
+	// workspace.root_path under /Shared (e.g. resources/jobs/shared-root-path),
+	// so sweep both. A "/Shared/..." root_path is normalized to "/Workspace/Shared/..."
+	// by prependWorkspacePrefix, so the swept path uses that form.
+	bundleRoots := []string{
+		"/Workspace/Users/" + me.UserName + "/.bundle",
+		"/Workspace/Shared/" + me.UserName + "/.bundle",
+	}
+
+	// The run's prefix always appears in the first path segment under .bundle
+	// (the bundle name, or the leaf of a workspace.root_path override), so match
+	// there and only descend into this run's subtrees. This avoids walking the
+	// thousands of directories other runs may have leaked under .bundle.
+	var roots []string
+	for _, bundleRoot := range bundleRoots {
+		for _, child := range listChildDirs(ctx, w, bundleRoot) {
+			if strings.Contains(path.Base(child), prefix) {
+				roots = append(roots, findDeploymentRoots(ctx, w, child)...)
+			}
+		}
+	}
+	slices.Sort(roots)
+
+	log.Infof(ctx, "bundle cleanup: found %d deployment(s) with prefix %q", len(roots), prefix)
+
+	// Each destroy shells out to a separate `bundle destroy` (auth + state pull +
+	// deletes), so run them concurrently. Each is network-bound (not CPU-bound),
+	// so cap at a fixed 20 rather than by GOMAXPROCS: it parallelizes the API
+	// waits while staying well under the workspace rate limit. This is
+	// best-effort, not fail-fast: a failed destroy is recorded and the rest still
+	// run, so a plain WaitGroup with a semaphore fits better than errgroup (whose
+	// error short-circuit we would not use).
+	const maxConcurrentDestroys = 20
+	sem := make(chan struct{}, maxConcurrentDestroys)
+	var wg sync.WaitGroup
+	var mu sync.Mutex
+	var failed []string
+	for _, root := range roots {
+		sem <- struct{}{}
+		wg.Go(func() {
+			defer func() { <-sem }()
+			log.Infof(ctx, "destroying %s", root)
+			if out, err := destroyBundle(execPath, root); err != nil {
+				log.Infof(ctx, "destroy failed: %s\n%s", root, out)
+				mu.Lock()
+				failed = append(failed, root)
+				mu.Unlock()
+			}
+		})
+	}
+	wg.Wait()
+
+	slices.Sort(failed)
+	log.Infof(ctx, "bundle cleanup: destroyed %d/%d deployment(s) in %s", len(roots)-len(failed), len(roots), time.Since(start))
+	if len(failed) > 0 {
+		return fmt.Errorf("failed to destroy %d deployment(s): %s", len(failed), strings.Join(failed, ", "))
+	}
+	return nil
+}
+
+// findDeploymentRoots walks the workspace tree under dir and returns the paths
+// of bundle deployment roots. A directory is a deployment root when it contains
+// a "state" or "files" child, which the bundle deploy writes beneath the
+// resolved workspace.root_path. This works regardless of whether the root is
+// the default ~/.bundle/<name>/<target> or a custom ~/.bundle/<...> override.
+func findDeploymentRoots(ctx context.Context, w *databricks.WorkspaceClient, dir string) []string {
+	var childDirs []string
+	for _, child := range listChildDirs(ctx, w, dir) {
+		if base := path.Base(child); base == "state" || base == "files" {
+			// dir is a deployment root; don't descend into its internals.
+			return []string{dir}
+		}
+		childDirs = append(childDirs, child)
+	}
+
+	var roots []string
+	for _, child := range childDirs {
+		roots = append(roots, findDeploymentRoots(ctx, w, child)...)
+	}
+	return roots
+}
+
+// listChildDirs returns the immediate subdirectory paths of dir. A missing dir
+// (nothing was deployed under it) yields nil silently; any other listing error
+// is logged loudly but does not stop the overall sweep.
+func listChildDirs(ctx context.Context, w *databricks.WorkspaceClient, dir string) []string {
+	objects, err := w.Workspace.ListAll(ctx, workspace.ListWorkspaceRequest{Path: dir})
+	if err != nil {
+		if !errors.Is(err, apierr.ErrNotFound) {
+			log.Infof(ctx, "WARNING: bundle cleanup incomplete, cannot list %s: %s", dir, err)
+		}
+		return nil
+	}
+	var dirs []string
+	for _, o := range objects {
+		if o.ObjectType == workspace.ObjectTypeDirectory {
+			dirs = append(dirs, o.Path)
+		}
+	}
+	return dirs
+}
+
+// destroyBundle destroys the bundle deployed at rootPath using the CLI binary,
+// returning the combined output and any error. It writes a throwaway
+// databricks.yml pinning workspace.root_path to the deployment root; destroy
+// pulls the remote state from there (auto-detecting the engine) and deletes the
+// resources and files. The bundle name and target are placeholders because
+// root_path fully determines the deployment location. --force-lock overrides a
+// stale deployment lock left by a test that was killed mid-deploy; these are
+// known-leaked bundles, so there is no concurrent deployment to conflict with.
+func destroyBundle(execPath, rootPath string) ([]byte, error) {
+	dir, err := os.MkdirTemp("", "bundle-clean")
+	if err != nil {
+		return nil, err
+	}
+	defer os.RemoveAll(dir)
+
+	databricksYML := "bundle:\n  name: cleanup\nworkspace:\n  root_path: " + rootPath + "\ntargets:\n  default: {}\n"
+	if err := os.WriteFile(filepath.Join(dir, "databricks.yml"), []byte(databricksYML), 0o644); err != nil {
+		return nil, err
+	}
+
+	cmd := exec.Command(execPath, "bundle", "destroy", "--target", "default", "--auto-approve", "--force-lock")
+	cmd.Dir = dir
+	cmd.Env = os.Environ()
+
+	return cmd.CombinedOutput()
+}
diff --git a/acceptance/cmd/account/account-help/out.test.toml b/acceptance/cmd/account/account-help/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/account/account-help/out.test.toml
+++ b/acceptance/cmd/account/account-help/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/account/account-help/output.txt b/acceptance/cmd/account/account-help/output.txt
index b39d4395521..cc586cb1ef1 100644
--- a/acceptance/cmd/account/account-help/output.txt
+++ b/acceptance/cmd/account/account-help/output.txt
@@ -6,10 +6,10 @@ Usage:
   databricks account [command]
 
 Identity and Access Management
-  access-control                      These APIs manage access rules on resources in an account.
+  access-control                      *Public Preview* These APIs manage access rules on resources in an account.
   groups                              Groups simplify identity management, making it easier to assign access to Databricks account, data, and other securable objects.
   groups-v2                           Groups simplify identity management, making it easier to assign access to Databricks account, data, and other securable objects.
-  iam-v2                              These APIs are used to manage identities and the workspace access of these identities in <Databricks>.
+  iam-v2                              These APIs are used to manage identities and the workspace access of these identities in Databricks.
   service-principals                  Identities for use with jobs, automated tools, and systems such as scripts, apps, and CI/CD platforms.
   service-principals-v2               Identities for use with jobs, automated tools, and systems such as scripts, apps, and CI/CD platforms.
   users                               User identities recognized by Databricks and represented by email addresses.
@@ -41,8 +41,8 @@ Provisioning
 
 Billing
   billable-usage                      This API allows you to download billable usage logs for the specified account and date range.
-  budget-policy                       A service serves REST API about Budget policies.
-  budgets                             These APIs manage budget configurations for this account.
+  budget-policy                       *Public Preview* A service serves REST API about Budget policies.
+  budgets                             *Public Preview* These APIs manage budget configurations for this account.
   log-delivery                        These APIs manage log delivery configurations for this account.
   usage-dashboards                    These APIs manage usage dashboards for this account.
 
@@ -54,6 +54,9 @@ OAuth
   service-principal-federation-policy These APIs manage service principal federation policies.
   service-principal-secrets           These APIs enable administrators to manage service principal secrets.
 
+Disaster Recovery
+  disaster-recovery                   Manage disaster recovery configurations and execute failover operations.
+
 Flags:
   -h, --help   help for account
 
diff --git a/acceptance/cmd/aitools/claude-config-dir/custom/plugins/installed_plugins.json b/acceptance/cmd/aitools/claude-config-dir/custom/plugins/installed_plugins.json
new file mode 100644
index 00000000000..606c3cb1be3
--- /dev/null
+++ b/acceptance/cmd/aitools/claude-config-dir/custom/plugins/installed_plugins.json
@@ -0,0 +1,6 @@
+{
+  "version": 2,
+  "plugins": {
+    "databricks@local": [{"scope": "user", "version": "1.0.0"}]
+  }
+}
diff --git a/acceptance/cmd/aitools/claude-config-dir/installed-home/.claude/plugins/installed_plugins.json b/acceptance/cmd/aitools/claude-config-dir/installed-home/.claude/plugins/installed_plugins.json
new file mode 100644
index 00000000000..606c3cb1be3
--- /dev/null
+++ b/acceptance/cmd/aitools/claude-config-dir/installed-home/.claude/plugins/installed_plugins.json
@@ -0,0 +1,6 @@
+{
+  "version": 2,
+  "plugins": {
+    "databricks@local": [{"scope": "user", "version": "1.0.0"}]
+  }
+}
diff --git a/acceptance/cmd/aitools/claude-config-dir/out.test.toml b/acceptance/cmd/aitools/claude-config-dir/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/aitools/claude-config-dir/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/aitools/claude-config-dir/output.txt b/acceptance/cmd/aitools/claude-config-dir/output.txt
new file mode 100644
index 00000000000..508651018c5
--- /dev/null
+++ b/acceptance/cmd/aitools/claude-config-dir/output.txt
@@ -0,0 +1,21 @@
+
+=== Plugin installed only in the custom config directory
+
+>>> CLAUDE_CONFIG_DIR=custom [CLI] version
+Databricks CLI v[CLI_VERSION]
+
+=== Custom directory takes precedence over the default installation
+
+>>> CLAUDE_CONFIG_DIR=missing [CLI] version
+Databricks skills are not installed. To work with Databricks reliably, first run: databricks aitools install
+Databricks CLI v[CLI_VERSION]
+
+=== Empty override uses the default installation
+
+>>> CLAUDE_CONFIG_DIR= [CLI] version
+Databricks CLI v[CLI_VERSION]
+
+=== Unset override uses the default installation
+
+>>> [CLI] version
+Databricks CLI v[CLI_VERSION]
diff --git a/acceptance/cmd/aitools/claude-config-dir/script b/acceptance/cmd/aitools/claude-config-dir/script
new file mode 100644
index 00000000000..bdec19ef438
--- /dev/null
+++ b/acceptance/cmd/aitools/claude-config-dir/script
@@ -0,0 +1,18 @@
+export CLAUDECODE=1
+unset CLAUDE_CODE_SESSION_ID
+
+# aitools commands skip the install hint; version exercises it without auth or network.
+sethome ./empty-home
+title "Plugin installed only in the custom config directory\n"
+trace CLAUDE_CONFIG_DIR=custom $CLI version
+
+sethome ./installed-home
+title "Custom directory takes precedence over the default installation\n"
+trace CLAUDE_CONFIG_DIR=missing $CLI version
+
+title "Empty override uses the default installation\n"
+trace CLAUDE_CONFIG_DIR= $CLI version
+
+title "Unset override uses the default installation\n"
+unset CLAUDE_CONFIG_DIR
+trace $CLI version
diff --git a/acceptance/cmd/aitools/claude-config-dir/test.toml b/acceptance/cmd/aitools/claude-config-dir/test.toml
new file mode 100644
index 00000000000..e4091b5e567
--- /dev/null
+++ b/acceptance/cmd/aitools/claude-config-dir/test.toml
@@ -0,0 +1 @@
+Ignore = ["empty-home"]
diff --git a/acceptance/cmd/api/account-flag/out.test.toml b/acceptance/cmd/api/account-flag/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/api/account-flag/out.test.toml
+++ b/acceptance/cmd/api/account-flag/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/api/account-flag/output.txt b/acceptance/cmd/api/account-flag/output.txt
index c165bf2af88..8aa86ba5677 100644
--- a/acceptance/cmd/api/account-flag/output.txt
+++ b/acceptance/cmd/api/account-flag/output.txt
@@ -7,7 +7,7 @@
       "Bearer [DATABRICKS_TOKEN]"
     ],
     "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/api_get cmd-exec-id/[UUID] interactive/none auth/pat"
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/api_get cmd-exec-id/[UUID] interactive/none auth/pat"
     ]
   },
   "method": "GET",
diff --git a/acceptance/cmd/api/account-flag/script b/acceptance/cmd/api/account-flag/script
index de2d4de92b7..b276923914b 100644
--- a/acceptance/cmd/api/account-flag/script
+++ b/acceptance/cmd/api/account-flag/script
@@ -1,2 +1,2 @@
 MSYS_NO_PATHCONV=1 $CLI api get /api/2.0/clusters/list --account
-trace print_requests.py --get //api/2.0/clusters/list | contains.py "!X-Databricks-Org-Id"
+trace print_requests.py --get //api/2.0/clusters/list | contains.py "!X-Databricks-Workspace-Id"
diff --git a/acceptance/cmd/api/account-path/out.test.toml b/acceptance/cmd/api/account-path/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/api/account-path/out.test.toml
+++ b/acceptance/cmd/api/account-path/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/api/account-path/output.txt b/acceptance/cmd/api/account-path/output.txt
index 1afd36c01d3..e3801019ef8 100644
--- a/acceptance/cmd/api/account-path/output.txt
+++ b/acceptance/cmd/api/account-path/output.txt
@@ -7,7 +7,7 @@
       "Bearer [DATABRICKS_TOKEN]"
     ],
     "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/api_get cmd-exec-id/[UUID] interactive/none auth/pat"
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/api_get cmd-exec-id/[UUID] interactive/none auth/pat"
     ]
   },
   "method": "GET",
diff --git a/acceptance/cmd/api/account-path/script b/acceptance/cmd/api/account-path/script
index 6cc97637695..cb84c2bccf3 100644
--- a/acceptance/cmd/api/account-path/script
+++ b/acceptance/cmd/api/account-path/script
@@ -1,2 +1,2 @@
 MSYS_NO_PATHCONV=1 $CLI api get /api/2.0/accounts/abc-123/network-policies
-trace print_requests.py --get //api/2.0/accounts/abc-123/network-policies | contains.py "!X-Databricks-Org-Id"
+trace print_requests.py --get //api/2.0/accounts/abc-123/network-policies | contains.py "!X-Databricks-Workspace-Id"
diff --git a/acceptance/cmd/api/default-profile-vs-env/home/.databrickscfg b/acceptance/cmd/api/default-profile-vs-env/home/.databrickscfg
new file mode 100644
index 00000000000..beabda57e2b
--- /dev/null
+++ b/acceptance/cmd/api/default-profile-vs-env/home/.databrickscfg
@@ -0,0 +1,7 @@
+[__settings__]
+default_profile = other
+
+[other]
+host     = https://other.cloud.databricks.test
+username = user
+password = pass
diff --git a/acceptance/cmd/api/default-profile-vs-env/out.test.toml b/acceptance/cmd/api/default-profile-vs-env/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/api/default-profile-vs-env/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/api/default-profile-vs-env/output.txt b/acceptance/cmd/api/default-profile-vs-env/output.txt
new file mode 100644
index 00000000000..e274cafcc3f
--- /dev/null
+++ b/acceptance/cmd/api/default-profile-vs-env/output.txt
@@ -0,0 +1,22 @@
+
+=== api without --profile uses env auth, ignoring default_profile (#5616)
+
+>>> [CLI] api get /api/2.0/clusters/list
+{}
+
+>>> print_requests.py --get //api/2.0/clusters/list
+{
+  "headers": {
+    "Authorization": [
+      "Bearer [DATABRICKS_TOKEN]"
+    ],
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/api_get cmd-exec-id/[UUID] interactive/none auth/pat"
+    ],
+    "X-Databricks-Workspace-Id": [
+      "[WORKSPACE_ID]"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/clusters/list"
+}
diff --git a/acceptance/cmd/api/default-profile-vs-env/script b/acceptance/cmd/api/default-profile-vs-env/script
new file mode 100644
index 00000000000..b8f620081ac
--- /dev/null
+++ b/acceptance/cmd/api/default-profile-vs-env/script
@@ -0,0 +1,9 @@
+sethome "./home"
+
+# home/.databrickscfg is a checked-in input: a default profile with conflicting
+# (basic) auth on a different host. The env below still points a PAT at the test
+# server. Without the #5616 guard, the default profile would be pinned and merged
+# with the env PAT, failing with "more than one authorization method configured".
+title "api without --profile uses env auth, ignoring default_profile (#5616)\n"
+MSYS_NO_PATHCONV=1 trace $CLI api get /api/2.0/clusters/list
+trace print_requests.py --get //api/2.0/clusters/list
diff --git a/acceptance/cmd/api/default-profile-vs-env/test.toml b/acceptance/cmd/api/default-profile-vs-env/test.toml
new file mode 100644
index 00000000000..45851c79afa
--- /dev/null
+++ b/acceptance/cmd/api/default-profile-vs-env/test.toml
@@ -0,0 +1,3 @@
+Ignore = [
+    "home",
+]
diff --git a/acceptance/cmd/api/default-profile/home/.databrickscfg.tmpl b/acceptance/cmd/api/default-profile/home/.databrickscfg.tmpl
new file mode 100644
index 00000000000..0c00242c066
--- /dev/null
+++ b/acceptance/cmd/api/default-profile/home/.databrickscfg.tmpl
@@ -0,0 +1,10 @@
+[default-target]
+host  = $DATABRICKS_HOST
+token = $DATABRICKS_TOKEN
+
+[other]
+host  = https://other.test
+token = other-token
+
+[__settings__]
+default_profile = default-target
diff --git a/acceptance/cmd/api/default-profile/out.test.toml b/acceptance/cmd/api/default-profile/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/api/default-profile/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/api/default-profile/output.txt b/acceptance/cmd/api/default-profile/output.txt
new file mode 100644
index 00000000000..68e21b2a638
--- /dev/null
+++ b/acceptance/cmd/api/default-profile/output.txt
@@ -0,0 +1,28 @@
+
+=== default_profile is used when no --profile flag and no DATABRICKS_CONFIG_PROFILE
+
+>>> [CLI] api get /api/2.0/clusters/list
+{}
+
+>>> print_requests.py --get //api/2.0/clusters/list
+{
+  "headers": {
+    "Authorization": [
+      "Bearer [DATABRICKS_TOKEN]"
+    ],
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/api_get cmd-exec-id/[UUID] interactive/none auth/pat"
+    ],
+    "X-Databricks-Workspace-Id": [
+      "[WORKSPACE_ID]"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/clusters/list"
+}
+
+=== --profile overrides default_profile (negative case)
+Warn: [hostmetadata] failed to fetch host metadata for https://other.test, will skip for 1m0s
+Error: Get "https://other.test/api/2.0/clusters/list": (redacted)
+
+Exit code: 1
diff --git a/acceptance/cmd/api/default-profile/script b/acceptance/cmd/api/default-profile/script
new file mode 100644
index 00000000000..8f0ea946e66
--- /dev/null
+++ b/acceptance/cmd/api/default-profile/script
@@ -0,0 +1,17 @@
+sethome "./home"
+
+# Two profiles plus an explicit default_profile pointing at the test server.
+# The 'other' profile points at an RFC 2606 reserved host so we can assert
+# that --profile overrides default_profile without making a real request.
+envsubst < "./home/.databrickscfg.tmpl" > "./home/.databrickscfg"
+
+unset DATABRICKS_HOST
+unset DATABRICKS_TOKEN
+unset DATABRICKS_CONFIG_PROFILE
+
+title "default_profile is used when no --profile flag and no DATABRICKS_CONFIG_PROFILE\n"
+MSYS_NO_PATHCONV=1 trace $CLI api get /api/2.0/clusters/list
+trace print_requests.py --get //api/2.0/clusters/list | contains.py "X-Databricks-Workspace-Id"
+
+title "--profile overrides default_profile (negative case)\n"
+MSYS_NO_PATHCONV=1 errcode $CLI api get /api/2.0/clusters/list -p other 2>&1 | contains.py "other.test"
diff --git a/acceptance/cmd/api/default-profile/test.toml b/acceptance/cmd/api/default-profile/test.toml
new file mode 100644
index 00000000000..02f926882c8
--- /dev/null
+++ b/acceptance/cmd/api/default-profile/test.toml
@@ -0,0 +1,10 @@
+Ignore = [
+    "home",
+]
+
+# Redact the OS- and network-dependent suffix on the failed lookup so the
+# negative case (--profile overrides default_profile) is stable across
+# runners. We still assert the requested host appears in output.
+[[Repls]]
+Old = 'Get "https://other.test/api/2.0/clusters/list": .*'
+New = 'Get "https://other.test/api/2.0/clusters/list": (redacted)'
diff --git a/acceptance/cmd/api/integer-precision/out.test.toml b/acceptance/cmd/api/integer-precision/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/api/integer-precision/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/api/integer-precision/output.txt b/acceptance/cmd/api/integer-precision/output.txt
new file mode 100644
index 00000000000..02c843db4b4
--- /dev/null
+++ b/acceptance/cmd/api/integer-precision/output.txt
@@ -0,0 +1,28 @@
+
+=== Response: a >2^53 id is rendered exactly, in server key order
+>>> [CLI] api get /api/2.0/test/bigint
+{
+  "name": "a<b",
+  "job_id": [JOB_ID]
+}
+
+=== Request body (POST): the id in --json is sent verbatim
+>>> print_requests.py //test/bigint --del-field headers
+{
+  "method": "POST",
+  "path": "/api/2.0/test/bigint",
+  "body": {
+    "name": "a<b",
+    "job_id": [JOB_ID]
+  }
+}
+
+=== Request query (GET): the id in --json survives in the query string
+>>> print_requests.py --get //test/bigint --del-field headers
+{
+  "method": "GET",
+  "path": "/api/2.0/test/bigint",
+  "q": {
+    "job_id": "[JOB_ID]"
+  }
+}
diff --git a/acceptance/cmd/api/integer-precision/script b/acceptance/cmd/api/integer-precision/script
new file mode 100644
index 00000000000..3d859c2fd47
--- /dev/null
+++ b/acceptance/cmd/api/integer-precision/script
@@ -0,0 +1,20 @@
+# databricks api must preserve integers exactly, both in what it sends and what
+# it prints: any integer above 2^53 loses its low digits through a float64
+# (...000), and the query-string path additionally renders a large float64 in
+# exponent form. test.toml rewrites the fixed id below to [JOB_ID] only when its
+# exact digits survive, so [JOB_ID] in a golden proves the round-trip is lossless.
+
+title "Response: a >2^53 id is rendered exactly, in server key order"
+# The response goes straight to the golden (no re-parse), so the unescaped '<'
+# and the key order (name before job_id) also show it is not re-marshalled.
+MSYS_NO_PATHCONV=1 trace $CLI api get /api/2.0/test/bigint
+
+title "Request body (POST): the id in --json is sent verbatim"
+# print_requests re-parses the recorded body, so '<' is normalised away here;
+# the preserved key order (name before job_id) is what shows the body is verbatim.
+MSYS_NO_PATHCONV=1 $CLI api post /api/2.0/test/bigint --json '{"name": "a<b", "job_id": 18000000000000000123}' > /dev/null
+trace print_requests.py //test/bigint --del-field headers
+
+title "Request query (GET): the id in --json survives in the query string"
+MSYS_NO_PATHCONV=1 $CLI api get /api/2.0/test/bigint --json '{"job_id": 18000000000000000123}' > /dev/null
+trace print_requests.py --get //test/bigint --del-field headers
diff --git a/acceptance/cmd/api/integer-precision/test.toml b/acceptance/cmd/api/integer-precision/test.toml
new file mode 100644
index 00000000000..c4f96e4c59e
--- /dev/null
+++ b/acceptance/cmd/api/integer-precision/test.toml
@@ -0,0 +1,19 @@
+# Fixture endpoints exercised only by this test. The GET response carries a
+# >2^53 integer id and non-alphabetical keys so the golden shows the CLI renders
+# the body verbatim (server key order kept, '<' not escaped) instead of
+# round-tripping it through a Go map.
+[[Server]]
+Pattern = "GET /api/2.0/test/bigint"
+Response.Body = '{"name": "a<b", "job_id": 18000000000000000123}'
+
+[[Server]]
+Pattern = "POST /api/2.0/test/bigint"
+Response.Body = '{}'
+
+# Rewrite the fixed test id to a readable placeholder. The placeholder appears
+# only when the exact digits survive the round-trip: a float64-rounded id
+# (18000000000000000000) wouldn't match this pattern and would show up raw,
+# failing the golden. So [JOB_ID] in the golden is itself the proof that precision is kept.
+[[Repls]]
+Old = '18000000000000000123'
+New = '[JOB_ID]'
diff --git a/acceptance/cmd/api/profile-overrides-env/home/.databrickscfg.tmpl b/acceptance/cmd/api/profile-overrides-env/home/.databrickscfg.tmpl
new file mode 100644
index 00000000000..e5540af0d70
--- /dev/null
+++ b/acceptance/cmd/api/profile-overrides-env/home/.databrickscfg.tmpl
@@ -0,0 +1,6 @@
+[my-workspace]
+host  = $DATABRICKS_HOST
+token = $DATABRICKS_TOKEN
+
+[host-only]
+host  = $DATABRICKS_HOST
diff --git a/acceptance/cmd/api/profile-overrides-env/out.test.toml b/acceptance/cmd/api/profile-overrides-env/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/api/profile-overrides-env/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/api/profile-overrides-env/output.txt b/acceptance/cmd/api/profile-overrides-env/output.txt
new file mode 100644
index 00000000000..bba9952d34d
--- /dev/null
+++ b/acceptance/cmd/api/profile-overrides-env/output.txt
@@ -0,0 +1,44 @@
+
+=== api --profile overrides auth env vars (#5096)
+
+>>> [CLI] api get /api/2.0/clusters/list --profile my-workspace
+{}
+
+>>> print_requests.py --get //api/2.0/clusters/list
+{
+  "headers": {
+    "Authorization": [
+      "Bearer [DATABRICKS_TOKEN]"
+    ],
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/api_get cmd-exec-id/[UUID] interactive/none auth/pat"
+    ],
+    "X-Databricks-Workspace-Id": [
+      "[WORKSPACE_ID]"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/clusters/list"
+}
+
+=== api host-only --profile fills the token from the environment (#5096)
+
+>>> [CLI] api get /api/2.0/clusters/list --profile host-only
+{}
+
+>>> print_requests.py --get //api/2.0/clusters/list
+{
+  "headers": {
+    "Authorization": [
+      "Bearer [DATABRICKS_TOKEN]"
+    ],
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/api_get cmd-exec-id/[UUID] interactive/none auth/pat"
+    ],
+    "X-Databricks-Workspace-Id": [
+      "[WORKSPACE_ID]"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/clusters/list"
+}
diff --git a/acceptance/cmd/api/profile-overrides-env/script b/acceptance/cmd/api/profile-overrides-env/script
new file mode 100644
index 00000000000..3628f59e9c3
--- /dev/null
+++ b/acceptance/cmd/api/profile-overrides-env/script
@@ -0,0 +1,22 @@
+sethome "./home"
+
+# One profile with full credentials, one host-only; both point at the test
+# server while the auth env vars below point elsewhere.
+envsubst < "./home/.databrickscfg.tmpl" > "./home/.databrickscfg"
+
+# direnv-style auth env vars for a different workspace; before #5096 these
+# shadowed the profile selected with --profile.
+real_token=$DATABRICKS_TOKEN
+export DATABRICKS_HOST=https://dev.cloud.databricks.test
+export DATABRICKS_TOKEN=dev-token
+
+title "api --profile overrides auth env vars (#5096)\n"
+MSYS_NO_PATHCONV=1 trace $CLI api get /api/2.0/clusters/list --profile my-workspace
+trace print_requests.py --get //api/2.0/clusters/list
+
+# Host-only profile: the profile wins for the host, but env fills the token it
+# omits (#5096).
+export DATABRICKS_TOKEN=$real_token
+title "api host-only --profile fills the token from the environment (#5096)\n"
+MSYS_NO_PATHCONV=1 trace $CLI api get /api/2.0/clusters/list --profile host-only
+trace print_requests.py --get //api/2.0/clusters/list
diff --git a/acceptance/cmd/api/profile-overrides-env/test.toml b/acceptance/cmd/api/profile-overrides-env/test.toml
new file mode 100644
index 00000000000..45851c79afa
--- /dev/null
+++ b/acceptance/cmd/api/profile-overrides-env/test.toml
@@ -0,0 +1,3 @@
+Ignore = [
+    "home",
+]
diff --git a/acceptance/cmd/api/request-handling/out.test.toml b/acceptance/cmd/api/request-handling/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/api/request-handling/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/api/request-handling/output.txt b/acceptance/cmd/api/request-handling/output.txt
new file mode 100644
index 00000000000..cb4438fa337
--- /dev/null
+++ b/acceptance/cmd/api/request-handling/output.txt
@@ -0,0 +1,27 @@
+
+=== Accept: application/json is sent (the raw response target must not drop it)
+OK: Accept header present
+
+=== A literal 'null' --json sends no request body (not the bytes "null")
+>>> print_requests.py //test/req --del-field headers
+{
+  "method": "POST",
+  "path": "/api/2.0/test/req"
+}
+
+=== Query parameters in the path and a --json body are both sent
+>>> print_requests.py //test/req --del-field headers
+{
+  "method": "POST",
+  "path": "/api/2.0/test/req",
+  "q": {
+    "foo": "bar",
+    "x": "1"
+  },
+  "body": {
+    "hello": "world"
+  }
+}
+
+=== Malformed --json is rejected client-side with a positioned error
+Error: error decoding JSON at (inline):1:8: invalid character ',' looking for beginning of value
diff --git a/acceptance/cmd/api/request-handling/script b/acceptance/cmd/api/request-handling/script
new file mode 100644
index 00000000000..c85bccd5df9
--- /dev/null
+++ b/acceptance/cmd/api/request-handling/script
@@ -0,0 +1,17 @@
+# Behaviours of how `databricks api` builds the outgoing request.
+
+title "Accept: application/json is sent (the raw response target must not drop it)"
+MSYS_NO_PATHCONV=1 $CLI api post /api/2.0/test/req --json '{"a": 1}' > /dev/null
+print_requests.py //test/req | contains.py '"Accept"' '"application/json"' > /dev/null
+printf '\n%s\n' "OK: Accept header present"
+
+title "A literal 'null' --json sends no request body (not the bytes \"null\")"
+MSYS_NO_PATHCONV=1 $CLI api post /api/2.0/test/req --json 'null' > /dev/null
+trace print_requests.py //test/req --del-field headers
+
+title "Query parameters in the path and a --json body are both sent"
+MSYS_NO_PATHCONV=1 $CLI api post "/api/2.0/test/req?foo=bar&x=1" --json '{"hello": "world"}' > /dev/null
+trace print_requests.py //test/req --del-field headers
+
+title "Malformed --json is rejected client-side with a positioned error\n"
+MSYS_NO_PATHCONV=1 musterr $CLI api post /api/2.0/test/req --json '{"a": 1,}'
diff --git a/acceptance/cmd/api/request-handling/test.toml b/acceptance/cmd/api/request-handling/test.toml
new file mode 100644
index 00000000000..d3637b163c2
--- /dev/null
+++ b/acceptance/cmd/api/request-handling/test.toml
@@ -0,0 +1,7 @@
+# Record the Accept header too (appended to the inherited list) so the
+# regression guard below can see it.
+IncludeRequestHeaders = ["Accept"]
+
+[[Server]]
+Pattern = "POST /api/2.0/test/req"
+Response.Body = '{}'
diff --git a/acceptance/cmd/api/response-handling/out.test.toml b/acceptance/cmd/api/response-handling/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/api/response-handling/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/api/response-handling/output.txt b/acceptance/cmd/api/response-handling/output.txt
new file mode 100644
index 00000000000..f1724aef023
--- /dev/null
+++ b/acceptance/cmd/api/response-handling/output.txt
@@ -0,0 +1,16 @@
+
+=== Empty response body renders null
+>>> [CLI] api get /api/2.0/test/empty
+null
+
+=== A trailing newline in the body does not add a blank line
+>>> [CLI] api get /api/2.0/test/trailing
+{
+  "ok": true
+}
+
+=== An HTML response surfaces the SDK's actionable error
+OK: HTML detected
+
+=== A malformed JSON response surfaces an unmarshal error
+OK: unmarshal error reported
diff --git a/acceptance/cmd/api/response-handling/script b/acceptance/cmd/api/response-handling/script
new file mode 100644
index 00000000000..0b60491a35c
--- /dev/null
+++ b/acceptance/cmd/api/response-handling/script
@@ -0,0 +1,19 @@
+# Response-rendering edge cases. The errors are routed to LOG files (their
+# detail includes volatile request/response dumps); contains.py asserts the
+# stable part.
+
+title "Empty response body renders null"
+MSYS_NO_PATHCONV=1 trace $CLI api get /api/2.0/test/empty
+
+title "A trailing newline in the body does not add a blank line"
+MSYS_NO_PATHCONV=1 trace $CLI api get /api/2.0/test/trailing
+
+title "An HTML response surfaces the SDK's actionable error"
+MSYS_NO_PATHCONV=1 musterr $CLI api get /api/2.0/test/html &> LOG.html
+contains.py "received HTML response instead of JSON" < LOG.html > /dev/null
+printf '\n%s\n' "OK: HTML detected"
+
+title "A malformed JSON response surfaces an unmarshal error"
+MSYS_NO_PATHCONV=1 musterr $CLI api get /api/2.0/test/malformed &> LOG.malformed
+contains.py "failed to unmarshal response body" < LOG.malformed > /dev/null
+printf '\n%s\n' "OK: unmarshal error reported"
diff --git a/acceptance/cmd/api/response-handling/test.toml b/acceptance/cmd/api/response-handling/test.toml
new file mode 100644
index 00000000000..8689303a8a7
--- /dev/null
+++ b/acceptance/cmd/api/response-handling/test.toml
@@ -0,0 +1,18 @@
+# Fixtures for the response-rendering edge cases. The HTML and malformed bodies
+# must surface the SDK's errors (the *json.RawMessage target keeps that
+# handling); the trailing newline must not produce a blank line.
+[[Server]]
+Pattern = "GET /api/2.0/test/empty"
+Response.Body = ''
+
+[[Server]]
+Pattern = "GET /api/2.0/test/trailing"
+Response.Body = "{\"ok\": true}\n"
+
+[[Server]]
+Pattern = "GET /api/2.0/test/html"
+Response.Body = '<html><head><title>Databricks</title></head><body>Sign in</body></html>'
+
+[[Server]]
+Pattern = "GET /api/2.0/test/malformed"
+Response.Body = '{"truncated":'
diff --git a/acceptance/cmd/api/test.toml b/acceptance/cmd/api/test.toml
index 11d83c3f486..d1a9112ed0e 100644
--- a/acceptance/cmd/api/test.toml
+++ b/acceptance/cmd/api/test.toml
@@ -1,5 +1,5 @@
 RecordRequests = true
-IncludeRequestHeaders = ["Authorization", "User-Agent", "X-Databricks-Org-Id"]
+IncludeRequestHeaders = ["Authorization", "User-Agent", "X-Databricks-Workspace-Id"]
 
 # Normalize OS-dependent and CI-only User-Agent segments so the recorded
 # requests are stable across local macOS/Linux runs and GitHub Actions.
diff --git a/acceptance/cmd/api/workspace-id-flag/out.test.toml b/acceptance/cmd/api/workspace-id-flag/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/api/workspace-id-flag/out.test.toml
+++ b/acceptance/cmd/api/workspace-id-flag/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/api/workspace-id-flag/output.txt b/acceptance/cmd/api/workspace-id-flag/output.txt
index 5ff264fa554..fd78060f1fd 100644
--- a/acceptance/cmd/api/workspace-id-flag/output.txt
+++ b/acceptance/cmd/api/workspace-id-flag/output.txt
@@ -7,9 +7,9 @@
       "Bearer [DATABRICKS_TOKEN]"
     ],
     "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/api_get cmd-exec-id/[UUID] interactive/none auth/pat"
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/api_get cmd-exec-id/[UUID] interactive/none auth/pat"
     ],
-    "X-Databricks-Org-Id": [
+    "X-Databricks-Workspace-Id": [
       "999"
     ]
   },
diff --git a/acceptance/cmd/api/workspace-id-flag/script b/acceptance/cmd/api/workspace-id-flag/script
index 83664ba8662..060a6fafbcb 100644
--- a/acceptance/cmd/api/workspace-id-flag/script
+++ b/acceptance/cmd/api/workspace-id-flag/script
@@ -1,2 +1,2 @@
 MSYS_NO_PATHCONV=1 $CLI api get /api/2.0/clusters/list --workspace-id 999
-trace print_requests.py --get //api/2.0/clusters/list | contains.py "X-Databricks-Org-Id" "999"
+trace print_requests.py --get //api/2.0/clusters/list | contains.py "X-Databricks-Workspace-Id" "999"
diff --git a/acceptance/cmd/api/workspace-id-from-query/out.test.toml b/acceptance/cmd/api/workspace-id-from-query/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/api/workspace-id-from-query/out.test.toml
+++ b/acceptance/cmd/api/workspace-id-from-query/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/api/workspace-id-from-query/output.txt b/acceptance/cmd/api/workspace-id-from-query/output.txt
index 7a72f8de473..1f1b4a03e55 100644
--- a/acceptance/cmd/api/workspace-id-from-query/output.txt
+++ b/acceptance/cmd/api/workspace-id-from-query/output.txt
@@ -7,9 +7,9 @@
       "Bearer [DATABRICKS_TOKEN]"
     ],
     "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/api_get cmd-exec-id/[UUID] interactive/none auth/pat"
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/api_get cmd-exec-id/[UUID] interactive/none auth/pat"
     ],
-    "X-Databricks-Org-Id": [
+    "X-Databricks-Workspace-Id": [
       "999"
     ]
   },
diff --git a/acceptance/cmd/api/workspace-id-from-query/script b/acceptance/cmd/api/workspace-id-from-query/script
index fd3fa0e151b..ff74526bf88 100644
--- a/acceptance/cmd/api/workspace-id-from-query/script
+++ b/acceptance/cmd/api/workspace-id-from-query/script
@@ -1,2 +1,2 @@
 MSYS_NO_PATHCONV=1 $CLI api get "/api/2.0/clusters/list?o=999"
-trace print_requests.py --get //api/2.0/clusters/list | contains.py "X-Databricks-Org-Id" "999"
+trace print_requests.py --get //api/2.0/clusters/list | contains.py "X-Databricks-Workspace-Id" "999"
diff --git a/acceptance/cmd/api/workspace-id-from-w-query/out.test.toml b/acceptance/cmd/api/workspace-id-from-w-query/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/api/workspace-id-from-w-query/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/api/workspace-id-from-w-query/output.txt b/acceptance/cmd/api/workspace-id-from-w-query/output.txt
new file mode 100644
index 00000000000..702a467d9c8
--- /dev/null
+++ b/acceptance/cmd/api/workspace-id-from-w-query/output.txt
@@ -0,0 +1,21 @@
+{}
+
+>>> print_requests.py --get //api/2.0/clusters/list
+{
+  "headers": {
+    "Authorization": [
+      "Bearer [DATABRICKS_TOKEN]"
+    ],
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/api_get cmd-exec-id/[UUID] interactive/none auth/pat"
+    ],
+    "X-Databricks-Workspace-Id": [
+      "999"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/clusters/list",
+  "q": {
+    "w": "999"
+  }
+}
diff --git a/acceptance/cmd/api/workspace-id-from-w-query/script b/acceptance/cmd/api/workspace-id-from-w-query/script
new file mode 100644
index 00000000000..f60139e4b7c
--- /dev/null
+++ b/acceptance/cmd/api/workspace-id-from-w-query/script
@@ -0,0 +1,2 @@
+MSYS_NO_PATHCONV=1 $CLI api get "/api/2.0/clusters/list?w=999"
+trace print_requests.py --get //api/2.0/clusters/list | contains.py "X-Databricks-Workspace-Id" "999"
diff --git a/acceptance/cmd/api/workspace-id-none/home/.databrickscfg.tmpl b/acceptance/cmd/api/workspace-id-none/home/.databrickscfg.tmpl
new file mode 100644
index 00000000000..cab79993c1f
--- /dev/null
+++ b/acceptance/cmd/api/workspace-id-none/home/.databrickscfg.tmpl
@@ -0,0 +1,4 @@
+[spog-account]
+host         = $DATABRICKS_HOST
+token        = $DATABRICKS_TOKEN
+workspace_id = none
diff --git a/acceptance/cmd/api/workspace-id-none/out.test.toml b/acceptance/cmd/api/workspace-id-none/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/api/workspace-id-none/out.test.toml
+++ b/acceptance/cmd/api/workspace-id-none/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/api/workspace-id-none/output.txt b/acceptance/cmd/api/workspace-id-none/output.txt
index c165bf2af88..8aa86ba5677 100644
--- a/acceptance/cmd/api/workspace-id-none/output.txt
+++ b/acceptance/cmd/api/workspace-id-none/output.txt
@@ -7,7 +7,7 @@
       "Bearer [DATABRICKS_TOKEN]"
     ],
     "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/api_get cmd-exec-id/[UUID] interactive/none auth/pat"
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/api_get cmd-exec-id/[UUID] interactive/none auth/pat"
     ]
   },
   "method": "GET",
diff --git a/acceptance/cmd/api/workspace-id-none/script b/acceptance/cmd/api/workspace-id-none/script
index 4ecd00c6768..9551a87dd57 100644
--- a/acceptance/cmd/api/workspace-id-none/script
+++ b/acceptance/cmd/api/workspace-id-none/script
@@ -2,12 +2,7 @@
 # The CLI must strip the sentinel before the header decision; the recorded
 # request should not carry the routing identifier.
 sethome "./home"
-cat > "./home/.databrickscfg" <<EOF
-[spog-account]
-host         = $DATABRICKS_HOST
-token        = $DATABRICKS_TOKEN
-workspace_id = none
-EOF
+envsubst < "./home/.databrickscfg.tmpl" > "./home/.databrickscfg"
 
 MSYS_NO_PATHCONV=1 $CLI api get /api/2.0/clusters/list --profile spog-account
-trace print_requests.py --get //api/2.0/clusters/list | contains.py "!X-Databricks-Org-Id"
+trace print_requests.py --get //api/2.0/clusters/list | contains.py "!X-Databricks-Workspace-Id"
diff --git a/acceptance/cmd/api/workspace-path/out.test.toml b/acceptance/cmd/api/workspace-path/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/api/workspace-path/out.test.toml
+++ b/acceptance/cmd/api/workspace-path/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/api/workspace-path/output.txt b/acceptance/cmd/api/workspace-path/output.txt
index 9d17f66284f..1e1a24f54c1 100644
--- a/acceptance/cmd/api/workspace-path/output.txt
+++ b/acceptance/cmd/api/workspace-path/output.txt
@@ -7,10 +7,10 @@
       "Bearer [DATABRICKS_TOKEN]"
     ],
     "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/api_get cmd-exec-id/[UUID] interactive/none auth/pat"
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/api_get cmd-exec-id/[UUID] interactive/none auth/pat"
     ],
-    "X-Databricks-Org-Id": [
-      "[NUMID]"
+    "X-Databricks-Workspace-Id": [
+      "[WORKSPACE_ID]"
     ]
   },
   "method": "GET",
diff --git a/acceptance/cmd/api/workspace-path/script b/acceptance/cmd/api/workspace-path/script
index 4e5bb35c4be..16351c0ef07 100644
--- a/acceptance/cmd/api/workspace-path/script
+++ b/acceptance/cmd/api/workspace-path/script
@@ -1,2 +1,2 @@
 MSYS_NO_PATHCONV=1 $CLI api get /api/2.0/clusters/list
-trace print_requests.py --get //api/2.0/clusters/list | contains.py "X-Databricks-Org-Id"
+trace print_requests.py --get //api/2.0/clusters/list | contains.py "X-Databricks-Workspace-Id"
diff --git a/acceptance/cmd/api/workspace-proxy-regression/out.test.toml b/acceptance/cmd/api/workspace-proxy-regression/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/api/workspace-proxy-regression/out.test.toml
+++ b/acceptance/cmd/api/workspace-proxy-regression/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/api/workspace-proxy-regression/output.txt b/acceptance/cmd/api/workspace-proxy-regression/output.txt
index c98486a15e1..92ed4ac3730 100644
--- a/acceptance/cmd/api/workspace-proxy-regression/output.txt
+++ b/acceptance/cmd/api/workspace-proxy-regression/output.txt
@@ -7,10 +7,10 @@
       "Bearer [DATABRICKS_TOKEN]"
     ],
     "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/api_get cmd-exec-id/[UUID] interactive/none auth/pat"
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/api_get cmd-exec-id/[UUID] interactive/none auth/pat"
     ],
-    "X-Databricks-Org-Id": [
-      "[NUMID]"
+    "X-Databricks-Workspace-Id": [
+      "[WORKSPACE_ID]"
     ]
   },
   "method": "GET",
diff --git a/acceptance/cmd/api/workspace-proxy-regression/script b/acceptance/cmd/api/workspace-proxy-regression/script
index 39ab661f4f1..8620765476d 100644
--- a/acceptance/cmd/api/workspace-proxy-regression/script
+++ b/acceptance/cmd/api/workspace-proxy-regression/script
@@ -2,4 +2,4 @@
 # being misclassified as account-scope, so the routing identifier should be
 # present on the recorded request.
 MSYS_NO_PATHCONV=1 $CLI api get /api/2.0/preview/accounts/access-control/rule-sets
-trace print_requests.py --get //api/2.0/preview/accounts/access-control/rule-sets | contains.py "X-Databricks-Org-Id"
+trace print_requests.py --get //api/2.0/preview/accounts/access-control/rule-sets | contains.py "X-Databricks-Workspace-Id"
diff --git a/acceptance/cmd/apps/init/package_manager/broken-template/appkit.plugins.json b/acceptance/cmd/apps/init/package_manager/broken-template/appkit.plugins.json
new file mode 100644
index 00000000000..fe51488c706
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager/broken-template/appkit.plugins.json
@@ -0,0 +1 @@
+[]
diff --git a/acceptance/cmd/apps/init/package_manager/broken-template/package.json b/acceptance/cmd/apps/init/package_manager/broken-template/package.json
new file mode 100644
index 00000000000..19765bd501b
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager/broken-template/package.json
@@ -0,0 +1 @@
+null
diff --git a/acceptance/cmd/apps/init/package_manager/broken-template/pnpm-lock.yaml b/acceptance/cmd/apps/init/package_manager/broken-template/pnpm-lock.yaml
new file mode 100644
index 00000000000..b0a073a9c13
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager/broken-template/pnpm-lock.yaml
@@ -0,0 +1 @@
+lockfileVersion: '9.0'
diff --git a/acceptance/cmd/apps/init/package_manager/cache/compat-manifest.json b/acceptance/cmd/apps/init/package_manager/cache/compat-manifest.json
new file mode 100644
index 00000000000..61229bfc23c
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager/cache/compat-manifest.json
@@ -0,0 +1,6 @@
+{
+  "1.0.0": {
+    "appkit": "999.0.0",
+    "skills": "0.2.10"
+  }
+}
diff --git a/acceptance/cmd/apps/init/package_manager/install-template/package-lock.json b/acceptance/cmd/apps/init/package_manager/install-template/package-lock.json
new file mode 100644
index 00000000000..dec24805d4e
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager/install-template/package-lock.json
@@ -0,0 +1,6 @@
+{
+  "name": "template",
+  "version": "1.0.0",
+  "lockfileVersion": 3,
+  "packages": {}
+}
diff --git a/acceptance/cmd/apps/init/package_manager/install-template/package.json.tmpl b/acceptance/cmd/apps/init/package_manager/install-template/package.json.tmpl
new file mode 100644
index 00000000000..46fd400a671
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager/install-template/package.json.tmpl
@@ -0,0 +1,8 @@
+{
+  "name": "{{.projectName}}",
+  "version": "1.0.0",
+  "packageManager": "pnpm@11.0.8",
+  "scripts": {
+    "dev": "node --version"
+  }
+}
diff --git a/acceptance/cmd/apps/init/package_manager/npm-only-template/package-lock.json b/acceptance/cmd/apps/init/package_manager/npm-only-template/package-lock.json
new file mode 100644
index 00000000000..ce614c9ae4d
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager/npm-only-template/package-lock.json
@@ -0,0 +1,12 @@
+{
+  "name": "template",
+  "version": "1.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "template",
+      "version": "1.0.0"
+    }
+  }
+}
diff --git a/acceptance/cmd/apps/init/package_manager/npm-only-template/package.json b/acceptance/cmd/apps/init/package_manager/npm-only-template/package.json
new file mode 100644
index 00000000000..3ce4ef1e614
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager/npm-only-template/package.json
@@ -0,0 +1,8 @@
+{
+  "name": "{{.projectName}}",
+  "version": "1.0.0",
+  "packageManager": "npm@9.9.4",
+  "scripts": {
+    "dev": "node --version"
+  }
+}
diff --git a/acceptance/cmd/apps/init/package_manager/npm/main.go b/acceptance/cmd/apps/init/package_manager/npm/main.go
new file mode 100644
index 00000000000..162b50353cd
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager/npm/main.go
@@ -0,0 +1,82 @@
+package main
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+	"time"
+)
+
+// main emulates npm without a local Node.js installation or package downloads.
+func main() {
+	if err := run(); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}
+
+// run validates the command and the package.json visible to the installer.
+//
+//nolint:forbidigo // This standalone acceptance helper cannot import the CLI's libs/env package.
+func run() error {
+	version := os.Getenv("CLI_TEST_NPM_VERSION")
+	switch {
+	case slices.Equal(os.Args[1:], []string{"--version"}):
+		if version == "unavailable" {
+			return errors.New("npm is unavailable")
+		}
+		if os.Getenv("COREPACK_ENABLE_PROJECT_SPEC") != "0" {
+			return errors.New("version detection must ignore inherited Corepack pins")
+		}
+		fmt.Println(version)
+		return nil
+	case slices.Equal(os.Args[1:], []string{"ci", "--include=dev", "--no-audit", "--no-fund", "--prefer-offline"}),
+		slices.Equal(os.Args[1:], []string{"install", "--frozen-lockfile", "--prod=false"}):
+		switch os.Getenv("CLI_TEST_INSTALL_MODE") {
+		case "fail":
+			return errors.New("install failed")
+		case "wait":
+			time.Sleep(time.Minute)
+			// A canceled installer must never reach this marker outside the scaffold.
+			return os.WriteFile(filepath.Join("..", "uncanceled-install"), nil, 0o644)
+		case "retry":
+			if _, err := os.Stat("install-attempt"); errors.Is(err, os.ErrNotExist) {
+				if err := os.WriteFile("install-attempt", nil, 0o644); err != nil {
+					return err
+				}
+				return errors.New("retry in foreground")
+			}
+		}
+		data, err := os.ReadFile("package.json")
+		if err != nil {
+			return err
+		}
+		var pkg struct {
+			PackageManager string `json:"packageManager"`
+		}
+		if err := json.Unmarshal(data, &pkg); err != nil {
+			return err
+		}
+		wantPin := "npm@" + version
+		if strings.HasPrefix(filepath.Base(os.Args[0]), "pnpm") {
+			wantPin = "pnpm@10.17.1+sha224.abc"
+		}
+		if pkg.PackageManager != wantPin {
+			return fmt.Errorf("install saw packageManager %q, expected %s", pkg.PackageManager, wantPin)
+		}
+		if err := os.MkdirAll("node_modules", 0o755); err != nil {
+			return err
+		}
+		return os.WriteFile(filepath.Join("node_modules", "installed-pin"), []byte(pkg.PackageManager+"\n"), 0o644)
+	case slices.Equal(os.Args[1:], []string{"appkit", "setup", "--write"}):
+		return errors.New("setup failed")
+	case slices.Equal(os.Args[1:], []string{"run", "dev"}):
+		return errors.New("dev failed")
+	default:
+		return fmt.Errorf("unexpected npm arguments: %q", os.Args[1:])
+	}
+}
diff --git a/acceptance/cmd/apps/init/package_manager/out.test.toml b/acceptance/cmd/apps/init/package_manager/out.test.toml
new file mode 100644
index 00000000000..0938e678987
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/cmd/apps/init/package_manager/output.txt b/acceptance/cmd/apps/init/package_manager/output.txt
new file mode 100644
index 00000000000..58f81bb908a
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager/output.txt
@@ -0,0 +1,501 @@
+
+=== Missing pnpm fails before creating files, and the same name can be retried
+>>> [CLI] apps init --name retry-app --template pnpm-template
+Error: pnpm is unavailable; use databricks apps init --package-manager npm, install pnpm with corepack enable pnpm or npx get-pnpm, or use databricks apps init --skip-install: exec: "pnpm": executable file not found in PATH
+
+>>> [CLI] apps init --name retry-app --template pnpm-template --skip-install
+✔ Creating project
+
+✔ Project created successfully!
+
+  Location: [TEST_TMP_DIR]/retry-app
+  Files: 2
+
+  Next steps:
+
+    cd retry-app
+    pnpm install --frozen-lockfile && pnpm run dev
+
+"pnpm@10.17.1+sha224.abc"
+
+=== Missing npm also fails before creating files
+>>> [CLI] apps init --name missing-npm --template npm-only-template
+Error: npm is unavailable; install it and retry, or use databricks apps init --skip-install to scaffold without running setup: exec: "npm": executable file not found in PATH
+
+=== Explicit manager values must be nonempty and supported
+>>> [CLI] apps init --name invalid-manager --package-manager= --skip-install
+Error: --package-manager must be npm or pnpm
+
+>>> [CLI] apps init --name invalid-manager --package-manager yarn --skip-install
+Error: unknown package manager "yarn" (allowed: npm, pnpm)
+
+=== Python templates reject an explicit Node.js package manager
+>>> [CLI] apps init --name python-app --template python-template --package-manager npm --skip-install
+Error: --package-manager is only supported for Node.js templates; remove the flag for this template
+
+>>> [CLI] apps init --name python-app --template python-pip-template --package-manager npm --skip-install
+Error: --package-manager is only supported for Node.js templates; remove the flag for this template
+
+>>> [CLI] apps init --name python-app --template python-template --skip-install
+✔ Creating project
+
+✔ Project created successfully!
+
+  Location: [TEST_TMP_DIR]/python-app
+  Files: 1
+
+  Next steps:
+
+    cd python-app
+    uv sync && uv run python app.py
+
+
+=== Pnpm includes development dependencies and preserves the template pin
+>>> NODE_ENV=production [CLI] apps init --name pnpm-installed --template pnpm-template
+✔ Installing dependencies
+✔ Creating project
+
+✔ Project created successfully!
+
+  Location: [TEST_TMP_DIR]/pnpm-installed
+  Files: 2
+
+  Next steps:
+
+    cd pnpm-installed
+    pnpm run dev
+
+pnpm@10.17.1+sha224.abc
+
+>>> NODE_ENV=production CLI_TEST_INSTALL_MODE=retry [CLI] apps init --name pnpm-retried --template pnpm-template
+Warn: Background install failed: exit status 1, will retry during project initialization
+✔ Creating project
+✔ Installing dependencies
+
+✔ Project created successfully!
+
+  Location: [TEST_TMP_DIR]/pnpm-retried
+  Files: 2
+
+  Next steps:
+
+    cd pnpm-retried
+    pnpm run dev
+
+pnpm@10.17.1+sha224.abc
+
+=== Failed installs remove the project so the same name can be retried
+>>> CLI_TEST_INSTALL_MODE=fail [CLI] apps init --name install-failed --template pnpm-template
+Warn: Background install failed: exit status 1, will retry during project initialization
+✔ Creating project
+Error: Failed to install dependencies: exit status 1
+
+>>> [CLI] apps init --name install-failed --template pnpm-template
+✔ Installing dependencies
+✔ Creating project
+
+✔ Project created successfully!
+
+  Location: [TEST_TMP_DIR]/install-failed
+  Files: 2
+
+  Next steps:
+
+    cd install-failed
+    pnpm run dev
+
+
+=== Validation after background preparation cancels installation and removes files
+>>> CLI_TEST_INSTALL_MODE=wait [CLI] apps init --name validation-failed --template pnpm-template --run invalid
+Error: invalid --run value: "invalid" (must be none, dev, or dev-remote)
+
+=== Failed background preparation is cleaned up even without an installer channel
+>>> [CLI] apps init --name preparation-failed --template broken-template
+Warn: Failed to prepare package.json: package.json must contain a JSON object, skipping background install
+Error: load manifest: parse manifest: json: cannot unmarshal array into Go value of type manifest.Manifest
+
+=== Failed setup removes the project
+>>> CLI_TEST_NPM_VERSION=11.4.1 [CLI] apps init --name setup-failed --template setup-template
+✔ Installing dependencies
+✔ Creating project
+Error: Failed to run appkit setup: exit status 1
+
+=== In-place failures preserve the current directory and existing git metadata
+>>> CLI_TEST_INSTALL_MODE=fail [CLI] apps init --name . --template ../pnpm-template
+Warn: Background install failed: exit status 1, will retry during project initialization
+✔ Creating project
+Warn: scaffold failed in current directory; review and clean up generated files manually (e.g. with git status / git clean -fd)
+Error: Failed to install dependencies: exit status 1
+
+=== A failed dev command preserves the completed project
+>>> [CLI] apps init --name dev-failed --template pnpm-template --run dev
+✔ Installing dependencies
+✔ Creating project
+
+✔ Project created successfully!
+
+  Location: [TEST_TMP_DIR]/dev-failed
+  Files: 2
+
+
+Starting development server (pnpm run dev)...
+dev failed
+Error: exit status 1
+
+>>> [CLI] apps init --name test-app-pnpm --skip-install
+✔ Creating project
+
+✔ Project created successfully!
+
+  Location: [TEST_TMP_DIR]/test-app-pnpm
+  Files: 6
+
+  Next steps:
+
+    cd test-app-pnpm
+    pnpm install --frozen-lockfile && pnpm run dev
+
+=== test-app-pnpm/app.yaml ===
+display_name: "test-app-pnpm"
+description: "A Databricks App powered by AppKit"
+command:
+  - "pnpm"
+  - "run"
+  - "start"
+=== test-app-pnpm/package.json ===
+{
+  "build": "pnpm run build:server && pnpm run build:client",
+  "build:server": "node --version",
+  "build:client": "node --version",
+  "optional": "pnpm run --if-present missing",
+  "required": "pnpm run --if-present false missing",
+  "quoted": "pnpm run build:server '\"--label\"'",
+  "quiet": "pnpm run --silent build:server --silent",
+  "env-build": "env NODE_ENV=production pnpm run build:server",
+  "predev": "pnpm run sync && pnpm run typegen",
+  "sync": "node --version",
+  "typegen": "node --version",
+  "dev": "vite dev",
+  "lint": "eslint ."
+}
+"pnpm@11.0.8"
+{
+  "lodash": "4.17.21"
+}
+
+>>> [CLI] apps init --name test-app-npm --package-manager npm --skip-install
+✔ Creating project
+
+✔ Project created successfully!
+
+  Location: [TEST_TMP_DIR]/test-app-npm
+  Files: 6
+
+  Next steps:
+
+    cd test-app-npm
+    npm ci && npm run dev
+
+=== test-app-npm/app.yaml ===
+display_name: "test-app-npm"
+description: "A Databricks App powered by AppKit"
+command:
+  - "npm"
+  - "run"
+  - "start"
+=== test-app-npm/package.json ===
+{
+  "build": "npm run build:server && npm run build:client",
+  "build:server": "node --version",
+  "build:client": "node --version",
+  "optional": "npm run missing --if-present",
+  "required": "npm run missing --if-present false",
+  "quoted": "npm run build:server '\"--label\"'",
+  "quiet": "npm run build:server --silent -- --silent",
+  "env-build": "env NODE_ENV=production npm run build:server",
+  "predev": "npm run sync && npm run typegen",
+  "sync": "node --version",
+  "typegen": "node --version",
+  "dev": "vite dev",
+  "lint": "eslint ."
+}
+null
+{
+  "lodash": "4.17.21"
+}
+
+=== Standard template with pnpm
+>>> [CLI] apps init --name standard-app-pnpm --template standard-template --skip-install
+✔ Creating project
+
+✔ Project created successfully!
+
+  Location: [TEST_TMP_DIR]/standard-app-pnpm
+  Files: 4
+
+  Next steps:
+
+    cd standard-app-pnpm
+    pnpm install --frozen-lockfile && pnpm run dev
+
+display_name: "standard-app-pnpm"
+description: "A Databricks App powered by AppKit"
+command:
+  - "pnpm"
+  - "run"
+  - "start"
+{
+  "build": "pnpm run build:server && pnpm run build:client",
+  "build:server": "node --version",
+  "build:client": "node --version",
+  "predev": "pnpm run sync && pnpm run typegen",
+  "sync": "node --version",
+  "typegen": "node --version",
+  "dev": "vite dev",
+  "lint": "eslint ."
+}
+"pnpm@11.0.8"
+{
+  "lodash": "4.17.21"
+}
+
+=== Standard template with npm
+>>> [CLI] apps init --name standard-app-npm --template standard-template --package-manager npm --skip-install
+✔ Creating project
+
+✔ Project created successfully!
+
+  Location: [TEST_TMP_DIR]/standard-app-npm
+  Files: 4
+
+  Next steps:
+
+    cd standard-app-npm
+    npm ci && npm run dev
+
+display_name: "standard-app-npm"
+description: "A Databricks App powered by AppKit"
+command:
+  - "npm"
+  - "run"
+  - "start"
+{
+  "build": "npm run build:server && npm run build:client",
+  "build:server": "node --version",
+  "build:client": "node --version",
+  "predev": "npm run sync && npm run typegen",
+  "sync": "node --version",
+  "typegen": "node --version",
+  "dev": "vite dev",
+  "lint": "eslint ."
+}
+null
+{
+  "lodash": "4.17.21"
+}
+
+=== Lockless templates reject installation before creating the project
+>>> [CLI] apps init --name lockless-app-npm --template standard-template --package-manager npm
+Error: template has no npm-shrinkwrap.json or package-lock.json required by "npm ci"; add npm-shrinkwrap.json or package-lock.json to the template or use --skip-install to scaffold without installing dependencies
+
+>>> [CLI] apps init --name lockless-app-pnpm --template standard-template --package-manager pnpm
+Error: template has no pnpm-lock.yaml required by "pnpm install --frozen-lockfile"; add pnpm-lock.yaml to the template or use --skip-install to scaffold without installing dependencies
+
+=== Npm-only custom template rejects pnpm before copying
+>>> [CLI] apps init --name incompatible-app --template npm-only-template --package-manager pnpm --skip-install
+Error: template has package-lock.json but no pnpm-lock.yaml required by "pnpm install --frozen-lockfile"; use --package-manager npm or add pnpm-lock.yaml to the template
+
+=== Npm-only custom template selects npm quietly
+>>> [CLI] apps init --name compatible-app --template npm-only-template --skip-install
+✔ Creating project
+
+✔ Project created successfully!
+
+  Location: [TEST_TMP_DIR]/compatible-app
+  Files: 2
+
+  Next steps:
+
+    cd compatible-app
+    npm ci && npm run dev
+
+"npm@9.9.4"
+
+=== Npm records the installed version in a plain template
+>>> CLI_TEST_NPM_VERSION=11.4.1 [CLI] apps init --name installed-app --template npm-only-template --package-manager npm
+✔ Installing dependencies
+✔ Creating project
+
+✔ Project created successfully!
+
+  Location: [TEST_TMP_DIR]/installed-app
+  Files: 2
+
+  Next steps:
+
+    cd installed-app
+    npm run dev
+
+npm@11.4.1
+
+=== Npm records the installed version in a Go template
+>>> CLI_TEST_NPM_VERSION=10.8.3 [CLI] apps init --name rendered-app --template install-template --package-manager npm
+✔ Installing dependencies
+✔ Creating project
+
+✔ Project created successfully!
+
+  Location: [TEST_TMP_DIR]/rendered-app
+  Files: 2
+
+  Next steps:
+
+    cd rendered-app
+    npm run dev
+
+npm@10.8.3
+
+=== Npm version detection failure stops before creating the project
+>>> [CLI] apps init --name failed-app --template npm-only-template --package-manager npm
+Error: detect npm version; ensure npm is installed and working, or use --skip-install: exit status 1
+
+=== Npm invalid version stops before creating the project
+>>> CLI_TEST_NPM_VERSION=invalid [CLI] apps init --name invalid-app --template npm-only-template --package-manager npm
+Error: npm --version returned invalid version "invalid"; ensure npm is working, or use --skip-install
+
+=== Npm empty version stops before creating the project
+>>> CLI_TEST_NPM_VERSION= [CLI] apps init --name empty-app --template npm-only-template --package-manager npm
+Error: npm --version returned invalid version ""; ensure npm is working, or use --skip-install
+
+=== Version-like branch keeps pnpm
+>>> [CLI] apps init --name branch-app --branch 0.81-maintenance --skip-install
+✔ Cloning template (branch 0.81-maintenance)
+✔ Creating project
+
+✔ Project created successfully!
+
+  Location: [TEST_TMP_DIR]/branch-app
+  Files: 6
+
+  Next steps:
+
+    cd branch-app
+    pnpm install --frozen-lockfile && pnpm run dev
+
+display_name: "branch-app"
+description: "A Databricks App powered by AppKit"
+command:
+  - "pnpm"
+  - "run"
+  - "start"
+"pnpm@11.0.8"
+
+=== First dual-manager template version keeps pnpm
+>>> [CLI] apps init --name dual-manager-app --version 0.82.0 --package-manager pnpm --skip-install
+✔ Cloning template (version 0.82.0)
+✔ Creating project
+
+✔ Project created successfully!
+
+  Location: [TEST_TMP_DIR]/dual-manager-app
+  Files: 6
+
+  Next steps:
+
+    cd dual-manager-app
+    pnpm install --frozen-lockfile && pnpm run dev
+
+display_name: "dual-manager-app"
+description: "A Databricks App powered by AppKit"
+command:
+  - "pnpm"
+  - "run"
+  - "start"
+"pnpm run build:server && pnpm run build:client"
+"pnpm@11.0.8"
+
+=== Version downgrade uses npm throughout
+>>> [CLI] apps init --name older-app --version 0.81.0 --skip-install
+✔ Cloning template (version 0.81.0)
+✔ Creating project
+
+✔ Project created successfully!
+
+  Location: [TEST_TMP_DIR]/older-app
+  Files: 6
+
+  Next steps:
+
+    cd older-app
+    npm ci && npm run dev
+
+display_name: "older-app"
+description: "A Databricks App powered by AppKit"
+command:
+  - "npm"
+  - "run"
+  - "start"
+"npm run build:server && npm run build:client"
+null
+
+=== Explicit pnpm on an older template warns before selecting npm
+>>> [CLI] apps init --name explicit-older-app --version 0.81.0 --package-manager pnpm --skip-install
+✔ Cloning template (version 0.81.0)
+Warn: Package manager "pnpm" is not supported for AppKit version 0.81.0, using npm instead
+✔ Creating project
+
+✔ Project created successfully!
+
+  Location: [TEST_TMP_DIR]/explicit-older-app
+  Files: 6
+
+  Next steps:
+
+    cd explicit-older-app
+    npm ci && npm run dev
+
+null
+
+=== Missing version falls back to the embedded template and its package manager
+>>> DATABRICKS_CACHE_DIR=cache DATABRICKS_CACHE_ENABLED=true DATABRICKS_FORCE_EMBEDDED_COMPAT=false [CLI] apps init --name fallback-app --skip-install
+Warn: Template version not found, falling back to embedded version 0.84.0
+✔ Cloning template (version 0.84.0)
+✔ Creating project
+
+✔ Project created successfully!
+
+  Location: [TEST_TMP_DIR]/fallback-app
+  Files: 6
+
+  Next steps:
+
+    cd fallback-app
+    pnpm install --frozen-lockfile && pnpm run dev
+
+display_name: "fallback-app"
+description: "A Databricks App powered by AppKit"
+command:
+  - "pnpm"
+  - "run"
+  - "start"
+"pnpm run build:server && pnpm run build:client"
+"pnpm@11.0.8"
+
+=== Version downgrade resolves the installed npm pin
+>>> CLI_TEST_NPM_VERSION=11.4.1 [CLI] apps init --name installed-older-app --version 0.81.0
+✔ Cloning template (version 0.81.0)
+✔ Installing dependencies
+✔ Creating project
+
+✔ Project created successfully!
+
+  Location: [TEST_TMP_DIR]/installed-older-app
+  Files: 6
+
+  Next steps:
+
+    cd installed-older-app
+    npm run dev
+
+"npm@11.4.1"
+npm@11.4.1
diff --git a/acceptance/cmd/apps/init/package_manager/pnpm-template/package.json b/acceptance/cmd/apps/init/package_manager/pnpm-template/package.json
new file mode 100644
index 00000000000..8bf220c7be1
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager/pnpm-template/package.json
@@ -0,0 +1,7 @@
+{
+  "name": "{{.projectName}}",
+  "packageManager": "pnpm@10.17.1+sha224.abc",
+  "scripts": {
+    "dev": "node --version"
+  }
+}
diff --git a/acceptance/cmd/apps/init/package_manager/pnpm-template/pnpm-lock.yaml b/acceptance/cmd/apps/init/package_manager/pnpm-template/pnpm-lock.yaml
new file mode 100644
index 00000000000..b0a073a9c13
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager/pnpm-template/pnpm-lock.yaml
@@ -0,0 +1 @@
+lockfileVersion: '9.0'
diff --git a/acceptance/cmd/apps/init/package_manager/python-pip-template/requirements.txt b/acceptance/cmd/apps/init/package_manager/python-pip-template/requirements.txt
new file mode 100644
index 00000000000..12a4706528d
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager/python-pip-template/requirements.txt
@@ -0,0 +1 @@
+streamlit
diff --git a/acceptance/cmd/apps/init/package_manager/python-template/pyproject.toml b/acceptance/cmd/apps/init/package_manager/python-template/pyproject.toml
new file mode 100644
index 00000000000..3658ce454e0
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager/python-template/pyproject.toml
@@ -0,0 +1,3 @@
+[project]
+name = "{{.projectName}}"
+version = "0.1.0"
diff --git a/acceptance/cmd/apps/init/package_manager/script b/acceptance/cmd/apps/init/package_manager/script
new file mode 100755
index 00000000000..aba7dd17302
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager/script
@@ -0,0 +1,179 @@
+#!/bin/bash
+
+go build -o "fake-bin/npm$(go env GOEXE)" ./npm/main.go
+cp "fake-bin/npm$(go env GOEXE)" "fake-bin/npx$(go env GOEXE)"
+export PATH="$PWD/fake-bin:$PATH"
+export CLI_TEST_NPM_VERSION=unavailable
+
+title "Missing pnpm fails before creating files, and the same name can be retried"
+PATH="$PWD/fake-bin" musterr trace $CLI apps init --name retry-app --template pnpm-template
+test ! -e retry-app
+PATH="$PWD/fake-bin" trace $CLI apps init --name retry-app --template pnpm-template --skip-install
+jq '.packageManager' retry-app/package.json
+
+title "Missing npm also fails before creating files"
+mkdir empty-bin
+PATH="$PWD/empty-bin" musterr trace $CLI apps init --name missing-npm --template npm-only-template
+test ! -e missing-npm
+
+title "Explicit manager values must be nonempty and supported"
+musterr trace $CLI apps init --name invalid-manager --package-manager= --skip-install
+musterr trace $CLI apps init --name invalid-manager --package-manager yarn --skip-install
+test ! -e invalid-manager
+
+title "Python templates reject an explicit Node.js package manager"
+for template in python-template python-pip-template; do
+    PATH="$PWD/fake-bin" musterr trace $CLI apps init --name python-app --template "$template" --package-manager npm --skip-install
+    test ! -e python-app
+done
+PATH="$PWD/fake-bin" trace $CLI apps init --name python-app --template python-template --skip-install
+
+cp "fake-bin/npm$(go env GOEXE)" "fake-bin/pnpm$(go env GOEXE)"
+
+title "Pnpm includes development dependencies and preserves the template pin"
+trace NODE_ENV=production $CLI apps init --name pnpm-installed --template pnpm-template
+cat pnpm-installed/node_modules/installed-pin
+trace NODE_ENV=production CLI_TEST_INSTALL_MODE=retry $CLI apps init --name pnpm-retried --template pnpm-template
+cat pnpm-retried/node_modules/installed-pin
+
+title "Failed installs remove the project so the same name can be retried"
+musterr trace CLI_TEST_INSTALL_MODE=fail $CLI apps init --name install-failed --template pnpm-template
+test ! -e install-failed
+trace $CLI apps init --name install-failed --template pnpm-template
+test -d install-failed/node_modules
+
+title "Validation after background preparation cancels installation and removes files"
+musterr trace CLI_TEST_INSTALL_MODE=wait $CLI apps init --name validation-failed --template pnpm-template --run invalid
+test ! -e validation-failed
+test ! -e uncanceled-install
+
+title "Failed background preparation is cleaned up even without an installer channel"
+musterr trace $CLI apps init --name preparation-failed --template broken-template
+test ! -e preparation-failed
+
+title "Failed setup removes the project"
+musterr trace CLI_TEST_NPM_VERSION=11.4.1 $CLI apps init --name setup-failed --template setup-template
+test ! -e setup-failed
+
+title "In-place failures preserve the current directory and existing git metadata"
+mkdir -p in-place-failed/.git
+musterr withdir in-place-failed trace CLI_TEST_INSTALL_MODE=fail $CLI apps init --name . --template ../pnpm-template
+test -d in-place-failed/.git
+test -f in-place-failed/package.json
+
+title "A failed dev command preserves the completed project"
+musterr trace $CLI apps init --name dev-failed --template pnpm-template --run dev
+test -f dev-failed/package.json
+test -d dev-failed/node_modules
+
+# Test default package manager (pnpm)
+trace $CLI apps init --name test-app-pnpm --skip-install
+
+echo "=== test-app-pnpm/app.yaml ==="
+cat test-app-pnpm/app.yaml
+
+echo "=== test-app-pnpm/package.json ==="
+jq '.scripts, .packageManager, .overrides' test-app-pnpm/package.json
+
+# Test explicit npm package manager
+trace $CLI apps init --name test-app-npm --package-manager npm --skip-install
+
+echo "=== test-app-npm/app.yaml ==="
+cat test-app-npm/app.yaml
+
+echo "=== test-app-npm/package.json ==="
+jq '.scripts, .packageManager, .overrides' test-app-npm/package.json
+
+title "Standard template with pnpm"
+trace $CLI apps init --name standard-app-pnpm --template standard-template --skip-install
+cat standard-app-pnpm/app.yaml
+jq '.scripts, .packageManager, .overrides' standard-app-pnpm/package.json
+
+title "Standard template with npm"
+trace $CLI apps init --name standard-app-npm --template standard-template --package-manager npm --skip-install
+cat standard-app-npm/app.yaml
+jq '.scripts, .packageManager, .overrides' standard-app-npm/package.json
+
+title "Lockless templates reject installation before creating the project"
+for manager in npm pnpm; do
+    musterr trace $CLI apps init --name "lockless-app-$manager" --template standard-template --package-manager "$manager"
+    test ! -e "lockless-app-$manager"
+done
+
+title "Npm-only custom template rejects pnpm before copying"
+musterr trace $CLI apps init --name incompatible-app --template npm-only-template --package-manager pnpm --skip-install
+test ! -e incompatible-app
+test -f npm-only-template/package-lock.json
+
+title "Npm-only custom template selects npm quietly"
+trace $CLI apps init --name compatible-app --template npm-only-template --skip-install
+diff.py npm-only-template/package-lock.json compatible-app/package-lock.json
+jq '.packageManager' compatible-app/package.json
+
+title "Npm records the installed version in a plain template"
+trace CLI_TEST_NPM_VERSION=11.4.1 $CLI apps init --name installed-app --template npm-only-template --package-manager npm
+jq -r '.packageManager' installed-app/package.json > final-pin
+diff.py installed-app/node_modules/installed-pin final-pin
+cat final-pin
+
+title "Npm records the installed version in a Go template"
+trace CLI_TEST_NPM_VERSION=10.8.3 $CLI apps init --name rendered-app --template install-template --package-manager npm
+jq -r '.packageManager' rendered-app/package.json > final-pin
+diff.py rendered-app/node_modules/installed-pin final-pin
+cat final-pin
+
+title "Npm version detection failure stops before creating the project"
+musterr trace $CLI apps init --name failed-app --template npm-only-template --package-manager npm
+test ! -e failed-app
+
+title "Npm invalid version stops before creating the project"
+musterr trace CLI_TEST_NPM_VERSION=invalid $CLI apps init --name invalid-app --template npm-only-template --package-manager npm
+test ! -e invalid-app
+
+title "Npm empty version stops before creating the project"
+musterr trace CLI_TEST_NPM_VERSION= $CLI apps init --name empty-app --template npm-only-template --package-manager npm
+test ! -e empty-app
+
+# Use a local repository to exercise default-template version resolution without network access.
+cp template/databricks.yml databricks.yml
+git-repo-init
+git add template
+git commit -qm 'Add template'
+git tag template-v0.81.0
+git tag template-v0.84.0
+git tag template-v0.82.0
+git branch 0.81-maintenance
+repo_url=$(python3 -c 'from pathlib import Path; print(Path.cwd().as_uri())')
+export GIT_CONFIG_COUNT=1
+export GIT_CONFIG_KEY_0="url.${repo_url}/.insteadOf"
+export GIT_CONFIG_VALUE_0="https://github.com/databricks/appkit"
+export DATABRICKS_APPKIT_TEMPLATE_PATH=""
+
+title "Version-like branch keeps pnpm"
+trace $CLI apps init --name branch-app --branch 0.81-maintenance --skip-install
+cat branch-app/app.yaml
+jq '.packageManager' branch-app/package.json
+
+title "First dual-manager template version keeps pnpm"
+trace $CLI apps init --name dual-manager-app --version 0.82.0 --package-manager pnpm --skip-install
+cat dual-manager-app/app.yaml
+jq '.scripts.build, .packageManager' dual-manager-app/package.json
+
+title "Version downgrade uses npm throughout"
+trace $CLI apps init --name older-app --version 0.81.0 --skip-install
+cat older-app/app.yaml
+jq '.scripts.build, .packageManager' older-app/package.json
+
+title "Explicit pnpm on an older template warns before selecting npm"
+trace $CLI apps init --name explicit-older-app --version 0.81.0 --package-manager pnpm --skip-install
+jq '.packageManager' explicit-older-app/package.json
+
+title "Missing version falls back to the embedded template and its package manager"
+trace DATABRICKS_CACHE_DIR=cache DATABRICKS_CACHE_ENABLED=true DATABRICKS_FORCE_EMBEDDED_COMPAT=false $CLI apps init --name fallback-app --skip-install
+cat fallback-app/app.yaml
+jq '.scripts.build, .packageManager' fallback-app/package.json
+
+title "Version downgrade resolves the installed npm pin"
+trace CLI_TEST_NPM_VERSION=11.4.1 $CLI apps init --name installed-older-app --version 0.81.0
+jq '.packageManager' installed-older-app/package.json
+cat installed-older-app/node_modules/installed-pin
diff --git a/acceptance/cmd/apps/init/package_manager/setup-template/package-lock.json b/acceptance/cmd/apps/init/package_manager/setup-template/package-lock.json
new file mode 100644
index 00000000000..ea4d7907814
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager/setup-template/package-lock.json
@@ -0,0 +1,3 @@
+{
+  "lockfileVersion": 3
+}
diff --git a/acceptance/cmd/apps/init/package_manager/setup-template/package.json b/acceptance/cmd/apps/init/package_manager/setup-template/package.json
new file mode 100644
index 00000000000..5be69e9c6a9
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager/setup-template/package.json
@@ -0,0 +1,6 @@
+{
+  "name": "{{.projectName}}",
+  "dependencies": {
+    "@databricks/appkit": "0.82.0"
+  }
+}
diff --git a/acceptance/cmd/apps/init/package_manager/standard-template/app.yaml.tmpl b/acceptance/cmd/apps/init/package_manager/standard-template/app.yaml.tmpl
new file mode 100644
index 00000000000..d57c70e15d5
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager/standard-template/app.yaml.tmpl
@@ -0,0 +1,6 @@
+display_name: "{{.projectName}}"
+description: "{{.appDescription}}"
+command:
+  - "{{.packageManager}}"
+  - "run"
+  - "start"
diff --git a/acceptance/cmd/apps/init/package_manager/standard-template/appkit.plugins.json b/acceptance/cmd/apps/init/package_manager/standard-template/appkit.plugins.json
new file mode 100644
index 00000000000..2c8f10552d7
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager/standard-template/appkit.plugins.json
@@ -0,0 +1,4 @@
+{
+  "version": "0.1.0",
+  "plugins": {}
+}
diff --git a/acceptance/cmd/apps/init/package_manager/standard-template/databricks.yml.tmpl b/acceptance/cmd/apps/init/package_manager/standard-template/databricks.yml.tmpl
new file mode 100644
index 00000000000..f892f7bb45a
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager/standard-template/databricks.yml.tmpl
@@ -0,0 +1,7 @@
+bundle:
+  name: "{{.projectName}}"
+
+resources:
+  apps:
+    my_app:
+      name: "{{.projectName}}"
diff --git a/acceptance/cmd/apps/init/package_manager/standard-template/package.json b/acceptance/cmd/apps/init/package_manager/standard-template/package.json
new file mode 100644
index 00000000000..798974029fb
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager/standard-template/package.json
@@ -0,0 +1,22 @@
+{
+  "name": "{{.projectName}}",
+  "version": "0.1.0",
+  "description": "{{.appDescription}}",
+  "packageManager": "pnpm@11.0.8",
+  "scripts": {
+    "build": "pnpm run build:server && pnpm run build:client",
+    "build:server": "node --version",
+    "build:client": "node --version",
+    "predev": "pnpm run sync && pnpm run typegen",
+    "sync": "node --version",
+    "typegen": "node --version",
+    "dev": "vite dev",
+    "lint": "eslint ."
+  },
+  "dependencies": {
+    "react": "^18.0.0"
+  },
+  "overrides": {
+    "lodash": "4.17.21"
+  }
+}
diff --git a/acceptance/cmd/apps/init/package_manager/template/app.yaml.tmpl b/acceptance/cmd/apps/init/package_manager/template/app.yaml.tmpl
new file mode 100644
index 00000000000..d57c70e15d5
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager/template/app.yaml.tmpl
@@ -0,0 +1,6 @@
+display_name: "{{.projectName}}"
+description: "{{.appDescription}}"
+command:
+  - "{{.packageManager}}"
+  - "run"
+  - "start"
diff --git a/acceptance/cmd/apps/init/package_manager/template/appkit.plugins.json b/acceptance/cmd/apps/init/package_manager/template/appkit.plugins.json
new file mode 100644
index 00000000000..2c8f10552d7
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager/template/appkit.plugins.json
@@ -0,0 +1,4 @@
+{
+  "version": "0.1.0",
+  "plugins": {}
+}
diff --git a/acceptance/cmd/apps/init/package_manager/template/databricks.yml b/acceptance/cmd/apps/init/package_manager/template/databricks.yml
new file mode 100644
index 00000000000..f892f7bb45a
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager/template/databricks.yml
@@ -0,0 +1,7 @@
+bundle:
+  name: "{{.projectName}}"
+
+resources:
+  apps:
+    my_app:
+      name: "{{.projectName}}"
diff --git a/acceptance/cmd/apps/init/package_manager/template/package-lock.json b/acceptance/cmd/apps/init/package_manager/template/package-lock.json
new file mode 100644
index 00000000000..269606acddb
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager/template/package-lock.json
@@ -0,0 +1,4 @@
+{
+  "name": "{{.projectName}}",
+  "lockfileVersion": 3
+}
diff --git a/acceptance/cmd/apps/init/package_manager/template/package.json b/acceptance/cmd/apps/init/package_manager/template/package.json
new file mode 100644
index 00000000000..fa1398600ca
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager/template/package.json
@@ -0,0 +1,27 @@
+{
+  "name": "{{.projectName}}",
+  "version": "0.1.0",
+  "description": "{{.appDescription}}",
+  "packageManager": "pnpm@11.0.8",
+  "scripts": {
+    "build": "pnpm run build:server && pnpm run build:client",
+    "build:server": "node --version",
+    "build:client": "node --version",
+    "optional": "npm run missing --if-present",
+    "required": "npm run missing --if-present false",
+    "quoted": "npm run build:server '\"--label\"'",
+    "quiet": "npm run build:server --silent -- --silent",
+    "env-build": "env NODE_ENV=production pnpm run build:server",
+    "predev": "pnpm run sync && pnpm run typegen",
+    "sync": "node --version",
+    "typegen": "node --version",
+    "dev": "vite dev",
+    "lint": "eslint ."
+  },
+  "dependencies": {
+    "react": "^18.0.0"
+  },
+  "overrides": {
+    "lodash": "4.17.21"
+  }
+}
diff --git a/acceptance/cmd/apps/init/package_manager/template/pnpm-lock.yaml b/acceptance/cmd/apps/init/package_manager/template/pnpm-lock.yaml
new file mode 100644
index 00000000000..cc2909bd1d5
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager/template/pnpm-lock.yaml
@@ -0,0 +1,2 @@
+lockfileVersion: '9.0'
+importers: {}
diff --git a/acceptance/cmd/apps/init/package_manager/test.toml b/acceptance/cmd/apps/init/package_manager/test.toml
new file mode 100644
index 00000000000..18a4a204a54
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager/test.toml
@@ -0,0 +1,39 @@
+EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+Env.DATABRICKS_APPKIT_TEMPLATE_PATH = "template"
+Ignore = [
+    "empty-bin",
+    "in-place-failed",
+    "retry-app",
+    "python-app",
+    "pnpm-installed",
+    "pnpm-retried",
+    "install-failed",
+    "dev-failed",
+    "explicit-older-app",
+    "test-app-pnpm",
+    "test-app-npm",
+    "standard-app-pnpm",
+    "standard-app-npm",
+    "older-app",
+    "dual-manager-app",
+    "branch-app",
+    "fallback-app",
+    "compatible-app",
+    "installed-app",
+    "rendered-app",
+    "installed-older-app",
+    "fake-bin",
+    "final-pin",
+    ".git",
+    "databricks.yml",
+    "cache",
+]
+
+# Background completion can precede or follow the spinner starting.
+[[Repls]]
+Old = "✔ Dependencies installed"
+New = "✔ Installing dependencies"
+
+[[Repls]]
+Old = '\$PATH|%PATH%'
+New = "PATH"
diff --git a/acceptance/cmd/apps/init/package_manager_prune/out.test.toml b/acceptance/cmd/apps/init/package_manager_prune/out.test.toml
new file mode 100644
index 00000000000..0938e678987
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager_prune/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/cmd/apps/init/package_manager_prune/output.txt b/acceptance/cmd/apps/init/package_manager_prune/output.txt
new file mode 100644
index 00000000000..f32d0619553
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager_prune/output.txt
@@ -0,0 +1,50 @@
+
+>>> [CLI] apps init --name test-app-pnpm --skip-install
+✔ Creating project
+
+✔ Project created successfully!
+
+  Location: [TEST_TMP_DIR]/test-app-pnpm
+  Files: 6
+
+  Next steps:
+
+    cd test-app-pnpm
+    pnpm install --frozen-lockfile && pnpm run dev
+
+=== test-app-pnpm lockfiles ===
+pnpm-lock.yaml
+pnpm-workspace.yaml
+
+>>> [CLI] apps init --name test-app-npm --package-manager npm --skip-install
+✔ Creating project
+
+✔ Project created successfully!
+
+  Location: [TEST_TMP_DIR]/test-app-npm
+  Files: 6
+
+  Next steps:
+
+    cd test-app-npm
+    npm ci && npm run dev
+
+=== test-app-npm lockfiles ===
+npm-shrinkwrap.json
+package-lock.json
+
+=== Npm accepts a shrinkwrap template with a pnpm lockfile
+>>> [CLI] apps init --name shrinkwrap-app --template shrinkwrap-template --package-manager npm --skip-install
+✔ Creating project
+
+✔ Project created successfully!
+
+  Location: [TEST_TMP_DIR]/shrinkwrap-app
+  Files: 3
+
+  Next steps:
+
+    cd shrinkwrap-app
+    npm ci && npm run dev
+
+npm-shrinkwrap.json
diff --git a/acceptance/cmd/apps/init/package_manager_prune/script b/acceptance/cmd/apps/init/package_manager_prune/script
new file mode 100755
index 00000000000..221770baf32
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager_prune/script
@@ -0,0 +1,20 @@
+#!/bin/bash
+
+# Test pnpm (default) — should keep pnpm lockfiles, remove npm lockfile
+trace $CLI apps init --name test-app-pnpm --skip-install
+
+echo "=== test-app-pnpm lockfiles ==="
+ls -1 test-app-pnpm/ | grep -E "lock|shrinkwrap|workspace" || echo "(none)"
+
+# Test npm — should keep npm lockfile, remove pnpm lockfiles
+trace $CLI apps init --name test-app-npm --package-manager npm --skip-install
+
+echo "=== test-app-npm lockfiles ==="
+ls -1 test-app-npm/ | grep -E "lock|shrinkwrap|workspace" || echo "(none)"
+
+title "Npm accepts a shrinkwrap template with a pnpm lockfile"
+trace $CLI apps init --name shrinkwrap-app --template shrinkwrap-template --package-manager npm --skip-install
+diff.py shrinkwrap-template/npm-shrinkwrap.json shrinkwrap-app/npm-shrinkwrap.json
+test ! -e shrinkwrap-app/pnpm-lock.yaml
+test ! -e shrinkwrap-app/package-lock.json
+ls -1 shrinkwrap-app/ | grep -E "lock|shrinkwrap|workspace"
diff --git a/acceptance/cmd/apps/init/package_manager_prune/shrinkwrap-template/npm-shrinkwrap.json b/acceptance/cmd/apps/init/package_manager_prune/shrinkwrap-template/npm-shrinkwrap.json
new file mode 100644
index 00000000000..ce614c9ae4d
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager_prune/shrinkwrap-template/npm-shrinkwrap.json
@@ -0,0 +1,12 @@
+{
+  "name": "template",
+  "version": "1.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "template",
+      "version": "1.0.0"
+    }
+  }
+}
diff --git a/acceptance/cmd/apps/init/package_manager_prune/shrinkwrap-template/package.json b/acceptance/cmd/apps/init/package_manager_prune/shrinkwrap-template/package.json
new file mode 100644
index 00000000000..8879c973343
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager_prune/shrinkwrap-template/package.json
@@ -0,0 +1,7 @@
+{
+  "name": "{{.projectName}}",
+  "version": "1.0.0",
+  "scripts": {
+    "dev": "node --version"
+  }
+}
diff --git a/acceptance/cmd/apps/init/package_manager_prune/shrinkwrap-template/pnpm-lock.yaml b/acceptance/cmd/apps/init/package_manager_prune/shrinkwrap-template/pnpm-lock.yaml
new file mode 100644
index 00000000000..bc499f20850
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager_prune/shrinkwrap-template/pnpm-lock.yaml
@@ -0,0 +1,2 @@
+lockfileVersion: 5.4
+packages: {}
diff --git a/acceptance/cmd/apps/init/package_manager_prune/template/app.yaml.tmpl b/acceptance/cmd/apps/init/package_manager_prune/template/app.yaml.tmpl
new file mode 100644
index 00000000000..d57c70e15d5
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager_prune/template/app.yaml.tmpl
@@ -0,0 +1,6 @@
+display_name: "{{.projectName}}"
+description: "{{.appDescription}}"
+command:
+  - "{{.packageManager}}"
+  - "run"
+  - "start"
diff --git a/acceptance/cmd/apps/init/package_manager_prune/template/npm-shrinkwrap.json b/acceptance/cmd/apps/init/package_manager_prune/template/npm-shrinkwrap.json
new file mode 100644
index 00000000000..269606acddb
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager_prune/template/npm-shrinkwrap.json
@@ -0,0 +1,4 @@
+{
+  "name": "{{.projectName}}",
+  "lockfileVersion": 3
+}
diff --git a/acceptance/cmd/apps/init/package_manager_prune/template/package-lock.json b/acceptance/cmd/apps/init/package_manager_prune/template/package-lock.json
new file mode 100644
index 00000000000..269606acddb
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager_prune/template/package-lock.json
@@ -0,0 +1,4 @@
+{
+  "name": "{{.projectName}}",
+  "lockfileVersion": 3
+}
diff --git a/acceptance/cmd/apps/init/package_manager_prune/template/package.json b/acceptance/cmd/apps/init/package_manager_prune/template/package.json
new file mode 100644
index 00000000000..a68dac1a186
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager_prune/template/package.json
@@ -0,0 +1,5 @@
+{
+  "name": "{{.projectName}}",
+  "version": "0.1.0",
+  "description": "{{.appDescription}}"
+}
diff --git a/acceptance/cmd/apps/init/package_manager_prune/template/pnpm-lock.yaml b/acceptance/cmd/apps/init/package_manager_prune/template/pnpm-lock.yaml
new file mode 100644
index 00000000000..bc499f20850
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager_prune/template/pnpm-lock.yaml
@@ -0,0 +1,2 @@
+lockfileVersion: 5.4
+packages: {}
diff --git a/acceptance/cmd/apps/init/package_manager_prune/template/pnpm-workspace.yaml b/acceptance/cmd/apps/init/package_manager_prune/template/pnpm-workspace.yaml
new file mode 100644
index 00000000000..d05a7e7dc84
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager_prune/template/pnpm-workspace.yaml
@@ -0,0 +1,2 @@
+packages:
+  - .
diff --git a/acceptance/cmd/apps/init/package_manager_prune/test.toml b/acceptance/cmd/apps/init/package_manager_prune/test.toml
new file mode 100644
index 00000000000..a206192400b
--- /dev/null
+++ b/acceptance/cmd/apps/init/package_manager_prune/test.toml
@@ -0,0 +1,7 @@
+EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+Env.DATABRICKS_APPKIT_TEMPLATE_PATH = "template"
+Ignore = [
+    "test-app-pnpm",
+    "test-app-npm",
+    "shrinkwrap-app",
+]
diff --git a/acceptance/cmd/auth/describe/account-host-with-workspace-id/home/.databrickscfg.tmpl b/acceptance/cmd/auth/describe/account-host-with-workspace-id/home/.databrickscfg.tmpl
new file mode 100644
index 00000000000..7f3b82761f4
--- /dev/null
+++ b/acceptance/cmd/auth/describe/account-host-with-workspace-id/home/.databrickscfg.tmpl
@@ -0,0 +1,5 @@
+[acct-with-ws]
+host         = $DATABRICKS_HOST
+token        = $DATABRICKS_TOKEN
+account_id   = acct-123
+workspace_id = 900800700600
diff --git a/acceptance/cmd/auth/describe/account-host-with-workspace-id/out.test.toml b/acceptance/cmd/auth/describe/account-host-with-workspace-id/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/auth/describe/account-host-with-workspace-id/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/auth/describe/account-host-with-workspace-id/output.txt b/acceptance/cmd/auth/describe/account-host-with-workspace-id/output.txt
new file mode 100644
index 00000000000..6ebf8cecaef
--- /dev/null
+++ b/acceptance/cmd/auth/describe/account-host-with-workspace-id/output.txt
@@ -0,0 +1,19 @@
+
+=== Describe falls back to the account endpoint when the workspace check fails
+
+>>> [CLI] auth describe --profile acct-with-ws
+Host: [DATABRICKS_URL]
+Account ID: acct-123
+Authenticated with: pat
+-----
+Current configuration:
+  ✓ host: [DATABRICKS_URL] (from [TEST_TMP_DIR]/home/.databrickscfg config file)
+  ✓ account_id: acct-123 (from [TEST_TMP_DIR]/home/.databrickscfg config file)
+  ✓ workspace_id: [WORKSPACE_ID] (from [TEST_TMP_DIR]/home/.databrickscfg config file)
+  ✓ token: ******** (from [TEST_TMP_DIR]/home/.databrickscfg config file)
+  ✓ profile: acct-with-ws (from --profile flag)
+  ✓ databricks_cli_path: [CLI]
+  ✓ auth_type: pat
+  ✓ rate_limit: 1000000000 (from DATABRICKS_RATE_LIMIT environment variable)
+  ✓ cloud: AWS
+  ✓ discovery_url: [DATABRICKS_URL]/oidc/.well-known/oauth-authorization-server
diff --git a/acceptance/cmd/auth/describe/account-host-with-workspace-id/script b/acceptance/cmd/auth/describe/account-host-with-workspace-id/script
new file mode 100644
index 00000000000..e2ba8c9ff19
--- /dev/null
+++ b/acceptance/cmd/auth/describe/account-host-with-workspace-id/script
@@ -0,0 +1,9 @@
+sethome "./home"
+
+# Older logins wrote account console profiles with both account_id and
+# workspace_id, which resolves to a workspace client even though the host only
+# serves account APIs (https://github.com/databricks/cli/issues/5479).
+envsubst < "./home/.databrickscfg.tmpl" > "./home/.databrickscfg"
+
+title "Describe falls back to the account endpoint when the workspace check fails\n"
+trace $CLI auth describe --profile acct-with-ws
diff --git a/acceptance/cmd/auth/describe/account-host-with-workspace-id/test.toml b/acceptance/cmd/auth/describe/account-host-with-workspace-id/test.toml
new file mode 100644
index 00000000000..55541c52a5d
--- /dev/null
+++ b/acceptance/cmd/auth/describe/account-host-with-workspace-id/test.toml
@@ -0,0 +1,14 @@
+Ignore = [
+    "home"
+]
+
+# Simulate an account console host: it cannot serve workspace APIs, so the
+# workspace-side verification call fails even though the credentials are valid.
+[[Server]]
+Pattern = "GET /api/2.0/preview/scim/v2/Me"
+Response.Body = 'Unable to load OAuth Config'
+Response.StatusCode = 400
+
+[[Server]]
+Pattern = "GET /api/2.0/accounts/acct-123/workspaces"
+Response.Body = '[]'
diff --git a/acceptance/cmd/auth/describe/bundle-profile-env/.databrickscfg b/acceptance/cmd/auth/describe/bundle-profile-env/.databrickscfg
new file mode 100644
index 00000000000..cda36ac3800
--- /dev/null
+++ b/acceptance/cmd/auth/describe/bundle-profile-env/.databrickscfg
@@ -0,0 +1,6 @@
+[DEFAULT]
+host = $DATABRICKS_HOST
+
+[env-profile]
+host  = $DATABRICKS_HOST
+token = $DATABRICKS_TOKEN
diff --git a/acceptance/cmd/auth/describe/bundle-profile-env/databricks.yml b/acceptance/cmd/auth/describe/bundle-profile-env/databricks.yml
new file mode 100644
index 00000000000..f64132cea83
--- /dev/null
+++ b/acceptance/cmd/auth/describe/bundle-profile-env/databricks.yml
@@ -0,0 +1,5 @@
+bundle:
+  name: test-auth
+
+workspace:
+  host: $DATABRICKS_HOST
diff --git a/acceptance/cmd/auth/describe/bundle-profile-env/out.test.toml b/acceptance/cmd/auth/describe/bundle-profile-env/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/auth/describe/bundle-profile-env/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/auth/describe/bundle-profile-env/output.txt b/acceptance/cmd/auth/describe/bundle-profile-env/output.txt
new file mode 100644
index 00000000000..c3dbfd14124
--- /dev/null
+++ b/acceptance/cmd/auth/describe/bundle-profile-env/output.txt
@@ -0,0 +1,21 @@
+
+=== Describe inside a bundle attributes the profile to DATABRICKS_CONFIG_PROFILE (#2303)
+
+>>> [CLI] auth describe
+Host: [DATABRICKS_URL]
+User: [USERNAME]
+Authenticated with: pat
+-----
+Current configuration:
+  ✓ host: [DATABRICKS_URL] (from bundle)
+  ✓ workspace_id: [WORKSPACE_ID]
+  ✓ token: ******** (from .databrickscfg config file)
+  ✓ profile: env-profile (from DATABRICKS_CONFIG_PROFILE environment variable)
+  ✓ config_file: .databrickscfg (from DATABRICKS_CONFIG_FILE environment variable)
+  ✓ databricks_cli_path: [CLI]
+  ✓ auth_type: pat
+  ✓ http_timeout_seconds: 90 (from bundle)
+  ✓ rate_limit: 1000000000 (from DATABRICKS_RATE_LIMIT environment variable)
+  ✓ retry_timeout_seconds: 900 (from bundle)
+  ✓ cloud: AWS
+  ✓ discovery_url: [DATABRICKS_URL]/oidc/.well-known/oauth-authorization-server
diff --git a/acceptance/cmd/auth/describe/bundle-profile-env/script b/acceptance/cmd/auth/describe/bundle-profile-env/script
new file mode 100644
index 00000000000..33dc4391829
--- /dev/null
+++ b/acceptance/cmd/auth/describe/bundle-profile-env/script
@@ -0,0 +1,15 @@
+# Bake the harness host into the bundle file and the profile config.
+envsubst < databricks.yml > out.yml && mv out.yml databricks.yml
+envsubst < .databrickscfg > out && mv out .databrickscfg
+export DATABRICKS_CONFIG_FILE=.databrickscfg
+
+# Select the profile via the environment, not a flag or databricks.yml. Auth is
+# fully determined by the profile, so remove the ambient host/token.
+unset DATABRICKS_HOST DATABRICKS_TOKEN
+export DATABRICKS_CONFIG_PROFILE=env-profile
+
+# Inside a bundle root the resolved config labels every attribute "bundle", so
+# before #2303 the profile read "(from bundle)" even though it came from
+# DATABRICKS_CONFIG_PROFILE. describe must attribute it to the env var.
+title "Describe inside a bundle attributes the profile to DATABRICKS_CONFIG_PROFILE (#2303)\n"
+trace $CLI auth describe
diff --git a/acceptance/cmd/auth/describe/default-profile/home/.databrickscfg.tmpl b/acceptance/cmd/auth/describe/default-profile/home/.databrickscfg.tmpl
new file mode 100644
index 00000000000..fa728de3ee2
--- /dev/null
+++ b/acceptance/cmd/auth/describe/default-profile/home/.databrickscfg.tmpl
@@ -0,0 +1,12 @@
+[DEFAULT]
+
+[my-workspace]
+host  = $DATABRICKS_HOST
+token = $DATABRICKS_TOKEN
+
+[other-workspace]
+host  = https://other.cloud.databricks.com
+token = other-token
+
+[__settings__]
+default_profile = my-workspace
diff --git a/acceptance/cmd/auth/describe/default-profile/out.test.toml b/acceptance/cmd/auth/describe/default-profile/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/auth/describe/default-profile/out.test.toml
+++ b/acceptance/cmd/auth/describe/default-profile/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/auth/describe/default-profile/output.txt b/acceptance/cmd/auth/describe/default-profile/output.txt
index 315e156e8e7..fe2b8c47b87 100644
--- a/acceptance/cmd/auth/describe/default-profile/output.txt
+++ b/acceptance/cmd/auth/describe/default-profile/output.txt
@@ -1,5 +1,5 @@
 
-=== Describe without --profile (should use default)
+=== Describe without --profile (DATABRICKS_HOST takes precedence over default_profile)
 
 >>> [CLI] auth describe
 Host: [DATABRICKS_URL]
@@ -8,11 +8,29 @@ Authenticated with: pat
 -----
 Current configuration:
   ✓ host: [DATABRICKS_URL] (from DATABRICKS_HOST environment variable)
-  ✓ workspace_id: [NUMID]
+  ✓ workspace_id: [WORKSPACE_ID]
   ✓ token: ******** (from DATABRICKS_TOKEN environment variable)
+  ✓ profile: default
+  ✓ databricks_cli_path: [CLI]
+  ✓ auth_type: pat
+  ✓ rate_limit: 1000000000 (from DATABRICKS_RATE_LIMIT environment variable)
+  ✓ cloud: AWS
+  ✓ discovery_url: [DATABRICKS_URL]/oidc/.well-known/oauth-authorization-server
+
+=== Describe without --profile and without DATABRICKS_HOST (uses default_profile)
+
+>>> [CLI] auth describe
+Host: [DATABRICKS_URL]
+User: [USERNAME]
+Authenticated with: pat
+-----
+Current configuration:
+  ✓ host: [DATABRICKS_URL] (from [TEST_TMP_DIR]/home/.databrickscfg config file)
+  ✓ workspace_id: [WORKSPACE_ID]
+  ✓ token: ******** (from [TEST_TMP_DIR]/home/.databrickscfg config file)
   ✓ profile: my-workspace
   ✓ databricks_cli_path: [CLI]
   ✓ auth_type: pat
-  ✓ rate_limit: [NUMID] (from DATABRICKS_RATE_LIMIT environment variable)
+  ✓ rate_limit: 1000000000 (from DATABRICKS_RATE_LIMIT environment variable)
   ✓ cloud: AWS
   ✓ discovery_url: [DATABRICKS_URL]/oidc/.well-known/oauth-authorization-server
diff --git a/acceptance/cmd/auth/describe/default-profile/script b/acceptance/cmd/auth/describe/default-profile/script
index d38cf8952c5..8a677abec6f 100644
--- a/acceptance/cmd/auth/describe/default-profile/script
+++ b/acceptance/cmd/auth/describe/default-profile/script
@@ -1,20 +1,14 @@
 sethome "./home"
 
-# Create a config with two profiles and an explicit default.
-cat > "./home/.databrickscfg" <<EOF
-[DEFAULT]
+# A config with two profiles and an explicit default.
+envsubst < "./home/.databrickscfg.tmpl" > "./home/.databrickscfg"
 
-[my-workspace]
-host  = $DATABRICKS_HOST
-token = $DATABRICKS_TOKEN
-
-[other-workspace]
-host  = https://other.cloud.databricks.com
-token = other-token
-
-[__settings__]
-default_profile = my-workspace
-EOF
+# DATABRICKS_HOST is set in the environment, so authentication is fully
+# determined by the environment and the default profile is not pinned.
+title "Describe without --profile (DATABRICKS_HOST takes precedence over default_profile)\n"
+trace $CLI auth describe
 
-title "Describe without --profile (should use default)\n"
+# Without a host in the environment, the default profile is resolved and used.
+unset DATABRICKS_HOST DATABRICKS_TOKEN
+title "Describe without --profile and without DATABRICKS_HOST (uses default_profile)\n"
 trace $CLI auth describe
diff --git a/acceptance/cmd/auth/describe/profile-overrides-env/home/.databrickscfg.tmpl b/acceptance/cmd/auth/describe/profile-overrides-env/home/.databrickscfg.tmpl
new file mode 100644
index 00000000000..e5540af0d70
--- /dev/null
+++ b/acceptance/cmd/auth/describe/profile-overrides-env/home/.databrickscfg.tmpl
@@ -0,0 +1,6 @@
+[my-workspace]
+host  = $DATABRICKS_HOST
+token = $DATABRICKS_TOKEN
+
+[host-only]
+host  = $DATABRICKS_HOST
diff --git a/acceptance/cmd/auth/describe/profile-overrides-env/out.test.toml b/acceptance/cmd/auth/describe/profile-overrides-env/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/auth/describe/profile-overrides-env/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/auth/describe/profile-overrides-env/output.txt b/acceptance/cmd/auth/describe/profile-overrides-env/output.txt
new file mode 100644
index 00000000000..7835485cd76
--- /dev/null
+++ b/acceptance/cmd/auth/describe/profile-overrides-env/output.txt
@@ -0,0 +1,36 @@
+
+=== Describe with --profile overrides auth env vars (#5096)
+
+>>> [CLI] auth describe --profile my-workspace
+Host: [DATABRICKS_URL]
+User: [USERNAME]
+Authenticated with: pat
+-----
+Current configuration:
+  ✓ host: [DATABRICKS_URL] (from [TEST_TMP_DIR]/home/.databrickscfg config file)
+  ✓ workspace_id: [WORKSPACE_ID]
+  ✓ token: ******** (from [TEST_TMP_DIR]/home/.databrickscfg config file)
+  ✓ profile: my-workspace (from --profile flag)
+  ✓ databricks_cli_path: [CLI]
+  ✓ auth_type: pat
+  ✓ rate_limit: 1000000000 (from DATABRICKS_RATE_LIMIT environment variable)
+  ✓ cloud: AWS
+  ✓ discovery_url: [DATABRICKS_URL]/oidc/.well-known/oauth-authorization-server
+
+=== Describe with a host-only --profile fills the token from the environment (#5096)
+
+>>> [CLI] auth describe --profile host-only
+Host: [DATABRICKS_URL]
+User: [USERNAME]
+Authenticated with: pat
+-----
+Current configuration:
+  ✓ host: [DATABRICKS_URL] (from [TEST_TMP_DIR]/home/.databrickscfg config file)
+  ✓ workspace_id: [WORKSPACE_ID]
+  ✓ token: ******** (from DATABRICKS_TOKEN environment variable)
+  ✓ profile: host-only (from --profile flag)
+  ✓ databricks_cli_path: [CLI]
+  ✓ auth_type: pat
+  ✓ rate_limit: 1000000000 (from DATABRICKS_RATE_LIMIT environment variable)
+  ✓ cloud: AWS
+  ✓ discovery_url: [DATABRICKS_URL]/oidc/.well-known/oauth-authorization-server
diff --git a/acceptance/cmd/auth/describe/profile-overrides-env/script b/acceptance/cmd/auth/describe/profile-overrides-env/script
new file mode 100644
index 00000000000..cccc6917845
--- /dev/null
+++ b/acceptance/cmd/auth/describe/profile-overrides-env/script
@@ -0,0 +1,19 @@
+sethome "./home"
+
+# A profile carries full credentials; a second profile carries only a host.
+envsubst < "./home/.databrickscfg.tmpl" > "./home/.databrickscfg"
+
+# direnv-style auth env vars for a different workspace; before #5096 these
+# shadowed the profile selected with --profile.
+real_token=$DATABRICKS_TOKEN
+export DATABRICKS_HOST=https://dev.cloud.databricks.test
+export DATABRICKS_TOKEN=dev-token
+
+title "Describe with --profile overrides auth env vars (#5096)\n"
+trace $CLI auth describe --profile my-workspace
+
+# Host-only profile: the profile wins for the host, but env fills the token it
+# omits (#5096).
+export DATABRICKS_TOKEN=$real_token
+title "Describe with a host-only --profile fills the token from the environment (#5096)\n"
+trace $CLI auth describe --profile host-only
diff --git a/acceptance/cmd/auth/describe/profile-overrides-env/test.toml b/acceptance/cmd/auth/describe/profile-overrides-env/test.toml
new file mode 100644
index 00000000000..36c0e7e237b
--- /dev/null
+++ b/acceptance/cmd/auth/describe/profile-overrides-env/test.toml
@@ -0,0 +1,3 @@
+Ignore = [
+    "home"
+]
diff --git a/acceptance/cmd/auth/describe/u2m-json-output/home/.databrickscfg b/acceptance/cmd/auth/describe/u2m-json-output/home/.databrickscfg
new file mode 100644
index 00000000000..2e04a2e26c3
--- /dev/null
+++ b/acceptance/cmd/auth/describe/u2m-json-output/home/.databrickscfg
@@ -0,0 +1,3 @@
+[u2m-profile]
+host       = https://u2m-profile.databricks.test
+auth_type  = databricks-cli
diff --git a/acceptance/cmd/auth/describe/u2m-json-output/out.test.toml b/acceptance/cmd/auth/describe/u2m-json-output/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/auth/describe/u2m-json-output/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/auth/describe/u2m-json-output/output.txt b/acceptance/cmd/auth/describe/u2m-json-output/output.txt
new file mode 100644
index 00000000000..bd5e6108735
--- /dev/null
+++ b/acceptance/cmd/auth/describe/u2m-json-output/output.txt
@@ -0,0 +1,8 @@
+
+>>> [CLI] auth describe --profile u2m-profile --output json
+Warn: [hostmetadata] failed to fetch host metadata for https://u2m-profile.databricks.test, will skip for 1m0s
+{
+  "mode": "secure",
+  "location": "OS keyring (service: databricks-cli)",
+  "source": "default"
+}
diff --git a/acceptance/cmd/auth/describe/u2m-json-output/script b/acceptance/cmd/auth/describe/u2m-json-output/script
new file mode 100644
index 00000000000..af37710cb85
--- /dev/null
+++ b/acceptance/cmd/auth/describe/u2m-json-output/script
@@ -0,0 +1,10 @@
+sethome "./home"
+
+unset DATABRICKS_HOST
+unset DATABRICKS_TOKEN
+unset DATABRICKS_CONFIG_PROFILE
+unset DATABRICKS_AUTH_STORAGE
+
+# Filter to just the new token_storage object so the assertion is focused
+# and doesn't churn when other fields evolve.
+trace $CLI auth describe --profile u2m-profile --output json | jq '.token_storage'
diff --git a/acceptance/cmd/auth/describe/u2m-json-output/test.toml b/acceptance/cmd/auth/describe/u2m-json-output/test.toml
new file mode 100644
index 00000000000..36c0e7e237b
--- /dev/null
+++ b/acceptance/cmd/auth/describe/u2m-json-output/test.toml
@@ -0,0 +1,3 @@
+Ignore = [
+    "home"
+]
diff --git a/acceptance/cmd/auth/describe/u2m-plaintext-config/home/.databrickscfg b/acceptance/cmd/auth/describe/u2m-plaintext-config/home/.databrickscfg
new file mode 100644
index 00000000000..ba7da675492
--- /dev/null
+++ b/acceptance/cmd/auth/describe/u2m-plaintext-config/home/.databrickscfg
@@ -0,0 +1,6 @@
+[__settings__]
+auth_storage = plaintext
+
+[u2m-profile]
+host       = https://u2m-profile.databricks.test
+auth_type  = databricks-cli
diff --git a/acceptance/cmd/auth/describe/u2m-plaintext-config/out.test.toml b/acceptance/cmd/auth/describe/u2m-plaintext-config/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/auth/describe/u2m-plaintext-config/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/auth/describe/u2m-plaintext-config/output.txt b/acceptance/cmd/auth/describe/u2m-plaintext-config/output.txt
new file mode 100644
index 00000000000..cd98530821a
--- /dev/null
+++ b/acceptance/cmd/auth/describe/u2m-plaintext-config/output.txt
@@ -0,0 +1,12 @@
+
+>>> [CLI] auth describe --profile u2m-profile
+Warn: [hostmetadata] failed to fetch host metadata for https://u2m-profile.databricks.test, will skip for 1m0s
+Unable to authenticate: error getting token: cache: no cached credentials; run `databricks auth login` to sign in
+Token storage: plaintext, ~/.databricks/token-cache.json (from auth_storage in [__settings__] section of [TEST_TMP_DIR]/home/.databrickscfg)
+-----
+Current configuration:
+  ✓ host: https://u2m-profile.databricks.test (from [TEST_TMP_DIR]/home/.databrickscfg config file)
+  ✓ profile: u2m-profile (from --profile flag)
+  ✓ databricks_cli_path: [CLI]
+  ✓ auth_type: databricks-cli (from [TEST_TMP_DIR]/home/.databrickscfg config file)
+  ✓ rate_limit: 1000000000 (from DATABRICKS_RATE_LIMIT environment variable)
diff --git a/acceptance/cmd/auth/describe/u2m-plaintext-config/script b/acceptance/cmd/auth/describe/u2m-plaintext-config/script
new file mode 100644
index 00000000000..e712b00e726
--- /dev/null
+++ b/acceptance/cmd/auth/describe/u2m-plaintext-config/script
@@ -0,0 +1,8 @@
+sethome "./home"
+
+unset DATABRICKS_HOST
+unset DATABRICKS_TOKEN
+unset DATABRICKS_CONFIG_PROFILE
+unset DATABRICKS_AUTH_STORAGE
+
+trace $CLI auth describe --profile u2m-profile
diff --git a/acceptance/cmd/auth/describe/u2m-plaintext-config/test.toml b/acceptance/cmd/auth/describe/u2m-plaintext-config/test.toml
new file mode 100644
index 00000000000..36c0e7e237b
--- /dev/null
+++ b/acceptance/cmd/auth/describe/u2m-plaintext-config/test.toml
@@ -0,0 +1,3 @@
+Ignore = [
+    "home"
+]
diff --git a/acceptance/cmd/auth/describe/u2m-plaintext-env/home/.databrickscfg b/acceptance/cmd/auth/describe/u2m-plaintext-env/home/.databrickscfg
new file mode 100644
index 00000000000..2e04a2e26c3
--- /dev/null
+++ b/acceptance/cmd/auth/describe/u2m-plaintext-env/home/.databrickscfg
@@ -0,0 +1,3 @@
+[u2m-profile]
+host       = https://u2m-profile.databricks.test
+auth_type  = databricks-cli
diff --git a/acceptance/cmd/auth/describe/u2m-plaintext-env/out.test.toml b/acceptance/cmd/auth/describe/u2m-plaintext-env/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/auth/describe/u2m-plaintext-env/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/auth/describe/u2m-plaintext-env/output.txt b/acceptance/cmd/auth/describe/u2m-plaintext-env/output.txt
new file mode 100644
index 00000000000..d5b9ada2904
--- /dev/null
+++ b/acceptance/cmd/auth/describe/u2m-plaintext-env/output.txt
@@ -0,0 +1,12 @@
+
+>>> [CLI] auth describe --profile u2m-profile
+Warn: [hostmetadata] failed to fetch host metadata for https://u2m-profile.databricks.test, will skip for 1m0s
+Unable to authenticate: error getting token: cache: no cached credentials; run `databricks auth login` to sign in
+Token storage: plaintext, ~/.databricks/token-cache.json (from DATABRICKS_AUTH_STORAGE environment variable)
+-----
+Current configuration:
+  ✓ host: https://u2m-profile.databricks.test (from [TEST_TMP_DIR]/home/.databrickscfg config file)
+  ✓ profile: u2m-profile (from --profile flag)
+  ✓ databricks_cli_path: [CLI]
+  ✓ auth_type: databricks-cli (from [TEST_TMP_DIR]/home/.databrickscfg config file)
+  ✓ rate_limit: 1000000000 (from DATABRICKS_RATE_LIMIT environment variable)
diff --git a/acceptance/cmd/auth/describe/u2m-plaintext-env/script b/acceptance/cmd/auth/describe/u2m-plaintext-env/script
new file mode 100644
index 00000000000..4a9e596a1a9
--- /dev/null
+++ b/acceptance/cmd/auth/describe/u2m-plaintext-env/script
@@ -0,0 +1,9 @@
+sethome "./home"
+
+unset DATABRICKS_HOST
+unset DATABRICKS_TOKEN
+unset DATABRICKS_CONFIG_PROFILE
+
+export DATABRICKS_AUTH_STORAGE=plaintext
+
+trace $CLI auth describe --profile u2m-profile
diff --git a/acceptance/cmd/auth/describe/u2m-plaintext-env/test.toml b/acceptance/cmd/auth/describe/u2m-plaintext-env/test.toml
new file mode 100644
index 00000000000..36c0e7e237b
--- /dev/null
+++ b/acceptance/cmd/auth/describe/u2m-plaintext-env/test.toml
@@ -0,0 +1,3 @@
+Ignore = [
+    "home"
+]
diff --git a/acceptance/cmd/auth/describe/u2m-secure-default/home/.databrickscfg b/acceptance/cmd/auth/describe/u2m-secure-default/home/.databrickscfg
new file mode 100644
index 00000000000..2e04a2e26c3
--- /dev/null
+++ b/acceptance/cmd/auth/describe/u2m-secure-default/home/.databrickscfg
@@ -0,0 +1,3 @@
+[u2m-profile]
+host       = https://u2m-profile.databricks.test
+auth_type  = databricks-cli
diff --git a/acceptance/cmd/auth/describe/u2m-secure-default/out.test.toml b/acceptance/cmd/auth/describe/u2m-secure-default/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/auth/describe/u2m-secure-default/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/auth/describe/u2m-secure-default/output.txt b/acceptance/cmd/auth/describe/u2m-secure-default/output.txt
new file mode 100644
index 00000000000..afab6173cdc
--- /dev/null
+++ b/acceptance/cmd/auth/describe/u2m-secure-default/output.txt
@@ -0,0 +1,12 @@
+
+>>> [CLI] auth describe --profile u2m-profile
+Warn: [hostmetadata] failed to fetch host metadata for https://u2m-profile.databricks.test, will skip for 1m0s
+Unable to authenticate: error getting token: [KEYRING_LOOKUP_ERROR]
+Token storage: secure, OS keyring (service: databricks-cli) (from default)
+-----
+Current configuration:
+  ✓ host: https://u2m-profile.databricks.test (from [TEST_TMP_DIR]/home/.databrickscfg config file)
+  ✓ profile: u2m-profile (from --profile flag)
+  ✓ databricks_cli_path: [CLI]
+  ✓ auth_type: databricks-cli (from [TEST_TMP_DIR]/home/.databrickscfg config file)
+  ✓ rate_limit: 1000000000 (from DATABRICKS_RATE_LIMIT environment variable)
diff --git a/acceptance/cmd/auth/describe/u2m-secure-default/script b/acceptance/cmd/auth/describe/u2m-secure-default/script
new file mode 100644
index 00000000000..e712b00e726
--- /dev/null
+++ b/acceptance/cmd/auth/describe/u2m-secure-default/script
@@ -0,0 +1,8 @@
+sethome "./home"
+
+unset DATABRICKS_HOST
+unset DATABRICKS_TOKEN
+unset DATABRICKS_CONFIG_PROFILE
+unset DATABRICKS_AUTH_STORAGE
+
+trace $CLI auth describe --profile u2m-profile
diff --git a/acceptance/cmd/auth/describe/u2m-secure-default/test.toml b/acceptance/cmd/auth/describe/u2m-secure-default/test.toml
new file mode 100644
index 00000000000..d0d5090e6a5
--- /dev/null
+++ b/acceptance/cmd/auth/describe/u2m-secure-default/test.toml
@@ -0,0 +1,11 @@
+Ignore = [
+    "home"
+]
+
+# This test runs against the real OS keyring at Lookup time (no writes).
+# macOS produces a clean miss; Linux without a usable D-Bus session bus
+# produces a backend error. Normalize both so the assertion stays on the
+# resolved storage mode, not the lookup outcome.
+[[Repls]]
+Old = 'Unable to authenticate: error getting token: .*'
+New = 'Unable to authenticate: error getting token: [KEYRING_LOOKUP_ERROR]'
diff --git a/acceptance/cmd/auth/docker/configure-errors/out.test.toml b/acceptance/cmd/auth/docker/configure-errors/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/auth/docker/configure-errors/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/auth/docker/configure-errors/output.txt b/acceptance/cmd/auth/docker/configure-errors/output.txt
new file mode 100644
index 00000000000..7555218534f
--- /dev/null
+++ b/acceptance/cmd/auth/docker/configure-errors/output.txt
@@ -0,0 +1,54 @@
+
+=== Unsupported inherited flags
+
+>>> musterr [CLI] auth docker configure docker-test --host https://other.cloud.databricks.test
+Error: --host is not supported for auth docker configure. Select the workspace with [PROFILE] or --profile instead
+
+>>> musterr [CLI] auth docker configure docker-test --account-id [UUID]
+Error: --account-id is not supported for auth docker configure. Select the workspace with [PROFILE] or --profile instead
+
+>>> musterr [CLI] auth docker configure docker-test --workspace-id [WORKSPACE_ID]
+Error: --workspace-id is not supported for auth docker configure. Select the workspace with [PROFILE] or --profile instead
+
+=== Profile argument and flag
+
+>>> musterr [CLI] auth docker configure docker-test --profile docker-test
+Error: argument "docker-test" cannot be combined with --profile. Use --profile instead
+
+=== Invalid explicit region
+
+>>> musterr [CLI] auth docker configure docker-test --region=
+Flag --region has been deprecated, --region will be fully removed in the next release
+Error: region is required
+
+>>> configure_with_whitespace_region
+Flag --region has been deprecated, --region will be fully removed in the next release
+Error: region is required
+
+>>> musterr [CLI] auth docker configure docker-test --region=invalid_region
+Flag --region has been deprecated, --region will be fully removed in the next release
+Error: invalid region "invalid_region"
+
+=== Unsupported workspace host
+
+>>> musterr [CLI] auth docker configure unsupported-host
+Error: profile "unsupported-host" does not target a supported Databricks workspace host. Select a workspace profile, or create one with databricks auth login --host <workspace-url> --profile <name>
+
+=== Unsupported authentication profiles
+
+>>> musterr [CLI] auth docker configure pat
+Error: profile "pat" uses auth_type "pat". Docker credential helper requires a profile created by databricks auth login
+
+>>> musterr [CLI] auth docker configure m2m
+Error: profile "m2m" uses client credentials. Docker credential helper requires a profile created by databricks auth login
+
+>>> musterr [CLI] auth docker configure blank-auth
+Error: profile "blank-auth" uses auth_type "". Docker credential helper requires a profile created by databricks auth login
+
+=== Another profile already maps to the workspace
+
+>>> musterr [CLI] auth docker configure docker-test
+Error: multiple Databricks profiles match workspace ID [WORKSPACE_ID]: duplicate and docker-test. Remove duplicate workspace_id entries before using Docker credential helper
+
+=== Nothing changed
+Docker config not created; profiles unchanged
diff --git a/acceptance/cmd/auth/docker/configure-errors/script b/acceptance/cmd/auth/docker/configure-errors/script
new file mode 100644
index 00000000000..b05752e3027
--- /dev/null
+++ b/acceptance/cmd/auth/docker/configure-errors/script
@@ -0,0 +1,63 @@
+setup_docker_auth
+export DOCKER_CONFIG="$HOME/docker"
+
+configure_with_whitespace_region() {
+    musterr "$CLI" auth docker configure docker-test --region='   '
+}
+
+cat >> "$HOME/.databrickscfg" <<ENDCFG
+
+[unsupported-host]
+host = https://workspace.example.test
+auth_type = databricks-cli
+
+[duplicate]
+host = $DATABRICKS_HOST_ORIG
+auth_type = databricks-cli
+workspace_id = 900800700600
+
+[pat]
+host = $DATABRICKS_HOST_ORIG
+auth_type = pat
+workspace_id = 111222333
+
+[m2m]
+host = $DATABRICKS_HOST_ORIG
+client_id = client-id
+client_secret = client-secret
+workspace_id = 222333444
+
+[blank-auth]
+host = $DATABRICKS_HOST_ORIG
+workspace_id = 333444555
+ENDCFG
+cp "$HOME/.databrickscfg" "$HOME/databrickscfg.before"
+
+title "Unsupported inherited flags\n"
+trace musterr $CLI auth docker configure docker-test --host https://other.cloud.databricks.test
+trace musterr $CLI auth docker configure docker-test --account-id 00000000-0000-0000-0000-000000000000
+trace musterr $CLI auth docker configure docker-test --workspace-id 900800700600
+
+title "Profile argument and flag\n"
+trace musterr $CLI auth docker configure docker-test --profile docker-test
+
+title "Invalid explicit region\n"
+trace musterr $CLI auth docker configure docker-test --region=
+trace configure_with_whitespace_region
+trace musterr $CLI auth docker configure docker-test --region=invalid_region
+
+title "Unsupported workspace host\n"
+trace musterr $CLI auth docker configure unsupported-host
+
+title "Unsupported authentication profiles\n"
+trace musterr $CLI auth docker configure pat
+trace musterr $CLI auth docker configure m2m
+trace musterr $CLI auth docker configure blank-auth
+
+title "Another profile already maps to the workspace\n"
+trace musterr $CLI auth docker configure docker-test
+
+title "Nothing changed\n"
+assert_not_exists.py "$DOCKER_CONFIG/config.json"
+cmp "$HOME/databrickscfg.before" "$HOME/.databrickscfg"
+printf 'Docker config not created; profiles unchanged\n'
diff --git a/acceptance/cmd/auth/docker/configure-missing-region/out.test.toml b/acceptance/cmd/auth/docker/configure-missing-region/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/auth/docker/configure-missing-region/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/auth/docker/configure-missing-region/output.txt b/acceptance/cmd/auth/docker/configure-missing-region/output.txt
new file mode 100644
index 00000000000..c2ce71809e8
--- /dev/null
+++ b/acceptance/cmd/auth/docker/configure-missing-region/output.txt
@@ -0,0 +1,6 @@
+
+>>> musterr [CLI] auth docker configure docker-test
+Error: resolve workspace region for profile "docker-test": metastore summary did not include a region
+
+=== Profile and Docker state unchanged
+No profile, Docker config, or credential helper changes
diff --git a/acceptance/cmd/auth/docker/configure-missing-region/script b/acceptance/cmd/auth/docker/configure-missing-region/script
new file mode 100644
index 00000000000..0925a13ff8f
--- /dev/null
+++ b/acceptance/cmd/auth/docker/configure-missing-region/script
@@ -0,0 +1,14 @@
+setup_docker_auth
+install_databricks_cli
+
+export DOCKER_CONFIG="$HOME/docker"
+cp "$HOME/.databrickscfg" "$HOME/databrickscfg.before"
+
+trace musterr $CLI auth docker configure docker-test
+
+title "Profile and Docker state unchanged\n"
+cmp "$HOME/databrickscfg.before" "$HOME/.databrickscfg"
+assert_not_exists.py "$DOCKER_CONFIG/config.json"
+assert_not_exists.py "$HOME/bin/docker-credential-databricks"
+assert_not_exists.py "$HOME/bin/docker-credential-databricks.cmd"
+printf 'No profile, Docker config, or credential helper changes\n'
diff --git a/acceptance/cmd/auth/docker/configure-missing-region/test.toml b/acceptance/cmd/auth/docker/configure-missing-region/test.toml
new file mode 100644
index 00000000000..cde822468bd
--- /dev/null
+++ b/acceptance/cmd/auth/docker/configure-missing-region/test.toml
@@ -0,0 +1,3 @@
+[[Server]]
+Pattern = "GET /api/2.1/unity-catalog/metastore_summary"
+Response.Body = '{}'
diff --git a/acceptance/cmd/auth/docker/configure/docker-config.json b/acceptance/cmd/auth/docker/configure/docker-config.json
new file mode 100644
index 00000000000..3e346bda29b
--- /dev/null
+++ b/acceptance/cmd/auth/docker/configure/docker-config.json
@@ -0,0 +1,7 @@
+{
+  "auths": {
+    "registry.example.test": {
+      "auth": "preserved"
+    }
+  }
+}
diff --git a/acceptance/cmd/auth/docker/configure/out.test.toml b/acceptance/cmd/auth/docker/configure/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/auth/docker/configure/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/auth/docker/configure/output.txt b/acceptance/cmd/auth/docker/configure/output.txt
new file mode 100644
index 00000000000..dd985e386a5
--- /dev/null
+++ b/acceptance/cmd/auth/docker/configure/output.txt
@@ -0,0 +1,156 @@
+
+>>> databricks auth docker host --profile docker-test
+Registry host: [WORKSPACE_ID].container.us-west-2.localhost
+Credential helper configured: NO
+
+>>> print_requests.py --get //api
+{
+  "method": "GET",
+  "path": "/api/2.0/preview/scim/v2/Me",
+  "q": {
+    "excludedAttributes": "entitlements"
+  }
+}
+{
+  "headers": {
+    "X-Databricks-Workspace-Id": [
+      "[WORKSPACE_ID]"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.1/unity-catalog/metastore_summary"
+}
+
+>>> databricks auth docker configure docker-test
+Configured Docker credential helper for [WORKSPACE_ID].container.us-west-2.localhost
+Updated Docker config: [TEST_TMP_DIR]/home/docker/config.json
+Installed Docker credential helper: [TEST_TMP_DIR]/home/bin/docker-credential-databricks
+
+>>> print_requests.py --get //api
+{
+  "method": "GET",
+  "path": "/api/2.0/preview/scim/v2/Me",
+  "q": {
+    "excludedAttributes": "entitlements"
+  }
+}
+{
+  "headers": {
+    "X-Databricks-Workspace-Id": [
+      "[WORKSPACE_ID]"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.1/unity-catalog/metastore_summary"
+}
+
+=== Docker config
+{
+  "auths": {
+    "registry.example.test": {
+      "auth": "preserved"
+    }
+  },
+  "credHelpers": {
+    "[WORKSPACE_ID].container.us-west-2.localhost": "databricks"
+  }
+}
+
+=== Profile with resolved workspace ID
+; The profile defined in the DEFAULT section is to be used as a fallback when no profile is explicitly specified.
+[DEFAULT]
+
+[docker-test]
+host         = [DATABRICKS_URL]
+auth_type    = databricks-cli
+workspace_id = [WORKSPACE_ID]
+
+>>> databricks auth docker host --profile docker-test --output json
+{
+  "host": "[WORKSPACE_ID].container.us-west-2.localhost",
+  "configured": true
+}
+
+>>> print_requests.py --get //api
+{
+  "headers": {
+    "X-Databricks-Workspace-Id": [
+      "[WORKSPACE_ID]"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.1/unity-catalog/metastore_summary"
+}
+
+>>> docker-credential-databricks get
+{
+  "Secret": "oauth-token",
+  "Username": "oauthtoken"
+}
+
+=== Invalid registry host
+
+>>> musterr docker-credential-databricks get
+Error: "registry.example.test" is not a Databricks Artifact Registry host
+
+>>> musterr docker-credential-databricks erase
+docker-credential-databricks only supports get
+
+=== Configure again
+Docker config unchanged
+
+>>> print_requests.py --get //api
+{
+  "headers": {
+    "X-Databricks-Workspace-Id": [
+      "[WORKSPACE_ID]"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.1/unity-catalog/metastore_summary"
+}
+
+=== Deprecated --region flag skips workspace lookups
+
+>>> databricks auth docker configure docker-test --region us-west-2
+Flag --region has been deprecated, --region will be fully removed in the next release
+Configured Docker credential helper for [WORKSPACE_ID].container.us-west-2.localhost
+Updated Docker config: [TEST_TMP_DIR]/home/docker/config.json
+Installed Docker credential helper: [TEST_TMP_DIR]/home/bin/docker-credential-databricks
+No requests sent
+
+=== Explicit --region resolves a missing workspace ID
+
+>>> databricks auth docker configure docker-test --region us-west-2
+Flag --region has been deprecated, --region will be fully removed in the next release
+Configured Docker credential helper for [WORKSPACE_ID].container.us-west-2.localhost
+Updated Docker config: [TEST_TMP_DIR]/home/docker/config.json
+Installed Docker credential helper: [TEST_TMP_DIR]/home/bin/docker-credential-databricks
+
+>>> print_requests.py --get //api
+{
+  "method": "GET",
+  "path": "/api/2.0/preview/scim/v2/Me",
+  "q": {
+    "excludedAttributes": "entitlements"
+  }
+}
+
+=== Configure with the installation directory absent from PATH
+
+>>> command [TEST_TMP_DIR]/home/bin/databricks auth docker configure docker-test
+Configured Docker credential helper for [WORKSPACE_ID].container.us-west-2.localhost
+Updated Docker config: [TEST_TMP_DIR]/home/docker/config.json
+Installed Docker credential helper: [TEST_TMP_DIR]/home/bin/docker-credential-databricks
+Warning: ensure [TEST_TMP_DIR]/home/bin is on PATH before any other docker-credential-databricks helper, and that .CMD is in PATHEXT on Windows
+
+>>> print_requests.py --get //api
+{
+  "headers": {
+    "X-Databricks-Workspace-Id": [
+      "[WORKSPACE_ID]"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.1/unity-catalog/metastore_summary"
+}
diff --git a/acceptance/cmd/auth/docker/configure/script b/acceptance/cmd/auth/docker/configure/script
new file mode 100644
index 00000000000..96b62b88d8e
--- /dev/null
+++ b/acceptance/cmd/auth/docker/configure/script
@@ -0,0 +1,65 @@
+setup_docker_auth
+path_without_cli="$PATH"
+install_databricks_cli
+
+export DOCKER_CONFIG="$HOME/docker"
+mkdir -p "$DOCKER_CONFIG"
+cp docker-config.json "$DOCKER_CONFIG/config.json"
+
+trace databricks auth docker host --profile docker-test
+trace print_requests.py --get //api
+
+trace databricks auth docker configure docker-test
+trace print_requests.py --get //api
+
+if [[ "$OSTYPE" == "msys" || "$OSTYPE" == "cygwin" || "$OSTYPE" == "win32" ]]; then
+    # Git Bash cannot execute a .cmd path containing the matrix suffix's '='.
+    helper_dir=$(mktemp -d)
+    cp "$HOME/bin/docker-credential-databricks.cmd" "$helper_dir/"
+    trap 'rm -rf "$helper_dir"' EXIT
+    docker-credential-databricks() {
+        "$helper_dir/docker-credential-databricks.cmd" "$@"
+    }
+fi
+
+title "Docker config\n"
+jq -S . "$DOCKER_CONFIG/config.json"
+
+title "Profile with resolved workspace ID\n"
+cat "$HOME/.databrickscfg"
+
+trace databricks auth docker host --profile docker-test --output json | tee "$HOME/host.json"
+trace print_requests.py --get //api
+
+registry_host=$(jq -r .host "$HOME/host.json")
+printf '%s\n' "$registry_host" | trace docker-credential-databricks get | jq -S .
+
+title "Invalid registry host\n"
+printf '%s\n' registry.example.test | trace musterr docker-credential-databricks get
+
+trace musterr docker-credential-databricks erase
+
+title "Configure again\n"
+cp "$DOCKER_CONFIG/config.json" "$HOME/config.before.json"
+databricks auth docker configure docker-test &>LOG.configure-again
+cmp "$HOME/config.before.json" "$DOCKER_CONFIG/config.json"
+printf 'Docker config unchanged\n'
+trace print_requests.py --get //api
+
+title "Deprecated --region flag skips workspace lookups\n"
+trace databricks auth docker configure docker-test --region us-west-2
+assert_not_exists.py "$OUT_REQUESTS"
+printf 'No requests sent\n'
+
+title "Explicit --region resolves a missing workspace ID\n"
+cat > "$HOME/.databrickscfg" <<ENDCFG
+[docker-test]
+host = $DATABRICKS_HOST_ORIG
+auth_type = databricks-cli
+ENDCFG
+trace databricks auth docker configure docker-test --region us-west-2
+trace print_requests.py --get //api
+
+title "Configure with the installation directory absent from PATH\n"
+PATH="$path_without_cli" trace command "$HOME/bin/databricks" auth docker configure docker-test
+trace print_requests.py --get //api
diff --git a/acceptance/cmd/auth/docker/configure/test.toml b/acceptance/cmd/auth/docker/configure/test.toml
new file mode 100644
index 00000000000..9ba415846be
--- /dev/null
+++ b/acceptance/cmd/auth/docker/configure/test.toml
@@ -0,0 +1,10 @@
+RecordRequests = true
+IncludeRequestHeaders = ["X-Databricks-Workspace-Id"]
+
+[[Repls]]
+Old = 'docker-credential-databricks\.cmd'
+New = 'docker-credential-databricks'
+
+[[Repls]]
+Old = '(?m)docker-credential-databricks only supports get +$'
+New = 'docker-credential-databricks only supports get'
diff --git a/acceptance/cmd/auth/docker/help/out.test.toml b/acceptance/cmd/auth/docker/help/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/auth/docker/help/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/auth/docker/help/output.txt b/acceptance/cmd/auth/docker/help/output.txt
new file mode 100644
index 00000000000..a8f6c570d60
--- /dev/null
+++ b/acceptance/cmd/auth/docker/help/output.txt
@@ -0,0 +1,111 @@
+
+>>> [CLI] auth --help
+Authentication related commands. For more information regarding how
+authentication for the Databricks CLI and SDKs work please refer to the documentation
+linked below.
+
+AWS: https://docs.databricks.com/dev-tools/auth/index.html
+Azure: https://learn.microsoft.com/azure/databricks/dev-tools/auth
+GCP: https://docs.gcp.databricks.com/dev-tools/auth/index.html
+
+Usage:
+  databricks auth [command]
+
+Available Commands:
+  describe    Describes the credentials and the source of those credentials, being used by the CLI to authenticate
+  docker      (Experimental) Manage Docker authentication for Databricks Artifact Registry
+  login       Log into a Databricks workspace or account
+  logout      Log out of a Databricks profile
+  profiles    Lists profiles from ~/.databrickscfg
+  switch      Set the default profile
+  token       Get authentication token
+
+Flags:
+      --account-id string     Databricks Account ID
+  -h, --help                  help for auth
+      --host string           Databricks Host
+      --workspace-id string   Databricks Workspace ID
+
+Global Flags:
+      --debug            enable debug logging
+  -o, --output type      output type: text or json (default text)
+  -p, --profile string   ~/.databrickscfg profile
+  -t, --target string    bundle target to use (if applicable)
+
+Use "databricks auth [command] --help" for more information about a command.
+
+>>> [CLI] auth docker --help
+(Experimental) Manage Docker authentication for Databricks Artifact Registry
+
+Usage:
+  databricks auth docker [command]
+
+Available Commands:
+  configure   (Experimental) Configure Docker authentication for Databricks Artifact Registry
+  host        (Experimental) Show the registry host and credential helper status for a profile
+  token       (Experimental) Generate a Docker credential
+
+Flags:
+  -h, --help   help for docker
+
+Global Flags:
+      --account-id string     Databricks Account ID
+      --debug                 enable debug logging
+      --host string           Databricks Host
+  -o, --output type           output type: text or json (default text)
+  -p, --profile string        ~/.databrickscfg profile
+  -t, --target string         bundle target to use (if applicable)
+      --workspace-id string   Databricks Workspace ID
+
+Use "databricks auth docker [command] --help" for more information about a command.
+
+>>> [CLI] auth docker configure --help
+(Experimental) Configure Docker authentication for Databricks Artifact Registry.
+
+This command installs docker-credential-databricks and configures Docker to use
+it for the selected workspace's Artifact Registry host. If the selected profile
+does not already include a workspace_id, the command resolves and saves it so
+the Docker helper can map the registry host back to the profile. The registry
+region is inferred from the workspace's metastore. Select the workspace with
+[PROFILE] or --profile; --host, --account-id, and --workspace-id are not
+supported. The deprecated --region flag is retained for compatibility; omit it
+because it will be fully removed in the next release.
+
+Usage:
+  databricks auth docker configure [PROFILE] [flags]
+
+Flags:
+  -h, --help            help for configure
+      --region string   Artifact Registry region; we recommend omitting this flag because the region is inferred automatically (DEPRECATED: --region will be fully removed in the next release)
+
+Global Flags:
+      --account-id string     Databricks Account ID
+      --debug                 enable debug logging
+      --host string           Databricks Host
+  -o, --output type           output type: text or json (default text)
+  -p, --profile string        ~/.databrickscfg profile
+  -t, --target string         bundle target to use (if applicable)
+      --workspace-id string   Databricks Workspace ID
+
+>>> [CLI] auth docker host --help
+(Experimental) Show the Databricks Artifact Registry host and Docker credential helper status for a profile.
+
+The --profile flag is required.
+
+Usage:
+  databricks auth docker host [flags]
+
+Examples:
+  databricks auth docker host --profile DEFAULT
+
+Flags:
+  -h, --help   help for host
+
+Global Flags:
+      --account-id string     Databricks Account ID
+      --debug                 enable debug logging
+      --host string           Databricks Host
+  -o, --output type           output type: text or json (default text)
+  -p, --profile string        ~/.databrickscfg profile
+  -t, --target string         bundle target to use (if applicable)
+      --workspace-id string   Databricks Workspace ID
diff --git a/acceptance/cmd/auth/docker/help/script b/acceptance/cmd/auth/docker/help/script
new file mode 100644
index 00000000000..1d935e47230
--- /dev/null
+++ b/acceptance/cmd/auth/docker/help/script
@@ -0,0 +1,4 @@
+trace "$CLI" auth --help
+trace "$CLI" auth docker --help
+trace "$CLI" auth docker configure --help
+trace "$CLI" auth docker host --help
diff --git a/acceptance/cmd/auth/docker/host/docker-config.json b/acceptance/cmd/auth/docker/host/docker-config.json
new file mode 100644
index 00000000000..9409393bcd7
--- /dev/null
+++ b/acceptance/cmd/auth/docker/host/docker-config.json
@@ -0,0 +1,3 @@
+{
+  "credsStore": "databricks"
+}
diff --git a/acceptance/cmd/auth/docker/host/invalid-docker-config.json b/acceptance/cmd/auth/docker/host/invalid-docker-config.json
new file mode 100644
index 00000000000..34d218e07dd
--- /dev/null
+++ b/acceptance/cmd/auth/docker/host/invalid-docker-config.json
@@ -0,0 +1 @@
+{not valid json
diff --git a/acceptance/cmd/auth/docker/host/out.test.toml b/acceptance/cmd/auth/docker/host/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/auth/docker/host/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/auth/docker/host/output.txt b/acceptance/cmd/auth/docker/host/output.txt
new file mode 100644
index 00000000000..912c3ecfbd8
--- /dev/null
+++ b/acceptance/cmd/auth/docker/host/output.txt
@@ -0,0 +1,52 @@
+
+=== Profile required
+
+>>> musterr [CLI] auth docker host
+Error: --profile is required for auth docker host
+
+=== Workspace profile required
+
+>>> musterr [CLI] auth docker host --profile account
+Error: profile "account" does not target a workspace. Run databricks auth login --host <workspace-url> and retry with that profile
+
+=== Unsupported workspace host
+
+>>> musterr [CLI] auth docker host --profile unsupported-host
+Error: profile "unsupported-host" does not target a supported Databricks workspace host. Select a workspace profile, or create one with databricks auth login --host <workspace-url> --profile <name>
+
+=== Other authentication flags not supported
+
+>>> musterr [CLI] auth docker host --profile docker-test --host https://other.cloud.databricks.test
+Error: --host is not supported for auth docker host. Select the workspace with --profile instead
+
+>>> musterr [CLI] auth docker host --profile docker-test --account-id [UUID]
+Error: --account-id is not supported for auth docker host. Select the workspace with --profile instead
+
+>>> musterr [CLI] auth docker host --profile docker-test --workspace-id 111222333
+Error: --workspace-id is not supported for auth docker host. Select the workspace with --profile instead
+
+=== Credential helper not configured
+
+>>> [CLI] auth docker host --profile docker-test
+Registry host: [WORKSPACE_ID].container.us-west-2.localhost
+Credential helper configured: NO
+
+=== Invalid Docker config
+
+>>> musterr [CLI] auth docker host --profile docker-test
+Error: read Docker config [TEST_TMP_DIR]/home/docker/config.json: invalid character 'n' looking for beginning of object key string
+
+=== Default credential store without an installed helper
+
+>>> PATH=[TEST_TMP_DIR]/home [CLI] auth docker host --profile docker-test
+Registry host: [WORKSPACE_ID].container.us-west-2.localhost
+Credential helper configured: NO
+
+>>> PATH=[TEST_TMP_DIR]/home [CLI] auth docker host --profile docker-test --output json
+{
+  "host": "[WORKSPACE_ID].container.us-west-2.localhost",
+  "configured": false
+}
+
+=== Profiles unchanged
+Workspace ID not saved
diff --git a/acceptance/cmd/auth/docker/host/script b/acceptance/cmd/auth/docker/host/script
new file mode 100644
index 00000000000..576f6c4ffa6
--- /dev/null
+++ b/acceptance/cmd/auth/docker/host/script
@@ -0,0 +1,47 @@
+setup_docker_auth
+export DOCKER_CONFIG="$HOME/docker"
+
+title "Profile required\n"
+trace musterr $CLI auth docker host
+
+cat >> "$HOME/.databrickscfg" <<'ENDCFG'
+
+[account]
+host = https://accounts.cloud.databricks.test
+account_id = 00000000-0000-0000-0000-000000000000
+auth_type = databricks-cli
+
+[unsupported-host]
+host = https://workspace.example.test
+auth_type = databricks-cli
+ENDCFG
+cp "$HOME/.databrickscfg" "$HOME/databrickscfg.before"
+
+title "Workspace profile required\n"
+trace musterr $CLI auth docker host --profile account
+
+title "Unsupported workspace host\n"
+trace musterr $CLI auth docker host --profile unsupported-host
+
+title "Other authentication flags not supported\n"
+trace musterr $CLI auth docker host --profile docker-test --host https://other.cloud.databricks.test
+trace musterr $CLI auth docker host --profile docker-test --account-id 00000000-0000-0000-0000-000000000000
+trace musterr $CLI auth docker host --profile docker-test --workspace-id 111222333
+
+title "Credential helper not configured\n"
+trace $CLI auth docker host --profile docker-test
+assert_not_exists.py "$DOCKER_CONFIG/config.json"
+
+title "Invalid Docker config\n"
+mkdir -p "$DOCKER_CONFIG"
+cp invalid-docker-config.json "$DOCKER_CONFIG/config.json"
+trace musterr $CLI auth docker host --profile docker-test
+
+title "Default credential store without an installed helper\n"
+cp docker-config.json "$DOCKER_CONFIG/config.json"
+trace PATH="$HOME" $CLI auth docker host --profile docker-test
+trace PATH="$HOME" $CLI auth docker host --profile docker-test --output json
+
+title "Profiles unchanged\n"
+cmp "$HOME/databrickscfg.before" "$HOME/.databrickscfg"
+printf 'Workspace ID not saved\n'
diff --git a/acceptance/cmd/auth/docker/host/test.toml b/acceptance/cmd/auth/docker/host/test.toml
new file mode 100644
index 00000000000..12e9eb5e1bc
--- /dev/null
+++ b/acceptance/cmd/auth/docker/host/test.toml
@@ -0,0 +1,3 @@
+[[Repls]]
+Old = '\\home\\docker\\config\.json'
+New = '/home/docker/config.json'
diff --git a/acceptance/cmd/auth/docker/invalid-refresh-token/out.test.toml b/acceptance/cmd/auth/docker/invalid-refresh-token/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/auth/docker/invalid-refresh-token/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/auth/docker/invalid-refresh-token/output.txt b/acceptance/cmd/auth/docker/invalid-refresh-token/output.txt
new file mode 100644
index 00000000000..a206e114758
--- /dev/null
+++ b/acceptance/cmd/auth/docker/invalid-refresh-token/output.txt
@@ -0,0 +1,27 @@
+
+=== Unresolved workspace ID
+
+>>> musterr [CLI] auth docker host --profile docker-test
+Error: A new access token could not be retrieved because the refresh token is invalid. To reauthenticate, run the following command:
+  $ databricks auth login --profile docker-test
+
+>>> musterr [CLI] auth docker configure docker-test
+Error: A new access token could not be retrieved because the refresh token is invalid. To reauthenticate, run the following command:
+  $ databricks auth login --profile docker-test
+
+=== Stored workspace ID
+
+>>> musterr [CLI] auth docker host --profile docker-test
+Error: A new access token could not be retrieved because the refresh token is invalid. To reauthenticate, run the following command:
+  $ databricks auth login --profile docker-test
+
+>>> musterr [CLI] auth docker configure docker-test
+Error: A new access token could not be retrieved because the refresh token is invalid. To reauthenticate, run the following command:
+  $ databricks auth login --profile docker-test
+
+>>> musterr [CLI] auth docker token
+Error: A new access token could not be retrieved because the refresh token is invalid. To reauthenticate, run the following command:
+  $ databricks auth login --profile docker-test
+
+=== Docker config not created
+OK
diff --git a/acceptance/cmd/auth/docker/invalid-refresh-token/script b/acceptance/cmd/auth/docker/invalid-refresh-token/script
new file mode 100644
index 00000000000..ddbfcf8c015
--- /dev/null
+++ b/acceptance/cmd/auth/docker/invalid-refresh-token/script
@@ -0,0 +1,20 @@
+setup_docker_auth
+cp token-cache.json "$HOME/.databricks/token-cache.json"
+export DOCKER_CONFIG="$HOME/docker"
+
+title "Unresolved workspace ID\n"
+trace musterr $CLI auth docker host --profile docker-test
+trace musterr $CLI auth docker configure docker-test
+
+cat >> "$HOME/.databrickscfg" <<'ENDCFG'
+workspace_id = 900800700600
+ENDCFG
+
+title "Stored workspace ID\n"
+trace musterr $CLI auth docker host --profile docker-test
+trace musterr $CLI auth docker configure docker-test
+printf '%s\n' "900800700600.container.us-west-2.localhost" | trace musterr $CLI auth docker token
+
+title "Docker config not created\n"
+assert_not_exists.py "$DOCKER_CONFIG/config.json"
+printf 'OK\n'
diff --git a/acceptance/cmd/auth/docker/invalid-refresh-token/test.toml b/acceptance/cmd/auth/docker/invalid-refresh-token/test.toml
new file mode 100644
index 00000000000..95067d76b72
--- /dev/null
+++ b/acceptance/cmd/auth/docker/invalid-refresh-token/test.toml
@@ -0,0 +1,4 @@
+[[Server]]
+Pattern = "POST /oidc/v1/token"
+Response.StatusCode = 401
+Response.Body = '{"error": "invalid_request", "error_description": "Refresh token is invalid"}'
diff --git a/acceptance/cmd/auth/docker/invalid-refresh-token/token-cache.json b/acceptance/cmd/auth/docker/invalid-refresh-token/token-cache.json
new file mode 100644
index 00000000000..7ef0d1df3cc
--- /dev/null
+++ b/acceptance/cmd/auth/docker/invalid-refresh-token/token-cache.json
@@ -0,0 +1,11 @@
+{
+  "version": 1,
+  "tokens": {
+    "docker-test": {
+      "access_token": "expired-access-token",
+      "token_type": "Bearer",
+      "refresh_token": "test-refresh-token",
+      "expiry": "2000-01-01T00:00:00Z"
+    }
+  }
+}
diff --git a/acceptance/cmd/auth/docker/script.prepare b/acceptance/cmd/auth/docker/script.prepare
new file mode 100644
index 00000000000..4f9fa0aeaaa
--- /dev/null
+++ b/acceptance/cmd/auth/docker/script.prepare
@@ -0,0 +1,40 @@
+setup_docker_auth() {
+    export DATABRICKS_HOST_ORIG="$DATABRICKS_HOST"
+    sethome "./home"
+
+    unset DATABRICKS_ACCOUNT_ID
+    unset DATABRICKS_AUTH_TYPE
+    unset DATABRICKS_CLIENT_ID
+    unset DATABRICKS_CLIENT_SECRET
+    unset DATABRICKS_CONFIG_FILE
+    unset DATABRICKS_CONFIG_PROFILE
+    unset DATABRICKS_DISCOVERY_URL
+    unset DATABRICKS_HOST
+    unset DATABRICKS_TOKEN
+    unset DATABRICKS_WORKSPACE_ID
+
+    export DATABRICKS_AUTH_STORAGE=plaintext
+    export DATABRICKS_LOG_LEVEL=error
+
+    cat > "$HOME/.databrickscfg" <<ENDCFG
+[docker-test]
+host = $DATABRICKS_HOST_ORIG
+auth_type = databricks-cli
+ENDCFG
+
+    mkdir -p "$HOME/.databricks"
+    cp "$TESTDIR/../token-cache.json" "$HOME/.databricks/token-cache.json"
+}
+
+# configure installs docker-credential-databricks next to the running CLI, so run a copy outside the shared build directory.
+install_databricks_cli() {
+    mkdir -p "$HOME/bin"
+    if [[ "$OSTYPE" == "msys" || "$OSTYPE" == "cygwin" || "$OSTYPE" == "win32" ]]; then
+        cp "$(cygpath -u "$CLI")" "$HOME/bin/databricks.exe"
+        export PATH="$(cygpath -u "$HOME/bin"):$PATH"
+    else
+        cp "$CLI" "$HOME/bin/databricks"
+        chmod +x "$HOME/bin/databricks"
+        export PATH="$HOME/bin:$PATH"
+    fi
+}
diff --git a/acceptance/cmd/auth/docker/test.toml b/acceptance/cmd/auth/docker/test.toml
new file mode 100644
index 00000000000..bcc00b27390
--- /dev/null
+++ b/acceptance/cmd/auth/docker/test.toml
@@ -0,0 +1,5 @@
+Ignore = [
+    "home",
+]
+
+Timeout = "30s"
diff --git a/acceptance/cmd/auth/docker/token-cache.json b/acceptance/cmd/auth/docker/token-cache.json
new file mode 100644
index 00000000000..92aff621332
--- /dev/null
+++ b/acceptance/cmd/auth/docker/token-cache.json
@@ -0,0 +1,11 @@
+{
+  "version": 1,
+  "tokens": {
+    "docker-test": {
+      "access_token": "cached-access-token",
+      "token_type": "Bearer",
+      "refresh_token": "test-refresh-token",
+      "expiry": "2099-01-01T00:00:00Z"
+    }
+  }
+}
diff --git a/acceptance/cmd/auth/docker/token/out.test.toml b/acceptance/cmd/auth/docker/token/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/auth/docker/token/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/auth/docker/token/output.txt b/acceptance/cmd/auth/docker/token/output.txt
new file mode 100644
index 00000000000..28262b1f2fe
--- /dev/null
+++ b/acceptance/cmd/auth/docker/token/output.txt
@@ -0,0 +1,57 @@
+
+=== Cached token
+
+>>> [CLI] auth docker token --no-force-refresh
+{
+  "Secret": "cached-access-token",
+  "Username": "oauthtoken"
+}
+
+=== Refreshed token by default
+
+>>> [CLI] auth docker token
+{
+  "Secret": "oauth-token",
+  "Username": "oauthtoken"
+}
+
+=== No profile for the workspace
+
+>>> musterr [CLI] auth docker token
+Error: no Databricks profile found for workspace ID 111222333 from registry host 111222333.container.us-west-2.localhost. Run databricks auth login --host <workspace-url> and set workspace_id for that profile
+
+=== Not an Artifact Registry host
+
+>>> musterr [CLI] auth docker token
+Error: "registry.example.test" is not a Databricks Artifact Registry host
+
+=== Profile flag not supported
+
+>>> musterr [CLI] auth docker token --profile docker-test
+Error: auth docker token does not support --profile
+
+=== Positional argument not supported
+
+>>> musterr [CLI] auth docker token docker-test
+Error: auth docker token does not accept positional arguments
+
+=== Other authentication flags not supported
+
+>>> musterr [CLI] auth docker token --host https://other.cloud.databricks.test
+Error: auth docker token does not support --host
+
+>>> musterr [CLI] auth docker token --account-id [UUID]
+Error: auth docker token does not support --account-id
+
+>>> musterr [CLI] auth docker token --workspace-id 111222333
+Error: auth docker token does not support --workspace-id
+
+=== Test-server registry never matches a remote workspace
+
+>>> musterr [CLI] auth docker token
+Error: no Databricks profile found for workspace ID 444555666 from registry host 444555666.container.us-west-2.localhost. Run databricks auth login --host <workspace-url> and set workspace_id for that profile
+
+=== Multiple profiles for the workspace
+
+>>> musterr [CLI] auth docker token
+Error: multiple Databricks profiles match workspace ID [WORKSPACE_ID]: docker-test and duplicate. Remove duplicate workspace_id entries before using Docker credential helper
diff --git a/acceptance/cmd/auth/docker/token/script b/acceptance/cmd/auth/docker/token/script
new file mode 100644
index 00000000000..a272f6af120
--- /dev/null
+++ b/acceptance/cmd/auth/docker/token/script
@@ -0,0 +1,48 @@
+setup_docker_auth
+cat >> "$HOME/.databrickscfg" <<'ENDCFG'
+workspace_id = 900800700600
+ENDCFG
+registry_host=900800700600.container.us-west-2.localhost
+
+title "Cached token\n"
+printf '%s\n' "$registry_host" | trace $CLI auth docker token --no-force-refresh | jq -S .
+
+title "Refreshed token by default\n"
+printf '%s\n' "$registry_host" | trace $CLI auth docker token | jq -S .
+
+title "No profile for the workspace\n"
+printf '%s\n' "111222333.container.us-west-2.localhost" | trace musterr $CLI auth docker token
+
+title "Not an Artifact Registry host\n"
+printf '%s\n' "registry.example.test" | trace musterr $CLI auth docker token
+
+title "Profile flag not supported\n"
+printf '%s\n' "$registry_host" | trace musterr $CLI auth docker token --profile docker-test
+
+title "Positional argument not supported\n"
+printf '%s\n' "$registry_host" | trace musterr $CLI auth docker token docker-test
+
+title "Other authentication flags not supported\n"
+printf '%s\n' "$registry_host" | trace musterr $CLI auth docker token --host https://other.cloud.databricks.test
+printf '%s\n' "$registry_host" | trace musterr $CLI auth docker token --account-id 00000000-0000-0000-0000-000000000000
+printf '%s\n' "$registry_host" | trace musterr $CLI auth docker token --workspace-id 111222333
+
+title "Test-server registry never matches a remote workspace\n"
+cat >> "$HOME/.databrickscfg" <<'ENDCFG'
+
+[remote]
+host = https://workspace.cloud.databricks.test
+auth_type = databricks-cli
+workspace_id = 444555666
+ENDCFG
+printf '%s\n' "444555666.container.us-west-2.localhost" | trace musterr $CLI auth docker token
+
+title "Multiple profiles for the workspace\n"
+cat >> "$HOME/.databrickscfg" <<ENDCFG
+
+[duplicate]
+host = $DATABRICKS_HOST_ORIG
+auth_type = databricks-cli
+workspace_id = 900800700600
+ENDCFG
+printf '%s\n' "$registry_host" | trace musterr $CLI auth docker token
diff --git a/acceptance/cmd/auth/login/configure-serverless/home/.databrickscfg.tmpl b/acceptance/cmd/auth/login/configure-serverless/home/.databrickscfg.tmpl
new file mode 100644
index 00000000000..ecf29352dc2
--- /dev/null
+++ b/acceptance/cmd/auth/login/configure-serverless/home/.databrickscfg.tmpl
@@ -0,0 +1,3 @@
+[DEFAULT]
+host = $DATABRICKS_HOST
+cluster_id = existing-cluster-123
diff --git a/acceptance/cmd/auth/login/configure-serverless/out.databrickscfg b/acceptance/cmd/auth/login/configure-serverless/out.databrickscfg
index b095b683c97..aa7cc83ac1e 100644
--- a/acceptance/cmd/auth/login/configure-serverless/out.databrickscfg
+++ b/acceptance/cmd/auth/login/configure-serverless/out.databrickscfg
@@ -1,5 +1,5 @@
 [DEFAULT]
 host                  = [DATABRICKS_URL]
 serverless_compute_id = auto
-workspace_id          = [NUMID]
+workspace_id          = [WORKSPACE_ID]
 auth_type             = databricks-cli
diff --git a/acceptance/cmd/auth/login/configure-serverless/out.test.toml b/acceptance/cmd/auth/login/configure-serverless/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/auth/login/configure-serverless/out.test.toml
+++ b/acceptance/cmd/auth/login/configure-serverless/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/auth/login/configure-serverless/output.txt b/acceptance/cmd/auth/login/configure-serverless/output.txt
index bb29a75f698..439f2f63638 100644
--- a/acceptance/cmd/auth/login/configure-serverless/output.txt
+++ b/acceptance/cmd/auth/login/configure-serverless/output.txt
@@ -12,5 +12,5 @@ Profile DEFAULT was successfully saved
 [DEFAULT]
 host                  = [DATABRICKS_URL]
 serverless_compute_id = auto
-workspace_id          = [NUMID]
+workspace_id          = [WORKSPACE_ID]
 auth_type             = databricks-cli
diff --git a/acceptance/cmd/auth/login/configure-serverless/script b/acceptance/cmd/auth/login/configure-serverless/script
index ba7b2f4f0ce..b25c2b91f12 100644
--- a/acceptance/cmd/auth/login/configure-serverless/script
+++ b/acceptance/cmd/auth/login/configure-serverless/script
@@ -1,11 +1,7 @@
 sethome "./home"
 
-# Create an initial profile with cluster_id to be cleared out.
-cat > "./home/.databrickscfg" <<EOF
-[DEFAULT]
-host = $DATABRICKS_HOST
-cluster_id = existing-cluster-123
-EOF
+# Initial profile with cluster_id to be cleared out.
+envsubst < "./home/.databrickscfg.tmpl" > "./home/.databrickscfg"
 
 title "Initial profile with cluster_id\n"
 cat "./home/.databrickscfg"
diff --git a/acceptance/cmd/auth/login/custom-config-file/home/custom.databrickscfg b/acceptance/cmd/auth/login/custom-config-file/home/custom.databrickscfg
new file mode 100644
index 00000000000..2faa827d3ec
--- /dev/null
+++ b/acceptance/cmd/auth/login/custom-config-file/home/custom.databrickscfg
@@ -0,0 +1,4 @@
+[custom-test]
+host = https://old-host.cloud.databricks.com
+auth_type = pat
+token = old-token-123
diff --git a/acceptance/cmd/auth/login/custom-config-file/out.test.toml b/acceptance/cmd/auth/login/custom-config-file/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/auth/login/custom-config-file/out.test.toml
+++ b/acceptance/cmd/auth/login/custom-config-file/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/auth/login/custom-config-file/script b/acceptance/cmd/auth/login/custom-config-file/script
index 6e7aeb6c6a6..d253b4a3d8b 100644
--- a/acceptance/cmd/auth/login/custom-config-file/script
+++ b/acceptance/cmd/auth/login/custom-config-file/script
@@ -7,15 +7,8 @@ export BROWSER="browser.py"
 # Set custom config file location via env var
 export DATABRICKS_CONFIG_FILE="./home/custom.databrickscfg"
 
-# Create an existing custom config file with a DIFFERENT host.
-# Since --profile and --host conflict, the CLI should error.
-cat > "./home/custom.databrickscfg" <<EOF
-[custom-test]
-host = https://old-host.cloud.databricks.com
-auth_type = pat
-token = old-token-123
-EOF
-
+# home/custom.databrickscfg is a checked-in input: an existing custom config file
+# with a DIFFERENT host. Since --profile and --host conflict, the CLI should error.
 title "Initial custom config file (with old host)\n"
 cat "./home/custom.databrickscfg"
 
diff --git a/acceptance/cmd/auth/login/discovery/out.databrickscfg b/acceptance/cmd/auth/login/discovery/out.databrickscfg
index 56763df71ca..a88732b3057 100644
--- a/acceptance/cmd/auth/login/discovery/out.databrickscfg
+++ b/acceptance/cmd/auth/login/discovery/out.databrickscfg
@@ -4,7 +4,8 @@
 [discovery-test]
 host         = [DATABRICKS_URL]
 account_id   = test-account-123
-workspace_id = [NUMID]
+workspace_id = [WORKSPACE_ID]
+client_id    = discovery-client-id
 auth_type    = databricks-cli
 
 [__settings__]
diff --git a/acceptance/cmd/auth/login/discovery/out.test.toml b/acceptance/cmd/auth/login/discovery/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/auth/login/discovery/out.test.toml
+++ b/acceptance/cmd/auth/login/discovery/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/auth/login/discovery/output.txt b/acceptance/cmd/auth/login/discovery/output.txt
index c687b07fd5e..42e065b2b5b 100644
--- a/acceptance/cmd/auth/login/discovery/output.txt
+++ b/acceptance/cmd/auth/login/discovery/output.txt
@@ -1,5 +1,5 @@
 
->>> [CLI] auth login --profile discovery-test
+>>> [CLI] auth login --profile discovery-test --client-id discovery-client-id
 Opening login.databricks.com in your browser...
 Profile discovery-test was successfully saved
 
diff --git a/acceptance/cmd/auth/login/discovery/script b/acceptance/cmd/auth/login/discovery/script
index 4ae4c682d9e..43d3b92bc0a 100644
--- a/acceptance/cmd/auth/login/discovery/script
+++ b/acceptance/cmd/auth/login/discovery/script
@@ -2,8 +2,9 @@ sethome "./home"
 
 # Use the discovery browser script that simulates login.databricks.com
 export BROWSER="discovery_browser.py"
+export DATABRICKS_TEST_CLIENT_ID="discovery-client-id"
 
-trace $CLI auth login --profile discovery-test
+trace $CLI auth login --profile discovery-test --client-id discovery-client-id
 
 trace $CLI auth profiles
 
diff --git a/acceptance/cmd/auth/login/host-arg-overrides-profile/home/.databrickscfg b/acceptance/cmd/auth/login/host-arg-overrides-profile/home/.databrickscfg
new file mode 100644
index 00000000000..a7827502e48
--- /dev/null
+++ b/acceptance/cmd/auth/login/host-arg-overrides-profile/home/.databrickscfg
@@ -0,0 +1,2 @@
+[override-test]
+host = https://old-host.cloud.databricks.com
diff --git a/acceptance/cmd/auth/login/host-arg-overrides-profile/out.test.toml b/acceptance/cmd/auth/login/host-arg-overrides-profile/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/auth/login/host-arg-overrides-profile/out.test.toml
+++ b/acceptance/cmd/auth/login/host-arg-overrides-profile/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/auth/login/host-arg-overrides-profile/script b/acceptance/cmd/auth/login/host-arg-overrides-profile/script
index 107cc6dbeb1..44badb0d1c4 100644
--- a/acceptance/cmd/auth/login/host-arg-overrides-profile/script
+++ b/acceptance/cmd/auth/login/host-arg-overrides-profile/script
@@ -1,11 +1,6 @@
 sethome "./home"
 
-# Create an existing profile with a DIFFERENT host
-cat > "./home/.databrickscfg" <<EOF
-[override-test]
-host = https://old-host.cloud.databricks.com
-EOF
-
+# home/.databrickscfg is a checked-in input: an existing profile with a DIFFERENT host.
 title "Initial profile with old host\n"
 cat "./home/.databrickscfg"
 
diff --git a/acceptance/cmd/auth/login/host-from-profile/home/.databrickscfg.tmpl b/acceptance/cmd/auth/login/host-from-profile/home/.databrickscfg.tmpl
new file mode 100644
index 00000000000..e3c1b1e0eae
--- /dev/null
+++ b/acceptance/cmd/auth/login/host-from-profile/home/.databrickscfg.tmpl
@@ -0,0 +1,4 @@
+[existing-profile]
+host = $DATABRICKS_HOST
+auth_type = databricks-cli
+client_id = custom-client-id
diff --git a/acceptance/cmd/auth/login/host-from-profile/out.databrickscfg b/acceptance/cmd/auth/login/host-from-profile/out.databrickscfg
index 0c13bde2570..a94a2407cef 100644
--- a/acceptance/cmd/auth/login/host-from-profile/out.databrickscfg
+++ b/acceptance/cmd/auth/login/host-from-profile/out.databrickscfg
@@ -3,5 +3,6 @@
 
 [existing-profile]
 host         = [DATABRICKS_URL]
-workspace_id = [NUMID]
 auth_type    = databricks-cli
+workspace_id = [WORKSPACE_ID]
+client_id    = flag-client-id
diff --git a/acceptance/cmd/auth/login/host-from-profile/out.test.toml b/acceptance/cmd/auth/login/host-from-profile/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/auth/login/host-from-profile/out.test.toml
+++ b/acceptance/cmd/auth/login/host-from-profile/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/auth/login/host-from-profile/output.txt b/acceptance/cmd/auth/login/host-from-profile/output.txt
index 6faae38ae5c..9585b8cd388 100644
--- a/acceptance/cmd/auth/login/host-from-profile/output.txt
+++ b/acceptance/cmd/auth/login/host-from-profile/output.txt
@@ -2,16 +2,34 @@
 === Initial profile
 [existing-profile]
 host = [DATABRICKS_URL]
+auth_type = databricks-cli
+client_id = custom-client-id
 
 === Login with existing profile (no host argument)
 >>> [CLI] auth login --profile existing-profile
 Profile existing-profile was successfully saved
 
+=== OAuth client ID
+
+>>> print_requests.py //oidc/v1/authorize --get
+json.q.client_id = "custom-client-id";
+
+=== Login with a client ID override
+
+>>> [CLI] auth login --profile existing-profile --client-id flag-client-id
+Profile existing-profile was successfully saved
+
+=== Overridden OAuth client ID
+
+>>> print_requests.py //oidc/v1/authorize --get
+json.q.client_id = "flag-client-id";
+
 === Profile after login
 ; The profile defined in the DEFAULT section is to be used as a fallback when no profile is explicitly specified.
 [DEFAULT]
 
 [existing-profile]
 host         = [DATABRICKS_URL]
-workspace_id = [NUMID]
 auth_type    = databricks-cli
+workspace_id = [WORKSPACE_ID]
+client_id    = flag-client-id
diff --git a/acceptance/cmd/auth/login/host-from-profile/script b/acceptance/cmd/auth/login/host-from-profile/script
index 9f44e4a705e..c800d378fea 100644
--- a/acceptance/cmd/auth/login/host-from-profile/script
+++ b/acceptance/cmd/auth/login/host-from-profile/script
@@ -1,10 +1,7 @@
 sethome "./home"
 
-# Create an existing profile with a host
-cat > "./home/.databrickscfg" <<EOF
-[existing-profile]
-host = $DATABRICKS_HOST
-EOF
+# An existing profile with a host.
+envsubst < "./home/.databrickscfg.tmpl" > "./home/.databrickscfg"
 
 title "Initial profile\n"
 cat "./home/.databrickscfg"
@@ -17,6 +14,15 @@ export BROWSER="browser.py"
 title "Login with existing profile (no host argument)"
 trace $CLI auth login --profile existing-profile
 
+title "OAuth client ID\n"
+trace print_requests.py //oidc/v1/authorize --get | gron.py | grep client_id
+
+title "Login with a client ID override\n"
+trace $CLI auth login --profile existing-profile --client-id flag-client-id
+
+title "Overridden OAuth client ID\n"
+trace print_requests.py //oidc/v1/authorize --get | gron.py | grep client_id
+
 title "Profile after login\n"
 cat "./home/.databrickscfg"
 
diff --git a/acceptance/cmd/auth/login/host-from-profile/test.toml b/acceptance/cmd/auth/login/host-from-profile/test.toml
index 36c0e7e237b..84786fa60f0 100644
--- a/acceptance/cmd/auth/login/host-from-profile/test.toml
+++ b/acceptance/cmd/auth/login/host-from-profile/test.toml
@@ -1,3 +1,4 @@
 Ignore = [
     "home"
 ]
+RecordRequests = true
diff --git a/acceptance/cmd/auth/login/nominal/out.databrickscfg b/acceptance/cmd/auth/login/nominal/out.databrickscfg
index d94ee2221d5..cf14685849c 100644
--- a/acceptance/cmd/auth/login/nominal/out.databrickscfg
+++ b/acceptance/cmd/auth/login/nominal/out.databrickscfg
@@ -3,7 +3,7 @@
 
 [test]
 host         = [DATABRICKS_URL]
-workspace_id = [NUMID]
+workspace_id = [WORKSPACE_ID]
 auth_type    = databricks-cli
 
 [__settings__]
diff --git a/acceptance/cmd/auth/login/nominal/out.test.toml b/acceptance/cmd/auth/login/nominal/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/auth/login/nominal/out.test.toml
+++ b/acceptance/cmd/auth/login/nominal/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/auth/login/nominal/output.txt b/acceptance/cmd/auth/login/nominal/output.txt
index 4200636bc2d..f4cf56b2933 100644
--- a/acceptance/cmd/auth/login/nominal/output.txt
+++ b/acceptance/cmd/auth/login/nominal/output.txt
@@ -1,4 +1,9 @@
 
+>>> [CLI] auth login --host [DATABRICKS_URL]
+
+>>> [CLI] auth token --host [DATABRICKS_URL]
+json.access_token = "oauth-token";
+
 >>> [CLI] auth login --host [DATABRICKS_URL] --profile test
 Profile test was successfully saved
 
diff --git a/acceptance/cmd/auth/login/nominal/script b/acceptance/cmd/auth/login/nominal/script
index 814ff5876b0..d318d3d15ef 100644
--- a/acceptance/cmd/auth/login/nominal/script
+++ b/acceptance/cmd/auth/login/nominal/script
@@ -4,6 +4,12 @@ sethome "./home"
 # and follows the redirect back to localhost.
 export BROWSER="browser.py"
 
+# Without an explicit profile, non-interactive login stores the token under
+# the host key without creating a profile.
+trace $CLI auth login --host $DATABRICKS_HOST
+trace $CLI auth token --host $DATABRICKS_HOST | gron.py | grep access_token
+
+# With an explicit profile, login saves both the profile and its token.
 trace $CLI auth login --host $DATABRICKS_HOST --profile test
 trace $CLI auth profiles
 
diff --git a/acceptance/cmd/auth/login/preserve-fields/home/.databrickscfg.tmpl b/acceptance/cmd/auth/login/preserve-fields/home/.databrickscfg.tmpl
new file mode 100644
index 00000000000..11c38a350b4
--- /dev/null
+++ b/acceptance/cmd/auth/login/preserve-fields/home/.databrickscfg.tmpl
@@ -0,0 +1,6 @@
+[DEFAULT]
+host = $DATABRICKS_HOST
+cluster_id = existing-cluster-123
+warehouse_id = warehouse-456
+azure_environment = USGOVERNMENT
+custom_key = my-custom-value
diff --git a/acceptance/cmd/auth/login/preserve-fields/out.test.toml b/acceptance/cmd/auth/login/preserve-fields/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/auth/login/preserve-fields/out.test.toml
+++ b/acceptance/cmd/auth/login/preserve-fields/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/auth/login/preserve-fields/output.txt b/acceptance/cmd/auth/login/preserve-fields/output.txt
index 28c0ed56608..2e8cd590fc0 100644
--- a/acceptance/cmd/auth/login/preserve-fields/output.txt
+++ b/acceptance/cmd/auth/login/preserve-fields/output.txt
@@ -18,5 +18,5 @@ cluster_id        = existing-cluster-123
 warehouse_id      = warehouse-456
 azure_environment = USGOVERNMENT
 custom_key        = my-custom-value
-workspace_id      = [NUMID]
+workspace_id      = [WORKSPACE_ID]
 auth_type         = databricks-cli
diff --git a/acceptance/cmd/auth/login/preserve-fields/script b/acceptance/cmd/auth/login/preserve-fields/script
index 6b34f7db608..b416038a3e3 100644
--- a/acceptance/cmd/auth/login/preserve-fields/script
+++ b/acceptance/cmd/auth/login/preserve-fields/script
@@ -1,15 +1,8 @@
 sethome "./home"
 
-# Create an initial profile with cluster_id, warehouse_id, azure_environment,
-# and a custom key that is not a recognized SDK config attribute.
-cat > "./home/.databrickscfg" <<EOF
-[DEFAULT]
-host = $DATABRICKS_HOST
-cluster_id = existing-cluster-123
-warehouse_id = warehouse-456
-azure_environment = USGOVERNMENT
-custom_key = my-custom-value
-EOF
+# Initial profile with cluster_id, warehouse_id, azure_environment, and a custom
+# key that is not a recognized SDK config attribute.
+envsubst < "./home/.databrickscfg.tmpl" > "./home/.databrickscfg"
 
 title "Initial profile\n"
 cat "./home/.databrickscfg"
diff --git a/acceptance/cmd/auth/login/timeout/out.test.toml b/acceptance/cmd/auth/login/timeout/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/auth/login/timeout/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/auth/login/timeout/output.txt b/acceptance/cmd/auth/login/timeout/output.txt
new file mode 100644
index 00000000000..07b20caaa9b
--- /dev/null
+++ b/acceptance/cmd/auth/login/timeout/output.txt
@@ -0,0 +1,3 @@
+
+>>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --timeout 1s
+Error: authorize: context deadline exceeded
diff --git a/acceptance/cmd/auth/login/timeout/script b/acceptance/cmd/auth/login/timeout/script
new file mode 100644
index 00000000000..bbe57b6c03c
--- /dev/null
+++ b/acceptance/cmd/auth/login/timeout/script
@@ -0,0 +1,7 @@
+sethome "./home"
+
+# Use a fake browser that prints the authorization URL and never completes the
+# redirect, so only --timeout ends the login. The URL changes on every run.
+export BROWSER="echo_browser.py"
+
+trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --timeout 1s > /dev/null
diff --git a/acceptance/cmd/auth/login/timeout/test.toml b/acceptance/cmd/auth/login/timeout/test.toml
new file mode 100644
index 00000000000..36c0e7e237b
--- /dev/null
+++ b/acceptance/cmd/auth/login/timeout/test.toml
@@ -0,0 +1,3 @@
+Ignore = [
+    "home"
+]
diff --git a/acceptance/cmd/auth/login/with-scopes/out.databrickscfg b/acceptance/cmd/auth/login/with-scopes/out.databrickscfg
index c8af1832d70..be136f325dc 100644
--- a/acceptance/cmd/auth/login/with-scopes/out.databrickscfg
+++ b/acceptance/cmd/auth/login/with-scopes/out.databrickscfg
@@ -3,7 +3,7 @@
 
 [scoped-test]
 host         = [DATABRICKS_URL]
-workspace_id = [NUMID]
+workspace_id = [WORKSPACE_ID]
 scopes       = jobs,pipelines,clusters
 auth_type    = databricks-cli
 
diff --git a/acceptance/cmd/auth/login/with-scopes/out.test.toml b/acceptance/cmd/auth/login/with-scopes/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/auth/login/with-scopes/out.test.toml
+++ b/acceptance/cmd/auth/login/with-scopes/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/auth/logout/default-profile/home/.databrickscfg.tmpl b/acceptance/cmd/auth/logout/default-profile/home/.databrickscfg.tmpl
new file mode 100644
index 00000000000..ea78d6a0f6e
--- /dev/null
+++ b/acceptance/cmd/auth/logout/default-profile/home/.databrickscfg.tmpl
@@ -0,0 +1,9 @@
+; The profile defined in the DEFAULT section is to be used as a fallback when no profile is explicitly specified.
+[DEFAULT]
+host = ${DATABRICKS_HOST}
+auth_type = databricks-cli
+
+; Dev workspace
+[dev]
+host = ${DATABRICKS_HOST}
+auth_type = databricks-cli
diff --git a/acceptance/cmd/auth/logout/default-profile/out.test.toml b/acceptance/cmd/auth/logout/default-profile/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/auth/logout/default-profile/out.test.toml
+++ b/acceptance/cmd/auth/logout/default-profile/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/auth/logout/default-profile/script b/acceptance/cmd/auth/logout/default-profile/script
index be3e3dd4399..367175b945f 100644
--- a/acceptance/cmd/auth/logout/default-profile/script
+++ b/acceptance/cmd/auth/logout/default-profile/script
@@ -1,16 +1,6 @@
 sethome "./home"
 
-cat > "./home/.databrickscfg" <<EOF
-; The profile defined in the DEFAULT section is to be used as a fallback when no profile is explicitly specified.
-[DEFAULT]
-host = ${DATABRICKS_HOST}
-auth_type = databricks-cli
-
-; Dev workspace
-[dev]
-host = ${DATABRICKS_HOST}
-auth_type = databricks-cli
-EOF
+envsubst < "./home/.databrickscfg.tmpl" > "./home/.databrickscfg"
 
 title "Initial config\n"
 cat "./home/.databrickscfg"
diff --git a/acceptance/cmd/auth/logout/delete-clears-default/home/.databrickscfg b/acceptance/cmd/auth/logout/delete-clears-default/home/.databrickscfg
new file mode 100644
index 00000000000..ce8fdd61fee
--- /dev/null
+++ b/acceptance/cmd/auth/logout/delete-clears-default/home/.databrickscfg
@@ -0,0 +1,15 @@
+; The profile defined in the DEFAULT section is to be used as a fallback when no profile is explicitly specified.
+[DEFAULT]
+
+[workspace-a]
+host      = https://workspace-a.cloud.databricks.com
+token     = token-a
+auth_type = pat
+
+[workspace-b]
+host      = https://workspace-b.cloud.databricks.com
+token     = token-b
+auth_type = pat
+
+[__settings__]
+default_profile = workspace-a
diff --git a/acceptance/cmd/auth/logout/delete-clears-default/out.test.toml b/acceptance/cmd/auth/logout/delete-clears-default/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/auth/logout/delete-clears-default/out.test.toml
+++ b/acceptance/cmd/auth/logout/delete-clears-default/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/auth/logout/delete-clears-default/script b/acceptance/cmd/auth/logout/delete-clears-default/script
index a0c86f1dfc8..2028390f4ad 100644
--- a/acceptance/cmd/auth/logout/delete-clears-default/script
+++ b/acceptance/cmd/auth/logout/delete-clears-default/script
@@ -1,23 +1,5 @@
 sethome "./home"
 
-cat > "./home/.databrickscfg" <<'EOF'
-; The profile defined in the DEFAULT section is to be used as a fallback when no profile is explicitly specified.
-[DEFAULT]
-
-[workspace-a]
-host      = https://workspace-a.cloud.databricks.com
-token     = token-a
-auth_type = pat
-
-[workspace-b]
-host      = https://workspace-b.cloud.databricks.com
-token     = token-b
-auth_type = pat
-
-[__settings__]
-default_profile = workspace-a
-EOF
-
 title "Initial settings section\n"
 cat "./home/.databrickscfg" | grep -A1 __settings__
 
diff --git a/acceptance/cmd/auth/logout/delete-pat-token-profile/home/.databrickscfg b/acceptance/cmd/auth/logout/delete-pat-token-profile/home/.databrickscfg
new file mode 100644
index 00000000000..d4e4eb2c7f9
--- /dev/null
+++ b/acceptance/cmd/auth/logout/delete-pat-token-profile/home/.databrickscfg
@@ -0,0 +1,6 @@
+; The profile defined in the DEFAULT section is to be used as a fallback when no profile is explicitly specified.
+[DEFAULT]
+
+[dev]
+host = https://dev.cloud.databricks.com
+token = dev-pat-token
diff --git a/acceptance/cmd/auth/logout/delete-pat-token-profile/out.test.toml b/acceptance/cmd/auth/logout/delete-pat-token-profile/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/auth/logout/delete-pat-token-profile/out.test.toml
+++ b/acceptance/cmd/auth/logout/delete-pat-token-profile/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/auth/logout/delete-pat-token-profile/script b/acceptance/cmd/auth/logout/delete-pat-token-profile/script
index 4bf9f9cdf16..fbd2bc18b66 100644
--- a/acceptance/cmd/auth/logout/delete-pat-token-profile/script
+++ b/acceptance/cmd/auth/logout/delete-pat-token-profile/script
@@ -1,14 +1,5 @@
 sethome "./home"
 
-cat > "./home/.databrickscfg" <<'EOF'
-; The profile defined in the DEFAULT section is to be used as a fallback when no profile is explicitly specified.
-[DEFAULT]
-
-[dev]
-host = https://dev.cloud.databricks.com
-token = dev-pat-token
-EOF
-
 title "Initial config\n"
 cat "./home/.databrickscfg"
 
diff --git a/acceptance/cmd/auth/logout/error-cases/home/.databrickscfg b/acceptance/cmd/auth/logout/error-cases/home/.databrickscfg
new file mode 100644
index 00000000000..0396f79861e
--- /dev/null
+++ b/acceptance/cmd/auth/logout/error-cases/home/.databrickscfg
@@ -0,0 +1,6 @@
+; The profile defined in the DEFAULT section is to be used as a fallback when no profile is explicitly specified.
+[DEFAULT]
+
+[dev]
+host = https://dev.cloud.databricks.com
+auth_type = databricks-cli
diff --git a/acceptance/cmd/auth/logout/error-cases/out.test.toml b/acceptance/cmd/auth/logout/error-cases/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/auth/logout/error-cases/out.test.toml
+++ b/acceptance/cmd/auth/logout/error-cases/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/auth/logout/error-cases/output.txt b/acceptance/cmd/auth/logout/error-cases/output.txt
index b61328b5d11..3d00fa795d8 100644
--- a/acceptance/cmd/auth/logout/error-cases/output.txt
+++ b/acceptance/cmd/auth/logout/error-cases/output.txt
@@ -2,9 +2,5 @@
 === Logout of non-existent profile
 Error: profile "nonexistent" not found. Available profiles: dev
 
-Exit code: 1
-
 === Logout without --profile in non-interactive mode
 Error: the command is being run in a non-interactive environment, please specify a profile using the PROFILE argument or --profile flag
-
-Exit code: 1
diff --git a/acceptance/cmd/auth/logout/error-cases/script b/acceptance/cmd/auth/logout/error-cases/script
index 603a5ecec73..08803a732f1 100644
--- a/acceptance/cmd/auth/logout/error-cases/script
+++ b/acceptance/cmd/auth/logout/error-cases/script
@@ -1,16 +1,7 @@
 sethome "./home"
 
-cat > "./home/.databrickscfg" <<'EOF'
-; The profile defined in the DEFAULT section is to be used as a fallback when no profile is explicitly specified.
-[DEFAULT]
-
-[dev]
-host = https://dev.cloud.databricks.com
-auth_type = databricks-cli
-EOF
-
 title "Logout of non-existent profile\n"
-errcode $CLI auth logout --profile nonexistent --auto-approve
+musterr $CLI auth logout --profile nonexistent --auto-approve
 
 title "Logout without --profile in non-interactive mode\n"
-errcode $CLI auth logout --auto-approve
+musterr $CLI auth logout --auto-approve
diff --git a/acceptance/cmd/auth/logout/last-non-default/home/.databrickscfg.tmpl b/acceptance/cmd/auth/logout/last-non-default/home/.databrickscfg.tmpl
new file mode 100644
index 00000000000..5b61c3907bc
--- /dev/null
+++ b/acceptance/cmd/auth/logout/last-non-default/home/.databrickscfg.tmpl
@@ -0,0 +1,7 @@
+; The profile defined in the DEFAULT section is to be used as a fallback when no profile is explicitly specified.
+[DEFAULT]
+
+; The only non-default profile
+[only-profile]
+host = ${DATABRICKS_HOST}
+auth_type = databricks-cli
diff --git a/acceptance/cmd/auth/logout/last-non-default/out.test.toml b/acceptance/cmd/auth/logout/last-non-default/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/auth/logout/last-non-default/out.test.toml
+++ b/acceptance/cmd/auth/logout/last-non-default/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/auth/logout/last-non-default/script b/acceptance/cmd/auth/logout/last-non-default/script
index 24998e2ec30..d95069a5552 100644
--- a/acceptance/cmd/auth/logout/last-non-default/script
+++ b/acceptance/cmd/auth/logout/last-non-default/script
@@ -1,14 +1,6 @@
 sethome "./home"
 
-cat > "./home/.databrickscfg" <<EOF
-; The profile defined in the DEFAULT section is to be used as a fallback when no profile is explicitly specified.
-[DEFAULT]
-
-; The only non-default profile
-[only-profile]
-host = ${DATABRICKS_HOST}
-auth_type = databricks-cli
-EOF
+envsubst < "./home/.databrickscfg.tmpl" > "./home/.databrickscfg"
 
 title "Initial config\n"
 cat "./home/.databrickscfg"
diff --git a/acceptance/cmd/auth/logout/ordering-preserved/home/.databrickscfg.tmpl b/acceptance/cmd/auth/logout/ordering-preserved/home/.databrickscfg.tmpl
new file mode 100644
index 00000000000..7ab8fe47f93
--- /dev/null
+++ b/acceptance/cmd/auth/logout/ordering-preserved/home/.databrickscfg.tmpl
@@ -0,0 +1,20 @@
+; The profile defined in the DEFAULT section is to be used as a fallback when no profile is explicitly specified.
+[DEFAULT]
+host = ${DATABRICKS_HOST}
+auth_type = databricks-cli
+
+; First workspace — alpha
+[alpha]
+host = ${DATABRICKS_HOST}
+auth_type = databricks-cli
+
+; Second workspace — beta
+[beta]
+host = ${DATABRICKS_HOST}
+auth_type = databricks-cli
+
+; Third workspace — gamma
+[gamma]
+host = https://accounts.cloud.databricks.test
+account_id = account-id
+auth_type  = databricks-cli
diff --git a/acceptance/cmd/auth/logout/ordering-preserved/out.test.toml b/acceptance/cmd/auth/logout/ordering-preserved/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/auth/logout/ordering-preserved/out.test.toml
+++ b/acceptance/cmd/auth/logout/ordering-preserved/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/auth/logout/ordering-preserved/output.txt b/acceptance/cmd/auth/logout/ordering-preserved/output.txt
index 127ad46c606..295451562ac 100644
--- a/acceptance/cmd/auth/logout/ordering-preserved/output.txt
+++ b/acceptance/cmd/auth/logout/ordering-preserved/output.txt
@@ -17,7 +17,7 @@ auth_type = databricks-cli
 
 ; Third workspace — gamma
 [gamma]
-host = https://accounts.cloud.databricks.com
+host = https://accounts.cloud.databricks.test
 account_id = account-id
 auth_type  = databricks-cli
 
@@ -41,12 +41,13 @@ auth_type = databricks-cli
 
 ; Third workspace — gamma
 [gamma]
-host       = https://accounts.cloud.databricks.com
+host       = https://accounts.cloud.databricks.test
 account_id = account-id
 auth_type  = databricks-cli
 
 === Delete last profile (gamma)
 >>> [CLI] auth logout --profile gamma --auto-approve --delete
+Warn: [hostmetadata] failed to fetch host metadata for https://accounts.cloud.databricks.test, will skip for 1m0s
 Logged out of and deleted profile "gamma".
 
 === Config after deleting gamma
diff --git a/acceptance/cmd/auth/logout/ordering-preserved/script b/acceptance/cmd/auth/logout/ordering-preserved/script
index a6273de75b7..168657a373c 100644
--- a/acceptance/cmd/auth/logout/ordering-preserved/script
+++ b/acceptance/cmd/auth/logout/ordering-preserved/script
@@ -1,27 +1,6 @@
 sethome "./home"
 
-cat > "./home/.databrickscfg" <<EOF
-; The profile defined in the DEFAULT section is to be used as a fallback when no profile is explicitly specified.
-[DEFAULT]
-host = ${DATABRICKS_HOST}
-auth_type = databricks-cli
-
-; First workspace — alpha
-[alpha]
-host = ${DATABRICKS_HOST}
-auth_type = databricks-cli
-
-; Second workspace — beta
-[beta]
-host = ${DATABRICKS_HOST}
-auth_type = databricks-cli
-
-; Third workspace — gamma
-[gamma]
-host = https://accounts.cloud.databricks.com
-account_id = account-id
-auth_type  = databricks-cli
-EOF
+envsubst < "./home/.databrickscfg.tmpl" > "./home/.databrickscfg"
 
 title "Initial config\n"
 cat "./home/.databrickscfg"
diff --git a/acceptance/cmd/auth/logout/stale-account-id-workspace-host/out.test.toml b/acceptance/cmd/auth/logout/stale-account-id-workspace-host/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/auth/logout/stale-account-id-workspace-host/out.test.toml
+++ b/acceptance/cmd/auth/logout/stale-account-id-workspace-host/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/auth/logout/stale-account-id-workspace-host/output.txt b/acceptance/cmd/auth/logout/stale-account-id-workspace-host/output.txt
index 29c2d40709e..8c3218ad06e 100644
--- a/acceptance/cmd/auth/logout/stale-account-id-workspace-host/output.txt
+++ b/acceptance/cmd/auth/logout/stale-account-id-workspace-host/output.txt
@@ -36,4 +36,4 @@ logfood (Default)  [DATABRICKS_URL]  NO
 
 === Logged out profile should no longer return a token
 >>> musterr [CLI] auth token --profile logfood
-Error: cache: databricks OAuth is not configured for this host. Try logging in again with `databricks auth login --profile logfood` before retrying. If this fails, please report this issue to the Databricks CLI maintainers at https://github.com/databricks/cli/issues/new
+Error: cache: databricks OAuth is not configured for this host. no cached credentials; run `databricks auth login` to sign in
diff --git a/acceptance/cmd/auth/logout/token-only-shared-host/out.test.toml b/acceptance/cmd/auth/logout/token-only-shared-host/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/auth/logout/token-only-shared-host/out.test.toml
+++ b/acceptance/cmd/auth/logout/token-only-shared-host/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/auth/logout/token-only/home/.databricks/token-cache.json b/acceptance/cmd/auth/logout/token-only/home/.databricks/token-cache.json
new file mode 100644
index 00000000000..a5c3b38b362
--- /dev/null
+++ b/acceptance/cmd/auth/logout/token-only/home/.databricks/token-cache.json
@@ -0,0 +1,13 @@
+{
+  "version": 1,
+  "tokens": {
+    "dev": {
+      "access_token": "dev-cached-token",
+      "token_type": "Bearer"
+    },
+    "https://accounts.cloud.databricks.test/oidc/accounts/account-id": {
+      "access_token": "dev-host-token",
+      "token_type": "Bearer"
+    }
+  }
+}
diff --git a/acceptance/cmd/auth/logout/token-only/home/.databrickscfg b/acceptance/cmd/auth/logout/token-only/home/.databrickscfg
new file mode 100644
index 00000000000..80d94b04e99
--- /dev/null
+++ b/acceptance/cmd/auth/logout/token-only/home/.databrickscfg
@@ -0,0 +1,7 @@
+; The profile defined in the DEFAULT section is to be used as a fallback when no profile is explicitly specified.
+[DEFAULT]
+
+[dev]
+host = https://accounts.cloud.databricks.test
+account_id = account-id
+auth_type  = databricks-cli
diff --git a/acceptance/cmd/auth/logout/token-only/out.test.toml b/acceptance/cmd/auth/logout/token-only/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/auth/logout/token-only/out.test.toml
+++ b/acceptance/cmd/auth/logout/token-only/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/auth/logout/token-only/output.txt b/acceptance/cmd/auth/logout/token-only/output.txt
index afaf11b3d70..6abf6c84c3d 100644
--- a/acceptance/cmd/auth/logout/token-only/output.txt
+++ b/acceptance/cmd/auth/logout/token-only/output.txt
@@ -2,11 +2,12 @@
 === Token cache keys before logout
 [
   "dev",
-  "https://accounts.cloud.databricks.com/oidc/accounts/account-id"
+  "https://accounts.cloud.databricks.test/oidc/accounts/account-id"
 ]
 
 === Logout without --delete
 >>> [CLI] auth logout --profile dev --auto-approve
+Warn: [hostmetadata] failed to fetch host metadata for https://accounts.cloud.databricks.test, will skip for 1m0s
 Logged out of profile "dev". Use --delete to also remove it from the config file.
 
 === Config after logout — profile should still exist
@@ -14,7 +15,7 @@ Logged out of profile "dev". Use --delete to also remove it from the config file
 [DEFAULT]
 
 [dev]
-host = https://accounts.cloud.databricks.com
+host = https://accounts.cloud.databricks.test
 account_id = account-id
 auth_type  = databricks-cli
 
diff --git a/acceptance/cmd/auth/logout/token-only/script b/acceptance/cmd/auth/logout/token-only/script
index a72d3657a48..bce46a7986b 100644
--- a/acceptance/cmd/auth/logout/token-only/script
+++ b/acceptance/cmd/auth/logout/token-only/script
@@ -1,32 +1,6 @@
 sethome "./home"
 
-cat > "./home/.databrickscfg" <<'EOF'
-; The profile defined in the DEFAULT section is to be used as a fallback when no profile is explicitly specified.
-[DEFAULT]
-
-[dev]
-host = https://accounts.cloud.databricks.com
-account_id = account-id
-auth_type  = databricks-cli
-EOF
-
-mkdir -p "./home/.databricks"
-cat > "./home/.databricks/token-cache.json" <<'EOF'
-{
-  "version": 1,
-  "tokens": {
-    "dev": {
-      "access_token": "dev-cached-token",
-      "token_type": "Bearer"
-    },
-    "https://accounts.cloud.databricks.com/oidc/accounts/account-id": {
-      "access_token": "dev-host-token",
-      "token_type": "Bearer"
-    }
-  }
-}
-EOF
-
+# home/.databrickscfg and home/.databricks/token-cache.json are checked-in inputs.
 title "Token cache keys before logout\n"
 jq -S '.tokens | keys' "./home/.databricks/token-cache.json"
 
diff --git a/acceptance/cmd/auth/profiles/home/.databrickscfg b/acceptance/cmd/auth/profiles/home/.databrickscfg
new file mode 100644
index 00000000000..fd4eb90339a
--- /dev/null
+++ b/acceptance/cmd/auth/profiles/home/.databrickscfg
@@ -0,0 +1,12 @@
+[workspace-profile]
+host = https://workspace.cloud.databricks.test
+
+[account-profile]
+host = https://accounts.cloud.databricks.test
+account_id = test-account-123
+
+[unified-profile]
+host = https://unified.databricks.test
+account_id = unified-account-456
+workspace_id = 987654321
+experimental_is_unified_host = true
diff --git a/acceptance/cmd/auth/profiles/out.test.toml b/acceptance/cmd/auth/profiles/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/auth/profiles/out.test.toml
+++ b/acceptance/cmd/auth/profiles/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/auth/profiles/output.txt b/acceptance/cmd/auth/profiles/output.txt
index c2d5f743f43..df472a2fd5e 100644
--- a/acceptance/cmd/auth/profiles/output.txt
+++ b/acceptance/cmd/auth/profiles/output.txt
@@ -1,18 +1,17 @@
 
 === Profiles with workspace_id (JSON output)
-Warn: [hostmetadata] failed to fetch host metadata for https://test.cloud.databricks.com, will skip for 1m0s
 {
   "profiles": [
     {
       "name": "workspace-profile",
-      "host": "https://test.cloud.databricks.com",
+      "host": "https://workspace.cloud.databricks.test",
       "cloud": "aws",
       "auth_type": "",
       "valid": false
     },
     {
       "name": "account-profile",
-      "host": "https://accounts.cloud.databricks.com",
+      "host": "https://accounts.cloud.databricks.test",
       "account_id": "test-account-123",
       "cloud": "aws",
       "auth_type": "",
@@ -20,9 +19,9 @@ Warn: [hostmetadata] failed to fetch host metadata for https://test.cloud.databr
     },
     {
       "name": "unified-profile",
-      "host": "https://unified.databricks.com",
+      "host": "https://unified.databricks.test",
       "account_id": "unified-account-456",
-      "workspace_id": "[NUMID]",
+      "workspace_id": "987654321",
       "cloud": "aws",
       "auth_type": "",
       "valid": false
diff --git a/acceptance/cmd/auth/profiles/script b/acceptance/cmd/auth/profiles/script
index 3decb74bb0d..d8342212d37 100644
--- a/acceptance/cmd/auth/profiles/script
+++ b/acceptance/cmd/auth/profiles/script
@@ -1,20 +1,5 @@
 sethome "./home"
 
-# Create profiles including one with workspace_id
-cat > "./home/.databrickscfg" <<EOF
-[workspace-profile]
-host = https://test.cloud.databricks.com
-
-[account-profile]
-host = https://accounts.cloud.databricks.com
-account_id = test-account-123
-
-[unified-profile]
-host = https://unified.databricks.com
-account_id = unified-account-456
-workspace_id = 987654321
-experimental_is_unified_host = true
-EOF
-
+# home/.databrickscfg is a checked-in input with profiles including one with workspace_id.
 title "Profiles with workspace_id (JSON output)\n"
 $CLI auth profiles --skip-validate --output json
diff --git a/acceptance/cmd/auth/profiles/spog-account/home/.databrickscfg.tmpl b/acceptance/cmd/auth/profiles/spog-account/home/.databrickscfg.tmpl
new file mode 100644
index 00000000000..7d3126e99ba
--- /dev/null
+++ b/acceptance/cmd/auth/profiles/spog-account/home/.databrickscfg.tmpl
@@ -0,0 +1,5 @@
+[spog-account]
+host = ${DATABRICKS_HOST}
+account_id = spog-acct-123
+workspace_id = none
+token = test-token
diff --git a/acceptance/cmd/auth/profiles/spog-account/out.test.toml b/acceptance/cmd/auth/profiles/spog-account/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/auth/profiles/spog-account/out.test.toml
+++ b/acceptance/cmd/auth/profiles/spog-account/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/auth/profiles/spog-account/script b/acceptance/cmd/auth/profiles/spog-account/script
index 64285ad0ec4..6a747a8b315 100644
--- a/acceptance/cmd/auth/profiles/spog-account/script
+++ b/acceptance/cmd/auth/profiles/spog-account/script
@@ -1,15 +1,9 @@
 sethome "./home"
 
-# Create a SPOG account profile: non-accounts.* host with account_id, no workspace_id.
+# A SPOG account profile: non-accounts.* host with account_id, no workspace_id.
 # Before the fix, this was misclassified as WorkspaceConfig and validated with
 # CurrentUser.Me, which fails on account-scoped SPOG hosts.
-cat > "./home/.databrickscfg" <<EOF
-[spog-account]
-host = ${DATABRICKS_HOST}
-account_id = spog-acct-123
-workspace_id = none
-token = test-token
-EOF
+envsubst < "./home/.databrickscfg.tmpl" > "./home/.databrickscfg"
 
 title "SPOG account profile should be valid"
 trace $CLI auth profiles --output json
diff --git a/acceptance/cmd/auth/storage-modes/env-overrides-config/home/.databricks/token-cache.json b/acceptance/cmd/auth/storage-modes/env-overrides-config/home/.databricks/token-cache.json
new file mode 100644
index 00000000000..1f7a28c3caa
--- /dev/null
+++ b/acceptance/cmd/auth/storage-modes/env-overrides-config/home/.databricks/token-cache.json
@@ -0,0 +1,9 @@
+{
+  "version": 1,
+  "tokens": {
+    "dev": {
+      "access_token": "dev-cached-token",
+      "token_type": "Bearer"
+    }
+  }
+}
diff --git a/acceptance/cmd/auth/storage-modes/env-overrides-config/home/.databrickscfg b/acceptance/cmd/auth/storage-modes/env-overrides-config/home/.databrickscfg
new file mode 100644
index 00000000000..bc32b642d64
--- /dev/null
+++ b/acceptance/cmd/auth/storage-modes/env-overrides-config/home/.databrickscfg
@@ -0,0 +1,7 @@
+[__settings__]
+auth_storage = secure
+
+[dev]
+host = https://accounts.cloud.databricks.test
+account_id = account-id
+auth_type  = databricks-cli
diff --git a/acceptance/cmd/auth/storage-modes/env-overrides-config/out.test.toml b/acceptance/cmd/auth/storage-modes/env-overrides-config/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/auth/storage-modes/env-overrides-config/out.test.toml
+++ b/acceptance/cmd/auth/storage-modes/env-overrides-config/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/auth/storage-modes/env-overrides-config/output.txt b/acceptance/cmd/auth/storage-modes/env-overrides-config/output.txt
index 8994c41ebbb..f0b9d0f93ad 100644
--- a/acceptance/cmd/auth/storage-modes/env-overrides-config/output.txt
+++ b/acceptance/cmd/auth/storage-modes/env-overrides-config/output.txt
@@ -5,6 +5,7 @@
 ]
 
 >>> [CLI] auth logout --profile dev --auto-approve
+Warn: [hostmetadata] failed to fetch host metadata for https://accounts.cloud.databricks.test, will skip for 1m0s
 Logged out of profile "dev". Use --delete to also remove it from the config file.
 
 === Token cache keys after logout (should be empty)
diff --git a/acceptance/cmd/auth/storage-modes/env-overrides-config/script b/acceptance/cmd/auth/storage-modes/env-overrides-config/script
index a698ab96b2e..ddab417910d 100644
--- a/acceptance/cmd/auth/storage-modes/env-overrides-config/script
+++ b/acceptance/cmd/auth/storage-modes/env-overrides-config/script
@@ -1,28 +1,7 @@
 export DATABRICKS_AUTH_STORAGE=plaintext
 
-cat > "./home/.databrickscfg" <<ENDCFG
-[__settings__]
-auth_storage = secure
-
-[dev]
-host = https://accounts.cloud.databricks.com
-account_id = account-id
-auth_type  = databricks-cli
-ENDCFG
-
-mkdir -p "./home/.databricks"
-cat > "./home/.databricks/token-cache.json" <<ENDCACHE
-{
-  "version": 1,
-  "tokens": {
-    "dev": {
-      "access_token": "dev-cached-token",
-      "token_type": "Bearer"
-    }
-  }
-}
-ENDCACHE
-
+# home/.databrickscfg ([__settings__] auth_storage = secure) and
+# home/.databricks/token-cache.json are checked-in inputs.
 title "Token cache keys before logout\n"
 jq -S '.tokens | keys' "./home/.databricks/token-cache.json"
 
diff --git a/acceptance/cmd/auth/storage-modes/invalid-config/home/.databrickscfg b/acceptance/cmd/auth/storage-modes/invalid-config/home/.databrickscfg
new file mode 100644
index 00000000000..50725314253
--- /dev/null
+++ b/acceptance/cmd/auth/storage-modes/invalid-config/home/.databrickscfg
@@ -0,0 +1,2 @@
+[__settings__]
+auth_storage = bogus
diff --git a/acceptance/cmd/auth/storage-modes/invalid-config/out.test.toml b/acceptance/cmd/auth/storage-modes/invalid-config/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/auth/storage-modes/invalid-config/out.test.toml
+++ b/acceptance/cmd/auth/storage-modes/invalid-config/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/auth/storage-modes/invalid-config/script b/acceptance/cmd/auth/storage-modes/invalid-config/script
index c609a71b641..d38c1df0127 100644
--- a/acceptance/cmd/auth/storage-modes/invalid-config/script
+++ b/acceptance/cmd/auth/storage-modes/invalid-config/script
@@ -1,8 +1,3 @@
-cat > "./home/.databrickscfg" <<ENDCFG
-[__settings__]
-auth_storage = bogus
-ENDCFG
-
 # auth token is the smallest reproducer that resolves the storage mode
 # without performing any network I/O.
 trace $CLI auth token --profile nonexistent
diff --git a/acceptance/cmd/auth/storage-modes/invalid-env/out.test.toml b/acceptance/cmd/auth/storage-modes/invalid-env/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/auth/storage-modes/invalid-env/out.test.toml
+++ b/acceptance/cmd/auth/storage-modes/invalid-env/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/auth/storage-modes/plaintext-env-default/home/.databricks/token-cache.json b/acceptance/cmd/auth/storage-modes/plaintext-env-default/home/.databricks/token-cache.json
new file mode 100644
index 00000000000..1f7a28c3caa
--- /dev/null
+++ b/acceptance/cmd/auth/storage-modes/plaintext-env-default/home/.databricks/token-cache.json
@@ -0,0 +1,9 @@
+{
+  "version": 1,
+  "tokens": {
+    "dev": {
+      "access_token": "dev-cached-token",
+      "token_type": "Bearer"
+    }
+  }
+}
diff --git a/acceptance/cmd/auth/storage-modes/plaintext-env-default/home/.databrickscfg b/acceptance/cmd/auth/storage-modes/plaintext-env-default/home/.databrickscfg
new file mode 100644
index 00000000000..ca4a697ecde
--- /dev/null
+++ b/acceptance/cmd/auth/storage-modes/plaintext-env-default/home/.databrickscfg
@@ -0,0 +1,4 @@
+[dev]
+host = https://accounts.cloud.databricks.test
+account_id = account-id
+auth_type  = databricks-cli
diff --git a/acceptance/cmd/auth/storage-modes/plaintext-env-default/out.test.toml b/acceptance/cmd/auth/storage-modes/plaintext-env-default/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/auth/storage-modes/plaintext-env-default/out.test.toml
+++ b/acceptance/cmd/auth/storage-modes/plaintext-env-default/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/auth/storage-modes/plaintext-env-default/output.txt b/acceptance/cmd/auth/storage-modes/plaintext-env-default/output.txt
index 8994c41ebbb..f0b9d0f93ad 100644
--- a/acceptance/cmd/auth/storage-modes/plaintext-env-default/output.txt
+++ b/acceptance/cmd/auth/storage-modes/plaintext-env-default/output.txt
@@ -5,6 +5,7 @@
 ]
 
 >>> [CLI] auth logout --profile dev --auto-approve
+Warn: [hostmetadata] failed to fetch host metadata for https://accounts.cloud.databricks.test, will skip for 1m0s
 Logged out of profile "dev". Use --delete to also remove it from the config file.
 
 === Token cache keys after logout (should be empty)
diff --git a/acceptance/cmd/auth/storage-modes/plaintext-env-default/script b/acceptance/cmd/auth/storage-modes/plaintext-env-default/script
index 75051cb20f7..d59b26e2195 100644
--- a/acceptance/cmd/auth/storage-modes/plaintext-env-default/script
+++ b/acceptance/cmd/auth/storage-modes/plaintext-env-default/script
@@ -1,25 +1,6 @@
 export DATABRICKS_AUTH_STORAGE=plaintext
 
-cat > "./home/.databrickscfg" <<ENDCFG
-[dev]
-host = https://accounts.cloud.databricks.com
-account_id = account-id
-auth_type  = databricks-cli
-ENDCFG
-
-mkdir -p "./home/.databricks"
-cat > "./home/.databricks/token-cache.json" <<ENDCACHE
-{
-  "version": 1,
-  "tokens": {
-    "dev": {
-      "access_token": "dev-cached-token",
-      "token_type": "Bearer"
-    }
-  }
-}
-ENDCACHE
-
+# home/.databrickscfg and home/.databricks/token-cache.json are checked-in inputs.
 title "Token cache keys before logout\n"
 jq -S '.tokens | keys' "./home/.databricks/token-cache.json"
 
diff --git a/acceptance/cmd/auth/switch/nominal/home/.databrickscfg.tmpl b/acceptance/cmd/auth/switch/nominal/home/.databrickscfg.tmpl
new file mode 100644
index 00000000000..af20de44379
--- /dev/null
+++ b/acceptance/cmd/auth/switch/nominal/home/.databrickscfg.tmpl
@@ -0,0 +1,12 @@
+; The profile defined in the DEFAULT section is to be used as a fallback when no profile is explicitly specified.
+[DEFAULT]
+
+[profile-a]
+host      = ${DATABRICKS_HOST}
+token     = token-a
+auth_type = pat
+
+[profile-b]
+host      = ${DATABRICKS_HOST}
+token     = token-b
+auth_type = pat
diff --git a/acceptance/cmd/auth/switch/nominal/out.test.toml b/acceptance/cmd/auth/switch/nominal/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/auth/switch/nominal/out.test.toml
+++ b/acceptance/cmd/auth/switch/nominal/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/auth/switch/nominal/script b/acceptance/cmd/auth/switch/nominal/script
index 625ee0af8fb..b10cd6c03e7 100644
--- a/acceptance/cmd/auth/switch/nominal/script
+++ b/acceptance/cmd/auth/switch/nominal/script
@@ -1,20 +1,7 @@
 sethome "./home"
 
-# Create two profiles without a [__settings__] section.
-cat > "./home/.databrickscfg" <<EOF
-; The profile defined in the DEFAULT section is to be used as a fallback when no profile is explicitly specified.
-[DEFAULT]
-
-[profile-a]
-host      = ${DATABRICKS_HOST}
-token     = token-a
-auth_type = pat
-
-[profile-b]
-host      = ${DATABRICKS_HOST}
-token     = token-b
-auth_type = pat
-EOF
+# Two profiles without a [__settings__] section.
+envsubst < "./home/.databrickscfg.tmpl" > "./home/.databrickscfg"
 
 title "Switch to profile-a\n"
 trace $CLI auth switch --profile profile-a
diff --git a/acceptance/cmd/auth/token/default-profile/out.test.toml b/acceptance/cmd/auth/token/default-profile/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/auth/token/default-profile/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/auth/token/default-profile/output.txt b/acceptance/cmd/auth/token/default-profile/output.txt
new file mode 100644
index 00000000000..4b386f69e94
--- /dev/null
+++ b/acceptance/cmd/auth/token/default-profile/output.txt
@@ -0,0 +1,15 @@
+
+=== default_profile is honored when no args, --profile, or env var
+
+>>> errcode [CLI] auth token
+Warn: [hostmetadata] failed to fetch host metadata for https://myworkspace.test, will skip for 1m0s
+Error: cache: databricks OAuth is not configured for this host. no cached credentials; run `databricks auth login` to sign in
+
+Exit code: 1
+
+=== default_profile pointing at a missing profile falls through to picker
+
+>>> errcode [CLI] auth token
+Error: no profile specified. Use --profile <name> to specify which profile to use
+
+Exit code: 1
diff --git a/acceptance/cmd/auth/token/default-profile/script b/acceptance/cmd/auth/token/default-profile/script
new file mode 100644
index 00000000000..f5de6231901
--- /dev/null
+++ b/acceptance/cmd/auth/token/default-profile/script
@@ -0,0 +1,34 @@
+sethome "./home"
+
+unset DATABRICKS_HOST
+unset DATABRICKS_TOKEN
+unset DATABRICKS_CONFIG_PROFILE
+
+# default_profile points at "myprofile". Without it, `auth token` would fall
+# through to the non-interactive error "no profile specified".
+cat > "./home/.databrickscfg" <<'ENDCFG'
+[myprofile]
+host = https://myworkspace.test
+auth_type = databricks-cli
+
+[other]
+host = https://other.test
+auth_type = databricks-cli
+
+[__settings__]
+default_profile = myprofile
+ENDCFG
+
+title "default_profile is honored when no args, --profile, or env var\n"
+trace errcode $CLI auth token
+
+title "default_profile pointing at a missing profile falls through to picker\n"
+cat > "./home/.databrickscfg" <<'ENDCFG'
+[myprofile]
+host = https://myworkspace.test
+auth_type = databricks-cli
+
+[__settings__]
+default_profile = does-not-exist
+ENDCFG
+trace errcode $CLI auth token
diff --git a/acceptance/cmd/auth/token/force-refresh-invalid-refresh-token/out.test.toml b/acceptance/cmd/auth/token/force-refresh-invalid-refresh-token/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/auth/token/force-refresh-invalid-refresh-token/out.test.toml
+++ b/acceptance/cmd/auth/token/force-refresh-invalid-refresh-token/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/auth/token/force-refresh-invalid-refresh-token/output.txt b/acceptance/cmd/auth/token/force-refresh-invalid-refresh-token/output.txt
index f1a1b8cadba..d975fe88448 100644
--- a/acceptance/cmd/auth/token/force-refresh-invalid-refresh-token/output.txt
+++ b/acceptance/cmd/auth/token/force-refresh-invalid-refresh-token/output.txt
@@ -1,4 +1,6 @@
 Error: A new access token could not be retrieved because the refresh token is invalid. To reauthenticate, run the following command:
   $ databricks auth login --profile test-profile
-
-Exit code: 1
+{
+  "error_code": "UNAUTHENTICATED",
+  "message": "A new access token could not be retrieved because the refresh token is invalid. To reauthenticate, run the following command:\n  $ databricks auth login --profile test-profile"
+}
diff --git a/acceptance/cmd/auth/token/force-refresh-invalid-refresh-token/script b/acceptance/cmd/auth/token/force-refresh-invalid-refresh-token/script
index b5f5c297bc5..aedac8849e7 100644
--- a/acceptance/cmd/auth/token/force-refresh-invalid-refresh-token/script
+++ b/acceptance/cmd/auth/token/force-refresh-invalid-refresh-token/script
@@ -1,4 +1,5 @@
 setup_test_profile
 setup_test_token_cache
 
-errcode $CLI auth token --profile test-profile --force-refresh
+musterr $CLI auth token --profile test-profile --force-refresh
+musterr $CLI auth token --profile test-profile --force-refresh --output json
diff --git a/acceptance/cmd/auth/token/force-refresh-no-cache/out.test.toml b/acceptance/cmd/auth/token/force-refresh-no-cache/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/auth/token/force-refresh-no-cache/out.test.toml
+++ b/acceptance/cmd/auth/token/force-refresh-no-cache/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/auth/token/force-refresh-no-cache/output.txt b/acceptance/cmd/auth/token/force-refresh-no-cache/output.txt
index a5fb2467341..148424a83a4 100644
--- a/acceptance/cmd/auth/token/force-refresh-no-cache/output.txt
+++ b/acceptance/cmd/auth/token/force-refresh-no-cache/output.txt
@@ -1,3 +1 @@
-Error: cache: databricks OAuth is not configured for this host. Try logging in again with `databricks auth login --profile test-profile` before retrying. If this fails, please report this issue to the Databricks CLI maintainers at https://github.com/databricks/cli/issues/new
-
-Exit code: 1
+Error: cache: databricks OAuth is not configured for this host. no cached credentials; run `databricks auth login` to sign in
diff --git a/acceptance/cmd/auth/token/force-refresh-no-cache/script b/acceptance/cmd/auth/token/force-refresh-no-cache/script
index e561647987f..b40fc0fa97c 100644
--- a/acceptance/cmd/auth/token/force-refresh-no-cache/script
+++ b/acceptance/cmd/auth/token/force-refresh-no-cache/script
@@ -1,3 +1,3 @@
 setup_test_profile
 
-errcode $CLI auth token --profile test-profile --force-refresh
+musterr $CLI auth token --profile test-profile --force-refresh
diff --git a/acceptance/cmd/auth/token/force-refresh-success/out.test.toml b/acceptance/cmd/auth/token/force-refresh-success/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/auth/token/force-refresh-success/out.test.toml
+++ b/acceptance/cmd/auth/token/force-refresh-success/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/auth/token/no-args-no-profiles/out.test.toml b/acceptance/cmd/auth/token/no-args-no-profiles/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/auth/token/no-args-no-profiles/out.test.toml
+++ b/acceptance/cmd/auth/token/no-args-no-profiles/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/auth/token/no-args-no-profiles/output.txt b/acceptance/cmd/auth/token/no-args-no-profiles/output.txt
index 5af1fb20e1b..ed92d886a2d 100644
--- a/acceptance/cmd/auth/token/no-args-no-profiles/output.txt
+++ b/acceptance/cmd/auth/token/no-args-no-profiles/output.txt
@@ -1,3 +1 @@
 Error: no profiles configured. Run 'databricks auth login' to create a profile
-
-Exit code: 1
diff --git a/acceptance/cmd/auth/token/no-args-no-profiles/script b/acceptance/cmd/auth/token/no-args-no-profiles/script
index 82089f4aa80..a4a01b25ef0 100644
--- a/acceptance/cmd/auth/token/no-args-no-profiles/script
+++ b/acceptance/cmd/auth/token/no-args-no-profiles/script
@@ -5,4 +5,4 @@ unset DATABRICKS_TOKEN
 unset DATABRICKS_CONFIG_PROFILE
 
 # No config file, non-interactive: should error with login hint
-errcode $CLI auth token
+musterr $CLI auth token
diff --git a/acceptance/cmd/auth/token/no-args-with-profiles/home/.databrickscfg b/acceptance/cmd/auth/token/no-args-with-profiles/home/.databrickscfg
new file mode 100644
index 00000000000..80ce5f6c999
--- /dev/null
+++ b/acceptance/cmd/auth/token/no-args-with-profiles/home/.databrickscfg
@@ -0,0 +1,3 @@
+[myprofile]
+host = https://myworkspace.cloud.databricks.com
+auth_type = databricks-cli
diff --git a/acceptance/cmd/auth/token/no-args-with-profiles/out.test.toml b/acceptance/cmd/auth/token/no-args-with-profiles/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/auth/token/no-args-with-profiles/out.test.toml
+++ b/acceptance/cmd/auth/token/no-args-with-profiles/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/auth/token/no-args-with-profiles/output.txt b/acceptance/cmd/auth/token/no-args-with-profiles/output.txt
index 116c4de17ea..4a174243bef 100644
--- a/acceptance/cmd/auth/token/no-args-with-profiles/output.txt
+++ b/acceptance/cmd/auth/token/no-args-with-profiles/output.txt
@@ -1,3 +1 @@
 Error: no profile specified. Use --profile <name> to specify which profile to use
-
-Exit code: 1
diff --git a/acceptance/cmd/auth/token/no-args-with-profiles/script b/acceptance/cmd/auth/token/no-args-with-profiles/script
index ea632a7b52b..6cf9e7b7949 100644
--- a/acceptance/cmd/auth/token/no-args-with-profiles/script
+++ b/acceptance/cmd/auth/token/no-args-with-profiles/script
@@ -4,12 +4,6 @@ unset DATABRICKS_HOST
 unset DATABRICKS_TOKEN
 unset DATABRICKS_CONFIG_PROFILE
 
-# Create a .databrickscfg with a profile
-cat > "./home/.databrickscfg" <<'ENDCFG'
-[myprofile]
-host = https://myworkspace.cloud.databricks.com
-auth_type = databricks-cli
-ENDCFG
-
+# home/.databrickscfg is a checked-in input with a single profile.
 # No arguments, non-interactive: should error with profile hint
-errcode $CLI auth token
+musterr $CLI auth token
diff --git a/acceptance/cmd/auth/token/out.test.toml b/acceptance/cmd/auth/token/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/auth/token/out.test.toml
+++ b/acceptance/cmd/auth/token/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/auth/token/output.txt b/acceptance/cmd/auth/token/output.txt
index 9299dfe871b..67bf1a3654e 100644
--- a/acceptance/cmd/auth/token/output.txt
+++ b/acceptance/cmd/auth/token/output.txt
@@ -1,5 +1,5 @@
 
 >>> [CLI] auth token --host [DATABRICKS_URL]
-Error: cache: databricks OAuth is not configured for this host. Try logging in again with `databricks auth login --host [DATABRICKS_URL]` before retrying. If this fails, please report this issue to the Databricks CLI maintainers at https://github.com/databricks/cli/issues/new
+Error: cache: databricks OAuth is not configured for this host. no cached credentials; run `databricks auth login` to sign in
 
 Exit code: 1
diff --git a/acceptance/cmd/bundle/dms-read-only/out.test.toml b/acceptance/cmd/bundle/dms-read-only/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/bundle/dms-read-only/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/bundle/dms-read-only/output.txt b/acceptance/cmd/bundle/dms-read-only/output.txt
new file mode 100644
index 00000000000..2dfd130777e
--- /dev/null
+++ b/acceptance/cmd/bundle/dms-read-only/output.txt
@@ -0,0 +1,91 @@
+
+>>> [CLI] bundle-deployments list-deployments
+[
+  {
+    "display_name": "first deployment",
+    "name": "deployments/abc",
+    "status": "DEPLOYMENT_STATUS_ACTIVE",
+    "target_name": "dev"
+  },
+  {
+    "display_name": "second deployment",
+    "name": "deployments/def",
+    "status": "DEPLOYMENT_STATUS_ACTIVE",
+    "target_name": "prod"
+  }
+]
+
+>>> [CLI] bundle-deployments get-deployment deployments/abc
+{
+  "display_name": "first deployment",
+  "git_info": {
+    "branch": "main",
+    "commit": "[COMMIT_SHA]",
+    "origin_url": "https://github.com/databricks/cli"
+  },
+  "last_version_id": "v1",
+  "name": "deployments/abc",
+  "status": "DEPLOYMENT_STATUS_ACTIVE",
+  "target_name": "dev"
+}
+
+>>> [CLI] bundle-deployments list-versions deployments/abc
+[
+  {
+    "cli_version": "0.0.0-test",
+    "name": "deployments/abc/versions/v1",
+    "status": "VERSION_STATUS_COMPLETED",
+    "version_type": ""
+  }
+]
+
+>>> [CLI] bundle-deployments get-version deployments/abc/versions/v1
+{
+  "cli_version": "0.0.0-test",
+  "git_info": {
+    "branch": "main",
+    "commit": "[COMMIT_SHA]",
+    "origin_url": "https://github.com/databricks/cli"
+  },
+  "name": "deployments/abc/versions/v1",
+  "status": "VERSION_STATUS_COMPLETED",
+  "version_type": ""
+}
+
+>>> [CLI] bundle-deployments list-resources deployments/abc
+[
+  {
+    "last_action_type": "OPERATION_ACTION_TYPE_CREATE",
+    "last_version_id": "v1",
+    "name": "deployments/abc/resources/my_job",
+    "resource_id": "12345",
+    "resource_type": "DEPLOYMENT_RESOURCE_TYPE_JOB"
+  }
+]
+
+>>> [CLI] bundle-deployments get-resource deployments/abc/resources/my_job
+{
+  "last_action_type": "OPERATION_ACTION_TYPE_CREATE",
+  "last_version_id": "v1",
+  "name": "deployments/abc/resources/my_job",
+  "resource_id": "12345",
+  "resource_type": "DEPLOYMENT_RESOURCE_TYPE_JOB"
+}
+
+>>> [CLI] bundle-deployments list-operations deployments/abc/versions/v1
+[
+  {
+    "action_type": "OPERATION_ACTION_TYPE_CREATE",
+    "name": "deployments/abc/versions/v1/operations/my_job",
+    "resource_id": "12345",
+    "status": "OPERATION_STATUS_SUCCEEDED"
+  }
+]
+
+>>> [CLI] bundle-deployments get-operation deployments/abc/versions/v1/operations/my_job
+{
+  "action_type": "OPERATION_ACTION_TYPE_CREATE",
+  "name": "deployments/abc/versions/v1/operations/my_job",
+  "resource_id": "12345",
+  "status": "OPERATION_STATUS_SUCCEEDED"
+}
diff --git a/acceptance/cmd/bundle/dms-read-only/script b/acceptance/cmd/bundle/dms-read-only/script
new file mode 100644
index 00000000000..a0fac2ea4e0
--- /dev/null
+++ b/acceptance/cmd/bundle/dms-read-only/script
@@ -0,0 +1,8 @@
+trace $CLI bundle-deployments list-deployments
+trace $CLI bundle-deployments get-deployment deployments/abc
+trace $CLI bundle-deployments list-versions deployments/abc
+trace $CLI bundle-deployments get-version deployments/abc/versions/v1
+trace $CLI bundle-deployments list-resources deployments/abc
+trace $CLI bundle-deployments get-resource deployments/abc/resources/my_job
+trace $CLI bundle-deployments list-operations deployments/abc/versions/v1
+trace $CLI bundle-deployments get-operation deployments/abc/versions/v1/operations/my_job
diff --git a/acceptance/cmd/bundle/dms-read-only/test.toml b/acceptance/cmd/bundle/dms-read-only/test.toml
new file mode 100644
index 00000000000..a335de6a2e8
--- /dev/null
+++ b/acceptance/cmd/bundle/dms-read-only/test.toml
@@ -0,0 +1,140 @@
+# Local-only acceptance test for the read-only verbs of the auto-generated
+# `databricks bundle-deployments` command (DMS). The DMS APIs aren't on test
+# workspaces yet, so we stub the eight read endpoints with fixed response
+# bodies and assert the generated command renders them as expected.
+#
+# The deployment/version stubs include git_info: it is the field of interest
+# for this service and is silently dropped by older CLI releases whose SDK
+# model predates it, so we assert it round-trips through the generated command.
+Cloud = false
+
+# bundle-deployments is a workspace-service command independent of the bundle
+# deploy engine, so pin to a single value instead of the inherited matrix so
+# it runs once (empty list would run on both direct and terraform CI runners).
+
+# Normalize the git commit SHA so the golden output isn't tied to a specific
+# commit value.
+[[Repls]]
+Old = '\b[0-9a-f]{40}\b'
+New = '[COMMIT_SHA]'
+
+[[Server]]
+Pattern = "GET /api/2.0/bundle/deployments"
+Response.Body = '''
+{
+  "deployments": [
+    {
+      "name": "deployments/abc",
+      "display_name": "first deployment",
+      "target_name": "dev",
+      "status": "DEPLOYMENT_STATUS_ACTIVE"
+    },
+    {
+      "name": "deployments/def",
+      "display_name": "second deployment",
+      "target_name": "prod",
+      "status": "DEPLOYMENT_STATUS_ACTIVE"
+    }
+  ]
+}
+'''
+
+[[Server]]
+Pattern = "GET /api/2.0/bundle/deployments/abc"
+Response.Body = '''
+{
+  "name": "deployments/abc",
+  "display_name": "first deployment",
+  "target_name": "dev",
+  "status": "DEPLOYMENT_STATUS_ACTIVE",
+  "last_version_id": "v1",
+  "git_info": {
+    "branch": "main",
+    "commit": "b3ceef677c3edbc098de4e38578e008f08dc0df1",
+    "origin_url": "https://github.com/databricks/cli"
+  }
+}
+'''
+
+[[Server]]
+Pattern = "GET /api/2.0/bundle/deployments/abc/versions"
+Response.Body = '''
+{
+  "versions": [
+    {
+      "name": "deployments/abc/versions/v1",
+      "cli_version": "0.0.0-test",
+      "status": "VERSION_STATUS_COMPLETED"
+    }
+  ]
+}
+'''
+
+[[Server]]
+Pattern = "GET /api/2.0/bundle/deployments/abc/versions/v1"
+Response.Body = '''
+{
+  "name": "deployments/abc/versions/v1",
+  "cli_version": "0.0.0-test",
+  "status": "VERSION_STATUS_COMPLETED",
+  "git_info": {
+    "branch": "main",
+    "commit": "b3ceef677c3edbc098de4e38578e008f08dc0df1",
+    "origin_url": "https://github.com/databricks/cli"
+  }
+}
+'''
+
+[[Server]]
+Pattern = "GET /api/2.0/bundle/deployments/abc/resources"
+Response.Body = '''
+{
+  "resources": [
+    {
+      "name": "deployments/abc/resources/my_job",
+      "resource_id": "12345",
+      "resource_type": "DEPLOYMENT_RESOURCE_TYPE_JOB",
+      "last_version_id": "v1",
+      "last_action_type": "OPERATION_ACTION_TYPE_CREATE"
+    }
+  ]
+}
+'''
+
+[[Server]]
+Pattern = "GET /api/2.0/bundle/deployments/abc/resources/my_job"
+Response.Body = '''
+{
+  "name": "deployments/abc/resources/my_job",
+  "resource_id": "12345",
+  "resource_type": "DEPLOYMENT_RESOURCE_TYPE_JOB",
+  "last_version_id": "v1",
+  "last_action_type": "OPERATION_ACTION_TYPE_CREATE"
+}
+'''
+
+[[Server]]
+Pattern = "GET /api/2.0/bundle/deployments/abc/versions/v1/operations"
+Response.Body = '''
+{
+  "operations": [
+    {
+      "name": "deployments/abc/versions/v1/operations/my_job",
+      "action_type": "OPERATION_ACTION_TYPE_CREATE",
+      "resource_id": "12345",
+      "status": "OPERATION_STATUS_SUCCEEDED"
+    }
+  ]
+}
+'''
+
+[[Server]]
+Pattern = "GET /api/2.0/bundle/deployments/abc/versions/v1/operations/my_job"
+Response.Body = '''
+{
+  "name": "deployments/abc/versions/v1/operations/my_job",
+  "action_type": "OPERATION_ACTION_TYPE_CREATE",
+  "resource_id": "12345",
+  "status": "OPERATION_STATUS_SUCCEEDED"
+}
+'''
diff --git a/acceptance/cmd/completion/out.test.toml b/acceptance/cmd/completion/out.test.toml
index 65156e0457c..18b1a88417e 100644
--- a/acceptance/cmd/completion/out.test.toml
+++ b/acceptance/cmd/completion/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform"]
diff --git a/acceptance/cmd/completion/output.txt b/acceptance/cmd/completion/output.txt
index 17ed0f61eb0..d9e58987459 100644
--- a/acceptance/cmd/completion/output.txt
+++ b/acceptance/cmd/completion/output.txt
@@ -1,34 +1,34 @@
 
 >>> [CLI] completion install --shell zsh --auto-approve
 Databricks CLI completions installed for zsh.
-Restart your shell or run 'source home/.zshrc' to activate.
+Restart your shell or run 'source [HOME]/.zshrc' to activate.
 
 Warning: zsh completions require the completion system to be initialized.
-Add the following to your home/.zshrc:
+Add the following to your [HOME]/.zshrc:
   autoload -U compinit && compinit
 
 >>> [CLI] completion status --shell zsh
 Shell:   zsh
-File:    home/.zshrc
+File:    [HOME]/.zshrc
 Status:  installed
 
 Warning: zsh completions require the completion system to be initialized.
-Add the following to your home/.zshrc:
+Add the following to your [HOME]/.zshrc:
   autoload -U compinit && compinit
 
 >>> [CLI] completion install --shell zsh --auto-approve
-Databricks CLI completions are already installed for zsh in home/.zshrc.
+Databricks CLI completions are already installed for zsh in [HOME]/.zshrc.
 
 Warning: zsh completions require the completion system to be initialized.
-Add the following to your home/.zshrc:
+Add the following to your [HOME]/.zshrc:
   autoload -U compinit && compinit
 
 >>> [CLI] completion uninstall --shell zsh --auto-approve
-Databricks CLI completions removed for zsh from home/.zshrc.
+Databricks CLI completions removed for zsh from [HOME]/.zshrc.
 
 >>> [CLI] completion status --shell zsh
 Shell:   zsh
-File:    home/.zshrc
+File:    [HOME]/.zshrc
 Status:  not installed
 # bash completion V2 for databricks                           -*- shell-script -*-
 #compdef databricks
diff --git a/acceptance/cmd/completion/script b/acceptance/cmd/completion/script
index e5b0f324d65..d315d83839a 100644
--- a/acceptance/cmd/completion/script
+++ b/acceptance/cmd/completion/script
@@ -1,7 +1,7 @@
 sethome "./home"
 
 # Track the home path for stable output across platforms.
-add_repl.py "$HOME" HOME
+add_repl "$HOME" HOME
 
 # Prevent Homebrew detection from affecting status output.
 export HOMEBREW_PREFIX=/nonexistent
diff --git a/acceptance/cmd/completion/test.toml b/acceptance/cmd/completion/test.toml
index e8c2fdf6dfe..437b34a827f 100644
--- a/acceptance/cmd/completion/test.toml
+++ b/acceptance/cmd/completion/test.toml
@@ -2,9 +2,6 @@ Ignore = [
     "home",
 ]
 
-Local = true
 Cloud = false
 
 # Completion tests don't involve bundles, skip the engine matrix.
-[EnvMatrix]
-DATABRICKS_BUNDLE_ENGINE = ["terraform"]
diff --git a/acceptance/cmd/configure/clears-oauth-on-pat/home/.databrickscfg b/acceptance/cmd/configure/clears-oauth-on-pat/home/.databrickscfg
new file mode 100644
index 00000000000..a60a777dd58
--- /dev/null
+++ b/acceptance/cmd/configure/clears-oauth-on-pat/home/.databrickscfg
@@ -0,0 +1,7 @@
+[DEFAULT]
+host                         = https://host
+auth_type                    = databricks-cli
+scopes                       = all-apis
+experimental_is_unified_host = true
+account_id                   = acc-123
+workspace_id                 = ws-456
diff --git a/acceptance/cmd/configure/clears-oauth-on-pat/out.test.toml b/acceptance/cmd/configure/clears-oauth-on-pat/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/configure/clears-oauth-on-pat/out.test.toml
+++ b/acceptance/cmd/configure/clears-oauth-on-pat/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/configure/clears-oauth-on-pat/script b/acceptance/cmd/configure/clears-oauth-on-pat/script
index 30f7b7fed1d..6b00490f79a 100644
--- a/acceptance/cmd/configure/clears-oauth-on-pat/script
+++ b/acceptance/cmd/configure/clears-oauth-on-pat/script
@@ -1,17 +1,7 @@
 sethome "./home"
 
-# Pre-populate a profile with OAuth metadata and unified host fields
-# (as if `auth login` was previously run against a unified host).
-cat > "./home/.databrickscfg" <<EOF
-[DEFAULT]
-host                         = https://host
-auth_type                    = databricks-cli
-scopes                       = all-apis
-experimental_is_unified_host = true
-account_id                   = acc-123
-workspace_id                 = ws-456
-EOF
-
+# home/.databrickscfg is a checked-in input: a profile with OAuth metadata and
+# unified host fields (as if `auth login` was previously run against a unified host).
 title "Initial profile (OAuth with unified host)\n"
 cat "./home/.databrickscfg"
 
diff --git a/acceptance/cmd/configure/clears-serverless-when-cluster-from-env/home/.databrickscfg b/acceptance/cmd/configure/clears-serverless-when-cluster-from-env/home/.databrickscfg
new file mode 100644
index 00000000000..d3883ab26f0
--- /dev/null
+++ b/acceptance/cmd/configure/clears-serverless-when-cluster-from-env/home/.databrickscfg
@@ -0,0 +1,3 @@
+[DEFAULT]
+host                  = https://host
+serverless_compute_id = auto
diff --git a/acceptance/cmd/configure/clears-serverless-when-cluster-from-env/out.test.toml b/acceptance/cmd/configure/clears-serverless-when-cluster-from-env/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/configure/clears-serverless-when-cluster-from-env/out.test.toml
+++ b/acceptance/cmd/configure/clears-serverless-when-cluster-from-env/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/configure/clears-serverless-when-cluster-from-env/script b/acceptance/cmd/configure/clears-serverless-when-cluster-from-env/script
index 2e0482d39ff..dcee6ef1209 100644
--- a/acceptance/cmd/configure/clears-serverless-when-cluster-from-env/script
+++ b/acceptance/cmd/configure/clears-serverless-when-cluster-from-env/script
@@ -1,12 +1,6 @@
 sethome "./home"
 
-# Pre-populate a profile with serverless_compute_id.
-cat > "./home/.databrickscfg" <<EOF
-[DEFAULT]
-host                  = https://host
-serverless_compute_id = auto
-EOF
-
+# home/.databrickscfg is a checked-in input: a profile with serverless_compute_id.
 title "Initial profile with serverless_compute_id\n"
 cat "./home/.databrickscfg"
 
diff --git a/acceptance/cmd/fs/cp/dir-to-dir/out.test.toml b/acceptance/cmd/fs/cp/dir-to-dir/out.test.toml
index e849ec85ace..c7c6f58ed6e 100644
--- a/acceptance/cmd/fs/cp/dir-to-dir/out.test.toml
+++ b/acceptance/cmd/fs/cp/dir-to-dir/out.test.toml
@@ -1,4 +1 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/fs/cp/dir-to-dir/test.toml b/acceptance/cmd/fs/cp/dir-to-dir/test.toml
index f5706bb0af4..c7c6f58ed6e 100644
--- a/acceptance/cmd/fs/cp/dir-to-dir/test.toml
+++ b/acceptance/cmd/fs/cp/dir-to-dir/test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
diff --git a/acceptance/cmd/fs/cp/file-to-dir/out.test.toml b/acceptance/cmd/fs/cp/file-to-dir/out.test.toml
index e849ec85ace..c7c6f58ed6e 100644
--- a/acceptance/cmd/fs/cp/file-to-dir/out.test.toml
+++ b/acceptance/cmd/fs/cp/file-to-dir/out.test.toml
@@ -1,4 +1 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/fs/cp/file-to-dir/test.toml b/acceptance/cmd/fs/cp/file-to-dir/test.toml
index f5706bb0af4..c7c6f58ed6e 100644
--- a/acceptance/cmd/fs/cp/file-to-dir/test.toml
+++ b/acceptance/cmd/fs/cp/file-to-dir/test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
diff --git a/acceptance/cmd/fs/cp/file-to-file/out.test.toml b/acceptance/cmd/fs/cp/file-to-file/out.test.toml
index e849ec85ace..c7c6f58ed6e 100644
--- a/acceptance/cmd/fs/cp/file-to-file/out.test.toml
+++ b/acceptance/cmd/fs/cp/file-to-file/out.test.toml
@@ -1,4 +1 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/fs/cp/file-to-file/test.toml b/acceptance/cmd/fs/cp/file-to-file/test.toml
index f5706bb0af4..c7c6f58ed6e 100644
--- a/acceptance/cmd/fs/cp/file-to-file/test.toml
+++ b/acceptance/cmd/fs/cp/file-to-file/test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = true
-RequiresUnityCatalog = true
diff --git a/acceptance/cmd/fs/cp/file-to-skill/local.txt b/acceptance/cmd/fs/cp/file-to-skill/local.txt
new file mode 100644
index 00000000000..a0423896973
--- /dev/null
+++ b/acceptance/cmd/fs/cp/file-to-skill/local.txt
@@ -0,0 +1 @@
+hello world!
diff --git a/acceptance/cmd/fs/cp/file-to-skill/out.test.toml b/acceptance/cmd/fs/cp/file-to-skill/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/fs/cp/file-to-skill/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/fs/cp/file-to-skill/output.txt b/acceptance/cmd/fs/cp/file-to-skill/output.txt
new file mode 100644
index 00000000000..187850bdf86
--- /dev/null
+++ b/acceptance/cmd/fs/cp/file-to-skill/output.txt
@@ -0,0 +1,6 @@
+
+>>> [CLI] fs cp local.txt dbfs:/Skills/main/default/fs-cp-test-[UNIQUE_NAME]/README.md
+local.txt -> dbfs:/Skills/main/default/fs-cp-test-[UNIQUE_NAME]/README.md
+
+>>> [CLI] fs cat dbfs:/Skills/main/default/fs-cp-test-[UNIQUE_NAME]/README.md
+hello world!
diff --git a/acceptance/cmd/fs/cp/file-to-skill/script b/acceptance/cmd/fs/cp/file-to-skill/script
new file mode 100644
index 00000000000..20c53986072
--- /dev/null
+++ b/acceptance/cmd/fs/cp/file-to-skill/script
@@ -0,0 +1,13 @@
+CATALOG_NAME="main"
+SCHEMA_NAME="default"
+SKILL_NAME="fs-cp-test-${UNIQUE_NAME}"
+
+# Create target directory. UC Skills are served by the Files API, so unlike the
+# Volumes tests there is no catalog object to create first.
+$CLI fs mkdir dbfs:/Skills/${CATALOG_NAME}/${SCHEMA_NAME}/${SKILL_NAME}
+
+# Upload a local file into the skill bundle.
+trace $CLI fs cp local.txt dbfs:/Skills/${CATALOG_NAME}/${SCHEMA_NAME}/${SKILL_NAME}/README.md
+
+# Verify file was uploaded correctly.
+trace $CLI fs cat dbfs:/Skills/${CATALOG_NAME}/${SCHEMA_NAME}/${SKILL_NAME}/README.md
diff --git a/acceptance/cmd/fs/cp/input-validation/out.test.toml b/acceptance/cmd/fs/cp/input-validation/out.test.toml
deleted file mode 100644
index f784a183258..00000000000
--- a/acceptance/cmd/fs/cp/input-validation/out.test.toml
+++ /dev/null
@@ -1,3 +0,0 @@
-Local = true
-Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/fs/cp/input-validation/output.txt b/acceptance/cmd/fs/cp/input-validation/output.txt
deleted file mode 100644
index febe55b74e8..00000000000
--- a/acceptance/cmd/fs/cp/input-validation/output.txt
+++ /dev/null
@@ -1,10 +0,0 @@
-
->>> errcode [CLI] fs cp src dst --concurrency -1
-Error: --concurrency must be at least 1
-
-Exit code: 1
-
->>> errcode [CLI] fs cp src dst --concurrency 0
-Error: --concurrency must be at least 1
-
-Exit code: 1
diff --git a/acceptance/cmd/fs/cp/input-validation/script b/acceptance/cmd/fs/cp/input-validation/script
deleted file mode 100644
index a5e8cec8621..00000000000
--- a/acceptance/cmd/fs/cp/input-validation/script
+++ /dev/null
@@ -1,3 +0,0 @@
-# Invalid concurrency values should fail.
-trace errcode $CLI fs cp src dst --concurrency -1
-trace errcode $CLI fs cp src dst --concurrency 0
diff --git a/acceptance/cmd/fs/cp/input-validation/test.toml b/acceptance/cmd/fs/cp/input-validation/test.toml
deleted file mode 100644
index 7d36fb9dc18..00000000000
--- a/acceptance/cmd/fs/cp/input-validation/test.toml
+++ /dev/null
@@ -1,2 +0,0 @@
-Local = true
-Cloud = false
diff --git a/acceptance/cmd/fs/input-validation/hello.txt b/acceptance/cmd/fs/input-validation/hello.txt
new file mode 100644
index 00000000000..ce013625030
--- /dev/null
+++ b/acceptance/cmd/fs/input-validation/hello.txt
@@ -0,0 +1 @@
+hello
diff --git a/acceptance/cmd/fs/input-validation/out.test.toml b/acceptance/cmd/fs/input-validation/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/fs/input-validation/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/fs/input-validation/output.txt b/acceptance/cmd/fs/input-validation/output.txt
new file mode 100644
index 00000000000..6fbc5731d9d
--- /dev/null
+++ b/acceptance/cmd/fs/input-validation/output.txt
@@ -0,0 +1,18 @@
+
+>>> musterr [CLI] fs cp src dst --concurrency -1
+Error: --concurrency must be at least 1
+
+>>> musterr [CLI] fs cp src dst --concurrency 0
+Error: --concurrency must be at least 1
+
+>>> musterr [CLI] fs cp dbfs:/a https:/b
+Error: invalid scheme: https
+
+>>> musterr [CLI] fs cat dab:/non-existent-file
+Error: invalid scheme: dab
+
+>>> musterr [CLI] fs ls path-without-a-dbfs-scheme --output=json
+Error: no such directory: path-without-a-dbfs-scheme
+
+>>> musterr [CLI] fs cat hello.txt --output=json
+Error: json output not supported
diff --git a/acceptance/cmd/fs/input-validation/script b/acceptance/cmd/fs/input-validation/script
new file mode 100644
index 00000000000..33483fa3508
--- /dev/null
+++ b/acceptance/cmd/fs/input-validation/script
@@ -0,0 +1,14 @@
+# Invalid concurrency values should fail.
+trace musterr $CLI fs cp src dst --concurrency -1
+trace musterr $CLI fs cp src dst --concurrency 0
+
+# Only the dbfs scheme is understood; anything else is rejected before any request.
+trace musterr $CLI fs cp dbfs:/a https:/b
+trace musterr $CLI fs cat dab:/non-existent-file
+
+# A path without a scheme is treated as a local path. Keep it relative: Git Bash
+# rewrites a leading-slash argument into a Windows path before the CLI sees it.
+trace musterr $CLI fs ls path-without-a-dbfs-scheme --output=json
+
+# fs cat streams raw file contents, which have no JSON representation.
+trace musterr $CLI fs cat hello.txt --output=json
diff --git a/acceptance/cmd/liteswap-target/databricks.yml b/acceptance/cmd/liteswap-target/databricks.yml
new file mode 100644
index 00000000000..26d6c90dbde
--- /dev/null
+++ b/acceptance/cmd/liteswap-target/databricks.yml
@@ -0,0 +1,2 @@
+bundle:
+  name: liteswap-target
diff --git a/acceptance/cmd/liteswap-target/out.test.toml b/acceptance/cmd/liteswap-target/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/liteswap-target/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/liteswap-target/output.txt b/acceptance/cmd/liteswap-target/output.txt
new file mode 100644
index 00000000000..9f3a29c49eb
--- /dev/null
+++ b/acceptance/cmd/liteswap-target/output.txt
@@ -0,0 +1,67 @@
+
+=== Workspace command
+>>> [CLI] clusters list
+ID    Name                State
+4321  some-test-cluster   
+9876  some-other-cluster  
+
+>>> print_requests.py --get //clusters/list
+{
+  "headers": {
+    "X-Databricks-Traffic-Id": [
+      "testenv://liteswap/dms"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.1/clusters/list"
+}
+
+=== Account command
+>>> [CLI] account network-policies list-network-policies-rpc
+[
+  
+]
+
+>>> print_requests.py --get //network-policies
+{
+  "headers": {
+    "X-Databricks-Traffic-Id": [
+      "testenv://liteswap/dms"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/accounts/abc-123/network-policies"
+}
+
+=== Bundle command
+>>> [CLI] bundle validate
+Name: liteswap-target
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/liteswap-target/default
+
+Validation OK!
+
+>>> print_requests.py --get //scim/v2/Me
+{
+  "headers": {
+    "X-Databricks-Traffic-Id": [
+      "testenv://liteswap/dms"
+    ]
+  },
+  "method": "GET",
+  "path": "/api/2.0/preview/scim/v2/Me"
+}
+
+=== No header when unset
+>>> [CLI] clusters list
+ID    Name                State
+4321  some-test-cluster   
+9876  some-other-cluster  
+
+>>> print_requests.py --get //clusters/list
+{
+  "method": "GET",
+  "path": "/api/2.1/clusters/list"
+}
diff --git a/acceptance/cmd/liteswap-target/script b/acceptance/cmd/liteswap-target/script
new file mode 100644
index 00000000000..f69acefb698
--- /dev/null
+++ b/acceptance/cmd/liteswap-target/script
@@ -0,0 +1,15 @@
+title "Workspace command"
+DATABRICKS_LITESWAP_TARGET=dms trace $CLI clusters list
+trace print_requests.py --get //clusters/list
+
+title "Account command"
+DATABRICKS_LITESWAP_TARGET=dms DATABRICKS_ACCOUNT_ID=abc-123 trace $CLI account network-policies list-network-policies-rpc
+trace print_requests.py --get //network-policies
+
+title "Bundle command"
+DATABRICKS_LITESWAP_TARGET=dms trace $CLI bundle validate
+trace print_requests.py --get //scim/v2/Me
+
+title "No header when unset"
+trace $CLI clusters list
+trace print_requests.py --get //clusters/list | contains.py "!X-Databricks-Traffic-Id"
diff --git a/acceptance/cmd/liteswap-target/test.toml b/acceptance/cmd/liteswap-target/test.toml
new file mode 100644
index 00000000000..ddabbb8dcf8
--- /dev/null
+++ b/acceptance/cmd/liteswap-target/test.toml
@@ -0,0 +1,6 @@
+RecordRequests = true
+IncludeRequestHeaders = ["X-Databricks-Traffic-Id"]
+
+[[Server]]
+Pattern = "GET /api/2.0/accounts/abc-123/network-policies"
+Response.Body = '{}'
diff --git a/acceptance/cmd/patchwhl/out.test.toml b/acceptance/cmd/patchwhl/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/patchwhl/out.test.toml
+++ b/acceptance/cmd/patchwhl/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/psql/argument-errors/out.test.toml b/acceptance/cmd/psql/argument-errors/out.test.toml
index 1baaa898c5b..2e1543aa802 100644
--- a/acceptance/cmd/psql/argument-errors/out.test.toml
+++ b/acceptance/cmd/psql/argument-errors/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = false
 GOOS.windows = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/psql/completions/out.test.toml b/acceptance/cmd/psql/completions/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/psql/completions/out.test.toml
+++ b/acceptance/cmd/psql/completions/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/psql/failing-connection/out.test.toml b/acceptance/cmd/psql/failing-connection/out.test.toml
index 1baaa898c5b..2e1543aa802 100644
--- a/acceptance/cmd/psql/failing-connection/out.test.toml
+++ b/acceptance/cmd/psql/failing-connection/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = false
 GOOS.windows = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/psql/not-available/out.test.toml b/acceptance/cmd/psql/not-available/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/psql/not-available/out.test.toml
+++ b/acceptance/cmd/psql/not-available/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/psql/postgres/out.test.toml b/acceptance/cmd/psql/postgres/out.test.toml
index 1baaa898c5b..2e1543aa802 100644
--- a/acceptance/cmd/psql/postgres/out.test.toml
+++ b/acceptance/cmd/psql/postgres/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = false
 GOOS.windows = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/psql/simple/out.test.toml b/acceptance/cmd/psql/simple/out.test.toml
index 1baaa898c5b..2e1543aa802 100644
--- a/acceptance/cmd/psql/simple/out.test.toml
+++ b/acceptance/cmd/psql/simple/out.test.toml
@@ -1,4 +1,2 @@
-Local = true
 Cloud = false
 GOOS.windows = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/sandbox/config/idle-timeout-bounds/out.test.toml b/acceptance/cmd/sandbox/config/idle-timeout-bounds/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/sandbox/config/idle-timeout-bounds/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/sandbox/config/idle-timeout-bounds/output.txt b/acceptance/cmd/sandbox/config/idle-timeout-bounds/output.txt
new file mode 100644
index 00000000000..da5dfe76648
--- /dev/null
+++ b/acceptance/cmd/sandbox/config/idle-timeout-bounds/output.txt
@@ -0,0 +1,2 @@
+Error: idle-timeout must be 0 (clear) or between 1m and 24h, got 30s
+Error: idle-timeout must be 0 (clear) or between 1m and 24h, got 48h
diff --git a/acceptance/cmd/sandbox/config/idle-timeout-bounds/script b/acceptance/cmd/sandbox/config/idle-timeout-bounds/script
new file mode 100644
index 00000000000..30f141cd7c3
--- /dev/null
+++ b/acceptance/cmd/sandbox/config/idle-timeout-bounds/script
@@ -0,0 +1,6 @@
+# Below the 60s lower bound — client-side validation rejects before
+# any API call, so no [[Server]] stub needed.
+musterr $CLI sandbox config happy-panda-1234 --idle-timeout 30s
+
+# Above the 24h upper bound.
+musterr $CLI sandbox config happy-panda-1234 --idle-timeout 48h
diff --git a/acceptance/cmd/sandbox/config/no-flags/out.test.toml b/acceptance/cmd/sandbox/config/no-flags/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/sandbox/config/no-flags/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/sandbox/config/no-flags/output.txt b/acceptance/cmd/sandbox/config/no-flags/output.txt
new file mode 100644
index 00000000000..56d78059977
--- /dev/null
+++ b/acceptance/cmd/sandbox/config/no-flags/output.txt
@@ -0,0 +1 @@
+Error: nothing to update — pass --name, --idle-timeout, and/or --no-autostop
diff --git a/acceptance/cmd/sandbox/config/no-flags/script b/acceptance/cmd/sandbox/config/no-flags/script
new file mode 100644
index 00000000000..0058167b0b6
--- /dev/null
+++ b/acceptance/cmd/sandbox/config/no-flags/script
@@ -0,0 +1 @@
+musterr $CLI sandbox config happy-panda-1234
diff --git a/acceptance/cmd/sandbox/config/update-name/out.test.toml b/acceptance/cmd/sandbox/config/update-name/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/sandbox/config/update-name/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/sandbox/config/update-name/output.txt b/acceptance/cmd/sandbox/config/update-name/output.txt
new file mode 100644
index 00000000000..194bf2ffd17
--- /dev/null
+++ b/acceptance/cmd/sandbox/config/update-name/output.txt
@@ -0,0 +1,5 @@
+
+  id         happy-panda-1234
+  name       renamed-project
+  autostop   15m
+
diff --git a/acceptance/cmd/sandbox/config/update-name/script b/acceptance/cmd/sandbox/config/update-name/script
new file mode 100644
index 00000000000..f8dac144fe8
--- /dev/null
+++ b/acceptance/cmd/sandbox/config/update-name/script
@@ -0,0 +1 @@
+$CLI sandbox config happy-panda-1234 --name renamed-project
diff --git a/acceptance/cmd/sandbox/config/update-name/test.toml b/acceptance/cmd/sandbox/config/update-name/test.toml
new file mode 100644
index 00000000000..96505610b10
--- /dev/null
+++ b/acceptance/cmd/sandbox/config/update-name/test.toml
@@ -0,0 +1,10 @@
+[[Server]]
+Pattern = "PATCH /api/2.0/lakebox/sandboxes/happy-panda-1234"
+Response.Body = '''
+{
+  "sandboxId": "happy-panda-1234",
+  "status": "Running",
+  "name": "renamed-project",
+  "idleTimeout": "900s"
+}
+'''
diff --git a/acceptance/cmd/sandbox/create/with-name/out.test.toml b/acceptance/cmd/sandbox/create/with-name/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/sandbox/create/with-name/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/sandbox/create/with-name/output.txt b/acceptance/cmd/sandbox/create/with-name/output.txt
new file mode 100644
index 00000000000..b0cbe501bf1
--- /dev/null
+++ b/acceptance/cmd/sandbox/create/with-name/output.txt
@@ -0,0 +1,4 @@
+  ✓ Sandbox happy-panda-1234 is running
+  default    happy-panda-1234
+
+happy-panda-1234
diff --git a/acceptance/cmd/sandbox/create/with-name/script b/acceptance/cmd/sandbox/create/with-name/script
new file mode 100644
index 00000000000..1644389ae86
--- /dev/null
+++ b/acceptance/cmd/sandbox/create/with-name/script
@@ -0,0 +1 @@
+$CLI sandbox create --name my-project
diff --git a/acceptance/cmd/sandbox/create/with-name/test.toml b/acceptance/cmd/sandbox/create/with-name/test.toml
new file mode 100644
index 00000000000..4acb38df562
--- /dev/null
+++ b/acceptance/cmd/sandbox/create/with-name/test.toml
@@ -0,0 +1,10 @@
+[[Server]]
+Pattern = "POST /api/2.0/lakebox/sandboxes"
+Response.Body = '''
+{
+  "sandboxId": "happy-panda-1234",
+  "status": "Running",
+  "name": "my-project",
+  "gatewayHost": "uw2.dbrx.dev"
+}
+'''
diff --git a/acceptance/cmd/sandbox/default/not-found/out.test.toml b/acceptance/cmd/sandbox/default/not-found/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/sandbox/default/not-found/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/sandbox/default/not-found/output.txt b/acceptance/cmd/sandbox/default/not-found/output.txt
new file mode 100644
index 00000000000..235a49bc669
--- /dev/null
+++ b/acceptance/cmd/sandbox/default/not-found/output.txt
@@ -0,0 +1 @@
+Error: no sandbox named "no-such-box" — `databricks sandbox list` shows available IDs
diff --git a/acceptance/cmd/sandbox/default/not-found/script b/acceptance/cmd/sandbox/default/not-found/script
new file mode 100644
index 00000000000..2155f9f651e
--- /dev/null
+++ b/acceptance/cmd/sandbox/default/not-found/script
@@ -0,0 +1 @@
+musterr $CLI sandbox default no-such-box
diff --git a/acceptance/cmd/sandbox/default/not-found/test.toml b/acceptance/cmd/sandbox/default/not-found/test.toml
new file mode 100644
index 00000000000..3d2b831b415
--- /dev/null
+++ b/acceptance/cmd/sandbox/default/not-found/test.toml
@@ -0,0 +1,4 @@
+[[Server]]
+Pattern = "GET /api/2.0/lakebox/sandboxes/no-such-box"
+Response.StatusCode = 404
+Response.Body = '{"error_code": "NOT_FOUND", "message": "Sandbox not found"}'
diff --git a/acceptance/cmd/sandbox/default/set/out.test.toml b/acceptance/cmd/sandbox/default/set/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/sandbox/default/set/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/sandbox/default/set/output.txt b/acceptance/cmd/sandbox/default/set/output.txt
new file mode 100644
index 00000000000..a04c2cf44f6
--- /dev/null
+++ b/acceptance/cmd/sandbox/default/set/output.txt
@@ -0,0 +1 @@
+Default sandbox set to: happy-panda-1234
diff --git a/acceptance/cmd/sandbox/default/set/script b/acceptance/cmd/sandbox/default/set/script
new file mode 100644
index 00000000000..159e80bb43d
--- /dev/null
+++ b/acceptance/cmd/sandbox/default/set/script
@@ -0,0 +1 @@
+$CLI sandbox default happy-panda-1234
diff --git a/acceptance/cmd/sandbox/default/set/test.toml b/acceptance/cmd/sandbox/default/set/test.toml
new file mode 100644
index 00000000000..61a48b3a379
--- /dev/null
+++ b/acceptance/cmd/sandbox/default/set/test.toml
@@ -0,0 +1,9 @@
+[[Server]]
+Pattern = "GET /api/2.0/lakebox/sandboxes/happy-panda-1234"
+Response.Body = '''
+{
+  "sandboxId": "happy-panda-1234",
+  "status": "Running",
+  "name": "my-project"
+}
+'''
diff --git a/acceptance/cmd/sandbox/delete/no-tty-no-auto-approve/out.test.toml b/acceptance/cmd/sandbox/delete/no-tty-no-auto-approve/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/sandbox/delete/no-tty-no-auto-approve/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/sandbox/delete/no-tty-no-auto-approve/output.txt b/acceptance/cmd/sandbox/delete/no-tty-no-auto-approve/output.txt
new file mode 100644
index 00000000000..fb62b25b406
--- /dev/null
+++ b/acceptance/cmd/sandbox/delete/no-tty-no-auto-approve/output.txt
@@ -0,0 +1 @@
+Error: `databricks sandbox delete` permanently destroys the sandbox; pass --auto-approve to confirm in non-interactive contexts
diff --git a/acceptance/cmd/sandbox/delete/no-tty-no-auto-approve/script b/acceptance/cmd/sandbox/delete/no-tty-no-auto-approve/script
new file mode 100644
index 00000000000..b596bf74dc6
--- /dev/null
+++ b/acceptance/cmd/sandbox/delete/no-tty-no-auto-approve/script
@@ -0,0 +1,3 @@
+# No --auto-approve and no TTY → must fail fast pointing at the flag,
+# not hang on a read from a closed stdin.
+musterr $CLI sandbox delete happy-panda-1234
diff --git a/acceptance/cmd/sandbox/delete/no-tty-no-auto-approve/test.toml b/acceptance/cmd/sandbox/delete/no-tty-no-auto-approve/test.toml
new file mode 100644
index 00000000000..d99bfa3599f
--- /dev/null
+++ b/acceptance/cmd/sandbox/delete/no-tty-no-auto-approve/test.toml
@@ -0,0 +1,9 @@
+[[Server]]
+Pattern = "GET /api/2.0/lakebox/sandboxes/happy-panda-1234"
+Response.Body = '''
+{
+  "sandboxId": "happy-panda-1234",
+  "status": "Stopped",
+  "name": "my-project"
+}
+'''
diff --git a/acceptance/cmd/sandbox/delete/not-found/out.test.toml b/acceptance/cmd/sandbox/delete/not-found/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/sandbox/delete/not-found/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/sandbox/delete/not-found/output.txt b/acceptance/cmd/sandbox/delete/not-found/output.txt
new file mode 100644
index 00000000000..235a49bc669
--- /dev/null
+++ b/acceptance/cmd/sandbox/delete/not-found/output.txt
@@ -0,0 +1 @@
+Error: no sandbox named "no-such-box" — `databricks sandbox list` shows available IDs
diff --git a/acceptance/cmd/sandbox/delete/not-found/script b/acceptance/cmd/sandbox/delete/not-found/script
new file mode 100644
index 00000000000..deed8686976
--- /dev/null
+++ b/acceptance/cmd/sandbox/delete/not-found/script
@@ -0,0 +1 @@
+musterr $CLI sandbox delete no-such-box --auto-approve
diff --git a/acceptance/cmd/sandbox/delete/not-found/test.toml b/acceptance/cmd/sandbox/delete/not-found/test.toml
new file mode 100644
index 00000000000..3d2b831b415
--- /dev/null
+++ b/acceptance/cmd/sandbox/delete/not-found/test.toml
@@ -0,0 +1,4 @@
+[[Server]]
+Pattern = "GET /api/2.0/lakebox/sandboxes/no-such-box"
+Response.StatusCode = 404
+Response.Body = '{"error_code": "NOT_FOUND", "message": "Sandbox not found"}'
diff --git a/acceptance/cmd/sandbox/delete/success/out.test.toml b/acceptance/cmd/sandbox/delete/success/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/sandbox/delete/success/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/sandbox/delete/success/output.txt b/acceptance/cmd/sandbox/delete/success/output.txt
new file mode 100644
index 00000000000..b9684e2ee21
--- /dev/null
+++ b/acceptance/cmd/sandbox/delete/success/output.txt
@@ -0,0 +1 @@
+  ✓ Removed happy-panda-1234
diff --git a/acceptance/cmd/sandbox/delete/success/script b/acceptance/cmd/sandbox/delete/success/script
new file mode 100644
index 00000000000..fc1f7da3fcd
--- /dev/null
+++ b/acceptance/cmd/sandbox/delete/success/script
@@ -0,0 +1 @@
+$CLI sandbox delete happy-panda-1234 --auto-approve
diff --git a/acceptance/cmd/sandbox/delete/success/test.toml b/acceptance/cmd/sandbox/delete/success/test.toml
new file mode 100644
index 00000000000..8c818e25c24
--- /dev/null
+++ b/acceptance/cmd/sandbox/delete/success/test.toml
@@ -0,0 +1,13 @@
+[[Server]]
+Pattern = "GET /api/2.0/lakebox/sandboxes/happy-panda-1234"
+Response.Body = '''
+{
+  "sandboxId": "happy-panda-1234",
+  "status": "Stopped",
+  "name": "my-project"
+}
+'''
+
+[[Server]]
+Pattern = "DELETE /api/2.0/lakebox/sandboxes/happy-panda-1234"
+Response.Body = '{}'
diff --git a/acceptance/cmd/sandbox/list/empty/out.test.toml b/acceptance/cmd/sandbox/list/empty/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/sandbox/list/empty/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/sandbox/list/empty/output.txt b/acceptance/cmd/sandbox/list/empty/output.txt
new file mode 100644
index 00000000000..ea72575bbea
--- /dev/null
+++ b/acceptance/cmd/sandbox/list/empty/output.txt
@@ -0,0 +1 @@
+  No sandboxes found.
diff --git a/acceptance/cmd/sandbox/list/empty/script b/acceptance/cmd/sandbox/list/empty/script
new file mode 100644
index 00000000000..35e7b078d4a
--- /dev/null
+++ b/acceptance/cmd/sandbox/list/empty/script
@@ -0,0 +1 @@
+$CLI sandbox list
diff --git a/acceptance/cmd/sandbox/list/empty/test.toml b/acceptance/cmd/sandbox/list/empty/test.toml
new file mode 100644
index 00000000000..8fca058ddb9
--- /dev/null
+++ b/acceptance/cmd/sandbox/list/empty/test.toml
@@ -0,0 +1,3 @@
+[[Server]]
+Pattern = "GET /api/2.0/lakebox/sandboxes"
+Response.Body = '{"sandboxes": []}'
diff --git a/acceptance/cmd/sandbox/list/json/out.test.toml b/acceptance/cmd/sandbox/list/json/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/sandbox/list/json/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/sandbox/list/json/output.txt b/acceptance/cmd/sandbox/list/json/output.txt
new file mode 100644
index 00000000000..ccd52b804ed
--- /dev/null
+++ b/acceptance/cmd/sandbox/list/json/output.txt
@@ -0,0 +1,9 @@
+[
+  {
+    "sandboxId": "happy-panda-1234",
+    "status": "Running",
+    "gatewayHost": "uw2.dbrx.dev",
+    "name": "my-project",
+    "idleTimeout": "900s"
+  }
+]
diff --git a/acceptance/cmd/sandbox/list/json/script b/acceptance/cmd/sandbox/list/json/script
new file mode 100644
index 00000000000..51428a8b5a9
--- /dev/null
+++ b/acceptance/cmd/sandbox/list/json/script
@@ -0,0 +1 @@
+$CLI sandbox list --json
diff --git a/acceptance/cmd/sandbox/list/json/test.toml b/acceptance/cmd/sandbox/list/json/test.toml
new file mode 100644
index 00000000000..cf34c1a8265
--- /dev/null
+++ b/acceptance/cmd/sandbox/list/json/test.toml
@@ -0,0 +1,15 @@
+[[Server]]
+Pattern = "GET /api/2.0/lakebox/sandboxes"
+Response.Body = '''
+{
+  "sandboxes": [
+    {
+      "sandboxId": "happy-panda-1234",
+      "status": "Running",
+      "name": "my-project",
+      "gatewayHost": "uw2.dbrx.dev",
+      "idleTimeout": "900s"
+    }
+  ]
+}
+'''
diff --git a/acceptance/cmd/sandbox/list/region-unavailable/out.test.toml b/acceptance/cmd/sandbox/list/region-unavailable/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/sandbox/list/region-unavailable/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/sandbox/list/region-unavailable/output.txt b/acceptance/cmd/sandbox/list/region-unavailable/output.txt
new file mode 100644
index 00000000000..442893cfc69
--- /dev/null
+++ b/acceptance/cmd/sandbox/list/region-unavailable/output.txt
@@ -0,0 +1,3 @@
+Error: failed to list sandboxes: the Databricks Sandbox feature is not available in your region. See https://docs.databricks.com/compute/serverless/sandbox
+
+Exit code: 1
diff --git a/acceptance/cmd/sandbox/list/region-unavailable/script b/acceptance/cmd/sandbox/list/region-unavailable/script
new file mode 100644
index 00000000000..62cc0f91e47
--- /dev/null
+++ b/acceptance/cmd/sandbox/list/region-unavailable/script
@@ -0,0 +1 @@
+errcode $CLI sandbox list
diff --git a/acceptance/cmd/sandbox/list/region-unavailable/test.toml b/acceptance/cmd/sandbox/list/region-unavailable/test.toml
new file mode 100644
index 00000000000..fc08c98d7ce
--- /dev/null
+++ b/acceptance/cmd/sandbox/list/region-unavailable/test.toml
@@ -0,0 +1,6 @@
+# A persistent 503 is retried max503Attempts times, then reported as a
+# user-facing unavailability error.
+[[Server]]
+Pattern = "GET /api/2.0/lakebox/sandboxes"
+Response.StatusCode = 503
+Response.Body = 'no healthy upstream'
diff --git a/acceptance/cmd/sandbox/list/with-entries/out.test.toml b/acceptance/cmd/sandbox/list/with-entries/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/sandbox/list/with-entries/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/sandbox/list/with-entries/output.txt b/acceptance/cmd/sandbox/list/with-entries/output.txt
new file mode 100644
index 00000000000..cba9c409dc9
--- /dev/null
+++ b/acceptance/cmd/sandbox/list/with-entries/output.txt
@@ -0,0 +1,7 @@
+
+  ID                    NAME          STATUS      AUTOSTOP    DEFAULT
+  ───────────────────────────────────────────────────────────────────
+  happy-panda-1234      my-project    running     15m         
+  sad-otter-5678        -             stopped     10m         
+  creating-newt-9999    -             creating…   never       
+
diff --git a/acceptance/cmd/sandbox/list/with-entries/script b/acceptance/cmd/sandbox/list/with-entries/script
new file mode 100644
index 00000000000..35e7b078d4a
--- /dev/null
+++ b/acceptance/cmd/sandbox/list/with-entries/script
@@ -0,0 +1 @@
+$CLI sandbox list
diff --git a/acceptance/cmd/sandbox/list/with-entries/test.toml b/acceptance/cmd/sandbox/list/with-entries/test.toml
new file mode 100644
index 00000000000..f78f911b2fd
--- /dev/null
+++ b/acceptance/cmd/sandbox/list/with-entries/test.toml
@@ -0,0 +1,29 @@
+[[Server]]
+Pattern = "GET /api/2.0/lakebox/sandboxes"
+Response.Body = '''
+{
+  "sandboxes": [
+    {
+      "sandboxId": "happy-panda-1234",
+      "status": "Running",
+      "name": "my-project",
+      "gatewayHost": "uw2.dbrx.dev",
+      "idleTimeout": "900s"
+    },
+    {
+      "sandboxId": "sad-otter-5678",
+      "status": "Stopped",
+      "name": "sad-otter-5678",
+      "gatewayHost": "uw2.dbrx.dev",
+      "idleTimeout": "600s"
+    },
+    {
+      "sandboxId": "creating-newt-9999",
+      "status": "Creating",
+      "name": "",
+      "gatewayHost": "uw2.dbrx.dev",
+      "noAutostop": true
+    }
+  ]
+}
+'''
diff --git a/acceptance/cmd/sandbox/register/success/out.test.toml b/acceptance/cmd/sandbox/register/success/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/sandbox/register/success/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/sandbox/register/success/output.txt b/acceptance/cmd/sandbox/register/success/output.txt
new file mode 100644
index 00000000000..3e7667a1b12
--- /dev/null
+++ b/acceptance/cmd/sandbox/register/success/output.txt
@@ -0,0 +1,9 @@
+  ✓ Generated SSH key at [TEST_TMP_DIR]/.ssh/sandbox_ed25519
+  ✓ SSH key registered
+  skipped SSH config update (non-interactive); re-run `databricks sandbox register` from a terminal to add the sandbox gateway block(s)
+
+  Run databricks sandbox create to provision your first sandbox.
+
+{
+  "[DATABRICKS_URL]": "us-west-2.service-direct.dev.databricks.com"
+}
diff --git a/acceptance/cmd/sandbox/register/success/script b/acceptance/cmd/sandbox/register/success/script
new file mode 100644
index 00000000000..774c6b5df16
--- /dev/null
+++ b/acceptance/cmd/sandbox/register/success/script
@@ -0,0 +1,6 @@
+$CLI sandbox register --name test-machine
+
+# Verify the gateway host was cached in the local state file.
+# The framework Ignores the .databricks directory by default, so we
+# print the cached value to stdout for assertion instead.
+cat "$HOME/.databricks/sandbox.json" | jq -r '.gatewayHosts // {}'
diff --git a/acceptance/cmd/sandbox/register/success/test.toml b/acceptance/cmd/sandbox/register/success/test.toml
new file mode 100644
index 00000000000..57f55ffe246
--- /dev/null
+++ b/acceptance/cmd/sandbox/register/success/test.toml
@@ -0,0 +1,15 @@
+[[Server]]
+Pattern = "POST /api/2.0/lakebox/ssh-keys"
+Response.Body = '''
+{
+  "keyHash": "a0b1c2d3e4f5a0b1c2d3e4f5a0b1c2d3",
+  "name": "test-machine",
+  "createTime": "2026-06-10T17:00:00Z",
+  "gatewayHost": "us-west-2.service-direct.dev.databricks.com"
+}
+'''
+
+# Pin the synthetic test hash to a stable placeholder.
+[[Repls]]
+Old = 'a0b1c2d3e4f5a0b1c2d3e4f5a0b1c2d3'
+New = '[KEY_HASH]'
diff --git a/acceptance/cmd/sandbox/script.prepare b/acceptance/cmd/sandbox/script.prepare
new file mode 100644
index 00000000000..2bcd215d8cb
--- /dev/null
+++ b/acceptance/cmd/sandbox/script.prepare
@@ -0,0 +1,11 @@
+# Isolate the sandbox state file (~/.databricks/sandbox.json) per test
+# by pointing the home directory at this test's unique TEST_TMP_DIR.
+# Without this, parallel sandbox tests race each other writing to the
+# shared home's state file and one read sees the other's half-written
+# content. Use sethome rather than a plain HOME export: the CLI resolves
+# the home via os.UserHomeDir(), which reads USERPROFILE on Windows and
+# ignores HOME, so exporting only HOME leaves Windows unisolated.
+# Auth is unaffected: the test framework passes DATABRICKS_HOST /
+# DATABRICKS_TOKEN explicitly via env, so the CLI doesn't fall back to
+# ~/.databrickscfg.
+sethome "$TEST_TMP_DIR"
diff --git a/acceptance/cmd/sandbox/ssh-key/delete/success/out.test.toml b/acceptance/cmd/sandbox/ssh-key/delete/success/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/sandbox/ssh-key/delete/success/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/sandbox/ssh-key/delete/success/output.txt b/acceptance/cmd/sandbox/ssh-key/delete/success/output.txt
new file mode 100644
index 00000000000..c306c9ab582
--- /dev/null
+++ b/acceptance/cmd/sandbox/ssh-key/delete/success/output.txt
@@ -0,0 +1 @@
+  ✓ SSH key [KEY_HASH] deleted
diff --git a/acceptance/cmd/sandbox/ssh-key/delete/success/script b/acceptance/cmd/sandbox/ssh-key/delete/success/script
new file mode 100644
index 00000000000..a8da539e22e
--- /dev/null
+++ b/acceptance/cmd/sandbox/ssh-key/delete/success/script
@@ -0,0 +1 @@
+$CLI sandbox ssh-key delete 98b3b2bce82049769b4ba03990460d09
diff --git a/acceptance/cmd/sandbox/ssh-key/delete/success/test.toml b/acceptance/cmd/sandbox/ssh-key/delete/success/test.toml
new file mode 100644
index 00000000000..2cdf0a7f67b
--- /dev/null
+++ b/acceptance/cmd/sandbox/ssh-key/delete/success/test.toml
@@ -0,0 +1,8 @@
+[[Server]]
+Pattern = "DELETE /api/2.0/lakebox/ssh-keys/98b3b2bce82049769b4ba03990460d09"
+Response.Body = '{}'
+
+# See ssh-key/list/with-entries/test.toml for why we pin the hash.
+[[Repls]]
+Old = '98b3b2bce82049769b4ba03990460d09'
+New = '[KEY_HASH]'
diff --git a/acceptance/cmd/sandbox/ssh-key/list/empty/out.test.toml b/acceptance/cmd/sandbox/ssh-key/list/empty/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/sandbox/ssh-key/list/empty/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/sandbox/ssh-key/list/empty/output.txt b/acceptance/cmd/sandbox/ssh-key/list/empty/output.txt
new file mode 100644
index 00000000000..1c001545a08
--- /dev/null
+++ b/acceptance/cmd/sandbox/ssh-key/list/empty/output.txt
@@ -0,0 +1 @@
+  No SSH keys registered. Run 'databricks sandbox register' to add one.
diff --git a/acceptance/cmd/sandbox/ssh-key/list/empty/script b/acceptance/cmd/sandbox/ssh-key/list/empty/script
new file mode 100644
index 00000000000..2227721682f
--- /dev/null
+++ b/acceptance/cmd/sandbox/ssh-key/list/empty/script
@@ -0,0 +1 @@
+$CLI sandbox ssh-key list
diff --git a/acceptance/cmd/sandbox/ssh-key/list/empty/test.toml b/acceptance/cmd/sandbox/ssh-key/list/empty/test.toml
new file mode 100644
index 00000000000..af48bfff188
--- /dev/null
+++ b/acceptance/cmd/sandbox/ssh-key/list/empty/test.toml
@@ -0,0 +1,3 @@
+[[Server]]
+Pattern = "GET /api/2.0/lakebox/ssh-keys"
+Response.Body = '{"sshKeys": []}'
diff --git a/acceptance/cmd/sandbox/ssh-key/list/with-entries/out.test.toml b/acceptance/cmd/sandbox/ssh-key/list/with-entries/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/sandbox/ssh-key/list/with-entries/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/sandbox/ssh-key/list/with-entries/output.txt b/acceptance/cmd/sandbox/ssh-key/list/with-entries/output.txt
new file mode 100644
index 00000000000..b198e8794a2
--- /dev/null
+++ b/acceptance/cmd/sandbox/ssh-key/list/with-entries/output.txt
@@ -0,0 +1,8 @@
+
+    NAME      KEY HASH                          CREATED               LAST USED
+    ──────────────────────────────────────────────────────────────────────────────────────
+    laptop    [KEY_HASH_1]  2026-05-29 17:18      2026-05-29 17:19
+    (unset)   [KEY_HASH_2]  2026-05-12 21:31      2026-05-29 17:13
+
+  (no local sandbox key on this machine — run `databricks sandbox register` to create and register one)
+
diff --git a/acceptance/cmd/sandbox/ssh-key/list/with-entries/script b/acceptance/cmd/sandbox/ssh-key/list/with-entries/script
new file mode 100644
index 00000000000..2227721682f
--- /dev/null
+++ b/acceptance/cmd/sandbox/ssh-key/list/with-entries/script
@@ -0,0 +1 @@
+$CLI sandbox ssh-key list
diff --git a/acceptance/cmd/sandbox/ssh-key/list/with-entries/test.toml b/acceptance/cmd/sandbox/ssh-key/list/with-entries/test.toml
new file mode 100644
index 00000000000..2baaabd30e1
--- /dev/null
+++ b/acceptance/cmd/sandbox/ssh-key/list/with-entries/test.toml
@@ -0,0 +1,30 @@
+[[Server]]
+Pattern = "GET /api/2.0/lakebox/ssh-keys"
+Response.Body = '''
+{
+  "sshKeys": [
+    {
+      "keyHash": "98b3b2bce82049769b4ba03990460d09",
+      "name": "laptop",
+      "createTime": "2026-05-29T17:18:00Z",
+      "lastUseTime": "2026-05-29T17:19:00Z",
+      "gatewayHost": "uw2.dbrx.dev"
+    },
+    {
+      "keyHash": "9e0fc7c899aeee6a462e3153aeae8f30",
+      "createTime": "2026-05-12T21:31:00Z",
+      "lastUseTime": "2026-05-29T17:13:00Z",
+      "gatewayHost": "uw2.dbrx.dev"
+    }
+  ]
+}
+'''
+
+# Pin our test hashes to stable placeholders.
+[[Repls]]
+Old = '98b3b2bce82049769b4ba03990460d09'
+New = '[KEY_HASH_1]'
+
+[[Repls]]
+Old = '9e0fc7c899aeee6a462e3153aeae8f30'
+New = '[KEY_HASH_2]'
diff --git a/acceptance/cmd/sandbox/start/already-running/out.test.toml b/acceptance/cmd/sandbox/start/already-running/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/sandbox/start/already-running/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/sandbox/start/already-running/output.txt b/acceptance/cmd/sandbox/start/already-running/output.txt
new file mode 100644
index 00000000000..14f2076c32d
--- /dev/null
+++ b/acceptance/cmd/sandbox/start/already-running/output.txt
@@ -0,0 +1 @@
+  ✓ Already running happy-panda-1234
diff --git a/acceptance/cmd/sandbox/start/already-running/script b/acceptance/cmd/sandbox/start/already-running/script
new file mode 100644
index 00000000000..d6c713a528b
--- /dev/null
+++ b/acceptance/cmd/sandbox/start/already-running/script
@@ -0,0 +1 @@
+$CLI sandbox start happy-panda-1234
diff --git a/acceptance/cmd/sandbox/start/already-running/test.toml b/acceptance/cmd/sandbox/start/already-running/test.toml
new file mode 100644
index 00000000000..6de67aaf48d
--- /dev/null
+++ b/acceptance/cmd/sandbox/start/already-running/test.toml
@@ -0,0 +1,10 @@
+[[Server]]
+Pattern = "POST /api/2.0/lakebox/sandboxes/happy-panda-1234/start"
+Response.Body = '''
+{
+  "sandboxId": "happy-panda-1234",
+  "status": "Running",
+  "name": "my-project",
+  "gatewayHost": "uw2.dbrx.dev"
+}
+'''
diff --git a/acceptance/cmd/sandbox/status/json/out.test.toml b/acceptance/cmd/sandbox/status/json/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/sandbox/status/json/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/sandbox/status/json/output.txt b/acceptance/cmd/sandbox/status/json/output.txt
new file mode 100644
index 00000000000..efabf824468
--- /dev/null
+++ b/acceptance/cmd/sandbox/status/json/output.txt
@@ -0,0 +1,7 @@
+{
+  "sandboxId": "happy-panda-1234",
+  "status": "Running",
+  "gatewayHost": "uw2.dbrx.dev",
+  "name": "my-project",
+  "idleTimeout": "1800s"
+}
diff --git a/acceptance/cmd/sandbox/status/json/script b/acceptance/cmd/sandbox/status/json/script
new file mode 100644
index 00000000000..da51d84a206
--- /dev/null
+++ b/acceptance/cmd/sandbox/status/json/script
@@ -0,0 +1 @@
+$CLI sandbox status happy-panda-1234 --json
diff --git a/acceptance/cmd/sandbox/status/json/test.toml b/acceptance/cmd/sandbox/status/json/test.toml
new file mode 100644
index 00000000000..aaa8c7754b7
--- /dev/null
+++ b/acceptance/cmd/sandbox/status/json/test.toml
@@ -0,0 +1,11 @@
+[[Server]]
+Pattern = "GET /api/2.0/lakebox/sandboxes/happy-panda-1234"
+Response.Body = '''
+{
+  "sandboxId": "happy-panda-1234",
+  "status": "Running",
+  "name": "my-project",
+  "gatewayHost": "uw2.dbrx.dev",
+  "idleTimeout": "1800s"
+}
+'''
diff --git a/acceptance/cmd/sandbox/status/not-found/out.test.toml b/acceptance/cmd/sandbox/status/not-found/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/sandbox/status/not-found/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/sandbox/status/not-found/output.txt b/acceptance/cmd/sandbox/status/not-found/output.txt
new file mode 100644
index 00000000000..235a49bc669
--- /dev/null
+++ b/acceptance/cmd/sandbox/status/not-found/output.txt
@@ -0,0 +1 @@
+Error: no sandbox named "no-such-box" — `databricks sandbox list` shows available IDs
diff --git a/acceptance/cmd/sandbox/status/not-found/script b/acceptance/cmd/sandbox/status/not-found/script
new file mode 100644
index 00000000000..26c78d32db7
--- /dev/null
+++ b/acceptance/cmd/sandbox/status/not-found/script
@@ -0,0 +1 @@
+musterr $CLI sandbox status no-such-box
diff --git a/acceptance/cmd/sandbox/status/not-found/test.toml b/acceptance/cmd/sandbox/status/not-found/test.toml
new file mode 100644
index 00000000000..3d2b831b415
--- /dev/null
+++ b/acceptance/cmd/sandbox/status/not-found/test.toml
@@ -0,0 +1,4 @@
+[[Server]]
+Pattern = "GET /api/2.0/lakebox/sandboxes/no-such-box"
+Response.StatusCode = 404
+Response.Body = '{"error_code": "NOT_FOUND", "message": "Sandbox not found"}'
diff --git a/acceptance/cmd/sandbox/status/running/out.test.toml b/acceptance/cmd/sandbox/status/running/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/sandbox/status/running/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/sandbox/status/running/output.txt b/acceptance/cmd/sandbox/status/running/output.txt
new file mode 100644
index 00000000000..1121ab9bc81
--- /dev/null
+++ b/acceptance/cmd/sandbox/status/running/output.txt
@@ -0,0 +1,7 @@
+
+  id         happy-panda-1234
+  name       my-project
+  status     running
+  gateway    uw2.dbrx.dev
+  autostop   30m
+
diff --git a/acceptance/cmd/sandbox/status/running/script b/acceptance/cmd/sandbox/status/running/script
new file mode 100644
index 00000000000..0be49f93434
--- /dev/null
+++ b/acceptance/cmd/sandbox/status/running/script
@@ -0,0 +1 @@
+$CLI sandbox status happy-panda-1234
diff --git a/acceptance/cmd/sandbox/status/running/test.toml b/acceptance/cmd/sandbox/status/running/test.toml
new file mode 100644
index 00000000000..aaa8c7754b7
--- /dev/null
+++ b/acceptance/cmd/sandbox/status/running/test.toml
@@ -0,0 +1,11 @@
+[[Server]]
+Pattern = "GET /api/2.0/lakebox/sandboxes/happy-panda-1234"
+Response.Body = '''
+{
+  "sandboxId": "happy-panda-1234",
+  "status": "Running",
+  "name": "my-project",
+  "gatewayHost": "uw2.dbrx.dev",
+  "idleTimeout": "1800s"
+}
+'''
diff --git a/acceptance/cmd/sandbox/stop/success/out.test.toml b/acceptance/cmd/sandbox/stop/success/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/sandbox/stop/success/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/sandbox/stop/success/output.txt b/acceptance/cmd/sandbox/stop/success/output.txt
new file mode 100644
index 00000000000..3a5b0fc2f05
--- /dev/null
+++ b/acceptance/cmd/sandbox/stop/success/output.txt
@@ -0,0 +1 @@
+  ✓ Stopped happy-panda-1234
diff --git a/acceptance/cmd/sandbox/stop/success/script b/acceptance/cmd/sandbox/stop/success/script
new file mode 100644
index 00000000000..f474a9592f1
--- /dev/null
+++ b/acceptance/cmd/sandbox/stop/success/script
@@ -0,0 +1 @@
+$CLI sandbox stop happy-panda-1234
diff --git a/acceptance/cmd/sandbox/stop/success/test.toml b/acceptance/cmd/sandbox/stop/success/test.toml
new file mode 100644
index 00000000000..224108fca78
--- /dev/null
+++ b/acceptance/cmd/sandbox/stop/success/test.toml
@@ -0,0 +1,9 @@
+[[Server]]
+Pattern = "POST /api/2.0/lakebox/sandboxes/happy-panda-1234/stop"
+Response.Body = '''
+{
+  "sandboxId": "happy-panda-1234",
+  "status": "Stopped",
+  "name": "my-project"
+}
+'''
diff --git a/acceptance/cmd/sandbox/test.toml b/acceptance/cmd/sandbox/test.toml
new file mode 100644
index 00000000000..10951253d38
--- /dev/null
+++ b/acceptance/cmd/sandbox/test.toml
@@ -0,0 +1,12 @@
+# Acceptance tests for `databricks sandbox` subcommands.
+#
+# Ignore the local state file the CLI writes (sandbox.json) and the
+# generated SSH key + managed SSH config — register-path tests would
+# otherwise produce these on every run.
+Ignore = [".databricks", ".ssh"]
+
+# Sandbox commands are independent of the bundle engine. Pin to a single
+# value so the two engines don't both run in parallel for every sandbox
+# test — when they did, they raced each other writing to the same
+# ~/.databricks/sandbox.json file. An empty list would run once locally
+# but on both direct and terraform CI runners, defeating the point.
diff --git a/acceptance/cmd/sync-from-file/gitignore.test-fixture b/acceptance/cmd/sync-from-file/gitignore.test-fixture
index eb483118609..48d52fd8cca 100644
--- a/acceptance/cmd/sync-from-file/gitignore.test-fixture
+++ b/acceptance/cmd/sync-from-file/gitignore.test-fixture
@@ -1,4 +1,3 @@
 ignored-folder/
 script
 output.txt
-repls.json
diff --git a/acceptance/cmd/sync-from-file/out.test.toml b/acceptance/cmd/sync-from-file/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/sync-from-file/out.test.toml
+++ b/acceptance/cmd/sync-from-file/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/sync-from-file/script b/acceptance/cmd/sync-from-file/script
index a9e9c2a587a..79e2da31231 100644
--- a/acceptance/cmd/sync-from-file/script
+++ b/acceptance/cmd/sync-from-file/script
@@ -1,3 +1,7 @@
+# Prevent Git Bash on Windows from converting the /Users/... sync target into a
+# Windows path (e.g. C:/Program Files/Git/Users/...) before the CLI sees it.
+export MSYS_NO_PATHCONV=1
+
 mkdir "project-folder" "project-folder/blob" "project-folder/static" "project-folder/static/folder1" "project-folder/static/folder2" "ignored-folder" "ignored-folder/folder1" "ignored-folder2" ".git"
 touch "project-folder/app.yaml" "project-folder/app.py" "project-folder/app2.py" "project-folder/query.sql" "project-folder/blob/1" "project-folder/blob/2" "ignored-folder2/app.py"
 touch "project-folder/static/folder1/1.txt" "project-folder/static/folder2/2.txt"
diff --git a/acceptance/cmd/sync-without-args/out.test.toml b/acceptance/cmd/sync-without-args/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/sync-without-args/out.test.toml
+++ b/acceptance/cmd/sync-without-args/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/sync-without-args/output.txt b/acceptance/cmd/sync-without-args/output.txt
index 5d63d426c67..6c757495507 100644
--- a/acceptance/cmd/sync-without-args/output.txt
+++ b/acceptance/cmd/sync-without-args/output.txt
@@ -1,5 +1,5 @@
 
->>> errcode [CLI] sync
+>>> musterr [CLI] sync
 Error: accepts 2 arg(s), received 0
 
 Usage:
@@ -14,13 +14,11 @@ Flags:
       --include strings       patterns to include in sync (can be specified multiple times)
       --include-from string   file containing patterns to include to sync (one pattern per line)
       --interval duration     file system polling interval (for --watch) (default 1s)
-      --output type           type of output format (default text)
       --watch                 watch local file system for changes
 
 Global Flags:
       --debug            enable debug logging
+  -o, --output type      output type: text or json (default text)
   -p, --profile string   ~/.databrickscfg profile
   -t, --target string    bundle target to use (if applicable)
 
-
-Exit code: 1
diff --git a/acceptance/cmd/sync-without-args/script b/acceptance/cmd/sync-without-args/script
index 8528cd34ab0..0841a0d4ca8 100644
--- a/acceptance/cmd/sync-without-args/script
+++ b/acceptance/cmd/sync-without-args/script
@@ -1 +1 @@
-trace errcode $CLI sync
+trace musterr $CLI sync
diff --git a/acceptance/cmd/sync/dryrun-missing-remote/hello.py b/acceptance/cmd/sync/dryrun-missing-remote/hello.py
new file mode 100644
index 00000000000..11b15b1a458
--- /dev/null
+++ b/acceptance/cmd/sync/dryrun-missing-remote/hello.py
@@ -0,0 +1 @@
+print("hello")
diff --git a/acceptance/cmd/sync/dryrun-missing-remote/out.test.toml b/acceptance/cmd/sync/dryrun-missing-remote/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/sync/dryrun-missing-remote/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/sync/dryrun-missing-remote/output.txt b/acceptance/cmd/sync/dryrun-missing-remote/output.txt
new file mode 100644
index 00000000000..b7453994b58
--- /dev/null
+++ b/acceptance/cmd/sync/dryrun-missing-remote/output.txt
@@ -0,0 +1,27 @@
+
+>>> [CLI] sync . /Users/[USERNAME]/missing-dir-[UNIQUE_NAME] --dry-run
+Warn: Running in dry-run mode. No actual changes will be made.
+Initial Sync Complete
+Uploaded .gitignore
+Uploaded hello.py
+
+>>> print_requests.py --sort //api/
+
+>>> [CLI] sync . /Users/[USERNAME]/missing-dir-[UNIQUE_NAME]
+Initial Sync Complete
+Uploaded .gitignore
+Uploaded hello.py
+
+>>> print_requests.py --sort //api/
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/import"
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/import"
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace/mkdirs"
+}
diff --git a/acceptance/cmd/sync/dryrun-missing-remote/script b/acceptance/cmd/sync/dryrun-missing-remote/script
new file mode 100644
index 00000000000..96ad29a2426
--- /dev/null
+++ b/acceptance/cmd/sync/dryrun-missing-remote/script
@@ -0,0 +1,26 @@
+mkdir .git
+cat > .gitignore << EOF
+.databricks/
+EOF
+
+# Use an ephemeral remote directory so concurrent test runs do not interfere.
+remote_dir="/Users/$CURRENT_USER_NAME/missing-dir-$UNIQUE_NAME"
+
+cleanup() {
+  MSYS_NO_PATHCONV=1 $CLI workspace delete --recursive "$remote_dir" 2>/dev/null || true
+  rm -rf .git .gitignore .databricks "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+# A dry run must not create the missing remote dir or upload anything.
+# Note: output line starting with Action lists files in non-deterministic order so we filter it out
+# MSYS_NO_PATHCONV=1 prevents Git Bash on Windows from converting /Users/... to C:/Program Files/Git/Users/...
+# It is set per-command, not exported for the whole script: a global setting also
+# breaks Git Bash's path resolution of the print_requests.py helper below.
+MSYS_NO_PATHCONV=1 trace $CLI sync . "$remote_dir" --dry-run | grep -v "^Action" | sort
+
+trace print_requests.py --sort //api/ | jq '{method, path}'
+
+MSYS_NO_PATHCONV=1 trace $CLI sync . "$remote_dir" | grep -v "^Action" | sort
+
+trace print_requests.py --sort //api/ | jq '{method, path}'
diff --git a/acceptance/cmd/sync/dryrun-missing-remote/test.toml b/acceptance/cmd/sync/dryrun-missing-remote/test.toml
new file mode 100644
index 00000000000..159efe02696
--- /dev/null
+++ b/acceptance/cmd/sync/dryrun-missing-remote/test.toml
@@ -0,0 +1 @@
+RecordRequests = true
diff --git a/acceptance/cmd/sync/dryrun/out.test.toml b/acceptance/cmd/sync/dryrun/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/sync/dryrun/out.test.toml
+++ b/acceptance/cmd/sync/dryrun/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/sync/dryrun/script b/acceptance/cmd/sync/dryrun/script
index 75e217400ef..46e48f1c8d9 100644
--- a/acceptance/cmd/sync/dryrun/script
+++ b/acceptance/cmd/sync/dryrun/script
@@ -1,11 +1,12 @@
+# Prevent Git Bash on Windows from converting the /Users/... sync target into a
+# Windows path (e.g. C:/Program Files/Git/Users/...) before the CLI sees it.
+export MSYS_NO_PATHCONV=1
+
 mkdir "project-folder" "ignored-folder" "ignored-folder/folder1" ".git"
 touch "project-folder/app.yaml" "project-folder/app.py" "project-folder/query.sql"
 touch "ignored-folder/script.py" "ignored-folder/folder1/script.py" "ignored-folder/folder1/script.yaml" "ignored-folder/folder1/big-blob"
 cat > .gitignore << EOF
 ignored-folder/
-script
-output.txt
-repls.json
 EOF
 
 cleanup() {
diff --git a/acceptance/cmd/sync/get-status-504/hello.py b/acceptance/cmd/sync/get-status-504/hello.py
new file mode 100644
index 00000000000..11b15b1a458
--- /dev/null
+++ b/acceptance/cmd/sync/get-status-504/hello.py
@@ -0,0 +1 @@
+print("hello")
diff --git a/acceptance/cmd/sync/get-status-504/out.test.toml b/acceptance/cmd/sync/get-status-504/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/sync/get-status-504/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/sync/get-status-504/output.txt b/acceptance/cmd/sync/get-status-504/output.txt
new file mode 100644
index 00000000000..863d79b61d2
--- /dev/null
+++ b/acceptance/cmd/sync/get-status-504/output.txt
@@ -0,0 +1,4 @@
+Warn: retrying after 504 Gateway Timeout from GET /api/2.0/workspace/get-status
+Action: PUT: hello.py
+Uploaded hello.py
+Initial Sync Complete
diff --git a/acceptance/cmd/sync/get-status-504/script b/acceptance/cmd/sync/get-status-504/script
new file mode 100644
index 00000000000..2b101d707c7
--- /dev/null
+++ b/acceptance/cmd/sync/get-status-504/script
@@ -0,0 +1,22 @@
+# .gitignore excludes itself and .databricks/ so that hello.py is the only synced file.
+mkdir .git
+cat > .gitignore << EOF2
+.databricks/
+.gitignore
+EOF2
+
+# Use an ephemeral remote directory so concurrent test runs do not interfere.
+remote_dir="/Users/$CURRENT_USER_NAME/sync-getstatus-504-$UNIQUE_NAME"
+
+cleanup() {
+  MSYS_NO_PATHCONV=1 $CLI workspace delete --recursive "$remote_dir" 2>/dev/null || true
+  rm -rf .git .gitignore .databricks
+}
+trap cleanup EXIT
+
+# Inject a single 504 on the first workspace get-status, the call that validates the sync
+# target (issue #6472). The read has no side effects, so it is retried and the sync succeeds.
+fault.py "GET /api/2.0/workspace/get-status" 504 0 1
+
+# MSYS_NO_PATHCONV=1 prevents Git Bash on Windows from converting /Users/... to C:/Program Files/Git/Users/...
+MSYS_NO_PATHCONV=1 $CLI sync . "$remote_dir"
diff --git a/acceptance/cmd/sync/get-status-504/test.toml b/acceptance/cmd/sync/get-status-504/test.toml
new file mode 100644
index 00000000000..838bbee034f
--- /dev/null
+++ b/acceptance/cmd/sync/get-status-504/test.toml
@@ -0,0 +1,2 @@
+Env.DATABRICKS_BUNDLE_RETRY_INTERVAL_MS = "100"
+Env.DATABRICKS_BUNDLE_RETRY_DISABLE_WARNING = ""
diff --git a/acceptance/cmd/sync/out.test.toml b/acceptance/cmd/sync/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/sync/out.test.toml
+++ b/acceptance/cmd/sync/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/sync/output.txt b/acceptance/cmd/sync/output.txt
index 04fb43abacd..2978ee5f328 100644
--- a/acceptance/cmd/sync/output.txt
+++ b/acceptance/cmd/sync/output.txt
@@ -1,14 +1,27 @@
 
 >>> [CLI] sync . /Users/[USERNAME]
-Action: PUT: .gitignore, dryrun/out.test.toml, project-folder/app.py, project-folder/app.yaml, project-folder/query.sql
+Action: PUT: .gitignore, dryrun-missing-remote/hello.py, dryrun-missing-remote/out.test.toml, dryrun-missing-remote/output.txt, dryrun/out.test.toml, dryrun/output.txt, get-status-504/hello.py, get-status-504/out.test.toml, get-status-504/output.txt, project-folder/app.py, project-folder/app.yaml, project-folder/query.sql, upload-504/hello.py, upload-504/out.test.toml, upload-504/output.txt
 Initial Sync Complete
 Uploaded .gitignore
 Uploaded dryrun
+Uploaded dryrun-missing-remote
+Uploaded dryrun-missing-remote/hello.py
+Uploaded dryrun-missing-remote/out.test.toml
+Uploaded dryrun-missing-remote/output.txt
 Uploaded dryrun/out.test.toml
+Uploaded dryrun/output.txt
+Uploaded get-status-504
+Uploaded get-status-504/hello.py
+Uploaded get-status-504/out.test.toml
+Uploaded get-status-504/output.txt
 Uploaded project-folder
 Uploaded project-folder/app.py
 Uploaded project-folder/app.yaml
 Uploaded project-folder/query.sql
+Uploaded upload-504
+Uploaded upload-504/hello.py
+Uploaded upload-504/out.test.toml
+Uploaded upload-504/output.txt
 
 >>> [CLI] sync . /Users/[USERNAME] --exclude project-folder/app.*
 Action: DELETE: project-folder/app.py, project-folder/app.yaml
diff --git a/acceptance/cmd/sync/script b/acceptance/cmd/sync/script
index 15d98f11b1e..f505b4024ab 100644
--- a/acceptance/cmd/sync/script
+++ b/acceptance/cmd/sync/script
@@ -1,11 +1,12 @@
+# Prevent Git Bash on Windows from converting the /Users/... sync target into a
+# Windows path (e.g. C:/Program Files/Git/Users/...) before the CLI sees it.
+export MSYS_NO_PATHCONV=1
+
 mkdir "project-folder" "ignored-folder" "ignored-folder/folder1" ".git"
 touch "project-folder/app.yaml" "project-folder/app.py" "project-folder/query.sql"
 touch "ignored-folder/script.py" "ignored-folder/folder1/script.py" "ignored-folder/folder1/script.yaml" "ignored-folder/folder1/big-blob"
 cat > .gitignore << EOF
 ignored-folder/
-script
-output.txt
-repls.json
 EOF
 
 cleanup() {
diff --git a/acceptance/cmd/sync/upload-504/hello.py b/acceptance/cmd/sync/upload-504/hello.py
new file mode 100644
index 00000000000..11b15b1a458
--- /dev/null
+++ b/acceptance/cmd/sync/upload-504/hello.py
@@ -0,0 +1 @@
+print("hello")
diff --git a/acceptance/cmd/sync/upload-504/out.test.toml b/acceptance/cmd/sync/upload-504/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/sync/upload-504/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/sync/upload-504/output.txt b/acceptance/cmd/sync/upload-504/output.txt
new file mode 100644
index 00000000000..cb9b61d2b0c
--- /dev/null
+++ b/acceptance/cmd/sync/upload-504/output.txt
@@ -0,0 +1,6 @@
+Action: PUT: hello.py
+Warn: retrying after 504 Gateway Timeout from POST /api/2.0/workspace/import: failed to upload /Users/[USERNAME]/sync-504-[UNIQUE_NAME]/hello.py: Fault injected by test.
+Uploaded hello.py
+Initial Sync Complete
+/Users/[USERNAME]/sync-504-[UNIQUE_NAME]/hello.py
+/Users/[USERNAME]/sync-504-[UNIQUE_NAME]/hello.py
diff --git a/acceptance/cmd/sync/upload-504/script b/acceptance/cmd/sync/upload-504/script
new file mode 100644
index 00000000000..3be71acff67
--- /dev/null
+++ b/acceptance/cmd/sync/upload-504/script
@@ -0,0 +1,24 @@
+# .gitignore excludes itself so that hello.py is the only uploaded file and the injected fault always hits it.
+mkdir .git
+cat > .gitignore << EOF2
+.databricks/
+.gitignore
+EOF2
+
+# Use an ephemeral remote directory so concurrent test runs do not interfere.
+remote_dir="/Users/$CURRENT_USER_NAME/sync-504-$UNIQUE_NAME"
+
+cleanup() {
+  MSYS_NO_PATHCONV=1 $CLI workspace delete --recursive "$remote_dir" 2>/dev/null || true
+  rm -rf .git .gitignore .databricks "$OUT_REQUESTS"
+}
+trap cleanup EXIT
+
+# Inject a single 504 on the first file upload. Uploads overwrite, so they are retried and the sync succeeds.
+fault.py "POST /api/2.0/workspace/import" 504 0 1
+
+# MSYS_NO_PATHCONV=1 prevents Git Bash on Windows from converting /Users/... to C:/Program Files/Git/Users/...
+MSYS_NO_PATHCONV=1 $CLI sync . "$remote_dir"
+
+# Two requests for hello.py should appear: the initial 504 and the successful retry.
+print_requests.py //api/2.0/workspace/import | jq -r .body.multipart_form.path
diff --git a/acceptance/cmd/sync/upload-504/test.toml b/acceptance/cmd/sync/upload-504/test.toml
new file mode 100644
index 00000000000..7d496b2f139
--- /dev/null
+++ b/acceptance/cmd/sync/upload-504/test.toml
@@ -0,0 +1,3 @@
+RecordRequests = true
+Env.DATABRICKS_BUNDLE_RETRY_INTERVAL_MS = "100"
+Env.DATABRICKS_BUNDLE_RETRY_DISABLE_WARNING = ""
diff --git a/acceptance/cmd/unknown-subcommand/out.test.toml b/acceptance/cmd/unknown-subcommand/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/unknown-subcommand/out.test.toml
+++ b/acceptance/cmd/unknown-subcommand/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/unknown-subcommand/output.txt b/acceptance/cmd/unknown-subcommand/output.txt
index 14bd12a4755..acaad967bdb 100644
--- a/acceptance/cmd/unknown-subcommand/output.txt
+++ b/acceptance/cmd/unknown-subcommand/output.txt
@@ -2,14 +2,14 @@
 >>> errcode [CLI] secrets list-scopes
 Scope  Backend Type
 
->>> errcode [CLI] secrets unknown
+>>> musterr [CLI] secrets unknown
 Error: unknown command "unknown" for "databricks secrets"
 
 Usage:
   databricks secrets [flags]
   databricks secrets [command]
 
-Available Commands
+Available Commands:
   create-scope  Create a new secret scope.
   delete-acl    Delete an ACL.
   delete-scope  Delete a secret scope.
@@ -33,5 +33,3 @@ Global Flags:
 
 Use "databricks secrets [command] --help" for more information about a command.
 
-
-Exit code: 1
diff --git a/acceptance/cmd/unknown-subcommand/script b/acceptance/cmd/unknown-subcommand/script
index 9e7cda66c7a..c36d69ac010 100644
--- a/acceptance/cmd/unknown-subcommand/script
+++ b/acceptance/cmd/unknown-subcommand/script
@@ -1,2 +1,2 @@
 trace errcode $CLI secrets list-scopes
-trace errcode $CLI secrets unknown
+trace musterr $CLI secrets unknown
diff --git a/acceptance/cmd/unknown-subcommand/test.toml b/acceptance/cmd/unknown-subcommand/test.toml
index 607065f4534..630ae4d78b8 100644
--- a/acceptance/cmd/unknown-subcommand/test.toml
+++ b/acceptance/cmd/unknown-subcommand/test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
 
 [[Server]]
diff --git a/acceptance/cmd/version/out.test.toml b/acceptance/cmd/version/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/version/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/version/output.txt b/acceptance/cmd/version/output.txt
new file mode 100644
index 00000000000..c34d5ba5254
--- /dev/null
+++ b/acceptance/cmd/version/output.txt
@@ -0,0 +1,20 @@
+
+=== version stays lightweight
+
+>>> [CLI] version
+Databricks CLI v[CLI_VERSION]
+
+=== version --check
+
+>>> [CLI] version --check
+Databricks CLI v[CLI_VERSION]
+This is a development build; skipping the update check.
+
+=== version --check --output json
+
+>>> [CLI] version --check --output json
+{
+  "current_version": "[CLI_VERSION]",
+  "update_available": false,
+  "development_build": true
+}
diff --git a/acceptance/cmd/version/script b/acceptance/cmd/version/script
new file mode 100644
index 00000000000..d4e36422ed0
--- /dev/null
+++ b/acceptance/cmd/version/script
@@ -0,0 +1,10 @@
+title "version stays lightweight\n"
+trace $CLI version
+
+# The acceptance binary is a development build, so the check short-circuits
+# without contacting GitHub. This exercises command wiring and output rendering.
+title "version --check\n"
+trace $CLI version --check
+
+title "version --check --output json\n"
+trace $CLI version --check --output json
diff --git a/acceptance/cmd/workspace/apps/out.requests.txt b/acceptance/cmd/workspace/apps/out.requests.txt
deleted file mode 100644
index ba4cf8bd6e4..00000000000
--- a/acceptance/cmd/workspace/apps/out.requests.txt
+++ /dev/null
@@ -1,46 +0,0 @@
-{
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/apps",
-  "body": {
-    "description": "My app description.",
-    "name": "test-name",
-    "resources": [
-      {
-        "description": "API key for external service.",
-        "name": "api-key",
-        "secret": {
-          "key": "my-key",
-          "permission": "READ",
-          "scope": "my-scope"
-        }
-      }
-    ]
-  }
-}
-{
-  "method": "GET",
-  "path": "/api/2.0/apps/test-name"
-}
-{
-  "method": "PATCH",
-  "path": "/api/2.0/apps/test-name",
-  "body": {
-    "description": "My app description.",
-    "name": "test-name",
-    "resources": [
-      {
-        "description": "API key for external service.",
-        "name": "api-key",
-        "secret": {
-          "key": "my-key",
-          "permission": "READ",
-          "scope": "my-scope"
-        }
-      }
-    ]
-  }
-}
diff --git a/acceptance/cmd/workspace/apps/out.test.toml b/acceptance/cmd/workspace/apps/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/workspace/apps/out.test.toml
+++ b/acceptance/cmd/workspace/apps/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/workspace/apps/output.txt b/acceptance/cmd/workspace/apps/output.txt
index 8d6fd58c574..3fe9bf974c0 100644
--- a/acceptance/cmd/workspace/apps/output.txt
+++ b/acceptance/cmd/workspace/apps/output.txt
@@ -3,7 +3,7 @@
 >>> [CLI] apps create --json @input.json
 {
   "active_deployment": {
-    "deployment_id": "deploy-[NUMID]",
+    "deployment_id": "deploy-[DEPLOYMENT_ID]",
     "source_code_path": "/Workspace/Users/[USERNAME]/test-name",
     "status": {
       "message": "Deployment succeeded",
@@ -21,6 +21,7 @@
   },
   "default_source_code_path": "/Workspace/Users/[USERNAME]/test-name",
   "description": "My app description.",
+  "forward_user_access_token": true,
   "id": "1000",
   "name": "test-name",
   "resources": [
@@ -35,7 +36,7 @@
     }
   ],
   "service_principal_client_id": "[UUID]",
-  "service_principal_id": [NUMID],
+  "service_principal_id": [SERVICE_PRINCIPAL_ID],
   "service_principal_name": "app-test-name",
   "url": "test-name-123.cloud.databricksapps.com"
 }
@@ -44,7 +45,7 @@
 >>> [CLI] apps update test-name --json @input.json
 {
   "active_deployment": {
-    "deployment_id": "deploy-[NUMID]",
+    "deployment_id": "deploy-[DEPLOYMENT_ID]",
     "source_code_path": "/Workspace/Users/[USERNAME]/test-name",
     "status": {
       "message": "Deployment succeeded",
@@ -62,6 +63,7 @@
   },
   "default_source_code_path": "/Workspace/Users/[USERNAME]/test-name",
   "description": "My app description.",
+  "forward_user_access_token": true,
   "id": "1001",
   "name": "test-name",
   "resources": [
@@ -76,7 +78,7 @@
     }
   ],
   "service_principal_client_id": "[UUID]",
-  "service_principal_id": [NUMID],
+  "service_principal_id": [SERVICE_PRINCIPAL_ID],
   "service_principal_name": "app-test-name",
   "url": "test-name-123.cloud.databricksapps.com"
 }
@@ -89,12 +91,23 @@ Usage:
   databricks apps update NAME [flags]
 
 Flags:
-      --budget-policy-id string    
-      --compute-size ComputeSize   Supported values: [LARGE, MEDIUM]
-      --description string         The description of the app.
-  -h, --help                       help for update
-      --json JSON                  either inline JSON string or @path/to/file.json with request body (default JSON (0 bytes))
-      --space string               Name of the space this app belongs to.
+      --budget-policy-id string       
+      --compute-max-instances int     Maximum number of app instances the app is configured to run.
+      --compute-min-instances int     Minimum number of app instances the app is configured to run.
+      --compute-size ComputeSize      Supported values: [LARGE, MEDIUM, XLARGE]
+      --description string            The description of the app.
+      --forward-user-access-token     Forward the user's access token to the app.
+      --git-auto-deploy               Automatically redeploy the app on pushes to the configured Git branch. Requires --git-url and --git-provider.
+      --git-branch string             Git branch to deploy from.
+      --git-commit string             Git commit SHA to deploy from.
+      --git-provider string           Git provider. Case insensitive. Supported values: gitHub, gitHubEnterprise, bitbucketCloud, bitbucketServer, azureDevOpsServices, gitLab, gitLabEnterpriseEdition, awsCodeCommit.
+      --git-source-code-path string   Relative path to the app source code within the Git repository. Defaults to the repository root.
+      --git-tag string                Git tag to deploy from.
+      --git-url string                URL of the Git repository the app deploys from.
+  -h, --help                          help for update
+      --json JSON                     either inline JSON string or @path/to/file.json with request body (default JSON (0 bytes))
+      --source-code-path string       
+      --space string                  Name of the space this app belongs to.
       --usage-policy-id string
 
 Global Flags:
diff --git a/acceptance/cmd/workspace/apps/run-local-node/app/.npmrc b/acceptance/cmd/workspace/apps/run-local-node/app/.npmrc
new file mode 100644
index 00000000000..c43162960a8
--- /dev/null
+++ b/acceptance/cmd/workspace/apps/run-local-node/app/.npmrc
@@ -0,0 +1,3 @@
+; With nothing to install, the one thing npm still reaches the registry for is its check for
+; a newer npm, and the acceptance proxy rejects that. The install and the audit stay local.
+update-notifier=false
diff --git a/acceptance/cmd/workspace/apps/run-local-node/app/app.js b/acceptance/cmd/workspace/apps/run-local-node/app/app.js
index 74686d09a82..4e47e5c9cda 100644
--- a/acceptance/cmd/workspace/apps/run-local-node/app/app.js
+++ b/acceptance/cmd/workspace/apps/run-local-node/app/app.js
@@ -1,27 +1,26 @@
-const express = require('express');
-const app = express();
-const port = process.env.PORT || 8000;
+const http = require('node:http');
 
-// Root route
-app.get('/', (req, res) => {
-  res.json({
-    message: 'Hello From App',
-    timestamp: new Date().toISOString(),
-    status: 'running'
-  });
-});
+// Standard library only: acceptance tests run with the network disabled, so the
+// app cannot install anything from the NPM registry.
+
+// The CLI sets PORT alongside DATABRICKS_APP_PORT. Unset, listen() would pick a random port
+// and the run would fail as a proxy timeout instead.
+const port = process.env.PORT;
+if (!port) throw new Error('PORT is not set');
 
-app.get('/shutdown', (req, res) => {
-  console.log('Server closed')
-  // Add a small delay to ensure response is sent before exit
-  setTimeout(() => {
-    process.exit(0);
-  }, 1000);
+const server = http.createServer((req, res) => {
+  if (req.url === '/shutdown') {
+    // close() waits for open connections, so the response must end this one or the proxy holds it.
+    res.setHeader('Connection', 'close');
+    res.end();
+    server.close();
+    return;
+  }
+
+  res.writeHead(200, { 'Content-Type': 'application/json' });
+  res.end(JSON.stringify({ message: 'Hello From App' }) + '\n');
 });
 
-// Start the server
-app.listen(port, () => {
+server.listen(port, '127.0.0.1', () => {
   console.log(`Server is running on port ${port}`);
 });
-
-module.exports = app;
diff --git a/acceptance/cmd/workspace/apps/run-local-node/app/app.yml b/acceptance/cmd/workspace/apps/run-local-node/app/app.yml
index bc02e198203..8acf26d0927 100644
--- a/acceptance/cmd/workspace/apps/run-local-node/app/app.yml
+++ b/acceptance/cmd/workspace/apps/run-local-node/app/app.yml
@@ -1,4 +1,3 @@
 command:
-  - npm
-  - run
-  - run-app
+  - node
+  - app.js
diff --git a/acceptance/cmd/workspace/apps/run-local-node/app/build.js b/acceptance/cmd/workspace/apps/run-local-node/app/build.js
new file mode 100644
index 00000000000..58421926421
--- /dev/null
+++ b/acceptance/cmd/workspace/apps/run-local-node/app/build.js
@@ -0,0 +1,3 @@
+// A file rather than an inline command in package.json, so the asserted output does
+// not depend on how npm's shell quotes it, which differs on Windows.
+console.log('Build script ran');
diff --git a/acceptance/cmd/workspace/apps/run-local-node/app/package.json b/acceptance/cmd/workspace/apps/run-local-node/app/package.json
index 15e06e17ffb..e3b250f18dc 100644
--- a/acceptance/cmd/workspace/apps/run-local-node/app/package.json
+++ b/acceptance/cmd/workspace/apps/run-local-node/app/package.json
@@ -2,12 +2,7 @@
     "name": "app",
     "version": "1.0.0",
     "description": "A simple Node.js app",
-    "main": "app.js",
     "scripts": {
-        "run-app": "node app.js",
-        "build": "echo 'Building app...'"
-    },
-    "dependencies": {
-        "express": "^5.1.0"
+        "build": "node build.js"
     }
 }
diff --git a/acceptance/cmd/workspace/apps/run-local-node/out.test.toml b/acceptance/cmd/workspace/apps/run-local-node/out.test.toml
index 3ef9121aba6..18b1a88417e 100644
--- a/acceptance/cmd/workspace/apps/run-local-node/out.test.toml
+++ b/acceptance/cmd/workspace/apps/run-local-node/out.test.toml
@@ -1,3 +1 @@
-Local = false
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/cmd/workspace/apps/run-local-node/output.txt b/acceptance/cmd/workspace/apps/run-local-node/output.txt
index 0185dbe5234..e6b0bd0a642 100644
--- a/acceptance/cmd/workspace/apps/run-local-node/output.txt
+++ b/acceptance/cmd/workspace/apps/run-local-node/output.txt
@@ -1,12 +1,28 @@
+
+=== Prepare environment runs the build script, and the entry point overrides app.yml
+
+>>> grep -x Build script ran ../LOG.prepare
+Build script ran
+
+>>> grep -x Running command: node -e console.log('Hello, world') ../LOG.prepare
 Running command: node -e console.log('Hello, world')
+
+>>> grep -x Hello, world ../LOG.prepare
 Hello, world
 
-=== Starting the app in background...
-=== Waiting
-=== Checking app is running...
->>> curl -s -o - http://127.0.0.1:$(port)
-{"message":"Hello From App","timestamp":"[TIMESTAMP]","status":"running"}
+=== Proxy forwards to the app
+
+>>> retry --until Hello From App curl -sS http://127.0.0.1:[PROXY_PORT]
+{"message":"Hello From App"}
+
+=== Debug mode reports the debugger port, and node listens on it
+
+>>> retry grep -x To debug your app, attach a debugger to port [DEBUG_PORT] LOG.run
+To debug your app, attach a debugger to port [DEBUG_PORT]
+
+>>> grep Debugger listening on ws://127.0.0.1:[DEBUG_PORT]/ LOG.run
+Debugger listening on ws://127.0.0.1:[DEBUG_PORT]/[UUID]
+
+=== Shutting the app down
 
-=== Sending shutdown request...
->>> curl -s -o /dev/null http://127.0.0.1:$(port)/shutdown
-Process terminated
+>>> curl -sS -o /dev/null http://127.0.0.1:[PROXY_PORT]/shutdown
diff --git a/acceptance/cmd/workspace/apps/run-local-node/script b/acceptance/cmd/workspace/apps/run-local-node/script
index 15975835afc..9749e979748 100755
--- a/acceptance/cmd/workspace/apps/run-local-node/script
+++ b/acceptance/cmd/workspace/apps/run-local-node/script
@@ -1,59 +1,45 @@
 cd app
 
-# We first run the command with different entry point which starts unblocking script
-# so we don't need to start it in background. It will install the dependencies as part of the command
-trace $CLI apps run-local --prepare-environment --entry-point test.yml 2>&1 | grep -w "Hello, world"
-
-# Function to find a free port in safe range
-get_free_port() {
-    python3 -c "import socket,random; port=random.randint(49152,65535); s=socket.socket(); s.bind(('',port)); print(port); s.close()" 2>/dev/null || python3 -c "import socket; s=socket.socket(); s.bind(('',0)); print(s.getsockname()[1]); s.close()"
-}
-
-PORT=$(get_free_port)
-DEBUG_PORT=$(get_free_port)
-PROXY_PORT=$(get_free_port)
+# Ports are allocated per run so that tests in parallel worktrees do not collide.
+read -r APP_PORT PROXY_PORT DEBUG_PORT PREPARE_PORT <<< "$(free_port.py 4)"
+add_repl "$PROXY_PORT" PROXY_PORT
+add_repl "$DEBUG_PORT" DEBUG_PORT
+
+# The app and the proxy start asynchronously; allow up to 15s for them to come up.
+export RETRY_MAX_ATTEMPTS=30
+
+title "Prepare environment runs the build script, and the entry point overrides app.yml\n"
+# npm reaches no registry here: nothing to install, and app/.npmrc turns off its update check.
+# The build script runs only if the install succeeded, so the first grep covers both halves.
+trace $CLI apps run-local --prepare-environment --entry-point test.yml --port "$PREPARE_PORT" &> ../LOG.prepare
+trace grep -x "Build script ran" ../LOG.prepare
+trace grep -x "Running command: node -e console.log('Hello, world')" ../LOG.prepare
+trace grep -x "Hello, world" ../LOG.prepare
 
 cleanup() {
-    # Kill any still running processes on these ports when the script exits
-    kill_port.py $PORT $DEBUG_PORT $PROXY_PORT
+    local status=$?
+    # Reap by port rather than by $PID, and only on failure, for the reasons in
+    # ../run-local/script. The debug port is here too because node binds the inspector before
+    # it runs app.js, so it is the only handle on an app that died before it listened.
+    [ "$status" -eq 0 ] || kill_port.py "$APP_PORT" "$PROXY_PORT" "$DEBUG_PORT"
 }
 
-trap cleanup EXIT
-
-title "Starting the app in background..."
-trace $CLI apps run-local --prepare-environment --debug --port "$PROXY_PORT" --debug-port "$DEBUG_PORT" --app-port "$PORT" > ../out.run.txt 2>&1 &
+# app/package.json selects the CLI's Node code path (runlocal.NewApp); without it the app is
+# treated as Python and --debug no longer sets NODE_OPTIONS.
+trace $CLI apps run-local --debug --port "$PROXY_PORT" --debug-port "$DEBUG_PORT" --app-port "$APP_PORT" &> ../LOG.run &
 PID=$!
-# Ensure background process is killed on script exit
-trap '(kill $PID >/dev/null 2>&1) 2>/dev/null || true' EXIT
+trap cleanup EXIT
 cd ..
 
-title Waiting for the app to start...
-# Use a loop to check for the startup message instead of tail/sed which can be unreliable on Windows
-# due to file locking, buffering issues, and different text processing behavior across Windows versions.
-# A simple grep loop is more robust across platforms.
-while [ -z "$(grep -o "Server is running on port " out.run.txt 2>/dev/null)" ]; do
-    sleep 1
-done
-
-# Make sure the proxy is ready to serve requests
-while [ -z "$(grep -o "To access your app go to " out.run.txt 2>/dev/null)" ]; do
-    sleep 1
-done
-
-title "Checking app is running..."
-trace curl -s -o - http://127.0.0.1:$PROXY_PORT | grep -w "Hello From App"
-
-title "Sending shutdown request..."
-trace curl -s -o /dev/null  http://127.0.0.1:$PROXY_PORT/shutdown || true
-
-# We need to wait for the app to shutdown before we can exit the test meaning wait until the
-# server is closed. We need to poll because the server is closed asynchronously.
-while [ -z "$(grep -o "Server closed" out.run.txt 2>/dev/null)" ]; do
-    sleep 1
-done
+title "Proxy forwards to the app\n"
+trace retry --until "Hello From App" curl -sS "http://127.0.0.1:$PROXY_PORT"
 
-# Wait for the background process to actually terminate
-wait $PID 2>/dev/null || true
-echo "Process terminated"
+title "Debug mode reports the debugger port, and node listens on it\n"
+# The CLI prints this only after the proxy accepts connections, so the curl above can beat it.
+# node's line below needs no retry: it is written before the app listens, so the curl proves it.
+trace retry grep -x "To debug your app, attach a debugger to port $DEBUG_PORT" LOG.run
+trace grep "Debugger listening on ws://127.0.0.1:$DEBUG_PORT/" LOG.run
 
-rm out.run.txt
+title "Shutting the app down\n"
+trace curl -sS -o /dev/null "http://127.0.0.1:$PROXY_PORT/shutdown"
+wait $PID
diff --git a/acceptance/cmd/workspace/apps/run-local-node/test.toml b/acceptance/cmd/workspace/apps/run-local-node/test.toml
index 2b6bb4bdda4..f46c1e68b26 100644
--- a/acceptance/cmd/workspace/apps/run-local-node/test.toml
+++ b/acceptance/cmd/workspace/apps/run-local-node/test.toml
@@ -1,26 +1,11 @@
-Badness = "need to enable NPM registry access"
 Cloud = false
-Local = false
 RecordRequests = false
-Timeout = '2m'
-TimeoutWindows = '10m'
 
+# npm install writes package-lock.json even with nothing to install, and older npm versions
+# also create node_modules for their own copy of the lockfile.
 Ignore = [
     'node_modules',
     'package-lock.json'
 ]
 
-[[Repls]]
-Old='curl/[0-9]+\.[0-9]+\.[0-9]+'
-New='curl/(version)'
-
-[[Repls]]
-Old='127.0.0.1:[0-9]+'
-New='127.0.0.1:$(port)'
-
-[[Repls]]
-Old='To debug your app, attach a debugger to port [0-9]+'
-New='To debug your app, attach a debugger to port $(debug_port)'
-
-[EnvMatrix]
-  DATABRICKS_BUNDLE_ENGINE = ["direct"]
+# The command is unrelated to bundle deployment, so run it once rather than per engine.
diff --git a/acceptance/cmd/workspace/apps/run-local/app/app.py b/acceptance/cmd/workspace/apps/run-local/app/app.py
index cfff4ce7aef..ff304318d83 100644
--- a/acceptance/cmd/workspace/apps/run-local/app/app.py
+++ b/acceptance/cmd/workspace/apps/run-local/app/app.py
@@ -1,18 +1,35 @@
+import http.server
+import json
 import os
-import signal
-from flask import Flask, request
+import threading
 
-app = Flask(__name__)
+# Standard library only: acceptance tests run with the network disabled, so the
+# app cannot install anything from PyPI.
 
-app.logger.warning("Python Flask app has started with: " + os.environ.get("TEST"))
 
+class Handler(http.server.BaseHTTPRequestHandler):
+    def do_GET(self):
+        shutdown = self.path == "/shutdown"
+        body = b"" if shutdown else json.dumps(dict(self.headers), sort_keys=True).encode() + b"\n"
 
-@app.route("/")
-def index():
-    return dict(request.headers)
+        self.send_response(200)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
 
+        # shutdown() blocks until serve_forever() returns, which cannot happen until this
+        # handler returns, so it has to run on another thread. Stopping the loop rather
+        # than exiting the process lets the connection close cleanly, otherwise the client
+        # can see a reset instead of the response we just wrote.
+        if shutdown:
+            threading.Thread(target=self.server.shutdown, daemon=True).start()
 
-@app.route("/shutdown")
-def shutdown():
-    os._exit(signal.SIGTERM)
-    return "Shutting down..."
+    def log_message(self, fmt, *args):
+        pass
+
+
+# Bind before printing, so the message can never appear while the port is still closed.
+server = http.server.HTTPServer(("127.0.0.1", int(os.environ["DATABRICKS_APP_PORT"])), Handler)
+print("Python app has started with: " + os.environ["TEST"], flush=True)
+server.serve_forever()
diff --git a/acceptance/cmd/workspace/apps/run-local/app/app.yml b/acceptance/cmd/workspace/apps/run-local/app/app.yml
index 0f6875f5b8a..3feee53ad5b 100644
--- a/acceptance/cmd/workspace/apps/run-local/app/app.yml
+++ b/acceptance/cmd/workspace/apps/run-local/app/app.yml
@@ -1,6 +1,6 @@
 command:
-  - flask
-  - run
+  - python
+  - app.py
 
 env:
   - name: TEST
diff --git a/acceptance/cmd/workspace/apps/run-local/app/requirements.txt b/acceptance/cmd/workspace/apps/run-local/app/requirements.txt
deleted file mode 100644
index af266d21cd3..00000000000
--- a/acceptance/cmd/workspace/apps/run-local/app/requirements.txt
+++ /dev/null
@@ -1 +0,0 @@
-Flask==3.1.3
diff --git a/acceptance/cmd/workspace/apps/run-local/out.test.toml b/acceptance/cmd/workspace/apps/run-local/out.test.toml
index a013748b1ff..18b1a88417e 100644
--- a/acceptance/cmd/workspace/apps/run-local/out.test.toml
+++ b/acceptance/cmd/workspace/apps/run-local/out.test.toml
@@ -1,3 +1 @@
-Local = false
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform"]
diff --git a/acceptance/cmd/workspace/apps/run-local/output.txt b/acceptance/cmd/workspace/apps/run-local/output.txt
index 6b7b6243600..4c8b525b8cc 100644
--- a/acceptance/cmd/workspace/apps/run-local/output.txt
+++ b/acceptance/cmd/workspace/apps/run-local/output.txt
@@ -1,24 +1,34 @@
 
+=== Env var with valueFrom cannot be resolved locally
+
 >>> errcode [CLI] apps run-local --entry-point value-from.yml
 Error: VALUE_FROM defined in value-from.yml with valueFrom property and can't be resolved locally. Please set VALUE_FROM environment variable in your terminal or using --env flag
 
 Exit code: 1
-Running command: uv run python -c print('Hello, world')
+
+=== Entry point overrides the command from app.yml
+
+>>> grep -x Running command: python -c print('Hello, world') ../LOG.entry-point
+Running command: python -c print('Hello, world')
+
+>>> grep -x Hello, world ../LOG.entry-point
 Hello, world
 
-=== Starting the app in background...
-=== Waiting
-=== Checking app is running...
-=== Checking the proxy is running...
->>> curl -s -o - http://127.0.0.1:$(port)
-{"Accept":"*/*","Accept-Encoding":"gzip","Host":"127.0.0.1:$(port)","User-Agent":"curl/(version)","X-Forwarded-Email":"[USERNAME]","X-Forwarded-Host":"localhost","X-Forwarded-Preferred-Username":"","X-Forwarded-User":"[USERNAME]","X-Real-Ip":"127.0.0.1","X-Request-Id":"[UUID]"}
+=== Proxy forwards to the app and injects the identity headers
+
+>>> retry --until X-Forwarded-Email curl -sS http://127.0.0.1:[PROXY_PORT]
+{"Accept": "*/*", "Accept-Encoding": "gzip", "Host": "127.0.0.1:[APP_PORT]", "User-Agent": "curl/(version)", "X-Forwarded-Email": "[USERNAME]", "X-Forwarded-Host": "localhost", "X-Forwarded-Preferred-Username": "", "X-Forwarded-User": "[USERNAME]", "X-Real-Ip": "127.0.0.1", "X-Request-Id": "[UUID]"}
+
+=== Proxy URL is reported on the port that was asked for
+
+>>> grep -x To access your app go to http://localhost:[PROXY_PORT] LOG.run
+To access your app go to http://localhost:[PROXY_PORT]
+
+=== App picked up the env var from app.yml
 
-=== Sending shutdown request...
->>> curl -s -o /dev/null http://127.0.0.1:$(port)/shutdown
+>>> grep -x Python app has started with: test LOG.run
+Python app has started with: test
 
-=== Checking CLI command output...
->>> grep To debug your app, attach a debugger to port ./out.run.txt
-To debug your app, attach a debugger to port $(debug_port)
+=== Shutting the app down
 
->>> grep -o Python Flask app has started with: test ./out.run.txt
-Python Flask app has started with: test
+>>> curl -sS -o /dev/null http://127.0.0.1:[PROXY_PORT]/shutdown
diff --git a/acceptance/cmd/workspace/apps/run-local/script b/acceptance/cmd/workspace/apps/run-local/script
index 701c8f5e95f..fd8b8b3c23e 100755
--- a/acceptance/cmd/workspace/apps/run-local/script
+++ b/acceptance/cmd/workspace/apps/run-local/script
@@ -1,75 +1,46 @@
 cd app
 
-trace errcode $CLI apps run-local --entry-point value-from.yml 2>&1
+# Ports are allocated per run so that tests in parallel worktrees do not collide.
+read -r APP_PORT PROXY_PORT ENTRY_POINT_PORT <<< "$(free_port.py 3)"
+add_repl "$APP_PORT" APP_PORT
+add_repl "$PROXY_PORT" PROXY_PORT
+
+# The app and the proxy start asynchronously; allow up to 15s for them to come up.
+export RETRY_MAX_ATTEMPTS=30
 
-# We first run the command with different entry point which starts unblocking script
-# so we don't need to start it in background. It will install the dependencies as part of the command
-trace $CLI apps run-local --prepare-environment --entry-point test.yml 2>&1 | grep -w "Hello, world"
+title "Env var with valueFrom cannot be resolved locally\n"
+trace errcode $CLI apps run-local --entry-point value-from.yml 2>&1
 
-PORT=8090
-DEBUG_PORT=5252
-PROXY_PORT=8091
+title "Entry point overrides the command from app.yml\n"
+trace $CLI apps run-local --entry-point test.yml --port "$ENTRY_POINT_PORT" &> ../LOG.entry-point
+trace grep -x "Running command: python -c print('Hello, world')" ../LOG.entry-point
+trace grep -x "Hello, world" ../LOG.entry-point
 
 cleanup() {
-    # Kill any still running processes on these ports when the script exits
-    kill_port.py $PORT $DEBUG_PORT $PROXY_PORT
+    local status=$?
+    # Reap by port rather than by $PID: backgrounding a function puts a subshell between the
+    # script and the CLI, so $PID is that subshell and the CLI and the app it started are
+    # grandchildren that survive killing it. Windows reaches the same state for another
+    # reason: kill terminates the CLI outright rather than letting it stop the app. Only when
+    # the script failed: on success both have exited through /shutdown already and the ports
+    # may belong to another test by now.
+    [ "$status" -eq 0 ] || kill_port.py "$APP_PORT" "$PROXY_PORT"
 }
 
-trap cleanup EXIT
-
-title "Starting the app in background..."
-trace $CLI apps run-local --prepare-environment --debug --port "$PROXY_PORT" --debug-port "$DEBUG_PORT" --app-port "$PORT" > ../out.run.txt 2>&1 &
+trace $CLI apps run-local --port "$PROXY_PORT" --app-port "$APP_PORT" &> ../LOG.run &
 PID=$!
-# Ensure background process is killed on script exit
-trap 'kill $PID 2>/dev/null || true' EXIT
+trap cleanup EXIT
 cd ..
 
-title Waiting for the app to start...
-# Use a loop to check for the startup message instead of tail/sed which can be unreliable on Windows
-# due to file locking, buffering issues, and different text processing behavior across Windows versions.
-# A simple grep loop is more robust across platforms.
-while [ -z "$(grep -o "Python Flask app has started with" out.run.txt 2>/dev/null)" ]; do
-    sleep 1
-done
-
-# Make sure the proxy is ready to serve requests
-while [ -z "$(grep -o "To access your app go to " out.run.txt 2>/dev/null)" ]; do
-    sleep 1
-done
-
-title "Checking app is running..."
-# Wait for the proxy to be ready to serve requests (with timeout)
-timeout=5
-counter=0
-while ! curl -s -o /dev/null http://127.0.0.1:$PORT 2>/dev/null; do
-    sleep 1
-    counter=$((counter + 1))
-    if [ $counter -ge $timeout ]; then
-        echo "Timeout waiting for app to be ready after ${timeout}s"
-        exit 1
-    fi
-done
-
-title "Checking the proxy is running..."
-# Wait for the proxy to be ready to serve requests (with timeout)
-timeout=5
-counter=0
-while ! curl -s -o /dev/null http://127.0.0.1:$PROXY_PORT 2>/dev/null; do
-    sleep 1
-    counter=$((counter + 1))
-    if [ $counter -ge $timeout ]; then
-        echo "Timeout waiting for proxy to be ready after ${timeout}s"
-        exit 1
-    fi
-done
-
-trace curl -s -o - http://127.0.0.1:$PROXY_PORT
+title "Proxy forwards to the app and injects the identity headers\n"
+trace retry --until X-Forwarded-Email curl -sS "http://127.0.0.1:$PROXY_PORT"
 
-title "Sending shutdown request..."
-trace curl -s -o /dev/null  http://127.0.0.1:$PROXY_PORT/shutdown || true
+title "Proxy URL is reported on the port that was asked for\n"
+trace grep -x "To access your app go to http://localhost:$PROXY_PORT" LOG.run
 
-title "Checking CLI command output..."
+title "App picked up the env var from app.yml\n"
+trace grep -x "Python app has started with: test" LOG.run
 
-trace grep "To debug your app, attach a debugger to port" ./out.run.txt
-trace grep -o "Python Flask app has started with: test" ./out.run.txt
-rm out.run.txt
+title "Shutting the app down\n"
+trace curl -sS -o /dev/null "http://127.0.0.1:$PROXY_PORT/shutdown"
+wait $PID
diff --git a/acceptance/cmd/workspace/apps/run-local/test.toml b/acceptance/cmd/workspace/apps/run-local/test.toml
index fedbe4a7e03..43720d22644 100644
--- a/acceptance/cmd/workspace/apps/run-local/test.toml
+++ b/acceptance/cmd/workspace/apps/run-local/test.toml
@@ -1,27 +1,10 @@
 Cloud = false
-# This test uses fixed ports, so incompatible with parellel testing in different worktrees.
-# It's also very slow when it does work.
-Local = false
 RecordRequests = false
-Timeout = '2m'
-TimeoutWindows = '10m'
 
-Ignore = [
-    '.venv',
-    '__pycache__'
-]
+# The command is unrelated to bundle deployment, so run it once rather than per engine.
+
+# The ports are registered as replacements by the script, which is where they are allocated.
 
 [[Repls]]
 Old='curl/[0-9]+\.[0-9]+\.[0-9]+'
 New='curl/(version)'
-
-[[Repls]]
-Old='127.0.0.1:[0-9]+'
-New='127.0.0.1:$(port)'
-
-[[Repls]]
-Old='To debug your app, attach a debugger to port [0-9]+'
-New='To debug your app, attach a debugger to port $(debug_port)'
-
-[EnvMatrix]
-  DATABRICKS_BUNDLE_ENGINE = ["terraform"]
diff --git a/acceptance/cmd/workspace/apps/script b/acceptance/cmd/workspace/apps/script
index d7d72e9be86..be072c7aba6 100644
--- a/acceptance/cmd/workspace/apps/script
+++ b/acceptance/cmd/workspace/apps/script
@@ -6,3 +6,5 @@ trace $CLI apps update test-name --json @input.json
 
 title "Apps update with missing parameter"
 trace $CLI apps update --json @input.json
+
+trace print_requests.py //apps
diff --git a/acceptance/cmd/workspace/apps/test.toml b/acceptance/cmd/workspace/apps/test.toml
index 159efe02696..76b0f7f680b 100644
--- a/acceptance/cmd/workspace/apps/test.toml
+++ b/acceptance/cmd/workspace/apps/test.toml
@@ -1 +1,10 @@
 RecordRequests = true
+
+# The testserver mints these per run.
+[[Repls]]
+Old = 'deploy-\d+'
+New = 'deploy-[DEPLOYMENT_ID]'
+
+[[Repls]]
+Old = '"service_principal_id": \d+'
+New = '"service_principal_id": [SERVICE_PRINCIPAL_ID]'
diff --git a/acceptance/cmd/workspace/arg-validation/out.test.toml b/acceptance/cmd/workspace/arg-validation/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/workspace/arg-validation/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/workspace/arg-validation/output.txt b/acceptance/cmd/workspace/arg-validation/output.txt
new file mode 100644
index 00000000000..c4d5c82a00f
--- /dev/null
+++ b/acceptance/cmd/workspace/arg-validation/output.txt
@@ -0,0 +1,57 @@
+
+=== clusters create requires a positional arg (or --json)
+
+>>> musterr [CLI] clusters create
+Error: accepts 1 arg(s), received 0
+
+Usage:
+  databricks clusters create SPARK_VERSION [flags]
+
+Flags:
+      --apply-policy-default-values           When set to true, fixed and default values from the policy will be used for fields that are omitted.
+      --autotermination-minutes int           Automatically terminates the cluster after it is inactive for this time in minutes.
+      --cluster-name string                   Cluster name requested by the user.
+      --data-security-mode DataSecurityMode   Supported values: [
+                                                DATA_SECURITY_MODE_AUTO,
+                                                DATA_SECURITY_MODE_DEDICATED,
+                                                DATA_SECURITY_MODE_STANDARD,
+                                                LEGACY_PASSTHROUGH,
+                                                LEGACY_SINGLE_USER,
+                                                LEGACY_SINGLE_USER_STANDARD,
+                                                LEGACY_TABLE_ACL,
+                                                NONE,
+                                                SINGLE_USER,
+                                                USER_ISOLATION,
+                                              ]
+      --dependency-mode DependencyMode        Controls dependency configuration for the cluster. Supported values: [DEPENDENCY_MODE_AUTO, DEPENDENCY_MODE_CLUSTER_LIBRARIES, DEPENDENCY_MODE_ENVIRONMENTS]
+      --driver-instance-pool-id string        The optional ID of the instance pool for the driver of the cluster belongs.
+      --driver-node-type-id string            The node type of the Spark driver.
+      --enable-elastic-disk                   Autoscaling Local Storage: when enabled, this cluster will dynamically acquire additional disk space when its Spark workers are running low on disk space.
+      --enable-local-disk-encryption          Whether to enable LUKS on cluster VMs' local disks.
+  -h, --help                                  help for create
+      --instance-pool-id string               The optional ID of the instance pool to which the cluster belongs.
+      --is-single-node                        This field can only be used when kind = CLASSIC_PREVIEW.
+      --json JSON                             either inline JSON string or @path/to/file.json with request body (default JSON (0 bytes))
+      --kind Kind                             Supported values: [CLASSIC_PREVIEW]
+      --no-wait                               do not wait to reach RUNNING state
+      --node-type-id string                   This field encodes, through a single value, the resources available to each of the Spark nodes in this cluster.
+      --num-workers int                       Number of worker nodes that this cluster should have.
+      --policy-id string                      The ID of the cluster policy used to create the cluster if applicable.
+      --remote-disk-throughput int            If set, what the configurable throughput (in Mb/s) for the remote disk is.
+      --runtime-engine RuntimeEngine          Determines the cluster's runtime engine, either standard or Photon. Supported values: [NULL, PHOTON, STANDARD]
+      --single-user-name string               Single user name if data_security_mode is SINGLE_USER.
+      --timeout duration                      maximum amount of time to reach RUNNING state (default 20m0s)
+      --total-initial-remote-disk-size int    If set, what the total initial volume size (in GB) of the remote disks should be.
+      --use-ml-runtime                        This field can only be used when kind = CLASSIC_PREVIEW.
+
+Global Flags:
+      --debug            enable debug logging
+  -o, --output type      output type: text or json (default text)
+  -p, --profile string   ~/.databrickscfg profile
+  -t, --target string    bundle target to use (if applicable)
+
+
+=== alerts-legacy create only accepts JSON input
+
+>>> musterr [CLI] alerts-legacy create
+Error: please provide command input in JSON format by specifying the --json flag
diff --git a/acceptance/cmd/workspace/arg-validation/script b/acceptance/cmd/workspace/arg-validation/script
new file mode 100644
index 00000000000..064065c87ca
--- /dev/null
+++ b/acceptance/cmd/workspace/arg-validation/script
@@ -0,0 +1,8 @@
+# Generated commands validate their input before issuing any request, so these
+# cases need no workspace.
+
+title "clusters create requires a positional arg (or --json)\n"
+trace musterr $CLI clusters create
+
+title "alerts-legacy create only accepts JSON input\n"
+trace musterr $CLI alerts-legacy create
diff --git a/acceptance/cmd/workspace/clusters-list/out.test.toml b/acceptance/cmd/workspace/clusters-list/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/workspace/clusters-list/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/workspace/clusters-list/output.txt b/acceptance/cmd/workspace/clusters-list/output.txt
new file mode 100644
index 00000000000..3b3bcf763d0
--- /dev/null
+++ b/acceptance/cmd/workspace/clusters-list/output.txt
@@ -0,0 +1,7 @@
+
+=== clusters list renders the ID/Name/State columns
+
+>>> [CLI] clusters list
+ID    Name                State
+4321  some-test-cluster   
+9876  some-other-cluster  
diff --git a/acceptance/cmd/workspace/clusters-list/script b/acceptance/cmd/workspace/clusters-list/script
new file mode 100644
index 00000000000..eee3f5887aa
--- /dev/null
+++ b/acceptance/cmd/workspace/clusters-list/script
@@ -0,0 +1,2 @@
+title "clusters list renders the ID/Name/State columns\n"
+trace $CLI clusters list
diff --git a/acceptance/cmd/workspace/create-scope/out.test.toml b/acceptance/cmd/workspace/create-scope/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/workspace/create-scope/out.test.toml
+++ b/acceptance/cmd/workspace/create-scope/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/workspace/create-scope/test.toml b/acceptance/cmd/workspace/create-scope/test.toml
deleted file mode 100644
index 7d36fb9dc18..00000000000
--- a/acceptance/cmd/workspace/create-scope/test.toml
+++ /dev/null
@@ -1,2 +0,0 @@
-Local = true
-Cloud = false
diff --git a/acceptance/cmd/workspace/database/update-database-instance/out.test.toml b/acceptance/cmd/workspace/database/update-database-instance/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/workspace/database/update-database-instance/out.test.toml
+++ b/acceptance/cmd/workspace/database/update-database-instance/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/workspace/database/update-database-instance/test.toml b/acceptance/cmd/workspace/database/update-database-instance/test.toml
index fed84c77816..4448d618fca 100644
--- a/acceptance/cmd/workspace/database/update-database-instance/test.toml
+++ b/acceptance/cmd/workspace/database/update-database-instance/test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
 
 [[Server]]
diff --git a/acceptance/cmd/workspace/export-dir-dashboard/dashboard.lvdash.json b/acceptance/cmd/workspace/export-dir-dashboard/dashboard.lvdash.json
new file mode 100644
index 00000000000..0a39c4a05c7
--- /dev/null
+++ b/acceptance/cmd/workspace/export-dir-dashboard/dashboard.lvdash.json
@@ -0,0 +1,11 @@
+{
+  "pages": [
+    {
+      "name": "main",
+      "displayName": "Main",
+      "pageType": "PAGE_TYPE_CANVAS",
+      "layoutVersion": "GRID_V1",
+      "layout": []
+    }
+  ]
+}
diff --git a/acceptance/cmd/workspace/export-dir-dashboard/out.test.toml b/acceptance/cmd/workspace/export-dir-dashboard/out.test.toml
new file mode 100644
index 00000000000..4a2cb2bdbdf
--- /dev/null
+++ b/acceptance/cmd/workspace/export-dir-dashboard/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = true
+GOOS.windows = false
diff --git a/acceptance/cmd/workspace/export-dir-dashboard/output.txt b/acceptance/cmd/workspace/export-dir-dashboard/output.txt
new file mode 100644
index 00000000000..21c8b788853
--- /dev/null
+++ b/acceptance/cmd/workspace/export-dir-dashboard/output.txt
@@ -0,0 +1,9 @@
+
+>>> [CLI] workspace mkdirs /Workspace/Users/[USERNAME]/export-dir-dashboard-[UNIQUE_NAME]
+
+>>> [CLI] workspace export-dir /Workspace/Users/[USERNAME]/export-dir-dashboard-[UNIQUE_NAME] [TEST_TMP_DIR]/export
+Exporting files from /Workspace/Users/[USERNAME]/export-dir-dashboard-[UNIQUE_NAME]
+/Workspace/Users/[USERNAME]/export-dir-dashboard-[UNIQUE_NAME]/export-dir-dashboard-[UNIQUE_NAME].lvdash.json -> [TEST_TMP_DIR]/export/export-dir-dashboard-[UNIQUE_NAME].lvdash.json
+Export complete
+
+>>> assert_exists.py [TEST_TMP_DIR]/export/export-dir-dashboard-[UNIQUE_NAME].lvdash.json
diff --git a/acceptance/cmd/workspace/export-dir-dashboard/script b/acceptance/cmd/workspace/export-dir-dashboard/script
new file mode 100644
index 00000000000..febb56173c4
--- /dev/null
+++ b/acceptance/cmd/workspace/export-dir-dashboard/script
@@ -0,0 +1,29 @@
+DASHBOARD_NAME="export-dir-dashboard-$UNIQUE_NAME"
+DASHBOARD_DIR="/Workspace/Users/$CURRENT_USER_NAME/export-dir-dashboard-$UNIQUE_NAME"
+dashboard_id=""
+
+cleanup() {
+    if [ -n "$dashboard_id" ]; then
+        $CLI lakeview trash "$dashboard_id" >> LOG.cleanup 2>&1 || true
+    fi
+    $CLI workspace delete "$DASHBOARD_DIR" --recursive >> LOG.cleanup 2>&1 || true
+}
+trap cleanup EXIT
+
+trace $CLI workspace mkdirs "$DASHBOARD_DIR"
+
+dashboard_id=$($CLI lakeview create \
+    --display-name "$DASHBOARD_NAME" \
+    --warehouse-id "$TEST_DEFAULT_WAREHOUSE_ID" \
+    --serialized-dashboard "$(cat dashboard.lvdash.json)" \
+    --json "{\"parent_path\": \"$DASHBOARD_DIR\"}" \
+    -o json | jq -r '.dashboard_id')
+add_repl "$dashboard_id" DASHBOARD_ID
+
+mkdir -p "$TEST_TMP_DIR/export"
+trace $CLI workspace export-dir "$DASHBOARD_DIR" "$TEST_TMP_DIR/export"
+
+# The Lakeview backend normalizes the serialized dashboard on create (e.g. it
+# drops an empty "layout": []), so the exported content is not byte-identical to
+# the input. Assert the dashboard was exported rather than diffing the content.
+trace assert_exists.py "$TEST_TMP_DIR/export/$DASHBOARD_NAME.lvdash.json"
diff --git a/acceptance/cmd/workspace/export-dir-dashboard/test.toml b/acceptance/cmd/workspace/export-dir-dashboard/test.toml
new file mode 100644
index 00000000000..db3893d343c
--- /dev/null
+++ b/acceptance/cmd/workspace/export-dir-dashboard/test.toml
@@ -0,0 +1,10 @@
+Cloud = true
+
+# export-dir prints the local destination with OS-native separators, so the
+# output diverges on Windows. The exported-dashboard behavior is OS-independent,
+# so cover it on Linux/macOS only.
+GOOS.windows = false
+
+Ignore = [
+  "export",
+]
diff --git a/acceptance/cmd/workspace/export-dir-file-size-limit/out.test.toml b/acceptance/cmd/workspace/export-dir-file-size-limit/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/workspace/export-dir-file-size-limit/out.test.toml
+++ b/acceptance/cmd/workspace/export-dir-file-size-limit/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/workspace/export-dir-file-size-limit/script b/acceptance/cmd/workspace/export-dir-file-size-limit/script
index 796011c6597..56ed21d5fff 100644
--- a/acceptance/cmd/workspace/export-dir-file-size-limit/script
+++ b/acceptance/cmd/workspace/export-dir-file-size-limit/script
@@ -1,3 +1,5 @@
+# The import API returns a 404 if the parent directory does not exist, so create it first.
+$CLI workspace mkdirs /test-dir
 $CLI workspace import /test-dir/file.py --file test_file.py --format AUTO --language PYTHON
 
 mkdir -p "$TEST_TMP_DIR/export"
diff --git a/acceptance/cmd/workspace/export-dir-file-size-limit/test.toml b/acceptance/cmd/workspace/export-dir-file-size-limit/test.toml
index 35cf6c829d8..690629ec87e 100644
--- a/acceptance/cmd/workspace/export-dir-file-size-limit/test.toml
+++ b/acceptance/cmd/workspace/export-dir-file-size-limit/test.toml
@@ -1,8 +1,6 @@
-Local = true
 Cloud = false
 
-[Env]
-MSYS_NO_PATHCONV = "1"
+Env.MSYS_NO_PATHCONV = "1"
 
 [[Server]]
 Pattern = "GET /api/2.0/workspace/list"
diff --git a/acceptance/cmd/workspace/export-dir-illegal-filename/_script b/acceptance/cmd/workspace/export-dir-illegal-filename/_script
new file mode 100644
index 00000000000..a0efc98668b
--- /dev/null
+++ b/acceptance/cmd/workspace/export-dir-illegal-filename/_script
@@ -0,0 +1,23 @@
+# Shared by the posix/ and windows/ leaf tests, which differ only in their GOOS
+# gate and golden output. The notebook name contains ':', which is a legal local
+# filename character on Linux/macOS but illegal on Windows, so export-dir renames
+# it to a legal name with a warning on Windows and exports it normally elsewhere.
+# The real #5171 trigger is the auto-generated "New Notebook <timestamp>" name.
+# We use two colons ("a:b:c") rather than one: a single ':' is the Windows
+# alternate-data-stream separator, so os.Create("New Notebook a:b.py") silently
+# succeeds (writing stream "b.py") instead of failing with ERROR_INVALID_NAME.
+# Two colons make the stream type invalid, which is what real timestamp names
+# ("13:54:24") hit. A plain name keeps the timestamp redaction out of the golden.
+
+# Operate in a unique directory under the current user's home so the test is
+# self-contained and safe to run against a real workspace. The import API returns
+# a 404 if the parent directory does not exist, so create it first.
+DIR="/Users/$CURRENT_USER_NAME/export-dir-test-$UNIQUE_NAME"
+$CLI workspace mkdirs "$DIR"
+$CLI workspace import "$DIR/New Notebook a:b:c.py" --file "$TESTDIR/../notebook.py" --format AUTO --language PYTHON
+
+mkdir -p "$TEST_TMP_DIR/export"
+
+trace $CLI workspace export-dir "$DIR" "$TEST_TMP_DIR/export"
+
+$CLI workspace delete --recursive "$DIR"
diff --git a/acceptance/cmd/workspace/export-dir-illegal-filename/notebook.py b/acceptance/cmd/workspace/export-dir-illegal-filename/notebook.py
new file mode 100644
index 00000000000..4914a7436d9
--- /dev/null
+++ b/acceptance/cmd/workspace/export-dir-illegal-filename/notebook.py
@@ -0,0 +1,2 @@
+# Databricks notebook source
+print("hello")
diff --git a/acceptance/cmd/workspace/export-dir-illegal-filename/posix/out.test.toml b/acceptance/cmd/workspace/export-dir-illegal-filename/posix/out.test.toml
new file mode 100644
index 00000000000..2e1543aa802
--- /dev/null
+++ b/acceptance/cmd/workspace/export-dir-illegal-filename/posix/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+GOOS.windows = false
diff --git a/acceptance/cmd/workspace/export-dir-illegal-filename/posix/output.txt b/acceptance/cmd/workspace/export-dir-illegal-filename/posix/output.txt
new file mode 100644
index 00000000000..0cdcde18b7e
--- /dev/null
+++ b/acceptance/cmd/workspace/export-dir-illegal-filename/posix/output.txt
@@ -0,0 +1,5 @@
+
+>>> [CLI] workspace export-dir /Users/[USERNAME]/export-dir-test-[UNIQUE_NAME] [TEST_TMP_DIR]/export
+Exporting files from /Users/[USERNAME]/export-dir-test-[UNIQUE_NAME]
+/Users/[USERNAME]/export-dir-test-[UNIQUE_NAME]/New Notebook a:b:c -> [TEST_TMP_DIR]/export/New Notebook a:b:c.py
+Export complete
diff --git a/acceptance/cmd/workspace/export-dir-illegal-filename/posix/script b/acceptance/cmd/workspace/export-dir-illegal-filename/posix/script
new file mode 100644
index 00000000000..6125f11b143
--- /dev/null
+++ b/acceptance/cmd/workspace/export-dir-illegal-filename/posix/script
@@ -0,0 +1 @@
+source "$TESTDIR/../_script"
diff --git a/acceptance/cmd/workspace/export-dir-illegal-filename/posix/test.toml b/acceptance/cmd/workspace/export-dir-illegal-filename/posix/test.toml
new file mode 100644
index 00000000000..96be3f28dce
--- /dev/null
+++ b/acceptance/cmd/workspace/export-dir-illegal-filename/posix/test.toml
@@ -0,0 +1,3 @@
+# The ':' in the notebook name is a legal local filename on Linux/macOS, so the
+# notebook is exported. Windows diverges and is covered by ../windows.
+GOOS.windows = false
diff --git a/acceptance/cmd/workspace/export-dir-illegal-filename/test.toml b/acceptance/cmd/workspace/export-dir-illegal-filename/test.toml
new file mode 100644
index 00000000000..efb0ddf1fb1
--- /dev/null
+++ b/acceptance/cmd/workspace/export-dir-illegal-filename/test.toml
@@ -0,0 +1,12 @@
+Cloud = false
+
+# This reproduces databricks/cli#5171. The behaviour is OS-specific (see _script),
+# so the actual test cases live in the posix/ and windows/ leaf directories, each
+# GOOS-gated with its own golden. This directory only holds the shared _script,
+# the notebook fixture, and the config they inherit.
+
+# The exported notebook lands under $TEST_TMP_DIR/export and is not part of the
+# comparison; only the captured command output is.
+Ignore = ["export/"]
+
+Env.MSYS_NO_PATHCONV = "1"
diff --git a/acceptance/cmd/workspace/export-dir-illegal-filename/windows/out.test.toml b/acceptance/cmd/workspace/export-dir-illegal-filename/windows/out.test.toml
new file mode 100644
index 00000000000..fd5293d57d1
--- /dev/null
+++ b/acceptance/cmd/workspace/export-dir-illegal-filename/windows/out.test.toml
@@ -0,0 +1,3 @@
+Cloud = false
+GOOS.darwin = false
+GOOS.linux = false
diff --git a/acceptance/cmd/workspace/export-dir-illegal-filename/windows/output.txt b/acceptance/cmd/workspace/export-dir-illegal-filename/windows/output.txt
new file mode 100644
index 00000000000..0cc15ac681f
--- /dev/null
+++ b/acceptance/cmd/workspace/export-dir-illegal-filename/windows/output.txt
@@ -0,0 +1,6 @@
+
+>>> [CLI] workspace export-dir /Users/[USERNAME]/export-dir-test-[UNIQUE_NAME] [TEST_TMP_DIR]/export
+Exporting files from /Users/[USERNAME]/export-dir-test-[UNIQUE_NAME]
+Warn: /Users/[USERNAME]/export-dir-test-[UNIQUE_NAME]/New Notebook a:b:c: name is not valid for the local file system, exporting as "New Notebook a_b_c.py"
+/Users/[USERNAME]/export-dir-test-[UNIQUE_NAME]/New Notebook a:b:c -> [TEST_TMP_DIR]\export\New Notebook a_b_c.py
+Export complete
diff --git a/acceptance/cmd/workspace/export-dir-illegal-filename/windows/script b/acceptance/cmd/workspace/export-dir-illegal-filename/windows/script
new file mode 100644
index 00000000000..6125f11b143
--- /dev/null
+++ b/acceptance/cmd/workspace/export-dir-illegal-filename/windows/script
@@ -0,0 +1 @@
+source "$TESTDIR/../_script"
diff --git a/acceptance/cmd/workspace/export-dir-illegal-filename/windows/test.toml b/acceptance/cmd/workspace/export-dir-illegal-filename/windows/test.toml
new file mode 100644
index 00000000000..9893864def7
--- /dev/null
+++ b/acceptance/cmd/workspace/export-dir-illegal-filename/windows/test.toml
@@ -0,0 +1,5 @@
+# The ':' in the notebook name is illegal as a local Windows filename, so
+# export-dir renames it to a legal name with a warning. Linux/macOS are covered
+# by ../posix.
+GOOS.linux = false
+GOOS.darwin = false
diff --git a/acceptance/cmd/workspace/export-dir-skip-experiments/out.test.toml b/acceptance/cmd/workspace/export-dir-skip-experiments/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/workspace/export-dir-skip-experiments/out.test.toml
+++ b/acceptance/cmd/workspace/export-dir-skip-experiments/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/workspace/export-dir-skip-experiments/test.toml b/acceptance/cmd/workspace/export-dir-skip-experiments/test.toml
index da4c08d3ec8..207f1871bff 100644
--- a/acceptance/cmd/workspace/export-dir-skip-experiments/test.toml
+++ b/acceptance/cmd/workspace/export-dir-skip-experiments/test.toml
@@ -1,8 +1,6 @@
-Local = true
 Cloud = false
 
-[Env]
-MSYS_NO_PATHCONV = "1"
+Env.MSYS_NO_PATHCONV = "1"
 
 [[Server]]
 Pattern = "GET /api/2.0/workspace/list"
diff --git a/acceptance/cmd/workspace/import-zip-auto/archive.zip b/acceptance/cmd/workspace/import-zip-auto/archive.zip
new file mode 100644
index 00000000000..fabadf6fa08
Binary files /dev/null and b/acceptance/cmd/workspace/import-zip-auto/archive.zip differ
diff --git a/acceptance/cmd/workspace/import-zip-auto/out.test.toml b/acceptance/cmd/workspace/import-zip-auto/out.test.toml
new file mode 100644
index 00000000000..c7c6f58ed6e
--- /dev/null
+++ b/acceptance/cmd/workspace/import-zip-auto/out.test.toml
@@ -0,0 +1 @@
+Cloud = true
diff --git a/acceptance/cmd/workspace/import-zip-auto/output.txt b/acceptance/cmd/workspace/import-zip-auto/output.txt
new file mode 100644
index 00000000000..6f9f2709742
--- /dev/null
+++ b/acceptance/cmd/workspace/import-zip-auto/output.txt
@@ -0,0 +1,40 @@
+
+=== AUTO extracts a .zip into a folder named after the archive, without .zip
+
+>>> [CLI] workspace import /Workspace/Users/[USERNAME]/[UNIQUE_NAME]/archive.zip --file archive.zip --format AUTO
+
+>>> list /Workspace/Users/[USERNAME]/[UNIQUE_NAME]
+DIRECTORY /Workspace/Users/[USERNAME]/[UNIQUE_NAME]/archive
+
+>>> list /Workspace/Users/[USERNAME]/[UNIQUE_NAME]/archive
+FILE /Workspace/Users/[USERNAME]/[UNIQUE_NAME]/archive/a.txt
+DIRECTORY /Workspace/Users/[USERNAME]/[UNIQUE_NAME]/archive/sub
+
+>>> list /Workspace/Users/[USERNAME]/[UNIQUE_NAME]/archive/sub
+FILE /Workspace/Users/[USERNAME]/[UNIQUE_NAME]/archive/sub/c.txt
+
+=== Importing the archive again is rejected, with or without overwrite
+
+>>> musterr [CLI] workspace import /Workspace/Users/[USERNAME]/[UNIQUE_NAME]/archive.zip --file archive.zip --format AUTO --overwrite
+Error: Overwrite cannot be used for AUTO format when importing a folder.
+
+>>> musterr [CLI] workspace import /Workspace/Users/[USERNAME]/[UNIQUE_NAME]/archive.zip --file archive.zip --format AUTO
+Error: /Workspace/Users/[USERNAME]/[UNIQUE_NAME]/archive already exists. Please pass overwrite=true to overwrite it.
+
+=== RAW stores the archive as a file, and overwrites it
+
+>>> [CLI] workspace import /Workspace/Users/[USERNAME]/[UNIQUE_NAME]/raw.zip --file archive.zip --format RAW
+
+>>> [CLI] workspace import /Workspace/Users/[USERNAME]/[UNIQUE_NAME]/raw.zip --file archive.zip --format RAW --overwrite
+
+=== AUTO rejects names reserved for asset types it cannot import; RAW stores them as files
+
+>>> musterr [CLI] workspace import /Workspace/Users/[USERNAME]/[UNIQUE_NAME]/space.geniespace.json --file space.geniespace.json --format AUTO
+Error: Requested node type [UNKNOWN] is not supported
+
+>>> [CLI] workspace import /Workspace/Users/[USERNAME]/[UNIQUE_NAME]/space.geniespace.json --file space.geniespace.json --format RAW
+
+>>> list /Workspace/Users/[USERNAME]/[UNIQUE_NAME]
+DIRECTORY /Workspace/Users/[USERNAME]/[UNIQUE_NAME]/archive
+FILE /Workspace/Users/[USERNAME]/[UNIQUE_NAME]/raw.zip
+FILE /Workspace/Users/[USERNAME]/[UNIQUE_NAME]/space.geniespace.json
diff --git a/acceptance/cmd/workspace/import-zip-auto/script b/acceptance/cmd/workspace/import-zip-auto/script
new file mode 100644
index 00000000000..8c48e84ee04
--- /dev/null
+++ b/acceptance/cmd/workspace/import-zip-auto/script
@@ -0,0 +1,34 @@
+# Documents how POST /api/2.0/workspace/import handles a .zip and names reserved for
+# other asset types. archive.zip holds a single top-level folder: pkg/a.txt, pkg/sub/c.txt.
+DIR="/Workspace/Users/$CURRENT_USER_NAME/$UNIQUE_NAME"
+$CLI workspace mkdirs "$DIR"
+
+cleanup() {
+  $CLI workspace delete "$DIR" --recursive
+}
+trap cleanup EXIT
+
+list() {
+  $CLI workspace list "$1" -o json | jq -r 'sort_by(.path)[] | "\(.object_type) \(.path)"'
+}
+
+title "AUTO extracts a .zip into a folder named after the archive, without .zip\n"
+trace $CLI workspace import "$DIR/archive.zip" --file archive.zip --format AUTO
+trace list "$DIR"
+# The archive's single top-level folder (pkg/) is replaced by the target folder.
+trace list "$DIR/archive"
+trace list "$DIR/archive/sub"
+
+title "Importing the archive again is rejected, with or without overwrite\n"
+trace musterr $CLI workspace import "$DIR/archive.zip" --file archive.zip --format AUTO --overwrite
+trace musterr $CLI workspace import "$DIR/archive.zip" --file archive.zip --format AUTO
+
+title "RAW stores the archive as a file, and overwrites it\n"
+trace $CLI workspace import "$DIR/raw.zip" --file archive.zip --format RAW
+trace $CLI workspace import "$DIR/raw.zip" --file archive.zip --format RAW --overwrite
+
+title "AUTO rejects names reserved for asset types it cannot import; RAW stores them as files\n"
+trace musterr $CLI workspace import "$DIR/space.geniespace.json" --file space.geniespace.json --format AUTO
+trace $CLI workspace import "$DIR/space.geniespace.json" --file space.geniespace.json --format RAW
+
+trace list "$DIR"
diff --git a/acceptance/cmd/workspace/import-zip-auto/space.geniespace.json b/acceptance/cmd/workspace/import-zip-auto/space.geniespace.json
new file mode 100644
index 00000000000..cb608f6e9c4
--- /dev/null
+++ b/acceptance/cmd/workspace/import-zip-auto/space.geniespace.json
@@ -0,0 +1 @@
+{"version": 1}
diff --git a/acceptance/cmd/workspace/import-zip-auto/test.toml b/acceptance/cmd/workspace/import-zip-auto/test.toml
new file mode 100644
index 00000000000..6b74aa538f0
--- /dev/null
+++ b/acceptance/cmd/workspace/import-zip-auto/test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+
+# Workspace paths start with "/"; keep Git Bash on Windows from rewriting them.
+Env.MSYS_NO_PATHCONV = "1"
diff --git a/acceptance/cmd/workspace/jobs/runs-submit/out.test.toml b/acceptance/cmd/workspace/jobs/runs-submit/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/workspace/jobs/runs-submit/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/workspace/jobs/runs-submit/output.txt b/acceptance/cmd/workspace/jobs/runs-submit/output.txt
new file mode 100644
index 00000000000..a6ba8d2da18
--- /dev/null
+++ b/acceptance/cmd/workspace/jobs/runs-submit/output.txt
@@ -0,0 +1,52 @@
+
+>>> [CLI] jobs submit --no-wait --json {
+  "run_name": "ssh-tunnel",
+  "tasks": [
+    {
+      "task_key": "main",
+      "environment_key": "default",
+      "notebook_task": {
+        "notebook_path": "/Workspace/notebook"
+      }
+    }
+  ],
+  "environments": [
+    {
+      "environment_key": "default",
+      "spec": {
+        "base_environment": "workspace-base-environments/databricks_ai_v4",
+        "environment_version": "4"
+      }
+    }
+  ]
+}
+{
+  "run_id": [RUN_ID]
+}
+
+>>> print_requests.py //jobs/runs/submit
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/runs/submit",
+  "body": {
+    "environments": [
+      {
+        "environment_key": "default",
+        "spec": {
+          "base_environment": "workspace-base-environments/databricks_ai_v4",
+          "environment_version": "4"
+        }
+      }
+    ],
+    "run_name": "ssh-tunnel",
+    "tasks": [
+      {
+        "environment_key": "default",
+        "notebook_task": {
+          "notebook_path": "/Workspace/notebook"
+        },
+        "task_key": "main"
+      }
+    ]
+  }
+}
diff --git a/acceptance/cmd/workspace/jobs/runs-submit/script b/acceptance/cmd/workspace/jobs/runs-submit/script
new file mode 100644
index 00000000000..68c7a47b6fc
--- /dev/null
+++ b/acceptance/cmd/workspace/jobs/runs-submit/script
@@ -0,0 +1,25 @@
+trace $CLI jobs submit --no-wait --json '{
+  "run_name": "ssh-tunnel",
+  "tasks": [
+    {
+      "task_key": "main",
+      "environment_key": "default",
+      "notebook_task": {
+        "notebook_path": "/Workspace/notebook"
+      }
+    }
+  ],
+  "environments": [
+    {
+      "environment_key": "default",
+      "spec": {
+        "base_environment": "workspace-base-environments/databricks_ai_v4",
+        "environment_version": "4"
+      }
+    }
+  ]
+}'
+
+# The test server records the submitted spec so tests can assert that
+# base_environment is present in the environments block.
+trace print_requests.py //jobs/runs/submit
diff --git a/acceptance/cmd/workspace/jobs/runs-submit/test.toml b/acceptance/cmd/workspace/jobs/runs-submit/test.toml
new file mode 100644
index 00000000000..8ff027e8dfa
--- /dev/null
+++ b/acceptance/cmd/workspace/jobs/runs-submit/test.toml
@@ -0,0 +1,9 @@
+Cloud = false
+
+RecordRequests = true
+
+# This command does not touch the bundle engine; run it once.
+
+[[Repls]]
+Old = '"run_id": \d+'
+New = '"run_id": [RUN_ID]'
diff --git a/acceptance/cmd/workspace/postgres/create-branch/out.test.toml b/acceptance/cmd/workspace/postgres/create-branch/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/workspace/postgres/create-branch/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/workspace/postgres/create-branch/output.txt b/acceptance/cmd/workspace/postgres/create-branch/output.txt
new file mode 100644
index 00000000000..77a585bc3d0
--- /dev/null
+++ b/acceptance/cmd/workspace/postgres/create-branch/output.txt
@@ -0,0 +1,99 @@
+
+=== Set up the parent project
+=== create-branch --ttl: API (604800s), Go (168h) and day (7d) forms all go on the wire as seconds
+=== create-branch --no-expiry
+=== create-branch --ttl combined with a --json spec: the flag's ttl survives the json merge
+=== the pre-existing flags still work alongside --ttl: --name (body), --replace-existing (query), --timeout (wait)
+=== the --no-wait path still works alongside --no-expiry
+=== An expiration is required: no flag fails before any API call (no request recorded)
+=== Conflicting flags fail before any API call (no request recorded)
+=== --no-expiry with a --json that also sets spec.no_expiry is a conflict, not a silent override
+=== Malformed --json fails client-side
+=== An empty spec.ttl in --json fails client-side
+=== Recorded create-branch request bodies{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/acc-proj/branches",
+  "q": {
+    "branch_id": "branch-ttl-api"
+  },
+  "body": {
+    "spec": {
+      "ttl": "604800s"
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/acc-proj/branches",
+  "q": {
+    "branch_id": "branch-ttl-go"
+  },
+  "body": {
+    "spec": {
+      "ttl": "604800s"
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/acc-proj/branches",
+  "q": {
+    "branch_id": "branch-ttl-days"
+  },
+  "body": {
+    "spec": {
+      "ttl": "604800s"
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/acc-proj/branches",
+  "q": {
+    "branch_id": "branch-noexp"
+  },
+  "body": {
+    "spec": {
+      "no_expiry": true
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/acc-proj/branches",
+  "q": {
+    "branch_id": "branch-mix"
+  },
+  "body": {
+    "spec": {
+      "source_branch": "projects/acc-proj/branches/production",
+      "ttl": "604800s"
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/acc-proj/branches",
+  "q": {
+    "branch_id": "branch-flags",
+    "replace_existing": "true"
+  },
+  "body": {
+    "name": "display-name",
+    "spec": {
+      "ttl": "604800s"
+    }
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/postgres/projects/acc-proj/branches",
+  "q": {
+    "branch_id": "branch-nowait"
+  },
+  "body": {
+    "spec": {
+      "no_expiry": true
+    }
+  }
+}
diff --git a/acceptance/cmd/workspace/postgres/create-branch/script b/acceptance/cmd/workspace/postgres/create-branch/script
new file mode 100644
index 00000000000..a9849746997
--- /dev/null
+++ b/acceptance/cmd/workspace/postgres/create-branch/script
@@ -0,0 +1,37 @@
+title "Set up the parent project"
+$CLI postgres create-project acc-proj > LOG.setup 2>&1
+
+title "create-branch --ttl: API (604800s), Go (168h) and day (7d) forms all go on the wire as seconds"
+$CLI postgres create-branch projects/acc-proj branch-ttl-api --ttl 604800s > LOG.ttl-api 2>&1
+$CLI postgres create-branch projects/acc-proj branch-ttl-go --ttl 168h > LOG.ttl-go 2>&1
+$CLI postgres create-branch projects/acc-proj branch-ttl-days --ttl 7d > LOG.ttl-days 2>&1
+
+title "create-branch --no-expiry"
+$CLI postgres create-branch projects/acc-proj branch-noexp --no-expiry > LOG.noexp 2>&1
+
+title "create-branch --ttl combined with a --json spec: the flag's ttl survives the json merge"
+$CLI postgres create-branch projects/acc-proj branch-mix --ttl 604800s --json '{"spec":{"source_branch":"projects/acc-proj/branches/production"}}' > LOG.mix 2>&1
+
+title "the pre-existing flags still work alongside --ttl: --name (body), --replace-existing (query), --timeout (wait)"
+$CLI postgres create-branch projects/acc-proj branch-flags --ttl 168h --name display-name --replace-existing --timeout 60s > LOG.flags 2>&1
+
+title "the --no-wait path still works alongside --no-expiry"
+$CLI postgres create-branch projects/acc-proj branch-nowait --no-expiry --no-wait > LOG.nowait 2>&1
+
+title "An expiration is required: no flag fails before any API call (no request recorded)"
+musterr $CLI postgres create-branch projects/acc-proj branch-none &> LOG.required
+
+title "Conflicting flags fail before any API call (no request recorded)"
+musterr $CLI postgres create-branch projects/acc-proj branch-conflict --ttl 1h --no-expiry &> LOG.conflict
+
+title "--no-expiry with a --json that also sets spec.no_expiry is a conflict, not a silent override"
+musterr $CLI postgres create-branch projects/acc-proj branch-both --no-expiry --json '{"spec":{"no_expiry":false}}' &> LOG.both
+
+title "Malformed --json fails client-side"
+musterr $CLI postgres create-branch projects/acc-proj branch-badjson --json 'not json' &> LOG.badjson
+
+title "An empty spec.ttl in --json fails client-side"
+musterr $CLI postgres create-branch projects/acc-proj branch-emptyttl --json '{"spec":{"ttl":""}}' &> LOG.emptyttl
+
+title "Recorded create-branch request bodies"
+print_requests.py //branches
diff --git a/acceptance/cmd/workspace/postgres/create-branch/test.toml b/acceptance/cmd/workspace/postgres/create-branch/test.toml
new file mode 100644
index 00000000000..8d4b95d31a5
--- /dev/null
+++ b/acceptance/cmd/workspace/postgres/create-branch/test.toml
@@ -0,0 +1,3 @@
+RecordRequests = true
+
+# Not a bundle command; pin a single engine so it runs once.
diff --git a/acceptance/cmd/workspace/put-secret/out.test.toml b/acceptance/cmd/workspace/put-secret/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/workspace/put-secret/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/workspace/put-secret/output.txt b/acceptance/cmd/workspace/put-secret/output.txt
new file mode 100644
index 00000000000..84649163a87
--- /dev/null
+++ b/acceptance/cmd/workspace/put-secret/output.txt
@@ -0,0 +1,51 @@
+
+>>> [CLI] secrets create-scope test-scope
+
+=== --string-value is sent verbatim and read back as-is
+
+>>> [CLI] secrets put-secret test-scope string-key --string-value test-value
+with-newlines
+
+
+>>> [CLI] secrets get-secret test-scope string-key
+{
+  "key": "string-key",
+  "value": "dGVzdC12YWx1ZQp3aXRoLW5ld2xpbmVzCg=="
+}
+
+=== --bytes-value is base64-encoded by the CLI before it is sent
+
+>>> [CLI] secrets put-secret test-scope bytes-key --bytes-value 

+
+>>> [CLI] secrets get-secret test-scope bytes-key
+{
+  "key": "bytes-key",
+  "value": "AQID"
+}
+
+=== the two value flags are mutually exclusive
+
+>>> musterr [CLI] secrets put-secret test-scope k --string-value a --bytes-value b
+Error: cannot specify both --bytes-value and --string-value
+
+=== what the CLI actually put on the wire
+
+>>> print_requests.py //api/2.0/secrets/put
+{
+  "method": "POST",
+  "path": "/api/2.0/secrets/put",
+  "body": {
+    "key": "string-key",
+    "scope": "test-scope",
+    "string_value": "test-value\nwith-newlines\n"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/secrets/put",
+  "body": {
+    "bytes_value": "AQID",
+    "key": "bytes-key",
+    "scope": "test-scope"
+  }
+}
diff --git a/acceptance/cmd/workspace/put-secret/script b/acceptance/cmd/workspace/put-secret/script
new file mode 100644
index 00000000000..a4f41d32b1e
--- /dev/null
+++ b/acceptance/cmd/workspace/put-secret/script
@@ -0,0 +1,23 @@
+scope="test-scope"
+trace $CLI secrets create-scope $scope
+
+title "--string-value is sent verbatim and read back as-is\n"
+trace $CLI secrets put-secret $scope string-key --string-value "test-value
+with-newlines
+"
+trace $CLI secrets get-secret $scope string-key
+
+# Non-printable bytes, to show the CLI base64-encodes the raw bytes. They are
+# kept ASCII on purpose: Git Bash re-encodes non-UTF-8 argv bytes (\xfe becomes
+# \xc3\xbe), which would make the payload differ on Windows. A null byte is not
+# usable either, since bash drops it from "$(...)".
+title "--bytes-value is base64-encoded by the CLI before it is sent\n"
+bytes=$(printf '\x01\x02\x03')
+trace $CLI secrets put-secret $scope bytes-key --bytes-value "$bytes"
+trace $CLI secrets get-secret $scope bytes-key
+
+title "the two value flags are mutually exclusive\n"
+trace musterr $CLI secrets put-secret $scope k --string-value a --bytes-value b
+
+title "what the CLI actually put on the wire\n"
+trace print_requests.py //api/2.0/secrets/put
diff --git a/acceptance/cmd/workspace/put-secret/test.toml b/acceptance/cmd/workspace/put-secret/test.toml
new file mode 100644
index 00000000000..159efe02696
--- /dev/null
+++ b/acceptance/cmd/workspace/put-secret/test.toml
@@ -0,0 +1 @@
+RecordRequests = true
diff --git a/acceptance/cmd/workspace/queries/out.test.toml b/acceptance/cmd/workspace/queries/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/workspace/queries/out.test.toml
+++ b/acceptance/cmd/workspace/queries/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/workspace/query-history/out.test.toml b/acceptance/cmd/workspace/query-history/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/workspace/query-history/out.test.toml
+++ b/acceptance/cmd/workspace/query-history/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/workspace/secrets/out.test.toml b/acceptance/cmd/workspace/secrets/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/cmd/workspace/secrets/out.test.toml
+++ b/acceptance/cmd/workspace/secrets/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/workspace/secrets/output.txt b/acceptance/cmd/workspace/secrets/output.txt
index bfafcb3416b..d0cf9312c6b 100644
--- a/acceptance/cmd/workspace/secrets/output.txt
+++ b/acceptance/cmd/workspace/secrets/output.txt
@@ -15,7 +15,7 @@ Usage:
   databricks secrets [flags]
   databricks secrets [command]
 
-Available Commands
+Available Commands:
   create-scope  Create a new secret scope.
   delete-acl    Delete an ACL.
   delete-scope  Delete a secret scope.
diff --git a/acceptance/cmd/workspace/storage-credentials-list/out.test.toml b/acceptance/cmd/workspace/storage-credentials-list/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/workspace/storage-credentials-list/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/workspace/storage-credentials-list/output.txt b/acceptance/cmd/workspace/storage-credentials-list/output.txt
new file mode 100644
index 00000000000..5f606ea4656
--- /dev/null
+++ b/acceptance/cmd/workspace/storage-credentials-list/output.txt
@@ -0,0 +1,4 @@
+
+>>> [CLI] storage-credentials list
+ID    Name                  Credentials
+1234  some-test-credential  
diff --git a/acceptance/cmd/workspace/storage-credentials-list/script b/acceptance/cmd/workspace/storage-credentials-list/script
new file mode 100644
index 00000000000..594e90f3899
--- /dev/null
+++ b/acceptance/cmd/workspace/storage-credentials-list/script
@@ -0,0 +1 @@
+trace $CLI storage-credentials list
diff --git a/acceptance/dbr_runner.py b/acceptance/dbr_runner.py
index ba646b183e5..d870fa379bc 100644
--- a/acceptance/dbr_runner.py
+++ b/acceptance/dbr_runner.py
@@ -17,7 +17,6 @@
 import os
 import platform
 import subprocess
-import sys
 import tarfile
 from pathlib import Path
 
@@ -74,8 +73,7 @@ def extract_archive(archive_path: str) -> Path:
     # The archive_path may be a FUSE path (with /Workspace prefix) or an API path.
     # The workspace API expects paths without the /Workspace prefix.
     api_path = archive_path
-    if api_path.startswith("/Workspace"):
-        api_path = api_path[len("/Workspace") :]
+    api_path = api_path.removeprefix("/Workspace")
 
     w = get_workspace_client()
 
@@ -118,6 +116,15 @@ def setup_environment(extract_dir: Path) -> dict:
     bin_dir = extract_dir / "bin" / arch
     go_bin_dir = bin_dir / "go" / "bin"
 
+    # Serverless does not guarantee the driver CPU architecture, so it may run one
+    # the archive was not built for. Fail with the detected architecture instead of
+    # a bare "FileNotFoundError: 'go'" that hides which architecture was missing.
+    if not (go_bin_dir / "go").is_file():
+        raise RuntimeError(
+            f"no Go toolchain for architecture {arch!r} (platform.machine()={machine!r}) "
+            f"in the test archive at {go_bin_dir}"
+        )
+
     path_entries = [
         str(go_bin_dir),
         str(bin_dir),
@@ -186,9 +193,6 @@ def run_tests(
 
     # Cloud tests: run with CLOUD_ENV set and workspace access
     env["CLOUD_ENV"] = cloud_env
-    # Only tests using direct deployment are run on DBR.
-    # Terraform based tests are out of scope for DBR.
-    env["ENVFILTER"] = "DATABRICKS_BUNDLE_ENGINE=direct"
 
     if test_default_warehouse_id:
         env["TEST_DEFAULT_WAREHOUSE_ID"] = test_default_warehouse_id
@@ -218,7 +222,7 @@ def run_tests(
     print(f"Working directory: {cli_dir}")
     print(f"CLOUD_ENV: {cloud_env}")
     print(f"Test filter: {test_filter or '(all tests)'}")
-    print(f"Go version: ", end="", flush=True)
+    print("Go version: ", end="", flush=True)
 
     # Print Go version for debugging
     subprocess.run(["go", "version"], cwd=cli_dir, env=env)
diff --git a/acceptance/dbr_test.go b/acceptance/dbr_test.go
index 2fe498698a1..28a9ce2aca5 100644
--- a/acceptance/dbr_test.go
+++ b/acceptance/dbr_test.go
@@ -9,14 +9,15 @@ import (
 	"path/filepath"
 	"testing"
 	"time"
+	"uuid"
 
 	"github.com/databricks/cli/internal/testarchive"
 	"github.com/databricks/cli/libs/filer"
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/service/compute"
+	"github.com/databricks/databricks-sdk-go/service/iam"
 	"github.com/databricks/databricks-sdk-go/service/jobs"
 	"github.com/databricks/databricks-sdk-go/service/workspace"
-	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -27,7 +28,7 @@ func workspaceTmpDir(ctx context.Context, t *testing.T) string {
 	w, err := databricks.NewWorkspaceClient()
 	require.NoError(t, err)
 
-	currentUser, err := w.CurrentUser.Me(ctx)
+	currentUser, err := w.CurrentUser.Me(ctx, iam.MeRequest{})
 	require.NoError(t, err)
 
 	timestamp := time.Now().Format("2006-01-02T15:04:05Z")
@@ -79,13 +80,13 @@ func setupDbrTestDir(ctx context.Context, t *testing.T, uniqueID string) (*datab
 	w, err := databricks.NewWorkspaceClient()
 	require.NoError(t, err)
 
-	currentUser, err := w.CurrentUser.Me(ctx)
+	currentUser, err := w.CurrentUser.Me(ctx, iam.MeRequest{})
 	require.NoError(t, err)
 
 	// API path (without /Workspace prefix) for workspace API calls.
 	apiPath := path.Join("/Users", currentUser.UserName, "dbr-acceptance-test", uniqueID)
 
-	err = w.Workspace.MkdirsByPath(ctx, apiPath) //nolint:staticcheck // Deprecated in SDK v0.127.0. Migration to WorkspaceHierarchyService tracked separately.
+	err = w.Workspace.MkdirsByPath(ctx, apiPath)
 	require.NoError(t, err)
 
 	// Note: We do not cleanup test directories created here. They are kept around
@@ -180,12 +181,12 @@ func runDbrTests(ctx context.Context, t *testing.T, w *databricks.WorkspaceClien
 		t.Fatal("CLOUD_ENV is not set. Please run DBR tests from a CI environment with deco env run.")
 	}
 
-	currentUser, err := w.CurrentUser.Me(ctx)
+	currentUser, err := w.CurrentUser.Me(ctx, iam.MeRequest{})
 	require.NoError(t, err)
 
 	// Create debug logs directory
 	debugLogsDir := path.Join("/Users", currentUser.UserName, "dbr_acceptance_tests")
-	err = w.Workspace.MkdirsByPath(ctx, debugLogsDir) //nolint:staticcheck // Deprecated in SDK v0.127.0. Migration to WorkspaceHierarchyService tracked separately.
+	err = w.Workspace.MkdirsByPath(ctx, debugLogsDir)
 	require.NoError(t, err)
 
 	// Create an empty debug log file so we can get its URL before the job runs.
@@ -204,7 +205,7 @@ func runDbrTests(ctx context.Context, t *testing.T, w *databricks.WorkspaceClien
 	require.NoError(t, err)
 
 	// Get the file's object ID for the URL
-	debugLogStatus, err := w.Workspace.GetStatusByPath(ctx, debugLogPath) //nolint:staticcheck // Deprecated in SDK v0.127.0. Migration to WorkspaceHierarchyService tracked separately.
+	debugLogStatus, err := w.Workspace.GetStatusByPath(ctx, debugLogPath)
 	require.NoError(t, err)
 
 	// Build cloud test parameters (Cloud=true tests, run with CLOUD_ENV set)
diff --git a/acceptance/experimental/aitools/skills/install-experimental-empty/out.test.toml b/acceptance/experimental/aitools/skills/install-experimental-empty/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/install-experimental-empty/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/experimental/aitools/skills/install-experimental-empty/output.txt b/acceptance/experimental/aitools/skills/install-experimental-empty/output.txt
new file mode 100644
index 00000000000..c1a6249bf76
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/install-experimental-empty/output.txt
@@ -0,0 +1,10 @@
+
+=== --experimental against a manifest with no experimental skills logs a nudge
+>>> [CLI] experimental aitools install --skills-only --global --experimental
+Command "install" is deprecated, use "databricks aitools install" instead.
+Flag --global has been deprecated, use --scope=global
+Installing Databricks skills for Claude Code...
+Using skills version test-ref
+Fetching skills manifest...
+Warn: --experimental was set but the manifest at test-ref exposes no experimental skills. Set DATABRICKS_SKILLS_REF to a release or ref that includes them.
+Installed 1 skill.
diff --git a/acceptance/experimental/aitools/skills/install-experimental-empty/script b/acceptance/experimental/aitools/skills/install-experimental-empty/script
new file mode 100644
index 00000000000..5e8a2c98749
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/install-experimental-empty/script
@@ -0,0 +1,7 @@
+# Isolate HOME so parallel aitools tests don't race on a shared ~/.databricks.
+sethome home
+# Agent detection needs ~/.claude; prefer USERPROFILE on Windows.
+mkdir -p "${USERPROFILE:-$HOME}/.claude"
+
+title "--experimental against a manifest with no experimental skills logs a nudge"
+trace $CLI experimental aitools install --skills-only --global --experimental
diff --git a/acceptance/experimental/aitools/skills/install-experimental-empty/test.toml b/acceptance/experimental/aitools/skills/install-experimental-empty/test.toml
new file mode 100644
index 00000000000..628b214ef71
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/install-experimental-empty/test.toml
@@ -0,0 +1,28 @@
+Env.DATABRICKS_SKILLS_BASE_URL = "$DATABRICKS_HOST"
+Env.DATABRICKS_SKILLS_REF = "test-ref"
+
+Ignore = [
+    "home",
+]
+
+# Stable-only manifest (no repo_dir=experimental).
+[[Server]]
+Pattern = "GET /test-ref/manifest.json"
+Response.Body = '''
+{
+  "version": "2",
+  "updated_at": "2026-01-01T00:00:00Z",
+  "skills": {
+    "test-stable": {"version": "1.0.0", "files": ["SKILL.md"]}
+  }
+}
+'''
+
+[[Server]]
+Pattern = "GET /test-ref/skills/test-stable/SKILL.md"
+Response.Body = '''---
+name: test-stable
+---
+
+# Stable
+'''
diff --git a/acceptance/experimental/aitools/skills/install-output-json-agent-error/out.test.toml b/acceptance/experimental/aitools/skills/install-output-json-agent-error/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/install-output-json-agent-error/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/experimental/aitools/skills/install-output-json-agent-error/output.txt b/acceptance/experimental/aitools/skills/install-output-json-agent-error/output.txt
new file mode 100644
index 00000000000..6860d375fa5
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/install-output-json-agent-error/output.txt
@@ -0,0 +1,22 @@
+
+=== install --output json records a per-agent error category
+>>> [CLI] aitools install --skills-only --scope=project --agents=claude-code,cursor --output json
+{
+  "scope": "project",
+  "agents": [
+    {
+      "name": "claude-code",
+      "delivery": "skills",
+      "status": "installed"
+    },
+    {
+      "name": "cursor",
+      "delivery": "skip",
+      "status": "skipped",
+      "error_category": "UNSUPPORTED_SCOPE",
+      "message": "does not support project-scoped skills"
+    }
+  ]
+}
+
+Exit code: 1
diff --git a/acceptance/experimental/aitools/skills/install-output-json-agent-error/script b/acceptance/experimental/aitools/skills/install-output-json-agent-error/script
new file mode 100644
index 00000000000..c84ede5e39b
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/install-output-json-agent-error/script
@@ -0,0 +1,9 @@
+# Isolate HOME so parallel aitools tests don't race on a shared ~/.databricks.
+sethome home
+
+title "install --output json records a per-agent error category"
+# claude-code supports project-scoped skills; cursor does not. At --scope=project,
+# claude-code installs while cursor is skipped with an UNSUPPORTED_SCOPE category in
+# its own agents[] entry (the top-level error_category stays unset because the
+# failure is per-agent). cursor was named explicitly, so the run exits non-zero.
+trace $CLI aitools install --skills-only --scope=project --agents=claude-code,cursor --output json
diff --git a/acceptance/experimental/aitools/skills/install-output-json-agent-error/test.toml b/acceptance/experimental/aitools/skills/install-output-json-agent-error/test.toml
new file mode 100644
index 00000000000..951939e9011
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/install-output-json-agent-error/test.toml
@@ -0,0 +1,35 @@
+# Mock server replaces raw.githubusercontent.com for manifest + skill files.
+Env.DATABRICKS_SKILLS_BASE_URL = "$DATABRICKS_HOST"
+Env.DATABRICKS_SKILLS_REF = "test-ref"
+
+Ignore = [
+    "home",
+    ".claude",
+    ".databricks",
+]
+
+[[Server]]
+Pattern = "GET /test-ref/manifest.json"
+Response.Body = '''
+{
+  "version": "2",
+  "updated_at": "2026-01-01T00:00:00Z",
+  "skills": {
+    "test-stable": {
+      "version": "1.0.0",
+      "description": "Stable test skill",
+      "files": ["SKILL.md"],
+      "repo_dir": "skills"
+    }
+  }
+}
+'''
+
+[[Server]]
+Pattern = "GET /test-ref/skills/test-stable/SKILL.md"
+Response.Body = '''---
+name: test-stable
+---
+
+# Test stable skill
+'''
diff --git a/acceptance/experimental/aitools/skills/install-output-json-agents-skipped/out.test.toml b/acceptance/experimental/aitools/skills/install-output-json-agents-skipped/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/install-output-json-agents-skipped/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/experimental/aitools/skills/install-output-json-agents-skipped/output.txt b/acceptance/experimental/aitools/skills/install-output-json-agents-skipped/output.txt
new file mode 100644
index 00000000000..01c511aaf17
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/install-output-json-agents-skipped/output.txt
@@ -0,0 +1,24 @@
+
+=== install --output json: every named agent skipped, each with its own category
+>>> [CLI] aitools install --skills-only --scope=project --agents=cursor,codex --output json
+{
+  "scope": "project",
+  "agents": [
+    {
+      "name": "cursor",
+      "delivery": "skip",
+      "status": "skipped",
+      "error_category": "UNSUPPORTED_SCOPE",
+      "message": "does not support project-scoped skills"
+    },
+    {
+      "name": "codex",
+      "delivery": "skip",
+      "status": "skipped",
+      "error_category": "UNSUPPORTED_SCOPE",
+      "message": "does not support project-scoped skills"
+    }
+  ]
+}
+
+Exit code: 1
diff --git a/acceptance/experimental/aitools/skills/install-output-json-agents-skipped/script b/acceptance/experimental/aitools/skills/install-output-json-agents-skipped/script
new file mode 100644
index 00000000000..6e23f81762c
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/install-output-json-agents-skipped/script
@@ -0,0 +1,9 @@
+# Isolate HOME so parallel aitools tests don't race on a shared ~/.databricks.
+sethome home
+
+title "install --output json: every named agent skipped, each with its own category"
+# Neither cursor nor codex supports project-scoped skills, so at --scope=project both
+# are skipped with a per-agent UNSUPPORTED_SCOPE category and nothing is installed (no
+# manifest fetch). Both were named explicitly, so the run exits non-zero, yet the
+# top-level error_category stays unset because every failure is per-agent.
+trace $CLI aitools install --skills-only --scope=project --agents=cursor,codex --output json
diff --git a/acceptance/experimental/aitools/skills/install-output-json-agents-skipped/test.toml b/acceptance/experimental/aitools/skills/install-output-json-agents-skipped/test.toml
new file mode 100644
index 00000000000..96cb960eefd
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/install-output-json-agents-skipped/test.toml
@@ -0,0 +1,8 @@
+# Every named agent is skipped for scope before any manifest fetch, so no skills
+# server is needed and nothing is written outside the isolated home.
+Env.DATABRICKS_SKILLS_BASE_URL = "$DATABRICKS_HOST"
+Env.DATABRICKS_SKILLS_REF = "test-ref"
+
+Ignore = [
+    "home",
+]
diff --git a/acceptance/experimental/aitools/skills/install-output-json-error/out.test.toml b/acceptance/experimental/aitools/skills/install-output-json-error/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/install-output-json-error/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/experimental/aitools/skills/install-output-json-error/output.txt b/acceptance/experimental/aitools/skills/install-output-json-error/output.txt
new file mode 100644
index 00000000000..db5a78e81e4
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/install-output-json-error/output.txt
@@ -0,0 +1,11 @@
+
+=== install --output json reports a top-level error category and exits non-zero
+>>> [CLI] aitools install --skills-only --scope=global --agents=claude-code --skills=nonexistent --output json
+{
+  "scope": "global",
+  "agents": [],
+  "error": "skill \"nonexistent\" not found",
+  "error_category": "SKILL_NOT_FOUND"
+}
+
+Exit code: 1
diff --git a/acceptance/experimental/aitools/skills/install-output-json-error/script b/acceptance/experimental/aitools/skills/install-output-json-error/script
new file mode 100644
index 00000000000..e4b34a80ff3
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/install-output-json-error/script
@@ -0,0 +1,10 @@
+# Isolate HOME so parallel aitools tests don't race on a shared ~/.databricks.
+sethome home
+
+title "install --output json reports a top-level error category and exits non-zero"
+# A --skills entry absent from the manifest fails before any agent is touched, so the
+# failure has no per-agent entry and surfaces in the top-level error/error_category
+# fields (agents stays empty). In JSON mode progress is silenced and root prints no
+# duplicate "Error:" line, so stdout carries only the JSON document; the command
+# still exits non-zero.
+trace $CLI aitools install --skills-only --scope=global --agents=claude-code --skills=nonexistent --output json
diff --git a/acceptance/experimental/aitools/skills/install-output-json-error/test.toml b/acceptance/experimental/aitools/skills/install-output-json-error/test.toml
new file mode 100644
index 00000000000..0db481f0c6d
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/install-output-json-error/test.toml
@@ -0,0 +1,26 @@
+# Mock server replaces raw.githubusercontent.com for manifest + skill files.
+Env.DATABRICKS_SKILLS_BASE_URL = "$DATABRICKS_HOST"
+Env.DATABRICKS_SKILLS_REF = "test-ref"
+
+Ignore = [
+    "home",
+]
+
+# The manifest has one skill; the script asks for a different one so the resolve
+# fails with a skill-not-found error.
+[[Server]]
+Pattern = "GET /test-ref/manifest.json"
+Response.Body = '''
+{
+  "version": "2",
+  "updated_at": "2026-01-01T00:00:00Z",
+  "skills": {
+    "test-stable": {
+      "version": "1.0.0",
+      "description": "Stable test skill",
+      "files": ["SKILL.md"],
+      "repo_dir": "skills"
+    }
+  }
+}
+'''
diff --git a/acceptance/experimental/aitools/skills/install-output-json-experimental-error/out.test.toml b/acceptance/experimental/aitools/skills/install-output-json-experimental-error/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/install-output-json-experimental-error/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/experimental/aitools/skills/install-output-json-experimental-error/output.txt b/acceptance/experimental/aitools/skills/install-output-json-experimental-error/output.txt
new file mode 100644
index 00000000000..513d2d5b5b3
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/install-output-json-experimental-error/output.txt
@@ -0,0 +1,11 @@
+
+=== install --output json categorizes an experimental skill requested without --experimental
+>>> [CLI] aitools install --skills-only --scope=global --agents=claude-code --skills=test-exp --output json
+{
+  "scope": "global",
+  "agents": [],
+  "error": "skill \"test-exp\" is experimental; use --experimental to install",
+  "error_category": "EXPERIMENTAL_SKILL"
+}
+
+Exit code: 1
diff --git a/acceptance/experimental/aitools/skills/install-output-json-experimental-error/script b/acceptance/experimental/aitools/skills/install-output-json-experimental-error/script
new file mode 100644
index 00000000000..3b68e727fb4
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/install-output-json-experimental-error/script
@@ -0,0 +1,8 @@
+# Isolate HOME so parallel aitools tests don't race on a shared ~/.databricks.
+sethome home
+
+title "install --output json categorizes an experimental skill requested without --experimental"
+# Requesting an experimental skill without --experimental fails during skill
+# resolution, before any agent is touched, so the failure has no per-agent entry
+# and surfaces in the top-level error/error_category fields (EXPERIMENTAL_SKILL).
+trace $CLI aitools install --skills-only --scope=global --agents=claude-code --skills=test-exp --output json
diff --git a/acceptance/experimental/aitools/skills/install-output-json-experimental-error/test.toml b/acceptance/experimental/aitools/skills/install-output-json-experimental-error/test.toml
new file mode 100644
index 00000000000..5a911b5456d
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/install-output-json-experimental-error/test.toml
@@ -0,0 +1,26 @@
+# Mock server replaces raw.githubusercontent.com for manifest + skill files.
+Env.DATABRICKS_SKILLS_BASE_URL = "$DATABRICKS_HOST"
+Env.DATABRICKS_SKILLS_REF = "test-ref"
+
+Ignore = [
+    "home",
+]
+
+# The requested skill is experimental (repo_dir=experimental); the script omits
+# --experimental so resolution fails before any skill file is fetched.
+[[Server]]
+Pattern = "GET /test-ref/manifest.json"
+Response.Body = '''
+{
+  "version": "2",
+  "updated_at": "2026-01-01T00:00:00Z",
+  "skills": {
+    "test-exp": {
+      "version": "0.0.1",
+      "description": "Experimental test skill",
+      "files": ["SKILL.md"],
+      "repo_dir": "experimental"
+    }
+  }
+}
+'''
diff --git a/acceptance/experimental/aitools/skills/install-output-json/out.test.toml b/acceptance/experimental/aitools/skills/install-output-json/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/install-output-json/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/experimental/aitools/skills/install-output-json/output.txt b/acceptance/experimental/aitools/skills/install-output-json/output.txt
new file mode 100644
index 00000000000..5caa3daf14b
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/install-output-json/output.txt
@@ -0,0 +1,13 @@
+
+=== install --output json emits only the JSON document; progress is silenced
+>>> [CLI] aitools install --skills-only --scope=global --agents=claude-code --output json
+{
+  "scope": "global",
+  "agents": [
+    {
+      "name": "claude-code",
+      "delivery": "skills",
+      "status": "installed"
+    }
+  ]
+}
diff --git a/acceptance/experimental/aitools/skills/install-output-json/script b/acceptance/experimental/aitools/skills/install-output-json/script
new file mode 100644
index 00000000000..93c6637462c
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/install-output-json/script
@@ -0,0 +1,8 @@
+# Isolate HOME so parallel aitools tests don't race on a shared ~/.databricks.
+sethome home
+
+title "install --output json emits only the JSON document; progress is silenced"
+# --agents makes the run fully non-interactive (no picker, no scope prompt), which
+# --output json requires. In JSON mode the command silences its human-readable
+# progress, so the only thing written is the JSON payload on stdout.
+trace $CLI aitools install --skills-only --scope=global --agents=claude-code --output json
diff --git a/acceptance/experimental/aitools/skills/install-output-json/test.toml b/acceptance/experimental/aitools/skills/install-output-json/test.toml
new file mode 100644
index 00000000000..7afa69b4552
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/install-output-json/test.toml
@@ -0,0 +1,33 @@
+# Mock server replaces raw.githubusercontent.com for manifest + skill files.
+Env.DATABRICKS_SKILLS_BASE_URL = "$DATABRICKS_HOST"
+Env.DATABRICKS_SKILLS_REF = "test-ref"
+
+Ignore = [
+    "home",
+]
+
+[[Server]]
+Pattern = "GET /test-ref/manifest.json"
+Response.Body = '''
+{
+  "version": "2",
+  "updated_at": "2026-01-01T00:00:00Z",
+  "skills": {
+    "test-stable": {
+      "version": "1.0.0",
+      "description": "Stable test skill",
+      "files": ["SKILL.md"],
+      "repo_dir": "skills"
+    }
+  }
+}
+'''
+
+[[Server]]
+Pattern = "GET /test-ref/skills/test-stable/SKILL.md"
+Response.Body = '''---
+name: test-stable
+---
+
+# Test stable skill
+'''
diff --git a/acceptance/experimental/aitools/skills/install-specific/out.test.toml b/acceptance/experimental/aitools/skills/install-specific/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/install-specific/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/experimental/aitools/skills/install-specific/output.txt b/acceptance/experimental/aitools/skills/install-specific/output.txt
new file mode 100644
index 00000000000..dc972dd17d3
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/install-specific/output.txt
@@ -0,0 +1,29 @@
+
+=== install only one specific stable skill via --skills
+>>> [CLI] experimental aitools install --skills-only --global --skills test-stable-a
+Command "install" is deprecated, use "databricks aitools install" instead.
+Flag --global has been deprecated, use --scope=global
+Installing Databricks skills for Claude Code...
+Using skills version test-ref
+Fetching skills manifest...
+Installed 1 skill.
+
+=== install a specific experimental skill
+>>> [CLI] experimental aitools install --skills-only --global --skills test-exp --experimental
+Command "install" is deprecated, use "databricks aitools install" instead.
+Flag --global has been deprecated, use --scope=global
+Installing Databricks skills for Claude Code...
+Using skills version test-ref
+Fetching skills manifest...
+Installed 1 skill.
+
+=== asking for an experimental skill without --experimental flag errors out
+>>> [CLI] experimental aitools install --skills-only --global --skills test-exp
+Command "install" is deprecated, use "databricks aitools install" instead.
+Flag --global has been deprecated, use --scope=global
+Installing Databricks skills for Claude Code...
+Using skills version test-ref
+Fetching skills manifest...
+Error: skill "test-exp" is experimental; use --experimental to install
+
+Exit code: 1
diff --git a/acceptance/experimental/aitools/skills/install-specific/script b/acceptance/experimental/aitools/skills/install-specific/script
new file mode 100644
index 00000000000..5bcc9b7dfa5
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/install-specific/script
@@ -0,0 +1,13 @@
+# Isolate HOME so parallel aitools tests don't race on a shared ~/.databricks.
+sethome home
+# Agent detection needs ~/.claude; prefer USERPROFILE on Windows.
+mkdir -p "${USERPROFILE:-$HOME}/.claude"
+
+title "install only one specific stable skill via --skills"
+trace $CLI experimental aitools install --skills-only --global --skills test-stable-a
+
+title "install a specific experimental skill"
+trace $CLI experimental aitools install --skills-only --global --skills test-exp --experimental
+
+title "asking for an experimental skill without --experimental flag errors out"
+errcode trace $CLI experimental aitools install --skills-only --global --skills test-exp
diff --git a/acceptance/experimental/aitools/skills/install-specific/test.toml b/acceptance/experimental/aitools/skills/install-specific/test.toml
new file mode 100644
index 00000000000..62e6a349867
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/install-specific/test.toml
@@ -0,0 +1,47 @@
+Env.DATABRICKS_SKILLS_BASE_URL = "$DATABRICKS_HOST"
+Env.DATABRICKS_SKILLS_REF = "test-ref"
+
+Ignore = [
+    "home",
+]
+
+[[Server]]
+Pattern = "GET /test-ref/manifest.json"
+Response.Body = '''
+{
+  "version": "2",
+  "updated_at": "2026-01-01T00:00:00Z",
+  "skills": {
+    "test-stable-a": {"version": "1.0.0", "files": ["SKILL.md"], "repo_dir": "skills"},
+    "test-stable-b": {"version": "1.0.0", "files": ["SKILL.md"], "repo_dir": "skills"},
+    "test-exp":      {"version": "0.0.1", "files": ["SKILL.md"], "repo_dir": "experimental"}
+  }
+}
+'''
+
+[[Server]]
+Pattern = "GET /test-ref/skills/test-stable-a/SKILL.md"
+Response.Body = '''---
+name: test-stable-a
+---
+
+# A
+'''
+
+[[Server]]
+Pattern = "GET /test-ref/skills/test-stable-b/SKILL.md"
+Response.Body = '''---
+name: test-stable-b
+---
+
+# B
+'''
+
+[[Server]]
+Pattern = "GET /test-ref/experimental/test-exp/SKILL.md"
+Response.Body = '''---
+name: test-exp
+---
+
+# Exp
+'''
diff --git a/acceptance/experimental/aitools/skills/install/out.test.toml b/acceptance/experimental/aitools/skills/install/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/install/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/experimental/aitools/skills/install/output.txt b/acceptance/experimental/aitools/skills/install/output.txt
new file mode 100644
index 00000000000..bcd43f22227
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/install/output.txt
@@ -0,0 +1,27 @@
+
+=== stable-only install (no --experimental flag) installs 1 skill
+>>> [CLI] experimental aitools install --skills-only --global
+Command "install" is deprecated, use "databricks aitools install" instead.
+Flag --global has been deprecated, use --scope=global
+Installing Databricks skills for Claude Code...
+Using skills version test-ref
+Fetching skills manifest...
+Installed 1 skill.
+
+=== re-run with --experimental installs the experimental one too
+>>> [CLI] experimental aitools install --skills-only --global --experimental
+Command "install" is deprecated, use "databricks aitools install" instead.
+Flag --global has been deprecated, use --scope=global
+Installing Databricks skills for Claude Code...
+Using skills version test-ref
+Fetching skills manifest...
+Installed 2 skills.
+
+=== no-op re-run is idempotent (no new fetches, no errors)
+>>> [CLI] experimental aitools install --skills-only --global --experimental
+Command "install" is deprecated, use "databricks aitools install" instead.
+Flag --global has been deprecated, use --scope=global
+Installing Databricks skills for Claude Code...
+Using skills version test-ref
+Fetching skills manifest...
+Installed 2 skills.
diff --git a/acceptance/experimental/aitools/skills/install/script b/acceptance/experimental/aitools/skills/install/script
new file mode 100644
index 00000000000..b0d06cf4859
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/install/script
@@ -0,0 +1,13 @@
+# Isolate HOME so parallel aitools tests don't race on a shared ~/.databricks.
+sethome home
+# Agent detection needs ~/.claude; prefer USERPROFILE on Windows.
+mkdir -p "${USERPROFILE:-$HOME}/.claude"
+
+title "stable-only install (no --experimental flag) installs 1 skill"
+trace $CLI experimental aitools install --skills-only --global
+
+title "re-run with --experimental installs the experimental one too"
+trace $CLI experimental aitools install --skills-only --global --experimental
+
+title "no-op re-run is idempotent (no new fetches, no errors)"
+trace $CLI experimental aitools install --skills-only --global --experimental
diff --git a/acceptance/experimental/aitools/skills/install/test.toml b/acceptance/experimental/aitools/skills/install/test.toml
new file mode 100644
index 00000000000..1e893369905
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/install/test.toml
@@ -0,0 +1,49 @@
+# Mock server replaces raw.githubusercontent.com for manifest + skill files.
+Env.DATABRICKS_SKILLS_BASE_URL = "$DATABRICKS_HOST"
+Env.DATABRICKS_SKILLS_REF = "test-ref"
+
+Ignore = [
+    "home",
+]
+
+# Stable + experimental skills via repo_dir.
+[[Server]]
+Pattern = "GET /test-ref/manifest.json"
+Response.Body = '''
+{
+  "version": "2",
+  "updated_at": "2026-01-01T00:00:00Z",
+  "skills": {
+    "test-stable": {
+      "version": "1.0.0",
+      "description": "Stable test skill",
+      "files": ["SKILL.md"],
+      "repo_dir": "skills"
+    },
+    "test-exp": {
+      "version": "0.0.1",
+      "description": "Experimental test skill",
+      "files": ["SKILL.md"],
+      "repo_dir": "experimental"
+    }
+  }
+}
+'''
+
+[[Server]]
+Pattern = "GET /test-ref/skills/test-stable/SKILL.md"
+Response.Body = '''---
+name: test-stable
+---
+
+# Test stable skill
+'''
+
+[[Server]]
+Pattern = "GET /test-ref/experimental/test-exp/SKILL.md"
+Response.Body = '''---
+name: test-exp
+---
+
+# Test experimental skill
+'''
diff --git a/acceptance/experimental/aitools/skills/path-dump/out.test.toml b/acceptance/experimental/aitools/skills/path-dump/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/path-dump/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/experimental/aitools/skills/path-dump/output.txt b/acceptance/experimental/aitools/skills/path-dump/output.txt
new file mode 100644
index 00000000000..f5f7baeba90
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/path-dump/output.txt
@@ -0,0 +1,10 @@
+
+=== dump skills to a directory
+>>> [CLI] experimental aitools install --path dumped
+Command "install" is deprecated, use "databricks aitools install" instead.
+Using skills version test-ref
+Wrote 1 skill to dumped
+
+=== the skill files were written
+>>> find.py dumped.*SKILL.md --expect 1
+dumped/test-stable/SKILL.md
diff --git a/acceptance/experimental/aitools/skills/path-dump/script b/acceptance/experimental/aitools/skills/path-dump/script
new file mode 100644
index 00000000000..b9fb14e2534
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/path-dump/script
@@ -0,0 +1,6 @@
+# --path is a dumb dump: no agents, no state, just the files.
+title "dump skills to a directory"
+trace $CLI experimental aitools install --path dumped
+
+title "the skill files were written"
+trace find.py 'dumped.*SKILL.md' --expect 1
diff --git a/acceptance/experimental/aitools/skills/path-dump/test.toml b/acceptance/experimental/aitools/skills/path-dump/test.toml
new file mode 100644
index 00000000000..b1ddddc7980
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/path-dump/test.toml
@@ -0,0 +1,34 @@
+# Mock server replaces raw.githubusercontent.com for manifest + skill files.
+Env.DATABRICKS_SKILLS_BASE_URL = "$DATABRICKS_HOST"
+Env.DATABRICKS_SKILLS_REF = "test-ref"
+
+# --path writes files into the working directory; don't diff them.
+Ignore = [
+    "dumped",
+]
+
+[[Server]]
+Pattern = "GET /test-ref/manifest.json"
+Response.Body = '''
+{
+  "version": "2",
+  "updated_at": "2026-01-01T00:00:00Z",
+  "skills": {
+    "test-stable": {
+      "version": "1.0.0",
+      "description": "Stable test skill",
+      "files": ["SKILL.md"],
+      "repo_dir": "skills"
+    }
+  }
+}
+'''
+
+[[Server]]
+Pattern = "GET /test-ref/skills/test-stable/SKILL.md"
+Response.Body = '''---
+name: test-stable
+---
+
+# Test stable skill
+'''
diff --git a/acceptance/experimental/aitools/skills/update-prune/out.test.toml b/acceptance/experimental/aitools/skills/update-prune/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/update-prune/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/experimental/aitools/skills/update-prune/output.txt b/acceptance/experimental/aitools/skills/update-prune/output.txt
new file mode 100644
index 00000000000..564957813a4
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/update-prune/output.txt
@@ -0,0 +1,17 @@
+
+=== install two skills
+>>> [CLI] experimental aitools install --skills-only --global
+Command "install" is deprecated, use "databricks aitools install" instead.
+Flag --global has been deprecated, use --scope=global
+Installing Databricks skills for Cursor...
+Using skills version test-ref
+Fetching skills manifest...
+Installed 2 skills.
+
+=== update against a release where beta is gone: alpha updates, beta is pruned
+>>> DATABRICKS_SKILLS_REF=v2-ref [CLI] experimental aitools update --scope global
+Command "update" is deprecated, use "databricks aitools update" instead.
+  updated alpha v1.0.0 -> v2.0.0
+  removed beta (no longer in this release)
+Updated 1 skill.
+Removed 1 skill.
diff --git a/acceptance/experimental/aitools/skills/update-prune/script b/acceptance/experimental/aitools/skills/update-prune/script
new file mode 100644
index 00000000000..bf24ea62fae
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/update-prune/script
@@ -0,0 +1,15 @@
+# Isolate HOME: this test reconciles the whole install state, so it must not
+# share ~/.databricks with the sibling aitools acceptance tests.
+sethome home
+# Detect Cursor, a skills-only agent (no databricks plugin), so update exercises
+# the raw-skill prune path without shelling out to a plugin-capable agent's CLI.
+# A plugin agent (e.g. Claude Code) would run `claude plugin install` during
+# update, making the output depend on whether `claude` is on the host PATH.
+# sethome sets HOME on Windows too, so $HOME is enough here.
+mkdir -p "$HOME/.cursor"
+
+title "install two skills"
+trace $CLI experimental aitools install --skills-only --global
+
+title "update against a release where beta is gone: alpha updates, beta is pruned"
+trace DATABRICKS_SKILLS_REF=v2-ref $CLI experimental aitools update --scope global
diff --git a/acceptance/experimental/aitools/skills/update-prune/test.toml b/acceptance/experimental/aitools/skills/update-prune/test.toml
new file mode 100644
index 00000000000..dbcfc07386f
--- /dev/null
+++ b/acceptance/experimental/aitools/skills/update-prune/test.toml
@@ -0,0 +1,46 @@
+# Mock server replaces raw.githubusercontent.com for manifest + skill files.
+Env.DATABRICKS_SKILLS_BASE_URL = "$DATABRICKS_HOST"
+Env.DATABRICKS_SKILLS_REF = "test-ref"
+
+Ignore = [
+    "home",
+]
+
+# Initial release: alpha + beta.
+[[Server]]
+Pattern = "GET /test-ref/manifest.json"
+Response.Body = '''
+{
+  "version": "1",
+  "updated_at": "2026-01-01T00:00:00Z",
+  "skills": {
+    "alpha": {"version": "1.0.0", "files": ["SKILL.md"], "repo_dir": "skills"},
+    "beta":  {"version": "1.0.0", "files": ["SKILL.md"], "repo_dir": "skills"}
+  }
+}
+'''
+
+[[Server]]
+Pattern = "GET /test-ref/skills/alpha/SKILL.md"
+Response.Body = "alpha v1"
+
+[[Server]]
+Pattern = "GET /test-ref/skills/beta/SKILL.md"
+Response.Body = "beta v1"
+
+# Next release: beta is gone, alpha is bumped.
+[[Server]]
+Pattern = "GET /v2-ref/manifest.json"
+Response.Body = '''
+{
+  "version": "2",
+  "updated_at": "2026-02-01T00:00:00Z",
+  "skills": {
+    "alpha": {"version": "2.0.0", "files": ["SKILL.md"], "repo_dir": "skills"}
+  }
+}
+'''
+
+[[Server]]
+Pattern = "GET /v2-ref/skills/alpha/SKILL.md"
+Response.Body = "alpha v2"
diff --git a/acceptance/experimental/genie/ask-deprecated/out.test.toml b/acceptance/experimental/genie/ask-deprecated/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/experimental/genie/ask-deprecated/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/experimental/genie/ask-deprecated/output.txt b/acceptance/experimental/genie/ask-deprecated/output.txt
new file mode 100644
index 00000000000..475c7538824
--- /dev/null
+++ b/acceptance/experimental/genie/ask-deprecated/output.txt
@@ -0,0 +1,12 @@
+
+=== the deprecated experimental alias still runs but prints a move notice
+>>> [CLI] experimental genie ask What are total sales by franchise?
+Command "ask" is deprecated, use "databricks genie ask" instead; this experimental alias will be removed in a future release
+Alpha leads with 1,250 total sales.
+
+  Total by Franchise
+  ──────────────────
+
+  Alpha ██████████████████████████████████████████████████ 1,250
+   Beta █████████████████████████▌   640
+
diff --git a/acceptance/experimental/genie/ask-deprecated/script b/acceptance/experimental/genie/ask-deprecated/script
new file mode 100644
index 00000000000..c3338131a74
--- /dev/null
+++ b/acceptance/experimental/genie/ask-deprecated/script
@@ -0,0 +1,2 @@
+title "the deprecated experimental alias still runs but prints a move notice"
+trace $CLI experimental genie ask "What are total sales by franchise?"
diff --git a/acceptance/experimental/genie/ask-deprecated/test.toml b/acceptance/experimental/genie/ask-deprecated/test.toml
new file mode 100644
index 00000000000..f21e94bea87
--- /dev/null
+++ b/acceptance/experimental/genie/ask-deprecated/test.toml
@@ -0,0 +1,27 @@
+# No bundle engine needed for this command.
+
+# One canned Genie SSE response covers all invocations in the script. The
+# stream exercises the full pipeline: a reasoning item, a THOUGHT message, an
+# execute_sql call whose .added event carries empty arguments (filled in on
+# .done), the QUERY_EXECUTION result data, a VIZ spec joined to it, the
+# FINAL_RESPONSE message with a viz image reference, and the completion event.
+[[Server]]
+Pattern = "POST /api/2.0/data-rooms/tools/onechat/responses"
+Response.Body = '''
+data: {"type":"response.output_item.added","output_index":0,"item":{"type":"reasoning","id":"r1","status":"in_progress"}}
+
+data: {"type":"response.output_item.added","output_index":1,"item":{"type":"message","id":"t1","role":"assistant","status":"completed","content":[{"type":"output_text","text":"Looking at the sales data...","annotations":[]}],"metadata":{"ui_type":"THOUGHT","source_internal_ids":["m1"]}}}
+
+data: {"type":"response.output_item.added","output_index":2,"item":{"type":"function_call","id":"f1","call_id":"c1","name":"execute_sql","arguments":""}}
+
+data: {"type":"response.output_item.done","output_index":2,"item":{"type":"function_call","id":"f1","call_id":"c1","status":"completed","name":"execute_sql","arguments":"{\"sql\":\"SELECT franchise, SUM(total) AS total FROM sales GROUP BY franchise\",\"title\":\"Total by Franchise\"}"}}
+
+data: {"type":"response.output_item.done","output_index":3,"item":{"type":"function_call_output","id":"o1","call_id":"c1","status":"completed","metadata":{"ui_type":"QUERY_EXECUTION","statement_id":"stmt1","result_data":{"columns":[{"name":"franchise"},{"name":"total"}],"preview_rows":[["Alpha",1250],["Beta",640]]}}}}
+
+data: {"type":"response.output_item.done","output_index":4,"item":{"type":"function_call_output","id":"o2","call_id":"c2","status":"completed","metadata":{"ui_type":"VIZ","sql_id":"stmt1","embed_id":"viz_1","viz_definition":"{\"renderSpec\":{\"widgetType\":\"bar\",\"frame\":{\"title\":\"Total by Franchise\"},\"encodings\":{\"x\":{\"fieldName\":\"franchise\"},\"y\":{\"fieldName\":\"total\"}}}}"}}}
+
+data: {"type":"response.output_item.added","output_index":5,"item":{"type":"message","id":"m1","role":"assistant","status":"completed","content":[{"type":"output_text","text":"Alpha leads with 1,250 total sales.\n\n![Total by Franchise](#viz_1)","annotations":[]}],"metadata":{"ui_type":"FINAL_RESPONSE","source_internal_ids":["x1"]}}}
+
+data: {"type":"response.completed","response":{"id":"resp_1","status":"completed","conversation_id":"conv_1"}}
+
+'''
diff --git a/acceptance/experimental/open/out.test.toml b/acceptance/experimental/open/out.test.toml
index d6187dcb046..18b1a88417e 100644
--- a/acceptance/experimental/open/out.test.toml
+++ b/acceptance/experimental/open/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = []
diff --git a/acceptance/experimental/open/output.txt b/acceptance/experimental/open/output.txt
index a83e0676fe8..f178342ef54 100644
--- a/acceptance/experimental/open/output.txt
+++ b/acceptance/experimental/open/output.txt
@@ -1,32 +1,49 @@
 
 === print URL for a job
 >>> [CLI] experimental open --url jobs 123
-[DATABRICKS_URL]/jobs/123?o=[NUMID]
+[DATABRICKS_URL]/jobs/123?w=[WORKSPACE_ID]
 
 === print URL for a notebook
 >>> [CLI] experimental open --url notebooks 12345
-[DATABRICKS_URL]/?o=[NUMID]#notebook/12345
+[DATABRICKS_URL]/?w=[WORKSPACE_ID]#notebook/12345
 
 === unknown resource type
 >>> [CLI] experimental open --url unknown 123
-Error: unknown resource type "unknown", must be one of: alerts, apps, clusters, dashboards, experiments, jobs, model_serving_endpoints, models, notebooks, pipelines, queries, registered_models, warehouses
-
-Exit code: 1
+Error: unknown resource type "unknown", must be one of: alerts, apps, catalogs, cluster_policies, clusters, dashboards, database_catalogs, database_instances, experiments, features, genie_spaces, instance_pools, jobs, mcp_services, model_provider_services, model_services, model_serving_endpoints, models, notebooks, pipelines, postgres_catalogs, postgres_synced_tables, quality_monitors, queries, registered_models, schemas, secrets, synced_database_tables, vector_search_endpoints, vector_search_indexes, volumes, warehouses
 
 === test auto-completion handler
 >>> [CLI] __complete experimental open ,
 alerts
 apps
+catalogs
+cluster_policies
 clusters
 dashboards
+database_catalogs
+database_instances
 experiments
+features
+genie_spaces
+instance_pools
 jobs
+mcp_services
+model_provider_services
+model_services
 model_serving_endpoints
 models
 notebooks
 pipelines
+postgres_catalogs
+postgres_synced_tables
+quality_monitors
 queries
 registered_models
+schemas
+secrets
+synced_database_tables
+vector_search_endpoints
+vector_search_indexes
+volumes
 warehouses
 :4
 Completion ended with directive: ShellCompDirectiveNoFileComp
diff --git a/acceptance/experimental/open/script b/acceptance/experimental/open/script
index 820175db8de..596378fc178 100644
--- a/acceptance/experimental/open/script
+++ b/acceptance/experimental/open/script
@@ -5,7 +5,7 @@ title "print URL for a notebook"
 trace $CLI experimental open --url notebooks 12345
 
 title "unknown resource type"
-errcode trace $CLI experimental open --url unknown 123
+musterr trace $CLI experimental open --url unknown 123
 
 title "test auto-completion handler"
 trace $CLI __complete experimental open ,
diff --git a/acceptance/experimental/open/test.toml b/acceptance/experimental/open/test.toml
deleted file mode 100644
index e83f5fafb97..00000000000
--- a/acceptance/experimental/open/test.toml
+++ /dev/null
@@ -1,3 +0,0 @@
-# No bundle engine needed for this command.
-[EnvMatrix]
-DATABRICKS_BUNDLE_ENGINE = []
diff --git a/acceptance/fips/out.test.toml b/acceptance/fips/out.test.toml
new file mode 100644
index 00000000000..c7c6f58ed6e
--- /dev/null
+++ b/acceptance/fips/out.test.toml
@@ -0,0 +1 @@
+Cloud = true
diff --git a/acceptance/fips/output.txt b/acceptance/fips/output.txt
new file mode 100644
index 00000000000..910a5b8e062
--- /dev/null
+++ b/acceptance/fips/output.txt
@@ -0,0 +1,5 @@
+
+>>> go version -m [CLI]
+	build	-tags=fips140v1.0
+	build	DefaultGODEBUG=fips140=on
+	build	GOFIPS140=v1.0.0-c2097c7c
diff --git a/acceptance/fips/script b/acceptance/fips/script
new file mode 100644
index 00000000000..a87c3f5e01b
--- /dev/null
+++ b/acceptance/fips/script
@@ -0,0 +1 @@
+trace go version -m $CLI | grep -i fips140 | contains.py 'GOFIPS140=v1.0.0' 'DefaultGODEBUG=fips140=on'
diff --git a/acceptance/fips/test.toml b/acceptance/fips/test.toml
new file mode 100644
index 00000000000..c7c6f58ed6e
--- /dev/null
+++ b/acceptance/fips/test.toml
@@ -0,0 +1 @@
+Cloud = true
diff --git a/acceptance/genie/ask-endpoint-gone/out.test.toml b/acceptance/genie/ask-endpoint-gone/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/genie/ask-endpoint-gone/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/genie/ask-endpoint-gone/output.txt b/acceptance/genie/ask-endpoint-gone/output.txt
new file mode 100644
index 00000000000..b6e02a96ce7
--- /dev/null
+++ b/acceptance/genie/ask-endpoint-gone/output.txt
@@ -0,0 +1,4 @@
+
+=== a removed endpoint tells the user to update the CLI
+>>> [CLI] genie ask What are total sales by franchise?
+Error: the Genie API is not available on this workspace: No API found for 'POST /data-rooms/tools/onechat/responses'; the endpoint may have moved since this CLI release: update the Databricks CLI to the latest version (run 'databricks version --check')
diff --git a/acceptance/genie/ask-endpoint-gone/script b/acceptance/genie/ask-endpoint-gone/script
new file mode 100644
index 00000000000..1a30a0e9fa7
--- /dev/null
+++ b/acceptance/genie/ask-endpoint-gone/script
@@ -0,0 +1,2 @@
+title "a removed endpoint tells the user to update the CLI"
+musterr trace $CLI genie ask "What are total sales by franchise?"
diff --git a/acceptance/genie/ask-endpoint-gone/test.toml b/acceptance/genie/ask-endpoint-gone/test.toml
new file mode 100644
index 00000000000..5beb1a06288
--- /dev/null
+++ b/acceptance/genie/ask-endpoint-gone/test.toml
@@ -0,0 +1,10 @@
+# No bundle engine needed for this command.
+
+# The genie route is an undocumented API that can disappear between releases.
+# This is the wire shape a live workspace gateway returns for a removed route.
+[[Server]]
+Pattern = "POST /api/2.0/data-rooms/tools/onechat/responses"
+Response.StatusCode = 404
+Response.Body = '''
+{"error_code":"ENDPOINT_NOT_FOUND","message":"No API found for 'POST /data-rooms/tools/onechat/responses'"}
+'''
diff --git a/acceptance/genie/ask-protocol-drift/out.test.toml b/acceptance/genie/ask-protocol-drift/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/genie/ask-protocol-drift/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/genie/ask-protocol-drift/output.txt b/acceptance/genie/ask-protocol-drift/output.txt
new file mode 100644
index 00000000000..00e7f7f5689
--- /dev/null
+++ b/acceptance/genie/ask-protocol-drift/output.txt
@@ -0,0 +1,17 @@
+
+=== a drifted protocol with no renderable answer tells the user to update the CLI
+>>> [CLI] genie ask What are total sales by franchise?
+Error: the stream ended without an answer (received 2 events); the API may have changed: update the Databricks CLI to the latest version (run 'databricks version --check'), or re-run with --raw to inspect the raw stream
+
+Exit code: 1
+
+=== json output also reports the drift
+>>> [CLI] genie ask What are total sales by franchise? --output json
+{
+  "status": "error",
+  "conversation_id": "conv_1",
+  "error": "the stream ended without an answer (received 2 events); the API may have changed: update the Databricks CLI to the latest version (run 'databricks version --check'), or re-run with --raw to inspect the raw stream"
+}
+Error: the stream ended without an answer (received 2 events); the API may have changed: update the Databricks CLI to the latest version (run 'databricks version --check'), or re-run with --raw to inspect the raw stream
+
+Exit code: 1
diff --git a/acceptance/genie/ask-protocol-drift/script b/acceptance/genie/ask-protocol-drift/script
new file mode 100644
index 00000000000..e9e5f17c26f
--- /dev/null
+++ b/acceptance/genie/ask-protocol-drift/script
@@ -0,0 +1,5 @@
+title "a drifted protocol with no renderable answer tells the user to update the CLI"
+errcode trace $CLI genie ask "What are total sales by franchise?"
+
+title "json output also reports the drift"
+errcode trace $CLI genie ask "What are total sales by franchise?" --output json
diff --git a/acceptance/genie/ask-protocol-drift/test.toml b/acceptance/genie/ask-protocol-drift/test.toml
new file mode 100644
index 00000000000..0f11a3b91d9
--- /dev/null
+++ b/acceptance/genie/ask-protocol-drift/test.toml
@@ -0,0 +1,13 @@
+# No bundle engine needed for this command.
+
+# A protocol change that renames item types (or moves the answer elsewhere)
+# leaves the stream syntactically valid but free of anything this build can
+# render. The command must fail with update advice, not exit 0 with no output.
+[[Server]]
+Pattern = "POST /api/2.0/data-rooms/tools/onechat/responses"
+Response.Body = '''
+data: {"type":"response.output_item.added","output_index":0,"item":{"type":"agent_step_v2","id":"s1","status":"completed"}}
+
+data: {"type":"response.completed","response":{"id":"resp_1","status":"completed","conversation_id":"conv_1"}}
+
+'''
diff --git a/acceptance/genie/ask-request-drift/out.test.toml b/acceptance/genie/ask-request-drift/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/genie/ask-request-drift/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/genie/ask-request-drift/output.txt b/acceptance/genie/ask-request-drift/output.txt
new file mode 100644
index 00000000000..7be83fde191
--- /dev/null
+++ b/acceptance/genie/ask-request-drift/output.txt
@@ -0,0 +1,4 @@
+
+=== a 500 with no message points at a possible request format change
+>>> [CLI] genie ask What are total sales by franchise?
+Error: the Genie backend could not process the request (500 with no details); if this keeps happening, the request format may have changed since this CLI release: update the Databricks CLI to the latest version (run 'databricks version --check')
diff --git a/acceptance/genie/ask-request-drift/script b/acceptance/genie/ask-request-drift/script
new file mode 100644
index 00000000000..1fa5c84e49d
--- /dev/null
+++ b/acceptance/genie/ask-request-drift/script
@@ -0,0 +1,2 @@
+title "a 500 with no message points at a possible request format change"
+musterr trace $CLI genie ask "What are total sales by franchise?"
diff --git a/acceptance/genie/ask-request-drift/test.toml b/acceptance/genie/ask-request-drift/test.toml
new file mode 100644
index 00000000000..61eaf11aa91
--- /dev/null
+++ b/acceptance/genie/ask-request-drift/test.toml
@@ -0,0 +1,11 @@
+# No bundle engine needed for this command.
+
+# Wire shape observed live when the backend cannot interpret the request body
+# (e.g. the expected request shape changed): a 500 INTERNAL_ERROR with an
+# empty message, which would otherwise render as a blank "Error: ".
+[[Server]]
+Pattern = "POST /api/2.0/data-rooms/tools/onechat/responses"
+Response.StatusCode = 500
+Response.Body = '''
+{"error_code":"INTERNAL_ERROR","message":""}
+'''
diff --git a/acceptance/genie/ask/out.test.toml b/acceptance/genie/ask/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/genie/ask/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/genie/ask/output.txt b/acceptance/genie/ask/output.txt
new file mode 100644
index 00000000000..397a096c2fb
--- /dev/null
+++ b/acceptance/genie/ask/output.txt
@@ -0,0 +1,59 @@
+
+=== ask renders the final answer and a chart
+>>> [CLI] genie ask What are total sales by franchise?
+Alpha leads with 1,250 total sales.
+
+  Total by Franchise
+  ──────────────────
+
+  Alpha ██████████████████████████████████████████████████ 1,250
+   Beta █████████████████████████▌   640
+
+
+=== ask with --include-sql also shows the executed SQL
+>>> [CLI] genie ask What are total sales by franchise? --include-sql
+
+SQL executed (Total by Franchise):
+  SELECT franchise, SUM(total) AS total FROM sales GROUP BY franchise
+Alpha leads with 1,250 total sales.
+
+  Total by Franchise
+  ──────────────────
+
+  Alpha ██████████████████████████████████████████████████ 1,250
+   Beta █████████████████████████▌   640
+
+
+=== ask with --output json emits structured output
+>>> [CLI] genie ask What are total sales by franchise? --output json
+{
+  "status": "completed",
+  "conversation_id": "conv_1",
+  "text": "Alpha leads with 1,250 total sales.\n\n![Total by Franchise](#viz_1)",
+  "tool_calls": [
+    {
+      "name": "execute_sql",
+      "sql": "SELECT franchise, SUM(total) AS total FROM sales GROUP BY franchise",
+      "title": "Total by Franchise",
+      "arguments": "{\"sql\":\"SELECT franchise, SUM(total) AS total FROM sales GROUP BY franchise\",\"title\":\"Total by Franchise\"}"
+    }
+  ]
+}
+
+=== ask with --raw dumps raw SSE events
+>>> [CLI] genie ask What are total sales by franchise? --raw
+{"type":"response.output_item.added","output_index":0,"item":{"type":"reasoning","id":"r1","status":"in_progress"}}
+{"type":"response.output_item.added","output_index":1,"item":{"type":"message","id":"t1","role":"assistant","status":"completed","content":[{"type":"output_text","text":"Looking at the sales data...","annotations":[]}],"metadata":{"ui_type":"THOUGHT","source_internal_ids":["m1"]}}}
+{"type":"response.output_item.added","output_index":2,"item":{"type":"function_call","id":"f1","call_id":"c1","name":"execute_sql","arguments":""}}
+{"type":"response.output_item.done","output_index":2,"item":{"type":"function_call","id":"f1","call_id":"c1","status":"completed","name":"execute_sql","arguments":"{\"sql\":\"SELECT franchise, SUM(total) AS total FROM sales GROUP BY franchise\",\"title\":\"Total by Franchise\"}"}}
+{"type":"response.output_item.done","output_index":3,"item":{"type":"function_call_output","id":"o1","call_id":"c1","status":"completed","metadata":{"ui_type":"QUERY_EXECUTION","statement_id":"stmt1","result_data":{"columns":[{"name":"franchise"},{"name":"total"}],"preview_rows":[["Alpha",1250],["Beta",640]]}}}}
+{"type":"response.output_item.done","output_index":4,"item":{"type":"function_call_output","id":"o2","call_id":"c2","status":"completed","metadata":{"ui_type":"VIZ","sql_id":"stmt1","embed_id":"viz_1","viz_definition":"{\"renderSpec\":{\"widgetType\":\"bar\",\"frame\":{\"title\":\"Total by Franchise\"},\"encodings\":{\"x\":{\"fieldName\":\"franchise\"},\"y\":{\"fieldName\":\"total\"}}}}"}}}
+{"type":"response.output_item.added","output_index":5,"item":{"type":"message","id":"m1","role":"assistant","status":"completed","content":[{"type":"output_text","text":"Alpha leads with 1,250 total sales.\n\n![Total by Franchise](#viz_1)","annotations":[]}],"metadata":{"ui_type":"FINAL_RESPONSE","source_internal_ids":["x1"]}}}
+{"type":"response.completed","response":{"id":"resp_1","status":"completed","conversation_id":"conv_1"}}
+
+=== incompatible flags are rejected
+>>> [CLI] genie ask q --raw --output json
+Error: --raw cannot be used with --output json
+
+>>> [CLI] genie ask q --raw --include-sql
+Error: --include-sql cannot be used with --raw
diff --git a/acceptance/genie/ask/script b/acceptance/genie/ask/script
new file mode 100644
index 00000000000..eb95620c77e
--- /dev/null
+++ b/acceptance/genie/ask/script
@@ -0,0 +1,15 @@
+title "ask renders the final answer and a chart"
+trace $CLI genie ask "What are total sales by franchise?"
+
+title "ask with --include-sql also shows the executed SQL"
+trace $CLI genie ask "What are total sales by franchise?" --include-sql
+
+title "ask with --output json emits structured output"
+trace $CLI genie ask "What are total sales by franchise?" --output json
+
+title "ask with --raw dumps raw SSE events"
+trace $CLI genie ask "What are total sales by franchise?" --raw
+
+title "incompatible flags are rejected"
+musterr trace $CLI genie ask "q" --raw --output json
+musterr trace $CLI genie ask "q" --raw --include-sql
diff --git a/acceptance/genie/ask/test.toml b/acceptance/genie/ask/test.toml
new file mode 100644
index 00000000000..f21e94bea87
--- /dev/null
+++ b/acceptance/genie/ask/test.toml
@@ -0,0 +1,27 @@
+# No bundle engine needed for this command.
+
+# One canned Genie SSE response covers all invocations in the script. The
+# stream exercises the full pipeline: a reasoning item, a THOUGHT message, an
+# execute_sql call whose .added event carries empty arguments (filled in on
+# .done), the QUERY_EXECUTION result data, a VIZ spec joined to it, the
+# FINAL_RESPONSE message with a viz image reference, and the completion event.
+[[Server]]
+Pattern = "POST /api/2.0/data-rooms/tools/onechat/responses"
+Response.Body = '''
+data: {"type":"response.output_item.added","output_index":0,"item":{"type":"reasoning","id":"r1","status":"in_progress"}}
+
+data: {"type":"response.output_item.added","output_index":1,"item":{"type":"message","id":"t1","role":"assistant","status":"completed","content":[{"type":"output_text","text":"Looking at the sales data...","annotations":[]}],"metadata":{"ui_type":"THOUGHT","source_internal_ids":["m1"]}}}
+
+data: {"type":"response.output_item.added","output_index":2,"item":{"type":"function_call","id":"f1","call_id":"c1","name":"execute_sql","arguments":""}}
+
+data: {"type":"response.output_item.done","output_index":2,"item":{"type":"function_call","id":"f1","call_id":"c1","status":"completed","name":"execute_sql","arguments":"{\"sql\":\"SELECT franchise, SUM(total) AS total FROM sales GROUP BY franchise\",\"title\":\"Total by Franchise\"}"}}
+
+data: {"type":"response.output_item.done","output_index":3,"item":{"type":"function_call_output","id":"o1","call_id":"c1","status":"completed","metadata":{"ui_type":"QUERY_EXECUTION","statement_id":"stmt1","result_data":{"columns":[{"name":"franchise"},{"name":"total"}],"preview_rows":[["Alpha",1250],["Beta",640]]}}}}
+
+data: {"type":"response.output_item.done","output_index":4,"item":{"type":"function_call_output","id":"o2","call_id":"c2","status":"completed","metadata":{"ui_type":"VIZ","sql_id":"stmt1","embed_id":"viz_1","viz_definition":"{\"renderSpec\":{\"widgetType\":\"bar\",\"frame\":{\"title\":\"Total by Franchise\"},\"encodings\":{\"x\":{\"fieldName\":\"franchise\"},\"y\":{\"fieldName\":\"total\"}}}}"}}}
+
+data: {"type":"response.output_item.added","output_index":5,"item":{"type":"message","id":"m1","role":"assistant","status":"completed","content":[{"type":"output_text","text":"Alpha leads with 1,250 total sales.\n\n![Total by Franchise](#viz_1)","annotations":[]}],"metadata":{"ui_type":"FINAL_RESPONSE","source_internal_ids":["x1"]}}}
+
+data: {"type":"response.completed","response":{"id":"resp_1","status":"completed","conversation_id":"conv_1"}}
+
+'''
diff --git a/acceptance/help/out.test.toml b/acceptance/help/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/help/out.test.toml
+++ b/acceptance/help/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/help/output.txt b/acceptance/help/output.txt
index d9f379f5bbf..8488eff3321 100644
--- a/acceptance/help/output.txt
+++ b/acceptance/help/output.txt
@@ -20,6 +20,9 @@ Compute
   policy-compliance-for-clusters         The policy compliance APIs allow you to view and manage the policy compliance status of clusters in your workspace.
   policy-families                        View available policy families.
 
+Sandbox
+  sandbox                                *Beta* Create, manage, and control the lifecycle of sandboxes -- isolated, pre-configured, low-latency Serverless compute environments for running code.
+
 Lakeflow
   jobs                                   The Jobs API allows you to create, edit, and delete jobs.
   pipelines                              The Lakeflow Spark Declarative Pipelines API allows you to create, edit, delete, start, and view details about pipelines.
@@ -27,6 +30,7 @@ Lakeflow
 
 Machine Learning
   experiments                            Experiments are the primary unit of organization in MLflow; all MLflow runs belong to an experiment.
+  feature-engineering                    Feature Engineering provides APIs for managing features and materialized features.
   model-registry                         Note: This API reference documents APIs for the Workspace Model Registry.
 
 Real-time Serving
@@ -36,23 +40,26 @@ Apps
   apps                                   Apps run directly on a customer's Databricks instance, integrate with their data, use and extend Databricks services, and enable users to interact through single sign-on.
 
 Vector Search
-  vector-search-endpoints                **Endpoint**: Represents the compute resources to host vector search indexes.
+  vector-search-endpoints                **Endpoint**: Represents the compute resources to host AI Search indexes.
   vector-search-indexes                  **Index**: An efficient representation of your embedding vectors that supports real-time and efficient approximate nearest neighbor (ANN) search queries.
 
+AI Search
+  ai-search                              *Public Preview* **AI Search Endpoint**: Represents the compute resources to host AI Search indexes.
+
 Identity and Access Management
-  current-user                           This API allows retrieving information about currently authenticated user or service principal.
+  current-user                           *Public Preview* This API allows retrieving information about currently authenticated user or service principal.
   groups                                 Groups simplify identity management, making it easier to assign access to Databricks workspace, data, and other securable objects.
-  groups-v2                              Groups simplify identity management, making it easier to assign access to Databricks workspace, data, and other securable objects.
+  groups-v2                              *Public Preview* Groups simplify identity management, making it easier to assign access to Databricks workspace, data, and other securable objects.
   permissions                            Permissions API are used to create read, write, edit, update and manage access for various users on different objects and endpoints.
   service-principals                     Identities for use with jobs, automated tools, and systems such as scripts, apps, and CI/CD platforms.
-  service-principals-v2                  Identities for use with jobs, automated tools, and systems such as scripts, apps, and CI/CD platforms.
+  service-principals-v2                  *Public Preview* Identities for use with jobs, automated tools, and systems such as scripts, apps, and CI/CD platforms.
   users                                  User identities recognized by Databricks and represented by email addresses.
-  users-v2                               User identities recognized by Databricks and represented by email addresses.
-  workspace-iam-v2                       These APIs are used to manage identities and the workspace access of these identities in <Databricks>.
+  users-v2                               *Public Preview* User identities recognized by Databricks and represented by email addresses.
+  workspace-iam-v2                       These APIs are used to manage identities and the workspace access of these identities in Databricks.
 
 Databricks SQL
   alerts                                 The alerts API can be used to perform CRUD operations on alerts.
-  alerts-legacy                          The alerts API can be used to perform CRUD operations on alerts.
+  alerts-legacy                          *Public Preview* The alerts API can be used to perform CRUD operations on alerts.
   alerts-v2                              New version of SQL Alerts.
   dashboards                             In general, there is little need to modify dashboards using the API.
   data-sources                           This API is provided to assist you in making new query objects.
@@ -67,38 +74,41 @@ AI/BI
   lakeview-embedded                      Token-based Lakeview APIs for embedding dashboards in external applications.
 
 Unity Catalog
-  artifact-allowlists                    In Databricks Runtime 13.3 and above, you can add libraries and init scripts to the allowlist in UC so that users can leverage these artifacts on compute configured with shared access mode.
+  ai-gateway                             Govern AI workloads in Unity Catalog.
+  artifact-allowlists                    In Databricks Runtime 13.3 and above, you can add libraries and init scripts to the allowlist in UC so that users can use these artifacts on compute configured with shared access mode.
   catalogs                               A catalog is the first layer of Unity Catalog’s three-level namespace.
-  connections                            Connections allow for creating a connection to an external data source.
+  connections                            A connection represents an external data source for use within Databricks.
   credentials                            A credential represents an authentication and authorization mechanism for accessing services on your cloud tenant.
   entity-tag-assignments                 Tags are attributes that include keys and optional values that you can use to organize and categorize entities in Unity Catalog.
-  external-lineage                       External Lineage APIs enable defining and managing lineage relationships between Databricks objects and external systems.
+  external-lineage                       *Public Preview* External Lineage APIs enable defining and managing lineage relationships between Databricks objects and external systems.
   external-locations                     An external location is an object that combines a cloud storage path with a storage credential that authorizes access to the cloud storage path.
-  external-metadata                      External Metadata objects enable customers to register and manage metadata about external systems within Unity Catalog.
+  external-metadata                      *Public Preview* External Metadata objects enable customers to register and manage metadata about external systems within Unity Catalog.
   functions                              Functions implement User-Defined Functions (UDFs) in Unity Catalog.
   grants                                 In Unity Catalog, data is secure by default.
   metastores                             A metastore is the top-level container of objects in Unity Catalog.
   model-versions                         Databricks provides a hosted version of MLflow Model Registry in Unity Catalog.
-  online-tables                          Online tables provide lower latency and higher QPS access to data from Delta tables.
+  online-tables                          *Public Preview* Online tables provide lower latency and higher QPS access to data from Delta tables.
   policies                               Attribute-Based Access Control (ABAC) provides high leverage governance for enforcing compliance policies in Unity Catalog.
   quality-monitors                       Deprecated: Please use the Data Quality Monitors API instead (REST: /api/data-quality/v1/monitors), which manages both Data Profiling and Anomaly Detection.
   registered-models                      Databricks provides a hosted version of MLflow Model Registry in Unity Catalog.
   resource-quotas                        Unity Catalog enforces resource quotas on all securable objects, which limits the number of resources that can be created.
-  rfa                                    Request for Access enables users to request access for Unity Catalog securables.
+  rfa                                    *Public Preview* Request for Access enables users to request access for Unity Catalog securables.
   schemas                                A schema (also called a database) is the second layer of Unity Catalog’s three-level namespace.
+  secrets-uc                             A secret is a Unity Catalog securable object that stores sensitive credential data (such as passwords, tokens, and keys) within a three-level namespace (**catalog_name.schema_name.secret_name**).
   storage-credentials                    A storage credential represents an authentication and authorization mechanism for accessing data stored on your cloud tenant.
-  system-schemas                         A system schema is a schema that lives within the system catalog.
+  system-schemas                         *Public Preview* A system schema is a schema that lives within the system catalog.
   table-constraints                      Primary key and foreign key constraints encode relationships between fields in tables.
   tables                                 A table resides in the third layer of Unity Catalog’s three-level namespace.
-  temporary-path-credentials             Temporary Path Credentials refer to short-lived, downscoped credentials used to access external cloud storage locations registered in Databricks.
-  temporary-table-credentials            Temporary Table Credentials refer to short-lived, downscoped credentials used to access cloud storage locations where table data is stored in Databricks.
-  volumes                                Volumes are a Unity Catalog (UC) capability for accessing, storing, governing, organizing and processing files.
+  temporary-path-credentials             Temporary Path Credentials are short-lived, downscoped credentials used to access external cloud storage locations registered in Databricks.
+  temporary-table-credentials            Temporary Table Credentials are short-lived, downscoped credentials used to access cloud storage locations where table data is stored in Databricks.
+  temporary-volume-credentials           *Public Preview* Temporary Volume Credentials are short-lived, downscoped credentials used to access cloud storage locations where volume data is stored in Databricks.
+  volumes                                Volumes are a Unity Catalog (UC) capability for accessing, storing, governing, organizing, and processing files.
   workspace-bindings                     A securable in Databricks can be configured as __OPEN__ or __ISOLATED__.
 
-Delta Sharing
+Open Sharing
   providers                              A data provider is an object representing the organization in the real world who shares the data.
   recipient-activation                   The Recipient Activation API is only applicable in the open sharing model where the recipient object has the authentication type of TOKEN.
-  recipient-federation-policies          The Recipient Federation Policies APIs are only applicable in the open sharing model where the recipient object has the authentication type of OIDC_RECIPIENT, enabling data sharing from Databricks to non-Databricks recipients.
+  recipient-federation-policies          *Public Preview* The Recipient Federation Policies APIs are only applicable in the open sharing model where the recipient object has the authentication type of OIDC_RECIPIENT, enabling data sharing from Databricks to non-Databricks recipients.
   recipients                             A recipient is an object you create using :method:recipients/create to represent an organization which you want to allow access shares.
   shares                                 A share is a container instantiated with :method:shares/create.
 
@@ -120,36 +130,41 @@ Marketplace
   consumer-listings                      Listings are the core entities in the Marketplace.
   consumer-personalization-requests      Personalization Requests allow customers to interact with the individualized Marketplace listing flow.
   consumer-providers                     Providers are the entities that publish listings to the Marketplace.
-  provider-exchange-filters              Marketplace exchanges filters curate which groups can access an exchange.
-  provider-exchanges                     Marketplace exchanges allow providers to share their listings with a curated set of customers.
-  provider-files                         Marketplace offers a set of file APIs for various purposes such as preview notebooks and provider icons.
-  provider-listings                      Listings are the core entities in the Marketplace.
-  provider-personalization-requests      Personalization requests are an alternate to instantly available listings.
-  provider-provider-analytics-dashboards Manage templated analytics solution for providers.
-  provider-providers                     Providers are entities that manage assets in Marketplace.
+  provider-exchange-filters              *Public Preview* Marketplace exchanges filters curate which groups can access an exchange.
+  provider-exchanges                     *Public Preview* Marketplace exchanges allow providers to share their listings with a curated set of customers.
+  provider-files                         *Public Preview* Marketplace offers a set of file APIs for various purposes such as preview notebooks and provider icons.
+  provider-listings                      *Public Preview* Listings are the core entities in the Marketplace.
+  provider-personalization-requests      *Public Preview* Personalization requests are an alternate to instantly available listings.
+  provider-provider-analytics-dashboards *Public Preview* Manage templated analytics solution for providers.
+  provider-providers                     *Public Preview* Providers are entities that manage assets in Marketplace.
 
 Clean Rooms
-  clean-room-asset-revisions             Clean Room Asset Revisions denote new versions of uploaded assets (e.g.
+  clean-room-asset-revisions             *Beta* Clean Room Asset Revisions denote new versions of uploaded assets (e.g.
   clean-room-assets                      Clean room assets are data and code objects — Tables, volumes, and notebooks that are shared with the clean room.
-  clean-room-auto-approval-rules         Clean room auto-approval rules automatically create an approval on your behalf when an asset (e.g.
-  clean-room-task-runs                   Clean room task runs are the executions of notebooks in a clean room.
+  clean-room-auto-approval-rules         *Beta* Clean room auto-approval rules automatically create an approval on your behalf when an asset (e.g.
+  clean-room-task-runs                   Clean room task runs are the executions of notebooks and JAR analyses in a clean room.
   clean-rooms                            A clean room uses Delta Sharing and serverless compute to provide a secure and privacy-protecting environment where multiple parties can work together on sensitive enterprise data without direct access to each other's data.
 
 Quality Monitor
-  quality-monitor-v2                     Deprecated: Please use the Data Quality Monitoring API instead (REST: /api/data-quality/v1/monitors).
+  quality-monitor-v2                     *Beta* Deprecated: Please use the Data Quality Monitoring API instead (REST: /api/data-quality/v1/monitors).
 
 Data Classification
   data-classification                    Manage data classification for Unity Catalog catalogs.
 
 Data Quality Monitoring
-  data-quality                           Manage the data quality of Unity Catalog objects (currently support schema and table).
+  data-quality                           *Public Preview* Manage the data quality of Unity Catalog objects (currently support schema and table).
 
 Database Instances
-  database                               Database Instances provide access to a database via REST API or direct SQL.
+  database                               *Public Preview* Database Instances provide access to a database via REST API or direct SQL.
   psql                                   Connect to a Lakebase Postgres database
 
 Agent Bricks
-  knowledge-assistants                   Manage Knowledge Assistants and related resources.
+  agent-kit                              *Beta* APIs for managing agent memory and durable session state.
+  knowledge-assistants                   *Beta* Manage legacy Knowledge Assistants and related resources.
+  supervisor-agents                      *Beta* Manage legacy Supervisor Agents and related resources.
+
+AI Functions
+  ai-functions                           Transform and enrich data with AI on Databricks.
 
 Tags
   tag-policies                           The Tag Policy API allows you to manage policies for governed tags in Databricks.
@@ -161,12 +176,17 @@ Postgres
 Environments
   environments                           APIs to manage environment resources.
 
+Domains
+  domains                                *Beta* Manage domains for organizing and discovering data assets.
+
 Developer Tools
+  air                                    *Public Preview* Run and manage AI Runtime training workloads
   bundle                                 Declarative Automation Bundles let you express data/AI/analytics projects as code.
   sync                                   Synchronize a local directory to a workspace directory
 
 Additional Commands:
   account                                Databricks Account Commands
+  aitools                                Databricks skills and plugins for coding agents
   api                                    Perform Databricks API call
   auth                                   Authentication related commands
   cache                                  Local cache related commands
@@ -174,6 +194,7 @@ Additional Commands:
   configure                              Configure authentication
   help                                   Help about any command
   labs                                   Manage Databricks Labs installations
+  quickstart                             Print an introduction to the Databricks CLI
   version                                Retrieve information about the current version of this CLI
 
 Flags:
diff --git a/acceptance/install_terraform.py b/acceptance/install_terraform.py
deleted file mode 100755
index c725a77988b..00000000000
--- a/acceptance/install_terraform.py
+++ /dev/null
@@ -1,135 +0,0 @@
-#!/usr/bin/env python3
-"""
-Script to set up terraform and databricks terraform provider in a local directory:
-
-- Download terraform.
-- Download databricks provider.
-- Write a .terraformrc config file that uses this directory.
-- The config file contains env vars that need to be set so that databricks CLI uses this terraform and provider.
-"""
-
-import os
-import platform
-import zipfile
-import argparse
-import json
-from pathlib import Path
-from urllib.request import urlretrieve
-
-os_name = platform.system().lower()
-
-arch = platform.machine().lower()
-arch = {
-    "x86_64": "amd64",
-    "aarch64": "arm64",
-}.get(arch, arch)
-if os_name == "windows" and arch not in ("386", "amd64"):
-    # terraform 1.5.5 only has builds for these two.
-    arch = "amd64"
-
-terraform_version = "1.5.5"
-terraform_file = f"terraform_{terraform_version}_{os_name}_{arch}.zip"
-terraform_url = f"https://releases.hashicorp.com/terraform/{terraform_version}/{terraform_file}"
-terraform_binary = "terraform.exe" if os_name == "windows" else "terraform"
-
-
-def retrieve(url, path):
-    if not path.exists():
-        print(f"Downloading {url} -> {path}")
-        urlretrieve(url, path)
-
-
-def read_version(path):
-    for line in path.open():
-        if line.startswith("const ProviderVersion"):
-            # Expecting 'const ProviderVersion = "1.64.1"'
-            items = line.strip().split()
-            assert len(items) >= 3, items
-            assert items[-3:-1] == ["ProviderVersion", "="], items
-            version = items[-1].strip('"')
-            assert version, items
-            return version
-    raise SystemExit(f"Could not find ProviderVersion in {path}")
-
-
-def main():
-    parser = argparse.ArgumentParser()
-    parser.add_argument("--targetdir", default="build", type=Path)
-    parser.add_argument("--provider-version")
-    args = parser.parse_args()
-    target = args.targetdir
-
-    if not args.provider_version:
-        version_file = Path(__file__).parent.parent / "bundle/internal/tf/codegen/schema/version.go"
-        assert version_file.exists(), version_file
-        terraform_provider_version = read_version(version_file)
-        print(f"Read version {terraform_provider_version} from {version_file}")
-    else:
-        terraform_provider_version = args.provider_version
-
-    terraform_provider_file = f"terraform-provider-databricks_{terraform_provider_version}_{os_name}_{arch}.zip"
-    terraform_provider_url = f"https://github.com/databricks/terraform-provider-databricks/releases/download/v{terraform_provider_version}/{terraform_provider_file}"
-
-    target.mkdir(exist_ok=True, parents=True)
-
-    zip_path = target / terraform_file
-    terraform_path = target / terraform_binary
-    terraform_provider_path = target / terraform_provider_file
-
-    retrieve(terraform_url, zip_path)
-    retrieve(terraform_provider_url, terraform_provider_path)
-
-    if not terraform_path.exists():
-        print(f"Extracting {zip_path} -> {terraform_path}")
-
-        with zipfile.ZipFile(zip_path, "r") as zip_ref:
-            zip_ref.extractall(target)
-
-        terraform_path.chmod(0o755)
-
-    tfplugins_path = target / "tfplugins"
-    provider_dir = Path(
-        tfplugins_path / f"registry.terraform.io/databricks/databricks/{terraform_provider_version}/{os_name}_{arch}"
-    )
-    if not provider_dir.exists():
-        print(f"Extracting {terraform_provider_path} -> {provider_dir}")
-        os.makedirs(provider_dir, exist_ok=True)
-        with zipfile.ZipFile(terraform_provider_path, "r") as zip_ref:
-            zip_ref.extractall(provider_dir)
-
-        files = list(provider_dir.iterdir())
-        assert files, provider_dir
-
-        for f in files:
-            f.chmod(0o755)
-
-    terraformrc_path = target / ".terraformrc"
-    if not terraformrc_path.exists():
-        path = json.dumps(str(tfplugins_path.absolute()))
-
-        # Check for dev override environment variable
-        dev_override_path = os.environ.get("DATABRICKS_TF_PROVIDER_DEV_OVERRIDE")
-        dev_overrides_section = ""
-        if dev_override_path:
-            dev_overrides_section = f"""    dev_overrides {{
-        "databricks/databricks" = "{dev_override_path}"
-    }}
-"""
-
-        text = f"""# Set these env variables before running databricks cli:
-# export DATABRICKS_TF_CLI_CONFIG_FILE={terraformrc_path.absolute()}
-# export DATABRICKS_TF_EXEC_PATH={terraform_path.absolute()}
-
-provider_installation {{
-{dev_overrides_section}    filesystem_mirror {{
-        path = {path}
-        include = ["registry.terraform.io/databricks/databricks"]
-    }}
-}}
-"""
-        print(f"Writing {terraformrc_path}:\n{text}")
-        terraformrc_path.write_text(text)
-
-
-if __name__ == "__main__":
-    main()
diff --git a/acceptance/internal/bundle_config.go b/acceptance/internal/bundle_config.go
deleted file mode 100644
index 01b4321dda8..00000000000
--- a/acceptance/internal/bundle_config.go
+++ /dev/null
@@ -1,38 +0,0 @@
-package internal
-
-import (
-	"bytes"
-
-	"dario.cat/mergo"
-	"go.yaml.in/yaml/v3"
-)
-
-func MergeBundleConfig(source string, bundleConfig map[string]any) (string, error) {
-	config := make(map[string]any)
-
-	err := yaml.Unmarshal([]byte(source), &config)
-	if err != nil {
-		return "", err
-	}
-
-	err = mergo.Merge(
-		&config,
-		bundleConfig,
-		mergo.WithoutDereference,
-	)
-	if err != nil {
-		return "", err
-	}
-
-	var buf bytes.Buffer
-	enc := yaml.NewEncoder(&buf)
-	enc.SetIndent(2)
-
-	err = enc.Encode(config)
-	if err != nil {
-		return "", err
-	}
-
-	updated := buf.String()
-	return updated, nil
-}
diff --git a/acceptance/internal/bundle_config_test.go b/acceptance/internal/bundle_config_test.go
deleted file mode 100644
index f28a4d4233f..00000000000
--- a/acceptance/internal/bundle_config_test.go
+++ /dev/null
@@ -1,162 +0,0 @@
-package internal
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"go.yaml.in/yaml/v3"
-)
-
-func TestMergeBundleConfig(t *testing.T) {
-	tests := []struct {
-		name         string
-		initialYaml  string
-		bundleConfig map[string]any
-		expected     map[string]any
-	}{
-		{
-			name:         "new_file",
-			initialYaml:  "",
-			bundleConfig: map[string]any{},
-			expected:     map[string]any{},
-		},
-		{
-			name:         "empty_config",
-			initialYaml:  "{}",
-			bundleConfig: map[string]any{},
-			expected:     map[string]any{},
-		},
-		{
-			name:        "simple_top_level",
-			initialYaml: "{}",
-			bundleConfig: map[string]any{
-				"name": "test-bundle",
-			},
-			expected: map[string]any{
-				"name": "test-bundle",
-			},
-		},
-		{
-			name:        "simple_top_level_new_file",
-			initialYaml: "",
-			bundleConfig: map[string]any{
-				"name": "test-bundle",
-			},
-			expected: map[string]any{
-				"name": "test-bundle",
-			},
-		},
-		{
-			name:        "nested_config",
-			initialYaml: "{}",
-			bundleConfig: map[string]any{
-				"bundle": map[string]any{
-					"name": "test-bundle",
-				},
-			},
-			expected: map[string]any{
-				"bundle": map[string]any{
-					"name": "test-bundle",
-				},
-			},
-		},
-		{
-			name:        "nested_config_new_file",
-			initialYaml: "",
-			bundleConfig: map[string]any{
-				"bundle": map[string]any{
-					"name": "test-bundle",
-				},
-			},
-			expected: map[string]any{
-				"bundle": map[string]any{
-					"name": "test-bundle",
-				},
-			},
-		},
-		{
-			name: "merge_with_existing_config",
-			initialYaml: `
-bundle:
-  name: original-name
-  target: dev
-`,
-			bundleConfig: map[string]any{
-				"bundle": map[string]any{
-					"name": "default-name",
-				},
-			},
-			expected: map[string]any{
-				"bundle": map[string]any{
-					"name":   "original-name",
-					"target": "dev",
-				},
-			},
-		},
-		{
-			name:        "merge_with_existing_config_2",
-			initialYaml: `resources: {}`,
-			bundleConfig: map[string]any{
-				"bundle": map[string]any{
-					"name": "new-name",
-				},
-			},
-			expected: map[string]any{
-				"bundle": map[string]any{
-					"name": "new-name",
-				},
-				"resources": map[string]any{},
-			},
-		},
-
-		{
-			name: "multiple_nested_levels",
-			initialYaml: `
-resources:
-  jobs:
-    myjob:
-      hello: world
-  pipelines:
-    mypipeline:
-      name: 123
-`,
-			bundleConfig: map[string]any{
-				"resources": map[string]any{
-					"jobs": map[string]any{
-						"myjob": map[string]any{
-							"name": "My Job",
-						},
-					},
-				},
-			},
-			expected: map[string]any{
-				"resources": map[string]any{
-					"jobs": map[string]any{
-						"myjob": map[string]any{
-							"name":  "My Job",
-							"hello": "world",
-						},
-					},
-					"pipelines": map[string]any{
-						"mypipeline": map[string]any{
-							"name": 123,
-						},
-					},
-				},
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			out, err := MergeBundleConfig(tt.initialYaml, tt.bundleConfig)
-			assert.NoError(t, err)
-
-			var result map[string]any
-			require.NoError(t, yaml.Unmarshal([]byte(out), &result))
-
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
diff --git a/acceptance/internal/config.go b/acceptance/internal/config.go
index 06ac61c39b8..a6541d062de 100644
--- a/acceptance/internal/config.go
+++ b/acceptance/internal/config.go
@@ -21,7 +21,7 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-const configFilename = "test.toml"
+const ConfigFilename = "test.toml"
 
 type TestConfig struct {
 	// Place to describe what's wrong with this test. Does not affect how the test is run.
@@ -37,30 +37,25 @@ type TestConfig struct {
 	// If absent, default to true.
 	GOOS map[string]bool
 
+	// Every test runs locally against the fake server in libs/testserver. None of the
+	// three cloud fields that follow can prevent that: they are only consulted when
+	// CLOUD_ENV is set (an additional run against a real workspace) and can only
+	// subtract from that run. What skips a test locally is a different set entirely:
+	// GOOS, RunsOnDbr, DATABRICKS_TEST_SELECT_CHANGED.
+
 	// Which Clouds the test is enabled on. Allowed values: "aws", "azure", "gcp".
 	// If absent, default to true.
 	// Only checked if CLOUD_ENV is not empty.
 	CloudEnvs map[string]bool
 
-	// If true, run this test when running locally with a testserver
-	Local *bool
-
-	// If true, run this test when running with cloud env configured
+	// If true, ALSO run this test against a real workspace when cloud env is configured.
+	// Does not affect the local run, which happens either way.
 	Cloud *bool
 
-	// If true, run this test when running with cloud env configured and -short is not passed
-	// This also sets -tail when -v is passed.
+	// Only meaningful alongside Cloud=true: the cloud run is skipped when -short is passed.
+	// This also sets -tail when -v is passed. It does not enable the cloud run on its own.
 	CloudSlow *bool
 
-	// If true and Cloud=true, run this test only if unity catalog is available in the cloud environment
-	RequiresUnityCatalog *bool
-
-	// If true and Cloud=true, run this test only if a default test cluster is available in the cloud environment
-	RequiresCluster *bool
-
-	// If true and Cloud=true, run this test only if a default warehouse is available in the cloud environment
-	RequiresWarehouse *bool
-
 	// If set, current user will be set to a service principal-like UUID instead of email (default is false)
 	IsServicePrincipal *bool
 
@@ -83,9 +78,24 @@ type TestConfig struct {
 	// out.requests.txt
 	RecordRequests *bool
 
+	// If true, local runs route the CLI through the recording proxy (libs/testproxy)
+	// instead of straight to the testserver, matching the cloud topology.
+	Proxy *bool
+
 	// List of request headers to include when recording requests.
 	IncludeRequestHeaders []string
 
+	// Map of name -> regexp. Each run of consecutive output lines matching one of the
+	// regexps is sorted before comparison. Use for output whose line order is not
+	// deterministic, e.g. "bundle deploy" reporting resources as they are applied in
+	// parallel. Entries are keyed by name so an inner test.toml can replace an
+	// inherited pattern by reusing its name, or switch it off via SortLinesOn.
+	SortLines map[string]string
+
+	// Map of SortLines name -> whether to apply it. If a name is not listed, defaults
+	// to true; set it to false to drop an inherited pattern for this test.
+	SortLinesOn map[string]bool
+
 	// List of gitignore patterns to ignore when checking output files
 	Ignore []string
 
@@ -110,7 +120,7 @@ type TestConfig struct {
 	// Exclude certain configuration from the grid generated by EnvMatrix.
 	// The key is arbitrary string and the value is a list of KEY=value pairs to exclude.
 	// For example:
-	//   EnvMatrixExclude.noplantf = ["READPLAN=1", "DATABRICKS_BUNDLE_ENGINE=terraform"]
+	//   EnvMatrixExclude.nodmsplan = ["READPLAN=1", "DMS=true"]
 	// Special pseudo-var CONFIG_Cloud=true is available for excluding combinations on cloud runs.
 	EnvMatrixExclude map[string][]string
 
@@ -153,12 +163,6 @@ type ServerStub struct {
 	// Configure as "1ms", "2s", "3m", etc.
 	// See [time.ParseDuration] for details.
 	Delay time.Duration
-
-	// Number of times to kill the caller process before returning normal responses.
-	// 0 = never kill (default), 1 = kill once then allow, 2 = kill twice then allow, etc.
-	// Useful for testing crash recovery scenarios where first deploy crashes but retry succeeds.
-	// Requires DATABRICKS_CLI_TEST_PID=1 to be set in the test environment.
-	KillCaller int
 }
 
 // FindConfigs finds all the config relevant for this test,
@@ -167,7 +171,7 @@ type ServerStub struct {
 func FindConfigs(t *testing.T, dir string) []string {
 	var configs []string
 	for {
-		path := filepath.Join(dir, configFilename)
+		path := filepath.Join(dir, ConfigFilename)
 		_, err := os.Stat(path)
 
 		if err == nil {
@@ -200,7 +204,7 @@ func LoadConfig(t *testing.T, dir string) (TestConfig, string) {
 	}
 
 	result := DoLoadConfig(t, configs[0])
-	leafConfigPath := filepath.Join(dir, configFilename)
+	leafConfigPath := filepath.Join(dir, ConfigFilename)
 	leafConfig := TestConfig{}
 	hasLeafConfig := configs[0] == leafConfigPath
 	if hasLeafConfig {
@@ -267,6 +271,10 @@ func DoLoadConfig(t *testing.T, path string) TestConfig {
 	meta, err := toml.Decode(string(bytes), &config)
 	require.NoError(t, err, "Failed to parse config %s", path)
 
+	if len(meta.Keys()) == 0 {
+		t.Fatalf("test.toml has no settings (delete it instead of leaving it empty): %s", path)
+	}
+
 	keys := meta.Undecoded()
 	for ind, key := range keys {
 		t.Errorf("Undecoded key in %s[%d]: %#v", path, ind, key)
@@ -423,60 +431,15 @@ func filterExcludedEnvSets(envSets [][]string, exclude map[string][]string) [][]
 	return filtered
 }
 
-// SubsetExpanded selects one variant per DATABRICKS_BUNDLE_ENGINE value (if scriptUsesEngine)
-// or one variant total from an already-expanded and exclusion-filtered list.
-// DATABRICKS_BUNDLE_ENGINE=direct has weight 10; all other variants have weight 1.
-func SubsetExpanded(expanded [][]string, testDir string, scriptUsesEngine bool) [][]string {
+// SubsetExpanded selects one variant from an already-expanded and exclusion-filtered
+// list, using consistent hashing on testDir.
+func SubsetExpanded(expanded [][]string, testDir string) [][]string {
 	if len(expanded) <= 1 {
 		return expanded
 	}
-	if scriptUsesEngine {
-		// Collect candidates per engine key, preserving first-seen order.
-		// keyToIdx maps engine value -> index in result/groups slices.
-		var result [][]string
-		var groups [][][]string
-		keyToIdx := make(map[string]int)
-		for _, envset := range expanded {
-			engine := ""
-			for _, kv := range envset {
-				if v, ok := strings.CutPrefix(kv, "DATABRICKS_BUNDLE_ENGINE="); ok {
-					engine = v
-					break
-				}
-			}
-			idx, ok := keyToIdx[engine]
-			if !ok {
-				idx = len(result)
-				keyToIdx[engine] = idx
-				result = append(result, nil)
-				groups = append(groups, nil)
-			}
-			groups[idx] = append(groups[idx], envset)
-		}
-		for i, group := range groups {
-			result[i] = weightedSelect(group, testDir)
-		}
-		return result
-	}
-	return [][]string{weightedSelect(expanded, testDir)}
-}
-
-// weightedSelect picks one envset using weighted consistent hashing.
-// DATABRICKS_BUNDLE_ENGINE=direct has weight 10; all other envsets have weight 1.
-func weightedSelect(envsets [][]string, testDir string) []string {
-	var weighted [][]string
-	for _, envset := range envsets {
-		weight := 1
-		if slices.Contains(envset, "DATABRICKS_BUNDLE_ENGINE=direct") {
-			weight = 10
-		}
-		for range weight {
-			weighted = append(weighted, envset)
-		}
-	}
 	h := fnv.New64a()
 	h.Write([]byte(testDir))
-	return weighted[h.Sum64()%uint64(len(weighted))]
+	return [][]string{expanded[h.Sum64()%uint64(len(expanded))]}
 }
 
 // matchesExclusionRule returns true if envSet contains all KEY=value pairs from excludeRule.
diff --git a/acceptance/internal/config_test.go b/acceptance/internal/config_test.go
index a81345ed571..b1380adaf17 100644
--- a/acceptance/internal/config_test.go
+++ b/acceptance/internal/config_test.go
@@ -128,18 +128,18 @@ func TestExpandEnvMatrix(t *testing.T) {
 			},
 		},
 		{
-			name: "exclude with terraform and readplan example",
+			name: "exclude with dms and readplan example",
 			matrix: map[string][]string{
-				"DATABRICKS_BUNDLE_ENGINE": {"terraform", "direct"},
-				"READPLAN":                 {"0", "1"},
+				"DMS":      {"", "true"},
+				"READPLAN": {"0", "1"},
 			},
 			exclude: map[string][]string{
-				"noplantf": {"READPLAN=1", "DATABRICKS_BUNDLE_ENGINE=terraform"},
+				"nodmsplan": {"READPLAN=1", "DMS=true"},
 			},
 			expected: [][]string{
-				{"DATABRICKS_BUNDLE_ENGINE=terraform", "READPLAN=0"},
-				{"DATABRICKS_BUNDLE_ENGINE=direct", "READPLAN=0"},
-				{"DATABRICKS_BUNDLE_ENGINE=direct", "READPLAN=1"},
+				{"DMS=", "READPLAN=0"},
+				{"DMS=", "READPLAN=1"},
+				{"DMS=true", "READPLAN=0"},
 			},
 		},
 		{
@@ -203,43 +203,25 @@ func TestExpandEnvMatrix(t *testing.T) {
 	}
 }
 
-func TestSubsetExpanded_DirectBias(t *testing.T) {
-	// Across many test dirs, DATABRICKS_BUNDLE_ENGINE=direct should be selected ~10/11 of the time.
+func TestSubsetExpanded(t *testing.T) {
 	expanded := [][]string{
-		{"DATABRICKS_BUNDLE_ENGINE=terraform"},
-		{"DATABRICKS_BUNDLE_ENGINE=direct"},
+		{"DMS=", "READPLAN="},
+		{"DMS=true", "READPLAN="},
+		{"DMS=true", "READPLAN=1"},
 	}
-	directCount := 0
-	total := 1000
-	for i := range total {
-		r := SubsetExpanded(expanded, fmt.Sprintf("test/dir%d", i), false)
-		if r[0][0] == "DATABRICKS_BUNDLE_ENGINE=direct" {
-			directCount++
-		}
-	}
-	ratio := float64(directCount) / float64(total)
-	assert.InDelta(t, float64(10)/11, ratio, 0.05, "expected ~10/11 direct, got %.1f%%", ratio*100)
-}
+	result := SubsetExpanded(expanded, "test/dir")
+	require.Len(t, result, 1)
+	assert.Contains(t, expanded, result[0])
+	// Consistent for the same dir.
+	assert.Equal(t, result, SubsetExpanded(expanded, "test/dir"))
 
-func TestSubsetExpanded_ScriptUsesEngine(t *testing.T) {
-	// When script uses $DATABRICKS_BUNDLE_ENGINE, one combo per engine value is returned.
-	expanded := [][]string{
-		{"DATABRICKS_BUNDLE_ENGINE=terraform", "READPLAN="},
-		{"DATABRICKS_BUNDLE_ENGINE=direct", "READPLAN="},
-		{"DATABRICKS_BUNDLE_ENGINE=direct", "READPLAN=1"},
-	}
-	result := SubsetExpanded(expanded, "test/dir", true)
-	require.Len(t, result, 2)
-	engines := make(map[string]bool)
-	for _, envset := range result {
-		for _, kv := range envset {
-			if strings.HasPrefix(kv, "DATABRICKS_BUNDLE_ENGINE=") {
-				engines[kv] = true
-			}
-		}
+	// Every variant gets picked for some dir.
+	seen := make(map[string]bool)
+	for i := range 100 {
+		r := SubsetExpanded(expanded, fmt.Sprintf("test/dir%d", i))
+		seen[strings.Join(r[0], ",")] = true
 	}
-	assert.True(t, engines["DATABRICKS_BUNDLE_ENGINE=terraform"])
-	assert.True(t, engines["DATABRICKS_BUNDLE_ENGINE=direct"])
+	assert.Len(t, seen, len(expanded))
 }
 
 func TestLoadConfigPhaseIsNotInherited(t *testing.T) {
@@ -263,7 +245,7 @@ func TestLoadConfigPhaseIsNotInherited(t *testing.T) {
 			name: "leaf config without phase resets inherited value",
 			files: map[string]string{
 				"test.toml":            "Phase = 3\n",
-				"suite/test/test.toml": "Local = true\n",
+				"suite/test/test.toml": "Cloud = false\n",
 			},
 			dir:        "suite/test",
 			wantPhase:  0,
@@ -273,7 +255,7 @@ func TestLoadConfigPhaseIsNotInherited(t *testing.T) {
 			name: "leaf phase wins",
 			files: map[string]string{
 				"test.toml":            "Phase = 3\n",
-				"suite/test/test.toml": "Local = true\nPhase = 1\n",
+				"suite/test/test.toml": "Cloud = false\nPhase = 1\n",
 			},
 			dir:        "suite/test",
 			wantPhase:  1,
diff --git a/acceptance/internal/dms_litebox.go b/acceptance/internal/dms_litebox.go
new file mode 100644
index 00000000000..b59a172e06a
--- /dev/null
+++ b/acceptance/internal/dms_litebox.go
@@ -0,0 +1,144 @@
+package internal
+
+import (
+	"bytes"
+	"crypto/tls"
+	"crypto/x509"
+	"io"
+	"net"
+	"net/http"
+	"net/url"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/databricks/cli/libs/testserver"
+	"github.com/stretchr/testify/require"
+)
+
+const dmsAPIPath = "/api/2.0/bundle/deployments"
+
+// Deployment TreeNodes use the generic workspace-objects permissions API.
+var liteboxPermissionTypes = []string{"directories", "files", "notebooks", "workspace-objects"}
+
+// configureDMSLitebox routes DMS to the local service and workspace files/ACLs
+// to its shared fakes, retaining request recording and mocks for other APIs.
+func configureDMSLitebox(t *testing.T, server *testserver.Server) {
+	t.Helper()
+	settings := loadDMSLiteboxSettings(t)
+	if settings == nil {
+		return
+	}
+	dmsURL := liteboxURL(t, settings.URL)
+
+	cert, err := tls.LoadX509KeyPair(settings.Cert, settings.Key)
+	require.NoError(t, err, "load Litebox client certificate and key")
+	pem, err := os.ReadFile(settings.CA)
+	require.NoError(t, err, "read Litebox CA certificate")
+	roots := x509.NewCertPool()
+	require.True(t, roots.AppendCertsFromPEM(pem), "invalid Litebox certificate")
+	// The LITE gateway uses the service's test certificate.
+	transport := &http.Transport{
+		TLSClientConfig: &tls.Config{
+			MinVersion:   tls.VersionTLS12,
+			Certificates: []tls.Certificate{cert},
+			RootCAs:      roots,
+			ServerName:   "deployment-metadata-service.svc.cluster.local",
+		},
+		ForceAttemptHTTP2: true,
+	}
+	t.Cleanup(transport.CloseIdleConnections)
+	client := &http.Client{
+		Transport: transport,
+		Timeout:   30 * time.Second,
+		CheckRedirect: func(_ *http.Request, _ []*http.Request) error {
+			return http.ErrUseLastResponse
+		},
+	}
+	handler := func(r testserver.Request) any {
+		target := *dmsURL
+		target.Path, target.RawPath, target.RawQuery = r.URL.Path, r.URL.RawPath, r.URL.RawQuery
+		req, err := http.NewRequestWithContext(r.Context, r.Method, target.String(), bytes.NewReader(r.Body))
+		if err != nil {
+			return liteboxFailure(err)
+		}
+		req.Header = r.Headers.Clone()
+		req.Header.Del("Authorization")
+		req.Header.Del("Accept-Encoding")
+		// Fixed test identity; this adapter only connects to a local LITE fixture.
+		req.Header.Set("X-Databricks-Org-Id", "456")
+		req.Header.Set("X-Databricks-Workspace-Id", "456")
+		req.Header.Set("X-Databricks-User-Id", testserver.TestUser.Id)
+		req.Header.Set("X-Databricks-User-Name", testserver.TestUser.UserName)
+		resp, err := client.Do(req)
+		if err != nil {
+			return liteboxFailure(err)
+		}
+		defer resp.Body.Close()
+		body, err := io.ReadAll(resp.Body)
+		if err != nil {
+			return liteboxFailure(err)
+		}
+		return testserver.Response{StatusCode: resp.StatusCode, Headers: resp.Header, Body: body}
+	}
+	routeLitebox(server, handler)
+}
+
+func liteboxURL(t *testing.T, endpoint string) *url.URL {
+	t.Helper()
+	u, err := url.Parse(endpoint)
+	require.NoError(t, err, "invalid DMS LITE gateway URL")
+	ip := net.ParseIP(u.Hostname())
+	require.True(t, u.Scheme == "https" && (u.Hostname() == "localhost" || (ip != nil && ip.IsLoopback())) &&
+		u.User == nil && u.RawQuery == "" && u.Fragment == "" && (u.Path == "" || u.Path == "/"),
+		"DMS LITE gateway URL must be an HTTPS loopback origin")
+	return u
+}
+
+func isDMSPath(path string) bool {
+	return path == dmsAPIPath || strings.HasPrefix(path, dmsAPIPath+"/")
+}
+
+func isLiteboxPath(path string) bool {
+	if isDMSPath(path) ||
+		strings.HasPrefix(path, "/api/2.0/workspace/") ||
+		strings.HasPrefix(path, "/api/2.0/workspace-files/") {
+		return true
+	}
+	for _, objectType := range liteboxPermissionTypes {
+		if strings.HasPrefix(path, "/api/2.0/permissions/"+objectType+"/") {
+			return true
+		}
+	}
+	return false
+}
+
+func routeLitebox(server *testserver.Server, handler testserver.HandlerFunc) {
+	// Without a PATCH route, ServeMux returns 405 before Dispatch or NotFound.
+	for _, objectType := range liteboxPermissionTypes {
+		server.Handle(http.MethodPatch, "/api/2.0/permissions/"+objectType+"/{object_id}", handler)
+	}
+	dispatch := server.Dispatch
+	server.Dispatch = func(w http.ResponseWriter, r *http.Request, h testserver.HandlerFunc, vars map[string]string) {
+		if isLiteboxPath(r.URL.Path) {
+			h = handler
+		}
+		dispatch(w, r, h, vars)
+	}
+	notFound := server.NotFound
+	server.NotFound = func(w http.ResponseWriter, r *http.Request) {
+		if isLiteboxPath(r.URL.Path) {
+			dispatch(w, r, handler, nil)
+			return
+		}
+		notFound(w, r)
+	}
+}
+
+func liteboxFailure(err error) testserver.Response {
+	return testserver.Response{StatusCode: http.StatusBadGateway, Body: map[string]string{
+		"error_code": "LITEBOX_CONNECTION_ERROR",
+		"message":    err.Error(),
+	}}
+}
diff --git a/acceptance/internal/dms_litebox_settings.go b/acceptance/internal/dms_litebox_settings.go
new file mode 100644
index 00000000000..f36ada02976
--- /dev/null
+++ b/acceptance/internal/dms_litebox_settings.go
@@ -0,0 +1,65 @@
+package internal
+
+import (
+	"encoding/json"
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/databricks/cli/libs/env"
+	"github.com/stretchr/testify/require"
+)
+
+type dmsLiteboxSettings struct {
+	URL  string `json:"url"`
+	Cert string `json:"cert"`
+	Key  string `json:"key"`
+	CA   string `json:"ca"`
+}
+
+func loadDMSLiteboxSettings(t *testing.T) *dmsLiteboxSettings {
+	t.Helper()
+	acceptanceDir, err := os.Getwd()
+	require.NoError(t, err)
+	file := env.Get(t.Context(), "DMS_CLI_ENDPOINTS_FILE")
+	explicit := file != ""
+	if !explicit {
+		file = findDMSLiteboxSettings(t, filepath.Dir(acceptanceDir))
+		if file == "" {
+			return nil
+		}
+	}
+	if !filepath.IsAbs(file) {
+		file = filepath.Join(acceptanceDir, file)
+	}
+	data, err := os.ReadFile(file)
+	if !explicit && errors.Is(err, os.ErrNotExist) {
+		return nil
+	}
+	require.NoError(t, err, "read DMS LITE settings %s", file)
+	var settings dmsLiteboxSettings
+	require.NoError(t, json.Unmarshal(data, &settings), "parse DMS LITE settings %s", file)
+	require.NotEmpty(t, settings.URL, "DMS LITE settings %s: url is required", file)
+	require.NotEmpty(t, settings.Cert, "DMS LITE settings %s: cert is required", file)
+	require.NotEmpty(t, settings.Key, "DMS LITE settings %s: key is required", file)
+	require.NotEmpty(t, settings.CA, "DMS LITE settings %s: ca is required", file)
+	return &settings
+}
+
+func findDMSLiteboxSettings(t *testing.T, dir string) string {
+	t.Helper()
+	for {
+		file := filepath.Join(dir, "bundle", "metadata-service", "test", ".lite", "cli-endpoints.json")
+		_, err := os.Stat(file)
+		if err == nil {
+			return file
+		}
+		require.ErrorIs(t, err, os.ErrNotExist, "find DMS LITE settings %s", file)
+		parent := filepath.Dir(dir)
+		if parent == dir {
+			return ""
+		}
+		dir = parent
+	}
+}
diff --git a/acceptance/internal/jq.go b/acceptance/internal/jq.go
new file mode 100644
index 00000000000..e8b3ba2c570
--- /dev/null
+++ b/acceptance/internal/jq.go
@@ -0,0 +1,28 @@
+package internal
+
+import (
+	"os/exec"
+	"strings"
+	"testing"
+
+	"golang.org/x/mod/semver"
+)
+
+// RequireJQ fails the run if jq is missing from PATH or older than minVersion
+// (e.g. "1.7"). See the call site for why the minimum is what it is.
+func RequireJQ(t *testing.T, minVersion string) {
+	out, err := exec.Command("jq", "--version").Output()
+	if err != nil {
+		t.Fatalf("jq not found on PATH (acceptance tests require jq >= %s): %v", minVersion, err)
+	}
+	version := strings.TrimSpace(string(out))
+	if !jqVersionOK(version, minVersion) {
+		t.Fatalf("acceptance tests require jq >= %s (found %q); install a newer jq", minVersion, version)
+	}
+}
+
+// jqVersionOK reports whether `jq --version` output (e.g. "jq-1.7.1") is >= minVersion.
+func jqVersionOK(versionOutput, minVersion string) bool {
+	got := strings.TrimPrefix(versionOutput, "jq-")
+	return semver.Compare("v"+got, "v"+minVersion) >= 0
+}
diff --git a/acceptance/internal/jq_test.go b/acceptance/internal/jq_test.go
new file mode 100644
index 00000000000..781c40625d2
--- /dev/null
+++ b/acceptance/internal/jq_test.go
@@ -0,0 +1,15 @@
+package internal
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestJqVersionOK(t *testing.T) {
+	assert.True(t, jqVersionOK("jq-1.7", "1.7"))
+	assert.True(t, jqVersionOK("jq-1.7.1", "1.7"))
+	assert.True(t, jqVersionOK("jq-1.8.1", "1.7"))
+	assert.False(t, jqVersionOK("jq-1.6", "1.7"))
+	assert.False(t, jqVersionOK("garbage", "1.7"))
+}
diff --git a/acceptance/internal/materialized_config.go b/acceptance/internal/materialized_config.go
index d849d74f2dd..41fed59eeeb 100644
--- a/acceptance/internal/materialized_config.go
+++ b/acceptance/internal/materialized_config.go
@@ -8,6 +8,31 @@ import (
 	"strings"
 )
 
+// filteredEnvMatrix returns a copy of matrix with values removed by single-condition
+// exclude rules applied directly. Multi-condition rules (pruning specific combinations)
+// are left for runtime and do not affect the per-key value lists.
+// Keys with an empty value list are preserved as-is: an empty list signals
+// an intentional override that clears an inherited matrix variable.
+func filteredEnvMatrix(matrix, exclude map[string][]string) map[string][]string {
+	if len(exclude) == 0 {
+		return matrix
+	}
+	result := maps.Clone(matrix)
+	for _, conditions := range exclude {
+		if len(conditions) != 1 {
+			continue
+		}
+		k, v, ok := strings.Cut(conditions[0], "=")
+		if !ok {
+			continue
+		}
+		if vals, exists := result[k]; exists && len(vals) > 0 {
+			result[k] = slices.DeleteFunc(slices.Clone(vals), func(x string) bool { return x == v })
+		}
+	}
+	return result
+}
+
 const MaterializedConfigFile = "out.test.toml"
 
 // GenerateMaterializedConfig creates a TOML representation of the configuration fields
@@ -15,12 +40,8 @@ const MaterializedConfigFile = "out.test.toml"
 func GenerateMaterializedConfig(config *TestConfig) string {
 	var buf strings.Builder
 
-	writeBool(&buf, "Local", config.Local)
 	writeBool(&buf, "Cloud", config.Cloud)
 	writeBool(&buf, "CloudSlow", config.CloudSlow)
-	writeBool(&buf, "RequiresUnityCatalog", config.RequiresUnityCatalog)
-	writeBool(&buf, "RequiresCluster", config.RequiresCluster)
-	writeBool(&buf, "RequiresWarehouse", config.RequiresWarehouse)
 	writeBool(&buf, "RunsOnDbr", config.RunsOnDbr)
 	if config.Phase != 0 {
 		fmt.Fprintf(&buf, "Phase = %d\n", config.Phase)
@@ -32,8 +53,9 @@ func GenerateMaterializedConfig(config *TestConfig) string {
 	for _, k := range slices.Sorted(maps.Keys(config.CloudEnvs)) {
 		fmt.Fprintf(&buf, "CloudEnvs.%s = %v\n", k, config.CloudEnvs[k])
 	}
-	for _, k := range slices.Sorted(maps.Keys(config.EnvMatrix)) {
-		writeTomlStringArray(&buf, "EnvMatrix."+k, config.EnvMatrix[k])
+	envMatrix := filteredEnvMatrix(config.EnvMatrix, config.EnvMatrixExclude)
+	for _, k := range slices.Sorted(maps.Keys(envMatrix)) {
+		writeTomlStringArray(&buf, "EnvMatrix."+k, envMatrix[k])
 	}
 
 	return buf.String()
diff --git a/acceptance/internal/prepare_server.go b/acceptance/internal/prepare_server.go
index 8f18d1c61bc..3890aa52d5a 100644
--- a/acceptance/internal/prepare_server.go
+++ b/acceptance/internal/prepare_server.go
@@ -1,25 +1,33 @@
 package internal
 
 import (
+	"bytes"
 	"encoding/json"
+	"errors"
 	"fmt"
+	"io"
+	"mime"
+	"mime/multipart"
 	"net/http"
 	"os"
 	"path/filepath"
 	"slices"
+	"strconv"
 	"strings"
 	"sync"
 	"testing"
 	"time"
 	"unicode/utf8"
+	"uuid"
 
+	"github.com/databricks/cli/libs/auth"
 	"github.com/databricks/cli/libs/env"
+	"github.com/databricks/cli/libs/iamutil"
 	"github.com/databricks/cli/libs/testproxy"
 	"github.com/databricks/cli/libs/testserver"
 	"github.com/databricks/databricks-sdk-go"
 	sdkconfig "github.com/databricks/databricks-sdk-go/config"
 	"github.com/databricks/databricks-sdk-go/service/iam"
-	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -27,6 +35,7 @@ import (
 func StartDefaultServer(t *testing.T, logRequests bool) {
 	s := testserver.New(t)
 	testserver.AddDefaultHandlers(s)
+	configureDMSLitebox(t, s)
 
 	// Log API responses if the -logrequests flag is set.
 	if logRequests {
@@ -63,19 +72,45 @@ func isTruePtr(value *bool) bool {
 	return value != nil && *value
 }
 
-func PrepareServerAndClient(t *testing.T, config TestConfig, logRequests bool, outputDir string) (*sdkconfig.Config, iam.User) {
+// staleOnceEnabled reports whether the testserver should simulate eventual
+// consistency (the first GET after a create returns 404). It is opt-in via
+// INJECT_STALE_ON_DIRECT=1.
+//
+// testEnv carries the per-variant EnvMatrix values, which are not visible via
+// os/env because matrix variants run in parallel and only reach the CLI subprocess.
+func staleOnceEnabled(testEnv []string) bool {
+	v, _ := lookupEnv(testEnv, "INJECT_STALE_ON_DIRECT")
+	return v == "1"
+}
+
+func lookupEnv(testEnv []string, key string) (string, bool) {
+	prefix := key + "="
+	for _, kv := range testEnv {
+		if v, ok := strings.CutPrefix(kv, prefix); ok {
+			return v, true
+		}
+	}
+	return "", false
+}
+
+func PrepareServerAndClient(t *testing.T, config TestConfig, logRequests bool, outputDir string, testEnv []string) (*sdkconfig.Config, iam.User, string) {
 	cloudEnv := env.Get(t.Context(), "CLOUD_ENV")
 	recordRequests := isTruePtr(config.RecordRequests)
 
 	// Use a unique token for each test. This allows us to maintain
 	// separate state for each test in fake workspaces.
-	tokenSuffix := strings.ReplaceAll(uuid.NewString(), "-", "")
+	tokenSuffix := strings.ReplaceAll(uuid.New().String(), "-", "")
 
 	var token string
 	var testUser iam.User
 	if isTruePtr(config.IsServicePrincipal) {
 		token = testserver.ServicePrincipalTokenPrefix + tokenSuffix
 		testUser = testserver.TestUserSP
+	} else if staleOnceEnabled(testEnv) {
+		// Use the eventual-consistency token so the testserver returns 404 on the
+		// first GET after a create, matching real cloud propagation delays.
+		token = testserver.EventualConsistencyTokenPrefix + tokenSuffix
+		testUser = testserver.TestUser
 	} else {
 		token = testserver.UserNameTokenPrefix + tokenSuffix
 		testUser = testserver.TestUser
@@ -85,22 +120,49 @@ func PrepareServerAndClient(t *testing.T, config TestConfig, logRequests bool, o
 		w, err := databricks.NewWorkspaceClient()
 		require.NoError(t, err)
 
-		user, err := w.CurrentUser.Me(t.Context())
+		user, err := iamutil.GetCurrentUser(t.Context(), w)
 		require.NoError(t, err, "Failed to get current user")
 
+		workspaceID, err := auth.ResolveWorkspaceID(t.Context(), w)
+		require.NoError(t, err, "Failed to get current workspace id")
+
 		cfg := w.Config
 
 		// If we are running in a cloud environment AND we need to intercept requests
 		// (for recording or logging), start a proxy server.
 		if recordRequests || logRequests {
-			host := startProxyServer(t, recordRequests, logRequests, config.IncludeRequestHeaders, outputDir)
+			// An empty config resolves the real workspace from the environment.
+			host := startProxyServer(t, &sdkconfig.Config{}, recordRequests, logRequests, config.IncludeRequestHeaders, outputDir)
 			cfg = &sdkconfig.Config{
 				Host:  host,
 				Token: token,
+				// Preserve the resolved config-file path (e.g. deco sets it to /dev/null)
+				// so the CLI subprocess stays isolated from the developer's ~/.databrickscfg,
+				// matching the non-proxy path. Otherwise the subprocess re-reads the default
+				// config and can fall back to a default_profile (e.g. via [__settings__]),
+				// which breaks auth on cloud record-requests runs.
+				ConfigFile: cfg.ConfigFile,
 			}
 		}
 
-		return cfg, *user
+		return cfg, *user, workspaceID
+	}
+
+	// Same topology as cloud, with the testserver as the upstream. Both servers see
+	// the same requests, so only the proxy records and logs.
+	if isTruePtr(config.Proxy) {
+		upstream := startLocalServer(t, config.Server, false, false, nil, outputDir)
+		host := startProxyServer(t, &sdkconfig.Config{
+			Host:  upstream,
+			Token: token,
+		}, recordRequests, logRequests, config.IncludeRequestHeaders, outputDir)
+
+		cfg := &sdkconfig.Config{
+			Host:  host,
+			Token: token,
+		}
+
+		return cfg, testUser, strconv.Itoa(testserver.TestWorkspaceID)
 	}
 
 	// If we are not recording requests, and no custom server stubs are configured,
@@ -111,7 +173,7 @@ func PrepareServerAndClient(t *testing.T, config TestConfig, logRequests bool, o
 			Token: token,
 		}
 
-		return cfg, testUser
+		return cfg, testUser, strconv.Itoa(testserver.TestWorkspaceID)
 	}
 
 	// Default case. Start a dedicated local server for the test with the server stubs configured
@@ -124,7 +186,7 @@ func PrepareServerAndClient(t *testing.T, config TestConfig, logRequests bool, o
 
 	// For the purposes of replacements, use testUser for local runs.
 	// Note, users might have overridden /api/2.0/preview/scim/v2/Me but that should not affect the replacement:
-	return cfg, testUser
+	return cfg, testUser, strconv.Itoa(testserver.TestWorkspaceID)
 }
 
 func recordRequestsCallback(t *testing.T, includeHeaders []string, outputDir string) func(request *testserver.Request) {
@@ -183,10 +245,6 @@ func startLocalServer(t *testing.T,
 		s.ResponseCallback = logResponseCallback(t)
 	}
 
-	// Track remaining kill counts per pattern (for KillCaller > 0)
-	killCounters := make(map[string]int)
-	killCountersMu := &sync.Mutex{}
-
 	for ind := range stubs {
 		// Later stubs take precedence over earlier ones (leaf configs override parent configs).
 		// The first handler registered for a given pattern wins, so we reverse the order.
@@ -195,11 +253,6 @@ func startLocalServer(t *testing.T,
 		items := strings.Split(stub.Pattern, " ")
 		require.Len(t, items, 2)
 
-		// Initialize kill counter for this pattern
-		if stub.KillCaller > 0 {
-			killCounters[stub.Pattern] = stub.KillCaller
-		}
-
 		s.Handle(items[0], items[1], func(req testserver.Request) any {
 			if stub.Delay > 0 {
 				ctx := req.Context
@@ -218,10 +271,6 @@ func startLocalServer(t *testing.T,
 				}
 			}
 
-			if shouldKillCaller(stub, killCounters, killCountersMu) {
-				killCaller(t, stub.Pattern, req.Headers)
-			}
-
 			return stub.Response
 		})
 	}
@@ -229,55 +278,18 @@ func startLocalServer(t *testing.T,
 	// The first handler registered for a given pattern wins, so default
 	// handlers registered last serve as fallbacks.
 	testserver.AddDefaultHandlers(s)
+	configureDMSLitebox(t, s)
 	return s.URL
 }
 
-func shouldKillCaller(stub ServerStub, killCounters map[string]int, mu *sync.Mutex) bool {
-	if stub.KillCaller <= 0 {
-		return false
-	}
-	mu.Lock()
-	defer mu.Unlock()
-	if killCounters[stub.Pattern] <= 0 {
-		return false
-	}
-	killCounters[stub.Pattern]--
-	return true
-}
-
-func killCaller(t *testing.T, pattern string, headers http.Header) {
-	pid := testserver.ExtractPidFromHeaders(headers)
-	if pid == 0 {
-		t.Errorf("KillCaller configured but test-pid not found in User-Agent")
-		return
-	}
-
-	process, err := os.FindProcess(pid)
-	if err != nil {
-		t.Errorf("Failed to find process %d: %s", pid, err)
-		return
-	}
-
-	// Use process.Kill() for cross-platform compatibility.
-	// On Unix, this sends SIGKILL. On Windows, this calls TerminateProcess.
-	if err := process.Kill(); err != nil {
-		t.Errorf("Failed to kill process %d: %s", pid, err)
-		return
-	}
-
-	if !waitForProcessExit(pid, 2*time.Second) {
-		t.Logf("KillCaller: timed out waiting for PID %d to exit (pattern: %s)", pid, pattern)
-	}
-	t.Logf("KillCaller: killed PID %d (pattern: %s)", pid, pattern)
-}
-
 func startProxyServer(t *testing.T,
+	upstream *sdkconfig.Config,
 	recordRequests bool,
 	logRequests bool,
 	includeHeaders []string,
 	outputDir string,
 ) string {
-	s := testproxy.New(t)
+	s := testproxy.New(t, upstream)
 
 	// Record API requests in out.requests.txt if RecordRequests is true in test.toml.
 	if recordRequests {
@@ -324,6 +336,11 @@ func getLoggedRequest(req *testserver.Request, includedHeaders []string) LoggedR
 
 	if json.Valid(req.Body) {
 		result.Body = json.RawMessage(req.Body)
+	} else if normalized, ok := normalizeMultipartBody(req); ok {
+		// Multipart bodies contain a randomly generated boundary string and binary
+		// content; record a normalized form (sorted form-field names with sizes for
+		// file parts) so recorded requests stay deterministic and reviewable.
+		result.Body = normalized
 	} else {
 		result.RawBody = string(req.Body)
 	}
@@ -331,6 +348,55 @@ func getLoggedRequest(req *testserver.Request, includedHeaders []string) LoggedR
 	return result
 }
 
+// Multipart parts larger than this limit are summarized as a size placeholder
+// to keep recorded fixtures small. Reviewers care about *what* was uploaded
+// (path, format, overwrite flag), not the bytes themselves, for large blobs.
+const multipartContentLimit = 4096
+
+// normalizeMultipartBody returns a deterministic representation of a multipart
+// form body if the request's Content-Type is multipart/*. The second return
+// value is false if the body is not multipart or cannot be parsed.
+//
+// Text parts are recorded as their literal content so reviewers can read what
+// was uploaded; existing global UNIX_TIME / UUID / USERNAME replacements
+// normalize the timestamp / id / email fields embedded in deploy.lock and
+// similar payloads. Non-UTF-8 (binary) parts and parts whose serialized
+// content would bloat the recording past multipartContentLimit are
+// summarized as "[binary content N bytes]".
+func normalizeMultipartBody(req *testserver.Request) (any, bool) {
+	contentType := req.Headers.Get("Content-Type")
+	mediaType, params, err := mime.ParseMediaType(contentType)
+	if err != nil || !strings.HasPrefix(mediaType, "multipart/") {
+		return nil, false
+	}
+	boundary := params["boundary"]
+	if boundary == "" {
+		return nil, false
+	}
+	mr := multipart.NewReader(bytes.NewReader(req.Body), boundary)
+	parts := map[string]any{}
+	for {
+		part, err := mr.NextPart()
+		if errors.Is(err, io.EOF) {
+			break
+		}
+		if err != nil {
+			return nil, false
+		}
+		data, err := io.ReadAll(part)
+		if err != nil {
+			return nil, false
+		}
+		name := part.FormName()
+		if !utf8.Valid(data) || len(data) > multipartContentLimit {
+			parts[name] = fmt.Sprintf("[binary content %d bytes]", len(data))
+			continue
+		}
+		parts[name] = string(data)
+	}
+	return map[string]any{"multipart_form": parts}, true
+}
+
 func filterHeaders(h http.Header, includedHeaders []string) http.Header {
 	headers := make(http.Header)
 	for k, v := range h {
diff --git a/acceptance/internal/python.go b/acceptance/internal/python.go
new file mode 100644
index 00000000000..6a3af08cc65
--- /dev/null
+++ b/acceptance/internal/python.go
@@ -0,0 +1,76 @@
+package internal
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+
+	"golang.org/x/mod/semver"
+)
+
+// RequirePython fails the test if no Python >= minVersion (e.g. "3.11") is
+// available for the acceptance suite. It only verifies; ConfigurePython performs
+// the PATH setup. On Windows os.Symlink needs extra privileges, so we require the
+// python3 already on PATH to satisfy the floor; elsewhere uv must be able to find
+// a compatible interpreter.
+func RequirePython(t *testing.T, minVersion string) {
+	if runtime.GOOS == "windows" {
+		out, err := exec.Command("python3", "--version").Output()
+		if err != nil {
+			t.Fatalf("python3 not found on PATH (acceptance tests require python >= %s): %v", minVersion, err)
+		}
+		version := strings.TrimSpace(string(out))
+		if !pythonVersionOK(version, minVersion) {
+			t.Fatalf("acceptance tests require python >= %s (found %q)", minVersion, version)
+		}
+		return
+	}
+
+	if _, err := exec.Command("uv", "python", "find", ">="+minVersion).Output(); err != nil {
+		t.Fatalf("uv could not find python >= %s: %v", minVersion, err)
+	}
+}
+
+// ConfigurePython makes `python3` on PATH resolve to a Python >= minVersion for
+// the rest of the run. Acceptance scripts invoke `python3` directly and some
+// import stdlib modules added in newer versions, but a host's default python3
+// may be older. On non-Windows hosts uv (see RequireUV) selects a compatible
+// interpreter, which we symlink as python3/python into a temp dir prepended to
+// PATH. On Windows we rely on the python3 already on PATH, which RequirePython
+// has verified satisfies the floor.
+//
+// It must run on the top-level test's t: the t.Setenv and t.TempDir below are
+// undone when that test returns, so calling it from a subtest would revert the
+// PATH change before the rest of the suite runs.
+func ConfigurePython(t *testing.T, minVersion string) {
+	if runtime.GOOS == "windows" {
+		return
+	}
+
+	out, err := exec.Command("uv", "python", "find", ">="+minVersion).Output()
+	if err != nil {
+		t.Fatalf("uv could not find python >= %s: %v", minVersion, err)
+	}
+	python := strings.TrimSpace(string(out))
+
+	binDir := t.TempDir()
+	for _, link := range []string{"python3", "python"} {
+		if err := os.Symlink(python, filepath.Join(binDir, link)); err != nil {
+			t.Fatalf("failed to symlink %s as %s: %v", python, link, err)
+		}
+	}
+	t.Setenv("PATH", binDir+string(os.PathListSeparator)+os.Getenv("PATH")) //nolint:forbidigo // acceptance test harness; no ctx for libs/env
+	t.Logf("acceptance tests: using %s (via uv) as python3", python)
+}
+
+// pythonVersionOK reports whether `python3 --version` output (e.g. "Python 3.13.2") is >= minVersion.
+func pythonVersionOK(versionOutput, minVersion string) bool {
+	fields := strings.Fields(versionOutput)
+	if len(fields) < 2 {
+		return false
+	}
+	return semver.Compare("v"+fields[1], "v"+minVersion) >= 0
+}
diff --git a/acceptance/internal/python_test.go b/acceptance/internal/python_test.go
new file mode 100644
index 00000000000..4a0ebcd8006
--- /dev/null
+++ b/acceptance/internal/python_test.go
@@ -0,0 +1,31 @@
+package internal
+
+import (
+	"os/exec"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestPythonVersionOK(t *testing.T) {
+	assert.True(t, pythonVersionOK("Python 3.11.0", "3.11"))
+	assert.True(t, pythonVersionOK("Python 3.13.2", "3.11"))
+	assert.False(t, pythonVersionOK("Python 3.10.6", "3.11"))
+	assert.False(t, pythonVersionOK("garbage", "3.11"))
+}
+
+func TestConfigurePython(t *testing.T) {
+	if _, err := exec.LookPath("uv"); err != nil {
+		t.Skip("uv not installed")
+	}
+
+	RequirePython(t, "3.11")
+	ConfigurePython(t, "3.11")
+
+	// After setup, the python3 resolved from PATH must satisfy the floor.
+	out, err := exec.Command("python3", "-c", "import sys; print(sys.version_info >= (3, 11))").Output()
+	require.NoError(t, err)
+	assert.Equal(t, "True", strings.TrimSpace(string(out)))
+}
diff --git a/acceptance/internal/rejecting_proxy.go b/acceptance/internal/rejecting_proxy.go
new file mode 100644
index 00000000000..591954ed15a
--- /dev/null
+++ b/acceptance/internal/rejecting_proxy.go
@@ -0,0 +1,112 @@
+package internal
+
+import (
+	"bufio"
+	"fmt"
+	"net"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/databricks/cli/libs/testserver"
+)
+
+// StartRejectingProxy starts an HTTP proxy server bound to a loopback port and
+// returns its URL for use as HTTPS_PROXY. Every proxied request receives a
+// 400 Bad Request response so the client gets a clear HTTP error instead of a
+// TCP reset (a reset would trigger the SDK's 5-minute retry loop).
+//
+// Real external hosts fail the test via t.Errorf. RFC 2606 reserved TLDs
+// (.test, .example, .invalid, .localhost) and loopback IPs are intentional
+// unreachable fixtures; those are only logged.
+//
+// hint is appended to the t.Errorf message for real hosts. Pass a non-empty
+// hint when using a shared proxy to tell the user how to get per-test
+// attribution (e.g. "re-run with -debugsandbox").
+func StartRejectingProxy(t *testing.T, hint string) string {
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("blocking proxy: listen: %v", err)
+	}
+	t.Cleanup(func() { ln.Close() })
+	go func() {
+		for {
+			conn, err := ln.Accept()
+			if err != nil {
+				return
+			}
+			go handleBlockedConnection(t, conn, hint)
+		}
+	}()
+	return "http://" + ln.Addr().String()
+}
+
+// rfc2606Reserved lists TLDs reserved by RFC 2606 §2 for use in testing and
+// documentation. Hosts under these TLDs are intentional unreachable fixtures,
+// not accidental internet access, so the proxy logs them but does not fail the
+// test via t.Errorf.
+var rfc2606Reserved = []string{".test", ".example", ".invalid", ".localhost"}
+
+func handleBlockedConnection(t *testing.T, conn net.Conn, hint string) {
+	defer conn.Close()
+
+	req, err := http.ReadRequest(bufio.NewReader(conn))
+	if err != nil {
+		// Connection closed before a full request arrived; nothing to report.
+		return
+	}
+
+	method := req.Method
+	host := req.Host
+	if host == "" {
+		host = req.URL.String()
+	}
+	ua := req.Header.Get("User-Agent")
+
+	detail := fmt.Sprintf("%s %s", method, host)
+	if ua != "" {
+		detail += fmt.Sprintf(" (User-Agent: %s)", ua)
+	}
+
+	// Strip the port to check just the hostname.
+	hostname := host
+	if h, _, err := net.SplitHostPort(host); err == nil {
+		hostname = h
+	}
+
+	// Loopback IPs (127.x.x.x, ::1) are the local test server — the Terraform
+	// provider routes its HTTP requests to 127.0.0.1:PORT through HTTPS_PROXY
+	// even though Go's standard library skips the proxy for loopback destinations.
+	// These are not real internet calls, so just log them.
+	isLoopback := false
+	if ip := net.ParseIP(hostname); ip != nil && ip.IsLoopback() {
+		isLoopback = true
+	}
+
+	// RFC 2606 §2 reserved TLDs are intentional unreachable test fixtures.
+	isReserved := false
+	for _, tld := range rfc2606Reserved {
+		if strings.HasSuffix(hostname, tld) {
+			isReserved = true
+			break
+		}
+	}
+
+	if isLoopback || isReserved {
+		// Expected unreachable fixture or local test server — log only, don't fail.
+		t.Logf("blocking proxy: blocked loopback/reserved host: %s", detail)
+	} else if testserver.IsLocalhostProbe(req) {
+		// Some Databricks-internal development environments run a port watcher
+		// that auto-forwards every new localhost listener and probes it with
+		// `HEAD / Host: localhost`. This is not the CLI-under-test reaching the
+		// internet, so log it instead of failing the test.
+		t.Logf("blocking proxy: ignored localhost port-classification probe: %s", detail)
+	} else {
+		t.Errorf("internet access blocked by proxy: %s%s", detail, hint)
+	}
+
+	body := fmt.Sprintf("internet access is blocked in local tests: %s %s\n", method, host)
+	fmt.Fprintf(conn,
+		"HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: %d\r\nConnection: close\r\n\r\n%s",
+		len(body), body)
+}
diff --git a/acceptance/internal/ruff.go b/acceptance/internal/ruff.go
new file mode 100644
index 00000000000..907eada2800
--- /dev/null
+++ b/acceptance/internal/ruff.go
@@ -0,0 +1,31 @@
+package internal
+
+import (
+	"os/exec"
+	"strings"
+	"testing"
+
+	"golang.org/x/mod/semver"
+)
+
+// RequireRuff fails the run if ruff is missing from PATH or older than
+// minVersion (e.g. "0.9.1"). See the call site for why the minimum is what it is.
+func RequireRuff(t *testing.T, minVersion string) {
+	out, err := exec.Command("ruff", "--version").Output()
+	if err != nil {
+		t.Fatalf("ruff not found on PATH (acceptance tests require ruff >= %s): %v", minVersion, err)
+	}
+	version := strings.TrimSpace(string(out))
+	if !ruffVersionOK(version, minVersion) {
+		t.Fatalf("acceptance tests require ruff >= %s (found %q); install a newer ruff", minVersion, version)
+	}
+}
+
+// ruffVersionOK reports whether `ruff --version` output (e.g. "ruff 0.9.1") is >= minVersion.
+func ruffVersionOK(versionOutput, minVersion string) bool {
+	fields := strings.Fields(versionOutput)
+	if len(fields) < 2 {
+		return false
+	}
+	return semver.Compare("v"+fields[1], "v"+minVersion) >= 0
+}
diff --git a/acceptance/internal/ruff_test.go b/acceptance/internal/ruff_test.go
new file mode 100644
index 00000000000..ddef9021950
--- /dev/null
+++ b/acceptance/internal/ruff_test.go
@@ -0,0 +1,15 @@
+package internal
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestRuffVersionOK(t *testing.T) {
+	assert.True(t, ruffVersionOK("ruff 0.9.1", "0.9.1"))
+	assert.True(t, ruffVersionOK("ruff 0.9.2", "0.9.1"))
+	assert.True(t, ruffVersionOK("ruff 0.11.0", "0.9.1"))
+	assert.False(t, ruffVersionOK("ruff 0.9.0", "0.9.1"))
+	assert.False(t, ruffVersionOK("ruff 0.8.5", "0.9.1"))
+}
diff --git a/acceptance/internal/selection/cmd/main.go b/acceptance/internal/selection/cmd/main.go
new file mode 100644
index 00000000000..787864431a6
--- /dev/null
+++ b/acceptance/internal/selection/cmd/main.go
@@ -0,0 +1,141 @@
+// Command cmd prints the acceptance tests that DATABRICKS_TEST_SELECT_CHANGED would run,
+// either for the current branch or for the paths given as arguments, together with the
+// score each test was picked by. It is a way to see what a change selects without running
+// the suite. Run it from the repo root:
+//
+//	go run ./acceptance/internal/selection/cmd
+//	go run ./acceptance/internal/selection/cmd -limit 5
+//	go run ./acceptance/internal/selection/cmd acceptance/bundle/invariant/configs/job.yml.tmpl
+//
+// With no arguments the selection comes from git, exactly as the test runner gets it. Each
+// argument stands for a changed file instead, and counts as modified unless it carries a
+// status ("A:path" for an added file, "R100:old:new" for a rename).
+//
+// Each line is a `go test -run` pattern, so a selected test can be run as printed:
+//
+//	go test ./acceptance -run 'TestAccept/^bundle$/^invariant$/^no_drift$/^INPUT_CONFIG=job.yml.tmpl$'
+//
+// Every element is anchored, because a -run element is a regexp matched against one level of
+// the test name: unanchored, `no_drift` would also run no_drift_extra, and `DMS=` would also
+// run the DMS=true variant.
+//
+// The variants come from each test's materialized config (out.test.toml), which already has
+// the excluded matrix values removed. Excludes that name a combination of variables are not
+// recorded there, so a listed variant can still turn out to be one the harness skips.
+package main
+
+import (
+	"flag"
+	"fmt"
+	"os"
+	"path/filepath"
+	"regexp"
+	"slices"
+	"strings"
+
+	"github.com/databricks/cli/acceptance/internal/selection"
+)
+
+func main() {
+	limit := flag.Int("limit", 50, "maximum number of changed tests to select")
+	root := flag.String("root", "acceptance", "path to the acceptance directory")
+	flag.Parse()
+
+	if *limit <= 0 {
+		fatalf("-limit must be a positive integer, got %d", *limit)
+	}
+
+	dirs, err := selection.FindTestDirs(*root)
+	if err != nil {
+		fatalf("cannot list test dirs in %s: %s", *root, err)
+	}
+	testDirs := make(map[string]bool, len(dirs))
+	for _, dir := range dirs {
+		testDirs[dir] = true
+	}
+
+	var result selection.Result
+	if args := flag.Args(); len(args) > 0 {
+		result = selection.FromDiff(*root, diffFromArgs(args), testDirs, *limit)
+	} else {
+		result, err = selection.FromGit(*root, testDirs, *limit)
+		if err != nil {
+			fatalf("%s", err)
+		}
+	}
+
+	fmt.Println(result.Counts())
+	for _, test := range result.Selected {
+		for _, name := range variantNames(*root, test) {
+			fmt.Printf("  %3d  %s\n", test.Score, name)
+		}
+	}
+	if len(result.Selected) == 0 {
+		fmt.Println("       none of the changed files belong to a test dir")
+	}
+}
+
+// variantNames returns the go test names of the selected test. go test reads a name as a
+// prefix, so a name is only as long as it needs to be: the dir alone when every variant of
+// it runs, and otherwise up to the variant the selection names.
+func variantNames(root string, test selection.Test) []string {
+	if test.Filter == "" {
+		return []string{runPattern(strings.Split(test.Dir, "/"))}
+	}
+	key, _, _ := strings.Cut(test.Filter, "=")
+
+	var names []string
+	for _, envset := range selection.Variants(root, test.Dir) {
+		if !selection.MatchesFilters(envset, []string{test.Filter}) {
+			continue
+		}
+		// Cut the name after the variable the filter names; the variants below it all run.
+		for i, kv := range envset {
+			if name, _, _ := strings.Cut(kv, "="); name == key {
+				envset = envset[:i+1]
+				break
+			}
+		}
+		if name := runPattern(append(strings.Split(test.Dir, "/"), envset...)); !slices.Contains(names, name) {
+			names = append(names, name)
+		}
+	}
+	return names
+}
+
+// runPattern renders test name elements as a `go test -run` pattern. Each element of such a
+// pattern is a regexp matched against one level of the test name, so every element is escaped
+// and anchored: otherwise `bundle/deploy/immutable` would also run immutable-no-artifacts, and
+// the dots in job.yml.tmpl would match any character. The pattern is left open at the end, so
+// the variants below its last element still run.
+func runPattern(elements []string) string {
+	anchored := make([]string, 0, len(elements))
+	for _, element := range elements {
+		anchored = append(anchored, "^"+regexp.QuoteMeta(element)+"$")
+	}
+	return strings.Join(anchored, "/")
+}
+
+// diffFromArgs renders command line arguments as `git diff --name-status` lines, so the
+// same selection runs on them as on a real diff.
+func diffFromArgs(args []string) string {
+	lines := make([]string, 0, len(args))
+	for _, arg := range args {
+		status, rest, ok := strings.Cut(arg, ":")
+		if !ok {
+			status, rest = "M", arg
+		}
+		// A rename carries both paths ("R100:old:new"), which git separates by tabs.
+		paths := strings.Split(rest, ":")
+		for i, path := range paths {
+			paths[i] = strings.TrimPrefix(filepath.ToSlash(filepath.Clean(path)), "./")
+		}
+		lines = append(lines, status+"\t"+strings.Join(paths, "\t"))
+	}
+	return strings.Join(lines, "\n")
+}
+
+func fatalf(format string, args ...any) {
+	fmt.Fprintf(os.Stderr, format+"\n", args...)
+	os.Exit(1)
+}
diff --git a/acceptance/internal/selection/selection.go b/acceptance/internal/selection/selection.go
new file mode 100644
index 00000000000..95aa66eda95
--- /dev/null
+++ b/acceptance/internal/selection/selection.go
@@ -0,0 +1,500 @@
+// Package selection picks the acceptance tests a branch changed, so a run can cover what a
+// PR touches instead of the whole suite. The acceptance harness uses it for
+// DATABRICKS_TEST_SELECT_CHANGED; the cmd subpackage exposes the same selection as a
+// command, to inspect what a given change would run.
+package selection
+
+import (
+	"errors"
+	"fmt"
+	"io/fs"
+	"maps"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"slices"
+	"strconv"
+	"strings"
+
+	"github.com/BurntSushi/toml"
+
+	"github.com/databricks/cli/acceptance/internal"
+)
+
+const (
+	// EnvVar holds the number of changed tests to select. Unset means no selection.
+	EnvVar = "DATABRICKS_TEST_SELECT_CHANGED"
+
+	// EntryPointScript is the file whose presence marks a directory as a test case.
+	EntryPointScript = "script"
+
+	// acceptanceDirPrefix is where the test dirs live relative to the repo root, since
+	// git reports repo-relative paths while test dirs are named relative to acceptance/.
+	acceptanceDirPrefix = "acceptance/"
+
+	invariantConfigsPrefix = acceptanceDirPrefix + "bundle/invariant/configs/"
+	invariantDirPrefix     = "bundle/invariant/"
+)
+
+// Test is one test the selection picked: a whole test dir, or one variant of it when only
+// some of its variants changed.
+type Test struct {
+	// Dir is the test dir, relative to acceptance/.
+	Dir string
+
+	// Filter is the KEY=value the variant is selected by, empty when every variant of the
+	// dir runs. Each variant is picked, and scored, on its own: adding one invariant config
+	// makes that config's variant new without touching the others.
+	Filter string
+
+	// Score is why the test was picked; see the score constants.
+	Score int
+}
+
+// Name is the test as go test names it, without the variants the selection says nothing
+// about (see MatchesFilters).
+func (t Test) Name() string {
+	if t.Filter == "" {
+		return t.Dir
+	}
+	return t.Dir + "/" + t.Filter
+}
+
+// Result is the outcome of a selection.
+type Result struct {
+	// Selected lists the picked tests, highest score first and alphabetical within a
+	// score.
+	Selected []Test
+
+	// Dropped counts the changed tests that did not fit Limit.
+	Dropped int
+
+	// Limit is the cap this selection was made with.
+	Limit int
+}
+
+// Tests maps each selected test dir to the variant filters it runs with, the form the
+// acceptance harness looks tests up by. A nil slice means every variant of the dir runs.
+func (r Result) Tests() map[string][]string {
+	tests := make(map[string][]string, len(r.Selected))
+	for _, test := range r.Selected {
+		if test.Filter == "" {
+			tests[test.Dir] = nil
+			continue
+		}
+		if filters, ok := tests[test.Dir]; !ok || filters != nil {
+			tests[test.Dir] = append(filters, test.Filter)
+		}
+	}
+	return tests
+}
+
+// Counts says how many tests were selected and how many the limit cut.
+func (r Result) Counts() string {
+	return fmt.Sprintf("Selected %d changed tests (limit=%d, %d not selected)", len(r.Selected), r.Limit, r.Dropped)
+}
+
+// Summary is the whole outcome on one line, for the test log.
+func (r Result) Summary() string {
+	names := make([]string, 0, len(r.Selected))
+	for _, test := range r.Selected {
+		names = append(names, test.Name())
+	}
+	return r.Counts() + ": " + strings.Join(names, " ")
+}
+
+// ParseLimit reads the number of tests to select from a raw EnvVar value. An empty value
+// yields 0, which means no selection.
+func ParseLimit(raw string) (int, error) {
+	if raw == "" {
+		return 0, nil
+	}
+
+	limit, err := strconv.Atoi(raw)
+	if err != nil || limit <= 0 {
+		return 0, fmt.Errorf("invalid %s=%q, expected a positive integer", EnvVar, raw)
+	}
+
+	return limit, nil
+}
+
+// MatchesFilters reports whether envset satisfies every KEY=value filter. A filter matches
+// unless its key is present in envset with a different value. Filters that share a key are
+// alternatives: the environment has one value per key, so requiring each of them separately
+// would match nothing, while a selection naming several values of a key (one INPUT_CONFIG
+// per changed invariant config) means any of them.
+func MatchesFilters(envset, filters []string) bool {
+	envMap := make(map[string]string, len(envset))
+	for _, kv := range envset {
+		key, value, _ := strings.Cut(kv, "=")
+		envMap[key] = value
+	}
+
+	expected := make(map[string][]string, len(filters))
+	for _, filter := range filters {
+		key, value, _ := strings.Cut(filter, "=")
+		expected[key] = append(expected[key], value)
+	}
+
+	for key, values := range expected {
+		if actual, ok := envMap[key]; ok && !slices.Contains(values, actual) {
+			return false
+		}
+	}
+	return true
+}
+
+// Variants returns the env sets dir runs with, read from its materialized config
+// (out.test.toml), which already has the excluded matrix values removed. Excludes that name a
+// combination of variables are not recorded there, so a returned variant can still be one the
+// harness skips.
+//
+// A dir with no readable materialized config has no matrix, which expands to a single variant
+// with no env set, so every filter matches it. That is the conservative answer: it can only
+// select more tests, never fewer, and the harness parses the same file strictly when it runs a
+// test, so a malformed one is reported there.
+func Variants(root, dir string) [][]string {
+	var config internal.TestConfig
+
+	contents, err := os.ReadFile(filepath.Join(root, dir, internal.MaterializedConfigFile))
+	if err == nil {
+		_, _ = toml.Decode(string(contents), &config)
+	}
+
+	return internal.ExpandEnvMatrix(config.EnvMatrix, nil, nil)
+}
+
+// hasVariant reports whether the test dir at root/dir runs a variant matching filter.
+func hasVariant(root, dir, filter string) bool {
+	for _, envset := range Variants(root, dir) {
+		if MatchesFilters(envset, []string{filter}) {
+			return true
+		}
+	}
+	return false
+}
+
+// FindTestDirs returns every test dir under root, named relative to root with forward
+// slashes, sorted.
+func FindTestDirs(root string) ([]string, error) {
+	var dirs []string
+
+	err := filepath.WalkDir(root, func(path string, entry fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		if entry.IsDir() || entry.Name() != EntryPointScript {
+			return nil
+		}
+		rel, err := filepath.Rel(root, filepath.Dir(path))
+		if err != nil {
+			return err
+		}
+		dirs = append(dirs, filepath.ToSlash(rel))
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	slices.Sort(dirs)
+	return dirs, nil
+}
+
+// FromGit selects among testDirs the tests this branch changed, at most limit of them.
+//
+// --merge-base diffs the working tree against the merge base of HEAD and
+// origin/main. This covers committed, staged, and unstaged changes alike —
+// the working tree reflects all three. Untracked files (not yet git-added)
+// are not visible to git diff and will not be re-enabled until staged or
+// committed. The three-dot form origin/main...HEAD only covers committed
+// changes and misses unstaged edits, which breaks the "touch a config, run
+// the test" local dev workflow (same reason lintdiff.py uses --merge-base).
+func FromGit(root string, testDirs map[string]bool, limit int) (Result, error) {
+	out, err := exec.Command("git", "diff", "--name-status", "--merge-base", "-M", "origin/main").Output()
+	if err != nil {
+		// A failed diff (most commonly a missing origin/main in a shallow CI checkout)
+		// must not be silently treated as "nothing changed": that disables change
+		// detection and lets newly added tests skip. Every caller (push.yml PR cells,
+		// integration runs) fetches origin/main, so the caller should fail loudly.
+		if exitErr, ok := errors.AsType[*exec.ExitError](err); ok {
+			if stderr := strings.TrimSpace(string(exitErr.Stderr)); stderr != "" {
+				return Result{}, fmt.Errorf("git diff --merge-base origin/main failed: %w: %s", err, stderr)
+			}
+		}
+		return Result{}, fmt.Errorf("git diff --merge-base origin/main failed: %w", err)
+	}
+
+	return FromDiff(root, strings.TrimSpace(string(out)), testDirs, limit), nil
+}
+
+// testDirForFile maps a repo-relative changed file (e.g. acceptance/bundle/foo/script)
+// to its owning test dir relative to acceptance/ (e.g. bundle/foo), or "" if the file
+// is outside acceptance/ or not under any known test dir.
+func testDirForFile(repoRelPath string, testDirs map[string]bool) string {
+	parts := strings.Split(filepath.ToSlash(repoRelPath), "/")
+	if len(parts) < 2 || parts[0]+"/" != acceptanceDirPrefix {
+		return ""
+	}
+	// Longest ancestor first so nested tests map to the innermost test dir.
+	for depth := len(parts); depth > 1; depth-- {
+		candidate := strings.Join(parts[1:depth], "/")
+		if testDirs[candidate] {
+			return candidate
+		}
+	}
+	return ""
+}
+
+// changedDir records how one test dir changed and which of its variants should run.
+type changedDir struct {
+	// filters holds one record per variant the dir is restricted to. Empty means every
+	// variant runs.
+	filters []variantFilter
+
+	// allVariants is set by a change to the dir itself, as opposed to a change to an
+	// invariant config the dir is generated from. It clears filters and keeps a later
+	// config change from narrowing the dir back down to one config.
+	allVariants bool
+
+	// newTest is set when the dir's script is new, so the whole test is new. moved is set
+	// when the script arrived as an identical rename, so the test only changed location.
+	newTest bool
+	moved   bool
+
+	// nonRenameChange is set by a change that is not a rename, so a dir that both moved and
+	// changed is not scored as a pure move.
+	nonRenameChange bool
+
+	// fixture is set when a file the test is made of changed, generated when a file the
+	// test produces changed (out*). A dir with only generated changes is one whose golden
+	// output was regenerated.
+	fixture   bool
+	generated bool
+}
+
+// The cap takes the highest scoring dirs, and the scores add up, so a dir that changed in
+// several ways outranks one that changed in a single way. A new test is the most likely to
+// be broken, while a dir where nothing but the golden output changed scores lowest: that
+// usually follows a change elsewhere in the tree and lands on hundreds of dirs at once,
+// which would otherwise fill the quota with tests this branch never edited.
+const (
+	scoreNewTest   = 5
+	scoreChange    = 5
+	scoreGenerated = 1
+	scoreMoved     = 1
+)
+
+func (d *changedDir) score(newVariant bool) int {
+	if d.moved && !d.nonRenameChange {
+		// The files of a moved dir all arrive as renames. Moving a test does not change what
+		// it does, so those renames do not also count as changes.
+		return scoreMoved
+	}
+
+	score := 0
+	if d.newTest || newVariant {
+		score += scoreNewTest
+	}
+	if d.fixture {
+		score += scoreChange
+	}
+	if d.generated {
+		score += scoreGenerated
+	}
+	if d.moved {
+		// A dir that moved and changed is scored for both.
+		score += scoreMoved
+	}
+	return score
+}
+
+// variantFilter is one variant of a dir, selected because the invariant config it is
+// generated from changed.
+type variantFilter struct {
+	// env is the KEY=value the variant is selected by.
+	env string
+
+	// newVariant is set when the config is new, so this variant of the dir is new while its
+	// other variants are not.
+	newVariant bool
+}
+
+// changedDirs maps a test dir, relative to acceptance/, to how it changed.
+type changedDirs map[string]*changedDir
+
+// addFilter restricts the dir to one more variant, unless a change to the dir itself
+// already runs every variant. Repeating a variant (a config and its setup script) keeps the
+// stronger record.
+func (d *changedDir) addFilter(env string, newVariant bool) {
+	if d.allVariants {
+		return
+	}
+	for i, filter := range d.filters {
+		if filter.env == env {
+			d.filters[i].newVariant = filter.newVariant || newVariant
+			return
+		}
+	}
+	d.filters = append(d.filters, variantFilter{env: env, newVariant: newVariant})
+}
+
+func (c changedDirs) get(dir string) *changedDir {
+	if d, ok := c[dir]; ok {
+		return d
+	}
+	d := &changedDir{}
+	c[dir] = d
+	return d
+}
+
+// invariantConfigName returns the config a changed file under acceptance/bundle/invariant/
+// configs/ belongs to (job.yml.tmpl for both job.yml.tmpl and job.yml.tmpl-init.sh), or ""
+// for any other path.
+func invariantConfigName(path string) string {
+	if !strings.HasPrefix(path, invariantConfigsPrefix) {
+		return ""
+	}
+	name := strings.TrimPrefix(path, invariantConfigsPrefix)
+	// A config's setup and teardown scripts belong to the config they are named after.
+	name = strings.TrimSuffix(name, "-init.sh")
+	name = strings.TrimSuffix(name, "-cleanup.sh")
+	if !strings.HasSuffix(name, ".yml.tmpl") {
+		return ""
+	}
+	return name
+}
+
+// isGeneratedFile reports whether path is a file the test generates rather than a fixture
+// the test is made of. A file counts as generated when its path relative to the test dir
+// starts with "out" (output.txt, out.requests.txt, out.test.toml) — the same rule the
+// harness uses to split inputs from outputs when it copies a test dir, so a nested file
+// such as subdir/outer.py stays a fixture.
+func isGeneratedFile(path, dir string) bool {
+	return strings.HasPrefix(strings.TrimPrefix(path, acceptanceDirPrefix+dir+"/"), "out")
+}
+
+// markChanged records a changed file against its test dir. The dir runs in full, and the file
+// counts as a fixture unless it is output the test generates.
+func markChanged(dirs changedDirs, dir, path string) *changedDir {
+	d := dirs.get(dir)
+	// A change to the dir itself runs every variant, so any variant filter it picked up from a
+	// config change is dropped and a later one is ignored.
+	d.allVariants = true
+	d.filters = nil
+	if isGeneratedFile(path, dir) {
+		d.generated = true
+	} else {
+		d.fixture = true
+	}
+	return d
+}
+
+// FromDiff selects among testDirs the tests touched by `git diff --name-status` output,
+// keeping at most limit of them in the order documented on the score constants. root is the
+// acceptance directory, read for the variants each test dir runs.
+func FromDiff(root, diff string, testDirs map[string]bool, limit int) Result {
+	dirs := changedDirs{}
+
+	for line := range strings.SplitSeq(diff, "\n") {
+		// A rename line carries both paths ("R100\told\tnew"); the last field is the
+		// path that exists now.
+		fields := strings.Split(line, "\t")
+		if len(fields) < 2 {
+			continue
+		}
+		status := fields[0]
+		path := fields[len(fields)-1]
+
+		// A rename also changes the dir the file left: it lost an input and may no longer
+		// pass. It only counts while that test dir still exists, so moving a whole dir does
+		// not select the dir it came from.
+		if strings.HasPrefix(status, "R") && len(fields) >= 3 {
+			if source := testDirForFile(fields[1], testDirs); source != "" {
+				markChanged(dirs, source, fields[1])
+			}
+		}
+
+		// A changed invariant config re-enables every invariant subdir, but only for the
+		// variants generated from that config.
+		if configName := invariantConfigName(path); configName != "" {
+			filter := "INPUT_CONFIG=" + configName
+			for dir := range testDirs {
+				if !strings.HasPrefix(dir, invariantDirPrefix) {
+					continue
+				}
+				// A dir that does not run this config would be selected with every
+				// variant skipped, spending the limit on a test that runs nothing.
+				// A deleted config is gone from every matrix, so this drops it too.
+				if !hasVariant(root, dir, filter) {
+					continue
+				}
+				d := dirs.get(dir)
+				// The config is the fixture these dirs are generated from. A new config
+				// adds one variant of each dir, so only that variant is new; the
+				// -init.sh / -cleanup.sh companions of a config change how an existing
+				// variant runs.
+				d.fixture = true
+				isNewConfig := status == "A" && strings.HasSuffix(path, configName)
+				d.addFilter(filter, isNewConfig)
+			}
+			continue
+		}
+
+		// out.test.toml under the invariant tree regenerates automatically when
+		// INPUT_CONFIG changes; ignore it so a regenerated matrix does not unlock all
+		// variants of every invariant subdir. The test.toml beside it is hand-written, so
+		// it is a fixture like any other.
+		if strings.HasPrefix(path, acceptanceDirPrefix+invariantDirPrefix) {
+			if filepath.Base(path) == internal.MaterializedConfigFile {
+				continue
+			}
+		}
+
+		dir := testDirForFile(path, testDirs)
+		if dir == "" {
+			continue
+		}
+
+		d := markChanged(dirs, dir, path)
+		if !strings.HasPrefix(status, "R") {
+			d.nonRenameChange = true
+		}
+		// The status of the dir's script says how the dir itself changed.
+		if strings.HasSuffix(path, "/script") {
+			switch status {
+			case "A":
+				d.newTest = true
+			case "R100":
+				// Only an identical rename is a pure move. A rename that also rewrote the
+				// script is a change like any other.
+				d.moved = true
+			}
+		}
+	}
+
+	tests := make([]Test, 0, len(dirs))
+	for _, dir := range slices.Sorted(maps.Keys(dirs)) {
+		d := dirs[dir]
+		if len(d.filters) == 0 {
+			tests = append(tests, Test{Dir: dir, Score: d.score(false)})
+			continue
+		}
+		for _, filter := range d.filters {
+			tests = append(tests, Test{Dir: dir, Filter: filter.env, Score: d.score(filter.newVariant)})
+		}
+	}
+
+	// Highest score first, then by name, so the limit cuts the same set whatever order the
+	// diff happens to list the changed files in.
+	slices.SortFunc(tests, func(a, b Test) int {
+		if byScore := b.Score - a.Score; byScore != 0 {
+			return byScore
+		}
+		return strings.Compare(a.Name(), b.Name())
+	})
+
+	dropped := max(len(tests)-limit, 0)
+	tests = tests[:len(tests)-dropped]
+	return Result{Selected: tests, Dropped: dropped, Limit: limit}
+}
diff --git a/acceptance/internal/selection/selection_test.go b/acceptance/internal/selection/selection_test.go
new file mode 100644
index 00000000000..89b23e7666b
--- /dev/null
+++ b/acceptance/internal/selection/selection_test.go
@@ -0,0 +1,347 @@
+package selection_test
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/databricks/cli/acceptance/internal/selection"
+)
+
+var testDirs = map[string]bool{
+	"bundle/added":           true,
+	"bundle/modified":        true,
+	"bundle/regenerated":     true,
+	"bundle/moved":           true,
+	"bundle/untouched":       true,
+	"bundle/invariant/jobs":  true,
+	"bundle/invariant/apps":  true,
+	"cmd/sync/nested":        true,
+	"cmd/sync/nested/deeper": true,
+}
+
+// fromDiff selects against a root with no materialized configs, so no test dir contradicts a
+// variant filter. TestFromDiffSkipsConfigNotInMatrix covers the case where one does.
+func fromDiff(t *testing.T, diff string, limit int) selection.Result {
+	return selection.FromDiff(t.TempDir(), diff, testDirs, limit)
+}
+
+// diffLines joins name-status records the way `git diff --name-status` prints them.
+func diffLines(lines ...string) string {
+	return strings.Join(lines, "\n")
+}
+
+func TestFromDiffStatuses(t *testing.T) {
+	diff := diffLines(
+		"A\tacceptance/bundle/added/script",
+		"M\tacceptance/bundle/modified/databricks.yml",
+		"R100\tacceptance/bundle/old/script\tacceptance/bundle/moved/script",
+		"M\tlibs/dyn/value.go",
+	)
+	result := fromDiff(t, diff, 10)
+	assert.Zero(t, result.Dropped)
+	assert.Equal(t, map[string][]string{
+		"bundle/added":    nil,
+		"bundle/modified": nil,
+		"bundle/moved":    nil,
+	}, result.Tests())
+}
+
+func TestFromDiffPriority(t *testing.T) {
+	diff := diffLines(
+		"R100\tacceptance/bundle/old/script\tacceptance/bundle/moved/script",
+		"M\tacceptance/bundle/regenerated/output.txt",
+		"M\tacceptance/bundle/modified/script",
+		"A\tacceptance/bundle/added/script",
+	)
+	// The cap keeps added first, then a changed fixture, then a moved dir, and last a dir
+	// where only the golden output was regenerated.
+	scored := []string{"bundle/added", "bundle/modified", "bundle/moved", "bundle/regenerated"}
+	for limit := 1; limit <= len(scored); limit++ {
+		result := fromDiff(t, diff, limit)
+		assert.Len(t, result.Selected, limit)
+		assert.Equal(t, len(scored)-limit, result.Dropped, "limit=%d", limit)
+		for _, dir := range scored[:limit] {
+			assert.Contains(t, result.Tests(), dir, "limit=%d", limit)
+		}
+	}
+}
+
+func TestFromDiffScores(t *testing.T) {
+	// Scores add up: a new dir counts as new (5) plus its fixtures (5) plus its goldens
+	// (1); a dir whose script and golden both changed counts 5+1. A dir that only moved
+	// scores the move alone, since the identical renames it brings along are not changes.
+	diff := diffLines(
+		"A\tacceptance/bundle/added/script",
+		"A\tacceptance/bundle/added/output.txt",
+		"M\tacceptance/bundle/modified/script",
+		"M\tacceptance/bundle/modified/output.txt",
+		"R100\tacceptance/bundle/old/script\tacceptance/bundle/moved/script",
+		"R100\tacceptance/bundle/old/output.txt\tacceptance/bundle/moved/output.txt",
+		"M\tacceptance/bundle/regenerated/output.txt",
+		"M\tacceptance/bundle/untouched/databricks.yml",
+	)
+	result := fromDiff(t, diff, 10)
+	scores := map[string]int{}
+	for _, test := range result.Selected {
+		scores[test.Dir] = test.Score
+	}
+	assert.Equal(t, map[string]int{
+		"bundle/added":       11,
+		"bundle/modified":    6,
+		"bundle/untouched":   5,
+		"bundle/moved":       1,
+		"bundle/regenerated": 1,
+	}, scores)
+}
+
+func TestFromDiffFixtureBeatsOutputInSameDir(t *testing.T) {
+	// A dir with both a fixture and an output change ranks as a fixture change.
+	diff := diffLines(
+		"M\tacceptance/bundle/modified/output.txt",
+		"M\tacceptance/bundle/modified/databricks.yml",
+		"M\tacceptance/bundle/regenerated/out.requests.txt",
+	)
+	result := fromDiff(t, diff, 1)
+	assert.Equal(t, map[string][]string{"bundle/modified": nil}, result.Tests())
+	assert.Equal(t, 1, result.Dropped)
+}
+
+func TestFromDiffNestedFixture(t *testing.T) {
+	// "out" is matched against the path relative to the test dir, so a file in a
+	// subdirectory is a fixture even when its own name starts with "out".
+	diff := diffLines(
+		"M\tacceptance/bundle/modified/subdir/outer.py",
+		"M\tacceptance/bundle/regenerated/output.txt",
+	)
+	result := fromDiff(t, diff, 1)
+	assert.Equal(t, map[string][]string{"bundle/modified": nil}, result.Tests())
+	assert.Equal(t, 1, result.Dropped)
+}
+
+func TestFromDiffInvariantConfigRanksAsFixture(t *testing.T) {
+	// The invariant config is the fixture its dirs are generated from, so it outranks
+	// a dir whose output was regenerated.
+	diff := diffLines(
+		"M\tacceptance/bundle/regenerated/output.txt",
+		"M\tacceptance/bundle/invariant/configs/job.yml.tmpl",
+	)
+	result := fromDiff(t, diff, 2)
+	assert.NotContains(t, result.Tests(), "bundle/regenerated")
+	assert.Equal(t, 1, result.Dropped)
+}
+
+func TestFromDiffNewInvariantConfig(t *testing.T) {
+	// A new invariant config adds a variant of every invariant dir, so it scores as a new
+	// test on top of the fixture change. Changing an existing config, or adding one of its
+	// -init.sh companions, only changes how an existing variant runs.
+	for status, want := range map[string]int{"A": 10, "M": 5} {
+		result := fromDiff(t, diffLines(status+"\tacceptance/bundle/invariant/configs/job.yml.tmpl"), 10)
+		assert.Equal(t, want, result.Selected[0].Score, "status=%s", status)
+	}
+
+	result := fromDiff(t, diffLines("A\tacceptance/bundle/invariant/configs/job.yml.tmpl-init.sh"), 10)
+	assert.Equal(t, 5, result.Selected[0].Score)
+}
+
+func TestFromDiffTwoInvariantConfigs(t *testing.T) {
+	// Two changed configs restrict the invariant dirs to the variants of both, as filters
+	// naming the same key are alternatives.
+	diff := diffLines(
+		"M\tacceptance/bundle/invariant/configs/job.yml.tmpl",
+		"M\tacceptance/bundle/invariant/configs/pipeline.yml.tmpl",
+	)
+	result := fromDiff(t, diff, 10)
+	both := []string{"INPUT_CONFIG=job.yml.tmpl", "INPUT_CONFIG=pipeline.yml.tmpl"}
+	assert.Equal(t, map[string][]string{
+		"bundle/invariant/jobs": both,
+		"bundle/invariant/apps": both,
+	}, result.Tests())
+}
+
+func TestFromDiffConfigAndItsInitScript(t *testing.T) {
+	// A config and its setup script name the same variant, so the filter is kept.
+	diff := diffLines(
+		"M\tacceptance/bundle/invariant/configs/job.yml.tmpl",
+		"M\tacceptance/bundle/invariant/configs/job.yml.tmpl-init.sh",
+	)
+	result := fromDiff(t, diff, 10)
+	assert.Equal(t, map[string][]string{
+		"bundle/invariant/jobs": {"INPUT_CONFIG=job.yml.tmpl"},
+		"bundle/invariant/apps": {"INPUT_CONFIG=job.yml.tmpl"},
+	}, result.Tests())
+}
+
+func TestFromDiffHyphenatedConfigName(t *testing.T) {
+	// The companion script names the config it belongs to, whose own name may contain a
+	// hyphen: only the exact suffix is stripped.
+	diff := diffLines("M\tacceptance/bundle/invariant/configs/my-config.yml.tmpl-init.sh")
+	result := fromDiff(t, diff, 10)
+	assert.Equal(t, map[string][]string{
+		"bundle/invariant/jobs": {"INPUT_CONFIG=my-config.yml.tmpl"},
+		"bundle/invariant/apps": {"INPUT_CONFIG=my-config.yml.tmpl"},
+	}, result.Tests())
+}
+
+func TestFromDiffMovedDirWithNewConfig(t *testing.T) {
+	// The move is a change to the dir itself, so it runs every variant, including the one
+	// the new config adds, and scores the move.
+	diff := diffLines(
+		"A\tacceptance/bundle/invariant/configs/job.yml.tmpl",
+		"R100\tacceptance/bundle/invariant/old/script\tacceptance/bundle/invariant/jobs/script",
+	)
+	result := fromDiff(t, diff, 10)
+	scores := map[string]int{}
+	for _, test := range result.Selected {
+		scores[test.Name()] = test.Score
+	}
+	assert.Equal(t, 1, scores["bundle/invariant/jobs"])
+	assert.Nil(t, result.Tests()["bundle/invariant/jobs"])
+}
+
+func TestFromDiffNewConfigScoresOnlyItsVariant(t *testing.T) {
+	// Each variant is scored on its own: adding one config makes that config's variant new
+	// without making the variant of a config that was merely changed look new too.
+	diff := diffLines(
+		"M\tacceptance/bundle/invariant/configs/job.yml.tmpl",
+		"A\tacceptance/bundle/invariant/configs/pipeline.yml.tmpl",
+	)
+	result := fromDiff(t, diff, 10)
+	scores := map[string]int{}
+	for _, test := range result.Selected {
+		scores[test.Name()] = test.Score
+	}
+	assert.Equal(t, map[string]int{
+		"bundle/invariant/apps/INPUT_CONFIG=job.yml.tmpl":      5,
+		"bundle/invariant/apps/INPUT_CONFIG=pipeline.yml.tmpl": 10,
+		"bundle/invariant/jobs/INPUT_CONFIG=job.yml.tmpl":      5,
+		"bundle/invariant/jobs/INPUT_CONFIG=pipeline.yml.tmpl": 10,
+	}, scores)
+}
+
+func TestFromDiffNestedDir(t *testing.T) {
+	// A file maps to the innermost test dir that owns it.
+	diff := diffLines("M\tacceptance/cmd/sync/nested/deeper/script")
+	result := fromDiff(t, diff, 10)
+	assert.Equal(t, map[string][]string{"cmd/sync/nested/deeper": nil}, result.Tests())
+}
+
+func TestFromDiffInvariantConfig(t *testing.T) {
+	// A changed invariant config re-enables every invariant dir, restricted to that config.
+	diff := diffLines("M\tacceptance/bundle/invariant/configs/job.yml.tmpl")
+	result := fromDiff(t, diff, 10)
+	assert.Equal(t, map[string][]string{
+		"bundle/invariant/jobs": {"INPUT_CONFIG=job.yml.tmpl"},
+		"bundle/invariant/apps": {"INPUT_CONFIG=job.yml.tmpl"},
+	}, result.Tests())
+}
+
+func TestFromDiffInvariantConfigAndDir(t *testing.T) {
+	// A non-config change to an invariant dir unlocks all of its variants; the
+	// regenerated test.toml files are ignored.
+	diff := diffLines(
+		"M\tacceptance/bundle/invariant/configs/job.yml.tmpl",
+		"M\tacceptance/bundle/invariant/jobs/script",
+		"M\tacceptance/bundle/invariant/apps/out.test.toml",
+	)
+	result := fromDiff(t, diff, 10)
+	assert.Equal(t, map[string][]string{
+		"bundle/invariant/jobs": nil,
+		"bundle/invariant/apps": {"INPUT_CONFIG=job.yml.tmpl"},
+	}, result.Tests())
+}
+
+func TestFromDiffEmptyDiff(t *testing.T) {
+	result := fromDiff(t, "", 10)
+	assert.Empty(t, result.Tests())
+	assert.Zero(t, result.Dropped)
+}
+
+func TestFromDiffInvariantTestToml(t *testing.T) {
+	// test.toml is hand-written, so changing it selects the dir it belongs to. out.test.toml
+	// next to it is generated whenever the matrix changes, and selects nothing.
+	result := fromDiff(t, diffLines("M\tacceptance/bundle/invariant/jobs/test.toml"), 10)
+	assert.Equal(t, map[string][]string{"bundle/invariant/jobs": nil}, result.Tests())
+
+	result = fromDiff(t, diffLines("M\tacceptance/bundle/invariant/jobs/out.test.toml"), 10)
+	assert.Empty(t, result.Tests())
+}
+
+func TestFromDiffSkipsConfigNotInMatrix(t *testing.T) {
+	// An invariant dir that does not run the changed config would be selected with every
+	// variant skipped, spending the limit on a test that runs nothing.
+	root := t.TempDir()
+	for dir, configs := range map[string]string{
+		"bundle/invariant/jobs": `["job.yml.tmpl", "app.yml.tmpl"]`,
+		"bundle/invariant/apps": `["app.yml.tmpl"]`,
+	} {
+		require.NoError(t, os.MkdirAll(filepath.Join(root, dir), 0o755))
+		contents := "EnvMatrix.INPUT_CONFIG = " + configs + "\n"
+		require.NoError(t, os.WriteFile(filepath.Join(root, dir, "out.test.toml"), []byte(contents), 0o644))
+	}
+
+	diff := diffLines("M\tacceptance/bundle/invariant/configs/job.yml.tmpl")
+	result := selection.FromDiff(root, diff, testDirs, 10)
+	assert.Equal(t, map[string][]string{
+		"bundle/invariant/jobs": {"INPUT_CONFIG=job.yml.tmpl"},
+	}, result.Tests())
+}
+
+func TestFromDiffRenameOutOfTestDir(t *testing.T) {
+	// The dir that lost the file may no longer pass, so it runs in full. The whole dir moving
+	// away is different: its old dir is gone, so only the new one is selected.
+	diff := diffLines("R100\tacceptance/bundle/modified/databricks.yml\tdocs/example.yml")
+	result := fromDiff(t, diff, 10)
+	assert.Equal(t, map[string][]string{"bundle/modified": nil}, result.Tests())
+
+	diff = diffLines("R100\tacceptance/bundle/old/script\tacceptance/bundle/moved/script")
+	result = fromDiff(t, diff, 10)
+	assert.Equal(t, map[string][]string{"bundle/moved": nil}, result.Tests())
+}
+
+func TestFromDiffMovedScoresMoveAndChange(t *testing.T) {
+	// Only an identical rename is a pure move. A rename that rewrote the script, or a move
+	// that came with another change, is scored for the change as well.
+	scoreOf := func(diff, name string) int {
+		for _, test := range fromDiff(t, diff, 10).Selected {
+			if test.Name() == name {
+				return test.Score
+			}
+		}
+		return 0
+	}
+
+	moved := "acceptance/bundle/old/script\tacceptance/bundle/moved/script"
+	assert.Equal(t, 1, scoreOf(diffLines("R100\t"+moved), "bundle/moved"))
+	assert.Equal(t, 5, scoreOf(diffLines("R090\t"+moved), "bundle/moved"))
+	assert.Equal(t, 6, scoreOf(diffLines(
+		"R100\t"+moved,
+		"M\tacceptance/bundle/moved/databricks.yml",
+	), "bundle/moved"))
+}
+
+func TestFromDiffTiesAreAlphabetical(t *testing.T) {
+	// Tests that score the same are ordered by name, so the limit cuts the same set whatever
+	// order the diff lists the changed files in.
+	lines := []string{
+		"M\tacceptance/bundle/invariant/configs/pipeline.yml.tmpl",
+		"M\tacceptance/bundle/invariant/configs/job.yml.tmpl",
+	}
+	expected := []string{
+		"bundle/invariant/apps/INPUT_CONFIG=job.yml.tmpl",
+		"bundle/invariant/apps/INPUT_CONFIG=pipeline.yml.tmpl",
+	}
+
+	for _, diff := range []string{diffLines(lines...), diffLines(lines[1], lines[0])} {
+		result := fromDiff(t, diff, 2)
+		var names []string
+		for _, test := range result.Selected {
+			names = append(names, test.Name())
+		}
+		assert.Equal(t, expected, names)
+	}
+}
diff --git a/acceptance/internal/tempdir.go b/acceptance/internal/tempdir.go
new file mode 100644
index 00000000000..97ebfc2b562
--- /dev/null
+++ b/acceptance/internal/tempdir.go
@@ -0,0 +1,29 @@
+package internal
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/databricks/cli/libs/git"
+)
+
+// RequireTempDirNotInGitRepo fails fast if os.TempDir() sits inside a git
+// repository. A stray .git directory above the temp dir (e.g. an empty
+// /tmp/.git) makes the CLI believe all temporary directories are git
+// repositories, which breaks dozens of tests with baffling diffs.
+// Catch it here instead of chasing them.
+func RequireTempDirNotInGitRepo(t *testing.T) {
+	for dir := os.TempDir(); ; {
+		gitPath := filepath.Join(dir, git.GitDirectoryName)
+		if _, err := os.Stat(gitPath); err == nil {
+			t.Fatalf("temp dir %q is inside a git repository (found %q); the CLI would treat every temporary directory as a git repository - remove %q",
+				os.TempDir(), gitPath, gitPath)
+		}
+		parent := filepath.Dir(dir)
+		if parent == dir {
+			return
+		}
+		dir = parent
+	}
+}
diff --git a/acceptance/internal/uv.go b/acceptance/internal/uv.go
new file mode 100644
index 00000000000..7c0d0207a82
--- /dev/null
+++ b/acceptance/internal/uv.go
@@ -0,0 +1,31 @@
+package internal
+
+import (
+	"os/exec"
+	"strings"
+	"testing"
+
+	"golang.org/x/mod/semver"
+)
+
+// RequireUV fails the run if uv is missing from PATH or older than minVersion
+// (e.g. "0.4"). See the call site for why the minimum is what it is.
+func RequireUV(t *testing.T, minVersion string) {
+	out, err := exec.Command("uv", "--version").Output()
+	if err != nil {
+		t.Fatalf("uv not found on PATH (acceptance tests require uv >= %s): %v", minVersion, err)
+	}
+	version := strings.TrimSpace(string(out))
+	if !uvVersionOK(version, minVersion) {
+		t.Fatalf("acceptance tests require uv >= %s (found %q); install a newer uv", minVersion, version)
+	}
+}
+
+// uvVersionOK reports whether `uv --version` output (e.g. "uv 0.11.22 (abc 2025-01-01)") is >= minVersion.
+func uvVersionOK(versionOutput, minVersion string) bool {
+	fields := strings.Fields(versionOutput)
+	if len(fields) < 2 {
+		return false
+	}
+	return semver.Compare("v"+fields[1], "v"+minVersion) >= 0
+}
diff --git a/acceptance/internal/uv_test.go b/acceptance/internal/uv_test.go
new file mode 100644
index 00000000000..879110411fb
--- /dev/null
+++ b/acceptance/internal/uv_test.go
@@ -0,0 +1,15 @@
+package internal
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestUvVersionOK(t *testing.T) {
+	assert.True(t, uvVersionOK("uv 0.4.0", "0.4"))
+	assert.True(t, uvVersionOK("uv 0.11.22 (abcdef 2025-01-01)", "0.4"))
+	assert.True(t, uvVersionOK("uv 1.0.0", "0.4"))
+	assert.False(t, uvVersionOK("uv 0.3.5", "0.4"))
+	assert.False(t, uvVersionOK("garbage", "0.4"))
+}
diff --git a/acceptance/invariant_test.go b/acceptance/invariant_test.go
new file mode 100644
index 00000000000..ad8e1d14022
--- /dev/null
+++ b/acceptance/invariant_test.go
@@ -0,0 +1,123 @@
+package acceptance_test
+
+import (
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+	"testing"
+
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/dyn/yamlloader"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const invariantConfigsDir = "bundle/invariant/configs"
+
+// LackingInvariantTest lists keys from config.ResourcesTypes that knowingly lack
+// a covering config in invariantConfigsDir. Keys match the ResourcesTypes
+// form: "<group>" for the resource itself, "<group>.permissions" / "<group>.grants"
+// for permissions/grants coverage. Add a config and remove the entry to close a gap;
+// the test fails if an entry here is actually covered, so the list only shrinks.
+var LackingInvariantTest = map[string]bool{
+	"quality_monitors":             true,
+	"internal_immutable_snapshots": true,
+}
+
+// TestInvariantConfigsCoverage ensures that the invariant test configs in
+// bundle/invariant/configs cover every bundle resource type, and that resource
+// types supporting permissions or grants have at least one config exercising them.
+//
+// config.ResourcesTypes is the source of truth: it maps each resource group
+// (e.g. "jobs") to its Go type and, where the resource struct has a Permissions
+// or Grants field, adds derived keys "<group>.permissions" and "<group>.grants".
+func TestInvariantConfigsCoverage(t *testing.T) {
+	present, withPermissions, withGrants := scanInvariantConfigs(t)
+
+	keys := make([]string, 0, len(config.ResourcesTypes))
+	for key := range config.ResourcesTypes {
+		keys = append(keys, key)
+	}
+	slices.Sort(keys)
+
+	for _, key := range keys {
+		var covered bool
+		var hint string
+		switch {
+		case strings.HasSuffix(key, ".permissions"):
+			group := strings.TrimSuffix(key, ".permissions")
+			covered = withPermissions[group]
+			hint = "attaches permissions to a " + group + " resource"
+		case strings.HasSuffix(key, ".grants"):
+			group := strings.TrimSuffix(key, ".grants")
+			covered = withGrants[group]
+			hint = "attaches grants to a " + group + " resource"
+		default:
+			covered = present[key]
+			hint = "defines a " + key + " resource"
+		}
+
+		if LackingInvariantTest[key] {
+			assert.False(t, covered,
+				"%q is covered by a config in %s; remove it from LackingInvariantTest", key, invariantConfigsDir)
+			continue
+		}
+		assert.True(t, covered,
+			"no config in %s %s; add one or allowlist %q", invariantConfigsDir, hint, key)
+	}
+}
+
+// scanInvariantConfigs parses every config in the invariant configs directory and
+// returns the set of resource groups present, the groups with at least one resource
+// carrying permissions, and the groups with at least one resource carrying grants.
+func scanInvariantConfigs(t *testing.T) (present, withPermissions, withGrants map[string]bool) {
+	present = map[string]bool{}
+	withPermissions = map[string]bool{}
+	withGrants = map[string]bool{}
+
+	entries, err := os.ReadDir(invariantConfigsDir)
+	require.NoError(t, err)
+
+	for _, entry := range entries {
+		if entry.IsDir() || !strings.HasSuffix(entry.Name(), ".yml.tmpl") {
+			continue
+		}
+		path := filepath.Join(invariantConfigsDir, entry.Name())
+		contents, err := os.ReadFile(path)
+		require.NoError(t, err)
+
+		v, err := yamlloader.LoadYAML(path, strings.NewReader(string(contents)))
+		require.NoError(t, err, "failed to parse %s", path)
+
+		resources := v.Get("resources")
+		if resources.Kind() != dyn.KindMap {
+			// Some configs (e.g. PyDABs) declare resources outside of YAML.
+			continue
+		}
+
+		for _, group := range resources.MustMap().Pairs() {
+			groupName := group.Key.MustString()
+			present[groupName] = true
+
+			if group.Value.Kind() != dyn.KindMap {
+				continue
+			}
+			for _, resource := range group.Value.MustMap().Pairs() {
+				cfg := resource.Value
+				if cfg.Kind() != dyn.KindMap {
+					continue
+				}
+				if cfg.Get("permissions").Kind() != dyn.KindInvalid {
+					withPermissions[groupName] = true
+				}
+				if cfg.Get("grants").Kind() != dyn.KindInvalid {
+					withGrants[groupName] = true
+				}
+			}
+		}
+	}
+
+	return present, withPermissions, withGrants
+}
diff --git a/acceptance/localenv/bundle-multiple-defaults/databricks.yml b/acceptance/localenv/bundle-multiple-defaults/databricks.yml
new file mode 100644
index 00000000000..46757827b57
--- /dev/null
+++ b/acceptance/localenv/bundle-multiple-defaults/databricks.yml
@@ -0,0 +1,11 @@
+bundle:
+  name: multiple-defaults
+
+# Two targets both marked default is an invalid bundle. setup-local consults the
+# bundle only as an optional source of cluster_id, so this error must not surface;
+# the command should still reach its own E_NO_TARGET.
+targets:
+  dev:
+    default: true
+  dev2:
+    default: true
diff --git a/acceptance/localenv/bundle-multiple-defaults/out.test.toml b/acceptance/localenv/bundle-multiple-defaults/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/localenv/bundle-multiple-defaults/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/localenv/bundle-multiple-defaults/output.txt b/acceptance/localenv/bundle-multiple-defaults/output.txt
new file mode 100644
index 00000000000..9f4228231ea
--- /dev/null
+++ b/acceptance/localenv/bundle-multiple-defaults/output.txt
@@ -0,0 +1,5 @@
+✗ Setup failed while resolving your compute target.
+
+  No compute target is selected. Select a cluster or serverless target, or pass --cluster-id / --cluster-name / --serverless-version / --job-task
+
+Re-run with --debug for details, or --output json for a structured report.
diff --git a/acceptance/localenv/bundle-multiple-defaults/script b/acceptance/localenv/bundle-multiple-defaults/script
new file mode 100644
index 00000000000..712272f0e56
--- /dev/null
+++ b/acceptance/localenv/bundle-multiple-defaults/script
@@ -0,0 +1 @@
+musterr $CLI environments setup-local
diff --git a/acceptance/localenv/bundle-multiple-defaults/test.toml b/acceptance/localenv/bundle-multiple-defaults/test.toml
new file mode 100644
index 00000000000..7850e09c2dc
--- /dev/null
+++ b/acceptance/localenv/bundle-multiple-defaults/test.toml
@@ -0,0 +1,3 @@
+[[Repls]]
+Old = 'uv uv \S+(?: \([^)]+\))?'
+New = 'uv [UV_VERSION]'
diff --git a/acceptance/localenv/cluster-name-ambiguous-json/out.test.toml b/acceptance/localenv/cluster-name-ambiguous-json/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/localenv/cluster-name-ambiguous-json/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/localenv/cluster-name-ambiguous-json/output.txt b/acceptance/localenv/cluster-name-ambiguous-json/output.txt
new file mode 100644
index 00000000000..cb5dcf04df7
--- /dev/null
+++ b/acceptance/localenv/cluster-name-ambiguous-json/output.txt
@@ -0,0 +1,42 @@
+{
+  "schemaVersion": 1,
+  "command": "environments setup-local",
+  "ok": false,
+  "mode": "default",
+  "dryRun": true,
+  "greenfield": false,
+  "phases": [
+    {
+      "phase": "preflight",
+      "status": "ok"
+    },
+    {
+      "phase": "resolve",
+      "status": "error"
+    },
+    {
+      "phase": "fetch",
+      "status": "pending"
+    },
+    {
+      "phase": "merge",
+      "status": "pending"
+    },
+    {
+      "phase": "provision",
+      "status": "pending"
+    },
+    {
+      "phase": "validate",
+      "status": "pending"
+    }
+  ],
+  "warnings": [],
+  "error": {
+    "code": "E_RESOLVE",
+    "failurePhase": "resolve",
+    "message": "resolving cluster name \"dup\": there are 2 active clusters named \"dup\"; use --cluster-id to disambiguate",
+    "diskMutated": false
+  },
+  "durationMs": [DURATION_MS]
+}
diff --git a/acceptance/localenv/cluster-name-ambiguous-json/script b/acceptance/localenv/cluster-name-ambiguous-json/script
new file mode 100644
index 00000000000..434245a7820
--- /dev/null
+++ b/acceptance/localenv/cluster-name-ambiguous-json/script
@@ -0,0 +1 @@
+musterr $CLI environments setup-local --cluster-name dup --dry-run --output json
diff --git a/acceptance/localenv/cluster-name-ambiguous-json/test.toml b/acceptance/localenv/cluster-name-ambiguous-json/test.toml
new file mode 100644
index 00000000000..b7d1537025a
--- /dev/null
+++ b/acceptance/localenv/cluster-name-ambiguous-json/test.toml
@@ -0,0 +1,17 @@
+Env.DATABRICKS_LOCALENV_CONSTRAINT_SOURCE_URL_TEST_OVERRIDE = "$DATABRICKS_HOST"
+# Two active clusters share the same name, so name→ID resolution is genuinely
+# ambiguous and errors as an actionable E_RESOLVE at the resolve phase.
+# (A terminated cluster sharing the name would be filtered out server-side via
+# ListClustersFilterBy, so it does not cause a spurious collision — see
+# GetClusterByName.)
+
+[[Server]]
+Pattern = "GET /api/2.1/clusters/list"
+Response.Body = '''
+{
+  "clusters": [
+    {"cluster_id": "cid-123", "cluster_name": "dup", "state": "RUNNING", "spark_version": "15.4.x-scala2.12"},
+    {"cluster_id": "cid-999", "cluster_name": "dup", "state": "RUNNING", "spark_version": "14.3.x-scala2.12"}
+  ]
+}
+'''
diff --git a/acceptance/localenv/cluster-name-ambiguous/out.test.toml b/acceptance/localenv/cluster-name-ambiguous/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/localenv/cluster-name-ambiguous/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/localenv/cluster-name-ambiguous/output.txt b/acceptance/localenv/cluster-name-ambiguous/output.txt
new file mode 100644
index 00000000000..7b0cf3418bb
--- /dev/null
+++ b/acceptance/localenv/cluster-name-ambiguous/output.txt
@@ -0,0 +1,5 @@
+✗ Setup failed while resolving your compute target.
+
+  resolving cluster name "dup": there are 2 active clusters named "dup"; use --cluster-id to disambiguate
+
+Re-run with --debug for details, or --output json for a structured report.
diff --git a/acceptance/localenv/cluster-name-ambiguous/script b/acceptance/localenv/cluster-name-ambiguous/script
new file mode 100644
index 00000000000..a7a8d77eb72
--- /dev/null
+++ b/acceptance/localenv/cluster-name-ambiguous/script
@@ -0,0 +1 @@
+musterr $CLI environments setup-local --cluster-name dup --dry-run
diff --git a/acceptance/localenv/cluster-name-ambiguous/test.toml b/acceptance/localenv/cluster-name-ambiguous/test.toml
new file mode 100644
index 00000000000..b7d1537025a
--- /dev/null
+++ b/acceptance/localenv/cluster-name-ambiguous/test.toml
@@ -0,0 +1,17 @@
+Env.DATABRICKS_LOCALENV_CONSTRAINT_SOURCE_URL_TEST_OVERRIDE = "$DATABRICKS_HOST"
+# Two active clusters share the same name, so name→ID resolution is genuinely
+# ambiguous and errors as an actionable E_RESOLVE at the resolve phase.
+# (A terminated cluster sharing the name would be filtered out server-side via
+# ListClustersFilterBy, so it does not cause a spurious collision — see
+# GetClusterByName.)
+
+[[Server]]
+Pattern = "GET /api/2.1/clusters/list"
+Response.Body = '''
+{
+  "clusters": [
+    {"cluster_id": "cid-123", "cluster_name": "dup", "state": "RUNNING", "spark_version": "15.4.x-scala2.12"},
+    {"cluster_id": "cid-999", "cluster_name": "dup", "state": "RUNNING", "spark_version": "14.3.x-scala2.12"}
+  ]
+}
+'''
diff --git a/acceptance/localenv/cluster-name-check/out.test.toml b/acceptance/localenv/cluster-name-check/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/localenv/cluster-name-check/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/localenv/cluster-name-check/output.txt b/acceptance/localenv/cluster-name-check/output.txt
new file mode 100644
index 00000000000..02f64fde947
--- /dev/null
+++ b/acceptance/localenv/cluster-name-check/output.txt
@@ -0,0 +1,7 @@
+
+>>> [CLI] environments setup-local --cluster-name my-cluster --dry-run
+Plan: [TEST_TMP_DIR]/pyproject.toml
+  changed region: requires-python
+  changed region: tool.uv.constraint-dependencies
+  changed region: databricks-connect
+Check complete. No files were modified.
diff --git a/acceptance/localenv/cluster-name-check/script b/acceptance/localenv/cluster-name-check/script
new file mode 100644
index 00000000000..ab8b82e1d02
--- /dev/null
+++ b/acceptance/localenv/cluster-name-check/script
@@ -0,0 +1 @@
+trace $CLI environments setup-local --cluster-name my-cluster --dry-run
diff --git a/acceptance/localenv/cluster-name-check/test.toml b/acceptance/localenv/cluster-name-check/test.toml
new file mode 100644
index 00000000000..8a4c4412163
--- /dev/null
+++ b/acceptance/localenv/cluster-name-check/test.toml
@@ -0,0 +1,31 @@
+Env.DATABRICKS_LOCALENV_CONSTRAINT_SOURCE_URL_TEST_OVERRIDE = "$DATABRICKS_HOST"
+# --cluster-name resolves the name to an ID via the Clusters API (which lists
+# clusters and matches on name), then resolves identically to --cluster-id.
+
+[[Server]]
+Pattern = "GET /api/2.1/clusters/list"
+Response.Body = '''
+{
+  "clusters": [
+    {"cluster_id": "cid-123", "cluster_name": "my-cluster", "spark_version": "15.4.x-scala2.12"},
+    {"cluster_id": "cid-999", "cluster_name": "other-cluster", "spark_version": "14.3.x-scala2.12"}
+  ]
+}
+'''
+
+[[Server]]
+Pattern = "GET /dbr/15.4.x-scala2.12/pyproject.toml"
+Response.Body = '''
+[project]
+requires-python = ">=3.11"
+
+[dependency-groups]
+dev = ["databricks-connect~=15.4.0"]
+
+[tool.uv]
+constraint-dependencies = ["pyarrow<19"]
+'''
+
+[[Repls]]
+Old = 'uv uv \S+(?: \([^)]+\))?'
+New = 'uv [UV_VERSION]'
diff --git a/acceptance/localenv/cluster-name-unknown/out.test.toml b/acceptance/localenv/cluster-name-unknown/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/localenv/cluster-name-unknown/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/localenv/cluster-name-unknown/output.txt b/acceptance/localenv/cluster-name-unknown/output.txt
new file mode 100644
index 00000000000..e6a46b095f1
--- /dev/null
+++ b/acceptance/localenv/cluster-name-unknown/output.txt
@@ -0,0 +1,5 @@
+✗ Setup failed while resolving your compute target.
+
+  resolving cluster name "nope": no active cluster named "nope"
+
+Re-run with --debug for details, or --output json for a structured report.
diff --git a/acceptance/localenv/cluster-name-unknown/script b/acceptance/localenv/cluster-name-unknown/script
new file mode 100644
index 00000000000..96ae54a868e
--- /dev/null
+++ b/acceptance/localenv/cluster-name-unknown/script
@@ -0,0 +1 @@
+musterr $CLI environments setup-local --cluster-name nope --dry-run
diff --git a/acceptance/localenv/cluster-name-unknown/test.toml b/acceptance/localenv/cluster-name-unknown/test.toml
new file mode 100644
index 00000000000..42f6ecc399e
--- /dev/null
+++ b/acceptance/localenv/cluster-name-unknown/test.toml
@@ -0,0 +1,15 @@
+Env.DATABRICKS_LOCALENV_CONSTRAINT_SOURCE_URL_TEST_OVERRIDE = "$DATABRICKS_HOST"
+# No active cluster matches the requested name, so name→ID resolution finds
+# nothing and errors as an actionable E_RESOLVE at the resolve phase. This is
+# the unknown-name counterpart to cluster-name-ambiguous; the two share the
+# single wrapping branch in GetClusterByName.
+
+[[Server]]
+Pattern = "GET /api/2.1/clusters/list"
+Response.Body = '''
+{
+  "clusters": [
+    {"cluster_id": "cid-123", "cluster_name": "my-cluster", "state": "RUNNING", "spark_version": "15.4.x-scala2.12"}
+  ]
+}
+'''
diff --git a/acceptance/localenv/cluster-stale-environment/out.test.toml b/acceptance/localenv/cluster-stale-environment/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/localenv/cluster-stale-environment/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/localenv/cluster-stale-environment/output.txt b/acceptance/localenv/cluster-stale-environment/output.txt
new file mode 100644
index 00000000000..64581495875
--- /dev/null
+++ b/acceptance/localenv/cluster-stale-environment/output.txt
@@ -0,0 +1,6 @@
+
+>>> [CLI] environments setup-local --cluster-name my-cluster --dry-run
+warning: [tool.databricks.environment] environment_version "5" is left from a serverless target but the current target is a cluster; it is not updated
+Plan: [TEST_TMP_DIR]/pyproject.toml
+  changed region: tool.uv.constraint-dependencies
+Check complete. No files were modified.
diff --git a/acceptance/localenv/cluster-stale-environment/script b/acceptance/localenv/cluster-stale-environment/script
new file mode 100644
index 00000000000..2aeb709898c
--- /dev/null
+++ b/acceptance/localenv/cluster-stale-environment/script
@@ -0,0 +1,15 @@
+# An existing project set up for serverless carries [tool.databricks.environment].
+# Re-running against a cluster target leaves it untouched but warns it is stale.
+cat > pyproject.toml <<'PY'
+[project]
+name = "demo"
+requires-python = ">=3.11"
+
+[dependency-groups]
+dev = ["databricks-connect~=15.4.0"]
+
+[tool.databricks.environment]
+environment_version = "5"
+PY
+
+trace $CLI environments setup-local --cluster-name my-cluster --dry-run
diff --git a/acceptance/localenv/cluster-stale-environment/test.toml b/acceptance/localenv/cluster-stale-environment/test.toml
new file mode 100644
index 00000000000..f37b69e24c5
--- /dev/null
+++ b/acceptance/localenv/cluster-stale-environment/test.toml
@@ -0,0 +1,33 @@
+# The script writes pyproject.toml as the merge input; --dry-run leaves it unchanged.
+Ignore = ["pyproject.toml"]
+
+Env.DATABRICKS_LOCALENV_CONSTRAINT_SOURCE_URL_TEST_OVERRIDE = "$DATABRICKS_HOST"
+# A cluster target does not manage [tool.databricks.environment], so a leftover
+# serverless environment_version is reported as stale.
+
+[[Server]]
+Pattern = "GET /api/2.1/clusters/list"
+Response.Body = '''
+{
+  "clusters": [
+    {"cluster_id": "cid-123", "cluster_name": "my-cluster", "spark_version": "15.4.x-scala2.12"}
+  ]
+}
+'''
+
+[[Server]]
+Pattern = "GET /dbr/15.4.x-scala2.12/pyproject.toml"
+Response.Body = '''
+[project]
+requires-python = ">=3.11"
+
+[dependency-groups]
+dev = ["databricks-connect~=15.4.0"]
+
+[tool.uv]
+constraint-dependencies = ["pyarrow<19"]
+'''
+
+[[Repls]]
+Old = 'uv uv \S+(?: \([^)]+\))?'
+New = 'uv [UV_VERSION]'
diff --git a/acceptance/localenv/constraints-only-existing/out.test.toml b/acceptance/localenv/constraints-only-existing/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/localenv/constraints-only-existing/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/localenv/constraints-only-existing/output.txt b/acceptance/localenv/constraints-only-existing/output.txt
new file mode 100644
index 00000000000..68d94ccc50e
--- /dev/null
+++ b/acceptance/localenv/constraints-only-existing/output.txt
@@ -0,0 +1,60 @@
+
+>>> [CLI] environments setup-local --serverless-version 4 --constraints-only --dry-run --output json
+Flag --constraints-only has been deprecated, use --no-dbconnect instead
+{
+  "schemaVersion": 1,
+  "command": "environments setup-local",
+  "ok": true,
+  "mode": "constraints-only",
+  "dryRun": true,
+  "compute": {
+    "source": "serverless",
+    "serverlessVersion": "v4",
+    "envKey": "serverless/serverless-v4"
+  },
+  "resolved": {
+    "pythonVersion": "3.12",
+    "artifactSource": "network"
+  },
+  "greenfield": false,
+  "plan": {
+    "wouldWrite": "[TEST_TMP_DIR]/pyproject.toml",
+    "wouldBackup": "[TEST_TMP_DIR]/pyproject.toml.bak",
+    "wouldInstallPython": "3.12",
+    "diff": "--- pyproject.toml\n+++ pyproject.toml.new\n@@ -1,8 +1,18 @@\n [project]\n name = \"demo\"\n-requires-python = \"\u003e=3.10\"\n+requires-python = \"\u003e=3.12\"\n dependencies = [\"databricks-connect==15.1.*\"]\n \n [dependency-groups]\n dev = [\"databricks-connect~=16.0\"]\n docs = [\"databricks-connect==15.0.0\"]\n+\n+[tool.databricks.environment]\n+environment_version = \"4\"\n+\n+# managed by databricks environments setup-local — do not edit\n+[tool.uv]\n+constraint-dependencies = [\n+    \"pyarrow\u003c19\",\n+]\n+# end managed by databricks environments setup-local\n"
+  },
+  "phases": [
+    {
+      "phase": "preflight",
+      "status": "ok"
+    },
+    {
+      "phase": "resolve",
+      "status": "ok"
+    },
+    {
+      "phase": "fetch",
+      "status": "ok"
+    },
+    {
+      "phase": "merge",
+      "status": "ok"
+    },
+    {
+      "phase": "provision",
+      "status": "ok"
+    },
+    {
+      "phase": "validate",
+      "status": "ok"
+    }
+  ],
+  "warnings": [
+    {
+      "code": "W_REQUIRES_PYTHON_OVERRIDDEN",
+      "message": "requires-python \"\u003e=3.10\" is replaced by the environment's \"\u003e=3.12\""
+    }
+  ],
+  "error": null,
+  "durationMs": [DURATION_MS]
+}
diff --git a/acceptance/localenv/constraints-only-existing/script b/acceptance/localenv/constraints-only-existing/script
new file mode 100644
index 00000000000..0ce45c47589
--- /dev/null
+++ b/acceptance/localenv/constraints-only-existing/script
@@ -0,0 +1,16 @@
+# --constraints-only omits databricks-connect entirely: no managed pin is inserted and
+# no stray is removed, so every databricks-connect requirement the user already had — in
+# [project].dependencies, dev, and a sibling group — is left byte-for-byte untouched. Only
+# requires-python and the [tool.uv] constraints are managed. The JSON diff shows this.
+cat > pyproject.toml <<'PY'
+[project]
+name = "demo"
+requires-python = ">=3.10"
+dependencies = ["databricks-connect==15.1.*"]
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0"]
+docs = ["databricks-connect==15.0.0"]
+PY
+
+trace $CLI environments setup-local --serverless-version 4 --constraints-only --dry-run --output json
diff --git a/acceptance/localenv/constraints-only-existing/test.toml b/acceptance/localenv/constraints-only-existing/test.toml
new file mode 100644
index 00000000000..9da015b178c
--- /dev/null
+++ b/acceptance/localenv/constraints-only-existing/test.toml
@@ -0,0 +1,21 @@
+# The script writes pyproject.toml as the merge input; --dry-run leaves it unchanged.
+Ignore = ["pyproject.toml"]
+
+Env.DATABRICKS_LOCALENV_CONSTRAINT_SOURCE_URL_TEST_OVERRIDE = "$DATABRICKS_HOST"
+
+[[Server]]
+Pattern = "GET /serverless/serverless-v4/pyproject.toml"
+Response.Body = '''
+[project]
+requires-python = ">=3.12"
+
+[dependency-groups]
+dev = ["databricks-connect~=17.2.0"]
+
+[tool.uv]
+constraint-dependencies = ["pyarrow<19"]
+'''
+
+[[Repls]]
+Old = 'uv uv \S+(?: \([^)]+\))?'
+New = 'uv [UV_VERSION]'
diff --git a/acceptance/localenv/constraints-only/out.test.toml b/acceptance/localenv/constraints-only/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/localenv/constraints-only/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/localenv/constraints-only/output.txt b/acceptance/localenv/constraints-only/output.txt
new file mode 100644
index 00000000000..efcd88fd74e
--- /dev/null
+++ b/acceptance/localenv/constraints-only/output.txt
@@ -0,0 +1,54 @@
+
+>>> [CLI] environments setup-local --serverless-version 4 --constraints-only --dry-run --output json
+Flag --constraints-only has been deprecated, use --no-dbconnect instead
+{
+  "schemaVersion": 1,
+  "command": "environments setup-local",
+  "ok": true,
+  "mode": "constraints-only",
+  "dryRun": true,
+  "compute": {
+    "source": "serverless",
+    "serverlessVersion": "v4",
+    "envKey": "serverless/serverless-v4"
+  },
+  "resolved": {
+    "pythonVersion": "3.12",
+    "artifactSource": "network"
+  },
+  "greenfield": true,
+  "plan": {
+    "wouldWrite": "[TEST_TMP_DIR]/pyproject.toml",
+    "wouldInstallPython": "3.12",
+    "diff": "--- pyproject.toml\n+++ pyproject.toml\n@@ -1 +1,18 @@\n+[project]\n+name = \"001\"\n+version = \"0.0.0\"\n+requires-python = \"\u003e=3.12\"\n+\n+[dependency-groups]\n+dev = []\n+\n+[tool.databricks.environment]\n+environment_version = \"4\"\n+\n+# managed by databricks environments setup-local — do not edit\n+[tool.uv]\n+constraint-dependencies = [\n+    \"pyarrow\u003c19\",\n+    \"pandas\u003c3\",\n+]\n+# end managed by databricks environments setup-local\n"
+  },
+  "phases": [
+    {
+      "phase": "preflight",
+      "status": "ok"
+    },
+    {
+      "phase": "resolve",
+      "status": "ok"
+    },
+    {
+      "phase": "fetch",
+      "status": "ok"
+    },
+    {
+      "phase": "merge",
+      "status": "ok"
+    },
+    {
+      "phase": "provision",
+      "status": "ok"
+    },
+    {
+      "phase": "validate",
+      "status": "ok"
+    }
+  ],
+  "warnings": [],
+  "error": null,
+  "durationMs": [DURATION_MS]
+}
diff --git a/acceptance/localenv/constraints-only/script b/acceptance/localenv/constraints-only/script
new file mode 100644
index 00000000000..b4f777e7980
--- /dev/null
+++ b/acceptance/localenv/constraints-only/script
@@ -0,0 +1 @@
+trace $CLI environments setup-local --serverless-version 4 --constraints-only --dry-run --output json
diff --git a/acceptance/localenv/constraints-only/test.toml b/acceptance/localenv/constraints-only/test.toml
new file mode 100644
index 00000000000..796a4b440b9
--- /dev/null
+++ b/acceptance/localenv/constraints-only/test.toml
@@ -0,0 +1,18 @@
+Env.DATABRICKS_LOCALENV_CONSTRAINT_SOURCE_URL_TEST_OVERRIDE = "$DATABRICKS_HOST"
+
+[[Server]]
+Pattern = "GET /serverless/serverless-v4/pyproject.toml"
+Response.Body = '''
+[project]
+requires-python = ">=3.12"
+
+[dependency-groups]
+dev = ["databricks-connect~=17.2.0"]
+
+[tool.uv]
+constraint-dependencies = ["pyarrow<19", "pandas<3"]
+'''
+
+[[Repls]]
+Old = 'uv uv \S+(?: \([^)]+\))?'
+New = 'uv [UV_VERSION]'
diff --git a/acceptance/localenv/dbconnect-compatible-kept-check/out.test.toml b/acceptance/localenv/dbconnect-compatible-kept-check/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/localenv/dbconnect-compatible-kept-check/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/localenv/dbconnect-compatible-kept-check/output.txt b/acceptance/localenv/dbconnect-compatible-kept-check/output.txt
new file mode 100644
index 00000000000..7b147c65964
--- /dev/null
+++ b/acceptance/localenv/dbconnect-compatible-kept-check/output.txt
@@ -0,0 +1,64 @@
+
+>>> [CLI] environments setup-local --serverless-version 4 --dry-run --output json
+{
+  "schemaVersion": 1,
+  "command": "environments setup-local",
+  "ok": true,
+  "mode": "default",
+  "dryRun": true,
+  "compute": {
+    "source": "serverless",
+    "serverlessVersion": "v4",
+    "envKey": "serverless/serverless-v4"
+  },
+  "resolved": {
+    "pythonVersion": "3.12",
+    "dbconnectVersion": "17.2.0",
+    "artifactSource": "network"
+  },
+  "greenfield": false,
+  "plan": {
+    "wouldWrite": "[TEST_TMP_DIR]/pyproject.toml",
+    "wouldBackup": "[TEST_TMP_DIR]/pyproject.toml.bak",
+    "wouldInstallPython": "3.12",
+    "diff": "--- pyproject.toml\n+++ pyproject.toml.new\n@@ -1,6 +1,6 @@\n [project]\n name = \"demo\"\n-requires-python = \"\u003e=3.10\"\n+requires-python = \"\u003e=3.12\"\n dependencies = [\n     \"databricks-connect\u003e=15\",\n     \"databricks-connect ; python_version \u003c '3.13'\",\n@@ -10,5 +10,14 @@\n extra = [\"databricks-connect\"]\n \n [dependency-groups]\n-dev = [\"databricks-connect~=16.0\"]\n+dev = [\"databricks-connect~=17.2.0\"]\n test = [\"databricks-connect\u003e=15,\u003c20\"]\n+\n+[tool.databricks.environment]\n+environment_version = \"4\"\n+\n+# managed by databricks environments setup-local — do not edit\n+[tool.uv]\n+constraint-dependencies = [\n+]\n+# end managed by databricks environments setup-local\n"
+  },
+  "phases": [
+    {
+      "phase": "preflight",
+      "status": "ok"
+    },
+    {
+      "phase": "resolve",
+      "status": "ok"
+    },
+    {
+      "phase": "fetch",
+      "status": "ok"
+    },
+    {
+      "phase": "merge",
+      "status": "ok"
+    },
+    {
+      "phase": "provision",
+      "status": "ok"
+    },
+    {
+      "phase": "validate",
+      "status": "ok"
+    }
+  ],
+  "warnings": [
+    {
+      "code": "W_REQUIRES_PYTHON_OVERRIDDEN",
+      "message": "requires-python \"\u003e=3.10\" is replaced by the environment's \"\u003e=3.12\""
+    },
+    {
+      "code": "W_DBCONNECT_PIN_OVERRIDDEN",
+      "message": "databricks-connect \"databricks-connect~=16.0\" is replaced by the environment's \"databricks-connect~=17.2.0\""
+    }
+  ],
+  "error": null,
+  "durationMs": [DURATION_MS]
+}
diff --git a/acceptance/localenv/dbconnect-compatible-kept-check/script b/acceptance/localenv/dbconnect-compatible-kept-check/script
new file mode 100644
index 00000000000..0d4aa45fa95
--- /dev/null
+++ b/acceptance/localenv/dbconnect-compatible-kept-check/script
@@ -0,0 +1,24 @@
+# Only a databricks-connect pin that provably cannot co-resolve with the managed
+# version (~=17.2.0) is removed. A pin that overlaps it (>=15), carries no version, or
+# is marker-gated resolves fine, so it is left in place — the merge does not silently
+# rewrite the user's declaration (including [project].dependencies wheel metadata) when
+# nothing is broken. The dry-run diff shows only requires-python and the dev pin change,
+# and no W_DBCONNECT_CONSOLIDATED warning is emitted.
+cat > pyproject.toml <<'PY'
+[project]
+name = "demo"
+requires-python = ">=3.10"
+dependencies = [
+    "databricks-connect>=15",
+    "databricks-connect ; python_version < '3.13'",
+]
+
+[project.optional-dependencies]
+extra = ["databricks-connect"]
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0"]
+test = ["databricks-connect>=15,<20"]
+PY
+
+trace $CLI environments setup-local --serverless-version 4 --dry-run --output json
diff --git a/acceptance/localenv/dbconnect-compatible-kept-check/test.toml b/acceptance/localenv/dbconnect-compatible-kept-check/test.toml
new file mode 100644
index 00000000000..1e28e633d7e
--- /dev/null
+++ b/acceptance/localenv/dbconnect-compatible-kept-check/test.toml
@@ -0,0 +1,21 @@
+# The script writes pyproject.toml as the merge input; --dry-run leaves it unchanged.
+Ignore = ["pyproject.toml"]
+
+Env.DATABRICKS_LOCALENV_CONSTRAINT_SOURCE_URL_TEST_OVERRIDE = "$DATABRICKS_HOST"
+
+[[Server]]
+Pattern = "GET /serverless/serverless-v4/pyproject.toml"
+Response.Body = '''
+[project]
+requires-python = ">=3.12"
+
+[dependency-groups]
+dev = ["databricks-connect~=17.2.0"]
+
+[tool.uv]
+constraint-dependencies = []
+'''
+
+[[Repls]]
+Old = 'uv uv \S+(?: \([^)]+\))?'
+New = 'uv [UV_VERSION]'
diff --git a/acceptance/localenv/dbconnect-consolidate-check/out.test.toml b/acceptance/localenv/dbconnect-consolidate-check/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/localenv/dbconnect-consolidate-check/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/localenv/dbconnect-consolidate-check/output.txt b/acceptance/localenv/dbconnect-consolidate-check/output.txt
new file mode 100644
index 00000000000..0e94ce0430e
--- /dev/null
+++ b/acceptance/localenv/dbconnect-consolidate-check/output.txt
@@ -0,0 +1,76 @@
+
+>>> [CLI] environments setup-local --serverless-version 4 --dry-run --output json
+{
+  "schemaVersion": 1,
+  "command": "environments setup-local",
+  "ok": true,
+  "mode": "default",
+  "dryRun": true,
+  "compute": {
+    "source": "serverless",
+    "serverlessVersion": "v4",
+    "envKey": "serverless/serverless-v4"
+  },
+  "resolved": {
+    "pythonVersion": "3.12",
+    "dbconnectVersion": "17.2.0",
+    "artifactSource": "network"
+  },
+  "greenfield": false,
+  "plan": {
+    "wouldWrite": "[TEST_TMP_DIR]/pyproject.toml",
+    "wouldBackup": "[TEST_TMP_DIR]/pyproject.toml.bak",
+    "wouldInstallPython": "3.12",
+    "diff": "--- pyproject.toml\n+++ pyproject.toml.new\n@@ -1,15 +1,23 @@\n [project]\n name = \"demo\"\n-requires-python = \"\u003e=3.10\"\n+requires-python = \"\u003e=3.12\"\n dependencies = [\n     \"databricks-dlt\",\n-    \"databricks-connect==15.1.*\",\n     \"pytest\",\n ]\n \n [project.optional-dependencies]\n-extra = [\"databricks-connect==14.0.0\"]\n+extra = []\n \n [dependency-groups]\n-dev = [\"databricks-connect~=16.0\"]\n-docs = [\"databricks-connect==15.0.0\"]\n+dev = [\"databricks-connect~=17.2.0\"]\n+docs = []\n+\n+[tool.databricks.environment]\n+environment_version = \"4\"\n+\n+# managed by databricks environments setup-local — do not edit\n+[tool.uv]\n+constraint-dependencies = [\n+]\n+# end managed by databricks environments setup-local\n"
+  },
+  "phases": [
+    {
+      "phase": "preflight",
+      "status": "ok"
+    },
+    {
+      "phase": "resolve",
+      "status": "ok"
+    },
+    {
+      "phase": "fetch",
+      "status": "ok"
+    },
+    {
+      "phase": "merge",
+      "status": "ok"
+    },
+    {
+      "phase": "provision",
+      "status": "ok"
+    },
+    {
+      "phase": "validate",
+      "status": "ok"
+    }
+  ],
+  "warnings": [
+    {
+      "code": "W_REQUIRES_PYTHON_OVERRIDDEN",
+      "message": "requires-python \"\u003e=3.10\" is replaced by the environment's \"\u003e=3.12\""
+    },
+    {
+      "code": "W_DBCONNECT_PIN_OVERRIDDEN",
+      "message": "databricks-connect \"databricks-connect~=16.0\" is replaced by the environment's \"databricks-connect~=17.2.0\""
+    },
+    {
+      "code": "W_DBCONNECT_CONSOLIDATED",
+      "message": "databricks-connect \"databricks-connect==15.1.*\" in [project].dependencies conflicts with the environment's \"databricks-connect~=17.2.0\" and is removed; it is managed in \"dev\""
+    },
+    {
+      "code": "W_DBCONNECT_CONSOLIDATED",
+      "message": "databricks-connect \"databricks-connect==14.0.0\" in [project.optional-dependencies].extra conflicts with the environment's \"databricks-connect~=17.2.0\" and is removed; it is managed in \"dev\""
+    },
+    {
+      "code": "W_DBCONNECT_CONSOLIDATED",
+      "message": "databricks-connect \"databricks-connect==15.0.0\" in [dependency-groups].docs conflicts with the environment's \"databricks-connect~=17.2.0\" and is removed; it is managed in \"dev\""
+    }
+  ],
+  "error": null,
+  "durationMs": [DURATION_MS]
+}
diff --git a/acceptance/localenv/dbconnect-consolidate-check/script b/acceptance/localenv/dbconnect-consolidate-check/script
new file mode 100644
index 00000000000..b809942455c
--- /dev/null
+++ b/acceptance/localenv/dbconnect-consolidate-check/script
@@ -0,0 +1,24 @@
+# Every stray databricks-connect pin here is disjoint from the managed version, so it
+# would make uv unsatisfiable and is removed — from [project].dependencies, an
+# optional-dependency extra, and another dependency group — leaving the single managed
+# pin in [dependency-groups].dev. The JSON diff shows each stray removed, with one
+# W_DBCONNECT_CONSOLIDATED warning per removed pin (in document order).
+cat > pyproject.toml <<'PY'
+[project]
+name = "demo"
+requires-python = ">=3.10"
+dependencies = [
+    "databricks-dlt",
+    "databricks-connect==15.1.*",
+    "pytest",
+]
+
+[project.optional-dependencies]
+extra = ["databricks-connect==14.0.0"]
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0"]
+docs = ["databricks-connect==15.0.0"]
+PY
+
+trace $CLI environments setup-local --serverless-version 4 --dry-run --output json
diff --git a/acceptance/localenv/dbconnect-consolidate-check/test.toml b/acceptance/localenv/dbconnect-consolidate-check/test.toml
new file mode 100644
index 00000000000..1e28e633d7e
--- /dev/null
+++ b/acceptance/localenv/dbconnect-consolidate-check/test.toml
@@ -0,0 +1,21 @@
+# The script writes pyproject.toml as the merge input; --dry-run leaves it unchanged.
+Ignore = ["pyproject.toml"]
+
+Env.DATABRICKS_LOCALENV_CONSTRAINT_SOURCE_URL_TEST_OVERRIDE = "$DATABRICKS_HOST"
+
+[[Server]]
+Pattern = "GET /serverless/serverless-v4/pyproject.toml"
+Response.Body = '''
+[project]
+requires-python = ">=3.12"
+
+[dependency-groups]
+dev = ["databricks-connect~=17.2.0"]
+
+[tool.uv]
+constraint-dependencies = []
+'''
+
+[[Repls]]
+Old = 'uv uv \S+(?: \([^)]+\))?'
+New = 'uv [UV_VERSION]'
diff --git a/acceptance/localenv/env-unsupported/out.test.toml b/acceptance/localenv/env-unsupported/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/localenv/env-unsupported/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/localenv/env-unsupported/output.txt b/acceptance/localenv/env-unsupported/output.txt
new file mode 100644
index 00000000000..5ca221a1759
--- /dev/null
+++ b/acceptance/localenv/env-unsupported/output.txt
@@ -0,0 +1,5 @@
+✗ Setup failed while fetching constraints.
+
+  no published environment for "dbr/15.4.x-scala2.12". If this is a new runtime, try the latest LTS target (e.g. --serverless-version 5 or a supported --cluster-id DBR): GET [DATABRICKS_URL]/dbr/15.4.x-scala2.12/pyproject.toml: environment key not found
+
+Re-run with --debug for details, or --output json for a structured report.
diff --git a/acceptance/localenv/env-unsupported/script b/acceptance/localenv/env-unsupported/script
new file mode 100644
index 00000000000..6a84cf8172e
--- /dev/null
+++ b/acceptance/localenv/env-unsupported/script
@@ -0,0 +1 @@
+musterr $CLI environments setup-local --cluster-id test-cluster-id --dry-run
diff --git a/acceptance/localenv/env-unsupported/test.toml b/acceptance/localenv/env-unsupported/test.toml
new file mode 100644
index 00000000000..7871d549f9d
--- /dev/null
+++ b/acceptance/localenv/env-unsupported/test.toml
@@ -0,0 +1,19 @@
+Env.DATABRICKS_LOCALENV_CONSTRAINT_SOURCE_URL_TEST_OVERRIDE = "$DATABRICKS_HOST"
+
+[[Server]]
+Pattern = "GET /api/2.1/clusters/get"
+Response.Body = '''
+{
+  "cluster_id": "test-cluster-id",
+  "spark_version": "15.4.x-scala2.12"
+}
+'''
+
+[[Server]]
+Pattern = "GET /dbr/15.4.x-scala2.12/pyproject.toml"
+Response.StatusCode = 404
+Response.Body = '{"message": "Not found"}'
+
+[[Repls]]
+Old = 'uv uv \S+(?: \([^)]+\))?'
+New = 'uv [UV_VERSION]'
diff --git a/acceptance/localenv/flag-conflict-json/out.test.toml b/acceptance/localenv/flag-conflict-json/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/localenv/flag-conflict-json/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/localenv/flag-conflict-json/output.txt b/acceptance/localenv/flag-conflict-json/output.txt
new file mode 100644
index 00000000000..5090f47dd70
--- /dev/null
+++ b/acceptance/localenv/flag-conflict-json/output.txt
@@ -0,0 +1,42 @@
+{
+  "schemaVersion": 1,
+  "command": "environments setup-local",
+  "ok": false,
+  "mode": "default",
+  "dryRun": false,
+  "greenfield": false,
+  "phases": [
+    {
+      "phase": "preflight",
+      "status": "error"
+    },
+    {
+      "phase": "resolve",
+      "status": "pending"
+    },
+    {
+      "phase": "fetch",
+      "status": "pending"
+    },
+    {
+      "phase": "merge",
+      "status": "pending"
+    },
+    {
+      "phase": "provision",
+      "status": "pending"
+    },
+    {
+      "phase": "validate",
+      "status": "pending"
+    }
+  ],
+  "warnings": [],
+  "error": {
+    "code": "E_USAGE",
+    "failurePhase": "preflight",
+    "message": "invalid compute target flags: flags --cluster-id and --serverless-version are mutually exclusive; specify at most one",
+    "diskMutated": false
+  },
+  "durationMs": [DURATION_MS]
+}
diff --git a/acceptance/localenv/flag-conflict-json/script b/acceptance/localenv/flag-conflict-json/script
new file mode 100644
index 00000000000..408aae874bd
--- /dev/null
+++ b/acceptance/localenv/flag-conflict-json/script
@@ -0,0 +1 @@
+musterr $CLI environments setup-local --cluster-id abc --serverless-version 4 --output json
diff --git a/acceptance/localenv/flag-conflict/out.test.toml b/acceptance/localenv/flag-conflict/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/localenv/flag-conflict/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/localenv/flag-conflict/output.txt b/acceptance/localenv/flag-conflict/output.txt
new file mode 100644
index 00000000000..e455d9e9f11
--- /dev/null
+++ b/acceptance/localenv/flag-conflict/output.txt
@@ -0,0 +1,5 @@
+✗ Setup failed during preflight checks.
+
+  invalid compute target flags: flags --cluster-id and --serverless-version are mutually exclusive; specify at most one
+
+Re-run with --debug for details, or --output json for a structured report.
diff --git a/acceptance/localenv/flag-conflict/script b/acceptance/localenv/flag-conflict/script
new file mode 100644
index 00000000000..b251350e3c4
--- /dev/null
+++ b/acceptance/localenv/flag-conflict/script
@@ -0,0 +1 @@
+musterr $CLI environments setup-local --cluster-id abc --serverless-version 4
diff --git a/acceptance/localenv/group-help/out.test.toml b/acceptance/localenv/group-help/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/localenv/group-help/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/localenv/group-help/output.txt b/acceptance/localenv/group-help/output.txt
new file mode 100644
index 00000000000..e30c8f1b415
--- /dev/null
+++ b/acceptance/localenv/group-help/output.txt
@@ -0,0 +1,3 @@
+
+>>> [CLI] environments --help
+  setup-local                               Set up a local Python environment that matches your Databricks compute
diff --git a/acceptance/localenv/group-help/script b/acceptance/localenv/group-help/script
new file mode 100644
index 00000000000..998e35aa2db
--- /dev/null
+++ b/acceptance/localenv/group-help/script
@@ -0,0 +1,5 @@
+# Assert setup-local is now listed under the generated environments group (the
+# visibility this PR unveils). Grep a single line rather than snapshotting the
+# whole group help, which also lists generated API subcommands that churn on
+# SDK regen.
+trace $CLI environments --help | grep setup-local
diff --git a/acceptance/localenv/help/out.test.toml b/acceptance/localenv/help/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/localenv/help/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/localenv/help/output.txt b/acceptance/localenv/help/output.txt
new file mode 100644
index 00000000000..836ebb00d41
--- /dev/null
+++ b/acceptance/localenv/help/output.txt
@@ -0,0 +1,36 @@
+Set up a local Python environment that matches a Databricks cluster or serverless version, so code you run on your machine behaves the same as it does on Databricks.
+
+Use this when you want to develop or debug a Databricks project locally: it installs the matching Python version and a compatible databricks-connect, and pins your dependencies to versions known to work with your chosen compute. It creates or updates a .venv (managed by uv) in the current directory and records the setup in pyproject.toml, leaving the rest of your project untouched.
+
+In a uv workspace member, the command uses the shared .venv at the workspace root and writes the dependency constraints to the root pyproject.toml, because uv reads them only from there. uv sync installs the current member's dependencies into the shared .venv and removes packages that only other members need. All members share one environment, so they must target compatible compute.
+
+If UV_PROJECT_ENVIRONMENT is set, the command uses that environment instead of .venv, as uv does.
+
+Usage:
+  databricks environments setup-local [flags]
+
+Examples:
+  # Match a serverless version
+  databricks environments setup-local --serverless-version 5
+
+  # Match an existing cluster by name
+  databricks environments setup-local --cluster-name my-cluster
+
+  # See what would change without writing anything
+  databricks environments setup-local --serverless-version 5 --dry-run
+
+Flags:
+      --cluster-id string           cluster ID to use as the compute target
+      --cluster-name string         cluster name to use as the compute target (resolved to an ID via the Clusters API)
+      --dry-run                     compute the plan without writing files or provisioning
+  -h, --help                        help for setup-local
+      --job-task string             job task to use as the compute target, as <job-id>.<task-key> (the task key is required)
+      --no-constraints              skip writing the remote Python version and dependency constraints
+      --no-dbconnect                skip adding the databricks-connect dependency
+      --serverless-version string   serverless version to use as the compute target (e.g. 5)
+
+Global Flags:
+      --debug            enable debug logging
+  -o, --output type      output type: text or json (default text)
+  -p, --profile string   ~/.databrickscfg profile
+  -t, --target string    bundle target to use (if applicable)
diff --git a/acceptance/localenv/help/script b/acceptance/localenv/help/script
new file mode 100644
index 00000000000..d8c393d010a
--- /dev/null
+++ b/acceptance/localenv/help/script
@@ -0,0 +1 @@
+$CLI environments setup-local --help
diff --git a/acceptance/localenv/job-classic-check/out.test.toml b/acceptance/localenv/job-classic-check/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/localenv/job-classic-check/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/localenv/job-classic-check/output.txt b/acceptance/localenv/job-classic-check/output.txt
new file mode 100644
index 00000000000..d42991e5e03
--- /dev/null
+++ b/acceptance/localenv/job-classic-check/output.txt
@@ -0,0 +1,7 @@
+
+>>> [CLI] environments setup-local --job-task 12345.ingest --dry-run
+Plan: [TEST_TMP_DIR]/pyproject.toml
+  changed region: requires-python
+  changed region: tool.uv.constraint-dependencies
+  changed region: databricks-connect
+Check complete. No files were modified.
diff --git a/acceptance/localenv/job-classic-check/script b/acceptance/localenv/job-classic-check/script
new file mode 100644
index 00000000000..c7c56c97f7b
--- /dev/null
+++ b/acceptance/localenv/job-classic-check/script
@@ -0,0 +1 @@
+trace $CLI environments setup-local --job-task 12345.ingest --dry-run
diff --git a/acceptance/localenv/job-classic-check/test.toml b/acceptance/localenv/job-classic-check/test.toml
new file mode 100644
index 00000000000..2423387cff8
--- /dev/null
+++ b/acceptance/localenv/job-classic-check/test.toml
@@ -0,0 +1,34 @@
+Env.DATABRICKS_LOCALENV_CONSTRAINT_SOURCE_URL_TEST_OVERRIDE = "$DATABRICKS_HOST"
+# A classic task carries its own new_cluster, so --job-task <id>.<task-key>
+# resolves to that cluster's DBR-derived environment key.
+
+[[Server]]
+Pattern = "GET /api/2.2/jobs/get"
+Response.Body = '''
+{
+  "job_id": 12345,
+  "settings": {
+    "name": "classic-job",
+    "tasks": [
+      {"task_key": "ingest", "new_cluster": {"spark_version": "15.4.x-scala2.12", "num_workers": 1}}
+    ]
+  }
+}
+'''
+
+[[Server]]
+Pattern = "GET /dbr/15.4.x-scala2.12/pyproject.toml"
+Response.Body = '''
+[project]
+requires-python = ">=3.11"
+
+[dependency-groups]
+dev = ["databricks-connect~=15.4.0"]
+
+[tool.uv]
+constraint-dependencies = ["pyarrow<19"]
+'''
+
+[[Repls]]
+Old = 'uv uv \S+(?: \([^)]+\))?'
+New = 'uv [UV_VERSION]'
diff --git a/acceptance/localenv/job-serverless-check/out.test.toml b/acceptance/localenv/job-serverless-check/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/localenv/job-serverless-check/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/localenv/job-serverless-check/output.txt b/acceptance/localenv/job-serverless-check/output.txt
new file mode 100644
index 00000000000..1abe7d22d77
--- /dev/null
+++ b/acceptance/localenv/job-serverless-check/output.txt
@@ -0,0 +1,8 @@
+
+>>> [CLI] environments setup-local --job-task 12345.transform --dry-run
+Plan: [TEST_TMP_DIR]/pyproject.toml
+  changed region: requires-python
+  changed region: tool.uv.constraint-dependencies
+  changed region: databricks-connect
+  changed region: tool.databricks.environment
+Check complete. No files were modified.
diff --git a/acceptance/localenv/job-serverless-check/script b/acceptance/localenv/job-serverless-check/script
new file mode 100644
index 00000000000..572709bfadf
--- /dev/null
+++ b/acceptance/localenv/job-serverless-check/script
@@ -0,0 +1 @@
+trace $CLI environments setup-local --job-task 12345.transform --dry-run
diff --git a/acceptance/localenv/job-serverless-check/test.toml b/acceptance/localenv/job-serverless-check/test.toml
new file mode 100644
index 00000000000..ea51d7a5f73
--- /dev/null
+++ b/acceptance/localenv/job-serverless-check/test.toml
@@ -0,0 +1,38 @@
+Env.DATABRICKS_LOCALENV_CONSTRAINT_SOURCE_URL_TEST_OVERRIDE = "$DATABRICKS_HOST"
+# A serverless task binds an environment_key to one of the job's environments;
+# that environment pins the version, so --job-task <id>.<task-key> resolves to
+# the matching serverless-vN (here v3) directly — no default fallback.
+
+[[Server]]
+Pattern = "GET /api/2.2/jobs/get"
+Response.Body = '''
+{
+  "job_id": 12345,
+  "settings": {
+    "name": "serverless-job",
+    "tasks": [
+      {"task_key": "transform", "environment_key": "default"}
+    ],
+    "environments": [
+      {"environment_key": "default", "spec": {"environment_version": "3"}}
+    ]
+  }
+}
+'''
+
+[[Server]]
+Pattern = "GET /serverless/serverless-v3/pyproject.toml"
+Response.Body = '''
+[project]
+requires-python = ">=3.11"
+
+[dependency-groups]
+dev = ["databricks-connect~=15.4.0"]
+
+[tool.uv]
+constraint-dependencies = ["pyarrow<19"]
+'''
+
+[[Repls]]
+Old = 'uv uv \S+(?: \([^)]+\))?'
+New = 'uv [UV_VERSION]'
diff --git a/acceptance/localenv/job-task-foreach/out.test.toml b/acceptance/localenv/job-task-foreach/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/localenv/job-task-foreach/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/localenv/job-task-foreach/output.txt b/acceptance/localenv/job-task-foreach/output.txt
new file mode 100644
index 00000000000..760ddc579ea
--- /dev/null
+++ b/acceptance/localenv/job-task-foreach/output.txt
@@ -0,0 +1,8 @@
+
+>>> [CLI] environments setup-local --job-task 12345.fanout --dry-run
+Plan: [TEST_TMP_DIR]/pyproject.toml
+  changed region: requires-python
+  changed region: tool.uv.constraint-dependencies
+  changed region: databricks-connect
+  changed region: tool.databricks.environment
+Check complete. No files were modified.
diff --git a/acceptance/localenv/job-task-foreach/script b/acceptance/localenv/job-task-foreach/script
new file mode 100644
index 00000000000..46ed21b157e
--- /dev/null
+++ b/acceptance/localenv/job-task-foreach/script
@@ -0,0 +1 @@
+trace $CLI environments setup-local --job-task 12345.fanout --dry-run
diff --git a/acceptance/localenv/job-task-foreach/test.toml b/acceptance/localenv/job-task-foreach/test.toml
new file mode 100644
index 00000000000..2be79e6bd9b
--- /dev/null
+++ b/acceptance/localenv/job-task-foreach/test.toml
@@ -0,0 +1,44 @@
+Env.DATABRICKS_LOCALENV_CONSTRAINT_SOURCE_URL_TEST_OVERRIDE = "$DATABRICKS_HOST"
+# A for_each_task wraps the real per-iteration task; its compute lives on the
+# nested task. --job-task resolves against that nested task (here a serverless
+# environment binding), not the empty outer wrapper.
+
+[[Server]]
+Pattern = "GET /api/2.2/jobs/get"
+Response.Body = '''
+{
+  "job_id": 12345,
+  "settings": {
+    "name": "foreach-job",
+    "tasks": [
+      {
+        "task_key": "fanout",
+        "for_each_task": {
+          "inputs": "[1,2,3]",
+          "task": {"task_key": "inner", "environment_key": "default"}
+        }
+      }
+    ],
+    "environments": [
+      {"environment_key": "default", "spec": {"environment_version": "3"}}
+    ]
+  }
+}
+'''
+
+[[Server]]
+Pattern = "GET /serverless/serverless-v3/pyproject.toml"
+Response.Body = '''
+[project]
+requires-python = ">=3.11"
+
+[dependency-groups]
+dev = ["databricks-connect~=15.4.0"]
+
+[tool.uv]
+constraint-dependencies = ["pyarrow<19"]
+'''
+
+[[Repls]]
+Old = 'uv uv \S+(?: \([^)]+\))?'
+New = 'uv [UV_VERSION]'
diff --git a/acceptance/localenv/job-task-jobcluster/out.test.toml b/acceptance/localenv/job-task-jobcluster/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/localenv/job-task-jobcluster/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/localenv/job-task-jobcluster/output.txt b/acceptance/localenv/job-task-jobcluster/output.txt
new file mode 100644
index 00000000000..d42991e5e03
--- /dev/null
+++ b/acceptance/localenv/job-task-jobcluster/output.txt
@@ -0,0 +1,7 @@
+
+>>> [CLI] environments setup-local --job-task 12345.ingest --dry-run
+Plan: [TEST_TMP_DIR]/pyproject.toml
+  changed region: requires-python
+  changed region: tool.uv.constraint-dependencies
+  changed region: databricks-connect
+Check complete. No files were modified.
diff --git a/acceptance/localenv/job-task-jobcluster/script b/acceptance/localenv/job-task-jobcluster/script
new file mode 100644
index 00000000000..c7c56c97f7b
--- /dev/null
+++ b/acceptance/localenv/job-task-jobcluster/script
@@ -0,0 +1 @@
+trace $CLI environments setup-local --job-task 12345.ingest --dry-run
diff --git a/acceptance/localenv/job-task-jobcluster/test.toml b/acceptance/localenv/job-task-jobcluster/test.toml
new file mode 100644
index 00000000000..b6d4bb30b2f
--- /dev/null
+++ b/acceptance/localenv/job-task-jobcluster/test.toml
@@ -0,0 +1,38 @@
+Env.DATABRICKS_LOCALENV_CONSTRAINT_SOURCE_URL_TEST_OVERRIDE = "$DATABRICKS_HOST"
+# A classic task references a shared job cluster by job_cluster_key (rather than
+# an inline new_cluster), so --job-task resolves the version from the job's
+# job_clusters entry.
+
+[[Server]]
+Pattern = "GET /api/2.2/jobs/get"
+Response.Body = '''
+{
+  "job_id": 12345,
+  "settings": {
+    "name": "jobcluster-job",
+    "tasks": [
+      {"task_key": "ingest", "job_cluster_key": "shared"}
+    ],
+    "job_clusters": [
+      {"job_cluster_key": "shared", "new_cluster": {"spark_version": "15.4.x-scala2.12", "num_workers": 1}}
+    ]
+  }
+}
+'''
+
+[[Server]]
+Pattern = "GET /dbr/15.4.x-scala2.12/pyproject.toml"
+Response.Body = '''
+[project]
+requires-python = ">=3.11"
+
+[dependency-groups]
+dev = ["databricks-connect~=15.4.0"]
+
+[tool.uv]
+constraint-dependencies = ["pyarrow<19"]
+'''
+
+[[Repls]]
+Old = 'uv uv \S+(?: \([^)]+\))?'
+New = 'uv [UV_VERSION]'
diff --git a/acceptance/localenv/job-task-missing-key/out.test.toml b/acceptance/localenv/job-task-missing-key/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/localenv/job-task-missing-key/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/localenv/job-task-missing-key/output.txt b/acceptance/localenv/job-task-missing-key/output.txt
new file mode 100644
index 00000000000..bf8ded1bfe5
--- /dev/null
+++ b/acceptance/localenv/job-task-missing-key/output.txt
@@ -0,0 +1,5 @@
+✗ Setup failed while resolving your compute target.
+
+  specify a job task: job 12345 has multiple tasks; specify one: --job-task 12345.<task-key> (available: ingest, transform)
+
+Re-run with --debug for details, or --output json for a structured report.
diff --git a/acceptance/localenv/job-task-missing-key/script b/acceptance/localenv/job-task-missing-key/script
new file mode 100644
index 00000000000..266ee6163aa
--- /dev/null
+++ b/acceptance/localenv/job-task-missing-key/script
@@ -0,0 +1 @@
+musterr $CLI environments setup-local --job-task 12345 --dry-run
diff --git a/acceptance/localenv/job-task-missing-key/test.toml b/acceptance/localenv/job-task-missing-key/test.toml
new file mode 100644
index 00000000000..483f31774f2
--- /dev/null
+++ b/acceptance/localenv/job-task-missing-key/test.toml
@@ -0,0 +1,23 @@
+Env.DATABRICKS_LOCALENV_CONSTRAINT_SOURCE_URL_TEST_OVERRIDE = "$DATABRICKS_HOST"
+# A bare --job-task <job-id> (no .<task-key>) is a usage error: a job can bind
+# tasks to different environment versions, so the CLI will not guess which one.
+# The error lists the job's task keys. Reported as E_USAGE at the resolve phase.
+
+[[Server]]
+Pattern = "GET /api/2.2/jobs/get"
+Response.Body = '''
+{
+  "job_id": 12345,
+  "settings": {
+    "name": "multi-task-job",
+    "tasks": [
+      {"task_key": "ingest", "environment_key": "e1"},
+      {"task_key": "transform", "environment_key": "e2"}
+    ],
+    "environments": [
+      {"environment_key": "e1", "spec": {"environment_version": "3"}},
+      {"environment_key": "e2", "spec": {"environment_version": "4"}}
+    ]
+  }
+}
+'''
diff --git a/acceptance/localenv/job-task-unknown/out.test.toml b/acceptance/localenv/job-task-unknown/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/localenv/job-task-unknown/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/localenv/job-task-unknown/output.txt b/acceptance/localenv/job-task-unknown/output.txt
new file mode 100644
index 00000000000..538d8750beb
--- /dev/null
+++ b/acceptance/localenv/job-task-unknown/output.txt
@@ -0,0 +1,5 @@
+✗ Setup failed while resolving your compute target.
+
+  resolving job task 12345.nope: job 12345 has no task "nope" (available: ingest)
+
+Re-run with --debug for details, or --output json for a structured report.
diff --git a/acceptance/localenv/job-task-unknown/script b/acceptance/localenv/job-task-unknown/script
new file mode 100644
index 00000000000..6d43be42211
--- /dev/null
+++ b/acceptance/localenv/job-task-unknown/script
@@ -0,0 +1 @@
+musterr $CLI environments setup-local --job-task 12345.nope --dry-run
diff --git a/acceptance/localenv/job-task-unknown/test.toml b/acceptance/localenv/job-task-unknown/test.toml
new file mode 100644
index 00000000000..8cdaa86eda6
--- /dev/null
+++ b/acceptance/localenv/job-task-unknown/test.toml
@@ -0,0 +1,20 @@
+Env.DATABRICKS_LOCALENV_CONSTRAINT_SOURCE_URL_TEST_OVERRIDE = "$DATABRICKS_HOST"
+# A --job-task naming a task key that the job does not define fails at resolve
+# (E_RESOLVE); the message lists the job's actual task keys.
+
+[[Server]]
+Pattern = "GET /api/2.2/jobs/get"
+Response.Body = '''
+{
+  "job_id": 12345,
+  "settings": {
+    "name": "job-with-tasks",
+    "tasks": [
+      {"task_key": "ingest", "environment_key": "default"}
+    ],
+    "environments": [
+      {"environment_key": "default", "spec": {"environment_version": "3"}}
+    ]
+  }
+}
+'''
diff --git a/acceptance/localenv/job-task-unpinned/out.test.toml b/acceptance/localenv/job-task-unpinned/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/localenv/job-task-unpinned/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/localenv/job-task-unpinned/output.txt b/acceptance/localenv/job-task-unpinned/output.txt
new file mode 100644
index 00000000000..6b2ca8503c2
--- /dev/null
+++ b/acceptance/localenv/job-task-unpinned/output.txt
@@ -0,0 +1,5 @@
+✗ Setup failed while resolving your compute target.
+
+  resolving job task 12345.transform: task "transform" of job 12345 binds environment "default", which records no environment version
+
+Re-run with --debug for details, or --output json for a structured report.
diff --git a/acceptance/localenv/job-task-unpinned/script b/acceptance/localenv/job-task-unpinned/script
new file mode 100644
index 00000000000..6bec20c0289
--- /dev/null
+++ b/acceptance/localenv/job-task-unpinned/script
@@ -0,0 +1 @@
+musterr $CLI environments setup-local --job-task 12345.transform --dry-run
diff --git a/acceptance/localenv/job-task-unpinned/test.toml b/acceptance/localenv/job-task-unpinned/test.toml
new file mode 100644
index 00000000000..9b28b212fd6
--- /dev/null
+++ b/acceptance/localenv/job-task-unpinned/test.toml
@@ -0,0 +1,22 @@
+Env.DATABRICKS_LOCALENV_CONSTRAINT_SOURCE_URL_TEST_OVERRIDE = "$DATABRICKS_HOST"
+# A task whose bound serverless environment records no version cannot be resolved:
+# the job-task path reads the version directly and never falls back to a default
+# (the serverless-vN fallback applies only to the bundle-target path). Fails at
+# resolve (E_RESOLVE); nothing is fetched.
+
+[[Server]]
+Pattern = "GET /api/2.2/jobs/get"
+Response.Body = '''
+{
+  "job_id": 12345,
+  "settings": {
+    "name": "serverless-job-unpinned",
+    "tasks": [
+      {"task_key": "transform", "environment_key": "default"}
+    ],
+    "environments": [
+      {"environment_key": "default", "spec": {}}
+    ]
+  }
+}
+'''
diff --git a/acceptance/localenv/json-error/out.test.toml b/acceptance/localenv/json-error/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/localenv/json-error/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/localenv/json-error/output.txt b/acceptance/localenv/json-error/output.txt
new file mode 100644
index 00000000000..7ea96c75f2d
--- /dev/null
+++ b/acceptance/localenv/json-error/output.txt
@@ -0,0 +1,42 @@
+{
+  "schemaVersion": 1,
+  "command": "environments setup-local",
+  "ok": false,
+  "mode": "default",
+  "dryRun": false,
+  "greenfield": false,
+  "phases": [
+    {
+      "phase": "preflight",
+      "status": "ok"
+    },
+    {
+      "phase": "resolve",
+      "status": "error"
+    },
+    {
+      "phase": "fetch",
+      "status": "pending"
+    },
+    {
+      "phase": "merge",
+      "status": "pending"
+    },
+    {
+      "phase": "provision",
+      "status": "pending"
+    },
+    {
+      "phase": "validate",
+      "status": "pending"
+    }
+  ],
+  "warnings": [],
+  "error": {
+    "code": "E_NO_TARGET",
+    "failurePhase": "resolve",
+    "message": "No compute target is selected. Select a cluster or serverless target, or pass --cluster-id / --cluster-name / --serverless-version / --job-task",
+    "diskMutated": false
+  },
+  "durationMs": [DURATION_MS]
+}
diff --git a/acceptance/localenv/json-error/script b/acceptance/localenv/json-error/script
new file mode 100644
index 00000000000..fc3931eadd5
--- /dev/null
+++ b/acceptance/localenv/json-error/script
@@ -0,0 +1 @@
+musterr $CLI environments setup-local --output json
diff --git a/acceptance/localenv/json-error/test.toml b/acceptance/localenv/json-error/test.toml
new file mode 100644
index 00000000000..7850e09c2dc
--- /dev/null
+++ b/acceptance/localenv/json-error/test.toml
@@ -0,0 +1,3 @@
+[[Repls]]
+Old = 'uv uv \S+(?: \([^)]+\))?'
+New = 'uv [UV_VERSION]'
diff --git a/acceptance/localenv/manager-unsupported/environment.yml b/acceptance/localenv/manager-unsupported/environment.yml
new file mode 100644
index 00000000000..d5364e4706f
--- /dev/null
+++ b/acceptance/localenv/manager-unsupported/environment.yml
@@ -0,0 +1,3 @@
+name: demo
+dependencies:
+  - python=3.10
diff --git a/acceptance/localenv/manager-unsupported/out.test.toml b/acceptance/localenv/manager-unsupported/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/localenv/manager-unsupported/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/localenv/manager-unsupported/output.txt b/acceptance/localenv/manager-unsupported/output.txt
new file mode 100644
index 00000000000..35fd6659ad3
--- /dev/null
+++ b/acceptance/localenv/manager-unsupported/output.txt
@@ -0,0 +1,5 @@
+✗ Setup failed during preflight checks.
+
+  detected a conda project; automated setup for conda is not yet available (P1). Use a uv project (add a pyproject.toml with a [tool.uv] table, or run `uv init`) to provision automatically
+
+Re-run with --debug for details, or --output json for a structured report.
diff --git a/acceptance/localenv/manager-unsupported/script b/acceptance/localenv/manager-unsupported/script
new file mode 100644
index 00000000000..f7a1e15df54
--- /dev/null
+++ b/acceptance/localenv/manager-unsupported/script
@@ -0,0 +1 @@
+musterr $CLI environments setup-local --serverless-version 4 --dry-run
diff --git a/acceptance/localenv/manager-unsupported/test.toml b/acceptance/localenv/manager-unsupported/test.toml
new file mode 100644
index 00000000000..7850e09c2dc
--- /dev/null
+++ b/acceptance/localenv/manager-unsupported/test.toml
@@ -0,0 +1,3 @@
+[[Repls]]
+Old = 'uv uv \S+(?: \([^)]+\))?'
+New = 'uv [UV_VERSION]'
diff --git a/acceptance/localenv/merge-warnings-json/out.test.toml b/acceptance/localenv/merge-warnings-json/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/localenv/merge-warnings-json/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/localenv/merge-warnings-json/output.txt b/acceptance/localenv/merge-warnings-json/output.txt
new file mode 100644
index 00000000000..c5d7333eb4e
--- /dev/null
+++ b/acceptance/localenv/merge-warnings-json/output.txt
@@ -0,0 +1,80 @@
+
+>>> [CLI] environments setup-local --serverless-version 4 --dry-run --output json
+{
+  "schemaVersion": 1,
+  "command": "environments setup-local",
+  "ok": true,
+  "mode": "default",
+  "dryRun": true,
+  "compute": {
+    "source": "serverless",
+    "serverlessVersion": "v4",
+    "envKey": "serverless/serverless-v4"
+  },
+  "resolved": {
+    "pythonVersion": "3.12",
+    "dbconnectVersion": "17.2.0",
+    "artifactSource": "network"
+  },
+  "greenfield": false,
+  "plan": {
+    "wouldWrite": "[TEST_TMP_DIR]/pyproject.toml",
+    "wouldBackup": "[TEST_TMP_DIR]/pyproject.toml.bak",
+    "wouldInstallPython": "3.12",
+    "diff": "--- pyproject.toml\n+++ pyproject.toml.new\n@@ -1,9 +1,20 @@\n [project]\n name = \"demo\"\n-requires-python = \"\u003e=3.10\"\n+requires-python = \"\u003e=3.12\"\n dependencies = [\"pyarrow==21.0.0\", \"pyspark\u003e=3.5.0\"]\n \n [dependency-groups]\n-dev = [\"databricks-connect~=16.0.0\", {include-group = \"spark\"}]\n-spark = [\"databricks-connect==15.0.0\"]\n+dev = [\"databricks-connect~=17.2.0\", {include-group = \"spark\"}]\n+spark = []\n qa = [\"pandas==4.0.0\"]\n+\n+[tool.databricks.environment]\n+environment_version = \"4\"\n+\n+# managed by databricks environments setup-local — do not edit\n+[tool.uv]\n+constraint-dependencies = [\n+    \"pyarrow\u003c19\",\n+    \"pandas\u003c3\",\n+]\n+# end managed by databricks environments setup-local\n"
+  },
+  "phases": [
+    {
+      "phase": "preflight",
+      "status": "ok"
+    },
+    {
+      "phase": "resolve",
+      "status": "ok"
+    },
+    {
+      "phase": "fetch",
+      "status": "ok"
+    },
+    {
+      "phase": "merge",
+      "status": "ok"
+    },
+    {
+      "phase": "provision",
+      "status": "ok"
+    },
+    {
+      "phase": "validate",
+      "status": "ok"
+    }
+  ],
+  "warnings": [
+    {
+      "code": "W_REQUIRES_PYTHON_OVERRIDDEN",
+      "message": "requires-python \"\u003e=3.10\" is replaced by the environment's \"\u003e=3.12\""
+    },
+    {
+      "code": "W_DBCONNECT_PIN_OVERRIDDEN",
+      "message": "databricks-connect \"databricks-connect~=16.0.0\" is replaced by the environment's \"databricks-connect~=17.2.0\""
+    },
+    {
+      "code": "W_DBCONNECT_CONSOLIDATED",
+      "message": "databricks-connect \"databricks-connect==15.0.0\" in [dependency-groups].spark conflicts with the environment's \"databricks-connect~=17.2.0\" and is removed; it is managed in \"dev\""
+    },
+    {
+      "code": "W_STANDALONE_PYSPARK_CONFLICT",
+      "message": "dependency \"pyspark\u003e=3.5.0\" collides with the pyspark bundled in databricks-connect; the two cannot share one environment — remove it, or install it in a separate environment for local Spark"
+    },
+    {
+      "code": "W_USER_CONSTRAINT_CONFLICT",
+      "message": "dependency \"pyarrow==21.0.0\" conflicts with the environment constraint \"pyarrow\u003c19\""
+    },
+    {
+      "code": "W_USER_CONSTRAINT_CONFLICT",
+      "message": "dependency \"pandas==4.0.0\" conflicts with the environment constraint \"pandas\u003c3\""
+    }
+  ],
+  "error": null,
+  "durationMs": [DURATION_MS]
+}
diff --git a/acceptance/localenv/merge-warnings-json/script b/acceptance/localenv/merge-warnings-json/script
new file mode 100644
index 00000000000..f6e4cbc2393
--- /dev/null
+++ b/acceptance/localenv/merge-warnings-json/script
@@ -0,0 +1,17 @@
+# An existing project whose pins the merge overrides, plus a dependency the env's
+# constraints exclude, a pin in a non-dev group uv still locks, and a standalone
+# pyspark that collides with the pyspark databricks-connect vendors. All five warning
+# conditions in one run, so warnings[] is exercised end to end.
+cat > pyproject.toml <<'PY'
+[project]
+name = "demo"
+requires-python = ">=3.10"
+dependencies = ["pyarrow==21.0.0", "pyspark>=3.5.0"]
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0.0", {include-group = "spark"}]
+spark = ["databricks-connect==15.0.0"]
+qa = ["pandas==4.0.0"]
+PY
+
+trace $CLI environments setup-local --serverless-version 4 --dry-run --output json
diff --git a/acceptance/localenv/merge-warnings-json/test.toml b/acceptance/localenv/merge-warnings-json/test.toml
new file mode 100644
index 00000000000..4bfbb6e7bdc
--- /dev/null
+++ b/acceptance/localenv/merge-warnings-json/test.toml
@@ -0,0 +1,21 @@
+# The script writes pyproject.toml as the merge input; --dry-run leaves it unchanged.
+Ignore = ["pyproject.toml"]
+
+Env.DATABRICKS_LOCALENV_CONSTRAINT_SOURCE_URL_TEST_OVERRIDE = "$DATABRICKS_HOST"
+
+[[Server]]
+Pattern = "GET /serverless/serverless-v4/pyproject.toml"
+Response.Body = '''
+[project]
+requires-python = ">=3.12"
+
+[dependency-groups]
+dev = ["databricks-connect~=17.2.0"]
+
+[tool.uv]
+constraint-dependencies = ["pyarrow<19", "pandas<3"]
+'''
+
+[[Repls]]
+Old = 'uv uv \S+(?: \([^)]+\))?'
+New = 'uv [UV_VERSION]'
diff --git a/acceptance/localenv/merge-warnings/out.test.toml b/acceptance/localenv/merge-warnings/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/localenv/merge-warnings/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/localenv/merge-warnings/output.txt b/acceptance/localenv/merge-warnings/output.txt
new file mode 100644
index 00000000000..45879bd6f62
--- /dev/null
+++ b/acceptance/localenv/merge-warnings/output.txt
@@ -0,0 +1,14 @@
+
+>>> [CLI] environments setup-local --serverless-version 4 --dry-run
+warning: requires-python ">=3.10" is replaced by the environment's ">=3.12"
+warning: databricks-connect "databricks-connect~=16.0.0" is replaced by the environment's "databricks-connect~=17.2.0"
+warning: databricks-connect "databricks-connect==15.0.0" in [dependency-groups].spark conflicts with the environment's "databricks-connect~=17.2.0" and is removed; it is managed in "dev"
+warning: dependency "pyspark>=3.5.0" collides with the pyspark bundled in databricks-connect; the two cannot share one environment — remove it, or install it in a separate environment for local Spark
+warning: dependency "pyarrow==21.0.0" conflicts with the environment constraint "pyarrow<19"
+warning: dependency "pandas==4.0.0" conflicts with the environment constraint "pandas<3"
+Plan: [TEST_TMP_DIR]/pyproject.toml
+  changed region: requires-python
+  changed region: databricks-connect
+  changed region: tool.databricks.environment
+  changed region: tool.uv.constraint-dependencies
+Check complete. No files were modified.
diff --git a/acceptance/localenv/merge-warnings/script b/acceptance/localenv/merge-warnings/script
new file mode 100644
index 00000000000..51a86a67d48
--- /dev/null
+++ b/acceptance/localenv/merge-warnings/script
@@ -0,0 +1,15 @@
+# The text renderer's warning lines, which the --json variant does not exercise.
+# See merge-warnings-json for the same input through --output json.
+cat > pyproject.toml <<'PY'
+[project]
+name = "demo"
+requires-python = ">=3.10"
+dependencies = ["pyarrow==21.0.0", "pyspark>=3.5.0"]
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0.0", {include-group = "spark"}]
+spark = ["databricks-connect==15.0.0"]
+qa = ["pandas==4.0.0"]
+PY
+
+trace $CLI environments setup-local --serverless-version 4 --dry-run
diff --git a/acceptance/localenv/merge-warnings/test.toml b/acceptance/localenv/merge-warnings/test.toml
new file mode 100644
index 00000000000..4bfbb6e7bdc
--- /dev/null
+++ b/acceptance/localenv/merge-warnings/test.toml
@@ -0,0 +1,21 @@
+# The script writes pyproject.toml as the merge input; --dry-run leaves it unchanged.
+Ignore = ["pyproject.toml"]
+
+Env.DATABRICKS_LOCALENV_CONSTRAINT_SOURCE_URL_TEST_OVERRIDE = "$DATABRICKS_HOST"
+
+[[Server]]
+Pattern = "GET /serverless/serverless-v4/pyproject.toml"
+Response.Body = '''
+[project]
+requires-python = ">=3.12"
+
+[dependency-groups]
+dev = ["databricks-connect~=17.2.0"]
+
+[tool.uv]
+constraint-dependencies = ["pyarrow<19", "pandas<3"]
+'''
+
+[[Repls]]
+Old = 'uv uv \S+(?: \([^)]+\))?'
+New = 'uv [UV_VERSION]'
diff --git a/acceptance/localenv/no-constraints/out.test.toml b/acceptance/localenv/no-constraints/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/localenv/no-constraints/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/localenv/no-constraints/output.txt b/acceptance/localenv/no-constraints/output.txt
new file mode 100644
index 00000000000..6010c343f5a
--- /dev/null
+++ b/acceptance/localenv/no-constraints/output.txt
@@ -0,0 +1,60 @@
+
+>>> [CLI] environments setup-local --serverless-version 4 --no-constraints --dry-run --output json
+{
+  "schemaVersion": 1,
+  "command": "environments setup-local",
+  "ok": true,
+  "mode": "default",
+  "dryRun": true,
+  "compute": {
+    "source": "serverless",
+    "serverlessVersion": "v4",
+    "envKey": "serverless/serverless-v4"
+  },
+  "resolved": {
+    "pythonVersion": "3.12",
+    "dbconnectVersion": "17.2.0",
+    "artifactSource": "network"
+  },
+  "greenfield": false,
+  "plan": {
+    "wouldWrite": "[TEST_TMP_DIR]/pyproject.toml",
+    "wouldBackup": "[TEST_TMP_DIR]/pyproject.toml.bak",
+    "wouldInstallPython": "3.12",
+    "diff": "--- pyproject.toml\n+++ pyproject.toml.new\n@@ -3,4 +3,7 @@\n requires-python = \"\u003e=3.10\"\n \n [dependency-groups]\n-dev = [\"databricks-connect~=16.0\"]\n+dev = [\"databricks-connect~=17.2.0\"]\n+\n+[tool.databricks.environment]\n+environment_version = \"4\"\n"
+  },
+  "phases": [
+    {
+      "phase": "preflight",
+      "status": "ok"
+    },
+    {
+      "phase": "resolve",
+      "status": "ok"
+    },
+    {
+      "phase": "fetch",
+      "status": "ok"
+    },
+    {
+      "phase": "merge",
+      "status": "ok"
+    },
+    {
+      "phase": "provision",
+      "status": "ok"
+    },
+    {
+      "phase": "validate",
+      "status": "ok"
+    }
+  ],
+  "warnings": [
+    {
+      "code": "W_DBCONNECT_PIN_OVERRIDDEN",
+      "message": "databricks-connect \"databricks-connect~=16.0\" is replaced by the environment's \"databricks-connect~=17.2.0\""
+    }
+  ],
+  "error": null,
+  "durationMs": [DURATION_MS]
+}
diff --git a/acceptance/localenv/no-constraints/script b/acceptance/localenv/no-constraints/script
new file mode 100644
index 00000000000..f4711b38dd5
--- /dev/null
+++ b/acceptance/localenv/no-constraints/script
@@ -0,0 +1,15 @@
+# --no-constraints leaves the remote Python version and dependency pins
+# unmanaged: the plan writes neither requires-python nor the [tool.uv] constraint
+# block, and the user's existing requires-python is left untouched. The
+# databricks-connect dependency (orthogonal to --no-constraints) is still managed.
+# The JSON plan shows the diff.
+cat > pyproject.toml <<'PY'
+[project]
+name = "demo"
+requires-python = ">=3.10"
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0"]
+PY
+
+trace $CLI environments setup-local --serverless-version 4 --no-constraints --dry-run --output json
diff --git a/acceptance/localenv/no-constraints/test.toml b/acceptance/localenv/no-constraints/test.toml
new file mode 100644
index 00000000000..9da015b178c
--- /dev/null
+++ b/acceptance/localenv/no-constraints/test.toml
@@ -0,0 +1,21 @@
+# The script writes pyproject.toml as the merge input; --dry-run leaves it unchanged.
+Ignore = ["pyproject.toml"]
+
+Env.DATABRICKS_LOCALENV_CONSTRAINT_SOURCE_URL_TEST_OVERRIDE = "$DATABRICKS_HOST"
+
+[[Server]]
+Pattern = "GET /serverless/serverless-v4/pyproject.toml"
+Response.Body = '''
+[project]
+requires-python = ">=3.12"
+
+[dependency-groups]
+dev = ["databricks-connect~=17.2.0"]
+
+[tool.uv]
+constraint-dependencies = ["pyarrow<19"]
+'''
+
+[[Repls]]
+Old = 'uv uv \S+(?: \([^)]+\))?'
+New = 'uv [UV_VERSION]'
diff --git a/acceptance/localenv/no-dbconnect/out.test.toml b/acceptance/localenv/no-dbconnect/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/localenv/no-dbconnect/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/localenv/no-dbconnect/output.txt b/acceptance/localenv/no-dbconnect/output.txt
new file mode 100644
index 00000000000..677a6fbf26b
--- /dev/null
+++ b/acceptance/localenv/no-dbconnect/output.txt
@@ -0,0 +1,59 @@
+
+>>> [CLI] environments setup-local --serverless-version 4 --no-dbconnect --dry-run --output json
+{
+  "schemaVersion": 1,
+  "command": "environments setup-local",
+  "ok": true,
+  "mode": "constraints-only",
+  "dryRun": true,
+  "compute": {
+    "source": "serverless",
+    "serverlessVersion": "v4",
+    "envKey": "serverless/serverless-v4"
+  },
+  "resolved": {
+    "pythonVersion": "3.12",
+    "artifactSource": "network"
+  },
+  "greenfield": false,
+  "plan": {
+    "wouldWrite": "[TEST_TMP_DIR]/pyproject.toml",
+    "wouldBackup": "[TEST_TMP_DIR]/pyproject.toml.bak",
+    "wouldInstallPython": "3.12",
+    "diff": "--- pyproject.toml\n+++ pyproject.toml.new\n@@ -1,7 +1,17 @@\n [project]\n name = \"demo\"\n-requires-python = \"\u003e=3.10\"\n+requires-python = \"\u003e=3.12\"\n dependencies = [\"databricks-connect==15.1.*\"]\n \n [dependency-groups]\n dev = [\"databricks-connect~=16.0\"]\n+\n+[tool.databricks.environment]\n+environment_version = \"4\"\n+\n+# managed by databricks environments setup-local — do not edit\n+[tool.uv]\n+constraint-dependencies = [\n+    \"pyarrow\u003c19\",\n+]\n+# end managed by databricks environments setup-local\n"
+  },
+  "phases": [
+    {
+      "phase": "preflight",
+      "status": "ok"
+    },
+    {
+      "phase": "resolve",
+      "status": "ok"
+    },
+    {
+      "phase": "fetch",
+      "status": "ok"
+    },
+    {
+      "phase": "merge",
+      "status": "ok"
+    },
+    {
+      "phase": "provision",
+      "status": "ok"
+    },
+    {
+      "phase": "validate",
+      "status": "ok"
+    }
+  ],
+  "warnings": [
+    {
+      "code": "W_REQUIRES_PYTHON_OVERRIDDEN",
+      "message": "requires-python \"\u003e=3.10\" is replaced by the environment's \"\u003e=3.12\""
+    }
+  ],
+  "error": null,
+  "durationMs": [DURATION_MS]
+}
diff --git a/acceptance/localenv/no-dbconnect/script b/acceptance/localenv/no-dbconnect/script
new file mode 100644
index 00000000000..63b38e08faa
--- /dev/null
+++ b/acceptance/localenv/no-dbconnect/script
@@ -0,0 +1,15 @@
+# --no-dbconnect is the orthogonal spelling of --constraints-only: it omits the
+# databricks-connect dependency (mode "constraints-only") while still managing
+# requires-python and the [tool.uv] constraints. Existing databricks-connect
+# requirements the user already had are left untouched.
+cat > pyproject.toml <<'PY'
+[project]
+name = "demo"
+requires-python = ">=3.10"
+dependencies = ["databricks-connect==15.1.*"]
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0"]
+PY
+
+trace $CLI environments setup-local --serverless-version 4 --no-dbconnect --dry-run --output json
diff --git a/acceptance/localenv/no-dbconnect/test.toml b/acceptance/localenv/no-dbconnect/test.toml
new file mode 100644
index 00000000000..9da015b178c
--- /dev/null
+++ b/acceptance/localenv/no-dbconnect/test.toml
@@ -0,0 +1,21 @@
+# The script writes pyproject.toml as the merge input; --dry-run leaves it unchanged.
+Ignore = ["pyproject.toml"]
+
+Env.DATABRICKS_LOCALENV_CONSTRAINT_SOURCE_URL_TEST_OVERRIDE = "$DATABRICKS_HOST"
+
+[[Server]]
+Pattern = "GET /serverless/serverless-v4/pyproject.toml"
+Response.Body = '''
+[project]
+requires-python = ">=3.12"
+
+[dependency-groups]
+dev = ["databricks-connect~=17.2.0"]
+
+[tool.uv]
+constraint-dependencies = ["pyarrow<19"]
+'''
+
+[[Repls]]
+Old = 'uv uv \S+(?: \([^)]+\))?'
+New = 'uv [UV_VERSION]'
diff --git a/acceptance/localenv/no-target/out.test.toml b/acceptance/localenv/no-target/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/localenv/no-target/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/localenv/no-target/output.txt b/acceptance/localenv/no-target/output.txt
new file mode 100644
index 00000000000..9f4228231ea
--- /dev/null
+++ b/acceptance/localenv/no-target/output.txt
@@ -0,0 +1,5 @@
+✗ Setup failed while resolving your compute target.
+
+  No compute target is selected. Select a cluster or serverless target, or pass --cluster-id / --cluster-name / --serverless-version / --job-task
+
+Re-run with --debug for details, or --output json for a structured report.
diff --git a/acceptance/localenv/no-target/script b/acceptance/localenv/no-target/script
new file mode 100644
index 00000000000..712272f0e56
--- /dev/null
+++ b/acceptance/localenv/no-target/script
@@ -0,0 +1 @@
+musterr $CLI environments setup-local
diff --git a/acceptance/localenv/no-target/test.toml b/acceptance/localenv/no-target/test.toml
new file mode 100644
index 00000000000..7850e09c2dc
--- /dev/null
+++ b/acceptance/localenv/no-target/test.toml
@@ -0,0 +1,3 @@
+[[Repls]]
+Old = 'uv uv \S+(?: \([^)]+\))?'
+New = 'uv [UV_VERSION]'
diff --git a/acceptance/localenv/provision-conflict-sync/fake-uv.sh b/acceptance/localenv/provision-conflict-sync/fake-uv.sh
new file mode 100644
index 00000000000..69d4b717fe1
--- /dev/null
+++ b/acceptance/localenv/provision-conflict-sync/fake-uv.sh
@@ -0,0 +1,23 @@
+#!/bin/bash
+#
+# Fake uv for the provision-conflict-sync acceptance test. It satisfies the
+# version probe and the Python install, then fails `uv sync` with a trimmed
+# sample of uv's real resolver-conflict stderr so the CLI reaches the new
+# E_PROVISION_CONFLICT classification without a real (network-dependent) sync.
+# The test script renames this to "uv" and puts it first on PATH, mirroring
+# acceptance/cmd/psql.
+#
+case "$1" in
+--version)
+	echo "uv 0.0.0-fake"
+	;;
+python)
+	# `uv python install <minor>`: pretend the interpreter is available.
+	;;
+sync)
+	echo "error: No solution found when resolving dependencies:" >&2
+	echo "  Because the project's requirements are unsatisfiable, we cannot proceed." >&2
+	exit 1
+	;;
+esac
+exit 0
diff --git a/acceptance/localenv/provision-conflict-sync/out.test.toml b/acceptance/localenv/provision-conflict-sync/out.test.toml
new file mode 100644
index 00000000000..2e1543aa802
--- /dev/null
+++ b/acceptance/localenv/provision-conflict-sync/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+GOOS.windows = false
diff --git a/acceptance/localenv/provision-conflict-sync/output.txt b/acceptance/localenv/provision-conflict-sync/output.txt
new file mode 100644
index 00000000000..10d6ee133ee
--- /dev/null
+++ b/acceptance/localenv/provision-conflict-sync/output.txt
@@ -0,0 +1,59 @@
+{
+  "schemaVersion": 1,
+  "command": "environments setup-local",
+  "ok": false,
+  "mode": "default",
+  "dryRun": false,
+  "compute": {
+    "source": "serverless",
+    "serverlessVersion": "v4",
+    "envKey": "serverless/serverless-v4"
+  },
+  "resolved": {
+    "pythonVersion": "3.12",
+    "dbconnectVersion": "17.2.0",
+    "artifactSource": "network"
+  },
+  "greenfield": false,
+  "pythonResolution": "uv_install_succeeded",
+  "phases": [
+    {
+      "phase": "preflight",
+      "status": "ok"
+    },
+    {
+      "phase": "resolve",
+      "status": "ok"
+    },
+    {
+      "phase": "fetch",
+      "status": "ok"
+    },
+    {
+      "phase": "merge",
+      "status": "ok"
+    },
+    {
+      "phase": "provision",
+      "status": "error"
+    },
+    {
+      "phase": "validate",
+      "status": "pending"
+    }
+  ],
+  "warnings": [
+    {
+      "code": "W_DBCONNECT_PIN_OVERRIDDEN",
+      "message": "databricks-connect \"databricks-connect~=16.0.0\" is replaced by the environment's \"databricks-connect~=17.2.0\""
+    }
+  ],
+  "error": {
+    "code": "E_PROVISION_CONFLICT",
+    "failurePhase": "provision",
+    "message": "uv sync failed: error: No solution found when resolving dependencies:\n  Because the project's requirements are unsatisfiable, we cannot proceed.: [TEST_TMP_DIR]/uv sync --python 3.12: exit status 1",
+    "diskMutated": true
+  },
+  "backupPath": "[TEST_TMP_DIR]/pyproject.toml.bak",
+  "durationMs": [DURATION_MS]
+}
diff --git a/acceptance/localenv/provision-conflict-sync/pyproject.toml b/acceptance/localenv/provision-conflict-sync/pyproject.toml
new file mode 100644
index 00000000000..1dfc15abb65
--- /dev/null
+++ b/acceptance/localenv/provision-conflict-sync/pyproject.toml
@@ -0,0 +1,6 @@
+[project]
+name = "demo"
+requires-python = ">=3.12"
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0.0"]
diff --git a/acceptance/localenv/provision-conflict-sync/script b/acceptance/localenv/provision-conflict-sync/script
new file mode 100644
index 00000000000..31f161f4a4f
--- /dev/null
+++ b/acceptance/localenv/provision-conflict-sync/script
@@ -0,0 +1,15 @@
+# The committed pyproject has no direct-pin conflict, so the merge phase succeeds
+# (no W_USER_CONSTRAINT_CONFLICT). uv sync then fails to resolve a transitive
+# conflict — here a fake uv on PATH (see acceptance/cmd/psql for the pattern)
+# stands in for the network-dependent resolve — and the CLI now classifies that
+# resolver failure as E_PROVISION_CONFLICT, the same code the merge-phase
+# direct-pin conflict uses. The merged pins are already on disk (diskMutated=true).
+mv fake-uv.sh uv
+chmod +x uv
+cleanup() {
+  rm -f uv
+}
+trap cleanup EXIT
+export PATH="$(pwd):$PATH"
+
+musterr $CLI environments setup-local --serverless-version 4 --output json
diff --git a/acceptance/localenv/provision-conflict-sync/test.toml b/acceptance/localenv/provision-conflict-sync/test.toml
new file mode 100644
index 00000000000..9c7e9c2f325
--- /dev/null
+++ b/acceptance/localenv/provision-conflict-sync/test.toml
@@ -0,0 +1,21 @@
+# The fake uv is a bash script, so this test cannot run on Windows runners
+# (mirrors acceptance/cmd/psql).
+GOOS.windows = false
+
+# setup-local writes pyproject.toml through the merge phase (backing up the
+# committed one) before uv sync runs; the assertion is the JSON output, so ignore
+# the mutated file and its backup. No .venv is created because the fake uv fails
+# the sync before anything is written.
+Ignore = ["pyproject.toml", "pyproject.toml.bak", ".venv"]
+
+Env.DATABRICKS_LOCALENV_CONSTRAINT_SOURCE_URL_TEST_OVERRIDE = "$DATABRICKS_HOST"
+
+[[Server]]
+Pattern = "GET /serverless/serverless-v4/pyproject.toml"
+Response.Body = '''
+[project]
+requires-python = ">=3.12"
+
+[dependency-groups]
+dev = ["databricks-connect~=17.2.0"]
+'''
diff --git a/acceptance/localenv/provision-conflict/out.test.toml b/acceptance/localenv/provision-conflict/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/localenv/provision-conflict/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/localenv/provision-conflict/output.txt b/acceptance/localenv/provision-conflict/output.txt
new file mode 100644
index 00000000000..d4fd58f8732
--- /dev/null
+++ b/acceptance/localenv/provision-conflict/output.txt
@@ -0,0 +1,62 @@
+{
+  "schemaVersion": 1,
+  "command": "environments setup-local",
+  "ok": false,
+  "mode": "default",
+  "dryRun": false,
+  "compute": {
+    "source": "serverless",
+    "serverlessVersion": "v4",
+    "envKey": "serverless/serverless-v4"
+  },
+  "resolved": {
+    "pythonVersion": "3.12",
+    "dbconnectVersion": "17.2.0",
+    "artifactSource": "network"
+  },
+  "greenfield": false,
+  "phases": [
+    {
+      "phase": "preflight",
+      "status": "ok"
+    },
+    {
+      "phase": "resolve",
+      "status": "ok"
+    },
+    {
+      "phase": "fetch",
+      "status": "ok"
+    },
+    {
+      "phase": "merge",
+      "status": "ok"
+    },
+    {
+      "phase": "provision",
+      "status": "error"
+    },
+    {
+      "phase": "validate",
+      "status": "pending"
+    }
+  ],
+  "warnings": [
+    {
+      "code": "W_DBCONNECT_PIN_OVERRIDDEN",
+      "message": "databricks-connect \"databricks-connect~=16.0.0\" is replaced by the environment's \"databricks-connect~=17.2.0\""
+    },
+    {
+      "code": "W_USER_CONSTRAINT_CONFLICT",
+      "message": "dependency \"pip==[PIP_VERSION]\" conflicts with the environment constraint \"pip\u003c24\""
+    }
+  ],
+  "error": {
+    "code": "E_PROVISION_CONFLICT",
+    "failurePhase": "provision",
+    "message": "dependency pins conflict with the environment constraints; relax the conflicting pins and re-run (see warnings)",
+    "diskMutated": true
+  },
+  "backupPath": "[TEST_TMP_DIR]/pyproject.toml.bak",
+  "durationMs": [DURATION_MS]
+}
diff --git a/acceptance/localenv/provision-conflict/pyproject.toml b/acceptance/localenv/provision-conflict/pyproject.toml
new file mode 100644
index 00000000000..3c372a9ef33
--- /dev/null
+++ b/acceptance/localenv/provision-conflict/pyproject.toml
@@ -0,0 +1,7 @@
+[project]
+name = "demo"
+requires-python = ">=3.12"
+dependencies = ["pip==26.2"]
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0.0"]
diff --git a/acceptance/localenv/provision-conflict/script b/acceptance/localenv/provision-conflict/script
new file mode 100644
index 00000000000..442595834d5
--- /dev/null
+++ b/acceptance/localenv/provision-conflict/script
@@ -0,0 +1,6 @@
+# The user pins a pip version >=24 while the remote environment constraints pin
+# pip<24, a provably disjoint range. The merge phase detects that (W_USER_CONSTRAINT_CONFLICT)
+# and setup-local reports E_PROVISION_CONFLICT right away — with the merged pins
+# already written to disk (diskMutated=true), the contract the extension's recovery
+# flow depends on — instead of spending a doomed Python install and uv sync.
+musterr $CLI environments setup-local --serverless-version 4 --output json
diff --git a/acceptance/localenv/provision-conflict/test.toml b/acceptance/localenv/provision-conflict/test.toml
new file mode 100644
index 00000000000..60ff063ac6e
--- /dev/null
+++ b/acceptance/localenv/provision-conflict/test.toml
@@ -0,0 +1,28 @@
+# setup-local writes pyproject.toml through the merge phase (backing up the
+# committed one) before it reports the conflict; the assertion is the JSON output,
+# so ignore the mutated file and its backup. No .venv is created because the run
+# stops before provisioning.
+Ignore = ["pyproject.toml", "pyproject.toml.bak"]
+
+Env.DATABRICKS_LOCALENV_CONSTRAINT_SOURCE_URL_TEST_OVERRIDE = "$DATABRICKS_HOST"
+
+# The pip pin in pyproject.toml is bumped by dependabot; normalize it in the
+# echoed warning so a version bump doesn't churn the golden. Any pinned version
+# still conflicts with the environment's "pip<24" constraint, which is what the
+# test asserts.
+[[Repls]]
+Old = 'pip==\d+(\.\d+)*'
+New = 'pip==[PIP_VERSION]'
+
+[[Server]]
+Pattern = "GET /serverless/serverless-v4/pyproject.toml"
+Response.Body = '''
+[project]
+requires-python = ">=3.12"
+
+[dependency-groups]
+dev = ["databricks-connect~=17.2.0"]
+
+[tool.uv]
+constraint-dependencies = ["pip<24"]
+'''
diff --git a/acceptance/localenv/serverless-check/out.test.toml b/acceptance/localenv/serverless-check/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/localenv/serverless-check/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/localenv/serverless-check/output.txt b/acceptance/localenv/serverless-check/output.txt
new file mode 100644
index 00000000000..a62cdbbb2d8
--- /dev/null
+++ b/acceptance/localenv/serverless-check/output.txt
@@ -0,0 +1,8 @@
+
+>>> [CLI] environments setup-local --serverless-version 4 --dry-run
+Plan: [TEST_TMP_DIR]/pyproject.toml
+  changed region: requires-python
+  changed region: tool.uv.constraint-dependencies
+  changed region: databricks-connect
+  changed region: tool.databricks.environment
+Check complete. No files were modified.
diff --git a/acceptance/localenv/serverless-check/script b/acceptance/localenv/serverless-check/script
new file mode 100644
index 00000000000..c02eb922237
--- /dev/null
+++ b/acceptance/localenv/serverless-check/script
@@ -0,0 +1 @@
+trace $CLI environments setup-local --serverless-version 4 --dry-run
diff --git a/acceptance/localenv/serverless-check/test.toml b/acceptance/localenv/serverless-check/test.toml
new file mode 100644
index 00000000000..796a4b440b9
--- /dev/null
+++ b/acceptance/localenv/serverless-check/test.toml
@@ -0,0 +1,18 @@
+Env.DATABRICKS_LOCALENV_CONSTRAINT_SOURCE_URL_TEST_OVERRIDE = "$DATABRICKS_HOST"
+
+[[Server]]
+Pattern = "GET /serverless/serverless-v4/pyproject.toml"
+Response.Body = '''
+[project]
+requires-python = ">=3.12"
+
+[dependency-groups]
+dev = ["databricks-connect~=17.2.0"]
+
+[tool.uv]
+constraint-dependencies = ["pyarrow<19", "pandas<3"]
+'''
+
+[[Repls]]
+Old = 'uv uv \S+(?: \([^)]+\))?'
+New = 'uv [UV_VERSION]'
diff --git a/acceptance/localenv/serverless-json-major-pin/out.test.toml b/acceptance/localenv/serverless-json-major-pin/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/localenv/serverless-json-major-pin/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/localenv/serverless-json-major-pin/output.txt b/acceptance/localenv/serverless-json-major-pin/output.txt
new file mode 100644
index 00000000000..d610b89c3cb
--- /dev/null
+++ b/acceptance/localenv/serverless-json-major-pin/output.txt
@@ -0,0 +1,53 @@
+
+>>> [CLI] environments setup-local --serverless-version 4 --dry-run --output json
+{
+  "schemaVersion": 1,
+  "command": "environments setup-local",
+  "ok": true,
+  "mode": "default",
+  "dryRun": true,
+  "compute": {
+    "source": "serverless",
+    "serverlessVersion": "v4",
+    "envKey": "serverless/serverless-v4"
+  },
+  "resolved": {
+    "pythonVersion": "3.12",
+    "artifactSource": "network"
+  },
+  "greenfield": true,
+  "plan": {
+    "wouldWrite": "[TEST_TMP_DIR]/pyproject.toml",
+    "wouldInstallPython": "3.12",
+    "diff": "--- pyproject.toml\n+++ pyproject.toml\n@@ -1 +1,20 @@\n+[project]\n+name = \"001\"\n+version = \"0.0.0\"\n+requires-python = \"\u003e=3.12\"\n+\n+[dependency-groups]\n+dev = [\n+    \"databricks-connect~=17.0\",\n+]\n+\n+[tool.databricks.environment]\n+environment_version = \"4\"\n+\n+# managed by databricks environments setup-local — do not edit\n+[tool.uv]\n+constraint-dependencies = [\n+    \"pyarrow\u003c19\",\n+    \"pandas\u003c3\",\n+]\n+# end managed by databricks environments setup-local\n"
+  },
+  "phases": [
+    {
+      "phase": "preflight",
+      "status": "ok"
+    },
+    {
+      "phase": "resolve",
+      "status": "ok"
+    },
+    {
+      "phase": "fetch",
+      "status": "ok"
+    },
+    {
+      "phase": "merge",
+      "status": "ok"
+    },
+    {
+      "phase": "provision",
+      "status": "ok"
+    },
+    {
+      "phase": "validate",
+      "status": "ok"
+    }
+  ],
+  "warnings": [],
+  "error": null,
+  "durationMs": [DURATION_MS]
+}
diff --git a/acceptance/localenv/serverless-json-major-pin/script b/acceptance/localenv/serverless-json-major-pin/script
new file mode 100644
index 00000000000..0bda75a032b
--- /dev/null
+++ b/acceptance/localenv/serverless-json-major-pin/script
@@ -0,0 +1 @@
+trace $CLI environments setup-local --serverless-version 4 --dry-run --output json
diff --git a/acceptance/localenv/serverless-json-major-pin/test.toml b/acceptance/localenv/serverless-json-major-pin/test.toml
new file mode 100644
index 00000000000..d7b65907ecf
--- /dev/null
+++ b/acceptance/localenv/serverless-json-major-pin/test.toml
@@ -0,0 +1,23 @@
+Env.DATABRICKS_LOCALENV_CONSTRAINT_SOURCE_URL_TEST_OVERRIDE = "$DATABRICKS_HOST"
+# Serverless pins databricks-connect by major (~=17.0) across every env
+# (environments#15), a compatible-release range rather than a concrete version.
+# Under --dry-run validate never runs, so dbconnectVersion must be omitted rather
+# than reporting the "17.0" floor nothing installs. This is the live serverless
+# shape; serverless-json covers the concrete full-pin path.
+
+[[Server]]
+Pattern = "GET /serverless/serverless-v4/pyproject.toml"
+Response.Body = '''
+[project]
+requires-python = ">=3.12"
+
+[dependency-groups]
+dev = ["databricks-connect~=17.0"]
+
+[tool.uv]
+constraint-dependencies = ["pyarrow<19", "pandas<3"]
+'''
+
+[[Repls]]
+Old = 'uv uv \S+(?: \([^)]+\))?'
+New = 'uv [UV_VERSION]'
diff --git a/acceptance/localenv/serverless-json/out.test.toml b/acceptance/localenv/serverless-json/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/localenv/serverless-json/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/localenv/serverless-json/output.txt b/acceptance/localenv/serverless-json/output.txt
new file mode 100644
index 00000000000..040ae13a9b1
--- /dev/null
+++ b/acceptance/localenv/serverless-json/output.txt
@@ -0,0 +1,54 @@
+
+>>> [CLI] environments setup-local --serverless-version 4 --dry-run --output json
+{
+  "schemaVersion": 1,
+  "command": "environments setup-local",
+  "ok": true,
+  "mode": "default",
+  "dryRun": true,
+  "compute": {
+    "source": "serverless",
+    "serverlessVersion": "v4",
+    "envKey": "serverless/serverless-v4"
+  },
+  "resolved": {
+    "pythonVersion": "3.12",
+    "dbconnectVersion": "17.2.0",
+    "artifactSource": "network"
+  },
+  "greenfield": true,
+  "plan": {
+    "wouldWrite": "[TEST_TMP_DIR]/pyproject.toml",
+    "wouldInstallPython": "3.12",
+    "diff": "--- pyproject.toml\n+++ pyproject.toml\n@@ -1 +1,20 @@\n+[project]\n+name = \"001\"\n+version = \"0.0.0\"\n+requires-python = \"\u003e=3.12\"\n+\n+[dependency-groups]\n+dev = [\n+    \"databricks-connect~=17.2.0\",\n+]\n+\n+[tool.databricks.environment]\n+environment_version = \"4\"\n+\n+# managed by databricks environments setup-local — do not edit\n+[tool.uv]\n+constraint-dependencies = [\n+    \"pyarrow\u003c19\",\n+    \"pandas\u003c3\",\n+]\n+# end managed by databricks environments setup-local\n"
+  },
+  "phases": [
+    {
+      "phase": "preflight",
+      "status": "ok"
+    },
+    {
+      "phase": "resolve",
+      "status": "ok"
+    },
+    {
+      "phase": "fetch",
+      "status": "ok"
+    },
+    {
+      "phase": "merge",
+      "status": "ok"
+    },
+    {
+      "phase": "provision",
+      "status": "ok"
+    },
+    {
+      "phase": "validate",
+      "status": "ok"
+    }
+  ],
+  "warnings": [],
+  "error": null,
+  "durationMs": [DURATION_MS]
+}
diff --git a/acceptance/localenv/serverless-json/script b/acceptance/localenv/serverless-json/script
new file mode 100644
index 00000000000..0bda75a032b
--- /dev/null
+++ b/acceptance/localenv/serverless-json/script
@@ -0,0 +1 @@
+trace $CLI environments setup-local --serverless-version 4 --dry-run --output json
diff --git a/acceptance/localenv/serverless-json/test.toml b/acceptance/localenv/serverless-json/test.toml
new file mode 100644
index 00000000000..796a4b440b9
--- /dev/null
+++ b/acceptance/localenv/serverless-json/test.toml
@@ -0,0 +1,18 @@
+Env.DATABRICKS_LOCALENV_CONSTRAINT_SOURCE_URL_TEST_OVERRIDE = "$DATABRICKS_HOST"
+
+[[Server]]
+Pattern = "GET /serverless/serverless-v4/pyproject.toml"
+Response.Body = '''
+[project]
+requires-python = ">=3.12"
+
+[dependency-groups]
+dev = ["databricks-connect~=17.2.0"]
+
+[tool.uv]
+constraint-dependencies = ["pyarrow<19", "pandas<3"]
+'''
+
+[[Repls]]
+Old = 'uv uv \S+(?: \([^)]+\))?'
+New = 'uv [UV_VERSION]'
diff --git a/acceptance/localenv/test.toml b/acceptance/localenv/test.toml
new file mode 100644
index 00000000000..adc40108ecb
--- /dev/null
+++ b/acceptance/localenv/test.toml
@@ -0,0 +1,5 @@
+[[Repls]]
+# environments setup-local emits a real wall-time durationMs; normalize it so the
+# JSON goldens are deterministic.
+Old = '"durationMs": \d+'
+New = '"durationMs": [DURATION_MS]'
diff --git a/acceptance/localenv/wildcard-constraint-conflict-check/out.test.toml b/acceptance/localenv/wildcard-constraint-conflict-check/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/localenv/wildcard-constraint-conflict-check/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/localenv/wildcard-constraint-conflict-check/output.txt b/acceptance/localenv/wildcard-constraint-conflict-check/output.txt
new file mode 100644
index 00000000000..8fdf2ffeb1c
--- /dev/null
+++ b/acceptance/localenv/wildcard-constraint-conflict-check/output.txt
@@ -0,0 +1,9 @@
+
+>>> [CLI] environments setup-local --serverless-version 4 --dry-run
+warning: requires-python ">=3.10" is replaced by the environment's ">=3.12"
+warning: dependency "pyarrow==18.*" conflicts with the environment constraint "pyarrow~=19.0"
+Plan: [TEST_TMP_DIR]/pyproject.toml
+  changed region: requires-python
+  changed region: tool.databricks.environment
+  changed region: tool.uv.constraint-dependencies
+Check complete. No files were modified.
diff --git a/acceptance/localenv/wildcard-constraint-conflict-check/script b/acceptance/localenv/wildcard-constraint-conflict-check/script
new file mode 100644
index 00000000000..d4c6ee6b1b2
--- /dev/null
+++ b/acceptance/localenv/wildcard-constraint-conflict-check/script
@@ -0,0 +1,14 @@
+# A PEP 440 prefix-match wildcard pin ("pyarrow==18.*") is modeled as the version range
+# it admits, so a conflict with the environment's constraint-dependencies is reported
+# rather than silently missed — the 18.* series lies entirely below the env's ~=19.0.
+cat > pyproject.toml <<'PY'
+[project]
+name = "demo"
+requires-python = ">=3.10"
+dependencies = ["pyarrow==18.*"]
+
+[dependency-groups]
+dev = ["databricks-connect~=17.2.0"]
+PY
+
+trace $CLI environments setup-local --serverless-version 4 --dry-run
diff --git a/acceptance/localenv/wildcard-constraint-conflict-check/test.toml b/acceptance/localenv/wildcard-constraint-conflict-check/test.toml
new file mode 100644
index 00000000000..5d8dd2778d6
--- /dev/null
+++ b/acceptance/localenv/wildcard-constraint-conflict-check/test.toml
@@ -0,0 +1,21 @@
+# The script writes pyproject.toml as the merge input; --dry-run leaves it unchanged.
+Ignore = ["pyproject.toml"]
+
+Env.DATABRICKS_LOCALENV_CONSTRAINT_SOURCE_URL_TEST_OVERRIDE = "$DATABRICKS_HOST"
+
+[[Server]]
+Pattern = "GET /serverless/serverless-v4/pyproject.toml"
+Response.Body = '''
+[project]
+requires-python = ">=3.12"
+
+[dependency-groups]
+dev = ["databricks-connect~=17.2.0"]
+
+[tool.uv]
+constraint-dependencies = ["pyarrow~=19.0"]
+'''
+
+[[Repls]]
+Old = 'uv uv \S+(?: \([^)]+\))?'
+New = 'uv [UV_VERSION]'
diff --git a/acceptance/localenv/workspace-discovery-unsupported-check/bundles/a/pyproject.toml b/acceptance/localenv/workspace-discovery-unsupported-check/bundles/a/pyproject.toml
new file mode 100644
index 00000000000..962b088a2b0
--- /dev/null
+++ b/acceptance/localenv/workspace-discovery-unsupported-check/bundles/a/pyproject.toml
@@ -0,0 +1,4 @@
+[project]
+name = "a"
+version = "0.1.0"
+requires-python = ">=3.10"
diff --git a/acceptance/localenv/workspace-discovery-unsupported-check/fake-uv.sh b/acceptance/localenv/workspace-discovery-unsupported-check/fake-uv.sh
new file mode 100644
index 00000000000..9e18385562b
--- /dev/null
+++ b/acceptance/localenv/workspace-discovery-unsupported-check/fake-uv.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+# uv older than 0.9.9 has no `workspace` subcommand.
+if [ "$1" = "workspace" ]; then
+  echo "error: unrecognized subcommand 'workspace'" >&2
+  exit 2
+fi
+echo "fake uv: unexpected call: $*" >&2
+exit 1
diff --git a/acceptance/localenv/workspace-discovery-unsupported-check/out.test.toml b/acceptance/localenv/workspace-discovery-unsupported-check/out.test.toml
new file mode 100644
index 00000000000..2e1543aa802
--- /dev/null
+++ b/acceptance/localenv/workspace-discovery-unsupported-check/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+GOOS.windows = false
diff --git a/acceptance/localenv/workspace-discovery-unsupported-check/output.txt b/acceptance/localenv/workspace-discovery-unsupported-check/output.txt
new file mode 100644
index 00000000000..dcb8fe5bc95
--- /dev/null
+++ b/acceptance/localenv/workspace-discovery-unsupported-check/output.txt
@@ -0,0 +1,60 @@
+
+>>> [CLI] environments setup-local --serverless-version 4 --dry-run --output json
+{
+  "schemaVersion": 1,
+  "command": "environments setup-local",
+  "ok": true,
+  "mode": "default",
+  "dryRun": true,
+  "compute": {
+    "source": "serverless",
+    "serverlessVersion": "v4",
+    "envKey": "serverless/serverless-v4"
+  },
+  "resolved": {
+    "pythonVersion": "3.12",
+    "dbconnectVersion": "17.2.0",
+    "artifactSource": "network"
+  },
+  "greenfield": false,
+  "plan": {
+    "wouldWrite": "[TEST_TMP_DIR]/bundles/a/pyproject.toml",
+    "wouldBackup": "[TEST_TMP_DIR]/bundles/a/pyproject.toml.bak",
+    "wouldInstallPython": "3.12",
+    "diff": "--- pyproject.toml\n+++ pyproject.toml.new\n@@ -1,4 +1,20 @@\n [project]\n name = \"a\"\n version = \"0.1.0\"\n-requires-python = \"\u003e=3.10\"\n+requires-python = \"\u003e=3.12\"\n+\n+[dependency-groups]\n+dev = [\n+    \"databricks-connect~=17.2.0\",\n+]\n+\n+[tool.databricks.environment]\n+environment_version = \"4\"\n+\n+# managed by databricks environments setup-local — do not edit\n+[tool.uv]\n+constraint-dependencies = [\n+    \"pyarrow\u003c19\",\n+    \"pandas\u003c3\",\n+]\n+# end managed by databricks environments setup-local\n"
+  },
+  "phases": [
+    {
+      "phase": "preflight",
+      "status": "ok"
+    },
+    {
+      "phase": "resolve",
+      "status": "ok"
+    },
+    {
+      "phase": "fetch",
+      "status": "ok"
+    },
+    {
+      "phase": "merge",
+      "status": "ok"
+    },
+    {
+      "phase": "provision",
+      "status": "ok"
+    },
+    {
+      "phase": "validate",
+      "status": "ok"
+    }
+  ],
+  "warnings": [
+    {
+      "code": "W_REQUIRES_PYTHON_OVERRIDDEN",
+      "message": "requires-python \"\u003e=3.10\" is replaced by the environment's \"\u003e=3.12\""
+    }
+  ],
+  "error": null,
+  "durationMs": [DURATION_MS]
+}
diff --git a/acceptance/localenv/workspace-discovery-unsupported-check/pyproject.toml b/acceptance/localenv/workspace-discovery-unsupported-check/pyproject.toml
new file mode 100644
index 00000000000..7a29f61f24a
--- /dev/null
+++ b/acceptance/localenv/workspace-discovery-unsupported-check/pyproject.toml
@@ -0,0 +1,7 @@
+[project]
+name = "root"
+version = "0.1.0"
+requires-python = ">=3.10"
+
+[tool.uv.workspace]
+members = ["bundles/*"]
diff --git a/acceptance/localenv/workspace-discovery-unsupported-check/script b/acceptance/localenv/workspace-discovery-unsupported-check/script
new file mode 100644
index 00000000000..f2c37466149
--- /dev/null
+++ b/acceptance/localenv/workspace-discovery-unsupported-check/script
@@ -0,0 +1,11 @@
+# uv older than 0.9.9 cannot report the workspace root, so in a workspace member
+# the plan is the same as for a standalone project: no workspace fields.
+mv fake-uv.sh uv
+chmod +x uv
+cleanup() {
+  rm -f uv
+}
+trap cleanup EXIT
+export PATH="$(pwd):$PATH"
+
+withdir bundles/a trace $CLI environments setup-local --serverless-version 4 --dry-run --output json
diff --git a/acceptance/localenv/workspace-discovery-unsupported-check/test.toml b/acceptance/localenv/workspace-discovery-unsupported-check/test.toml
new file mode 100644
index 00000000000..1f85ab26622
--- /dev/null
+++ b/acceptance/localenv/workspace-discovery-unsupported-check/test.toml
@@ -0,0 +1,18 @@
+# The fake uv is a bash script, so this test cannot run on Windows runners
+# (mirrors acceptance/cmd/psql).
+GOOS.windows = false
+
+Env.DATABRICKS_LOCALENV_CONSTRAINT_SOURCE_URL_TEST_OVERRIDE = "$DATABRICKS_HOST"
+
+[[Server]]
+Pattern = "GET /serverless/serverless-v4/pyproject.toml"
+Response.Body = '''
+[project]
+requires-python = ">=3.12"
+
+[dependency-groups]
+dev = ["databricks-connect~=17.2.0"]
+
+[tool.uv]
+constraint-dependencies = ["pyarrow<19", "pandas<3"]
+'''
diff --git a/acceptance/localenv/workspace-member-check/bundles/a/pyproject.toml b/acceptance/localenv/workspace-member-check/bundles/a/pyproject.toml
new file mode 100644
index 00000000000..962b088a2b0
--- /dev/null
+++ b/acceptance/localenv/workspace-member-check/bundles/a/pyproject.toml
@@ -0,0 +1,4 @@
+[project]
+name = "a"
+version = "0.1.0"
+requires-python = ">=3.10"
diff --git a/acceptance/localenv/workspace-member-check/fake-uv.sh b/acceptance/localenv/workspace-member-check/fake-uv.sh
new file mode 100644
index 00000000000..34452908cdd
--- /dev/null
+++ b/acceptance/localenv/workspace-member-check/fake-uv.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+# The workspace root is the test folder, where this script is installed as uv.
+if [ "$1" = "workspace" ] && [ "$2" = "dir" ]; then
+  cd "$(dirname "$0")" && pwd
+  exit 0
+fi
+echo "fake uv: unexpected call: $*" >&2
+exit 1
diff --git a/acceptance/localenv/workspace-member-check/out.test.toml b/acceptance/localenv/workspace-member-check/out.test.toml
new file mode 100644
index 00000000000..2e1543aa802
--- /dev/null
+++ b/acceptance/localenv/workspace-member-check/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+GOOS.windows = false
diff --git a/acceptance/localenv/workspace-member-check/output.txt b/acceptance/localenv/workspace-member-check/output.txt
new file mode 100644
index 00000000000..b9fa432530e
--- /dev/null
+++ b/acceptance/localenv/workspace-member-check/output.txt
@@ -0,0 +1,73 @@
+
+>>> [CLI] environments setup-local --serverless-version 4 --dry-run
+warning: requires-python ">=3.10" is replaced by the environment's ">=3.12"
+Plan: [TEST_TMP_DIR]/bundles/a/pyproject.toml
+Plan: [TEST_TMP_DIR]/pyproject.toml (uv workspace root)
+  changed region: requires-python
+  changed region: databricks-connect
+  changed region: tool.databricks.environment
+  changed region: tool.uv.constraint-dependencies (uv workspace root)
+Check complete. No files were modified.
+
+>>> [CLI] environments setup-local --serverless-version 4 --dry-run --output json
+{
+  "schemaVersion": 1,
+  "command": "environments setup-local",
+  "ok": true,
+  "mode": "default",
+  "dryRun": true,
+  "compute": {
+    "source": "serverless",
+    "serverlessVersion": "v4",
+    "envKey": "serverless/serverless-v4"
+  },
+  "resolved": {
+    "pythonVersion": "3.12",
+    "dbconnectVersion": "17.2.0",
+    "artifactSource": "network"
+  },
+  "greenfield": false,
+  "plan": {
+    "wouldWrite": "[TEST_TMP_DIR]/bundles/a/pyproject.toml",
+    "wouldBackup": "[TEST_TMP_DIR]/bundles/a/pyproject.toml.bak",
+    "wouldWriteUvWorkspace": "[TEST_TMP_DIR]/pyproject.toml",
+    "wouldBackupUvWorkspace": "[TEST_TMP_DIR]/pyproject.toml.bak",
+    "wouldInstallPython": "3.12",
+    "diff": "--- pyproject.toml\n+++ pyproject.toml.new\n@@ -1,4 +1,12 @@\n [project]\n name = \"a\"\n version = \"0.1.0\"\n-requires-python = \"\u003e=3.10\"\n+requires-python = \"\u003e=3.12\"\n+\n+[dependency-groups]\n+dev = [\n+    \"databricks-connect~=17.2.0\",\n+]\n+\n+[tool.databricks.environment]\n+environment_version = \"4\"\n--- uv workspace root pyproject.toml\n+++ uv workspace root pyproject.toml.new\n@@ -5,3 +5,11 @@\n \n [tool.uv.workspace]\n members = [\"bundles/*\"]\n+\n+# managed by databricks environments setup-local — do not edit\n+[tool.uv]\n+constraint-dependencies = [\n+    \"pyarrow\u003c19\",\n+    \"pandas\u003c3\",\n+]\n+# end managed by databricks environments setup-local\n"
+  },
+  "uvWorkspaceRoot": "[TEST_TMP_DIR]",
+  "phases": [
+    {
+      "phase": "preflight",
+      "status": "ok"
+    },
+    {
+      "phase": "resolve",
+      "status": "ok"
+    },
+    {
+      "phase": "fetch",
+      "status": "ok"
+    },
+    {
+      "phase": "merge",
+      "status": "ok"
+    },
+    {
+      "phase": "provision",
+      "status": "ok"
+    },
+    {
+      "phase": "validate",
+      "status": "ok"
+    }
+  ],
+  "warnings": [
+    {
+      "code": "W_REQUIRES_PYTHON_OVERRIDDEN",
+      "message": "requires-python \"\u003e=3.10\" is replaced by the environment's \"\u003e=3.12\""
+    }
+  ],
+  "error": null,
+  "durationMs": [DURATION_MS]
+}
diff --git a/acceptance/localenv/workspace-member-check/pyproject.toml b/acceptance/localenv/workspace-member-check/pyproject.toml
new file mode 100644
index 00000000000..7a29f61f24a
--- /dev/null
+++ b/acceptance/localenv/workspace-member-check/pyproject.toml
@@ -0,0 +1,7 @@
+[project]
+name = "root"
+version = "0.1.0"
+requires-python = ">=3.10"
+
+[tool.uv.workspace]
+members = ["bundles/*"]
diff --git a/acceptance/localenv/workspace-member-check/script b/acceptance/localenv/workspace-member-check/script
new file mode 100644
index 00000000000..ec88e4f62e2
--- /dev/null
+++ b/acceptance/localenv/workspace-member-check/script
@@ -0,0 +1,13 @@
+# A uv workspace member: the plan writes the member pyproject.toml and the
+# constraint block into the workspace root pyproject.toml. A fake uv on PATH
+# answers `uv workspace dir` (see acceptance/cmd/psql for the pattern).
+mv fake-uv.sh uv
+chmod +x uv
+cleanup() {
+  rm -f uv
+}
+trap cleanup EXIT
+export PATH="$(pwd):$PATH"
+
+withdir bundles/a trace $CLI environments setup-local --serverless-version 4 --dry-run
+withdir bundles/a trace $CLI environments setup-local --serverless-version 4 --dry-run --output json
diff --git a/acceptance/localenv/workspace-member-check/test.toml b/acceptance/localenv/workspace-member-check/test.toml
new file mode 100644
index 00000000000..1f85ab26622
--- /dev/null
+++ b/acceptance/localenv/workspace-member-check/test.toml
@@ -0,0 +1,18 @@
+# The fake uv is a bash script, so this test cannot run on Windows runners
+# (mirrors acceptance/cmd/psql).
+GOOS.windows = false
+
+Env.DATABRICKS_LOCALENV_CONSTRAINT_SOURCE_URL_TEST_OVERRIDE = "$DATABRICKS_HOST"
+
+[[Server]]
+Pattern = "GET /serverless/serverless-v4/pyproject.toml"
+Response.Body = '''
+[project]
+requires-python = ">=3.12"
+
+[dependency-groups]
+dev = ["databricks-connect~=17.2.0"]
+
+[tool.uv]
+constraint-dependencies = ["pyarrow<19", "pandas<3"]
+'''
diff --git a/acceptance/localenv/workspace-member-project-env/bundles/a/pyproject.toml b/acceptance/localenv/workspace-member-project-env/bundles/a/pyproject.toml
new file mode 100644
index 00000000000..962b088a2b0
--- /dev/null
+++ b/acceptance/localenv/workspace-member-project-env/bundles/a/pyproject.toml
@@ -0,0 +1,4 @@
+[project]
+name = "a"
+version = "0.1.0"
+requires-python = ">=3.10"
diff --git a/acceptance/localenv/workspace-member-project-env/fake-uv.sh b/acceptance/localenv/workspace-member-project-env/fake-uv.sh
new file mode 100644
index 00000000000..5f52746a189
--- /dev/null
+++ b/acceptance/localenv/workspace-member-project-env/fake-uv.sh
@@ -0,0 +1,26 @@
+#!/bin/bash
+# The workspace root is the test folder, where this script is installed as uv.
+# Like real uv, `uv sync` creates the environment at UV_PROJECT_ENVIRONMENT
+# (relative to the workspace root), with a fake interpreter that answers the
+# validate probe (prefixes from libs/localenv/uv.go).
+root="$(cd "$(dirname "$0")" && pwd)"
+venv="$root/${UV_PROJECT_ENVIRONMENT:-.venv}"
+case "$1 $2" in
+  "--version ") echo "uv 0.12.9 (fake)"; exit 0 ;;
+  "workspace dir") echo "$root"; exit 0 ;;
+  "python install") exit 0 ;;
+  "pip install") exit 0 ;;
+  "sync --python")
+    mkdir -p "$venv/bin"
+    cat > "$venv/bin/python" <<'PY'
+#!/bin/bash
+echo "PYVER:3.12"
+echo "DBCVER:17.2.0"
+echo "PYSPARKVER:"
+echo "DBCIMPORT:"
+PY
+    chmod +x "$venv/bin/python"
+    exit 0 ;;
+esac
+echo "fake uv: unexpected call: $*" >&2
+exit 1
diff --git a/acceptance/localenv/workspace-member-project-env/out.test.toml b/acceptance/localenv/workspace-member-project-env/out.test.toml
new file mode 100644
index 00000000000..2e1543aa802
--- /dev/null
+++ b/acceptance/localenv/workspace-member-project-env/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+GOOS.windows = false
diff --git a/acceptance/localenv/workspace-member-project-env/output.txt b/acceptance/localenv/workspace-member-project-env/output.txt
new file mode 100644
index 00000000000..a5366a75bdf
--- /dev/null
+++ b/acceptance/localenv/workspace-member-project-env/output.txt
@@ -0,0 +1,16 @@
+
+>>> [CLI] environments setup-local --serverless-version 4
+warning: requires-python ">=3.10" is replaced by the environment's ">=3.12"
+✔ Local environment ready
+
+  Compute target      serverless 4
+  Python              3.12
+  databricks-connect  17.2.0
+  Virtual env         ../../custom env
+  pyproject.toml      updated (backup: [TEST_TMP_DIR]/bundles/a/pyproject.toml.bak)
+  uv workspace root   [TEST_TMP_DIR]
+  Root pyproject.toml constraints updated (backup: [TEST_TMP_DIR]/pyproject.toml.bak)
+
+Next steps:
+  • Activate it:  source '../../custom env/bin/activate'
+  • Or select ../../custom env as the Python interpreter in VS Code / Cursor
diff --git a/acceptance/localenv/workspace-member-project-env/pyproject.toml b/acceptance/localenv/workspace-member-project-env/pyproject.toml
new file mode 100644
index 00000000000..7a29f61f24a
--- /dev/null
+++ b/acceptance/localenv/workspace-member-project-env/pyproject.toml
@@ -0,0 +1,7 @@
+[project]
+name = "root"
+version = "0.1.0"
+requires-python = ">=3.10"
+
+[tool.uv.workspace]
+members = ["bundles/*"]
diff --git a/acceptance/localenv/workspace-member-project-env/script b/acceptance/localenv/workspace-member-project-env/script
new file mode 100644
index 00000000000..a9148f5f42f
--- /dev/null
+++ b/acceptance/localenv/workspace-member-project-env/script
@@ -0,0 +1,14 @@
+# With UV_PROJECT_ENVIRONMENT set, the shared environment is that folder
+# (relative to the workspace root), not .venv. The name holds a space, so the
+# activate hint quotes it. A fake uv on PATH stands in for the
+# network-dependent sync (see acceptance/cmd/psql).
+mv fake-uv.sh uv
+chmod +x uv
+cleanup() {
+  rm -f uv
+}
+trap cleanup EXIT
+export PATH="$(pwd):$PATH"
+export UV_PROJECT_ENVIRONMENT="custom env"
+
+withdir bundles/a trace $CLI environments setup-local --serverless-version 4
diff --git a/acceptance/localenv/workspace-member-project-env/test.toml b/acceptance/localenv/workspace-member-project-env/test.toml
new file mode 100644
index 00000000000..c896c0fc247
--- /dev/null
+++ b/acceptance/localenv/workspace-member-project-env/test.toml
@@ -0,0 +1,22 @@
+# The fake uv is a bash script, so this test cannot run on Windows runners
+# (mirrors acceptance/cmd/psql).
+GOOS.windows = false
+
+# The run writes both pyproject.toml files, their backups, and the shared
+# environment "custom env" at the workspace root.
+Ignore = ["custom env", "pyproject.toml.bak", "bundles/a/pyproject.toml.bak"]
+
+Env.DATABRICKS_LOCALENV_CONSTRAINT_SOURCE_URL_TEST_OVERRIDE = "$DATABRICKS_HOST"
+
+[[Server]]
+Pattern = "GET /serverless/serverless-v4/pyproject.toml"
+Response.Body = '''
+[project]
+requires-python = ">=3.12"
+
+[dependency-groups]
+dev = ["databricks-connect~=17.2.0"]
+
+[tool.uv]
+constraint-dependencies = ["pyarrow<19", "pandas<3"]
+'''
diff --git a/acceptance/localenv/workspace-member/bundles/a/pyproject.toml b/acceptance/localenv/workspace-member/bundles/a/pyproject.toml
new file mode 100644
index 00000000000..962b088a2b0
--- /dev/null
+++ b/acceptance/localenv/workspace-member/bundles/a/pyproject.toml
@@ -0,0 +1,4 @@
+[project]
+name = "a"
+version = "0.1.0"
+requires-python = ">=3.10"
diff --git a/acceptance/localenv/workspace-member/fake-uv.sh b/acceptance/localenv/workspace-member/fake-uv.sh
new file mode 100644
index 00000000000..9b63430c86e
--- /dev/null
+++ b/acceptance/localenv/workspace-member/fake-uv.sh
@@ -0,0 +1,24 @@
+#!/bin/bash
+# The workspace root is the test folder, where this script is installed as uv.
+# `uv sync` creates the shared venv there with a fake interpreter that answers
+# the validate probe (prefixes from libs/localenv/uv.go).
+root="$(cd "$(dirname "$0")" && pwd)"
+case "$1 $2" in
+  "--version ") echo "uv 0.12.9 (fake)"; exit 0 ;;
+  "workspace dir") echo "$root"; exit 0 ;;
+  "python install") exit 0 ;;
+  "pip install") exit 0 ;;
+  "sync --python")
+    mkdir -p "$root/.venv/bin"
+    cat > "$root/.venv/bin/python" <<'PY'
+#!/bin/bash
+echo "PYVER:3.12"
+echo "DBCVER:17.2.0"
+echo "PYSPARKVER:"
+echo "DBCIMPORT:"
+PY
+    chmod +x "$root/.venv/bin/python"
+    exit 0 ;;
+esac
+echo "fake uv: unexpected call: $*" >&2
+exit 1
diff --git a/acceptance/localenv/workspace-member/out.test.toml b/acceptance/localenv/workspace-member/out.test.toml
new file mode 100644
index 00000000000..2e1543aa802
--- /dev/null
+++ b/acceptance/localenv/workspace-member/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+GOOS.windows = false
diff --git a/acceptance/localenv/workspace-member/output.txt b/acceptance/localenv/workspace-member/output.txt
new file mode 100644
index 00000000000..5a05c6f4c08
--- /dev/null
+++ b/acceptance/localenv/workspace-member/output.txt
@@ -0,0 +1,105 @@
+
+>>> [CLI] environments setup-local --serverless-version 4 --output json
+{
+  "schemaVersion": 1,
+  "command": "environments setup-local",
+  "ok": true,
+  "mode": "default",
+  "dryRun": false,
+  "compute": {
+    "source": "serverless",
+    "serverlessVersion": "v4",
+    "envKey": "serverless/serverless-v4"
+  },
+  "resolved": {
+    "pythonVersion": "3.12",
+    "dbconnectVersion": "17.2.0",
+    "artifactSource": "network"
+  },
+  "greenfield": false,
+  "venvPath": "../../.venv",
+  "uvWorkspaceRoot": "[TEST_TMP_DIR]",
+  "pythonResolution": "uv_install_succeeded",
+  "phases": [
+    {
+      "phase": "preflight",
+      "status": "ok"
+    },
+    {
+      "phase": "resolve",
+      "status": "ok"
+    },
+    {
+      "phase": "fetch",
+      "status": "ok"
+    },
+    {
+      "phase": "merge",
+      "status": "ok"
+    },
+    {
+      "phase": "provision",
+      "status": "ok"
+    },
+    {
+      "phase": "validate",
+      "status": "ok"
+    }
+  ],
+  "warnings": [
+    {
+      "code": "W_REQUIRES_PYTHON_OVERRIDDEN",
+      "message": "requires-python \"\u003e=3.10\" is replaced by the environment's \"\u003e=3.12\""
+    }
+  ],
+  "error": null,
+  "backupPath": "[TEST_TMP_DIR]/bundles/a/pyproject.toml.bak",
+  "uvWorkspaceBackupPath": "[TEST_TMP_DIR]/pyproject.toml.bak",
+  "durationMs": [DURATION_MS]
+}
+
+>>> [CLI] environments setup-local --serverless-version 4
+✔ Local environment ready
+
+  Compute target      serverless 4
+  Python              3.12
+  databricks-connect  17.2.0
+  Virtual env         ../../.venv
+  pyproject.toml      updated
+  uv workspace root   [TEST_TMP_DIR]
+  Root pyproject.toml unchanged
+
+Next steps:
+  • Activate it:  source ../../.venv/bin/activate
+  • Or select ../../.venv as the Python interpreter in VS Code / Cursor
+
+>>> cat pyproject.toml
+[project]
+name = "root"
+version = "0.1.0"
+requires-python = ">=3.10"
+
+[tool.uv.workspace]
+members = ["bundles/*"]
+
+# managed by databricks environments setup-local — do not edit
+[tool.uv]
+constraint-dependencies = [
+    "pyarrow<19",
+    "pandas<3",
+]
+# end managed by databricks environments setup-local
+
+>>> cat bundles/a/pyproject.toml
+[project]
+name = "a"
+version = "0.1.0"
+requires-python = ">=3.12"
+
+[dependency-groups]
+dev = [
+    "databricks-connect~=17.2.0",
+]
+
+[tool.databricks.environment]
+environment_version = "4"
diff --git a/acceptance/localenv/workspace-member/pyproject.toml b/acceptance/localenv/workspace-member/pyproject.toml
new file mode 100644
index 00000000000..7a29f61f24a
--- /dev/null
+++ b/acceptance/localenv/workspace-member/pyproject.toml
@@ -0,0 +1,7 @@
+[project]
+name = "root"
+version = "0.1.0"
+requires-python = ">=3.10"
+
+[tool.uv.workspace]
+members = ["bundles/*"]
diff --git a/acceptance/localenv/workspace-member/script b/acceptance/localenv/workspace-member/script
new file mode 100644
index 00000000000..0e2f3b7218f
--- /dev/null
+++ b/acceptance/localenv/workspace-member/script
@@ -0,0 +1,17 @@
+# A real run in a uv workspace member provisions the shared .venv at the
+# workspace root and writes the constraint block into the root pyproject.toml.
+# The member keeps requires-python and the databricks-connect pin. A fake uv on
+# PATH stands in for the network-dependent sync (see acceptance/cmd/psql).
+mv fake-uv.sh uv
+chmod +x uv
+cleanup() {
+  rm -f uv
+}
+trap cleanup EXIT
+export PATH="$(pwd):$PATH"
+
+withdir bundles/a trace $CLI environments setup-local --serverless-version 4 --output json
+# A re-run changes nothing, and the text summary says so for the root.
+withdir bundles/a trace $CLI environments setup-local --serverless-version 4
+trace cat pyproject.toml
+trace cat bundles/a/pyproject.toml
diff --git a/acceptance/localenv/workspace-member/test.toml b/acceptance/localenv/workspace-member/test.toml
new file mode 100644
index 00000000000..0f62f56b8cc
--- /dev/null
+++ b/acceptance/localenv/workspace-member/test.toml
@@ -0,0 +1,22 @@
+# The fake uv is a bash script, so this test cannot run on Windows runners
+# (mirrors acceptance/cmd/psql).
+GOOS.windows = false
+
+# The run writes both pyproject.toml files (checked with cat below), their
+# backups, and the shared .venv at the workspace root.
+Ignore = [".venv", "pyproject.toml.bak", "bundles/a/pyproject.toml.bak"]
+
+Env.DATABRICKS_LOCALENV_CONSTRAINT_SOURCE_URL_TEST_OVERRIDE = "$DATABRICKS_HOST"
+
+[[Server]]
+Pattern = "GET /serverless/serverless-v4/pyproject.toml"
+Response.Body = '''
+[project]
+requires-python = ">=3.12"
+
+[dependency-groups]
+dev = ["databricks-connect~=17.2.0"]
+
+[tool.uv]
+constraint-dependencies = ["pyarrow<19", "pandas<3"]
+'''
diff --git a/acceptance/panic/out.test.toml b/acceptance/panic/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/panic/out.test.toml
+++ b/acceptance/panic/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/panic/output.txt b/acceptance/panic/output.txt
index 9dca41c238e..cb0c3c93118 100644
--- a/acceptance/panic/output.txt
+++ b/acceptance/panic/output.txt
@@ -4,7 +4,7 @@ The Databricks CLI unexpectedly had a fatal error.
 Please report this issue to Databricks in the form of a GitHub issue at:
 https://github.com/databricks/cli
 
-CLI Version: [DEV_VERSION]
+CLI Version: [CLI_VERSION]
 
 Panic Payload: the databricks selftest panic command always panics
 
diff --git a/acceptance/pipelines/databricks-cli-help/out.test.toml b/acceptance/pipelines/databricks-cli-help/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/pipelines/databricks-cli-help/out.test.toml
+++ b/acceptance/pipelines/databricks-cli-help/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/pipelines/databricks-cli-help/output.txt b/acceptance/pipelines/databricks-cli-help/output.txt
index 9043af0f127..8514fa33b2b 100644
--- a/acceptance/pipelines/databricks-cli-help/output.txt
+++ b/acceptance/pipelines/databricks-cli-help/output.txt
@@ -18,7 +18,7 @@ Usage:
   databricks pipelines [flags]
   databricks pipelines [command]
 
-Available Commands
+Main Commands
   deploy                Deploy pipelines
   destroy               Destroy a pipelines project
   dry-run               Validate correctness of the pipeline's graph
@@ -28,10 +28,11 @@ Available Commands
   logs                  Retrieve events for a pipeline
   open                  Open a pipeline in the browser
   run                   Run a pipeline
+  show                  Preview a table's columns and sample rows
   stop                  Stop a pipeline
 
 Management Commands
-  apply-environment     Apply the latest environment to the pipeline.
+  apply-environment     *Public Preview* Apply the latest environment to the pipeline.
   clone                 Clone a pipeline.
   create                Create a pipeline.
   delete                Delete a pipeline.
diff --git a/acceptance/pipelines/deploy/auto-approve/out.test.toml b/acceptance/pipelines/deploy/auto-approve/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/pipelines/deploy/auto-approve/out.test.toml
+++ b/acceptance/pipelines/deploy/auto-approve/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/pipelines/deploy/auto-approve/output.txt b/acceptance/pipelines/deploy/auto-approve/output.txt
index ff5ac099bfd..ab4d3a151d7 100644
--- a/acceptance/pipelines/deploy/auto-approve/output.txt
+++ b/acceptance/pipelines/deploy/auto-approve/output.txt
@@ -1,10 +1,10 @@
 
 >>> [CLI] pipelines deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-pipeline-auto-approve/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-View your pipeline foo here: [DATABRICKS_URL]/pipelines/[UUID]?o=[NUMID]
+Created pipelines.foo
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+View your pipeline foo here: [DATABRICKS_URL]/pipelines/[UUID]?w=[WORKSPACE_ID]
 
 === Remove resources from configuration to test auto-approve
 >>> rm resources.yml
@@ -18,8 +18,11 @@ Streaming Tables (STs) and Materialized Views (MVs) managed by them. Recreating
 restore the defined STs and MVs through full refresh. Note that recreation is necessary when pipeline
 properties such as the 'catalog' or 'storage' are changed:
   delete resources.pipelines.foo
-Error: the deployment requires destructive actions, but current console does not support prompting. Please specify --auto-approve if you would like to skip prompts and proceed
+Error: the deployment requires destructive actions, but the current console does not support prompting.
+Deleting data assets such as schemas, pipelines, or volumes may cause permanent data loss and should be carefully reviewed.
+To proceed, use --auto-approve after reviewing the plan above.
 
+Files: 0 uploaded, 1 deleted
 
 Exit code: 1
 
@@ -32,6 +35,6 @@ Streaming Tables (STs) and Materialized Views (MVs) managed by them. Recreating
 restore the defined STs and MVs through full refresh. Note that recreation is necessary when pipeline
 properties such as the 'catalog' or 'storage' are changed:
   delete resources.pipelines.foo
-Deploying resources...
-Updating deployment state...
-Deployment complete!
+Deleted pipelines.foo
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 1 deleted, 0 unchanged
diff --git a/acceptance/pipelines/deploy/create-pipeline/out.test.toml b/acceptance/pipelines/deploy/create-pipeline/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/pipelines/deploy/create-pipeline/out.test.toml
+++ b/acceptance/pipelines/deploy/create-pipeline/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/pipelines/deploy/create-pipeline/output.txt b/acceptance/pipelines/deploy/create-pipeline/output.txt
index ca6cd27e975..ad253d3a5e8 100644
--- a/acceptance/pipelines/deploy/create-pipeline/output.txt
+++ b/acceptance/pipelines/deploy/create-pipeline/output.txt
@@ -1,10 +1,10 @@
 
 >>> [CLI] pipelines deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-create-pipeline/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-View your pipeline foo here: [DATABRICKS_URL]/pipelines/[UUID]?o=[NUMID]
+Created pipelines.foo
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+View your pipeline foo here: [DATABRICKS_URL]/pipelines/[UUID]?w=[WORKSPACE_ID]
 
 >>> [CLI] pipelines get [UUID]
 {
@@ -27,3 +27,8 @@ View your pipeline foo here: [DATABRICKS_URL]/pipelines/[UUID]?o=[NUMID]
     "storage": "dbfs:/pipelines/[UUID]"
   }
 }
+
+>>> [CLI] pipelines deploy --quiet
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-create-pipeline/default/files...
+Files: 0 uploaded, 0 deleted
+Resources: 0 created, 0 changed, 0 deleted, 1 unchanged
diff --git a/acceptance/pipelines/deploy/create-pipeline/script b/acceptance/pipelines/deploy/create-pipeline/script
index 2f571804bba..041bb3fbcd8 100644
--- a/acceptance/pipelines/deploy/create-pipeline/script
+++ b/acceptance/pipelines/deploy/create-pipeline/script
@@ -1,3 +1,6 @@
 trace $CLI pipelines deploy
 PIPELINE_ID=$($CLI bundle summary -o json | jq -r '.resources.pipelines.foo.id')
 trace $CLI pipelines get "${PIPELINE_ID}" | jq "{spec}"
+
+# --quiet prints only the summary line: no per-resource line, no "View your ... here".
+trace $CLI pipelines deploy --quiet
diff --git a/acceptance/pipelines/deploy/fail-on-active-runs/out.test.toml b/acceptance/pipelines/deploy/fail-on-active-runs/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/pipelines/deploy/fail-on-active-runs/out.test.toml
+++ b/acceptance/pipelines/deploy/fail-on-active-runs/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/pipelines/deploy/fail-on-active-runs/output.txt b/acceptance/pipelines/deploy/fail-on-active-runs/output.txt
index c9057378a48..14ff2fd2e1b 100644
--- a/acceptance/pipelines/deploy/fail-on-active-runs/output.txt
+++ b/acceptance/pipelines/deploy/fail-on-active-runs/output.txt
@@ -1,10 +1,10 @@
 
 >>> [CLI] pipelines deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/pipeline-fail-on-active-runs/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-View your pipeline my_pipeline here: [DATABRICKS_URL]/pipelines/[UUID]?o=[NUMID]
+Created pipelines.my_pipeline
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+View your pipeline my_pipeline here: [DATABRICKS_URL]/pipelines/[UUID]?w=[WORKSPACE_ID]
 
 >>> [CLI] pipelines deploy --fail-on-active-runs
 Error: pipeline [UUID] is running
diff --git a/acceptance/pipelines/deploy/force-lock/out.test.toml b/acceptance/pipelines/deploy/force-lock/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/pipelines/deploy/force-lock/out.test.toml
+++ b/acceptance/pipelines/deploy/force-lock/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/pipelines/deploy/force-lock/output.txt b/acceptance/pipelines/deploy/force-lock/output.txt
index e5fdadbaf9d..e3922e9a536 100644
--- a/acceptance/pipelines/deploy/force-lock/output.txt
+++ b/acceptance/pipelines/deploy/force-lock/output.txt
@@ -4,8 +4,12 @@
 
 === test deployment without force-lock (should fail)
 >>> errcode [CLI] pipelines deploy
-Error: Failed to acquire deployment lock: deploy lock acquired by user-with-lock@databricks.com at [TIMESTAMP] +0000 UTC. Use --force-lock to override
-Error: deploy lock acquired by user-with-lock@databricks.com at [TIMESTAMP] +0000 UTC. Use --force-lock to override
+Error: Failed to acquire deployment lock: deploy lock acquired by user-with-lock@databricks.com at [TIMESTAMP] +0000 UTC.
+Another deployment may be in progress. Use --force-lock to override, but this may
+conflict with the other deployment if it is still active
+Error: deploy lock acquired by user-with-lock@databricks.com at [TIMESTAMP] +0000 UTC.
+Another deployment may be in progress. Use --force-lock to override, but this may
+conflict with the other deployment if it is still active
 
 
 Exit code: 1
@@ -13,7 +17,7 @@ Exit code: 1
 === test deployment with force-lock (should succeed)
 >>> [CLI] pipelines deploy --force-lock
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-pipeline-force-lock/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-View your pipeline foo here: [DATABRICKS_URL]/pipelines/[UUID]?o=[NUMID]
+Created pipelines.foo
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+View your pipeline foo here: [DATABRICKS_URL]/pipelines/[UUID]?w=[WORKSPACE_ID]
diff --git a/acceptance/pipelines/deploy/force-lock/script b/acceptance/pipelines/deploy/force-lock/script
index 0879c49c71d..9e63b7fdad3 100644
--- a/acceptance/pipelines/deploy/force-lock/script
+++ b/acceptance/pipelines/deploy/force-lock/script
@@ -1,6 +1,9 @@
 export username=$($CLI current-user me | jq -r .userName)
 export MSYS_NO_PATHCONV=1
 title "upload lock file"
+# The import API returns a 404 if the parent directory does not exist. No deploy has
+# run yet, so create the state directory before uploading the lock file into it.
+$CLI workspace mkdirs /Workspace/Users/$username/.bundle/test-pipeline-force-lock/default/state
 trace $CLI workspace import /Workspace/Users/$username/.bundle/test-pipeline-force-lock/default/state/deploy.lock --format AUTO --file ./deploy.lock
 
 title "test deployment without force-lock (should fail)"
diff --git a/acceptance/pipelines/deploy/oss-spark-error/out.test.toml b/acceptance/pipelines/deploy/oss-spark-error/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/pipelines/deploy/oss-spark-error/out.test.toml
+++ b/acceptance/pipelines/deploy/oss-spark-error/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/pipelines/deploy/render-diagnostics-warning/out.test.toml b/acceptance/pipelines/deploy/render-diagnostics-warning/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/pipelines/deploy/render-diagnostics-warning/out.test.toml
+++ b/acceptance/pipelines/deploy/render-diagnostics-warning/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/pipelines/deploy/render-diagnostics-warning/output.txt b/acceptance/pipelines/deploy/render-diagnostics-warning/output.txt
index efa65f931ae..abc05d1d7d5 100644
--- a/acceptance/pipelines/deploy/render-diagnostics-warning/output.txt
+++ b/acceptance/pipelines/deploy/render-diagnostics-warning/output.txt
@@ -5,8 +5,8 @@ Warning: unknown field: unknown_property
   in databricks.yml:8:7
 
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/render-diagnostics-warning-pipeline/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-View your pipeline test-pipeline here: [DATABRICKS_URL]/pipelines/[UUID]?o=[NUMID]
+Created pipelines.test-pipeline
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+View your pipeline test-pipeline here: [DATABRICKS_URL]/pipelines/[UUID]?w=[WORKSPACE_ID]
 <EOL>
diff --git a/acceptance/pipelines/deploy/var-flag/out.test.toml b/acceptance/pipelines/deploy/var-flag/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/pipelines/deploy/var-flag/out.test.toml
+++ b/acceptance/pipelines/deploy/var-flag/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/pipelines/deploy/var-flag/output.txt b/acceptance/pipelines/deploy/var-flag/output.txt
index 620c0966913..01fa4e82c5e 100644
--- a/acceptance/pipelines/deploy/var-flag/output.txt
+++ b/acceptance/pipelines/deploy/var-flag/output.txt
@@ -2,10 +2,10 @@
 === Test --var flag usage
 >>> [CLI] pipelines deploy --var=catalog=custom_catalog --var=schema=custom_schema --auto-approve
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-pipeline-var-flag/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-View your pipeline foo here: [DATABRICKS_URL]/pipelines/[UUID]?o=[NUMID]
+Created pipelines.foo
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+View your pipeline foo here: [DATABRICKS_URL]/pipelines/[UUID]?w=[WORKSPACE_ID]
 
 === Verify: Check that variables were substituted correctly
 >>> [CLI] pipelines get [UUID]
diff --git a/acceptance/pipelines/destroy/auto-approve/out.test.toml b/acceptance/pipelines/destroy/auto-approve/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/pipelines/destroy/auto-approve/out.test.toml
+++ b/acceptance/pipelines/destroy/auto-approve/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/pipelines/destroy/auto-approve/output.txt b/acceptance/pipelines/destroy/auto-approve/output.txt
index 17aecc20592..d792a3a0942 100644
--- a/acceptance/pipelines/destroy/auto-approve/output.txt
+++ b/acceptance/pipelines/destroy/auto-approve/output.txt
@@ -2,13 +2,15 @@
 === Test auto-approve pipelines destroy
 >>> [CLI] pipelines deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-pipeline-destroy/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-View your pipeline my_pipeline here: [DATABRICKS_URL]/pipelines/[UUID]?o=[NUMID]
+Created pipelines.my_pipeline
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+View your pipeline my_pipeline here: [DATABRICKS_URL]/pipelines/[UUID]?w=[WORKSPACE_ID]
 
 >>> errcode [CLI] pipelines destroy
-Error: please specify --auto-approve since terminal does not support interactive prompts
+Error: this command will destroy all resources deployed by this bundle, including workspace files in the deployment directory.
+Deleting data assets such as schemas, pipelines, or volumes may cause permanent data loss and should be carefully reviewed.
+To proceed, use --auto-approve.
 
 Exit code: 1
 
@@ -17,10 +19,9 @@ The following resources will be deleted:
   delete resources.pipelines.my_pipeline
 
 This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
-Streaming Tables (STs) and Materialized Views (MVs) managed by them:
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:
   delete resources.pipelines.my_pipeline
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-pipeline-destroy/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/pipelines/destroy/destroy-pipeline-cascade-state-divergence/databricks.yml b/acceptance/pipelines/destroy/destroy-pipeline-cascade-state-divergence/databricks.yml
new file mode 100644
index 00000000000..2f735bad878
--- /dev/null
+++ b/acceptance/pipelines/destroy/destroy-pipeline-cascade-state-divergence/databricks.yml
@@ -0,0 +1,7 @@
+bundle:
+  name: test-pipeline-destroy-cascade-divergence
+resources:
+  pipelines:
+    my_pipeline:
+      name: test-pipeline-cascade-divergence
+      cascade_on_destroy: true
diff --git a/acceptance/pipelines/destroy/destroy-pipeline-cascade-state-divergence/out.test.toml b/acceptance/pipelines/destroy/destroy-pipeline-cascade-state-divergence/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/pipelines/destroy/destroy-pipeline-cascade-state-divergence/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/pipelines/destroy/destroy-pipeline-cascade-state-divergence/output.txt b/acceptance/pipelines/destroy/destroy-pipeline-cascade-state-divergence/output.txt
new file mode 100644
index 00000000000..d2321f4fa70
--- /dev/null
+++ b/acceptance/pipelines/destroy/destroy-pipeline-cascade-state-divergence/output.txt
@@ -0,0 +1,46 @@
+
+=== Deploy a pipeline with cascade_on_destroy: true (state records true)
+>>> [CLI] pipelines deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-pipeline-destroy-cascade-divergence/default/files...
+Created pipelines.my_pipeline
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+View your pipeline my_pipeline here: [DATABRICKS_URL]/pipelines/[UUID]?w=[WORKSPACE_ID]
+
+>>> print_requests.py //api/2.0/pipelines
+{
+  "method": "POST",
+  "path": "/api/2.0/pipelines",
+  "body": {
+    "channel": "CURRENT",
+    "deployment": {
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-pipeline-destroy-cascade-divergence/default/state/metadata.json"
+    },
+    "edition": "ADVANCED",
+    "name": "test-pipeline-cascade-divergence"
+  }
+}
+
+=== Edit cascade_on_destroy true -> false in YAML WITHOUT deploying (config diverges from state)
+=== Destroy: banner and DELETE both reflect STATE (cascade=true), not the edited YAML
+>>> [CLI] pipelines destroy --auto-approve
+The following resources will be deleted:
+  delete resources.pipelines.my_pipeline
+
+This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:
+  delete resources.pipelines.my_pipeline
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-pipeline-destroy-cascade-divergence/default
+
+Destroy: 1 deleted
+
+>>> print_requests.py //api/2.0/pipelines
+{
+  "method": "DELETE",
+  "path": "/api/2.0/pipelines/[UUID]",
+  "q": {
+    "cascade": "true"
+  }
+}
diff --git a/acceptance/pipelines/destroy/destroy-pipeline-cascade-state-divergence/script b/acceptance/pipelines/destroy/destroy-pipeline-cascade-state-divergence/script
new file mode 100644
index 00000000000..feb1cf52f4a
--- /dev/null
+++ b/acceptance/pipelines/destroy/destroy-pipeline-cascade-state-divergence/script
@@ -0,0 +1,13 @@
+title "Deploy a pipeline with cascade_on_destroy: true (state records true)"
+trace $CLI pipelines deploy
+trace print_requests.py //api/2.0/pipelines
+
+title "Edit cascade_on_destroy true -> false in YAML WITHOUT deploying (config diverges from state)"
+update_file.py databricks.yml "cascade_on_destroy: true" "cascade_on_destroy: false"
+
+# The approval banner and the DELETE request must both reflect the persisted state (cascade=true),
+# not the edited-but-undeployed YAML. Otherwise the prompt would promise dataset retention while
+# the execution cascades and deletes them.
+title "Destroy: banner and DELETE both reflect STATE (cascade=true), not the edited YAML"
+trace $CLI pipelines destroy --auto-approve
+trace print_requests.py //api/2.0/pipelines
diff --git a/acceptance/pipelines/destroy/destroy-pipeline-cascade-state-divergence/test.toml b/acceptance/pipelines/destroy/destroy-pipeline-cascade-state-divergence/test.toml
new file mode 100644
index 00000000000..82e9fa36571
--- /dev/null
+++ b/acceptance/pipelines/destroy/destroy-pipeline-cascade-state-divergence/test.toml
@@ -0,0 +1,3 @@
+# cascade_on_destroy only affects the direct engine's delete request; the terraform engine
+# does not support the attribute yet and rejects it. Restrict this test to direct
+RecordRequests = true
diff --git a/acceptance/pipelines/destroy/destroy-pipeline-cascade/databricks.yml b/acceptance/pipelines/destroy/destroy-pipeline-cascade/databricks.yml
new file mode 100644
index 00000000000..af159a9e9c1
--- /dev/null
+++ b/acceptance/pipelines/destroy/destroy-pipeline-cascade/databricks.yml
@@ -0,0 +1,7 @@
+bundle:
+  name: test-pipeline-destroy-cascade
+resources:
+  pipelines:
+    my_pipeline:
+      name: test-pipeline-cascade
+      cascade_on_destroy: false
diff --git a/acceptance/pipelines/destroy/destroy-pipeline-cascade/out.test.toml b/acceptance/pipelines/destroy/destroy-pipeline-cascade/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/pipelines/destroy/destroy-pipeline-cascade/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/pipelines/destroy/destroy-pipeline-cascade/output.txt b/acceptance/pipelines/destroy/destroy-pipeline-cascade/output.txt
new file mode 100644
index 00000000000..641d04b1af2
--- /dev/null
+++ b/acceptance/pipelines/destroy/destroy-pipeline-cascade/output.txt
@@ -0,0 +1,72 @@
+
+=== Deploy a pipeline configured with cascade_on_destroy: false
+>>> [CLI] pipelines deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-pipeline-destroy-cascade/default/files...
+Created pipelines.my_pipeline
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+View your pipeline my_pipeline here: [DATABRICKS_URL]/pipelines/[UUID]?w=[WORKSPACE_ID]
+
+>>> print_requests.py //api/2.0/pipelines
+{
+  "method": "POST",
+  "path": "/api/2.0/pipelines",
+  "body": {
+    "channel": "CURRENT",
+    "deployment": {
+      "kind": "BUNDLE",
+      "metadata_file_path": "/Workspace/Users/[USERNAME]/.bundle/test-pipeline-destroy-cascade/default/state/metadata.json"
+    },
+    "edition": "ADVANCED",
+    "name": "test-pipeline-cascade"
+  }
+}
+
+=== Change only cascade_on_destroy (false -> true): expect a state-only update, no pipeline update API call
+>>> [CLI] pipelines deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-pipeline-destroy-cascade/default/files...
+Updated pipelines.my_pipeline
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+View your pipeline my_pipeline here: [DATABRICKS_URL]/pipelines/[UUID]?w=[WORKSPACE_ID]
+
+>>> print_requests.py //api/2.0/pipelines
+
+=== Set cascade_on_destroy back to false and deploy so state reflects it before destroy
+>>> [CLI] pipelines deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-pipeline-destroy-cascade/default/files...
+Updated pipelines.my_pipeline
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+View your pipeline my_pipeline here: [DATABRICKS_URL]/pipelines/[UUID]?w=[WORKSPACE_ID]
+
+>>> print_requests.py //api/2.0/pipelines
+
+=== Unset cascade_on_destroy entirely: expect a state-only update that persists nil to state
+>>> [CLI] pipelines deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-pipeline-destroy-cascade/default/files...
+Updated pipelines.my_pipeline
+Files: 1 uploaded, 0 deleted
+Resources: 0 created, 1 changed, 0 deleted, 0 unchanged
+View your pipeline my_pipeline here: [DATABRICKS_URL]/pipelines/[UUID]?w=[WORKSPACE_ID]
+
+>>> print_requests.py //api/2.0/pipelines
+
+=== Destroy: cascade_on_destroy is unset in state, so the delete uses the backend default (no cascade param)
+>>> [CLI] pipelines destroy --auto-approve
+The following resources will be deleted:
+  delete resources.pipelines.my_pipeline
+
+This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:
+  delete resources.pipelines.my_pipeline
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-pipeline-destroy-cascade/default
+
+Destroy: 1 deleted
+
+>>> print_requests.py //api/2.0/pipelines
+{
+  "method": "DELETE",
+  "path": "/api/2.0/pipelines/[UUID]"
+}
diff --git a/acceptance/pipelines/destroy/destroy-pipeline-cascade/script b/acceptance/pipelines/destroy/destroy-pipeline-cascade/script
new file mode 100644
index 00000000000..017780d8412
--- /dev/null
+++ b/acceptance/pipelines/destroy/destroy-pipeline-cascade/script
@@ -0,0 +1,27 @@
+title "Deploy a pipeline configured with cascade_on_destroy: false"
+trace $CLI pipelines deploy
+
+# Flush the deploy requests: cascade_on_destroy is delete-time-only, so the create request must not carry it.
+trace print_requests.py //api/2.0/pipelines
+
+title "Change only cascade_on_destroy (false -> true): expect a state-only update, no pipeline update API call"
+update_file.py databricks.yml "cascade_on_destroy: false" "cascade_on_destroy: true"
+trace $CLI pipelines deploy
+# No POST/PATCH to /pipelines is expected here; the cascade-only change is persisted to state.
+trace print_requests.py //api/2.0/pipelines
+
+title "Set cascade_on_destroy back to false and deploy so state reflects it before destroy"
+update_file.py databricks.yml "cascade_on_destroy: true" "cascade_on_destroy: false"
+trace $CLI pipelines deploy
+trace print_requests.py //api/2.0/pipelines
+
+title "Unset cascade_on_destroy entirely: expect a state-only update that persists nil to state"
+update_file.py databricks.yml "      cascade_on_destroy: false
+" ""
+trace $CLI pipelines deploy
+# No pipeline API call is expected; the cascade-only change is persisted to state.
+trace print_requests.py //api/2.0/pipelines
+
+title "Destroy: cascade_on_destroy is unset in state, so the delete uses the backend default (no cascade param)"
+trace $CLI pipelines destroy --auto-approve
+trace print_requests.py //api/2.0/pipelines
diff --git a/acceptance/pipelines/destroy/destroy-pipeline-cascade/test.toml b/acceptance/pipelines/destroy/destroy-pipeline-cascade/test.toml
new file mode 100644
index 00000000000..82e9fa36571
--- /dev/null
+++ b/acceptance/pipelines/destroy/destroy-pipeline-cascade/test.toml
@@ -0,0 +1,3 @@
+# cascade_on_destroy only affects the direct engine's delete request; the terraform engine
+# does not support the attribute yet and rejects it. Restrict this test to direct
+RecordRequests = true
diff --git a/acceptance/pipelines/destroy/destroy-pipeline/out.test.toml b/acceptance/pipelines/destroy/destroy-pipeline/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/pipelines/destroy/destroy-pipeline/out.test.toml
+++ b/acceptance/pipelines/destroy/destroy-pipeline/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/pipelines/destroy/destroy-pipeline/output.txt b/acceptance/pipelines/destroy/destroy-pipeline/output.txt
index d06ff16cfca..a1456cf87e9 100644
--- a/acceptance/pipelines/destroy/destroy-pipeline/output.txt
+++ b/acceptance/pipelines/destroy/destroy-pipeline/output.txt
@@ -2,23 +2,22 @@
 === Test basic pipelines destroy
 >>> [CLI] pipelines deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-pipeline-destroy/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-View your pipeline my_pipeline here: [DATABRICKS_URL]/pipelines/[UUID]?o=[NUMID]
+Created pipelines.my_pipeline
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+View your pipeline my_pipeline here: [DATABRICKS_URL]/pipelines/[UUID]?w=[WORKSPACE_ID]
 
 >>> [CLI] pipelines destroy --auto-approve
 The following resources will be deleted:
   delete resources.pipelines.my_pipeline
 
 This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
-Streaming Tables (STs) and Materialized Views (MVs) managed by them:
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:
   delete resources.pipelines.my_pipeline
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-pipeline-destroy/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
 
 === Assert pipeline is deleted
 >>> errcode [CLI] pipelines get [UUID]
diff --git a/acceptance/pipelines/destroy/force-lock/out.test.toml b/acceptance/pipelines/destroy/force-lock/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/pipelines/destroy/force-lock/out.test.toml
+++ b/acceptance/pipelines/destroy/force-lock/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/pipelines/destroy/force-lock/output.txt b/acceptance/pipelines/destroy/force-lock/output.txt
index 5b6449f7322..28c43d1bfd0 100644
--- a/acceptance/pipelines/destroy/force-lock/output.txt
+++ b/acceptance/pipelines/destroy/force-lock/output.txt
@@ -1,18 +1,22 @@
 
 >>> errcode [CLI] pipelines deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-pipeline-force-lock/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-View your pipeline foo here: [DATABRICKS_URL]/pipelines/[UUID]?o=[NUMID]
+Created pipelines.foo
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+View your pipeline foo here: [DATABRICKS_URL]/pipelines/[UUID]?w=[WORKSPACE_ID]
 
 === upload lock file
 >>> [CLI] workspace import /Workspace/Users/[USERNAME]/.bundle/test-pipeline-force-lock/default/state/deploy.lock --format AUTO --file ./deploy.lock
 
 === test deployment without force-lock (should fail)
 >>> errcode [CLI] pipelines destroy --auto-approve
-Error: Failed to acquire deployment lock: deploy lock acquired by user-with-lock@databricks.com at [TIMESTAMP] +0000 UTC. Use --force-lock to override
-Error: deploy lock acquired by user-with-lock@databricks.com at [TIMESTAMP] +0000 UTC. Use --force-lock to override
+Error: Failed to acquire deployment lock: deploy lock acquired by user-with-lock@databricks.com at [TIMESTAMP] +0000 UTC.
+Another deployment may be in progress. Use --force-lock to override, but this may
+conflict with the other deployment if it is still active
+Error: deploy lock acquired by user-with-lock@databricks.com at [TIMESTAMP] +0000 UTC.
+Another deployment may be in progress. Use --force-lock to override, but this may
+conflict with the other deployment if it is still active
 
 
 Exit code: 1
@@ -23,10 +27,9 @@ The following resources will be deleted:
   delete resources.pipelines.foo
 
 This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
-Streaming Tables (STs) and Materialized Views (MVs) managed by them:
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:
   delete resources.pipelines.foo
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-pipeline-force-lock/default
 
-Deleting files...
-Destroy complete!
+Destroy: 1 deleted
diff --git a/acceptance/pipelines/dry-run/dry-run-pipeline/out.test.toml b/acceptance/pipelines/dry-run/dry-run-pipeline/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/pipelines/dry-run/dry-run-pipeline/out.test.toml
+++ b/acceptance/pipelines/dry-run/dry-run-pipeline/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/pipelines/dry-run/dry-run-pipeline/output.txt b/acceptance/pipelines/dry-run/dry-run-pipeline/output.txt
index 5ae77f15d7f..a4e2c1eb7a4 100644
--- a/acceptance/pipelines/dry-run/dry-run-pipeline/output.txt
+++ b/acceptance/pipelines/dry-run/dry-run-pipeline/output.txt
@@ -1,10 +1,10 @@
 
 >>> [CLI] pipelines deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-pipeline-run/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-View your pipeline my_pipeline here: [DATABRICKS_URL]/pipelines/[UUID]?o=[NUMID]
+Created pipelines.my_pipeline
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+View your pipeline my_pipeline here: [DATABRICKS_URL]/pipelines/[UUID]?w=[WORKSPACE_ID]
 
 === Dry running pipeline, should have validate_only set to true
 >>> [CLI] pipelines dry-run
@@ -16,11 +16,11 @@ Update URL: [DATABRICKS_URL]/#joblist/pipelines/[UUID]/updates/[UUID]
 
 Update ID: [UUID]
 {
+  "method": "POST",
+  "path": "/api/2.0/pipelines/[UUID]/updates",
   "body": {
     "validate_only": true
-  },
-  "method": "POST",
-  "path": "/api/2.0/pipelines/[UUID]/updates"
+  }
 }
 
 === Dry running pipeline with KEY, expect same output as without KEY
@@ -33,9 +33,9 @@ Update URL: [DATABRICKS_URL]/#joblist/pipelines/[UUID]/updates/[UUID]
 
 Update ID: [UUID]
 {
+  "method": "POST",
+  "path": "/api/2.0/pipelines/[UUID]/updates",
   "body": {
     "validate_only": true
-  },
-  "method": "POST",
-  "path": "/api/2.0/pipelines/[UUID]/updates"
+  }
 }
diff --git a/acceptance/pipelines/dry-run/dry-run-pipeline/script b/acceptance/pipelines/dry-run/dry-run-pipeline/script
index 8afe4968c51..42aa0f8e6b8 100755
--- a/acceptance/pipelines/dry-run/dry-run-pipeline/script
+++ b/acceptance/pipelines/dry-run/dry-run-pipeline/script
@@ -1,14 +1,9 @@
-print_requests() {
-    jq --sort-keys 'select(.method != "GET" and (.path | contains("/pipelines")))' < out.requests.txt
-    rm out.requests.txt
-}
-
 trace $CLI pipelines deploy
-rm out.requests.txt
+rm "$OUT_REQUESTS"
 title "Dry running pipeline, should have validate_only set to true"
 trace $CLI pipelines dry-run
-print_requests
+print_requests.py //pipelines
 
 title "Dry running pipeline with KEY, expect same output as without KEY"
 trace $CLI pipelines dry-run my_pipeline
-print_requests
+print_requests.py //pipelines
diff --git a/acceptance/pipelines/dry-run/no-wait/out.test.toml b/acceptance/pipelines/dry-run/no-wait/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/pipelines/dry-run/no-wait/out.test.toml
+++ b/acceptance/pipelines/dry-run/no-wait/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/pipelines/dry-run/no-wait/output.txt b/acceptance/pipelines/dry-run/no-wait/output.txt
index bd171a3f912..50e609a6814 100644
--- a/acceptance/pipelines/dry-run/no-wait/output.txt
+++ b/acceptance/pipelines/dry-run/no-wait/output.txt
@@ -1,10 +1,10 @@
 
 >>> [CLI] pipelines deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-pipeline-run-flags/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-View your pipeline my_pipeline here: [DATABRICKS_URL]/pipelines/[UUID]?o=[NUMID]
+Created pipelines.my_pipeline
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+View your pipeline my_pipeline here: [DATABRICKS_URL]/pipelines/[UUID]?w=[WORKSPACE_ID]
 
 === Dry running pipeline with --no-wait flag
 >>> [CLI] pipelines dry-run --no-wait
diff --git a/acceptance/pipelines/dry-run/restart/out.test.toml b/acceptance/pipelines/dry-run/restart/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/pipelines/dry-run/restart/out.test.toml
+++ b/acceptance/pipelines/dry-run/restart/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/pipelines/dry-run/restart/output.txt b/acceptance/pipelines/dry-run/restart/output.txt
index 62732b6e3ef..cf77b26a8e3 100644
--- a/acceptance/pipelines/dry-run/restart/output.txt
+++ b/acceptance/pipelines/dry-run/restart/output.txt
@@ -1,10 +1,10 @@
 
 >>> [CLI] pipelines deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-pipeline-run-flags/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-View your pipeline my_pipeline here: [DATABRICKS_URL]/pipelines/[UUID]?o=[NUMID]
+Created pipelines.my_pipeline
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+View your pipeline my_pipeline here: [DATABRICKS_URL]/pipelines/[UUID]?w=[WORKSPACE_ID]
 
 === Dry running pipeline with --restart flag, should stop the current pipeline and start a new run
 >>> [CLI] pipelines dry-run --restart
@@ -16,15 +16,15 @@ Update URL: [DATABRICKS_URL]/#joblist/pipelines/[UUID]/updates/[UUID]
 
 Update ID: [UUID]
 
->>> print_requests
+>>> print_requests.py //pipelines
 {
   "method": "POST",
   "path": "/api/2.0/pipelines/[UUID]/stop"
 }
 {
+  "method": "POST",
+  "path": "/api/2.0/pipelines/[UUID]/updates",
   "body": {
     "validate_only": true
-  },
-  "method": "POST",
-  "path": "/api/2.0/pipelines/[UUID]/updates"
+  }
 }
diff --git a/acceptance/pipelines/dry-run/restart/script b/acceptance/pipelines/dry-run/restart/script
index b60de9760d0..5f022da96aa 100644
--- a/acceptance/pipelines/dry-run/restart/script
+++ b/acceptance/pipelines/dry-run/restart/script
@@ -1,11 +1,6 @@
-print_requests() {
-    jq --sort-keys 'select(.method != "GET" and (.path | contains("/pipelines")))' < out.requests.txt
-    rm out.requests.txt
-}
-
 trace $CLI pipelines deploy
-rm out.requests.txt
+rm "$OUT_REQUESTS"
 
 title "Dry running pipeline with --restart flag, should stop the current pipeline and start a new run"
 trace $CLI pipelines dry-run --restart
-trace print_requests
+trace print_requests.py //pipelines
diff --git a/acceptance/pipelines/e2e/out.test.toml b/acceptance/pipelines/e2e/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/pipelines/e2e/out.test.toml
+++ b/acceptance/pipelines/e2e/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/pipelines/e2e/output.txt b/acceptance/pipelines/e2e/output.txt
index 65b27ec3506..a699e7b7143 100644
--- a/acceptance/pipelines/e2e/output.txt
+++ b/acceptance/pipelines/e2e/output.txt
@@ -17,11 +17,12 @@ Please refer to the README.md file for "getting started" instructions.
 === Deploy pipeline
 >>> [CLI] pipelines deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/lakeflow_project/dev/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-View your job sample_job here: [DATABRICKS_URL]/jobs/[NUMID]?o=[NUMID]
-View your pipeline lakeflow_project_etl here: [DATABRICKS_URL]/pipelines/[UUID]?o=[NUMID]
+Created jobs.sample_job
+Created pipelines.lakeflow_project_etl
+Files: 13 uploaded, 0 deleted
+Resources: 2 created, 0 changed, 0 deleted, 0 unchanged
+View your job sample_job here: [DATABRICKS_URL]/jobs/[SAMPLE_JOB_ID]?w=[WORKSPACE_ID]
+View your pipeline lakeflow_project_etl here: [DATABRICKS_URL]/pipelines/[UUID]?w=[WORKSPACE_ID]
 
 === Run pipeline
 >>> [CLI] pipelines run
@@ -41,12 +42,12 @@ Pipeline configurations for this update:
 === Edit project by creating and running a new second pipeline
 >>> [CLI] pipelines deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/lakeflow_project/dev/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-View your job sample_job here: [DATABRICKS_URL]/jobs/[NUMID]?o=[NUMID]
-View your pipeline lakeflow_project_etl here: [DATABRICKS_URL]/pipelines/[UUID]?o=[NUMID]
-View your pipeline lakeflow_project_etl_2 here: [DATABRICKS_URL]/pipelines/[UUID]?o=[NUMID]
+Created pipelines.lakeflow_project_etl_2
+Files: 1 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 2 unchanged
+View your job sample_job here: [DATABRICKS_URL]/jobs/[SAMPLE_JOB_ID]?w=[WORKSPACE_ID]
+View your pipeline lakeflow_project_etl here: [DATABRICKS_URL]/pipelines/[UUID]?w=[WORKSPACE_ID]
+View your pipeline lakeflow_project_etl_2 here: [DATABRICKS_URL]/pipelines/[UUID]?w=[WORKSPACE_ID]
 
 === Assert the second pipeline is created
 >>> [CLI] pipelines get [UUID]
@@ -106,11 +107,10 @@ The following resources will be deleted:
   delete resources.pipelines.lakeflow_project_etl_2
 
 This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
-Streaming Tables (STs) and Materialized Views (MVs) managed by them:
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:
   delete resources.pipelines.lakeflow_project_etl
   delete resources.pipelines.lakeflow_project_etl_2
 
 All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/lakeflow_project/dev
 
-Deleting files...
-Destroy complete!
+Destroy: 3 deleted
diff --git a/acceptance/pipelines/e2e/output/lakeflow_project/.vscode/extensions.json b/acceptance/pipelines/e2e/output/lakeflow_project/.vscode/extensions.json
index 5ba48e79c9b..b958aacfcb4 100644
--- a/acceptance/pipelines/e2e/output/lakeflow_project/.vscode/extensions.json
+++ b/acceptance/pipelines/e2e/output/lakeflow_project/.vscode/extensions.json
@@ -1,7 +1,7 @@
 {
     "recommendations": [
+        "charliermarsh.ruff",
         "databricks.databricks",
-        "redhat.vscode-yaml",
-        "charliermarsh.ruff"
+        "redhat.vscode-yaml"
     ]
 }
diff --git a/acceptance/pipelines/e2e/output/lakeflow_project/AGENTS.md b/acceptance/pipelines/e2e/output/lakeflow_project/AGENTS.md
new file mode 100644
index 00000000000..fdcca98a432
--- /dev/null
+++ b/acceptance/pipelines/e2e/output/lakeflow_project/AGENTS.md
@@ -0,0 +1,25 @@
+# Declarative Automation Bundles Project
+
+This project uses Declarative Automation Bundles (DABs) for deployment. Add project-specific instructions below.
+
+## For AI Agents: Use Databricks AI Tools
+
+**BEFORE any other action, read the `databricks-core` skill.**
+
+It sets you up to work with this project reliably: CLI authentication, profile
+selection, data discovery, and the bundle deployment workflow. Without it,
+results are often slower and less accurate.
+
+If this skill is not available (Databricks AI Tools are not installed), you can install them for your coding agent in seconds:
+
+```bash
+databricks aitools install
+```
+
+If the CLI is not installed, see: https://docs.databricks.com/dev-tools/cli/install
+
+---
+
+## Project Instructions
+
+<!-- Add your project-specific instructions, coding conventions, or notes here -->
diff --git a/acceptance/pipelines/e2e/output/lakeflow_project/databricks.yml b/acceptance/pipelines/e2e/output/lakeflow_project/databricks.yml
index 3eeee62f8e8..67f65788f23 100644
--- a/acceptance/pipelines/e2e/output/lakeflow_project/databricks.yml
+++ b/acceptance/pipelines/e2e/output/lakeflow_project/databricks.yml
@@ -1,4 +1,4 @@
-# This is a Databricks asset bundle definition for lakeflow_project.
+# This is a Declarative Automation Bundle definition for lakeflow_project.
 # See https://docs.databricks.com/dev-tools/bundles/index.html for documentation.
 bundle:
   name: lakeflow_project
diff --git a/acceptance/pipelines/e2e/output/lakeflow_project/pyproject.toml b/acceptance/pipelines/e2e/output/lakeflow_project/pyproject.toml
index 39353902f6b..141ceddab2e 100644
--- a/acceptance/pipelines/e2e/output/lakeflow_project/pyproject.toml
+++ b/acceptance/pipelines/e2e/output/lakeflow_project/pyproject.toml
@@ -2,7 +2,7 @@
 name = "lakeflow_project"
 version = "0.0.1"
 authors = [{ name = "[USERNAME]" }]
-requires-python = ">=3.10,<3.13"
+requires-python = ">=3.12,<3.13"
 dependencies = [
     # Any dependencies for jobs and pipelines in this project can be added here
     # See also https://docs.databricks.com/dev-tools/bundles/library-dependencies
@@ -16,7 +16,7 @@ dev = [
     "pytest",
     "ruff",
     "databricks-dlt",
-    "databricks-connect>=15.4,<15.5",
+    "databricks-connect>=16.4,<16.5",
     "ipykernel",
 ]
 
diff --git a/acceptance/pipelines/e2e/output/lakeflow_project/resources/sample_job.job.yml b/acceptance/pipelines/e2e/output/lakeflow_project/resources/sample_job.job.yml
index 2ba45ba9ffe..86f5510b339 100644
--- a/acceptance/pipelines/e2e/output/lakeflow_project/resources/sample_job.job.yml
+++ b/acceptance/pipelines/e2e/output/lakeflow_project/resources/sample_job.job.yml
@@ -29,4 +29,4 @@ resources:
       environments:
         - environment_key: default
           spec:
-            environment_version: "4"
+            environment_version: "5"
diff --git a/acceptance/pipelines/e2e/output/lakeflow_project/src/lakeflow_project_etl/README.md b/acceptance/pipelines/e2e/output/lakeflow_project/src/lakeflow_project_etl/README.md
index 1fd2a85b68b..041f340d6d3 100644
--- a/acceptance/pipelines/e2e/output/lakeflow_project/src/lakeflow_project_etl/README.md
+++ b/acceptance/pipelines/e2e/output/lakeflow_project/src/lakeflow_project_etl/README.md
@@ -15,6 +15,6 @@ To get started, go to the `transformations` folder -- most of the relevant sourc
 * Take a look at the sample called "sample_trips_lakeflow_project.py" to get familiar with the syntax.
   Read more about the syntax at https://docs.databricks.com/dlt/python-ref.html.
 * If you're using the workspace UI, use `Run file` to run and preview a single transformation.
-* If you're using the CLI, use `databricks bundle run lakeflow_project_etl --select sample_trips_lakeflow_project` to run a single transformation.
+* If you're using the CLI, use `databricks bundle run lakeflow_project_etl --refresh sample_trips_lakeflow_project` to run a single transformation.
 
 For more tutorials and reference material, see https://docs.databricks.com/dlt.
diff --git a/acceptance/pipelines/e2e/script b/acceptance/pipelines/e2e/script
index dd8a50ada10..d393e3334a8 100644
--- a/acceptance/pipelines/e2e/script
+++ b/acceptance/pipelines/e2e/script
@@ -6,6 +6,7 @@ trace $CLI pipelines init --output-dir output
 title "Deploy pipeline"
 cd output/lakeflow_project
 trace $CLI pipelines deploy
+read_id.py sample_job > /dev/null
 
 title "Run pipeline"
 trace $CLI pipelines run
diff --git a/acceptance/pipelines/generate/bad-path/out.test.toml b/acceptance/pipelines/generate/bad-path/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/pipelines/generate/bad-path/out.test.toml
+++ b/acceptance/pipelines/generate/bad-path/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/pipelines/generate/bad-path/output.txt b/acceptance/pipelines/generate/bad-path/output.txt
index 7b12955c2f5..2a88941a230 100644
--- a/acceptance/pipelines/generate/bad-path/output.txt
+++ b/acceptance/pipelines/generate/bad-path/output.txt
@@ -1,5 +1,3 @@
 
->>> errcode [CLI] pipelines generate --existing-pipeline-dir /tmp/foo
+>>> musterr [CLI] pipelines generate --existing-pipeline-dir /tmp/foo
 Error: please make sure the directory is located in side 'src/' (for example 'src/my_pipeline'), got: [path]
-
-Exit code: 1
diff --git a/acceptance/pipelines/generate/bad-path/script b/acceptance/pipelines/generate/bad-path/script
index c00adf6ce5e..b61b7c886f3 100644
--- a/acceptance/pipelines/generate/bad-path/script
+++ b/acceptance/pipelines/generate/bad-path/script
@@ -1,2 +1,2 @@
 
-trace errcode $CLI pipelines generate --existing-pipeline-dir /tmp/foo
+trace musterr $CLI pipelines generate --existing-pipeline-dir /tmp/foo
diff --git a/acceptance/pipelines/generate/discover-spark-pipeline-yml/out.test.toml b/acceptance/pipelines/generate/discover-spark-pipeline-yml/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/pipelines/generate/discover-spark-pipeline-yml/out.test.toml
+++ b/acceptance/pipelines/generate/discover-spark-pipeline-yml/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/pipelines/generate/fail-overwrite/out.test.toml b/acceptance/pipelines/generate/fail-overwrite/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/pipelines/generate/fail-overwrite/out.test.toml
+++ b/acceptance/pipelines/generate/fail-overwrite/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/pipelines/generate/fail-overwrite/output.txt b/acceptance/pipelines/generate/fail-overwrite/output.txt
index ec2a53fffc8..bba32160e25 100644
--- a/acceptance/pipelines/generate/fail-overwrite/output.txt
+++ b/acceptance/pipelines/generate/fail-overwrite/output.txt
@@ -1,5 +1,3 @@
 
->>> errcode [CLI] pipelines generate --existing-pipeline-dir src/my_pipeline
+>>> musterr [CLI] pipelines generate --existing-pipeline-dir src/my_pipeline
 Error: resources/my_pipeline.pipeline.yml already exists. Use --force to overwrite
-
-Exit code: 1
diff --git a/acceptance/pipelines/generate/fail-overwrite/script b/acceptance/pipelines/generate/fail-overwrite/script
index 1eee25565cf..82bedcaf66f 100644
--- a/acceptance/pipelines/generate/fail-overwrite/script
+++ b/acceptance/pipelines/generate/fail-overwrite/script
@@ -1,2 +1,2 @@
 
-trace errcode $CLI pipelines generate --existing-pipeline-dir src/my_pipeline
+trace musterr $CLI pipelines generate --existing-pipeline-dir src/my_pipeline
diff --git a/acceptance/pipelines/generate/simple/out.test.toml b/acceptance/pipelines/generate/simple/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/pipelines/generate/simple/out.test.toml
+++ b/acceptance/pipelines/generate/simple/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/pipelines/generate/unknown-attribute/out.test.toml b/acceptance/pipelines/generate/unknown-attribute/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/pipelines/generate/unknown-attribute/out.test.toml
+++ b/acceptance/pipelines/generate/unknown-attribute/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/pipelines/history/basic/databricks.yml b/acceptance/pipelines/history/basic/databricks.yml
new file mode 100644
index 00000000000..88084d31062
--- /dev/null
+++ b/acceptance/pipelines/history/basic/databricks.yml
@@ -0,0 +1,2 @@
+# invalid databricks.yml to show that `pipelines history PIPELINE_ID` bypasses the bundle
+bundle: invalid
diff --git a/acceptance/pipelines/history/basic/out.test.toml b/acceptance/pipelines/history/basic/out.test.toml
new file mode 100644
index 00000000000..0938e678987
--- /dev/null
+++ b/acceptance/pipelines/history/basic/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/pipelines/history/basic/output.txt b/acceptance/pipelines/history/basic/output.txt
new file mode 100644
index 00000000000..cc9db675fb4
--- /dev/null
+++ b/acceptance/pipelines/history/basic/output.txt
@@ -0,0 +1,59 @@
+
+=== default history by pipeline id
+
+>>> [CLI] pipelines history [PIPELINE_ID]
+Updates Summary for pipeline [PIPELINE_ID]:
+Update ID: update-3
+   State: COMPLETED
+   Creation Time: [TIMESTAMP]
+   Full Refresh: false
+   Validate Only: false
+Update ID: update-2
+   State: FAILED
+   Creation Time: [TIMESTAMP]
+   Full Refresh: false
+   Validate Only: true
+Update ID: update-1
+   State: CANCELED
+   Creation Time: [TIMESTAMP]
+   Full Refresh: false
+   Validate Only: false
+
+=== json output
+
+>>> [CLI] pipelines history [PIPELINE_ID] --output json
+{
+  "Key": "[PIPELINE_ID]",
+  "Updates": [
+    {
+      "creation_time": 1640995200000,
+      "state": "COMPLETED",
+      "update_id": "update-3",
+      "validate_only": false
+    },
+    {
+      "creation_time": 1640908800000,
+      "state": "FAILED",
+      "update_id": "update-2",
+      "validate_only": true
+    },
+    {
+      "creation_time": 1640822400000,
+      "state": "CANCELED",
+      "update_id": "update-1",
+      "validate_only": false
+    }
+  ]
+}
+
+=== wire request uses pipeline id
+
+>>> print_requests.py //api/2.0/pipelines/[PIPELINE_ID]/updates --get
+{
+  "method": "GET",
+  "path": "/api/2.0/pipelines/[PIPELINE_ID]/updates"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/pipelines/[PIPELINE_ID]/updates"
+}
diff --git a/acceptance/pipelines/history/basic/script b/acceptance/pipelines/history/basic/script
new file mode 100644
index 00000000000..27a44231923
--- /dev/null
+++ b/acceptance/pipelines/history/basic/script
@@ -0,0 +1,10 @@
+add_repl 3fb8e5a1-0d2c-4a6b-9f1e-2c7d8e9f0a1b PIPELINE_ID
+
+title "default history by pipeline id\n"
+trace $CLI pipelines history 3fb8e5a1-0d2c-4a6b-9f1e-2c7d8e9f0a1b
+
+title "json output\n"
+trace $CLI pipelines history 3fb8e5a1-0d2c-4a6b-9f1e-2c7d8e9f0a1b --output json
+
+title "wire request uses pipeline id\n"
+trace print_requests.py //api/2.0/pipelines/3fb8e5a1-0d2c-4a6b-9f1e-2c7d8e9f0a1b/updates --get
diff --git a/acceptance/pipelines/history/basic/test.toml b/acceptance/pipelines/history/basic/test.toml
new file mode 100644
index 00000000000..3f23481ca91
--- /dev/null
+++ b/acceptance/pipelines/history/basic/test.toml
@@ -0,0 +1,16 @@
+Cloud = false
+
+EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+RecordRequests = true
+
+[[Server]]
+Pattern = "GET /api/2.0/pipelines/{pipeline_id}/updates"
+Response.Body = '''
+{
+  "updates": [
+    {"update_id": "update-3", "state": "COMPLETED", "creation_time": 1640995200000, "validate_only": false},
+    {"update_id": "update-2", "state": "FAILED", "creation_time": 1640908800000, "validate_only": true},
+    {"update_id": "update-1", "state": "CANCELED", "creation_time": 1640822400000, "validate_only": false}
+  ]
+}
+'''
diff --git a/acceptance/pipelines/init/error-cases/out.test.toml b/acceptance/pipelines/init/error-cases/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/pipelines/init/error-cases/out.test.toml
+++ b/acceptance/pipelines/init/error-cases/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/pipelines/init/error-cases/output.txt b/acceptance/pipelines/init/error-cases/output.txt
index f3394fb34ea..fc266593a14 100644
--- a/acceptance/pipelines/init/error-cases/output.txt
+++ b/acceptance/pipelines/init/error-cases/output.txt
@@ -1,12 +1,8 @@
 
 === Test with invalid project name (contains uppercase letters)
->>> errcode [CLI] pipelines init --config-file ./invalid_input.json --output-dir invalid-output
+>>> musterr [CLI] pipelines init --config-file ./invalid_input.json --output-dir invalid-output
 Error: failed to load config from file ./invalid_input.json: invalid value for project_name: "InvalidProjectName". Name must consist of lower case letters, numbers, and underscores.
 
-Exit code: 1
-
 === Test with non-existent config file
->>> errcode [CLI] pipelines init --config-file ./nonexistent.json --output-dir invalid-output-2
+>>> musterr [CLI] pipelines init --config-file ./nonexistent.json --output-dir invalid-output-2
 Error: failed to load config from file ./nonexistent.json: open ./nonexistent.json: no such file or directory
-
-Exit code: 1
diff --git a/acceptance/pipelines/init/error-cases/script b/acceptance/pipelines/init/error-cases/script
index 4baddca6799..25fba63fffe 100644
--- a/acceptance/pipelines/init/error-cases/script
+++ b/acceptance/pipelines/init/error-cases/script
@@ -1,5 +1,5 @@
 title "Test with invalid project name (contains uppercase letters)"
-trace errcode $CLI pipelines init --config-file ./invalid_input.json --output-dir invalid-output
+trace musterr $CLI pipelines init --config-file ./invalid_input.json --output-dir invalid-output
 
 title "Test with non-existent config file"
-trace errcode $CLI pipelines init --config-file ./nonexistent.json --output-dir invalid-output-2
+trace musterr $CLI pipelines init --config-file ./nonexistent.json --output-dir invalid-output-2
diff --git a/acceptance/pipelines/init/python/out.test.toml b/acceptance/pipelines/init/python/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/pipelines/init/python/out.test.toml
+++ b/acceptance/pipelines/init/python/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/pipelines/init/python/output/my_python_project/.vscode/extensions.json b/acceptance/pipelines/init/python/output/my_python_project/.vscode/extensions.json
index 5ba48e79c9b..b958aacfcb4 100644
--- a/acceptance/pipelines/init/python/output/my_python_project/.vscode/extensions.json
+++ b/acceptance/pipelines/init/python/output/my_python_project/.vscode/extensions.json
@@ -1,7 +1,7 @@
 {
     "recommendations": [
+        "charliermarsh.ruff",
         "databricks.databricks",
-        "redhat.vscode-yaml",
-        "charliermarsh.ruff"
+        "redhat.vscode-yaml"
     ]
 }
diff --git a/acceptance/pipelines/init/python/output/my_python_project/AGENTS.md b/acceptance/pipelines/init/python/output/my_python_project/AGENTS.md
new file mode 100644
index 00000000000..fdcca98a432
--- /dev/null
+++ b/acceptance/pipelines/init/python/output/my_python_project/AGENTS.md
@@ -0,0 +1,25 @@
+# Declarative Automation Bundles Project
+
+This project uses Declarative Automation Bundles (DABs) for deployment. Add project-specific instructions below.
+
+## For AI Agents: Use Databricks AI Tools
+
+**BEFORE any other action, read the `databricks-core` skill.**
+
+It sets you up to work with this project reliably: CLI authentication, profile
+selection, data discovery, and the bundle deployment workflow. Without it,
+results are often slower and less accurate.
+
+If this skill is not available (Databricks AI Tools are not installed), you can install them for your coding agent in seconds:
+
+```bash
+databricks aitools install
+```
+
+If the CLI is not installed, see: https://docs.databricks.com/dev-tools/cli/install
+
+---
+
+## Project Instructions
+
+<!-- Add your project-specific instructions, coding conventions, or notes here -->
diff --git a/acceptance/pipelines/init/python/output/my_python_project/databricks.yml b/acceptance/pipelines/init/python/output/my_python_project/databricks.yml
index 56db923dce0..6fee1dfff76 100644
--- a/acceptance/pipelines/init/python/output/my_python_project/databricks.yml
+++ b/acceptance/pipelines/init/python/output/my_python_project/databricks.yml
@@ -1,4 +1,4 @@
-# This is a Databricks asset bundle definition for my_python_project.
+# This is a Declarative Automation Bundle definition for my_python_project.
 # See https://docs.databricks.com/dev-tools/bundles/index.html for documentation.
 bundle:
   name: my_python_project
diff --git a/acceptance/pipelines/init/python/output/my_python_project/pyproject.toml b/acceptance/pipelines/init/python/output/my_python_project/pyproject.toml
index d75a0a4caa8..7b8932736c6 100644
--- a/acceptance/pipelines/init/python/output/my_python_project/pyproject.toml
+++ b/acceptance/pipelines/init/python/output/my_python_project/pyproject.toml
@@ -2,7 +2,7 @@
 name = "my_python_project"
 version = "0.0.1"
 authors = [{ name = "[USERNAME]" }]
-requires-python = ">=3.10,<3.13"
+requires-python = ">=3.12,<3.13"
 dependencies = [
     # Any dependencies for jobs and pipelines in this project can be added here
     # See also https://docs.databricks.com/dev-tools/bundles/library-dependencies
@@ -16,7 +16,7 @@ dev = [
     "pytest",
     "ruff",
     "databricks-dlt",
-    "databricks-connect>=15.4,<15.5",
+    "databricks-connect>=16.4,<16.5",
     "ipykernel",
 ]
 
diff --git a/acceptance/pipelines/init/python/output/my_python_project/resources/sample_job.job.yml b/acceptance/pipelines/init/python/output/my_python_project/resources/sample_job.job.yml
index 788216eaadb..58ffd15561f 100644
--- a/acceptance/pipelines/init/python/output/my_python_project/resources/sample_job.job.yml
+++ b/acceptance/pipelines/init/python/output/my_python_project/resources/sample_job.job.yml
@@ -29,4 +29,4 @@ resources:
       environments:
         - environment_key: default
           spec:
-            environment_version: "4"
+            environment_version: "5"
diff --git a/acceptance/pipelines/init/python/output/my_python_project/src/my_python_project_etl/README.md b/acceptance/pipelines/init/python/output/my_python_project/src/my_python_project_etl/README.md
index 7e6ec71d7d0..e2361401fb9 100644
--- a/acceptance/pipelines/init/python/output/my_python_project/src/my_python_project_etl/README.md
+++ b/acceptance/pipelines/init/python/output/my_python_project/src/my_python_project_etl/README.md
@@ -15,6 +15,6 @@ To get started, go to the `transformations` folder -- most of the relevant sourc
 * Take a look at the sample called "sample_trips_my_python_project.py" to get familiar with the syntax.
   Read more about the syntax at https://docs.databricks.com/dlt/python-ref.html.
 * If you're using the workspace UI, use `Run file` to run and preview a single transformation.
-* If you're using the CLI, use `databricks bundle run my_python_project_etl --select sample_trips_my_python_project` to run a single transformation.
+* If you're using the CLI, use `databricks bundle run my_python_project_etl --refresh sample_trips_my_python_project` to run a single transformation.
 
 For more tutorials and reference material, see https://docs.databricks.com/dlt.
diff --git a/acceptance/pipelines/init/sql/out.test.toml b/acceptance/pipelines/init/sql/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/pipelines/init/sql/out.test.toml
+++ b/acceptance/pipelines/init/sql/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/pipelines/init/sql/output/my_sql_project/.vscode/__builtins__.pyi b/acceptance/pipelines/init/sql/output/my_sql_project/.vscode/__builtins__.pyi
deleted file mode 100644
index 0edd5181bc5..00000000000
--- a/acceptance/pipelines/init/sql/output/my_sql_project/.vscode/__builtins__.pyi
+++ /dev/null
@@ -1,3 +0,0 @@
-# Typings for Pylance in Visual Studio Code
-# see https://github.com/microsoft/pyright/blob/main/docs/builtins.md
-from databricks.sdk.runtime import *
diff --git a/acceptance/pipelines/init/sql/output/my_sql_project/.vscode/extensions.json b/acceptance/pipelines/init/sql/output/my_sql_project/.vscode/extensions.json
index 5ba48e79c9b..1f39c330871 100644
--- a/acceptance/pipelines/init/sql/output/my_sql_project/.vscode/extensions.json
+++ b/acceptance/pipelines/init/sql/output/my_sql_project/.vscode/extensions.json
@@ -1,7 +1,6 @@
 {
     "recommendations": [
         "databricks.databricks",
-        "redhat.vscode-yaml",
-        "charliermarsh.ruff"
+        "redhat.vscode-yaml"
     ]
 }
diff --git a/acceptance/pipelines/init/sql/output/my_sql_project/.vscode/settings.json b/acceptance/pipelines/init/sql/output/my_sql_project/.vscode/settings.json
index d73c73b5705..d3e814885cb 100644
--- a/acceptance/pipelines/init/sql/output/my_sql_project/.vscode/settings.json
+++ b/acceptance/pipelines/init/sql/output/my_sql_project/.vscode/settings.json
@@ -1,39 +1,5 @@
 {
-    "jupyter.interactiveWindow.cellMarker.codeRegex": "^# COMMAND ----------|^# Databricks notebook source|^(#\\s*%%|#\\s*\\<codecell\\>|#\\s*In\\[\\d*?\\]|#\\s*In\\[ \\])",
-    "jupyter.interactiveWindow.cellMarker.default": "# COMMAND ----------",
-    "python.testing.pytestArgs": [
-        "."
-    ],
-    "files.exclude": {
-        "**/*.egg-info": true,
-        "**/__pycache__": true,
-        ".pytest_cache": true,
-        "dist": true,
-    },
     "files.associations": {
         "**/.gitkeep": "markdown"
     },
-
-    // Pylance settings (VS Code)
-    // Set typeCheckingMode to "basic" to enable type checking!
-    "python.analysis.typeCheckingMode": "off",
-    "python.analysis.extraPaths": ["src", "lib", "resources"],
-    "python.analysis.diagnosticMode": "workspace",
-    "python.analysis.stubPath": ".vscode",
-
-    // Pyright settings (Cursor)
-    // Set typeCheckingMode to "basic" to enable type checking!
-    "cursorpyright.analysis.typeCheckingMode": "off",
-    "cursorpyright.analysis.extraPaths": ["src", "lib", "resources"],
-    "cursorpyright.analysis.diagnosticMode": "workspace",
-    "cursorpyright.analysis.stubPath": ".vscode",
-
-    // General Python settings
-    "python.defaultInterpreterPath": "./.venv/bin/python",
-    "python.testing.unittestEnabled": false,
-    "python.testing.pytestEnabled": true,
-    "[python]": {
-        "editor.defaultFormatter": "charliermarsh.ruff",
-        "editor.formatOnSave": true,
-    },
 }
diff --git a/acceptance/pipelines/init/sql/output/my_sql_project/AGENTS.md b/acceptance/pipelines/init/sql/output/my_sql_project/AGENTS.md
new file mode 100644
index 00000000000..fdcca98a432
--- /dev/null
+++ b/acceptance/pipelines/init/sql/output/my_sql_project/AGENTS.md
@@ -0,0 +1,25 @@
+# Declarative Automation Bundles Project
+
+This project uses Declarative Automation Bundles (DABs) for deployment. Add project-specific instructions below.
+
+## For AI Agents: Use Databricks AI Tools
+
+**BEFORE any other action, read the `databricks-core` skill.**
+
+It sets you up to work with this project reliably: CLI authentication, profile
+selection, data discovery, and the bundle deployment workflow. Without it,
+results are often slower and less accurate.
+
+If this skill is not available (Databricks AI Tools are not installed), you can install them for your coding agent in seconds:
+
+```bash
+databricks aitools install
+```
+
+If the CLI is not installed, see: https://docs.databricks.com/dev-tools/cli/install
+
+---
+
+## Project Instructions
+
+<!-- Add your project-specific instructions, coding conventions, or notes here -->
diff --git a/acceptance/pipelines/init/sql/output/my_sql_project/databricks.yml b/acceptance/pipelines/init/sql/output/my_sql_project/databricks.yml
index a639afbb930..60823122702 100644
--- a/acceptance/pipelines/init/sql/output/my_sql_project/databricks.yml
+++ b/acceptance/pipelines/init/sql/output/my_sql_project/databricks.yml
@@ -1,4 +1,4 @@
-# This is a Databricks asset bundle definition for my_sql_project.
+# This is a Declarative Automation Bundle definition for my_sql_project.
 # See https://docs.databricks.com/dev-tools/bundles/index.html for documentation.
 bundle:
   name: my_sql_project
diff --git a/acceptance/pipelines/init/sql/output/my_sql_project/out.gitignore b/acceptance/pipelines/init/sql/output/my_sql_project/out.gitignore
index e566c51f740..622a8811a7b 100644
--- a/acceptance/pipelines/init/sql/output/my_sql_project/out.gitignore
+++ b/acceptance/pipelines/init/sql/output/my_sql_project/out.gitignore
@@ -1,9 +1,4 @@
 .databricks/
-build/
-dist/
-__pycache__/
-*.egg-info
-.venv/
 scratch/**
 !scratch/README.md
 **/explorations/**
diff --git a/acceptance/pipelines/init/sql/output/my_sql_project/resources/sample_job.job.yml b/acceptance/pipelines/init/sql/output/my_sql_project/resources/sample_job.job.yml
index 1e1767f2f38..ebb65a80c2b 100644
--- a/acceptance/pipelines/init/sql/output/my_sql_project/resources/sample_job.job.yml
+++ b/acceptance/pipelines/init/sql/output/my_sql_project/resources/sample_job.job.yml
@@ -29,4 +29,4 @@ resources:
       environments:
         - environment_key: default
           spec:
-            environment_version: "4"
+            environment_version: "5"
diff --git a/acceptance/pipelines/init/sql/output/my_sql_project/src/my_sql_project_etl/README.md b/acceptance/pipelines/init/sql/output/my_sql_project/src/my_sql_project_etl/README.md
index 6df39890722..f74a15e6296 100644
--- a/acceptance/pipelines/init/sql/output/my_sql_project/src/my_sql_project_etl/README.md
+++ b/acceptance/pipelines/init/sql/output/my_sql_project/src/my_sql_project_etl/README.md
@@ -15,6 +15,6 @@ To get started, go to the `transformations` folder -- most of the relevant sourc
 * Take a look at the sample called "sample_trips_my_sql_project.py" to get familiar with the syntax.
   Read more about the syntax at https://docs.databricks.com/dlt/python-ref.html.
 * If you're using the workspace UI, use `Run file` to run and preview a single transformation.
-* If you're using the CLI, use `databricks bundle run my_sql_project_etl --select sample_trips_my_sql_project` to run a single transformation.
+* If you're using the CLI, use `databricks bundle run my_sql_project_etl --refresh sample_trips_my_sql_project` to run a single transformation.
 
 For more tutorials and reference material, see https://docs.databricks.com/dlt.
diff --git a/acceptance/pipelines/open/completion/out.test.toml b/acceptance/pipelines/open/completion/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/pipelines/open/completion/out.test.toml
+++ b/acceptance/pipelines/open/completion/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/pipelines/open/open-after-deployment/out.test.toml b/acceptance/pipelines/open/open-after-deployment/out.test.toml
index 519954aedc9..2b7754ff98b 100644
--- a/acceptance/pipelines/open/open-after-deployment/out.test.toml
+++ b/acceptance/pipelines/open/open-after-deployment/out.test.toml
@@ -1,5 +1,3 @@
-Local = true
 Cloud = false
 GOOS.linux = false
 GOOS.windows = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/pipelines/open/open-after-deployment/output.txt b/acceptance/pipelines/open/open-after-deployment/output.txt
index ec19082f2e8..cf468e04dd6 100644
--- a/acceptance/pipelines/open/open-after-deployment/output.txt
+++ b/acceptance/pipelines/open/open-after-deployment/output.txt
@@ -7,18 +7,18 @@ Exit code: 1
 
 >>> [CLI] pipelines deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/pipelines-open/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-View your pipeline test-pipelines-open here: [DATABRICKS_URL]/pipelines/[UUID]?o=[NUMID]
+Created pipelines.test-pipelines-open
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+View your pipeline test-pipelines-open here: [DATABRICKS_URL]/pipelines/[UUID]?w=[WORKSPACE_ID]
 
 === Modify PATH so that real open is not run
 === open after deployment. This will fail to open browser and complain, that's ok, we only want the message
 >>> [CLI] pipelines open
-Opening browser at [DATABRICKS_URL]/pipelines/[UUID]?o=[NUMID]
+Opening browser at [DATABRICKS_URL]/pipelines/[UUID]?w=[WORKSPACE_ID]
 Error: exec: "open": cannot run executable found relative to current directory
 
 === open with KEY, expect same output as opening without KEY
 >>> [CLI] pipelines open test-pipelines-open
-Opening browser at [DATABRICKS_URL]/pipelines/[UUID]?o=[NUMID]
+Opening browser at [DATABRICKS_URL]/pipelines/[UUID]?w=[WORKSPACE_ID]
 Error: exec: "open": cannot run executable found relative to current directory
diff --git a/acceptance/pipelines/run/completion/out.test.toml b/acceptance/pipelines/run/completion/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/pipelines/run/completion/out.test.toml
+++ b/acceptance/pipelines/run/completion/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/pipelines/run/no-wait/out.test.toml b/acceptance/pipelines/run/no-wait/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/pipelines/run/no-wait/out.test.toml
+++ b/acceptance/pipelines/run/no-wait/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/pipelines/run/no-wait/output.txt b/acceptance/pipelines/run/no-wait/output.txt
index 39987c2e3d5..ff1d3d832b2 100644
--- a/acceptance/pipelines/run/no-wait/output.txt
+++ b/acceptance/pipelines/run/no-wait/output.txt
@@ -1,10 +1,10 @@
 
 >>> [CLI] pipelines deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-pipeline-run-flags/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-View your pipeline my_pipeline here: [DATABRICKS_URL]/pipelines/[UUID]?o=[NUMID]
+Created pipelines.my_pipeline
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+View your pipeline my_pipeline here: [DATABRICKS_URL]/pipelines/[UUID]?w=[WORKSPACE_ID]
 
 === test --no-wait flag
 >>> [CLI] pipelines run --no-wait
diff --git a/acceptance/pipelines/run/refresh-flags/out.test.toml b/acceptance/pipelines/run/refresh-flags/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/pipelines/run/refresh-flags/out.test.toml
+++ b/acceptance/pipelines/run/refresh-flags/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/pipelines/run/refresh-flags/output.txt b/acceptance/pipelines/run/refresh-flags/output.txt
index 4a3b2c3234d..68dcd0c9a23 100644
--- a/acceptance/pipelines/run/refresh-flags/output.txt
+++ b/acceptance/pipelines/run/refresh-flags/output.txt
@@ -1,10 +1,10 @@
 
 >>> [CLI] pipelines deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-pipeline-run-flags/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-View your pipeline my_pipeline here: [DATABRICKS_URL]/pipelines/[UUID]?o=[NUMID]
+Created pipelines.my_pipeline
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+View your pipeline my_pipeline here: [DATABRICKS_URL]/pipelines/[UUID]?w=[WORKSPACE_ID]
 
 === Running pipeline with --refresh flag and specific tables
 >>> [CLI] pipelines run --refresh table1,table2
@@ -21,16 +21,16 @@ Update for pipeline completed successfully.
 Pipeline configurations for this update:
 • All tables are refreshed
 
->>> print_requests
+>>> print_requests.py //pipelines
 {
+  "method": "POST",
+  "path": "/api/2.0/pipelines/[UUID]/updates",
   "body": {
     "refresh_selection": [
       "table1",
       "table2"
     ]
-  },
-  "method": "POST",
-  "path": "/api/2.0/pipelines/[UUID]/updates"
+  }
 }
 
 === Running pipeline with --full-refresh-all flag
@@ -48,13 +48,13 @@ Update for pipeline completed successfully.
 Pipeline configurations for this update:
 • All tables are refreshed
 
->>> print_requests
+>>> print_requests.py //pipelines
 {
+  "method": "POST",
+  "path": "/api/2.0/pipelines/[UUID]/updates",
   "body": {
     "full_refresh": true
-  },
-  "method": "POST",
-  "path": "/api/2.0/pipelines/[UUID]/updates"
+  }
 }
 
 === Running pipeline with --full-refresh flag and specific tables
@@ -72,16 +72,16 @@ Update for pipeline completed successfully.
 Pipeline configurations for this update:
 • All tables are refreshed
 
->>> print_requests
+>>> print_requests.py //pipelines
 {
+  "method": "POST",
+  "path": "/api/2.0/pipelines/[UUID]/updates",
   "body": {
     "full_refresh_selection": [
       "table1",
       "table2"
     ]
-  },
-  "method": "POST",
-  "path": "/api/2.0/pipelines/[UUID]/updates"
+  }
 }
 
 === Running pipeline with --full-refresh flag and --refresh flag
@@ -99,8 +99,10 @@ Update for pipeline completed successfully.
 Pipeline configurations for this update:
 • All tables are refreshed
 
->>> print_requests
+>>> print_requests.py //pipelines
 {
+  "method": "POST",
+  "path": "/api/2.0/pipelines/[UUID]/updates",
   "body": {
     "full_refresh_selection": [
       "table1",
@@ -110,7 +112,5 @@ Pipeline configurations for this update:
       "table3",
       "table4"
     ]
-  },
-  "method": "POST",
-  "path": "/api/2.0/pipelines/[UUID]/updates"
+  }
 }
diff --git a/acceptance/pipelines/run/refresh-flags/script b/acceptance/pipelines/run/refresh-flags/script
index 58fea998ccc..b324074d59f 100644
--- a/acceptance/pipelines/run/refresh-flags/script
+++ b/acceptance/pipelines/run/refresh-flags/script
@@ -1,23 +1,18 @@
-print_requests() {
-    jq --sort-keys 'select(.method != "GET" and (.path | contains("/pipelines")))' < out.requests.txt
-    rm out.requests.txt
-}
-
 trace $CLI pipelines deploy
-rm out.requests.txt
+rm "$OUT_REQUESTS"
 
 title "Running pipeline with --refresh flag and specific tables"
 trace $CLI pipelines run --refresh table1,table2
-trace print_requests
+trace print_requests.py //pipelines
 
 title "Running pipeline with --full-refresh-all flag"
 trace $CLI pipelines run --full-refresh-all
-trace print_requests
+trace print_requests.py //pipelines
 
 title "Running pipeline with --full-refresh flag and specific tables"
 trace $CLI pipelines run --full-refresh table1,table2
-trace print_requests
+trace print_requests.py //pipelines
 
 title "Running pipeline with --full-refresh flag and --refresh flag"
 trace $CLI pipelines run --full-refresh table1,table2 --refresh table3,table4
-trace print_requests
+trace print_requests.py //pipelines
diff --git a/acceptance/pipelines/run/restart/out.test.toml b/acceptance/pipelines/run/restart/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/pipelines/run/restart/out.test.toml
+++ b/acceptance/pipelines/run/restart/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/pipelines/run/restart/output.txt b/acceptance/pipelines/run/restart/output.txt
index e28549b9360..07a3215d5dd 100644
--- a/acceptance/pipelines/run/restart/output.txt
+++ b/acceptance/pipelines/run/restart/output.txt
@@ -1,10 +1,10 @@
 
 >>> [CLI] pipelines deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-pipeline-run-flags/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-View your pipeline my_pipeline here: [DATABRICKS_URL]/pipelines/[UUID]?o=[NUMID]
+Created pipelines.my_pipeline
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+View your pipeline my_pipeline here: [DATABRICKS_URL]/pipelines/[UUID]?w=[WORKSPACE_ID]
 
 === Running pipeline with --restart flag
 >>> [CLI] pipelines run --restart
@@ -21,13 +21,13 @@ Update for pipeline completed successfully.
 Pipeline configurations for this update:
 • All tables are refreshed
 
->>> print_requests
+>>> print_requests.py //pipelines
 {
   "method": "POST",
   "path": "/api/2.0/pipelines/[UUID]/stop"
 }
 {
-  "body": {},
   "method": "POST",
-  "path": "/api/2.0/pipelines/[UUID]/updates"
+  "path": "/api/2.0/pipelines/[UUID]/updates",
+  "body": {}
 }
diff --git a/acceptance/pipelines/run/restart/script b/acceptance/pipelines/run/restart/script
index a470005c3b0..65f732e8efa 100644
--- a/acceptance/pipelines/run/restart/script
+++ b/acceptance/pipelines/run/restart/script
@@ -1,12 +1,7 @@
-print_requests() {
-    jq --sort-keys 'select(.method != "GET" and (.path | contains("/pipelines")))' < out.requests.txt
-    rm out.requests.txt
-}
-
 trace $CLI pipelines deploy
-rm out.requests.txt
+rm "$OUT_REQUESTS"
 
 title "Running pipeline with --restart flag"
 # Should stop the current pipeline and start a new update
 trace $CLI pipelines run --restart
-trace print_requests
+trace print_requests.py //pipelines
diff --git a/acceptance/pipelines/run/run-info/out.test.toml b/acceptance/pipelines/run/run-info/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/pipelines/run/run-info/out.test.toml
+++ b/acceptance/pipelines/run/run-info/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/pipelines/run/run-info/output.txt b/acceptance/pipelines/run/run-info/output.txt
index ffdecbfcda6..755270d2611 100644
--- a/acceptance/pipelines/run/run-info/output.txt
+++ b/acceptance/pipelines/run/run-info/output.txt
@@ -1,10 +1,10 @@
 
 >>> [CLI] pipelines deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-pipeline-run/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-View your pipeline my_pipeline here: [DATABRICKS_URL]/pipelines/[UUID]?o=[NUMID]
+Created pipelines.my_pipeline
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+View your pipeline my_pipeline here: [DATABRICKS_URL]/pipelines/[UUID]?w=[WORKSPACE_ID]
 
 === Run pipeline and display pipeline configuration summary and events durations
 >>> [CLI] pipelines run
diff --git a/acceptance/pipelines/run/run-info/test.toml b/acceptance/pipelines/run/run-info/test.toml
index 240a8654ae9..0faf955fe38 100644
--- a/acceptance/pipelines/run/run-info/test.toml
+++ b/acceptance/pipelines/run/run-info/test.toml
@@ -1,4 +1,3 @@
-Local = true
 Cloud = false
 
 [[Server]]
diff --git a/acceptance/pipelines/run/run-pipeline/out.test.toml b/acceptance/pipelines/run/run-pipeline/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/pipelines/run/run-pipeline/out.test.toml
+++ b/acceptance/pipelines/run/run-pipeline/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/pipelines/show/basic/out.test.toml b/acceptance/pipelines/show/basic/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/pipelines/show/basic/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/pipelines/show/basic/output.txt b/acceptance/pipelines/show/basic/output.txt
new file mode 100644
index 00000000000..5acd64d832a
--- /dev/null
+++ b/acceptance/pipelines/show/basic/output.txt
@@ -0,0 +1,79 @@
+
+=== table output
+
+>>> [CLI] pipelines show main.default.people
+id  name
+--  -----
+1   alice
+2   bob
+
+2 rows
+
+=== json output
+
+>>> [CLI] pipelines show main.default.people --output json
+[
+  {
+    "id": "1",
+    "name": "alice"
+  },
+  {
+    "id": "2",
+    "name": "bob"
+  }
+]
+
+=== explicit limit does not show a hint
+
+>>> [CLI] pipelines show main.default.people --limit 9
+id  name
+--  -----
+1   alice
+2   bob
+
+2 rows
+
+=== invalid table name
+
+>>> [CLI] pipelines show people
+Error: invalid table name "people": expected catalog.schema.table (Unity Catalog) or schema.table (legacy Hive metastore)
+
+=== wire SQL pins quoting and limits
+
+>>> print_requests.py //api/2.0/sql/statements
+{
+  "method": "POST",
+  "path": "/api/2.0/sql/statements",
+  "body": {
+    "disposition": "INLINE",
+    "format": "JSON_ARRAY",
+    "on_wait_timeout": "CONTINUE",
+    "statement": "SELECT * FROM `main`.`default`.`people` LIMIT 11",
+    "wait_timeout": "10s",
+    "warehouse_id": "wh-test"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/sql/statements",
+  "body": {
+    "disposition": "INLINE",
+    "format": "JSON_ARRAY",
+    "on_wait_timeout": "CONTINUE",
+    "statement": "SELECT * FROM `main`.`default`.`people` LIMIT 10",
+    "wait_timeout": "10s",
+    "warehouse_id": "wh-test"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/sql/statements",
+  "body": {
+    "disposition": "INLINE",
+    "format": "JSON_ARRAY",
+    "on_wait_timeout": "CONTINUE",
+    "statement": "SELECT * FROM `main`.`default`.`people` LIMIT 9",
+    "wait_timeout": "10s",
+    "warehouse_id": "wh-test"
+  }
+}
diff --git a/acceptance/pipelines/show/basic/script b/acceptance/pipelines/show/basic/script
new file mode 100644
index 00000000000..b63cfc73e23
--- /dev/null
+++ b/acceptance/pipelines/show/basic/script
@@ -0,0 +1,14 @@
+title "table output\n"
+trace $CLI pipelines show main.default.people
+
+title "json output\n"
+trace $CLI pipelines show main.default.people --output json
+
+title "explicit limit does not show a hint\n"
+trace $CLI pipelines show main.default.people --limit 9
+
+title "invalid table name\n"
+musterr trace $CLI pipelines show people
+
+title "wire SQL pins quoting and limits\n"
+trace print_requests.py //api/2.0/sql/statements
diff --git a/acceptance/pipelines/show/basic/test.toml b/acceptance/pipelines/show/basic/test.toml
new file mode 100644
index 00000000000..b0ced00380b
--- /dev/null
+++ b/acceptance/pipelines/show/basic/test.toml
@@ -0,0 +1,17 @@
+RecordRequests = true
+
+Env.DATABRICKS_WAREHOUSE_ID = "wh-test"
+
+# The testserver's SQL Statement Execution API is matcher-driven and fails
+# unmatched statements by default; stub a canned result so the golden shows real
+# columns and rows. The SDK POSTs to the path without a trailing slash.
+[[Server]]
+Pattern = "POST /api/2.0/sql/statements"
+Response.Body = '''
+{
+  "statement_id": "s1",
+  "status": {"state": "SUCCEEDED"},
+  "manifest": {"schema": {"columns": [{"name": "id"}, {"name": "name"}]}, "total_chunk_count": 1},
+  "result": {"data_array": [["1", "alice"], ["2", "bob"]]}
+}
+'''
diff --git a/acceptance/pipelines/show/exact-limit/out.test.toml b/acceptance/pipelines/show/exact-limit/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/pipelines/show/exact-limit/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/pipelines/show/exact-limit/output.txt b/acceptance/pipelines/show/exact-limit/output.txt
new file mode 100644
index 00000000000..dbdb65f350b
--- /dev/null
+++ b/acceptance/pipelines/show/exact-limit/output.txt
@@ -0,0 +1,34 @@
+
+=== default limit does not show a hint when exactly 10 rows are available
+
+>>> [CLI] pipelines show main.default.people
+id
+--
+1
+2
+3
+4
+5
+6
+7
+8
+9
+10
+
+10 rows
+
+=== wire SQL fetches one extra row
+
+>>> print_requests.py //api/2.0/sql/statements
+{
+  "method": "POST",
+  "path": "/api/2.0/sql/statements",
+  "body": {
+    "disposition": "INLINE",
+    "format": "JSON_ARRAY",
+    "on_wait_timeout": "CONTINUE",
+    "statement": "SELECT * FROM `main`.`default`.`people` LIMIT 11",
+    "wait_timeout": "10s",
+    "warehouse_id": "wh-test"
+  }
+}
diff --git a/acceptance/pipelines/show/exact-limit/script b/acceptance/pipelines/show/exact-limit/script
new file mode 100644
index 00000000000..1b74a228537
--- /dev/null
+++ b/acceptance/pipelines/show/exact-limit/script
@@ -0,0 +1,5 @@
+title "default limit does not show a hint when exactly 10 rows are available\n"
+trace $CLI pipelines show main.default.people
+
+title "wire SQL fetches one extra row\n"
+trace print_requests.py //api/2.0/sql/statements
diff --git a/acceptance/pipelines/show/exact-limit/test.toml b/acceptance/pipelines/show/exact-limit/test.toml
new file mode 100644
index 00000000000..eec09b87ca7
--- /dev/null
+++ b/acceptance/pipelines/show/exact-limit/test.toml
@@ -0,0 +1,14 @@
+RecordRequests = true
+
+Env.DATABRICKS_WAREHOUSE_ID = "wh-test"
+
+[[Server]]
+Pattern = "POST /api/2.0/sql/statements"
+Response.Body = '''
+{
+  "statement_id": "s1",
+  "status": {"state": "SUCCEEDED"},
+  "manifest": {"schema": {"columns": [{"name": "id"}]}, "total_chunk_count": 1},
+  "result": {"data_array": [["1"], ["2"], ["3"], ["4"], ["5"], ["6"], ["7"], ["8"], ["9"], ["10"]]}
+}
+'''
diff --git a/acceptance/pipelines/show/help/out.test.toml b/acceptance/pipelines/show/help/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/pipelines/show/help/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/pipelines/show/help/output.txt b/acceptance/pipelines/show/help/output.txt
new file mode 100644
index 00000000000..67a94f1bdb1
--- /dev/null
+++ b/acceptance/pipelines/show/help/output.txt
@@ -0,0 +1,22 @@
+
+=== help
+>>> [CLI] pipelines show --help
+Preview a table's columns and sample rows on a SQL warehouse.
+
+TABLE is a fully-qualified name: catalog.schema.table (Unity Catalog) or
+schema.table (legacy Hive metastore).
+
+Usage:
+  databricks pipelines show TABLE [flags]
+
+Flags:
+  -h, --help                  help for show
+  -n, --limit int             Maximum number of rows to fetch. (default 10)
+      --warehouse-id string   SQL warehouse to run the query on. Defaults to DATABRICKS_WAREHOUSE_ID or a workspace default.
+
+Global Flags:
+      --debug            enable debug logging
+  -o, --output type      output type: text or json (default text)
+  -p, --profile string   ~/.databrickscfg profile
+  -t, --target string    bundle target to use (if applicable)
+      --var strings      set values for variables defined in project config. Example: --var="foo=bar"
diff --git a/acceptance/pipelines/show/help/script b/acceptance/pipelines/show/help/script
new file mode 100644
index 00000000000..4bf308a2d04
--- /dev/null
+++ b/acceptance/pipelines/show/help/script
@@ -0,0 +1,4 @@
+# Pin the command tree so any change to the command or its help shows up as a diff here.
+
+title "help"
+trace $CLI pipelines show --help
diff --git a/acceptance/pipelines/show/limit-hint/out.test.toml b/acceptance/pipelines/show/limit-hint/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/pipelines/show/limit-hint/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/pipelines/show/limit-hint/output.txt b/acceptance/pipelines/show/limit-hint/output.txt
new file mode 100644
index 00000000000..5a359f7b992
--- /dev/null
+++ b/acceptance/pipelines/show/limit-hint/output.txt
@@ -0,0 +1,35 @@
+
+=== default limit shows a hint when more rows are available
+
+>>> [CLI] pipelines show main.default.people
+id
+--
+1
+2
+3
+4
+5
+6
+7
+8
+9
+10
+
+10 rows
+Use --limit <n> to preview more rows.
+
+=== wire SQL fetches one extra row
+
+>>> print_requests.py //api/2.0/sql/statements
+{
+  "method": "POST",
+  "path": "/api/2.0/sql/statements",
+  "body": {
+    "disposition": "INLINE",
+    "format": "JSON_ARRAY",
+    "on_wait_timeout": "CONTINUE",
+    "statement": "SELECT * FROM `main`.`default`.`people` LIMIT 11",
+    "wait_timeout": "10s",
+    "warehouse_id": "wh-test"
+  }
+}
diff --git a/acceptance/pipelines/show/limit-hint/script b/acceptance/pipelines/show/limit-hint/script
new file mode 100644
index 00000000000..7f066a8fe9c
--- /dev/null
+++ b/acceptance/pipelines/show/limit-hint/script
@@ -0,0 +1,5 @@
+title "default limit shows a hint when more rows are available\n"
+trace $CLI pipelines show main.default.people
+
+title "wire SQL fetches one extra row\n"
+trace print_requests.py //api/2.0/sql/statements
diff --git a/acceptance/pipelines/show/limit-hint/test.toml b/acceptance/pipelines/show/limit-hint/test.toml
new file mode 100644
index 00000000000..9887d749d23
--- /dev/null
+++ b/acceptance/pipelines/show/limit-hint/test.toml
@@ -0,0 +1,14 @@
+RecordRequests = true
+
+Env.DATABRICKS_WAREHOUSE_ID = "wh-test"
+
+[[Server]]
+Pattern = "POST /api/2.0/sql/statements"
+Response.Body = '''
+{
+  "statement_id": "s1",
+  "status": {"state": "SUCCEEDED"},
+  "manifest": {"schema": {"columns": [{"name": "id"}]}, "total_chunk_count": 1},
+  "result": {"data_array": [["1"], ["2"], ["3"], ["4"], ["5"], ["6"], ["7"], ["8"], ["9"], ["10"], ["11"]]}
+}
+'''
diff --git a/acceptance/pipelines/show/rendering/out.test.toml b/acceptance/pipelines/show/rendering/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/pipelines/show/rendering/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/pipelines/show/rendering/output.txt b/acceptance/pipelines/show/rendering/output.txt
new file mode 100644
index 00000000000..499332abbba
--- /dev/null
+++ b/acceptance/pipelines/show/rendering/output.txt
@@ -0,0 +1,26 @@
+
+=== table output: long note truncated, ragged row blank cell
+
+>>> [CLI] pipelines show main.default.people
+name   id  note
+-----  --  ----------------------------------------
+alice  1   this is a very long note value that e...
+bob    2   
+
+2 rows
+
+=== json output: column order preserved, ragged row padded with null
+
+>>> [CLI] pipelines show main.default.people --output json
+[
+  {
+    "name": "alice",
+    "id": "1",
+    "note": "this is a very long note value that exceeds forty display cells"
+  },
+  {
+    "name": "bob",
+    "id": "2",
+    "note": null
+  }
+]
diff --git a/acceptance/pipelines/show/rendering/script b/acceptance/pipelines/show/rendering/script
new file mode 100644
index 00000000000..5ae4498b154
--- /dev/null
+++ b/acceptance/pipelines/show/rendering/script
@@ -0,0 +1,5 @@
+title "table output: long note truncated, ragged row blank cell\n"
+trace $CLI pipelines show main.default.people
+
+title "json output: column order preserved, ragged row padded with null\n"
+trace $CLI pipelines show main.default.people --output json
diff --git a/acceptance/pipelines/show/rendering/test.toml b/acceptance/pipelines/show/rendering/test.toml
new file mode 100644
index 00000000000..1b01e09a2b9
--- /dev/null
+++ b/acceptance/pipelines/show/rendering/test.toml
@@ -0,0 +1,16 @@
+RecordRequests = false
+
+Env.DATABRICKS_WAREHOUSE_ID = "wh-test"
+
+# Non-alphabetical columns test JSON order preservation; the ragged second row tests
+# null padding, and the long note tests cell truncation.
+[[Server]]
+Pattern = "POST /api/2.0/sql/statements"
+Response.Body = '''
+{
+  "statement_id": "s1",
+  "status": {"state": "SUCCEEDED"},
+  "manifest": {"schema": {"columns": [{"name": "name"}, {"name": "id"}, {"name": "note"}]}, "total_chunk_count": 1},
+  "result": {"data_array": [["alice", "1", "this is a very long note value that exceeds forty display cells"], ["bob", "2"]]}
+}
+'''
diff --git a/acceptance/pipelines/stop/out.test.toml b/acceptance/pipelines/stop/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/pipelines/stop/out.test.toml
+++ b/acceptance/pipelines/stop/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/pipelines/stop/output.txt b/acceptance/pipelines/stop/output.txt
index b8a85e88977..76587739aed 100644
--- a/acceptance/pipelines/stop/output.txt
+++ b/acceptance/pipelines/stop/output.txt
@@ -1,10 +1,10 @@
 
 >>> [CLI] pipelines deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-pipeline-stop/default/files...
-Deploying resources...
-Updating deployment state...
-Deployment complete!
-View your pipeline my_pipeline here: [DATABRICKS_URL]/pipelines/[UUID]?o=[NUMID]
+Created pipelines.my_pipeline
+Files: 2 uploaded, 0 deleted
+Resources: 1 created, 0 changed, 0 deleted, 0 unchanged
+View your pipeline my_pipeline here: [DATABRICKS_URL]/pipelines/[UUID]?w=[WORKSPACE_ID]
 
 >>> [CLI] pipelines run
 Recommendation: This command runs the last deployed version of the code
diff --git a/acceptance/pipelines/stop/script b/acceptance/pipelines/stop/script
index 8eed3686432..4abb9de67a8 100644
--- a/acceptance/pipelines/stop/script
+++ b/acceptance/pipelines/stop/script
@@ -1,16 +1,11 @@
-print_requests() {
-    jq --sort-keys 'select(.method != "GET" and (.path | contains("/pipelines")))' < out.requests.txt
-    rm out.requests.txt
-}
-
 trace $CLI pipelines deploy
 trace $CLI pipelines run
-rm out.requests.txt
+rm "$OUT_REQUESTS"
 
 title "Stopping pipeline"
 trace $CLI pipelines stop
-print_requests
+print_requests.py //pipelines
 
 title "Stopping pipeline with KEY, expect same output as without KEY"
 trace $CLI pipelines stop my_pipeline
-print_requests
+print_requests.py //pipelines
diff --git a/acceptance/pipelines/test.toml b/acceptance/pipelines/test.toml
deleted file mode 100644
index b2881a9045e..00000000000
--- a/acceptance/pipelines/test.toml
+++ /dev/null
@@ -1,3 +0,0 @@
-# All pipelines tests are local only
-Local = true
-Cloud = false
diff --git a/acceptance/quickstart/out.test.toml b/acceptance/quickstart/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/quickstart/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/quickstart/output.txt b/acceptance/quickstart/output.txt
new file mode 100644
index 00000000000..62e9502a7c0
--- /dev/null
+++ b/acceptance/quickstart/output.txt
@@ -0,0 +1,88 @@
+# Databricks Quickstart
+
+The `databricks` CLI wraps the public Databricks REST API — there's a command for essentially every API endpoint, so almost any Databricks task can be driven from here. If something looks unsupported, it's almost always a command you haven't found yet, not a real gap. The headline workflow: build durable resources as code with **Declarative Automation Bundles (DABs)** and ship them with `databricks bundle deploy` (see Build and deploy below).
+
+## Golden rules
+
+- **Reason, don't refuse.** Before telling the user something can't be done, run `databricks <group> --help` and install the matching skill (below). Almost everything is reachable through the CLI.
+- **Build with bundles.** For anything durable — jobs, pipelines, dashboards, apps — define it as code in a Declarative Automation Bundle (DABs) and ship with `databricks bundle deploy`, not one-off API calls.
+- **Pick the profile deliberately.** Run `databricks auth profiles`. If only one profile exists, use it. If one is already set as the default (via `databricks auth switch`), assume that one — you can confirm if unsure. Otherwise, show the user the profiles with their workspace URLs and let them choose. Don't invent profile names.
+- **Always pass `--profile <name>`.** Each Bash command runs in its own shell, so a separate `export DATABRICKS_CONFIG_PROFILE=...` line does NOT persist. Use the flag, or chain with `&&`.
+- **OAuth, never PAT.** Authenticate with `databricks auth login`, not personal access tokens.
+
+## Step 1 — Authenticate
+
+```bash
+databricks auth profiles                  # already set up? lists profiles + validity
+databricks auth login --profile <name>    # if not — opens login.databricks.com to pick a workspace
+```
+
+No host needed: without `--host`, login opens login.databricks.com and the user picks a workspace in the browser. Only pass `--host <url>` if the user already gave you a specific workspace URL. Always pass a descriptive `--profile <name>` (e.g. `dev-aws`, `prod-azure`) so you can target it reliably afterward — ask the user for the name rather than inventing one.
+
+## Step 2 — Verify
+
+```bash
+databricks current-user me --profile <name>
+```
+
+## Build and deploy with Declarative Automation Bundles (DABs)
+
+**DABs are the standard, recommended way to build on Databricks.** A bundle is a project with a `databricks.yml` that declares your resources (jobs, pipelines, dashboards, apps) and its targets (e.g. dev, prod) — one project, one deploy, every resource type:
+
+```bash
+databricks bundle init                     # scaffold a project from a template
+databricks bundle validate                 # check the config
+databricks bundle deploy -t dev            # deploy everything to a target (dev, prod, ...)
+databricks bundle run <resource> -t dev    # run a job or pipeline
+```
+
+Read the `databricks-dabs` skill for bundle structure, resource schemas, and multi-target setup.
+
+**Databricks Apps** (full-stack TypeScript + React via AppKit) build on bundles too, with a dedicated scaffolder — see `databricks-apps`:
+
+```bash
+databricks apps init          # scaffold an AppKit app (generates the bundle for you)
+databricks apps deploy        # deploy it to the workspace
+databricks apps run-local     # develop locally (or `dev-remote` against the workspace)
+```
+
+## Common commands
+
+```bash
+databricks jobs list --profile <name>
+databricks pipelines list --profile <name>
+databricks apps list --profile <name>
+databricks warehouses list --profile <name>
+
+# Unity Catalog data uses POSITIONAL args, NOT flags:
+databricks catalogs list --profile <name>
+databricks schemas list <catalog> --profile <name>
+databricks tables list <catalog> <schema> --profile <name>
+```
+
+Unsure of a command's shape? Run `databricks <command> --help`.
+
+## Install skills for the task
+
+Skills give you Databricks-specific patterns so you build resources correctly instead of guessing. They install into your coding agent (auto-detected):
+
+```bash
+databricks aitools install                 # stable skills
+databricks aitools install --experimental  # broader coverage: more areas, lower quality bar
+databricks aitools list                    # available + installed skills — check this for the latest
+```
+
+The set evolves, so run `databricks aitools list` rather than relying on a fixed list. Common ones: `databricks-core` (CLI/auth), `databricks-jobs`, `databricks-pipelines`, `databricks-dabs` (deploy as code), `databricks-apps`. Experimental skills reach further (Unity Catalog, vector search, dashboards, AI functions, and more) — worth a look depending on the prompt.
+
+## Explore data
+
+Use the built-in tools instead of guessing SQL or navigating by hand:
+
+```bash
+databricks experimental aitools tools discover-schema <catalog>.<schema>.<table> --profile <name>
+databricks experimental aitools tools query "SELECT * FROM <table> LIMIT 10" --profile <name>
+```
+
+## When you get stuck
+
+Re-read `databricks <group> --help`, install the matching skill, and check https://docs.databricks.com. If you truly can't do something yourself, tell the user how they can — don't tell them Databricks can't.
diff --git a/acceptance/quickstart/script b/acceptance/quickstart/script
new file mode 100644
index 00000000000..ffe8b163648
--- /dev/null
+++ b/acceptance/quickstart/script
@@ -0,0 +1 @@
+$CLI quickstart
diff --git a/acceptance/regression_test.go b/acceptance/regression_test.go
new file mode 100644
index 00000000000..c37ad214c4e
--- /dev/null
+++ b/acceptance/regression_test.go
@@ -0,0 +1,444 @@
+package acceptance_test
+
+import (
+	"errors"
+	"flag"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"regexp"
+	"runtime"
+	"slices"
+	"strconv"
+	"strings"
+	"testing"
+
+	"github.com/databricks/cli/acceptance/internal/selection"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/sync/errgroup"
+)
+
+// Regression mode runs the acceptance tests this branch changed against other CLI
+// builds, to tell tests that pin new behavior (fail on main) from tests that cover
+// existing behavior (pass everywhere). The tests and the test harness always come from
+// this branch; only the CLI binary under test is swapped (see -clipath, -useversion).
+var (
+	RegrMain    bool
+	RegrRelease bool
+	RegrOutput  string
+)
+
+func init() {
+	flag.BoolVar(&RegrMain, "regr-main", false, "Run the tests changed on this branch against a CLI built from the merge base with origin/main and report the difference. Use with -v to see the summary")
+	flag.BoolVar(&RegrRelease, "regr-release", false, "Run the tests changed on this branch against the latest released CLI and report the difference. Use with -v to see the summary")
+	flag.StringVar(&RegrOutput, "regr-output", "../regression_report.md", "Where -regr-main and -regr-release write the full markdown report")
+}
+
+const (
+	// regrDefaultLimit caps how many changed tests are compared unless selection.EnvVar says otherwise.
+	regrDefaultLimit = 20
+
+	// regrDetailLines caps the output of one failed run in the report.
+	regrDetailLines = 200
+
+	prerequisitesTest = "TestAccept/prerequisites"
+)
+
+const (
+	statusPass = "pass"
+	statusFail = "fail"
+	statusSkip = "skip"
+)
+
+// Categories a test falls into, see classifyRegression.
+const (
+	// catRegression passes on this branch and fails on main: it pins behavior this branch introduced.
+	catRegression = "regression"
+
+	// catUnreleased passes on this branch and main and fails on the latest release: it covers
+	// behavior that is merged but not shipped yet.
+	catUnreleased = "unreleased"
+
+	// catCoverage passes everywhere.
+	catCoverage = "coverage"
+
+	// catFailing fails on this branch.
+	catFailing = "failing"
+)
+
+// regrCategories lists the categories in the order reports show them.
+var regrCategories = []string{catRegression, catUnreleased, catCoverage, catFailing}
+
+// testResult is the outcome of one test in a child run, with the log lines it produced.
+type testResult struct {
+	Status string
+	Output []string
+}
+
+// regrColumn holds the results of running the selected tests with one CLI.
+type regrColumn struct {
+	// Title is the column header in the report.
+	Title string
+
+	// Category is what a failure in this column means for the test, empty for the branch column.
+	Category string
+
+	Results map[string]*testResult
+}
+
+func (c regrColumn) status(test string) string {
+	if r, ok := c.Results[test]; ok {
+		return r.Status
+	}
+	return ""
+}
+
+var (
+	// "=== RUN   TestAccept/foo", also CONT, NAME and PAUSE: following log lines belong to that test.
+	markerLineRE = regexp.MustCompile(`^=== (?:RUN|CONT|NAME|PAUSE)\s+(\S+)`)
+
+	// "    --- FAIL: TestAccept/foo (0.10s)"
+	resultLineRE = regexp.MustCompile(`^\s*--- (PASS|FAIL|SKIP): (\S+) `)
+
+	// The temp dir of a test, e.g. "/tmp/TestAcceptfoo123456"; the random suffix differs on every run.
+	tmpDirRE = regexp.MustCompile(`/TestAccept[^/\s]*`)
+)
+
+// parseTestOutput parses the output of a test binary run with -test.v into results by test name.
+func parseTestOutput(output string) map[string]*testResult {
+	results := map[string]*testResult{}
+	current := ""
+	for line := range strings.Lines(output) {
+		line = strings.TrimRight(line, "\r\n")
+		if m := markerLineRE.FindStringSubmatch(line); m != nil {
+			current = m[1]
+			if _, ok := results[current]; !ok {
+				results[current] = &testResult{}
+			}
+			continue
+		}
+		if m := resultLineRE.FindStringSubmatch(line); m != nil {
+			if _, ok := results[m[2]]; !ok {
+				results[m[2]] = &testResult{}
+			}
+			results[m[2]].Status = strings.ToLower(m[1])
+			continue
+		}
+		if current != "" {
+			results[current].Output = append(results[current].Output, line)
+		}
+	}
+	return results
+}
+
+// leafTests returns the tests that ran a test script, sorted. A test with EnvMatrix variants
+// is represented by its variants (named KEY=value) rather than by itself.
+func leafTests(results map[string]*testResult) []string {
+	parents := map[string]bool{}
+	for name := range results {
+		for i, c := range name {
+			if c != '/' {
+				continue
+			}
+			next, _, _ := strings.Cut(name[i+1:], "/")
+			if strings.Contains(next, "=") {
+				parents[name[:i]] = true
+			}
+		}
+	}
+
+	var leaves []string
+	for name, r := range results {
+		if parents[name] || name == "TestAccept" || name == prerequisitesTest || r.Status == "" {
+			continue
+		}
+		leaves = append(leaves, name)
+	}
+	slices.Sort(leaves)
+	return leaves
+}
+
+func isOK(status string) bool {
+	return status == statusPass || status == statusSkip
+}
+
+// classifyRegression says what the status of one test on every CLI means. refs are the
+// non-branch columns in the order they are checked.
+func classifyRegression(branch string, refs, refCategories []string) string {
+	if !isOK(branch) {
+		return catFailing
+	}
+	for i, status := range refs {
+		if !isOK(status) {
+			return refCategories[i]
+		}
+	}
+	return catCoverage
+}
+
+func categorize(test string, branch regrColumn, refs []regrColumn) string {
+	statuses := make([]string, len(refs))
+	categories := make([]string, len(refs))
+	for i, ref := range refs {
+		statuses[i] = ref.status(test)
+		categories[i] = ref.Category
+	}
+	return classifyRegression(branch.status(test), statuses, categories)
+}
+
+func statusMark(status string) string {
+	switch status {
+	case statusPass:
+		return "✅"
+	case statusFail:
+		return "❌"
+	case statusSkip:
+		return "⏭️"
+	default:
+		return "➖"
+	}
+}
+
+// countByCategory counts the tests in each category.
+func countByCategory(tests []string, branch regrColumn, refs []regrColumn) map[string]int {
+	counts := map[string]int{}
+	for _, test := range tests {
+		counts[categorize(test, branch, refs)]++
+	}
+	return counts
+}
+
+func formatCounts(counts map[string]int) string {
+	var parts []string
+	for _, cat := range regrCategories {
+		parts = append(parts, fmt.Sprintf("%s=%d", cat, counts[cat]))
+	}
+	return strings.Join(parts, " ")
+}
+
+// renderRegressionReport returns the markdown report. columns[0] is the branch, the rest are
+// the CLIs it is compared against.
+func renderRegressionReport(selected string, columns []regrColumn) string {
+	branch, refs := columns[0], columns[1:]
+	tests := leafTests(branch.Results)
+
+	var b strings.Builder
+	b.WriteString("## Regression test report\n\n")
+	fmt.Fprintf(&b, "%s\n\n", selected)
+	fmt.Fprintf(&b, "%d tests: %s\n\n", len(tests), formatCounts(countByCategory(tests, branch, refs)))
+
+	b.WriteString("| test | " + strings.Join(columnTitles(columns), " | ") + " |\n")
+	b.WriteString("|---|" + strings.Repeat("---|", len(columns)) + "\n")
+	for _, test := range tests {
+		marks := make([]string, len(columns))
+		for i, c := range columns {
+			marks[i] = statusMark(c.status(test))
+		}
+		fmt.Fprintf(&b, "| %s | %s |\n", test, strings.Join(marks, " | "))
+	}
+	b.WriteString("\n")
+
+	for _, test := range tests {
+		renderDetails(&b, test, columns)
+	}
+	return b.String()
+}
+
+func columnTitles(columns []regrColumn) []string {
+	titles := make([]string, len(columns))
+	for i, c := range columns {
+		titles[i] = c.Title
+	}
+	return titles
+}
+
+// renderDetails adds a collapsible section with the output of every failed run of the test.
+func renderDetails(b *strings.Builder, test string, columns []regrColumn) {
+	var failed []regrColumn
+	for _, c := range columns {
+		if c.status(test) == statusFail {
+			failed = append(failed, c)
+		}
+	}
+	if len(failed) == 0 {
+		return
+	}
+
+	marks := make([]string, len(columns))
+	for i, c := range columns {
+		marks[i] = c.Title + " " + statusMark(c.status(test))
+	}
+	fmt.Fprintf(b, "<details>\n<summary>%s: %s</summary>\n\n", test, strings.Join(marks, " | "))
+	// A new test commonly fails the same way on main and on the release, which would print the
+	// same long diff twice.
+	firstWith := map[string]string{}
+	for _, c := range failed {
+		output := strings.TrimSpace(strings.Join(c.Results[test].Output, "\n"))
+		key := tmpDirRE.ReplaceAllString(output, "/TestAccept")
+		if first, ok := firstWith[key]; ok {
+			fmt.Fprintf(b, "**%s:** same output as %s\n\n", c.Title, first)
+			continue
+		}
+		firstWith[key] = c.Title
+		// The longer fence keeps backticks in the output from ending the block.
+		fmt.Fprintf(b, "**%s:**\n````\n%s\n````\n\n", c.Title, truncateLines(output, regrDetailLines))
+	}
+	b.WriteString("</details>\n\n")
+}
+
+// printRegressionSummary prints the short form of the report: counts, and the names of the
+// tests that need attention.
+func printRegressionSummary(columns []regrColumn, reportPath string) {
+	branch, refs := columns[0], columns[1:]
+	tests := leafTests(branch.Results)
+
+	fmt.Printf("\nRegression summary (%d tests): %s\n", len(tests), formatCounts(countByCategory(tests, branch, refs)))
+	for _, cat := range []string{catRegression, catFailing} {
+		for _, test := range tests {
+			if categorize(test, branch, refs) == cat {
+				fmt.Printf("  %s: %s\n", cat, test)
+			}
+		}
+	}
+	fmt.Printf("Full report: %s\n", reportPath)
+}
+
+// runRegression runs the tests this branch changed with the branch CLI and with each CLI
+// requested by -regr-main and -regr-release, then reports the difference.
+//
+// Each run is a child process of this test binary, because the harness builds the CLI and
+// starts the servers once per process. The children select the changed tests themselves
+// (selection.EnvVar), so all of them run the same tests.
+func runRegression(t *testing.T) {
+	testDirs, err := selection.FindTestDirs(".")
+	require.NoError(t, err)
+	testDirsSet := make(map[string]bool, len(testDirs))
+	for _, dir := range testDirs {
+		testDirsSet[dir] = true
+	}
+
+	limit, err := selection.ParseLimit(os.Getenv(selection.EnvVar))
+	require.NoError(t, err)
+	if limit == 0 {
+		limit = regrDefaultLimit
+	}
+
+	result, err := selection.FromGit(".", testDirsSet, limit)
+	require.NoError(t, err)
+	fmt.Println(result.Counts())
+	if len(result.Selected) == 0 {
+		fmt.Println("No acceptance tests were changed on this branch, nothing to compare")
+		return
+	}
+
+	cwd, err := os.Getwd()
+	require.NoError(t, err)
+
+	// The CLI of main does not depend on the branch run, so it is built while that runs.
+	var mainCLI, mainShort string
+	var mainBuild errgroup.Group
+	if RegrMain {
+		mergeBase := gitOutput(t, "merge-base", "HEAD", "origin/main")
+		mainShort = gitOutput(t, "rev-parse", "--short", mergeBase)
+		src, fips := t.TempDir(), readGOFIPS140(t, cwd)
+		fmt.Printf("Building the CLI of main (%s)\n", mainShort)
+		mainBuild.Go(func() (err error) {
+			mainCLI, err = buildCLIAtRef(src, mergeBase, fips)
+			return err
+		})
+	}
+
+	fmt.Println("Running the selected tests with the CLI of this branch")
+	columns := []regrColumn{{Title: "branch", Results: runAcceptanceChild(t, limit)}}
+
+	if RegrMain {
+		require.NoError(t, mainBuild.Wait())
+		fmt.Printf("Running the selected tests with the CLI of main (%s)\n", mainShort)
+		columns = append(columns, regrColumn{
+			Title:    "main (" + mainShort + ")",
+			Category: catRegression,
+			Results:  runAcceptanceChild(t, limit, "-clipath="+mainCLI),
+		})
+	}
+
+	if RegrRelease {
+		version := resolveLatestVersion(t, getBuildDir(t, cwd, runtime.GOOS, runtime.GOARCH))
+		fmt.Printf("Running the selected tests with the latest release (v%s)\n", version)
+		columns = append(columns, regrColumn{
+			Title:    "latest (v" + version + ")",
+			Category: catUnreleased,
+			Results:  runAcceptanceChild(t, limit, "-useversion="+version),
+		})
+	}
+
+	report := renderRegressionReport(result.Counts(), columns)
+	require.NoError(t, os.WriteFile(RegrOutput, []byte(report), 0o644))
+	printRegressionSummary(columns, filepath.ToSlash(RegrOutput))
+}
+
+// runAcceptanceChild runs TestAccept in a child process of this test binary and returns what it
+// reports. Failing tests are expected and are not an error, a run without results is.
+func runAcceptanceChild(t *testing.T, limit int, args ...string) map[string]*testResult {
+	args = append([]string{
+		"-test.run=^TestAccept$",
+		"-test.v",
+		"-test.count=1",
+		"-test.timeout=" + flag.Lookup("test.timeout").Value.String(),
+	}, args...)
+
+	cmd := exec.Command(os.Args[0], args...)
+	cmd.Env = append(os.Environ(), selection.EnvVar+"="+strconv.Itoa(limit))
+	out, err := cmd.CombinedOutput()
+	if _, ok := errors.AsType[*exec.ExitError](err); err != nil && !ok {
+		require.NoError(t, err)
+	}
+
+	results := parseTestOutput(string(out))
+	if len(leafTests(results)) == 0 {
+		lines := strings.Split(strings.TrimSpace(string(out)), "\n")
+		require.Fail(t, "no test results", "%s failed:\n%s", cmd.Args, strings.Join(lines[max(0, len(lines)-50):], "\n"))
+	}
+	return results
+}
+
+// buildCLIAtRef builds the CLI from the source tree at ref in the empty directory src, and
+// returns the path of the binary. The tree is exported with git archive so the working tree is
+// not touched. It runs next to a test, so it reports errors instead of failing t.
+func buildCLIAtRef(src, ref, gofips140 string) (string, error) {
+	archive := exec.Command("git", "archive", "--format=tar", ref)
+	// git archive exports the subtree of its working directory, and the CLI is the whole repo.
+	archive.Dir = ".."
+	extract := exec.Command("tar", "-x", "-C", src)
+	pipe, err := archive.StdoutPipe()
+	if err != nil {
+		return "", err
+	}
+	extract.Stdin = pipe
+	if err := archive.Start(); err != nil {
+		return "", fmt.Errorf("git archive %s: %w", ref, err)
+	}
+	// Waiting for the extraction first lets tar drain the pipe before archive.Wait closes it.
+	if err := extract.Run(); err != nil {
+		return "", fmt.Errorf("extracting %s: %w", ref, err)
+	}
+	if err := archive.Wait(); err != nil {
+		return "", fmt.Errorf("git archive %s: %w", ref, err)
+	}
+
+	cli := filepath.Join(src, "databricks"+exeSuffix)
+	// The exported tree has no .git, so VCS stamping would fail.
+	build := exec.Command("go", "build", "-buildvcs=false", "-o", cli, ".")
+	build.Dir = src
+	build.Env = append(os.Environ(), "GOFIPS140="+gofips140)
+	if out, err := build.CombinedOutput(); err != nil {
+		return "", fmt.Errorf("building the CLI at %s: %w\n%s", ref, err, strings.TrimSpace(string(out)))
+	}
+	return cli, nil
+}
+
+func gitOutput(t *testing.T, args ...string) string {
+	out, err := exec.Command("git", args...).Output()
+	require.NoError(t, err, "git %s", strings.Join(args, " "))
+	return strings.TrimSpace(string(out))
+}
diff --git a/acceptance/regression_unit_test.go b/acceptance/regression_unit_test.go
new file mode 100644
index 00000000000..8a5900ce10c
--- /dev/null
+++ b/acceptance/regression_unit_test.go
@@ -0,0 +1,85 @@
+package acceptance_test
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+const sampleOutput = `=== RUN   TestAccept
+=== RUN   TestAccept/prerequisites
+--- PASS: TestAccept/prerequisites (0.10s)
+=== RUN   TestAccept/bundle/a
+=== PAUSE TestAccept/bundle/a
+=== RUN   TestAccept/bundle/inv
+=== RUN   TestAccept/bundle/inv/DMS=true/INPUT_CONFIG=x.yml.tmpl
+=== CONT  TestAccept/bundle/a
+    acceptance_test.go:1: boom
+=== CONT  TestAccept/bundle/inv/DMS=true/INPUT_CONFIG=x.yml.tmpl
+--- FAIL: TestAccept (1.00s)
+    --- PASS: TestAccept/prerequisites (0.10s)
+    --- FAIL: TestAccept/bundle/a (0.50s)
+    --- SKIP: TestAccept/bundle/inv (0.00s)
+        --- PASS: TestAccept/bundle/inv/DMS=true/INPUT_CONFIG=x.yml.tmpl (0.00s)
+`
+
+func TestParseTestOutput(t *testing.T) {
+	results := parseTestOutput(sampleOutput)
+	assert.Equal(t, statusFail, results["TestAccept/bundle/a"].Status)
+	assert.Equal(t, []string{"    acceptance_test.go:1: boom"}, results["TestAccept/bundle/a"].Output)
+	assert.Equal(t, statusPass, results["TestAccept/bundle/inv/DMS=true/INPUT_CONFIG=x.yml.tmpl"].Status)
+}
+
+func TestLeafTests(t *testing.T) {
+	assert.Equal(t,
+		[]string{"TestAccept/bundle/a", "TestAccept/bundle/inv/DMS=true/INPUT_CONFIG=x.yml.tmpl"},
+		leafTests(parseTestOutput(sampleOutput)))
+}
+
+func TestClassifyRegression(t *testing.T) {
+	refCats := []string{catRegression, catUnreleased}
+	tests := []struct {
+		branch string
+		refs   []string
+		want   string
+	}{
+		{statusFail, []string{statusPass, statusPass}, catFailing},
+		{statusPass, []string{statusFail, statusFail}, catRegression},
+		{statusPass, []string{statusPass, statusFail}, catUnreleased},
+		{statusPass, []string{statusSkip, statusSkip}, catCoverage},
+		{statusPass, []string{"", statusPass}, catRegression},
+	}
+	for _, tt := range tests {
+		assert.Equal(t, tt.want, classifyRegression(tt.branch, tt.refs, refCats), "%v", tt)
+	}
+}
+
+func TestRenderRegressionReport(t *testing.T) {
+	branch := regrColumn{Title: "branch", Results: parseTestOutput(sampleOutput)}
+	main := regrColumn{Title: "main (abc)", Category: catRegression, Results: map[string]*testResult{
+		"TestAccept/bundle/a": {Status: statusFail, Output: []string{"main failure"}},
+	}}
+
+	report := renderRegressionReport("Selected 2", []regrColumn{branch, main})
+	assert.Contains(t, report, "| test | branch | main (abc) |")
+	assert.Contains(t, report, "| TestAccept/bundle/a | ❌ | ❌ |")
+	assert.Contains(t, report, "**main (abc):**\n````\nmain failure\n````")
+	assert.Contains(t, report, "failing=1")
+}
+
+func TestRenderRegressionReportDedupesIdenticalFailures(t *testing.T) {
+	failure := func(tmp string) *testResult {
+		return &testResult{Status: statusFail, Output: []string{"Messages: output.txt vs /tmp/TestAcceptfoo" + tmp + "/002/output.txt", "diff"}}
+	}
+	test := "TestAccept/bundle/a"
+	columns := []regrColumn{
+		{Title: "branch", Results: map[string]*testResult{test: {Status: statusPass}}},
+		{Title: "main (abc)", Category: catRegression, Results: map[string]*testResult{test: failure("111")}},
+		{Title: "latest (v1)", Category: catUnreleased, Results: map[string]*testResult{test: failure("222")}},
+	}
+
+	report := renderRegressionReport("Selected 1", columns)
+	assert.Equal(t, 1, strings.Count(report, "\ndiff\n"))
+	assert.Contains(t, report, "**latest (v1):** same output as main (abc)")
+}
diff --git a/acceptance/script.prepare b/acceptance/script.prepare
index b158ca3c74e..66080eb1fcb 100644
--- a/acceptance/script.prepare
+++ b/acceptance/script.prepare
@@ -1,3 +1,9 @@
+# Force plaintext token storage so acceptance tests exercise the file-backed
+# cache rather than the OS keyring, which is not reliably reachable in CI.
+# Tests that want to exercise the secure path or the resolver default unset
+# or override this in their own script.prepare or script.
+export DATABRICKS_AUTH_STORAGE=plaintext
+
 errcode() {
     # Temporarily disable 'set -e' to prevent the script from exiting on error
     set +e
@@ -49,6 +55,10 @@ trace() {
 }
 
 git-repo-init() {
+    if git rev-parse --git-dir > /dev/null 2>&1; then
+        echo "git-repo-init: already inside a git repository" >&2
+        return 1
+    fi
     git init -qb main
     git config core.autocrlf false
     git config user.name "Tester"
@@ -93,14 +103,60 @@ envsubst() {
     env -u MSYS_NO_PATHCONV envsubst.py
 }
 
+retry() {
+    # Same MSYS_NO_PATHCONV workaround as envsubst above: otherwise Python cannot
+    # find retry.py on Windows.
+    env -u MSYS_NO_PATHCONV retry.py "$@"
+}
+
+add_repl() {
+    # Same MSYS_NO_PATHCONV workaround as envsubst above: otherwise Python cannot
+    # find add_repl.py on Windows.
+    env -u MSYS_NO_PATHCONV add_repl.py "$@"
+}
+
+nostamp() {
+    # Same MSYS_NO_PATHCONV workaround as envsubst above: otherwise Python cannot
+    # find nostamp.py on Windows.
+    env -u MSYS_NO_PATHCONV nostamp.py "$@"
+}
+
+# The engine_terraform_* and deployment_history_enabled keys reflect matrix settings, so they
+# legitimately diverge across variants. Drop them here so this shared helper stays
+# matrix-agnostic; engine selection is asserted in bundle/telemetry/deploy.
 print_telemetry_bool_values() {
-    jq -r 'select(.path? == "/telemetry-ext") | (.body.protoLogs // [])[] | fromjson | ( (.entry // .) | (.databricks_cli_log.bundle_deploy_event.experimental.bool_values // []) ) | map("\(.key) \(.value)") | .[]' out.requests.txt | sort
+    jq -r 'select(.path? == "/telemetry-ext") | (.body.protoLogs // [])[] | fromjson | ( (.entry // .) | (.databricks_cli_log.bundle_deploy_event.experimental.bool_values // []) ) | map("\(.key) \(.value)") | .[]' "$OUT_REQUESTS" | grep -Ev '^(engine_terraform_|deployment_history_enabled )' | sort
+}
+
+# Workspace paths uploaded via /workspace/import, one per line. The path is a
+# multipart form field, not part of the URL, so print_requests.py can't filter on it.
+print_workspace_imports() {
+    jq -r 'select(.path? == "/api/2.0/workspace/import") | .body.multipart_form.path | strings' "$OUT_REQUESTS"
 }
 
 sethome() {
     local home="$1"
     mkdir -p "$home"
 
+    # Resolve to an absolute path so HOME (and USERPROFILE) keep pointing at
+    # the same directory after the test cd's elsewhere. The SDK expands
+    # `~/.databrickscfg` against $HOME at lookup time; with a relative path
+    # the cfg silently disappears once the cwd changes, and helpers like
+    # databrickscfg.GetConfiguredDefaultProfile return "" instead of
+    # erroring.
+    #
+    # On Git Bash (MSYS), plain `pwd` returns Unix-style /c/... paths that
+    # the native Windows Go binary can't open; `pwd -W` returns the mixed
+    # C:/... form instead. Use the same form for both HOME and USERPROFILE
+    # so tests that compare a `$HOME`-based placeholder against the CLI's
+    # `os.UserHomeDir()` output (which reads USERPROFILE on Windows) find
+    # a match.
+    if [[ "$OSTYPE" == "msys" || "$OSTYPE" == "cygwin" || "$OSTYPE" == "win32" ]]; then
+        home="$(cd "$home" && pwd -W)"
+    else
+        home="$(cd "$home" && pwd)"
+    fi
+
     # For macOS and Linux, use HOME.
     export HOME="$home"
 
diff --git a/acceptance/selftest/IsServicePrincipal/out.test.toml b/acceptance/selftest/IsServicePrincipal/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/selftest/IsServicePrincipal/out.test.toml
+++ b/acceptance/selftest/IsServicePrincipal/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/selftest/acc_repls/out.test.toml b/acceptance/selftest/acc_repls/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/selftest/acc_repls/out.test.toml
+++ b/acceptance/selftest/acc_repls/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/selftest/acc_repls/output.txt b/acceptance/selftest/acc_repls/output.txt
index a4a044b6387..1f0afec6e84 100644
--- a/acceptance/selftest/acc_repls/output.txt
+++ b/acceptance/selftest/acc_repls/output.txt
@@ -1,4 +1,5 @@
 my job is [JOB_ID]
-echo "$job_id:JOB_ID" >> ACC_REPLS
-echo "[MY_TEXT]:MY_TEXT" >> ACC_REPLS
-grep ACC_REPLS script
+my text is [MY_TEXT]
+my json is [CURLY]
+my tricky value is [TRICKY]
+{"value": "[TRICKY]"}
diff --git a/acceptance/selftest/acc_repls/script b/acceptance/selftest/acc_repls/script
index 871fa13ad23..2ed324a85b5 100644
--- a/acceptance/selftest/acc_repls/script
+++ b/acceptance/selftest/acc_repls/script
@@ -1,6 +1,15 @@
 job_id=100200300
+add_repl "$job_id" JOB_ID
+
+# Values that cannot be encoded as plain text: a colon, a leading curly brace, quotes and backslashes.
+add_repl "ABCD:EFG" MY_TEXT
+add_repl '{"a": 1}' CURLY
+add_repl 'back\slash "quoted"' TRICKY
+
 echo "my job is $job_id"
-echo "$job_id:JOB_ID" >> ACC_REPLS
-echo "ABCD:EFG:MY_TEXT" >> ACC_REPLS
+echo "my text is ABCD:EFG"
+echo 'my json is {"a": 1}'
+echo 'my tricky value is back\slash "quoted"'
 
-grep ACC_REPLS script
+# The JSON-encoded form of the value is replaced as well.
+echo '{"value": "back\\slash \"quoted\""}'
diff --git a/acceptance/selftest/add_repl/out.test.toml b/acceptance/selftest/add_repl/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/selftest/add_repl/out.test.toml
+++ b/acceptance/selftest/add_repl/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/selftest/add_repl/output.txt b/acceptance/selftest/add_repl/output.txt
index 2a69cea5ce8..556934d3318 100644
--- a/acceptance/selftest/add_repl/output.txt
+++ b/acceptance/selftest/add_repl/output.txt
@@ -5,4 +5,3 @@ my job is [JOB_ID]
 >>> add_repl.py [MY_TEXT] MY_TEXT
 
 >>> add_repl.py [MY_TEXT_2] MY_TEXT
-grep ACC_REPLS script
diff --git a/acceptance/selftest/add_repl/script b/acceptance/selftest/add_repl/script
index 8cfd2da143a..842ed1f0930 100644
--- a/acceptance/selftest/add_repl/script
+++ b/acceptance/selftest/add_repl/script
@@ -3,5 +3,3 @@ echo "my job is $job_id"
 trace add_repl.py $job_id JOB_ID
 trace add_repl.py ABCD:EFG MY_TEXT
 trace add_repl.py SECOND MY_TEXT
-
-grep ACC_REPLS script
diff --git a/acceptance/selftest/basic/out.test.toml b/acceptance/selftest/basic/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/selftest/basic/out.test.toml
+++ b/acceptance/selftest/basic/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/selftest/basic/output.txt b/acceptance/selftest/basic/output.txt
index e642148a7f4..c43d7529752 100644
--- a/acceptance/selftest/basic/output.txt
+++ b/acceptance/selftest/basic/output.txt
@@ -41,4 +41,4 @@ CUSTOM_NUMBER_REGEX
 
 === Testing --version
 >>> [CLI] --version
-Databricks CLI v[DEV_VERSION]
+Databricks CLI v[CLI_VERSION]
diff --git a/acceptance/selftest/benchmark/out.test.toml b/acceptance/selftest/benchmark/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/selftest/benchmark/out.test.toml
+++ b/acceptance/selftest/benchmark/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/selftest/contains/out.test.toml b/acceptance/selftest/contains/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/selftest/contains/out.test.toml
+++ b/acceptance/selftest/contains/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/selftest/contains/output.txt b/acceptance/selftest/contains/output.txt
index ce55c098d93..181578f94fa 100644
--- a/acceptance/selftest/contains/output.txt
+++ b/acceptance/selftest/contains/output.txt
@@ -4,11 +4,15 @@
 Hello world
 contains error: 'not_found' not found in the output.
 
+Exit code: 1
+
 === This should complain about not_found not found
 >>> musterr python3 ./failure.py
 Failed script
 contains error: 'not_found' not found in the output.
 
+Exit code: 1
+
 === This should not complain
 >>> python3 ./success.py
 Hello world
@@ -22,6 +26,8 @@ Failed script
 Hello world
 contains error: 'Hello' was not expected: 'Hello world'
 
+Exit code: 1
+
 === This should not complain
 >>> python3 ./success.py
 Hello world
diff --git a/acceptance/selftest/contains/script b/acceptance/selftest/contains/script
index e65b2719eee..e4f22d101d6 100644
--- a/acceptance/selftest/contains/script
+++ b/acceptance/selftest/contains/script
@@ -1,8 +1,8 @@
 title "This should complain about not_found not found"
-trace python3 ./success.py | contains.py not_found
+trace python3 ./success.py | errcode contains.py not_found
 
 title "This should complain about not_found not found"
-trace musterr python3 ./failure.py | contains.py not_found
+trace musterr python3 ./failure.py | errcode contains.py not_found
 
 title "This should not complain"
 trace python3 ./success.py | contains.py world Hello
@@ -11,7 +11,7 @@ title "This should not complain"
 trace musterr python3 ./failure.py | contains.py Failed
 
 title "This should complain about Hello present in output"
-trace python3 ./success.py | contains.py !Hello
+trace python3 ./success.py | errcode contains.py !Hello
 
 title "This should not complain"
 trace python3 ./success.py | contains.py !not_found
diff --git a/acceptance/selftest/diff/out.test.toml b/acceptance/selftest/diff/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/selftest/diff/out.test.toml
+++ b/acceptance/selftest/diff/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/selftest/envmatrix/inner/out.test.toml b/acceptance/selftest/envmatrix/inner/out.test.toml
index a07b8b5da49..71956b450a7 100644
--- a/acceptance/selftest/envmatrix/inner/out.test.toml
+++ b/acceptance/selftest/envmatrix/inner/out.test.toml
@@ -1,7 +1,5 @@
-Local = true
 Cloud = false
 EnvMatrix.B_REGULAR_VAR = ["hello"]
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
 EnvMatrix.FIRST = ["one111", "two222"]
 EnvMatrix.SECOND = ["variantA", "variantB"]
 EnvMatrix.THIRD = ["three $FIRST"]
diff --git a/acceptance/selftest/envmatrix/inner/test.toml b/acceptance/selftest/envmatrix/inner/test.toml
index 04925ece6bb..8eb62f27aa4 100644
--- a/acceptance/selftest/envmatrix/inner/test.toml
+++ b/acceptance/selftest/envmatrix/inner/test.toml
@@ -1,4 +1,3 @@
-[EnvMatrix]
-B_REGULAR_VAR = ["hello"]
-FIRST = ["one111", "two222"]
-SECOND = ["variantA", "variantB"]
+EnvMatrix.B_REGULAR_VAR = ["hello"]
+EnvMatrix.FIRST = ["one111", "two222"]
+EnvMatrix.SECOND = ["variantA", "variantB"]
diff --git a/acceptance/selftest/envmatrix/out.test.toml b/acceptance/selftest/envmatrix/out.test.toml
index b017ee6bdaf..5940f9c438d 100644
--- a/acceptance/selftest/envmatrix/out.test.toml
+++ b/acceptance/selftest/envmatrix/out.test.toml
@@ -1,5 +1,3 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
 EnvMatrix.FIRST = ["overriden-in-inner"]
 EnvMatrix.THIRD = ["three $FIRST"]
diff --git a/acceptance/selftest/envmatrix/test.toml b/acceptance/selftest/envmatrix/test.toml
index 2869edb9b6d..6b703c56539 100644
--- a/acceptance/selftest/envmatrix/test.toml
+++ b/acceptance/selftest/envmatrix/test.toml
@@ -1,7 +1,5 @@
-[Env]
-A_REGULAR_VAR = "yes"
-B_REGULAR_VAR = "answer:$A_REGULAR_VAR"
+Env.A_REGULAR_VAR = "yes"
+Env.B_REGULAR_VAR = "answer:$A_REGULAR_VAR"
 
-[EnvMatrix]
-FIRST = ["overriden-in-inner"]
-THIRD = ["three $FIRST"]
+EnvMatrix.FIRST = ["overriden-in-inner"]
+EnvMatrix.THIRD = ["three $FIRST"]
diff --git a/acceptance/selftest/envmatrix_empty/out.test.toml b/acceptance/selftest/envmatrix_empty/out.test.toml
index d6187dcb046..18b1a88417e 100644
--- a/acceptance/selftest/envmatrix_empty/out.test.toml
+++ b/acceptance/selftest/envmatrix_empty/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = []
diff --git a/acceptance/selftest/envmatrix_empty/test.toml b/acceptance/selftest/envmatrix_empty/test.toml
deleted file mode 100644
index 38bba6b6415..00000000000
--- a/acceptance/selftest/envmatrix_empty/test.toml
+++ /dev/null
@@ -1,4 +0,0 @@
-Local = true
-
-[EnvMatrix]
-DATABRICKS_BUNDLE_ENGINE = []
diff --git a/acceptance/selftest/envmatrix_mixed/out.test.toml b/acceptance/selftest/envmatrix_mixed/out.test.toml
index 7dbbeba2e82..4b0032027d8 100644
--- a/acceptance/selftest/envmatrix_mixed/out.test.toml
+++ b/acceptance/selftest/envmatrix_mixed/out.test.toml
@@ -1,5 +1,3 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = []
 EnvMatrix.FIRST = ["alpha", "beta"]
 EnvMatrix.SECOND = []
diff --git a/acceptance/selftest/envmatrix_mixed/test.toml b/acceptance/selftest/envmatrix_mixed/test.toml
index 6f556b54b39..30938d59e71 100644
--- a/acceptance/selftest/envmatrix_mixed/test.toml
+++ b/acceptance/selftest/envmatrix_mixed/test.toml
@@ -1,6 +1,2 @@
-Local = true
-
-[EnvMatrix]
-DATABRICKS_BUNDLE_ENGINE = []
-FIRST = ["alpha", "beta"]
-SECOND = []
+EnvMatrix.FIRST = ["alpha", "beta"]
+EnvMatrix.SECOND = []
diff --git a/acceptance/selftest/envoutput/out.direct.txt b/acceptance/selftest/envoutput/out.direct.txt
deleted file mode 100644
index 84153ad6ccd..00000000000
--- a/acceptance/selftest/envoutput/out.direct.txt
+++ /dev/null
@@ -1 +0,0 @@
-myvalue=direct
diff --git a/acceptance/selftest/envoutput/out.terraform.txt b/acceptance/selftest/envoutput/out.terraform.txt
deleted file mode 100644
index 775ce816b1f..00000000000
--- a/acceptance/selftest/envoutput/out.terraform.txt
+++ /dev/null
@@ -1 +0,0 @@
-myvalue=terraform
diff --git a/acceptance/selftest/envoutput/out.test.toml b/acceptance/selftest/envoutput/out.test.toml
deleted file mode 100644
index f784a183258..00000000000
--- a/acceptance/selftest/envoutput/out.test.toml
+++ /dev/null
@@ -1,3 +0,0 @@
-Local = true
-Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/selftest/envoutput/script b/acceptance/selftest/envoutput/script
deleted file mode 100644
index a9a0f1525f0..00000000000
--- a/acceptance/selftest/envoutput/script
+++ /dev/null
@@ -1 +0,0 @@
-echo myvalue=$DATABRICKS_BUNDLE_ENGINE > out.$DATABRICKS_BUNDLE_ENGINE.txt
diff --git a/acceptance/selftest/envoutput/test.toml b/acceptance/selftest/envoutput/test.toml
deleted file mode 100644
index 38d677b4c51..00000000000
--- a/acceptance/selftest/envoutput/test.toml
+++ /dev/null
@@ -1,4 +0,0 @@
-EnvVaryOutput = "DATABRICKS_BUNDLE_ENGINE"
-
-[EnvMatrix]
-DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/selftest/gen_config/out.test.toml b/acceptance/selftest/gen_config/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/selftest/gen_config/out.test.toml
+++ b/acceptance/selftest/gen_config/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/selftest/inject_error/out.test.toml b/acceptance/selftest/inject_error/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/selftest/inject_error/out.test.toml
+++ b/acceptance/selftest/inject_error/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/selftest/kill_caller/currentuser/out.test.toml b/acceptance/selftest/kill_caller/currentuser/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/selftest/kill_caller/currentuser/out.test.toml
+++ b/acceptance/selftest/kill_caller/currentuser/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/selftest/kill_caller/currentuser/script b/acceptance/selftest/kill_caller/currentuser/script
index 821c42d8cf7..dbd96b12a94 100644
--- a/acceptance/selftest/kill_caller/currentuser/script
+++ b/acceptance/selftest/kill_caller/currentuser/script
@@ -1,2 +1,4 @@
+# Kill the CLI when it calls /Me endpoint (once, then allow)
+kill_after.py "GET /api/2.0/preview/scim/v2/Me" 0 1
 trace errcode $CLI current-user me
 echo "Script continued after kill"
diff --git a/acceptance/selftest/kill_caller/currentuser/test.toml b/acceptance/selftest/kill_caller/currentuser/test.toml
deleted file mode 100644
index b76fe401fcb..00000000000
--- a/acceptance/selftest/kill_caller/currentuser/test.toml
+++ /dev/null
@@ -1,4 +0,0 @@
-# Kill the CLI when it calls /Me endpoint (once, then allow)
-[[Server]]
-Pattern = "GET /api/2.0/preview/scim/v2/Me"
-KillCaller = 1
diff --git a/acceptance/selftest/kill_caller/multi_pattern/out.test.toml b/acceptance/selftest/kill_caller/multi_pattern/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/selftest/kill_caller/multi_pattern/out.test.toml
+++ b/acceptance/selftest/kill_caller/multi_pattern/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/selftest/kill_caller/multi_pattern/output.txt b/acceptance/selftest/kill_caller/multi_pattern/output.txt
index 9b41f23ec4d..b3528428352 100644
--- a/acceptance/selftest/kill_caller/multi_pattern/output.txt
+++ b/acceptance/selftest/kill_caller/multi_pattern/output.txt
@@ -13,8 +13,8 @@ Me attempt 2 done
 
 >>> [CLI] current-user me
 {
-  "id": "123",
-  "userName": "test@example.com"
+  "id": "[USERID]",
+  "userName": "[USERNAME]"
 }
 Me attempt 3 done - success!
 
diff --git a/acceptance/selftest/kill_caller/multi_pattern/script b/acceptance/selftest/kill_caller/multi_pattern/script
index ba9447a29a7..e0b5523c45c 100644
--- a/acceptance/selftest/kill_caller/multi_pattern/script
+++ b/acceptance/selftest/kill_caller/multi_pattern/script
@@ -1,3 +1,6 @@
+kill_after.py "GET /api/2.0/preview/scim/v2/Me" 0 2
+kill_after.py "GET /api/2.0/workspace/list" 0 1
+
 # Test pattern 1: /Me endpoint (kills first 2, then allows)
 trace errcode $CLI current-user me
 echo "Me attempt 1 done"
diff --git a/acceptance/selftest/kill_caller/multi_pattern/test.toml b/acceptance/selftest/kill_caller/multi_pattern/test.toml
index 08bdc17085d..4565475423d 100644
--- a/acceptance/selftest/kill_caller/multi_pattern/test.toml
+++ b/acceptance/selftest/kill_caller/multi_pattern/test.toml
@@ -1,17 +1,5 @@
-# Test that multiple patterns can have independent KillCaller counts
-# Pattern 1: Kill first 2 requests to /Me endpoint
-# Pattern 2: Kill first 1 request to /workspace/list endpoint
-
-[[Server]]
-Pattern = "GET /api/2.0/preview/scim/v2/Me"
-KillCaller = 2
-Response.Body = '''
-{
-    "id": "123",
-    "userName": "test@example.com"
-}
-'''
+# Test that multiple patterns can have independent kill counts
 
 [[Server]]
 Pattern = "GET /api/2.0/workspace/list"
-KillCaller = 1
+Response.Body = '{"objects": []}'
diff --git a/acceptance/selftest/kill_caller/multiple/out.test.toml b/acceptance/selftest/kill_caller/multiple/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/selftest/kill_caller/multiple/out.test.toml
+++ b/acceptance/selftest/kill_caller/multiple/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/selftest/kill_caller/multiple/output.txt b/acceptance/selftest/kill_caller/multiple/output.txt
index 27b034cfcb1..3b6aea849fd 100644
--- a/acceptance/selftest/kill_caller/multiple/output.txt
+++ b/acceptance/selftest/kill_caller/multiple/output.txt
@@ -19,7 +19,7 @@ Attempt 3 done
 
 >>> [CLI] current-user me
 {
-  "id": "123",
-  "userName": "test@example.com"
+  "id": "[USERID]",
+  "userName": "[USERNAME]"
 }
 Attempt 4 done - success!
diff --git a/acceptance/selftest/kill_caller/multiple/script b/acceptance/selftest/kill_caller/multiple/script
index 03628e203ed..1e089f3cc0f 100644
--- a/acceptance/selftest/kill_caller/multiple/script
+++ b/acceptance/selftest/kill_caller/multiple/script
@@ -1,3 +1,6 @@
+# Kill the CLI 3 times, then allow the 4th request to succeed
+kill_after.py "GET /api/2.0/preview/scim/v2/Me" 0 3
+
 # First 3 attempts should be killed
 trace errcode $CLI current-user me
 echo "Attempt 1 done"
diff --git a/acceptance/selftest/kill_caller/multiple/test.toml b/acceptance/selftest/kill_caller/multiple/test.toml
deleted file mode 100644
index 5485fc6a6bb..00000000000
--- a/acceptance/selftest/kill_caller/multiple/test.toml
+++ /dev/null
@@ -1,10 +0,0 @@
-# Kill the CLI 3 times, then allow the 4th request to succeed
-[[Server]]
-Pattern = "GET /api/2.0/preview/scim/v2/Me"
-KillCaller = 3
-Response.Body = '''
-{
-    "id": "123",
-    "userName": "test@example.com"
-}
-'''
diff --git a/acceptance/selftest/kill_caller/offset/out.test.toml b/acceptance/selftest/kill_caller/offset/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/selftest/kill_caller/offset/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/selftest/kill_caller/offset/output.txt b/acceptance/selftest/kill_caller/offset/output.txt
new file mode 100644
index 00000000000..b6959aec5e2
--- /dev/null
+++ b/acceptance/selftest/kill_caller/offset/output.txt
@@ -0,0 +1,33 @@
+
+>>> [CLI] current-user me
+{
+  "id": "[USERID]",
+  "userName": "[USERNAME]"
+}
+Attempt 1 done - success (offset)
+
+>>> [CLI] current-user me
+{
+  "id": "[USERID]",
+  "userName": "[USERNAME]"
+}
+Attempt 2 done - success (offset)
+
+>>> errcode [CLI] current-user me
+[PROCESS_KILLED]
+
+Exit code: [KILLED]
+Attempt 3 done - killed
+
+>>> errcode [CLI] current-user me
+[PROCESS_KILLED]
+
+Exit code: [KILLED]
+Attempt 4 done - killed
+
+>>> [CLI] current-user me
+{
+  "id": "[USERID]",
+  "userName": "[USERNAME]"
+}
+Attempt 5 done - success (past kill window)
diff --git a/acceptance/selftest/kill_caller/offset/script b/acceptance/selftest/kill_caller/offset/script
new file mode 100644
index 00000000000..6abee0dcac7
--- /dev/null
+++ b/acceptance/selftest/kill_caller/offset/script
@@ -0,0 +1,20 @@
+# Let first 2 requests pass, kill next 2, then allow rest
+kill_after.py "GET /api/2.0/preview/scim/v2/Me" 2 2
+
+# First 2 attempts should succeed (offset period)
+trace $CLI current-user me
+echo "Attempt 1 done - success (offset)"
+
+trace $CLI current-user me
+echo "Attempt 2 done - success (offset)"
+
+# Attempts 3-4 should be killed
+trace errcode $CLI current-user me
+echo "Attempt 3 done - killed"
+
+trace errcode $CLI current-user me
+echo "Attempt 4 done - killed"
+
+# Attempt 5 should succeed again
+trace $CLI current-user me
+echo "Attempt 5 done - success (past kill window)"
diff --git a/acceptance/selftest/kill_caller/test.toml b/acceptance/selftest/kill_caller/test.toml
index faa7caf7b00..736f5cde994 100644
--- a/acceptance/selftest/kill_caller/test.toml
+++ b/acceptance/selftest/kill_caller/test.toml
@@ -2,7 +2,6 @@
 # This enables testing crash recovery scenarios, e.g., "bundle deploy" fails on first attempt
 # but succeeds on retry. Each subdirectory tests a different endpoint or retry count.
 
-Local = true
 Env.DATABRICKS_CLI_TEST_PID = "1"
 
 [[Repls]]
diff --git a/acceptance/selftest/kill_caller/workspace/out.test.toml b/acceptance/selftest/kill_caller/workspace/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/selftest/kill_caller/workspace/out.test.toml
+++ b/acceptance/selftest/kill_caller/workspace/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/selftest/kill_caller/workspace/script b/acceptance/selftest/kill_caller/workspace/script
index 076972136c9..5a21881ab3f 100644
--- a/acceptance/selftest/kill_caller/workspace/script
+++ b/acceptance/selftest/kill_caller/workspace/script
@@ -1,2 +1,4 @@
+# Kill the CLI when it calls workspace list endpoint (once, then allow)
+kill_after.py "GET /api/2.0/workspace/list" 0 1
 trace errcode $CLI workspace list /
 echo "Script continued after kill"
diff --git a/acceptance/selftest/kill_caller/workspace/test.toml b/acceptance/selftest/kill_caller/workspace/test.toml
deleted file mode 100644
index eac10a6329b..00000000000
--- a/acceptance/selftest/kill_caller/workspace/test.toml
+++ /dev/null
@@ -1,4 +0,0 @@
-# Kill the CLI when it calls workspace list endpoint (once, then allow)
-[[Server]]
-Pattern = "GET /api/2.0/workspace/list"
-KillCaller = 1
diff --git a/acceptance/selftest/log/out.test.toml b/acceptance/selftest/log/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/selftest/log/out.test.toml
+++ b/acceptance/selftest/log/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/selftest/record_cloud/basic/out.requests.txt b/acceptance/selftest/record_cloud/basic/out.requests.txt
deleted file mode 100644
index 12576f503d5..00000000000
--- a/acceptance/selftest/record_cloud/basic/out.requests.txt
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "method": "GET",
-  "path": "/api/2.0/preview/scim/v2/Me"
-}
diff --git a/acceptance/selftest/record_cloud/basic/out.test.toml b/acceptance/selftest/record_cloud/basic/out.test.toml
index 650836edeb3..c7c6f58ed6e 100644
--- a/acceptance/selftest/record_cloud/basic/out.test.toml
+++ b/acceptance/selftest/record_cloud/basic/out.test.toml
@@ -1,3 +1 @@
-Local = false
 Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/selftest/record_cloud/basic/output.txt b/acceptance/selftest/record_cloud/basic/output.txt
index 7f0b941262b..64a0c8e3890 100644
--- a/acceptance/selftest/record_cloud/basic/output.txt
+++ b/acceptance/selftest/record_cloud/basic/output.txt
@@ -1,3 +1,13 @@
 
 >>> [CLI] current-user me
 "[USERNAME]"
+
+>>> print_requests.py --get //
+{
+  "method": "GET",
+  "path": "/.well-known/databricks-config"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/preview/scim/v2/Me"
+}
diff --git a/acceptance/selftest/record_cloud/basic/script b/acceptance/selftest/record_cloud/basic/script
index 5d8c2eac19f..f12bcc208ad 100644
--- a/acceptance/selftest/record_cloud/basic/script
+++ b/acceptance/selftest/record_cloud/basic/script
@@ -1,2 +1,4 @@
 # Proxy server successfully records a requests and returns a response.
-trace $CLI current-user me | jq .name.givenName
+trace $CLI current-user me | jq .userName
+
+trace print_requests.py --get //
diff --git a/acceptance/selftest/record_cloud/error/out.requests.txt b/acceptance/selftest/record_cloud/error/out.requests.txt
deleted file mode 100644
index 4b720276004..00000000000
--- a/acceptance/selftest/record_cloud/error/out.requests.txt
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "method": "GET",
-  "path": "/api/2.2/jobs/get",
-  "q": {
-    "job_id": "1234"
-  }
-}
diff --git a/acceptance/selftest/record_cloud/error/out.test.toml b/acceptance/selftest/record_cloud/error/out.test.toml
index 650836edeb3..c7c6f58ed6e 100644
--- a/acceptance/selftest/record_cloud/error/out.test.toml
+++ b/acceptance/selftest/record_cloud/error/out.test.toml
@@ -1,3 +1 @@
-Local = false
 Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/selftest/record_cloud/error/output.txt b/acceptance/selftest/record_cloud/error/output.txt
index f911ca508fd..510536a783e 100644
--- a/acceptance/selftest/record_cloud/error/output.txt
+++ b/acceptance/selftest/record_cloud/error/output.txt
@@ -3,3 +3,16 @@
 Error: Job 1234 does not exist.
 
 Exit code: 1
+
+>>> print_requests.py --get //
+{
+  "method": "GET",
+  "path": "/.well-known/databricks-config"
+}
+{
+  "method": "GET",
+  "path": "/api/2.2/jobs/get",
+  "q": {
+    "job_id": "1234"
+  }
+}
diff --git a/acceptance/selftest/record_cloud/error/script b/acceptance/selftest/record_cloud/error/script
index 662a0732cca..bd9a4b66c68 100644
--- a/acceptance/selftest/record_cloud/error/script
+++ b/acceptance/selftest/record_cloud/error/script
@@ -1,2 +1,4 @@
 # Proxy server should successfully return non 200 responses.
 errcode trace $CLI jobs get 1234
+
+trace print_requests.py --get //
diff --git a/acceptance/selftest/record_cloud/pipeline-crud/out.test.toml b/acceptance/selftest/record_cloud/pipeline-crud/out.test.toml
index 650836edeb3..c7c6f58ed6e 100644
--- a/acceptance/selftest/record_cloud/pipeline-crud/out.test.toml
+++ b/acceptance/selftest/record_cloud/pipeline-crud/out.test.toml
@@ -1,3 +1 @@
-Local = false
 Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/selftest/record_cloud/pipeline-crud/script b/acceptance/selftest/record_cloud/pipeline-crud/script
index 85de4aa3227..4e6ada990d8 100644
--- a/acceptance/selftest/record_cloud/pipeline-crud/script
+++ b/acceptance/selftest/record_cloud/pipeline-crud/script
@@ -1,6 +1,6 @@
 print_requests() {
-    cat out.requests.txt
-    rm out.requests.txt
+    cat "$OUT_REQUESTS"
+    rm "$OUT_REQUESTS"
 }
 
 # Verify that the entire crud lifecycle of a pipeline works.
diff --git a/acceptance/selftest/record_cloud/test.toml b/acceptance/selftest/record_cloud/test.toml
index 20d0343612e..c42930853fb 100644
--- a/acceptance/selftest/record_cloud/test.toml
+++ b/acceptance/selftest/record_cloud/test.toml
@@ -1,3 +1,6 @@
 Cloud = true
-Local = false
 RecordRequests = true
+
+# Local runs go through the proxy too, so one set of goldens covers it against both
+# a real workspace and the fake.
+Proxy = true
diff --git a/acceptance/selftest/record_cloud/volume-io/out.test.toml b/acceptance/selftest/record_cloud/volume-io/out.test.toml
index 2d812727e32..c7c6f58ed6e 100644
--- a/acceptance/selftest/record_cloud/volume-io/out.test.toml
+++ b/acceptance/selftest/record_cloud/volume-io/out.test.toml
@@ -1,4 +1 @@
-Local = false
 Cloud = true
-RequiresUnityCatalog = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/selftest/record_cloud/volume-io/script b/acceptance/selftest/record_cloud/volume-io/script
index 741eec19573..19ccac68ba6 100644
--- a/acceptance/selftest/record_cloud/volume-io/script
+++ b/acceptance/selftest/record_cloud/volume-io/script
@@ -1,6 +1,6 @@
 print_requests() {
-    cat out.requests.txt
-    rm out.requests.txt
+    cat "$OUT_REQUESTS"
+    rm "$OUT_REQUESTS"
 }
 
 trace $CLI schemas create schema-$UNIQUE_NAME main | jq '{full_name, owner}'
diff --git a/acceptance/selftest/record_cloud/volume-io/test.toml b/acceptance/selftest/record_cloud/volume-io/test.toml
deleted file mode 100644
index 9f65b59bbdc..00000000000
--- a/acceptance/selftest/record_cloud/volume-io/test.toml
+++ /dev/null
@@ -1 +0,0 @@
-RequiresUnityCatalog = true
diff --git a/acceptance/selftest/record_cloud/workspace-file-io/out.test.toml b/acceptance/selftest/record_cloud/workspace-file-io/out.test.toml
index 650836edeb3..c7c6f58ed6e 100644
--- a/acceptance/selftest/record_cloud/workspace-file-io/out.test.toml
+++ b/acceptance/selftest/record_cloud/workspace-file-io/out.test.toml
@@ -1,3 +1 @@
-Local = false
 Cloud = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/selftest/record_cloud/workspace-file-io/script b/acceptance/selftest/record_cloud/workspace-file-io/script
index 990b7856914..cd1ac7bd489 100644
--- a/acceptance/selftest/record_cloud/workspace-file-io/script
+++ b/acceptance/selftest/record_cloud/workspace-file-io/script
@@ -6,8 +6,8 @@ export username=$($CLI current-user me | jq -r .userName)
 export MSYS_NO_PATHCONV=1
 
 print_requests() {
-    cat out.requests.txt
-    rm out.requests.txt
+    cat "$OUT_REQUESTS"
+    rm "$OUT_REQUESTS"
 }
 
 title "create a folder"
diff --git a/acceptance/selftest/selection/out.test.toml b/acceptance/selftest/selection/out.test.toml
new file mode 100644
index 00000000000..2e1543aa802
--- /dev/null
+++ b/acceptance/selftest/selection/out.test.toml
@@ -0,0 +1,2 @@
+Cloud = false
+GOOS.windows = false
diff --git a/acceptance/selftest/selection/output.txt b/acceptance/selftest/selection/output.txt
new file mode 100644
index 00000000000..7e2c55b1c1d
--- /dev/null
+++ b/acceptance/selftest/selection/output.txt
@@ -0,0 +1,80 @@
+
+=== Changing a test
+
+>>> selection M:acceptance/selftest/basic/script
+Selected 1 changed tests (limit=50, 0 not selected)
+    5  ^selftest$/^basic$
+
+=== Adding a test
+
+>>> selection A:acceptance/selftest/basic/script
+Selected 1 changed tests (limit=50, 0 not selected)
+   10  ^selftest$/^basic$
+
+=== A regenerated golden scores below a changed fixture
+
+>>> selection M:acceptance/selftest/basic/output.txt M:acceptance/selftest/diff/script
+Selected 2 changed tests (limit=50, 0 not selected)
+    5  ^selftest$/^diff$
+    1  ^selftest$/^basic$
+
+=== Moving a test scores lowest
+
+>>> selection R100:acceptance/selftest/old/script:acceptance/selftest/basic/script M:acceptance/selftest/diff/script
+Selected 2 changed tests (limit=50, 0 not selected)
+    5  ^selftest$/^diff$
+    1  ^selftest$/^basic$
+
+=== Touching an invariant config runs every invariant test, for that config only
+
+>>> selection M:acceptance/bundle/invariant/configs/job.yml.tmpl
+Selected 6 changed tests (limit=50, 0 not selected)
+    5  ^bundle$/^invariant$/^auto-migrate$/^DMS=$/^INPUT_CONFIG=job\.yml\.tmpl$
+    5  ^bundle$/^invariant$/^continue_293$/^DMS=$/^INPUT_CONFIG=job\.yml\.tmpl$
+    5  ^bundle$/^invariant$/^delete_idempotent$/^DMS=$/^INPUT_CONFIG=job\.yml\.tmpl$
+    5  ^bundle$/^invariant$/^destroy_idempotent$/^DMS=$/^INPUT_CONFIG=job\.yml\.tmpl$
+    5  ^bundle$/^invariant$/^migrate$/^DMS=$/^INPUT_CONFIG=job\.yml\.tmpl$
+    5  ^bundle$/^invariant$/^no_drift$/^DMS=$/^INPUT_CONFIG=job\.yml\.tmpl$
+    5  ^bundle$/^invariant$/^no_drift$/^DMS=true$/^INPUT_CONFIG=job\.yml\.tmpl$
+
+=== Adding one invariant config and touching another: only the new variant is new
+
+>>> selection A:acceptance/bundle/invariant/configs/pipeline.yml.tmpl M:acceptance/bundle/invariant/configs/job.yml.tmpl
+Selected 12 changed tests (limit=50, 0 not selected)
+   10  ^bundle$/^invariant$/^auto-migrate$/^DMS=$/^INPUT_CONFIG=pipeline\.yml\.tmpl$
+   10  ^bundle$/^invariant$/^continue_293$/^DMS=$/^INPUT_CONFIG=pipeline\.yml\.tmpl$
+   10  ^bundle$/^invariant$/^delete_idempotent$/^DMS=$/^INPUT_CONFIG=pipeline\.yml\.tmpl$
+   10  ^bundle$/^invariant$/^destroy_idempotent$/^DMS=$/^INPUT_CONFIG=pipeline\.yml\.tmpl$
+   10  ^bundle$/^invariant$/^migrate$/^DMS=$/^INPUT_CONFIG=pipeline\.yml\.tmpl$
+   10  ^bundle$/^invariant$/^no_drift$/^DMS=$/^INPUT_CONFIG=pipeline\.yml\.tmpl$
+   10  ^bundle$/^invariant$/^no_drift$/^DMS=true$/^INPUT_CONFIG=pipeline\.yml\.tmpl$
+    5  ^bundle$/^invariant$/^auto-migrate$/^DMS=$/^INPUT_CONFIG=job\.yml\.tmpl$
+    5  ^bundle$/^invariant$/^continue_293$/^DMS=$/^INPUT_CONFIG=job\.yml\.tmpl$
+    5  ^bundle$/^invariant$/^delete_idempotent$/^DMS=$/^INPUT_CONFIG=job\.yml\.tmpl$
+    5  ^bundle$/^invariant$/^destroy_idempotent$/^DMS=$/^INPUT_CONFIG=job\.yml\.tmpl$
+    5  ^bundle$/^invariant$/^migrate$/^DMS=$/^INPUT_CONFIG=job\.yml\.tmpl$
+    5  ^bundle$/^invariant$/^no_drift$/^DMS=$/^INPUT_CONFIG=job\.yml\.tmpl$
+    5  ^bundle$/^invariant$/^no_drift$/^DMS=true$/^INPUT_CONFIG=job\.yml\.tmpl$
+
+=== A config an invariant test excludes does not select that test
+
+>>> selection M:acceptance/bundle/invariant/configs/vector_search_index.yml.tmpl
+Selected 3 changed tests (limit=50, 0 not selected)
+    5  ^bundle$/^invariant$/^delete_idempotent$/^DMS=$/^INPUT_CONFIG=vector_search_index\.yml\.tmpl$
+    5  ^bundle$/^invariant$/^destroy_idempotent$/^DMS=$/^INPUT_CONFIG=vector_search_index\.yml\.tmpl$
+    5  ^bundle$/^invariant$/^no_drift$/^DMS=$/^INPUT_CONFIG=vector_search_index\.yml\.tmpl$
+    5  ^bundle$/^invariant$/^no_drift$/^DMS=true$/^INPUT_CONFIG=vector_search_index\.yml\.tmpl$
+
+=== Renaming a fixture out of a test selects the test that lost it
+
+>>> selection R100:acceptance/selftest/basic/output.txt:docs/example.txt
+Selected 1 changed tests (limit=50, 0 not selected)
+    1  ^selftest$/^basic$
+
+=== The limit keeps the highest scoring tests
+
+>>> selection -limit 3 A:acceptance/selftest/basic/script M:acceptance/selftest/diff/script M:acceptance/bundle/invariant/configs/job.yml.tmpl
+Selected 3 changed tests (limit=3, 5 not selected)
+   10  ^selftest$/^basic$
+    5  ^bundle$/^invariant$/^auto-migrate$/^DMS=$/^INPUT_CONFIG=job\.yml\.tmpl$
+    5  ^bundle$/^invariant$/^continue_293$/^DMS=$/^INPUT_CONFIG=job\.yml\.tmpl$
diff --git a/acceptance/selftest/selection/script b/acceptance/selftest/selection/script
new file mode 100644
index 00000000000..122f4f4c8bb
--- /dev/null
+++ b/acceptance/selftest/selection/script
@@ -0,0 +1,36 @@
+# The selection runs against the real acceptance tree, so every line it prints is a real
+# test name that can be passed to `go test -run`.
+selection() {
+    "$SELECTION" -root "$TESTROOT" "$@"
+}
+
+# Each argument is a changed file: "M:" modified, "A:" added, "R100:old:new" moved.
+
+title "Changing a test\n"
+trace selection M:acceptance/selftest/basic/script
+
+title "Adding a test\n"
+trace selection A:acceptance/selftest/basic/script
+
+title "A regenerated golden scores below a changed fixture\n"
+trace selection M:acceptance/selftest/basic/output.txt M:acceptance/selftest/diff/script
+
+title "Moving a test scores lowest\n"
+trace selection R100:acceptance/selftest/old/script:acceptance/selftest/basic/script M:acceptance/selftest/diff/script
+
+title "Touching an invariant config runs every invariant test, for that config only\n"
+trace selection M:acceptance/bundle/invariant/configs/job.yml.tmpl
+
+title "Adding one invariant config and touching another: only the new variant is new\n"
+trace selection A:acceptance/bundle/invariant/configs/pipeline.yml.tmpl M:acceptance/bundle/invariant/configs/job.yml.tmpl
+
+title "A config an invariant test excludes does not select that test\n"
+# continue_293 pins an old CLI that has no Vector Search support, so it excludes this config;
+# selecting it would spend the limit on a test whose every variant is skipped.
+trace selection M:acceptance/bundle/invariant/configs/vector_search_index.yml.tmpl
+
+title "Renaming a fixture out of a test selects the test that lost it\n"
+trace selection R100:acceptance/selftest/basic/output.txt:docs/example.txt
+
+title "The limit keeps the highest scoring tests\n"
+trace selection -limit 3 A:acceptance/selftest/basic/script M:acceptance/selftest/diff/script M:acceptance/bundle/invariant/configs/job.yml.tmpl
diff --git a/acceptance/selftest/selection/test.toml b/acceptance/selftest/selection/test.toml
new file mode 100644
index 00000000000..573fe55fdc2
--- /dev/null
+++ b/acceptance/selftest/selection/test.toml
@@ -0,0 +1,5 @@
+# Test selection has nothing to do with the deployment engine.
+
+# Git Bash rewrites an "A:..." argument as a Windows path (A: reads as a drive letter),
+# so the statuses would not survive to the command.
+GOOS.windows = false
diff --git a/acceptance/selftest/server/out.requests.txt b/acceptance/selftest/server/out.requests.txt
deleted file mode 100644
index 02cfcd24d8e..00000000000
--- a/acceptance/selftest/server/out.requests.txt
+++ /dev/null
@@ -1,22 +0,0 @@
-{
-  "method": "GET",
-  "path": "/api/2.0/preview/scim/v2/Me"
-}
-{
-  "method": "GET",
-  "path": "/custom/endpoint",
-  "q": {
-    "query": "param"
-  }
-}
-{
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/a/b/c"
-  }
-}
diff --git a/acceptance/selftest/server/out.test.toml b/acceptance/selftest/server/out.test.toml
index d4e9799c700..3d071780982 100644
--- a/acceptance/selftest/server/out.test.toml
+++ b/acceptance/selftest/server/out.test.toml
@@ -1,5 +1,3 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
 EnvMatrix.VARIABLE_A = ["one", "two"]
 EnvMatrix.VARIABLE_B = ["HELLO", "WORLD"]
diff --git a/acceptance/selftest/server/output.txt b/acceptance/selftest/server/output.txt
index 7147f9c9bef..19f581068a8 100644
--- a/acceptance/selftest/server/output.txt
+++ b/acceptance/selftest/server/output.txt
@@ -16,6 +16,30 @@ custom
 response
 
 >>> errcode [CLI] workspace get-status /a/b/c
-Error: Workspace path not found
+Error: Path (/a/b/c) doesn't exist.
 
 Exit code: 1
+
+>>> print_requests.py --get //
+{
+  "method": "GET",
+  "path": "/api/2.0/preview/scim/v2/Me"
+}
+{
+  "method": "GET",
+  "path": "/custom/endpoint",
+  "q": {
+    "query": "param"
+  }
+}
+{
+  "method": "GET",
+  "path": "/.well-known/databricks-config"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/workspace/get-status",
+  "q": {
+    "path": "/a/b/c"
+  }
+}
diff --git a/acceptance/selftest/server/script b/acceptance/selftest/server/script
index 810ea64b63e..955687a44d4 100644
--- a/acceptance/selftest/server/script
+++ b/acceptance/selftest/server/script
@@ -1,4 +1,6 @@
-trace curl -s $DATABRICKS_HOST/api/2.0/preview/scim/v2/Me
-trace curl -sD - $DATABRICKS_HOST/custom/endpoint?query=param
+MSYS_NO_PATHCONV=1 trace curl -s $DATABRICKS_HOST/api/2.0/preview/scim/v2/Me
+MSYS_NO_PATHCONV=1 trace curl -sD - $DATABRICKS_HOST/custom/endpoint?query=param
 
-trace errcode $CLI workspace get-status /a/b/c
+MSYS_NO_PATHCONV=1 trace errcode $CLI workspace get-status /a/b/c
+
+trace print_requests.py --get //
diff --git a/acceptance/selftest/server/test.toml b/acceptance/selftest/server/test.toml
index 391b6b742b2..7b8d16a1872 100644
--- a/acceptance/selftest/server/test.toml
+++ b/acceptance/selftest/server/test.toml
@@ -1,11 +1,8 @@
 RecordRequests = true
 
-Env.MSYS_NO_PATHCONV = "1"
-
 # Ensure that server configuration works with EnvMatrix (regression test for https://github.com/databricks/cli/pull/2758)
-[EnvMatrix]
-VARIABLE_A = ["one", "two"]
-VARIABLE_B = ["HELLO", "WORLD"]
+EnvMatrix.VARIABLE_A = ["one", "two"]
+EnvMatrix.VARIABLE_B = ["HELLO", "WORLD"]
 
 [[Server]]
 Pattern = "GET /custom/endpoint"
diff --git a/acceptance/selftest/skip/out.test.toml b/acceptance/selftest/skip/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/selftest/skip/out.test.toml
+++ b/acceptance/selftest/skip/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/selftest/sortlines/out.test.toml b/acceptance/selftest/sortlines/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/selftest/sortlines/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/selftest/sortlines/output.txt b/acceptance/selftest/sortlines/output.txt
new file mode 100644
index 00000000000..013e56e8224
--- /dev/null
+++ b/acceptance/selftest/sortlines/output.txt
@@ -0,0 +1,9 @@
+Fruit: quince
+Fruit: zucchini
+Not a fruit: rock
+Fruit: apple
+Fruit: banana
+Not a fruit: spoon
+Fruit: melon
+Created jobs.z
+Created jobs.a
diff --git a/acceptance/selftest/sortlines/override/out.test.toml b/acceptance/selftest/sortlines/override/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/selftest/sortlines/override/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/selftest/sortlines/override/output.txt b/acceptance/selftest/sortlines/override/output.txt
new file mode 100644
index 00000000000..339e6b00366
--- /dev/null
+++ b/acceptance/selftest/sortlines/override/output.txt
@@ -0,0 +1,4 @@
+Fruit: pear
+Fruit: apple
+Veg: carrot
+Veg: turnip
diff --git a/acceptance/selftest/sortlines/override/script b/acceptance/selftest/sortlines/override/script
new file mode 100644
index 00000000000..4a51a9f1add
--- /dev/null
+++ b/acceptance/selftest/sortlines/override/script
@@ -0,0 +1,4 @@
+echo "Fruit: pear"
+echo "Fruit: apple"
+echo "Veg: turnip"
+echo "Veg: carrot"
diff --git a/acceptance/selftest/sortlines/override/test.toml b/acceptance/selftest/sortlines/override/test.toml
new file mode 100644
index 00000000000..36c7a8748da
--- /dev/null
+++ b/acceptance/selftest/sortlines/override/test.toml
@@ -0,0 +1,3 @@
+# Reusing the inherited name replaces the parent's pattern rather than adding to it:
+# "Fruit:" lines are left alone from here on, and "Veg:" lines are sorted instead.
+SortLines.fruit = '^Veg: '
diff --git a/acceptance/selftest/sortlines/script b/acceptance/selftest/sortlines/script
new file mode 100644
index 00000000000..afe77ccac2c
--- /dev/null
+++ b/acceptance/selftest/sortlines/script
@@ -0,0 +1,15 @@
+# Each run of consecutive "Fruit:" lines is sorted on its own, and a non-matching line ends
+# the run. The values are picked so that this is visible in the output: the first block
+# sorts late in the alphabet and the second sorts early, so if the two blocks were sorted
+# together, "apple" and "banana" would move up past "Not a fruit: rock".
+echo "Fruit: zucchini"
+echo "Fruit: quince"
+echo "Not a fruit: rock"
+echo "Fruit: banana"
+echo "Fruit: apple"
+echo "Not a fruit: spoon"
+echo "Fruit: melon"
+
+# deploy_actions is disabled here, so these keep the order they were printed in.
+echo "Created jobs.z"
+echo "Created jobs.a"
diff --git a/acceptance/selftest/sortlines/test.toml b/acceptance/selftest/sortlines/test.toml
new file mode 100644
index 00000000000..d5b098bb2ed
--- /dev/null
+++ b/acceptance/selftest/sortlines/test.toml
@@ -0,0 +1,8 @@
+# Runs once: the sorting is independent of the deployment engine.
+
+# Only "Fruit:" lines are sorted; every other line delimits the runs.
+SortLines.fruit = '^Fruit: '
+
+# The inherited deploy_actions pattern is irrelevant here, and switching it off
+# exercises SortLinesOn.
+SortLinesOn.deploy_actions = false
diff --git a/acceptance/selftest/subset_ancestor_engine/_script b/acceptance/selftest/subset_ancestor_engine/_script
deleted file mode 100644
index 0836732d6ee..00000000000
--- a/acceptance/selftest/subset_ancestor_engine/_script
+++ /dev/null
@@ -1 +0,0 @@
-echo "engine=$DATABRICKS_BUNDLE_ENGINE" > "out.$DATABRICKS_BUNDLE_ENGINE.txt"
diff --git a/acceptance/selftest/subset_ancestor_engine/child/out.direct.txt b/acceptance/selftest/subset_ancestor_engine/child/out.direct.txt
deleted file mode 100644
index 163862caec8..00000000000
--- a/acceptance/selftest/subset_ancestor_engine/child/out.direct.txt
+++ /dev/null
@@ -1 +0,0 @@
-engine=direct
diff --git a/acceptance/selftest/subset_ancestor_engine/child/out.terraform.txt b/acceptance/selftest/subset_ancestor_engine/child/out.terraform.txt
deleted file mode 100644
index 2618d93f70d..00000000000
--- a/acceptance/selftest/subset_ancestor_engine/child/out.terraform.txt
+++ /dev/null
@@ -1 +0,0 @@
-engine=terraform
diff --git a/acceptance/selftest/subset_ancestor_engine/child/out.test.toml b/acceptance/selftest/subset_ancestor_engine/child/out.test.toml
deleted file mode 100644
index f784a183258..00000000000
--- a/acceptance/selftest/subset_ancestor_engine/child/out.test.toml
+++ /dev/null
@@ -1,3 +0,0 @@
-Local = true
-Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/selftest/subset_ancestor_engine/child/script b/acceptance/selftest/subset_ancestor_engine/child/script
deleted file mode 100644
index a3c2588f2d8..00000000000
--- a/acceptance/selftest/subset_ancestor_engine/child/script
+++ /dev/null
@@ -1,4 +0,0 @@
-# This script does not directly reference $DATABRICKS_BUNDLE_ENGINE.
-# Engine detection happens via the ancestor _script helper,
-# exercising the anyHelperScriptUsesEngine() path in subset selection.
-source "$TESTDIR/../_script"
diff --git a/acceptance/selftest/subset_ancestor_engine/child/test.toml b/acceptance/selftest/subset_ancestor_engine/child/test.toml
deleted file mode 100644
index 9b64b4605a7..00000000000
--- a/acceptance/selftest/subset_ancestor_engine/child/test.toml
+++ /dev/null
@@ -1 +0,0 @@
-EnvVaryOutput = "DATABRICKS_BUNDLE_ENGINE"
diff --git a/acceptance/selftest/testlog/out.test.toml b/acceptance/selftest/testlog/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/selftest/testlog/out.test.toml
+++ b/acceptance/selftest/testlog/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/selftest/timeout/out.test.toml b/acceptance/selftest/timeout/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/selftest/timeout/out.test.toml
+++ b/acceptance/selftest/timeout/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/selftest/timestamp/out.test.toml b/acceptance/selftest/timestamp/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/selftest/timestamp/out.test.toml
+++ b/acceptance/selftest/timestamp/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/selftest/trap/out.test.toml b/acceptance/selftest/trap/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/selftest/trap/out.test.toml
+++ b/acceptance/selftest/trap/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/ssh/bulk-transfer/out.test.toml b/acceptance/ssh/bulk-transfer/out.test.toml
new file mode 100644
index 00000000000..0cb6941ca8d
--- /dev/null
+++ b/acceptance/ssh/bulk-transfer/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = true
+GOOS.darwin = false
+GOOS.linux = true
+GOOS.windows = false
diff --git a/acceptance/ssh/bulk-transfer/output.txt b/acceptance/ssh/bulk-transfer/output.txt
new file mode 100644
index 00000000000..3bce864290e
--- /dev/null
+++ b/acceptance/ssh/bulk-transfer/output.txt
@@ -0,0 +1,6 @@
+
+=== Download 8388608 bytes over the tunnel
+received 8388608 of 8388608 bytes
+
+=== Upload 8388608 bytes over the tunnel
+delivered 8388608 of 8388608 bytes
diff --git a/acceptance/ssh/bulk-transfer/script b/acceptance/ssh/bulk-transfer/script
new file mode 100644
index 00000000000..7e043dedf28
--- /dev/null
+++ b/acceptance/ssh/bulk-transfer/script
@@ -0,0 +1,50 @@
+# A tunnel session must survive a payload larger than the proxy's internal buffers, in both
+# directions. `ssh connect --ide` pushes several megabytes while the remote IDE server starts,
+# so a ceiling here breaks the IDE outright: #6558 capped the unacknowledged replay window at
+# 1 MiB and read a full window as a peer that had stopped acknowledging, which ended every
+# session that moved more than that. That shipped in v1.16.0 and was reverted in #6608; this test
+# is here so a re-introduction is caught before users are.
+#
+# The byte counts below are the assertion, not the exit code: the regression ended the session
+# with truncated output and, depending on which side noticed the drop first, exit code 0.
+#
+# 8 MiB is the size that matters: the remote IDE server pushes about 7 MiB while it starts, and
+# it is eight times the window that broke.
+PAYLOAD_BYTES=8388608
+
+# Generated rather than committed: 8 MiB does not belong in the repo, and the exact bytes do not
+# matter. SSH MACs the byte stream (RFC 4253 section 6), so anything lost, duplicated or
+# reordered ends the session, which shows up here as a short count. The same command runs
+# remotely for the download and locally for the upload, so both directions move the same bytes.
+payload_cmd="yes 0123456789abcdefghijklmnopqrstuvwxyz | head -c $PAYLOAD_BYTES"
+
+if [ -n "${CLOUD_ENV:-}" ]; then
+  # Serverless CPU: nothing to provision, so this is the cheapest real tunnel to open.
+  CONNECT_FLAGS="--releases-dir=$CLI_RELEASES_DIR"
+else
+  # No compute locally: the test server backs the driver-proxy /ssh websocket with a real sshd,
+  # so the transfer crosses a real ssh session over a ws:// tunnel. Needs sshd (only task
+  # test-exp-ssh provisions it); the test server probes the same way, so skip where it's absent.
+  if [ -z "$(command -v sshd || ls /usr/sbin/sshd /usr/local/sbin/sshd /sbin/sshd 2>/dev/null)" ]; then
+    echo "SKIP_TEST sshd (openssh-server) not installed"
+    exit 0
+  fi
+
+  # No release artifacts locally and they're never executed; stand in empty archives.
+  mkdir -p releases
+  : >releases/databricks_cli_linux_amd64.zip
+  : >releases/databricks_cli_linux_arm64.zip
+  CONNECT_FLAGS="--releases-dir=$PWD/releases --known-hosts-dir=known-hosts"
+fi
+
+title "Download $PAYLOAD_BYTES bytes over the tunnel\n"
+errcode $CLI ssh connect $CONNECT_FLAGS -- "$payload_cmd" >received.bin 2>LOG.download
+echo "received $(wc -c <received.bin | tr -d ' ') of $PAYLOAD_BYTES bytes"
+
+title "Upload $PAYLOAD_BYTES bytes over the tunnel\n"
+sh -c "$payload_cmd" >sent.bin
+errcode $CLI ssh connect $CONNECT_FLAGS -- "wc -c" <sent.bin >remote-count.txt 2>LOG.upload
+# The remote count is empty when the session ended before `wc` could report; say 0 rather than
+# leaving a blank in the output.
+remote_count=$(tr -dc 0-9 <remote-count.txt)
+echo "delivered ${remote_count:-0} of $PAYLOAD_BYTES bytes"
diff --git a/acceptance/ssh/bulk-transfer/test.toml b/acceptance/ssh/bulk-transfer/test.toml
new file mode 100644
index 00000000000..2dd11a8b1e9
--- /dev/null
+++ b/acceptance/ssh/bulk-transfer/test.toml
@@ -0,0 +1,16 @@
+Cloud = true
+
+# Staged release archives, the pinned host key, and the payload files: none are golden output.
+Ignore = [
+  "releases",
+  "known-hosts",
+  "received.bin",
+  "sent.bin",
+  "remote-count.txt",
+]
+
+# The local run drives a real sshd, reliable only on Linux. Absent GOOS keys default to enabled,
+# so the other OSes must be disabled explicitly.
+GOOS.linux = true
+GOOS.darwin = false
+GOOS.windows = false
diff --git a/acceptance/ssh/connect-serverless-cpu/known_hosts b/acceptance/ssh/connect-serverless-cpu/known_hosts
new file mode 100644
index 00000000000..197ec818881
--- /dev/null
+++ b/acceptance/ssh/connect-serverless-cpu/known_hosts
@@ -0,0 +1 @@
+# not actually checked by tests; accept-new appends the ephemeral host key here
diff --git a/acceptance/ssh/connect-serverless-cpu/out.stdout.txt b/acceptance/ssh/connect-serverless-cpu/out.stdout.txt
new file mode 100644
index 00000000000..41cae5e7d16
--- /dev/null
+++ b/acceptance/ssh/connect-serverless-cpu/out.stdout.txt
@@ -0,0 +1 @@
+Connection successful
diff --git a/acceptance/ssh/connect-serverless-cpu/out.test.toml b/acceptance/ssh/connect-serverless-cpu/out.test.toml
new file mode 100644
index 00000000000..44cce516e73
--- /dev/null
+++ b/acceptance/ssh/connect-serverless-cpu/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = false
+GOOS.darwin = false
+GOOS.linux = true
+GOOS.windows = false
diff --git a/acceptance/ssh/connect-serverless-cpu/output.txt b/acceptance/ssh/connect-serverless-cpu/output.txt
new file mode 100644
index 00000000000..1a2da09b42c
--- /dev/null
+++ b/acceptance/ssh/connect-serverless-cpu/output.txt
@@ -0,0 +1,41 @@
+
+=== CLI ssh connect (local sshd)
+
+>>> print_requests.py //api/2.2/jobs/runs/submit
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/runs/submit",
+  "body": {
+    "environments": [
+      {
+        "environment_key": "ssh_tunnel_serverless",
+        "spec": {
+          "environment_version": "4"
+        }
+      }
+    ],
+    "run_name": "ssh-server-bootstrap-[CPU_CONN]",
+    "tasks": [
+      {
+        "environment_key": "ssh_tunnel_serverless",
+        "notebook_task": {
+          "base_parameters": {
+            "authorizedKeySecretName": "client-public-key",
+            "keepDetachedProcesses": "false",
+            "maxClients": "10",
+            "secretScopeName": "[USERNAME]-[CPU_CONN]-ssh-tunnel-keys",
+            "serverless": "true",
+            "sessionId": "[CPU_CONN]",
+            "shutdownDelay": "10m0s",
+            "usagePolicyId": "",
+            "version": "[CLI_VERSION]"
+          },
+          "notebook_path": "/Workspace/Users/[USERNAME]/.databricks/ssh-tunnel/[CLI_VERSION]/[CPU_CONN]/ssh-server-bootstrap"
+        },
+        "task_key": "start_ssh_server",
+        "timeout_seconds": 86400
+      }
+    ],
+    "timeout_seconds": 86400
+  }
+}
diff --git a/acceptance/ssh/connect-serverless-cpu/script b/acceptance/ssh/connect-serverless-cpu/script
new file mode 100644
index 00000000000..02b0068f3da
--- /dev/null
+++ b/acceptance/ssh/connect-serverless-cpu/script
@@ -0,0 +1,27 @@
+if [ -n "${CLOUD_ENV:-}" ]; then
+  # Cloud: real serverless CPU runs the command; dump the run on failure.
+  title "CLI ssh connect (serverless CPU)\n"
+  errcode $CLI ssh connect --releases-dir=$CLI_RELEASES_DIR -- "echo 'Connection successful'" >out.stdout.txt 2>LOG.stderr
+  if ! grep -q "Connection successful" out.stdout.txt; then
+    run_id=$(cat LOG.stderr | grep -o "Job submitted successfully with run ID: [0-9]*" | grep -o "[0-9]*$")
+    trace $CLI jobs get-run "$run_id" > LOG.job
+  fi
+else
+  # Local: the test server backs the /ssh websocket with a real sshd, so this
+  # asserts the bootstrap job plus a full handshake over the tunnel. Skip when
+  # sshd is absent (only task test-exp-ssh provisions it).
+  if [ -z "$(command -v sshd || ls /usr/sbin/sshd /usr/local/sbin/sshd /sbin/sshd 2>/dev/null)" ]; then
+    echo "SKIP_TEST sshd (openssh-server) not installed"
+    exit 0
+  fi
+
+  # No release artifacts locally and they're never executed; stand in empty archives.
+  mkdir -p releases
+  touch releases/databricks_cli_linux_amd64.zip
+  touch releases/databricks_cli_linux_arm64.zip
+  CLI_RELEASES_DIR="$PWD/releases"
+
+  title "CLI ssh connect (local sshd)\n"
+  errcode $CLI ssh connect --releases-dir=$CLI_RELEASES_DIR --known-hosts-dir=known-hosts -- "echo 'Connection successful'" >out.stdout.txt 2>LOG.stderr
+  trace print_requests.py //api/2.2/jobs/runs/submit
+fi
diff --git a/acceptance/ssh/connect-serverless-cpu/test.toml b/acceptance/ssh/connect-serverless-cpu/test.toml
new file mode 100644
index 00000000000..e2a81665dae
--- /dev/null
+++ b/acceptance/ssh/connect-serverless-cpu/test.toml
@@ -0,0 +1,25 @@
+Cloud = false
+
+# Serverless requires Unity Catalog.
+
+# Record requests so we can assert the bootstrap job the CLI submits.
+RecordRequests = true
+
+# Stand-in release archives staged by the local run, plus the host key the CLI pins under
+# known-hosts; not golden output.
+Ignore = [
+  "releases",
+  "known-hosts",
+]
+
+# The local run drives a real sshd, reliable only on Linux.
+GOOS.linux = true
+GOOS.darwin = false
+GOOS.windows = false
+
+# No --name: the connection name is a hash of the (random) local host, so
+# normalize it to keep the submitted job payload deterministic.
+
+[[Repls]]
+Old = 'databricks-cpu-[0-9a-f]{8}'
+New = "[CPU_CONN]"
diff --git a/acceptance/ssh/connect-serverless-feature-disabled/out.connect.txt b/acceptance/ssh/connect-serverless-feature-disabled/out.connect.txt
new file mode 100644
index 00000000000..d1205d7fb6a
--- /dev/null
+++ b/acceptance/ssh/connect-serverless-feature-disabled/out.connect.txt
@@ -0,0 +1,5 @@
+Connecting to feature-disabled...
+Uploading binaries...
+Starting SSH server...
+Job submitted successfully with run ID: [RUN_ID]
+Error: failed to ensure that ssh server is running: the workspace refused the SSH tunnel connection: FEATURE_DISABLED: An administrator has disabled port forwarding to serverless compute for this workspace, which includes the SSH tunnel used by `databricks ssh connect`
diff --git a/acceptance/ssh/connect-serverless-feature-disabled/out.test.toml b/acceptance/ssh/connect-serverless-feature-disabled/out.test.toml
new file mode 100644
index 00000000000..c826e1c76b6
--- /dev/null
+++ b/acceptance/ssh/connect-serverless-feature-disabled/out.test.toml
@@ -0,0 +1,5 @@
+Cloud = false
+GOOS.darwin = false
+GOOS.linux = true
+GOOS.windows = false
+EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/ssh/connect-serverless-feature-disabled/output.txt b/acceptance/ssh/connect-serverless-feature-disabled/output.txt
new file mode 100644
index 00000000000..9957a1c7e18
--- /dev/null
+++ b/acceptance/ssh/connect-serverless-feature-disabled/output.txt
@@ -0,0 +1,34 @@
+
+>>> [CLI] workspace-settings-v2 patch-public-workspace-setting port_fwd_serverless_enabled --json {"name": "port_fwd_serverless_enabled", "boolean_val": {"value": false}}
+
+=== CLI ssh connect
+
+=== Reported error category
+
+>>> jq -r select(.path == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log.ssh_tunnel_event.error_category [OUTPUT_DIR]/out.requests.txt
+DRIVER_PROXY_FORBIDDEN
+
+=== Each release archive is uploaded once, and the submitted run is cancelled
+
+>>> print_requests.py //api/2.0/workspace-files/import-file //api/2.2/jobs/runs/cancel
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.databricks/ssh-tunnel/[CLI_VERSION]/databricks_cli_linux_amd64/databricks.zip",
+  "q": {
+    "overwrite": "true"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/workspace-files/import-file/Workspace/Users/[USERNAME]/.databricks/ssh-tunnel/[CLI_VERSION]/databricks_cli_linux_arm64/databricks.zip",
+  "q": {
+    "overwrite": "true"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/runs/cancel",
+  "body": {
+    "run_id": [RUN_ID]
+  }
+}
diff --git a/acceptance/ssh/connect-serverless-feature-disabled/script b/acceptance/ssh/connect-serverless-feature-disabled/script
new file mode 100644
index 00000000000..9f8fe5c1b92
--- /dev/null
+++ b/acceptance/ssh/connect-serverless-feature-disabled/script
@@ -0,0 +1,22 @@
+# An administrator disabled port forwarding to serverless compute, so the driver proxy refuses
+# every request to the tunnel server. The setting itself cannot be read here (see test.toml), so
+# the CLI goes ahead and starts the server. It must then report the proxy's reason as soon as it
+# gets the 403 instead of polling until the server start timeout, and cancel the run it submitted
+# since nothing can ever connect to that server.
+# The body repeats the name: with only {"value": false} in it, the API sees an empty message.
+trace $CLI workspace-settings-v2 patch-public-workspace-setting port_fwd_serverless_enabled --json '{"name": "port_fwd_serverless_enabled", "boolean_val": {"value": false}}' >/dev/null
+
+# No release artifacts locally and they're never executed; stand in empty archives.
+mkdir -p releases
+: >releases/databricks_cli_linux_amd64.zip
+: >releases/databricks_cli_linux_arm64.zip
+
+title "CLI ssh connect\n"
+musterr $CLI ssh connect --name feature-disabled --releases-dir="$PWD/releases" -- "echo 'Connection successful'" >out.connect.txt 2>&1
+add_repl "$(grep -o 'run ID: [0-9]*' out.connect.txt | grep -o '[0-9]*$')" RUN_ID
+
+title "Reported error category\n"
+trace jq -r 'select(.path == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log.ssh_tunnel_event.error_category' "$OUT_REQUESTS"
+
+title "Each release archive is uploaded once, and the submitted run is cancelled\n"
+trace print_requests.py //api/2.0/workspace-files/import-file //api/2.2/jobs/runs/cancel
diff --git a/acceptance/ssh/connect-serverless-feature-disabled/test.toml b/acceptance/ssh/connect-serverless-feature-disabled/test.toml
new file mode 100644
index 00000000000..3ed947e3902
--- /dev/null
+++ b/acceptance/ssh/connect-serverless-feature-disabled/test.toml
@@ -0,0 +1,30 @@
+Cloud = false
+
+# Record requests so we can assert that the CLI uploads each release archive once and cancels
+# the run it submitted.
+RecordRequests = true
+
+# Stand-in release archives staged by the script; not golden output.
+Ignore = [
+  "releases",
+]
+
+# The rest of acceptance/ssh only runs on Linux; nothing here needs another OS.
+GOOS.linux = true
+GOOS.darwin = false
+GOOS.windows = false
+
+EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+
+# Production does not serve port_fwd_serverless_enabled through the public API, so the CLI cannot
+# check it up front there and only learns about it from the driver proxy's 403. This reproduces
+# that environment, which the fake workspace's settings handler does not model.
+[[Server]]
+Pattern = "GET /api/2.1/settings/port_fwd_serverless_enabled"
+Response.StatusCode = 404
+Response.Body = '''
+{
+  "error_code": "NOT_FOUND",
+  "message": "Setting port_fwd_serverless_enabled is not enabled for public API"
+}
+'''
diff --git a/acceptance/ssh/connect-serverless-gpu/known_hosts b/acceptance/ssh/connect-serverless-gpu/known_hosts
new file mode 100644
index 00000000000..197ec818881
--- /dev/null
+++ b/acceptance/ssh/connect-serverless-gpu/known_hosts
@@ -0,0 +1 @@
+# not actually checked by tests; accept-new appends the ephemeral host key here
diff --git a/acceptance/ssh/connect-serverless-gpu/out.test.toml b/acceptance/ssh/connect-serverless-gpu/out.test.toml
index ab8691ddb9b..ccd41ad5e2b 100644
--- a/acceptance/ssh/connect-serverless-gpu/out.test.toml
+++ b/acceptance/ssh/connect-serverless-gpu/out.test.toml
@@ -1,5 +1,5 @@
-Local = false
 Cloud = false
-RequiresUnityCatalog = true
+GOOS.darwin = false
+GOOS.linux = true
+GOOS.windows = false
 CloudEnvs.gcp = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/ssh/connect-serverless-gpu/output.txt b/acceptance/ssh/connect-serverless-gpu/output.txt
index e69de29bb2d..c89a29c8193 100644
--- a/acceptance/ssh/connect-serverless-gpu/output.txt
+++ b/acceptance/ssh/connect-serverless-gpu/output.txt
@@ -0,0 +1,42 @@
+
+>>> print_requests.py //api/2.2/jobs/runs/submit
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/runs/submit",
+  "body": {
+    "environments": [
+      {
+        "environment_key": "ssh_tunnel_serverless",
+        "spec": {
+          "environment_version": "4"
+        }
+      }
+    ],
+    "run_name": "ssh-server-bootstrap-serverless-gpu-test",
+    "tasks": [
+      {
+        "compute": {
+          "hardware_accelerator": "GPU_1xA10"
+        },
+        "environment_key": "ssh_tunnel_serverless",
+        "notebook_task": {
+          "base_parameters": {
+            "authorizedKeySecretName": "client-public-key",
+            "keepDetachedProcesses": "false",
+            "maxClients": "10",
+            "secretScopeName": "[USERNAME]-serverless-gpu-test-ssh-tunnel-keys",
+            "serverless": "true",
+            "sessionId": "serverless-gpu-test",
+            "shutdownDelay": "10m0s",
+            "usagePolicyId": "",
+            "version": "[CLI_VERSION]"
+          },
+          "notebook_path": "/Workspace/Users/[USERNAME]/.databricks/ssh-tunnel/[CLI_VERSION]/serverless-gpu-test/ssh-server-bootstrap"
+        },
+        "task_key": "start_ssh_server",
+        "timeout_seconds": 86400
+      }
+    ],
+    "timeout_seconds": 86400
+  }
+}
diff --git a/acceptance/ssh/connect-serverless-gpu/script b/acceptance/ssh/connect-serverless-gpu/script
index 8c8538f6e32..b2e5e3d40fa 100644
--- a/acceptance/ssh/connect-serverless-gpu/script
+++ b/acceptance/ssh/connect-serverless-gpu/script
@@ -1,6 +1,29 @@
-errcode $CLI ssh connect --name serverless-gpu-test --accelerator=GPU_1xA10 --releases-dir=$CLI_RELEASES_DIR -- "echo 'Connection successful'" >out.stdout.txt 2>LOG.stderr
+if [ -z "${CLOUD_ENV:-}" ]; then
+  # Local runs have no release artifacts and never execute the uploaded
+  # binaries, so stand in empty archives (dev name omits the version).
+  mkdir -p releases
+  : >releases/databricks_cli_linux_amd64.zip
+  : >releases/databricks_cli_linux_arm64.zip
+  CLI_RELEASES_DIR="$PWD/releases"
+fi
 
-if ! grep -q "Connection successful" out.stdout.txt; then
-  run_id=$(cat LOG.stderr | grep -o "Job submitted successfully with run ID: [0-9]*" | grep -o "[0-9]*$")
-  trace $CLI jobs get-run "$run_id" > LOG.job
+if [ -n "${CLOUD_ENV:-}" ]; then
+  # On cloud serverless GPU compute runs the remote command over a full SSH
+  # handshake; dump the run on failure.
+  errcode $CLI ssh connect --name serverless-gpu-test --accelerator=GPU_1xA10 --releases-dir=$CLI_RELEASES_DIR -- "echo 'Connection successful'" >out.stdout.txt 2>LOG.stderr
+  if ! grep -q "Connection successful" out.stdout.txt; then
+    run_id=$(cat LOG.stderr | grep -o "Job submitted successfully with run ID: [0-9]*" | grep -o "[0-9]*$")
+    trace $CLI jobs get-run "$run_id" > LOG.job
+  fi
+else
+  # No compute locally: the test server backs the driver-proxy /ssh websocket with a
+  # real sshd, so this one run asserts both the bootstrap job and a full handshake +
+  # remote exec over the ws:// tunnel. Needs sshd (only task test-exp-ssh provisions
+  # it); the test server probes the same way, so skip where it's absent.
+  if [ -z "$(command -v sshd || ls /usr/sbin/sshd /usr/local/sbin/sshd /sbin/sshd 2>/dev/null)" ]; then
+    echo "SKIP_TEST sshd (openssh-server) not installed"
+    exit 0
+  fi
+  errcode $CLI ssh connect --name serverless-gpu-test --accelerator=GPU_1xA10 --releases-dir=$CLI_RELEASES_DIR --known-hosts-dir=known-hosts -- "echo 'Connection successful'" >out.stdout.txt 2>LOG.stderr
+  trace print_requests.py //api/2.2/jobs/runs/submit
 fi
diff --git a/acceptance/ssh/connect-serverless-gpu/test.toml b/acceptance/ssh/connect-serverless-gpu/test.toml
index fa125d9bb5d..7f941a26c6e 100644
--- a/acceptance/ssh/connect-serverless-gpu/test.toml
+++ b/acceptance/ssh/connect-serverless-gpu/test.toml
@@ -1,12 +1,23 @@
-Local = false
 Cloud = false
 
 # Serverless GPU is only available in newer environments
-RequiresUnityCatalog = true
 
-# Serverless GPU is not available in GCP yet
-[CloudEnvs]
-  gcp = false
+# Assert the serverless GPU bootstrap job the CLI submits on a local run.
+RecordRequests = true
+
+# Local runs stage stand-in release archives here, and the CLI pins the server's host key
+# under known-hosts; neither is part of the golden output.
+Ignore = [
+  "releases",
+  "known-hosts",
+]
 
-[EnvMatrix]
-  DATABRICKS_BUNDLE_ENGINE = ["direct"]
+# Linux-only: the local run drives a real sshd, reliable only there (and where
+# task test-exp-ssh provisions it). Absent GOOS keys default to enabled, so the
+# other OSes must be disabled explicitly.
+GOOS.linux = true
+GOOS.darwin = false
+GOOS.windows = false
+
+# Serverless GPU is not available in GCP yet
+CloudEnvs.gcp = false
diff --git a/acceptance/ssh/connect-serverless-port-forwarding-disabled/out.test.toml b/acceptance/ssh/connect-serverless-port-forwarding-disabled/out.test.toml
new file mode 100644
index 00000000000..c826e1c76b6
--- /dev/null
+++ b/acceptance/ssh/connect-serverless-port-forwarding-disabled/out.test.toml
@@ -0,0 +1,5 @@
+Cloud = false
+GOOS.darwin = false
+GOOS.linux = true
+GOOS.windows = false
+EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/ssh/connect-serverless-port-forwarding-disabled/output.txt b/acceptance/ssh/connect-serverless-port-forwarding-disabled/output.txt
new file mode 100644
index 00000000000..26b382fefe6
--- /dev/null
+++ b/acceptance/ssh/connect-serverless-port-forwarding-disabled/output.txt
@@ -0,0 +1,15 @@
+
+>>> [CLI] workspace-settings-v2 patch-public-workspace-setting port_fwd_serverless_enabled --json {"name": "port_fwd_serverless_enabled", "boolean_val": {"value": false}}
+
+=== CLI ssh connect
+
+>>> musterr [CLI] ssh connect --name port-forwarding-disabled -- echo 'Connection successful'
+Connecting to port-forwarding-disabled...
+Error: port forwarding to serverless compute is disabled for this workspace (setting port_fwd_serverless_enabled), and the SSH tunnel needs it. Ask a workspace or account admin to enable it, or connect to a dedicated cluster with --cluster
+
+=== Reported error category
+
+>>> jq -r select(.path == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log.ssh_tunnel_event.error_category [OUTPUT_DIR]/out.requests.txt
+PORT_FORWARDING_DISABLED
+
+>>> print_requests.py //api
diff --git a/acceptance/ssh/connect-serverless-port-forwarding-disabled/script b/acceptance/ssh/connect-serverless-port-forwarding-disabled/script
new file mode 100644
index 00000000000..2dbc12b6ac0
--- /dev/null
+++ b/acceptance/ssh/connect-serverless-port-forwarding-disabled/script
@@ -0,0 +1,16 @@
+# An administrator disabled port forwarding to serverless compute. The CLI reads the setting
+# before anything else, so it refuses the connection without creating a secret scope, uploading
+# binaries or starting compute that nobody could reach.
+# The body repeats the name: with only {"value": false} in it, the API sees an empty message.
+trace $CLI workspace-settings-v2 patch-public-workspace-setting port_fwd_serverless_enabled --json '{"name": "port_fwd_serverless_enabled", "boolean_val": {"value": false}}' >/dev/null
+# Drop the setup request so the check below only sees what ssh connect sent.
+print_requests.py //api/2.1/settings >/dev/null
+
+title "CLI ssh connect\n"
+trace musterr $CLI ssh connect --name port-forwarding-disabled -- "echo 'Connection successful'"
+
+title "Reported error category\n"
+trace jq -r 'select(.path == "/telemetry-ext") | .body.protoLogs[] | fromjson | .entry.databricks_cli_log.ssh_tunnel_event.error_category' "$OUT_REQUESTS"
+
+# Expect no requests other than reads: the connection stops at the settings check.
+trace print_requests.py //api
diff --git a/acceptance/ssh/connect-serverless-port-forwarding-disabled/test.toml b/acceptance/ssh/connect-serverless-port-forwarding-disabled/test.toml
new file mode 100644
index 00000000000..10c3ef353f7
--- /dev/null
+++ b/acceptance/ssh/connect-serverless-port-forwarding-disabled/test.toml
@@ -0,0 +1,11 @@
+Cloud = false
+
+# Record requests so we can assert that nothing is created before the CLI gives up.
+RecordRequests = true
+
+# The rest of acceptance/ssh only runs on Linux; nothing here needs another OS.
+GOOS.linux = true
+GOOS.darwin = false
+GOOS.windows = false
+
+EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
diff --git a/acceptance/ssh/connection/known_hosts b/acceptance/ssh/connection/known_hosts
deleted file mode 100644
index b254044c77a..00000000000
--- a/acceptance/ssh/connection/known_hosts
+++ /dev/null
@@ -1,2 +0,0 @@
-# not actually checked by tests
-cluster ssh-rsa key
diff --git a/acceptance/ssh/connection/out.test.toml b/acceptance/ssh/connection/out.test.toml
index 06079f65341..44cce516e73 100644
--- a/acceptance/ssh/connection/out.test.toml
+++ b/acceptance/ssh/connection/out.test.toml
@@ -1,4 +1,4 @@
-Local = false
 Cloud = false
-RequiresCluster = true
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+GOOS.darwin = false
+GOOS.linux = true
+GOOS.windows = false
diff --git a/acceptance/ssh/connection/output.txt b/acceptance/ssh/connection/output.txt
index e69de29bb2d..1372be147a3 100644
--- a/acceptance/ssh/connection/output.txt
+++ b/acceptance/ssh/connection/output.txt
@@ -0,0 +1,31 @@
+
+>>> print_requests.py //api/2.2/jobs/runs/submit
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/runs/submit",
+  "body": {
+    "run_name": "ssh-server-bootstrap-[TEST_DEFAULT_CLUSTER_ID]",
+    "tasks": [
+      {
+        "existing_cluster_id": "[TEST_DEFAULT_CLUSTER_ID]",
+        "notebook_task": {
+          "base_parameters": {
+            "authorizedKeySecretName": "client-public-key",
+            "keepDetachedProcesses": "false",
+            "maxClients": "10",
+            "secretScopeName": "[USERNAME]-[TEST_DEFAULT_CLUSTER_ID]-ssh-tunnel-keys",
+            "serverless": "false",
+            "sessionId": "[TEST_DEFAULT_CLUSTER_ID]",
+            "shutdownDelay": "10m0s",
+            "usagePolicyId": "",
+            "version": "[CLI_VERSION]"
+          },
+          "notebook_path": "/Workspace/Users/[USERNAME]/.databricks/ssh-tunnel/[CLI_VERSION]/[TEST_DEFAULT_CLUSTER_ID]/ssh-server-bootstrap"
+        },
+        "task_key": "start_ssh_server",
+        "timeout_seconds": 86400
+      }
+    ],
+    "timeout_seconds": 86400
+  }
+}
diff --git a/acceptance/ssh/connection/script b/acceptance/ssh/connection/script
index 39e8b39ef4b..3858cd1b6ba 100644
--- a/acceptance/ssh/connection/script
+++ b/acceptance/ssh/connection/script
@@ -1,6 +1,29 @@
-errcode $CLI ssh connect --cluster=$TEST_DEFAULT_CLUSTER_ID --releases-dir=$CLI_RELEASES_DIR --user-known-hosts-file=known_hosts -- "echo 'Connection successful'" >out.stdout.txt 2>LOG.stderr
+if [ -z "${CLOUD_ENV:-}" ]; then
+  # Local runs have no release artifacts and never execute the uploaded
+  # binaries, so stand in empty archives (dev name omits the version).
+  mkdir -p releases
+  : >releases/databricks_cli_linux_amd64.zip
+  : >releases/databricks_cli_linux_arm64.zip
+  CLI_RELEASES_DIR="$PWD/releases"
+fi
 
-if ! grep -q "Connection successful" out.stdout.txt; then
-  run_id=$(cat LOG.stderr | grep -o "Job submitted successfully with run ID: [0-9]*" | grep -o "[0-9]*$")
-  trace $CLI jobs get-run "$run_id" > LOG.job
+if [ -n "${CLOUD_ENV:-}" ]; then
+  # On cloud the dedicated cluster runs the remote command over a full SSH
+  # handshake; dump the run on failure.
+  errcode $CLI ssh connect --cluster=$TEST_DEFAULT_CLUSTER_ID --releases-dir=$CLI_RELEASES_DIR --known-hosts-dir=known-hosts -- "echo 'Connection successful'" >out.stdout.txt 2>LOG.stderr
+  if ! grep -q "Connection successful" out.stdout.txt; then
+    run_id=$(cat LOG.stderr | grep -o "Job submitted successfully with run ID: [0-9]*" | grep -o "[0-9]*$")
+    trace $CLI jobs get-run "$run_id" > LOG.job
+  fi
+else
+  # No compute locally: the test server backs the driver-proxy /ssh websocket with a
+  # real sshd, so this one run asserts both the bootstrap job and a full handshake +
+  # remote exec over the ws:// tunnel. Needs sshd (only task test-exp-ssh provisions
+  # it); the test server probes the same way, so skip where it's absent.
+  if [ -z "$(command -v sshd || ls /usr/sbin/sshd /usr/local/sbin/sshd /sbin/sshd 2>/dev/null)" ]; then
+    echo "SKIP_TEST sshd (openssh-server) not installed"
+    exit 0
+  fi
+  errcode $CLI ssh connect --cluster=$TEST_DEFAULT_CLUSTER_ID --releases-dir=$CLI_RELEASES_DIR --known-hosts-dir=known-hosts -- "echo 'Connection successful'" >out.stdout.txt 2>LOG.stderr
+  trace print_requests.py //api/2.2/jobs/runs/submit
 fi
diff --git a/acceptance/ssh/connection/test.toml b/acceptance/ssh/connection/test.toml
index 76965d3ae0e..6f720c3a52b 100644
--- a/acceptance/ssh/connection/test.toml
+++ b/acceptance/ssh/connection/test.toml
@@ -1,6 +1,21 @@
-Local = false
 Cloud = false
-RequiresCluster = true
 
-[EnvMatrix]
-  DATABRICKS_BUNDLE_ENGINE = ["direct"]
+# On cloud this needs a real dedicated single-user cluster; locally the default
+# test cluster stands in for it.
+
+# Assert the dedicated-cluster bootstrap job the CLI submits on a local run.
+RecordRequests = true
+
+# Local runs stage stand-in release archives here, and the CLI pins the server's host key
+# under known-hosts; neither is part of the golden output.
+Ignore = [
+  "releases",
+  "known-hosts",
+]
+
+# Linux-only: the local run drives a real sshd, reliable only there (and where
+# task test-exp-ssh provisions it). Absent GOOS keys default to enabled, so the
+# other OSes must be disabled explicitly.
+GOOS.linux = true
+GOOS.darwin = false
+GOOS.windows = false
diff --git a/acceptance/ssh/reconnect-reused-name/out.connect-1.txt b/acceptance/ssh/reconnect-reused-name/out.connect-1.txt
new file mode 100644
index 00000000000..41cae5e7d16
--- /dev/null
+++ b/acceptance/ssh/reconnect-reused-name/out.connect-1.txt
@@ -0,0 +1 @@
+Connection successful
diff --git a/acceptance/ssh/reconnect-reused-name/out.connect-2.txt b/acceptance/ssh/reconnect-reused-name/out.connect-2.txt
new file mode 100644
index 00000000000..41cae5e7d16
--- /dev/null
+++ b/acceptance/ssh/reconnect-reused-name/out.connect-2.txt
@@ -0,0 +1 @@
+Connection successful
diff --git a/acceptance/ssh/reconnect-reused-name/out.test.toml b/acceptance/ssh/reconnect-reused-name/out.test.toml
new file mode 100644
index 00000000000..44cce516e73
--- /dev/null
+++ b/acceptance/ssh/reconnect-reused-name/out.test.toml
@@ -0,0 +1,4 @@
+Cloud = false
+GOOS.darwin = false
+GOOS.linux = true
+GOOS.windows = false
diff --git a/acceptance/ssh/reconnect-reused-name/output.txt b/acceptance/ssh/reconnect-reused-name/output.txt
new file mode 100644
index 00000000000..43e837cd723
--- /dev/null
+++ b/acceptance/ssh/reconnect-reused-name/output.txt
@@ -0,0 +1,10 @@
+
+=== CLI ssh connect over a stale host key for the connection name
+
+=== The stale key is replaced by the one the workspace published
+stale key replaced
+
+>>> grep -c ^reused-name ssh- known-hosts/reused-name
+1
+
+=== Reconnecting to the running server keeps working
diff --git a/acceptance/ssh/reconnect-reused-name/script b/acceptance/ssh/reconnect-reused-name/script
new file mode 100644
index 00000000000..b07e4304746
--- /dev/null
+++ b/acceptance/ssh/reconnect-reused-name/script
@@ -0,0 +1,42 @@
+# Reconnecting with a name used before must not fail on the host key
+# recorded for that name earlier. The tunnel's host key lives in the workspace, and the
+# CLI pins it for the connection name, so a key recorded by an earlier instance (or by
+# the same name in another workspace) is replaced rather than tripping strict checking.
+#
+# The test server backs the /ssh websocket with a real sshd whose host key comes from the
+# session's secret scope, so this asserts a full handshake against a pinned key. Skip when
+# sshd is absent (only task test-exp-ssh provisions it).
+if [ -z "$(command -v sshd || ls /usr/sbin/sshd /usr/local/sbin/sshd /sbin/sshd 2>/dev/null)" ]; then
+  echo "SKIP_TEST sshd (openssh-server) not installed"
+  exit 0
+fi
+
+# No release artifacts locally and they're never executed; stand in empty archives.
+mkdir -p releases
+: >releases/databricks_cli_linux_amd64.zip
+: >releases/databricks_cli_linux_arm64.zip
+CLI_RELEASES_DIR="$PWD/releases"
+
+# The state a user reconnecting with a reused name is in: an entry for this connection
+# name, pinned days earlier, whose key no longer belongs to anything. The CLI names the file
+# after the connection, so --known-hosts-dir is enough to keep the pin inside the test.
+STALE_KEY=AAAAC3NzaC1lZDI1NTE5AAAAICTzJweKcgiNoBUAyuvCY2Qu1Od8mKBON5aJeA03Nl+D
+mkdir -p known-hosts
+echo "reused-name ssh-ed25519 $STALE_KEY" >known-hosts/reused-name
+
+# The remote command's output is the assertion (see out.connect-*.txt); the tunnel's own
+# progress and teardown messages go to stderr, where the order of the last few lines
+# depends on which side closes the websocket first.
+title "CLI ssh connect over a stale host key for the connection name\n"
+errcode $CLI ssh connect --name reused-name --releases-dir=$CLI_RELEASES_DIR --known-hosts-dir=known-hosts -- "echo 'Connection successful'" >out.connect-1.txt 2>LOG.connect-1
+
+title "The stale key is replaced by the one the workspace published\n"
+if grep -q "$STALE_KEY" known-hosts/reused-name; then
+  echo "stale key still pinned"
+else
+  echo "stale key replaced"
+fi
+trace grep -c "^reused-name ssh-" known-hosts/reused-name
+
+title "Reconnecting to the running server keeps working\n"
+errcode $CLI ssh connect --name reused-name --releases-dir=$CLI_RELEASES_DIR --known-hosts-dir=known-hosts -- "echo 'Connection successful'" >out.connect-2.txt 2>LOG.connect-2
diff --git a/acceptance/ssh/reconnect-reused-name/test.toml b/acceptance/ssh/reconnect-reused-name/test.toml
new file mode 100644
index 00000000000..e88220d564c
--- /dev/null
+++ b/acceptance/ssh/reconnect-reused-name/test.toml
@@ -0,0 +1,16 @@
+Cloud = false
+
+# The connection name is explicit, so nothing here depends on the local host name.
+
+# Local runs stage stand-in release archives here; not part of the golden output.
+Ignore = [
+  "releases",
+  "known-hosts",
+]
+
+# Linux-only: the local run drives a real sshd, reliable only there (and where
+# task test-exp-ssh provisions it). Absent GOOS keys default to enabled, so the
+# other OSes must be disabled explicitly.
+GOOS.linux = true
+GOOS.darwin = false
+GOOS.windows = false
diff --git a/acceptance/ssh/setup/out.test.toml b/acceptance/ssh/setup/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/ssh/setup/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/ssh/setup/output.txt b/acceptance/ssh/setup/output.txt
new file mode 100644
index 00000000000..c07eb2cc138
--- /dev/null
+++ b/acceptance/ssh/setup/output.txt
@@ -0,0 +1,22 @@
+
+=== ProxyCommand written by setup --max-clients=25 --server-timeout=48h
+ssh connect --proxy --cluster=[TEST_DEFAULT_CLUSTER_ID] --auto-start-cluster=true --shutdown-delay=10m0s --max-clients=25 --server-timeout=48h0m0s
+
+=== A shutdown delay beyond the default lifetime raises it, no --server-timeout needed
+ssh connect --proxy --cluster=[TEST_DEFAULT_CLUSTER_ID] --auto-start-cluster=true --shutdown-delay=48h0m0s --max-clients=10 --server-timeout=48h0m0s
+
+=== ProxyCommand written by setup --keep-detached-processes
+ssh connect --proxy --cluster=[TEST_DEFAULT_CLUSTER_ID] --auto-start-cluster=true --shutdown-delay=10m0s --keep-detached-processes --max-clients=10 --server-timeout=24h0m0s
+
+=== Rejects a server that would refuse every connection
+>>> [CLI] ssh setup --name=broken --cluster=[TEST_DEFAULT_CLUSTER_ID] --max-clients=0
+Error: --max-clients must be at least 1, got 0
+
+=== Rejects a shutdown delay the server can never reach
+>>> [CLI] ssh setup --name=broken --cluster=[TEST_DEFAULT_CLUSTER_ID] --shutdown-delay=48h --server-timeout=24h
+Error: --shutdown-delay (48h0m0s) cannot be longer than --server-timeout (24h0m0s)
+
+=== No host config is written for the rejected setups
+home/.databricks/ssh-tunnel-configs/keep-detached
+home/.databricks/ssh-tunnel-configs/long-delay
+home/.databricks/ssh-tunnel-configs/my-cluster
diff --git a/acceptance/ssh/setup/script b/acceptance/ssh/setup/script
new file mode 100644
index 00000000000..a04c038ff3d
--- /dev/null
+++ b/acceptance/ssh/setup/script
@@ -0,0 +1,33 @@
+sethome "./home"
+
+# Send the command's own output to a LOG file: it echoes the whole host config, whose IdentityFile
+# and ProxyCommand carry OS-specific absolute paths.
+$CLI ssh setup --name=my-cluster --cluster=$TEST_DEFAULT_CLUSTER_ID --max-clients=25 --server-timeout=48h &>LOG.setup
+
+# The ProxyCommand is the invocation that submits the SSH server job, so --max-clients and
+# --server-timeout have to appear there or `ssh my-cluster` silently starts a server with the
+# defaults.
+title "ProxyCommand written by setup --max-clients=25 --server-timeout=48h\n"
+sed -n 's/.*\(ssh connect --proxy.*\)/\1/p' "$HOME/.databricks/ssh-tunnel-configs/my-cluster"
+
+# A shutdown delay longer than the default 24h lifetime worked before --server-timeout existed,
+# and `ssh setup` persisted it into the ProxyCommand. OpenSSH runs that ProxyCommand verbatim, so
+# the delay has to keep raising the lifetime rather than becoming an error the user cannot fix.
+title "A shutdown delay beyond the default lifetime raises it, no --server-timeout needed\n"
+$CLI ssh setup --name=long-delay --cluster=$TEST_DEFAULT_CLUSTER_ID --shutdown-delay=48h &>LOG.long-delay
+sed -n 's/.*\(ssh connect --proxy.*\)/\1/p' "$HOME/.databricks/ssh-tunnel-configs/long-delay"
+
+# Holding the job run open for detached processes is fixed at submission too, so a host
+# configured through setup can only ask for it here.
+title "ProxyCommand written by setup --keep-detached-processes\n"
+$CLI ssh setup --name=keep-detached --cluster=$TEST_DEFAULT_CLUSTER_ID --keep-detached-processes &>LOG.keep-detached
+sed -n 's/.*\(ssh connect --proxy.*\)/\1/p' "$HOME/.databricks/ssh-tunnel-configs/keep-detached"
+
+title "Rejects a server that would refuse every connection"
+musterr trace $CLI ssh setup --name=broken --cluster=$TEST_DEFAULT_CLUSTER_ID --max-clients=0
+
+title "Rejects a shutdown delay the server can never reach"
+musterr trace $CLI ssh setup --name=broken --cluster=$TEST_DEFAULT_CLUSTER_ID --shutdown-delay=48h --server-timeout=24h
+
+title "No host config is written for the rejected setups\n"
+find.py 'ssh-tunnel-configs' --expect 3
diff --git a/acceptance/ssh/setup/test.toml b/acceptance/ssh/setup/test.toml
new file mode 100644
index 00000000000..9a56fa72838
--- /dev/null
+++ b/acceptance/ssh/setup/test.toml
@@ -0,0 +1,6 @@
+# `ssh setup` only reads the cluster and writes local SSH config, so a real workspace adds nothing.
+Cloud = false
+
+Ignore = [
+  "home",
+]
diff --git a/acceptance/subset_test.go b/acceptance/subset_test.go
new file mode 100644
index 00000000000..b996f87cf13
--- /dev/null
+++ b/acceptance/subset_test.go
@@ -0,0 +1,120 @@
+package acceptance_test
+
+import (
+	"hash/fnv"
+	"os"
+	"strconv"
+	"strings"
+	"testing"
+	"uuid"
+
+	"github.com/databricks/cli/acceptance/internal/selection"
+)
+
+// TESTS_SELECT_SUBSET_PCT/SEED select a random subset of subtests to run, so a CI
+// cell can cover a fraction of the suite in less time. CI sets these only on the
+// windows/macOS pull_request cells (see .github/workflows/push.yml); on Linux they
+// are unset and the full suite runs.
+const (
+	// SubsetPctEnvVar is an integer 0..100: the percentage of subtests to run.
+	// Unset (or empty) disables subsetting entirely.
+	SubsetPctEnvVar = "TESTS_SELECT_SUBSET_PCT"
+
+	// SubsetSeedEnvVar seeds the selection. CI sets it to the HEAD commit hash, so
+	// a new commit reshuffles the subset while a retry of the same commit repeats it.
+	// If unset, a random seed is generated and logged so the run can be reproduced.
+	SubsetSeedEnvVar = "TESTS_SELECT_SUBSET_SEED"
+
+	// subsetChangedLimit caps how many changed tests the subset selector keeps on top of
+	// its hash-selected fraction. Unlike selection.EnvVar it carries no count of its own,
+	// and a PR that edits hundreds of test dirs must not turn the subset cells back into
+	// a full run.
+	subsetChangedLimit = 50
+)
+
+// subsetSelector decides, per subtest, whether it runs under TESTS_SELECT_SUBSET_PCT.
+// A subtest runs if it is a changed test on this branch (always kept, reusing the same
+// change detection as DATABRICKS_TEST_SELECT_CHANGED), or if its seeded hash falls
+// under the percentage. The decision is independent per subtest, so changed tests run
+// on top of the hash-selected subset rather than displacing anything.
+type subsetSelector struct {
+	enabled bool
+	pct     int
+	seed    string
+
+	// changed maps test dir -> variant filters for added/modified tests (nil filters
+	// means all variants of that dir are changed). Same shape as changedTests.
+	changed map[string][]string
+}
+
+// newSubsetSelector reads the subset env vars. Subsetting is disabled in update mode
+// and under -forcerun so that every output is regenerated and forced runs are honored.
+// The caller assigns .changed (the changed tests to always keep) so that the change
+// detection is shared with DATABRICKS_TEST_SELECT_CHANGED and runs at most once.
+func newSubsetSelector(t *testing.T, overwrite, forcerun bool) subsetSelector {
+	raw := os.Getenv(SubsetPctEnvVar)
+	if raw == "" || overwrite || forcerun {
+		return subsetSelector{}
+	}
+
+	pct, err := strconv.Atoi(raw)
+	if err != nil || pct < 0 || pct > 100 {
+		t.Fatalf("Invalid %s=%q, expected an integer 0..100", SubsetPctEnvVar, raw)
+	}
+
+	seed := os.Getenv(SubsetSeedEnvVar)
+	if seed == "" {
+		// Reproduce this run's subset by re-running with the logged seed.
+		seed = uuid.New().String()
+		t.Logf("%s not set, using random seed %q", SubsetSeedEnvVar, seed)
+	}
+
+	return subsetSelector{
+		enabled: true,
+		pct:     pct,
+		seed:    seed,
+	}
+}
+
+// skipReason returns a non-empty skip message if the subtest identified by dir and
+// envset should be skipped by subsetting, or "" if it should run.
+func (s subsetSelector) skipReason(dir string, envset []string) string {
+	if !s.enabled {
+		return ""
+	}
+	if s.isChanged(dir, envset) {
+		return ""
+	}
+	id := dir
+	if len(envset) > 0 {
+		id += "/" + strings.Join(envset, "/")
+	}
+	if hashPercent(s.seed, id) < s.pct {
+		return ""
+	}
+	return "Skipped by " + SubsetPctEnvVar
+}
+
+// isChanged reports whether the subtest belongs to a changed test dir. For an
+// invariant dir re-enabled by a specific config change, only the matching variants
+// count as changed.
+func (s subsetSelector) isChanged(dir string, envset []string) bool {
+	filters, ok := s.changed[dir]
+	if !ok {
+		return false
+	}
+	if filters == nil {
+		return true
+	}
+	return selection.MatchesFilters(envset, filters)
+}
+
+// hashPercent maps (seed, id) deterministically to 0..99. A subtest runs when this is
+// below the percentage, so pct=100 runs everything and pct=0 runs nothing.
+func hashPercent(seed, id string) int {
+	h := fnv.New64a()
+	h.Write([]byte(seed))
+	h.Write([]byte{0})
+	h.Write([]byte(id))
+	return int(h.Sum64() % 100)
+}
diff --git a/acceptance/subset_unit_test.go b/acceptance/subset_unit_test.go
new file mode 100644
index 00000000000..3bec8555e61
--- /dev/null
+++ b/acceptance/subset_unit_test.go
@@ -0,0 +1,120 @@
+package acceptance_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestSubsetDisabled(t *testing.T) {
+	var s subsetSelector
+	assert.Empty(t, s.skipReason("bundle/foo", nil))
+	assert.Empty(t, s.skipReason("bundle/foo", []string{"DMS=true"}))
+}
+
+func TestSubsetPctBoundaries(t *testing.T) {
+	all := subsetSelector{enabled: true, pct: 100, seed: "seed"}
+	none := subsetSelector{enabled: true, pct: 0, seed: "seed"}
+
+	for _, dir := range []string{"bundle/a", "bundle/b", "cmd/c"} {
+		assert.Empty(t, all.skipReason(dir, nil), "pct=100 must run everything")
+		assert.NotEmpty(t, none.skipReason(dir, nil), "pct=0 must skip everything")
+	}
+}
+
+func TestSubsetChangedAlwaysRuns(t *testing.T) {
+	// pct=0 would skip everything, but a changed dir is always kept.
+	s := subsetSelector{
+		enabled: true,
+		pct:     0,
+		seed:    "seed",
+		changed: map[string][]string{"bundle/changed": nil},
+	}
+	assert.Empty(t, s.skipReason("bundle/changed", []string{"DMS=true"}))
+	assert.NotEmpty(t, s.skipReason("bundle/other", nil))
+}
+
+func TestSubsetChangedVariantFilter(t *testing.T) {
+	// A changed dir restricted to a specific config only keeps matching variants.
+	s := subsetSelector{
+		enabled: true,
+		pct:     0,
+		seed:    "seed",
+		changed: map[string][]string{"bundle/invariant/x": {"INPUT_CONFIG=job.yml.tmpl"}},
+	}
+	assert.Empty(t, s.skipReason("bundle/invariant/x", []string{"INPUT_CONFIG=job.yml.tmpl"}))
+	assert.NotEmpty(t, s.skipReason("bundle/invariant/x", []string{"INPUT_CONFIG=pipeline.yml.tmpl"}))
+}
+
+func TestSubsetChangedVariantFilterAlternatives(t *testing.T) {
+	// Filters naming the same key are alternatives, so the variants of both configs are
+	// kept rather than neither.
+	s := subsetSelector{
+		enabled: true,
+		pct:     0,
+		seed:    "seed",
+		changed: map[string][]string{"bundle/invariant/x": {"INPUT_CONFIG=job.yml.tmpl", "INPUT_CONFIG=pipeline.yml.tmpl"}},
+	}
+	assert.Empty(t, s.skipReason("bundle/invariant/x", []string{"INPUT_CONFIG=job.yml.tmpl"}))
+	assert.Empty(t, s.skipReason("bundle/invariant/x", []string{"INPUT_CONFIG=pipeline.yml.tmpl"}))
+	assert.NotEmpty(t, s.skipReason("bundle/invariant/x", []string{"INPUT_CONFIG=other.yml.tmpl"}))
+}
+
+func TestSubsetSeedDeterministic(t *testing.T) {
+	// Same seed selects the same subset; the decision does not depend on ordering.
+	a := subsetSelector{enabled: true, pct: 50, seed: "abc"}
+	b := subsetSelector{enabled: true, pct: 50, seed: "abc"}
+	for _, dir := range []string{"bundle/a", "bundle/b", "bundle/c", "bundle/d"} {
+		assert.Equal(t, a.skipReason(dir, nil), b.skipReason(dir, nil))
+	}
+}
+
+func TestSubsetSeedChangesSelection(t *testing.T) {
+	// Different seeds should produce different selections across a set of dirs.
+	var dirs []string
+	for i := range 100 {
+		dirs = append(dirs, "bundle/dir"+string(rune('a'+i%26))+string(rune('0'+i/26)))
+	}
+	s1 := subsetSelector{enabled: true, pct: 50, seed: "seed-1"}
+	s2 := subsetSelector{enabled: true, pct: 50, seed: "seed-2"}
+	diff := 0
+	for _, dir := range dirs {
+		if (s1.skipReason(dir, nil) == "") != (s2.skipReason(dir, nil) == "") {
+			diff++
+		}
+	}
+	assert.NotZero(t, diff, "different seeds should select different subsets")
+}
+
+func TestSubsetVariantsIndependent(t *testing.T) {
+	// Two variants of one dir are decided independently: at least one differs from the
+	// other across a spread of dirs (they are not forced to the same outcome).
+	s := subsetSelector{enabled: true, pct: 50, seed: "seed"}
+	sawDifferent := false
+	for i := range 50 {
+		dir := "bundle/d" + string(rune('a'+i%26))
+		a := s.skipReason(dir, []string{"DMS=true"}) == ""
+		b := s.skipReason(dir, []string{"DMS="}) == ""
+		if a != b {
+			sawDifferent = true
+			break
+		}
+	}
+	assert.True(t, sawDifferent, "variants of the same dir should be decided independently")
+}
+
+func TestSubsetApproximatesPct(t *testing.T) {
+	// Over many subtests the selected fraction should be close to pct.
+	s := subsetSelector{enabled: true, pct: 30, seed: "seed"}
+	run := 0
+	total := 1000
+	for i := range total {
+		id := "bundle/pkg" + string(rune('a'+i%26)) + "/case" + string(rune('0'+i/26%10))
+		if s.skipReason(id, []string{"V=" + string(rune('a'+i%7))}) == "" {
+			run++
+		}
+	}
+	// Allow a generous margin; this guards against gross bias, not exact proportion.
+	assert.Greater(t, run, 200)
+	assert.Less(t, run, 400)
+}
diff --git a/acceptance/telemetry/failure/out.requests.txt b/acceptance/telemetry/failure/out.requests.txt
deleted file mode 100644
index 808b5e97243..00000000000
--- a/acceptance/telemetry/failure/out.requests.txt
+++ /dev/null
@@ -1,64 +0,0 @@
-{
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "headers": {
-    "Authorization": [
-      "Bearer [DATABRICKS_TOKEN]"
-    ],
-    "X-Databricks-Org-Id": [
-      "[NUMID]"
-    ]
-  },
-  "method": "POST",
-  "path": "/telemetry-ext",
-  "body": {
-    "uploadTime": [UNIX_TIME_MILLIS][0],
-    "items": [],
-    "protoLogs": [
-      "{\"frontend_log_event_id\":\"[UUID]\",\"entry\":{\"databricks_cli_log\":{\"execution_context\":{\"cmd_exec_id\":\"[UUID]\",\"version\":\"[DEV_VERSION]\",\"command\":\"selftest_send-telemetry\",\"operating_system\":\"[OS]\",\"execution_time_ms\":\"SMALL_INT\",\"exit_code\":0},\"cli_test_event\":{\"name\":\"VALUE1\"}}}}",
-      "{\"frontend_log_event_id\":\"[UUID]\",\"entry\":{\"databricks_cli_log\":{\"execution_context\":{\"cmd_exec_id\":\"[UUID]\",\"version\":\"[DEV_VERSION]\",\"command\":\"selftest_send-telemetry\",\"operating_system\":\"[OS]\",\"execution_time_ms\":\"SMALL_INT\",\"exit_code\":0},\"cli_test_event\":{\"name\":\"VALUE2\"}}}}"
-    ]
-  }
-}
-{
-  "headers": {
-    "Authorization": [
-      "Bearer [DATABRICKS_TOKEN]"
-    ],
-    "X-Databricks-Org-Id": [
-      "[NUMID]"
-    ]
-  },
-  "method": "POST",
-  "path": "/telemetry-ext",
-  "body": {
-    "uploadTime": [UNIX_TIME_MILLIS][1],
-    "items": [],
-    "protoLogs": [
-      "{\"frontend_log_event_id\":\"[UUID]\",\"entry\":{\"databricks_cli_log\":{\"execution_context\":{\"cmd_exec_id\":\"[UUID]\",\"version\":\"[DEV_VERSION]\",\"command\":\"selftest_send-telemetry\",\"operating_system\":\"[OS]\",\"execution_time_ms\":\"SMALL_INT\",\"exit_code\":0},\"cli_test_event\":{\"name\":\"VALUE1\"}}}}",
-      "{\"frontend_log_event_id\":\"[UUID]\",\"entry\":{\"databricks_cli_log\":{\"execution_context\":{\"cmd_exec_id\":\"[UUID]\",\"version\":\"[DEV_VERSION]\",\"command\":\"selftest_send-telemetry\",\"operating_system\":\"[OS]\",\"execution_time_ms\":\"SMALL_INT\",\"exit_code\":0},\"cli_test_event\":{\"name\":\"VALUE2\"}}}}"
-    ]
-  }
-}
-{
-  "headers": {
-    "Authorization": [
-      "Bearer [DATABRICKS_TOKEN]"
-    ],
-    "X-Databricks-Org-Id": [
-      "[NUMID]"
-    ]
-  },
-  "method": "POST",
-  "path": "/telemetry-ext",
-  "body": {
-    "uploadTime": [UNIX_TIME_MILLIS][2],
-    "items": [],
-    "protoLogs": [
-      "{\"frontend_log_event_id\":\"[UUID]\",\"entry\":{\"databricks_cli_log\":{\"execution_context\":{\"cmd_exec_id\":\"[UUID]\",\"version\":\"[DEV_VERSION]\",\"command\":\"selftest_send-telemetry\",\"operating_system\":\"[OS]\",\"execution_time_ms\":\"SMALL_INT\",\"exit_code\":0},\"cli_test_event\":{\"name\":\"VALUE1\"}}}}",
-      "{\"frontend_log_event_id\":\"[UUID]\",\"entry\":{\"databricks_cli_log\":{\"execution_context\":{\"cmd_exec_id\":\"[UUID]\",\"version\":\"[DEV_VERSION]\",\"command\":\"selftest_send-telemetry\",\"operating_system\":\"[OS]\",\"execution_time_ms\":\"SMALL_INT\",\"exit_code\":0},\"cli_test_event\":{\"name\":\"VALUE2\"}}}}"
-    ]
-  }
-}
diff --git a/acceptance/telemetry/failure/out.test.toml b/acceptance/telemetry/failure/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/telemetry/failure/out.test.toml
+++ b/acceptance/telemetry/failure/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/telemetry/failure/output.txt b/acceptance/telemetry/failure/output.txt
index 2086a88444a..a4a56f92e22 100644
--- a/acceptance/telemetry/failure/output.txt
+++ b/acceptance/telemetry/failure/output.txt
@@ -1,16 +1,16 @@
 
 >>> [CLI] selftest send-telemetry --debug
-HH:MM:SS Info: start pid=PID version=[DEV_VERSION] args="[CLI], selftest, send-telemetry, --debug"
+HH:MM:SS Info: start pid=PID version=[CLI_VERSION] args="[CLI], selftest, send-telemetry, --debug"
 HH:MM:SS Debug: [Local Cache] using cache key: [SHA256_HASH] pid=PID
 HH:MM:SS Debug: [Local Cache] cache miss, computing pid=PID
 HH:MM:SS Debug: GET /.well-known/databricks-config
 < HTTP/1.1 200 OK
 < {
 <   "oidc_endpoint": "[DATABRICKS_URL]/oidc",
-<   "workspace_id": "[NUMID]"
+<   "workspace_id": "[WORKSPACE_ID]"
 < } pid=PID sdk=true
 HH:MM:SS Debug: [Local Cache] computed and stored result pid=PID
-HH:MM:SS Debug: Resolved workspace_id from host metadata: "[NUMID]" pid=PID sdk=true
+HH:MM:SS Debug: Resolved workspace_id from host metadata: "[WORKSPACE_ID]" pid=PID sdk=true
 HH:MM:SS Debug: Resolved cloud from hostname: "AWS" pid=PID sdk=true
 HH:MM:SS Debug: Resolved discovery_url from host metadata: "[DATABRICKS_URL]/oidc/.well-known/oauth-authorization-server" pid=PID sdk=true
 HH:MM:SS Info: completed execution pid=PID exit_code=0
@@ -64,14 +64,14 @@ HH:MM:SS Debug: non-retriable error: Endpoint not implemented. pid=PID sdk=true
 HH:MM:SS Info: Attempt 3 failed due to a server side error. Retrying status code: 501 pid=PID
 HH:MM:SS Info: telemetry upload failed: failed to upload telemetry logs after three attempts pid=PID
 
->>> cat out.requests.txt
+>>> cat [OUTPUT_DIR]/out.requests.txt
 {
   "frontend_log_event_id": "[UUID]",
   "entry": {
     "databricks_cli_log": {
       "execution_context": {
         "cmd_exec_id": "[UUID]",
-        "version": "[DEV_VERSION]",
+        "version": "[CLI_VERSION]",
         "command": "selftest_send-telemetry",
         "operating_system": "[OS]",
         "execution_time_ms": SMALL_INT,
@@ -89,7 +89,7 @@ HH:MM:SS Info: telemetry upload failed: failed to upload telemetry logs after th
     "databricks_cli_log": {
       "execution_context": {
         "cmd_exec_id": "[UUID]",
-        "version": "[DEV_VERSION]",
+        "version": "[CLI_VERSION]",
         "command": "selftest_send-telemetry",
         "operating_system": "[OS]",
         "execution_time_ms": SMALL_INT,
@@ -107,7 +107,7 @@ HH:MM:SS Info: telemetry upload failed: failed to upload telemetry logs after th
     "databricks_cli_log": {
       "execution_context": {
         "cmd_exec_id": "[UUID]",
-        "version": "[DEV_VERSION]",
+        "version": "[CLI_VERSION]",
         "command": "selftest_send-telemetry",
         "operating_system": "[OS]",
         "execution_time_ms": SMALL_INT,
@@ -125,7 +125,7 @@ HH:MM:SS Info: telemetry upload failed: failed to upload telemetry logs after th
     "databricks_cli_log": {
       "execution_context": {
         "cmd_exec_id": "[UUID]",
-        "version": "[DEV_VERSION]",
+        "version": "[CLI_VERSION]",
         "command": "selftest_send-telemetry",
         "operating_system": "[OS]",
         "execution_time_ms": SMALL_INT,
@@ -143,7 +143,7 @@ HH:MM:SS Info: telemetry upload failed: failed to upload telemetry logs after th
     "databricks_cli_log": {
       "execution_context": {
         "cmd_exec_id": "[UUID]",
-        "version": "[DEV_VERSION]",
+        "version": "[CLI_VERSION]",
         "command": "selftest_send-telemetry",
         "operating_system": "[OS]",
         "execution_time_ms": SMALL_INT,
@@ -161,7 +161,7 @@ HH:MM:SS Info: telemetry upload failed: failed to upload telemetry logs after th
     "databricks_cli_log": {
       "execution_context": {
         "cmd_exec_id": "[UUID]",
-        "version": "[DEV_VERSION]",
+        "version": "[CLI_VERSION]",
         "command": "selftest_send-telemetry",
         "operating_system": "[OS]",
         "execution_time_ms": SMALL_INT,
diff --git a/acceptance/telemetry/failure/script b/acceptance/telemetry/failure/script
index 7dbe9a0900b..9439e9ae3b5 100644
--- a/acceptance/telemetry/failure/script
+++ b/acceptance/telemetry/failure/script
@@ -1,4 +1,4 @@
 trace $CLI selftest send-telemetry --debug
 
 # pretty print the telemetry payload.
-trace cat out.requests.txt | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson'
+trace cat "$OUT_REQUESTS" | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson'
diff --git a/acceptance/telemetry/partial-success/out.requests.txt b/acceptance/telemetry/partial-success/out.requests.txt
deleted file mode 100644
index 808b5e97243..00000000000
--- a/acceptance/telemetry/partial-success/out.requests.txt
+++ /dev/null
@@ -1,64 +0,0 @@
-{
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "headers": {
-    "Authorization": [
-      "Bearer [DATABRICKS_TOKEN]"
-    ],
-    "X-Databricks-Org-Id": [
-      "[NUMID]"
-    ]
-  },
-  "method": "POST",
-  "path": "/telemetry-ext",
-  "body": {
-    "uploadTime": [UNIX_TIME_MILLIS][0],
-    "items": [],
-    "protoLogs": [
-      "{\"frontend_log_event_id\":\"[UUID]\",\"entry\":{\"databricks_cli_log\":{\"execution_context\":{\"cmd_exec_id\":\"[UUID]\",\"version\":\"[DEV_VERSION]\",\"command\":\"selftest_send-telemetry\",\"operating_system\":\"[OS]\",\"execution_time_ms\":\"SMALL_INT\",\"exit_code\":0},\"cli_test_event\":{\"name\":\"VALUE1\"}}}}",
-      "{\"frontend_log_event_id\":\"[UUID]\",\"entry\":{\"databricks_cli_log\":{\"execution_context\":{\"cmd_exec_id\":\"[UUID]\",\"version\":\"[DEV_VERSION]\",\"command\":\"selftest_send-telemetry\",\"operating_system\":\"[OS]\",\"execution_time_ms\":\"SMALL_INT\",\"exit_code\":0},\"cli_test_event\":{\"name\":\"VALUE2\"}}}}"
-    ]
-  }
-}
-{
-  "headers": {
-    "Authorization": [
-      "Bearer [DATABRICKS_TOKEN]"
-    ],
-    "X-Databricks-Org-Id": [
-      "[NUMID]"
-    ]
-  },
-  "method": "POST",
-  "path": "/telemetry-ext",
-  "body": {
-    "uploadTime": [UNIX_TIME_MILLIS][1],
-    "items": [],
-    "protoLogs": [
-      "{\"frontend_log_event_id\":\"[UUID]\",\"entry\":{\"databricks_cli_log\":{\"execution_context\":{\"cmd_exec_id\":\"[UUID]\",\"version\":\"[DEV_VERSION]\",\"command\":\"selftest_send-telemetry\",\"operating_system\":\"[OS]\",\"execution_time_ms\":\"SMALL_INT\",\"exit_code\":0},\"cli_test_event\":{\"name\":\"VALUE1\"}}}}",
-      "{\"frontend_log_event_id\":\"[UUID]\",\"entry\":{\"databricks_cli_log\":{\"execution_context\":{\"cmd_exec_id\":\"[UUID]\",\"version\":\"[DEV_VERSION]\",\"command\":\"selftest_send-telemetry\",\"operating_system\":\"[OS]\",\"execution_time_ms\":\"SMALL_INT\",\"exit_code\":0},\"cli_test_event\":{\"name\":\"VALUE2\"}}}}"
-    ]
-  }
-}
-{
-  "headers": {
-    "Authorization": [
-      "Bearer [DATABRICKS_TOKEN]"
-    ],
-    "X-Databricks-Org-Id": [
-      "[NUMID]"
-    ]
-  },
-  "method": "POST",
-  "path": "/telemetry-ext",
-  "body": {
-    "uploadTime": [UNIX_TIME_MILLIS][2],
-    "items": [],
-    "protoLogs": [
-      "{\"frontend_log_event_id\":\"[UUID]\",\"entry\":{\"databricks_cli_log\":{\"execution_context\":{\"cmd_exec_id\":\"[UUID]\",\"version\":\"[DEV_VERSION]\",\"command\":\"selftest_send-telemetry\",\"operating_system\":\"[OS]\",\"execution_time_ms\":\"SMALL_INT\",\"exit_code\":0},\"cli_test_event\":{\"name\":\"VALUE1\"}}}}",
-      "{\"frontend_log_event_id\":\"[UUID]\",\"entry\":{\"databricks_cli_log\":{\"execution_context\":{\"cmd_exec_id\":\"[UUID]\",\"version\":\"[DEV_VERSION]\",\"command\":\"selftest_send-telemetry\",\"operating_system\":\"[OS]\",\"execution_time_ms\":\"SMALL_INT\",\"exit_code\":0},\"cli_test_event\":{\"name\":\"VALUE2\"}}}}"
-    ]
-  }
-}
diff --git a/acceptance/telemetry/partial-success/out.test.toml b/acceptance/telemetry/partial-success/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/telemetry/partial-success/out.test.toml
+++ b/acceptance/telemetry/partial-success/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/telemetry/partial-success/output.txt b/acceptance/telemetry/partial-success/output.txt
index c641e6bc0d0..cfcda42e67d 100644
--- a/acceptance/telemetry/partial-success/output.txt
+++ b/acceptance/telemetry/partial-success/output.txt
@@ -1,16 +1,16 @@
 
 >>> [CLI] selftest send-telemetry --debug
-HH:MM:SS Info: start pid=PID version=[DEV_VERSION] args="[CLI], selftest, send-telemetry, --debug"
+HH:MM:SS Info: start pid=PID version=[CLI_VERSION] args="[CLI], selftest, send-telemetry, --debug"
 HH:MM:SS Debug: [Local Cache] using cache key: [SHA256_HASH] pid=PID
 HH:MM:SS Debug: [Local Cache] cache miss, computing pid=PID
 HH:MM:SS Debug: GET /.well-known/databricks-config
 < HTTP/1.1 200 OK
 < {
 <   "oidc_endpoint": "[DATABRICKS_URL]/oidc",
-<   "workspace_id": "[NUMID]"
+<   "workspace_id": "[WORKSPACE_ID]"
 < } pid=PID sdk=true
 HH:MM:SS Debug: [Local Cache] computed and stored result pid=PID
-HH:MM:SS Debug: Resolved workspace_id from host metadata: "[NUMID]" pid=PID sdk=true
+HH:MM:SS Debug: Resolved workspace_id from host metadata: "[WORKSPACE_ID]" pid=PID sdk=true
 HH:MM:SS Debug: Resolved cloud from hostname: "AWS" pid=PID sdk=true
 HH:MM:SS Debug: Resolved discovery_url from host metadata: "[DATABRICKS_URL]/oidc/.well-known/oauth-authorization-server" pid=PID sdk=true
 HH:MM:SS Info: completed execution pid=PID exit_code=0
@@ -61,14 +61,14 @@ HH:MM:SS Debug: POST /telemetry-ext
 HH:MM:SS Debug: Attempt 3 was a partial success. Number of logs uploaded: 1 out of 2 pid=PID
 HH:MM:SS Info: telemetry upload failed: failed to upload telemetry logs after three attempts pid=PID
 
->>> cat out.requests.txt
+>>> cat [OUTPUT_DIR]/out.requests.txt
 {
   "frontend_log_event_id": "[UUID]",
   "entry": {
     "databricks_cli_log": {
       "execution_context": {
         "cmd_exec_id": "[UUID]",
-        "version": "[DEV_VERSION]",
+        "version": "[CLI_VERSION]",
         "command": "selftest_send-telemetry",
         "operating_system": "[OS]",
         "execution_time_ms": SMALL_INT,
@@ -86,7 +86,7 @@ HH:MM:SS Info: telemetry upload failed: failed to upload telemetry logs after th
     "databricks_cli_log": {
       "execution_context": {
         "cmd_exec_id": "[UUID]",
-        "version": "[DEV_VERSION]",
+        "version": "[CLI_VERSION]",
         "command": "selftest_send-telemetry",
         "operating_system": "[OS]",
         "execution_time_ms": SMALL_INT,
@@ -104,7 +104,7 @@ HH:MM:SS Info: telemetry upload failed: failed to upload telemetry logs after th
     "databricks_cli_log": {
       "execution_context": {
         "cmd_exec_id": "[UUID]",
-        "version": "[DEV_VERSION]",
+        "version": "[CLI_VERSION]",
         "command": "selftest_send-telemetry",
         "operating_system": "[OS]",
         "execution_time_ms": SMALL_INT,
@@ -122,7 +122,7 @@ HH:MM:SS Info: telemetry upload failed: failed to upload telemetry logs after th
     "databricks_cli_log": {
       "execution_context": {
         "cmd_exec_id": "[UUID]",
-        "version": "[DEV_VERSION]",
+        "version": "[CLI_VERSION]",
         "command": "selftest_send-telemetry",
         "operating_system": "[OS]",
         "execution_time_ms": SMALL_INT,
@@ -140,7 +140,7 @@ HH:MM:SS Info: telemetry upload failed: failed to upload telemetry logs after th
     "databricks_cli_log": {
       "execution_context": {
         "cmd_exec_id": "[UUID]",
-        "version": "[DEV_VERSION]",
+        "version": "[CLI_VERSION]",
         "command": "selftest_send-telemetry",
         "operating_system": "[OS]",
         "execution_time_ms": SMALL_INT,
@@ -158,7 +158,7 @@ HH:MM:SS Info: telemetry upload failed: failed to upload telemetry logs after th
     "databricks_cli_log": {
       "execution_context": {
         "cmd_exec_id": "[UUID]",
-        "version": "[DEV_VERSION]",
+        "version": "[CLI_VERSION]",
         "command": "selftest_send-telemetry",
         "operating_system": "[OS]",
         "execution_time_ms": SMALL_INT,
diff --git a/acceptance/telemetry/partial-success/script b/acceptance/telemetry/partial-success/script
index 7dbe9a0900b..9439e9ae3b5 100644
--- a/acceptance/telemetry/partial-success/script
+++ b/acceptance/telemetry/partial-success/script
@@ -1,4 +1,4 @@
 trace $CLI selftest send-telemetry --debug
 
 # pretty print the telemetry payload.
-trace cat out.requests.txt | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson'
+trace cat "$OUT_REQUESTS" | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson'
diff --git a/acceptance/telemetry/skipped/out.requests.txt b/acceptance/telemetry/skipped/out.requests.txt
deleted file mode 100644
index 40bd283a0c3..00000000000
--- a/acceptance/telemetry/skipped/out.requests.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-{
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
diff --git a/acceptance/telemetry/skipped/out.test.toml b/acceptance/telemetry/skipped/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/telemetry/skipped/out.test.toml
+++ b/acceptance/telemetry/skipped/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/telemetry/skipped/output.txt b/acceptance/telemetry/skipped/output.txt
index 9e784a8eb0b..85a1de2dbdf 100644
--- a/acceptance/telemetry/skipped/output.txt
+++ b/acceptance/telemetry/skipped/output.txt
@@ -1,17 +1,23 @@
 
 >>> [CLI] selftest send-telemetry --debug
-HH:MM:SS Info: start pid=PID version=[DEV_VERSION] args="[CLI], selftest, send-telemetry, --debug"
+HH:MM:SS Info: start pid=PID version=[CLI_VERSION] args="[CLI], selftest, send-telemetry, --debug"
 HH:MM:SS Debug: [Local Cache] using cache key: [SHA256_HASH] pid=PID
 HH:MM:SS Debug: [Local Cache] cache miss, computing pid=PID
 HH:MM:SS Debug: GET /.well-known/databricks-config
 < HTTP/1.1 200 OK
 < {
 <   "oidc_endpoint": "[DATABRICKS_URL]/oidc",
-<   "workspace_id": "[NUMID]"
+<   "workspace_id": "[WORKSPACE_ID]"
 < } pid=PID sdk=true
 HH:MM:SS Debug: [Local Cache] computed and stored result pid=PID
-HH:MM:SS Debug: Resolved workspace_id from host metadata: "[NUMID]" pid=PID sdk=true
+HH:MM:SS Debug: Resolved workspace_id from host metadata: "[WORKSPACE_ID]" pid=PID sdk=true
 HH:MM:SS Debug: Resolved cloud from hostname: "AWS" pid=PID sdk=true
 HH:MM:SS Debug: Resolved discovery_url from host metadata: "[DATABRICKS_URL]/oidc/.well-known/oauth-authorization-server" pid=PID sdk=true
 HH:MM:SS Info: completed execution pid=PID exit_code=0
 HH:MM:SS Debug: telemetry upload is disabled. Not uploading any logs. pid=PID
+
+>>> print_requests.py --get //
+{
+  "method": "GET",
+  "path": "/.well-known/databricks-config"
+}
diff --git a/acceptance/telemetry/skipped/script b/acceptance/telemetry/skipped/script
index 247171a6f15..75ada980d20 100644
--- a/acceptance/telemetry/skipped/script
+++ b/acceptance/telemetry/skipped/script
@@ -1,3 +1,5 @@
 export DATABRICKS_CLI_DISABLE_TELEMETRY="true"
 
 trace $CLI selftest send-telemetry --debug
+
+trace print_requests.py --get //
diff --git a/acceptance/telemetry/success/out.requests.txt b/acceptance/telemetry/success/out.requests.txt
deleted file mode 100644
index f73cd0a891e..00000000000
--- a/acceptance/telemetry/success/out.requests.txt
+++ /dev/null
@@ -1,32 +0,0 @@
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]"
-    ]
-  },
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "headers": {
-    "Authorization": [
-      "Bearer [DATABRICKS_TOKEN]"
-    ],
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/selftest_send-telemetry cmd-exec-id/[CMD-EXEC-ID] interactive/none auth/pat"
-    ],
-    "X-Databricks-Org-Id": [
-      "[NUMID]"
-    ]
-  },
-  "method": "POST",
-  "path": "/telemetry-ext",
-  "body": {
-    "uploadTime": [UNIX_TIME_MILLIS],
-    "items": [],
-    "protoLogs": [
-      "{\"frontend_log_event_id\":\"[UUID]\",\"entry\":{\"databricks_cli_log\":{\"execution_context\":{\"cmd_exec_id\":\"[CMD-EXEC-ID]\",\"version\":\"[DEV_VERSION]\",\"command\":\"selftest_send-telemetry\",\"operating_system\":\"[OS]\",\"execution_time_ms\":\"SMALL_INT\",\"exit_code\":0},\"cli_test_event\":{\"name\":\"VALUE1\"}}}}",
-      "{\"frontend_log_event_id\":\"[UUID]\",\"entry\":{\"databricks_cli_log\":{\"execution_context\":{\"cmd_exec_id\":\"[CMD-EXEC-ID]\",\"version\":\"[DEV_VERSION]\",\"command\":\"selftest_send-telemetry\",\"operating_system\":\"[OS]\",\"execution_time_ms\":\"SMALL_INT\",\"exit_code\":0},\"cli_test_event\":{\"name\":\"VALUE2\"}}}}"
-    ]
-  }
-}
diff --git a/acceptance/telemetry/success/out.test.toml b/acceptance/telemetry/success/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/telemetry/success/out.test.toml
+++ b/acceptance/telemetry/success/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/telemetry/success/output.txt b/acceptance/telemetry/success/output.txt
index 96f72c97270..67a3874fe77 100644
--- a/acceptance/telemetry/success/output.txt
+++ b/acceptance/telemetry/success/output.txt
@@ -1,16 +1,16 @@
 
 >>> [CLI] selftest send-telemetry --debug
-HH:MM:SS Info: start pid=PID version=[DEV_VERSION] args="[CLI], selftest, send-telemetry, --debug"
+HH:MM:SS Info: start pid=PID version=[CLI_VERSION] args="[CLI], selftest, send-telemetry, --debug"
 HH:MM:SS Debug: [Local Cache] using cache key: [SHA256_HASH] pid=PID
 HH:MM:SS Debug: [Local Cache] cache miss, computing pid=PID
 HH:MM:SS Debug: GET /.well-known/databricks-config
 < HTTP/1.1 200 OK
 < {
 <   "oidc_endpoint": "[DATABRICKS_URL]/oidc",
-<   "workspace_id": "[NUMID]"
+<   "workspace_id": "[WORKSPACE_ID]"
 < } pid=PID sdk=true
 HH:MM:SS Debug: [Local Cache] computed and stored result pid=PID
-HH:MM:SS Debug: Resolved workspace_id from host metadata: "[NUMID]" pid=PID sdk=true
+HH:MM:SS Debug: Resolved workspace_id from host metadata: "[WORKSPACE_ID]" pid=PID sdk=true
 HH:MM:SS Debug: Resolved cloud from hostname: "AWS" pid=PID sdk=true
 HH:MM:SS Debug: Resolved discovery_url from host metadata: "[DATABRICKS_URL]/oidc/.well-known/oauth-authorization-server" pid=PID sdk=true
 HH:MM:SS Info: completed execution pid=PID exit_code=0
@@ -30,14 +30,14 @@ HH:MM:SS Debug: POST /telemetry-ext
 < } pid=PID sdk=true
 HH:MM:SS Debug: All 2 logs uploaded successfully pid=PID
 
->>> cat out.requests.txt
+>>> cat [OUTPUT_DIR]/out.requests.txt
 {
   "frontend_log_event_id": "[UUID]",
   "entry": {
     "databricks_cli_log": {
       "execution_context": {
         "cmd_exec_id": "[CMD-EXEC-ID]",
-        "version": "[DEV_VERSION]",
+        "version": "[CLI_VERSION]",
         "command": "selftest_send-telemetry",
         "operating_system": "[OS]",
         "execution_time_ms": SMALL_INT,
@@ -55,7 +55,7 @@ HH:MM:SS Debug: All 2 logs uploaded successfully pid=PID
     "databricks_cli_log": {
       "execution_context": {
         "cmd_exec_id": "[CMD-EXEC-ID]",
-        "version": "[DEV_VERSION]",
+        "version": "[CLI_VERSION]",
         "command": "selftest_send-telemetry",
         "operating_system": "[OS]",
         "execution_time_ms": SMALL_INT,
diff --git a/acceptance/telemetry/success/script b/acceptance/telemetry/success/script
index 9e924eec5fc..49e4f92ba20 100644
--- a/acceptance/telemetry/success/script
+++ b/acceptance/telemetry/success/script
@@ -1,8 +1,8 @@
 trace $CLI selftest send-telemetry --debug
 
-update_file.py out.requests.txt \
- $(cat out.requests.txt | jq '.headers."User-Agent".[0]'| grep -o 'cmd-exec-id/[^ ]*' | cut -d '/' -f2) \
+update_file.py "$OUT_REQUESTS" \
+ $(cat "$OUT_REQUESTS" | jq '.headers."User-Agent".[0]'| grep -o 'cmd-exec-id/[^ ]*' | cut -d '/' -f2) \
  '[CMD-EXEC-ID]'
 
 # pretty print the telemetry payload.
-trace cat out.requests.txt | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson'
+trace cat "$OUT_REQUESTS" | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson'
diff --git a/acceptance/telemetry/test.toml b/acceptance/telemetry/test.toml
index cce01f8ccd2..0b3a05238da 100644
--- a/acceptance/telemetry/test.toml
+++ b/acceptance/telemetry/test.toml
@@ -1,7 +1,6 @@
-IncludeRequestHeaders = ["Authorization", "X-Databricks-Org-Id"]
+IncludeRequestHeaders = ["Authorization", "X-Databricks-Workspace-Id"]
 RecordRequests = true
 
-Local = true
 Cloud = false
 
 [[Repls]]
@@ -39,8 +38,6 @@ New = "(N more bytes)"
 
 # Host metadata cache keys vary per-test because the mock server URL changes.
 # Normalize them so the golden output is stable across runs.
-# Order=1 so it runs before the parent's `\d{14,}` → `[NUMID]` replacement.
 [[Repls]]
 Old = '[a-f0-9]{64}'
 New = "[SHA256_HASH]"
-Order = 1
diff --git a/acceptance/telemetry/timeout/out.requests.txt b/acceptance/telemetry/timeout/out.requests.txt
deleted file mode 100644
index 1241a933a9a..00000000000
--- a/acceptance/telemetry/timeout/out.requests.txt
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "headers": {
-    "Authorization": [
-      "Bearer [DATABRICKS_TOKEN]"
-    ],
-    "X-Databricks-Org-Id": [
-      "[NUMID]"
-    ]
-  },
-  "method": "POST",
-  "path": "/telemetry-ext",
-  "body": {
-    "uploadTime": [UNIX_TIME_MILLIS],
-    "items": [],
-    "protoLogs": [
-      "{\"frontend_log_event_id\":\"[UUID]\",\"entry\":{\"databricks_cli_log\":{\"execution_context\":{\"cmd_exec_id\":\"[UUID]\",\"version\":\"[DEV_VERSION]\",\"command\":\"selftest_send-telemetry\",\"operating_system\":\"[OS]\",\"execution_time_ms\":\"SMALL_INT\",\"exit_code\":0},\"cli_test_event\":{\"name\":\"VALUE1\"}}}}",
-      "{\"frontend_log_event_id\":\"[UUID]\",\"entry\":{\"databricks_cli_log\":{\"execution_context\":{\"cmd_exec_id\":\"[UUID]\",\"version\":\"[DEV_VERSION]\",\"command\":\"selftest_send-telemetry\",\"operating_system\":\"[OS]\",\"execution_time_ms\":\"SMALL_INT\",\"exit_code\":0},\"cli_test_event\":{\"name\":\"VALUE2\"}}}}"
-    ]
-  }
-}
diff --git a/acceptance/telemetry/timeout/out.test.toml b/acceptance/telemetry/timeout/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/telemetry/timeout/out.test.toml
+++ b/acceptance/telemetry/timeout/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/telemetry/timeout/output.txt b/acceptance/telemetry/timeout/output.txt
index 21f79ef7bed..550fe861652 100644
--- a/acceptance/telemetry/timeout/output.txt
+++ b/acceptance/telemetry/timeout/output.txt
@@ -1,16 +1,16 @@
 
 >>> [CLI] selftest send-telemetry --debug
-HH:MM:SS Info: start pid=PID version=[DEV_VERSION] args="[CLI], selftest, send-telemetry, --debug"
+HH:MM:SS Info: start pid=PID version=[CLI_VERSION] args="[CLI], selftest, send-telemetry, --debug"
 HH:MM:SS Debug: [Local Cache] using cache key: [SHA256_HASH] pid=PID
 HH:MM:SS Debug: [Local Cache] cache miss, computing pid=PID
 HH:MM:SS Debug: GET /.well-known/databricks-config
 < HTTP/1.1 200 OK
 < {
 <   "oidc_endpoint": "[DATABRICKS_URL]/oidc",
-<   "workspace_id": "[NUMID]"
+<   "workspace_id": "[WORKSPACE_ID]"
 < } pid=PID sdk=true
 HH:MM:SS Debug: [Local Cache] computed and stored result pid=PID
-HH:MM:SS Debug: Resolved workspace_id from host metadata: "[NUMID]" pid=PID sdk=true
+HH:MM:SS Debug: Resolved workspace_id from host metadata: "[WORKSPACE_ID]" pid=PID sdk=true
 HH:MM:SS Debug: Resolved cloud from hostname: "AWS" pid=PID sdk=true
 HH:MM:SS Debug: Resolved discovery_url from host metadata: "[DATABRICKS_URL]/oidc/.well-known/oauth-authorization-server" pid=PID sdk=true
 HH:MM:SS Info: completed execution pid=PID exit_code=0
@@ -28,14 +28,14 @@ HH:MM:SS Debug: non-retriable error: Post "[DATABRICKS_URL]/telemetry-ext": cont
 HH:MM:SS Debug: Attempt 1 failed due to a timeout. Will not retry pid=PID
 HH:MM:SS Info: telemetry upload failed: uploading telemetry logs timed out: Post "[DATABRICKS_URL]/telemetry-ext": context deadline exceeded pid=PID
 
->>> cat out.requests.txt
+>>> cat [OUTPUT_DIR]/out.requests.txt
 {
   "frontend_log_event_id": "[UUID]",
   "entry": {
     "databricks_cli_log": {
       "execution_context": {
         "cmd_exec_id": "[UUID]",
-        "version": "[DEV_VERSION]",
+        "version": "[CLI_VERSION]",
         "command": "selftest_send-telemetry",
         "operating_system": "[OS]",
         "execution_time_ms": SMALL_INT,
@@ -53,7 +53,7 @@ HH:MM:SS Info: telemetry upload failed: uploading telemetry logs timed out: Post
     "databricks_cli_log": {
       "execution_context": {
         "cmd_exec_id": "[UUID]",
-        "version": "[DEV_VERSION]",
+        "version": "[CLI_VERSION]",
         "command": "selftest_send-telemetry",
         "operating_system": "[OS]",
         "execution_time_ms": SMALL_INT,
diff --git a/acceptance/telemetry/timeout/script b/acceptance/telemetry/timeout/script
index 807bc51a9b6..f8336d77d47 100644
--- a/acceptance/telemetry/timeout/script
+++ b/acceptance/telemetry/timeout/script
@@ -4,4 +4,4 @@ export DATABRICKS_CLI_TELEMETRY_TIMEOUT=0.1
 trace $CLI selftest send-telemetry --debug
 
 # pretty print the telemetry payload.
-trace cat out.requests.txt | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson'
+trace cat "$OUT_REQUESTS" | jq 'select(has("path") and .path == "/telemetry-ext") | .body.protoLogs[] | fromjson'
diff --git a/acceptance/test.toml b/acceptance/test.toml
index a482f492603..714b05e5242 100644
--- a/acceptance/test.toml
+++ b/acceptance/test.toml
@@ -1,5 +1,7 @@
 # Default settings that apply to all tests unless overriden by test.toml files in inner directories.
-Local = true
+# Tests always run locally; set Cloud = true to also run on a real workspace.
+# Cloud = false (the inherited default) therefore means local only.
+# CloudSlow only narrows a Cloud = true run (skipped under -short); it does not enable cloud on its own.
 Cloud = false
 
 # default timeouts
@@ -17,18 +19,15 @@ Env.PYTHONDONTWRITEBYTECODE = "1"
 Env.PYTHONUNBUFFERED = "1"
 Env.PYTHONUTF8 = "1"
 
-# Clear agent env vars to prevent them from affecting test output
-Env.ANTIGRAVITY_AGENT = ""
-Env.CLAUDECODE = ""
-Env.CLINE_ACTIVE = ""
-Env.CODEX_CI = ""
-Env.CURSOR_AGENT = ""
-Env.GEMINI_CLI = ""
-Env.OPENCODE = ""
+# Retries are timing dependent, so their warnings would make output flaky.
+# Tests that inject errors deterministically and assert the warning set this to "".
+Env.DATABRICKS_BUNDLE_RETRY_DISABLE_WARNING = "1"
 
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
-EnvMatrixExclude.noplantf = ["DATABRICKS_BUNDLE_ENGINE=terraform", "READPLAN=1"]
-EnvRepl.DATABRICKS_BUNDLE_ENGINE = false
+# The direct engine reports resources as soon as each one is applied, and resources are
+# applied in parallel, so the order of these lines is not deterministic. Sort each run of
+# them before comparing, so tests pin which resources were applied, not the order.
+# A test that needs the raw order sets SortLinesOn.deploy_actions = false.
+SortLines.deploy_actions = '^(Created|Updated|Deleted|Recreated|Resized) \S+$'
 
 # >>> datetime.datetime.fromtimestamp(18000000000)
 # datetime.datetime(2027, 1, 15, 9, 0)
@@ -36,21 +35,11 @@ EnvRepl.DATABRICKS_BUNDLE_ENGINE = false
 # datetime.datetime(2030, 3, 17, 18, 46, 40)
 
 [[Repls]]
-Old = '\d{20,}'
-New = "[NUMID]"
-Order = 10
-
-[[Repls]]
-Old = '1[78]\d{17}'
+Old = '\b1[78]\d{17}\b'
 New = '[UNIX_TIME_NANOS]'
 Order = 10
 Distinct = true
 
-[[Repls]]
-Old = '\d{17,}'
-New = "[NUMID]"
-Order = 10
-
 #[[Repls]]
 # This makes certain integration tests flaky as experiment IDs overlap in range with this regex
 #Old = '1[78]\d{14}'
@@ -58,44 +47,47 @@ Order = 10
 #Order = 10
 
 [[Repls]]
-Old = '\d{14,}'
-New = "[NUMID]"
-Order = 10
-
-[[Repls]]
-Old = '1[78]\d{11}'
+Old = '\b1[78]\d{11}\b'
 New = '[UNIX_TIME_MILLIS]'
 Order = 10
 Distinct = true
 
 [[Repls]]
-Old = '\d{11,}'
-New = "[NUMID]"
-Order = 10
-
-[[Repls]]
-Old = '1[78]\d{8}'
+Old = '\b1[78]\d{8}\b'
 New = '[UNIX_TIME_S]'
 Order = 10
 
-[[Repls]]
-Old = '\d{8,}'
-New = "[NUMID]"
-Order = 10
-
 [[Repls]]
 # "2025-10-23T14:26:43.499488Z"
-Old = '2\d\d\d-\d\d-\d\d(T| )\d\d:\d\d:\d\d\.\d+(Z|\+\d\d:\d\d)?'
+Old = '2\d\d\d-\d\d-\d\d(T| )\d\d:\d\d:\d\d\.\d+(Z|[+-]\d\d:\d\d)?'
 New = "[TIMESTAMP]"
 Order = 9
 
 [[Repls]]
 # "2025-10-23T14:26:43"
 # "2025-10-23T14:26:43Z"
-Old = '2\d\d\d-\d\d-\d\d(T| )\d\d:\d\d:\d\dZ?'
+Old = '2\d\d\d-\d\d-\d\d(T| )\d\d:\d\d:\d\d(Z|[+-]\d\d:\d\d)?'
 New = "[TIMESTAMP]"
 Order = 9
 
 [[Repls]]
 Old = "deco-uc-prod-isolated-aws-us-east-1|metastore_azure_eastus2"
 New = "[METASTORE_NAME]"
+
+# Normalize plan_version so bumping it doesn't churn every recorded plan.
+[[Repls]]
+Old = '"plan_version": 2,'
+New = '"plan_version": [PLAN_VERSION],'
+
+[[Repls]]
+Old = 'json\.plan_version = 2;'
+New = 'json.plan_version = [PLAN_VERSION];'
+
+# The lineage hash (libs/shortid) is not masked: fixture lineages hash to stable values, and
+# tests with a freshly minted lineage register its hash with read_lineage.py.
+
+# Workspace TreeIDs can be short (for example, in LITE). Match the deployment path
+# rather than arbitrary numbers so version numbers and counts stay visible.
+[[Repls]]
+Old = '\bdeployments/[0-9]+\b'
+New = 'deployments/[DEPLOYMENT_ID]'
diff --git a/acceptance/unique_name_test.go b/acceptance/unique_name_test.go
new file mode 100644
index 00000000000..a385da33c8d
--- /dev/null
+++ b/acceptance/unique_name_test.go
@@ -0,0 +1,25 @@
+package acceptance_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestCIUniqueName(t *testing.T) {
+	// 26 lowercase base32 characters, like the generated unique name.
+	random := "osr5mzrrvzb73juixjoviti24y"
+
+	// Prefix prepended, same length as input, lowercase-alphanumeric.
+	assert.Equal(t, "ci15799017600xabcdosr5mzrr", ciUniqueName("ci15799017600xabcd", random))
+	assert.Equal(t, "ci1xabcdosr5mzrrvzb73juixj", ciUniqueName("ci1xabcd", random))
+
+	// Empty prefix (off cloud): unchanged.
+	assert.Equal(t, random, ciUniqueName("", random))
+
+	// An 11-digit run id plus the 4-char suffix leaves exactly the 8-char random minimum: prepended.
+	assert.Equal(t, "ci15799017600xabcdosr5mzrr", ciUniqueName("ci15799017600xabcd", random))
+
+	// A prefix too long to leave 8 random chars is a bug in newBundleNamePrefix, so it panics.
+	assert.Panics(t, func() { ciUniqueName("ci159990176001xabcd", random) })
+}
diff --git a/acceptance/workspace/jobs/create-error/out.requests.txt b/acceptance/workspace/jobs/create-error/out.requests.txt
deleted file mode 100644
index 9d7f5dde1ed..00000000000
--- a/acceptance/workspace/jobs/create-error/out.requests.txt
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "method": "POST",
-  "path": "/api/2.2/jobs/create",
-  "body": {
-    "name": "abc"
-  }
-}
diff --git a/acceptance/workspace/jobs/create-error/out.test.toml b/acceptance/workspace/jobs/create-error/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/workspace/jobs/create-error/out.test.toml
+++ b/acceptance/workspace/jobs/create-error/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/workspace/jobs/create-error/script b/acceptance/workspace/jobs/create-error/script
index 9ff7b5b87bf..00344560ed8 100644
--- a/acceptance/workspace/jobs/create-error/script
+++ b/acceptance/workspace/jobs/create-error/script
@@ -1 +1,3 @@
 trace $CLI jobs create --json '{"name":"abc"}'
+
+trace print_requests.py //jobs
diff --git a/acceptance/workspace/jobs/create/out.requests.txt b/acceptance/workspace/jobs/create/out.requests.txt
deleted file mode 100644
index 8cde6c5f5fc..00000000000
--- a/acceptance/workspace/jobs/create/out.requests.txt
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]"
-    ]
-  },
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "headers": {
-    "Authorization": [
-      "Bearer [DATABRICKS_TOKEN]"
-    ],
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/jobs_create cmd-exec-id/[UUID] interactive/none auth/pat"
-    ]
-  },
-  "method": "POST",
-  "path": "/api/2.2/jobs/create",
-  "body": {
-    "name": "abc"
-  }
-}
diff --git a/acceptance/workspace/jobs/create/out.test.toml b/acceptance/workspace/jobs/create/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/workspace/jobs/create/out.test.toml
+++ b/acceptance/workspace/jobs/create/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/workspace/jobs/create/output.txt b/acceptance/workspace/jobs/create/output.txt
index 7b006aa656e..df669116179 100644
--- a/acceptance/workspace/jobs/create/output.txt
+++ b/acceptance/workspace/jobs/create/output.txt
@@ -1,5 +1,22 @@
 
 >>> [CLI] jobs create --json {"name":"abc"}
 {
-  "job_id": [NUMID]
+  "job_id": [JOB_ID]
+}
+
+>>> print_requests.py //jobs
+{
+  "headers": {
+    "Authorization": [
+      "Bearer [DATABRICKS_TOKEN]"
+    ],
+    "User-Agent": [
+      "cli/[CLI_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS] cmd/jobs_create cmd-exec-id/[UUID] interactive/none auth/pat"
+    ]
+  },
+  "method": "POST",
+  "path": "/api/2.2/jobs/create",
+  "body": {
+    "name": "abc"
+  }
 }
diff --git a/acceptance/workspace/jobs/create/script b/acceptance/workspace/jobs/create/script
index 9ff7b5b87bf..9d579a353c5 100644
--- a/acceptance/workspace/jobs/create/script
+++ b/acceptance/workspace/jobs/create/script
@@ -1 +1,5 @@
-trace $CLI jobs create --json '{"name":"abc"}'
+trace $CLI jobs create --json '{"name":"abc"}' | tee job.json.tmp
+add_repl "$(sed -n 's/.*"job_id": \([0-9]*\).*/\1/p' job.json.tmp)" JOB_ID
+rm job.json.tmp
+
+trace print_requests.py //jobs
diff --git a/acceptance/workspace/lakeview/publish/out.requests.txt b/acceptance/workspace/lakeview/publish/out.requests.txt
deleted file mode 100644
index e4802babc67..00000000000
--- a/acceptance/workspace/lakeview/publish/out.requests.txt
+++ /dev/null
@@ -1,27 +0,0 @@
-{
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/Users/[USERNAME]"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/lakeview/dashboards",
-  "body": {
-    "display_name": "Test Dashboard",
-    "parent_path": "/Users/[USERNAME]",
-    "warehouse_id": "test-warehouse"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/lakeview/dashboards/[DASHBOARD_ID]/published",
-  "body": {
-    "embed_credentials": false
-  }
-}
diff --git a/acceptance/workspace/lakeview/publish/out.test.toml b/acceptance/workspace/lakeview/publish/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/workspace/lakeview/publish/out.test.toml
+++ b/acceptance/workspace/lakeview/publish/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/workspace/lakeview/publish/output.txt b/acceptance/workspace/lakeview/publish/output.txt
index 3a1ebfc8bdf..16d93882a98 100644
--- a/acceptance/workspace/lakeview/publish/output.txt
+++ b/acceptance/workspace/lakeview/publish/output.txt
@@ -10,3 +10,21 @@
   "revision_create_time": "[TIMESTAMP]",
   "warehouse_id": "test-warehouse"
 }
+
+>>> print_requests.py //lakeview
+{
+  "method": "POST",
+  "path": "/api/2.0/lakeview/dashboards",
+  "body": {
+    "display_name": "Test Dashboard",
+    "parent_path": "/Users/[USERNAME]",
+    "warehouse_id": "test-warehouse"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/lakeview/dashboards/[DASHBOARD_ID]/published",
+  "body": {
+    "embed_credentials": false
+  }
+}
diff --git a/acceptance/workspace/lakeview/publish/script b/acceptance/workspace/lakeview/publish/script
index 5bef1846f33..09e7cbafcc2 100644
--- a/acceptance/workspace/lakeview/publish/script
+++ b/acceptance/workspace/lakeview/publish/script
@@ -1,7 +1,9 @@
-trace $CLI workspace mkdirs /Users/tester@databricks.com
+MSYS_NO_PATHCONV=1 trace $CLI workspace mkdirs /Users/tester@databricks.com
 
-trace $CLI lakeview create --json '{"display_name": "Test Dashboard", "parent_path": "/Users/tester@databricks.com", "warehouse_id": "test-warehouse"}' -o json > tmp.json
+MSYS_NO_PATHCONV=1 trace $CLI lakeview create --json '{"display_name": "Test Dashboard", "parent_path": "/Users/tester@databricks.com", "warehouse_id": "test-warehouse"}' -o json > tmp.json
 dashboard_id=$(jq -r .dashboard_id < tmp.json)
 rm tmp.json
-echo "$dashboard_id:DASHBOARD_ID" >> ACC_REPLS
-trace $CLI lakeview publish $dashboard_id
+add_repl "$dashboard_id" DASHBOARD_ID
+MSYS_NO_PATHCONV=1 trace $CLI lakeview publish $dashboard_id
+
+trace print_requests.py //lakeview
diff --git a/acceptance/workspace/lakeview/publish/test.toml b/acceptance/workspace/lakeview/publish/test.toml
index 24fbd75ea78..159efe02696 100644
--- a/acceptance/workspace/lakeview/publish/test.toml
+++ b/acceptance/workspace/lakeview/publish/test.toml
@@ -1,4 +1 @@
 RecordRequests = true
-
-[Env]
-MSYS_NO_PATHCONV = "1"
diff --git a/acceptance/workspace/repos/create_with_provider/out.requests.txt b/acceptance/workspace/repos/create_with_provider/out.requests.txt
deleted file mode 100644
index 430eb33fe1b..00000000000
--- a/acceptance/workspace/repos/create_with_provider/out.requests.txt
+++ /dev/null
@@ -1,32 +0,0 @@
-{
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/repos",
-  "body": {
-    "path": "/Repos/me@databricks.com/test-repo",
-    "provider": "gitHub",
-    "url": "https://github.com/databricks/databricks-empty-ide-project.git"
-  }
-}
-{
-  "method": "GET",
-  "path": "/api/2.0/repos/[NUMID]"
-}
-{
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Repos/me@databricks.com/test-repo"
-  }
-}
-{
-  "method": "GET",
-  "path": "/api/2.0/repos/[NUMID]"
-}
-{
-  "method": "DELETE",
-  "path": "/api/2.0/repos/[NUMID]"
-}
diff --git a/acceptance/workspace/repos/create_with_provider/out.test.toml b/acceptance/workspace/repos/create_with_provider/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/workspace/repos/create_with_provider/out.test.toml
+++ b/acceptance/workspace/repos/create_with_provider/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/workspace/repos/create_with_provider/output.txt b/acceptance/workspace/repos/create_with_provider/output.txt
index df97be1fcee..07d9eac9623 100644
--- a/acceptance/workspace/repos/create_with_provider/output.txt
+++ b/acceptance/workspace/repos/create_with_provider/output.txt
@@ -2,10 +2,11 @@
 >>> [CLI] repos create https://github.com/databricks/databricks-empty-ide-project.git gitHub --path /Repos/me@databricks.com/test-repo
 
 === Get by id should work
->>> [CLI] repos get [NUMID] -o json
+>>> [CLI] repos get [REPO_ID] -o json
 {
   "branch": "main",
-  "id": [NUMID],
+  "head_commit_id": "0a1b2c3d4e5f6a7b8e7dadd73e50a69d8ba47d8f",
+  "id": [REPO_ID],
   "path": "/Repos/me@databricks.com/test-repo",
   "provider": "gitHub",
   "url": "https://github.com/databricks/databricks-empty-ide-project.git"
@@ -15,11 +16,42 @@
 >>> [CLI] repos get /Repos/me@databricks.com/test-repo -o json
 {
   "branch": "main",
-  "id": [NUMID],
+  "head_commit_id": "0a1b2c3d4e5f6a7b8e7dadd73e50a69d8ba47d8f",
+  "id": [REPO_ID],
   "path": "/Repos/me@databricks.com/test-repo",
   "provider": "gitHub",
   "url": "https://github.com/databricks/databricks-empty-ide-project.git"
 }
 
 === Delete by id should work
->>> [CLI] repos delete [NUMID]
+>>> [CLI] repos delete [REPO_ID]
+
+>>> print_requests.py --get //repos //workspace/get-status
+{
+  "method": "POST",
+  "path": "/api/2.0/repos",
+  "body": {
+    "path": "/Repos/me@databricks.com/test-repo",
+    "provider": "gitHub",
+    "url": "https://github.com/databricks/databricks-empty-ide-project.git"
+  }
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/repos/[REPO_ID]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/workspace/get-status",
+  "q": {
+    "path": "/Repos/me@databricks.com/test-repo"
+  }
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/repos/[REPO_ID]"
+}
+{
+  "method": "DELETE",
+  "path": "/api/2.0/repos/[REPO_ID]"
+}
diff --git a/acceptance/workspace/repos/create_with_provider/script b/acceptance/workspace/repos/create_with_provider/script
index 6cf4cf56b95..52de07f8921 100644
--- a/acceptance/workspace/repos/create_with_provider/script
+++ b/acceptance/workspace/repos/create_with_provider/script
@@ -2,13 +2,16 @@ url=https://github.com/databricks/databricks-empty-ide-project.git
 provider=gitHub
 path=/Repos/me@databricks.com/test-repo
 
-repo_id=$(trace $CLI repos create $url $provider --path $path | jq .id -r)
+repo_id=$(MSYS_NO_PATHCONV=1 trace $CLI repos create $url $provider --path $path | jq .id -r)
+add_repl "$repo_id" REPO_ID
 
 title "Get by id should work"
-trace $CLI repos get $repo_id -o json
+MSYS_NO_PATHCONV=1 trace $CLI repos get $repo_id -o json
 
 title "Get by path should work"
-trace $CLI repos get $path -o json
+MSYS_NO_PATHCONV=1 trace $CLI repos get $path -o json
 
 title "Delete by id should work"
-trace $CLI repos delete $repo_id
+MSYS_NO_PATHCONV=1 trace $CLI repos delete $repo_id
+
+trace print_requests.py --get //repos //workspace/get-status
diff --git a/acceptance/workspace/repos/create_without_provider/out.requests.txt b/acceptance/workspace/repos/create_without_provider/out.requests.txt
deleted file mode 100644
index eb4819231fe..00000000000
--- a/acceptance/workspace/repos/create_without_provider/out.requests.txt
+++ /dev/null
@@ -1,13 +0,0 @@
-{
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/repos",
-  "body": {
-    "path": "/Repos/me@databricks.com/test-repo",
-    "provider": "gitHub",
-    "url": "https://github.com/databricks/databricks-empty-ide-project.git"
-  }
-}
diff --git a/acceptance/workspace/repos/create_without_provider/out.test.toml b/acceptance/workspace/repos/create_without_provider/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/workspace/repos/create_without_provider/out.test.toml
+++ b/acceptance/workspace/repos/create_without_provider/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/workspace/repos/create_without_provider/output.txt b/acceptance/workspace/repos/create_without_provider/output.txt
index 4a461ec664e..1945fb50252 100644
--- a/acceptance/workspace/repos/create_without_provider/output.txt
+++ b/acceptance/workspace/repos/create_without_provider/output.txt
@@ -2,8 +2,20 @@
 >>> [CLI] repos create https://github.com/databricks/databricks-empty-ide-project.git --path /Repos/me@databricks.com/test-repo
 {
   "branch": "main",
-  "id": [NUMID],
+  "head_commit_id": "0a1b2c3d4e5f6a7b8e7dadd73e50a69d8ba47d8f",
+  "id": [REPO_ID],
   "path": "/Repos/me@databricks.com/test-repo",
   "provider": "gitHub",
   "url": "https://github.com/databricks/databricks-empty-ide-project.git"
 }
+
+>>> print_requests.py --get //repos //workspace/get-status
+{
+  "method": "POST",
+  "path": "/api/2.0/repos",
+  "body": {
+    "path": "/Repos/me@databricks.com/test-repo",
+    "provider": "gitHub",
+    "url": "https://github.com/databricks/databricks-empty-ide-project.git"
+  }
+}
diff --git a/acceptance/workspace/repos/create_without_provider/script b/acceptance/workspace/repos/create_without_provider/script
index 1953f59568f..a16badd9c3e 100644
--- a/acceptance/workspace/repos/create_without_provider/script
+++ b/acceptance/workspace/repos/create_without_provider/script
@@ -1,4 +1,6 @@
 url=https://github.com/databricks/databricks-empty-ide-project.git
 path=/Repos/me@databricks.com/test-repo
 
-trace $CLI repos create $url --path $path
+MSYS_NO_PATHCONV=1 trace $CLI repos create $url --path $path
+
+trace print_requests.py --get //repos //workspace/get-status
diff --git a/acceptance/workspace/repos/create_without_provider/test.toml b/acceptance/workspace/repos/create_without_provider/test.toml
new file mode 100644
index 00000000000..17099bad1de
--- /dev/null
+++ b/acceptance/workspace/repos/create_without_provider/test.toml
@@ -0,0 +1,3 @@
+[[Repls]]
+Old = '"id": \d+,'
+New = '"id": [REPO_ID],'
diff --git a/acceptance/workspace/repos/delete_by_path/out.requests.txt b/acceptance/workspace/repos/delete_by_path/out.requests.txt
deleted file mode 100644
index 9fa6916971a..00000000000
--- a/acceptance/workspace/repos/delete_by_path/out.requests.txt
+++ /dev/null
@@ -1,42 +0,0 @@
-{
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/repos",
-  "body": {
-    "path": "/Repos/me@databricks.com/test-repo",
-    "provider": "gitHub",
-    "url": "https://github.com/databricks/databricks-empty-ide-project.git"
-  }
-}
-{
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Repos/me@databricks.com/test-repo"
-  }
-}
-{
-  "method": "GET",
-  "path": "/api/2.0/repos/[NUMID]"
-}
-{
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Repos/me@databricks.com/test-repo"
-  }
-}
-{
-  "method": "DELETE",
-  "path": "/api/2.0/repos/[NUMID]"
-}
-{
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Repos/me@databricks.com/test-repo"
-  }
-}
diff --git a/acceptance/workspace/repos/delete_by_path/out.test.toml b/acceptance/workspace/repos/delete_by_path/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/workspace/repos/delete_by_path/out.test.toml
+++ b/acceptance/workspace/repos/delete_by_path/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/workspace/repos/delete_by_path/output.txt b/acceptance/workspace/repos/delete_by_path/output.txt
index 3f888863e06..d1cef31426b 100644
--- a/acceptance/workspace/repos/delete_by_path/output.txt
+++ b/acceptance/workspace/repos/delete_by_path/output.txt
@@ -1,11 +1,12 @@
 
 >>> [CLI] repos create https://github.com/databricks/databricks-empty-ide-project.git gitHub --path /Repos/me@databricks.com/test-repo
-[NUMID]
+[REPO_ID]
 
 >>> [CLI] repos get /Repos/me@databricks.com/test-repo -o json
 {
   "branch": "main",
-  "id": [NUMID],
+  "head_commit_id": "0a1b2c3d4e5f6a7b8e7dadd73e50a69d8ba47d8f",
+  "id": [REPO_ID],
   "path": "/Repos/me@databricks.com/test-repo",
   "provider": "gitHub",
   "url": "https://github.com/databricks/databricks-empty-ide-project.git"
@@ -14,6 +15,6 @@
 >>> [CLI] repos delete /Repos/me@databricks.com/test-repo
 
 >>> [CLI] repos get /Repos/me@databricks.com/test-repo -o json
-Error: failed to look up repo by path: Workspace path not found
+Error: failed to look up repo by path: Path (/Repos/me@databricks.com/test-repo) doesn't exist.
 
 Exit code: 1
diff --git a/acceptance/workspace/repos/delete_by_path/script b/acceptance/workspace/repos/delete_by_path/script
index 2aacc9397b7..98e1928e2aa 100644
--- a/acceptance/workspace/repos/delete_by_path/script
+++ b/acceptance/workspace/repos/delete_by_path/script
@@ -2,10 +2,14 @@ url=https://github.com/databricks/databricks-empty-ide-project.git
 provider=gitHub
 path=/Repos/me@databricks.com/test-repo
 
-trace $CLI repos create $url $provider --path $path | jq .id -r
+MSYS_NO_PATHCONV=1 trace $CLI repos create $url $provider --path $path | jq .id -r | tee repo_id.tmp
+add_repl "$(cat repo_id.tmp)" REPO_ID
+rm repo_id.tmp
 
-trace $CLI repos get $path -o json
+MSYS_NO_PATHCONV=1 trace $CLI repos get $path -o json
 
-trace $CLI repos delete $path
+MSYS_NO_PATHCONV=1 trace $CLI repos delete $path
 
-trace $CLI repos get $path -o json
+MSYS_NO_PATHCONV=1 trace $CLI repos get $path -o json
+
+trace print_requests.py --get //repos //workspace/get-status
diff --git a/acceptance/workspace/repos/get_errors/out.requests.txt b/acceptance/workspace/repos/get_errors/out.requests.txt
deleted file mode 100644
index 2bfe07b1317..00000000000
--- a/acceptance/workspace/repos/get_errors/out.requests.txt
+++ /dev/null
@@ -1,25 +0,0 @@
-{
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Repos/me@databricks.com/doesnotexist"
-  }
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/workspace/mkdirs",
-  "body": {
-    "path": "/not-a-repo"
-  }
-}
-{
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/not-a-repo"
-  }
-}
diff --git a/acceptance/workspace/repos/get_errors/out.test.toml b/acceptance/workspace/repos/get_errors/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/workspace/repos/get_errors/out.test.toml
+++ b/acceptance/workspace/repos/get_errors/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/workspace/repos/get_errors/output.txt b/acceptance/workspace/repos/get_errors/output.txt
index 33084a05ce4..3e59d6440e2 100644
--- a/acceptance/workspace/repos/get_errors/output.txt
+++ b/acceptance/workspace/repos/get_errors/output.txt
@@ -1,10 +1,12 @@
 
 >>> [CLI] repos get /Repos/me@databricks.com/doesnotexist -o json
-Error: failed to look up repo by path: Workspace path not found
-
-Exit code: 1
-
->>> [CLI] repos get /not-a-repo -o json
-Error: object at path "/not-a-repo" is not a repo
-
-Exit code: 1
+Error: failed to look up repo by path: Path (/Repos/me@databricks.com/doesnotexist) doesn't exist.
+
+>>> print_requests.py --get //repos //workspace/get-status
+{
+  "method": "GET",
+  "path": "/api/2.0/workspace/get-status",
+  "q": {
+    "path": "/Repos/me@databricks.com/doesnotexist"
+  }
+}
diff --git a/acceptance/workspace/repos/get_errors/script b/acceptance/workspace/repos/get_errors/script
index a2a0b525e8e..0ac489de76a 100644
--- a/acceptance/workspace/repos/get_errors/script
+++ b/acceptance/workspace/repos/get_errors/script
@@ -1,4 +1,3 @@
-errcode trace $CLI repos get /Repos/me@databricks.com/doesnotexist -o json
+MSYS_NO_PATHCONV=1 musterr trace $CLI repos get /Repos/me@databricks.com/doesnotexist -o json
 
-$CLI workspace mkdirs /not-a-repo
-errcode trace $CLI repos get /not-a-repo -o json
+trace print_requests.py --get //repos //workspace/get-status
diff --git a/acceptance/workspace/repos/git_cli_folder/out.test.toml b/acceptance/workspace/repos/git_cli_folder/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/workspace/repos/git_cli_folder/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/workspace/repos/git_cli_folder/output.txt b/acceptance/workspace/repos/git_cli_folder/output.txt
new file mode 100644
index 00000000000..f27bd344833
--- /dev/null
+++ b/acceptance/workspace/repos/git_cli_folder/output.txt
@@ -0,0 +1,67 @@
+
+>>> [CLI] repos create https://github.com/databricks/databricks-empty-ide-project.git gitHub --path /Workspace/Users/me@databricks.com/test-repo
+[REPO_ID]
+
+=== Get by path resolves a Git CLI folder
+>>> [CLI] repos get /Workspace/Users/me@databricks.com/test-repo -o json
+{
+  "branch": "main",
+  "head_commit_id": "0a1b2c3d4e5f6a7b8e7dadd73e50a69d8ba47d8f",
+  "id": [REPO_ID],
+  "path": "/Workspace/Users/me@databricks.com/test-repo",
+  "provider": "gitHub",
+  "url": "https://github.com/databricks/databricks-empty-ide-project.git"
+}
+
+=== Update by path resolves a Git CLI folder
+>>> [CLI] repos update /Workspace/Users/me@databricks.com/test-repo --branch update-by-path
+
+=== Delete by path resolves a Git CLI folder
+>>> [CLI] repos delete /Workspace/Users/me@databricks.com/test-repo
+
+>>> print_requests.py --get //repos //workspace/get-status
+{
+  "method": "POST",
+  "path": "/api/2.0/repos",
+  "body": {
+    "path": "/Workspace/Users/me@databricks.com/test-repo",
+    "provider": "gitHub",
+    "url": "https://github.com/databricks/databricks-empty-ide-project.git"
+  }
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/workspace/get-status",
+  "q": {
+    "path": "/Workspace/Users/me@databricks.com/test-repo"
+  }
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/repos/[REPO_ID]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/workspace/get-status",
+  "q": {
+    "path": "/Workspace/Users/me@databricks.com/test-repo"
+  }
+}
+{
+  "method": "PATCH",
+  "path": "/api/2.0/repos/[REPO_ID]",
+  "body": {
+    "branch": "update-by-path"
+  }
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/workspace/get-status",
+  "q": {
+    "path": "/Workspace/Users/me@databricks.com/test-repo"
+  }
+}
+{
+  "method": "DELETE",
+  "path": "/api/2.0/repos/[REPO_ID]"
+}
diff --git a/acceptance/workspace/repos/git_cli_folder/script b/acceptance/workspace/repos/git_cli_folder/script
new file mode 100644
index 00000000000..e64e97420d2
--- /dev/null
+++ b/acceptance/workspace/repos/git_cli_folder/script
@@ -0,0 +1,20 @@
+url=https://github.com/databricks/databricks-empty-ide-project.git
+provider=gitHub
+# A Git-CLI-enabled folder lives outside /Repos and get-status reports it as a
+# DIRECTORY, not a REPO. Path-based commands must still resolve it to a repo ID.
+path=/Workspace/Users/me@databricks.com/test-repo
+
+MSYS_NO_PATHCONV=1 trace $CLI repos create $url $provider --path $path | jq .id -r | tee repo_id.tmp
+add_repl "$(cat repo_id.tmp)" REPO_ID
+rm repo_id.tmp
+
+title "Get by path resolves a Git CLI folder"
+MSYS_NO_PATHCONV=1 trace $CLI repos get $path -o json
+
+title "Update by path resolves a Git CLI folder"
+MSYS_NO_PATHCONV=1 trace $CLI repos update $path --branch update-by-path
+
+title "Delete by path resolves a Git CLI folder"
+MSYS_NO_PATHCONV=1 trace $CLI repos delete $path
+
+trace print_requests.py --get //repos //workspace/get-status
diff --git a/acceptance/workspace/repos/test.toml b/acceptance/workspace/repos/test.toml
index 7d4ca32ad8a..159efe02696 100644
--- a/acceptance/workspace/repos/test.toml
+++ b/acceptance/workspace/repos/test.toml
@@ -1,7 +1 @@
 RecordRequests = true
-
-[Env]
-# MSYS2 automatically converts absolute paths like /Repos/me@databricks.com/test-repo to
-# C:/Program Files/Git/Repos/me@databricks.com/test-repo before passing it to the CLI
-# Setting this environment variable prevents that conversion on windows.
-MSYS_NO_PATHCONV = "1"
diff --git a/acceptance/workspace/repos/update/out.requests.txt b/acceptance/workspace/repos/update/out.requests.txt
deleted file mode 100644
index fa5a518dad8..00000000000
--- a/acceptance/workspace/repos/update/out.requests.txt
+++ /dev/null
@@ -1,42 +0,0 @@
-{
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
-{
-  "method": "POST",
-  "path": "/api/2.0/repos",
-  "body": {
-    "path": "/Repos/me@databricks.com/test-repo",
-    "provider": "gitHub",
-    "url": "https://github.com/databricks/databricks-empty-ide-project.git"
-  }
-}
-{
-  "method": "PATCH",
-  "path": "/api/2.0/repos/[NUMID]",
-  "body": {
-    "branch": "update-by-id"
-  }
-}
-{
-  "method": "GET",
-  "path": "/api/2.0/repos/[NUMID]"
-}
-{
-  "method": "GET",
-  "path": "/api/2.0/workspace/get-status",
-  "q": {
-    "path": "/Repos/me@databricks.com/test-repo"
-  }
-}
-{
-  "method": "PATCH",
-  "path": "/api/2.0/repos/[NUMID]",
-  "body": {
-    "branch": "update-by-path"
-  }
-}
-{
-  "method": "GET",
-  "path": "/api/2.0/repos/[NUMID]"
-}
diff --git a/acceptance/workspace/repos/update/out.test.toml b/acceptance/workspace/repos/update/out.test.toml
index f784a183258..18b1a88417e 100644
--- a/acceptance/workspace/repos/update/out.test.toml
+++ b/acceptance/workspace/repos/update/out.test.toml
@@ -1,3 +1 @@
-Local = true
 Cloud = false
-EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/workspace/repos/update/output.txt b/acceptance/workspace/repos/update/output.txt
index fb5b97bc3a6..24414ac795d 100644
--- a/acceptance/workspace/repos/update/output.txt
+++ b/acceptance/workspace/repos/update/output.txt
@@ -1,12 +1,13 @@
 
 >>> [CLI] repos create https://github.com/databricks/databricks-empty-ide-project.git gitHub --path /Repos/me@databricks.com/test-repo
 
->>> [CLI] repos update [NUMID] --branch update-by-id
+>>> [CLI] repos update [REPO_ID] --branch update-by-id
 
->>> [CLI] repos get [NUMID] -o json
+>>> [CLI] repos get [REPO_ID] -o json
 {
   "branch": "update-by-id",
-  "id": [NUMID],
+  "head_commit_id": "0a1b2c3d4e5f6a7b8e7dadd73e50a69d8ba47d8f",
+  "id": [REPO_ID],
   "path": "/Repos/me@databricks.com/test-repo",
   "provider": "gitHub",
   "url": "https://github.com/databricks/databricks-empty-ide-project.git"
@@ -14,11 +15,52 @@
 
 >>> [CLI] repos update /Repos/me@databricks.com/test-repo --branch update-by-path
 
->>> [CLI] repos get [NUMID] -o json
+>>> [CLI] repos get [REPO_ID] -o json
 {
   "branch": "update-by-path",
-  "id": [NUMID],
+  "head_commit_id": "0a1b2c3d4e5f6a7b8e7dadd73e50a69d8ba47d8f",
+  "id": [REPO_ID],
   "path": "/Repos/me@databricks.com/test-repo",
   "provider": "gitHub",
   "url": "https://github.com/databricks/databricks-empty-ide-project.git"
 }
+
+>>> print_requests.py --get //repos //workspace/get-status
+{
+  "method": "POST",
+  "path": "/api/2.0/repos",
+  "body": {
+    "path": "/Repos/me@databricks.com/test-repo",
+    "provider": "gitHub",
+    "url": "https://github.com/databricks/databricks-empty-ide-project.git"
+  }
+}
+{
+  "method": "PATCH",
+  "path": "/api/2.0/repos/[REPO_ID]",
+  "body": {
+    "branch": "update-by-id"
+  }
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/repos/[REPO_ID]"
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/workspace/get-status",
+  "q": {
+    "path": "/Repos/me@databricks.com/test-repo"
+  }
+}
+{
+  "method": "PATCH",
+  "path": "/api/2.0/repos/[REPO_ID]",
+  "body": {
+    "branch": "update-by-path"
+  }
+}
+{
+  "method": "GET",
+  "path": "/api/2.0/repos/[REPO_ID]"
+}
diff --git a/acceptance/workspace/repos/update/script b/acceptance/workspace/repos/update/script
index ab5db9f64bf..c6b449533bc 100644
--- a/acceptance/workspace/repos/update/script
+++ b/acceptance/workspace/repos/update/script
@@ -2,12 +2,15 @@ url=https://github.com/databricks/databricks-empty-ide-project.git
 provider=gitHub
 path=/Repos/me@databricks.com/test-repo
 
-repo_id=$(trace $CLI repos create $url $provider --path $path | jq .id -r)
+repo_id=$(MSYS_NO_PATHCONV=1 trace $CLI repos create $url $provider --path $path | jq .id -r)
+add_repl "$repo_id" REPO_ID
 
-trace $CLI repos update $repo_id --branch update-by-id
+MSYS_NO_PATHCONV=1 trace $CLI repos update $repo_id --branch update-by-id
 
-trace $CLI repos get $repo_id -o json
+MSYS_NO_PATHCONV=1 trace $CLI repos get $repo_id -o json
 
-trace $CLI repos update $path --branch update-by-path
+MSYS_NO_PATHCONV=1 trace $CLI repos update $path --branch update-by-path
 
-trace $CLI repos get $repo_id -o json
+MSYS_NO_PATHCONV=1 trace $CLI repos get $repo_id -o json
+
+trace print_requests.py --get //repos //workspace/get-status
diff --git a/bundle/apps/validate.go b/bundle/apps/validate.go
index 45a5b49c672..2ab3384f991 100644
--- a/bundle/apps/validate.go
+++ b/bundle/apps/validate.go
@@ -9,6 +9,7 @@ import (
 	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/structs/structpath"
 	"github.com/databricks/databricks-sdk-go/service/apps"
 )
 
@@ -27,7 +28,7 @@ func (v *validate) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics
 				Severity:  diag.Error,
 				Summary:   "Missing app source code path or git source",
 				Detail:    fmt.Sprintf("app resource '%s' should have either source_code_path or git_source field", key),
-				Locations: b.Config.GetLocations("resources.apps." + key),
+				Locations: b.Config.GetLocationsOf(structpath.NewPath(nil, "resources", "apps", key)),
 			})
 			continue
 		}
@@ -37,7 +38,7 @@ func (v *validate) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics
 				Severity:  diag.Error,
 				Summary:   "Both source_code_path and git_source fields are set",
 				Detail:    fmt.Sprintf("app resource '%s' should have either source_code_path or git_source field, not both", key),
-				Locations: b.Config.GetLocations("resources.apps." + key),
+				Locations: b.Config.GetLocationsOf(structpath.NewPath(nil, "resources", "apps", key)),
 			})
 			continue
 		}
@@ -47,7 +48,7 @@ func (v *validate) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics
 				Severity:  diag.Error,
 				Summary:   "Duplicate app source code path",
 				Detail:    fmt.Sprintf("app resource '%s' has the same source code path as app resource '%s', this will lead to the app configuration being overridden by each other", key, usedSourceCodePaths[app.SourceCodePath]),
-				Locations: b.Config.GetLocations(fmt.Sprintf("resources.apps.%s.source_code_path", key)),
+				Locations: b.Config.GetLocationsOf(structpath.NewPath(nil, "resources", "apps", key, "source_code_path")),
 			})
 		}
 		usedSourceCodePaths[app.SourceCodePath] = key
@@ -154,7 +155,7 @@ func warnForAppResourcePermissions(b *bundle.Bundle, appKey string, app *resourc
 			continue
 		}
 
-		appPath := "resources.apps." + appKey
+		appPath := structpath.NewPath(nil, "resources", "apps", appKey)
 		diags = append(diags, diag.Diagnostic{
 			Severity: diag.Warning,
 			Summary:  fmt.Sprintf("app %q references %s %q which has permissions set. To prevent permission override after deploying the app, please add the app service principal to the %s permissions", appKey, refType, resourceKey, refType),
@@ -172,8 +173,8 @@ func warnForAppResourcePermissions(b *bundle.Bundle, appKey string, app *resourc
 				ref.permission,
 				appKey,
 			),
-			Paths:     []dyn.Path{dyn.MustPathFromString(appPath)},
-			Locations: b.Config.GetLocations(appPath),
+			Paths:     []*structpath.PathNode{appPath},
+			Locations: b.Config.GetLocationsOf(appPath),
 		})
 	}
 
diff --git a/bundle/apps/validate_test.go b/bundle/apps/validate_test.go
index ffc4fde45e4..89b4e1d5907 100644
--- a/bundle/apps/validate_test.go
+++ b/bundle/apps/validate_test.go
@@ -11,7 +11,6 @@ import (
 	"github.com/databricks/cli/bundle/internal/bundletest"
 	"github.com/databricks/cli/internal/testutil"
 	"github.com/databricks/cli/libs/diag"
-	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/cli/libs/vfs"
 	"github.com/databricks/databricks-sdk-go/service/apps"
 	"github.com/stretchr/testify/require"
@@ -33,22 +32,22 @@ func TestAppsValidateSameSourcePath(t *testing.T) {
 				Apps: map[string]*resources.App{
 					"app1": {
 						App: apps.App{
-							Name: "app1",
+							Name:           "app1",
+							SourceCodePath: "./app1",
 						},
-						SourceCodePath: "./app1",
 					},
 					"app2": {
 						App: apps.App{
-							Name: "app2",
+							Name:           "app2",
+							SourceCodePath: "./app1",
 						},
-						SourceCodePath: "./app1",
 					},
 				},
 			},
 		},
 	}
 
-	bundletest.SetLocation(b, ".", []dyn.Location{{File: filepath.Join(tmpDir, "databricks.yml")}})
+	bundletest.SetLocation(b, ".", []diag.Location{{File: filepath.Join(tmpDir, "databricks.yml")}})
 
 	diags := bundle.ApplySeq(t.Context(), b, mutator.TranslatePaths(), Validate())
 	require.Len(t, diags, 1)
@@ -188,10 +187,10 @@ func TestAppsValidateResourcePermissionsWarning(t *testing.T) {
 			tc.resources.Apps = map[string]*resources.App{
 				"my_app": {
 					App: apps.App{
-						Name:      "my_app",
-						Resources: tc.appResources,
+						Name:           "my_app",
+						Resources:      tc.appResources,
+						SourceCodePath: "./app1",
 					},
-					SourceCodePath: "./app1",
 				},
 			}
 
@@ -205,7 +204,7 @@ func TestAppsValidateResourcePermissionsWarning(t *testing.T) {
 				},
 			}
 
-			bundletest.SetLocation(b, ".", []dyn.Location{{File: filepath.Join(tmpDir, "databricks.yml")}})
+			bundletest.SetLocation(b, ".", []diag.Location{{File: filepath.Join(tmpDir, "databricks.yml")}})
 
 			diags := bundle.ApplySeq(t.Context(), b, Validate())
 			warnings := diags.Filter(diag.Warning)
@@ -213,7 +212,7 @@ func TestAppsValidateResourcePermissionsWarning(t *testing.T) {
 				require.Len(t, warnings, 1)
 				require.Contains(t, warnings[0].Summary, tc.wantSummary)
 				require.Contains(t, warnings[0].Detail, "service_principal_name: ${resources.apps.my_app.service_principal_client_id}")
-				require.Equal(t, dyn.MustPathFromString("resources.apps.my_app"), warnings[0].Paths[0])
+				require.Equal(t, "resources.apps.my_app", warnings[0].Paths[0].String())
 			} else {
 				require.Empty(t, warnings)
 			}
@@ -237,11 +236,11 @@ func TestAppsValidateBothSourceCodePathAndGitSource(t *testing.T) {
 				Apps: map[string]*resources.App{
 					"app1": {
 						App: apps.App{
-							Name: "app1",
-						},
-						SourceCodePath: "./app1",
-						GitSource: &apps.GitSource{
-							Branch: "main",
+							Name:           "app1",
+							SourceCodePath: "./app1",
+							GitSource: &apps.GitSource{
+								Branch: "main",
+							},
 						},
 					},
 				},
@@ -249,7 +248,7 @@ func TestAppsValidateBothSourceCodePathAndGitSource(t *testing.T) {
 		},
 	}
 
-	bundletest.SetLocation(b, ".", []dyn.Location{{File: filepath.Join(tmpDir, "databricks.yml")}})
+	bundletest.SetLocation(b, ".", []diag.Location{{File: filepath.Join(tmpDir, "databricks.yml")}})
 
 	diags := bundle.ApplySeq(t.Context(), b, mutator.TranslatePaths(), Validate())
 	require.Len(t, diags, 1)
diff --git a/bundle/artifacts/build.go b/bundle/artifacts/build.go
index 38b42dd1ab6..6c7ab622737 100644
--- a/bundle/artifacts/build.go
+++ b/bundle/artifacts/build.go
@@ -63,6 +63,22 @@ func (m *build) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
 
 		}
 
+		// A `tgz` artifact with `include`/`git` (and no user `build` command) is built
+		// by DABs itself. Produce the tarball, then expand globs so its output file is
+		// picked up for upload just like a build-command output.
+		if a.BuildCommand == "" && a.Type == config.ArtifactTarball && (len(a.Include) > 0 || a.Git != nil) {
+			cmdio.LogProgress(ctx, fmt.Sprintf("Building %s...", artifactName))
+			if err := buildTarballArtifact(ctx, b, artifactName, a); err != nil {
+				logdiag.LogError(ctx, err)
+				break
+			}
+			bundle.ApplyContext(ctx, b, expandGlobs{name: artifactName})
+			a = b.Config.Artifacts[artifactName]
+			if logdiag.HasError(ctx) {
+				break
+			}
+		}
+
 		if a.Type == "whl" && a.DynamicVersion && cacheDir != "" {
 			b.Metrics.AddBoolValue(metrics.ArtifactDynamicVersionIsSet, true)
 			for ind, artifactFile := range a.Files {
@@ -82,7 +98,7 @@ func (m *build) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
 }
 
 func doBuild(ctx context.Context, artifactName string, a *config.Artifact) error {
-	cmdio.LogString(ctx, fmt.Sprintf("Building %s...", artifactName))
+	cmdio.LogProgress(ctx, fmt.Sprintf("Building %s...", artifactName))
 
 	var executor *exec.Executor
 	if a.Executable != "" {
@@ -102,7 +118,7 @@ func doBuild(ctx context.Context, artifactName string, a *config.Artifact) error
 
 	out, err := executor.Exec(ctx, a.BuildCommand)
 	if err != nil {
-		return fmt.Errorf("build failed %s, error: %v, output: %s", artifactName, err, out)
+		return fmt.Errorf("build failed %s, error: %w, output: %s", artifactName, err, out)
 	}
 
 	log.Debugf(ctx, "build output for %s:\n%s", artifactName, out)
diff --git a/bundle/artifacts/expand_globs.go b/bundle/artifacts/expand_globs.go
index af358d3dda9..cc5d1f3fb60 100644
--- a/bundle/artifacts/expand_globs.go
+++ b/bundle/artifacts/expand_globs.go
@@ -26,8 +26,8 @@ func createGlobError(v dyn.Value, p dyn.Path, message string) diag.Diagnostic {
 	return diag.Diagnostic{
 		Severity:  diag.Error,
 		Summary:   fmt.Sprintf("%s: %s", source, message),
-		Locations: []dyn.Location{v.Location()},
-		Paths:     []dyn.Path{p},
+		Locations: []diag.Location{v.Location()},
+		Paths:     dyn.ToStructPaths(p),
 	}
 }
 
diff --git a/bundle/artifacts/prepare.go b/bundle/artifacts/prepare.go
index 9f8b2e6eaed..e285eb1ee30 100644
--- a/bundle/artifacts/prepare.go
+++ b/bundle/artifacts/prepare.go
@@ -3,6 +3,7 @@ package artifacts
 import (
 	"context"
 	"errors"
+	"fmt"
 	"maps"
 	"os"
 	"path/filepath"
@@ -13,7 +14,6 @@ import (
 	"github.com/databricks/cli/bundle/libraries"
 	"github.com/databricks/cli/bundle/metrics"
 	"github.com/databricks/cli/libs/diag"
-	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/cli/libs/log"
 	"github.com/databricks/cli/libs/logdiag"
 	"github.com/databricks/cli/libs/python"
@@ -43,13 +43,24 @@ func (m *prepare) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics
 				Severity:  diag.Error,
 				Summary:   "Artifact not properly configured",
 				Detail:    "please specify artifact properties",
-				Locations: []dyn.Location{l},
+				Locations: []diag.Location{l},
 			})
 			continue
 		}
 		b.Metrics.AddBoolValue(metrics.ArtifactBuildCommandIsSet, artifact.BuildCommand != "")
 		b.Metrics.AddBoolValue(metrics.ArtifactFilesIsSet, len(artifact.Files) != 0)
 
+		// A `tgz` artifact with `include`/`git` is built by DABs itself in the build
+		// phase (see artifacts.Build). `build` and `git`/`include` are mutually
+		// exclusive: either the user's command produces the tarball, or DABs does.
+		native := artifact.Type == config.ArtifactTarball && (len(artifact.Include) > 0 || artifact.Git != nil)
+		if native && artifact.BuildCommand != "" {
+			logdiag.LogError(ctx, fmt.Errorf("artifact %q: `build` cannot be combined with `git`/`include`", artifactName))
+		}
+		if native && len(artifact.Files) == 0 {
+			logdiag.LogError(ctx, fmt.Errorf("artifact %q: a tgz artifact needs a `files` entry naming the output path", artifactName))
+		}
+
 		l := b.Config.GetLocation("artifacts." + artifactName)
 		dirPath := filepath.Dir(l.File)
 
@@ -88,7 +99,9 @@ func (m *prepare) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics
 			logdiag.LogError(ctx, errors.New("misconfigured artifact: please specify 'build' or 'files' property"))
 		}
 
-		if len(artifact.Files) > 0 && artifact.BuildCommand == "" {
+		// Skip glob expansion for a DABs-built tgz: its output file does not exist yet
+		// (it is produced in the build phase, which expands globs afterward).
+		if len(artifact.Files) > 0 && artifact.BuildCommand == "" && !native {
 			bundle.ApplyContext(ctx, b, expandGlobs{name: artifactName})
 		}
 
diff --git a/bundle/artifacts/tarball.go b/bundle/artifacts/tarball.go
new file mode 100644
index 00000000000..85c0124220b
--- /dev/null
+++ b/bundle/artifacts/tarball.go
@@ -0,0 +1,254 @@
+package artifacts
+
+import (
+	"archive/tar"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"path"
+	"path/filepath"
+	"runtime"
+	"slices"
+	"strings"
+	"time"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/deploy/files"
+	"github.com/databricks/cli/libs/fileset"
+	libsync "github.com/databricks/cli/libs/sync"
+	"github.com/databricks/cli/libs/vfs"
+	"github.com/klauspost/pgzip"
+)
+
+// tarballEpoch stamps every entry so the archive is reproducible: identical contents
+// produce identical bytes regardless of file mtimes.
+var tarballEpoch = time.Date(2000, 1, 1, 0, 0, 0, 0, time.UTC)
+
+// pgzipBlockSize is the input chunk pgzip compresses per block. gzip's single-threaded
+// compression dominates packaging time on a large tree, so we use klauspost/pgzip to
+// spread it across cores. We keep the default compression level (matching the old
+// single-threaded gzip, so tarball sizes don't change) and pin the block size: pgzip
+// only parallelizes *across* blocks, so a fixed block size keeps the compressed byte
+// stream identical regardless of how many cores the build host has — preserving the
+// reproducibility contract above. This is pgzip's own default block size (1 MiB).
+const pgzipBlockSize = 1 << 20
+
+// newParallelGzip returns a parallel gzip writer with a deterministic block size. Callers
+// must Close it to flush the trailer.
+func newParallelGzip(w io.Writer) (*pgzip.Writer, error) {
+	gzw := pgzip.NewWriter(w)
+	if err := gzw.SetConcurrency(pgzipBlockSize, runtime.GOMAXPROCS(0)); err != nil {
+		return nil, err
+	}
+	return gzw, nil
+}
+
+// buildTarballArtifact produces the gzipped tarball for a `type: tgz` artifact that
+// DABs builds itself (no user `build` command). Archive entries are the packed files
+// named relative to the artifact's `path`. With `git` set the tarball snapshots that
+// ref; otherwise it packs the working tree scoped to `include`. The result is written
+// to the artifact's single output file, which the normal artifact upload path uploads
+// and references.
+func buildTarballArtifact(ctx context.Context, b *bundle.Bundle, name string, a *config.Artifact) error {
+	if len(a.Files) != 1 {
+		return fmt.Errorf("artifact %q: a tgz artifact needs exactly one `files` entry naming the output path", name)
+	}
+	out := a.Files[0].Source // made absolute by artifacts.Prepare
+	if err := os.MkdirAll(filepath.Dir(out), 0o755); err != nil {
+		return err
+	}
+
+	// Write to a temp file and rename on success, so a failed build never leaves a
+	// partial tarball at `out`.
+	tmp, err := os.CreateTemp(filepath.Dir(out), filepath.Base(out)+".*.tmp")
+	if err != nil {
+		return err
+	}
+	tmpName := tmp.Name()
+	defer func() {
+		tmp.Close()
+		os.Remove(tmpName) // no-op once renamed into place
+	}()
+
+	if a.Git != nil {
+		err = tarballFromGit(ctx, b, a, tmp)
+	} else {
+		err = tarballFromInclude(ctx, b, a, tmp)
+	}
+	if err != nil {
+		return err
+	}
+	if err := tmp.Close(); err != nil {
+		return err
+	}
+	return os.Rename(tmpName, out)
+}
+
+// codeRel returns the artifact's `path` as a slash-separated path relative to the sync
+// root ("." when they are the same). include paths and archive entry names are relative
+// to it.
+func codeRel(b *bundle.Bundle, a *config.Artifact) (string, error) {
+	rel, err := filepath.Rel(b.SyncRootPath, a.Path)
+	if err != nil {
+		return "", fmt.Errorf("artifact path %q: %w", a.Path, err)
+	}
+	return filepath.ToSlash(rel), nil
+}
+
+// tarballFromInclude packs the working tree under the artifact's `path`, optionally
+// narrowed to `include` subpaths (relative to `path`). Entries are named relative to
+// `path`. The bundle's sync walker is used so .gitignore is honored, but the
+// bundle-wide sync.include/sync.exclude are deliberately NOT applied — they scope
+// bundle file sync, not a code artifact.
+func tarballFromInclude(ctx context.Context, b *bundle.Bundle, a *config.Artifact, w io.Writer) error {
+	relBase, err := codeRel(b, a)
+	if err != nil {
+		return err
+	}
+	opts, err := files.GetSyncOptions(ctx, b)
+	if err != nil {
+		return err
+	}
+	paths := []string{relBase}
+	if len(a.Include) > 0 {
+		paths = paths[:0]
+		for _, inc := range a.Include {
+			paths = append(paths, path.Join(relBase, filepath.ToSlash(inc)))
+		}
+	}
+	// nil include/exclude: only .gitignore filters the walk, not the bundle sync globs.
+	fl, err := libsync.NewFileList(ctx, opts.WorktreeRoot, opts.LocalRoot, paths, nil, nil)
+	if err != nil {
+		return err
+	}
+	list, err := fl.Files(ctx)
+	if err != nil {
+		return err
+	}
+	if relBase != "." {
+		prefix := relBase + "/"
+		list = slices.DeleteFunc(list, func(f fileset.File) bool {
+			return !strings.HasPrefix(f.Relative, prefix)
+		})
+	}
+	if len(list) == 0 {
+		return fmt.Errorf("artifact tgz: no files to pack under %q (empty, gitignored, or no `include` match)", a.Path)
+	}
+	// Sort so the archive byte stream doesn't depend on walk order.
+	slices.SortFunc(list, func(x, y fileset.File) int {
+		return strings.Compare(x.Relative, y.Relative)
+	})
+
+	gzw, err := newParallelGzip(w)
+	if err != nil {
+		return err
+	}
+	tw := tar.NewWriter(gzw)
+	for _, file := range list {
+		if err := addFileToTarball(tw, b.SyncRoot, relBase, file); err != nil {
+			return err
+		}
+	}
+	if err := tw.Close(); err != nil {
+		return err
+	}
+	return gzw.Close()
+}
+
+// tarballFromGit snapshots a git ref via `git archive`, so the archive reflects the
+// committed tree at that ref. Entries are named relative to `path` (the tree at
+// `<ref>:<path>`); `include`, when set, scopes the archived pathspecs. Commit wins over
+// Branch.
+func tarballFromGit(ctx context.Context, b *bundle.Bundle, a *config.Artifact, w io.Writer) error {
+	ref := a.Git.Commit
+	if ref == "" {
+		ref = a.Git.Branch
+	}
+	if ref == "" {
+		return errors.New("git artifact: specify git.commit or git.branch")
+	}
+	relBase, err := codeRel(b, a)
+	if err != nil {
+		return err
+	}
+	treeish := ref
+	if relBase != "." {
+		// The tree at <ref>:<path>, so entries come out relative to `path`.
+		treeish = ref + ":" + relBase
+	}
+	// Ask git for an uncompressed tar and gzip it ourselves with pgzip: git's
+	// --format=tar.gz gzip is single-threaded, whereas pgzip spreads it across cores.
+	args := []string{"-C", b.SyncRootPath, "archive", "--format=tar", treeish}
+	if len(a.Include) > 0 {
+		args = append(args, "--")
+		args = append(args, a.Include...)
+	}
+	gzw, err := newParallelGzip(w)
+	if err != nil {
+		return err
+	}
+	cmd := exec.CommandContext(ctx, "git", args...)
+	cmd.Stdout = gzw
+	var stderr strings.Builder
+	cmd.Stderr = &stderr
+	if err := cmd.Run(); err != nil {
+		gzw.Close()
+		return fmt.Errorf("git archive %s: %w: %s", treeish, err, stderr.String())
+	}
+	return gzw.Close()
+}
+
+// addFileToTarball writes f (a sync-root-relative file) to the archive under a name
+// relative to relBase, so entries are relative to the artifact's `path`.
+func addFileToTarball(tw *tar.Writer, root vfs.Path, relBase string, f fileset.File) error {
+	name := f.Relative
+	if relBase != "." {
+		trimmed, ok := strings.CutPrefix(name, relBase+"/")
+		if !ok {
+			// Outside the code root; the walk is scoped to it, so this shouldn't
+			// happen, but skip defensively rather than mis-place a file.
+			return nil
+		}
+		name = trimmed
+	}
+
+	rc, err := root.Open(f.Relative)
+	if err != nil {
+		return fmt.Errorf("open %s: %w", f.Relative, err)
+	}
+	defer rc.Close()
+
+	info, err := rc.Stat()
+	if err != nil {
+		return fmt.Errorf("stat %s: %w", f.Relative, err)
+	}
+	// Only regular files; the walker never yields directories and symlinks are out
+	// of scope for a code snapshot.
+	if !info.Mode().IsRegular() {
+		return nil
+	}
+
+	// Preserve the owner execute bit; normalize the rest.
+	mode := int64(0o644)
+	if info.Mode().Perm()&0o100 != 0 {
+		mode = 0o755
+	}
+	hdr := &tar.Header{
+		Typeflag: tar.TypeReg,
+		Name:     name,
+		Size:     info.Size(),
+		Mode:     mode,
+		ModTime:  tarballEpoch,
+	}
+	if err := tw.WriteHeader(hdr); err != nil {
+		return fmt.Errorf("tar header for %s: %w", name, err)
+	}
+	if _, err := io.Copy(tw, rc); err != nil {
+		return fmt.Errorf("write %s: %w", name, err)
+	}
+	return nil
+}
diff --git a/bundle/artifacts/tarball_test.go b/bundle/artifacts/tarball_test.go
new file mode 100644
index 00000000000..49764877ae6
--- /dev/null
+++ b/bundle/artifacts/tarball_test.go
@@ -0,0 +1,107 @@
+package artifacts
+
+import (
+	"archive/tar"
+	"bytes"
+	"compress/gzip"
+	"errors"
+	"io"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// tarEntries reads a gzipped tarball and returns entry name -> content.
+func tarEntries(t *testing.T, b []byte) map[string]string {
+	t.Helper()
+	gzr, err := gzip.NewReader(bytes.NewReader(b))
+	require.NoError(t, err)
+	tr := tar.NewReader(gzr)
+	out := map[string]string{}
+	for {
+		hdr, err := tr.Next()
+		if errors.Is(err, io.EOF) {
+			break
+		}
+		require.NoError(t, err)
+		body, err := io.ReadAll(tr)
+		require.NoError(t, err)
+		out[hdr.Name] = string(body)
+	}
+	return out
+}
+
+func runGit(t *testing.T, dir string, args ...string) {
+	t.Helper()
+	cmd := exec.Command("git", args...)
+	cmd.Dir = dir
+	out, err := cmd.CombinedOutput()
+	require.NoError(t, err, "git %v: %s", args, out)
+}
+
+// TestTarballFromGitArchivesRef verifies git mode archives the committed tree with
+// entries named relative to the artifact's path (here the repo root, so no prefix).
+func TestTarballFromGitArchivesRef(t *testing.T) {
+	repo := t.TempDir()
+	runGit(t, repo, "init", "-q")
+	runGit(t, repo, "config", "user.email", "t@example.com")
+	runGit(t, repo, "config", "user.name", "t")
+	// Keep line endings verbatim so the content check doesn't depend on the runner's
+	// core.autocrlf (true by default on the Windows CI image).
+	runGit(t, repo, "config", "core.autocrlf", "false")
+	require.NoError(t, os.WriteFile(filepath.Join(repo, "train.py"), []byte("print('x')\n"), 0o644))
+	runGit(t, repo, "add", "-A")
+	runGit(t, repo, "commit", "-qm", "init")
+
+	b := &bundle.Bundle{SyncRootPath: repo}
+	a := &config.Artifact{Path: repo, Git: &config.ArtifactGit{Commit: "HEAD"}}
+
+	var buf bytes.Buffer
+	require.NoError(t, tarballFromGit(t.Context(), b, a, &buf))
+
+	// path == repo root, so the entry is relative to it (no injected prefix).
+	entries := tarEntries(t, buf.Bytes())
+	require.Contains(t, entries, "train.py")
+	assert.Equal(t, "print('x')", strings.TrimSpace(entries["train.py"]))
+}
+
+func TestTarballFromGitRequiresRef(t *testing.T) {
+	b := &bundle.Bundle{SyncRootPath: t.TempDir()}
+	a := &config.Artifact{Path: b.SyncRootPath, Git: &config.ArtifactGit{}}
+	err := tarballFromGit(t.Context(), b, a, io.Discard)
+	require.ErrorContains(t, err, "git.commit or git.branch")
+}
+
+// The tarball is content-addressed on upload, so the same tree must always compress to
+// the same bytes. We now gzip with parallel pgzip; this guards that its output stays
+// deterministic (pgzip only parallelizes across fixed-size blocks, so core count doesn't
+// leak into the bytes) and that it decompresses cleanly.
+func TestTarballFromGitIsReproducible(t *testing.T) {
+	repo := t.TempDir()
+	runGit(t, repo, "init", "-q")
+	runGit(t, repo, "config", "user.email", "t@example.com")
+	runGit(t, repo, "config", "user.name", "t")
+	runGit(t, repo, "config", "core.autocrlf", "false")
+	require.NoError(t, os.WriteFile(filepath.Join(repo, "train.py"), []byte("print('x')\n"), 0o644))
+	require.NoError(t, os.WriteFile(filepath.Join(repo, "big.txt"), bytes.Repeat([]byte("compress me\n"), 200000), 0o644))
+	runGit(t, repo, "add", "-A")
+	runGit(t, repo, "commit", "-qm", "init")
+
+	b := &bundle.Bundle{SyncRootPath: repo}
+	a := &config.Artifact{Path: repo, Git: &config.ArtifactGit{Commit: "HEAD"}}
+
+	var buf1, buf2 bytes.Buffer
+	require.NoError(t, tarballFromGit(t.Context(), b, a, &buf1))
+	require.NoError(t, tarballFromGit(t.Context(), b, a, &buf2))
+
+	assert.Equal(t, buf1.Bytes(), buf2.Bytes(), "identical tree must compress to identical bytes")
+	// Round-trips through gzip and carries the packed file.
+	assert.Equal(t, "print('x')", strings.TrimSpace(tarEntries(t, buf1.Bytes())["train.py"]))
+}
diff --git a/bundle/bundle.go b/bundle/bundle.go
index e7eef14b907..6c80882134a 100644
--- a/bundle/bundle.go
+++ b/bundle/bundle.go
@@ -13,11 +13,14 @@ import (
 	"path/filepath"
 	"sync"
 	"time"
+	"uuid"
 
 	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/config/engine"
 	"github.com/databricks/cli/bundle/direct"
 	"github.com/databricks/cli/bundle/env"
 	"github.com/databricks/cli/bundle/metadata"
+	"github.com/databricks/cli/bundle/statemgmt/resourcestate"
 	"github.com/databricks/cli/libs/auth"
 	"github.com/databricks/cli/libs/cache"
 	"github.com/databricks/cli/libs/fileset"
@@ -29,21 +32,38 @@ import (
 	"github.com/databricks/cli/libs/telemetry/protos"
 	"github.com/databricks/cli/libs/vfs"
 	"github.com/databricks/databricks-sdk-go"
-	"github.com/google/uuid"
-	"github.com/hashicorp/terraform-exec/tfexec"
 )
 
 const internalFolder = ".internal"
 
+// QuietLevel is how much of the informational output to suppress, controlled by
+// repeating -q. Warnings and errors are never suppressed.
+type QuietLevel int
+
+const (
+	// QuietNone prints everything.
+	QuietNone QuietLevel = iota
+
+	// QuietSummary (-q) drops the per-resource action lines, keeping the summary.
+	QuietSummary
+
+	// QuietAll (-qq) also drops the summary and the progress lines ("Uploading
+	// bundle files to ...", "Building ...", "Executing 'postdeploy' script"), so
+	// only warnings and errors remain.
+	QuietAll
+)
+
+// SuppressProgress reports whether progress and summary output should be skipped.
+func (b *Bundle) SuppressProgress() bool {
+	return b.Quiet >= QuietAll
+}
+
 // Filename where resources are stored for DATABRICKS_BUNDLE_ENGINE=direct
 const resourcesFilename = "resources.json"
 
 // Filename where resources are stored for DATABRICKS_BUNDLE_ENGINE=terraform
 const terraformStateFilename = "terraform.tfstate"
 
-// Filename where config snapshot is stored for experimental YAML sync
-const configSnapshotFilename = "resources-config-sync-snapshot.json"
-
 // This struct is used as a communication channel to collect metrics
 // from all over the bundle codebase to finally be emitted as telemetry.
 type Metrics struct {
@@ -55,6 +75,19 @@ type Metrics struct {
 	PythonUpdatedResourcesCount int64
 	ExecutionTimes              []protos.IntMapEntry
 	LocalCacheMeasurementsMs    []protos.IntMapEntry // Local cache measurements stored as milliseconds
+
+	// StateEngine is the engine that ran (or would have run) the deploy. Set to the
+	// requested engine as soon as it is resolved, then refined to the state's engine
+	// once the state is pulled, so deploy telemetry reports it even when the deploy
+	// fails or is cancelled before applying resources. Empty only when the deploy
+	// fails before the engine is resolved.
+	StateEngine engine.EngineType
+
+	// ResourceState is the direct engine's per-resource deployment state
+	// captured right after the deploy. It carries each resource's state-size in
+	// bytes so deploy telemetry can be derived without re-reading or re-parsing
+	// the state file.
+	ResourceState resourcestate.ExportedResourcesMap
 }
 
 // SetBoolValue sets the value of a boolean metric.
@@ -109,9 +142,20 @@ type Bundle struct {
 	// It is loaded from the bundle configuration files and mutators may update it.
 	Config config.Root
 
+	// includePatterns holds the raw (unexpanded) 'include' patterns from the root
+	// databricks.yml. ProcessRootIncludes overwrites Config.Include with the
+	// expanded list of loaded files, so this preserves the original patterns for
+	// IsFileIncluded. Set via SetIncludePatterns.
+	includePatterns []string
+
 	// Target stores a snapshot of the Root.Bundle.Target configuration when it was selected by SelectTarget.
 	Target *config.Target `json:"target_config,omitempty" bundle:"internal"`
 
+	// RootPathIsNameTargetScoped reports whether workspace.root_path ends in the bundle
+	// name and target. Recorded before variable resolution, so a path that only happens
+	// to end in those two segments does not count.
+	RootPathIsNameTargetScoped bool
+
 	// Metadata about the bundle deployment. This is the interface Databricks services
 	// rely on to integrate with bundles when they need additional information about
 	// a bundle deployment.
@@ -126,18 +170,13 @@ type Bundle struct {
 	// Files that are synced to the workspace.file_path
 	Files []fileset.File
 
-	// Stores an initialized copy of this bundle's Terraform wrapper.
-	Terraform *tfexec.Terraform
+	// FileCounts is how many files the deploy uploaded and deleted. Unlike Files,
+	// which lists everything tracked, this counts only what actually changed.
+	FileCounts libsync.FileCounts
 
 	// Stores the locker responsible for acquiring/releasing a deployment lock.
 	Locker *locker.Locker
 
-	// TerraformPlanPath is the path to the plan from the terraform CLI
-	TerraformPlanPath string
-
-	// If true, the plan is empty and applying it will not do anything
-	TerraformPlanIsEmpty bool
-
 	// (direct only) deployment implementation and state
 	DeploymentBundle direct.DeploymentBundle
 
@@ -145,6 +184,26 @@ type Bundle struct {
 	// files
 	AutoApprove bool
 
+	// Select contains resource selectors passed via --select flag.
+	// When non-empty, only the specified resources are included in deployment.
+	Select []string
+
+	// MigratingToDirect is set when the existing state still uses terraform, so it is
+	// migrated to the direct engine in memory before the command runs (statemgmt.Migrate).
+	// Deploy and destroy commit the migration (statemgmt.CommitMigration); other commands
+	// leave the terraform state untouched.
+	MigratingToDirect bool
+
+	// AllowTerraformEngineConfig reports a terraform bundle.engine as a warning instead
+	// of an error and skips the DATABRICKS_BUNDLE_ENGINE check. Set by read-only commands
+	// (bundle summary) so users can still inspect a bundle that pins the removed engine.
+	AllowTerraformEngineConfig bool
+
+	// Quiet is the output verbosity reduction requested via -q/--quiet, which is
+	// repeatable: QuietSummary drops the per-resource lines, QuietAll additionally
+	// drops the summary and progress lines, leaving warnings and errors.
+	Quiet QuietLevel
+
 	// SkipLocalFileValidation makes path translation tolerant of missing local files.
 	// When set, TranslatePaths computes workspace paths without verifying files exist.
 	// Used by config-remote-sync: a user may modify resource paths remotely (e.g.,
@@ -180,9 +239,11 @@ func Load(ctx context.Context, path string) (*Bundle, error) {
 // MustLoad returns a bundle configuration.
 // The errors are recorded by logdiag, check with logdiag.HasError().
 func MustLoad(ctx context.Context) *Bundle {
-	root, err := mustGetRoot(ctx)
-	if err != nil {
-		logdiag.LogError(ctx, err)
+	root, diags := mustGetRoot(ctx)
+	if diags.HasError() {
+		for _, d := range diags {
+			logdiag.LogDiag(ctx, d)
+		}
 		return nil
 	}
 
@@ -200,9 +261,11 @@ func MustLoad(ctx context.Context) *Bundle {
 // The errors are recorded by logdiag, check with logdiag.HasError().
 // It returns a `nil` bundle if a bundle was not found.
 func TryLoad(ctx context.Context) *Bundle {
-	root, err := tryGetRoot(ctx)
-	if err != nil {
-		logdiag.LogError(ctx, err)
+	root, diags := tryGetRoot(ctx)
+	if diags.HasError() {
+		for _, d := range diags {
+			logdiag.LogDiag(ctx, d)
+		}
 		return nil
 	}
 
@@ -337,7 +400,8 @@ func (b *Bundle) GetSyncIncludePatterns(ctx context.Context) ([]string, error) {
 	if err != nil {
 		return nil, err
 	}
-	return append(b.Config.Sync.Include, filepath.ToSlash(filepath.Join(internalDirRel, "*.*"))), nil
+	includes := append(b.Config.Sync.Include, filepath.ToSlash(filepath.Join(internalDirRel, "*.*")))
+	return includes, nil
 }
 
 // AuthEnv returns a map with environment variables and their values
@@ -364,7 +428,7 @@ func (b *Bundle) StateFilenameTerraform(ctx context.Context) (string, string) {
 	return terraformStateFilename, filepath.ToSlash(filepath.Join(b.GetLocalStateDir(ctx), "terraform", terraformStateFilename))
 }
 
-// StateFilenameConfigSnapshot returns (relative remote path, relative local path) for config snapshot state
-func (b *Bundle) StateFilenameConfigSnapshot(ctx context.Context) (string, string) {
-	return configSnapshotFilename, filepath.ToSlash(filepath.Join(b.GetLocalStateDir(ctx), configSnapshotFilename))
+// IsImmutableFolder reports whether experimental.immutable_folder is enabled.
+func (b *Bundle) IsImmutableFolder() bool {
+	return b.Config.Experimental != nil && b.Config.Experimental.ImmutableFolder
 }
diff --git a/bundle/bundle_test.go b/bundle/bundle_test.go
index 37928cb8801..9bd667afe62 100644
--- a/bundle/bundle_test.go
+++ b/bundle/bundle_test.go
@@ -1,7 +1,6 @@
 package bundle
 
 import (
-	"io/fs"
 	"os"
 	"path/filepath"
 	"testing"
@@ -38,7 +37,7 @@ func tryLoad(t *testing.T) (*Bundle, []diag.Diagnostic) {
 
 func TestLoadNotExists(t *testing.T) {
 	b, err := Load(t.Context(), "/doesntexist")
-	assert.ErrorIs(t, err, fs.ErrNotExist)
+	assert.ErrorContains(t, err, "databricks.yml not found")
 	assert.Nil(t, b)
 }
 
@@ -110,7 +109,7 @@ func TestBundleMustLoadFailureWithEnv(t *testing.T) {
 	b, diags := mustLoad(t)
 	require.Nil(t, b)
 	require.Len(t, diags, 1, "expected diagnostics")
-	assert.Contains(t, diags[0].Summary, "invalid bundle root")
+	assert.Contains(t, diags[0].Summary, "Invalid bundle root")
 	assert.Equal(t, diag.Error, diags[0].Severity)
 }
 
@@ -119,7 +118,7 @@ func TestBundleMustLoadFailureIfNotFound(t *testing.T) {
 	b, diags := mustLoad(t)
 	require.Nil(t, b)
 	require.Len(t, diags, 1, "expected diagnostics")
-	assert.Contains(t, diags[0].Summary, "unable to locate bundle root")
+	assert.Contains(t, diags[0].Summary, "Unable to locate the bundle root")
 	assert.Equal(t, diag.Error, diags[0].Severity)
 }
 
@@ -136,7 +135,7 @@ func TestBundleTryLoadFailureWithEnv(t *testing.T) {
 	b, diags := tryLoad(t)
 	require.Nil(t, b)
 	require.Len(t, diags, 1, "expected diagnostics")
-	assert.Contains(t, diags[0].Summary, "invalid bundle root")
+	assert.Contains(t, diags[0].Summary, "Invalid bundle root")
 	assert.Equal(t, diag.Error, diags[0].Severity)
 }
 
diff --git a/bundle/config/artifact.go b/bundle/config/artifact.go
index cb029bcb4be..ad5c79ae9b6 100644
--- a/bundle/config/artifact.go
+++ b/bundle/config/artifact.go
@@ -12,14 +12,28 @@ const ArtifactPythonWheel ArtifactType = `whl`
 
 const ArtifactJar ArtifactType = `jar`
 
+// ArtifactTarball is a gzipped tar of source files, built by DABs itself from
+// `include` paths and/or a `git` ref rather than by a user `build` command.
+// Uploaded and referenced like any other artifact file (e.g. as an AI Runtime
+// task's code_source_path).
+const ArtifactTarball ArtifactType = `tgz`
+
 // Values returns all valid ArtifactType values
 func (ArtifactType) Values() []ArtifactType {
 	return []ArtifactType{
 		ArtifactPythonWheel,
 		ArtifactJar,
+		ArtifactTarball,
 	}
 }
 
+// ArtifactGit pins a `tgz` artifact to a git ref, so the tarball is a snapshot of
+// that ref rather than of the working tree. Commit wins over Branch when both set.
+type ArtifactGit struct {
+	Branch string `json:"branch,omitempty"`
+	Commit string `json:"commit,omitempty"`
+}
+
 type ArtifactFile struct {
 	Source string `json:"source"`
 
@@ -46,4 +60,14 @@ type Artifact struct {
 	Executable exec.ExecutableType `json:"executable,omitempty"`
 
 	DynamicVersion bool `json:"dynamic_version,omitempty"`
+
+	// Include narrows a `tgz` artifact to these subpaths of `path`, relative to it;
+	// empty packs the whole `path`. .gitignore is honored; the bundle-wide
+	// sync.include/exclude do not apply. Archive entries are named relative to
+	// `path`. Mutually exclusive with `build`.
+	Include []string `json:"include,omitempty"`
+
+	// Git, when set on a `tgz` artifact, snapshots the given ref instead of the
+	// working tree. Mutually exclusive with `build`.
+	Git *ArtifactGit `json:"git,omitempty"`
 }
diff --git a/bundle/config/bundle.go b/bundle/config/bundle.go
index ce6d25bfe62..8a46641212a 100644
--- a/bundle/config/bundle.go
+++ b/bundle/config/bundle.go
@@ -23,8 +23,8 @@ type Bundle struct {
 	// DEPRECATED. Left for backward compatibility with Target
 	Environment string `json:"environment,omitempty" bundle:"readonly"`
 
-	// Terraform holds configuration related to Terraform.
-	// For example, where to find the binary, which version to use, etc.
+	// DEPRECATED. The Terraform engine was removed, so this setting is ignored
+	// (a warning is reported if it is set). Kept so existing configs still parse.
 	Terraform *Terraform `json:"terraform,omitempty" bundle:"readonly"`
 
 	// Force-override Git branch validation.
@@ -46,7 +46,8 @@ type Bundle struct {
 	// Overrides the cluster used for jobs and other supported assets.
 	ClusterId string `json:"cluster_id,omitempty"`
 
-	// Engine specifies the deployment engine to use ("terraform" or "direct").
+	// Engine specifies the deployment engine to use. "direct" is the only supported
+	// engine and the default; "terraform" is rejected with the removal error.
 	// Can be overridden with the DATABRICKS_BUNDLE_ENGINE environment variable.
 	Engine engine.EngineType `json:"engine,omitempty"`
 
diff --git a/bundle/config/deployment.go b/bundle/config/deployment.go
index b7efb4456f9..3b3f65608b3 100644
--- a/bundle/config/deployment.go
+++ b/bundle/config/deployment.go
@@ -7,4 +7,16 @@ type Deployment struct {
 
 	// Lock configures locking behavior on deployment.
 	Lock Lock `json:"lock,omitempty"`
+
+	// DeploymentID is the ID the service assigned to this bundle's deployment.
+	DeploymentID string `json:"deployment_id,omitempty"`
+
+	// LatestVersionID is the most recent version recorded for the deployment. It is
+	// zero when the deployment exists but has no version yet.
+	LatestVersionID int `json:"latest_version_id,omitempty"`
+
+	// ForceSendFields records which fields were explicitly set so that zero-value
+	// overrides can replace non-zero base values (e.g., fail_on_active_runs: false).
+	// This field is not serialized to JSON.
+	ForceSendFields []string `json:"-"`
 }
diff --git a/bundle/config/engine/engine.go b/bundle/config/engine/engine.go
index c2c251e8f9b..f483d563c08 100644
--- a/bundle/config/engine/engine.go
+++ b/bundle/config/engine/engine.go
@@ -17,8 +17,31 @@ const (
 	EngineNotSet    EngineType = ""
 )
 
-// Default is used for new bundles if user has not set the value
-const Default = EngineTerraform
+// Default is used when the user has not set the value, both for new bundles and
+// for existing terraform deployments (whose state is migrated to it before the command runs).
+const Default = EngineDirect
+
+// TerraformRemovedConfigMessage and TerraformRemovedEnvMessage are the error text
+// shown when a bundle pins the removed Terraform deployment engine via
+// bundle.engine or DATABRICKS_BUNDLE_ENGINE respectively. "terraform" is still
+// recognized as a value so we can point at this specific removal rather than
+// reporting it as an unrecognized setting.
+const (
+	TerraformRemovedConfigMessage = TerraformRemovedSummary + "\n\n" + TerraformRemovedConfigDetail
+	TerraformRemovedEnvMessage    = TerraformRemovedSummary + "\n\n" + TerraformRemovedEnvDetail
+)
+
+// TerraformRemovedSummary and TerraformRemovedConfigDetail are the two parts of
+// TerraformRemovedConfigMessage, for callers that report it as a diagnostic.
+const TerraformRemovedSummary = `the Terraform deployment engine has been removed in Databricks CLI v1.20.0`
+
+const (
+	TerraformRemovedConfigDetail = `Remove the "bundle.engine" setting (or set it to "direct") to deploy with the direct engine; ` + terraformRemovedHint
+	TerraformRemovedEnvDetail    = `Unset the ` + EnvVar + ` environment variable (or set it to "direct") to deploy with the direct engine; ` + terraformRemovedHint
+)
+
+const terraformRemovedHint = `existing Terraform state is migrated automatically. To keep using Terraform, revert to Databricks CLI v1.19.x.
+See https://docs.databricks.com/dev-tools/bundles/direct for details`
 
 // Parse returns EngineType from string
 func Parse(engine string) (EngineType, bool) {
@@ -39,18 +62,11 @@ func FromEnv(ctx context.Context) (EngineType, error) {
 	value := env.Get(ctx, EnvVar)
 	engine, ok := Parse(value)
 	if !ok {
-		return EngineNotSet, fmt.Errorf("unexpected setting for %s=%#v (expected 'terraform' or 'direct')", EnvVar, value)
+		return EngineNotSet, fmt.Errorf("unexpected setting for %s=%#v (expected 'direct')", EnvVar, value)
 	}
 	return engine, nil
 }
 
-// EngineSetting represents a requested engine type along with the source of the request.
-type EngineSetting struct {
-	Type       EngineType // effective resolved engine
-	Source     string     // human-readable source of Type
-	ConfigType EngineType // from bundle config (EngineNotSet if not configured)
-}
-
 func (e EngineType) ThisOrDefault() EngineType {
 	if e == EngineNotSet {
 		return Default
diff --git a/bundle/config/experimental.go b/bundle/config/experimental.go
index 2f8aaac0dea..6fd5511b79b 100644
--- a/bundle/config/experimental.go
+++ b/bundle/config/experimental.go
@@ -3,6 +3,13 @@ package config
 type Experimental struct {
 	Scripts map[ScriptHook]Command `json:"scripts,omitempty"`
 
+	// ImmutableFolder specifies that bundle files and artifacts are uploaded as a
+	// single immutable snapshot rather than being synced individually. When true,
+	// the deployment calls /api/2.0/repos/snapshots with a zip of all files and sets
+	// workspace.file_path and workspace.artifact_path to the returned content-addressed
+	// path.
+	ImmutableFolder bool `json:"immutable_folder,omitempty"`
+
 	// By default Python wheel tasks deployed as is to Databricks platform.
 	// If notebook wrapper required (for example, used in DBR < 13.1 or other configuration differences), users can provide a following experimental setting
 	// experimental:
@@ -42,6 +49,15 @@ type Experimental struct {
 	// Eventually this can be made the default once we have native CRUD in DABs
 	// at which point we can deprecate or remove this field all together.
 	SkipNamePrefixForSchema bool `json:"skip_name_prefix_for_schema,omitempty"`
+
+	// DeploymentHistory opts the bundle into the deployment metadata
+	// service (DMS), which records deployment history and tracks what changed
+	// across deployments.
+	//
+	// Only for bundles with no deployed resources yet: DMS becomes the source of
+	// truth for their state.
+	// An explicit value takes priority over the environment setting.
+	DeploymentHistory *bool `json:"deployment_history,omitempty"`
 }
 
 type Python struct {
diff --git a/bundle/config/filename.go b/bundle/config/filename.go
index 11af34d9cf7..ce72cff2ce2 100644
--- a/bundle/config/filename.go
+++ b/bundle/config/filename.go
@@ -18,7 +18,6 @@ var FileNames = ConfigFileNames{
 
 func (c ConfigFileNames) FindInPath(path string) (string, error) {
 	result := ""
-	var firstErr error
 
 	for _, file := range c {
 		filePath := filepath.Join(path, file)
@@ -28,15 +27,11 @@ func (c ConfigFileNames) FindInPath(path string) (string, error) {
 				return "", fmt.Errorf("multiple bundle root configuration files found in %s", path)
 			}
 			result = filePath
-		} else {
-			if firstErr == nil {
-				firstErr = err
-			}
 		}
 	}
 
 	if result == "" {
-		return "", firstErr
+		return "", fmt.Errorf("%s not found", c[0])
 	}
 
 	return result, nil
diff --git a/bundle/config/filename_test.go b/bundle/config/filename_test.go
index 9d71fa7e867..47d4fd22aa4 100644
--- a/bundle/config/filename_test.go
+++ b/bundle/config/filename_test.go
@@ -3,7 +3,6 @@ package config
 import (
 	"os"
 	"path/filepath"
-	"runtime"
 	"strings"
 	"testing"
 
@@ -39,14 +38,10 @@ func TestConfigFileNames_FindInPath(t *testing.T) {
 			name:     "file not found",
 			files:    []string{},
 			expected: "",
-			err:      "no such file or directory",
+			err:      "databricks.yml not found",
 		},
 	}
 
-	if runtime.GOOS == "windows" {
-		testCases[3].err = "The system cannot find the file specified."
-	}
-
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
 			projectDir := t.TempDir()
diff --git a/bundle/config/loader/process_include.go b/bundle/config/loader/process_include.go
index 3a64297814c..064855caca2 100644
--- a/bundle/config/loader/process_include.go
+++ b/bundle/config/loader/process_include.go
@@ -11,6 +11,7 @@ import (
 	"github.com/databricks/cli/bundle/config"
 	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/structs/structpath"
 )
 
 func validateFileFormat(configRoot dyn.Value, filePath string) diag.Diagnostics {
@@ -107,17 +108,17 @@ func validateSingleResourceDefined(configRoot dyn.Value, ext, typ string) diag.D
 		detail.WriteString(l)
 	}
 
-	var locations []dyn.Location
-	var paths []dyn.Path
+	var locations []diag.Location
+	var paths []*structpath.PathNode
 	for _, rr := range resources {
 		locations = append(locations, rr.value.Locations()...)
-		paths = append(paths, rr.path)
+		paths = append(paths, dyn.ToStructPath(rr.path))
 	}
 	// Sort the locations and paths to make the output deterministic.
-	slices.SortFunc(locations, func(a, b dyn.Location) int {
+	slices.SortFunc(locations, func(a, b diag.Location) int {
 		return cmp.Compare(a.String(), b.String())
 	})
-	slices.SortFunc(paths, func(a, b dyn.Path) int {
+	slices.SortFunc(paths, func(a, b *structpath.PathNode) int {
 		return cmp.Compare(a.String(), b.String())
 	})
 
@@ -168,7 +169,7 @@ func (m *processInclude) Apply(_ context.Context, b *bundle.Bundle) diag.Diagnos
 			Detail: `An include section is defined in a file that is not databricks.yml.
 Only includes defined in databricks.yml are applied.`,
 			Locations: this.GetLocations("include"),
-			Paths:     []dyn.Path{dyn.MustPathFromString("include")},
+			Paths:     structpath.NewPathSlice("include"),
 		})
 	}
 
diff --git a/bundle/config/loader/process_include_test.go b/bundle/config/loader/process_include_test.go
index c768dc57dc9..16ed455e622 100644
--- a/bundle/config/loader/process_include_test.go
+++ b/bundle/config/loader/process_include_test.go
@@ -8,7 +8,7 @@ import (
 	"github.com/databricks/cli/bundle/config"
 	"github.com/databricks/cli/bundle/config/loader"
 	"github.com/databricks/cli/libs/diag"
-	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/structs/structpath"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -67,14 +67,14 @@ func TestProcessIncludeFormatNotMatch(t *testing.T) {
 				Severity: diag.Recommendation,
 				Summary:  "define a single pipeline in a file with the .pipeline.yaml extension.",
 				Detail:   "The following resources are defined or configured in this file:\n  - job1 (job)\n",
-				Locations: []dyn.Location{
+				Locations: []diag.Location{
 					{File: "testdata/format_not_match/single_job.pipeline.yaml", Line: 11, Column: 11},
 					{File: "testdata/format_not_match/single_job.pipeline.yaml", Line: 4, Column: 7},
 				},
-				Paths: []dyn.Path{
-					dyn.MustPathFromString("resources.jobs.job1"),
-					dyn.MustPathFromString("targets.target1.resources.jobs.job1"),
-				},
+				Paths: structpath.MustParsePaths(
+					"resources.jobs.job1",
+					"targets.target1.resources.jobs.job1",
+				),
 			},
 		},
 		"job_and_pipeline.job.yml": {
@@ -82,14 +82,14 @@ func TestProcessIncludeFormatNotMatch(t *testing.T) {
 				Severity: diag.Recommendation,
 				Summary:  "define a single job in a file with the .job.yml extension.",
 				Detail:   "The following resources are defined or configured in this file:\n  - job1 (job)\n  - pipeline1 (pipeline)\n",
-				Locations: []dyn.Location{
+				Locations: []diag.Location{
 					{File: "testdata/format_not_match/job_and_pipeline.job.yml", Line: 11, Column: 11},
 					{File: "testdata/format_not_match/job_and_pipeline.job.yml", Line: 4, Column: 7},
 				},
-				Paths: []dyn.Path{
-					dyn.MustPathFromString("resources.pipelines.pipeline1"),
-					dyn.MustPathFromString("targets.target1.resources.jobs.job1"),
-				},
+				Paths: structpath.MustParsePaths(
+					"resources.pipelines.pipeline1",
+					"targets.target1.resources.jobs.job1",
+				),
 			},
 		},
 		"job_and_pipeline.experiment.yml": {
@@ -97,14 +97,14 @@ func TestProcessIncludeFormatNotMatch(t *testing.T) {
 				Severity: diag.Recommendation,
 				Summary:  "define a single experiment in a file with the .experiment.yml extension.",
 				Detail:   "The following resources are defined or configured in this file:\n  - job1 (job)\n  - pipeline1 (pipeline)\n",
-				Locations: []dyn.Location{
+				Locations: []diag.Location{
 					{File: "testdata/format_not_match/job_and_pipeline.experiment.yml", Line: 11, Column: 11},
 					{File: "testdata/format_not_match/job_and_pipeline.experiment.yml", Line: 4, Column: 7},
 				},
-				Paths: []dyn.Path{
-					dyn.MustPathFromString("resources.pipelines.pipeline1"),
-					dyn.MustPathFromString("targets.target1.resources.jobs.job1"),
-				},
+				Paths: structpath.MustParsePaths(
+					"resources.pipelines.pipeline1",
+					"targets.target1.resources.jobs.job1",
+				),
 			},
 		},
 		"two_jobs.job.yml": {
@@ -112,14 +112,14 @@ func TestProcessIncludeFormatNotMatch(t *testing.T) {
 				Severity: diag.Recommendation,
 				Summary:  "define a single job in a file with the .job.yml extension.",
 				Detail:   "The following resources are defined or configured in this file:\n  - job1 (job)\n  - job2 (job)\n",
-				Locations: []dyn.Location{
+				Locations: []diag.Location{
 					{File: "testdata/format_not_match/two_jobs.job.yml", Line: 4, Column: 7},
 					{File: "testdata/format_not_match/two_jobs.job.yml", Line: 7, Column: 7},
 				},
-				Paths: []dyn.Path{
-					dyn.MustPathFromString("resources.jobs.job1"),
-					dyn.MustPathFromString("resources.jobs.job2"),
-				},
+				Paths: structpath.MustParsePaths(
+					"resources.jobs.job1",
+					"resources.jobs.job2",
+				),
 			},
 		},
 		"second_job_in_target.job.yml": {
@@ -127,14 +127,14 @@ func TestProcessIncludeFormatNotMatch(t *testing.T) {
 				Severity: diag.Recommendation,
 				Summary:  "define a single job in a file with the .job.yml extension.",
 				Detail:   "The following resources are defined or configured in this file:\n  - job1 (job)\n  - job2 (job)\n",
-				Locations: []dyn.Location{
+				Locations: []diag.Location{
 					{File: "testdata/format_not_match/second_job_in_target.job.yml", Line: 11, Column: 11},
 					{File: "testdata/format_not_match/second_job_in_target.job.yml", Line: 4, Column: 7},
 				},
-				Paths: []dyn.Path{
-					dyn.MustPathFromString("resources.jobs.job1"),
-					dyn.MustPathFromString("targets.target1.resources.jobs.job2"),
-				},
+				Paths: structpath.MustParsePaths(
+					"resources.jobs.job1",
+					"targets.target1.resources.jobs.job2",
+				),
 			},
 		},
 		"two_jobs_in_target.job.yml": {
@@ -142,14 +142,14 @@ func TestProcessIncludeFormatNotMatch(t *testing.T) {
 				Severity: diag.Recommendation,
 				Summary:  "define a single job in a file with the .job.yml extension.",
 				Detail:   "The following resources are defined or configured in this file:\n  - job1 (job)\n  - job2 (job)\n",
-				Locations: []dyn.Location{
+				Locations: []diag.Location{
 					{File: "testdata/format_not_match/two_jobs_in_target.job.yml", Line: 6, Column: 11},
 					{File: "testdata/format_not_match/two_jobs_in_target.job.yml", Line: 8, Column: 11},
 				},
-				Paths: []dyn.Path{
-					dyn.MustPathFromString("targets.target1.resources.jobs.job1"),
-					dyn.MustPathFromString("targets.target1.resources.jobs.job2"),
-				},
+				Paths: structpath.MustParsePaths(
+					"targets.target1.resources.jobs.job1",
+					"targets.target1.resources.jobs.job2",
+				),
 			},
 		},
 		"multiple_resources.model_serving_endpoint.yml": {
@@ -169,7 +169,7 @@ func TestProcessIncludeFormatNotMatch(t *testing.T) {
   - registered_model1 (registered_model)
   - schema1 (schema)
 `,
-				Locations: []dyn.Location{
+				Locations: []diag.Location{
 					{File: "testdata/format_not_match/multiple_resources.model_serving_endpoint.yml", Line: 12, Column: 7},
 					{File: "testdata/format_not_match/multiple_resources.model_serving_endpoint.yml", Line: 14, Column: 7},
 					{File: "testdata/format_not_match/multiple_resources.model_serving_endpoint.yml", Line: 18, Column: 7},
@@ -182,19 +182,19 @@ func TestProcessIncludeFormatNotMatch(t *testing.T) {
 					{File: "testdata/format_not_match/multiple_resources.model_serving_endpoint.yml", Line: 4, Column: 7},
 					{File: "testdata/format_not_match/multiple_resources.model_serving_endpoint.yml", Line: 8, Column: 7},
 				},
-				Paths: []dyn.Path{
-					dyn.MustPathFromString("resources.experiments.experiment1"),
-					dyn.MustPathFromString("resources.jobs.job1"),
-					dyn.MustPathFromString("resources.jobs.job2"),
-					dyn.MustPathFromString("resources.model_serving_endpoints.model_serving_endpoint1"),
-					dyn.MustPathFromString("resources.models.model1"),
-					dyn.MustPathFromString("resources.pipelines.pipeline1"),
-					dyn.MustPathFromString("resources.pipelines.pipeline2"),
-					dyn.MustPathFromString("resources.schemas.schema1"),
-					dyn.MustPathFromString("targets.target1.resources.jobs.job3"),
-					dyn.MustPathFromString("targets.target1.resources.quality_monitors.quality_monitor1"),
-					dyn.MustPathFromString("targets.target1.resources.registered_models.registered_model1"),
-				},
+				Paths: structpath.MustParsePaths(
+					"resources.experiments.experiment1",
+					"resources.jobs.job1",
+					"resources.jobs.job2",
+					"resources.model_serving_endpoints.model_serving_endpoint1",
+					"resources.models.model1",
+					"resources.pipelines.pipeline1",
+					"resources.pipelines.pipeline2",
+					"resources.schemas.schema1",
+					"targets.target1.resources.jobs.job3",
+					"targets.target1.resources.quality_monitors.quality_monitor1",
+					"targets.target1.resources.registered_models.registered_model1",
+				),
 			},
 		},
 	} {
diff --git a/bundle/config/loader/process_root_includes.go b/bundle/config/loader/process_root_includes.go
index 934c777a90a..655ca27162b 100644
--- a/bundle/config/loader/process_root_includes.go
+++ b/bundle/config/loader/process_root_includes.go
@@ -10,6 +10,7 @@ import (
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/bundle/config"
 	"github.com/databricks/cli/libs/diag"
+	"github.com/databricks/cli/libs/dyn"
 )
 
 type processRootIncludes struct{}
@@ -39,6 +40,10 @@ func hasGlobCharacters(path string) (string, bool) {
 func (m *processRootIncludes) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
 	var out []bundle.Mutator
 
+	// Preserve the raw include patterns before they are replaced below with the
+	// expanded list of loaded files, so IsFileIncluded can re-match against them.
+	b.SetIncludePatterns(b.Config.Include)
+
 	// Map with files we've already seen to avoid loading them twice.
 	seen := map[string]bool{}
 
@@ -72,7 +77,7 @@ func (m *processRootIncludes) Apply(ctx context.Context, b *bundle.Bundle) diag.
 	// For each glob, find all files to load.
 	// Ordering of the list of globs is maintained in the output.
 	// For matches that appear in multiple globs, only the first is kept.
-	for _, entry := range b.Config.Include {
+	for entryIndex, entry := range b.Config.Include {
 		// Include paths must be relative.
 		if filepath.IsAbs(entry) {
 			return diag.Errorf("%s: includes must be relative paths", entry)
@@ -92,7 +97,7 @@ func (m *processRootIncludes) Apply(ctx context.Context, b *bundle.Bundle) diag.
 
 		// Filter matches to ones we haven't seen yet.
 		var includes []string
-		for i, match := range matches {
+		for _, match := range matches {
 			rel, err := filepath.Rel(b.BundleRootPath, match)
 			if err != nil {
 				return diag.FromErr(err)
@@ -103,10 +108,11 @@ func (m *processRootIncludes) Apply(ctx context.Context, b *bundle.Bundle) diag.
 			seen[rel] = true
 			if filepath.Ext(rel) != ".yaml" && filepath.Ext(rel) != ".yml" && filepath.Ext(rel) != ".json" {
 				diags = diags.Append(diag.Diagnostic{
-					Severity:  diag.Error,
-					Summary:   "Files in the 'include' configuration section must be YAML or JSON files.",
-					Detail:    fmt.Sprintf("The file %s in the 'include' configuration section is not a YAML or JSON file, and only such files are supported. To include files to sync, specify them in the 'sync.include' configuration section instead.", rel),
-					Locations: b.Config.GetLocations(fmt.Sprintf("include[%d]", i)),
+					Severity: diag.Error,
+					Summary:  "Files in the 'include' configuration section must be YAML or JSON files.",
+					Detail:   fmt.Sprintf("The file %s in the 'include' configuration section is not a YAML or JSON file, and only such files are supported. To include files to sync, specify them in the 'sync.include' configuration section instead.", rel),
+					// The match's index within the glob is unrelated to the entry's position in the include list.
+					Locations: b.Config.GetLocations(fmt.Sprintf("include[%d]", entryIndex)),
 				})
 				continue
 			}
@@ -125,13 +131,35 @@ func (m *processRootIncludes) Apply(ctx context.Context, b *bundle.Bundle) diag.
 		}
 	}
 
-	// Swap out the original includes list with the expanded globs.
-	b.Config.Include = files
+	// Swap out the original includes list with the expanded globs. This goes through
+	// Mutate so the dynamic tree is updated too: the includes below are applied without
+	// their own mutator scope, so nothing converts the typed field back into the dynamic
+	// tree afterwards, and the next ToTyped would otherwise restore the raw patterns.
+	err := b.Config.Mutate(func(root dyn.Value) (dyn.Value, error) {
+		// Include is omitempty in the typed configuration, so an empty list must stay
+		// absent from the dynamic tree rather than be written as [].
+		if len(files) == 0 {
+			return dyn.DropKeys(root, []string{"include"})
+		}
+
+		includeValues := make([]dyn.Value, 0, len(files))
+		for _, file := range files {
+			includeValues = append(includeValues, dyn.V(file))
+		}
+		return dyn.Set(root, "include", dyn.NewValue(includeValues, root.Get("include").Locations()))
+	})
+	if err != nil {
+		return diag.FromErr(err)
+	}
 
 	// Track number of bundle YAML (or JSON) files in the configuration. The +1 is there
 	// to account for the root databricks.yaml file.
 	b.Metrics.ConfigurationFileCount = int64(len(files)) + 1
 
-	bundle.ApplySeqContext(ctx, b, out...)
+	// ProcessInclude merges into the configuration via [config.Root.Merge], so it does
+	// not need its own mutator scope. Giving each included file one would re-convert the
+	// whole accumulated configuration per file, making load quadratic in the number of
+	// included files (~20 minutes for 6000 files).
+	bundle.ApplySeqInScopeContext(ctx, b, out...)
 	return nil
 }
diff --git a/bundle/config/loader/process_root_includes_test.go b/bundle/config/loader/process_root_includes_test.go
index cb98037507f..e7a850a835b 100644
--- a/bundle/config/loader/process_root_includes_test.go
+++ b/bundle/config/loader/process_root_includes_test.go
@@ -9,6 +9,7 @@ import (
 	"github.com/databricks/cli/bundle/config/loader"
 	"github.com/databricks/cli/internal/testutil"
 	"github.com/databricks/cli/libs/diag"
+	"github.com/databricks/cli/libs/dyn"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -98,6 +99,49 @@ func TestProcessRootIncludesRemoveDups(t *testing.T) {
 	assert.Equal(t, []string{"a.yml"}, b.Config.Include)
 }
 
+// The expanded include list must be visible in both the typed and the dynamic
+// configuration: the per-file includes are applied without their own mutator scope, so
+// nothing converts the typed field back into the dynamic tree afterwards.
+func TestProcessRootIncludesUpdatesDynamicValue(t *testing.T) {
+	b := &bundle.Bundle{
+		BundleRootPath: t.TempDir(),
+		Config: config.Root{
+			Include: []string{
+				"*.yml",
+			},
+		},
+	}
+
+	testutil.Touch(t, b.BundleRootPath, "databricks.yml")
+	testutil.Touch(t, b.BundleRootPath, "a.yml")
+
+	diags := bundle.Apply(t.Context(), b, loader.ProcessRootIncludes())
+	require.NoError(t, diags.Error())
+	assert.Equal(t, []string{"a.yml"}, b.Config.Include)
+
+	assert.Equal(t, []any{"a.yml"}, b.Config.Value().Get("include").AsAny())
+}
+
+// An empty include list must stay absent from the dynamic tree: the typed field is
+// omitempty, so writing [] would add an empty "include" to `bundle validate -o json`.
+func TestProcessRootIncludesEmptyOmitsDynamicValue(t *testing.T) {
+	b := &bundle.Bundle{
+		BundleRootPath: t.TempDir(),
+		Config: config.Root{
+			Include: []string{
+				"*.yml",
+			},
+		},
+	}
+
+	testutil.Touch(t, b.BundleRootPath, "databricks.yml")
+
+	diags := bundle.Apply(t.Context(), b, loader.ProcessRootIncludes())
+	require.NoError(t, diags.Error())
+	assert.Empty(t, b.Config.Include)
+	assert.Equal(t, dyn.KindInvalid, b.Config.Value().Get("include").Kind())
+}
+
 func TestProcessRootIncludesNotExists(t *testing.T) {
 	b := &bundle.Bundle{
 		BundleRootPath: t.TempDir(),
diff --git a/bundle/config/mutator/apply_source_linked_deployment_preset.go b/bundle/config/mutator/apply_source_linked_deployment_preset.go
index c1e817673d9..695edabc68a 100644
--- a/bundle/config/mutator/apply_source_linked_deployment_preset.go
+++ b/bundle/config/mutator/apply_source_linked_deployment_preset.go
@@ -8,7 +8,7 @@ import (
 	"github.com/databricks/cli/bundle/config"
 	"github.com/databricks/cli/libs/dbr"
 	"github.com/databricks/cli/libs/diag"
-	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/structs/structpath"
 )
 
 type applySourceLinkedDeploymentPreset struct{}
@@ -31,17 +31,15 @@ func (m *applySourceLinkedDeploymentPreset) Apply(ctx context.Context, b *bundle
 	isDatabricksWorkspace := dbr.RunsOnRuntime(ctx) && strings.HasPrefix(b.SyncRootPath, "/Workspace/")
 	target := b.Config.Bundle.Target
 
-	if config.IsExplicitlyEnabled((b.Config.Presets.SourceLinkedDeployment)) {
+	if config.IsExplicitlyEnabled(b.Config.Presets.SourceLinkedDeployment) {
 		if !isDatabricksWorkspace {
-			path := dyn.NewPath(dyn.Key("targets"), dyn.Key(target), dyn.Key("presets"), dyn.Key("source_linked_deployment"))
+			path := structpath.NewPath(nil, "targets", target, "presets", "source_linked_deployment")
 			diags = diags.Append(
 				diag.Diagnostic{
-					Severity: diag.Warning,
-					Summary:  "source-linked deployment is available only in the Databricks Workspace",
-					Paths: []dyn.Path{
-						path,
-					},
-					Locations: b.Config.GetLocations(path[2:].String()),
+					Severity:  diag.Warning,
+					Summary:   "source-linked deployment is available only in the Databricks Workspace",
+					Paths:     []*structpath.PathNode{path},
+					Locations: b.Config.GetLocationsOf(path.SkipPrefix(2)),
 				},
 			)
 
@@ -53,15 +51,13 @@ func (m *applySourceLinkedDeploymentPreset) Apply(ctx context.Context, b *bundle
 		b.Metrics.AddBoolValue("source_linked_set_for_non_development", b.Config.Bundle.Mode != config.Development)
 
 		if b.Config.Bundle.Mode != config.Development {
-			path := dyn.NewPath(dyn.Key("targets"), dyn.Key(target), dyn.Key("presets"), dyn.Key("source_linked_deployment"))
+			path := structpath.NewPath(nil, "targets", target, "presets", "source_linked_deployment")
 			diags = diags.Append(
 				diag.Diagnostic{
-					Severity: diag.Warning,
-					Summary:  "source-linked deployment in non-development mode is deprecated and will not be supported in a future release",
-					Paths: []dyn.Path{
-						path,
-					},
-					Locations: b.Config.GetLocations(path[2:].String()),
+					Severity:  diag.Warning,
+					Summary:   "source-linked deployment in non-development mode is deprecated and will not be supported in a future release",
+					Paths:     []*structpath.PathNode{path},
+					Locations: b.Config.GetLocationsOf(path.SkipPrefix(2)),
 				},
 			)
 		}
@@ -74,16 +70,14 @@ func (m *applySourceLinkedDeploymentPreset) Apply(ctx context.Context, b *bundle
 
 	// This mutator runs before workspace paths are defaulted so it's safe to check for the user-defined value
 	if b.Config.Workspace.FilePath != "" && config.IsExplicitlyEnabled(b.Config.Presets.SourceLinkedDeployment) {
-		path := dyn.NewPath(dyn.Key("workspace"), dyn.Key("file_path"))
+		path := structpath.NewPath(nil, "workspace", "file_path")
 		diags = diags.Append(
 			diag.Diagnostic{
-				Severity: diag.Warning,
-				Summary:  "workspace.file_path setting will be ignored in source-linked deployment mode",
-				Detail:   "In source-linked deployment files are not copied to the destination and resources use source files instead",
-				Paths: []dyn.Path{
-					path,
-				},
-				Locations: b.Config.GetLocations(path.String()),
+				Severity:  diag.Warning,
+				Summary:   "workspace.file_path setting will be ignored in source-linked deployment mode",
+				Detail:    "In source-linked deployment files are not copied to the destination and resources use source files instead",
+				Paths:     []*structpath.PathNode{path},
+				Locations: b.Config.GetLocationsOf(path),
 			},
 		)
 	}
diff --git a/bundle/config/mutator/apply_source_linked_deployment_preset_test.go b/bundle/config/mutator/apply_source_linked_deployment_preset_test.go
index c0371077537..8d50788a3b3 100644
--- a/bundle/config/mutator/apply_source_linked_deployment_preset_test.go
+++ b/bundle/config/mutator/apply_source_linked_deployment_preset_test.go
@@ -11,7 +11,7 @@ import (
 	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/cli/bundle/internal/bundletest"
 	"github.com/databricks/cli/libs/dbr"
-	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/diag"
 	"github.com/stretchr/testify/require"
 )
 
@@ -128,8 +128,8 @@ func TestApplyPresetsSourceLinkedDeployment(t *testing.T) {
 				tt.mutateBundle(b)
 			}
 
-			bundletest.SetLocation(b, "presets.source_linked_deployment", []dyn.Location{{File: "databricks.yml"}})
-			bundletest.SetLocation(b, "workspace.file_path", []dyn.Location{{File: "databricks.yml"}})
+			bundletest.SetLocation(b, "presets.source_linked_deployment", []diag.Location{{File: "databricks.yml"}})
+			bundletest.SetLocation(b, "workspace.file_path", []diag.Location{{File: "databricks.yml"}})
 
 			diags := bundle.Apply(tt.ctx, b, mutator.ApplySourceLinkedDeploymentPreset())
 			if diags.HasError() && tt.expectedError == "" {
diff --git a/bundle/config/mutator/compute_id_compat.go b/bundle/config/mutator/compute_id_compat.go
index 8f1ff5868e8..35568441ce8 100644
--- a/bundle/config/mutator/compute_id_compat.go
+++ b/bundle/config/mutator/compute_id_compat.go
@@ -2,6 +2,7 @@ package mutator
 
 import (
 	"context"
+	"slices"
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/libs/diag"
@@ -23,12 +24,12 @@ func (m *computeIdToClusterId) Apply(ctx context.Context, b *bundle.Bundle) diag
 
 	// The "compute_id" key is set; rewrite it to "cluster_id".
 	err := b.Config.Mutate(func(v dyn.Value) (dyn.Value, error) {
-		v, d := rewriteComputeIdToClusterId(v, dyn.NewPath(dyn.Key("bundle")))
+		v, d := rewriteComputeIdToClusterId(v, dyn.NewPath(dyn.Key("bundle")), nil)
 		diags = diags.Extend(d)
 
 		// Check if the "compute_id" key is set in any target overrides.
 		return dyn.MapByPattern(v, dyn.NewPattern(dyn.Key("targets"), dyn.AnyKey()), func(p dyn.Path, v dyn.Value) (dyn.Value, error) {
-			v, d := rewriteComputeIdToClusterId(v, dyn.Path{})
+			v, d := rewriteComputeIdToClusterId(v, dyn.Path{}, p)
 			diags = diags.Extend(d)
 			return v, nil
 		})
@@ -38,7 +39,9 @@ func (m *computeIdToClusterId) Apply(ctx context.Context, b *bundle.Bundle) diag
 	return diags
 }
 
-func rewriteComputeIdToClusterId(v dyn.Value, p dyn.Path) (dyn.Value, diag.Diagnostics) {
+// rewriteComputeIdToClusterId rewrites p.compute_id to p.cluster_id in v; prefix is the
+// path of v in the configuration, used in the diagnostic.
+func rewriteComputeIdToClusterId(v dyn.Value, p, prefix dyn.Path) (dyn.Value, diag.Diagnostics) {
 	var diags diag.Diagnostics
 	computeIdPath := p.Append(dyn.Key("compute_id"))
 	computeId, err := dyn.GetByPath(v, computeIdPath)
@@ -55,7 +58,7 @@ func rewriteComputeIdToClusterId(v dyn.Value, p dyn.Path) (dyn.Value, diag.Diagn
 		Severity:  diag.Warning,
 		Summary:   "compute_id is deprecated, please use cluster_id instead",
 		Locations: computeId.Locations(),
-		Paths:     []dyn.Path{computeIdPath},
+		Paths:     dyn.ToStructPaths(slices.Concat(prefix, computeIdPath)),
 	})
 
 	clusterIdPath := p.Append(dyn.Key("cluster_id"))
diff --git a/bundle/config/mutator/default_workspace_paths.go b/bundle/config/mutator/default_workspace_paths.go
index 02a1ddb3b11..7e182ee5f30 100644
--- a/bundle/config/mutator/default_workspace_paths.go
+++ b/bundle/config/mutator/default_workspace_paths.go
@@ -5,6 +5,7 @@ import (
 	"path"
 
 	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/cli/libs/diag"
 )
 
@@ -26,7 +27,11 @@ func (m *defineDefaultWorkspacePaths) Apply(ctx context.Context, b *bundle.Bundl
 	}
 
 	if b.Config.Workspace.FilePath == "" {
-		b.Config.Workspace.FilePath = path.Join(root, "files")
+		if b.IsImmutableFolder() {
+			b.Config.Workspace.FilePath = resources.SnapshotFullPathRef + "/files"
+		} else {
+			b.Config.Workspace.FilePath = path.Join(root, "files")
+		}
 	}
 
 	if b.Config.Workspace.ResourcePath == "" {
@@ -34,7 +39,11 @@ func (m *defineDefaultWorkspacePaths) Apply(ctx context.Context, b *bundle.Bundl
 	}
 
 	if b.Config.Workspace.ArtifactPath == "" {
-		b.Config.Workspace.ArtifactPath = path.Join(root, "artifacts")
+		if b.IsImmutableFolder() {
+			b.Config.Workspace.ArtifactPath = resources.SnapshotFullPathRef + "/artifacts"
+		} else {
+			b.Config.Workspace.ArtifactPath = path.Join(root, "artifacts")
+		}
 	}
 
 	if b.Config.Workspace.StatePath == "" {
diff --git a/bundle/config/mutator/default_workspace_root.go b/bundle/config/mutator/default_workspace_root.go
index d7c24a5b557..b7571afbb85 100644
--- a/bundle/config/mutator/default_workspace_root.go
+++ b/bundle/config/mutator/default_workspace_root.go
@@ -3,11 +3,16 @@ package mutator
 import (
 	"context"
 	"fmt"
+	"strings"
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/libs/diag"
 )
 
+// How the bundle name and target appear in a configured root_path, which this mutator
+// sees before variable resolution replaces them.
+const nameTargetSuffix = "${bundle.name}/${bundle.target}"
+
 type defineDefaultWorkspaceRoot struct{}
 
 // DefineDefaultWorkspaceRoot defines the default workspace root path.
@@ -21,6 +26,7 @@ func (m *defineDefaultWorkspaceRoot) Name() string {
 
 func (m *defineDefaultWorkspaceRoot) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
 	if b.Config.Workspace.RootPath != "" {
+		b.RootPathIsNameTargetScoped = endsWithNameAndTarget(b.Config.Workspace.RootPath)
 		return nil
 	}
 
@@ -37,5 +43,13 @@ func (m *defineDefaultWorkspaceRoot) Apply(ctx context.Context, b *bundle.Bundle
 		b.Config.Bundle.Name,
 		b.Config.Bundle.Target,
 	)
+	b.RootPathIsNameTargetScoped = true
 	return nil
 }
+
+// endsWithNameAndTarget reports whether rootPath ends in the bundle name and target
+// references. Matched as a plain string: rootPath is not interpolated yet, so path
+// operations on it are not reliable.
+func endsWithNameAndTarget(rootPath string) bool {
+	return strings.HasSuffix(strings.TrimSuffix(rootPath, "/"), nameTargetSuffix)
+}
diff --git a/bundle/config/mutator/default_workspace_root_test.go b/bundle/config/mutator/default_workspace_root_test.go
index ad5dac4e42c..0a26c7ad596 100644
--- a/bundle/config/mutator/default_workspace_root_test.go
+++ b/bundle/config/mutator/default_workspace_root_test.go
@@ -24,3 +24,38 @@ func TestDefaultWorkspaceRoot(t *testing.T) {
 
 	assert.Equal(t, "~/.bundle/name/environment", b.Config.Workspace.RootPath)
 }
+
+func TestDefaultWorkspaceRootIsNameTargetScoped(t *testing.T) {
+	tcases := []struct {
+		name     string
+		rootPath string
+		scoped   bool
+	}{
+		{"defaulted", "", true},
+		{"name and target references", "~/.bundle/${bundle.name}/${bundle.target}", true},
+		{"references under another prefix", "/Workspace/Shared/${bundle.name}/${bundle.target}", true},
+		{"trailing slash", "~/.bundle/${bundle.name}/${bundle.target}/", true},
+		// Already-resolved segments are indistinguishable from a literal path that
+		// happens to match, so they do not count.
+		{"resolved values", "~/.bundle/name/environment", false},
+		{"target only", "~/.bundle/${bundle.target}", false},
+		{"name only", "~/.bundle/${bundle.name}", false},
+		{"extra segment below", "~/.bundle/${bundle.name}/${bundle.target}/inner", false},
+		{"unrelated path", "/Workspace/Shared/some/path", false},
+	}
+
+	for _, tc := range tcases {
+		t.Run(tc.name, func(t *testing.T) {
+			b := &bundle.Bundle{
+				Config: config.Root{
+					Bundle:    config.Bundle{Name: "name", Target: "environment"},
+					Workspace: config.Workspace{RootPath: tc.rootPath},
+				},
+			}
+			diags := bundle.Apply(t.Context(), b, mutator.DefineDefaultWorkspaceRoot())
+			require.NoError(t, diags.Error())
+
+			assert.Equal(t, tc.scoped, b.RootPathIsNameTargetScoped)
+		})
+	}
+}
diff --git a/bundle/config/mutator/drop_empty_strings.go b/bundle/config/mutator/drop_empty_strings.go
new file mode 100644
index 00000000000..028351ed943
--- /dev/null
+++ b/bundle/config/mutator/drop_empty_strings.go
@@ -0,0 +1,60 @@
+package mutator
+
+import (
+	"context"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/libs/diag"
+	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/dyn/convert"
+)
+
+type dropEmptyStrings struct{}
+
+// DropEmptyStrings removes empty-string values on omitempty resource fields, so
+// they are not force-sent to the backend. An empty string reaches this point
+// either literally (policy_id: "") or via a variable that resolved to "", so
+// this must run after variable resolution.
+//
+// The direct engine converts the resolved config through convert.ToTyped, which
+// force-sends explicitly-set zero values, defeating the omitempty tag. Dropping
+// here fixes it and makes the result visible in `bundle validate -o json`, which
+// serializes the dynamic value.
+func DropEmptyStrings() bundle.Mutator {
+	return &dropEmptyStrings{}
+}
+
+func (m *dropEmptyStrings) Name() string {
+	return "DropEmptyStrings"
+}
+
+func (m *dropEmptyStrings) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
+	var diags diag.Diagnostics
+	err := b.Config.Mutate(func(root dyn.Value) (dyn.Value, error) {
+		root, err := dyn.Map(root, "resources", func(_ dyn.Path, resources dyn.Value) (dyn.Value, error) {
+			// Normalize against the resources type so omitempty is known per field.
+			// Only DropEmptyStrings is set: existing values are kept as-is otherwise.
+			out, normDiags := convert.Normalize(config.Resources{}, resources, convert.DropEmptyStrings)
+			diags = diags.Extend(normDiags)
+			return out, nil
+		})
+		if err != nil {
+			return root, err
+		}
+
+		// Keep an empty apps description instead of dropping it: an app update without
+		// the field leaves the remote description unchanged, so removing description
+		// from config would never converge. Force-sending "" clears it.
+		return dyn.MapByPattern(root, dyn.NewPattern(dyn.Key("resources"), dyn.Key("apps"), dyn.AnyKey()), func(_ dyn.Path, app dyn.Value) (dyn.Value, error) {
+			if _, err := dyn.Get(app, "description"); err != nil {
+				return dyn.Set(app, "description", dyn.V(""))
+			}
+			return app, nil
+		})
+	})
+	if err != nil {
+		diags = diags.Extend(diag.FromErr(err))
+	}
+	return diags
+}
diff --git a/bundle/config/mutator/initialize_urls.go b/bundle/config/mutator/initialize_urls.go
index ea69a38ce1c..6e32ee24a28 100644
--- a/bundle/config/mutator/initialize_urls.go
+++ b/bundle/config/mutator/initialize_urls.go
@@ -7,6 +7,7 @@ import (
 	"strings"
 
 	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/libs/databrickscfg/profile"
 	"github.com/databricks/cli/libs/diag"
 )
 
@@ -25,35 +26,65 @@ func (m *initializeURLs) Name() string {
 }
 
 func (m *initializeURLs) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
-	workspaceId, err := b.WorkspaceClient(ctx).CurrentWorkspaceID(ctx)
+	client := b.WorkspaceClient(ctx)
+	host := client.Config.CanonicalHostName()
+
+	// A configured, non-numeric workspace ID (a UUID connection-style
+	// identifier) can't be validated against CurrentWorkspaceID, which
+	// strictly parses the org ID header as an integer and would error on a
+	// UUID. Skip the API call entirely and pass it through unchanged.
+	cfgID := client.Config.WorkspaceID
+	if cfgID != "" && cfgID != profile.WorkspaceIDNone {
+		if _, err := strconv.ParseInt(cfgID, 10, 64); err != nil {
+			if err := initializeForWorkspace(b, cfgID, host); err != nil {
+				return diag.FromErr(err)
+			}
+			return nil
+		}
+	}
+
+	// Otherwise, always resolve the workspace ID from the API. This is the
+	// only way to detect a numeric workspace ID that is stale or mis-scoped
+	// (e.g. a leftover value from a different profile or an old pasted SPOG
+	// URL): if the configured value disagrees with the org ID the workspace
+	// actually reports, embedding it in ?w= would silently navigate to the
+	// wrong workspace, so we error out instead.
+	apiID, err := client.CurrentWorkspaceID(ctx)
 	if err != nil {
 		return diag.FromErr(err)
 	}
-	orgId := strconv.FormatInt(workspaceId, 10)
-	host := b.WorkspaceClient(ctx).Config.CanonicalHostName()
-	err = initializeForWorkspace(b, orgId, host)
-	if err != nil {
+	orgID := strconv.FormatInt(apiID, 10)
+
+	if cfgID != "" && cfgID != profile.WorkspaceIDNone && cfgID != orgID {
+		return diag.Errorf(
+			"workspace_id %s in your configuration does not match the connected workspace (ID: %s); "+
+				"remove or correct workspace_id in your profile or bundle config to disambiguate",
+			cfgID, orgID,
+		)
+	}
+
+	if err := initializeForWorkspace(b, orgID, host); err != nil {
 		return diag.FromErr(err)
 	}
 	return nil
 }
 
-func initializeForWorkspace(b *bundle.Bundle, orgId, host string) error {
+func initializeForWorkspace(b *bundle.Bundle, workspaceID, host string) error {
 	baseURL, err := url.Parse(host)
 	if err != nil {
 		return err
 	}
 
-	// Add ?o=<workspace id> only if <workspace id> wasn't in the subdomain already.
-	// The ?o= is needed when vanity URLs / legacy workspace URLs are used.
-	// If it's not needed we prefer to leave it out since these URLs are rather
-	// long for most terminals.
+	// Add ?w=<workspace id> only if <workspace id> wasn't in the subdomain
+	// already. The parameter is needed when vanity URLs / legacy workspace
+	// URLs are used. If it's not needed we prefer to leave it out since these
+	// URLs are rather long for most terminals.
 	//
-	// See https://docs.databricks.com/en/workspace/workspace-details.html for
-	// further reading about the '?o=' suffix.
-	if !strings.Contains(baseURL.Hostname(), orgId) {
+	// The legacy ?o= spelling is also accepted by the platform; we emit ?w=
+	// here to match the new workspace addressing convention.
+	if !strings.Contains(baseURL.Hostname(), workspaceID) {
 		values := baseURL.Query()
-		values.Add("o", orgId)
+		values.Add("w", workspaceID)
 		baseURL.RawQuery = values.Encode()
 	}
 
diff --git a/bundle/config/mutator/initialize_urls_test.go b/bundle/config/mutator/initialize_urls_test.go
index 6b0c8d6655e..e89d6de116c 100644
--- a/bundle/config/mutator/initialize_urls_test.go
+++ b/bundle/config/mutator/initialize_urls_test.go
@@ -6,12 +6,15 @@ import (
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/bundle/config"
 	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/cli/libs/testserver"
+	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/service/catalog"
 	"github.com/databricks/databricks-sdk-go/service/compute"
 	"github.com/databricks/databricks-sdk-go/service/jobs"
 	"github.com/databricks/databricks-sdk-go/service/ml"
 	"github.com/databricks/databricks-sdk-go/service/pipelines"
 	"github.com/databricks/databricks-sdk-go/service/serving"
+	"github.com/databricks/databricks-sdk-go/service/vectorsearch"
 	"github.com/stretchr/testify/require"
 )
 
@@ -24,31 +27,31 @@ func TestInitializeURLs(t *testing.T) {
 			Resources: config.Resources{
 				Jobs: map[string]*resources.Job{
 					"job1": {
-						BaseResource: resources.BaseResource{ID: "1"},
-						JobSettings:  jobs.JobSettings{Name: "job1"},
+						ID:          "1",
+						JobSettings: jobs.JobSettings{Name: "job1"},
 					},
 				},
 				Pipelines: map[string]*resources.Pipeline{
 					"pipeline1": {
-						BaseResource:   resources.BaseResource{ID: "3"},
+						ID:             "3",
 						CreatePipeline: pipelines.CreatePipeline{Name: "pipeline1"},
 					},
 				},
 				Experiments: map[string]*resources.MlflowExperiment{
 					"experiment1": {
-						BaseResource:     resources.BaseResource{ID: "4"},
+						ID:               "4",
 						CreateExperiment: ml.CreateExperiment{Name: "experiment1"},
 					},
 				},
 				Models: map[string]*resources.MlflowModel{
 					"model1": {
-						BaseResource:       resources.BaseResource{ID: "a model uses its name for identifier"},
+						ID:                 "a model uses its name for identifier",
 						CreateModelRequest: ml.CreateModelRequest{Name: "a model uses its name for identifier"},
 					},
 				},
 				ModelServingEndpoints: map[string]*resources.ModelServingEndpoint{
 					"servingendpoint1": {
-						BaseResource: resources.BaseResource{ID: "my_serving_endpoint"},
+						ID: "my_serving_endpoint",
 						CreateServingEndpoint: serving.CreateServingEndpoint{
 							Name: "my_serving_endpoint",
 						},
@@ -56,7 +59,7 @@ func TestInitializeURLs(t *testing.T) {
 				},
 				RegisteredModels: map[string]*resources.RegisteredModel{
 					"registeredmodel1": {
-						BaseResource: resources.BaseResource{ID: "8"},
+						ID: "8",
 						CreateRegisteredModelRequest: catalog.CreateRegisteredModelRequest{
 							Name: "my_registered_model",
 						},
@@ -68,9 +71,17 @@ func TestInitializeURLs(t *testing.T) {
 						CreateMonitor: catalog.CreateMonitor{},
 					},
 				},
+				VectorSearchIndexes: map[string]*resources.VectorSearchIndex{
+					"vectorsearchindex1": {
+						ID: "catalog.schema.vectorsearchindex1",
+						CreateVectorIndexRequest: vectorsearch.CreateVectorIndexRequest{
+							Name: "catalog.schema.vectorsearchindex1",
+						},
+					},
+				},
 				Schemas: map[string]*resources.Schema{
 					"schema1": {
-						BaseResource: resources.BaseResource{ID: "catalog.schema"},
+						ID: "catalog.schema",
 						CreateSchema: catalog.CreateSchema{
 							Name: "schema",
 						},
@@ -78,7 +89,7 @@ func TestInitializeURLs(t *testing.T) {
 				},
 				Clusters: map[string]*resources.Cluster{
 					"cluster1": {
-						BaseResource: resources.BaseResource{ID: "1017-103929-vlr7jzcf"},
+						ID: "1017-103929-vlr7jzcf",
 						ClusterSpec: compute.ClusterSpec{
 							ClusterName: "cluster1",
 						},
@@ -86,7 +97,7 @@ func TestInitializeURLs(t *testing.T) {
 				},
 				Dashboards: map[string]*resources.Dashboard{
 					"dashboard1": {
-						BaseResource: resources.BaseResource{ID: "01ef8d56871e1d50ae30ce7375e42478"},
+						ID: "01ef8d56871e1d50ae30ce7375e42478",
 						DashboardConfig: resources.DashboardConfig{
 							DisplayName: "My special dashboard",
 						},
@@ -97,16 +108,17 @@ func TestInitializeURLs(t *testing.T) {
 	}
 
 	expectedURLs := map[string]string{
-		"job1":             "https://mycompany.databricks.com/jobs/1?o=123456",
-		"pipeline1":        "https://mycompany.databricks.com/pipelines/3?o=123456",
-		"experiment1":      "https://mycompany.databricks.com/ml/experiments/4?o=123456",
-		"model1":           "https://mycompany.databricks.com/ml/models/a%20model%20uses%20its%20name%20for%20identifier?o=123456",
-		"servingendpoint1": "https://mycompany.databricks.com/ml/endpoints/my_serving_endpoint?o=123456",
-		"registeredmodel1": "https://mycompany.databricks.com/explore/data/models/8?o=123456",
-		"qualityMonitor1":  "https://mycompany.databricks.com/explore/data/catalog/schema/qualityMonitor1?o=123456",
-		"schema1":          "https://mycompany.databricks.com/explore/data/catalog/schema?o=123456",
-		"cluster1":         "https://mycompany.databricks.com/compute/clusters/1017-103929-vlr7jzcf?o=123456",
-		"dashboard1":       "https://mycompany.databricks.com/dashboardsv3/01ef8d56871e1d50ae30ce7375e42478/published?o=123456",
+		"job1":               "https://mycompany.databricks.com/jobs/1?w=123456",
+		"pipeline1":          "https://mycompany.databricks.com/pipelines/3?w=123456",
+		"experiment1":        "https://mycompany.databricks.com/ml/experiments/4?w=123456",
+		"model1":             "https://mycompany.databricks.com/ml/models/a%20model%20uses%20its%20name%20for%20identifier?w=123456",
+		"servingendpoint1":   "https://mycompany.databricks.com/ml/endpoints/my_serving_endpoint?w=123456",
+		"registeredmodel1":   "https://mycompany.databricks.com/explore/data/models/8?w=123456",
+		"qualityMonitor1":    "https://mycompany.databricks.com/explore/data/catalog/schema/qualityMonitor1?w=123456",
+		"vectorsearchindex1": "https://mycompany.databricks.com/explore/data/catalog/schema/vectorsearchindex1?w=123456",
+		"schema1":            "https://mycompany.databricks.com/explore/data/catalog/schema?w=123456",
+		"cluster1":           "https://mycompany.databricks.com/compute/clusters/1017-103929-vlr7jzcf?w=123456",
+		"dashboard1":         "https://mycompany.databricks.com/dashboardsv3/01ef8d56871e1d50ae30ce7375e42478/published?w=123456",
 	}
 
 	err := initializeForWorkspace(b, "123456", "https://mycompany.databricks.com/")
@@ -114,7 +126,8 @@ func TestInitializeURLs(t *testing.T) {
 
 	for _, group := range b.Config.Resources.AllResources() {
 		for key, r := range group.Resources {
-			require.Equal(t, expectedURLs[key], r.GetURL(), "Unexpected URL for "+key)
+			url, _ := r.GetURL()
+			require.Equal(t, expectedURLs[key], url, "Unexpected URL for "+key)
 		}
 	}
 }
@@ -125,8 +138,8 @@ func TestInitializeURLsWithoutOrgId(t *testing.T) {
 			Resources: config.Resources{
 				Jobs: map[string]*resources.Job{
 					"job1": {
-						BaseResource: resources.BaseResource{ID: "1"},
-						JobSettings:  jobs.JobSettings{Name: "job1"},
+						ID:          "1",
+						JobSettings: jobs.JobSettings{Name: "job1"},
 					},
 				},
 			},
@@ -138,3 +151,118 @@ func TestInitializeURLsWithoutOrgId(t *testing.T) {
 
 	require.Equal(t, "https://adb-123456.azuredatabricks.net/jobs/1", b.Config.Resources.Jobs["job1"].URL)
 }
+
+// TestInitializeURLsApplyNonNumericConfigPassedThrough verifies that a
+// non-numeric Config.WorkspaceID (e.g. a UUID connection-style identifier) is
+// passed through unchanged into the ?w= parameter. The numeric-mismatch check
+// is skipped because such IDs cannot be compared against an integer org ID.
+func TestInitializeURLsApplyNonNumericConfigPassedThrough(t *testing.T) {
+	server := testserver.New(t)
+	testserver.AddDefaultHandlers(server)
+
+	w, err := databricks.NewWorkspaceClient(&databricks.Config{
+		Host:        server.URL,
+		Token:       "testtoken",
+		WorkspaceID: "some-uuid-style-id",
+	})
+	require.NoError(t, err)
+
+	b := &bundle.Bundle{
+		Config: config.Root{
+			Resources: config.Resources{
+				Jobs: map[string]*resources.Job{
+					"job1": {
+						ID:          "1",
+						JobSettings: jobs.JobSettings{Name: "job1"},
+					},
+				},
+			},
+		},
+	}
+	b.SetWorkpaceClient(w)
+
+	diags := InitializeURLs().Apply(t.Context(), b)
+	require.NoError(t, diags.Error())
+
+	// UUID flows through into ?w= unchanged — no numeric comparison is possible.
+	require.Equal(t,
+		server.URL+"/jobs/1?w=some-uuid-style-id",
+		b.Config.Resources.Jobs["job1"].URL,
+	)
+}
+
+// TestInitializeURLsApplyNoneSentinelResolvesViaAPI verifies that the "none"
+// sentinel (persisted to .databrickscfg when a user explicitly skips
+// workspace selection) is treated as unset rather than as a literal value: it
+// must not end up as ?w=none, and it must not be compared against the API
+// result (both would be wrong; the sentinel means "no preference").
+func TestInitializeURLsApplyNoneSentinelResolvesViaAPI(t *testing.T) {
+	server := testserver.New(t)
+	testserver.AddDefaultHandlers(server)
+	// /Me returns X-Databricks-Org-Id: 900800700600.
+
+	w, err := databricks.NewWorkspaceClient(&databricks.Config{
+		Host:        server.URL,
+		Token:       "testtoken",
+		WorkspaceID: "none",
+	})
+	require.NoError(t, err)
+
+	b := &bundle.Bundle{
+		Config: config.Root{
+			Resources: config.Resources{
+				Jobs: map[string]*resources.Job{
+					"job1": {
+						ID:          "1",
+						JobSettings: jobs.JobSettings{Name: "job1"},
+					},
+				},
+			},
+		},
+	}
+	b.SetWorkpaceClient(w)
+
+	diags := InitializeURLs().Apply(t.Context(), b)
+	require.NoError(t, diags.Error())
+
+	require.Equal(t,
+		server.URL+"/jobs/1?w=900800700600",
+		b.Config.Resources.Jobs["job1"].URL,
+	)
+}
+
+// TestInitializeURLsApplyErrorsOnNumericWorkspaceIDMismatch verifies that Apply
+// returns an error when Config.WorkspaceID is a numeric value that differs from
+// the workspace org ID returned by the API. This prevents silently embedding a
+// wrong ?w= parameter in resource URLs that would navigate to an unexpected workspace.
+func TestInitializeURLsApplyErrorsOnNumericWorkspaceIDMismatch(t *testing.T) {
+	server := testserver.New(t)
+	testserver.AddDefaultHandlers(server)
+	// /Me returns X-Databricks-Org-Id: 900800700600.
+
+	w, err := databricks.NewWorkspaceClient(&databricks.Config{
+		Host:        server.URL,
+		Token:       "testtoken",
+		WorkspaceID: "12345", // numeric but does not match 900800700600
+	})
+	require.NoError(t, err)
+
+	b := &bundle.Bundle{
+		Config: config.Root{
+			Resources: config.Resources{
+				Jobs: map[string]*resources.Job{
+					"job1": {
+						ID:          "1",
+						JobSettings: jobs.JobSettings{Name: "job1"},
+					},
+				},
+			},
+		},
+	}
+	b.SetWorkpaceClient(w)
+
+	diags := InitializeURLs().Apply(t.Context(), b)
+	require.ErrorContains(t, diags.Error(), "12345")
+	require.ErrorContains(t, diags.Error(), "900800700600")
+	require.ErrorContains(t, diags.Error(), "disambiguate")
+}
diff --git a/bundle/config/mutator/initialize_volume_paths.go b/bundle/config/mutator/initialize_volume_paths.go
new file mode 100644
index 00000000000..20ea9ae6b38
--- /dev/null
+++ b/bundle/config/mutator/initialize_volume_paths.go
@@ -0,0 +1,79 @@
+package mutator
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/cli/libs/diag"
+	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/dyn/convert"
+	"github.com/databricks/cli/libs/dyn/dynvar"
+)
+
+type initializeVolumePaths struct{}
+
+// InitializeVolumePaths sets resources.volumes.*.volume_path from catalog_name, schema_name, and name.
+//
+// References in those fields are resolved locally only to compute the path; the original field
+// values are left intact so validate and plan still show the references. A component that cannot be
+// resolved locally is embedded verbatim as a ${...} reference and resolved later during plan or
+// deploy, like any other resource reference.
+//
+// Must run exactly once: volume_path is computed here and never persisted, so a second run would
+// see its own value and trip the "computed and read-only" rejection below.
+func InitializeVolumePaths() bundle.Mutator {
+	return &initializeVolumePaths{}
+}
+
+func (m *initializeVolumePaths) Name() string {
+	return "InitializeVolumePaths"
+}
+
+func (m *initializeVolumePaths) Apply(_ context.Context, b *bundle.Bundle) diag.Diagnostics {
+	err := b.Config.Mutate(func(root dyn.Value) (dyn.Value, error) {
+		pattern := dyn.NewPattern(dyn.Key("resources"), dyn.Key("volumes"), dyn.AnyKey())
+		return dyn.MapByPattern(root, pattern, func(p dyn.Path, v dyn.Value) (dyn.Value, error) {
+			// volume_path is computed and read-only; reject a user-provided value instead of overwriting it.
+			if existing, ok := v.Get("volume_path").AsString(); ok && existing != "" {
+				return dyn.InvalidValue, fmt.Errorf("%s.volume_path is computed and read-only; remove it from the configuration", p.String())
+			}
+
+			var vol resources.Volume
+			if err := convert.ToTyped(&vol, v); err != nil {
+				return dyn.InvalidValue, err
+			}
+
+			// Resolve references to compute the path only; the field values in v are left untouched.
+			vol.CatalogName = resolveResourceReference(root, vol.CatalogName)
+			vol.SchemaName = resolveResourceReference(root, vol.SchemaName)
+			vol.Name = resolveResourceReference(root, vol.Name)
+
+			return dyn.Set(v, "volume_path", dyn.V(vol.ComputeVolumePath()))
+		})
+	})
+	if err != nil {
+		return diag.FromErr(err)
+	}
+	return nil
+}
+
+// resolveResourceReference resolves a pure ${resources....} reference by looking it up in root.
+// Values that are not such a reference, or cannot be resolved, are returned unchanged (still
+// containing "${"), so the caller embeds the reference verbatim to be resolved later.
+func resolveResourceReference(root dyn.Value, s string) string {
+	p, ok := dynvar.PureReferenceToPath(s)
+	if !ok || p[0].Key() != "resources" {
+		return s
+	}
+	rv, err := dyn.GetByPath(root, p)
+	if err != nil {
+		return s
+	}
+	rs, ok := rv.AsString()
+	if !ok {
+		return s
+	}
+	return rs
+}
diff --git a/bundle/config/mutator/initialize_volume_paths_test.go b/bundle/config/mutator/initialize_volume_paths_test.go
new file mode 100644
index 00000000000..b624a99a813
--- /dev/null
+++ b/bundle/config/mutator/initialize_volume_paths_test.go
@@ -0,0 +1,140 @@
+package mutator
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/databricks-sdk-go/service/catalog"
+	"github.com/stretchr/testify/require"
+)
+
+func TestInitializeVolumePaths(t *testing.T) {
+	b := &bundle.Bundle{
+		Config: config.Root{
+			Resources: config.Resources{
+				Schemas: map[string]*resources.Schema{
+					"my": {
+						CreateSchema: catalog.CreateSchema{
+							CatalogName: "main",
+							Name:        "myschema",
+						},
+					},
+				},
+				Volumes: map[string]*resources.Volume{
+					"bar": {
+						CreateVolumeRequestContent: catalog.CreateVolumeRequestContent{
+							CatalogName: "main",
+							SchemaName:  "myschema",
+							Name:        "volbar",
+						},
+					},
+					// foo references the schema's name; InitializeVolumePaths resolves
+					// it locally to compute the path without rewriting schema_name.
+					"foo": {
+						CreateVolumeRequestContent: catalog.CreateVolumeRequestContent{
+							CatalogName: "main",
+							SchemaName:  "${resources.schemas.my.name}",
+							Name:        "volfoo",
+						},
+					},
+				},
+			},
+		},
+	}
+
+	diags := bundle.Apply(t.Context(), b, InitializeVolumePaths())
+	require.NoError(t, diags.Error())
+
+	require.Equal(t, "/Volumes/main/myschema/volbar", b.Config.Resources.Volumes["bar"].VolumePath)
+
+	foo := b.Config.Resources.Volumes["foo"]
+	require.Equal(t, "/Volumes/main/myschema/volfoo", foo.VolumePath)
+	// The schema_name reference must be preserved, not replaced with the resolved value.
+	require.Equal(t, "${resources.schemas.my.name}", foo.SchemaName)
+}
+
+func TestInitializeVolumePaths_UnresolvedReference(t *testing.T) {
+	b := &bundle.Bundle{
+		Config: config.Root{
+			Resources: config.Resources{
+				Volumes: map[string]*resources.Volume{
+					// The reference cannot be resolved locally, so it is embedded into
+					// the path verbatim to be resolved later during plan or deploy.
+					"foo": {
+						CreateVolumeRequestContent: catalog.CreateVolumeRequestContent{
+							CatalogName: "main",
+							SchemaName:  "${resources.schemas.missing.name}",
+							Name:        "volfoo",
+						},
+					},
+				},
+			},
+		},
+	}
+
+	diags := bundle.Apply(t.Context(), b, InitializeVolumePaths())
+	require.NoError(t, diags.Error())
+	require.Equal(t, "/Volumes/main/${resources.schemas.missing.name}/volfoo", b.Config.Resources.Volumes["foo"].VolumePath)
+	// The schema_name reference itself must be preserved, not rewritten.
+	require.Equal(t, "${resources.schemas.missing.name}", b.Config.Resources.Volumes["foo"].SchemaName)
+}
+
+func TestInitializeVolumePaths_RejectsUserProvidedPath(t *testing.T) {
+	b := &bundle.Bundle{
+		Config: config.Root{
+			Resources: config.Resources{
+				Volumes: map[string]*resources.Volume{
+					"foo": {
+						CreateVolumeRequestContent: catalog.CreateVolumeRequestContent{
+							CatalogName: "main",
+							SchemaName:  "myschema",
+							Name:        "volfoo",
+						},
+						VolumePath: "/Volumes/bogus/path/set-by-user",
+					},
+				},
+			},
+		},
+	}
+
+	diags := bundle.Apply(t.Context(), b, InitializeVolumePaths())
+	require.ErrorContains(t, diags.Error(), "volume_path is computed and read-only")
+}
+
+func TestVolumePathPipeline_ResolvesCrossVolumeReference(t *testing.T) {
+	b := &bundle.Bundle{
+		Config: config.Root{
+			Resources: config.Resources{
+				Volumes: map[string]*resources.Volume{
+					"bar": {
+						CreateVolumeRequestContent: catalog.CreateVolumeRequestContent{
+							CatalogName: "main",
+							SchemaName:  "myschema",
+							Name:        "volbar",
+						},
+					},
+					"foo": {
+						CreateVolumeRequestContent: catalog.CreateVolumeRequestContent{
+							CatalogName: "main",
+							SchemaName:  "myschema",
+							Name:        "volfoo",
+							Comment:     "${resources.volumes.bar.volume_path}",
+						},
+					},
+				},
+			},
+		},
+	}
+
+	diags := bundle.ApplySeq(
+		t.Context(),
+		b,
+		InitializeVolumePaths(),
+		ResolveVolumePathReferencesOnlyResources(),
+	)
+	require.NoError(t, diags.Error())
+	require.Equal(t, "/Volumes/main/myschema/volbar", b.Config.Resources.Volumes["bar"].VolumePath)
+	require.Equal(t, "/Volumes/main/myschema/volbar", b.Config.Resources.Volumes["foo"].Comment)
+}
diff --git a/bundle/config/mutator/load_dbalert_files.go b/bundle/config/mutator/load_dbalert_files.go
index 992ce9962d6..437095aa218 100644
--- a/bundle/config/mutator/load_dbalert_files.go
+++ b/bundle/config/mutator/load_dbalert_files.go
@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"os"
+	"path/filepath"
 	"slices"
 	"strings"
 
@@ -12,6 +13,7 @@ import (
 	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/cli/libs/dyn/dynvar"
+	"github.com/databricks/cli/libs/structs/structpath"
 	"github.com/databricks/databricks-sdk-go/marshal"
 	"github.com/databricks/databricks-sdk-go/service/sql"
 )
@@ -63,7 +65,7 @@ func (m *loadDBAlertFiles) Apply(ctx context.Context, b *bundle.Bundle) diag.Dia
 		// No other fields other than allowedInYAML should be set in the bundle YAML.
 		m, ok := alertV.AsMap()
 		if !ok {
-			return diag.FromErr(fmt.Errorf("internal error: alert value is not a map: %w", err))
+			return diag.FromErr(fmt.Errorf("internal error: alert value is not a map, got %s", alertV.Kind()))
 		}
 
 		for _, p := range m.Pairs() {
@@ -84,13 +86,21 @@ func (m *loadDBAlertFiles) Apply(ctx context.Context, b *bundle.Bundle) diag.Dia
 					Severity:  diag.Error,
 					Summary:   fmt.Sprintf("field %s is not allowed in the bundle configuration.", k),
 					Detail:    "When a .dbalert.json is specified, only the following fields are allowed in the bundle configuration: " + strings.Join(allowedInYAML, ", "),
-					Paths:     []dyn.Path{dyn.MustPathFromString(fmt.Sprintf("resources.alerts.%s.%s", alertKey, k))},
+					Paths:     structpath.NewPathSlice("resources", "alerts", alertKey, k),
 					Locations: v.Locations(),
 				},
 			}
 		}
 
-		content, err := os.ReadFile(alert.FilePath)
+		// NormalizePaths rewrote file_path to be relative to the bundle root, but the
+		// process working directory can be any directory within the bundle, so anchor
+		// the read to the bundle root. Absolute paths are kept as-is by NormalizePaths.
+		filePath := alert.FilePath
+		if !filepath.IsAbs(filePath) {
+			filePath = filepath.Join(b.BundleRootPath, filePath)
+		}
+
+		content, err := os.ReadFile(filePath)
 		if err != nil {
 			return diag.Diagnostics{
 				{
@@ -98,7 +108,7 @@ func (m *loadDBAlertFiles) Apply(ctx context.Context, b *bundle.Bundle) diag.Dia
 					Severity:  diag.Error,
 					Summary:   fmt.Sprintf("failed to read .dbalert.json file %s: %s", alert.FilePath, err),
 					Detail:    "",
-					Paths:     []dyn.Path{dyn.MustPathFromString(fmt.Sprintf("resources.alerts.%s.file_path", alertKey))},
+					Paths:     structpath.NewPathSlice("resources", "alerts", alertKey, "file_path"),
 					Locations: alertV.Get("file_path").Locations(),
 				},
 			}
@@ -113,7 +123,7 @@ func (m *loadDBAlertFiles) Apply(ctx context.Context, b *bundle.Bundle) diag.Dia
 					Severity:  diag.Error,
 					Summary:   fmt.Sprintf("failed to parse .dbalert.json file %s: %s", alert.FilePath, err),
 					Detail:    "",
-					Paths:     []dyn.Path{dyn.MustPathFromString(fmt.Sprintf("resources.alerts.%s.file_path", alertKey))},
+					Paths:     structpath.NewPathSlice("resources", "alerts", alertKey, "file_path"),
 					Locations: alertV.Get("file_path").Locations(),
 				},
 			}
@@ -127,7 +137,7 @@ func (m *loadDBAlertFiles) Apply(ctx context.Context, b *bundle.Bundle) diag.Dia
 					Severity:  diag.Error,
 					Summary:   fmt.Sprintf(".alert file %s must not contain variable interpolations.", alert.FilePath),
 					Detail:    "Please inline the alert configuration in the bundle configuration to use variables",
-					Paths:     []dyn.Path{dyn.MustPathFromString(fmt.Sprintf("resources.alerts.%s.file_path", alertKey))},
+					Paths:     structpath.NewPathSlice("resources", "alerts", alertKey, "file_path"),
 					Locations: alertV.Get("file_path").Locations(),
 				},
 			}
@@ -163,13 +173,15 @@ func (m *loadDBAlertFiles) Apply(ctx context.Context, b *bundle.Bundle) diag.Dia
 			WarehouseId: alert.WarehouseId,
 
 			// Fields with the same schema in file vs API.
-			CustomSummary:  dbalertFromFile.CustomSummary,
-			Schedule:       dbalertFromFile.Schedule,
-			Evaluation:     dbalertFromFile.Evaluation,
-			EffectiveRunAs: dbalertFromFile.EffectiveRunAs,
-			RunAs:          dbalertFromFile.RunAs,
-			RunAsUserName:  dbalertFromFile.RunAsUserName,
-			ParentPath:     dbalertFromFile.ParentPath,
+			CustomSummary:        dbalertFromFile.CustomSummary,
+			Schedule:             dbalertFromFile.Schedule,
+			Evaluation:           dbalertFromFile.Evaluation,
+			EffectiveRunAs:       dbalertFromFile.EffectiveRunAs,
+			RunAs:                dbalertFromFile.RunAs,
+			RunAsUserName:        dbalertFromFile.RunAsUserName,
+			ParentPath:           dbalertFromFile.ParentPath,
+			Parameters:           dbalertFromFile.Parameters,
+			CustomTemplateFormat: dbalertFromFile.CustomTemplateFormat,
 
 			// Output only fields.
 			CreateTime:     dbalertFromFile.CreateTime,
diff --git a/bundle/config/mutator/load_dbalert_files_test.go b/bundle/config/mutator/load_dbalert_files_test.go
index a1f42c73c9e..5e8a8d896e6 100644
--- a/bundle/config/mutator/load_dbalert_files_test.go
+++ b/bundle/config/mutator/load_dbalert_files_test.go
@@ -10,7 +10,7 @@ import (
 	"github.com/databricks/cli/bundle/config/mutator"
 	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/cli/bundle/internal/bundletest"
-	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/databricks-sdk-go/service/sql"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -66,7 +66,7 @@ func TestLoadDBAlertFiles(t *testing.T) {
 		},
 	}
 
-	bundletest.SetLocation(b, "resources.alerts.my_alert", []dyn.Location{{
+	bundletest.SetLocation(b, "resources.alerts.my_alert", []diag.Location{{
 		File: filepath.Join(dir, "databricks.yml"),
 	}})
 
@@ -79,3 +79,42 @@ func TestLoadDBAlertFiles(t *testing.T) {
 	assert.Equal(t, "abc123", b.Config.Resources.Alerts["my_alert"].WarehouseId)
 	assert.Equal(t, "SELECT * FROM table\nWHERE value > 100\n", b.Config.Resources.Alerts["my_alert"].QueryText)
 }
+
+func TestLoadDBAlertFilesRelativeToBundleRoot(t *testing.T) {
+	dir := t.TempDir()
+
+	alertJSON := `{
+  "query_lines": [
+    "SELECT 1"
+  ]
+}`
+
+	err := os.WriteFile(filepath.Join(dir, "alert.dbalert.json"), []byte(alertJSON), 0o644)
+	require.NoError(t, err)
+
+	b := &bundle.Bundle{
+		BundleRootPath: dir,
+		Config: config.Root{
+			Resources: config.Resources{
+				Alerts: map[string]*resources.Alert{
+					"my_alert": {
+						FilePath: "alert.dbalert.json",
+						AlertV2: sql.AlertV2{
+							DisplayName: "Test Alert",
+							WarehouseId: "abc123",
+						},
+					},
+				},
+			},
+		},
+	}
+
+	bundletest.SetLocation(b, "resources.alerts.my_alert", []diag.Location{{
+		File: filepath.Join(dir, "databricks.yml"),
+	}})
+
+	diags := bundle.Apply(t.Context(), b, mutator.LoadDBAlertFiles())
+	require.NoError(t, diags.Error())
+
+	assert.Equal(t, "SELECT 1\n", b.Config.Resources.Alerts["my_alert"].QueryText)
+}
diff --git a/bundle/config/mutator/load_git_details.go b/bundle/config/mutator/load_git_details.go
index bbb6ff147e8..f2d3be08a1b 100644
--- a/bundle/config/mutator/load_git_details.go
+++ b/bundle/config/mutator/load_git_details.go
@@ -2,8 +2,6 @@ package mutator
 
 import (
 	"context"
-	"errors"
-	"os"
 	"path/filepath"
 
 	"github.com/databricks/cli/bundle"
@@ -26,9 +24,7 @@ func (m *loadGitDetails) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagn
 	var diags diag.Diagnostics
 	info, err := git.FetchRepositoryInfo(ctx, b.BundleRoot.Native(), b.WorkspaceClient(ctx))
 	if err != nil {
-		if !errors.Is(err, os.ErrNotExist) {
-			diags = append(diags, diag.WarningFromErr(err)...)
-		}
+		diags = append(diags, diag.WarningFromErr(err)...)
 	}
 
 	if info.WorktreeRoot == "" {
diff --git a/bundle/config/mutator/log_resource_references.go b/bundle/config/mutator/log_resource_references.go
deleted file mode 100644
index a18b3aaa249..00000000000
--- a/bundle/config/mutator/log_resource_references.go
+++ /dev/null
@@ -1,148 +0,0 @@
-package mutator
-
-import (
-	"context"
-	"reflect"
-	"strings"
-
-	"github.com/databricks/cli/bundle"
-	"github.com/databricks/cli/libs/diag"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/dynvar"
-	"github.com/databricks/cli/libs/log"
-	"github.com/databricks/cli/libs/structs/structaccess"
-	"github.com/databricks/cli/libs/structs/structpath"
-)
-
-// Longest field name:
-// >>> len('hard_deletion_sync_min_interval_in_seconds') == 42
-const maxFieldLength = 42
-
-const maxMetricLength = 200
-
-// logResourceReferences scans resources for ${resources.*} references and logs them.
-func LogResourceReferences() bundle.Mutator {
-	return &logResourceReferences{}
-}
-
-type logResourceReferences struct{}
-
-func (m *logResourceReferences) Name() string {
-	return "LogResourceReferences"
-}
-
-func (m *logResourceReferences) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
-	used := map[string]struct{}{}
-	resources := b.Config.Value().Get("resources")
-	if !resources.IsValid() {
-		// No resources section, nothing to do
-		return nil
-	}
-
-	_ = dyn.WalkReadOnly(resources, func(path dyn.Path, val dyn.Value) error {
-		ref, ok := dynvar.NewRef(val)
-		if !ok {
-			return nil
-		}
-		for _, r := range ref.References() {
-			// Only track ${resources.*} references.
-			if !strings.HasPrefix(r, "resources.") {
-				continue
-			}
-
-			key := convertReferenceToMetric(ctx, b.Config, r)
-			if key != "" {
-				used[key] = struct{}{}
-			}
-		}
-		return nil
-	})
-
-	maxRefsLogged := 50
-
-	// map iteration is randomized, which works for this case
-	for key := range used {
-		b.Metrics.AddBoolValue(key, true)
-		maxRefsLogged--
-		if maxRefsLogged <= 0 {
-			break
-		}
-	}
-
-	return nil
-}
-
-// convertReferenceToMetric converts a reference like "resources.jobs.foo.id" to
-// a telemetry key like "resref__jobs__id"
-func convertReferenceToMetric(ctx context.Context, cfg any, ref string) string {
-	p, err := dyn.NewPathFromString(ref)
-	if err != nil || len(p) < 3 || p[0].Key() != "resources" {
-		return ""
-	}
-
-	group := truncate(p[1].Key(), maxFieldLength, "")
-	kept := []string{"resref_" + group}
-
-	for i := 3; i < len(p); i++ {
-		c := p[i]
-		if c.Key() != "" {
-			item := c.Key()
-
-			repl, err := censorValue(ctx, cfg, p[:i])
-			if err != nil {
-				kept[0] = "resreferr_" + group
-				break
-			}
-
-			if repl != "" {
-				item = repl
-			}
-
-			item = truncate(item, maxFieldLength, "")
-			kept = append(kept, item)
-			continue
-		}
-	}
-
-	result := strings.Join(kept, ".")
-	return truncate(result, maxMetricLength, "__cut")
-}
-
-func truncate(s string, n int, suffix string) string {
-	if len(s) <= n {
-		return s
-	}
-	return s[:n] + suffix
-}
-
-func censorValue(ctx context.Context, v any, path dyn.Path) (string, error) {
-	pathString := path.String()
-	pathNode, err := structpath.ParsePath(pathString)
-	if err != nil {
-		log.Warnf(ctx, "internal error: parsing %q: %s", pathString, err)
-		return "err", err
-	}
-
-	v, err = structaccess.Get(v, pathNode)
-	if err != nil {
-		log.Infof(ctx, "internal error: path=%s: %s", path, err)
-		return "err", err
-	}
-
-	rv := reflect.ValueOf(v)
-	for rv.IsValid() {
-		switch rv.Kind() {
-		case reflect.Pointer, reflect.Interface:
-			if rv.IsNil() {
-				return "", nil
-			}
-			rv = rv.Elem()
-		default:
-			if rv.Kind() == reflect.Map {
-				return "*", nil
-			}
-			return "", nil
-		}
-	}
-	return "", nil
-}
diff --git a/bundle/config/mutator/log_resource_references_test.go b/bundle/config/mutator/log_resource_references_test.go
deleted file mode 100644
index af5100da99f..00000000000
--- a/bundle/config/mutator/log_resource_references_test.go
+++ /dev/null
@@ -1,96 +0,0 @@
-package mutator
-
-import (
-	"testing"
-
-	"github.com/databricks/cli/bundle/config"
-	cres "github.com/databricks/cli/bundle/config/resources"
-	"github.com/databricks/databricks-sdk-go/service/jobs"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestConvertReferenceToMetric_Table(t *testing.T) {
-	ctx := t.Context()
-	cfg := config.Root{
-		Resources: config.Resources{
-			Jobs: map[string]*cres.Job{
-				"foo": {
-					JobSettings: jobs.JobSettings{
-						Tasks: []jobs.Task{
-							{TaskKey: "alpha"},
-						},
-					},
-				},
-				"джоб": {
-					JobSettings: jobs.JobSettings{},
-				},
-
-				"niljob": nil,
-			},
-		},
-	}
-
-	tests := []struct {
-		name string
-		ref  string
-		want string
-	}{
-		{
-			name: "basic job id",
-			ref:  "resources.jobs.foo.id",
-			want: "resref_jobs.id",
-		},
-		{
-			name: "basic job id with non-ascii key",
-			ref:  "resources.jobs.джоб.id",
-			want: "resref_jobs.id",
-		},
-		{
-			name: "invalid empty",
-			ref:  "",
-			want: "",
-		},
-		{
-			name: "invalid variables",
-			ref:  "variables.foo",
-			want: "",
-		},
-		{
-			name: "invalid short resources",
-			ref:  "resources",
-			want: "",
-		},
-		{
-			name: "invalid short group",
-			ref:  "resources.jobs",
-			want: "",
-		},
-		{
-			name: "nil job pointer yields plain id",
-			ref:  "resources.jobs.niljob.id",
-			want: "resref_jobs.id",
-		},
-		{
-			name: "err censor on missing job key",
-			ref:  "resources.jobs.missing.id",
-			want: "resreferr_jobs",
-		},
-		{
-			name: "array index tasks key",
-			ref:  "resources.jobs.foo.tasks[0].task_key",
-			want: "resref_jobs.tasks.task_key",
-		},
-		{
-			name: "array index task key",
-			ref:  "resources.jobs.foo.task[0].task_key",
-			want: "resreferr_jobs.task",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := convertReferenceToMetric(ctx, cfg, tt.ref)
-			assert.Equal(t, tt.want, got)
-		})
-	}
-}
diff --git a/bundle/config/mutator/normalize_paths.go b/bundle/config/mutator/normalize_paths.go
index ecab0e812db..7256ebad4b7 100644
--- a/bundle/config/mutator/normalize_paths.go
+++ b/bundle/config/mutator/normalize_paths.go
@@ -84,7 +84,7 @@ func collectGitSourcePaths(b *bundle.Bundle) []dyn.Path {
 	return jobs
 }
 
-func normalizePath(path string, location dyn.Location, bundleRootPath string) (string, error) {
+func normalizePath(path string, location diag.Location, bundleRootPath string) (string, error) {
 	// Handle local file paths used inside pip flags
 	for _, flag := range libraries.PipFlagsWithLocalPaths {
 		reqPath, ok := strings.CutPrefix(path, flag+" ")
@@ -134,7 +134,7 @@ func normalizePath(path string, location dyn.Location, bundleRootPath string) (s
 	return filepath.ToSlash(filepath.Join(relDir, path)), nil
 }
 
-func locationDirectory(l dyn.Location) (string, error) {
+func locationDirectory(l diag.Location) (string, error) {
 	if l.File == "" {
 		return "", errors.New("no file in location")
 	}
diff --git a/bundle/config/mutator/normalize_paths_test.go b/bundle/config/mutator/normalize_paths_test.go
index 8bee6c5064b..9c9085a27c6 100644
--- a/bundle/config/mutator/normalize_paths_test.go
+++ b/bundle/config/mutator/normalize_paths_test.go
@@ -7,6 +7,7 @@ import (
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/bundle/config"
 	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/databricks-sdk-go/service/jobs"
 	"github.com/stretchr/testify/assert"
@@ -36,11 +37,11 @@ func TestNormalizePaths(t *testing.T) {
 	}
 
 	// update config as if 'notebook_path' property is defined in resources/job_1.yml
-	location := dyn.Location{File: filepath.Join(tmpDir, "resources", "job_1.yml")}
+	location := diag.Location{File: filepath.Join(tmpDir, "resources", "job_1.yml")}
 	path := dyn.MustPathFromString("resources.jobs.job1.tasks[0].notebook_task.notebook_path")
 	err := b.Config.Mutate(func(v dyn.Value) (dyn.Value, error) {
 		return dyn.MapByPath(v, path, func(path dyn.Path, value dyn.Value) (dyn.Value, error) {
-			return dyn.NewValue(value.MustString(), []dyn.Location{location}), nil
+			return dyn.NewValue(value.MustString(), []diag.Location{location}), nil
 		})
 	})
 	require.NoError(t, err)
@@ -53,21 +54,60 @@ func TestNormalizePaths(t *testing.T) {
 	require.Equal(t, "src/notebook.py", newValue.MustString())
 }
 
+func TestNormalizePaths_jobRunOnFileChange(t *testing.T) {
+	tmpDir := t.TempDir()
+	pattern := "../data/*.txt"
+	m := NormalizePaths()
+	b := &bundle.Bundle{
+		Config: config.Root{
+			Resources: config.Resources{
+				JobRuns: map[string]*resources.JobRun{
+					"run1": {
+						Lifecycle: &resources.JobRunLifecycle{
+							Triggers: []resources.JobRunTrigger{
+								{OnFileChange: &pattern},
+							},
+							TriggersState: nil,
+						},
+					},
+				},
+			},
+		},
+		BundleRootPath: tmpDir,
+	}
+
+	location := diag.Location{File: filepath.Join(tmpDir, "resources", "run.yml")}
+	path := dyn.MustPathFromString("resources.job_runs.run1.lifecycle.triggers[0].on_file_change")
+	err := b.Config.Mutate(func(v dyn.Value) (dyn.Value, error) {
+		return dyn.MapByPath(v, path, func(path dyn.Path, value dyn.Value) (dyn.Value, error) {
+			return dyn.NewValue(value.MustString(), []diag.Location{location}), nil
+		})
+	})
+	require.NoError(t, err)
+
+	diags := bundle.Apply(t.Context(), b, m)
+	require.NoError(t, diags.Error())
+
+	newValue, err := dyn.GetByPath(b.Config.Value(), path)
+	require.NoError(t, err)
+	require.Equal(t, "data/*.txt", newValue.MustString())
+}
+
 func TestNormalizePath_absolutePath(t *testing.T) {
-	value, err := normalizePath("/notebook.py", dyn.Location{}, "/tmp")
+	value, err := normalizePath("/notebook.py", diag.Location{}, "/tmp")
 	assert.NoError(t, err)
 	assert.Equal(t, "/notebook.py", value)
 }
 
 func TestNormalizePath_url(t *testing.T) {
-	value, err := normalizePath("s3:///path/to/notebook.py", dyn.Location{}, "/tmp")
+	value, err := normalizePath("s3:///path/to/notebook.py", diag.Location{}, "/tmp")
 	assert.NoError(t, err)
 	assert.Equal(t, "s3:///path/to/notebook.py", value)
 }
 
 func TestNormalizePath_requirementsFile(t *testing.T) {
 	tmpDir := t.TempDir()
-	location := dyn.Location{File: filepath.Join(tmpDir, "resources", "job_1.yml")}
+	location := diag.Location{File: filepath.Join(tmpDir, "resources", "job_1.yml")}
 	value, err := normalizePath("-r ../requirements.txt", location, tmpDir)
 	assert.NoError(t, err)
 	assert.Equal(t, "-r requirements.txt", value)
@@ -79,21 +119,21 @@ func TestNormalizePath_requirementsFile(t *testing.T) {
 
 func TestNormalizePath_environmentDependency(t *testing.T) {
 	tmpDir := t.TempDir()
-	location := dyn.Location{File: filepath.Join(tmpDir, "resources", "job_1.yml")}
+	location := diag.Location{File: filepath.Join(tmpDir, "resources", "job_1.yml")}
 	value, err := normalizePath("-e ../file.py", location, tmpDir)
 	assert.NoError(t, err)
 	assert.Equal(t, "-e file.py", value)
 }
 
 func TestLocationDirectory(t *testing.T) {
-	loc := dyn.Location{File: "file", Line: 1, Column: 2}
+	loc := diag.Location{File: "file", Line: 1, Column: 2}
 	dir, err := locationDirectory(loc)
 	assert.NoError(t, err)
 	assert.Equal(t, ".", dir)
 }
 
 func TestLocationDirectoryNoFile(t *testing.T) {
-	loc := dyn.Location{}
+	loc := diag.Location{}
 	_, err := locationDirectory(loc)
 	assert.Error(t, err)
 }
diff --git a/bundle/config/mutator/override_immutable_folder.go b/bundle/config/mutator/override_immutable_folder.go
new file mode 100644
index 00000000000..a033ca12e5f
--- /dev/null
+++ b/bundle/config/mutator/override_immutable_folder.go
@@ -0,0 +1,35 @@
+package mutator
+
+import (
+	"context"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/libs/diag"
+	"github.com/databricks/cli/libs/env"
+)
+
+type overrideImmutableFolder struct{}
+
+// OverrideImmutableFolder sets bundle.deployment.immutable_folder to true
+// if the __TEST_DATABRICKS_IMMUTABLE_FOLDER environment variable is non-empty.
+// This allows running the acceptance test suite against the immutable folder
+// code path without modifying any databricks.yml files.
+func OverrideImmutableFolder() bundle.Mutator {
+	return &overrideImmutableFolder{}
+}
+
+func (m *overrideImmutableFolder) Name() string {
+	return "OverrideImmutableFolder"
+}
+
+func (m *overrideImmutableFolder) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
+	if env.Get(ctx, "__TEST_DATABRICKS_IMMUTABLE_FOLDER") == "" {
+		return nil
+	}
+	if b.Config.Experimental == nil {
+		b.Config.Experimental = &config.Experimental{}
+	}
+	b.Config.Experimental.ImmutableFolder = true
+	return nil
+}
diff --git a/bundle/config/mutator/override_immutable_folder_test.go b/bundle/config/mutator/override_immutable_folder_test.go
new file mode 100644
index 00000000000..a675974e7ed
--- /dev/null
+++ b/bundle/config/mutator/override_immutable_folder_test.go
@@ -0,0 +1,43 @@
+package mutator_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/config/mutator"
+	"github.com/databricks/cli/libs/env"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestOverrideImmutableFolderNotSet(t *testing.T) {
+	t.Parallel()
+	ctx := env.Set(t.Context(), "__TEST_DATABRICKS_IMMUTABLE_FOLDER", "")
+	b := &bundle.Bundle{Config: config.Root{}}
+	diags := bundle.Apply(ctx, b, mutator.OverrideImmutableFolder())
+	require.NoError(t, diags.Error())
+	assert.True(t, b.Config.Experimental == nil || !b.Config.Experimental.ImmutableFolder)
+}
+
+func TestOverrideImmutableFolderSet(t *testing.T) {
+	t.Parallel()
+	ctx := env.Set(t.Context(), "__TEST_DATABRICKS_IMMUTABLE_FOLDER", "true")
+	b := &bundle.Bundle{Config: config.Root{}}
+	diags := bundle.Apply(ctx, b, mutator.OverrideImmutableFolder())
+	require.NoError(t, diags.Error())
+	require.NotNil(t, b.Config.Experimental)
+	assert.True(t, b.Config.Experimental.ImmutableFolder)
+}
+
+func TestOverrideImmutableFolderAlreadyTrue(t *testing.T) {
+	t.Parallel()
+	ctx := env.Set(t.Context(), "__TEST_DATABRICKS_IMMUTABLE_FOLDER", "")
+	b := &bundle.Bundle{Config: config.Root{}}
+	b.Config.Experimental = &config.Experimental{ImmutableFolder: true}
+	diags := bundle.Apply(ctx, b, mutator.OverrideImmutableFolder())
+	require.NoError(t, diags.Error())
+	// Existing true value must not be cleared when the env var is absent.
+	require.NotNil(t, b.Config.Experimental)
+	assert.True(t, b.Config.Experimental.ImmutableFolder)
+}
diff --git a/bundle/config/mutator/paths/app_paths_visitor_test.go b/bundle/config/mutator/paths/app_paths_visitor_test.go
index 5c5951dab16..9ec01aeaf83 100644
--- a/bundle/config/mutator/paths/app_paths_visitor_test.go
+++ b/bundle/config/mutator/paths/app_paths_visitor_test.go
@@ -6,6 +6,7 @@ import (
 	"github.com/databricks/cli/bundle/config"
 	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/databricks-sdk-go/service/apps"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -14,7 +15,9 @@ func TestAppPathsVisitor(t *testing.T) {
 		Resources: config.Resources{
 			Apps: map[string]*resources.App{
 				"app0": {
-					SourceCodePath: "foo",
+					App: apps.App{
+						SourceCodePath: "foo",
+					},
 				},
 			},
 		},
diff --git a/bundle/config/mutator/paths/genie_space_paths_visitor.go b/bundle/config/mutator/paths/genie_space_paths_visitor.go
new file mode 100644
index 00000000000..edd6ff2d8df
--- /dev/null
+++ b/bundle/config/mutator/paths/genie_space_paths_visitor.go
@@ -0,0 +1,18 @@
+package paths
+
+import (
+	"github.com/databricks/cli/libs/dyn"
+)
+
+func VisitGenieSpacePaths(value dyn.Value, fn VisitFunc) (dyn.Value, error) {
+	pattern := dyn.NewPattern(
+		dyn.Key("resources"),
+		dyn.Key("genie_spaces"),
+		dyn.AnyKey(),
+		dyn.Key("file_path"),
+	)
+
+	return dyn.MapByPattern(value, pattern, func(path dyn.Path, value dyn.Value) (dyn.Value, error) {
+		return fn(path, TranslateModeLocalRelative, value)
+	})
+}
diff --git a/bundle/config/mutator/paths/job_libraries_paths_visitor_test.go b/bundle/config/mutator/paths/job_libraries_paths_visitor_test.go
index b35087e579d..07b3c6d6641 100644
--- a/bundle/config/mutator/paths/job_libraries_paths_visitor_test.go
+++ b/bundle/config/mutator/paths/job_libraries_paths_visitor_test.go
@@ -51,16 +51,14 @@ func TestVisitJobLibrariesPaths(t *testing.T) {
 	}
 
 	job0 := &resources.Job{
-		JobSettings: jobs.JobSettings{
-			Tasks: []jobs.Task{
-				task0,
-				task1,
-				task2,
-				task3,
-				task4,
-				task5,
-				task6,
-			},
+		Tasks: []jobs.Task{
+			task0,
+			task1,
+			task2,
+			task3,
+			task4,
+			task5,
+			task6,
 		},
 	}
 
@@ -91,10 +89,8 @@ func TestVisitJobLibrariesPaths_environments(t *testing.T) {
 		},
 	}
 	job0 := &resources.Job{
-		JobSettings: jobs.JobSettings{
-			Environments: []jobs.JobEnvironment{
-				environment0,
-			},
+		Environments: []jobs.JobEnvironment{
+			environment0,
 		},
 	}
 
diff --git a/bundle/config/mutator/paths/job_paths_visitor.go b/bundle/config/mutator/paths/job_paths_visitor.go
index 49011e4b1e7..a3abd0090a4 100644
--- a/bundle/config/mutator/paths/job_paths_visitor.go
+++ b/bundle/config/mutator/paths/job_paths_visitor.go
@@ -46,11 +46,19 @@ func jobTaskRewritePatterns(base dyn.Pattern) []jobRewritePattern {
 			TranslateModeFile,
 			noSkipRewrite,
 		},
+		{
+			// The AI Runtime task runs this bash script on each node; the backend
+			// reads it as a workspace file, so translate the local path to its
+			// remote (or immutable-snapshot) location like any other file.
+			base.Append(dyn.Key("ai_runtime_task"), dyn.Key("deployments"), dyn.AnyIndex(), dyn.Key("command_path")),
+			TranslateModeFile,
+			noSkipRewrite,
+		},
 	}
 }
 
 func jobRewritePatterns() []jobRewritePattern {
-	// Base pattern to match all tasks in all jobs.
+	// Task-level base pattern for all jobs.
 	base := dyn.NewPattern(
 		dyn.Key("resources"),
 		dyn.Key("jobs"),
@@ -61,7 +69,37 @@ func jobRewritePatterns() []jobRewritePattern {
 
 	taskPatterns := jobTaskRewritePatterns(base)
 	forEachPatterns := jobTaskRewritePatterns(base.Append(dyn.Key("for_each_task"), dyn.Key("task")))
-	return append(taskPatterns, forEachPatterns...)
+	patterns := append(taskPatterns, forEachPatterns...)
+	return append(patterns,
+		jobRewritePattern{
+			dyn.NewPattern(
+				dyn.Key("resources"),
+				dyn.Key("jobs"),
+				dyn.AnyKey(),
+				dyn.Key("environment_variables"),
+				dyn.AnyIndex(),
+				dyn.Key("spec"),
+				dyn.Key("files"),
+				dyn.AnyIndex(),
+			),
+			TranslateModeFile,
+			noSkipRewrite,
+		},
+		// Environment-level pattern for all jobs.
+		jobRewritePattern{
+			dyn.NewPattern(
+				dyn.Key("resources"),
+				dyn.Key("jobs"),
+				dyn.AnyKey(),
+				dyn.Key("environments"),
+				dyn.AnyIndex(),
+				dyn.Key("spec"),
+				dyn.Key("project_environment"),
+			),
+			TranslateModeFile,
+			noSkipRewrite,
+		},
+	)
 }
 
 // VisitJobPaths visits all paths in job resources and applies a function to each path.
diff --git a/bundle/config/mutator/paths/job_paths_visitor_test.go b/bundle/config/mutator/paths/job_paths_visitor_test.go
index 6e6687c265f..b9fe29d154e 100644
--- a/bundle/config/mutator/paths/job_paths_visitor_test.go
+++ b/bundle/config/mutator/paths/job_paths_visitor_test.go
@@ -54,19 +54,25 @@ func TestVisitJobPaths(t *testing.T) {
 			WorkspacePath: "abc",
 		},
 	}
+	task8 := jobs.Task{
+		AiRuntimeTask: &jobs.AiRuntimeTask{
+			Deployments: []jobs.DeploymentSpec{
+				{CommandPath: "abc"},
+			},
+		},
+	}
 
 	job0 := &resources.Job{
-		JobSettings: jobs.JobSettings{
-			Tasks: []jobs.Task{
-				task0,
-				task1,
-				task2,
-				task3,
-				task4,
-				task5,
-				task6,
-				task7,
-			},
+		Tasks: []jobs.Task{
+			task0,
+			task1,
+			task2,
+			task3,
+			task4,
+			task5,
+			task6,
+			task7,
+			task8,
 		},
 	}
 
@@ -86,6 +92,7 @@ func TestVisitJobPaths(t *testing.T) {
 		dyn.MustPathFromString("resources.jobs.job0.tasks[3].sql_task.file.path"),
 		dyn.MustPathFromString("resources.jobs.job0.tasks[6].libraries[0].requirements"),
 		dyn.MustPathFromString("resources.jobs.job0.tasks[7].alert_task.workspace_path"),
+		dyn.MustPathFromString("resources.jobs.job0.tasks[8].ai_runtime_task.deployments[0].command_path"),
 	}
 
 	assert.ElementsMatch(t, expected, actual)
@@ -101,9 +108,41 @@ func TestVisitJobPaths_environments(t *testing.T) {
 		},
 	}
 	job0 := &resources.Job{
-		JobSettings: jobs.JobSettings{
-			Environments: []jobs.JobEnvironment{
-				environment0,
+		Environments: []jobs.JobEnvironment{
+			environment0,
+			{Spec: &compute.Environment{ProjectEnvironment: "../pyproject.toml"}},
+			{Spec: &compute.Environment{ProjectEnvironment: "/Workspace/shared/pyproject.toml"}},
+		},
+	}
+
+	root := config.Root{
+		Resources: config.Resources{
+			Jobs: map[string]*resources.Job{
+				"job0": job0,
+			},
+		},
+	}
+
+	actual := collectVisitedPaths(t, root, VisitJobPaths)
+	expected := []dyn.Path{
+		dyn.MustPathFromString("resources.jobs.job0.environments[1].spec.project_environment"),
+		dyn.MustPathFromString("resources.jobs.job0.environments[2].spec.project_environment"),
+	}
+
+	assert.ElementsMatch(t, expected, actual)
+}
+
+func TestVisitJobPaths_environmentVariables(t *testing.T) {
+	job0 := &resources.Job{
+		EnvironmentVariables: []jobs.JobEnvironmentVariables{
+			{
+				EnvironmentVariablesKey: "default",
+				Spec: &jobs.JobEnvironmentVariablesSpec{
+					Files: []string{
+						"./a.env",
+						"./b.env",
+					},
+				},
 			},
 		},
 	}
@@ -117,7 +156,10 @@ func TestVisitJobPaths_environments(t *testing.T) {
 	}
 
 	actual := collectVisitedPaths(t, root, VisitJobPaths)
-	var expected []dyn.Path
+	expected := []dyn.Path{
+		dyn.MustPathFromString("resources.jobs.job0.environment_variables[0].spec.files[0]"),
+		dyn.MustPathFromString("resources.jobs.job0.environment_variables[0].spec.files[1]"),
+	}
 
 	assert.ElementsMatch(t, expected, actual)
 }
@@ -142,11 +184,9 @@ func TestVisitJobPaths_foreach(t *testing.T) {
 		},
 	}
 	job0 := &resources.Job{
-		JobSettings: jobs.JobSettings{
-			Tasks: []jobs.Task{
-				task0,
-				task1,
-			},
+		Tasks: []jobs.Task{
+			task0,
+			task1,
 		},
 	}
 
diff --git a/bundle/config/mutator/paths/job_run_paths_visitor.go b/bundle/config/mutator/paths/job_run_paths_visitor.go
new file mode 100644
index 00000000000..3bc56bacf72
--- /dev/null
+++ b/bundle/config/mutator/paths/job_run_paths_visitor.go
@@ -0,0 +1,24 @@
+package paths
+
+import (
+	"github.com/databricks/cli/libs/dyn"
+)
+
+// VisitJobRunPaths visits local paths on job_runs so NormalizePaths can rewrite
+// them relative to the bundle root. Not used by TranslatePaths: hashing still
+// needs a local glob, not a workspace path.
+func VisitJobRunPaths(value dyn.Value, fn VisitFunc) (dyn.Value, error) {
+	pattern := dyn.NewPattern(
+		dyn.Key("resources"),
+		dyn.Key("job_runs"),
+		dyn.AnyKey(),
+		dyn.Key("lifecycle"),
+		dyn.Key("triggers"),
+		dyn.AnyIndex(),
+		dyn.Key("on_file_change"),
+	)
+
+	return dyn.MapByPattern(value, pattern, func(path dyn.Path, value dyn.Value) (dyn.Value, error) {
+		return fn(path, TranslateModeLocalRelative, value)
+	})
+}
diff --git a/bundle/config/mutator/paths/job_run_paths_visitor_test.go b/bundle/config/mutator/paths/job_run_paths_visitor_test.go
new file mode 100644
index 00000000000..93df73d3c9e
--- /dev/null
+++ b/bundle/config/mutator/paths/job_run_paths_visitor_test.go
@@ -0,0 +1,35 @@
+package paths
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/cli/libs/dyn"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestVisitJobRunPaths(t *testing.T) {
+	watched := "watched.txt"
+	root := config.Root{
+		Resources: config.Resources{
+			JobRuns: map[string]*resources.JobRun{
+				"run0": {
+					Lifecycle: &resources.JobRunLifecycle{
+						Triggers: []resources.JobRunTrigger{
+							{OnFileChange: &watched},
+						},
+						TriggersState: nil,
+					},
+				},
+			},
+		},
+	}
+
+	actual := collectVisitedPaths(t, root, VisitJobRunPaths)
+	expected := []dyn.Path{
+		dyn.MustPathFromString("resources.job_runs.run0.lifecycle.triggers[0].on_file_change"),
+	}
+
+	assert.ElementsMatch(t, expected, actual)
+}
diff --git a/bundle/config/mutator/paths/visitor.go b/bundle/config/mutator/paths/visitor.go
index 0e3d59d43f5..cadc52b75fe 100644
--- a/bundle/config/mutator/paths/visitor.go
+++ b/bundle/config/mutator/paths/visitor.go
@@ -10,11 +10,13 @@ type VisitFunc func(path dyn.Path, mode TranslateMode, value dyn.Value) (dyn.Val
 func VisitPaths(root dyn.Value, fn VisitFunc) (dyn.Value, error) {
 	visitors := []func(dyn.Value, VisitFunc) (dyn.Value, error){
 		VisitJobPaths,
+		VisitJobRunPaths,
 		VisitJobLibrariesPaths,
 		VisitAppPaths,
 		VisitArtifactPaths,
 		VisitAlertPaths,
 		VisitDashboardPaths,
+		VisitGenieSpacePaths,
 		VisitPipelinePaths,
 		VisitPipelineLibrariesPaths,
 	}
diff --git a/bundle/config/mutator/populate_current_user.go b/bundle/config/mutator/populate_current_user.go
index 2a3cc492829..a00234912fa 100644
--- a/bundle/config/mutator/populate_current_user.go
+++ b/bundle/config/mutator/populate_current_user.go
@@ -31,7 +31,7 @@ func (m *populateCurrentUser) Apply(ctx context.Context, b *bundle.Bundle) diag.
 
 	fingerprint := b.GetUserFingerprint(ctx)
 	me, err := cache.GetOrCompute(ctx, b.Cache, fingerprint, func(ctx context.Context) (*iam.User, error) {
-		return w.CurrentUser.Me(ctx)
+		return iamutil.GetCurrentUser(ctx, w)
 	})
 	if err != nil {
 		return diag.FromErr(err)
diff --git a/bundle/config/mutator/prepend_workspace_prefix.go b/bundle/config/mutator/prepend_workspace_prefix.go
index 616759ee4fe..3124244c857 100644
--- a/bundle/config/mutator/prepend_workspace_prefix.go
+++ b/bundle/config/mutator/prepend_workspace_prefix.go
@@ -41,7 +41,7 @@ func (m *prependWorkspacePrefix) Apply(ctx context.Context, b *bundle.Bundle) di
 			v, err = dyn.MapByPattern(v, pattern, func(p dyn.Path, pv dyn.Value) (dyn.Value, error) {
 				path, ok := pv.AsString()
 				if !ok {
-					return dyn.InvalidValue, fmt.Errorf("expected string, got %s", v.Kind())
+					return dyn.InvalidValue, fmt.Errorf("expected string, got %s", pv.Kind())
 				}
 
 				// Skip prefixing if the path does not start with /, it might be variable reference or smth else.
@@ -55,7 +55,8 @@ func (m *prependWorkspacePrefix) Apply(ctx context.Context, b *bundle.Bundle) di
 					}
 				}
 
-				return dyn.NewValue("/Workspace"+path, v.Locations()), nil
+				// Use pv's locations, not the root v's, so diagnostics point at the original config line.
+				return dyn.NewValue("/Workspace"+path, pv.Locations()), nil
 			})
 			if err != nil {
 				return dyn.InvalidValue, err
diff --git a/bundle/config/mutator/prepend_workspace_prefix_test.go b/bundle/config/mutator/prepend_workspace_prefix_test.go
index b4c3f4ddaae..6c439247051 100644
--- a/bundle/config/mutator/prepend_workspace_prefix_test.go
+++ b/bundle/config/mutator/prepend_workspace_prefix_test.go
@@ -5,6 +5,8 @@ import (
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/internal/bundletest"
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/databricks-sdk-go/service/iam"
 	"github.com/stretchr/testify/require"
 )
@@ -63,6 +65,23 @@ func TestPrependWorkspacePrefix(t *testing.T) {
 	}
 }
 
+func TestPrependWorkspacePrefixPreservesLocations(t *testing.T) {
+	b := &bundle.Bundle{
+		Config: config.Root{
+			Workspace: config.Workspace{
+				RootPath: "/Users/test",
+			},
+		},
+	}
+	locations := []diag.Location{{File: "databricks.yml", Line: 42, Column: 5}}
+	bundletest.SetLocation(b, "workspace.root_path", locations)
+
+	diags := bundle.Apply(t.Context(), b, PrependWorkspacePrefix())
+	require.Empty(t, diags)
+	require.Equal(t, "/Workspace/Users/test", b.Config.Workspace.RootPath)
+	require.Equal(t, locations, b.Config.GetLocations("workspace.root_path"))
+}
+
 func TestPrependWorkspaceForDefaultConfig(t *testing.T) {
 	b := &bundle.Bundle{
 		Config: config.Root{
diff --git a/bundle/config/mutator/python/apply_python_output_test.go b/bundle/config/mutator/python/apply_python_output_test.go
index 2d64d6c4bbc..94d7e7c39cc 100644
--- a/bundle/config/mutator/python/apply_python_output_test.go
+++ b/bundle/config/mutator/python/apply_python_output_test.go
@@ -5,6 +5,7 @@ import (
 
 	"github.com/databricks/cli/bundle/config/mutator/resourcemutator"
 
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn/merge"
 
 	"github.com/databricks/cli/libs/dyn"
@@ -196,7 +197,7 @@ func TestCreateOverrideVisitor_omitempty(t *testing.T) {
 	// there is no semantic difference between empty and missing, so we keep them as they were before
 	// Python code deleted them.
 
-	location := dyn.Location{
+	location := diag.Location{
 		File:   "databricks.yml",
 		Line:   10,
 		Column: 20,
@@ -206,38 +207,38 @@ func TestCreateOverrideVisitor_omitempty(t *testing.T) {
 		{
 			name:        "undo delete of empty variables",
 			path:        dyn.MustPathFromString("variables"),
-			left:        dyn.NewValue([]dyn.Value{}, []dyn.Location{location}),
+			left:        dyn.NewValue([]dyn.Value{}, []diag.Location{location}),
 			expectedErr: merge.ErrOverrideUndoDelete,
 		},
 		{
 			name:        "undo delete of empty job clusters",
 			path:        dyn.MustPathFromString("resources.jobs.job0.job_clusters"),
-			left:        dyn.NewValue([]dyn.Value{}, []dyn.Location{location}),
+			left:        dyn.NewValue([]dyn.Value{}, []diag.Location{location}),
 			expectedErr: merge.ErrOverrideUndoDelete,
 		},
 		{
 			name:        "allow delete of non-empty job clusters",
 			path:        dyn.MustPathFromString("resources.jobs.job0.job_clusters"),
-			left:        dyn.NewValue([]dyn.Value{dyn.NewValue("abc", []dyn.Location{location})}, []dyn.Location{location}),
+			left:        dyn.NewValue([]dyn.Value{dyn.NewValue("abc", []diag.Location{location})}, []diag.Location{location}),
 			expectedErr: nil,
 		},
 		{
 			name:        "undo delete of empty tags",
 			path:        dyn.MustPathFromString("resources.jobs.job0.tags"),
-			left:        dyn.NewValue(map[string]dyn.Value{}, []dyn.Location{location}),
+			left:        dyn.NewValue(map[string]dyn.Value{}, []diag.Location{location}),
 			expectedErr: merge.ErrOverrideUndoDelete,
 		},
 		{
 			name: "allow delete of non-empty tags",
 			path: dyn.MustPathFromString("resources.jobs.job0.tags"),
-			left: dyn.NewValue(map[string]dyn.Value{"dev": dyn.NewValue("true", []dyn.Location{location})}, []dyn.Location{location}),
+			left: dyn.NewValue(map[string]dyn.Value{"dev": dyn.NewValue("true", []diag.Location{location})}, []diag.Location{location}),
 
 			expectedErr: nil,
 		},
 		{
 			name:        "undo delete of nil",
 			path:        dyn.MustPathFromString("resources.jobs.job0.tags"),
-			left:        dyn.NilValue.WithLocations([]dyn.Location{location}),
+			left:        dyn.NilValue.WithLocations([]diag.Location{location}),
 			expectedErr: merge.ErrOverrideUndoDelete,
 		},
 	}
diff --git a/bundle/config/mutator/python/python_diagnostics.go b/bundle/config/mutator/python/python_diagnostics.go
index 7a1e13b4e19..3006ee8321b 100644
--- a/bundle/config/mutator/python/python_diagnostics.go
+++ b/bundle/config/mutator/python/python_diagnostics.go
@@ -7,6 +7,7 @@ import (
 
 	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/structs/structpath"
 )
 
 // pythonDiagnostic is a single entry in diagnostics.json
@@ -43,26 +44,26 @@ func parsePythonDiagnostics(input io.Reader) (diag.Diagnostics, error) {
 
 		err := decoder.Decode(&parsedLine)
 		if err != nil {
-			return nil, fmt.Errorf("failed to parse diags: %s", err)
+			return nil, fmt.Errorf("failed to parse diags: %w", err)
 		}
 
 		severity, err := convertPythonSeverity(parsedLine.Severity)
 		if err != nil {
-			return nil, fmt.Errorf("failed to parse severity: %s", err)
+			return nil, fmt.Errorf("failed to parse severity: %w", err)
 		}
 
 		path, err := convertPythonPath(parsedLine.Path)
 		if err != nil {
-			return nil, fmt.Errorf("failed to parse path: %s", err)
+			return nil, fmt.Errorf("failed to parse path: %w", err)
 		}
-		var paths []dyn.Path
+		var paths []*structpath.PathNode
 		if path != nil {
-			paths = []dyn.Path{path}
+			paths = dyn.ToStructPaths(path)
 		}
 
-		var locations []dyn.Location
+		var locations []diag.Location
 		location := convertPythonLocation(parsedLine.Location)
-		if location != (dyn.Location{}) {
+		if location != (diag.Location{}) {
 			locations = append(locations, location)
 		}
 
@@ -99,8 +100,8 @@ func convertPythonSeverity(severity pythonSeverity) (diag.Severity, error) {
 	}
 }
 
-func convertPythonLocation(location pythonDiagnosticLocation) dyn.Location {
-	return dyn.Location{
+func convertPythonLocation(location pythonDiagnosticLocation) diag.Location {
+	return diag.Location{
 		File:   location.File,
 		Line:   location.Line,
 		Column: location.Column,
diff --git a/bundle/config/mutator/python/python_diagnostics_test.go b/bundle/config/mutator/python/python_diagnostics_test.go
index 6fef9eca9cb..faba60e7498 100644
--- a/bundle/config/mutator/python/python_diagnostics_test.go
+++ b/bundle/config/mutator/python/python_diagnostics_test.go
@@ -5,7 +5,7 @@ import (
 	"testing"
 
 	"github.com/databricks/cli/libs/diag"
-	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/structs/structpath"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -16,7 +16,7 @@ func TestConvertPythonLocation(t *testing.T) {
 		Column: 2,
 	})
 
-	assert.Equal(t, dyn.Location{
+	assert.Equal(t, diag.Location{
 		File:   "src/examples/file.py",
 		Line:   1,
 		Column: 2,
@@ -38,7 +38,7 @@ func TestParsePythonDiagnostics(t *testing.T) {
 				{
 					Severity: diag.Error,
 					Summary:  "error summary",
-					Locations: []dyn.Location{
+					Locations: []diag.Location{
 						{
 							File:   "src/examples/file.py",
 							Line:   1,
@@ -55,7 +55,7 @@ func TestParsePythonDiagnostics(t *testing.T) {
 				{
 					Severity: diag.Error,
 					Summary:  "error summary",
-					Paths:    []dyn.Path{dyn.MustPathFromString("resources.jobs.job0.name")},
+					Paths:    structpath.NewPathSlice("resources", "jobs", "job0", "name"),
 				},
 			},
 		},
diff --git a/bundle/config/mutator/python/python_locations.go b/bundle/config/mutator/python/python_locations.go
index 9cb65c302e5..bb301da9755 100644
--- a/bundle/config/mutator/python/python_locations.go
+++ b/bundle/config/mutator/python/python_locations.go
@@ -7,12 +7,13 @@ import (
 	pathlib "path"
 	"path/filepath"
 
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
 )
 
 // generatedFileName is used as the virtual file name for YAML generated by Python code.
 //
-// mergePythonLocations replaces dyn.Location with generatedFileName with locations loaded
+// mergePythonLocations replaces diag.Location with generatedFileName with locations loaded
 // from locations.json
 const generatedFileName = "__generated_by_python__.yml"
 
@@ -42,7 +43,7 @@ type pythonLocations struct {
 	indexes map[int]*pythonLocations
 
 	// location for the current node if it exists
-	location dyn.Location
+	location diag.Location
 
 	// if true, location is present
 	exists bool
@@ -75,7 +76,7 @@ func mergePythonLocations(value dyn.Value, locations *pythonLocations) (dyn.Valu
 		// We preserve any previous non-virtual locations in case when Python function modified
 		// resource defined in YAML.
 		newLocations := append(
-			[]dyn.Location{newLocation},
+			[]diag.Location{newLocation},
 			removeVirtualLocations(value.Locations())...,
 		)
 
@@ -83,8 +84,8 @@ func mergePythonLocations(value dyn.Value, locations *pythonLocations) (dyn.Valu
 	})
 }
 
-func removeVirtualLocations(locations []dyn.Location) []dyn.Location {
-	var newLocations []dyn.Location
+func removeVirtualLocations(locations []diag.Location) []diag.Location {
+	var newLocations []diag.Location
 
 	for _, location := range locations {
 		if filepath.Base(location.File) == generatedFileName {
@@ -109,12 +110,12 @@ func parsePythonLocations(bundleRoot string, input io.Reader) (*pythonLocations,
 
 		err := decoder.Decode(&entry)
 		if err != nil {
-			return nil, fmt.Errorf("failed to parse python location: %s", err)
+			return nil, fmt.Errorf("failed to parse python location: %w", err)
 		}
 
 		path, err := dyn.NewPathFromString(entry.Path)
 		if err != nil {
-			return nil, fmt.Errorf("failed to parse python location: %s", err)
+			return nil, fmt.Errorf("failed to parse python location: %w", err)
 		}
 
 		// Output can contain both relative paths and absolute paths outside of bundle root.
@@ -123,7 +124,7 @@ func parsePythonLocations(bundleRoot string, input io.Reader) (*pythonLocations,
 			entry.File = filepath.Join(bundleRoot, entry.File)
 		}
 
-		location := dyn.Location{
+		location := diag.Location{
 			File:   entry.File,
 			Line:   entry.Line,
 			Column: entry.Column,
@@ -136,7 +137,7 @@ func parsePythonLocations(bundleRoot string, input io.Reader) (*pythonLocations,
 }
 
 // putPythonLocation puts the location to the trie for the given path
-func putPythonLocation(trie *pythonLocations, path dyn.Path, location dyn.Location) {
+func putPythonLocation(trie *pythonLocations, path dyn.Path, location diag.Location) {
 	currentNode := trie
 
 	for _, component := range path {
@@ -170,7 +171,7 @@ func newPythonLocations() *pythonLocations {
 
 // findPythonLocation finds the location or closest ancestor location in the trie for the given path
 // if no ancestor or exact location is found, false is returned.
-func findPythonLocation(locations *pythonLocations, path dyn.Path) (dyn.Location, bool) {
+func findPythonLocation(locations *pythonLocations, path dyn.Path) (diag.Location, bool) {
 	currentNode := locations
 	lastLocation := locations.location
 	exists := locations.exists
diff --git a/bundle/config/mutator/python/python_locations_test.go b/bundle/config/mutator/python/python_locations_test.go
index 9c5b33d3b59..2bc815e7cdc 100644
--- a/bundle/config/mutator/python/python_locations_test.go
+++ b/bundle/config/mutator/python/python_locations_test.go
@@ -13,9 +13,9 @@ import (
 )
 
 func TestMergeLocations(t *testing.T) {
-	pythonLocation := dyn.Location{File: "foo.py", Line: 1, Column: 1}
-	generatedLocation := dyn.Location{File: generatedFileName, Line: 1, Column: 1}
-	yamlLocation := dyn.Location{File: "foo.yml", Line: 1, Column: 1}
+	pythonLocation := diag.Location{File: "foo.py", Line: 1, Column: 1}
+	generatedLocation := diag.Location{File: generatedFileName, Line: 1, Column: 1}
+	yamlLocation := diag.Location{File: "foo.yml", Line: 1, Column: 1}
 
 	locations := newPythonLocations()
 	putPythonLocation(locations, dyn.MustPathFromString("foo"), pythonLocation)
@@ -24,13 +24,13 @@ func TestMergeLocations(t *testing.T) {
 		map[string]dyn.Value{
 			"foo": dyn.V(
 				map[string]dyn.Value{
-					"baz": dyn.NewValue("baz", []dyn.Location{yamlLocation}),
-					"qux": dyn.NewValue("baz", []dyn.Location{generatedLocation, yamlLocation}),
+					"baz": dyn.NewValue("baz", []diag.Location{yamlLocation}),
+					"qux": dyn.NewValue("baz", []diag.Location{generatedLocation, yamlLocation}),
 				},
 			),
-			"bar": dyn.NewValue("baz", []dyn.Location{generatedLocation}),
+			"bar": dyn.NewValue("baz", []diag.Location{generatedLocation}),
 		},
-		[]dyn.Location{yamlLocation},
+		[]diag.Location{yamlLocation},
 	)
 
 	expected := dyn.NewValue(
@@ -38,16 +38,16 @@ func TestMergeLocations(t *testing.T) {
 			"foo": dyn.NewValue(
 				map[string]dyn.Value{
 					// pythonLocation is appended to the beginning of the list if absent
-					"baz": dyn.NewValue("baz", []dyn.Location{pythonLocation, yamlLocation}),
+					"baz": dyn.NewValue("baz", []diag.Location{pythonLocation, yamlLocation}),
 					// generatedLocation is replaced by pythonLocation
-					"qux": dyn.NewValue("baz", []dyn.Location{pythonLocation, yamlLocation}),
+					"qux": dyn.NewValue("baz", []diag.Location{pythonLocation, yamlLocation}),
 				},
-				[]dyn.Location{pythonLocation},
+				[]diag.Location{pythonLocation},
 			),
 			// if location is unknown, we keep it as-is
-			"bar": dyn.NewValue("baz", []dyn.Location{generatedLocation}),
+			"bar": dyn.NewValue("baz", []diag.Location{generatedLocation}),
 		},
-		[]dyn.Location{yamlLocation},
+		[]diag.Location{yamlLocation},
 	)
 
 	actual, err := mergePythonLocations(input, locations)
@@ -57,8 +57,8 @@ func TestMergeLocations(t *testing.T) {
 }
 
 func TestFindLocation(t *testing.T) {
-	location0 := dyn.Location{File: "foo.py", Line: 1, Column: 1}
-	location1 := dyn.Location{File: "foo.py", Line: 2, Column: 1}
+	location0 := diag.Location{File: "foo.py", Line: 1, Column: 1}
+	location1 := diag.Location{File: "foo.py", Line: 2, Column: 1}
 
 	locations := newPythonLocations()
 	putPythonLocation(locations, dyn.MustPathFromString("foo"), location0)
@@ -71,9 +71,9 @@ func TestFindLocation(t *testing.T) {
 }
 
 func TestFindLocation_indexPathComponent(t *testing.T) {
-	location0 := dyn.Location{File: "foo.py", Line: 1, Column: 1}
-	location1 := dyn.Location{File: "foo.py", Line: 2, Column: 1}
-	location2 := dyn.Location{File: "foo.py", Line: 3, Column: 1}
+	location0 := diag.Location{File: "foo.py", Line: 1, Column: 1}
+	location1 := diag.Location{File: "foo.py", Line: 2, Column: 1}
+	location2 := diag.Location{File: "foo.py", Line: 3, Column: 1}
 
 	locations := newPythonLocations()
 	putPythonLocation(locations, dyn.MustPathFromString("foo"), location0)
@@ -87,8 +87,8 @@ func TestFindLocation_indexPathComponent(t *testing.T) {
 }
 
 func TestFindLocation_closestAncestorLocation(t *testing.T) {
-	location0 := dyn.Location{File: "foo.py", Line: 1, Column: 1}
-	location1 := dyn.Location{File: "foo.py", Line: 2, Column: 1}
+	location0 := diag.Location{File: "foo.py", Line: 1, Column: 1}
+	location1 := diag.Location{File: "foo.py", Line: 2, Column: 1}
 
 	locations := newPythonLocations()
 	putPythonLocation(locations, dyn.MustPathFromString("foo"), location0)
@@ -101,8 +101,8 @@ func TestFindLocation_closestAncestorLocation(t *testing.T) {
 }
 
 func TestFindLocation_unknownLocation(t *testing.T) {
-	location0 := dyn.Location{File: "foo.py", Line: 1, Column: 1}
-	location1 := dyn.Location{File: "foo.py", Line: 2, Column: 1}
+	location0 := diag.Location{File: "foo.py", Line: 1, Column: 1}
+	location1 := diag.Location{File: "foo.py", Line: 2, Column: 1}
 
 	locations := newPythonLocations()
 	putPythonLocation(locations, dyn.MustPathFromString("foo"), location0)
@@ -114,7 +114,7 @@ func TestFindLocation_unknownLocation(t *testing.T) {
 }
 
 func TestLoadOutput(t *testing.T) {
-	location := dyn.Location{File: "my_job.py", Line: 1, Column: 1}
+	location := diag.Location{File: "my_job.py", Line: 1, Column: 1}
 	bundleRoot := t.TempDir()
 	output := `{
 		"resources": {
@@ -151,12 +151,12 @@ func TestLoadOutput(t *testing.T) {
 
 	name, err := dyn.Get(value, "resources.jobs.my_job.name")
 	require.NoError(t, err)
-	require.Equal(t, []dyn.Location{location}, name.Locations())
+	require.Equal(t, []diag.Location{location}, name.Locations())
 }
 
 func TestParsePythonLocations_absolutePath(t *testing.T) {
 	// output can contain absolute path that is outside of the bundle root
-	expected := dyn.Location{File: "/Shared/foo.py", Line: 1, Column: 2}
+	expected := diag.Location{File: "/Shared/foo.py", Line: 1, Column: 2}
 
 	input := `{"path": "foo", "file": "/Shared/foo.py", "line": 1, "column": 2}`
 	reader := bytes.NewReader([]byte(input))
@@ -171,7 +171,7 @@ func TestParsePythonLocations_absolutePath(t *testing.T) {
 func TestParsePythonLocations_relativePath(t *testing.T) {
 	// output can contain relative paths, we expect all locations to be absolute
 	// at this stage of mutator pipeline
-	expected := dyn.Location{File: filepath.Clean("/tmp/my_project/foo.py"), Line: 1, Column: 2}
+	expected := diag.Location{File: filepath.Clean("/tmp/my_project/foo.py"), Line: 1, Column: 2}
 
 	input := `{"path": "foo", "file": "foo.py", "line": 1, "column": 2}`
 	reader := bytes.NewReader([]byte(input))
diff --git a/bundle/config/mutator/python/python_mutator.go b/bundle/config/mutator/python/python_mutator.go
index 44e19b276a3..5d6e8b0d801 100644
--- a/bundle/config/mutator/python/python_mutator.go
+++ b/bundle/config/mutator/python/python_mutator.go
@@ -104,6 +104,7 @@ type runPythonMutatorOpts struct {
 	bundleRootPath string
 	pythonPath     string
 	loadLocations  bool
+	authEnv        map[string]string
 }
 
 // getOpts adapts deprecated PyDABs and upcoming Python configuration
@@ -217,6 +218,15 @@ func (m *pythonMutator) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagno
 		return diag.Errorf("Running Python code is not allowed when DATABRICKS_BUNDLE_RESTRICTED_CODE_EXECUTION is set")
 	}
 
+	// Propagate auth env so the Databricks SDK in the Python subprocess uses the
+	// same credentials as the CLI. In particular this carries DATABRICKS_CONFIG_PROFILE,
+	// which lets the CLI disambiguate profiles sharing the same host when the SDK
+	// re-invokes `databricks auth token --host <host>`.
+	authEnv, err := b.AuthEnv(ctx)
+	if err != nil {
+		return diag.FromErr(err)
+	}
+
 	// mutateDiags is used because Mutate returns 'error' instead of 'diag.Diagnostics'
 	var mutateDiags diag.Diagnostics
 	var result applyPythonOutputResult
@@ -228,16 +238,18 @@ func (m *pythonMutator) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagno
 			return dyn.InvalidValue, fmt.Errorf("failed to get Python interpreter path: %w", err)
 		}
 
-		cacheDir, err := createCacheDir(ctx)
+		cacheDir, cleanup, err := createCacheDir(ctx)
 		if err != nil {
 			return dyn.InvalidValue, fmt.Errorf("failed to create cache dir: %w", err)
 		}
+		defer cleanup()
 
 		rightRoot, diags := m.runPythonMutator(ctx, leftRoot, runPythonMutatorOpts{
 			cacheDir:       cacheDir,
 			bundleRootPath: b.BundleRootPath,
 			pythonPath:     pythonPath,
 			loadLocations:  opts.loadLocations,
+			authEnv:        authEnv,
 		})
 		mutateDiags = diags
 		if diags.HasError() {
@@ -281,7 +293,7 @@ func (m *pythonMutator) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagno
 	b.Metrics.PythonUpdatedResourcesCount += int64(result.UpdatedResources.Size())
 	b.Metrics.PythonAddedResourcesCount += int64(result.AddedResources.Size())
 
-	if err == mutateDiagsHasError {
+	if errors.Is(err, mutateDiagsHasError) {
 		if !mutateDiags.HasError() {
 			panic("mutateDiags has no error, but error is expected")
 		}
@@ -304,7 +316,8 @@ func (m *pythonMutator) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagno
 	return mutateDiags
 }
 
-func createCacheDir(ctx context.Context) (string, error) {
+// createCacheDir returns the directory for input/output files of the Python subprocess, and a cleanup function.
+func createCacheDir(ctx context.Context) (string, func(), error) {
 	// b.LocalStateDir doesn't work because target isn't yet selected
 
 	// support the same env variable as in b.LocalStateDir
@@ -314,13 +327,20 @@ func createCacheDir(ctx context.Context) (string, error) {
 
 		err := os.MkdirAll(cacheDir, 0o700)
 		if err != nil {
-			return "", err
+			return "", nil, err
 		}
 
-		return cacheDir, nil
+		// the user picked this location explicitly, keep the files for inspection
+		return cacheDir, func() {}, nil
+	}
+
+	cacheDir, err := os.MkdirTemp("", "-python")
+	if err != nil {
+		return "", nil, err
 	}
 
-	return os.MkdirTemp("", "-python")
+	// input.json contains the full serialized bundle configuration; don't leave it behind in the system temp dir
+	return cacheDir, func() { _ = os.RemoveAll(cacheDir) }, nil
 }
 
 func (m *pythonMutator) runPythonMutator(ctx context.Context, root dyn.Value, opts runPythonMutatorOpts) (dyn.Value, diag.Diagnostics) {
@@ -364,6 +384,7 @@ func (m *pythonMutator) runPythonMutator(ctx context.Context, root dyn.Value, op
 		process.WithDir(opts.bundleRootPath),
 		process.WithStderrWriter(stderrWriter),
 		process.WithStdoutWriter(stdoutWriter),
+		process.WithEnvs(opts.authEnv),
 	)
 	if processErr != nil {
 		logger.Debugf(ctx, "python mutator process failed: %s", processErr)
@@ -490,7 +511,7 @@ func loadOutput(rootPath string, outputFile io.Reader, locations *pythonLocation
 		return dyn.InvalidValue, diag.FromErr(fmt.Errorf("failed to parse output file: %w", err))
 	}
 
-	// generated has dyn.Location as if it comes from generated YAML file
+	// generated has diag.Location as if it comes from generated YAML file
 	// earlier we loaded locations.json with source locations in Python code
 	generatedWithLocations, err := mergePythonLocations(generated, locations)
 	if err != nil {
diff --git a/bundle/config/mutator/python/python_mutator_test.go b/bundle/config/mutator/python/python_mutator_test.go
index cf81da5f78c..f2c91749e87 100644
--- a/bundle/config/mutator/python/python_mutator_test.go
+++ b/bundle/config/mutator/python/python_mutator_test.go
@@ -11,6 +11,7 @@ import (
 	"slices"
 	"testing"
 
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn/convert"
 
 	"github.com/databricks/cli/bundle/env"
@@ -20,6 +21,7 @@ import (
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/internal/testutil"
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/process"
 	"github.com/stretchr/testify/assert"
@@ -53,7 +55,7 @@ resources:
       name: job_0
 workspace: { current_user: { userName: test }}`)
 
-	// set rootPath so that we can make absolute paths in dyn.Location
+	// set rootPath so that we can make absolute paths in diag.Location
 	b.BundleRootPath = rootPath
 
 	ctx := withProcessStub(
@@ -123,7 +125,7 @@ workspace: { current_user: { userName: test }}`)
 		// location is databricks.yml, because output contains resource as-is
 		jobName0, err := dyn.GetByPath(v, dyn.MustPathFromString("resources.jobs.job0.name"))
 		require.NoError(t, err)
-		assert.Equal(t, []dyn.Location{
+		assert.Equal(t, []diag.Location{
 			{
 				File:   "databricks.yml",
 				Line:   9,
@@ -133,7 +135,7 @@ workspace: { current_user: { userName: test }}`)
 
 		jobName1, err := dyn.GetByPath(v, dyn.MustPathFromString("resources.jobs.job1.name"))
 		require.NoError(t, err)
-		assert.Equal(t, []dyn.Location{
+		assert.Equal(t, []diag.Location{
 			{
 				File:   filepath.Join(rootPath, "src/examples/job1.py"),
 				Line:   5,
@@ -143,7 +145,7 @@ workspace: { current_user: { userName: test }}`)
 
 		pipelineName0, err := dyn.GetByPath(v, dyn.MustPathFromString("resources.pipelines.pipeline0.name"))
 		require.NoError(t, err)
-		assert.Equal(t, []dyn.Location{
+		assert.Equal(t, []diag.Location{
 			{
 				File:   filepath.Join(rootPath, "src/examples/pipeline0.py"),
 				Line:   7,
@@ -158,9 +160,9 @@ workspace: { current_user: { userName: test }}`)
 	assert.Equal(t, int64(2), b.Metrics.PythonAddedResourcesCount)
 	assert.Equal(t, int64(0), b.Metrics.PythonUpdatedResourcesCount)
 
-	assert.Equal(t, 1, len(diags))
+	assert.Len(t, diags, 1)
 	assert.Equal(t, "job doesn't have any tasks", diags[0].Summary)
-	assert.Equal(t, []dyn.Location{
+	assert.Equal(t, []diag.Location{
 		{
 			File:   "src/examples/file.py",
 			Line:   10,
@@ -471,6 +473,34 @@ func TestStrictNormalize(t *testing.T) {
 	assert.True(t, strictDiags.HasError())
 }
 
+func TestCreateCacheDir(t *testing.T) {
+	testutil.CleanupEnvironment(t)
+
+	t.Run("DATABRICKS_BUNDLE_TMP is set", func(t *testing.T) {
+		tempDir := t.TempDir()
+		t.Setenv(env.TempDirVariable, tempDir)
+
+		cacheDir, cleanup, err := createCacheDir(t.Context())
+		require.NoError(t, err)
+		require.Equal(t, filepath.Join(tempDir, "default", "python"), cacheDir)
+
+		cleanup()
+
+		// user-specified directories are kept for inspection
+		assert.DirExists(t, cacheDir)
+	})
+
+	t.Run("DATABRICKS_BUNDLE_TMP is not set", func(t *testing.T) {
+		cacheDir, cleanup, err := createCacheDir(t.Context())
+		require.NoError(t, err)
+		require.DirExists(t, cacheDir)
+
+		cleanup()
+
+		assert.NoDirExists(t, cacheDir)
+	})
+}
+
 func TestExplainProcessErr(t *testing.T) {
 	stderr := "/home/test/.venv/bin/python3: Error while finding module specification for 'databricks.bundles.build' (ModuleNotFoundError: No module named 'databricks')\n"
 	expected := `/home/test/.venv/bin/python3: Error while finding module specification for 'databricks.bundles.build' (ModuleNotFoundError: No module named 'databricks')
@@ -501,7 +531,7 @@ func withProcessStub(t *testing.T, args []string, output, diagnostics, locations
 	t.Setenv(env.TempDirVariable, t.TempDir())
 
 	// after we override env variable, we always get the same cache dir as mutator
-	cacheDir, err := createCacheDir(ctx)
+	cacheDir, _, err := createCacheDir(ctx)
 	require.NoError(t, err)
 
 	inputPath := filepath.Join(cacheDir, "input.json")
diff --git a/bundle/config/mutator/reject_internal_resources.go b/bundle/config/mutator/reject_internal_resources.go
new file mode 100644
index 00000000000..0e4e28e53b5
--- /dev/null
+++ b/bundle/config/mutator/reject_internal_resources.go
@@ -0,0 +1,35 @@
+package mutator
+
+import (
+	"context"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/libs/diag"
+	"github.com/databricks/cli/libs/structs/structpath"
+)
+
+type rejectInternalResources struct{}
+
+// RejectInternalResources returns a mutator that errors when a user has set
+// any internal resource field in their bundle configuration.
+func RejectInternalResources() bundle.Mutator {
+	return &rejectInternalResources{}
+}
+
+func (m *rejectInternalResources) Name() string {
+	return "RejectInternalResources"
+}
+
+func (m *rejectInternalResources) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
+	var diags diag.Diagnostics
+	if b.Config.Resources.HasInternalResources() {
+		diags = diags.Append(diag.Diagnostic{
+			Severity:  diag.Error,
+			Summary:   "Internal resources cannot be set in bundle configuration",
+			Paths:     structpath.NewPathSlice("resources"),
+			Locations: b.Config.GetLocations("resources"),
+		})
+	}
+
+	return diags
+}
diff --git a/bundle/config/mutator/resolve_job_run_file_triggers.go b/bundle/config/mutator/resolve_job_run_file_triggers.go
new file mode 100644
index 00000000000..35cffd0dcbe
--- /dev/null
+++ b/bundle/config/mutator/resolve_job_run_file_triggers.go
@@ -0,0 +1,212 @@
+package mutator
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"io"
+	"io/fs"
+	pathlib "path"
+	"path/filepath"
+	"slices"
+	"strings"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/cli/libs/diag"
+	libsync "github.com/databricks/cli/libs/sync"
+)
+
+// Every diagnostic below is reported against an on_file_change entry.
+const fileTriggerPrefix = "lifecycle.triggers.on_file_change: "
+
+type resolveJobRunFileTriggers struct{}
+
+// ResolveJobRunFileTriggers expands on_file_change globs into trigger state.
+func ResolveJobRunFileTriggers() bundle.Mutator {
+	return &resolveJobRunFileTriggers{}
+}
+
+func (*resolveJobRunFileTriggers) Name() string {
+	return "ResolveJobRunFileTriggers"
+}
+
+func (*resolveJobRunFileTriggers) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	// Sorted so diagnostics from several job_runs come out in a stable order.
+	names := make([]string, 0, len(b.Config.Resources.JobRuns))
+	for name, jr := range b.Config.Resources.JobRuns {
+		// A job_run declared with an empty YAML body is a nil entry here.
+		if jr != nil && jr.HasOnFileChange() {
+			names = append(names, name)
+		}
+	}
+	if len(names) == 0 {
+		return diags
+	}
+	slices.Sort(names)
+
+	// Listing the sync files walks the tree, so only do it once the loop above
+	// found a pattern that needs matching against it.
+	syncable, err := listSyncableRelPaths(ctx, b)
+	if err != nil {
+		return diags.Append(diag.Diagnostic{
+			Severity: diag.Error,
+			Summary:  fileTriggerPrefix + fmt.Sprintf("list sync files: %s", err),
+		})
+	}
+
+	for _, name := range names {
+		jr := b.Config.Resources.JobRuns[name]
+		out := make(map[string]string)
+		for i, t := range jr.Lifecycle.Triggers {
+			if t.OnFileChange == nil {
+				continue
+			}
+			path := fmt.Sprintf("resources.job_runs.%s.lifecycle.triggers[%d].on_file_change", name, i)
+			pattern, fingerprint, d := resolveFileTrigger(b, path, *t.OnFileChange, syncable)
+			diags = diags.Extend(d)
+			if !d.HasError() {
+				out[pattern] = fingerprint
+			}
+		}
+		jr.Lifecycle.TriggersState = &resources.JobRunTriggersState{OnFileChange: out}
+	}
+	return diags
+}
+
+func listSyncableRelPaths(ctx context.Context, b *bundle.Bundle) ([]string, error) {
+	// Match sync's effective include set, not just Sync.Include, so a pattern can
+	// hash the internal dir sync force-includes.
+	//
+	// This is the candidate set, not sync's post-snapshot upload set: NewSnapshotState
+	// additionally drops files whose notebook type it cannot determine, such as a
+	// malformed .ipynb. Those stay watched on purpose - editing one is exactly when the
+	// run should re-fire - so a pattern can hash a file that this deploy will not upload.
+	includes, err := b.GetSyncIncludePatterns(ctx)
+	if err != nil {
+		return nil, err
+	}
+	fl, err := libsync.NewFileList(ctx, b.WorktreeRoot, b.SyncRoot, b.Config.Sync.Paths, includes, b.Config.Sync.Exclude)
+	if err != nil {
+		return nil, err
+	}
+	files, err := fl.Files(ctx)
+	if err != nil {
+		return nil, err
+	}
+	out := make([]string, 0, len(files))
+	for _, f := range files {
+		out = append(out, filepath.ToSlash(f.Relative))
+	}
+	slices.Sort(out)
+	return out, nil
+}
+
+func resolveFileTrigger(b *bundle.Bundle, loc, pattern string, syncable []string) (string, string, diag.Diagnostics) {
+	relPattern, diags := validateFileTriggerPattern(b, loc, pattern)
+	if diags.HasError() {
+		return "", "", diags
+	}
+
+	h := sha256.New()
+	matches := 0
+	for _, rel := range syncable {
+		matched, err := pathlib.Match(relPattern, rel)
+		if err != nil {
+			diags = diags.Append(diag.Diagnostic{
+				Severity:  diag.Error,
+				Summary:   fileTriggerPrefix + fmt.Sprintf("invalid pattern %q: %s", pattern, err),
+				Locations: b.Config.GetLocations(loc),
+			})
+			continue
+		}
+		if !matched {
+			continue
+		}
+		hash, err := hashFile(b.SyncRoot, rel)
+		if err != nil {
+			diags = diags.Append(diag.Diagnostic{
+				Severity:  diag.Error,
+				Summary:   fileTriggerPrefix + fmt.Sprintf("hash %q: %s", rel, err),
+				Locations: b.Config.GetLocations(loc),
+			})
+			continue
+		}
+		h.Write([]byte(rel))
+		h.Write([]byte{0})
+		h.Write([]byte(hash))
+		h.Write([]byte{0})
+		matches++
+	}
+	if matches == 0 && !diags.HasError() {
+		diags = diags.Append(diag.Diagnostic{
+			Severity:  diag.Warning,
+			Summary:   fileTriggerPrefix + fmt.Sprintf("no synced files match %q", pattern),
+			Locations: b.Config.GetLocations(loc),
+		})
+	}
+	return relPattern, hex.EncodeToString(h.Sum(nil)), diags
+}
+
+func validateFileTriggerPattern(b *bundle.Bundle, loc, pattern string) (string, diag.Diagnostics) {
+	var diags diag.Diagnostics
+	// A double star looks recursive but path.Match treats it as two ordinary stars.
+	if strings.Contains(pattern, "**") {
+		return "", diags.Append(diag.Diagnostic{
+			Severity:  diag.Error,
+			Summary:   fileTriggerPrefix + fmt.Sprintf("** in %q is not supported; use * for a single directory level", pattern),
+			Locations: b.Config.GetLocations(loc),
+		})
+	}
+	// Reject a genuinely absolute path; Join would otherwise silently reinterpret it
+	// as relative to the bundle root. filepath.IsAbs is OS-aware and pathlib.IsAbs
+	// covers a POSIX path on Windows. A string that is rooted only on the other OS
+	// (e.g. "c:foo" or "\foo" on POSIX) is a valid relative name here and falls
+	// through to the sync-root containment check below.
+	if filepath.IsAbs(pattern) || pathlib.IsAbs(pattern) {
+		return "", diags.Append(diag.Diagnostic{
+			Severity:  diag.Error,
+			Summary:   fileTriggerPrefix + fmt.Sprintf("pattern %q must be relative to the defining YAML file", pattern),
+			Locations: b.Config.GetLocations(loc),
+		})
+	}
+	// NormalizePaths has already rewritten YAML-relative globs to be bundle-root
+	// relative. Join that onto the bundle root, then require the result stay
+	// under the sync root (an ancestor of the bundle when sync.paths uses ..).
+	joined := filepath.Join(b.BundleRootPath, filepath.FromSlash(pattern))
+	relPattern, err := filepath.Rel(b.SyncRootPath, joined)
+	if err != nil || !filepath.IsLocal(relPattern) {
+		return "", diags.Append(diag.Diagnostic{
+			Severity:  diag.Error,
+			Summary:   fileTriggerPrefix + fmt.Sprintf("pattern %q is not under the sync root", pattern),
+			Locations: b.Config.GetLocations(loc),
+		})
+	}
+	relPattern = filepath.ToSlash(relPattern)
+	_, err = pathlib.Match(relPattern, "")
+	if err != nil {
+		return "", diags.Append(diag.Diagnostic{
+			Severity:  diag.Error,
+			Summary:   fileTriggerPrefix + fmt.Sprintf("invalid pattern %q: %s", pattern, err),
+			Locations: b.Config.GetLocations(loc),
+		})
+	}
+	return relPattern, diags
+}
+
+func hashFile(root fs.FS, path string) (string, error) {
+	f, err := root.Open(path)
+	if err != nil {
+		return "", err
+	}
+	defer f.Close()
+
+	h := sha256.New()
+	if _, err := io.Copy(h, f); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(h.Sum(nil)), nil
+}
diff --git a/bundle/config/mutator/resolve_job_run_file_triggers_test.go b/bundle/config/mutator/resolve_job_run_file_triggers_test.go
new file mode 100644
index 00000000000..2af318b0178
--- /dev/null
+++ b/bundle/config/mutator/resolve_job_run_file_triggers_test.go
@@ -0,0 +1,101 @@
+package mutator_test
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/config/mutator"
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/cli/libs/vfs"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestResolveJobRunFileTriggersHashesThroughSyncRoot(t *testing.T) {
+	dir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "watched.txt"), []byte("watched"), 0o644))
+	root := vfs.MustNew(dir)
+	pattern := "watched.txt"
+	b := &bundle.Bundle{
+		BundleRootPath: dir,
+		SyncRootPath:   dir,
+		SyncRoot:       root,
+		WorktreeRoot:   root,
+		Config: config.Root{
+			Bundle: config.Bundle{Target: "default"},
+			Sync:   config.Sync{Paths: []string{"."}},
+			Resources: config.Resources{
+				JobRuns: map[string]*resources.JobRun{
+					"my_run": {
+						Lifecycle: &resources.JobRunLifecycle{
+							Triggers: []resources.JobRunTrigger{
+								{OnFileChange: &pattern},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	diags := bundle.Apply(t.Context(), b, mutator.ResolveJobRunFileTriggers())
+	require.False(t, diags.HasError())
+	assert.Equal(t,
+		contentHash("watched.txt\x00"+contentHash("watched")+"\x00"),
+		b.Config.Resources.JobRuns["my_run"].Lifecycle.TriggersState.OnFileChange["watched.txt"],
+	)
+}
+
+// Rooted patterns must be rejected the same way on every host: filepath.IsAbs
+// alone only knows the local flavour, so a Windows-rooted pattern used to pass
+// validation on POSIX and fail on Windows.
+func TestResolveJobRunFileTriggersRejectsRootedPatterns(t *testing.T) {
+	// Only genuinely absolute paths on this OS are rejected. A string that is
+	// rooted only on Windows (e.g. "c:foo" or "\foo") is a valid relative name on
+	// POSIX and is left to the sync-root containment check, so it is not listed
+	// here; on Windows filepath.IsAbs classifies those forms itself.
+	for _, pattern := range []string{
+		"/abs/watched.txt",
+	} {
+		t.Run(pattern, func(t *testing.T) {
+			dir := t.TempDir()
+			require.NoError(t, os.WriteFile(filepath.Join(dir, "watched.txt"), []byte("native"), 0o644))
+			root := vfs.MustNew(dir)
+			b := &bundle.Bundle{
+				BundleRootPath: dir,
+				SyncRootPath:   dir,
+				SyncRoot:       root,
+				WorktreeRoot:   root,
+				Config: config.Root{
+					Bundle: config.Bundle{Target: "default"},
+					Sync:   config.Sync{Paths: []string{"."}},
+					Resources: config.Resources{
+						JobRuns: map[string]*resources.JobRun{
+							"my_run": {
+								Lifecycle: &resources.JobRunLifecycle{
+									Triggers: []resources.JobRunTrigger{
+										{OnFileChange: &pattern},
+									},
+								},
+							},
+						},
+					},
+				},
+			}
+
+			diags := bundle.Apply(t.Context(), b, mutator.ResolveJobRunFileTriggers())
+			require.True(t, diags.HasError(), "expected %q to be rejected", pattern)
+			assert.Contains(t, diags[0].Summary, "must be relative to the defining YAML file")
+		})
+	}
+}
+
+func contentHash(content string) string {
+	sum := sha256.Sum256([]byte(content))
+	return hex.EncodeToString(sum[:])
+}
diff --git a/bundle/config/mutator/resolve_select.go b/bundle/config/mutator/resolve_select.go
new file mode 100644
index 00000000000..0c9b42634e9
--- /dev/null
+++ b/bundle/config/mutator/resolve_select.go
@@ -0,0 +1,45 @@
+package mutator
+
+import (
+	"context"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/metrics"
+	"github.com/databricks/cli/libs/diag"
+)
+
+type resolveSelect struct{}
+
+// ResolveSelect returns a mutator that resolves and validates the selectors in
+// b.Select, normalizing each to its qualified "type.name" form. Selectors may be
+// "type.name" (e.g. "jobs.myjob") or just "name" if unique across all resource
+// types. The mutator does not filter the config; the direct engine selects against
+// the resolved keys later via plan.FilterToSelected.
+// If b.Select is empty, this is a no-op.
+func ResolveSelect() bundle.Mutator {
+	return &resolveSelect{}
+}
+
+func (m *resolveSelect) Name() string {
+	return "ResolveSelect"
+}
+
+func (m *resolveSelect) Apply(_ context.Context, b *bundle.Bundle) diag.Diagnostics {
+	if len(b.Select) == 0 {
+		return nil
+	}
+
+	b.Metrics.SetBoolValue(metrics.SelectUsed, true)
+
+	resolved := make([]string, 0, len(b.Select))
+	for _, selector := range b.Select {
+		res, key, err := b.Config.Resources.ResolveKey(selector)
+		if err != nil {
+			return diag.FromErr(err)
+		}
+		resolved = append(resolved, res.ResourceDescription().PluralName+"."+key)
+	}
+
+	b.Select = resolved
+	return nil
+}
diff --git a/bundle/config/mutator/resolve_select_test.go b/bundle/config/mutator/resolve_select_test.go
new file mode 100644
index 00000000000..d116d9ca601
--- /dev/null
+++ b/bundle/config/mutator/resolve_select_test.go
@@ -0,0 +1,53 @@
+package mutator_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/config/mutator"
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestResolveSelect_Normalizes checks that selectors are normalized to their
+// qualified "type.name" form in place, without filtering the config. End-to-end
+// selection behavior is covered by acceptance/bundle/select.
+func TestResolveSelect_Normalizes(t *testing.T) {
+	b := &bundle.Bundle{
+		Config: config.Root{
+			Resources: config.Resources{
+				Jobs:      map[string]*resources.Job{"my_job": {}},
+				Pipelines: map[string]*resources.Pipeline{"my_pipeline": {}},
+			},
+		},
+	}
+	b.Select = []string{"my_job", "pipelines.my_pipeline"}
+	diags := bundle.Apply(t.Context(), b, mutator.ResolveSelect())
+	require.NoError(t, diags.Error())
+	assert.Equal(t, []string{"jobs.my_job", "pipelines.my_pipeline"}, b.Select)
+	// Config is left untouched; the mutator only resolves selectors.
+	assert.Len(t, b.Config.Resources.Jobs, 1)
+	assert.Len(t, b.Config.Resources.Pipelines, 1)
+}
+
+// TestResolveSelect_Ambiguous covers the ambiguous-selector error in isolation.
+// In a real bundle this is unreachable — UniqueResourceKeys rejects two resources
+// sharing a key across types before this mutator runs (see the acceptance test
+// bundle/select_errors/ambiguous for the real, load-time error).
+func TestResolveSelect_Ambiguous(t *testing.T) {
+	b := &bundle.Bundle{
+		Config: config.Root{
+			Resources: config.Resources{
+				Jobs:      map[string]*resources.Job{"thing": {}},
+				Pipelines: map[string]*resources.Pipeline{"thing": {}},
+			},
+		},
+	}
+	b.Select = []string{"thing"}
+	diags := bundle.Apply(t.Context(), b, mutator.ResolveSelect())
+	require.Error(t, diags.Error())
+	assert.ErrorContains(t, diags.Error(), "ambiguous resource: thing")
+	assert.ErrorContains(t, diags.Error(), "use a qualified name to disambiguate")
+}
diff --git a/bundle/config/mutator/resolve_variable_references.go b/bundle/config/mutator/resolve_variable_references.go
index 113f0576394..257309c55f8 100644
--- a/bundle/config/mutator/resolve_variable_references.go
+++ b/bundle/config/mutator/resolve_variable_references.go
@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"slices"
+	"strings"
 
 	"github.com/databricks/cli/libs/dyn/merge"
 
@@ -50,6 +51,7 @@ type resolveVariableReferences struct {
 	prefixes    []string
 	pattern     dyn.Pattern
 	lookupFn    func(dyn.Value, dyn.Path, *bundle.Bundle) (dyn.Value, error)
+	allowPathFn func(dyn.Path) bool
 	extraRounds int
 
 	// includeResources allows resolving variables in 'resources', otherwise, they are excluded.
@@ -59,6 +61,11 @@ type resolveVariableReferences struct {
 	includeResources bool
 
 	artifactsReferenceUsed bool
+
+	// excludePaths lists variable reference paths (e.g. "workspace.file_path") whose
+	// resolution should be skipped. References to these paths remain unresolved so a
+	// later mutator can set the value and re-run resolution.
+	excludePaths []string
 }
 
 func ResolveVariableReferencesOnlyResources(prefixes ...string) bundle.Mutator {
@@ -94,6 +101,17 @@ func ResolveVariableReferencesInLookup() bundle.Mutator {
 	}
 }
 
+// ResolveVolumePathReferencesOnlyResources resolves only references to resources.volumes.*.volume_path.
+func ResolveVolumePathReferencesOnlyResources() bundle.Mutator {
+	return &resolveVariableReferences{
+		prefixes:         []string{"resources"},
+		lookupFn:         lookup,
+		allowPathFn:      isVolumePathReferencePath,
+		extraRounds:      maxResolutionRounds - 1,
+		includeResources: true,
+	}
+}
+
 func lookup(v dyn.Value, path dyn.Path, b *bundle.Bundle) (dyn.Value, error) {
 	if config.IsExplicitlyEnabled(b.Config.Presets.SourceLinkedDeployment) {
 		if path.String() == "workspace.file_path" {
@@ -229,6 +247,12 @@ func (m *resolveVariableReferences) resolveOnce(b *bundle.Bundle, prefixes []dyn
 
 				// Perform resolution only if the path starts with one of the specified prefixes.
 				if slices.ContainsFunc(prefixes, path.HasPrefix) {
+					if slices.Contains(m.excludePaths, path.String()) {
+						return dyn.InvalidValue, dynvar.ErrSkipResolution
+					}
+					if m.allowPathFn != nil && !m.allowPathFn(path) {
+						return dyn.InvalidValue, dynvar.ErrSkipResolution
+					}
 					value, err := m.lookupFn(normalized, path, b)
 					hasUpdates = hasUpdates || (err == nil && value.IsValid())
 					return value, err
@@ -248,12 +272,37 @@ func (m *resolveVariableReferences) resolveOnce(b *bundle.Bundle, prefixes []dyn
 		return root, nil
 	})
 	if err != nil {
-		diags = diags.Extend(diag.FromErr(err))
+		diags = diags.Extend(resolveErrorDiags(err))
 	}
 
 	return hasUpdates, diags
 }
 
+// resolveErrorDiags renders "did you mean" suggestions as a diagnostic Detail so
+// libs/diag owns the multi-line formatting.
+func resolveErrorDiags(err error) diag.Diagnostics {
+	refErr, ok := errors.AsType[*dynvar.ReferenceError](err)
+	if !ok || len(refErr.Suggestions) == 0 {
+		return diag.FromErr(err)
+	}
+
+	header := "did you mean:"
+	if len(refErr.Suggestions) > 1 {
+		header = "did you mean one of:"
+	}
+	var detail strings.Builder
+	detail.WriteString(header)
+	for _, ref := range refErr.Suggestions {
+		detail.WriteString("\n  ${" + ref + "}")
+	}
+
+	return diag.Diagnostics{{
+		Severity: diag.Error,
+		Summary:  refErr.Error(),
+		Detail:   detail.String(),
+	}}
+}
+
 // selectivelyMutate applies a function to a subset of the configuration
 func (m *resolveVariableReferences) selectivelyMutate(b *bundle.Bundle, fn func(value dyn.Value) (dyn.Value, error)) error {
 	return b.Config.Mutate(func(root dyn.Value) (dyn.Value, error) {
@@ -308,3 +357,12 @@ func getAllKeys(root dyn.Value) ([]string, error) {
 
 	return keys, nil
 }
+
+func isVolumePathReferencePath(path dyn.Path) bool {
+	if len(path) != 4 {
+		return false
+	}
+	return path[0].Key() == "resources" &&
+		path[1].Key() == "volumes" &&
+		path[3].Key() == "volume_path"
+}
diff --git a/bundle/config/mutator/resolve_variable_references_test.go b/bundle/config/mutator/resolve_variable_references_test.go
index 876980e9486..284b78846b4 100644
--- a/bundle/config/mutator/resolve_variable_references_test.go
+++ b/bundle/config/mutator/resolve_variable_references_test.go
@@ -6,6 +6,7 @@ import (
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/bundle/config"
 	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/databricks-sdk-go/service/pipelines"
 	"github.com/stretchr/testify/require"
 )
@@ -63,3 +64,49 @@ func TestResolveVariableReferencesWithSourceLinkedDeployment(t *testing.T) {
 		testCase.assert(t, b)
 	}
 }
+
+func TestResolveVolumePathReferencesOnlyResources(t *testing.T) {
+	b := &bundle.Bundle{
+		Config: config.Root{
+			Resources: config.Resources{
+				Volumes: map[string]*resources.Volume{
+					"foo": {
+						VolumePath: "/Volumes/main/myschema/myvolume",
+					},
+					"volumePathRef": {},
+					"otherRef":      {},
+				},
+			},
+		},
+	}
+
+	b.Config.Resources.Volumes["volumePathRef"].Comment = "${resources.volumes.foo.volume_path}"
+	b.Config.Resources.Volumes["otherRef"].Comment = "${resources.volumes.foo.name}"
+
+	diags := bundle.Apply(t.Context(), b, ResolveVolumePathReferencesOnlyResources())
+	require.NoError(t, diags.Error())
+	require.Equal(t, "/Volumes/main/myschema/myvolume", b.Config.Resources.Volumes["volumePathRef"].Comment)
+	require.Equal(t, "${resources.volumes.foo.name}", b.Config.Resources.Volumes["otherRef"].Comment)
+}
+
+func TestResolveVolumePathReferencesOnlyResources_MissingTarget(t *testing.T) {
+	b := &bundle.Bundle{
+		Config: config.Root{
+			Resources: config.Resources{
+				Volumes: map[string]*resources.Volume{
+					"foo": {},
+				},
+			},
+		},
+	}
+	b.Config.Resources.Volumes["foo"].Comment = "${resources.volumes.missing.volume_path}"
+
+	diags := bundle.Apply(t.Context(), b, ResolveVolumePathReferencesOnlyResources())
+	require.ErrorContains(t, diags.Error(), "reference does not exist: ${resources.volumes.missing.volume_path}")
+}
+
+func TestIsVolumePathReferencePath(t *testing.T) {
+	require.True(t, isVolumePathReferencePath(dyn.MustPathFromString("resources.volumes.foo.volume_path")))
+	require.False(t, isVolumePathReferencePath(dyn.MustPathFromString("resources.volumes.foo.name")))
+	require.False(t, isVolumePathReferencePath(dyn.MustPathFromString("resources.jobs.foo.name")))
+}
diff --git a/bundle/config/mutator/resourcemutator/apply_bundle_permissions.go b/bundle/config/mutator/resourcemutator/apply_bundle_permissions.go
index fd019479d77..f2a6d857090 100644
--- a/bundle/config/mutator/resourcemutator/apply_bundle_permissions.go
+++ b/bundle/config/mutator/resourcemutator/apply_bundle_permissions.go
@@ -13,6 +13,7 @@ import (
 	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/cli/libs/dyn/convert"
+	"github.com/databricks/cli/libs/logdiag"
 	"github.com/databricks/databricks-sdk-go/service/iam"
 )
 
@@ -47,6 +48,10 @@ var (
 			permissions.CAN_MANAGE: "CAN_MANAGE",
 			permissions.CAN_VIEW:   "CAN_READ",
 		},
+		"genie_spaces": {
+			permissions.CAN_MANAGE: "CAN_MANAGE",
+			permissions.CAN_VIEW:   "CAN_READ",
+		},
 		"apps": {
 			permissions.CAN_MANAGE: "CAN_MANAGE",
 			permissions.CAN_VIEW:   "CAN_USE",
@@ -84,6 +89,10 @@ var (
 			permissions.CAN_MANAGE: "CAN_MANAGE",
 			permissions.CAN_VIEW:   "CAN_USE",
 		},
+		"instance_pools": {
+			permissions.CAN_MANAGE: "CAN_MANAGE",
+			permissions.CAN_VIEW:   "CAN_ATTACH_TO",
+		},
 	}
 )
 
@@ -236,9 +245,10 @@ func notifyForPermissionOverlap(
 	resourcePermissions []resources.Permission,
 	resourceName string,
 ) bool {
-	isOverlap, _ := isPermissionOverlap(permission, resourcePermissions, resourceName)
-	// TODO: When we start to collect all diagnostics at the top level and visualize jointly,
-	// use diagnostics returned from isPermissionOverlap to display warnings
+	isOverlap, diagnostics := isPermissionOverlap(permission, resourcePermissions, resourceName)
+	for _, d := range diagnostics {
+		logdiag.LogDiag(ctx, d)
+	}
 
 	return isOverlap
 }
diff --git a/bundle/config/mutator/resourcemutator/apply_bundle_permissions_test.go b/bundle/config/mutator/resourcemutator/apply_bundle_permissions_test.go
index e472241f282..4ead9785e06 100644
--- a/bundle/config/mutator/resourcemutator/apply_bundle_permissions_test.go
+++ b/bundle/config/mutator/resourcemutator/apply_bundle_permissions_test.go
@@ -10,6 +10,7 @@ import (
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/bundle/config"
 	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/databricks-sdk-go/service/jobs"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -22,12 +23,26 @@ var unsupportedResources = []string{
 	"external_locations",
 	"volumes",
 	"schemas",
+	"features",
 	"quality_monitors",
 	"registered_models",
+	"model_services",
+	"mcp_services",
+	"model_provider_services",
 	"database_catalogs",
 	"synced_database_tables",
 	"postgres_branches",
+	"postgres_databases",
 	"postgres_endpoints",
+	"postgres_catalogs",
+	"postgres_roles",
+	"postgres_snapshot_schedules",
+	"postgres_synced_tables",
+	"vector_search_indexes",
+	"job_runs",
+	"internal_immutable_snapshots",
+	"secrets",
+	"cluster_policies",
 }
 
 func TestApplyBundlePermissions(t *testing.T) {
@@ -82,6 +97,10 @@ func TestApplyBundlePermissions(t *testing.T) {
 					"vs_1": {},
 					"vs_2": {},
 				},
+				InstancePools: map[string]*resources.InstancePool{
+					"instance_pool_1": {},
+					"instance_pool_2": {},
+				},
 			},
 		},
 	}
@@ -144,12 +163,16 @@ func TestApplyBundlePermissions(t *testing.T) {
 	require.Contains(t, b.Config.Resources.Apps["app_1"].Permissions, resources.AppPermission{Level: "CAN_USE", GroupName: "TestGroup"})
 
 	require.Len(t, b.Config.Resources.VectorSearchEndpoints["vs_1"].Permissions, 2)
-	require.Contains(t, b.Config.Resources.VectorSearchEndpoints["vs_1"].Permissions, resources.Permission{Level: "CAN_MANAGE", UserName: "TestUser"})
-	require.Contains(t, b.Config.Resources.VectorSearchEndpoints["vs_1"].Permissions, resources.Permission{Level: "CAN_USE", GroupName: "TestGroup"})
+	require.Contains(t, b.Config.Resources.VectorSearchEndpoints["vs_1"].Permissions, resources.VectorSearchEndpointPermission{Level: "CAN_MANAGE", UserName: "TestUser"})
+	require.Contains(t, b.Config.Resources.VectorSearchEndpoints["vs_1"].Permissions, resources.VectorSearchEndpointPermission{Level: "CAN_USE", GroupName: "TestGroup"})
 
 	require.Len(t, b.Config.Resources.VectorSearchEndpoints["vs_2"].Permissions, 2)
-	require.Contains(t, b.Config.Resources.VectorSearchEndpoints["vs_2"].Permissions, resources.Permission{Level: "CAN_MANAGE", UserName: "TestUser"})
-	require.Contains(t, b.Config.Resources.VectorSearchEndpoints["vs_2"].Permissions, resources.Permission{Level: "CAN_USE", GroupName: "TestGroup"})
+	require.Contains(t, b.Config.Resources.VectorSearchEndpoints["vs_2"].Permissions, resources.VectorSearchEndpointPermission{Level: "CAN_MANAGE", UserName: "TestUser"})
+	require.Contains(t, b.Config.Resources.VectorSearchEndpoints["vs_2"].Permissions, resources.VectorSearchEndpointPermission{Level: "CAN_USE", GroupName: "TestGroup"})
+
+	require.Len(t, b.Config.Resources.InstancePools["instance_pool_1"].Permissions, 2)
+	require.Contains(t, b.Config.Resources.InstancePools["instance_pool_1"].Permissions, resources.InstancePoolPermission{Level: "CAN_MANAGE", UserName: "TestUser"})
+	require.Contains(t, b.Config.Resources.InstancePools["instance_pool_1"].Permissions, resources.InstancePoolPermission{Level: "CAN_ATTACH_TO", GroupName: "TestGroup"})
 }
 
 func TestWarningOnOverlapPermission(t *testing.T) {
@@ -188,6 +211,10 @@ func TestWarningOnOverlapPermission(t *testing.T) {
 	diags := bundle.Apply(t.Context(), b, ApplyBundlePermissions())
 	require.NoError(t, diags.Error())
 
+	require.Len(t, diags, 1)
+	require.Equal(t, diag.Warning, diags[0].Severity)
+	require.Equal(t, "'jobs' already has permissions set for 'TestUser' user name", diags[0].Summary)
+
 	require.Contains(t, b.Config.Resources.Jobs["job_1"].Permissions, resources.JobPermission{Level: "CAN_VIEW", UserName: "TestUser"})
 	require.Contains(t, b.Config.Resources.Jobs["job_1"].Permissions, resources.JobPermission{Level: "CAN_VIEW", GroupName: "TestGroup"})
 	require.Contains(t, b.Config.Resources.Jobs["job_2"].Permissions, resources.JobPermission{Level: "CAN_VIEW", UserName: "TestUser2"})
diff --git a/bundle/config/mutator/resourcemutator/apply_default_task_source.go b/bundle/config/mutator/resourcemutator/apply_default_task_source.go
new file mode 100644
index 00000000000..30e000b1fb1
--- /dev/null
+++ b/bundle/config/mutator/resourcemutator/apply_default_task_source.go
@@ -0,0 +1,93 @@
+package resourcemutator
+
+import (
+	"context"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/libs/diag"
+	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+)
+
+type applyDefaultTaskSource struct{}
+
+// ApplyDefaultTaskSource sets source: GIT on the tasks of a job that has a
+// git_source, for the task types that support the field and only when the user
+// did not set it. Non-git jobs are left untouched: their tasks default to
+// WORKSPACE at the backend, so leaving source unset keeps the request minimal.
+//
+// The backend treats a task as git-sourced only when its source is explicitly GIT;
+// it does not infer GIT from the job's git_source. So without this a git_source job
+// whose task omits source has its repo-relative python_file/notebook_path rejected
+// as an "Invalid python file reference".
+//
+// This runs after PythonMutator so the value reflects any git_source or tasks that
+// Python code added or removed, and so the injected value is not exposed to Python
+// code. That is the same rationale that first moved this defaulting out of the
+// pre-Python resource mutators, at the cost of making it invisible in
+// `bundle validate`/`summary` and of leaving the direct engine without it.
+// Running it here as a normal mutator restores that visibility.
+// See https://github.com/databricks/cli/pull/3359 and
+// https://github.com/databricks/cli/pull/3528.
+func ApplyDefaultTaskSource() bundle.Mutator {
+	return &applyDefaultTaskSource{}
+}
+
+func (a *applyDefaultTaskSource) Name() string {
+	return "ApplyDefaultTaskSource"
+}
+
+// sourceAwareTaskTypes are the task types that support the `source` field.
+// https://docs.databricks.com/api/workspace/jobs/create
+var sourceAwareTaskTypes = []string{
+	"dbt_task",
+	"gen_ai_compute_task",
+	"notebook_task",
+	"spark_python_task",
+	"sql_task.file",
+}
+
+func (a *applyDefaultTaskSource) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
+	jobsPattern := dyn.NewPattern(dyn.Key("resources"), dyn.Key("jobs"), dyn.AnyKey())
+
+	err := b.Config.Mutate(func(root dyn.Value) (dyn.Value, error) {
+		return dyn.MapByPattern(root, jobsPattern, func(_ dyn.Path, job dyn.Value) (dyn.Value, error) {
+			// Only git_source jobs need an explicit source; leave the rest untouched.
+			// A missing key (KindInvalid) or an explicit `git_source: null` (KindNil)
+			// both count as absent, matching the typed nil pointer TranslatePaths keys
+			// off; otherwise we would set source: GIT on a job whose paths get
+			// translated to workspace paths.
+			gitSource := job.Get("git_source")
+			if gitSource.Kind() == dyn.KindInvalid || gitSource.Kind() == dyn.KindNil {
+				return job, nil
+			}
+
+			return dyn.Map(job, "tasks", dyn.Foreach(func(_ dyn.Path, task dyn.Value) (dyn.Value, error) {
+				task, err := dyn.Map(task, "for_each_task.task", func(_ dyn.Path, foreachTask dyn.Value) (dyn.Value, error) {
+					return setGitTaskSource(foreachTask)
+				})
+				if err != nil {
+					return dyn.InvalidValue, err
+				}
+				return setGitTaskSource(task)
+			}))
+		})
+	})
+
+	return diag.FromErr(err)
+}
+
+// setGitTaskSource sets source: GIT on the first task-type block present that
+// supports the field, unless the user already set it.
+func setGitTaskSource(task dyn.Value) (dyn.Value, error) {
+	for _, taskType := range sourceAwareTaskTypes {
+		t, err := dyn.Get(task, taskType)
+		if err != nil {
+			continue
+		}
+		if _, err := dyn.Get(t, "source"); err != nil {
+			return dyn.Set(task, taskType+".source", dyn.V(string(jobs.SourceGit)))
+		}
+	}
+	return task, nil
+}
diff --git a/bundle/config/mutator/resourcemutator/apply_default_task_source_test.go b/bundle/config/mutator/resourcemutator/apply_default_task_source_test.go
new file mode 100644
index 00000000000..7bdcc76ed41
--- /dev/null
+++ b/bundle/config/mutator/resourcemutator/apply_default_task_source_test.go
@@ -0,0 +1,95 @@
+package resourcemutator
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestApplyDefaultTaskSourceGitJob(t *testing.T) {
+	b := &bundle.Bundle{
+		Config: config.Root{
+			Resources: config.Resources{
+				Jobs: map[string]*resources.Job{
+					"git": {
+						JobSettings: jobs.JobSettings{
+							GitSource: &jobs.GitSource{GitUrl: "https://example.invalid/repo", GitProvider: "gitHub", GitBranch: "main"},
+							Tasks: []jobs.Task{
+								{TaskKey: "py", SparkPythonTask: &jobs.SparkPythonTask{PythonFile: "src/main.py"}},
+								{TaskKey: "nb_explicit", NotebookTask: &jobs.NotebookTask{NotebookPath: "nb", Source: jobs.SourceWorkspace}},
+								{TaskKey: "foreach", ForEachTask: &jobs.ForEachTask{Task: jobs.Task{
+									TaskKey:         "inner",
+									SparkPythonTask: &jobs.SparkPythonTask{PythonFile: "src/inner.py"},
+								}}},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	diags := bundle.Apply(t.Context(), b, ApplyDefaultTaskSource())
+	require.NoError(t, diags.Error())
+
+	tasks := b.Config.Resources.Jobs["git"].Tasks
+	// Unset source on a git job is defaulted to GIT.
+	assert.Equal(t, jobs.SourceGit, tasks[0].SparkPythonTask.Source)
+	// An explicit source is preserved.
+	assert.Equal(t, jobs.SourceWorkspace, tasks[1].NotebookTask.Source)
+	// The nested for_each task is handled too.
+	assert.Equal(t, jobs.SourceGit, tasks[2].ForEachTask.Task.SparkPythonTask.Source)
+}
+
+func TestApplyDefaultTaskSourceNullGitSourceUntouched(t *testing.T) {
+	// An explicit `git_source: null` reads back as a nil value, and TranslatePaths
+	// treats it as absent (typed nil pointer). The mutator must do the same, or it
+	// would set source: GIT on a job whose paths are translated to workspace paths.
+	root, diags := config.LoadFromBytes("databricks.yml", []byte(`
+resources:
+  jobs:
+    nullgit:
+      name: nullgit
+      git_source:
+      tasks:
+        - task_key: main
+          spark_python_task:
+            python_file: src/main.py
+`))
+	require.NoError(t, diags.Error())
+	b := &bundle.Bundle{Config: *root}
+
+	diags = bundle.Apply(t.Context(), b, ApplyDefaultTaskSource())
+	require.NoError(t, diags.Error())
+
+	assert.Empty(t, string(b.Config.Resources.Jobs["nullgit"].Tasks[0].SparkPythonTask.Source))
+}
+
+func TestApplyDefaultTaskSourceNonGitJobUntouched(t *testing.T) {
+	b := &bundle.Bundle{
+		Config: config.Root{
+			Resources: config.Resources{
+				Jobs: map[string]*resources.Job{
+					"plain": {
+						JobSettings: jobs.JobSettings{
+							Tasks: []jobs.Task{
+								{TaskKey: "py", SparkPythonTask: &jobs.SparkPythonTask{PythonFile: "/Workspace/main.py"}},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	diags := bundle.Apply(t.Context(), b, ApplyDefaultTaskSource())
+	require.NoError(t, diags.Error())
+
+	// A job without git_source is left untouched; the backend defaults source to WORKSPACE.
+	assert.Empty(t, string(b.Config.Resources.Jobs["plain"].Tasks[0].SparkPythonTask.Source))
+}
diff --git a/bundle/config/mutator/resourcemutator/apply_presets.go b/bundle/config/mutator/resourcemutator/apply_presets.go
index d5c97266cdc..bb84240d7cc 100644
--- a/bundle/config/mutator/resourcemutator/apply_presets.go
+++ b/bundle/config/mutator/resourcemutator/apply_presets.go
@@ -11,7 +11,6 @@ import (
 	"github.com/databricks/cli/bundle/config"
 	"github.com/databricks/cli/bundle/metrics"
 	"github.com/databricks/cli/libs/diag"
-	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/cli/libs/textutil"
 	"github.com/databricks/databricks-sdk-go/service/catalog"
 	"github.com/databricks/databricks-sdk-go/service/jobs"
@@ -100,9 +99,11 @@ func (m *applyPresets) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnos
 		}
 		p.Name = prefix + p.Name
 		if config.IsExplicitlyEnabled(t.PipelinesDevelopment) {
+			//nolint:staticcheck // SA1019: pipeline development is deprecated in the SDK but remains a supported bundle config field
 			p.Development = true
 		}
 		if t.TriggerPauseStatus == config.Paused {
+			//nolint:staticcheck // SA1019: pipeline continuous is deprecated in the SDK but remains a supported bundle config field
 			p.Continuous = false
 		}
 
@@ -186,6 +187,9 @@ func (m *applyPresets) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnos
 	// Quality monitors presets: Schedule
 	if t.TriggerPauseStatus == config.Paused {
 		for _, q := range r.QualityMonitors {
+			if q == nil {
+				continue
+			}
 			// Remove all schedules from monitors, since they don't support pausing/unpausing.
 			// Quality monitors might support the "pause" property in the future, so at the
 			// CLI level we do respect that property if it is set to "unpaused."
@@ -229,6 +233,26 @@ func (m *applyPresets) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnos
 		}
 	}
 
+	// Instance Pools: Prefix, Tags
+	for _, pool := range r.InstancePools {
+		if pool == nil {
+			continue
+		}
+		pool.InstancePoolName = prefix + pool.InstancePoolName
+		if len(tags) > 0 {
+			if pool.CustomTags == nil {
+				pool.CustomTags = make(map[string]string, len(tags))
+			}
+			for _, tag := range tags {
+				k := b.Tagging.NormalizeKey(tag.Key)
+				v := b.Tagging.NormalizeValue(tag.Value)
+				if _, ok := pool.CustomTags[k]; !ok {
+					pool.CustomTags[k] = v
+				}
+			}
+		}
+	}
+
 	// Dashboards: Prefix
 	for _, dashboard := range r.Dashboards {
 		if dashboard == nil {
@@ -237,6 +261,14 @@ func (m *applyPresets) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnos
 		dashboard.DisplayName = prefix + dashboard.DisplayName
 	}
 
+	// Genie Spaces: Prefix
+	for _, genieSpace := range r.GenieSpaces {
+		if genieSpace == nil {
+			continue
+		}
+		genieSpace.Title = prefix + genieSpace.Title
+	}
+
 	// Apps: No presets
 
 	// Alerts: Prefix, TriggerPauseStatus
@@ -290,14 +322,25 @@ func (m *applyPresets) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnos
 		}
 	}
 
-	// Vector Search Endpoints: Prefix
-	for _, e := range r.VectorSearchEndpoints {
-		if e == nil {
+	// Cluster Policies: Prefix. The policy name is a user-facing display name
+	// (unique, 1-100 chars), not the API id (policy_id), so prefixing it in dev
+	// mode avoids collisions between developers without changing identity.
+	for _, cp := range r.ClusterPolicies {
+		if cp == nil {
 			continue
 		}
-		e.Name = normalizePrefix(prefix) + e.Name
+		cp.Name = prefix + cp.Name
 	}
 
+	// Vector Search Endpoints: no prefix. The endpoint name is the primary key
+	// (it's what GET/UPDATE/DELETE address by), so prefixing it would change
+	// the resource's identity rather than just its display name.
+
+	// Vector Search Indexes: no prefix. The 3-part UC name (catalog.schema.index)
+	// is the API primary key (CreateIndex addresses by name and DoCreate returns
+	// it as the deployment id), so prefixing would change the resource's
+	// identity rather than just its display name.
+
 	return diags
 }
 
@@ -309,7 +352,7 @@ func validatePauseStatus(b *bundle.Bundle) diag.Diagnostics {
 	return diag.Diagnostics{{
 		Summary:   "Invalid value for trigger_pause_status, should be PAUSED or UNPAUSED",
 		Severity:  diag.Error,
-		Locations: []dyn.Location{b.Config.GetLocation("presets.trigger_pause_status")},
+		Locations: []diag.Location{b.Config.GetLocation("presets.trigger_pause_status")},
 	}}
 }
 
diff --git a/bundle/config/mutator/resourcemutator/apply_presets_test.go b/bundle/config/mutator/resourcemutator/apply_presets_test.go
new file mode 100644
index 00000000000..c97db137b26
--- /dev/null
+++ b/bundle/config/mutator/resourcemutator/apply_presets_test.go
@@ -0,0 +1,40 @@
+package resourcemutator
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/databricks-sdk-go/service/catalog"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestApplyPresetsSkipsNilQualityMonitors(t *testing.T) {
+	b := &bundle.Bundle{
+		Config: config.Root{
+			Presets: config.Presets{
+				TriggerPauseStatus: config.Paused,
+			},
+			Resources: config.Resources{
+				QualityMonitors: map[string]*resources.QualityMonitor{
+					// Python-generated configs can contain null resource entries that
+					// bypass AllResourcesHaveValues, so ApplyPresets must skip them.
+					"nil_monitor": nil,
+					"monitor": {
+						TableName: "monitor",
+						CreateMonitor: catalog.CreateMonitor{
+							OutputSchemaName: "catalog.schema",
+							Schedule:         &catalog.MonitorCronSchedule{},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	diags := bundle.Apply(t.Context(), b, ApplyPresets())
+	require.NoError(t, diags.Error())
+	assert.Nil(t, b.Config.Resources.QualityMonitors["monitor"].Schedule)
+}
diff --git a/bundle/config/mutator/resourcemutator/apply_target_mode_test.go b/bundle/config/mutator/resourcemutator/apply_target_mode_test.go
index 84f2acf781b..e9ea418d1d6 100644
--- a/bundle/config/mutator/resourcemutator/apply_target_mode_test.go
+++ b/bundle/config/mutator/resourcemutator/apply_target_mode_test.go
@@ -92,8 +92,11 @@ func mockBundle(mode config.Mode) *bundle.Bundle {
 						},
 					},
 				},
+				JobRuns: map[string]*resources.JobRun{
+					"job_run1": {RunNow: jobs.RunNow{JobId: 1234}},
+				},
 				Pipelines: map[string]*resources.Pipeline{
-					"pipeline1": {CreatePipeline: pipelines.CreatePipeline{Name: "pipeline1", Continuous: true}},
+					"pipeline1": {CreatePipeline: pipelines.CreatePipeline{Name: "pipeline1", Continuous: true}}, //nolint:staticcheck // SA1019: pipeline continuous is deprecated in the SDK but remains a supported bundle config field
 				},
 				Experiments: map[string]*resources.MlflowExperiment{
 					"experiment1": {CreateExperiment: ml.CreateExperiment{Name: "/Users/lennart.kats@databricks.com/experiment1"}},
@@ -105,6 +108,15 @@ func mockBundle(mode config.Mode) *bundle.Bundle {
 				ModelServingEndpoints: map[string]*resources.ModelServingEndpoint{
 					"servingendpoint1": {CreateServingEndpoint: serving.CreateServingEndpoint{Name: "servingendpoint1"}},
 				},
+				ModelServices: map[string]*resources.ModelService{
+					"modelservice1": {ModelServiceConfig: resources.ModelServiceConfig{Parent: "schemas/main.default", ModelServiceId: "modelservice1"}},
+				},
+				McpServices: map[string]*resources.McpService{
+					"mcpservice1": {McpServiceConfig: resources.McpServiceConfig{Parent: "schemas/main.default", McpServiceId: "mcpservice1"}},
+				},
+				ModelProviderServices: map[string]*resources.ModelProviderService{
+					"modelproviderservice1": {ModelProviderServiceConfig: resources.ModelProviderServiceConfig{Parent: "schemas/main.default", ModelProviderServiceId: "modelproviderservice1"}},
+				},
 				RegisteredModels: map[string]*resources.RegisteredModel{
 					"registeredmodel1": {CreateRegisteredModelRequest: catalog.CreateRegisteredModelRequest{Name: "registeredmodel1"}},
 				},
@@ -144,9 +156,18 @@ func mockBundle(mode config.Mode) *bundle.Bundle {
 				Volumes: map[string]*resources.Volume{
 					"volume1": {CreateVolumeRequestContent: catalog.CreateVolumeRequestContent{Name: "volume1"}},
 				},
+				Features: map[string]*resources.Feature{
+					"feature1": {Feature: ml.Feature{FullName: "catalog1.schema1.feature1"}},
+				},
 				Clusters: map[string]*resources.Cluster{
 					"cluster1": {ClusterSpec: compute.ClusterSpec{ClusterName: "cluster1", SparkVersion: "13.2.x", NumWorkers: 1}},
 				},
+				InstancePools: map[string]*resources.InstancePool{
+					"instance_pool1": {CreateInstancePool: compute.CreateInstancePool{InstancePoolName: "instance_pool1", NodeTypeId: "i3.xlarge"}},
+				},
+				ClusterPolicies: map[string]*resources.ClusterPolicy{
+					"cluster_policy1": {CreatePolicy: compute.CreatePolicy{Name: "cluster_policy1"}},
+				},
 				Dashboards: map[string]*resources.Dashboard{
 					"dashboard1": {
 						DashboardConfig: resources.DashboardConfig{
@@ -154,6 +175,13 @@ func mockBundle(mode config.Mode) *bundle.Bundle {
 						},
 					},
 				},
+				GenieSpaces: map[string]*resources.GenieSpace{
+					"geniespace1": {
+						GenieSpaceConfig: resources.GenieSpaceConfig{
+							Title: "geniespace1",
+						},
+					},
+				},
 				Apps: map[string]*resources.App{
 					"app1": {
 						App: apps.App{
@@ -166,6 +194,15 @@ func mockBundle(mode config.Mode) *bundle.Bundle {
 						Name: "secretScope1",
 					},
 				},
+				Secrets: map[string]*resources.Secret{
+					"secret1": {
+						Secret: catalog.Secret{
+							CatalogName: "main",
+							SchemaName:  "default",
+							Name:        "secret1",
+						},
+					},
+				},
 				SqlWarehouses: map[string]*resources.SqlWarehouse{
 					"sql_warehouse1": {
 						CreateWarehouseRequest: sql.CreateWarehouseRequest{
@@ -247,6 +284,46 @@ func mockBundle(mode config.Mode) *bundle.Bundle {
 						},
 					},
 				},
+				PostgresCatalogs: map[string]*resources.PostgresCatalog{
+					"postgres_catalog1": {
+						PostgresCatalogConfig: resources.PostgresCatalogConfig{
+							CatalogId: "postgres_catalog_1",
+						},
+					},
+				},
+				PostgresDatabases: map[string]*resources.PostgresDatabase{
+					"postgres_database1": {
+						PostgresDatabaseConfig: resources.PostgresDatabaseConfig{
+							DatabaseId: "postgres-database-1",
+							Parent:     "projects/postgres-project-1/branches/postgres-branch-1",
+						},
+					},
+				},
+				PostgresRoles: map[string]*resources.PostgresRole{
+					"postgres_role1": {
+						PostgresRoleConfig: resources.PostgresRoleConfig{
+							RoleId: "postgres-role-1",
+							Parent: "projects/postgres-project-1/branches/postgres-branch-1",
+							RoleRoleSpec: postgres.RoleRoleSpec{
+								PostgresRole: "postgres_role_1",
+							},
+						},
+					},
+				},
+				PostgresSyncedTables: map[string]*resources.PostgresSyncedTable{
+					"postgres_synced_table1": {
+						PostgresSyncedTableConfig: resources.PostgresSyncedTableConfig{
+							SyncedTableId: "catalog.schema.table1",
+						},
+					},
+				},
+				PostgresSnapshotSchedules: map[string]*resources.PostgresSnapshotSchedule{
+					"postgres_snapshot_schedule1": {
+						PostgresSnapshotScheduleConfig: resources.PostgresSnapshotScheduleConfig{
+							Branch: "projects/project1/branches/branch1",
+						},
+					},
+				},
 				VectorSearchEndpoints: map[string]*resources.VectorSearchEndpoint{
 					"vs_endpoint1": {
 						CreateEndpoint: vectorsearch.CreateEndpoint{
@@ -255,6 +332,22 @@ func mockBundle(mode config.Mode) *bundle.Bundle {
 						},
 					},
 				},
+				VectorSearchIndexes: map[string]*resources.VectorSearchIndex{
+					"vs_index1": {
+						CreateVectorIndexRequest: vectorsearch.CreateVectorIndexRequest{
+							Name:         "main.default.vs_index1",
+							EndpointName: "vs_endpoint1",
+							PrimaryKey:   "id",
+							IndexType:    vectorsearch.VectorIndexTypeDeltaSync,
+						},
+					},
+				},
+				Snapshots: map[string]*resources.Snapshot{
+					"snapshot1": {
+						BundleID: "bundle1",
+						ACL:      nil,
+					},
+				},
 			},
 		},
 		SyncRoot: vfs.MustNew("/Users/lennart.kats@databricks.com"),
@@ -284,8 +377,8 @@ func TestProcessTargetModeDevelopment(t *testing.T) {
 
 	// Pipeline 1
 	assert.Equal(t, "[dev lennart] pipeline1", b.Config.Resources.Pipelines["pipeline1"].Name)
-	assert.False(t, b.Config.Resources.Pipelines["pipeline1"].Continuous)
-	assert.True(t, b.Config.Resources.Pipelines["pipeline1"].Development)
+	assert.False(t, b.Config.Resources.Pipelines["pipeline1"].Continuous) //nolint:staticcheck // SA1019: pipeline continuous is deprecated in the SDK but remains a supported bundle config field
+	assert.True(t, b.Config.Resources.Pipelines["pipeline1"].Development) //nolint:staticcheck // SA1019: pipeline development is deprecated in the SDK but remains a supported bundle config field
 
 	// Experiment 1
 	assert.Equal(t, "/Users/lennart.kats@databricks.com/[dev lennart] experiment1", b.Config.Resources.Experiments["experiment1"].Name)
@@ -303,8 +396,11 @@ func TestProcessTargetModeDevelopment(t *testing.T) {
 	// Model serving endpoint 1
 	assert.Equal(t, "dev_lennart_servingendpoint1", b.Config.Resources.ModelServingEndpoints["servingendpoint1"].Name)
 
-	// Vector search endpoint 1
-	assert.Equal(t, "dev_lennart_vs_endpoint1", b.Config.Resources.VectorSearchEndpoints["vs_endpoint1"].Name)
+	// Vector search endpoint 1: name is the primary key, so it must not be prefixed.
+	assert.Equal(t, "vs_endpoint1", b.Config.Resources.VectorSearchEndpoints["vs_endpoint1"].Name)
+
+	// Vector search index 1: name is the primary key, so it must not be prefixed.
+	assert.Equal(t, "main.default.vs_index1", b.Config.Resources.VectorSearchIndexes["vs_index1"].Name)
 
 	// Registered model 1
 	assert.Equal(t, "dev_lennart_registeredmodel1", b.Config.Resources.RegisteredModels["registeredmodel1"].Name)
@@ -320,9 +416,15 @@ func TestProcessTargetModeDevelopment(t *testing.T) {
 	// Clusters
 	assert.Equal(t, "[dev lennart] cluster1", b.Config.Resources.Clusters["cluster1"].ClusterName)
 
+	// Instance pools
+	assert.Equal(t, "[dev lennart] instance_pool1", b.Config.Resources.InstancePools["instance_pool1"].InstancePoolName)
+
 	// Dashboards
 	assert.Equal(t, "[dev lennart] dashboard1", b.Config.Resources.Dashboards["dashboard1"].DisplayName)
 
+	// Genie Spaces
+	assert.Equal(t, "[dev lennart] geniespace1", b.Config.Resources.GenieSpaces["geniespace1"].Title)
+
 	// Alert 1: has schedule without pause status set - should be paused
 	assert.Equal(t, "[dev lennart] alert1", b.Config.Resources.Alerts["alert1"].DisplayName)
 	assert.Equal(t, sql.SchedulePauseStatusPaused, b.Config.Resources.Alerts["alert1"].Schedule.PauseStatus)
@@ -385,14 +487,16 @@ func TestProcessTargetModeDefault(t *testing.T) {
 	require.NoError(t, diags.Error())
 	assert.Equal(t, "job1", b.Config.Resources.Jobs["job1"].Name)
 	assert.Equal(t, "pipeline1", b.Config.Resources.Pipelines["pipeline1"].Name)
-	assert.False(t, b.Config.Resources.Pipelines["pipeline1"].Development)
+	assert.False(t, b.Config.Resources.Pipelines["pipeline1"].Development) //nolint:staticcheck // SA1019: pipeline development is deprecated in the SDK but remains a supported bundle config field
 	assert.Equal(t, "servingendpoint1", b.Config.Resources.ModelServingEndpoints["servingendpoint1"].Name)
 	assert.Equal(t, "registeredmodel1", b.Config.Resources.RegisteredModels["registeredmodel1"].Name)
 	assert.Equal(t, "qualityMonitor1", b.Config.Resources.QualityMonitors["qualityMonitor1"].TableName)
 	assert.Equal(t, "catalog1", b.Config.Resources.Catalogs["catalog1"].Name)
 	assert.Equal(t, "schema1", b.Config.Resources.Schemas["schema1"].Name)
 	assert.Equal(t, "volume1", b.Config.Resources.Volumes["volume1"].Name)
+	assert.Equal(t, "catalog1.schema1.feature1", b.Config.Resources.Features["feature1"].FullName)
 	assert.Equal(t, "cluster1", b.Config.Resources.Clusters["cluster1"].ClusterName)
+	assert.Equal(t, "instance_pool1", b.Config.Resources.InstancePools["instance_pool1"].InstancePoolName)
 	assert.Equal(t, "sql_warehouse1", b.Config.Resources.SqlWarehouses["sql_warehouse1"].Name)
 }
 
@@ -414,17 +518,39 @@ func TestAllResourcesMocked(t *testing.T) {
 	}
 }
 
-// Make sure that we at rename all non UC resources
-func TestAllNonUcResourcesAreRenamed(t *testing.T) {
+// TestAppropriateResourcesAreRenamed checks that every resource with a user-facing
+// Name field is renamed by dev-mode / presets.name_prefix, except for an
+// explicit carve-out list. The carve-out applies to resources whose Name is
+// the API primary key / object id (not a display name) — prefixing those
+// would change the resource's identity rather than its label.
+func TestAppropriateResourcesAreRenamed(t *testing.T) {
 	b := mockBundle(config.Development)
 
-	// UC resources should not have a prefix added to their name. Right now
-	// this list only contains the Volume, Catalog, and ExternalLocation resources since we have yet to remove
-	// prefixing support for UC schemas and registered models.
-	ucFields := []reflect.Type{
+	notRenamedFields := []reflect.Type{
 		reflect.TypeFor[*resources.Catalog](),
 		reflect.TypeFor[*resources.ExternalLocation](),
 		reflect.TypeFor[*resources.Volume](),
+		reflect.TypeFor[*resources.VectorSearchEndpoint](),
+		reflect.TypeFor[*resources.VectorSearchIndex](),
+	}
+
+	// Resources whose Name is server-generated or otherwise not a user-facing
+	// label, so the rename matrix doesn't apply. Reflection still finds a
+	// Name field on these via embedded SDK types, hence the explicit skip.
+	notUserNamed := []string{
+		"Apps",
+		"Features",
+		"SecretScopes",
+		"Secrets",
+		"DatabaseInstances",
+		"DatabaseCatalogs",
+		"SyncedDatabaseTables",
+		"PostgresProjects",
+		"PostgresBranches",
+		"PostgresEndpoints",
+		"PostgresCatalogs",
+		"PostgresDatabases",
+		"PostgresSyncedTables",
 	}
 
 	diags := bundle.ApplySeq(t.Context(), b, ApplyTargetMode(), ApplyPresets())
@@ -433,28 +559,24 @@ func TestAllNonUcResourcesAreRenamed(t *testing.T) {
 	resources := reflect.ValueOf(b.Config.Resources)
 	for i := range resources.NumField() {
 		field := resources.Field(i)
+		if field.Kind() != reflect.Map {
+			continue
+		}
+		resourceType := resources.Type().Field(i).Name
+		if slices.Contains(notUserNamed, resourceType) {
+			continue
+		}
+		for _, key := range field.MapKeys() {
+			resource := field.MapIndex(key)
+			nameField := resource.Elem().FieldByName("Name")
+			if !nameField.IsValid() || nameField.Kind() != reflect.String {
+				continue
+			}
 
-		if field.Kind() == reflect.Map {
-			for _, key := range field.MapKeys() {
-				resource := field.MapIndex(key)
-				nameField := resource.Elem().FieldByName("Name")
-				resourceType := resources.Type().Field(i).Name
-
-				// Skip resources that are not renamed (either because they don't have a user-facing Name field,
-				// or because their Name is server-generated rather than user-specified)
-				if resourceType == "Apps" || resourceType == "SecretScopes" || resourceType == "DatabaseInstances" || resourceType == "DatabaseCatalogs" || resourceType == "SyncedDatabaseTables" || resourceType == "PostgresProjects" || resourceType == "PostgresBranches" || resourceType == "PostgresEndpoints" {
-					continue
-				}
-
-				if !nameField.IsValid() || nameField.Kind() != reflect.String {
-					continue
-				}
-
-				if slices.Contains(ucFields, resource.Type()) {
-					assert.NotContains(t, nameField.String(), "dev", "process_target_mode should not rename '%s' in '%s'", key, resources.Type().Field(i).Name)
-				} else {
-					assert.Contains(t, nameField.String(), "dev", "process_target_mode should rename '%s' in '%s'", key, resources.Type().Field(i).Name)
-				}
+			if slices.Contains(notRenamedFields, resource.Type()) {
+				assert.NotContains(t, nameField.String(), "dev", "process_target_mode should not rename '%s' in '%s'", key, resourceType)
+			} else {
+				assert.Contains(t, nameField.String(), "dev", "process_target_mode should rename '%s' in '%s'", key, resourceType)
 			}
 		}
 	}
@@ -553,5 +675,5 @@ func TestPipelinesDevelopmentDisabled(t *testing.T) {
 	diags := bundle.ApplySeq(t.Context(), b, ApplyTargetMode(), ApplyPresets())
 	require.NoError(t, diags.Error())
 
-	assert.False(t, b.Config.Resources.Pipelines["pipeline1"].Development)
+	assert.False(t, b.Config.Resources.Pipelines["pipeline1"].Development) //nolint:staticcheck // SA1019: pipeline development is deprecated in the SDK but remains a supported bundle config field
 }
diff --git a/bundle/config/mutator/resourcemutator/capture_uc_dependencies.go b/bundle/config/mutator/resourcemutator/capture_uc_dependencies.go
index 61c2fed2592..a0e8d05fbde 100644
--- a/bundle/config/mutator/resourcemutator/capture_uc_dependencies.go
+++ b/bundle/config/mutator/resourcemutator/capture_uc_dependencies.go
@@ -8,18 +8,19 @@ import (
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/cli/libs/diag"
+	"github.com/databricks/cli/libs/dyn/dynvar"
 )
 
 type captureUCDependencies struct{}
 
 // If a user defines a UC schema in the bundle, they can refer to it in SDP pipelines,
-// UC Volumes, Registered Models, Quality Monitors, or Model Serving Endpoints using the
-// `${resources.schemas.<schema_key>.name}` syntax. Using this syntax allows TF to capture
-// the deploy time dependency this resource has on the schema and deploy changes to the
-// schema before deploying the dependent resource.
+// UC Volumes, Registered Models, Quality Monitors, Model Serving Endpoints, or Vector Search
+// Indexes using the `${resources.schemas.<schema_key>.name}` syntax. Using this syntax allows
+// TF to capture the deploy time dependency this resource has on the schema and deploy changes
+// to the schema before deploying the dependent resource.
 //
 // Similarly, if a user defines a UC catalog in the bundle, they can refer to it in UC schemas,
-// UC Volumes, Registered Models, or Model Serving Endpoints using the
+// UC Volumes, Registered Models, Model Serving Endpoints, or Vector Search Indexes using the
 // `${resources.catalogs.<catalog_key>.name}` syntax. This captures the deploy time
 // dependency the resource has on the catalog.
 //
@@ -88,6 +89,35 @@ func resolveCatalog(b *bundle.Bundle, catalogName string) string {
 	return catalogName
 }
 
+// splitUCName splits a compound UC identifier into exactly n dot-separated
+// components, returning false if it has a different number of components. Callers
+// skip names containing a ${...} reference beforehand, so this is a plain split:
+// a reference would push the component count past n and be rejected here anyway.
+func splitUCName(name string, n int) ([]string, bool) {
+	parts := strings.Split(name, ".")
+	if len(parts) != n {
+		return nil, false
+	}
+	return parts, true
+}
+
+// resolveAiGatewayParent rewrites a `schemas/{catalog}.{schema}` parent reference so that
+// a catalog or schema defined in the same bundle becomes an explicit deploy-time
+// dependency. AI Gateway securables address their parent schema with this
+// compound field rather than separate catalog/schema fields.
+func resolveAiGatewayParent(b *bundle.Bundle, parent string) string {
+	rest, ok := strings.CutPrefix(parent, "schemas/")
+	if !ok {
+		return parent
+	}
+	parts, ok := splitUCName(rest, 2)
+	if !ok {
+		return parent
+	}
+	catalogName, schemaName := parts[0], parts[1]
+	return "schemas/" + resolveCatalog(b, catalogName) + "." + resolveSchema(b, catalogName, schemaName)
+}
+
 func (m *captureUCDependencies) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
 	// Resolve resources that depend on schemas before resolving schemas themselves.
 	// The schema resolution below modifies schema.CatalogName, and findSchema
@@ -99,6 +129,13 @@ func (m *captureUCDependencies) Apply(ctx context.Context, b *bundle.Bundle) dia
 		v.SchemaName = resolveSchema(b, v.CatalogName, v.SchemaName)
 		v.CatalogName = resolveCatalog(b, v.CatalogName)
 	}
+	for _, s := range b.Config.Resources.Secrets {
+		if s == nil {
+			continue
+		}
+		s.SchemaName = resolveSchema(b, s.CatalogName, s.SchemaName)
+		s.CatalogName = resolveCatalog(b, s.CatalogName)
+	}
 	for _, rm := range b.Config.Resources.RegisteredModels {
 		if rm == nil {
 			continue
@@ -120,9 +157,14 @@ func (m *captureUCDependencies) Apply(ctx context.Context, b *bundle.Bundle) dia
 		if qm == nil || qm.OutputSchemaName == "" {
 			continue
 		}
+		// A name that already contains a reference is left as is: we only rewrite a
+		// fully literal name and do not support a mix of references and literals.
+		if dynvar.ContainsVariableReference(qm.OutputSchemaName) {
+			continue
+		}
 		// OutputSchemaName is a compound "catalog.schema" string.
-		parts := strings.SplitN(qm.OutputSchemaName, ".", 2)
-		if len(parts) != 2 {
+		parts, ok := splitUCName(qm.OutputSchemaName, 2)
+		if !ok {
 			continue
 		}
 		catalogName, schemaName := parts[0], parts[1]
@@ -131,6 +173,37 @@ func (m *captureUCDependencies) Apply(ctx context.Context, b *bundle.Bundle) dia
 			qm.OutputSchemaName = resolved
 		}
 	}
+	for _, idx := range b.Config.Resources.VectorSearchIndexes {
+		if idx == nil {
+			continue
+		}
+		// A name that already contains a reference is left as is; a mix of
+		// references and literals is not supported.
+		if dynvar.ContainsVariableReference(idx.Name) {
+			continue
+		}
+		// Name is a three-part "catalog.schema.index" UC identifier.
+		parts, ok := splitUCName(idx.Name, 3)
+		if !ok {
+			continue
+		}
+		catalogName, schemaName := parts[0], parts[1]
+		idx.Name = resolveCatalog(b, catalogName) + "." + resolveSchema(b, catalogName, schemaName) + "." + parts[2]
+	}
+	for _, f := range b.Config.Resources.Features {
+		if f == nil {
+			continue
+		}
+		if dynvar.ContainsVariableReference(f.FullName) {
+			continue
+		}
+		parts, ok := splitUCName(f.FullName, 3)
+		if !ok {
+			continue
+		}
+		catalogName, schemaName := parts[0], parts[1]
+		f.FullName = resolveCatalog(b, catalogName) + "." + resolveSchema(b, catalogName, schemaName) + "." + parts[2]
+	}
 	for _, mse := range b.Config.Resources.ModelServingEndpoints {
 		if mse == nil {
 			continue
@@ -147,6 +220,29 @@ func (m *captureUCDependencies) Apply(ctx context.Context, b *bundle.Bundle) dia
 			acc.CatalogName = resolveCatalog(b, acc.CatalogName)
 		}
 	}
+	for _, ms := range b.Config.Resources.ModelServices {
+		if ms == nil {
+			continue
+		}
+		// A parent that already contains a reference is left as is; a mix of
+		// references and literals is not supported.
+		if dynvar.ContainsVariableReference(ms.Parent) {
+			continue
+		}
+		ms.Parent = resolveAiGatewayParent(b, ms.Parent)
+	}
+	for _, ms := range b.Config.Resources.McpServices {
+		if ms == nil {
+			continue
+		}
+		ms.Parent = resolveAiGatewayParent(b, ms.Parent)
+	}
+	for _, mps := range b.Config.Resources.ModelProviderServices {
+		if mps == nil {
+			continue
+		}
+		mps.Parent = resolveAiGatewayParent(b, mps.Parent)
+	}
 
 	// Schemas are resolved last because the schema catalog resolution modifies
 	// schema.CatalogName, and findSchema (used by resolveSchema above) matches
diff --git a/bundle/config/mutator/resourcemutator/capture_uc_dependencies_test.go b/bundle/config/mutator/resourcemutator/capture_uc_dependencies_test.go
index 12aac0c472e..347f0b72caa 100644
--- a/bundle/config/mutator/resourcemutator/capture_uc_dependencies_test.go
+++ b/bundle/config/mutator/resourcemutator/capture_uc_dependencies_test.go
@@ -7,8 +7,10 @@ import (
 	"github.com/databricks/cli/bundle/config"
 	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/databricks-sdk-go/service/catalog"
+	"github.com/databricks/databricks-sdk-go/service/ml"
 	"github.com/databricks/databricks-sdk-go/service/pipelines"
 	"github.com/databricks/databricks-sdk-go/service/serving"
+	"github.com/databricks/databricks-sdk-go/service/vectorsearch"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -131,6 +133,31 @@ func TestCaptureUCDependencies(t *testing.T) {
 						},
 					}},
 				},
+				ModelServices: map[string]*resources.ModelService{
+					"my_model_service": {ModelServiceConfig: resources.ModelServiceConfig{
+						Parent: "schemas/mycatalog.myschema", ModelServiceId: "myservice",
+					}},
+				},
+				VectorSearchIndexes: map[string]*resources.VectorSearchIndex{
+					"my_index": {CreateVectorIndexRequest: vectorsearch.CreateVectorIndexRequest{
+						Name: "mycatalog.myschema.myindex",
+					}},
+				},
+				Features: map[string]*resources.Feature{
+					"my_feature": {Feature: ml.Feature{
+						FullName: "mycatalog.myschema.myfeature",
+					}},
+				},
+				McpServices: map[string]*resources.McpService{
+					"my_mcp_service": {McpServiceConfig: resources.McpServiceConfig{
+						Parent: "schemas/mycatalog.myschema", McpServiceId: "mymcp",
+					}},
+				},
+				ModelProviderServices: map[string]*resources.ModelProviderService{
+					"my_mps": {ModelProviderServiceConfig: resources.ModelProviderServiceConfig{
+						Parent: "schemas/mycatalog.myschema", ModelProviderServiceId: "mymps",
+					}},
+				},
 			},
 		},
 	}
@@ -163,6 +190,21 @@ func TestCaptureUCDependencies(t *testing.T) {
 	itc := b.Config.Resources.ModelServingEndpoints["my_endpoint"].AiGateway.InferenceTableConfig
 	assert.Equal(t, schemaRef, itc.SchemaName)
 	assert.Equal(t, catalogRef, itc.CatalogName)
+
+	// Model service (compound "schemas/{catalog}.{schema}" parent field).
+	assert.Equal(t, "schemas/"+catalogRef+"."+schemaRef, b.Config.Resources.ModelServices["my_model_service"].Parent)
+
+	// Vector search index (three-part "catalog.schema.index" name).
+	assert.Equal(t, catalogRef+"."+schemaRef+".myindex", b.Config.Resources.VectorSearchIndexes["my_index"].Name)
+
+	// Feature (three-part "catalog.schema.feature" full name).
+	assert.Equal(t, catalogRef+"."+schemaRef+".myfeature", b.Config.Resources.Features["my_feature"].FullName)
+
+	// MCP service (same compound parent field).
+	assert.Equal(t, "schemas/"+catalogRef+"."+schemaRef, b.Config.Resources.McpServices["my_mcp_service"].Parent)
+
+	// Model provider service (same compound parent field).
+	assert.Equal(t, "schemas/"+catalogRef+"."+schemaRef, b.Config.Resources.ModelProviderServices["my_mps"].Parent)
 }
 
 // Pipeline schema and target are mutually exclusive; only the populated field
@@ -220,7 +262,7 @@ func TestCaptureUCDependenciesQualityMonitorEdgeCases(t *testing.T) {
 
 	assert.Equal(t, "${resources.catalogs.my_catalog.name}.other", b.Config.Resources.QualityMonitors["catalog_only"].OutputSchemaName)
 	assert.Equal(t, "other.other", b.Config.Resources.QualityMonitors["no_match"].OutputSchemaName)
-	assert.Equal(t, "", b.Config.Resources.QualityMonitors["empty"].OutputSchemaName)
+	assert.Empty(t, b.Config.Resources.QualityMonitors["empty"].OutputSchemaName)
 	assert.Equal(t, "nodot", b.Config.Resources.QualityMonitors["no_dot"].OutputSchemaName)
 	assert.Nil(t, b.Config.Resources.QualityMonitors["nil_monitor"])
 }
@@ -239,6 +281,7 @@ func TestCaptureUCDependenciesModelServingEndpointEdgeCases(t *testing.T) {
 					// AutoCaptureConfig path.
 					"auto_capture": {CreateServingEndpoint: serving.CreateServingEndpoint{
 						Config: &serving.EndpointCoreConfigInput{
+							//nolint:staticcheck // SA1019: deprecated AutoCaptureConfigInput kept for bundle config compatibility
 							AutoCaptureConfig: &serving.AutoCaptureConfigInput{
 								CatalogName: "mycatalog", SchemaName: "myschema",
 							},
@@ -278,6 +321,37 @@ func TestCaptureUCDependenciesModelServingEndpointEdgeCases(t *testing.T) {
 	assert.Nil(t, b.Config.Resources.ModelServingEndpoints["nil_endpoint"])
 }
 
+func TestCaptureUCDependenciesVectorSearchIndexEdgeCases(t *testing.T) {
+	b := &bundle.Bundle{
+		Config: config.Root{
+			Resources: config.Resources{
+				Catalogs: map[string]*resources.Catalog{
+					"my_catalog": {CreateCatalog: catalog.CreateCatalog{Name: "mycatalog"}},
+				},
+				Schemas: map[string]*resources.Schema{
+					"my_schema": {CreateSchema: catalog.CreateSchema{CatalogName: "mycatalog", Name: "myschema"}},
+				},
+				VectorSearchIndexes: map[string]*resources.VectorSearchIndex{
+					"catalog_only": {CreateVectorIndexRequest: vectorsearch.CreateVectorIndexRequest{Name: "mycatalog.other.myindex"}},
+					"no_match":     {CreateVectorIndexRequest: vectorsearch.CreateVectorIndexRequest{Name: "other.other.myindex"}},
+					"empty":        {CreateVectorIndexRequest: vectorsearch.CreateVectorIndexRequest{Name: ""}},
+					"two_part":     {CreateVectorIndexRequest: vectorsearch.CreateVectorIndexRequest{Name: "mycatalog.myschema"}},
+					"nil_index":    nil,
+				},
+			},
+		},
+	}
+
+	d := bundle.Apply(t.Context(), b, CaptureUCDependencies())
+	require.Nil(t, d)
+
+	assert.Equal(t, "${resources.catalogs.my_catalog.name}.other.myindex", b.Config.Resources.VectorSearchIndexes["catalog_only"].Name)
+	assert.Equal(t, "other.other.myindex", b.Config.Resources.VectorSearchIndexes["no_match"].Name)
+	assert.Empty(t, b.Config.Resources.VectorSearchIndexes["empty"].Name)
+	assert.Equal(t, "mycatalog.myschema", b.Config.Resources.VectorSearchIndexes["two_part"].Name)
+	assert.Nil(t, b.Config.Resources.VectorSearchIndexes["nil_index"])
+}
+
 // Nil and empty resources should not panic.
 func TestCaptureUCDependenciesNilResources(t *testing.T) {
 	b := &bundle.Bundle{
@@ -290,6 +364,7 @@ func TestCaptureUCDependenciesNilResources(t *testing.T) {
 				Pipelines:             map[string]*resources.Pipeline{"nil": nil, "empty": {}},
 				QualityMonitors:       map[string]*resources.QualityMonitor{"nil": nil, "empty": {}},
 				ModelServingEndpoints: map[string]*resources.ModelServingEndpoint{"nil": nil, "empty": {}},
+				VectorSearchIndexes:   map[string]*resources.VectorSearchIndex{"nil": nil, "empty": {}},
 			},
 		},
 	}
@@ -297,3 +372,88 @@ func TestCaptureUCDependenciesNilResources(t *testing.T) {
 	d := bundle.Apply(t.Context(), b, CaptureUCDependencies())
 	require.Nil(t, d)
 }
+
+func TestSplitUCName(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    string
+		n        int
+		expected []string
+		ok       bool
+	}{
+		{"three_part", "catalog.schema.index", 3, []string{"catalog", "schema", "index"}, true},
+		{"two_part", "catalog.schema", 2, []string{"catalog", "schema"}, true},
+		{"too_many_components", "a.b.c.d", 3, nil, false},
+		{"too_few_components", "a.b", 3, nil, false},
+		{"single_component", "a", 3, nil, false},
+		{"empty", "", 3, nil, false},
+		{"reference_over_counts", "${resources.catalogs.c.name}.schema.index", 3, nil, false},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			parts, ok := splitUCName(tc.input, tc.n)
+			assert.Equal(t, tc.ok, ok)
+			assert.Equal(t, tc.expected, parts)
+		})
+	}
+}
+
+// A vector search index name that already contains a ${resources...} reference is left
+// untouched: a mix of references and literals is not supported. Only a fully literal name
+// with exactly three components has its catalog and schema captured.
+func TestCaptureUCDependenciesVectorSearchIndexReferences(t *testing.T) {
+	newBundle := func(indexName string) *bundle.Bundle {
+		return &bundle.Bundle{
+			Config: config.Root{
+				Resources: config.Resources{
+					Catalogs: map[string]*resources.Catalog{
+						"dev_catalog": {CreateCatalog: catalog.CreateCatalog{Name: "catalog1"}},
+					},
+					Schemas: map[string]*resources.Schema{
+						"my_schema": {CreateSchema: catalog.CreateSchema{CatalogName: "catalog1", Name: "myschema"}},
+					},
+					VectorSearchIndexes: map[string]*resources.VectorSearchIndex{
+						"idx": {CreateVectorIndexRequest: vectorsearch.CreateVectorIndexRequest{Name: indexName}},
+					},
+				},
+			},
+		}
+	}
+
+	tests := []struct {
+		name     string
+		input    string
+		expected string
+	}{
+		{
+			"all_literal_captured",
+			"catalog1.myschema.myindex",
+			"${resources.catalogs.dev_catalog.name}.${resources.schemas.my_schema.name}.myindex",
+		},
+		{
+			"catalog_reference_with_literal_schema_unsupported",
+			"${resources.catalogs.dev_catalog.name}.myschema.myindex",
+			"${resources.catalogs.dev_catalog.name}.myschema.myindex",
+		},
+		{
+			"fully_referenced_unchanged",
+			"${resources.catalogs.dev_catalog.name}.${resources.schemas.my_schema.name}.myindex",
+			"${resources.catalogs.dev_catalog.name}.${resources.schemas.my_schema.name}.myindex",
+		},
+		{
+			"more_than_three_components_skipped",
+			"catalog1.myschema.my.index",
+			"catalog1.myschema.my.index",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			b := newBundle(tc.input)
+			d := bundle.Apply(t.Context(), b, CaptureUCDependencies())
+			require.Nil(t, d)
+			assert.Equal(t, tc.expected, b.Config.Resources.VectorSearchIndexes["idx"].Name)
+		})
+	}
+}
diff --git a/bundle/config/mutator/resourcemutator/cluster_fixups.go b/bundle/config/mutator/resourcemutator/cluster_fixups.go
index 893cd248aa4..53cf62e10dc 100644
--- a/bundle/config/mutator/resourcemutator/cluster_fixups.go
+++ b/bundle/config/mutator/resourcemutator/cluster_fixups.go
@@ -97,8 +97,11 @@ func prepareJobSettingsForUpdate(js *jobs.JobSettings) {
 		}
 	}
 	for ind := range js.JobClusters {
-		ModifyRequestOnInstancePool(&js.JobClusters[ind].NewCluster)
-		initializeNumWorkers(&js.JobClusters[ind].NewCluster)
+		nc := js.JobClusters[ind].NewCluster
+		if nc != nil {
+			ModifyRequestOnInstancePool(nc)
+			initializeNumWorkers(nc)
+		}
 	}
 }
 
diff --git a/bundle/config/mutator/resourcemutator/configure_cluster_policy_definition.go b/bundle/config/mutator/resourcemutator/configure_cluster_policy_definition.go
new file mode 100644
index 00000000000..1e7a0d6f64b
--- /dev/null
+++ b/bundle/config/mutator/resourcemutator/configure_cluster_policy_definition.go
@@ -0,0 +1,71 @@
+package resourcemutator
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/libs/diag"
+	"github.com/databricks/cli/libs/dyn"
+)
+
+// jsonPolicyFields are the JSON-policy fields normalized from inline YAML to a JSON string.
+var jsonPolicyFields = []string{"definition", "policy_family_definition_overrides"}
+
+type configureClusterPolicyDefinition struct{}
+
+func ConfigureClusterPolicyDefinition() bundle.Mutator {
+	return &configureClusterPolicyDefinition{}
+}
+
+func (c configureClusterPolicyDefinition) Name() string {
+	return "ConfigureClusterPolicyDefinition"
+}
+
+func (c configureClusterPolicyDefinition) Apply(_ context.Context, b *bundle.Bundle) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	pattern := dyn.NewPattern(
+		dyn.Key("resources"),
+		dyn.Key("cluster_policies"),
+		dyn.AnyKey(),
+	)
+
+	err := b.Config.Mutate(func(v dyn.Value) (dyn.Value, error) {
+		return dyn.MapByPattern(v, pattern, func(p dyn.Path, v dyn.Value) (dyn.Value, error) {
+			for _, field := range jsonPolicyFields {
+				def := v.Get(field)
+
+				// Marshal an inline structured value to a JSON string so both
+				// config-side and state-side carry the same plain string. Otherwise
+				// YAML decodes small ints as Go `int` while state JSON round-trip
+				// decodes them as `float64`, and structdiff reports false drift.
+				switch def.Kind() {
+				case dyn.KindInvalid, dyn.KindNil, dyn.KindString:
+					// KindInvalid means the field is absent; leave it for backend validation.
+					continue
+				case dyn.KindMap:
+					jsonBytes, err := json.Marshal(def.AsAny())
+					if err != nil {
+						return dyn.InvalidValue, fmt.Errorf("failed to marshal inline %s: %w", field, err)
+					}
+					v, err = dyn.Set(v, field, dyn.V(string(jsonBytes)))
+					if err != nil {
+						return dyn.InvalidValue, err
+					}
+				default:
+					diags = diags.Append(diag.Diagnostic{
+						Severity:  diag.Error,
+						Summary:   fmt.Sprintf("%s must be a string or map, got %s", field, def.Kind()),
+						Locations: def.Locations(),
+					})
+				}
+			}
+			return v, nil
+		})
+	})
+
+	diags = diags.Extend(diag.FromErr(err))
+	return diags
+}
diff --git a/bundle/config/mutator/resourcemutator/configure_cluster_policy_definition_test.go b/bundle/config/mutator/resourcemutator/configure_cluster_policy_definition_test.go
new file mode 100644
index 00000000000..0c889b94655
--- /dev/null
+++ b/bundle/config/mutator/resourcemutator/configure_cluster_policy_definition_test.go
@@ -0,0 +1,111 @@
+package resourcemutator_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/config/mutator/resourcemutator"
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestConfigureClusterPolicyDefinition(t *testing.T) {
+	tests := []struct {
+		name  string
+		field string // "definition" or "policy_family_definition_overrides"
+		value any
+		want  any
+		// wantErr, when non-empty, is a substring expected in the diagnostics.
+		wantErr string
+	}{
+		{
+			name:  "definition: inline map is marshaled to a JSON string",
+			field: "definition",
+			value: map[string]any{"spark_version": map[string]any{"type": "fixed", "value": "13.3.x"}},
+			want:  `{"spark_version":{"type":"fixed","value":"13.3.x"}}`,
+		},
+		{
+			name:    "definition: inline sequence is rejected",
+			field:   "definition",
+			value:   []any{"a", "b"},
+			wantErr: "definition must be a string or map, got sequence",
+		},
+		{
+			name:  "definition: inline string is left unchanged",
+			field: "definition",
+			value: `{"spark_version":{"type":"fixed"}}`,
+			want:  `{"spark_version":{"type":"fixed"}}`,
+		},
+		{
+			name:  "definition: absent passes through",
+			field: "definition",
+			want:  nil,
+		},
+		{
+			name:    "definition: non-structured is rejected",
+			field:   "definition",
+			value:   true,
+			wantErr: "definition must be a string or map, got bool",
+		},
+		{
+			// Number stays a JSON number (30, not "30").
+			name:  "overrides: inline map is marshaled to a JSON string",
+			field: "policy_family_definition_overrides",
+			value: map[string]any{"autotermination_minutes": map[string]any{"type": "fixed", "value": 30}},
+			want:  `{"autotermination_minutes":{"type":"fixed","value":30}}`,
+		},
+		{
+			name:  "overrides: inline string is left unchanged",
+			field: "policy_family_definition_overrides",
+			value: `{"autotermination_minutes":{"type":"fixed"}}`,
+			want:  `{"autotermination_minutes":{"type":"fixed"}}`,
+		},
+		{
+			name:    "overrides: non-structured is rejected",
+			field:   "policy_family_definition_overrides",
+			value:   true,
+			wantErr: "policy_family_definition_overrides must be a string or map, got bool",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cp := &resources.ClusterPolicy{}
+			switch tt.field {
+			case "policy_family_definition_overrides":
+				cp.PolicyFamilyDefinitionOverrides = tt.value
+			case "definition":
+				cp.Definition = tt.value
+			default:
+				t.Fatalf("unknown field %q", tt.field)
+			}
+
+			b := &bundle.Bundle{
+				Config: config.Root{
+					Resources: config.Resources{
+						ClusterPolicies: map[string]*resources.ClusterPolicy{"pol": cp},
+					},
+				},
+			}
+
+			diags := bundle.ApplySeq(t.Context(), b, resourcemutator.ConfigureClusterPolicyDefinition())
+
+			if tt.wantErr != "" {
+				require.Error(t, diags.Error())
+				assert.ErrorContains(t, diags.Error(), tt.wantErr)
+				return
+			}
+
+			require.NoError(t, diags.Error())
+			got := b.Config.Resources.ClusterPolicies["pol"]
+			switch tt.field {
+			case "policy_family_definition_overrides":
+				assert.Equal(t, tt.want, got.PolicyFamilyDefinitionOverrides)
+			case "definition":
+				assert.Equal(t, tt.want, got.Definition)
+			}
+		})
+	}
+}
diff --git a/bundle/config/mutator/resourcemutator/configure_dashboards_serialized_dashboard.go b/bundle/config/mutator/resourcemutator/configure_dashboards_serialized_dashboard.go
index 27b55403d88..a17e5c6b07c 100644
--- a/bundle/config/mutator/resourcemutator/configure_dashboards_serialized_dashboard.go
+++ b/bundle/config/mutator/resourcemutator/configure_dashboards_serialized_dashboard.go
@@ -2,6 +2,7 @@ package resourcemutator
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
 
 	"github.com/databricks/cli/bundle"
@@ -39,17 +40,49 @@ func (c configureDashboardSerializedDashboard) Apply(_ context.Context, b *bundl
 			// Include "serialized_dashboard" field if "file_path" is set.
 			// Note: the Terraform resource supports "file_path" natively, but we read the contents of the dashboard here
 			// to be able to read file contents in Databricks Workspace (reading a dashboard file via file system fails there)
-			path, ok := v.Get(filePathFieldName).AsString()
-			if !ok {
-				return v, nil
-			}
+			filePath, hasFilePath := v.Get(filePathFieldName).AsString()
+			sd := v.Get(serializedDashboardFieldName)
+
+			if hasFilePath {
+				// file_path and serialized_dashboard are two ways to provide the
+				// same content. Accepting both is ambiguous, so reject it instead
+				// of silently picking one.
+				if sd.IsValid() && sd.Kind() != dyn.KindNil {
+					diags = diags.Append(diag.Diagnostic{
+						Severity:  diag.Error,
+						Summary:   "both file_path and serialized_dashboard are set; specify only one",
+						Locations: sd.Locations(),
+					})
+					return v, nil
+				}
 
-			contents, err := b.SyncRoot.ReadFile(path)
-			if err != nil {
-				return dyn.InvalidValue, fmt.Errorf("failed to read serialized dashboard from file_path %s: %w", path, err)
+				contents, err := b.SyncRoot.ReadFile(filePath)
+				if err != nil {
+					return dyn.InvalidValue, fmt.Errorf("failed to read serialized dashboard from file_path %s: %w", filePath, err)
+				}
+				return dyn.Set(v, serializedDashboardFieldName, dyn.V(string(contents)))
 			}
 
-			return dyn.Set(v, serializedDashboardFieldName, dyn.V(string(contents)))
+			// Marshal an inline structured serialized_dashboard to a JSON string
+			switch sd.Kind() {
+			case dyn.KindInvalid, dyn.KindNil, dyn.KindString:
+				// KindInvalid means serialized_dashboard is absent (neither it nor
+				// file_path is set); leave it for backend validation to reject.
+				return v, nil
+			case dyn.KindMap:
+				jsonBytes, err := json.Marshal(sd.AsAny())
+				if err != nil {
+					return dyn.InvalidValue, fmt.Errorf("failed to marshal inline serialized_dashboard: %w", err)
+				}
+				return dyn.Set(v, serializedDashboardFieldName, dyn.V(string(jsonBytes)))
+			default:
+				diags = diags.Append(diag.Diagnostic{
+					Severity:  diag.Error,
+					Summary:   fmt.Sprintf("serialized_dashboard must be a string or map, got %s", sd.Kind()),
+					Locations: sd.Locations(),
+				})
+				return v, nil
+			}
 		})
 	})
 
diff --git a/bundle/config/mutator/resourcemutator/configure_dashboards_serialized_dashboard_test.go b/bundle/config/mutator/resourcemutator/configure_dashboards_serialized_dashboard_test.go
new file mode 100644
index 00000000000..792cecde9bf
--- /dev/null
+++ b/bundle/config/mutator/resourcemutator/configure_dashboards_serialized_dashboard_test.go
@@ -0,0 +1,126 @@
+package resourcemutator_test
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/config/mutator/resourcemutator"
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/cli/libs/vfs"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestConfigureDashboardSerializedDashboard(t *testing.T) {
+	const fileName = "dashboard.lvdash.json"
+
+	tests := []struct {
+		name string
+		// filePath is set on the resource as-is (already sync-root-relative).
+		filePath string
+		// writeFile creates filePath with fileContents before the mutator runs.
+		writeFile           bool
+		fileContents        string
+		setSerialized       bool
+		serializedDashboard any
+		// wantSerialized is the expected serialized_dashboard after a successful run.
+		wantSerialized any
+		// wantErr, when non-empty, is a substring expected in the diagnostics.
+		wantErr string
+	}{
+		{
+			// The file is read verbatim, so formatting and the trailing newline
+			// are preserved (unlike the inline path, which re-marshals).
+			name:           "file_path reads file contents verbatim",
+			filePath:       fileName,
+			writeFile:      true,
+			fileContents:   `{"pages": 1}` + "\n",
+			wantSerialized: `{"pages": 1}` + "\n",
+		},
+		{
+			// Inline maps are marshaled to a compact JSON string with sorted keys
+			// so config and state hold an identical string and don't drift.
+			name:                "inline map is marshaled to a JSON string",
+			setSerialized:       true,
+			serializedDashboard: map[string]any{"pages": 1},
+			wantSerialized:      `{"pages":1}`,
+		},
+		{
+			name:                "inline string is left unchanged",
+			setSerialized:       true,
+			serializedDashboard: `{"pages":1}`,
+			wantSerialized:      `{"pages":1}`,
+		},
+		{
+			// Neither field set: the absent field must pass through, not error.
+			name:           "neither file_path nor serialized_dashboard passes through",
+			wantSerialized: nil,
+		},
+		{
+			name:                "both file_path and serialized_dashboard is rejected",
+			filePath:            fileName,
+			setSerialized:       true,
+			serializedDashboard: map[string]any{"pages": 1},
+			wantErr:             "both file_path and serialized_dashboard are set; specify only one",
+		},
+		{
+			name:                "non-structured serialized_dashboard is rejected",
+			setSerialized:       true,
+			serializedDashboard: true,
+			wantErr:             "serialized_dashboard must be a string or map, got bool",
+		},
+		{
+			name:                "inline sequence is rejected",
+			setSerialized:       true,
+			serializedDashboard: []any{map[string]any{"version": 1}},
+			wantErr:             "serialized_dashboard must be a string or map, got sequence",
+		},
+		{
+			name:     "unreadable file_path is an error",
+			filePath: "does_not_exist.json",
+			wantErr:  "failed to read serialized dashboard",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			dir := t.TempDir()
+			if tt.writeFile {
+				require.NoError(t, os.WriteFile(filepath.Join(dir, tt.filePath), []byte(tt.fileContents), 0o600))
+			}
+
+			dash := &resources.Dashboard{
+				DisplayName: "My Dashboard",
+				FilePath:    tt.filePath,
+			}
+			if tt.setSerialized {
+				dash.SerializedDashboard = tt.serializedDashboard
+			}
+
+			b := &bundle.Bundle{
+				SyncRootPath:   dir,
+				BundleRootPath: dir,
+				SyncRoot:       vfs.MustNew(dir),
+				Config: config.Root{
+					Resources: config.Resources{
+						Dashboards: map[string]*resources.Dashboard{"my_dashboard": dash},
+					},
+				},
+			}
+
+			diags := bundle.ApplySeq(t.Context(), b, resourcemutator.ConfigureDashboardSerializedDashboard())
+
+			if tt.wantErr != "" {
+				require.Error(t, diags.Error())
+				assert.ErrorContains(t, diags.Error(), tt.wantErr)
+				return
+			}
+
+			require.NoError(t, diags.Error())
+			assert.Equal(t, tt.wantSerialized, b.Config.Resources.Dashboards["my_dashboard"].SerializedDashboard)
+		})
+	}
+}
diff --git a/bundle/config/mutator/resourcemutator/configure_genie_space_serialized_space.go b/bundle/config/mutator/resourcemutator/configure_genie_space_serialized_space.go
new file mode 100644
index 00000000000..e16bd57625b
--- /dev/null
+++ b/bundle/config/mutator/resourcemutator/configure_genie_space_serialized_space.go
@@ -0,0 +1,90 @@
+package resourcemutator
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/libs/diag"
+	"github.com/databricks/cli/libs/dyn"
+)
+
+const serializedSpaceFieldName = "serialized_space"
+
+type configureGenieSpaceSerializedSpace struct{}
+
+func ConfigureGenieSpaceSerializedSpace() bundle.Mutator {
+	return &configureGenieSpaceSerializedSpace{}
+}
+
+func (c configureGenieSpaceSerializedSpace) Name() string {
+	return "ConfigureGenieSpaceSerializedSpace"
+}
+
+func (c configureGenieSpaceSerializedSpace) Apply(_ context.Context, b *bundle.Bundle) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	pattern := dyn.NewPattern(
+		dyn.Key("resources"),
+		dyn.Key("genie_spaces"),
+		dyn.AnyKey(),
+	)
+
+	err := b.Config.Mutate(func(v dyn.Value) (dyn.Value, error) {
+		return dyn.MapByPattern(v, pattern, func(p dyn.Path, v dyn.Value) (dyn.Value, error) {
+			filePath, hasFilePath := v.Get(filePathFieldName).AsString()
+			ss := v.Get(serializedSpaceFieldName)
+
+			if hasFilePath {
+				// file_path and serialized_space are two ways to provide the same
+				// content. Accepting both is ambiguous, so reject it instead of
+				// silently picking one.
+				if ss.IsValid() && ss.Kind() != dyn.KindNil {
+					diags = diags.Append(diag.Diagnostic{
+						Severity:  diag.Error,
+						Summary:   "both file_path and serialized_space are set; specify only one",
+						Locations: ss.Locations(),
+					})
+					return v, nil
+				}
+				contents, err := b.SyncRoot.ReadFile(filePath)
+				if err != nil {
+					return dyn.InvalidValue, fmt.Errorf("failed to read serialized genie space from file_path %s: %w", filePath, err)
+				}
+				return dyn.Set(v, serializedSpaceFieldName, dyn.V(string(contents)))
+			}
+
+			// Marshal an inline structured serialized_space to a JSON string so
+			// both config-side and state-side carry the same plain string.
+			// Otherwise YAML decodes small ints as Go `int` while state JSON
+			// round-trip decodes them as `float64`, and structdiff reports
+			// false drift on every plan.
+			switch ss.Kind() {
+			case dyn.KindInvalid, dyn.KindNil, dyn.KindString:
+				// KindInvalid means serialized_space is absent (neither it nor
+				// file_path is set); leave it for backend validation to reject.
+				return v, nil
+			case dyn.KindMap:
+				// A top-level sequence would be valid JSON but is meaningless for a
+				// genie space, so KindSequence is not accepted here and falls through
+				// to the default rejection below.
+				jsonBytes, err := json.Marshal(ss.AsAny())
+				if err != nil {
+					return dyn.InvalidValue, fmt.Errorf("failed to marshal inline serialized_space: %w", err)
+				}
+				return dyn.Set(v, serializedSpaceFieldName, dyn.V(string(jsonBytes)))
+			default:
+				diags = diags.Append(diag.Diagnostic{
+					Severity:  diag.Error,
+					Summary:   fmt.Sprintf("serialized_space must be a string or map, got %s", ss.Kind()),
+					Locations: ss.Locations(),
+				})
+				return v, nil
+			}
+		})
+	})
+
+	diags = diags.Extend(diag.FromErr(err))
+	return diags
+}
diff --git a/bundle/config/mutator/resourcemutator/configure_genie_space_serialized_space_test.go b/bundle/config/mutator/resourcemutator/configure_genie_space_serialized_space_test.go
new file mode 100644
index 00000000000..fb9eab68b0d
--- /dev/null
+++ b/bundle/config/mutator/resourcemutator/configure_genie_space_serialized_space_test.go
@@ -0,0 +1,128 @@
+package resourcemutator_test
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/config/mutator/resourcemutator"
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/cli/libs/vfs"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestConfigureGenieSpaceSerializedSpace(t *testing.T) {
+	const fileName = "space.geniespace.json"
+
+	tests := []struct {
+		name string
+		// filePath is set on the resource as-is (already sync-root-relative).
+		filePath string
+		// writeFile creates filePath with fileContents before the mutator runs.
+		writeFile       bool
+		fileContents    string
+		setSerialized   bool
+		serializedSpace any
+		// wantSerialized is the expected serialized_space after a successful run.
+		wantSerialized any
+		// wantErr, when non-empty, is a substring expected in the diagnostics.
+		wantErr string
+	}{
+		{
+			// The file is read verbatim, so formatting and the trailing newline
+			// are preserved (unlike the inline path, which re-marshals).
+			name:           "file_path reads file contents verbatim",
+			filePath:       fileName,
+			writeFile:      true,
+			fileContents:   `{"version": 1}` + "\n",
+			wantSerialized: `{"version": 1}` + "\n",
+		},
+		{
+			// Inline maps are marshaled to a compact JSON string with sorted keys
+			// so config and state hold an identical string and don't drift.
+			name:            "inline map is marshaled to a JSON string",
+			setSerialized:   true,
+			serializedSpace: map[string]any{"version": 1},
+			wantSerialized:  `{"version":1}`,
+		},
+		{
+			name:            "inline string is left unchanged",
+			setSerialized:   true,
+			serializedSpace: `{"version":1}`,
+			wantSerialized:  `{"version":1}`,
+		},
+		{
+			// Neither field set: the absent field must pass through, not error.
+			name:           "neither file_path nor serialized_space passes through",
+			wantSerialized: nil,
+		},
+		{
+			name:            "both file_path and serialized_space is rejected",
+			filePath:        fileName,
+			setSerialized:   true,
+			serializedSpace: map[string]any{"version": 1},
+			wantErr:         "both file_path and serialized_space are set; specify only one",
+		},
+		{
+			name:            "non-structured serialized_space is rejected",
+			setSerialized:   true,
+			serializedSpace: true,
+			wantErr:         "serialized_space must be a string or map, got bool",
+		},
+		{
+			// A top-level sequence is valid JSON but meaningless for a genie space,
+			// so it is rejected rather than marshaled like an inline map.
+			name:            "inline sequence is rejected",
+			setSerialized:   true,
+			serializedSpace: []any{map[string]any{"version": 1}},
+			wantErr:         "serialized_space must be a string or map, got sequence",
+		},
+		{
+			name:     "unreadable file_path is an error",
+			filePath: "does_not_exist.json",
+			wantErr:  "failed to read serialized genie space",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			dir := t.TempDir()
+			if tt.writeFile {
+				require.NoError(t, os.WriteFile(filepath.Join(dir, tt.filePath), []byte(tt.fileContents), 0o600))
+			}
+
+			gs := &resources.GenieSpace{
+				Title:    "My Genie Space",
+				FilePath: tt.filePath,
+			}
+			if tt.setSerialized {
+				gs.SerializedSpace = tt.serializedSpace
+			}
+
+			b := &bundle.Bundle{
+				SyncRootPath:   dir,
+				BundleRootPath: dir,
+				SyncRoot:       vfs.MustNew(dir),
+				Config: config.Root{
+					Resources: config.Resources{
+						GenieSpaces: map[string]*resources.GenieSpace{"my_space": gs},
+					},
+				},
+			}
+
+			diags := bundle.ApplySeq(t.Context(), b, resourcemutator.ConfigureGenieSpaceSerializedSpace())
+
+			if tt.wantErr != "" {
+				require.Error(t, diags.Error())
+				assert.ErrorContains(t, diags.Error(), tt.wantErr)
+				return
+			}
+
+			require.NoError(t, diags.Error())
+			assert.Equal(t, tt.wantSerialized, b.Config.Resources.GenieSpaces["my_space"].SerializedSpace)
+		})
+	}
+}
diff --git a/bundle/config/mutator/resourcemutator/expand_pipeline_glob_paths_test.go b/bundle/config/mutator/resourcemutator/expand_pipeline_glob_paths_test.go
index 56440f7cd1c..ead2084d835 100644
--- a/bundle/config/mutator/resourcemutator/expand_pipeline_glob_paths_test.go
+++ b/bundle/config/mutator/resourcemutator/expand_pipeline_glob_paths_test.go
@@ -14,7 +14,7 @@ import (
 	"github.com/databricks/cli/bundle/config"
 	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/cli/bundle/internal/bundletest"
-	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/databricks-sdk-go/service/compute"
 	"github.com/databricks/databricks-sdk-go/service/pipelines"
 	"github.com/stretchr/testify/require"
@@ -110,8 +110,8 @@ func TestExpandGlobPathsInPipelines(t *testing.T) {
 		},
 	}
 
-	bundletest.SetLocation(b, ".", []dyn.Location{{File: filepath.Join(dir, "resource.yml")}})
-	bundletest.SetLocation(b, "resources.pipelines.pipeline.libraries[3]", []dyn.Location{{File: filepath.Join(dir, "relative", "resource.yml")}})
+	bundletest.SetLocation(b, ".", []diag.Location{{File: filepath.Join(dir, "resource.yml")}})
+	bundletest.SetLocation(b, "resources.pipelines.pipeline.libraries[3]", []diag.Location{{File: filepath.Join(dir, "relative", "resource.yml")}})
 
 	diags := bundle.ApplySeq(t.Context(), b, mutator.NormalizePaths(), resourcemutator.ExpandPipelineGlobPaths())
 	require.NoError(t, diags.Error())
diff --git a/bundle/config/mutator/resourcemutator/fix_permissions.go b/bundle/config/mutator/resourcemutator/fix_permissions.go
index 7f685015e2d..9e6c785b0d9 100644
--- a/bundle/config/mutator/resourcemutator/fix_permissions.go
+++ b/bundle/config/mutator/resourcemutator/fix_permissions.go
@@ -25,6 +25,9 @@ var hasIsOwner = map[string]bool{
 
 var ignoredResources = map[string]bool{
 	"secret_scopes": true,
+	// Cluster policies only support CAN_USE; injecting the current user as
+	// CAN_MANAGE/IS_OWNER would be rejected by the permissions API.
+	"cluster_policies": true,
 }
 
 // When processing permissions, we need to implement these constraints:
@@ -211,6 +214,12 @@ func createPermissionFromPrincipal(principal, level string) dyn.Value {
 }
 
 func (m *fixPermissions) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
+	// CurrentUser is populated by PopulateCurrentUser early in the initialize phase.
+	// It can be nil when this mutator runs outside that phase (e.g. NormalizeResources
+	// after PythonMutator); there is no user to add as owner, so skip.
+	if b.Config.Workspace.CurrentUser == nil {
+		return nil
+	}
 	currentUser := b.Config.Workspace.CurrentUser.UserName
 
 	err := b.Config.Mutate(func(v dyn.Value) (dyn.Value, error) {
diff --git a/bundle/config/mutator/resourcemutator/fix_permissions_test.go b/bundle/config/mutator/resourcemutator/fix_permissions_test.go
index 507096c3fd7..f5488777ec4 100644
--- a/bundle/config/mutator/resourcemutator/fix_permissions_test.go
+++ b/bundle/config/mutator/resourcemutator/fix_permissions_test.go
@@ -23,7 +23,7 @@ func TestGetMaxLevel(t *testing.T) {
 	assert.Equal(t, "CAN_MANAGE", resources.GetMaxLevel("CAN_MANAGE", "CAN_MANAGE"))
 	assert.Equal(t, "CAN_READ", resources.GetMaxLevel("CAN_READ", ""))
 	assert.Equal(t, "CAN_READ", resources.GetMaxLevel("", "CAN_READ"))
-	assert.Equal(t, "", resources.GetMaxLevel("", ""))
+	assert.Empty(t, resources.GetMaxLevel("", ""))
 
 	assert.Equal(t, "UNKNOWN_B", resources.GetMaxLevel("UNKNOWN_A", "UNKNOWN_B"))
 	assert.Equal(t, "UNKNOWN_B", resources.GetMaxLevel("UNKNOWN_B", "UNKNOWN_A"))
diff --git a/bundle/config/mutator/resourcemutator/genie_space_fixups.go b/bundle/config/mutator/resourcemutator/genie_space_fixups.go
new file mode 100644
index 00000000000..85e1bb7e745
--- /dev/null
+++ b/bundle/config/mutator/resourcemutator/genie_space_fixups.go
@@ -0,0 +1,30 @@
+package resourcemutator
+
+import (
+	"context"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/libs/diag"
+)
+
+type genieSpaceFixups struct{}
+
+func GenieSpaceFixups() bundle.Mutator {
+	return &genieSpaceFixups{}
+}
+
+func (m *genieSpaceFixups) Name() string {
+	return "GenieSpaceFixups"
+}
+
+func (m *genieSpaceFixups) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
+	for _, genieSpace := range b.Config.Resources.GenieSpaces {
+		if genieSpace == nil {
+			continue
+		}
+
+		genieSpace.ParentPath = ensureWorkspacePrefix(genieSpace.ParentPath)
+	}
+
+	return nil
+}
diff --git a/bundle/config/mutator/resourcemutator/merge_grants.go b/bundle/config/mutator/resourcemutator/merge_grants.go
index 1f8d033747c..3966190a5ee 100644
--- a/bundle/config/mutator/resourcemutator/merge_grants.go
+++ b/bundle/config/mutator/resourcemutator/merge_grants.go
@@ -14,8 +14,10 @@ var grantResourceTypes = []string{
 	"catalogs",
 	"schemas",
 	"external_locations",
+	"secrets",
 	"volumes",
 	"registered_models",
+	"vector_search_indexes",
 }
 
 type mergeGrants struct{}
diff --git a/bundle/config/mutator/resourcemutator/merge_job_clusters_test.go b/bundle/config/mutator/resourcemutator/merge_job_clusters_test.go
index 56c5e5ee721..4f981022609 100644
--- a/bundle/config/mutator/resourcemutator/merge_job_clusters_test.go
+++ b/bundle/config/mutator/resourcemutator/merge_job_clusters_test.go
@@ -23,7 +23,7 @@ func TestMergeJobClusters(t *testing.T) {
 							JobClusters: []jobs.JobCluster{
 								{
 									JobClusterKey: "foo",
-									NewCluster: compute.ClusterSpec{
+									NewCluster: &compute.ClusterSpec{
 										SparkVersion: "13.3.x-scala2.12",
 										NodeTypeId:   "i3.xlarge",
 										NumWorkers:   2,
@@ -31,13 +31,13 @@ func TestMergeJobClusters(t *testing.T) {
 								},
 								{
 									JobClusterKey: "bar",
-									NewCluster: compute.ClusterSpec{
+									NewCluster: &compute.ClusterSpec{
 										SparkVersion: "10.4.x-scala2.12",
 									},
 								},
 								{
 									JobClusterKey: "foo",
-									NewCluster: compute.ClusterSpec{
+									NewCluster: &compute.ClusterSpec{
 										NodeTypeId: "i3.2xlarge",
 										NumWorkers: 4,
 									},
@@ -79,14 +79,14 @@ func TestMergeJobClustersWithNilKey(t *testing.T) {
 						JobSettings: jobs.JobSettings{
 							JobClusters: []jobs.JobCluster{
 								{
-									NewCluster: compute.ClusterSpec{
+									NewCluster: &compute.ClusterSpec{
 										SparkVersion: "13.3.x-scala2.12",
 										NodeTypeId:   "i3.xlarge",
 										NumWorkers:   2,
 									},
 								},
 								{
-									NewCluster: compute.ClusterSpec{
+									NewCluster: &compute.ClusterSpec{
 										NodeTypeId: "i3.2xlarge",
 										NumWorkers: 4,
 									},
diff --git a/bundle/config/mutator/resourcemutator/model_serving_endpoint_fixups.go b/bundle/config/mutator/resourcemutator/model_serving_endpoint_fixups.go
index 87962a85e86..6c25146e6bd 100644
--- a/bundle/config/mutator/resourcemutator/model_serving_endpoint_fixups.go
+++ b/bundle/config/mutator/resourcemutator/model_serving_endpoint_fixups.go
@@ -5,7 +5,6 @@ import (
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/libs/diag"
-	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/cli/libs/utils"
 	"github.com/databricks/databricks-sdk-go/service/serving"
 )
@@ -56,7 +55,7 @@ func (m *modelServingEndpointFixups) Apply(ctx context.Context, b *bundle.Bundle
 				Severity: diag.Error,
 				Summary:  "Cannot use both served_models and served_entities",
 				Detail:   "Model serving endpoint cannot specify both served_models and served_entities at the same time.",
-				Locations: []dyn.Location{
+				Locations: []diag.Location{
 					b.Config.GetLocation("resources.model_serving_endpoints." + key),
 				},
 			})
@@ -71,7 +70,7 @@ func (m *modelServingEndpointFixups) Apply(ctx context.Context, b *bundle.Bundle
 				Severity: diag.Warning,
 				Summary:  "Using served_models is deprecated",
 				Detail:   "The served_models field is deprecated. Please use served_entities instead.",
-				Locations: []dyn.Location{
+				Locations: []diag.Location{
 					b.Config.GetLocation("resources.model_serving_endpoints." + key + ".config.served_models"),
 				},
 			})
diff --git a/bundle/config/mutator/resourcemutator/process_static_resources.go b/bundle/config/mutator/resourcemutator/process_static_resources.go
index 3f859fd11cd..82aa89ff915 100644
--- a/bundle/config/mutator/resourcemutator/process_static_resources.go
+++ b/bundle/config/mutator/resourcemutator/process_static_resources.go
@@ -38,6 +38,7 @@ func (p processStaticResources) Apply(ctx context.Context, b *bundle.Bundle) dia
 	// we need to resolve variables because they can change path values:
 	// - variable can be used a prefix
 	// - path can be part of a complex variable value
+
 	bundle.ApplySeqContext(
 		ctx,
 		b,
@@ -45,8 +46,6 @@ func (p processStaticResources) Apply(ctx context.Context, b *bundle.Bundle) dia
 		// Updates (dynamic): resources.* (strings) (resolves variable references to their actual values)
 		// Resolves variable references in 'resources' using bundle, workspace, and variables prefixes
 		mutator.ResolveVariableReferencesOnlyResources(),
-		// After normal variable resolution, log all ${resources.*} references
-		mutator.LogResourceReferences(),
 		mutator.NormalizePaths(),
 
 		// Translate dashboard paths into paths in the workspace file system
@@ -75,7 +74,7 @@ func getAllResources(b *bundle.Bundle) (ResourceKeySet, error) {
 		return root, nil
 	})
 	if err != nil {
-		return nil, fmt.Errorf("failed to collect resources: %s", err)
+		return nil, fmt.Errorf("failed to collect resources: %w", err)
 	}
 
 	return set, nil
diff --git a/bundle/config/mutator/resourcemutator/resource_mutator.go b/bundle/config/mutator/resourcemutator/resource_mutator.go
index 2eb292cfbb0..2262ad6c0a5 100644
--- a/bundle/config/mutator/resourcemutator/resource_mutator.go
+++ b/bundle/config/mutator/resourcemutator/resource_mutator.go
@@ -52,6 +52,7 @@ func applyInitializeMutators(ctx context.Context, b *bundle.Bundle) {
 	}{
 		{"resources.dashboards.*.parent_path", b.Config.Workspace.ResourcePath},
 		{"resources.dashboards.*.embed_credentials", false},
+		{"resources.genie_spaces.*.parent_path", b.Config.Workspace.ResourcePath},
 		{"resources.volumes.*.volume_type", "MANAGED"},
 
 		{"resources.alerts.*.parent_path", b.Config.Workspace.ResourcePath},
@@ -72,10 +73,6 @@ func applyInitializeMutators(ctx context.Context, b *bundle.Bundle) {
 			"enabled": dyn.V(true),
 		}},
 
-		// This is converted from single-task to multi-task
-		{"resources.jobs.*.task[*].dbt_task.schema", "default"},
-		{"resources.jobs.*.task[*].for_each_task.task.dbt_task.schema", "default"},
-
 		// https://github.com/databricks/terraform-provider-databricks/blob/v1.75.0/clusters/resource_cluster.go
 		{"resources.jobs.*.job_clusters[*].new_cluster.workload_type.clients.notebooks", true},
 		{"resources.jobs.*.job_clusters[*].new_cluster.workload_type.clients.jobs", true},
@@ -115,6 +112,11 @@ func applyInitializeMutators(ctx context.Context, b *bundle.Bundle) {
 		// Ensures dashboard parent paths have the required /Workspace prefix
 		DashboardFixups(),
 
+		// Reads (typed): b.Config.Resources.GenieSpaces (checks genie space configurations)
+		// Updates (typed): b.Config.Resources.GenieSpaces[].ParentPath (ensures /Workspace prefix is present)
+		// Ensures genie space parent paths have the required /Workspace prefix
+		GenieSpaceFixups(),
+
 		// Reads (typed): b.Config.Permissions (validates permission levels)
 		// Reads (dynamic): resources.{jobs,pipelines,experiments,models,model_serving_endpoints,dashboards,apps,vector_search_endpoints,...}.*.permissions (reads existing permissions)
 		// Updates (dynamic): resources.{jobs,pipelines,experiments,models,model_serving_endpoints,dashboards,apps,vector_search_endpoints,...}.*.permissions (adds permissions from bundle-level configuration)
@@ -167,7 +169,7 @@ func applyNormalizeMutators(ctx context.Context, b *bundle.Bundle) {
 		// Updates (dynamic): resources.apps.*.resources (merges app resources with the same name)
 		MergeApps(),
 
-		// Reads (dynamic): resources.{catalogs,schemas,external_locations,volumes,registered_models}.*.grants
+		// Reads (dynamic): resources.{catalogs,schemas,external_locations,volumes,registered_models,vector_search_indexes}.*.grants
 		// Updates (dynamic): same paths — merges grant entries by principal and deduplicates privileges
 		MergeGrants(),
 
@@ -182,6 +184,14 @@ func applyNormalizeMutators(ctx context.Context, b *bundle.Bundle) {
 		// Drops (dynamic): resources.dashboards.*.file_path
 		ConfigureDashboardSerializedDashboard(),
 
+		// Reads (dynamic): resources.genie_spaces.*.file_path
+		// Updates (dynamic): resources.genie_spaces.*.serialized_space
+		ConfigureGenieSpaceSerializedSpace(),
+
+		// Reads (dynamic): resources.cluster_policies.*.definition
+		// Updates (dynamic): resources.cluster_policies.*.definition (inline YAML -> JSON string)
+		ConfigureClusterPolicyDefinition(),
+
 		// Reads (typed): resources.alerts.*.file_path
 		// Updates (typed): resources.alerts.* (loads alert configuration from .dbalert.json file)
 		mutator.LoadDBAlertFiles(),
@@ -218,7 +228,7 @@ func NormalizeAndInitializeResources(
 		return selectResources(root, addedResources)
 	})
 	if err != nil {
-		logdiag.LogError(ctx, fmt.Errorf("failed to select resources: %s", err))
+		logdiag.LogError(ctx, fmt.Errorf("failed to select resources: %w", err))
 		return
 	}
 
@@ -237,7 +247,7 @@ func NormalizeAndInitializeResources(
 		return mergeResources(root, snapshot)
 	})
 	if err != nil {
-		logdiag.LogError(ctx, fmt.Errorf("failed to merge resources: %s", err))
+		logdiag.LogError(ctx, fmt.Errorf("failed to merge resources: %w", err))
 	}
 }
 
@@ -260,7 +270,7 @@ func NormalizeResources(
 		return selectResources(root, updatedResources)
 	})
 	if err != nil {
-		logdiag.LogError(ctx, fmt.Errorf("failed to select resources: %s", err))
+		logdiag.LogError(ctx, fmt.Errorf("failed to select resources: %w", err))
 		return
 	}
 
@@ -269,12 +279,23 @@ func NormalizeResources(
 		return
 	}
 
+	// Permissions added to an existing resource by a Python mutator must still get the
+	// deploying user as IS_OWNER, otherwise the Permissions API rejects the PUT with
+	// "must have exactly one owner" (#5682). FixPermissions is idempotent, so re-running
+	// it on resources that already have an owner is a no-op. ApplyBundlePermissions is
+	// intentionally not re-run here: it is not idempotent (it appends bundle-level
+	// permissions) and already ran for these resources in ProcessStaticResources.
+	bundle.ApplyContext(ctx, b, FixPermissions())
+	if logdiag.HasError(ctx) {
+		return
+	}
+
 	// after mutators, we merge updated resources back to snapshot to preserve non-selected resources
 	err = b.Config.Mutate(func(root dyn.Value) (dyn.Value, error) {
 		return mergeResources(root, snapshot)
 	})
 	if err != nil {
-		logdiag.LogError(ctx, fmt.Errorf("failed to merge resources: %s", err))
+		logdiag.LogError(ctx, fmt.Errorf("failed to merge resources: %w", err))
 	}
 }
 
diff --git a/bundle/config/mutator/resourcemutator/run_as.go b/bundle/config/mutator/resourcemutator/run_as.go
index 4f5e3ce9036..65279c7f212 100644
--- a/bundle/config/mutator/resourcemutator/run_as.go
+++ b/bundle/config/mutator/resourcemutator/run_as.go
@@ -9,6 +9,7 @@ import (
 	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/structs/structpath"
 	"github.com/databricks/databricks-sdk-go/service/jobs"
 	"github.com/databricks/databricks-sdk-go/service/pipelines"
 	"github.com/databricks/databricks-sdk-go/service/sql"
@@ -31,12 +32,12 @@ func (m *setRunAs) Name() string {
 	return "SetRunAs"
 }
 
-func reportRunAsNotSupported(resourceType string, location dyn.Location, currentUser, runAsUser string) diag.Diagnostics {
+func reportRunAsNotSupported(resourceType string, location diag.Location, currentUser, runAsUser string) diag.Diagnostics {
 	return diag.Diagnostics{{
 		Summary: fmt.Sprintf("%s do not support a setting a run_as user that is different from the owner.\n"+
 			"Current identity: %s. Run as identity: %s.\n"+
 			"See https://docs.databricks.com/dev-tools/bundles/run-as.html to learn more about the run_as property.", resourceType, currentUser, runAsUser),
-		Locations: []dyn.Location{location},
+		Locations: []diag.Location{location},
 		Severity:  diag.Error,
 	}}
 }
@@ -44,31 +45,21 @@ func reportRunAsNotSupported(resourceType string, location dyn.Location, current
 func validateRunAs(b *bundle.Bundle) diag.Diagnostics {
 	diags := diag.Diagnostics{}
 
-	neitherSpecifiedErr := diag.Diagnostics{{
-		Summary:   "run_as section must specify exactly one identity. Neither service_principal_name nor user_name is specified",
-		Locations: []dyn.Location{b.Config.GetLocation("run_as")},
-		Severity:  diag.Error,
-	}}
-
-	// Fail fast if neither service_principal_name nor user_name are specified, but the
-	// run_as section is present.
-	if b.Config.Value().Get("run_as").Kind() == dyn.KindNil {
-		return neitherSpecifiedErr
-	}
-
-	// Fail fast if one or both of service_principal_name and user_name are specified,
-	// but with empty values.
+	identityCount := 0
 	runAs := b.Config.RunAs
-	if runAs.ServicePrincipalName == "" && runAs.UserName == "" {
-		return neitherSpecifiedErr
+	if runAs != nil {
+		for _, identity := range []string{runAs.UserName, runAs.ServicePrincipalName, runAs.GroupName} {
+			if identity != "" {
+				identityCount++
+			}
+		}
 	}
-
-	if runAs.UserName != "" && runAs.ServicePrincipalName != "" {
-		diags = diags.Extend(diag.Diagnostics{{
-			Summary:   "run_as section cannot specify both user_name and service_principal_name",
-			Locations: []dyn.Location{b.Config.GetLocation("run_as")},
+	if identityCount != 1 {
+		return diag.Diagnostics{{
+			Summary:   "run_as section must specify exactly one non-empty identity: user_name, service_principal_name, or group_name",
+			Locations: []diag.Location{b.Config.GetLocation("run_as")},
 			Severity:  diag.Error,
-		}})
+		}}
 	}
 
 	identity := runAs.ServicePrincipalName
@@ -77,10 +68,19 @@ func validateRunAs(b *bundle.Bundle) diag.Diagnostics {
 	}
 
 	// All resources are supported if the run_as identity is the same as the current deployment identity.
-	if identity == b.Config.Workspace.CurrentUser.UserName {
+	if runAs.GroupName == "" && identity == b.Config.Workspace.CurrentUser.UserName {
 		return diags
 	}
 
+	if runAs.GroupName != "" {
+		identity = fmt.Sprintf("group %q", runAs.GroupName)
+		for _, alert := range b.Config.Resources.Alerts {
+			if alert.RunAs == nil {
+				return diag.Errorf("alerts do not support run_as.group_name; set run_as.user_name or run_as.service_principal_name on each alert")
+			}
+		}
+	}
+
 	// Model serving endpoints do not support run_as in the API.
 	if len(b.Config.Resources.ModelServingEndpoints) > 0 {
 		diags = diags.Extend(reportRunAsNotSupported(
@@ -109,7 +109,7 @@ func validateRunAs(b *bundle.Bundle) diag.Diagnostics {
 			}
 			diags = diags.Extend(reportRunAsNotSupported(
 				"dashboards with embed_credentials set to true",
-				b.Config.GetLocation("resources.dashboards."+key),
+				b.Config.GetLocationOf(structpath.NewPath(nil, "resources", "dashboards", key)),
 				b.Config.Workspace.CurrentUser.UserName,
 				identity,
 			))
@@ -141,6 +141,7 @@ func setRunAsForJobs(b *bundle.Bundle) {
 			continue
 		}
 		job.RunAs = &jobs.JobRunAs{
+			GroupName:            runAs.GroupName,
 			ServicePrincipalName: runAs.ServicePrincipalName,
 			UserName:             runAs.UserName,
 		}
@@ -159,6 +160,7 @@ func setRunAsForPipelines(b *bundle.Bundle) {
 			continue
 		}
 		pipeline.RunAs = &pipelines.RunAs{
+			GroupName:            runAs.GroupName,
 			ServicePrincipalName: runAs.ServicePrincipalName,
 			UserName:             runAs.UserName,
 		}
@@ -228,13 +230,16 @@ func (m *setRunAs) Apply(_ context.Context, b *bundle.Bundle) diag.Diagnostics {
 	// User has opted to use the legacy behavior of run_as with the
 	// experimental.use_legacy_run_as flag.
 	if b.Config.Experimental != nil && b.Config.Experimental.UseLegacyRunAs {
+		if b.Config.Value().Get("run_as").Get("group_name").Kind() != dyn.KindInvalid {
+			return diag.Errorf("run_as.group_name is not supported with experimental.use_legacy_run_as; disable experimental.use_legacy_run_as to use a group identity")
+		}
 		setPipelineOwnersToRunAsIdentity(b)
 		setRunAsForJobs(b)
 		return diag.Diagnostics{
 			{
 				Severity:  diag.Warning,
 				Summary:   "You are using the legacy mode of run_as. The support for this mode is experimental and might be removed in a future release of the CLI. In order to run the pipelines in your DABs project as the run_as user this mode changes the owners of the pipelines to the run_as identity, which requires the user deploying the bundle to be a workspace admin, and also a Metastore admin if the pipeline target is in UC.",
-				Paths:     []dyn.Path{dyn.MustPathFromString("experimental.use_legacy_run_as")},
+				Paths:     structpath.NewPathSlice("experimental", "use_legacy_run_as"),
 				Locations: b.Config.GetLocations("experimental.use_legacy_run_as"),
 			},
 		}
diff --git a/bundle/config/mutator/resourcemutator/run_as_test.go b/bundle/config/mutator/resourcemutator/run_as_test.go
index 0b7003f5873..200939f2dd0 100644
--- a/bundle/config/mutator/resourcemutator/run_as_test.go
+++ b/bundle/config/mutator/resourcemutator/run_as_test.go
@@ -1,16 +1,21 @@
 package resourcemutator
 
 import (
+	"fmt"
+	"reflect"
 	"slices"
+	"strings"
 	"testing"
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/bundle/config"
 	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/cli/libs/dyn/convert"
 	"github.com/databricks/databricks-sdk-go/service/iam"
 	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/databricks/databricks-sdk-go/service/pipelines"
 	"github.com/databricks/databricks-sdk-go/service/sql"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -31,32 +36,49 @@ func allResourceTypes(t *testing.T) []string {
 	// Assert the total list of resource supported, as a sanity check that using
 	// the dyn library gives us the correct list of all resources supported. Please
 	// also update this check when adding a new resource
-	require.Equal(t, []string{
-		"alerts",
-		"apps",
-		"catalogs",
-		"clusters",
-		"dashboards",
-		"database_catalogs",
-		"database_instances",
-		"experiments",
-		"external_locations",
-		"jobs",
-		"model_serving_endpoints",
-		"models",
-		"pipelines",
-		"postgres_branches",
-		"postgres_endpoints",
-		"postgres_projects",
-		"quality_monitors",
-		"registered_models",
-		"schemas",
-		"secret_scopes",
-		"sql_warehouses",
-		"synced_database_tables",
-		"vector_search_endpoints",
-		"volumes",
-	},
+	require.Equal(
+		t, []string{
+			"alerts",
+			"apps",
+			"catalogs",
+			"cluster_policies",
+			"clusters",
+			"dashboards",
+			"database_catalogs",
+			"database_instances",
+			"experiments",
+			"external_locations",
+			"features",
+			"genie_spaces",
+			"instance_pools",
+			"internal_immutable_snapshots",
+			"job_runs",
+			"jobs",
+			"mcp_services",
+			"model_provider_services",
+			"model_services",
+			"model_serving_endpoints",
+			"models",
+			"pipelines",
+			"postgres_branches",
+			"postgres_catalogs",
+			"postgres_databases",
+			"postgres_endpoints",
+			"postgres_projects",
+			"postgres_roles",
+			"postgres_snapshot_schedules",
+			"postgres_synced_tables",
+			"quality_monitors",
+			"registered_models",
+			"schemas",
+			"secret_scopes",
+			"secrets",
+			"sql_warehouses",
+			"synced_database_tables",
+			"vector_search_endpoints",
+			"vector_search_indexes",
+			"volumes",
+		},
 		resourceTypes,
 	)
 
@@ -144,8 +166,7 @@ func TestRunAsWorksForAllowedResources(t *testing.T) {
 // two conditions:
 //  1. The resource supports setting a run_as identity to a different user
 //     from the owner/creator of the resource. For example, jobs.
-//  2. Run as semantics do not apply to the resource. We do not plan to add
-//     platform side support for `run_as` for these resources. For example,
+//  2. Run as semantics do not apply to the resource's current API. For example,
 //     experiments or registered models.
 //
 // Any resource that is not on the allow list cannot be used when the bundle
@@ -153,18 +174,14 @@ func TestRunAsWorksForAllowedResources(t *testing.T) {
 // return an error if such a resource has been defined, and the run_as identity
 // is different from the current deployment identity.
 //
-// Action Item: If you are adding a new resource to DABs, please check in with
-// the relevant owning team whether the resource should be on the allow list or (implicitly) on
-// the deny list. Any resources that could have run_as semantics in the future
-// should be on the deny list.
-// For example: Teams for pipelines, model serving endpoints or Lakeview dashboards
-// are planning to add platform side support for `run_as` for these resources at
-// some point in the future. These resources are (implicitly) on the deny list, since
-// they are not on the allow list below.
+// If a resource gains run_as support, review this list and the group support
+// classification below. Model serving endpoints are excluded. Dashboards are
+// allowed when embed_credentials is false and rejected otherwise.
 var allowList = []string{
 	"alerts",
 	"catalogs",
 	"clusters",
+	"cluster_policies",
 	"dashboards",
 	"database_catalogs",
 	"database_instances",
@@ -173,18 +190,102 @@ var allowList = []string{
 	"jobs",
 	"pipelines",
 	"models",
+	"model_services",
+	"mcp_services",
+	"model_provider_services",
 	"postgres_branches",
+	"postgres_catalogs",
+	"postgres_databases",
 	"postgres_endpoints",
 	"postgres_projects",
+	"postgres_roles",
+	"postgres_snapshot_schedules",
+	"postgres_synced_tables",
 	"registered_models",
 	"experiments",
+	"features",
+	"genie_spaces",
+	"instance_pools",
+	"job_runs",
+	"internal_immutable_snapshots",
 	"schemas",
 	"secret_scopes",
+	"secrets",
 	"sql_warehouses",
 	"vector_search_endpoints",
+	"vector_search_indexes",
 	"volumes",
 }
 
+type groupRunAsSupport int
+
+const (
+	groupRunAsUnsupported groupRunAsSupport = iota
+	groupRunAsSupported
+)
+
+// Classify every resource type that exposes a run_as field.
+var groupRunAsSupportByResource = map[string]groupRunAsSupport{
+	"alerts":    groupRunAsUnsupported,
+	"jobs":      groupRunAsSupported,
+	"pipelines": groupRunAsSupported,
+}
+
+func TestRunAsGroupSupportClassification(t *testing.T) {
+	actual := make(map[string]groupRunAsSupport)
+	resourceTypes := reflect.TypeFor[config.Resources]()
+	for field := range resourceTypes.Fields() {
+		require.Equal(t, reflect.Map, field.Type.Kind(), field.Name)
+		require.Equal(t, reflect.Pointer, field.Type.Elem().Kind(), field.Name)
+		resourceType := field.Type.Elem().Elem()
+		runAsField, ok := resourceType.FieldByName("RunAs")
+		if !ok {
+			continue
+		}
+
+		name, _, _ := strings.Cut(field.Tag.Get("json"), ",")
+		require.Equal(t, reflect.Pointer, runAsField.Type.Kind(), name)
+		runAsType := runAsField.Type.Elem()
+		require.Equal(t, reflect.Struct, runAsType.Kind(), name)
+		support := groupRunAsUnsupported
+		if _, ok := runAsType.FieldByName("GroupName"); ok {
+			support = groupRunAsSupported
+		}
+		actual[name] = support
+	}
+
+	require.Equal(t, groupRunAsSupportByResource, actual)
+}
+
+func TestRunAsGroupSupportBehavior(t *testing.T) {
+	for resourceType, support := range groupRunAsSupportByResource {
+		t.Run(resourceType, func(t *testing.T) {
+			yaml := fmt.Sprintf("run_as: {group_name: group}\nworkspace: {current_user: {userName: deployer}}\nresources:\n  %s: {test: {}}\n", resourceType)
+			r, diags := config.LoadFromBytes("databricks.yml", []byte(yaml))
+			require.NoError(t, diags.Error())
+			b := &bundle.Bundle{Config: *r}
+			diags = bundle.Apply(t.Context(), b, SetRunAs())
+
+			switch support {
+			case groupRunAsUnsupported:
+				require.ErrorContains(t, diags.Error(), "run_as.group_name")
+			case groupRunAsSupported:
+				require.NoError(t, diags.Error())
+				switch resourceType {
+				case "jobs":
+					assert.Equal(t, "group", b.Config.Resources.Jobs["test"].RunAs.GroupName)
+				case "pipelines":
+					assert.Equal(t, "group", b.Config.Resources.Pipelines["test"].RunAs.GroupName)
+				default:
+					t.Fatalf("add a group propagation assertion for %s", resourceType)
+				}
+			default:
+				t.Fatalf("unknown group run_as support level for %s", resourceType)
+			}
+		})
+	}
+}
+
 func TestRunAsErrorForUnsupportedResources(t *testing.T) {
 	base := config.Root{
 		Workspace: config.Workspace{
@@ -289,3 +390,132 @@ func TestRunAsNoErrorForSupportedResources(t *testing.T) {
 		require.NoError(t, diags.Error())
 	}
 }
+
+func TestRunAsIdentities(t *testing.T) {
+	for _, tc := range []struct {
+		runAs     string
+		wantError bool
+	}{
+		{`null`, true},
+		{`{}`, true},
+		{`{user_name: ""}`, true},
+		{`{service_principal_name: ""}`, true},
+		{`{group_name: ""}`, true},
+		{`{user_name: user}`, false},
+		{`{service_principal_name: sp}`, false},
+		{`{group_name: group}`, false},
+		{`{user_name: "", service_principal_name: "", group_name: ""}`, true},
+		{`{user_name: "", service_principal_name: "", group_name: group}`, false},
+		{`{user_name: user, service_principal_name: sp}`, true},
+		{`{user_name: user, group_name: group}`, true},
+		{`{service_principal_name: sp, group_name: group}`, true},
+		{`{user_name: user, service_principal_name: sp, group_name: group}`, true},
+	} {
+		t.Run(tc.runAs, func(t *testing.T) {
+			yaml := "workspace: {current_user: {userName: deployer}}\nrun_as: " + tc.runAs
+			r, diags := config.LoadFromBytes("databricks.yml", []byte(yaml))
+			require.NoError(t, diags.Error())
+			b := &bundle.Bundle{Config: *r}
+			diags = bundle.Apply(t.Context(), b, SetRunAs())
+			if tc.wantError {
+				require.ErrorContains(t, diags.Error(), "run_as section must specify exactly one non-empty identity: user_name, service_principal_name, or group_name")
+				assert.Equal(t, []diag.Location{r.GetLocation("run_as")}, diags[0].Locations)
+			} else {
+				require.NoError(t, diags.Error())
+			}
+		})
+	}
+}
+
+func TestRunAsLegacyGroup(t *testing.T) {
+	for _, runAs := range []string{`{group_name: group}`, `{group_name: ""}`} {
+		t.Run(runAs, func(t *testing.T) {
+			yaml := "workspace: {current_user: {userName: deployer}}\nexperimental: {use_legacy_run_as: true}\nrun_as: " + runAs
+			r, diags := config.LoadFromBytes("databricks.yml", []byte(yaml))
+			require.NoError(t, diags.Error())
+			b := &bundle.Bundle{Config: *r}
+			diags = bundle.Apply(t.Context(), b, SetRunAs())
+			require.ErrorContains(t, diags.Error(), "run_as.group_name is not supported with experimental.use_legacy_run_as")
+		})
+	}
+}
+
+func TestRunAsGroupResources(t *testing.T) {
+	for _, tc := range []struct {
+		name      string
+		resource  string
+		wantError string
+	}{
+		{name: "alert", resource: `alerts: {test: {}}`, wantError: "alerts do not support run_as.group_name"},
+		{name: "model serving", resource: `model_serving_endpoints: {test: {}}`, wantError: "Run as identity: group \"group\""},
+		{name: "alert sp override", resource: `alerts: {test: {run_as: {service_principal_name: sp}}}`},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			yaml := "run_as: {group_name: group}\nworkspace: {current_user: {userName: group}}\nresources:\n  " + tc.resource
+			r, diags := config.LoadFromBytes("databricks.yml", []byte(yaml))
+			require.NoError(t, diags.Error())
+			b := &bundle.Bundle{Config: *r}
+			before := b.Config.Value().Get("resources")
+			diags = bundle.Apply(t.Context(), b, SetRunAs())
+			if tc.wantError != "" {
+				require.Error(t, diags.Error())
+				assert.Contains(t, diags.Error().Error(), tc.wantError)
+			} else {
+				require.NoError(t, diags.Error())
+				assert.Equal(t, before, b.Config.Value().Get("resources"))
+			}
+		})
+	}
+}
+
+func TestRunAsGroupInheritance(t *testing.T) {
+	for _, tc := range []struct {
+		name   string
+		root   string
+		target string
+		want   jobs.JobRunAs
+	}{
+		{name: "root group", root: `{group_name: group}`, target: `{}`, want: jobs.JobRunAs{GroupName: "group"}},
+		{name: "target group replaces user", root: `{user_name: user}`, target: `{run_as: {group_name: group}}`, want: jobs.JobRunAs{GroupName: "group"}},
+		{name: "target user replaces group", root: `{group_name: group}`, target: `{run_as: {user_name: user}}`, want: jobs.JobRunAs{UserName: "user"}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			yaml := fmt.Sprintf(`
+workspace: {current_user: {userName: deployer}}
+run_as: %s
+targets:
+  test: %s
+resources:
+  jobs:
+    inherited: {}
+    user: {run_as: {user_name: other_user}}
+    sp: {run_as: {service_principal_name: other_sp}}
+    group: {run_as: {group_name: other_group}}
+  pipelines:
+    inherited: {}
+    user: {run_as: {user_name: other_user}}
+    sp: {run_as: {service_principal_name: other_sp}}
+    group: {run_as: {group_name: other_group}}
+`, tc.root, tc.target)
+			r, diags := config.LoadFromBytes("databricks.yml", []byte(yaml))
+			require.NoError(t, diags.Error())
+			require.NoError(t, r.MergeTargetOverrides("test"))
+			b := &bundle.Bundle{Config: *r}
+			diags = bundle.Apply(t.Context(), b, SetRunAs())
+			require.NoError(t, diags.Error())
+			assert.Equal(t, &tc.want, b.Config.RunAs)
+			assert.Equal(t, &tc.want, b.Config.Resources.Jobs["inherited"].RunAs)
+			assert.Equal(t, &jobs.JobRunAs{UserName: "other_user"}, b.Config.Resources.Jobs["user"].RunAs)
+			assert.Equal(t, &jobs.JobRunAs{ServicePrincipalName: "other_sp"}, b.Config.Resources.Jobs["sp"].RunAs)
+			assert.Equal(t, &jobs.JobRunAs{GroupName: "other_group"}, b.Config.Resources.Jobs["group"].RunAs)
+			assert.Equal(t, &pipelines.RunAs{
+				GroupName:            tc.want.GroupName,
+				ServicePrincipalName: tc.want.ServicePrincipalName,
+				UserName:             tc.want.UserName,
+			}, b.Config.Resources.Pipelines["inherited"].RunAs)
+			assert.Equal(t, &pipelines.RunAs{UserName: "other_user"}, b.Config.Resources.Pipelines["user"].RunAs)
+			assert.Equal(t, &pipelines.RunAs{ServicePrincipalName: "other_sp"}, b.Config.Resources.Pipelines["sp"].RunAs)
+			assert.Equal(t, &pipelines.RunAs{GroupName: "other_group"}, b.Config.Resources.Pipelines["group"].RunAs)
+		})
+	}
+}
diff --git a/bundle/config/mutator/resourcemutator/secret_scope_fixups.go b/bundle/config/mutator/resourcemutator/secret_scope_fixups.go
index e85584da3f0..8404d2444eb 100644
--- a/bundle/config/mutator/resourcemutator/secret_scope_fixups.go
+++ b/bundle/config/mutator/resourcemutator/secret_scope_fixups.go
@@ -7,20 +7,17 @@ import (
 	"strings"
 
 	"github.com/databricks/cli/bundle"
-	"github.com/databricks/cli/bundle/config/engine"
 	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/cli/libs/diag"
-	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/cli/libs/iamutil"
+	"github.com/databricks/cli/libs/structs/structpath"
 	"github.com/databricks/databricks-sdk-go/service/iam"
 )
 
-type secretScopeFixups struct {
-	engine engine.EngineType
-}
+type secretScopeFixups struct{}
 
-func SecretScopeFixups(engine engine.EngineType) bundle.Mutator {
-	return &secretScopeFixups{engine: engine}
+func SecretScopeFixups() bundle.Mutator {
+	return &secretScopeFixups{}
 }
 
 func (m *secretScopeFixups) Name() string {
@@ -123,12 +120,6 @@ func collapsePermissions(scope *resources.SecretScope) error {
 func (m *secretScopeFixups) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
 	// Secret scopes by default have the current user as a MANAGE ACL. We need to add it to the client ACL list
 	// to prevent a phantom persistent diff.
-	// We do not need to do this in terraform because terraform naively always applies the config during ACL
-	// creation without checking if the ACL already exists.
-	// https://github.com/databricks/terraform-provider-databricks/blob/5cb5d3fa46bc4843be1a4c4bce89296eaa2e14fc/secrets/resource_secret_acl.go#L43
-	if !m.engine.IsDirect() {
-		return nil
-	}
 
 	// Secret scopes assigns the create MANAGE ACL on it by default. So we always add it to
 	// the client ACL list as a default.
@@ -147,8 +138,8 @@ func (m *secretScopeFixups) Apply(ctx context.Context, b *bundle.Bundle) diag.Di
 					Severity:  diag.Error,
 					Summary:   "Failed to collapse permissions for secret scope",
 					Detail:    err.Error(),
-					Paths:     []dyn.Path{dyn.MustPathFromString("resources.secret_scopes." + key)},
-					Locations: []dyn.Location{b.Config.GetLocation("resources.secret_scopes." + key)},
+					Paths:     structpath.NewPathSlice("resources", "secret_scopes", key),
+					Locations: []diag.Location{b.Config.GetLocationOf(structpath.NewPath(nil, "resources", "secret_scopes", key))},
 				},
 			}
 		}
diff --git a/bundle/config/mutator/resourcemutator/secret_scope_fixups_test.go b/bundle/config/mutator/resourcemutator/secret_scope_fixups_test.go
index 174a8d83efd..24cd7aa06a1 100644
--- a/bundle/config/mutator/resourcemutator/secret_scope_fixups_test.go
+++ b/bundle/config/mutator/resourcemutator/secret_scope_fixups_test.go
@@ -245,9 +245,9 @@ func TestAddManageForCurrentUser(t *testing.T) {
 			assert.ElementsMatch(t, tt.expectedPerms, scope.Permissions)
 
 			if tt.shouldAddNewPerm {
-				assert.Equal(t, initialCount+1, len(scope.Permissions))
+				assert.Len(t, scope.Permissions, initialCount+1)
 			} else {
-				assert.Equal(t, initialCount, len(scope.Permissions))
+				assert.Len(t, scope.Permissions, initialCount)
 			}
 		})
 	}
diff --git a/bundle/config/mutator/resourcemutator/validate_target_mode.go b/bundle/config/mutator/resourcemutator/validate_target_mode.go
index 190c60c9b98..bf6386264ad 100644
--- a/bundle/config/mutator/resourcemutator/validate_target_mode.go
+++ b/bundle/config/mutator/resourcemutator/validate_target_mode.go
@@ -5,11 +5,11 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/cli/libs/iamutil"
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/cli/libs/diag"
 )
 
@@ -55,7 +55,7 @@ func validateDevelopmentMode(b *bundle.Bundle) diag.Diagnostics {
 		diags = diags.Append(diag.Diagnostic{
 			Severity:  diag.Error,
 			Summary:   "target with 'mode: development' cannot set trigger pause status to UNPAUSED by default",
-			Locations: []dyn.Location{b.Config.GetLocation("presets.trigger_pause_status")},
+			Locations: []diag.Location{b.Config.GetLocation("presets.trigger_pause_status")},
 		})
 	}
 
@@ -77,7 +77,7 @@ func validateDevelopmentMode(b *bundle.Bundle) diag.Diagnostics {
 		diags = diags.Append(diag.Diagnostic{
 			Severity:  diag.Error,
 			Summary:   "prefix should contain the current username or ${workspace.current_user.short_name} to ensure uniqueness when using 'mode: development'",
-			Locations: []dyn.Location{b.Config.GetLocation("presets.name_prefix")},
+			Locations: []diag.Location{b.Config.GetLocation("presets.name_prefix")},
 		})
 	}
 	return diags
@@ -98,28 +98,36 @@ func namePrefixContainsUserIdentifier(prefix string, u *config.User) bool {
 	return false
 }
 
+// isNonUserPath reports whether path is set and is not unique to the current user.
+func isNonUserPath(path string, u *config.User) bool {
+	if path == "" {
+		return false
+	}
+	// Immutable folder snapshot paths are already unique per deployment: they are
+	// keyed by a hash of state_path (which is checked separately) and the content hash.
+	if strings.HasPrefix(path, resources.SnapshotFullPathRef) {
+		return false
+	}
+	return !strings.Contains(path, u.UserName) && !strings.Contains(path, u.ShortName)
+}
+
 // findNonUserPath finds the first workspace path such as root_path that doesn't
 // contain the current username or current user's shortname.
 func findNonUserPath(b *bundle.Bundle) string {
-	containsName := func(path string) bool {
-		username := b.Config.Workspace.CurrentUser.UserName
-		shortname := b.Config.Workspace.CurrentUser.ShortName
-		return strings.Contains(path, username) || strings.Contains(path, shortname)
-	}
-
-	if b.Config.Workspace.RootPath != "" && !containsName(b.Config.Workspace.RootPath) {
+	u := b.Config.Workspace.CurrentUser
+	if isNonUserPath(b.Config.Workspace.RootPath, u) {
 		return "root_path"
 	}
-	if b.Config.Workspace.FilePath != "" && !containsName(b.Config.Workspace.FilePath) {
+	if isNonUserPath(b.Config.Workspace.FilePath, u) {
 		return "file_path"
 	}
-	if b.Config.Workspace.ResourcePath != "" && !containsName(b.Config.Workspace.ResourcePath) {
+	if isNonUserPath(b.Config.Workspace.ResourcePath, u) {
 		return "resource_path"
 	}
-	if b.Config.Workspace.ArtifactPath != "" && !containsName(b.Config.Workspace.ArtifactPath) {
+	if isNonUserPath(b.Config.Workspace.ArtifactPath, u) {
 		return "artifact_path"
 	}
-	if b.Config.Workspace.StatePath != "" && !containsName(b.Config.Workspace.StatePath) {
+	if isNonUserPath(b.Config.Workspace.StatePath, u) {
 		return "state_path"
 	}
 	return ""
@@ -128,6 +136,7 @@ func findNonUserPath(b *bundle.Bundle) string {
 func validateProductionMode(b *bundle.Bundle, isPrincipalUsed bool) diag.Diagnostics {
 	r := b.Config.Resources
 	for i := range r.Pipelines {
+		//nolint:staticcheck // SA1019: pipeline development is deprecated in the SDK but remains a supported bundle config field
 		if r.Pipelines[i].Development {
 			return diag.Errorf("target with 'mode: production' cannot include a pipeline with 'development: true'")
 		}
diff --git a/bundle/config/mutator/resourcemutator/validate_target_mode_test.go b/bundle/config/mutator/resourcemutator/validate_target_mode_test.go
index bf82773d9e5..ce361de2d80 100644
--- a/bundle/config/mutator/resourcemutator/validate_target_mode_test.go
+++ b/bundle/config/mutator/resourcemutator/validate_target_mode_test.go
@@ -21,7 +21,7 @@ func TestValidateProductionPipelines(t *testing.T) {
 				Pipelines: map[string]*resources.Pipeline{
 					"pipeline": {
 						CreatePipeline: pipelines.CreatePipeline{
-							Development: true,
+							Development: true, //nolint:staticcheck // SA1019: pipeline development is deprecated in the SDK but remains a supported bundle config field
 						},
 					},
 				},
@@ -101,7 +101,7 @@ func TestProcessTargetModeProduction(t *testing.T) {
 
 	assert.Equal(t, "job1", b.Config.Resources.Jobs["job1"].Name)
 	assert.Equal(t, "pipeline1", b.Config.Resources.Pipelines["pipeline1"].Name)
-	assert.False(t, b.Config.Resources.Pipelines["pipeline1"].Development)
+	assert.False(t, b.Config.Resources.Pipelines["pipeline1"].Development) //nolint:staticcheck // SA1019: pipeline development is deprecated in the SDK but remains a supported bundle config field
 	assert.Equal(t, "servingendpoint1", b.Config.Resources.ModelServingEndpoints["servingendpoint1"].Name)
 	assert.Equal(t, "registeredmodel1", b.Config.Resources.RegisteredModels["registeredmodel1"].Name)
 	assert.Equal(t, "qualityMonitor1", b.Config.Resources.QualityMonitors["qualityMonitor1"].TableName)
@@ -168,6 +168,13 @@ func TestValidateDevelopmentMode(t *testing.T) {
 	diags = validateDevelopmentMode(b)
 	require.ErrorContains(t, diags.Error(), "root_path must start with '~/' or contain the current username to ensure uniqueness when using 'mode: development'")
 
+	// Test with immutable folder snapshot paths
+	b = mockBundle(config.Development)
+	b.Config.Workspace.FilePath = resources.SnapshotFullPathRef + "/files"
+	b.Config.Workspace.ArtifactPath = resources.SnapshotFullPathRef + "/artifacts"
+	diags = validateDevelopmentMode(b)
+	require.NoError(t, diags.Error())
+
 	// Test with a bundle that has an unpaused trigger pause status
 	b = mockBundle(config.Development)
 	b.Config.Presets.TriggerPauseStatus = config.Unpaused
diff --git a/bundle/config/mutator/rewrite_sync_paths_test.go b/bundle/config/mutator/rewrite_sync_paths_test.go
index 2b9d291ddd8..e01b5cc8eee 100644
--- a/bundle/config/mutator/rewrite_sync_paths_test.go
+++ b/bundle/config/mutator/rewrite_sync_paths_test.go
@@ -8,7 +8,7 @@ import (
 	"github.com/databricks/cli/bundle/config"
 	"github.com/databricks/cli/bundle/config/mutator"
 	"github.com/databricks/cli/bundle/internal/bundletest"
-	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/diag"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -33,12 +33,12 @@ func TestRewriteSyncPathsRelative(t *testing.T) {
 		},
 	}
 
-	bundletest.SetLocation(b, "sync.paths[0]", []dyn.Location{{File: "./databricks.yml"}})
-	bundletest.SetLocation(b, "sync.paths[1]", []dyn.Location{{File: "./databricks.yml"}})
-	bundletest.SetLocation(b, "sync.include[0]", []dyn.Location{{File: "./file.yml"}})
-	bundletest.SetLocation(b, "sync.include[1]", []dyn.Location{{File: "./a/file.yml"}})
-	bundletest.SetLocation(b, "sync.exclude[0]", []dyn.Location{{File: "./a/b/file.yml"}})
-	bundletest.SetLocation(b, "sync.exclude[1]", []dyn.Location{{File: "./a/b/c/file.yml"}})
+	bundletest.SetLocation(b, "sync.paths[0]", []diag.Location{{File: "./databricks.yml"}})
+	bundletest.SetLocation(b, "sync.paths[1]", []diag.Location{{File: "./databricks.yml"}})
+	bundletest.SetLocation(b, "sync.include[0]", []diag.Location{{File: "./file.yml"}})
+	bundletest.SetLocation(b, "sync.include[1]", []diag.Location{{File: "./a/file.yml"}})
+	bundletest.SetLocation(b, "sync.exclude[0]", []diag.Location{{File: "./a/b/file.yml"}})
+	bundletest.SetLocation(b, "sync.exclude[1]", []diag.Location{{File: "./a/b/c/file.yml"}})
 
 	diags := bundle.Apply(t.Context(), b, mutator.RewriteSyncPaths())
 	assert.NoError(t, diags.Error())
@@ -72,12 +72,12 @@ func TestRewriteSyncPathsAbsolute(t *testing.T) {
 		},
 	}
 
-	bundletest.SetLocation(b, "sync.paths[0]", []dyn.Location{{File: "/tmp/dir/databricks.yml"}})
-	bundletest.SetLocation(b, "sync.paths[1]", []dyn.Location{{File: "/tmp/dir/databricks.yml"}})
-	bundletest.SetLocation(b, "sync.include[0]", []dyn.Location{{File: "/tmp/dir/file.yml"}})
-	bundletest.SetLocation(b, "sync.include[1]", []dyn.Location{{File: "/tmp/dir/a/file.yml"}})
-	bundletest.SetLocation(b, "sync.exclude[0]", []dyn.Location{{File: "/tmp/dir/a/b/file.yml"}})
-	bundletest.SetLocation(b, "sync.exclude[1]", []dyn.Location{{File: "/tmp/dir/a/b/c/file.yml"}})
+	bundletest.SetLocation(b, "sync.paths[0]", []diag.Location{{File: "/tmp/dir/databricks.yml"}})
+	bundletest.SetLocation(b, "sync.paths[1]", []diag.Location{{File: "/tmp/dir/databricks.yml"}})
+	bundletest.SetLocation(b, "sync.include[0]", []diag.Location{{File: "/tmp/dir/file.yml"}})
+	bundletest.SetLocation(b, "sync.include[1]", []diag.Location{{File: "/tmp/dir/a/file.yml"}})
+	bundletest.SetLocation(b, "sync.exclude[0]", []diag.Location{{File: "/tmp/dir/a/b/file.yml"}})
+	bundletest.SetLocation(b, "sync.exclude[1]", []diag.Location{{File: "/tmp/dir/a/b/c/file.yml"}})
 
 	diags := bundle.Apply(t.Context(), b, mutator.RewriteSyncPaths())
 	assert.NoError(t, diags.Error())
diff --git a/bundle/config/mutator/rewrite_workspace_prefix.go b/bundle/config/mutator/rewrite_workspace_prefix.go
index e66482f8e55..30914fd149e 100644
--- a/bundle/config/mutator/rewrite_workspace_prefix.go
+++ b/bundle/config/mutator/rewrite_workspace_prefix.go
@@ -24,15 +24,24 @@ func (m *rewriteWorkspacePrefix) Name() string {
 
 func (m *rewriteWorkspacePrefix) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
 	diags := diag.Diagnostics{}
-	paths := map[string]string{
-		"/Workspace/${workspace.root_path}":     "${workspace.root_path}",
-		"/Workspace${workspace.root_path}":      "${workspace.root_path}",
-		"/Workspace/${workspace.file_path}":     "${workspace.file_path}",
-		"/Workspace${workspace.file_path}":      "${workspace.file_path}",
-		"/Workspace/${workspace.artifact_path}": "${workspace.artifact_path}",
-		"/Workspace${workspace.artifact_path}":  "${workspace.artifact_path}",
-		"/Workspace/${workspace.state_path}":    "${workspace.state_path}",
-		"/Workspace${workspace.state_path}":     "${workspace.state_path}",
+	// The patterns must cover every path that PrependWorkspacePrefix prefixes,
+	// otherwise interpolation produces a doubled "/Workspace/Workspace/..." path.
+	// A slice (not a map) keeps the rewrite and warning order deterministic when
+	// multiple patterns occur in the same string.
+	paths := []struct {
+		pattern     string
+		replacement string
+	}{
+		{"/Workspace/${workspace.root_path}", "${workspace.root_path}"},
+		{"/Workspace${workspace.root_path}", "${workspace.root_path}"},
+		{"/Workspace/${workspace.file_path}", "${workspace.file_path}"},
+		{"/Workspace${workspace.file_path}", "${workspace.file_path}"},
+		{"/Workspace/${workspace.artifact_path}", "${workspace.artifact_path}"},
+		{"/Workspace${workspace.artifact_path}", "${workspace.artifact_path}"},
+		{"/Workspace/${workspace.state_path}", "${workspace.state_path}"},
+		{"/Workspace${workspace.state_path}", "${workspace.state_path}"},
+		{"/Workspace/${workspace.resource_path}", "${workspace.resource_path}"},
+		{"/Workspace${workspace.resource_path}", "${workspace.resource_path}"},
 	}
 
 	err := b.Config.Mutate(func(root dyn.Value) (dyn.Value, error) {
@@ -44,23 +53,28 @@ func (m *rewriteWorkspacePrefix) Apply(ctx context.Context, b *bundle.Bundle) di
 				return v, nil
 			}
 
-			for path, replacePath := range paths {
-				if strings.Contains(vv, path) {
-					newPath := strings.Replace(vv, path, replacePath, 1)
-					diags = append(diags, diag.Diagnostic{
-						Severity:  diag.Warning,
-						Summary:   fmt.Sprintf("substring %q found in %q. Please update this to %q.", path, vv, newPath),
-						Detail:    "For more information, please refer to: https://docs.databricks.com/en/release-notes/dev-tools/bundles.html#workspace-paths",
-						Locations: v.Locations(),
-						Paths:     []dyn.Path{p},
-					})
-
-					// Remove the workspace prefix from the string.
-					return dyn.NewValue(newPath, v.Locations()), nil
+			newPath := vv
+			for _, rewrite := range paths {
+				if !strings.Contains(newPath, rewrite.pattern) {
+					continue
 				}
+
+				newPath = strings.ReplaceAll(newPath, rewrite.pattern, rewrite.replacement)
+				diags = append(diags, diag.Diagnostic{
+					Severity:  diag.Warning,
+					Summary:   fmt.Sprintf("substring %q found in %q. Please update this to %q.", rewrite.pattern, vv, newPath),
+					Detail:    "For more information, please refer to: https://docs.databricks.com/en/release-notes/dev-tools/bundles.html#workspace-paths",
+					Locations: v.Locations(),
+					Paths:     dyn.ToStructPaths(p),
+				})
+			}
+
+			if newPath == vv {
+				return v, nil
 			}
 
-			return v, nil
+			// Remove the workspace prefix from the string.
+			return dyn.NewValue(newPath, v.Locations()), nil
 		})
 	})
 	if err != nil {
diff --git a/bundle/config/mutator/rewrite_workspace_prefix_test.go b/bundle/config/mutator/rewrite_workspace_prefix_test.go
index 3a51b211bc4..885d8dc2241 100644
--- a/bundle/config/mutator/rewrite_workspace_prefix_test.go
+++ b/bundle/config/mutator/rewrite_workspace_prefix_test.go
@@ -20,6 +20,7 @@ func TestNoWorkspacePrefixUsed(t *testing.T) {
 				ArtifactPath: "/Workspace/Users/test/artifacts",
 				FilePath:     "/Workspace/Users/test/files",
 				StatePath:    "/Workspace/Users/test/state",
+				ResourcePath: "/Workspace/Users/test/resources",
 			},
 
 			Resources: config.Resources{
@@ -52,6 +53,25 @@ func TestNoWorkspacePrefixUsed(t *testing.T) {
 										},
 									},
 								},
+								{
+									NotebookTask: &jobs.NotebookTask{
+										NotebookPath: "/Workspace/${workspace.resource_path}/notebook3",
+									},
+									Libraries: []compute.Library{
+										{
+											Jar: "/Workspace${workspace.resource_path}/jar3.jar",
+										},
+									},
+								},
+								{
+									SparkPythonTask: &jobs.SparkPythonTask{
+										PythonFile: "${workspace.file_path}/file2.py",
+										Parameters: []string{
+											"--input=/Workspace/${workspace.file_path}/in.txt --output=/Workspace/${workspace.file_path}/out.txt",
+											"--cp=/Workspace/${workspace.root_path}/lib.jar:/Workspace${workspace.artifact_path}/dep.jar",
+										},
+									},
+								},
 							},
 						},
 					},
@@ -61,12 +81,17 @@ func TestNoWorkspacePrefixUsed(t *testing.T) {
 	}
 
 	diags := bundle.Apply(t.Context(), b, RewriteWorkspacePrefix())
-	require.Len(t, diags, 3)
+	require.Len(t, diags, 8)
 
 	expectedErrors := map[string]bool{
-		`substring "/Workspace/${workspace.root_path}" found in "/Workspace/${workspace.root_path}/file1.py". Please update this to "${workspace.root_path}/file1.py".`:             true,
-		`substring "/Workspace${workspace.file_path}" found in "/Workspace${workspace.file_path}/notebook1". Please update this to "${workspace.file_path}/notebook1".`:             true,
-		`substring "/Workspace/${workspace.artifact_path}" found in "/Workspace/${workspace.artifact_path}/jar1.jar". Please update this to "${workspace.artifact_path}/jar1.jar".`: true,
+		`substring "/Workspace/${workspace.root_path}" found in "/Workspace/${workspace.root_path}/file1.py". Please update this to "${workspace.root_path}/file1.py".`:                                                                                                        true,
+		`substring "/Workspace${workspace.file_path}" found in "/Workspace${workspace.file_path}/notebook1". Please update this to "${workspace.file_path}/notebook1".`:                                                                                                        true,
+		`substring "/Workspace/${workspace.artifact_path}" found in "/Workspace/${workspace.artifact_path}/jar1.jar". Please update this to "${workspace.artifact_path}/jar1.jar".`:                                                                                            true,
+		`substring "/Workspace/${workspace.resource_path}" found in "/Workspace/${workspace.resource_path}/notebook3". Please update this to "${workspace.resource_path}/notebook3".`:                                                                                          true,
+		`substring "/Workspace${workspace.resource_path}" found in "/Workspace${workspace.resource_path}/jar3.jar". Please update this to "${workspace.resource_path}/jar3.jar".`:                                                                                              true,
+		`substring "/Workspace/${workspace.file_path}" found in "--input=/Workspace/${workspace.file_path}/in.txt --output=/Workspace/${workspace.file_path}/out.txt". Please update this to "--input=${workspace.file_path}/in.txt --output=${workspace.file_path}/out.txt".`: true,
+		`substring "/Workspace/${workspace.root_path}" found in "--cp=/Workspace/${workspace.root_path}/lib.jar:/Workspace${workspace.artifact_path}/dep.jar". Please update this to "--cp=${workspace.root_path}/lib.jar:/Workspace${workspace.artifact_path}/dep.jar".`:      true,
+		`substring "/Workspace${workspace.artifact_path}" found in "--cp=/Workspace/${workspace.root_path}/lib.jar:/Workspace${workspace.artifact_path}/dep.jar". Please update this to "--cp=${workspace.root_path}/lib.jar:${workspace.artifact_path}/dep.jar".`:             true,
 	}
 
 	for _, d := range diags {
@@ -80,4 +105,9 @@ func TestNoWorkspacePrefixUsed(t *testing.T) {
 	require.Equal(t, "${workspace.artifact_path}/jar1.jar", b.Config.Resources.Jobs["test_job"].JobSettings.Tasks[1].Libraries[0].Jar)
 	require.Equal(t, "${workspace.file_path}/notebook2", b.Config.Resources.Jobs["test_job"].Tasks[2].NotebookTask.NotebookPath)
 	require.Equal(t, "${workspace.artifact_path}/jar2.jar", b.Config.Resources.Jobs["test_job"].JobSettings.Tasks[2].Libraries[0].Jar)
+	require.Equal(t, "${workspace.resource_path}/notebook3", b.Config.Resources.Jobs["test_job"].Tasks[3].NotebookTask.NotebookPath)
+	require.Equal(t, "${workspace.resource_path}/jar3.jar", b.Config.Resources.Jobs["test_job"].JobSettings.Tasks[3].Libraries[0].Jar)
+	require.Equal(t, "${workspace.file_path}/file2.py", b.Config.Resources.Jobs["test_job"].Tasks[4].SparkPythonTask.PythonFile)
+	require.Equal(t, "--input=${workspace.file_path}/in.txt --output=${workspace.file_path}/out.txt", b.Config.Resources.Jobs["test_job"].Tasks[4].SparkPythonTask.Parameters[0])
+	require.Equal(t, "--cp=${workspace.root_path}/lib.jar:${workspace.artifact_path}/dep.jar", b.Config.Resources.Jobs["test_job"].Tasks[4].SparkPythonTask.Parameters[1])
 }
diff --git a/bundle/config/mutator/set_variables.go b/bundle/config/mutator/set_variables.go
index 3038b05acaf..f8f3b35394c 100644
--- a/bundle/config/mutator/set_variables.go
+++ b/bundle/config/mutator/set_variables.go
@@ -45,7 +45,7 @@ func setVariable(ctx context.Context, v dyn.Value, variable *variable.Variable,
 
 		v, err := dyn.Set(v, "value", dyn.V(val))
 		if err != nil {
-			return dyn.InvalidValue, fmt.Errorf(`failed to assign value "%s" to variable %s from environment variable %s with error: %v`, val, name, envVarName, err)
+			return dyn.InvalidValue, fmt.Errorf(`failed to assign value "%s" to variable %s from environment variable %s with error: %v`, val, name, envVarName, err) //nolint:errorlint // runs inside dyn.Map, which drops wrapped no-such-key errors
 		}
 		return v, nil
 	}
@@ -70,7 +70,7 @@ func setVariable(ctx context.Context, v dyn.Value, variable *variable.Variable,
 
 		v, err := dyn.Set(v, "value", fileDefault)
 		if err != nil {
-			return dyn.InvalidValue, fmt.Errorf(`failed to assign default value from variable file to variable %s with error: %v`, name, err)
+			return dyn.InvalidValue, fmt.Errorf(`failed to assign default value from variable file to variable %s with error: %v`, name, err) //nolint:errorlint // runs inside dyn.Map, which drops wrapped no-such-key errors
 		}
 
 		return v, nil
@@ -80,12 +80,12 @@ func setVariable(ctx context.Context, v dyn.Value, variable *variable.Variable,
 	if variable.HasDefault() {
 		vDefault, err := dyn.Get(v, "default")
 		if err != nil {
-			return dyn.InvalidValue, fmt.Errorf(`failed to get default value from config "%s" for variable %s with error: %v`, variable.Default, name, err)
+			return dyn.InvalidValue, fmt.Errorf(`failed to get default value from config "%s" for variable %s with error: %v`, variable.Default, name, err) //nolint:errorlint // runs inside dyn.Map, which drops wrapped no-such-key errors
 		}
 
 		v, err := dyn.Set(v, "value", vDefault)
 		if err != nil {
-			return dyn.InvalidValue, fmt.Errorf(`failed to assign default value from config "%s" to variable %s with error: %v`, variable.Default, name, err)
+			return dyn.InvalidValue, fmt.Errorf(`failed to assign default value from config "%s" to variable %s with error: %v`, variable.Default, name, err) //nolint:errorlint // runs inside dyn.Map, which drops wrapped no-such-key errors
 		}
 		return v, nil
 	}
diff --git a/bundle/config/mutator/sync_infer_root.go b/bundle/config/mutator/sync_infer_root.go
index 373a3701dcc..bd1a529380a 100644
--- a/bundle/config/mutator/sync_infer_root.go
+++ b/bundle/config/mutator/sync_infer_root.go
@@ -7,7 +7,7 @@ import (
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/libs/diag"
-	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/structs/structpath"
 	"github.com/databricks/cli/libs/vfs"
 )
 
@@ -90,11 +90,12 @@ func (m *syncInferRoot) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagno
 			continue
 		}
 
+		syncPath := structpath.NewPath(nil, "sync", "paths", i)
 		diags = append(diags, diag.Diagnostic{
 			Severity:  diag.Error,
 			Summary:   fmt.Sprintf("invalid sync path %q", path),
-			Locations: b.Config.GetLocations(fmt.Sprintf("sync.paths[%d]", i)),
-			Paths:     []dyn.Path{dyn.NewPath(dyn.Key("sync"), dyn.Key("paths"), dyn.Index(i))},
+			Locations: b.Config.GetLocationsOf(syncPath),
+			Paths:     []*structpath.PathNode{syncPath},
 		})
 	}
 
diff --git a/bundle/config/mutator/sync_infer_root_test.go b/bundle/config/mutator/sync_infer_root_test.go
index c8f4a09c472..e34b4210bd6 100644
--- a/bundle/config/mutator/sync_infer_root_test.go
+++ b/bundle/config/mutator/sync_infer_root_test.go
@@ -8,7 +8,7 @@ import (
 	"github.com/databricks/cli/bundle/config"
 	"github.com/databricks/cli/bundle/config/mutator"
 	"github.com/databricks/cli/bundle/internal/bundletest"
-	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/diag"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -184,7 +184,7 @@ func TestSyncInferRoot_Error(t *testing.T) {
 		},
 	}
 
-	bundletest.SetLocation(b, "sync.paths", []dyn.Location{{File: "databricks.yml"}})
+	bundletest.SetLocation(b, "sync.paths", []diag.Location{{File: "databricks.yml"}})
 
 	ctx := t.Context()
 	diags := bundle.Apply(ctx, b, mutator.SyncInferRoot())
diff --git a/bundle/config/mutator/translate_paths.go b/bundle/config/mutator/translate_paths.go
index 99dd75dd787..f44c7235043 100644
--- a/bundle/config/mutator/translate_paths.go
+++ b/bundle/config/mutator/translate_paths.go
@@ -16,6 +16,7 @@ import (
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/cli/libs/notebook"
@@ -196,8 +197,7 @@ func (t *translateContext) rewritePath(
 
 func (t *translateContext) translateNotebookPath(ctx context.Context, literal, localFullPath, localRelPath string) (string, error) {
 	if t.skipLocalFileValidation {
-		localRelPathNoExt := strings.TrimSuffix(localRelPath, path.Ext(localRelPath))
-		return path.Join(t.remoteRoot, localRelPathNoExt), nil
+		return path.Join(t.remoteRoot, notebook.StripExtension(localRelPath)), nil
 	}
 
 	nb, _, err := notebook.DetectWithFS(t.b.SyncRoot, localRelPath)
@@ -229,9 +229,9 @@ to contain one of the following file extensions: [%s]`, literal, strings.Join(no
 		return "", ErrIsNotNotebook{localFullPath}
 	}
 
-	// Upon import, notebooks are stripped of their extension.
-	localRelPathNoExt := strings.TrimSuffix(localRelPath, path.Ext(localRelPath))
-	return path.Join(t.remoteRoot, localRelPathNoExt), nil
+	// Upon import, notebooks are stripped of their extension. Designer files
+	// keep their full ".designer.ipynb" suffix.
+	return path.Join(t.remoteRoot, notebook.StripExtension(localRelPath)), nil
 }
 
 func (t *translateContext) translateFilePath(ctx context.Context, literal, localFullPath, localRelPath string) (string, error) {
@@ -303,10 +303,10 @@ func (t *translateContext) translateLocalRelativeWithPrefixPath(ctx context.Cont
 func (t *translateContext) rewriteValue(ctx context.Context, p dyn.Path, v dyn.Value, dir string, opts translateOptions) (dyn.Value, error) {
 	out, err := t.rewritePath(ctx, dir, v.MustString(), opts)
 	if err != nil {
-		if target := (&ErrIsNotebook{}); errors.As(err, target) {
+		if target, ok := errors.AsType[ErrIsNotebook](err); ok {
 			return dyn.InvalidValue, fmt.Errorf(`expected a file for "%s" but got a notebook: %w`, p, target)
 		}
-		if target := (&ErrIsNotNotebook{}); errors.As(err, target) {
+		if target, ok := errors.AsType[ErrIsNotNotebook](err); ok {
 			return dyn.InvalidValue, fmt.Errorf(`expected a notebook for "%s" but got a file: %w`, p, target)
 		}
 		return dyn.InvalidValue, err
@@ -321,11 +321,22 @@ func (t *translateContext) rewriteValue(ctx context.Context, p dyn.Path, v dyn.V
 }
 
 func applyTranslations(ctx context.Context, b *bundle.Bundle, t *translateContext, translations []func(context.Context, dyn.Value) (dyn.Value, error)) diag.Diagnostics {
-	// Set the remote root to the sync root if source-linked deployment is enabled.
-	// Otherwise, set it to the workspace file path.
-	if config.IsExplicitlyEnabled(t.b.Config.Presets.SourceLinkedDeployment) {
+	switch {
+	case b.IsImmutableFolder():
+		// Reject an explicit workspace.file_path: immutable bundles set it
+		// automatically to the content-addressed snapshot location. A user-supplied
+		// value would be silently discarded during path translation, so we error early.
+		if loc := b.Config.GetLocation("workspace.file_path"); loc.File != "" {
+			return diag.Diagnostics{{
+				Severity:  diag.Error,
+				Summary:   "workspace.file_path cannot be configured when experimental.immutable_folder is enabled",
+				Locations: []diag.Location{loc},
+			}}
+		}
+		t.remoteRoot = resources.SnapshotFullPathRef + "/files"
+	case config.IsExplicitlyEnabled(t.b.Config.Presets.SourceLinkedDeployment):
 		t.remoteRoot = t.b.SyncRootPath
-	} else {
+	default:
 		t.remoteRoot = t.b.Config.Workspace.FilePath
 	}
 
@@ -369,35 +380,6 @@ func (m *translatePathsDashboards) Apply(ctx context.Context, b *bundle.Bundle)
 
 	return applyTranslations(ctx, b, t, []func(context.Context, dyn.Value) (dyn.Value, error){
 		t.applyDashboardTranslations,
+		t.applyGenieSpaceTranslations,
 	})
 }
-
-// gatherFallbackPaths collects the fallback paths for relative paths in the configuration.
-// Read more about the motivation for this functionality in the "fallback" path translation tests.
-func gatherFallbackPaths(v dyn.Value, typ string) (map[string]string, error) {
-	fallback := make(map[string]string)
-	pattern := dyn.NewPattern(dyn.Key("resources"), dyn.Key(typ), dyn.AnyKey())
-
-	// Previous behavior was to use a resource's location as the base path to resolve
-	// relative paths in its definition. With the introduction of [dyn.Value] throughout,
-	// we can use the location of the [dyn.Value] of the relative path itself.
-	//
-	// This is more flexible, as resources may have overrides that are not
-	// located in the same directory as the resource configuration file.
-	//
-	// To maintain backwards compatibility, we allow relative paths to be resolved using
-	// the original approach as fallback if the [dyn.Value] location cannot be resolved.
-	_, err := dyn.MapByPattern(v, pattern, func(p dyn.Path, v dyn.Value) (dyn.Value, error) {
-		key := p[2].Key()
-		dir, err := locationDirectory(v.Location())
-		if err != nil {
-			return dyn.InvalidValue, fmt.Errorf("unable to determine directory for %s: %w", p, err)
-		}
-		fallback[key] = dir
-		return v, nil
-	})
-	if err != nil {
-		return nil, err
-	}
-	return fallback, nil
-}
diff --git a/bundle/config/mutator/translate_paths_apps_test.go b/bundle/config/mutator/translate_paths_apps_test.go
index 331a1a8ab5e..05c902235b1 100644
--- a/bundle/config/mutator/translate_paths_apps_test.go
+++ b/bundle/config/mutator/translate_paths_apps_test.go
@@ -9,7 +9,7 @@ import (
 	"github.com/databricks/cli/bundle/config/mutator"
 	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/cli/bundle/internal/bundletest"
-	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/vfs"
 	"github.com/databricks/databricks-sdk-go/service/apps"
 	"github.com/stretchr/testify/assert"
@@ -32,16 +32,16 @@ func TestTranslatePathsApps_FilePathRelativeSubDirectory(t *testing.T) {
 				Apps: map[string]*resources.App{
 					"app": {
 						App: apps.App{
-							Name: "My App",
+							Name:           "My App",
+							SourceCodePath: "../src/app",
 						},
-						SourceCodePath: "../src/app",
 					},
 				},
 			},
 		},
 	}
 
-	bundletest.SetLocation(b, "resources.apps", []dyn.Location{{
+	bundletest.SetLocation(b, "resources.apps", []diag.Location{{
 		File: filepath.Join(dir, "resources/app.yml"),
 	}})
 
diff --git a/bundle/config/mutator/translate_paths_artifacts_test.go b/bundle/config/mutator/translate_paths_artifacts_test.go
index 31f9a0ea4ad..cf55d3d70dd 100644
--- a/bundle/config/mutator/translate_paths_artifacts_test.go
+++ b/bundle/config/mutator/translate_paths_artifacts_test.go
@@ -9,7 +9,7 @@ import (
 	"github.com/databricks/cli/bundle/config"
 	"github.com/databricks/cli/bundle/config/mutator"
 	"github.com/databricks/cli/bundle/internal/bundletest"
-	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/vfs"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -38,7 +38,7 @@ func TestTranslatePathsArtifacts_InsideSyncRoot(t *testing.T) {
 		},
 	}
 
-	bundletest.SetLocation(b, "artifacts", []dyn.Location{{
+	bundletest.SetLocation(b, "artifacts", []diag.Location{{
 		File: filepath.Join(dir, "config/artifacts.yml"),
 	}})
 
@@ -72,7 +72,7 @@ func TestTranslatePathsArtifacts_OutsideSyncRoot(t *testing.T) {
 		},
 	}
 
-	bundletest.SetLocation(b, "artifacts", []dyn.Location{{
+	bundletest.SetLocation(b, "artifacts", []diag.Location{{
 		File: filepath.Join(dir, "config/artifacts.yml"),
 	}})
 
diff --git a/bundle/config/mutator/translate_paths_dashboards_test.go b/bundle/config/mutator/translate_paths_dashboards_test.go
index 89625798805..84c36bc3706 100644
--- a/bundle/config/mutator/translate_paths_dashboards_test.go
+++ b/bundle/config/mutator/translate_paths_dashboards_test.go
@@ -9,7 +9,7 @@ import (
 	"github.com/databricks/cli/bundle/config/mutator"
 	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/cli/bundle/internal/bundletest"
-	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/vfs"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -37,7 +37,7 @@ func TestTranslatePathsDashboards_FilePathRelativeSubDirectory(t *testing.T) {
 		},
 	}
 
-	bundletest.SetLocation(b, "resources.dashboards", []dyn.Location{{
+	bundletest.SetLocation(b, "resources.dashboards", []diag.Location{{
 		File: filepath.Join(dir, "resources/dashboard.yml"),
 	}})
 
diff --git a/bundle/config/mutator/translate_paths_genie_spaces.go b/bundle/config/mutator/translate_paths_genie_spaces.go
new file mode 100644
index 00000000000..4e6d41f1cec
--- /dev/null
+++ b/bundle/config/mutator/translate_paths_genie_spaces.go
@@ -0,0 +1,21 @@
+package mutator
+
+import (
+	"context"
+
+	"github.com/databricks/cli/bundle/config/mutator/paths"
+	"github.com/databricks/cli/libs/dyn"
+)
+
+func (t *translateContext) applyGenieSpaceTranslations(ctx context.Context, v dyn.Value) (dyn.Value, error) {
+	// Rewrite the `file_path` field to a path relative to the bundle sync root.
+	// We load the file at this path and use its contents for the genie space contents.
+
+	return paths.VisitGenieSpacePaths(v, func(p dyn.Path, mode paths.TranslateMode, v dyn.Value) (dyn.Value, error) {
+		opts := translateOptions{
+			Mode: mode,
+		}
+
+		return t.rewriteValue(ctx, p, v, t.b.BundleRootPath, opts)
+	})
+}
diff --git a/bundle/config/mutator/translate_paths_genie_spaces_test.go b/bundle/config/mutator/translate_paths_genie_spaces_test.go
new file mode 100644
index 00000000000..ea053335a75
--- /dev/null
+++ b/bundle/config/mutator/translate_paths_genie_spaces_test.go
@@ -0,0 +1,55 @@
+package mutator_test
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/config/mutator"
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/cli/bundle/internal/bundletest"
+	"github.com/databricks/cli/libs/diag"
+	"github.com/databricks/cli/libs/vfs"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestTranslatePathsGenieSpaces_FilePathRelativeSubDirectory(t *testing.T) {
+	dir := t.TempDir()
+	touchEmptyFile(t, filepath.Join(dir, "src", "my_space.geniespace.json"))
+
+	b := &bundle.Bundle{
+		SyncRootPath:   dir,
+		BundleRootPath: dir,
+		SyncRoot:       vfs.MustNew(dir),
+		Config: config.Root{
+			Resources: config.Resources{
+				GenieSpaces: map[string]*resources.GenieSpace{
+					"genie_space": {
+						GenieSpaceConfig: resources.GenieSpaceConfig{
+							Title: "My Genie Space",
+						},
+						FilePath: "../src/my_space.geniespace.json",
+					},
+				},
+			},
+		},
+	}
+
+	bundletest.SetLocation(b, "resources.genie_spaces", []diag.Location{{
+		File: filepath.Join(dir, "resources", "genie_space.yml"),
+	}})
+
+	// Genie space paths reuse the dashboard translator; there is no separate
+	// genie_space mutator. The dashboard translator walks all resource types
+	// that need path translation, so calling it covers genie_spaces too.
+	diags := bundle.ApplySeq(t.Context(), b, mutator.NormalizePaths(), mutator.TranslatePathsDashboards())
+	require.NoError(t, diags.Error())
+
+	assert.Equal(
+		t,
+		filepath.ToSlash(filepath.Join("src", "my_space.geniespace.json")),
+		b.Config.Resources.GenieSpaces["genie_space"].FilePath,
+	)
+}
diff --git a/bundle/config/mutator/translate_paths_jobs.go b/bundle/config/mutator/translate_paths_jobs.go
index 4ffab62c89b..2c94e21802b 100644
--- a/bundle/config/mutator/translate_paths_jobs.go
+++ b/bundle/config/mutator/translate_paths_jobs.go
@@ -2,15 +2,11 @@ package mutator
 
 import (
 	"context"
-	"fmt"
-	"path/filepath"
 	"slices"
 
 	"github.com/databricks/cli/bundle/config/mutator/paths"
 
-	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/logdiag"
 )
 
 type (
@@ -20,13 +16,6 @@ type (
 
 func (t *translateContext) applyJobTranslations(visitor visitFunc, allowOutsideSyncRoot bool) translateFunc {
 	return func(ctx context.Context, v dyn.Value) (dyn.Value, error) {
-		var err error
-
-		fallback, err := gatherFallbackPaths(v, "jobs")
-		if err != nil {
-			return dyn.InvalidValue, err
-		}
-
 		// Do not translate job task paths if using Git source
 		var ignore []string
 		for key, job := range t.b.Config.Resources.Jobs {
@@ -54,36 +43,6 @@ func (t *translateContext) applyJobTranslations(visitor visitFunc, allowOutsideS
 				return nv, nil
 			}
 
-			// If we failed to rewrite the path, try to rewrite it relative to the fallback directory.
-			// We only do this for jobs and pipelines because of the comment in [gatherFallbackPaths].
-			if fallback[key] != "" {
-				dir, nerr := locationDirectory(v.Location())
-				if nerr != nil {
-					return dyn.InvalidValue, nerr
-				}
-
-				dirRel, nerr := filepath.Rel(t.b.BundleRootPath, dir)
-				if nerr != nil {
-					return dyn.InvalidValue, nerr
-				}
-
-				originalPath, nerr := filepath.Rel(dirRel, v.MustString())
-				if nerr != nil {
-					return dyn.InvalidValue, nerr
-				}
-
-				originalValue := dyn.NewValue(originalPath, v.Locations())
-				nv, nerr := t.rewriteValue(ctx, p, originalValue, fallback[key], opts)
-				if nerr == nil {
-					logdiag.LogDiag(ctx, diag.Diagnostic{
-						Severity:  diag.Error,
-						Summary:   fmt.Sprintf("path %s is defined relative to the %s directory (%s). Please update the path to be relative to the file where it is defined or use earlier version of CLI (0.261.0 or earlier).", originalPath, fallback[key], v.Location()),
-						Locations: v.Locations(),
-					})
-					return nv, nil
-				}
-			}
-
 			return dyn.InvalidValue, err
 		})
 	}
diff --git a/bundle/config/mutator/translate_paths_pipelines.go b/bundle/config/mutator/translate_paths_pipelines.go
index 53848461bd2..07c2e58cd93 100644
--- a/bundle/config/mutator/translate_paths_pipelines.go
+++ b/bundle/config/mutator/translate_paths_pipelines.go
@@ -2,27 +2,15 @@ package mutator
 
 import (
 	"context"
-	"fmt"
-	"path/filepath"
 
 	"github.com/databricks/cli/bundle/config/mutator/paths"
 
-	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/logdiag"
 )
 
 func (t *translateContext) applyPipelineTranslations(visitor visitFunc, allowOutsideSyncRoot bool) translateFunc {
 	return func(ctx context.Context, v dyn.Value) (dyn.Value, error) {
-		var err error
-
-		fallback, err := gatherFallbackPaths(v, "pipelines")
-		if err != nil {
-			return dyn.InvalidValue, err
-		}
-
 		return visitor(v, func(p dyn.Path, mode paths.TranslateMode, v dyn.Value) (dyn.Value, error) {
-			key := p[2].Key()
 			opts := translateOptions{
 				Mode:                     mode,
 				AllowPathOutsideSyncRoot: allowOutsideSyncRoot,
@@ -34,35 +22,6 @@ func (t *translateContext) applyPipelineTranslations(visitor visitFunc, allowOut
 				return nv, nil
 			}
 
-			// If we failed to rewrite the path, it uses an old path format which relied on fallback.
-			if fallback[key] != "" {
-				dir, nerr := locationDirectory(v.Location())
-				if nerr != nil {
-					return dyn.InvalidValue, nerr
-				}
-
-				dirRel, nerr := filepath.Rel(t.b.BundleRootPath, dir)
-				if nerr != nil {
-					return dyn.InvalidValue, nerr
-				}
-
-				originalPath, nerr := filepath.Rel(dirRel, v.MustString())
-				if nerr != nil {
-					return dyn.InvalidValue, nerr
-				}
-
-				originalValue := dyn.NewValue(originalPath, v.Locations())
-				nv, nerr := t.rewriteValue(ctx, p, originalValue, fallback[key], opts)
-				if nerr == nil {
-					logdiag.LogDiag(ctx, diag.Diagnostic{
-						Severity:  diag.Error,
-						Summary:   fmt.Sprintf("path %s is defined relative to the %s directory (%s). Please update the path to be relative to the file where it is defined or use earlier version of CLI (0.261.0 or earlier).", originalPath, fallback[key], v.Location()),
-						Locations: v.Locations(),
-					})
-					return nv, nil
-				}
-			}
-
 			return dyn.InvalidValue, err
 		})
 	}
diff --git a/bundle/config/mutator/translate_paths_test.go b/bundle/config/mutator/translate_paths_test.go
index bc2d1217909..8aaf9ce9c71 100644
--- a/bundle/config/mutator/translate_paths_test.go
+++ b/bundle/config/mutator/translate_paths_test.go
@@ -14,6 +14,7 @@ import (
 	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/cli/bundle/config/variable"
 	"github.com/databricks/cli/bundle/internal/bundletest"
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/cli/libs/vfs"
 	"github.com/databricks/databricks-sdk-go/service/compute"
@@ -31,6 +32,15 @@ func touchNotebookFile(t *testing.T, path string) {
 	f.Close()
 }
 
+// touchDesignerFile writes a minimal valid Lakeflow Designer notebook (Jupyter
+// JSON) so that notebook.DetectWithFS recognizes it as a notebook.
+func touchDesignerFile(t *testing.T, path string) {
+	err := os.MkdirAll(filepath.Dir(path), 0o700)
+	require.NoError(t, err)
+	contents := `{"cells":[],"metadata":{"application/vnd.databricks.v1+notebook":{"language":"python"}},"nbformat":4,"nbformat_minor":0}`
+	require.NoError(t, os.WriteFile(path, []byte(contents), 0o644))
+}
+
 func touchEmptyFile(t *testing.T, path string) {
 	err := os.MkdirAll(filepath.Dir(path), 0o700)
 	require.NoError(t, err)
@@ -84,7 +94,7 @@ func TestTranslatePathsSkippedWithGitSource(t *testing.T) {
 		},
 	}
 
-	bundletest.SetLocation(b, ".", []dyn.Location{{File: filepath.Join(dir, "resource.yml")}})
+	bundletest.SetLocation(b, ".", []diag.Location{{File: filepath.Join(dir, "resource.yml")}})
 
 	diags := bundle.ApplySeq(t.Context(), b, mutator.NormalizePaths(), mutator.TranslatePaths())
 	require.NoError(t, diags.Error())
@@ -213,7 +223,7 @@ func TestTranslatePaths(t *testing.T) {
 		},
 	}
 
-	bundletest.SetLocation(b, ".", []dyn.Location{{File: filepath.Join(dir, "resource.yml")}})
+	bundletest.SetLocation(b, ".", []diag.Location{{File: filepath.Join(dir, "resource.yml")}})
 
 	diags := bundle.ApplySeq(t.Context(), b, mutator.NormalizePaths(), mutator.TranslatePaths())
 	require.NoError(t, diags.Error())
@@ -356,8 +366,8 @@ func TestTranslatePathsInSubdirectories(t *testing.T) {
 		},
 	}
 
-	bundletest.SetLocation(b, "resources.jobs", []dyn.Location{{File: filepath.Join(dir, "job/resource.yml")}})
-	bundletest.SetLocation(b, "resources.pipelines", []dyn.Location{{File: filepath.Join(dir, "pipeline/resource.yml")}})
+	bundletest.SetLocation(b, "resources.jobs", []diag.Location{{File: filepath.Join(dir, "job/resource.yml")}})
+	bundletest.SetLocation(b, "resources.pipelines", []diag.Location{{File: filepath.Join(dir, "pipeline/resource.yml")}})
 
 	diags := bundle.ApplySeq(t.Context(), b, mutator.NormalizePaths(), mutator.TranslatePaths())
 	require.NoError(t, diags.Error())
@@ -424,7 +434,7 @@ func TestTranslatePathsOutsideSyncRoot(t *testing.T) {
 		},
 	}
 
-	bundletest.SetLocation(b, ".", []dyn.Location{{File: filepath.Join(dir, "../resource.yml")}})
+	bundletest.SetLocation(b, ".", []diag.Location{{File: filepath.Join(dir, "../resource.yml")}})
 
 	diags := bundle.ApplySeq(t.Context(), b, mutator.NormalizePaths(), mutator.TranslatePaths())
 	assert.ErrorContains(t, diags.Error(), "is not contained in sync root path")
@@ -456,7 +466,7 @@ func TestJobNotebookDoesNotExistError(t *testing.T) {
 		},
 	}
 
-	bundletest.SetLocation(b, ".", []dyn.Location{{File: filepath.Join(dir, "fake.yml")}})
+	bundletest.SetLocation(b, ".", []diag.Location{{File: filepath.Join(dir, "fake.yml")}})
 
 	diags := bundle.ApplySeq(t.Context(), b, mutator.NormalizePaths(), mutator.TranslatePaths())
 	assert.EqualError(t, diags.Error(), "notebook doesnt_exist.py not found")
@@ -488,7 +498,7 @@ func TestJobFileDoesNotExistError(t *testing.T) {
 		},
 	}
 
-	bundletest.SetLocation(b, ".", []dyn.Location{{File: filepath.Join(dir, "fake.yml")}})
+	bundletest.SetLocation(b, ".", []diag.Location{{File: filepath.Join(dir, "fake.yml")}})
 
 	diags := bundle.ApplySeq(t.Context(), b, mutator.NormalizePaths(), mutator.TranslatePaths())
 	assert.EqualError(t, diags.Error(), "file doesnt_exist.py not found")
@@ -520,7 +530,7 @@ func TestPipelineNotebookDoesNotExistError(t *testing.T) {
 		},
 	}
 
-	bundletest.SetLocation(b, ".", []dyn.Location{{File: filepath.Join(dir, "fake.yml")}})
+	bundletest.SetLocation(b, ".", []diag.Location{{File: filepath.Join(dir, "fake.yml")}})
 
 	diags := bundle.ApplySeq(t.Context(), b, mutator.NormalizePaths(), mutator.TranslatePaths())
 	assert.EqualError(t, diags.Error(), "notebook doesnt_exist.py not found")
@@ -565,7 +575,7 @@ func TestPipelineNotebookDoesNotExistErrorWithoutExtension(t *testing.T) {
 				},
 			}
 
-			bundletest.SetLocation(b, ".", []dyn.Location{{File: filepath.Join(dir, "fake.yml")}})
+			bundletest.SetLocation(b, ".", []diag.Location{{File: filepath.Join(dir, "fake.yml")}})
 			diags := bundle.ApplySeq(t.Context(), b, mutator.NormalizePaths(), mutator.TranslatePaths())
 
 			if ext == "" {
@@ -606,7 +616,7 @@ func TestPipelineFileDoesNotExistError(t *testing.T) {
 		},
 	}
 
-	bundletest.SetLocation(b, ".", []dyn.Location{{File: filepath.Join(dir, "fake.yml")}})
+	bundletest.SetLocation(b, ".", []diag.Location{{File: filepath.Join(dir, "fake.yml")}})
 
 	diags := bundle.ApplySeq(t.Context(), b, mutator.NormalizePaths(), mutator.TranslatePaths())
 	assert.EqualError(t, diags.Error(), "file doesnt_exist.py not found")
@@ -642,7 +652,7 @@ func TestJobSparkPythonTaskWithNotebookSourceError(t *testing.T) {
 		},
 	}
 
-	bundletest.SetLocation(b, ".", []dyn.Location{{File: filepath.Join(dir, "resource.yml")}})
+	bundletest.SetLocation(b, ".", []diag.Location{{File: filepath.Join(dir, "resource.yml")}})
 
 	diags := bundle.ApplySeq(t.Context(), b, mutator.NormalizePaths(), mutator.TranslatePaths())
 	assert.ErrorContains(t, diags.Error(), `expected a file for "resources.jobs.job.tasks[0].spark_python_task.python_file" but got a notebook`)
@@ -678,7 +688,7 @@ func TestJobNotebookTaskWithFileSourceError(t *testing.T) {
 		},
 	}
 
-	bundletest.SetLocation(b, ".", []dyn.Location{{File: filepath.Join(dir, "resource.yml")}})
+	bundletest.SetLocation(b, ".", []diag.Location{{File: filepath.Join(dir, "resource.yml")}})
 
 	diags := bundle.ApplySeq(t.Context(), b, mutator.NormalizePaths(), mutator.TranslatePaths())
 	assert.ErrorContains(t, diags.Error(), `expected a notebook for "resources.jobs.job.tasks[0].notebook_task.notebook_path" but got a file`)
@@ -714,7 +724,7 @@ func TestPipelineNotebookLibraryWithFileSourceError(t *testing.T) {
 		},
 	}
 
-	bundletest.SetLocation(b, ".", []dyn.Location{{File: filepath.Join(dir, "resource.yml")}})
+	bundletest.SetLocation(b, ".", []diag.Location{{File: filepath.Join(dir, "resource.yml")}})
 
 	diags := bundle.ApplySeq(t.Context(), b, mutator.NormalizePaths(), mutator.TranslatePaths())
 	assert.ErrorContains(t, diags.Error(), `expected a notebook for "resources.pipelines.pipeline.libraries[0].notebook.path" but got a file`)
@@ -750,7 +760,7 @@ func TestPipelineFileLibraryWithNotebookSourceError(t *testing.T) {
 		},
 	}
 
-	bundletest.SetLocation(b, ".", []dyn.Location{{File: filepath.Join(dir, "resource.yml")}})
+	bundletest.SetLocation(b, ".", []diag.Location{{File: filepath.Join(dir, "resource.yml")}})
 
 	diags := bundle.ApplySeq(t.Context(), b, mutator.NormalizePaths(), mutator.TranslatePaths())
 	assert.ErrorContains(t, diags.Error(), `expected a file for "resources.pipelines.pipeline.libraries[0].file.path" but got a notebook`)
@@ -792,7 +802,7 @@ func TestTranslatePathJobEnvironments(t *testing.T) {
 		},
 	}
 
-	bundletest.SetLocation(b, "resources.jobs", []dyn.Location{{File: filepath.Join(dir, "job/resource.yml")}})
+	bundletest.SetLocation(b, "resources.jobs", []diag.Location{{File: filepath.Join(dir, "job/resource.yml")}})
 
 	diags := bundle.ApplySeq(t.Context(), b, mutator.NormalizePaths(), mutator.TranslatePaths())
 	require.NoError(t, diags.Error())
@@ -839,8 +849,8 @@ func TestTranslatePathWithComplexVariables(t *testing.T) {
 		},
 	}
 
-	bundletest.SetLocation(b, "variables", []dyn.Location{{File: filepath.Join(dir, "variables/variables.yml")}})
-	bundletest.SetLocation(b, "resources.jobs", []dyn.Location{{File: filepath.Join(dir, "job/resource.yml")}})
+	bundletest.SetLocation(b, "variables", []diag.Location{{File: filepath.Join(dir, "variables/variables.yml")}})
+	bundletest.SetLocation(b, "resources.jobs", []diag.Location{{File: filepath.Join(dir, "job/resource.yml")}})
 
 	ctx := t.Context()
 	// Assign the variables to the dynamic configuration.
@@ -968,7 +978,7 @@ func TestTranslatePathsWithSourceLinkedDeployment(t *testing.T) {
 		},
 	}
 
-	bundletest.SetLocation(b, ".", []dyn.Location{{File: filepath.Join(dir, "resource.yml")}})
+	bundletest.SetLocation(b, ".", []diag.Location{{File: filepath.Join(dir, "resource.yml")}})
 	diags := bundle.ApplySeq(t.Context(), b, mutator.NormalizePaths(), mutator.TranslatePaths())
 	require.NoError(t, diags.Error())
 
@@ -1076,7 +1086,7 @@ func TestTranslatePathsWithSkipLocalFileValidation(t *testing.T) {
 		},
 	}
 
-	bundletest.SetLocation(b, ".", []dyn.Location{{File: filepath.Join(dir, "databricks.yml")}})
+	bundletest.SetLocation(b, ".", []diag.Location{{File: filepath.Join(dir, "databricks.yml")}})
 
 	diags := bundle.ApplySeq(t.Context(), b, mutator.NormalizePaths(), mutator.TranslatePaths())
 	require.NoError(t, diags.Error())
@@ -1116,7 +1126,7 @@ func TestTranslatePathsWithSkipLocalFileValidationDirectory(t *testing.T) {
 		},
 	}
 
-	bundletest.SetLocation(b, ".", []dyn.Location{{File: filepath.Join(dir, "databricks.yml")}})
+	bundletest.SetLocation(b, ".", []diag.Location{{File: filepath.Join(dir, "databricks.yml")}})
 
 	diags := bundle.ApplySeq(t.Context(), b, mutator.NormalizePaths(), mutator.TranslatePaths())
 	require.NoError(t, diags.Error())
@@ -1124,3 +1134,110 @@ func TestTranslatePathsWithSkipLocalFileValidationDirectory(t *testing.T) {
 	// Directory path should be translated even though directory doesn't exist.
 	assert.Equal(t, "/bundle/pipeline_root", b.Config.Resources.Pipelines["pipeline"].RootPath)
 }
+
+// TestTranslatePathsDesignerNotebook verifies that Lakeflow Designer notebooks
+// (`*.designer.ipynb`) referenced by a notebook_task preserve their full
+// suffix in the deployed notebook_path, since the workspace keeps that suffix
+// on import (unlike regular `.ipynb`, which is stripped).
+func TestTranslatePathsDesignerNotebook(t *testing.T) {
+	dir := t.TempDir()
+	touchDesignerFile(t, filepath.Join(dir, "src", "designer.designer.ipynb"))
+	touchNotebookFile(t, filepath.Join(dir, "src", "regular.py"))
+
+	b := &bundle.Bundle{
+		SyncRootPath:   dir,
+		BundleRootPath: dir,
+		SyncRoot:       vfs.MustNew(dir),
+		Config: config.Root{
+			Workspace: config.Workspace{
+				FilePath: "/bundle",
+			},
+			Resources: config.Resources{
+				Jobs: map[string]*resources.Job{
+					"job": {
+						JobSettings: jobs.JobSettings{
+							Tasks: []jobs.Task{
+								{
+									NotebookTask: &jobs.NotebookTask{
+										NotebookPath: "./src/designer.designer.ipynb",
+									},
+								},
+								{
+									NotebookTask: &jobs.NotebookTask{
+										NotebookPath: "./src/regular.py",
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	bundletest.SetLocation(b, ".", []diag.Location{{File: filepath.Join(dir, "databricks.yml")}})
+
+	diags := bundle.ApplySeq(t.Context(), b, mutator.NormalizePaths(), mutator.TranslatePaths())
+	require.NoError(t, diags.Error())
+
+	// Designer notebook keeps its full ".designer.ipynb" suffix.
+	assert.Equal(t,
+		"/bundle/src/designer.designer.ipynb",
+		b.Config.Resources.Jobs["job"].Tasks[0].NotebookTask.NotebookPath)
+
+	// Regular notebook still has its extension stripped on import.
+	assert.Equal(t,
+		"/bundle/src/regular",
+		b.Config.Resources.Jobs["job"].Tasks[1].NotebookTask.NotebookPath)
+}
+
+// TestTranslatePathsDesignerNotebookSkipLocalFileValidation verifies the
+// designer-suffix preservation also holds on the config-remote-sync code path
+// where the local file is not inspected.
+func TestTranslatePathsDesignerNotebookSkipLocalFileValidation(t *testing.T) {
+	dir := t.TempDir()
+
+	b := &bundle.Bundle{
+		SyncRootPath:            dir,
+		BundleRootPath:          dir,
+		SyncRoot:                vfs.MustNew(dir),
+		SkipLocalFileValidation: true,
+		Config: config.Root{
+			Workspace: config.Workspace{
+				FilePath: "/bundle",
+			},
+			Resources: config.Resources{
+				Jobs: map[string]*resources.Job{
+					"job": {
+						JobSettings: jobs.JobSettings{
+							Tasks: []jobs.Task{
+								{
+									NotebookTask: &jobs.NotebookTask{
+										NotebookPath: "./src/designer.designer.ipynb",
+									},
+								},
+								{
+									NotebookTask: &jobs.NotebookTask{
+										NotebookPath: "./src/regular.ipynb",
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	bundletest.SetLocation(b, ".", []diag.Location{{File: filepath.Join(dir, "databricks.yml")}})
+
+	diags := bundle.ApplySeq(t.Context(), b, mutator.NormalizePaths(), mutator.TranslatePaths())
+	require.NoError(t, diags.Error())
+
+	assert.Equal(t,
+		"/bundle/src/designer.designer.ipynb",
+		b.Config.Resources.Jobs["job"].Tasks[0].NotebookTask.NotebookPath)
+	assert.Equal(t,
+		"/bundle/src/regular",
+		b.Config.Resources.Jobs["job"].Tasks[1].NotebookTask.NotebookPath)
+}
diff --git a/bundle/config/mutator/validate_direct_only_resources.go b/bundle/config/mutator/validate_direct_only_resources.go
deleted file mode 100644
index 5717497205b..00000000000
--- a/bundle/config/mutator/validate_direct_only_resources.go
+++ /dev/null
@@ -1,96 +0,0 @@
-package mutator
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/databricks/cli/bundle"
-	"github.com/databricks/cli/bundle/config/engine"
-	"github.com/databricks/cli/libs/diag"
-)
-
-type directOnlyResource struct {
-	resourceType string
-	pluralName   string
-	singularName string
-	getResources func(*bundle.Bundle) map[string]any
-}
-
-// Resources that are only supported in direct deployment mode
-var directOnlyResources = []directOnlyResource{
-	{
-		resourceType: "catalogs",
-		pluralName:   "Catalog",
-		singularName: "catalog",
-		getResources: func(b *bundle.Bundle) map[string]any {
-			result := make(map[string]any)
-			for k, v := range b.Config.Resources.Catalogs {
-				result[k] = v
-			}
-			return result
-		},
-	},
-	{
-		resourceType: "external_locations",
-		pluralName:   "External Location",
-		singularName: "external location",
-		getResources: func(b *bundle.Bundle) map[string]any {
-			result := make(map[string]any)
-			for k, v := range b.Config.Resources.ExternalLocations {
-				result[k] = v
-			}
-			return result
-		},
-	},
-	{
-		resourceType: "vector_search_endpoints",
-		pluralName:   "Vector Search Endpoint",
-		singularName: "vector search endpoint",
-		getResources: func(b *bundle.Bundle) map[string]any {
-			result := make(map[string]any)
-			for k, v := range b.Config.Resources.VectorSearchEndpoints {
-				result[k] = v
-			}
-			return result
-		},
-	},
-}
-
-type validateDirectOnlyResources struct {
-	engine engine.EngineType
-}
-
-// ValidateDirectOnlyResources returns a mutator that validates resources
-// that are only supported in direct deployment mode.
-func ValidateDirectOnlyResources(engine engine.EngineType) bundle.Mutator {
-	return &validateDirectOnlyResources{engine: engine}
-}
-
-func (m *validateDirectOnlyResources) Name() string {
-	return "ValidateDirectOnlyResources"
-}
-
-func (m *validateDirectOnlyResources) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
-	if m.engine.IsDirect() {
-		return nil
-	}
-
-	var diags diag.Diagnostics
-
-	for _, resource := range directOnlyResources {
-		resourceMap := resource.getResources(b)
-		if len(resourceMap) > 0 {
-			diags = diags.Append(diag.Diagnostic{
-				Severity: diag.Error,
-				Summary:  resource.pluralName + " resources are only supported with direct deployment mode",
-				Detail: fmt.Sprintf("%s resources require direct deployment mode. "+
-					"Please set the DATABRICKS_BUNDLE_ENGINE environment variable to 'direct' to use %s resources.\n"+
-					"Learn more at https://docs.databricks.com/dev-tools/bundles/direct",
-					resource.pluralName, resource.singularName),
-				Locations: b.Config.GetLocations("resources." + resource.resourceType),
-			})
-		}
-	}
-
-	return diags
-}
diff --git a/bundle/config/mutator/validate_git_details.go b/bundle/config/mutator/validate_git_details.go
index 69a4221fdcb..bb25a198093 100644
--- a/bundle/config/mutator/validate_git_details.go
+++ b/bundle/config/mutator/validate_git_details.go
@@ -4,6 +4,7 @@ import (
 	"context"
 
 	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/libs/agent"
 	"github.com/databricks/cli/libs/diag"
 )
 
@@ -23,7 +24,8 @@ func (m *validateGitDetails) Apply(ctx context.Context, b *bundle.Bundle) diag.D
 	}
 
 	if b.Config.Bundle.Git.Branch != b.Config.Bundle.Git.ActualBranch && !b.Config.Bundle.Force {
-		return diag.Errorf("not on the right Git branch:\n  expected according to configuration: %s\n  actual: %s\nuse --force to override", b.Config.Bundle.Git.Branch, b.Config.Bundle.Git.ActualBranch)
+		return diag.Errorf("not on the right Git branch:\n  expected according to configuration: %s\n  actual: %s\nTo deploy from this branch anyway, use --force. Note that this may push unexpected code to the target.%s",
+			b.Config.Bundle.Git.Branch, b.Config.Bundle.Git.ActualBranch, agent.AgentNotice())
 	}
 	return nil
 }
diff --git a/bundle/config/mutator/validate_git_details_test.go b/bundle/config/mutator/validate_git_details_test.go
index b29f221edc1..b7eaad9aeb6 100644
--- a/bundle/config/mutator/validate_git_details_test.go
+++ b/bundle/config/mutator/validate_git_details_test.go
@@ -40,8 +40,9 @@ func TestValidateGitDetailsNonMatchingBranches(t *testing.T) {
 	m := ValidateGitDetails()
 	diags := bundle.Apply(t.Context(), b, m)
 
-	expectedError := "not on the right Git branch:\n  expected according to configuration: main\n  actual: feature\nuse --force to override"
-	assert.EqualError(t, diags.Error(), expectedError)
+	err := diags.Error()
+	assert.ErrorContains(t, err, "not on the right Git branch:\n  expected according to configuration: main\n  actual: feature")
+	assert.ErrorContains(t, err, "To deploy from this branch anyway, use --force. Note that this may push unexpected code to the target.")
 }
 
 func TestValidateGitDetailsNotUsingGit(t *testing.T) {
diff --git a/bundle/config/mutator/validate_job_run_triggers.go b/bundle/config/mutator/validate_job_run_triggers.go
new file mode 100644
index 00000000000..d33a7263bde
--- /dev/null
+++ b/bundle/config/mutator/validate_job_run_triggers.go
@@ -0,0 +1,70 @@
+package mutator
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/libs/diag"
+)
+
+type validateJobRunTriggers struct{}
+
+// ValidateJobRunTriggers rejects invalid lifecycle.triggers on job_runs.
+func ValidateJobRunTriggers() bundle.Mutator {
+	return &validateJobRunTriggers{}
+}
+
+func (*validateJobRunTriggers) Name() string {
+	return "ValidateJobRunTriggers"
+}
+
+func (*validateJobRunTriggers) Apply(_ context.Context, b *bundle.Bundle) diag.Diagnostics {
+	var diags diag.Diagnostics
+	for name, jr := range b.Config.Resources.JobRuns {
+		if jr == nil || jr.Lifecycle == nil {
+			continue
+		}
+		for i, t := range jr.Lifecycle.Triggers {
+			path := fmt.Sprintf("resources.job_runs.%s.lifecycle.triggers[%d]", name, i)
+			if t.OnBundleDeploy == nil && t.OnFileChange == nil {
+				diags = diags.Append(diag.Diagnostic{
+					Severity:  diag.Error,
+					Summary:   "lifecycle.triggers entry must set on_bundle_deploy or on_file_change",
+					Locations: b.Config.GetLocations(path),
+				})
+				continue
+			}
+			if t.OnBundleDeploy != nil && t.OnFileChange != nil {
+				diags = diags.Append(diag.Diagnostic{
+					Severity:  diag.Error,
+					Summary:   "lifecycle.triggers entry must set only one of on_bundle_deploy or on_file_change",
+					Locations: b.Config.GetLocations(path),
+				})
+				continue
+			}
+			if t.OnBundleDeploy != nil && !*t.OnBundleDeploy {
+				diags = diags.Append(diag.Diagnostic{
+					Severity:  diag.Error,
+					Summary:   "lifecycle.triggers.on_bundle_deploy must be true when set",
+					Locations: b.Config.GetLocations(path + ".on_bundle_deploy"),
+				})
+			}
+			if t.OnFileChange != nil {
+				if strings.TrimSpace(*t.OnFileChange) == "" {
+					diags = diags.Append(diag.Diagnostic{
+						Severity:  diag.Error,
+						Summary:   "lifecycle.triggers.on_file_change must be non-empty when set",
+						Locations: b.Config.GetLocations(path + ".on_file_change"),
+					})
+					continue
+				}
+				// Report bad patterns at validate time; hashing only runs on deploy.
+				_, patternDiags := validateFileTriggerPattern(b, path+".on_file_change", *t.OnFileChange)
+				diags = diags.Extend(patternDiags)
+			}
+		}
+	}
+	return diags
+}
diff --git a/bundle/config/mutator/validate_job_run_triggers_test.go b/bundle/config/mutator/validate_job_run_triggers_test.go
new file mode 100644
index 00000000000..3ec1e90b844
--- /dev/null
+++ b/bundle/config/mutator/validate_job_run_triggers_test.go
@@ -0,0 +1,125 @@
+package mutator_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/config/mutator"
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestValidateJobRunTriggers(t *testing.T) {
+	trueVal := true
+	falseVal := false
+
+	fileChange := "seed.txt"
+	emptyFile := ""
+	whitespaceFile := "  \t"
+
+	tests := []struct {
+		name           string
+		triggers       []resources.JobRunTrigger
+		preventDestroy bool
+		summary        string
+	}{
+		{
+			name: "on_bundle_deploy true",
+			triggers: []resources.JobRunTrigger{
+				{OnBundleDeploy: &trueVal},
+			},
+		},
+		{
+			name: "on_file_change set",
+			triggers: []resources.JobRunTrigger{
+				{OnFileChange: &fileChange},
+			},
+		},
+		{
+			name: "both triggers as separate entries",
+			triggers: []resources.JobRunTrigger{
+				{OnFileChange: &fileChange},
+				{OnBundleDeploy: &trueVal},
+			},
+		},
+		{
+			name: "empty entry",
+			triggers: []resources.JobRunTrigger{
+				{},
+			},
+			summary: "lifecycle.triggers entry must set on_bundle_deploy or on_file_change",
+		},
+		{
+			name: "both keys on one entry",
+			triggers: []resources.JobRunTrigger{
+				{OnBundleDeploy: &trueVal, OnFileChange: &fileChange},
+			},
+			summary: "lifecycle.triggers entry must set only one of on_bundle_deploy or on_file_change",
+		},
+		{
+			name: "on_bundle_deploy false",
+			triggers: []resources.JobRunTrigger{
+				{OnBundleDeploy: &falseVal},
+			},
+			summary: "lifecycle.triggers.on_bundle_deploy must be true when set",
+		},
+		{
+			name: "on_file_change empty",
+			triggers: []resources.JobRunTrigger{
+				{OnFileChange: &emptyFile},
+			},
+			summary: "lifecycle.triggers.on_file_change must be non-empty when set",
+		},
+		{
+			name: "on_file_change whitespace",
+			triggers: []resources.JobRunTrigger{
+				{OnFileChange: &whitespaceFile},
+			},
+			summary: "lifecycle.triggers.on_file_change must be non-empty when set",
+		},
+		{
+			// A trigger with prevent_destroy is valid at this stage; the recreate a
+			// fired trigger plans is rejected generically by checkForPreventDestroy.
+			name: "trigger with prevent_destroy is allowed here",
+			triggers: []resources.JobRunTrigger{
+				{OnFileChange: &fileChange},
+			},
+			preventDestroy: true,
+		},
+		{
+			name:           "prevent_destroy alone",
+			preventDestroy: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			root := t.TempDir()
+			b := &bundle.Bundle{
+				BundleRootPath: root,
+				SyncRootPath:   root,
+				Config: config.Root{
+					Resources: config.Resources{
+						JobRuns: map[string]*resources.JobRun{
+							"my_run": {
+								Lifecycle: &resources.JobRunLifecycle{
+									PreventDestroy: tt.preventDestroy,
+									Triggers:       tt.triggers,
+									TriggersState:  nil,
+								},
+							},
+						},
+					},
+				},
+			}
+			diags := bundle.Apply(t.Context(), b, mutator.ValidateJobRunTriggers())
+			if tt.summary == "" {
+				assert.Empty(t, diags)
+				return
+			}
+			assert.True(t, diags.HasError())
+			assert.Equal(t, tt.summary, diags[0].Summary)
+		})
+	}
+}
diff --git a/bundle/config/mutator/validate_lifecycle_started.go b/bundle/config/mutator/validate_lifecycle_started.go
deleted file mode 100644
index 67c58a5701c..00000000000
--- a/bundle/config/mutator/validate_lifecycle_started.go
+++ /dev/null
@@ -1,48 +0,0 @@
-package mutator
-
-import (
-	"context"
-
-	"github.com/databricks/cli/bundle"
-	"github.com/databricks/cli/bundle/config/engine"
-	"github.com/databricks/cli/bundle/config/resources"
-	"github.com/databricks/cli/libs/diag"
-)
-
-type validateLifecycleStarted struct {
-	engine engine.EngineType
-}
-
-// ValidateLifecycleStarted returns a mutator that errors when lifecycle.started
-// is used with the terraform deployment engine.
-// lifecycle.started is only supported in direct deployment mode.
-func ValidateLifecycleStarted(e engine.EngineType) bundle.Mutator {
-	return &validateLifecycleStarted{engine: e}
-}
-
-func (m *validateLifecycleStarted) Name() string {
-	return "ValidateLifecycleStarted"
-}
-
-func (m *validateLifecycleStarted) Apply(_ context.Context, b *bundle.Bundle) diag.Diagnostics {
-	if m.engine.IsDirect() {
-		return nil
-	}
-
-	var diags diag.Diagnostics
-	for _, group := range b.Config.Resources.AllResources() {
-		for key, resource := range group.Resources {
-			lws, ok := resource.GetLifecycle().(resources.LifecycleWithStarted)
-			if !ok || lws.Started == nil {
-				continue
-			}
-			path := "resources." + group.Description.PluralName + "." + key + ".lifecycle.started"
-			diags = diags.Append(diag.Diagnostic{
-				Severity:  diag.Error,
-				Summary:   "lifecycle.started is only supported in direct deployment mode",
-				Locations: b.Config.GetLocations(path),
-			})
-		}
-	}
-	return diags
-}
diff --git a/bundle/config/mutator/validate_secret_value_is_variable.go b/bundle/config/mutator/validate_secret_value_is_variable.go
new file mode 100644
index 00000000000..1f979e15f74
--- /dev/null
+++ b/bundle/config/mutator/validate_secret_value_is_variable.go
@@ -0,0 +1,111 @@
+package mutator
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/libs/diag"
+	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/dyn/dynvar"
+)
+
+type validateSecretValueIsVariable struct{}
+
+func ValidateSecretValueIsVariable() bundle.Mutator {
+	return &validateSecretValueIsVariable{}
+}
+
+func (v *validateSecretValueIsVariable) Name() string {
+	return "ValidateSecretValueIsVariable"
+}
+
+func (v *validateSecretValueIsVariable) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	// Iterate over all secrets in the bundle
+	for key := range b.Config.Resources.Secrets {
+		p := dyn.NewPath(dyn.Key("resources"), dyn.Key("secrets"), dyn.Key(key), dyn.Key("value"))
+		val, err := dyn.GetByPath(b.Config.Value(), p)
+		if dyn.IsNoSuchKeyError(err) {
+			diags = append(diags, diag.Diagnostic{
+				Severity:  diag.Error,
+				Summary:   "Secret value must be a string",
+				Detail:    fmt.Sprintf(`The secret value for "%s" must be a string.`, key),
+				Locations: val.Locations(),
+				Paths:     dyn.ToStructPaths(p),
+			})
+			continue
+		}
+		if err != nil {
+			return diag.FromErr(err)
+		}
+
+		valueStr, ok := val.AsString()
+		if !ok {
+			diags = append(diags, diag.Diagnostic{
+				Severity:  diag.Error,
+				Summary:   "Secret value must be a string",
+				Detail:    fmt.Sprintf(`The secret value for "%s" must be a string.`, key),
+				Locations: val.Locations(),
+				Paths:     dyn.ToStructPaths(p),
+			})
+			continue
+		}
+
+		// Value must be a variable reference to prevent leaking secrets in config files
+		if !dynvar.IsPureVariableReference(valueStr) {
+			diags = append(diags, diag.Diagnostic{
+				Severity: diag.Error,
+				Summary:  "Secret value must be a variable reference",
+				Detail: fmt.Sprintf(`The secret value for "%s" must be a variable reference (e.g., ${var.my_secret}).
+Plain text secret values are not allowed to prevent leaking secrets in configuration files.
+Use bundle variables to pass secret values at deployment time.`, key),
+				Locations: val.Locations(),
+				Paths:     dyn.ToStructPaths(p),
+			})
+			continue
+		}
+
+		// The value is a variable reference. If it is a pure ${var.<name>} reference,
+		// check that the referenced variable does not have a default value set. A default
+		// value would be stored in plain text in the config file, defeating the purpose
+		// of using a variable reference.
+		diags = append(diags, v.checkVariableDefault(b, key, valueStr, p, val)...)
+	}
+
+	return diags
+}
+
+// checkVariableDefault emits an error if valueStr is a pure ${var.<name>} reference
+// and the referenced variable has a default value set.
+func (v *validateSecretValueIsVariable) checkVariableDefault(b *bundle.Bundle, secretKey, valueStr string, p dyn.Path, val dyn.Value) diag.Diagnostics {
+	refPath, ok := dynvar.PureReferenceToPath(valueStr)
+	if !ok || len(refPath) < 2 || refPath[0].Key() != "var" {
+		return nil
+	}
+
+	varName := refPath[1].Key()
+	variable, exists := b.Config.Variables[varName]
+	if !exists || variable == nil || !variable.HasDefault() {
+		return nil
+	}
+
+	// The default path in the dynamic config for the variable's default field.
+	defaultPath := dyn.NewPath(dyn.Key("variables"), dyn.Key(varName), dyn.Key("default"))
+	defaultVal, err := dyn.GetByPath(b.Config.Value(), defaultPath)
+	locations := val.Locations()
+	if err == nil {
+		locations = append(defaultVal.Locations(), locations...)
+	}
+
+	return diag.Diagnostics{{
+		Severity: diag.Error,
+		Summary:  "Variable used for secret value must not have a default value",
+		Detail: fmt.Sprintf(`The variable "%s" used for the secret "%s" must not have a default value.
+A default value is stored in plain text in the configuration file, which defeats the purpose of using a variable reference for a secret.
+Remove the default value and pass the secret value at deployment time using "--var", the BUNDLE_VAR_%s environment variable, or a variable overrides file.`, varName, secretKey, varName),
+		Locations: locations,
+		Paths:     dyn.ToStructPaths(p),
+	}}
+}
diff --git a/bundle/config/mutator/verify_cli_version.go b/bundle/config/mutator/verify_cli_version.go
index 873e4f78065..a6d705a6fbb 100644
--- a/bundle/config/mutator/verify_cli_version.go
+++ b/bundle/config/mutator/verify_cli_version.go
@@ -39,7 +39,10 @@ func (v *verifyCliVersion) Apply(ctx context.Context, b *bundle.Bundle) diag.Dia
 	}
 
 	if !c.Check(version) {
-		if version.Prerelease() == "dev" && version.Major() == 0 {
+		// Development builds are built from main and may already carry the change
+		// the constraint requires, so the constraint is a warning rather than an
+		// error. Masterminds reports the prerelease without its leading dash.
+		if version.Prerelease() == "dev" {
 			return diag.Warningf("Ignoring Databricks CLI version constraint for development build. Required: %s, current: %s", constraint, currentVersion)
 		}
 
diff --git a/bundle/config/presets.go b/bundle/config/presets.go
index 46562067ae3..a831d83c9c2 100644
--- a/bundle/config/presets.go
+++ b/bundle/config/presets.go
@@ -29,6 +29,11 @@ type Presets struct {
 
 	// Tags to add to all resources.
 	Tags map[string]string `json:"tags,omitempty"`
+
+	// ForceSendFields records which fields were explicitly set so that zero-value
+	// overrides can replace non-zero base values (e.g., name_prefix: "" clearing a base prefix).
+	// This field is not serialized to JSON.
+	ForceSendFields []string `json:"-"`
 }
 
 // IsExplicitlyEnabled tests whether this feature is explicitly enabled.
diff --git a/bundle/config/resources.go b/bundle/config/resources.go
index 225ec32165d..75fef099133 100644
--- a/bundle/config/resources.go
+++ b/bundle/config/resources.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"net/url"
+	"strings"
 
 	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/databricks-sdk-go"
@@ -12,30 +13,48 @@ import (
 // Resources defines Databricks resources associated with the bundle.
 type Resources struct {
 	Jobs      map[string]*resources.Job      `json:"jobs,omitempty"`
+	JobRuns   map[string]*resources.JobRun   `json:"job_runs,omitempty"`
 	Pipelines map[string]*resources.Pipeline `json:"pipelines,omitempty"`
 
-	Models                map[string]*resources.MlflowModel          `json:"models,omitempty"`
-	Experiments           map[string]*resources.MlflowExperiment     `json:"experiments,omitempty"`
-	ModelServingEndpoints map[string]*resources.ModelServingEndpoint `json:"model_serving_endpoints,omitempty"`
-	RegisteredModels      map[string]*resources.RegisteredModel      `json:"registered_models,omitempty"`
-	QualityMonitors       map[string]*resources.QualityMonitor       `json:"quality_monitors,omitempty"`
-	Catalogs              map[string]*resources.Catalog              `json:"catalogs,omitempty"`
-	Schemas               map[string]*resources.Schema               `json:"schemas,omitempty"`
-	Volumes               map[string]*resources.Volume               `json:"volumes,omitempty"`
-	ExternalLocations     map[string]*resources.ExternalLocation     `json:"external_locations,omitempty"`
-	Clusters              map[string]*resources.Cluster              `json:"clusters,omitempty"`
-	Dashboards            map[string]*resources.Dashboard            `json:"dashboards,omitempty"`
-	Apps                  map[string]*resources.App                  `json:"apps,omitempty"`
-	SecretScopes          map[string]*resources.SecretScope          `json:"secret_scopes,omitempty"`
-	Alerts                map[string]*resources.Alert                `json:"alerts,omitempty"`
-	SqlWarehouses         map[string]*resources.SqlWarehouse         `json:"sql_warehouses,omitempty"`
-	DatabaseInstances     map[string]*resources.DatabaseInstance     `json:"database_instances,omitempty"`
-	DatabaseCatalogs      map[string]*resources.DatabaseCatalog      `json:"database_catalogs,omitempty"`
-	SyncedDatabaseTables  map[string]*resources.SyncedDatabaseTable  `json:"synced_database_tables,omitempty"`
-	PostgresProjects      map[string]*resources.PostgresProject      `json:"postgres_projects,omitempty"`
-	PostgresBranches      map[string]*resources.PostgresBranch       `json:"postgres_branches,omitempty"`
-	PostgresEndpoints     map[string]*resources.PostgresEndpoint     `json:"postgres_endpoints,omitempty"`
-	VectorSearchEndpoints map[string]*resources.VectorSearchEndpoint `json:"vector_search_endpoints,omitempty"`
+	Features                  map[string]*resources.Feature                  `json:"features,omitempty"`
+	Models                    map[string]*resources.MlflowModel              `json:"models,omitempty"`
+	Experiments               map[string]*resources.MlflowExperiment         `json:"experiments,omitempty"`
+	ModelServingEndpoints     map[string]*resources.ModelServingEndpoint     `json:"model_serving_endpoints,omitempty"`
+	ModelServices             map[string]*resources.ModelService             `json:"model_services,omitempty"`
+	McpServices               map[string]*resources.McpService               `json:"mcp_services,omitempty"`
+	ModelProviderServices     map[string]*resources.ModelProviderService     `json:"model_provider_services,omitempty"`
+	RegisteredModels          map[string]*resources.RegisteredModel          `json:"registered_models,omitempty"`
+	QualityMonitors           map[string]*resources.QualityMonitor           `json:"quality_monitors,omitempty"`
+	Catalogs                  map[string]*resources.Catalog                  `json:"catalogs,omitempty"`
+	Schemas                   map[string]*resources.Schema                   `json:"schemas,omitempty"`
+	Volumes                   map[string]*resources.Volume                   `json:"volumes,omitempty"`
+	ExternalLocations         map[string]*resources.ExternalLocation         `json:"external_locations,omitempty"`
+	Clusters                  map[string]*resources.Cluster                  `json:"clusters,omitempty"`
+	Dashboards                map[string]*resources.Dashboard                `json:"dashboards,omitempty"`
+	GenieSpaces               map[string]*resources.GenieSpace               `json:"genie_spaces,omitempty"`
+	Apps                      map[string]*resources.App                      `json:"apps,omitempty"`
+	SecretScopes              map[string]*resources.SecretScope              `json:"secret_scopes,omitempty"`
+	Alerts                    map[string]*resources.Alert                    `json:"alerts,omitempty"`
+	SqlWarehouses             map[string]*resources.SqlWarehouse             `json:"sql_warehouses,omitempty"`
+	DatabaseInstances         map[string]*resources.DatabaseInstance         `json:"database_instances,omitempty"`
+	DatabaseCatalogs          map[string]*resources.DatabaseCatalog          `json:"database_catalogs,omitempty"`
+	SyncedDatabaseTables      map[string]*resources.SyncedDatabaseTable      `json:"synced_database_tables,omitempty"`
+	PostgresProjects          map[string]*resources.PostgresProject          `json:"postgres_projects,omitempty"`
+	PostgresBranches          map[string]*resources.PostgresBranch           `json:"postgres_branches,omitempty"`
+	PostgresEndpoints         map[string]*resources.PostgresEndpoint         `json:"postgres_endpoints,omitempty"`
+	PostgresCatalogs          map[string]*resources.PostgresCatalog          `json:"postgres_catalogs,omitempty"`
+	PostgresDatabases         map[string]*resources.PostgresDatabase         `json:"postgres_databases,omitempty"`
+	PostgresRoles             map[string]*resources.PostgresRole             `json:"postgres_roles,omitempty"`
+	PostgresSyncedTables      map[string]*resources.PostgresSyncedTable      `json:"postgres_synced_tables,omitempty"`
+	PostgresSnapshotSchedules map[string]*resources.PostgresSnapshotSchedule `json:"postgres_snapshot_schedules,omitempty"`
+	VectorSearchEndpoints     map[string]*resources.VectorSearchEndpoint     `json:"vector_search_endpoints,omitempty"`
+	VectorSearchIndexes       map[string]*resources.VectorSearchIndex        `json:"vector_search_indexes,omitempty"`
+	InstancePools             map[string]*resources.InstancePool             `json:"instance_pools,omitempty"`
+	Secrets                   map[string]*resources.Secret                   `json:"secrets,omitempty"`
+	ClusterPolicies           map[string]*resources.ClusterPolicy            `json:"cluster_policies,omitempty"`
+
+	// Internal resources
+	Snapshots map[string]*resources.Snapshot `json:"internal_immutable_snapshots,omitempty" bundle:"internal"`
 }
 
 type ConfigResource interface {
@@ -49,8 +68,10 @@ type ConfigResource interface {
 	// GetName returns the in-product name of the resource.
 	GetName() string
 
-	// GetURL returns the URL of the resource.
-	GetURL() string
+	// GetURL returns the resource's workspace URL and whether this resource type
+	// has one at all. A supported type that is not deployed yet returns ("", true);
+	// a type that never has a URL returns ("", false).
+	GetURL() (string, bool)
 
 	// InitializeURL initializes the URL field of the resource.
 	InitializeURL(baseURL url.URL)
@@ -90,10 +111,15 @@ func (r *Resources) AllResources() []ResourceGroup {
 	descriptions := SupportedResources()
 	return []ResourceGroup{
 		collectResourceMap(descriptions["jobs"], r.Jobs),
+		collectResourceMap(descriptions["job_runs"], r.JobRuns),
 		collectResourceMap(descriptions["pipelines"], r.Pipelines),
 		collectResourceMap(descriptions["models"], r.Models),
 		collectResourceMap(descriptions["experiments"], r.Experiments),
+		collectResourceMap(descriptions["features"], r.Features),
 		collectResourceMap(descriptions["model_serving_endpoints"], r.ModelServingEndpoints),
+		collectResourceMap(descriptions["model_services"], r.ModelServices),
+		collectResourceMap(descriptions["mcp_services"], r.McpServices),
+		collectResourceMap(descriptions["model_provider_services"], r.ModelProviderServices),
 		collectResourceMap(descriptions["registered_models"], r.RegisteredModels),
 		collectResourceMap(descriptions["quality_monitors"], r.QualityMonitors),
 		collectResourceMap(descriptions["catalogs"], r.Catalogs),
@@ -101,6 +127,7 @@ func (r *Resources) AllResources() []ResourceGroup {
 		collectResourceMap(descriptions["external_locations"], r.ExternalLocations),
 		collectResourceMap(descriptions["clusters"], r.Clusters),
 		collectResourceMap(descriptions["dashboards"], r.Dashboards),
+		collectResourceMap(descriptions["genie_spaces"], r.GenieSpaces),
 		collectResourceMap(descriptions["volumes"], r.Volumes),
 		collectResourceMap(descriptions["apps"], r.Apps),
 		collectResourceMap(descriptions["alerts"], r.Alerts),
@@ -112,61 +139,103 @@ func (r *Resources) AllResources() []ResourceGroup {
 		collectResourceMap(descriptions["postgres_projects"], r.PostgresProjects),
 		collectResourceMap(descriptions["postgres_branches"], r.PostgresBranches),
 		collectResourceMap(descriptions["postgres_endpoints"], r.PostgresEndpoints),
+		collectResourceMap(descriptions["postgres_catalogs"], r.PostgresCatalogs),
+		collectResourceMap(descriptions["postgres_databases"], r.PostgresDatabases),
+		collectResourceMap(descriptions["postgres_roles"], r.PostgresRoles),
+		collectResourceMap(descriptions["postgres_synced_tables"], r.PostgresSyncedTables),
+		collectResourceMap(descriptions["postgres_snapshot_schedules"], r.PostgresSnapshotSchedules),
 		collectResourceMap(descriptions["vector_search_endpoints"], r.VectorSearchEndpoints),
+		collectResourceMap(descriptions["vector_search_indexes"], r.VectorSearchIndexes),
+		collectResourceMap(descriptions["instance_pools"], r.InstancePools),
+		collectResourceMap(descriptions["internal_immutable_snapshots"], r.Snapshots),
+		collectResourceMap(descriptions["secrets"], r.Secrets),
+		collectResourceMap(descriptions["cluster_policies"], r.ClusterPolicies),
 	}
 }
 
-// FindResourceByConfigKey searches all resource maps for a resource with the given key.
-func (r *Resources) FindResourceByConfigKey(key string) (ConfigResource, error) {
-	var found []ConfigResource
-
-	for _, group := range r.AllResources() {
-		if res, ok := group.Resources[key]; ok {
-			found = append(found, res)
+// ResolveKey finds a resource by "key" or "type.key", e.g. "foo" or "jobs.foo", and returns it
+// together with its key. A bare key must match exactly one resource across all types.
+func (r *Resources) ResolveKey(ref string) (ConfigResource, string, error) {
+	groups := r.AllResources()
+
+	if typeName, key, ok := strings.Cut(ref, "."); ok {
+		for _, group := range groups {
+			if group.Description.PluralName != typeName {
+				continue
+			}
+			if res, ok := group.Resources[key]; ok {
+				return res, key, nil
+			}
+			break
 		}
+		return nil, "", fmt.Errorf("no such resource: %s", ref)
 	}
 
-	if len(found) == 0 {
-		return nil, fmt.Errorf("no such resource: %s", key)
+	var found []ConfigResource
+	var matches []string
+	for _, group := range groups {
+		if res, ok := group.Resources[ref]; ok {
+			found = append(found, res)
+			matches = append(matches, group.Description.PluralName+"."+ref)
+		}
 	}
 
-	if len(found) > 1 {
-		keys := make([]string, 0, len(found))
-		for _, r := range found {
-			keys = append(keys, fmt.Sprintf("%s.%s", r.ResourceDescription().PluralName, key))
-		}
-		return nil, fmt.Errorf("ambiguous: %s (can resolve to all of %s)", key, keys)
+	switch len(found) {
+	case 0:
+		return nil, "", fmt.Errorf("no such resource: %s", ref)
+	case 1:
+		return found[0], ref, nil
+	default:
+		return nil, "", fmt.Errorf("ambiguous resource: %s (can resolve to %s); use a qualified name to disambiguate", ref, strings.Join(matches, ", "))
 	}
+}
 
-	return found[0], nil
+func (r *Resources) HasInternalResources() bool {
+	return len(r.Snapshots) > 0
 }
 
 // SupportedResources returns a map which keys correspond to the resource key in the bundle configuration.
 func SupportedResources() map[string]resources.ResourceDescription {
 	return map[string]resources.ResourceDescription{
-		"jobs":                    (&resources.Job{}).ResourceDescription(),
-		"pipelines":               (&resources.Pipeline{}).ResourceDescription(),
-		"models":                  (&resources.MlflowModel{}).ResourceDescription(),
-		"experiments":             (&resources.MlflowExperiment{}).ResourceDescription(),
-		"model_serving_endpoints": (&resources.ModelServingEndpoint{}).ResourceDescription(),
-		"registered_models":       (&resources.RegisteredModel{}).ResourceDescription(),
-		"quality_monitors":        (&resources.QualityMonitor{}).ResourceDescription(),
-		"catalogs":                (&resources.Catalog{}).ResourceDescription(),
-		"schemas":                 (&resources.Schema{}).ResourceDescription(),
-		"external_locations":      (&resources.ExternalLocation{}).ResourceDescription(),
-		"clusters":                (&resources.Cluster{}).ResourceDescription(),
-		"dashboards":              (&resources.Dashboard{}).ResourceDescription(),
-		"volumes":                 (&resources.Volume{}).ResourceDescription(),
-		"apps":                    (&resources.App{}).ResourceDescription(),
-		"secret_scopes":           (&resources.SecretScope{}).ResourceDescription(),
-		"alerts":                  (&resources.Alert{}).ResourceDescription(),
-		"sql_warehouses":          (&resources.SqlWarehouse{}).ResourceDescription(),
-		"database_instances":      (&resources.DatabaseInstance{}).ResourceDescription(),
-		"database_catalogs":       (&resources.DatabaseCatalog{}).ResourceDescription(),
-		"synced_database_tables":  (&resources.SyncedDatabaseTable{}).ResourceDescription(),
-		"postgres_projects":       (&resources.PostgresProject{}).ResourceDescription(),
-		"postgres_branches":       (&resources.PostgresBranch{}).ResourceDescription(),
-		"postgres_endpoints":      (&resources.PostgresEndpoint{}).ResourceDescription(),
-		"vector_search_endpoints": (&resources.VectorSearchEndpoint{}).ResourceDescription(),
+		"jobs":                         (&resources.Job{}).ResourceDescription(),
+		"job_runs":                     (&resources.JobRun{}).ResourceDescription(),
+		"pipelines":                    (&resources.Pipeline{}).ResourceDescription(),
+		"models":                       (&resources.MlflowModel{}).ResourceDescription(),
+		"experiments":                  (&resources.MlflowExperiment{}).ResourceDescription(),
+		"features":                     (&resources.Feature{}).ResourceDescription(),
+		"instance_pools":               (&resources.InstancePool{}).ResourceDescription(),
+		"model_serving_endpoints":      (&resources.ModelServingEndpoint{}).ResourceDescription(),
+		"model_services":               (&resources.ModelService{}).ResourceDescription(),
+		"mcp_services":                 (&resources.McpService{}).ResourceDescription(),
+		"model_provider_services":      (&resources.ModelProviderService{}).ResourceDescription(),
+		"registered_models":            (&resources.RegisteredModel{}).ResourceDescription(),
+		"quality_monitors":             (&resources.QualityMonitor{}).ResourceDescription(),
+		"catalogs":                     (&resources.Catalog{}).ResourceDescription(),
+		"schemas":                      (&resources.Schema{}).ResourceDescription(),
+		"external_locations":           (&resources.ExternalLocation{}).ResourceDescription(),
+		"clusters":                     (&resources.Cluster{}).ResourceDescription(),
+		"dashboards":                   (&resources.Dashboard{}).ResourceDescription(),
+		"genie_spaces":                 (&resources.GenieSpace{}).ResourceDescription(),
+		"volumes":                      (&resources.Volume{}).ResourceDescription(),
+		"apps":                         (&resources.App{}).ResourceDescription(),
+		"secret_scopes":                (&resources.SecretScope{}).ResourceDescription(),
+		"alerts":                       (&resources.Alert{}).ResourceDescription(),
+		"sql_warehouses":               (&resources.SqlWarehouse{}).ResourceDescription(),
+		"database_instances":           (&resources.DatabaseInstance{}).ResourceDescription(),
+		"database_catalogs":            (&resources.DatabaseCatalog{}).ResourceDescription(),
+		"synced_database_tables":       (&resources.SyncedDatabaseTable{}).ResourceDescription(),
+		"postgres_projects":            (&resources.PostgresProject{}).ResourceDescription(),
+		"postgres_branches":            (&resources.PostgresBranch{}).ResourceDescription(),
+		"postgres_endpoints":           (&resources.PostgresEndpoint{}).ResourceDescription(),
+		"postgres_catalogs":            (&resources.PostgresCatalog{}).ResourceDescription(),
+		"postgres_databases":           (&resources.PostgresDatabase{}).ResourceDescription(),
+		"postgres_roles":               (&resources.PostgresRole{}).ResourceDescription(),
+		"postgres_synced_tables":       (&resources.PostgresSyncedTable{}).ResourceDescription(),
+		"postgres_snapshot_schedules":  (&resources.PostgresSnapshotSchedule{}).ResourceDescription(),
+		"vector_search_endpoints":      (&resources.VectorSearchEndpoint{}).ResourceDescription(),
+		"vector_search_indexes":        (&resources.VectorSearchIndex{}).ResourceDescription(),
+		"internal_immutable_snapshots": (&resources.Snapshot{}).ResourceDescription(),
+		"secrets":                      (&resources.Secret{}).ResourceDescription(),
+		"cluster_policies":             (&resources.ClusterPolicy{}).ResourceDescription(),
 	}
 }
diff --git a/bundle/config/resources/alerts.go b/bundle/config/resources/alerts.go
index 628302c4e3b..4416873d526 100644
--- a/bundle/config/resources/alerts.go
+++ b/bundle/config/resources/alerts.go
@@ -13,7 +13,8 @@ import (
 
 type Alert struct {
 	BaseResource
-	sql.AlertV2 //nolint AlertV2 also defines Id and URL field with the same json tag "id" and "url"
+	sql.AlertV2        //nolint:govet // AlertV2.Id and our depth-0 ID field both carry json:"id"; the depth-0 field wins
+	ID          string `json:"id,omitempty" bundle:"readonly"`
 
 	Permissions []Permission `json:"permissions,omitempty"`
 
@@ -59,7 +60,3 @@ func (a *Alert) InitializeURL(baseURL url.URL) {
 func (a *Alert) GetName() string {
 	return a.DisplayName
 }
-
-func (a *Alert) GetURL() string {
-	return a.URL
-}
diff --git a/bundle/config/resources/apps.go b/bundle/config/resources/apps.go
index 75d5cac0fd1..76acbb29a96 100644
--- a/bundle/config/resources/apps.go
+++ b/bundle/config/resources/apps.go
@@ -35,25 +35,25 @@ type AppEnvVar struct {
 
 type App struct {
 	BaseResource
-	apps.App // nolint App struct also defines Id and URL field with the same json tag "id" and "url"
+	apps.App        //nolint:govet // apps.App.{Id,Url} and our depth-0 {ID,URL} fields carry the same json names; the depth-0 fields win
+	ID       string `json:"id,omitempty" bundle:"readonly"`
+	URL      string `json:"url,omitempty" bundle:"internal"`
+
 	// Note: apps.App already includes GitRepository field from the SDK
 
 	// Lifecycle shadows BaseResource.Lifecycle to add support for lifecycle.started.
 	Lifecycle *LifecycleWithStarted `json:"lifecycle,omitempty"`
 
-	// SourceCodePath is a required field used by DABs to point to Databricks app source code
-	// on local disk and to the corresponding workspace path during app deployment.
-	SourceCodePath string `json:"source_code_path,omitempty"`
+	// SourceCodePath and GitSource come from the embedded apps.App. DABs treats them as
+	// deploy-only: source_code_path points at app source on local disk and is translated to
+	// its workspace path, and both are passed to the Deploy API rather than sent as resource
+	// attributes. Declaring them here too would duplicate their json tags and break diffing.
 
 	// Config represents inline app.yaml configuration for the app.
 	// When specified, this configuration is written to an app.yaml file in the source code path during deployment.
 	// This allows users to define app configuration directly in the bundle YAML instead of maintaining a separate app.yaml file.
 	Config *AppConfig `json:"config,omitempty"`
 
-	// GitSource specifies the git reference (branch, tag, or commit) to use during deployment.
-	// This is used in conjunction with GitRepository (from apps.App) and is passed to the Deploy API.
-	GitSource *apps.GitSource `json:"git_source,omitempty"`
-
 	Permissions []AppPermission `json:"permissions,omitempty"`
 }
 
@@ -105,7 +105,3 @@ func (a *App) GetName() string {
 	}
 	return a.Name
 }
-
-func (a *App) GetURL() string {
-	return a.URL
-}
diff --git a/bundle/config/resources/base.go b/bundle/config/resources/base.go
index ceeb1f0b869..03406bfa843 100644
--- a/bundle/config/resources/base.go
+++ b/bundle/config/resources/base.go
@@ -2,9 +2,8 @@ package resources
 
 // BaseResource is a struct that contains the base settings for a resource.
 type BaseResource struct {
-	ID             string         `json:"id,omitempty" bundle:"readonly"`
-	ModifiedStatus ModifiedStatus `json:"modified_status,omitempty" bundle:"internal"`
 	URL            string         `json:"url,omitempty" bundle:"internal"`
+	ModifiedStatus ModifiedStatus `json:"modified_status,omitempty" bundle:"internal"`
 	Lifecycle      Lifecycle      `json:"lifecycle,omitempty"`
 }
 
@@ -12,3 +11,9 @@ type BaseResource struct {
 func (b *BaseResource) GetLifecycle() LifecycleConfig {
 	return b.Lifecycle
 }
+
+// GetURL returns the resource's workspace URL and true. Resource types whose
+// IDs don't map to a web UI page override this to return ("", false).
+func (b *BaseResource) GetURL() (string, bool) {
+	return b.URL, true
+}
diff --git a/bundle/config/resources/catalog.go b/bundle/config/resources/catalog.go
index d558f127f5c..3fc4a5c89dc 100644
--- a/bundle/config/resources/catalog.go
+++ b/bundle/config/resources/catalog.go
@@ -3,7 +3,6 @@ package resources
 import (
 	"context"
 	"net/url"
-	"strings"
 
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/apierr"
@@ -11,10 +10,12 @@ import (
 	"github.com/databricks/databricks-sdk-go/service/catalog"
 
 	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/workspaceurls"
 )
 
 type Catalog struct {
 	BaseResource
+	ID string `json:"id,omitempty" bundle:"readonly"`
 	catalog.CreateCatalog
 
 	// List of grants to apply on this catalog.
@@ -48,12 +49,7 @@ func (c *Catalog) InitializeURL(baseURL url.URL) {
 	if c.ID == "" {
 		return
 	}
-	baseURL.Path = "explore/data/" + strings.ReplaceAll(c.ID, ".", "/")
-	c.URL = baseURL.String()
-}
-
-func (c *Catalog) GetURL() string {
-	return c.URL
+	c.URL = workspaceurls.ResourceURL(baseURL, "catalogs", c.ID)
 }
 
 func (c *Catalog) GetName() string {
diff --git a/bundle/config/resources/cluster_policy.go b/bundle/config/resources/cluster_policy.go
new file mode 100644
index 00000000000..8315c5b8b90
--- /dev/null
+++ b/bundle/config/resources/cluster_policy.go
@@ -0,0 +1,66 @@
+package resources
+
+import (
+	"context"
+	"net/url"
+
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/workspaceurls"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/marshal"
+	"github.com/databricks/databricks-sdk-go/service/compute"
+)
+
+type ClusterPolicy struct {
+	BaseResource
+	ID string `json:"id,omitempty" bundle:"readonly"`
+	compute.CreatePolicy
+
+	// Shadows the embedded compute.CreatePolicy.Definition (a string). `any` lets the
+	// definition be authored as inline YAML; ConfigureClusterPolicyDefinition normalizes
+	// it to a JSON string before deploy.
+	Definition any `json:"definition,omitempty"`
+
+	// Shadows the embedded compute.CreatePolicy.PolicyFamilyDefinitionOverrides (a string),
+	// same as Definition: also a policy document authorable as inline YAML.
+	PolicyFamilyDefinitionOverrides any `json:"policy_family_definition_overrides,omitempty"`
+
+	Permissions []ClusterPolicyPermission `json:"permissions,omitempty"`
+}
+
+func (s *ClusterPolicy) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, s)
+}
+
+func (s ClusterPolicy) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(s)
+}
+
+func (s *ClusterPolicy) Exists(ctx context.Context, w *databricks.WorkspaceClient, id string) (bool, error) {
+	_, err := w.ClusterPolicies.GetByPolicyId(ctx, id)
+	if err != nil {
+		log.Debugf(ctx, "cluster policy %s does not exist", id)
+		return false, err
+	}
+	return true, nil
+}
+
+func (*ClusterPolicy) ResourceDescription() ResourceDescription {
+	return ResourceDescription{
+		SingularName:  "cluster_policy",
+		PluralName:    "cluster_policies",
+		SingularTitle: "Cluster Policy",
+		PluralTitle:   "Cluster Policies",
+	}
+}
+
+func (s *ClusterPolicy) InitializeURL(baseURL url.URL) {
+	if s.ID == "" {
+		return
+	}
+	s.URL = workspaceurls.ResourceURL(baseURL, "cluster_policies", s.ID)
+}
+
+func (s *ClusterPolicy) GetName() string {
+	return s.Name
+}
diff --git a/bundle/config/resources/clusters.go b/bundle/config/resources/clusters.go
index 5eb8dc57378..75b8f66b93d 100644
--- a/bundle/config/resources/clusters.go
+++ b/bundle/config/resources/clusters.go
@@ -13,11 +13,26 @@ import (
 
 type Cluster struct {
 	BaseResource
+	ID string `json:"id,omitempty" bundle:"readonly"`
 	compute.ClusterSpec
 
+	// Lifecycle shadows BaseResource.Lifecycle to add support for lifecycle.started.
+	Lifecycle *LifecycleWithStarted `json:"lifecycle,omitempty"`
+
+	// Libraries are installed via the Libraries API, not the cluster spec.
+	Libraries []compute.Library `json:"libraries,omitempty"`
+
 	Permissions []ClusterPermission `json:"permissions,omitempty"`
 }
 
+// GetLifecycle returns the lifecycle settings, using LifecycleWithStarted.
+func (s *Cluster) GetLifecycle() LifecycleConfig {
+	if s.Lifecycle == nil {
+		return LifecycleWithStarted{}
+	}
+	return *s.Lifecycle
+}
+
 func (s *Cluster) UnmarshalJSON(b []byte) error {
 	return marshal.Unmarshal(b, s)
 }
@@ -54,7 +69,3 @@ func (s *Cluster) InitializeURL(baseURL url.URL) {
 func (s *Cluster) GetName() string {
 	return s.ClusterName
 }
-
-func (s *Cluster) GetURL() string {
-	return s.URL
-}
diff --git a/bundle/config/resources/dashboard.go b/bundle/config/resources/dashboard.go
index 61238149371..16b3229ed16 100644
--- a/bundle/config/resources/dashboard.go
+++ b/bundle/config/resources/dashboard.go
@@ -78,6 +78,7 @@ func (c DashboardConfig) MarshalJSON() ([]byte, error) {
 
 type Dashboard struct {
 	BaseResource
+	ID string `json:"id,omitempty" bundle:"readonly"`
 	DashboardConfig
 
 	Permissions []Permission `json:"permissions,omitempty"`
@@ -89,6 +90,14 @@ type Dashboard struct {
 	FilePath string `json:"file_path,omitempty"`
 }
 
+func (r *Dashboard) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, r)
+}
+
+func (r Dashboard) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(r)
+}
+
 func (*Dashboard) Exists(ctx context.Context, w *databricks.WorkspaceClient, id string) (bool, error) {
 	_, err := w.Lakeview.Get(ctx, dashboards.GetDashboardRequest{
 		DashboardId: id,
@@ -120,7 +129,3 @@ func (r *Dashboard) InitializeURL(baseURL url.URL) {
 func (r *Dashboard) GetName() string {
 	return r.DisplayName
 }
-
-func (r *Dashboard) GetURL() string {
-	return r.URL
-}
diff --git a/bundle/config/resources/dashboard_test.go b/bundle/config/resources/dashboard_test.go
index c010d949157..83c80b17107 100644
--- a/bundle/config/resources/dashboard_test.go
+++ b/bundle/config/resources/dashboard_test.go
@@ -29,8 +29,7 @@ func TestDashboardConfigIsSupersetOfSDKDashboard(t *testing.T) {
 
 	// Create a map of SDK fields by name and their JSON tags
 	sdkFields := make(map[string]string)
-	for i := range sdkType.NumField() {
-		field := sdkType.Field(i)
+	for field := range sdkType.Fields() {
 		jsonTag := field.Tag.Get("json")
 		jsonName := getJSONTagName(jsonTag)
 		if jsonName != "" {
@@ -40,8 +39,7 @@ func TestDashboardConfigIsSupersetOfSDKDashboard(t *testing.T) {
 
 	// Create a map of config fields by name and their JSON tags
 	configFields := make(map[string]string)
-	for i := range configType.NumField() {
-		field := configType.Field(i)
+	for field := range configType.Fields() {
 		jsonTag := field.Tag.Get("json")
 		jsonName := getJSONTagName(jsonTag)
 		if jsonName != "" {
diff --git a/bundle/config/resources/database_catalog.go b/bundle/config/resources/database_catalog.go
index 0de0fa45715..c1c0b86bd24 100644
--- a/bundle/config/resources/database_catalog.go
+++ b/bundle/config/resources/database_catalog.go
@@ -5,16 +5,27 @@ import (
 	"net/url"
 
 	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/workspaceurls"
 
 	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/marshal"
 	"github.com/databricks/databricks-sdk-go/service/database"
 )
 
 type DatabaseCatalog struct {
 	BaseResource
+	ID string `json:"id,omitempty" bundle:"readonly"`
 	database.DatabaseCatalog
 }
 
+func (d *DatabaseCatalog) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, d)
+}
+
+func (d DatabaseCatalog) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(d)
+}
+
 func (d *DatabaseCatalog) Exists(ctx context.Context, w *databricks.WorkspaceClient, name string) (bool, error) {
 	_, err := w.Database.GetDatabaseCatalog(ctx, database.GetDatabaseCatalogRequest{Name: name})
 	if err != nil {
@@ -37,14 +48,9 @@ func (d *DatabaseCatalog) GetName() string {
 	return d.Name
 }
 
-func (d *DatabaseCatalog) GetURL() string {
-	return d.URL
-}
-
 func (d *DatabaseCatalog) InitializeURL(baseURL url.URL) {
 	if d.Name == "" {
 		return
 	}
-	baseURL.Path = "explore/data/" + d.Name
-	d.URL = baseURL.String()
+	d.URL = workspaceurls.ResourceURL(baseURL, "database_catalogs", d.Name)
 }
diff --git a/bundle/config/resources/database_instance.go b/bundle/config/resources/database_instance.go
index 2ba19b84f41..5d4abf5a27a 100644
--- a/bundle/config/resources/database_instance.go
+++ b/bundle/config/resources/database_instance.go
@@ -5,18 +5,29 @@ import (
 	"net/url"
 
 	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/workspaceurls"
 
 	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/marshal"
 	"github.com/databricks/databricks-sdk-go/service/database"
 )
 
 type DatabaseInstance struct {
 	BaseResource
+	ID string `json:"id,omitempty" bundle:"readonly"`
 	database.DatabaseInstance
 
 	Permissions []Permission `json:"permissions,omitempty"`
 }
 
+func (d *DatabaseInstance) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, d)
+}
+
+func (d DatabaseInstance) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(d)
+}
+
 func (d *DatabaseInstance) Exists(ctx context.Context, w *databricks.WorkspaceClient, name string) (bool, error) {
 	_, err := w.Database.GetDatabaseInstance(ctx, database.GetDatabaseInstanceRequest{Name: name})
 	if err != nil {
@@ -39,10 +50,6 @@ func (d *DatabaseInstance) GetName() string {
 	return d.Name
 }
 
-func (d *DatabaseInstance) GetURL() string {
-	return d.URL
-}
-
 func (d *DatabaseInstance) InitializeURL(baseURL url.URL) {
 	if d.ModifiedStatus == ModifiedStatusCreated {
 		return
@@ -50,6 +57,5 @@ func (d *DatabaseInstance) InitializeURL(baseURL url.URL) {
 	if d.Name == "" {
 		return
 	}
-	baseURL.Path = "compute/database-instances/" + d.Name
-	d.URL = baseURL.String()
+	d.URL = workspaceurls.ResourceURL(baseURL, "database_instances", d.Name)
 }
diff --git a/bundle/config/resources/external_location.go b/bundle/config/resources/external_location.go
index cc413de84f3..5d9a52a1b75 100644
--- a/bundle/config/resources/external_location.go
+++ b/bundle/config/resources/external_location.go
@@ -53,9 +53,9 @@ func (e *ExternalLocation) InitializeURL(baseURL url.URL) {
 	// The Url field is for the storage path (s3://...), not a workspace URL
 }
 
-func (e *ExternalLocation) GetURL() string {
-	// Return empty as external locations don't have a workspace URL
-	return ""
+func (e *ExternalLocation) GetURL() (string, bool) {
+	// External locations don't have a workspace URL
+	return "", false
 }
 
 func (e *ExternalLocation) GetName() string {
diff --git a/bundle/config/resources/external_location_test.go b/bundle/config/resources/external_location_test.go
index 01b792e048b..af1b78e8d64 100644
--- a/bundle/config/resources/external_location_test.go
+++ b/bundle/config/resources/external_location_test.go
@@ -55,9 +55,7 @@ func TestExternalLocationResourceDescription(t *testing.T) {
 
 func TestExternalLocationGetName(t *testing.T) {
 	el := &ExternalLocation{
-		CreateExternalLocation: catalog.CreateExternalLocation{
-			Name: "my_location",
-		},
+		Name: "my_location",
 	}
 
 	assert.Equal(t, "my_location", el.GetName())
diff --git a/bundle/config/resources/feature.go b/bundle/config/resources/feature.go
new file mode 100644
index 00000000000..05d27624a2e
--- /dev/null
+++ b/bundle/config/resources/feature.go
@@ -0,0 +1,68 @@
+package resources
+
+import (
+	"context"
+	"net/url"
+
+	"github.com/databricks/databricks-sdk-go/apierr"
+
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/workspaceurls"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/marshal"
+	"github.com/databricks/databricks-sdk-go/service/ml"
+)
+
+type Feature struct {
+	BaseResource
+	ID string `json:"id,omitempty" bundle:"readonly"`
+	ml.Feature
+}
+
+func (f *Feature) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, f)
+}
+
+func (f Feature) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(f)
+}
+
+func (f *Feature) Exists(ctx context.Context, w *databricks.WorkspaceClient, fullName string) (bool, error) {
+	_, err := w.FeatureEngineering.GetFeature(ctx, ml.GetFeatureRequest{
+		FullName: fullName,
+	})
+	if err != nil {
+		log.Debugf(ctx, "feature with full name %s does not exist: %v", fullName, err)
+
+		if apierr.IsMissing(err) {
+			return false, nil
+		}
+
+		return false, err
+	}
+
+	return true, nil
+}
+
+func (*Feature) ResourceDescription() ResourceDescription {
+	return ResourceDescription{
+		SingularName:  "feature",
+		PluralName:    "features",
+		SingularTitle: "Feature",
+		PluralTitle:   "Features",
+	}
+}
+
+func (f *Feature) InitializeURL(baseURL url.URL) {
+	if f.ID == "" {
+		return
+	}
+	f.URL = workspaceurls.ResourceURL(baseURL, "features", f.ID)
+}
+
+// GetName returns the fully qualified name. Callers read it off the config, which only ever carries
+// what the user wrote plus id and modified_status (see statemgmt.StateToBundle), so the OUTPUT_ONLY
+// name field is always empty here.
+func (f *Feature) GetName() string {
+	return f.FullName
+}
diff --git a/bundle/config/resources/genie_space.go b/bundle/config/resources/genie_space.go
new file mode 100644
index 00000000000..3d60fa01a58
--- /dev/null
+++ b/bundle/config/resources/genie_space.go
@@ -0,0 +1,107 @@
+package resources
+
+import (
+	"context"
+	"net/url"
+
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/workspaceurls"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/marshal"
+	"github.com/databricks/databricks-sdk-go/service/dashboards"
+)
+
+type GenieSpaceConfig struct {
+	// Description of the Genie Space
+	Description string `json:"description,omitempty"`
+	// Etag for change detection. The bundle persists the value the backend
+	// returned on the last Create/Update and uses it both as an If-Match for
+	// the next Update and as the signal for `bundle plan` to detect remote
+	// drift (see OverrideChangeDesc in bundle/direct/dresources/genie_space.go).
+	// Mirrors dashboards.DashboardConfig.Etag.
+	Etag string `json:"etag,omitempty"`
+	// Title of the Genie Space
+	Title string `json:"title,omitempty"`
+	// Warehouse associated with the Genie Space
+	WarehouseId string `json:"warehouse_id,omitempty"`
+	// Parent folder path where the space will be registered
+	ParentPath string `json:"parent_path,omitempty"`
+
+	ForceSendFields []string `json:"-" url:"-"`
+
+	// ==============================================
+	// === overrides over [dashboards.GenieSpace] ===
+	// ==============================================
+
+	// SerializedSpace holds the contents of the Genie Space in serialized JSON form.
+	// Even though the SDK represents this as a string, we override it as any to allow for inlining as YAML.
+	// If the value is a string, it is used as is.
+	// If it is not a string, its contents is marshalled as JSON.
+	SerializedSpace any `json:"serialized_space,omitempty"`
+}
+
+func (c *GenieSpaceConfig) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, c)
+}
+
+func (c GenieSpaceConfig) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(c)
+}
+
+type GenieSpace struct {
+	BaseResource
+	ID string `json:"id,omitempty" bundle:"readonly"`
+	GenieSpaceConfig
+
+	Permissions []Permission `json:"permissions,omitempty"`
+
+	// FilePath points to the local `.geniespace.json` file containing the Genie Space definition.
+	// This is inlined into serialized_space during deployment. The file_path is kept around
+	// as metadata which is needed for `databricks bundle generate genie-space --resource <key>` to work.
+	// This is not part of GenieSpaceConfig because we don't need to store this in the resource state.
+	FilePath string `json:"file_path,omitempty"`
+}
+
+func (r *GenieSpace) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, r)
+}
+
+func (r GenieSpace) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(r)
+}
+
+func (*GenieSpace) Exists(ctx context.Context, w *databricks.WorkspaceClient, id string) (bool, error) {
+	_, err := w.Genie.GetSpace(ctx, dashboards.GenieGetSpaceRequest{
+		SpaceId: id,
+	})
+	if err != nil {
+		if apierr.IsMissing(err) {
+			log.Debugf(ctx, "genie space %s does not exist", id)
+			return false, nil
+		}
+		return false, err
+	}
+	return true, nil
+}
+
+func (*GenieSpace) ResourceDescription() ResourceDescription {
+	return ResourceDescription{
+		SingularName:  "genie_space",
+		PluralName:    "genie_spaces",
+		SingularTitle: "Genie Space",
+		PluralTitle:   "Genie Spaces",
+	}
+}
+
+func (r *GenieSpace) InitializeURL(baseURL url.URL) {
+	if r.ID == "" {
+		return
+	}
+
+	r.URL = workspaceurls.ResourceURL(baseURL, "genie_spaces", r.ID)
+}
+
+func (r *GenieSpace) GetName() string {
+	return r.Title
+}
diff --git a/bundle/config/resources/instance_pools.go b/bundle/config/resources/instance_pools.go
new file mode 100644
index 00000000000..81c9a75e166
--- /dev/null
+++ b/bundle/config/resources/instance_pools.go
@@ -0,0 +1,56 @@
+package resources
+
+import (
+	"context"
+	"net/url"
+
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/workspaceurls"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/marshal"
+	"github.com/databricks/databricks-sdk-go/service/compute"
+)
+
+type InstancePool struct {
+	BaseResource
+	ID string `json:"id,omitempty" bundle:"readonly"`
+	compute.CreateInstancePool
+	Permissions []InstancePoolPermission `json:"permissions,omitempty"`
+}
+
+func (s *InstancePool) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, s)
+}
+
+func (s InstancePool) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(s)
+}
+
+func (s *InstancePool) Exists(ctx context.Context, w *databricks.WorkspaceClient, id string) (bool, error) {
+	_, err := w.InstancePools.GetByInstancePoolId(ctx, id)
+	if err != nil {
+		log.Debugf(ctx, "instance pool %s does not exist", id)
+		return false, err
+	}
+	return true, nil
+}
+
+func (*InstancePool) ResourceDescription() ResourceDescription {
+	return ResourceDescription{
+		SingularName:  "instance_pool",
+		PluralName:    "instance_pools",
+		SingularTitle: "Instance Pool",
+		PluralTitle:   "Instance Pools",
+	}
+}
+
+func (s *InstancePool) InitializeURL(baseURL url.URL) {
+	if s.ID == "" {
+		return
+	}
+	s.URL = workspaceurls.ResourceURL(baseURL, "instance_pools", s.ID)
+}
+
+func (s *InstancePool) GetName() string {
+	return s.InstancePoolName
+}
diff --git a/bundle/config/resources/job.go b/bundle/config/resources/job.go
index 646750ef859..5d62c511791 100644
--- a/bundle/config/resources/job.go
+++ b/bundle/config/resources/job.go
@@ -14,6 +14,7 @@ import (
 
 type Job struct {
 	BaseResource
+	ID string `json:"id,omitempty" bundle:"readonly"`
 	jobs.JobSettings
 
 	Permissions []JobPermission `json:"permissions,omitempty"`
@@ -61,7 +62,3 @@ func (j *Job) InitializeURL(baseURL url.URL) {
 func (j *Job) GetName() string {
 	return j.Name
 }
-
-func (j *Job) GetURL() string {
-	return j.URL
-}
diff --git a/bundle/config/resources/job_run.go b/bundle/config/resources/job_run.go
new file mode 100644
index 00000000000..ff9a91a8899
--- /dev/null
+++ b/bundle/config/resources/job_run.go
@@ -0,0 +1,143 @@
+package resources
+
+import (
+	"context"
+	"net/url"
+	"strconv"
+
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/workspaceurls"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/marshal"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+)
+
+// JobRun is the bundle config for a triggered job run, described by the same
+// fields as the Jobs RunNow request (embedded). By default it re-fires when its
+// own configuration changes; lifecycle.triggers can add further conditions.
+type JobRun struct {
+	BaseResource
+	ID string `json:"id,omitempty" bundle:"readonly"`
+	jobs.RunNow
+
+	// Lifecycle shadows BaseResource.Lifecycle so job_runs can set triggers.
+	Lifecycle *JobRunLifecycle `json:"lifecycle,omitempty"`
+
+	// ResolvedJobID holds the run's job_id loaded from state, used only to build
+	// the run URL. Keeping it separate from RunNow.JobId (a ${resources.jobs.*.id}
+	// reference) lets state loading preserve that reference and its plan dependency.
+	ResolvedJobID int64 `json:"resolved_job_id,omitempty" bundle:"internal"`
+}
+
+// JobRunLifecycle extends Lifecycle with run-fire triggers.
+type JobRunLifecycle struct {
+	Lifecycle
+
+	// Triggers that cause the run to re-fire (in addition to config changes).
+	Triggers []JobRunTrigger `json:"triggers,omitempty"`
+
+	// Resolved fingerprint for the planner; not user config.
+	TriggersState *JobRunTriggersState `json:"triggers_state,omitempty" bundle:"internal"`
+}
+
+// JobRunTrigger is one lifecycle.triggers entry.
+type JobRunTrigger struct {
+	OnBundleDeploy *bool   `json:"on_bundle_deploy,omitempty"`
+	OnFileChange   *string `json:"on_file_change,omitempty"` // path or glob relative to the defining YAML file; must resolve under the sync root
+}
+
+// JobRunTriggersState is the resolved fingerprint of lifecycle.triggers.
+type JobRunTriggersState struct {
+	OnBundleDeploy string            `json:"on_bundle_deploy,omitempty"`
+	OnFileChange   map[string]string `json:"on_file_change,omitempty"`
+}
+
+// IsEmpty reports whether no trigger is armed. An empty state is left off the
+// job run entirely, so this has to cover every field above: a new fingerprint
+// added without extending it would be dropped instead of persisted.
+func (s JobRunTriggersState) IsEmpty() bool {
+	return s.OnBundleDeploy == "" && len(s.OnFileChange) == 0
+}
+
+// HasOnBundleDeploy reports whether any trigger re-fires on every deploy.
+func (r *JobRun) HasOnBundleDeploy() bool {
+	if r.Lifecycle == nil {
+		return false
+	}
+	for _, t := range r.Lifecycle.Triggers {
+		if t.OnBundleDeploy != nil && *t.OnBundleDeploy {
+			return true
+		}
+	}
+	return false
+}
+
+// HasOnFileChange reports whether any trigger re-fires when matched files change.
+func (r *JobRun) HasOnFileChange() bool {
+	if r.Lifecycle == nil {
+		return false
+	}
+	for _, t := range r.Lifecycle.Triggers {
+		if t.OnFileChange != nil {
+			return true
+		}
+	}
+	return false
+}
+
+func (r *JobRun) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, r)
+}
+
+func (r JobRun) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(r)
+}
+
+// Exists reports whether the run with the given numeric id still exists, for as
+// long as the workspace retains its run history.
+func (r *JobRun) Exists(ctx context.Context, w *databricks.WorkspaceClient, id string) (bool, error) {
+	runID, err := strconv.ParseInt(id, 10, 64)
+	if err != nil {
+		return false, err
+	}
+	_, err = w.Jobs.GetRun(ctx, jobs.GetRunRequest{
+		RunId: runID,
+	})
+	if err != nil {
+		log.Debugf(ctx, "job run %s does not exist: %v", id, err)
+		if apierr.IsMissing(err) {
+			return false, nil
+		}
+		return false, err
+	}
+	return true, nil
+}
+
+func (r *JobRun) ResourceDescription() ResourceDescription {
+	return ResourceDescription{
+		SingularName:  "job_run",
+		PluralName:    "job_runs",
+		SingularTitle: "Job Run",
+		PluralTitle:   "Job Runs",
+	}
+}
+
+// GetName returns the in-product name, which is empty: a run has no name.
+func (r *JobRun) GetName() string {
+	return ""
+}
+
+// InitializeURL sets the run's workspace URL. The job id comes from RunNow.JobId
+// when resolved (deploy) or ResolvedJobID from state (read-only commands); if
+// either id is missing we skip rather than emit a broken jobs/0 URL.
+func (r *JobRun) InitializeURL(baseURL url.URL) {
+	jobID := r.JobId
+	if jobID == 0 {
+		jobID = r.ResolvedJobID
+	}
+	if r.ID == "" || jobID == 0 {
+		return
+	}
+	r.URL = workspaceurls.JobRunURL(baseURL, strconv.FormatInt(jobID, 10), r.ID)
+}
diff --git a/bundle/config/resources/lifecycle.go b/bundle/config/resources/lifecycle.go
index db2b130d313..b7f0d55ec72 100644
--- a/bundle/config/resources/lifecycle.go
+++ b/bundle/config/resources/lifecycle.go
@@ -9,6 +9,12 @@ type LifecycleConfig interface {
 type Lifecycle struct {
 	// Lifecycle setting to prevent the resource from being destroyed.
 	PreventDestroy bool `json:"prevent_destroy,omitempty"`
+
+	// ForceSendFields records which fields were explicitly set so that zero-value
+	// overrides can replace non-zero base values (e.g., prevent_destroy: false in a target
+	// can override prevent_destroy: true in the base).
+	// This field is not serialized to JSON.
+	ForceSendFields []string `json:"-"`
 }
 
 // HasPreventDestroy returns true if prevent_destroy is set.
diff --git a/bundle/config/resources/mcp_service.go b/bundle/config/resources/mcp_service.go
new file mode 100644
index 00000000000..1ca5ce86901
--- /dev/null
+++ b/bundle/config/resources/mcp_service.go
@@ -0,0 +1,103 @@
+package resources
+
+import (
+	"context"
+	"net/url"
+
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/workspaceurls"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/marshal"
+	"github.com/databricks/databricks-sdk-go/service/catalog"
+)
+
+// McpServiceConfig is the bundle-authored state for an AI Gateway MCP service.
+//
+// It mirrors ModelServiceConfig: the SDK models the create inputs `parent` and
+// `mcp_service_id` as URL parameters (`json:"-"`) outside the McpService body
+// and derives the resource `name`
+// (`mcp-services/{catalog}.{schema}.{mcp_service}`) server-side, so we expose a
+// flat struct with the immutable identity plus the mutable body. Owner is not
+// exposed yet (the API returns effective_owner on read, not owner).
+type McpServiceConfig struct {
+	// Parent schema, format `schemas/{catalog}.{schema}`. Immutable: the server
+	// derives `name` from parent + mcp_service_id, so changing it recreates the
+	// resource.
+	Parent string `json:"parent"`
+	// Leaf id of the MCP service, e.g. "my_mcp_service". Immutable.
+	McpServiceId string `json:"mcp_service_id"`
+	// User-provided description.
+	Comment string `json:"comment,omitempty"`
+	// Operational configuration: source connection, tool selectors, rate limit.
+	Config *catalog.McpServiceConfig `json:"config,omitempty"`
+
+	ForceSendFields []string `json:"-" url:"-"`
+}
+
+func (c *McpServiceConfig) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, c)
+}
+
+func (c McpServiceConfig) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(c)
+}
+
+type McpService struct {
+	BaseResource
+	ID string `json:"id,omitempty" bundle:"readonly"`
+	McpServiceConfig
+
+	// List of grants to apply on this MCP service. Grants are applied via the
+	// permissions API (the `.grants` sub-resource), not the MCP-service body, so
+	// this field lives on the wrapper and stays out of the diffed state that
+	// PrepareState returns (the embedded McpServiceConfig).
+	Grants []catalog.PrivilegeAssignment `json:"grants,omitempty"`
+}
+
+// UnmarshalJSON / MarshalJSON are defined on the wrapper so it does not inherit
+// McpServiceConfig's promoted marshaler, which would silently drop the
+// BaseResource fields (id, url, lifecycle, modified_status).
+func (m *McpService) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, m)
+}
+
+func (m McpService) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(m)
+}
+
+func (m *McpService) Exists(ctx context.Context, w *databricks.WorkspaceClient, id string) (bool, error) {
+	// The engine tracks the id as the bare {catalog}.{schema}.{mcp_service};
+	// the API addresses the resource by its full name.
+	_, err := w.AiGateway.GetMcpService(ctx, catalog.GetMcpServiceRequest{Name: "mcp-services/" + id})
+	if err != nil {
+		log.Debugf(ctx, "mcp service %s does not exist", id)
+		if apierr.IsMissing(err) {
+			return false, nil
+		}
+		return false, err
+	}
+	return true, nil
+}
+
+func (*McpService) ResourceDescription() ResourceDescription {
+	return ResourceDescription{
+		SingularName:  "mcp_service",
+		PluralName:    "mcp_services",
+		SingularTitle: "MCP service",
+		PluralTitle:   "MCP services",
+	}
+}
+
+func (m *McpService) InitializeURL(baseURL url.URL) {
+	if m.ID == "" {
+		return
+	}
+	// The id is the bare {catalog}.{schema}.{mcp_service}; ResourceURL splits it
+	// into the Catalog Explorer path explore/data/mcp-services/...
+	m.URL = workspaceurls.ResourceURL(baseURL, "mcp_services", m.ID)
+}
+
+func (m *McpService) GetName() string {
+	return m.McpServiceId
+}
diff --git a/bundle/config/resources/mlflow_experiment.go b/bundle/config/resources/mlflow_experiment.go
index c7db059bc8b..965a3ca55ff 100644
--- a/bundle/config/resources/mlflow_experiment.go
+++ b/bundle/config/resources/mlflow_experiment.go
@@ -13,6 +13,7 @@ import (
 
 type MlflowExperiment struct {
 	BaseResource
+	ID string `json:"id,omitempty" bundle:"readonly"`
 	ml.CreateExperiment
 
 	Permissions []MlflowExperimentPermission `json:"permissions,omitempty"`
@@ -56,7 +57,3 @@ func (s *MlflowExperiment) InitializeURL(baseURL url.URL) {
 func (s *MlflowExperiment) GetName() string {
 	return s.Name
 }
-
-func (s *MlflowExperiment) GetURL() string {
-	return s.URL
-}
diff --git a/bundle/config/resources/mlflow_model.go b/bundle/config/resources/mlflow_model.go
index c153e2d95e9..f7bbcd96e7a 100644
--- a/bundle/config/resources/mlflow_model.go
+++ b/bundle/config/resources/mlflow_model.go
@@ -13,6 +13,7 @@ import (
 
 type MlflowModel struct {
 	BaseResource
+	ID string `json:"id,omitempty" bundle:"readonly"`
 	ml.CreateModelRequest
 
 	Permissions []MlflowModelPermission `json:"permissions,omitempty"`
@@ -56,7 +57,3 @@ func (s *MlflowModel) InitializeURL(baseURL url.URL) {
 func (s *MlflowModel) GetName() string {
 	return s.Name
 }
-
-func (s *MlflowModel) GetURL() string {
-	return s.URL
-}
diff --git a/bundle/config/resources/model_provider_service.go b/bundle/config/resources/model_provider_service.go
new file mode 100644
index 00000000000..20bf48c5539
--- /dev/null
+++ b/bundle/config/resources/model_provider_service.go
@@ -0,0 +1,111 @@
+package resources
+
+import (
+	"context"
+	"net/url"
+
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/workspaceurls"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/marshal"
+	"github.com/databricks/databricks-sdk-go/service/catalog"
+)
+
+// ModelProviderServiceConfig is the bundle-authored state for an AI Gateway
+// model provider service.
+//
+// It mirrors ModelServiceConfig: the SDK models the create inputs `parent` and
+// `model_provider_service_id` as URL parameters (`json:"-"`) outside the
+// ModelProviderService body and derives the resource `name`
+// (`model-provider-services/{catalog}.{schema}.{model_provider_service}`)
+// server-side, so we expose a flat struct with the immutable identity plus the
+// mutable body. Owner is not exposed yet (the API returns effective_owner on
+// read, not owner).
+//
+// Note: config.provider_type is immutable after create (the API rejects
+// changing it via Update); it is classified recreate_on_changes in
+// resources.yml.
+type ModelProviderServiceConfig struct {
+	// Parent schema, format `schemas/{catalog}.{schema}`. Immutable: the server
+	// derives `name` from parent + model_provider_service_id, so changing it
+	// recreates the resource.
+	Parent string `json:"parent"`
+	// Leaf id of the model provider service, e.g. "openai_prod". Immutable.
+	ModelProviderServiceId string `json:"model_provider_service_id"`
+	// User-provided description.
+	Comment string `json:"comment,omitempty"`
+	// Behavioral configuration: provider connection, model catalog, passthrough
+	// policy. config.provider_type is required at create and immutable after.
+	Config *catalog.ModelProviderServiceConfig `json:"config,omitempty"`
+
+	ForceSendFields []string `json:"-" url:"-"`
+}
+
+func (c *ModelProviderServiceConfig) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, c)
+}
+
+func (c ModelProviderServiceConfig) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(c)
+}
+
+type ModelProviderService struct {
+	BaseResource
+	ID string `json:"id,omitempty" bundle:"readonly"`
+	ModelProviderServiceConfig
+
+	// List of grants to apply on this model provider service. Grants are applied
+	// via the permissions API (the `.grants` sub-resource), not the service body,
+	// so this field lives on the wrapper and stays out of the diffed state that
+	// PrepareState returns (the embedded ModelProviderServiceConfig).
+	Grants []catalog.PrivilegeAssignment `json:"grants,omitempty"`
+}
+
+// UnmarshalJSON / MarshalJSON are defined on the wrapper so it does not inherit
+// ModelProviderServiceConfig's promoted marshaler, which would silently drop the
+// BaseResource fields (id, url, lifecycle, modified_status).
+func (m *ModelProviderService) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, m)
+}
+
+func (m ModelProviderService) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(m)
+}
+
+func (m *ModelProviderService) Exists(ctx context.Context, w *databricks.WorkspaceClient, id string) (bool, error) {
+	// The engine tracks the id as the bare
+	// {catalog}.{schema}.{model_provider_service}; the API addresses the
+	// resource by its full name.
+	_, err := w.AiGateway.GetModelProviderService(ctx, catalog.GetModelProviderServiceRequest{Name: "model-provider-services/" + id})
+	if err != nil {
+		log.Debugf(ctx, "model provider service %s does not exist", id)
+		if apierr.IsMissing(err) {
+			return false, nil
+		}
+		return false, err
+	}
+	return true, nil
+}
+
+func (*ModelProviderService) ResourceDescription() ResourceDescription {
+	return ResourceDescription{
+		SingularName:  "model_provider_service",
+		PluralName:    "model_provider_services",
+		SingularTitle: "Model provider service",
+		PluralTitle:   "Model provider services",
+	}
+}
+
+func (m *ModelProviderService) InitializeURL(baseURL url.URL) {
+	if m.ID == "" {
+		return
+	}
+	// The id is the bare {catalog}.{schema}.{model_provider_service}; ResourceURL
+	// splits it into the Catalog Explorer path explore/data/model-provider-services/...
+	m.URL = workspaceurls.ResourceURL(baseURL, "model_provider_services", m.ID)
+}
+
+func (m *ModelProviderService) GetName() string {
+	return m.ModelProviderServiceId
+}
diff --git a/bundle/config/resources/model_service.go b/bundle/config/resources/model_service.go
new file mode 100644
index 00000000000..28134a9cb06
--- /dev/null
+++ b/bundle/config/resources/model_service.go
@@ -0,0 +1,110 @@
+package resources
+
+import (
+	"context"
+	"net/url"
+
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/workspaceurls"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/marshal"
+	"github.com/databricks/databricks-sdk-go/service/catalog"
+)
+
+// ModelServiceConfig is the bundle-authored state for an AI Gateway model
+// service.
+//
+// The SDK models the create inputs `parent` and `model_service_id` as URL
+// parameters (`json:"-"`) that sit outside the ModelService body, and derives
+// the resource `name` (`model-services/{catalog}.{schema}.{model_service}`)
+// server-side. We therefore cannot embed catalog.CreateModelServiceRequest the
+// way volume embeds catalog.CreateVolumeRequestContent: its identity fields
+// would be invisible to the bundle schema. Instead we expose a flat struct with
+// the immutable identity (parent + model_service_id) plus the mutable body.
+//
+// Owner is intentionally not exposed yet (mirrors volume, which does not manage
+// owner): the API returns effective_owner rather than owner on read, so round
+// tripping it needs extra care. See the direct engine resource for the CRUD.
+type ModelServiceConfig struct {
+	// Parent schema, format `schemas/{catalog}.{schema}`. Immutable: the server
+	// derives `name` from parent + model_service_id, so changing it recreates
+	// the resource.
+	Parent string `json:"parent"`
+	// Leaf id of the model service, e.g. "my_model_service". Immutable.
+	ModelServiceId string `json:"model_service_id"`
+	// User-provided description.
+	Comment string `json:"comment,omitempty"`
+	// Operational configuration: destinations, routing, rate limits, inference
+	// table.
+	Config *catalog.ModelServiceConfig `json:"config,omitempty"`
+
+	ForceSendFields []string `json:"-" url:"-"`
+}
+
+func (c *ModelServiceConfig) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, c)
+}
+
+func (c ModelServiceConfig) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(c)
+}
+
+type ModelService struct {
+	BaseResource
+	ModelServiceConfig
+	ID string `json:"id,omitempty" bundle:"readonly"`
+
+	// List of grants to apply on this model service. Grants are applied via the
+	// permissions API (the `.grants` sub-resource), not the model-service body, so
+	// this field lives on the wrapper and stays out of the diffed state that
+	// PrepareState returns (the embedded ModelServiceConfig).
+	Grants []catalog.PrivilegeAssignment `json:"grants,omitempty"`
+}
+
+// UnmarshalJSON / MarshalJSON are defined on the wrapper so it does not inherit
+// ModelServiceConfig's promoted marshaler, which would silently drop the
+// BaseResource fields (id, url, lifecycle, modified_status).
+func (m *ModelService) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, m)
+}
+
+func (m ModelService) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(m)
+}
+
+func (m *ModelService) Exists(ctx context.Context, w *databricks.WorkspaceClient, id string) (bool, error) {
+	// The engine tracks the id as the bare {catalog}.{schema}.{model_service};
+	// the API addresses the resource by its full name.
+	_, err := w.AiGateway.GetModelService(ctx, catalog.GetModelServiceRequest{Name: "model-services/" + id})
+	if err != nil {
+		log.Debugf(ctx, "model service %s does not exist", id)
+		if apierr.IsMissing(err) {
+			return false, nil
+		}
+		return false, err
+	}
+	return true, nil
+}
+
+func (*ModelService) ResourceDescription() ResourceDescription {
+	return ResourceDescription{
+		SingularName:  "model_service",
+		PluralName:    "model_services",
+		SingularTitle: "Model service",
+		PluralTitle:   "Model services",
+	}
+}
+
+func (m *ModelService) InitializeURL(baseURL url.URL) {
+	if m.ID == "" {
+		return
+	}
+	// The id is the bare {catalog}.{schema}.{model_service}; ResourceURL splits
+	// it into the Catalog Explorer path explore/data/model-services/...
+	m.URL = workspaceurls.ResourceURL(baseURL, "model_services", m.ID)
+}
+
+func (m *ModelService) GetName() string {
+	return m.ModelServiceId
+}
diff --git a/bundle/config/resources/model_serving_endpoint.go b/bundle/config/resources/model_serving_endpoint.go
index 5a917c2e268..e3bc707cfad 100644
--- a/bundle/config/resources/model_serving_endpoint.go
+++ b/bundle/config/resources/model_serving_endpoint.go
@@ -13,9 +13,8 @@ import (
 
 type ModelServingEndpoint struct {
 	BaseResource
+	ID string `json:"id,omitempty" bundle:"readonly"`
 
-	// This represents the input args for terraform, and will get converted
-	// to a HCL representation for CRUD
 	serving.CreateServingEndpoint
 
 	// This is a resource agnostic implementation of permissions for ACLs.
@@ -61,7 +60,3 @@ func (s *ModelServingEndpoint) InitializeURL(baseURL url.URL) {
 func (s *ModelServingEndpoint) GetName() string {
 	return s.Name
 }
-
-func (s *ModelServingEndpoint) GetURL() string {
-	return s.URL
-}
diff --git a/bundle/config/resources/permission.go b/bundle/config/resources/permission.go
index 11863cbabd9..b71194755c0 100644
--- a/bundle/config/resources/permission.go
+++ b/bundle/config/resources/permission.go
@@ -32,6 +32,12 @@ func (p PermissionT[L]) String() string {
 	return "level: " + string(p.Level)
 }
 
+// CAN_EDIT is the workspace folder ACL level marking write access. It is not a valid
+// bundle permission level (those are CAN_MANAGE / CAN_VIEW / CAN_RUN, defined in the
+// permissions package), but permission checks rank against it via GetLevelScore, so it
+// is named here next to the level ordering it keys into.
+const CAN_EDIT = "CAN_EDIT"
+
 // PermissionOrder defines the hierarchy of permission levels.
 // Higher numbers mean more permissive access.
 // Based on https://docs.databricks.com/aws/en/security/auth/access-control
diff --git a/bundle/config/resources/permission_types.go b/bundle/config/resources/permission_types.go
index 3029ee40b8c..31d41e09439 100644
--- a/bundle/config/resources/permission_types.go
+++ b/bundle/config/resources/permission_types.go
@@ -9,6 +9,7 @@ import (
 	"github.com/databricks/databricks-sdk-go/service/pipelines"
 	"github.com/databricks/databricks-sdk-go/service/serving"
 	"github.com/databricks/databricks-sdk-go/service/sql"
+	"github.com/databricks/databricks-sdk-go/service/vectorsearch"
 )
 
 // Each resource defines its own permission type so that the JSON schema names them distinctly.
@@ -26,10 +27,13 @@ func (p Permission) String() string {
 type (
 	AppPermission                  PermissionT[apps.AppPermissionLevel]
 	ClusterPermission              PermissionT[compute.ClusterPermissionLevel]
+	ClusterPolicyPermission        PermissionT[compute.ClusterPolicyPermissionLevel]
+	InstancePoolPermission         PermissionT[compute.InstancePoolPermissionLevel]
 	JobPermission                  PermissionT[jobs.JobPermissionLevel]
 	MlflowExperimentPermission     PermissionT[ml.ExperimentPermissionLevel]
 	MlflowModelPermission          PermissionT[ml.RegisteredModelPermissionLevel]
 	ModelServingEndpointPermission PermissionT[serving.ServingEndpointPermissionLevel]
 	PipelinePermission             PermissionT[pipelines.PipelinePermissionLevel]
 	SqlWarehousePermission         PermissionT[sql.WarehousePermissionLevel]
+	VectorSearchEndpointPermission PermissionT[vectorsearch.VectorSearchEndpointPermissionLevel]
 )
diff --git a/bundle/config/resources/pipeline.go b/bundle/config/resources/pipeline.go
index c442a01a641..fd1fc61ce86 100644
--- a/bundle/config/resources/pipeline.go
+++ b/bundle/config/resources/pipeline.go
@@ -13,9 +13,15 @@ import (
 
 type Pipeline struct {
 	BaseResource
-	pipelines.CreatePipeline //nolint CreatePipeline also defines Id field with the same json tag "id"
+	pipelines.CreatePipeline        //nolint:govet // CreatePipeline.Id and our depth-0 ID field both carry json:"id"; the depth-0 field wins
+	ID                       string `json:"id,omitempty" bundle:"readonly"`
 
 	Permissions []PipelinePermission `json:"permissions,omitempty"`
+
+	// CascadeOnDestroy controls whether destroying the pipeline also deletes its datasets
+	// Nil (unset) uses the server default, which cascades. Set to false to retain datasets
+	// when the pipeline is deleted. Delete-time only: never sent on create/update.
+	CascadeOnDestroy *bool `json:"cascade_on_destroy,omitempty"`
 }
 
 func (p *Pipeline) UnmarshalJSON(b []byte) error {
@@ -56,7 +62,3 @@ func (p *Pipeline) InitializeURL(baseURL url.URL) {
 func (p *Pipeline) GetName() string {
 	return p.Name
 }
-
-func (p *Pipeline) GetURL() string {
-	return p.URL
-}
diff --git a/bundle/config/resources/postgres_branch.go b/bundle/config/resources/postgres_branch.go
index dd6e9daacdf..a248667a87e 100644
--- a/bundle/config/resources/postgres_branch.go
+++ b/bundle/config/resources/postgres_branch.go
@@ -19,21 +19,47 @@ type PostgresBranchConfig struct {
 
 	// Parent is the project containing this branch. Format: "projects/{project_id}"
 	Parent string `json:"parent"`
+
+	// ReplaceExisting, when true, takes over an existing branch with the same ID
+	// instead of returning ALREADY_EXISTS. Used to manage the implicitly-created
+	// production branch of a new project. Input-only: not returned by the GET API.
+	ReplaceExisting bool `json:"replace_existing,omitempty"`
+
+	// PurgeOnDelete, when true, hard-deletes the branch on destroy (Purge=true on
+	// DeleteBranch). When false or unset, the backend performs a soft delete that
+	// can be undone within the branch's retention window. Input-only: not
+	// returned by the GET API.
+	PurgeOnDelete bool `json:"purge_on_delete,omitempty"`
+
+	// ForceSendFields shadows the embedded BranchSpec.ForceSendFields so the
+	// SDK's marshal package tracks zero-value top-level fields (branch_id,
+	// parent, replace_existing, purge_on_delete) here instead of polluting
+	// BranchSpec.ForceSendFields with names that don't exist in that struct.
+	ForceSendFields []string `json:"-" url:"-"`
 }
 
 func (c *PostgresBranchConfig) UnmarshalJSON(b []byte) error {
 	return marshal.Unmarshal(b, c)
 }
 
-func (c *PostgresBranchConfig) MarshalJSON() ([]byte, error) {
+func (c PostgresBranchConfig) MarshalJSON() ([]byte, error) {
 	return marshal.Marshal(c)
 }
 
 type PostgresBranch struct {
 	BaseResource
+	ID string `json:"id,omitempty" bundle:"readonly"`
 	PostgresBranchConfig
 }
 
+func (b *PostgresBranch) UnmarshalJSON(data []byte) error {
+	return marshal.Unmarshal(data, b)
+}
+
+func (b PostgresBranch) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(b)
+}
+
 func (b *PostgresBranch) Exists(ctx context.Context, w *databricks.WorkspaceClient, name string) (bool, error) {
 	_, err := w.Postgres.GetBranch(ctx, postgres.GetBranchRequest{Name: name})
 	if err != nil {
@@ -53,13 +79,14 @@ func (b *PostgresBranch) ResourceDescription() ResourceDescription {
 }
 
 func (b *PostgresBranch) GetName() string {
-	// Branches don't have a user-visible name field
-	return ""
+	// Branches have no name field of their own; the resource name is the ID
+	// ("projects/{project_id}/branches/{branch_id}").
+	return b.ID
 }
 
-func (b *PostgresBranch) GetURL() string {
+func (b *PostgresBranch) GetURL() (string, bool) {
 	// The IDs in the API do not (yet) map to IDs in the web UI.
-	return ""
+	return "", false
 }
 
 func (b *PostgresBranch) InitializeURL(_ url.URL) {
diff --git a/bundle/config/resources/postgres_branch_test.go b/bundle/config/resources/postgres_branch_test.go
new file mode 100644
index 00000000000..a9c846c38de
--- /dev/null
+++ b/bundle/config/resources/postgres_branch_test.go
@@ -0,0 +1,45 @@
+package resources
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestPostgresBranchConfigMarshalHonorsForceSendFields pins the reason
+// PostgresBranchConfig.MarshalJSON is declared on a value receiver.
+//
+// PurgeOnDelete is omitempty, so its zero value is emitted only because
+// ForceSendFields names it, and the SDK marshaler is what honors ForceSendFields.
+// With a pointer-receiver MarshalJSON, only *T satisfies json.Marshaler, so
+// marshalling a value falls back to plain encoding/json -- which ignores
+// ForceSendFields (tagged json:"-") and would drop the field.
+func TestPostgresBranchConfigMarshalHonorsForceSendFields(t *testing.T) {
+	c := PostgresBranchConfig{BranchId: "b1", Parent: "projects/p1"}
+	c.ForceSendFields = []string{"PurgeOnDelete"}
+
+	b, err := json.Marshal(c)
+	require.NoError(t, err)
+	assert.JSONEq(t, `{"branch_id":"b1","parent":"projects/p1","purge_on_delete":false}`, string(b))
+}
+
+// TestPostgresBranchMarshalValueAndPointerAgree guards the invariant directly:
+// a value-receiver MarshalJSON makes json.Marshal(x) and json.Marshal(&x)
+// produce the same bytes. A pointer-only marshaler would send them down two
+// different code paths.
+func TestPostgresBranchMarshalValueAndPointerAgree(t *testing.T) {
+	b := PostgresBranch{
+		ID:       "the-id",
+		BranchId: "b1",
+		Parent:   "projects/p1",
+	}
+
+	byValue, err := json.Marshal(b)
+	require.NoError(t, err)
+	byPointer, err := json.Marshal(&b)
+	require.NoError(t, err)
+	assert.Equal(t, string(byPointer), string(byValue))
+	assert.JSONEq(t, `{"id":"the-id","lifecycle":{},"branch_id":"b1","parent":"projects/p1"}`, string(byValue))
+}
diff --git a/bundle/config/resources/postgres_catalog.go b/bundle/config/resources/postgres_catalog.go
new file mode 100644
index 00000000000..51246f06af0
--- /dev/null
+++ b/bundle/config/resources/postgres_catalog.go
@@ -0,0 +1,71 @@
+package resources
+
+import (
+	"context"
+	"net/url"
+
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/workspaceurls"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/marshal"
+	"github.com/databricks/databricks-sdk-go/service/postgres"
+)
+
+type PostgresCatalogConfig struct {
+	postgres.CatalogCatalogSpec
+
+	// CatalogId is the user-specified UC catalog name. Becomes the trailing
+	// component of the server-assigned Name: "catalogs/{catalog_id}".
+	CatalogId string `json:"catalog_id"`
+}
+
+func (c *PostgresCatalogConfig) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, c)
+}
+
+func (c PostgresCatalogConfig) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(c)
+}
+
+type PostgresCatalog struct {
+	BaseResource
+	ID string `json:"id,omitempty" bundle:"readonly"`
+	PostgresCatalogConfig
+}
+
+func (c *PostgresCatalog) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, c)
+}
+
+func (c PostgresCatalog) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(c)
+}
+
+func (c *PostgresCatalog) Exists(ctx context.Context, w *databricks.WorkspaceClient, name string) (bool, error) {
+	_, err := w.Postgres.GetCatalog(ctx, postgres.GetCatalogRequest{Name: name})
+	if err != nil {
+		log.Debugf(ctx, "postgres catalog %s does not exist", name)
+		return false, err
+	}
+	return true, nil
+}
+
+func (c *PostgresCatalog) ResourceDescription() ResourceDescription {
+	return ResourceDescription{
+		SingularName:  "postgres_catalog",
+		PluralName:    "postgres_catalogs",
+		SingularTitle: "Postgres catalog",
+		PluralTitle:   "Postgres catalogs",
+	}
+}
+
+func (c *PostgresCatalog) GetName() string {
+	return c.CatalogId
+}
+
+func (c *PostgresCatalog) InitializeURL(baseURL url.URL) {
+	if c.CatalogId == "" {
+		return
+	}
+	c.URL = workspaceurls.ResourceURL(baseURL, "postgres_catalogs", c.CatalogId)
+}
diff --git a/bundle/config/resources/postgres_database.go b/bundle/config/resources/postgres_database.go
new file mode 100644
index 00000000000..efbe5984d5e
--- /dev/null
+++ b/bundle/config/resources/postgres_database.go
@@ -0,0 +1,86 @@
+package resources
+
+import (
+	"context"
+	"net/url"
+
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/marshal"
+	"github.com/databricks/databricks-sdk-go/service/postgres"
+)
+
+type PostgresDatabaseConfig struct {
+	postgres.DatabaseDatabaseSpec
+
+	// DatabaseId is the user-specified ID for the database (becomes part of the hierarchical name).
+	// This is specified during creation and becomes part of Name: "projects/{project_id}/branches/{branch_id}/databases/{database_id}"
+	DatabaseId string `json:"database_id"`
+
+	// Parent is the branch containing this database. Format: "projects/{project_id}/branches/{branch_id}"
+	Parent string `json:"parent"`
+
+	// ReplaceExisting, when true, takes over an existing database with the same ID
+	// instead of returning ALREADY_EXISTS. Used to manage a database that already
+	// exists on the branch. Input-only: not returned by the GET API.
+	ReplaceExisting bool `json:"replace_existing,omitempty"`
+}
+
+func (c *PostgresDatabaseConfig) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, c)
+}
+
+func (c PostgresDatabaseConfig) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(c)
+}
+
+type PostgresDatabase struct {
+	BaseResource
+	ID string `json:"id,omitempty" bundle:"readonly"`
+	PostgresDatabaseConfig
+}
+
+func (d *PostgresDatabase) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, d)
+}
+
+func (d PostgresDatabase) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(d)
+}
+
+func (d *PostgresDatabase) Exists(ctx context.Context, w *databricks.WorkspaceClient, name string) (bool, error) {
+	_, err := w.Postgres.GetDatabase(ctx, postgres.GetDatabaseRequest{Name: name})
+	if apierr.IsMissing(err) {
+		log.Debugf(ctx, "postgres database %s does not exist", name)
+		return false, nil
+	}
+	if err != nil {
+		return false, err
+	}
+	return true, nil
+}
+
+func (d *PostgresDatabase) ResourceDescription() ResourceDescription {
+	return ResourceDescription{
+		SingularName:  "postgres_database",
+		PluralName:    "postgres_databases",
+		SingularTitle: "Postgres database",
+		PluralTitle:   "Postgres databases",
+	}
+}
+
+func (d *PostgresDatabase) GetName() string {
+	// Databases have no name field of their own; the resource name is the ID
+	// ("projects/{project_id}/branches/{branch_id}/databases/{database_id}").
+	return d.ID
+}
+
+func (d *PostgresDatabase) GetURL() (string, bool) {
+	// The IDs in the API do not (yet) map to IDs in the web UI.
+	return "", false
+}
+
+func (d *PostgresDatabase) InitializeURL(_ url.URL) {
+	// The IDs in the API do not (yet) map to IDs in the web UI.
+}
diff --git a/bundle/config/resources/postgres_endpoint.go b/bundle/config/resources/postgres_endpoint.go
index 6dfe4fe7f33..0947045a719 100644
--- a/bundle/config/resources/postgres_endpoint.go
+++ b/bundle/config/resources/postgres_endpoint.go
@@ -19,21 +19,35 @@ type PostgresEndpointConfig struct {
 
 	// Parent is the branch containing this endpoint. Format: "projects/{project_id}/branches/{branch_id}"
 	Parent string `json:"parent"`
+
+	// ReplaceExisting, when true, takes over an existing endpoint with the same ID
+	// instead of returning ALREADY_EXISTS. Used to manage the implicitly-created
+	// primary read-write endpoint of a new branch. Input-only: not returned by the GET API.
+	ReplaceExisting bool `json:"replace_existing,omitempty"`
 }
 
 func (c *PostgresEndpointConfig) UnmarshalJSON(b []byte) error {
 	return marshal.Unmarshal(b, c)
 }
 
-func (c *PostgresEndpointConfig) MarshalJSON() ([]byte, error) {
+func (c PostgresEndpointConfig) MarshalJSON() ([]byte, error) {
 	return marshal.Marshal(c)
 }
 
 type PostgresEndpoint struct {
 	BaseResource
+	ID string `json:"id,omitempty" bundle:"readonly"`
 	PostgresEndpointConfig
 }
 
+func (e *PostgresEndpoint) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, e)
+}
+
+func (e PostgresEndpoint) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(e)
+}
+
 func (e *PostgresEndpoint) Exists(ctx context.Context, w *databricks.WorkspaceClient, name string) (bool, error) {
 	_, err := w.Postgres.GetEndpoint(ctx, postgres.GetEndpointRequest{Name: name})
 	if err != nil {
@@ -53,13 +67,14 @@ func (e *PostgresEndpoint) ResourceDescription() ResourceDescription {
 }
 
 func (e *PostgresEndpoint) GetName() string {
-	// Endpoints don't have a user-visible name field
-	return ""
+	// Endpoints have no name field of their own; the resource name is the ID
+	// ("projects/{project_id}/branches/{branch_id}/endpoints/{endpoint_id}").
+	return e.ID
 }
 
-func (e *PostgresEndpoint) GetURL() string {
+func (e *PostgresEndpoint) GetURL() (string, bool) {
 	// The IDs in the API do not (yet) map to IDs in the web UI.
-	return ""
+	return "", false
 }
 
 func (e *PostgresEndpoint) InitializeURL(_ url.URL) {
diff --git a/bundle/config/resources/postgres_project.go b/bundle/config/resources/postgres_project.go
index d76a6ee135c..0cdfbbcc2af 100644
--- a/bundle/config/resources/postgres_project.go
+++ b/bundle/config/resources/postgres_project.go
@@ -16,23 +16,44 @@ type PostgresProjectConfig struct {
 	// ProjectId is the user-specified ID for the project (becomes part of the hierarchical name).
 	// This is specified during creation and becomes part of Name: "projects/{project_id}"
 	ProjectId string `json:"project_id"`
+
+	// PurgeOnDelete, when true, hard-deletes the project on destroy (Purge=true on
+	// DeleteProject). When false or unset, the backend performs a soft delete that
+	// can be undone within the project's retention window. Input-only: not
+	// returned by the GET API.
+	PurgeOnDelete bool `json:"purge_on_delete,omitempty"`
+
+	// ForceSendFields shadows the embedded ProjectSpec.ForceSendFields so the
+	// SDK's marshal package tracks zero-value top-level fields (project_id,
+	// purge_on_delete) here instead of polluting ProjectSpec.ForceSendFields
+	// with names that don't exist in that struct.
+	ForceSendFields []string `json:"-" url:"-"`
 }
 
 func (c *PostgresProjectConfig) UnmarshalJSON(b []byte) error {
 	return marshal.Unmarshal(b, c)
 }
 
-func (c *PostgresProjectConfig) MarshalJSON() ([]byte, error) {
+func (c PostgresProjectConfig) MarshalJSON() ([]byte, error) {
 	return marshal.Marshal(c)
 }
 
 type PostgresProject struct {
 	BaseResource
+	ID string `json:"id,omitempty" bundle:"readonly"`
 	PostgresProjectConfig
 
 	Permissions []Permission `json:"permissions,omitempty"`
 }
 
+func (p *PostgresProject) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, p)
+}
+
+func (p PostgresProject) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(p)
+}
+
 func (p *PostgresProject) Exists(ctx context.Context, w *databricks.WorkspaceClient, name string) (bool, error) {
 	_, err := w.Postgres.GetProject(ctx, postgres.GetProjectRequest{Name: name})
 	if err != nil {
@@ -55,9 +76,9 @@ func (p *PostgresProject) GetName() string {
 	return p.DisplayName
 }
 
-func (p *PostgresProject) GetURL() string {
+func (p *PostgresProject) GetURL() (string, bool) {
 	// The IDs in the API do not (yet) map to IDs in the web UI.
-	return ""
+	return "", false
 }
 
 func (p *PostgresProject) InitializeURL(_ url.URL) {
diff --git a/bundle/config/resources/postgres_role.go b/bundle/config/resources/postgres_role.go
new file mode 100644
index 00000000000..7cc30a3ee0a
--- /dev/null
+++ b/bundle/config/resources/postgres_role.go
@@ -0,0 +1,87 @@
+package resources
+
+import (
+	"context"
+	"net/url"
+
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/marshal"
+	"github.com/databricks/databricks-sdk-go/service/postgres"
+)
+
+type PostgresRoleConfig struct {
+	postgres.RoleRoleSpec
+
+	// RoleId is the user-specified ID for the role (becomes part of the hierarchical name).
+	// This is specified during creation and becomes part of Name: "projects/{project_id}/branches/{branch_id}/roles/{role_id}"
+	RoleId string `json:"role_id"`
+
+	// Parent is the branch containing this role. Format: "projects/{project_id}/branches/{branch_id}"
+	Parent string `json:"parent"`
+
+	// ReplaceExisting, when true, takes over an existing role with the same ID
+	// instead of returning ALREADY_EXISTS. Used to manage a role that already
+	// exists on the branch (e.g. inherited from the parent branch). Input-only:
+	// not returned by the GET API.
+	ReplaceExisting bool `json:"replace_existing,omitempty"`
+}
+
+func (c *PostgresRoleConfig) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, c)
+}
+
+func (c PostgresRoleConfig) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(c)
+}
+
+type PostgresRole struct {
+	BaseResource
+	ID string `json:"id,omitempty" bundle:"readonly"`
+	PostgresRoleConfig
+}
+
+func (r *PostgresRole) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, r)
+}
+
+func (r PostgresRole) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(r)
+}
+
+func (r *PostgresRole) Exists(ctx context.Context, w *databricks.WorkspaceClient, name string) (bool, error) {
+	_, err := w.Postgres.GetRole(ctx, postgres.GetRoleRequest{Name: name})
+	if apierr.IsMissing(err) {
+		log.Debugf(ctx, "postgres role %s does not exist", name)
+		return false, nil
+	}
+	if err != nil {
+		return false, err
+	}
+	return true, nil
+}
+
+func (r *PostgresRole) ResourceDescription() ResourceDescription {
+	return ResourceDescription{
+		SingularName:  "postgres_role",
+		PluralName:    "postgres_roles",
+		SingularTitle: "Postgres role",
+		PluralTitle:   "Postgres roles",
+	}
+}
+
+func (r *PostgresRole) GetName() string {
+	// Roles have no name field of their own; the resource name is the ID
+	// ("projects/{project_id}/branches/{branch_id}/roles/{role_id}").
+	return r.ID
+}
+
+func (r *PostgresRole) GetURL() (string, bool) {
+	// The IDs in the API do not (yet) map to IDs in the web UI.
+	return "", false
+}
+
+func (r *PostgresRole) InitializeURL(_ url.URL) {
+	// The IDs in the API do not (yet) map to IDs in the web UI.
+}
diff --git a/bundle/config/resources/postgres_snapshot_schedule.go b/bundle/config/resources/postgres_snapshot_schedule.go
new file mode 100644
index 00000000000..d07ac597f31
--- /dev/null
+++ b/bundle/config/resources/postgres_snapshot_schedule.go
@@ -0,0 +1,83 @@
+package resources
+
+import (
+	"context"
+	"net/url"
+
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/marshal"
+	"github.com/databricks/databricks-sdk-go/service/postgres"
+)
+
+type PostgresSnapshotScheduleConfig struct {
+	// Branch is the branch whose automatic-snapshot schedule this resource manages.
+	// Format: "projects/{project_id}/branches/{branch_id}". The schedule's resource
+	// name (and this resource's ID) is "{branch}/snapshot-schedule".
+	Branch string `json:"branch"`
+
+	// Schedule is the set of cadences at which automatic snapshots are taken. An
+	// empty set disables automatic snapshots. Order is not significant; when
+	// several cadences fire together a single snapshot is taken, retained for the
+	// longest of their retentions.
+	Schedule []postgres.ScheduleCadence `json:"schedule,omitempty"`
+
+	// ForceSendFields tracks zero-value top-level fields (branch) for the SDK's
+	// marshal package.
+	ForceSendFields []string `json:"-" url:"-"`
+}
+
+func (c *PostgresSnapshotScheduleConfig) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, c)
+}
+
+func (c PostgresSnapshotScheduleConfig) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(c)
+}
+
+type PostgresSnapshotSchedule struct {
+	BaseResource
+	ID string `json:"id,omitempty" bundle:"readonly"`
+	PostgresSnapshotScheduleConfig
+}
+
+func (b *PostgresSnapshotSchedule) UnmarshalJSON(data []byte) error {
+	return marshal.Unmarshal(data, b)
+}
+
+func (b PostgresSnapshotSchedule) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(b)
+}
+
+func (b *PostgresSnapshotSchedule) Exists(ctx context.Context, w *databricks.WorkspaceClient, name string) (bool, error) {
+	_, err := w.Postgres.GetSnapshotSchedule(ctx, postgres.GetSnapshotScheduleRequest{Name: name})
+	if err != nil {
+		log.Debugf(ctx, "postgres snapshot schedule %s does not exist", name)
+		return false, err
+	}
+	return true, nil
+}
+
+func (b *PostgresSnapshotSchedule) ResourceDescription() ResourceDescription {
+	return ResourceDescription{
+		SingularName:  "postgres_snapshot_schedule",
+		PluralName:    "postgres_snapshot_schedules",
+		SingularTitle: "Postgres snapshot schedule",
+		PluralTitle:   "Postgres snapshot schedules",
+	}
+}
+
+func (b *PostgresSnapshotSchedule) GetName() string {
+	// The schedule has no name field of its own; its resource name is its ID
+	// ("{branch}/snapshot-schedule").
+	return b.ID
+}
+
+func (b *PostgresSnapshotSchedule) GetURL() (string, bool) {
+	// The IDs in the API do not (yet) map to IDs in the web UI.
+	return "", false
+}
+
+func (b *PostgresSnapshotSchedule) InitializeURL(_ url.URL) {
+	// The IDs in the API do not (yet) map to IDs in the web UI.
+}
diff --git a/bundle/config/resources/postgres_synced_table.go b/bundle/config/resources/postgres_synced_table.go
new file mode 100644
index 00000000000..3aac2578d70
--- /dev/null
+++ b/bundle/config/resources/postgres_synced_table.go
@@ -0,0 +1,85 @@
+package resources
+
+import (
+	"context"
+	"net/url"
+	"strings"
+
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/workspaceurls"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/marshal"
+	"github.com/databricks/databricks-sdk-go/service/postgres"
+)
+
+type PostgresSyncedTableConfig struct {
+	postgres.SyncedTableSyncedTableSpec
+
+	// SyncedTableId is the user-specified three-part UC name (catalog.schema.table).
+	// Becomes the trailing component of the server-assigned Name:
+	// "synced_tables/{synced_table_id}".
+	SyncedTableId string `json:"synced_table_id"`
+}
+
+func (c *PostgresSyncedTableConfig) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, c)
+}
+
+func (c PostgresSyncedTableConfig) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(c)
+}
+
+type PostgresSyncedTable struct {
+	BaseResource
+	ID string `json:"id,omitempty" bundle:"readonly"`
+	PostgresSyncedTableConfig
+}
+
+func (s *PostgresSyncedTable) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, s)
+}
+
+func (s PostgresSyncedTable) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(s)
+}
+
+func (s *PostgresSyncedTable) Exists(ctx context.Context, w *databricks.WorkspaceClient, name string) (bool, error) {
+	_, err := w.Postgres.GetSyncedTable(ctx, postgres.GetSyncedTableRequest{Name: name})
+	if err != nil {
+		log.Debugf(ctx, "postgres synced table %s does not exist", name)
+		return false, err
+	}
+	return true, nil
+}
+
+func (s *PostgresSyncedTable) ResourceDescription() ResourceDescription {
+	return ResourceDescription{
+		SingularName:  "postgres_synced_table",
+		PluralName:    "postgres_synced_tables",
+		SingularTitle: "Postgres synced table",
+		PluralTitle:   "Postgres synced tables",
+	}
+}
+
+func (s *PostgresSyncedTable) GetName() string {
+	// Synced tables don't expose a display name distinct from their three-part
+	// id, so the id IS the name. Prefer the post-deploy ID
+	// ("synced_tables/{catalog}.{schema}.{table}") so bundle summary renders
+	// the resolved id even when SyncedTableId still has unresolved
+	// cross-resource references like ${resources.X.Y.Z}.
+	if id, ok := strings.CutPrefix(s.ID, "synced_tables/"); ok {
+		return id
+	}
+	return s.SyncedTableId
+}
+
+func (s *PostgresSyncedTable) InitializeURL(baseURL url.URL) {
+	// UC explore expects /{catalog}/{schema}/{table}, so bail if the name isn't
+	// a fully resolved three-part identifier; an unresolved ${...} reference
+	// would otherwise produce a misleading URL.
+	name := s.GetName()
+	if strings.Count(name, ".") != 2 {
+		return
+	}
+	s.URL = workspaceurls.ResourceURL(baseURL, "postgres_synced_tables", name)
+}
diff --git a/bundle/config/resources/quality_monitor.go b/bundle/config/resources/quality_monitor.go
index f937a7d6167..5548ef4d7da 100644
--- a/bundle/config/resources/quality_monitor.go
+++ b/bundle/config/resources/quality_monitor.go
@@ -3,9 +3,9 @@ package resources
 import (
 	"context"
 	"net/url"
-	"strings"
 
 	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/workspaceurls"
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/marshal"
 	"github.com/databricks/databricks-sdk-go/service/catalog"
@@ -13,6 +13,7 @@ import (
 
 type QualityMonitor struct {
 	BaseResource
+	ID string `json:"id,omitempty" bundle:"readonly"`
 
 	// This struct defines the creation payload for a monitor.
 	catalog.CreateMonitor
@@ -54,14 +55,9 @@ func (s *QualityMonitor) InitializeURL(baseURL url.URL) {
 	if s.TableName == "" {
 		return
 	}
-	baseURL.Path = "explore/data/" + strings.ReplaceAll(s.TableName, ".", "/")
-	s.URL = baseURL.String()
+	s.URL = workspaceurls.ResourceURL(baseURL, "quality_monitors", s.TableName)
 }
 
 func (s *QualityMonitor) GetName() string {
 	return s.TableName
 }
-
-func (s *QualityMonitor) GetURL() string {
-	return s.URL
-}
diff --git a/bundle/config/resources/registered_model.go b/bundle/config/resources/registered_model.go
index 87b0f0748c1..ed06e942f23 100644
--- a/bundle/config/resources/registered_model.go
+++ b/bundle/config/resources/registered_model.go
@@ -13,9 +13,8 @@ import (
 
 type RegisteredModel struct {
 	BaseResource
+	ID string `json:"id,omitempty" bundle:"readonly"`
 
-	// This represents the input args for terraform, and will get converted
-	// to a HCL representation for CRUD
 	catalog.CreateRegisteredModelRequest
 
 	// List of grants to apply on this registered model.
@@ -60,7 +59,3 @@ func (s *RegisteredModel) InitializeURL(baseURL url.URL) {
 func (s *RegisteredModel) GetName() string {
 	return s.Name
 }
-
-func (s *RegisteredModel) GetURL() string {
-	return s.URL
-}
diff --git a/bundle/config/resources/schema.go b/bundle/config/resources/schema.go
index 6cf47272796..5b6f5001516 100644
--- a/bundle/config/resources/schema.go
+++ b/bundle/config/resources/schema.go
@@ -3,11 +3,11 @@ package resources
 import (
 	"context"
 	"net/url"
-	"strings"
 
 	"github.com/databricks/databricks-sdk-go/apierr"
 
 	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/workspaceurls"
 
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/marshal"
@@ -16,6 +16,7 @@ import (
 
 type Schema struct {
 	BaseResource
+	ID string `json:"id,omitempty" bundle:"readonly"`
 	catalog.CreateSchema
 	// List of grants to apply on this schema.
 	Grants []catalog.PrivilegeAssignment `json:"grants,omitempty"`
@@ -50,12 +51,7 @@ func (s *Schema) InitializeURL(baseURL url.URL) {
 	if s.ID == "" {
 		return
 	}
-	baseURL.Path = "explore/data/" + strings.ReplaceAll(s.ID, ".", "/")
-	s.URL = baseURL.String()
-}
-
-func (s *Schema) GetURL() string {
-	return s.URL
+	s.URL = workspaceurls.ResourceURL(baseURL, "schemas", s.ID)
 }
 
 func (s *Schema) GetName() string {
diff --git a/bundle/config/resources/secret.go b/bundle/config/resources/secret.go
new file mode 100644
index 00000000000..a6ce7540374
--- /dev/null
+++ b/bundle/config/resources/secret.go
@@ -0,0 +1,72 @@
+package resources
+
+import (
+	"context"
+	"fmt"
+	"net/url"
+
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/workspaceurls"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/marshal"
+	"github.com/databricks/databricks-sdk-go/service/catalog"
+)
+
+type Secret struct {
+	BaseResource
+	ID string `json:"id,omitempty" bundle:"readonly"`
+	catalog.Secret
+
+	// List of grants to apply on this secret.
+	Grants []catalog.PrivilegeAssignment `json:"grants,omitempty"`
+}
+
+func (s *Secret) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, s)
+}
+
+func (s Secret) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(s)
+}
+
+func (s *Secret) Exists(ctx context.Context, w *databricks.WorkspaceClient, fullName string) (bool, error) {
+	log.Tracef(ctx, "Checking if secret with fullName=%s exists", fullName)
+
+	_, err := w.SecretsUc.GetSecret(ctx, catalog.GetSecretRequest{
+		FullName: fullName,
+	})
+	if err != nil {
+		log.Debugf(ctx, "secret with full name %s does not exist: %v", fullName, err)
+
+		if apierr.IsMissing(err) {
+			return false, nil
+		}
+
+		return false, err
+	}
+	return true, nil
+}
+
+func (*Secret) ResourceDescription() ResourceDescription {
+	return ResourceDescription{
+		SingularName:  "secret",
+		PluralName:    "secrets",
+		SingularTitle: "Secret",
+		PluralTitle:   "Secrets",
+	}
+}
+
+func (s *Secret) InitializeURL(baseURL url.URL) {
+	if s.ID == "" {
+		return
+	}
+	s.URL = workspaceurls.ResourceURL(baseURL, "secrets", s.ID)
+}
+
+func (s *Secret) GetName() string {
+	if s.ID != "" {
+		return s.ID
+	}
+	return fmt.Sprintf("%s.%s.%s", s.CatalogName, s.SchemaName, s.Name)
+}
diff --git a/bundle/config/resources/secret_scope.go b/bundle/config/resources/secret_scope.go
index 702ee914f8a..abd34dff9b2 100644
--- a/bundle/config/resources/secret_scope.go
+++ b/bundle/config/resources/secret_scope.go
@@ -13,10 +13,19 @@ type SecretScopePermissionLevel string
 
 const (
 	SecretScopePermissionLevelRead   SecretScopePermissionLevel = "READ"
-	SecretScopePermissionLevelManage SecretScopePermissionLevel = "MANAGE"
 	SecretScopePermissionLevelWrite  SecretScopePermissionLevel = "WRITE"
+	SecretScopePermissionLevelManage SecretScopePermissionLevel = "MANAGE"
 )
 
+// Values enables generated enum validation. Order matches privilege rank (READ < WRITE < MANAGE).
+func (SecretScopePermissionLevel) Values() []SecretScopePermissionLevel {
+	return []SecretScopePermissionLevel{
+		SecretScopePermissionLevelRead,
+		SecretScopePermissionLevelWrite,
+		SecretScopePermissionLevelManage,
+	}
+}
+
 // SecretScopePermission holds the permission level setting for a single principal.
 // Multiple of these can be defined on any secret scope.
 // Secret scopes permissions are mapped to Secret ACLs
@@ -30,6 +39,7 @@ type SecretScopePermission struct {
 
 type SecretScope struct { //nolint:recvcheck // pointer receiver needed for UnmarshalJSON, value for other methods
 	BaseResource
+	ID string `json:"id,omitempty" bundle:"readonly"`
 
 	// A unique name to identify the secret scope.
 	Name string `json:"name"`
@@ -95,9 +105,9 @@ func (s SecretScope) GetName() string {
 	return s.Name
 }
 
-func (s SecretScope) GetURL() string {
+func (s SecretScope) GetURL() (string, bool) {
 	// Secret scopes do not have a URL
-	return ""
+	return "", false
 }
 
 func (s SecretScope) InitializeURL(_ url.URL) {
diff --git a/bundle/config/resources/snapshot.go b/bundle/config/resources/snapshot.go
new file mode 100644
index 00000000000..95d98c89271
--- /dev/null
+++ b/bundle/config/resources/snapshot.go
@@ -0,0 +1,115 @@
+package resources
+
+import (
+	"context"
+	"net/url"
+	"path"
+	"strings"
+
+	"github.com/databricks/cli/libs/snapshot"
+	"github.com/databricks/databricks-sdk-go"
+)
+
+const (
+	// SnapshotKey is the config key of the singleton immutable-folder snapshot. The
+	// "immutable" map key is assigned in bundle/deploy/snapshot.PlanUpload; the plural
+	// segment must match ResourceDescription().PluralName below.
+	SnapshotKey = "resources.internal_immutable_snapshots.immutable"
+
+	// SnapshotFullPathRef is a ${...} reference to the snapshot's deployed workspace
+	// path (FullPath). Mutators point workspace.file_path / workspace.artifact_path and
+	// translated resource paths at it so they resolve to the snapshot after deploy.
+	SnapshotFullPathRef = "${" + SnapshotKey + ".full_path}"
+
+	// SnapshotResourceKey is the config key of the singleton immutable-folder snapshot.
+	// The "immutable" map key is assigned in bundle/deploy/snapshot.PlanUpload; the plural
+	// segment must match ResourceDescription().PluralName below.
+	SnapshotResourceKey = "immutable"
+)
+
+// Snapshot is an internal resource that stores the bundle zip as an immutable
+// workspace object. It is created by the deploy pipeline and is not intended
+// to be declared in user-authored databricks.yml files.
+//
+// JSON tags are present because the direct-deploy engine serialises the in-memory
+// state to a JSON plan file (resources.internal_immutable_snapshots.*).
+//
+// RemoteRoot, RelativePath and FullPath are all workspace (remote) paths and are
+// related, not independent: FullPath = RemoteRoot + "/" + RelativePath. RemoteRoot is
+// the shared parent, RelativePath is this snapshot's location within it (and the
+// resource ID), and FullPath is the composed absolute path that downstream resources
+// reference and that the API echoes back on read.
+type Snapshot struct {
+	// BundleID is the stable UUID that identifies the bundle deployment, used
+	// as the first path component of RelativePath.
+	// Example: "1a2b3c4d-....".
+	BundleID string `json:"bundle_id"`
+	// ACL is the access control list applied to the uploaded snapshot, granting
+	// CAN_READ to the deploying user and to every principal in bundle.permissions.
+	ACL []snapshot.ACLEntry `json:"acl"`
+	// ZipPath is the local path of the bundle zip staged by the deploy pipeline.
+	// The file is named "<sha256>.zip", so its base name is the content hash used
+	// as the last component of RelativePath. Storing the path (not the bytes) keeps
+	// the zip off the config, the state, and the plan file, and lets DoCreate stream
+	// it straight from disk at upload time.
+	// Example: "/.../.databricks/bundle/default/snapshots/e3b0c4...zip".
+	ZipPath string `json:"zip_path"`
+	// RemoteRoot is the workspace directory that holds every snapshot for this user,
+	// returned by the snapshot rootpath API.
+	// Example: "/Workspace/Users/<user>/.snapshots".
+	RemoteRoot string `json:"remote_root"`
+
+	Lifecycle Lifecycle `json:"-"`
+}
+
+// RelativePath is the snapshot's location under RemoteRoot: "<bundle_id>/<zip_hash>".
+// It is the resource ID; the last component is the zip content hash (the ZipPath base
+// name), which makes the pre-computed path match the uploaded content.
+// Example: "1a2b3c4d-.../e3b0c4...".
+func (s *Snapshot) RelativePath() string {
+	hash := strings.TrimSuffix(path.Base(s.ZipPath), ".zip")
+	return path.Join(s.BundleID, hash)
+}
+
+// FullPath is the absolute workspace path of the snapshot: RemoteRoot + "/" + RelativePath.
+// Example: "/Workspace/Users/<user>/.snapshots/1a2b3c4d-.../e3b0c4...".
+func (s *Snapshot) FullPath() string {
+	return path.Join(s.RemoteRoot, s.RelativePath())
+}
+
+func (s *Snapshot) Exists(ctx context.Context, w *databricks.WorkspaceClient, name string) (bool, error) {
+	_, err := w.Workspace.GetStatusByPath(ctx, s.FullPath())
+	if err != nil {
+		return false, err
+	}
+	return true, nil
+}
+
+func (s *Snapshot) ResourceDescription() ResourceDescription {
+	return ResourceDescription{
+		SingularName:  "internal_immutable_snapshot",
+		PluralName:    "internal_immutable_snapshots",
+		SingularTitle: "Internal Immutable Snapshot",
+		PluralTitle:   "Internal Immutable Snapshots",
+	}
+}
+
+func (s *Snapshot) GetName() string {
+	return s.RelativePath()
+}
+
+func (s *Snapshot) GetURL() (string, bool) {
+	// A snapshot is a workspace folder owned by the project's service principal, so
+	// a browser URL is constructible from its path. We don't surface one yet:
+	// workspaceurls has no folder-path helper, and the path is only known during
+	// deploy (its content hash is derived from the zip staged by the deploy pipeline).
+	return "", false
+}
+
+func (s *Snapshot) InitializeURL(_ url.URL) {
+	// See GetURL: no browser URL is surfaced for the snapshot folder yet.
+}
+
+func (s *Snapshot) GetLifecycle() LifecycleConfig {
+	return s.Lifecycle
+}
diff --git a/bundle/config/resources/sql_warehouses.go b/bundle/config/resources/sql_warehouses.go
index 016526a80ef..de0fda7de74 100644
--- a/bundle/config/resources/sql_warehouses.go
+++ b/bundle/config/resources/sql_warehouses.go
@@ -13,11 +13,23 @@ import (
 
 type SqlWarehouse struct {
 	BaseResource
+	ID string `json:"id,omitempty" bundle:"readonly"`
 	sql.CreateWarehouseRequest
 
+	// Lifecycle shadows BaseResource.Lifecycle to add support for lifecycle.started.
+	Lifecycle *LifecycleWithStarted `json:"lifecycle,omitempty"`
+
 	Permissions []SqlWarehousePermission `json:"permissions,omitempty"`
 }
 
+// GetLifecycle returns the lifecycle settings, using LifecycleWithStarted.
+func (sw *SqlWarehouse) GetLifecycle() LifecycleConfig {
+	if sw.Lifecycle == nil {
+		return LifecycleWithStarted{}
+	}
+	return *sw.Lifecycle
+}
+
 func (sw *SqlWarehouse) UnmarshalJSON(b []byte) error {
 	return marshal.Unmarshal(b, sw)
 }
@@ -54,7 +66,3 @@ func (sw *SqlWarehouse) InitializeURL(baseURL url.URL) {
 func (sw *SqlWarehouse) GetName() string {
 	return sw.Name
 }
-
-func (sw *SqlWarehouse) GetURL() string {
-	return sw.URL
-}
diff --git a/bundle/config/resources/synced_database_table.go b/bundle/config/resources/synced_database_table.go
index 5577fe47b08..b8839d99a5e 100644
--- a/bundle/config/resources/synced_database_table.go
+++ b/bundle/config/resources/synced_database_table.go
@@ -5,16 +5,27 @@ import (
 	"net/url"
 
 	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/workspaceurls"
 
 	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/marshal"
 	"github.com/databricks/databricks-sdk-go/service/database"
 )
 
 type SyncedDatabaseTable struct {
 	BaseResource
+	ID string `json:"id,omitempty" bundle:"readonly"`
 	database.SyncedDatabaseTable
 }
 
+func (s *SyncedDatabaseTable) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, s)
+}
+
+func (s SyncedDatabaseTable) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(s)
+}
+
 func (s *SyncedDatabaseTable) Exists(ctx context.Context, w *databricks.WorkspaceClient, name string) (bool, error) {
 	_, err := w.Database.GetSyncedDatabaseTable(ctx, database.GetSyncedDatabaseTableRequest{Name: name})
 	if err != nil {
@@ -37,14 +48,9 @@ func (s *SyncedDatabaseTable) GetName() string {
 	return s.Name
 }
 
-func (s *SyncedDatabaseTable) GetURL() string {
-	return s.URL
-}
-
 func (s *SyncedDatabaseTable) InitializeURL(baseURL url.URL) {
 	if s.Name == "" {
 		return
 	}
-	baseURL.Path = "explore/data/" + s.Name
-	s.URL = baseURL.String()
+	s.URL = workspaceurls.ResourceURL(baseURL, "synced_database_tables", s.Name)
 }
diff --git a/bundle/config/resources/vector_search_endpoint.go b/bundle/config/resources/vector_search_endpoint.go
index 900e91ccc57..5404469bdfd 100644
--- a/bundle/config/resources/vector_search_endpoint.go
+++ b/bundle/config/resources/vector_search_endpoint.go
@@ -5,6 +5,7 @@ import (
 	"net/url"
 
 	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/workspaceurls"
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/apierr"
 	"github.com/databricks/databricks-sdk-go/marshal"
@@ -13,9 +14,10 @@ import (
 
 type VectorSearchEndpoint struct {
 	BaseResource
+	ID string `json:"id,omitempty" bundle:"readonly"`
 	vectorsearch.CreateEndpoint
 
-	Permissions []Permission `json:"permissions,omitempty"`
+	Permissions []VectorSearchEndpointPermission `json:"permissions,omitempty"`
 }
 
 func (e *VectorSearchEndpoint) UnmarshalJSON(b []byte) error {
@@ -51,14 +53,9 @@ func (e *VectorSearchEndpoint) InitializeURL(baseURL url.URL) {
 	if e.Name == "" {
 		return
 	}
-	baseURL.Path = "compute/vector-search/" + e.Name
-	e.URL = baseURL.String()
+	e.URL = workspaceurls.ResourceURL(baseURL, "vector_search_endpoints", e.Name)
 }
 
 func (e *VectorSearchEndpoint) GetName() string {
 	return e.Name
 }
-
-func (e *VectorSearchEndpoint) GetURL() string {
-	return e.URL
-}
diff --git a/bundle/config/resources/vector_search_index.go b/bundle/config/resources/vector_search_index.go
new file mode 100644
index 00000000000..2c843376209
--- /dev/null
+++ b/bundle/config/resources/vector_search_index.go
@@ -0,0 +1,67 @@
+package resources
+
+import (
+	"context"
+	"net/url"
+	"strings"
+
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/workspaceurls"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/marshal"
+	"github.com/databricks/databricks-sdk-go/service/catalog"
+	"github.com/databricks/databricks-sdk-go/service/vectorsearch"
+)
+
+type VectorSearchIndex struct {
+	BaseResource
+	ID string `json:"id,omitempty" bundle:"readonly"`
+	vectorsearch.CreateVectorIndexRequest
+
+	// List of grants to apply on this vector search index.
+	Grants []catalog.PrivilegeAssignment `json:"grants,omitempty"`
+}
+
+func (e *VectorSearchIndex) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, e)
+}
+
+func (e VectorSearchIndex) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(e)
+}
+
+func (e *VectorSearchIndex) Exists(ctx context.Context, w *databricks.WorkspaceClient, name string) (bool, error) {
+	_, err := w.VectorSearchIndexes.GetIndexByIndexName(ctx, name)
+	if err != nil {
+		log.Debugf(ctx, "vector search index %s does not exist: %v", name, err)
+		if apierr.IsMissing(err) {
+			return false, nil
+		}
+		return false, err
+	}
+	return true, nil
+}
+
+func (e *VectorSearchIndex) ResourceDescription() ResourceDescription {
+	return ResourceDescription{
+		SingularName:  "vector_search_index",
+		PluralName:    "vector_search_indexes",
+		SingularTitle: "Vector Search Index",
+		PluralTitle:   "Vector Search Indexes",
+	}
+}
+
+func (e *VectorSearchIndex) InitializeURL(baseURL url.URL) {
+	// UC explore expects /{catalog}/{schema}/{name}, so bail if the name isn't
+	// a fully resolved three-part identifier; an unresolved ${...} reference
+	// would otherwise produce a misleading URL.
+	if strings.Count(e.Name, ".") != 2 {
+		return
+	}
+	e.URL = workspaceurls.ResourceURL(baseURL, "vector_search_indexes", e.Name)
+}
+
+func (e *VectorSearchIndex) GetName() string {
+	return e.Name
+}
diff --git a/bundle/config/resources/volume.go b/bundle/config/resources/volume.go
index 112f5020665..db321e9ceb2 100644
--- a/bundle/config/resources/volume.go
+++ b/bundle/config/resources/volume.go
@@ -2,12 +2,13 @@ package resources
 
 import (
 	"context"
+	"fmt"
 	"net/url"
-	"strings"
 
 	"github.com/databricks/databricks-sdk-go/apierr"
 
 	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/workspaceurls"
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/marshal"
 	"github.com/databricks/databricks-sdk-go/service/catalog"
@@ -15,8 +16,12 @@ import (
 
 type Volume struct {
 	BaseResource
+	ID string `json:"id,omitempty" bundle:"readonly"`
 	catalog.CreateVolumeRequestContent
 
+	// VolumePath is /Volumes/{catalog}/{schema}/{name}. Populated during initialize; not user-configurable.
+	VolumePath string `json:"volume_path,omitempty" bundle:"readonly"`
+
 	// List of grants to apply on this volume.
 	Grants []catalog.PrivilegeAssignment `json:"grants,omitempty"`
 }
@@ -59,14 +64,18 @@ func (v *Volume) InitializeURL(baseURL url.URL) {
 	if v.ID == "" {
 		return
 	}
-	baseURL.Path = "explore/data/volumes/" + strings.ReplaceAll(v.ID, ".", "/")
-	v.URL = baseURL.String()
-}
-
-func (v *Volume) GetURL() string {
-	return v.URL
+	v.URL = workspaceurls.ResourceURL(baseURL, "volumes", v.ID)
 }
 
 func (v *Volume) GetName() string {
 	return v.Name
 }
+
+// ComputeVolumePath returns the Unity Catalog volume path /Volumes/{catalog}/{schema}/{name}.
+//
+// Components are used as-is: a ${...} reference is embedded verbatim and resolved later during plan
+// or deploy. Missing required fields and malformed references are reported by validation and the
+// plan/deploy backends, so this function does not guard against them.
+func (v *Volume) ComputeVolumePath() string {
+	return fmt.Sprintf("/Volumes/%s/%s/%s", v.CatalogName, v.SchemaName, v.Name)
+}
diff --git a/bundle/config/resources/volume_test.go b/bundle/config/resources/volume_test.go
index ef44a2e61de..065d8cb287d 100644
--- a/bundle/config/resources/volume_test.go
+++ b/bundle/config/resources/volume_test.go
@@ -9,6 +9,25 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+func TestComputeVolumePath(t *testing.T) {
+	v := &Volume{
+		CatalogName: "main",
+		SchemaName:  "myschema",
+		Name:        "myvol",
+	}
+	require.Equal(t, "/Volumes/main/myschema/myvol", v.ComputeVolumePath())
+}
+
+func TestComputeVolumePath_PureReferenceEmbedded(t *testing.T) {
+	v := &Volume{
+		CatalogName: "main",
+		SchemaName:  "${resources.schemas.my.name}",
+		Name:        "myvol",
+	}
+	// A pure reference is embedded verbatim so it can be resolved later (plan/deploy).
+	require.Equal(t, "/Volumes/main/${resources.schemas.my.name}/myvol", v.ComputeVolumePath())
+}
+
 func TestVolumeNotFound(t *testing.T) {
 	ctx := t.Context()
 
diff --git a/bundle/config/resources_test.go b/bundle/config/resources_test.go
index 943b279a288..963e7efd4ff 100644
--- a/bundle/config/resources_test.go
+++ b/bundle/config/resources_test.go
@@ -15,6 +15,9 @@ import (
 	"github.com/databricks/databricks-sdk-go/service/serving"
 
 	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/cli/libs/structs/structpath"
+	"github.com/databricks/cli/libs/structs/structtag"
+	"github.com/databricks/cli/libs/structs/structwalk"
 	"github.com/databricks/cli/libs/workspaceurls"
 	"github.com/databricks/databricks-sdk-go/experimental/mocks"
 	"github.com/databricks/databricks-sdk-go/service/apps"
@@ -53,15 +56,13 @@ import (
 func TestCustomMarshallerIsImplemented(t *testing.T) {
 	rt := reflect.TypeFor[Resources]()
 
-	for i := range rt.NumField() {
-		field := rt.Field(i)
-
+	for field := range rt.Fields() {
 		// Fields in Resources are expected be of the form map[string]*resourceStruct
 		assert.Equal(t, reflect.Map, field.Type.Kind(), "Resource %s is not a map", field.Name)
 		kt := field.Type.Key()
 		assert.Equal(t, reflect.String, kt.Kind(), "Resource %s is not a map with string keys", field.Name)
 		vt := field.Type.Elem()
-		assert.Equal(t, reflect.Ptr, vt.Kind(), "Resource %s is not a map with pointer values", field.Name)
+		assert.Equal(t, reflect.Pointer, vt.Kind(), "Resource %s is not a map with pointer values", field.Name)
 
 		// Marshalling a resourceStruct will panic if resourceStruct does not have a custom marshaller
 		// This is because resourceStruct embeds a Go SDK struct that implements
@@ -95,8 +96,7 @@ func TestResourcesAllResourcesCompleteness(t *testing.T) {
 		types = append(types, group.Description.PluralName)
 	}
 
-	for i := range rt.NumField() {
-		field := rt.Field(i)
+	for field := range rt.Fields() {
 		jsonTag := field.Tag.Get("json")
 
 		if idx := strings.Index(jsonTag, ","); idx != -1 {
@@ -112,42 +112,52 @@ func TestSupportedResources(t *testing.T) {
 	actual := SupportedResources()
 
 	typ := reflect.TypeFor[Resources]()
-	for i := range typ.NumField() {
-		field := typ.Field(i)
+	for field := range typ.Fields() {
 		jsonTags := strings.Split(field.Tag.Get("json"), ",")
 		pluralName := jsonTags[0]
 		assert.Equal(t, actual[pluralName].PluralName, pluralName)
 	}
 }
 
-// Bundle resources whose InitializeURL() resolves via workspaceurls. When a
-// pattern key or a bundle plural name drifts, ResourceURL returns "" and this
-// test fails loudly instead of silently producing empty URLs in bundle summary.
+// All bundle resources must have a workspace URL, except those listed in noURL.
+// When a pattern key or a bundle plural name drifts, ResourceURL returns "" and
+// this test fails loudly instead of silently producing empty URLs in bundle summary.
+// When adding a new resource, add a URL pattern in libs/workspaceurls or add the
+// plural name to noURL with a comment explaining why no URL exists.
 func TestBundleResourcePluralNamesResolveInWorkspaceURLs(t *testing.T) {
-	withURLs := []string{
-		"alerts",
-		"apps",
-		"clusters",
-		"dashboards",
-		"experiments",
-		"jobs",
-		"models",
-		"model_serving_endpoints",
-		"pipelines",
-		"registered_models",
-		"sql_warehouses",
+	// Resources that intentionally have no workspace URL.
+	noURL := map[string]bool{
+		"external_locations": true,
+		// A job run does have a workspace URL, but it's addressed by two IDs
+		// (job + run) so it can't be expressed as a single-ID pattern here; it's
+		// built in JobRun.InitializeURL via workspaceurls.JobRunURL instead.
+		"job_runs":                     true,
+		"postgres_branches":            true,
+		"postgres_databases":           true,
+		"postgres_endpoints":           true,
+		"postgres_projects":            true,
+		"postgres_roles":               true,
+		"postgres_snapshot_schedules":  true,
+		"secret_scopes":                true,
+		"internal_immutable_snapshots": true,
 	}
 
 	supported := SupportedResources()
-	for _, name := range withURLs {
+
+	// Catch stale noURL entries when a resource is removed from SupportedResources.
+	for name := range noURL {
 		_, ok := supported[name]
-		require.Truef(t, ok, "%q is not a bundle plural name, update SupportedResources or this test", name)
+		require.Truef(t, ok, "%q is in the noURL list but is not a supported bundle resource; remove it from noURL", name)
 	}
 
 	base := url.URL{Scheme: "https", Host: "example.com"}
-	for _, name := range withURLs {
+	for name := range supported {
 		got := workspaceurls.ResourceURL(base, name, "test-id")
-		assert.NotEmptyf(t, got, "workspaceurls.ResourceURL(%q) returned empty; pattern key renamed or alias missing", name)
+		if noURL[name] {
+			assert.Emptyf(t, got, "workspaceurls.ResourceURL(%q) returned non-empty; remove %q from noURL or remove its URL pattern", name, name)
+		} else {
+			assert.NotEmptyf(t, got, "workspaceurls.ResourceURL(%q) returned empty; add a URL pattern in libs/workspaceurls or add %q to noURL", name, name)
+		}
 	}
 }
 
@@ -158,6 +168,11 @@ func TestResourcesBindSupport(t *testing.T) {
 				JobSettings: jobs.JobSettings{},
 			},
 		},
+		JobRuns: map[string]*resources.JobRun{
+			"my_job_run": {
+				RunNow: jobs.RunNow{},
+			},
+		},
 		Pipelines: map[string]*resources.Pipeline{
 			"my_pipeline": {
 				CreatePipeline: pipelines.CreatePipeline{},
@@ -191,9 +206,18 @@ func TestResourcesBindSupport(t *testing.T) {
 		Clusters: map[string]*resources.Cluster{
 			"my_cluster": {},
 		},
+		InstancePools: map[string]*resources.InstancePool{
+			"my_instance_pool": {},
+		},
+		ClusterPolicies: map[string]*resources.ClusterPolicy{
+			"my_cluster_policy": {},
+		},
 		Dashboards: map[string]*resources.Dashboard{
 			"my_dashboard": {},
 		},
+		GenieSpaces: map[string]*resources.GenieSpace{
+			"my_genie_space": {},
+		},
 		Volumes: map[string]*resources.Volume{
 			"my_volume": {
 				CreateVolumeRequestContent: catalog.CreateVolumeRequestContent{},
@@ -219,11 +243,35 @@ func TestResourcesBindSupport(t *testing.T) {
 				CreateServingEndpoint: serving.CreateServingEndpoint{},
 			},
 		},
+		ModelServices: map[string]*resources.ModelService{
+			"my_model_service": {
+				ModelServiceConfig: resources.ModelServiceConfig{},
+			},
+		},
+		McpServices: map[string]*resources.McpService{
+			"my_mcp_service": {
+				McpServiceConfig: resources.McpServiceConfig{},
+			},
+		},
+		ModelProviderServices: map[string]*resources.ModelProviderService{
+			"my_model_provider_service": {
+				ModelProviderServiceConfig: resources.ModelProviderServiceConfig{},
+			},
+		},
 		SecretScopes: map[string]*resources.SecretScope{
 			"my_secret_scope": {
 				Name: "0",
 			},
 		},
+		Secrets: map[string]*resources.Secret{
+			"my_secret": {
+				Secret: catalog.Secret{
+					CatalogName: "main",
+					SchemaName:  "default",
+					Name:        "my_secret",
+				},
+			},
+		},
 		SqlWarehouses: map[string]*resources.SqlWarehouse{
 			"my_sql_warehouse": {
 				CreateWarehouseRequest: sql.CreateWarehouseRequest{},
@@ -273,6 +321,53 @@ func TestResourcesBindSupport(t *testing.T) {
 				},
 			},
 		},
+		PostgresCatalogs: map[string]*resources.PostgresCatalog{
+			"my_postgres_catalog": {
+				PostgresCatalogConfig: resources.PostgresCatalogConfig{
+					CatalogId: "my_postgres_catalog",
+				},
+			},
+		},
+		PostgresDatabases: map[string]*resources.PostgresDatabase{
+			"my_postgres_database": {
+				PostgresDatabaseConfig: resources.PostgresDatabaseConfig{
+					DatabaseId: "my-postgres-database",
+					Parent:     "projects/my-postgres-project/branches/my-postgres-branch",
+				},
+			},
+		},
+		PostgresRoles: map[string]*resources.PostgresRole{
+			"my_postgres_role": {
+				PostgresRoleConfig: resources.PostgresRoleConfig{
+					RoleId: "my-postgres-role",
+					Parent: "projects/my-postgres-project/branches/my-postgres-branch",
+					RoleRoleSpec: postgres.RoleRoleSpec{
+						PostgresRole: "my_postgres_role",
+					},
+				},
+			},
+		},
+		PostgresSyncedTables: map[string]*resources.PostgresSyncedTable{
+			"my_postgres_synced_table": {
+				PostgresSyncedTableConfig: resources.PostgresSyncedTableConfig{
+					SyncedTableId: "catalog.schema.my_postgres_synced_table",
+				},
+			},
+		},
+		PostgresSnapshotSchedules: map[string]*resources.PostgresSnapshotSchedule{
+			"my_postgres_snapshot_schedule": {
+				PostgresSnapshotScheduleConfig: resources.PostgresSnapshotScheduleConfig{
+					Branch: "projects/my-postgres-project/branches/my-postgres-branch",
+				},
+			},
+		},
+		Features: map[string]*resources.Feature{
+			"my_feature": {
+				Feature: ml.Feature{
+					FullName: "main.myschema.my_feature",
+				},
+			},
+		},
 		VectorSearchEndpoints: map[string]*resources.VectorSearchEndpoint{
 			"my_vector_search_endpoint": {
 				CreateEndpoint: vectorsearch.CreateEndpoint{
@@ -281,27 +376,46 @@ func TestResourcesBindSupport(t *testing.T) {
 				},
 			},
 		},
+		VectorSearchIndexes: map[string]*resources.VectorSearchIndex{
+			"my_vector_search_index": {
+				CreateVectorIndexRequest: vectorsearch.CreateVectorIndexRequest{
+					Name:         "my_vector_search_index",
+					EndpointName: "my_vector_search_endpoint",
+					PrimaryKey:   "id",
+					IndexType:    vectorsearch.VectorIndexTypeDeltaSync,
+				},
+			},
+		},
 	}
 	unbindableResources := map[string]bool{
-		"model": true,
+		"model":                       true,
+		"internal_immutable_snapshot": true,
 	}
 
 	ctx := t.Context()
 	m := mocks.NewMockWorkspaceClient(t)
 	m.GetMockJobsAPI().EXPECT().Get(mock.Anything, mock.Anything).Return(nil, nil)
+	m.GetMockJobsAPI().EXPECT().GetRun(mock.Anything, mock.Anything).Return(nil, nil)
 	m.GetMockPipelinesAPI().EXPECT().Get(mock.Anything, mock.Anything).Return(nil, nil)
 	m.GetMockExperimentsAPI().EXPECT().GetExperiment(mock.Anything, mock.Anything).Return(nil, nil)
+	m.GetMockFeatureEngineeringAPI().EXPECT().GetFeature(mock.Anything, mock.Anything).Return(nil, nil)
 	m.GetMockRegisteredModelsAPI().EXPECT().Get(mock.Anything, mock.Anything).Return(nil, nil)
 	m.GetMockCatalogsAPI().EXPECT().GetByName(mock.Anything, mock.Anything).Return(nil, nil)
 	m.GetMockExternalLocationsAPI().EXPECT().GetByName(mock.Anything, mock.Anything).Return(nil, nil)
 	m.GetMockSchemasAPI().EXPECT().GetByFullName(mock.Anything, mock.Anything).Return(nil, nil)
 	m.GetMockClustersAPI().EXPECT().GetByClusterId(mock.Anything, mock.Anything).Return(nil, nil)
+	m.GetMockInstancePoolsAPI().EXPECT().GetByInstancePoolId(mock.Anything, mock.Anything).Return(nil, nil)
+	m.GetMockClusterPoliciesAPI().EXPECT().GetByPolicyId(mock.Anything, mock.Anything).Return(nil, nil)
 	m.GetMockLakeviewAPI().EXPECT().Get(mock.Anything, mock.Anything).Return(nil, nil)
+	m.GetMockGenieAPI().EXPECT().GetSpace(mock.Anything, mock.Anything).Return(nil, nil)
 	m.GetMockVolumesAPI().EXPECT().Read(mock.Anything, mock.Anything).Return(nil, nil)
 	m.GetMockAppsAPI().EXPECT().GetByName(mock.Anything, mock.Anything).Return(nil, nil)
 	m.GetMockAlertsV2API().EXPECT().GetAlertById(mock.Anything, mock.Anything).Return(nil, nil)
 	m.GetMockQualityMonitorsAPI().EXPECT().Get(mock.Anything, mock.Anything).Return(nil, nil)
 	m.GetMockServingEndpointsAPI().EXPECT().Get(mock.Anything, mock.Anything).Return(nil, nil)
+	m.GetMockAiGatewayAPI().EXPECT().GetModelService(mock.Anything, mock.Anything).Return(nil, nil)
+	m.GetMockAiGatewayAPI().EXPECT().GetMcpService(mock.Anything, mock.Anything).Return(nil, nil)
+	m.GetMockAiGatewayAPI().EXPECT().GetModelProviderService(mock.Anything, mock.Anything).Return(nil, nil)
 	m.GetMockSecretsAPI().EXPECT().ListScopesAll(mock.Anything).Return([]workspace.SecretScope{
 		{Name: "0"},
 	}, nil)
@@ -312,7 +426,15 @@ func TestResourcesBindSupport(t *testing.T) {
 	m.GetMockPostgresAPI().EXPECT().GetProject(mock.Anything, mock.Anything).Return(nil, nil)
 	m.GetMockPostgresAPI().EXPECT().GetBranch(mock.Anything, mock.Anything).Return(nil, nil)
 	m.GetMockPostgresAPI().EXPECT().GetEndpoint(mock.Anything, mock.Anything).Return(nil, nil)
+	m.GetMockPostgresAPI().EXPECT().GetCatalog(mock.Anything, mock.Anything).Return(nil, nil)
+	m.GetMockPostgresAPI().EXPECT().GetDatabase(mock.Anything, mock.Anything).Return(nil, nil)
+	m.GetMockPostgresAPI().EXPECT().GetRole(mock.Anything, mock.Anything).Return(nil, nil)
+	m.GetMockPostgresAPI().EXPECT().GetSyncedTable(mock.Anything, mock.Anything).Return(nil, nil)
+	m.GetMockPostgresAPI().EXPECT().GetSnapshotSchedule(mock.Anything, mock.Anything).Return(nil, nil)
+	m.GetMockPostgresAPI().EXPECT().GetRole(mock.Anything, mock.Anything).Return(nil, nil)
 	m.GetMockVectorSearchEndpointsAPI().EXPECT().GetEndpoint(mock.Anything, mock.Anything).Return(nil, nil)
+	m.GetMockVectorSearchIndexesAPI().EXPECT().GetIndexByIndexName(mock.Anything, mock.Anything).Return(nil, nil)
+	m.GetMockSecretsUcAPI().EXPECT().GetSecret(mock.Anything, mock.Anything).Return(&catalog.Secret{FullName: "0"}, nil)
 
 	allResources := supportedResources.AllResources()
 	for _, group := range allResources {
@@ -320,8 +442,8 @@ func TestResourcesBindSupport(t *testing.T) {
 			t.Fatalf("Expected at least one resource in group %s", group.Description)
 		}
 		for _, resource := range group.Resources {
-			// bind operation requires resource to be returned from FindResourceByConfigKey
-			r, err := supportedResources.FindResourceByConfigKey("my_" + resource.ResourceDescription().SingularName)
+			// bind operation requires resource to be returned from ResolveKey
+			r, _, err := supportedResources.ResolveKey("my_" + resource.ResourceDescription().SingularName)
 			assert.NoError(t, err)
 
 			// bind operation requires Exists to return true
@@ -331,3 +453,70 @@ func TestResourcesBindSupport(t *testing.T) {
 		}
 	}
 }
+
+func TestAllInteralResourcesAreMarkedAsInternal(t *testing.T) {
+	internalResourceKeys := map[string]reflect.Type{}
+	err := structwalk.WalkType(reflect.TypeFor[Resources](), func(path *structpath.PatternNode, typ reflect.Type, field *reflect.StructField) bool {
+		if path.Len() > 2 {
+			return false
+		}
+		if field == nil {
+			return true
+		}
+		tag := field.Tag.Get("bundle")
+		if structtag.BundleTag(tag).Internal() {
+			internalResourceKeys[field.Name] = typ
+		}
+		return true
+	})
+	assert.NoError(t, err)
+
+	for key, typ := range internalResourceKeys {
+		r := reflect.MakeMap(typ)
+		r.SetMapIndex(reflect.ValueOf("my_resources"), reflect.New(typ.Elem()).Elem())
+
+		resources := &Resources{}
+		res := reflect.ValueOf(resources).Elem()
+		field := res.FieldByName(key)
+		if !field.IsValid() && !field.CanSet() {
+			t.Fatalf("Field %s is not valid", key)
+		}
+		field.Set(r)
+		assert.True(t, resources.HasInternalResources())
+	}
+}
+
+func TestResolveKey(t *testing.T) {
+	r := &Resources{
+		Jobs:      map[string]*resources.Job{"foo": {}, "thing": {}},
+		Pipelines: map[string]*resources.Pipeline{"bar": {}, "thing": {}},
+	}
+
+	tests := []struct {
+		ref      string
+		wantType string
+		wantKey  string
+		wantErr  string
+	}{
+		{ref: "foo", wantType: "jobs", wantKey: "foo"},
+		{ref: "jobs.foo", wantType: "jobs", wantKey: "foo"},
+		{ref: "pipelines.thing", wantType: "pipelines", wantKey: "thing"},
+		{ref: "missing", wantErr: "no such resource: missing"},
+		{ref: "jobs.bar", wantErr: "no such resource: jobs.bar"},
+		{ref: "nosuchtype.foo", wantErr: "no such resource: nosuchtype.foo"},
+		{ref: "thing", wantErr: "ambiguous resource: thing (can resolve to jobs.thing, pipelines.thing); use a qualified name to disambiguate"},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.ref, func(t *testing.T) {
+			res, key, err := r.ResolveKey(tc.ref)
+			if tc.wantErr != "" {
+				assert.EqualError(t, err, tc.wantErr)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tc.wantType, res.ResourceDescription().PluralName)
+			assert.Equal(t, tc.wantKey, key)
+		})
+	}
+}
diff --git a/bundle/config/resources_types.go b/bundle/config/resources_types.go
index 15fac1b93f1..dcc91545f19 100644
--- a/bundle/config/resources_types.go
+++ b/bundle/config/resources_types.go
@@ -26,7 +26,7 @@ var ResourcesTypes = func() map[string]reflect.Type {
 			continue
 		}
 		elemType := field.Type.Elem()
-		if elemType.Kind() == reflect.Ptr {
+		if elemType.Kind() == reflect.Pointer {
 			elemType = elemType.Elem()
 		}
 
diff --git a/bundle/config/resources_types_test.go b/bundle/config/resources_types_test.go
index 5d2a7298c6f..7a698604612 100644
--- a/bundle/config/resources_types_test.go
+++ b/bundle/config/resources_types_test.go
@@ -1,12 +1,22 @@
 package config
 
 import (
+	"encoding/json"
+	"fmt"
 	"reflect"
+	"slices"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 
 	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/dyn/convert"
+	"github.com/databricks/cli/libs/structs/structpath"
+	"github.com/databricks/cli/libs/structs/structtag"
+	"github.com/databricks/cli/libs/structs/structwalk"
 )
 
 func TestResourcesTypesMap(t *testing.T) {
@@ -20,3 +30,158 @@ func TestResourcesTypesMap(t *testing.T) {
 	assert.True(t, ok, "resources type for 'jobs.permissions' not found in ResourcesTypes map")
 	assert.Equal(t, reflect.TypeFor[[]resources.JobPermission](), typ, "resources type for 'jobs.permissions' mismatch")
 }
+
+// TestResourceTypesZeroValueFieldsSerialize guards against the ForceSendFields
+// routing bug fixed in libs/dyn/convert: a field declared in a struct embedded
+// more than one level deep (e.g. PostgresProject -> PostgresProjectConfig ->
+// ProjectSpec) had its zero value recorded in the wrong struct's ForceSendFields,
+// which the SDK marshaler rejects with "field X cannot be found in struct Y".
+// The direct engine hits this path when it serializes planned state to JSON.
+//
+// For every registered resource type it sets every omitempty scalar field (at any
+// depth) to its zero value, converts via ToTyped, and marshals - the same round
+// trip the direct engine performs. Any newly added resource whose wrapper embeds
+// an SDK spec is covered automatically.
+func TestResourceTypesZeroValueFieldsSerialize(t *testing.T) {
+	names := make([]string, 0, len(ResourcesTypes))
+	for name := range ResourcesTypes {
+		names = append(names, name)
+	}
+	slices.Sort(names)
+
+	for _, name := range names {
+		t.Run(name, func(t *testing.T) {
+			typ := ResourcesTypes[name]
+			zeros := zeroValueScalars(typ, 0, map[reflect.Type]bool{})
+			if zeros.Kind() != dyn.KindMap {
+				return
+			}
+
+			ptr := reflect.New(typ)
+			require.NoError(t, convert.ToTyped(ptr.Interface(), zeros))
+
+			_, err := json.Marshal(ptr.Interface())
+			require.NoError(t, err)
+		})
+	}
+}
+
+// zeroValueScalars builds a [dyn.Value] map that sets every omitempty scalar field
+// reachable through embedded anonymous structs to its zero value. Those are exactly
+// the fields the convert layer records in ForceSendFields, so they exercise the
+// routing logic. depth and seen bound recursion against deep or recursive types.
+func zeroValueScalars(t reflect.Type, depth int, seen map[reflect.Type]bool) dyn.Value {
+	for t.Kind() == reflect.Pointer {
+		t = t.Elem()
+	}
+	if t.Kind() != reflect.Struct || depth > 6 || seen[t] {
+		return dyn.NilValue
+	}
+	seen[t] = true
+	defer delete(seen, t)
+
+	m := dyn.NewMapping()
+	for f := range t.Fields() {
+		if f.Anonymous {
+			if sub := zeroValueScalars(f.Type, depth+1, seen); sub.Kind() == dyn.KindMap {
+				for _, p := range sub.MustMap().Pairs() {
+					m.SetLoc(p.Key.MustString(), nil, p.Value)
+				}
+			}
+			continue
+		}
+
+		tag := structtag.JSONTag(f.Tag.Get("json"))
+		name := tag.Name()
+		if name == "" || name == "-" || !f.IsExported() || !tag.OmitEmpty() {
+			continue
+		}
+
+		switch f.Type.Kind() {
+		case reflect.Bool:
+			m.SetLoc(name, nil, dyn.V(false))
+		case reflect.String:
+			m.SetLoc(name, nil, dyn.V(""))
+		case reflect.Int, reflect.Int32, reflect.Int64:
+			m.SetLoc(name, nil, dyn.V(int64(0)))
+		case reflect.Float32, reflect.Float64:
+			m.SetLoc(name, nil, dyn.V(float64(0)))
+		default:
+			// Only basic types are eligible for ForceSendFields; skip the rest.
+		}
+	}
+	return dyn.V(m)
+}
+
+// TestNoSameDepthJSONShadows uses structwalk.WalkType — the dumb walker that
+// visits every field including duplicates — to detect unresolved same-depth json
+// name collisions. A collision is any json name WalkType visits more than once
+// for a resource type, with no depth-0 direct field on the resource struct
+// resolving the ambiguity.
+//
+// structwalk.WalkType is the right tool because it faithfully reproduces the
+// traversal structwalk.Walk uses at the value level: it visits every promoted
+// field from every anonymous embed, even when two embeds declare the same name.
+// Any same-depth collision therefore appears as a path visited twice.
+func TestNoSameDepthJSONShadows(t *testing.T) {
+	rt := reflect.TypeFor[Resources]()
+	var collisions []string
+
+	for f := range rt.Fields() {
+		et := f.Type.Elem()
+		for et.Kind() == reflect.Pointer {
+			et = et.Elem()
+		}
+		if et.Kind() != reflect.Struct {
+			continue
+		}
+		group := structtag.JSONTag(f.Tag.Get("json")).Name()
+
+		// depth0 is the set of json names declared as direct (non-anonymous)
+		// fields on the resource struct itself. A depth-0 field wins over any
+		// same-depth collision at deeper embedding levels, so those are OK.
+		depth0 := map[string]bool{}
+		for sf := range et.Fields() {
+			if sf.Anonymous || sf.PkgPath != "" || sf.Name == "ForceSendFields" {
+				continue
+			}
+			name := structtag.JSONTag(sf.Tag.Get("json")).Name()
+			if name == "" {
+				name = sf.Name
+			}
+			if name != "-" {
+				depth0[name] = true
+			}
+		}
+
+		// Walk the type and count how many times each top-level json name is
+		// visited. structwalk.WalkType is a dumb walker: it visits both
+		// declarations when two anonymous embeds carry the same json name,
+		// naturally surfacing the collision.
+		visits := map[string]int{}
+		_ = structwalk.WalkType(et, func(path *structpath.PatternNode, _ reflect.Type, sf *reflect.StructField) bool {
+			if sf == nil || path == nil {
+				return true
+			}
+			p := strings.TrimPrefix(path.String(), ".")
+			// Only top-level names collide at the resource level.
+			if p != "" && !strings.Contains(p, ".") {
+				visits[p]++
+			}
+			return true
+		})
+
+		for name, count := range visits {
+			if count > 1 && !depth0[name] {
+				collisions = append(collisions,
+					fmt.Sprintf("%s.%s visited %d times by structwalk with no depth-0 field resolving it",
+						group, name, count))
+			}
+		}
+	}
+
+	slices.Sort(collisions)
+	assert.Empty(t, collisions,
+		"same-depth json name collisions found — encoding/json calls these ambiguous "+
+			"and serializes neither; structaccess cannot read or write them either")
+}
diff --git a/bundle/config/root.go b/bundle/config/root.go
index 6d4697cc1ba..a64b742630e 100644
--- a/bundle/config/root.go
+++ b/bundle/config/root.go
@@ -18,12 +18,20 @@ import (
 	"github.com/databricks/cli/libs/dyn/merge"
 	"github.com/databricks/cli/libs/dyn/yamlloader"
 	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/structs/structpath"
 	"github.com/databricks/databricks-sdk-go/service/jobs"
 )
 
 type Script struct {
 	// Content of the script to be executed.
 	Content string `json:"content"`
+
+	// Env is a map of environment variables exported when running the script.
+	// Values may reference ${bundle.*}, ${workspace.*}, ${var.*} (or
+	// ${variables.*}); other prefixes are rejected at validation time.
+	// Use this to pass bundle configuration into a script's shell environment
+	// without polluting the script content with DABs interpolation syntax.
+	Env map[string]string `json:"env,omitempty"`
 }
 
 type Root struct { //nolint:recvcheck // value receivers for read-only accessors, pointer for mutators
@@ -107,12 +115,11 @@ func LoadFromBytes(path string, raw []byte) (*Root, diag.Diagnostics) {
 	// Load configuration tree from YAML.
 	v, err := yamlloader.LoadYAML(path, bytes.NewBuffer(raw))
 	if err != nil {
-		var le *yamlloader.LocationError
-		if errors.As(err, &le) {
+		if le, ok := errors.AsType[*yamlloader.LocationError](err); ok {
 			return nil, diag.Diagnostics{{
 				Severity:  diag.Error,
 				Summary:   le.Summary,
-				Locations: []dyn.Location{le.Loc},
+				Locations: []diag.Location{le.Loc},
 			}}
 		}
 		return nil, diag.Errorf("failed to load %s: %v", path, err)
@@ -282,7 +289,7 @@ func (r *Root) InitializeVariables(vars []string) error {
 
 		err := r.Variables[name].Set(val)
 		if err != nil {
-			return fmt.Errorf("failed to assign %s to %s: %s", val, name, err)
+			return fmt.Errorf("failed to assign %s to %s: %w", val, name, err)
 		}
 	}
 	return nil
@@ -580,10 +587,10 @@ func validateVariableOverrides(root, target dyn.Value) (err error) {
 // Best effort to get the location of configuration value at the specified path.
 // This function is useful to annotate error messages with the location, because
 // we don't want to fail with a different error message if we cannot retrieve the location.
-func (r Root) GetLocation(path string) dyn.Location {
+func (r Root) GetLocation(path string) diag.Location {
 	v, err := dyn.Get(r.value, path)
 	if err != nil {
-		return dyn.Location{}
+		return diag.Location{}
 	}
 	return v.Location()
 }
@@ -591,7 +598,7 @@ func (r Root) GetLocation(path string) dyn.Location {
 // Get all locations of the configuration value at the specified path. We need both
 // this function and it's singular version (GetLocation) because some diagnostics just need
 // the primary location and some need all locations associated with a configuration value.
-func (r Root) GetLocations(path string) []dyn.Location {
+func (r Root) GetLocations(path string) []diag.Location {
 	v, err := dyn.Get(r.value, path)
 	if err != nil {
 		return nil
@@ -599,6 +606,33 @@ func (r Root) GetLocations(path string) []dyn.Location {
 	return v.Locations()
 }
 
+// GetLocationOf is [Root.GetLocation] for a path node.
+func (r Root) GetLocationOf(path *structpath.PathNode) diag.Location {
+	v, ok := r.valueOf(path)
+	if !ok {
+		return diag.Location{}
+	}
+	return v.Location()
+}
+
+// GetLocationsOf is [Root.GetLocations] for a path node.
+func (r Root) GetLocationsOf(path *structpath.PathNode) []diag.Location {
+	v, ok := r.valueOf(path)
+	if !ok {
+		return nil
+	}
+	return v.Locations()
+}
+
+func (r Root) valueOf(path *structpath.PathNode) (dyn.Value, bool) {
+	p, ok := dyn.FromStructPath(path)
+	if !ok {
+		return dyn.InvalidValue, false
+	}
+	v, err := dyn.GetByPath(r.value, p)
+	return v, err == nil
+}
+
 // GetNodeAndType and returns parent resource node and type of the resource in direct backend.
 // Examples:
 //
diff --git a/bundle/config/root_test.go b/bundle/config/root_test.go
index 42fae49d98c..f735c44405e 100644
--- a/bundle/config/root_test.go
+++ b/bundle/config/root_test.go
@@ -47,8 +47,8 @@ func TestInitializeVariables(t *testing.T) {
 
 	err := root.InitializeVariables([]string{"foo=123", "bar=456"})
 	assert.NoError(t, err)
-	assert.Equal(t, "123", (root.Variables["foo"].Value))
-	assert.Equal(t, "456", (root.Variables["bar"].Value))
+	assert.Equal(t, "123", root.Variables["foo"].Value)
+	assert.Equal(t, "456", root.Variables["bar"].Value)
 }
 
 func TestInitializeVariablesWithAnEqualSignInValue(t *testing.T) {
@@ -62,7 +62,7 @@ func TestInitializeVariablesWithAnEqualSignInValue(t *testing.T) {
 
 	err := root.InitializeVariables([]string{"foo=123=567"})
 	assert.NoError(t, err)
-	assert.Equal(t, "123=567", (root.Variables["foo"].Value))
+	assert.Equal(t, "123=567", root.Variables["foo"].Value)
 }
 
 func TestInitializeVariablesInvalidFormat(t *testing.T) {
diff --git a/bundle/config/validate/all_resources_have_values.go b/bundle/config/validate/all_resources_have_values.go
index 7f96e529a74..713ec0f83af 100644
--- a/bundle/config/validate/all_resources_have_values.go
+++ b/bundle/config/validate/all_resources_have_values.go
@@ -3,7 +3,6 @@ package validate
 import (
 	"context"
 	"fmt"
-	"slices"
 	"strings"
 
 	"github.com/databricks/cli/bundle"
@@ -43,7 +42,7 @@ func (m *allResourcesHaveValues) Apply(ctx context.Context, b *bundle.Bundle) di
 				Severity:  diag.Error,
 				Summary:   fmt.Sprintf("%s %s is not defined", rType, rName),
 				Locations: v.Locations(),
-				Paths:     []dyn.Path{slices.Clone(p)},
+				Paths:     dyn.ToStructPaths(p),
 			})
 
 			return v, nil
diff --git a/bundle/config/validate/enum.go b/bundle/config/validate/enum.go
index e6266163bc8..2ce99ea1d19 100644
--- a/bundle/config/validate/enum.go
+++ b/bundle/config/validate/enum.go
@@ -69,13 +69,12 @@ func (f *enum) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
 		if !validValue {
 			// p is a slice of path components. We need to clone it before using it in diagnostics
 			// since the WalkReadOnly function will mutate it while walking the config tree.
-			cloneP := slices.Clone(p)
 
 			diags = diags.Append(diag.Diagnostic{
 				Severity:  diag.Warning,
 				Summary:   fmt.Sprintf("invalid value %q for enum field. Valid values are %v", strValue, validValues),
 				Locations: v.Locations(),
-				Paths:     []dyn.Path{cloneP},
+				Paths:     dyn.ToStructPaths(p),
 			})
 		}
 
diff --git a/bundle/config/validate/files_to_sync.go b/bundle/config/validate/files_to_sync.go
index aea78f7104b..14b032e8da1 100644
--- a/bundle/config/validate/files_to_sync.go
+++ b/bundle/config/validate/files_to_sync.go
@@ -6,7 +6,8 @@ import (
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/bundle/deploy/files"
 	"github.com/databricks/cli/libs/diag"
-	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/structs/structpath"
+	"github.com/databricks/cli/libs/sync"
 )
 
 func FilesToSync() bundle.ReadOnlyMutator {
@@ -26,7 +27,14 @@ func (v *filesToSync) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnost
 		return nil
 	}
 
-	sync, err := files.GetSync(ctx, b)
+	var sync *sync.Sync
+	var err error
+	if b.IsImmutableFolder() {
+		sync, err = files.GetNoValidateSync(ctx, b)
+	} else {
+		sync, err = files.GetSync(ctx, b)
+	}
+
 	if err != nil {
 		return diag.FromErr(err)
 	}
@@ -48,14 +56,14 @@ func (v *filesToSync) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnost
 			Summary:  "There are no files to sync, please check your .gitignore",
 		})
 	} else {
-		path := "sync.exclude"
+		path := structpath.NewPath(nil, "sync", "exclude")
 		diags = diags.Append(diag.Diagnostic{
 			Severity: diag.Warning,
 			Summary:  "There are no files to sync, please check your .gitignore and sync.exclude configuration",
 			// Show all locations where sync.exclude is defined, since merging
 			// sync.exclude is additive.
-			Locations: b.Config.GetLocations(path),
-			Paths:     []dyn.Path{dyn.MustPathFromString(path)},
+			Locations: b.Config.GetLocationsOf(path),
+			Paths:     []*structpath.PathNode{path},
 		})
 	}
 
diff --git a/bundle/config/validate/folder_permissions.go b/bundle/config/validate/folder_permissions.go
index 7ea2ee8cee8..0a201a272d8 100644
--- a/bundle/config/validate/folder_permissions.go
+++ b/bundle/config/validate/folder_permissions.go
@@ -2,17 +2,12 @@ package validate
 
 import (
 	"context"
-	"fmt"
-	"path"
-	"strconv"
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/bundle/libraries"
 	"github.com/databricks/cli/bundle/paths"
 	"github.com/databricks/cli/bundle/permissions"
 	"github.com/databricks/cli/libs/diag"
-	"github.com/databricks/databricks-sdk-go/apierr"
-	"github.com/databricks/databricks-sdk-go/service/workspace"
 	"golang.org/x/sync/errgroup"
 )
 
@@ -23,7 +18,14 @@ func (f *folderPermissions) Apply(ctx context.Context, b *bundle.Bundle) diag.Di
 		return nil
 	}
 
-	bundlePaths := paths.CollectUniqueWorkspacePathPrefixes(b.Config.Workspace)
+	workspace := b.Config.Workspace
+	if b.IsImmutableFolder() {
+		// file_path and artifact_path reference the snapshot, which does not exist until
+		// deploy, so there is no folder to check. See permissions.ApplyWorkspaceRootPermissions.
+		workspace.FilePath = ""
+		workspace.ArtifactPath = ""
+	}
+	bundlePaths := paths.CollectUniqueWorkspacePathPrefixes(workspace).Paths
 
 	var diags diag.Diagnostics
 	g, ctx := errgroup.WithContext(ctx)
@@ -54,44 +56,12 @@ func checkFolderPermission(ctx context.Context, b *bundle.Bundle, folderPath str
 	}
 
 	w := b.WorkspaceClient(ctx).Workspace
-	obj, err := getClosestExistingObject(ctx, w, folderPath)
-	if err != nil {
-		return diag.FromErr(err)
-	}
-
-	objPermissions, err := w.GetPermissions(ctx, workspace.GetWorkspaceObjectPermissionsRequest{
-		WorkspaceObjectId:   strconv.FormatInt(obj.ObjectId, 10),
-		WorkspaceObjectType: "directories",
-	})
+	acl, err := permissions.ResolveFolderACL(ctx, w, folderPath)
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
-	p := permissions.ObjectAclToResourcePermissions(folderPath, objPermissions.AccessControlList)
-	return p.Compare(b.Config.Permissions)
-}
-
-func getClosestExistingObject(ctx context.Context, w workspace.WorkspaceInterface, folderPath string) (*workspace.ObjectInfo, error) {
-	for {
-		obj, err := w.GetStatusByPath(ctx, folderPath) //nolint:staticcheck // Deprecated in SDK v0.127.0. Migration to WorkspaceHierarchyService tracked separately.
-		if err == nil {
-			return obj, nil
-		}
-
-		if !apierr.IsMissing(err) {
-			return nil, err
-		}
-
-		parent := path.Dir(folderPath)
-		// If the parent is the same as the current folder, then we have reached the root
-		if folderPath == parent {
-			break
-		}
-
-		folderPath = parent
-	}
-
-	return nil, fmt.Errorf("folder %s and its parent folders do not exist", folderPath)
+	return acl.Permissions.Compare(b.Config.Permissions)
 }
 
 // Name implements bundle.ReadOnlyMutator.
diff --git a/bundle/config/validate/interpolation_in_auth_config.go b/bundle/config/validate/interpolation_in_auth_config.go
index 1598ef49d88..f749f9e0613 100644
--- a/bundle/config/validate/interpolation_in_auth_config.go
+++ b/bundle/config/validate/interpolation_in_auth_config.go
@@ -78,7 +78,7 @@ func (f *noInterpolationInAuthConfig) Apply(ctx context.Context, b *bundle.Bundl
 				Detail: fmt.Sprintf(`Interpolation is not supported for the field %s. Please set
 the %s environment variable if you wish to configure this field at runtime.`, p.String(), envVar),
 				Locations: v.Locations(),
-				Paths:     []dyn.Path{p},
+				Paths:     dyn.ToStructPaths(p),
 			})
 		}
 	}
diff --git a/bundle/config/validate/job_cluster_key_defined.go b/bundle/config/validate/job_cluster_key_defined.go
index 5ae2f5437b8..eb9bea4df70 100644
--- a/bundle/config/validate/job_cluster_key_defined.go
+++ b/bundle/config/validate/job_cluster_key_defined.go
@@ -6,7 +6,7 @@ import (
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/libs/diag"
-	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/structs/structpath"
 )
 
 func JobClusterKeyDefined() bundle.ReadOnlyMutator {
@@ -31,23 +31,36 @@ func (v *jobClusterKeyDefined) Apply(ctx context.Context, b *bundle.Bundle) diag
 		}
 
 		for index, task := range job.Tasks {
-			if task.JobClusterKey != "" {
-				if _, ok := jobClusterKeys[task.JobClusterKey]; !ok {
-					path := fmt.Sprintf("resources.jobs.%s.tasks[%d].job_cluster_key", k, index)
-
-					diags = diags.Append(diag.Diagnostic{
-						Severity: diag.Warning,
-						Summary:  fmt.Sprintf("job_cluster_key %s is not defined", task.JobClusterKey),
-						// Show only the location where the job_cluster_key is defined.
-						// Other associated locations are not relevant since they are
-						// overridden during merging.
-						Locations: b.Config.GetLocations(path),
-						Paths:     []dyn.Path{dyn.MustPathFromString(path)},
-					})
-				}
+			diags = diags.Extend(checkJobClusterKey(b, jobClusterKeys, task.JobClusterKey,
+				structpath.NewPath(nil, "resources", "jobs", k, "tasks", index, "job_cluster_key")))
+
+			// The Jobs API rejects nested for_each_task, so one level is sufficient.
+			if task.ForEachTask != nil {
+				diags = diags.Extend(checkJobClusterKey(b, jobClusterKeys, task.ForEachTask.Task.JobClusterKey,
+					structpath.NewPath(nil, "resources", "jobs", k, "tasks", index, "for_each_task", "task", "job_cluster_key")))
 			}
 		}
 	}
 
 	return diags
 }
+
+// checkJobClusterKey warns if jobClusterKey is set but not defined in the job's job_clusters.
+func checkJobClusterKey(b *bundle.Bundle, jobClusterKeys map[string]bool, jobClusterKey string, path *structpath.PathNode) diag.Diagnostics {
+	if jobClusterKey == "" {
+		return nil
+	}
+	if _, ok := jobClusterKeys[jobClusterKey]; ok {
+		return nil
+	}
+
+	return diag.Diagnostics{{
+		Severity: diag.Warning,
+		Summary:  fmt.Sprintf("job_cluster_key %s is not defined", jobClusterKey),
+		// Show only the location where the job_cluster_key is defined.
+		// Other associated locations are not relevant since they are
+		// overridden during merging.
+		Locations: b.Config.GetLocationsOf(path),
+		Paths:     []*structpath.PathNode{path},
+	}}
+}
diff --git a/bundle/config/validate/job_cluster_key_defined_test.go b/bundle/config/validate/job_cluster_key_defined_test.go
index 4cc35c1ad68..248bc31a60e 100644
--- a/bundle/config/validate/job_cluster_key_defined_test.go
+++ b/bundle/config/validate/job_cluster_key_defined_test.go
@@ -62,6 +62,67 @@ func TestJobClusterKeyNotDefined(t *testing.T) {
 	require.Equal(t, "job_cluster_key do-not-exist is not defined", diags[0].Summary)
 }
 
+func TestJobClusterKeyDefinedInForEachTask(t *testing.T) {
+	b := &bundle.Bundle{
+		Config: config.Root{
+			Resources: config.Resources{
+				Jobs: map[string]*resources.Job{
+					"job1": {
+						JobSettings: jobs.JobSettings{
+							Name: "job1",
+							JobClusters: []jobs.JobCluster{
+								{JobClusterKey: "do-not-exist"},
+							},
+							Tasks: []jobs.Task{
+								{
+									ForEachTask: &jobs.ForEachTask{
+										Task: jobs.Task{JobClusterKey: "do-not-exist"},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	diags := JobClusterKeyDefined().Apply(t.Context(), b)
+	require.Empty(t, diags)
+	require.NoError(t, diags.Error())
+}
+
+func TestJobClusterKeyNotDefinedInForEachTask(t *testing.T) {
+	b := &bundle.Bundle{
+		Config: config.Root{
+			Resources: config.Resources{
+				Jobs: map[string]*resources.Job{
+					"job1": {
+						JobSettings: jobs.JobSettings{
+							Name: "job1",
+							Tasks: []jobs.Task{
+								{
+									ForEachTask: &jobs.ForEachTask{
+										Task: jobs.Task{JobClusterKey: "do-not-exist"},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	diags := JobClusterKeyDefined().Apply(t.Context(), b)
+	require.Len(t, diags, 1)
+	require.NoError(t, diags.Error())
+	require.Equal(t, diag.Warning, diags[0].Severity)
+	require.Equal(t, "job_cluster_key do-not-exist is not defined", diags[0].Summary)
+	require.Len(t, diags[0].Paths, 1)
+	require.Equal(t, "resources.jobs.job1.tasks[0].for_each_task.task.job_cluster_key", diags[0].Paths[0].String())
+}
+
 func TestJobClusterKeyDefinedInDifferentJob(t *testing.T) {
 	b := &bundle.Bundle{
 		Config: config.Root{
diff --git a/bundle/config/validate/job_task_cluster_spec.go b/bundle/config/validate/job_task_cluster_spec.go
index 79672be63e6..e387d83f6fb 100644
--- a/bundle/config/validate/job_task_cluster_spec.go
+++ b/bundle/config/validate/job_task_cluster_spec.go
@@ -8,6 +8,7 @@ import (
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/structs/structpath"
 	"github.com/databricks/databricks-sdk-go/service/jobs"
 )
 
@@ -88,12 +89,13 @@ func validateJobTask(b *bundle.Bundle, task jobs.Task, taskPath dyn.Path) diag.D
 				strings.Join(unspecified, ", "),
 			)
 
+			taskNode := dyn.ToStructPath(taskPath)
 			diags = diags.Append(diag.Diagnostic{
 				Severity:  diag.Error,
 				Summary:   "Missing required cluster or environment settings",
 				Detail:    detail,
-				Locations: b.Config.GetLocations(taskPath.String()),
-				Paths:     []dyn.Path{taskPath},
+				Locations: b.Config.GetLocationsOf(taskNode),
+				Paths:     []*structpath.PathNode{taskNode},
 			})
 		}
 	}
diff --git a/bundle/config/validate/job_task_cluster_spec_test.go b/bundle/config/validate/job_task_cluster_spec_test.go
index 3ba2e841a65..6f7d31ee944 100644
--- a/bundle/config/validate/job_task_cluster_spec_test.go
+++ b/bundle/config/validate/job_task_cluster_spec_test.go
@@ -167,9 +167,7 @@ Specify one of the following fields: job_cluster_key, environment_key, existing_
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
 			job := &resources.Job{
-				JobSettings: jobs.JobSettings{
-					Tasks: []jobs.Task{tc.task},
-				},
+				Tasks: []jobs.Task{tc.task},
 			}
 
 			b := createBundle(map[string]*resources.Job{"job1": job})
diff --git a/bundle/config/validate/no_interpolation_in_bundle_name.go b/bundle/config/validate/no_interpolation_in_bundle_name.go
index c4238ffe25a..8fc547b174e 100644
--- a/bundle/config/validate/no_interpolation_in_bundle_name.go
+++ b/bundle/config/validate/no_interpolation_in_bundle_name.go
@@ -5,9 +5,9 @@ import (
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/libs/diag"
-	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/cli/libs/dyn/dynvar"
 	"github.com/databricks/cli/libs/logdiag"
+	"github.com/databricks/cli/libs/structs/structpath"
 )
 
 type noInterpolationInBundleName struct{}
@@ -29,7 +29,7 @@ is a part of the path at which your bundle state is stored at by default. Parame
 runtime can have unexpected consequences like duplicate deployments or resources not being
 cleaned up during bundle destroy.`,
 			Locations: b.Config.GetLocations("bundle.name"),
-			Paths:     []dyn.Path{dyn.MustPathFromString("bundle.name")},
+			Paths:     structpath.NewPathSlice("bundle", "name"),
 		})
 	}
 
diff --git a/bundle/config/validate/no_variable_reference_in_resource_key.go b/bundle/config/validate/no_variable_reference_in_resource_key.go
index 5ad5b58f200..75b8361ce97 100644
--- a/bundle/config/validate/no_variable_reference_in_resource_key.go
+++ b/bundle/config/validate/no_variable_reference_in_resource_key.go
@@ -41,7 +41,7 @@ func (m *noVariableReferenceInResourceKey) Apply(_ context.Context, b *bundle.Bu
 						Severity:  diag.Error,
 						Summary:   fmt.Sprintf("resource key %q must not contain variable references", key),
 						Locations: v.Locations(),
-						Paths:     []dyn.Path{p},
+						Paths:     dyn.ToStructPaths(p),
 					})
 				}
 				return v, nil
diff --git a/bundle/config/validate/pipeline_development_deprecated.go b/bundle/config/validate/pipeline_development_deprecated.go
new file mode 100644
index 00000000000..3eb3c77c5f0
--- /dev/null
+++ b/bundle/config/validate/pipeline_development_deprecated.go
@@ -0,0 +1,67 @@
+package validate
+
+import (
+	"context"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/libs/diag"
+	"github.com/databricks/cli/libs/dyn"
+)
+
+const (
+	pipelineDevelopmentDeprecatedSummary = `The "development" property of pipelines is deprecated. Use "mode: development" in your databricks.yml instead. See https://docs.databricks.com/dev-tools/bundles/deployment-modes.`
+
+	pipelineDevelopmentIgnoredSummary = `The "development: false" set by a Python mutator is ignored when running the pipeline. "bundle run" uses development mode from "mode: development" instead.`
+	pipelineDevelopmentIgnoredDetail  = `To run this pipeline in production, set "presets.pipelines_development: false" on the target.`
+)
+
+type pipelineDevelopmentDeprecated struct{ bundle.RO }
+
+// PipelineDevelopmentDeprecated warns when the development property is set on a pipeline.
+func PipelineDevelopmentDeprecated() bundle.ReadOnlyMutator {
+	return &pipelineDevelopmentDeprecated{}
+}
+
+func (v *pipelineDevelopmentDeprecated) Name() string {
+	return "validate:pipeline_development_deprecated"
+}
+
+func (v *pipelineDevelopmentDeprecated) Apply(_ context.Context, b *bundle.Bundle) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	presetEnabled := config.IsExplicitlyEnabled(b.Config.Presets.PipelinesDevelopment)
+
+	pattern := dyn.NewPattern(dyn.Key("resources"), dyn.Key("pipelines"), dyn.AnyKey(), dyn.Key("development"))
+	_, err := dyn.MapByPattern(b.Config.Value(), pattern, func(p dyn.Path, v dyn.Value) (dyn.Value, error) {
+		// Only user-written values have a location; the value set by "mode: development" does not.
+		if len(v.Locations()) == 0 {
+			return v, nil
+		}
+
+		diags = append(diags, diag.Diagnostic{
+			Severity:  diag.Warning,
+			Summary:   pipelineDevelopmentDeprecatedSummary,
+			Locations: v.Locations(),
+			Paths:     dyn.ToStructPaths(p),
+		})
+
+		// The preset overwrites YAML values with true, so a false here was set by a Python
+		// mutator after the preset ran. "bundle run" still sends development: true.
+		if development, ok := v.AsBool(); ok && presetEnabled && !development {
+			diags = append(diags, diag.Diagnostic{
+				Severity:  diag.Warning,
+				Summary:   pipelineDevelopmentIgnoredSummary,
+				Detail:    pipelineDevelopmentIgnoredDetail,
+				Locations: v.Locations(),
+				Paths:     dyn.ToStructPaths(p),
+			})
+		}
+		return v, nil
+	})
+	if err != nil {
+		return diag.FromErr(err)
+	}
+
+	return diags
+}
diff --git a/bundle/config/validate/required.go b/bundle/config/validate/required.go
index 6f886caab44..9e3274b6f00 100644
--- a/bundle/config/validate/required.go
+++ b/bundle/config/validate/required.go
@@ -5,11 +5,13 @@ import (
 	"context"
 	"fmt"
 	"slices"
+	"strings"
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/bundle/internal/validation/generated"
 	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/structs/structpath"
 )
 
 type required struct{}
@@ -48,8 +50,6 @@ func warnForMissingFields(ctx context.Context, b *bundle.Bundle) diag.Diagnostic
 			return nil
 		}
 
-		cloneP := slices.Clone(p)
-
 		fields := generated.RequiredFields[pattern.String()]
 		for _, field := range fields {
 			vv := v.Get(field)
@@ -58,7 +58,7 @@ func warnForMissingFields(ctx context.Context, b *bundle.Bundle) diag.Diagnostic
 					Severity:  diag.Warning,
 					Summary:   fmt.Sprintf("required field %q is not set", field),
 					Locations: v.Locations(),
-					Paths:     []dyn.Path{cloneP},
+					Paths:     dyn.ToStructPaths(p),
 				})
 			}
 		}
@@ -68,37 +68,49 @@ func warnForMissingFields(ctx context.Context, b *bundle.Bundle) diag.Diagnostic
 		return diag.FromErr(err)
 	}
 
-	// Sort diagnostics to make them deterministic
+	sortDiagnostics(diags)
+
+	return diags
+}
+
+// sortDiagnostics orders diagnostics deterministically, since they are collected
+// by walking maps with random iteration order.
+func sortDiagnostics(diags diag.Diagnostics) {
 	slices.SortFunc(diags, func(a, b diag.Diagnostic) int {
 		// First sort by summary
 		if n := cmp.Compare(a.Summary, b.Summary); n != 0 {
 			return n
 		}
 
-		// Finally sort by locations as a tie breaker if summaries are the same.
-		return cmp.Compare(fmt.Sprintf("%v", a.Locations), fmt.Sprintf("%v", b.Locations))
-	})
+		// Then sort by locations as a tie breaker if summaries are the same.
+		if n := cmp.Compare(fmt.Sprintf("%v", a.Locations), fmt.Sprintf("%v", b.Locations)); n != 0 {
+			return n
+		}
 
-	return diags
+		// Sibling entries can share a location; fall back to path for a stable order.
+		return cmp.Compare(fmt.Sprintf("%v", a.Paths), fmt.Sprintf("%v", b.Paths))
+	})
 }
 
 // Bespoke code to error for fields that are not marked as required in the Go SDK / OpenAPI spec.
 func errorForMissingFields(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
 	// Dashboards should always have a name and warehouse_id.
-	var nameLocations []dyn.Location
-	var namePaths []dyn.Path
-	var warehouseIdLocations []dyn.Location
-	var warehouseIdPaths []dyn.Path
+	var nameLocations []diag.Location
+	var namePaths []*structpath.PathNode
+	var warehouseIdLocations []diag.Location
+	var warehouseIdPaths []*structpath.PathNode
 
 	diags := diag.Diagnostics{}
 	for key, dashboard := range b.Config.Resources.Dashboards {
 		if dashboard.DisplayName == "" {
-			nameLocations = append(nameLocations, b.Config.GetLocations("resources.dashboards."+key)...)
-			namePaths = append(namePaths, dyn.MustPathFromString("resources.dashboards."+key))
+			path := structpath.NewPath(nil, "resources", "dashboards", key)
+			nameLocations = append(nameLocations, b.Config.GetLocationsOf(path)...)
+			namePaths = append(namePaths, path)
 		}
 		if dashboard.WarehouseId == "" {
-			warehouseIdLocations = append(warehouseIdLocations, b.Config.GetLocations("resources.dashboards."+key)...)
-			warehouseIdPaths = append(warehouseIdPaths, dyn.MustPathFromString("resources.dashboards."+key))
+			path := structpath.NewPath(nil, "resources", "dashboards", key)
+			warehouseIdLocations = append(warehouseIdLocations, b.Config.GetLocationsOf(path)...)
+			warehouseIdPaths = append(warehouseIdPaths, path)
 		}
 	}
 
@@ -119,11 +131,120 @@ func errorForMissingFields(ctx context.Context, b *bundle.Bundle) diag.Diagnosti
 		})
 	}
 
+	// sql_warehouses.name is optional in the SDK (json:"name,omitempty") but required
+	// by the backend, which rejects whitespace-only names (name.trim.nonEmpty).
+	for key, warehouse := range b.Config.Resources.SqlWarehouses {
+		if strings.TrimSpace(warehouse.Name) == "" {
+			path := structpath.NewPath(nil, "resources", "sql_warehouses", key)
+			diags = diags.Append(diag.Diagnostic{
+				Severity:  diag.Error,
+				Summary:   "sql_warehouse name is required",
+				Locations: b.Config.GetLocationsOf(path),
+				Paths:     []*structpath.PathNode{path},
+			})
+		}
+	}
+
+	sortDiagnostics(diags)
+
+	return diags
+}
+
+// errorForInvalidGrants errors for grants the backend rejects or that never converge:
+// a missing principal is rejected, and an empty privileges list re-plans forever because
+// the backend drops principals with no privileges. Erroring here (rather than warning)
+// avoids a partial deploy where the securable is created before the grants call fails.
+// Grants exist on every securable, so match any resource type.
+func errorForInvalidGrants(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
+	diags := diag.Diagnostics{}
+
+	_, err := dyn.MapByPattern(
+		b.Config.Value(),
+		dyn.NewPattern(dyn.Key("resources"), dyn.AnyKey(), dyn.AnyKey(), dyn.Key("grants"), dyn.AnyIndex()),
+		func(p dyn.Path, v dyn.Value) (dyn.Value, error) {
+			if isMissingOrEmptyString(v.Get("principal")) {
+				diags = diags.Append(diag.Diagnostic{
+					Severity:  diag.Error,
+					Summary:   "grant principal is required",
+					Locations: v.Locations(),
+					Paths:     dyn.ToStructPaths(p),
+				})
+			}
+			if isMissingOrEmptySequence(v.Get("privileges")) {
+				diags = diags.Append(diag.Diagnostic{
+					Severity:  diag.Error,
+					Summary:   "grant privileges is required",
+					Locations: v.Locations(),
+					Paths:     dyn.ToStructPaths(p),
+				})
+			}
+			return v, nil
+		},
+	)
+	if err != nil {
+		return diag.FromErr(err)
+	}
+
+	sortDiagnostics(diags)
+
+	return diags
+}
+
+// errorForInvalidSecretScopePermissions errors when a permission names no principal.
+// Wrong-typed values are already empty here (normalization only warns and drops them).
+func errorForInvalidSecretScopePermissions(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
+	diags := diag.Diagnostics{}
+
+	for key, scope := range b.Config.Resources.SecretScopes {
+		for i, perm := range scope.Permissions {
+			if perm.UserName != "" || perm.GroupName != "" || perm.ServicePrincipalName != "" {
+				continue
+			}
+			// ApplyBundlePermissions rebuilds permissions via convert.FromTyped and drops
+			// per-entry locations, so point at the scope.
+			diags = diags.Append(diag.Diagnostic{
+				Severity:  diag.Error,
+				Summary:   "secret scope permission principal is required",
+				Detail:    "Set one of user_name, group_name or service_principal_name",
+				Locations: b.Config.GetLocationsOf(structpath.NewPath(nil, "resources", "secret_scopes", key)),
+				Paths:     structpath.NewPathSlice("resources", "secret_scopes", key, "permissions", i),
+			})
+		}
+	}
+
+	sortDiagnostics(diags)
+
 	return diags
 }
 
+// isMissingOrEmptyString reports whether v is unset, null, or an empty string.
+func isMissingOrEmptyString(v dyn.Value) bool {
+	switch v.Kind() {
+	case dyn.KindInvalid, dyn.KindNil:
+		return true
+	case dyn.KindString:
+		return v.MustString() == ""
+	default:
+		return false
+	}
+}
+
+// isMissingOrEmptySequence reports whether v is unset, null, or an empty sequence.
+func isMissingOrEmptySequence(v dyn.Value) bool {
+	switch v.Kind() {
+	case dyn.KindInvalid, dyn.KindNil:
+		return true
+	case dyn.KindSequence:
+		return len(v.MustSequence()) == 0
+	default:
+		return false
+	}
+}
+
 func (f *required) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
 	diags := errorForMissingFields(ctx, b)
+	diags = diags.Extend(errorForInvalidGrants(ctx, b))
+	diags = diags.Extend(errorForInvalidSecretScopePermissions(ctx, b))
 	if diags.HasError() {
 		return diags
 	}
diff --git a/bundle/config/validate/scripts.go b/bundle/config/validate/scripts.go
index 04c6045bb42..323db769d23 100644
--- a/bundle/config/validate/scripts.go
+++ b/bundle/config/validate/scripts.go
@@ -4,12 +4,13 @@ import (
 	"context"
 	"fmt"
 	"maps"
-	"regexp"
 	"slices"
+	"strings"
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/dyn/dynvar"
 )
 
 type validateScripts struct{}
@@ -22,10 +23,14 @@ func (f *validateScripts) Name() string {
 	return "validate:scripts"
 }
 
-func (f *validateScripts) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
-	diags := diag.Diagnostics{}
+// allowedEnvRefPrefixes are the variable prefixes that may appear in a
+// script's "env:" section. These match the prefixes resolved before scripts
+// execute (defaultPrefixes in resolve_variable_references.go); "var" is the
+// shorthand for "variables".
+var allowedEnvRefPrefixes = []string{"bundle", "workspace", "var", "variables"}
 
-	re := regexp.MustCompile(`\$\{.*\}`)
+func (f *validateScripts) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
+	var diags diag.Diagnostics
 
 	// Sort the scripts to have a deterministic order for the
 	// generated diagnostics.
@@ -33,33 +38,74 @@ func (f *validateScripts) Apply(ctx context.Context, b *bundle.Bundle) diag.Diag
 
 	for _, k := range scriptKeys {
 		script := b.Config.Scripts[k]
-		p := dyn.NewPath(dyn.Key("scripts"), dyn.Key(k), dyn.Key("content"))
+		contentPath := dyn.NewPath(dyn.Key("scripts"), dyn.Key(k), dyn.Key("content"))
 
 		if script.Content == "" {
 			diags = append(diags, diag.Diagnostic{
 				Severity: diag.Error,
 				Summary:  fmt.Sprintf("Script %s has no content", k),
-				Paths:    []dyn.Path{p},
+				Paths:    dyn.ToStructPaths(contentPath),
 			})
 			continue
 		}
 
-		v, err := dyn.GetByPath(b.Config.Value(), p)
-		if err != nil {
-			return diags.Extend(diag.FromErr(err))
+		diags = diags.Extend(validateScriptContent(b, k, script.Content, contentPath))
+		diags = diags.Extend(validateScriptEnv(b, k, script.Env))
+	}
+
+	return diags
+}
+
+// validateScriptContent rejects any ${...} reference in a script's content.
+// Content is passed to the shell as-is, so ${...} would be ambiguous with a
+// bundle reference; reference a declared env entry with $NAME instead.
+func validateScriptContent(b *bundle.Bundle, key, content string, p dyn.Path) diag.Diagnostics {
+	ref, ok := dynvar.NewRef(dyn.V(content))
+	if !ok {
+		return nil
+	}
+
+	first := ref.Matches[0][0]
+	v, _ := dyn.GetByPath(b.Config.Value(), p)
+	return diag.Diagnostics{{
+		Severity: diag.Error,
+		Summary:  fmt.Sprintf("Found %s in script %s.content. Interpolation syntax ${...} is not supported in script content", first, key),
+		Detail: `The ${...} syntax is not allowed in script content. To use a bundle value,
+declare an environment variable in the script's "env:" section and reference it
+from "content" with $NAME:
+
+  scripts:
+    ` + key + `:
+      env:
+        MY_VAR: ${var.foo}
+      content: echo "$MY_VAR"`,
+		Locations: v.Locations(),
+		Paths:     dyn.ToStructPaths(p),
+	}}
+}
+
+func validateScriptEnv(b *bundle.Bundle, key string, env map[string]string) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	for _, name := range slices.Sorted(maps.Keys(env)) {
+		ref, ok := dynvar.NewRef(dyn.V(env[name]))
+		if !ok {
+			continue
 		}
 
-		// Check for interpolation syntax
-		match := re.FindString(script.Content)
-		if match != "" {
+		envValuePath := dyn.NewPath(dyn.Key("scripts"), dyn.Key(key), dyn.Key("env"), dyn.Key(name))
+		v, _ := dyn.GetByPath(b.Config.Value(), envValuePath)
+
+		for _, refPath := range ref.References() {
+			prefix, _, _ := strings.Cut(refPath, ".")
+			if slices.Contains(allowedEnvRefPrefixes, prefix) {
+				continue
+			}
 			diags = append(diags, diag.Diagnostic{
-				Severity: diag.Error,
-				Summary:  fmt.Sprintf("Found %s in script %s. Interpolation syntax ${...} is not allowed in scripts", match, k),
-				Detail: `We do not support the ${...} interpolation syntax in scripts because
-it's ambiguous whether it's a variable reference or reference to an
-environment variable.`,
+				Severity:  diag.Error,
+				Summary:   fmt.Sprintf("${%s} cannot be used in scripts.%s.env.%s; only ${bundle.*}, ${workspace.*}, and ${var.*} are resolved before scripts execute", refPath, key, name),
 				Locations: v.Locations(),
-				Paths:     []dyn.Path{p},
+				Paths:     dyn.ToStructPaths(envValuePath),
 			})
 		}
 	}
diff --git a/bundle/config/validate/single_node_cluster.go b/bundle/config/validate/single_node_cluster.go
index f4f6f0e5954..88b7536f80b 100644
--- a/bundle/config/validate/single_node_cluster.go
+++ b/bundle/config/validate/single_node_cluster.go
@@ -128,7 +128,7 @@ func (m *singleNodeCluster) Apply(ctx context.Context, b *bundle.Bundle) diag.Di
 				Summary:   singleNodeWarningSummary,
 				Detail:    singleNodeWarningDetail,
 				Locations: v.Locations(),
-				Paths:     []dyn.Path{p},
+				Paths:     dyn.ToStructPaths(p),
 			}
 
 			if showSingleNodeClusterWarning(ctx, v) {
diff --git a/bundle/config/validate/single_node_cluster_test.go b/bundle/config/validate/single_node_cluster_test.go
index bbda86f2ff3..997d39ea0ac 100644
--- a/bundle/config/validate/single_node_cluster_test.go
+++ b/bundle/config/validate/single_node_cluster_test.go
@@ -9,6 +9,7 @@ import (
 	"github.com/databricks/cli/bundle/internal/bundletest"
 	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/structs/structpath"
 	"github.com/databricks/databricks-sdk-go/service/compute"
 	"github.com/databricks/databricks-sdk-go/service/jobs"
 	"github.com/databricks/databricks-sdk-go/service/pipelines"
@@ -108,7 +109,7 @@ func TestValidateSingleNodeClusterFailForInteractiveClusters(t *testing.T) {
 				},
 			}
 
-			bundletest.SetLocation(b, "resources.clusters.foo", []dyn.Location{{File: "a.yml", Line: 1, Column: 1}})
+			bundletest.SetLocation(b, "resources.clusters.foo", []diag.Location{{File: "a.yml", Line: 1, Column: 1}})
 
 			// We can't set num_workers to 0 explicitly in the typed configuration.
 			// Do it on the dyn.Value directly.
@@ -121,8 +122,8 @@ func TestValidateSingleNodeClusterFailForInteractiveClusters(t *testing.T) {
 					Severity:  diag.Warning,
 					Summary:   singleNodeWarningSummary,
 					Detail:    singleNodeWarningDetail,
-					Locations: []dyn.Location{{File: "a.yml", Line: 1, Column: 1}},
-					Paths:     []dyn.Path{dyn.NewPath(dyn.Key("resources"), dyn.Key("clusters"), dyn.Key("foo"))},
+					Locations: []diag.Location{{File: "a.yml", Line: 1, Column: 1}},
+					Paths:     structpath.NewPathSlice("resources", "clusters", "foo"),
 				},
 			}, diags)
 		})
@@ -142,7 +143,7 @@ func TestValidateSingleNodeClusterFailForJobClusters(t *testing.T) {
 								JobSettings: jobs.JobSettings{
 									JobClusters: []jobs.JobCluster{
 										{
-											NewCluster: compute.ClusterSpec{
+											NewCluster: &compute.ClusterSpec{
 												ClusterName: "my_cluster",
 												SparkConf:   tc.sparkConf,
 												CustomTags:  tc.customTags,
@@ -156,7 +157,7 @@ func TestValidateSingleNodeClusterFailForJobClusters(t *testing.T) {
 				},
 			}
 
-			bundletest.SetLocation(b, "resources.jobs.foo.job_clusters[0].new_cluster", []dyn.Location{{File: "b.yml", Line: 1, Column: 1}})
+			bundletest.SetLocation(b, "resources.jobs.foo.job_clusters[0].new_cluster", []diag.Location{{File: "b.yml", Line: 1, Column: 1}})
 
 			// We can't set num_workers to 0 explicitly in the typed configuration.
 			// Do it on the dyn.Value directly.
@@ -170,8 +171,8 @@ func TestValidateSingleNodeClusterFailForJobClusters(t *testing.T) {
 					Severity:  diag.Warning,
 					Summary:   singleNodeWarningSummary,
 					Detail:    singleNodeWarningDetail,
-					Locations: []dyn.Location{{File: "b.yml", Line: 1, Column: 1}},
-					Paths:     []dyn.Path{dyn.MustPathFromString("resources.jobs.foo.job_clusters[0].new_cluster")},
+					Locations: []diag.Location{{File: "b.yml", Line: 1, Column: 1}},
+					Paths:     structpath.MustParsePaths("resources.jobs.foo.job_clusters[0].new_cluster"),
 				},
 			}, diags)
 		})
@@ -205,7 +206,7 @@ func TestValidateSingleNodeClusterFailForJobTaskClusters(t *testing.T) {
 				},
 			}
 
-			bundletest.SetLocation(b, "resources.jobs.foo.tasks[0].new_cluster", []dyn.Location{{File: "c.yml", Line: 1, Column: 1}})
+			bundletest.SetLocation(b, "resources.jobs.foo.tasks[0].new_cluster", []diag.Location{{File: "c.yml", Line: 1, Column: 1}})
 
 			// We can't set num_workers to 0 explicitly in the typed configuration.
 			// Do it on the dyn.Value directly.
@@ -219,8 +220,8 @@ func TestValidateSingleNodeClusterFailForJobTaskClusters(t *testing.T) {
 					Severity:  diag.Warning,
 					Summary:   singleNodeWarningSummary,
 					Detail:    singleNodeWarningDetail,
-					Locations: []dyn.Location{{File: "c.yml", Line: 1, Column: 1}},
-					Paths:     []dyn.Path{dyn.MustPathFromString("resources.jobs.foo.tasks[0].new_cluster")},
+					Locations: []diag.Location{{File: "c.yml", Line: 1, Column: 1}},
+					Paths:     structpath.MustParsePaths("resources.jobs.foo.tasks[0].new_cluster"),
 				},
 			}, diags)
 		})
@@ -251,7 +252,7 @@ func TestValidateSingleNodeClusterFailForPipelineClusters(t *testing.T) {
 				},
 			}
 
-			bundletest.SetLocation(b, "resources.pipelines.foo.clusters[0]", []dyn.Location{{File: "d.yml", Line: 1, Column: 1}})
+			bundletest.SetLocation(b, "resources.pipelines.foo.clusters[0]", []diag.Location{{File: "d.yml", Line: 1, Column: 1}})
 
 			// We can't set num_workers to 0 explicitly in the typed configuration.
 			// Do it on the dyn.Value directly.
@@ -265,8 +266,8 @@ func TestValidateSingleNodeClusterFailForPipelineClusters(t *testing.T) {
 					Severity:  diag.Warning,
 					Summary:   singleNodeWarningSummary,
 					Detail:    singleNodeWarningDetail,
-					Locations: []dyn.Location{{File: "d.yml", Line: 1, Column: 1}},
-					Paths:     []dyn.Path{dyn.MustPathFromString("resources.pipelines.foo.clusters[0]")},
+					Locations: []diag.Location{{File: "d.yml", Line: 1, Column: 1}},
+					Paths:     structpath.MustParsePaths("resources.pipelines.foo.clusters[0]"),
 				},
 			}, diags)
 		})
@@ -304,7 +305,7 @@ func TestValidateSingleNodeClusterFailForJobForEachTaskCluster(t *testing.T) {
 				},
 			}
 
-			bundletest.SetLocation(b, "resources.jobs.foo.tasks[0].for_each_task.task.new_cluster", []dyn.Location{{File: "e.yml", Line: 1, Column: 1}})
+			bundletest.SetLocation(b, "resources.jobs.foo.tasks[0].for_each_task.task.new_cluster", []diag.Location{{File: "e.yml", Line: 1, Column: 1}})
 
 			// We can't set num_workers to 0 explicitly in the typed configuration.
 			// Do it on the dyn.Value directly.
@@ -318,8 +319,8 @@ func TestValidateSingleNodeClusterFailForJobForEachTaskCluster(t *testing.T) {
 					Severity:  diag.Warning,
 					Summary:   singleNodeWarningSummary,
 					Detail:    singleNodeWarningDetail,
-					Locations: []dyn.Location{{File: "e.yml", Line: 1, Column: 1}},
-					Paths:     []dyn.Path{dyn.MustPathFromString("resources.jobs.foo.tasks[0].for_each_task.task.new_cluster")},
+					Locations: []diag.Location{{File: "e.yml", Line: 1, Column: 1}},
+					Paths:     structpath.MustParsePaths("resources.jobs.foo.tasks[0].for_each_task.task.new_cluster"),
 				},
 			}, diags)
 		})
@@ -415,7 +416,7 @@ func TestValidateSingleNodeClusterPassJobClusters(t *testing.T) {
 								JobSettings: jobs.JobSettings{
 									JobClusters: []jobs.JobCluster{
 										{
-											NewCluster: compute.ClusterSpec{
+											NewCluster: &compute.ClusterSpec{
 												ClusterName: "my_cluster",
 												SparkConf:   tc.sparkConf,
 												CustomTags:  tc.customTags,
@@ -576,7 +577,7 @@ func TestValidateSingleNodeClusterWithIsSingleNode(t *testing.T) {
 						JobSettings: jobs.JobSettings{
 							JobClusters: []jobs.JobCluster{
 								{
-									NewCluster: compute.ClusterSpec{
+									NewCluster: &compute.ClusterSpec{
 										ClusterName: "my_cluster",
 									},
 								},
diff --git a/bundle/config/validate/tf_only_references.go b/bundle/config/validate/tf_only_references.go
new file mode 100644
index 00000000000..3603b6f4a7f
--- /dev/null
+++ b/bundle/config/validate/tf_only_references.go
@@ -0,0 +1,87 @@
+package validate
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/terraform_dabs_map"
+	"github.com/databricks/cli/libs/diag"
+	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/dyn/dynvar"
+	"github.com/databricks/cli/libs/structs/structpath"
+)
+
+type tfOnlyReferences struct{}
+
+// TFOnlyReferences validates that no cross-resource references point to
+// Terraform-only fields (fields that exist in TF schema but have no DABs equivalent).
+// The direct engine cannot resolve such references at deploy time.
+func TFOnlyReferences() bundle.Mutator {
+	return &tfOnlyReferences{}
+}
+
+func (m *tfOnlyReferences) Name() string {
+	return "validate:tf_only_references"
+}
+
+func (m *tfOnlyReferences) Apply(_ context.Context, b *bundle.Bundle) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	// Walk the entire config looking for ${resources.*} references.
+	_ = dyn.WalkReadOnly(b.Config.Value(), func(_ dyn.Path, v dyn.Value) error {
+		ref, ok := dynvar.NewRef(v)
+		if !ok {
+			return nil
+		}
+		for _, r := range ref.References() {
+			if !strings.HasPrefix(r, "resources.") {
+				continue
+			}
+			if d := checkTFOnlyReference(r, v.Location()); d != nil {
+				diags = append(diags, *d)
+			}
+		}
+		return nil
+	})
+
+	if len(diags) > 0 {
+		b.Metrics.AddBoolValue("has_tf_only_references", true)
+	}
+
+	return diags
+}
+
+// checkTFOnlyReference checks a single reference string like
+// "resources.jobs.src.always_running" and returns a diagnostic when it refers
+// to a TF-only field, or nil otherwise.
+func checkTFOnlyReference(ref string, loc diag.Location) *diag.Diagnostic {
+	p, err := dyn.NewPathFromString(ref)
+	// Need at least resources.<group>.<name>.<field>
+	if err != nil || len(p) < 4 || p[0].Key() != "resources" {
+		return nil
+	}
+
+	group := p[1].Key()
+	tfOnlyFields, ok := terraform_dabs_map.TerraformOnlyFields[group]
+	if !ok || len(tfOnlyFields) == 0 {
+		return nil
+	}
+
+	// Field path is everything after resources.<group>.<name>.
+	fieldNode, err := structpath.ParsePath(p[3:].String())
+	if err != nil {
+		return nil
+	}
+
+	if !tfOnlyFields.Contains(fieldNode) {
+		return nil
+	}
+
+	return &diag.Diagnostic{
+		Severity:  diag.Error,
+		Summary:   fmt.Sprintf("%q: Terraform-only field; cross-resource references to Terraform-only fields are not supported by the direct engine", ref),
+		Locations: []diag.Location{loc},
+	}
+}
diff --git a/bundle/config/validate/tf_only_references_test.go b/bundle/config/validate/tf_only_references_test.go
new file mode 100644
index 00000000000..7b994cf864e
--- /dev/null
+++ b/bundle/config/validate/tf_only_references_test.go
@@ -0,0 +1,65 @@
+package validate
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/cli/bundle/internal/bundletest"
+	"github.com/databricks/cli/libs/diag"
+	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func makeBundle(t *testing.T) *bundle.Bundle {
+	t.Helper()
+	b := &bundle.Bundle{
+		Config: config.Root{
+			Resources: config.Resources{
+				Jobs: map[string]*resources.Job{
+					"src": {JobSettings: jobs.JobSettings{Name: "source"}},
+					"dst": {JobSettings: jobs.JobSettings{Name: "placeholder"}},
+				},
+			},
+		},
+	}
+	return b
+}
+
+func TestTFOnlyReferences_Error(t *testing.T) {
+	b := makeBundle(t)
+	bundletest.Mutate(t, b, func(v dyn.Value) (dyn.Value, error) {
+		return dyn.Set(v, "resources.jobs.dst.name", dyn.V("${resources.jobs.src.always_running}"))
+	})
+
+	diags := TFOnlyReferences().Apply(t.Context(), b)
+	require.Len(t, diags, 1)
+	assert.Equal(t, diag.Error, diags[0].Severity)
+	assert.Contains(t, diags[0].Summary, "resources.jobs.src.always_running")
+	assert.Contains(t, diags[0].Summary, "Terraform-only field")
+}
+
+func TestTFOnlyReferences_NormalReference(t *testing.T) {
+	b := makeBundle(t)
+	bundletest.Mutate(t, b, func(v dyn.Value) (dyn.Value, error) {
+		// "name" is not a TF-only field; no diagnostic expected.
+		return dyn.Set(v, "resources.jobs.dst.name", dyn.V("${resources.jobs.src.name}"))
+	})
+
+	diags := TFOnlyReferences().Apply(t.Context(), b)
+	assert.Empty(t, diags)
+}
+
+func TestTFOnlyReferences_RenamedField(t *testing.T) {
+	b := makeBundle(t)
+	bundletest.Mutate(t, b, func(v dyn.Value) (dyn.Value, error) {
+		// "git_source[0].branch" is a TF rename (not TF-only), should not error.
+		return dyn.Set(v, "resources.jobs.dst.name", dyn.V("${resources.jobs.src.git_source[0].branch}"))
+	})
+
+	diags := TFOnlyReferences().Apply(t.Context(), b)
+	assert.Empty(t, diags)
+}
diff --git a/bundle/config/validate/unique_resource_keys.go b/bundle/config/validate/unique_resource_keys.go
index 12c13fd1a86..7d2e49569f7 100644
--- a/bundle/config/validate/unique_resource_keys.go
+++ b/bundle/config/validate/unique_resource_keys.go
@@ -8,6 +8,7 @@ import (
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/structs/structpath"
 )
 
 // This mutator validates that:
@@ -35,8 +36,8 @@ func (m *uniqueResourceKeys) Apply(ctx context.Context, b *bundle.Bundle) diag.D
 	diags := diag.Diagnostics{}
 
 	type metadata struct {
-		locations []dyn.Location
-		paths     []dyn.Path
+		locations []diag.Location
+		paths     []*structpath.PathNode
 	}
 
 	// Maps of key to the paths and locations the resource / script is defined at.
@@ -50,7 +51,7 @@ func (m *uniqueResourceKeys) Apply(ctx context.Context, b *bundle.Bundle) diag.D
 			}
 		}
 
-		mv.paths = append(mv.paths, dyn.NewPath(dyn.Key(prefix)).Append(p...))
+		mv.paths = append(mv.paths, dyn.ToStructPath(dyn.NewPath(dyn.Key(prefix)).Append(p...)))
 		mv.locations = append(mv.locations, v.Locations()...)
 
 		resourceAndScriptMetadata[k] = mv
@@ -100,7 +101,7 @@ func (m *uniqueResourceKeys) Apply(ctx context.Context, b *bundle.Bundle) diag.D
 
 		// Sort the locations and paths for consistent error messages. This helps
 		// with unit testing.
-		slices.SortFunc(v.locations, func(a, b dyn.Location) int {
+		slices.SortFunc(v.locations, func(a, b diag.Location) int {
 			if n := cmp.Compare(a.File, b.File); n != 0 {
 				return n
 			}
@@ -109,7 +110,7 @@ func (m *uniqueResourceKeys) Apply(ctx context.Context, b *bundle.Bundle) diag.D
 			}
 			return cmp.Compare(a.Column, b.Column)
 		})
-		slices.SortFunc(v.paths, func(a, b dyn.Path) int {
+		slices.SortFunc(v.paths, func(a, b *structpath.PathNode) int {
 			return cmp.Compare(a.String(), b.String())
 		})
 
diff --git a/bundle/config/validate/validate_artifact_path.go b/bundle/config/validate/validate_artifact_path.go
index 4ea5c4308ad..36494cf7d77 100644
--- a/bundle/config/validate/validate_artifact_path.go
+++ b/bundle/config/validate/validate_artifact_path.go
@@ -13,6 +13,7 @@ import (
 	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/cli/libs/dyn/dynvar"
+	"github.com/databricks/cli/libs/structs/structpath"
 	"github.com/databricks/databricks-sdk-go/apierr"
 )
 
@@ -51,7 +52,7 @@ func extractVolumeFromPath(artifactPath string) (string, string, string, error)
 	return catalogName, schemaName, volumeName, nil
 }
 
-func findVolumeInBundle(r config.Root, catalogName, schemaName, volumeName string) (dyn.Path, []dyn.Location, bool) {
+func findVolumeInBundle(r config.Root, catalogName, schemaName, volumeName string) (dyn.Path, []diag.Location, bool) {
 	volumes := r.Resources.Volumes
 	for k, v := range volumes {
 		if v.CatalogName != catalogName || v.Name != volumeName {
@@ -68,15 +69,14 @@ func findVolumeInBundle(r config.Root, catalogName, schemaName, volumeName strin
 		if v.SchemaName != schemaName && !isSchemaDefinedInBundle {
 			continue
 		}
-		pathString := "resources.volumes." + k
-		return dyn.MustPathFromString(pathString), r.GetLocations(pathString), true
+		return dyn.Path{dyn.Key("resources"), dyn.Key("volumes"), dyn.Key(k)}, r.GetLocationsOf(structpath.NewPath(nil, "resources", "volumes", k)), true
 	}
 	return nil, nil, false
 }
 
 func (v *validateArtifactPath) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
 	// We only validate UC Volumes paths right now.
-	if !libraries.IsVolumesPath(b.Config.Workspace.ArtifactPath) {
+	if !libraries.IsVolumesPath(b.Config.Workspace.ArtifactPath) || b.IsImmutableFolder() {
 		return nil
 	}
 
@@ -86,7 +86,7 @@ func (v *validateArtifactPath) Apply(ctx context.Context, b *bundle.Bundle) diag
 				Summary:   s,
 				Severity:  diag.Error,
 				Locations: b.Config.GetLocations("workspace.artifact_path"),
-				Paths:     []dyn.Path{dyn.MustPathFromString("workspace.artifact_path")},
+				Paths:     structpath.NewPathSlice("workspace", "artifact_path"),
 			},
 		}
 	}
@@ -118,7 +118,7 @@ this bundle but which has not been deployed yet. Please first deploy
 the volume using 'bundle deploy' and then switch over to using it in
 the artifact_path.`,
 			Locations: slices.Concat(b.Config.GetLocations("workspace.artifact_path"), locations),
-			Paths:     append([]dyn.Path{dyn.MustPathFromString("workspace.artifact_path")}, path),
+			Paths:     append(structpath.NewPathSlice("workspace", "artifact_path"), dyn.ToStructPath(path)),
 		}}
 
 	}
diff --git a/bundle/config/validate/validate_artifact_path_test.go b/bundle/config/validate/validate_artifact_path_test.go
index 08f50e39fb8..97a08ab6e30 100644
--- a/bundle/config/validate/validate_artifact_path_test.go
+++ b/bundle/config/validate/validate_artifact_path_test.go
@@ -9,6 +9,7 @@ import (
 	"github.com/databricks/cli/bundle/internal/bundletest"
 	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/structs/structpath"
 	"github.com/databricks/databricks-sdk-go/apierr"
 	"github.com/databricks/databricks-sdk-go/experimental/mocks"
 	"github.com/databricks/databricks-sdk-go/service/catalog"
@@ -37,8 +38,8 @@ func TestValidateArtifactPathWithVolumeInBundle(t *testing.T) {
 		},
 	}
 
-	bundletest.SetLocation(b, "workspace.artifact_path", []dyn.Location{{File: "file", Line: 1, Column: 1}})
-	bundletest.SetLocation(b, "resources.volumes.foo", []dyn.Location{{File: "file", Line: 2, Column: 2}})
+	bundletest.SetLocation(b, "workspace.artifact_path", []diag.Location{{File: "file", Line: 1, Column: 1}})
+	bundletest.SetLocation(b, "resources.volumes.foo", []diag.Location{{File: "file", Line: 2, Column: 2}})
 
 	ctx := t.Context()
 	m := mocks.NewMockWorkspaceClient(t)
@@ -52,14 +53,14 @@ func TestValidateArtifactPathWithVolumeInBundle(t *testing.T) {
 	assert.Equal(t, diag.Diagnostics{{
 		Severity: diag.Error,
 		Summary:  "volume catalogN.schemaN.volumeN does not exist",
-		Locations: []dyn.Location{
+		Locations: []diag.Location{
 			{File: "file", Line: 1, Column: 1},
 			{File: "file", Line: 2, Column: 2},
 		},
-		Paths: []dyn.Path{
-			dyn.MustPathFromString("workspace.artifact_path"),
-			dyn.MustPathFromString("resources.volumes.foo"),
-		},
+		Paths: structpath.MustParsePaths(
+			"workspace.artifact_path",
+			"resources.volumes.foo",
+		),
 		Detail: `You are using a volume in your artifact_path that is managed by
 this bundle but which has not been deployed yet. Please first deploy
 the volume using 'bundle deploy' and then switch over to using it in
@@ -76,14 +77,14 @@ func TestValidateArtifactPath(t *testing.T) {
 		},
 	}
 
-	bundletest.SetLocation(b, "workspace.artifact_path", []dyn.Location{{File: "file", Line: 1, Column: 1}})
+	bundletest.SetLocation(b, "workspace.artifact_path", []diag.Location{{File: "file", Line: 1, Column: 1}})
 	assertDiags := func(t *testing.T, diags diag.Diagnostics, expected string) {
 		assert.Len(t, diags, 1)
 		assert.Equal(t, diag.Diagnostics{{
 			Severity:  diag.Error,
 			Summary:   expected,
-			Locations: []dyn.Location{{File: "file", Line: 1, Column: 1}},
-			Paths:     []dyn.Path{dyn.MustPathFromString("workspace.artifact_path")},
+			Locations: []diag.Location{{File: "file", Line: 1, Column: 1}},
+			Paths:     structpath.NewPathSlice("workspace", "artifact_path"),
 		}}, diags)
 	}
 
@@ -163,14 +164,14 @@ func TestValidateArtifactPathWithInvalidPaths(t *testing.T) {
 			},
 		}
 
-		bundletest.SetLocation(b, "workspace.artifact_path", []dyn.Location{{File: "config.yml", Line: 1, Column: 2}})
+		bundletest.SetLocation(b, "workspace.artifact_path", []diag.Location{{File: "config.yml", Line: 1, Column: 2}})
 
 		diags := ValidateArtifactPath().Apply(t.Context(), b)
 		require.Equal(t, diag.Diagnostics{{
 			Severity:  diag.Error,
 			Summary:   "expected UC volume path to be in the format /Volumes/<catalog>/<schema>/<volume>/..., got " + p,
-			Locations: []dyn.Location{{File: "config.yml", Line: 1, Column: 2}},
-			Paths:     []dyn.Path{dyn.MustPathFromString("workspace.artifact_path")},
+			Locations: []diag.Location{{File: "config.yml", Line: 1, Column: 2}},
+			Paths:     structpath.NewPathSlice("workspace", "artifact_path"),
 		}}, diags)
 	}
 }
@@ -192,7 +193,7 @@ func TestFindVolumeInBundle(t *testing.T) {
 		},
 	}
 
-	bundletest.SetLocation(b, "resources.volumes.foo", []dyn.Location{
+	bundletest.SetLocation(b, "resources.volumes.foo", []diag.Location{
 		{
 			File:   "volume.yml",
 			Line:   1,
@@ -203,7 +204,7 @@ func TestFindVolumeInBundle(t *testing.T) {
 	// volume is in DAB.
 	path, locations, ok := findVolumeInBundle(b.Config, "main", "my_schema", "my_volume")
 	assert.True(t, ok)
-	assert.Equal(t, []dyn.Location{{
+	assert.Equal(t, []diag.Location{{
 		File:   "volume.yml",
 		Line:   1,
 		Column: 2,
@@ -232,7 +233,7 @@ func TestFindVolumeInBundle(t *testing.T) {
 	b.Config.Resources.Volumes["foo"].SchemaName = "${resources.schemas.my_schema.name}"
 	path, locations, ok = findVolumeInBundle(b.Config, "main", "valuedoesnotmatter", "my_volume")
 	assert.True(t, ok)
-	assert.Equal(t, []dyn.Location{{
+	assert.Equal(t, []diag.Location{{
 		File:   "volume.yml",
 		Line:   1,
 		Column: 2,
diff --git a/bundle/config/validate/validate_dashboard_etags.go b/bundle/config/validate/validate_dashboard_etags.go
index 53c428af1dd..1715f22cb84 100644
--- a/bundle/config/validate/validate_dashboard_etags.go
+++ b/bundle/config/validate/validate_dashboard_etags.go
@@ -6,7 +6,7 @@ import (
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/libs/diag"
-	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/structs/structpath"
 )
 
 func ValidateDashboardEtags() bundle.ReadOnlyMutator {
@@ -27,8 +27,8 @@ func (v *validateDashboardEtags) Apply(ctx context.Context, b *bundle.Bundle) di
 				{
 					Severity:  diag.Error,
 					Summary:   fmt.Sprintf("dashboard %q has an etag set. Etags must not be set in bundle configuration", dashboard.DisplayName),
-					Paths:     []dyn.Path{dyn.MustPathFromString("resources.dashboards." + k)},
-					Locations: b.Config.GetLocations("resources.dashboards." + k),
+					Paths:     structpath.NewPathSlice("resources", "dashboards", k),
+					Locations: b.Config.GetLocationsOf(structpath.NewPath(nil, "resources", "dashboards", k)),
 				},
 			}
 		}
diff --git a/bundle/config/validate/validate_deployment_fields.go b/bundle/config/validate/validate_deployment_fields.go
new file mode 100644
index 00000000000..d1ca337f4ed
--- /dev/null
+++ b/bundle/config/validate/validate_deployment_fields.go
@@ -0,0 +1,61 @@
+package validate
+
+import (
+	"cmp"
+	"context"
+	"slices"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/libs/diag"
+	"github.com/databricks/cli/libs/structs/structpath"
+)
+
+func ValidateDeploymentFields() bundle.ReadOnlyMutator {
+	return &validateDeploymentFields{}
+}
+
+type validateDeploymentFields struct{ bundle.RO }
+
+func (v *validateDeploymentFields) Name() string {
+	return "validate:validate_deployment_fields"
+}
+
+func (v *validateDeploymentFields) Apply(_ context.Context, b *bundle.Bundle) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	// deployment_id and version_id identify the bundle deployment and its version
+	// in the Deployment Metadata Service. The CLI sets them on every deploy, so a
+	// value provided by hand would be overwritten; reject it up front.
+	reject := func(resourceType, name, field, value string) {
+		if value == "" {
+			return
+		}
+		path := structpath.NewPath(nil, "resources", resourceType, name, "deployment", field)
+		diags = append(diags, diag.Diagnostic{
+			Severity:  diag.Error,
+			Summary:   field + " must not be set in bundle configuration; it is managed by Declarative Automation Bundles",
+			Paths:     []*structpath.PathNode{path},
+			Locations: b.Config.GetLocationsOf(path),
+		})
+	}
+
+	for name, job := range b.Config.Resources.Jobs {
+		if d := job.Deployment; d != nil {
+			reject("jobs", name, "deployment_id", d.DeploymentId)
+			reject("jobs", name, "version_id", d.VersionId)
+		}
+	}
+	for name, pipeline := range b.Config.Resources.Pipelines {
+		if d := pipeline.Deployment; d != nil {
+			reject("pipelines", name, "deployment_id", d.DeploymentId)
+			reject("pipelines", name, "version_id", d.VersionId)
+		}
+	}
+
+	// Map iteration order is randomized; sort by path for stable output.
+	slices.SortFunc(diags, func(x, y diag.Diagnostic) int {
+		return cmp.Compare(x.Paths[0].String(), y.Paths[0].String())
+	})
+
+	return diags
+}
diff --git a/bundle/config/validate/validate_deployment_fields_test.go b/bundle/config/validate/validate_deployment_fields_test.go
new file mode 100644
index 00000000000..766242bc8f6
--- /dev/null
+++ b/bundle/config/validate/validate_deployment_fields_test.go
@@ -0,0 +1,80 @@
+package validate
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/cli/libs/diag"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/databricks/databricks-sdk-go/service/pipelines"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const reservedFieldMsg = " must not be set in bundle configuration; it is managed by Declarative Automation Bundles"
+
+func jobBundle(d *jobs.JobDeployment) *bundle.Bundle {
+	return &bundle.Bundle{
+		Config: config.Root{
+			Resources: config.Resources{
+				Jobs: map[string]*resources.Job{
+					"my_job": {JobSettings: jobs.JobSettings{Name: "my_job", Deployment: d}},
+				},
+			},
+		},
+	}
+}
+
+func pipelineBundle(d *pipelines.PipelineDeployment) *bundle.Bundle {
+	return &bundle.Bundle{
+		Config: config.Root{
+			Resources: config.Resources{
+				Pipelines: map[string]*resources.Pipeline{
+					"my_pipeline": {CreatePipeline: pipelines.CreatePipeline{Name: "my_pipeline", Deployment: d}},
+				},
+			},
+		},
+	}
+}
+
+func TestValidateDeploymentFieldsRejectsReservedFields(t *testing.T) {
+	tests := []struct {
+		name string
+		b    *bundle.Bundle
+		want string
+	}{
+		{"job deployment_id", jobBundle(&jobs.JobDeployment{DeploymentId: "x"}), "deployment_id" + reservedFieldMsg},
+		{"job version_id", jobBundle(&jobs.JobDeployment{VersionId: "x"}), "version_id" + reservedFieldMsg},
+		{"pipeline deployment_id", pipelineBundle(&pipelines.PipelineDeployment{DeploymentId: "x"}), "deployment_id" + reservedFieldMsg},
+		{"pipeline version_id", pipelineBundle(&pipelines.PipelineDeployment{VersionId: "x"}), "version_id" + reservedFieldMsg},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			diags := ValidateDeploymentFields().Apply(t.Context(), tt.b)
+			require.Len(t, diags, 1)
+			assert.Equal(t, diag.Error, diags[0].Severity)
+			assert.Equal(t, tt.want, diags[0].Summary)
+		})
+	}
+}
+
+func TestValidateDeploymentFieldsReportsAllOffenders(t *testing.T) {
+	b := &bundle.Bundle{
+		Config: config.Root{
+			Resources: config.Resources{
+				Jobs: map[string]*resources.Job{
+					"my_job": {JobSettings: jobs.JobSettings{Deployment: &jobs.JobDeployment{DeploymentId: "a"}}},
+				},
+				Pipelines: map[string]*resources.Pipeline{
+					"my_pipeline": {CreatePipeline: pipelines.CreatePipeline{Deployment: &pipelines.PipelineDeployment{VersionId: "b"}}},
+				},
+			},
+		},
+	}
+
+	diags := ValidateDeploymentFields().Apply(t.Context(), b)
+	require.Len(t, diags, 2)
+}
diff --git a/bundle/config/validate/validate_engine.go b/bundle/config/validate/validate_engine.go
index b688f644ba9..f19c2270b26 100644
--- a/bundle/config/validate/validate_engine.go
+++ b/bundle/config/validate/validate_engine.go
@@ -8,11 +8,14 @@ import (
 	"github.com/databricks/cli/bundle/config/engine"
 	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/structs/structpath"
 )
 
 type validateEngine struct{ bundle.RO }
 
-// ValidateEngine validates that the bundle.engine setting is valid.
+// ValidateEngine validates that the bundle.engine setting is valid and warns
+// about the bundle.terraform setting, which has no effect since the Terraform
+// deployment engine was removed.
 func ValidateEngine() bundle.ReadOnlyMutator {
 	return &validateEngine{}
 }
@@ -22,20 +25,44 @@ func (v *validateEngine) Name() string {
 }
 
 func (v *validateEngine) Apply(_ context.Context, b *bundle.Bundle) diag.Diagnostics {
+	var diags diag.Diagnostics
+	if tf := dyn.GetValue(b.Config.Value(), "bundle.terraform"); tf.IsValid() {
+		diags = diags.Append(diag.Diagnostic{
+			Severity:  diag.Warning,
+			Summary:   "bundle.terraform is deprecated and has no effect: " + engine.TerraformRemovedSummary,
+			Locations: tf.Locations(),
+			Paths:     structpath.NewPathSlice("bundle", "terraform"),
+		})
+	}
+
 	configEngine := b.Config.Bundle.Engine
 	if configEngine == engine.EngineNotSet {
-		return nil
+		return diags
 	}
 
-	if _, ok := engine.Parse(string(configEngine)); !ok {
-		val := dyn.GetValue(b.Config.Value(), "bundle.engine")
-		loc := val.Location()
-		return diag.Diagnostics{{
+	loc := dyn.GetValue(b.Config.Value(), "bundle.engine").Location()
+
+	parsed, ok := engine.Parse(string(configEngine))
+	if !ok {
+		return diags.Append(diag.Diagnostic{
 			Severity:  diag.Error,
-			Summary:   fmt.Sprintf("invalid value %q for bundle.engine (expected %q or %q)", configEngine, engine.EngineTerraform, engine.EngineDirect),
-			Locations: []dyn.Location{loc},
-		}}
+			Summary:   fmt.Sprintf("invalid value %q for bundle.engine (expected %q)", configEngine, engine.EngineDirect),
+			Locations: []diag.Location{loc},
+		})
+	}
+
+	if parsed == engine.EngineTerraform {
+		severity := diag.Error
+		if b.AllowTerraformEngineConfig {
+			severity = diag.Warning
+		}
+		return diags.Append(diag.Diagnostic{
+			Severity:  severity,
+			Summary:   engine.TerraformRemovedSummary,
+			Detail:    engine.TerraformRemovedConfigDetail,
+			Locations: []diag.Location{loc},
+		})
 	}
 
-	return nil
+	return diags
 }
diff --git a/bundle/config/validate/validate_engine_test.go b/bundle/config/validate/validate_engine_test.go
index f260b631f5c..da1bd7bf12d 100644
--- a/bundle/config/validate/validate_engine_test.go
+++ b/bundle/config/validate/validate_engine_test.go
@@ -8,23 +8,37 @@ import (
 	"github.com/databricks/cli/bundle/config/engine"
 	"github.com/databricks/cli/bundle/internal/bundletest"
 	"github.com/databricks/cli/libs/diag"
-	"github.com/databricks/cli/libs/dyn"
 	"github.com/stretchr/testify/assert"
 )
 
-func TestValidateEngineValid(t *testing.T) {
-	for _, eng := range []engine.EngineType{engine.EngineTerraform, engine.EngineDirect} {
-		b := &bundle.Bundle{
-			Config: config.Root{
-				Bundle: config.Bundle{
-					Engine: eng,
-				},
+func TestValidateEngineDirect(t *testing.T) {
+	b := &bundle.Bundle{
+		Config: config.Root{
+			Bundle: config.Bundle{
+				Engine: engine.EngineDirect,
 			},
-		}
-		bundletest.SetLocation(b, "bundle.engine", []dyn.Location{{File: "databricks.yml", Line: 5, Column: 3}})
-		diags := ValidateEngine().Apply(t.Context(), b)
-		assert.Empty(t, diags)
+		},
 	}
+	bundletest.SetLocation(b, "bundle.engine", []diag.Location{{File: "databricks.yml", Line: 5, Column: 3}})
+	diags := ValidateEngine().Apply(t.Context(), b)
+	assert.Empty(t, diags)
+}
+
+func TestValidateEngineTerraformRemoved(t *testing.T) {
+	b := &bundle.Bundle{
+		Config: config.Root{
+			Bundle: config.Bundle{
+				Engine: engine.EngineTerraform,
+			},
+		},
+	}
+	loc := diag.Location{File: "databricks.yml", Line: 5, Column: 3}
+	bundletest.SetLocation(b, "bundle.engine", []diag.Location{loc})
+	diags := ValidateEngine().Apply(t.Context(), b)
+	assert.Len(t, diags, 1)
+	assert.Equal(t, diag.Error, diags[0].Severity)
+	assert.Contains(t, diags[0].Summary, "has been removed")
+	assert.Equal(t, []diag.Location{loc}, diags[0].Locations)
 }
 
 func TestValidateEngineNotSet(t *testing.T) {
@@ -43,9 +57,42 @@ func TestValidateEngineInvalid(t *testing.T) {
 			},
 		},
 	}
-	bundletest.SetLocation(b, "bundle.engine", []dyn.Location{{File: "databricks.yml", Line: 5, Column: 3}})
+	bundletest.SetLocation(b, "bundle.engine", []diag.Location{{File: "databricks.yml", Line: 5, Column: 3}})
 	diags := ValidateEngine().Apply(t.Context(), b)
 	assert.Len(t, diags, 1)
 	assert.Equal(t, diag.Error, diags[0].Severity)
 	assert.Contains(t, diags[0].Summary, "invalid")
 }
+
+func TestValidateEngineTerraformConfigDeprecated(t *testing.T) {
+	b := &bundle.Bundle{
+		Config: config.Root{
+			Bundle: config.Bundle{
+				Terraform: &config.Terraform{ExecPath: "/usr/bin/terraform"},
+			},
+		},
+	}
+	loc := diag.Location{File: "databricks.yml", Line: 3, Column: 5}
+	bundletest.SetLocation(b, "bundle.terraform", []diag.Location{loc})
+	diags := ValidateEngine().Apply(t.Context(), b)
+	assert.Len(t, diags, 1)
+	assert.Equal(t, diag.Warning, diags[0].Severity)
+	assert.Contains(t, diags[0].Summary, "bundle.terraform is deprecated")
+	assert.Equal(t, []diag.Location{loc}, diags[0].Locations)
+}
+
+func TestValidateEngineTerraformAllowed(t *testing.T) {
+	b := &bundle.Bundle{
+		Config: config.Root{
+			Bundle: config.Bundle{
+				Engine: engine.EngineTerraform,
+			},
+		},
+		AllowTerraformEngineConfig: true,
+	}
+	bundletest.SetLocation(b, "bundle.engine", []diag.Location{{File: "databricks.yml", Line: 5, Column: 3}})
+	diags := ValidateEngine().Apply(t.Context(), b)
+	assert.Len(t, diags, 1)
+	assert.Equal(t, diag.Warning, diags[0].Severity)
+	assert.Contains(t, diags[0].Summary, "has been removed")
+}
diff --git a/bundle/config/validate/validate_genie_space_etags.go b/bundle/config/validate/validate_genie_space_etags.go
new file mode 100644
index 00000000000..963e572346f
--- /dev/null
+++ b/bundle/config/validate/validate_genie_space_etags.go
@@ -0,0 +1,39 @@
+package validate
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/libs/diag"
+	"github.com/databricks/cli/libs/structs/structpath"
+)
+
+func ValidateGenieSpaceEtags() bundle.ReadOnlyMutator {
+	return &validateGenieSpaceEtags{}
+}
+
+type validateGenieSpaceEtags struct{ bundle.RO }
+
+func (v *validateGenieSpaceEtags) Name() string {
+	return "validate:validate_genie_space_etags"
+}
+
+func (v *validateGenieSpaceEtags) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
+	// No genie spaces should have etags set. They are purely internal state
+	// (persisted by the direct engine for drift detection), never authored by
+	// the user. Mirrors ValidateDashboardEtags.
+	for k, genieSpace := range b.Config.Resources.GenieSpaces {
+		if genieSpace.Etag != "" {
+			return diag.Diagnostics{
+				{
+					Severity:  diag.Error,
+					Summary:   fmt.Sprintf("genie space %q has an etag set. Etags must not be set in bundle configuration", genieSpace.Title),
+					Paths:     structpath.NewPathSlice("resources", "genie_spaces", k),
+					Locations: b.Config.GetLocationsOf(structpath.NewPath(nil, "resources", "genie_spaces", k)),
+				},
+			}
+		}
+	}
+	return nil
+}
diff --git a/bundle/config/validate/validate_job_run_idempotency_token.go b/bundle/config/validate/validate_job_run_idempotency_token.go
new file mode 100644
index 00000000000..61e07e302ca
--- /dev/null
+++ b/bundle/config/validate/validate_job_run_idempotency_token.go
@@ -0,0 +1,45 @@
+package validate
+
+import (
+	"context"
+	"maps"
+	"slices"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/libs/diag"
+	"github.com/databricks/cli/libs/structs/structpath"
+)
+
+func ValidateJobRunIdempotencyToken() bundle.ReadOnlyMutator {
+	return &validateJobRunIdempotencyToken{}
+}
+
+type validateJobRunIdempotencyToken struct{ bundle.RO }
+
+func (v *validateJobRunIdempotencyToken) Name() string {
+	return "validate:job_run_idempotency_token"
+}
+
+func (v *validateJobRunIdempotencyToken) Apply(_ context.Context, b *bundle.Bundle) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	// Map iteration order is randomized; sort by name for stable output.
+	for _, name := range slices.Sorted(maps.Keys(b.Config.Resources.JobRuns)) {
+		jobRun := b.Config.Resources.JobRuns[name]
+		// An empty `job_runs.<name>:` entry loads as a present key with a nil value.
+		if jobRun == nil || jobRun.IdempotencyToken == "" {
+			continue
+		}
+		// The CLI mints the token; a configured one would also remain reserved after
+		// the run is deleted and break the next deploy.
+		path := structpath.NewPath(nil, "resources", "job_runs", name, "idempotency_token")
+		diags = append(diags, diag.Diagnostic{
+			Severity:  diag.Error,
+			Summary:   "idempotency_token must not be set in bundle configuration; the CLI sets it on each run-now request",
+			Paths:     []*structpath.PathNode{path},
+			Locations: b.Config.GetLocationsOf(path),
+		})
+	}
+
+	return diags
+}
diff --git a/bundle/config/validate/validate_job_run_idempotency_token_test.go b/bundle/config/validate/validate_job_run_idempotency_token_test.go
new file mode 100644
index 00000000000..4aa5ad4dbbc
--- /dev/null
+++ b/bundle/config/validate/validate_job_run_idempotency_token_test.go
@@ -0,0 +1,27 @@
+package validate
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestValidateJobRunIdempotencyTokenAcceptsRunsWithoutOne(t *testing.T) {
+	b := &bundle.Bundle{
+		Config: config.Root{
+			Resources: config.Resources{
+				JobRuns: map[string]*resources.JobRun{
+					"my_run": {RunNow: jobs.RunNow{JobId: 456}},
+					// An empty `job_runs.<name>:` entry loads as a present key with a nil value.
+					"empty": nil,
+				},
+			},
+		},
+	}
+
+	assert.Empty(t, ValidateJobRunIdempotencyToken().Apply(t.Context(), b))
+}
diff --git a/bundle/config/validate/validate_sync_patterns.go b/bundle/config/validate/validate_sync_patterns.go
index 8488aefebd2..8ed0406e280 100644
--- a/bundle/config/validate/validate_sync_patterns.go
+++ b/bundle/config/validate/validate_sync_patterns.go
@@ -7,9 +7,9 @@ import (
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/libs/diag"
-	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/cli/libs/fileset"
 	"github.com/databricks/cli/libs/logdiag"
+	"github.com/databricks/cli/libs/structs/structpath"
 	"golang.org/x/sync/errgroup"
 )
 
@@ -26,16 +26,16 @@ func (v *validateSyncPatterns) Name() string {
 func (v *validateSyncPatterns) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
 	s := b.Config.Sync
 
-	checkPatterns(ctx, s.Exclude, "sync.exclude", b)
+	checkPatterns(ctx, s.Exclude, structpath.NewPath(nil, "sync", "exclude"), b)
 	if logdiag.HasError(ctx) {
 		return nil
 	}
 
-	checkPatterns(ctx, s.Include, "sync.include", b)
+	checkPatterns(ctx, s.Include, structpath.NewPath(nil, "sync", "include"), b)
 	return nil
 }
 
-func checkPatterns(ctx context.Context, patterns []string, path string, b *bundle.Bundle) {
+func checkPatterns(ctx context.Context, patterns []string, path *structpath.PathNode, b *bundle.Bundle) {
 	var errs errgroup.Group
 
 	for index, pattern := range patterns {
@@ -46,7 +46,9 @@ func checkPatterns(ctx context.Context, patterns []string, path string, b *bundl
 		// it means: do not include these files into result set
 		p := strings.TrimPrefix(pattern, "!")
 		errs.Go(func() error {
-			fs, err := fileset.NewGlobSet(b.BundleRoot, []string{p})
+			// SyncInferRoot rewrites patterns to be relative to the sync root,
+			// which can be an ancestor of the bundle root.
+			fs, err := fileset.NewGlobSet(b.SyncRoot, []string{p})
 			if err != nil {
 				return err
 			}
@@ -57,12 +59,12 @@ func checkPatterns(ctx context.Context, patterns []string, path string, b *bundl
 			}
 
 			if len(all) == 0 {
-				path := fmt.Sprintf("%s[%d]", path, index)
+				path := structpath.NewPath(path, index)
 				logdiag.LogDiag(ctx, diag.Diagnostic{
 					Severity:  diag.Warning,
 					Summary:   fmt.Sprintf("Pattern %s does not match any files", pattern),
-					Locations: b.Config.GetLocations(path),
-					Paths:     []dyn.Path{dyn.MustPathFromString(path)},
+					Locations: b.Config.GetLocationsOf(path),
+					Paths:     []*structpath.PathNode{path},
 				})
 			}
 			return nil
diff --git a/bundle/config/validate/validate_volume_path.go b/bundle/config/validate/validate_volume_path.go
index 265a0bfd53b..c440dfbf06f 100644
--- a/bundle/config/validate/validate_volume_path.go
+++ b/bundle/config/validate/validate_volume_path.go
@@ -7,7 +7,7 @@ import (
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/libs/diag"
-	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/structs/structpath"
 )
 
 type validateVolumePath struct {
@@ -24,11 +24,12 @@ func (m *validateVolumePath) Apply(ctx context.Context, b *bundle.Bundle) diag.D
 	pathChecks := []struct {
 		path       string
 		configName string
+		configPath *structpath.PathNode
 	}{
-		{b.Config.Workspace.RootPath, "workspace.root_path"},
-		{b.Config.Workspace.FilePath, "workspace.file_path"},
-		{b.Config.Workspace.StatePath, "workspace.state_path"},
-		{b.Config.Workspace.ResourcePath, "workspace.resource_path"},
+		{b.Config.Workspace.RootPath, "workspace.root_path", structpath.NewPath(nil, "workspace", "root_path")},
+		{b.Config.Workspace.FilePath, "workspace.file_path", structpath.NewPath(nil, "workspace", "file_path")},
+		{b.Config.Workspace.StatePath, "workspace.state_path", structpath.NewPath(nil, "workspace", "state_path")},
+		{b.Config.Workspace.ResourcePath, "workspace.resource_path", structpath.NewPath(nil, "workspace", "resource_path")},
 	}
 
 	// Check each path
@@ -38,8 +39,8 @@ func (m *validateVolumePath) Apply(ctx context.Context, b *bundle.Bundle) diag.D
 				Severity:  diag.Error,
 				Summary:   fmt.Sprintf("%s %s starts with /Volumes. /Volumes can only be used with workspace.artifact_path.", check.configName, check.path),
 				Detail:    "For more information, see https://docs.databricks.com/aws/en/dev-tools/bundles/settings#workspace",
-				Locations: b.Config.GetLocations(check.configName),
-				Paths:     []dyn.Path{dyn.MustPathFromString(check.configName)},
+				Locations: b.Config.GetLocationsOf(check.configPath),
+				Paths:     []*structpath.PathNode{check.configPath},
 			})
 
 			// Return early for root path validation
diff --git a/bundle/config/workspace.go b/bundle/config/workspace.go
index 9cd397f13aa..b3311bf07d2 100644
--- a/bundle/config/workspace.go
+++ b/bundle/config/workspace.go
@@ -2,13 +2,12 @@ package config
 
 import (
 	"context"
-	"os"
-	"path/filepath"
 	"strconv"
 
 	"github.com/databricks/cli/bundle/env"
 	"github.com/databricks/cli/libs/auth"
 	"github.com/databricks/cli/libs/databrickscfg"
+	"github.com/databricks/cli/libs/liteswap"
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/config"
 	"github.com/databricks/databricks-sdk-go/marshal"
@@ -137,12 +136,13 @@ func (w *Workspace) Config(ctx context.Context) *config.Config {
 		AzureClientID:    w.AzureClientID,
 		AzureTenantID:    w.AzureTenantID,
 		AzureEnvironment: w.AzureEnvironment,
-		AzureLoginAppID:  w.AzureLoginAppID,
+		AzureLoginAppID:  w.AzureLoginAppID, //nolint:staticcheck // SA1019: still accepted in bundle config; forwarded until the SDK drops the field
 
 		// Unified host
 		AccountID:   w.AccountID,
 		WorkspaceID: w.WorkspaceID,
 	}
+	liteswap.Apply(ctx, cfg)
 
 	for k := range config.ConfigAttributes {
 		attr := &config.ConfigAttributes[k]
@@ -178,9 +178,19 @@ func (w *Workspace) Client(ctx context.Context) (*databricks.WorkspaceClient, er
 
 	cfg := w.Config(ctx)
 
-	// If only the host is configured, we try and unambiguously match it to
-	// a profile in the user's databrickscfg file. Override the default loaders.
-	if w.Host != "" && w.Profile == "" {
+	switch {
+	case env.StrictProfileMatch(ctx) && (w.Host != "" || w.WorkspaceID != ""):
+		// The target's host and workspace ID must match a profile, even when
+		// auth env vars are set. A target with neither has nothing to match, so
+		// it resolves as without strict mode.
+		cfg.Loaders = databrickscfg.StrictProfileLoaders
+	case w.Profile != "":
+		// An explicit profile wins over auth env vars (#5096).
+		// ValidateConfigAndProfileHost below still checks host agreement.
+		cfg.Loaders = databrickscfg.ProfileAuthLoaders
+	case w.Host != "":
+		// If only the host is configured, we try and unambiguously match it to
+		// a profile in the user's databrickscfg file. Override the default loaders.
 		cfg.Loaders = []config.Loader{
 			// Load auth creds from env vars
 			config.ConfigAttributes,
@@ -209,13 +219,3 @@ func (w *Workspace) Client(ctx context.Context) (*databricks.WorkspaceClient, er
 
 	return databricks.NewWorkspaceClient((*databricks.Config)(cfg))
 }
-
-func init() {
-	arg0 := os.Args[0]
-
-	// Configure DATABRICKS_CLI_PATH only if our caller intends to use this specific version of this binary.
-	// Otherwise, if it is equal to its basename, processes can find it in $PATH.
-	if arg0 != filepath.Base(arg0) {
-		os.Setenv("DATABRICKS_CLI_PATH", arg0)
-	}
-}
diff --git a/bundle/config/workspace_test.go b/bundle/config/workspace_test.go
index b1898db77c8..3fb86da2b64 100644
--- a/bundle/config/workspace_test.go
+++ b/bundle/config/workspace_test.go
@@ -155,6 +155,78 @@ func TestWorkspaceClientNormalizesHostBeforeProfileResolution(t *testing.T) {
 	assert.Equal(t, "ws2", client.Config.Profile)
 }
 
+func TestWorkspaceClientProfileOverridesAuthEnv(t *testing.T) {
+	// An explicit profile must win over auth env vars (#5096).
+	setupWorkspaceTest(t)
+
+	err := databrickscfg.SaveToProfile(t.Context(), &config.Config{
+		Profile: "tst",
+		Host:    "https://tst.cloud.databricks.test",
+		Token:   "tst-token",
+	})
+	require.NoError(t, err)
+
+	// direnv-style auth env vars pointing at a different (dev) workspace.
+	t.Setenv("DATABRICKS_HOST", "https://dev.cloud.databricks.test")
+	t.Setenv("DATABRICKS_TOKEN", "dev-token")
+
+	w := Workspace{Profile: "tst"}
+	client, err := w.Client(t.Context())
+	require.NoError(t, err)
+	assert.Equal(t, "tst", client.Config.Profile)
+	assert.Equal(t, "https://tst.cloud.databricks.test", client.Config.Host)
+	assert.Equal(t, "tst-token", client.Config.Token)
+}
+
+func TestWorkspaceClientProfileFillsAuthFromEnv(t *testing.T) {
+	// Host-only profile: the profile wins for the host, but env fills the token
+	// it omits (#5096).
+	setupWorkspaceTest(t)
+
+	err := databrickscfg.SaveToProfile(t.Context(), &config.Config{
+		Profile: "host-only",
+		Host:    "https://tst.cloud.databricks.test",
+	})
+	require.NoError(t, err)
+
+	t.Setenv("DATABRICKS_TOKEN", "env-token")
+
+	w := Workspace{Profile: "host-only"}
+	client, err := w.Client(t.Context())
+	require.NoError(t, err)
+	assert.Equal(t, "host-only", client.Config.Profile)
+	assert.Equal(t, "https://tst.cloud.databricks.test", client.Config.Host)
+	// The token is not in the profile, so it is filled from the environment.
+	assert.Equal(t, "env-token", client.Config.Token)
+}
+
+func TestWorkspaceClientHostAndProfileOverridesAuthEnv(t *testing.T) {
+	// Bundle pins both workspace.host and workspace.profile: the profile wins
+	// for auth and the host check passes because they agree (#5096).
+	setupWorkspaceTest(t)
+
+	err := databrickscfg.SaveToProfile(t.Context(), &config.Config{
+		Profile: "tst",
+		Host:    "https://tst.cloud.databricks.test",
+		Token:   "tst-token",
+	})
+	require.NoError(t, err)
+
+	// direnv-style auth env vars pointing at a different (dev) workspace.
+	t.Setenv("DATABRICKS_HOST", "https://dev.cloud.databricks.test")
+	t.Setenv("DATABRICKS_TOKEN", "dev-token")
+
+	w := Workspace{
+		Host:    "https://tst.cloud.databricks.test",
+		Profile: "tst",
+	}
+	client, err := w.Client(t.Context())
+	require.NoError(t, err)
+	assert.Equal(t, "tst", client.Config.Profile)
+	assert.Equal(t, "https://tst.cloud.databricks.test", client.Config.Host)
+	assert.Equal(t, "tst-token", client.Config.Token)
+}
+
 func TestWorkspaceConfigHTTPTimeout(t *testing.T) {
 	for _, tc := range []struct {
 		envVal string
diff --git a/bundle/configsync/defaults.go b/bundle/configsync/defaults.go
index 480f90f99db..0981b0625d6 100644
--- a/bundle/configsync/defaults.go
+++ b/bundle/configsync/defaults.go
@@ -11,12 +11,18 @@ type (
 	skipIfEmptyOrDefault struct {
 		defaults map[string]any
 	}
+	// skipBackendDefault skips a field, regardless of its remote value, when it is
+	// absent from config. Used for fields the backend or a cluster policy may fill
+	// in: their remote-only value must not be synced into config. Fields the user
+	// does manage (present in config) still sync normally.
+	skipBackendDefault struct{}
 )
 
 var (
 	alwaysSkip              = skipAlways{}
 	zeroOrNil               = skipIfZeroOrNil{}
 	emptyEmailNotifications = skipIfEmptyOrDefault{defaults: map[string]any{"no_alert_for_skipped_runs": false}}
+	backendDefault          = skipBackendDefault{}
 )
 
 // serverSideDefaults contains all hardcoded server-side defaults.
@@ -54,6 +60,13 @@ var serverSideDefaults = map[string]any{
 	"resources.jobs.*.tasks[*].new_cluster.data_security_mode":  "SINGLE_USER", // TODO this field is computed on some workspaces in integration tests, check why and if we can skip it
 	"resources.jobs.*.tasks[*].new_cluster.enable_elastic_disk": alwaysSkip,    // deprecated field
 	"resources.jobs.*.tasks[*].new_cluster.single_user_name":    alwaysSkip,
+	// custom_tags and cluster_log_conf are commonly injected by cluster policies
+	// when the user omits them, so they exist only remotely. Syncing them back leaks
+	// one environment's policy values into (often shared) config and breaks deploys in
+	// other environments. TODO: move to backend_defaults in jobs.yml once
+	// configsync filtering is migrated to the direct engine lifecycle metadata.
+	"resources.jobs.*.tasks[*].new_cluster.custom_tags":      backendDefault,
+	"resources.jobs.*.tasks[*].new_cluster.cluster_log_conf": backendDefault,
 
 	// Cluster fields (job_clusters)
 	"resources.jobs.*.job_clusters[*].new_cluster.aws_attributes":      alwaysSkip,
@@ -62,6 +75,8 @@ var serverSideDefaults = map[string]any{
 	"resources.jobs.*.job_clusters[*].new_cluster.data_security_mode":  "SINGLE_USER", // TODO this field is computed on some workspaces in integration tests, check why and if we can skip it
 	"resources.jobs.*.job_clusters[*].new_cluster.enable_elastic_disk": alwaysSkip,    // deprecated field
 	"resources.jobs.*.job_clusters[*].new_cluster.single_user_name":    alwaysSkip,
+	"resources.jobs.*.job_clusters[*].new_cluster.custom_tags":         backendDefault, // see tasks[*].new_cluster.custom_tags
+	"resources.jobs.*.job_clusters[*].new_cluster.cluster_log_conf":    backendDefault, // see tasks[*].new_cluster.cluster_log_conf
 
 	// Standalone cluster fields
 	"resources.clusters.*.aws_attributes":      alwaysSkip,
@@ -71,6 +86,8 @@ var serverSideDefaults = map[string]any{
 	"resources.clusters.*.driver_node_type_id": alwaysSkip,
 	"resources.clusters.*.enable_elastic_disk": alwaysSkip,
 	"resources.clusters.*.single_user_name":    alwaysSkip,
+	"resources.clusters.*.custom_tags":         backendDefault, // see jobs.*.tasks[*].new_cluster.custom_tags
+	"resources.clusters.*.cluster_log_conf":    backendDefault, // see jobs.*.tasks[*].new_cluster.cluster_log_conf
 
 	// Experiment fields
 	"resources.experiments.*.artifact_location": alwaysSkip,
@@ -83,6 +100,7 @@ var serverSideDefaults = map[string]any{
 
 	// Volume fields
 	"resources.volumes.*.storage_location": alwaysSkip,
+	"resources.volumes.*.volume_path":      alwaysSkip,
 
 	// SQL warehouse fields
 	"resources.sql_warehouses.*.creator_name":     alwaysSkip,
@@ -92,9 +110,26 @@ var serverSideDefaults = map[string]any{
 	// Terraform defaults
 	"resources.jobs.*.run_as": alwaysSkip,
 
+	// deployment.* is CLI-managed: metadata.AnnotateJobs / AnnotatePipelines write
+	// kind + metadata_file_path on every deploy, and the Deployment Metadata Service
+	// sets deployment_id + version_id. None is user-authored (validate.ValidateDeploymentFields
+	// even rejects deployment_id / version_id in config), so no subfield is synced back.
+	"resources.jobs.*.deployment.*":      alwaysSkip,
+	"resources.pipelines.*.deployment.*": alwaysSkip,
+
 	// Pipeline fields
 	"resources.pipelines.*.storage":    alwaysSkip,
 	"resources.pipelines.*.continuous": false,
+
+	// Dashboard fields
+	// etag is output-only and never present in config. The plan re-promotes etag
+	// drift to Update via ResourceDashboard.OverrideChangeDesc (needed for deploy's
+	// modified-remotely detection), so configsync cannot rely on the plan's Skip
+	// action and must exclude the field explicitly.
+	"resources.dashboards.*.etag": alwaysSkip,
+	// published is an internal state field (not part of the user config): DoRead
+	// derives it from the publish lifecycle, so it must never be synced into config.
+	"resources.dashboards.*.published": alwaysSkip,
 }
 
 // shouldSkipField checks if a field should be skipped in change detection.
@@ -111,6 +146,9 @@ func shouldSkipField(path string, value any, hasConfigValue bool) bool {
 			if hasConfigValue {
 				return false
 			}
+			if _, ok := expected.(skipBackendDefault); ok {
+				return true
+			}
 			if _, ok := expected.(skipIfZeroOrNil); ok {
 				return value == nil || value == int64(0)
 			}
@@ -152,7 +190,7 @@ func matchParts(patternParts, pathParts []string) bool {
 	}
 
 	if strings.Contains(patternPart, "[*]") {
-		prefix := strings.Split(patternPart, "[*]")[0]
+		prefix, _, _ := strings.Cut(patternPart, "[*]")
 
 		if strings.HasPrefix(pathPart, prefix) && strings.Contains(pathPart, "[") {
 			return matchParts(patternParts[1:], pathParts[1:])
diff --git a/bundle/configsync/diff.go b/bundle/configsync/diff.go
index dee7fa48116..e42f0a1d83a 100644
--- a/bundle/configsync/diff.go
+++ b/bundle/configsync/diff.go
@@ -2,21 +2,16 @@ package configsync
 
 import (
 	"context"
-	"errors"
 	"fmt"
-	"io"
-	"io/fs"
-	"os"
-	"path/filepath"
+	"strings"
 
 	"github.com/databricks/cli/bundle"
-	"github.com/databricks/cli/bundle/config/engine"
-	"github.com/databricks/cli/bundle/deploy"
+	"github.com/databricks/cli/bundle/config"
 	"github.com/databricks/cli/bundle/deployplan"
-	"github.com/databricks/cli/bundle/direct"
 	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/cli/libs/dyn/convert"
 	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/structs/structdiff"
 )
 
 type OperationType string
@@ -32,6 +27,12 @@ const (
 type ConfigChangeDesc struct {
 	Operation OperationType `json:"operation"`
 	Value     any           `json:"value,omitempty"` // Normalized remote value (nil for remove operations)
+
+	// LocalEdit reports that the local config value for this field differs from
+	// the last-deployed state, so applying this change overwrites a not-yet-
+	// deployed local edit. Telemetry-only; direct engine only (the terraform
+	// sync snapshot has no per-field base). Not part of the command output.
+	LocalEdit bool `json:"-"`
 }
 
 type ResourceChanges map[string]*ConfigChangeDesc
@@ -85,7 +86,12 @@ func filterEntityDefaults(basePath string, value any) any {
 }
 
 func convertChangeDesc(path string, cd *deployplan.ChangeDesc) (*ConfigChangeDesc, error) {
-	hasConfigValue := cd.Old != nil || cd.New != nil
+	// Use cd.New (current config) to decide whether the field exists "on the config side".
+	// cd.Old (saved state) must not be considered: when the user has already synced a rename
+	// locally (cd.New == nil for the old key) but state still holds the prior key, including
+	// cd.Old in this check would classify the change as Replace and fail later in
+	// resolveSelectors because the old key no longer exists in the YAML.
+	hasConfigValue := cd.New != nil
 	normalizedValue, err := normalizeValue(cd.Remote)
 	if err != nil {
 		return nil, fmt.Errorf("failed to normalize remote value: %w", err)
@@ -117,39 +123,41 @@ func convertChangeDesc(path string, cd *deployplan.ChangeDesc) (*ConfigChangeDes
 	}, nil
 }
 
-// DetectChanges compares current remote state with the last deployed state
-// and returns a map of resource changes.
-func DetectChanges(ctx context.Context, b *bundle.Bundle, engine engine.EngineType) (Changes, error) {
-	changes := make(Changes)
-
-	err := ensureSnapshotAvailable(ctx, b, engine)
+// isPermissionsOrGrantsSubResource reports whether a plan resource key is a
+// permissions or grants sub-resource ("resources.<type>.<name>.permissions" /
+// ".grants"). It classifies the key structurally via config.GetNodeAndType,
+// which keys on the path component (index 3), so a resource literally named
+// "permissions" ("resources.jobs.permissions") is not misclassified.
+func isPermissionsOrGrantsSubResource(resourceKey string) bool {
+	path, err := dyn.NewPathFromString(resourceKey)
 	if err != nil {
-		return nil, fmt.Errorf("state snapshot not available: %w", err)
-	}
-
-	var deployBundle *direct.DeploymentBundle
-	if engine.IsDirect() {
-		// For direct engine, state is already opened by the caller (process.go).
-		deployBundle = &b.DeploymentBundle
-	} else {
-		deployBundle = &direct.DeploymentBundle{}
-		_, statePath := b.StateFilenameConfigSnapshot(ctx)
-		if err := deployBundle.StateDB.Open(statePath); err != nil {
-			return nil, fmt.Errorf("failed to open state: %w", err)
-		}
+		return false
 	}
+	_, nodeType := config.GetNodeAndType(path)
+	return strings.HasSuffix(nodeType, ".permissions") || strings.HasSuffix(nodeType, ".grants")
+}
 
-	plan, err := deployBundle.CalculatePlan(ctx, b.WorkspaceClient(ctx), &b.Config)
-	if err != nil {
-		return nil, fmt.Errorf("failed to calculate plan: %w", err)
-	}
+// ExtractChanges extracts the map of remote-vs-config changes from a deploy
+// plan.
+func ExtractChanges(ctx context.Context, b *bundle.Bundle, plan *deployplan.Plan) (Changes, error) {
+	changes := make(Changes)
 
 	for resourceKey, entry := range plan.Plan {
+		// permissions and grants are emitted as their own plan keys
+		// ("resources.<type>.<name>.permissions" / ".grants"; see splitResourcePath
+		// in bundle/direct/bundle_plan.go). config-remote-sync cannot write them back
+		// to YAML: their fields (e.g. object_id) are server-populated with no source
+		// location, and bundle-level permissions have no per-resource YAML node at all,
+		// so resolving them would fail the whole sync. Skip them instead.
+		if isPermissionsOrGrantsSubResource(resourceKey) {
+			continue
+		}
+
 		resourceChanges := make(ResourceChanges)
 
 		if entry.Changes != nil {
 			for path, changeDesc := range entry.Changes {
-				if changeDesc.Action == deployplan.Skip {
+				if changeDesc.Action == deployplan.Skip && changeDesc.Reason != deployplan.ReasonRemoteAddition {
 					continue
 				}
 
@@ -161,6 +169,12 @@ func DetectChanges(ctx context.Context, b *bundle.Bundle, engine engine.EngineTy
 				if change.Operation == OperationSkip {
 					continue
 				}
+				// The state snapshot holds real per-field values, so New != Old
+				// means the local config diverged from the last deploy and this
+				// change overwrites that pending edit.
+				if !structdiff.IsEqual(changeDesc.Old, changeDesc.New) {
+					change.LocalEdit = true
+				}
 				change.Value = stripNamePrefix(fullPath, change.Value, b.Config.Presets.NamePrefix)
 				resourceChanges[path] = change
 			}
@@ -175,52 +189,3 @@ func DetectChanges(ctx context.Context, b *bundle.Bundle, engine engine.EngineTy
 
 	return changes, nil
 }
-
-func ensureSnapshotAvailable(ctx context.Context, b *bundle.Bundle, engine engine.EngineType) error {
-	if engine.IsDirect() {
-		return nil
-	}
-
-	remotePathSnapshot, localPathSnapshot := b.StateFilenameConfigSnapshot(ctx)
-
-	if _, err := os.Stat(localPathSnapshot); err == nil {
-		return nil
-	} else if !errors.Is(err, fs.ErrNotExist) {
-		return fmt.Errorf("checking snapshot file: %w", err)
-	}
-
-	log.Debugf(ctx, "Resources state snapshot not found locally, pulling from remote")
-
-	f, err := deploy.StateFiler(ctx, b)
-	if err != nil {
-		return fmt.Errorf("getting state filer: %w", err)
-	}
-
-	r, err := f.Read(ctx, remotePathSnapshot)
-	if err != nil {
-		if errors.Is(err, fs.ErrNotExist) {
-			return fmt.Errorf("resources state snapshot not found remotely at %s", remotePathSnapshot)
-		}
-		return fmt.Errorf("reading remote snapshot: %w", err)
-	}
-	defer r.Close()
-
-	content, err := io.ReadAll(r)
-	if err != nil {
-		return fmt.Errorf("reading snapshot content: %w", err)
-	}
-
-	localStateDir := filepath.Dir(localPathSnapshot)
-	err = os.MkdirAll(localStateDir, 0o700)
-	if err != nil {
-		return fmt.Errorf("creating snapshot directory: %w", err)
-	}
-
-	err = os.WriteFile(localPathSnapshot, content, 0o600)
-	if err != nil {
-		return fmt.Errorf("writing snapshot file: %w", err)
-	}
-
-	log.Debugf(ctx, "Pulled config snapshot from remote to %s", localPathSnapshot)
-	return nil
-}
diff --git a/bundle/configsync/diff_test.go b/bundle/configsync/diff_test.go
index f55a6453784..b16885f6b71 100644
--- a/bundle/configsync/diff_test.go
+++ b/bundle/configsync/diff_test.go
@@ -3,9 +3,95 @@ package configsync
 import (
 	"testing"
 
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/deployplan"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
+func TestConvertChangeDesc(t *testing.T) {
+	tests := []struct {
+		name    string
+		path    string
+		cd      *deployplan.ChangeDesc
+		wantOp  OperationType
+		wantVal any
+	}{
+		{
+			name:    "add: new in remote only",
+			path:    "resources.jobs.my_job.description",
+			cd:      &deployplan.ChangeDesc{Old: nil, New: nil, Remote: "remote-desc"},
+			wantOp:  OperationAdd,
+			wantVal: "remote-desc",
+		},
+		{
+			name:    "remove: in config, missing from remote",
+			path:    "resources.jobs.my_job.description",
+			cd:      &deployplan.ChangeDesc{Old: "state-desc", New: "config-desc", Remote: nil},
+			wantOp:  OperationRemove,
+			wantVal: nil,
+		},
+		{
+			name:    "replace: differs between config and remote",
+			path:    "resources.jobs.my_job.description",
+			cd:      &deployplan.ChangeDesc{Old: "state-desc", New: "config-desc", Remote: "remote-desc"},
+			wantOp:  OperationReplace,
+			wantVal: "remote-desc",
+		},
+		{
+			name:    "skip: absent everywhere",
+			path:    "resources.jobs.my_job.description",
+			cd:      &deployplan.ChangeDesc{Old: nil, New: nil, Remote: nil},
+			wantOp:  OperationSkip,
+			wantVal: nil,
+		},
+		// Regression: rename-back-and-forth. State holds the old key (user did not
+		// redeploy after the first sync), config holds the intermediate key, and
+		// remote now matches the original. The element at this path is missing from
+		// config, so the change must be Add — Replace would error in resolveSelectors
+		// because the keyed element no longer exists in the YAML.
+		{
+			name: "add: rename-back path, state has it but config does not",
+			path: "resources.jobs.my_job.tasks[task_key='new_task']",
+			cd: &deployplan.ChangeDesc{
+				Old:    map[string]any{"task_key": "new_task"},
+				New:    nil,
+				Remote: map[string]any{"task_key": "new_task"},
+			},
+			wantOp:  OperationAdd,
+			wantVal: map[string]any{"task_key": "new_task"},
+		},
+		{
+			name: "skip: state has it, config and remote do not",
+			path: "resources.jobs.my_job.tasks[task_key='gone']",
+			cd: &deployplan.ChangeDesc{
+				Old:    map[string]any{"task_key": "gone"},
+				New:    nil,
+				Remote: nil,
+			},
+			wantOp:  OperationSkip,
+			wantVal: nil,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := convertChangeDesc(tt.path, tt.cd)
+			require.NoError(t, err)
+			assert.Equal(t, tt.wantOp, got.Operation)
+			assert.Equal(t, tt.wantVal, got.Value)
+		})
+	}
+}
+
+func TestShouldSkipFieldDashboardEtag(t *testing.T) {
+	// etag is output-only: alwaysSkip must apply regardless of hasConfigValue,
+	// otherwise out-of-band etag drift is written back into the user's YAML.
+	path := "resources.dashboards.my_dashboard.etag"
+	assert.True(t, shouldSkipField(path, "some-etag", false))
+	assert.True(t, shouldSkipField(path, "some-etag", true))
+}
+
 func TestStripNamePrefix(t *testing.T) {
 	tests := []struct {
 		name   string
@@ -162,3 +248,53 @@ func TestMatchPattern(t *testing.T) {
 		})
 	}
 }
+
+// ExtractChanges must skip permissions/grants sub-resources: they are emitted as
+// their own plan keys but cannot be written back to YAML, and resolving them
+// (e.g. the server-populated object_id field, or a bundle-level permissions entry
+// with no per-resource YAML node) otherwise fails the whole sync.
+func TestExtractChangesSkipsPermissionsAndGrants(t *testing.T) {
+	ctx := t.Context()
+
+	plan := &deployplan.Plan{Plan: map[string]*deployplan.PlanEntry{
+		"resources.jobs.my_job": {
+			Changes: deployplan.Changes{
+				"description": {Action: deployplan.Update, New: nil, Remote: "remote-desc"},
+			},
+		},
+		"resources.jobs.my_job.permissions": {
+			Changes: deployplan.Changes{
+				"object_id": {Action: deployplan.Update, New: nil, Remote: "/jobs/123"},
+			},
+		},
+		"resources.schemas.my_schema.grants": {
+			Changes: deployplan.Changes{
+				"[0].privileges": {Action: deployplan.Update, New: nil, Remote: []any{"SELECT"}},
+			},
+		},
+		// A resource literally named "permissions" is a regular resource, not a
+		// permissions sub-resource, so its changes must be kept (structural
+		// classification via config.GetNodeAndType, not a suffix match).
+		"resources.jobs.permissions": {
+			Changes: deployplan.Changes{
+				"description": {Action: deployplan.Update, New: nil, Remote: "kept"},
+			},
+		},
+	}}
+
+	changes, err := ExtractChanges(ctx, &bundle.Bundle{}, plan)
+	require.NoError(t, err)
+
+	_, hasPerms := changes["resources.jobs.my_job.permissions"]
+	assert.False(t, hasPerms, "permissions sub-resource must be skipped")
+	_, hasGrants := changes["resources.schemas.my_schema.grants"]
+	assert.False(t, hasGrants, "grants sub-resource must be skipped")
+
+	job, hasJob := changes["resources.jobs.my_job"]
+	require.True(t, hasJob, "regular resource changes must be kept")
+	assert.Contains(t, job, "description")
+
+	namedPerms, hasNamedPerms := changes["resources.jobs.permissions"]
+	require.True(t, hasNamedPerms, "a resource named permissions must not be skipped")
+	assert.Contains(t, namedPerms, "description")
+}
diff --git a/bundle/configsync/output.go b/bundle/configsync/output.go
index 83de12c402b..dce2692b84c 100644
--- a/bundle/configsync/output.go
+++ b/bundle/configsync/output.go
@@ -2,10 +2,15 @@ package configsync
 
 import (
 	"context"
-	"os"
-	"path/filepath"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
 
 	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/libs/atomicfile"
+	"github.com/databricks/cli/libs/telemetry"
+	"github.com/databricks/cli/libs/telemetry/protos"
 )
 
 // FileChange represents a change to a bundle configuration file
@@ -15,21 +20,81 @@ type FileChange struct {
 	ModifiedContent string `json:"modifiedContent"`
 }
 
+// SyncStatus is the outcome the JSON caller (DABs in the Workspace) branches on.
+type SyncStatus string
+
+const (
+	StatusSuccess SyncStatus = "success"
+	// StatusSkipped: nothing to sync against (state missing, or no selector
+	// matched a deployed resource). Not an error for the caller.
+	StatusSkipped SyncStatus = "skipped"
+	StatusFailed  SyncStatus = "failed"
+)
+
 // DiffOutput represents the complete output of the config-remote-sync command
 type DiffOutput struct {
-	Files   []FileChange `json:"files"`
-	Changes Changes      `json:"changes"`
+	Status    SyncStatus                                 `json:"status"`
+	Error     string                                     `json:"error,omitempty"`
+	ErrorCode protos.BundleConfigRemoteSyncErrorCategory `json:"errorCode,omitempty"`
+	Files     []FileChange                               `json:"files"`
+	Changes   Changes                                    `json:"changes"`
 }
 
-// SaveFiles writes all file changes to disk.
-func SaveFiles(ctx context.Context, b *bundle.Bundle, files []FileChange) error {
-	for _, file := range files {
-		err := os.MkdirAll(filepath.Dir(file.Path), 0o755)
+// WriteResult renders the result and records the error payload on stats for
+// telemetry. In JSON mode the process never fails: the outcome is carried in
+// DiffOutput.Status so the caller branches on it, not the exit code. Text mode
+// returns the error so the CLI still fails loudly for humans.
+func WriteResult(out io.Writer, jsonOutput bool, stats *Stats, files []FileChange, changes Changes, err error) error {
+	status := StatusSuccess
+	// Read before the fallback below so unclassified errors carry no code.
+	errorCode := stats.ErrorCategory
+	if err != nil {
+		if stats.ErrorCategory == "" {
+			stats.ErrorCategory = protos.BundleConfigRemoteSyncErrorCategoryBundleLoadFailed
+		}
+		stats.ErrorMessage = telemetry.ScrubErrorMessage(err.Error())
+		// A selector that matched nothing: nothing to sync, not a failure.
+		if errors.Is(err, ErrNoMatchingSelector) {
+			status = StatusSkipped
+		} else {
+			status = StatusFailed
+		}
+	}
+
+	if !jsonOutput {
 		if err != nil {
 			return err
 		}
+		_, _ = io.WriteString(out, FormatTextOutput(changes))
+		_, _ = out.Write([]byte{'\n'})
+		return nil
+	}
+
+	output := DiffOutput{Status: status, Files: files, Changes: changes}
+	if output.Changes == nil {
+		// Serialize as {} rather than null so a consumer can iterate it unconditionally.
+		output.Changes = Changes{}
+	}
+	if err != nil {
+		output.Error = err.Error()
+		output.ErrorCode = errorCode
+	}
+	result, marshalErr := json.MarshalIndent(output, "", "  ")
+	if marshalErr != nil {
+		// Cannot produce JSON: fail rather than emit a partial contract.
+		stats.ErrorCategory = protos.BundleConfigRemoteSyncErrorCategoryOutputFailed
+		stats.ErrorMessage = telemetry.ScrubErrorMessage(marshalErr.Error())
+		return fmt.Errorf("failed to marshal output: %w", marshalErr)
+	}
+	_, _ = out.Write(result)
+	_, _ = out.Write([]byte{'\n'})
+	return nil
+}
 
-		err = os.WriteFile(file.Path, []byte(file.ModifiedContent), 0o644)
+// SaveFiles writes all file changes to disk.
+func SaveFiles(ctx context.Context, b *bundle.Bundle, files []FileChange) error {
+	for _, file := range files {
+		err := atomicfile.Write(file.Path, []byte(file.ModifiedContent), 0o644, atomicfile.MkDir(0o755))
 		if err != nil {
 			return err
 		}
diff --git a/bundle/configsync/patch.go b/bundle/configsync/patch.go
index e002d31335c..573b5d2c1ba 100644
--- a/bundle/configsync/patch.go
+++ b/bundle/configsync/patch.go
@@ -40,7 +40,7 @@ func ApplyChangesToYAML(ctx context.Context, b *bundle.Bundle, fieldChanges []Fi
 
 		modifiedContent, err := applyChange(ctx, modifiedFiles[filePath], fieldChange)
 		if err != nil {
-			return nil, fmt.Errorf("failed to apply change to file %s for a field %s: %w", filePath, fieldChange.FieldCandidates[0], err)
+			return nil, fmt.Errorf("failed to apply change to file %s for a field %s: %w", filePath, fieldChange.WritePath, err)
 		}
 
 		modifiedFiles[filePath] = modifiedContent
@@ -81,7 +81,7 @@ func applyChange(ctx context.Context, content []byte, fieldChange FieldChange) (
 	var firstErr error
 	var parentNodesToCreate []parentNode
 
-	for _, fieldPathCandidate := range fieldChange.FieldCandidates {
+	for _, fieldPathCandidate := range fieldChange.writePaths() {
 		jsonPointer, err := strPathToJSONPointer(fieldPathCandidate)
 		if err != nil {
 			return nil, fmt.Errorf("failed to convert field path %q to JSON pointer: %w", fieldPathCandidate, err)
@@ -285,7 +285,7 @@ func clearAddedFlowStyle(content []byte, fieldChanges []FieldChange) ([]byte, er
 		return content, nil //nolint:nilerr // return original content if YAML parsing fails
 	}
 	for _, fc := range fieldChanges {
-		for _, candidate := range fc.FieldCandidates {
+		for _, candidate := range fc.writePaths() {
 			clearFlowStyleAlongPath(&doc, candidate)
 		}
 	}
diff --git a/bundle/configsync/patch_test.go b/bundle/configsync/patch_test.go
index b4faea82858..ef0030f95f8 100644
--- a/bundle/configsync/patch_test.go
+++ b/bundle/configsync/patch_test.go
@@ -50,8 +50,9 @@ resources:
 		},
 	}
 
-	fieldChanges, err := ResolveChanges(ctx, b, changes)
+	fieldChanges, skipped, err := ResolveChanges(ctx, b, changes, LoadPreResolvedConfig(ctx, b))
 	require.NoError(t, err)
+	require.Empty(t, skipped)
 
 	fileChanges, err := ApplyChangesToYAML(ctx, b, fieldChanges)
 	require.NoError(t, err)
diff --git a/bundle/configsync/rename.go b/bundle/configsync/rename.go
new file mode 100644
index 00000000000..916f37ef0c3
--- /dev/null
+++ b/bundle/configsync/rename.go
@@ -0,0 +1,327 @@
+package configsync
+
+import (
+	"maps"
+	"slices"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/libs/structs/structdiff"
+	"github.com/databricks/cli/libs/structs/structpath"
+)
+
+// renamedElement is a keyed sequence element whose key changed remotely.
+type renamedElement struct {
+	// keyField is the field holding the key, e.g. "task_key".
+	keyField string
+	oldKey   string
+	newKey   string
+	// addPath is the change path of the add half, kept so it can be skipped.
+	addPath string
+}
+
+type renameSet struct {
+	// byRemovePath maps the remove half's change path to the pair.
+	byRemovePath map[string]renamedElement
+	// addPaths are the add halves, which must not be routed on their own.
+	addPaths map[string]struct{}
+	// unpairedPaths are the halves of a suspected key change that could not be
+	// matched up one-to-one. Applying them separately would delete the element from
+	// every block and recreate it in one, collapsing a split element and moving
+	// fields into a scope the user did not choose, so neither half is applied. The
+	// value is the reason, for reporting.
+	unpairedPaths map[string]string
+}
+
+// matchRenamingPairs matches removes of keyed elements against adds in the same sequence
+// that carry the same content apart from the key.
+//
+// A remote key change is reported as an unrelated remove plus add, so without
+// pairing the element is deleted and recreated: the recreated copy has to be
+// placed somewhere, and for an element defined in several blocks there is no
+// single right place. Recognising the pair turns it into a key rewrite, which
+// every defining block can apply to its own part.
+func matchRenamingPairs(b *bundle.Bundle, blocks *blockResolver, resourceKey string, changes ResourceChanges) renameSet {
+	set := renameSet{
+		byRemovePath:  map[string]renamedElement{},
+		addPaths:      map[string]struct{}{},
+		unpairedPaths: map[string]string{},
+	}
+	if blocks == nil {
+		return set
+	}
+
+	removes, adds := keyedElementChanges(changes)
+
+	// The remove half carries no value, so each removed element is read from the
+	// merged configuration once: its fields decide which additions it could have
+	// become, and its source blocks decide whether a choice between them is safe.
+	candidates := make([]renameCandidate, 0, len(removes))
+	for _, remove := range removes {
+		resolved, err := resolveSelectors(resourceKey+"."+remove.path, b, OperationRemove)
+		if err != nil || !resolved.leaf.IsValid() {
+			continue
+		}
+		element, ok := resolved.leaf.AsAny().(map[string]any)
+		if !ok {
+			continue
+		}
+		candidates = append(candidates, renameCandidate{
+			remove:    remove,
+			resolved:  resolved,
+			oldFields: withoutKey(element, remove.keyField),
+		})
+	}
+
+	// Which additions each removal could equally well have become. Matching is by
+	// content, so it is symmetric: an addition can be a match for several removals
+	// just as a removal can match several additions.
+	matches := make([][]keyedElement, len(candidates))
+	for i, candidate := range candidates {
+		matches[i] = matchingAdds(candidate, adds, sameElementApartFromKey)
+	}
+
+	// Which removals each addition matches, so "forced from both sides" is a lookup
+	// rather than a rescan of every other removal's matches.
+	matchedBy := map[string][]int{}
+	for i, candidateMatches := range matches {
+		for _, add := range candidateMatches {
+			matchedBy[add.path] = append(matchedBy[add.path], i)
+		}
+	}
+
+	for i, candidate := range candidates {
+		// A pair is only unambiguous when the choice is forced from both sides. One
+		// removal matching several additions is the obvious case, but so is several
+		// removals matching the same addition: pairing the first and deleting the rest
+		// would move a key into a block the user did not choose.
+		if len(matches[i]) == 1 && len(matchedBy[matches[i][0].path]) == 1 {
+			add := matches[i][0]
+			set.byRemovePath[candidate.remove.path] = renamedElement{
+				keyField: candidate.remove.keyField,
+				oldKey:   candidate.remove.key,
+				newKey:   add.key,
+				addPath:  add.path,
+			}
+			set.addPaths[add.path] = struct{}{}
+			continue
+		}
+
+		if len(matches[i]) > 0 {
+			// Which pairing was intended only matters when the elements live in
+			// different blocks, because then it decides which block each new key is
+			// written to. Within one block every pairing writes the same elements to the
+			// same place, so the halves are applied as a plain removal and addition --
+			// holding them back would drop the rename and leave anything referring to
+			// them by key (depends_on) pointing at keys that no longer exist.
+			if ambiguityCrossesBlocks(blocks, candidates, matches[i], matchedBy) {
+				set.holdBack(candidate.remove.path, addPaths(matches[i]),
+					"several elements with the same contents were renamed at once, in different blocks")
+			}
+			continue
+		}
+
+		// The removal matched no addition. A plain removal is fine: it deletes every
+		// part of the element. But the same element re-added under a new key with one of
+		// its fields also edited cannot be recognised as a rename: applying the halves
+		// separately would delete a split element from every block and recreate it in
+		// one, collapsing the split and moving fields into a scope the user did not
+		// choose.
+		var edited []keyedElement
+		for _, add := range matchingAdds(candidate, adds, sameFieldsApartFromKey) {
+			// An addition already paired with another removal is that rename's half.
+			if _, taken := set.addPaths[add.path]; !taken {
+				edited = append(edited, add)
+			}
+		}
+		if len(edited) > 0 && multiBlockElement(blocks, candidate.resolved) {
+			set.holdBack(candidate.remove.path, addPaths(edited),
+				"a split element cannot be removed and recreated at once")
+		}
+	}
+	return set
+}
+
+// renameCandidate is a removal of a keyed element, resolved once so its fields and
+// source blocks can be consulted without walking the tree again.
+type renameCandidate struct {
+	remove   keyedElement
+	resolved resolvedChange
+	// oldFields is the removed element without its key field, i.e. what an addition
+	// has to look like to be the same element under a new key.
+	oldFields map[string]any
+}
+
+// matchingAdds returns the additions in the same sequence that satisfy pred, i.e. the
+// ones this removal could have become.
+func matchingAdds(candidate renameCandidate, adds []keyedElement, pred func(map[string]any, keyedElement) bool) []keyedElement {
+	var out []keyedElement
+	for _, add := range adds {
+		if candidate.remove.parent != add.parent || candidate.remove.keyField != add.keyField {
+			continue
+		}
+		if pred(candidate.oldFields, add) {
+			out = append(out, add)
+		}
+	}
+	return out
+}
+
+// ambiguityCrossesBlocks reports whether an unforced pairing would have to choose
+// between blocks. Every removal that could have become one of the same additions is
+// considered, because the choice is between them.
+func ambiguityCrossesBlocks(blocks *blockResolver, candidates []renameCandidate, matches []keyedElement, matchedBy map[string][]int) bool {
+	var seen []sourceBlock
+	for _, i := range competingRemovals(matches, matchedBy) {
+		steps := candidates[i].resolved.steps
+		if len(steps) == 0 {
+			return true
+		}
+		elementBlocks := blocks.blocksOf(steps[len(steps)-1].element)
+		if len(elementBlocks) != 1 {
+			return true
+		}
+		if !slices.Contains(seen, elementBlocks[0]) {
+			seen = append(seen, elementBlocks[0])
+		}
+	}
+	return len(seen) != 1
+}
+
+// competingRemovals returns the indices of every removal matching any of these
+// additions, including the one they came from.
+func competingRemovals(matches []keyedElement, matchedBy map[string][]int) []int {
+	var out []int
+	for _, add := range matches {
+		for _, i := range matchedBy[add.path] {
+			if !slices.Contains(out, i) {
+				out = append(out, i)
+			}
+		}
+	}
+	return out
+}
+
+// holdBack refuses both halves of a suspected key change, so a rename is never applied
+// as a removal that lands without its matching addition.
+func (s renameSet) holdBack(removePath string, addPaths []string, reason string) {
+	s.unpairedPaths[removePath] = reason
+	for _, path := range addPaths {
+		s.unpairedPaths[path] = reason
+	}
+}
+
+func addPaths(adds []keyedElement) []string {
+	paths := make([]string, 0, len(adds))
+	for _, add := range adds {
+		paths = append(paths, add.path)
+	}
+	return paths
+}
+
+// multiBlockElement reports whether the element the change addresses is assembled
+// from more than one physical block.
+func multiBlockElement(blocks *blockResolver, change resolvedChange) bool {
+	if len(change.steps) == 0 {
+		return false
+	}
+	last := change.steps[len(change.steps)-1]
+	return len(blocks.blocksOf(last.element)) > 1
+}
+
+// keyedElement is one side of a candidate rename.
+type keyedElement struct {
+	path     string
+	parent   string
+	keyField string
+	key      string
+	value    any
+}
+
+// keyedElementChanges splits the changes that address a whole keyed element into
+// removes and adds, in a deterministic order.
+func keyedElementChanges(changes ResourceChanges) (removes, adds []keyedElement) {
+	for _, path := range slices.Sorted(maps.Keys(changes)) {
+		change := changes[path]
+		if change.Operation != OperationRemove && change.Operation != OperationAdd {
+			continue
+		}
+		node, err := structpath.ParsePath(path)
+		if err != nil {
+			continue
+		}
+		keyField, key, ok := node.KeyValue()
+		if !ok {
+			continue
+		}
+		element := keyedElement{
+			path:     path,
+			parent:   node.Parent().String(),
+			keyField: keyField,
+			key:      key,
+			value:    change.Value,
+		}
+		if change.Operation == OperationRemove {
+			removes = append(removes, element)
+		} else {
+			adds = append(adds, element)
+		}
+	}
+	return removes, adds
+}
+
+// sameElementApartFromKey reports whether the added element is the removed one with
+// a different key, i.e. a plain rename. oldFields is the removed element without its
+// key field.
+func sameElementApartFromKey(oldFields map[string]any, add keyedElement) bool {
+	newFields, ok := fieldsApartFromKey(add)
+	return ok && structdiff.IsEqual(oldFields, newFields)
+}
+
+// sameFieldsApartFromKey reports whether the added element has the same fields as the
+// removed one, ignoring their values, i.e. whether it could be that element with a field
+// edited. An unrelated new element generally has a different shape.
+func sameFieldsApartFromKey(oldFields map[string]any, add keyedElement) bool {
+	newFields, ok := fieldsApartFromKey(add)
+	return ok && slices.Equal(slices.Sorted(maps.Keys(oldFields)), slices.Sorted(maps.Keys(newFields)))
+}
+
+// fieldsApartFromKey returns the added element's fields without its key field.
+func fieldsApartFromKey(add keyedElement) (map[string]any, bool) {
+	value, ok := add.value.(map[string]any)
+	if !ok {
+		return nil, false
+	}
+	return withoutKey(value, add.keyField), true
+}
+
+func withoutKey(value map[string]any, keyField string) map[string]any {
+	out := make(map[string]any, len(value))
+	for field, fieldValue := range value {
+		if field != keyField {
+			out[field] = fieldValue
+		}
+	}
+	return out
+}
+
+// renameKeyChange turns a paired rename into a write of just the element's key field, so
+// the element's other fields stay where they are and a split element keeps its parts in
+// their original scopes.
+//
+// The index is still adjusted, because a removal earlier in the same block shifts the
+// position the key rewrite has to target.
+func renameKeyChange(blocks *blockResolver, block sourceBlock, scope string, indices *indexTracker,
+	blockPath, mergedPath *structpath.PatternNode, rename renamedElement, change *ConfigChangeDesc,
+) FieldChange {
+	change.Operation = OperationReplace
+	change.Value = rename.newKey
+
+	blockPath = adjustArrayIndex(blockPath, scope, indices.operations)
+	blockPath = structpath.NewPatternStringKey(blockPath, rename.keyField)
+	return FieldChange{
+		FilePath:     block.file,
+		Change:       change,
+		WritePath:    blocks.candidatePath(block, blockPath),
+		originalPath: structpath.NewPatternStringKey(mergedPath, rename.keyField).String(),
+	}
+}
diff --git a/bundle/configsync/resolve.go b/bundle/configsync/resolve.go
index 01018365e67..cdad5182336 100644
--- a/bundle/configsync/resolve.go
+++ b/bundle/configsync/resolve.go
@@ -3,6 +3,7 @@ package configsync
 import (
 	"cmp"
 	"context"
+	"errors"
 	"fmt"
 	"io/fs"
 	"maps"
@@ -18,28 +19,56 @@ import (
 )
 
 type FieldChange struct {
-	FilePath        string
-	Change          *ConfigChangeDesc
-	FieldCandidates []string
+	FilePath string
+	Change   *ConfigChangeDesc
+	// WritePath addresses the field in the file at FilePath, so for an override block
+	// it carries the targets.<target> prefix and its sequence indices are block-local.
+	WritePath string
+	// AltWritePath is tried when WritePath does not exist in the file. It is only set
+	// when the change could not be routed to a block, i.e. when the scope had to be
+	// guessed; a routed change has exactly one correct path.
+	AltWritePath string
+	// originalPath addresses the field in the original configuration, before deployment
+	// replaced any ${var.X} reference with its value, so restoration can read the
+	// reference back. That configuration is merged, so unlike WritePath this path is in
+	// merged index space and has no prefix (see sequences.go). Deriving one from the
+	// other reads a different element and restores a sibling's reference.
+	originalPath string
 }
 
-// resolveSelectors converts key-value selectors to numeric indices that match
-// the YAML file positions. It also returns the location of the resolved leaf value.
+// resolvedChange locates a change in the source YAML.
+type resolvedChange struct {
+	// path is relative to the block, with merged indices still in place.
+	path  *structpath.PatternNode
+	steps []sequenceStep
+	// leaf is the merged value the change addresses, invalid for a new field.
+	leaf dyn.Value
+	// operation decides how many destinations the change needs: a removal has to
+	// reach every definition, an edit only the one that wins the merge.
+	operation OperationType
+}
+
+// resolveSelectors converts key-value selectors to the indices of the merged
+// configuration and records the sequence elements traversed on the way, so the
+// caller can map those positions onto the physical block that owns them.
 // Example: "resources.jobs.foo.tasks[task_key='main'].name" -> "resources.jobs.foo.tasks[1].name"
 // Returns a PatternNode because for Add operations, [*] may be used as a placeholder for new elements.
-func resolveSelectors(pathStr string, b *bundle.Bundle, operation OperationType) (*structpath.PatternNode, dyn.Location, error) {
+func resolveSelectors(pathStr string, b *bundle.Bundle, operation OperationType) (resolvedChange, error) {
 	node, err := structpath.ParsePath(pathStr)
 	if err != nil {
-		return nil, dyn.Location{}, fmt.Errorf("failed to parse path %s: %w", pathStr, err)
+		return resolvedChange{}, fmt.Errorf("failed to parse path %s: %w", pathStr, err)
 	}
 
 	nodes := node.AsSlice()
 	var result *structpath.PatternNode
+	var steps []sequenceStep
+	var currentPath dyn.Path
 	currentValue := b.Config.Value()
 
-	for _, n := range nodes {
+	for component, n := range nodes {
 		if key, ok := n.StringKey(); ok {
 			result = structpath.NewPatternStringKey(result, key)
+			currentPath = append(currentPath, dyn.Key(key))
 			if currentValue.IsValid() {
 				currentValue, _ = dyn.GetByPath(currentValue, dyn.Path{dyn.Key(key)})
 			}
@@ -47,17 +76,30 @@ func resolveSelectors(pathStr string, b *bundle.Bundle, operation OperationType)
 		}
 
 		if idx, ok := n.Index(); ok {
+			sequencePath := slices.Clone(currentPath)
 			result = structpath.NewPatternIndex(result, idx)
+			currentPath = append(currentPath, dyn.Index(idx))
+			var element dyn.Value
 			if currentValue.IsValid() {
-				currentValue, _ = dyn.GetByPath(currentValue, dyn.Path{dyn.Index(idx)})
+				element, _ = dyn.GetByPath(currentValue, dyn.Path{dyn.Index(idx)})
+				currentValue = element
 			}
+			steps = append(steps, sequenceStep{
+				component:    component,
+				sequencePath: sequencePath,
+				element:      element,
+				// A positional path can address one past the end of the sequence,
+				// which is how an add to a positionally-diffed list arrives. There is
+				// no element to route by, so it is placed like any other new element.
+				newElement: !element.IsValid(),
+			})
 			continue
 		}
 
 		// Check for key-value selector: [key='value']
 		if key, value, ok := n.KeyValue(); ok {
 			if !currentValue.IsValid() || currentValue.Kind() != dyn.KindSequence {
-				return nil, dyn.Location{}, fmt.Errorf("cannot apply [%s='%s'] selector to non-array value in path %s", key, value, pathStr)
+				return resolvedChange{}, fmt.Errorf("cannot apply [%s='%s'] selector to non-array value in path %s", key, value, pathStr)
 			}
 
 			seq, _ := currentValue.AsSequence()
@@ -75,50 +117,36 @@ func resolveSelectors(pathStr string, b *bundle.Bundle, operation OperationType)
 				}
 			}
 
+			sequencePath := slices.Clone(currentPath)
+
 			if foundIndex == -1 {
 				if operation == OperationAdd {
 					result = structpath.NewPatternBracketStar(result)
+					steps = append(steps, sequenceStep{
+						component:    component,
+						sequencePath: sequencePath,
+						newElement:   true,
+					})
 					// Can't navigate further into non-existent element
 					currentValue = dyn.Value{}
 					continue
 				}
-				return nil, dyn.Location{}, fmt.Errorf("no array element found with %s='%s' in path %s", key, value, pathStr)
+				return resolvedChange{}, fmt.Errorf("no array element found with %s='%s' in path %s", key, value, pathStr)
 			}
 
-			// Mutators may reorder sequence elements (e.g., tasks sorted by task_key).
-			// Use location information to determine the original YAML file position.
-			yamlIndex := yamlFileIndex(seq, foundIndex)
-			result = structpath.NewPatternIndex(result, yamlIndex)
+			result = structpath.NewPatternIndex(result, foundIndex)
+			currentPath = append(currentPath, dyn.Index(foundIndex))
+			steps = append(steps, sequenceStep{
+				component:    component,
+				sequencePath: sequencePath,
+				element:      seq[foundIndex],
+			})
 			currentValue = seq[foundIndex]
 			continue
 		}
 	}
 
-	return result, currentValue.Location(), nil
-}
-
-// yamlFileIndex determines the original YAML file position of a sequence element.
-// Mutators may reorder sequence elements (e.g., tasks sorted by task_key), so the
-// in-memory index may not match the position in the YAML file. This function uses
-// location information to count how many elements from the same file appear before
-// the target element, giving the correct index for YAML patching.
-func yamlFileIndex(seq []dyn.Value, sortedIndex int) int {
-	matchLocation := seq[sortedIndex].Location()
-	if matchLocation.File == "" {
-		return sortedIndex
-	}
-
-	yamlIndex := 0
-	for i, elem := range seq {
-		if i == sortedIndex {
-			continue
-		}
-		loc := elem.Location()
-		if loc.File == matchLocation.File && loc.Line < matchLocation.Line {
-			yamlIndex++
-		}
-	}
-	return yamlIndex
+	return resolvedChange{path: result, steps: steps, leaf: currentValue, operation: operation}, nil
 }
 
 func pathDepth(pathStr string) int {
@@ -132,7 +160,7 @@ func pathDepth(pathStr string) int {
 // adjustArrayIndex adjusts the index in a PatternNode based on previous operations.
 // When operations are applied sequentially, removals and additions shift array indices.
 // This function adjusts the index to account for those shifts.
-func adjustArrayIndex(path *structpath.PatternNode, operations map[string][]struct {
+func adjustArrayIndex(path *structpath.PatternNode, scope string, operations map[string][]struct {
 	index     int
 	operation OperationType
 },
@@ -143,8 +171,7 @@ func adjustArrayIndex(path *structpath.PatternNode, operations map[string][]stru
 	}
 
 	parentPath := path.Parent()
-	parentPathStr := parentPath.String()
-	ops := operations[parentPathStr]
+	ops := operations[scopedParent(scope, path)]
 
 	adjustment := 0
 	for _, op := range ops {
@@ -165,9 +192,19 @@ func adjustArrayIndex(path *structpath.PatternNode, operations map[string][]stru
 }
 
 // ResolveChanges resolves selectors and computes field path candidates for each change.
-func ResolveChanges(ctx context.Context, b *bundle.Bundle, configChanges Changes) ([]FieldChange, error) {
+//
+// A change that cannot be attributed to a single source location, or whose parent
+// in the config is written as a variable reference, is left unapplied rather than
+// written to a guessed or non-existent location. The count of those is returned so
+// the caller can record it: the command runs unattended, so a change that silently
+// disappears looks identical to one that was written. preResolved is the merged
+// config with ${...} references still literal, used to detect variable-reference
+// parents.
+func ResolveChanges(ctx context.Context, b *bundle.Bundle, configChanges Changes, preResolved dyn.Value) ([]FieldChange, int, error) {
 	var result []FieldChange
+	skipped := 0
 	targetName := b.Config.Bundle.Target
+	blocks := newBlockResolver(ctx, b)
 
 	resourceKeys := slices.Sorted(maps.Keys(configChanges))
 
@@ -203,102 +240,155 @@ func ResolveChanges(ctx context.Context, b *bundle.Bundle, configChanges Changes
 			return cmp.Compare(a, b)
 		})
 
-		// Create indices map for this resource, path -> indices, that we could use to replace with added elements
-		indicesToReplaceMap := make(map[string][]int)
+		// A key change on a keyed element arrives as a remove of the old key plus an
+		// add of the new one, with nothing linking them. Pairing them back up lets a
+		// rename be written as a key rewrite in every block that defines the element,
+		// which keeps a split element split instead of collapsing it into one scope.
+		renames := matchRenamingPairs(b, blocks, resourceKey, resourceChanges)
 
-		indexOperations := make(map[string][]struct {
-			index     int
-			operation OperationType
-		})
+		indices := newIndexTracker()
 
 		for _, fieldPath := range fieldPaths {
 			configChange := resourceChanges[fieldPath]
 			fullPath := resourceKey + "." + fieldPath
 
-			resolvedPath, resolvedLocation, err := resolveSelectors(fullPath, b, configChange.Operation)
-			if err != nil {
-				return nil, fmt.Errorf("failed to resolve selectors in path %s: %w", fullPath, err)
+			// The add half of a rename carries no source location of its own; the
+			// pair is written from the remove half, which does.
+			if _, ok := renames.addPaths[fieldPath]; ok {
+				continue
+			}
+			if reason, ok := renames.unpairedPaths[fieldPath]; ok {
+				log.Debugf(ctx, "config-remote-sync: skipping %s: %s", fullPath, reason)
+				skipped++
+				continue
 			}
+			rename, isRename := renames.byRemovePath[fieldPath]
 
-			// If the element is removed, we can use the index to replace it with added element
-			// That may improve the diff in cases when the task is recreated because of renaming
-			if configChange.Operation == OperationRemove {
-				freeIndex, ok := resolvedPath.Index()
-				if ok {
-					parentPath := resolvedPath.Parent().String()
-					indicesToReplaceMap[parentPath] = append(indicesToReplaceMap[parentPath], freeIndex)
-				}
+			resolved, err := resolveSelectors(fullPath, b, configChange.Operation)
+			if err != nil {
+				return nil, 0, fmt.Errorf("failed to resolve selectors in path %s: %w", fullPath, err)
+			}
+			resolvedPath := resolved.path
+
+			// Captured before routing rewrites indices to be block-local.
+			mergedIndexPath := resolvedPath
+
+			// The field is nested inside a value written as a variable reference (e.g.
+			// spark_conf: ${var.spark_conf}), which is a scalar in the file with no node
+			// to place the key or index under. Leave it unapplied, and record the skip on
+			// the shared change so the output reports "skip" rather than a write that never
+			// happens (matching the reclassification below).
+			if parentIsVariableReference(preResolved, mergedIndexPath.String()) {
+				log.Debugf(ctx, "config-remote-sync: skipping %s: parent is a variable reference", fullPath)
+				configChange.Operation = OperationSkip
+				skipped++
+				continue
 			}
 
-			if configChange.Operation == OperationAdd && resolvedPath.BracketStar() {
-				parentPath := resolvedPath.Parent().String()
-				indices, ok := indicesToReplaceMap[parentPath]
-				if ok && len(indices) > 0 {
-					index := indices[0]
-					indicesToReplaceMap[parentPath] = indices[1:]
-					resolvedPath = structpath.NewPatternIndex(resolvedPath.Parent(), index)
+			destinations, err := routeChange(blocks, resolved, isRename)
+			if err != nil {
+				if !errors.Is(err, errAmbiguousBlock) {
+					return nil, 0, err
 				}
+				// Applying this change would mean guessing a location. Leave it
+				// unapplied; a later run can pick it up.
+				log.Debugf(ctx, "config-remote-sync: skipping %s: %v", fullPath, err)
+				skipped++
+				continue
 			}
-
-			resolvedPath = adjustArrayIndex(resolvedPath, indexOperations)
-
-			// Track this operation for future index adjustments (only for array element operations)
-			if originalIndex, ok := resolvedPath.Index(); ok {
-				parentPath := resolvedPath.Parent().String()
-				indexOperations[parentPath] = append(indexOperations[parentPath], struct {
-					index     int
-					operation OperationType
-				}{originalIndex, configChange.Operation})
+			if len(destinations) == 0 {
+				// A rename whose element could not be attributed to a block: the whole
+				// pair is left for a later run rather than half-applied.
+				log.Debugf(ctx, "config-remote-sync: skipping %s: the renamed element has no source location", fullPath)
+				skipped++
+				continue
 			}
 
-			resolvedPathStr := resolvedPath.String()
-			candidates := []string{resolvedPathStr}
-			if targetName != "" {
-				targetPrefixedPath := "targets." + targetName + "." + resolvedPathStr
-				candidates = append(candidates, targetPrefixedPath)
-			}
+			for _, destination := range destinations {
+				block := destination.block
+				resolvedPath := destination.path
+				// Each destination gets its own copy: the operation and the value
+				// are rewritten below per destination, and one block's rewrite must
+				// not leak into the next.
+				destChange := &ConfigChangeDesc{
+					Operation: configChange.Operation,
+					Value:     configChange.Value,
+					LocalEdit: configChange.LocalEdit,
+				}
 
-			filePath := resolvedLocation.File
+				// Index bookkeeping is scoped to a block so that shifts caused by
+				// operations on one block cannot move indices in another.
+				scope := destination.scopeKey()
 
-			isDefinedInConfig := filePath != ""
-			if !isDefinedInConfig {
-				if configChange.Operation == OperationRemove {
-					// If the field is not defined in the config and the operation is remove, it is more likely a CLI default
-					// in this case we skip the change
+				if isRename {
+					result = append(result, renameKeyChange(blocks, *block, scope, indices,
+						resolvedPath, mergedIndexPath, rename, destChange))
 					continue
 				}
 
-				if configChange.Operation == OperationReplace {
-					// If the field is not defined in the config and the operation is replace, it is more likely a CLI default
-					// in this case we add it explicitly to the resource location
-					configChange.Operation = OperationAdd
-				}
+				resolvedPath = indices.place(scope, resolvedPath, destChange.Operation)
+
+				writePath, altWritePath := writeAddress(blocks, block, targetName, resolvedPath)
 
-				resourceLocation := b.Config.GetLocation(resourceKey)
-				filePath = resourceLocation.File
-				if filePath == "" {
-					return nil, fmt.Errorf("failed to find location for resource %s for a field %s", resourceKey, fieldPath)
+				// A change routed to a block has a known destination file even when the leaf
+				// itself is new, but "defined in the config" must still be decided by
+				// the leaf: a field with no source location is added, not replaced.
+				filePath := resolved.leaf.Location().File
+				isDefinedInConfig := filePath != ""
+				if block != nil && isDefinedInConfig {
+					filePath = block.file
 				}
 
-				log.Debugf(ctx, "Field %s has no location, using resource location: %s", fullPath, filePath)
-			}
+				if !isDefinedInConfig {
+					if destChange.Operation == OperationRemove {
+						// If the field is not defined in the config and the operation is remove, it is more likely a CLI default
+						// in this case we skip the change
+						continue
+					}
+
+					if destChange.Operation == OperationReplace {
+						// If the field is not defined in the config and the operation is replace, it is more likely a CLI default
+						// in this case we add it explicitly to the resource location.
+						// The reclassification is also recorded on the shared change so
+						// the command's output reports what was actually written.
+						destChange.Operation = OperationAdd
+						configChange.Operation = OperationAdd
+					}
+
+					if block != nil {
+						// The enclosing element was resolved to a block, so a new field
+						// on it belongs in that same block.
+						filePath = block.file
+					} else {
+						resourceLocation := b.Config.GetLocation(resourceKey)
+						filePath = resourceLocation.File
+					}
+					if filePath == "" {
+						return nil, 0, fmt.Errorf("failed to find location for resource %s for a field %s", resourceKey, fieldPath)
+					}
+
+					log.Debugf(ctx, "Field %s has no location, using %s", fullPath, filePath)
+				}
 
-			if (configChange.Operation == OperationAdd || configChange.Operation == OperationReplace) && b.SyncRootPath != "" {
-				configChange = &ConfigChangeDesc{
-					Operation: configChange.Operation,
-					Value:     translateWorkspacePaths(configChange.Value, b.SyncRootPath, b.SyncRoot, filepath.Dir(filePath)),
+				if (destChange.Operation == OperationAdd || destChange.Operation == OperationReplace) && b.SyncRootPath != "" {
+					destChange = &ConfigChangeDesc{
+						Operation: destChange.Operation,
+						Value:     translateWorkspacePaths(destChange.Value, b.SyncRootPath, b.SyncRoot, filepath.Dir(filePath)),
+					}
 				}
-			}
 
-			result = append(result, FieldChange{
-				FilePath:        filePath,
-				Change:          configChange,
-				FieldCandidates: candidates,
-			})
+				result = append(result, FieldChange{
+					FilePath:     filePath,
+					Change:       destChange,
+					WritePath:    writePath,
+					AltWritePath: altWritePath,
+					originalPath: mergedIndexPath.String(),
+				})
+			}
 		}
 	}
 
-	return result, nil
+	return result, skipped, nil
 }
 
 // translateWorkspacePaths recursively converts absolute workspace paths to relative
@@ -356,3 +446,12 @@ func resolveNotebookExtension(syncRoot fs.FS, relPath string) string {
 	}
 	return relPath
 }
+
+// writePaths lists the paths to try, in order: the addressed one, then the fallback
+// for a change whose scope had to be guessed.
+func (c FieldChange) writePaths() []string {
+	if c.AltWritePath == "" {
+		return []string{c.WritePath}
+	}
+	return []string{c.WritePath, c.AltWritePath}
+}
diff --git a/bundle/configsync/resolve_test.go b/bundle/configsync/resolve_test.go
index 9264ad7f5dc..9d85fc51119 100644
--- a/bundle/configsync/resolve_test.go
+++ b/bundle/configsync/resolve_test.go
@@ -8,7 +8,6 @@ import (
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/bundle/config/mutator"
 	"github.com/databricks/cli/libs/cmdio"
-	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/cli/libs/logdiag"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -32,9 +31,9 @@ func TestResolveSelectors_NoSelectors(t *testing.T) {
 
 	mutator.DefaultMutators(ctx, b)
 
-	result, _, err := resolveSelectors("resources.jobs.test_job.name", b, OperationReplace)
+	result, err := resolveSelectors("resources.jobs.test_job.name", b, OperationReplace)
 	require.NoError(t, err)
-	assert.Equal(t, "resources.jobs.test_job.name", result.String())
+	assert.Equal(t, "resources.jobs.test_job.name", result.path.String())
 }
 
 func TestResolveSelectors_NumericIndices(t *testing.T) {
@@ -57,13 +56,13 @@ func TestResolveSelectors_NumericIndices(t *testing.T) {
 
 	mutator.DefaultMutators(ctx, b)
 
-	result, _, err := resolveSelectors("resources.jobs.test_job.tasks[0].task_key", b, OperationReplace)
+	result, err := resolveSelectors("resources.jobs.test_job.tasks[0].task_key", b, OperationReplace)
 	require.NoError(t, err)
-	assert.Equal(t, "resources.jobs.test_job.tasks[0].task_key", result.String())
+	assert.Equal(t, "resources.jobs.test_job.tasks[0].task_key", result.path.String())
 
-	result, _, err = resolveSelectors("resources.jobs.test_job.tasks[1].task_key", b, OperationReplace)
+	result, err = resolveSelectors("resources.jobs.test_job.tasks[1].task_key", b, OperationReplace)
 	require.NoError(t, err)
-	assert.Equal(t, "resources.jobs.test_job.tasks[1].task_key", result.String())
+	assert.Equal(t, "resources.jobs.test_job.tasks[1].task_key", result.path.String())
 }
 
 func TestResolveSelectors_KeyValueSelector(t *testing.T) {
@@ -90,13 +89,13 @@ func TestResolveSelectors_KeyValueSelector(t *testing.T) {
 
 	mutator.DefaultMutators(ctx, b)
 
-	result, _, err := resolveSelectors("resources.jobs.test_job.tasks[task_key='main'].notebook_task.notebook_path", b, OperationReplace)
+	result, err := resolveSelectors("resources.jobs.test_job.tasks[task_key='main'].notebook_task.notebook_path", b, OperationReplace)
 	require.NoError(t, err)
-	assert.Equal(t, "resources.jobs.test_job.tasks[1].notebook_task.notebook_path", result.String())
+	assert.Equal(t, "resources.jobs.test_job.tasks[1].notebook_task.notebook_path", result.path.String())
 
-	result, _, err = resolveSelectors("resources.jobs.test_job.tasks[task_key='setup'].notebook_task.notebook_path", b, OperationReplace)
+	result, err = resolveSelectors("resources.jobs.test_job.tasks[task_key='setup'].notebook_task.notebook_path", b, OperationReplace)
 	require.NoError(t, err)
-	assert.Equal(t, "resources.jobs.test_job.tasks[0].notebook_task.notebook_path", result.String())
+	assert.Equal(t, "resources.jobs.test_job.tasks[0].notebook_task.notebook_path", result.path.String())
 }
 
 func TestResolveSelectors_SelectorNotFound(t *testing.T) {
@@ -120,7 +119,7 @@ func TestResolveSelectors_SelectorNotFound(t *testing.T) {
 
 	mutator.DefaultMutators(ctx, b)
 
-	_, _, err = resolveSelectors("resources.jobs.test_job.tasks[task_key='nonexistent'].notebook_task.notebook_path", b, OperationReplace)
+	_, err = resolveSelectors("resources.jobs.test_job.tasks[task_key='nonexistent'].notebook_task.notebook_path", b, OperationReplace)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "no array element found with task_key='nonexistent'")
 }
@@ -143,7 +142,7 @@ func TestResolveSelectors_SelectorOnNonArray(t *testing.T) {
 
 	mutator.DefaultMutators(ctx, b)
 
-	_, _, err = resolveSelectors("resources.jobs.test_job[task_key='main'].name", b, OperationReplace)
+	_, err = resolveSelectors("resources.jobs.test_job[task_key='main'].name", b, OperationReplace)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "cannot apply [task_key='main'] selector to non-array value")
 }
@@ -174,9 +173,9 @@ func TestResolveSelectors_NestedSelectors(t *testing.T) {
 
 	mutator.DefaultMutators(ctx, b)
 
-	result, _, err := resolveSelectors("resources.jobs.test_job.tasks[task_key='main'].libraries[0].pypi.package", b, OperationReplace)
+	result, err := resolveSelectors("resources.jobs.test_job.tasks[task_key='main'].libraries[0].pypi.package", b, OperationReplace)
 	require.NoError(t, err)
-	assert.Equal(t, "resources.jobs.test_job.tasks[1].libraries[0].pypi.package", result.String())
+	assert.Equal(t, "resources.jobs.test_job.tasks[1].libraries[0].pypi.package", result.path.String())
 }
 
 func TestResolveSelectors_WildcardNotSupported(t *testing.T) {
@@ -200,52 +199,7 @@ func TestResolveSelectors_WildcardNotSupported(t *testing.T) {
 
 	mutator.DefaultMutators(ctx, b)
 
-	_, _, err = resolveSelectors("resources.jobs.test_job.tasks.*.task_key", b, OperationReplace)
+	_, err = resolveSelectors("resources.jobs.test_job.tasks.*.task_key", b, OperationReplace)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "wildcards not allowed in path")
 }
-
-func TestYamlFileIndex(t *testing.T) {
-	// Simulate a sequence that was sorted alphabetically by a mutator.
-	// Original YAML order: notebook_task (line 10), python_wheel_task (line 20), pipeline_task (line 30), extra (line 40)
-	// Sorted order:        extra (line 40), notebook_task (line 10), pipeline_task (line 30), python_wheel_task (line 20)
-	seq := []dyn.Value{
-		dyn.NewValue(nil, []dyn.Location{{File: "a.yml", Line: 40}}), // extra
-		dyn.NewValue(nil, []dyn.Location{{File: "a.yml", Line: 10}}), // notebook_task
-		dyn.NewValue(nil, []dyn.Location{{File: "a.yml", Line: 30}}), // pipeline_task
-		dyn.NewValue(nil, []dyn.Location{{File: "a.yml", Line: 20}}), // python_wheel_task
-	}
-
-	assert.Equal(t, 3, yamlFileIndex(seq, 0)) // extra: 3 elements before it in YAML
-	assert.Equal(t, 0, yamlFileIndex(seq, 1)) // notebook_task: first in YAML
-	assert.Equal(t, 2, yamlFileIndex(seq, 2)) // pipeline_task: 2 elements before it
-	assert.Equal(t, 1, yamlFileIndex(seq, 3)) // python_wheel_task: 1 element before it
-}
-
-func TestYamlFileIndex_MultipleFiles(t *testing.T) {
-	// Tasks from two different files, sorted alphabetically by mutator.
-	// File A (lines 10, 20): task_a, task_b
-	// File B (lines 5, 15): task_c, task_d
-	// Sorted order: task_a (A:10), task_b (A:20), task_c (B:5), task_d (B:15)
-	seq := []dyn.Value{
-		dyn.NewValue(nil, []dyn.Location{{File: "a.yml", Line: 10}}), // task_a
-		dyn.NewValue(nil, []dyn.Location{{File: "a.yml", Line: 20}}), // task_b
-		dyn.NewValue(nil, []dyn.Location{{File: "b.yml", Line: 5}}),  // task_c
-		dyn.NewValue(nil, []dyn.Location{{File: "b.yml", Line: 15}}), // task_d
-	}
-
-	// Indices are relative to each file
-	assert.Equal(t, 0, yamlFileIndex(seq, 0)) // task_a: first in file A
-	assert.Equal(t, 1, yamlFileIndex(seq, 1)) // task_b: second in file A
-	assert.Equal(t, 0, yamlFileIndex(seq, 2)) // task_c: first in file B
-	assert.Equal(t, 1, yamlFileIndex(seq, 3)) // task_d: second in file B
-}
-
-func TestYamlFileIndex_NoLocation(t *testing.T) {
-	seq := []dyn.Value{
-		dyn.NewValue(nil, nil),
-		dyn.NewValue(nil, nil),
-	}
-	assert.Equal(t, 0, yamlFileIndex(seq, 0))
-	assert.Equal(t, 1, yamlFileIndex(seq, 1))
-}
diff --git a/bundle/configsync/select.go b/bundle/configsync/select.go
new file mode 100644
index 00000000000..269150ed8b5
--- /dev/null
+++ b/bundle/configsync/select.go
@@ -0,0 +1,199 @@
+package configsync
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"slices"
+	"strings"
+
+	"github.com/databricks/cli/bundle/direct/dstate"
+	"github.com/databricks/cli/libs/log"
+)
+
+// ErrNoMatchingSelector marks an all-stale --select-ids batch (no selector
+// matched a deployed resource), distinct from a malformed selector: the former
+// is drift the caller reports as skipped, the latter is a failure.
+var ErrNoMatchingSelector = errors.New("no matching selector")
+
+// noMatchingSelectorError keeps the descriptive message while matching
+// ErrNoMatchingSelector via errors.Is, so the sentinel text never leaks into it.
+type noMatchingSelectorError struct{ msg string }
+
+func (e *noMatchingSelectorError) Error() string { return e.msg }
+
+func (e *noMatchingSelectorError) Unwrap() error { return ErrNoMatchingSelector }
+
+// IndexDeployedResources indexes the deployed resources by "<type>:<id>",
+// mapping to the plan key ("resources.<type>.<name>"). Indexing by the <type>
+// component means a selector can only ever match a resource of that exact type,
+// never an id that happens to collide across types.
+func IndexDeployedResources(state *dstate.DeploymentState) map[string]string {
+	byTypeID := make(map[string]string)
+	for key := range state.Data.State {
+		id := state.GetResourceID(key)
+		if id == "" {
+			continue
+		}
+		typeAndName, ok := strings.CutPrefix(key, "resources.")
+		if !ok {
+			continue
+		}
+		resourceType, _, ok := strings.Cut(typeAndName, ".")
+		if !ok {
+			continue
+		}
+		byTypeID[resourceType+":"+id] = key
+	}
+	return byTypeID
+}
+
+// ResolveResourceSelectors maps "<type>:<id>" selectors to their plan keys
+// ("resources.<type>.<name>") using the open deployment state (see
+// OpenDeploymentState).
+//
+// Selection uses both the resource type and the deployed resource id (a job id,
+// pipeline id, dashboard id, ...) — the pair the workspace UI knows from a
+// resource's page. The type is required because a resource id is only unique
+// within a type: an id that happens to collide across types (e.g. a job and a
+// warehouse) would otherwise select the wrong resource. <type> is the bundle
+// resource type as it appears in the plan key, e.g. "jobs" or "pipelines". This
+// is also why selection is independent from `bundle deploy --select`, which
+// matches "type.name" keys.
+//
+// A selector that matches no deployed resource is skipped rather than failing
+// the run — but only when at least one other selector did match. The workspace
+// UI batches every edited resource into one sync, so a single stale selector
+// (a resource deleted remotely, or whose deploy state has drifted) must not
+// drop the valid resources' edits. When NO selector matches, the error is
+// returned instead: silently reporting "no changes" would let the UI show a
+// success while nothing synced, hiding a real state problem. A malformed
+// selector (missing "<type>:<id>" shape) is always an error, because that is a
+// caller mistake rather than drift.
+// Duplicate selectors are deduplicated; the returned keys preserve the order in
+// which their selectors first appear.
+func ResolveResourceSelectors(ctx context.Context, state *dstate.DeploymentState, selectors []string) ([]string, error) {
+	byTypeID := IndexDeployedResources(state)
+
+	keys := make([]string, 0, len(selectors))
+	var missing []string
+	for _, selector := range selectors {
+		resourceType, id, ok := strings.Cut(selector, ":")
+		if !ok || resourceType == "" || id == "" {
+			return nil, fmt.Errorf("invalid --select-ids value %q, expected <type>:<id> (e.g. jobs:123456789)", selector)
+		}
+		key, ok := byTypeID[selector]
+		if !ok {
+			missing = append(missing, selector)
+			continue
+		}
+		if !slices.Contains(keys, key) {
+			keys = append(keys, key)
+		}
+	}
+
+	// No selector matched a deployed resource: fail loudly instead of syncing
+	// nothing, so the caller does not report a spurious success.
+	if len(keys) == 0 {
+		resourceType, id, _ := strings.Cut(missing[0], ":")
+		return nil, &noMatchingSelectorError{
+			msg: fmt.Sprintf("no deployed %s resource with id %s; %s", resourceType, id, describeStateIDs(byTypeID, resourceType)),
+		}
+	}
+
+	// Some selectors matched: skip the stale ones so the matched resources still
+	// sync (the UI batches several resources into one run).
+	for _, selector := range missing {
+		log.Debugf(ctx, "config-remote-sync: skipping selector %q, no deployed resource with that id", selector)
+	}
+	return keys, nil
+}
+
+// maxReportedIDs bounds how many ids describeStateIDs lists, so the message stays
+// readable for bundles with many resources of one type, and fits the limit
+// telemetry.ScrubErrorMessage truncates error_message to.
+const maxReportedIDs = 10
+
+// describeStateIDs summarizes the ids present in the deployment state index so
+// a failed selector lookup says what the state DID contain, not just what was
+// missing. Without this, "no deployed jobs resource with id X" cannot be told
+// apart from an empty state, a state for a different bundle, or a genuinely
+// stale id — the three have very different fixes.
+//
+// byTypeID is keyed "<type>:<id>" as built by ResolveResourceSelectors, mapping
+// to the plan key. Only resource types and ids are reported: ids are opaque
+// workspace identifiers, while resource keys/names come from user configuration
+// and are never included.
+//
+// Permissions and grants sub-resources are excluded. They are indexed under
+// their parent's type with a path-shaped object id ("jobs:/jobs/123"), which is
+// never selectable, would inflate the per-type counts, and would be redacted as
+// a path when the error is recorded in telemetry.
+func describeStateIDs(byTypeID map[string]string, resourceType string) string {
+	countsByType := make(map[string]int)
+	var sameTypeIDs []string
+	for typeAndID, resourceKey := range byTypeID {
+		if isPermissionsOrGrantsSubResource(resourceKey) {
+			continue
+		}
+		t, id, ok := strings.Cut(typeAndID, ":")
+		if !ok {
+			continue
+		}
+		countsByType[t]++
+		if t == resourceType {
+			sameTypeIDs = append(sameTypeIDs, id)
+		}
+	}
+
+	if len(countsByType) == 0 {
+		return "the deployment state contains no resources with ids (the bundle may not be deployed, or its resource state is missing)"
+	}
+
+	if len(sameTypeIDs) == 0 {
+		types := make([]string, 0, len(countsByType))
+		for t, n := range countsByType {
+			types = append(types, fmt.Sprintf("%s=%d", t, n))
+		}
+		slices.Sort(types)
+		return fmt.Sprintf("the deployment state contains no %s resources (deployed resources by type: %s)", resourceType, strings.Join(types, ", "))
+	}
+
+	slices.Sort(sameTypeIDs)
+	listed := sameTypeIDs
+	suffix := ""
+	if len(listed) > maxReportedIDs {
+		listed = listed[:maxReportedIDs]
+		suffix = fmt.Sprintf(" (and %d more)", len(sameTypeIDs)-maxReportedIDs)
+	}
+	return fmt.Sprintf("deployed %s ids in state: %s%s", resourceType, strings.Join(listed, ", "), suffix)
+}
+
+// FilterChanges returns the subset of changes that belong to the resources in
+// selected, a list of plan keys ("resources.<type>.<name>") as returned by
+// ResolveResourceSelectors. Change keys are plan keys too.
+//
+// Selection is at the resource level: a change node is kept when it is the
+// selected resource itself or any node beneath it, matched by prefix on the "."
+// path boundary. This groups a resource's permissions/grants sub-nodes
+// ("resources.<type>.<name>.permissions") with their parent, so selecting a
+// resource never silently skips its permissions. The "." boundary stops
+// "resources.jobs.foo" from also matching an unrelated "resources.jobs.foobar".
+//
+// Only the selected resources' own nodes are kept: unlike deploy's plan
+// filtering, the selection is not expanded to transitive dependencies, because
+// dependencies matter only when planning (the plan always covers the full
+// resource set so ${resources.*} references resolve), not when deciding which
+// resources' configuration may be rewritten.
+func FilterChanges(changes Changes, selected []string) Changes {
+	filtered := make(Changes)
+	for key, resourceChanges := range changes {
+		for _, sel := range selected {
+			if key == sel || strings.HasPrefix(key, sel+".") {
+				filtered[key] = resourceChanges
+				break
+			}
+		}
+	}
+	return filtered
+}
diff --git a/bundle/configsync/select_test.go b/bundle/configsync/select_test.go
new file mode 100644
index 00000000000..8fb1c787050
--- /dev/null
+++ b/bundle/configsync/select_test.go
@@ -0,0 +1,182 @@
+package configsync
+
+import (
+	"fmt"
+	"maps"
+	"slices"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestFilterChanges(t *testing.T) {
+	changes := Changes{
+		"resources.jobs.foo": {
+			"max_concurrent_runs": {Operation: OperationReplace, Value: 5},
+		},
+		"resources.jobs.foo.permissions": {
+			"[0].level": {Operation: OperationReplace, Value: "CAN_MANAGE"},
+		},
+		// Boundary: shares the "resources.jobs.foo" prefix but is a different
+		// resource, so selecting "resources.jobs.foo" must not pull it in.
+		"resources.jobs.foobar": {
+			"name": {Operation: OperationReplace, Value: "foobar"},
+		},
+		"resources.jobs.bar": {
+			"name": {Operation: OperationReplace, Value: "bar"},
+		},
+		"resources.schemas.baz": {
+			"comment": {Operation: OperationAdd, Value: "c"},
+		},
+		"resources.schemas.baz.grants": {
+			"[0].principal": {Operation: OperationAdd, Value: "users"},
+		},
+		// A resource whose name is literally "permissions" is the resource itself,
+		// not a sub-node, and is kept only when selected by its own key.
+		"resources.jobs.permissions": {
+			"name": {Operation: OperationReplace, Value: "p"},
+		},
+	}
+
+	tests := []struct {
+		name     string
+		selected []string
+		wantKeys []string
+	}{
+		{
+			name:     "resource groups its permissions sub-node by prefix, excludes the foobar sibling",
+			selected: []string{"resources.jobs.foo"},
+			wantKeys: []string{"resources.jobs.foo", "resources.jobs.foo.permissions"},
+		},
+		{
+			name:     "resource without sub-nodes",
+			selected: []string{"resources.jobs.bar"},
+			wantKeys: []string{"resources.jobs.bar"},
+		},
+		{
+			name:     "grants sub-node follows its parent",
+			selected: []string{"resources.schemas.baz"},
+			wantKeys: []string{"resources.schemas.baz", "resources.schemas.baz.grants"},
+		},
+		{
+			name:     "multiple selections are a union",
+			selected: []string{"resources.jobs.bar", "resources.schemas.baz"},
+			wantKeys: []string{"resources.jobs.bar", "resources.schemas.baz", "resources.schemas.baz.grants"},
+		},
+		{
+			name:     "resource with no detected changes yields empty result",
+			selected: []string{"resources.jobs.never_drifted"},
+			wantKeys: []string{},
+		},
+		{
+			name:     "resource named permissions is kept only by its own key",
+			selected: []string{"resources.jobs.permissions"},
+			wantKeys: []string{"resources.jobs.permissions"},
+		},
+		{
+			name:     "empty selection keeps nothing",
+			selected: nil,
+			wantKeys: []string{},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := FilterChanges(changes, tt.selected)
+			assert.ElementsMatch(t, tt.wantKeys, slices.Collect(maps.Keys(got)))
+			for _, key := range tt.wantKeys {
+				assert.Equal(t, changes[key], got[key])
+			}
+		})
+	}
+
+	// The input map is never mutated.
+	assert.Len(t, changes, 7)
+}
+
+func TestDescribeStateIDs(t *testing.T) {
+	tests := []struct {
+		name         string
+		byTypeID     map[string]string
+		resourceType string
+		want         string
+	}{
+		{
+			name:         "empty state is called out explicitly",
+			byTypeID:     map[string]string{},
+			resourceType: "jobs",
+			want:         "the deployment state contains no resources with ids (the bundle may not be deployed, or its resource state is missing)",
+		},
+		{
+			// Permissions/grants are indexed under the parent's type with a
+			// path-shaped object id; reporting them would leak a path and
+			// inflate the counts.
+			name: "permissions and grants sub-resources are excluded",
+			byTypeID: map[string]string{
+				"jobs:111":            "resources.jobs.a",
+				"jobs:/jobs/111":      "resources.jobs.a.permissions",
+				"schemas:s1":          "resources.schemas.s",
+				"schemas:/schemas/s1": "resources.schemas.s.grants",
+			},
+			resourceType: "jobs",
+			want:         "deployed jobs ids in state: 111",
+		},
+		{
+			name: "state holding only sub-resources reads as no resources with ids",
+			byTypeID: map[string]string{
+				"jobs:/jobs/111": "resources.jobs.a.permissions",
+			},
+			resourceType: "jobs",
+			want:         "the deployment state contains no resources with ids (the bundle may not be deployed, or its resource state is missing)",
+		},
+		{
+			// A resource literally named "permissions" is a real resource, not a
+			// sub-resource, so its id must still be reported.
+			name: "resource named permissions is still reported",
+			byTypeID: map[string]string{
+				"jobs:333": "resources.jobs.permissions",
+			},
+			resourceType: "jobs",
+			want:         "deployed jobs ids in state: 333",
+		},
+		{
+			name: "state holds other types only",
+			byTypeID: map[string]string{
+				"pipelines:abc-123": "resources.pipelines.p",
+				"schemas:99":        "resources.schemas.s",
+				"pipelines:def-456": "resources.pipelines.q",
+			},
+			resourceType: "jobs",
+			want:         "the deployment state contains no jobs resources (deployed resources by type: pipelines=2, schemas=1)",
+		},
+		{
+			name: "ids of the requested type are listed sorted",
+			byTypeID: map[string]string{
+				"jobs:222":  "resources.jobs.b",
+				"jobs:111":  "resources.jobs.a",
+				"schemas:7": "resources.schemas.s",
+			},
+			resourceType: "jobs",
+			want:         "deployed jobs ids in state: 111, 222",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, describeStateIDs(tt.byTypeID, tt.resourceType))
+		})
+	}
+}
+
+func TestDescribeStateIDsTruncatesLongLists(t *testing.T) {
+	byTypeID := make(map[string]string)
+	for i := range maxReportedIDs + 3 {
+		// Ids are zero-padded so lexical sort order is also numeric order,
+		// keeping the assertion independent of id formatting.
+		id := fmt.Sprintf("%03d", i)
+		byTypeID["jobs:"+id] = "resources.jobs.j" + id
+	}
+
+	got := describeStateIDs(byTypeID, "jobs")
+	assert.Equal(t, "deployed jobs ids in state: 000, 001, 002, 003, 004, 005, 006, 007, 008, 009 (and 3 more)", got)
+}
diff --git a/bundle/configsync/sequences.go b/bundle/configsync/sequences.go
new file mode 100644
index 00000000000..4ce0274fdb3
--- /dev/null
+++ b/bundle/configsync/sequences.go
@@ -0,0 +1,647 @@
+package configsync
+
+import (
+	"cmp"
+	"context"
+	"errors"
+	"fmt"
+	"maps"
+	"os"
+	"slices"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/libs/diag"
+	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/structs/structpath"
+)
+
+// Write-back has to turn a position in the merged configuration into a position in a
+// file, and the two do not correspond. That translation is what this file does.
+//
+// A sequence field of a resource may be defined in two physical regions: the top-level
+// resources.<type>.<name>.<field> block and the targets.<target>.resources... override
+// block, either of which may live in its own included file. Loading concatenates those
+// regions into one sequence and sorts keyed ones by key, so a merged index addresses no
+// single region. Crossing the two index spaces silently addresses a different element.
+//
+// Two questions have to be answered, in order:
+//
+//   - Which block receives the change? Its locations say where it was defined, and an
+//     element assembled from two blocks has a part in each.
+//   - Which position inside that block? Not just the block-local index, but the index the
+//     sequence will have by the time this change is applied, since earlier changes in the
+//     same run may already have moved it.
+//
+// Both apply equally to keyed and positional sequences; those differ only in how
+// resolveSelectors arrives at a merged position.
+
+// A block is (kind, file), because both kinds may occur in one file and one target's
+// override may span several files, so neither identifies a block alone.
+type sourceBlock struct {
+	// override is false for the top-level block and true for the selected target's
+	// override block.
+	override bool
+	file     string
+}
+
+// scopeKey identifies this block for index bookkeeping, so operations on one block
+// cannot shift positions recorded for another.
+func (b sourceBlock) scopeKey() string {
+	if b.override {
+		return "override\x00" + b.file + "\x00"
+	}
+	return "toplevel\x00" + b.file + "\x00"
+}
+
+// blockResolver answers which physical block a merged value came from, by location:
+// merging accumulates them (libs/dyn/merge), so a value assembled from two blocks
+// reports a location in each. Selecting a target folds its overrides into resources and
+// drops the targets subtree, so the blocks are recovered by parsing the files again.
+type blockResolver struct {
+	// blocks holds one parsed file per contributing file, keyed by block, so a
+	// path relative to a block can be looked up inside it.
+	blocks     map[sourceBlock]dyn.Value
+	target     string
+	byLocation map[diag.Location]sourceBlock
+}
+
+// newBlockResolver builds the location -> block mapping for the bundle's resources,
+// returning nil when the source cannot be re-read so callers keep their existing
+// single-block behaviour.
+//
+// The contributing files are parsed directly rather than reloaded through the mutator
+// pipeline, which would run the bundle's preinit script a second time.
+func newBlockResolver(ctx context.Context, b *bundle.Bundle) *blockResolver {
+	root := b.Config.Value()
+	if !root.IsValid() {
+		return nil
+	}
+
+	r := &blockResolver{
+		blocks:     make(map[sourceBlock]dyn.Value),
+		target:     b.Config.Bundle.Target,
+		byLocation: make(map[diag.Location]sourceBlock),
+	}
+
+	sourceFiles := slices.Sorted(maps.Keys(referencedFiles(root)))
+	for _, file := range sourceFiles {
+		contents, err := os.ReadFile(file)
+		if err != nil {
+			log.Debugf(ctx, "config-remote-sync: cannot read %s, treating its sequences as unsplit: %v", file, err)
+			continue
+		}
+		parsed, diags := config.LoadFromBytes(file, contents)
+		if diags.HasError() {
+			log.Debugf(ctx, "config-remote-sync: cannot parse %s, treating its sequences as unsplit: %v", file, diags.Error())
+			continue
+		}
+		r.registerBlock(parsed.Value(), sourceBlock{file: file})
+		if r.target != "" {
+			r.registerBlock(parsed.Value(), sourceBlock{override: true, file: file})
+		}
+	}
+
+	if len(r.byLocation) == 0 {
+		return nil
+	}
+	return r
+}
+
+func referencedFiles(root dyn.Value) map[string]struct{} {
+	files := map[string]struct{}{}
+	_ = dyn.WalkReadOnly(root, func(_ dyn.Path, v dyn.Value) error {
+		for _, location := range v.Locations() {
+			if location.File != "" {
+				files[location.File] = struct{}{}
+			}
+		}
+		return nil
+	})
+	return files
+}
+
+// registerBlock records that block exists and maps every location under its
+// resources subtree back to it, so a merged value can later be traced to the
+// region it was written in. Does nothing when the file has no such region, which
+// is why r.blocks doubles as the set of blocks that exist.
+func (r *blockResolver) registerBlock(parsed dyn.Value, block sourceBlock) {
+	subtree, err := dyn.GetByPath(parsed, r.regionPath(block, dyn.NewPath(dyn.Key("resources"))))
+	if err != nil {
+		return
+	}
+
+	// Keep the parsed file: resolving a path inside this block needs the tree it
+	// came from, and the entry also marks the block as present for sortedBlocks.
+	r.blocks[block] = parsed
+	_ = dyn.WalkReadOnly(subtree, func(_ dyn.Path, v dyn.Value) error {
+		for _, location := range v.Locations() {
+			// A file only carries locations of its own, so a location seen here
+			// belongs to this block. First writer wins: an outer node accumulates
+			// its children's locations, but the innermost node that owns a location
+			// is the one walked last.
+			if location.File != block.file {
+				continue
+			}
+			if _, ok := r.byLocation[location]; !ok {
+				r.byLocation[location] = block
+			}
+		}
+		return nil
+	})
+}
+
+// regionPath prefixes a resources-relative path with the region it belongs to.
+func (r *blockResolver) regionPath(block sourceBlock, path dyn.Path) dyn.Path {
+	if !block.override {
+		return path
+	}
+	return append(dyn.NewPath(dyn.Key("targets"), dyn.Key(r.target)), path...)
+}
+
+// candidatePath renders a resolved path the way the patch layer addresses it,
+// which for an override block includes the targets.<target> prefix.
+//
+// The prefix is built as path nodes rather than concatenated as text: a target name
+// may contain a dot ("dev.eu" is a legal name), and the result is parsed back into
+// segments, so text would split one name into two keys and address the wrong node.
+func (r *blockResolver) candidatePath(block sourceBlock, path *structpath.PatternNode) string {
+	if !block.override {
+		return path.String()
+	}
+	return targetPrefixedPath(r.target, path)
+}
+
+// targetPrefixedPath prefixes path with targets.<target>, quoting the target name
+// where necessary so the result parses back into the same segments.
+func targetPrefixedPath(target string, path *structpath.PatternNode) string {
+	prefixed := structpath.NewPatternStringKey(nil, "targets")
+	prefixed = structpath.NewPatternStringKey(prefixed, target)
+	for _, node := range path.AsSlice() {
+		if key, ok := node.StringKey(); ok {
+			prefixed = structpath.NewPatternStringKey(prefixed, key)
+		} else if index, ok := node.Index(); ok {
+			prefixed = structpath.NewPatternIndex(prefixed, index)
+		} else {
+			prefixed = structpath.NewPatternBracketStar(prefixed)
+		}
+	}
+	return prefixed.String()
+}
+
+// sortedBlocks orders top-level blocks first, so a choice between blocks never depends
+// on map iteration order.
+func (r *blockResolver) sortedBlocks() []sourceBlock {
+	blocks := slices.Collect(maps.Keys(r.blocks))
+	slices.SortFunc(blocks, compareBlocks)
+	return blocks
+}
+
+func compareBlocks(a, b sourceBlock) int {
+	if a.override != b.override {
+		if !a.override {
+			return -1
+		}
+		return 1
+	}
+	return cmp.Compare(a.file, b.file)
+}
+
+// blocksOf returns the distinct blocks that contributed to value, sorted with the
+// top-level block first. More than one result means the value is assembled from
+// several regions and has no single source location.
+func (r *blockResolver) blocksOf(value dyn.Value) []sourceBlock {
+	var blocks []sourceBlock
+	for _, location := range value.Locations() {
+		block, ok := r.byLocation[location]
+		if !ok {
+			continue
+		}
+		if !slices.Contains(blocks, block) {
+			blocks = append(blocks, block)
+		}
+	}
+	// Total order, so declaringBlock's choice never depends on how locations
+	// happened to accumulate.
+	slices.SortFunc(blocks, compareBlocks)
+	return blocks
+}
+
+// winningBlock returns the block whose definition the merged value took.
+//
+// Locations accumulate in merge order, so the first one that maps to a block is the
+// winner and writing any other copy would leave the effective value unchanged. Load
+// order is the only thing that distinguishes two blocks in the same scope.
+func (r *blockResolver) winningBlock(value dyn.Value) (sourceBlock, bool) {
+	for _, location := range value.Locations() {
+		if block, ok := r.byLocation[location]; ok {
+			return block, true
+		}
+	}
+	return sourceBlock{}, false
+}
+
+// indexWithinBlock returns the position of element inside block, where sequencePath is
+// relative to the block. A block is one parsed file, so the sequence read here holds
+// only that file's entries and a plain index into it is block-local.
+func (r *blockResolver) indexWithinBlock(block sourceBlock, sequencePath dyn.Path, element dyn.Value) (int, bool) {
+	parsed, ok := r.blocks[block]
+	if !ok {
+		return 0, false
+	}
+	sequence, err := dyn.GetByPath(parsed, r.regionPath(block, sequencePath))
+	if err != nil {
+		return 0, false
+	}
+	entries, ok := sequence.AsSequence()
+	if !ok {
+		return 0, false
+	}
+
+	locations := make(map[diag.Location]struct{}, len(element.Locations()))
+	for _, location := range element.Locations() {
+		locations[location] = struct{}{}
+	}
+
+	for local, entry := range entries {
+		for _, location := range entry.Locations() {
+			if _, ok := locations[location]; ok {
+				return local, true
+			}
+		}
+	}
+	return 0, false
+}
+
+// errAmbiguousBlock reports a change that cannot be attributed to one physical
+// block. Leaving such a change unapplied is preferable to writing it to a guessed
+// location, since the sync runs unattended and a later run can retry.
+var errAmbiguousBlock = errors.New("change cannot be attributed to a single source block")
+
+// singleDestination maps a change onto the one block that owns it.
+//
+// The element the change addresses decides the block: an element defined in
+// exactly one block is written there. When the addressed element is assembled from
+// several blocks, the leaf field decides instead, because merging records the
+// location of each field separately. If neither identifies a single block the
+// change is ambiguous and is reported as such.
+func (r *blockResolver) singleDestination(change resolvedChange) (routeDestination, error) {
+	block, err := r.blockFor(change)
+	if err != nil {
+		return routeDestination{}, err
+	}
+
+	path, err := r.pathWithinBlock(block, change)
+	if err != nil {
+		return routeDestination{}, err
+	}
+	return routeDestination{block: &block, path: path}, nil
+}
+
+// routeDestination is one physical place a change has to be written. block is nil when
+// the change was not routed to a block, i.e. it is written at its resolved path in
+// whichever file the resource was found in.
+type routeDestination struct {
+	block *sourceBlock
+	path  *structpath.PatternNode
+}
+
+// scopeKey identifies the destination for index bookkeeping, so operations on one
+// block cannot shift positions recorded for another. An unrouted destination shares
+// one scope, which is the behaviour before blocks were known.
+func (d routeDestination) scopeKey() string {
+	if d.block == nil {
+		return ""
+	}
+	return d.block.scopeKey()
+}
+
+// routeDestinations returns one destination for an edit, since only the definition that
+// wins the merge decides the deployed value, and one per definition for a removal, since
+// the value is gone only once every copy is.
+func (r *blockResolver) routeDestinations(change resolvedChange) ([]routeDestination, error) {
+	// The value whose definitions have to be reached: the element itself when the
+	// change addresses one, otherwise the field being removed.
+	var target dyn.Value
+	if addressesWholeElement(change) {
+		target = change.steps[len(change.steps)-1].element
+	} else if change.operation == OperationRemove {
+		target = change.leaf
+	}
+
+	if !target.IsValid() {
+		destination, err := r.singleDestination(change)
+		if err != nil {
+			return nil, err
+		}
+		return []routeDestination{destination}, nil
+	}
+
+	blocks := r.blocksOf(target)
+	if len(blocks) == 0 {
+		return nil, fmt.Errorf("%w: no source location for the value being changed", errAmbiguousBlock)
+	}
+
+	destinations := make([]routeDestination, 0, len(blocks))
+	for _, block := range blocks {
+		path, err := r.pathWithinBlock(block, change)
+		if err != nil {
+			return nil, err
+		}
+		destinations = append(destinations, routeDestination{block: &block, path: path})
+	}
+	return destinations, nil
+}
+
+// routeChange returns every physical place a change has to be written: one per block
+// that defines the addressed element, since an element split across blocks has a part in
+// each.
+//
+// Returns no destinations when the change has to be left for a later run, and
+// errAmbiguousBlock when applying it would mean guessing a location.
+func routeChange(blocks *blockResolver, resolved resolvedChange, isRename bool) ([]routeDestination, error) {
+	// Without a resolver, or with no sequence on the path, the resolved path is written
+	// as-is in whichever file the resource was found in.
+	if blocks == nil || len(resolved.steps) == 0 {
+		return []routeDestination{{path: resolved.path}}, nil
+	}
+
+	destinations, err := blocks.routeDestinations(resolved)
+	if isRename && errors.Is(err, errAmbiguousBlock) {
+		// A rename is a pair, so an element that cannot be attributed to a block leaves
+		// both halves for a later run instead of failing the resource.
+		return nil, nil
+	}
+	return destinations, err
+}
+
+// writeAddress renders the path to write, plus a fallback to try when the first does not
+// exist in the file.
+//
+// A change routed to a block has exactly one correct path, so it needs no fallback. One
+// that was not routed has a guessed scope: the top-level path is tried first and the
+// target override second.
+func writeAddress(blocks *blockResolver, block *sourceBlock, target string, path *structpath.PatternNode) (writePath, altWritePath string) {
+	if block != nil {
+		return blocks.candidatePath(*block, path), ""
+	}
+	if target == "" {
+		return path.String(), ""
+	}
+	return path.String(), targetPrefixedPath(target, path)
+}
+
+// addressesWholeElement reports whether the change targets an existing sequence
+// element itself rather than something inside it. Only such a change can need more
+// than one destination, since only it can span the blocks the element is built
+// from. A new element is excluded: it exists in no block yet, so it has no parts to
+// span and is placed by blockForNewElement instead.
+func addressesWholeElement(change resolvedChange) bool {
+	if len(change.steps) == 0 {
+		return false
+	}
+	for _, step := range change.steps {
+		if step.newElement {
+			return false
+		}
+	}
+	last := change.steps[len(change.steps)-1]
+	return len(change.path.AsSlice()) == last.component+1
+}
+
+func (r *blockResolver) blockFor(change resolvedChange) (sourceBlock, error) {
+	// A new element has no source of its own; it is placed relative to the
+	// sequence that receives it.
+	for _, step := range change.steps {
+		if step.newElement {
+			return r.blockForNewElement(change)
+		}
+	}
+
+	element := change.steps[len(change.steps)-1].element
+	blocks := r.blocksOf(element)
+	if len(blocks) == 0 {
+		return sourceBlock{}, fmt.Errorf("%w: no source location for the addressed element", errAmbiguousBlock)
+	}
+	if len(blocks) == 1 {
+		return blocks[0], nil
+	}
+
+	// The element is assembled from several blocks. A field of it is not: it is
+	// written in one block, or written in both and one of them wins, so a
+	// field-level change routes by the field's own location.
+	if block, ok := r.winningBlock(change.leaf); ok {
+		return block, nil
+	}
+
+	// The field has no source location: either it is absent from the config, or a
+	// mutator inserted it (e.g. OverrideCompute setting existing_cluster_id), which
+	// builds a fresh value carrying no location. Either way no block declares it, so
+	// writing it is an addition; it goes to the block declaring the resource rather
+	// than into a target-specific scope the user did not choose.
+	if !addressesWholeElement(change) {
+		return declaringBlock(blocks), nil
+	}
+
+	// A change addressing the element itself never reaches here: routeDestinations sends
+	// it to every defining block instead of asking for one.
+	return declaringBlock(blocks), nil
+}
+
+// declaringBlock relies on blocksOf and sortedBlocks ordering top-level first.
+func declaringBlock(blocks []sourceBlock) sourceBlock {
+	for _, block := range blocks {
+		if !block.override {
+			return block
+		}
+	}
+	return blocks[0]
+}
+
+// blockForNewElement chooses where an element that exists in no source block
+// should be written: the block that defines the sequence, or when several do, the
+// block that declares the resource. Adding to the resource's own block keeps a new
+// element out of a target-specific scope the user did not ask for.
+func (r *blockResolver) blockForNewElement(change resolvedChange) (sourceBlock, error) {
+	step := change.steps[len(change.steps)-1]
+
+	// A nested sequence is reached through the enclosing elements, which are
+	// already placed: route by the innermost one that exists in the source, since
+	// a new element belongs in the same block as its parent.
+	for i := len(change.steps) - 2; i >= 0; i-- {
+		enclosing := change.steps[i]
+		if enclosing.newElement {
+			continue
+		}
+		if blocks := r.blocksOf(enclosing.element); len(blocks) == 1 {
+			return blocks[0], nil
+		}
+	}
+
+	blocks := r.blocksDefiningSequence(change, step.sequencePath)
+	if len(blocks) == 0 {
+		return sourceBlock{}, fmt.Errorf("%w: no block defines the sequence receiving the new element", errAmbiguousBlock)
+	}
+	return declaringBlock(blocks), nil
+}
+
+// blocksDefiningSequence returns the blocks that write the sequence at sequencePath.
+// This is for a value that does not exist yet, where only the receiving sequence is
+// known; an existing value is traced through its own locations instead.
+func (r *blockResolver) blocksDefiningSequence(change resolvedChange, sequencePath dyn.Path) []sourceBlock {
+	var blocks []sourceBlock
+	for _, block := range r.sortedBlocks() {
+		blockPath, ok := r.sequencePathWithinBlock(block, change, sequencePath)
+		if !ok {
+			continue
+		}
+		sequence, err := dyn.GetByPath(r.blocks[block], r.regionPath(block, blockPath))
+		if err != nil {
+			continue
+		}
+		if slices.ContainsFunc(sequence.Locations(), func(l diag.Location) bool { return l.File == block.file }) {
+			blocks = append(blocks, block)
+		}
+	}
+	return blocks
+}
+
+// sequencePathWithinBlock rewrites sequencePath's enclosing indices from merged
+// positions to block's own, reporting false when an enclosing element is not in this
+// block. This is the one place merged indices become block-local ones.
+//
+// change.steps is ordered outermost first, so each translated index is already known
+// by the time a deeper step needs it.
+func (r *blockResolver) sequencePathWithinBlock(block sourceBlock, change resolvedChange, sequencePath dyn.Path) (dyn.Path, bool) {
+	result := slices.Clone(sequencePath)
+	for _, step := range change.steps {
+		at := len(step.sequencePath)
+		if step.newElement || at >= len(sequencePath) {
+			continue
+		}
+		// The step's own path is a prefix of sequencePath, so the indices translated
+		// so far already apply to it.
+		index, ok := r.indexWithinBlock(block, result[:at], step.element)
+		if !ok {
+			return nil, false
+		}
+		result[at] = dyn.Index(index)
+	}
+	return result, true
+}
+
+// pathWithinBlock rewrites a change's path so every sequence index addresses the
+// element's position inside block rather than its position in the merged list.
+func (r *blockResolver) pathWithinBlock(block sourceBlock, change resolvedChange) (*structpath.PatternNode, error) {
+	nodes := change.path.AsSlice()
+	indices := make([]int, len(change.steps))
+	for i, step := range change.steps {
+		if step.newElement {
+			// Keeps the [*] placeholder; the patcher appends to the block's
+			// sequence.
+			indices[i] = -1
+			continue
+		}
+		sequencePath, ok := r.sequencePathWithinBlock(block, change, step.sequencePath)
+		if !ok {
+			return nil, fmt.Errorf("%w: enclosing element has no position in %s", errAmbiguousBlock, block.file)
+		}
+		index, ok := r.indexWithinBlock(block, sequencePath, step.element)
+		if !ok {
+			return nil, fmt.Errorf("%w: element has no position in %s", errAmbiguousBlock, block.file)
+		}
+		indices[i] = index
+	}
+
+	var result *structpath.PatternNode
+	next := 0
+	for component, node := range nodes {
+		if next < len(change.steps) && change.steps[next].component == component {
+			if indices[next] < 0 {
+				result = structpath.NewPatternBracketStar(result)
+			} else {
+				result = structpath.NewPatternIndex(result, indices[next])
+			}
+			next++
+			continue
+		}
+		key, ok := node.StringKey()
+		if !ok {
+			return nil, fmt.Errorf("%w: unsupported path component in %s", errAmbiguousBlock, change.path.String())
+		}
+		result = structpath.NewPatternStringKey(result, key)
+	}
+	return result, nil
+}
+
+// sequenceStep records a sequence element that a change path navigated through.
+// The element's index inside a physical block is only known once the block has
+// been chosen, so the merged position is kept until then.
+type sequenceStep struct {
+	// component is how many path components precede this sequence's index.
+	component int
+	// sequencePath is the sequence itself, e.g. resources.jobs.j.tasks.
+	sequencePath dyn.Path
+	element      dyn.Value
+	// newElement marks an Add whose key is not in the merged sequence yet.
+	newElement bool
+}
+
+// scopedParent keys index bookkeeping by the sequence a path addresses, per block.
+func scopedParent(scope string, path *structpath.PatternNode) string {
+	return scope + path.Parent().String()
+}
+
+// indexTracker keeps the positions already spoken for while a resource's changes are
+// applied one after another: removing an element shifts everything after it, and adding
+// one can reuse a position a removal just freed. Keyed per block, so operations on one
+// block cannot move positions in another.
+type indexTracker struct {
+	// freed holds positions left by a removal, so an addition can reuse one instead of
+	// appending. That keeps a recreated element in place, which matters for a rename
+	// that could not be paired.
+	freed map[string][]int
+	// operations lets adjustArrayIndex shift a later index past earlier ones.
+	operations map[string][]struct {
+		index     int
+		operation OperationType
+	}
+}
+
+func newIndexTracker() *indexTracker {
+	return &indexTracker{
+		freed: map[string][]int{},
+		operations: map[string][]struct {
+			index     int
+			operation OperationType
+		}{},
+	}
+}
+
+// place accounts for earlier operations in the same block, and records this one for the
+// operations that follow.
+func (t *indexTracker) place(scope string, path *structpath.PatternNode, operation OperationType) *structpath.PatternNode {
+	parent := scopedParent(scope, path)
+	switch {
+	case operation == OperationRemove:
+		if freeIndex, ok := path.Index(); ok {
+			t.freed[parent] = append(t.freed[parent], freeIndex)
+		}
+	case operation == OperationAdd && path.BracketStar():
+		if reusable := t.freed[parent]; len(reusable) > 0 {
+			t.freed[parent] = reusable[1:]
+			path = structpath.NewPatternIndex(path.Parent(), reusable[0])
+		}
+	}
+
+	path = adjustArrayIndex(path, scope, t.operations)
+	if index, ok := path.Index(); ok {
+		key := scopedParent(scope, path)
+		t.operations[key] = append(t.operations[key], struct {
+			index     int
+			operation OperationType
+		}{index, operation})
+	}
+	return path
+}
diff --git a/bundle/configsync/telemetry.go b/bundle/configsync/telemetry.go
new file mode 100644
index 00000000000..9fd0afccc83
--- /dev/null
+++ b/bundle/configsync/telemetry.go
@@ -0,0 +1,301 @@
+package configsync
+
+import (
+	"context"
+	"slices"
+	"strings"
+
+	"github.com/databricks/cli/bundle/config/engine"
+	"github.com/databricks/cli/bundle/direct/dresources"
+	"github.com/databricks/cli/bundle/statemgmt"
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/structs/structpath"
+	"github.com/databricks/cli/libs/telemetry"
+	"github.com/databricks/cli/libs/telemetry/protos"
+)
+
+// recoverTelemetry swallows any panic raised while collecting or emitting
+// telemetry. Telemetry is best-effort and must never fail the command, so every
+// telemetry entry point that runs in the command path defers this.
+func recoverTelemetry(ctx context.Context) {
+	if r := recover(); r != nil {
+		log.Debugf(ctx, "config-remote-sync telemetry panicked and was skipped: %v", r)
+	}
+}
+
+// Stats accumulates aggregate counters for a single config-remote-sync run.
+// All values are counts, booleans, or enumerated categories; no resource
+// names, paths, or configuration values are ever recorded.
+type Stats struct {
+	Save   bool
+	Engine engine.EngineType
+
+	ChangesTotal int64
+	AddCount     int64
+	ReplaceCount int64
+	RemoveCount  int64
+
+	// Keyed by resource type (e.g. "jobs"), as parsed from change keys like
+	// "resources.jobs.foo".
+	PerResourceType map[string]*protos.BundleConfigRemoteSyncResourceChanges
+
+	RecreateForcingChanges int64
+	OverwrittenLocalEdits  int64
+
+	FilesChangedCount int64
+	FilesWrittenCount int64
+
+	// Changes that were detected and reported but not written back, because they
+	// could not be attributed to a single source location.
+	SkippedChangesCount int64
+
+	Restore RestoreStats
+
+	// Identity of the resource state the run actually read. Without these, a
+	// "no deployed <type> resource with id" failure cannot be told apart from
+	// reading a stale local cache, another target's state, or no state at all.
+	StateSerial  int64
+	StateLineage string
+	StateSource  string
+	// Pointer so the informative zero (no state file found at all) survives
+	// omitempty on serialization.
+	StatesAvailableCount *int64
+
+	// Resource ids present in the state that was read, and the ids the run was
+	// asked to sync. Comparing the two classifies a selector miss.
+	StateResourceIDs    *protos.BundleConfigRemoteSyncResourceIds
+	SelectedResourceIDs *protos.BundleConfigRemoteSyncResourceIds
+
+	ErrorMessage  string
+	ErrorCategory protos.BundleConfigRemoteSyncErrorCategory
+}
+
+// CollectStateStats records which resource state the run read. Only the
+// state's identity is recorded (serial, system-generated lineage UUID,
+// local/remote origin, candidate count) — never a path or a target name.
+//
+// None of these can contain PII: the lineage is an opaque random UUID minted by
+// the state layer, and the source is one of two fixed literals.
+// recordedVersion is the version the deployment metadata service holds, zero when the bundle does
+// not record deployment history. A recorded state file persists no serial of its own, so the
+// recorded version stands in for it and the field means the same thing for both backends.
+func (s *Stats) CollectStateStats(desc *statemgmt.StateDesc, recordedVersion int) {
+	if desc == nil {
+		return
+	}
+	s.StateSerial = int64(desc.Serial)
+	if recordedVersion > 0 {
+		s.StateSerial = int64(recordedVersion)
+	}
+	s.StateLineage = desc.Lineage
+	s.StateSource = "remote"
+	if desc.IsLocal {
+		s.StateSource = "local"
+	}
+	// AllStates is only populated when at least one state was found; a
+	// synthesized empty state descriptor leaves it nil.
+	n := int64(len(desc.AllStates))
+	s.StatesAvailableCount = &n
+}
+
+// RestoreStats counts the variable-reference restorations that can leak a
+// current-target-scoped reference into a shared file. The safe paths (kept /
+// compound-realigned) are not counted.
+type RestoreStats struct {
+	Retargeted   int64
+	FromSiblings int64
+}
+
+// incRetargeted and incFromSiblings are nil-safe so that threading the pointer
+// through the deep restoration recursion (or passing nil when counters are not
+// needed) can never panic the command.
+func (s *RestoreStats) incRetargeted() {
+	if s != nil {
+		s.Retargeted++
+	}
+}
+
+func (s *RestoreStats) incFromSiblings() {
+	if s != nil {
+		s.FromSiblings++
+	}
+}
+
+// CollectChangeStats fills change counters from the raw (pre-restoration)
+// detected changes.
+func (s *Stats) CollectChangeStats(ctx context.Context, changes Changes) {
+	defer recoverTelemetry(ctx)
+	if s.PerResourceType == nil {
+		s.PerResourceType = make(map[string]*protos.BundleConfigRemoteSyncResourceChanges)
+	}
+	for resourceKey, resourceChanges := range changes {
+		resourceType := resourceTypeFromKey(resourceKey)
+		perType := s.PerResourceType[resourceType]
+		if perType == nil {
+			perType = &protos.BundleConfigRemoteSyncResourceChanges{ResourceType: resourceType}
+			s.PerResourceType[resourceType] = perType
+		}
+		// Only Add/Replace/Remove reach this function: ExtractChanges filters
+		// out Skip operations and convertChangeDesc never produces Unknown,
+		// so the totals always equal the per-operation breakdown.
+		for fieldPath, change := range resourceChanges {
+			s.ChangesTotal++
+			perType.ChangesCount++
+			switch change.Operation {
+			case OperationAdd:
+				s.AddCount++
+				perType.AddCount++
+			case OperationReplace:
+				s.ReplaceCount++
+				perType.ReplaceCount++
+			case OperationRemove:
+				s.RemoveCount++
+				perType.RemoveCount++
+			case OperationUnknown, OperationSkip:
+			}
+			if isRecreateForcing(resourceType, fieldPath) {
+				s.RecreateForcingChanges++
+			}
+			if change.LocalEdit {
+				s.OverwrittenLocalEdits++
+			}
+		}
+	}
+}
+
+// isRecreateForcing reports whether a change to fieldPath on resourceType lands
+// on an immutable field (recreate_on_changes), meaning the next deploy will
+// delete+recreate the resource. It consults both the hand-written and the
+// spec-generated lifecycle configs, matching bundle plan behavior.
+func isRecreateForcing(resourceType, fieldPath string) bool {
+	node, err := structpath.ParsePath(fieldPath)
+	if err != nil {
+		return false
+	}
+	for _, cfg := range []*dresources.Config{dresources.MustLoadConfig(), dresources.MustLoadGeneratedConfig()} {
+		rc, ok := cfg.Resources[resourceType]
+		if !ok {
+			continue
+		}
+		for _, rule := range rc.RecreateOnChanges {
+			if node.HasPatternPrefix(rule.Field) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// resourceTypeFromKey extracts the resource type from a change key like
+// "resources.jobs.foo". Only the type segment is recorded; resource keys are
+// never logged.
+func resourceTypeFromKey(resourceKey string) string {
+	parts := strings.SplitN(resourceKey, ".", 3)
+	if len(parts) < 2 || parts[0] != "resources" {
+		return "unknown"
+	}
+	return parts[1]
+}
+
+// resourceIDLimit caps how many ids of one type are reported. Mirrors
+// phases.ResourceIdLimit: the telemetry upload has a short timeout, so a bundle
+// with very many resources must not produce an unbounded payload.
+const resourceIDLimit = 1000
+
+// collectResourceIDs groups "<type>:<id>" pairs into the per-type id lists.
+// Returns nil when nothing was collected so the field is omitted entirely.
+func collectResourceIDs(typeAndIDs []string) *protos.BundleConfigRemoteSyncResourceIds {
+	out := &protos.BundleConfigRemoteSyncResourceIds{}
+	any := false
+	for _, typeAndID := range typeAndIDs {
+		resourceType, id, ok := strings.Cut(typeAndID, ":")
+		if !ok || id == "" {
+			continue
+		}
+		// Sub-resources (permissions/grants) are indexed under their parent's
+		// type with a path-shaped object id; those are not selectable and the
+		// path would be redacted, so skip them.
+		if strings.Contains(id, "/") {
+			continue
+		}
+		switch resourceType {
+		case "jobs":
+			if len(out.ResourceJobIDs) < resourceIDLimit {
+				out.ResourceJobIDs = append(out.ResourceJobIDs, id)
+				any = true
+			}
+		case "pipelines":
+			if len(out.ResourcePipelineIDs) < resourceIDLimit {
+				out.ResourcePipelineIDs = append(out.ResourcePipelineIDs, id)
+				any = true
+			}
+		case "clusters":
+			if len(out.ResourceClusterIDs) < resourceIDLimit {
+				out.ResourceClusterIDs = append(out.ResourceClusterIDs, id)
+				any = true
+			}
+		case "dashboards":
+			if len(out.ResourceDashboardIDs) < resourceIDLimit {
+				out.ResourceDashboardIDs = append(out.ResourceDashboardIDs, id)
+				any = true
+			}
+		}
+	}
+	if !any {
+		return nil
+	}
+	slices.Sort(out.ResourceJobIDs)
+	slices.Sort(out.ResourcePipelineIDs)
+	slices.Sort(out.ResourceClusterIDs)
+	slices.Sort(out.ResourceDashboardIDs)
+	return out
+}
+
+// CollectSelectedIDs records the ids the run was asked to sync.
+func (s *Stats) CollectSelectedIDs(selectors []string) {
+	s.SelectedResourceIDs = collectResourceIDs(selectors)
+}
+
+// CollectStateIDs records the ids present in the state that was read.
+func (s *Stats) CollectStateIDs(typeAndIDs []string) {
+	s.StateResourceIDs = collectResourceIDs(typeAndIDs)
+}
+
+// LogTelemetry emits the BundleConfigRemoteSyncEvent for this run.
+func (s *Stats) LogTelemetry(ctx context.Context) {
+	defer recoverTelemetry(ctx)
+	resourceChanges := make([]protos.BundleConfigRemoteSyncResourceChanges, 0, len(s.PerResourceType))
+	for _, perType := range s.PerResourceType {
+		resourceChanges = append(resourceChanges, *perType)
+	}
+	slices.SortFunc(resourceChanges, func(a, b protos.BundleConfigRemoteSyncResourceChanges) int {
+		return strings.Compare(a.ResourceType, b.ResourceType)
+	})
+
+	telemetry.Log(ctx, protos.DatabricksCliLog{
+		BundleConfigRemoteSyncEvent: &protos.BundleConfigRemoteSyncEvent{
+			Save:                   s.Save,
+			Engine:                 string(s.Engine),
+			ChangesTotal:           s.ChangesTotal,
+			AddCount:               s.AddCount,
+			ReplaceCount:           s.ReplaceCount,
+			RemoveCount:            s.RemoveCount,
+			RecreateForcingChanges: s.RecreateForcingChanges,
+			OverwrittenLocalEdits:  s.OverwrittenLocalEdits,
+			ResourceChanges:        resourceChanges,
+			FilesChangedCount:      s.FilesChangedCount,
+			FilesWrittenCount:      s.FilesWrittenCount,
+			SkippedChangesCount:    s.SkippedChangesCount,
+			RefsRetargeted:         s.Restore.Retargeted,
+			RefsFromSiblings:       s.Restore.FromSiblings,
+			StateSerial:            s.StateSerial,
+			StateLineage:           s.StateLineage,
+			StateSource:            s.StateSource,
+			StatesAvailableCount:   s.StatesAvailableCount,
+			StateResourceIDs:       s.StateResourceIDs,
+			SelectedResourceIDs:    s.SelectedResourceIDs,
+			ErrorMessage:           s.ErrorMessage,
+			ErrorCategory:          s.ErrorCategory,
+		},
+	})
+}
diff --git a/bundle/configsync/telemetry_test.go b/bundle/configsync/telemetry_test.go
new file mode 100644
index 00000000000..d2a3da537f8
--- /dev/null
+++ b/bundle/configsync/telemetry_test.go
@@ -0,0 +1,108 @@
+package configsync
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/dyn"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestCollectChangeStats(t *testing.T) {
+	changes := Changes{
+		"resources.jobs.foo": {
+			"name":                   {Operation: OperationReplace, Value: "new name"},
+			"tasks[0].notebook_task": {Operation: OperationAdd, Value: map[string]any{"base_parameters": map[string]any{"p": "x"}}},
+			"timeout_seconds":        {Operation: OperationRemove},
+		},
+		"resources.jobs.bar": {
+			"name": {Operation: OperationReplace, Value: "other"},
+		},
+		"resources.dashboards.dash": {
+			"etag": {Operation: OperationAdd, Value: "123456"},
+		},
+		// pipelines.storage is recreate_on_changes (immutable); also mark it as
+		// overwriting a local edit.
+		"resources.pipelines.pipe": {
+			"storage": {Operation: OperationReplace, Value: "s3://new", LocalEdit: true},
+		},
+	}
+
+	var stats Stats
+	stats.CollectChangeStats(t.Context(), changes)
+
+	assert.Equal(t, int64(6), stats.ChangesTotal)
+	assert.Equal(t, int64(2), stats.AddCount)
+	assert.Equal(t, int64(3), stats.ReplaceCount)
+	assert.Equal(t, int64(1), stats.RemoveCount)
+	assert.Equal(t, int64(1), stats.RecreateForcingChanges)
+	assert.Equal(t, int64(1), stats.OverwrittenLocalEdits)
+
+	jobs := stats.PerResourceType["jobs"]
+	assert.Equal(t, int64(4), jobs.ChangesCount)
+	assert.Equal(t, int64(1), jobs.AddCount)
+	assert.Equal(t, int64(2), jobs.ReplaceCount)
+	assert.Equal(t, int64(1), jobs.RemoveCount)
+
+	dashboards := stats.PerResourceType["dashboards"]
+	assert.Equal(t, int64(1), dashboards.ChangesCount)
+	assert.Equal(t, int64(1), dashboards.AddCount)
+}
+
+func TestIsRecreateForcing(t *testing.T) {
+	assert.True(t, isRecreateForcing("pipelines", "storage"))
+	assert.False(t, isRecreateForcing("pipelines", "configuration"))
+	assert.False(t, isRecreateForcing("jobs", "name"))
+	assert.False(t, isRecreateForcing("unknown", "storage"))
+}
+
+func TestResourceTypeFromKey(t *testing.T) {
+	assert.Equal(t, "jobs", resourceTypeFromKey("resources.jobs.foo"))
+	assert.Equal(t, "dashboards", resourceTypeFromKey("resources.dashboards.a.b"))
+	assert.Equal(t, "unknown", resourceTypeFromKey("variables.foo"))
+	assert.Equal(t, "unknown", resourceTypeFromKey("resources"))
+}
+
+func TestRestoreStatsCounters(t *testing.T) {
+	resolved := dyn.V(map[string]dyn.Value{
+		"variables": dyn.V(map[string]dyn.Value{
+			"region": dyn.V(map[string]dyn.Value{"value": dyn.V("us-east-1")}),
+			"other":  dyn.V(map[string]dyn.Value{"value": dyn.V("eu-west-1")}),
+		}),
+	})
+
+	// Original pure ref still matching: restored but not counted (safe path).
+	var kept RestoreStats
+	result := restoreOriginalRefs("us-east-1", dyn.V("${var.region}"), resolved, &kept)
+	assert.Equal(t, "${var.region}", result)
+	assert.Equal(t, RestoreStats{}, kept)
+
+	// Pure ref whose value changed to another variable's value: re-targeted.
+	var retargeted RestoreStats
+	result = restoreOriginalRefs("eu-west-1", dyn.V("${var.region}"), resolved, &retargeted)
+	assert.Equal(t, "${var.other}", result)
+	assert.Equal(t, RestoreStats{Retargeted: 1}, retargeted)
+
+	// New sequence element leaf restored from a sibling reference.
+	siblings := []dyn.Value{
+		dyn.V(map[string]dyn.Value{"region": dyn.V("${var.region}")}),
+	}
+	var fromSiblings RestoreStats
+	resultMap := restoreFromSiblings(map[string]any{"region": "us-east-1"}, siblings, resolved, &fromSiblings).(map[string]any)
+	assert.Equal(t, "${var.region}", resultMap["region"])
+	assert.Equal(t, RestoreStats{FromSiblings: 1}, fromSiblings)
+
+	// Hardcoded value: nothing restored, nothing counted.
+	var none RestoreStats
+	result = restoreOriginalRefs("hardcoded", dyn.V("hardcoded"), resolved, &none)
+	assert.Equal(t, "hardcoded", result)
+	assert.Equal(t, RestoreStats{}, none)
+}
+
+func TestRestoreStatsCountersNilSafe(t *testing.T) {
+	// Telemetry must never panic the command: counting on a nil pointer is a no-op.
+	var s *RestoreStats
+	assert.NotPanics(t, func() {
+		s.incRetargeted()
+		s.incFromSiblings()
+	})
+}
diff --git a/bundle/configsync/variables.go b/bundle/configsync/variables.go
index e7bdff3696d..442224158f5 100644
--- a/bundle/configsync/variables.go
+++ b/bundle/configsync/variables.go
@@ -8,7 +8,7 @@ import (
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/bundle/config"
 	"github.com/databricks/cli/bundle/config/mutator"
-	"github.com/databricks/cli/bundle/direct/dstate"
+	"github.com/databricks/cli/bundle/config/mutator/resourcemutator"
 	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/cli/libs/dyn/dynvar"
 	"github.com/databricks/cli/libs/log"
@@ -45,14 +45,14 @@ var varPrefix = dyn.NewPath(dyn.Key("var"))
 // matches the leaf value. Non-sequence Adds (new map fields) are left
 // untouched.
 //
-// The pre-resolved config is obtained by re-loading the bundle from disk
-// through the standard loader mutators (entry point + includes + target
-// overrides) but skipping variable resolution. This gives a fully merged
-// view where ${var.X} and ${resources.X.Y.id} references are still literal
+// The caller supplies preResolved (see LoadPreResolvedConfig): the merged
+// config where ${var.X} and ${resources.X.Y.id} references are still literal
 // strings — enabling correct sibling lookup even for sequences split across
 // files via target overrides.
-func RestoreVariableReferences(ctx context.Context, b *bundle.Bundle, fieldChanges []FieldChange) error {
-	preResolved := loadPreResolvedConfig(ctx, b)
+// Restoration counts by mechanism are accumulated into stats (used for
+// telemetry); pass nil when counters are not needed (the counter methods are
+// nil-safe).
+func RestoreVariableReferences(ctx context.Context, b *bundle.Bundle, fieldChanges []FieldChange, preResolved dyn.Value, stats *RestoreStats) error {
 	if !preResolved.IsValid() {
 		return errors.New("pre-resolved config unavailable; variable-backed fields will be hardcoded")
 	}
@@ -78,7 +78,7 @@ func RestoreVariableReferences(ctx context.Context, b *bundle.Bundle, fieldChang
 	// no resource refs to avoid opening state DB files unnecessarily.
 	resourceRefs := collectResourceIDRefs(preResolved)
 	if len(resourceRefs) > 0 {
-		if lookup := resourceIDLookup(ctx, b); lookup != nil {
+		if lookup := resourceIDLookup(b); lookup != nil {
 			resolved = injectResourceIDs(ctx, resolved, resourceRefs, lookup)
 		} else {
 			log.Debugf(ctx, "variable restoration: state DB unavailable, skipping resource ID injection for %d refs", len(resourceRefs))
@@ -91,17 +91,17 @@ func RestoreVariableReferences(ctx context.Context, b *bundle.Bundle, fieldChang
 		var newValue any
 		switch fc.Change.Operation {
 		case OperationReplace:
-			fieldValue, ok := preResolvedValueAt(preResolved, fc.FieldCandidates)
+			fieldValue, ok := preResolvedValueAt(preResolved, fc.originalPath)
 			if !ok {
 				continue
 			}
-			newValue = restoreOriginalRefs(fc.Change.Value, fieldValue, resolved)
+			newValue = restoreOriginalRefs(fc.Change.Value, fieldValue, resolved, stats)
 		case OperationAdd:
-			siblings, ok := sequenceSiblings(preResolved, fc.FieldCandidates)
+			siblings, ok := sequenceSiblings(preResolved, fc.originalPath)
 			if !ok {
 				continue
 			}
-			newValue = restoreFromSiblings(fc.Change.Value, siblings, resolved)
+			newValue = restoreFromSiblings(fc.Change.Value, siblings, resolved, stats)
 		case OperationUnknown, OperationRemove, OperationSkip:
 			continue
 		}
@@ -114,12 +114,12 @@ func RestoreVariableReferences(ctx context.Context, b *bundle.Bundle, fieldChang
 	return nil
 }
 
-// loadPreResolvedConfig loads the bundle's configuration through the standard
+// LoadPreResolvedConfig loads the bundle's configuration through the standard
 // loader mutators (entry point, includes, target overrides) but without
 // variable resolution. The resulting dyn.Value is fully merged across files
 // and targets, yet retains ${...} references as literal strings. Returns
 // InvalidValue if loading fails (restoration is then skipped).
-func loadPreResolvedConfig(ctx context.Context, b *bundle.Bundle) dyn.Value {
+func LoadPreResolvedConfig(ctx context.Context, b *bundle.Bundle) dyn.Value {
 	fresh := &bundle.Bundle{
 		BundleRootPath: b.BundleRootPath,
 		BundleRoot:     b.BundleRoot,
@@ -130,25 +130,28 @@ func loadPreResolvedConfig(ctx context.Context, b *bundle.Bundle) dyn.Value {
 			bundle.ApplyContext(ctx, fresh, mutator.SelectTarget(target))
 		}
 	}
+
+	// Keyed sequences merge in the initialize phase, which this reload skips. Without
+	// them the sequences here stay in file order while the change paths address the
+	// merged, key-sorted order, so a lookup would read a different element.
+	bundle.ApplySeqContext(ctx, fresh,
+		resourcemutator.MergeJobClusters(),
+		resourcemutator.MergeJobParameters(),
+		resourcemutator.MergeJobTasks(),
+		resourcemutator.MergePipelineClusters(),
+		resourcemutator.MergeApps(),
+	)
 	return fresh.Config.Value()
 }
 
 // resourceIDLookup returns a function that resolves resource keys to their
-// deployed IDs from state. For the direct engine, the StateDB is already open
-// on b.DeploymentBundle. For the terraform engine, the config snapshot is
-// opened locally (it was downloaded by ensureSnapshotAvailable during
-// DetectChanges). Returns nil if no state is available.
-func resourceIDLookup(ctx context.Context, b *bundle.Bundle) func(string) string {
+// deployed IDs from the direct StateDB already open on b.DeploymentBundle.
+// Returns nil if no state is available.
+func resourceIDLookup(b *bundle.Bundle) func(string) string {
 	if b.DeploymentBundle.StateDB.Path != "" {
 		return b.DeploymentBundle.StateDB.GetResourceID
 	}
-	_, statePath := b.StateFilenameConfigSnapshot(ctx)
-	db := &dstate.DeploymentState{}
-	if err := db.Open(statePath); err != nil {
-		log.Debugf(ctx, "variable restoration: failed to open state DB at %s: %v", statePath, err)
-		return nil
-	}
-	return db.GetResourceID
+	return nil
 }
 
 // collectResourceIDRefs walks the pre-resolved merged config to find pure
@@ -231,7 +234,7 @@ func resolveReferencePath(refStr string) (dyn.Path, bool) {
 // new value, falls back to a global lookup: if the new value uniquely matches
 // a different variable, that variable is used instead. The field's prior use
 // of a variable is the false-positive guard.
-func restoreOriginalRefs(value any, preResolved, resolved dyn.Value) any {
+func restoreOriginalRefs(value any, preResolved, resolved dyn.Value, stats *RestoreStats) any {
 	switch v := value.(type) {
 	case string, bool, int64:
 		if ref, ok := matchOriginalRef(value, preResolved, resolved); ok {
@@ -244,6 +247,7 @@ func restoreOriginalRefs(value any, preResolved, resolved dyn.Value) any {
 		}
 		if isPureVarRef(preResolved) {
 			if ref, ok := matchAnyVariable(value, resolved); ok {
+				stats.incRetargeted()
 				return ref
 			}
 		}
@@ -258,7 +262,7 @@ func restoreOriginalRefs(value any, preResolved, resolved dyn.Value) any {
 					childPre = p.Value
 				}
 			}
-			v[key] = restoreOriginalRefs(val, childPre, resolved)
+			v[key] = restoreOriginalRefs(val, childPre, resolved, stats)
 		}
 		return v
 
@@ -269,7 +273,7 @@ func restoreOriginalRefs(value any, preResolved, resolved dyn.Value) any {
 			if i < len(preSeq) {
 				childPre = preSeq[i]
 			}
-			v[i] = restoreOriginalRefs(val, childPre, resolved)
+			v[i] = restoreOriginalRefs(val, childPre, resolved, stats)
 		}
 		return v
 
@@ -283,11 +287,11 @@ func restoreOriginalRefs(value any, preResolved, resolved dyn.Value) any {
 // relative path: if exactly one unique pure variable reference across siblings
 // resolves to the leaf value, that reference is substituted. Multiple
 // different matching references are treated as ambiguous and skipped.
-func restoreFromSiblings(value any, siblings []dyn.Value, resolved dyn.Value) any {
-	return restoreFromSiblingsAt(value, siblings, resolved, dyn.EmptyPath)
+func restoreFromSiblings(value any, siblings []dyn.Value, resolved dyn.Value, stats *RestoreStats) any {
+	return restoreFromSiblingsAt(value, siblings, resolved, dyn.EmptyPath, stats)
 }
 
-func restoreFromSiblingsAt(value any, siblings []dyn.Value, resolved dyn.Value, relPath dyn.Path) any {
+func restoreFromSiblingsAt(value any, siblings []dyn.Value, resolved dyn.Value, relPath dyn.Path, stats *RestoreStats) any {
 	switch v := value.(type) {
 	case string, bool, int64:
 		refs := map[string]struct{}{}
@@ -325,6 +329,7 @@ func restoreFromSiblingsAt(value any, siblings []dyn.Value, resolved dyn.Value,
 		}
 		if len(refs) == 1 {
 			for ref := range refs {
+				stats.incFromSiblings()
 				return ref
 			}
 		}
@@ -332,13 +337,13 @@ func restoreFromSiblingsAt(value any, siblings []dyn.Value, resolved dyn.Value,
 
 	case map[string]any:
 		for key, val := range v {
-			v[key] = restoreFromSiblingsAt(val, siblings, resolved, relPath.Append(dyn.Key(key)))
+			v[key] = restoreFromSiblingsAt(val, siblings, resolved, relPath.Append(dyn.Key(key)), stats)
 		}
 		return v
 
 	case []any:
 		for i, val := range v {
-			v[i] = restoreFromSiblingsAt(val, siblings, resolved, relPath.Append(dyn.Index(i)))
+			v[i] = restoreFromSiblingsAt(val, siblings, resolved, relPath.Append(dyn.Index(i)), stats)
 		}
 		return v
 
@@ -551,18 +556,38 @@ func parseTemplateSegments(template string, resolved dyn.Value) []templateSegmen
 
 // preResolvedValueAt returns the pre-resolved dyn.Value at the field path,
 // if the field exists in the merged pre-resolved config.
-func preResolvedValueAt(preResolved dyn.Value, candidates []string) (dyn.Value, bool) {
-	for _, candidate := range candidates {
-		p, err := dyn.NewPathFromString(candidate)
-		if err != nil {
-			continue
-		}
-		v, err := dyn.GetByPath(preResolved, p)
-		if err == nil {
-			return v, true
-		}
+func preResolvedValueAt(preResolved dyn.Value, fieldPath string) (dyn.Value, bool) {
+	p, err := dyn.NewPathFromString(fieldPath)
+	if err != nil {
+		return dyn.InvalidValue, false
+	}
+	v, err := dyn.GetByPath(preResolved, p)
+	if err != nil {
+		return dyn.InvalidValue, false
+	}
+	return v, true
+}
+
+// parentIsVariableReference reports whether the parent of fieldPath resolves to a
+// scalar variable reference in the pre-resolved config (e.g. spark_conf:
+// ${var.spark_conf}). A nested key or index cannot be written into such a scalar,
+// so config-remote-sync skips the change. fieldPath is a merged-index path, the
+// same space as FieldChange.originalPath.
+func parentIsVariableReference(preResolved dyn.Value, fieldPath string) bool {
+	node, err := structpath.ParsePattern(fieldPath)
+	if err != nil {
+		return false
+	}
+	parent := node.Parent()
+	if parent == nil {
+		return false
 	}
-	return dyn.InvalidValue, false
+	v, ok := preResolvedValueAt(preResolved, parent.String())
+	if !ok {
+		return false
+	}
+	s, ok := v.AsString()
+	return ok && dynvar.ContainsVariableReference(s)
 }
 
 // sequenceSiblings returns the sibling elements of the parent sequence when
@@ -570,29 +595,26 @@ func preResolvedValueAt(preResolved dyn.Value, candidates []string) (dyn.Value,
 // last component must be an index ([*] or [N]) and the parent must resolve
 // to a sequence in the pre-resolved config. Returns false for non-sequence
 // Adds (e.g., new map fields).
-func sequenceSiblings(preResolved dyn.Value, candidates []string) ([]dyn.Value, bool) {
-	for _, candidate := range candidates {
-		node, err := structpath.ParsePattern(candidate)
-		if err != nil {
-			continue
-		}
-		_, hasIndex := node.Index()
-		if !hasIndex && !node.BracketStar() {
-			continue
-		}
-		p, err := dyn.NewPathFromString(node.Parent().String())
-		if err != nil {
-			continue
-		}
-		parentValue, err := dyn.GetByPath(preResolved, p)
-		if err != nil {
-			continue
-		}
-		seq, ok := parentValue.AsSequence()
-		if !ok {
-			continue
-		}
-		return seq, true
+func sequenceSiblings(preResolved dyn.Value, fieldPath string) ([]dyn.Value, bool) {
+	node, err := structpath.ParsePattern(fieldPath)
+	if err != nil {
+		return nil, false
+	}
+	_, hasIndex := node.Index()
+	if !hasIndex && !node.BracketStar() {
+		return nil, false
+	}
+	p, err := dyn.NewPathFromString(node.Parent().String())
+	if err != nil {
+		return nil, false
+	}
+	parentValue, err := dyn.GetByPath(preResolved, p)
+	if err != nil {
+		return nil, false
+	}
+	seq, ok := parentValue.AsSequence()
+	if !ok {
+		return nil, false
 	}
-	return nil, false
+	return seq, true
 }
diff --git a/bundle/configsync/variables_test.go b/bundle/configsync/variables_test.go
index 9dd94c0cfb7..15f11d5eb3c 100644
--- a/bundle/configsync/variables_test.go
+++ b/bundle/configsync/variables_test.go
@@ -19,7 +19,7 @@ func TestRestoreOriginalRefs_HardcodedFieldNotRewritten(t *testing.T) {
 	})
 	// Even though "main" matches ${var.region}, restoreOriginalRefs must NOT
 	// rewrite it — the original was hardcoded.
-	result := restoreOriginalRefs("main", preResolved, resolved)
+	result := restoreOriginalRefs("main", preResolved, resolved, &RestoreStats{})
 	assert.Equal(t, "main", result)
 }
 
@@ -44,7 +44,7 @@ func TestRestoreFromSiblings_ValueMatchesVariableButDifferentPath(t *testing.T)
 		"task_key":           "other",
 		"min_retry_interval": int64(5),
 	}
-	result := restoreFromSiblings(value, siblings, resolved).(map[string]any)
+	result := restoreFromSiblings(value, siblings, resolved, &RestoreStats{}).(map[string]any)
 	assert.Equal(t, "other", result["task_key"])
 	assert.Equal(t, int64(5), result["min_retry_interval"])
 }
@@ -64,7 +64,7 @@ func TestRestoreFromSiblings_AmbiguousAcrossSiblings(t *testing.T) {
 		}),
 	})
 	value := map[string]any{"default": "raw_data"}
-	result := restoreFromSiblings(value, siblings, resolved).(map[string]any)
+	result := restoreFromSiblings(value, siblings, resolved, &RestoreStats{}).(map[string]any)
 	assert.Equal(t, "raw_data", result["default"])
 }
 
@@ -108,7 +108,7 @@ func TestRestoreCompoundInterpolation(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			result := restoreOriginalRefs(tt.remote, dyn.V(tt.template), resolved)
+			result := restoreOriginalRefs(tt.remote, dyn.V(tt.template), resolved, &RestoreStats{})
 			assert.Equal(t, tt.want, result)
 		})
 	}
diff --git a/bundle/context.go b/bundle/context.go
index 3e6ed751c5f..efd04162374 100644
--- a/bundle/context.go
+++ b/bundle/context.go
@@ -7,12 +7,6 @@ import (
 // Placeholder to use as unique key in context.Context.
 var bundleKey int
 
-// Context stores the specified bundle on a new context.
-// The bundle is available through the `Get()` function.
-func Context(ctx context.Context, b *Bundle) context.Context {
-	return context.WithValue(ctx, &bundleKey, b)
-}
-
 // GetOrNil returns the bundle as configured on the context.
 // It returns nil if it isn't configured.
 func GetOrNil(ctx context.Context) *Bundle {
@@ -22,13 +16,3 @@ func GetOrNil(ctx context.Context) *Bundle {
 	}
 	return bundle
 }
-
-// Get returns the bundle as configured on the context.
-// It panics if it isn't configured.
-func Get(ctx context.Context) *Bundle {
-	b := GetOrNil(ctx)
-	if b == nil {
-		panic("context not configured with bundle")
-	}
-	return b
-}
diff --git a/bundle/context_test.go b/bundle/context_test.go
index 40dfa1b7d15..9b16772854e 100644
--- a/bundle/context_test.go
+++ b/bundle/context_test.go
@@ -4,20 +4,8 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
-func TestGetPanics(t *testing.T) {
-	defer func() {
-		r := recover()
-		require.NotNil(t, r, "The function did not panic")
-		assert.Equal(t, "context not configured with bundle", r)
-	}()
-
-	Get(t.Context())
-}
-
-func TestGetSuccess(t *testing.T) {
-	ctx := Context(t.Context(), &Bundle{})
-	require.NotNil(t, Get(ctx))
+func TestGetOrNilReturnsNilWhenUnset(t *testing.T) {
+	assert.Nil(t, GetOrNil(t.Context()))
 }
diff --git a/bundle/deploy/check_dashboards_modified_remotely.go b/bundle/deploy/check_dashboards_modified_remotely.go
new file mode 100644
index 00000000000..d685f7ebeb6
--- /dev/null
+++ b/bundle/deploy/check_dashboards_modified_remotely.go
@@ -0,0 +1,122 @@
+package deploy
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/libs/agent"
+	"github.com/databricks/cli/libs/diag"
+	"github.com/databricks/cli/libs/structs/structpath"
+)
+
+type dashboardState struct {
+	Name string
+	ID   string
+	ETag string
+}
+
+func collectDashboardsFromState(ctx context.Context, b *bundle.Bundle) []dashboardState {
+	state := b.DeploymentBundle.ExportState(ctx)
+
+	var dashboards []dashboardState
+	for resourceKey, instance := range state {
+		// Check if this is a dashboard resource key
+		if !strings.HasPrefix(resourceKey, "resources.dashboards.") {
+			continue
+		}
+		// Extract dashboard name from "resources.dashboards.name"
+		parts := strings.Split(resourceKey, ".")
+		if len(parts) != 3 {
+			continue
+		}
+		resourceName := parts[2]
+
+		dashboards = append(dashboards, dashboardState{
+			Name: resourceName,
+			ID:   instance.ID,
+			ETag: instance.ETag,
+		})
+	}
+
+	return dashboards
+}
+
+type checkDashboardsModifiedRemotely struct {
+	isPlan bool
+}
+
+func (l *checkDashboardsModifiedRemotely) Name() string {
+	return "CheckDashboardsModifiedRemotely"
+}
+
+func (l *checkDashboardsModifiedRemotely) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
+	// This mutator is relevant only if the bundle includes dashboards.
+	if len(b.Config.Resources.Dashboards) == 0 {
+		return nil
+	}
+
+	// If the user has forced the deployment, skip this check.
+	if b.Config.Bundle.Force {
+		return nil
+	}
+
+	dashboards := collectDashboardsFromState(ctx, b)
+
+	var diags diag.Diagnostics
+	for _, dashboard := range dashboards {
+		// Skip dashboards that are not defined in the bundle.
+		// These will be destroyed upon deployment.
+		if _, ok := b.Config.Resources.Dashboards[dashboard.Name]; !ok {
+			continue
+		}
+
+		path := structpath.NewPath(nil, "resources", "dashboards", dashboard.Name)
+		loc := b.Config.GetLocationOf(path)
+		actual, err := b.WorkspaceClient(ctx).Lakeview.GetByDashboardId(ctx, dashboard.ID)
+		if err != nil {
+			diags = diags.Append(diag.Diagnostic{
+				Severity:  diag.Error,
+				Summary:   fmt.Sprintf("failed to get dashboard %q", dashboard.Name),
+				Detail:    err.Error(),
+				Paths:     []*structpath.PathNode{path},
+				Locations: []diag.Location{loc},
+			})
+			continue
+		}
+
+		// If the ETag is the same, the dashboard has not been modified.
+		if actual.Etag == dashboard.ETag {
+			continue
+		}
+
+		// Downgrade this to a warning in plan mode.
+		severity := diag.Error
+		if l.isPlan {
+			severity = diag.Warning
+		}
+
+		diags = diags.Append(diag.Diagnostic{
+			Severity: severity,
+			Summary:  fmt.Sprintf("dashboard %q has been modified remotely", dashboard.Name),
+			Detail: "" +
+				"This dashboard has been modified remotely since the last bundle deployment.\n" +
+				"These modifications are untracked and will be overwritten on deploy.\n" +
+				"\n" +
+				"Make sure that the local dashboard definition matches what you intend to deploy\n" +
+				"before proceeding with the deployment.\n" +
+				"\n" +
+				"To overwrite the remote changes with your local version, use --force.\n" +
+				"The remote modifications will be lost." + agent.AgentNotice(),
+			Paths:     []*structpath.PathNode{path},
+			Locations: []diag.Location{loc},
+		})
+	}
+
+	return diags
+}
+
+func CheckDashboardsModifiedRemotely(isPlan bool) *checkDashboardsModifiedRemotely {
+	return &checkDashboardsModifiedRemotely{isPlan: isPlan}
+}
diff --git a/bundle/deploy/check_dashboards_modified_remotely_test.go b/bundle/deploy/check_dashboards_modified_remotely_test.go
new file mode 100644
index 00000000000..797fff59669
--- /dev/null
+++ b/bundle/deploy/check_dashboards_modified_remotely_test.go
@@ -0,0 +1,173 @@
+package deploy
+
+import (
+	"encoding/json"
+	"errors"
+	"path/filepath"
+	"testing"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/cli/bundle/direct/dstate"
+	"github.com/databricks/cli/libs/diag"
+	"github.com/databricks/databricks-sdk-go/experimental/mocks"
+	"github.com/databricks/databricks-sdk-go/service/dashboards"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+)
+
+func mockDashboardBundle(t *testing.T) *bundle.Bundle {
+	dir := t.TempDir()
+	b := &bundle.Bundle{
+		BundleRootPath: dir,
+		Config: config.Root{
+			Bundle: config.Bundle{
+				Target: "test",
+			},
+			Resources: config.Resources{
+				Dashboards: map[string]*resources.Dashboard{
+					"dash1": {
+						DashboardConfig: resources.DashboardConfig{
+							DisplayName: "My Special Dashboard",
+						},
+					},
+				},
+			},
+		},
+	}
+	return b
+}
+
+func TestCheckDashboardsModifiedRemotely_NoDashboards(t *testing.T) {
+	dir := t.TempDir()
+	b := &bundle.Bundle{
+		BundleRootPath: dir,
+		Config: config.Root{
+			Bundle: config.Bundle{
+				Target: "test",
+			},
+			Resources: config.Resources{},
+		},
+	}
+
+	diags := bundle.Apply(t.Context(), b, CheckDashboardsModifiedRemotely(false))
+	assert.Empty(t, diags)
+}
+
+func TestCheckDashboardsModifiedRemotely_FirstDeployment(t *testing.T) {
+	b := mockDashboardBundle(t)
+	openDashboardState(t, b, dstate.NewDatabase("lineage", 1))
+	diags := bundle.Apply(t.Context(), b, CheckDashboardsModifiedRemotely(false))
+	assert.Empty(t, diags)
+}
+
+func TestCheckDashboardsModifiedRemotely_ExistingStateNoChange(t *testing.T) {
+	ctx := t.Context()
+
+	b := mockDashboardBundle(t)
+	writeFakeDashboardState(t, b)
+
+	// Mock the call to the API.
+	m := mocks.NewMockWorkspaceClient(t)
+	dashboardsAPI := m.GetMockLakeviewAPI()
+	dashboardsAPI.EXPECT().
+		GetByDashboardId(mock.Anything, "id1").
+		Return(&dashboards.Dashboard{
+			DisplayName: "My Special Dashboard",
+			Etag:        "1000",
+		}, nil).
+		Once()
+	b.SetWorkpaceClient(m.WorkspaceClient)
+
+	// No changes, so no diags.
+	diags := bundle.Apply(ctx, b, CheckDashboardsModifiedRemotely(false))
+	assert.Empty(t, diags)
+}
+
+func TestCheckDashboardsModifiedRemotely_ExistingStateChange(t *testing.T) {
+	ctx := t.Context()
+
+	b := mockDashboardBundle(t)
+	writeFakeDashboardState(t, b)
+
+	// Mock the call to the API.
+	m := mocks.NewMockWorkspaceClient(t)
+	dashboardsAPI := m.GetMockLakeviewAPI()
+	dashboardsAPI.EXPECT().
+		GetByDashboardId(mock.Anything, "id1").
+		Return(&dashboards.Dashboard{
+			DisplayName: "My Special Dashboard",
+			Etag:        "1234",
+		}, nil).
+		Once()
+	b.SetWorkpaceClient(m.WorkspaceClient)
+
+	// The dashboard has changed, so expect an error.
+	diags := bundle.Apply(ctx, b, CheckDashboardsModifiedRemotely(false))
+	if assert.Len(t, diags, 1) {
+		assert.Equal(t, diag.Error, diags[0].Severity)
+		assert.Equal(t, `dashboard "dash1" has been modified remotely`, diags[0].Summary)
+	}
+}
+
+func TestCheckDashboardsModifiedRemotely_ExistingStateFailureToGet(t *testing.T) {
+	ctx := t.Context()
+
+	b := mockDashboardBundle(t)
+	writeFakeDashboardState(t, b)
+
+	// Mock the call to the API.
+	m := mocks.NewMockWorkspaceClient(t)
+	dashboardsAPI := m.GetMockLakeviewAPI()
+	dashboardsAPI.EXPECT().
+		GetByDashboardId(mock.Anything, "id1").
+		Return(nil, errors.New("failure")).
+		Once()
+	b.SetWorkpaceClient(m.WorkspaceClient)
+
+	// Unable to get the dashboard, so expect an error.
+	diags := bundle.Apply(ctx, b, CheckDashboardsModifiedRemotely(false))
+	if assert.Len(t, diags, 1) {
+		assert.Equal(t, diag.Error, diags[0].Severity)
+		assert.Equal(t, `failed to get dashboard "dash1"`, diags[0].Summary)
+	}
+}
+
+func TestCheckDashboardsModifiedRemotely_ExistingStateChangePlanMode(t *testing.T) {
+	ctx := t.Context()
+
+	b := mockDashboardBundle(t)
+	writeFakeDashboardState(t, b)
+
+	// Mock the call to the API.
+	m := mocks.NewMockWorkspaceClient(t)
+	dashboardsAPI := m.GetMockLakeviewAPI()
+	dashboardsAPI.EXPECT().
+		GetByDashboardId(mock.Anything, "id1").
+		Return(&dashboards.Dashboard{
+			DisplayName: "My Special Dashboard",
+			Etag:        "1234",
+		}, nil).
+		Once()
+	b.SetWorkpaceClient(m.WorkspaceClient)
+
+	// The dashboard has changed, but in plan mode expect a warning instead of an error.
+	diags := bundle.Apply(ctx, b, CheckDashboardsModifiedRemotely(true))
+	if assert.Len(t, diags, 1) {
+		assert.Equal(t, diag.Warning, diags[0].Severity)
+		assert.Equal(t, `dashboard "dash1" has been modified remotely`, diags[0].Summary)
+	}
+}
+
+func openDashboardState(t *testing.T, b *bundle.Bundle, data dstate.Database) {
+	b.DeploymentBundle.StateDB.OpenWithData(filepath.Join(t.TempDir(), "resources.json"), data)
+}
+
+func writeFakeDashboardState(t *testing.T, b *bundle.Bundle) {
+	data := dstate.NewDatabase("lineage", 1)
+	data.State["resources.dashboards.dash1"] = dstate.ResourceEntry{ID: "id1", State: json.RawMessage(`{"etag": "1000"}`)}
+	data.State["resources.jobs.job"] = dstate.ResourceEntry{ID: "1234", State: json.RawMessage(`{}`)}
+	data.State["resources.dashboards.dash2"] = dstate.ResourceEntry{ID: "id2", State: json.RawMessage(`{"etag": "1001"}`)}
+	openDashboardState(t, b, data)
+}
diff --git a/bundle/deploy/filer.go b/bundle/deploy/filer.go
index a6b36f8d04e..bd1171ed3e7 100644
--- a/bundle/deploy/filer.go
+++ b/bundle/deploy/filer.go
@@ -1,18 +1,17 @@
 package deploy
 
 import (
-	"bytes"
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"io/fs"
-	"net/http"
-	"net/url"
-	"strings"
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/libs/filer"
-	"github.com/databricks/databricks-sdk-go/client"
+	"github.com/databricks/cli/libs/retry"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/apierr"
 )
 
 // FilerFactory is a function that returns a filer.Filer.
@@ -21,21 +20,8 @@ type FilerFactory func(ctx context.Context, b *bundle.Bundle) (filer.Filer, erro
 type stateFiler struct {
 	filer filer.Filer
 
-	apiClient *client.DatabricksClient
-	root      filer.WorkspaceRootPath
-}
-
-// orgIDHeaders returns headers with X-Databricks-Org-Id set if a workspace ID
-// is configured. SPOG hosts require this header to route requests to the
-// correct workspace.
-func (s stateFiler) orgIDHeaders() map[string]string {
-	wsID := s.apiClient.Config.WorkspaceID
-	if wsID == "" {
-		return nil
-	}
-	return map[string]string{
-		"X-Databricks-Org-Id": wsID,
-	}
+	workspaceClient *databricks.WorkspaceClient
+	root            filer.WorkspaceRootPath
 }
 
 func (s stateFiler) Delete(ctx context.Context, path string, mode ...filer.DeleteMode) error {
@@ -53,22 +39,17 @@ func (s stateFiler) Read(ctx context.Context, path string) (io.ReadCloser, error
 		return nil, err
 	}
 
-	stat, err := s.Stat(ctx, path)
-	if err != nil {
-		return nil, err
-	}
-	if stat.IsDir() {
-		return nil, fmt.Errorf("not a file: %s", absPath)
-	}
-
-	var buf bytes.Buffer
-	urlPath := "/api/2.0/workspace-files/" + url.PathEscape(strings.TrimLeft(absPath, "/"))
-	err = s.apiClient.Do(ctx, http.MethodGet, urlPath, s.orgIDHeaders(), nil, nil, &buf)
-	if err != nil {
-		return nil, err
+	// Stream via the SDK's /workspace/export (direct_download=true); no 10 MB cap.
+	// No get-status first: a missing file is the common first-deploy case and export's 404
+	// reports it in one round trip. A directory at a state path is not a state file; its
+	// export fails to parse as one.
+	r, err := retry.With(ctx, retry.IsTransientRead, func() (io.ReadCloser, error) {
+		return s.workspaceClient.Workspace.Download(ctx, absPath)
+	})
+	if errors.Is(err, apierr.ErrNotFound) {
+		return nil, fmt.Errorf("file does not exist: %s: %w", absPath, fs.ErrNotExist)
 	}
-
-	return io.NopCloser(&buf), nil
+	return r, err
 }
 
 func (s stateFiler) ReadDir(ctx context.Context, path string) ([]fs.DirEntry, error) {
@@ -84,24 +65,19 @@ func (s stateFiler) Write(ctx context.Context, path string, reader io.Reader, mo
 }
 
 // StateFiler returns a filer.Filer that can be used to read/write state files.
-// We use a custom workspace filer which uses workspace-files API to read state files.
-// This API has a higher than 10 MB limits and allows to export large state files.
-// We don't use the same API for read because it doesn't correct get the file content for notebooks and returns
-// "File Not Found" error instead.
+// Reads use the streaming /workspace/export API, which is officially supported,
+// scoped, and streams state files well beyond the 10 MB JSON export limit.
 func StateFiler(ctx context.Context, b *bundle.Bundle) (filer.Filer, error) {
-	f, err := filer.NewWorkspaceFilesClient(b.WorkspaceClient(ctx), b.Config.Workspace.StatePath)
-	if err != nil {
-		return nil, err
-	}
+	w := b.WorkspaceClient(ctx)
 
-	apiClient, err := client.New(b.WorkspaceClient(ctx).Config)
+	f, err := filer.NewWorkspaceFilesClient(w, b.Config.Workspace.StatePath)
 	if err != nil {
-		return nil, fmt.Errorf("failed to create API client: %w", err)
+		return nil, err
 	}
 
 	return stateFiler{
-		filer:     f,
-		root:      filer.NewWorkspaceRootPath(b.Config.Workspace.StatePath),
-		apiClient: apiClient,
+		filer:           retry.Filer(f),
+		root:            filer.NewWorkspaceRootPath(b.Config.Workspace.StatePath),
+		workspaceClient: w,
 	}, nil
 }
diff --git a/bundle/deploy/files/delete.go b/bundle/deploy/files/delete.go
index 921a4d2f31e..48eaf149d1c 100644
--- a/bundle/deploy/files/delete.go
+++ b/bundle/deploy/files/delete.go
@@ -6,10 +6,11 @@ import (
 	"fmt"
 	"io/fs"
 	"os"
+	"path"
 
 	"github.com/databricks/cli/bundle"
-	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/diag"
+	"github.com/databricks/cli/libs/log"
 	"github.com/databricks/cli/libs/sync"
 	"github.com/databricks/databricks-sdk-go/service/workspace"
 )
@@ -21,9 +22,7 @@ func (m *delete) Name() string {
 }
 
 func (m *delete) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
-	cmdio.LogString(ctx, "Deleting files...")
-
-	err := b.WorkspaceClient(ctx).Workspace.Delete(ctx, workspace.Delete{ //nolint:staticcheck // Deprecated in SDK v0.127.0. Migration to WorkspaceHierarchyService tracked separately.
+	err := b.WorkspaceClient(ctx).Workspace.Delete(ctx, workspace.Delete{
 		Path:      b.Config.Workspace.RootPath,
 		Recursive: true,
 	})
@@ -31,6 +30,8 @@ func (m *delete) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
 		return diag.FromErr(err)
 	}
 
+	removeBundleNameDir(ctx, b)
+
 	// Clean up sync snapshot file
 	err = deleteSnapshotFile(ctx, b)
 	if err != nil {
@@ -39,6 +40,21 @@ func (m *delete) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
 	return nil
 }
 
+// removeBundleNameDir removes the directory named after the bundle now that the
+// deployment under it is gone. Not recursive, so it fails harmlessly while another
+// target is still deployed there.
+func removeBundleNameDir(ctx context.Context, b *bundle.Bundle) {
+	if !b.RootPathIsNameTargetScoped {
+		return
+	}
+
+	dir := path.Dir(b.Config.Workspace.RootPath)
+	err := b.WorkspaceClient(ctx).Workspace.Delete(ctx, workspace.Delete{Path: dir})
+	if err != nil {
+		log.Infof(ctx, "Leaving %s in place: %s", dir, err)
+	}
+}
+
 func deleteSnapshotFile(ctx context.Context, b *bundle.Bundle) error {
 	opts, err := GetSyncOptions(ctx, b)
 	if err != nil {
@@ -50,7 +66,7 @@ func deleteSnapshotFile(ctx context.Context, b *bundle.Bundle) error {
 	}
 	err = os.Remove(sp)
 	if err != nil && !errors.Is(err, fs.ErrNotExist) {
-		return fmt.Errorf("failed to destroy sync snapshot file: %s", err)
+		return fmt.Errorf("failed to destroy sync snapshot file: %w", err)
 	}
 	return nil
 }
diff --git a/bundle/deploy/files/sync.go b/bundle/deploy/files/sync.go
index 90f44a98d8b..152df0f3692 100644
--- a/bundle/deploy/files/sync.go
+++ b/bundle/deploy/files/sync.go
@@ -8,6 +8,8 @@ import (
 	"github.com/databricks/cli/libs/sync"
 )
 
+// GetSync returns a new sync instance for the given bundle.
+// The sync instance will be in no validate remote path mode because it's only used to validate files to sync.
 func GetSync(ctx context.Context, b *bundle.Bundle) (*sync.Sync, error) {
 	opts, err := GetSyncOptions(ctx, b)
 	if err != nil {
@@ -16,6 +18,18 @@ func GetSync(ctx context.Context, b *bundle.Bundle) (*sync.Sync, error) {
 	return sync.New(ctx, *opts)
 }
 
+// GetNoValidateSync returns a new sync instance for the given bundle.
+// The sync instance will be in no validate remote path mode.
+// This is used when the remote path is not known at bundle configuration validation time (e.g. immutable folder).
+func GetNoValidateSync(ctx context.Context, b *bundle.Bundle) (*sync.Sync, error) {
+	opts, err := GetSyncOptions(ctx, b)
+	if err != nil {
+		return nil, fmt.Errorf("cannot get sync options: %w", err)
+	}
+	opts.NoValidateRemotePath = true
+	return sync.New(ctx, *opts)
+}
+
 func GetSyncOptions(ctx context.Context, b *bundle.Bundle) (*sync.SyncOptions, error) {
 	cacheDir, err := b.LocalStateDir(ctx)
 	if err != nil {
diff --git a/bundle/deploy/files/upload.go b/bundle/deploy/files/upload.go
index bb46c97c999..a74876ba4d1 100644
--- a/bundle/deploy/files/upload.go
+++ b/bundle/deploy/files/upload.go
@@ -25,11 +25,11 @@ func (m *upload) Name() string {
 
 func (m *upload) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
 	if config.IsExplicitlyEnabled(b.Config.Presets.SourceLinkedDeployment) {
-		cmdio.LogString(ctx, "Source-linked deployment is enabled. Deployed resources reference the source files in your working tree instead of separate copies.")
+		cmdio.LogProgress(ctx, "Source-linked deployment is enabled. Deployed resources reference the source files in your working tree instead of separate copies.")
 		return nil
 	}
 
-	cmdio.LogString(ctx, fmt.Sprintf("Uploading bundle files to %s...", b.Config.Workspace.FilePath))
+	cmdio.LogProgress(ctx, fmt.Sprintf("Uploading bundle files to %s...", b.Config.Workspace.FilePath))
 	opts, err := GetSyncOptions(ctx, b)
 	if err != nil {
 		return diag.FromErr(err)
@@ -49,6 +49,7 @@ func (m *upload) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
 		}
 		return diag.FromErr(err)
 	}
+	b.FileCounts = sync.FileCounts()
 
 	log.Infof(ctx, "Uploaded bundle files")
 	return nil
diff --git a/bundle/deploy/lock/acquire.go b/bundle/deploy/lock/acquire.go
index 6e4844ca5ff..bf8b91212dd 100644
--- a/bundle/deploy/lock/acquire.go
+++ b/bundle/deploy/lock/acquire.go
@@ -10,12 +10,20 @@ import (
 	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/locker"
 	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/databricks-sdk-go/apierr"
 )
 
-type acquire struct{}
+// maxChildNodeSizeExceeded is the error_code the Workspace API returns (as a 403)
+// when a directory is at its child-node limit and cannot accept a new child.
+// The SDK has no sentinel for it, so we match on the code directly.
+const maxChildNodeSizeExceeded = "MAX_CHILD_NODE_SIZE_EXCEEDED"
 
-func Acquire() bundle.Mutator {
-	return &acquire{}
+type acquire struct {
+	goal Goal
+}
+
+func Acquire(goal Goal) bundle.Mutator {
+	return &acquire{goal}
 }
 
 func (m *acquire) Name() string {
@@ -50,6 +58,19 @@ func (m *acquire) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics
 	log.Infof(ctx, "Acquiring deployment lock (force: %v)", force)
 	err = b.Locker.Lock(ctx, force)
 	if err != nil {
+		// When destroying with --force-lock, tolerate a full workspace directory
+		// that cannot accept the lock file: proceeding lock-less carries the same
+		// caveat --force-lock already documents (no guaranteed exclusive access),
+		// which is acceptable when the goal is to tear the deployment down.
+		// This check must precede the fs.ErrPermission branch below because the API
+		// reports the child-node limit as a 403, which the filer maps to that error.
+		if m.goal == GoalDestroy && force {
+			if aerr, ok := errors.AsType[*apierr.APIError](err); ok && aerr.ErrorCode == maxChildNodeSizeExceeded {
+				log.Warnf(ctx, "Proceeding with destroy without a deployment lock: %v", err)
+				return nil
+			}
+		}
+
 		log.Errorf(ctx, "Failed to acquire deployment lock: %v", err)
 
 		if errors.Is(err, fs.ErrPermission) {
diff --git a/bundle/deploy/lock/release.go b/bundle/deploy/lock/release.go
index 26f95edfc95..7c8eef10e99 100644
--- a/bundle/deploy/lock/release.go
+++ b/bundle/deploy/lock/release.go
@@ -51,6 +51,12 @@ func (m *release) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics
 	case GoalBind, GoalUnbind:
 		return diag.FromErr(b.Locker.Unlock(ctx))
 	case GoalDestroy:
+		// Destroy may have proceeded without acquiring a lock (see lock.Acquire:
+		// --force-lock tolerates a workspace directory at its child-node limit).
+		// There is nothing to release in that case.
+		if !b.Locker.Active {
+			return nil
+		}
 		return diag.FromErr(b.Locker.Unlock(ctx, locker.AllowLockFileNotExist))
 	default:
 		return diag.Errorf("unknown goal for lock release: %s", m.goal)
diff --git a/bundle/deploy/metadata/annotate_deployment_version.go b/bundle/deploy/metadata/annotate_deployment_version.go
new file mode 100644
index 00000000000..8a77250a3c4
--- /dev/null
+++ b/bundle/deploy/metadata/annotate_deployment_version.go
@@ -0,0 +1,65 @@
+package metadata
+
+import (
+	"context"
+	"strconv"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/libs/diag"
+)
+
+type annotateDeployment struct {
+	deploymentID string
+}
+
+// AnnotateDeployment stamps the DMS deployment onto every job and pipeline, so a workspace
+// resource points back at the deployment that produced it - how lineage resolves a job to its
+// bundle. It runs before the plan, or the stamp would show as drift against local config.
+func AnnotateDeployment(deploymentID string) bundle.Mutator {
+	return &annotateDeployment{deploymentID: deploymentID}
+}
+
+func (m *annotateDeployment) Name() string {
+	return "metadata.AnnotateDeployment"
+}
+
+func (m *annotateDeployment) Apply(_ context.Context, b *bundle.Bundle) diag.Diagnostics {
+	for _, job := range b.Config.Resources.Jobs {
+		// Deployment is set by AnnotateJobs, which runs during initialize.
+		job.Deployment.DeploymentId = m.deploymentID
+	}
+
+	for _, pipeline := range b.Config.Resources.Pipelines {
+		pipeline.Deployment.DeploymentId = m.deploymentID
+	}
+
+	return nil
+}
+
+type annotateDeploymentVersion struct {
+	version int
+}
+
+// AnnotateDeploymentVersion stamps the DMS version onto every job and pipeline.
+// Separate from AnnotateDeployment because version only exists after CreateVersion runs.
+func AnnotateDeploymentVersion(version int) bundle.Mutator {
+	return &annotateDeploymentVersion{version: version}
+}
+
+func (m *annotateDeploymentVersion) Name() string {
+	return "metadata.AnnotateDeploymentVersion"
+}
+
+func (m *annotateDeploymentVersion) Apply(_ context.Context, b *bundle.Bundle) diag.Diagnostics {
+	versionID := strconv.Itoa(m.version)
+
+	for _, job := range b.Config.Resources.Jobs {
+		job.Deployment.VersionId = versionID
+	}
+
+	for _, pipeline := range b.Config.Resources.Pipelines {
+		pipeline.Deployment.VersionId = versionID
+	}
+
+	return nil
+}
diff --git a/bundle/deploy/metadata/annotate_deployment_version_test.go b/bundle/deploy/metadata/annotate_deployment_version_test.go
new file mode 100644
index 00000000000..297ba95f8ee
--- /dev/null
+++ b/bundle/deploy/metadata/annotate_deployment_version_test.go
@@ -0,0 +1,50 @@
+package metadata
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/databricks/databricks-sdk-go/service/pipelines"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAnnotateDeploymentVersion(t *testing.T) {
+	b := &bundle.Bundle{
+		Config: config.Root{
+			Resources: config.Resources{
+				Jobs: map[string]*resources.Job{
+					"my-job": {
+						JobSettings: jobs.JobSettings{
+							Deployment: &jobs.JobDeployment{Kind: jobs.JobDeploymentKindBundle},
+						},
+					},
+				},
+				Pipelines: map[string]*resources.Pipeline{
+					"my-pipeline": {
+						CreatePipeline: pipelines.CreatePipeline{
+							Deployment: &pipelines.PipelineDeployment{Kind: pipelines.DeploymentKindBundle},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	diags := bundle.ApplySeq(t.Context(), b, AnnotateDeployment("dep-123"), AnnotateDeploymentVersion(7))
+	require.NoError(t, diags.Error())
+
+	job := b.Config.Resources.Jobs["my-job"].Deployment
+	assert.Equal(t, "dep-123", job.DeploymentId)
+	assert.Equal(t, "7", job.VersionId)
+	// The kind set by AnnotateJobs is preserved.
+	assert.Equal(t, jobs.JobDeploymentKindBundle, job.Kind)
+
+	pipeline := b.Config.Resources.Pipelines["my-pipeline"].Deployment
+	assert.Equal(t, "dep-123", pipeline.DeploymentId)
+	assert.Equal(t, "7", pipeline.VersionId)
+	assert.Equal(t, pipelines.DeploymentKindBundle, pipeline.Kind)
+}
diff --git a/bundle/deploy/metadata/compute.go b/bundle/deploy/metadata/compute.go
index cb7be9811c4..1fa4c3bf2d9 100644
--- a/bundle/deploy/metadata/compute.go
+++ b/bundle/deploy/metadata/compute.go
@@ -48,7 +48,9 @@ func (m *compute) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics
 		// root
 		l := b.Config.GetLocation("resources.jobs." + name)
 		if l.File == "" {
-			// b.Config.Resources.Jobs may include a job that only exists in state but not in config
+			// Skip resources that exist only in the deployment state: statemgmt.Load,
+			// which runs before this mutator, injects them into the config without a
+			// file location.
 			continue
 		}
 
@@ -72,6 +74,13 @@ func (m *compute) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics
 		// Compute config file path the pipeline is defined in, relative to the bundle
 		// root
 		l := b.Config.GetLocation("resources.pipelines." + name)
+		if l.File == "" {
+			// Skip resources that exist only in the deployment state: statemgmt.Load,
+			// which runs before this mutator, injects them into the config without a
+			// file location.
+			continue
+		}
+
 		relativePath, err := filepath.Rel(b.BundleRootPath, l.File)
 		if err != nil {
 			return diag.Errorf("failed to compute relative path for pipeline %s: %v", name, err)
@@ -90,6 +99,13 @@ func (m *compute) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics
 		// Compute config file path the dashboard is defined in, relative to the bundle
 		// root
 		l := b.Config.GetLocation("resources.dashboards." + name)
+		if l.File == "" {
+			// Skip resources that exist only in the deployment state: statemgmt.Load,
+			// which runs before this mutator, injects them into the config without a
+			// file location.
+			continue
+		}
+
 		relativePath, err := filepath.Rel(b.BundleRootPath, l.File)
 		if err != nil {
 			return diag.Errorf("failed to compute relative path for dashboard %s: %v", name, err)
diff --git a/bundle/deploy/metadata/compute_test.go b/bundle/deploy/metadata/compute_test.go
index a10f65d72e5..cb163914bdb 100644
--- a/bundle/deploy/metadata/compute_test.go
+++ b/bundle/deploy/metadata/compute_test.go
@@ -9,7 +9,7 @@ import (
 	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/cli/bundle/internal/bundletest"
 	"github.com/databricks/cli/bundle/metadata"
-	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/vfs"
 	"github.com/databricks/databricks-sdk-go/service/jobs"
 	"github.com/databricks/databricks-sdk-go/service/pipelines"
@@ -39,13 +39,13 @@ func TestComputeMetadataMutator(t *testing.T) {
 			Resources: config.Resources{
 				Jobs: map[string]*resources.Job{
 					"my-job-1": {
-						BaseResource: resources.BaseResource{ID: "1111"},
+						ID: "1111",
 						JobSettings: jobs.JobSettings{
 							Name: "My Job One",
 						},
 					},
 					"my-job-2": {
-						BaseResource: resources.BaseResource{ID: "2222"},
+						ID: "2222",
 						JobSettings: jobs.JobSettings{
 							Name: "My Job Two",
 						},
@@ -53,13 +53,13 @@ func TestComputeMetadataMutator(t *testing.T) {
 				},
 				Pipelines: map[string]*resources.Pipeline{
 					"my-pipeline-1": {
-						BaseResource: resources.BaseResource{ID: "3333"},
+						ID: "3333",
 						CreatePipeline: pipelines.CreatePipeline{
 							Name: "My Pipeline One",
 						},
 					},
 					"my-pipeline-2": {
-						BaseResource: resources.BaseResource{ID: "4444"},
+						ID: "4444",
 						CreatePipeline: pipelines.CreatePipeline{
 							Name: "My Pipeline Two",
 						},
@@ -67,12 +67,12 @@ func TestComputeMetadataMutator(t *testing.T) {
 				},
 				Dashboards: map[string]*resources.Dashboard{
 					"my-dashboard-1": {
-						BaseResource:    resources.BaseResource{ID: "5555"},
+						ID:              "5555",
 						DashboardConfig: resources.DashboardConfig{},
 						FilePath:        "i/h/g",
 					},
 					"my-dashboard-2": {
-						BaseResource:    resources.BaseResource{ID: "6666"},
+						ID:              "6666",
 						DashboardConfig: resources.DashboardConfig{},
 						FilePath:        "l/k/j",
 					},
@@ -81,12 +81,12 @@ func TestComputeMetadataMutator(t *testing.T) {
 		},
 	}
 
-	bundletest.SetLocation(b, "resources.jobs.my-job-1", []dyn.Location{{File: "a/b/c"}})
-	bundletest.SetLocation(b, "resources.jobs.my-job-2", []dyn.Location{{File: "d/e/f"}})
-	bundletest.SetLocation(b, "resources.pipelines.my-pipeline-1", []dyn.Location{{File: "x/y/z"}})
-	bundletest.SetLocation(b, "resources.pipelines.my-pipeline-2", []dyn.Location{{File: "u/v/w"}})
-	bundletest.SetLocation(b, "resources.dashboards.my-dashboard-1", []dyn.Location{{File: "g/h/i"}})
-	bundletest.SetLocation(b, "resources.dashboards.my-dashboard-2", []dyn.Location{{File: "j/k/l"}})
+	bundletest.SetLocation(b, "resources.jobs.my-job-1", []diag.Location{{File: "a/b/c"}})
+	bundletest.SetLocation(b, "resources.jobs.my-job-2", []diag.Location{{File: "d/e/f"}})
+	bundletest.SetLocation(b, "resources.pipelines.my-pipeline-1", []diag.Location{{File: "x/y/z"}})
+	bundletest.SetLocation(b, "resources.pipelines.my-pipeline-2", []diag.Location{{File: "u/v/w"}})
+	bundletest.SetLocation(b, "resources.dashboards.my-dashboard-1", []diag.Location{{File: "g/h/i"}})
+	bundletest.SetLocation(b, "resources.dashboards.my-dashboard-2", []diag.Location{{File: "j/k/l"}})
 
 	expectedMetadata := metadata.Metadata{
 		Version: metadata.Version,
@@ -148,6 +148,39 @@ func TestComputeMetadataMutator(t *testing.T) {
 	assert.Equal(t, expectedMetadata, b.Metadata)
 }
 
+func TestComputeMetadataMutatorStateOnlyResources(t *testing.T) {
+	// State-only resources (in state but not in config) have no location and must be skipped, not error.
+	b := &bundle.Bundle{
+		BundleRootPath: "/tmp/some/root",
+		Config: config.Root{
+			Resources: config.Resources{
+				Jobs: map[string]*resources.Job{
+					"state-only-job": {
+						ID: "1111",
+					},
+				},
+				Pipelines: map[string]*resources.Pipeline{
+					"state-only-pipeline": {
+						ID: "2222",
+					},
+				},
+				Dashboards: map[string]*resources.Dashboard{
+					"state-only-dashboard": {
+						ID: "3333",
+					},
+				},
+			},
+		},
+	}
+
+	diags := bundle.Apply(t.Context(), b, Compute())
+	require.NoError(t, diags.Error())
+
+	assert.Empty(t, b.Metadata.Config.Resources.Jobs)
+	assert.Empty(t, b.Metadata.Config.Resources.Pipelines)
+	assert.Empty(t, b.Metadata.Config.Resources.Dashboards)
+}
+
 func TestComputeMetadataMutatorSourceLinked(t *testing.T) {
 	syncRootPath := "/Users/shreyas.goenka@databricks.com/source"
 	enabled := true
diff --git a/bundle/deploy/metadata/upload.go b/bundle/deploy/metadata/upload.go
index 79546518a36..3217b054034 100644
--- a/bundle/deploy/metadata/upload.go
+++ b/bundle/deploy/metadata/upload.go
@@ -9,6 +9,7 @@ import (
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/filer"
+	"github.com/databricks/cli/libs/retry"
 )
 
 const metadataFileName = "metadata.json"
@@ -28,10 +29,11 @@ func (m *upload) Name() string {
 }
 
 func (m *upload) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
-	f, err := filer.NewWorkspaceFilesClient(b.WorkspaceClient(ctx), b.Config.Workspace.StatePath)
+	workspaceFiler, err := filer.NewWorkspaceFilesClient(b.WorkspaceClient(ctx), b.Config.Workspace.StatePath)
 	if err != nil {
 		return diag.FromErr(err)
 	}
+	f := retry.Filer(workspaceFiler)
 
 	metadata, err := json.MarshalIndent(b.Metadata, "", "  ")
 	if err != nil {
diff --git a/bundle/deploy/resource_path_mkdir.go b/bundle/deploy/resource_path_mkdir.go
index ab070b925e6..5c41a270a80 100644
--- a/bundle/deploy/resource_path_mkdir.go
+++ b/bundle/deploy/resource_path_mkdir.go
@@ -28,9 +28,8 @@ func (m *resourcePathMkdir) Apply(ctx context.Context, b *bundle.Bundle) diag.Di
 	w := b.WorkspaceClient(ctx)
 
 	// Optimisitcally create the resource path. If it already exists ignore the error.
-	err := w.Workspace.MkdirsByPath(ctx, b.Config.Workspace.ResourcePath) //nolint:staticcheck // Deprecated in SDK v0.127.0. Migration to WorkspaceHierarchyService tracked separately.
-	var aerr *apierr.APIError
-	if errors.As(err, &aerr) && aerr.ErrorCode == "RESOURCE_ALREADY_EXISTS" {
+	err := w.Workspace.MkdirsByPath(ctx, b.Config.Workspace.ResourcePath)
+	if aerr, ok := errors.AsType[*apierr.APIError](err); ok && aerr.ErrorCode == "RESOURCE_ALREADY_EXISTS" {
 		return nil
 	}
 	return diag.FromErr(err)
diff --git a/bundle/deploy/snapshot/path.go b/bundle/deploy/snapshot/path.go
new file mode 100644
index 00000000000..b82cf42a336
--- /dev/null
+++ b/bundle/deploy/snapshot/path.go
@@ -0,0 +1,180 @@
+package snapshot
+
+import (
+	"archive/zip"
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"slices"
+	"time"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/deploy/files"
+	"github.com/databricks/cli/libs/fileset"
+	"github.com/databricks/cli/libs/snapshot"
+	libsync "github.com/databricks/cli/libs/sync"
+)
+
+// zipEpoch is a fixed timestamp used for all zip entries to make the zip content-addressed
+// and reproducible: the same file content always produces the same hash regardless of when
+// the zip was built or the file's mtime.
+var zipEpoch = time.Date(2000, 1, 1, 0, 0, 0, 0, time.UTC)
+
+// metadataFileName is the name of the metadata file embedded in every snapshot zip.
+// It captures a hash of the ACL so that a change to top-level permissions always produces
+// a different snapshot ID — necessary because immutable snapshots cannot be re-permissioned
+// after creation. The hash avoids embedding principal names in the stored artifact.
+const metadataFileName = ".databricks/snapshot-metadata.json"
+
+// snapshotMetadata is the structure written to metadataFileName inside the zip.
+type snapshotMetadata struct {
+	// PermissionsHash is the SHA-256 hex digest of the JSON-serialized ACL.
+	PermissionsHash string `json:"permissions_hash"`
+}
+
+// BundleZip builds the zip that is uploaded to the snapshot API.
+// It contains:
+//   - all files from the bundle sync root under the "files/" prefix,
+//     selected with the same git-aware + include/exclude logic as files.Upload
+//   - all built artifact files under the "artifacts/.internal/" prefix
+//   - a metadata file at metadataFileName that embeds the ACL so that any
+//     change to top-level permissions forces a new snapshot ID
+//
+// The snapshot ID is always IDFromContent(BundleZip(b)), ensuring the
+// pre-calculated path and the uploaded path are derived from the same content.
+// The second return value is the number of sync-root files included in the zip.
+func BundleZip(ctx context.Context, b *bundle.Bundle) ([]byte, int, error) {
+	var buf bytes.Buffer
+	zw := zip.NewWriter(&buf)
+
+	fileCount, err := addSyncRootToZip(ctx, zw, b)
+	if err != nil {
+		return nil, 0, err
+	}
+	if err := addArtifactsToZip(zw, b); err != nil {
+		return nil, 0, err
+	}
+	if err := addMetadataToZip(zw, BuildACL(b)); err != nil {
+		return nil, 0, err
+	}
+
+	if err := zw.Close(); err != nil {
+		return nil, 0, err
+	}
+	return buf.Bytes(), fileCount, nil
+}
+
+// addMetadataToZip writes the snapshot metadata file into the zip so that
+// any change to the ACL changes the snapshot hash and forces a new snapshot.
+func addMetadataToZip(zw *zip.Writer, acl []snapshot.ACLEntry) error {
+	aclJSON, err := json.Marshal(acl)
+	if err != nil {
+		return fmt.Errorf("marshal ACL for permissions hash: %w", err)
+	}
+	data, err := json.Marshal(snapshotMetadata{PermissionsHash: snapshot.HashFromContent(aclJSON)})
+	if err != nil {
+		return fmt.Errorf("marshal snapshot metadata: %w", err)
+	}
+	h := &zip.FileHeader{
+		Name:     metadataFileName,
+		Method:   zip.Deflate,
+		Modified: zipEpoch,
+	}
+	w, err := zw.CreateHeader(h)
+	if err != nil {
+		return fmt.Errorf("zip entry for %s: %w", metadataFileName, err)
+	}
+	_, err = w.Write(data)
+	return err
+}
+
+// addSyncRootToZip returns the number of files added from the sync root.
+func addSyncRootToZip(ctx context.Context, zw *zip.Writer, b *bundle.Bundle) (int, error) {
+	opts, err := files.GetSyncOptions(ctx, b)
+	if err != nil {
+		return 0, err
+	}
+	fl, err := libsync.NewFileList(ctx, opts.WorktreeRoot, opts.LocalRoot, opts.Paths, opts.Include, opts.Exclude)
+	if err != nil {
+		return 0, fmt.Errorf("build file set: %w", err)
+	}
+	fileList, err := fl.Files(ctx)
+	if err != nil {
+		return 0, err
+	}
+	// Sort for a stable zip (same content → same hash regardless of iteration order).
+	slices.SortFunc(fileList, func(a, b fileset.File) int {
+		if a.Relative < b.Relative {
+			return -1
+		}
+		if a.Relative > b.Relative {
+			return 1
+		}
+		return 0
+	})
+
+	for _, f := range fileList {
+		rc, err := b.SyncRoot.Open(f.Relative)
+		if err != nil {
+			return 0, fmt.Errorf("open %s: %w", f.Relative, err)
+		}
+
+		entryPath := filepath.ToSlash(f.Relative)
+		h := &zip.FileHeader{
+			Name:     "files/" + entryPath,
+			Method:   zip.Deflate,
+			Modified: zipEpoch,
+		}
+		w, err := zw.CreateHeader(h)
+		if err != nil {
+			rc.Close()
+			return 0, fmt.Errorf("zip entry for %s: %w", f.Relative, err)
+		}
+		_, err = io.Copy(w, rc)
+		rc.Close()
+		if err != nil {
+			return 0, fmt.Errorf("write %s: %w", f.Relative, err)
+		}
+	}
+	return len(fileList), nil
+}
+
+func addArtifactsToZip(zw *zip.Writer, b *bundle.Bundle) error {
+	for _, artifact := range b.Config.Artifacts {
+		for _, af := range artifact.Files {
+			source := af.Source
+			if af.Patched != "" {
+				source = af.Patched
+			}
+			if err := addLocalFileToZip(zw, source, "artifacts/.internal"); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func addLocalFileToZip(zw *zip.Writer, localPath, zipPrefix string) error {
+	f, err := os.Open(localPath)
+	if err != nil {
+		return fmt.Errorf("open %s: %w", localPath, err)
+	}
+	defer f.Close()
+
+	entryName := zipPrefix + "/" + filepath.Base(localPath)
+	h := &zip.FileHeader{
+		Name:     entryName,
+		Method:   zip.Deflate,
+		Modified: zipEpoch,
+	}
+	w, err := zw.CreateHeader(h)
+	if err != nil {
+		return fmt.Errorf("zip entry %s: %w", entryName, err)
+	}
+	_, err = io.Copy(w, f)
+	return err
+}
diff --git a/bundle/deploy/snapshot/path_test.go b/bundle/deploy/snapshot/path_test.go
new file mode 100644
index 00000000000..54407a98e20
--- /dev/null
+++ b/bundle/deploy/snapshot/path_test.go
@@ -0,0 +1,152 @@
+package snapshot_test
+
+import (
+	"archive/zip"
+	"bytes"
+	"os"
+	"path/filepath"
+	"slices"
+	"testing"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/cli/bundle/deploy/snapshot"
+	libsnapshot "github.com/databricks/cli/libs/snapshot"
+	"github.com/databricks/cli/libs/vfs"
+	"github.com/databricks/databricks-sdk-go/service/iam"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func makeBundleWithFiles(t *testing.T, files map[string]string) *bundle.Bundle {
+	t.Helper()
+	dir := t.TempDir()
+	for name, content := range files {
+		p := filepath.Join(dir, name)
+		require.NoError(t, os.MkdirAll(filepath.Dir(p), 0o755))
+		require.NoError(t, os.WriteFile(p, []byte(content), 0o644))
+	}
+	root := vfs.MustNew(dir)
+	b := &bundle.Bundle{
+		BundleRootPath: dir,
+		SyncRoot:       root,
+		// WorktreeRoot = SyncRoot is the fallback used by LoadGitDetails when
+		// there is no git repository.
+		WorktreeRoot: root,
+		Config: config.Root{
+			Bundle: config.Bundle{Target: "default"},
+			// The SyncDefaultPath mutator sets this to ["."] during initialize;
+			// set it here since these tests bypass the mutator pipeline. Empty
+			// sync paths select no files.
+			Sync:      config.Sync{Paths: []string{"."}},
+			Workspace: config.Workspace{CurrentUser: &config.User{}},
+		},
+	}
+	b.Config.Workspace.CurrentUser.User = &iam.User{UserName: "tester@example.com"}
+	return b
+}
+
+func TestBundleZipIsDeterministic(t *testing.T) {
+	b := makeBundleWithFiles(t, map[string]string{
+		"main.py":     "print('hello')",
+		"src/task.py": "def run(): pass",
+	})
+
+	zip1, _, err := snapshot.BundleZip(t.Context(), b)
+	require.NoError(t, err)
+	zip2, _, err := snapshot.BundleZip(t.Context(), b)
+	require.NoError(t, err)
+
+	assert.Equal(t, zip1, zip2, "BundleZip must produce identical bytes for identical content")
+}
+
+func TestBundleZipChangesWithContent(t *testing.T) {
+	b1 := makeBundleWithFiles(t, map[string]string{"main.py": "v1"})
+	b2 := makeBundleWithFiles(t, map[string]string{"main.py": "v2"})
+
+	zip1, _, err := snapshot.BundleZip(t.Context(), b1)
+	require.NoError(t, err)
+	zip2, _, err := snapshot.BundleZip(t.Context(), b2)
+	require.NoError(t, err)
+
+	assert.NotEqual(t, zip1, zip2, "different file content must produce different zips")
+}
+
+func TestBundleZipRespectsExcludes(t *testing.T) {
+	b := makeBundleWithFiles(t, map[string]string{
+		"main.py":   "print('hello')",
+		"skip.json": `{"id": "runtime-generated"}`,
+	})
+	bExclude := makeBundleWithFiles(t, map[string]string{
+		"main.py":   "print('hello')",
+		"skip.json": `{"id": "runtime-generated"}`,
+	})
+	bExclude.Config.Sync.Exclude = []string{"*.json"}
+
+	zipAll, _, err := snapshot.BundleZip(t.Context(), b)
+	require.NoError(t, err)
+	zipExcl, _, err := snapshot.BundleZip(t.Context(), bExclude)
+	require.NoError(t, err)
+
+	// The zip without the excluded file should be smaller and different.
+	assert.NotEqual(t, zipAll, zipExcl)
+	assert.Less(t, len(zipExcl), len(zipAll))
+}
+
+func zipEntryNames(t *testing.T, zipContent []byte) []string {
+	t.Helper()
+	r, err := zip.NewReader(bytes.NewReader(zipContent), int64(len(zipContent)))
+	require.NoError(t, err)
+	names := make([]string, len(r.File))
+	for i, f := range r.File {
+		names[i] = f.Name
+	}
+	return names
+}
+
+func TestBundleZipDoNotStripNotebookExtensions(t *testing.T) {
+	// Minimal valid Jupyter notebook content.
+	ipynb := `{"nbformat": 4, "nbformat_minor": 5, "cells": [], "metadata": {}}`
+	b := makeBundleWithFiles(t, map[string]string{
+		"src/my_notebook.ipynb": ipynb,
+		"src/script.py":         "print('hello')",
+	})
+
+	zipContent, _, err := snapshot.BundleZip(t.Context(), b)
+	require.NoError(t, err)
+
+	names := zipEntryNames(t, zipContent)
+	assert.True(t, slices.Contains(names, "files/src/my_notebook.ipynb"), "notebook should keep its extension")
+	assert.True(t, slices.Contains(names, "files/src/script.py"), "regular Python file should keep its extension")
+}
+
+func TestBundleZipIncludesMetadataFile(t *testing.T) {
+	b := makeBundleWithFiles(t, map[string]string{"task.py": "x = 1"})
+
+	zipContent, _, err := snapshot.BundleZip(t.Context(), b)
+	require.NoError(t, err)
+
+	names := zipEntryNames(t, zipContent)
+	assert.True(t, slices.Contains(names, ".databricks/snapshot-metadata.json"), "zip must contain the snapshot metadata file")
+}
+
+func TestBundleZipChangesWithPermissions(t *testing.T) {
+	files := map[string]string{"task.py": "x = 1"}
+
+	bNoPerms := makeBundleWithFiles(t, files)
+
+	bWithPerms := makeBundleWithFiles(t, files)
+	bWithPerms.Config.Permissions = []resources.Permission{
+		{Level: "CAN_VIEW", GroupName: "data-team"},
+	}
+
+	zipNoPerms, _, err := snapshot.BundleZip(t.Context(), bNoPerms)
+	require.NoError(t, err)
+	zipWithPerms, _, err := snapshot.BundleZip(t.Context(), bWithPerms)
+	require.NoError(t, err)
+
+	assert.NotEqual(t, zipNoPerms, zipWithPerms, "adding top-level permissions must produce a different snapshot zip")
+	assert.NotEqual(t, libsnapshot.HashFromContent(zipNoPerms), libsnapshot.HashFromContent(zipWithPerms),
+		"snapshot IDs must differ when top-level permissions change")
+}
diff --git a/bundle/deploy/snapshot/upload.go b/bundle/deploy/snapshot/upload.go
new file mode 100644
index 00000000000..3b7d7d1fc1a
--- /dev/null
+++ b/bundle/deploy/snapshot/upload.go
@@ -0,0 +1,157 @@
+package snapshot
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/cli/libs/diag"
+	"github.com/databricks/cli/libs/snapshot"
+)
+
+// fileLimitWarning is the file count above which immutable folder deployments may fail.
+const fileLimitWarning = 1000
+
+type snapshotUpload struct {
+	// clean is true for a fresh plan or deploy: the mutator discards zips staged by a
+	// previous run (so content-addressed "<hash>.zip" files don't accumulate) and
+	// stages the current one. It is false when applying a pre-existing plan
+	// (deploy --plan): the mutator reuses the zip staged when the plan was produced
+	// instead of rebuilding it.
+	clean bool
+}
+
+type PlanUploadOptions struct {
+	Clean bool
+}
+
+// PlanUpload returns a mutator that registers the immutable snapshot as an internal
+// resource. When Clean is true it discards zips staged by a previous run, builds the
+// bundle zip, stages it under the bundle's local state directory as "<hash>.zip", and
+// records the path on the resource; the staged file is uploaded when the resource is
+// created on apply. Pass Clean=false when applying a pre-existing plan: the mutator reuses the
+// zip staged when the plan was produced. Either way the resource is registered in the config,
+// so its path is known to the rest of the deploy before the snapshot is uploaded.
+func PlanUpload(opts PlanUploadOptions) bundle.Mutator {
+	return &snapshotUpload{clean: opts.Clean}
+}
+
+func (m *snapshotUpload) Name() string {
+	return "snapshot.Upload"
+}
+
+func (m *snapshotUpload) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
+	uploader, err := snapshot.NewSnapshotClient(b.WorkspaceClient(ctx))
+	if err != nil {
+		return diag.FromErr(err)
+	}
+
+	remoteRoot, err := uploader.GetSnapshotRootPath(ctx)
+	if err != nil {
+		return diag.FromErr(err)
+	}
+
+	if b.Config.Resources.Snapshots == nil {
+		b.Config.Resources.Snapshots = make(map[string]*resources.Snapshot)
+	}
+	if _, ok := b.Config.Resources.Snapshots[resources.SnapshotResourceKey]; ok {
+		return nil
+	}
+
+	var zipPath string
+	var diags diag.Diagnostics
+	if m.clean {
+		zipPath, diags, err = stageZip(ctx, b)
+	} else {
+		zipPath, err = stagedZipPath(ctx, b)
+	}
+	if err != nil {
+		return diags.Extend(diag.FromErr(err))
+	}
+
+	b.Config.Resources.Snapshots[resources.SnapshotResourceKey] = &resources.Snapshot{
+		BundleID:   BundleID(b),
+		ACL:        BuildACL(b),
+		RemoteRoot: remoteRoot,
+		ZipPath:    filepath.ToSlash(zipPath),
+	}
+	return diags
+}
+
+// stageZip builds the bundle zip and stages it under the bundle's local state directory as
+// "<hash>.zip", discarding zips staged by a previous run so content-addressed files don't
+// accumulate.
+func stageZip(ctx context.Context, b *bundle.Bundle) (string, diag.Diagnostics, error) {
+	zipContent, fileCount, err := BundleZip(ctx, b)
+	if err != nil {
+		return "", nil, fmt.Errorf("failed to build snapshot zip: %w", err)
+	}
+
+	if err := os.RemoveAll(b.GetLocalStateDir(ctx, "snapshots")); err != nil {
+		return "", nil, fmt.Errorf("failed to clean snapshot dir: %w", err)
+	}
+	dir, err := b.LocalStateDir(ctx, "snapshots")
+	if err != nil {
+		return "", nil, err
+	}
+	zipPath := filepath.Join(dir, snapshot.HashFromContent(zipContent)+".zip")
+	if err := os.WriteFile(zipPath, zipContent, 0o600); err != nil {
+		return "", nil, fmt.Errorf("failed to write snapshot zip: %w", err)
+	}
+
+	var diags diag.Diagnostics
+	if fileCount > fileLimitWarning {
+		diags = diag.Warningf(
+			"immutable folder deployment may not work correctly: bundle contains %d files (limit is %d)",
+			fileCount, fileLimitWarning,
+		)
+	}
+	return zipPath, diags, nil
+}
+
+// stagedZipPath returns the zip staged when the plan being applied was produced. Each fresh
+// plan clears the directory before staging, so it holds exactly that one zip.
+func stagedZipPath(ctx context.Context, b *bundle.Bundle) (string, error) {
+	zips, err := filepath.Glob(filepath.Join(b.GetLocalStateDir(ctx, "snapshots"), "*.zip"))
+	if err != nil {
+		return "", err
+	}
+	if len(zips) != 1 {
+		return "", fmt.Errorf("expected one staged snapshot zip, found %d; run 'bundle plan' again", len(zips))
+	}
+	return zips[0], nil
+}
+
+// BundleID returns a stable hash that identifies the bundle deployment.
+// It is derived deterministically from workspace.state_path, which is the
+// canonical unique identifier for a deployment (name, target, and workspace root
+// are all encoded in it). Two bundles with the same name and target but different
+// workspace.state_path values get distinct IDs.
+func BundleID(b *bundle.Bundle) string {
+	// Use normal sha256 without the namespace.
+	hash := sha256.Sum256([]byte(b.Config.Workspace.StatePath))
+	return hex.EncodeToString(hash[:])
+}
+
+// BuildACL constructs the access_control_list for the snapshot upload.
+// It grants CAN_READ to the current user and to every principal listed in the
+// top-level permissions section of the bundle config.
+func BuildACL(b *bundle.Bundle) []snapshot.ACLEntry {
+	acl := []snapshot.ACLEntry{
+		{UserName: b.Config.Workspace.CurrentUser.UserName, PermissionLevel: "CAN_READ"},
+	}
+	for _, p := range b.Config.Permissions {
+		acl = append(acl, snapshot.ACLEntry{
+			UserName:             p.UserName,
+			GroupName:            p.GroupName,
+			ServicePrincipalName: p.ServicePrincipalName,
+			PermissionLevel:      "CAN_READ",
+		})
+	}
+	return acl
+}
diff --git a/bundle/deploy/snapshot/upload_test.go b/bundle/deploy/snapshot/upload_test.go
new file mode 100644
index 00000000000..5bace57e2be
--- /dev/null
+++ b/bundle/deploy/snapshot/upload_test.go
@@ -0,0 +1,54 @@
+package snapshot_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/cli/bundle/deploy/snapshot"
+	libsnapshot "github.com/databricks/cli/libs/snapshot"
+	"github.com/databricks/databricks-sdk-go/service/iam"
+	"github.com/stretchr/testify/assert"
+)
+
+func bundleWithPermissions(currentUser string, perms []resources.Permission) *bundle.Bundle {
+	b := &bundle.Bundle{
+		Config: config.Root{
+			Workspace: config.Workspace{
+				CurrentUser: &config.User{},
+			},
+			Permissions: perms,
+		},
+	}
+	b.Config.Workspace.CurrentUser.User = &iam.User{UserName: currentUser}
+	return b
+}
+
+func TestBuildACLCurrentUserOnly(t *testing.T) {
+	b := bundleWithPermissions("alice@example.com", nil)
+
+	acl := snapshot.BuildACL(b)
+
+	assert.Equal(t, []libsnapshot.ACLEntry{
+		{UserName: "alice@example.com", PermissionLevel: "CAN_READ"},
+	}, acl)
+}
+
+func TestBuildACLWithTopLevelPermissions(t *testing.T) {
+	perms := []resources.Permission{
+		{Level: "CAN_VIEW", UserName: "bob@example.com"},
+		{Level: "CAN_MANAGE", GroupName: "devs"},
+		{Level: "CAN_RUN", ServicePrincipalName: "sp-123"},
+	}
+	b := bundleWithPermissions("alice@example.com", perms)
+
+	acl := snapshot.BuildACL(b)
+
+	assert.Equal(t, []libsnapshot.ACLEntry{
+		{UserName: "alice@example.com", PermissionLevel: "CAN_READ"},
+		{UserName: "bob@example.com", PermissionLevel: "CAN_READ"},
+		{GroupName: "devs", PermissionLevel: "CAN_READ"},
+		{ServicePrincipalName: "sp-123", PermissionLevel: "CAN_READ"},
+	}, acl)
+}
diff --git a/bundle/deploy/snapshot/upload_warning_test.go b/bundle/deploy/snapshot/upload_warning_test.go
new file mode 100644
index 00000000000..85ff5a21b51
--- /dev/null
+++ b/bundle/deploy/snapshot/upload_warning_test.go
@@ -0,0 +1,123 @@
+package snapshot
+
+import (
+	"context"
+	"fmt"
+	"math"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/diag"
+	"github.com/databricks/cli/libs/logdiag"
+	"github.com/databricks/cli/libs/testserver"
+	"github.com/databricks/cli/libs/vfs"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/service/iam"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func setupTestClient(t *testing.T) *databricks.WorkspaceClient {
+	t.Helper()
+	server := testserver.New(t)
+	testserver.AddDefaultHandlers(server)
+	client, err := databricks.NewWorkspaceClient(&databricks.Config{
+		Host:               server.URL,
+		Token:              "testtoken",
+		RateLimitPerSecond: math.MaxInt,
+	})
+	require.NoError(t, err)
+	return client
+}
+
+func makeBundle(t *testing.T, nFiles int) *bundle.Bundle {
+	t.Helper()
+	dir := t.TempDir()
+	for i := range nFiles {
+		p := filepath.Join(dir, fmt.Sprintf("f%d.py", i))
+		require.NoError(t, os.WriteFile(p, []byte("x"), 0o644))
+	}
+	root := vfs.MustNew(dir)
+	b := &bundle.Bundle{
+		BundleRootPath: dir,
+		SyncRoot:       root,
+		WorktreeRoot:   root,
+		Config: config.Root{
+			Bundle: config.Bundle{Target: "default"},
+			// The SyncDefaultPath mutator sets this to ["."] during initialize;
+			// set it here since these tests bypass the mutator pipeline. Empty
+			// sync paths select no files.
+			Sync: config.Sync{Paths: []string{"."}},
+			Workspace: config.Workspace{
+				CurrentUser: &config.User{
+					User: &iam.User{UserName: "test@example.test"},
+				},
+			},
+		},
+	}
+	return b
+}
+
+func testContext(t *testing.T) context.Context {
+	t.Helper()
+	return logdiag.InitContext(cmdio.MockDiscard(t.Context()))
+}
+
+func TestUploadWarnsAboveFileLimit(t *testing.T) {
+	b := makeBundle(t, fileLimitWarning+1)
+	b.SetWorkpaceClient(setupTestClient(t))
+	m := &snapshotUpload{clean: true}
+
+	diags := m.Apply(testContext(t), b)
+
+	require.Len(t, diags, 1)
+	assert.Equal(t, diag.Warning, diags[0].Severity)
+	assert.Contains(t, diags[0].Summary, fmt.Sprintf("%d files", fileLimitWarning+1))
+}
+
+func TestUploadNoWarningBelowFileLimit(t *testing.T) {
+	b := makeBundle(t, 5)
+	b.SetWorkpaceClient(setupTestClient(t))
+	m := &snapshotUpload{clean: true}
+
+	diags := m.Apply(testContext(t), b)
+
+	assert.True(t, diags.HasError() == false && len(diags) == 0, "expected no diagnostics")
+}
+
+func TestUploadReusesStagedZipWhenNotClean(t *testing.T) {
+	// clean=false is the deploy --plan path: the zip staged when the plan was produced is
+	// registered on the config as is, without rebuilding or warning again, even for a
+	// bundle that would otherwise exceed the file limit.
+	ctx := testContext(t)
+	b := makeBundle(t, fileLimitWarning+1)
+	b.SetWorkpaceClient(setupTestClient(t))
+
+	require.Len(t, (&snapshotUpload{clean: true}).Apply(ctx, b), 1)
+	staged := b.Config.Resources.Snapshots[resources.SnapshotResourceKey]
+	require.NotNil(t, staged)
+
+	b.Config.Resources.Snapshots = nil
+	diags := (&snapshotUpload{clean: false}).Apply(ctx, b)
+
+	require.Empty(t, diags)
+	reused := b.Config.Resources.Snapshots[resources.SnapshotResourceKey]
+	require.NotNil(t, reused)
+	assert.Equal(t, staged.ZipPath, reused.ZipPath)
+	assert.Equal(t, staged.FullPath(), reused.FullPath())
+}
+
+func TestUploadNotCleanWithoutStagedZip(t *testing.T) {
+	b := makeBundle(t, 5)
+	b.SetWorkpaceClient(setupTestClient(t))
+
+	diags := (&snapshotUpload{clean: false}).Apply(testContext(t), b)
+
+	require.True(t, diags.HasError())
+	assert.Contains(t, diags[0].Summary, "run 'bundle plan' again")
+}
diff --git a/bundle/deploy/state.go b/bundle/deploy/state.go
index 5d99748fb71..13b04e0dc36 100644
--- a/bundle/deploy/state.go
+++ b/bundle/deploy/state.go
@@ -9,11 +9,11 @@ import (
 	"io/fs"
 	"path/filepath"
 	"time"
+	"uuid"
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/libs/fileset"
 	"github.com/databricks/cli/libs/vfs"
-	"github.com/google/uuid"
 )
 
 const (
diff --git a/bundle/deploy/state_pull.go b/bundle/deploy/state_pull.go
index 832fac87fbb..462981cf4e2 100644
--- a/bundle/deploy/state_pull.go
+++ b/bundle/deploy/state_pull.go
@@ -11,6 +11,7 @@ import (
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/bundle/deploy/files"
+	"github.com/databricks/cli/libs/atomicfile"
 	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/filer"
 	"github.com/databricks/cli/libs/log"
@@ -44,37 +45,22 @@ func (s *statePull) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostic
 		return diag.FromErr(err)
 	}
 
-	local, err := os.OpenFile(statePath, os.O_CREATE|os.O_RDWR, 0o600)
-	if err != nil {
-		return diag.FromErr(err)
-	}
-	defer local.Close()
-
 	data := remote.Bytes()
 	err = validateRemoteStateCompatibility(bytes.NewReader(data))
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
-	if !isLocalStateStale(local, bytes.NewReader(data)) {
+	// A missing or unreadable local file counts as stale, so we write the remote copy.
+	localData, _ := os.ReadFile(statePath)
+	if !isLocalStateStale(bytes.NewReader(localData), bytes.NewReader(data)) {
 		log.Infof(ctx, "Local deployment state is the same or newer, ignoring remote state")
 		return nil
 	}
 
-	// Truncating the file before writing
-	err = local.Truncate(0)
-	if err != nil {
-		return diag.FromErr(err)
-	}
-	_, err = local.Seek(0, 0)
-	if err != nil {
-		return diag.FromErr(err)
-	}
-
 	// Write file to disk.
 	log.Infof(ctx, "Writing remote deployment state file to local cache directory")
-	_, err = io.Copy(local, bytes.NewReader(data))
-	if err != nil {
+	if err := atomicfile.Write(statePath, data, 0o600); err != nil {
 		return diag.FromErr(err)
 	}
 
diff --git a/bundle/deploy/state_update.go b/bundle/deploy/state_update.go
index 55cf2393bf1..eeecc7b8cdb 100644
--- a/bundle/deploy/state_update.go
+++ b/bundle/deploy/state_update.go
@@ -1,20 +1,19 @@
 package deploy
 
 import (
-	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
-	"io"
 	"io/fs"
 	"os"
 	"time"
+	"uuid"
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/internal/build"
+	"github.com/databricks/cli/libs/atomicfile"
 	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/log"
-	"github.com/google/uuid"
 )
 
 type stateUpdate struct{}
@@ -47,7 +46,7 @@ func (s *stateUpdate) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnost
 	state.Files = fl
 
 	// Generate a UUID for the deployment, if one does not already exist
-	if state.ID == uuid.Nil {
+	if state.ID == uuid.Nil() {
 		state.ID = uuid.New()
 	}
 	b.Metrics.DeploymentId = state.ID
@@ -56,21 +55,14 @@ func (s *stateUpdate) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnost
 	if err != nil {
 		return diag.FromErr(err)
 	}
-	// Write the state back to the file.
-	f, err := os.OpenFile(statePath, os.O_CREATE|os.O_RDWR|os.O_TRUNC, 0o600)
-	if err != nil {
-		log.Infof(ctx, "Unable to open deployment state file: %s", err)
-		return diag.FromErr(err)
-	}
-	defer f.Close()
-
 	data, err := json.Marshal(state)
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
-	_, err = io.Copy(f, bytes.NewReader(data))
-	if err != nil {
+	// Write the state back to the file.
+	if err := atomicfile.Write(statePath, data, 0o600); err != nil {
+		log.Infof(ctx, "Unable to write deployment state file: %s", err)
 		return diag.FromErr(err)
 	}
 
diff --git a/bundle/deploy/state_update_test.go b/bundle/deploy/state_update_test.go
index d4b24d85b33..c43e547d8bb 100644
--- a/bundle/deploy/state_update_test.go
+++ b/bundle/deploy/state_update_test.go
@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"os"
 	"testing"
+	"uuid"
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/bundle/config"
@@ -12,7 +13,6 @@ import (
 	"github.com/databricks/cli/libs/fileset"
 	"github.com/databricks/cli/libs/vfs"
 	"github.com/databricks/databricks-sdk-go/service/iam"
-	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 )
 
@@ -90,7 +90,7 @@ func TestStateUpdate(t *testing.T) {
 	require.Equal(t, build.GetInfo().Version, state.CliVersion)
 
 	// Valid non-empty UUID is generated.
-	require.NotEqual(t, uuid.Nil, state.ID)
+	require.NotEqual(t, uuid.Nil(), state.ID)
 }
 
 func TestStateUpdateWithExistingState(t *testing.T) {
diff --git a/bundle/deploy/terraform/apply.go b/bundle/deploy/terraform/apply.go
deleted file mode 100644
index aff2025e018..00000000000
--- a/bundle/deploy/terraform/apply.go
+++ /dev/null
@@ -1,53 +0,0 @@
-package terraform
-
-import (
-	"context"
-
-	"github.com/databricks/cli/bundle"
-	"github.com/databricks/cli/bundle/permissions"
-	"github.com/databricks/cli/libs/diag"
-	"github.com/databricks/cli/libs/log"
-	"github.com/hashicorp/terraform-exec/tfexec"
-)
-
-type apply struct{}
-
-func (w *apply) Name() string {
-	return "terraform.Apply"
-}
-
-func (w *apply) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
-	// return early if plan is empty
-	if b.TerraformPlanIsEmpty {
-		log.Debugf(ctx, "No changes in plan. Skipping terraform apply.")
-		return nil
-	}
-
-	tf := b.Terraform
-	if tf == nil {
-		return diag.Errorf("terraform not initialized")
-	}
-
-	if b.TerraformPlanPath == "" {
-		return diag.Errorf("no plan found")
-	}
-
-	// Apply terraform according to the computed plan
-	err := tf.Apply(ctx, tfexec.DirOrPlan(b.TerraformPlanPath))
-	if err != nil {
-		diags := permissions.TryExtendTerraformPermissionError(ctx, b, err)
-		if diags != nil {
-			return diags
-		}
-		return diag.Errorf("terraform apply: %v", err)
-	}
-
-	log.Infof(ctx, "terraform apply completed")
-	return nil
-}
-
-// Apply returns a [bundle.Mutator] that runs the equivalent of `terraform apply ./plan`
-// from the bundle's ephemeral working directory for Terraform.
-func Apply() bundle.Mutator {
-	return &apply{}
-}
diff --git a/bundle/deploy/terraform/check_dashboards_modified_remotely.go b/bundle/deploy/terraform/check_dashboards_modified_remotely.go
deleted file mode 100644
index 4e56eb8e1d1..00000000000
--- a/bundle/deploy/terraform/check_dashboards_modified_remotely.go
+++ /dev/null
@@ -1,135 +0,0 @@
-package terraform
-
-import (
-	"context"
-	"fmt"
-	"strings"
-
-	"github.com/databricks/cli/bundle"
-	"github.com/databricks/cli/bundle/config/engine"
-	"github.com/databricks/cli/libs/diag"
-	"github.com/databricks/cli/libs/dyn"
-)
-
-type dashboardState struct {
-	Name string
-	ID   string
-	ETag string
-}
-
-func collectDashboardsFromState(ctx context.Context, b *bundle.Bundle, directDeployment bool) ([]dashboardState, error) {
-	var state ExportedResourcesMap
-	var err error
-	if directDeployment {
-		state = b.DeploymentBundle.ExportState(ctx)
-	} else {
-		state, err = ParseResourcesState(ctx, b)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	var dashboards []dashboardState
-	for resourceKey, instance := range state {
-		// Check if this is a dashboard resource key
-		if !strings.HasPrefix(resourceKey, "resources.dashboards.") {
-			continue
-		}
-		// Extract dashboard name from "resources.dashboards.name"
-		parts := strings.Split(resourceKey, ".")
-		if len(parts) != 3 {
-			continue
-		}
-		resourceName := parts[2]
-
-		dashboards = append(dashboards, dashboardState{
-			Name: resourceName,
-			ID:   instance.ID,
-			ETag: instance.ETag,
-		})
-	}
-
-	return dashboards, nil
-}
-
-type checkDashboardsModifiedRemotely struct {
-	isPlan bool
-	engine engine.EngineType
-}
-
-func (l *checkDashboardsModifiedRemotely) Name() string {
-	return "CheckDashboardsModifiedRemotely"
-}
-
-func (l *checkDashboardsModifiedRemotely) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
-	// This mutator is relevant only if the bundle includes dashboards.
-	if len(b.Config.Resources.Dashboards) == 0 {
-		return nil
-	}
-
-	// If the user has forced the deployment, skip this check.
-	if b.Config.Bundle.Force {
-		return nil
-	}
-
-	dashboards, err := collectDashboardsFromState(ctx, b, l.engine.IsDirect())
-	if err != nil {
-		return diag.FromErr(err)
-	}
-
-	var diags diag.Diagnostics
-	for _, dashboard := range dashboards {
-		// Skip dashboards that are not defined in the bundle.
-		// These will be destroyed upon deployment.
-		if _, ok := b.Config.Resources.Dashboards[dashboard.Name]; !ok {
-			continue
-		}
-
-		path := dyn.MustPathFromString("resources.dashboards." + dashboard.Name)
-		loc := b.Config.GetLocation(path.String())
-		actual, err := b.WorkspaceClient(ctx).Lakeview.GetByDashboardId(ctx, dashboard.ID)
-		if err != nil {
-			diags = diags.Append(diag.Diagnostic{
-				Severity:  diag.Error,
-				Summary:   fmt.Sprintf("failed to get dashboard %q", dashboard.Name),
-				Detail:    err.Error(),
-				Paths:     []dyn.Path{path},
-				Locations: []dyn.Location{loc},
-			})
-			continue
-		}
-
-		// If the ETag is the same, the dashboard has not been modified.
-		if actual.Etag == dashboard.ETag {
-			continue
-		}
-
-		// Downgrade this to a warning in plan mode.
-		severity := diag.Error
-		if l.isPlan {
-			severity = diag.Warning
-		}
-
-		diags = diags.Append(diag.Diagnostic{
-			Severity: severity,
-			Summary:  fmt.Sprintf("dashboard %q has been modified remotely", dashboard.Name),
-			Detail: "" +
-				"This dashboard has been modified remotely since the last bundle deployment.\n" +
-				"These modifications are untracked and will be overwritten on deploy.\n" +
-				"\n" +
-				"Make sure that the local dashboard definition matches what you intend to deploy\n" +
-				"before proceeding with the deployment.\n" +
-				"\n" +
-				"Run `databricks bundle deploy --force` to bypass this error." +
-				"",
-			Paths:     []dyn.Path{path},
-			Locations: []dyn.Location{loc},
-		})
-	}
-
-	return diags
-}
-
-func CheckDashboardsModifiedRemotely(isPlan bool, engine engine.EngineType) *checkDashboardsModifiedRemotely {
-	return &checkDashboardsModifiedRemotely{isPlan: isPlan, engine: engine}
-}
diff --git a/bundle/deploy/terraform/check_dashboards_modified_remotely_test.go b/bundle/deploy/terraform/check_dashboards_modified_remotely_test.go
deleted file mode 100644
index 6270e4229fe..00000000000
--- a/bundle/deploy/terraform/check_dashboards_modified_remotely_test.go
+++ /dev/null
@@ -1,215 +0,0 @@
-package terraform
-
-import (
-	"context"
-	"errors"
-	"testing"
-
-	"github.com/databricks/cli/bundle"
-	"github.com/databricks/cli/bundle/config"
-	"github.com/databricks/cli/bundle/config/engine"
-	"github.com/databricks/cli/bundle/config/resources"
-	"github.com/databricks/cli/internal/testutil"
-	"github.com/databricks/cli/libs/diag"
-	"github.com/databricks/databricks-sdk-go/experimental/mocks"
-	"github.com/databricks/databricks-sdk-go/service/dashboards"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/mock"
-)
-
-func mockDashboardBundle(t *testing.T) *bundle.Bundle {
-	dir := t.TempDir()
-	b := &bundle.Bundle{
-		BundleRootPath: dir,
-		Config: config.Root{
-			Bundle: config.Bundle{
-				Target: "test",
-			},
-			Resources: config.Resources{
-				Dashboards: map[string]*resources.Dashboard{
-					"dash1": {
-						DashboardConfig: resources.DashboardConfig{
-							DisplayName: "My Special Dashboard",
-						},
-					},
-				},
-			},
-		},
-	}
-	return b
-}
-
-func TestCheckDashboardsModifiedRemotely_NoDashboards(t *testing.T) {
-	dir := t.TempDir()
-	b := &bundle.Bundle{
-		BundleRootPath: dir,
-		Config: config.Root{
-			Bundle: config.Bundle{
-				Target: "test",
-			},
-			Resources: config.Resources{},
-		},
-	}
-
-	diags := bundle.Apply(t.Context(), b, CheckDashboardsModifiedRemotely(false, engine.EngineTerraform))
-	assert.Empty(t, diags)
-}
-
-func TestCheckDashboardsModifiedRemotely_FirstDeployment(t *testing.T) {
-	b := mockDashboardBundle(t)
-	diags := bundle.Apply(t.Context(), b, CheckDashboardsModifiedRemotely(false, engine.EngineTerraform))
-	assert.Empty(t, diags)
-}
-
-func TestCheckDashboardsModifiedRemotely_ExistingStateNoChange(t *testing.T) {
-	ctx := t.Context()
-
-	b := mockDashboardBundle(t)
-	writeFakeDashboardState(t, ctx, b)
-
-	// Mock the call to the API.
-	m := mocks.NewMockWorkspaceClient(t)
-	dashboardsAPI := m.GetMockLakeviewAPI()
-	dashboardsAPI.EXPECT().
-		GetByDashboardId(mock.Anything, "id1").
-		Return(&dashboards.Dashboard{
-			DisplayName: "My Special Dashboard",
-			Etag:        "1000",
-		}, nil).
-		Once()
-	b.SetWorkpaceClient(m.WorkspaceClient)
-
-	// No changes, so no diags.
-	diags := bundle.Apply(ctx, b, CheckDashboardsModifiedRemotely(false, engine.EngineTerraform))
-	assert.Empty(t, diags)
-}
-
-func TestCheckDashboardsModifiedRemotely_ExistingStateChange(t *testing.T) {
-	ctx := t.Context()
-
-	b := mockDashboardBundle(t)
-	writeFakeDashboardState(t, ctx, b)
-
-	// Mock the call to the API.
-	m := mocks.NewMockWorkspaceClient(t)
-	dashboardsAPI := m.GetMockLakeviewAPI()
-	dashboardsAPI.EXPECT().
-		GetByDashboardId(mock.Anything, "id1").
-		Return(&dashboards.Dashboard{
-			DisplayName: "My Special Dashboard",
-			Etag:        "1234",
-		}, nil).
-		Once()
-	b.SetWorkpaceClient(m.WorkspaceClient)
-
-	// The dashboard has changed, so expect an error.
-	diags := bundle.Apply(ctx, b, CheckDashboardsModifiedRemotely(false, engine.EngineTerraform))
-	if assert.Len(t, diags, 1) {
-		assert.Equal(t, diag.Error, diags[0].Severity)
-		assert.Equal(t, `dashboard "dash1" has been modified remotely`, diags[0].Summary)
-	}
-}
-
-func TestCheckDashboardsModifiedRemotely_ExistingStateFailureToGet(t *testing.T) {
-	ctx := t.Context()
-
-	b := mockDashboardBundle(t)
-	writeFakeDashboardState(t, ctx, b)
-
-	// Mock the call to the API.
-	m := mocks.NewMockWorkspaceClient(t)
-	dashboardsAPI := m.GetMockLakeviewAPI()
-	dashboardsAPI.EXPECT().
-		GetByDashboardId(mock.Anything, "id1").
-		Return(nil, errors.New("failure")).
-		Once()
-	b.SetWorkpaceClient(m.WorkspaceClient)
-
-	// Unable to get the dashboard, so expect an error.
-	diags := bundle.Apply(ctx, b, CheckDashboardsModifiedRemotely(false, engine.EngineTerraform))
-	if assert.Len(t, diags, 1) {
-		assert.Equal(t, diag.Error, diags[0].Severity)
-		assert.Equal(t, `failed to get dashboard "dash1"`, diags[0].Summary)
-	}
-}
-
-func TestCheckDashboardsModifiedRemotely_ExistingStateChangePlanMode(t *testing.T) {
-	ctx := t.Context()
-
-	b := mockDashboardBundle(t)
-	writeFakeDashboardState(t, ctx, b)
-
-	// Mock the call to the API.
-	m := mocks.NewMockWorkspaceClient(t)
-	dashboardsAPI := m.GetMockLakeviewAPI()
-	dashboardsAPI.EXPECT().
-		GetByDashboardId(mock.Anything, "id1").
-		Return(&dashboards.Dashboard{
-			DisplayName: "My Special Dashboard",
-			Etag:        "1234",
-		}, nil).
-		Once()
-	b.SetWorkpaceClient(m.WorkspaceClient)
-
-	// The dashboard has changed, but in plan mode expect a warning instead of an error.
-	diags := bundle.Apply(ctx, b, CheckDashboardsModifiedRemotely(true, engine.EngineTerraform))
-	if assert.Len(t, diags, 1) {
-		assert.Equal(t, diag.Warning, diags[0].Severity)
-		assert.Equal(t, `dashboard "dash1" has been modified remotely`, diags[0].Summary)
-	}
-}
-
-func writeFakeDashboardState(t *testing.T, ctx context.Context, b *bundle.Bundle) {
-	_, path := b.StateFilenameTerraform(ctx)
-
-	// Write fake state file.
-	testutil.WriteFile(t, path, `
-    {
-      "version": 4,
-      "terraform_version": "1.5.5",
-      "resources": [
-        {
-          "mode": "managed",
-          "type": "databricks_dashboard",
-          "name": "dash1",
-          "instances": [
-            {
-              "schema_version": 0,
-              "attributes": {
-                "etag": "1000",
-                "id": "id1"
-              }
-            }
-          ]
-        },
-        {
-          "mode": "managed",
-          "type": "databricks_job",
-          "name": "job",
-          "instances": [
-            {
-              "schema_version": 0,
-              "attributes": {
-                "id": "1234"
-              }
-            }
-          ]
-        },
-        {
-          "mode": "managed",
-          "type": "databricks_dashboard",
-          "name": "dash2",
-          "instances": [
-            {
-              "schema_version": 0,
-              "attributes": {
-                "etag": "1001",
-                "id": "id2"
-              }
-            }
-          ]
-        }
-      ]
-    }
-	`)
-}
diff --git a/bundle/deploy/terraform/convert.go b/bundle/deploy/terraform/convert.go
deleted file mode 100644
index 551cbb0a762..00000000000
--- a/bundle/deploy/terraform/convert.go
+++ /dev/null
@@ -1,78 +0,0 @@
-package terraform
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/databricks/cli/bundle/config/resources"
-	"github.com/databricks/cli/bundle/deploy/terraform/tfdyn"
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-)
-
-// BundleToTerraformWithDynValue converts resources in a bundle configuration
-// to the equivalent Terraform JSON representation.
-func BundleToTerraformWithDynValue(ctx context.Context, root dyn.Value) (*schema.Root, error) {
-	tfroot := schema.NewRoot()
-	tfroot.Provider = schema.NewProviders()
-
-	// Convert each resource in the bundle to the equivalent Terraform representation.
-	dynResources, err := dyn.Get(root, "resources")
-	if err != nil {
-		// If the resources key is missing, return an empty root.
-		if dyn.IsNoSuchKeyError(err) {
-			return tfroot, nil
-		}
-		return nil, err
-	}
-
-	tfroot.Resource = schema.NewResources()
-
-	numResources := 0
-	_, err = dyn.Walk(dynResources, func(p dyn.Path, v dyn.Value) (dyn.Value, error) {
-		if len(p) < 2 {
-			return v, nil
-		}
-
-		// Skip resources that have been deleted locally.
-		modifiedStatus, err := dyn.Get(v, "modified_status")
-		if err == nil {
-			modifiedStatusStr, ok := modifiedStatus.AsString()
-			if ok && modifiedStatusStr == resources.ModifiedStatusDeleted {
-				return v, dyn.ErrSkip
-			}
-		}
-
-		typ := p[0].Key()
-		key := p[1].Key()
-
-		// Lookup the converter based on the resource type.
-		c, ok := tfdyn.GetConverter(typ)
-		if !ok {
-			return dyn.InvalidValue, fmt.Errorf("no converter for resource type %s", typ)
-		}
-
-		// Convert resource to Terraform representation.
-		err = c.Convert(ctx, key, v, tfroot.Resource)
-		if err != nil {
-			return dyn.InvalidValue, err
-		}
-
-		numResources++
-
-		// Skip traversal of the resource itself.
-		return v, dyn.ErrSkip
-	})
-	if err != nil {
-		return nil, err
-	}
-
-	// We explicitly set "resource" to nil to omit it from a JSON encoding.
-	// This is required because the terraform CLI requires >= 1 resources defined
-	// if the "resource" property is used in a .tf.json file.
-	if numResources == 0 {
-		tfroot.Resource = nil
-	}
-
-	return tfroot, nil
-}
diff --git a/bundle/deploy/terraform/convert_test.go b/bundle/deploy/terraform/convert_test.go
deleted file mode 100644
index 564340190d4..00000000000
--- a/bundle/deploy/terraform/convert_test.go
+++ /dev/null
@@ -1,598 +0,0 @@
-package terraform
-
-import (
-	"testing"
-
-	"github.com/databricks/cli/bundle/config"
-	"github.com/databricks/cli/bundle/config/resources"
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/databricks-sdk-go/service/catalog"
-	"github.com/databricks/databricks-sdk-go/service/compute"
-	"github.com/databricks/databricks-sdk-go/service/jobs"
-	"github.com/databricks/databricks-sdk-go/service/ml"
-	"github.com/databricks/databricks-sdk-go/service/pipelines"
-	"github.com/databricks/databricks-sdk-go/service/serving"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func produceTerraformConfiguration(t *testing.T, config config.Root) *schema.Root {
-	vin, err := convert.FromTyped(config, dyn.NilValue)
-	require.NoError(t, err)
-	out, err := BundleToTerraformWithDynValue(t.Context(), vin)
-	require.NoError(t, err)
-	return out
-}
-
-func convertToResourceStruct[T any](t *testing.T, resource *T, data any) {
-	require.NotNil(t, resource)
-	require.NotNil(t, data)
-
-	// Convert data to a dyn.Value.
-	vin, err := convert.FromTyped(data, dyn.NilValue)
-	require.NoError(t, err)
-
-	// Convert the dyn.Value to a struct.
-	err = convert.ToTyped(resource, vin)
-	require.NoError(t, err)
-}
-
-func TestBundleToTerraformJob(t *testing.T) {
-	src := resources.Job{
-		JobSettings: jobs.JobSettings{
-			Name: "my job",
-			JobClusters: []jobs.JobCluster{
-				{
-					JobClusterKey: "key",
-					NewCluster: compute.ClusterSpec{
-						SparkVersion: "10.4.x-scala2.12",
-					},
-				},
-			},
-			GitSource: &jobs.GitSource{
-				GitProvider: jobs.GitProviderGitHub,
-				GitUrl:      "https://github.com/foo/bar",
-			},
-			Parameters: []jobs.JobParameterDefinition{
-				{
-					Name:    "param1",
-					Default: "default1",
-				},
-				{
-					Name:    "param2",
-					Default: "default2",
-				},
-			},
-		},
-	}
-
-	config := config.Root{
-		Resources: config.Resources{
-			Jobs: map[string]*resources.Job{
-				"my_job": &src,
-			},
-		},
-	}
-
-	var resource schema.ResourceJob
-	out := produceTerraformConfiguration(t, config)
-	convertToResourceStruct(t, &resource, out.Resource.Job["my_job"])
-
-	assert.Equal(t, "my job", resource.Name)
-	assert.Len(t, resource.JobCluster, 1)
-	assert.Equal(t, "https://github.com/foo/bar", resource.GitSource.Url)
-	assert.Len(t, resource.Parameter, 2)
-	assert.Equal(t, "param1", resource.Parameter[0].Name)
-	assert.Equal(t, "param2", resource.Parameter[1].Name)
-	assert.Nil(t, out.Data)
-}
-
-func TestBundleToTerraformJobPermissions(t *testing.T) {
-	src := resources.Job{
-		Permissions: []resources.JobPermission{
-			{
-				Level:    "CAN_VIEW",
-				UserName: "jane@doe.com",
-			},
-		},
-	}
-
-	config := config.Root{
-		Resources: config.Resources{
-			Jobs: map[string]*resources.Job{
-				"my_job": &src,
-			},
-		},
-	}
-
-	var resource schema.ResourcePermissions
-	out := produceTerraformConfiguration(t, config)
-	convertToResourceStruct(t, &resource, out.Resource.Permissions["job_my_job"])
-
-	assert.NotEmpty(t, resource.JobId)
-	assert.Len(t, resource.AccessControl, 1)
-	assert.Equal(t, "jane@doe.com", resource.AccessControl[0].UserName)
-	assert.Equal(t, "CAN_VIEW", resource.AccessControl[0].PermissionLevel)
-}
-
-func TestBundleToTerraformJobTaskLibraries(t *testing.T) {
-	src := resources.Job{
-		JobSettings: jobs.JobSettings{
-			Name: "my job",
-			Tasks: []jobs.Task{
-				{
-					TaskKey: "key",
-					Libraries: []compute.Library{
-						{
-							Pypi: &compute.PythonPyPiLibrary{
-								Package: "mlflow",
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-
-	config := config.Root{
-		Resources: config.Resources{
-			Jobs: map[string]*resources.Job{
-				"my_job": &src,
-			},
-		},
-	}
-
-	var resource schema.ResourceJob
-	out := produceTerraformConfiguration(t, config)
-	convertToResourceStruct(t, &resource, out.Resource.Job["my_job"])
-
-	assert.Equal(t, "my job", resource.Name)
-	require.Len(t, resource.Task, 1)
-	require.Len(t, resource.Task[0].Library, 1)
-	assert.Equal(t, "mlflow", resource.Task[0].Library[0].Pypi.Package)
-}
-
-func TestBundleToTerraformForEachTaskLibraries(t *testing.T) {
-	src := resources.Job{
-		JobSettings: jobs.JobSettings{
-			Name: "my job",
-			Tasks: []jobs.Task{
-				{
-					TaskKey: "key",
-					ForEachTask: &jobs.ForEachTask{
-						Inputs: "[1,2,3]",
-						Task: jobs.Task{
-							TaskKey: "iteration",
-							Libraries: []compute.Library{
-								{
-									Pypi: &compute.PythonPyPiLibrary{
-										Package: "mlflow",
-									},
-								},
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-
-	config := config.Root{
-		Resources: config.Resources{
-			Jobs: map[string]*resources.Job{
-				"my_job": &src,
-			},
-		},
-	}
-
-	var resource schema.ResourceJob
-	out := produceTerraformConfiguration(t, config)
-	convertToResourceStruct(t, &resource, out.Resource.Job["my_job"])
-
-	assert.Equal(t, "my job", resource.Name)
-	require.Len(t, resource.Task, 1)
-	require.Len(t, resource.Task[0].ForEachTask.Task.Library, 1)
-	assert.Equal(t, "mlflow", resource.Task[0].ForEachTask.Task.Library[0].Pypi.Package)
-}
-
-func TestBundleToTerraformPipeline(t *testing.T) {
-	src := resources.Pipeline{
-		CreatePipeline: pipelines.CreatePipeline{
-			Name: "my pipeline",
-			Libraries: []pipelines.PipelineLibrary{
-				{
-					Notebook: &pipelines.NotebookLibrary{
-						Path: "notebook path",
-					},
-				},
-				{
-					File: &pipelines.FileLibrary{
-						Path: "file path",
-					},
-				},
-			},
-			Notifications: []pipelines.Notifications{
-				{
-					Alerts: []string{
-						"on-update-fatal-failure",
-					},
-					EmailRecipients: []string{
-						"jane@doe.com",
-					},
-				},
-				{
-					Alerts: []string{
-						"on-update-failure",
-						"on-flow-failure",
-					},
-					EmailRecipients: []string{
-						"jane@doe.com",
-						"john@doe.com",
-					},
-				},
-			},
-		},
-	}
-
-	config := config.Root{
-		Resources: config.Resources{
-			Pipelines: map[string]*resources.Pipeline{
-				"my_pipeline": &src,
-			},
-		},
-	}
-
-	var resource schema.ResourcePipeline
-	out := produceTerraformConfiguration(t, config)
-	convertToResourceStruct(t, &resource, out.Resource.Pipeline["my_pipeline"])
-
-	assert.Equal(t, "my pipeline", resource.Name)
-	assert.Len(t, resource.Library, 2)
-	assert.Len(t, resource.Notification, 2)
-	assert.Equal(t, []string{"on-update-fatal-failure"}, resource.Notification[0].Alerts)
-	assert.Equal(t, []string{"jane@doe.com"}, resource.Notification[0].EmailRecipients)
-	assert.Equal(t, []string{"on-update-failure", "on-flow-failure"}, resource.Notification[1].Alerts)
-	assert.Equal(t, []string{"jane@doe.com", "john@doe.com"}, resource.Notification[1].EmailRecipients)
-	assert.Nil(t, out.Data)
-}
-
-func TestBundleToTerraformPipelinePermissions(t *testing.T) {
-	src := resources.Pipeline{
-		Permissions: []resources.PipelinePermission{
-			{
-				Level:    "CAN_VIEW",
-				UserName: "jane@doe.com",
-			},
-		},
-	}
-
-	config := config.Root{
-		Resources: config.Resources{
-			Pipelines: map[string]*resources.Pipeline{
-				"my_pipeline": &src,
-			},
-		},
-	}
-
-	var resource schema.ResourcePermissions
-	out := produceTerraformConfiguration(t, config)
-	convertToResourceStruct(t, &resource, out.Resource.Permissions["pipeline_my_pipeline"])
-
-	assert.NotEmpty(t, resource.PipelineId)
-	assert.Len(t, resource.AccessControl, 1)
-	assert.Equal(t, "jane@doe.com", resource.AccessControl[0].UserName)
-	assert.Equal(t, "CAN_VIEW", resource.AccessControl[0].PermissionLevel)
-}
-
-func TestBundleToTerraformModel(t *testing.T) {
-	src := resources.MlflowModel{
-		CreateModelRequest: ml.CreateModelRequest{
-			Name:        "name",
-			Description: "description",
-			Tags: []ml.ModelTag{
-				{
-					Key:   "k1",
-					Value: "v1",
-				},
-				{
-					Key:   "k2",
-					Value: "v2",
-				},
-			},
-		},
-	}
-
-	config := config.Root{
-		Resources: config.Resources{
-			Models: map[string]*resources.MlflowModel{
-				"my_model": &src,
-			},
-		},
-	}
-
-	var resource schema.ResourceMlflowModel
-	out := produceTerraformConfiguration(t, config)
-	convertToResourceStruct(t, &resource, out.Resource.MlflowModel["my_model"])
-
-	assert.Equal(t, "name", resource.Name)
-	assert.Equal(t, "description", resource.Description)
-	assert.Len(t, resource.Tags, 2)
-	assert.Equal(t, "k1", resource.Tags[0].Key)
-	assert.Equal(t, "v1", resource.Tags[0].Value)
-	assert.Equal(t, "k2", resource.Tags[1].Key)
-	assert.Equal(t, "v2", resource.Tags[1].Value)
-	assert.Nil(t, out.Data)
-}
-
-func TestBundleToTerraformModelPermissions(t *testing.T) {
-	src := resources.MlflowModel{
-		CreateModelRequest: ml.CreateModelRequest{
-			Name: "name",
-		},
-		Permissions: []resources.MlflowModelPermission{
-			{
-				Level:    "CAN_READ",
-				UserName: "jane@doe.com",
-			},
-		},
-	}
-
-	config := config.Root{
-		Resources: config.Resources{
-			Models: map[string]*resources.MlflowModel{
-				"my_model": &src,
-			},
-		},
-	}
-
-	var resource schema.ResourcePermissions
-	out := produceTerraformConfiguration(t, config)
-	convertToResourceStruct(t, &resource, out.Resource.Permissions["mlflow_model_my_model"])
-
-	assert.NotEmpty(t, resource.RegisteredModelId)
-	assert.Len(t, resource.AccessControl, 1)
-	assert.Equal(t, "jane@doe.com", resource.AccessControl[0].UserName)
-	assert.Equal(t, "CAN_READ", resource.AccessControl[0].PermissionLevel)
-}
-
-func TestBundleToTerraformExperiment(t *testing.T) {
-	src := resources.MlflowExperiment{
-		CreateExperiment: ml.CreateExperiment{
-			Name: "name",
-		},
-	}
-
-	config := config.Root{
-		Resources: config.Resources{
-			Experiments: map[string]*resources.MlflowExperiment{
-				"my_experiment": &src,
-			},
-		},
-	}
-
-	var resource schema.ResourceMlflowExperiment
-	out := produceTerraformConfiguration(t, config)
-	convertToResourceStruct(t, &resource, out.Resource.MlflowExperiment["my_experiment"])
-
-	assert.Equal(t, "name", resource.Name)
-	assert.Nil(t, out.Data)
-}
-
-func TestBundleToTerraformExperimentPermissions(t *testing.T) {
-	src := resources.MlflowExperiment{
-		CreateExperiment: ml.CreateExperiment{
-			Name: "name",
-		},
-		Permissions: []resources.MlflowExperimentPermission{
-			{
-				Level:    "CAN_READ",
-				UserName: "jane@doe.com",
-			},
-		},
-	}
-
-	config := config.Root{
-		Resources: config.Resources{
-			Experiments: map[string]*resources.MlflowExperiment{
-				"my_experiment": &src,
-			},
-		},
-	}
-
-	var resource schema.ResourcePermissions
-	out := produceTerraformConfiguration(t, config)
-	convertToResourceStruct(t, &resource, out.Resource.Permissions["mlflow_experiment_my_experiment"])
-
-	assert.NotEmpty(t, resource.ExperimentId)
-	assert.Len(t, resource.AccessControl, 1)
-	assert.Equal(t, "jane@doe.com", resource.AccessControl[0].UserName)
-	assert.Equal(t, "CAN_READ", resource.AccessControl[0].PermissionLevel)
-}
-
-func TestBundleToTerraformModelServing(t *testing.T) {
-	src := resources.ModelServingEndpoint{
-		CreateServingEndpoint: serving.CreateServingEndpoint{
-			Name: "name",
-			Config: &serving.EndpointCoreConfigInput{
-				ServedModels: []serving.ServedModelInput{
-					{
-						ModelName:          "model_name",
-						ModelVersion:       "1",
-						ScaleToZeroEnabled: true,
-						WorkloadSize:       "Small",
-					},
-				},
-				TrafficConfig: &serving.TrafficConfig{
-					Routes: []serving.Route{
-						{
-							ServedModelName:   "model_name-1",
-							TrafficPercentage: 100,
-						},
-					},
-				},
-			},
-		},
-	}
-
-	config := config.Root{
-		Resources: config.Resources{
-			ModelServingEndpoints: map[string]*resources.ModelServingEndpoint{
-				"my_model_serving_endpoint": &src,
-			},
-		},
-	}
-
-	var resource schema.ResourceModelServing
-	out := produceTerraformConfiguration(t, config)
-	convertToResourceStruct(t, &resource, out.Resource.ModelServing["my_model_serving_endpoint"])
-
-	assert.Equal(t, "name", resource.Name)
-	assert.Equal(t, "model_name", resource.Config.ServedModels[0].ModelName)
-	assert.Equal(t, "1", resource.Config.ServedModels[0].ModelVersion)
-	assert.True(t, resource.Config.ServedModels[0].ScaleToZeroEnabled)
-	assert.Equal(t, "Small", resource.Config.ServedModels[0].WorkloadSize)
-	assert.Equal(t, "model_name-1", resource.Config.TrafficConfig.Routes[0].ServedModelName)
-	assert.Equal(t, 100, resource.Config.TrafficConfig.Routes[0].TrafficPercentage)
-	assert.Nil(t, out.Data)
-}
-
-func TestBundleToTerraformModelServingPermissions(t *testing.T) {
-	src := resources.ModelServingEndpoint{
-		CreateServingEndpoint: serving.CreateServingEndpoint{
-			Name: "name",
-
-			// Need to specify this to satisfy the equivalence test:
-			// The previous method of generation includes the "create" field
-			// because it is required (not marked as `omitempty`).
-			// The previous method used [json.Marshal] from the standard library
-			// and as such observed the `omitempty` tag.
-			// The new method leverages [dyn.Value] where any field that is not
-			// explicitly set is not part of the value.
-			Config: &serving.EndpointCoreConfigInput{
-				ServedModels: []serving.ServedModelInput{
-					{
-						ModelName:          "model_name",
-						ModelVersion:       "1",
-						ScaleToZeroEnabled: true,
-						WorkloadSize:       "Small",
-					},
-				},
-			},
-		},
-		Permissions: []resources.ModelServingEndpointPermission{
-			{
-				Level:    "CAN_VIEW",
-				UserName: "jane@doe.com",
-			},
-		},
-	}
-
-	config := config.Root{
-		Resources: config.Resources{
-			ModelServingEndpoints: map[string]*resources.ModelServingEndpoint{
-				"my_model_serving_endpoint": &src,
-			},
-		},
-	}
-
-	var resource schema.ResourcePermissions
-	out := produceTerraformConfiguration(t, config)
-	convertToResourceStruct(t, &resource, out.Resource.Permissions["model_serving_my_model_serving_endpoint"])
-
-	assert.NotEmpty(t, resource.ServingEndpointId)
-	assert.Len(t, resource.AccessControl, 1)
-	assert.Equal(t, "jane@doe.com", resource.AccessControl[0].UserName)
-	assert.Equal(t, "CAN_VIEW", resource.AccessControl[0].PermissionLevel)
-}
-
-func TestBundleToTerraformRegisteredModel(t *testing.T) {
-	src := resources.RegisteredModel{
-		CreateRegisteredModelRequest: catalog.CreateRegisteredModelRequest{
-			Name:        "name",
-			CatalogName: "catalog",
-			SchemaName:  "schema",
-			Comment:     "comment",
-		},
-	}
-
-	config := config.Root{
-		Resources: config.Resources{
-			RegisteredModels: map[string]*resources.RegisteredModel{
-				"my_registered_model": &src,
-			},
-		},
-	}
-
-	var resource schema.ResourceRegisteredModel
-	out := produceTerraformConfiguration(t, config)
-	convertToResourceStruct(t, &resource, out.Resource.RegisteredModel["my_registered_model"])
-
-	assert.Equal(t, "name", resource.Name)
-	assert.Equal(t, "catalog", resource.CatalogName)
-	assert.Equal(t, "schema", resource.SchemaName)
-	assert.Equal(t, "comment", resource.Comment)
-	assert.Nil(t, out.Data)
-}
-
-func TestBundleToTerraformRegisteredModelGrants(t *testing.T) {
-	src := resources.RegisteredModel{
-		CreateRegisteredModelRequest: catalog.CreateRegisteredModelRequest{
-			Name:        "name",
-			CatalogName: "catalog",
-			SchemaName:  "schema",
-		},
-		Grants: []catalog.PrivilegeAssignment{
-			{
-				Privileges: []catalog.Privilege{catalog.PrivilegeExecute},
-				Principal:  "jane@doe.com",
-			},
-		},
-	}
-
-	config := config.Root{
-		Resources: config.Resources{
-			RegisteredModels: map[string]*resources.RegisteredModel{
-				"my_registered_model": &src,
-			},
-		},
-	}
-
-	var resource schema.ResourceGrants
-	out := produceTerraformConfiguration(t, config)
-	convertToResourceStruct(t, &resource, out.Resource.Grants["registered_model_my_registered_model"])
-
-	assert.NotEmpty(t, resource.Function)
-	assert.Len(t, resource.Grant, 1)
-	assert.Equal(t, "jane@doe.com", resource.Grant[0].Principal)
-	assert.Equal(t, "EXECUTE", resource.Grant[0].Privileges[0])
-}
-
-func TestBundleToTerraformDeletedResources(t *testing.T) {
-	job1 := resources.Job{
-		JobSettings: jobs.JobSettings{},
-	}
-	job2 := resources.Job{
-		BaseResource: resources.BaseResource{ModifiedStatus: resources.ModifiedStatusDeleted},
-		JobSettings:  jobs.JobSettings{},
-	}
-	config := config.Root{
-		Resources: config.Resources{
-			Jobs: map[string]*resources.Job{
-				"my_job1": &job1,
-				"my_job2": &job2,
-			},
-		},
-	}
-
-	vin, err := convert.FromTyped(config, dyn.NilValue)
-	require.NoError(t, err)
-	out, err := BundleToTerraformWithDynValue(t.Context(), vin)
-	require.NoError(t, err)
-
-	_, ok := out.Resource.Job["my_job1"]
-	assert.True(t, ok)
-	_, ok = out.Resource.Job["my_job2"]
-	assert.False(t, ok)
-}
diff --git a/bundle/deploy/terraform/import.go b/bundle/deploy/terraform/import.go
deleted file mode 100644
index 8fdfe1212d5..00000000000
--- a/bundle/deploy/terraform/import.go
+++ /dev/null
@@ -1,115 +0,0 @@
-package terraform
-
-import (
-	"bytes"
-	"context"
-	"fmt"
-	"io"
-	"os"
-	"path/filepath"
-	"strings"
-
-	"github.com/databricks/cli/bundle"
-	"github.com/databricks/cli/libs/cmdio"
-	"github.com/databricks/cli/libs/diag"
-	"github.com/hashicorp/terraform-exec/tfexec"
-)
-
-type BindOptions struct {
-	AutoApprove  bool
-	ResourceType string
-	ResourceKey  string
-	ResourceId   string
-}
-
-type importResource struct {
-	opts *BindOptions
-}
-
-// Apply implements bundle.Mutator.
-func (m *importResource) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
-	dir, err := Dir(ctx, b)
-	if err != nil {
-		return diag.FromErr(err)
-	}
-
-	diags := Initialize(ctx, b)
-	if diags.HasError() {
-		return diags
-	}
-
-	tf := b.Terraform
-	tmpDir, err := os.MkdirTemp("", "state-*")
-	if err != nil {
-		return diag.Errorf("terraform init: %v", err)
-	}
-	relPath, _ := b.StateFilenameTerraform(ctx)
-	tmpState := filepath.Join(tmpDir, filepath.Base(relPath))
-
-	importAddress := fmt.Sprintf("%s.%s", m.opts.ResourceType, m.opts.ResourceKey)
-	err = tf.Import(ctx, importAddress, m.opts.ResourceId, tfexec.StateOut(tmpState))
-	if err != nil {
-		return diag.Errorf("terraform import: %v", err)
-	}
-
-	buf := bytes.NewBuffer(nil)
-	tf.SetStdout(buf)
-
-	//nolint:staticcheck // SA1019 We use legacy -state flag for now to plan the import changes based on temporary state file
-	changed, err := tf.Plan(ctx, tfexec.State(tmpState), tfexec.Target(importAddress))
-	if err != nil {
-		return diag.Errorf("terraform plan: %v", err)
-	}
-
-	defer os.RemoveAll(tmpDir)
-
-	if changed && !m.opts.AutoApprove {
-		output := buf.String()
-		// Remove output starting from Warning until end of output, if present.
-		if idx := strings.Index(output, "Warning:"); idx != -1 {
-			output = output[:idx]
-		}
-		cmdio.LogString(ctx, output)
-
-		if !cmdio.IsPromptSupported(ctx) {
-			return diag.Errorf("This bind operation requires user confirmation, but the current console does not support prompting. Please specify --auto-approve if you would like to skip prompts and proceed.")
-		}
-
-		ans, err := cmdio.AskYesOrNo(ctx, "Confirm import changes? Changes will be remotely applied only after running 'bundle deploy'.")
-		if err != nil {
-			return diag.FromErr(err)
-		}
-		if !ans {
-			return diag.Errorf("import aborted")
-		}
-	}
-
-	// If user confirmed changes, move the state file from temp dir to state location
-	f, err := os.Create(filepath.Join(dir, relPath))
-	if err != nil {
-		return diag.FromErr(err)
-	}
-	defer f.Close()
-
-	tmpF, err := os.Open(tmpState)
-	if err != nil {
-		return diag.FromErr(err)
-	}
-	defer tmpF.Close()
-
-	_, err = io.Copy(f, tmpF)
-	if err != nil {
-		return diag.FromErr(err)
-	}
-
-	return diags
-}
-
-// Name implements bundle.Mutator.
-func (*importResource) Name() string {
-	return "terraform.Import"
-}
-
-func Import(opts *BindOptions) bundle.Mutator {
-	return &importResource{opts: opts}
-}
diff --git a/bundle/deploy/terraform/init.go b/bundle/deploy/terraform/init.go
deleted file mode 100644
index cbabeb3fee1..00000000000
--- a/bundle/deploy/terraform/init.go
+++ /dev/null
@@ -1,381 +0,0 @@
-package terraform
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"io/fs"
-	"maps"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"runtime"
-	"slices"
-	"strings"
-
-	"github.com/databricks/cli/bundle"
-	"github.com/databricks/cli/bundle/config"
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/internal/build"
-	"github.com/databricks/cli/libs/diag"
-	"github.com/databricks/cli/libs/env"
-	"github.com/databricks/cli/libs/log"
-	"github.com/hashicorp/hc-install/product"
-	"github.com/hashicorp/terraform-exec/tfexec"
-)
-
-func findExecPath(ctx context.Context, b *bundle.Bundle, tf *config.Terraform, installer Installer) (string, error) {
-	// If set, pass it through [exec.LookPath] to resolve its absolute path.
-	if tf.ExecPath != "" {
-		execPath, err := exec.LookPath(tf.ExecPath)
-		if err != nil {
-			return "", err
-		}
-		tf.ExecPath = execPath
-		log.Debugf(ctx, "Using Terraform at %s", tf.ExecPath)
-		return tf.ExecPath, nil
-	}
-
-	// Resolve the version of the Terraform CLI to use.
-	tv, isDefault, err := GetTerraformVersion(ctx)
-	if err != nil {
-		return "", err
-	}
-
-	// Allow the user to specify the path to the Terraform CLI.
-	// If this is set, verify that the version matches the version we expect.
-	if execPathValue, ok := env.Lookup(ctx, TerraformExecPathEnv); ok {
-		tfe, err := getTerraformExec(ctx, b, execPathValue)
-		if err != nil {
-			return "", err
-		}
-
-		expectedVersion := tv.Version
-		actualVersion, _, err := tfe.Version(ctx, false)
-		if err != nil {
-			return "", fmt.Errorf("unable to execute %s: %w", TerraformExecPathEnv, err)
-		}
-
-		if !actualVersion.Equal(expectedVersion) {
-			if isDefault {
-				return "", fmt.Errorf(
-					"terraform binary at %s (from $%s) is %s but expected version is %s. Set %s to %s to continue",
-					execPathValue,
-					TerraformExecPathEnv,
-					actualVersion.String(),
-					expectedVersion.String(),
-					TerraformVersionEnv,
-					actualVersion.String(),
-				)
-			} else {
-				return "", fmt.Errorf(
-					"terraform binary at %s (from $%s) is %s but expected version is %s (from $%s). Update $%s and $%s so that versions match",
-					execPathValue,
-					TerraformExecPathEnv,
-					actualVersion.String(),
-					expectedVersion.String(),
-					TerraformVersionEnv,
-					TerraformExecPathEnv,
-					TerraformVersionEnv,
-				)
-			}
-		}
-
-		tf.ExecPath = execPathValue
-		log.Debugf(ctx, "Using Terraform from %s at %s", TerraformExecPathEnv, tf.ExecPath)
-		return tf.ExecPath, nil
-	}
-
-	binDir, err := b.LocalStateDir(ctx, "bin")
-	if err != nil {
-		return "", err
-	}
-
-	// If the execPath already exists, return it.
-	execPath := filepath.Join(binDir, product.Terraform.BinaryName())
-	_, err = os.Stat(execPath)
-	if err != nil && !errors.Is(err, fs.ErrNotExist) {
-		return "", err
-	}
-	if err == nil {
-		tf.ExecPath = execPath
-		log.Debugf(ctx, "Using Terraform at %s", tf.ExecPath)
-		return tf.ExecPath, nil
-	}
-
-	// Download Terraform to private bin directory.
-	execPath, err = installer.Install(ctx, binDir, tv.Version)
-	if err != nil {
-		return "", fmt.Errorf("error downloading Terraform: %w", err)
-	}
-
-	tf.ExecPath = execPath
-	log.Debugf(ctx, "Using Terraform at %s", tf.ExecPath)
-	return tf.ExecPath, nil
-}
-
-var envCopy = []string{
-	// Include $HOME in set of environment variables to pass along.
-	"HOME",
-
-	// Include $USERPROFILE in set of environment variables to pass along.
-	// This variable is used by Azure CLI on Windows to find stored credentials and metadata
-	"USERPROFILE",
-
-	// Include $PATH in set of environment variables to pass along.
-	// This is necessary to ensure that our Terraform provider can use the
-	// same auxiliary programs (e.g. `az`, or `gcloud`) as the CLI.
-	"PATH",
-
-	// Include $AZURE_CONFIG_DIR in set of environment variables to pass along.
-	// This is set in Azure DevOps by the AzureCLI@2 task.
-	"AZURE_CONFIG_DIR",
-
-	// Include $TF_CLI_CONFIG_FILE to override terraform provider in development.
-	// See: https://developer.hashicorp.com/terraform/cli/config/config-file#explicit-installation-method-configuration
-	"TF_CLI_CONFIG_FILE",
-
-	// Include $USE_SDK_V2_RESOURCES and $USE_SDK_V2_DATA_SOURCES, these are used to switch back from plugin framework to SDKv2.
-	// This is used for mitigation issues with resource migrated to plugin framework, as recommended here:
-	// https://registry.terraform.io/providers/databricks/databricks/latest/docs/guides/troubleshooting#plugin-framework-migration-problems
-	// It is currently a workaround for deploying quality_monitors
-	// https://github.com/databricks/terraform-provider-databricks/issues/4229#issuecomment-2520344690
-	"USE_SDK_V2_RESOURCES",
-	"USE_SDK_V2_DATA_SOURCES",
-}
-
-// This function inherits some environment variables for Terraform CLI.
-func inheritEnvVars(ctx context.Context, environ map[string]string) error {
-	for _, key := range envCopy {
-		value, ok := env.Lookup(ctx, key)
-		if ok {
-			environ[key] = value
-		}
-	}
-
-	// If there's a DATABRICKS_OIDC_TOKEN_ENV set, we need to pass the value of the environment variable defined in DATABRICKS_OIDC_TOKEN_ENV to Terraform.
-	// This is necessary to ensure that Terraform can use the same OIDC token as the CLI.
-	oidcTokenEnv, ok := env.Lookup(ctx, "DATABRICKS_OIDC_TOKEN_ENV")
-	if ok {
-		environ["DATABRICKS_OIDC_TOKEN_ENV"] = oidcTokenEnv
-	} else {
-		oidcTokenEnv = "DATABRICKS_OIDC_TOKEN"
-	}
-
-	oidcToken, ok := env.Lookup(ctx, oidcTokenEnv)
-	if ok {
-		environ[oidcTokenEnv] = oidcToken
-	}
-
-	// Pass additional Azure DevOps system variables required for OIDC authentication.
-	// These variables are used by the Databricks Go SDK to authenticate with Azure DevOps OIDC.
-	azureDevOpsVars := []string{
-		"SYSTEM_ACCESSTOKEN",
-		"SYSTEM_COLLECTIONID",
-		"SYSTEM_COLLECTIONURI",
-		"SYSTEM_DEFINITIONID",
-		"SYSTEM_HOSTTYPE",
-		"SYSTEM_JOBID",
-		"SYSTEM_OIDCREQUESTURI",
-		"SYSTEM_PLANID",
-		"SYSTEM_TEAMFOUNDATIONCOLLECTIONURI",
-		"SYSTEM_TEAMPROJECT",
-		"SYSTEM_TEAMPROJECTID",
-	}
-	for _, varName := range azureDevOpsVars {
-		if val, ok := env.Lookup(ctx, varName); ok {
-			environ[varName] = val
-		}
-	}
-
-	// Map $DATABRICKS_TF_CLI_CONFIG_FILE to $TF_CLI_CONFIG_FILE
-	// VSCode extension provides a file with the "provider_installation.filesystem_mirror" configuration.
-	// We only use it if the provider version matches the currently used version,
-	// otherwise terraform will fail to download the right version (even with unrestricted internet access).
-	configFile, err := getEnvVarWithMatchingVersion(ctx, TerraformCliConfigPathEnv, TerraformProviderVersionEnv, schema.ProviderVersion)
-	if err != nil {
-		return err
-	}
-	if configFile != "" {
-		log.Debugf(ctx, "Using Terraform CLI config from %s at %s", TerraformCliConfigPathEnv, configFile)
-		environ["TF_CLI_CONFIG_FILE"] = configFile
-	}
-
-	return nil
-}
-
-// Example: this function will return a value of TF_EXEC_PATH only if the path exists and if TF_VERSION matches the TerraformVersion.
-// This function is used for env vars set by the Databricks VSCode extension. The variables are intended to be used by the CLI
-// bundled with the Databricks VSCode extension, but users can use different CLI versions in the VSCode terminals, in which case we want to ignore
-// the variables if that CLI uses different versions of the dependencies.
-func getEnvVarWithMatchingVersion(ctx context.Context, envVarName, versionVarName, currentVersion string) (string, error) {
-	envValue := env.Get(ctx, envVarName)
-	versionValue := env.Get(ctx, versionVarName)
-
-	// return early if the environment variable is not set
-	if envValue == "" {
-		log.Debugf(ctx, "%s is not defined", envVarName)
-		return "", nil
-	}
-
-	// If the path does not exist, we return early.
-	_, err := os.Stat(envValue)
-	if err != nil {
-		if errors.Is(err, fs.ErrNotExist) {
-			log.Debugf(ctx, "%s at %s does not exist", envVarName, envValue)
-			return "", nil
-		} else {
-			return "", err
-		}
-	}
-
-	// If the version environment variable is not set, we directly return the value of the environment variable.
-	if versionValue == "" {
-		return envValue, nil
-	}
-
-	// When the version environment variable is set, we check if it matches the current version.
-	// If it does not match, we return an empty string.
-	if versionValue != currentVersion {
-		log.Debugf(ctx, "%s as %s does not match the current version %s, ignoring %s", versionVarName, versionValue, currentVersion, envVarName)
-		return "", nil
-	}
-	return envValue, nil
-}
-
-// This function sets temp dir location for terraform to use. If user does not
-// specify anything here, we fall back to a `tmp` directory in the bundle's cache
-// directory
-//
-// This is necessary to avoid trying to create temporary files in directories
-// the CLI and its dependencies do not have access to.
-//
-// see: os.TempDir for more context
-func setTempDirEnvVars(ctx context.Context, environ map[string]string, b *bundle.Bundle) error {
-	switch runtime.GOOS {
-	case "windows":
-		if v, ok := env.Lookup(ctx, "TMP"); ok {
-			environ["TMP"] = v
-		} else if v, ok := env.Lookup(ctx, "TEMP"); ok {
-			environ["TEMP"] = v
-		} else {
-			tmpDir, err := b.LocalStateDir(ctx, "tmp")
-			if err != nil {
-				return err
-			}
-			environ["TMP"] = tmpDir
-		}
-	default:
-		// If TMPDIR is not set, we let the process fall back to its default value.
-		if v, ok := env.Lookup(ctx, "TMPDIR"); ok {
-			environ["TMPDIR"] = v
-		}
-	}
-	return nil
-}
-
-// This function passes through all proxy related environment variables.
-func setProxyEnvVars(ctx context.Context, environ map[string]string, b *bundle.Bundle) error {
-	for _, v := range []string{"http_proxy", "https_proxy", "no_proxy"} {
-		// The case (upper or lower) is notoriously inconsistent for tools on Unix systems.
-		// We therefore try to read both the upper and lower case versions of the variable.
-		for _, v := range []string{strings.ToUpper(v), strings.ToLower(v)} {
-			if val, ok := env.Lookup(ctx, v); ok {
-				// Only set uppercase version of the variable.
-				environ[strings.ToUpper(v)] = val
-			}
-		}
-	}
-	return nil
-}
-
-func setUserAgentExtraEnvVar(environ map[string]string, b *bundle.Bundle) error {
-	// Add "cli" to the user agent in set by the Databricks Terraform provider.
-	// This will allow us to attribute downstream requests made by the Databricks
-	// Terraform provider to the CLI.
-	products := []string{"cli/" + build.GetInfo().Version}
-	if experimental := b.Config.Experimental; experimental != nil {
-		hasPython := experimental.Python.Resources != nil || experimental.Python.Mutators != nil
-
-		if hasPython {
-			products = append(products, "databricks-pydabs/0.7.0")
-		}
-	}
-
-	userAgentExtra := strings.Join(products, " ")
-	if userAgentExtra != "" {
-		environ["DATABRICKS_USER_AGENT_EXTRA"] = userAgentExtra
-	}
-
-	return nil
-}
-
-func getTerraformExec(ctx context.Context, b *bundle.Bundle, execPath string) (*tfexec.Terraform, error) {
-	workingDir, err := Dir(ctx, b)
-	if err != nil {
-		return nil, err
-	}
-
-	return tfexec.NewTerraform(workingDir, execPath)
-}
-
-func Initialize(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
-	tfConfig := b.Config.Bundle.Terraform
-	if tfConfig == nil {
-		tfConfig = &config.Terraform{}
-		b.Config.Bundle.Terraform = tfConfig
-	}
-
-	execPath, err := findExecPath(ctx, b, tfConfig, tfInstaller{})
-	if err != nil {
-		return diag.FromErr(err)
-	}
-
-	tfe, err := getTerraformExec(ctx, b, execPath)
-	if err != nil {
-		return diag.FromErr(err)
-	}
-
-	environ, err := b.AuthEnv(ctx)
-	if err != nil {
-		return diag.FromErr(err)
-	}
-
-	err = inheritEnvVars(ctx, environ)
-	if err != nil {
-		return diag.FromErr(err)
-	}
-
-	// Set the temporary directory environment variables
-	err = setTempDirEnvVars(ctx, environ, b)
-	if err != nil {
-		return diag.FromErr(err)
-	}
-
-	// Set the proxy related environment variables
-	err = setProxyEnvVars(ctx, environ, b)
-	if err != nil {
-		return diag.FromErr(err)
-	}
-
-	err = setUserAgentExtraEnvVar(environ, b)
-	if err != nil {
-		return diag.FromErr(err)
-	}
-
-	// Configure environment variables for auth for Terraform to use.
-	log.Debugf(ctx, "Environment variables for Terraform: %s", strings.Join(slices.Collect(maps.Keys(environ)), ", "))
-	err = tfe.SetEnv(environ)
-	if err != nil {
-		return diag.FromErr(err)
-	}
-
-	err = tfe.Init(ctx, tfexec.Upgrade(true))
-	if err != nil {
-		return diag.Errorf("terraform init: %v", err)
-	}
-
-	b.Terraform = tfe
-
-	return nil
-}
diff --git a/bundle/deploy/terraform/init_test.go b/bundle/deploy/terraform/init_test.go
deleted file mode 100644
index 323d073f813..00000000000
--- a/bundle/deploy/terraform/init_test.go
+++ /dev/null
@@ -1,718 +0,0 @@
-package terraform
-
-import (
-	"context"
-	"fmt"
-	"maps"
-	"os"
-	"path/filepath"
-	"runtime"
-	"slices"
-	"strings"
-	"testing"
-
-	"github.com/databricks/cli/bundle"
-	"github.com/databricks/cli/bundle/config"
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/internal/testutil"
-	"github.com/databricks/cli/libs/env"
-	"github.com/hashicorp/go-version"
-	"github.com/hashicorp/hc-install/product"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func unsetEnv(t *testing.T, name string) {
-	t.Setenv(name, "")
-	err := os.Unsetenv(name)
-	require.NoError(t, err)
-}
-
-func TestSetTempDirEnvVarsForUnixWithTmpDirSet(t *testing.T) {
-	if runtime.GOOS != "darwin" && runtime.GOOS != "linux" {
-		t.SkipNow()
-	}
-
-	b := &bundle.Bundle{
-		BundleRootPath: t.TempDir(),
-		Config: config.Root{
-			Bundle: config.Bundle{
-				Target: "whatever",
-			},
-		},
-	}
-
-	// Set TMPDIR environment variable
-	t.Setenv("TMPDIR", "/foo/bar")
-
-	// compute env
-	env := make(map[string]string, 0)
-	err := setTempDirEnvVars(t.Context(), env, b)
-	require.NoError(t, err)
-
-	// Assert that we pass through TMPDIR.
-	assert.Equal(t, map[string]string{
-		"TMPDIR": "/foo/bar",
-	}, env)
-}
-
-func TestSetTempDirEnvVarsForUnixWithTmpDirNotSet(t *testing.T) {
-	if runtime.GOOS != "darwin" && runtime.GOOS != "linux" {
-		t.SkipNow()
-	}
-
-	b := &bundle.Bundle{
-		BundleRootPath: t.TempDir(),
-		Config: config.Root{
-			Bundle: config.Bundle{
-				Target: "whatever",
-			},
-		},
-	}
-
-	// Unset TMPDIR environment variable confirm it's not set
-	unsetEnv(t, "TMPDIR")
-
-	// compute env
-	env := make(map[string]string, 0)
-	err := setTempDirEnvVars(t.Context(), env, b)
-	require.NoError(t, err)
-
-	// Assert that we don't pass through TMPDIR.
-	assert.Equal(t, map[string]string{}, env)
-}
-
-func TestSetTempDirEnvVarsForWindowWithAllTmpDirEnvVarsSet(t *testing.T) {
-	if runtime.GOOS != "windows" {
-		t.SkipNow()
-	}
-
-	b := &bundle.Bundle{
-		BundleRootPath: t.TempDir(),
-		Config: config.Root{
-			Bundle: config.Bundle{
-				Target: "whatever",
-			},
-		},
-	}
-
-	// Set environment variables
-	t.Setenv("TMP", "c:\\foo\\a")
-	t.Setenv("TEMP", "c:\\foo\\b")
-	t.Setenv("USERPROFILE", "c:\\foo\\c")
-
-	// compute env
-	env := make(map[string]string, 0)
-	err := setTempDirEnvVars(t.Context(), env, b)
-	require.NoError(t, err)
-
-	// assert that we pass through the highest priority env var value
-	assert.Equal(t, map[string]string{
-		"TMP": "c:\\foo\\a",
-	}, env)
-}
-
-func TestSetTempDirEnvVarsForWindowWithUserProfileAndTempSet(t *testing.T) {
-	if runtime.GOOS != "windows" {
-		t.SkipNow()
-	}
-
-	b := &bundle.Bundle{
-		BundleRootPath: t.TempDir(),
-		Config: config.Root{
-			Bundle: config.Bundle{
-				Target: "whatever",
-			},
-		},
-	}
-
-	// Set environment variables
-	unsetEnv(t, "TMP")
-	t.Setenv("TEMP", "c:\\foo\\b")
-	t.Setenv("USERPROFILE", "c:\\foo\\c")
-
-	// compute env
-	env := make(map[string]string, 0)
-	err := setTempDirEnvVars(t.Context(), env, b)
-	require.NoError(t, err)
-
-	// assert that we pass through the highest priority env var value
-	assert.Equal(t, map[string]string{
-		"TEMP": "c:\\foo\\b",
-	}, env)
-}
-
-func TestSetTempDirEnvVarsForWindowsWithoutAnyTempDirEnvVarsSet(t *testing.T) {
-	if runtime.GOOS != "windows" {
-		t.SkipNow()
-	}
-
-	b := &bundle.Bundle{
-		BundleRootPath: t.TempDir(),
-		Config: config.Root{
-			Bundle: config.Bundle{
-				Target: "whatever",
-			},
-		},
-	}
-
-	// unset all env vars
-	unsetEnv(t, "TMP")
-	unsetEnv(t, "TEMP")
-	unsetEnv(t, "USERPROFILE")
-
-	// compute env
-	env := make(map[string]string, 0)
-	err := setTempDirEnvVars(t.Context(), env, b)
-	require.NoError(t, err)
-
-	// assert TMP is set to b.LocalStateDir("tmp")
-	tmpDir, err := b.LocalStateDir(t.Context(), "tmp")
-	require.NoError(t, err)
-	assert.Equal(t, map[string]string{
-		"TMP": tmpDir,
-	}, env)
-}
-
-func TestSetProxyEnvVars(t *testing.T) {
-	b := &bundle.Bundle{
-		BundleRootPath: t.TempDir(),
-		Config: config.Root{
-			Bundle: config.Bundle{
-				Target: "whatever",
-			},
-		},
-	}
-
-	// Temporarily clear environment variables.
-	clearEnv := func() {
-		for _, v := range []string{"http_proxy", "https_proxy", "no_proxy"} {
-			for _, v := range []string{strings.ToUpper(v), strings.ToLower(v)} {
-				t.Setenv(v, "foo")
-				os.Unsetenv(v)
-			}
-		}
-	}
-
-	// No proxy env vars set.
-	clearEnv()
-	env := make(map[string]string, 0)
-	err := setProxyEnvVars(t.Context(), env, b)
-	require.NoError(t, err)
-	assert.Empty(t, env)
-
-	// Lower case set.
-	clearEnv()
-	t.Setenv("http_proxy", "foo")
-	t.Setenv("https_proxy", "foo")
-	t.Setenv("no_proxy", "foo")
-	env = make(map[string]string, 0)
-	err = setProxyEnvVars(t.Context(), env, b)
-	require.NoError(t, err)
-	assert.ElementsMatch(t, []string{"HTTP_PROXY", "HTTPS_PROXY", "NO_PROXY"}, slices.Collect(maps.Keys(env)))
-
-	// Upper case set.
-	clearEnv()
-	t.Setenv("HTTP_PROXY", "foo")
-	t.Setenv("HTTPS_PROXY", "foo")
-	t.Setenv("NO_PROXY", "foo")
-	env = make(map[string]string, 0)
-	err = setProxyEnvVars(t.Context(), env, b)
-	require.NoError(t, err)
-	assert.ElementsMatch(t, []string{"HTTP_PROXY", "HTTPS_PROXY", "NO_PROXY"}, slices.Collect(maps.Keys(env)))
-}
-
-func TestSetUserAgentExtra_Python(t *testing.T) {
-	b := &bundle.Bundle{
-		BundleRootPath: t.TempDir(),
-		Config: config.Root{
-			Experimental: &config.Experimental{
-				Python: config.Python{
-					Resources: []string{"my_project.resources:load_resources"},
-				},
-			},
-		},
-	}
-
-	env := make(map[string]string, 0)
-	err := setUserAgentExtraEnvVar(env, b)
-	require.NoError(t, err)
-	assert.Equal(t, map[string]string{
-		"DATABRICKS_USER_AGENT_EXTRA": "cli/0.0.0-dev databricks-pydabs/0.7.0",
-	}, env)
-}
-
-func TestInheritEnvVars(t *testing.T) {
-	t.Setenv("HOME", "/home/testuser")
-	t.Setenv("PATH", "/foo:/bar")
-	t.Setenv("TF_CLI_CONFIG_FILE", "/tmp/config.tfrc")
-	t.Setenv("AZURE_CONFIG_DIR", "/tmp/foo/bar")
-
-	ctx := t.Context()
-	env := map[string]string{}
-	err := inheritEnvVars(ctx, env)
-	if assert.NoError(t, err) {
-		assert.Equal(t, "/home/testuser", env["HOME"])
-		assert.Equal(t, "/foo:/bar", env["PATH"])
-		assert.Equal(t, "/tmp/config.tfrc", env["TF_CLI_CONFIG_FILE"])
-		assert.Equal(t, "/tmp/foo/bar", env["AZURE_CONFIG_DIR"])
-	}
-}
-
-func TestInheritOIDCTokenEnvCustom(t *testing.T) {
-	t.Setenv("DATABRICKS_OIDC_TOKEN_ENV", "custom_DATABRICKS_OIDC_TOKEN")
-	t.Setenv("custom_DATABRICKS_OIDC_TOKEN", "foobar")
-
-	ctx := t.Context()
-	env := map[string]string{}
-	err := inheritEnvVars(ctx, env)
-	require.NoError(t, err)
-	assert.Equal(t, "foobar", env["custom_DATABRICKS_OIDC_TOKEN"])
-	assert.Equal(t, "custom_DATABRICKS_OIDC_TOKEN", env["DATABRICKS_OIDC_TOKEN_ENV"])
-}
-
-func TestInheritOIDCTokenEnv(t *testing.T) {
-	t.Setenv("DATABRICKS_OIDC_TOKEN", "foobar")
-
-	ctx := t.Context()
-	env := map[string]string{}
-	err := inheritEnvVars(ctx, env)
-	require.NoError(t, err)
-	assert.Equal(t, "foobar", env["DATABRICKS_OIDC_TOKEN"])
-	assert.Equal(t, "", env["DATABRICKS_OIDC_TOKEN_ENV"])
-}
-
-func TestInheritAzureDevOpsSystemVariablesIndividual(t *testing.T) {
-	testCases := []struct {
-		envVar   string
-		envValue string
-	}{
-		{"SYSTEM_ACCESSTOKEN", "test-token"},
-		{"SYSTEM_COLLECTIONID", "collection-id-456"},
-		{"SYSTEM_COLLECTIONURI", "https://dev.azure.com/myorg/"},
-		{"SYSTEM_DEFINITIONID", "42"},
-		{"SYSTEM_HOSTTYPE", "build"},
-		{"SYSTEM_JOBID", "job-123"},
-		{"SYSTEM_OIDCREQUESTURI", "https://oidc.example.com"},
-		{"SYSTEM_PLANID", "plan-id-123"},
-		{"SYSTEM_TEAMFOUNDATIONCOLLECTIONURI", "https://dev.azure.com/org/"},
-		{"SYSTEM_TEAMPROJECT", "my-project"},
-		{"SYSTEM_TEAMPROJECTID", "project-id-789"},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.envVar, func(t *testing.T) {
-			t.Setenv(tc.envVar, tc.envValue)
-
-			ctx := t.Context()
-			env := map[string]string{}
-			err := inheritEnvVars(ctx, env)
-			require.NoError(t, err)
-			assert.Equal(t, tc.envValue, env[tc.envVar])
-		})
-	}
-}
-
-func TestInheritAzureDevOpsSystemVariables(t *testing.T) {
-	// Set all Azure DevOps system variables
-	vars := map[string]string{
-		"SYSTEM_ACCESSTOKEN":                 "test-token",
-		"SYSTEM_COLLECTIONID":                "collection-id-456",
-		"SYSTEM_COLLECTIONURI":               "https://dev.azure.com/myorg/",
-		"SYSTEM_DEFINITIONID":                "42",
-		"SYSTEM_HOSTTYPE":                    "build",
-		"SYSTEM_JOBID":                       "job-123",
-		"SYSTEM_OIDCREQUESTURI":              "https://oidc.example.com",
-		"SYSTEM_PLANID":                      "plan-id-123",
-		"SYSTEM_TEAMFOUNDATIONCOLLECTIONURI": "https://dev.azure.com/org/",
-		"SYSTEM_TEAMPROJECT":                 "my-project",
-		"SYSTEM_TEAMPROJECTID":               "project-id-789",
-	}
-
-	for k, v := range vars {
-		t.Setenv(k, v)
-	}
-
-	ctx := t.Context()
-	env := map[string]string{}
-	err := inheritEnvVars(ctx, env)
-	require.NoError(t, err)
-
-	for k, v := range vars {
-		assert.Equal(t, v, env[k])
-	}
-}
-
-func TestSetUserProfileFromInheritEnvVars(t *testing.T) {
-	t.Setenv("USERPROFILE", "c:\\foo\\c")
-
-	env := make(map[string]string, 0)
-	err := inheritEnvVars(t.Context(), env)
-	require.NoError(t, err)
-
-	assert.Contains(t, env, "USERPROFILE")
-	assert.Equal(t, "c:\\foo\\c", env["USERPROFILE"])
-}
-
-func TestInheritEnvVarsWithAbsentTFConfigFile(t *testing.T) {
-	ctx := t.Context()
-	envMap := map[string]string{}
-	ctx = env.Set(ctx, "DATABRICKS_TF_PROVIDER_VERSION", schema.ProviderVersion)
-	ctx = env.Set(ctx, "DATABRICKS_TF_CLI_CONFIG_FILE", "/tmp/config.tfrc")
-	err := inheritEnvVars(ctx, envMap)
-	require.NoError(t, err)
-	require.NotContains(t, envMap, "TF_CLI_CONFIG_FILE")
-}
-
-func TestInheritEnvVarsWithWrongTFProviderVersion(t *testing.T) {
-	ctx := t.Context()
-	envMap := map[string]string{}
-	configFile := createTempFile(t, t.TempDir(), "config.tfrc", false)
-	ctx = env.Set(ctx, "DATABRICKS_TF_PROVIDER_VERSION", "wrong")
-	ctx = env.Set(ctx, "DATABRICKS_TF_CLI_CONFIG_FILE", configFile)
-	err := inheritEnvVars(ctx, envMap)
-	require.NoError(t, err)
-	require.NotContains(t, envMap, "TF_CLI_CONFIG_FILE")
-}
-
-func TestInheritEnvVarsWithCorrectTFCLIConfigFile(t *testing.T) {
-	ctx := t.Context()
-	envMap := map[string]string{}
-	configFile := createTempFile(t, t.TempDir(), "config.tfrc", false)
-	ctx = env.Set(ctx, "DATABRICKS_TF_PROVIDER_VERSION", schema.ProviderVersion)
-	ctx = env.Set(ctx, "DATABRICKS_TF_CLI_CONFIG_FILE", configFile)
-	err := inheritEnvVars(ctx, envMap)
-	require.NoError(t, err)
-	require.Contains(t, envMap, "TF_CLI_CONFIG_FILE")
-	require.Equal(t, configFile, envMap["TF_CLI_CONFIG_FILE"])
-}
-
-func createFakeTerraformBinary(t *testing.T, dest, version string) string {
-	binPath := filepath.Join(dest, product.Terraform.BinaryName())
-	jsonPayload := fmt.Sprintf(`{
-  "terraform_version": "%s",
-  "provider_selections": {}
-}
-`, version)
-
-	if runtime.GOOS == "windows" {
-		// Create stub with .exe that cannot be executed.
-		// We need it because the implementation looks for this file to see if it is cached.
-		createFakeTerraformBinaryWindows(t, binPath, jsonPayload, version)
-		// Create stub with .bat that can be executed.
-		// We use this path when setting the DATABRICKS_TF_EXEC_PATH environment variable.
-		createFakeTerraformBinaryWindows(t, binPath+".bat", jsonPayload, version)
-		// Return the .bat file that can be executed.
-		return binPath + ".bat"
-	} else {
-		return createFakeTerraformBinaryOther(t, binPath, jsonPayload, version)
-	}
-}
-
-func createFakeTerraformBinaryWindows(t *testing.T, binPath, jsonPayload, version string) string {
-	f, err := os.Create(binPath)
-	require.NoError(t, err)
-	defer func() {
-		err = f.Close()
-		require.NoError(t, err)
-	}()
-	// Write the payload to a temp file and type it, to avoid escaping issues
-	tmpJsonPath := filepath.Join(t.TempDir(), "payload.json")
-	err = os.WriteFile(tmpJsonPath, []byte(jsonPayload), 0o644)
-	require.NoError(t, err)
-	_, err = fmt.Fprintf(f, `@echo off
-REM This is a fake Terraform binary that returns the JSON payload.
-REM It stubs version %s.
-type "%s"
-`, version, tmpJsonPath)
-	require.NoError(t, err)
-	return binPath
-}
-
-func createFakeTerraformBinaryOther(t *testing.T, binPath, jsonPayload, version string) string {
-	f, err := os.Create(binPath)
-	require.NoError(t, err)
-	defer func() {
-		err = f.Close()
-		require.NoError(t, err)
-	}()
-	err = f.Chmod(0o777)
-	require.NoError(t, err)
-	_, err = fmt.Fprintf(f, `#!/bin/sh
-# This is a fake Terraform binary that returns the JSON payload.
-# It stubs version %s.
-cat <<EOF
-%sEOF
-`, version, jsonPayload)
-	require.NoError(t, err)
-	return binPath
-}
-
-type testInstaller struct {
-	t *testing.T
-}
-
-func (i testInstaller) Install(ctx context.Context, dir string, version *version.Version) (string, error) {
-	return createFakeTerraformBinary(i.t, dir, version.String()), nil
-}
-
-func TestFindExecPath_NoBinary(t *testing.T) {
-	ctx := t.Context()
-	b := &bundle.Bundle{
-		BundleRootPath: t.TempDir(),
-		Config: config.Root{
-			Bundle: config.Bundle{
-				Target:    "whatever",
-				Terraform: &config.Terraform{},
-			},
-		},
-	}
-
-	// Verify that the binary for the default version is downloaded.
-	_, err := findExecPath(ctx, b, b.Config.Bundle.Terraform, testInstaller{t})
-	require.NoError(t, err)
-	assert.Contains(t, testutil.ReadFile(t, b.Config.Bundle.Terraform.ExecPath), "1.5.5")
-}
-
-func TestFindExecPath_UseExistingBinary(t *testing.T) {
-	ctx := t.Context()
-	b := &bundle.Bundle{
-		BundleRootPath: t.TempDir(),
-		Config: config.Root{
-			Bundle: config.Bundle{
-				Target:    "whatever",
-				Terraform: &config.Terraform{},
-			},
-		},
-	}
-
-	// Create a pre-existing Terraform binary to avoid downloading it
-	cacheDir, _ := b.LocalStateDir(ctx, "bin")
-	createFakeTerraformBinary(t, cacheDir, "1.2.3")
-
-	// Verify that the pre-existing Terraform binary is used.
-	_, err := findExecPath(ctx, b, b.Config.Bundle.Terraform, testInstaller{t})
-	require.NoError(t, err)
-	assert.Contains(t, testutil.ReadFile(t, b.Config.Bundle.Terraform.ExecPath), "1.2.3")
-}
-
-func TestFindExecPath_ExecPathWrongVersion(t *testing.T) {
-	ctx := t.Context()
-	b := &bundle.Bundle{
-		BundleRootPath: t.TempDir(),
-		Config: config.Root{
-			Bundle: config.Bundle{
-				Target:    "whatever",
-				Terraform: &config.Terraform{},
-			},
-		},
-	}
-
-	// Configure a valid exec path.
-	version := "1.2.4"
-	execPath := createFakeTerraformBinary(t, t.TempDir(), version)
-	ctx = env.Set(ctx, "DATABRICKS_TF_EXEC_PATH", execPath)
-
-	// Verify that the error is returned.
-	expected := []string{
-		`terraform binary at ` + execPath + ` (from $DATABRICKS_TF_EXEC_PATH) is ` + version + ` but expected version is ` + defaultTerraformVersion.Version.String() + `.`,
-		`Set DATABRICKS_TF_VERSION to ` + version + ` to continue`,
-	}
-	_, err := findExecPath(ctx, b, b.Config.Bundle.Terraform, testInstaller{t})
-	require.ErrorContains(t, err, strings.Join(expected, " "))
-}
-
-func TestFindExecPath_ExecPathMatchingVersion(t *testing.T) {
-	ctx := t.Context()
-	b := &bundle.Bundle{
-		BundleRootPath: t.TempDir(),
-		Config: config.Root{
-			Bundle: config.Bundle{
-				Target:    "whatever",
-				Terraform: &config.Terraform{},
-			},
-		},
-	}
-
-	// Configure a valid exec path.
-	execPath := createFakeTerraformBinary(t, t.TempDir(), defaultTerraformVersion.Version.String())
-	ctx = env.Set(ctx, "DATABRICKS_TF_EXEC_PATH", execPath)
-
-	// Verify that the pre-existing Terraform binary is used.
-	_, err := findExecPath(ctx, b, b.Config.Bundle.Terraform, testInstaller{t})
-	require.NoError(t, err)
-	assert.Equal(t, execPath, b.Config.Bundle.Terraform.ExecPath)
-}
-
-func TestFindExecPath_Version_NoExecPath(t *testing.T) {
-	ctx := t.Context()
-	b := &bundle.Bundle{
-		BundleRootPath: t.TempDir(),
-		Config: config.Root{
-			Bundle: config.Bundle{
-				Target:    "whatever",
-				Terraform: &config.Terraform{},
-			},
-		},
-	}
-
-	// Configure a fake version.
-	version := "1.2.3"
-	ctx = env.Set(ctx, "DATABRICKS_TF_VERSION", version)
-
-	// Verify that the binary for the default version is downloaded.
-	_, err := findExecPath(ctx, b, b.Config.Bundle.Terraform, testInstaller{t})
-	require.NoError(t, err)
-	assert.Contains(t, testutil.ReadFile(t, b.Config.Bundle.Terraform.ExecPath), version)
-}
-
-func TestFindExecPath_Version_ExecPathBadFile(t *testing.T) {
-	ctx := t.Context()
-	b := &bundle.Bundle{
-		BundleRootPath: t.TempDir(),
-		Config: config.Root{
-			Bundle: config.Bundle{
-				Target:    "whatever",
-				Terraform: &config.Terraform{},
-			},
-		},
-	}
-
-	// Configure a fake version.
-	version := "1.2.3"
-	ctx = env.Set(ctx, "DATABRICKS_TF_VERSION", version)
-
-	// Configure an invalid exec path.
-	ctx = env.Set(ctx, "DATABRICKS_TF_EXEC_PATH", "/tmp/terraform")
-
-	// Verify that the error is returned.
-	_, err := findExecPath(ctx, b, b.Config.Bundle.Terraform, testInstaller{t})
-	require.ErrorContains(t, err, "unable to execute DATABRICKS_TF_EXEC_PATH:")
-}
-
-func TestFindExecPath_Version_ExecPathWrongVersion(t *testing.T) {
-	ctx := t.Context()
-	b := &bundle.Bundle{
-		BundleRootPath: t.TempDir(),
-		Config: config.Root{
-			Bundle: config.Bundle{
-				Target:    "whatever",
-				Terraform: &config.Terraform{},
-			},
-		},
-	}
-
-	// Configure a fake version.
-	version := "1.2.3"
-	ctx = env.Set(ctx, "DATABRICKS_TF_VERSION", version)
-
-	// Configure a valid exec path.
-	execPath := createFakeTerraformBinary(t, t.TempDir(), "1.2.4")
-	ctx = env.Set(ctx, "DATABRICKS_TF_EXEC_PATH", execPath)
-
-	// Verify that the error is returned.
-	expected := []string{
-		`terraform binary at ` + execPath + ` (from $DATABRICKS_TF_EXEC_PATH) is 1.2.4 but expected version is 1.2.3 (from $DATABRICKS_TF_VERSION).`,
-		`Update $DATABRICKS_TF_EXEC_PATH and $DATABRICKS_TF_VERSION so that versions match`,
-	}
-	_, err := findExecPath(ctx, b, b.Config.Bundle.Terraform, testInstaller{t})
-	require.ErrorContains(t, err, strings.Join(expected, " "))
-}
-
-func TestFindExecPath_Version_ExecPathMatchingVersion(t *testing.T) {
-	ctx := t.Context()
-	b := &bundle.Bundle{
-		BundleRootPath: t.TempDir(),
-		Config: config.Root{
-			Bundle: config.Bundle{
-				Target:    "whatever",
-				Terraform: &config.Terraform{},
-			},
-		},
-	}
-
-	// Configure a fake version.
-	otherVersion := "1.2.3"
-	ctx = env.Set(ctx, "DATABRICKS_TF_VERSION", otherVersion)
-
-	// Configure a valid exec path.
-	execPath := createFakeTerraformBinary(t, t.TempDir(), otherVersion)
-	ctx = env.Set(ctx, "DATABRICKS_TF_EXEC_PATH", execPath)
-
-	// Verify that the specified Terraform binary is used.
-	_, err := findExecPath(ctx, b, b.Config.Bundle.Terraform, testInstaller{t})
-	require.NoError(t, err)
-	require.Equal(t, execPath, b.Config.Bundle.Terraform.ExecPath)
-}
-
-func createTempFile(t *testing.T, dest, name string, executable bool) string {
-	binPath := filepath.Join(dest, name)
-	f, err := os.Create(binPath)
-	require.NoError(t, err)
-	defer func() {
-		err = f.Close()
-		require.NoError(t, err)
-	}()
-	if executable {
-		err = f.Chmod(0o777)
-		require.NoError(t, err)
-	}
-	return binPath
-}
-
-func TestGetEnvVarWithMatchingVersion(t *testing.T) {
-	envVarName := "FOO"
-	versionVarName := "FOO_VERSION"
-
-	tmp := t.TempDir()
-	file := testutil.Touch(t, tmp, "bar")
-
-	tc := []struct {
-		envValue       string
-		versionValue   string
-		currentVersion string
-		expected       string
-	}{
-		{
-			envValue:       file,
-			versionValue:   "1.2.3",
-			currentVersion: "1.2.3",
-			expected:       file,
-		},
-		{
-			envValue:       "does-not-exist",
-			versionValue:   "1.2.3",
-			currentVersion: "1.2.3",
-			expected:       "",
-		},
-		{
-			envValue:       file,
-			versionValue:   "1.2.3",
-			currentVersion: "1.2.4",
-			expected:       "",
-		},
-		{
-			envValue:       "",
-			versionValue:   "1.2.3",
-			currentVersion: "1.2.3",
-			expected:       "",
-		},
-		{
-			envValue:       file,
-			versionValue:   "",
-			currentVersion: "1.2.3",
-			expected:       file,
-		},
-	}
-
-	for _, c := range tc {
-		t.Run("", func(t *testing.T) {
-			t.Setenv(envVarName, c.envValue)
-			t.Setenv(versionVarName, c.versionValue)
-
-			actual, err := getEnvVarWithMatchingVersion(t.Context(), envVarName, versionVarName, c.currentVersion)
-			require.NoError(t, err)
-			assert.Equal(t, c.expected, actual)
-		})
-	}
-}
diff --git a/bundle/deploy/terraform/install.go b/bundle/deploy/terraform/install.go
deleted file mode 100644
index 09412d9031e..00000000000
--- a/bundle/deploy/terraform/install.go
+++ /dev/null
@@ -1,31 +0,0 @@
-package terraform
-
-import (
-	"context"
-	"time"
-
-	"github.com/hashicorp/go-version"
-	"github.com/hashicorp/hc-install/product"
-	"github.com/hashicorp/hc-install/releases"
-)
-
-// Installer is an interface that can be used to install a Terraform binary.
-// It exists to facilitate testing.
-type Installer interface {
-	Install(ctx context.Context, dir string, version *version.Version) (string, error)
-}
-
-// tfInstaller is a real installer that uses the HashiCorp installer library.
-type tfInstaller struct{}
-
-// Install installs a Terraform binary using the HashiCorp installer library.
-func (i tfInstaller) Install(ctx context.Context, dir string, version *version.Version) (string, error) {
-	installer := &releases.ExactVersion{
-		Product:          product.Terraform,
-		Version:          version,
-		InstallDir:       dir,
-		Timeout:          1 * time.Minute,
-		ArmoredPublicKey: hashicorpPublicKey,
-	}
-	return installer.Install(ctx)
-}
diff --git a/bundle/deploy/terraform/interpolate.go b/bundle/deploy/terraform/interpolate.go
deleted file mode 100644
index fdcb671bdd3..00000000000
--- a/bundle/deploy/terraform/interpolate.go
+++ /dev/null
@@ -1,78 +0,0 @@
-package terraform
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/databricks/cli/bundle"
-	"github.com/databricks/cli/libs/diag"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/dynvar"
-)
-
-type interpolateMutator struct{}
-
-// isPostgresResource returns true if the resource type is a postgres resource.
-// Postgres resources use "name" instead of "id" as their identifier attribute.
-func isPostgresResource(resourceType string) bool {
-	switch resourceType {
-	case "postgres_projects", "postgres_branches", "postgres_endpoints":
-		return true
-	default:
-		return false
-	}
-}
-
-func Interpolate() bundle.Mutator {
-	return &interpolateMutator{}
-}
-
-func (m *interpolateMutator) Name() string {
-	return "terraform.Interpolate"
-}
-
-func (m *interpolateMutator) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
-	err := b.Config.Mutate(func(root dyn.Value) (dyn.Value, error) {
-		prefix := dyn.MustPathFromString("resources")
-
-		// Resolve variable references in all values.
-		return dynvar.Resolve(root, func(path dyn.Path) (dyn.Value, error) {
-			// Expect paths of the form:
-			//   - resources.<resource_type>.<resource_name>.<field>...
-			if !path.HasPrefix(prefix) || len(path) < 4 {
-				return dyn.InvalidValue, dynvar.ErrSkipResolution
-			}
-
-			// Rewrite the bundle configuration path:
-			//
-			//   ${resources.pipelines.my_pipeline.id}
-			//
-			// into the Terraform-compatible resource identifier:
-			//
-			//   ${databricks_pipeline.my_pipeline.id}
-			//
-			resourceType := path[1].Key()
-			tfResourceName, ok := GroupToTerraformName[resourceType]
-			if !ok {
-				// Trigger "key not found" for unknown resource types.
-				return dyn.GetByPath(root, path)
-			}
-
-			// Replace the resource type with the Terraform resource name.
-			path = dyn.NewPath(dyn.Key(tfResourceName)).Append(path[2:]...)
-
-			// Postgres resources use "name" (resource path) instead of "id" as the identifier.
-			// Map .id references to .name for these resources so cross-resource references
-			// (like branch.parent -> project) resolve to the resource path format.
-			if isPostgresResource(resourceType) && len(path) >= 3 {
-				if lastKey := path[len(path)-1].Key(); lastKey == "id" {
-					path = path[:len(path)-1].Append(dyn.Key("name"))
-				}
-			}
-
-			return dyn.V(fmt.Sprintf("${%s}", path.String())), nil
-		})
-	})
-
-	return diag.FromErr(err)
-}
diff --git a/bundle/deploy/terraform/interpolate_test.go b/bundle/deploy/terraform/interpolate_test.go
deleted file mode 100644
index 5d45b4d8fb6..00000000000
--- a/bundle/deploy/terraform/interpolate_test.go
+++ /dev/null
@@ -1,136 +0,0 @@
-package terraform
-
-import (
-	"testing"
-
-	"github.com/databricks/cli/bundle"
-	"github.com/databricks/cli/bundle/config"
-	"github.com/databricks/cli/bundle/config/resources"
-	"github.com/databricks/databricks-sdk-go/service/jobs"
-	"github.com/databricks/databricks-sdk-go/service/ml"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestInterpolate(t *testing.T) {
-	b := &bundle.Bundle{
-		Config: config.Root{
-			Bundle: config.Bundle{
-				Name: "example",
-			},
-			Resources: config.Resources{
-				Jobs: map[string]*resources.Job{
-					"my_job": {
-						JobSettings: jobs.JobSettings{
-							Tags: map[string]string{
-								"other_pipeline":         "${resources.pipelines.other_pipeline.id}",
-								"other_job":              "${resources.jobs.other_job.id}",
-								"other_model":            "${resources.models.other_model.id}",
-								"other_experiment":       "${resources.experiments.other_experiment.id}",
-								"other_model_serving":    "${resources.model_serving_endpoints.other_model_serving.id}",
-								"other_registered_model": "${resources.registered_models.other_registered_model.id}",
-								"other_schema":           "${resources.schemas.other_schema.id}",
-								"other_volume":           "${resources.volumes.other_volume.id}",
-								"other_cluster":          "${resources.clusters.other_cluster.id}",
-								"other_dashboard":        "${resources.dashboards.other_dashboard.id}",
-								"other_app":              "${resources.apps.other_app.id}",
-								"other_sql_warehouse":    "${resources.sql_warehouses.other_sql_warehouse.id}",
-							},
-							Tasks: []jobs.Task{
-								{
-									TaskKey: "my_task",
-									NotebookTask: &jobs.NotebookTask{
-										BaseParameters: map[string]string{
-											"model_name": "${resources.models.my_model.name}",
-										},
-									},
-								},
-							},
-						},
-					},
-				},
-				Models: map[string]*resources.MlflowModel{
-					"my_model": {
-						CreateModelRequest: ml.CreateModelRequest{
-							Name: "my_model",
-						},
-					},
-				},
-			},
-		},
-	}
-
-	diags := bundle.Apply(t.Context(), b, Interpolate())
-	require.NoError(t, diags.Error())
-
-	j := b.Config.Resources.Jobs["my_job"]
-	assert.Equal(t, "${databricks_pipeline.other_pipeline.id}", j.Tags["other_pipeline"])
-	assert.Equal(t, "${databricks_job.other_job.id}", j.Tags["other_job"])
-	assert.Equal(t, "${databricks_mlflow_model.other_model.id}", j.Tags["other_model"])
-	assert.Equal(t, "${databricks_mlflow_experiment.other_experiment.id}", j.Tags["other_experiment"])
-	assert.Equal(t, "${databricks_model_serving.other_model_serving.id}", j.Tags["other_model_serving"])
-	assert.Equal(t, "${databricks_registered_model.other_registered_model.id}", j.Tags["other_registered_model"])
-	assert.Equal(t, "${databricks_schema.other_schema.id}", j.Tags["other_schema"])
-	assert.Equal(t, "${databricks_volume.other_volume.id}", j.Tags["other_volume"])
-	assert.Equal(t, "${databricks_cluster.other_cluster.id}", j.Tags["other_cluster"])
-	assert.Equal(t, "${databricks_dashboard.other_dashboard.id}", j.Tags["other_dashboard"])
-	assert.Equal(t, "${databricks_app.other_app.id}", j.Tags["other_app"])
-	assert.Equal(t, "${databricks_sql_endpoint.other_sql_warehouse.id}", j.Tags["other_sql_warehouse"])
-
-	m := b.Config.Resources.Models["my_model"]
-	assert.Equal(t, "my_model", m.Name)
-}
-
-func TestInterpolatePostgresResourcesMapIdToName(t *testing.T) {
-	b := &bundle.Bundle{
-		Config: config.Root{
-			Resources: config.Resources{
-				Jobs: map[string]*resources.Job{
-					"my_job": {
-						JobSettings: jobs.JobSettings{
-							Tags: map[string]string{
-								"postgres_project_id":  "${resources.postgres_projects.my_project.id}",
-								"postgres_branch_id":   "${resources.postgres_branches.my_branch.id}",
-								"postgres_endpoint_id": "${resources.postgres_endpoints.my_endpoint.id}",
-								// name attribute should not be changed
-								"postgres_project_name": "${resources.postgres_projects.my_project.name}",
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-
-	diags := bundle.Apply(t.Context(), b, Interpolate())
-	require.NoError(t, diags.Error())
-
-	j := b.Config.Resources.Jobs["my_job"]
-	// .id should be mapped to .name for postgres resources (resource path format)
-	assert.Equal(t, "${databricks_postgres_project.my_project.name}", j.Tags["postgres_project_id"])
-	assert.Equal(t, "${databricks_postgres_branch.my_branch.name}", j.Tags["postgres_branch_id"])
-	assert.Equal(t, "${databricks_postgres_endpoint.my_endpoint.name}", j.Tags["postgres_endpoint_id"])
-	// .name reference should also remain .name
-	assert.Equal(t, "${databricks_postgres_project.my_project.name}", j.Tags["postgres_project_name"])
-}
-
-func TestInterpolateUnknownResourceType(t *testing.T) {
-	b := &bundle.Bundle{
-		Config: config.Root{
-			Resources: config.Resources{
-				Jobs: map[string]*resources.Job{
-					"my_job": {
-						JobSettings: jobs.JobSettings{
-							Tags: map[string]string{
-								"other_unknown": "${resources.unknown.other_unknown.id}",
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-
-	diags := bundle.Apply(t.Context(), b, Interpolate())
-	assert.ErrorContains(t, diags.Error(), `reference does not exist: ${resources.unknown.other_unknown.id}`)
-}
diff --git a/bundle/deploy/terraform/lifecycle_test.go b/bundle/deploy/terraform/lifecycle_test.go
deleted file mode 100644
index 7f56248bb44..00000000000
--- a/bundle/deploy/terraform/lifecycle_test.go
+++ /dev/null
@@ -1,51 +0,0 @@
-package terraform
-
-import (
-	"encoding/json"
-	"testing"
-
-	"github.com/databricks/cli/bundle/config"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/stretchr/testify/require"
-)
-
-func TestConvertLifecycleForAllResources(t *testing.T) {
-	supportedResources := config.SupportedResources()
-	ctx := t.Context()
-
-	// Resources that are only supported in direct mode and should not be converted to Terraform
-	ignoredResources := []string{
-		"catalogs",
-		"external_locations",
-		"vector_search_endpoints",
-	}
-
-	for resourceType := range supportedResources {
-		t.Run(resourceType, func(t *testing.T) {
-			for _, ignored := range ignoredResources {
-				if resourceType == ignored {
-					t.Skipf("%s is only supported in direct mode", resourceType)
-				}
-			}
-
-			vin := dyn.NewValue(map[string]dyn.Value{
-				"resources": dyn.NewValue(map[string]dyn.Value{
-					resourceType: dyn.NewValue(map[string]dyn.Value{
-						"test_resource": dyn.NewValue(map[string]dyn.Value{
-							"lifecycle": dyn.NewValue(map[string]dyn.Value{
-								"prevent_destroy": dyn.NewValue(true, nil),
-							}, nil),
-						}, nil),
-					}, nil),
-				}, nil),
-			}, nil)
-
-			tfroot, err := BundleToTerraformWithDynValue(ctx, vin)
-			require.NoError(t, err)
-
-			bytes, err := json.Marshal(tfroot.Resource)
-			require.NoError(t, err)
-			require.Contains(t, string(bytes), `"lifecycle":{"prevent_destroy":true}`)
-		})
-	}
-}
diff --git a/bundle/deploy/terraform/pkg.go b/bundle/deploy/terraform/pkg.go
index a66e5cb6a06..8bc368a8da7 100644
--- a/bundle/deploy/terraform/pkg.go
+++ b/bundle/deploy/terraform/pkg.go
@@ -1,111 +1,5 @@
 package terraform
 
-import (
-	"context"
-
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/env"
-	"github.com/hashicorp/go-version"
-)
-
-const (
-	TerraformConfigFileName = "bundle.tf.json"
-)
-
-// Users can provide their own Terraform binary and Databricks Terraform provider by setting the following environment variables.
-// This allows users to use the CLI in an air-gapped environments. See the `debug terraform` command.
-const (
-	TerraformExecPathEnv        = "DATABRICKS_TF_EXEC_PATH"
-	TerraformVersionEnv         = "DATABRICKS_TF_VERSION"
-	TerraformCliConfigPathEnv   = "DATABRICKS_TF_CLI_CONFIG_FILE"
-	TerraformProviderVersionEnv = "DATABRICKS_TF_PROVIDER_VERSION"
-)
-
-// TerraformVersion represents the version of the Terraform CLI to use.
-// It allows for users overriding the default version.
-type TerraformVersion struct {
-	Version *version.Version
-
-	// These hashes are not used inside the CLI. They are only co-located here to be
-	// output in the "databricks bundle debug terraform" output. Downstream applications
-	// like the CLI docker image use these checksums to verify the integrity of the
-	// downloaded Terraform archive.
-	ChecksumLinuxArm64 string
-	ChecksumLinuxAmd64 string
-}
-
-// Terraform CLI version to use and the corresponding checksums for it. The
-// checksums are used to verify the integrity of the downloaded binary. Please
-// update the checksums when the Terraform version is updated. The checksums
-// were obtained from https://releases.hashicorp.com/terraform/1.5.5.
-var defaultTerraformVersion = TerraformVersion{
-	Version: version.Must(version.NewVersion("1.5.5")),
-
-	ChecksumLinuxArm64: "b055aefe343d0b710d8a7afd31aeb702b37bbf4493bb9385a709991e48dfbcd2",
-	ChecksumLinuxAmd64: "ad0c696c870c8525357b5127680cd79c0bdf58179af9acd091d43b1d6482da4a",
-}
-
-// GetTerraformVersion returns the Terraform version to use.
-// The user can configure the Terraform version to use by setting the
-// DATABRICKS_TF_VERSION environment variable to the desired version.
-// It returns true if the version is the default version.
-// It returns an error if the version is malformed.
-func GetTerraformVersion(ctx context.Context) (TerraformVersion, bool, error) {
-	versionEnv, ok := env.Lookup(ctx, TerraformVersionEnv)
-	if !ok {
-		return defaultTerraformVersion, true, nil
-	}
-
-	v, err := version.NewVersion(versionEnv)
-	if err != nil {
-		return TerraformVersion{}, false, err
-	}
-
-	return TerraformVersion{
-		Version: v,
-
-		// Checksums are unknown if we return a user-specified version. This is not an issue,
-		// because they are only used in the output of the `databricks bundle debug terraform` command.
-		ChecksumLinuxArm64: "",
-		ChecksumLinuxAmd64: "",
-	}, false, nil
-}
-
-type Checksum struct {
-	LinuxArm64 string `json:"linux_arm64"`
-	LinuxAmd64 string `json:"linux_amd64"`
-}
-
-type TerraformMetadata struct {
-	Version          string   `json:"version"`
-	Checksum         Checksum `json:"checksum"`
-	ProviderHost     string   `json:"providerHost"`
-	ProviderSource   string   `json:"providerSource"`
-	ProviderVersion  string   `json:"providerVersion"`
-	ProviderChecksum Checksum `json:"providerChecksum"`
-}
-
-func NewTerraformMetadata(ctx context.Context) (*TerraformMetadata, error) {
-	tv, _, err := GetTerraformVersion(ctx)
-	if err != nil {
-		return nil, err
-	}
-	return &TerraformMetadata{
-		Version: tv.Version.String(),
-		Checksum: Checksum{
-			LinuxArm64: tv.ChecksumLinuxArm64,
-			LinuxAmd64: tv.ChecksumLinuxAmd64,
-		},
-		ProviderHost:    schema.ProviderHost,
-		ProviderSource:  schema.ProviderSource,
-		ProviderVersion: schema.ProviderVersion,
-		ProviderChecksum: Checksum{
-			LinuxAmd64: schema.ProviderChecksumLinuxAmd64,
-			LinuxArm64: schema.ProviderChecksumLinuxArm64,
-		},
-	}, nil
-}
-
 var GroupToTerraformName = map[string]string{
 	// 2 level groups: resources.GROUP
 	"jobs":                    "databricks_job",
@@ -128,7 +22,11 @@ var GroupToTerraformName = map[string]string{
 	"synced_database_tables":  "databricks_database_synced_database_table",
 	"postgres_projects":       "databricks_postgres_project",
 	"postgres_branches":       "databricks_postgres_branch",
+	"postgres_databases":      "databricks_postgres_database",
 	"postgres_endpoints":      "databricks_postgres_endpoint",
+	"postgres_catalogs":       "databricks_postgres_catalog",
+	"postgres_roles":          "databricks_postgres_role",
+	"postgres_synced_tables":  "databricks_postgres_synced_table",
 
 	// 3 level groups: resources.*.GROUP
 	"permissions": "databricks_permissions",
diff --git a/bundle/deploy/terraform/pkg_test.go b/bundle/deploy/terraform/pkg_test.go
deleted file mode 100644
index 2b19e99234d..00000000000
--- a/bundle/deploy/terraform/pkg_test.go
+++ /dev/null
@@ -1,79 +0,0 @@
-package terraform
-
-import (
-	"crypto/sha256"
-	"encoding/hex"
-	"fmt"
-	"io"
-	"net/http"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/databricks/cli/libs/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func downloadAndChecksum(t *testing.T, url, expectedChecksum string) {
-	resp, err := http.Get(url)
-	require.NoError(t, err)
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		t.Fatalf("failed to download %s: %s", url, resp.Status)
-	}
-
-	tmpDir := t.TempDir()
-	tmpFile, err := os.Create(filepath.Join(tmpDir, "archive.zip"))
-	require.NoError(t, err)
-	defer tmpFile.Close()
-
-	_, err = io.Copy(tmpFile, resp.Body)
-	require.NoError(t, err)
-
-	_, err = tmpFile.Seek(0, 0) // go back to the start of the file
-	require.NoError(t, err)
-
-	hash := sha256.New()
-	_, err = io.Copy(hash, tmpFile)
-	require.NoError(t, err)
-
-	checksum := hex.EncodeToString(hash.Sum(nil))
-	assert.Equal(t, expectedChecksum, checksum)
-}
-
-func TestTerraformArchiveChecksums(t *testing.T) {
-	tv, isDefault, err := GetTerraformVersion(t.Context())
-	require.NoError(t, err)
-	assert.True(t, isDefault)
-	armUrl := fmt.Sprintf("https://releases.hashicorp.com/terraform/%s/terraform_%s_linux_arm64.zip", tv.Version.String(), tv.Version.String())
-	amdUrl := fmt.Sprintf("https://releases.hashicorp.com/terraform/%s/terraform_%s_linux_amd64.zip", tv.Version.String(), tv.Version.String())
-
-	downloadAndChecksum(t, amdUrl, tv.ChecksumLinuxAmd64)
-	downloadAndChecksum(t, armUrl, tv.ChecksumLinuxArm64)
-}
-
-func TestGetTerraformVersionDefault(t *testing.T) {
-	// Verify that the default version is used
-	tv, isDefault, err := GetTerraformVersion(t.Context())
-	require.NoError(t, err)
-	assert.True(t, isDefault)
-	assert.Equal(t, defaultTerraformVersion.Version.String(), tv.Version.String())
-	assert.Equal(t, defaultTerraformVersion.ChecksumLinuxArm64, tv.ChecksumLinuxArm64)
-	assert.Equal(t, defaultTerraformVersion.ChecksumLinuxAmd64, tv.ChecksumLinuxAmd64)
-}
-
-func TestGetTerraformVersionOverride(t *testing.T) {
-	// Set the override version
-	overrideVersion := "1.12.2"
-	ctx := env.Set(t.Context(), TerraformVersionEnv, overrideVersion)
-
-	// Verify that the override version is used
-	tv, isDefault, err := GetTerraformVersion(ctx)
-	require.NoError(t, err)
-	assert.False(t, isDefault)
-	assert.Equal(t, overrideVersion, tv.Version.String())
-	assert.Empty(t, tv.ChecksumLinuxArm64)
-	assert.Empty(t, tv.ChecksumLinuxAmd64)
-}
diff --git a/bundle/deploy/terraform/plan.go b/bundle/deploy/terraform/plan.go
deleted file mode 100644
index 660cd0ba34b..00000000000
--- a/bundle/deploy/terraform/plan.go
+++ /dev/null
@@ -1,61 +0,0 @@
-package terraform
-
-import (
-	"context"
-	"path/filepath"
-
-	"github.com/databricks/cli/bundle"
-	"github.com/databricks/cli/libs/diag"
-	"github.com/databricks/cli/libs/log"
-	"github.com/hashicorp/terraform-exec/tfexec"
-)
-
-type PlanGoal string
-
-var (
-	PlanDeploy  = PlanGoal("deploy")
-	PlanDestroy = PlanGoal("destroy")
-)
-
-type plan struct {
-	goal PlanGoal
-}
-
-func (p *plan) Name() string {
-	return "terraform.Plan"
-}
-
-func (p *plan) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
-	diags := Initialize(ctx, b)
-	if diags.HasError() {
-		return diags
-	}
-
-	// Persist computed plan
-	tfDir, err := Dir(ctx, b)
-	if err != nil {
-		return diag.FromErr(err)
-	}
-	planPath := filepath.Join(tfDir, "plan")
-	destroy := p.goal == PlanDestroy
-
-	notEmpty, err := b.Terraform.Plan(ctx, tfexec.Destroy(destroy), tfexec.Out(planPath))
-	if err != nil {
-		return diag.FromErr(err)
-	}
-
-	// Set plan in main bundle struct for downstream mutators
-	b.TerraformPlanPath = planPath
-	b.TerraformPlanIsEmpty = !notEmpty
-
-	log.Debugf(ctx, "Planning complete and persisted at %s\n", planPath)
-	return diags
-}
-
-// Plan returns a [bundle.Mutator] that runs the equivalent of `terraform plan -out ./plan`
-// from the bundle's ephemeral working directory for Terraform.
-func Plan(goal PlanGoal) bundle.Mutator {
-	return &plan{
-		goal: goal,
-	}
-}
diff --git a/bundle/deploy/terraform/pubkey.go b/bundle/deploy/terraform/pubkey.go
deleted file mode 100644
index e7609056524..00000000000
--- a/bundle/deploy/terraform/pubkey.go
+++ /dev/null
@@ -1,137 +0,0 @@
-package terraform
-
-// hashicorpPublicKey is HashiCorp's release-signing public key with self-signatures
-// refreshed on 2026-02-19 (expiration extended to ~2035).
-//
-// The embedded key in hc-install v0.9.3 has a UserID self-signature that expired
-// on 2026-04-18, which breaks Terraform checksum verification. hc-install#355
-// added refreshed signatures, but go-crypto v1 only reads the first armored
-// block and keeps one SelfSignature per Identity, so the fix is a no-op when
-// relying on the embedded key. We pass this refreshed block to
-// releases.ExactVersion.ArmoredPublicKey directly.
-//
-// Source: https://github.com/hashicorp/hc-install/blob/main/internal/pubkey/pubkey.go
-//
-//	(second -----BEGIN PGP PUBLIC KEY BLOCK----- block, added in PR #355)
-const hashicorpPublicKey = `-----BEGIN PGP PUBLIC KEY BLOCK-----
-
-mQINBGB9+xkBEACabYZOWKmgZsHTdRDiyPJxhbuUiKX65GUWkyRMJKi/1dviVxOX
-PG6hBPtF48IFnVgxKpIb7G6NjBousAV+CuLlv5yqFKpOZEGC6sBV+Gx8Vu1CICpl
-Zm+HpQPcIzwBpN+Ar4l/exCG/f/MZq/oxGgH+TyRF3XcYDjG8dbJCpHO5nQ5Cy9h
-QIp3/Bh09kET6lk+4QlofNgHKVT2epV8iK1cXlbQe2tZtfCUtxk+pxvU0UHXp+AB
-0xc3/gIhjZp/dePmCOyQyGPJbp5bpO4UeAJ6frqhexmNlaw9Z897ltZmRLGq1p4a
-RnWL8FPkBz9SCSKXS8uNyV5oMNVn4G1obCkc106iWuKBTibffYQzq5TG8FYVJKrh
-RwWB6piacEB8hl20IIWSxIM3J9tT7CPSnk5RYYCTRHgA5OOrqZhC7JefudrP8n+M
-pxkDgNORDu7GCfAuisrf7dXYjLsxG4tu22DBJJC0c/IpRpXDnOuJN1Q5e/3VUKKW
-mypNumuQpP5lc1ZFG64TRzb1HR6oIdHfbrVQfdiQXpvdcFx+Fl57WuUraXRV6qfb
-4ZmKHX1JEwM/7tu21QE4F1dz0jroLSricZxfaCTHHWNfvGJoZ30/MZUrpSC0IfB3
-iQutxbZrwIlTBt+fGLtm3vDtwMFNWM+Rb1lrOxEQd2eijdxhvBOHtlIcswARAQAB
-tERIYXNoaUNvcnAgU2VjdXJpdHkgKGhhc2hpY29ycC5jb20vc2VjdXJpdHkpIDxz
-ZWN1cml0eUBoYXNoaWNvcnAuY29tPokCVAQTAQoAPgIbAwULCQgHAgYVCgkICwIE
-FgIDAQIeAQIXgBYhBMh0AR8KtAURDQIQVTQ2XZRy10aPBQJplkfQBQkQrOy3AAoJ
-EDQ2XZRy10aPw6gP/3GUEMUa6mCRuuSOT9UnziPIvXYd63mcN6A6Jwmwj8JaB2qu
-OCijvJkw56UbZK3x1FZIbe0hA6VUAwNSNmSIxVJkilgwIYYFO0tnL79XhIeP7jYF
-ydXLZ4rTi1FDl8lltAujTNARdY8UGg4hGlcM9OrEeXEFLWugJNiChL15FVoxZqIS
-jeduaEqyxGfJnyVwy8z3pZfgODeFr7xs2NkUIMSfuRg24VcL4aW8Frt3jW8P45y3
-o/5fsi6Aw2tZ0wD9NSgkVc8VD1NRV9eSZ95Bv+Awf9IXa+Cn5OCjc8Jc+XF+nLfB
-oPswOO7E8dLiuBUw6/GzSLMbVs8qf8BNXB92dOe1VccVTqjCxK2sEpVaHh7e+co8
-d8lDGBIWMGh7NS6XlGORpFb/T6gxjjOYUV3SKd4QDebUUG8kMkb5juLljOoq+YOP
-vgNLDZLZteFpmH+zB9DpOY1YtHZB/OD+DtzLMaSl6VPF2Ln0j5aQGwNDt7sheyAe
-sXbu0qn2H5FxojSfvhT0kUDKZ0mgg5y3Oflg49MiAOhjLGY0JocFpBeMILw27fbw
-fpIBP7siQWFTFJ1O+l2NQiWAwC2x5fX2EakyCBJmrkPV2hr4nEogNqg9/RDskIUq
-cpcOOd/0BntiXMyUCCH2AoCt5acaTQ0WU6CAosZPojOYhtGGgOgeQSdflpMSuQIN
-BGB9+xkBEACoklYsfvWRCjOwS8TOKBTfl8myuP9V9uBNbyHufzNETbhYeT33Cj0M
-GCNd9GdoaknzBQLbQVSQogA+spqVvQPz1MND18GIdtmr0BXENiZE7SRvu76jNqLp
-KxYALoK2Pc3yK0JGD30HcIIgx+lOofrVPA2dfVPTj1wXvm0rbSGA4Wd4Ng3d2AoR
-G/wZDAQ7sdZi1A9hhfugTFZwfqR3XAYCk+PUeoFrkJ0O7wngaon+6x2GJVedVPOs
-2x/XOR4l9ytFP3o+5ILhVnsK+ESVD9AQz2fhDEU6RhvzaqtHe+sQccR3oVLoGcat
-ma5rbfzH0Fhj0JtkbP7WreQf9udYgXxVJKXLQFQgel34egEGG+NlbGSPG+qHOZtY
-4uWdlDSvmo+1P95P4VG/EBteqyBbDDGDGiMs6lAMg2cULrwOsbxWjsWka8y2IN3z
-1stlIJFvW2kggU+bKnQ+sNQnclq3wzCJjeDBfucR3a5WRojDtGoJP6Fc3luUtS7V
-5TAdOx4dhaMFU9+01OoH8ZdTRiHZ1K7RFeAIslSyd4iA/xkhOhHq89F4ECQf3Bt4
-ZhGsXDTaA/VgHmf3AULbrC94O7HNqOvTWzwGiWHLfcxXQsr+ijIEQvh6rHKmJK8R
-9NMHqc3L18eMO6bqrzEHW0Xoiu9W8Yj+WuB3IKdhclT3w0pO4Pj8gQARAQABiQI8
-BBgBCgAmAhsMFiEEyHQBHwq0BRENAhBVNDZdlHLXRo8FAmmWR+0FCRCs7NQACgkQ
-NDZdlHLXRo/R0A//QW1opBlzWSmWww1q9QuJA2WCIIs8tJKRDOsmgJPscNpzwZFU
-N1Df0wWNjqi1BDReei7lZTHwUk+ebBn0bkI3ANmmgYg7LBueAt5UWSingOc+rvKA
-N32BDzBYkMckRzJSQsmeC5hm3J3wLSy90uaIlrJJE9GJZkf/W2Ob+4SQZZ+dnnRP
-JokDdW1DuZS9PbxSLJKD5eIWHBxJnFM1CmHfOfrjTJ+MYvVGM5sxSY8R7E+GADj5
-L/i4N+tTFJLuTMYARGfA6d+KPKcMJtgpUPjSMAg8nGUhukctpuBs27mOKW0CBtmJ
-82X/qYROTL0+vGTvUYflYiuceVlhX/kw0JZnMaG5V/mpHq8SwD07pCGOf69j/mNa
-5EL3++Pmzg0s0stw3Ea5pCN0cL/nKkoWchHBfW15W4JOnKAIspyD1vH670P4WfeV
-E9B9d6tgKSbM/9JlXoQS5ZdG+kbdosieELhmVWmvojyK7K+Ry6C9wgd+UfnW5jXd
-iNwKW3KHuautQwlFhHRNMyDg08c+pI5emTMT3IUQyGWo+Gska3TqGujFcABx7Ip+
-mHNmMrCkSD+XC2bvzvRR7FcM0/B9fsjLX/Wttm5vRJ1d2oAoEPvw2IZnJIXpOt2z
-zo55sJTztNu4lWGgDVgtp9SXO5a0E5YvFHQNZN5QLeVTTFu6I7qG+ME1E/K5Ag0E
-YH3+JQEQALivllTjMolxUW2OxrXb+a2Pt6vjCBsiJzrUj0Pa63U+lT9jldbCCfgP
-wDpcDuO1O05Q8k1MoYZ6HddjWnqKG7S3eqkV5c3ct3amAXp513QDKZUfIDylOmhU
-qvxjEgvGjdRjz6kECFGYr6Vnj/p6AwWv4/FBRFlrq7cnQgPynbIH4hrWvewp3Tqw
-GVgqm5RRofuAugi8iZQVlAiQZJo88yaztAQ/7VsXBiHTn61ugQ8bKdAsr8w/ZZU5
-HScHLqRolcYg0cKN91c0EbJq9k1LUC//CakPB9mhi5+aUVUGusIM8ECShUEgSTCi
-KQiJUPZ2CFbbPE9L5o9xoPCxjXoX+r7L/WyoCPTeoS3YRUMEnWKvc42Yxz3meRb+
-BmaqgbheNmzOah5nMwPupJYmHrjWPkX7oyyHxLSFw4dtoP2j6Z7GdRXKa2dUYdk2
-x3JYKocrDoPHh3Q0TAZujtpdjFi1BS8pbxYFb3hHmGSdvz7T7KcqP7ChC7k2RAKO
-GiG7QQe4NX3sSMgweYpl4OwvQOn73t5CVWYp/gIBNZGsU3Pto8g27vHeWyH9mKr4
-cSepDhw+/X8FGRNdxNfpLKm7Vc0Sm9Sof8TRFrBTqX+vIQupYHRi5QQCuYaV6OVr
-ITeegNK3So4m39d6ajCR9QxRbmjnx9UcnSYYDmIB6fpBuwT0ogNtABEBAAGJBHIE
-GAEKACYCGwIWIQTIdAEfCrQFEQ0CEFU0Nl2UctdGjwUCYH4bgAUJAeFQ2wJAwXQg
-BBkBCgAdFiEEs2y6kaLAcwxDX8KAsLRBCXaFtnYFAmB9/iUACgkQsLRBCXaFtnYX
-BhAAlxejyFXoQwyGo9U+2g9N6LUb/tNtH29RHYxy4A3/ZUY7d/FMkArmh4+dfjf0
-p9MJz98Zkps20kaYP+2YzYmaizO6OA6RIddcEXQDRCPHmLts3097mJ/skx9qLAf6
-rh9J7jWeSqWO6VW6Mlx8j9m7sm3Ae1OsjOx/m7lGZOhY4UYfY627+Jf7WQ5103Qs
-lgQ09es/vhTCx0g34SYEmMW15Tc3eCjQ21b1MeJD/V26npeakV8iCZ1kHZHawPq/
-aCCuYEcCeQOOteTWvl7HXaHMhHIx7jjOd8XX9V+UxsGz2WCIxX/j7EEEc7CAxwAN
-nWp9jXeLfxYfjrUB7XQZsGCd4EHHzUyCf7iRJL7OJ3tz5Z+rOlNjSgci+ycHEccL
-YeFAEV+Fz+sj7q4cFAferkr7imY1XEI0Ji5P8p/uRYw/n8uUf7LrLw5TzHmZsTSC
-UaiL4llRzkDC6cVhYfqQWUXDd/r385OkE4oalNNE+n+txNRx92rpvXWZ5qFYfv7E
-95fltvpXc0iOugPMzyof3lwo3Xi4WZKc1CC/jEviKTQhfn3WZukuF5lbz3V1PQfI
-xFsYe9WYQmp25XGgezjXzp89C/OIcYsVB1KJAKihgbYdHyUN4fRCmOszmOUwEAKR
-3k5j4X8V5bk08sA69NVXPn2ofxyk3YYOMYWW8ouObnXoS8QJEDQ2XZRy10aPMpsQ
-AIbwX21erVqUDMPn1uONP6o4NBEq4MwG7d+fT85rc1U0RfeKBwjucAE/iStZDQoM
-ZKWvGhFR+uoyg1LrXNKuSPB82unh2bpvj4zEnJsJadiwtShTKDsikhrfFEK3aCK8
-Zuhpiu3jxMFDhpFzlxsSwaCcGJqcdwGhWUx0ZAVD2X71UCFoOXPjF9fNnpy80YNp
-flPjj2RnOZbJyBIM0sWIVMd8F44qkTASf8K5Qb47WFN5tSpePq7OCm7s8u+lYZGK
-wR18K7VliundR+5a8XAOyUXOL5UsDaQCK4Lj4lRaeFXunXl3DJ4E+7BKzZhReJL6
-EugV5eaGonA52TWtFdB8p+79wPUeI3KcdPmQ9Ll5Zi/jBemY4bzasmgKzNeMtwWP
-fk6WgrvBwptqohw71HDymGxFUnUP7XYYjic2sVKhv9AevMGycVgwWBiWroDCQ9Ja
-btKfxHhI2p+g+rcywmBobWJbZsujTNjhtme+kNn1mhJsD3bKPjKQfAxaTskBLb0V
-wgV21891TS1Dq9kdPLwoS4XNpYg2LLB4p9hmeG3fu9+OmqwY5oKXsHiWc43dei9Y
-yxZ1AAUOIaIdPkq+YG/PhlGE4YcQZ4RPpltAr0HfGgZhmXWigbGS+66pUj+Ojysc
-j0K5tCVxVu0fhhFpOlHv0LWaxCbnkgkQH9jfMEJkAWMOuQINBGCAXCYBEADW6RNr
-ZVGNXvHVBqSiOWaxl1XOiEoiHPt50Aijt25yXbG+0kHIFSoR+1g6Lh20JTCChgfQ
-kGGjzQvEuG1HTw07YhsvLc0pkjNMfu6gJqFox/ogc53mz69OxXauzUQ/TZ27GDVp
-UBu+EhDKt1s3OtA6Bjz/csop/Um7gT0+ivHyvJ/jGdnPEZv8tNuSE/Uo+hn/Q9hg
-8SbveZzo3C+U4KcabCESEFl8Gq6aRi9vAfa65oxD5jKaIz7cy+pwb0lizqlW7H9t
-Qlr3dBfdIcdzgR55hTFC5/XrcwJ6/nHVH/xGskEasnfCQX8RYKMuy0UADJy72TkZ
-bYaCx+XXIcVB8GTOmJVoAhrTSSVLAZspfCnjwnSxisDn3ZzsYrq3cV6sU8b+QlIX
-7VAjurE+5cZiVlaxgCjyhKqlGgmonnReWOBacCgL/UvuwMmMp5TTLmiLXLT7uxeG
-ojEyoCk4sMrqrU1jevHyGlDJH9Taux15GILDwnYFfAvPF9WCid4UZ4Ouwjcaxfys
-3LxNiZIlUsXNKwS3mhiMRL4TRsbs4k4QE+LIMOsauIvcvm8/frydvQ/kUwIhVTH8
-0XGOH909bYtJvY3fudK7ShIwm7ZFTduBJUG473E/Fn3VkhTmBX6+PjOC50HR/Hyb
-waRCzfDruMe3TAcE/tSP5CUOb9C7+P+hPzQcDwARAQABiQRyBBgBCgAmAhsCFiEE
-yHQBHwq0BRENAhBVNDZdlHLXRo8FAmmWSAoFCRCqi+QCQMF0IAQZAQoAHRYhBDdO
-x1tIWRNgSoMcx8ggxtXNJ6uHBQJggFwmAAoJEMggxtXNJ6uHRfAP/2CGdSyg0K7U
-66Vygl0dugxrMm8O3/Oe211BKdQsFUSWAznOTRTK/zvMUHO4LJAlYvdtZ6xDa4XH
-l9FYQ8MR9ZV0OuOlAZvU4IJDLPVCU09X/UzX/GEoZL0R5esvwPAXopMaRHCfXJeI
-/gEaB94UhAeYlwpcRn0eSuk1vyZx7GRE6/hog8DCf4hoT40dW20gGe58xcvJ+mRY
-lC0lr16WH08wuUcee6+dgu+4Cg6SG6+zt9cMyl8VnTUL5BK/V3MebnYZJK0RFDNn
-nXDhzStgOd5gOeIL+xBPXHd0/ld/rDM74SFExpuS+hNsyo+xMQ/HJavak21MFinu
-l9COwfGEmlAXTGMY30Lf3Pt/eAkbwgmGc966VSoRmOFEXJVlDr+yJR6ru+7j50z8
-lAv6Lsop7sun1Qysbo0swf6W1qgPf6VWbx91NTFLkw0+gD8jxwrU5ZMkeSuntX9d
-pjuZS29CflXXIRPlvhuiDPicwTpYuIUx37vHveAH5gnowZg247x780Urrsx8duTX
-8CI9MAnqzm4dFAiRlwE8bvLk+l9wekiXA9gIMZiVNqNlduXIqvAG21Wdgq8qyeXK
-y/XWCVKDQOmEbFAltfNam8E3KEw0fl199x+93d5ckDGcPzUYPbNkCuIwngC/ZN96
-pDafF3Z12fSNfhZUe0C8td8KAszYa96GCRA0Nl2UctdGj1gKD/4jOGhEGTg88Vyu
-PVjeK+zkwrTIZSvHdUHfTt/+rTLSNb/RQiBCUQuEZvafj6FrntS7bAEhccGqH894
-T3St5K0AXWkvsLd6K+cbIQdlnFA2zb6geJUCk6qx5NgWpRc3i0DS7CheGwl+Bwu7
-+n9pNjNjiHV+rYDgqbQXG0dtGysB0/3qIRgEDHFO0HJu/dcte4oXrQIqrZrpOwe8
-WxqFqdU918JpSUcc8coiFp9YtwpgqQNxGVZ+rhgnTGdZzk1f/Yhhimh+2B0ReaFv
-k3UzVBj3HQ9C6+Ot3MyDEhSgdhjr9e25Tm9S5YfhwtWmghRw9RKPyLMSXSxm/Uc0
-mK1NucAp8TQBwKqKzNpCk5IdrBSWRUbjOoOFyzyCsY6gS285GCpSIzI39hTf+3gd
-wYPlE6fj+F2TZzdhx62DPnzBzBHnByYTVdJ649bx0FFp4Q+5TbIWtxu/AQkRDxmW
-NQfE+6GgeshlrhXWsh6+PGDzt+2raG6zUT913sdz7Ctw4fLjmsKOTdTz3Xa9pr8l
-xfI/JuukSgt9o/n3GirhTB3zE1w/I/Xt6k7oASiP3zQSuHtB/CYKYHDtOCWwjo7J
-PEGtb/FkreKNxsk/p20jnlrB8WZxxswdr2Vri9NmFeyMDVX7qF3WqT+8aCV9GtS1
-GCHx/5nGBdDwoxEsXqpI3IUqPb6FDg==
-=wtp+
------END PGP PUBLIC KEY BLOCK-----`
diff --git a/bundle/deploy/terraform/showplanfile.go b/bundle/deploy/terraform/showplanfile.go
index c0cc7a4e0c3..36145b5a5d8 100644
--- a/bundle/deploy/terraform/showplanfile.go
+++ b/bundle/deploy/terraform/showplanfile.go
@@ -1,14 +1,6 @@
 package terraform
 
-import (
-	"context"
-	"strings"
-
-	"github.com/databricks/cli/bundle/deployplan"
-	"github.com/databricks/cli/libs/log"
-	"github.com/hashicorp/terraform-exec/tfexec"
-	tfjson "github.com/hashicorp/terraform-json"
-)
+import "strings"
 
 var prefixToGroup = []struct{ prefix, group string }{
 	{"job_", "jobs"},
@@ -56,85 +48,3 @@ func convertGrantsResourceNameToKey(terraformName string) string {
 	// Fallback: if no known prefix is found, use the old behavior
 	return ""
 }
-
-// convertSecretAclNameToScopeKey converts terraform secret ACL resource names to scope permission keys.
-// ACL names have format "secret_acl_<scope_key>_<idx>" (see convert_secret_scope.go).
-// e.g., "secret_acl_my_scope_0" -> "resources.secret_scopes.my_scope.permissions"
-func convertSecretAclNameToScopeKey(name string) string {
-	name, _ = strings.CutPrefix(name, "secret_acl_")
-	if i := strings.LastIndex(name, "_"); i >= 0 {
-		name = name[:i]
-	}
-	return "resources.secret_scopes." + name + ".permissions"
-}
-
-// populatePlan populates a deployplan.Plan from Terraform resource changes.
-func populatePlan(ctx context.Context, plan *deployplan.Plan, changes []*tfjson.ResourceChange) {
-	for _, rc := range changes {
-		if rc.Change == nil {
-			continue
-		}
-
-		var actionType deployplan.ActionType
-		switch {
-		case rc.Change.Actions.Delete():
-			actionType = deployplan.Delete
-		case rc.Change.Actions.Replace():
-			actionType = deployplan.Recreate
-		case rc.Change.Actions.Create():
-			actionType = deployplan.Create
-		case rc.Change.Actions.Update():
-			actionType = deployplan.Update
-		case rc.Change.Actions.NoOp():
-			actionType = deployplan.Skip
-		default:
-			continue
-		}
-
-		group, ok := TerraformToGroupName[rc.Type]
-		if !ok {
-			log.Warnf(ctx, "unknown resource type '%s'", rc.Type)
-			continue
-		}
-
-		var key string
-		switch group {
-		case "permissions":
-			key = convertPermissionsResourceNameToKey(rc.Name)
-		case "grants":
-			key = convertGrantsResourceNameToKey(rc.Name)
-		case "secret_acls":
-			key = convertSecretAclNameToScopeKey(rc.Name)
-		default:
-			key = "resources." + group + "." + rc.Name
-		}
-
-		if existing, ok := plan.Plan[key]; ok {
-			// For secret ACLs, multiple individual ACL changes are merged into a single
-			// scope-level permissions entry. When the actions differ (e.g., some ACLs are
-			// recreated while others are deleted), it means permissions are being updated,
-			// not deleted entirely.
-			if group == "secret_acls" && existing.Action != actionType {
-				existing.Action = deployplan.Update
-			} else {
-				existing.Action = deployplan.GetHigherAction(existing.Action, actionType)
-			}
-		} else {
-			plan.Plan[key] = &deployplan.PlanEntry{Action: actionType}
-		}
-	}
-}
-
-// ShowPlanFile reads a Terraform plan file located at planPath using the provided tfexec.Terraform handle
-// and converts it into a deployplan.Plan.
-func ShowPlanFile(ctx context.Context, tf *tfexec.Terraform, planPath string) (*deployplan.Plan, error) {
-	tfPlan, err := tf.ShowPlanFile(ctx, planPath)
-	if err != nil {
-		return nil, err
-	}
-
-	plan := deployplan.NewPlanTerraform()
-	populatePlan(ctx, plan, tfPlan.ResourceChanges)
-
-	return plan, nil
-}
diff --git a/bundle/deploy/terraform/showplanfile_test.go b/bundle/deploy/terraform/showplanfile_test.go
deleted file mode 100644
index 5c4426f6650..00000000000
--- a/bundle/deploy/terraform/showplanfile_test.go
+++ /dev/null
@@ -1,164 +0,0 @@
-package terraform
-
-import (
-	"testing"
-
-	"github.com/databricks/cli/bundle/deployplan"
-	tfjson "github.com/hashicorp/terraform-json"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestPopulatePlan(t *testing.T) {
-	ctx := t.Context()
-	changes := []*tfjson.ResourceChange{
-		{
-			Type: "databricks_pipeline",
-			Change: &tfjson.Change{
-				Actions: tfjson.Actions{tfjson.ActionCreate},
-			},
-			Name: "create pipeline",
-		},
-		{
-			Type: "databricks_pipeline",
-			Change: &tfjson.Change{
-				Actions: tfjson.Actions{tfjson.ActionDelete},
-			},
-			Name: "delete pipeline",
-		},
-		{
-			Type: "databricks_pipeline",
-			Change: &tfjson.Change{
-				Actions: tfjson.Actions{tfjson.ActionDelete, tfjson.ActionCreate},
-			},
-			Name: "recreate pipeline",
-		},
-		{
-			Type: "databricks_whatever",
-			Change: &tfjson.Change{
-				Actions: tfjson.Actions{tfjson.ActionDelete, tfjson.ActionCreate},
-			},
-			Name: "recreate whatever",
-		},
-	}
-
-	plan := deployplan.NewPlanTerraform()
-	populatePlan(ctx, plan, changes)
-
-	actions := plan.GetActions()
-
-	// Assert that the actions list contains all expected actions
-	expectedActions := []deployplan.Action{
-		{
-			ActionType:  deployplan.Create,
-			ResourceKey: "resources.pipelines.create pipeline",
-		},
-		{
-			ActionType:  deployplan.Delete,
-			ResourceKey: "resources.pipelines.delete pipeline",
-		},
-		{
-			ActionType:  deployplan.Recreate,
-			ResourceKey: "resources.pipelines.recreate pipeline",
-		},
-	}
-	assert.Equal(t, expectedActions, actions)
-
-	// Also test that the plan was populated correctly with expected entries
-	assert.Contains(t, plan.Plan, "resources.pipelines.create pipeline")
-	assert.Equal(t, deployplan.Create, plan.Plan["resources.pipelines.create pipeline"].Action)
-
-	assert.Contains(t, plan.Plan, "resources.pipelines.delete pipeline")
-	assert.Equal(t, deployplan.Delete, plan.Plan["resources.pipelines.delete pipeline"].Action)
-
-	assert.Contains(t, plan.Plan, "resources.pipelines.recreate pipeline")
-	assert.Equal(t, deployplan.Recreate, plan.Plan["resources.pipelines.recreate pipeline"].Action)
-
-	// Unknown resource type should not be in the plan
-	assert.NotContains(t, plan.Plan, "resources.recreate whatever")
-}
-
-func TestPopulatePlanSecretAcl(t *testing.T) {
-	ctx := t.Context()
-	changes := []*tfjson.ResourceChange{
-		{
-			Type:   "databricks_secret_acl",
-			Change: &tfjson.Change{Actions: tfjson.Actions{tfjson.ActionCreate}},
-			Name:   "secret_acl_my_scope_0",
-		},
-		{
-			Type:   "databricks_secret_acl",
-			Change: &tfjson.Change{Actions: tfjson.Actions{tfjson.ActionDelete, tfjson.ActionCreate}},
-			Name:   "secret_acl_my_scope_1",
-		},
-	}
-
-	plan := deployplan.NewPlanTerraform()
-	populatePlan(ctx, plan, changes)
-
-	// Multiple ACL changes for the same scope with different actions are merged as Update.
-	assert.Equal(t, map[string]*deployplan.PlanEntry{
-		"resources.secret_scopes.my_scope.permissions": {Action: deployplan.Update},
-	}, plan.Plan)
-}
-
-func TestPopulatePlanSecretAclMixedCreateDelete(t *testing.T) {
-	ctx := t.Context()
-	changes := []*tfjson.ResourceChange{
-		{
-			Type:   "databricks_secret_acl",
-			Change: &tfjson.Change{Actions: tfjson.Actions{tfjson.ActionDelete}},
-			Name:   "secret_acl_my_scope_0",
-		},
-		{
-			Type:   "databricks_secret_acl",
-			Change: &tfjson.Change{Actions: tfjson.Actions{tfjson.ActionCreate}},
-			Name:   "secret_acl_my_scope_1",
-		},
-	}
-
-	plan := deployplan.NewPlanTerraform()
-	populatePlan(ctx, plan, changes)
-
-	assert.Equal(t, map[string]*deployplan.PlanEntry{
-		"resources.secret_scopes.my_scope.permissions": {Action: deployplan.Update},
-	}, plan.Plan)
-}
-
-func TestPopulatePlanSecretAclMixedRecreateDelete(t *testing.T) {
-	ctx := t.Context()
-	// Simulates a permission update where some ACLs are recreated (principal changed)
-	// and some are deleted (principal removed). This is the typical Terraform plan shape
-	// when updating secret scope permissions.
-	changes := []*tfjson.ResourceChange{
-		{
-			Type:   "databricks_secret_acl",
-			Change: &tfjson.Change{Actions: tfjson.Actions{tfjson.ActionDelete, tfjson.ActionCreate}},
-			Name:   "secret_acl_my_scope_0",
-		},
-		{
-			Type:   "databricks_secret_acl",
-			Change: &tfjson.Change{Actions: tfjson.Actions{tfjson.ActionDelete, tfjson.ActionCreate}},
-			Name:   "secret_acl_my_scope_1",
-		},
-		{
-			Type:   "databricks_secret_acl",
-			Change: &tfjson.Change{Actions: tfjson.Actions{tfjson.ActionDelete}},
-			Name:   "secret_acl_my_scope_2",
-		},
-	}
-
-	plan := deployplan.NewPlanTerraform()
-	populatePlan(ctx, plan, changes)
-
-	// When permissions are being updated (some ACLs recreated, some deleted),
-	// the aggregated action should be Update, not Delete.
-	assert.Equal(t, map[string]*deployplan.PlanEntry{
-		"resources.secret_scopes.my_scope.permissions": {Action: deployplan.Update},
-	}, plan.Plan)
-}
-
-func TestConvertSecretAclNameToScopeKey(t *testing.T) {
-	assert.Equal(t, "resources.secret_scopes.my_scope.permissions", convertSecretAclNameToScopeKey("secret_acl_my_scope_0"))
-	assert.Equal(t, "resources.secret_scopes.my_scope.permissions", convertSecretAclNameToScopeKey("secret_acl_my_scope_1"))
-	assert.Equal(t, "resources.secret_scopes.scope_123.permissions", convertSecretAclNameToScopeKey("secret_acl_scope_123_2"))
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert.go b/bundle/deploy/terraform/tfdyn/convert.go
deleted file mode 100644
index 9df4e264013..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert.go
+++ /dev/null
@@ -1,23 +0,0 @@
-package tfdyn
-
-import (
-	"context"
-
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-)
-
-type Converter interface {
-	Convert(ctx context.Context, key string, vin dyn.Value, out *schema.Resources) error
-}
-
-var converters = map[string]Converter{}
-
-func GetConverter(name string) (Converter, bool) {
-	c, ok := converters[name]
-	return c, ok
-}
-
-func registerConverter(name string, c Converter) {
-	converters[name] = c
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_alert.go b/bundle/deploy/terraform/tfdyn/convert_alert.go
deleted file mode 100644
index 8cb17001f18..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_alert.go
+++ /dev/null
@@ -1,56 +0,0 @@
-package tfdyn
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/cli/libs/log"
-)
-
-func convertAlertResource(ctx context.Context, vin dyn.Value) (dyn.Value, error) {
-	// Normalize the output value to the target schema.
-	vout, diags := convert.Normalize(schema.ResourceAlertV2{}, vin)
-	for _, diag := range diags {
-		log.Debugf(ctx, "alert normalization diagnostic: %s", diag.Summary)
-	}
-
-	// Always set purge_on_delete to true. PR with context: https://github.com/databricks/cli/pull/4505
-	vout, err := dyn.Set(vout, "purge_on_delete", dyn.V(true))
-	if err != nil {
-		return dyn.InvalidValue, err
-	}
-
-	return vout, nil
-}
-
-type alertConverter struct{}
-
-func (alertConverter) Convert(ctx context.Context, key string, vin dyn.Value, out *schema.Resources) error {
-	vout, err := convertAlertResource(ctx, vin)
-	if err != nil {
-		return err
-	}
-
-	vout, err = convertLifecycle(ctx, vout, vin.Get("lifecycle"))
-	if err != nil {
-		return err
-	}
-
-	// Add the converted resource to the output.
-	out.AlertV2[key] = vout.AsAny()
-
-	// Configure permissions for this resource.
-	if permissions := convertPermissionsResource(ctx, vin); permissions != nil {
-		permissions.AlertV2Id = fmt.Sprintf("${databricks_alert_v2.%s.id}", key)
-		out.Permissions["alert_"+key] = permissions
-	}
-
-	return nil
-}
-
-func init() {
-	registerConverter("alerts", alertConverter{})
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_alert_test.go b/bundle/deploy/terraform/tfdyn/convert_alert_test.go
deleted file mode 100644
index 25d59425194..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_alert_test.go
+++ /dev/null
@@ -1,107 +0,0 @@
-package tfdyn
-
-import (
-	"testing"
-
-	"github.com/databricks/cli/bundle/config/resources"
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/databricks-sdk-go/service/sql"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestConvertAlert(t *testing.T) {
-	src := resources.Alert{
-		AlertV2: sql.AlertV2{
-			DisplayName:       "test_alert",
-			QueryText:         "SELECT 1",
-			WarehouseId:       "test_warehouse_id",
-			CustomSummary:     "Test alert summary",
-			CustomDescription: "Test alert description",
-		},
-		Permissions: []resources.Permission{
-			{
-				Level:    "CAN_VIEW",
-				UserName: "jane@doe.com",
-			},
-			{
-				Level:                "CAN_MANAGE",
-				ServicePrincipalName: "sp-test",
-			},
-		},
-	}
-
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	out := schema.NewResources()
-	err = alertConverter{}.Convert(ctx, "test_alert", vin, out)
-	require.NoError(t, err)
-
-	// Assert equality on the alert
-	alert := out.AlertV2["test_alert"]
-	assert.Equal(t, map[string]any{
-		"display_name":       "test_alert",
-		"query_text":         "SELECT 1",
-		"warehouse_id":       "test_warehouse_id",
-		"custom_summary":     "Test alert summary",
-		"custom_description": "Test alert description",
-		"purge_on_delete":    true,
-	}, alert)
-
-	// Assert equality on the permissions
-	assert.Equal(t, &schema.ResourcePermissions{
-		AlertV2Id: "${databricks_alert_v2.test_alert.id}",
-		AccessControl: []schema.ResourcePermissionsAccessControl{
-			{
-				UserName:        "jane@doe.com",
-				PermissionLevel: "CAN_VIEW",
-			},
-			{
-				ServicePrincipalName: "sp-test",
-				PermissionLevel:      "CAN_MANAGE",
-			},
-		},
-	}, out.Permissions["alert_test_alert"])
-}
-
-func TestConvertAlertWithThresholdDoubleValue(t *testing.T) {
-	src := resources.Alert{
-		AlertV2: sql.AlertV2{
-			DisplayName: "test_alert",
-			QueryText:   "SELECT 1",
-			WarehouseId: "test_warehouse_id",
-			Evaluation: sql.AlertV2Evaluation{
-				ComparisonOperator: "EQUAL",
-				Source: sql.AlertV2OperandColumn{
-					Name: "1",
-				},
-				Threshold: &sql.AlertV2Operand{
-					Value: &sql.AlertV2OperandValue{
-						DoubleValue: 1.3,
-					},
-				},
-			},
-		},
-	}
-
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	out := schema.NewResources()
-	err = alertConverter{}.Convert(ctx, "test_alert", vin, out)
-	require.NoError(t, err)
-
-	alert := out.AlertV2["test_alert"]
-	alertMap := alert.(map[string]any)
-	evaluation := alertMap["evaluation"].(map[string]any)
-	threshold := evaluation["threshold"].(map[string]any)
-	value := threshold["value"].(map[string]any)
-
-	// Assert the fractional double_value is preserved after normalization.
-	assert.InDelta(t, 1.3, value["double_value"], 0.0001)
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_app.go b/bundle/deploy/terraform/tfdyn/convert_app.go
deleted file mode 100644
index 87095eb0aa7..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_app.go
+++ /dev/null
@@ -1,66 +0,0 @@
-package tfdyn
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/cli/libs/log"
-	"github.com/databricks/databricks-sdk-go/service/apps"
-)
-
-func convertAppResource(ctx context.Context, vin dyn.Value) (dyn.Value, error) {
-	// Check if the description is not set and if it's not, set it to an empty string.
-	// This is done to avoid TF drift because Apps API return empty string for description when if it's not set.
-	if _, err := dyn.Get(vin, "description"); err != nil {
-		vin, err = dyn.Set(vin, "description", dyn.V(""))
-		if err != nil {
-			return vin, err
-		}
-	}
-
-	// Normalize the output value to the target schema.
-	vout, diags := convert.Normalize(apps.App{}, vin)
-	for _, diag := range diags {
-		log.Debugf(ctx, "app normalization diagnostic: %s", diag.Summary)
-	}
-
-	return vout, nil
-}
-
-type appConverter struct{}
-
-func (appConverter) Convert(ctx context.Context, key string, vin dyn.Value, out *schema.Resources) error {
-	vout, err := convertAppResource(ctx, vin)
-	if err != nil {
-		return err
-	}
-
-	// Always skip compute during creation; lifecycle.started is only supported in direct mode.
-	vout, err = dyn.Set(vout, "no_compute", dyn.V(true))
-	if err != nil {
-		return err
-	}
-
-	vout, err = convertLifecycle(ctx, vout, vin.Get("lifecycle"))
-	if err != nil {
-		return err
-	}
-
-	// Add the converted resource to the output.
-	out.App[key] = vout.AsAny()
-
-	// Configure permissions for this resource.
-	if permissions := convertPermissionsResource(ctx, vin); permissions != nil {
-		permissions.AppName = fmt.Sprintf("${databricks_app.%s.name}", key)
-		out.Permissions["app_"+key] = permissions
-	}
-
-	return nil
-}
-
-func init() {
-	registerConverter("apps", appConverter{})
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_app_test.go b/bundle/deploy/terraform/tfdyn/convert_app_test.go
deleted file mode 100644
index 896d0e52d5c..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_app_test.go
+++ /dev/null
@@ -1,151 +0,0 @@
-package tfdyn
-
-import (
-	"testing"
-
-	"github.com/databricks/cli/bundle/config/resources"
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/databricks-sdk-go/service/apps"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestConvertApp(t *testing.T) {
-	src := resources.App{
-		SourceCodePath: "./app",
-		App: apps.App{
-			Name:        "app_id",
-			Description: "app description",
-			Resources: []apps.AppResource{
-				{
-					Name: "job1",
-					Job: &apps.AppResourceJob{
-						Id:         "1234",
-						Permission: "CAN_MANAGE_RUN",
-					},
-				},
-				{
-					Name: "sql1",
-					SqlWarehouse: &apps.AppResourceSqlWarehouse{
-						Id:         "5678",
-						Permission: "CAN_USE",
-					},
-				},
-			},
-		},
-		Permissions: []resources.AppPermission{
-			{
-				Level:    "CAN_RUN",
-				UserName: "jack@gmail.com",
-			},
-			{
-				Level:                "CAN_MANAGE",
-				ServicePrincipalName: "sp",
-			},
-		},
-	}
-
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	out := schema.NewResources()
-	err = appConverter{}.Convert(ctx, "my_app", vin, out)
-	require.NoError(t, err)
-
-	app := out.App["my_app"]
-	assert.Equal(t, map[string]any{
-		"description": "app description",
-		"name":        "app_id",
-		"no_compute":  true,
-		"resources": []any{
-			map[string]any{
-				"name": "job1",
-				"job": map[string]any{
-					"id":         "1234",
-					"permission": "CAN_MANAGE_RUN",
-				},
-			},
-			map[string]any{
-				"name": "sql1",
-				"sql_warehouse": map[string]any{
-					"id":         "5678",
-					"permission": "CAN_USE",
-				},
-			},
-		},
-	}, app)
-
-	// Assert equality on the permissions
-	assert.Equal(t, &schema.ResourcePermissions{
-		AppName: "${databricks_app.my_app.name}",
-		AccessControl: []schema.ResourcePermissionsAccessControl{
-			{
-				PermissionLevel: "CAN_RUN",
-				UserName:        "jack@gmail.com",
-			},
-			{
-				PermissionLevel:      "CAN_MANAGE",
-				ServicePrincipalName: "sp",
-			},
-		},
-	}, out.Permissions["app_my_app"])
-}
-
-func TestConvertAppWithNoDescription(t *testing.T) {
-	src := resources.App{
-		SourceCodePath: "./app",
-		App: apps.App{
-			Name: "app_id",
-			Resources: []apps.AppResource{
-				{
-					Name: "job1",
-					Job: &apps.AppResourceJob{
-						Id:         "1234",
-						Permission: "CAN_MANAGE_RUN",
-					},
-				},
-				{
-					Name: "sql1",
-					SqlWarehouse: &apps.AppResourceSqlWarehouse{
-						Id:         "5678",
-						Permission: "CAN_USE",
-					},
-				},
-			},
-		},
-	}
-
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	out := schema.NewResources()
-	err = appConverter{}.Convert(ctx, "my_app", vin, out)
-	require.NoError(t, err)
-
-	app := out.App["my_app"]
-	assert.Equal(t, map[string]any{
-		"name":        "app_id",
-		"description": "", // Due to Apps API always returning a description field, we set it in the output as well to avoid permanent TF drift
-		"no_compute":  true,
-		"resources": []any{
-			map[string]any{
-				"name": "job1",
-				"job": map[string]any{
-					"id":         "1234",
-					"permission": "CAN_MANAGE_RUN",
-				},
-			},
-			map[string]any{
-				"name": "sql1",
-				"sql_warehouse": map[string]any{
-					"id":         "5678",
-					"permission": "CAN_USE",
-				},
-			},
-		},
-	}, app)
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_cluster.go b/bundle/deploy/terraform/tfdyn/convert_cluster.go
deleted file mode 100644
index e53b22a38d6..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_cluster.go
+++ /dev/null
@@ -1,57 +0,0 @@
-package tfdyn
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/cli/libs/log"
-	"github.com/databricks/databricks-sdk-go/service/compute"
-)
-
-func convertClusterResource(ctx context.Context, vin dyn.Value) (dyn.Value, error) {
-	// Normalize the output value to the target schema.
-	vout, diags := convert.Normalize(compute.ClusterSpec{}, vin)
-	for _, diag := range diags {
-		log.Debugf(ctx, "cluster normalization diagnostic: %s", diag.Summary)
-	}
-
-	return vout, nil
-}
-
-type clusterConverter struct{}
-
-func (clusterConverter) Convert(ctx context.Context, key string, vin dyn.Value, out *schema.Resources) error {
-	vout, err := convertClusterResource(ctx, vin)
-	if err != nil {
-		return err
-	}
-
-	// We always set no_wait as it allows DABs not to wait for cluster to be started.
-	vout, err = dyn.Set(vout, "no_wait", dyn.V(true))
-	if err != nil {
-		return err
-	}
-
-	vout, err = convertLifecycle(ctx, vout, vin.Get("lifecycle"))
-	if err != nil {
-		return err
-	}
-
-	// Add the converted resource to the output.
-	out.Cluster[key] = vout.AsAny()
-
-	// Configure permissions for this resource.
-	if permissions := convertPermissionsResource(ctx, vin); permissions != nil {
-		permissions.ClusterId = fmt.Sprintf("${databricks_cluster.%s.id}", key)
-		out.Permissions["cluster_"+key] = permissions
-	}
-
-	return nil
-}
-
-func init() {
-	registerConverter("clusters", clusterConverter{})
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_cluster_test.go b/bundle/deploy/terraform/tfdyn/convert_cluster_test.go
deleted file mode 100644
index c28e8744137..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_cluster_test.go
+++ /dev/null
@@ -1,95 +0,0 @@
-package tfdyn
-
-import (
-	"testing"
-
-	"github.com/databricks/cli/bundle/config/resources"
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/databricks-sdk-go/service/compute"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestConvertCluster(t *testing.T) {
-	src := resources.Cluster{
-		ClusterSpec: compute.ClusterSpec{
-			NumWorkers:   3,
-			SparkVersion: "13.3.x-scala2.12",
-			ClusterName:  "cluster",
-			SparkConf: map[string]string{
-				"spark.executor.memory": "2g",
-			},
-			AwsAttributes: &compute.AwsAttributes{
-				Availability: "ON_DEMAND",
-			},
-			AzureAttributes: &compute.AzureAttributes{
-				Availability: "SPOT",
-			},
-			DataSecurityMode: "USER_ISOLATION",
-			NodeTypeId:       "m5.xlarge",
-			Autoscale: &compute.AutoScale{
-				MinWorkers: 1,
-				MaxWorkers: 10,
-			},
-		},
-
-		Permissions: []resources.ClusterPermission{
-			{
-				Level:    "CAN_RUN",
-				UserName: "jack@gmail.com",
-			},
-			{
-				Level:                "CAN_MANAGE",
-				ServicePrincipalName: "sp",
-			},
-		},
-	}
-
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	out := schema.NewResources()
-	err = clusterConverter{}.Convert(ctx, "my_cluster", vin, out)
-	require.NoError(t, err)
-
-	cluster := out.Cluster["my_cluster"]
-	assert.Equal(t, map[string]any{
-		"num_workers":   int64(3),
-		"spark_version": "13.3.x-scala2.12",
-		"cluster_name":  "cluster",
-		"spark_conf": map[string]any{
-			"spark.executor.memory": "2g",
-		},
-		"aws_attributes": map[string]any{
-			"availability": "ON_DEMAND",
-		},
-		"azure_attributes": map[string]any{
-			"availability": "SPOT",
-		},
-		"data_security_mode": "USER_ISOLATION",
-		"no_wait":            true,
-		"node_type_id":       "m5.xlarge",
-		"autoscale": map[string]any{
-			"min_workers": int64(1),
-			"max_workers": int64(10),
-		},
-	}, cluster)
-
-	// Assert equality on the permissions
-	assert.Equal(t, &schema.ResourcePermissions{
-		ClusterId: "${databricks_cluster.my_cluster.id}",
-		AccessControl: []schema.ResourcePermissionsAccessControl{
-			{
-				PermissionLevel: "CAN_RUN",
-				UserName:        "jack@gmail.com",
-			},
-			{
-				PermissionLevel:      "CAN_MANAGE",
-				ServicePrincipalName: "sp",
-			},
-		},
-	}, out.Permissions["cluster_my_cluster"])
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_dashboard.go b/bundle/deploy/terraform/tfdyn/convert_dashboard.go
deleted file mode 100644
index eb9260e8ec8..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_dashboard.go
+++ /dev/null
@@ -1,92 +0,0 @@
-package tfdyn
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/cli/libs/log"
-)
-
-const (
-	serializedDashboardFieldName = "serialized_dashboard"
-)
-
-// Marshal "serialized_dashboard" as JSON if it is set in the input but not in the output.
-func marshalSerializedDashboard(vin, vout dyn.Value) (dyn.Value, error) {
-	// Skip if the "serialized_dashboard" field is already set.
-	if v := vout.Get(serializedDashboardFieldName); v.IsValid() {
-		return vout, nil
-	}
-
-	// Skip if the "serialized_dashboard" field on the input is not set.
-	v := vin.Get(serializedDashboardFieldName)
-	if !v.IsValid() {
-		return vout, nil
-	}
-
-	// Marshal the "serialized_dashboard" field as JSON.
-	data, err := json.Marshal(v.AsAny())
-	if err != nil {
-		return dyn.InvalidValue, fmt.Errorf("failed to marshal serialized_dashboard: %w", err)
-	}
-
-	// Set the "serialized_dashboard" field on the output.
-	return dyn.Set(vout, serializedDashboardFieldName, dyn.V(string(data)))
-}
-
-func convertDashboardResource(ctx context.Context, vin dyn.Value) (dyn.Value, error) {
-	var err error
-
-	// Normalize the output value to the target schema.
-	vout, diags := convert.Normalize(schema.ResourceDashboard{}, vin)
-	for _, diag := range diags {
-		log.Debugf(ctx, "dashboard normalization diagnostic: %s", diag.Summary)
-	}
-
-	// Marshal "serialized_dashboard" as JSON if it is set in the input but not in the output.
-	vout, err = marshalSerializedDashboard(vin, vout)
-	if err != nil {
-		return dyn.InvalidValue, err
-	}
-
-	// Drop the "file_path" field. It's always inlined into "serialized_dashboard".
-	vout, err = dyn.DropKeys(vout, []string{"file_path"})
-	if err != nil {
-		return dyn.InvalidValue, err
-	}
-
-	return vout, nil
-}
-
-type dashboardConverter struct{}
-
-func (dashboardConverter) Convert(ctx context.Context, key string, vin dyn.Value, out *schema.Resources) error {
-	vout, err := convertDashboardResource(ctx, vin)
-	if err != nil {
-		return err
-	}
-
-	vout, err = convertLifecycle(ctx, vout, vin.Get("lifecycle"))
-	if err != nil {
-		return err
-	}
-
-	// Add the converted resource to the output.
-	out.Dashboard[key] = vout.AsAny()
-
-	// Configure permissions for this resource.
-	if permissions := convertPermissionsResource(ctx, vin); permissions != nil {
-		permissions.DashboardId = fmt.Sprintf("${databricks_dashboard.%s.id}", key)
-		out.Permissions["dashboard_"+key] = permissions
-	}
-
-	return nil
-}
-
-func init() {
-	registerConverter("dashboards", dashboardConverter{})
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_dashboard_test.go b/bundle/deploy/terraform/tfdyn/convert_dashboard_test.go
deleted file mode 100644
index d8f05dc76c1..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_dashboard_test.go
+++ /dev/null
@@ -1,141 +0,0 @@
-package tfdyn
-
-import (
-	"testing"
-
-	"github.com/databricks/cli/bundle/config/resources"
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestConvertDashboard(t *testing.T) {
-	src := resources.Dashboard{
-		DashboardConfig: resources.DashboardConfig{
-			DisplayName:      "my dashboard",
-			WarehouseId:      "f00dcafe",
-			ParentPath:       "/some/path",
-			EmbedCredentials: true,
-		},
-
-		Permissions: []resources.Permission{
-			{
-				Level:    "CAN_VIEW",
-				UserName: "jane@doe.com",
-			},
-		},
-	}
-
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	out := schema.NewResources()
-	err = dashboardConverter{}.Convert(ctx, "my_dashboard", vin, out)
-	require.NoError(t, err)
-
-	// Assert equality on the job
-	assert.Equal(t, map[string]any{
-		"display_name":      "my dashboard",
-		"warehouse_id":      "f00dcafe",
-		"parent_path":       "/some/path",
-		"embed_credentials": true,
-	}, out.Dashboard["my_dashboard"])
-
-	// Assert equality on the permissions
-	assert.Equal(t, &schema.ResourcePermissions{
-		DashboardId: "${databricks_dashboard.my_dashboard.id}",
-		AccessControl: []schema.ResourcePermissionsAccessControl{
-			{
-				PermissionLevel: "CAN_VIEW",
-				UserName:        "jane@doe.com",
-			},
-		},
-	}, out.Permissions["dashboard_my_dashboard"])
-}
-
-func TestConvertDashboardSerializedDashboardString(t *testing.T) {
-	src := resources.Dashboard{
-		DashboardConfig: resources.DashboardConfig{
-			SerializedDashboard: `{ "json": true }`,
-		},
-	}
-
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	out := schema.NewResources()
-	err = dashboardConverter{}.Convert(ctx, "my_dashboard", vin, out)
-	require.NoError(t, err)
-
-	// Assert that the "serialized_dashboard" is included.
-	assert.Subset(t, out.Dashboard["my_dashboard"], map[string]any{
-		"serialized_dashboard": `{ "json": true }`,
-	})
-}
-
-func TestConvertDashboardSerializedDashboardAny(t *testing.T) {
-	src := resources.Dashboard{
-		DashboardConfig: resources.DashboardConfig{
-			SerializedDashboard: map[string]any{
-				"pages": []map[string]any{
-					{
-						"displayName": "New Page",
-						"layout":      []map[string]any{},
-					},
-				},
-			},
-		},
-		FilePath: "some/path/to/dashboard.lvdash.json",
-	}
-
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	out := schema.NewResources()
-	err = dashboardConverter{}.Convert(ctx, "my_dashboard", vin, out)
-	require.NoError(t, err)
-
-	// Assert that the "serialized_dashboard" is included.
-	assert.Subset(t, out.Dashboard["my_dashboard"], map[string]any{
-		"serialized_dashboard": `{"pages":[{"displayName":"New Page","layout":[]}]}`,
-	})
-
-	// Assert that the "file_path" is dropped.
-	assert.NotContains(t, out.Dashboard["my_dashboard"], "file_path")
-}
-
-func TestConvertDashboardDatasetCatalogSchema(t *testing.T) {
-	src := resources.Dashboard{
-		DashboardConfig: resources.DashboardConfig{
-			DisplayName:      "my dashboard",
-			WarehouseId:      "f00dcafe",
-			ParentPath:       "/some/path",
-			DatasetCatalog:   "main",
-			DatasetSchema:    "default",
-			EmbedCredentials: true,
-		},
-	}
-
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	out := schema.NewResources()
-	err = dashboardConverter{}.Convert(ctx, "my_dashboard", vin, out)
-	require.NoError(t, err)
-
-	// Assert that dataset_catalog and dataset_schema are included.
-	assert.Subset(t, out.Dashboard["my_dashboard"], map[string]any{
-		"display_name":      "my dashboard",
-		"warehouse_id":      "f00dcafe",
-		"parent_path":       "/some/path",
-		"dataset_catalog":   "main",
-		"dataset_schema":    "default",
-		"embed_credentials": true,
-	})
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_database_catalog.go b/bundle/deploy/terraform/tfdyn/convert_database_catalog.go
deleted file mode 100644
index 716c3baf814..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_database_catalog.go
+++ /dev/null
@@ -1,35 +0,0 @@
-package tfdyn
-
-import (
-	"context"
-
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/cli/libs/log"
-	"github.com/databricks/databricks-sdk-go/service/database"
-)
-
-type databaseCatalogConverter struct{}
-
-func (d databaseCatalogConverter) Convert(ctx context.Context, key string, vin dyn.Value, out *schema.Resources) error {
-	// Normalize the output value to the target schema.
-	vout, diags := convert.Normalize(database.DatabaseCatalog{}, vin)
-	for _, diag := range diags {
-		log.Debugf(ctx, "database Catalog normalization diagnostic: %s", diag.Summary)
-	}
-
-	var err error
-	vout, err = convertLifecycle(ctx, vout, vin.Get("lifecycle"))
-	if err != nil {
-		return err
-	}
-
-	out.DatabaseDatabaseCatalog[key] = vout.AsAny()
-
-	return nil
-}
-
-func init() {
-	registerConverter("database_catalogs", databaseCatalogConverter{})
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_database_instance.go b/bundle/deploy/terraform/tfdyn/convert_database_instance.go
deleted file mode 100644
index 1dfb4dc4c94..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_database_instance.go
+++ /dev/null
@@ -1,48 +0,0 @@
-package tfdyn
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/databricks/databricks-sdk-go/service/database"
-
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/cli/libs/log"
-)
-
-type databaseInstanceConverter struct{}
-
-func (d databaseInstanceConverter) Convert(ctx context.Context, key string, vin dyn.Value, out *schema.Resources) error {
-	// Normalize the output value to the target schema.
-	vout, diags := convert.Normalize(database.DatabaseInstance{}, vin)
-	for _, diag := range diags {
-		log.Debugf(ctx, "database instance normalization diagnostic: %s", diag.Summary)
-	}
-
-	// Always set purge_on_delete to true
-	vout, err := dyn.Set(vout, "purge_on_delete", dyn.V(true))
-	if err != nil {
-		return err
-	}
-
-	vout, err = convertLifecycle(ctx, vout, vin.Get("lifecycle"))
-	if err != nil {
-		return err
-	}
-
-	out.DatabaseInstance[key] = vout.AsAny()
-
-	// Configure permissions for this resource.
-	if permissions := convertPermissionsResource(ctx, vin); permissions != nil {
-		permissions.DatabaseInstanceName = fmt.Sprintf("${databricks_database_instance.%s.name}", key)
-		out.Permissions["database_instance_"+key] = permissions
-	}
-
-	return nil
-}
-
-func init() {
-	registerConverter("database_instances", databaseInstanceConverter{})
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_database_instance_test.go b/bundle/deploy/terraform/tfdyn/convert_database_instance_test.go
deleted file mode 100644
index 533c69abedc..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_database_instance_test.go
+++ /dev/null
@@ -1,118 +0,0 @@
-package tfdyn
-
-import (
-	"testing"
-
-	"github.com/databricks/cli/bundle/config/resources"
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/databricks-sdk-go/service/database"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestConvertDatabaseInstance(t *testing.T) {
-	src := resources.DatabaseInstance{
-		DatabaseInstance: database.DatabaseInstance{
-			Name:                      "test-db-instance",
-			Capacity:                  "CU_4",
-			NodeCount:                 2,
-			EnableReadableSecondaries: true,
-			RetentionWindowInDays:     14,
-			Stopped:                   false,
-		},
-	}
-
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	out := schema.NewResources()
-	err = databaseInstanceConverter{}.Convert(ctx, "my_database_instance", vin, out)
-	require.NoError(t, err)
-
-	databaseInstance := out.DatabaseInstance["my_database_instance"]
-	assert.Equal(t, map[string]any{
-		"name":                        "test-db-instance",
-		"capacity":                    "CU_4",
-		"node_count":                  int64(2),
-		"enable_readable_secondaries": true,
-		"retention_window_in_days":    int64(14),
-		"purge_on_delete":             true,
-	}, databaseInstance)
-}
-
-func TestConvertDatabaseInstanceWithMinimalConfig(t *testing.T) {
-	src := resources.DatabaseInstance{
-		DatabaseInstance: database.DatabaseInstance{
-			Name:     "minimal-db-instance",
-			Capacity: "CU_1",
-		},
-	}
-
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	out := schema.NewResources()
-	err = databaseInstanceConverter{}.Convert(ctx, "minimal_database_instance", vin, out)
-	require.NoError(t, err)
-
-	databaseInstance := out.DatabaseInstance["minimal_database_instance"]
-	assert.Equal(t, map[string]any{
-		"name":            "minimal-db-instance",
-		"capacity":        "CU_1",
-		"purge_on_delete": true,
-	}, databaseInstance)
-}
-
-func TestConvertDatabaseInstanceWithPermissions(t *testing.T) {
-	src := resources.DatabaseInstance{
-		DatabaseInstance: database.DatabaseInstance{
-			Name:     "db-instance-with-permissions",
-			Capacity: "CU_2",
-		},
-		Permissions: []resources.Permission{
-			{
-				Level:    "CAN_USE",
-				UserName: "user@example.com",
-			},
-			{
-				Level:                "CAN_MANAGE",
-				ServicePrincipalName: "sp-name",
-			},
-		},
-	}
-
-	// Add permissions to the dynamic value
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	out := schema.NewResources()
-	err = databaseInstanceConverter{}.Convert(ctx, "db_with_permissions", vin, out)
-	require.NoError(t, err)
-
-	databaseInstance := out.DatabaseInstance["db_with_permissions"]
-	assert.Equal(t, map[string]any{
-		"name":            "db-instance-with-permissions",
-		"purge_on_delete": true,
-		"capacity":        "CU_2",
-	}, databaseInstance)
-
-	// Assert permissions were created
-	assert.Equal(t, &schema.ResourcePermissions{
-		DatabaseInstanceName: "${databricks_database_instance.db_with_permissions.name}",
-		AccessControl: []schema.ResourcePermissionsAccessControl{
-			{
-				PermissionLevel: "CAN_USE",
-				UserName:        "user@example.com",
-			},
-			{
-				PermissionLevel:      "CAN_MANAGE",
-				ServicePrincipalName: "sp-name",
-			},
-		},
-	}, out.Permissions["database_instance_db_with_permissions"])
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_experiment.go b/bundle/deploy/terraform/tfdyn/convert_experiment.go
deleted file mode 100644
index a741b4dec4c..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_experiment.go
+++ /dev/null
@@ -1,50 +0,0 @@
-package tfdyn
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/cli/libs/log"
-)
-
-func convertExperimentResource(ctx context.Context, vin dyn.Value) (dyn.Value, error) {
-	// Normalize the output value to the target schema.
-	vout, diags := convert.Normalize(schema.ResourceMlflowExperiment{}, vin)
-	for _, diag := range diags {
-		log.Debugf(ctx, "experiment normalization diagnostic: %s", diag.Summary)
-	}
-
-	return vout, nil
-}
-
-type experimentConverter struct{}
-
-func (experimentConverter) Convert(ctx context.Context, key string, vin dyn.Value, out *schema.Resources) error {
-	vout, err := convertExperimentResource(ctx, vin)
-	if err != nil {
-		return err
-	}
-
-	vout, err = convertLifecycle(ctx, vout, vin.Get("lifecycle"))
-	if err != nil {
-		return err
-	}
-
-	// Add the converted resource to the output.
-	out.MlflowExperiment[key] = vout.AsAny()
-
-	// Configure permissions for this resource.
-	if permissions := convertPermissionsResource(ctx, vin); permissions != nil {
-		permissions.ExperimentId = fmt.Sprintf("${databricks_mlflow_experiment.%s.id}", key)
-		out.Permissions["mlflow_experiment_"+key] = permissions
-	}
-
-	return nil
-}
-
-func init() {
-	registerConverter("experiments", experimentConverter{})
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_experiment_test.go b/bundle/deploy/terraform/tfdyn/convert_experiment_test.go
deleted file mode 100644
index 9140ef13aca..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_experiment_test.go
+++ /dev/null
@@ -1,51 +0,0 @@
-package tfdyn
-
-import (
-	"testing"
-
-	"github.com/databricks/cli/bundle/config/resources"
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/databricks-sdk-go/service/ml"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestConvertExperiment(t *testing.T) {
-	src := resources.MlflowExperiment{
-		CreateExperiment: ml.CreateExperiment{
-			Name: "name",
-		},
-		Permissions: []resources.MlflowExperimentPermission{
-			{
-				Level:    "CAN_READ",
-				UserName: "jane@doe.com",
-			},
-		},
-	}
-
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	out := schema.NewResources()
-	err = experimentConverter{}.Convert(ctx, "my_experiment", vin, out)
-	require.NoError(t, err)
-
-	// Assert equality on the experiment
-	assert.Equal(t, map[string]any{
-		"name": "name",
-	}, out.MlflowExperiment["my_experiment"])
-
-	// Assert equality on the permissions
-	assert.Equal(t, &schema.ResourcePermissions{
-		ExperimentId: "${databricks_mlflow_experiment.my_experiment.id}",
-		AccessControl: []schema.ResourcePermissionsAccessControl{
-			{
-				PermissionLevel: "CAN_READ",
-				UserName:        "jane@doe.com",
-			},
-		},
-	}, out.Permissions["mlflow_experiment_my_experiment"])
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_grants.go b/bundle/deploy/terraform/tfdyn/convert_grants.go
deleted file mode 100644
index 1ddd99dd70f..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_grants.go
+++ /dev/null
@@ -1,39 +0,0 @@
-package tfdyn
-
-import (
-	"context"
-
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-)
-
-func convertGrantsResource(ctx context.Context, vin dyn.Value) *schema.ResourceGrants {
-	grants, ok := vin.Get("grants").AsSequence()
-	if !ok || len(grants) == 0 {
-		return nil
-	}
-
-	resource := &schema.ResourceGrants{}
-	for _, permission := range grants {
-		principal, _ := permission.Get("principal").AsString()
-		v, _ := permission.Get("privileges").AsSequence()
-
-		// Turn privileges into a slice of strings.
-		var privileges []string
-		for _, privilege := range v {
-			str, ok := privilege.AsString()
-			if !ok {
-				continue
-			}
-
-			privileges = append(privileges, str)
-		}
-
-		resource.Grant = append(resource.Grant, schema.ResourceGrantsGrant{
-			Principal:  principal,
-			Privileges: privileges,
-		})
-	}
-
-	return resource
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_grants_test.go b/bundle/deploy/terraform/tfdyn/convert_grants_test.go
deleted file mode 100644
index 6019ab823d2..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_grants_test.go
+++ /dev/null
@@ -1,71 +0,0 @@
-package tfdyn
-
-import (
-	"testing"
-
-	"github.com/databricks/cli/bundle/config/resources"
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/databricks-sdk-go/service/catalog"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestConvertGrants(t *testing.T) {
-	src := resources.RegisteredModel{
-		Grants: []catalog.PrivilegeAssignment{
-			{
-				Privileges: []catalog.Privilege{"EXECUTE", "FOO"},
-				Principal:  "jane@doe.com",
-			},
-			{
-				Privileges: []catalog.Privilege{"EXECUTE", "BAR"},
-				Principal:  "spn",
-			},
-		},
-	}
-
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	resource := convertGrantsResource(ctx, vin)
-	require.NotNil(t, resource)
-	assert.Equal(t, []schema.ResourceGrantsGrant{
-		{
-			Privileges: []string{"EXECUTE", "FOO"},
-			Principal:  "jane@doe.com",
-		},
-		{
-			Privileges: []string{"EXECUTE", "BAR"},
-			Principal:  "spn",
-		},
-	}, resource.Grant)
-}
-
-func TestConvertGrantsNil(t *testing.T) {
-	src := resources.RegisteredModel{
-		Grants: nil,
-	}
-
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	resource := convertGrantsResource(ctx, vin)
-	assert.Nil(t, resource)
-}
-
-func TestConvertGrantsEmpty(t *testing.T) {
-	src := resources.RegisteredModel{
-		Grants: []catalog.PrivilegeAssignment{},
-	}
-
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	resource := convertGrantsResource(ctx, vin)
-	assert.Nil(t, resource)
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_job.go b/bundle/deploy/terraform/tfdyn/convert_job.go
deleted file mode 100644
index c9f7e8219a4..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_job.go
+++ /dev/null
@@ -1,261 +0,0 @@
-package tfdyn
-
-import (
-	"cmp"
-	"context"
-	"fmt"
-	"slices"
-	"strings"
-
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/cli/libs/log"
-	"github.com/databricks/databricks-sdk-go/service/jobs"
-)
-
-// These are the task types that support the source field
-// https://docs.databricks.com/api/workspace/jobs/create
-var supportedTypeTasks = []string{
-	"dbt_task",
-	"gen_ai_compute_task",
-	"notebook_task",
-	"spark_python_task",
-	"sql_task.file",
-}
-
-func setSourceIfNotSet(task dyn.Value, defaultSource jobs.Source) (dyn.Value, error) {
-	for _, taskType := range supportedTypeTasks {
-		t, err := dyn.Get(task, taskType)
-		if err != nil {
-			continue
-		}
-
-		_, err = dyn.Get(t, "source")
-		if err != nil {
-			return dyn.Set(task, taskType+".source", dyn.V(string(defaultSource)))
-		}
-	}
-	return task, nil
-}
-
-func applyDefaultTaskSource(job dyn.Value) (dyn.Value, error) {
-	defaultSource := jobs.SourceWorkspace
-
-	// Check if the job has git_source set and set the default source to GIT if it does
-	_, err := dyn.Get(job, "git_source")
-	if err == nil {
-		defaultSource = jobs.SourceGit
-	}
-
-	// Then iterate over the tasks and set the source to the default if it's not set
-	return dyn.Map(job, "tasks", dyn.Foreach(func(_ dyn.Path, task dyn.Value) (dyn.Value, error) {
-		// Then iterate over the foreach tasks and set the source to the default if it's not set
-		task, err = dyn.Map(task, "for_each_task.task", func(_ dyn.Path, foreachTask dyn.Value) (dyn.Value, error) {
-			return setSourceIfNotSet(foreachTask, defaultSource)
-		})
-		if err != nil {
-			return task, err
-		}
-
-		return setSourceIfNotSet(task, defaultSource)
-	}))
-}
-
-func patchApplyPolicyDefaultValues(_ dyn.Path, v dyn.Value) (dyn.Value, error) {
-	// If the field "apply_policy_default_values" is not set, do nothing.
-	if b, ok := v.Get("apply_policy_default_values").AsBool(); !ok || !b {
-		return v, nil
-	}
-
-	// If the field "policy_id" is not set, do nothing.
-	if _, ok := v.Get("policy_id").AsString(); !ok {
-		return v, nil
-	}
-
-	// The field "apply_policy_default_values" is set.
-	// We need to collect the list of fields that are set explicitly
-	// and pass it to Terraform. This enables Terraform to clear
-	// server-side defaults from the update request, which in turn
-	// allows the backend to re-apply the policy defaults.
-	//
-	// For more details, see: https://github.com/databricks/terraform-provider-databricks/pull/4834
-	//
-	paths := dyn.CollectLeafPaths(v)
-
-	// If any of the map or sequence fields are set, always include them entirely instead of traversing the them.
-	for _, field := range []string{
-		"custom_tags",
-		"init_scripts",
-		"spark_conf",
-		"spark_env_vars",
-		"ssh_public_keys",
-	} {
-		if vv := v.Get(field); vv.IsValid() {
-			// Remove all paths that start with the field.
-			paths = slices.DeleteFunc(paths, func(p string) bool {
-				return strings.HasPrefix(p, field+".") || strings.HasPrefix(p, field+"[")
-			})
-			// Add the field to the paths.
-			paths = append(paths, field)
-		}
-	}
-
-	slices.Sort(paths)
-	valList := make([]dyn.Value, len(paths))
-	for i, s := range paths {
-		valList[i] = dyn.V(s)
-	}
-	v, err := dyn.Set(v, "__apply_policy_default_values_allow_list", dyn.V(valList))
-	if err != nil {
-		return dyn.InvalidValue, err
-	}
-
-	return v, nil
-}
-
-func convertJobResource(ctx context.Context, vin dyn.Value) (dyn.Value, error) {
-	// Normalize the input value to the underlying job schema.
-	// This removes superfluous keys and adapts the input to the expected schema.
-	vin, diags := convert.Normalize(jobs.JobSettings{}, vin)
-	for _, diag := range diags {
-		log.Debugf(ctx, "job normalization diagnostic: %s", diag.Summary)
-	}
-
-	// Sort the tasks of each job in the bundle by task key. Sorting
-	// the task keys ensures that the diff computed by terraform is correct and avoids
-	// recreates. For more details see the NOTE at
-	// https://registry.terraform.io/providers/databricks/databricks/latest/docs/resources/job#example-usage
-	// and https://github.com/databricks/terraform-provider-databricks/issues/4011
-	// and https://github.com/databricks/cli/pull/1776
-	vout := vin
-	var err error
-	tasks, ok := vin.Get("tasks").AsSequence()
-	if ok {
-		slices.SortFunc(tasks, func(a, b dyn.Value) int {
-			// We sort the tasks by their task key. Tasks without task keys are ordered
-			// before tasks with task keys. We do not error for those tasks
-			// since presence of a task_key is validated for in the Jobs backend.
-			tk1, ok1 := a.Get("task_key").AsString()
-			tk2, ok2 := b.Get("task_key").AsString()
-			if !ok1 && ok2 {
-				return -1
-			}
-			if ok1 && !ok2 {
-				return 1
-			}
-			if !ok1 && !ok2 {
-				return 0
-			}
-			return cmp.Compare(tk1, tk2)
-		})
-		vout, err = dyn.Set(vin, "tasks", dyn.V(tasks))
-		if err != nil {
-			return dyn.InvalidValue, err
-		}
-	}
-
-	// Apply default task source logic
-	vout, err = applyDefaultTaskSource(vout)
-	if err != nil {
-		return dyn.InvalidValue, err
-	}
-
-	// Modify top-level keys.
-	vout, err = renameKeys(vout, map[string]string{
-		"tasks":        "task",
-		"job_clusters": "job_cluster",
-		"parameters":   "parameter",
-		"environments": "environment",
-	})
-	if err != nil {
-		return dyn.InvalidValue, err
-	}
-
-	// Modify keys in the "git_source" block
-	vout, err = dyn.Map(vout, "git_source", func(_ dyn.Path, v dyn.Value) (dyn.Value, error) {
-		return renameKeys(v, map[string]string{
-			"git_branch":   "branch",
-			"git_commit":   "commit",
-			"git_provider": "provider",
-			"git_tag":      "tag",
-			"git_url":      "url",
-		})
-	})
-	if err != nil {
-		return dyn.InvalidValue, err
-	}
-
-	// Modify keys in the "task" blocks
-	vout, err = dyn.Map(vout, "task", dyn.Foreach(func(_ dyn.Path, v dyn.Value) (dyn.Value, error) {
-		// Modify "library" blocks for for_each_task
-		vout, err = dyn.Map(v, "for_each_task.task", func(_ dyn.Path, v dyn.Value) (dyn.Value, error) {
-			return renameKeys(v, map[string]string{
-				"libraries": "library",
-			})
-		})
-		if err != nil {
-			return dyn.InvalidValue, err
-		}
-
-		return renameKeys(vout, map[string]string{
-			"libraries": "library",
-		})
-	}))
-	if err != nil {
-		return dyn.InvalidValue, err
-	}
-
-	// Normalize the output value to the target schema.
-	vout, diags = convert.Normalize(schema.ResourceJob{}, vout)
-	for _, diag := range diags {
-		log.Debugf(ctx, "job normalization diagnostic: %s", diag.Summary)
-	}
-
-	// Apply __apply_policy_default_values_allow_list for tasks
-	vout, err = dyn.Map(vout, "task", dyn.Foreach(func(_ dyn.Path, v dyn.Value) (dyn.Value, error) {
-		return dyn.Map(v, "new_cluster", patchApplyPolicyDefaultValues)
-	}))
-	if err != nil {
-		return dyn.InvalidValue, err
-	}
-
-	// Apply __apply_policy_default_values_allow_list for job clusters
-	vout, err = dyn.Map(vout, "job_cluster", dyn.Foreach(func(_ dyn.Path, v dyn.Value) (dyn.Value, error) {
-		return dyn.Map(v, "new_cluster", patchApplyPolicyDefaultValues)
-	}))
-	if err != nil {
-		return dyn.InvalidValue, err
-	}
-
-	return vout, err
-}
-
-type jobConverter struct{}
-
-func (jobConverter) Convert(ctx context.Context, key string, vin dyn.Value, out *schema.Resources) error {
-	vout, err := convertJobResource(ctx, vin)
-	if err != nil {
-		return err
-	}
-
-	vout, err = convertLifecycle(ctx, vout, vin.Get("lifecycle"))
-	if err != nil {
-		return err
-	}
-
-	// Add the converted resource to the output.
-	out.Job[key] = vout.AsAny()
-
-	// Configure permissions for this resource.
-	if permissions := convertPermissionsResource(ctx, vin); permissions != nil {
-		permissions.JobId = fmt.Sprintf("${databricks_job.%s.id}", key)
-		out.Permissions["job_"+key] = permissions
-	}
-
-	return nil
-}
-
-func init() {
-	registerConverter("jobs", jobConverter{})
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_job_test.go b/bundle/deploy/terraform/tfdyn/convert_job_test.go
deleted file mode 100644
index 1f67369e916..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_job_test.go
+++ /dev/null
@@ -1,379 +0,0 @@
-package tfdyn
-
-import (
-	"reflect"
-	"slices"
-	"strings"
-	"testing"
-
-	"github.com/databricks/cli/bundle/config/resources"
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/cli/libs/textutil"
-	"github.com/databricks/databricks-sdk-go/service/compute"
-	"github.com/databricks/databricks-sdk-go/service/jobs"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestConvertJob(t *testing.T) {
-	src := resources.Job{
-		JobSettings: jobs.JobSettings{
-			Name: "my job",
-			JobClusters: []jobs.JobCluster{
-				{
-					JobClusterKey: "key",
-					NewCluster: compute.ClusterSpec{
-						SparkVersion: "10.4.x-scala2.12",
-					},
-				},
-			},
-			GitSource: &jobs.GitSource{
-				GitProvider: jobs.GitProviderGitHub,
-				GitUrl:      "https://github.com/foo/bar",
-			},
-			Parameters: []jobs.JobParameterDefinition{
-				{
-					Name:    "param1",
-					Default: "default1",
-				},
-				{
-					Name:    "param2",
-					Default: "default2",
-				},
-			},
-			Tasks: []jobs.Task{
-				{
-					TaskKey:       "task_key_b",
-					JobClusterKey: "job_cluster_key_b",
-					Libraries: []compute.Library{
-						{
-							Pypi: &compute.PythonPyPiLibrary{
-								Package: "package",
-							},
-						},
-						{
-							Whl: "/path/to/my.whl",
-						},
-					},
-				},
-				{
-					TaskKey:       "task_key_a",
-					JobClusterKey: "job_cluster_key_a",
-				},
-				{
-					TaskKey:       "task_key_c",
-					JobClusterKey: "job_cluster_key_c",
-				},
-				{
-					Description: "missing task key 😱",
-				},
-			},
-		},
-		Permissions: []resources.JobPermission{
-			{
-				Level:    "CAN_VIEW",
-				UserName: "jane@doe.com",
-			},
-		},
-	}
-
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	out := schema.NewResources()
-	err = jobConverter{}.Convert(ctx, "my_job", vin, out)
-	require.NoError(t, err)
-
-	// Assert equality on the job
-	assert.Equal(t, map[string]any{
-		"name": "my job",
-		"job_cluster": []any{
-			map[string]any{
-				"job_cluster_key": "key",
-				"new_cluster": map[string]any{
-					"spark_version": "10.4.x-scala2.12",
-				},
-			},
-		},
-		"git_source": map[string]any{
-			"provider": "gitHub",
-			"url":      "https://github.com/foo/bar",
-		},
-		"parameter": []any{
-			map[string]any{
-				"name":    "param1",
-				"default": "default1",
-			},
-			map[string]any{
-				"name":    "param2",
-				"default": "default2",
-			},
-		},
-		"task": []any{
-			map[string]any{
-				"description": "missing task key 😱",
-			},
-			map[string]any{
-				"task_key":        "task_key_a",
-				"job_cluster_key": "job_cluster_key_a",
-			},
-			map[string]any{
-				"task_key":        "task_key_b",
-				"job_cluster_key": "job_cluster_key_b",
-				"library": []any{
-					map[string]any{
-						"pypi": map[string]any{
-							"package": "package",
-						},
-					},
-					map[string]any{
-						"whl": "/path/to/my.whl",
-					},
-				},
-			},
-			map[string]any{
-				"task_key":        "task_key_c",
-				"job_cluster_key": "job_cluster_key_c",
-			},
-		},
-	}, out.Job["my_job"])
-
-	// Assert equality on the permissions
-	assert.Equal(t, &schema.ResourcePermissions{
-		JobId: "${databricks_job.my_job.id}",
-		AccessControl: []schema.ResourcePermissionsAccessControl{
-			{
-				PermissionLevel: "CAN_VIEW",
-				UserName:        "jane@doe.com",
-			},
-		},
-	}, out.Permissions["job_my_job"])
-}
-
-func TestConvertJobApplyPolicyDefaultValues(t *testing.T) {
-	src := resources.Job{
-		JobSettings: jobs.JobSettings{
-			Name: "my job",
-			JobClusters: []jobs.JobCluster{
-				{
-					JobClusterKey: "key",
-					NewCluster: compute.ClusterSpec{
-						ApplyPolicyDefaultValues: true,
-						PolicyId:                 "policy_id",
-						GcpAttributes: &compute.GcpAttributes{
-							Availability:  "SPOT",
-							LocalSsdCount: 2,
-						},
-					},
-				},
-				{
-					JobClusterKey: "key2",
-					NewCluster: compute.ClusterSpec{
-						ApplyPolicyDefaultValues: true,
-						PolicyId:                 "policy_id2",
-						CustomTags: map[string]string{
-							"key": "value",
-						},
-						InitScripts: []compute.InitScriptInfo{
-							{
-								Workspace: &compute.WorkspaceStorageInfo{
-									Destination: "/Workspace/path/to/init_script1",
-								},
-							},
-							{
-								Workspace: &compute.WorkspaceStorageInfo{
-									Destination: "/Workspace/path/to/init_script2",
-								},
-							},
-						},
-						SparkConf: map[string]string{
-							"key": "value",
-						},
-						SparkEnvVars: map[string]string{
-							"key": "value",
-						},
-						SshPublicKeys: []string{
-							"ssh-rsa 1234",
-						},
-					},
-				},
-				{
-					JobClusterKey: "key3",
-					NewCluster: compute.ClusterSpec{
-						ApplyPolicyDefaultValues: true,
-						SparkVersion:             "16.4.x-scala2.12",
-					},
-				},
-			},
-		},
-	}
-
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	out := schema.NewResources()
-	err = jobConverter{}.Convert(ctx, "my_job", vin, out)
-	require.NoError(t, err)
-
-	assert.Equal(t, map[string]any{
-		"name": "my job",
-		"job_cluster": []any{
-			map[string]any{
-				"job_cluster_key": "key",
-				"new_cluster": map[string]any{
-					"__apply_policy_default_values_allow_list": []any{
-						"apply_policy_default_values",
-						"gcp_attributes.availability",
-						"gcp_attributes.local_ssd_count",
-						"policy_id",
-					},
-					"apply_policy_default_values": true,
-					"policy_id":                   "policy_id",
-					"gcp_attributes": map[string]any{
-						"availability":    "SPOT",
-						"local_ssd_count": int64(2),
-					},
-				},
-			},
-			map[string]any{
-				"job_cluster_key": "key2",
-				"new_cluster": map[string]any{
-					"__apply_policy_default_values_allow_list": []any{
-						"apply_policy_default_values",
-						"custom_tags",
-						"init_scripts",
-						"policy_id",
-						"spark_conf",
-						"spark_env_vars",
-						"ssh_public_keys",
-					},
-					"apply_policy_default_values": true,
-					"policy_id":                   "policy_id2",
-					"custom_tags": map[string]any{
-						"key": "value",
-					},
-					"init_scripts": []any{
-						map[string]any{
-							"workspace": map[string]any{
-								"destination": "/Workspace/path/to/init_script1",
-							},
-						},
-						map[string]any{
-							"workspace": map[string]any{
-								"destination": "/Workspace/path/to/init_script2",
-							},
-						},
-					},
-					"spark_conf": map[string]any{
-						"key": "value",
-					},
-					"spark_env_vars": map[string]any{
-						"key": "value",
-					},
-					"ssh_public_keys": []any{
-						"ssh-rsa 1234",
-					},
-				},
-			},
-			map[string]any{
-				"job_cluster_key": "key3",
-				"new_cluster": map[string]any{
-					"apply_policy_default_values": true,
-					"spark_version":               "16.4.x-scala2.12",
-				},
-			},
-		},
-	}, out.Job["my_job"])
-}
-
-// TestSupportedTypeTasksComplete verifies that supportedTypeTasks includes all task types with a Source field.
-func TestSupportedTypeTasksComplete(t *testing.T) {
-	// Use reflection to find all task types that have a Source field
-	taskType := reflect.TypeFor[jobs.Task]()
-	var tasksWithSource []string
-
-	for i := range taskType.NumField() {
-		field := taskType.Field(i)
-
-		// Skip non-task fields (like DependsOn, Libraries, etc.)
-		if !strings.HasSuffix(field.Name, "Task") {
-			continue
-		}
-
-		// Get the type of the task field (e.g., *NotebookTask)
-		taskFieldType := field.Type
-		if taskFieldType.Kind() == reflect.Ptr {
-			taskFieldType = taskFieldType.Elem()
-		}
-
-		if taskFieldType.Kind() != reflect.Struct {
-			continue
-		}
-
-		// Recursively search for Source fields in this task type
-		// We only search one level deep to catch nested Source fields like sql_task.file
-		taskName := textutil.CamelToSnakeCase(field.Name)
-		sourcePaths := findSourceFieldsShallow(taskFieldType)
-		for _, path := range sourcePaths {
-			if path == "" {
-				tasksWithSource = append(tasksWithSource, taskName)
-			} else {
-				tasksWithSource = append(tasksWithSource, taskName+"."+path)
-			}
-		}
-	}
-
-	// Verify that all tasks with Source fields are in supportedTypeTasks
-	slices.Sort(tasksWithSource)
-	sortedSupported := make([]string, len(supportedTypeTasks))
-	copy(sortedSupported, supportedTypeTasks)
-	slices.Sort(sortedSupported)
-
-	assert.Equal(t, sortedSupported, tasksWithSource,
-		"supportedTypeTasks must include all task types with a Source field. "+
-			"If this test fails, update supportedTypeTasks in convert_job.go")
-}
-
-// findSourceFieldsShallow searches for Source fields in a struct type, going only one level deep.
-// Returns a list of paths to Source fields (e.g., "" for direct Source, "file" for sql_task.file).
-func findSourceFieldsShallow(t reflect.Type) []string {
-	if t.Kind() == reflect.Ptr {
-		t = t.Elem()
-	}
-
-	if t.Kind() != reflect.Struct {
-		return nil
-	}
-
-	var paths []string
-
-	for i := range t.NumField() {
-		field := t.Field(i)
-
-		// Check if this field is named "Source"
-		if field.Name == "Source" {
-			paths = append(paths, "")
-			continue
-		}
-
-		// Only search one level deep in nested structs
-		fieldType := field.Type
-		if fieldType.Kind() == reflect.Ptr {
-			fieldType = fieldType.Elem()
-		}
-
-		if fieldType.Kind() == reflect.Struct {
-			// Check if the nested struct has a Source field
-			if _, hasSource := fieldType.FieldByName("Source"); hasSource {
-				fieldName := textutil.CamelToSnakeCase(field.Name)
-				paths = append(paths, fieldName)
-			}
-		}
-	}
-
-	return paths
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_model.go b/bundle/deploy/terraform/tfdyn/convert_model.go
deleted file mode 100644
index 722f3aa6363..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_model.go
+++ /dev/null
@@ -1,50 +0,0 @@
-package tfdyn
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/cli/libs/log"
-)
-
-func convertModelResource(ctx context.Context, vin dyn.Value) (dyn.Value, error) {
-	// Normalize the output value to the target schema.
-	vout, diags := convert.Normalize(schema.ResourceMlflowModel{}, vin)
-	for _, diag := range diags {
-		log.Debugf(ctx, "model normalization diagnostic: %s", diag.Summary)
-	}
-
-	return vout, nil
-}
-
-type modelConverter struct{}
-
-func (modelConverter) Convert(ctx context.Context, key string, vin dyn.Value, out *schema.Resources) error {
-	vout, err := convertModelResource(ctx, vin)
-	if err != nil {
-		return err
-	}
-
-	vout, err = convertLifecycle(ctx, vout, vin.Get("lifecycle"))
-	if err != nil {
-		return err
-	}
-
-	// Add the converted resource to the output.
-	out.MlflowModel[key] = vout.AsAny()
-
-	// Configure permissions for this resource.
-	if permissions := convertPermissionsResource(ctx, vin); permissions != nil {
-		permissions.RegisteredModelId = fmt.Sprintf("${databricks_mlflow_model.%s.registered_model_id}", key)
-		out.Permissions["mlflow_model_"+key] = permissions
-	}
-
-	return nil
-}
-
-func init() {
-	registerConverter("models", modelConverter{})
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_model_serving_endpoint.go b/bundle/deploy/terraform/tfdyn/convert_model_serving_endpoint.go
deleted file mode 100644
index b9a5d95c145..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_model_serving_endpoint.go
+++ /dev/null
@@ -1,50 +0,0 @@
-package tfdyn
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/cli/libs/log"
-)
-
-func convertModelServingEndpointResource(ctx context.Context, vin dyn.Value) (dyn.Value, error) {
-	// Normalize the output value to the target schema.
-	vout, diags := convert.Normalize(schema.ResourceModelServing{}, vin)
-	for _, diag := range diags {
-		log.Debugf(ctx, "model serving endpoint normalization diagnostic: %s", diag.Summary)
-	}
-
-	return vout, nil
-}
-
-type modelServingEndpointConverter struct{}
-
-func (modelServingEndpointConverter) Convert(ctx context.Context, key string, vin dyn.Value, out *schema.Resources) error {
-	vout, err := convertModelServingEndpointResource(ctx, vin)
-	if err != nil {
-		return err
-	}
-
-	vout, err = convertLifecycle(ctx, vout, vin.Get("lifecycle"))
-	if err != nil {
-		return err
-	}
-
-	// Add the converted resource to the output.
-	out.ModelServing[key] = vout.AsAny()
-
-	// Configure permissions for this resource.
-	if permissions := convertPermissionsResource(ctx, vin); permissions != nil {
-		permissions.ServingEndpointId = fmt.Sprintf("${databricks_model_serving.%s.serving_endpoint_id}", key)
-		out.Permissions["model_serving_"+key] = permissions
-	}
-
-	return nil
-}
-
-func init() {
-	registerConverter("model_serving_endpoints", modelServingEndpointConverter{})
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_model_serving_endpoint_test.go b/bundle/deploy/terraform/tfdyn/convert_model_serving_endpoint_test.go
deleted file mode 100644
index fbb3d39a72c..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_model_serving_endpoint_test.go
+++ /dev/null
@@ -1,87 +0,0 @@
-package tfdyn
-
-import (
-	"testing"
-
-	"github.com/databricks/cli/bundle/config/resources"
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/databricks-sdk-go/service/serving"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestConvertModelServingEndpoint(t *testing.T) {
-	src := resources.ModelServingEndpoint{
-		CreateServingEndpoint: serving.CreateServingEndpoint{
-			Name: "name",
-			Config: &serving.EndpointCoreConfigInput{
-				ServedModels: []serving.ServedModelInput{
-					{
-						ModelName:          "model_name",
-						ModelVersion:       "1",
-						ScaleToZeroEnabled: true,
-						WorkloadSize:       "Small",
-					},
-				},
-				TrafficConfig: &serving.TrafficConfig{
-					Routes: []serving.Route{
-						{
-							ServedModelName:   "model_name-1",
-							TrafficPercentage: 100,
-						},
-					},
-				},
-			},
-		},
-		Permissions: []resources.ModelServingEndpointPermission{
-			{
-				Level:    "CAN_VIEW",
-				UserName: "jane@doe.com",
-			},
-		},
-	}
-
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	out := schema.NewResources()
-	err = modelServingEndpointConverter{}.Convert(ctx, "my_model_serving_endpoint", vin, out)
-	require.NoError(t, err)
-
-	// Assert equality on the model serving endpoint
-	assert.Equal(t, map[string]any{
-		"name": "name",
-		"config": map[string]any{
-			"served_models": []any{
-				map[string]any{
-					"model_name":            "model_name",
-					"model_version":         "1",
-					"scale_to_zero_enabled": true,
-					"workload_size":         "Small",
-				},
-			},
-			"traffic_config": map[string]any{
-				"routes": []any{
-					map[string]any{
-						"served_model_name":  "model_name-1",
-						"traffic_percentage": int64(100),
-					},
-				},
-			},
-		},
-	}, out.ModelServing["my_model_serving_endpoint"])
-
-	// Assert equality on the permissions
-	assert.Equal(t, &schema.ResourcePermissions{
-		ServingEndpointId: "${databricks_model_serving.my_model_serving_endpoint.serving_endpoint_id}",
-		AccessControl: []schema.ResourcePermissionsAccessControl{
-			{
-				PermissionLevel: "CAN_VIEW",
-				UserName:        "jane@doe.com",
-			},
-		},
-	}, out.Permissions["model_serving_my_model_serving_endpoint"])
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_model_test.go b/bundle/deploy/terraform/tfdyn/convert_model_test.go
deleted file mode 100644
index 3d7e8b22c4f..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_model_test.go
+++ /dev/null
@@ -1,73 +0,0 @@
-package tfdyn
-
-import (
-	"testing"
-
-	"github.com/databricks/cli/bundle/config/resources"
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/databricks-sdk-go/service/ml"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestConvertModel(t *testing.T) {
-	src := resources.MlflowModel{
-		CreateModelRequest: ml.CreateModelRequest{
-			Name:        "name",
-			Description: "description",
-			Tags: []ml.ModelTag{
-				{
-					Key:   "k1",
-					Value: "v1",
-				},
-				{
-					Key:   "k2",
-					Value: "v2",
-				},
-			},
-		},
-		Permissions: []resources.MlflowModelPermission{
-			{
-				Level:    "CAN_READ",
-				UserName: "jane@doe.com",
-			},
-		},
-	}
-
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	out := schema.NewResources()
-	err = modelConverter{}.Convert(ctx, "my_model", vin, out)
-	require.NoError(t, err)
-
-	// Assert equality on the model
-	assert.Equal(t, map[string]any{
-		"name":        "name",
-		"description": "description",
-		"tags": []any{
-			map[string]any{
-				"key":   "k1",
-				"value": "v1",
-			},
-			map[string]any{
-				"key":   "k2",
-				"value": "v2",
-			},
-		},
-	}, out.MlflowModel["my_model"])
-
-	// Assert equality on the permissions
-	assert.Equal(t, &schema.ResourcePermissions{
-		RegisteredModelId: "${databricks_mlflow_model.my_model.registered_model_id}",
-		AccessControl: []schema.ResourcePermissionsAccessControl{
-			{
-				PermissionLevel: "CAN_READ",
-				UserName:        "jane@doe.com",
-			},
-		},
-	}, out.Permissions["mlflow_model_my_model"])
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_permissions.go b/bundle/deploy/terraform/tfdyn/convert_permissions.go
deleted file mode 100644
index 99e8d29737c..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_permissions.go
+++ /dev/null
@@ -1,32 +0,0 @@
-package tfdyn
-
-import (
-	"context"
-
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-)
-
-func convertPermissionsResource(ctx context.Context, vin dyn.Value) *schema.ResourcePermissions {
-	permissions, ok := vin.Get("permissions").AsSequence()
-	if !ok || len(permissions) == 0 {
-		return nil
-	}
-
-	resource := &schema.ResourcePermissions{}
-	for _, permission := range permissions {
-		level, _ := permission.Get("level").AsString()
-		userName, _ := permission.Get("user_name").AsString()
-		groupName, _ := permission.Get("group_name").AsString()
-		servicePrincipalName, _ := permission.Get("service_principal_name").AsString()
-
-		resource.AccessControl = append(resource.AccessControl, schema.ResourcePermissionsAccessControl{
-			PermissionLevel:      level,
-			UserName:             userName,
-			GroupName:            groupName,
-			ServicePrincipalName: servicePrincipalName,
-		})
-	}
-
-	return resource
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_permissions_test.go b/bundle/deploy/terraform/tfdyn/convert_permissions_test.go
deleted file mode 100644
index 4d0d2d7481b..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_permissions_test.go
+++ /dev/null
@@ -1,84 +0,0 @@
-package tfdyn
-
-import (
-	"testing"
-
-	"github.com/databricks/cli/bundle/config/resources"
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestConvertPermissions(t *testing.T) {
-	src := resources.Job{
-		Permissions: []resources.JobPermission{
-			{
-				Level:    "CAN_VIEW",
-				UserName: "jane@doe.com",
-			},
-			{
-				Level:     "CAN_MANAGE",
-				GroupName: "special admins",
-			},
-			{
-				Level:                "CAN_MANAGE_RUN",
-				ServicePrincipalName: "spn",
-			},
-		},
-	}
-
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	resource := convertPermissionsResource(ctx, vin)
-	require.NotNil(t, resource)
-	assert.Equal(t, []schema.ResourcePermissionsAccessControl{
-		{
-			PermissionLevel:      "CAN_VIEW",
-			UserName:             "jane@doe.com",
-			GroupName:            "",
-			ServicePrincipalName: "",
-		},
-		{
-			PermissionLevel:      "CAN_MANAGE",
-			UserName:             "",
-			GroupName:            "special admins",
-			ServicePrincipalName: "",
-		},
-		{
-			PermissionLevel:      "CAN_MANAGE_RUN",
-			UserName:             "",
-			GroupName:            "",
-			ServicePrincipalName: "spn",
-		},
-	}, resource.AccessControl)
-}
-
-func TestConvertPermissionsNil(t *testing.T) {
-	src := resources.Job{
-		Permissions: nil,
-	}
-
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	resource := convertPermissionsResource(ctx, vin)
-	assert.Nil(t, resource)
-}
-
-func TestConvertPermissionsEmpty(t *testing.T) {
-	src := resources.Job{
-		Permissions: []resources.JobPermission{},
-	}
-
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	resource := convertPermissionsResource(ctx, vin)
-	assert.Nil(t, resource)
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_pipeline.go b/bundle/deploy/terraform/tfdyn/convert_pipeline.go
deleted file mode 100644
index 944ce0858c7..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_pipeline.go
+++ /dev/null
@@ -1,65 +0,0 @@
-package tfdyn
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/cli/libs/log"
-)
-
-func convertPipelineResource(ctx context.Context, vin dyn.Value) (dyn.Value, error) {
-	// Modify top-level keys.
-	vout, err := renameKeys(vin, map[string]string{
-		"libraries":     "library",
-		"clusters":      "cluster",
-		"notifications": "notification",
-	})
-	if err != nil {
-		return dyn.InvalidValue, err
-	}
-
-	vout, err = dyn.DropKeys(vout, []string{"dry_run"})
-	if err != nil {
-		return dyn.InvalidValue, err
-	}
-
-	// Normalize the output value to the target schema.
-	vout, diags := convert.Normalize(schema.ResourcePipeline{}, vout)
-	for _, diag := range diags {
-		log.Debugf(ctx, "pipeline normalization diagnostic: %s", diag.Summary)
-	}
-
-	return vout, err
-}
-
-type pipelineConverter struct{}
-
-func (pipelineConverter) Convert(ctx context.Context, key string, vin dyn.Value, out *schema.Resources) error {
-	vout, err := convertPipelineResource(ctx, vin)
-	if err != nil {
-		return err
-	}
-
-	vout, err = convertLifecycle(ctx, vout, vin.Get("lifecycle"))
-	if err != nil {
-		return err
-	}
-
-	// Add the converted resource to the output.
-	out.Pipeline[key] = vout.AsAny()
-
-	// Configure permissions for this resource.
-	if permissions := convertPermissionsResource(ctx, vin); permissions != nil {
-		permissions.PipelineId = fmt.Sprintf("${databricks_pipeline.%s.id}", key)
-		out.Permissions["pipeline_"+key] = permissions
-	}
-
-	return nil
-}
-
-func init() {
-	registerConverter("pipelines", pipelineConverter{})
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_pipeline_test.go b/bundle/deploy/terraform/tfdyn/convert_pipeline_test.go
deleted file mode 100644
index fe6620a00c2..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_pipeline_test.go
+++ /dev/null
@@ -1,140 +0,0 @@
-package tfdyn
-
-import (
-	"testing"
-
-	"github.com/databricks/cli/bundle/config/resources"
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/databricks-sdk-go/service/pipelines"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestConvertPipeline(t *testing.T) {
-	src := resources.Pipeline{
-		CreatePipeline: pipelines.CreatePipeline{
-			Name: "my pipeline",
-			// This fields is not part of TF schema yet, but once we upgrade to TF version that supports it, this test will fail because run_as
-			// will be exposed which is expected and test will need to be updated.
-			RunAs: &pipelines.RunAs{
-				UserName: "foo@bar.test",
-			},
-			// We expect AllowDuplicateNames and DryRun to be ignored and not passed to the TF output.
-			// This is not supported by TF now, so we don't want to expose it.
-			AllowDuplicateNames: true,
-			DryRun:              true,
-			Libraries: []pipelines.PipelineLibrary{
-				{
-					Notebook: &pipelines.NotebookLibrary{
-						Path: "notebook path",
-					},
-				},
-				{
-					File: &pipelines.FileLibrary{
-						Path: "file path",
-					},
-				},
-			},
-			Notifications: []pipelines.Notifications{
-				{
-					Alerts: []string{
-						"on-update-fatal-failure",
-					},
-					EmailRecipients: []string{
-						"jane@doe.com",
-					},
-				},
-				{
-					Alerts: []string{
-						"on-update-failure",
-						"on-flow-failure",
-					},
-					EmailRecipients: []string{
-						"jane@doe.com",
-						"john@doe.com",
-					},
-				},
-			},
-			Clusters: []pipelines.PipelineCluster{
-				{
-					Label:      "default",
-					NumWorkers: 1,
-				},
-			},
-		},
-		Permissions: []resources.PipelinePermission{
-			{
-				Level:    "CAN_VIEW",
-				UserName: "jane@doe.com",
-			},
-		},
-	}
-
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	out := schema.NewResources()
-	err = pipelineConverter{}.Convert(ctx, "my_pipeline", vin, out)
-	require.NoError(t, err)
-
-	// Assert equality on the pipeline
-	assert.Equal(t, map[string]any{
-		"name": "my pipeline",
-		"library": []any{
-			map[string]any{
-				"notebook": map[string]any{
-					"path": "notebook path",
-				},
-			},
-			map[string]any{
-				"file": map[string]any{
-					"path": "file path",
-				},
-			},
-		},
-		"notification": []any{
-			map[string]any{
-				"alerts": []any{
-					"on-update-fatal-failure",
-				},
-				"email_recipients": []any{
-					"jane@doe.com",
-				},
-			},
-			map[string]any{
-				"alerts": []any{
-					"on-update-failure",
-					"on-flow-failure",
-				},
-				"email_recipients": []any{
-					"jane@doe.com",
-					"john@doe.com",
-				},
-			},
-		},
-		"allow_duplicate_names": true,
-		"cluster": []any{
-			map[string]any{
-				"label":       "default",
-				"num_workers": int64(1),
-			},
-		},
-		"run_as": map[string]any{
-			"user_name": "foo@bar.test",
-		},
-	}, out.Pipeline["my_pipeline"])
-
-	// Assert equality on the permissions
-	assert.Equal(t, &schema.ResourcePermissions{
-		PipelineId: "${databricks_pipeline.my_pipeline.id}",
-		AccessControl: []schema.ResourcePermissionsAccessControl{
-			{
-				PermissionLevel: "CAN_VIEW",
-				UserName:        "jane@doe.com",
-			},
-		},
-	}, out.Permissions["pipeline_my_pipeline"])
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_postgres_branch.go b/bundle/deploy/terraform/tfdyn/convert_postgres_branch.go
deleted file mode 100644
index c1d598a1e64..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_postgres_branch.go
+++ /dev/null
@@ -1,63 +0,0 @@
-package tfdyn
-
-import (
-	"context"
-
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/cli/libs/log"
-)
-
-type postgresBranchConverter struct{}
-
-func (c postgresBranchConverter) Convert(ctx context.Context, key string, vin dyn.Value, out *schema.Resources) error {
-	// The bundle config has flattened BranchSpec fields at the top level.
-	// Terraform expects them nested in a "spec" block.
-	specFields := specFieldNames(schema.ResourcePostgresBranchSpec{})
-	topLevelFields := []string{"branch_id", "parent"}
-
-	// Build the spec block from the flattened fields
-	specMap := make(map[string]dyn.Value)
-	for _, field := range specFields {
-		if v := vin.Get(field); v.Kind() != dyn.KindInvalid {
-			specMap[field] = v
-		}
-	}
-
-	// Build the output with top-level fields and spec
-	outMap := make(map[string]dyn.Value)
-
-	// Keep top-level fields
-	for _, field := range topLevelFields {
-		if v := vin.Get(field); v.Kind() != dyn.KindInvalid {
-			outMap[field] = v
-		}
-	}
-
-	// Add spec block if we have any spec fields
-	if len(specMap) > 0 {
-		outMap["spec"] = dyn.V(specMap)
-	}
-
-	vout := dyn.V(outMap)
-
-	// Normalize the output value to the Terraform schema.
-	vout, diags := convert.Normalize(schema.ResourcePostgresBranch{}, vout)
-	for _, diag := range diags {
-		log.Debugf(ctx, "postgres branch normalization diagnostic: %s", diag.Summary)
-	}
-
-	vout, err := convertLifecycle(ctx, vout, vin.Get("lifecycle"))
-	if err != nil {
-		return err
-	}
-
-	out.PostgresBranch[key] = vout.AsAny()
-
-	return nil
-}
-
-func init() {
-	registerConverter("postgres_branches", postgresBranchConverter{})
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_postgres_branch_test.go b/bundle/deploy/terraform/tfdyn/convert_postgres_branch_test.go
deleted file mode 100644
index 0f8040caf19..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_postgres_branch_test.go
+++ /dev/null
@@ -1,102 +0,0 @@
-package tfdyn
-
-import (
-	"testing"
-	"time"
-
-	"github.com/databricks/cli/bundle/config/resources"
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/databricks-sdk-go/common/types/duration"
-	"github.com/databricks/databricks-sdk-go/service/postgres"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestConvertPostgresBranch(t *testing.T) {
-	src := resources.PostgresBranch{
-		PostgresBranchConfig: resources.PostgresBranchConfig{
-			BranchId: "my-branch",
-			Parent:   "projects/my-project",
-			BranchSpec: postgres.BranchSpec{
-				IsProtected: true,
-				NoExpiry:    true,
-			},
-		},
-	}
-
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	out := schema.NewResources()
-	err = postgresBranchConverter{}.Convert(ctx, "my_postgres_branch", vin, out)
-	require.NoError(t, err)
-
-	postgresBranch := out.PostgresBranch["my_postgres_branch"]
-	assert.Equal(t, map[string]any{
-		"branch_id": "my-branch",
-		"parent":    "projects/my-project",
-		"spec": map[string]any{
-			"is_protected": true,
-			"no_expiry":    true,
-		},
-	}, postgresBranch)
-}
-
-func TestConvertPostgresBranchWithSourceBranch(t *testing.T) {
-	src := resources.PostgresBranch{
-		PostgresBranchConfig: resources.PostgresBranchConfig{
-			BranchId: "feature-branch",
-			Parent:   "projects/my-project",
-			BranchSpec: postgres.BranchSpec{
-				SourceBranch:    "projects/my-project/branches/main",
-				SourceBranchLsn: "0/1234ABCD",
-				Ttl:             duration.New(86400 * time.Second),
-			},
-		},
-	}
-
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	out := schema.NewResources()
-	err = postgresBranchConverter{}.Convert(ctx, "feature_postgres_branch", vin, out)
-	require.NoError(t, err)
-
-	postgresBranch := out.PostgresBranch["feature_postgres_branch"]
-	assert.Equal(t, map[string]any{
-		"branch_id": "feature-branch",
-		"parent":    "projects/my-project",
-		"spec": map[string]any{
-			"source_branch":     "projects/my-project/branches/main",
-			"source_branch_lsn": "0/1234ABCD",
-			"ttl":               "86400s",
-		},
-	}, postgresBranch)
-}
-
-func TestConvertPostgresBranchMinimal(t *testing.T) {
-	src := resources.PostgresBranch{
-		PostgresBranchConfig: resources.PostgresBranchConfig{
-			BranchId: "minimal-branch",
-			Parent:   "projects/minimal-project",
-		},
-	}
-
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	out := schema.NewResources()
-	err = postgresBranchConverter{}.Convert(ctx, "minimal_postgres_branch", vin, out)
-	require.NoError(t, err)
-
-	postgresBranch := out.PostgresBranch["minimal_postgres_branch"]
-	assert.Equal(t, map[string]any{
-		"branch_id": "minimal-branch",
-		"parent":    "projects/minimal-project",
-	}, postgresBranch)
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_postgres_endpoint.go b/bundle/deploy/terraform/tfdyn/convert_postgres_endpoint.go
deleted file mode 100644
index f97582a2a33..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_postgres_endpoint.go
+++ /dev/null
@@ -1,63 +0,0 @@
-package tfdyn
-
-import (
-	"context"
-
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/cli/libs/log"
-)
-
-type postgresEndpointConverter struct{}
-
-func (c postgresEndpointConverter) Convert(ctx context.Context, key string, vin dyn.Value, out *schema.Resources) error {
-	// The bundle config has flattened EndpointSpec fields at the top level.
-	// Terraform expects them nested in a "spec" block.
-	specFields := specFieldNames(schema.ResourcePostgresEndpointSpec{})
-	topLevelFields := []string{"endpoint_id", "parent"}
-
-	// Build the spec block from the flattened fields
-	specMap := make(map[string]dyn.Value)
-	for _, field := range specFields {
-		if v := vin.Get(field); v.Kind() != dyn.KindInvalid {
-			specMap[field] = v
-		}
-	}
-
-	// Build the output with top-level fields and spec
-	outMap := make(map[string]dyn.Value)
-
-	// Keep top-level fields
-	for _, field := range topLevelFields {
-		if v := vin.Get(field); v.Kind() != dyn.KindInvalid {
-			outMap[field] = v
-		}
-	}
-
-	// Add spec block if we have any spec fields
-	if len(specMap) > 0 {
-		outMap["spec"] = dyn.V(specMap)
-	}
-
-	vout := dyn.V(outMap)
-
-	// Normalize the output value to the Terraform schema.
-	vout, diags := convert.Normalize(schema.ResourcePostgresEndpoint{}, vout)
-	for _, diag := range diags {
-		log.Debugf(ctx, "postgres endpoint normalization diagnostic: %s", diag.Summary)
-	}
-
-	vout, err := convertLifecycle(ctx, vout, vin.Get("lifecycle"))
-	if err != nil {
-		return err
-	}
-
-	out.PostgresEndpoint[key] = vout.AsAny()
-
-	return nil
-}
-
-func init() {
-	registerConverter("postgres_endpoints", postgresEndpointConverter{})
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_postgres_endpoint_test.go b/bundle/deploy/terraform/tfdyn/convert_postgres_endpoint_test.go
deleted file mode 100644
index 27f6ec5391e..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_postgres_endpoint_test.go
+++ /dev/null
@@ -1,134 +0,0 @@
-package tfdyn
-
-import (
-	"testing"
-	"time"
-
-	"github.com/databricks/cli/bundle/config/resources"
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/databricks-sdk-go/common/types/duration"
-	"github.com/databricks/databricks-sdk-go/service/postgres"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestConvertPostgresEndpoint(t *testing.T) {
-	src := resources.PostgresEndpoint{
-		PostgresEndpointConfig: resources.PostgresEndpointConfig{
-			EndpointId: "my-endpoint",
-			Parent:     "projects/my-project/branches/main",
-			EndpointSpec: postgres.EndpointSpec{
-				EndpointType:           postgres.EndpointTypeEndpointTypeReadWrite,
-				AutoscalingLimitMinCu:  0.5,
-				AutoscalingLimitMaxCu:  4,
-				SuspendTimeoutDuration: duration.New(300 * time.Second),
-			},
-		},
-	}
-
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	out := schema.NewResources()
-	err = postgresEndpointConverter{}.Convert(ctx, "my_postgres_endpoint", vin, out)
-	require.NoError(t, err)
-
-	postgresEndpoint := out.PostgresEndpoint["my_postgres_endpoint"]
-	assert.Equal(t, map[string]any{
-		"endpoint_id": "my-endpoint",
-		"parent":      "projects/my-project/branches/main",
-		"spec": map[string]any{
-			"endpoint_type":            "ENDPOINT_TYPE_READ_WRITE",
-			"autoscaling_limit_min_cu": 0.5,
-			"autoscaling_limit_max_cu": float64(4),
-			"suspend_timeout_duration": "300s",
-		},
-	}, postgresEndpoint)
-}
-
-func TestConvertPostgresEndpointReadOnly(t *testing.T) {
-	src := resources.PostgresEndpoint{
-		PostgresEndpointConfig: resources.PostgresEndpointConfig{
-			EndpointId: "readonly-endpoint",
-			Parent:     "projects/my-project/branches/main",
-			EndpointSpec: postgres.EndpointSpec{
-				EndpointType: postgres.EndpointTypeEndpointTypeReadOnly,
-				NoSuspension: true,
-			},
-		},
-	}
-
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	out := schema.NewResources()
-	err = postgresEndpointConverter{}.Convert(ctx, "readonly_postgres_endpoint", vin, out)
-	require.NoError(t, err)
-
-	postgresEndpoint := out.PostgresEndpoint["readonly_postgres_endpoint"]
-	assert.Equal(t, map[string]any{
-		"endpoint_id": "readonly-endpoint",
-		"parent":      "projects/my-project/branches/main",
-		"spec": map[string]any{
-			"endpoint_type": "ENDPOINT_TYPE_READ_ONLY",
-			"no_suspension": true,
-		},
-	}, postgresEndpoint)
-}
-
-func TestConvertPostgresEndpointWithSettings(t *testing.T) {
-	src := resources.PostgresEndpoint{
-		PostgresEndpointConfig: resources.PostgresEndpointConfig{
-			EndpointId: "settings-endpoint",
-			Parent:     "projects/my-project/branches/main",
-			EndpointSpec: postgres.EndpointSpec{
-				EndpointType: postgres.EndpointTypeEndpointTypeReadWrite,
-				Settings: &postgres.EndpointSettings{
-					PgSettings: map[string]string{
-						"max_connections":          "100",
-						"shared_buffers":           "256MB",
-						"effective_cache_size":     "1GB",
-						"maintenance_work_mem":     "64MB",
-						"checkpoint_timeout":       "15min",
-						"work_mem":                 "4MB",
-						"random_page_cost":         "1.1",
-						"effective_io_concurrency": "200",
-					},
-				},
-			},
-		},
-	}
-
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	out := schema.NewResources()
-	err = postgresEndpointConverter{}.Convert(ctx, "settings_postgres_endpoint", vin, out)
-	require.NoError(t, err)
-
-	postgresEndpoint := out.PostgresEndpoint["settings_postgres_endpoint"]
-	assert.Equal(t, map[string]any{
-		"endpoint_id": "settings-endpoint",
-		"parent":      "projects/my-project/branches/main",
-		"spec": map[string]any{
-			"endpoint_type": "ENDPOINT_TYPE_READ_WRITE",
-			"settings": map[string]any{
-				"pg_settings": map[string]any{
-					"max_connections":          "100",
-					"shared_buffers":           "256MB",
-					"effective_cache_size":     "1GB",
-					"maintenance_work_mem":     "64MB",
-					"checkpoint_timeout":       "15min",
-					"work_mem":                 "4MB",
-					"random_page_cost":         "1.1",
-					"effective_io_concurrency": "200",
-				},
-			},
-		},
-	}, postgresEndpoint)
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_postgres_project.go b/bundle/deploy/terraform/tfdyn/convert_postgres_project.go
deleted file mode 100644
index b6b1294caf9..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_postgres_project.go
+++ /dev/null
@@ -1,67 +0,0 @@
-package tfdyn
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/cli/libs/log"
-)
-
-type postgresProjectConverter struct{}
-
-func (c postgresProjectConverter) Convert(ctx context.Context, key string, vin dyn.Value, out *schema.Resources) error {
-	// The bundle config has flattened ProjectSpec fields at the top level.
-	// Terraform expects them nested in a "spec" block.
-	specFields := specFieldNames(schema.ResourcePostgresProjectSpec{})
-
-	// Build the spec block from the flattened fields
-	specMap := make(map[string]dyn.Value)
-	for _, field := range specFields {
-		if v := vin.Get(field); v.Kind() != dyn.KindInvalid {
-			specMap[field] = v
-		}
-	}
-
-	// Build the output with project_id and spec
-	outMap := make(map[string]dyn.Value)
-
-	// Keep project_id at top level
-	if v := vin.Get("project_id"); v.Kind() != dyn.KindInvalid {
-		outMap["project_id"] = v
-	}
-
-	// Add spec block if we have any spec fields
-	if len(specMap) > 0 {
-		outMap["spec"] = dyn.V(specMap)
-	}
-
-	vout := dyn.V(outMap)
-
-	// Normalize the output value to the Terraform schema.
-	vout, diags := convert.Normalize(schema.ResourcePostgresProject{}, vout)
-	for _, diag := range diags {
-		log.Debugf(ctx, "postgres project normalization diagnostic: %s", diag.Summary)
-	}
-
-	vout, err := convertLifecycle(ctx, vout, vin.Get("lifecycle"))
-	if err != nil {
-		return err
-	}
-
-	out.PostgresProject[key] = vout.AsAny()
-
-	// Configure permissions for this resource.
-	if permissions := convertPermissionsResource(ctx, vin); permissions != nil {
-		permissions.DatabaseProjectName = fmt.Sprintf("${databricks_postgres_project.%s.project_id}", key)
-		out.Permissions["postgres_project_"+key] = permissions
-	}
-
-	return nil
-}
-
-func init() {
-	registerConverter("postgres_projects", postgresProjectConverter{})
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_postgres_project_test.go b/bundle/deploy/terraform/tfdyn/convert_postgres_project_test.go
deleted file mode 100644
index 696a6e76c28..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_postgres_project_test.go
+++ /dev/null
@@ -1,130 +0,0 @@
-package tfdyn
-
-import (
-	"testing"
-	"time"
-
-	"github.com/databricks/cli/bundle/config/resources"
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/databricks-sdk-go/common/types/duration"
-	"github.com/databricks/databricks-sdk-go/service/postgres"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestConvertPostgresProject(t *testing.T) {
-	src := resources.PostgresProject{
-		PostgresProjectConfig: resources.PostgresProjectConfig{
-			ProjectId: "my-project",
-			ProjectSpec: postgres.ProjectSpec{
-				DisplayName:              "My Postgres Project",
-				PgVersion:                17,
-				HistoryRetentionDuration: duration.New(86400 * time.Second),
-				DefaultEndpointSettings: &postgres.ProjectDefaultEndpointSettings{
-					AutoscalingLimitMinCu:  0.5,
-					AutoscalingLimitMaxCu:  4,
-					SuspendTimeoutDuration: duration.New(300 * time.Second),
-				},
-			},
-		},
-	}
-
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	out := schema.NewResources()
-	err = postgresProjectConverter{}.Convert(ctx, "my_postgres_project", vin, out)
-	require.NoError(t, err)
-
-	postgresProject := out.PostgresProject["my_postgres_project"]
-	assert.Equal(t, map[string]any{
-		"project_id": "my-project",
-		"spec": map[string]any{
-			"display_name":               "My Postgres Project",
-			"pg_version":                 int64(17),
-			"history_retention_duration": "86400s",
-			"default_endpoint_settings": map[string]any{
-				"autoscaling_limit_min_cu": 0.5,
-				"autoscaling_limit_max_cu": float64(4),
-				"suspend_timeout_duration": "300s",
-			},
-		},
-	}, postgresProject)
-}
-
-func TestConvertPostgresProjectWithPermissions(t *testing.T) {
-	src := resources.PostgresProject{
-		PostgresProjectConfig: resources.PostgresProjectConfig{
-			ProjectId: "my-project",
-			ProjectSpec: postgres.ProjectSpec{
-				DisplayName: "My Postgres Project",
-				PgVersion:   17,
-			},
-		},
-		Permissions: []resources.Permission{
-			{
-				Level:    "CAN_USE",
-				UserName: "user@example.com",
-			},
-			{
-				Level:                "CAN_MANAGE",
-				ServicePrincipalName: "sp-name",
-			},
-		},
-	}
-
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	out := schema.NewResources()
-	err = postgresProjectConverter{}.Convert(ctx, "my_postgres_project", vin, out)
-	require.NoError(t, err)
-
-	postgresProject := out.PostgresProject["my_postgres_project"]
-	assert.Equal(t, map[string]any{
-		"project_id": "my-project",
-		"spec": map[string]any{
-			"display_name": "My Postgres Project",
-			"pg_version":   int64(17),
-		},
-	}, postgresProject)
-
-	assert.Equal(t, &schema.ResourcePermissions{
-		DatabaseProjectName: "${databricks_postgres_project.my_postgres_project.project_id}",
-		AccessControl: []schema.ResourcePermissionsAccessControl{
-			{
-				PermissionLevel: "CAN_USE",
-				UserName:        "user@example.com",
-			},
-			{
-				PermissionLevel:      "CAN_MANAGE",
-				ServicePrincipalName: "sp-name",
-			},
-		},
-	}, out.Permissions["postgres_project_my_postgres_project"])
-}
-
-func TestConvertPostgresProjectMinimal(t *testing.T) {
-	src := resources.PostgresProject{
-		PostgresProjectConfig: resources.PostgresProjectConfig{
-			ProjectId: "minimal-project",
-		},
-	}
-
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	out := schema.NewResources()
-	err = postgresProjectConverter{}.Convert(ctx, "minimal_postgres_project", vin, out)
-	require.NoError(t, err)
-
-	postgresProject := out.PostgresProject["minimal_postgres_project"]
-	assert.Equal(t, map[string]any{
-		"project_id": "minimal-project",
-	}, postgresProject)
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_quality_monitor.go b/bundle/deploy/terraform/tfdyn/convert_quality_monitor.go
deleted file mode 100644
index 3e78bacc702..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_quality_monitor.go
+++ /dev/null
@@ -1,42 +0,0 @@
-package tfdyn
-
-import (
-	"context"
-
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/cli/libs/log"
-)
-
-func convertQualityMonitorResource(ctx context.Context, vin dyn.Value) (dyn.Value, error) {
-	// Normalize the output value to the target schema.
-	vout, diags := convert.Normalize(schema.ResourceQualityMonitor{}, vin)
-	for _, diag := range diags {
-		log.Debugf(ctx, "monitor normalization diagnostic: %s", diag.Summary)
-	}
-	return vout, nil
-}
-
-type qualityMonitorConverter struct{}
-
-func (qualityMonitorConverter) Convert(ctx context.Context, key string, vin dyn.Value, out *schema.Resources) error {
-	vout, err := convertQualityMonitorResource(ctx, vin)
-	if err != nil {
-		return err
-	}
-
-	vout, err = convertLifecycle(ctx, vout, vin.Get("lifecycle"))
-	if err != nil {
-		return err
-	}
-
-	// Add the converted resource to the output.
-	out.QualityMonitor[key] = vout.AsAny()
-
-	return nil
-}
-
-func init() {
-	registerConverter("quality_monitors", qualityMonitorConverter{})
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_quality_monitor_test.go b/bundle/deploy/terraform/tfdyn/convert_quality_monitor_test.go
deleted file mode 100644
index ad14945ff51..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_quality_monitor_test.go
+++ /dev/null
@@ -1,45 +0,0 @@
-package tfdyn
-
-import (
-	"testing"
-
-	"github.com/databricks/cli/bundle/config/resources"
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/databricks-sdk-go/service/catalog"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestConvertQualityMonitor(t *testing.T) {
-	src := resources.QualityMonitor{
-		TableName: "test_table_name",
-		CreateMonitor: catalog.CreateMonitor{
-			AssetsDir:        "assets_dir",
-			OutputSchemaName: "output_schema_name",
-			InferenceLog: &catalog.MonitorInferenceLog{
-				ModelIdCol:    "model_id",
-				PredictionCol: "test_prediction_col",
-				ProblemType:   "PROBLEM_TYPE_CLASSIFICATION",
-			},
-		},
-	}
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-	ctx := t.Context()
-	out := schema.NewResources()
-	err = qualityMonitorConverter{}.Convert(ctx, "my_monitor", vin, out)
-
-	require.NoError(t, err)
-	assert.Equal(t, map[string]any{
-		"assets_dir":         "assets_dir",
-		"output_schema_name": "output_schema_name",
-		"table_name":         "test_table_name",
-		"inference_log": map[string]any{
-			"model_id_col":   "model_id",
-			"prediction_col": "test_prediction_col",
-			"problem_type":   "PROBLEM_TYPE_CLASSIFICATION",
-		},
-	}, out.QualityMonitor["my_monitor"])
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_registered_model.go b/bundle/deploy/terraform/tfdyn/convert_registered_model.go
deleted file mode 100644
index 49e05b47e54..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_registered_model.go
+++ /dev/null
@@ -1,50 +0,0 @@
-package tfdyn
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/cli/libs/log"
-)
-
-func convertRegisteredModelResource(ctx context.Context, vin dyn.Value) (dyn.Value, error) {
-	// Normalize the output value to the target schema.
-	vout, diags := convert.Normalize(schema.ResourceRegisteredModel{}, vin)
-	for _, diag := range diags {
-		log.Debugf(ctx, "registered model normalization diagnostic: %s", diag.Summary)
-	}
-
-	return vout, nil
-}
-
-type registeredModelConverter struct{}
-
-func (registeredModelConverter) Convert(ctx context.Context, key string, vin dyn.Value, out *schema.Resources) error {
-	vout, err := convertRegisteredModelResource(ctx, vin)
-	if err != nil {
-		return err
-	}
-
-	vout, err = convertLifecycle(ctx, vout, vin.Get("lifecycle"))
-	if err != nil {
-		return err
-	}
-
-	// Add the converted resource to the output.
-	out.RegisteredModel[key] = vout.AsAny()
-
-	// Configure grants for this resource.
-	if grants := convertGrantsResource(ctx, vin); grants != nil {
-		grants.Function = fmt.Sprintf("${databricks_registered_model.%s.id}", key)
-		out.Grants["registered_model_"+key] = grants
-	}
-
-	return nil
-}
-
-func init() {
-	registerConverter("registered_models", registeredModelConverter{})
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_registered_model_test.go b/bundle/deploy/terraform/tfdyn/convert_registered_model_test.go
deleted file mode 100644
index dab20f45eb8..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_registered_model_test.go
+++ /dev/null
@@ -1,57 +0,0 @@
-package tfdyn
-
-import (
-	"testing"
-
-	"github.com/databricks/cli/bundle/config/resources"
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/databricks-sdk-go/service/catalog"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestConvertRegisteredModel(t *testing.T) {
-	src := resources.RegisteredModel{
-		CreateRegisteredModelRequest: catalog.CreateRegisteredModelRequest{
-			Name:        "name",
-			CatalogName: "catalog",
-			SchemaName:  "schema",
-			Comment:     "comment",
-		},
-		Grants: []catalog.PrivilegeAssignment{
-			{
-				Privileges: []catalog.Privilege{catalog.PrivilegeExecute},
-				Principal:  "jane@doe.com",
-			},
-		},
-	}
-
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	out := schema.NewResources()
-	err = registeredModelConverter{}.Convert(ctx, "my_registered_model", vin, out)
-	require.NoError(t, err)
-
-	// Assert equality on the registered model
-	assert.Equal(t, map[string]any{
-		"name":         "name",
-		"catalog_name": "catalog",
-		"schema_name":  "schema",
-		"comment":      "comment",
-	}, out.RegisteredModel["my_registered_model"])
-
-	// Assert equality on the grants
-	assert.Equal(t, &schema.ResourceGrants{
-		Function: "${databricks_registered_model.my_registered_model.id}",
-		Grant: []schema.ResourceGrantsGrant{
-			{
-				Privileges: []string{"EXECUTE"},
-				Principal:  "jane@doe.com",
-			},
-		},
-	}, out.Grants["registered_model_my_registered_model"])
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_schema.go b/bundle/deploy/terraform/tfdyn/convert_schema.go
deleted file mode 100644
index 33fd8aab046..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_schema.go
+++ /dev/null
@@ -1,58 +0,0 @@
-package tfdyn
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/cli/libs/log"
-)
-
-func convertSchemaResource(ctx context.Context, vin dyn.Value) (dyn.Value, error) {
-	// Normalize the output value to the target schema.
-	v, diags := convert.Normalize(schema.ResourceSchema{}, vin)
-	for _, diag := range diags {
-		log.Debugf(ctx, "schema normalization diagnostic: %s", diag.Summary)
-	}
-
-	// We always set force destroy as it allows DABs to manage the lifecycle
-	// of the schema. It's the responsibility of the CLI to ensure the user
-	// is adequately warned when they try to delete a UC schema.
-	vout, err := dyn.SetByPath(v, dyn.MustPathFromString("force_destroy"), dyn.V(true))
-	if err != nil {
-		return dyn.InvalidValue, err
-	}
-
-	return vout, nil
-}
-
-type schemaConverter struct{}
-
-func (schemaConverter) Convert(ctx context.Context, key string, vin dyn.Value, out *schema.Resources) error {
-	vout, err := convertSchemaResource(ctx, vin)
-	if err != nil {
-		return err
-	}
-
-	vout, err = convertLifecycle(ctx, vout, vin.Get("lifecycle"))
-	if err != nil {
-		return err
-	}
-
-	// Add the converted resource to the output.
-	out.Schema[key] = vout.AsAny()
-
-	// Configure grants for this resource.
-	if grants := convertGrantsResource(ctx, vin); grants != nil {
-		grants.Schema = fmt.Sprintf("${databricks_schema.%s.id}", key)
-		out.Grants["schema_"+key] = grants
-	}
-
-	return nil
-}
-
-func init() {
-	registerConverter("schemas", schemaConverter{})
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_schema_test.go b/bundle/deploy/terraform/tfdyn/convert_schema_test.go
deleted file mode 100644
index 1d2431a5e16..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_schema_test.go
+++ /dev/null
@@ -1,74 +0,0 @@
-package tfdyn
-
-import (
-	"testing"
-
-	"github.com/databricks/cli/bundle/config/resources"
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/databricks-sdk-go/service/catalog"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestConvertSchema(t *testing.T) {
-	src := resources.Schema{
-		CreateSchema: catalog.CreateSchema{
-			Name:        "name",
-			CatalogName: "catalog",
-			Comment:     "comment",
-			Properties: map[string]string{
-				"k1": "v1",
-				"k2": "v2",
-			},
-			StorageRoot: "root",
-		},
-		Grants: []catalog.PrivilegeAssignment{
-			{
-				Privileges: []catalog.Privilege{catalog.PrivilegeExecute},
-				Principal:  "jack@gmail.com",
-			},
-			{
-				Privileges: []catalog.Privilege{catalog.PrivilegeSelect},
-				Principal:  "jane@gmail.com",
-			},
-		},
-	}
-
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	out := schema.NewResources()
-	err = schemaConverter{}.Convert(ctx, "my_schema", vin, out)
-	require.NoError(t, err)
-
-	// Assert equality on the schema
-	assert.Equal(t, map[string]any{
-		"name":         "name",
-		"catalog_name": "catalog",
-		"comment":      "comment",
-		"properties": map[string]any{
-			"k1": "v1",
-			"k2": "v2",
-		},
-		"force_destroy": true,
-		"storage_root":  "root",
-	}, out.Schema["my_schema"])
-
-	// Assert equality on the grants
-	assert.Equal(t, &schema.ResourceGrants{
-		Schema: "${databricks_schema.my_schema.id}",
-		Grant: []schema.ResourceGrantsGrant{
-			{
-				Privileges: []string{"EXECUTE"},
-				Principal:  "jack@gmail.com",
-			},
-			{
-				Privileges: []string{"SELECT"},
-				Principal:  "jane@gmail.com",
-			},
-		},
-	}, out.Grants["schema_my_schema"])
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_secret_scope.go b/bundle/deploy/terraform/tfdyn/convert_secret_scope.go
deleted file mode 100644
index fe6dfce79c9..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_secret_scope.go
+++ /dev/null
@@ -1,89 +0,0 @@
-package tfdyn
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/cli/libs/log"
-	"github.com/databricks/databricks-sdk-go/service/workspace"
-)
-
-type resourceSecretAcl struct {
-	schema.ResourceSecretAcl
-	DependsOn []string `json:"depends_on,omitempty"`
-}
-
-type secretScopeConverter struct{}
-
-func convertPermissionsSecretScope(key, scopeName string, permissions []dyn.Value, out *schema.Resources) {
-	var previousAclKey string
-
-	for idx, permission := range permissions {
-		level, _ := permission.Get("level").AsString()
-		userName, _ := permission.Get("user_name").AsString()
-		groupName, _ := permission.Get("group_name").AsString()
-		servicePrincipalName, _ := permission.Get("service_principal_name").AsString()
-
-		principal := ""
-		if userName != "" {
-			principal = userName
-		} else if groupName != "" {
-			principal = groupName
-		} else if servicePrincipalName != "" {
-			principal = servicePrincipalName
-		}
-
-		// Build depends_on list - always depend on scope, plus previous ACL if exists.
-		// This forces Terraform to execute ACL operations sequentially, avoiding
-		// a backend race condition where parallel ACL modifications return inconsistent results.
-		dependsOn := []string{"databricks_secret_scope." + key}
-		if previousAclKey != "" {
-			dependsOn = append(dependsOn, "databricks_secret_acl."+previousAclKey)
-		}
-
-		acl := &resourceSecretAcl{
-			ResourceSecretAcl: schema.ResourceSecretAcl{
-				Permission: level,
-				Principal:  principal,
-				Scope:      scopeName,
-			},
-			DependsOn: dependsOn,
-		}
-
-		aclKey := fmt.Sprintf("secret_acl_%s_%d", key, idx)
-		out.SecretAcl[aclKey] = acl
-
-		previousAclKey = aclKey
-	}
-}
-
-func (s secretScopeConverter) Convert(ctx context.Context, key string, vin dyn.Value, out *schema.Resources) error {
-	// Normalize the output value to the target schema.
-	vout, diags := convert.Normalize(workspace.SecretScope{}, vin)
-	for _, diag := range diags {
-		log.Debugf(ctx, "secret scope normalization diagnostic: %s", diag.Summary)
-	}
-
-	vout, err := convertLifecycle(ctx, vout, vin.Get("lifecycle"))
-	if err != nil {
-		return err
-	}
-
-	out.SecretScope[key] = vout.AsAny()
-
-	// Configure permissions for this resource
-	scopeName, _ := vin.Get("name").AsString()
-	permissions, ok := vin.Get("permissions").AsSequence()
-	if ok && len(permissions) > 0 {
-		convertPermissionsSecretScope(key, scopeName, permissions, out)
-	}
-
-	return nil
-}
-
-func init() {
-	registerConverter("secret_scopes", secretScopeConverter{})
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_secret_scope_test.go b/bundle/deploy/terraform/tfdyn/convert_secret_scope_test.go
deleted file mode 100644
index f508ff7526a..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_secret_scope_test.go
+++ /dev/null
@@ -1,101 +0,0 @@
-package tfdyn
-
-import (
-	"testing"
-
-	"github.com/databricks/cli/bundle/config/resources"
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestConvertSecretScopeWithPermissions(t *testing.T) {
-	src := resources.SecretScope{
-		Name: "my_scope",
-		Permissions: []resources.SecretScopePermission{
-			{UserName: "user@example.com", Level: resources.SecretScopePermissionLevelWrite},
-			{GroupName: "data-team", Level: resources.SecretScopePermissionLevelRead},
-			{ServicePrincipalName: "sp-uuid", Level: resources.SecretScopePermissionLevelManage},
-		},
-	}
-
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	out := schema.NewResources()
-	err = secretScopeConverter{}.Convert(ctx, "my_scope", vin, out)
-	require.NoError(t, err)
-
-	// Verify ACL count
-	assert.Len(t, out.SecretAcl, 3)
-
-	// Verify first ACL depends only on scope
-	acl0 := out.SecretAcl["secret_acl_my_scope_0"].(*resourceSecretAcl)
-	assert.Equal(t, "user@example.com", acl0.Principal)
-	assert.Equal(t, "WRITE", acl0.Permission)
-	assert.Equal(t, []string{"databricks_secret_scope.my_scope"}, acl0.DependsOn)
-
-	// Verify second ACL depends on scope + first ACL (sequential execution)
-	acl1 := out.SecretAcl["secret_acl_my_scope_1"].(*resourceSecretAcl)
-	assert.Equal(t, "data-team", acl1.Principal)
-	assert.Equal(t, "READ", acl1.Permission)
-	assert.Equal(t, []string{
-		"databricks_secret_scope.my_scope",
-		"databricks_secret_acl.secret_acl_my_scope_0",
-	}, acl1.DependsOn)
-
-	// Verify third ACL depends on scope + second ACL (sequential execution)
-	acl2 := out.SecretAcl["secret_acl_my_scope_2"].(*resourceSecretAcl)
-	assert.Equal(t, "sp-uuid", acl2.Principal)
-	assert.Equal(t, "MANAGE", acl2.Permission)
-	assert.Equal(t, []string{
-		"databricks_secret_scope.my_scope",
-		"databricks_secret_acl.secret_acl_my_scope_1",
-	}, acl2.DependsOn)
-}
-
-func TestConvertSecretScopeSinglePermission(t *testing.T) {
-	src := resources.SecretScope{
-		Name: "single_scope",
-		Permissions: []resources.SecretScopePermission{
-			{UserName: "user@example.com", Level: resources.SecretScopePermissionLevelManage},
-		},
-	}
-
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	out := schema.NewResources()
-	err = secretScopeConverter{}.Convert(ctx, "single_scope", vin, out)
-	require.NoError(t, err)
-
-	// Single ACL should only depend on scope (no chaining needed)
-	assert.Len(t, out.SecretAcl, 1)
-	acl := out.SecretAcl["secret_acl_single_scope_0"].(*resourceSecretAcl)
-	assert.Equal(t, "user@example.com", acl.Principal)
-	assert.Equal(t, []string{"databricks_secret_scope.single_scope"}, acl.DependsOn)
-}
-
-func TestConvertSecretScopeNoPermissions(t *testing.T) {
-	src := resources.SecretScope{
-		Name: "no_permissions_scope",
-	}
-
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	out := schema.NewResources()
-	err = secretScopeConverter{}.Convert(ctx, "no_permissions_scope", vin, out)
-	require.NoError(t, err)
-
-	// No ACLs should be created
-	assert.Len(t, out.SecretAcl, 0)
-
-	// But the scope should still be created
-	assert.Contains(t, out.SecretScope, "no_permissions_scope")
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_sql_warehouse.go b/bundle/deploy/terraform/tfdyn/convert_sql_warehouse.go
deleted file mode 100644
index 0107ba24601..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_sql_warehouse.go
+++ /dev/null
@@ -1,50 +0,0 @@
-package tfdyn
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/cli/libs/log"
-	"github.com/databricks/databricks-sdk-go/service/sql"
-)
-
-func convertSqlWarehouseResource(ctx context.Context, vin dyn.Value) (dyn.Value, error) {
-	vout, diags := convert.Normalize(sql.CreateWarehouseRequest{}, vin)
-	for _, diag := range diags {
-		log.Debugf(ctx, "sql warehouse normalization diagnostic: %s", diag.Summary)
-	}
-
-	return vout, nil
-}
-
-type sqlWarehouseConverter struct{}
-
-func (sqlWarehouseConverter) Convert(ctx context.Context, key string, vin dyn.Value, out *schema.Resources) error {
-	vout, err := convertSqlWarehouseResource(ctx, vin)
-	if err != nil {
-		return err
-	}
-
-	vout, err = convertLifecycle(ctx, vout, vin.Get("lifecycle"))
-	if err != nil {
-		return err
-	}
-
-	// Add the converted resource to the output.
-	out.SqlEndpoint[key] = vout.AsAny()
-
-	// Configure permissions for this resource.
-	if permissions := convertPermissionsResource(ctx, vin); permissions != nil {
-		permissions.SqlEndpointId = fmt.Sprintf("${databricks_sql_endpoint.%s.id}", key)
-		out.Permissions["sql_endpoint_"+key] = permissions
-	}
-
-	return nil
-}
-
-func init() {
-	registerConverter("sql_warehouses", sqlWarehouseConverter{})
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_sql_warehouse_test.go b/bundle/deploy/terraform/tfdyn/convert_sql_warehouse_test.go
deleted file mode 100644
index a8be3a12d6f..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_sql_warehouse_test.go
+++ /dev/null
@@ -1,66 +0,0 @@
-package tfdyn
-
-import (
-	"testing"
-
-	"github.com/databricks/cli/bundle/config/resources"
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/databricks-sdk-go/service/sql"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestConvertSqlWarehouse(t *testing.T) {
-	src := resources.SqlWarehouse{
-		CreateWarehouseRequest: sql.CreateWarehouseRequest{
-			AutoStopMins:            120,
-			ClusterSize:             "X-Large",
-			EnableServerlessCompute: true,
-			MaxNumClusters:          1,
-			MinNumClusters:          1,
-			Name:                    "test_sql_warehouse",
-			Tags: &sql.EndpointTags{
-				CustomTags: []sql.EndpointTagPair{
-					{
-						Key:   "key",
-						Value: "value",
-					},
-				},
-			},
-			Channel: &sql.Channel{
-				Name: "CHANNEL_NAME",
-			},
-		},
-	}
-
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	out := schema.NewResources()
-	err = sqlWarehouseConverter{}.Convert(ctx, "test_sql_warehouse", vin, out)
-	require.NoError(t, err)
-
-	sqlWarehouse := out.SqlEndpoint["test_sql_warehouse"]
-	assert.Equal(t, map[string]any{
-		"name": "test_sql_warehouse",
-		"tags": map[string]any{
-			"custom_tags": []any{
-				map[string]any{
-					"key":   "key",
-					"value": "value",
-				},
-			},
-		},
-		"channel": map[string]any{
-			"name": "CHANNEL_NAME",
-		},
-		"auto_stop_mins":            int64(120),
-		"cluster_size":              "X-Large",
-		"enable_serverless_compute": true,
-		"max_num_clusters":          int64(1),
-		"min_num_clusters":          int64(1),
-	}, sqlWarehouse)
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_synced_database_table.go b/bundle/deploy/terraform/tfdyn/convert_synced_database_table.go
deleted file mode 100644
index 5e64711629c..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_synced_database_table.go
+++ /dev/null
@@ -1,34 +0,0 @@
-package tfdyn
-
-import (
-	"context"
-
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/cli/libs/log"
-	"github.com/databricks/databricks-sdk-go/service/database"
-)
-
-type syncedDatabaseTableConverter struct{}
-
-func (s syncedDatabaseTableConverter) Convert(ctx context.Context, key string, vin dyn.Value, out *schema.Resources) error {
-	// Normalize the output value to the target schema.
-	vout, diags := convert.Normalize(database.SyncedDatabaseTable{}, vin)
-	for _, diag := range diags {
-		log.Debugf(ctx, "synced database table normalization diagnostic: %s", diag.Summary)
-	}
-
-	var err error
-	vout, err = convertLifecycle(ctx, vout, vin.Get("lifecycle"))
-	if err != nil {
-		return err
-	}
-	out.DatabaseSyncedDatabaseTable[key] = vout.AsAny()
-
-	return nil
-}
-
-func init() {
-	registerConverter("synced_database_tables", syncedDatabaseTableConverter{})
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_volume.go b/bundle/deploy/terraform/tfdyn/convert_volume.go
deleted file mode 100644
index 287ddee0c6b..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_volume.go
+++ /dev/null
@@ -1,50 +0,0 @@
-package tfdyn
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/cli/libs/log"
-)
-
-func convertVolumeResource(ctx context.Context, vin dyn.Value) (dyn.Value, error) {
-	// Normalize the output value to the target schema.
-	vout, diags := convert.Normalize(schema.ResourceVolume{}, vin)
-	for _, diag := range diags {
-		log.Debugf(ctx, "volume normalization diagnostic: %s", diag.Summary)
-	}
-
-	return vout, nil
-}
-
-type volumeConverter struct{}
-
-func (volumeConverter) Convert(ctx context.Context, key string, vin dyn.Value, out *schema.Resources) error {
-	vout, err := convertVolumeResource(ctx, vin)
-	if err != nil {
-		return err
-	}
-
-	vout, err = convertLifecycle(ctx, vout, vin.Get("lifecycle"))
-	if err != nil {
-		return err
-	}
-
-	// Add the converted resource to the output.
-	out.Volume[key] = vout.AsAny()
-
-	// Configure grants for this resource.
-	if grants := convertGrantsResource(ctx, vin); grants != nil {
-		grants.Volume = fmt.Sprintf("${databricks_volume.%s.id}", key)
-		out.Grants["volume_"+key] = grants
-	}
-
-	return nil
-}
-
-func init() {
-	registerConverter("volumes", volumeConverter{})
-}
diff --git a/bundle/deploy/terraform/tfdyn/convert_volume_test.go b/bundle/deploy/terraform/tfdyn/convert_volume_test.go
deleted file mode 100644
index bd8798780ad..00000000000
--- a/bundle/deploy/terraform/tfdyn/convert_volume_test.go
+++ /dev/null
@@ -1,69 +0,0 @@
-package tfdyn
-
-import (
-	"testing"
-
-	"github.com/databricks/cli/bundle/config/resources"
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/databricks-sdk-go/service/catalog"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestConvertVolume(t *testing.T) {
-	src := resources.Volume{
-		CreateVolumeRequestContent: catalog.CreateVolumeRequestContent{
-			CatalogName:     "catalog",
-			Comment:         "comment",
-			Name:            "name",
-			SchemaName:      "schema",
-			StorageLocation: "s3://bucket/path",
-			VolumeType:      "EXTERNAL",
-		},
-		Grants: []catalog.PrivilegeAssignment{
-			{
-				Privileges: []catalog.Privilege{catalog.PrivilegeReadVolume},
-				Principal:  "jack@gmail.com",
-			},
-			{
-				Privileges: []catalog.Privilege{catalog.PrivilegeWriteVolume},
-				Principal:  "jane@gmail.com",
-			},
-		},
-	}
-
-	vin, err := convert.FromTyped(src, dyn.NilValue)
-	require.NoError(t, err)
-
-	ctx := t.Context()
-	out := schema.NewResources()
-	err = volumeConverter{}.Convert(ctx, "my_volume", vin, out)
-	require.NoError(t, err)
-
-	// Assert equality on the volume
-	require.Equal(t, map[string]any{
-		"catalog_name":     "catalog",
-		"comment":          "comment",
-		"name":             "name",
-		"schema_name":      "schema",
-		"storage_location": "s3://bucket/path",
-		"volume_type":      "EXTERNAL",
-	}, out.Volume["my_volume"])
-
-	// Assert equality on the grants
-	assert.Equal(t, &schema.ResourceGrants{
-		Volume: "${databricks_volume.my_volume.id}",
-		Grant: []schema.ResourceGrantsGrant{
-			{
-				Privileges: []string{"READ_VOLUME"},
-				Principal:  "jack@gmail.com",
-			},
-			{
-				Privileges: []string{"WRITE_VOLUME"},
-				Principal:  "jane@gmail.com",
-			},
-		},
-	}, out.Grants["volume_my_volume"])
-}
diff --git a/bundle/deploy/terraform/tfdyn/lifecycle.go b/bundle/deploy/terraform/tfdyn/lifecycle.go
deleted file mode 100644
index 669aa830400..00000000000
--- a/bundle/deploy/terraform/tfdyn/lifecycle.go
+++ /dev/null
@@ -1,32 +0,0 @@
-package tfdyn
-
-import (
-	"context"
-
-	"github.com/databricks/cli/libs/dyn"
-)
-
-func convertLifecycle(ctx context.Context, vout, vLifecycle dyn.Value) (dyn.Value, error) {
-	if !vLifecycle.IsValid() {
-		return vout, nil
-	}
-
-	// Strip lifecycle.started: it is a DABs-only field not understood by Terraform.
-	var err error
-	vLifecycle, err = dyn.DropKeys(vLifecycle, []string{"started"})
-	if err != nil {
-		return dyn.InvalidValue, err
-	}
-
-	// If only lifecycle.started was set (now empty), skip setting the lifecycle block.
-	if m, ok := vLifecycle.AsMap(); ok && m.Len() == 0 {
-		return vout, nil
-	}
-
-	vout, err = dyn.Set(vout, "lifecycle", vLifecycle)
-	if err != nil {
-		return dyn.InvalidValue, err
-	}
-
-	return vout, nil
-}
diff --git a/bundle/deploy/terraform/tfdyn/rename_keys.go b/bundle/deploy/terraform/tfdyn/rename_keys.go
deleted file mode 100644
index 95904575f87..00000000000
--- a/bundle/deploy/terraform/tfdyn/rename_keys.go
+++ /dev/null
@@ -1,45 +0,0 @@
-package tfdyn
-
-import (
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/merge"
-)
-
-// renameKeys renames keys in the given map value.
-//
-// Terraform resources sometimes use singular names for repeating blocks where the API
-// definition uses the plural name. This function can convert between the two.
-func renameKeys(v dyn.Value, rename map[string]string) (dyn.Value, error) {
-	var err error
-	acc := dyn.V(map[string]dyn.Value{})
-
-	nv, err := dyn.Walk(v, func(p dyn.Path, v dyn.Value) (dyn.Value, error) {
-		if len(p) == 0 {
-			return v, nil
-		}
-
-		// Check if this key should be renamed.
-		for oldKey, newKey := range rename {
-			if p[0].Key() != oldKey {
-				continue
-			}
-
-			// Add the new key to the accumulator.
-			p[0] = dyn.Key(newKey)
-			acc, err = dyn.SetByPath(acc, p, v)
-			if err != nil {
-				return dyn.InvalidValue, err
-			}
-			return dyn.InvalidValue, dyn.ErrDrop
-		}
-
-		// Pass through all other values.
-		return v, dyn.ErrSkip
-	})
-	if err != nil {
-		return dyn.InvalidValue, err
-	}
-
-	// Merge the accumulator with the original value.
-	return merge.Merge(nv, acc)
-}
diff --git a/bundle/deploy/terraform/tfdyn/spec_fields.go b/bundle/deploy/terraform/tfdyn/spec_fields.go
deleted file mode 100644
index 189e82f4b78..00000000000
--- a/bundle/deploy/terraform/tfdyn/spec_fields.go
+++ /dev/null
@@ -1,31 +0,0 @@
-package tfdyn
-
-import (
-	"reflect"
-
-	"github.com/databricks/cli/libs/structs/structpath"
-	"github.com/databricks/cli/libs/structs/structwalk"
-)
-
-// specFieldNames returns the JSON field names from a struct type's top-level fields.
-// It is used by postgres resource converters to dynamically determine which fields
-// belong in the "spec" block when converting bundle config to Terraform config.
-// Using reflection ensures new fields added to the Terraform schema are automatically
-// included without manual updates to the converters.
-func specFieldNames(v any) []string {
-	var names []string
-	_ = structwalk.WalkType(reflect.TypeOf(v), func(path *structpath.PatternNode, typ reflect.Type, field *reflect.StructField) bool {
-		// Skip root node (path is nil)
-		if path == nil {
-			return true
-		}
-		// Collect top-level field names only (depth 1)
-		if path.Parent() == nil {
-			if key, ok := path.StringKey(); ok {
-				names = append(names, key)
-			}
-		}
-		return false
-	})
-	return names
-}
diff --git a/bundle/deploy/terraform/unbind.go b/bundle/deploy/terraform/unbind.go
deleted file mode 100644
index 25cc8271921..00000000000
--- a/bundle/deploy/terraform/unbind.go
+++ /dev/null
@@ -1,59 +0,0 @@
-package terraform
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/databricks/cli/bundle"
-	"github.com/databricks/cli/libs/diag"
-)
-
-type unbind struct {
-	bundleType     string
-	tfResourceType string
-	resourceKey    string
-}
-
-func (m *unbind) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
-	diags := Initialize(ctx, b)
-	if diags.HasError() {
-		return diags
-	}
-	tf := b.Terraform
-
-	err := tf.StateRm(ctx, fmt.Sprintf("%s.%s", m.tfResourceType, m.resourceKey))
-	if err != nil {
-		return diag.Errorf("terraform state rm: %v", err)
-	}
-
-	// Also remove the permission if it exists
-	// First check terraform state list to see if the permission exists
-	state, err := tf.Show(ctx)
-	if err != nil {
-		return diag.Errorf("terraform show: %v", err)
-	}
-
-	if state.Values == nil || state.Values.RootModule == nil || state.Values.RootModule.Resources == nil {
-		return nil
-	}
-
-	for _, resource := range state.Values.RootModule.Resources {
-		if resource.Address == fmt.Sprintf("databricks_permissions.%s_%s", m.bundleType, m.resourceKey) ||
-			resource.Address == fmt.Sprintf("databricks_grants.%s_%s", m.bundleType, m.resourceKey) {
-			err = tf.StateRm(ctx, resource.Address)
-			if err != nil {
-				return diag.Errorf("terraform state rm: %v", err)
-			}
-		}
-	}
-
-	return nil
-}
-
-func (*unbind) Name() string {
-	return "terraform.Unbind"
-}
-
-func Unbind(bundleType, tfResourceType, resourceKey string) bundle.Mutator {
-	return &unbind{bundleType: bundleType, tfResourceType: tfResourceType, resourceKey: resourceKey}
-}
diff --git a/bundle/deploy/terraform/util.go b/bundle/deploy/terraform/util.go
index 632d32bca19..a0f8bcd5558 100644
--- a/bundle/deploy/terraform/util.go
+++ b/bundle/deploy/terraform/util.go
@@ -11,7 +11,6 @@ import (
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/bundle/statemgmt/resourcestate"
 	"github.com/databricks/cli/libs/log"
-	tfjson "github.com/hashicorp/terraform-json"
 )
 
 type (
@@ -29,10 +28,13 @@ type resourcesState struct {
 
 const SupportedStateVersion = 4
 
+// ManagedResourceMode is the tfstate "mode" of a managed resource; data sources use "data".
+const ManagedResourceMode = "managed"
+
 type stateResource struct {
 	Type      string                  `json:"type"`
 	Name      string                  `json:"name"`
-	Mode      tfjson.ResourceMode     `json:"mode"`
+	Mode      string                  `json:"mode"`
 	Instances []stateResourceInstance `json:"instances"`
 }
 
@@ -51,6 +53,15 @@ type stateInstanceAttributes struct {
 }
 
 // Returns a mapping resourceKey -> stateInstanceAttributes
+// ParseResourcesStateFromBytes parses a terraform state file from already-read bytes.
+func ParseResourcesStateFromBytes(ctx context.Context, raw []byte) (ExportedResourcesMap, error) {
+	var state resourcesState
+	if err := json.Unmarshal(raw, &state); err != nil {
+		return nil, err
+	}
+	return resourcesStateToMap(ctx, &state)
+}
+
 func parseResourcesState(ctx context.Context, path string) (ExportedResourcesMap, error) {
 	rawState, err := os.ReadFile(path)
 	if err != nil {
@@ -59,12 +70,10 @@ func parseResourcesState(ctx context.Context, path string) (ExportedResourcesMap
 		}
 		return nil, err
 	}
-	var state resourcesState
-	err = json.Unmarshal(rawState, &state)
-	if err != nil {
-		return nil, err
-	}
+	return ParseResourcesStateFromBytes(ctx, rawState)
+}
 
+func resourcesStateToMap(ctx context.Context, state *resourcesState) (ExportedResourcesMap, error) {
 	if state.Version != SupportedStateVersion {
 		return nil, fmt.Errorf("unsupported deployment state version: %d. Try re-deploying the bundle", state.Version)
 	}
@@ -72,7 +81,7 @@ func parseResourcesState(ctx context.Context, path string) (ExportedResourcesMap
 	result := make(ExportedResourcesMap)
 
 	for _, resource := range state.Resources {
-		if resource.Mode != tfjson.ManagedResourceMode {
+		if resource.Mode != ManagedResourceMode {
 			continue
 		}
 		for _, instance := range resource.Instances {
@@ -96,7 +105,7 @@ func parseResourcesState(ctx context.Context, path string) (ExportedResourcesMap
 				// The direct engine manages permissions as a sub-resource
 				// (SecretScopeFixups adds MANAGE ACL for the current user).
 				result[resourceKey+".permissions"] = ResourceState{ID: instance.Attributes.Name}
-			case "apps", "database_instances", "database_catalogs", "synced_database_tables", "postgres_projects", "postgres_branches", "postgres_endpoints":
+			case "apps", "database_instances", "database_catalogs", "synced_database_tables", "postgres_projects", "postgres_branches", "postgres_catalogs", "postgres_databases", "postgres_endpoints", "postgres_roles", "postgres_synced_tables":
 				resourceKey = "resources." + groupName + "." + resource.Name
 				resourceState = ResourceState{ID: instance.Attributes.Name}
 			case "dashboards":
@@ -131,5 +140,10 @@ func ParseResourcesState(ctx context.Context, b *bundle.Bundle) (ExportedResourc
 		return nil, err
 	}
 	filename, _ := b.StateFilenameTerraform(ctx)
-	return parseResourcesState(ctx, filepath.Join(cacheDir, filename))
+	return ParseResourcesStateFromPath(ctx, filepath.Join(cacheDir, filename))
+}
+
+// ParseResourcesStateFromPath parses a terraform state file at a known path.
+func ParseResourcesStateFromPath(ctx context.Context, path string) (ExportedResourcesMap, error) {
+	return parseResourcesState(ctx, path)
 }
diff --git a/bundle/deploy/terraform/write.go b/bundle/deploy/terraform/write.go
deleted file mode 100644
index bee777ffe00..00000000000
--- a/bundle/deploy/terraform/write.go
+++ /dev/null
@@ -1,57 +0,0 @@
-package terraform
-
-import (
-	"context"
-	"encoding/json"
-	"os"
-	"path/filepath"
-
-	"github.com/databricks/cli/bundle"
-	"github.com/databricks/cli/bundle/internal/tf/schema"
-	"github.com/databricks/cli/libs/diag"
-	"github.com/databricks/cli/libs/dyn"
-)
-
-type write struct{}
-
-func (w *write) Name() string {
-	return "terraform.Write"
-}
-
-func (w *write) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
-	dir, err := Dir(ctx, b)
-	if err != nil {
-		return diag.FromErr(err)
-	}
-
-	var root *schema.Root
-	err = b.Config.Mutate(func(v dyn.Value) (dyn.Value, error) {
-		root, err = BundleToTerraformWithDynValue(ctx, v)
-		return v, err
-	})
-	if err != nil {
-		return diag.FromErr(err)
-	}
-
-	f, err := os.Create(filepath.Join(dir, TerraformConfigFileName))
-	if err != nil {
-		return diag.FromErr(err)
-	}
-
-	defer f.Close()
-
-	enc := json.NewEncoder(f)
-	enc.SetIndent("", "  ")
-	err = enc.Encode(root)
-	if err != nil {
-		return diag.FromErr(err)
-	}
-
-	return nil
-}
-
-// Write returns a [bundle.Mutator] that converts resources in a bundle configuration
-// to the equivalent Terraform JSON representation and writes the result to a file.
-func Write() bundle.Mutator {
-	return &write{}
-}
diff --git a/bundle/deployplan/action.go b/bundle/deployplan/action.go
index e8e14279567..e53ef0d84bd 100644
--- a/bundle/deployplan/action.go
+++ b/bundle/deployplan/action.go
@@ -9,12 +9,27 @@ type Action struct {
 	// Full resource key, e.g. "resources.jobs.foo" or "resources.jobs.foo.permissions"
 	ResourceKey string
 	ActionType  ActionType
+	// Gone mirrors PlanEntry.Gone: the delete is a state-only cleanup because the
+	// resource no longer exists remotely.
+	Gone bool
+	// StateOnly mirrors PlanEntry.StateOnly: the delete is a state-only cleanup
+	// because the resource implements no DoDelete (deleting it has no backend effect).
+	StateOnly bool
 }
 
 func (a Action) String() string {
 	return fmt.Sprintf("  %s %s", a.ActionType.StringShort(), a.ResourceKey)
 }
 
+// IsStateOnlyDelete reports whether applying this delete only drops the state entry
+// without any backend call: the resource is already gone remotely (Gone) or has no
+// delete operation (StateOnly). Such deletes are omitted from human output, excluded
+// from the resource counts, and need no destructive-action approval. See the same
+// method on PlanEntry.
+func (a Action) IsStateOnlyDelete() bool {
+	return a.Gone || a.StateOnly
+}
+
 func (a Action) IsChildResource() bool {
 	// Note, strictly speaking ResourceKey could be resources.jobs["my.job"] but
 	// we have an assumption in many other places that it's always looks like "resources.jobs.my_job"
@@ -64,6 +79,16 @@ func (a ActionType) StringShort() string {
 	return items[0]
 }
 
+// AppliedLine renders the user-facing line reporting that action has been applied
+// to resourceKey, e.g. "Created jobs.foo". The past-tense verb is the short action
+// name plus "d" (create->Created, delete->Deleted, ...), capitalized to match the
+// sentence case of other output. "bundle plan" keeps the lower-case present tense,
+// so the two are still distinguishable at a glance.
+func AppliedLine(resourceKey string, action ActionType) string {
+	verb := action.StringShort() + "d"
+	return strings.ToUpper(verb[:1]) + verb[1:] + " " + strings.TrimPrefix(resourceKey, "resources.")
+}
+
 // GetHigherAction returns the action with higher severity between a and b.
 // Actions are ordered by severity in actionOrder map.
 func GetHigherAction(a, b ActionType) ActionType {
diff --git a/bundle/deployplan/plan.go b/bundle/deployplan/plan.go
index b35357c7c28..874479db43d 100644
--- a/bundle/deployplan/plan.go
+++ b/bundle/deployplan/plan.go
@@ -16,16 +16,66 @@ import (
 const currentPlanVersion = 2
 
 type Plan struct {
-	PlanVersion int                   `json:"plan_version,omitempty"`
-	CLIVersion  string                `json:"cli_version,omitempty"`
-	Lineage     string                `json:"lineage,omitempty"`
-	Serial      int                   `json:"serial,omitempty"`
-	Plan        map[string]*PlanEntry `json:"plan,omitzero"`
+	PlanVersion int    `json:"plan_version,omitempty"`
+	CLIVersion  string `json:"cli_version,omitempty"`
+	Lineage     string `json:"lineage,omitempty"`
+	Serial      int    `json:"serial,omitempty"`
+
+	// Features are the state feature flags this plan was built against, mirroring the state
+	// file's own "features" field. The stamps above exist because of a feature being set, so
+	// deploy --plan rejects a plan whose features differ from the target's (see process.go).
+	Features map[string]struct{} `json:"features,omitempty"`
+
+	Plan map[string]*PlanEntry `json:"plan,omitzero"`
+
+	// NotSelected is the number of resources removed by FilterToSelected via the
+	// --select flag. Serialized so the summary survives a deploy from a plan file
+	// (--plan); used only for summary reporting.
+	NotSelected int `json:"not_selected,omitempty"`
 
 	mutex   sync.Mutex `json:"-"`
 	lockmap lockmap    `json:"-"`
 }
 
+// ActionCounts summarizes a plan's actions by category. A recreate counts as
+// both a create and a delete, matching how plan and deploy report changes.
+type ActionCounts struct {
+	Create    int
+	Change    int
+	Delete    int
+	Unchanged int
+}
+
+// CountActions tallies the plan's actions by category. Order is irrelevant to a
+// tally, so it iterates the plan map directly rather than the sorted GetActions.
+func (p *Plan) CountActions() ActionCounts {
+	var c ActionCounts
+	for _, entry := range p.Plan {
+		switch entry.Action {
+		case Create:
+			c.Create++
+		case Update, UpdateWithID, Resize:
+			c.Change++
+		case Delete:
+			// A state-only delete touches nothing in the backend and only drops the
+			// state entry, so it is not a real action: leave it out of the tally
+			// entirely rather than misreport it as deleted or unchanged. This matches
+			// how `bundle destroy` counts its own deletions.
+			if entry.IsStateOnlyDelete() {
+				continue
+			}
+			c.Delete++
+		case Recreate:
+			// A recreate counts as both a delete and a create.
+			c.Delete++
+			c.Create++
+		case Skip, Undefined:
+			c.Unchanged++
+		}
+	}
+	return c
+}
+
 // NewPlanDirect creates a new Plan for direct engine with plan_version set.
 func NewPlanDirect() *Plan {
 	return &Plan{
@@ -36,15 +86,6 @@ func NewPlanDirect() *Plan {
 	}
 }
 
-// NewPlanTerraform creates a new Plan for terraform engine without plan_version.
-func NewPlanTerraform() *Plan {
-	return &Plan{
-		CLIVersion: build.GetInfo().Version,
-		Plan:       make(map[string]*PlanEntry),
-		lockmap:    newLockmap(),
-	}
-}
-
 // LoadPlanFromFile reads a plan from a JSON file.
 func LoadPlanFromFile(path string) (*Plan, error) {
 	file, err := os.Open(path)
@@ -73,14 +114,33 @@ func LoadPlanFromFile(path string) (*Plan, error) {
 }
 
 type PlanEntry struct {
-	ID          string                   `json:"id,omitempty"`
-	DependsOn   []DependsOnEntry         `json:"depends_on,omitempty"`
-	Action      ActionType               `json:"action,omitempty"`
+	ID        string           `json:"id,omitempty"`
+	DependsOn []DependsOnEntry `json:"depends_on,omitempty"`
+	Action    ActionType       `json:"action,omitempty"`
+	// Gone is set on Delete entries when planning confirmed the resource no longer
+	// exists remotely. Applying such an entry only removes it from the state, without
+	// calling the delete API, and approval prompts do not list it as a deletion.
+	Gone bool `json:"gone,omitempty"`
+	// StateOnly is set on Delete entries for resources that implement no DoDelete:
+	// deleting them has no backend effect. Like Gone, applying such an entry only
+	// removes it from the state and it is excluded from destructive-action prompts,
+	// textual plan output and the deleted count — but unlike Gone it is a property of
+	// the resource type, not of the current remote state, so planning skips the
+	// remote read that Gone detection needs.
+	StateOnly   bool                     `json:"state_only,omitempty"`
 	NewState    *structvar.StructVarJSON `json:"new_state,omitempty"`
 	RemoteState any                      `json:"remote_state,omitempty"`
 	Changes     Changes                  `json:"changes,omitempty"`
 }
 
+// IsStateOnlyDelete reports whether applying this delete only drops the state entry
+// without any backend call: the resource is already gone remotely (Gone) or has no
+// delete operation (StateOnly). Such deletes are omitted from human output, excluded
+// from the resource counts, and need no destructive-action approval.
+func (e *PlanEntry) IsStateOnlyDelete() bool {
+	return e.Gone || e.StateOnly
+}
+
 type DependsOnEntry struct {
 	Node  string `json:"node"`
 	Label string `json:"label,omitempty"`
@@ -100,16 +160,32 @@ type ChangeDesc struct {
 const (
 	ReasonBackendDefault   = "backend_default"
 	ReasonAlias            = "alias"
-	ReasonURLNormalization = "url_normalization"
 	ReasonRemoteAlreadySet = "remote_already_set"
 	ReasonEmpty            = "empty"
 	ReasonCustom           = "custom"
+	// ReasonMissingInRemote: field is not present in RemoteType (write-only / input-only).
+	// Remote always appears nil, so treat the absence as a no-op when there is no local change.
+	ReasonMissingInRemote = "missing_in_remote"
+	// ReasonRemoteAddition: the field is a remote-only addition (absent from config, present
+	// in the remote) inside an object whose gate is set (e.g. a cluster with a policy_id). The
+	// backend may extend such an object beyond what the bundle declares, so the addition is not
+	// treated as drift. We do not attribute the value to any particular source.
+	ReasonRemoteAddition = "remote_addition"
+	// ReasonImmutableBackendValue: an immutable (recreate_on_changes) field the config never
+	// set but the backend populated (old and new nil, remote set). It is left in place rather
+	// than recreated - the user does not manage it and the value cannot be changed anyway.
+	ReasonImmutableBackendValue = "immutable_backend_value"
+	// ReasonUnmanaged: the config does not declare the field at all, so the bundle does not manage
+	// it and whatever the remote reports is not drift (e.g. cluster libraries without a libraries
+	// section, where job runs install their task libraries cluster-wide).
+	ReasonUnmanaged = "unmanaged"
 
 	// Special reason that results in removing this change from the plan
 	ReasonDrop = "!drop"
 )
 
-// HasChange checks if there are any changes for fields with the given prefix.
+// HasChange checks if there are any actionable changes for fields with the given prefix.
+// Suppressed changes (Action == Skip) are ignored, matching HasChangeExcept.
 // This function is path-aware and correctly handles path component boundaries.
 // For example:
 //   - HasChange for path "a" matches "a" and "a.b" but not "aa"
@@ -119,7 +195,10 @@ func (c *Changes) HasChange(fieldPath *structpath.PathNode) bool {
 		return false
 	}
 
-	for field := range *c {
+	for field, change := range *c {
+		if change.Action == Skip {
+			continue
+		}
 		fieldNode, err := structpath.ParsePath(field)
 		if err != nil {
 			continue
@@ -132,12 +211,29 @@ func (c *Changes) HasChange(fieldPath *structpath.PathNode) bool {
 	return false
 }
 
+// HasChangeExcept checks if there are any changes for fields with the given prefixes.
+func (c *Changes) HasChangeExcept(prefixes ...string) bool {
+	if c == nil {
+		return false
+	}
+	for field := range *c {
+		if !slices.Contains(prefixes, field) {
+			if (*c)[field].Action != Skip {
+				return true
+			}
+		}
+	}
+	return false
+}
+
 func (p *Plan) GetActions() []Action {
 	actions := make([]Action, 0, len(p.Plan))
 	for key, entry := range p.Plan {
 		actions = append(actions, Action{
 			ResourceKey: key,
 			ActionType:  entry.Action,
+			Gone:        entry.Gone,
+			StateOnly:   entry.StateOnly,
 		})
 	}
 
@@ -181,10 +277,55 @@ func (p *Plan) ReadUnlockEntry(resourceKey string) {
 	p.lockmap.RUnlock(resourceKey)
 }
 
-func (p *Plan) RemoveEntry(resourceKey string) {
-	p.mutex.Lock()
-	defer p.mutex.Unlock()
-	delete(p.Plan, resourceKey)
+// FilterToSelected reduces the plan to the nodes in selected (format "type.name",
+// e.g. "jobs.my_job") plus their transitive dependencies as recorded in each
+// entry's DependsOn field. Nodes not reachable from the selected set are removed.
+func (p *Plan) FilterToSelected(selected []string) {
+	before := len(p.Plan)
+
+	// Convert "type.name" → "resources.type.name" (plan key format).
+	queue := make([]string, 0, len(selected))
+	reachable := make(map[string]struct{}, len(selected))
+	for _, s := range selected {
+		key := "resources." + s
+		p.enqueueReachable(reachable, &queue, key)
+		// Grants and permissions are modeled as separate plan nodes for internal
+		// reasons, but the user cannot address them via --select. Pull them in as
+		// part of the parent resource so selecting a resource applies its grants
+		// and permissions too. The dependency edge runs sub-node → parent, so the
+		// BFS below would never reach them from the parent otherwise.
+		p.enqueueReachable(reachable, &queue, key+".grants")
+		p.enqueueReachable(reachable, &queue, key+".permissions")
+	}
+
+	// BFS following DependsOn edges to include transitive dependencies.
+	for len(queue) > 0 {
+		key := queue[0]
+		queue = queue[1:]
+		for _, dep := range p.Plan[key].DependsOn {
+			p.enqueueReachable(reachable, &queue, dep.Node)
+		}
+	}
+
+	for key := range p.Plan {
+		if _, ok := reachable[key]; !ok {
+			delete(p.Plan, key)
+		}
+	}
+
+	p.NotSelected = before - len(p.Plan)
+}
+
+// enqueueReachable marks key as reachable and appends it to queue, if key exists
+// in the plan and has not been seen before. Missing or already-seen keys are ignored.
+func (p *Plan) enqueueReachable(reachable map[string]struct{}, queue *[]string, key string) {
+	if _, seen := reachable[key]; seen {
+		return
+	}
+	if _, ok := p.Plan[key]; ok {
+		reachable[key] = struct{}{}
+		*queue = append(*queue, key)
+	}
 }
 
 type lockmap struct {
diff --git a/bundle/deployplan/plan_filter_test.go b/bundle/deployplan/plan_filter_test.go
new file mode 100644
index 00000000000..c5451f470b1
--- /dev/null
+++ b/bundle/deployplan/plan_filter_test.go
@@ -0,0 +1,88 @@
+package deployplan_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/bundle/deployplan"
+	"github.com/stretchr/testify/assert"
+)
+
+func planWithDeps() *deployplan.Plan {
+	p := deployplan.NewPlanDirect()
+	p.Plan["resources.jobs.foo"] = &deployplan.PlanEntry{
+		DependsOn: []deployplan.DependsOnEntry{{Node: "resources.jobs.bar"}},
+	}
+	p.Plan["resources.jobs.bar"] = &deployplan.PlanEntry{
+		DependsOn: []deployplan.DependsOnEntry{{Node: "resources.jobs.baz"}},
+	}
+	p.Plan["resources.jobs.baz"] = &deployplan.PlanEntry{}
+	p.Plan["resources.jobs.independent"] = &deployplan.PlanEntry{}
+	return p
+}
+
+func planWithGrants() *deployplan.Plan {
+	p := deployplan.NewPlanDirect()
+	p.Plan["resources.schemas.bronze"] = &deployplan.PlanEntry{}
+	// Sub-nodes depend on the parent (to resolve full_name), not the other way around.
+	p.Plan["resources.schemas.bronze.grants"] = &deployplan.PlanEntry{
+		DependsOn: []deployplan.DependsOnEntry{{Node: "resources.schemas.bronze"}},
+	}
+	p.Plan["resources.schemas.bronze.permissions"] = &deployplan.PlanEntry{
+		DependsOn: []deployplan.DependsOnEntry{{Node: "resources.schemas.bronze"}},
+	}
+	p.Plan["resources.schemas.silver"] = &deployplan.PlanEntry{}
+	p.Plan["resources.schemas.silver.grants"] = &deployplan.PlanEntry{
+		DependsOn: []deployplan.DependsOnEntry{{Node: "resources.schemas.silver"}},
+	}
+	return p
+}
+
+func TestFilterToSelected_Direct(t *testing.T) {
+	p := planWithDeps()
+	p.FilterToSelected([]string{"jobs.foo"})
+	assert.Contains(t, p.Plan, "resources.jobs.foo")
+	assert.Contains(t, p.Plan, "resources.jobs.bar")
+	assert.Contains(t, p.Plan, "resources.jobs.baz")
+	assert.NotContains(t, p.Plan, "resources.jobs.independent")
+	assert.Equal(t, 1, p.NotSelected)
+}
+
+func TestFilterToSelected_NoDeps(t *testing.T) {
+	p := planWithDeps()
+	p.FilterToSelected([]string{"jobs.baz"})
+	assert.Contains(t, p.Plan, "resources.jobs.baz")
+	assert.NotContains(t, p.Plan, "resources.jobs.foo")
+	assert.NotContains(t, p.Plan, "resources.jobs.bar")
+	assert.NotContains(t, p.Plan, "resources.jobs.independent")
+	assert.Equal(t, 3, p.NotSelected)
+}
+
+func TestFilterToSelected_Multiple(t *testing.T) {
+	p := planWithDeps()
+	p.FilterToSelected([]string{"jobs.baz", "jobs.independent"})
+	assert.Contains(t, p.Plan, "resources.jobs.baz")
+	assert.Contains(t, p.Plan, "resources.jobs.independent")
+	assert.NotContains(t, p.Plan, "resources.jobs.foo")
+	assert.NotContains(t, p.Plan, "resources.jobs.bar")
+	assert.Equal(t, 2, p.NotSelected)
+}
+
+func TestFilterToSelected_IncludesGrantsAndPermissions(t *testing.T) {
+	p := planWithGrants()
+	p.FilterToSelected([]string{"schemas.bronze"})
+	assert.Contains(t, p.Plan, "resources.schemas.bronze")
+	assert.Contains(t, p.Plan, "resources.schemas.bronze.grants")
+	assert.Contains(t, p.Plan, "resources.schemas.bronze.permissions")
+	assert.NotContains(t, p.Plan, "resources.schemas.silver")
+	assert.NotContains(t, p.Plan, "resources.schemas.silver.grants")
+}
+
+func TestFilterToSelected_MissingSubNodesAreSkipped(t *testing.T) {
+	p := planWithGrants()
+	// silver has grants but no permissions node; selecting it must not fail.
+	p.FilterToSelected([]string{"schemas.silver"})
+	assert.Contains(t, p.Plan, "resources.schemas.silver")
+	assert.Contains(t, p.Plan, "resources.schemas.silver.grants")
+	assert.NotContains(t, p.Plan, "resources.schemas.silver.permissions")
+	assert.NotContains(t, p.Plan, "resources.schemas.bronze")
+}
diff --git a/bundle/deployplan/plan_test.go b/bundle/deployplan/plan_test.go
new file mode 100644
index 00000000000..cee00f42c44
--- /dev/null
+++ b/bundle/deployplan/plan_test.go
@@ -0,0 +1,67 @@
+package deployplan_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/bundle/deployplan"
+	"github.com/databricks/cli/libs/structs/structpath"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestHasChange(t *testing.T) {
+	tests := []struct {
+		name    string
+		changes deployplan.Changes
+		path    string
+		want    bool
+	}{
+		{
+			name:    "nil changes",
+			changes: nil,
+			path:    "config",
+			want:    false,
+		},
+		{
+			name:    "actionable change matches prefix",
+			changes: deployplan.Changes{"config.name": {Action: deployplan.Update}},
+			path:    "config",
+			want:    true,
+		},
+		{
+			name:    "skip change is ignored",
+			changes: deployplan.Changes{"config.traffic_config": {Action: deployplan.Skip}},
+			path:    "config",
+			want:    false,
+		},
+		{
+			name: "skip alongside actionable change still reports",
+			changes: deployplan.Changes{
+				"config.traffic_config":  {Action: deployplan.Skip},
+				"config.served_entities": {Action: deployplan.Update},
+			},
+			path: "config",
+			want: true,
+		},
+		{
+			name:    "no match for unrelated prefix",
+			changes: deployplan.Changes{"tags.team": {Action: deployplan.Update}},
+			path:    "config",
+			want:    false,
+		},
+		{
+			name:    "prefix respects path boundaries",
+			changes: deployplan.Changes{"configuration": {Action: deployplan.Update}},
+			path:    "config",
+			want:    false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			path, err := structpath.ParsePath(tt.path)
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, tt.changes.HasChange(path))
+		})
+	}
+}
diff --git a/bundle/direct/apply.go b/bundle/direct/apply.go
index e7186f64670..d4f4a2ffb41 100644
--- a/bundle/direct/apply.go
+++ b/bundle/direct/apply.go
@@ -6,14 +6,24 @@ import (
 	"errors"
 	"fmt"
 	"reflect"
+	"strings"
 
 	"github.com/databricks/cli/bundle/deployplan"
+	"github.com/databricks/cli/bundle/direct/dresources"
 	"github.com/databricks/cli/bundle/direct/dstate"
 	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/retry"
 	"github.com/databricks/databricks-sdk-go/apierr"
 )
 
+func (d *DeploymentUnit) withResourceKey(ctx context.Context) context.Context {
+	// Match plan output (e.g. "job_runs.foo"), not the internal "resources." form.
+	return dresources.WithResourceKey(ctx, strings.TrimPrefix(d.ResourceKey, "resources."))
+}
+
 func (d *DeploymentUnit) Destroy(ctx context.Context, db *dstate.DeploymentState) error {
+	ctx = log.WithPrefix(ctx, "destroying "+d.ResourceKey)
+	ctx = d.withResourceKey(ctx)
 	id := db.GetResourceID(d.ResourceKey)
 	if id == "" {
 		log.Infof(ctx, "Cannot delete %s: missing from state", d.ResourceKey)
@@ -24,6 +34,8 @@ func (d *DeploymentUnit) Destroy(ctx context.Context, db *dstate.DeploymentState
 }
 
 func (d *DeploymentUnit) Deploy(ctx context.Context, db *dstate.DeploymentState, newState any, actionType deployplan.ActionType, planEntry *deployplan.PlanEntry) error {
+	ctx = log.WithPrefix(ctx, "deploying "+d.ResourceKey)
+	ctx = d.withResourceKey(ctx)
 	if actionType == deployplan.Create {
 		return d.Create(ctx, db, newState)
 	}
@@ -39,16 +51,28 @@ func (d *DeploymentUnit) Deploy(ctx context.Context, db *dstate.DeploymentState,
 	case deployplan.Update:
 		return d.Update(ctx, db, oldID, newState, planEntry)
 	case deployplan.UpdateWithID:
-		return d.UpdateWithID(ctx, db, oldID, newState)
+		return d.UpdateWithID(ctx, db, oldID, newState, planEntry)
 	case deployplan.Resize:
-		return d.Resize(ctx, db, oldID, newState)
+		return d.Resize(ctx, db, oldID, newState, planEntry)
 	default:
 		return fmt.Errorf("internal error: unexpected actionType: %#v", actionType)
 	}
 }
 
+// Create creates the resource and records its state.
 func (d *DeploymentUnit) Create(ctx context.Context, db *dstate.DeploymentState, newState any) error {
-	newID, remoteState, err := d.Adapter.DoCreate(ctx, newState)
+	var newID string
+	var remoteState any
+	_, err := retry.With(ctx, func(ctx context.Context, err error) bool {
+		// For DoCreate, retry feature is opt-in via retrySafe(err) error wrapper
+		_, ok := errors.AsType[*dresources.RetrySafeError](err)
+		return ok && retry.IsTransient(ctx, err)
+	}, func() (struct{}, error) {
+		var e error
+		newID, remoteState, e = d.Adapter.DoCreate(ctx, newState)
+		return struct{}{}, e
+	})
+	err = dresources.UnwrapRetrySafe(err)
 	if err != nil {
 		// No need to prefix error, there is no ambiguity (only one operation - DoCreate) and no additional context (like id)
 		return err
@@ -61,12 +85,16 @@ func (d *DeploymentUnit) Create(ctx context.Context, db *dstate.DeploymentState,
 		return err
 	}
 
-	err = db.SaveState(d.ResourceKey, newID, newState, d.DependsOn)
+	err = d.saveState(ctx, db, newID, newState, d.DependsOn)
 	if err != nil {
 		return fmt.Errorf("saving state after creating id=%s: %w", newID, err)
 	}
 
-	waitRemoteState, err := d.Adapter.WaitAfterCreate(ctx, newState)
+	waitRemoteState, err := waitCapped(ctx, d.MaxWait, "creation of "+d.ResourceKey, func(ctx context.Context) (any, error) {
+		return retry.With(ctx, retry.IsTransientRead, func() (any, error) {
+			return d.Adapter.WaitAfterCreate(ctx, newID, newState)
+		})
+	})
 	if err != nil {
 		return fmt.Errorf("waiting after creating id=%s: %w", newID, err)
 	}
@@ -80,19 +108,47 @@ func (d *DeploymentUnit) Create(ctx context.Context, db *dstate.DeploymentState,
 }
 
 func (d *DeploymentUnit) Recreate(ctx context.Context, db *dstate.DeploymentState, oldID string, newState any) error {
-	// Note, unlike Delete(), we hard error on 403 here intentionally
-	err := d.Adapter.DoDelete(ctx, oldID)
-	if err != nil && !isResourceGone(err) {
-		return fmt.Errorf("deleting old id=%s: %w", oldID, err)
+	oldState, err := d.loadPersistedState(db)
+	if err != nil {
+		return err
+	}
+
+	// Note, unlike Delete(), we hard error on 403 here intentionally.
+	// MANAGED_BY_PARENT is still disregarded — the subsequent Create with
+	// replace_existing=true will reconfigure the parent-managed resource in
+	// place, matching the Terraform provider's recreate behaviour.
+	_, err = retry.With(ctx, retry.IsTransient, func() (struct{}, error) {
+		return struct{}{}, d.Adapter.DoDelete(ctx, oldID, oldState)
+	})
+	if err != nil && !apierr.IsMissing(err) && !isManagedByParent(err) {
+		if !d.deleteConfirmedGone(ctx, oldID) {
+			return fmt.Errorf("deleting old id=%s: %w", oldID, err)
+		}
+		log.Warnf(ctx, "Treating %s id=%s as already deleted despite delete error: %s", d.ResourceKey, oldID, err)
 	}
 
-	// Drop the state entry so a subsequent failure of Create leaves no malformed
-	// (empty-id) entry behind. The next plan will see "no state" and retry as Create.
-	err = db.DeleteState(d.ResourceKey)
+	// Drop the state entry so a subsequent failure of Create or WaitAfterDelete
+	// leaves no malformed (empty-ID) entry behind. The next plan will see "no
+	// state" and retry as Create.
+	//
+	// Recorded as a recreate rather than a delete: if the create below fails, this is the
+	// operation DMS is left with, and it says the resource is mid-recreate.
+	err = db.DeleteState(ctx, d.ResourceKey, true)
 	if err != nil {
 		return fmt.Errorf("deleting state: %w", err)
 	}
 
+	// Wait for asynchronous teardown to finish before re-creating the same
+	// name. Done after DeleteState so the bundle stays consistent if the wait
+	// times out — the resource is no longer tracked in state, retry on next plan.
+	// The general delete-wait stays uncapped; we only pass the already-resolved
+	// RESOURCE_MAX_WAIT so a resource that opts in can bound its own poll by it.
+	// A NotFound means the resource is gone, which is the success the wait polls for.
+	err = d.Adapter.WaitAfterDelete(dresources.WithResourceMaxWait(ctx, d.MaxWait), oldID)
+	if err != nil && !apierr.IsMissing(err) {
+		return fmt.Errorf("waiting after deleting id=%s: %w", oldID, err)
+	}
+
 	return d.Create(ctx, db, newState)
 }
 
@@ -101,7 +157,9 @@ func (d *DeploymentUnit) Update(ctx context.Context, db *dstate.DeploymentState,
 		return fmt.Errorf("internal error: DoUpdate not implemented for resource %s", d.ResourceKey)
 	}
 
-	remoteState, err := d.Adapter.DoUpdate(ctx, id, newState, planEntry)
+	remoteState, err := retry.With(ctx, retry.IsTransient, func() (any, error) {
+		return d.Adapter.DoUpdate(ctx, id, newState, planEntry)
+	})
 	if err != nil {
 		return fmt.Errorf("updating id=%s: %w", id, err)
 	}
@@ -111,12 +169,29 @@ func (d *DeploymentUnit) Update(ctx context.Context, db *dstate.DeploymentState,
 		return err
 	}
 
-	err = db.SaveState(d.ResourceKey, id, newState, d.DependsOn)
+	empty, err := d.Adapter.IsEmptyState(newState)
 	if err != nil {
-		return fmt.Errorf("saving state id=%s: %w", id, err)
+		return err
 	}
 
-	waitRemoteState, err := d.Adapter.WaitAfterUpdate(ctx, newState)
+	if empty {
+		// The update emptied the resource out (e.g. all grants revoked). Keeping an entry
+		// would report the node as tracked-and-unchanged forever, while a fresh deploy of
+		// the same config plans no node at all; drop it so the two agree.
+		err = db.DeleteState(ctx, d.ResourceKey, false)
+		if err != nil {
+			return fmt.Errorf("deleting state id=%s: %w", id, err)
+		}
+	} else {
+		err = d.saveState(ctx, db, id, newState, d.DependsOn)
+		if err != nil {
+			return fmt.Errorf("saving state id=%s: %w", id, err)
+		}
+	}
+
+	waitRemoteState, err := retry.With(ctx, retry.IsTransientRead, func() (any, error) {
+		return d.Adapter.WaitAfterUpdate(ctx, id, newState)
+	})
 	if err != nil {
 		return fmt.Errorf("waiting after updating id=%s: %w", id, err)
 	}
@@ -130,8 +205,14 @@ func (d *DeploymentUnit) Update(ctx context.Context, db *dstate.DeploymentState,
 	return nil
 }
 
-func (d *DeploymentUnit) UpdateWithID(ctx context.Context, db *dstate.DeploymentState, oldID string, newState any) error {
-	newID, remoteState, err := d.Adapter.DoUpdateWithID(ctx, oldID, newState)
+func (d *DeploymentUnit) UpdateWithID(ctx context.Context, db *dstate.DeploymentState, oldID string, newState any, planEntry *deployplan.PlanEntry) error {
+	var newID string
+	var remoteState any
+	_, err := retry.With(ctx, retry.IsTransient, func() (struct{}, error) {
+		var e error
+		newID, remoteState, e = d.Adapter.DoUpdateWithID(ctx, oldID, newState, planEntry)
+		return struct{}{}, e
+	})
 	if err != nil {
 		return fmt.Errorf("updating id=%s: %w", oldID, err)
 	}
@@ -147,12 +228,14 @@ func (d *DeploymentUnit) UpdateWithID(ctx context.Context, db *dstate.Deployment
 		return err
 	}
 
-	err = db.SaveState(d.ResourceKey, newID, newState, d.DependsOn)
+	err = d.saveState(ctx, db, newID, newState, d.DependsOn)
 	if err != nil {
 		return fmt.Errorf("saving state id=%s: %w", oldID, err)
 	}
 
-	waitRemoteState, err := d.Adapter.WaitAfterUpdate(ctx, newState)
+	waitRemoteState, err := retry.With(ctx, retry.IsTransientRead, func() (any, error) {
+		return d.Adapter.WaitAfterUpdate(ctx, newID, newState)
+	})
 	if err != nil {
 		return fmt.Errorf("waiting after updating id=%s: %w", newID, err)
 	}
@@ -167,34 +250,78 @@ func (d *DeploymentUnit) UpdateWithID(ctx context.Context, db *dstate.Deployment
 }
 
 func (d *DeploymentUnit) Delete(ctx context.Context, db *dstate.DeploymentState, oldID string) error {
-	err := d.Adapter.DoDelete(ctx, oldID)
-	if err != nil && !isResourceGone(err) {
+	oldState, err := d.loadPersistedState(db)
+	if err != nil {
+		return err
+	}
+
+	err = d.Adapter.DoDelete(ctx, oldID, oldState)
+	if err != nil && !apierr.IsMissing(err) && !isManagedByParent(err) {
 		// Rather than failing delete and requiring user to unbind, we perform unbind automatically there.
 		// Some services, e.g. jobs, return 403 for missing resources if caller did not have permissions to it when job existed.
 		// In those cases 403 hides 404. In other cases, user not having permissions to resource but having in the bundle might
 		// mean configuration error that user is trying to fix by removing resource from their bundle.
 		if errors.Is(err, apierr.ErrPermissionDenied) {
 			log.Warnf(ctx, "Ignoring permission error when deleting %s id=%s: %s", d.ResourceKey, oldID, err)
-		} else {
-			return fmt.Errorf("deleting id=%s: %w", oldID, err)
+		} else if d.deleteConfirmedGone(ctx, oldID) {
+			log.Warnf(ctx, "Treating %s id=%s as already deleted despite delete error: %s", d.ResourceKey, oldID, err)
+		} else if db.IsDeploymentMetadataService() {
+			// When using the deployment metadata service, record the error.
+			err = fmt.Errorf("deleting id=%s: %w", oldID, err)
+			db.RecordFailure(d.ResourceKey, oldID, err)
+			return err
 		}
 	}
 
-	err = db.DeleteState(d.ResourceKey)
+	err = db.DeleteState(ctx, d.ResourceKey, false)
 	if err != nil {
 		return fmt.Errorf("deleting state id=%s: %w", oldID, err)
 	}
 
+	// Wait for asynchronous teardown after dropping state. Mirrors Recreate so
+	// the contract is the same regardless of whether the user triggered
+	// `bundle destroy` or a recreate.
+	// The two diverge once MaxWait is set: this wait is capped, Recreate's is not,
+	// because only Recreate needs the name released for the create that follows.
+	_, err = waitCapped(ctx, d.MaxWait, "deletion of "+d.ResourceKey, func(ctx context.Context) (struct{}, error) {
+		return struct{}{}, d.Adapter.WaitAfterDelete(ctx, oldID)
+	})
+	// A NotFound means the resource is gone, which is the success the wait polls for.
+	if err != nil && !apierr.IsMissing(err) {
+		return fmt.Errorf("waiting after deleting id=%s: %w", oldID, err)
+	}
+
 	return nil
 }
 
-func (d *DeploymentUnit) Resize(ctx context.Context, db *dstate.DeploymentState, id string, newState any) error {
-	err := d.Adapter.DoResize(ctx, id, newState)
+// deleteConfirmedGone reports whether a failed DoDelete can be treated as
+// complete: the backend already removed the resource, or it is in a transient
+// terminal-teardown state (e.g. an app in DELETING) that IsGone recognises and a
+// retried delete would keep rejecting. This closes the plan/apply gap for saved
+// plans: IsGone is consulted at plan time, but with `deploy --plan` the resource
+// may enter that state only after the plan is saved. We re-read rather than match
+// the delete error because the backend returns a generic 400 BAD_REQUEST (see
+// apps/src/utils/AppsStatusUtils.scala) that carries no distinct SDK sentinel.
+func (d *DeploymentUnit) deleteConfirmedGone(ctx context.Context, id string) bool {
+	remote, err := d.Adapter.DoRead(ctx, id)
+	if apierr.IsMissing(err) {
+		return true
+	}
+	if err != nil {
+		return false
+	}
+	return d.Adapter.IsGone(remote)
+}
+
+func (d *DeploymentUnit) Resize(ctx context.Context, db *dstate.DeploymentState, id string, newState any, entry *deployplan.PlanEntry) error {
+	_, err := retry.With(ctx, retry.IsTransient, func() (struct{}, error) {
+		return struct{}{}, d.Adapter.DoResize(ctx, id, newState, entry)
+	})
 	if err != nil {
 		return fmt.Errorf("resizing id=%s: %w", id, err)
 	}
 
-	err = db.SaveState(d.ResourceKey, id, newState, d.DependsOn)
+	err = d.saveState(ctx, db, id, newState, d.DependsOn)
 	if err != nil {
 		return fmt.Errorf("saving state id=%s: %w", id, err)
 	}
@@ -202,6 +329,21 @@ func (d *DeploymentUnit) Resize(ctx context.Context, db *dstate.DeploymentState,
 	return nil
 }
 
+// saveState compacts the state (replacing fields declared in hashed_fields
+// with content hashes, see dresources.CompactState) before persisting it. Fields already
+// smaller than a hash placeholder are persisted as is. Sensitive fields are replaced by a
+// placeholder value so secrets are never written to disk in plaintext.
+func (d *DeploymentUnit) saveState(ctx context.Context, db *dstate.DeploymentState, newID string, state any, dependsOn []deployplan.DependsOnEntry) error {
+	compacted, err := dresources.CompactState(d.Adapter.ResourceConfig(), state)
+	if err != nil {
+		return fmt.Errorf("compacting state: %w", err)
+	}
+	if err := zeroSensitiveFields(d.Adapter, compacted); err != nil {
+		return fmt.Errorf("redacting state: %w", err)
+	}
+	return db.SaveState(ctx, d.ResourceKey, newID, compacted, dependsOn)
+}
+
 func parseState(destType reflect.Type, raw json.RawMessage) (any, error) {
 	destPtr := reflect.New(destType).Interface()
 	err := json.Unmarshal(raw, destPtr)
@@ -212,11 +354,30 @@ func parseState(destType reflect.Type, raw json.RawMessage) (any, error) {
 	return reflect.ValueOf(destPtr).Elem().Interface(), nil
 }
 
+// loadPersistedState reads and parses the resource's last-persisted state for
+// the DoDelete call. Returns a zero-value state pointer when nothing has been
+// persisted yet (e.g. delete after a partial-create failure), so the call site
+// always passes a typed value.
+func (d *DeploymentUnit) loadPersistedState(db *dstate.DeploymentState) (any, error) {
+	stateType := d.Adapter.StateType()
+	dbentry, ok := db.GetResourceEntry(d.ResourceKey)
+	if !ok || len(dbentry.State) == 0 {
+		return reflect.New(stateType.Elem()).Interface(), nil
+	}
+	state, err := parseState(stateType, dbentry.State)
+	if err != nil {
+		return nil, fmt.Errorf("parsing persisted state: %w", err)
+	}
+	return state, nil
+}
+
 func (d *DeploymentUnit) refreshRemoteState(ctx context.Context, id string) error {
 	if d.RemoteState != nil {
 		return nil
 	}
-	remoteState, err := d.Adapter.DoRead(ctx, id)
+	remoteState, err := retry.With(ctx, retry.IsTransientRead, func() (any, error) {
+		return d.Adapter.DoRead(ctx, id)
+	})
 	if err != nil {
 		return fmt.Errorf("failed to refresh remote state id=%s: %w", id, err)
 	}
diff --git a/bundle/direct/bind.go b/bundle/direct/bind.go
index ed5cbbc07bc..9ac921b9c3c 100644
--- a/bundle/direct/bind.go
+++ b/bundle/direct/bind.go
@@ -2,12 +2,14 @@ package direct
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"os"
 	"strings"
 
 	"github.com/databricks/cli/bundle/config"
 	"github.com/databricks/cli/bundle/deployplan"
+	"github.com/databricks/cli/bundle/direct/dresources"
 	"github.com/databricks/cli/bundle/direct/dstate"
 	"github.com/databricks/cli/libs/log"
 	"github.com/databricks/cli/libs/structs/structaccess"
@@ -61,14 +63,25 @@ type BindResult struct {
 // Call Finalize to commit the state or Cancel to discard.
 func (b *DeploymentBundle) Bind(ctx context.Context, client *databricks.WorkspaceClient, configRoot *config.Root, statePath, resourceKey, resourceID string) (*BindResult, error) {
 	// Check if the resource is already managed (bound to a different ID)
+	// The state is opened without a DMS client, so the writes below record nothing;
+	// phases.Bind and phases.Unbind refuse to run at all when recording is enabled.
 	var checkStateDB dstate.DeploymentState
-	if err := checkStateDB.Open(statePath); err == nil {
-		if existingID := checkStateDB.GetResourceID(resourceKey); existingID != "" {
-			return nil, ErrResourceAlreadyBound{
-				ResourceKey: resourceKey,
-				ExistingID:  existingID,
-				NewID:       resourceID,
-			}
+	if err := checkStateDB.Open(ctx, statePath, dstate.WithRecovery(true), dstate.WithWrite(false), dstate.WithDeploymentHistory(false), dstate.OpenDmsArgs{}); err != nil {
+		// State that cannot be read is not the same as state without a binding:
+		// the resource may well be managed already, and binding on top of it
+		// would take over a resource whose ownership was never checked. A state
+		// file that does not exist yet opens successfully as an empty one.
+		return nil, fmt.Errorf("cannot check whether %s is already bound: %w", resourceKey, err)
+	}
+	existingID := checkStateDB.GetResourceID(resourceKey)
+	if _, err := checkStateDB.Finalize(ctx); err != nil {
+		log.Warnf(ctx, "failed to finalize state: %v", err)
+	}
+	if existingID != "" {
+		return nil, ErrResourceAlreadyBound{
+			ResourceKey: resourceKey,
+			ExistingID:  existingID,
+			NewID:       resourceID,
 		}
 	}
 
@@ -82,21 +95,21 @@ func (b *DeploymentBundle) Bind(ctx context.Context, client *databricks.Workspac
 	}
 
 	// Open temp state
-	err := b.StateDB.Open(tmpStatePath)
+	err := b.StateDB.Open(ctx, tmpStatePath, dstate.WithRecovery(false), dstate.WithWrite(true), dstate.WithDeploymentHistory(false), dstate.OpenDmsArgs{})
 	if err != nil {
 		os.Remove(tmpStatePath)
 		return nil, err
 	}
 
 	// Save state with ID and empty state (like migrate does)
-	err = b.StateDB.SaveState(resourceKey, resourceID, struct{}{}, nil)
+	err = b.StateDB.SaveState(ctx, resourceKey, resourceID, struct{}{}, nil)
 	if err != nil {
 		os.Remove(tmpStatePath)
 		return nil, err
 	}
 
 	// Finalize to persist temp state to disk
-	err = b.StateDB.Finalize()
+	_, err = b.StateDB.Finalize(ctx)
 	if err != nil {
 		os.Remove(tmpStatePath)
 		return nil, err
@@ -105,11 +118,19 @@ func (b *DeploymentBundle) Bind(ctx context.Context, client *databricks.Workspac
 	log.Infof(ctx, "Bound %s to id=%s (in temp state)", resourceKey, resourceID)
 
 	// First plan + update: populate state with resolved config
+	err = b.StateDB.Open(ctx, tmpStatePath, dstate.WithRecovery(true), dstate.WithWrite(false), dstate.WithDeploymentHistory(false), dstate.OpenDmsArgs{})
+	if err != nil {
+		os.Remove(tmpStatePath)
+		return nil, err
+	}
 	plan, err := b.CalculatePlan(ctx, client, configRoot)
 	if err != nil {
 		os.Remove(tmpStatePath)
 		return nil, err
 	}
+	if _, err := b.StateDB.Finalize(ctx); err != nil {
+		log.Warnf(ctx, "failed to finalize state: %v", err)
+	}
 
 	// Populate the state with the resolved config
 	entry := plan.Plan[resourceKey]
@@ -120,10 +141,11 @@ func (b *DeploymentBundle) Bind(ctx context.Context, client *databricks.Workspac
 			dependsOn = entry.DependsOn
 		}
 
-		// Copy etag from remote state for dashboards.
-		// Dashboards store "etag" in state which is not provided by user but comes from remote.
-		// If we don't store "etag" in state, we won't detect remote drift correctly.
-		if strings.Contains(resourceKey, ".dashboards.") && entry != nil && entry.RemoteState != nil {
+		// Copy etag from remote state for resources that use etag-based drift
+		// detection (dashboards and genie spaces). The etag is not provided by the
+		// user; it comes from remote. If we don't store it in state, we won't
+		// detect remote drift correctly and the next plan shows a bogus update.
+		if (strings.Contains(resourceKey, ".dashboards.") || strings.Contains(resourceKey, ".genie_spaces.")) && entry != nil && entry.RemoteState != nil {
 			etag, err := structaccess.Get(entry.RemoteState, structpath.NewStringKey(nil, "etag"))
 			if err == nil && etag != nil {
 				if etagStr, ok := etag.(string); ok && etagStr != "" {
@@ -132,13 +154,32 @@ func (b *DeploymentBundle) Bind(ctx context.Context, client *databricks.Workspac
 			}
 		}
 
-		err = b.StateDB.SaveState(resourceKey, resourceID, sv.Value, dependsOn)
+		// Compact hashed_fields fields so the persisted state stays small. Not needed for
+		// correctness — the next plan (CalculatePlan) compacts the saved state on read.
+		adapter, err := b.getAdapterForKey(resourceKey)
 		if err != nil {
 			os.Remove(tmpStatePath)
 			return nil, err
 		}
+		compacted, err := dresources.CompactState(adapter.ResourceConfig(), sv.Value)
+		if err != nil {
+			os.Remove(tmpStatePath)
+			return nil, fmt.Errorf("compacting state: %w", err)
+		}
 
-		err = b.StateDB.Finalize()
+		err = b.StateDB.Open(ctx, tmpStatePath, dstate.WithRecovery(true), dstate.WithWrite(true), dstate.WithDeploymentHistory(false), dstate.OpenDmsArgs{})
+		if err != nil {
+			os.Remove(tmpStatePath)
+			return nil, err
+		}
+
+		err = b.StateDB.SaveState(ctx, resourceKey, resourceID, compacted, dependsOn)
+		if err != nil {
+			os.Remove(tmpStatePath)
+			return nil, err
+		}
+
+		_, err = b.StateDB.Finalize(ctx)
 		if err != nil {
 			os.Remove(tmpStatePath)
 			return nil, err
@@ -146,7 +187,15 @@ func (b *DeploymentBundle) Bind(ctx context.Context, client *databricks.Workspac
 	}
 
 	// Second plan: this is the plan to present to the user (change between remote resource and config)
+	err = b.StateDB.Open(ctx, tmpStatePath, dstate.WithRecovery(true), dstate.WithWrite(false), dstate.WithDeploymentHistory(false), dstate.OpenDmsArgs{})
+	if err != nil {
+		os.Remove(tmpStatePath)
+		return nil, err
+	}
 	plan, err = b.CalculatePlan(ctx, client, configRoot)
+	if _, ferr := b.StateDB.Finalize(ctx); ferr != nil {
+		log.Warnf(ctx, "failed to finalize state: %v", ferr)
+	}
 	if err != nil {
 		os.Remove(tmpStatePath)
 		return nil, err
@@ -188,13 +237,16 @@ func (result *BindResult) Cancel() {
 // Unbind removes a resource from direct engine state without deleting
 // the workspace resource. Also removes associated permissions/grants entries.
 func (b *DeploymentBundle) Unbind(ctx context.Context, statePath, resourceKey string) error {
-	err := b.StateDB.Open(statePath)
+	err := b.StateDB.Open(ctx, statePath, dstate.WithRecovery(true), dstate.WithWrite(true), dstate.WithDeploymentHistory(false), dstate.OpenDmsArgs{})
 	if err != nil {
+		if errors.Is(err, dstate.ErrUnsettingRecording) {
+			return errors.New("unbind is not supported for a bundle target that records deployment history")
+		}
 		return err
 	}
 
 	// Delete the main resource
-	err = b.StateDB.DeleteState(resourceKey)
+	err = b.StateDB.DeleteState(ctx, resourceKey, false)
 	if err != nil {
 		return err
 	}
@@ -208,7 +260,7 @@ func (b *DeploymentBundle) Unbind(ctx context.Context, statePath, resourceKey st
 
 	for key := range b.StateDB.Data.State {
 		if key == permissionsKey || key == grantsKey || strings.HasPrefix(key, resourceKey+".") {
-			err = b.StateDB.DeleteState(key)
+			err = b.StateDB.DeleteState(ctx, key, false)
 			if err != nil {
 				return err
 			}
@@ -216,5 +268,6 @@ func (b *DeploymentBundle) Unbind(ctx context.Context, statePath, resourceKey st
 		}
 	}
 
-	return b.StateDB.Finalize()
+	_, err = b.StateDB.Finalize(ctx)
+	return err
 }
diff --git a/bundle/direct/bundle_apply.go b/bundle/direct/bundle_apply.go
index a7f3ee65fc2..a673a3239c8 100644
--- a/bundle/direct/bundle_apply.go
+++ b/bundle/direct/bundle_apply.go
@@ -6,26 +6,40 @@ import (
 	"errors"
 	"fmt"
 
+	"github.com/databricks/cli/bundle/config"
 	"github.com/databricks/cli/bundle/deployplan"
+	"github.com/databricks/cli/bundle/terraform_dabs_map"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/log"
 	"github.com/databricks/cli/libs/logdiag"
 	"github.com/databricks/cli/libs/structs/structaccess"
 	"github.com/databricks/cli/libs/structs/structpath"
 	"github.com/databricks/databricks-sdk-go"
 )
 
-type MigrateMode bool
-
-func (b *DeploymentBundle) Apply(ctx context.Context, client *databricks.WorkspaceClient, plan *deployplan.Plan, migrateMode MigrateMode) {
+// Apply deploys every node in plan, respecting dependency order. When reportApplied
+// is set, each resource is reported as soon as it is applied, so a long deploy shows
+// what it has done and a failing one still reports the resources it did apply. Nodes
+// run in parallel, so the lines come out in completion order, which varies per run.
+func (b *DeploymentBundle) Apply(ctx context.Context, client *databricks.WorkspaceClient, plan *deployplan.Plan, reportApplied bool) {
 	if plan == nil {
 		panic("Planning is not done")
 	}
 
+	// Read before the early return below so a malformed value is reported even when there is
+	// nothing to deploy.
+	maxWait, err := resourceMaxWait(ctx)
+	if err != nil {
+		logdiag.LogError(ctx, err)
+		return
+	}
+
 	if len(plan.Plan) == 0 {
 		// Avoid creating state file if nothing to deploy
 		return
 	}
 
-	b.StateDB.AssertOpened()
+	b.StateDB.AssertOpenedForWrite()
 	b.RemoteStateCache.Clear()
 
 	g, err := makeGraph(plan)
@@ -34,6 +48,9 @@ func (b *DeploymentBundle) Apply(ctx context.Context, client *databricks.Workspa
 		return
 	}
 
+	// The state DB records every write with DMS from here on (via the buffer InitializeOperationBuffer opened
+	// in the deploy phase), so the service mirrors the WAL. Writes go out on one background
+	// goroutine, off the apply path, and are drained below once every worker has finished recording.
 	g.Run(defaultParallelism, func(resourceKey string, failedDependency *string) bool {
 		entry, err := plan.WriteLockEntry(resourceKey)
 		if err != nil {
@@ -50,9 +67,6 @@ func (b *DeploymentBundle) Apply(ctx context.Context, client *databricks.Workspa
 
 		action := entry.Action
 		errorPrefix := fmt.Sprintf("cannot %s %s", action, resourceKey)
-		if migrateMode {
-			errorPrefix = "cannot migrate " + resourceKey
-		}
 
 		if action == deployplan.Undefined {
 			logdiag.LogError(ctx, fmt.Errorf("cannot deploy %s: unknown action %q", resourceKey, action))
@@ -67,28 +81,57 @@ func (b *DeploymentBundle) Apply(ctx context.Context, client *databricks.Workspa
 			return false
 		}
 
+		// Stop resource CRUD once recording state with DMS has failed.
+		if err := b.StateDB.RecordingError(); err != nil {
+			logdiag.LogError(ctx, fmt.Errorf("%s: %w", errorPrefix, err))
+			return false
+		}
+
 		adapter, err := b.getAdapterForKey(resourceKey)
 		if adapter == nil {
 			logdiag.LogError(ctx, fmt.Errorf("%s: internal error: cannot get adapter: %w", errorPrefix, err))
 			return false
 		}
 
+		// Deletes are capped even with dependents: state is dropped before the wait, so a
+		// cut-short delete leaves the resource untracked while it tears down, and a dependency
+		// deleted after it may be rejected for still having a child. Accepted deliberately.
+		// Recreate's internal delete-wait is never routed through the cap at all, because it
+		// releases the name for the create that follows.
+		unitWait := maxWait
+		if action != deployplan.Delete && hasBlockingDependents(g, resourceKey) {
+			unitWait = maxWaitUnset
+			if maxWait != maxWaitUnset {
+				log.Debugf(ctx, "Not capping wait for %s: other resources depend on it", resourceKey)
+			}
+		}
+
 		d := &DeploymentUnit{
 			ResourceKey: resourceKey,
 			Adapter:     adapter,
 			DependsOn:   entry.DependsOn,
+			MaxWait:     unitWait,
 		}
 
 		if action == deployplan.Delete {
-			if migrateMode {
-				logdiag.LogError(ctx, fmt.Errorf("%s: Unexpected delete action during migration", errorPrefix))
-				return false
+			if entry.IsStateOnlyDelete() {
+				// The resource is already deleted remotely (Gone) or has no delete
+				// operation (StateOnly); either way only remove it from the state,
+				// without calling the delete API.
+				err = b.StateDB.DeleteState(ctx, resourceKey, false)
+			} else {
+				err = d.Destroy(ctx, &b.StateDB)
 			}
-			err = d.Destroy(ctx, &b.StateDB)
 			if err != nil {
 				logdiag.LogError(ctx, fmt.Errorf("%s: %w", errorPrefix, err))
 				return false
 			}
+			// A state-only delete performs no backend operation, so don't report it,
+			// consistent with the summary (CountActions excludes it) and the terraform
+			// path in logDeploySummary.
+			if reportApplied && !entry.IsStateOnlyDelete() {
+				cmdio.LogString(ctx, deployplan.AppliedLine(resourceKey, action))
+			}
 			return true
 		}
 
@@ -111,23 +154,25 @@ func (b *DeploymentBundle) Apply(ctx context.Context, client *databricks.Workspa
 				return false
 			}
 
-			if migrateMode {
-				// In migration mode we're reading resources in DAG order so that we have fully resolved config snapshots stored
-				id := b.StateDB.GetResourceID(resourceKey)
-				if id == "" {
-					logdiag.LogError(ctx, fmt.Errorf("state entry not found for %q", resourceKey))
-					return false
-				}
-				err = b.StateDB.SaveState(resourceKey, id, sv.Value, entry.DependsOn)
-			} else {
-				// TODO: redo calcDiff to downgrade planned action if possible (?)
-				err = d.Deploy(ctx, &b.StateDB, sv.Value, action, entry)
-			}
-
+			// TODO: redo calcDiff to downgrade planned action if possible (?)
+			//
+			// Success is recorded by the state writes inside Deploy, so a recreate reports
+			// each of its steps.
+			err = d.Deploy(ctx, &b.StateDB, sv.Value, action, entry)
 			if err != nil {
+				// Empty for a create that never got an ID, and for a recreate whose delete
+				// step already dropped it.
+				failedID := b.StateDB.GetResourceID(resourceKey)
+				b.StateDB.RecordFailure(resourceKey, failedID, err)
 				logdiag.LogError(ctx, fmt.Errorf("%s: %w", errorPrefix, err))
 				return false
 			}
+
+			// Reported before the remote-state refresh below: the resource is already
+			// deployed at this point, so the line is accurate even if the refresh fails.
+			if reportApplied {
+				cmdio.LogString(ctx, deployplan.AppliedLine(resourceKey, action))
+			}
 		}
 
 		// TODO: Note, we only really need remote state if there are remote references.
@@ -155,6 +200,13 @@ func (b *DeploymentBundle) Apply(ctx context.Context, client *databricks.Workspa
 
 func (b *DeploymentBundle) LookupReferencePostDeploy(ctx context.Context, path *structpath.PathNode) (any, error) {
 	targetResourceKey, fieldPath := splitResourcePath(path)
+	targetGroup := config.GetResourceTypeFromKey(targetResourceKey)
+
+	// Translate Terraform-style field paths to DABs naming before lookup.
+	fieldPath, err := terraform_dabs_map.TerraformPathToDABs(targetGroup, fieldPath)
+	if err != nil {
+		return nil, err
+	}
 	fieldPathS := fieldPath.String()
 
 	targetEntry, err := b.Plan.ReadLockEntry(targetResourceKey)
diff --git a/bundle/direct/bundle_plan.go b/bundle/direct/bundle_plan.go
index f6bcea316cd..abf10376039 100644
--- a/bundle/direct/bundle_plan.go
+++ b/bundle/direct/bundle_plan.go
@@ -11,19 +11,22 @@ import (
 	"strings"
 
 	"github.com/databricks/cli/bundle/config"
-	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/cli/bundle/deployplan"
 	"github.com/databricks/cli/bundle/direct/dresources"
 	"github.com/databricks/cli/bundle/direct/dstate"
+	"github.com/databricks/cli/bundle/terraform_dabs_map"
 	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/cli/libs/dyn/dynvar"
 	"github.com/databricks/cli/libs/log"
 	"github.com/databricks/cli/libs/logdiag"
+	"github.com/databricks/cli/libs/retry"
 	"github.com/databricks/cli/libs/structs/structaccess"
 	"github.com/databricks/cli/libs/structs/structdiff"
 	"github.com/databricks/cli/libs/structs/structpath"
 	"github.com/databricks/cli/libs/structs/structvar"
 	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
 )
 
 var errDelayed = errors.New("must be resolved after apply")
@@ -37,46 +40,53 @@ func (b *DeploymentBundle) init(client *databricks.WorkspaceClient) error {
 	return err
 }
 
-// ValidatePlanAgainstState validates that a plan's lineage and serial match the current state.
-// This should be called early in the deployment process, before any file operations.
-// If the plan has no lineage (first deployment), validation is skipped.
+// ValidatePlanAgainstState rejects a saved plan that no longer matches the state it was built
+// against: its features, its lineage and its serial.
 func ValidatePlanAgainstState(stateDB *dstate.DeploymentState, plan *deployplan.Plan) error {
-	// If plan has no lineage, this is a first deployment before any state exists
-	// No validation needed
-	if plan.Lineage == "" {
-		return nil
+	stateDB.AssertOpenedForReadOrWrite()
+
+	// A plan is built against a set of state features, and the stamps it carries follow from
+	// them, so applying it to a target with a different set would deploy the wrong shape.
+	// The state is the target's source of truth and carries its features even on a first
+	// recorded deploy (unlike the version ids, which are empty then).
+	if !maps.Equal(plan.Features, stateDB.StateFeatures()) {
+		return errors.New("this plan was created for a different set of state features than the target now has; run 'bundle plan' again")
 	}
 
-	stateDB.AssertOpened()
-
-	// Validate that the plan's lineage matches the current state's lineage
+	// A plan taken before the first deploy carries no lineage, so both sides are empty then and this
+	// passes. If a deployment has happened since, the lineage no longer matches.
 	if plan.Lineage != stateDB.Data.Lineage {
 		return fmt.Errorf("plan lineage %q does not match state lineage %q; the state may have been modified by another process", plan.Lineage, stateDB.Data.Lineage)
 	}
 
-	// Validate that the plan's serial matches the current state's serial
-	if plan.Serial != stateDB.Data.Serial {
-		return fmt.Errorf("plan serial %d does not match state serial %d; the state has been modified since the plan was created. Please run 'bundle plan' again", plan.Serial, stateDB.Data.Serial)
+	expected := stateDB.GetSerial()
+	if plan.Serial != expected {
+		return fmt.Errorf("plan serial %d does not match state serial %d; the state has been modified since the plan was created. Please run 'bundle plan' again", plan.Serial, expected)
 	}
 
 	return nil
 }
 
 // InitForApply initializes the DeploymentBundle for applying a pre-computed plan.
-// This is used when --plan is specified to skip the planning phase.
+// StateDB must already be open for write before calling this function.
 func (b *DeploymentBundle) InitForApply(ctx context.Context, client *databricks.WorkspaceClient, plan *deployplan.Plan) error {
-	b.StateDB.AssertOpened()
+	b.StateDB.AssertOpenedForWrite()
 
 	err := b.init(client)
 	if err != nil {
 		return err
 	}
 
-	// Eagerly parse all StructVarJSON entries to catch parsing errors early.
-	// When the plan is read from JSON, Value contains raw JSON bytes.
-	// We parse them into typed structs and cache them for later use.
+	// Eagerly parse plan entries loaded from JSON:
+	// - NewState.Value contains raw JSON bytes; parse into typed structs and cache.
+	// - RemoteState is decoded as map[string]interface{}; round-trip through the
+	//   adapter's StateType to recover the correct typed struct so that type
+	//   assertions in resource adapters (e.g. entry.RemoteState.(*GrantsState))
+	//   work identically whether the plan came from a file or from memory.
 	for resourceKey, entry := range plan.Plan {
-		if entry.NewState == nil || len(entry.NewState.Value) == 0 {
+		hasNewState := entry.NewState != nil && len(entry.NewState.Value) > 0
+		hasRemoteState := entry.RemoteState != nil
+		if !hasNewState && !hasRemoteState {
 			continue
 		}
 
@@ -85,20 +95,73 @@ func (b *DeploymentBundle) InitForApply(ctx context.Context, client *databricks.
 			return fmt.Errorf("converting plan entry %s: %w", resourceKey, err)
 		}
 
-		sv, err := entry.NewState.ToStructVar(adapter.StateType())
-		if err != nil {
-			return fmt.Errorf("loading plan entry %s: %w", resourceKey, err)
+		if hasNewState {
+			sv, err := entry.NewState.ToStructVar(adapter.StateType())
+			if err != nil {
+				return fmt.Errorf("loading plan entry %s: %w", resourceKey, err)
+			}
+			b.StateCache.Store(resourceKey, sv)
 		}
 
-		b.StateCache.Store(resourceKey, sv)
+		if hasRemoteState {
+			data, err := json.Marshal(entry.RemoteState)
+			if err != nil {
+				return fmt.Errorf("re-serializing remote state for %s: %w", resourceKey, err)
+			}
+			// RemoteType() returns a pointer type (e.g. *AppRemote); Elem() gives
+			// the struct type so reflect.New produces a single pointer, not double.
+			typed := reflect.New(adapter.RemoteType().Elem()).Interface()
+			if err := json.Unmarshal(data, typed); err != nil {
+				return fmt.Errorf("loading remote state for %s: %w", resourceKey, err)
+			}
+			entry.RemoteState = typed
+		}
 	}
 
 	b.Plan = plan
 	return nil
 }
 
+// StampDeploymentIdForFirstVersion fills deploymentID into the plan's jobs and pipelines that still lack one, in
+// both the state cache the apply reads and the plan JSON. It is called after approval creates the
+// deployment, for a first deploy whose deployment_id did not exist at plan time.
+//
+// For subsequent deployments, the deployment_id is already stamped in the plan.
+func (b *DeploymentBundle) StampDeploymentIdForFirstVersion(deploymentID string) error {
+	for resourceKey, entry := range b.Plan.Plan {
+		if entry.NewState == nil || len(entry.NewState.Value) == 0 {
+			continue
+		}
+		sv, ok := b.StateCache.Load(resourceKey)
+		if !ok {
+			continue
+		}
+		var stamped bool
+		switch v := sv.Value.(type) {
+		case *jobs.JobSettings:
+			if v.Deployment.DeploymentId == "" {
+				v.Deployment.DeploymentId = deploymentID
+				stamped = true
+			}
+		case *dresources.PipelineState:
+			if v.Deployment.DeploymentId == "" {
+				v.Deployment.DeploymentId = deploymentID
+				stamped = true
+			}
+		}
+		if stamped {
+			if err := sv.SyncToJSON(entry.NewState); err != nil {
+				return fmt.Errorf("%s: stamping deployment into plan: %w", resourceKey, err)
+			}
+		}
+	}
+	return nil
+}
+
+// CalculatePlan computes the deployment plan by comparing local config against remote state.
+// StateDB must already be open for read before calling this function.
 func (b *DeploymentBundle) CalculatePlan(ctx context.Context, client *databricks.WorkspaceClient, configRoot *config.Root) (*deployplan.Plan, error) {
-	b.StateDB.AssertOpened()
+	b.StateDB.AssertOpenedForRead()
 
 	err := b.init(client)
 	if err != nil {
@@ -110,6 +173,11 @@ func (b *DeploymentBundle) CalculatePlan(ctx context.Context, client *databricks
 		return nil, fmt.Errorf("reading config: %w", err)
 	}
 
+	// The plan records the state it was built against so deploy --plan can reject a plan built for a
+	// target of a different shape or a state that has moved on since.
+	plan.Features = b.StateDB.StateFeatures()
+	plan.Serial = b.StateDB.GetSerial()
+
 	b.Plan = plan
 
 	g, err := makeGraph(plan)
@@ -125,6 +193,7 @@ func (b *DeploymentBundle) CalculatePlan(ctx context.Context, client *databricks
 	// We're processing resources in DAG order because we're resolving references (that can be resolved at plan stage).
 	g.Run(defaultParallelism, func(resourceKey string, failedDependency *string) bool {
 		errorPrefix := "cannot plan " + resourceKey
+		ctx := log.WithPrefix(ctx, "planning "+resourceKey)
 
 		entry, err := plan.WriteLockEntry(resourceKey)
 		if err != nil {
@@ -158,15 +227,34 @@ func (b *DeploymentBundle) CalculatePlan(ctx context.Context, client *databricks
 				return false
 			}
 
-			remoteState, err := adapter.DoRead(ctx, id)
+			if !adapter.HasDoDelete() {
+				// Deleting this resource has no backend effect, so applying the
+				// Delete only drops the state entry. The remote read below exists
+				// solely to detect an already-deleted/gone resource and skip the
+				// delete call — pointless when there is no delete call — so skip it
+				// and mark the entry state-only.
+				entry.StateOnly = true
+				return true
+			}
+
+			remoteState, err := retry.With(ctx, retry.IsTransientRead, func() (any, error) {
+				return adapter.DoRead(ctx, id)
+			})
 			if err != nil {
-				if isResourceGone(err) {
-					// no such resource
-					plan.RemoveEntry(resourceKey)
+				if apierr.IsMissing(err) {
+					// The resource is already deleted remotely. Keep the Delete entry so
+					// that applying it removes the stale state entry, but mark it Gone so
+					// apply skips the delete call and prompts don't list it as a deletion.
+					entry.Gone = true
 				} else {
 					log.Warnf(ctx, "reading %s id=%q: %s", resourceKey, id, err)
 					// This is not an error during deletion, so don't return false here
 				}
+			} else if adapter.IsGone(remoteState) {
+				// The resource is in a transient terminal-teardown state (e.g. an app in
+				// DELETING) that a GET still returns but a second delete would reject.
+				// Treat it as gone: apply cleans up state without re-issuing the delete.
+				entry.Gone = true
 			}
 
 			entry.RemoteState = remoteState
@@ -181,7 +269,7 @@ func (b *DeploymentBundle) CalculatePlan(ctx context.Context, client *databricks
 		}
 
 		dbentry, hasEntry := b.StateDB.GetResourceEntry(resourceKey)
-		// Tolerate empty-id entries from older partial-recreate failures
+		// Tolerate empty-ID entries from older partial-recreate failures
 		// (apply.Recreate now deletes state on the way through, but pre-fix
 		// state files may still carry a malformed entry). Treat as missing
 		// and let the resource be re-created on this plan.
@@ -196,6 +284,13 @@ func (b *DeploymentBundle) CalculatePlan(ctx context.Context, client *databricks
 			return false
 		}
 
+		// Compact the saved state so hashed_fields fields are hashes
+		compactedSavedState, err := dresources.CompactState(adapter.ResourceConfig(), savedState)
+		if err != nil {
+			logdiag.LogError(ctx, fmt.Errorf("%s: compacting saved state: %w", errorPrefix, err))
+			return false
+		}
+
 		// Note, currently we're diffing static structs, not dynamic value.
 		// This means for fields that contain references like ${resources.group.foo.id} we do one of the following:
 		// for strings: comparing unresolved string like "${resoures.group.foo.id}" with actual object id. As long as IDs do not have ${...} format we're good.
@@ -207,15 +302,24 @@ func (b *DeploymentBundle) CalculatePlan(ctx context.Context, client *databricks
 			logdiag.LogError(ctx, fmt.Errorf("%s: internal error: no state cache entry found for %q", errorPrefix, resourceKey))
 			return false
 		}
-		localDiff, err := structdiff.GetStructDiff(savedState, sv.Value, adapter.KeyedSlices())
+		// Compact a copy for comparison only; sv.Value keeps the full contents, which
+		// the deploy sends to the API.
+		localState, err := dresources.CompactState(adapter.ResourceConfig(), sv.Value)
+		if err != nil {
+			logdiag.LogError(ctx, fmt.Errorf("%s: compacting local state: %w", errorPrefix, err))
+			return false
+		}
+		localDiff, err := structdiff.GetStructDiff(compactedSavedState, localState, adapter.KeyedSlices())
 		if err != nil {
 			logdiag.LogError(ctx, fmt.Errorf("%s: diffing local state: %w", errorPrefix, err))
 			return false
 		}
 
-		remoteState, err := adapter.DoRead(ctx, dbentry.ID)
+		remoteState, err := retry.With(ctx, retry.IsTransientRead, func() (any, error) {
+			return adapter.DoRead(ctx, dbentry.ID)
+		})
 		if err != nil {
-			if isResourceGone(err) {
+			if apierr.IsMissing(err) {
 				remoteState = nil
 			} else {
 				logdiag.LogError(ctx, fmt.Errorf("%s: reading id=%q: %w", errorPrefix, dbentry.ID, err))
@@ -238,20 +342,28 @@ func (b *DeploymentBundle) CalculatePlan(ctx context.Context, client *databricks
 				return false
 			}
 
-			remoteDiff, err = structdiff.GetStructDiff(remoteStateComparable, sv.Value, adapter.KeyedSlices())
+			// Compact the remapped remote on the same fields, so a hashed_fields field
+			// is a hash on all three sides of the diff (saved, local, remote)
+			remoteStateComparable, err = dresources.CompactState(adapter.ResourceConfig(), remoteStateComparable)
+			if err != nil {
+				logdiag.LogError(ctx, fmt.Errorf("%s: compacting remote state id=%q: %w", errorPrefix, dbentry.ID, err))
+				return false
+			}
+
+			remoteDiff, err = structdiff.GetStructDiff(remoteStateComparable, localState, adapter.KeyedSlices())
 			if err != nil {
 				logdiag.LogError(ctx, fmt.Errorf("%s: diffing remote state: %w", errorPrefix, err))
 				return false
 			}
 		}
 
-		entry.Changes, err = prepareChanges(ctx, adapter, localDiff, remoteDiff, savedState, remoteStateComparable)
+		entry.Changes, err = prepareChanges(ctx, adapter, localDiff, remoteDiff, compactedSavedState, remoteStateComparable)
 		if err != nil {
 			logdiag.LogError(ctx, fmt.Errorf("%s: %w", errorPrefix, err))
 			return false
 		}
 
-		err = addPerFieldActions(ctx, adapter, entry.Changes, remoteState)
+		err = addPerFieldActions(ctx, adapter, entry.Changes, sv.Value, remoteState)
 		if err != nil {
 			logdiag.LogError(ctx, fmt.Errorf("%s: classifying changes: %w", errorPrefix, err))
 			return false
@@ -289,6 +401,16 @@ func (b *DeploymentBundle) CalculatePlan(ctx context.Context, client *databricks
 		}
 	}
 
+	for resourceKey, entry := range plan.Plan {
+		adapter, err := b.getAdapterForKey(resourceKey)
+		if err != nil {
+			return nil, fmt.Errorf("redacting plan entry %s: %w", resourceKey, err)
+		}
+		if err := redactPlanEntry(adapter, entry); err != nil {
+			return nil, fmt.Errorf("redacting plan entry %s: %w", resourceKey, err)
+		}
+	}
+
 	return plan, nil
 }
 
@@ -321,8 +443,8 @@ func prepareChanges(ctx context.Context, adapter *dresources.Adapter, localDiff,
 			// we have difference for remoteState but not difference for localState
 			// from remoteDiff we can find out remote value (ch.Old) and new config value (ch.New) but we don't know oldState value
 			oldStateVal, err := structaccess.Get(oldState, ch.Path)
-			var notFound *structaccess.NotFoundError
-			if err != nil && !errors.As(err, &notFound) {
+			_, isNotFound := errors.AsType[*structaccess.NotFoundError](err)
+			if err != nil && !isNotFound {
 				log.Debugf(ctx, "Constructing diff: accessing %q on %T: %s", ch.Path, oldState, err)
 			}
 			m[ch.Path.String()] = &deployplan.ChangeDesc{
@@ -342,7 +464,7 @@ func prepareChanges(ctx context.Context, adapter *dresources.Adapter, localDiff,
 	return m, nil
 }
 
-func addPerFieldActions(ctx context.Context, adapter *dresources.Adapter, changes deployplan.Changes, remoteState any) error {
+func addPerFieldActions(ctx context.Context, adapter *dresources.Adapter, changes deployplan.Changes, newState, remoteState any) error {
 	cfg := adapter.ResourceConfig()
 	generatedCfg := adapter.GeneratedResourceConfig()
 
@@ -354,10 +476,16 @@ func addPerFieldActions(ctx context.Context, adapter *dresources.Adapter, change
 			return err
 		}
 
-		if structdiff.IsEqual(ch.Remote, ch.New) {
+		// RemoteAlreadySet only holds when ch.Remote is a real remote value we can compare
+		// against ch.New. Skip it for fields whose remote value is fabricated and thus
+		// meaningless: declared ignore_remote_changes (present in RemoteType but read back
+		// backend-managed/input-only), or absent from RemoteType (a guaranteed-nil
+		// placeholder, since RemapState is a dumb copy). Otherwise a coincidental
+		// new == remote (both nil, say) wrongly skips a real local change.
+		if structdiff.IsEqual(ch.Remote, ch.New) && !ignoreRemoteChanges(cfg, generatedCfg, path) && !isFieldMissingInRemote(adapter, path) {
 			ch.Action = deployplan.Skip
 			ch.Reason = deployplan.ReasonRemoteAlreadySet
-		} else if allEmpty(ch.Old, ch.New, ch.Remote) {
+		} else if allEmptyChange(ch) {
 			ch.Action = deployplan.Skip
 			ch.Reason = deployplan.ReasonEmpty
 		} else if reason, ok := shouldSkip(cfg, path, ch); ok {
@@ -366,18 +494,39 @@ func addPerFieldActions(ctx context.Context, adapter *dresources.Adapter, change
 		} else if reason, ok := shouldSkip(generatedCfg, path, ch); ok {
 			ch.Action = deployplan.Skip
 			ch.Reason = reason
+		} else if action, reason, ok := classifyIDField(cfg, path, ch); ok {
+			ch.Action = action
+			ch.Reason = reason
+		} else if action, reason, ok := classifyIDField(generatedCfg, path, ch); ok {
+			ch.Action = action
+			ch.Reason = reason
 		} else if reason, ok := shouldSkipBackendDefault(cfg, path, ch); ok {
 			ch.Action = deployplan.Skip
 			ch.Reason = reason
 		} else if reason, ok := shouldSkipBackendDefault(generatedCfg, path, ch); ok {
 			ch.Action = deployplan.Skip
 			ch.Reason = reason
-		} else if action, reason := shouldUpdateOrRecreate(cfg, path); action != deployplan.Undefined {
-			ch.Action = action
+		} else if reason, ok := shouldSkipNormalized(cfg, path, ch); ok {
+			ch.Action = deployplan.Skip
 			ch.Reason = reason
-		} else if action, reason := shouldUpdateOrRecreate(generatedCfg, path); action != deployplan.Undefined {
-			ch.Action = action
+		} else if reason, ok := shouldSkipNormalized(generatedCfg, path, ch); ok {
+			ch.Action = deployplan.Skip
 			ch.Reason = reason
+		} else if isFieldMissingInRemote(adapter, path) && structdiff.IsEqual(ch.Old, ch.New) {
+			ch.Action = deployplan.Skip
+			ch.Reason = deployplan.ReasonMissingInRemote
+			// remote_addition is the broadest skip (any config-absent remote field inside a gated
+			// object), so it runs after every more specific skip classifier above. It MUST stay
+			// above recreate: a policy-supplied field must not trigger a delete+create. And after
+			// backend_default (both share the Old==nil,New==nil,Remote!=nil shape) so known defaults
+			// keep their own reason for config-remote-sync (#6631). See shouldSkipRemoteAddition.
+		} else if reason, ok := shouldSkipRemoteAddition(cfg, path, ch, newState); ok {
+			ch.Action = deployplan.Skip
+			ch.Reason = reason
+		} else if reason, ok := findMatchingRuleBidirectional(path, cfg.RecreateOnChanges); ok {
+			ch.Action, ch.Reason = recreateOrBackendDefault(ch, reason)
+		} else if reason, ok := findMatchingRuleBidirectional(path, generatedCfg.RecreateOnChanges); ok {
+			ch.Action, ch.Reason = recreateOrBackendDefault(ch, reason)
 		} else {
 			ch.Action = deployplan.Update
 		}
@@ -409,6 +558,35 @@ func addPerFieldActions(ctx context.Context, adapter *dresources.Adapter, change
 	return nil
 }
 
+func ignoreRemoteChanges(cfg1, cfg2 *dresources.ResourceLifecycleConfig, path *structpath.PathNode) bool {
+	if _, ok := findMatchingRule(path, cfg1.IgnoreRemoteChanges); ok {
+		return true
+	}
+
+	if _, ok := findMatchingRule(path, cfg2.IgnoreRemoteChanges); ok {
+		return true
+	}
+
+	return false
+}
+
+// isFieldMissingInRemote reports whether path exists in StateType but is absent from RemoteType.
+// Such fields are accepted by the API on write but not returned by GET.
+//
+// Because RemapState is a dumb subset copy (see the "RemapState is a dumb copy" section in
+// dresources/README.md), a field absent from RemoteType is always nil/zero in the remapped
+// remote state the planner compares against (ch.Remote): there is nothing for RemapState to
+// copy it from, so it can never appear. That guarantee is what makes this a sound signal that
+// the field's remote value is meaningless. Fields the API returns under a different path are
+// added to RemoteType and populated in DoRead, so they are NOT missing here and keep their
+// real remote value.
+func isFieldMissingInRemote(adapter *dresources.Adapter, path *structpath.PathNode) bool {
+	if structaccess.ValidatePath(adapter.StateType(), path) != nil {
+		return false
+	}
+	return structaccess.ValidatePath(adapter.RemoteType(), path) != nil
+}
+
 func findMatchingRule(path *structpath.PathNode, rules []dresources.FieldRule) (string, bool) {
 	for _, r := range rules {
 		if path.HasPatternPrefix(r.Field) {
@@ -418,6 +596,32 @@ func findMatchingRule(path *structpath.PathNode, rules []dresources.FieldRule) (
 	return "", false
 }
 
+// findMatchingRuleBidirectional matches rules in both directions: the usual
+// descendant match, plus a rule on foo.bar matching a change recorded at foo,
+// because a whole block added or removed is one block-level change and the field
+// the rule names is part of it. Callers must only use this for escalating actions
+// (currently recreate): a whole block that merely contains a leaf named by a
+// suppressing rule (ignore_remote/ignore_local, backend_default, normalize) is
+// still a real change, so those keep the descendant-only findMatchingRule.
+func findMatchingRuleBidirectional(path *structpath.PathNode, rules []dresources.FieldRule) (string, bool) {
+	for _, r := range rules {
+		if matchesFieldRuleBidirectional(path, r.Field) {
+			return r.Reason, true
+		}
+	}
+	return "", false
+}
+
+func matchesFieldRuleBidirectional(path *structpath.PathNode, pattern *structpath.PatternNode) bool {
+	if path.HasPatternPrefix(pattern) {
+		return true
+	}
+	if path.Len() < pattern.Len() {
+		return path.HasPatternPrefix(pattern.Prefix(path.Len()))
+	}
+	return false
+}
+
 func shouldSkip(cfg *dresources.ResourceLifecycleConfig, path *structpath.PathNode, ch *deployplan.ChangeDesc) (string, bool) {
 	if cfg == nil {
 		return "", false
@@ -431,17 +635,123 @@ func shouldSkip(cfg *dresources.ResourceLifecycleConfig, path *structpath.PathNo
 	return "", false
 }
 
-func shouldUpdateOrRecreate(cfg *dresources.ResourceLifecycleConfig, path *structpath.PathNode) (deployplan.ActionType, string) {
+// classifyIDField decides the action for a field that composes the resource's
+// name-based ID, in one place so the remote-only-vs-local rule does not depend on
+// ordering elsewhere in the ladder. Returns ok=false if the path is not such a field.
+//
+//   - Remote-only difference (Old==New): the resource was just fetched by that ID,
+//     so a differing remote value can only be backend normalization (e.g. UC
+//     lowercasing) — a real out-of-band rename would 404 and is handled as
+//     resource-gone. Skip.
+//   - Local change: provided_id_fields recreate (delete + create); updatable_id_fields
+//     rename via UpdateWithID.
+func classifyIDField(cfg *dresources.ResourceLifecycleConfig, path *structpath.PathNode, ch *deployplan.ChangeDesc) (deployplan.ActionType, string, bool) {
 	if cfg == nil {
-		return deployplan.Undefined, ""
+		return deployplan.Undefined, "", false
 	}
-	if reason, ok := findMatchingRule(path, cfg.RecreateOnChanges); ok {
-		return deployplan.Recreate, reason
+	localChange := !structdiff.IsEqual(ch.Old, ch.New)
+	if reason, ok := findMatchingRule(path, cfg.ProvidedIDFields); ok {
+		if localChange {
+			return deployplan.Recreate, reason, true
+		}
+		return deployplan.Skip, reason, true
 	}
-	if reason, ok := findMatchingRule(path, cfg.UpdateIDOnChanges); ok {
-		return deployplan.UpdateWithID, reason
+	if reason, ok := findMatchingRule(path, cfg.UpdatableIDFields); ok {
+		if localChange {
+			return deployplan.UpdateWithID, reason, true
+		}
+		return deployplan.Skip, reason, true
 	}
-	return deployplan.Undefined, ""
+	return deployplan.Undefined, "", false
+}
+
+// shouldSkipNormalized skips a change that is a false diff caused by UC API
+// normalization: the API strips trailing slashes from storage URLs
+// (normalize_slash). The direct engine saves local config to state, so without
+// this the next plan sees the original value against the normalized remote value
+// and triggers a spurious recreate/update.
+func shouldSkipNormalized(cfg *dresources.ResourceLifecycleConfig, path *structpath.PathNode, ch *deployplan.ChangeDesc) (string, bool) {
+	if cfg == nil {
+		return "", false
+	}
+	newStr, newOk := ch.New.(string)
+	remoteStr, remoteOk := ch.Remote.(string)
+	if !newOk || !remoteOk {
+		return "", false
+	}
+	if reason, ok := findMatchingRule(path, cfg.NormalizeSlash); ok && strings.TrimRight(newStr, "/") == strings.TrimRight(remoteStr, "/") {
+		return reason, true
+	}
+	return "", false
+}
+
+// shouldSkipRemoteAddition skips a field the backend added to an object it co-owns.
+//
+// It fires only on an addition: absent from both old state and new config, present in the
+// remote. A disagreement between config and remote (New != nil) is left alone and still
+// reports an update, and so does a field the user removed from config (Old != nil) — that
+// is a deletion the user asked for, not a backend addition.
+//
+// The rule is gated on a field within the same object (ignore_remote_additions.when_set).
+// For cluster specs that gate is policy_id: an attached cluster policy supplies values
+// server-side — "fixed" elements always, "defaultValue" elements when the request sets
+// apply_policy_default_values — so the remote spec is legitimately a superset of what the
+// bundle declares. See acceptance/bundle/resources/jobs/cluster_policy (fixed_addition, default_flag)
+// for the measured backend behavior.
+//
+// Suppressed values are never echoed back on write: an update sends the config spec as-is
+// and the backend re-supplies the policy values.
+//
+// Order in the ladder: this is the broadest skip (any config-absent remote field inside a
+// gated object), so it runs last among the skip classifiers — after backend_default,
+// normalized, and missing_in_remote (all mutually exclusive with it or more specific), and
+// before recreate (a policy-supplied field must not trigger a delete+create). The
+// after-backend_default part is load-bearing: the cluster rule is root-level so it also
+// matches known backend defaults; classifying those as backend_default first keeps
+// remote_addition to genuine, unrecognized additions. config-remote-sync relies on this — it
+// captures remote_addition entries but excludes backend defaults, so mislabeling a default as
+// remote_addition would sync it into config (#6631).
+func shouldSkipRemoteAddition(cfg *dresources.ResourceLifecycleConfig, path *structpath.PathNode, ch *deployplan.ChangeDesc, newState any) (string, bool) {
+	if cfg == nil || ch.Old != nil || ch.New != nil || ch.Remote == nil {
+		return "", false
+	}
+	for _, rule := range cfg.IgnoreRemoteAdditions {
+		if !path.HasPatternPrefix(rule.Field) {
+			continue
+		}
+		// Resolve the gate in two steps: the concrete object the rule matched, then the gate
+		// path relative to it. The wildcards in Field are filled in from the change path, so
+		// each object is gated on its own value.
+		object, err := structaccess.Get(newState, path.Prefix(rule.Field.Len()))
+		if err != nil {
+			// The gated object is absent from the config entirely (e.g. the remote grew a
+			// whole new_cluster the bundle does not declare), so there is no policy to gate
+			// on and the addition is real drift. Rule typos cannot reach here: the patterns
+			// are validated against the state type by TestResourcesYMLRemoteAdditionGates.
+			continue
+		}
+		value, err := structaccess.Get(object, rule.WhenSet)
+		if err != nil || allEmpty(value) {
+			continue
+		}
+		return deployplan.ReasonRemoteAddition, true
+	}
+	return "", false
+}
+
+// recreateOrBackendDefault decides the action for a change that matched a
+// recreate_on_changes rule. An immutable field the config never set (old and new
+// nil) but the backend populated (remote set) is treated as a backend default and
+// left in place: the user does not manage it, and recreating to drop it would be
+// destructive (e.g. dropping an out-of-band UC trace location on an MLflow
+// experiment). This makes the backend default implicit for every optional immutable
+// field, so an explicit backend_defaults entry is only needed for a non-recreate
+// field. Any other change to an immutable field still recreates.
+func recreateOrBackendDefault(ch *deployplan.ChangeDesc, reason string) (deployplan.ActionType, string) {
+	if ch.Old == nil && ch.New == nil && ch.Remote != nil {
+		return deployplan.Skip, deployplan.ReasonImmutableBackendValue
+	}
+	return deployplan.Recreate, reason
 }
 
 // shouldSkipBackendDefault checks if a change should be skipped because the remote value
@@ -451,18 +761,45 @@ func shouldSkipBackendDefault(cfg *dresources.ResourceLifecycleConfig, path *str
 	if cfg == nil || ch.Old != nil || ch.New != nil || ch.Remote == nil {
 		return "", false
 	}
+	if matchesAnyBackendDefault(cfg, path, ch.Remote) {
+		return deployplan.ReasonBackendDefault, true
+	}
+
+	// Nil-vs-map case from structdiff: a remote-only map change is emitted at the
+	// parent path rather than per key. Only skip the parent map if every remote
+	// entry matches a configured backend-default child rule; any unmanaged key
+	// must still surface as drift. rv is always valid here (ch.Remote != nil
+	// above) and a nil map is excluded by Len() == 0.
+	rv := reflect.ValueOf(ch.Remote)
+	if rv.Kind() != reflect.Map || rv.Type().Key().Kind() != reflect.String || rv.Len() == 0 {
+		return "", false
+	}
+	iter := rv.MapRange()
+	for iter.Next() {
+		childPath := structpath.NewBracketString(path, iter.Key().String())
+		if !matchesAnyBackendDefault(cfg, childPath, iter.Value().Interface()) {
+			return "", false
+		}
+	}
+	return deployplan.ReasonBackendDefault, true
+}
+
+// matchesAnyBackendDefault reports whether the remote value at path matches any of
+// the resource's configured backend-default rules (and the rule's allowed values,
+// if specified).
+func matchesAnyBackendDefault(cfg *dresources.ResourceLifecycleConfig, path *structpath.PathNode, remote any) bool {
 	for _, rule := range cfg.BackendDefaults {
 		if !path.HasPatternPrefix(rule.Field) {
 			continue
 		}
 		if len(rule.Values) == 0 {
-			return deployplan.ReasonBackendDefault, true
+			return true
 		}
-		if matchesAllowedValue(ch.Remote, rule.Values) {
-			return deployplan.ReasonBackendDefault, true
+		if matchesAllowedValue(remote, rule.Values) {
+			return true
 		}
 	}
-	return "", false
+	return false
 }
 
 // matchesAllowedValue checks if the remote value matches one of the allowed JSON values.
@@ -496,6 +833,49 @@ func allEmpty(values ...any) bool {
 	return true
 }
 
+// allEmptyChange reports whether a change is an empty no-op that should be skipped.
+// All of Old/New/Remote must be empty-ish under isEmpty (nil, a zero scalar, "", empty map).
+//
+// The one exception is a genuine local change involving an explicit zero scalar: a value
+// force-sent on either side of the diff that differs from the other side is a real change the
+// config makes, so it must be applied rather than dismissed as empty. This covers both setting
+// gcp_attributes.local_ssd_count: 0 on a cluster first deployed without the field (Old nil,
+// New 0) and removing it again (Old 0, New nil). A zero the backend merely echoes for a field
+// nobody set (Old and New empty) or a value the config did not actually change (Old == New,
+// e.g. an unchanged num_workers: 0) stays a no-op.
+//
+// The check reads only Old (saved state) and New (desired state); both are derived from config
+// (saveState persists newState, never the remote read), so a non-nil zero here always means the
+// value was explicitly configured. The backend-supplied Remote value is only consulted by the
+// allEmpty gate above, so backend normalization of a zero (e.g. "" <-> null) never triggers this.
+func allEmptyChange(ch *deployplan.ChangeDesc) bool {
+	if !allEmpty(ch.Old, ch.New, ch.Remote) {
+		return false
+	}
+	if (isZeroScalar(ch.Old) || isZeroScalar(ch.New)) && !structdiff.IsEqual(ch.Old, ch.New) {
+		return false
+	}
+	return true
+}
+
+// isZeroScalar reports whether v is a number or bool holding its zero value (0, 0.0, false).
+// Strings are left out to stay in line with the DropEmptyStrings mutator, which drops an
+// explicit "" before the plan runs.
+func isZeroScalar(v any) bool {
+	if v == nil {
+		return false
+	}
+	rv := reflect.ValueOf(v)
+	switch rv.Kind() {
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64,
+		reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64,
+		reflect.Float32, reflect.Float64, reflect.Bool:
+		return rv.IsZero()
+	default:
+		return false
+	}
+}
+
 func isEmpty(rv reflect.Value) bool {
 	// certain fields can change between "" and null when processed by backend.
 	// in some cases, e.g. model_serving_endpoints.descriptions those fields are also marked as recreate, so we ignore such cases
@@ -525,7 +905,7 @@ func isEmpty(rv reflect.Value) bool {
 }
 
 func isEmptyStruct(rv reflect.Value) bool {
-	if rv.Kind() == reflect.Ptr {
+	if rv.Kind() == reflect.Pointer {
 		if rv.IsNil() {
 			return false
 		}
@@ -537,6 +917,13 @@ func isEmptyStruct(rv reflect.Value) bool {
 	}
 
 	rt := rv.Type()
+
+	// Opaque structs (duration.Duration, types/time.Time) have no exported
+	// fields to inspect, so the loop below would call every value empty.
+	if structdiff.IsOpaqueStruct(rt) {
+		return false
+	}
+
 	for i := range rt.NumField() {
 		field := rt.Field(i)
 
@@ -568,6 +955,15 @@ func splitResourcePath(path *structpath.PathNode) (string, *structpath.PathNode)
 
 func (b *DeploymentBundle) LookupReferencePreDeploy(ctx context.Context, path *structpath.PathNode) (any, error) {
 	targetResourceKey, fieldPath := splitResourcePath(path)
+	targetGroup := config.GetResourceTypeFromKey(targetResourceKey)
+
+	// Translate Terraform-style field paths to DABs naming (e.g. "task" → "tasks",
+	// "git_source.branch" → "git_source.git_branch"). No-op for already-DABs paths.
+	// Returns an error for paths that are Terraform-only with no DABs equivalent.
+	fieldPath, err := terraform_dabs_map.TerraformPathToDABs(targetGroup, fieldPath)
+	if err != nil {
+		return nil, err
+	}
 	fieldPathS := fieldPath.String()
 
 	targetEntry, err := b.Plan.ReadLockEntry(targetResourceKey)
@@ -615,10 +1011,9 @@ func (b *DeploymentBundle) LookupReferencePreDeploy(ctx context.Context, path *s
 
 	localConfig := sv.Value
 
-	targetGroup := config.GetResourceTypeFromKey(targetResourceKey)
-	adapter := b.Adapters[targetGroup]
-	if adapter == nil {
-		return nil, fmt.Errorf("internal error: %s: unknown resource type %q", targetResourceKey, targetGroup)
+	adapter, err := b.getAdapterForKey(targetResourceKey)
+	if err != nil {
+		return nil, fmt.Errorf("internal error: %s: %w", targetResourceKey, err)
 	}
 
 	configValidErr := structaccess.ValidatePath(reflect.TypeOf(localConfig), fieldPath)
@@ -639,7 +1034,14 @@ func (b *DeploymentBundle) LookupReferencePreDeploy(ctx context.Context, path *s
 		return value, nil
 	}
 
-	canReadRemoteCache := targetAction == deployplan.Skip || (targetAction.KeepsID() && adapter.IsFieldInRecreateOnChanges(fieldPath))
+	// A field is safe to read from the remote cache when the target either has no
+	// changes (Skip) or keeps its ID and the field cannot have changed: an
+	// immutable field (FieldTriggersRecreate) or a backend-assigned stable output
+	// like an AIP name derived from the ID (FieldIsStableOutput). The latter lets
+	// ${resources.X.name} resolve during an in-place update instead of delaying,
+	// which would otherwise recreate dependents that reference it as their parent.
+	canReadRemoteCache := targetAction == deployplan.Skip ||
+		(targetAction.KeepsID() && (adapter.FieldTriggersRecreate(fieldPath) || adapter.FieldIsStableOutput(fieldPath)))
 
 	if configValidErr != nil && remoteValidErr == nil {
 		// The field is only present in remote state schema.
@@ -690,7 +1092,17 @@ func (b *DeploymentBundle) resolveReferences(ctx context.Context, resourceKey st
 			return false
 		}
 
+		// References() returns one entry per occurrence, but ResolveRef substitutes
+		// every occurrence in one call and then drops the entry from sv.Refs.
+		// Process each distinct reference once so that a reference appearing more
+		// than once in the same field does not fail with "reference not found".
+		seen := make(map[string]bool)
 		for _, pathString := range refs.References() {
+			if seen[pathString] {
+				continue
+			}
+			seen[pathString] = true
+
 			ref := "${" + pathString + "}"
 			targetPath, err := structpath.ParsePath(pathString)
 			if err != nil {
@@ -782,7 +1194,6 @@ func (b *DeploymentBundle) makePlan(ctx context.Context, configRoot *config.Root
 	}
 
 	slices.Sort(nodes)
-
 	for _, node := range nodes {
 		delete(existingKeys, node)
 
@@ -797,51 +1208,48 @@ func (b *DeploymentBundle) makePlan(ctx context.Context, configRoot *config.Root
 			return nil, fmt.Errorf("%s: %w", prefix, err)
 		}
 
-		baseRefs := map[string]string{}
+		inputStructVar, err := adapter.PrepareInputConfig(inputConfig, node)
+		if err != nil {
+			return nil, fmt.Errorf("%s: %w", prefix, err)
+		}
 
-		if strings.HasSuffix(node, ".permissions") {
-			var inputConfigStructVar *structvar.StructVar
-			var err error
+		newStateConfig, err := adapter.PrepareState(inputStructVar.Value)
+		if err != nil {
+			return nil, fmt.Errorf("%s: %w", prefix, err)
+		}
 
-			if strings.HasPrefix(node, "resources.secret_scopes.") {
-				typedConfig, ok := inputConfig.(*[]resources.SecretScopePermission)
-				if !ok {
-					return nil, fmt.Errorf("%s: expected *[]resources.SecretScopePermission, got %T", prefix, inputConfig)
-				}
-				inputConfigStructVar, err = dresources.PrepareSecretScopeAclsInputConfig(*typedConfig, node)
-			} else {
-				inputConfigStructVar, err = dresources.PreparePermissionsInputConfig(inputConfig, node)
-			}
+		// Unescape "$${...}" to a literal "${...}" in the typed state, which is what
+		// gets deployed and saved.
+		//
+		// This runs on the typed state rather than the dynamic config so that
+		// extractReferences below still sees the escaped form and does not mistake
+		// these placeholders for bundle references.
+		if err := unescapeRefs(newStateConfig); err != nil {
+			return nil, fmt.Errorf("%s: %w", prefix, err)
+		}
 
+		// New nodes only: a node with state must stay in the plan, otherwise emptying it plans nothing.
+		// Apply drops the state entry once the node is empty, so it is skipped from then on.
+		if _, hasState := db.State[node]; !hasState {
+			empty, err := adapter.IsEmptyState(newStateConfig)
 			if err != nil {
-				return nil, err
+				return nil, fmt.Errorf("%s: %w", prefix, err)
 			}
-			inputConfig = inputConfigStructVar.Value
-			baseRefs = inputConfigStructVar.Refs
-		} else if strings.HasSuffix(node, ".grants") {
-			inputConfigStructVar, err := dresources.PrepareGrantsInputConfig(inputConfig, node)
-			if err != nil {
-				return nil, err
+			if empty {
+				continue
 			}
-			inputConfig = inputConfigStructVar.Value
-			baseRefs = inputConfigStructVar.Refs
-		}
-
-		newStateConfig, err := adapter.PrepareState(inputConfig)
-		if err != nil {
-			return nil, fmt.Errorf("%s: %w", prefix, err)
 		}
 
 		// Note, we're extracting references in input config but resolving them in newState.Config which is PrepareState(inputConfig)
 		// This means input and state must be compatible: input can have more fields, but existing fields should not be moved
 		// This means one cannot refer to fields not present in state (e.g. ${resources.jobs.foo.permissions})
 
-		refs, err := extractReferences(configRoot.Value(), node)
+		refs, err := extractReferences(configRoot.Value(), node, adapter.StateType())
 		if err != nil {
 			return nil, fmt.Errorf("failed to read references from config for %s: %w", node, err)
 		}
 
-		maps.Copy(refs, baseRefs)
+		maps.Copy(refs, inputStructVar.Refs)
 
 		var dependsOn []deployplan.DependsOnEntry
 		for _, reference := range refs {
@@ -884,15 +1292,31 @@ func (b *DeploymentBundle) makePlan(ctx context.Context, configRoot *config.Root
 			return strings.Compare(a.Label, b.Label)
 		})
 
+		// Store an unredacted copy in the cache so Apply can deploy with the
+		// actual values. The original newStateConfig is redacted below and used
+		// only for the plan output.
+		stateType := adapter.StateType()
+		cacheCopyPtr := reflect.New(stateType.Elem())
+		cacheCopyPtr.Elem().Set(reflect.ValueOf(newStateConfig).Elem())
+		b.StateCache.Store(node, &structvar.StructVar{
+			Value: cacheCopyPtr.Interface(),
+			Refs:  refs,
+		})
+
+		// Redact sensitive fields before serialising. Sensitive values always come
+		// from bundle variables (enforced by ValidateSecretValueIsVariable), which
+		// are resolved before plan time, so SyncToJSON (called when cross-resource
+		// refs are resolved during planNode) will never re-serialise these fields.
+		if err := redactStruct(adapter, newStateConfig); err != nil {
+			return nil, fmt.Errorf("%s: cannot redact state: %w", node, err)
+		}
+
 		newState := &structvar.StructVar{
 			Value: newStateConfig,
 			Refs:  refs,
 		}
 
-		// Store in cache for use during planning phase
-		b.StateCache.Store(node, newState)
-
-		// Convert to JSON for serialization in plan
+		// Convert to JSON for serialization in plan (values already redacted above).
 		newStateJSON, err := newState.ToJSON()
 		if err != nil {
 			return nil, fmt.Errorf("%s: cannot serialize state: %w", node, err)
@@ -920,7 +1344,15 @@ func (b *DeploymentBundle) makePlan(ctx context.Context, configRoot *config.Root
 	return p, nil
 }
 
-func extractReferences(root dyn.Value, node string) (map[string]string, error) {
+// ExtractReferences extracts variable references from the config subtree rooted at node,
+// keeping only those whose field path exists in stateType (references in input-only or
+// bundle:"readonly" fields, such as volumes' computed volume_path, are skipped).
+// Returns a map from structpath string (field path within the resource) to template string.
+func ExtractReferences(root dyn.Value, node string, stateType reflect.Type) (map[string]string, error) {
+	return extractReferences(root, node, stateType)
+}
+
+func extractReferences(root dyn.Value, node string, stateType reflect.Type) (map[string]string, error) {
 	nodeType := config.GetResourceTypeFromKey(node)
 	refs := make(map[string]string)
 
@@ -948,11 +1380,21 @@ func extractReferences(root dyn.Value, node string) (map[string]string, error) {
 		if !ok {
 			return nil
 		}
-		// Store the original string that contains references, not individual references.
-		// Convert dyn.Path to structpath string because refs are later parsed by structpath.ParsePath.
-		// dyn.Path.String() uses dot notation which is ambiguous for keys containing dots;
-		// structpath uses bracket notation (['key.with.dots']) which round-trips correctly.
-		refs[dynPathToStructPath(p).String()] = ref.Str
+		// ValidatePath and the refs keys both operate on structpath (keys are
+		// re-parsed and applied to the typed state in structvar.ResolveRef).
+		// structpath's bracket notation (['key.with.dots']) also round-trips
+		// keys with dots, which dyn.Path.String()'s dot notation cannot.
+		fieldPath := dynPathToStructPath(p)
+
+		// References resolve against the state type, not the input config (see PlanResources
+		// and dresources.TestInputSubset). A field in input but not in state — e.g. a
+		// bundle:"readonly" field like volumes' volume_path — is dropped before deploy, so a
+		// reference it carries cannot resolve into state and is not a dependency here. Such
+		// references are still resolved earlier during initialize.
+		if structaccess.ValidatePath(stateType, fieldPath) == nil {
+			// Store the original string that contains references, not individual references.
+			refs[fieldPath.String()] = ref.Str
+		}
 		return nil
 	})
 	if err != nil {
diff --git a/bundle/direct/bundle_plan_test.go b/bundle/direct/bundle_plan_test.go
index ccfb7cb517f..2d051dc21b9 100644
--- a/bundle/direct/bundle_plan_test.go
+++ b/bundle/direct/bundle_plan_test.go
@@ -1,10 +1,23 @@
 package direct
 
 import (
+	"bytes"
+	"slices"
 	"testing"
 
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/cli/bundle/deployplan"
+	"github.com/databricks/cli/bundle/direct/dresources"
 	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/dyn/yamlloader"
+	"github.com/databricks/cli/libs/structs/structdiff"
+	"github.com/databricks/cli/libs/structs/structpath"
+	"github.com/databricks/cli/libs/structs/structvar"
+	"github.com/databricks/databricks-sdk-go/service/compute"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/databricks/databricks-sdk-go/service/pipelines"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestDynPathToStructPath(t *testing.T) {
@@ -35,3 +48,750 @@ func TestDynPathToStructPath(t *testing.T) {
 		assert.Equal(t, tc.expected, node.String())
 	}
 }
+
+// extractReferences gates references on the state type: a reference in an input-only field
+// (e.g. a bundle:"readonly" field like volumes' volume_path) must not become a dependency,
+// while references in state fields (e.g. comment) are still extracted.
+func TestExtractReferences_ExcludesReadonlyFields(t *testing.T) {
+	adapters, err := dresources.InitAll(nil)
+	require.NoError(t, err)
+	// The volume state type is catalog.CreateVolumeRequestContent, which has
+	// comment but not volume_path.
+	stateType := adapters["volumes"].StateType()
+
+	const yml = `
+resources:
+  volumes:
+    v:
+      catalog_name: main
+      schema_name: myschema
+      name: myvol
+      comment: "${resources.schemas.kept.name}"
+      volume_path: "/Volumes/main/${resources.schemas.dropped.name}/myvol"
+`
+	root, err := yamlloader.LoadYAML("test", bytes.NewBufferString(yml))
+	require.NoError(t, err)
+
+	refs, err := extractReferences(root, "resources.volumes.v", stateType)
+	require.NoError(t, err)
+
+	assert.Equal(t, map[string]string{
+		"comment": "${resources.schemas.kept.name}",
+	}, refs)
+}
+
+func TestShouldSkipBackendDefault_ManagedPropertiesOnly(t *testing.T) {
+	// Rules mirror the schemas backend_defaults in schemas.yml, but the test is
+	// deliberately self-contained so that edits to schemas.yml don't break it.
+	// The real wiring is covered by acceptance/bundle/resources/schemas/drift.
+	managedDefaults, err := structpath.ParsePattern("properties['unity.catalog.managed.*.defaults.*']")
+	require.NoError(t, err)
+	cfg := &dresources.ResourceLifecycleConfig{
+		BackendDefaults: []dresources.BackendDefaultRule{
+			{Field: managedDefaults},
+		},
+	}
+
+	tests := []struct {
+		name     string
+		path     string
+		remote   any
+		expected bool
+	}{
+		{
+			name:     "managed delta row tracking property",
+			path:     "properties['unity.catalog.managed.delta.defaults.delta.enableRowTracking']",
+			remote:   "true",
+			expected: true,
+		},
+		{
+			name:     "managed iceberg catalog property",
+			path:     "properties['unity.catalog.managed.iceberg.defaults.delta.feature.catalogManaged']",
+			remote:   "true",
+			expected: true,
+		},
+		{
+			name:     "managed delta cluster by auto property",
+			path:     "properties['unity.catalog.managed.delta.defaults.defaultClusterByAuto']",
+			remote:   "true",
+			expected: true,
+		},
+		{
+			name:     "managed delta checkpoint policy property",
+			path:     "properties['unity.catalog.managed.delta.defaults.delta.checkpointPolicy']",
+			remote:   "v2",
+			expected: true,
+		},
+		{
+			name:     "managed delta feature catalogManaged property",
+			path:     "properties['unity.catalog.managed.delta.defaults.delta.feature.catalogManaged']",
+			remote:   "supported",
+			expected: true,
+		},
+		{
+			name:     "unmanaged remote-only property is not skipped",
+			path:     "properties['custom.remote_only']",
+			remote:   "true",
+			expected: false,
+		},
+		{
+			name:     "managed prefix without defaults segment is not skipped",
+			path:     "properties['unity.catalog.managed.delta.other.delta.enableRowTracking']",
+			remote:   "true",
+			expected: false,
+		},
+		{
+			name:     "managed-only parent properties map is skipped",
+			path:     "properties",
+			remote:   map[string]string{"unity.catalog.managed.delta.defaults.delta.enableRowTracking": "true"},
+			expected: true,
+		},
+		{
+			name:     "mixed parent properties map is not skipped",
+			path:     "properties",
+			remote:   map[string]string{"unity.catalog.managed.delta.defaults.delta.enableRowTracking": "true", "custom.remote_only": "true"},
+			expected: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			path, err := structpath.ParsePath(tt.path)
+			require.NoError(t, err)
+
+			reason, ok := shouldSkipBackendDefault(cfg, path, &deployplan.ChangeDesc{
+				Old:    nil,
+				New:    nil,
+				Remote: tt.remote,
+			})
+
+			assert.Equal(t, tt.expected, ok)
+			if tt.expected {
+				assert.Equal(t, deployplan.ReasonBackendDefault, reason)
+			} else {
+				assert.Empty(t, reason)
+			}
+		})
+	}
+}
+
+// A field present in StateType but absent from RemoteType (input-only, e.g. external
+// locations' skip_validation) reads back nil, so a coincidental new == remote must NOT
+// trip RemoteAlreadySet — that would skip a real local change. A field present in RemoteType
+// (jobs' max_concurrent_runs) is not affected.
+func TestIsFieldMissingInRemote(t *testing.T) {
+	adapters, err := dresources.InitAll(nil)
+	require.NoError(t, err)
+
+	tests := []struct {
+		resource string
+		path     string
+		expected bool
+	}{
+		{"external_locations", "skip_validation", true},
+		{"jobs", "max_concurrent_runs", false},
+		{"jobs", "name", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.resource+"."+tt.path, func(t *testing.T) {
+			adapter, ok := adapters[tt.resource]
+			require.True(t, ok)
+			path, err := structpath.ParsePath(tt.path)
+			require.NoError(t, err)
+			assert.Equal(t, tt.expected, isFieldMissingInRemote(adapter, path))
+		})
+	}
+}
+
+// TestRemoteAlreadySetGuards drives addPerFieldActions directly to pin the two guards that
+// keep the RemoteAlreadySet shortcut from swallowing a real local change when the remote
+// value is fabricated (read back as a fixed nil/zero rather than the true remote value):
+//   - a field declared ignore_remote_changes (present in RemoteType, e.g. pipelines' run_as)
+//   - a field absent from RemoteType (missing_in_remote, e.g. external_locations' skip_validation)
+//
+// In both cases a genuine local change (old != new) that coincidentally makes new == remote
+// must still classify as Update, not Skip/remote_already_set.
+func TestRemoteAlreadySetGuards(t *testing.T) {
+	adapters, err := dresources.InitAll(nil)
+	require.NoError(t, err)
+
+	runAs := &pipelines.RunAs{UserName: "someone@example.test"}
+
+	tests := []struct {
+		name           string
+		resource       string
+		field          string
+		ch             *deployplan.ChangeDesc
+		expectedAction deployplan.ActionType
+		expectedReason string
+	}{
+		{
+			// ignore_remote_changes guard: run_as read back nil, config changed A -> B.
+			name:           "ignore_remote_changes real local change",
+			resource:       "pipelines",
+			field:          "run_as",
+			ch:             &deployplan.ChangeDesc{Old: runAs, New: nil, Remote: nil},
+			expectedAction: deployplan.Update,
+		},
+		{
+			// missing_in_remote guard: skip_validation absent from RemoteType (remote nil),
+			// config unset the field it previously had.
+			name:           "missing_in_remote real local change",
+			resource:       "external_locations",
+			field:          "skip_validation",
+			ch:             &deployplan.ChangeDesc{Old: true, New: nil, Remote: nil},
+			expectedAction: deployplan.Update,
+		},
+		{
+			// Control: a real remote value that matches config is correctly skipped.
+			name:           "genuine remote_already_set is skipped",
+			resource:       "jobs",
+			field:          "max_concurrent_runs",
+			ch:             &deployplan.ChangeDesc{Old: 1, New: 2, Remote: 2},
+			expectedAction: deployplan.Skip,
+			expectedReason: deployplan.ReasonRemoteAlreadySet,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			adapter, ok := adapters[tt.resource]
+			require.True(t, ok)
+			changes := deployplan.Changes{tt.field: tt.ch}
+			err := addPerFieldActions(t.Context(), adapter, changes, nil, nil)
+			require.NoError(t, err)
+			assert.Equal(t, tt.expectedAction, tt.ch.Action)
+			if tt.expectedReason != "" {
+				assert.Equal(t, tt.expectedReason, tt.ch.Reason)
+			} else {
+				assert.NotEqual(t, deployplan.ReasonRemoteAlreadySet, tt.ch.Reason, "a real local change must not be skipped as remote_already_set")
+			}
+		})
+	}
+}
+
+// TestRecreateBackendDefault pins the implicit backend-default behavior for
+// recreate_on_changes fields (recreateOrBackendDefault): an immutable field the
+// config never set (old and new nil) but the backend populated (remote set) is left
+// in place instead of recreating, without any explicit backend_defaults entry. A
+// genuine local change to the same field still recreates. This is what generalizes
+// the trace_location fix to every optional immutable field.
+func TestRecreateBackendDefault(t *testing.T) {
+	adapters, err := dresources.InitAll(nil)
+	require.NoError(t, err)
+
+	tests := []struct {
+		name           string
+		resource       string
+		field          string
+		ch             *deployplan.ChangeDesc
+		expectedAction deployplan.ActionType
+		expectedReason string
+	}{
+		{
+			// artifact_location is recreate_on_changes with no backend_defaults entry.
+			name:           "config-absent immutable field the backend set is left in place",
+			resource:       "experiments",
+			field:          "artifact_location",
+			ch:             &deployplan.ChangeDesc{Old: nil, New: nil, Remote: "dbfs:/databricks/mlflow-tracking/123"},
+			expectedAction: deployplan.Skip,
+			expectedReason: deployplan.ReasonImmutableBackendValue,
+		},
+		{
+			// A real change to the immutable field still recreates.
+			name:           "changed immutable field recreates",
+			resource:       "experiments",
+			field:          "artifact_location",
+			ch:             &deployplan.ChangeDesc{Old: "s3://a", New: "s3://b", Remote: "s3://a"},
+			expectedAction: deployplan.Recreate,
+		},
+		{
+			// volumes.storage_location: same shape, different resource.
+			name:           "managed volume storage_location left in place",
+			resource:       "volumes",
+			field:          "storage_location",
+			ch:             &deployplan.ChangeDesc{Old: nil, New: nil, Remote: "s3://bucket/vol"},
+			expectedAction: deployplan.Skip,
+			expectedReason: deployplan.ReasonImmutableBackendValue,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			adapter, ok := adapters[tt.resource]
+			require.True(t, ok)
+			changes := deployplan.Changes{tt.field: tt.ch}
+			require.NoError(t, addPerFieldActions(t.Context(), adapter, changes, nil, nil))
+			assert.Equal(t, tt.expectedAction, tt.ch.Action)
+			if tt.expectedReason != "" {
+				assert.Equal(t, tt.expectedReason, tt.ch.Reason)
+			}
+		})
+	}
+}
+
+// TestScalarZeroChange pins the handling of a zero integer in addPerFieldActions:
+// an explicit config zero is a real, force-sent value and must update, while a
+// zero the backend echoes for a field nobody set stays a no-op. gcp_attributes.local_ssd_count
+// is the motivating field (GCP does not reliably echo it, so it never converged before).
+func TestScalarZeroChange(t *testing.T) {
+	adapters, err := dresources.InitAll(nil)
+	require.NoError(t, err)
+
+	tests := []struct {
+		name           string
+		field          string
+		ch             *deployplan.ChangeDesc
+		expectedAction deployplan.ActionType
+		expectedReason string
+	}{
+		{
+			// The fix: config sets the field to 0 for the first time (remote lacks it).
+			name:           "explicit config zero is an update",
+			field:          "gcp_attributes.local_ssd_count",
+			ch:             &deployplan.ChangeDesc{Old: nil, New: 0, Remote: nil},
+			expectedAction: deployplan.Update,
+		},
+		{
+			// Config never set it, the backend just echoed a zero: not a change.
+			name:           "backend-echoed zero is a no-op",
+			field:          "gcp_attributes.local_ssd_count",
+			ch:             &deployplan.ChangeDesc{Old: nil, New: nil, Remote: 0},
+			expectedAction: deployplan.Skip,
+			expectedReason: deployplan.ReasonEmpty,
+		},
+		{
+			// Control: nothing set anywhere.
+			name:           "all empty is a no-op",
+			field:          "gcp_attributes.local_ssd_count",
+			ch:             &deployplan.ChangeDesc{Old: nil, New: nil, Remote: nil},
+			expectedAction: deployplan.Skip,
+			expectedReason: deployplan.ReasonEmpty,
+		},
+		{
+			// gcp_attributes is ignore_remote_changes: managed, so the remote value is not
+			// authoritative and the remote_already_set shortcut is disabled. An explicit
+			// config zero (New) the prior state lacked (Old) is a real local change, so it
+			// updates even though the remote already reports 0 — before the fix it was
+			// wrongly skipped as empty.
+			name:           "explicit zero on a managed field updates even when remote reports zero",
+			field:          "gcp_attributes.local_ssd_count",
+			ch:             &deployplan.ChangeDesc{Old: nil, New: 0, Remote: 0},
+			expectedAction: deployplan.Update,
+		},
+		{
+			// Mirror of the fix: config removes a field it previously set to 0. That is a
+			// genuine local change (Old 0, New nil differ), symmetric with setting it, so it
+			// updates rather than being dismissed as empty.
+			name:           "clearing an integer zero is an update",
+			field:          "gcp_attributes.local_ssd_count",
+			ch:             &deployplan.ChangeDesc{Old: 0, New: nil, Remote: 0},
+			expectedAction: deployplan.Update,
+		},
+		{
+			// Same treatment for a bool: an explicit false the prior state lacked is a real
+			// change on a managed field (use_preemptible_executors), not an empty no-op.
+			name:           "explicit bool false is an update",
+			field:          "gcp_attributes.use_preemptible_executors",
+			ch:             &deployplan.ChangeDesc{Old: nil, New: false, Remote: false},
+			expectedAction: deployplan.Update,
+		},
+		{
+			// But a false the backend echoes for a bool the config never set stays a no-op.
+			name:           "backend-echoed bool false is a no-op",
+			field:          "gcp_attributes.use_preemptible_executors",
+			ch:             &deployplan.ChangeDesc{Old: nil, New: nil, Remote: false},
+			expectedAction: deployplan.Skip,
+			expectedReason: deployplan.ReasonEmpty,
+		},
+		{
+			// Clearing a bool the config previously set to false is symmetric with setting it.
+			name:           "clearing a bool false is an update",
+			field:          "gcp_attributes.use_preemptible_executors",
+			ch:             &deployplan.ChangeDesc{Old: false, New: nil, Remote: false},
+			expectedAction: deployplan.Update,
+		},
+		{
+			// And for a float: an explicit 0.0 the prior state lacked is a real change.
+			name:           "explicit float zero is an update",
+			field:          "azure_attributes.spot_bid_max_price",
+			ch:             &deployplan.ChangeDesc{Old: nil, New: 0.0, Remote: 0.0},
+			expectedAction: deployplan.Update,
+		},
+		{
+			// Clearing a float the config previously set to 0.0 is symmetric with setting it.
+			name:           "clearing a float zero is an update",
+			field:          "azure_attributes.spot_bid_max_price",
+			ch:             &deployplan.ChangeDesc{Old: 0.0, New: nil, Remote: 0.0},
+			expectedAction: deployplan.Update,
+		},
+		{
+			// Unlike an explicit 0/false, an explicit "" in New is left as a no-op: strings are
+			// not in isZeroScalar. (In practice DropEmptyStrings strips "" upstream, so New is
+			// never "" from real config; this pins the classifier and fails if reflect.String
+			// is ever added to isZeroScalar.)
+			name:           "explicit empty string is a no-op",
+			field:          "gcp_attributes.google_service_account",
+			ch:             &deployplan.ChangeDesc{Old: nil, New: "", Remote: ""},
+			expectedAction: deployplan.Skip,
+			expectedReason: deployplan.ReasonEmpty,
+		},
+		{
+			// A backend-echoed "" (config and state nil) is empty on every side and stays a
+			// no-op. isZeroScalar is never called on Remote, so this is generic empty handling.
+			name:           "backend-echoed empty string is a no-op",
+			field:          "gcp_attributes.google_service_account",
+			ch:             &deployplan.ChangeDesc{Old: nil, New: nil, Remote: ""},
+			expectedAction: deployplan.Skip,
+			expectedReason: deployplan.ReasonEmpty,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			adapter, ok := adapters["clusters"]
+			require.True(t, ok)
+			changes := deployplan.Changes{tt.field: tt.ch}
+			require.NoError(t, addPerFieldActions(t.Context(), adapter, changes, nil, nil))
+			assert.Equal(t, tt.expectedAction, tt.ch.Action)
+			if tt.expectedReason != "" {
+				assert.Equal(t, tt.expectedReason, tt.ch.Reason)
+			}
+		})
+	}
+}
+
+// Map drift handling synthesizes child paths to match against rules. structdiff
+// always emits map keys in bracket notation, so synthetic child paths must too;
+// otherwise rules wouldn't match for identifier-like keys.
+func TestShouldSkipBackendDefault_MapDriftUsesBracketKeys(t *testing.T) {
+	field, err := structpath.ParsePattern("properties['simple']")
+	require.NoError(t, err)
+	cfg := &dresources.ResourceLifecycleConfig{
+		BackendDefaults: []dresources.BackendDefaultRule{{Field: field}},
+	}
+
+	path, err := structpath.ParsePath("properties")
+	require.NoError(t, err)
+
+	reason, ok := shouldSkipBackendDefault(cfg, path, &deployplan.ChangeDesc{
+		Remote: map[string]string{"simple": "v"},
+	})
+	assert.True(t, ok)
+	assert.Equal(t, deployplan.ReasonBackendDefault, reason)
+}
+
+const jobRunKey = "resources.job_runs.my_run"
+
+// The plan skips only a run that reached the required SUCCESS, so a reference
+// served from the remote state cache reads a finished run.
+func TestLookupReferencePreDeploy_FinishedJobRun(t *testing.T) {
+	b := bundleWithSkippedJobRun(t, &dresources.JobRunRemote{
+		RunId:       123,
+		ResultState: jobs.RunResultStateSuccess,
+		State: &jobs.RunState{
+			LifeCycleState: jobs.RunLifeCycleStateTerminated,
+			ResultState:    jobs.RunResultStateSuccess,
+		},
+	})
+
+	value, err := b.LookupReferencePreDeploy(t.Context(), structpath.MustParsePath(jobRunKey+".state.result_state"))
+
+	require.NoError(t, err)
+	assert.Equal(t, jobs.RunResultStateSuccess, value)
+}
+
+// jobRunResultStateAction classifies the result_state drift of a run in the given
+// state. Old == New because a deploy records the outcome it asked for, and only
+// the remote says whether the run reached it.
+func jobRunResultStateAction(t *testing.T, state *jobs.RunState) *deployplan.ChangeDesc {
+	t.Helper()
+	adapters, err := dresources.InitAll(nil)
+	require.NoError(t, err)
+
+	remote := &dresources.JobRunRemote{RunId: 123, ResultState: state.ResultState, State: state}
+	changes := deployplan.Changes{"result_state": &deployplan.ChangeDesc{
+		Old:    jobs.RunResultStateSuccess,
+		New:    jobs.RunResultStateSuccess,
+		Remote: state.ResultState,
+	}}
+
+	require.NoError(t, addPerFieldActions(t.Context(), adapters["job_runs"], changes, nil, remote))
+	return changes["result_state"]
+}
+
+// References are served from the remote state cache only for a run the plan
+// skips, so a run that stopped without succeeding has to be re-triggered.
+func TestJobRunFinishedWithoutSuccessIsRecreate(t *testing.T) {
+	for name, state := range map[string]*jobs.RunState{
+		"FAILED": {
+			LifeCycleState: jobs.RunLifeCycleStateTerminated,
+			ResultState:    jobs.RunResultStateFailed,
+		},
+		"CANCELED": {
+			LifeCycleState: jobs.RunLifeCycleStateTerminated,
+			ResultState:    jobs.RunResultStateCanceled,
+		},
+		"TIMEDOUT": {
+			LifeCycleState: jobs.RunLifeCycleStateTerminated,
+			ResultState:    jobs.RunResultStateTimedout,
+		},
+		// A skipped run never ran, so it reports no result_state at all — the same
+		// as a run still going. Only the lifecycle state tells the two apart.
+		"SKIPPED": {LifeCycleState: jobs.RunLifeCycleStateSkipped},
+	} {
+		t.Run(name, func(t *testing.T) {
+			assert.Equal(t, deployplan.Recreate, jobRunResultStateAction(t, state).Action)
+		})
+	}
+}
+
+// A run that has not stopped yet may still succeed, so the plan leaves it
+// alone rather than recreating it. Skip does not resume an abandoned wait.
+func TestJobRunInProgressIsSkip(t *testing.T) {
+	for _, lifeCycleState := range []jobs.RunLifeCycleState{
+		jobs.RunLifeCycleStatePending,
+		jobs.RunLifeCycleStateRunning,
+		jobs.RunLifeCycleStateTerminating,
+	} {
+		t.Run(string(lifeCycleState), func(t *testing.T) {
+			change := jobRunResultStateAction(t, &jobs.RunState{LifeCycleState: lifeCycleState})
+
+			assert.Equal(t, deployplan.Skip, change.Action)
+			assert.Equal(t, "run in progress", change.Reason)
+		})
+	}
+}
+
+// The run reached the required outcome, so the plan can skip it.
+func TestJobRunSucceededOutcomeIsNotDrift(t *testing.T) {
+	change := jobRunResultStateAction(t, &jobs.RunState{
+		LifeCycleState: jobs.RunLifeCycleStateTerminated,
+		ResultState:    jobs.RunResultStateSuccess,
+	})
+
+	assert.Equal(t, deployplan.Skip, change.Action)
+}
+
+// bundleWithSkippedJobRun sets up a deploy whose plan skips the run, so
+// references to it resolve from the remote state cache. The state cache holds
+// PrepareState's output, as a real plan does.
+func bundleWithSkippedJobRun(t *testing.T, remote *dresources.JobRunRemote) *DeploymentBundle {
+	t.Helper()
+
+	adapters, err := dresources.InitAll(nil)
+	require.NoError(t, err)
+
+	plan := deployplan.NewPlanDirect()
+	plan.Plan[jobRunKey] = &deployplan.PlanEntry{
+		Action:   deployplan.Skip,
+		NewState: &structvar.StructVarJSON{},
+	}
+
+	b := &DeploymentBundle{Adapters: adapters, Plan: plan}
+	state := (&dresources.ResourceJobRun{}).PrepareState(&resources.JobRun{})
+	b.StateCache.Store(jobRunKey, structvar.NewStructVar(state, nil))
+	b.RemoteStateCache.Store(jobRunKey, remote)
+	return b
+}
+
+func TestShouldSkipRemoteAddition(t *testing.T) {
+	// Rules mirror clusters/jobs ignore_remote_additions in clusters.yml and jobs.yml, but the
+	// test is deliberately self-contained so edits to those files don't break it. The real wiring
+	// is covered by acceptance/bundle/resources/cluster_policies/*.
+	jobCluster, err := structpath.ParsePattern("job_clusters[*].new_cluster")
+	require.NoError(t, err)
+	cfg := &dresources.ResourceLifecycleConfig{
+		IgnoreRemoteAdditions: []dresources.RemoteAdditionRule{
+			{Field: jobCluster, WhenSet: structpath.MustParsePath("policy_id")},
+		},
+	}
+
+	withPolicy := &jobs.JobSettings{JobClusters: []jobs.JobCluster{{
+		JobClusterKey: "small",
+		NewCluster:    &compute.ClusterSpec{PolicyId: "p1"},
+	}}}
+	withoutPolicy := &jobs.JobSettings{JobClusters: []jobs.JobCluster{{
+		JobClusterKey: "small",
+		NewCluster:    &compute.ClusterSpec{},
+	}}}
+	// when_set resolves against the concrete object the rule matched, so two clusters in one
+	// job are gated independently.
+	mixed := &jobs.JobSettings{JobClusters: []jobs.JobCluster{
+		{JobClusterKey: "gated", NewCluster: &compute.ClusterSpec{PolicyId: "p1"}},
+		{JobClusterKey: "plain", NewCluster: &compute.ClusterSpec{}},
+	}}
+
+	const tagPath = "job_clusters[job_cluster_key='small'].new_cluster.custom_tags['CostCenter']"
+
+	tests := []struct {
+		name     string
+		path     string
+		state    *jobs.JobSettings
+		change   deployplan.ChangeDesc
+		expected bool
+	}{
+		{
+			name:     "policy attached, backend added a tag",
+			path:     tagPath,
+			state:    withPolicy,
+			change:   deployplan.ChangeDesc{Remote: "dev-1234"},
+			expected: true,
+		},
+		{
+			name:     "policy attached, whole map added by backend",
+			path:     "job_clusters[job_cluster_key='small'].new_cluster.custom_tags",
+			state:    withPolicy,
+			change:   deployplan.ChangeDesc{Remote: map[string]string{"CostCenter": "dev-1234"}},
+			expected: true,
+		},
+		{
+			name:     "no policy attached: an addition is still drift",
+			path:     tagPath,
+			state:    withoutPolicy,
+			change:   deployplan.ChangeDesc{Remote: "dev-1234"},
+			expected: false,
+		},
+		{
+			name:     "config disagrees with remote: still an update",
+			path:     tagPath,
+			state:    withPolicy,
+			change:   deployplan.ChangeDesc{New: "mine", Remote: "dev-1234"},
+			expected: false,
+		},
+		{
+			name:     "user removed the field from config: still an update",
+			path:     tagPath,
+			state:    withPolicy,
+			change:   deployplan.ChangeDesc{Old: "mine", Remote: "dev-1234"},
+			expected: false,
+		},
+		{
+			name:     "remote has nothing: not an addition",
+			path:     tagPath,
+			state:    withPolicy,
+			change:   deployplan.ChangeDesc{},
+			expected: false,
+		},
+		{
+			name:     "outside the gated object: not covered",
+			path:     "tags['CostCenter']",
+			state:    withPolicy,
+			change:   deployplan.ChangeDesc{Remote: "dev-1234"},
+			expected: false,
+		},
+		{
+			name:     "sibling cluster with a policy does not gate one without",
+			path:     "job_clusters[job_cluster_key='plain'].new_cluster.custom_tags['CostCenter']",
+			state:    mixed,
+			change:   deployplan.ChangeDesc{Remote: "dev-1234"},
+			expected: false,
+		},
+		{
+			name:     "the cluster with the policy is gated on its own policy_id",
+			path:     "job_clusters[job_cluster_key='gated'].new_cluster.custom_tags['CostCenter']",
+			state:    mixed,
+			change:   deployplan.ChangeDesc{Remote: "dev-1234"},
+			expected: true,
+		},
+		{
+			// The remote grew a whole cluster the config does not declare: there is no
+			// policy_id to gate on, so this is real drift rather than a policy addition.
+			name:     "gated object absent from config: still drift",
+			path:     "job_clusters[job_cluster_key='other'].new_cluster.custom_tags['CostCenter']",
+			state:    withPolicy,
+			change:   deployplan.ChangeDesc{Remote: "dev-1234"},
+			expected: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			path, err := structpath.ParsePath(tt.path)
+			require.NoError(t, err)
+
+			change := tt.change
+			reason, ok := shouldSkipRemoteAddition(cfg, path, &change, tt.state)
+			assert.Equal(t, tt.expected, ok)
+			if tt.expected {
+				assert.Equal(t, deployplan.ReasonRemoteAddition, reason)
+			}
+		})
+	}
+}
+
+// Types for TestPrepareChangesWholeBlockOverlap: two levels of nesting under an
+// optional pointer.
+type threeWayInner struct {
+	B string `json:"b,omitempty"`
+	C string `json:"c,omitempty"`
+}
+
+type threeWayMid struct {
+	A *threeWayInner `json:"a,omitempty"`
+}
+
+type threeWayOuter struct {
+	Field *threeWayMid `json:"field,omitempty"`
+}
+
+// TestPrepareChangesWholeBlockOverlap documents the "whole block" bug at the
+// three-way merge: local (saved-state vs config) and remote (remote vs config)
+// diffs cut the tree at different levels when the remote has a nil intermediate,
+// so prepareChanges keys them under different paths and emits a coarse parent
+// entry alongside the fine child entry instead of merging into leaves.
+//
+// old:    field.a = {b: "old"}
+// new:    field.a = {b: "old", c: "newc"}   (c added locally)
+// remote: field.a = nil
+//
+// The local diff descends to the leaf (field.a.c); the remote diff stops at the
+// nil (field.a), so the two never merge. This test asserts the current (buggy)
+// key set; leaf-level decomposition must instead yield {field.a.b, field.a.c}.
+func TestPrepareChangesWholeBlockOverlap(t *testing.T) {
+	old := threeWayOuter{Field: &threeWayMid{A: &threeWayInner{B: "old"}}}
+	newState := threeWayOuter{Field: &threeWayMid{A: &threeWayInner{B: "old", C: "newc"}}}
+	remote := threeWayOuter{Field: &threeWayMid{A: nil}}
+
+	localDiff, err := structdiff.GetStructDiff(old, newState, nil)
+	require.NoError(t, err)
+	remoteDiff, err := structdiff.GetStructDiff(remote, newState, nil)
+	require.NoError(t, err)
+
+	changes, err := prepareChanges(t.Context(), nil, localDiff, remoteDiff, old, remote)
+	require.NoError(t, err)
+
+	keys := make([]string, 0, len(changes))
+	for k := range changes {
+		keys = append(keys, k)
+	}
+	slices.Sort(keys)
+
+	// Unexpected: a coarse "field.a" entry overlaps the fine "field.a.c" entry.
+	// Probably should be: []string{"field.a.b", "field.a.c"}.
+	assert.Equal(t, []string{"field.a", "field.a.c"}, keys)
+
+	// The coarse parent entry carries the whole sub-block rather than a leaf value.
+	assert.Equal(t, threeWayInner{B: "old", C: "newc"}, changes["field.a"].New)
+}
+
+// TestLadderBackendDefaultBeforeRemoteAddition guards the ladder order in addPerFieldActions.
+// The clusters resource has BOTH a root-level ignore_remote_additions rule (when_set: policy_id)
+// and backend_defaults (enable_elastic_disk). On a policy-gated cluster a config-absent backend
+// default matches both; it must keep reason backend_default, not remote_addition, so that
+// config-remote-sync excludes it (it captures remote_addition but filters known defaults).
+// Reordering the two classifiers reintroduces #6631.
+func TestLadderBackendDefaultBeforeRemoteAddition(t *testing.T) {
+	adapter, err := dresources.NewAdapter(dresources.SupportedResources["clusters"], "clusters", nil)
+	require.NoError(t, err)
+
+	newState := &dresources.ClusterState{PolicyId: "p1"}
+	changes := deployplan.Changes{
+		// config-absent (Old==New==nil), present in remote: matches both rules.
+		"enable_elastic_disk": &deployplan.ChangeDesc{Remote: true},
+	}
+	require.NoError(t, addPerFieldActions(t.Context(), adapter, changes, newState, nil))
+	assert.Equal(t, deployplan.Skip, changes["enable_elastic_disk"].Action)
+	assert.Equal(t, deployplan.ReasonBackendDefault, changes["enable_elastic_disk"].Reason)
+}
diff --git a/bundle/direct/dresources/.gitattributes b/bundle/direct/dresources/.gitattributes
new file mode 100644
index 00000000000..48aea316546
--- /dev/null
+++ b/bundle/direct/dresources/.gitattributes
@@ -0,0 +1 @@
+*.generated.yml linguist-generated=true
diff --git a/bundle/direct/dresources/README.md b/bundle/direct/dresources/README.md
index a20b68c4ebd..5487042c965 100644
--- a/bundle/direct/dresources/README.md
+++ b/bundle/direct/dresources/README.md
@@ -9,22 +9,27 @@
    An exception could be made if default error message lacks the necessary context.
  - The arguments point to actual struct that will be persisted in state, any changes to it will affect what is stored in state. Usually there is no need to change it, but if there is, there should always be detailed explanation.
  - Each Create/Update/Delete method should correspond to one API call. We persist state right after, so there is minimum chance of having orphaned resources.
- - We should calculate the update type during plan phase. This means it should be configured via resources.yml as much as possible, falling back to OverrideChangeDesc(). The DoUpdate() implementation should be as predictable as possible based on the plan. In particular, avoid reading remote state in DoUpdate() to decide what kind of update to dod.
+ - We should calculate the update type during plan phase. This means it should be configured via the resource's YAML file as much as possible, falling back to OverrideChangeDesc(). The DoUpdate() implementation should be as predictable as possible based on the plan. In particular, avoid reading remote state in DoUpdate() to decide what kind of update to dod.
  - Create/Update/Delete methods should not need to do read requests. They can read state passed to them via \*PlanEntry but that should be reserved for exceptional cases. Most resources should have 1-1 mapping to single SDK/API call.
- - For update with complex logic, ensure that DoUpdate() never results in no-op. If certain fields could not be updated, they should be excluded at plan level in resources.yml.
+ - For update with complex logic, ensure that DoUpdate() never results in no-op. If certain fields could not be updated, they should be excluded at plan level in `<resource_type>.yml`.
 
-## Field classification in resources.yml
+## Field classification in `<resource_type>.yml`
 
-Each field with special plan/deploy behavior must be declared in `resources.yml`. Choose the right category:
+Each field with special plan/deploy behavior must be declared in the YAML file of its resource type, under `configs/`. Both files of a resource type are optional and are omitted when they would be empty:
+
+ - `configs/<resource_type>.yml` (e.g. `configs/jobs.yml`) — hand-written rules.
+ - `configs/<resource_type>.generated.yml` — API field behaviors from the OpenAPI schema. Generated by `./task generate-direct-resources`, do not edit.
+
+Choose the right category:
 
  - **`backend_defaults`**: The backend may fill in a value when the user doesn't specify one. Suppresses the diff when the user's config is nil/empty but remote has a value. Optionally restrict to specific allowed remote values via `values:`. Use for fields the API fills in as defaults (e.g., `format`, `run_if`, `node_type_id`). Link to TF provider suppression comment in the same format as existing entries.
- - **`ignore_remote_changes`**: Ignore changes the remote makes to this field. Use for fields the backend manages (e.g., cloud-provider attributes like `aws_attributes`, `gcp_attributes`) or fields not returned by the update endpoint. Reason codes:
+ - **`ignore_remote_changes`**: Ignore changes the remote makes to this field. Use for fields the backend manages (e.g., cloud-provider attributes like `aws_attributes`, `gcp_attributes`) or fields not returned by the update endpoint. Do not zero out such fields in `RemapState` to hide them from diff computation: carry the real remote value through and declare the field here instead, since zeroing discards information and duplicates the suppression logic. For `output_only` fields this rule is often already produced by `<resource_type>.generated.yml` from the OpenAPI annotation. Reason codes:
    - `output_only` — the field is computed by the backend; the user never sets it
    - `input_only` — accepted on create/update but not returned by GET (e.g., write-only tokens, flags)
    - `managed` — managed by the cloud provider or platform, not by the user config
- - **`ignore_local_changes`**: Ignore changes the user makes to this field. Use for fields that cannot be updated via API — either they are immutable after creation or require a separate API that is not yet implemented. Must have a comment in resources.yml explaining why.
+ - **`ignore_local_changes`**: Ignore changes the user makes to this field. Use for fields that cannot be updated via API — either they are immutable after creation or require a separate API that is not yet implemented. Must have a comment explaining why.
  - **`recreate_on_changes`**: Changing this field requires delete + create. Use for truly immutable fields (name, type, location). The reason should reference API docs or TF provider.
- - **`update_id_on_changes`**: Changing this field changes the resource's ID. Requires `DoUpdateWithID` to be implemented.
+ - **`updatable_id_fields`**: Changing this field changes the resource's ID. Requires `DoUpdateWithID` to be implemented.
 
 ## Update mask
 
@@ -42,14 +47,65 @@ For resources whose create or update is asynchronous (the resource is not immedi
 
 If the API may return a slice's elements in a different order between calls (e.g., `depends_on` in job tasks, `privileges` in grants), implement `KeyedSlices` to compare elements by a natural key rather than by index. Without this, every deploy after any reordering shows phantom diffs.
 
+## Empty states: IsEmptyState
+
+If a desired state describes no resource at all (e.g. an empty grants list), implement `IsEmptyState`. The planner omits such a node instead of planning a create, and apply drops its state entry instead of persisting one.
+
+The planner only consults it for nodes without a state entry: once state exists the node stays in the plan, so emptying it still plans an update, and the update is what removes the entry.
+
+## Config that is not the state: Configure and PrepareInputConfig
+
+Most resources take their bundle config straight into `PrepareState`. Sub-resources (permissions, grants) cannot: their state is assembled from the parent's config section plus a reference to the parent's ID, which has no source in the config.
+
+Two optional hooks cover this, and nothing outside the resource needs to know a node is a sub-resource:
+
+ - `Configure(resourceType string) error` is called once per registered type at adapter construction, with the key from `SupportedResources` (e.g. `"jobs.permissions"`). Resolve type-level lookups here — one instance exists per type, so the result can be stored on the receiver, and an unsupported type fails at init rather than at plan time.
+ - `PrepareInputConfig(inputConfig, resourceKey string) (*structvar.StructVar, error)` converts the node's config into the value handed to `PrepareState`, together with the references needed to complete it. `resourceKey` is the full node (`resources.jobs.foo.permissions`), so the parent node is available for building `${...}` references.
+
+Declare `inputConfig` with its concrete type when every parent shares one (grants: `*[]catalog.PrivilegeAssignment`); use `any` only where the config types genuinely differ per parent, as with permissions.
+
 ## State backward compatibility
 
 The state struct is serialized to JSON and persisted between deploys. Backward incompatible changes will result in a drift, which depending
 on field behaviour might result in recreate. See dstate/migrate.go on how to handle state migration.
 
+## hashed_fields: storing large fields as content hashes
+
+Declaring a field under `hashed_fields` in `resources.yml` makes the engine persist only a `sha256:<hex>` content hash of it in state (via `CompactState`) rather than the full contents, for large equality-only fields that are never read back from state (e.g. `dashboards.serialized_dashboard`).
+
+## RemapState is a dumb copy; DoRead owns all remapping
+
+`RemapState` converts `RemoteType` to `StateType` only because `StateType` is typically a
+subset of `RemoteType`. It must be a field-by-field copy (or no-op), never a place for
+logic. In particular, do not remap a differently-named field there (e.g. `state.x = remote.status.x`).
+Any remapping the API requires belongs in `DoRead`: add `x` directly to `RemoteType` and
+populate it from `status.x` inside `DoRead`.
+
+This is not a style preference — the plan classifier depends on it. Because `RemapState` is a
+dumb copy, a field absent from `RemoteType` is always nil/zero in the remapped remote state the
+planner compares against: there is nothing to copy it from. So "path present in `StateType` but
+absent from `RemoteType`" reliably means "field the API accepts on write but never echoes on
+read," and its remote value is guaranteed meaningless (see `isFieldMissingInRemote` /
+`missing_in_remote` in `bundle_plan.go`).
+
+A `RemapState` that instead synthesizes `state.x = remote.status.x` breaks this: `x` is absent
+from `RemoteType`, so the classifier treats it as input-only and skips it (`missing_in_remote`),
+yet the field actually has a real remote value under `status.x`. Genuine remote drift is then
+silently suppressed. The fix is to make the field genuinely present in `RemoteType`, not to
+smuggle it in via `RemapState`.
+
+So when a field comes back under a different path than `StateType` uses:
+
+1. Add the field to `RemoteType` (the struct returned by `DoRead`).
+2. Populate it in `DoRead` by mapping from whatever the API returns under the other name.
+3. Keep `RemapState` a trivial subset copy.
+
+This makes the field present in `InputType`, `StateType`, and `RemoteType`, so it participates
+in normal drift detection and is no longer subject to the `missing_in_remote` suppression.
+
 ## OverrideChangeDesc
 
-Use `OverrideChangeDesc` only as a last resort when `resources.yml` settings cannot express the needed logic. Skipping an action with `change.Action = deployplan.Skip` in `OverrideChangeDesc` creates a silent no-op: the plan shows no change even if the user's config differs from remote. Document the skip reason clearly in both the comment and `change.Reason`.
+Use `OverrideChangeDesc` only as a last resort when the `<resource_type>.yml` settings cannot express the needed logic. Skipping an action with `change.Action = deployplan.Skip` in `OverrideChangeDesc` creates a silent no-op: the plan shows no change even if the user's config differs from remote. Document the skip reason clearly in both the comment and `change.Reason`.
 
 ## Nice to have
  - Add link to corresponding API documentation before each method.
diff --git a/bundle/direct/dresources/adapter.go b/bundle/direct/dresources/adapter.go
index f931208c3cc..80ece24b2be 100644
--- a/bundle/direct/dresources/adapter.go
+++ b/bundle/direct/dresources/adapter.go
@@ -9,6 +9,7 @@ import (
 	"github.com/databricks/cli/bundle/deployplan"
 	"github.com/databricks/cli/libs/calladapt"
 	"github.com/databricks/cli/libs/structs/structpath"
+	"github.com/databricks/cli/libs/structs/structvar"
 	"github.com/databricks/databricks-sdk-go"
 )
 
@@ -28,6 +29,21 @@ type IResource interface {
 	// Single instance is reused across all instances, so it must not store any resource-specific state.
 	New(client *databricks.WorkspaceClient) any
 
+	// [Optional] Configure passes the resource type this instance is registered under in SupportedResources
+	// (e.g. "jobs.permissions"). One instance is created per resource type, so type-level lookups belong here
+	// rather than in per-node methods, and an unsupported type fails at init instead of at plan time.
+	// Example: func (r *ResourcePermissions) Configure(resourceType string) error
+	Configure(resourceType string) error
+
+	// [Optional] PrepareInputConfig converts the bundle config for a node into the value passed to PrepareState,
+	// plus references that complete it but have no source in the config. resourceKey is the full node,
+	// e.g. "resources.jobs.foo.permissions". Sub-resources use it to reference their parent's id.
+	// Resources that don't implement it receive their config unchanged and contribute no references.
+	// Like the other resource methods, inputConfig is never nil, so it may be declared as a concrete
+	// pointer and dereferenced: nodes are discovered from the config tree, so the key always exists.
+	// Example: func (r *ResourceGrants) PrepareInputConfig(inputConfig *[]catalog.PrivilegeAssignment, resourceKey string) (*structvar.StructVar, error)
+	PrepareInputConfig(inputConfig any, resourceKey string) (*structvar.StructVar, error)
+
 	// PrepareState converts resource's config as defined by bundle schema to the concrete type used by create/update and persisted in the state.
 	// Example: func (*ResourceJob) PrepareState(input *resources.Job) *jobs.JobSettings
 	PrepareState(input any) any
@@ -42,9 +58,16 @@ type IResource interface {
 	// Example: func (r *ResourceJob) DoRead(ctx context.Context, id string) (*jobs.Job, error)
 	DoRead(ctx context.Context, id string) (remoteState any, e error)
 
-	// DoDelete deletes the resource.
-	// Example: func (r *ResourceJob) DoDelete(ctx context.Context, id string) error
-	DoDelete(ctx context.Context, id string) error
+	// [Optional] DoDelete deletes the resource. The state argument is the last-persisted
+	// state for the resource; resources that don't need it should accept it as
+	// _ to satisfy the interface.
+	// Omitting DoDelete declares that deleting the resource has no backend effect
+	// (e.g. grants, permissions): the engine then treats a planned Delete as a
+	// state-only cleanup (see PlanEntry.StateOnly) — it skips the remote read at
+	// plan time, issues no delete call at apply, and omits the resource from
+	// textual plan output and destructive-action prompts.
+	// Example: func (r *ResourceJob) DoDelete(ctx context.Context, id string, _ *jobs.JobSettings) error
+	DoDelete(ctx context.Context, id string, state any) error
 
 	// [Optional] OverrideChangeDesc can implement custom logic to update a given ChangeDesc; it is run last after built-in classifiers and field triggers.
 	OverrideChangeDesc(ctx context.Context, path *structpath.PathNode, changedesc *ChangeDesc, remoteState any) error
@@ -54,27 +77,47 @@ type IResource interface {
 	// Example: func (r *ResourceVolume) DoCreate(ctx context.Context, newState *catalog.CreateVolumeRequestContent) (string, *catalog.VolumeInfo, error)
 	DoCreate(ctx context.Context, newState any) (id string, remoteState any, e error)
 
+	// [Optional] IsEmptyState reports that newState describes no resource at all: the planner
+	// omits the node instead of planning a create, and apply drops the state entry instead of
+	// persisting one, so plan and apply converge on "this node does not exist".
+	// Example: func (*ResourceGrants) IsEmptyState(state *GrantsState) bool
+	IsEmptyState(newState any) bool
+
 	// [Optional] DoUpdate updates the resource. ID must not change as a result of this operation. Returns optionally remote state.
 	// If remote state is available as part of the operation, return it; otherwise return nil.
 	// Example: func (r *ResourceSchema) DoUpdate(ctx context.Context, id string, newState *catalog.CreateSchema, entry *PlanEntry) (*catalog.SchemaInfo, error)
 	DoUpdate(ctx context.Context, id string, newState any, entry *PlanEntry) (remoteState any, e error)
 
 	// [Optional] DoUpdateWithID performs an update that may result in resource having a new ID. Returns new id and optionally remote state.
-	DoUpdateWithID(ctx context.Context, id string, newState any) (newID string, remoteState any, e error)
+	// Example: func (r *ResourceCatalog) DoUpdateWithID(ctx context.Context, id string, newState *catalog.CreateCatalog, entry *PlanEntry) (string, *catalog.CatalogInfo, error)
+	DoUpdateWithID(ctx context.Context, id string, newState any, entry *PlanEntry) (newID string, remoteState any, e error)
 
 	// [Optional] DoResize resizes the resource. Only supported by clusters
-	DoResize(ctx context.Context, id string, newState any) error
+	DoResize(ctx context.Context, id string, newState any, entry *PlanEntry) error
 
 	// [Optional] WaitAfterCreate waits for the resource to become ready after creation. Returns optionally updated remote state.
 	// TODO: wait status should be persisted in the state.
-	WaitAfterCreate(ctx context.Context, newState any) (remoteState any, e error)
+	WaitAfterCreate(ctx context.Context, id string, newState any) (remoteState any, e error)
 
 	// [Optional] WaitAfterUpdate waits for the resource to become ready after update. Returns optionally updated remote state.
-	WaitAfterUpdate(ctx context.Context, newState any) (remoteState any, e error)
+	WaitAfterUpdate(ctx context.Context, id string, newState any) (remoteState any, e error)
+
+	// [Optional] WaitAfterDelete waits for the resource to be fully removed after DoDelete returns.
+	// Useful for backends with asynchronous deletion: a follow-up create on the same name (recreate path)
+	// would otherwise race with the in-progress teardown. State is dropped before this is called, so a
+	// timeout here leaves the bundle consistent (resource was requested deleted, retry on next plan).
+	WaitAfterDelete(ctx context.Context, id string) error
 
 	// [Optional] KeyedSlices returns a map from path patterns to KeyFunc for comparing slices by key instead of by index.
 	// Example: func (*ResourcePermissions) KeyedSlices(state *PermissionsState) map[string]any
 	KeyedSlices() map[string]any
+
+	// [Optional] IsGone reports whether a remote resource should be treated as
+	// already-deleted when planning a delete. Use for backends whose DELETE is
+	// asynchronous and leaves the resource in a transient terminal-teardown state
+	// (returned by GET, not 404) that rejects a second DELETE.
+	// Example: func (*ResourceApp) IsGone(remote *AppRemote) bool
+	IsGone(remoteState any) bool
 }
 
 // Adapter wraps resource implementation, validates signatures and type consistency across methods
@@ -84,16 +127,20 @@ type Adapter struct {
 	prepareState *calladapt.BoundCaller
 	remapState   *calladapt.BoundCaller
 	doRefresh    *calladapt.BoundCaller
-	doDelete     *calladapt.BoundCaller
 	doCreate     *calladapt.BoundCaller
 
 	// Optional:
+	doDelete           *calladapt.BoundCaller
+	prepareInputConfig *calladapt.BoundCaller
+	isEmptyState       *calladapt.BoundCaller
 	doUpdate           *calladapt.BoundCaller
 	doUpdateWithID     *calladapt.BoundCaller
 	waitAfterCreate    *calladapt.BoundCaller
 	waitAfterUpdate    *calladapt.BoundCaller
+	waitAfterDelete    *calladapt.BoundCaller
 	overrideChangeDesc *calladapt.BoundCaller
 	doResize           *calladapt.BoundCaller
+	isGone             *calladapt.BoundCaller
 
 	resourceConfig          *ResourceLifecycleConfig
 	generatedResourceConfig *ResourceLifecycleConfig
@@ -113,18 +160,28 @@ func NewAdapter(typedNil any, resourceType string, client *databricks.WorkspaceC
 		return nil, fmt.Errorf("internal error: New returned %d values, expected 1", len(outs))
 	}
 	impl := outs[0]
+
+	err = configureImpl(impl, resourceType)
+	if err != nil {
+		return nil, err
+	}
+
 	adapter := &Adapter{
 		prepareState:            nil,
 		remapState:              nil,
 		doRefresh:               nil,
 		doDelete:                nil,
 		doCreate:                nil,
+		prepareInputConfig:      nil,
+		isEmptyState:            nil,
 		doUpdate:                nil,
 		doUpdateWithID:          nil,
 		doResize:                nil,
 		waitAfterCreate:         nil,
 		waitAfterUpdate:         nil,
+		waitAfterDelete:         nil,
 		overrideChangeDesc:      nil,
+		isGone:                  nil,
 		resourceConfig:          GetResourceConfig(resourceType),
 		generatedResourceConfig: GetGeneratedResourceConfig(resourceType),
 		keyedSlices:             nil,
@@ -143,6 +200,19 @@ func NewAdapter(typedNil any, resourceType string, client *databricks.WorkspaceC
 	return adapter, nil
 }
 
+// configureImpl calls the resource's Configure method, if it has one.
+func configureImpl(impl any, resourceType string) error {
+	call, err := calladapt.PrepareCall(impl, reflect.TypeFor[IResource](), "Configure")
+	if err != nil {
+		return err
+	}
+	if call == nil {
+		return nil
+	}
+	_, err = call.Call(resourceType)
+	return err
+}
+
 // loadKeyedSlices validates and calls KeyedSlices method, returning the resulting map.
 func loadKeyedSlices(call *calladapt.BoundCaller) (map[string]any, error) {
 	outs, err := call.Call()
@@ -174,17 +244,29 @@ func (a *Adapter) initMethods(resource any) error {
 		return err
 	}
 
-	a.doDelete, err = prepareCallRequired(resource, "DoDelete")
+	a.doCreate, err = prepareCallRequired(resource, "DoCreate")
 	if err != nil {
 		return err
 	}
 
-	a.doCreate, err = prepareCallRequired(resource, "DoCreate")
+	// Optional methods with varying signatures:
+
+	// DoDelete is optional: a resource that omits it declares that deleting it has
+	// no backend effect, and the engine handles the Delete as a state-only cleanup.
+	a.doDelete, err = calladapt.PrepareCall(resource, reflect.TypeFor[IResource](), "DoDelete")
 	if err != nil {
 		return err
 	}
 
-	// Optional methods with varying signatures:
+	a.prepareInputConfig, err = calladapt.PrepareCall(resource, reflect.TypeFor[IResource](), "PrepareInputConfig")
+	if err != nil {
+		return err
+	}
+
+	a.isEmptyState, err = calladapt.PrepareCall(resource, reflect.TypeFor[IResource](), "IsEmptyState")
+	if err != nil {
+		return err
+	}
 
 	a.doUpdate, err = calladapt.PrepareCall(resource, reflect.TypeFor[IResource](), "DoUpdate")
 	if err != nil {
@@ -206,6 +288,11 @@ func (a *Adapter) initMethods(resource any) error {
 		return err
 	}
 
+	a.waitAfterDelete, err = calladapt.PrepareCall(resource, reflect.TypeFor[IResource](), "WaitAfterDelete")
+	if err != nil {
+		return err
+	}
+
 	a.overrideChangeDesc, err = calladapt.PrepareCall(resource, reflect.TypeFor[IResource](), "OverrideChangeDesc")
 	if err != nil {
 		return err
@@ -216,6 +303,11 @@ func (a *Adapter) initMethods(resource any) error {
 		return err
 	}
 
+	a.isGone, err = calladapt.PrepareCall(resource, reflect.TypeFor[IResource](), "IsGone")
+	if err != nil {
+		return err
+	}
+
 	keyedSlicesCall, err := calladapt.PrepareCall(resource, reflect.TypeFor[IResource](), "KeyedSlices")
 	if err != nil {
 		return err
@@ -266,10 +358,16 @@ func (a *Adapter) validate() error {
 		"DoCreate newState", a.doCreate.InTypes[1], stateType,
 	}
 
+	// DoDelete is optional; validate its state argument only when implemented.
+	if a.doDelete != nil {
+		validations = append(validations, "DoDelete state", a.doDelete.InTypes[2], stateType)
+	}
+
 	// If RemapState is implemented, validate its signature.
 	// Otherwise require remote type to equal state type so remapping isn't needed.
 	if a.remapState != nil {
-		validations = append(validations,
+		validations = append(
+			validations,
 			"RemapState input", a.remapState.InTypes[0], remoteType,
 			"RemapState return", a.remapState.OutTypes[0], stateType,
 		)
@@ -283,6 +381,10 @@ func (a *Adapter) validate() error {
 	}
 	validations = append(validations, "DoCreate remoteState return", a.doCreate.OutTypes[1], remoteType)
 
+	if a.isEmptyState != nil {
+		validations = append(validations, "IsEmptyState newState", a.isEmptyState.InTypes[0], stateType)
+	}
+
 	// Validate DoUpdate: must return (remoteType, error) if implemented
 	if a.doUpdate != nil {
 		validations = append(validations, "DoUpdate newState", a.doUpdate.InTypes[2], stateType)
@@ -296,6 +398,10 @@ func (a *Adapter) validate() error {
 		validations = append(validations, "DoResize newState", a.doResize.InTypes[2], stateType)
 	}
 
+	if a.isGone != nil {
+		validations = append(validations, "IsGone remoteState", a.isGone.InTypes[0], remoteType)
+	}
+
 	if a.doUpdateWithID != nil {
 		validations = append(validations, "DoUpdateWithID newState", a.doUpdateWithID.InTypes[2], stateType)
 		// DoUpdateWithID must return (string, remoteType, error)
@@ -306,7 +412,7 @@ func (a *Adapter) validate() error {
 	}
 
 	if a.waitAfterCreate != nil {
-		validations = append(validations, "WaitAfterCreate newState", a.waitAfterCreate.InTypes[1], stateType)
+		validations = append(validations, "WaitAfterCreate newState", a.waitAfterCreate.InTypes[2], stateType)
 		// WaitAfterCreate must return (remoteType, error)
 		if len(a.waitAfterCreate.OutTypes) != 2 {
 			return fmt.Errorf("WaitAfterCreate must return (remoteType, error), got %d return values", len(a.waitAfterCreate.OutTypes))
@@ -315,7 +421,7 @@ func (a *Adapter) validate() error {
 	}
 
 	if a.waitAfterUpdate != nil {
-		validations = append(validations, "WaitAfterUpdate newState", a.waitAfterUpdate.InTypes[1], stateType)
+		validations = append(validations, "WaitAfterUpdate newState", a.waitAfterUpdate.InTypes[2], stateType)
 		// WaitAfterUpdate must return (remoteType, error)
 		if len(a.waitAfterUpdate.OutTypes) != 2 {
 			return fmt.Errorf("WaitAfterUpdate must return (remoteType, error), got %d return values", len(a.waitAfterUpdate.OutTypes))
@@ -330,12 +436,12 @@ func (a *Adapter) validate() error {
 
 	// Validate resourceConfig consistency with DoUpdateWithID
 	if a.overrideChangeDesc == nil {
-		hasUpdateWithIDTrigger := a.resourceConfig != nil && len(a.resourceConfig.UpdateIDOnChanges) > 0
+		hasUpdateWithIDTrigger := a.resourceConfig != nil && len(a.resourceConfig.UpdatableIDFields) > 0
 		if hasUpdateWithIDTrigger && a.doUpdateWithID == nil {
-			return errors.New("resourceConfig has update_id_on_changes but DoUpdateWithID is not implemented")
+			return errors.New("resourceConfig has updatable_id_fields but DoUpdateWithID is not implemented")
 		}
 		if a.doUpdateWithID != nil && !hasUpdateWithIDTrigger {
-			return errors.New("DoUpdateWithID is implemented but resourceConfig lacks update_id_on_changes")
+			return errors.New("DoUpdateWithID is implemented but resourceConfig lacks updatable_id_fields")
 		}
 	}
 
@@ -362,15 +468,60 @@ func (a *Adapter) GeneratedResourceConfig() *ResourceLifecycleConfig {
 	return a.generatedResourceConfig
 }
 
-func (a *Adapter) IsFieldInRecreateOnChanges(path *structpath.PathNode) bool {
+// GetSensitiveFields returns the list of sensitive fields for the resource.
+func (a *Adapter) GetSensitiveFields() []string {
+	var fields []string
+	for _, r := range a.resourceConfig.SensitiveFields {
+		fields = append(fields, r.Field.String())
+	}
+	return fields
+}
+
+// FieldTriggersRecreate reports whether a local change to the field forces a
+// delete + create. Both recreate_on_changes and provided_id_fields do this, so a
+// caller that knows the ID is preserved can conclude the field is unchanged.
+func (a *Adapter) FieldTriggersRecreate(path *structpath.PathNode) bool {
 	for _, p := range a.resourceConfig.RecreateOnChanges {
 		if path.HasPatternPrefix(p.Field) {
 			return true
 		}
 	}
+	for _, p := range a.resourceConfig.ProvidedIDFields {
+		if path.HasPatternPrefix(p.Field) {
+			return true
+		}
+	}
+	return false
+}
+
+// FieldIsStableOutput reports whether the field is an output-only value the
+// backend fixes at creation and never changes on update (declared under
+// stable_output_fields). Like FieldTriggersRecreate, a caller that knows the ID
+// is preserved can conclude the field is unchanged, so its remote value is safe
+// to read.
+func (a *Adapter) FieldIsStableOutput(path *structpath.PathNode) bool {
+	for _, p := range a.resourceConfig.StableOutputFields {
+		if path.HasPatternPrefix(p.Field) {
+			return true
+		}
+	}
 	return false
 }
 
+// PrepareInputConfig converts the node's bundle config into the input for PrepareState and the
+// references needed to complete it. Resources without PrepareInputConfig pass their config through.
+func (a *Adapter) PrepareInputConfig(inputConfig any, resourceKey string) (*structvar.StructVar, error) {
+	if a.prepareInputConfig == nil {
+		return &structvar.StructVar{Value: inputConfig, Refs: nil}, nil
+	}
+
+	outs, err := a.prepareInputConfig.Call(inputConfig, resourceKey)
+	if err != nil {
+		return nil, err
+	}
+	return outs[0].(*structvar.StructVar), nil
+}
+
 func (a *Adapter) PrepareState(input any) (any, error) {
 	outs, err := a.prepareState.Call(input)
 	if err != nil {
@@ -399,12 +550,19 @@ func (a *Adapter) DoRead(ctx context.Context, id string) (any, error) {
 	return outs[0], nil
 }
 
-func (a *Adapter) DoDelete(ctx context.Context, id string) error {
-	_, err := a.doDelete.Call(ctx, id)
-	if err != nil {
-		return err
+// HasDoDelete reports whether the resource implements DoDelete. When false, the
+// resource's delete has no backend effect and the engine treats a planned Delete
+// as a state-only cleanup.
+func (a *Adapter) HasDoDelete() bool {
+	return a.doDelete != nil
+}
+
+func (a *Adapter) DoDelete(ctx context.Context, id string, state any) error {
+	if a.doDelete == nil {
+		return nil // no-op: deleting this resource has no backend effect
 	}
-	return nil
+	_, err := a.doDelete.Call(ctx, id, state)
+	return err
 }
 
 // normalizeNilPointer converts a nil pointer wrapped in an interface to a nil interface.
@@ -414,7 +572,7 @@ func normalizeNilPointer(v any) any {
 		return nil
 	}
 	rv := reflect.ValueOf(v)
-	if rv.Kind() == reflect.Ptr && rv.IsNil() {
+	if rv.Kind() == reflect.Pointer && rv.IsNil() {
 		return nil
 	}
 	return v
@@ -431,6 +589,19 @@ func (a *Adapter) DoCreate(ctx context.Context, newState any) (string, any, erro
 	return id, remoteState, nil
 }
 
+// IsEmptyState reports whether newState describes no resource; false if not implemented.
+func (a *Adapter) IsEmptyState(newState any) (bool, error) {
+	if a.isEmptyState == nil {
+		return false, nil
+	}
+
+	outs, err := a.isEmptyState.Call(newState)
+	if err != nil {
+		return false, err
+	}
+	return outs[0].(bool), nil
+}
+
 // HasDoUpdate returns true if the resource implements DoUpdate method.
 func (a *Adapter) HasDoUpdate() bool {
 	return a.doUpdate != nil
@@ -458,12 +629,12 @@ func (a *Adapter) HasDoUpdateWithID() bool {
 }
 
 // DoUpdateWithID updates the resource and may change its ID. Returns newID and remoteState if available.
-func (a *Adapter) DoUpdateWithID(ctx context.Context, oldID string, newState any) (string, any, error) {
+func (a *Adapter) DoUpdateWithID(ctx context.Context, oldID string, newState any, entry *PlanEntry) (string, any, error) {
 	if a.doUpdateWithID == nil {
 		return "", nil, errors.New("internal error: DoUpdateWithID not found")
 	}
 
-	outs, err := a.doUpdateWithID.Call(ctx, oldID, newState)
+	outs, err := a.doUpdateWithID.Call(ctx, oldID, newState, entry)
 	if err != nil {
 		return "", nil, err
 	}
@@ -473,24 +644,24 @@ func (a *Adapter) DoUpdateWithID(ctx context.Context, oldID string, newState any
 	return id, remoteState, nil
 }
 
-func (a *Adapter) DoResize(ctx context.Context, id string, newState any) error {
+func (a *Adapter) DoResize(ctx context.Context, id string, newState any, entry *PlanEntry) error {
 	if a.doResize == nil {
 		return errors.New("internal error: DoResize not found")
 	}
 
-	_, err := a.doResize.Call(ctx, id, newState)
+	_, err := a.doResize.Call(ctx, id, newState, entry)
 	return err
 }
 
 // WaitAfterCreate waits for the resource to become ready after creation.
 // If the resource doesn't implement this method, this is a no-op.
 // Returns the updated remoteState if available, otherwise returns nil
-func (a *Adapter) WaitAfterCreate(ctx context.Context, newState any) (any, error) {
+func (a *Adapter) WaitAfterCreate(ctx context.Context, id string, newState any) (any, error) {
 	if a.waitAfterCreate == nil {
 		return nil, nil // no-op if not implemented
 	}
 
-	outs, err := a.waitAfterCreate.Call(ctx, newState)
+	outs, err := a.waitAfterCreate.Call(ctx, id, newState)
 	if err != nil {
 		return nil, err
 	}
@@ -502,12 +673,12 @@ func (a *Adapter) WaitAfterCreate(ctx context.Context, newState any) (any, error
 // WaitAfterUpdate waits for the resource to become ready after update.
 // If the resource doesn't implement this method, this is a no-op.
 // Returns the updated remoteState if available, otherwise returns nil.
-func (a *Adapter) WaitAfterUpdate(ctx context.Context, newState any) (any, error) {
+func (a *Adapter) WaitAfterUpdate(ctx context.Context, id string, newState any) (any, error) {
 	if a.waitAfterUpdate == nil {
 		return nil, nil // no-op if not implemented
 	}
 
-	outs, err := a.waitAfterUpdate.Call(ctx, newState)
+	outs, err := a.waitAfterUpdate.Call(ctx, id, newState)
 	if err != nil {
 		return nil, err
 	}
@@ -516,6 +687,16 @@ func (a *Adapter) WaitAfterUpdate(ctx context.Context, newState any) (any, error
 	return remoteState, nil
 }
 
+// WaitAfterDelete waits for the resource to be fully removed after DoDelete.
+// If the resource doesn't implement this method, this is a no-op.
+func (a *Adapter) WaitAfterDelete(ctx context.Context, id string) error {
+	if a.waitAfterDelete == nil {
+		return nil // no-op if not implemented
+	}
+	_, err := a.waitAfterDelete.Call(ctx, id)
+	return err
+}
+
 // HasOverrideChangeDesc returns true if OverrideChangeDesc is defined for this resource impl
 func (a *Adapter) HasOverrideChangeDesc() bool {
 	return a.overrideChangeDesc != nil
@@ -533,6 +714,19 @@ func (a *Adapter) KeyedSlices() map[string]any {
 	return a.keyedSlices
 }
 
+// IsGone reports whether the remote state represents an already-deleted resource
+// for planning purposes. Resources that don't implement IsGone are never gone.
+func (a *Adapter) IsGone(remoteState any) bool {
+	if a.isGone == nil {
+		return false
+	}
+	outs, err := a.isGone.Call(remoteState)
+	if err != nil {
+		return false
+	}
+	return outs[0].(bool)
+}
+
 // prepareCallRequired prepares a call and ensures the method is found.
 func prepareCallRequired(resource any, methodName string) (*calladapt.BoundCaller, error) {
 	caller, err := calladapt.PrepareCall(resource, reflect.TypeFor[IResource](), methodName)
@@ -550,7 +744,7 @@ func validatePointerToStruct(t reflect.Type, context string) error {
 	if t == nil {
 		return fmt.Errorf("%s not set", context)
 	}
-	if t.Kind() != reflect.Ptr {
+	if t.Kind() != reflect.Pointer {
 		return fmt.Errorf("%s must be a pointer, got %s", context, t.Kind())
 	}
 	if t.Elem().Kind() != reflect.Struct {
diff --git a/bundle/direct/dresources/alert.go b/bundle/direct/dresources/alert.go
index 4fa4e410a1e..a18641e810a 100644
--- a/bundle/direct/dresources/alert.go
+++ b/bundle/direct/dresources/alert.go
@@ -59,7 +59,7 @@ func (r *ResourceAlert) DoUpdate(ctx context.Context, id string, config *sql.Ale
 }
 
 // DoDelete deletes the alert by id.
-func (r *ResourceAlert) DoDelete(ctx context.Context, id string) error {
+func (r *ResourceAlert) DoDelete(ctx context.Context, id string, _ *sql.AlertV2) error {
 	return r.client.AlertsV2.TrashAlert(ctx, sql.TrashAlertV2Request{
 		Id:              id,
 		Purge:           true,
diff --git a/bundle/direct/dresources/all.go b/bundle/direct/dresources/all.go
index ddc30c41f54..88f08048235 100644
--- a/bundle/direct/dresources/all.go
+++ b/bundle/direct/dresources/all.go
@@ -7,30 +7,45 @@ import (
 )
 
 var SupportedResources = map[string]any{
-	"jobs":                    (*ResourceJob)(nil),
-	"pipelines":               (*ResourcePipeline)(nil),
-	"experiments":             (*ResourceExperiment)(nil),
-	"catalogs":                (*ResourceCatalog)(nil),
-	"schemas":                 (*ResourceSchema)(nil),
-	"external_locations":      (*ResourceExternalLocation)(nil),
-	"volumes":                 (*ResourceVolume)(nil),
-	"models":                  (*ResourceMlflowModel)(nil),
-	"apps":                    (*ResourceApp)(nil),
-	"sql_warehouses":          (*ResourceSqlWarehouse)(nil),
-	"database_instances":      (*ResourceDatabaseInstance)(nil),
-	"database_catalogs":       (*ResourceDatabaseCatalog)(nil),
-	"synced_database_tables":  (*ResourceSyncedDatabaseTable)(nil),
-	"postgres_projects":       (*ResourcePostgresProject)(nil),
-	"postgres_branches":       (*ResourcePostgresBranch)(nil),
-	"postgres_endpoints":      (*ResourcePostgresEndpoint)(nil),
-	"alerts":                  (*ResourceAlert)(nil),
-	"clusters":                (*ResourceCluster)(nil),
-	"registered_models":       (*ResourceRegisteredModel)(nil),
-	"dashboards":              (*ResourceDashboard)(nil),
-	"secret_scopes":           (*ResourceSecretScope)(nil),
-	"model_serving_endpoints": (*ResourceModelServingEndpoint)(nil),
-	"quality_monitors":        (*ResourceQualityMonitor)(nil),
-	"vector_search_endpoints": (*ResourceVectorSearchEndpoint)(nil),
+	"jobs":                        (*ResourceJob)(nil),
+	"job_runs":                    (*ResourceJobRun)(nil),
+	"pipelines":                   (*ResourcePipeline)(nil),
+	"experiments":                 (*ResourceExperiment)(nil),
+	"features":                    (*ResourceFeature)(nil),
+	"catalogs":                    (*ResourceCatalog)(nil),
+	"schemas":                     (*ResourceSchema)(nil),
+	"external_locations":          (*ResourceExternalLocation)(nil),
+	"volumes":                     (*ResourceVolume)(nil),
+	"models":                      (*ResourceMlflowModel)(nil),
+	"apps":                        (*ResourceApp)(nil),
+	"sql_warehouses":              (*ResourceSqlWarehouse)(nil),
+	"database_instances":          (*ResourceDatabaseInstance)(nil),
+	"database_catalogs":           (*ResourceDatabaseCatalog)(nil),
+	"synced_database_tables":      (*ResourceSyncedDatabaseTable)(nil),
+	"postgres_projects":           (*ResourcePostgresProject)(nil),
+	"postgres_branches":           (*ResourcePostgresBranch)(nil),
+	"postgres_endpoints":          (*ResourcePostgresEndpoint)(nil),
+	"postgres_catalogs":           (*ResourcePostgresCatalog)(nil),
+	"postgres_databases":          (*ResourcePostgresDatabase)(nil),
+	"postgres_roles":              (*ResourcePostgresRole)(nil),
+	"postgres_synced_tables":      (*ResourcePostgresSyncedTable)(nil),
+	"postgres_snapshot_schedules": (*ResourcePostgresSnapshotSchedule)(nil),
+	"alerts":                      (*ResourceAlert)(nil),
+	"clusters":                    (*ResourceCluster)(nil),
+	"registered_models":           (*ResourceRegisteredModel)(nil),
+	"dashboards":                  (*ResourceDashboard)(nil),
+	"genie_spaces":                (*ResourceGenieSpace)(nil),
+	"secret_scopes":               (*ResourceSecretScope)(nil),
+	"model_serving_endpoints":     (*ResourceModelServingEndpoint)(nil),
+	"model_services":              (*ResourceModelService)(nil),
+	"mcp_services":                (*ResourceMcpService)(nil),
+	"model_provider_services":     (*ResourceModelProviderService)(nil),
+	"quality_monitors":            (*ResourceQualityMonitor)(nil),
+	"vector_search_endpoints":     (*ResourceVectorSearchEndpoint)(nil),
+	"vector_search_indexes":       (*ResourceVectorSearchIndex)(nil),
+	"instance_pools":              (*ResourceInstancePool)(nil),
+	"secrets":                     (*ResourceSecret)(nil),
+	"cluster_policies":            (*ResourceClusterPolicy)(nil),
 
 	// Permissions
 	"jobs.permissions":                    (*ResourcePermissions)(nil),
@@ -38,6 +53,7 @@ var SupportedResources = map[string]any{
 	"apps.permissions":                    (*ResourcePermissions)(nil),
 	"alerts.permissions":                  (*ResourcePermissions)(nil),
 	"clusters.permissions":                (*ResourcePermissions)(nil),
+	"cluster_policies.permissions":        (*ResourcePermissions)(nil),
 	"database_instances.permissions":      (*ResourcePermissions)(nil),
 	"postgres_projects.permissions":       (*ResourcePermissions)(nil),
 	"experiments.permissions":             (*ResourcePermissions)(nil),
@@ -46,14 +62,24 @@ var SupportedResources = map[string]any{
 	"secret_scopes.permissions":           (*ResourceSecretScopeAcls)(nil),
 	"model_serving_endpoints.permissions": (*ResourcePermissions)(nil),
 	"dashboards.permissions":              (*ResourcePermissions)(nil),
+	"genie_spaces.permissions":            (*ResourcePermissions)(nil),
 	"vector_search_endpoints.permissions": (*ResourcePermissions)(nil),
+	"instance_pools.permissions":          (*ResourcePermissions)(nil),
 
 	// Grants
-	"catalogs.grants":           (*ResourceGrants)(nil),
-	"schemas.grants":            (*ResourceGrants)(nil),
-	"external_locations.grants": (*ResourceGrants)(nil),
-	"volumes.grants":            (*ResourceGrants)(nil),
-	"registered_models.grants":  (*ResourceGrants)(nil),
+	"catalogs.grants":                (*ResourceGrants)(nil),
+	"schemas.grants":                 (*ResourceGrants)(nil),
+	"external_locations.grants":      (*ResourceGrants)(nil),
+	"volumes.grants":                 (*ResourceGrants)(nil),
+	"registered_models.grants":       (*ResourceGrants)(nil),
+	"vector_search_indexes.grants":   (*ResourceGrants)(nil),
+	"secrets.grants":                 (*ResourceGrants)(nil),
+	"model_services.grants":          (*ResourceGrants)(nil),
+	"mcp_services.grants":            (*ResourceGrants)(nil),
+	"model_provider_services.grants": (*ResourceGrants)(nil),
+
+	// Internal resources
+	"internal_immutable_snapshots": (*ResourceSnapshot)(nil),
 }
 
 func InitAll(client *databricks.WorkspaceClient) (map[string]*Adapter, error) {
diff --git a/bundle/direct/dresources/all_test.go b/bundle/direct/dresources/all_test.go
index 9f0dc07e90b..1b0da0602a2 100644
--- a/bundle/direct/dresources/all_test.go
+++ b/bundle/direct/dresources/all_test.go
@@ -4,6 +4,8 @@ import (
 	"context"
 	"encoding/json"
 	"math"
+	"os"
+	"path/filepath"
 	"reflect"
 	"strconv"
 	"strings"
@@ -11,12 +13,14 @@ import (
 
 	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/cli/bundle/deployplan"
+	"github.com/databricks/cli/libs/snapshot"
 	"github.com/databricks/cli/libs/structs/structaccess"
 	"github.com/databricks/cli/libs/structs/structdiff"
 	"github.com/databricks/cli/libs/structs/structpath"
 	"github.com/databricks/cli/libs/structs/structwalk"
 	"github.com/databricks/cli/libs/testserver"
 	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/apierr"
 	"github.com/databricks/databricks-sdk-go/service/apps"
 	"github.com/databricks/databricks-sdk-go/service/catalog"
 	"github.com/databricks/databricks-sdk-go/service/dashboards"
@@ -35,92 +39,120 @@ import (
 
 var testConfig map[string]any = map[string]any{
 	"apps": &resources.App{
-		App: apps.App{
-			Name: "myapp",
-		},
+		Name: "myapp",
 	},
 
 	"catalogs": &resources.Catalog{
-		CreateCatalog: catalog.CreateCatalog{
-			Name:    "mycatalog",
-			Comment: "Test catalog",
-		},
+		Name:    "mycatalog",
+		Comment: "Test catalog",
 		// Note: EnablePredictiveOptimization and IsolationMode cannot be set during creation,
 		// only during updates. They are not included in the test config.
 	},
 
 	"external_locations": &resources.ExternalLocation{
-		CreateExternalLocation: catalog.CreateExternalLocation{
-			Name:           "myexternallocation",
-			Url:            "s3://mybucket/mypath",
-			CredentialName: "mycredential",
-			Comment:        "Test external location",
-		},
+		Name:           "myexternallocation",
+		Url:            "s3://mybucket/mypath",
+		CredentialName: "mycredential",
+		Comment:        "Test external location",
 	},
 
 	"schemas": &resources.Schema{
-		CreateSchema: catalog.CreateSchema{
-			CatalogName: "main",
-			Name:        "myschema",
-		},
+		CatalogName: "main",
+		Name:        "myschema",
+		Comment:     "Test schema",
 	},
 
 	"volumes": &resources.Volume{
-		CreateVolumeRequestContent: catalog.CreateVolumeRequestContent{
-			CatalogName: "main",
-			SchemaName:  "myschema",
-			Name:        "myvolume",
-		},
+		CatalogName: "main",
+		SchemaName:  "myschema",
+		Name:        "myvolume",
+		Comment:     "Test volume",
 	},
 
 	"database_instances": &resources.DatabaseInstance{
-		DatabaseInstance: database.DatabaseInstance{
-			Name: "mydbinstance",
-		},
+		Name: "mydbinstance",
+	},
+
+	"instance_pools": &resources.InstancePool{
+		InstancePoolName: "my-instance-pool",
+		NodeTypeId:       "i3.xlarge",
 	},
 
 	"synced_database_tables": &resources.SyncedDatabaseTable{
-		SyncedDatabaseTable: database.SyncedDatabaseTable{
-			Name: "main.myschema.my_synced_table",
-		},
+		Name: "main.myschema.my_synced_table",
+	},
+
+	"model_services": &resources.ModelService{
+		Parent:         "schemas/main.default",
+		ModelServiceId: "my_model_service",
+		Comment:        "Test model service",
+	},
+
+	"mcp_services": &resources.McpService{
+		Parent:       "schemas/main.default",
+		McpServiceId: "my_mcp_service",
+		Comment:      "Test mcp service",
+	},
+
+	"model_provider_services": &resources.ModelProviderService{
+		Parent:                 "schemas/main.default",
+		ModelProviderServiceId: "my_model_provider_service",
+		Comment:                "Test model provider service",
 	},
 
 	"registered_models": &resources.RegisteredModel{
-		CreateRegisteredModelRequest: catalog.CreateRegisteredModelRequest{
-			Name:            "my_registered_model",
-			Comment:         "Test registered model",
-			CatalogName:     "main",
-			SchemaName:      "default",
-			StorageLocation: "s3://my-bucket/my-path",
+		Name:            "my_registered_model",
+		Comment:         "Test registered model",
+		CatalogName:     "main",
+		SchemaName:      "default",
+		StorageLocation: "s3://my-bucket/my-path",
+	},
+
+	"features": &resources.Feature{
+		FullName:    "main.default.my_feature",
+		Description: "Test feature",
+		Source: ml.DataSource{
+			DeltaTableSource: &ml.DeltaTableSource{
+				FullName: "main.default.my_source",
+			},
 		},
+		Function: ml.Function{
+			ColumnSelection: &ml.ColumnSelection{Column: "amount"},
+		},
+		Entities:         []ml.EntityColumn{{Name: "id"}},
+		TimeseriesColumn: &ml.TimeseriesColumn{Name: "ts"},
 	},
 
 	"experiments": &resources.MlflowExperiment{
-		CreateExperiment: ml.CreateExperiment{
-			Name: "my-experiment",
-			Tags: []ml.ExperimentTag{
-				{
-					Key:   "my-tag",
-					Value: "my-value",
-				},
+		Name: "my-experiment",
+		Tags: []ml.ExperimentTag{
+			{
+				Key:   "my-tag",
+				Value: "my-value",
 			},
-			ArtifactLocation: "s3://my-bucket/my-experiment",
 		},
+		ArtifactLocation: "s3://my-bucket/my-experiment",
 	},
 
 	"models": &resources.MlflowModel{
-		CreateModelRequest: ml.CreateModelRequest{
-			Name:        "my_mlflow_model",
-			Description: "my_mlflow_model_description",
-			Tags: []ml.ModelTag{
-				{
-					Key:   "k1",
-					Value: "v1",
-				},
+		Name:        "my_mlflow_model",
+		Description: "my_mlflow_model_description",
+		Tags: []ml.ModelTag{
+			{
+				Key:   "k1",
+				Value: "v1",
 			},
 		},
 	},
 
+	"secrets": &resources.Secret{
+		CatalogName: "main",
+		SchemaName:  "default",
+		Name:        "my_secret",
+		Value:       "my_secret_value",
+		Comment:     "Test secret",
+	},
+
 	"secret_scopes": &resources.SecretScope{
 		Name:        "my_secret_scope",
 		BackendType: workspace.ScopeBackendTypeAzureKeyvault,
@@ -137,43 +169,42 @@ var testConfig map[string]any = map[string]any{
 	},
 
 	"model_serving_endpoints": &resources.ModelServingEndpoint{
-		CreateServingEndpoint: serving.CreateServingEndpoint{
+		Name: "my-endpoint",
+		Config: &serving.EndpointCoreConfigInput{
 			Name: "my-endpoint",
-			Config: &serving.EndpointCoreConfigInput{
-				Name: "my-endpoint",
-				AutoCaptureConfig: &serving.AutoCaptureConfigInput{
-					CatalogName:     "main",
-					SchemaName:      "myschema",
-					TableNamePrefix: "my_table",
-					Enabled:         true,
-					ForceSendFields: nil,
+			//nolint:staticcheck // SA1019: deprecated AutoCaptureConfigInput kept for bundle config compatibility
+			AutoCaptureConfig: &serving.AutoCaptureConfigInput{
+				CatalogName:     "main",
+				SchemaName:      "myschema",
+				TableNamePrefix: "my_table",
+				Enabled:         true,
+				ForceSendFields: nil,
+			},
+			ServedModels: nil,
+			ServedEntities: []serving.ServedEntityInput{
+				{
+					EntityName:                "entity-name",
+					EntityVersion:             "1",
+					WorkloadSize:              "Small",
+					ScaleToZeroEnabled:        true,
+					WorkloadType:              serving.ServingModelWorkloadTypeCpu,
+					EnvironmentVars:           map[string]string{"key": "value"},
+					InstanceProfileArn:        "arn:aws:iam::123456789012:instance-profile/my-instance-profile",
+					MaxProvisionedConcurrency: 10,
+					MaxProvisionedThroughput:  100,
+					MinProvisionedConcurrency: 1,
+					MinProvisionedThroughput:  10,
+					Name:                      "entity-name",
+					ProvisionedModelUnits:     100,
+					ExternalModel:             nil,
+					ForceSendFields:           nil,
 				},
-				ServedModels: nil,
-				ServedEntities: []serving.ServedEntityInput{
+			},
+			TrafficConfig: &serving.TrafficConfig{
+				Routes: []serving.Route{
 					{
-						EntityName:                "entity-name",
-						EntityVersion:             "1",
-						WorkloadSize:              "Small",
-						ScaleToZeroEnabled:        true,
-						WorkloadType:              serving.ServingModelWorkloadTypeCpu,
-						EnvironmentVars:           map[string]string{"key": "value"},
-						InstanceProfileArn:        "arn:aws:iam::123456789012:instance-profile/my-instance-profile",
-						MaxProvisionedConcurrency: 10,
-						MaxProvisionedThroughput:  100,
-						MinProvisionedConcurrency: 1,
-						MinProvisionedThroughput:  10,
-						Name:                      "entity-name",
-						ProvisionedModelUnits:     100,
-						ExternalModel:             nil,
-						ForceSendFields:           nil,
-					},
-				},
-				TrafficConfig: &serving.TrafficConfig{
-					Routes: []serving.Route{
-						{
-							ServedModelName:   "model-name-1",
-							TrafficPercentage: 100,
-						},
+						ServedModelName:   "model-name-1",
+						TrafficPercentage: 100,
 					},
 				},
 			},
@@ -181,71 +212,87 @@ var testConfig map[string]any = map[string]any{
 	},
 
 	"postgres_projects": &resources.PostgresProject{
-		PostgresProjectConfig: resources.PostgresProjectConfig{
-			ProjectId: "test-project",
-			ProjectSpec: postgres.ProjectSpec{
-				DisplayName: "Test Project",
-				PgVersion:   16,
-			},
-		},
+		ProjectId:   "test-project",
+		DisplayName: "Test Project",
+		PgVersion:   16,
+	},
+
+	"postgres_catalogs": &resources.PostgresCatalog{
+		CatalogId: "test_catalog",
+	},
+
+	"postgres_synced_tables": &resources.PostgresSyncedTable{
+		SyncedTableId: "main.public.trips_synced",
 	},
 
 	"alerts": &resources.Alert{
-		AlertV2: sql.AlertV2{
-			DisplayName: "my-alert",
-			QueryText:   "SELECT 1",
-			WarehouseId: "test-warehouse-id",
-			Schedule: sql.CronSchedule{
-				QuartzCronSchedule: "0 0 12 * * ?",
-				TimezoneId:         "UTC",
+		DisplayName: "my-alert",
+		QueryText:   "SELECT 1",
+		WarehouseId: "test-warehouse-id",
+		Schedule: sql.CronSchedule{
+			QuartzCronSchedule: "0 0 12 * * ?",
+			TimezoneId:         "UTC",
+		},
+		Evaluation: sql.AlertV2Evaluation{
+			ComparisonOperator: sql.ComparisonOperatorGreaterThan,
+			Source: sql.AlertV2OperandColumn{
+				Name: "column1",
 			},
-			Evaluation: sql.AlertV2Evaluation{
-				ComparisonOperator: sql.ComparisonOperatorGreaterThan,
-				Source: sql.AlertV2OperandColumn{
-					Name: "column1",
-				},
-				Threshold: &sql.AlertV2Operand{
-					Column: &sql.AlertV2OperandColumn{
-						Name: "column2",
-					},
+			Threshold: &sql.AlertV2Operand{
+				Column: &sql.AlertV2OperandColumn{
+					Name: "column2",
 				},
 			},
 		},
 	},
 
 	"quality_monitors": &resources.QualityMonitor{
-		TableName: "main.myschema.mytable",
-		CreateMonitor: catalog.CreateMonitor{
-			AssetsDir:        "/Workspace/Users/user@example.com/assets",
-			OutputSchemaName: "main.myschema",
-		},
+		TableName:        "main.myschema.mytable",
+		AssetsDir:        "/Workspace/Users/user@example.com/assets",
+		OutputSchemaName: "main.myschema",
 	},
 
 	"dashboards": &resources.Dashboard{
-		DashboardConfig: resources.DashboardConfig{
-			DisplayName: "my-dashboard",
-			ParentPath:  "/Workspace/Users/user@example.com",
-			WarehouseId: "test-warehouse-id",
-			SerializedDashboard: map[string]any{
-				"pages": []map[string]any{
-					{
-						"name":        "page1",
-						"displayName": "Page 1",
-						"pageType":    "PAGE_TYPE_CANVAS",
-					},
-				},
-			},
+		DisplayName:         "my-dashboard",
+		ParentPath:          "/Workspace/Users/user@example.com",
+		WarehouseId:         "test-warehouse-id",
+		SerializedDashboard: `{"pages":[{"name":"page1","displayName":"Page 1","pageType":"PAGE_TYPE_CANVAS"}]}`,
 
-			DatasetCatalog: "main",
-			DatasetSchema:  "myschema",
-		},
+		DatasetCatalog: "main",
+		DatasetSchema:  "myschema",
+	},
+
+	"genie_spaces": &resources.GenieSpace{
+		Title:           "my-genie-space",
+		WarehouseId:     "test-warehouse-id",
+		ParentPath:      "/Workspace/Users/user@example.com",
+		SerializedSpace: "{}",
 	},
 
 	"vector_search_endpoints": &resources.VectorSearchEndpoint{
-		CreateEndpoint: vectorsearch.CreateEndpoint{
-			Name:         "my-endpoint",
-			EndpointType: vectorsearch.EndpointTypeStandard,
+		Name:         "my-endpoint",
+		EndpointType: vectorsearch.EndpointTypeStandard,
+	},
+
+	"vector_search_indexes": &resources.VectorSearchIndex{
+		Name:         "main.default.my_index",
+		EndpointName: "my-index-endpoint",
+		PrimaryKey:   "id",
+		IndexType:    vectorsearch.VectorIndexTypeDeltaSync,
+		DeltaSyncIndexSpec: &vectorsearch.DeltaSyncVectorIndexSpecRequest{
+			SourceTable:  "main.default.source_table",
+			PipelineType: vectorsearch.PipelineTypeTriggered,
 		},
+		Grants: []catalog.PrivilegeAssignment{{
+			Principal:  "user@example.com",
+			Privileges: []catalog.Privilege{catalog.PrivilegeSelect},
+		}},
+	},
+
+	"internal_immutable_snapshots": &resources.Snapshot{
+		RemoteRoot: "/Workspace/Users/" + testserver.TestUserSP.UserName + "/.snapshots",
+		BundleID:   "test-bundle-id",
+		ACL:        []snapshot.ACLEntry{{UserName: "user@example.com", PermissionLevel: "CAN_READ"}},
 	},
 }
 
@@ -261,13 +308,45 @@ var testDeps = map[string]prepareWorkspace{
 		})
 
 		return &resources.DatabaseCatalog{
-			DatabaseCatalog: database.DatabaseCatalog{
-				Name:                 "mydbcatalog",
-				DatabaseInstanceName: "mydbinstance1",
-			},
+			Name:                 "mydbcatalog",
+			DatabaseInstanceName: "mydbinstance1",
 		}, err
 	},
 
+	"vector_search_indexes": func(ctx context.Context, client *databricks.WorkspaceClient) (any, error) {
+		_, err := client.VectorSearchEndpoints.CreateEndpoint(ctx, vectorsearch.CreateEndpoint{
+			Name:         "my-index-endpoint",
+			EndpointType: vectorsearch.EndpointTypeStandard,
+		})
+		if err != nil {
+			return nil, err
+		}
+
+		return testConfig["vector_search_indexes"], nil
+	},
+
+	"job_runs": func(ctx context.Context, client *databricks.WorkspaceClient) (any, error) {
+		// A run can only be triggered against an existing job, so create one first.
+		resp, err := client.Jobs.Create(ctx, jobs.CreateJob{
+			Name: "job-for-run",
+			Tasks: []jobs.Task{
+				{
+					TaskKey: "t",
+					NotebookTask: &jobs.NotebookTask{
+						NotebookPath: "/Workspace/Users/user@example.com/notebook",
+					},
+				},
+			},
+		})
+		if err != nil {
+			return nil, err
+		}
+
+		return &resources.JobRun{
+			JobId: resp.JobId,
+		}, nil
+	},
+
 	"jobs.permissions": func(ctx context.Context, client *databricks.WorkspaceClient) (any, error) {
 		resp, err := client.Jobs.Create(ctx, jobs.CreateJob{
 			Name: "job-permissions",
@@ -304,7 +383,8 @@ var testDeps = map[string]prepareWorkspace{
 		return &PermissionsState{
 			ObjectID: "/pipelines/" + resp.PipelineId,
 			EmbeddedSlice: []StatePermission{{
-				Level:    "CAN_MANAGE",
+				// Pipelines require exactly one owner, like jobs.
+				Level:    "IS_OWNER",
 				UserName: "user@example.com",
 			}},
 		}, nil
@@ -355,6 +435,26 @@ var testDeps = map[string]prepareWorkspace{
 		}, nil
 	},
 
+	"cluster_policies.permissions": func(ctx context.Context, client *databricks.WorkspaceClient) (any, error) {
+		return &PermissionsState{
+			ObjectID: "/cluster-policies/cluster-policy-permissions",
+			EmbeddedSlice: []StatePermission{{
+				Level:    "CAN_USE",
+				UserName: "user@example.com",
+			}},
+		}, nil
+	},
+
+	"instance_pools.permissions": func(ctx context.Context, client *databricks.WorkspaceClient) (any, error) {
+		return &PermissionsState{
+			ObjectID: "/instance-pools/pool-permissions",
+			EmbeddedSlice: []StatePermission{{
+				Level:    "CAN_MANAGE",
+				UserName: "user@example.com",
+			}},
+		}, nil
+	},
+
 	"apps.permissions": func(ctx context.Context, client *databricks.WorkspaceClient) (any, error) {
 		waiter, err := client.Apps.Create(ctx, apps.CreateAppRequest{
 			App: apps.App{
@@ -404,20 +504,19 @@ var testDeps = map[string]prepareWorkspace{
 	},
 
 	"postgres_projects.permissions": func(ctx context.Context, client *databricks.WorkspaceClient) (any, error) {
+		const projectID = "permissions-project"
 		waiter, err := client.Postgres.CreateProject(ctx, postgres.CreateProjectRequest{
-			ProjectId: "permissions-project",
+			ProjectId: projectID,
 		})
 		if err != nil {
 			return nil, err
 		}
-		result, err := waiter.Wait(ctx)
-		if err != nil {
+		if _, err := waiter.Wait(ctx); err != nil {
 			return nil, err
 		}
 
-		components, _ := ParsePostgresName(result.Name)
 		return &PermissionsState{
-			ObjectID: "/database-projects/" + components.ProjectID,
+			ObjectID: "/database-projects/" + projectID,
 			EmbeddedSlice: []StatePermission{{
 				Level:    "CAN_MANAGE",
 				UserName: "user@example.com",
@@ -429,7 +528,7 @@ var testDeps = map[string]prepareWorkspace{
 		parentPath := "/Workspace/Users/user@example.com"
 
 		// Create parent directory if it doesn't exist
-		err := client.Workspace.MkdirsByPath(ctx, parentPath) //nolint:staticcheck // Deprecated in SDK v0.127.0. Migration to WorkspaceHierarchyService tracked separately.
+		err := client.Workspace.MkdirsByPath(ctx, parentPath)
 		if err != nil {
 			return nil, err
 		}
@@ -454,6 +553,25 @@ var testDeps = map[string]prepareWorkspace{
 		}, nil
 	},
 
+	"genie_spaces.permissions": func(ctx context.Context, client *databricks.WorkspaceClient) (any, error) {
+		resp, err := client.Genie.CreateSpace(ctx, dashboards.GenieCreateSpaceRequest{
+			Title:           "genie-space-permissions",
+			WarehouseId:     "test-warehouse-id",
+			SerializedSpace: "{}",
+		})
+		if err != nil {
+			return nil, err
+		}
+
+		return &PermissionsState{
+			ObjectID: "/genie/" + resp.SpaceId,
+			EmbeddedSlice: []StatePermission{{
+				Level:    "CAN_MANAGE",
+				UserName: "user@example.com",
+			}},
+		}, nil
+	},
+
 	"model_serving_endpoints.permissions": func(ctx context.Context, client *databricks.WorkspaceClient) (any, error) {
 		waiter, err := client.ServingEndpoints.Create(ctx, serving.CreateServingEndpoint{
 			Name: "endpoint-permissions",
@@ -585,6 +703,61 @@ var testDeps = map[string]prepareWorkspace{
 		}, nil
 	},
 
+	"vector_search_indexes.grants": func(ctx context.Context, client *databricks.WorkspaceClient) (any, error) {
+		return &GrantsState{
+			SecurableType: "table",
+			FullName:      "main.default.my_index",
+			EmbeddedSlice: []catalog.PrivilegeAssignment{{
+				Privileges: []catalog.Privilege{catalog.PrivilegeSelect},
+				Principal:  "user@example.com",
+			}},
+		}, nil
+	},
+
+	"secrets.grants": func(ctx context.Context, client *databricks.WorkspaceClient) (any, error) {
+		return &GrantsState{
+			SecurableType: "secret",
+			FullName:      "main.default.my_secret",
+			EmbeddedSlice: []catalog.PrivilegeAssignment{{
+				Privileges: []catalog.Privilege{catalog.PrivilegeSelect},
+				Principal:  "user@example.com",
+			}},
+		}, nil
+	},
+
+	"model_services.grants": func(ctx context.Context, client *databricks.WorkspaceClient) (any, error) {
+		return &GrantsState{
+			SecurableType: "model_service",
+			FullName:      "main.myschema.mymodelservice",
+			EmbeddedSlice: []catalog.PrivilegeAssignment{{
+				Privileges: []catalog.Privilege{catalog.PrivilegeApplyTag},
+				Principal:  "user@example.com",
+			}},
+		}, nil
+	},
+
+	"mcp_services.grants": func(ctx context.Context, client *databricks.WorkspaceClient) (any, error) {
+		return &GrantsState{
+			SecurableType: "mcp_service",
+			FullName:      "main.myschema.mymcpservice",
+			EmbeddedSlice: []catalog.PrivilegeAssignment{{
+				Privileges: []catalog.Privilege{catalog.PrivilegeApplyTag},
+				Principal:  "user@example.com",
+			}},
+		}, nil
+	},
+
+	"model_provider_services.grants": func(ctx context.Context, client *databricks.WorkspaceClient) (any, error) {
+		return &GrantsState{
+			SecurableType: "model_provider_service",
+			FullName:      "main.myschema.myproviderservice",
+			EmbeddedSlice: []catalog.PrivilegeAssignment{{
+				Privileges: []catalog.Privilege{catalog.PrivilegeApplyTag},
+				Principal:  "user@example.com",
+			}},
+		}, nil
+	},
+
 	"secret_scopes.permissions": func(ctx context.Context, client *databricks.WorkspaceClient) (any, error) {
 		err := client.Secrets.CreateScope(ctx, workspace.CreateScope{
 			Scope:            "permissions_test_scope",
@@ -625,11 +798,30 @@ var testDeps = map[string]prepareWorkspace{
 		}
 
 		return &resources.PostgresBranch{
-			PostgresBranchConfig: resources.PostgresBranchConfig{
-				Parent:     "projects/test-project-for-branch",
-				BranchId:   "test-branch",
-				BranchSpec: postgres.BranchSpec{},
+			Parent:     "projects/test-project-for-branch",
+			BranchId:   "test-branch",
+			BranchSpec: postgres.BranchSpec{},
+		}, nil
+	},
+
+	"postgres_snapshot_schedules": func(ctx context.Context, client *databricks.WorkspaceClient) (any, error) {
+		// Creating the project implicitly provisions the root "production"
+		// branch, the only branch a snapshot schedule may target.
+		_, err := client.Postgres.CreateProject(ctx, postgres.CreateProjectRequest{
+			ProjectId: "test-project-for-snapshot-schedule",
+			Project: postgres.Project{
+				Spec: &postgres.ProjectSpec{
+					DisplayName: "Test Project for Snapshot Schedule",
+					PgVersion:   16,
+				},
 			},
+		})
+		if err != nil {
+			return nil, err
+		}
+
+		return &resources.PostgresSnapshotSchedule{
+			Branch: "projects/test-project-for-snapshot-schedule/branches/production",
 		}, nil
 	},
 
@@ -659,13 +851,74 @@ var testDeps = map[string]prepareWorkspace{
 		}
 
 		return &resources.PostgresEndpoint{
-			PostgresEndpointConfig: resources.PostgresEndpointConfig{
-				Parent:     "projects/test-project-for-endpoint/branches/test-branch-for-endpoint",
-				EndpointId: "test-endpoint",
-				EndpointSpec: postgres.EndpointSpec{
-					EndpointType: postgres.EndpointTypeEndpointTypeReadWrite,
+			Parent:       "projects/test-project-for-endpoint/branches/test-branch-for-endpoint",
+			EndpointId:   "test-endpoint",
+			EndpointType: postgres.EndpointTypeEndpointTypeReadWrite,
+		}, nil
+	},
+
+	"postgres_databases": func(ctx context.Context, client *databricks.WorkspaceClient) (any, error) {
+		// Create parent project first
+		_, err := client.Postgres.CreateProject(ctx, postgres.CreateProjectRequest{
+			ProjectId: "test-project-for-database",
+			Project: postgres.Project{
+				Spec: &postgres.ProjectSpec{
+					DisplayName: "Test Project for Database",
+					PgVersion:   16,
+				},
+			},
+		})
+		if err != nil {
+			return nil, err
+		}
+
+		// Create parent branch
+		_, err = client.Postgres.CreateBranch(ctx, postgres.CreateBranchRequest{
+			Parent:   "projects/test-project-for-database",
+			BranchId: "test-branch-for-database",
+			Branch:   postgres.Branch{},
+		})
+		if err != nil {
+			return nil, err
+		}
+
+		return &resources.PostgresDatabase{
+			Parent:           "projects/test-project-for-database/branches/test-branch-for-database",
+			DatabaseId:       "test-database",
+			PostgresDatabase: "app_db",
+			Role:             "projects/test-project-for-database/branches/test-branch-for-database/roles/owner",
+		}, nil
+	},
+
+	"postgres_roles": func(ctx context.Context, client *databricks.WorkspaceClient) (any, error) {
+		// Create parent project first
+		_, err := client.Postgres.CreateProject(ctx, postgres.CreateProjectRequest{
+			ProjectId: "test-project-for-role",
+			Project: postgres.Project{
+				Spec: &postgres.ProjectSpec{
+					DisplayName: "Test Project for Role",
+					PgVersion:   16,
 				},
 			},
+		})
+		if err != nil {
+			return nil, err
+		}
+
+		// Create parent branch
+		_, err = client.Postgres.CreateBranch(ctx, postgres.CreateBranchRequest{
+			Parent:   "projects/test-project-for-role",
+			BranchId: "test-branch-for-role",
+			Branch:   postgres.Branch{},
+		})
+		if err != nil {
+			return nil, err
+		}
+
+		return &resources.PostgresRole{
+			Parent:       "projects/test-project-for-role/branches/test-branch-for-role",
+			RoleId:       "test-role",
+			PostgresRole: "test_role",
 		}, nil
 	},
 }
@@ -691,9 +944,13 @@ func TestAll(t *testing.T) {
 // testIgnoreFilter encapsulates the logic for filtering fields based on ignore_remote_changes config.
 type testIgnoreFilter struct {
 	ignoreFields map[string]bool
+	adapter      *Adapter
 }
 
 // newTestIgnoreFilter creates a filter from the adapter's resource configs.
+// It also ignores fields that exist in StateType but not in RemoteType, because
+// those are automatically suppressed by the planner (reason: missing_in_remote)
+// and RemapState cannot populate them from remote state.
 func newTestIgnoreFilter(adapter *Adapter) *testIgnoreFilter {
 	ignoreFields := make(map[string]bool)
 	for _, cfg := range []*ResourceLifecycleConfig{adapter.ResourceConfig(), adapter.GeneratedResourceConfig()} {
@@ -704,7 +961,18 @@ func newTestIgnoreFilter(adapter *Adapter) *testIgnoreFilter {
 			ignoreFields[p.Field.String()] = true
 		}
 	}
-	return &testIgnoreFilter{ignoreFields: ignoreFields}
+	// Auto-include fields present in StateType but absent from RemoteType.
+	_ = structwalk.WalkType(adapter.StateType(), func(path *structpath.PatternNode, typ reflect.Type, field *reflect.StructField) bool {
+		if path.IsRoot() {
+			return true
+		}
+		if structaccess.ValidatePattern(adapter.RemoteType(), path) != nil {
+			ignoreFields[path.String()] = true
+			return false
+		}
+		return true
+	})
+	return &testIgnoreFilter{ignoreFields: ignoreFields, adapter: adapter}
 }
 
 // shouldIgnore returns true if the field at the given path should be ignored.
@@ -717,6 +985,12 @@ func (f *testIgnoreFilter) shouldIgnore(path string) bool {
 	if prefix, _, ok := strings.Cut(path, "."); ok {
 		topLevelField = prefix
 	}
+
+	parts := strings.Split(topLevelField, "[")
+	if len(parts) > 1 {
+		topLevelField = parts[0]
+	}
+
 	return f.ignoreFields[topLevelField]
 }
 
@@ -767,6 +1041,22 @@ func testCRUD(t *testing.T, group string, adapter *Adapter, client *databricks.W
 	newState, err := adapter.PrepareState(inputConfig)
 	require.NoError(t, err, "PrepareState failed")
 
+	// The snapshot is content-addressed: DoCreate reads a zip from disk and the server
+	// returns a path derived from that zip's hash. The generic fixture has no ZipPath, so
+	// stage a real zip and align RelativePath/FullPath with its hash; otherwise the
+	// create→read round-trip compares a fixture path against a hash-derived remote path
+	// and fails. This is inherent to content-addressed resources, not a missing hook.
+	if ss, ok := newState.(*SnapshotState); ok {
+		snap := inputConfig.(*resources.Snapshot)
+		content := []byte("test snapshot content")
+		hash := snapshot.HashFromContent(content)
+		zipPath := filepath.Join(t.TempDir(), hash+".zip")
+		require.NoError(t, os.WriteFile(zipPath, content, 0o600))
+		ss.ZipPath = filepath.ToSlash(zipPath)
+		ss.RelativePath = ss.BundleID + "/" + hash
+		ss.FullPath = snap.RemoteRoot + "/" + ss.RelativePath
+	}
+
 	ctx := t.Context()
 
 	// initial DoRead() cannot find the resource
@@ -783,6 +1073,10 @@ func testCRUD(t *testing.T, group string, adapter *Adapter, client *databricks.W
 	require.NoError(t, err)
 	require.NotNil(t, remote)
 
+	// RemoteType is included verbatim in the JSON plan's "remote_state" field,
+	// so it must survive a JSON round-trip without losing fields.
+	assertJSONRoundTrip(t, reflect.ValueOf(remote).Elem().Interface(), "RemoteType "+group)
+
 	remappedState, err := adapter.RemapState(remote)
 	require.NoError(t, err)
 	require.NotNil(t, remappedState)
@@ -797,10 +1091,17 @@ func testCRUD(t *testing.T, group string, adapter *Adapter, client *databricks.W
 			"unexpected differences between remappedState and remappedRemoteStateFromCreate")
 	}
 
-	remoteStateFromWaitCreate, err := adapter.WaitAfterCreate(ctx, newState)
+	remoteStateFromWaitCreate, err := adapter.WaitAfterCreate(ctx, createdID, newState)
 	require.NoError(t, err)
 	if remoteStateFromWaitCreate != nil {
+		// Re-read after the wait: the earlier remote can be stale for resources
+		// whose state settles while WaitAfterCreate blocks (e.g. job_runs).
+		remote, err = adapter.DoRead(ctx, createdID)
+		require.NoError(t, err)
 		require.Equal(t, remote, remoteStateFromWaitCreate)
+
+		remappedState, err = adapter.RemapState(remote)
+		require.NoError(t, err)
 	}
 
 	if adapter.HasDoUpdate() {
@@ -809,11 +1110,21 @@ func testCRUD(t *testing.T, group string, adapter *Adapter, client *databricks.W
 		if remoteStateFromUpdate != nil {
 			remappedStateFromUpdate, err := adapter.RemapState(remoteStateFromUpdate)
 			require.NoError(t, err)
-			ignoreFilter.requireEqual(t, remappedState, remappedStateFromUpdate,
+			// Compare DoUpdate's result against a fresh DoRead: server-generated
+			// fields (e.g. etag) may change on any write, so DoUpdate's return
+			// value must match what DoRead returns right after.
+			remotePostUpdate, err := adapter.DoRead(ctx, createdID)
+			require.NoError(t, err)
+			remappedPostUpdate, err := adapter.RemapState(remotePostUpdate)
+			require.NoError(t, err)
+			ignoreFilter.requireEqual(t, remappedPostUpdate, remappedStateFromUpdate,
 				"unexpected differences between remappedState and remappedStateFromUpdate")
+			// DoUpdate may mutate newState in place (e.g. etag), so update remappedState
+			// to match the post-update server state for the field checks below.
+			remappedState = remappedStateFromUpdate
 		}
 
-		remoteStateFromWaitUpdate, err := adapter.WaitAfterUpdate(ctx, newState)
+		remoteStateFromWaitUpdate, err := adapter.WaitAfterUpdate(ctx, createdID, newState)
 		require.NoError(t, err)
 		if remoteStateFromWaitUpdate != nil {
 			remappedStateFromWaitUpdate, err := adapter.RemapState(remoteStateFromWaitUpdate)
@@ -824,6 +1135,10 @@ func testCRUD(t *testing.T, group string, adapter *Adapter, client *databricks.W
 	}
 
 	require.NoError(t, structwalk.Walk(newState, func(path *structpath.PathNode, val any, field *reflect.StructField) {
+		// Skip fields configured in ignore_remote_changes.
+		if ignoreFilter.shouldIgnore(path.String()) {
+			return
+		}
 		remoteValue, err := structaccess.Get(remappedState, path)
 		if err != nil {
 			t.Errorf("Failed to read %s from remapped remote state %#v", path.String(), remappedState)
@@ -838,19 +1153,22 @@ func testCRUD(t *testing.T, group string, adapter *Adapter, client *databricks.W
 			// testserver can set field to backend-generated value
 			return
 		}
-		// Skip fields configured in ignore_remote_changes.
-		if ignoreFilter.shouldIgnore(path.String()) {
-			return
-		}
 		// t.Logf("Testing %s v=%#v, remoteValue=%#v", path.String(), val, remoteValue)
 		// We expect fields set explicitly to be preserved by testserver, which is true for all resources as of today.
 		// If not true for your resource, add exception here:
 		assert.Equal(t, val, remoteValue, "path=%q\nnewState=%s\nremappedState=%s", path.String(), jsonDump(newState), jsonDump(remappedState))
 	}))
 
-	err = adapter.DoDelete(ctx, createdID)
+	err = adapter.DoDelete(ctx, createdID, newState)
 	require.NoError(t, err)
 
+	// WaitAfterDelete polls until the resource reads back gone; a NotFound is that
+	// success and the caller (DeploymentUnit.waitDeleted) maps it to nil, so accept it here too.
+	err = adapter.WaitAfterDelete(ctx, createdID)
+	if !apierr.IsMissing(err) {
+		require.NoError(t, err)
+	}
+
 	p, err := structpath.ParsePath("name")
 	require.NoError(t, err)
 
@@ -859,12 +1177,38 @@ func testCRUD(t *testing.T, group string, adapter *Adapter, client *databricks.W
 		require.NoError(t, err)
 	}
 
-	deleteIsNoop := strings.HasSuffix(group, "permissions") || strings.HasSuffix(group, "grants")
+	// A resource that implements no DoDelete (permissions, grants, job_runs)
+	// leaves the resource in place, so DoRead still succeeds afterwards.
+	// postgres_snapshot_schedules does implement DoDelete but has no delete
+	// endpoint: it disables the schedule by setting an empty cadence set, and the
+	// schedule remains readable (it is intrinsic to the branch).
+	deleteIsNoop := !adapter.HasDoDelete() || group == "postgres_snapshot_schedules"
+	isImmutable := strings.HasSuffix(group, "internal_immutable_snapshots")
+	// Apps DoDelete is fire-and-forget: the API returns success while the app
+	// sits in DELETING state for up to ~20 minutes before the record is removed.
+	// A GET on the DELETING app returns the app, not 404 -- the testserver
+	// mirrors that in libs/testserver/apps.go. DoRead therefore still succeeds
+	// here; the planner treats this transient state as gone via ResourceApp.IsGone
+	// so delete/destroy stay idempotent (acceptance/bundle/invariant/{delete,destroy}_idempotent).
+	deleteLeavesDeleting := group == "apps"
 
 	remoteAfterDelete, err := adapter.DoRead(ctx, createdID)
-	if deleteIsNoop {
+	switch {
+	case isImmutable:
 		require.NoError(t, err)
-	} else {
+		assert.True(t, adapter.IsGone(remoteAfterDelete))
+	case deleteIsNoop:
+		require.NoError(t, err)
+		// The resource genuinely still exists, so it must not report as gone.
+		assert.False(t, adapter.IsGone(remoteAfterDelete))
+	case deleteLeavesDeleting:
+		require.NoError(t, err)
+		require.NotNil(t, remoteAfterDelete)
+		// IsGone lets the planner short-circuit the second delete on this
+		// transient DELETING state; this is what keeps the delete/destroy
+		// invariant tests idempotent, so assert the contract directly.
+		assert.True(t, adapter.IsGone(remoteAfterDelete))
+	default:
 		require.Error(t, err)
 		require.Nil(t, remoteAfterDelete)
 	}
@@ -883,7 +1227,7 @@ func TestResourceConfig(t *testing.T) {
 		}
 
 		t.Run(resourceType, func(t *testing.T) {
-			validateResourceConfig(t, adapter.StateType(), cfg)
+			validateResourceConfig(t, adapter.StateType(), adapter.RemoteType(), cfg)
 		})
 	}
 }
@@ -901,17 +1245,20 @@ func TestGeneratedResourceConfig(t *testing.T) {
 		}
 
 		t.Run(resourceType, func(t *testing.T) {
-			validateResourceConfig(t, adapter.StateType(), cfg)
+			validateResourceConfig(t, adapter.StateType(), adapter.RemoteType(), cfg)
 		})
 	}
 }
 
-func validateResourceConfig(t *testing.T, stateType reflect.Type, cfg *ResourceLifecycleConfig) {
+func validateResourceConfig(t *testing.T, stateType, remoteType reflect.Type, cfg *ResourceLifecycleConfig) {
 	for _, p := range cfg.RecreateOnChanges {
 		assert.NoError(t, structaccess.ValidatePattern(stateType, p.Field), "RecreateOnChanges: %s", p.Field)
 	}
-	for _, p := range cfg.UpdateIDOnChanges {
-		assert.NoError(t, structaccess.ValidatePattern(stateType, p.Field), "UpdateIDOnChanges: %s", p.Field)
+	for _, p := range cfg.ProvidedIDFields {
+		assert.NoError(t, structaccess.ValidatePattern(stateType, p.Field), "ProvidedIDFields: %s", p.Field)
+	}
+	for _, p := range cfg.UpdatableIDFields {
+		assert.NoError(t, structaccess.ValidatePattern(stateType, p.Field), "UpdatableIDFields: %s", p.Field)
 	}
 	for _, p := range cfg.IgnoreRemoteChanges {
 		assert.NoError(t, structaccess.ValidatePattern(stateType, p.Field), "IgnoreRemoteChanges: %s", p.Field)
@@ -919,6 +1266,159 @@ func validateResourceConfig(t *testing.T, stateType reflect.Type, cfg *ResourceL
 	for _, p := range cfg.BackendDefaults {
 		assert.NoError(t, structaccess.ValidatePattern(stateType, p.Field), "BackendDefaults: %s", p.Field)
 	}
+	// stable_output_fields must be valid paths in RemoteType: the reference
+	// resolver reads their value from the remote cache. The backend owns the
+	// value, but the field may or may not also appear in StateType, so we only
+	// require presence in RemoteType.
+	for _, p := range cfg.StableOutputFields {
+		assert.NoError(t, structaccess.ValidatePattern(remoteType, p.Field), "StableOutputFields %s: must be a valid RemoteType path", p.Field)
+	}
+}
+
+// TestNoUpdateResourcesCoverAllFields ensures that resources which do not
+// implement DoUpdate classify every settable field. Without DoUpdate the
+// planner rejects any "update" action ("resource does not support update
+// action but plan produced update"), so a field a user can change must be
+// declared recreate_on_changes (or ignore_local_changes) to recreate instead.
+// A provided_id_field also recreates on change (classifyIDField), so it counts
+// as covered too. An output-only field is fine under ignore_remote_changes
+// because the user never sets it, so it can never produce a user-driven change.
+//
+// The check walks the state type and fails on any uncovered scalar leaf. This
+// keeps the recreate_on_changes lists exhaustive as the SDK adds fields.
+func TestNoUpdateResourcesCoverAllFields(t *testing.T) {
+	for resourceType, resource := range SupportedResources {
+		adapter, err := NewAdapter(resource, resourceType, nil)
+		require.NoError(t, err)
+		if adapter.HasDoUpdate() {
+			continue
+		}
+		if adapter.HasOverrideChangeDesc() {
+			// OverrideChangeDesc classifies changes programmatically (e.g.
+			// vector_search_indexes handles endpoint_uuid there), which this
+			// static walk can't see into.
+			continue
+		}
+
+		// A user change is only neutralized by recreate_on_changes,
+		// provided_id_fields, or ignore_local_changes; output-only fields are
+		// covered by ignore_remote_changes since the user never sets them. A
+		// root rule (omitted field) records the empty path "", which stops the
+		// walk below at the root node and thus covers every field at once.
+		covered := map[string]bool{}
+		for _, cfg := range []*ResourceLifecycleConfig{adapter.ResourceConfig(), adapter.GeneratedResourceConfig()} {
+			if cfg == nil {
+				continue
+			}
+			for _, r := range cfg.RecreateOnChanges {
+				covered[r.Field.String()] = true
+			}
+			for _, r := range cfg.ProvidedIDFields {
+				covered[r.Field.String()] = true
+			}
+			for _, r := range cfg.IgnoreLocalChanges {
+				covered[r.Field.String()] = true
+			}
+			for _, r := range cfg.IgnoreRemoteChanges {
+				if strings.HasSuffix(r.Reason, "output_only") {
+					covered[r.Field.String()] = true
+				}
+			}
+		}
+
+		t.Run(resourceType, func(t *testing.T) {
+			err := structwalk.WalkType(adapter.StateType(), func(path *structpath.PatternNode, typ reflect.Type, _ *reflect.StructField) bool {
+				if covered[path.String()] {
+					// This field (or its enclosing object) is classified; the
+					// whole subtree is covered, so stop descending.
+					return false
+				}
+				for typ.Kind() == reflect.Pointer {
+					typ = typ.Elem()
+				}
+				switch typ.Kind() {
+				case reflect.Struct, reflect.Slice, reflect.Array, reflect.Map:
+					// Intermediate node: descend and check its children.
+					return true
+				default:
+					t.Errorf("field %q is not classified; a change to it would plan an unsupported update. Add it to recreate_on_changes.", path)
+					return false
+				}
+			})
+			require.NoError(t, err)
+		})
+	}
+}
+
+// stableNameOptOut is the explicit escape hatch for TestNameStableOrOptedOut: a
+// resource whose `name` is backend-owned (so not auto-exempt) yet must still NOT
+// be declared stable_output_fields — e.g. the backend recomputes the name on
+// update, so its remote value is not stable. Empty today.
+var stableNameOptOut = map[string]string{}
+
+// nameIsUserProvided reports whether `name` is a plain user-set field: present in
+// StateType and touched by no ignore rule (so not output_only or otherwise
+// backend-owned). Such a name resolves from local config, so a ${...name}
+// reference is never delayed — and it must not be pinned stable, since a rename
+// must change the reference.
+func nameIsUserProvided(adapter *Adapter, path *structpath.PathNode) bool {
+	if structaccess.ValidatePath(adapter.StateType(), path) != nil {
+		return false
+	}
+	for _, cfg := range []*ResourceLifecycleConfig{adapter.ResourceConfig(), adapter.GeneratedResourceConfig()} {
+		if cfg == nil {
+			continue
+		}
+		for _, rules := range [][]FieldRule{cfg.IgnoreRemoteChanges, cfg.IgnoreLocalChanges} {
+			for _, r := range rules {
+				if path.HasPatternPrefix(r.Field) {
+					return false
+				}
+			}
+		}
+	}
+	return true
+}
+
+// TestNameStableOrOptedOut guards against silently reintroducing ES-2202624: a
+// ${resources.X.name} reference delayed during X's in-place update recreates
+// every dependent that uses it as an immutable parent. To prevent that, a
+// backend-assigned `name` that can be referenced must be declared under
+// stable_output_fields so the reference resolves from the remote cache.
+//
+// For every resource that supports in-place update and has a `name` in RemoteType,
+// the name must be either auto-exempt (a plain user-provided field, which resolves
+// from local config), declared stable, or listed in stableNameOptOut. Resources
+// with no DoUpdate are skipped: they never take an in-place-update action, so the
+// reference is never delayed.
+func TestNameStableOrOptedOut(t *testing.T) {
+	namePath := structpath.MustParsePath("name")
+	for resourceType, resource := range SupportedResources {
+		adapter, err := NewAdapter(resource, resourceType, nil)
+		require.NoError(t, err)
+
+		if !adapter.HasDoUpdate() {
+			continue
+		}
+		if structaccess.ValidatePath(adapter.RemoteType(), namePath) != nil {
+			continue
+		}
+
+		if nameIsUserProvided(adapter, namePath) {
+			t.Logf("%s: auto-exempt — name is user-provided (in StateType, not output_only or ignored); resolves from local config", resourceType)
+			continue
+		}
+
+		if reason, ok := stableNameOptOut[resourceType]; ok {
+			t.Logf("%s: exempt from the stable-name check: %s", resourceType, reason)
+			continue
+		}
+
+		t.Run(resourceType, func(t *testing.T) {
+			assert.True(t, adapter.FieldIsStableOutput(namePath),
+				"backend-assigned `name` must be declared under stable_output_fields in configs/%[1]s.yml, or listed in stableNameOptOut; otherwise ${resources.%[1]s.<key>.name} references recreate dependents on an in-place update (ES-2202624)", resourceType)
+		})
+	}
 }
 
 func setupTestServerClient(t *testing.T) (*testserver.Server, *databricks.WorkspaceClient) {
diff --git a/bundle/direct/dresources/apitypes.generated.yml b/bundle/direct/dresources/apitypes.generated.yml
index a80b3baa69b..317a04442c4 100644
--- a/bundle/direct/dresources/apitypes.generated.yml
+++ b/bundle/direct/dresources/apitypes.generated.yml
@@ -6,6 +6,8 @@ apps: apps.App
 
 catalogs: catalog.CreateCatalog
 
+cluster_policies: compute.CreatePolicy
+
 clusters: compute.ClusterSpec
 
 dashboards: dashboards.Dashboard
@@ -18,8 +20,22 @@ experiments: ml.CreateExperiment
 
 external_locations: catalog.CreateExternalLocation
 
+features: ml.Feature
+
+genie_spaces: dashboards.GenieUpdateSpaceRequest
+
+instance_pools: compute.CreateInstancePool
+
+job_runs: jobs.RunNow
+
 jobs: jobs.JobSettings
 
+mcp_services: catalog.CreateMcpServiceRequest
+
+model_provider_services: catalog.CreateModelProviderServiceRequest
+
+model_services: catalog.CreateModelServiceRequest
+
 model_serving_endpoints: serving.CreateServingEndpoint
 
 models: ml.CreateModelRequest
@@ -28,10 +44,20 @@ pipelines: pipelines.CreatePipeline
 
 postgres_branches: postgres.BranchSpec
 
+postgres_catalogs: postgres.CatalogCatalogSpec
+
+postgres_databases: postgres.DatabaseDatabaseStatus
+
 postgres_endpoints: postgres.EndpointSpec
 
 postgres_projects: postgres.ProjectStatus
 
+postgres_roles: postgres.RoleRoleStatus
+
+postgres_snapshot_schedules: postgres.UpdateBranchRequest
+
+postgres_synced_tables: postgres.SyncedTableSyncedTableSpec
+
 quality_monitors: catalog.CreateMonitor
 
 registered_models: catalog.RegisteredModelInfo
@@ -40,10 +66,14 @@ schemas: catalog.CreateSchema
 
 secret_scopes: workspace.CreateScope
 
+secrets: catalog.Secret
+
 sql_warehouses: sql.EditWarehouseRequest
 
 synced_database_tables: database.SyncedDatabaseTable
 
 vector_search_endpoints: vectorsearch.CreateEndpoint
 
+vector_search_indexes: vectorsearch.CreateVectorIndexRequest
+
 volumes: catalog.CreateVolumeRequestContent
diff --git a/bundle/direct/dresources/apitypes.yml b/bundle/direct/dresources/apitypes.yml
index 29db9b67b20..ba16fd72c6a 100644
--- a/bundle/direct/dresources/apitypes.yml
+++ b/bundle/direct/dresources/apitypes.yml
@@ -4,8 +4,29 @@
 # Set a value to null to remove a type:
 # jobs: null
 
+# The field-overlap heuristic ties GenieSpace and GenieUpdateSpaceRequest and
+# breaks the tie toward GenieUpdateSpaceRequest because GenieSpace carries one
+# extra field (space_id). Pin GenieSpace: its etag is OUTPUT_ONLY (server-managed),
+# so we ignore remote changes to it, whereas on GenieUpdateSpaceRequest etag is a
+# caller-supplied optimistic-concurrency token and that behavior is lost.
+genie_spaces: dashboards.GenieSpace
+
+mcp_services: catalog.McpService
+
+model_provider_services: catalog.ModelProviderService
+
+model_services: catalog.ModelService
+
 postgres_branches: postgres.BranchSpec
 
+postgres_databases: postgres.DatabaseDatabaseSpec
+
 postgres_endpoints: postgres.EndpointSpec
 
 postgres_projects: postgres.ProjectSpec
+
+postgres_catalogs: postgres.CatalogCatalogSpec
+
+postgres_synced_tables: postgres.SyncedTableSyncedTableSpec
+
+postgres_roles: postgres.RoleRoleSpec
diff --git a/bundle/direct/dresources/app.go b/bundle/direct/dresources/app.go
index 5f882170613..22cd7cc2b4e 100644
--- a/bundle/direct/dresources/app.go
+++ b/bundle/direct/dresources/app.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"slices"
 	"strings"
 	"time"
 
@@ -18,29 +19,20 @@ import (
 	"github.com/databricks/databricks-sdk-go/service/apps"
 )
 
-// AppStateLifecycle holds lifecycle settings persisted in state.
-type AppStateLifecycle struct {
-	Started *bool `json:"started,omitempty"`
-}
-
-// AppState is the state type for App resources. It extends apps.App with deployment-related
-// fields (source_code_path, config, git_source, lifecycle) that are persisted in state.
+// AppState is the state type for App resources. source_code_path and git_source come from
+// apps.App; config and lifecycle are DABs-only additions persisted in state.
 type AppState struct {
 	apps.App
-	SourceCodePath string               `json:"source_code_path,omitempty"`
-	Config         *resources.AppConfig `json:"config,omitempty"`
-	GitSource      *apps.GitSource      `json:"git_source,omitempty"`
-	Lifecycle      *AppStateLifecycle   `json:"lifecycle,omitempty"`
+	Config    *resources.AppConfig `json:"config,omitempty"`
+	Lifecycle *StateLifecycle      `json:"lifecycle,omitempty"`
 }
 
-// AppRemote extends apps.App with the same deployment fields as AppState so they
+// AppRemote extends apps.App with the same DABs-only fields as AppState so they
 // appear in RemoteType and can be used for $resource resolution and drift detection.
 type AppRemote struct {
 	apps.App
-	SourceCodePath string               `json:"source_code_path,omitempty"`
-	Config         *resources.AppConfig `json:"config,omitempty"`
-	GitSource      *apps.GitSource      `json:"git_source,omitempty"`
-	Lifecycle      *AppStateLifecycle   `json:"lifecycle,omitempty"`
+	Config    *resources.AppConfig `json:"config,omitempty"`
+	Lifecycle *StateLifecycle      `json:"lifecycle,omitempty"`
 }
 
 // Custom marshalers needed because embedded apps.App has its own MarshalJSON
@@ -71,30 +63,25 @@ func (*ResourceApp) New(client *databricks.WorkspaceClient) *ResourceApp {
 
 func (*ResourceApp) PrepareState(input *resources.App) *AppState {
 	s := &AppState{
-		App:            input.App,
-		SourceCodePath: input.SourceCodePath,
-		Config:         input.Config,
-		GitSource:      input.GitSource,
-		Lifecycle:      nil,
+		App:       input.App,
+		Config:    input.Config,
+		Lifecycle: nil,
 	}
 	if input.Lifecycle != nil && input.Lifecycle.Started != nil {
-		s.Lifecycle = &AppStateLifecycle{Started: input.Lifecycle.Started}
+		s.Lifecycle = &StateLifecycle{Started: input.Lifecycle.Started}
 	}
 	return s
 }
 
 // RemapState maps the remote AppRemote to AppState for diff comparison.
-// Config, GitSource, and SourceCodePath are populated from the active deployment
-// when one exists, enabling drift detection for out-of-band redeploys.
+// DoRead populates config, git_source, and source_code_path from the active
+// deployment when one exists, enabling drift detection for out-of-band redeploys.
 // Started is derived from compute status so the planner can detect start/stop changes.
 func (*ResourceApp) RemapState(remote *AppRemote) *AppState {
-	started := !isComputeStopped(&remote.App)
 	return &AppState{
-		App:            remote.App,
-		SourceCodePath: remote.SourceCodePath,
-		Config:         remote.Config,
-		GitSource:      remote.GitSource,
-		Lifecycle:      &AppStateLifecycle{Started: &started},
+		App:       remote.App,
+		Config:    remote.Config,
+		Lifecycle: remote.Lifecycle,
 	}
 }
 
@@ -105,11 +92,9 @@ func (r *ResourceApp) DoRead(ctx context.Context, id string) (*AppRemote, error)
 	}
 	started := !isComputeStopped(app)
 	remote := &AppRemote{
-		App:            *app,
-		Config:         nil,
-		GitSource:      nil,
-		SourceCodePath: "",
-		Lifecycle:      &AppStateLifecycle{Started: &started},
+		App:       *app,
+		Config:    nil,
+		Lifecycle: &StateLifecycle{Started: &started},
 	}
 	if app.ActiveDeployment != nil {
 		// The source code path in active deployment is snapshotted version of the source code path in the app.
@@ -121,12 +106,28 @@ func (r *ResourceApp) DoRead(ctx context.Context, id string) (*AppRemote, error)
 	return remote, nil
 }
 
+// appRequestBody returns config.App with the deploy-only fields cleared. source_code_path
+// and git_source became part of apps.App in SDK v0.175, but DABs applies them through the
+// Deploy API (see manageLifecycle), so they must not ride along in create/update bodies.
+// ForceSendFields is cloned and stripped of SourceCodePath because the SDK's JSON
+// unmarshal (used when loading the plan) adds every present basic-type field to
+// ForceSendFields, which would otherwise force "source_code_path": "" into the body.
+func appRequestBody(config *AppState) apps.App {
+	app := config.App
+	app.SourceCodePath = ""
+	app.GitSource = nil
+	app.ForceSendFields = slices.DeleteFunc(slices.Clone(app.ForceSendFields), func(s string) bool {
+		return s == "SourceCodePath"
+	})
+	return app
+}
+
 func (r *ResourceApp) DoCreate(ctx context.Context, config *AppState) (string, *AppRemote, error) {
 	// Start app compute only when lifecycle.started=true is explicit.
 	// For nil (omitted) or false, use no_compute=true (do not start compute).
 	noCompute := config.Lifecycle == nil || config.Lifecycle.Started == nil || !*config.Lifecycle.Started
 	request := apps.CreateAppRequest{
-		App:             config.App,
+		App:             appRequestBody(config),
 		NoCompute:       noCompute,
 		ForceSendFields: nil,
 	}
@@ -169,6 +170,8 @@ var UpdateMaskFields = []string{
 	"resources",
 	"user_api_scopes",
 	"compute_size",
+	"compute_min_instances",
+	"compute_max_instances",
 	"git_repository",
 	"telemetry_export_destinations",
 }
@@ -176,11 +179,12 @@ var UpdateMaskFields = []string{
 var updateMask = strings.Join(UpdateMaskFields, ",")
 
 func (r *ResourceApp) DoUpdate(ctx context.Context, id string, config *AppState, entry *PlanEntry) (*AppRemote, error) {
-	// Deploy-only fields (source_code_path, config,
-	// git_source, lifecycle) are not part of apps.App and thus excluded from the request body.
+	// Deploy-only fields (source_code_path, config, git_source, lifecycle) are excluded
+	// from the request body; see appRequestBody.
 	if hasAppChanges(entry) {
+		app := appRequestBody(config)
 		request := apps.AsyncUpdateAppRequest{
-			App:        &config.App,
+			App:        &app,
 			AppName:    id,
 			UpdateMask: updateMask,
 		}
@@ -243,34 +247,24 @@ func (r *ResourceApp) manageLifecycle(ctx context.Context, id string, config *Ap
 	return nil
 }
 
-// deployOnlyFields are AppState fields managed via the Deploy API, not the App Update API.
-// They have remote counterparts (populated from active deployment and compute status),
-// but must not appear in the App update_mask.
-var deployOnlyFields = map[string]bool{
-	"source_code_path":  true,
-	"config":            true,
-	"git_source":        true,
-	"lifecycle":         true,
-	"lifecycle.started": true,
-}
-
 // hasAppChanges reports whether the plan entry contains any Update changes
 // to fields that belong to the App Update API (i.e., not deploy-only fields).
 func hasAppChanges(entry *PlanEntry) bool {
-	for path, change := range entry.Changes {
-		if change.Action == deployplan.Update && !deployOnlyFields[truncateAtIndex(path)] {
-			return true
-		}
-	}
-	return false
+	return entry.Changes.HasChangeExcept("source_code_path", "config", "git_source", "lifecycle", "lifecycle.started")
 }
 
-// OverrideChangeDesc skips source_code_path drift when the remote value is empty.
-// This happens when an app has no deployment yet (DefaultSourceCodePath is unset).
+// OverrideChangeDesc skips drift on the deploy-only fields (source_code_path, config,
+// git_source) while the app has no active deployment. DoRead reads them only from the
+// active deployment, so before the first deploy (or once a stop clears it) the remote
+// side is empty and the diff is spurious; it applies on the next start (manageLifecycle).
 func (*ResourceApp) OverrideChangeDesc(_ context.Context, path *structpath.PathNode, change *ChangeDesc, remote *AppRemote) error {
-	if path.String() == "source_code_path" && (remote.SourceCodePath == "" || remote.SourceCodePath == "null") {
-		change.Action = deployplan.Skip
-		change.Reason = "no deployment"
+	// Prefix(1) so a nested diff (e.g. config.command) matches its top-level field.
+	switch path.Prefix(1).String() {
+	case "source_code_path", "config", "git_source":
+		if remote.ActiveDeployment == nil {
+			change.Action = deployplan.Skip
+			change.Reason = "no active deployment"
+		}
 	}
 	return nil
 }
@@ -316,12 +310,27 @@ func deploymentToAppConfig(d *apps.AppDeployment) *resources.AppConfig {
 	return config
 }
 
-func (r *ResourceApp) DoDelete(ctx context.Context, id string) error {
+func (r *ResourceApp) DoDelete(ctx context.Context, id string, _ *AppState) error {
 	_, err := r.client.Apps.DeleteByName(ctx, id)
 	return err
 }
 
-func (r *ResourceApp) WaitAfterCreate(ctx context.Context, config *AppState) (*AppRemote, error) {
+// IsGone treats a DELETING app as already-deleted. The Apps DELETE is
+// fire-and-forget: it returns success while the app sits in
+// ComputeState=DELETING for up to ~20 minutes, and a GET during that window
+// returns the app (not 404), so callers cannot rely on IsMissing. A second
+// DELETE while DELETING is rejected with 400, so without this the delete/destroy
+// path is not idempotent (acceptance/bundle/invariant/{delete,destroy}_idempotent).
+// Consulted both at plan time (bundle_plan.go) and after a failed apply-time
+// delete (apply.go deleteConfirmedGone), which covers saved-plan deploys where
+// the app enters DELETING only after the plan was computed.
+// Still uncovered: a DELETING app hit during a normal deploy/update (not a
+// delete) produces a spurious update/skip because plan/apply do not special-case it there.
+func (*ResourceApp) IsGone(remote *AppRemote) bool {
+	return remote.ComputeStatus != nil && remote.ComputeStatus.State == apps.ComputeStateDeleting
+}
+
+func (r *ResourceApp) WaitAfterCreate(ctx context.Context, id string, config *AppState) (*AppRemote, error) {
 	remote, err := r.waitForApp(ctx, r.client, config.Name)
 	if err != nil {
 		return nil, err
@@ -363,11 +372,9 @@ func (r *ResourceApp) waitForApp(ctx context.Context, w *databricks.WorkspaceCli
 	}
 	started := !isComputeStopped(app)
 	remote := &AppRemote{
-		App:            *app,
-		Config:         nil,
-		GitSource:      nil,
-		SourceCodePath: "",
-		Lifecycle:      &AppStateLifecycle{Started: &started},
+		App:       *app,
+		Config:    nil,
+		Lifecycle: &StateLifecycle{Started: &started},
 	}
 	if app.ActiveDeployment != nil {
 		remote.SourceCodePath = app.DefaultSourceCodePath
diff --git a/bundle/direct/dresources/app_test.go b/bundle/direct/dresources/app_test.go
index edb99c4cffb..a32dbdeb0ed 100644
--- a/bundle/direct/dresources/app_test.go
+++ b/bundle/direct/dresources/app_test.go
@@ -1,6 +1,7 @@
 package dresources
 
 import (
+	"encoding/json"
 	"reflect"
 	"slices"
 	"strings"
@@ -60,7 +61,7 @@ func TestAppDoCreate_RetriesWhenAppIsDeleting(t *testing.T) {
 
 	r := (&ResourceApp{}).New(client)
 	ctx := t.Context()
-	name, _, err := r.DoCreate(ctx, &AppState{App: apps.App{Name: "test-app"}})
+	name, _, err := r.DoCreate(ctx, &AppState{Name: "test-app"})
 
 	require.NoError(t, err)
 	assert.Equal(t, "test-app", name)
@@ -116,7 +117,7 @@ func TestAppDoCreate_RetriesWhenGetReturnsNotFound(t *testing.T) {
 
 	r := (&ResourceApp{}).New(client)
 	ctx := t.Context()
-	name, _, err := r.DoCreate(ctx, &AppState{App: apps.App{Name: "test-app"}})
+	name, _, err := r.DoCreate(ctx, &AppState{Name: "test-app"})
 
 	require.NoError(t, err)
 	assert.Equal(t, "test-app", name)
@@ -128,7 +129,8 @@ func TestAppDoUpdate_UpdateMaskHasAllFields(t *testing.T) {
 	// iterate over all apps.App fields using reflection and ensure that UpdateMaskFields contains all of them.
 	config := GetGeneratedResourceConfig("apps")
 	require.NotNil(t, config)
-	var nonUpdatableFields []string
+	// forward_user_access_token is not supported, so it's not in UpdateMaskFields.
+	nonUpdatableFields := []string{"forward_user_access_token"}
 	for _, field := range config.IgnoreRemoteChanges {
 		nonUpdatableFields = append(nonUpdatableFields, field.Field.String())
 	}
@@ -147,10 +149,14 @@ func TestAppDoUpdate_UpdateMaskHasAllFields(t *testing.T) {
 		nonUpdatableFields = append(nonUpdatableFields, field.Field.String())
 	}
 
+	// provided_id_fields recreate on local changes, so they are not updatable either.
+	for _, field := range config.ProvidedIDFields {
+		nonUpdatableFields = append(nonUpdatableFields, field.Field.String())
+	}
+
 	fields := reflect.TypeFor[apps.App]()
 	var allFields []string
-	for i := range fields.NumField() {
-		field := fields.Field(i)
+	for field := range fields.Fields() {
 		jsonTag := field.Tag.Get("json")
 		if jsonTag == "" || jsonTag == "-" {
 			continue
@@ -166,3 +172,36 @@ func TestAppDoUpdate_UpdateMaskHasAllFields(t *testing.T) {
 		assert.Contains(t, allFields, field, "field %s is in UpdateMaskFields but not in apps.App struct", field)
 	}
 }
+
+// TestAppRequestBody_StripsSourceCodePathFromForceSendFields verifies that
+// appRequestBody removes SourceCodePath from ForceSendFields even when the plan
+// JSON round-trip has forced it in — reproduces the v1.14.0 regression where
+// "source_code_path": "" was sent in the UpdateApp body, causing a 400.
+func TestAppRequestBody_StripsSourceCodePathFromForceSendFields(t *testing.T) {
+	config := &AppState{
+		Name:           "my-app",
+		SourceCodePath: "/Workspace/Users/me/app",
+		// Simulate ForceSendFields as populated by marshal.Unmarshal when the
+		// plan entry is deserialized from JSON (ToStructVar calls json.Unmarshal,
+		// which calls apps.App.UnmarshalJSON -> marshal.Unmarshal, which adds
+		// every basic-type field present in the JSON to ForceSendFields).
+		ForceSendFields: []string{"Name", "SourceCodePath"},
+	}
+
+	body := appRequestBody(config)
+
+	// SourceCodePath must be cleared and absent from ForceSendFields so that
+	// the SDK's marshal.Marshal omits it from the request body.
+	assert.Empty(t, body.SourceCodePath)
+	assert.NotContains(t, body.ForceSendFields, "SourceCodePath")
+
+	// Verify the field is absent from the marshaled JSON (the root cause of the 400).
+	data, err := json.Marshal(body)
+	require.NoError(t, err)
+	var m map[string]any
+	require.NoError(t, json.Unmarshal(data, &m))
+	assert.NotContains(t, m, "source_code_path", "source_code_path must not appear in the UpdateApp request body")
+
+	// Other ForceSendFields entries must be preserved.
+	assert.Contains(t, body.ForceSendFields, "Name")
+}
diff --git a/bundle/direct/dresources/catalog.go b/bundle/direct/dresources/catalog.go
index 2e090ddfb8e..638138bfbda 100644
--- a/bundle/direct/dresources/catalog.go
+++ b/bundle/direct/dresources/catalog.go
@@ -2,6 +2,7 @@ package dresources
 
 import (
 	"context"
+	"slices"
 
 	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/cli/libs/utils"
@@ -25,6 +26,7 @@ func (*ResourceCatalog) RemapState(info *catalog.CatalogInfo) *catalog.CreateCat
 	return &catalog.CreateCatalog{
 		Comment:                   info.Comment,
 		ConnectionName:            info.ConnectionName,
+		CustomMaxRetentionHours:   info.CustomMaxRetentionHours,
 		ManagedEncryptionSettings: info.ManagedEncryptionSettings,
 		Name:                      info.Name,
 		Options:                   info.Options,
@@ -48,10 +50,19 @@ func (r *ResourceCatalog) DoCreate(ctx context.Context, config *catalog.CreateCa
 	return response.Name, response, nil
 }
 
+// See schemaForceSend. Verified against a real workspace: {"comment": ""} clears it.
+//
+// CustomMaxRetentionHours is force-sent here even though schemaForceSend deliberately omits it:
+// that omission was for parity with the removed Terraform engine, which does not apply to catalogs
+// anyway. Verified against a real workspace: {"custom_max_retention_hours": 0} clears it (an empty PATCH is otherwise
+// rejected with "Nothing to update").
+var catalogForceSend = []string{"Comment", "CustomMaxRetentionHours"}
+
 // DoUpdate updates the catalog in place and returns remote state.
 func (r *ResourceCatalog) DoUpdate(ctx context.Context, id string, config *catalog.CreateCatalog, _ *PlanEntry) (*catalog.CatalogInfo, error) {
 	updateRequest := catalog.UpdateCatalog{
 		Comment:                      config.Comment,
+		CustomMaxRetentionHours:      config.CustomMaxRetentionHours,
 		EnablePredictiveOptimization: "", // Not supported by DABs
 		IsolationMode:                "", // Not supported by DABs
 		ManagedEncryptionSettings:    config.ManagedEncryptionSettings,
@@ -60,7 +71,7 @@ func (r *ResourceCatalog) DoUpdate(ctx context.Context, id string, config *catal
 		Options:                      config.Options,
 		Owner:                        "", // Not supported by DABs
 		Properties:                   config.Properties,
-		ForceSendFields:              utils.FilterFields[catalog.UpdateCatalog](config.ForceSendFields, "EnablePredictiveOptimization", "IsolationMode", "Owner"),
+		ForceSendFields:              utils.FilterFields[catalog.UpdateCatalog](append(slices.Clone(catalogForceSend), config.ForceSendFields...), "EnablePredictiveOptimization", "IsolationMode", "Owner"),
 	}
 
 	response, err := r.client.Catalogs.Update(ctx, updateRequest)
@@ -72,9 +83,10 @@ func (r *ResourceCatalog) DoUpdate(ctx context.Context, id string, config *catal
 }
 
 // DoUpdateWithID updates the catalog and returns the new ID if the name changes.
-func (r *ResourceCatalog) DoUpdateWithID(ctx context.Context, id string, config *catalog.CreateCatalog) (string, *catalog.CatalogInfo, error) {
+func (r *ResourceCatalog) DoUpdateWithID(ctx context.Context, id string, config *catalog.CreateCatalog, _ *PlanEntry) (string, *catalog.CatalogInfo, error) {
 	updateRequest := catalog.UpdateCatalog{
 		Comment:                      config.Comment,
+		CustomMaxRetentionHours:      config.CustomMaxRetentionHours,
 		EnablePredictiveOptimization: "", // Not supported by DABs
 		IsolationMode:                "", // Not supported by DABs
 		ManagedEncryptionSettings:    config.ManagedEncryptionSettings,
@@ -83,7 +95,7 @@ func (r *ResourceCatalog) DoUpdateWithID(ctx context.Context, id string, config
 		Options:                      config.Options,
 		Owner:                        "", // Not supported by DABs
 		Properties:                   config.Properties,
-		ForceSendFields:              utils.FilterFields[catalog.UpdateCatalog](config.ForceSendFields, "EnablePredictiveOptimization", "IsolationMode", "Owner"),
+		ForceSendFields:              utils.FilterFields[catalog.UpdateCatalog](append(slices.Clone(catalogForceSend), config.ForceSendFields...), "EnablePredictiveOptimization", "IsolationMode", "Owner"),
 	}
 
 	if config.Name != id {
@@ -104,7 +116,7 @@ func (r *ResourceCatalog) DoUpdateWithID(ctx context.Context, id string, config
 	return newID, response, nil
 }
 
-func (r *ResourceCatalog) DoDelete(ctx context.Context, id string) error {
+func (r *ResourceCatalog) DoDelete(ctx context.Context, id string, _ *catalog.CreateCatalog) error {
 	return r.client.Catalogs.Delete(ctx, catalog.DeleteCatalogRequest{
 		Name:            id,
 		Force:           true,
diff --git a/bundle/direct/dresources/cluster.go b/bundle/direct/dresources/cluster.go
index 46148a2655f..82167080c4d 100644
--- a/bundle/direct/dresources/cluster.go
+++ b/bundle/direct/dresources/cluster.go
@@ -4,18 +4,82 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"strings"
 	"time"
 
 	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/cli/bundle/deployplan"
+	"github.com/databricks/cli/libs/log"
 	"github.com/databricks/cli/libs/structs/structpath"
 	"github.com/databricks/cli/libs/utils"
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/marshal"
 	"github.com/databricks/databricks-sdk-go/retries"
 	"github.com/databricks/databricks-sdk-go/service/compute"
+	"golang.org/x/sync/errgroup"
 )
 
+// librariesWaitTimeout bounds how long we poll for libraries to finish installing.
+const librariesWaitTimeout = 15 * time.Minute
+
+// clusterWaitTimeout bounds how long we poll for a cluster to reach its target
+// state (RUNNING/TERMINATED) after create, edit, or start/stop. Provisioning can
+// legitimately take longer than 15 minutes on capacity-constrained workspaces
+// (a cluster stays PENDING with "Finding instances for new nodes"), so we allow
+// 30 minutes before giving up. Terminal states still halt immediately.
+const clusterWaitTimeout = 30 * time.Minute
+
+// ClusterState is the state type for Cluster resources. It extends compute.ClusterSpec with
+// lifecycle settings and the cluster ID.
+// ClusterId is written to state by DoCreate/DoUpdate for informational purposes; it is not
+// used in diff computation (neither PrepareState nor RemapState set it).
+type ClusterState struct {
+	compute.ClusterSpec
+
+	Lifecycle *StateLifecycle `json:"lifecycle,omitempty"`
+
+	// Libraries are installed via the Libraries API, not the cluster spec, and managed as
+	// part of the cluster (see reconcileLibraries and the install in WaitAfterCreate).
+	Libraries []compute.Library `json:"libraries,omitempty"`
+}
+
+// Custom marshalers needed because embedded compute.ClusterSpec has its own MarshalJSON
+// which would otherwise take over and ignore the additional fields.
+func (s *ClusterState) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, s)
+}
+
+func (s ClusterState) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(s)
+}
+
+// ClusterRemote extends compute.ClusterDetails with a synthetic Lifecycle field so that
+// RemoteType satisfies TestRemoteSuperset (every field in ClusterState exists in ClusterRemote).
+// Lifecycle.Started is populated by DoRead from the cluster's running state.
+//
+// ApplyPolicyDefaultValues is promoted to the top level because the cluster GET API returns it
+// only under .spec (a snapshot of the create/edit settings), never at the top level. DoRead
+// copies it up so RemapState stays a dumb copy and the field participates in normal drift
+// detection instead of being suppressed as missing_in_remote.
+type ClusterRemote struct {
+	compute.ClusterDetails
+	ApplyPolicyDefaultValues bool            `json:"apply_policy_default_values,omitempty"`
+	Lifecycle                *StateLifecycle `json:"lifecycle,omitempty"`
+
+	// Libraries is populated by DoRead from the Libraries cluster-status API (the cluster
+	// GET does not return installed libraries), so it participates in drift detection.
+	Libraries []compute.Library `json:"libraries,omitempty"`
+}
+
+func (r *ClusterRemote) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, r)
+}
+
+func (r ClusterRemote) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(r)
+}
+
 type ResourceCluster struct {
 	client *databricks.WorkspaceClient
 }
@@ -26,13 +90,23 @@ func (r *ResourceCluster) New(client *databricks.WorkspaceClient) any {
 	}
 }
 
-func (r *ResourceCluster) PrepareState(input *resources.Cluster) *compute.ClusterSpec {
-	return &input.ClusterSpec
+func (r *ResourceCluster) PrepareState(input *resources.Cluster) *ClusterState {
+	s := &ClusterState{
+		ClusterSpec: input.ClusterSpec,
+		Lifecycle:   nil,
+		Libraries:   input.Libraries,
+	}
+	if input.Lifecycle != nil && input.Lifecycle.Started != nil {
+		s.Lifecycle = &StateLifecycle{Started: input.Lifecycle.Started}
+	}
+	return s
 }
 
-func (r *ResourceCluster) RemapState(input *compute.ClusterDetails) *compute.ClusterSpec {
-	spec := &compute.ClusterSpec{
-		ApplyPolicyDefaultValues:   false,
+// RemapState maps the remote ClusterRemote to ClusterState for diff comparison.
+// Started is derived from cluster state so the planner can detect start/stop changes.
+func (r *ResourceCluster) RemapState(input *ClusterRemote) *ClusterState {
+	spec := &ClusterState{
+		ApplyPolicyDefaultValues:   input.ApplyPolicyDefaultValues,
 		Autoscale:                  input.Autoscale,
 		AutoterminationMinutes:     input.AutoterminationMinutes,
 		AwsAttributes:              input.AwsAttributes,
@@ -41,6 +115,7 @@ func (r *ResourceCluster) RemapState(input *compute.ClusterDetails) *compute.Clu
 		ClusterName:                input.ClusterName,
 		CustomTags:                 input.CustomTags,
 		DataSecurityMode:           input.DataSecurityMode,
+		DependencyMode:             input.DependencyMode,
 		DockerImage:                input.DockerImage,
 		DriverInstancePoolId:       input.DriverInstancePoolId,
 		DriverNodeTypeId:           input.DriverNodeTypeId,
@@ -67,67 +142,246 @@ func (r *ResourceCluster) RemapState(input *compute.ClusterDetails) *compute.Clu
 		WorkloadType:               input.WorkloadType,
 		WorkerNodeTypeFlexibility:  input.WorkerNodeTypeFlexibility,
 		ForceSendFields:            utils.FilterFields[compute.ClusterSpec](input.ForceSendFields),
-	}
-	if input.Spec != nil {
-		spec.ApplyPolicyDefaultValues = input.Spec.ApplyPolicyDefaultValues
+		Lifecycle:                  input.Lifecycle,
+		Libraries:                  input.Libraries,
 	}
 	return spec
 }
 
-func (r *ResourceCluster) DoRead(ctx context.Context, id string) (*compute.ClusterDetails, error) {
-	return r.client.Clusters.GetByClusterId(ctx, id)
+func (r *ResourceCluster) DoRead(ctx context.Context, id string) (*ClusterRemote, error) {
+	var details *compute.ClusterDetails
+	var libraries []compute.Library
+
+	// The cluster GET and the library-status GET are independent, so run them concurrently.
+	g, ctx := errgroup.WithContext(ctx)
+	g.Go(func() error {
+		var err error
+		details, err = r.client.Clusters.GetByClusterId(ctx, id)
+		return err
+	})
+	g.Go(func() error {
+		var err error
+		libraries, err = r.readLibraries(ctx, id)
+		return err
+	})
+	if err := g.Wait(); err != nil {
+		return nil, err
+	}
+
+	remote := &ClusterRemote{
+		ClusterDetails:           *details,
+		ApplyPolicyDefaultValues: false,
+		Lifecycle:                nil,
+		Libraries:                libraries,
+	}
+	// The GET response carries apply_policy_default_values only under .spec (a snapshot of the
+	// create/edit settings), not at the top level. Promote it so RemapState is a dumb copy.
+	if details.Spec != nil {
+		remote.ApplyPolicyDefaultValues = details.Spec.ApplyPolicyDefaultValues
+	}
+
+	switch details.State {
+	case compute.StateRunning:
+		started := true
+		remote.Lifecycle = &StateLifecycle{Started: &started}
+	case compute.StateTerminated:
+		started := false
+		remote.Lifecycle = &StateLifecycle{Started: &started}
+	default:
+		remote.Lifecycle = nil
+	}
+
+	return remote, nil
+}
+
+// readLibraries returns the bundle-managed libraries installed on the cluster.
+// https://docs.databricks.com/api/workspace/libraries/clusterstatus
+func (r *ResourceCluster) readLibraries(ctx context.Context, id string) ([]compute.Library, error) {
+	statuses, err := r.client.Libraries.ClusterStatusByClusterId(ctx, id)
+	if err != nil {
+		return nil, err
+	}
+	var libraries []compute.Library
+	for _, s := range statuses.LibraryStatuses {
+		// Libraries set for all clusters via the UI are not managed by the bundle; a library
+		// pending uninstall on restart is on its way out. Skip both.
+		if s.Library == nil || s.IsLibraryForAllClusters || s.Status == compute.LibraryInstallStatusUninstallOnRestart {
+			continue
+		}
+		libraries = append(libraries, *s.Library)
+	}
+	return libraries, nil
 }
 
-func (r *ResourceCluster) DoCreate(ctx context.Context, config *compute.ClusterSpec) (string, *compute.ClusterDetails, error) {
-	wait, err := r.client.Clusters.Create(ctx, makeCreateCluster(config))
+func (r *ResourceCluster) DoCreate(ctx context.Context, config *ClusterState) (string, *ClusterRemote, error) {
+	wait, err := r.client.Clusters.Create(ctx, makeCreateCluster(&config.ClusterSpec))
 	if err != nil {
 		return "", nil, err
 	}
 	return wait.ClusterId, nil, nil
 }
 
-func (r *ResourceCluster) DoUpdate(ctx context.Context, id string, config *compute.ClusterSpec, _ *PlanEntry) (*compute.ClusterDetails, error) {
-	// Same retry as in TF provider logic
-	// https://github.com/databricks/terraform-provider-databricks/blob/3eecd0f90cf99d7777e79a3d03c41f9b2aafb004/clusters/resource_cluster.go#L624
-	timeout := 15 * time.Minute
-	_, err := retries.Poll(ctx, timeout, func() (*compute.WaitGetClusterRunning[struct{}], *retries.Err) {
-		wait, err := r.client.Clusters.Edit(ctx, makeEditCluster(id, config))
-		if err == nil {
-			return wait, nil
+// hasClusterSpecChanges reports whether the plan entry changes a Cluster Edit API field —
+// anything other than lifecycle (start/stop) and libraries (handled via the Libraries API).
+func hasClusterSpecChanges(entry *PlanEntry) bool {
+	for field, change := range entry.Changes {
+		if change.Action == deployplan.Skip {
+			continue
+		}
+		node, err := structpath.ParsePath(field)
+		if err != nil {
+			continue
+		}
+		top, _ := node.Prefix(1).StringKey()
+		if top != "lifecycle" && top != "libraries" {
+			return true
+		}
+	}
+	return false
+}
+
+func (r *ResourceCluster) DoUpdate(ctx context.Context, id string, config *ClusterState, entry *PlanEntry) (*ClusterRemote, error) {
+	if hasClusterSpecChanges(entry) {
+		// Same retry as in TF provider logic
+		// https://github.com/databricks/terraform-provider-databricks/blob/3eecd0f90cf99d7777e79a3d03c41f9b2aafb004/clusters/resource_cluster.go#L624
+		_, err := retries.Poll(ctx, clusterWaitTimeout, func() (*compute.WaitGetClusterRunning[struct{}], *retries.Err) {
+			wait, err := r.client.Clusters.Edit(ctx, makeEditCluster(id, &config.ClusterSpec))
+			if err == nil {
+				return wait, nil
+			}
+
+			// Only Running and Terminated clusters can be modified. In particular, autoscaling clusters cannot be modified
+			// while the resizing is ongoing. We retry in this case. Scaling can take several minutes.
+			if apiErr, ok := errors.AsType[*apierr.APIError](err); ok && apiErr.ErrorCode == "INVALID_STATE" {
+				return nil, retries.Continues(fmt.Sprintf("cluster %s cannot be modified in its current state: %s", id, apiErr.Message))
+			}
+			return nil, retries.Halt(err)
+		})
+		if err != nil {
+			return nil, err
 		}
+	}
 
-		var apiErr *apierr.APIError
-		// Only Running and Terminated clusters can be modified. In particular, autoscaling clusters cannot be modified
-		// while the resizing is ongoing. We retry in this case. Scaling can take several minutes.
-		if errors.As(err, &apiErr) && apiErr.ErrorCode == "INVALID_STATE" {
-			return nil, retries.Continues(fmt.Sprintf("cluster %s cannot be modified in its current state: %s", id, apiErr.Message))
+	// TODO: a local whl/jar whose workspace path is unchanged but whose contents
+	// changed (same name+version, non-dev mode) is not detected here, so it is not reinstalled.
+	// Dev mode handles this via patchwheel (a source-derived version bump).
+	if entry.Changes.HasChange(librariesPath) {
+		if err := r.reconcileLibraries(ctx, id, config.Libraries, entry); err != nil {
+			return nil, err
 		}
-		return nil, retries.Halt(err)
-	})
+		// Installs apply live on a running cluster. Uninstalls are marked UNINSTALL_ON_RESTART
+		// by the backend and take effect at the cluster's next restart; the bundle never restarts it.
+		if err := r.waitForInstall(ctx, id, config.Libraries); err != nil {
+			return nil, err
+		}
+	}
+
+	if config.Lifecycle == nil || config.Lifecycle.Started == nil {
+		return nil, nil
+	}
+
+	desiredStarted := *config.Lifecycle.Started
+	alreadyRunning := remoteClusterIsRunning(entry)
+	if desiredStarted && !alreadyRunning {
+		// lifecycle.started=true: fire Start; WaitAfterUpdate polls for RUNNING.
+		_, err := r.client.Clusters.Start(ctx, compute.StartCluster{ClusterId: id})
+		return nil, err
+	} else if !desiredStarted && alreadyRunning {
+		// lifecycle.started=false: fire Delete; WaitAfterUpdate polls for TERMINATED.
+		// Note: Delete terminates the cluster; permanent removal is a separate API (permanent-delete).
+		_, err := r.client.Clusters.Delete(ctx, compute.DeleteCluster{ClusterId: id})
+		return nil, err
+	}
+
+	return nil, nil
+}
+
+// WaitAfterUpdate waits for the cluster to reach the desired lifecycle state after DoUpdate.
+func (r *ResourceCluster) WaitAfterUpdate(ctx context.Context, id string, config *ClusterState) (*ClusterRemote, error) {
+	if config.Lifecycle == nil || config.Lifecycle.Started == nil {
+		return nil, nil
+	}
+
+	if *config.Lifecycle.Started {
+		_, err := r.client.Clusters.WaitGetClusterRunning(ctx, id, clusterWaitTimeout, nil)
+		return nil, err
+	}
+
+	_, err := r.client.Clusters.WaitGetClusterTerminated(ctx, id, clusterWaitTimeout, nil)
 	return nil, err
 }
 
-func (r *ResourceCluster) DoResize(ctx context.Context, id string, config *compute.ClusterSpec) error {
+// WaitAfterCreate waits for the cluster to reach RUNNING state (clusters always start on creation).
+// When lifecycle.started=false, it then terminates the cluster.
+func (r *ResourceCluster) WaitAfterCreate(ctx context.Context, id string, config *ClusterState) (*ClusterRemote, error) {
+	// Always wait for RUNNING first: clusters start in PENDING state and must be polled.
+	_, err := r.client.Clusters.WaitGetClusterRunning(ctx, id, clusterWaitTimeout, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	// Install libraries once the cluster is running: installs only progress on a running cluster.
+	// TODO: Wait is supposed to be side effect free, but in this case moving it to
+	// the create will cause a wait for libraries to be installed befor the cluster is installed.
+	// this increases the risk of losing the cluster. This is a limitation
+	if len(config.Libraries) > 0 {
+		err = r.client.Libraries.Install(ctx, compute.InstallLibraries{ClusterId: id, Libraries: config.Libraries})
+		if err != nil {
+			return nil, err
+		}
+		if err := r.waitForInstall(ctx, id, config.Libraries); err != nil {
+			return nil, err
+		}
+	}
+
+	if config.Lifecycle != nil && config.Lifecycle.Started != nil && !*config.Lifecycle.Started {
+		// started=false: terminate the cluster after it reaches RUNNING.
+		// Note: Delete terminates the cluster; permanent removal is a separate API (permanent-delete).
+		deleteWaiter, err := r.client.Clusters.Delete(ctx, compute.DeleteCluster{ClusterId: id})
+		if err != nil {
+			return nil, err
+		}
+		_, err = deleteWaiter.GetWithTimeout(clusterWaitTimeout)
+		return nil, err
+	}
+
+	return nil, nil
+}
+
+func (r *ResourceCluster) DoResize(ctx context.Context, id string, config *ClusterState, entry *PlanEntry) error {
 	_, err := r.client.Clusters.Resize(ctx, compute.ResizeCluster{
 		ClusterId:       id,
 		NumWorkers:      config.NumWorkers,
 		Autoscale:       config.Autoscale,
 		ForceSendFields: utils.FilterFields[compute.ResizeCluster](config.ForceSendFields),
 	})
+	if err == nil {
+		return nil
+	}
+
+	apiErr, ok := errors.AsType[*apierr.APIError](err)
+	if !ok || apiErr.ErrorCode != "INVALID_STATE" {
+		return err
+	}
+
+	// Cluster is not running; fall back to the full clusters/edit path.
+	log.Debugf(ctx, "cluster %s: resize returned INVALID_STATE (%s), falling back to edit", id, err)
+	_, err = r.DoUpdate(ctx, id, config, entry)
 	return err
 }
 
-func (r *ResourceCluster) DoDelete(ctx context.Context, id string) error {
+func (r *ResourceCluster) DoDelete(ctx context.Context, id string, _ *ClusterState) error {
 	return r.client.Clusters.PermanentDeleteByClusterId(ctx, id)
 }
 
-func (r *ResourceCluster) OverrideChangeDesc(ctx context.Context, p *structpath.PathNode, change *ChangeDesc, remoteState *compute.ClusterDetails) error {
-	// We're only interested in downgrading some updates to skips. Changes that already skipped or cause recreation should remain unchanged.
+func (r *ResourceCluster) OverrideChangeDesc(ctx context.Context, p *structpath.PathNode, change *ChangeDesc, remoteState *ClusterRemote) error {
+	path := p.Prefix(1).String()
+
+	// Remaining overrides only apply to Update actions.
 	if change.Action != deployplan.Update {
 		return nil
 	}
 
-	path := p.Prefix(1).String()
 	switch path {
 	case "data_security_mode":
 		// We do change skip here in the same way TF provider does suppress diff if the alias is used.
@@ -144,13 +398,35 @@ func (r *ResourceCluster) OverrideChangeDesc(ctx context.Context, p *structpath.
 		}
 
 	case "num_workers", "autoscale":
-		if remoteState.State == compute.StateRunning {
+		if remoteState != nil && remoteState.State == compute.StateRunning {
 			change.Action = deployplan.Resize
 		}
+
+	case "libraries":
+		// Without a libraries section the bundle does not manage the cluster's libraries, matching
+		// the behaviour before the field existed: job runs install their task libraries cluster-wide,
+		// so what the cluster reports is not drift. With no section, New is nil and the difference
+		// arrives as a single whole-field change; `libraries: []` keeps New non-nil and stays managed.
+		if p.String() == "libraries" && change.New == nil {
+			change.Action = deployplan.Skip
+			change.Reason = deployplan.ReasonUnmanaged
+		}
 	}
 	return nil
 }
 
+// remoteClusterIsRunning reads the cluster running state from the plan entry's remote state.
+func remoteClusterIsRunning(entry *PlanEntry) bool {
+	if entry.RemoteState == nil {
+		return false
+	}
+	remote, ok := entry.RemoteState.(*ClusterRemote)
+	if !ok {
+		return false
+	}
+	return remote.State == compute.StateRunning
+}
+
 func makeCreateCluster(config *compute.ClusterSpec) compute.CreateCluster {
 	create := compute.CreateCluster{
 		ApplyPolicyDefaultValues:   config.ApplyPolicyDefaultValues,
@@ -163,6 +439,7 @@ func makeCreateCluster(config *compute.ClusterSpec) compute.CreateCluster {
 		CloneFrom:                  nil, // Not supported by DABs
 		CustomTags:                 config.CustomTags,
 		DataSecurityMode:           config.DataSecurityMode,
+		DependencyMode:             config.DependencyMode,
 		DockerImage:                config.DockerImage,
 		DriverInstancePoolId:       config.DriverInstancePoolId,
 		DriverNodeTypeId:           config.DriverNodeTypeId,
@@ -212,6 +489,7 @@ func makeEditCluster(id string, config *compute.ClusterSpec) compute.EditCluster
 		ClusterName:                config.ClusterName,
 		CustomTags:                 config.CustomTags,
 		DataSecurityMode:           config.DataSecurityMode,
+		DependencyMode:             config.DependencyMode,
 		DockerImage:                config.DockerImage,
 		DriverInstancePoolId:       config.DriverInstancePoolId,
 		DriverNodeTypeId:           config.DriverNodeTypeId,
@@ -248,3 +526,150 @@ func makeEditCluster(id string, config *compute.ClusterSpec) compute.EditCluster
 
 	return edit
 }
+
+// librariesPath is the ClusterState path of the libraries slice, used to detect library changes.
+var librariesPath = structpath.MustParsePath("libraries")
+
+// KeyedSlices compares libraries by identity rather than index so reordering (or the
+// read-order the status API returns) does not produce phantom diffs.
+func (*ResourceCluster) KeyedSlices() map[string]any {
+	return map[string]any{"libraries": libraryKey}
+}
+
+// reconcileLibraries uninstalls libraries dropped from config and installs the desired set.
+// The Libraries API exposes install and uninstall as separate endpoints, so this is two calls.
+func (r *ResourceCluster) reconcileLibraries(ctx context.Context, id string, desired []compute.Library, entry *PlanEntry) error {
+	removed := removedLibraries(desired, entry)
+	if len(removed) > 0 {
+		err := r.client.Libraries.Uninstall(ctx, compute.UninstallLibraries{ClusterId: id, Libraries: removed})
+		if err != nil {
+			return err
+		}
+	}
+	if len(desired) > 0 {
+		return r.client.Libraries.Install(ctx, compute.InstallLibraries{ClusterId: id, Libraries: desired})
+	}
+	return nil
+}
+
+// removedLibraries returns libraries present in the remote state but absent from the desired set.
+func removedLibraries(desired []compute.Library, entry *PlanEntry) []compute.Library {
+	remote, ok := entry.RemoteState.(*ClusterRemote)
+	if !ok || remote == nil {
+		return nil
+	}
+	desiredKeys := make(map[string]struct{}, len(desired))
+	for _, l := range desired {
+		desiredKeys[libraryMapKey(l)] = struct{}{}
+	}
+	var result []compute.Library
+	for _, l := range remote.Libraries {
+		if _, ok := desiredKeys[libraryMapKey(l)]; !ok {
+			result = append(result, l)
+		}
+	}
+	return result
+}
+
+// waitForInstall polls until every desired library reaches a terminal installed state. It returns
+// early without waiting when the cluster is not running: installs only progress on a running
+// cluster and are queued until it next starts.
+func (r *ResourceCluster) waitForInstall(ctx context.Context, id string, desired []compute.Library) error {
+	if len(desired) == 0 {
+		return nil
+	}
+	details, err := r.client.Clusters.GetByClusterId(ctx, id)
+	if err != nil {
+		return err
+	}
+	if details.State != compute.StateRunning {
+		log.Debugf(ctx, "cluster %s is not running (%s); skipping wait for library installation", id, details.State)
+		return nil
+	}
+
+	desiredKeys := make(map[string]struct{}, len(desired))
+	for _, l := range desired {
+		typ, val := libraryWaitKey(l)
+		if typ == "" {
+			// Unknown library type: it can't be matched in cluster-status, so don't wait for it.
+			continue
+		}
+		desiredKeys[typ+"="+val] = struct{}{}
+	}
+
+	_, err = retries.Poll(ctx, librariesWaitTimeout, func() (*struct{}, *retries.Err) {
+		statuses, err := r.client.Libraries.ClusterStatusByClusterId(ctx, id)
+		if err != nil {
+			return nil, retries.Halt(err)
+		}
+		pending := len(desiredKeys)
+		for _, s := range statuses.LibraryStatuses {
+			if s.Library == nil {
+				continue
+			}
+			if _, ok := desiredKeys[libraryWaitMapKey(*s.Library)]; !ok {
+				continue
+			}
+			switch s.Status {
+			case compute.LibraryInstallStatusFailed:
+				return nil, retries.Halt(fmt.Errorf("library %s failed to install: %s", libraryWaitMapKey(*s.Library), strings.Join(s.Messages, "; ")))
+			case compute.LibraryInstallStatusInstalled, compute.LibraryInstallStatusSkipped, compute.LibraryInstallStatusRestored:
+				pending--
+			case compute.LibraryInstallStatusPending, compute.LibraryInstallStatusResolving, compute.LibraryInstallStatusInstalling, compute.LibraryInstallStatusUninstallOnRestart:
+				// Still in progress (or being removed); keep polling.
+			}
+		}
+		if pending > 0 {
+			return nil, retries.Continues(fmt.Sprintf("waiting for %d librar(ies) to install on cluster %s", pending, id))
+		}
+		return &struct{}{}, nil
+	})
+	return err
+}
+
+// libraryWaitKey identifies a library by its primary field only, used to match install-status reports.
+func libraryWaitKey(l compute.Library) (string, string) {
+	switch {
+	case l.Whl != "":
+		return "whl", l.Whl
+	case l.Jar != "":
+		return "jar", l.Jar
+	case l.Egg != "":
+		return "egg", l.Egg
+	case l.Requirements != "":
+		return "requirements", l.Requirements
+	case l.Pypi != nil:
+		return "pypi", l.Pypi.Package
+	case l.Maven != nil:
+		return "maven", l.Maven.Coordinates
+	case l.Cran != nil:
+		return "cran", l.Cran.Package
+	}
+	return "", ""
+}
+
+// libraryKey extends libraryWaitKey with repo/exclusions so a repo-only change is detected.
+func libraryKey(l compute.Library) (string, string) {
+	typ, id := libraryWaitKey(l)
+	switch {
+	case l.Pypi != nil:
+		return typ, id + ";" + l.Pypi.Repo
+	case l.Maven != nil:
+		return typ, id + ";" + l.Maven.Repo + ";" + strings.Join(l.Maven.Exclusions, ",")
+	case l.Cran != nil:
+		return typ, id + ";" + l.Cran.Repo
+	}
+	return typ, id
+}
+
+// libraryMapKey flattens libraryKey into a single string for map lookups.
+func libraryMapKey(l compute.Library) string {
+	f, v := libraryKey(l)
+	return f + "=" + v
+}
+
+// libraryWaitMapKey flattens libraryWaitKey into a single string for map lookups.
+func libraryWaitMapKey(l compute.Library) string {
+	f, v := libraryWaitKey(l)
+	return f + "=" + v
+}
diff --git a/bundle/direct/dresources/cluster_policy.go b/bundle/direct/dresources/cluster_policy.go
new file mode 100644
index 00000000000..ae69390b9cc
--- /dev/null
+++ b/bundle/direct/dresources/cluster_policy.go
@@ -0,0 +1,76 @@
+package dresources
+
+import (
+	"context"
+
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/cli/libs/utils"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/service/compute"
+)
+
+type ResourceClusterPolicy struct {
+	client *databricks.WorkspaceClient
+}
+
+func (*ResourceClusterPolicy) New(client *databricks.WorkspaceClient) *ResourceClusterPolicy {
+	return &ResourceClusterPolicy{client: client}
+}
+
+func (*ResourceClusterPolicy) PrepareState(input *resources.ClusterPolicy) *compute.CreatePolicy {
+	cp := input.CreatePolicy
+	// Copy the shadow fields, already normalized to JSON strings by ConfigureClusterPolicyDefinition.
+	if s, ok := input.Definition.(string); ok {
+		cp.Definition = s
+	}
+	if s, ok := input.PolicyFamilyDefinitionOverrides.(string); ok {
+		cp.PolicyFamilyDefinitionOverrides = s
+	}
+	return &cp
+}
+
+// RemapState copies the config fields shared by Policy and CreatePolicy;
+// output-only fields (policy_id, created_at_timestamp, creator_user_name, is_default) are not in the state.
+func (*ResourceClusterPolicy) RemapState(remote *compute.Policy) *compute.CreatePolicy {
+	return &compute.CreatePolicy{
+		Definition:                      remote.Definition,
+		Description:                     remote.Description,
+		Libraries:                       remote.Libraries,
+		MaxClustersPerUser:              remote.MaxClustersPerUser,
+		Name:                            remote.Name,
+		PolicyFamilyDefinitionOverrides: remote.PolicyFamilyDefinitionOverrides,
+		PolicyFamilyId:                  remote.PolicyFamilyId,
+		ForceSendFields:                 utils.FilterFields[compute.CreatePolicy](remote.ForceSendFields),
+	}
+}
+
+func (r *ResourceClusterPolicy) DoRead(ctx context.Context, id string) (*compute.Policy, error) {
+	return r.client.ClusterPolicies.GetByPolicyId(ctx, id)
+}
+
+func (r *ResourceClusterPolicy) DoCreate(ctx context.Context, config *compute.CreatePolicy) (string, *compute.Policy, error) {
+	resp, err := r.client.ClusterPolicies.Create(ctx, *config)
+	if err != nil {
+		return "", nil, err
+	}
+
+	return resp.PolicyId, nil, nil
+}
+
+func (r *ResourceClusterPolicy) DoUpdate(ctx context.Context, id string, config *compute.CreatePolicy, _ *PlanEntry) (*compute.Policy, error) {
+	return nil, r.client.ClusterPolicies.Edit(ctx, compute.EditPolicy{
+		PolicyId:                        id,
+		Name:                            config.Name,
+		Definition:                      config.Definition,
+		Description:                     config.Description,
+		Libraries:                       config.Libraries,
+		MaxClustersPerUser:              config.MaxClustersPerUser,
+		PolicyFamilyDefinitionOverrides: config.PolicyFamilyDefinitionOverrides,
+		PolicyFamilyId:                  config.PolicyFamilyId,
+		ForceSendFields:                 utils.FilterFields[compute.EditPolicy](config.ForceSendFields),
+	})
+}
+
+func (r *ResourceClusterPolicy) DoDelete(ctx context.Context, id string, _ *compute.CreatePolicy) error {
+	return r.client.ClusterPolicies.DeleteByPolicyId(ctx, id)
+}
diff --git a/bundle/direct/dresources/cluster_policy_test.go b/bundle/direct/dresources/cluster_policy_test.go
new file mode 100644
index 00000000000..60377bfd0b3
--- /dev/null
+++ b/bundle/direct/dresources/cluster_policy_test.go
@@ -0,0 +1,47 @@
+package dresources
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestClusterPolicyPrepareState(t *testing.T) {
+	tests := []struct {
+		name       string
+		definition any
+		want       string
+	}{
+		{
+			// The normal post-mutator case: definition is already a JSON string.
+			name:       "string definition is copied into state",
+			definition: `{"spark_version":{"type":"fixed"}}`,
+			want:       `{"spark_version":{"type":"fixed"}}`,
+		},
+		{
+			// ConfigureClusterPolicyDefinition guarantees a string, so a non-string
+			// is ignored rather than reaching the API.
+			name:       "non-string definition is ignored",
+			definition: map[string]any{"spark_version": "fixed"},
+			want:       "",
+		},
+		{
+			name:       "absent definition leaves state empty",
+			definition: nil,
+			want:       "",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			input := &resources.ClusterPolicy{Definition: tt.definition}
+			input.Name = "my_policy"
+
+			got := (*ResourceClusterPolicy)(nil).PrepareState(input)
+
+			assert.Equal(t, tt.want, got.Definition)
+			assert.Equal(t, "my_policy", got.Name)
+		})
+	}
+}
diff --git a/bundle/direct/dresources/cluster_test.go b/bundle/direct/dresources/cluster_test.go
new file mode 100644
index 00000000000..7d3af4440d4
--- /dev/null
+++ b/bundle/direct/dresources/cluster_test.go
@@ -0,0 +1,68 @@
+package dresources
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/bundle/deployplan"
+	"github.com/databricks/cli/libs/structs/structpath"
+	"github.com/databricks/databricks-sdk-go/service/compute"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestClusterOverrideChangeDescLibraries(t *testing.T) {
+	jobLib := []compute.Library{{Whl: "/Workspace/job.whl"}}
+
+	tests := []struct {
+		name   string
+		path   string
+		change ChangeDesc
+		action deployplan.ActionType
+		reason string
+	}{
+		{
+			name:   "no section with remote libraries is unmanaged",
+			path:   "libraries",
+			change: ChangeDesc{Action: deployplan.Update, Old: nil, New: nil, Remote: jobLib},
+			action: deployplan.Skip,
+			reason: deployplan.ReasonUnmanaged,
+		},
+		{
+			name:   "removed section is unmanaged",
+			path:   "libraries",
+			change: ChangeDesc{Action: deployplan.Update, Old: jobLib, New: nil, Remote: jobLib},
+			action: deployplan.Skip,
+			reason: deployplan.ReasonUnmanaged,
+		},
+		{
+			name:   "empty list stays managed",
+			path:   "libraries",
+			change: ChangeDesc{Action: deployplan.Update, Old: nil, New: []compute.Library{}, Remote: jobLib},
+			action: deployplan.Update,
+		},
+		{
+			name:   "declared libraries stay managed",
+			path:   "libraries",
+			change: ChangeDesc{Action: deployplan.Update, Old: nil, New: jobLib, Remote: nil},
+			action: deployplan.Update,
+		},
+		{
+			// A per-library entry only exists when the config declares a list, so a missing New
+			// there is a removal to apply, not an unmanaged section.
+			name:   "element removal stays managed",
+			path:   "libraries[whl='/Workspace/job.whl']",
+			change: ChangeDesc{Action: deployplan.Update, Old: nil, New: nil, Remote: jobLib[0]},
+			action: deployplan.Update,
+		},
+	}
+
+	r := &ResourceCluster{}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			change := tt.change
+			require.NoError(t, r.OverrideChangeDesc(t.Context(), structpath.MustParsePath(tt.path), &change, nil))
+			assert.Equal(t, tt.action, change.Action)
+			assert.Equal(t, tt.reason, change.Reason)
+		})
+	}
+}
diff --git a/bundle/direct/dresources/config.go b/bundle/direct/dresources/config.go
index 70f6dbb1d8d..cc54d60a678 100644
--- a/bundle/direct/dresources/config.go
+++ b/bundle/direct/dresources/config.go
@@ -1,8 +1,12 @@
 package dresources
 
 import (
-	_ "embed"
+	"embed"
 	"encoding/json"
+	"fmt"
+	"io/fs"
+	"path"
+	"strings"
 	"sync"
 
 	"github.com/databricks/cli/libs/structs/structpath"
@@ -45,6 +49,17 @@ func (b *BackendDefaultRule) UnmarshalYAML(unmarshal func(any) error) error {
 	return nil
 }
 
+// RemoteAdditionRule marks a sub-object whose contents the backend co-owns whenever the
+// object's WhenSet field is set. Inside such an object, a field the config never declared
+// coming back set from the remote is an addition by the backend, not drift.
+//
+// Field is a prefix pattern selecting the object (omitted = the resource root); WhenSet is a
+// path within that object, relative to it, whose value gates the rule.
+type RemoteAdditionRule struct {
+	Field   *structpath.PatternNode `yaml:"field"`
+	WhenSet *structpath.PathNode    `yaml:"when_set"`
+}
+
 // ResourceLifecycleConfig defines lifecycle behavior for a resource type.
 type ResourceLifecycleConfig struct {
 	// IgnoreRemoteChanges: field patterns where remote changes are ignored (output-only, policy-set).
@@ -56,12 +71,62 @@ type ResourceLifecycleConfig struct {
 	// RecreateOnChanges: field patterns that trigger delete + create when changed.
 	RecreateOnChanges []FieldRule `yaml:"recreate_on_changes,omitempty"`
 
-	// UpdateIDOnChanges: field patterns that trigger UpdateWithID when changed.
-	UpdateIDOnChanges []FieldRule `yaml:"update_id_on_changes,omitempty"`
+	// ProvidedIDFields: field patterns that compose the resource's ID — its name,
+	// as opposed to a server-generated id. DoRead fetches by the ID recorded in
+	// state (the value the backend returned, e.g. a lowercased full_name), not by
+	// these config fields directly. So a remote-only difference on them can only be
+	// the backend normalizing what we sent: the resource was found at its ID, and a
+	// real out-of-band rename would change the ID and 404 (handled as resource-gone).
+	// A local change recreates (delete + create).
+	ProvidedIDFields []FieldRule `yaml:"provided_id_fields,omitempty"`
+
+	// UpdatableIDFields: like ProvidedIDFields these compose the resource's
+	// name-based ID, but the backend supports renaming in place. A local change
+	// triggers UpdateWithID (a rename; the ID changes) instead of delete + create. A
+	// remote-only difference is still skipped (see classifyIDField) — DoRead found
+	// the resource by its recorded ID, so it can only be backend normalization.
+	UpdatableIDFields []FieldRule `yaml:"updatable_id_fields,omitempty"`
+
+	// NormalizeSlash: string field patterns the UC API strips trailing slashes from.
+	// A change is skipped when local and remote differ only by trailing slashes.
+	NormalizeSlash []FieldRule `yaml:"normalize_slash,omitempty"`
+
+	// IgnoreRemoteAdditions: objects whose fields the backend may add to when a gate field
+	// is set. A field that is absent from both old and new state but present in the remote
+	// is skipped; a disagreement between config and remote is still an update.
+	IgnoreRemoteAdditions []RemoteAdditionRule `yaml:"ignore_remote_additions,omitempty"`
 
 	// BackendDefaults: fields where the backend may set defaults.
 	// When old and new are nil but remote is set, and the remote value matches allowed values (if specified), the change is skipped.
 	BackendDefaults []BackendDefaultRule `yaml:"backend_defaults,omitempty"`
+
+	// StableOutputFields: output-only fields the backend assigns at creation and
+	// never changes on update — typically an AIP resource name derived from the
+	// immutable ID (e.g. a postgres project's "name" = "projects/{project_id}").
+	// The backend owns the value, so it is validated against RemoteType (from
+	// which the resolver reads it); the field may or may not also appear in
+	// StateType.
+	//
+	// A cross-resource reference to such a field (${resources.X.name}) resolves
+	// from the remote cache during a keeps-ID update instead of being delayed
+	// until after apply. Without this, a dependent that treats the reference as
+	// part of its own immutable identity (a hierarchical parent/branch name)
+	// recreates spuriously on every in-place update of the target. See
+	// LookupReferencePreDeploy.
+	//
+	// This category only gates reference resolution; it never classifies a change,
+	// so the FieldRule Reason is unused (it would never surface in a plan) and is
+	// left unset in the YAML.
+	StableOutputFields []FieldRule `yaml:"stable_output_fields,omitempty"`
+
+	// HashedFields: field paths persisted to state as a content hash
+	// ("sha256:<hex>") instead of the raw value. This is only valid
+	// for large, equality-only fields that are never read back from state
+	// (e.g. serialized dashboards).
+	HashedFields []string `yaml:"hashed_fields,omitempty"`
+
+	// SensitiveFields: fields that are sensitive and should not be logged.
+	SensitiveFields []FieldRule `yaml:"sensitive_fields,omitempty"`
 }
 
 // Config is the root configuration structure for resource lifecycle behavior.
@@ -69,42 +134,80 @@ type Config struct {
 	Resources map[string]ResourceLifecycleConfig `yaml:"resources"`
 }
 
-//go:embed resources.yml
-var resourcesYAML []byte
+// One file per resource type under configs/: <resource_type>.yml holds the
+// hand-written rules and <resource_type>.generated.yml the ones derived from the
+// OpenAPI spec. A resource type without rules has no file. The file name is the
+// resource type, so each file holds the rules directly with no enclosing keys.
+//
+//go:embed configs/*.yml
+var configFS embed.FS
+
+const (
+	configDir = "configs"
+	ymlSuffix = ".yml"
 
-//go:embed resources.generated.yml
-var resourcesGeneratedYAML []byte
+	// generatedSuffix marks a generated file once ymlSuffix is trimmed.
+	generatedSuffix = ".generated"
+)
 
 var empty = ResourceLifecycleConfig{
-	IgnoreRemoteChanges: nil,
-	IgnoreLocalChanges:  nil,
-	RecreateOnChanges:   nil,
-	UpdateIDOnChanges:   nil,
-	BackendDefaults:     nil,
+	IgnoreRemoteChanges:   nil,
+	IgnoreLocalChanges:    nil,
+	RecreateOnChanges:     nil,
+	ProvidedIDFields:      nil,
+	UpdatableIDFields:     nil,
+	NormalizeSlash:        nil,
+	IgnoreRemoteAdditions: nil,
+	BackendDefaults:       nil,
+	StableOutputFields:    nil,
+	HashedFields:          nil,
+	SensitiveFields:       nil,
 }
 
-func mustParseConfig(data []byte) func() *Config {
-	return sync.OnceValue(func() *Config {
-		c := &Config{Resources: nil}
-		if err := yaml.Unmarshal(data, c); err != nil {
+// loadConfigs parses every embedded YAML file into the hand-written or the generated
+// config, keyed by the resource type the file is named after.
+var loadConfigs = sync.OnceValues(func() (*Config, *Config) {
+	handWritten := &Config{Resources: map[string]ResourceLifecycleConfig{}}
+	generated := &Config{Resources: map[string]ResourceLifecycleConfig{}}
+
+	names, err := fs.Glob(configFS, configDir+"/*"+ymlSuffix)
+	if err != nil {
+		panic(err)
+	}
+
+	for _, name := range names {
+		dst, resourceType := handWritten, strings.TrimSuffix(path.Base(name), ymlSuffix)
+		if trimmed, ok := strings.CutSuffix(resourceType, generatedSuffix); ok {
+			dst, resourceType = generated, trimmed
+		}
+
+		data, err := configFS.ReadFile(name)
+		if err != nil {
 			panic(err)
 		}
-		return c
-	})
-}
 
-var loadConfig = mustParseConfig(resourcesYAML)
+		var rc ResourceLifecycleConfig
+		if err := yaml.Unmarshal(data, &rc); err != nil {
+			panic(fmt.Errorf("%s: %w", name, err))
+		}
+
+		dst.Resources[resourceType] = rc
+	}
 
-var loadGeneratedConfig = mustParseConfig(resourcesGeneratedYAML)
+	return handWritten, generated
+})
 
-// MustLoadConfig returns the parsed resources.yml configuration.
+// MustLoadConfig returns the configuration parsed from the configs/<resource_type>.yml files.
 func MustLoadConfig() *Config {
-	return loadConfig()
+	handWritten, _ := loadConfigs()
+	return handWritten
 }
 
-// MustLoadGeneratedConfig returns the parsed resources.generated.yml configuration.
+// MustLoadGeneratedConfig returns the configuration parsed from the
+// configs/<resource_type>.generated.yml files.
 func MustLoadGeneratedConfig() *Config {
-	return loadGeneratedConfig()
+	_, generated := loadConfigs()
+	return generated
 }
 
 // GetResourceConfig returns the lifecycle config for a given resource type.
diff --git a/bundle/direct/dresources/config_test.go b/bundle/direct/dresources/config_test.go
index 6d871268975..1446a14e8e2 100644
--- a/bundle/direct/dresources/config_test.go
+++ b/bundle/direct/dresources/config_test.go
@@ -1,9 +1,16 @@
 package dresources
 
 import (
+	"io/fs"
+	"path"
+	"strings"
 	"testing"
 
+	"github.com/databricks/cli/libs/structs/structaccess"
+	"github.com/databricks/cli/libs/structs/structpath"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.yaml.in/yaml/v3"
 )
 
 func TestMustLoadConfig(t *testing.T) {
@@ -11,7 +18,188 @@ func TestMustLoadConfig(t *testing.T) {
 	assert.NotEmpty(t, cfg.Resources)
 }
 
+// TestConfigFiles guards the file naming the loader derives resource types from: a
+// misspelled name would silently drop every rule in the file. A file holding no rules
+// is a mistake too — an empty resource has no file at all.
+func TestConfigFiles(t *testing.T) {
+	names, err := fs.Glob(configFS, configDir+"/*"+ymlSuffix)
+	require.NoError(t, err)
+	require.NotEmpty(t, names)
+
+	for _, name := range names {
+		resourceType := strings.TrimSuffix(strings.TrimSuffix(path.Base(name), ymlSuffix), generatedSuffix)
+		assert.Containsf(t, SupportedResources, resourceType, "%s: %q is not a supported resource type", name, resourceType)
+	}
+
+	for _, cfg := range []*Config{MustLoadConfig(), MustLoadGeneratedConfig()} {
+		for resourceType, rc := range cfg.Resources {
+			assert.NotEqualf(t, empty, rc, "%s: declares no rules; delete the file", resourceType)
+		}
+	}
+}
+
 func TestGetResourceConfig(t *testing.T) {
 	assert.NotEmpty(t, GetResourceConfig("volumes").RecreateOnChanges)
 	assert.Empty(t, GetResourceConfig("nonexistent").RecreateOnChanges)
 }
+
+// TestFieldRuleOmittedIsRoot verifies that a FieldRule with no field is a root
+// rule matching every field, which the job_runs root rules rely on.
+func TestFieldRuleOmittedIsRoot(t *testing.T) {
+	someField := structpath.MustParsePath("dbt_commands")
+
+	var omitted FieldRule
+	require.NoError(t, yaml.Unmarshal([]byte("reason: input_only\n"), &omitted))
+	assert.True(t, omitted.Field.IsRoot(), "omitting field should be root")
+	assert.True(t, someField.HasPatternPrefix(omitted.Field), "omitting field should match every field")
+}
+
+// categoryRules projects ResourceLifecycleConfig's categories onto a
+// uniform [name, []FieldRule] shape so the redundancy check can iterate them.
+func categoryRules(c ResourceLifecycleConfig) []struct {
+	name  string
+	rules []FieldRule
+} {
+	backendAsFieldRules := make([]FieldRule, len(c.BackendDefaults))
+	for i, r := range c.BackendDefaults {
+		backendAsFieldRules[i] = FieldRule{Field: r.Field}
+	}
+	return []struct {
+		name  string
+		rules []FieldRule
+	}{
+		{"ignore_remote_changes", c.IgnoreRemoteChanges},
+		{"ignore_local_changes", c.IgnoreLocalChanges},
+		{"recreate_on_changes", c.RecreateOnChanges},
+		{"provided_id_fields", c.ProvidedIDFields},
+		{"updatable_id_fields", c.UpdatableIDFields},
+		{"backend_defaults", backendAsFieldRules},
+	}
+}
+
+// TestResourcesYMLNoRedundantRules guards against two redundancy classes in the
+// hand-written configs/<resource_type>.yml files: duplicate field entries within the
+// same category of a resource, and entries that the autogenerated
+// configs/<resource_type>.generated.yml already produces from the OpenAPI schema.
+func TestResourcesYMLNoRedundantRules(t *testing.T) {
+	handWritten := MustLoadConfig()
+	generated := MustLoadGeneratedConfig()
+
+	for resourceType, rc := range handWritten.Resources {
+		genCats := categoryRules(generated.Resources[resourceType])
+		genFields := make(map[string]map[string]bool, len(genCats))
+		for _, c := range genCats {
+			fields := make(map[string]bool, len(c.rules))
+			for _, r := range c.rules {
+				fields[r.Field.String()] = true
+			}
+			genFields[c.name] = fields
+		}
+
+		for _, c := range categoryRules(rc) {
+			seen := make(map[string]bool, len(c.rules))
+			for _, r := range c.rules {
+				field := r.Field.String()
+				if seen[field] {
+					t.Errorf("bundle/direct/dresources/configs/%s.yml: %s lists %q twice; remove the duplicate entry", resourceType, c.name, field)
+				}
+				seen[field] = true
+				if genFields[c.name][field] {
+					t.Errorf("bundle/direct/dresources/configs/%[1]s.yml: %[2]s entry %[3]q is already produced by %[1]s.generated.yml; remove it", resourceType, c.name, field)
+				}
+			}
+		}
+	}
+}
+
+// TestResourcesYMLNoRedundantMissingInRemote guards that ignore_remote_changes entries
+// in configs/<resource_type>.yml do not duplicate the automatic missing-in-remote suppression. A field
+// absent from RemoteType is already skipped automatically (reason: missing_in_remote) when
+// there is no local change, so a manual ignore_remote_changes entry for it is dead weight.
+//
+// This rests on RemapState being a dumb subset copy: absence from RemoteType reliably means
+// the field is input-only (accepted on write, never echoed on read). See the "RemapState is
+// a dumb copy" section in README.md. Note the redundancy claim only holds for the no-local-change
+// case — missing_in_remote carries an old==new guard, so a write-only field that legitimately
+// transitions old!=new->nil is NOT auto-handled and a declared entry there is load-bearing.
+func TestResourcesYMLNoRedundantMissingInRemote(t *testing.T) {
+	cfg := MustLoadConfig()
+	for resourceType, rc := range cfg.Resources {
+		adapter, err := NewAdapter(SupportedResources[resourceType], resourceType, nil)
+		if err != nil {
+			t.Errorf("%s.yml: failed to create adapter: %v", resourceType, err)
+			continue
+		}
+		for _, r := range rc.IgnoreRemoteChanges {
+			inState := structaccess.ValidatePattern(adapter.StateType(), r.Field) == nil
+			inRemote := structaccess.ValidatePattern(adapter.RemoteType(), r.Field) == nil
+			if inState && !inRemote {
+				t.Errorf("%s.yml: ignore_remote_changes entry %q is automatically handled (field absent from RemoteType); remove it", resourceType, r.Field)
+			}
+		}
+	}
+}
+
+// TestResourcesYMLActionCategoriesExclusive guards that a field is in at most one
+// of the action categories that decide a change's action. They are not
+// independent: classifyIDField (provided_id_fields, updatable_id_fields) runs
+// before recreate_on_changes in the ladder and short-circuits, so a field listed
+// in more than one would have all but the first entry silently dead — and the
+// categories disagree (e.g. provided_id_fields skips a remote-only diff that
+// recreate_on_changes would recreate).
+func TestResourcesYMLActionCategoriesExclusive(t *testing.T) {
+	cfg := MustLoadConfig()
+	for resourceType, rc := range cfg.Resources {
+		actionCats := []struct {
+			name  string
+			rules []FieldRule
+		}{
+			{"recreate_on_changes", rc.RecreateOnChanges},
+			{"provided_id_fields", rc.ProvidedIDFields},
+			{"updatable_id_fields", rc.UpdatableIDFields},
+		}
+		firstCat := map[string]string{}
+		for _, c := range actionCats {
+			for _, r := range c.rules {
+				field := r.Field.String()
+				if prev, ok := firstCat[field]; ok {
+					t.Errorf("bundle/direct/dresources/configs/%s.yml: %q is listed in both %s and %s; a field's action belongs to exactly one category", resourceType, field, prev, c.name)
+				} else {
+					firstCat[field] = c.name
+				}
+			}
+		}
+	}
+}
+
+// TestResourcesYMLRemoteAdditionGates validates every ignore_remote_additions rule against
+// the resource's state type: the field pattern must resolve, and so must the when_set gate
+// relative to it. Without this a typo produces a rule that silently never matches.
+func TestResourcesYMLRemoteAdditionGates(t *testing.T) {
+	for resourceType, rc := range MustLoadConfig().Resources {
+		adapter, err := NewAdapter(SupportedResources[resourceType], resourceType, nil)
+		require.NoError(t, err)
+
+		for _, rule := range rc.IgnoreRemoteAdditions {
+			field := rule.Field
+			require.False(t, rule.WhenSet.IsRoot(),
+				"%s: ignore_remote_additions entry %q needs a when_set", resourceType, field.String())
+
+			if !field.IsRoot() {
+				assert.NoError(t, structaccess.ValidatePattern(adapter.StateType(), field),
+					"%s: ignore_remote_additions field %q does not resolve in the state type", resourceType, field.String())
+			}
+			gate, err := structpath.ParsePattern(joinPattern(field, rule.WhenSet.String()))
+			require.NoError(t, err)
+			assert.NoError(t, structaccess.ValidatePattern(adapter.StateType(), gate),
+				"%s: ignore_remote_additions when_set %q does not resolve under %q", resourceType, rule.WhenSet, field.String())
+		}
+	}
+}
+
+func joinPattern(prefix *structpath.PatternNode, field string) string {
+	if prefix.IsRoot() {
+		return field
+	}
+	return prefix.String() + "." + field
+}
diff --git a/bundle/direct/dresources/configs/alerts.generated.yml b/bundle/direct/dresources/configs/alerts.generated.yml
new file mode 100644
index 00000000000..8b9e18006be
--- /dev/null
+++ b/bundle/direct/dresources/configs/alerts.generated.yml
@@ -0,0 +1,19 @@
+# Generated, do not edit.
+
+ignore_remote_changes:
+  - field: create_time
+    reason: spec:output_only
+  - field: effective_run_as
+    reason: spec:output_only
+  - field: evaluation.last_evaluated_at
+    reason: spec:output_only
+  - field: evaluation.state
+    reason: spec:output_only
+  - field: id
+    reason: spec:output_only
+  - field: lifecycle_state
+    reason: spec:output_only
+  - field: owner_user_name
+    reason: spec:output_only
+  - field: update_time
+    reason: spec:output_only
diff --git a/bundle/direct/dresources/configs/apps.generated.yml b/bundle/direct/dresources/configs/apps.generated.yml
new file mode 100644
index 00000000000..5e204b2a15f
--- /dev/null
+++ b/bundle/direct/dresources/configs/apps.generated.yml
@@ -0,0 +1,54 @@
+# Generated, do not edit.
+
+ignore_remote_changes:
+  - field: git_repository.caller_credential_id
+    reason: spec:input_only
+  - field: git_source
+    reason: spec:input_only
+  - field: source_code_path
+    reason: spec:input_only
+
+  - field: active_deployment
+    reason: spec:output_only
+  - field: app_status
+    reason: spec:output_only
+  - field: compute_status
+    reason: spec:output_only
+  - field: create_time
+    reason: spec:output_only
+  - field: creator
+    reason: spec:output_only
+  - field: default_git_source
+    reason: spec:output_only
+  - field: default_source_code_path
+    reason: spec:output_only
+  - field: effective_budget_policy_id
+    reason: spec:output_only
+  - field: effective_usage_policy_id
+    reason: spec:output_only
+  - field: effective_user_api_scopes
+    reason: spec:output_only
+  - field: id
+    reason: spec:output_only
+  - field: oauth2_app_client_id
+    reason: spec:output_only
+  - field: oauth2_app_integration_id
+    reason: spec:output_only
+  - field: pending_deployment
+    reason: spec:output_only
+  - field: resources[*].uc_securable.securable_kind
+    reason: spec:output_only
+  - field: service_principal_client_id
+    reason: spec:output_only
+  - field: service_principal_id
+    reason: spec:output_only
+  - field: service_principal_name
+    reason: spec:output_only
+  - field: thumbnail_url
+    reason: spec:output_only
+  - field: update_time
+    reason: spec:output_only
+  - field: updater
+    reason: spec:output_only
+  - field: url
+    reason: spec:output_only
diff --git a/bundle/direct/dresources/configs/apps.yml b/bundle/direct/dresources/configs/apps.yml
new file mode 100644
index 00000000000..a6725316bec
--- /dev/null
+++ b/bundle/direct/dresources/configs/apps.yml
@@ -0,0 +1,20 @@
+provided_id_fields:
+  - field: name
+    reason: id_field
+backend_defaults:
+  # Backend sets it "MEDIUM" when not specified in the config
+  - field: compute_size
+  # Backend enables token forwarding and reports true even when the config omits it,
+  # so an omitted field would otherwise plan an update on every deploy. An explicit
+  # value in the config still diffs normally.
+  - field: forward_user_access_token
+  # lifecycle.started is derived from remote compute status in RemapState, so the
+  # remote side always has a value. When the user omits lifecycle from config,
+  # both old and new are nil and backend_defaults correctly skips the remote value.
+  # When the user explicitly sets lifecycle.started, old/new are non-nil and normal
+  # drift detection applies (e.g. detecting out-of-band stop).
+  - field: lifecycle
+  - field: lifecycle.started
+ignore_remote_changes:
+  - field: space # This field is not yet supported by Update APIs but exposed in the API spec. TODO: fix when update APIs supports it.
+    reason: managed
diff --git a/bundle/direct/dresources/configs/catalogs.yml b/bundle/direct/dresources/configs/catalogs.yml
new file mode 100644
index 00000000000..143a74c447d
--- /dev/null
+++ b/bundle/direct/dresources/configs/catalogs.yml
@@ -0,0 +1,21 @@
+recreate_on_changes:
+  - field: storage_root
+    reason: immutable
+  - field: connection_name
+    reason: immutable
+  - field: provider_name
+    reason: immutable
+  - field: share_name
+    reason: immutable
+normalize_slash:
+  # UC strips a trailing slash from storage_root on create. The TF provider
+  # suppresses the same slash-only drift on this field (ucDirectoryPathSlashOnlySuppressDiff):
+  # https://github.com/databricks/terraform-provider-databricks/blob/main/catalog/resource_catalog.go
+  - field: storage_root
+    reason: uc_strips_trailing_slash
+updatable_id_fields:
+  - field: name
+    reason: id_changes
+backend_defaults:
+  # UC auto-populates unity.catalog.managed.<format>.defaults.* keys after create.
+  - field: properties['unity.catalog.managed.*.defaults.*']
diff --git a/bundle/direct/dresources/configs/cluster_policies.yml b/bundle/direct/dresources/configs/cluster_policies.yml
new file mode 100644
index 00000000000..6f2ee1e1b9b
--- /dev/null
+++ b/bundle/direct/dresources/configs/cluster_policies.yml
@@ -0,0 +1,6 @@
+backend_defaults:
+  # A policy authored with policy_family_id and no definition gets its definition
+  # computed from the policy family by the backend and returned on read. Config
+  # leaves definition empty, so old/new are nil and backend_defaults skips the
+  # server-computed remote value; without this every deploy sees drift and re-Edits.
+  - field: definition
diff --git a/bundle/direct/dresources/configs/clusters.yml b/bundle/direct/dresources/configs/clusters.yml
new file mode 100644
index 00000000000..b19d9c0483c
--- /dev/null
+++ b/bundle/direct/dresources/configs/clusters.yml
@@ -0,0 +1,57 @@
+# A cluster policy supplies cluster settings server-side: "fixed" elements always,
+# "defaultValue" elements when the request sets apply_policy_default_values. The bundle
+# is not the source for those, so the remote spec is legitimately a superset of what the
+# config declares and an added field is not drift. Measured backend behavior is pinned by
+# acceptance/bundle/resources/jobs/cluster_policy (fixed_addition, default_flag).
+# https://github.com/databricks/cli/issues/5179
+# https://github.com/databricks/cli/issues/6512
+ignore_remote_additions:
+  - when_set: policy_id
+
+ignore_remote_changes:
+  # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/clusters/resource_cluster.go#L361-L363
+  # s.SchemaPath("aws_attributes").SetSuppressDiff()
+  # s.SchemaPath("azure_attributes").SetSuppressDiff()
+  # s.SchemaPath("gcp_attributes").SetSuppressDiff()
+  - field: aws_attributes
+    reason: managed
+  - field: azure_attributes
+    reason: managed
+  - field: gcp_attributes
+    reason: managed
+backend_defaults:
+  # lifecycle.started is derived from remote cluster state in RemapState, so the
+  # remote side always has a value. When the user omits lifecycle from config,
+  # both old and new are nil and backend_defaults correctly skips the remote value.
+  # When the user explicitly sets lifecycle.started, old/new are non-nil and normal
+  # drift detection applies (e.g. detecting out-of-band terminate).
+  - field: lifecycle
+  - field: lifecycle.started
+  # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/clusters/resource_cluster.go#L331
+  # s.SchemaPath("enable_elastic_disk").SetComputed()
+  - field: enable_elastic_disk
+
+  # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/clusters/resource_cluster.go#L332
+  # s.SchemaPath("enable_local_disk_encryption").SetComputed()
+  - field: enable_local_disk_encryption
+
+  # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/clusters/resource_cluster.go#L333
+  # s.SchemaPath("node_type_id").SetComputed()
+  - field: node_type_id
+
+  # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/clusters/resource_cluster.go#L334
+  # s.SchemaPath("driver_node_type_id").SetComputed()
+  - field: driver_node_type_id
+
+  # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/clusters/resource_cluster.go#L335
+  # s.SchemaPath("driver_instance_pool_id").SetComputed()
+  - field: driver_instance_pool_id
+
+  # Terraform currently does not do this, but it is a field with backend default.
+  # See https://github.com/databricks/cli/issues/4418
+  - field: single_user_name
+
+# We have custom handler for this in cluster.go
+# https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/clusters/resource_cluster.go#L109-L118
+# DataSecurityModeDiffSuppressFunc: suppress when old != "" && new == ""
+#- field: data_security_mode
diff --git a/bundle/direct/dresources/configs/dashboards.generated.yml b/bundle/direct/dresources/configs/dashboards.generated.yml
new file mode 100644
index 00000000000..936b6e7f1c6
--- /dev/null
+++ b/bundle/direct/dresources/configs/dashboards.generated.yml
@@ -0,0 +1,17 @@
+# Generated, do not edit.
+
+recreate_on_changes:
+  - field: parent_path
+    reason: spec:immutable
+
+ignore_remote_changes:
+  - field: create_time
+    reason: spec:output_only
+  - field: dashboard_id
+    reason: spec:output_only
+  - field: lifecycle_state
+    reason: spec:output_only
+  - field: path
+    reason: spec:output_only
+  - field: update_time
+    reason: spec:output_only
diff --git a/bundle/direct/dresources/configs/dashboards.yml b/bundle/direct/dresources/configs/dashboards.yml
new file mode 100644
index 00000000000..f59f0e38208
--- /dev/null
+++ b/bundle/direct/dresources/configs/dashboards.yml
@@ -0,0 +1,17 @@
+ignore_remote_changes:
+  # "serialized_dashboard" locally and remotely will have different contents
+  # We only need to rely on etag here, and can skip this field for diff computation.
+  - field: serialized_dashboard
+    reason: etag_based
+
+  # "dataset_catalog" and "dataset_schema" are write-only fields that are not returned by the server.
+  # They will always differ between local config (which has values) and remote state (which has empty strings).
+  - field: dataset_catalog
+    reason: input_only
+  - field: dataset_schema
+    reason: input_only
+
+# "serialized_dashboard" holds inlined dashboard JSON that is never read back
+# from state, so we persist only its content hash.
+hashed_fields:
+  - serialized_dashboard
diff --git a/bundle/direct/dresources/configs/database_catalogs.generated.yml b/bundle/direct/dresources/configs/database_catalogs.generated.yml
new file mode 100644
index 00000000000..5eddcfd2a48
--- /dev/null
+++ b/bundle/direct/dresources/configs/database_catalogs.generated.yml
@@ -0,0 +1,8 @@
+# Generated, do not edit.
+
+ignore_remote_changes:
+  - field: create_database_if_not_exists
+    reason: spec:input_only
+
+  - field: uid
+    reason: spec:output_only
diff --git a/bundle/direct/dresources/configs/database_catalogs.yml b/bundle/direct/dresources/configs/database_catalogs.yml
new file mode 100644
index 00000000000..26eda6c377f
--- /dev/null
+++ b/bundle/direct/dresources/configs/database_catalogs.yml
@@ -0,0 +1,11 @@
+provided_id_fields:
+  - field: name
+    reason: id_field
+# The Database API has no UpdateDatabaseCatalog endpoint (the generated SDK
+# method is a stub that returns 501 NOT_IMPLEMENTED), so this resource
+# implements no DoUpdate and every settable field must recreate. The
+# complementary ignore_remote_changes block in database_catalogs.generated.yml
+# handles the read side (create_database_if_not_exists is input-only, uid is
+# output-only) so no-op deploys stay idempotent.
+recreate_on_changes:
+  - reason: immutable
diff --git a/bundle/direct/dresources/configs/database_instances.generated.yml b/bundle/direct/dresources/configs/database_instances.generated.yml
new file mode 100644
index 00000000000..66fdebab914
--- /dev/null
+++ b/bundle/direct/dresources/configs/database_instances.generated.yml
@@ -0,0 +1,78 @@
+# Generated, do not edit.
+
+recreate_on_changes:
+  - field: parent_instance_ref
+    reason: spec:immutable
+
+ignore_remote_changes:
+  - field: custom_tags
+    reason: spec:input_only
+  - field: custom_tags[*].key
+    reason: spec:input_only
+  - field: custom_tags[*].value
+    reason: spec:input_only
+  - field: enable_pg_native_login
+    reason: spec:input_only
+  - field: enable_readable_secondaries
+    reason: spec:input_only
+  - field: node_count
+    reason: spec:input_only
+  - field: parent_instance_ref.lsn
+    reason: spec:input_only
+  - field: retention_window_in_days
+    reason: spec:input_only
+  - field: stopped
+    reason: spec:input_only
+  - field: usage_policy_id
+    reason: spec:input_only
+
+  - field: child_instance_refs
+    reason: spec:output_only
+  - field: child_instance_refs[*].branch_time
+    reason: spec:output_only
+  - field: child_instance_refs[*].effective_lsn
+    reason: spec:output_only
+  - field: child_instance_refs[*].lsn
+    reason: spec:output_only
+  - field: child_instance_refs[*].name
+    reason: spec:output_only
+  - field: child_instance_refs[*].uid
+    reason: spec:output_only
+  - field: creation_time
+    reason: spec:output_only
+  - field: creator
+    reason: spec:output_only
+  - field: effective_capacity
+    reason: spec:output_only
+  - field: effective_custom_tags
+    reason: spec:output_only
+  - field: effective_custom_tags[*].key
+    reason: spec:output_only
+  - field: effective_custom_tags[*].value
+    reason: spec:output_only
+  - field: effective_enable_pg_native_login
+    reason: spec:output_only
+  - field: effective_enable_readable_secondaries
+    reason: spec:output_only
+  - field: effective_node_count
+    reason: spec:output_only
+  - field: effective_retention_window_in_days
+    reason: spec:output_only
+  - field: effective_stopped
+    reason: spec:output_only
+  - field: effective_usage_policy_id
+    reason: spec:output_only
+  - field: parent_instance_ref.effective_lsn
+    reason: spec:output_only
+  - field: parent_instance_ref.uid
+    reason: spec:output_only
+  - field: pg_version
+    reason: spec:output_only
+  - field: read_only_dns
+    reason: spec:output_only
+  - field: read_write_dns
+    reason: spec:output_only
+  - field: state
+    reason: spec:output_only
+  - field: uid
+    reason: spec:output_only
diff --git a/bundle/direct/dresources/configs/database_instances.yml b/bundle/direct/dresources/configs/database_instances.yml
new file mode 100644
index 00000000000..b6ab8dc9e8a
--- /dev/null
+++ b/bundle/direct/dresources/configs/database_instances.yml
@@ -0,0 +1,3 @@
+provided_id_fields:
+  - field: name
+    reason: id_field
diff --git a/bundle/direct/dresources/configs/experiments.generated.yml b/bundle/direct/dresources/configs/experiments.generated.yml
new file mode 100644
index 00000000000..afd372d58f2
--- /dev/null
+++ b/bundle/direct/dresources/configs/experiments.generated.yml
@@ -0,0 +1,9 @@
+# Generated, do not edit.
+
+recreate_on_changes:
+  - field: trace_location
+    reason: spec:immutable
+
+ignore_remote_changes:
+  - field: trace_location.uc_trace_location.effective_table_prefix
+    reason: spec:output_only
diff --git a/bundle/direct/dresources/configs/experiments.yml b/bundle/direct/dresources/configs/experiments.yml
new file mode 100644
index 00000000000..6a261514379
--- /dev/null
+++ b/bundle/direct/dresources/configs/experiments.yml
@@ -0,0 +1,11 @@
+# TF implementation: https://github.com/databricks/terraform-provider-databricks/blob/6c106e8e7052bb2726148d66309fd460ed444236/mlflow/resource_mlflow_experiment.go#L22
+recreate_on_changes:
+  - field: artifact_location
+    reason: immutable
+ignore_remote_changes:
+  # Tags updates are not supported by TF. This mirrors that behaviour.
+  - field: tags
+    reason: terraform_compat
+ignore_local_changes:
+  - field: tags
+    reason: terraform_compat
diff --git a/bundle/direct/dresources/configs/external_locations.generated.yml b/bundle/direct/dresources/configs/external_locations.generated.yml
new file mode 100644
index 00000000000..df2846b0a2f
--- /dev/null
+++ b/bundle/direct/dresources/configs/external_locations.generated.yml
@@ -0,0 +1,19 @@
+# Generated, do not edit.
+
+ignore_remote_changes:
+  - field: effective_enable_file_events
+    reason: spec:output_only
+  - field: effective_file_event_queue
+    reason: spec:output_only
+  - field: file_event_queue.managed_aqs.managed_resource_id
+    reason: spec:output_only
+  - field: file_event_queue.managed_pubsub.managed_resource_id
+    reason: spec:output_only
+  - field: file_event_queue.managed_sqs.managed_resource_id
+    reason: spec:output_only
+  - field: file_event_queue.provided_aqs.managed_resource_id
+    reason: spec:output_only
+  - field: file_event_queue.provided_pubsub.managed_resource_id
+    reason: spec:output_only
+  - field: file_event_queue.provided_sqs.managed_resource_id
+    reason: spec:output_only
diff --git a/bundle/direct/dresources/configs/external_locations.yml b/bundle/direct/dresources/configs/external_locations.yml
new file mode 100644
index 00000000000..55612ef68a6
--- /dev/null
+++ b/bundle/direct/dresources/configs/external_locations.yml
@@ -0,0 +1,10 @@
+recreate_on_changes:
+  - field: credential_name
+    reason: immutable
+  - field: encryption_details
+    reason: immutable
+  - field: file_event_queue
+    reason: immutable
+updatable_id_fields:
+  - field: name
+    reason: id_changes
diff --git a/bundle/direct/dresources/configs/features.generated.yml b/bundle/direct/dresources/configs/features.generated.yml
new file mode 100644
index 00000000000..51dae44ab90
--- /dev/null
+++ b/bundle/direct/dresources/configs/features.generated.yml
@@ -0,0 +1,36 @@
+# Generated, do not edit.
+
+recreate_on_changes:
+  - field: entities
+    reason: spec:immutable
+  - field: filter_condition
+    reason: spec:immutable
+  - field: full_name
+    reason: spec:immutable
+  - field: function
+    reason: spec:immutable
+  - field: inputs
+    reason: spec:immutable
+  - field: lineage_context
+    reason: spec:immutable
+  - field: source
+    reason: spec:immutable
+  - field: time_window
+    reason: spec:immutable
+  - field: timeseries_column
+    reason: spec:immutable
+
+ignore_remote_changes:
+  - field: lineage_context
+    reason: spec:input_only
+
+  - field: catalog_name
+    reason: spec:output_only
+  - field: created_at
+    reason: spec:output_only
+  - field: created_by
+    reason: spec:output_only
+  - field: name
+    reason: spec:output_only
+  - field: schema_name
+    reason: spec:output_only
diff --git a/bundle/direct/dresources/configs/features.yml b/bundle/direct/dresources/configs/features.yml
new file mode 100644
index 00000000000..c0cd511f2dd
--- /dev/null
+++ b/bundle/direct/dresources/configs/features.yml
@@ -0,0 +1,4 @@
+stable_output_fields:
+  # name is the last component of full_name, which is immutable, so it cannot change on an
+  # in-place update; see the stable_output_fields doc in config.go and ES-2202624.
+  - field: name
diff --git a/bundle/direct/dresources/configs/genie_spaces.generated.yml b/bundle/direct/dresources/configs/genie_spaces.generated.yml
new file mode 100644
index 00000000000..d9c3e63803d
--- /dev/null
+++ b/bundle/direct/dresources/configs/genie_spaces.generated.yml
@@ -0,0 +1,5 @@
+# Generated, do not edit.
+
+ignore_remote_changes:
+  - field: etag
+    reason: spec:output_only
diff --git a/bundle/direct/dresources/configs/genie_spaces.yml b/bundle/direct/dresources/configs/genie_spaces.yml
new file mode 100644
index 00000000000..41ab7d5aa1b
--- /dev/null
+++ b/bundle/direct/dresources/configs/genie_spaces.yml
@@ -0,0 +1,10 @@
+ignore_remote_changes:
+  # serialized_space locally (structured YAML) and remotely (JSON string) will differ
+  # textually, so we cannot meaningfully compare them for drift.
+  - field: serialized_space
+    reason: etag_based
+
+# "serialized_space" holds inlined Genie space JSON that is never read back
+# from state, so we persist only its content hash.
+hashed_fields:
+  - serialized_space
diff --git a/bundle/direct/dresources/configs/instance_pools.yml b/bundle/direct/dresources/configs/instance_pools.yml
new file mode 100644
index 00000000000..35fec4fbbb4
--- /dev/null
+++ b/bundle/direct/dresources/configs/instance_pools.yml
@@ -0,0 +1,24 @@
+# Field behaviors follow the TF provider tags cross-referenced with the edit API (compute.EditInstancePool):
+# https://github.com/databricks/terraform-provider-databricks/blob/main/pools/resource_instance_pool.go
+ignore_remote_changes:
+  # Backend fills cloud defaults the user omits; treated as managed like clusters above.
+  - field: aws_attributes
+    reason: managed
+  - field: azure_attributes
+    reason: managed
+  - field: gcp_attributes
+    reason: managed
+recreate_on_changes:
+  # force_new and not accepted by /instance-pools/edit.
+  - field: disk_spec
+  - field: node_type_flexibility
+  - field: preloaded_spark_versions
+  - field: preloaded_docker_images
+backend_defaults:
+  # Defaults to true server-side.
+  - field: enable_elastic_disk
+  # Backend applies a default of 60 minutes when the field is omitted.
+  - field: idle_instance_autotermination_minutes
+    values: [60]
+  # GCP seeds max_capacity (1000) when omitted; unconstrained as the default is cloud-dependent.
+  - field: max_capacity
diff --git a/bundle/direct/dresources/configs/internal_immutable_snapshots.yml b/bundle/direct/dresources/configs/internal_immutable_snapshots.yml
new file mode 100644
index 00000000000..7fcfd7cc35c
--- /dev/null
+++ b/bundle/direct/dresources/configs/internal_immutable_snapshots.yml
@@ -0,0 +1,2 @@
+recreate_on_changes:
+  - reason: immutable
diff --git a/bundle/direct/dresources/configs/job_runs.yml b/bundle/direct/dresources/configs/job_runs.yml
new file mode 100644
index 00000000000..5d6fabc85bf
--- /dev/null
+++ b/bundle/direct/dresources/configs/job_runs.yml
@@ -0,0 +1,44 @@
+# Every jobs.RunNow field is listed, so nothing the request carries is drift.
+# TestJobRunIgnoresEveryRequestField keeps the list in step with the SDK.
+# result_state is not in the list: comparing it against the remote is what
+# makes a run that has not succeeded visible to the plan.
+ignore_remote_changes:
+  - field: job_id
+    reason: immutable
+  - field: duration_target
+    reason: immutable
+  # GetRun reports job_parameters resolved against the job's defaults, and
+  # nests the rest under overriding_parameters.
+  - field: dbt_commands
+    reason: effective_vs_requested
+  - field: jar_params
+    reason: effective_vs_requested
+  - field: job_parameters
+    reason: effective_vs_requested
+  - field: notebook_params
+    reason: effective_vs_requested
+  - field: pipeline_params
+    reason: effective_vs_requested
+  - field: python_named_params
+    reason: effective_vs_requested
+  - field: python_params
+    reason: effective_vs_requested
+  - field: spark_submit_params
+    reason: effective_vs_requested
+  - field: sql_params
+    reason: effective_vs_requested
+  # Fields the run-now request carries that GetRun never reports back.
+  - field: idempotency_token
+    reason: not_returned_by_api
+  - field: only
+    reason: not_returned_by_api
+  - field: performance_target
+    reason: not_returned_by_api
+  - field: queue
+    reason: not_returned_by_api
+# A run is immutable and fire-once, so any change recreates it. Omitting
+# `field` matches every field (root; see TestFieldRuleOmittedIsRoot).
+# `field: ""` would instead match nothing. The one exception is a run that is
+# still going, which ResourceJobRun.OverrideChangeDesc downgrades to skip.
+recreate_on_changes:
+  - reason: immutable
diff --git a/bundle/direct/dresources/configs/jobs.yml b/bundle/direct/dresources/configs/jobs.yml
new file mode 100644
index 00000000000..c1a9b5a5790
--- /dev/null
+++ b/bundle/direct/dresources/configs/jobs.yml
@@ -0,0 +1,146 @@
+# version_id is set to the current DMS deployment version on every deploy, so
+# it changes constantly. Ignoring it as a local and remote change keeps that
+# churn from driving an update or showing as drift on its own; when the job is
+# updated for any other reason, DoUpdate sends the full config via Reset, so
+# the current version_id is still recorded. deployment_id is intentionally
+# left out: it is stable across versions, so a change to it is worth showing.
+ignore_local_changes:
+  - field: deployment.version_id
+    reason: auto
+
+ignore_remote_changes:
+  - field: deployment.version_id
+    reason: auto
+
+  # Same as clusters.{aws,azure,gcp}_attributes — see clusters/resource_cluster.go#L361-L363
+  # s.SchemaPath("aws_attributes").SetSuppressDiff()
+  # s.SchemaPath("azure_attributes").SetSuppressDiff()
+  # s.SchemaPath("gcp_attributes").SetSuppressDiff()
+  - field: tasks[*].new_cluster.aws_attributes
+    reason: managed
+  - field: tasks[*].new_cluster.azure_attributes
+    reason: managed
+  - field: tasks[*].new_cluster.gcp_attributes
+    reason: managed
+  - field: tasks[*].for_each_task.task.new_cluster.aws_attributes
+    reason: managed
+  - field: tasks[*].for_each_task.task.new_cluster.azure_attributes
+    reason: managed
+  - field: tasks[*].for_each_task.task.new_cluster.gcp_attributes
+    reason: managed
+  - field: job_clusters[*].new_cluster.aws_attributes
+    reason: managed
+  - field: job_clusters[*].new_cluster.azure_attributes
+    reason: managed
+  - field: job_clusters[*].new_cluster.gcp_attributes
+    reason: managed
+
+  # The Jobs API accepts apply_policy_default_values but does not return it
+  # in GET responses, so the remote is always nil even when the user sets it.
+  # Ignore remote-side nil so old==new (no user change) doesn't trigger drift.
+  - field: tasks[*].new_cluster.apply_policy_default_values
+    reason: not_returned_by_api
+  - field: tasks[*].for_each_task.task.new_cluster.apply_policy_default_values
+    reason: not_returned_by_api
+  - field: job_clusters[*].new_cluster.apply_policy_default_values
+    reason: not_returned_by_api
+
+  # The Jobs API accepts trigger.table_update.condition but never returns it
+  # in GET responses (verified for both ANY_UPDATED and ALL_UPDATED), so
+  # without this every plan after a successful deploy reports an update.
+  # https://github.com/databricks/cli/issues/6315
+  - field: trigger.table_update.condition
+    reason: input_only
+
+  # Same field via the multi-trigger list. Untested: creating a job with
+  # "triggers" fails with 404 FEATURE_DISABLED ("The 'triggers' field is in
+  # private preview and is not enabled for this workspace"), so there is no
+  # invariant config for it. Both shapes carry the same
+  # TableUpdateTriggerConfiguration message and the backend builds it from
+  # the same expression on read, so the field is dropped here too.
+  - field: triggers[*].table_update.condition
+    reason: input_only
+
+ignore_remote_additions:
+  # A cluster policy supplies cluster settings server-side: "fixed" elements always,
+  # "defaultValue" elements when the request sets apply_policy_default_values. The bundle
+  # is not the source for those, so the remote spec is legitimately a superset of what the
+  # config declares and an added field is not drift. Measured backend behavior is pinned by
+  # acceptance/bundle/resources/jobs/cluster_policy (fixed_addition, default_flag).
+  # https://github.com/databricks/cli/issues/5179
+  # https://github.com/databricks/cli/issues/6512
+  - field: tasks[*].new_cluster
+    when_set: policy_id
+  - field: tasks[*].for_each_task.task.new_cluster
+    when_set: policy_id
+  - field: job_clusters[*].new_cluster
+    when_set: policy_id
+
+backend_defaults:
+  # Same as clusters.enable_elastic_disk — see clusters/resource_cluster.go#L331
+  # s.SchemaPath("enable_elastic_disk").SetComputed()
+  - field: tasks[*].new_cluster.enable_elastic_disk
+  - field: tasks[*].for_each_task.task.new_cluster.enable_elastic_disk
+  - field: job_clusters[*].new_cluster.enable_elastic_disk
+
+  # Same as clusters.enable_local_disk_encryption — see clusters/resource_cluster.go#L332
+  # s.SchemaPath("enable_local_disk_encryption").SetComputed()
+  - field: tasks[*].new_cluster.enable_local_disk_encryption
+  - field: tasks[*].for_each_task.task.new_cluster.enable_local_disk_encryption
+  - field: job_clusters[*].new_cluster.enable_local_disk_encryption
+
+  # Same as clusters.node_type_id — see clusters/resource_cluster.go#L333
+  # s.SchemaPath("node_type_id").SetComputed()
+  - field: tasks[*].new_cluster.node_type_id
+  - field: tasks[*].for_each_task.task.new_cluster.node_type_id
+  - field: job_clusters[*].new_cluster.node_type_id
+
+  # Same as clusters.driver_node_type_id — see clusters/resource_cluster.go#L334
+  # s.SchemaPath("driver_node_type_id").SetComputed()
+  - field: tasks[*].new_cluster.driver_node_type_id
+  - field: tasks[*].for_each_task.task.new_cluster.driver_node_type_id
+  - field: job_clusters[*].new_cluster.driver_node_type_id
+
+  # Same as clusters.driver_instance_pool_id — see clusters/resource_cluster.go#L335
+  # s.SchemaPath("driver_instance_pool_id").SetComputed()
+  - field: tasks[*].new_cluster.driver_instance_pool_id
+  - field: tasks[*].for_each_task.task.new_cluster.driver_instance_pool_id
+  - field: job_clusters[*].new_cluster.driver_instance_pool_id
+
+  # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/jobs/resource_job.go#L531
+  # s.SchemaPath("format").SetComputed()
+  - field: format
+    values: ["MULTI_TASK", "SINGLE_TASK"]
+
+  # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/jobs/resource_job.go#L639
+  # s.SchemaPath("task", "run_if").SetSuppressDiffWithDefault(jobs.RunIfAllSuccess)
+  - field: "tasks[*].run_if"
+    values: ["ALL_SUCCESS"]
+
+  # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/jobs/resource_job.go#L640
+  # s.SchemaPath("task", "for_each_task", "task", "run_if").SetSuppressDiffWithDefault(jobs.RunIfAllSuccess)
+  - field: "tasks[*].for_each_task.task.run_if"
+    values: ["ALL_SUCCESS"]
+
+  # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/jobs/resource_job.go#L527
+  # s.SchemaPath("run_as").SetComputed()
+  - field: run_as
+
+  # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/jobs/resource_job.go#L521-L524
+  # s.SchemaPath("task", "notebook_task", "source").SetSuppressDiff()
+  # s.SchemaPath("task", "spark_python_task", "source").SetSuppressDiff()
+  # s.SchemaPath("task", "sql_task", "file", "source").SetSuppressDiff()
+  # s.SchemaPath("task", "dbt_task", "source").SetSuppressDiff()
+  - field: tasks[*].notebook_task.source
+  - field: tasks[*].for_each_task.task.notebook_task.source
+  - field: tasks[*].spark_python_task.source
+  - field: tasks[*].for_each_task.task.spark_python_task.source
+  - field: tasks[*].sql_task.file.source
+  - field: tasks[*].for_each_task.task.sql_task.file.source
+  - field: tasks[*].dbt_task.source
+  - field: tasks[*].for_each_task.task.dbt_task.source
+
+  # Same as clusters.data_security_mode: backend sets this when not specified
+  - field: tasks[*].new_cluster.data_security_mode
+  - field: tasks[*].for_each_task.task.new_cluster.data_security_mode
+  - field: job_clusters[*].new_cluster.data_security_mode
diff --git a/bundle/direct/dresources/configs/mcp_services.generated.yml b/bundle/direct/dresources/configs/mcp_services.generated.yml
new file mode 100644
index 00000000000..f9371afff03
--- /dev/null
+++ b/bundle/direct/dresources/configs/mcp_services.generated.yml
@@ -0,0 +1,7 @@
+# Generated, do not edit.
+
+ignore_remote_changes:
+  - field: config.source_connection.is_deleted
+    reason: spec:output_only
+  - field: config.source_connection.options
+    reason: spec:output_only
diff --git a/bundle/direct/dresources/configs/mcp_services.yml b/bundle/direct/dresources/configs/mcp_services.yml
new file mode 100644
index 00000000000..419cf45197c
--- /dev/null
+++ b/bundle/direct/dresources/configs/mcp_services.yml
@@ -0,0 +1,10 @@
+provided_id_fields:
+  # parent + mcp_service_id compose the server-derived resource name
+  # (mcp-services/{catalog}.{schema}.{mcp_service}), which is the ID the
+  # resource is fetched by. Both are immutable; a local change recreates.
+  # DoRead reconstructs them from the returned name, so a remote-only
+  # difference can only be normalization and is skipped.
+  - field: parent
+    reason: id_field
+  - field: mcp_service_id
+    reason: id_field
diff --git a/bundle/direct/dresources/configs/model_provider_services.generated.yml b/bundle/direct/dresources/configs/model_provider_services.generated.yml
new file mode 100644
index 00000000000..bd374986aca
--- /dev/null
+++ b/bundle/direct/dresources/configs/model_provider_services.generated.yml
@@ -0,0 +1,34 @@
+# Generated, do not edit.
+
+recreate_on_changes:
+  - field: config.provider_type
+    reason: spec:immutable
+
+ignore_remote_changes:
+  - field: config.amazon_bedrock.direct.aws_access_key.secret_access_key.plaintext
+    reason: spec:input_only
+  - field: config.anthropic.direct.api_key.plaintext
+    reason: spec:input_only
+  - field: config.azure_openai.direct.api_key.plaintext
+    reason: spec:input_only
+  - field: config.azure_openai.direct.entra_service_principal.client_secret.plaintext
+    reason: spec:input_only
+  - field: config.bedrock_mantle.direct.aws_access_key.secret_access_key.plaintext
+    reason: spec:input_only
+  - field: config.custom.direct.api_key.plaintext
+    reason: spec:input_only
+  - field: config.custom.direct.header_auth.api_key_value.plaintext
+    reason: spec:input_only
+  - field: config.gemini_enterprise.direct.api_key.plaintext
+    reason: spec:input_only
+  - field: config.microsoft_foundry.direct.api_key.plaintext
+    reason: spec:input_only
+  - field: config.microsoft_foundry.direct.entra_service_principal.client_secret.plaintext
+    reason: spec:input_only
+  - field: config.openai.direct.api_key.plaintext
+    reason: spec:input_only
+
+  - field: config.inference_table.is_deleted
+    reason: spec:output_only
+  - field: config.inference_table.table
+    reason: spec:output_only
diff --git a/bundle/direct/dresources/configs/model_provider_services.yml b/bundle/direct/dresources/configs/model_provider_services.yml
new file mode 100644
index 00000000000..f83495c340f
--- /dev/null
+++ b/bundle/direct/dresources/configs/model_provider_services.yml
@@ -0,0 +1,9 @@
+provided_id_fields:
+  # parent + model_provider_service_id compose the server-derived resource
+  # name (model-provider-services/{catalog}.{schema}.{model_provider_service}),
+  # which is the ID the resource is fetched by. Both immutable; a local
+  # change recreates. DoRead reconstructs them from the returned name.
+  - field: parent
+    reason: id_field
+  - field: model_provider_service_id
+    reason: id_field
diff --git a/bundle/direct/dresources/configs/model_services.generated.yml b/bundle/direct/dresources/configs/model_services.generated.yml
new file mode 100644
index 00000000000..1d2a16b848f
--- /dev/null
+++ b/bundle/direct/dresources/configs/model_services.generated.yml
@@ -0,0 +1,15 @@
+# Generated, do not edit.
+
+ignore_remote_changes:
+  - field: config.inference_table.is_deleted
+    reason: spec:output_only
+  - field: config.inference_table.table
+    reason: spec:output_only
+  - field: config.routing.destinations[*].is_deleted
+    reason: spec:output_only
+  - field: config.routing.destinations[*].provisioned_throughput_config.model
+    reason: spec:output_only
+  - field: config.routing.fallback.destinations[*].is_deleted
+    reason: spec:output_only
+  - field: config.routing.fallback.destinations[*].provisioned_throughput_config.model
+    reason: spec:output_only
diff --git a/bundle/direct/dresources/configs/model_services.yml b/bundle/direct/dresources/configs/model_services.yml
new file mode 100644
index 00000000000..d1b7a91e6e5
--- /dev/null
+++ b/bundle/direct/dresources/configs/model_services.yml
@@ -0,0 +1,10 @@
+provided_id_fields:
+  # parent + model_service_id compose the server-derived resource name
+  # (model-services/{catalog}.{schema}.{model_service}), which is the ID the
+  # resource is fetched by. Both are immutable; a local change recreates.
+  # DoRead reconstructs them from the returned name, so a remote-only
+  # difference can only be normalization and is skipped.
+  - field: parent
+    reason: id_field
+  - field: model_service_id
+    reason: id_field
diff --git a/bundle/direct/dresources/configs/model_serving_endpoints.generated.yml b/bundle/direct/dresources/configs/model_serving_endpoints.generated.yml
new file mode 100644
index 00000000000..71df6d6f832
--- /dev/null
+++ b/bundle/direct/dresources/configs/model_serving_endpoints.generated.yml
@@ -0,0 +1,34 @@
+# Generated, do not edit.
+
+ignore_remote_changes:
+  - field: config.served_entities[*].burst_scaling_enabled
+    reason: spec:input_only
+  - field: config.served_entities[*].external_model.ai21labs_config.ai21labs_api_key_plaintext
+    reason: spec:input_only
+  - field: config.served_entities[*].external_model.amazon_bedrock_config.aws_access_key_id_plaintext
+    reason: spec:input_only
+  - field: config.served_entities[*].external_model.amazon_bedrock_config.aws_secret_access_key_plaintext
+    reason: spec:input_only
+  - field: config.served_entities[*].external_model.anthropic_config.anthropic_api_key_plaintext
+    reason: spec:input_only
+  - field: config.served_entities[*].external_model.cohere_config.cohere_api_key_plaintext
+    reason: spec:input_only
+  - field: config.served_entities[*].external_model.custom_provider_config.api_key_auth.value_plaintext
+    reason: spec:input_only
+  - field: config.served_entities[*].external_model.custom_provider_config.bearer_token_auth.token_plaintext
+    reason: spec:input_only
+  - field: config.served_entities[*].external_model.databricks_model_serving_config.databricks_api_token_plaintext
+    reason: spec:input_only
+  - field: config.served_entities[*].external_model.google_cloud_vertex_ai_config.private_key_plaintext
+    reason: spec:input_only
+  - field: config.served_entities[*].external_model.openai_config.microsoft_entra_client_secret_plaintext
+    reason: spec:input_only
+  - field: config.served_entities[*].external_model.openai_config.openai_api_key_plaintext
+    reason: spec:input_only
+  - field: config.served_entities[*].external_model.palm_config.palm_api_key_plaintext
+    reason: spec:input_only
+  - field: config.served_models[*].burst_scaling_enabled
+    reason: spec:input_only
+
+  - field: telemetry_config.inference_table_config.name
+    reason: spec:output_only
diff --git a/bundle/direct/dresources/configs/model_serving_endpoints.yml b/bundle/direct/dresources/configs/model_serving_endpoints.yml
new file mode 100644
index 00000000000..c1f88a79a7c
--- /dev/null
+++ b/bundle/direct/dresources/configs/model_serving_endpoints.yml
@@ -0,0 +1,54 @@
+# TF implementation: https://github.com/databricks/terraform-provider-databricks/blob/6c106e8e7052bb2726148d66309fd460ed444236/mlflow/resource_mlflow_experiment.go#L22
+provided_id_fields:
+  - field: name
+    reason: id_field
+recreate_on_changes:
+  # description is immutable, can't be updated via API
+  - field: description
+    reason: immutable
+  - field: config.auto_capture_config.catalog_name
+    reason: immutable
+  - field: config.auto_capture_config.schema_name
+    reason: immutable
+  - field: config.auto_capture_config.table_name_prefix
+    reason: immutable
+  - field: route_optimized
+    reason: immutable
+ignore_remote_changes:
+  # budget_policy_id is in ServingEndpointDetailed but GET never populates it
+  # (the API returns effective_budget_policy_id instead), so the remote always
+  # reports empty. This is not a backend default, so suppress remote changes.
+  - field: budget_policy_id
+    reason: no_update_api
+  # table_names creates a profile and is not returned; inference_table_config round-trips.
+  # The spec annotated this input_only in the v0.171 spec but no longer does, so the rule
+  # has to be manual again.
+  - field: telemetry_config.table_names
+    reason: input_only
+ignore_local_changes:
+  - field: budget_policy_id
+    reason: no_update_api
+  - field: rate_limits
+    reason: not_implemented
+backend_defaults:
+  # Remote-only telemetry is reported as a change at this parent path.
+  - field: telemetry_config
+
+  # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/serving/resource_model_serving.go#L383
+  # common.CustomizeSchemaPath(m, "config", "served_entities", "name").SetComputed()
+  - field: config.served_entities[*].name
+
+  # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/serving/resource_model_serving.go#L384
+  # common.CustomizeSchemaPath(m, "config", "served_entities", "workload_type").SetComputed()
+  - field: config.served_entities[*].workload_type
+
+  # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/serving/resource_model_serving.go#L372
+  # common.CustomizeSchemaPath(m, "config", "auto_capture_config", "enabled").SetComputed()
+  - field: config.auto_capture_config.enabled
+
+  # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/serving/resource_model_serving.go#L370
+  # common.CustomizeSchemaPath(m, "config", "traffic_config").SetComputed()
+  # The backend defaults traffic_config (100% to the served entity) when the user
+  # does not specify one. Suppress only that default: if the user sets traffic_config
+  # and the remote diverges, normal drift detection still applies.
+  - field: config.traffic_config
diff --git a/bundle/direct/dresources/configs/models.yml b/bundle/direct/dresources/configs/models.yml
new file mode 100644
index 00000000000..15032fac685
--- /dev/null
+++ b/bundle/direct/dresources/configs/models.yml
@@ -0,0 +1,18 @@
+provided_id_fields:
+  # Recreate matches current behavior of Terraform. It is possible to rename without recreate
+  # but that would require dynamic select of the method during update since
+  # the ml.RenameModel needs to be called instead of ml.UpdateModel.
+  # We might reasonably choose to never fix this because this is a legacy resource.
+  - field: name
+    reason: terraform_compat
+# Allowing updates for tags requires dynamic selection of the method since
+# tags can only be updated by calling ml.SetModelTag or ml.DeleteModelTag methods.
+# Skip annotation matches the current behavior of Terraform where tags changes are showed
+# in plan but are just ignored / not applied. Since this is a legacy resource we might
+# reasonably choose to not fix it here as well.
+ignore_remote_changes:
+  - field: tags
+    reason: terraform_compat
+ignore_local_changes:
+  - field: tags
+    reason: terraform_compat
diff --git a/bundle/direct/dresources/configs/pipelines.generated.yml b/bundle/direct/dresources/configs/pipelines.generated.yml
new file mode 100644
index 00000000000..60639caed59
--- /dev/null
+++ b/bundle/direct/dresources/configs/pipelines.generated.yml
@@ -0,0 +1,5 @@
+# Generated, do not edit.
+
+ignore_remote_changes:
+  - field: ingestion_definition.source_type
+    reason: spec:output_only
diff --git a/bundle/direct/dresources/configs/pipelines.yml b/bundle/direct/dresources/configs/pipelines.yml
new file mode 100644
index 00000000000..59b92f268d6
--- /dev/null
+++ b/bundle/direct/dresources/configs/pipelines.yml
@@ -0,0 +1,72 @@
+recreate_on_changes:
+  - field: storage
+    reason: immutable
+  - field: ingestion_definition.connection_name
+    reason: immutable
+  - field: ingestion_definition.ingestion_gateway_id
+    reason: immutable
+  # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/pipelines/resource_pipeline.go#L204
+  - field: gateway_definition.connection_id
+    reason: immutable
+  - field: gateway_definition.connection_name
+    reason: immutable
+  - field: gateway_definition.gateway_storage_catalog
+    reason: immutable
+  - field: gateway_definition.gateway_storage_schema
+    reason: immutable
+  # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/pipelines/resource_pipeline.go#L209
+  - field: ingestion_definition.ingest_from_uc_foreign_catalog
+    reason: immutable
+
+# See jobs above: version_id is set on every deploy, so it is ignored as a
+# local/remote change. deployment_id is left out so a change to it still shows.
+ignore_remote_changes:
+  - field: deployment.version_id
+    reason: auto
+  # "id" is handled in a special way before any fields changed
+  # However, it is also part of RemotePipeline via CreatePipeline.
+  # Thus it shows up as a remote change since we don't set on the object.
+  - field: id
+    reason: "!drop"
+  # QQQ should this be here? When run_as is explicitly set, the GET response echoes it back
+  # as a structured run_as.user_name (verified on e2-dogfood with a real user), so it may not
+  # be truly input-only. The explicit-set case could not be confirmed on aws-cli, azure-cli,
+  # or gcp-cli: those envs authenticate as a service principal that lacks servicePrincipal.user
+  # on itself, so it can't self-bind run_as. In the default (unset) case on all three clouds,
+  # GET returns only the flat run_as_user_name and no structured run_as.
+  - field: run_as
+    reason: input_only
+  # Carried by CreatePipeline/EditPipeline but never returned by GET, so remote
+  # always reads back false and a config value of true never converges.
+  - field: allow_duplicate_names
+    reason: input_only
+
+ignore_local_changes:
+  - field: deployment.version_id
+    reason: auto
+  # "id" is output-only, providing it in config would be a mistake
+  - field: id
+    reason: "!drop"
+
+backend_defaults:
+  # Pipelines adds ANSI mode to the configuration map when it is omitted.
+  - field: configuration['spark.sql.ansi.enabled']
+    values: ["true"]
+
+  # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/pipelines/resource_pipeline.go#L218
+  # s.SchemaPath("cluster", "node_type_id").SetComputed()
+  - field: clusters[*].node_type_id
+
+  # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/pipelines/resource_pipeline.go#L219
+  # s.SchemaPath("cluster", "driver_node_type_id").SetComputed()
+  - field: clusters[*].driver_node_type_id
+
+  # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/pipelines/resource_pipeline.go#L220
+  # s.SchemaPath("cluster", "enable_local_disk_encryption").SetComputed()
+  - field: clusters[*].enable_local_disk_encryption
+
+  # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/pipelines/resource_pipeline.go#L229-L230
+  # s.SchemaPath("event_log", "catalog").SetComputed()
+  # s.SchemaPath("event_log", "schema").SetComputed()
+  - field: event_log.catalog
+  - field: event_log.schema
diff --git a/bundle/direct/dresources/configs/postgres_branches.generated.yml b/bundle/direct/dresources/configs/postgres_branches.generated.yml
new file mode 100644
index 00000000000..07e938094ce
--- /dev/null
+++ b/bundle/direct/dresources/configs/postgres_branches.generated.yml
@@ -0,0 +1,29 @@
+# Generated, do not edit.
+
+recreate_on_changes:
+  - field: source_branch
+    reason: spec:immutable
+  - field: source_branch_lsn
+    reason: spec:immutable
+  - field: source_branch_time
+    reason: spec:immutable
+  - field: source_snapshot
+    reason: spec:immutable
+
+ignore_remote_changes:
+  - field: expire_time
+    reason: spec:input_only
+  - field: is_protected
+    reason: spec:input_only
+  - field: no_expiry
+    reason: spec:input_only
+  - field: source_branch
+    reason: spec:input_only
+  - field: source_branch_lsn
+    reason: spec:input_only
+  - field: source_branch_time
+    reason: spec:input_only
+  - field: source_snapshot
+    reason: spec:input_only
+  - field: ttl
+    reason: spec:input_only
diff --git a/bundle/direct/dresources/configs/postgres_branches.yml b/bundle/direct/dresources/configs/postgres_branches.yml
new file mode 100644
index 00000000000..e256c724cd2
--- /dev/null
+++ b/bundle/direct/dresources/configs/postgres_branches.yml
@@ -0,0 +1,14 @@
+provided_id_fields:
+  # parent and branch_id are immutable (part of hierarchical name, not in API spec)
+  - field: parent
+    reason: id_field
+  - field: branch_id
+    reason: id_field
+ignore_local_changes:
+  # replace_existing only takes effect on create; toggling it later is a no-op.
+  - field: replace_existing
+    reason: "input_only; cannot be updated after create"
+stable_output_fields:
+  # name ("projects/{project_id}/branches/{branch_id}") is backend-assigned at
+  # creation and immutable; see the stable_output_fields doc in config.go and ES-2202624.
+  - field: name
diff --git a/bundle/direct/dresources/configs/postgres_catalogs.generated.yml b/bundle/direct/dresources/configs/postgres_catalogs.generated.yml
new file mode 100644
index 00000000000..63f0569c669
--- /dev/null
+++ b/bundle/direct/dresources/configs/postgres_catalogs.generated.yml
@@ -0,0 +1,13 @@
+# Generated, do not edit.
+
+recreate_on_changes:
+  - field: postgres_database
+    reason: spec:immutable
+
+ignore_remote_changes:
+  - field: branch
+    reason: spec:input_only
+  - field: create_database_if_missing
+    reason: spec:input_only
+  - field: postgres_database
+    reason: spec:input_only
diff --git a/bundle/direct/dresources/configs/postgres_catalogs.yml b/bundle/direct/dresources/configs/postgres_catalogs.yml
new file mode 100644
index 00000000000..c4f6945071f
--- /dev/null
+++ b/bundle/direct/dresources/configs/postgres_catalogs.yml
@@ -0,0 +1,10 @@
+provided_id_fields:
+  # catalog_id is part of the hierarchical name and immutable.
+  - field: catalog_id
+    reason: id_field
+recreate_on_changes:
+  # The Postgres SDK has no UpdateCatalog endpoint, so any local change
+  # requires delete+create. The OpenAPI spec only marks postgres_database
+  # as IMMUTABLE (handled by autogen); branch and create_database_if_missing
+  # need explicit entries here.
+  - reason: immutable
diff --git a/bundle/direct/dresources/configs/postgres_databases.generated.yml b/bundle/direct/dresources/configs/postgres_databases.generated.yml
new file mode 100644
index 00000000000..9a9eb664188
--- /dev/null
+++ b/bundle/direct/dresources/configs/postgres_databases.generated.yml
@@ -0,0 +1,7 @@
+# Generated, do not edit.
+
+ignore_remote_changes:
+  - field: postgres_database
+    reason: spec:input_only
+  - field: role
+    reason: spec:input_only
diff --git a/bundle/direct/dresources/configs/postgres_databases.yml b/bundle/direct/dresources/configs/postgres_databases.yml
new file mode 100644
index 00000000000..f9d65fbc398
--- /dev/null
+++ b/bundle/direct/dresources/configs/postgres_databases.yml
@@ -0,0 +1,14 @@
+provided_id_fields:
+  # parent and database_id are immutable (part of hierarchical name, not in API spec)
+  - field: parent
+    reason: id_field
+  - field: database_id
+    reason: id_field
+ignore_local_changes:
+  # replace_existing only takes effect on create; toggling it later is a no-op.
+  - field: replace_existing
+    reason: "input_only; cannot be updated after create"
+stable_output_fields:
+  # name ("projects/{p}/branches/{b}/databases/{database_id}") is backend-assigned
+  # at creation and immutable; see the stable_output_fields doc in config.go and ES-2202624.
+  - field: name
diff --git a/bundle/direct/dresources/configs/postgres_endpoints.generated.yml b/bundle/direct/dresources/configs/postgres_endpoints.generated.yml
new file mode 100644
index 00000000000..2560c7f5ef7
--- /dev/null
+++ b/bundle/direct/dresources/configs/postgres_endpoints.generated.yml
@@ -0,0 +1,23 @@
+# Generated, do not edit.
+
+recreate_on_changes:
+  - field: endpoint_type
+    reason: spec:immutable
+
+ignore_remote_changes:
+  - field: autoscaling_limit_max_cu
+    reason: spec:input_only
+  - field: autoscaling_limit_min_cu
+    reason: spec:input_only
+  - field: disabled
+    reason: spec:input_only
+  - field: endpoint_type
+    reason: spec:input_only
+  - field: group
+    reason: spec:input_only
+  - field: no_suspension
+    reason: spec:input_only
+  - field: settings
+    reason: spec:input_only
+  - field: suspend_timeout_duration
+    reason: spec:input_only
diff --git a/bundle/direct/dresources/configs/postgres_endpoints.yml b/bundle/direct/dresources/configs/postgres_endpoints.yml
new file mode 100644
index 00000000000..a9da4a06c9c
--- /dev/null
+++ b/bundle/direct/dresources/configs/postgres_endpoints.yml
@@ -0,0 +1,14 @@
+provided_id_fields:
+  # parent and endpoint_id are immutable (part of hierarchical name, not in API spec)
+  - field: parent
+    reason: id_field
+  - field: endpoint_id
+    reason: id_field
+ignore_local_changes:
+  # replace_existing only takes effect on create; toggling it later is a no-op.
+  - field: replace_existing
+    reason: "input_only; cannot be updated after create"
+stable_output_fields:
+  # name ("projects/{p}/branches/{b}/endpoints/{endpoint_id}") is backend-assigned
+  # at creation and immutable; see the stable_output_fields doc in config.go and ES-2202624.
+  - field: name
diff --git a/bundle/direct/dresources/configs/postgres_projects.generated.yml b/bundle/direct/dresources/configs/postgres_projects.generated.yml
new file mode 100644
index 00000000000..cf29cbf156a
--- /dev/null
+++ b/bundle/direct/dresources/configs/postgres_projects.generated.yml
@@ -0,0 +1,27 @@
+# Generated, do not edit.
+
+recreate_on_changes:
+  - field: pg_version
+    reason: spec:immutable
+
+ignore_remote_changes:
+  - field: budget_policy_id
+    reason: spec:input_only
+  - field: custom_tags
+    reason: spec:input_only
+  - field: custom_tags[*].key
+    reason: spec:input_only
+  - field: custom_tags[*].value
+    reason: spec:input_only
+  - field: default_branch
+    reason: spec:input_only
+  - field: default_endpoint_settings
+    reason: spec:input_only
+  - field: display_name
+    reason: spec:input_only
+  - field: enable_pg_native_login
+    reason: spec:input_only
+  - field: history_retention_duration
+    reason: spec:input_only
+  - field: pg_version
+    reason: spec:input_only
diff --git a/bundle/direct/dresources/configs/postgres_projects.yml b/bundle/direct/dresources/configs/postgres_projects.yml
new file mode 100644
index 00000000000..4c5079e7079
--- /dev/null
+++ b/bundle/direct/dresources/configs/postgres_projects.yml
@@ -0,0 +1,8 @@
+provided_id_fields:
+  # project_id is immutable (part of hierarchical name, not in API spec)
+  - field: project_id
+    reason: id_field
+stable_output_fields:
+  # name ("projects/{project_id}") is backend-assigned at creation and immutable;
+  # see the stable_output_fields doc in config.go and ES-2202624.
+  - field: name
diff --git a/bundle/direct/dresources/configs/postgres_roles.generated.yml b/bundle/direct/dresources/configs/postgres_roles.generated.yml
new file mode 100644
index 00000000000..d5b37104344
--- /dev/null
+++ b/bundle/direct/dresources/configs/postgres_roles.generated.yml
@@ -0,0 +1,13 @@
+# Generated, do not edit.
+
+ignore_remote_changes:
+  - field: attributes
+    reason: spec:input_only
+  - field: auth_method
+    reason: spec:input_only
+  - field: identity_type
+    reason: spec:input_only
+  - field: membership_roles
+    reason: spec:input_only
+  - field: postgres_role
+    reason: spec:input_only
diff --git a/bundle/direct/dresources/configs/postgres_roles.yml b/bundle/direct/dresources/configs/postgres_roles.yml
new file mode 100644
index 00000000000..2096b0d3d47
--- /dev/null
+++ b/bundle/direct/dresources/configs/postgres_roles.yml
@@ -0,0 +1,26 @@
+ignore_local_changes:
+  # replace_existing only takes effect on create; toggling it later is a no-op.
+  - field: replace_existing
+    reason: "input_only; cannot be updated after create"
+stable_output_fields:
+  # name ("projects/{project_id}/branches/{branch_id}/roles/{role_id}") is
+  # backend-assigned at creation and immutable; see the stable_output_fields doc
+  # in config.go and ES-2202624.
+  - field: name
+recreate_on_changes:
+  # parent and role_id are immutable (together they form the hierarchical name).
+  - field: parent
+    reason: immutable
+  - field: role_id
+    reason: immutable
+  # The PATCH update_mask only accepts spec.attributes and spec.membership_roles;
+  # the backend rejects spec.postgres_role, spec.auth_method, and spec.identity_type
+  # with 400 INVALID_PARAMETER_VALUE "Unknown field path in update_mask". These spec
+  # fields are not marked immutable in the OpenAPI definition yet, so the generator
+  # doesn't catch them — declare the constraint manually until upstream is fixed.
+  - field: postgres_role
+    reason: immutable
+  - field: auth_method
+    reason: immutable
+  - field: identity_type
+    reason: immutable
diff --git a/bundle/direct/dresources/configs/postgres_snapshot_schedules.yml b/bundle/direct/dresources/configs/postgres_snapshot_schedules.yml
new file mode 100644
index 00000000000..d81b0d30548
--- /dev/null
+++ b/bundle/direct/dresources/configs/postgres_snapshot_schedules.yml
@@ -0,0 +1,10 @@
+provided_id_fields:
+  # branch composes the schedule's hierarchical name
+  # ("{branch}/snapshot-schedule"); changing it targets a different branch's
+  # schedule, so it recreates (delete + create).
+  - field: branch
+    reason: id_field
+stable_output_fields:
+  # name ("{branch}/snapshot-schedule") is backend-assigned at creation and
+  # immutable; see the stable_output_fields doc in config.go and ES-2202624.
+  - field: name
diff --git a/bundle/direct/dresources/configs/postgres_synced_tables.generated.yml b/bundle/direct/dresources/configs/postgres_synced_tables.generated.yml
new file mode 100644
index 00000000000..082f93bd66e
--- /dev/null
+++ b/bundle/direct/dresources/configs/postgres_synced_tables.generated.yml
@@ -0,0 +1,41 @@
+# Generated, do not edit.
+
+ignore_remote_changes:
+  - field: accelerated_sync
+    reason: spec:input_only
+  - field: branch
+    reason: spec:input_only
+  - field: create_database_objects_if_missing
+    reason: spec:input_only
+  - field: existing_pipeline_id
+    reason: spec:input_only
+  - field: extra_columns
+    reason: spec:input_only
+  - field: extra_columns[*].column_name
+    reason: spec:input_only
+  - field: extra_columns[*].column_type
+    reason: spec:input_only
+  - field: extra_columns[*].compute
+    reason: spec:input_only
+  - field: extra_columns[*].maintenance
+    reason: spec:input_only
+  - field: new_pipeline_spec
+    reason: spec:input_only
+  - field: postgres_database
+    reason: spec:input_only
+  - field: primary_key_columns
+    reason: spec:input_only
+  - field: scheduling_policy
+    reason: spec:input_only
+  - field: source_table_full_name
+    reason: spec:input_only
+  - field: timeseries_key
+    reason: spec:input_only
+  - field: type_overrides
+    reason: spec:input_only
+  - field: type_overrides[*].column_name
+    reason: spec:input_only
+  - field: type_overrides[*].pg_type
+    reason: spec:input_only
+  - field: type_overrides[*].size
+    reason: spec:input_only
diff --git a/bundle/direct/dresources/configs/postgres_synced_tables.yml b/bundle/direct/dresources/configs/postgres_synced_tables.yml
new file mode 100644
index 00000000000..2a76ea3a253
--- /dev/null
+++ b/bundle/direct/dresources/configs/postgres_synced_tables.yml
@@ -0,0 +1,12 @@
+# The Postgres API has no UpdateSyncedTable endpoint, so every settable
+# field is recreate-only on the intent side (local YAML edit -> delete +
+# create). The complementary ignore_remote_changes block for this resource
+# lives in postgres_synced_tables.generated.yml and handles the read side: it suppresses
+# drift for the same fields because the GET API does not echo back the
+# spec. Together they make no-op deploys idempotent while a real config
+# edit still triggers a recreate. Same pattern as secret_scopes.
+provided_id_fields:
+  - field: synced_table_id
+    reason: id_field
+recreate_on_changes:
+  - reason: immutable
diff --git a/bundle/direct/dresources/configs/quality_monitors.yml b/bundle/direct/dresources/configs/quality_monitors.yml
new file mode 100644
index 00000000000..98f5b059016
--- /dev/null
+++ b/bundle/direct/dresources/configs/quality_monitors.yml
@@ -0,0 +1,6 @@
+provided_id_fields:
+  - field: table_name
+    reason: id_field
+recreate_on_changes:
+  - field: assets_dir
+    reason: immutable
diff --git a/bundle/direct/dresources/configs/registered_models.generated.yml b/bundle/direct/dresources/configs/registered_models.generated.yml
new file mode 100644
index 00000000000..9e376d45246
--- /dev/null
+++ b/bundle/direct/dresources/configs/registered_models.generated.yml
@@ -0,0 +1,5 @@
+# Generated, do not edit.
+
+ignore_remote_changes:
+  - field: browse_only
+    reason: spec:output_only
diff --git a/bundle/direct/dresources/configs/registered_models.yml b/bundle/direct/dresources/configs/registered_models.yml
new file mode 100644
index 00000000000..5d6bd9fd8de
--- /dev/null
+++ b/bundle/direct/dresources/configs/registered_models.yml
@@ -0,0 +1,34 @@
+ignore_remote_changes:
+  # Output-only timestamp/user fields populated by the backend on read.
+  # The user never sets them, so remote-only differences are ignored here
+  # rather than zeroed in RemapState.
+  - field: created_at
+    reason: output_only
+  - field: created_by
+    reason: output_only
+  - field: updated_at
+    reason: output_only
+  - field: updated_by
+    reason: output_only
+  # Aliases are managed on model versions through a separate API, and DoRead
+  # passes IncludeAliases=false, so GET never echoes them back. Without this a
+  # config that sets aliases reports a perpetual update (remote stays empty).
+  - field: aliases
+    reason: input_only
+provided_id_fields:
+  # The name can technically be updated without recreate. We recreate for now though
+  # to match TF implementation.
+  - field: name
+    reason: terraform_compat
+  - field: catalog_name
+    reason: id_field
+  - field: schema_name
+    reason: id_field
+recreate_on_changes:
+  - field: storage_location
+    reason: immutable
+backend_defaults:
+  # owner, full_name, metastore_id are Computed in TF (backend-set output fields).
+  - field: owner
+  - field: full_name
+  - field: metastore_id
diff --git a/bundle/direct/dresources/configs/schemas.yml b/bundle/direct/dresources/configs/schemas.yml
new file mode 100644
index 00000000000..8ef27e71d15
--- /dev/null
+++ b/bundle/direct/dresources/configs/schemas.yml
@@ -0,0 +1,17 @@
+provided_id_fields:
+  # UC lowercases identifier names; remote returns "myschema" for config "MySchema".
+  - field: name
+    reason: id_field
+  - field: catalog_name
+    reason: id_field
+recreate_on_changes:
+  - field: storage_root
+    reason: immutable
+normalize_slash:
+  - field: storage_root
+    reason: uc_strips_trailing_slash
+backend_defaults:
+  # UC auto-populates unity.catalog.managed.<format>.defaults.* keys after create.
+  # Without this, every subsequent plan produces an Update whose payload is empty,
+  # and UC rejects it with "UpdateSchema Nothing to update".
+  - field: properties['unity.catalog.managed.*.defaults.*']
diff --git a/bundle/direct/dresources/configs/secret_scopes.permissions.yml b/bundle/direct/dresources/configs/secret_scopes.permissions.yml
new file mode 100644
index 00000000000..61c734eb8c1
--- /dev/null
+++ b/bundle/direct/dresources/configs/secret_scopes.permissions.yml
@@ -0,0 +1,6 @@
+# Permissions for secret scopes use ResourceSecretScopeAcls.
+updatable_id_fields:
+  # When scope name changes, we need UpdateWithID trigger. This is necessary so that subsequent
+  # DoRead operations use the correct ID and we do not end up with a persistent drift.
+  - field: scope_name
+    reason: id_changes
diff --git a/bundle/direct/dresources/configs/secret_scopes.yml b/bundle/direct/dresources/configs/secret_scopes.yml
new file mode 100644
index 00000000000..12f6429a3d3
--- /dev/null
+++ b/bundle/direct/dresources/configs/secret_scopes.yml
@@ -0,0 +1,10 @@
+provided_id_fields:
+  - field: scope
+    reason: id_field
+recreate_on_changes:
+  - field: scope_backend_type
+    reason: immutable
+  - field: backend_azure_keyvault
+    reason: immutable
+  - field: initial_manage_principal
+    reason: immutable
diff --git a/bundle/direct/dresources/configs/secrets.generated.yml b/bundle/direct/dresources/configs/secrets.generated.yml
new file mode 100644
index 00000000000..34877e8fb10
--- /dev/null
+++ b/bundle/direct/dresources/configs/secrets.generated.yml
@@ -0,0 +1,32 @@
+# Generated, do not edit.
+
+recreate_on_changes:
+  - field: catalog_name
+    reason: spec:immutable
+  - field: name
+    reason: spec:immutable
+  - field: schema_name
+    reason: spec:immutable
+
+ignore_remote_changes:
+  - field: owner
+    reason: spec:input_only
+  - field: value
+    reason: spec:input_only
+
+  - field: create_time
+    reason: spec:output_only
+  - field: created_by
+    reason: spec:output_only
+  - field: effective_owner
+    reason: spec:output_only
+  - field: effective_value
+    reason: spec:output_only
+  - field: full_name
+    reason: spec:output_only
+  - field: metastore_id
+    reason: spec:output_only
+  - field: update_time
+    reason: spec:output_only
+  - field: updated_by
+    reason: spec:output_only
diff --git a/bundle/direct/dresources/configs/secrets.yml b/bundle/direct/dresources/configs/secrets.yml
new file mode 100644
index 00000000000..22ca3d7f49f
--- /dev/null
+++ b/bundle/direct/dresources/configs/secrets.yml
@@ -0,0 +1,3 @@
+sensitive_fields:
+  - field: value
+  - field: effective_value
diff --git a/bundle/direct/dresources/configs/sql_warehouses.yml b/bundle/direct/dresources/configs/sql_warehouses.yml
new file mode 100644
index 00000000000..582126d2d89
--- /dev/null
+++ b/bundle/direct/dresources/configs/sql_warehouses.yml
@@ -0,0 +1,37 @@
+ignore_remote_changes:
+  # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/sql/resource_sql_endpoint.go#L62
+  # common.CustomizeSchemaPath(m, "channel").SetSuppressDiff()
+  - field: channel
+    reason: managed
+
+  # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/sql/resource_sql_endpoint.go#L82
+  # common.CustomizeSchemaPath(m, "tags").SetSuppressDiff()
+  - field: tags
+    reason: managed
+
+  # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/sql/resource_sql_endpoint.go#L85-L87
+  # common.CustomizeSchemaPath(m, "warehouse_type").SetSuppressDiff()
+  - field: warehouse_type
+    reason: managed
+
+  # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/sql/resource_sql_endpoint.go#L75
+  # common.CustomizeSchemaPath(m, "min_num_clusters").SetSuppressDiff()
+  - field: min_num_clusters
+    reason: managed
+
+  # creator_name is readonly, can't be updated via API
+  - field: creator_name
+    reason: output_only
+
+backend_defaults:
+  # lifecycle.started is derived from remote warehouse state in RemapState, so the
+  # remote side always has a value. When the user omits lifecycle from config,
+  # both old and new are nil and backend_defaults correctly skips the remote value.
+  # When the user explicitly sets lifecycle.started, old/new are non-nil and normal
+  # drift detection applies (e.g. detecting out-of-band stop).
+  - field: lifecycle
+  - field: lifecycle.started
+
+  # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/sql/resource_sql_endpoint.go#L69
+  # m["enable_serverless_compute"].Computed = true
+  - field: enable_serverless_compute
diff --git a/bundle/direct/dresources/configs/synced_database_tables.generated.yml b/bundle/direct/dresources/configs/synced_database_tables.generated.yml
new file mode 100644
index 00000000000..2958becd442
--- /dev/null
+++ b/bundle/direct/dresources/configs/synced_database_tables.generated.yml
@@ -0,0 +1,24 @@
+# Generated, do not edit.
+
+ignore_remote_changes:
+  - field: database_instance_name
+    reason: spec:input_only
+  - field: logical_database_name
+    reason: spec:input_only
+  - field: spec.accelerated_sync
+    reason: spec:input_only
+  - field: spec.create_database_objects_if_missing
+    reason: spec:input_only
+  - field: spec.existing_pipeline_id
+    reason: spec:input_only
+  - field: spec.new_pipeline_spec
+    reason: spec:input_only
+
+  - field: data_synchronization_status
+    reason: spec:output_only
+  - field: effective_database_instance_name
+    reason: spec:output_only
+  - field: effective_logical_database_name
+    reason: spec:output_only
+  - field: unity_catalog_provisioning_state
+    reason: spec:output_only
diff --git a/bundle/direct/dresources/configs/synced_database_tables.yml b/bundle/direct/dresources/configs/synced_database_tables.yml
new file mode 100644
index 00000000000..deb5126e6e1
--- /dev/null
+++ b/bundle/direct/dresources/configs/synced_database_tables.yml
@@ -0,0 +1,11 @@
+provided_id_fields:
+  - field: name
+    reason: id_field
+# The Database API has no UpdateSyncedDatabaseTable endpoint (the generated
+# SDK method is a stub that returns 501 NOT_IMPLEMENTED), so this resource
+# implements no DoUpdate and every settable field must recreate. The
+# complementary ignore_remote_changes block in synced_database_tables.generated.yml
+# handles the read side (input-only and output-only fields) so no-op deploys
+# stay idempotent. Same pattern as postgres_synced_tables.
+recreate_on_changes:
+  - reason: immutable
diff --git a/bundle/direct/dresources/configs/vector_search_endpoints.yml b/bundle/direct/dresources/configs/vector_search_endpoints.yml
new file mode 100644
index 00000000000..34fe753bd2a
--- /dev/null
+++ b/bundle/direct/dresources/configs/vector_search_endpoints.yml
@@ -0,0 +1,12 @@
+provided_id_fields:
+  # The endpoint API has no rename; the endpoint is fetched by name.
+  - field: name
+    reason: id_field
+recreate_on_changes:
+  - field: endpoint_type
+    reason: immutable
+ignore_remote_changes:
+  # The API returns effective_budget_policy_id which may include inherited workspace policies,
+  # not the user-set budget_policy_id. Ignore until the API exposes the user-set value directly.
+  - field: budget_policy_id
+    reason: effective_vs_requested
diff --git a/bundle/direct/dresources/configs/vector_search_indexes.yml b/bundle/direct/dresources/configs/vector_search_indexes.yml
new file mode 100644
index 00000000000..9e5e044030c
--- /dev/null
+++ b/bundle/direct/dresources/configs/vector_search_indexes.yml
@@ -0,0 +1,28 @@
+provided_id_fields:
+  - field: name
+    reason: id_field
+recreate_on_changes:
+  # The index API has no rename or update path, so every config change
+  # has to go through delete + create.
+  - field: endpoint_name
+    reason: immutable
+  - field: index_type
+    reason: immutable
+  - field: index_subtype
+    reason: immutable
+  - field: primary_key
+    reason: immutable
+  - field: delta_sync_index_spec
+    reason: immutable
+  - field: direct_access_index_spec
+    reason: immutable
+ignore_remote_changes:
+  # The backend rewrites schema_json on create: user-facing type names
+  # ("integer", "long", "short", "byte") are stored in Unity Catalog as
+  # Spark type names ("int", "bigint", "smallint", "tinyint") and the
+  # columns come back in sorted key order, so GET never echoes the user's
+  # literal input. Without this rule the rewrite reads as a change to the
+  # immutable direct_access_index_spec and plans a destructive recreate
+  # that drops all upserted vectors.
+  - field: direct_access_index_spec.schema_json
+    reason: normalized_by_backend
diff --git a/bundle/direct/dresources/configs/volumes.yml b/bundle/direct/dresources/configs/volumes.yml
new file mode 100644
index 00000000000..d4b68e95875
--- /dev/null
+++ b/bundle/direct/dresources/configs/volumes.yml
@@ -0,0 +1,18 @@
+provided_id_fields:
+  - field: catalog_name
+    reason: id_field
+  - field: schema_name
+    reason: id_field
+recreate_on_changes:
+  - field: storage_location
+    reason: immutable
+  - field: volume_type
+    reason: immutable
+updatable_id_fields:
+  - field: name
+    reason: id_changes
+normalize_slash:
+  # UC strips trailing slashes on create; matches the Terraform provider's suppressLocationDiff.
+  # https://github.com/databricks/terraform-provider-databricks/blob/v1.65.1/catalog/resource_volume.go#L25
+  - field: storage_location
+    reason: uc_strips_trailing_slash
diff --git a/bundle/direct/dresources/dashboard.go b/bundle/direct/dresources/dashboard.go
index 6c4a9f1f611..c47fed477fc 100644
--- a/bundle/direct/dresources/dashboard.go
+++ b/bundle/direct/dresources/dashboard.go
@@ -2,11 +2,11 @@ package dresources
 
 import (
 	"context"
-	"encoding/json"
 	"fmt"
 	"path"
 	"slices"
 	"strings"
+	"time"
 
 	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/cli/bundle/deployplan"
@@ -27,6 +27,16 @@ type ResourceDashboard struct {
 
 type DashboardState struct {
 	resources.DashboardConfig
+	// Published reports whether the current draft content is published. DoRead sets it
+	// to true only when GetPublished succeeds AND the published revision is at least as
+	// new as the draft (revision_create_time >= update_time). A draft update without a
+	// republish leaves the previously-published content in place, but the API keeps
+	// returning it from GetPublished, so a naive "does GetPublished succeed" cannot
+	// detect stale content; the timestamp comparison can.
+	//
+	// The desired value (PrepareState) is always true, so when the published content is
+	// stale, remote Published=false differs from desired and the planner runs DoUpdate,
+	// which republishes.
 	Published bool `json:"published"`
 }
 
@@ -64,48 +74,6 @@ func (*ResourceDashboard) PrepareState(input *resources.Dashboard) *DashboardSta
 	}
 }
 
-func (r *ResourceDashboard) RemapState(state *DashboardState) *DashboardState {
-	forceSendFields := utils.FilterFields[DashboardState](state.ForceSendFields, []string{
-		"CreateTime",
-		"DashboardId",
-		"LifecycleState",
-		"Path",
-		"UpdateTime",
-		"SerializedDashboard",
-		"DatasetCatalog",
-		"DatasetSchema",
-	}...)
-
-	// EmbedCredentials must always be included in ForceSendFields to ensure it's serialized
-	// even when false (zero value).
-	if !slices.Contains(forceSendFields, "EmbedCredentials") {
-		forceSendFields = append(forceSendFields, "EmbedCredentials")
-	}
-
-	return &DashboardState{
-		DashboardConfig: resources.DashboardConfig{
-			DisplayName:         state.DisplayName,
-			Etag:                state.Etag,
-			ParentPath:          state.ParentPath,
-			WarehouseId:         state.WarehouseId,
-			SerializedDashboard: state.SerializedDashboard,
-			EmbedCredentials:    state.EmbedCredentials,
-			DatasetCatalog:      state.DatasetCatalog,
-			DatasetSchema:       state.DatasetSchema,
-
-			ForceSendFields: forceSendFields,
-
-			// Clear output only fields. They should not show up on remote diff computation.
-			CreateTime:     "",
-			DashboardId:    "",
-			LifecycleState: dashboards.LifecycleState(""),
-			Path:           "",
-			UpdateTime:     "",
-		},
-		Published: state.Published,
-	}
-}
-
 func (r *ResourceDashboard) DoRead(ctx context.Context, id string) (*DashboardState, error) {
 	var dashboard *dashboards.Dashboard
 	var publishedDashboard *dashboards.PublishedDashboard
@@ -140,8 +108,14 @@ func (r *ResourceDashboard) DoRead(ctx context.Context, id string) (*DashboardSt
 		return nil, apierr.ErrNotFound
 	}
 
-	// Determine if the dashboard is published
-	published := publishedErr == nil
+	// A dashboard is published (in the sense that matters for planning: the current
+	// draft content is what's published) only when GetPublished succeeds AND the
+	// published revision is at least as new as the draft. A draft update without a
+	// republish leaves stale content published, but GetPublished keeps returning it,
+	// so publishedErr == nil alone cannot detect staleness — the timestamp comparison
+	// can. If either timestamp is unparseable, fall back to publish-existence so we
+	// don't spuriously republish. See DashboardState.Published.
+	published := publishedErr == nil && publishedIsCurrent(dashboard, publishedDashboard)
 
 	forceSendFields := utils.FilterFields[DashboardState](dashboard.ForceSendFields)
 	// EmbedCredentials must always be included in ForceSendFields to ensure it's serialized
@@ -156,30 +130,51 @@ func (r *ResourceDashboard) DoRead(ctx context.Context, id string) (*DashboardSt
 	}
 
 	return &DashboardState{
-		DashboardConfig: resources.DashboardConfig{
-			DisplayName:         dashboard.DisplayName,
-			Etag:                dashboard.Etag,
-			WarehouseId:         dashboard.WarehouseId,
-			SerializedDashboard: dashboard.SerializedDashboard,
-			ParentPath:          ensureWorkspacePrefix(dashboard.ParentPath),
-			// diffs are detected via etags, which will change if dataset_catalog/dataset_schema is updated.
-			DatasetCatalog: "",
-			DatasetSchema:  "",
-
-			// Output only fields.
-			CreateTime:      dashboard.CreateTime,
-			DashboardId:     dashboard.DashboardId,
-			LifecycleState:  dashboard.LifecycleState,
-			Path:            dashboard.Path,
-			UpdateTime:      dashboard.UpdateTime,
-			ForceSendFields: forceSendFields,
-
-			EmbedCredentials: embedCredentials,
-		},
-		Published: published,
+		DisplayName:         dashboard.DisplayName,
+		Etag:                dashboard.Etag,
+		WarehouseId:         dashboard.WarehouseId,
+		SerializedDashboard: dashboard.SerializedDashboard,
+		ParentPath:          ensureWorkspacePrefix(dashboard.ParentPath),
+		// diffs are detected via etags, which will change if dataset_catalog/dataset_schema is updated.
+		DatasetCatalog: "",
+		DatasetSchema:  "",
+
+		// Output only fields.
+		CreateTime:      dashboard.CreateTime,
+		DashboardId:     dashboard.DashboardId,
+		LifecycleState:  dashboard.LifecycleState,
+		Path:            dashboard.Path,
+		UpdateTime:      dashboard.UpdateTime,
+		ForceSendFields: forceSendFields,
+
+		EmbedCredentials: embedCredentials,
+		Published:        published,
 	}, nil
 }
 
+// publishedIsCurrent reports whether the published revision reflects the current
+// draft, i.e. the dashboard was published after its last draft update. The published
+// API exposes no etag, only revision_create_time, so we compare it against the draft's
+// update_time. Both are RFC3339 timestamps set by the backend on a shared clock
+// (verified on AWS/GCP/Azure/dogfood: a publish always leaves revision_create_time >=
+// update_time, and a draft update pushes update_time ahead until the next publish).
+// If either timestamp is missing or unparseable, return true so we do not force a
+// spurious republish.
+func publishedIsCurrent(dashboard *dashboards.Dashboard, published *dashboards.PublishedDashboard) bool {
+	if published == nil {
+		return false
+	}
+	updateTime, err := time.Parse(time.RFC3339, dashboard.UpdateTime)
+	if err != nil {
+		return true
+	}
+	revisionTime, err := time.Parse(time.RFC3339, published.RevisionCreateTime)
+	if err != nil {
+		return true
+	}
+	return !revisionTime.Before(updateTime)
+}
+
 func prepareDashboardRequest(config *DashboardState) (dashboards.Dashboard, error) {
 	dashboard := dashboards.Dashboard{
 		DisplayName:         config.DisplayName,
@@ -196,17 +191,12 @@ func prepareDashboardRequest(config *DashboardState) (dashboards.Dashboard, erro
 		// Thus we need to filter such fields out.
 		ForceSendFields: utils.FilterFields[dashboards.Dashboard](config.ForceSendFields),
 	}
-	v := config.SerializedDashboard
-	if serializedDashboard, ok := v.(string); ok {
-		// If serialized dashboard is already a string, we can use it directly.
-		dashboard.SerializedDashboard = serializedDashboard
-	} else if v != nil {
-		// If it's inlined in the bundle config as a map, we need to marshal it to a string.
-		b, err := json.Marshal(v)
-		if err != nil {
-			return dashboards.Dashboard{}, fmt.Errorf("failed to marshal serialized dashboard: %w", err)
-		}
-		dashboard.SerializedDashboard = string(b)
+	switch v := config.SerializedDashboard.(type) {
+	case nil:
+	case string:
+		dashboard.SerializedDashboard = v
+	default:
+		return dashboards.Dashboard{}, fmt.Errorf("internal error: serialized_dashboard should have been normalized to a string, got %T", v)
 	}
 	return dashboard, nil
 }
@@ -241,26 +231,24 @@ func responseToState(createOrUpdateResp *dashboards.Dashboard, publishResp *dash
 	}
 
 	return &DashboardState{
-		DashboardConfig: resources.DashboardConfig{
-			DisplayName:         createOrUpdateResp.DisplayName,
-			Etag:                createOrUpdateResp.Etag,
-			WarehouseId:         createOrUpdateResp.WarehouseId,
-			SerializedDashboard: serializedDashboard,
-			ParentPath:          ensureWorkspacePrefix(createOrUpdateResp.ParentPath),
-			DatasetCatalog:      "",
-			DatasetSchema:       "",
-
-			// Output only fields
-			CreateTime:      createOrUpdateResp.CreateTime,
-			DashboardId:     createOrUpdateResp.DashboardId,
-			LifecycleState:  createOrUpdateResp.LifecycleState,
-			Path:            createOrUpdateResp.Path,
-			UpdateTime:      createOrUpdateResp.UpdateTime,
-			ForceSendFields: forceSendFields,
-
-			EmbedCredentials: embedCredentials,
-		},
-		Published: published,
+		DisplayName:         createOrUpdateResp.DisplayName,
+		Etag:                createOrUpdateResp.Etag,
+		WarehouseId:         createOrUpdateResp.WarehouseId,
+		SerializedDashboard: serializedDashboard,
+		ParentPath:          ensureWorkspacePrefix(createOrUpdateResp.ParentPath),
+		DatasetCatalog:      "",
+		DatasetSchema:       "",
+
+		// Output only fields
+		CreateTime:      createOrUpdateResp.CreateTime,
+		DashboardId:     createOrUpdateResp.DashboardId,
+		LifecycleState:  createOrUpdateResp.LifecycleState,
+		Path:            createOrUpdateResp.Path,
+		UpdateTime:      createOrUpdateResp.UpdateTime,
+		ForceSendFields: forceSendFields,
+
+		EmbedCredentials: embedCredentials,
+		Published:        published,
 	}
 }
 
@@ -281,7 +269,7 @@ func (r *ResourceDashboard) DoCreate(ctx context.Context, config *DashboardState
 	// The API returns 404 if the parent directory doesn't exist.
 	// If the parent directory doesn't exist, create it and try again.
 	if err != nil && apierr.IsMissing(err) {
-		err = r.client.Workspace.MkdirsByPath(ctx, config.ParentPath) //nolint:staticcheck // Deprecated in SDK v0.127.0. Migration to WorkspaceHierarchyService tracked separately.
+		err = r.client.Workspace.MkdirsByPath(ctx, config.ParentPath)
 		if err != nil {
 			return "", nil, fmt.Errorf("failed to create parent directory: %w", err)
 		}
@@ -357,7 +345,7 @@ func (r *ResourceDashboard) DoUpdate(ctx context.Context, id string, config *Das
 	return responseToState(updateResp, publishResp, dashboard.SerializedDashboard, config.Published), nil
 }
 
-func (r *ResourceDashboard) DoDelete(ctx context.Context, id string) error {
+func (r *ResourceDashboard) DoDelete(ctx context.Context, id string, _ *DashboardState) error {
 	return r.client.Lakeview.Trash(ctx, dashboards.TrashDashboardRequest{
 		DashboardId: id,
 	})
diff --git a/bundle/direct/dresources/dashboard_test.go b/bundle/direct/dresources/dashboard_test.go
index 177e1236221..ad93899234d 100644
--- a/bundle/direct/dresources/dashboard_test.go
+++ b/bundle/direct/dresources/dashboard_test.go
@@ -2,20 +2,20 @@ package dresources
 
 import (
 	"encoding/json"
+	"slices"
+	"strings"
 	"testing"
 
-	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/cli/libs/structs/structpath"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
 func TestDashboardState_JSONSerialization_PublishedField(t *testing.T) {
 	state := &DashboardState{
-		DashboardConfig: resources.DashboardConfig{
-			DisplayName: "test-dashboard",
-			WarehouseId: "warehouse123",
-		},
-		Published: true,
+		DisplayName: "test-dashboard",
+		WarehouseId: "warehouse123",
+		Published:   true,
 	}
 
 	data, err := json.Marshal(state)
@@ -23,3 +23,52 @@ func TestDashboardState_JSONSerialization_PublishedField(t *testing.T) {
 
 	assert.Contains(t, string(data), `"published":true`)
 }
+
+func TestDashboardCompactState(t *testing.T) {
+	requireLargeEnoughToHash(t, largeDashboard)
+
+	state := &DashboardState{
+		DisplayName:         "test-dashboard",
+		Etag:                "etag-123",
+		SerializedDashboard: largeDashboard,
+	}
+
+	out, err := CompactState(GetResourceConfig("dashboards"), state)
+	require.NoError(t, err)
+	compacted := out.(*DashboardState)
+
+	// serialized_dashboard is replaced by a content hash; other fields are preserved.
+	require.IsType(t, "", compacted.SerializedDashboard)
+	assert.True(t, strings.HasPrefix(compacted.SerializedDashboard.(string), stateHashPrefix))
+	assert.Equal(t, "test-dashboard", compacted.DisplayName)
+	assert.Equal(t, "etag-123", compacted.Etag)
+
+	// The original state is not mutated.
+	assert.Equal(t, largeDashboard, state.SerializedDashboard)
+
+	// Compacting is idempotent.
+	out2, err := CompactState(GetResourceConfig("dashboards"), compacted)
+	require.NoError(t, err)
+	assert.Equal(t, compacted.SerializedDashboard, out2.(*DashboardState).SerializedDashboard)
+}
+
+// TestDashboardSerializedDashboardStateRules documents that serialized_dashboard carries
+// two independent declarations: hashed_fields (persist only its hash, since the blob is
+// large) and ignore_remote_changes (the server normalizes the content, so its remote hash
+// never matches the config hash — drift is detected via etag instead). The two are
+// orthogonal in general; serialized_dashboard just happens to need both.
+func TestDashboardSerializedDashboardStateRules(t *testing.T) {
+	cfg := GetResourceConfig("dashboards")
+	path := structpath.NewStringKey(nil, "serialized_dashboard")
+
+	ignoresRemote := false
+	for _, rule := range cfg.IgnoreRemoteChanges {
+		if path.HasPatternPrefix(rule.Field) {
+			ignoresRemote = true
+			break
+		}
+	}
+
+	assert.True(t, slices.Contains(cfg.HashedFields, "serialized_dashboard"), "serialized_dashboard must be declared hashed_fields")
+	assert.True(t, ignoresRemote, "serialized_dashboard must be ignore_remote_changes (server normalizes the content)")
+}
diff --git a/bundle/direct/dresources/database_catalog.go b/bundle/direct/dresources/database_catalog.go
index ea97574d4b5..a1a7ebdef44 100644
--- a/bundle/direct/dresources/database_catalog.go
+++ b/bundle/direct/dresources/database_catalog.go
@@ -34,18 +34,7 @@ func (r *ResourceDatabaseCatalog) DoCreate(ctx context.Context, config *database
 	return result.Name, nil, nil
 }
 
-func (r *ResourceDatabaseCatalog) DoUpdate(ctx context.Context, id string, config *database.DatabaseCatalog, _ *PlanEntry) (*database.DatabaseCatalog, error) {
-	request := database.UpdateDatabaseCatalogRequest{
-		DatabaseCatalog: *config,
-		Name:            id,
-		UpdateMask:      "*",
-	}
-
-	_, err := r.client.Database.UpdateDatabaseCatalog(ctx, request)
-	return nil, err
-}
-
-func (r *ResourceDatabaseCatalog) DoDelete(ctx context.Context, id string) error {
+func (r *ResourceDatabaseCatalog) DoDelete(ctx context.Context, id string, _ *database.DatabaseCatalog) error {
 	return r.client.Database.DeleteDatabaseCatalog(ctx, database.DeleteDatabaseCatalogRequest{
 		Name: id,
 	})
diff --git a/bundle/direct/dresources/database_instance.go b/bundle/direct/dresources/database_instance.go
index e7a5e8d824c..2169a61fc8e 100644
--- a/bundle/direct/dresources/database_instance.go
+++ b/bundle/direct/dresources/database_instance.go
@@ -46,7 +46,7 @@ func (d *ResourceDatabaseInstance) DoUpdate(ctx context.Context, id string, conf
 	return nil, err
 }
 
-func (d *ResourceDatabaseInstance) WaitAfterCreate(ctx context.Context, config *database.DatabaseInstance) (*database.DatabaseInstance, error) {
+func (d *ResourceDatabaseInstance) WaitAfterCreate(ctx context.Context, id string, config *database.DatabaseInstance) (*database.DatabaseInstance, error) {
 	waiter := &database.WaitGetDatabaseInstanceDatabaseAvailable[database.DatabaseInstance]{
 		Response: config,
 		Name:     config.Name,
@@ -60,7 +60,7 @@ func (d *ResourceDatabaseInstance) WaitAfterCreate(ctx context.Context, config *
 	return nil, err
 }
 
-func (d *ResourceDatabaseInstance) DoDelete(ctx context.Context, name string) error {
+func (d *ResourceDatabaseInstance) DoDelete(ctx context.Context, name string, _ *database.DatabaseInstance) error {
 	return d.client.Database.DeleteDatabaseInstance(ctx, database.DeleteDatabaseInstanceRequest{
 		Name:            name,
 		Purge:           true,
diff --git a/bundle/direct/dresources/experiment.go b/bundle/direct/dresources/experiment.go
index de62720fe80..e4f2e8ebbd7 100644
--- a/bundle/direct/dresources/experiment.go
+++ b/bundle/direct/dresources/experiment.go
@@ -27,6 +27,7 @@ func (*ResourceExperiment) PrepareState(input *resources.MlflowExperiment) *ml.C
 		Name:             input.Name,
 		ArtifactLocation: input.ArtifactLocation,
 		Tags:             input.Tags,
+		TraceLocation:    input.TraceLocation,
 		ForceSendFields:  utils.FilterFields[ml.CreateExperiment](input.ForceSendFields),
 	}
 }
@@ -36,6 +37,7 @@ func (*ResourceExperiment) RemapState(experiment *ml.Experiment) *ml.CreateExper
 		Name:             experiment.Name,
 		ArtifactLocation: experiment.ArtifactLocation,
 		Tags:             experiment.Tags,
+		TraceLocation:    experiment.TraceLocation,
 		ForceSendFields:  utils.FilterFields[ml.CreateExperiment](experiment.ForceSendFields),
 	}
 }
@@ -68,7 +70,7 @@ func (r *ResourceExperiment) DoUpdate(ctx context.Context, id string, config *ml
 	return nil, r.client.Experiments.UpdateExperiment(ctx, updateReq)
 }
 
-func (r *ResourceExperiment) DoDelete(ctx context.Context, id string) error {
+func (r *ResourceExperiment) DoDelete(ctx context.Context, id string, _ *ml.CreateExperiment) error {
 	return r.client.Experiments.DeleteExperiment(ctx, ml.DeleteExperiment{
 		ExperimentId: id,
 	})
diff --git a/bundle/direct/dresources/external_location.go b/bundle/direct/dresources/external_location.go
index a9715b06190..26c957020ab 100644
--- a/bundle/direct/dresources/external_location.go
+++ b/bundle/direct/dresources/external_location.go
@@ -2,6 +2,7 @@ package dresources
 
 import (
 	"context"
+	"slices"
 
 	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/cli/libs/utils"
@@ -52,6 +53,13 @@ func (r *ResourceExternalLocation) DoCreate(ctx context.Context, config *catalog
 	return response.Name, response, nil
 }
 
+// See schemaForceSend. Unlike the other four this one is not probed: an external
+// location needs a storage credential with cloud IAM setup, which the test workspaces do
+// not provision, so its acceptance test is local-only. Comment is carried here because it
+// is the same field on the same UC PATCH family, where all four siblings clear on
+// {"comment": ""}; re-probe before adding anything else.
+var externalLocationForceSend = []string{"Comment"}
+
 // DoUpdate updates the external location in place and returns remote state.
 func (r *ResourceExternalLocation) DoUpdate(ctx context.Context, id string, config *catalog.CreateExternalLocation, _ *PlanEntry) (*catalog.ExternalLocationInfo, error) {
 	updateRequest := catalog.UpdateExternalLocation{
@@ -71,14 +79,14 @@ func (r *ResourceExternalLocation) DoUpdate(ctx context.Context, id string, conf
 		ReadOnly:                  config.ReadOnly,
 		SkipValidation:            config.SkipValidation,
 		Url:                       config.Url,
-		ForceSendFields:           utils.FilterFields[catalog.UpdateExternalLocation](config.ForceSendFields, "IsolationMode", "Owner"),
+		ForceSendFields:           utils.FilterFields[catalog.UpdateExternalLocation](append(slices.Clone(externalLocationForceSend), config.ForceSendFields...), "IsolationMode", "Owner"),
 	}
 
 	return r.client.ExternalLocations.Update(ctx, updateRequest)
 }
 
 // DoUpdateWithID updates the external location and returns the new ID if the name changes.
-func (r *ResourceExternalLocation) DoUpdateWithID(ctx context.Context, id string, config *catalog.CreateExternalLocation) (string, *catalog.ExternalLocationInfo, error) {
+func (r *ResourceExternalLocation) DoUpdateWithID(ctx context.Context, id string, config *catalog.CreateExternalLocation, _ *PlanEntry) (string, *catalog.ExternalLocationInfo, error) {
 	updateRequest := catalog.UpdateExternalLocation{
 		Comment:                   config.Comment,
 		CredentialName:            config.CredentialName,
@@ -96,7 +104,7 @@ func (r *ResourceExternalLocation) DoUpdateWithID(ctx context.Context, id string
 		ReadOnly:                  config.ReadOnly,
 		SkipValidation:            config.SkipValidation,
 		Url:                       config.Url,
-		ForceSendFields:           utils.FilterFields[catalog.UpdateExternalLocation](config.ForceSendFields, "IsolationMode", "Owner"),
+		ForceSendFields:           utils.FilterFields[catalog.UpdateExternalLocation](append(slices.Clone(externalLocationForceSend), config.ForceSendFields...), "IsolationMode", "Owner"),
 	}
 
 	if config.Name != id {
@@ -117,7 +125,7 @@ func (r *ResourceExternalLocation) DoUpdateWithID(ctx context.Context, id string
 	return newID, response, nil
 }
 
-func (r *ResourceExternalLocation) DoDelete(ctx context.Context, id string) error {
+func (r *ResourceExternalLocation) DoDelete(ctx context.Context, id string, _ *catalog.CreateExternalLocation) error {
 	return r.client.ExternalLocations.Delete(ctx, catalog.DeleteExternalLocationRequest{
 		Name:            id,
 		Force:           true,
diff --git a/bundle/direct/dresources/feature.go b/bundle/direct/dresources/feature.go
new file mode 100644
index 00000000000..8d95e3d0eac
--- /dev/null
+++ b/bundle/direct/dresources/feature.go
@@ -0,0 +1,59 @@
+package dresources
+
+import (
+	"context"
+	"slices"
+
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/service/ml"
+)
+
+// https://docs.databricks.com/api/workspace/featureengineering
+// Terraform: https://github.com/databricks/terraform-provider-databricks/blob/main/internal/providers/pluginfw/products/featureengineering/
+type ResourceFeature struct {
+	client *databricks.WorkspaceClient
+}
+
+func (*ResourceFeature) New(client *databricks.WorkspaceClient) *ResourceFeature {
+	return &ResourceFeature{client: client}
+}
+
+func (*ResourceFeature) PrepareState(input *resources.Feature) *ml.Feature {
+	return &input.Feature
+}
+
+func (r *ResourceFeature) DoRead(ctx context.Context, id string) (*ml.Feature, error) {
+	return r.client.FeatureEngineering.GetFeature(ctx, ml.GetFeatureRequest{FullName: id})
+}
+
+func (r *ResourceFeature) DoCreate(ctx context.Context, config *ml.Feature) (string, *ml.Feature, error) {
+	response, err := r.client.FeatureEngineering.CreateFeature(ctx, ml.CreateFeatureRequest{Feature: *config})
+	if err != nil {
+		return "", nil, err
+	}
+	return response.FullName, response, nil
+}
+
+// The update endpoint rejects a mask containing anything else, so "*" cannot be used. Every other
+// field is excluded at plan level in configs/features.yml and features.generated.yml.
+const featureUpdateMask = "description"
+
+func (r *ResourceFeature) DoUpdate(ctx context.Context, id string, config *ml.Feature, _ *PlanEntry) (*ml.Feature, error) {
+	// The whole feature goes in the body, with the mask limiting what is applied: full_name,
+	// function and source have no omitempty, so a body built from just the updatable fields would
+	// send them blanked out. Description is forced so clearing it sends "" rather than omitting it.
+	update := *config
+	update.FullName = id
+	update.ForceSendFields = append(slices.Clone(config.ForceSendFields), "Description")
+
+	return r.client.FeatureEngineering.UpdateFeature(ctx, ml.UpdateFeatureRequest{
+		FullName:   id,
+		Feature:    update,
+		UpdateMask: featureUpdateMask,
+	})
+}
+
+func (r *ResourceFeature) DoDelete(ctx context.Context, id string, _ *ml.Feature) error {
+	return r.client.FeatureEngineering.DeleteFeature(ctx, ml.DeleteFeatureRequest{FullName: id})
+}
diff --git a/bundle/direct/dresources/genie_space.go b/bundle/direct/dresources/genie_space.go
new file mode 100644
index 00000000000..30c8a07485f
--- /dev/null
+++ b/bundle/direct/dresources/genie_space.go
@@ -0,0 +1,230 @@
+package dresources
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"slices"
+	"strings"
+
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/cli/bundle/deployplan"
+	"github.com/databricks/cli/libs/structs/structpath"
+	"github.com/databricks/cli/libs/utils"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/service/dashboards"
+)
+
+// ResourceGenieSpace mirrors the dashboard resource pattern (see dashboard.go),
+// with these intentional divergences:
+//   - No Published wrapper: Genie spaces have no publish lifecycle, so
+//     PrepareState returns the config directly.
+//   - responseToGenieSpaceConfig maps fewer fields: Genie has no LifecycleState /
+//     CreateTime / Path / UpdateTime output-only fields to scrub.
+//   - DoUpdate omits the etag (dashboard sends it as an If-Match guard): the
+//     backend bumps the etag when it migrates serialized_space to a newer
+//     schema version, so sending a stale etag would 409 the update after a
+//     migration. Drift is still detected on read via OverrideChangeDesc.
+//   - DoCreate has expanded missing-parent-path detection: see
+//     isMissingGenieParentPathError below.
+//
+// Permissions follow the standard /permissions/genie/{id} endpoint and are wired
+// up via the generic permissions adapter (permissions.go).
+type ResourceGenieSpace struct {
+	client *databricks.WorkspaceClient
+}
+
+func (*ResourceGenieSpace) New(client *databricks.WorkspaceClient) *ResourceGenieSpace {
+	return &ResourceGenieSpace{client: client}
+}
+
+func (*ResourceGenieSpace) PrepareState(input *resources.GenieSpace) *resources.GenieSpaceConfig {
+	return &input.GenieSpaceConfig
+}
+
+func (r *ResourceGenieSpace) DoRead(ctx context.Context, id string) (*resources.GenieSpaceConfig, error) {
+	space, err := r.client.Genie.GetSpace(ctx, dashboards.GenieGetSpaceRequest{
+		SpaceId:                id,
+		IncludeSerializedSpace: true, // otherwise etag isn't returned
+		ForceSendFields:        nil,
+	})
+	if err != nil {
+		return nil, err
+	}
+	return responseToGenieSpaceConfig(space, space.SerializedSpace), nil
+}
+
+// prepareGenieSpaceRequest returns the serialized_space body to send to the API.
+// ConfigureGenieSpaceSerializedSpace normalizes serialized_space to a JSON string
+// (read from file_path, or marshalled from inline YAML) before the deploy engine
+// runs, so the value is always a string or unset by this point.
+func prepareGenieSpaceRequest(config *resources.GenieSpaceConfig) (string, error) {
+	switch v := config.SerializedSpace.(type) {
+	case nil:
+		return "", nil
+	case string:
+		return v, nil
+	default:
+		return "", fmt.Errorf("internal error: serialized_space should have been normalized to a string, got %T", v)
+	}
+}
+
+func responseToGenieSpaceConfig(space *dashboards.GenieSpace, serializedSpace string) *resources.GenieSpaceConfig {
+	// SerializedSpace is excluded so it is never force-sent as an empty value; it is always
+	// populated from the bundle config on write. Done here (rather than in a RemapState) so
+	// every remote-producing path (DoRead/DoCreate/DoUpdate) yields the same force-send set.
+	forceSendFields := utils.FilterFields[resources.GenieSpaceConfig](space.ForceSendFields, "SerializedSpace")
+
+	return &resources.GenieSpaceConfig{
+		Description:     space.Description,
+		Etag:            space.Etag,
+		Title:           space.Title,
+		WarehouseId:     space.WarehouseId,
+		ParentPath:      ensureWorkspacePrefix(space.ParentPath),
+		SerializedSpace: serializedSpace,
+
+		ForceSendFields: forceSendFields,
+	}
+}
+
+// isMissingGenieParentPathError reports whether the given Create error means
+// "the parent workspace folder does not exist", so DoCreate can mkdir and retry.
+//
+// Dashboard handles the equivalent condition with a plain apierr.IsMissing
+// check (see ResourceDashboard.DoCreate). Genie cannot, because it surfaces
+// the same condition in two different shapes depending on the workspace's
+// backend version:
+//
+//  1. Standard missing-resource error: HTTP 404, ErrorCode RESOURCE_DOES_NOT_EXIST.
+//     Caught by apierr.IsMissing. Observed on workspaces running the newer
+//     Genie service implementation.
+//  2. HTTP 400 with ErrorCode INVALID_PARAMETER_VALUE and a message of the
+//     form "Tree node with path '<path>' does not exist". Observed on
+//     workspaces still backed by the legacy implementation during integration
+//     testing in early 2026 (aws-prod-ucws and azure-prod-ucws clusters at
+//     the time). The string match is intentional: there is no distinct error
+//     code to key on.
+//
+// Both forms unambiguously mean "create the parent and retry once".
+func isMissingGenieParentPathError(err error) bool {
+	if apierr.IsMissing(err) {
+		return true
+	}
+
+	apiErr, ok := errors.AsType[*apierr.APIError](err)
+	if !ok {
+		return false
+	}
+
+	return apiErr.StatusCode == http.StatusBadRequest &&
+		apiErr.ErrorCode == "INVALID_PARAMETER_VALUE" &&
+		strings.Contains(apiErr.Message, "Tree node with path") &&
+		strings.Contains(apiErr.Message, "does not exist")
+}
+
+func (r *ResourceGenieSpace) DoCreate(ctx context.Context, config *resources.GenieSpaceConfig) (string, *resources.GenieSpaceConfig, error) {
+	serializedSpace, err := prepareGenieSpaceRequest(config)
+	if err != nil {
+		return "", nil, err
+	}
+
+	req := dashboards.GenieCreateSpaceRequest{
+		Description:     config.Description,
+		Title:           config.Title,
+		WarehouseId:     config.WarehouseId,
+		ParentPath:      config.ParentPath,
+		SerializedSpace: serializedSpace,
+
+		ForceSendFields: utils.FilterFields[dashboards.GenieCreateSpaceRequest](config.ForceSendFields),
+	}
+
+	createResp, err := r.client.Genie.CreateSpace(ctx, req)
+
+	// Retry once after creating the parent directory when the workspace folder
+	// is missing. Genie can surface this either as a standard missing-resource
+	// error or as INVALID_PARAMETER_VALUE with a "Tree node ... does not exist"
+	// message depending on the backend.
+	if err != nil && isMissingGenieParentPathError(err) {
+		err = r.client.Workspace.MkdirsByPath(ctx, config.ParentPath)
+		if err != nil {
+			return "", nil, fmt.Errorf("failed to create parent directory: %w", err)
+		}
+		createResp, err = r.client.Genie.CreateSpace(ctx, req)
+	}
+	if err != nil {
+		return "", nil, err
+	}
+
+	// Persist the etag in state. The deploy framework saves `config` (the input
+	// to DoCreate) as the state record, so mutating it here is what gets the
+	// backend-returned etag onto disk for the next plan's drift check.
+	// Matches the dashboard pattern (dashboard.go DoCreate).
+	config.Etag = createResp.Etag
+
+	return createResp.SpaceId, responseToGenieSpaceConfig(createResp, serializedSpace), nil
+}
+
+// description is force-sent on update so that clearing it in config clears it on the space.
+// Without this the omitempty field is dropped from the request and the old value drifts back on
+// every plan. Verified against a real workspace: UpdateSpace accepts {"description": ""} as a clear.
+var genieSpaceForceSend = []string{"Description"}
+
+func (r *ResourceGenieSpace) DoUpdate(ctx context.Context, id string, config *resources.GenieSpaceConfig, _ *PlanEntry) (*resources.GenieSpaceConfig, error) {
+	serializedSpace, err := prepareGenieSpaceRequest(config)
+	if err != nil {
+		return nil, err
+	}
+
+	// Always send serialized_space so the deploy converges the space to the
+	// bundle config (the bundle is the source of truth, mirroring dashboards).
+	// We cannot use the etag as an If-Match guard: the backend bumps it when it
+	// migrates serialized_space to a newer schema version, so a stale etag would
+	// 409 a legitimate update after a migration. Etag is therefore left empty;
+	// out-of-band drift is surfaced on read via OverrideChangeDesc instead.
+	updateResp, err := r.client.Genie.UpdateSpace(ctx, dashboards.GenieUpdateSpaceRequest{
+		SpaceId:         id,
+		Description:     config.Description,
+		Title:           config.Title,
+		WarehouseId:     config.WarehouseId,
+		ParentPath:      config.ParentPath,
+		SerializedSpace: serializedSpace,
+		Etag:            "",
+
+		ForceSendFields: utils.FilterFields[dashboards.GenieUpdateSpaceRequest](append(slices.Clone(genieSpaceForceSend), config.ForceSendFields...)),
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	// Persist the new etag in state (see DoCreate for the rationale). Record the
+	// body we sent, mirroring DoCreate, so config-side and state-side match.
+	config.Etag = updateResp.Etag
+
+	return responseToGenieSpaceConfig(updateResp, serializedSpace), nil
+}
+
+// OverrideChangeDesc handles the etag field. The user never sets it directly;
+// we compare the stored etag against the remote one and Skip if they match.
+// This mirrors ResourceDashboard.OverrideChangeDesc.
+func (r *ResourceGenieSpace) OverrideChangeDesc(_ context.Context, path *structpath.PathNode, change *ChangeDesc, _ *resources.GenieSpaceConfig) error {
+	switch path.String() {
+	case "etag":
+		// change.New is always nil for etag because it's not present in the
+		// user-authored config. Compare stored etag with remote one to decide
+		// whether anything changed out-of-band since the last deploy.
+		if change.Old == change.Remote {
+			change.Action = deployplan.Skip
+		} else {
+			change.Action = deployplan.Update
+		}
+	}
+	return nil
+}
+
+func (r *ResourceGenieSpace) DoDelete(ctx context.Context, id string, _ *resources.GenieSpaceConfig) error {
+	return r.client.Genie.TrashSpace(ctx, dashboards.GenieTrashSpaceRequest{
+		SpaceId: id,
+	})
+}
diff --git a/bundle/direct/dresources/genie_space_test.go b/bundle/direct/dresources/genie_space_test.go
new file mode 100644
index 00000000000..a7bd8b0c2ed
--- /dev/null
+++ b/bundle/direct/dresources/genie_space_test.go
@@ -0,0 +1,203 @@
+package dresources
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/cli/bundle/deployplan"
+	"github.com/databricks/cli/libs/structs/structpath"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/experimental/mocks"
+	"github.com/databricks/databricks-sdk-go/service/dashboards"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestIsMissingGenieParentPathError(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want bool
+	}{
+		{
+			name: "standard missing error",
+			err: &apierr.APIError{
+				StatusCode: 404,
+				ErrorCode:  "NOT_FOUND",
+				Message:    "not found",
+			},
+			want: true,
+		},
+		{
+			name: "invalid parameter tree node missing error",
+			err: &apierr.APIError{
+				StatusCode: 400,
+				ErrorCode:  "INVALID_PARAMETER_VALUE",
+				Message:    "NOT_FOUND: Tree node with path /Workspace/foo does not exist",
+			},
+			want: true,
+		},
+		{
+			name: "other invalid parameter error",
+			err: &apierr.APIError{
+				StatusCode: 400,
+				ErrorCode:  "INVALID_PARAMETER_VALUE",
+				Message:    "some other validation failure",
+			},
+			want: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, isMissingGenieParentPathError(tt.err))
+		})
+	}
+}
+
+func TestGenieSpaceDoCreateRetriesWhenParentPathLooksMissing(t *testing.T) {
+	ctx := t.Context()
+	m := mocks.NewMockWorkspaceClient(t)
+	r := (&ResourceGenieSpace{}).New(m.WorkspaceClient)
+
+	req := dashboards.GenieCreateSpaceRequest{
+		Title:           "test genie space",
+		Description:     "test description",
+		ParentPath:      "/Workspace/test-parent",
+		WarehouseId:     "test-warehouse-id",
+		SerializedSpace: "{}",
+	}
+
+	m.GetMockGenieAPI().EXPECT().
+		CreateSpace(ctx, req).
+		Return(nil, &apierr.APIError{
+			StatusCode: 400,
+			ErrorCode:  "INVALID_PARAMETER_VALUE",
+			Message:    "NOT_FOUND: Tree node with path /Workspace/test-parent does not exist",
+		}).
+		Once()
+
+	m.GetMockWorkspaceAPI().EXPECT().
+		MkdirsByPath(ctx, "/Workspace/test-parent").
+		Return(nil).
+		Once()
+
+	m.GetMockGenieAPI().EXPECT().
+		CreateSpace(ctx, req).
+		Return(&dashboards.GenieSpace{
+			SpaceId:         "space-id",
+			Title:           "test genie space",
+			Description:     "test description",
+			WarehouseId:     "test-warehouse-id",
+			SerializedSpace: "{}",
+		}, nil).
+		Once()
+
+	id, state, err := r.DoCreate(ctx, &resources.GenieSpaceConfig{
+		Title:           "test genie space",
+		Description:     "test description",
+		ParentPath:      "/Workspace/test-parent",
+		WarehouseId:     "test-warehouse-id",
+		SerializedSpace: "{}",
+	})
+	require.NoError(t, err)
+	assert.Equal(t, "space-id", id)
+	require.NotNil(t, state)
+	assert.Equal(t, "test genie space", state.Title)
+}
+
+func TestGenieSpaceDoUpdateRoundTripsEtag(t *testing.T) {
+	ctx := t.Context()
+	m := mocks.NewMockWorkspaceClient(t)
+	r := (&ResourceGenieSpace{}).New(m.WorkspaceClient)
+
+	entry := &deployplan.PlanEntry{
+		Changes: deployplan.Changes{
+			"title": {Action: deployplan.Update, Old: "old", New: "new"},
+		},
+	}
+
+	// The stored etag (etag-7) must NOT be sent as an If-Match guard — it would
+	// 409 after a backend serialized_space schema migration. Only the etag from
+	// the response is persisted, for drift detection on the next plan.
+	m.GetMockGenieAPI().EXPECT().
+		UpdateSpace(ctx, dashboards.GenieUpdateSpaceRequest{
+			SpaceId:         "space-id",
+			Title:           "new",
+			ForceSendFields: []string{"Description"},
+		}).
+		Return(&dashboards.GenieSpace{
+			SpaceId: "space-id",
+			Title:   "new",
+			Etag:    "etag-8",
+		}, nil).
+		Once()
+
+	state, err := r.DoUpdate(ctx, "space-id", &resources.GenieSpaceConfig{
+		Title: "new",
+		Etag:  "etag-7",
+	}, entry)
+	require.NoError(t, err)
+	require.NotNil(t, state)
+	assert.Equal(t, "etag-8", state.Etag)
+}
+
+func TestGenieSpaceDoUpdateAlwaysSendsSerializedSpace(t *testing.T) {
+	ctx := t.Context()
+	m := mocks.NewMockWorkspaceClient(t)
+	r := (&ResourceGenieSpace{}).New(m.WorkspaceClient)
+
+	// Even though the plan entry only marks an unrelated field changed, the body
+	// is sent so the deploy converges the space to the bundle config.
+	entry := &deployplan.PlanEntry{
+		Changes: deployplan.Changes{
+			"title": {Action: deployplan.Update, Old: "old", New: "new"},
+		},
+	}
+
+	m.GetMockGenieAPI().EXPECT().
+		UpdateSpace(ctx, dashboards.GenieUpdateSpaceRequest{
+			SpaceId:         "space-id",
+			Title:           "new",
+			SerializedSpace: "{\"converge\":\"me\"}",
+			ForceSendFields: []string{"Description"},
+		}).
+		Return(&dashboards.GenieSpace{
+			SpaceId:         "space-id",
+			Title:           "new",
+			SerializedSpace: "{\"converge\":\"me\"}",
+		}, nil).
+		Once()
+
+	state, err := r.DoUpdate(ctx, "space-id", &resources.GenieSpaceConfig{
+		Title:           "new",
+		SerializedSpace: "{\"converge\":\"me\"}",
+	}, entry)
+	require.NoError(t, err)
+	require.NotNil(t, state)
+	assert.Equal(t, "{\"converge\":\"me\"}", state.SerializedSpace)
+}
+
+func TestGenieSpaceOverrideChangeDescEtag(t *testing.T) {
+	r := &ResourceGenieSpace{}
+	etagPath := structpath.MustParsePath("etag")
+
+	t.Run("Skip when stored matches remote", func(t *testing.T) {
+		change := &ChangeDesc{Old: "etag-7", Remote: "etag-7"}
+		require.NoError(t, r.OverrideChangeDesc(t.Context(), etagPath, change, nil))
+		assert.Equal(t, deployplan.Skip, change.Action)
+	})
+
+	t.Run("Update when stored differs from remote", func(t *testing.T) {
+		change := &ChangeDesc{Old: "etag-7", Remote: "etag-8"}
+		require.NoError(t, r.OverrideChangeDesc(t.Context(), etagPath, change, nil))
+		assert.Equal(t, deployplan.Update, change.Action)
+	})
+
+	t.Run("Other paths are untouched", func(t *testing.T) {
+		titlePath := structpath.MustParsePath("title")
+		change := &ChangeDesc{Action: deployplan.Update, Old: "a", Remote: "b"}
+		require.NoError(t, r.OverrideChangeDesc(t.Context(), titlePath, change, nil))
+		assert.Equal(t, deployplan.Update, change.Action)
+	})
+}
diff --git a/bundle/direct/dresources/grants.go b/bundle/direct/dresources/grants.go
index 8bb19061224..3aa48c58279 100644
--- a/bundle/direct/dresources/grants.go
+++ b/bundle/direct/dresources/grants.go
@@ -13,11 +13,16 @@ import (
 )
 
 var grantResourceToSecurableType = map[string]string{
-	"catalogs":           "catalog",
-	"schemas":            "schema",
-	"external_locations": "external_location",
-	"volumes":            "volume",
-	"registered_models":  "function",
+	"catalogs":                "catalog",
+	"schemas":                 "schema",
+	"external_locations":      "external_location",
+	"volumes":                 "volume",
+	"registered_models":       "function",
+	"secrets":                 "secret",
+	"vector_search_indexes":   "table",
+	"model_services":          "model_service",
+	"mcp_services":            "mcp_service",
+	"model_provider_services": "model_provider_service",
 }
 
 type GrantsState struct {
@@ -26,37 +31,46 @@ type GrantsState struct {
 	EmbeddedSlice []catalog.PrivilegeAssignment `json:"__embed__,omitempty"`
 }
 
-func PrepareGrantsInputConfig(inputConfig any, node string) (*structvar.StructVar, error) {
-	baseNode, ok := strings.CutSuffix(node, ".grants")
-	if !ok {
-		return nil, fmt.Errorf("internal error: node %q does not end with .grants", node)
-	}
+type ResourceGrants struct {
+	client *databricks.WorkspaceClient
 
-	resourceType, err := extractGrantResourceType(node)
-	if err != nil {
-		return nil, err
-	}
+	// securableType is the UC securable type of the parent resource, e.g. "schema".
+	securableType string
+}
+
+func (*ResourceGrants) New(client *databricks.WorkspaceClient) *ResourceGrants {
+	return &ResourceGrants{client: client, securableType: ""}
+}
 
-	securableType, ok := grantResourceToSecurableType[resourceType]
+func (r *ResourceGrants) Configure(resourceType string) error {
+	parentType, ok := strings.CutSuffix(resourceType, ".grants")
 	if !ok {
-		return nil, fmt.Errorf("unsupported grants resource type: %s", resourceType)
+		return fmt.Errorf("internal error: resource type %q does not end with .grants", resourceType)
 	}
 
-	grantsPtr, ok := inputConfig.(*[]catalog.PrivilegeAssignment)
+	r.securableType, ok = grantResourceToSecurableType[parentType]
 	if !ok {
-		return nil, fmt.Errorf("expected *[]catalog.PrivilegeAssignment, got %T", inputConfig)
+		return fmt.Errorf("unsupported grants resource type: %s", parentType)
 	}
 
-	// Backend sorts privileges, so we sort here as well.
-	for i := range *grantsPtr {
-		slices.Sort((*grantsPtr)[i].Privileges)
+	return nil
+}
+
+func (r *ResourceGrants) PrepareInputConfig(inputConfig *[]catalog.PrivilegeAssignment, resourceKey string) (*structvar.StructVar, error) {
+	baseNode, ok := strings.CutSuffix(resourceKey, ".grants")
+	if !ok {
+		return nil, fmt.Errorf("internal error: node %q does not end with .grants", resourceKey)
 	}
 
+	// Normalize the same way as DoRead (sort, collapse ALL_PRIVILEGES) so the
+	// config and the value read back compare equal.
+	normalizeAssignments(*inputConfig)
+
 	return &structvar.StructVar{
 		Value: &GrantsState{
-			SecurableType: securableType,
+			SecurableType: r.securableType,
 			FullName:      "",
-			EmbeddedSlice: *grantsPtr,
+			EmbeddedSlice: *inputConfig,
 		},
 		Refs: map[string]string{
 			"full_name": "${" + baseNode + ".id}",
@@ -64,18 +78,17 @@ func PrepareGrantsInputConfig(inputConfig any, node string) (*structvar.StructVa
 	}, nil
 }
 
-type ResourceGrants struct {
-	client *databricks.WorkspaceClient
-}
-
-func (*ResourceGrants) New(client *databricks.WorkspaceClient) *ResourceGrants {
-	return &ResourceGrants{client: client}
-}
-
 func (*ResourceGrants) PrepareState(state *GrantsState) *GrantsState {
 	return state
 }
 
+// IsEmptyState reports an empty grants list as no resource at all: nothing to grant, and
+// Terraform records no databricks_grants resource for it either, so migrated bundles have
+// no state entry.
+func (*ResourceGrants) IsEmptyState(state *GrantsState) bool {
+	return len(state.EmbeddedSlice) == 0
+}
+
 func grantKey(x catalog.PrivilegeAssignment) (string, string) {
 	return "principal", x.Principal
 }
@@ -109,7 +122,8 @@ func (r *ResourceGrants) DoRead(ctx context.Context, id string) (*GrantsState, e
 func (r *ResourceGrants) DoCreate(ctx context.Context, state *GrantsState) (string, *GrantsState, error) {
 	_, err := r.DoUpdate(ctx, "", state, nil)
 	if err != nil {
-		return "", nil, err
+		// Grants Update is idempotent (additive PATCH), so retrying on transient errors is safe.
+		return "", nil, retrySafe(err)
 	}
 
 	return state.SecurableType + "/" + state.FullName, nil, nil
@@ -119,50 +133,84 @@ func (r *ResourceGrants) DoUpdate(ctx context.Context, _ string, state *GrantsSt
 	if state.FullName == "" {
 		return nil, errors.New("internal error: grants full_name must be resolved before deployment")
 	}
-	removedPrincipals := removedGrantPrincipals(state.EmbeddedSlice, entry)
 	_, err := r.client.Grants.Update(ctx, catalog.UpdatePermissions{
-		SecurableType: state.SecurableType,
-		FullName:      state.FullName,
-		Changes:       buildGrantChanges(state.EmbeddedSlice, removedPrincipals),
+		SecurableType:             state.SecurableType,
+		FullName:                  state.FullName,
+		Changes:                   buildGrantChanges(state.EmbeddedSlice, remoteGrantPrivileges(entry)),
+		OmitPermissionsInResponse: false,
+		ForceSendFields:           nil,
 	})
 	return nil, err
 }
 
-func (r *ResourceGrants) DoDelete(ctx context.Context, id string) error {
-	// Similar to permissions, we do nothing there.
-	// We could delete all grants there, but it would be confusing to explain wrt permissions.
-	return nil
-}
+// ResourceGrants intentionally implements no DoDelete: removing grants from the
+// bundle does nothing to the backend. We could revoke all grants here, but it would
+// be confusing to explain wrt permissions. Deleting the resource is a state-only
+// cleanup (see PlanEntry.StateOnly).
 
-func buildGrantChanges(desiredAssignments []catalog.PrivilegeAssignment, removedPrincipals []string) []catalog.PermissionsChange {
-	changes := make([]catalog.PermissionsChange, 0, len(desiredAssignments)+len(removedPrincipals))
+func buildGrantChanges(desiredAssignments []catalog.PrivilegeAssignment, remote map[string][]catalog.Privilege) []catalog.PermissionsChange {
+	changes := make([]catalog.PermissionsChange, 0, len(desiredAssignments)+len(remote))
+	desiredPrincipals := make(map[string]struct{}, len(desiredAssignments))
 	for _, ga := range desiredAssignments {
-		change := catalog.PermissionsChange{
+		desiredPrincipals[ga.Principal] = struct{}{}
+		changes = append(changes, catalog.PermissionsChange{
 			Principal:       ga.Principal,
 			Add:             ga.Privileges,
-			Remove:          nil,
+			Remove:          grantRemovals(ga.Privileges, remote[ga.Principal]),
 			ForceSendFields: nil,
+		})
+	}
+
+	// Principals present remotely but no longer desired: revoke everything.
+	var removedPrincipals []string
+	for principal := range remote {
+		if _, ok := desiredPrincipals[principal]; !ok {
+			removedPrincipals = append(removedPrincipals, principal)
 		}
-		// Remove all other privileges unless ALL_PRIVILEGES is being granted
-		// (it would conflict with appearing in both Add and Remove).
-		if !slices.Contains(ga.Privileges, catalog.PrivilegeAllPrivileges) {
-			change.Remove = []catalog.Privilege{catalog.PrivilegeAllPrivileges}
-		}
-		changes = append(changes, change)
 	}
+	slices.Sort(removedPrincipals)
 	for _, principal := range removedPrincipals {
 		changes = append(changes, catalog.PermissionsChange{
 			Principal:       principal,
 			Add:             nil,
-			Remove:          []catalog.Privilege{catalog.PrivilegeAllPrivileges},
+			Remove:          grantRemovals(nil, remote[principal]),
 			ForceSendFields: nil,
 		})
 	}
 	return changes
 }
 
-// removedGrantPrincipals returns principals present in the remote state but absent from the desired assignments.
-func removedGrantPrincipals(desiredAssignments []catalog.PrivilegeAssignment, entry *PlanEntry) []string {
+// grantRemovals returns the privileges to revoke for a principal so the backend
+// converges to desired. When ALL_PRIVILEGES stays desired it must not appear in
+// Remove (the backend rejects the same privilege in Add and Remove), so only the
+// no-longer-wanted excluded privileges are revoked. Otherwise ALL_PRIVILEGES is
+// removed to clear everything it implies, plus the excluded privileges by name
+// because ALL_PRIVILEGES does not imply them and its removal would leave them behind.
+func grantRemovals(desired, remotePrivileges []catalog.Privilege) []catalog.Privilege {
+	remove := revokedExcludedPrivileges(desired, remotePrivileges)
+	if slices.Contains(desired, catalog.PrivilegeAllPrivileges) {
+		return remove
+	}
+	return append([]catalog.Privilege{catalog.PrivilegeAllPrivileges}, remove...)
+}
+
+// revokedExcludedPrivileges returns the privileges not implied by ALL_PRIVILEGES
+// (see allPrivilegesExcludes) that the principal holds remotely but no longer
+// desires, so they can be revoked by name.
+func revokedExcludedPrivileges(desired, remotePrivileges []catalog.Privilege) []catalog.Privilege {
+	var remove []catalog.Privilege
+	for _, p := range allPrivilegesExcludes {
+		if slices.Contains(remotePrivileges, p) && !slices.Contains(desired, p) {
+			remove = append(remove, p)
+		}
+	}
+	return remove
+}
+
+// remoteGrantPrivileges maps each principal in the plan's remote state to the
+// privileges it currently holds, or nil when there is no remote state (e.g. on
+// create). The privileges are normalized the same way as the desired assignments.
+func remoteGrantPrivileges(entry *PlanEntry) map[string][]catalog.Privilege {
 	if entry == nil {
 		return nil
 	}
@@ -170,21 +218,12 @@ func removedGrantPrincipals(desiredAssignments []catalog.PrivilegeAssignment, en
 	if !ok || remote == nil {
 		return nil
 	}
-
-	desired := make(map[string]struct{}, len(desiredAssignments))
-	for _, a := range desiredAssignments {
-		if a.Principal != "" {
-			desired[a.Principal] = struct{}{}
-		}
-	}
-
-	var result []string
+	result := make(map[string][]catalog.Privilege, len(remote.EmbeddedSlice))
 	for _, a := range remote.EmbeddedSlice {
-		if _, ok := desired[a.Principal]; !ok {
-			result = append(result, a.Principal)
+		if a.Principal != "" {
+			result[a.Principal] = a.Privileges
 		}
 	}
-	slices.Sort(result)
 	return result
 }
 
@@ -218,19 +257,47 @@ func (r *ResourceGrants) listGrants(ctx context.Context, securableType, fullName
 		}
 		pageToken = resp.NextPageToken
 	}
+	// Normalize the same way as the config side (sort, collapse ALL_PRIVILEGES)
+	// so the two compare equal and we don't report false drift.
+	normalizeAssignments(assignments)
 	return assignments, nil
 }
 
-func extractGrantResourceType(node string) (string, error) {
-	rest, ok := strings.CutPrefix(node, "resources.")
-	if !ok {
-		return "", fmt.Errorf("cannot extract resource type from %q", node)
-	}
-	parts := strings.Split(rest, ".")
-	if len(parts) < 2 {
-		return "", fmt.Errorf("cannot extract resource type from %q", node)
+// allPrivilegesExcludes are the privileges that ALL_PRIVILEGES does not imply, so
+// they are granted independently and must survive the collapse in
+// normalizeAssignments. UC excludes exactly these four from ALL_PRIVILEGES to
+// avoid accidental data exfiltration or privilege escalation; see
+// https://docs.databricks.com/aws/en/data-governance/unity-catalog/manage-privileges/privileges
+var allPrivilegesExcludes = []catalog.Privilege{
+	catalog.PrivilegeExternalUseLocation,
+	catalog.PrivilegeExternalUseSchema,
+	catalog.PrivilegeManage,
+	catalog.PrivilegeReadMetadata,
+}
+
+// normalizeAssignments sorts each assignment's privileges (the backend sorts
+// them, so we match that) and collapses a principal holding ALL_PRIVILEGES down
+// to ALL_PRIVILEGES plus any privilege ALL_PRIVILEGES does not imply. The collapse
+// is applied to both the config and read sides, so config granting ALL_PRIVILEGES
+// matches a backend that reports ALL_PRIVILEGES plus the concrete privileges it
+// implies, instead of reporting a perpetual update. The excluded privileges are
+// kept so they are not silently dropped from both the request and the drift check.
+func normalizeAssignments(assignments []catalog.PrivilegeAssignment) {
+	for i := range assignments {
+		privileges := assignments[i].Privileges
+		if slices.Contains(privileges, catalog.PrivilegeAllPrivileges) {
+			collapsed := []catalog.Privilege{catalog.PrivilegeAllPrivileges}
+			for _, p := range allPrivilegesExcludes {
+				if slices.Contains(privileges, p) {
+					collapsed = append(collapsed, p)
+				}
+			}
+			slices.Sort(collapsed)
+			assignments[i].Privileges = collapsed
+			continue
+		}
+		slices.Sort(privileges)
 	}
-	return parts[0], nil
 }
 
 func parseGrantsID(id string) (string, string, error) {
diff --git a/bundle/direct/dresources/grants_test.go b/bundle/direct/dresources/grants_test.go
index 1724eed40dc..73a4b1414a2 100644
--- a/bundle/direct/dresources/grants_test.go
+++ b/bundle/direct/dresources/grants_test.go
@@ -5,13 +5,14 @@ import (
 
 	"github.com/databricks/databricks-sdk-go/service/catalog"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestBuildGrantChanges(t *testing.T) {
 	tests := []struct {
 		name     string
 		desired  []catalog.PrivilegeAssignment
-		removed  []string
+		remote   map[string][]catalog.Privilege
 		expected []catalog.PermissionsChange
 	}{
 		{
@@ -48,8 +49,8 @@ func TestBuildGrantChanges(t *testing.T) {
 					},
 				},
 			},
-			removed: []string{
-				"bob",
+			remote: map[string][]catalog.Privilege{
+				"bob": {catalog.PrivilegeAllPrivileges},
 			},
 			expected: []catalog.PermissionsChange{
 				{
@@ -66,11 +67,182 @@ func TestBuildGrantChanges(t *testing.T) {
 				},
 			},
 		},
+		{
+			// ALL_PRIVILEGES stays granted, so MANAGE (which it does not imply and
+			// which its removal would not clear) must be revoked by name.
+			name: "revokes excluded privilege dropped while keeping ALL_PRIVILEGES",
+			desired: []catalog.PrivilegeAssignment{
+				{
+					Principal:  "alice",
+					Privileges: []catalog.Privilege{catalog.PrivilegeAllPrivileges},
+				},
+			},
+			remote: map[string][]catalog.Privilege{
+				"alice": {catalog.PrivilegeAllPrivileges, catalog.PrivilegeManage},
+			},
+			expected: []catalog.PermissionsChange{
+				{
+					Principal: "alice",
+					Add:       []catalog.Privilege{catalog.PrivilegeAllPrivileges},
+					Remove:    []catalog.Privilege{catalog.PrivilegeManage},
+				},
+			},
+		},
+		{
+			// Removing a principal that holds MANAGE: ALL_PRIVILEGES removal clears
+			// everything it implies, and MANAGE (which it does not imply) is revoked
+			// by name so the principal is fully removed instead of lingering.
+			name: "revokes excluded privilege of a removed principal",
+			remote: map[string][]catalog.Privilege{
+				"alice": {catalog.PrivilegeAllPrivileges, catalog.PrivilegeManage},
+			},
+			expected: []catalog.PermissionsChange{
+				{
+					Principal: "alice",
+					Remove:    []catalog.Privilege{catalog.PrivilegeAllPrivileges, catalog.PrivilegeManage},
+				},
+			},
+		},
+		{
+			// Downgrading a principal off ALL_PRIVILEGES: MANAGE must be revoked by
+			// name too, since removing ALL_PRIVILEGES does not clear it.
+			name: "revokes excluded privilege when downgrading off ALL_PRIVILEGES",
+			desired: []catalog.PrivilegeAssignment{
+				{
+					Principal:  "alice",
+					Privileges: []catalog.Privilege{catalog.PrivilegeSelect},
+				},
+			},
+			remote: map[string][]catalog.Privilege{
+				"alice": {catalog.PrivilegeAllPrivileges, catalog.PrivilegeManage},
+			},
+			expected: []catalog.PermissionsChange{
+				{
+					Principal: "alice",
+					Add:       []catalog.Privilege{catalog.PrivilegeSelect},
+					Remove:    []catalog.Privilege{catalog.PrivilegeAllPrivileges, catalog.PrivilegeManage},
+				},
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.expected, buildGrantChanges(tt.desired, tt.remote))
+		})
+	}
+}
+
+// Calls through the adapter so the optional-method wiring is covered too.
+func TestGrantsIsEmptyState(t *testing.T) {
+	tests := []struct {
+		name     string
+		state    *GrantsState
+		expected bool
+	}{
+		{
+			name:     "empty grants list",
+			state:    &GrantsState{SecurableType: "schema", EmbeddedSlice: []catalog.PrivilegeAssignment{}},
+			expected: true,
+		},
+		{
+			name:     "unset grants list",
+			state:    &GrantsState{SecurableType: "schema"},
+			expected: true,
+		},
+		{
+			name: "one assignment",
+			state: &GrantsState{
+				SecurableType: "schema",
+				EmbeddedSlice: []catalog.PrivilegeAssignment{
+					{Principal: "alice", Privileges: []catalog.Privilege{catalog.PrivilegeSelect}},
+				},
+			},
+			expected: false,
+		},
+	}
+
+	adapter, err := NewAdapter(SupportedResources["schemas.grants"], "schemas.grants", nil)
+	require.NoError(t, err)
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			empty, err := adapter.IsEmptyState(tt.state)
+			require.NoError(t, err)
+			assert.Equal(t, tt.expected, empty)
+		})
+	}
+}
+
+// Resources without IsEmptyState are never treated as empty.
+func TestIsEmptyStateNotImplemented(t *testing.T) {
+	adapter, err := NewAdapter(SupportedResources["schemas"], "schemas", nil)
+	require.NoError(t, err)
+
+	empty, err := adapter.IsEmptyState(&catalog.CreateSchema{Name: "myschema"})
+	require.NoError(t, err)
+	assert.False(t, empty)
+}
+
+func TestNormalizeAssignments(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    []catalog.PrivilegeAssignment
+		expected []catalog.PrivilegeAssignment
+	}{
+		{
+			name: "sorts privileges",
+			input: []catalog.PrivilegeAssignment{
+				{Principal: "alice", Privileges: []catalog.Privilege{catalog.PrivilegeUseSchema, catalog.PrivilegeApplyTag}},
+			},
+			expected: []catalog.PrivilegeAssignment{
+				{Principal: "alice", Privileges: []catalog.Privilege{catalog.PrivilegeApplyTag, catalog.PrivilegeUseSchema}},
+			},
+		},
+		{
+			// Regression test for #6030: ALL_PRIVILEGES implies every concrete
+			// privilege, so a principal holding it collapses to just
+			// ALL_PRIVILEGES. Applied to both config and remote, this stops the
+			// backend's extra concrete privileges from showing as drift.
+			name: "collapses ALL_PRIVILEGES with concrete privileges",
+			input: []catalog.PrivilegeAssignment{
+				{Principal: "alice", Privileges: []catalog.Privilege{catalog.PrivilegeUseCatalog, catalog.PrivilegeAllPrivileges, catalog.PrivilegeCreateSchema}},
+			},
+			expected: []catalog.PrivilegeAssignment{
+				{Principal: "alice", Privileges: []catalog.Privilege{catalog.PrivilegeAllPrivileges}},
+			},
+		},
+		{
+			// ALL_PRIVILEGES does not imply MANAGE, READ_METADATA, EXTERNAL_USE_SCHEMA
+			// or EXTERNAL_USE_LOCATION, so all four must survive the collapse instead
+			// of being dropped alongside the concrete privileges (e.g. USE_CATALOG).
+			name: "keeps privileges not implied by ALL_PRIVILEGES",
+			input: []catalog.PrivilegeAssignment{
+				{Principal: "alice", Privileges: []catalog.Privilege{
+					catalog.PrivilegeUseCatalog,
+					catalog.PrivilegeManage,
+					catalog.PrivilegeReadMetadata,
+					catalog.PrivilegeExternalUseSchema,
+					catalog.PrivilegeExternalUseLocation,
+					catalog.PrivilegeAllPrivileges,
+				}},
+			},
+			expected: []catalog.PrivilegeAssignment{
+				{Principal: "alice", Privileges: []catalog.Privilege{
+					catalog.PrivilegeAllPrivileges,
+					catalog.PrivilegeExternalUseLocation,
+					catalog.PrivilegeExternalUseSchema,
+					catalog.PrivilegeManage,
+					catalog.PrivilegeReadMetadata,
+				}},
+			},
+		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.expected, buildGrantChanges(tt.desired, tt.removed))
+			normalizeAssignments(tt.input)
+			assert.Equal(t, tt.expected, tt.input)
 		})
 	}
 }
diff --git a/bundle/direct/dresources/instance_pool.go b/bundle/direct/dresources/instance_pool.go
new file mode 100644
index 00000000000..37a1aeab447
--- /dev/null
+++ b/bundle/direct/dresources/instance_pool.go
@@ -0,0 +1,77 @@
+package dresources
+
+import (
+	"context"
+
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/cli/libs/utils"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/service/compute"
+)
+
+type ResourceInstancePool struct {
+	client *databricks.WorkspaceClient
+}
+
+func (*ResourceInstancePool) New(client *databricks.WorkspaceClient) *ResourceInstancePool {
+	return &ResourceInstancePool{client: client}
+}
+
+func (*ResourceInstancePool) PrepareState(input *resources.InstancePool) *compute.CreateInstancePool {
+	return &input.CreateInstancePool
+}
+
+// RemapState copies the config fields shared by GetInstancePool and CreateInstancePool;
+// output-only fields (state, stats, default_tags, instance_pool_id) are not in the state.
+func (*ResourceInstancePool) RemapState(remote *compute.GetInstancePool) *compute.CreateInstancePool {
+	return &compute.CreateInstancePool{
+		AwsAttributes:                      remote.AwsAttributes,
+		AzureAttributes:                    remote.AzureAttributes,
+		CustomTags:                         remote.CustomTags,
+		DiskSpec:                           remote.DiskSpec,
+		EnableElasticDisk:                  remote.EnableElasticDisk,
+		GcpAttributes:                      remote.GcpAttributes,
+		IdleInstanceAutoterminationMinutes: remote.IdleInstanceAutoterminationMinutes,
+		InstancePoolName:                   remote.InstancePoolName,
+		MaxCapacity:                        remote.MaxCapacity,
+		MinIdleInstances:                   remote.MinIdleInstances,
+		NodeTypeFlexibility:                remote.NodeTypeFlexibility,
+		NodeTypeId:                         remote.NodeTypeId,
+		PreloadedDockerImages:              remote.PreloadedDockerImages,
+		PreloadedSparkVersions:             remote.PreloadedSparkVersions,
+		RemoteDiskThroughput:               remote.RemoteDiskThroughput,
+		TotalInitialRemoteDiskSize:         remote.TotalInitialRemoteDiskSize,
+		ForceSendFields:                    utils.FilterFields[compute.CreateInstancePool](remote.ForceSendFields),
+	}
+}
+
+func (r *ResourceInstancePool) DoRead(ctx context.Context, id string) (*compute.GetInstancePool, error) {
+	return r.client.InstancePools.GetByInstancePoolId(ctx, id)
+}
+
+func (r *ResourceInstancePool) DoCreate(ctx context.Context, config *compute.CreateInstancePool) (string, *compute.GetInstancePool, error) {
+	resp, err := r.client.InstancePools.Create(ctx, *config)
+	if err != nil {
+		return "", nil, err
+	}
+	return resp.InstancePoolId, nil, nil
+}
+
+func (r *ResourceInstancePool) DoUpdate(ctx context.Context, id string, config *compute.CreateInstancePool, _ *PlanEntry) (*compute.GetInstancePool, error) {
+	return nil, r.client.InstancePools.Edit(ctx, compute.EditInstancePool{
+		InstancePoolId:                     id,
+		InstancePoolName:                   config.InstancePoolName,
+		NodeTypeId:                         config.NodeTypeId,
+		MinIdleInstances:                   config.MinIdleInstances,
+		MaxCapacity:                        config.MaxCapacity,
+		IdleInstanceAutoterminationMinutes: config.IdleInstanceAutoterminationMinutes,
+		CustomTags:                         config.CustomTags,
+		RemoteDiskThroughput:               config.RemoteDiskThroughput,
+		TotalInitialRemoteDiskSize:         config.TotalInitialRemoteDiskSize,
+		ForceSendFields:                    utils.FilterFields[compute.EditInstancePool](config.ForceSendFields),
+	})
+}
+
+func (r *ResourceInstancePool) DoDelete(ctx context.Context, id string, _ *compute.CreateInstancePool) error {
+	return r.client.InstancePools.DeleteByInstancePoolId(ctx, id)
+}
diff --git a/bundle/direct/dresources/job.go b/bundle/direct/dresources/job.go
index 9477bf52517..a19ecf4dae2 100644
--- a/bundle/direct/dresources/job.go
+++ b/bundle/direct/dresources/job.go
@@ -24,6 +24,7 @@ type JobRemote struct {
 	EffectiveUsagePolicyId  string                  `json:"effective_usage_policy_id,omitempty"`
 	JobId                   int64                   `json:"job_id,omitempty"`
 	RunAsUserName           string                  `json:"run_as_user_name,omitempty"`
+	TriggerDetails          []jobs.TriggerDetails   `json:"trigger_details,omitempty"`
 	TriggerState            *jobs.TriggerStateProto `json:"trigger_state,omitempty"`
 }
 
@@ -75,8 +76,29 @@ func getDependsOnTaskKey(x jobs.TaskDependency) (string, string) {
 	return "task_key", x.TaskKey
 }
 
+func getWebhookKey(x jobs.Webhook) (string, string) {
+	return "id", x.Id
+}
+
+// The Jobs API returns webhook_notifications.on_* in an arbitrary order, so
+// diff them by id to avoid a phantom diff that never converges.
+var webhookNotificationEvents = []string{
+	"on_start",
+	"on_success",
+	"on_failure",
+	"on_duration_warning_threshold_exceeded",
+	"on_streaming_backlog_exceeded",
+}
+
+// webhook_notifications appears at the job, task, and for_each task levels.
+var webhookNotificationParents = []string{
+	"webhook_notifications",
+	"tasks[*].webhook_notifications",
+	"tasks[*].for_each_task.task.webhook_notifications",
+}
+
 func (*ResourceJob) KeyedSlices() map[string]any {
-	return map[string]any{
+	result := map[string]any{
 		"tasks":                                  getTaskKey,
 		"parameters":                             getParameterName,
 		"job_clusters":                           getJobClusterKey,
@@ -84,6 +106,12 @@ func (*ResourceJob) KeyedSlices() map[string]any {
 		"tasks[*].depends_on":                    getDependsOnTaskKey,
 		"tasks[*].for_each_task.task.depends_on": getDependsOnTaskKey,
 	}
+	for _, parent := range webhookNotificationParents {
+		for _, event := range webhookNotificationEvents {
+			result[parent+"."+event] = getWebhookKey
+		}
+	}
+	return result
 }
 
 func (r *ResourceJob) DoRead(ctx context.Context, id string) (*JobRemote, error) {
@@ -94,9 +122,10 @@ func (r *ResourceJob) DoRead(ctx context.Context, id string) (*JobRemote, error)
 	// GetByJobId only fetches the first page (100 tasks). Jobs.Get handles
 	// pagination and returns the complete job with all tasks merged.
 	job, err := r.client.Jobs.Get(ctx, jobs.GetJobRequest{
-		JobId:           idInt,
-		PageToken:       "",
-		ForceSendFields: nil,
+		JobId:               idInt,
+		PageToken:           "",
+		IncludeTriggerState: false,
+		ForceSendFields:     nil,
 	})
 	if err != nil {
 		return nil, err
@@ -117,6 +146,7 @@ func makeJobRemote(job *jobs.Job) *JobRemote {
 		EffectiveUsagePolicyId:  job.EffectiveUsagePolicyId,
 		JobId:                   job.JobId,
 		RunAsUserName:           job.RunAsUserName,
+		TriggerDetails:          job.TriggerDetails,
 		TriggerState:            job.TriggerState,
 	}
 }
@@ -141,7 +171,7 @@ func (r *ResourceJob) DoUpdate(ctx context.Context, id string, config *jobs.JobS
 	return nil, r.client.Jobs.Reset(ctx, request)
 }
 
-func (r *ResourceJob) DoDelete(ctx context.Context, id string) error {
+func (r *ResourceJob) DoDelete(ctx context.Context, id string, _ *jobs.JobSettings) error {
 	idInt, err := parseJobID(id)
 	if err != nil {
 		return err
@@ -158,8 +188,10 @@ func makeCreateJob(config jobs.JobSettings) (jobs.CreateJob, error) {
 		Continuous:           config.Continuous,
 		Deployment:           config.Deployment,
 		Description:          config.Description,
+		DurationTarget:       config.DurationTarget,
 		EditMode:             config.EditMode,
 		EmailNotifications:   config.EmailNotifications,
+		EnvironmentVariables: config.EnvironmentVariables,
 		Environments:         config.Environments,
 		Format:               config.Format,
 		GitSource:            config.GitSource,
@@ -169,6 +201,7 @@ func makeCreateJob(config jobs.JobSettings) (jobs.CreateJob, error) {
 		Name:                 config.Name,
 		NotificationSettings: config.NotificationSettings,
 		Parameters:           config.Parameters,
+		ParentPath:           config.ParentPath,
 		PerformanceTarget:    config.PerformanceTarget,
 		Queue:                config.Queue,
 		RunAs:                config.RunAs,
@@ -177,6 +210,7 @@ func makeCreateJob(config jobs.JobSettings) (jobs.CreateJob, error) {
 		Tasks:                config.Tasks,
 		TimeoutSeconds:       config.TimeoutSeconds,
 		Trigger:              config.Trigger,
+		Triggers:             config.Triggers,
 		UsagePolicyId:        config.UsagePolicyId,
 		WebhookNotifications: config.WebhookNotifications,
 		ForceSendFields:      utils.FilterFields[jobs.CreateJob](config.ForceSendFields, "AccessControlList"),
diff --git a/bundle/direct/dresources/job_run.go b/bundle/direct/dresources/job_run.go
new file mode 100644
index 00000000000..90a628b0486
--- /dev/null
+++ b/bundle/direct/dresources/job_run.go
@@ -0,0 +1,430 @@
+package dresources
+
+import (
+	"cmp"
+	"context"
+	"errors"
+	"fmt"
+	"slices"
+	"strconv"
+	"strings"
+	"time"
+	"uuid"
+
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/cli/bundle/deployplan"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/structs/structpath"
+	"github.com/databricks/cli/libs/workspaceurls"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/marshal"
+	"github.com/databricks/databricks-sdk-go/retries"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+)
+
+// jobRunTimeout matches the timeout `bundle run` allows a run (bundle/run/job.go).
+const jobRunTimeout = 24 * time.Hour
+
+// JobRunLifecycleState is the local-only trigger fingerprint.
+type JobRunLifecycleState struct {
+	TriggersState *resources.JobRunTriggersState `json:"triggers_state,omitempty"`
+}
+
+// JobRunState is the RunNow request plus the outcome required for planning.
+type JobRunState struct {
+	jobs.RunNow
+
+	// Always SUCCESS during planning and cleared before persistence.
+	ResultState jobs.RunResultState `json:"result_state,omitempty"`
+
+	// Local-only fingerprint. Nested under lifecycle to avoid colliding with a
+	// future Jobs API field; nil when no trigger is armed so the key is omitted.
+	Lifecycle *JobRunLifecycleState `json:"lifecycle,omitempty"`
+}
+
+func (s *JobRunState) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, s)
+}
+
+func (s JobRunState) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(s)
+}
+
+// JobRunRemote is the RunNow request plus the run's output-only fields. It has no
+// lifecycle: GetRun never returns the fingerprints (see knownMissingInRemoteType).
+type JobRunRemote struct {
+	jobs.RunNow
+
+	// Repeats state.result_state at the path JobRunState uses, so the planner can
+	// compare the two. See "RemapState is a dumb copy" in README.md.
+	ResultState jobs.RunResultState `json:"result_state,omitempty"`
+
+	RunId      int64          `json:"run_id,omitempty"`
+	RunName    string         `json:"run_name,omitempty"`
+	State      *jobs.RunState `json:"state,omitempty"`
+	RunPageUrl string         `json:"run_page_url,omitempty"`
+	RunType    jobs.RunType   `json:"run_type,omitempty"`
+}
+
+// Custom marshaler needed because embedded RunNow's MarshalJSON would otherwise
+// take over and drop the additional fields.
+func (s *JobRunRemote) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, s)
+}
+
+func (s JobRunRemote) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(s)
+}
+
+type ResourceJobRun struct {
+	client *databricks.WorkspaceClient
+}
+
+func (*ResourceJobRun) New(client *databricks.WorkspaceClient) *ResourceJobRun {
+	return &ResourceJobRun{
+		client: client,
+	}
+}
+
+func (*ResourceJobRun) PrepareState(input *resources.JobRun) *JobRunState {
+	state := &JobRunState{
+		RunNow:      input.RunNow,
+		ResultState: jobs.RunResultStateSuccess,
+		Lifecycle:   nil,
+	}
+	var ts resources.JobRunTriggersState
+	if input.Lifecycle != nil && input.Lifecycle.TriggersState != nil {
+		ts = *input.Lifecycle.TriggersState
+	}
+	if input.HasOnBundleDeploy() {
+		ts.OnBundleDeploy = uuid.New().String()
+	}
+	if !ts.IsEmpty() {
+		state.Lifecycle = &JobRunLifecycleState{TriggersState: &ts}
+	}
+	return state
+}
+
+// makeJobRunRemote maps the GetRun response into the RunNow-shaped remote: GET
+// nests the params under overriding_parameters and returns job_parameters as a
+// list, so both are flattened back into RunNow.
+func makeJobRunRemote(run *jobs.Run) *JobRunRemote {
+	var overriding jobs.RunParameters
+	if run.OverridingParameters != nil {
+		overriding = *run.OverridingParameters
+	}
+	var jobParameters map[string]string
+	if len(run.JobParameters) > 0 {
+		jobParameters = make(map[string]string, len(run.JobParameters))
+		for _, p := range run.JobParameters {
+			jobParameters[p.Name] = p.Value
+		}
+	}
+	return &JobRunRemote{
+		JobId:             run.JobId,
+		JobParameters:     jobParameters,
+		DurationTarget:    run.DurationTarget,
+		DbtCommands:       overriding.DbtCommands,
+		JarParams:         overriding.JarParams,
+		NotebookParams:    overriding.NotebookParams,
+		PipelineParams:    overriding.PipelineParams,
+		PythonNamedParams: overriding.PythonNamedParams,
+		PythonParams:      overriding.PythonParams,
+		SparkSubmitParams: overriding.SparkSubmitParams,
+		SqlParams:         overriding.SqlParams,
+		// Request-only fields GetRun never reports; listed so exhaustruct
+		// flags any new SDK field.
+		IdempotencyToken:  "",
+		Only:              nil,
+		PerformanceTarget: "",
+		Queue:             nil,
+		ForceSendFields:   nil,
+		ResultState:       run.State.ResultState,
+		RunId:             run.RunId,
+		RunName:           run.RunName,
+		// Rebuilt, not copied: the SDK records explicitly-sent fields in
+		// ForceSendFields, which makes zero values workspace-dependent.
+		State: &jobs.RunState{
+			LifeCycleState: run.State.LifeCycleState,
+			ResultState:    run.State.ResultState,
+			StateMessage:   run.State.StateMessage,
+			// Nothing reads these; listed so exhaustruct flags any new SDK field.
+			QueueReason:             "",
+			UserCancelledOrTimedout: false,
+			ForceSendFields:         nil,
+		},
+		RunPageUrl: workspaceurls.ModernizeJobRunPageURL(run.RunPageUrl),
+		RunType:    run.RunType,
+	}
+}
+
+// DoRead returns the run as GetRun reports it; a 404 lets the planner re-trigger.
+func (r *ResourceJobRun) DoRead(ctx context.Context, id string) (*JobRunRemote, error) {
+	runID, err := parseRunID(id)
+	if err != nil {
+		return nil, err
+	}
+	// var + field set (not a literal) avoids listing GetRunRequest's other fields.
+	var req jobs.GetRunRequest
+	req.RunId = runID
+	run, err := r.client.Jobs.GetRun(ctx, req)
+	if err != nil {
+		return nil, err
+	}
+	return makeJobRunRemote(run), nil
+}
+
+// RemapState extracts the fields used for diffing: the RunNow request and the
+// outcome the run reached. Lifecycle has no remote counterpart.
+func (*ResourceJobRun) RemapState(remote *JobRunRemote) *JobRunState {
+	return &JobRunState{
+		RunNow:      remote.RunNow,
+		ResultState: remote.ResultState,
+		Lifecycle:   nil,
+	}
+}
+
+func (r *ResourceJobRun) DoCreate(ctx context.Context, config *JobRunState) (string, *JobRunRemote, error) {
+	// Mint a token so an SDK retry of a lost response returns the same run. Set it
+	// on a copy: recording it in state would drift from the empty config and recreate.
+	req := config.RunNow
+	req.IdempotencyToken = uuid.New().String()
+	// RunNow returns only the new run id, so we return a nil remote and let the
+	// framework read it back via DoRead.
+	wait, err := r.client.Jobs.RunNow(ctx, req)
+	if err != nil {
+		return "", nil, err
+	}
+	config.ResultState = ""
+	return strconv.FormatInt(wait.RunId, 10), nil, nil
+}
+
+// WaitAfterCreate blocks until the run finishes, so a resource referencing its
+// output (e.g. state.result_state) sees a settled run. Only SUCCESS continues the deploy.
+func (r *ResourceJobRun) WaitAfterCreate(ctx context.Context, id string, _ *JobRunState) (*JobRunRemote, error) {
+	return r.waitForRun(ctx, id)
+}
+
+// waitForRun polls the run until it stops, and fails unless it succeeded.
+func (r *ResourceJobRun) waitForRun(ctx context.Context, id string) (*JobRunRemote, error) {
+	runID, err := parseRunID(id)
+	if err != nil {
+		return nil, err
+	}
+
+	// A run can take hours, so report the run page as soon as it is known. pageURL
+	// outlives the poll so an abandoned wait can still link the run.
+	var pageURL string
+	// Every state is logged, but only the outcome is reported: how many states a
+	// run passes through varies with its compute, and output has to stay reproducible.
+	var logged jobs.RunState
+	// Not the SDK's WaitGetRunJobTerminatedOrSkipped: it discards the run on
+	// INTERNAL_ERROR, the state a run whose task failed lands in, leaving
+	// runFailedError nothing to name the failing task from. This poll returns the
+	// run in whatever state it settles in.
+	run, err := retries.Poll(ctx, jobRunTimeout, func() (*jobs.Run, *retries.Err) {
+		var req jobs.GetRunRequest
+		req.RunId = runID
+		run, err := r.client.Jobs.GetRun(ctx, req)
+		if err != nil {
+			return nil, retries.Halt(err)
+		}
+		if pageURL == "" && run.RunPageUrl != "" {
+			pageURL = run.RunPageUrl
+			reportRunLine(ctx, runID, "Run URL: "+workspaceurls.ModernizeJobRunPageURL(pageURL))
+		}
+		if run.State.LifeCycleState != logged.LifeCycleState || run.State.ResultState != logged.ResultState {
+			logged = *run.State
+			log.Info(ctx, strings.TrimSpace(fmt.Sprintf("job run %d: %s %s", runID, logged.LifeCycleState, logged.ResultState)))
+		}
+		if !runIsTerminal(run.State.LifeCycleState) {
+			return nil, retries.Continues(run.State.StateMessage)
+		}
+		return run, nil
+	})
+	if err != nil {
+		// The wait can end with the run still going (timeout, interrupt), so link
+		// the run page.
+		if ctx.Err() != nil {
+			// A cancelled context is reported as a timeout.
+			return nil, fmt.Errorf("interrupted while waiting for the run to finish: %w%s", ctx.Err(), runPageLine(pageURL))
+		}
+		return nil, fmt.Errorf("%w%s", err, runPageLine(pageURL))
+	}
+	if run.State.ResultState != jobs.RunResultStateSuccess {
+		// The error names the outcome.
+		return nil, r.runFailedError(ctx, run)
+	}
+	reportRunLine(ctx, runID, string(run.State.ResultState))
+	return makeJobRunRemote(run), nil
+}
+
+// runFailedError reports why the run did not succeed, naming each failed task
+// and the error it reported.
+func (r *ResourceJobRun) runFailedError(ctx context.Context, run *jobs.Run) error {
+	// A skipped run has no result_state; report the lifecycle state.
+	outcome := cmp.Or(string(run.State.ResultState), string(run.State.LifeCycleState))
+	var msg strings.Builder
+	// The framework already prefixes the resource key and the run id.
+	fmt.Fprintf(&msg, "run did not succeed: %s", outcome)
+	if run.State.StateMessage != "" {
+		fmt.Fprintf(&msg, ": %s", run.State.StateMessage)
+	}
+	for _, task := range lastFailedAttempts(run.Tasks) {
+		fmt.Fprintf(&msg, "\ntask %q: %s", task.TaskKey, r.taskError(ctx, task))
+	}
+	msg.WriteString(runPageLine(run.RunPageUrl))
+	return errors.New(msg.String())
+}
+
+// lastFailedAttempts returns the failed tasks in the order the run reports them,
+// one per task key: a task the Jobs API retried is reported once per attempt, and
+// only its last one says how the run ended up.
+func lastFailedAttempts(tasks []jobs.RunTask) []jobs.RunTask {
+	var result []jobs.RunTask
+	for _, task := range tasks {
+		if !taskFailed(task) {
+			continue
+		}
+		i := slices.IndexFunc(result, func(seen jobs.RunTask) bool { return seen.TaskKey == task.TaskKey })
+		switch {
+		case i < 0:
+			result = append(result, task)
+		case task.AttemptNumber > result[i].AttemptNumber:
+			result[i] = task
+		}
+	}
+	return result
+}
+
+// taskFailed reports whether a task is a cause of the run's failure. A task left
+// SKIPPED or UPSTREAM_FAILED never ran, so it has no error to report.
+func taskFailed(task jobs.RunTask) bool {
+	if task.State != nil {
+		return task.State.LifeCycleState == jobs.RunLifeCycleStateInternalError ||
+			task.State.ResultState == jobs.RunResultStateFailed ||
+			task.State.ResultState == jobs.RunResultStateTimedout
+	}
+	// State is deprecated in favour of Status, so a workspace may stop setting it.
+	if task.Status == nil || task.Status.TerminationDetails == nil {
+		return false
+	}
+	details := task.Status.TerminationDetails
+	// SKIPPED is also the code for a task an upstream failure skipped.
+	return details.Type != jobs.TerminationTypeTypeSuccess &&
+		details.Code != jobs.TerminationCodeCodeSkipped
+}
+
+// taskError returns the message the task reported, from the same place `bundle
+// run` reads it.
+func (r *ResourceJobRun) taskError(ctx context.Context, task jobs.RunTask) string {
+	var reported string
+	output, err := r.client.Jobs.GetRunOutput(ctx, jobs.GetRunOutputRequest{RunId: task.RunId})
+	if err != nil {
+		log.Debugf(ctx, "could not read output of task %s: %v", task.TaskKey, err)
+	} else {
+		reported = output.Error
+	}
+	// Not every task type reports an error through GetRunOutput.
+	return cmp.Or(reported, taskMessage(task))
+}
+
+// taskMessage reads the message off whichever field taskFailed accepted the task
+// on, so the field it reads is always set.
+func taskMessage(task jobs.RunTask) string {
+	if task.State != nil {
+		return task.State.StateMessage
+	}
+	return task.Status.TerminationDetails.Message
+}
+
+func runPageLine(rawURL string) string {
+	if rawURL == "" {
+		return ""
+	}
+	return "\nrun page: " + workspaceurls.ModernizeJobRunPageURL(rawURL)
+}
+
+// runIsTerminal reports whether a run has stopped, whatever it stopped as.
+func runIsTerminal(state jobs.RunLifeCycleState) bool {
+	return state == jobs.RunLifeCycleStateTerminated ||
+		state == jobs.RunLifeCycleStateSkipped ||
+		state == jobs.RunLifeCycleStateInternalError
+}
+
+// reportRunLine names the resource and run id so concurrent deploys stay readable.
+// Deploy attaches the key via [WithResourceKey].
+func reportRunLine(ctx context.Context, runID int64, msg string) {
+	if !cmdio.HasIO(ctx) {
+		return
+	}
+	cmdio.LogString(ctx, fmt.Sprintf("Output from %s: id=%d: %s", ResourceKey(ctx), runID, msg))
+}
+
+// OverrideChangeDesc downgrades result_state drift to skip while the run is
+// still going, so a run that may yet succeed is not recreated. A run that
+// stopped without succeeding keeps its recreate. A SKIPPED run reports no
+// result_state either, so the lifecycle state is what tells the two apart.
+// Removing a trigger drops the change and leaves the last fingerprint in state,
+// so re-adding the trigger only re-fires when the watched files changed
+// meanwhile. All other trigger changes recreate the run.
+func (*ResourceJobRun) OverrideChangeDesc(_ context.Context, path *structpath.PathNode, change *ChangeDesc, remote *JobRunRemote) error {
+	switch path.String() {
+	case "lifecycle":
+		// Dropped when the trigger is removed (New nil) and when both sides are
+		// present, where the trigger fields below classify the change instead.
+		// Arming from no lifecycle at all keeps its recreate.
+		if change.New == nil || change.Old != nil {
+			change.Reason = deployplan.ReasonDrop
+		}
+	case "lifecycle.triggers_state.on_bundle_deploy":
+		if change.New == nil || change.New == "" {
+			change.Reason = deployplan.ReasonDrop
+		}
+	case "lifecycle.triggers_state.on_file_change":
+		// As above: an emptied map is a removal, and pattern entries classify a map
+		// that still has both sides.
+		if isEmptyFileTriggerMap(change.New) || change.Old != nil {
+			change.Reason = deployplan.ReasonDrop
+		}
+	case "result_state":
+		// The planner passes no remote state when the run could not be read.
+		if remote == nil || runIsTerminal(remote.State.LifeCycleState) {
+			return nil
+		}
+		change.Action = deployplan.Skip
+		change.Reason = "run in progress"
+	default:
+		// A single on_file_change pattern entry, e.g.
+		// lifecycle.triggers_state.on_file_change['seed.txt']. Removing one pattern
+		// drops its change and leaves the last fingerprint in state.
+		if parent := path.Parent(); parent != nil && parent.String() == "lifecycle.triggers_state.on_file_change" {
+			if change.New == nil {
+				change.Reason = deployplan.ReasonDrop
+			}
+		}
+	}
+	return nil
+}
+
+// ResourceJobRun intentionally implements no DoDelete: a run is a historical
+// record, so removing it from the bundle (or recreating it when a trigger
+// re-fires) leaves the run alone on the backend and only drops the state entry
+// (see PlanEntry.StateOnly). A recreate still triggers a fresh run.
+
+func isEmptyFileTriggerMap(v any) bool {
+	if v == nil {
+		return true
+	}
+	m, ok := v.(map[string]string)
+	return ok && len(m) == 0
+}
+
+func parseRunID(id string) (int64, error) {
+	result, err := strconv.ParseInt(id, 10, 64)
+	if err != nil {
+		return 0, fmt.Errorf("internal error: run id is not integer: %q: %w", id, err)
+	}
+	return result, nil
+}
diff --git a/bundle/direct/dresources/job_run_test.go b/bundle/direct/dresources/job_run_test.go
new file mode 100644
index 00000000000..5dc964c360f
--- /dev/null
+++ b/bundle/direct/dresources/job_run_test.go
@@ -0,0 +1,508 @@
+package dresources
+
+import (
+	"context"
+	"encoding/json"
+	"reflect"
+	"slices"
+	"strings"
+	"sync/atomic"
+	"testing"
+
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/cli/bundle/deployplan"
+	"github.com/databricks/cli/libs/structs/structpath"
+	"github.com/databricks/cli/libs/testserver"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// jobRunClientFor returns a client talking to server. Call it after the test
+// registers its own handlers: first registration wins, so the defaults added here
+// only fill the gaps.
+func jobRunClientFor(t *testing.T, server *testserver.Server) *databricks.WorkspaceClient {
+	t.Helper()
+	testserver.AddDefaultHandlers(server)
+
+	client, err := databricks.NewWorkspaceClient(&databricks.Config{
+		Host:  server.URL,
+		Token: "testtoken",
+	})
+	require.NoError(t, err)
+	return client
+}
+
+// jobRunServer returns a client whose runs/get is the given handler, so a wait can
+// be driven without a real run.
+func jobRunServer(t *testing.T, getRun testserver.HandlerFunc) *databricks.WorkspaceClient {
+	t.Helper()
+	server := testserver.New(t)
+	server.Handle("GET", "/api/2.2/jobs/runs/get", getRun)
+	return jobRunClientFor(t, server)
+}
+
+// The Jobs API reports the run page in the legacy fragment form; errors and
+// progress lines carry the path form it converts to.
+const (
+	testRunPageURL  = "https://myworkspace.databricks.test/?o=900800700600#job/456/run/123"
+	testRunPageLink = "run page: https://myworkspace.databricks.test/jobs/456/runs/123?o=900800700600"
+)
+
+// jobRunClient returns a client whose GetRun always reports the given run state.
+func jobRunClient(t *testing.T, state *jobs.RunState) *databricks.WorkspaceClient {
+	t.Helper()
+	return jobRunServer(t, func(req testserver.Request) any {
+		return jobs.Run{RunId: 123, JobId: 456, State: state, RunPageUrl: testRunPageURL}
+	})
+}
+
+// waitForTestRun drives the framework hook, so it covers parsing the id the
+// framework hands back from DoCreate along with the wait itself.
+func waitForTestRun(t *testing.T, ctx context.Context, client *databricks.WorkspaceClient) (*JobRunRemote, error) {
+	t.Helper()
+	r := (&ResourceJobRun{}).New(client)
+	return r.WaitAfterCreate(ctx, "123", &JobRunState{})
+}
+
+func TestJobRunWaitFailsOnFailedResult(t *testing.T) {
+	client := jobRunClient(t, &jobs.RunState{
+		LifeCycleState: jobs.RunLifeCycleStateTerminated,
+		ResultState:    jobs.RunResultStateFailed,
+		StateMessage:   "task failed",
+	})
+
+	_, err := waitForTestRun(t, t.Context(), client)
+
+	require.ErrorContains(t, err, "did not succeed: FAILED: task failed")
+}
+
+// Without the deprecated per-task state, a failed task is told apart from a
+// skipped one by its termination details.
+func TestJobRunWaitReportsFailedTaskWithoutDeprecatedState(t *testing.T) {
+	server := testserver.New(t)
+	server.Handle("GET", "/api/2.2/jobs/runs/get", func(req testserver.Request) any {
+		return jobs.Run{
+			RunId: 123,
+			JobId: 456,
+			State: &jobs.RunState{
+				LifeCycleState: jobs.RunLifeCycleStateTerminated,
+				ResultState:    jobs.RunResultStateFailed,
+			},
+			Tasks: []jobs.RunTask{
+				{TaskKey: "main", RunId: 999, Status: &jobs.RunStatus{
+					State: jobs.RunLifecycleStateV2StateTerminated,
+					TerminationDetails: &jobs.TerminationDetails{
+						Type:    jobs.TerminationTypeTypeClientError,
+						Code:    jobs.TerminationCodeCodeRunExecutionError,
+						Message: "Workload failed, see run output for details",
+					},
+				}},
+				// Never ran, so it has no error of its own to report.
+				{TaskKey: "downstream", RunId: 1000, Status: &jobs.RunStatus{
+					State: jobs.RunLifecycleStateV2StateTerminated,
+					TerminationDetails: &jobs.TerminationDetails{
+						Type: jobs.TerminationTypeTypeClientError,
+						Code: jobs.TerminationCodeCodeSkipped,
+					},
+				}},
+			},
+		}
+	})
+	server.Handle("GET", "/api/2.2/jobs/runs/get-output", func(req testserver.Request) any {
+		return jobs.RunOutput{Error: "RuntimeError: intentional failure"}
+	})
+
+	_, err := waitForTestRun(t, t.Context(), jobRunClientFor(t, server))
+
+	require.ErrorContains(t, err, `task "main": RuntimeError: intentional failure`)
+	assert.NotContains(t, err.Error(), `task "downstream"`)
+}
+
+// When the run output carries no error, the termination message stands in.
+func TestJobRunWaitFallsBackToTheTerminationMessage(t *testing.T) {
+	server := testserver.New(t)
+	server.Handle("GET", "/api/2.2/jobs/runs/get", func(req testserver.Request) any {
+		return jobs.Run{
+			RunId: 123,
+			JobId: 456,
+			State: &jobs.RunState{
+				LifeCycleState: jobs.RunLifeCycleStateTerminated,
+				ResultState:    jobs.RunResultStateFailed,
+			},
+			Tasks: []jobs.RunTask{
+				{TaskKey: "main", RunId: 999, Status: &jobs.RunStatus{
+					State: jobs.RunLifecycleStateV2StateTerminated,
+					TerminationDetails: &jobs.TerminationDetails{
+						Type:    jobs.TerminationTypeTypeCloudFailure,
+						Code:    jobs.TerminationCodeCodeCloudFailure,
+						Message: "the cloud provider ran out of capacity",
+					},
+				}},
+			},
+		}
+	})
+	server.Handle("GET", "/api/2.2/jobs/runs/get-output", func(req testserver.Request) any {
+		return jobs.RunOutput{}
+	})
+
+	_, err := waitForTestRun(t, t.Context(), jobRunClientFor(t, server))
+
+	require.ErrorContains(t, err, `task "main": the cloud provider ran out of capacity`)
+}
+
+// The same fallback for a task still reported through the deprecated state.
+func TestJobRunWaitFallsBackToTheTaskMessage(t *testing.T) {
+	server := testserver.New(t)
+	server.Handle("GET", "/api/2.2/jobs/runs/get", func(req testserver.Request) any {
+		return jobs.Run{
+			RunId: 123,
+			JobId: 456,
+			State: &jobs.RunState{
+				LifeCycleState: jobs.RunLifeCycleStateTerminated,
+				ResultState:    jobs.RunResultStateFailed,
+			},
+			Tasks: []jobs.RunTask{
+				{TaskKey: "main", RunId: 999, State: &jobs.RunState{
+					LifeCycleState: jobs.RunLifeCycleStateTerminated,
+					ResultState:    jobs.RunResultStateFailed,
+					StateMessage:   "Workload failed, see run output for details",
+				}},
+			},
+		}
+	})
+	server.Handle("GET", "/api/2.2/jobs/runs/get-output", func(req testserver.Request) any {
+		return jobs.RunOutput{}
+	})
+
+	_, err := waitForTestRun(t, t.Context(), jobRunClientFor(t, server))
+
+	require.ErrorContains(t, err, `task "main": Workload failed, see run output for details`)
+}
+
+func TestJobRunWaitFailsOnSkipped(t *testing.T) {
+	// A skipped run has no result_state, so the lifecycle state is reported.
+	client := jobRunClient(t, &jobs.RunState{
+		LifeCycleState: jobs.RunLifeCycleStateSkipped,
+	})
+
+	_, err := waitForTestRun(t, t.Context(), client)
+
+	require.ErrorContains(t, err, "did not succeed: SKIPPED")
+}
+
+func TestJobRunWaitFailsOnInternalError(t *testing.T) {
+	client := jobRunClient(t, &jobs.RunState{
+		LifeCycleState: jobs.RunLifeCycleStateInternalError,
+	})
+
+	_, err := waitForTestRun(t, t.Context(), client)
+
+	require.ErrorContains(t, err, "run did not succeed: INTERNAL_ERROR")
+	require.ErrorContains(t, err, testRunPageLink)
+}
+
+func TestJobRunWaitReportsOnlyTheLastAttemptOfATask(t *testing.T) {
+	failed := &jobs.RunState{
+		LifeCycleState: jobs.RunLifeCycleStateTerminated,
+		ResultState:    jobs.RunResultStateFailed,
+	}
+	server := testserver.New(t)
+	server.Handle("GET", "/api/2.2/jobs/runs/get", func(req testserver.Request) any {
+		return jobs.Run{
+			RunId: 123,
+			JobId: 456,
+			State: failed,
+			Tasks: []jobs.RunTask{
+				{TaskKey: "main", RunId: 998, AttemptNumber: 0, State: failed},
+				{TaskKey: "main", RunId: 999, AttemptNumber: 1, State: failed},
+			},
+		}
+	})
+	server.Handle("GET", "/api/2.2/jobs/runs/get-output", func(req testserver.Request) any {
+		return jobs.RunOutput{Error: "output of run " + req.URL.Query().Get("run_id")}
+	})
+
+	_, err := waitForTestRun(t, t.Context(), jobRunClientFor(t, server))
+
+	// The Jobs API reports a retried task once per attempt; only the last one says
+	// how the run ended up.
+	require.ErrorContains(t, err, `task "main": output of run 999`)
+	assert.NotContains(t, err.Error(), "output of run 998")
+}
+
+func TestJobRunWaitAbandonedLinksTheRun(t *testing.T) {
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+
+	// The first poll reports the run page and finds the run still going; the
+	// second cancels the wait. Driving the interrupt from the handler keeps it
+	// deterministic: the run page URL is always captured before the wait ends,
+	// instead of racing a wall-clock timeout against the first GetRun.
+	var gets atomic.Int32
+	client := jobRunServer(t, func(req testserver.Request) any {
+		if gets.Add(1) >= 2 {
+			cancel()
+		}
+		return jobs.Run{RunId: 123, JobId: 456, State: &jobs.RunState{
+			LifeCycleState: jobs.RunLifeCycleStateRunning,
+		}, RunPageUrl: testRunPageURL}
+	})
+
+	_, err := waitForTestRun(t, ctx, client)
+
+	// The run keeps going, so the error links to it and names the interrupt.
+	require.ErrorContains(t, err, "interrupted while waiting for the run to finish")
+	require.ErrorContains(t, err, testRunPageLink)
+}
+
+func TestJobRunStateOmitsEmptyLifecycle(t *testing.T) {
+	var state JobRunState
+
+	require.NoError(t, json.Unmarshal([]byte(`{}`), &state))
+
+	assert.Nil(t, state.Lifecycle)
+	serialized, err := json.Marshal(state)
+	require.NoError(t, err)
+	assert.NotContains(t, string(serialized), `"lifecycle"`)
+}
+
+func TestJobRunPrepareStateCopiesResolvedTriggers(t *testing.T) {
+	enabled := true
+	triggers := &resources.JobRunTriggersState{
+		OnFileChange: map[string]string{"*.txt": "hash"},
+	}
+	input := &resources.JobRun{
+		Lifecycle: &resources.JobRunLifecycle{
+			Triggers:      []resources.JobRunTrigger{{OnBundleDeploy: &enabled}},
+			TriggersState: triggers,
+		},
+	}
+
+	state := (&ResourceJobRun{}).PrepareState(input)
+
+	require.NotNil(t, state.Lifecycle)
+	require.NotNil(t, state.Lifecycle.TriggersState)
+	assert.NotSame(t, triggers, state.Lifecycle.TriggersState)
+	assert.Equal(t, triggers.OnFileChange, state.Lifecycle.TriggersState.OnFileChange)
+	assert.NotEmpty(t, state.Lifecycle.TriggersState.OnBundleDeploy)
+	assert.Empty(t, triggers.OnBundleDeploy)
+}
+
+// The planner diffs RemapState(remote) against PrepareState(config), so a run
+// that did not end in SUCCESS has to surface as a difference on result_state.
+func TestJobRunRemapStateCarriesTheOutcome(t *testing.T) {
+	for _, outcome := range []jobs.RunResultState{
+		jobs.RunResultStateSuccess,
+		jobs.RunResultStateFailed,
+		// A run still going, and a SKIPPED one, report no result at all.
+		"",
+	} {
+		t.Run(string(outcome), func(t *testing.T) {
+			remote := &JobRunRemote{RunId: 123, ResultState: outcome}
+
+			state := (&ResourceJobRun{}).RemapState(remote)
+
+			assert.Equal(t, outcome, state.ResultState)
+			assert.Nil(t, state.Lifecycle)
+		})
+	}
+}
+
+// job_runs.yml ignores remote drift on everything the RunNow request carries,
+// since GetRun does not echo it back faithfully, and leaves result_state alone.
+func TestJobRunIgnoresEveryRequestField(t *testing.T) {
+	adapters, err := InitAll(nil)
+	require.NoError(t, err)
+	ignored := adapters["job_runs"].ResourceConfig().IgnoreRemoteChanges
+
+	for field := range reflect.TypeFor[jobs.RunNow]().Fields() {
+		name, _, _ := strings.Cut(field.Tag.Get("json"), ",")
+		if name == "" || name == "-" {
+			continue
+		}
+		assert.True(t, ignoresRemoteChanges(ignored, name), "jobs.RunNow field %q is not in job_runs ignore_remote_changes", name)
+	}
+
+	assert.False(t, ignoresRemoteChanges(ignored, "result_state"), "result_state must stay comparable against the remote")
+}
+
+// ignoresRemoteChanges reports whether the rules suppress remote drift on field.
+func ignoresRemoteChanges(rules []FieldRule, field string) bool {
+	path := structpath.MustParsePath(field)
+	return slices.ContainsFunc(rules, func(r FieldRule) bool { return path.HasPatternPrefix(r.Field) })
+}
+
+// Reporting RUNNING for the first two polls exercises the poll loop.
+func TestJobRunWaitPollsUntilTerminal(t *testing.T) {
+	var gets atomic.Int32
+	client := jobRunServer(t, func(req testserver.Request) any {
+		if gets.Add(1) <= 2 {
+			return jobs.Run{RunId: 123, JobId: 456, State: &jobs.RunState{
+				LifeCycleState: jobs.RunLifeCycleStateRunning,
+			}}
+		}
+		return jobs.Run{RunId: 123, JobId: 456, State: &jobs.RunState{
+			LifeCycleState: jobs.RunLifeCycleStateTerminated,
+			ResultState:    jobs.RunResultStateSuccess,
+		}}
+	})
+
+	remote, err := waitForTestRun(t, t.Context(), client)
+	require.NoError(t, err)
+
+	// SUCCESS is only reachable by polling past the RUNNING reads.
+	require.NotNil(t, remote.State)
+	assert.Equal(t, jobs.RunResultStateSuccess, remote.State.ResultState)
+	assert.Equal(t, int32(3), gets.Load(), "expected the wait to poll past both RUNNING reads")
+}
+
+func TestJobRunCreateSendsAFreshIdempotencyToken(t *testing.T) {
+	var tokens []string
+	server := testserver.New(t)
+	server.Handle("POST", "/api/2.2/jobs/run-now", func(req testserver.Request) any {
+		var body jobs.RunNow
+		require.NoError(t, json.Unmarshal(req.Body, &body))
+		tokens = append(tokens, body.IdempotencyToken)
+		return jobs.RunNowResponse{RunId: int64(123 + len(tokens))}
+	})
+	r := (&ResourceJobRun{}).New(jobRunClientFor(t, server))
+	config := &JobRunState{JobId: 456}
+
+	for range 2 {
+		_, _, err := r.DoCreate(t.Context(), config)
+		require.NoError(t, err)
+	}
+
+	require.Len(t, tokens, 2)
+	assert.NotEmpty(t, tokens[0])
+	assert.NotEqual(t, tokens[0], tokens[1])
+	// Token must not leak into persisted state.
+	assert.Empty(t, config.IdempotencyToken)
+}
+
+func TestJobRunOverrideChangeDescTriggerRemoved(t *testing.T) {
+	r := &ResourceJobRun{}
+	var lifecycle JobRunLifecycleState
+	for _, tt := range []struct {
+		name   string
+		path   string
+		old    any
+		new    any
+		action deployplan.ActionType
+		reason string
+	}{
+		{
+			name:   "cleared lifecycle",
+			path:   "lifecycle",
+			old:    lifecycle,
+			new:    nil,
+			action: deployplan.Recreate,
+			reason: deployplan.ReasonDrop,
+		},
+		{
+			name:   "added lifecycle",
+			path:   "lifecycle",
+			old:    nil,
+			new:    lifecycle,
+			action: deployplan.Recreate,
+			reason: "",
+		},
+		{
+			name:   "changed lifecycle",
+			path:   "lifecycle",
+			old:    lifecycle,
+			new:    lifecycle,
+			action: deployplan.Recreate,
+			reason: deployplan.ReasonDrop,
+		},
+		{
+			name:   "cleared on_bundle_deploy string",
+			path:   "lifecycle.triggers_state.on_bundle_deploy",
+			old:    "uuid",
+			new:    "",
+			action: deployplan.Recreate,
+			reason: deployplan.ReasonDrop,
+		},
+		{
+			name:   "nil on_bundle_deploy",
+			path:   "lifecycle.triggers_state.on_bundle_deploy",
+			old:    "uuid",
+			new:    nil,
+			action: deployplan.Recreate,
+			reason: deployplan.ReasonDrop,
+		},
+		{
+			name:   "rotated on_bundle_deploy",
+			path:   "lifecycle.triggers_state.on_bundle_deploy",
+			old:    "old-uuid",
+			new:    "new-uuid",
+			action: deployplan.Recreate,
+			reason: "",
+		},
+		{
+			name:   "cleared on_file_change",
+			path:   "lifecycle.triggers_state.on_file_change",
+			old:    map[string]string{"*.txt": "hash"},
+			new:    nil,
+			action: deployplan.Recreate,
+			reason: deployplan.ReasonDrop,
+		},
+		{
+			name:   "empty on_file_change maps",
+			path:   "lifecycle.triggers_state.on_file_change",
+			old:    map[string]string{},
+			new:    map[string]string{},
+			action: deployplan.Recreate,
+			reason: deployplan.ReasonDrop,
+		},
+		{
+			name:   "added on_file_change map",
+			path:   "lifecycle.triggers_state.on_file_change",
+			old:    nil,
+			new:    map[string]string{"*.txt": "hash"},
+			action: deployplan.Recreate,
+			reason: "",
+		},
+		{
+			name:   "changed on_file_change map",
+			path:   "lifecycle.triggers_state.on_file_change",
+			old:    map[string]string{"*.txt": "old"},
+			new:    map[string]string{"*.txt": "new"},
+			action: deployplan.Recreate,
+			reason: deployplan.ReasonDrop,
+		},
+		{
+			name:   "cleared on_file_change pattern",
+			path:   "lifecycle.triggers_state.on_file_change['*.txt']",
+			old:    "hash",
+			new:    nil,
+			action: deployplan.Recreate,
+			reason: deployplan.ReasonDrop,
+		},
+		{
+			name:   "changed on_file_change pattern",
+			path:   "lifecycle.triggers_state.on_file_change['*.txt']",
+			old:    "old",
+			new:    "new",
+			action: deployplan.Recreate,
+			reason: "",
+		},
+		{
+			name:   "result_state with unreadable remote",
+			path:   "result_state",
+			old:    jobs.RunResultStateSuccess,
+			new:    nil,
+			action: deployplan.Recreate,
+			reason: "",
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			change := &ChangeDesc{Action: deployplan.Recreate, Old: tt.old, New: tt.new}
+			require.NoError(t, r.OverrideChangeDesc(t.Context(), structpath.MustParsePath(tt.path), change, nil))
+			assert.Equal(t, tt.action, change.Action)
+			assert.Equal(t, tt.reason, change.Reason)
+		})
+	}
+}
diff --git a/bundle/direct/dresources/job_test.go b/bundle/direct/dresources/job_test.go
index 8b8c85c8a24..ca19620023f 100644
--- a/bundle/direct/dresources/job_test.go
+++ b/bundle/direct/dresources/job_test.go
@@ -4,7 +4,10 @@ import (
 	"reflect"
 	"testing"
 
+	"github.com/databricks/cli/libs/structs/structdiff"
 	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 // TestJobRemote verifies that all fields from jobs.Job (except Settings and pagination/internal fields)
@@ -17,3 +20,71 @@ func TestJobRemote(t *testing.T) {
 		"NextPageToken":   true, // Pagination field, not relevant for single job read
 	})
 }
+
+func webhooks(ids ...string) []jobs.Webhook {
+	result := make([]jobs.Webhook, len(ids))
+	for i, id := range ids {
+		result[i] = jobs.Webhook{Id: id}
+	}
+	return result
+}
+
+// TestJobWebhookNotificationsOrderInsensitive verifies that a webhook list
+// reordered by the Jobs API produces no diff, but a changed set still does.
+func TestJobWebhookNotificationsOrderInsensitive(t *testing.T) {
+	keys := (&ResourceJob{}).KeyedSlices()
+
+	config := jobs.JobSettings{
+		WebhookNotifications: &jobs.WebhookNotifications{
+			OnSuccess: webhooks("a", "b", "c"),
+		},
+		Tasks: []jobs.Task{
+			{
+				TaskKey: "t1",
+				WebhookNotifications: &jobs.WebhookNotifications{
+					OnFailure: webhooks("a", "b"),
+				},
+				ForEachTask: &jobs.ForEachTask{
+					Task: jobs.Task{
+						TaskKey: "inner",
+						WebhookNotifications: &jobs.WebhookNotifications{
+							OnStart: webhooks("x", "y"),
+						},
+					},
+				},
+			},
+		},
+	}
+
+	remote := jobs.JobSettings{
+		WebhookNotifications: &jobs.WebhookNotifications{
+			OnSuccess: webhooks("a", "c", "b"),
+		},
+		Tasks: []jobs.Task{
+			{
+				TaskKey: "t1",
+				WebhookNotifications: &jobs.WebhookNotifications{
+					OnFailure: webhooks("b", "a"),
+				},
+				ForEachTask: &jobs.ForEachTask{
+					Task: jobs.Task{
+						TaskKey: "inner",
+						WebhookNotifications: &jobs.WebhookNotifications{
+							OnStart: webhooks("y", "x"),
+						},
+					},
+				},
+			},
+		},
+	}
+
+	changes, err := structdiff.GetStructDiff(config, remote, keys)
+	require.NoError(t, err)
+	assert.Empty(t, changes)
+
+	// A genuinely different destination set is still detected.
+	remote.WebhookNotifications.OnSuccess = webhooks("a", "b", "d")
+	changes, err = structdiff.GetStructDiff(config, remote, keys)
+	require.NoError(t, err)
+	assert.NotEmpty(t, changes)
+}
diff --git a/bundle/direct/dresources/mcp_service.go b/bundle/direct/dresources/mcp_service.go
new file mode 100644
index 00000000000..0882190dc5d
--- /dev/null
+++ b/bundle/direct/dresources/mcp_service.go
@@ -0,0 +1,137 @@
+package dresources
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/common/types/fieldmask"
+	"github.com/databricks/databricks-sdk-go/service/catalog"
+)
+
+// AI Gateway MCP service.
+// API: https://docs.databricks.com/api/workspace/aigateway
+// Terraform: databricks_ai_gateway_mcp_service
+//
+// Mirrors ResourceModelService: the remote type returned by DoRead is the same
+// bundle-local resources.McpServiceConfig used for state (so RemapState is not
+// needed), and DoRead reconstructs the create-time identity (parent +
+// mcp_service_id) from the server-derived resource name.
+const mcpServiceNamePrefix = "mcp-services/"
+
+type ResourceMcpService struct {
+	client *databricks.WorkspaceClient
+}
+
+func (*ResourceMcpService) New(client *databricks.WorkspaceClient) *ResourceMcpService {
+	return &ResourceMcpService{client: client}
+}
+
+func (*ResourceMcpService) PrepareState(input *resources.McpService) *resources.McpServiceConfig {
+	return &input.McpServiceConfig
+}
+
+// mcpServiceIdentityFromName reconstructs the create-time parent and leaf id
+// from the server-derived resource name
+// `mcp-services/{catalog}.{schema}.{mcp_service}`.
+func mcpServiceIdentityFromName(name string) (parent, mcpServiceId string, err error) {
+	rest, ok := strings.CutPrefix(name, mcpServiceNamePrefix)
+	if !ok {
+		return "", "", fmt.Errorf("unexpected mcp service name %q (want mcp-services/{catalog}.{schema}.{mcp_service})", name)
+	}
+	parts := strings.Split(rest, ".")
+	if len(parts) != 3 {
+		return "", "", fmt.Errorf("unexpected mcp service name %q (want three dot-separated components)", name)
+	}
+	return "schemas/" + parts[0] + "." + parts[1], parts[2], nil
+}
+
+func responseToMcpServiceConfig(ms *catalog.McpService) (*resources.McpServiceConfig, error) {
+	parent, id, err := mcpServiceIdentityFromName(ms.Name)
+	if err != nil {
+		return nil, err
+	}
+	return &resources.McpServiceConfig{
+		Parent:          parent,
+		McpServiceId:    id,
+		Comment:         ms.Comment,
+		Config:          ms.Config,
+		ForceSendFields: nil,
+	}, nil
+}
+
+// mcpServiceBody builds the McpService write payload from the bundle config.
+// Only comment and config are client-settable; every other field is OUTPUT_ONLY
+// (server-derived) and sent as its zero value.
+func mcpServiceBody(config *resources.McpServiceConfig) catalog.McpService {
+	return catalog.McpService{
+		Comment:         config.Comment,
+		Config:          config.Config,
+		CreateTime:      nil,
+		CreatedBy:       "",
+		EffectiveOwner:  "",
+		Etag:            "",
+		MetastoreId:     "",
+		Name:            "",
+		UpdateTime:      nil,
+		UpdatedBy:       "",
+		ForceSendFields: nil,
+	}
+}
+
+func (r *ResourceMcpService) DoRead(ctx context.Context, id string) (*resources.McpServiceConfig, error) {
+	ms, err := r.client.AiGateway.GetMcpService(ctx, catalog.GetMcpServiceRequest{Name: mcpServiceNamePrefix + id})
+	if err != nil {
+		return nil, err
+	}
+	return responseToMcpServiceConfig(ms)
+}
+
+func (r *ResourceMcpService) DoCreate(ctx context.Context, config *resources.McpServiceConfig) (string, *resources.McpServiceConfig, error) {
+	resp, err := r.client.AiGateway.CreateMcpService(ctx, catalog.CreateMcpServiceRequest{
+		Parent:       config.Parent,
+		McpServiceId: config.McpServiceId,
+		McpService:   mcpServiceBody(config),
+	})
+	if err != nil {
+		return "", nil, err
+	}
+	state, err := responseToMcpServiceConfig(resp)
+	if err != nil {
+		return "", nil, err
+	}
+	return strings.TrimPrefix(resp.Name, mcpServiceNamePrefix), state, nil
+}
+
+// DoUpdate sends update_mask "*" on every update. name, parent and
+// mcp_service_id are immutable (provided_id_fields in resources.yml), so the
+// wildcard replaces every client-settable field (comment + a full config
+// replace), matching the mask the Terraform provider generates.
+//
+// Etag is intentionally left empty here and in DoDelete: an empty etag means no
+// If-Match precondition (last-write-wins), matching the Terraform provider,
+// which also does not send etag. We deliberately do not do optimistic
+// concurrency on these resources.
+func (r *ResourceMcpService) DoUpdate(ctx context.Context, id string, config *resources.McpServiceConfig, _ *PlanEntry) (*resources.McpServiceConfig, error) {
+	resp, err := r.client.AiGateway.UpdateMcpService(ctx, catalog.UpdateMcpServiceRequest{
+		Etag:            "",
+		McpService:      mcpServiceBody(config),
+		Name:            mcpServiceNamePrefix + id,
+		UpdateMask:      fieldmask.FieldMask{Paths: []string{"*"}},
+		ForceSendFields: nil,
+	})
+	if err != nil {
+		return nil, err
+	}
+	return responseToMcpServiceConfig(resp)
+}
+
+func (r *ResourceMcpService) DoDelete(ctx context.Context, id string, _ *resources.McpServiceConfig) error {
+	return r.client.AiGateway.DeleteMcpService(ctx, catalog.DeleteMcpServiceRequest{
+		Etag:            "",
+		Name:            mcpServiceNamePrefix + id,
+		ForceSendFields: nil,
+	})
+}
diff --git a/bundle/direct/dresources/model.go b/bundle/direct/dresources/model.go
index 52a3b1075de..83a4f8832aa 100644
--- a/bundle/direct/dresources/model.go
+++ b/bundle/direct/dresources/model.go
@@ -2,10 +2,12 @@ package dresources
 
 import (
 	"context"
+	"errors"
 
 	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/cli/libs/utils"
 	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/marshal"
 	"github.com/databricks/databricks-sdk-go/service/ml"
 )
 
@@ -22,6 +24,16 @@ type MlflowModelRemote struct {
 	ModelId string `json:"model_id"`
 }
 
+// Custom marshalers needed because embedded ml.ModelDatabricks has its own
+// MarshalJSON which would otherwise take over and ignore model_id.
+func (s *MlflowModelRemote) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, s)
+}
+
+func (s MlflowModelRemote) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(s)
+}
+
 func (*ResourceMlflowModel) New(client *databricks.WorkspaceClient) *ResourceMlflowModel {
 	return &ResourceMlflowModel{client: client}
 }
@@ -57,6 +69,9 @@ func (r *ResourceMlflowModel) DoCreate(ctx context.Context, config *ml.CreateMod
 	if err != nil {
 		return "", nil, err
 	}
+	if response.RegisteredModel == nil {
+		return "", nil, errors.New("CreateModel returned no registered_model")
+	}
 	// Return nil for refresh output; the engine will call DoRead to populate the full state
 	// including the numeric model ID needed for permissions.
 	return response.RegisteredModel.Name, nil, nil
@@ -73,6 +88,9 @@ func (r *ResourceMlflowModel) DoUpdate(ctx context.Context, id string, config *m
 	if err != nil {
 		return nil, err
 	}
+	if response.RegisteredModel == nil {
+		return nil, errors.New("UpdateModel returned no registered_model")
+	}
 
 	// Carry forward model_id from existing state since UpdateModelResponse doesn't include it.
 	var modelId string
@@ -80,24 +98,26 @@ func (r *ResourceMlflowModel) DoUpdate(ctx context.Context, id string, config *m
 		modelId = old.ModelId
 	}
 
+	// Id and PermissionLevel are left empty because ml.Model (the UpdateModel
+	// response) does not carry them; every other field is taken from the
+	// response so references against the post-update remote state resolve to
+	// real values until the next plan's DoRead.
 	return &MlflowModelRemote{
-		ModelDatabricks: ml.ModelDatabricks{
-			CreationTimestamp:    0,
-			Description:          response.RegisteredModel.Description,
-			Id:                   "",
-			LastUpdatedTimestamp: 0,
-			LatestVersions:       nil,
-			Name:                 response.RegisteredModel.Name,
-			PermissionLevel:      "",
-			Tags:                 response.RegisteredModel.Tags,
-			UserId:               "",
-			ForceSendFields:      utils.FilterFields[ml.ModelDatabricks](response.RegisteredModel.ForceSendFields, "CreationTimestamp", "Id", "LastUpdatedTimestamp", "LatestVersions", "PermissionLevel", "UserId"),
-		},
-		ModelId: modelId,
+		CreationTimestamp:    response.RegisteredModel.CreationTimestamp,
+		Description:          response.RegisteredModel.Description,
+		Id:                   "",
+		LastUpdatedTimestamp: response.RegisteredModel.LastUpdatedTimestamp,
+		LatestVersions:       response.RegisteredModel.LatestVersions,
+		Name:                 response.RegisteredModel.Name,
+		PermissionLevel:      "",
+		Tags:                 response.RegisteredModel.Tags,
+		UserId:               response.RegisteredModel.UserId,
+		ForceSendFields:      utils.FilterFields[ml.ModelDatabricks](response.RegisteredModel.ForceSendFields, "Id", "PermissionLevel"),
+		ModelId:              modelId,
 	}, nil
 }
 
-func (r *ResourceMlflowModel) DoDelete(ctx context.Context, id string) error {
+func (r *ResourceMlflowModel) DoDelete(ctx context.Context, id string, _ *ml.CreateModelRequest) error {
 	return r.client.ModelRegistry.DeleteModel(ctx, ml.DeleteModelRequest{
 		Name: id,
 	})
diff --git a/bundle/direct/dresources/model_provider_service.go b/bundle/direct/dresources/model_provider_service.go
new file mode 100644
index 00000000000..ebf02e9c3f6
--- /dev/null
+++ b/bundle/direct/dresources/model_provider_service.go
@@ -0,0 +1,138 @@
+package dresources
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/common/types/fieldmask"
+	"github.com/databricks/databricks-sdk-go/service/catalog"
+)
+
+// AI Gateway model provider service.
+// API: https://docs.databricks.com/api/workspace/aigateway
+// Terraform: databricks_ai_gateway_model_provider_service
+//
+// Mirrors ResourceModelService: the remote type returned by DoRead is the same
+// bundle-local resources.ModelProviderServiceConfig used for state (so
+// RemapState is not needed), and DoRead reconstructs the create-time identity
+// (parent + model_provider_service_id) from the server-derived resource name.
+const modelProviderServiceNamePrefix = "model-provider-services/"
+
+type ResourceModelProviderService struct {
+	client *databricks.WorkspaceClient
+}
+
+func (*ResourceModelProviderService) New(client *databricks.WorkspaceClient) *ResourceModelProviderService {
+	return &ResourceModelProviderService{client: client}
+}
+
+func (*ResourceModelProviderService) PrepareState(input *resources.ModelProviderService) *resources.ModelProviderServiceConfig {
+	return &input.ModelProviderServiceConfig
+}
+
+// modelProviderServiceIdentityFromName reconstructs the create-time parent and
+// leaf id from the server-derived resource name
+// `model-provider-services/{catalog}.{schema}.{model_provider_service}`.
+func modelProviderServiceIdentityFromName(name string) (parent, modelProviderServiceId string, err error) {
+	rest, ok := strings.CutPrefix(name, modelProviderServiceNamePrefix)
+	if !ok {
+		return "", "", fmt.Errorf("unexpected model provider service name %q (want model-provider-services/{catalog}.{schema}.{model_provider_service})", name)
+	}
+	parts := strings.Split(rest, ".")
+	if len(parts) != 3 {
+		return "", "", fmt.Errorf("unexpected model provider service name %q (want three dot-separated components)", name)
+	}
+	return "schemas/" + parts[0] + "." + parts[1], parts[2], nil
+}
+
+func responseToModelProviderServiceConfig(ms *catalog.ModelProviderService) (*resources.ModelProviderServiceConfig, error) {
+	parent, id, err := modelProviderServiceIdentityFromName(ms.Name)
+	if err != nil {
+		return nil, err
+	}
+	return &resources.ModelProviderServiceConfig{
+		Parent:                 parent,
+		ModelProviderServiceId: id,
+		Comment:                ms.Comment,
+		Config:                 ms.Config,
+		ForceSendFields:        nil,
+	}, nil
+}
+
+// modelProviderServiceBody builds the ModelProviderService write payload from the
+// bundle config. Only comment and config are client-settable; every other field
+// is OUTPUT_ONLY (server-derived) and sent as its zero value.
+func modelProviderServiceBody(config *resources.ModelProviderServiceConfig) catalog.ModelProviderService {
+	return catalog.ModelProviderService{
+		Comment:         config.Comment,
+		Config:          config.Config,
+		CreateTime:      nil,
+		CreatedBy:       "",
+		EffectiveOwner:  "",
+		Etag:            "",
+		MetastoreId:     "",
+		Name:            "",
+		UpdateTime:      nil,
+		UpdatedBy:       "",
+		ForceSendFields: nil,
+	}
+}
+
+func (r *ResourceModelProviderService) DoRead(ctx context.Context, id string) (*resources.ModelProviderServiceConfig, error) {
+	ms, err := r.client.AiGateway.GetModelProviderService(ctx, catalog.GetModelProviderServiceRequest{Name: modelProviderServiceNamePrefix + id})
+	if err != nil {
+		return nil, err
+	}
+	return responseToModelProviderServiceConfig(ms)
+}
+
+func (r *ResourceModelProviderService) DoCreate(ctx context.Context, config *resources.ModelProviderServiceConfig) (string, *resources.ModelProviderServiceConfig, error) {
+	resp, err := r.client.AiGateway.CreateModelProviderService(ctx, catalog.CreateModelProviderServiceRequest{
+		Parent:                 config.Parent,
+		ModelProviderServiceId: config.ModelProviderServiceId,
+		ModelProviderService:   modelProviderServiceBody(config),
+	})
+	if err != nil {
+		return "", nil, err
+	}
+	state, err := responseToModelProviderServiceConfig(resp)
+	if err != nil {
+		return "", nil, err
+	}
+	return strings.TrimPrefix(resp.Name, modelProviderServiceNamePrefix), state, nil
+}
+
+// DoUpdate sends update_mask "*" on every update. name, parent and
+// model_provider_service_id are immutable (provided_id_fields), and
+// config.provider_type is immutable (recreate_on_changes), so the wildcard
+// replaces every client-settable field (comment + a full config replace),
+// matching the mask the Terraform provider generates.
+//
+// Etag is intentionally left empty here and in DoDelete: an empty etag means no
+// If-Match precondition (last-write-wins), matching the Terraform provider,
+// which also does not send etag. We deliberately do not do optimistic
+// concurrency on these resources.
+func (r *ResourceModelProviderService) DoUpdate(ctx context.Context, id string, config *resources.ModelProviderServiceConfig, _ *PlanEntry) (*resources.ModelProviderServiceConfig, error) {
+	resp, err := r.client.AiGateway.UpdateModelProviderService(ctx, catalog.UpdateModelProviderServiceRequest{
+		Etag:                 "",
+		Name:                 modelProviderServiceNamePrefix + id,
+		ModelProviderService: modelProviderServiceBody(config),
+		UpdateMask:           fieldmask.FieldMask{Paths: []string{"*"}},
+		ForceSendFields:      nil,
+	})
+	if err != nil {
+		return nil, err
+	}
+	return responseToModelProviderServiceConfig(resp)
+}
+
+func (r *ResourceModelProviderService) DoDelete(ctx context.Context, id string, _ *resources.ModelProviderServiceConfig) error {
+	return r.client.AiGateway.DeleteModelProviderService(ctx, catalog.DeleteModelProviderServiceRequest{
+		Etag:            "",
+		Name:            modelProviderServiceNamePrefix + id,
+		ForceSendFields: nil,
+	})
+}
diff --git a/bundle/direct/dresources/model_service.go b/bundle/direct/dresources/model_service.go
new file mode 100644
index 00000000000..7eb3860d191
--- /dev/null
+++ b/bundle/direct/dresources/model_service.go
@@ -0,0 +1,143 @@
+package dresources
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/common/types/fieldmask"
+	"github.com/databricks/databricks-sdk-go/service/catalog"
+)
+
+// AI Gateway model service.
+// API: https://docs.databricks.com/api/workspace/aigateway
+// Terraform: databricks_ai_gateway_model_service
+//
+// The remote type returned by DoRead is the same bundle-local
+// resources.ModelServiceConfig used for state, so RemapState is not needed.
+// DoRead reconstructs the create-time identity (parent + model_service_id) from
+// the server-derived resource name so those fields participate in normal drift
+// detection rather than being suppressed as missing-in-remote.
+// modelServiceNamePrefix is the fixed prefix of the resource name
+// (model-services/{catalog}.{schema}.{model_service}). The engine tracks the id
+// as the bare {catalog}.{schema}.{model_service} portion and this prefix is
+// re-added when addressing the resource through the SDK.
+const modelServiceNamePrefix = "model-services/"
+
+type ResourceModelService struct {
+	client *databricks.WorkspaceClient
+}
+
+func (*ResourceModelService) New(client *databricks.WorkspaceClient) *ResourceModelService {
+	return &ResourceModelService{client: client}
+}
+
+func (*ResourceModelService) PrepareState(input *resources.ModelService) *resources.ModelServiceConfig {
+	return &input.ModelServiceConfig
+}
+
+// modelServiceIdentityFromName reconstructs the create-time parent and leaf id
+// from the server-derived resource name
+// `model-services/{catalog}.{schema}.{model_service}`.
+func modelServiceIdentityFromName(name string) (parent, modelServiceId string, err error) {
+	rest, ok := strings.CutPrefix(name, "model-services/")
+	if !ok {
+		return "", "", fmt.Errorf("unexpected model service name %q (want model-services/{catalog}.{schema}.{model_service})", name)
+	}
+	parts := strings.Split(rest, ".")
+	if len(parts) != 3 {
+		return "", "", fmt.Errorf("unexpected model service name %q (want three dot-separated components)", name)
+	}
+	return "schemas/" + parts[0] + "." + parts[1], parts[2], nil
+}
+
+func responseToModelServiceConfig(ms *catalog.ModelService) (*resources.ModelServiceConfig, error) {
+	parent, id, err := modelServiceIdentityFromName(ms.Name)
+	if err != nil {
+		return nil, err
+	}
+	return &resources.ModelServiceConfig{
+		Parent:          parent,
+		ModelServiceId:  id,
+		Comment:         ms.Comment,
+		Config:          ms.Config,
+		ForceSendFields: nil,
+	}, nil
+}
+
+// modelServiceBody builds the ModelService write payload from the bundle config.
+// Only comment and config are client-settable; every other field is OUTPUT_ONLY
+// (server-derived) and sent as its zero value.
+func modelServiceBody(config *resources.ModelServiceConfig) catalog.ModelService {
+	return catalog.ModelService{
+		Comment:           config.Comment,
+		Config:            config.Config,
+		CreateTime:        nil,
+		CreatedBy:         "",
+		EffectiveOwner:    "",
+		Etag:              "",
+		MetastoreId:       "",
+		Name:              "",
+		SupportedApiTypes: nil,
+		UpdateTime:        nil,
+		UpdatedBy:         "",
+		ForceSendFields:   nil,
+	}
+}
+
+func (r *ResourceModelService) DoRead(ctx context.Context, id string) (*resources.ModelServiceConfig, error) {
+	ms, err := r.client.AiGateway.GetModelService(ctx, catalog.GetModelServiceRequest{Name: modelServiceNamePrefix + id})
+	if err != nil {
+		return nil, err
+	}
+	return responseToModelServiceConfig(ms)
+}
+
+func (r *ResourceModelService) DoCreate(ctx context.Context, config *resources.ModelServiceConfig) (string, *resources.ModelServiceConfig, error) {
+	resp, err := r.client.AiGateway.CreateModelService(ctx, catalog.CreateModelServiceRequest{
+		Parent:         config.Parent,
+		ModelServiceId: config.ModelServiceId,
+		ModelService:   modelServiceBody(config),
+	})
+	if err != nil {
+		return "", nil, err
+	}
+	state, err := responseToModelServiceConfig(resp)
+	if err != nil {
+		return "", nil, err
+	}
+	return strings.TrimPrefix(resp.Name, modelServiceNamePrefix), state, nil
+}
+
+// DoUpdate sends update_mask "*" on every update. name, parent and
+// model_service_id are immutable (recreate_on_changes in model_services.yml), so the
+// wildcard replaces every client-settable field (comment + a full config
+// replace), matching the mask the Terraform provider generates.
+//
+// Etag is intentionally left empty here and in DoDelete: an empty etag means no
+// If-Match precondition (last-write-wins), matching the Terraform provider,
+// which also does not send etag. We deliberately do not do optimistic
+// concurrency on these resources.
+func (r *ResourceModelService) DoUpdate(ctx context.Context, id string, config *resources.ModelServiceConfig, _ *PlanEntry) (*resources.ModelServiceConfig, error) {
+	resp, err := r.client.AiGateway.UpdateModelService(ctx, catalog.UpdateModelServiceRequest{
+		Etag:            "",
+		ModelService:    modelServiceBody(config),
+		Name:            modelServiceNamePrefix + id,
+		UpdateMask:      fieldmask.FieldMask{Paths: []string{"*"}},
+		ForceSendFields: nil,
+	})
+	if err != nil {
+		return nil, err
+	}
+	return responseToModelServiceConfig(resp)
+}
+
+func (r *ResourceModelService) DoDelete(ctx context.Context, id string, _ *resources.ModelServiceConfig) error {
+	return r.client.AiGateway.DeleteModelService(ctx, catalog.DeleteModelServiceRequest{
+		Etag:            "",
+		Name:            modelServiceNamePrefix + id,
+		ForceSendFields: nil,
+	})
+}
diff --git a/bundle/direct/dresources/model_serving_endpoint.go b/bundle/direct/dresources/model_serving_endpoint.go
index 06a8dbda40f..f9c0a2314ac 100644
--- a/bundle/direct/dresources/model_serving_endpoint.go
+++ b/bundle/direct/dresources/model_serving_endpoint.go
@@ -9,6 +9,7 @@ import (
 	"github.com/databricks/cli/libs/structs/structpath"
 	"github.com/databricks/cli/libs/utils"
 	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/marshal"
 	"github.com/databricks/databricks-sdk-go/service/serving"
 )
 
@@ -18,6 +19,7 @@ var (
 	pathAiGateway          = structpath.MustParsePath("ai_gateway")
 	pathConfig             = structpath.MustParsePath("config")
 	pathEmailNotifications = structpath.MustParsePath("email_notifications")
+	pathTelemetryConfig    = structpath.MustParsePath("telemetry_config")
 )
 
 type ResourceModelServingEndpoint struct {
@@ -34,6 +36,11 @@ func (*ResourceModelServingEndpoint) PrepareState(input *resources.ModelServingE
 	return &input.CreateServingEndpoint
 }
 
+// AutoCaptureConfig is the legacy inference-table API; the recommended replacement
+// is AI Gateway inference tables. Bundles still expose it, so the conversion has to
+// keep working until users have migrated.
+//
+//nolint:staticcheck // SA1019: deprecated AutoCaptureConfig{Input,Output} kept for bundle config compatibility
 func autoCaptureConfigOutputToInput(output *serving.AutoCaptureConfigOutput) *serving.AutoCaptureConfigInput {
 	if output == nil {
 		return nil
@@ -87,19 +94,17 @@ func configOutputToInput(output *serving.EndpointCoreConfigOutput) *serving.Endp
 }
 
 func (*ResourceModelServingEndpoint) RemapState(state *ModelServingEndpointRemote) *serving.CreateServingEndpoint {
-	details := state.EndpointDetails
-	// Map the remote state (ServingEndpointDetailed) to the local state (CreateServingEndpoint)
-	// for proper comparison during diff calculation
 	return &serving.CreateServingEndpoint{
-		AiGateway:          details.AiGateway,
-		BudgetPolicyId:     details.BudgetPolicyId,
-		Config:             configOutputToInput(details.Config),
-		Description:        details.Description,
-		EmailNotifications: details.EmailNotifications,
-		Name:               details.Name,
-		RouteOptimized:     details.RouteOptimized,
-		Tags:               details.Tags,
-		ForceSendFields:    utils.FilterFields[serving.CreateServingEndpoint](details.ForceSendFields),
+		AiGateway:          state.AiGateway,
+		BudgetPolicyId:     state.BudgetPolicyId,
+		Config:             state.Config,
+		Description:        state.Description,
+		EmailNotifications: state.EmailNotifications,
+		Name:               state.Name,
+		RouteOptimized:     state.RouteOptimized,
+		Tags:               state.Tags,
+		TelemetryConfig:    state.TelemetryConfig,
+		ForceSendFields:    utils.FilterFields[serving.CreateServingEndpoint](state.ForceSendFields),
 
 		// Rate limits are a deprecated field that are not returned by the API on GET calls. Thus we map them to nil.
 		// TODO(shreyas): Add a warning when users try setting top level rate limits.
@@ -110,6 +115,49 @@ func (*ResourceModelServingEndpoint) RemapState(state *ModelServingEndpointRemot
 type ModelServingEndpointRemote struct {
 	EndpointDetails *serving.ServingEndpointDetailed `json:"endpoint_details"`
 	EndpointId      string                           `json:"endpoint_id"`
+
+	// Fields mapped from EndpointDetails in DoRead so that RemapState is a direct copy
+	// and these fields participate in normal drift detection.
+	AiGateway          *serving.AiGatewayConfig         `json:"ai_gateway,omitempty"`
+	BudgetPolicyId     string                           `json:"budget_policy_id,omitempty"`
+	Config             *serving.EndpointCoreConfigInput `json:"config,omitempty"`
+	Description        string                           `json:"description,omitempty"`
+	EmailNotifications *serving.EmailNotifications      `json:"email_notifications,omitempty"`
+	Name               string                           `json:"name,omitempty"`
+	RouteOptimized     bool                             `json:"route_optimized,omitempty"`
+	Tags               []serving.EndpointTag            `json:"tags,omitempty"`
+	TelemetryConfig    *serving.TelemetryConfig         `json:"telemetry_config,omitempty"`
+
+	// ForceSendFields surfaces EndpointDetails.ForceSendFields at the root so RemapState is a
+	// plain field copy rather than reaching into the nested EndpointDetails struct.
+	ForceSendFields []string `json:"-"`
+}
+
+// Custom marshalers so the SDK's ForceSendFields convention is honored on the wrapper and its
+// extra fields survive a JSON state round-trip (mirrors VectorSearchEndpointRemote).
+func (s *ModelServingEndpointRemote) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, s)
+}
+
+func (s ModelServingEndpointRemote) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(s)
+}
+
+func newModelServingEndpointRemote(details *serving.ServingEndpointDetailed) *ModelServingEndpointRemote {
+	return &ModelServingEndpointRemote{
+		EndpointDetails:    details,
+		EndpointId:         details.Id,
+		AiGateway:          details.AiGateway,
+		BudgetPolicyId:     details.BudgetPolicyId,
+		Config:             configOutputToInput(details.Config),
+		Description:        details.Description,
+		EmailNotifications: details.EmailNotifications,
+		Name:               details.Name,
+		RouteOptimized:     details.RouteOptimized,
+		Tags:               details.Tags,
+		TelemetryConfig:    details.TelemetryConfig,
+		ForceSendFields:    utils.FilterFields[ModelServingEndpointRemote](details.ForceSendFields),
+	}
 }
 
 func (r *ResourceModelServingEndpoint) DoRead(ctx context.Context, id string) (*ModelServingEndpointRemote, error) {
@@ -117,10 +165,7 @@ func (r *ResourceModelServingEndpoint) DoRead(ctx context.Context, id string) (*
 	if err != nil {
 		return nil, err
 	}
-	return &ModelServingEndpointRemote{
-		EndpointDetails: endpoint,
-		EndpointId:      endpoint.Id,
-	}, nil
+	return newModelServingEndpointRemote(endpoint), nil
 }
 
 func (r *ResourceModelServingEndpoint) DoCreate(ctx context.Context, config *serving.CreateServingEndpoint) (string, *ModelServingEndpointRemote, error) {
@@ -138,18 +183,14 @@ func (r *ResourceModelServingEndpoint) waitForEndpointReady(ctx context.Context,
 	if err != nil {
 		return nil, err
 	}
-
-	return &ModelServingEndpointRemote{
-		EndpointDetails: details,
-		EndpointId:      details.Id,
-	}, nil
+	return newModelServingEndpointRemote(details), nil
 }
 
-func (r *ResourceModelServingEndpoint) WaitAfterCreate(ctx context.Context, config *serving.CreateServingEndpoint) (*ModelServingEndpointRemote, error) {
+func (r *ResourceModelServingEndpoint) WaitAfterCreate(ctx context.Context, id string, config *serving.CreateServingEndpoint) (*ModelServingEndpointRemote, error) {
 	return r.waitForEndpointReady(ctx, config.Name)
 }
 
-func (r *ResourceModelServingEndpoint) WaitAfterUpdate(ctx context.Context, config *serving.CreateServingEndpoint) (*ModelServingEndpointRemote, error) {
+func (r *ResourceModelServingEndpoint) WaitAfterUpdate(ctx context.Context, id string, config *serving.CreateServingEndpoint) (*ModelServingEndpointRemote, error) {
 	return r.waitForEndpointReady(ctx, config.Name)
 }
 
@@ -222,6 +263,19 @@ func (r *ResourceModelServingEndpoint) updateNotifications(ctx context.Context,
 	return nil
 }
 
+// updateTelemetryConfig removes telemetry when telemetryConfig is nil.
+func (r *ResourceModelServingEndpoint) updateTelemetryConfig(ctx context.Context, id string, telemetryConfig *serving.TelemetryConfig) error {
+	req := serving.PatchTelemetryConfigRequest{
+		Name:            id,
+		TelemetryConfig: telemetryConfig,
+	}
+	_, err := r.client.ServingEndpoints.PatchTelemetryConfig(ctx, req)
+	if err != nil {
+		return fmt.Errorf("failed to update telemetry config: %w", err)
+	}
+	return nil
+}
+
 func diffTags(currentTags, desiredTags []serving.EndpointTag) (addTags []serving.EndpointTag, deleteTags []string) {
 	addTags = make([]serving.EndpointTag, 0)
 
@@ -319,9 +373,22 @@ func (r *ResourceModelServingEndpoint) DoUpdate(ctx context.Context, id string,
 		}
 	}
 
+	if entry.Changes.HasChange(pathTelemetryConfig) {
+		// The telemetry API rejects endpoints with an update in progress.
+		_, err = r.waitForEndpointReady(ctx, id)
+		if err != nil {
+			return nil, err
+		}
+
+		err = r.updateTelemetryConfig(ctx, id, config.TelemetryConfig)
+		if err != nil {
+			return nil, err
+		}
+	}
+
 	return nil, nil
 }
 
-func (r *ResourceModelServingEndpoint) DoDelete(ctx context.Context, id string) error {
+func (r *ResourceModelServingEndpoint) DoDelete(ctx context.Context, id string, _ *serving.CreateServingEndpoint) error {
 	return r.client.ServingEndpoints.DeleteByName(ctx, id)
 }
diff --git a/bundle/direct/dresources/permissions.go b/bundle/direct/dresources/permissions.go
index eac5e2dcdbc..c2aebb4d0ac 100644
--- a/bundle/direct/dresources/permissions.go
+++ b/bundle/direct/dresources/permissions.go
@@ -17,7 +17,10 @@ var permissionResourceToObjectType = map[string]string{
 	"alerts":                  "/alertsv2/",
 	"apps":                    "/apps/",
 	"clusters":                "/clusters/",
+	"cluster_policies":        "/cluster-policies/",
+	"instance_pools":          "/instance-pools/",
 	"dashboards":              "/dashboards/",
+	"genie_spaces":            "/genie/",
 	"database_instances":      "/database-instances/",
 	"postgres_projects":       "/database-projects/",
 	"jobs":                    "/jobs/",
@@ -31,6 +34,12 @@ var permissionResourceToObjectType = map[string]string{
 
 type ResourcePermissions struct {
 	client *databricks.WorkspaceClient
+
+	// objectType is the permissions API prefix of the parent resource, e.g. "/jobs/".
+	objectType string
+
+	// idField is the parent field holding the permissions object ID.
+	idField string
 }
 
 // StatePermission represents a permission entry in deployment state.
@@ -55,7 +64,7 @@ type PermissionsState struct {
 }
 
 // permissionIDFields maps resource types that use a non-standard ID field for
-// the permissions API (most resources use "id").
+// the permissions API; resources absent from it use defaultPermissionIDField.
 var permissionIDFields = map[string]string{
 	"model_serving_endpoints": "endpoint_id",   // internal numeric ID, not the name used in CRUD APIs
 	"models":                  "model_id",      // numeric model ID, not the model name used as CRUD state ID
@@ -63,29 +72,35 @@ var permissionIDFields = map[string]string{
 	"vector_search_endpoints": "endpoint_uuid", // endpoint UUID, not the endpoint name used as deployment ID
 }
 
-// objectIDRef returns the reference expression for the permissions object ID.
-func objectIDRef(prefix, baseNode, resourceType string) string {
-	if field, ok := permissionIDFields[resourceType]; ok {
-		return prefix + "${" + baseNode + "." + field + "}"
-	}
-	return prefix + "${" + baseNode + ".id}"
+const defaultPermissionIDField = "id"
+
+func (*ResourcePermissions) New(client *databricks.WorkspaceClient) *ResourcePermissions {
+	return &ResourcePermissions{client: client, objectType: "", idField: ""}
 }
 
-func PreparePermissionsInputConfig(inputConfig any, node string) (*structvar.StructVar, error) {
-	baseNode, ok := strings.CutSuffix(node, ".permissions")
+func (r *ResourcePermissions) Configure(resourceType string) error {
+	parentType, ok := strings.CutSuffix(resourceType, ".permissions")
 	if !ok {
-		return nil, fmt.Errorf("internal error: node %q does not end with .permissions", node)
+		return fmt.Errorf("internal error: resource type %q does not end with .permissions", resourceType)
 	}
 
-	parts := strings.Split(baseNode, ".")
-	if len(parts) < 2 {
-		return nil, fmt.Errorf("internal error: unexpected node format %q", baseNode)
+	r.objectType, ok = permissionResourceToObjectType[parentType]
+	if !ok {
+		return fmt.Errorf("unsupported permissions resource type: %s", parentType)
 	}
-	resourceType := parts[1]
 
-	prefix, ok := permissionResourceToObjectType[resourceType]
+	r.idField, ok = permissionIDFields[parentType]
 	if !ok {
-		return nil, fmt.Errorf("unsupported permissions resource type: %s", resourceType)
+		r.idField = defaultPermissionIDField
+	}
+
+	return nil
+}
+
+func (r *ResourcePermissions) PrepareInputConfig(inputConfig any, resourceKey string) (*structvar.StructVar, error) {
+	baseNode, ok := strings.CutSuffix(resourceKey, ".permissions")
+	if !ok {
+		return nil, fmt.Errorf("internal error: node %q does not end with .permissions", resourceKey)
 	}
 
 	permissions, err := toStatePermissions(inputConfig)
@@ -99,15 +114,11 @@ func PreparePermissionsInputConfig(inputConfig any, node string) (*structvar.Str
 			EmbeddedSlice: permissions,
 		},
 		Refs: map[string]string{
-			"object_id": objectIDRef(prefix, baseNode, resourceType),
+			"object_id": r.objectType + "${" + baseNode + "." + r.idField + "}",
 		},
 	}, nil
 }
 
-func (*ResourcePermissions) New(client *databricks.WorkspaceClient) *ResourcePermissions {
-	return &ResourcePermissions{client: client}
-}
-
 func (*ResourcePermissions) PrepareState(s *PermissionsState) *PermissionsState {
 	return s
 }
@@ -219,7 +230,8 @@ func (r *ResourcePermissions) DoCreate(ctx context.Context, newState *Permission
 	// should we remember the default here?
 	_, err := r.DoUpdate(ctx, newState.ObjectID, newState, nil)
 	if err != nil {
-		return "", nil, err
+		// Permissions Set is idempotent (PUT), so retrying on transient errors is safe.
+		return "", nil, retrySafe(err)
 	}
 
 	return newState.ObjectID, nil, nil
@@ -252,14 +264,11 @@ func (r *ResourcePermissions) DoUpdate(ctx context.Context, _ string, newState *
 	return nil, err
 }
 
-// DoDelete is activated in 2 distinct cases:
+// ResourcePermissions intentionally implements no DoDelete (deleting is a state-only
+// cleanup, see PlanEntry.StateOnly). A delete would otherwise be activated in 2 cases:
 // 1) 'permissions' field is deleted in DABs config. In that case terraform would restore the default permissions (IS_OWNER for current user).
 // 2) the parent resource is deleted; in that case there is no need to do anything; parent resource deletion is enough.
-// Let's do nothing in both cases. If user no longer wishes to manage permissions with DABs they can go ahead and manage
+// We do nothing in both cases. If the user no longer wishes to manage permissions with DABs they can go ahead and manage
 // it themselves. Trying to fix permissions back requires
 // - making assumptions on what it should look like
 // - storing current user somewhere or storing original permissions somewhere
-func (r *ResourcePermissions) DoDelete(ctx context.Context, id string) error {
-	// intentional noop
-	return nil
-}
diff --git a/bundle/direct/dresources/permissions_test.go b/bundle/direct/dresources/permissions_test.go
new file mode 100644
index 00000000000..e6b63d37436
--- /dev/null
+++ b/bundle/direct/dresources/permissions_test.go
@@ -0,0 +1,66 @@
+package dresources
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// The object_id reference is synthesized from the resource type, so it is only exercised
+// end-to-end by acceptance tests. Pin both the default id field and an override here.
+func TestPermissionsPrepareInputConfig(t *testing.T) {
+	tests := []struct {
+		resourceType string
+		resourceKey  string
+		expectedRef  string
+	}{
+		{
+			resourceType: "jobs.permissions",
+			resourceKey:  "resources.jobs.foo.permissions",
+			expectedRef:  "/jobs/${resources.jobs.foo.id}",
+		},
+		{
+			// models use a numeric model_id, not the model name recorded as the CRUD state ID
+			resourceType: "models.permissions",
+			resourceKey:  "resources.models.foo.permissions",
+			expectedRef:  "/registered-models/${resources.models.foo.model_id}",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.resourceType, func(t *testing.T) {
+			adapter, err := NewAdapter(SupportedResources[tt.resourceType], tt.resourceType, nil)
+			require.NoError(t, err)
+
+			input := &[]resources.JobPermission{{Level: "CAN_VIEW", UserName: "alice"}}
+			sv, err := adapter.PrepareInputConfig(input, tt.resourceKey)
+			require.NoError(t, err)
+
+			assert.Equal(t, &PermissionsState{
+				EmbeddedSlice: []StatePermission{{Level: "CAN_VIEW", UserName: "alice"}},
+			}, sv.Value)
+			assert.Equal(t, map[string]string{"object_id": tt.expectedRef}, sv.Refs)
+		})
+	}
+}
+
+// Configure resolves the parent type at init, so an unregistered parent fails before planning.
+func TestPermissionsConfigureUnsupportedParent(t *testing.T) {
+	_, err := NewAdapter(SupportedResources["jobs.permissions"], "unregistered.permissions", nil)
+	assert.ErrorContains(t, err, "unsupported permissions resource type: unregistered")
+}
+
+// Resources without PrepareInputConfig get their config through unchanged and add no references.
+func TestPrepareInputConfigPassthrough(t *testing.T) {
+	adapter, err := NewAdapter(SupportedResources["schemas"], "schemas", nil)
+	require.NoError(t, err)
+
+	input := &resources.Schema{Name: "myschema"}
+	sv, err := adapter.PrepareInputConfig(input, "resources.schemas.foo")
+	require.NoError(t, err)
+
+	assert.Same(t, input, sv.Value)
+	assert.Nil(t, sv.Refs)
+}
diff --git a/bundle/direct/dresources/pipeline.go b/bundle/direct/dresources/pipeline.go
index 9a59ab4e40b..6f367d4e498 100644
--- a/bundle/direct/dresources/pipeline.go
+++ b/bundle/direct/dresources/pipeline.go
@@ -4,29 +4,54 @@ import (
 	"context"
 
 	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/cli/bundle/deployplan"
+	"github.com/databricks/cli/libs/structs/structdiff"
+	"github.com/databricks/cli/libs/structs/structpath"
 	"github.com/databricks/cli/libs/utils"
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/marshal"
 	"github.com/databricks/databricks-sdk-go/service/pipelines"
 )
 
+// PipelineState is the state type for Pipeline resources. It extends CreatePipeline with
+// the CascadeOnDestroy field, a delete-time setting that is not part of the pipeline spec
+type PipelineState struct {
+	pipelines.CreatePipeline
+
+	// CascadeOnDestroy controls whether deleting the pipeline also deletes its datasets (MVs,
+	// STs, Views). Nil means the server default (cascade) applies. Read from persisted state at
+	// delete time; never sent on create/update.
+	CascadeOnDestroy *bool `json:"cascade_on_destroy,omitempty"`
+}
+
+func (s *PipelineState) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, s)
+}
+
+func (s PipelineState) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(s)
+}
+
 // PipelineRemote is the return type for DoRead. It embeds CreatePipeline so that all
 // paths in StateType are valid paths in RemoteType.
+// Note that cascade_on_destroy is intentionally absent: it is a delete-time-only setting
+// that the GET response never returns, so the engine suppresses its drift automatically
 type PipelineRemote struct {
 	pipelines.CreatePipeline
 
 	// Remote-specific fields from pipelines.GetPipelineResponse
-	Cause                   string                              `json:"cause,omitempty"`
-	ClusterId               string                              `json:"cluster_id,omitempty"`
-	CreatorUserName         string                              `json:"creator_user_name,omitempty"`
-	EffectiveBudgetPolicyId string                              `json:"effective_budget_policy_id,omitempty"`
-	EffectivePublishingMode pipelines.PublishingMode            `json:"effective_publishing_mode,omitempty"`
-	Health                  pipelines.GetPipelineResponseHealth `json:"health,omitempty"`
-	LastModified            int64                               `json:"last_modified,omitempty"`
-	LatestUpdates           []pipelines.UpdateStateInfo         `json:"latest_updates,omitempty"`
-	PipelineId              string                              `json:"pipeline_id,omitempty"`
-	RunAsUserName           string                              `json:"run_as_user_name,omitempty"`
-	State                   pipelines.PipelineState             `json:"state,omitempty"`
+	Cause                        string                              `json:"cause,omitempty"`
+	ClusterId                    string                              `json:"cluster_id,omitempty"`
+	CreatorUserName              string                              `json:"creator_user_name,omitempty"`
+	EffectiveBudgetPolicyId      string                              `json:"effective_budget_policy_id,omitempty"`
+	EffectivePublishingMode      pipelines.PublishingMode            `json:"effective_publishing_mode,omitempty"`
+	EffectiveServerlessComputeId string                              `json:"effective_serverless_compute_id,omitempty"`
+	Health                       pipelines.GetPipelineResponseHealth `json:"health,omitempty"`
+	LastModified                 int64                               `json:"last_modified,omitempty"`
+	LatestUpdates                []pipelines.UpdateStateInfo         `json:"latest_updates,omitempty"`
+	PipelineId                   string                              `json:"pipeline_id,omitempty"`
+	RunAsUserName                string                              `json:"run_as_user_name,omitempty"`
+	State                        pipelines.PipelineState             `json:"state,omitempty"`
 }
 
 // Custom marshaler needed because embedded CreatePipeline has its own MarshalJSON
@@ -49,12 +74,19 @@ func (*ResourcePipeline) New(client *databricks.WorkspaceClient) *ResourcePipeli
 	}
 }
 
-func (*ResourcePipeline) PrepareState(input *resources.Pipeline) *pipelines.CreatePipeline {
-	return &input.CreatePipeline
+func (*ResourcePipeline) PrepareState(input *resources.Pipeline) *PipelineState {
+	return &PipelineState{
+		CreatePipeline:   input.CreatePipeline,
+		CascadeOnDestroy: input.CascadeOnDestroy,
+	}
 }
 
-func (*ResourcePipeline) RemapState(remote *PipelineRemote) *pipelines.CreatePipeline {
-	return &remote.CreatePipeline
+func (*ResourcePipeline) RemapState(remote *PipelineRemote) *PipelineState {
+	return &PipelineState{
+		CreatePipeline: remote.CreatePipeline,
+		// cascade_on_destroy is input-only and absent from PipelineRemote, so it stays nil here.
+		CascadeOnDestroy: nil,
+	}
 }
 
 func (r *ResourcePipeline) DoRead(ctx context.Context, id string) (*PipelineRemote, error) {
@@ -78,9 +110,9 @@ func makePipelineRemote(p *pipelines.GetPipelineResponse) *PipelineRemote {
 			Channel:             spec.Channel,
 			Clusters:            spec.Clusters,
 			Configuration:       spec.Configuration,
-			Continuous:          spec.Continuous,
+			Continuous:          spec.Continuous, //nolint:staticcheck // SA1019: pipeline continuous is deprecated in the SDK but remains a supported bundle config field
 			Deployment:          spec.Deployment,
-			Development:         spec.Development,
+			Development:         spec.Development, //nolint:staticcheck // SA1019: pipeline development is deprecated in the SDK but remains a supported bundle config field
 			DryRun:              false,
 			Edition:             spec.Edition,
 			Environment:         spec.Environment,
@@ -92,45 +124,55 @@ func makePipelineRemote(p *pipelines.GetPipelineResponse) *PipelineRemote {
 			Libraries:           spec.Libraries,
 			Name:                spec.Name,
 			Notifications:       spec.Notifications,
+			Parameters:          p.Parameters,
+			ParentPath:          spec.ParentPath,
 			Photon:              spec.Photon,
 			RestartWindow:       spec.RestartWindow,
 			RootPath:            spec.RootPath,
 			RunAs:               p.RunAs,
 			Schema:              spec.Schema,
 			Serverless:          spec.Serverless,
+			ServerlessComputeId: spec.ServerlessComputeId,
 			Storage:             spec.Storage,
 			Tags:                spec.Tags,
 			Target:              spec.Target,
 			Trigger:             spec.Trigger,
 			UsagePolicyId:       spec.UsagePolicyId,
-			ForceSendFields:     utils.FilterFields[pipelines.CreatePipeline](spec.ForceSendFields, "AllowDuplicateNames", "DryRun", "RunAs"),
+			ForceSendFields:     utils.FilterFields[pipelines.CreatePipeline](spec.ForceSendFields, "AllowDuplicateNames", "DryRun", "Parameters", "RunAs"),
 		}
 	}
 	return &PipelineRemote{
-		CreatePipeline:          createPipeline,
-		Cause:                   p.Cause,
-		ClusterId:               p.ClusterId,
-		CreatorUserName:         p.CreatorUserName,
-		EffectiveBudgetPolicyId: p.EffectiveBudgetPolicyId,
-		EffectivePublishingMode: p.EffectivePublishingMode,
-		Health:                  p.Health,
-		LastModified:            p.LastModified,
-		LatestUpdates:           p.LatestUpdates,
-		PipelineId:              p.PipelineId,
-		RunAsUserName:           p.RunAsUserName,
-		State:                   p.State,
+		CreatePipeline:               createPipeline,
+		Cause:                        p.Cause,
+		ClusterId:                    p.ClusterId,
+		CreatorUserName:              p.CreatorUserName,
+		EffectiveBudgetPolicyId:      p.EffectiveBudgetPolicyId,
+		EffectivePublishingMode:      p.EffectivePublishingMode,
+		EffectiveServerlessComputeId: p.EffectiveServerlessComputeId,
+		Health:                       p.Health,
+		LastModified:                 p.LastModified,
+		LatestUpdates:                p.LatestUpdates,
+		PipelineId:                   p.PipelineId,
+		RunAsUserName:                p.RunAsUserName,
+		State:                        p.State,
 	}
 }
 
-func (r *ResourcePipeline) DoCreate(ctx context.Context, config *pipelines.CreatePipeline) (string, *PipelineRemote, error) {
-	response, err := r.client.Pipelines.Create(ctx, *config)
+func (r *ResourcePipeline) DoCreate(ctx context.Context, config *PipelineState) (string, *PipelineRemote, error) {
+	response, err := r.client.Pipelines.Create(ctx, config.CreatePipeline)
 	if err != nil {
 		return "", nil, err
 	}
 	return response.PipelineId, nil, nil
 }
 
-func (r *ResourcePipeline) DoUpdate(ctx context.Context, id string, config *pipelines.CreatePipeline, _ *PlanEntry) (*PipelineRemote, error) {
+func (r *ResourcePipeline) DoUpdate(ctx context.Context, id string, config *PipelineState, entry *PlanEntry) (*PipelineRemote, error) {
+	// cascade_on_destroy is a delete-time-only setting with no update API, so a change to it
+	// alone must persist to state without a pipeline Update call.
+	if !entry.Changes.HasChangeExcept("cascade_on_destroy") {
+		return nil, nil
+	}
+
 	request := pipelines.EditPipeline{
 		AllowDuplicateNames:  config.AllowDuplicateNames,
 		BudgetPolicyId:       config.BudgetPolicyId,
@@ -138,9 +180,9 @@ func (r *ResourcePipeline) DoUpdate(ctx context.Context, id string, config *pipe
 		Channel:              config.Channel,
 		Clusters:             config.Clusters,
 		Configuration:        config.Configuration,
-		Continuous:           config.Continuous,
+		Continuous:           config.Continuous, //nolint:staticcheck // SA1019: pipeline continuous is deprecated in the SDK but remains a supported bundle config field
 		Deployment:           config.Deployment,
-		Development:          config.Development,
+		Development:          config.Development, //nolint:staticcheck // SA1019: pipeline development is deprecated in the SDK but remains a supported bundle config field
 		Edition:              config.Edition,
 		Environment:          config.Environment,
 		EventLog:             config.EventLog,
@@ -152,12 +194,15 @@ func (r *ResourcePipeline) DoUpdate(ctx context.Context, id string, config *pipe
 		Libraries:            config.Libraries,
 		Name:                 config.Name,
 		Notifications:        config.Notifications,
+		Parameters:           config.Parameters,
+		ParentPath:           config.ParentPath,
 		Photon:               config.Photon,
 		RestartWindow:        config.RestartWindow,
 		RootPath:             config.RootPath,
 		RunAs:                config.RunAs,
 		Schema:               config.Schema,
 		Serverless:           config.Serverless,
+		ServerlessComputeId:  config.ServerlessComputeId,
 		Storage:              config.Storage,
 		Tags:                 config.Tags,
 		Target:               config.Target,
@@ -170,8 +215,31 @@ func (r *ResourcePipeline) DoUpdate(ctx context.Context, id string, config *pipe
 	return nil, r.client.Pipelines.Update(ctx, request)
 }
 
-func (r *ResourcePipeline) DoDelete(ctx context.Context, id string) error {
-	return r.client.Pipelines.DeleteByPipelineId(ctx, id)
+func (r *ResourcePipeline) DoDelete(ctx context.Context, id string, state *PipelineState) error {
+	if state.CascadeOnDestroy == nil {
+		// No explicit cascade_on_destroy in config: preserve the backend default (cascade).
+		return r.client.Pipelines.DeleteByPipelineId(ctx, id)
+	}
+	return r.client.Pipelines.Delete(ctx, pipelines.DeletePipelineRequest{
+		PipelineId: id,
+		Cascade:    *state.CascadeOnDestroy,
+		Force:      false,
+		// Cascade is marshaled as `url:"cascade,omitempty"`, so a false value would be dropped from
+		// the query string. We specify `cascade` in ForceSendFields so the SDK send cascade=false explicitly
+		ForceSendFields: []string{"Cascade"},
+	})
+}
+
+// OverrideChangeDesc forces a state-only Update when cascade_on_destroy changes locally.
+// The field is absent from PipelineRemote, so unsetting puts us in the scenario where
+// old=false, new=nil, remote=nil.
+// The problem is that classifier skips the change if remote and new are "empty". There is a bug
+// where "false" value for a boolean field is treated as empty. Hence, we set this override.
+func (*ResourcePipeline) OverrideChangeDesc(_ context.Context, path *structpath.PathNode, change *ChangeDesc, _ *PipelineRemote) error {
+	if path.String() == "cascade_on_destroy" && !structdiff.IsEqual(change.Old, change.New) {
+		change.Action = deployplan.Update
+	}
+	return nil
 }
 
 // Note, terraform provider either
diff --git a/bundle/direct/dresources/pipeline_test.go b/bundle/direct/dresources/pipeline_test.go
index da769aa947b..3629255a600 100644
--- a/bundle/direct/dresources/pipeline_test.go
+++ b/bundle/direct/dresources/pipeline_test.go
@@ -4,7 +4,11 @@ import (
 	"reflect"
 	"testing"
 
+	"github.com/databricks/cli/bundle/deployplan"
+	"github.com/databricks/cli/libs/structs/structpath"
 	"github.com/databricks/databricks-sdk-go/service/pipelines"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 // TestPipelineRemote verifies that all fields from pipelines.GetPipelineResponse
@@ -14,6 +18,38 @@ func TestPipelineRemote(t *testing.T) {
 		"Spec":            true, // Embedded as pipelines.CreatePipeline (via makePipelineRemote)
 		"ForceSendFields": true, // Internal marshaling field
 		"Name":            true, // Available through embedded CreatePipeline
+		"Parameters":      true, // Available through embedded CreatePipeline
 		"RunAs":           true, // Available through embedded CreatePipeline
 	})
 }
+
+func TestPipelineOverrideChangeDescCascadeOnDestroy(t *testing.T) {
+	r := &ResourcePipeline{}
+	cascadePath := structpath.MustParsePath("cascade_on_destroy")
+	ptr := func(b bool) *bool { return &b }
+
+	t.Run("unset forces state-only update", func(t *testing.T) {
+		change := &ChangeDesc{Action: deployplan.Skip, Old: ptr(false), New: nil}
+		require.NoError(t, r.OverrideChangeDesc(t.Context(), cascadePath, change, nil))
+		assert.Equal(t, deployplan.Update, change.Action)
+	})
+
+	t.Run("changed value forces state-only update", func(t *testing.T) {
+		change := &ChangeDesc{Action: deployplan.Skip, Old: ptr(true), New: ptr(false)}
+		require.NoError(t, r.OverrideChangeDesc(t.Context(), cascadePath, change, nil))
+		assert.Equal(t, deployplan.Update, change.Action)
+	})
+
+	t.Run("unchanged value is left as skip", func(t *testing.T) {
+		change := &ChangeDesc{Action: deployplan.Skip, Old: ptr(false), New: ptr(false)}
+		require.NoError(t, r.OverrideChangeDesc(t.Context(), cascadePath, change, nil))
+		assert.Equal(t, deployplan.Skip, change.Action)
+	})
+
+	t.Run("other paths are untouched", func(t *testing.T) {
+		namePath := structpath.MustParsePath("name")
+		change := &ChangeDesc{Action: deployplan.Skip, Old: "a", New: nil}
+		require.NoError(t, r.OverrideChangeDesc(t.Context(), namePath, change, nil))
+		assert.Equal(t, deployplan.Skip, change.Action)
+	})
+}
diff --git a/bundle/direct/dresources/postgres_branch.go b/bundle/direct/dresources/postgres_branch.go
index cb042699dec..57bba56707d 100644
--- a/bundle/direct/dresources/postgres_branch.go
+++ b/bundle/direct/dresources/postgres_branch.go
@@ -2,13 +2,42 @@ package dresources
 
 import (
 	"context"
+	"slices"
 
 	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/common/types/fieldmask"
+	sdktime "github.com/databricks/databricks-sdk-go/common/types/time"
+	"github.com/databricks/databricks-sdk-go/marshal"
 	"github.com/databricks/databricks-sdk-go/service/postgres"
 )
 
+// PostgresBranchRemote is the return type for DoRead. It embeds BranchSpec so that
+// all paths in StateType are valid paths in RemoteType, enabling drift detection
+// for spec fields once the backend echoes spec on GET.
+type PostgresBranchRemote struct {
+	postgres.BranchSpec
+
+	BranchId string `json:"branch_id,omitempty"`
+	Parent   string `json:"parent,omitempty"`
+
+	Name       string                 `json:"name,omitempty"`
+	Status     *postgres.BranchStatus `json:"status,omitempty"`
+	Uid        string                 `json:"uid,omitempty"`
+	CreateTime *sdktime.Time          `json:"create_time,omitempty"`
+	UpdateTime *sdktime.Time          `json:"update_time,omitempty"`
+}
+
+// Custom marshaler needed because embedded BranchSpec has its own MarshalJSON
+// which would otherwise take over and ignore the additional fields.
+func (s *PostgresBranchRemote) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, s)
+}
+
+func (s PostgresBranchRemote) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(s)
+}
+
 type ResourcePostgresBranch struct {
 	client *databricks.WorkspaceClient
 }
@@ -21,42 +50,63 @@ func (*ResourcePostgresBranch) New(client *databricks.WorkspaceClient) *Resource
 
 func (*ResourcePostgresBranch) PrepareState(input *resources.PostgresBranch) *PostgresBranchState {
 	return &PostgresBranchState{
-		BranchId:   input.BranchId,
-		Parent:     input.Parent,
-		BranchSpec: input.BranchSpec,
+		BranchId:        input.BranchId,
+		Parent:          input.Parent,
+		ReplaceExisting: input.ReplaceExisting,
+		PurgeOnDelete:   input.PurgeOnDelete,
+		BranchSpec:      input.BranchSpec,
+		ForceSendFields: input.ForceSendFields,
 	}
 }
 
-func (*ResourcePostgresBranch) RemapState(remote *postgres.Branch) *PostgresBranchState {
-	// Extract branch_id from hierarchical name: "projects/{project_id}/branches/{branch_id}"
-	// TODO: log error when we have access to the context
-	components, _ := ParsePostgresName(remote.Name)
-
+func (*ResourcePostgresBranch) RemapState(remote *PostgresBranchRemote) *PostgresBranchState {
 	return &PostgresBranchState{
-		BranchId: components.BranchID,
+		BranchId: remote.BranchId,
 		Parent:   remote.Parent,
 
-		// The read API does not return the spec, only the status.
-		// This means we cannot detect remote drift for spec fields.
-		// Use an empty struct (not nil) so field-level diffing works correctly.
-		BranchSpec: postgres.BranchSpec{
-			ExpireTime:       nil,
-			IsProtected:      false,
-			NoExpiry:         false,
-			SourceBranch:     "",
-			SourceBranchLsn:  "",
-			SourceBranchTime: nil,
-			Ttl:              nil,
-			ForceSendFields:  nil,
-		},
+		// replace_existing is a create-time-only flag; the GET API never returns
+		// it, so RemapState leaves it false.
+		ReplaceExisting: false,
+
+		// purge_on_delete is a delete-time query parameter; the GET API never
+		// returns it, so RemapState leaves it false.
+		PurgeOnDelete:   false,
+		ForceSendFields: nil,
+
+		BranchSpec: remote.BranchSpec,
 	}
 }
 
-func (r *ResourcePostgresBranch) DoRead(ctx context.Context, id string) (*postgres.Branch, error) {
-	return r.client.Postgres.GetBranch(ctx, postgres.GetBranchRequest{Name: id})
+// makePostgresBranchRemote converts the SDK Branch into the embedded remote shape.
+// GET does not echo spec today (only status is returned); the embedded spec fields
+// stay at their zero values, and postgres_branches.yml suppresses phantom drift via
+// ignore_remote_changes with reason spec:input_only.
+func makePostgresBranchRemote(branch *postgres.Branch) *PostgresBranchRemote {
+	var spec postgres.BranchSpec
+	if branch.Spec != nil {
+		spec = *branch.Spec
+	}
+	return &PostgresBranchRemote{
+		BranchSpec: spec,
+		BranchId:   branch.BranchId,
+		Parent:     branch.Parent,
+		Name:       branch.Name,
+		Status:     branch.Status,
+		Uid:        branch.Uid,
+		CreateTime: branch.CreateTime,
+		UpdateTime: branch.UpdateTime,
+	}
 }
 
-func (r *ResourcePostgresBranch) DoCreate(ctx context.Context, config *PostgresBranchState) (string, *postgres.Branch, error) {
+func (r *ResourcePostgresBranch) DoRead(ctx context.Context, id string) (*PostgresBranchRemote, error) {
+	branch, err := r.client.Postgres.GetBranch(ctx, postgres.GetBranchRequest{Name: id})
+	if err != nil {
+		return nil, err
+	}
+	return makePostgresBranchRemote(branch), nil
+}
+
+func (r *ResourcePostgresBranch) DoCreate(ctx context.Context, config *PostgresBranchState) (string, *PostgresBranchRemote, error) {
 	waiter, err := r.client.Postgres.CreateBranch(ctx, postgres.CreateBranchRequest{
 		BranchId: config.BranchId,
 		Parent:   config.Parent,
@@ -64,6 +114,7 @@ func (r *ResourcePostgresBranch) DoCreate(ctx context.Context, config *PostgresB
 			Spec: &config.BranchSpec,
 
 			// Output-only fields.
+			BranchId:        "",
 			CreateTime:      nil,
 			Name:            "",
 			Parent:          "",
@@ -72,6 +123,8 @@ func (r *ResourcePostgresBranch) DoCreate(ctx context.Context, config *PostgresB
 			UpdateTime:      nil,
 			ForceSendFields: nil,
 		},
+		ReplaceExisting: config.ReplaceExisting,
+		ForceSendFields: nil,
 	})
 	if err != nil {
 		return "", nil, err
@@ -83,21 +136,45 @@ func (r *ResourcePostgresBranch) DoCreate(ctx context.Context, config *PostgresB
 		return "", nil, err
 	}
 
-	return result.Name, result, nil
+	remote := makePostgresBranchRemote(result)
+	return remote.Name, remote, nil
 }
 
-func (r *ResourcePostgresBranch) DoUpdate(ctx context.Context, id string, config *PostgresBranchState, entry *PlanEntry) (*postgres.Branch, error) {
-	// Build update mask from fields that have action="update" in the changes map.
-	// This excludes immutable fields and fields that haven't changed.
-	// Prefix with "spec." because the API expects paths relative to the Branch object,
-	// not relative to our flattened state type.
-	fieldPaths := collectUpdatePathsWithPrefix(entry.Changes, "spec.")
+// expire_time, no_expiry and ttl are three sides of one oneof, and the API accepts them
+// in update_mask only under the group name: masking the field itself is answered with
+// "Unknown field path in update_mask". Probed against a real workspace on 2026-08-31.
+var branchOneofGroups = map[string]string{
+	"expire_time": "expiration",
+	"no_expiry":   "expiration",
+	"ttl":         "expiration",
+}
+
+func (r *ResourcePostgresBranch) DoUpdate(ctx context.Context, id string, config *PostgresBranchState, entry *PlanEntry) (*PostgresBranchRemote, error) {
+	// Build the mask from the plan's change list and prefix with "spec." (the
+	// API expects paths relative to Branch). The API rejects mask entries
+	// that aren't also populated in the request body, and a wildcard "*"
+	// expands to nested attributes the body would have to set too — so we
+	// can't use a static all-fields mask. The change list naturally tracks
+	// what the user actually set, so the body and mask stay consistent.
+	fieldPaths := collectUpdatePathsWithPrefix(entry.Changes, "spec.", branchOneofGroups)
+
+	// purge_on_delete is an input-only flag consulted at delete time; it is
+	// not a spec field. Strip it from the mask so toggling it between deploys
+	// becomes a state-only refresh (the framework saves newState when this
+	// returns nil error).
+	fieldPaths = slices.DeleteFunc(fieldPaths, func(p string) bool {
+		return p == "spec.purge_on_delete"
+	})
+	if len(fieldPaths) == 0 {
+		return nil, nil
+	}
 
 	waiter, err := r.client.Postgres.UpdateBranch(ctx, postgres.UpdateBranchRequest{
 		Branch: postgres.Branch{
 			Spec: &config.BranchSpec,
 
 			// Output-only fields.
+			BranchId:        "",
 			CreateTime:      nil,
 			Name:            "",
 			Parent:          "",
@@ -117,12 +194,17 @@ func (r *ResourcePostgresBranch) DoUpdate(ctx context.Context, id string, config
 
 	// Wait for the update to complete
 	result, err := waiter.Wait(ctx)
-	return result, err
+	if err != nil {
+		return nil, err
+	}
+	return makePostgresBranchRemote(result), nil
 }
 
-func (r *ResourcePostgresBranch) DoDelete(ctx context.Context, id string) error {
+func (r *ResourcePostgresBranch) DoDelete(ctx context.Context, id string, state *PostgresBranchState) error {
 	waiter, err := r.client.Postgres.DeleteBranch(ctx, postgres.DeleteBranchRequest{
-		Name: id,
+		Name:            id,
+		Purge:           state.PurgeOnDelete,
+		ForceSendFields: nil,
 	})
 	if err != nil {
 		return err
diff --git a/bundle/direct/dresources/postgres_catalog.go b/bundle/direct/dresources/postgres_catalog.go
new file mode 100644
index 00000000000..348ba88960b
--- /dev/null
+++ b/bundle/direct/dresources/postgres_catalog.go
@@ -0,0 +1,130 @@
+package dresources
+
+import (
+	"context"
+	"strings"
+
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/databricks-sdk-go"
+	sdktime "github.com/databricks/databricks-sdk-go/common/types/time"
+	"github.com/databricks/databricks-sdk-go/marshal"
+	"github.com/databricks/databricks-sdk-go/service/postgres"
+)
+
+// PostgresCatalogRemote is the return type for DoRead. It embeds CatalogCatalogSpec so
+// that all paths in StateType are valid paths in RemoteType, enabling drift detection
+// for spec fields once the backend echoes spec on GET.
+type PostgresCatalogRemote struct {
+	postgres.CatalogCatalogSpec
+
+	CatalogId string `json:"catalog_id,omitempty"`
+
+	Name       string                         `json:"name,omitempty"`
+	Status     *postgres.CatalogCatalogStatus `json:"status,omitempty"`
+	Uid        string                         `json:"uid,omitempty"`
+	CreateTime *sdktime.Time                  `json:"create_time,omitempty"`
+	UpdateTime *sdktime.Time                  `json:"update_time,omitempty"`
+}
+
+// Custom marshaler needed because embedded CatalogCatalogSpec has its own MarshalJSON
+// which would otherwise take over and ignore the additional fields.
+func (s *PostgresCatalogRemote) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, s)
+}
+
+func (s PostgresCatalogRemote) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(s)
+}
+
+type ResourcePostgresCatalog struct {
+	client *databricks.WorkspaceClient
+}
+
+type PostgresCatalogState = resources.PostgresCatalogConfig
+
+func (*ResourcePostgresCatalog) New(client *databricks.WorkspaceClient) *ResourcePostgresCatalog {
+	return &ResourcePostgresCatalog{client: client}
+}
+
+func (*ResourcePostgresCatalog) PrepareState(input *resources.PostgresCatalog) *PostgresCatalogState {
+	return &PostgresCatalogState{
+		CatalogId:          input.CatalogId,
+		CatalogCatalogSpec: input.CatalogCatalogSpec,
+	}
+}
+
+func (*ResourcePostgresCatalog) RemapState(remote *PostgresCatalogRemote) *PostgresCatalogState {
+	return &PostgresCatalogState{
+		CatalogId:          remote.CatalogId,
+		CatalogCatalogSpec: remote.CatalogCatalogSpec,
+	}
+}
+
+// makePostgresCatalogRemote converts the SDK Catalog into the embedded remote shape.
+// GET does not echo spec today (only status is returned); the embedded spec fields
+// stay at their zero values, and postgres_catalogs.yml suppresses phantom drift via
+// ignore_remote_changes with reason spec:input_only.
+//
+// The user-facing catalog id only appears as the trailing component of
+// remote.Name, so we strip the constant "catalogs/" prefix.
+func makePostgresCatalogRemote(catalog *postgres.Catalog) *PostgresCatalogRemote {
+	var spec postgres.CatalogCatalogSpec
+	if catalog.Spec != nil {
+		spec = *catalog.Spec
+	}
+	return &PostgresCatalogRemote{
+		CatalogCatalogSpec: spec,
+		CatalogId:          strings.TrimPrefix(catalog.Name, "catalogs/"),
+		Name:               catalog.Name,
+		Status:             catalog.Status,
+		Uid:                catalog.Uid,
+		CreateTime:         catalog.CreateTime,
+		UpdateTime:         catalog.UpdateTime,
+	}
+}
+
+func (r *ResourcePostgresCatalog) DoRead(ctx context.Context, id string) (*PostgresCatalogRemote, error) {
+	catalog, err := r.client.Postgres.GetCatalog(ctx, postgres.GetCatalogRequest{Name: id})
+	if err != nil {
+		return nil, err
+	}
+	return makePostgresCatalogRemote(catalog), nil
+}
+
+func (r *ResourcePostgresCatalog) DoCreate(ctx context.Context, config *PostgresCatalogState) (string, *PostgresCatalogRemote, error) {
+	waiter, err := r.client.Postgres.CreateCatalog(ctx, postgres.CreateCatalogRequest{
+		CatalogId: config.CatalogId,
+		Catalog: postgres.Catalog{
+			Spec: &config.CatalogCatalogSpec,
+
+			// Output-only fields.
+			CatalogId:       "",
+			CreateTime:      nil,
+			Name:            "",
+			Status:          nil,
+			Uid:             "",
+			UpdateTime:      nil,
+			ForceSendFields: nil,
+		},
+	})
+	if err != nil {
+		return "", nil, err
+	}
+
+	result, err := waiter.Wait(ctx)
+	if err != nil {
+		return "", nil, err
+	}
+	remote := makePostgresCatalogRemote(result)
+	return remote.Name, remote, nil
+}
+
+func (r *ResourcePostgresCatalog) DoDelete(ctx context.Context, id string, _ *PostgresCatalogState) error {
+	waiter, err := r.client.Postgres.DeleteCatalog(ctx, postgres.DeleteCatalogRequest{
+		Name: id,
+	})
+	if err != nil {
+		return err
+	}
+	return waiter.Wait(ctx)
+}
diff --git a/bundle/direct/dresources/postgres_database.go b/bundle/direct/dresources/postgres_database.go
new file mode 100644
index 00000000000..613f5d90270
--- /dev/null
+++ b/bundle/direct/dresources/postgres_database.go
@@ -0,0 +1,178 @@
+package dresources
+
+import (
+	"context"
+
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/common/types/fieldmask"
+	sdktime "github.com/databricks/databricks-sdk-go/common/types/time"
+	"github.com/databricks/databricks-sdk-go/marshal"
+	"github.com/databricks/databricks-sdk-go/service/postgres"
+)
+
+// PostgresDatabaseRemote is the return type for DoRead. It embeds
+// DatabaseDatabaseSpec so that all paths in StateType are valid paths in
+// RemoteType, enabling drift detection for spec fields once the backend echoes
+// spec on GET.
+type PostgresDatabaseRemote struct {
+	postgres.DatabaseDatabaseSpec
+
+	DatabaseId string `json:"database_id,omitempty"`
+	Parent     string `json:"parent,omitempty"`
+
+	Name       string                           `json:"name,omitempty"`
+	Status     *postgres.DatabaseDatabaseStatus `json:"status,omitempty"`
+	CreateTime *sdktime.Time                    `json:"create_time,omitempty"`
+	UpdateTime *sdktime.Time                    `json:"update_time,omitempty"`
+}
+
+// Custom marshaler needed because embedded DatabaseDatabaseSpec has its own
+// MarshalJSON which would otherwise take over and ignore the additional fields.
+func (s *PostgresDatabaseRemote) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, s)
+}
+
+func (s PostgresDatabaseRemote) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(s)
+}
+
+type ResourcePostgresDatabase struct {
+	client *databricks.WorkspaceClient
+}
+
+type PostgresDatabaseState = resources.PostgresDatabaseConfig
+
+func (*ResourcePostgresDatabase) New(client *databricks.WorkspaceClient) *ResourcePostgresDatabase {
+	return &ResourcePostgresDatabase{client: client}
+}
+
+func (*ResourcePostgresDatabase) PrepareState(input *resources.PostgresDatabase) *PostgresDatabaseState {
+	return &PostgresDatabaseState{
+		DatabaseId:           input.DatabaseId,
+		Parent:               input.Parent,
+		ReplaceExisting:      input.ReplaceExisting,
+		DatabaseDatabaseSpec: input.DatabaseDatabaseSpec,
+	}
+}
+
+func (*ResourcePostgresDatabase) RemapState(remote *PostgresDatabaseRemote) *PostgresDatabaseState {
+	return &PostgresDatabaseState{
+		DatabaseId: remote.DatabaseId,
+		Parent:     remote.Parent,
+
+		// replace_existing is a create-time-only flag; the GET API never returns
+		// it, so RemapState leaves it false.
+		ReplaceExisting: false,
+
+		DatabaseDatabaseSpec: remote.DatabaseDatabaseSpec,
+	}
+}
+
+// makePostgresDatabaseRemote converts the SDK Database into the embedded remote
+// shape. GET does not echo spec today (only status is returned); the embedded
+// spec fields stay at their zero values, and postgres_databases.yml suppresses phantom
+// drift via ignore_remote_changes with reason spec:input_only.
+func makePostgresDatabaseRemote(database *postgres.Database) *PostgresDatabaseRemote {
+	var spec postgres.DatabaseDatabaseSpec
+	if database.Spec != nil {
+		spec = *database.Spec
+	}
+	return &PostgresDatabaseRemote{
+		DatabaseDatabaseSpec: spec,
+		DatabaseId:           database.DatabaseId,
+		Parent:               database.Parent,
+		Name:                 database.Name,
+		Status:               database.Status,
+		CreateTime:           database.CreateTime,
+		UpdateTime:           database.UpdateTime,
+	}
+}
+
+func (r *ResourcePostgresDatabase) DoRead(ctx context.Context, id string) (*PostgresDatabaseRemote, error) {
+	database, err := r.client.Postgres.GetDatabase(ctx, postgres.GetDatabaseRequest{Name: id})
+	if err != nil {
+		return nil, err
+	}
+	return makePostgresDatabaseRemote(database), nil
+}
+
+func (r *ResourcePostgresDatabase) DoCreate(ctx context.Context, config *PostgresDatabaseState) (string, *PostgresDatabaseRemote, error) {
+	waiter, err := r.client.Postgres.CreateDatabase(ctx, postgres.CreateDatabaseRequest{
+		DatabaseId: config.DatabaseId,
+		Parent:     config.Parent,
+		Database: postgres.Database{
+			Spec: &config.DatabaseDatabaseSpec,
+
+			// Output-only fields.
+			DatabaseId:      "",
+			CreateTime:      nil,
+			Name:            "",
+			Parent:          "",
+			Status:          nil,
+			UpdateTime:      nil,
+			ForceSendFields: nil,
+		},
+		ReplaceExisting: config.ReplaceExisting,
+		ForceSendFields: nil,
+	})
+	if err != nil {
+		return "", nil, err
+	}
+
+	// Wait for the database to be ready (long-running operation)
+	result, err := waiter.Wait(ctx)
+	if err != nil {
+		return "", nil, err
+	}
+
+	remote := makePostgresDatabaseRemote(result)
+	return remote.Name, remote, nil
+}
+
+func (r *ResourcePostgresDatabase) DoUpdate(ctx context.Context, id string, config *PostgresDatabaseState, entry *PlanEntry) (*PostgresDatabaseRemote, error) {
+	// Build update mask from fields that have action="update" in the changes map.
+	// This excludes immutable fields and fields that haven't changed.
+	// Prefix with "spec." because the API expects paths relative to the Database object,
+	// not relative to our flattened state type.
+	fieldPaths := collectUpdatePathsWithPrefix(entry.Changes, "spec.", nil)
+
+	waiter, err := r.client.Postgres.UpdateDatabase(ctx, postgres.UpdateDatabaseRequest{
+		Database: postgres.Database{
+			Spec: &config.DatabaseDatabaseSpec,
+
+			// Output-only fields.
+			DatabaseId:      "",
+			CreateTime:      nil,
+			Name:            "",
+			Parent:          "",
+			Status:          nil,
+			UpdateTime:      nil,
+			ForceSendFields: nil,
+		},
+		Name: id,
+		UpdateMask: fieldmask.FieldMask{
+			Paths: fieldPaths,
+		},
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	// Wait for the update to complete
+	result, err := waiter.Wait(ctx)
+	if err != nil {
+		return nil, err
+	}
+	return makePostgresDatabaseRemote(result), nil
+}
+
+func (r *ResourcePostgresDatabase) DoDelete(ctx context.Context, id string, _ *PostgresDatabaseState) error {
+	waiter, err := r.client.Postgres.DeleteDatabase(ctx, postgres.DeleteDatabaseRequest{
+		Name: id,
+	})
+	if err != nil {
+		return err
+	}
+	return waiter.Wait(ctx)
+}
diff --git a/bundle/direct/dresources/postgres_endpoint.go b/bundle/direct/dresources/postgres_endpoint.go
index 63f0eb0f2db..786f52b8b21 100644
--- a/bundle/direct/dresources/postgres_endpoint.go
+++ b/bundle/direct/dresources/postgres_endpoint.go
@@ -11,6 +11,8 @@ import (
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/apierr"
 	"github.com/databricks/databricks-sdk-go/common/types/fieldmask"
+	sdktime "github.com/databricks/databricks-sdk-go/common/types/time"
+	"github.com/databricks/databricks-sdk-go/marshal"
 	"github.com/databricks/databricks-sdk-go/service/postgres"
 )
 
@@ -18,6 +20,32 @@ import (
 // This value is a heuristic and is being discussed with the backend team.
 const endpointReconciliationTimeout = 2 * time.Minute
 
+// PostgresEndpointRemote is the return type for DoRead. It embeds EndpointSpec so
+// that all paths in StateType are valid paths in RemoteType, enabling drift
+// detection for spec fields once the backend echoes spec on GET.
+type PostgresEndpointRemote struct {
+	postgres.EndpointSpec
+
+	EndpointId string `json:"endpoint_id,omitempty"`
+	Parent     string `json:"parent,omitempty"`
+
+	Name       string                   `json:"name,omitempty"`
+	Status     *postgres.EndpointStatus `json:"status,omitempty"`
+	Uid        string                   `json:"uid,omitempty"`
+	CreateTime *sdktime.Time            `json:"create_time,omitempty"`
+	UpdateTime *sdktime.Time            `json:"update_time,omitempty"`
+}
+
+// Custom marshaler needed because embedded EndpointSpec has its own MarshalJSON
+// which would otherwise take over and ignore the additional fields.
+func (s *PostgresEndpointRemote) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, s)
+}
+
+func (s PostgresEndpointRemote) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(s)
+}
+
 type ResourcePostgresEndpoint struct {
 	client *databricks.WorkspaceClient
 }
@@ -30,46 +58,59 @@ func (*ResourcePostgresEndpoint) New(client *databricks.WorkspaceClient) *Resour
 
 func (*ResourcePostgresEndpoint) PrepareState(input *resources.PostgresEndpoint) *PostgresEndpointState {
 	return &PostgresEndpointState{
-		EndpointId:   input.EndpointId,
-		Parent:       input.Parent,
-		EndpointSpec: input.EndpointSpec,
+		EndpointId:      input.EndpointId,
+		Parent:          input.Parent,
+		ReplaceExisting: input.ReplaceExisting,
+		EndpointSpec:    input.EndpointSpec,
 	}
 }
 
-func (*ResourcePostgresEndpoint) RemapState(remote *postgres.Endpoint) *PostgresEndpointState {
-	// Extract endpoint_id from hierarchical name: "projects/{project_id}/branches/{branch_id}/endpoints/{endpoint_id}"
-	// TODO: log error when we have access to the context
-	components, _ := ParsePostgresName(remote.Name)
-
+func (*ResourcePostgresEndpoint) RemapState(remote *PostgresEndpointRemote) *PostgresEndpointState {
 	return &PostgresEndpointState{
-		EndpointId: components.EndpointID,
+		EndpointId: remote.EndpointId,
 		Parent:     remote.Parent,
 
-		// The read API does not return the spec, only the status.
-		// This means we cannot detect remote drift for spec fields.
-		// Use an empty struct (not nil) so field-level diffing works correctly.
-		EndpointSpec: postgres.EndpointSpec{
-			AutoscalingLimitMaxCu:  0,
-			AutoscalingLimitMinCu:  0,
-			Disabled:               false,
-			EndpointType:           "",
-			Group:                  nil,
-			NoSuspension:           false,
-			Settings:               nil,
-			SuspendTimeoutDuration: nil,
-			ForceSendFields:        nil,
-		},
+		// replace_existing is a create-time-only flag; the GET API never returns
+		// it, so RemapState leaves it false.
+		ReplaceExisting: false,
+
+		EndpointSpec: remote.EndpointSpec,
+	}
+}
+
+// makePostgresEndpointRemote converts the SDK Endpoint into the embedded remote shape.
+// GET does not echo spec today (only status is returned); the embedded spec fields
+// stay at their zero values, and postgres_endpoints.yml suppresses phantom drift via
+// ignore_remote_changes with reason spec:input_only.
+func makePostgresEndpointRemote(endpoint *postgres.Endpoint) *PostgresEndpointRemote {
+	var spec postgres.EndpointSpec
+	if endpoint.Spec != nil {
+		spec = *endpoint.Spec
+	}
+	return &PostgresEndpointRemote{
+		EndpointSpec: spec,
+		EndpointId:   endpoint.EndpointId,
+		Parent:       endpoint.Parent,
+		Name:         endpoint.Name,
+		Status:       endpoint.Status,
+		Uid:          endpoint.Uid,
+		CreateTime:   endpoint.CreateTime,
+		UpdateTime:   endpoint.UpdateTime,
 	}
 }
 
-func (r *ResourcePostgresEndpoint) DoRead(ctx context.Context, id string) (*postgres.Endpoint, error) {
-	return r.client.Postgres.GetEndpoint(ctx, postgres.GetEndpointRequest{Name: id})
+func (r *ResourcePostgresEndpoint) DoRead(ctx context.Context, id string) (*PostgresEndpointRemote, error) {
+	endpoint, err := r.client.Postgres.GetEndpoint(ctx, postgres.GetEndpointRequest{Name: id})
+	if err != nil {
+		return nil, err
+	}
+	return makePostgresEndpointRemote(endpoint), nil
 }
 
 // waitForReconciliation polls the endpoint until PendingState is empty.
 // This is needed because the operation can complete while internal reconciliation
 // is still in progress, which would cause subsequent operations to fail.
-func (r *ResourcePostgresEndpoint) waitForReconciliation(ctx context.Context, name string) (*postgres.Endpoint, error) {
+func (r *ResourcePostgresEndpoint) waitForReconciliation(ctx context.Context, name string) (*PostgresEndpointRemote, error) {
 	deadline := time.Now().Add(endpointReconciliationTimeout)
 	for {
 		endpoint, err := r.client.Postgres.GetEndpoint(ctx, postgres.GetEndpointRequest{Name: name})
@@ -79,7 +120,7 @@ func (r *ResourcePostgresEndpoint) waitForReconciliation(ctx context.Context, na
 
 		// If there's no pending state, reconciliation is complete
 		if endpoint.Status == nil || endpoint.Status.PendingState == "" {
-			return endpoint, nil
+			return makePostgresEndpointRemote(endpoint), nil
 		}
 
 		// Check if we've exceeded the timeout
@@ -96,7 +137,7 @@ func (r *ResourcePostgresEndpoint) waitForReconciliation(ctx context.Context, na
 	}
 }
 
-func (r *ResourcePostgresEndpoint) DoCreate(ctx context.Context, config *PostgresEndpointState) (string, *postgres.Endpoint, error) {
+func (r *ResourcePostgresEndpoint) DoCreate(ctx context.Context, config *PostgresEndpointState) (string, *PostgresEndpointRemote, error) {
 	waiter, err := r.client.Postgres.CreateEndpoint(ctx, postgres.CreateEndpointRequest{
 		EndpointId: config.EndpointId,
 		Parent:     config.Parent,
@@ -104,6 +145,7 @@ func (r *ResourcePostgresEndpoint) DoCreate(ctx context.Context, config *Postgre
 			Spec: &config.EndpointSpec,
 
 			// Output-only fields.
+			EndpointId:      "",
 			CreateTime:      nil,
 			Name:            "",
 			Parent:          "",
@@ -112,6 +154,8 @@ func (r *ResourcePostgresEndpoint) DoCreate(ctx context.Context, config *Postgre
 			UpdateTime:      nil,
 			ForceSendFields: nil,
 		},
+		ReplaceExisting: config.ReplaceExisting,
+		ForceSendFields: nil,
 	})
 	if err != nil {
 		return "", nil, err
@@ -124,26 +168,34 @@ func (r *ResourcePostgresEndpoint) DoCreate(ctx context.Context, config *Postgre
 	}
 
 	// Wait for reconciliation to complete
-	result, err = r.waitForReconciliation(ctx, result.Name)
+	remote, err := r.waitForReconciliation(ctx, result.Name)
 	if err != nil {
 		return "", nil, err
 	}
 
-	return result.Name, result, nil
+	return remote.Name, remote, nil
+}
+
+// no_suspension and suspend_timeout_duration are two sides of one oneof, which the API
+// accepts in update_mask only under the group name; see branchOneofGroups.
+var endpointOneofGroups = map[string]string{
+	"no_suspension":            "suspension",
+	"suspend_timeout_duration": "suspension",
 }
 
-func (r *ResourcePostgresEndpoint) DoUpdate(ctx context.Context, id string, config *PostgresEndpointState, entry *PlanEntry) (*postgres.Endpoint, error) {
+func (r *ResourcePostgresEndpoint) DoUpdate(ctx context.Context, id string, config *PostgresEndpointState, entry *PlanEntry) (*PostgresEndpointRemote, error) {
 	// Build update mask from fields that have action="update" in the changes map.
 	// This excludes immutable fields and fields that haven't changed.
 	// Prefix with "spec." because the API expects paths relative to the Endpoint object,
 	// not relative to our flattened state type.
-	fieldPaths := collectUpdatePathsWithPrefix(entry.Changes, "spec.")
+	fieldPaths := collectUpdatePathsWithPrefix(entry.Changes, "spec.", endpointOneofGroups)
 
 	waiter, err := r.client.Postgres.UpdateEndpoint(ctx, postgres.UpdateEndpointRequest{
 		Endpoint: postgres.Endpoint{
 			Spec: &config.EndpointSpec,
 
 			// Output-only fields.
+			EndpointId:      "",
 			CreateTime:      nil,
 			Name:            "",
 			Parent:          "",
@@ -171,7 +223,7 @@ func (r *ResourcePostgresEndpoint) DoUpdate(ctx context.Context, id string, conf
 	return r.waitForReconciliation(ctx, id)
 }
 
-func (r *ResourcePostgresEndpoint) DoDelete(ctx context.Context, id string) error {
+func (r *ResourcePostgresEndpoint) DoDelete(ctx context.Context, id string, _ *PostgresEndpointState) error {
 	// Retry loop to handle "Endpoint reconciliation still in progress" errors
 	deadline := time.Now().Add(endpointReconciliationTimeout)
 	for {
@@ -180,8 +232,7 @@ func (r *ResourcePostgresEndpoint) DoDelete(ctx context.Context, id string) erro
 		})
 		if err != nil {
 			// Check if this is a reconciliation in progress error
-			var apiErr *apierr.APIError
-			if errors.As(err, &apiErr) && apiErr.StatusCode == http.StatusConflict &&
+			if apiErr, ok := errors.AsType[*apierr.APIError](err); ok && apiErr.StatusCode == http.StatusConflict &&
 				strings.Contains(apiErr.Message, "reconciliation") {
 				// Check if we've exceeded the timeout
 				if time.Now().After(deadline) {
diff --git a/bundle/direct/dresources/postgres_project.go b/bundle/direct/dresources/postgres_project.go
index e1e802b2678..bdb886e9437 100644
--- a/bundle/direct/dresources/postgres_project.go
+++ b/bundle/direct/dresources/postgres_project.go
@@ -2,13 +2,44 @@ package dresources
 
 import (
 	"context"
+	"slices"
 
 	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/common/types/fieldmask"
+	sdktime "github.com/databricks/databricks-sdk-go/common/types/time"
+	"github.com/databricks/databricks-sdk-go/marshal"
 	"github.com/databricks/databricks-sdk-go/service/postgres"
 )
 
+// PostgresProjectRemote is the return type for DoRead. It embeds ProjectSpec so
+// that all paths in StateType are valid paths in RemoteType, enabling drift
+// detection for spec fields once the backend echoes spec on GET.
+type PostgresProjectRemote struct {
+	postgres.ProjectSpec
+
+	ProjectId string `json:"project_id,omitempty"`
+
+	InitialEndpointSpec *postgres.InitialEndpointSpec `json:"initial_endpoint_spec,omitempty"`
+	Name                string                        `json:"name,omitempty"`
+	Status              *postgres.ProjectStatus       `json:"status,omitempty"`
+	Uid                 string                        `json:"uid,omitempty"`
+	CreateTime          *sdktime.Time                 `json:"create_time,omitempty"`
+	DeleteTime          *sdktime.Time                 `json:"delete_time,omitempty"`
+	PurgeTime           *sdktime.Time                 `json:"purge_time,omitempty"`
+	UpdateTime          *sdktime.Time                 `json:"update_time,omitempty"`
+}
+
+// Custom marshaler needed because embedded ProjectSpec has its own MarshalJSON
+// which would otherwise take over and ignore the additional fields.
+func (s *PostgresProjectRemote) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, s)
+}
+
+func (s PostgresProjectRemote) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(s)
+}
+
 type ResourcePostgresProject struct {
 	client *databricks.WorkspaceClient
 }
@@ -21,50 +52,70 @@ func (*ResourcePostgresProject) New(client *databricks.WorkspaceClient) *Resourc
 
 func (*ResourcePostgresProject) PrepareState(input *resources.PostgresProject) *PostgresProjectState {
 	return &PostgresProjectState{
-		ProjectId:   input.ProjectId,
-		ProjectSpec: input.ProjectSpec,
+		ProjectId:       input.ProjectId,
+		PurgeOnDelete:   input.PurgeOnDelete,
+		ProjectSpec:     input.ProjectSpec,
+		ForceSendFields: input.ForceSendFields,
 	}
 }
 
-func (*ResourcePostgresProject) RemapState(remote *postgres.Project) *PostgresProjectState {
-	// Extract project_id from hierarchical name: "projects/{project_id}"
-	// TODO: log error when we have access to the context
-	components, _ := ParsePostgresName(remote.Name)
-
+func (*ResourcePostgresProject) RemapState(remote *PostgresProjectRemote) *PostgresProjectState {
 	return &PostgresProjectState{
-		ProjectId: components.ProjectID,
-
-		// The read API does not return the spec, only the status.
-		// This means we cannot detect remote drift for spec fields.
-		// Use an empty struct (not nil) so field-level diffing works correctly.
-		ProjectSpec: postgres.ProjectSpec{
-			BudgetPolicyId:           "",
-			CustomTags:               nil,
-			DefaultBranch:            "",
-			DefaultEndpointSettings:  nil,
-			DisplayName:              "",
-			EnablePgNativeLogin:      false,
-			HistoryRetentionDuration: nil,
-			PgVersion:                0,
-			ForceSendFields:          nil,
-		},
+		ProjectId:   remote.ProjectId,
+		ProjectSpec: remote.ProjectSpec,
+
+		// purge_on_delete is a delete-time query parameter; the GET API never
+		// returns it, so RemapState leaves it false.
+		PurgeOnDelete:   false,
+		ForceSendFields: nil,
+	}
+}
+
+// makePostgresProjectRemote converts the SDK Project into the embedded remote shape.
+// GET does not echo spec today (only status is returned); the embedded spec fields
+// stay at their zero values, and postgres_projects.yml suppresses phantom drift via
+// ignore_remote_changes with reason spec:input_only.
+func makePostgresProjectRemote(project *postgres.Project) *PostgresProjectRemote {
+	var spec postgres.ProjectSpec
+	if project.Spec != nil {
+		spec = *project.Spec
+	}
+	return &PostgresProjectRemote{
+		ProjectSpec:         spec,
+		ProjectId:           project.ProjectId,
+		InitialEndpointSpec: project.InitialEndpointSpec,
+		Name:                project.Name,
+		Status:              project.Status,
+		Uid:                 project.Uid,
+		CreateTime:          project.CreateTime,
+		DeleteTime:          project.DeleteTime,
+		PurgeTime:           project.PurgeTime,
+		UpdateTime:          project.UpdateTime,
 	}
 }
 
-func (r *ResourcePostgresProject) DoRead(ctx context.Context, id string) (*postgres.Project, error) {
-	return r.client.Postgres.GetProject(ctx, postgres.GetProjectRequest{Name: id})
+func (r *ResourcePostgresProject) DoRead(ctx context.Context, id string) (*PostgresProjectRemote, error) {
+	project, err := r.client.Postgres.GetProject(ctx, postgres.GetProjectRequest{Name: id})
+	if err != nil {
+		return nil, err
+	}
+	return makePostgresProjectRemote(project), nil
 }
 
-func (r *ResourcePostgresProject) DoCreate(ctx context.Context, config *PostgresProjectState) (string, *postgres.Project, error) {
+func (r *ResourcePostgresProject) DoCreate(ctx context.Context, config *PostgresProjectState) (string, *PostgresProjectRemote, error) {
 	waiter, err := r.client.Postgres.CreateProject(ctx, postgres.CreateProjectRequest{
 		ProjectId: config.ProjectId,
 		Project: postgres.Project{
 			Spec:                &config.ProjectSpec,
+			InitialBranchSpec:   nil,
 			InitialEndpointSpec: nil,
 
 			// Output-only fields.
+			ProjectId:       "",
 			CreateTime:      nil,
+			DeleteTime:      nil,
 			Name:            "",
+			PurgeTime:       nil,
 			Status:          nil,
 			Uid:             "",
 			UpdateTime:      nil,
@@ -81,24 +132,49 @@ func (r *ResourcePostgresProject) DoCreate(ctx context.Context, config *Postgres
 		return "", nil, err
 	}
 
-	return result.Name, result, nil
+	remote := makePostgresProjectRemote(result)
+	return remote.Name, remote, nil
+}
+
+// The default endpoint settings carry the same suspension oneof as an endpoint does;
+// see branchOneofGroups.
+var projectOneofGroups = map[string]string{
+	"default_endpoint_settings.no_suspension":            "default_endpoint_settings.suspension",
+	"default_endpoint_settings.suspend_timeout_duration": "default_endpoint_settings.suspension",
 }
 
-func (r *ResourcePostgresProject) DoUpdate(ctx context.Context, id string, config *PostgresProjectState, entry *PlanEntry) (*postgres.Project, error) {
-	// Build update mask from fields that have action="update" in the changes map.
-	// This excludes immutable fields and fields that haven't changed.
-	// Prefix with "spec." because the API expects paths relative to the Project object,
-	// not relative to our flattened state type.
-	fieldPaths := collectUpdatePathsWithPrefix(entry.Changes, "spec.")
+func (r *ResourcePostgresProject) DoUpdate(ctx context.Context, id string, config *PostgresProjectState, entry *PlanEntry) (*PostgresProjectRemote, error) {
+	// Build the mask from the plan's change list and prefix with "spec." (the
+	// API expects paths relative to Project). The API rejects mask entries
+	// that aren't also populated in the request body, and a wildcard "*"
+	// expands to nested attributes the body would have to set too — so we
+	// can't use a static all-fields mask. The change list naturally tracks
+	// what the user actually set, so the body and mask stay consistent.
+	fieldPaths := collectUpdatePathsWithPrefix(entry.Changes, "spec.", projectOneofGroups)
+
+	// purge_on_delete is an input-only flag consulted at delete time; it is
+	// not a spec field. Strip it from the mask so toggling it between deploys
+	// becomes a state-only refresh (the framework saves newState when this
+	// returns nil error).
+	fieldPaths = slices.DeleteFunc(fieldPaths, func(p string) bool {
+		return p == "spec.purge_on_delete"
+	})
+	if len(fieldPaths) == 0 {
+		return nil, nil
+	}
 
 	waiter, err := r.client.Postgres.UpdateProject(ctx, postgres.UpdateProjectRequest{
 		Project: postgres.Project{
 			Spec:                &config.ProjectSpec,
+			InitialBranchSpec:   nil,
 			InitialEndpointSpec: nil,
 
 			// Output-only fields.
+			ProjectId:       "",
 			CreateTime:      nil,
+			DeleteTime:      nil,
 			Name:            "",
+			PurgeTime:       nil,
 			Status:          nil,
 			Uid:             "",
 			UpdateTime:      nil,
@@ -115,12 +191,17 @@ func (r *ResourcePostgresProject) DoUpdate(ctx context.Context, id string, confi
 
 	// Wait for the update to complete
 	result, err := waiter.Wait(ctx)
-	return result, err
+	if err != nil {
+		return nil, err
+	}
+	return makePostgresProjectRemote(result), nil
 }
 
-func (r *ResourcePostgresProject) DoDelete(ctx context.Context, id string) error {
+func (r *ResourcePostgresProject) DoDelete(ctx context.Context, id string, state *PostgresProjectState) error {
 	waiter, err := r.client.Postgres.DeleteProject(ctx, postgres.DeleteProjectRequest{
-		Name: id,
+		Name:            id,
+		Purge:           state.PurgeOnDelete,
+		ForceSendFields: nil,
 	})
 	if err != nil {
 		return err
diff --git a/bundle/direct/dresources/postgres_role.go b/bundle/direct/dresources/postgres_role.go
new file mode 100644
index 00000000000..10ef250e37c
--- /dev/null
+++ b/bundle/direct/dresources/postgres_role.go
@@ -0,0 +1,206 @@
+package dresources
+
+import (
+	"context"
+
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/common/types/fieldmask"
+	sdktime "github.com/databricks/databricks-sdk-go/common/types/time"
+	"github.com/databricks/databricks-sdk-go/marshal"
+	"github.com/databricks/databricks-sdk-go/service/postgres"
+)
+
+type ResourcePostgresRole struct {
+	client *databricks.WorkspaceClient
+}
+
+// PostgresRoleState keeps role_id and parent as separate fields rather than a
+// pre-joined hierarchical name. That alignment matters because bundle variable
+// resolution only rewrites state fields whose JSON paths appear in the input
+// config's refs map (parent, role_id, etc.); a synthesized "name" field built
+// from input.Parent at PrepareState time would keep the literal ${...} string
+// when parent comes from a resource reference.
+type PostgresRoleState struct {
+	postgres.RoleRoleSpec
+
+	// RoleId is the leaf id, matching the user-facing config.
+	RoleId string `json:"role_id"`
+
+	// Parent is "projects/{project_id}/branches/{branch_id}".
+	Parent string `json:"parent"`
+
+	// ReplaceExisting takes over an existing role with the same ID on create
+	// instead of returning ALREADY_EXISTS. Input-only: not returned by the GET API.
+	ReplaceExisting bool `json:"replace_existing,omitempty"`
+}
+
+// PostgresRoleRemote is the return type for DoRead. It embeds RoleRoleSpec so that
+// all paths in StateType are valid paths in RemoteType, enabling drift detection
+// for spec fields once the backend echoes spec on GET.
+type PostgresRoleRemote struct {
+	postgres.RoleRoleSpec
+
+	RoleId string `json:"role_id,omitempty"`
+	Parent string `json:"parent,omitempty"`
+
+	Name       string                   `json:"name,omitempty"`
+	Status     *postgres.RoleRoleStatus `json:"status,omitempty"`
+	CreateTime *sdktime.Time            `json:"create_time,omitempty"`
+	UpdateTime *sdktime.Time            `json:"update_time,omitempty"`
+}
+
+// Custom marshalers needed because embedded RoleRoleSpec has its own MarshalJSON
+// which would otherwise take over and ignore the additional fields.
+func (s *PostgresRoleState) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, s)
+}
+
+func (s PostgresRoleState) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(s)
+}
+
+func (s *PostgresRoleRemote) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, s)
+}
+
+func (s PostgresRoleRemote) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(s)
+}
+
+func (*ResourcePostgresRole) New(client *databricks.WorkspaceClient) *ResourcePostgresRole {
+	return &ResourcePostgresRole{client: client}
+}
+
+func (*ResourcePostgresRole) PrepareState(input *resources.PostgresRole) *PostgresRoleState {
+	return &PostgresRoleState{
+		RoleId:          input.RoleId,
+		Parent:          input.Parent,
+		ReplaceExisting: input.ReplaceExisting,
+		RoleRoleSpec:    input.RoleRoleSpec,
+	}
+}
+
+func (*ResourcePostgresRole) RemapState(remote *PostgresRoleRemote) *PostgresRoleState {
+	return &PostgresRoleState{
+		RoleId: remote.RoleId,
+		Parent: remote.Parent,
+
+		// replace_existing is a create-time-only flag; the GET API never returns
+		// it, so RemapState leaves it false.
+		ReplaceExisting: false,
+
+		RoleRoleSpec: remote.RoleRoleSpec,
+	}
+}
+
+// makePostgresRoleRemote converts the SDK Role into the embedded remote shape.
+// GET does not echo spec today (only status is returned); the embedded spec fields
+// stay at their zero values, and postgres_roles.yml suppresses phantom drift via
+// ignore_remote_changes with reason spec:input_only.
+func makePostgresRoleRemote(role *postgres.Role) *PostgresRoleRemote {
+	var spec postgres.RoleRoleSpec
+	if role.Spec != nil {
+		spec = *role.Spec
+	}
+	return &PostgresRoleRemote{
+		RoleRoleSpec: spec,
+		RoleId:       role.RoleId,
+		Parent:       role.Parent,
+		Name:         role.Name,
+		Status:       role.Status,
+		CreateTime:   role.CreateTime,
+		UpdateTime:   role.UpdateTime,
+	}
+}
+
+func (r *ResourcePostgresRole) DoRead(ctx context.Context, id string) (*PostgresRoleRemote, error) {
+	role, err := r.client.Postgres.GetRole(ctx, postgres.GetRoleRequest{Name: id})
+	if err != nil {
+		return nil, err
+	}
+	return makePostgresRoleRemote(role), nil
+}
+
+func (r *ResourcePostgresRole) DoCreate(ctx context.Context, config *PostgresRoleState) (string, *PostgresRoleRemote, error) {
+	waiter, err := r.client.Postgres.CreateRole(ctx, postgres.CreateRoleRequest{
+		RoleId: config.RoleId,
+		Parent: config.Parent,
+		Role: postgres.Role{
+			Spec: &config.RoleRoleSpec,
+
+			// Output-only fields.
+			RoleId:          "",
+			CreateTime:      nil,
+			Name:            "",
+			Parent:          "",
+			Status:          nil,
+			UpdateTime:      nil,
+			ForceSendFields: nil,
+		},
+		ReplaceExisting: config.ReplaceExisting,
+		ForceSendFields: nil,
+	})
+	if err != nil {
+		return "", nil, err
+	}
+
+	result, err := waiter.Wait(ctx)
+	if err != nil {
+		return "", nil, err
+	}
+
+	remote := makePostgresRoleRemote(result)
+	return remote.Name, remote, nil
+}
+
+func (r *ResourcePostgresRole) DoUpdate(ctx context.Context, id string, config *PostgresRoleState, entry *PlanEntry) (*PostgresRoleRemote, error) {
+	// Build update mask from fields that have action="update" in the changes map.
+	// Prefix with "spec." because the API expects paths relative to the Role
+	// object, not relative to our flattened state type.
+	fieldPaths := collectUpdatePathsWithPrefix(entry.Changes, "spec.", nil)
+
+	waiter, err := r.client.Postgres.UpdateRole(ctx, postgres.UpdateRoleRequest{
+		Name: id,
+		Role: postgres.Role{
+			Spec: &config.RoleRoleSpec,
+
+			// Output-only fields.
+			RoleId:          "",
+			CreateTime:      nil,
+			Name:            "",
+			Parent:          "",
+			Status:          nil,
+			UpdateTime:      nil,
+			ForceSendFields: nil,
+		},
+		UpdateMask: fieldmask.FieldMask{
+			Paths: fieldPaths,
+		},
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	result, err := waiter.Wait(ctx)
+	if err != nil {
+		return nil, err
+	}
+	return makePostgresRoleRemote(result), nil
+}
+
+func (r *ResourcePostgresRole) DoDelete(ctx context.Context, id string, _ *PostgresRoleState) error {
+	waiter, err := r.client.Postgres.DeleteRole(ctx, postgres.DeleteRoleRequest{
+		Name: id,
+
+		// ReassignOwnedTo is intentionally unset; honoring it would require
+		// user-facing config we don't expose, and it would spin up compute to
+		// run reassignment SQL.
+		ReassignOwnedTo: "",
+		ForceSendFields: nil,
+	})
+	if err != nil {
+		return err
+	}
+	return waiter.Wait(ctx)
+}
diff --git a/bundle/direct/dresources/postgres_snapshot_schedule.go b/bundle/direct/dresources/postgres_snapshot_schedule.go
new file mode 100644
index 00000000000..3f73e8c729f
--- /dev/null
+++ b/bundle/direct/dresources/postgres_snapshot_schedule.go
@@ -0,0 +1,138 @@
+package dresources
+
+import (
+	"context"
+	"strings"
+
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/common/types/fieldmask"
+	"github.com/databricks/databricks-sdk-go/marshal"
+	"github.com/databricks/databricks-sdk-go/service/postgres"
+)
+
+// snapshotScheduleSuffix is the final segment of a snapshot schedule's resource
+// name: "projects/{project_id}/branches/{branch_id}/snapshot-schedule".
+const snapshotScheduleSuffix = "/snapshot-schedule"
+
+// snapshotScheduleName returns the schedule's resource name for a branch. It
+// trims any trailing slash on the branch name (e.g. a user-supplied
+// "projects/p/branches/b/") so the suffix is not doubled up.
+func snapshotScheduleName(branch string) string {
+	return strings.TrimRight(branch, "/") + snapshotScheduleSuffix
+}
+
+// PostgresSnapshotScheduleRemote is the return type for DoRead. It carries all
+// paths present in StateType (branch, schedule) so drift detection works, plus
+// the schedule's resource name.
+type PostgresSnapshotScheduleRemote struct {
+	Branch   string                     `json:"branch,omitempty"`
+	Schedule []postgres.ScheduleCadence `json:"schedule,omitempty"`
+	Name     string                     `json:"name,omitempty"`
+}
+
+func (s *PostgresSnapshotScheduleRemote) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, s)
+}
+
+func (s PostgresSnapshotScheduleRemote) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(s)
+}
+
+type ResourcePostgresSnapshotSchedule struct {
+	client *databricks.WorkspaceClient
+}
+
+type PostgresSnapshotScheduleState = resources.PostgresSnapshotScheduleConfig
+
+func (*ResourcePostgresSnapshotSchedule) New(client *databricks.WorkspaceClient) *ResourcePostgresSnapshotSchedule {
+	return &ResourcePostgresSnapshotSchedule{client: client}
+}
+
+func (*ResourcePostgresSnapshotSchedule) PrepareState(input *resources.PostgresSnapshotSchedule) *PostgresSnapshotScheduleState {
+	return &PostgresSnapshotScheduleState{
+		Branch:          input.Branch,
+		Schedule:        input.Schedule,
+		ForceSendFields: input.ForceSendFields,
+	}
+}
+
+func (*ResourcePostgresSnapshotSchedule) RemapState(remote *PostgresSnapshotScheduleRemote) *PostgresSnapshotScheduleState {
+	return &PostgresSnapshotScheduleState{
+		Branch:          remote.Branch,
+		Schedule:        remote.Schedule,
+		ForceSendFields: nil,
+	}
+}
+
+// makePostgresSnapshotScheduleRemote converts the SDK SnapshotSchedule into the
+// remote shape. The API addresses the schedule by "{branch}/snapshot-schedule";
+// branch is derived by stripping that suffix so it participates in drift detection.
+func makePostgresSnapshotScheduleRemote(schedule *postgres.SnapshotSchedule) *PostgresSnapshotScheduleRemote {
+	return &PostgresSnapshotScheduleRemote{
+		Branch:   strings.TrimSuffix(schedule.Name, snapshotScheduleSuffix),
+		Schedule: schedule.Schedule,
+		Name:     schedule.Name,
+	}
+}
+
+func (r *ResourcePostgresSnapshotSchedule) DoRead(ctx context.Context, id string) (*PostgresSnapshotScheduleRemote, error) {
+	schedule, err := r.client.Postgres.GetSnapshotSchedule(ctx, postgres.GetSnapshotScheduleRequest{Name: id})
+	if err != nil {
+		return nil, err
+	}
+	return makePostgresSnapshotScheduleRemote(schedule), nil
+}
+
+// updateSnapshotSchedule sets the branch's schedule to the given cadences and
+// waits for the long-running operation to complete. It is the single API call
+// behind create, update, and delete: there is no Create/DeleteSnapshotSchedule
+// endpoint, so the schedule is managed entirely through UpdateSnapshotSchedule.
+// schedule is the only updatable path, so a static mask is used.
+func (r *ResourcePostgresSnapshotSchedule) updateSnapshotSchedule(ctx context.Context, name string, cadences []postgres.ScheduleCadence) (*postgres.SnapshotSchedule, error) {
+	waiter, err := r.client.Postgres.UpdateSnapshotSchedule(ctx, postgres.UpdateSnapshotScheduleRequest{
+		Name: name,
+		SnapshotSchedule: postgres.SnapshotSchedule{
+			Schedule: cadences,
+
+			// Name is carried in the request's Name field, not the body.
+			Name:            "",
+			ForceSendFields: nil,
+		},
+		UpdateMask: fieldmask.FieldMask{
+			Paths: []string{"schedule"},
+		},
+	})
+	if err != nil {
+		return nil, err
+	}
+	return waiter.Wait(ctx)
+}
+
+func (r *ResourcePostgresSnapshotSchedule) DoCreate(ctx context.Context, config *PostgresSnapshotScheduleState) (string, *PostgresSnapshotScheduleRemote, error) {
+	// The schedule exists implicitly for every branch; "creating" the resource
+	// means setting its cadences via UpdateSnapshotSchedule.
+	result, err := r.updateSnapshotSchedule(ctx, snapshotScheduleName(config.Branch), config.Schedule)
+	if err != nil {
+		return "", nil, err
+	}
+	remote := makePostgresSnapshotScheduleRemote(result)
+	return remote.Name, remote, nil
+}
+
+func (r *ResourcePostgresSnapshotSchedule) DoUpdate(ctx context.Context, id string, config *PostgresSnapshotScheduleState, _ *PlanEntry) (*PostgresSnapshotScheduleRemote, error) {
+	result, err := r.updateSnapshotSchedule(ctx, id, config.Schedule)
+	if err != nil {
+		return nil, err
+	}
+	return makePostgresSnapshotScheduleRemote(result), nil
+}
+
+func (r *ResourcePostgresSnapshotSchedule) DoDelete(ctx context.Context, id string, _ *PostgresSnapshotScheduleState) error {
+	// There is no DeleteSnapshotSchedule endpoint. DoDelete fires whenever the
+	// resource leaves the desired state (removed from config, or bundle destroy),
+	// so disable automatic snapshots by setting an empty cadence set — otherwise
+	// the branch would keep taking snapshots after the resource is gone.
+	_, err := r.updateSnapshotSchedule(ctx, id, nil)
+	return err
+}
diff --git a/bundle/direct/dresources/postgres_snapshot_schedule_test.go b/bundle/direct/dresources/postgres_snapshot_schedule_test.go
new file mode 100644
index 00000000000..261ceba17ad
--- /dev/null
+++ b/bundle/direct/dresources/postgres_snapshot_schedule_test.go
@@ -0,0 +1,19 @@
+package dresources
+
+import "testing"
+
+func TestSnapshotScheduleName(t *testing.T) {
+	const branch = "projects/p/branches/b"
+	want := branch + "/snapshot-schedule"
+
+	cases := []string{
+		branch,
+		branch + "/",
+		branch + "//",
+	}
+	for _, in := range cases {
+		if got := snapshotScheduleName(in); got != want {
+			t.Errorf("snapshotScheduleName(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
diff --git a/bundle/direct/dresources/postgres_synced_table.go b/bundle/direct/dresources/postgres_synced_table.go
new file mode 100644
index 00000000000..f194df54e61
--- /dev/null
+++ b/bundle/direct/dresources/postgres_synced_table.go
@@ -0,0 +1,171 @@
+package dresources
+
+import (
+	"context"
+	"strings"
+	"time"
+
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/databricks-sdk-go"
+	sdktime "github.com/databricks/databricks-sdk-go/common/types/time"
+	"github.com/databricks/databricks-sdk-go/marshal"
+	"github.com/databricks/databricks-sdk-go/retries"
+	"github.com/databricks/databricks-sdk-go/service/postgres"
+)
+
+// deleteSyncedTableTimeout caps the post-delete poll so a stuck teardown does not
+// wait forever. Deletion tears down the backing sync pipeline, which normally
+// completes within a minute. DATABRICKS_BUNDLE_RESOURCE_MAX_WAIT shortens it further.
+const deleteSyncedTableTimeout = 5 * time.Minute
+
+// PostgresSyncedTableRemote is the return type for DoRead. It embeds
+// SyncedTableSyncedTableSpec so that all paths in StateType are valid paths in
+// RemoteType, enabling drift detection for spec fields once the backend echoes
+// spec on GET.
+type PostgresSyncedTableRemote struct {
+	postgres.SyncedTableSyncedTableSpec
+
+	SyncedTableId string `json:"synced_table_id,omitempty"`
+
+	Name       string                                 `json:"name,omitempty"`
+	Status     *postgres.SyncedTableSyncedTableStatus `json:"status,omitempty"`
+	Uid        string                                 `json:"uid,omitempty"`
+	CreateTime *sdktime.Time                          `json:"create_time,omitempty"`
+}
+
+// Custom marshaler needed because embedded SyncedTableSyncedTableSpec has its own
+// MarshalJSON which would otherwise take over and ignore the additional fields.
+func (s *PostgresSyncedTableRemote) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, s)
+}
+
+func (s PostgresSyncedTableRemote) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(s)
+}
+
+type ResourcePostgresSyncedTable struct {
+	client *databricks.WorkspaceClient
+}
+
+type PostgresSyncedTableState = resources.PostgresSyncedTableConfig
+
+func (*ResourcePostgresSyncedTable) New(client *databricks.WorkspaceClient) *ResourcePostgresSyncedTable {
+	return &ResourcePostgresSyncedTable{client: client}
+}
+
+func (*ResourcePostgresSyncedTable) PrepareState(input *resources.PostgresSyncedTable) *PostgresSyncedTableState {
+	return &PostgresSyncedTableState{
+		SyncedTableId:              input.SyncedTableId,
+		SyncedTableSyncedTableSpec: input.SyncedTableSyncedTableSpec,
+	}
+}
+
+func (*ResourcePostgresSyncedTable) RemapState(remote *PostgresSyncedTableRemote) *PostgresSyncedTableState {
+	return &PostgresSyncedTableState{
+		SyncedTableId:              remote.SyncedTableId,
+		SyncedTableSyncedTableSpec: remote.SyncedTableSyncedTableSpec,
+	}
+}
+
+// makePostgresSyncedTableRemote converts the SDK SyncedTable into the embedded
+// remote shape. GET does not echo spec today (only status is returned); the
+// embedded spec fields stay at their zero values, and postgres_synced_tables.yml suppresses
+// phantom drift via ignore_remote_changes with reason spec:input_only.
+//
+// The synced-table API doesn't expose the user-facing id as a named field. It
+// only appears as the trailing component of remote.Name, so we strip the
+// constant "synced_tables/" prefix.
+func makePostgresSyncedTableRemote(syncedTable *postgres.SyncedTable) *PostgresSyncedTableRemote {
+	var spec postgres.SyncedTableSyncedTableSpec
+	if syncedTable.Spec != nil {
+		spec = *syncedTable.Spec
+	}
+	return &PostgresSyncedTableRemote{
+		SyncedTableSyncedTableSpec: spec,
+		SyncedTableId:              strings.TrimPrefix(syncedTable.Name, "synced_tables/"),
+		Name:                       syncedTable.Name,
+		Status:                     syncedTable.Status,
+		Uid:                        syncedTable.Uid,
+		CreateTime:                 syncedTable.CreateTime,
+	}
+}
+
+func (r *ResourcePostgresSyncedTable) DoRead(ctx context.Context, id string) (*PostgresSyncedTableRemote, error) {
+	syncedTable, err := r.client.Postgres.GetSyncedTable(ctx, postgres.GetSyncedTableRequest{Name: id})
+	if err != nil {
+		return nil, err
+	}
+	return makePostgresSyncedTableRemote(syncedTable), nil
+}
+
+func (r *ResourcePostgresSyncedTable) DoCreate(ctx context.Context, config *PostgresSyncedTableState) (string, *PostgresSyncedTableRemote, error) {
+	waiter, err := r.client.Postgres.CreateSyncedTable(ctx, postgres.CreateSyncedTableRequest{
+		SyncedTableId: config.SyncedTableId,
+		SyncedTable: postgres.SyncedTable{
+			Spec: &config.SyncedTableSyncedTableSpec,
+
+			// Output-only fields.
+			SyncedTableId:   "",
+			CreateTime:      nil,
+			Name:            "",
+			Status:          nil,
+			Uid:             "",
+			ForceSendFields: nil,
+		},
+	})
+	if err != nil {
+		return "", nil, err
+	}
+
+	result, err := waiter.Wait(ctx)
+	if err != nil {
+		return "", nil, err
+	}
+	remote := makePostgresSyncedTableRemote(result)
+	return remote.Name, remote, nil
+}
+
+func (r *ResourcePostgresSyncedTable) DoDelete(ctx context.Context, id string, _ *PostgresSyncedTableState) error {
+	waiter, err := r.client.Postgres.DeleteSyncedTable(ctx, postgres.DeleteSyncedTableRequest{
+		Name: id,
+	})
+	if err != nil {
+		return err
+	}
+	return waiter.Wait(ctx)
+}
+
+// WaitAfterDelete polls GetSyncedTable until the table is gone. DeleteSyncedTable
+// returns a synthetic operation immediately while the backend tears the table
+// down asynchronously: GET keeps returning 200 with a DELETING provisioning
+// state until the Unity Catalog record is finally removed, and only then returns
+// 404. CreateSyncedTable checks existence against that same UC record, so a
+// recreate's follow-up create issued during the window is rejected with 409
+// ALREADY_EXISTS (observed on AWS). Because both the create's conflict check and
+// this GET read the one UC record, waiting for GET to stop returning the table
+// is enough to make the recreate safe.
+//
+// The poll surfaces the terminal read error: the framework maps a NotFound to
+// success (the table is finally gone — see Adapter.WaitAfterDelete) and propagates
+// anything else. So a poll timeout, an unexpected backend error, or a cancelled
+// deploy fails the recreate rather than racing the create into a 409.
+//
+// The poll runs up to deleteSyncedTableTimeout, shortened to RESOURCE_MAX_WAIT when
+// that is smaller. The engine resolves that env var once and passes it via context
+// (WithResourceMaxWait); the general delete-wait in apply.go stays uncapped, so only
+// this resource bounds itself by it.
+func (r *ResourcePostgresSyncedTable) WaitAfterDelete(ctx context.Context, id string) error {
+	timeout := deleteSyncedTableTimeout
+	if maxWait, ok := resourceMaxWait(ctx); ok && maxWait > 0 {
+		timeout = min(timeout, maxWait)
+	}
+
+	_, err := retries.Poll[struct{}](ctx, timeout, func() (*struct{}, *retries.Err) {
+		_, getErr := r.client.Postgres.GetSyncedTable(ctx, postgres.GetSyncedTableRequest{Name: id})
+		if getErr != nil {
+			return nil, retries.Halt(getErr)
+		}
+		return nil, retries.Continues("synced table still exists, waiting for deletion to complete")
+	})
+	return err
+}
diff --git a/bundle/direct/dresources/quality_monitor.go b/bundle/direct/dresources/quality_monitor.go
index 38667796183..c66fed4e0bb 100644
--- a/bundle/direct/dresources/quality_monitor.go
+++ b/bundle/direct/dresources/quality_monitor.go
@@ -110,7 +110,7 @@ func (r *ResourceQualityMonitor) DoUpdate(ctx context.Context, id string, config
 	return response, nil
 }
 
-func (r *ResourceQualityMonitor) DoDelete(ctx context.Context, id string) error {
+func (r *ResourceQualityMonitor) DoDelete(ctx context.Context, id string, _ *QualityMonitorState) error {
 	//nolint:staticcheck // Direct quality_monitor resource still uses legacy monitor endpoints; v1 data-quality migration is separate work.
 	_, err := r.client.QualityMonitors.Delete(ctx, catalog.DeleteQualityMonitorRequest{
 		TableName: id,
diff --git a/bundle/direct/dresources/redact_config.go b/bundle/direct/dresources/redact_config.go
new file mode 100644
index 00000000000..dbd6ccda83d
--- /dev/null
+++ b/bundle/direct/dresources/redact_config.go
@@ -0,0 +1,72 @@
+package dresources
+
+import (
+	"reflect"
+
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/libs/structs/structaccess"
+	"github.com/databricks/cli/libs/structs/structpath"
+	"github.com/databricks/cli/libs/structs/structwalk"
+)
+
+// RedactSensitiveConfigValues walks the bundle config and replaces the
+// value of every field declared as sensitive_fields for its resource type with
+// "[redacted]". It also redacts the entire variables section when any sensitive
+// resource fields are present, since variables are the standard mechanism for
+// supplying secret values and their resolved values must not appear in the
+// output of `bundle validate -o json`.
+func RedactSensitiveConfigValues(root *config.Root) (*config.Root, error) {
+	fields := getSensitiveFields()
+
+	var hasSensitiveFields bool
+	for resourceType, fieldRules := range fields {
+		resources, err := structaccess.GetByString(root, "resources."+resourceType)
+		if err != nil {
+			return nil, err
+		}
+		err = structwalk.Walk(resources, func(path *structpath.PathNode, val any, _ *reflect.StructField) {
+			for _, fieldRule := range fieldRules {
+				// The first segment of the path is the resource key, so we need to skip it and check the rest of the path
+				rest := path.SkipPrefix(1)
+				if rest.HasPatternPrefix(fieldRule.Field) {
+					hasSensitiveFields = true
+					_ = structaccess.SetByString(root, "resources."+resourceType+path.String(), sensitiveRedactedMarker)
+				}
+			}
+		})
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	// Redact all variable values when any sensitive resource fields are present.
+	// Variables are the standard mechanism for supplying secret values and their
+	// resolved values must not appear in plaintext in the validate output.
+	if hasSensitiveFields {
+		for _, variable := range root.Variables {
+			if variable == nil {
+				continue
+			}
+			if _, ok := variable.Value.(string); ok {
+				variable.Value = sensitiveRedactedMarker
+			}
+		}
+	}
+
+	return root, nil
+}
+
+const sensitiveRedactedMarker = "[redacted]"
+
+// getSensitiveFields returns the map of resource type to list of sensitive fields.
+func getSensitiveFields() map[string][]FieldRule {
+	cfg := MustLoadConfig()
+	fields := make(map[string][]FieldRule)
+	for resourceType, rc := range cfg.Resources {
+		if rc.SensitiveFields == nil {
+			continue
+		}
+		fields[resourceType] = rc.SensitiveFields
+	}
+	return fields
+}
diff --git a/bundle/direct/dresources/registered_model.go b/bundle/direct/dresources/registered_model.go
index e191f52b8bb..1a2fd468ebb 100644
--- a/bundle/direct/dresources/registered_model.go
+++ b/bundle/direct/dresources/registered_model.go
@@ -2,6 +2,7 @@ package dresources
 
 import (
 	"context"
+	"slices"
 
 	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/cli/libs/utils"
@@ -38,11 +39,12 @@ func (*ResourceRegisteredModel) RemapState(model *catalog.RegisteredModelInfo) *
 		MetastoreId: model.MetastoreId,
 		Owner:       model.Owner,
 
-		// Clear output only fields. They should not show up on remote diff computation.
-		CreatedAt: 0,
-		CreatedBy: "",
-		UpdatedAt: 0,
-		UpdatedBy: "",
+		// Output only fields. Remote changes to these are ignored via
+		// ignore_remote_changes in registered_models.yml rather than zeroed here.
+		CreatedAt: model.CreatedAt,
+		CreatedBy: model.CreatedBy,
+		UpdatedAt: model.UpdatedAt,
+		UpdatedBy: model.UpdatedBy,
 	}
 }
 
@@ -64,13 +66,18 @@ func (r *ResourceRegisteredModel) DoCreate(ctx context.Context, config *catalog.
 	return response.FullName, response, nil
 }
 
+// See schemaForceSend. Verified against a real workspace: {"comment": ""} clears it.
+var registeredModelForceSend = []string{"Comment"}
+
 func (r *ResourceRegisteredModel) DoUpdate(ctx context.Context, id string, config *catalog.CreateRegisteredModelRequest, _ *PlanEntry) (*catalog.RegisteredModelInfo, error) {
 	updateRequest := catalog.UpdateRegisteredModelRequest{
 		FullName:        id,
 		Comment:         config.Comment,
-		ForceSendFields: utils.FilterFields[catalog.UpdateRegisteredModelRequest](config.ForceSendFields, "Owner", "NewName"),
+		ForceSendFields: utils.FilterFields[catalog.UpdateRegisteredModelRequest](append(slices.Clone(registeredModelForceSend), config.ForceSendFields...), "Owner", "NewName"),
 
-		// Owner is not part of the configuration tree
+		// Owner is settable in the config (it comes from the embedded
+		// CreateRegisteredModelRequest) and create sends it, but update never has: a
+		// change to it is silently dropped rather than applied.
 		Owner: "",
 
 		// Name updates are not supported yet without recreating. Can be added as a follow-up.
@@ -98,7 +105,7 @@ func (r *ResourceRegisteredModel) DoUpdate(ctx context.Context, id string, confi
 	return response, nil
 }
 
-func (r *ResourceRegisteredModel) DoDelete(ctx context.Context, id string) error {
+func (r *ResourceRegisteredModel) DoDelete(ctx context.Context, id string, _ *catalog.CreateRegisteredModelRequest) error {
 	return r.client.RegisteredModels.Delete(ctx, catalog.DeleteRegisteredModelRequest{
 		FullName: id,
 	})
diff --git a/bundle/direct/dresources/resource_key.go b/bundle/direct/dresources/resource_key.go
new file mode 100644
index 00000000000..640c02243d4
--- /dev/null
+++ b/bundle/direct/dresources/resource_key.go
@@ -0,0 +1,17 @@
+package dresources
+
+import "context"
+
+type resourceKeyType struct{}
+
+// WithResourceKey attaches the bundle resource key used in cmdio progress lines.
+// key is the plan form without the "resources." prefix (e.g. "job_runs.foo").
+func WithResourceKey(ctx context.Context, key string) context.Context {
+	return context.WithValue(ctx, resourceKeyType{}, key)
+}
+
+// ResourceKey returns the key attached by [WithResourceKey], or "" if none.
+func ResourceKey(ctx context.Context) string {
+	key, _ := ctx.Value(resourceKeyType{}).(string)
+	return key
+}
diff --git a/bundle/direct/dresources/resource_key_test.go b/bundle/direct/dresources/resource_key_test.go
new file mode 100644
index 00000000000..b6e9c72b6eb
--- /dev/null
+++ b/bundle/direct/dresources/resource_key_test.go
@@ -0,0 +1,13 @@
+package dresources
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestResourceKeyRoundTrip(t *testing.T) {
+	ctx := WithResourceKey(t.Context(), "job_runs.foo")
+	assert.Equal(t, "job_runs.foo", ResourceKey(ctx))
+	assert.Empty(t, ResourceKey(t.Context()))
+}
diff --git a/bundle/direct/dresources/resource_max_wait.go b/bundle/direct/dresources/resource_max_wait.go
new file mode 100644
index 00000000000..3fbedb8d97b
--- /dev/null
+++ b/bundle/direct/dresources/resource_max_wait.go
@@ -0,0 +1,23 @@
+package dresources
+
+import (
+	"context"
+	"time"
+)
+
+type resourceMaxWaitType struct{}
+
+// WithResourceMaxWait attaches the engine's already-resolved
+// DATABRICKS_BUNDLE_RESOURCE_MAX_WAIT cap so a resource wait can bound itself by it
+// without re-reading and re-parsing the environment on every call. A non-positive
+// duration means "no cap".
+func WithResourceMaxWait(ctx context.Context, maxWait time.Duration) context.Context {
+	return context.WithValue(ctx, resourceMaxWaitType{}, maxWait)
+}
+
+// resourceMaxWait returns the cap attached by [WithResourceMaxWait]; ok is false when
+// none was attached.
+func resourceMaxWait(ctx context.Context) (maxWait time.Duration, ok bool) {
+	maxWait, ok = ctx.Value(resourceMaxWaitType{}).(time.Duration)
+	return maxWait, ok
+}
diff --git a/bundle/direct/dresources/resources.generated.yml b/bundle/direct/dresources/resources.generated.yml
deleted file mode 100644
index 6c3778d3494..00000000000
--- a/bundle/direct/dresources/resources.generated.yml
+++ /dev/null
@@ -1,292 +0,0 @@
-# Generated, do not edit. API field behaviors from OpenAPI schema.
-#
-# For manual edits and schema description, see resources.yml.
-
-resources:
-
-  alerts:
-
-    ignore_remote_changes:
-      - field: create_time
-        reason: spec:output_only
-      - field: effective_run_as
-        reason: spec:output_only
-      - field: evaluation.last_evaluated_at
-        reason: spec:output_only
-      - field: evaluation.state
-        reason: spec:output_only
-      - field: id
-        reason: spec:output_only
-      - field: lifecycle_state
-        reason: spec:output_only
-      - field: owner_user_name
-        reason: spec:output_only
-      - field: update_time
-        reason: spec:output_only
-
-  apps:
-
-    ignore_remote_changes:
-      - field: active_deployment
-        reason: spec:output_only
-      - field: app_status
-        reason: spec:output_only
-      - field: compute_status
-        reason: spec:output_only
-      - field: create_time
-        reason: spec:output_only
-      - field: creator
-        reason: spec:output_only
-      - field: default_source_code_path
-        reason: spec:output_only
-      - field: effective_budget_policy_id
-        reason: spec:output_only
-      - field: effective_usage_policy_id
-        reason: spec:output_only
-      - field: effective_user_api_scopes
-        reason: spec:output_only
-      - field: id
-        reason: spec:output_only
-      - field: oauth2_app_client_id
-        reason: spec:output_only
-      - field: oauth2_app_integration_id
-        reason: spec:output_only
-      - field: pending_deployment
-        reason: spec:output_only
-      - field: service_principal_client_id
-        reason: spec:output_only
-      - field: service_principal_id
-        reason: spec:output_only
-      - field: service_principal_name
-        reason: spec:output_only
-      - field: update_time
-        reason: spec:output_only
-      - field: updater
-        reason: spec:output_only
-      - field: url
-        reason: spec:output_only
-
-  # catalogs: no api field behaviors
-
-  # clusters: no api field behaviors
-
-  dashboards:
-
-    recreate_on_changes:
-      - field: parent_path
-        reason: spec:immutable
-
-    ignore_remote_changes:
-      - field: create_time
-        reason: spec:output_only
-      - field: dashboard_id
-        reason: spec:output_only
-      - field: lifecycle_state
-        reason: spec:output_only
-      - field: path
-        reason: spec:output_only
-      - field: update_time
-        reason: spec:output_only
-
-  database_catalogs:
-
-    ignore_remote_changes:
-      - field: create_database_if_not_exists
-        reason: spec:input_only
-
-      - field: uid
-        reason: spec:output_only
-
-  database_instances:
-
-    recreate_on_changes:
-      - field: parent_instance_ref
-        reason: spec:immutable
-
-    ignore_remote_changes:
-      - field: custom_tags
-        reason: spec:input_only
-      - field: enable_pg_native_login
-        reason: spec:input_only
-      - field: enable_readable_secondaries
-        reason: spec:input_only
-      - field: node_count
-        reason: spec:input_only
-      - field: parent_instance_ref.lsn
-        reason: spec:input_only
-      - field: retention_window_in_days
-        reason: spec:input_only
-      - field: stopped
-        reason: spec:input_only
-      - field: usage_policy_id
-        reason: spec:input_only
-
-      - field: child_instance_refs
-        reason: spec:output_only
-      - field: creation_time
-        reason: spec:output_only
-      - field: creator
-        reason: spec:output_only
-      - field: effective_capacity
-        reason: spec:output_only
-      - field: effective_custom_tags
-        reason: spec:output_only
-      - field: effective_enable_pg_native_login
-        reason: spec:output_only
-      - field: effective_enable_readable_secondaries
-        reason: spec:output_only
-      - field: effective_node_count
-        reason: spec:output_only
-      - field: effective_retention_window_in_days
-        reason: spec:output_only
-      - field: effective_stopped
-        reason: spec:output_only
-      - field: effective_usage_policy_id
-        reason: spec:output_only
-      - field: parent_instance_ref.effective_lsn
-        reason: spec:output_only
-      - field: parent_instance_ref.uid
-        reason: spec:output_only
-      - field: pg_version
-        reason: spec:output_only
-      - field: read_only_dns
-        reason: spec:output_only
-      - field: read_write_dns
-        reason: spec:output_only
-      - field: state
-        reason: spec:output_only
-      - field: uid
-        reason: spec:output_only
-
-  # experiments: no api field behaviors
-
-  external_locations:
-
-    ignore_remote_changes:
-      - field: effective_enable_file_events
-        reason: spec:output_only
-      - field: effective_file_event_queue
-        reason: spec:output_only
-
-  # jobs: no api field behaviors
-
-  # model_serving_endpoints: no api field behaviors
-
-  # models: no api field behaviors
-
-  pipelines:
-
-    ignore_remote_changes:
-      - field: ingestion_definition.source_type
-        reason: spec:output_only
-
-  postgres_branches:
-
-    recreate_on_changes:
-      - field: source_branch
-        reason: spec:immutable
-      - field: source_branch_lsn
-        reason: spec:immutable
-      - field: source_branch_time
-        reason: spec:immutable
-
-    ignore_remote_changes:
-      - field: expire_time
-        reason: spec:input_only
-      - field: is_protected
-        reason: spec:input_only
-      - field: no_expiry
-        reason: spec:input_only
-      - field: source_branch
-        reason: spec:input_only
-      - field: source_branch_lsn
-        reason: spec:input_only
-      - field: source_branch_time
-        reason: spec:input_only
-      - field: ttl
-        reason: spec:input_only
-
-  postgres_endpoints:
-
-    recreate_on_changes:
-      - field: endpoint_type
-        reason: spec:immutable
-
-    ignore_remote_changes:
-      - field: autoscaling_limit_max_cu
-        reason: spec:input_only
-      - field: autoscaling_limit_min_cu
-        reason: spec:input_only
-      - field: disabled
-        reason: spec:input_only
-      - field: endpoint_type
-        reason: spec:input_only
-      - field: group
-        reason: spec:input_only
-      - field: no_suspension
-        reason: spec:input_only
-      - field: settings
-        reason: spec:input_only
-      - field: suspend_timeout_duration
-        reason: spec:input_only
-
-  postgres_projects:
-
-    recreate_on_changes:
-      - field: pg_version
-        reason: spec:immutable
-
-    ignore_remote_changes:
-      - field: budget_policy_id
-        reason: spec:input_only
-      - field: custom_tags
-        reason: spec:input_only
-      - field: default_branch
-        reason: spec:input_only
-      - field: default_endpoint_settings
-        reason: spec:input_only
-      - field: display_name
-        reason: spec:input_only
-      - field: enable_pg_native_login
-        reason: spec:input_only
-      - field: history_retention_duration
-        reason: spec:input_only
-      - field: pg_version
-        reason: spec:input_only
-
-  # quality_monitors: no api field behaviors
-
-  # registered_models: no api field behaviors
-
-  # schemas: no api field behaviors
-
-  # secret_scopes: no api field behaviors
-
-  # sql_warehouses: no api field behaviors
-
-  synced_database_tables:
-
-    ignore_remote_changes:
-      - field: database_instance_name
-        reason: spec:input_only
-      - field: logical_database_name
-        reason: spec:input_only
-      - field: spec.create_database_objects_if_missing
-        reason: spec:input_only
-      - field: spec.existing_pipeline_id
-        reason: spec:input_only
-      - field: spec.new_pipeline_spec
-        reason: spec:input_only
-
-      - field: data_synchronization_status
-        reason: spec:output_only
-      - field: effective_database_instance_name
-        reason: spec:output_only
-      - field: effective_logical_database_name
-        reason: spec:output_only
-      - field: unity_catalog_provisioning_state
-        reason: spec:output_only
-
-  # vector_search_endpoints: no api field behaviors
-
-  # volumes: no api field behaviors
diff --git a/bundle/direct/dresources/resources.yml b/bundle/direct/dresources/resources.yml
deleted file mode 100644
index 569fca9ee82..00000000000
--- a/bundle/direct/dresources/resources.yml
+++ /dev/null
@@ -1,514 +0,0 @@
-# Resource lifecycle configuration for Declarative Automation Bundles.
-# This file defines how field changes affect resource operations.
-#
-# Available options:
-#   recreate_on_changes: fields that trigger delete + create
-#   update_id_on_changes: fields that trigger UpdateWithID (ID may change)
-#   ignore_remote_changes: fields where remote changes are ignored
-#   ignore_local_changes: fields where local changes are ignored (can't be updated via API)
-#   backend_defaults: fields where the backend may set defaults (skipped when old/new are nil but remote is set)
-#     Optional "values" list constrains which remote values are allowed (as JSON-compatible literals).
-#
-# Each field entry has:
-#   field: the field path
-#   reason: why this field is in this category (immutable, input_only, output_only, or descriptive text)
-
-resources:
-
-  jobs:
-    ignore_remote_changes:
-      # Same as clusters.{aws,azure,gcp}_attributes — see clusters/resource_cluster.go#L361-L363
-      # s.SchemaPath("aws_attributes").SetSuppressDiff()
-      # s.SchemaPath("azure_attributes").SetSuppressDiff()
-      # s.SchemaPath("gcp_attributes").SetSuppressDiff()
-      - field: tasks[*].new_cluster.aws_attributes
-        reason: managed
-      - field: tasks[*].new_cluster.azure_attributes
-        reason: managed
-      - field: tasks[*].new_cluster.gcp_attributes
-        reason: managed
-      - field: job_clusters[*].new_cluster.aws_attributes
-        reason: managed
-      - field: job_clusters[*].new_cluster.azure_attributes
-        reason: managed
-      - field: job_clusters[*].new_cluster.gcp_attributes
-        reason: managed
-
-    backend_defaults:
-      # Same as clusters.enable_elastic_disk — see clusters/resource_cluster.go#L331
-      # s.SchemaPath("enable_elastic_disk").SetComputed()
-      - field: tasks[*].new_cluster.enable_elastic_disk
-      - field: job_clusters[*].new_cluster.enable_elastic_disk
-
-      # Same as clusters.enable_local_disk_encryption — see clusters/resource_cluster.go#L332
-      # s.SchemaPath("enable_local_disk_encryption").SetComputed()
-      - field: tasks[*].new_cluster.enable_local_disk_encryption
-      - field: job_clusters[*].new_cluster.enable_local_disk_encryption
-
-      # Same as clusters.node_type_id — see clusters/resource_cluster.go#L333
-      # s.SchemaPath("node_type_id").SetComputed()
-      - field: tasks[*].new_cluster.node_type_id
-      - field: job_clusters[*].new_cluster.node_type_id
-
-      # Same as clusters.driver_node_type_id — see clusters/resource_cluster.go#L334
-      # s.SchemaPath("driver_node_type_id").SetComputed()
-      - field: tasks[*].new_cluster.driver_node_type_id
-      - field: job_clusters[*].new_cluster.driver_node_type_id
-
-      # Same as clusters.driver_instance_pool_id — see clusters/resource_cluster.go#L335
-      # s.SchemaPath("driver_instance_pool_id").SetComputed()
-      - field: tasks[*].new_cluster.driver_instance_pool_id
-      - field: job_clusters[*].new_cluster.driver_instance_pool_id
-
-      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/jobs/resource_job.go#L531
-      # s.SchemaPath("format").SetComputed()
-      - field: format
-        values: ["MULTI_TASK", "SINGLE_TASK"]
-
-      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/jobs/resource_job.go#L639
-      # s.SchemaPath("task", "run_if").SetSuppressDiffWithDefault(jobs.RunIfAllSuccess)
-      - field: "tasks[*].run_if"
-        values: ["ALL_SUCCESS"]
-
-      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/jobs/resource_job.go#L640
-      # s.SchemaPath("task", "for_each_task", "task", "run_if").SetSuppressDiffWithDefault(jobs.RunIfAllSuccess)
-      - field: "tasks[*].for_each_task.task.run_if"
-        values: ["ALL_SUCCESS"]
-
-      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/jobs/resource_job.go#L527
-      # s.SchemaPath("run_as").SetComputed()
-      - field: run_as
-
-      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/jobs/resource_job.go#L521-L524
-      # s.SchemaPath("task", "notebook_task", "source").SetSuppressDiff()
-      # s.SchemaPath("task", "spark_python_task", "source").SetSuppressDiff()
-      # s.SchemaPath("task", "sql_task", "file", "source").SetSuppressDiff()
-      # s.SchemaPath("task", "dbt_task", "source").SetSuppressDiff()
-      - field: tasks[*].notebook_task.source
-      - field: tasks[*].for_each_task.task.notebook_task.source
-      - field: tasks[*].spark_python_task.source
-      - field: tasks[*].for_each_task.task.spark_python_task.source
-      - field: tasks[*].sql_task.file.source
-      - field: tasks[*].for_each_task.task.sql_task.file.source
-      - field: tasks[*].dbt_task.source
-      - field: tasks[*].for_each_task.task.dbt_task.source
-
-      # Same as clusters.data_security_mode: backend sets this when not specified
-      - field: tasks[*].new_cluster.data_security_mode
-      - field: job_clusters[*].new_cluster.data_security_mode
-
-  pipelines:
-    recreate_on_changes:
-      - field: storage
-        reason: immutable
-      - field: ingestion_definition.connection_name
-        reason: immutable
-      - field: ingestion_definition.ingestion_gateway_id
-        reason: immutable
-      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/pipelines/resource_pipeline.go#L204
-      - field: gateway_definition.connection_id
-        reason: immutable
-      - field: gateway_definition.connection_name
-        reason: immutable
-      - field: gateway_definition.gateway_storage_catalog
-        reason: immutable
-      - field: gateway_definition.gateway_storage_schema
-        reason: immutable
-      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/pipelines/resource_pipeline.go#L209
-      - field: ingestion_definition.ingest_from_uc_foreign_catalog
-        reason: immutable
-      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/pipelines/resource_pipeline.go#L204
-      - field: gateway_definition.connection_id
-        reason: immutable
-      - field: gateway_definition.connection_name
-        reason: immutable
-      - field: gateway_definition.gateway_storage_catalog
-        reason: immutable
-      - field: gateway_definition.gateway_storage_schema
-        reason: immutable
-      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/pipelines/resource_pipeline.go#L209
-      - field: ingestion_definition.ingest_from_uc_foreign_catalog
-        reason: immutable
-
-    ignore_remote_changes:
-      # "id" is handled in a special way before any fields changed
-      # However, it is also part of RemotePipeline via CreatePipeline.
-      # Thus it shows up as a remote change since we don't set on the object.
-      - field: id
-        reason: "!drop"
-      - field: run_as
-        reason: input_only
-
-    ignore_local_changes:
-      # "id" is output-only, providing it in config would be a mistake
-      - field: id
-        reason: "!drop"
-
-    backend_defaults:
-      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/pipelines/resource_pipeline.go#L238
-      # s.SchemaPath("storage").SetCustomSuppressDiff(suppressStorageDiff)
-      # Backend generates storage path like dbfs:/pipelines/<id> when not set by user.
-      - field: storage
-
-      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/pipelines/resource_pipeline.go#L218
-      # s.SchemaPath("cluster", "node_type_id").SetComputed()
-      - field: clusters[*].node_type_id
-
-      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/pipelines/resource_pipeline.go#L219
-      # s.SchemaPath("cluster", "driver_node_type_id").SetComputed()
-      - field: clusters[*].driver_node_type_id
-
-      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/pipelines/resource_pipeline.go#L220
-      # s.SchemaPath("cluster", "enable_local_disk_encryption").SetComputed()
-      - field: clusters[*].enable_local_disk_encryption
-
-      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/pipelines/resource_pipeline.go#L229-L230
-      # s.SchemaPath("event_log", "catalog").SetComputed()
-      # s.SchemaPath("event_log", "schema").SetComputed()
-      - field: event_log.catalog
-      - field: event_log.schema
-
-  models:
-    recreate_on_changes:
-      # Recreate matches current behavior of Terraform. It is possible to rename without recreate
-      # but that would require dynamic select of the method during update since
-      # the ml.RenameModel needs to be called instead of ml.UpdateModel.
-      # We might reasonably choose to never fix this because this is a legacy resource.
-      - field: name
-        reason: terraform_compat
-    # Allowing updates for tags requires dynamic selection of the method since
-    # tags can only be updated by calling ml.SetModelTag or ml.DeleteModelTag methods.
-    # Skip annotation matches the current behavior of Terraform where tags changes are showed
-    # in plan but are just ignored / not applied. Since this is a legacy resource we might
-    # reasonably choose to not fix it here as well.
-    ignore_remote_changes:
-      - field: tags
-        reason: terraform_compat
-    ignore_local_changes:
-      - field: tags
-        reason: terraform_compat
-
-  # TF implementation: https://github.com/databricks/terraform-provider-databricks/blob/6c106e8e7052bb2726148d66309fd460ed444236/mlflow/resource_mlflow_experiment.go#L22
-  experiments:
-    recreate_on_changes:
-      - field: artifact_location
-        reason: immutable
-    backend_defaults:
-      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/mlflow/resource_mlflow_experiment.go#L34
-      # SetForceNew().SetSuppressDiff(): backend generates artifact_location when not set by user
-      - field: artifact_location
-    ignore_remote_changes:
-      # Tags updates are not supported by TF. This mirrors that behaviour.
-      - field: tags
-        reason: terraform_compat
-    ignore_local_changes:
-      - field: tags
-        reason: terraform_compat
-
-  # TF implementation: https://github.com/databricks/terraform-provider-databricks/blob/6c106e8e7052bb2726148d66309fd460ed444236/mlflow/resource_mlflow_experiment.go#L22
-  model_serving_endpoints:
-    recreate_on_changes:
-      - field: name
-        reason: immutable
-      # description is immutable, can't be updated via API
-      - field: description
-        reason: immutable
-      - field: config.auto_capture_config.catalog_name
-        reason: immutable
-      - field: config.auto_capture_config.schema_name
-        reason: immutable
-      - field: config.auto_capture_config.table_name_prefix
-        reason: immutable
-      - field: route_optimized
-        reason: immutable
-    ignore_remote_changes:
-      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/serving/resource_model_serving.go#L370
-      # common.CustomizeSchemaPath(m, "config", "traffic_config").SetComputed()
-      # Routes have custom SuppressDiff (lines 387-388)
-      - field: config.traffic_config
-        reason: managed
-      - field: budget_policy_id
-        reason: no_update_api
-        # There is PublicPreview endpoints but we're not using it https://docs.databricks.com/api/workspace/servingendpoints/put
-      - field: rate_limits
-        reason: not_implemented
-    ignore_local_changes:
-      - field: budget_policy_id
-        reason: no_update_api
-      - field: rate_limits
-        reason: not_implemented
-    backend_defaults:
-      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/serving/resource_model_serving.go#L383
-      # common.CustomizeSchemaPath(m, "config", "served_entities", "name").SetComputed()
-      - field: config.served_entities[*].name
-
-      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/serving/resource_model_serving.go#L384
-      # common.CustomizeSchemaPath(m, "config", "served_entities", "workload_type").SetComputed()
-      - field: config.served_entities[*].workload_type
-
-      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/serving/resource_model_serving.go#L372
-      # common.CustomizeSchemaPath(m, "config", "auto_capture_config", "enabled").SetComputed()
-      - field: config.auto_capture_config.enabled
-
-      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/serving/resource_model_serving.go#L395-L396
-      # route_optimized is ForceNew; backend returns false when not set by user.
-      - field: route_optimized
-        values: [false]
-
-  registered_models:
-    ignore_remote_changes:
-      # Output-only timestamp/user fields zeroed in RemapState but still show up
-      # via ForceSendFields. These should never participate in diffs.
-      - field: created_at
-        reason: output_only
-      - field: created_by
-        reason: output_only
-      - field: updated_at
-        reason: output_only
-      - field: updated_by
-        reason: output_only
-    recreate_on_changes:
-      # The name can technically be updated without recreate. We recreate for now though
-      # to match TF implementation.
-      - field: name
-        reason: terraform_compat
-      - field: catalog_name
-        reason: immutable
-      - field: schema_name
-        reason: immutable
-      - field: storage_location
-        reason: immutable
-    backend_defaults:
-      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/catalog/resource_registered_model.go#L28
-      # m["storage_location"].Computed = true
-      - field: storage_location
-      # owner, full_name, metastore_id are Computed in TF (backend-set output fields).
-      - field: owner
-      - field: full_name
-      - field: metastore_id
-
-  quality_monitors:
-    recreate_on_changes:
-      - field: assets_dir
-        reason: immutable
-      - field: table_name
-        reason: immutable
-    ignore_remote_changes:
-      - field: warehouse_id
-        reason: input_only
-      # skip_builtin_dashboard is input-only, not returned by the Get API.
-      # TF preserves it from state; see resource_quality_monitor.go.
-      - field: skip_builtin_dashboard
-        reason: input_only
-
-  catalogs:
-    recreate_on_changes:
-      - field: storage_root
-        reason: immutable
-      - field: connection_name
-        reason: immutable
-      - field: provider_name
-        reason: immutable
-      - field: share_name
-        reason: immutable
-    update_id_on_changes:
-      - field: name
-        reason: id_changes
-
-  schemas:
-    recreate_on_changes:
-      - field: name
-        reason: immutable
-      - field: catalog_name
-        reason: immutable
-      - field: storage_root
-        reason: immutable
-
-  external_locations:
-    recreate_on_changes:
-      - field: credential_name
-        reason: immutable
-      - field: encryption_details
-        reason: immutable
-      - field: file_event_queue
-        reason: immutable
-    update_id_on_changes:
-      - field: name
-        reason: id_changes
-    ignore_remote_changes:
-      # skip_validation is input-only and not returned by the API
-      - field: skip_validation
-        reason: input_only
-
-  volumes:
-    recreate_on_changes:
-      - field: catalog_name
-        reason: immutable
-      - field: schema_name
-        reason: immutable
-      - field: storage_location
-        reason: immutable
-      - field: volume_type
-        reason: immutable
-    update_id_on_changes:
-      - field: name
-        reason: id_changes
-    backend_defaults:
-      # storage_location is Computed; backend generates it for managed volumes.
-      - field: storage_location
-
-  dashboards:
-    ignore_remote_changes:
-      # "serialized_dashboard" locally and remotely will have different contents
-      # We only need to rely on etag here, and can skip this field for diff computation.
-      - field: serialized_dashboard
-        reason: etag_based
-
-      # "dataset_catalog" and "dataset_schema" are write-only fields that are not returned by the server.
-      # They will always differ between local config (which has values) and remote state (which has empty strings).
-      - field: dataset_catalog
-        reason: input_only
-      - field: dataset_schema
-        reason: input_only
-
-  apps:
-    recreate_on_changes:
-      - field: name
-        reason: immutable
-    backend_defaults:
-      # Backend sets it "MEDIUM" when not specified in the config
-      - field: compute_size
-      # lifecycle.started is derived from remote compute status in RemapState, so the
-      # remote side always has a value. When the user omits lifecycle from config,
-      # both old and new are nil and backend_defaults correctly skips the remote value.
-      # When the user explicitly sets lifecycle.started, old/new are non-nil and normal
-      # drift detection applies (e.g. detecting out-of-band stop).
-      - field: lifecycle
-      - field: lifecycle.started
-    ignore_remote_changes:
-      - field: space # This field is not yet supported by Update APIs but exposed in the API spec. TODO: fix when update APIs supports it.
-        reason: managed
-
-  secret_scopes:
-    backend_defaults:
-      # The Secrets API defaults scope_backend_type to DATABRICKS when not specified.
-      - field: scope_backend_type
-        values: ["DATABRICKS"]
-    recreate_on_changes:
-      - field: scope
-        reason: immutable
-      - field: scope_backend_type
-        reason: immutable
-      - field: backend_azure_keyvault
-        reason: immutable
-      - field: initial_manage_principal
-        reason: immutable
-
-  # Permissions for secret scopes use ResourceSecretScopeAcls.
-  secret_scopes.permissions:
-    update_id_on_changes:
-      # When scope name changes, we need UpdateWithID trigger. This is necessary so that subsequent
-      # DoRead operations use the correct ID and we do not end up with a persistent drift.
-      - field: scope_name
-        reason: id_changes
-
-  clusters:
-    ignore_remote_changes:
-      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/clusters/resource_cluster.go#L361-L363
-      # s.SchemaPath("aws_attributes").SetSuppressDiff()
-      # s.SchemaPath("azure_attributes").SetSuppressDiff()
-      # s.SchemaPath("gcp_attributes").SetSuppressDiff()
-      - field: aws_attributes
-        reason: managed
-      - field: azure_attributes
-        reason: managed
-      - field: gcp_attributes
-        reason: managed
-
-    backend_defaults:
-      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/clusters/resource_cluster.go#L331
-      # s.SchemaPath("enable_elastic_disk").SetComputed()
-      - field: enable_elastic_disk
-
-      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/clusters/resource_cluster.go#L332
-      # s.SchemaPath("enable_local_disk_encryption").SetComputed()
-      - field: enable_local_disk_encryption
-
-      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/clusters/resource_cluster.go#L333
-      # s.SchemaPath("node_type_id").SetComputed()
-      - field: node_type_id
-
-      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/clusters/resource_cluster.go#L334
-      # s.SchemaPath("driver_node_type_id").SetComputed()
-      - field: driver_node_type_id
-
-      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/clusters/resource_cluster.go#L335
-      # s.SchemaPath("driver_instance_pool_id").SetComputed()
-      - field: driver_instance_pool_id
-
-      # Terraform currently does not do this, but it is a field with backend default.
-      # See https://github.com/databricks/cli/issues/4418
-      - field: single_user_name
-
-    # We have custom handler for this in cluster.go
-    # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/clusters/resource_cluster.go#L109-L118
-    # DataSecurityModeDiffSuppressFunc: suppress when old != "" && new == ""
-    #- field: data_security_mode
-
-  sql_warehouses:
-    ignore_remote_changes:
-      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/sql/resource_sql_endpoint.go#L62
-      # common.CustomizeSchemaPath(m, "channel").SetSuppressDiff()
-      - field: channel
-        reason: managed
-
-      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/sql/resource_sql_endpoint.go#L82
-      # common.CustomizeSchemaPath(m, "tags").SetSuppressDiff()
-      - field: tags
-        reason: managed
-
-      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/sql/resource_sql_endpoint.go#L85-L87
-      # common.CustomizeSchemaPath(m, "warehouse_type").SetSuppressDiff()
-      - field: warehouse_type
-        reason: managed
-
-      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/sql/resource_sql_endpoint.go#L75
-      # common.CustomizeSchemaPath(m, "min_num_clusters").SetSuppressDiff()
-      - field: min_num_clusters
-        reason: managed
-
-      # creator_name is readonly, can't be updated via API
-      - field: creator_name
-        reason: output_only
-
-    backend_defaults:
-      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/sql/resource_sql_endpoint.go#L69
-      # m["enable_serverless_compute"].Computed = true
-      - field: enable_serverless_compute
-
-  postgres_projects:
-    recreate_on_changes:
-      # project_id is immutable (part of hierarchical name, not in API spec)
-      - field: project_id
-        reason: immutable
-
-  postgres_branches:
-    recreate_on_changes:
-      # parent and branch_id are immutable (part of hierarchical name, not in API spec)
-      - field: parent
-        reason: immutable
-      - field: branch_id
-        reason: immutable
-
-  postgres_endpoints:
-    recreate_on_changes:
-      # parent and endpoint_id are immutable (part of hierarchical name, not in API spec)
-      - field: parent
-        reason: immutable
-      - field: endpoint_id
-        reason: immutable
-
-  vector_search_endpoints:
-    recreate_on_changes:
-      - field: endpoint_type
-        reason: immutable
diff --git a/bundle/direct/dresources/retry.go b/bundle/direct/dresources/retry.go
new file mode 100644
index 00000000000..e7aa77fa956
--- /dev/null
+++ b/bundle/direct/dresources/retry.go
@@ -0,0 +1,29 @@
+package dresources
+
+import "errors"
+
+// RetrySafeError wraps an error to signal that the failed DoCreate is safe to retry.
+type RetrySafeError struct {
+	err error
+}
+
+func (e *RetrySafeError) Error() string { return e.err.Error() }
+func (e *RetrySafeError) Unwrap() error { return e.err }
+
+// retrySafe wraps err to mark the operation as safe to retry from DoCreate.
+// Use this when the create is idempotent (e.g. a PUT that can be repeated safely).
+func retrySafe(err error) error {
+	if err == nil {
+		return nil
+	}
+	return &RetrySafeError{err: err}
+}
+
+// UnwrapRetrySafe removes the retrySafe wrapper, returning the underlying error.
+// If err is not retrySafe-wrapped, it returns err unchanged.
+func UnwrapRetrySafe(err error) error {
+	if safe, ok := errors.AsType[*RetrySafeError](err); ok {
+		return safe.err
+	}
+	return err
+}
diff --git a/bundle/direct/dresources/schema.go b/bundle/direct/dresources/schema.go
index 783b87caf96..d80dac584bc 100644
--- a/bundle/direct/dresources/schema.go
+++ b/bundle/direct/dresources/schema.go
@@ -2,6 +2,7 @@ package dresources
 
 import (
 	"context"
+	"slices"
 
 	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/cli/libs/log"
@@ -24,12 +25,13 @@ func (*ResourceSchema) PrepareState(input *resources.Schema) *catalog.CreateSche
 
 func (*ResourceSchema) RemapState(info *catalog.SchemaInfo) *catalog.CreateSchema {
 	return &catalog.CreateSchema{
-		CatalogName:     info.CatalogName,
-		Comment:         info.Comment,
-		Name:            info.Name,
-		Properties:      info.Properties,
-		StorageRoot:     info.StorageRoot,
-		ForceSendFields: utils.FilterFields[catalog.CreateSchema](info.ForceSendFields),
+		CatalogName:             info.CatalogName,
+		Comment:                 info.Comment,
+		CustomMaxRetentionHours: info.CustomMaxRetentionHours,
+		Name:                    info.Name,
+		Properties:              info.Properties,
+		StorageRoot:             info.StorageRoot,
+		ForceSendFields:         utils.FilterFields[catalog.CreateSchema](info.ForceSendFields),
 	}
 }
 
@@ -45,16 +47,34 @@ func (r *ResourceSchema) DoCreate(ctx context.Context, config *catalog.CreateSch
 	return response.FullName, response, nil
 }
 
+// UC drops a field the payload omits, so a value the config stops declaring never
+// reaches the backend and every later plan reports the same pending change. Worse, when
+// nothing else is in the payload UC rejects it outright with "Nothing to update" (400),
+// which made a schema undeployable once someone set a description on it outside the
+// bundle. Sending these explicitly is the only way to express "the bundle owns this".
+//
+// Only fields verified against a real workspace belong here: {"comment": ""} and
+// {"custom_max_retention_hours": 0} both clear. Do not add a field without probing it -- UC rejects
+// an empty value on some (owner: "" is "Could not find principal with name .", new_name: "" is "not
+// a valid name"), and ForceSendFields is inert for maps, so listing properties would be a no-op.
+//
+// custom_max_retention_hours is force-sent so the direct engine can clear it. The terraform
+// databricks_schema resource cannot set this field at all, so a schema config that uses it deploys
+// differently under terraform (which drops it) than under direct; such configs are kept out of the
+// migrate invariant (schema.yml is excluded there, and schema_tf_compat.yml covers migrate instead).
+var schemaForceSend = []string{"Comment", "CustomMaxRetentionHours"}
+
 // DoUpdate updates the schema in place and returns remote state.
 func (r *ResourceSchema) DoUpdate(ctx context.Context, id string, config *catalog.CreateSchema, _ *PlanEntry) (*catalog.SchemaInfo, error) {
 	updateRequest := catalog.UpdateSchema{
 		Comment:                      config.Comment,
+		CustomMaxRetentionHours:      config.CustomMaxRetentionHours,
 		EnablePredictiveOptimization: "", // Not supported by DABs
 		FullName:                     id,
 		NewName:                      "", // We recreate schemas on name change intentionally.
 		Owner:                        "", // Not supported by DABs
 		Properties:                   config.Properties,
-		ForceSendFields:              utils.FilterFields[catalog.UpdateSchema](config.ForceSendFields, "EnablePredictiveOptimization", "NewName", "Owner"),
+		ForceSendFields:              utils.FilterFields[catalog.UpdateSchema](append(slices.Clone(schemaForceSend), config.ForceSendFields...), "EnablePredictiveOptimization", "NewName", "Owner"),
 	}
 
 	response, err := r.client.Schemas.Update(ctx, updateRequest)
@@ -69,7 +89,7 @@ func (r *ResourceSchema) DoUpdate(ctx context.Context, id string, config *catalo
 	return response, nil
 }
 
-func (r *ResourceSchema) DoDelete(ctx context.Context, id string) error {
+func (r *ResourceSchema) DoDelete(ctx context.Context, id string, _ *catalog.CreateSchema) error {
 	return r.client.Schemas.Delete(ctx, catalog.DeleteSchemaRequest{
 		FullName:        id,
 		Force:           true,
diff --git a/bundle/direct/dresources/schema_test.go b/bundle/direct/dresources/schema_test.go
index d013610e052..ee6397afc6e 100644
--- a/bundle/direct/dresources/schema_test.go
+++ b/bundle/direct/dresources/schema_test.go
@@ -49,12 +49,16 @@ func TestResourceSchema_DoUpdate_WithUnsupportedForceSendFields(t *testing.T) {
 
 	resultJSON, err := json.Marshal(result)
 	require.NoError(t, err)
+	// browse_only is force-sent from create onwards, matching UC, which returns it on
+	// every read including after an update.
 	expected := `{
+		"browse_only": false,
 		"catalog_name": "main",
 		"catalog_type": "MANAGED_CATALOG",
 		"created_at": 0,
 		"created_by": "tester@databricks.com",
 		"comment": "updated comment",
+		"custom_max_retention_hours": 0,
 		"effective_predictive_optimization_flag": {
 			"inherited_from_name": "deco-uc-prod-isolated-aws-us-east-1",
 			"inherited_from_type": "METASTORE",
diff --git a/bundle/direct/dresources/secret.go b/bundle/direct/dresources/secret.go
new file mode 100644
index 00000000000..2db0a334f82
--- /dev/null
+++ b/bundle/direct/dresources/secret.go
@@ -0,0 +1,131 @@
+package dresources
+
+import (
+	"context"
+	"slices"
+
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/cli/bundle/deployplan"
+	"github.com/databricks/cli/libs/structs/structdiff"
+	"github.com/databricks/cli/libs/structs/structpath"
+	"github.com/databricks/cli/libs/utils"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/common/types/fieldmask"
+	"github.com/databricks/databricks-sdk-go/service/catalog"
+)
+
+// Terraform provider implementation:
+// https://github.com/databricks/terraform-provider-databricks/blob/main/catalog/resource_secret.go
+type ResourceSecret struct {
+	client *databricks.WorkspaceClient
+}
+
+func (*ResourceSecret) New(client *databricks.WorkspaceClient) *ResourceSecret {
+	return &ResourceSecret{client: client}
+}
+
+func (*ResourceSecret) PrepareState(input *resources.Secret) *catalog.Secret {
+	return &catalog.Secret{
+		CatalogName:     input.CatalogName,
+		SchemaName:      input.SchemaName,
+		Name:            input.Name,
+		Value:           input.Value,
+		Comment:         input.Comment,
+		ExpireTime:      input.ExpireTime,
+		Owner:           "",
+		CreateTime:      nil,
+		CreatedBy:       "",
+		EffectiveOwner:  "",
+		EffectiveValue:  "",
+		FullName:        "",
+		MetastoreId:     "",
+		UpdateTime:      nil,
+		UpdatedBy:       "",
+		ForceSendFields: utils.FilterFields[catalog.Secret](nil),
+	}
+}
+
+// remapSecretRemote surfaces the resolved value and owner (the API returns them under
+// effective_value/effective_owner) under value/owner so remote state matches the config
+// shape — without this, the persisted value is empty and every plan re-reports an update.
+// The rest of the secret, including the output-only metadata, is left intact and handled
+// by ignore_remote_changes, so no information is discarded. It runs wherever remote state
+// is produced (DoRead/DoCreate/DoUpdate), so no RemapState hook is needed.
+func remapSecretRemote(remote *catalog.Secret) *catalog.Secret {
+	remote.Value = remote.EffectiveValue
+	remote.Owner = remote.EffectiveOwner
+	return remote
+}
+
+// DoRead fetches the secret by full name. IncludeValue is set so remapSecretRemote can
+// recover the stored value from EffectiveValue.
+func (r *ResourceSecret) DoRead(ctx context.Context, id string) (*catalog.Secret, error) {
+	remote, err := r.client.SecretsUc.GetSecret(ctx, catalog.GetSecretRequest{
+		FullName:        id,
+		IncludeValue:    true,
+		ForceSendFields: nil,
+	})
+	if err != nil {
+		return nil, err
+	}
+	return remapSecretRemote(remote), nil
+}
+
+// DoCreate creates a new UC secret.
+func (r *ResourceSecret) DoCreate(ctx context.Context, state *catalog.Secret) (string, *catalog.Secret, error) {
+	response, err := r.client.SecretsUc.CreateSecret(ctx, catalog.CreateSecretRequest{
+		Secret: *state,
+	})
+	if err != nil || response == nil {
+		return "", nil, err
+	}
+	return response.FullName, remapSecretRemote(response), nil
+}
+
+// comment is force-sent on update so that clearing it in config clears it on the secret. The
+// update_mask is "*" and the backend merges, so an omitempty comment would be dropped from the
+// body and the old value would drift back. Verified against a real workspace: {"comment": ""} clears it.
+var secretForceSend = []string{"Comment"}
+
+// DoUpdate updates the secret in place and returns remote state.
+func (r *ResourceSecret) DoUpdate(ctx context.Context, id string, state *catalog.Secret, _ *PlanEntry) (*catalog.Secret, error) {
+	secret := *state
+	secret.ForceSendFields = utils.FilterFields[catalog.Secret](append(slices.Clone(secretForceSend), state.ForceSendFields...))
+	response, err := r.client.SecretsUc.UpdateSecret(ctx, catalog.UpdateSecretRequest{
+		FullName: id,
+		Secret:   secret,
+		UpdateMask: fieldmask.FieldMask{
+			Paths: []string{"*"},
+		},
+	})
+	if err != nil {
+		return nil, err
+	}
+	return remapSecretRemote(response), nil
+}
+
+// DoDelete deletes the secret.
+func (r *ResourceSecret) DoDelete(ctx context.Context, id string, _ *catalog.Secret) error {
+	return r.client.SecretsUc.DeleteSecret(ctx, catalog.DeleteSecretRequest{
+		FullName: id,
+	})
+}
+
+// OverrideChangeDesc handles the "value" field, which is write-only (the API never
+// returns it in GET responses — only effective_value is readable). The state file
+// stores "" for this field (never the plaintext), so old is always "" regardless of
+// the actual stored value. We compare new vs remote (via effective_value from DoRead)
+// to decide whether the secret actually changed: if they are equal, the user's config
+// already matches what is stored remotely and no update is needed.
+func (*ResourceSecret) OverrideChangeDesc(_ context.Context, path *structpath.PathNode, ch *ChangeDesc, _ *catalog.Secret) error {
+	if path.String() != "value" {
+		return nil
+	}
+	if structdiff.IsEqual(ch.Remote, ch.New) {
+		ch.Action = deployplan.Skip
+		ch.Reason = deployplan.ReasonCustom
+	} else {
+		ch.Action = deployplan.Update
+	}
+	return nil
+}
diff --git a/bundle/direct/dresources/secret_scope.go b/bundle/direct/dresources/secret_scope.go
index 420424997a6..7ad0b0d469a 100644
--- a/bundle/direct/dresources/secret_scope.go
+++ b/bundle/direct/dresources/secret_scope.go
@@ -2,11 +2,12 @@ package dresources
 
 import (
 	"context"
-	"fmt"
 
 	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/cli/libs/utils"
 	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/marshal"
 	"github.com/databricks/databricks-sdk-go/service/workspace"
 )
 
@@ -18,6 +19,30 @@ type SecretScopeConfig struct {
 	workspace.CreateScope
 }
 
+// SecretScopeRemote is remote state for a secret scope. The Secrets API returns scopes as
+// workspace.SecretScope (name/backend_type/keyvault_metadata); DoRead maps those onto the field
+// names the state uses (scope/scope_backend_type/backend_azure_keyvault) so RemapState is a plain
+// field copy. name is retained because `${resources.secret_scopes.<key>.name}` references resolve
+// against the remote type.
+type SecretScopeRemote struct {
+	Name                 string                                      `json:"name"`
+	Scope                string                                      `json:"scope"`
+	ScopeBackendType     workspace.ScopeBackendType                  `json:"scope_backend_type,omitempty"`
+	BackendAzureKeyvault *workspace.AzureKeyVaultSecretScopeMetadata `json:"backend_azure_keyvault,omitempty"`
+	ForceSendFields      []string                                    `json:"-"`
+}
+
+// Custom marshalers so the root ForceSendFields is honored: a force-sent zero-valued
+// scalar (e.g. scope_backend_type) survives serialization instead of being dropped by
+// omitempty, which plain encoding/json would do since it does not know the convention.
+func (s *SecretScopeRemote) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, s)
+}
+
+func (s SecretScopeRemote) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(s)
+}
+
 func (*ResourceSecretScope) New(client *databricks.WorkspaceClient) *ResourceSecretScope {
 	return &ResourceSecretScope{
 		client: client,
@@ -26,32 +51,28 @@ func (*ResourceSecretScope) New(client *databricks.WorkspaceClient) *ResourceSec
 
 func (*ResourceSecretScope) PrepareState(input *resources.SecretScope) *SecretScopeConfig {
 	return &SecretScopeConfig{
-		CreateScope: workspace.CreateScope{
-			Scope:                  input.Name,
-			ScopeBackendType:       input.BackendType,
-			BackendAzureKeyvault:   input.KeyvaultMetadata,
-			InitialManagePrincipal: "",
-			ForceSendFields:        nil,
-		},
+		Scope:                  input.Name,
+		ScopeBackendType:       input.BackendType,
+		BackendAzureKeyvault:   input.KeyvaultMetadata,
+		InitialManagePrincipal: "",
+		ForceSendFields:        nil,
 	}
 }
 
-func (*ResourceSecretScope) RemapState(remote *workspace.SecretScope) *SecretScopeConfig {
+func (*ResourceSecretScope) RemapState(remote *SecretScopeRemote) *SecretScopeConfig {
 	return &SecretScopeConfig{
-		CreateScope: workspace.CreateScope{
-			Scope:                  remote.Name,
-			ScopeBackendType:       remote.BackendType,
-			BackendAzureKeyvault:   remote.KeyvaultMetadata,
-			InitialManagePrincipal: "",
-			ForceSendFields:        utils.FilterFields[workspace.CreateScope](remote.ForceSendFields),
-		},
+		Scope:                  remote.Scope,
+		ScopeBackendType:       remote.ScopeBackendType,
+		BackendAzureKeyvault:   remote.BackendAzureKeyvault,
+		InitialManagePrincipal: "",
+		ForceSendFields:        utils.FilterFields[workspace.CreateScope](remote.ForceSendFields),
 	}
 }
 
 // DoRead fetches the secret scope by name. Since the Secrets API does not provide
 // a "get by name" endpoint (see https://docs.databricks.com/api/workspace/secrets),
 // we must list all scopes and filter by name to check if the scope still exists.
-func (r *ResourceSecretScope) DoRead(ctx context.Context, id string) (*workspace.SecretScope, error) {
+func (r *ResourceSecretScope) DoRead(ctx context.Context, id string) (*SecretScopeRemote, error) {
 	scopes, err := r.client.Secrets.ListScopesAll(ctx)
 	if err != nil {
 		return nil, err
@@ -59,14 +80,20 @@ func (r *ResourceSecretScope) DoRead(ctx context.Context, id string) (*workspace
 
 	for _, scope := range scopes {
 		if scope.Name == id {
-			return &scope, nil
+			return &SecretScopeRemote{
+				Name:                 scope.Name,
+				Scope:                scope.Name,
+				ScopeBackendType:     scope.BackendType,
+				BackendAzureKeyvault: scope.KeyvaultMetadata,
+				ForceSendFields:      nil,
+			}, nil
 		}
 	}
 
-	return nil, fmt.Errorf("secret scope %q not found", id)
+	return nil, apierr.ErrNotFound
 }
 
-func (r *ResourceSecretScope) DoCreate(ctx context.Context, state *SecretScopeConfig) (string, *workspace.SecretScope, error) {
+func (r *ResourceSecretScope) DoCreate(ctx context.Context, state *SecretScopeConfig) (string, *SecretScopeRemote, error) {
 	err := r.client.Secrets.CreateScope(ctx, state.CreateScope)
 	if err != nil {
 		return "", nil, err
@@ -78,6 +105,6 @@ func (r *ResourceSecretScope) DoCreate(ctx context.Context, state *SecretScopeCo
 // DoUpdate is not intentionally implemented here because scopes do not support a update API. All fields are marked to
 // return a recreate trigger.
 
-func (r *ResourceSecretScope) DoDelete(ctx context.Context, id string) error {
+func (r *ResourceSecretScope) DoDelete(ctx context.Context, id string, _ *SecretScopeConfig) error {
 	return r.client.Secrets.DeleteScopeByScope(ctx, id)
 }
diff --git a/bundle/direct/dresources/secret_scope_acls.go b/bundle/direct/dresources/secret_scope_acls.go
index dc03544e9cc..1de301bde2c 100644
--- a/bundle/direct/dresources/secret_scope_acls.go
+++ b/bundle/direct/dresources/secret_scope_acls.go
@@ -22,14 +22,22 @@ type SecretScopeAclsState struct {
 	Acls      []workspace.AclItem `json:"acls,omitempty"`
 }
 
-func PrepareSecretScopeAclsInputConfig(inputConfig []resources.SecretScopePermission, node string) (*structvar.StructVar, error) {
-	baseNode, ok := strings.CutSuffix(node, ".permissions")
+func (*ResourceSecretScopeAcls) New(client *databricks.WorkspaceClient) *ResourceSecretScopeAcls {
+	return &ResourceSecretScopeAcls{client: client}
+}
+
+func (*ResourceSecretScopeAcls) PrepareState(s *SecretScopeAclsState) *SecretScopeAclsState {
+	return s
+}
+
+func (*ResourceSecretScopeAcls) PrepareInputConfig(inputConfig *[]resources.SecretScopePermission, resourceKey string) (*structvar.StructVar, error) {
+	baseNode, ok := strings.CutSuffix(resourceKey, ".permissions")
 	if !ok {
-		return nil, fmt.Errorf("internal error: node %q does not end with .permissions", node)
+		return nil, fmt.Errorf("internal error: node %q does not end with .permissions", resourceKey)
 	}
 
-	acls := make([]workspace.AclItem, 0, len(inputConfig))
-	for _, elem := range inputConfig {
+	acls := make([]workspace.AclItem, 0, len(*inputConfig))
+	for _, elem := range *inputConfig {
 		acl := workspace.AclItem{
 			Permission: workspace.AclPermission(elem.Level),
 			Principal:  "",
@@ -55,14 +63,6 @@ func PrepareSecretScopeAclsInputConfig(inputConfig []resources.SecretScopePermis
 	}, nil
 }
 
-func (*ResourceSecretScopeAcls) New(client *databricks.WorkspaceClient) *ResourceSecretScopeAcls {
-	return &ResourceSecretScopeAcls{client: client}
-}
-
-func (*ResourceSecretScopeAcls) PrepareState(s *SecretScopeAclsState) *SecretScopeAclsState {
-	return s
-}
-
 func aclItemKey(x workspace.AclItem) (string, string) {
 	return "principal", x.Principal
 }
@@ -88,10 +88,6 @@ func (r *ResourceSecretScopeAcls) DoRead(ctx context.Context, id string) (*Secre
 	}, nil
 }
 
-func (r *ResourceSecretScopeAcls) RemapState(remote *SecretScopeAclsState) *SecretScopeAclsState {
-	return remote
-}
-
 func (r *ResourceSecretScopeAcls) DoCreate(ctx context.Context, state *SecretScopeAclsState) (string, *SecretScopeAclsState, error) {
 	err := r.setACLs(ctx, state.ScopeName, state.Acls)
 	if err != nil {
@@ -101,7 +97,7 @@ func (r *ResourceSecretScopeAcls) DoCreate(ctx context.Context, state *SecretSco
 }
 
 // We implement DoUpdateWithId to ensure that the updated ID gets recorded in state.
-func (r *ResourceSecretScopeAcls) DoUpdateWithID(ctx context.Context, id string, state *SecretScopeAclsState) (string, *SecretScopeAclsState, error) {
+func (r *ResourceSecretScopeAcls) DoUpdateWithID(ctx context.Context, id string, state *SecretScopeAclsState, _ *PlanEntry) (string, *SecretScopeAclsState, error) {
 	err := r.setACLs(ctx, state.ScopeName, state.Acls)
 	if err != nil {
 		return "", nil, err
@@ -109,15 +105,14 @@ func (r *ResourceSecretScopeAcls) DoUpdateWithID(ctx context.Context, id string,
 	return state.ScopeName, nil, nil
 }
 
-func (r *ResourceSecretScopeAcls) DoUpdate(ctx context.Context, id string, state *SecretScopeAclsState, _ *PlanEntry) (*SecretScopeAclsState, error) {
-	_, _, err := r.DoUpdateWithID(ctx, id, state)
+func (r *ResourceSecretScopeAcls) DoUpdate(ctx context.Context, id string, state *SecretScopeAclsState, entry *PlanEntry) (*SecretScopeAclsState, error) {
+	_, _, err := r.DoUpdateWithID(ctx, id, state, entry)
 	return nil, err
 }
 
-// Removing ACLs is a no-op, to match the behavior for permissions and grants.
-func (r *ResourceSecretScopeAcls) DoDelete(ctx context.Context, id string) error {
-	return nil
-}
+// ResourceSecretScopeAcls intentionally implements no DoDelete: removing ACLs is a
+// no-op, to match the behavior for permissions and grants. Deleting the resource is a
+// state-only cleanup (see PlanEntry.StateOnly).
 
 // setACLs reconciles the desired ACLs with the current state
 func (r *ResourceSecretScopeAcls) setACLs(ctx context.Context, scopeName string, desiredAcls []workspace.AclItem) error {
diff --git a/bundle/direct/dresources/serialize_test.go b/bundle/direct/dresources/serialize_test.go
new file mode 100644
index 00000000000..76078460193
--- /dev/null
+++ b/bundle/direct/dresources/serialize_test.go
@@ -0,0 +1,405 @@
+package dresources
+
+import (
+	"encoding/json"
+	"reflect"
+	"slices"
+	"strings"
+	"testing"
+
+	"github.com/databricks/cli/libs/structs/structdiff"
+	"github.com/databricks/cli/libs/structs/structtag"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// formatChanges renders a diff as one "  path: old -> new" line per change, with
+// values JSON-encoded so nested fields stay readable in the failure message.
+func formatChanges(changes []structdiff.Change) string {
+	var b strings.Builder
+	for _, c := range changes {
+		old, _ := json.Marshal(c.Old)
+		updated, _ := json.Marshal(c.New)
+		b.WriteString("\n  ")
+		b.WriteString(c.Path.String())
+		b.WriteString(":\n    old = ")
+		b.Write(old)
+		b.WriteString("\n    new = ")
+		b.Write(updated)
+	}
+	return b.String()
+}
+
+// assertJSONRoundTrip marshals v to JSON, unmarshals it back into a fresh value
+// of the same type, and asserts the two are equal field-by-field.
+//
+// This guards against wrapper structs (StateType, RemoteType) that embed an SDK
+// type with its own MarshalJSON but forget to define their own: the embedded
+// marshaler takes over and silently drops the wrapper's extra fields. The state
+// file round-trips through exactly this path (dstate.SaveState json.Marshal ->
+// apply.parseState json.Unmarshal), so a missing wrapper marshaler corrupts state.
+func assertJSONRoundTrip(t *testing.T, v any, label string) {
+	t.Helper()
+
+	data, err := json.Marshal(v)
+	require.NoError(t, err, "%s: Marshal failed", label)
+
+	roundTripped := reflect.New(reflect.TypeOf(v)).Interface()
+	err = json.Unmarshal(data, roundTripped)
+	require.NoError(t, err, "%s: Unmarshal failed", label)
+	back := reflect.ValueOf(roundTripped).Elem().Interface()
+
+	// Diff the Go values rather than the JSON: a wrapper that drops fields keeps
+	// them populated in v but loses them in back, so structdiff flags it even
+	// though both marshal to the same (already-truncated) JSON. structdiff skips
+	// ForceSendFields and json:"-" fields, which are intentionally not serialized.
+	// Free-form any fields must be populated with []any/map[string]any (as JSON
+	// decoding yields) so they round-trip to the same concrete type.
+	changes, err := structdiff.GetStructDiff(v, back, nil)
+	require.NoError(t, err)
+	require.Empty(t, changes, "%s lost %d field(s) in JSON round-trip:%s", label, len(changes), formatChanges(changes))
+}
+
+// TestRoundtripFixtureStateType verifies that every resource's StateType
+// survives a json.Marshal -> json.Unmarshal cycle without losing fields, using
+// the per-resource fixture in testConfig. The state file is persisted and
+// reloaded through exactly this path. Complements TestRoundtripAllFieldsStateType:
+// this exercises a realistic value, that one exercises every field.
+func TestRoundtripFixtureStateType(t *testing.T) {
+	_, client := setupTestServerClient(t)
+
+	for resourceType, resource := range SupportedResources {
+		// secrets are dropping value from state, so we skip it
+		if resourceType == "secrets" {
+			continue
+		}
+		adapter, err := NewAdapter(resource, resourceType, client)
+		require.NoError(t, err)
+
+		t.Run(resourceType, func(t *testing.T) {
+			inputConfig, ok := testConfig[resourceType]
+			if !ok {
+				// No populated fixture: fall back to a zero value. This still
+				// exercises the marshalers, just without field-preservation signal.
+				inputConfig = reflect.New(adapter.InputConfigType().Elem()).Interface()
+			}
+
+			newState, err := adapter.PrepareState(inputConfig)
+			require.NoError(t, err, "PrepareState failed")
+
+			assertJSONRoundTrip(t, newState, "StateType "+resourceType)
+		})
+	}
+}
+
+// testRoundtripAllFields fills every field of the type returned by typeOf with a
+// non-zero value and asserts it survives a JSON round-trip. Filling all fields
+// makes a dropped field always observable (non-zero before, zero after),
+// independent of which fields a realistic value would populate. StateType and
+// RemoteType are validated as pointer-to-struct by the adapter, so typeOf always
+// returns a pointer here.
+func testRoundtripAllFields(t *testing.T, label string, typeOf func(*Adapter) reflect.Type, skip []string) {
+	for resourceType, resource := range SupportedResources {
+		if slices.Contains(skip, resourceType) {
+			continue
+		}
+		adapter, err := NewAdapter(resource, resourceType, nil)
+		require.NoError(t, err)
+
+		t.Run(resourceType, func(t *testing.T) {
+			v := reflect.New(typeOf(adapter).Elem())
+			fillNonZero(v.Elem(), 0)
+			assertJSONRoundTrip(t, v.Interface(), label+" "+resourceType)
+		})
+	}
+}
+
+// TestRoundtripAllFieldsStateType verifies StateType survives a JSON round-trip
+// with every field populated. StateType is persisted to the state file.
+func TestRoundtripAllFieldsStateType(t *testing.T) {
+	testRoundtripAllFields(t, "StateType", (*Adapter).StateType, nil)
+}
+
+// TestRoundtripAllFieldsRemoteType verifies RemoteType survives a JSON round-trip
+// with every field populated. RemoteType is emitted in the plan's "remote_state"
+// field, so a wrapper embedding an SDK type with its own MarshalJSON must define
+// its own or its extra fields vanish.
+func TestRoundtripAllFieldsRemoteType(t *testing.T) {
+	testRoundtripAllFields(t, "RemoteType", (*Adapter).RemoteType, nil)
+}
+
+// TestRoundtripAllFieldsInputConfigType verifies InputConfigType, the typed
+// bundle config a resource is loaded into, survives a JSON round-trip with every
+// field populated. Bundle config is normally read and written through libs/dyn,
+// which walks the struct itself and never calls these marshalers, so this is a
+// latent trap rather than live corruption. It is guarded anyway because it is the
+// same trap as StateType and RemoteType: a resource that embeds a member with its
+// own MarshalJSON and defines none of its own inherits that method by promotion
+// and silently drops id, url, lifecycle, modified_status and permissions.
+//
+// cluster_policies is exempt. Its definition and policy_family_definition_overrides
+// are typed `any` and deliberately shadow same-named string fields in the embedded
+// compute.CreatePolicy, so a policy document can be authored as inline YAML
+// (ConfigureClusterPolicyDefinition normalizes it to the JSON string the API wants
+// before deploy). Only the shallower `any` is reachable by that JSON name, but
+// marshal.Unmarshal hands the whole payload to the embedded member, so the shadowed
+// string comes back holding the raw JSON text and reads as a lost field. Its other
+// fields go unchecked on this surface as a result.
+func TestRoundtripAllFieldsInputConfigType(t *testing.T) {
+	testRoundtripAllFields(t, "InputConfigType", (*Adapter).InputConfigType, []string{"cluster_policies"})
+}
+
+var jsonMarshalerType = reflect.TypeFor[json.Marshaler]()
+
+// hasPointerOnlyMarshaler reports whether *T marshals itself but T does not.
+//
+// A type with no marshaler at all is not a defect: encoding/json treats it the
+// same by value and by pointer. Only the asymmetry is. Kind is not restricted:
+// a named scalar, slice or map can declare MarshalJSON on a pointer receiver and
+// diverges exactly the same way.
+func hasPointerOnlyMarshaler(t reflect.Type) bool {
+	return reflect.PointerTo(t).Implements(jsonMarshalerType) &&
+		!t.Implements(jsonMarshalerType)
+}
+
+// collectPointerOnlyMarshalers records into found every type reachable from t
+// whose MarshalJSON is declared on a pointer receiver only.
+//
+// Pointers are followed as edges rather than stripped up front, so `type L *L`
+// terminates on seen rather than spinning in Elem().
+func collectPointerOnlyMarshalers(t reflect.Type, seen, found map[reflect.Type]bool) {
+	if seen[t] {
+		return
+	}
+	seen[t] = true
+
+	if hasPointerOnlyMarshaler(t) {
+		found[t] = true
+	}
+
+	switch t.Kind() {
+	case reflect.Pointer, reflect.Slice, reflect.Array, reflect.Map:
+		collectPointerOnlyMarshalers(t.Elem(), seen, found)
+	case reflect.Struct:
+		for field := range t.Fields() {
+			// json:"-" is never serialized, so a type reachable only through one
+			// cannot diverge. Skipped for the same reason as unexported fields.
+			if !field.IsExported() || structtag.JSONTag(field.Tag.Get("json")).Name() == "-" {
+				continue
+			}
+			collectPointerOnlyMarshalers(field.Type, seen, found)
+		}
+	default:
+		// Scalars hold no reachable named type, and an interface field's dynamic
+		// type is not knowable from the static type.
+	}
+}
+
+// TestMarshalerValueReceiver asserts that no type reachable from an adapter
+// surface declares MarshalJSON on a pointer receiver only.
+//
+// Such a method is satisfied by *T but not by T, and encoding/json reaches it
+// only for an addressable value. json.Marshal(&x) then uses the marshaler while
+// json.Marshal(x) silently falls back to plain struct-field encoding -- two code
+// paths for one type. They disagree on more than key order, because encoding/json
+// knows nothing about ForceSendFields (tagged json:"-"), so a force-sent zero
+// value of an omitempty field survives one path and vanishes on the other.
+//
+// The walk covers embedded members and named fields, not just the surface type
+// itself. Both matter, for different reasons: an embedded member's pointer
+// receiver is promoted to *T only, which makes T itself asymmetric unless T
+// declares its own marshaler -- and if it does, the member's asymmetry is hidden
+// from a top-level check while still applying wherever that member is marshalled
+// directly. A named field is stronger still: marshal's structAsMap stores every
+// field into a map via .Interface(), and a map value is not addressable, so the
+// pointer receiver is unreachable there. (Slice elements, by contrast, stay
+// addressable and do reach it -- the walk covers them for the embedded-member
+// reason, not this one.)
+//
+// The round-trip tests above cannot catch any of this: they build values with
+// reflect.New, so they only ever marshal a pointer.
+func TestMarshalerValueReceiver(t *testing.T) {
+	for resourceType, resource := range SupportedResources {
+		adapter, err := NewAdapter(resource, resourceType, nil)
+		require.NoError(t, err)
+
+		t.Run(resourceType, func(t *testing.T) {
+			// Each subtest walks with its own maps. Sharing them across subtests
+			// would attribute a type to whichever one reached it first, and
+			// iteration order over SupportedResources is random.
+			seen := make(map[reflect.Type]bool)
+			found := make(map[reflect.Type]bool)
+			for _, typeOf := range []func(*Adapter) reflect.Type{
+				(*Adapter).InputConfigType,
+				(*Adapter).StateType,
+				(*Adapter).RemoteType,
+			} {
+				collectPointerOnlyMarshalers(typeOf(adapter), seen, found)
+			}
+
+			names := make([]string, 0, len(found))
+			for typ := range found {
+				names = append(names, typ.String())
+			}
+			slices.Sort(names)
+			require.Empty(t, names,
+				"reachable from %s: these types declare MarshalJSON on a pointer receiver only; give each a value receiver so marshalling by value and by pointer agree:\n  %s",
+				resourceType, strings.Join(names, "\n  "))
+		})
+	}
+}
+
+// fillNonZero recursively populates v with non-zero values so that every
+// serializable field is observable in a round-trip. It skips ForceSendFields
+// (json:"-") and bounds recursion depth to avoid runaway on self-referential
+// SDK types; bounding is safe because the fields at risk (a wrapper's own
+// fields alongside an embedded SDK type) sit at the top level.
+func fillNonZero(v reflect.Value, depth int) {
+	if depth > 6 {
+		return
+	}
+	switch v.Kind() {
+	case reflect.Bool:
+		v.SetBool(true)
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		v.SetInt(1)
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+		v.SetUint(1)
+	case reflect.Float32, reflect.Float64:
+		v.SetFloat(1)
+	case reflect.String:
+		v.SetString("x")
+	case reflect.Pointer:
+		v.Set(reflect.New(v.Type().Elem()))
+		fillNonZero(v.Elem(), depth+1)
+	case reflect.Slice:
+		elem := reflect.New(v.Type().Elem()).Elem()
+		fillNonZero(elem, depth+1)
+		v.Set(reflect.Append(v, elem))
+	case reflect.Map:
+		v.Set(reflect.MakeMap(v.Type()))
+		val := reflect.New(v.Type().Elem()).Elem()
+		fillNonZero(val, depth+1)
+		v.SetMapIndex(reflect.ValueOf("k").Convert(v.Type().Key()), val)
+	case reflect.Interface:
+		// Free-form any fields decode to map[string]any from JSON.
+		v.Set(reflect.ValueOf(map[string]any{"k": "v"}))
+	case reflect.Struct:
+		t := v.Type()
+		for i := range t.NumField() {
+			sf := t.Field(i)
+			if !sf.IsExported() || sf.Name == "ForceSendFields" {
+				continue
+			}
+			if structtag.JSONTag(sf.Tag.Get("json")).Name() == "-" {
+				continue
+			}
+			fillNonZero(v.Field(i), depth+1)
+		}
+	default:
+		// Kinds that don't appear in SDK state/remote types (chan, func,
+		// complex, array, etc.) are left at their zero value.
+	}
+}
+
+// TestForceSendZeroValues verifies that every InputConfigType/StateType/RemoteType
+// honors the SDK ForceSendFields convention: a zero-valued scalar field whose name is
+// in ForceSendFields must still be serialized.
+//
+// The round-trip tests above fill every field non-zero and leave ForceSendFields
+// empty, so they cover the "populated field silently dropped" failure mode but never
+// the opposite one: a force-sent zero value that is omitted because the type marshals
+// via plain encoding/json (which knows nothing about ForceSendFields) rather than the
+// SDK marshaler. That path is the entire reason ForceSendFields and the wrapper
+// marshalers exist, so it is the one worth pinning.
+func TestForceSendZeroValues(t *testing.T) {
+	for _, dim := range []struct {
+		label  string
+		typeOf func(*Adapter) reflect.Type
+	}{
+		{"InputConfigType", (*Adapter).InputConfigType},
+		{"StateType", (*Adapter).StateType},
+		{"RemoteType", (*Adapter).RemoteType},
+	} {
+		for resourceType, resource := range SupportedResources {
+			adapter, err := NewAdapter(resource, resourceType, nil)
+			require.NoError(t, err)
+			t.Run(dim.label+"/"+resourceType, func(t *testing.T) {
+				assertForceSendHonored(t, dim.typeOf(adapter))
+			})
+		}
+	}
+}
+
+// assertForceSendHonored builds a zero value of typ (a pointer to struct), tells the
+// struct that owns ForceSendFields to force-send each of its own scalar omitempty
+// fields, marshals, and asserts each such field survives into the JSON. ForceSendFields
+// governs the fields declared alongside it (embedded structs carry their own), so the
+// forced fields and the ForceSendFields must come from the same struct.
+func assertForceSendHonored(t *testing.T, typ reflect.Type) {
+	t.Helper()
+
+	sf, ok := typ.Elem().FieldByName("ForceSendFields")
+	if !ok || sf.Type != reflect.TypeFor[[]string]() {
+		t.Skip("no ForceSendFields")
+	}
+
+	ptr := reflect.New(typ.Elem())
+	owner := fieldByIndexAlloc(ptr.Elem(), sf.Index[:len(sf.Index)-1])
+
+	var goNames, jsonNames []string
+	for field := range owner.Type().Fields() {
+		if !field.IsExported() || field.Anonymous || !isBasicKind(field.Type.Kind()) {
+			continue
+		}
+		tag := structtag.JSONTag(field.Tag.Get("json"))
+		if name := tag.Name(); name != "" && name != "-" && strings.Contains(field.Tag.Get("json"), "omitempty") {
+			goNames = append(goNames, field.Name)
+			jsonNames = append(jsonNames, name)
+		}
+	}
+	if len(goNames) == 0 {
+		t.Skip("no force-sendable scalar fields")
+	}
+
+	owner.Field(sf.Index[len(sf.Index)-1]).Set(reflect.ValueOf(goNames))
+
+	data, err := json.Marshal(ptr.Interface())
+	require.NoError(t, err)
+
+	// The ForceSendFields owner is the top-level struct or an embed, so its fields
+	// serialize at the document root; a top-level key check is enough.
+	var top map[string]json.RawMessage
+	require.NoError(t, json.Unmarshal(data, &top))
+	for _, name := range jsonNames {
+		assert.Contains(t, top, name,
+			"field %q is force-sent (zero value) but was dropped from the JSON: the type marshals via plain encoding/json instead of a ForceSendFields-aware marshaler", name)
+	}
+}
+
+func isBasicKind(k reflect.Kind) bool {
+	switch k {
+	case reflect.Bool, reflect.String,
+		reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64,
+		reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64,
+		reflect.Float32, reflect.Float64:
+		return true
+	default:
+		return false
+	}
+}
+
+// fieldByIndexAlloc walks index from v, allocating a nil pointer before descending
+// through it, so a field reached through an unset pointer is still addressable.
+func fieldByIndexAlloc(v reflect.Value, index []int) reflect.Value {
+	for _, i := range index {
+		if v.Kind() == reflect.Pointer {
+			if v.IsNil() {
+				v.Set(reflect.New(v.Type().Elem()))
+			}
+			v = v.Elem()
+		}
+		v = v.Field(i)
+	}
+	return v
+}
diff --git a/bundle/direct/dresources/snapshot.go b/bundle/direct/dresources/snapshot.go
new file mode 100644
index 00000000000..5c59e5110c8
--- /dev/null
+++ b/bundle/direct/dresources/snapshot.go
@@ -0,0 +1,112 @@
+package dresources
+
+import (
+	"context"
+	"fmt"
+	"os"
+
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/cli/libs/snapshot"
+	"github.com/databricks/databricks-sdk-go"
+)
+
+type ResourceSnapshot struct {
+	uploader *snapshot.SnapshotClient
+}
+
+type SnapshotState struct {
+	// RelativePath is the relative path (without the snapshot root provided by backend) to the snapshot in the workspace.
+	// RelativePath is client defined and normally contains the content hash of the snapshot.
+	RelativePath string `json:"relative_path"`
+	// FullPath is the absolute path to the snapshot in the workspace.
+	// It contains the root path provided by the backend and the relative path.
+	FullPath string              `json:"full_path"`
+	BundleID string              `json:"bundle_id"`
+	ACL      []snapshot.ACLEntry `json:"acl"`
+	// ZipPath locates the bundle zip staged locally by the deploy pipeline. It is
+	// small enough to round-trip through the plan file, so deploying from a plan
+	// restores it directly (no re-injection needed). The file name is the content
+	// hash, which is also the last component of RelativePath.
+	ZipPath string `json:"zip_path"`
+}
+
+type SnapshotRemote struct {
+	RelativePath string `json:"relative_path"`
+	FullPath     string `json:"full_path"`
+}
+
+func (s *ResourceSnapshot) New(client *databricks.WorkspaceClient) *ResourceSnapshot {
+	// Return a zero-value instance when client is nil (e.g. refschema introspection).
+	if client == nil {
+		return &ResourceSnapshot{
+			uploader: nil,
+		}
+	}
+
+	uploader, err := snapshot.NewSnapshotClient(client)
+	if err != nil {
+		panic(err)
+	}
+
+	return &ResourceSnapshot{
+		uploader: uploader,
+	}
+}
+
+func (s *ResourceSnapshot) PrepareState(input *resources.Snapshot) *SnapshotState {
+	return &SnapshotState{
+		RelativePath: input.RelativePath(),
+		FullPath:     input.FullPath(),
+		BundleID:     input.BundleID,
+		ACL:          input.ACL,
+		ZipPath:      input.ZipPath,
+	}
+}
+
+func (s *ResourceSnapshot) RemapState(remote *SnapshotRemote) *SnapshotState {
+	return &SnapshotState{
+		RelativePath: remote.RelativePath,
+		FullPath:     remote.FullPath,
+		BundleID:     "",
+		ACL:          nil,
+		ZipPath:      "",
+	}
+}
+
+func (s *ResourceSnapshot) DoRead(ctx context.Context, id string) (*SnapshotRemote, error) {
+	info, err := s.uploader.Get(ctx, id)
+	if err != nil {
+		return nil, err
+	}
+	return &SnapshotRemote{
+		RelativePath: id,
+		FullPath:     info.Path,
+	}, nil
+}
+
+func (s *ResourceSnapshot) DoCreate(ctx context.Context, state *SnapshotState) (string, *SnapshotRemote, error) {
+	content, err := os.ReadFile(state.ZipPath)
+	if err != nil {
+		return "", nil, fmt.Errorf("reading snapshot zip: %w", err)
+	}
+
+	path := state.RelativePath
+	info, err := s.uploader.Upload(ctx, path, state.BundleID, state.ACL, content)
+	if err != nil {
+		return "", nil, err
+	}
+	return path, &SnapshotRemote{RelativePath: path, FullPath: info.Path}, nil
+}
+
+// DoDelete is a no-op: a snapshot is immutable and cannot be deleted, so this only
+// clears the state entry. DoUpdate is omitted entirely (the adapter treats it as
+// optional) because every change recreates the snapshot. IsGone below keeps
+// delete/destroy idempotent.
+func (s *ResourceSnapshot) DoDelete(ctx context.Context, id string, state *SnapshotState) error {
+	return nil
+}
+
+// IsGone treats a snapshot as already-deleted. The snapshot is immutable, so it can't be deleted.
+func (s *ResourceSnapshot) IsGone(remote *SnapshotRemote) bool {
+	return true
+}
diff --git a/bundle/direct/dresources/sql_warehouse.go b/bundle/direct/dresources/sql_warehouse.go
index 2e8caa4a4a2..7d4578dd6f2 100644
--- a/bundle/direct/dresources/sql_warehouse.go
+++ b/bundle/direct/dresources/sql_warehouse.go
@@ -2,14 +2,51 @@ package dresources
 
 import (
 	"context"
+	"time"
 
 	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/cli/libs/log"
 	"github.com/databricks/cli/libs/utils"
 	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/marshal"
 	"github.com/databricks/databricks-sdk-go/service/sql"
 )
 
+// SqlWarehouseState is the state type for SqlWarehouse resources. It extends sql.CreateWarehouseRequest
+// with lifecycle settings.
+type SqlWarehouseState struct {
+	sql.CreateWarehouseRequest
+
+	Lifecycle *StateLifecycle `json:"lifecycle,omitempty"`
+}
+
+// Custom marshalers needed because embedded sql.CreateWarehouseRequest has its own MarshalJSON
+// which would otherwise take over and ignore the additional fields.
+func (s *SqlWarehouseState) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, s)
+}
+
+func (s SqlWarehouseState) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(s)
+}
+
+// SqlWarehouseRemote extends sql.GetWarehouseResponse with a synthetic Lifecycle field so that
+// RemoteType satisfies TestRemoteSuperset (every field in SqlWarehouseState exists in SqlWarehouseRemote).
+// Lifecycle.Started is populated by DoRead from the warehouse's running state.
+type SqlWarehouseRemote struct {
+	sql.GetWarehouseResponse
+
+	Lifecycle *StateLifecycle `json:"lifecycle,omitempty"`
+}
+
+func (r *SqlWarehouseRemote) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, r)
+}
+
+func (r SqlWarehouseRemote) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(r)
+}
+
 type ResourceSqlWarehouse struct {
 	client *databricks.WorkspaceClient
 }
@@ -20,12 +57,21 @@ func (*ResourceSqlWarehouse) New(client *databricks.WorkspaceClient) *ResourceSq
 }
 
 // PrepareState converts bundle config to the SDK type.
-func (*ResourceSqlWarehouse) PrepareState(input *resources.SqlWarehouse) *sql.CreateWarehouseRequest {
-	return &input.CreateWarehouseRequest
+func (*ResourceSqlWarehouse) PrepareState(input *resources.SqlWarehouse) *SqlWarehouseState {
+	s := &SqlWarehouseState{
+		CreateWarehouseRequest: input.CreateWarehouseRequest,
+		Lifecycle:              nil,
+	}
+	if input.Lifecycle != nil && input.Lifecycle.Started != nil {
+		s.Lifecycle = &StateLifecycle{Started: input.Lifecycle.Started}
+	}
+	return s
 }
 
-func (*ResourceSqlWarehouse) RemapState(warehouse *sql.GetWarehouseResponse) *sql.CreateWarehouseRequest {
-	return &sql.CreateWarehouseRequest{
+// RemapState maps the remote SqlWarehouseRemote to SqlWarehouseState for diff comparison.
+// Started is derived from warehouse state so the planner can detect start/stop changes.
+func (*ResourceSqlWarehouse) RemapState(warehouse *SqlWarehouseRemote) *SqlWarehouseState {
+	return &SqlWarehouseState{
 		AutoStopMins:            warehouse.AutoStopMins,
 		Channel:                 warehouse.Channel,
 		ClusterSize:             warehouse.ClusterSize,
@@ -37,58 +83,164 @@ func (*ResourceSqlWarehouse) RemapState(warehouse *sql.GetWarehouseResponse) *sq
 		MinNumClusters:          warehouse.MinNumClusters,
 		Name:                    warehouse.Name,
 		SpotInstancePolicy:      warehouse.SpotInstancePolicy,
+		StatementTimeout:        warehouse.StatementTimeout,
 		Tags:                    warehouse.Tags,
 		WarehouseType:           sql.CreateWarehouseRequestWarehouseType(warehouse.WarehouseType),
 		ForceSendFields:         utils.FilterFields[sql.CreateWarehouseRequest](warehouse.ForceSendFields),
+		Lifecycle:               warehouse.Lifecycle,
 	}
 }
 
 // DoRead reads the warehouse by id.
-func (r *ResourceSqlWarehouse) DoRead(ctx context.Context, id string) (*sql.GetWarehouseResponse, error) {
-	return r.client.Warehouses.GetById(ctx, id)
+func (r *ResourceSqlWarehouse) DoRead(ctx context.Context, id string) (*SqlWarehouseRemote, error) {
+	warehouse, err := r.client.Warehouses.GetById(ctx, id)
+	if err != nil {
+		return nil, err
+	}
+	remote := &SqlWarehouseRemote{
+		GetWarehouseResponse: *warehouse,
+		Lifecycle:            nil,
+	}
+
+	switch warehouse.State {
+	case sql.StateRunning:
+		started := true
+		remote.Lifecycle = &StateLifecycle{Started: &started}
+	case sql.StateStopped:
+		started := false
+		remote.Lifecycle = &StateLifecycle{Started: &started}
+	default:
+		remote.Lifecycle = nil
+	}
+	return remote, nil
 }
 
 // DoCreate creates the warehouse and returns its id.
-func (r *ResourceSqlWarehouse) DoCreate(ctx context.Context, config *sql.CreateWarehouseRequest) (string, *sql.GetWarehouseResponse, error) {
-	waiter, err := r.client.Warehouses.Create(ctx, *config)
+func (r *ResourceSqlWarehouse) DoCreate(ctx context.Context, config *SqlWarehouseState) (string, *SqlWarehouseRemote, error) {
+	waiter, err := r.client.Warehouses.Create(ctx, config.CreateWarehouseRequest)
 	if err != nil {
 		return "", nil, err
 	}
 	return waiter.Id, nil, nil
 }
 
+// hasWarehouseChanges reports whether the plan entry contains any Update changes
+// to fields that belong to the Warehouse Edit API (i.e., not lifecycle-only fields).
+func hasWarehouseChanges(entry *PlanEntry) bool {
+	return entry.Changes.HasChangeExcept("lifecycle", "lifecycle.started")
+}
+
 // DoUpdate updates the warehouse in place.
-func (r *ResourceSqlWarehouse) DoUpdate(ctx context.Context, id string, config *sql.CreateWarehouseRequest, _ *PlanEntry) (*sql.GetWarehouseResponse, error) {
-	request := sql.EditWarehouseRequest{
-		AutoStopMins:            config.AutoStopMins,
-		Channel:                 config.Channel,
-		ClusterSize:             config.ClusterSize,
-		CreatorName:             config.CreatorName,
-		EnablePhoton:            config.EnablePhoton,
-		EnableServerlessCompute: config.EnableServerlessCompute,
-		Id:                      id,
-		InstanceProfileArn:      config.InstanceProfileArn,
-		MaxNumClusters:          config.MaxNumClusters,
-		MinNumClusters:          config.MinNumClusters,
-		Name:                    config.Name,
-		SpotInstancePolicy:      config.SpotInstancePolicy,
-		Tags:                    config.Tags,
-		WarehouseType:           sql.EditWarehouseRequestWarehouseType(config.WarehouseType),
-		ForceSendFields:         utils.FilterFields[sql.EditWarehouseRequest](config.ForceSendFields),
-	}
-
-	waiter, err := r.client.Warehouses.Edit(ctx, request)
+func (r *ResourceSqlWarehouse) DoUpdate(ctx context.Context, id string, config *SqlWarehouseState, entry *PlanEntry) (*SqlWarehouseRemote, error) {
+	edited := hasWarehouseChanges(entry)
+	if edited {
+		request := sql.EditWarehouseRequest{
+			AutoStopMins:            config.AutoStopMins,
+			Channel:                 config.Channel,
+			ClusterSize:             config.ClusterSize,
+			CreatorName:             config.CreatorName,
+			EnablePhoton:            config.EnablePhoton,
+			EnableServerlessCompute: config.EnableServerlessCompute,
+			Id:                      id,
+			InstanceProfileArn:      config.InstanceProfileArn,
+			MaxNumClusters:          config.MaxNumClusters,
+			MinNumClusters:          config.MinNumClusters,
+			Name:                    config.Name,
+			SpotInstancePolicy:      config.SpotInstancePolicy,
+			StatementTimeout:        config.StatementTimeout,
+			Tags:                    config.Tags,
+			WarehouseType:           sql.EditWarehouseRequestWarehouseType(config.WarehouseType),
+			ForceSendFields:         utils.FilterFields[sql.EditWarehouseRequest](config.ForceSendFields),
+		}
+
+		waiter, err := r.client.Warehouses.Edit(ctx, request)
+		if err != nil {
+			return nil, err
+		}
+
+		if waiter.Id != id {
+			log.Warnf(ctx, "sql_warehouses: response contains unexpected id=%#v (expected %#v)", waiter.Id, id)
+		}
+	}
+
+	if config.Lifecycle == nil || config.Lifecycle.Started == nil {
+		return nil, nil
+	}
+
+	desiredStarted := *config.Lifecycle.Started
+	alreadyRunning := remoteWarehouseIsRunning(entry)
+	if edited {
+		// Edit restarts the warehouse: its long-running op waits for RUNNING
+		// (SDK WaitGetWarehouseRunning), so reconcile from RUNNING, not the
+		// stale pre-plan state.
+		alreadyRunning = true
+	}
+	if desiredStarted && !alreadyRunning {
+		// lifecycle.started=true: fire Start; WaitAfterUpdate polls for RUNNING.
+		_, err := r.client.Warehouses.Start(ctx, sql.StartRequest{Id: id})
+		return nil, err
+	} else if !desiredStarted && alreadyRunning {
+		// lifecycle.started=false: fire Stop; WaitAfterUpdate polls for STOPPED.
+		_, err := r.client.Warehouses.Stop(ctx, sql.StopRequest{Id: id})
+		return nil, err
+	}
+
+	return nil, nil
+}
+
+// WaitAfterUpdate waits for the warehouse to reach the desired lifecycle state after DoUpdate.
+func (r *ResourceSqlWarehouse) WaitAfterUpdate(ctx context.Context, id string, config *SqlWarehouseState) (*SqlWarehouseRemote, error) {
+	if config.Lifecycle == nil || config.Lifecycle.Started == nil {
+		return nil, nil
+	}
+
+	if *config.Lifecycle.Started {
+		_, err := r.client.Warehouses.WaitGetWarehouseRunning(ctx, id, 20*time.Minute, nil)
+		return nil, err
+	}
+
+	_, err := r.client.Warehouses.WaitGetWarehouseStopped(ctx, id, 20*time.Minute, nil)
+	return nil, err
+}
+
+// WaitAfterCreate waits for the warehouse to be ready, then stops it if lifecycle.started=false.
+// Warehouses are created in a starting state; WaitGetWarehouseRunning waits for them to be RUNNING.
+func (r *ResourceSqlWarehouse) WaitAfterCreate(ctx context.Context, id string, config *SqlWarehouseState) (*SqlWarehouseRemote, error) {
+	if config.Lifecycle == nil || config.Lifecycle.Started == nil {
+		return nil, nil
+	}
+
+	// Always wait for RUNNING first: warehouses start asynchronously.
+	_, err := r.client.Warehouses.WaitGetWarehouseRunning(ctx, id, 20*time.Minute, nil)
 	if err != nil {
 		return nil, err
 	}
 
-	if waiter.Id != id {
-		log.Warnf(ctx, "sql_warehouses: response contains unexpected id=%#v (expected %#v)", waiter.Id, id)
+	if !*config.Lifecycle.Started {
+		// started=false: stop the warehouse after it reaches RUNNING.
+		stopWaiter, err := r.client.Warehouses.Stop(ctx, sql.StopRequest{Id: id})
+		if err != nil {
+			return nil, err
+		}
+		_, err = stopWaiter.Get()
+		return nil, err
 	}
 
 	return nil, nil
 }
 
-func (r *ResourceSqlWarehouse) DoDelete(ctx context.Context, oldID string) error {
+func (r *ResourceSqlWarehouse) DoDelete(ctx context.Context, oldID string, _ *SqlWarehouseState) error {
 	return r.client.Warehouses.DeleteById(ctx, oldID)
 }
+
+// remoteWarehouseIsRunning reads the warehouse running state from the plan entry's remote state.
+func remoteWarehouseIsRunning(entry *PlanEntry) bool {
+	if entry.RemoteState == nil {
+		return false
+	}
+	remote, ok := entry.RemoteState.(*SqlWarehouseRemote)
+	if !ok {
+		return false
+	}
+	return remote.State == sql.StateRunning
+}
diff --git a/bundle/direct/dresources/state_compaction.go b/bundle/direct/dresources/state_compaction.go
new file mode 100644
index 00000000000..130be77678b
--- /dev/null
+++ b/bundle/direct/dresources/state_compaction.go
@@ -0,0 +1,110 @@
+package dresources
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"reflect"
+	"regexp"
+
+	"github.com/databricks/cli/libs/structs/structaccess"
+	"github.com/databricks/cli/libs/structs/structpath"
+)
+
+// stateHashPrefix marks a state value that holds a content hash instead of the
+// raw value. Since this is part of the on-disk state format, changing it is not
+// backwards compatible.
+const stateHashPrefix = "sha256:"
+
+// stateHashPlaceholderLen is the exact size of a placeholder: the prefix followed by a
+// SHA-256 digest in hex (sha256.Size bytes, two characters each).
+const stateHashPlaceholderLen = len(stateHashPrefix) + sha256.Size*2
+
+// stateHashPlaceholderRe matches exactly the placeholders this package produces (the prefix
+// followed by a lowercase-hex SHA-256 digest), so content that merely shares the prefix is
+// not mistaken for an already-hashed value.
+var stateHashPlaceholderRe = regexp.MustCompile(fmt.Sprintf("^%s[a-f0-9]{%d}$", regexp.QuoteMeta(stateHashPrefix), sha256.Size*2))
+
+// isStateHashPlaceholder reports whether s is a placeholder this package produced.
+func isStateHashPlaceholder(s string) bool {
+	return stateHashPlaceholderRe.MatchString(s)
+}
+
+// hashStateValue returns a content-hash placeholder ("sha256:<hex>") for s, used to store
+// large, equality-only string fields (e.g. a dashboard's serialized_dashboard) compactly in
+// state instead of their full contents. hashed_fields values are serialized to a string
+// before the deploy engine runs, so this operates on a plain string.
+//
+// It is idempotent and stable: an empty string, a value already a placeholder, and a value
+// no larger than a placeholder are returned unchanged.
+func hashStateValue(s string) string {
+	if s == "" || isStateHashPlaceholder(s) || len(s) <= stateHashPlaceholderLen {
+		return s
+	}
+	sum := sha256.Sum256([]byte(s))
+	return stateHashPrefix + hex.EncodeToString(sum[:])
+}
+
+// CompactState returns a copy of state with every field declared in cfg.HashedFields
+// replaced by a content hash, so the state persists only the hash and not the full
+// contents. A field whose contents are already no larger than a placeholder is left as
+// is (see hashStateValue). It is applied both before persisting state and to every value
+// entering the state diff, so stored and compared values share one form. The caller's
+// value is never mutated (it is reused for the deploy API call, which needs the full
+// contents).
+//
+// Returns state unchanged when no fields are declared or state is not a non-nil pointer.
+func CompactState(cfg *ResourceLifecycleConfig, state any) (any, error) {
+	if cfg == nil || len(cfg.HashedFields) == 0 {
+		return state, nil
+	}
+
+	rv := reflect.ValueOf(state)
+	if rv.Kind() != reflect.Pointer || rv.IsNil() {
+		return state, nil
+	}
+
+	// Shallow copy so the caller's value (reused for the deploy) is untouched. This is
+	// safe only because every hashed_fields field is a top-level field (e.g.
+	// serialized_dashboard): SetByString overwrites it on the copy directly. A field
+	// reached through a shared pointer/slice/map would need a deep copy here.
+	out := reflect.New(rv.Type().Elem())
+	out.Elem().Set(rv.Elem())
+	compacted := out.Interface()
+
+	for _, field := range cfg.HashedFields {
+		// The shallow copy above only isolates top-level fields: SetByString on a
+		// depth-1 path reassigns the field on the copy, but a nested path (e.g.
+		// "foo.bar") is reached through a pointer/slice/map still shared with the
+		// caller's value, so hashing it would mutate the value reused for the deploy
+		// API call. Reject nested paths loudly instead of corrupting state silently.
+		path, err := structpath.ParsePath(field)
+		if err != nil {
+			return nil, fmt.Errorf("compacting state field %q: %w", field, err)
+		}
+		if path.Len() != 1 {
+			return nil, fmt.Errorf("hashed_fields field %q must be a top-level field", field)
+		}
+
+		current, err := structaccess.GetByString(compacted, field)
+		if err != nil {
+			return nil, fmt.Errorf("compacting state field %q: %w", field, err)
+		}
+		if current == nil {
+			// Field is unset; nothing to hash.
+			continue
+		}
+		s, ok := current.(string)
+		if !ok {
+			// hashed_fields values are serialized to a string before the deploy engine
+			// runs (e.g. ConfigureDashboardSerializedDashboard), so a non-string here is a
+			// broken invariant / programming error, not a user error — fail loudly.
+			panic(fmt.Sprintf("hashed_fields field %q must be a string, got %T", field, current))
+		}
+		if err := structaccess.SetByString(compacted, field, hashStateValue(s)); err != nil {
+			return nil, fmt.Errorf("compacting state field %q: %w", field, err)
+		}
+	}
+
+	return compacted, nil
+}
diff --git a/bundle/direct/dresources/state_compaction_test.go b/bundle/direct/dresources/state_compaction_test.go
new file mode 100644
index 00000000000..c39598d4601
--- /dev/null
+++ b/bundle/direct/dresources/state_compaction_test.go
@@ -0,0 +1,250 @@
+package dresources
+
+import (
+	"crypto/sha256"
+	"strings"
+	"testing"
+
+	"github.com/databricks/cli/libs/structs/structaccess"
+	"github.com/databricks/cli/libs/structs/structpath"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	// largeDashboard is a serialized_dashboard longer than stateHashPlaceholderLen, so it is
+	// actually compacted.
+	largeDashboard = `{"pages":[{"name":"p1","displayName":"Page One","layout":[{"widget":{"name":"w1"}}]}]}`
+
+	// smallDashboard is a serialized_dashboard no longer than stateHashPlaceholderLen, so
+	// hashing it would grow the state and it is persisted raw.
+	smallDashboard = `{"pages":[{"name":"p1"}]}`
+)
+
+// requireLargeEnoughToHash asserts a fixture is on the hashed side of the size threshold.
+// Whether a value is hashed depends on its length, so shrinking a fixture would silently
+// leave it raw and make the tests below assert the opposite of what they were written for.
+func requireLargeEnoughToHash(t *testing.T, content string) {
+	t.Helper()
+	require.Greater(t, len(content), stateHashPlaceholderLen,
+		"fixture must be more than %d bytes to be hashed; enlarge it", stateHashPlaceholderLen)
+}
+
+// requireTooSmallToHash is the inverse of requireLargeEnoughToHash: it asserts a fixture
+// stays on the raw side of the threshold, so enlarging it cannot silently turn a
+// persisted-raw test into a hashing test that passes for the wrong reason.
+func requireTooSmallToHash(t *testing.T, content string) {
+	t.Helper()
+	require.LessOrEqual(t, len(content), stateHashPlaceholderLen,
+		"fixture must be at most %d bytes to be persisted raw; shrink it", stateHashPlaceholderLen)
+}
+
+// TestHashedFieldsAreValid checks every hashed_fields path in the resource configs is a top-level
+// field (CompactState's shallow copy only isolates those) and a real field on the state type
+// (a typo parses fine but resolves to nothing, so CompactState silently skips it).
+func TestHashedFieldsAreValid(t *testing.T) {
+	for name, rc := range MustLoadConfig().Resources {
+		if len(rc.HashedFields) == 0 {
+			continue
+		}
+		adapter, err := NewAdapter(SupportedResources[name], name, nil)
+		require.NoError(t, err, "%s: failed to create adapter", name)
+		for _, field := range rc.HashedFields {
+			path, err := structpath.ParsePath(field)
+			require.NoError(t, err, "%s: hashed_fields field %q", name, field)
+			assert.Equal(t, 1, path.Len(), "%s: hashed_fields field %q must be a top-level field", name, field)
+			assert.NoError(t, structaccess.ValidatePath(adapter.StateType(), path),
+				"%s: hashed_fields field %q must be an actual field on the state type", name, field)
+		}
+	}
+}
+
+// TestCompactStateRejectsNestedField verifies CompactState errors on a nested
+// hashed_fields path rather than mutating memory shared with the deploy value.
+func TestCompactStateRejectsNestedField(t *testing.T) {
+	cfg := &ResourceLifecycleConfig{HashedFields: []string{"foo.bar"}}
+	state := &DashboardState{SerializedDashboard: `{"a":1}`}
+
+	_, err := CompactState(cfg, state)
+	require.ErrorContains(t, err, "must be a top-level field")
+}
+
+// TestCompactStateRejectsNonStringField verifies CompactState panics when a hashed_fields
+// value is not a string. hashed_fields values are serialized to a string before the deploy
+// engine runs, so a non-string here is a broken invariant, not a user error.
+func TestCompactStateRejectsNonStringField(t *testing.T) {
+	state := &DashboardState{
+		SerializedDashboard: map[string]any{"pages": []any{}},
+	}
+
+	assert.Panics(t, func() {
+		_, _ = CompactState(GetResourceConfig("dashboards"), state)
+	})
+}
+
+// TestCompactStateSkipsNilField verifies an unset hashed_fields value passes through
+// untouched, since there is nothing to hash.
+func TestCompactStateSkipsNilField(t *testing.T) {
+	state := &DashboardState{SerializedDashboard: nil}
+
+	out, err := CompactState(GetResourceConfig("dashboards"), state)
+	require.NoError(t, err)
+	assert.Nil(t, out.(*DashboardState).SerializedDashboard)
+}
+
+// TestCompactStateNoDeclaredFields verifies CompactState is a no-op for a resource
+// type with no hashed_fields declaration and for a nil config, returning the same
+// value untouched.
+func TestCompactStateNoDeclaredFields(t *testing.T) {
+	state := &DashboardState{SerializedDashboard: `{"a":1}`}
+
+	out, err := CompactState(GetResourceConfig("jobs"), state)
+	require.NoError(t, err)
+	assert.Same(t, state, out.(*DashboardState))
+
+	out, err = CompactState(nil, state)
+	require.NoError(t, err)
+	assert.Same(t, state, out.(*DashboardState))
+}
+
+// TestCompactStateMigratesLegacyFullContent verifies that a legacy state holding the
+// full serialized_dashboard and a config holding identical content compact to the
+// same hash, so a diff computed after hashing-on-read shows no spurious change and
+// the next save rewrites the state compactly.
+func TestCompactStateMigratesLegacyFullContent(t *testing.T) {
+	requireLargeEnoughToHash(t, largeDashboard)
+
+	legacy := &DashboardState{SerializedDashboard: largeDashboard}
+	config := &DashboardState{SerializedDashboard: largeDashboard}
+
+	cfg := GetResourceConfig("dashboards")
+	compactedLegacy, err := CompactState(cfg, legacy)
+	require.NoError(t, err)
+	compactedConfig, err := CompactState(cfg, config)
+	require.NoError(t, err)
+
+	legacyHash := compactedLegacy.(*DashboardState).SerializedDashboard
+	assert.Equal(t, compactedConfig.(*DashboardState).SerializedDashboard, legacyHash)
+	assert.True(t, strings.HasPrefix(legacyHash.(string), stateHashPrefix))
+}
+
+// TestStateHashing verifies, per fixture, that hashStateValue maps content to the exact
+// expected value (a hardcoded sha256:<hex> placeholder when hashing pays off, the content
+// itself otherwise), that isStateHashPlaceholder recognizes only the strings this package
+// produces, and that CompactState of a dashboard's serialized_dashboard yields the same.
+func TestStateHashing(t *testing.T) {
+	requireTooSmallToHash(t, smallDashboard)
+
+	// A raw string of exactly stateHashPlaceholderLen bytes sits at the limit; one more tips
+	// it over. hex64 is a valid digest body; placeholder is a full, valid placeholder.
+	atLimit := strings.Repeat("x", stateHashPlaceholderLen)
+	hex64 := strings.Repeat("a", sha256.Size*2)
+	placeholder := stateHashPrefix + hex64
+
+	cases := []struct {
+		name          string
+		content       string
+		want          string
+		isPlaceholder bool
+	}{
+		{
+			name: "multiline",
+			content: `
+{
+  "datasets": [
+    {
+      "name": "sales",
+      "displayName": "Sales",
+      "query": "SELECT region, SUM(amount) AS total FROM sales GROUP BY region"
+    }
+  ],
+  "pages": [
+    {
+      "name": "overview",
+      "displayName": "Sales Overview",
+      "layout": [
+        {
+          "widget": {
+            "name": "by_region",
+            "queries": [{"name": "main", "query": {"datasetName": "sales"}}],
+            "spec": {"version": 3, "widgetType": "bar"}
+          },
+          "position": {"x": 0, "y": 0, "width": 6, "height": 6}
+        }
+      ]
+    }
+  ]
+}
+`,
+			want: "sha256:4c937eec7bb545672fca3b17176fcbb70046bc20ad8e7a1e1cf819cb8ea373f1",
+		},
+		{
+			name:    "over_size_limit",
+			content: atLimit + "x",
+			want:    "sha256:5bd2fd7019be4014a135cbc4fc4aecc894861782ec797467a7cd0909e98f76f2",
+		},
+		{
+			// Shares the prefix but is one byte too long to be a placeholder, so it hashes.
+			name:    "too_long",
+			content: stateHashPrefix + strings.Repeat("a", 65),
+			want:    "sha256:ee9921c0587e224847f0833ce1ef61f0d92295bc283a268caff458cf98e87cf3",
+		},
+		{
+			name:          "valid_placeholder",
+			content:       placeholder,
+			want:          placeholder,
+			isPlaceholder: true,
+		},
+		{
+			name:    "empty",
+			content: "",
+			want:    "",
+		},
+		{
+			name:    "small_stays_raw",
+			content: smallDashboard,
+			want:    smallDashboard,
+		},
+		{
+			name:    "at_size_limit",
+			content: atLimit,
+			want:    atLimit,
+		},
+		{
+			name:    "too_short",
+			content: stateHashPrefix + strings.Repeat("a", 63),
+			want:    stateHashPrefix + strings.Repeat("a", 63),
+		},
+		{
+			name:    "uppercase",
+			content: stateHashPrefix + strings.Repeat("A", 64),
+			want:    stateHashPrefix + strings.Repeat("A", 64),
+		},
+		{
+			name:    "no_prefix",
+			content: hex64,
+			want:    hex64,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := hashStateValue(tc.content)
+			assert.Equal(t, tc.want, got)
+			assert.Equal(t, tc.isPlaceholder, isStateHashPlaceholder(tc.content))
+			// Idempotent: re-hashing the output is a no-op, so re-compacting never double-hashes.
+			assert.Equal(t, tc.want, hashStateValue(got))
+			if got != tc.content {
+				// Hashing only ever happens when it shrinks the value.
+				assert.Less(t, len(got), len(tc.content))
+			}
+
+			// CompactState delegates to hashStateValue, so a dashboard's serialized_dashboard
+			// compacts to the same value.
+			state := &DashboardState{SerializedDashboard: tc.content}
+			out, err := CompactState(GetResourceConfig("dashboards"), state)
+			require.NoError(t, err)
+			assert.Equal(t, tc.want, out.(*DashboardState).SerializedDashboard)
+		})
+	}
+}
diff --git a/bundle/direct/dresources/synced_database_table.go b/bundle/direct/dresources/synced_database_table.go
index 94182b729f3..e1c0df12f00 100644
--- a/bundle/direct/dresources/synced_database_table.go
+++ b/bundle/direct/dresources/synced_database_table.go
@@ -34,18 +34,7 @@ func (r *ResourceSyncedDatabaseTable) DoCreate(ctx context.Context, config *data
 	return result.Name, nil, nil
 }
 
-func (r *ResourceSyncedDatabaseTable) DoUpdate(ctx context.Context, id string, config *database.SyncedDatabaseTable, _ *PlanEntry) (*database.SyncedDatabaseTable, error) {
-	request := database.UpdateSyncedDatabaseTableRequest{
-		SyncedTable: *config,
-		Name:        id,
-		UpdateMask:  "*",
-	}
-
-	_, err := r.client.Database.UpdateSyncedDatabaseTable(ctx, request)
-	return nil, err
-}
-
-func (r *ResourceSyncedDatabaseTable) DoDelete(ctx context.Context, id string) error {
+func (r *ResourceSyncedDatabaseTable) DoDelete(ctx context.Context, id string, _ *database.SyncedDatabaseTable) error {
 	return r.client.Database.DeleteSyncedDatabaseTable(ctx, database.DeleteSyncedDatabaseTableRequest{
 		Name:            id,
 		PurgeData:       false,
diff --git a/bundle/direct/dresources/type_test.go b/bundle/direct/dresources/type_test.go
index 8e711c9bf03..bc12c994621 100644
--- a/bundle/direct/dresources/type_test.go
+++ b/bundle/direct/dresources/type_test.go
@@ -16,69 +16,52 @@ import (
 // These are known issues that should be fixed. If a field listed here is found in RemoteType,
 // the test fails to ensure the entry is removed from this map.
 var knownMissingInRemoteType = map[string][]string{
-	"clusters": {
-		"apply_policy_default_values",
-	},
 	"external_locations": {
 		"skip_validation",
 	},
 	"model_serving_endpoints": {
-		"ai_gateway",
-		"budget_policy_id",
-		"config",
-		"description",
-		"email_notifications",
-		"name",
 		"rate_limits",
-		"route_optimized",
-		"tags",
+	},
+	"pipelines": {
+		// Note that this is a deliberate omission: cascade_on_destroy is a client-side-only field.
+		// It has no remote counterpart, so it is never expected in RemoteType.
+		"cascade_on_destroy",
 	},
 	"quality_monitors": {
 		"skip_builtin_dashboard",
 		"warehouse_id",
 	},
 	"secret_scopes": {
-		"backend_azure_keyvault",
 		"initial_manage_principal",
-		"scope",
-		"scope_backend_type",
 	},
 	"postgres_branches": {
-		"branch_id",
-		"expire_time",
-		"is_protected",
-		"no_expiry",
-		"source_branch",
-		"source_branch_lsn",
-		"source_branch_time",
-		"ttl",
+		"replace_existing",
+		"purge_on_delete",
+	},
+	"postgres_databases": {
+		"replace_existing",
 	},
 	"postgres_endpoints": {
-		"autoscaling_limit_max_cu",
-		"autoscaling_limit_min_cu",
-		"disabled",
-		"endpoint_id",
-		"endpoint_type",
-		"group",
-		"no_suspension",
-		"settings",
-		"suspend_timeout_duration",
+		"replace_existing",
+	},
+	"postgres_roles": {
+		"replace_existing",
 	},
 	"postgres_projects": {
-		"budget_policy_id",
-		"custom_tags",
-		"default_branch",
-		"default_endpoint_settings",
-		"display_name",
-		"enable_pg_native_login",
-		"history_retention_duration",
-		"pg_version",
-		"project_id",
+		"purge_on_delete",
 	},
 	"vector_search_endpoints": {
-		"min_qps",
 		"usage_policy_id",
 	},
+	"internal_immutable_snapshots": {
+		"bundle_id",
+		"acl",
+		"zip_path",
+	},
+	"job_runs": {
+		// Local-only trigger fingerprints under lifecycle.
+		"lifecycle",
+	},
 }
 
 // commonMissingInStateType lists fields that are commonly missing across all resource types.
@@ -99,14 +82,33 @@ var knownMissingInStateType = map[string][]string{
 	"apps": {
 		"lifecycle.prevent_destroy",
 	},
+	"clusters": {
+		"lifecycle.prevent_destroy",
+	},
+	"sql_warehouses": {
+		"lifecycle.prevent_destroy",
+	},
+	"job_runs": {
+		// State stores trigger fingerprints, not the config trigger list / prevent_destroy.
+		"lifecycle.prevent_destroy",
+		"lifecycle.triggers",
+	},
 	"dashboards": {
 		"file_path",
 	},
+	"genie_spaces": {
+		"file_path",
+	},
 	"secret_scopes": {
 		"backend_type",
 		"keyvault_metadata",
 		"name",
 	},
+	"internal_immutable_snapshots": {
+		// RemoteRoot is only the input used to compose FullPath; the state persists
+		// the composed FullPath (and RelativePath), so it isn't kept in state.
+		"remote_root",
+	},
 }
 
 // TestInputSubset validates that all fields in InputType exist in StateType.
diff --git a/bundle/direct/dresources/util.go b/bundle/direct/dresources/util.go
index 3bd0ab4ec73..3b918693ebf 100644
--- a/bundle/direct/dresources/util.go
+++ b/bundle/direct/dresources/util.go
@@ -2,47 +2,21 @@ package dresources
 
 import (
 	"errors"
-	"fmt"
-	"regexp"
+	"slices"
+	"strings"
 
 	"github.com/databricks/cli/bundle/deployplan"
-	"github.com/databricks/cli/libs/structs/structpath"
 	"github.com/databricks/databricks-sdk-go/retries"
 )
 
-// postgresNamePattern matches hierarchical Postgres resource names:
-// - projects/{project_id}
-// - projects/{project_id}/branches/{branch_id}
-// - projects/{project_id}/branches/{branch_id}/endpoints/{endpoint_id}
-var postgresNamePattern = regexp.MustCompile(`^projects/([^/]+)(?:/branches/([^/]+)(?:/endpoints/([^/]+))?)?$`)
-
-// PostgresNameComponents holds the extracted components from a Postgres resource name.
-type PostgresNameComponents struct {
-	ProjectID  string
-	BranchID   string
-	EndpointID string
-}
-
-// ParsePostgresName extracts project, branch, and endpoint IDs from a hierarchical Postgres resource name.
-// Returns an error if the name doesn't match the expected format.
-func ParsePostgresName(name string) (PostgresNameComponents, error) {
-	matches := postgresNamePattern.FindStringSubmatch(name)
-	if matches == nil {
-		return PostgresNameComponents{}, fmt.Errorf("invalid postgres resource name format: %q", name)
-	}
-
-	return PostgresNameComponents{
-		ProjectID:  matches[1],
-		BranchID:   matches[2],
-		EndpointID: matches[3],
-	}, nil
+type StateLifecycle struct {
+	Started *bool `json:"started,omitempty"`
 }
 
 // This is copied from the retries package of the databricks-sdk-go. It should be made public,
 // but for now, I'm copying it here.
 func shouldRetry(err error) bool {
-	var e *retries.Err
-	if errors.As(err, &e) {
+	if e, ok := errors.AsType[*retries.Err](err); ok {
 		return !e.Halt
 	}
 	return false
@@ -51,25 +25,57 @@ func shouldRetry(err error) bool {
 // collectUpdatePathsWithPrefix extracts field paths from Changes that have action=Update,
 // adding a prefix to each path. This is used when the state type has a flattened structure
 // but the API expects paths relative to a nested object (e.g., "spec.display_name").
-func collectUpdatePathsWithPrefix(changes Changes, prefix string) []string {
+//
+// A parent path is dropped when a more specific child path is also being updated. Masking a
+// message asks the API to replace it wholesale, so the API then requires every field under
+// that message to be populated in the request body — verified against a real workspace on
+// 2026-08-31, where update_mask=spec.default_endpoint_settings with a body carrying only
+// the autoscaling limits was rejected with "Field
+// 'spec.default_endpoint_settings.suspension' is in update_mask but not provided in
+// request". A bundle sends only the fields it declares, so only the leaf may be masked.
+//
+// oneofGroups renames a change path to the group it belongs to, for fields the API only
+// accepts under their oneof group name; see the per-resource maps below.
+//
+// Sorted, so the generated update_mask does not depend on map iteration order.
+func collectUpdatePathsWithPrefix(changes Changes, prefix string, oneofGroups map[string]string) []string {
 	var paths []string
 	for path, change := range changes {
-		if change.Action == deployplan.Update {
-			paths = append(paths, prefix+path)
+		if change.Action != deployplan.Update {
+			continue
+		}
+		hasChild := false
+		for other := range changes {
+			if other == path || changes[other].Action != deployplan.Update {
+				continue
+			}
+			if strings.HasPrefix(other, path+".") {
+				hasChild = true
+				break
+			}
+		}
+		if !hasChild {
+			masked := maskPath(path)
+			if group, ok := oneofGroups[masked]; ok {
+				masked = group
+			}
+			paths = append(paths, prefix+masked)
 		}
 	}
-	return paths
+	slices.Sort(paths)
+	// Truncating subscripts can map two changed entries of the same map onto one path, and
+	// two members of one oneof collapse onto their group.
+	return slices.Compact(paths)
 }
 
-// truncateAtIndex truncates a field path at the first bracket index (e.g. "[0]", "[*]",
-// "[key=value]"). Most update_mask APIs only support referencing entire collection
-// fields, not individual elements within them.
-// Examples: "resources[0].name" -> "resources", "description" -> "description",
-// "config.env[0].name" -> "config.env".
-func truncateAtIndex(path string) string {
-	p, err := structpath.ParsePath(path)
-	if err != nil {
-		return path
+// maskPath converts a change path into the path the API accepts in update_mask. A map or
+// repeated field is addressable only as a whole, so everything from the first subscript
+// onwards is dropped: settings.pg_settings['work_mem'] is masked as settings.pg_settings.
+// Verified against a real workspace on 2026-08-31, which answers the indexed form with
+// "Unknown field path in update_mask: 'spec.settings.pg_settings['work_mem']'".
+func maskPath(path string) string {
+	if before, _, ok := strings.Cut(path, "["); ok {
+		return before
 	}
-	return p.Prefix(1).String()
+	return path
 }
diff --git a/bundle/direct/dresources/util_test.go b/bundle/direct/dresources/util_test.go
index bbf04717099..518fa2e3cc8 100644
--- a/bundle/direct/dresources/util_test.go
+++ b/bundle/direct/dresources/util_test.go
@@ -4,8 +4,8 @@ import (
 	"reflect"
 	"testing"
 
+	"github.com/databricks/cli/bundle/deployplan"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 // assertFieldsCovered asserts that all fields in sdkType (except those in skip)
@@ -13,15 +13,13 @@ import (
 func assertFieldsCovered(t *testing.T, sdkType, remoteType reflect.Type, skip map[string]bool) {
 	t.Helper()
 	remoteFields := map[string]bool{}
-	for i := range remoteType.NumField() {
-		f := remoteType.Field(i)
+	for f := range remoteType.Fields() {
 		if !f.Anonymous {
 			remoteFields[f.Name] = true
 		}
 	}
 
-	for i := range sdkType.NumField() {
-		field := sdkType.Field(i)
+	for field := range sdkType.Fields() {
 		if skip[field.Name] {
 			assert.NotContains(t, remoteFields, field.Name, "field %s is in skip list but present in %s; remove it from skip", field.Name, remoteType.Name())
 			continue
@@ -30,93 +28,63 @@ func assertFieldsCovered(t *testing.T, sdkType, remoteType reflect.Type, skip ma
 	}
 }
 
-func TestParsePostgresName(t *testing.T) {
+func TestCollectUpdatePathsWithPrefix(t *testing.T) {
+	upd := func() *deployplan.ChangeDesc { return &deployplan.ChangeDesc{Action: deployplan.Update} }
+	skip := func() *deployplan.ChangeDesc { return &deployplan.ChangeDesc{Action: deployplan.Skip} }
+
 	tests := []struct {
-		name       string
-		input      string
-		projectID  string
-		branchID   string
-		endpointID string
-		expectErr  bool
+		name        string
+		changes     Changes
+		oneofGroups map[string]string
+		want        []string
 	}{
 		{
-			name:      "project",
-			input:     "projects/my-project",
-			projectID: "my-project",
-		},
-		{
-			name:      "branch",
-			input:     "projects/my-project/branches/my-branch",
-			projectID: "my-project",
-			branchID:  "my-branch",
-		},
-		{
-			name:       "endpoint",
-			input:      "projects/my-project/branches/my-branch/endpoints/my-endpoint",
-			projectID:  "my-project",
-			branchID:   "my-branch",
-			endpointID: "my-endpoint",
-		},
-		{
-			name:       "with hyphens and numbers",
-			input:      "projects/my-app-123/branches/dev-branch/endpoints/primary-1",
-			projectID:  "my-app-123",
-			branchID:   "dev-branch",
-			endpointID: "primary-1",
-		},
-		{
-			name:      "empty",
-			input:     "",
-			expectErr: true,
+			name:    "drops parent when a child is also updated",
+			changes: Changes{"attributes": upd(), "attributes.createdb": upd()},
+			want:    []string{"spec.attributes.createdb"},
 		},
 		{
-			name:      "no prefix",
-			input:     "my-project",
-			expectErr: true,
+			name:    "keeps parent when its only child is not updated",
+			changes: Changes{"attributes": upd(), "attributes.createdb": skip()},
+			want:    []string{"spec.attributes"},
 		},
 		{
-			name:      "wrong prefix",
-			input:     "project/my-project",
-			expectErr: true,
+			name:    "sorts multiple leaf paths",
+			changes: Changes{"membership_roles": upd(), "attributes.createdb": upd()},
+			want:    []string{"spec.attributes.createdb", "spec.membership_roles"},
 		},
 		{
-			name:      "missing branch id",
-			input:     "projects/my-project/branches/",
-			expectErr: true,
+			name:    "ignores non-update actions",
+			changes: Changes{"parent": skip(), "role_id": skip(), "attributes.createdb": upd()},
+			want:    []string{"spec.attributes.createdb"},
 		},
 		{
-			name:      "missing endpoint id",
-			input:     "projects/my-project/branches/my-branch/endpoints/",
-			expectErr: true,
+			name:    "no updates yields no paths",
+			changes: Changes{"parent": skip()},
+			want:    nil,
 		},
 		{
-			name:      "extra segments",
-			input:     "projects/my-project/branches/my-branch/endpoints/my-endpoint/extra",
-			expectErr: true,
+			name:        "renames a oneof member to its group",
+			changes:     Changes{"ttl": upd()},
+			oneofGroups: map[string]string{"ttl": "expiration"},
+			want:        []string{"spec.expiration"},
 		},
 		{
-			name:      "branches without branch",
-			input:     "projects/my-project/branches",
-			expectErr: true,
+			name:        "collapses two members of one oneof",
+			changes:     Changes{"ttl": upd(), "no_expiry": upd()},
+			oneofGroups: map[string]string{"ttl": "expiration", "no_expiry": "expiration"},
+			want:        []string{"spec.expiration"},
 		},
 		{
-			name:      "endpoints without endpoint",
-			input:     "projects/my-project/branches/my-branch/endpoints",
-			expectErr: true,
+			name:    "masks a map as a whole",
+			changes: Changes{"settings.pg_settings['work_mem']": upd(), "settings.pg_settings['jit']": upd()},
+			want:    []string{"spec.settings.pg_settings"},
 		},
 	}
 
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			components, err := ParsePostgresName(tt.input)
-			if tt.expectErr {
-				assert.ErrorContains(t, err, "invalid postgres resource name format")
-				return
-			}
-			require.NoError(t, err)
-			assert.Equal(t, tt.projectID, components.ProjectID)
-			assert.Equal(t, tt.branchID, components.BranchID)
-			assert.Equal(t, tt.endpointID, components.EndpointID)
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, collectUpdatePathsWithPrefix(tc.changes, "spec.", tc.oneofGroups))
 		})
 	}
 }
diff --git a/bundle/direct/dresources/vector_search_endpoint.go b/bundle/direct/dresources/vector_search_endpoint.go
index 24bbd1a6e74..12470872b62 100644
--- a/bundle/direct/dresources/vector_search_endpoint.go
+++ b/bundle/direct/dresources/vector_search_endpoint.go
@@ -8,28 +8,44 @@ import (
 	"github.com/databricks/cli/libs/structs/structpath"
 	"github.com/databricks/cli/libs/utils"
 	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/marshal"
 	"github.com/databricks/databricks-sdk-go/service/vectorsearch"
 )
 
 var (
 	pathBudgetPolicyId = structpath.MustParsePath("budget_policy_id")
-	pathMinQps         = structpath.MustParsePath("min_qps")
+	pathTargetQps      = structpath.MustParsePath("target_qps")
 )
 
 // VectorSearchEndpointRemote is remote state for a vector search endpoint. It embeds API response
 // fields for drift comparison and adds endpoint_uuid for permissions; deployment state id remains the endpoint name.
 type VectorSearchEndpointRemote struct {
-	*vectorsearch.EndpointInfo
+	vectorsearch.EndpointInfo
 	EndpointUuid string `json:"endpoint_uuid"`
+	// TargetQps is mapped from EndpointInfo.ScalingInfo.RequestedTargetQps in DoRead
+	// so that drift detection can compare it directly against the config field.
+	TargetQps int64 `json:"target_qps,omitempty"`
+}
+
+// Custom marshalers needed because embedded vectorsearch.EndpointInfo has its own
+// MarshalJSON which would otherwise take over and ignore endpoint_uuid.
+func (s *VectorSearchEndpointRemote) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, s)
+}
+
+func (s VectorSearchEndpointRemote) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(s)
 }
 
 func newVectorSearchEndpointRemote(info *vectorsearch.EndpointInfo) *VectorSearchEndpointRemote {
-	if info == nil {
-		return nil
+	var targetQps int64
+	if info.ScalingInfo != nil {
+		targetQps = info.ScalingInfo.RequestedTargetQps
 	}
 	return &VectorSearchEndpointRemote{
-		EndpointInfo: info,
+		EndpointInfo: *info,
 		EndpointUuid: info.Id,
+		TargetQps:    targetQps,
 	}
 }
 
@@ -46,16 +62,12 @@ func (*ResourceVectorSearchEndpoint) PrepareState(input *resources.VectorSearchE
 }
 
 func (*ResourceVectorSearchEndpoint) RemapState(remote *VectorSearchEndpointRemote) *vectorsearch.CreateEndpoint {
-	var minQps int64
-	if remote.ScalingInfo != nil {
-		minQps = remote.ScalingInfo.RequestedMinQps
-	}
 	return &vectorsearch.CreateEndpoint{
 		Name:            remote.Name,
 		EndpointType:    remote.EndpointType,
 		BudgetPolicyId:  remote.BudgetPolicyId,
 		UsagePolicyId:   "", // Missing in remote
-		MinQps:          minQps,
+		TargetQps:       remote.TargetQps,
 		ForceSendFields: utils.FilterFields[vectorsearch.CreateEndpoint](remote.ForceSendFields, "UsagePolicyId"),
 	}
 }
@@ -77,7 +89,7 @@ func (r *ResourceVectorSearchEndpoint) DoCreate(ctx context.Context, config *vec
 	return id, newVectorSearchEndpointRemote(waiter.Response), nil
 }
 
-func (r *ResourceVectorSearchEndpoint) WaitAfterCreate(ctx context.Context, config *vectorsearch.CreateEndpoint) (*VectorSearchEndpointRemote, error) {
+func (r *ResourceVectorSearchEndpoint) WaitAfterCreate(ctx context.Context, id string, config *vectorsearch.CreateEndpoint) (*VectorSearchEndpointRemote, error) {
 	info, err := r.client.VectorSearchEndpoints.WaitGetEndpointVectorSearchEndpointOnline(ctx, config.Name, 60*time.Minute, nil)
 	if err != nil {
 		return nil, err
@@ -96,10 +108,10 @@ func (r *ResourceVectorSearchEndpoint) DoUpdate(ctx context.Context, id string,
 		}
 	}
 
-	if entry.Changes.HasChange(pathMinQps) {
+	if entry.Changes.HasChange(pathTargetQps) {
 		_, err := r.client.VectorSearchEndpoints.PatchEndpoint(ctx, vectorsearch.PatchEndpointRequest{
 			EndpointName:    id,
-			MinQps:          config.MinQps,
+			TargetQps:       config.TargetQps,
 			ForceSendFields: nil,
 		})
 		if err != nil {
@@ -110,6 +122,6 @@ func (r *ResourceVectorSearchEndpoint) DoUpdate(ctx context.Context, id string,
 	return nil, nil
 }
 
-func (r *ResourceVectorSearchEndpoint) DoDelete(ctx context.Context, id string) error {
+func (r *ResourceVectorSearchEndpoint) DoDelete(ctx context.Context, id string, _ *vectorsearch.CreateEndpoint) error {
 	return r.client.VectorSearchEndpoints.DeleteEndpointByEndpointName(ctx, id)
 }
diff --git a/bundle/direct/dresources/vector_search_index.go b/bundle/direct/dresources/vector_search_index.go
new file mode 100644
index 00000000000..857e3fc44db
--- /dev/null
+++ b/bundle/direct/dresources/vector_search_index.go
@@ -0,0 +1,283 @@
+package dresources
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/cli/bundle/deployplan"
+	"github.com/databricks/cli/libs/structs/structpath"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/marshal"
+	"github.com/databricks/databricks-sdk-go/retries"
+	"github.com/databricks/databricks-sdk-go/service/vectorsearch"
+)
+
+// deleteIndexTimeout caps the wait for an index deletion to complete.
+// In practice deletion finishes in a minute or two, but worst case the
+// embedding pipeline shutdown can stretch closer to ten minutes.
+const deleteIndexTimeout = 15 * time.Minute
+
+// pendingDeletionTimeout caps how long a create is retried while the backend
+// still holds the index name from a preceding delete (see createIndex). Kept
+// deliberately short so we fail fast rather than hang for the full
+// deleteIndexTimeout: if nightlies still hit the race, raise it then.
+const pendingDeletionTimeout = time.Minute
+
+// createIndexTimeout caps the wait for an index to become ready after creation.
+// Delta sync indexes do an initial sync from the source table, which can stretch
+// out for large tables. Matches the terraform provider's defaultIndexProvisionTimeout.
+// https://github.com/databricks/terraform-provider-databricks/blob/c79d82d9582ab6670468bbff303199906d47905f/vectorsearch/resource_vector_search_index.go#L19
+const createIndexTimeout = 75 * time.Minute
+
+// VectorSearchIndexState tracks the UUID of the endpoint the index is attached
+// to. Without it the planner cannot tell that an index pointing at a deleted
+// and recreated endpoint (same name, different UUID) has been orphaned — the
+// index still exists by name but its backing endpoint is gone.
+type VectorSearchIndexState struct {
+	vectorsearch.CreateVectorIndexRequest
+	EndpointUuid string `json:"endpoint_uuid,omitempty"`
+}
+
+func (s *VectorSearchIndexState) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, s)
+}
+
+func (s VectorSearchIndexState) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(s)
+}
+
+// VectorSearchIndexRemote is remote state. endpoint_uuid is looked up from the
+// endpoint service since the index API itself doesn't return it.
+type VectorSearchIndexRemote struct {
+	vectorsearch.VectorIndex
+	EndpointUuid string `json:"endpoint_uuid,omitempty"`
+}
+
+func (s *VectorSearchIndexRemote) UnmarshalJSON(b []byte) error {
+	return marshal.Unmarshal(b, s)
+}
+
+func (s VectorSearchIndexRemote) MarshalJSON() ([]byte, error) {
+	return marshal.Marshal(s)
+}
+
+type ResourceVectorSearchIndex struct {
+	client *databricks.WorkspaceClient
+}
+
+func (*ResourceVectorSearchIndex) New(client *databricks.WorkspaceClient) *ResourceVectorSearchIndex {
+	return &ResourceVectorSearchIndex{client: client}
+}
+
+func (*ResourceVectorSearchIndex) PrepareState(input *resources.VectorSearchIndex) *VectorSearchIndexState {
+	return &VectorSearchIndexState{
+		CreateVectorIndexRequest: input.CreateVectorIndexRequest,
+		EndpointUuid:             "",
+	}
+}
+
+func (*ResourceVectorSearchIndex) RemapState(remote *VectorSearchIndexRemote) *VectorSearchIndexState {
+	state := &VectorSearchIndexState{
+		DeltaSyncIndexSpec:    nil, // need to remap below
+		DirectAccessIndexSpec: remote.DirectAccessIndexSpec,
+		IndexSubtype:          remote.IndexSubtype,
+		Name:                  remote.Name,
+		EndpointName:          remote.EndpointName,
+		IndexType:             remote.IndexType,
+		PrimaryKey:            remote.PrimaryKey,
+		EndpointUuid:          remote.EndpointUuid,
+	}
+	if remote.DeltaSyncIndexSpec != nil {
+		state.DeltaSyncIndexSpec = &vectorsearch.DeltaSyncVectorIndexSpecRequest{
+			ColumnsToIndex:          remote.DeltaSyncIndexSpec.ColumnsToIndex,
+			ColumnsToSync:           remote.DeltaSyncIndexSpec.ColumnsToSync,
+			EmbeddingSourceColumns:  remote.DeltaSyncIndexSpec.EmbeddingSourceColumns,
+			EmbeddingVectorColumns:  remote.DeltaSyncIndexSpec.EmbeddingVectorColumns,
+			EmbeddingWritebackTable: remote.DeltaSyncIndexSpec.EmbeddingWritebackTable,
+			PipelineType:            remote.DeltaSyncIndexSpec.PipelineType,
+			SourceTable:             remote.DeltaSyncIndexSpec.SourceTable,
+			// ForceSendFields is an SDK marshaling concern (which zero-valued
+			// fields to wire-serialize) that has no meaning on the read path.
+			// Local config doesn't carry one either, so leave it nil rather
+			// than copy whatever the response struct happened to use.
+			ForceSendFields: nil,
+		}
+	}
+	return state
+}
+
+func (r *ResourceVectorSearchIndex) DoRead(ctx context.Context, id string) (*VectorSearchIndexRemote, error) {
+	index, err := r.client.VectorSearchIndexes.GetIndexByIndexName(ctx, id)
+	if err != nil {
+		return nil, err
+	}
+	endpointUuid, err := r.lookupEndpointUuid(ctx, index.EndpointName)
+	if err != nil {
+		return nil, err
+	}
+	return &VectorSearchIndexRemote{
+		VectorIndex:  *index,
+		EndpointUuid: endpointUuid,
+	}, nil
+}
+
+func (r *ResourceVectorSearchIndex) DoCreate(ctx context.Context, config *VectorSearchIndexState) (string, *VectorSearchIndexRemote, error) {
+	index, err := r.createIndex(ctx, config.CreateVectorIndexRequest)
+	if err != nil {
+		return "", nil, err
+	}
+	// Second API call (also done in DoRead): the index API does not return the
+	// endpoint UUID, but we need to persist it in state so a future plan can
+	// detect that the endpoint was replaced out-of-band (same name, different
+	// UUID -> orphan).
+	endpointUuid, err := r.lookupEndpointUuid(ctx, config.EndpointName)
+	if err != nil {
+		return "", nil, err
+	}
+	config.EndpointUuid = endpointUuid
+	return config.Name, &VectorSearchIndexRemote{VectorIndex: *index, EndpointUuid: endpointUuid}, nil
+}
+
+// createIndex calls CreateIndex, retrying while the backend still reports the
+// name as pending deletion.
+//
+// Deleting an index completes in two backend phases: the index first disappears
+// from GET, and only later is the name released for reuse. WaitAfterDelete polls
+// GET, so it can return as soon as phase one is done and a follow-up CREATE for
+// the same name is still rejected with 400 INVALID_PARAMETER_VALUE "currently
+// pending deletion". Polling GET cannot close that race because the two phases
+// are observed on different endpoints, so the CREATE itself has to be retried.
+// The API exposes no DELETING state to poll for instead; remove this once it
+// does, or once CREATE queues behind the pending delete rather than failing.
+func (r *ResourceVectorSearchIndex) createIndex(ctx context.Context, req vectorsearch.CreateVectorIndexRequest) (*vectorsearch.VectorIndex, error) {
+	return retries.Poll(ctx, pendingDeletionTimeout, func() (*vectorsearch.VectorIndex, *retries.Err) {
+		index, err := r.client.VectorSearchIndexes.CreateIndex(ctx, req)
+		if err == nil {
+			return index, nil
+		}
+		if isIndexPendingDeletion(err) {
+			return nil, retries.Continues("index name is still pending deletion, waiting to recreate it")
+		}
+		return nil, retries.Halt(err)
+	})
+}
+
+// isIndexPendingDeletion reports whether err is the backend's rejection of an
+// operation on an index whose deletion has not fully completed. There is no
+// distinct error code for it — the backend returns a generic
+// INVALID_PARAMETER_VALUE — so the message has to be matched.
+func isIndexPendingDeletion(err error) bool {
+	if !errors.Is(err, apierr.ErrInvalidParameterValue) {
+		return false
+	}
+	apiErr, ok := errors.AsType[*apierr.APIError](err)
+	return ok && strings.Contains(apiErr.Message, "pending deletion")
+}
+
+// No DoUpdate: vector search indexes have no update API. All SDK fields are
+// declared in vector_search_indexes.yml under recreate_on_changes or ignore_remote_changes.
+// If a future SDK bump adds a new field that isn't classified, the framework
+// rejects the resulting Update plan at bundle_plan.go (see also the reflection
+// test in vector_search_index_test.go which catches it earlier at unit-test time).
+
+func (r *ResourceVectorSearchIndex) DoDelete(ctx context.Context, id string, _ *VectorSearchIndexState) error {
+	return r.client.VectorSearchIndexes.DeleteIndexByIndexName(ctx, id)
+}
+
+// WaitAfterCreate polls GetIndex until Status.Ready=true. CreateIndex returns
+// immediately with metadata of an index whose embedding pipeline is still
+// provisioning; queries against an index that isn't ready fail. Blocking here
+// lets dependent resources (and the next plan) see a usable index.
+func (r *ResourceVectorSearchIndex) WaitAfterCreate(ctx context.Context, id string, config *VectorSearchIndexState) (*VectorSearchIndexRemote, error) {
+	index, err := retries.Poll(ctx, createIndexTimeout, func() (*vectorsearch.VectorIndex, *retries.Err) {
+		idx, getErr := r.client.VectorSearchIndexes.GetIndexByIndexName(ctx, id)
+		if getErr != nil {
+			return nil, retries.Halt(getErr)
+		}
+		if idx.Status == nil || !idx.Status.Ready {
+			msg := "index is still provisioning"
+			if idx.Status != nil && idx.Status.Message != "" {
+				msg = idx.Status.Message
+			}
+			return nil, retries.Continues(msg)
+		}
+		return idx, nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	return &VectorSearchIndexRemote{VectorIndex: *index, EndpointUuid: config.EndpointUuid}, nil
+}
+
+// WaitAfterDelete polls GetIndex until the index is gone. The DELETE call is
+// asynchronous, so without this a `bundle destroy` would report success while
+// the index is still being torn down. The framework calls this after dropping
+// state (so a wait-time failure leaves the bundle consistent) and maps the
+// terminal NotFound to success (see Adapter.WaitAfterDelete).
+//
+// This does NOT on its own make a recreate safe: the name is released after the
+// index disappears from GET, so createIndex retries the CREATE for the rest.
+func (r *ResourceVectorSearchIndex) WaitAfterDelete(ctx context.Context, id string) error {
+	_, err := retries.Poll[struct{}](ctx, deleteIndexTimeout, func() (*struct{}, *retries.Err) {
+		_, getErr := r.client.VectorSearchIndexes.GetIndexByIndexName(ctx, id)
+		if getErr != nil {
+			return nil, retries.Halt(getErr)
+		}
+		return nil, retries.Continues("index still exists, waiting for deletion to complete")
+	})
+	return err
+}
+
+// OverrideChangeDesc classifies endpoint_uuid drift: Recreate when the saved
+// UUID differs from what's currently attached to the endpoint name, Skip
+// otherwise. endpoint_uuid is never present in config, so without Skip a
+// synthetic diff between empty newState and populated saved state would
+// otherwise leak into the plan.
+//
+// Unlike vector_search_endpoint, this intentionally does NOT require
+// remoteUuid != "". An empty remoteUuid here is the orphan signal: the index
+// still exists by name but its backing endpoint has been deleted out-of-band.
+// lookupEndpointUuid distinguishes this (404 -> "") from transient errors
+// (propagated through DoRead/DoCreate), so reaching this branch with empty
+// remoteUuid unambiguously means the endpoint is gone.
+func (*ResourceVectorSearchIndex) OverrideChangeDesc(_ context.Context, path *structpath.PathNode, change *ChangeDesc, remote *VectorSearchIndexRemote) error {
+	if path.String() != "endpoint_uuid" {
+		return nil
+	}
+	savedUuid, _ := change.Old.(string)
+	var remoteUuid string
+	if remote != nil {
+		remoteUuid = remote.EndpointUuid
+	}
+	if savedUuid != "" && savedUuid != remoteUuid {
+		change.Action = deployplan.Recreate
+		change.Reason = "endpoint replaced out-of-band"
+	} else {
+		change.Action = deployplan.Skip
+		change.Reason = "state-only field"
+	}
+	return nil
+}
+
+// lookupEndpointUuid returns the current UUID of the endpoint with the given
+// name. A 404 is converted to ("", nil) so the caller can distinguish a
+// genuinely missing endpoint (the orphan signal) from a transient or
+// permission error, which is propagated.
+func (r *ResourceVectorSearchIndex) lookupEndpointUuid(ctx context.Context, endpointName string) (string, error) {
+	if endpointName == "" {
+		return "", nil
+	}
+	info, err := r.client.VectorSearchEndpoints.GetEndpointByEndpointName(ctx, endpointName)
+	if err != nil {
+		if apierr.IsMissing(err) {
+			return "", nil
+		}
+		return "", fmt.Errorf("looking up vector search endpoint %q: %w", endpointName, err)
+	}
+	return info.Id, nil
+}
diff --git a/bundle/direct/dresources/vector_search_index_test.go b/bundle/direct/dresources/vector_search_index_test.go
new file mode 100644
index 00000000000..4bb49eb18d9
--- /dev/null
+++ b/bundle/direct/dresources/vector_search_index_test.go
@@ -0,0 +1,49 @@
+package dresources
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/databricks/databricks-sdk-go/service/vectorsearch"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestVectorSearchIndexAllSDKFieldsAreClassified guards against a future SDK
+// bump silently adding a field that the planner classifies as Update. The
+// resource has no update API and intentionally omits DoUpdate, so any
+// unclassified field would surface as a deploy-time framework error
+// ("resource does not support update action but plan produced update"). This
+// test catches the gap at unit-test time instead.
+func TestVectorSearchIndexAllSDKFieldsAreClassified(t *testing.T) {
+	config := GetResourceConfig("vector_search_indexes")
+	require.NotNil(t, config)
+
+	classified := map[string]bool{}
+	for _, field := range config.RecreateOnChanges {
+		classified[field.Field.String()] = true
+	}
+	// provided_id_fields also recreate on local changes, so they are classified.
+	for _, field := range config.ProvidedIDFields {
+		classified[field.Field.String()] = true
+	}
+	for _, field := range config.IgnoreRemoteChanges {
+		classified[field.Field.String()] = true
+	}
+
+	sdkType := reflect.TypeFor[vectorsearch.CreateVectorIndexRequest]()
+	for field := range sdkType.Fields() {
+		jsonTag := field.Tag.Get("json")
+		if jsonTag == "" || jsonTag == "-" {
+			continue
+		}
+		jsonTag = strings.TrimSuffix(jsonTag, ",omitempty")
+		assert.Truef(t, classified[jsonTag],
+			"field %q is not declared in vector_search_indexes.yml; "+
+				"vector_search_indexes has no update API, so every SDK field must be in "+
+				"recreate_on_changes, provided_id_fields or ignore_remote_changes",
+			jsonTag,
+		)
+	}
+}
diff --git a/bundle/direct/dresources/volume.go b/bundle/direct/dresources/volume.go
index 35196bdb388..7cd1eaba1ce 100644
--- a/bundle/direct/dresources/volume.go
+++ b/bundle/direct/dresources/volume.go
@@ -3,12 +3,11 @@ package dresources
 import (
 	"context"
 	"fmt"
+	"slices"
 	"strings"
 
 	"github.com/databricks/cli/bundle/config/resources"
-	"github.com/databricks/cli/bundle/deployplan"
 	"github.com/databricks/cli/libs/log"
-	"github.com/databricks/cli/libs/structs/structpath"
 	"github.com/databricks/cli/libs/utils"
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/service/catalog"
@@ -50,6 +49,9 @@ func (r *ResourceVolume) DoCreate(ctx context.Context, config *catalog.CreateVol
 	return response.FullName, response, nil
 }
 
+// See schemaForceSend. Verified against a real workspace: {"comment": ""} clears it.
+var volumeForceSend = []string{"Comment"}
+
 func (r *ResourceVolume) DoUpdate(ctx context.Context, id string, config *catalog.CreateVolumeRequestContent, _ *PlanEntry) (*catalog.VolumeInfo, error) {
 	updateRequest := catalog.UpdateVolumeRequestContent{
 		Comment: config.Comment,
@@ -57,7 +59,7 @@ func (r *ResourceVolume) DoUpdate(ctx context.Context, id string, config *catalo
 		NewName: "", // Not supported by Update(). Needs DoUpdateWithID()
 		Owner:   "", // Not supported by DABs
 
-		ForceSendFields: utils.FilterFields[catalog.UpdateVolumeRequestContent](config.ForceSendFields, "NewName", "Owner"),
+		ForceSendFields: utils.FilterFields[catalog.UpdateVolumeRequestContent](append(slices.Clone(volumeForceSend), config.ForceSendFields...), "NewName", "Owner"),
 	}
 
 	nameFromID, err := getNameFromID(id)
@@ -81,7 +83,7 @@ func (r *ResourceVolume) DoUpdate(ctx context.Context, id string, config *catalo
 	return response, err
 }
 
-func (r *ResourceVolume) DoUpdateWithID(ctx context.Context, id string, config *catalog.CreateVolumeRequestContent) (string, *catalog.VolumeInfo, error) {
+func (r *ResourceVolume) DoUpdateWithID(ctx context.Context, id string, config *catalog.CreateVolumeRequestContent, _ *PlanEntry) (string, *catalog.VolumeInfo, error) {
 	updateRequest := catalog.UpdateVolumeRequestContent{
 		Comment: config.Comment,
 		Name:    id,
@@ -89,7 +91,7 @@ func (r *ResourceVolume) DoUpdateWithID(ctx context.Context, id string, config *
 		NewName: "", // Initialized below if needed
 		Owner:   "", // Not supported by DABs
 
-		ForceSendFields: utils.FilterFields[catalog.UpdateVolumeRequestContent](config.ForceSendFields, "Owner"),
+		ForceSendFields: utils.FilterFields[catalog.UpdateVolumeRequestContent](append(slices.Clone(volumeForceSend), config.ForceSendFields...), "Owner"),
 	}
 
 	items := strings.Split(id, ".")
@@ -110,39 +112,10 @@ func (r *ResourceVolume) DoUpdateWithID(ctx context.Context, id string, config *
 	return response.FullName, response, nil
 }
 
-func (r *ResourceVolume) DoDelete(ctx context.Context, id string) error {
+func (r *ResourceVolume) DoDelete(ctx context.Context, id string, _ *catalog.CreateVolumeRequestContent) error {
 	return r.client.Volumes.DeleteByName(ctx, id)
 }
 
-// OverrideChangeDesc suppresses drift for storage_location when the only difference
-// is a trailing slash. The UC API strips trailing slashes on create, so remote returns
-// "s3://bucket/path" while the config may have "s3://bucket/path/".
-//
-// This matches the Terraform provider's suppressLocationDiff behavior.
-// https://github.com/databricks/terraform-provider-databricks/blob/v1.65.1/catalog/resource_volume.go#L25
-func (*ResourceVolume) OverrideChangeDesc(_ context.Context, path *structpath.PathNode, change *ChangeDesc, _ *catalog.VolumeInfo) error {
-	if change.Action == deployplan.Skip {
-		return nil
-	}
-
-	if path.String() != "storage_location" {
-		return nil
-	}
-
-	newStr, newOk := change.New.(string)
-	remoteStr, remoteOk := change.Remote.(string)
-	if !newOk || !remoteOk {
-		return nil
-	}
-
-	if newStr != remoteStr && strings.TrimRight(newStr, "/") == strings.TrimRight(remoteStr, "/") {
-		change.Action = deployplan.Skip
-		change.Reason = deployplan.ReasonURLNormalization
-	}
-
-	return nil
-}
-
 func getNameFromID(id string) (string, error) {
 	items := strings.Split(id, ".")
 	if len(items) == 0 {
diff --git a/bundle/direct/dstate/dms.go b/bundle/direct/dstate/dms.go
new file mode 100644
index 00000000000..57e10b8d4b4
--- /dev/null
+++ b/bundle/direct/dstate/dms.go
@@ -0,0 +1,61 @@
+package dstate
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"github.com/databricks/cli/bundle/deployplan"
+	"github.com/databricks/cli/libs/dms"
+)
+
+// RecordedState is what the CLI serializes into the DMS operation's state field. It wraps the
+// config so depends_on survives the round trip: DMS has no field for dependency edges, and
+// nesting them in the config would collide with resource fields of the same name.
+type RecordedState struct {
+	State     json.RawMessage             `json:"state"`
+	DependsOn []deployplan.DependsOnEntry `json:"depends_on,omitempty"`
+}
+
+// applyDMSState fills in the resource state from what DMS recorded. For a deployment that uses DMS
+// resources.json does not track state. The service is queried for state for resources and then they
+// are filled in-place in DeploymentState.Data.State:
+func (db *DeploymentState) applyDMSState(recorded []dms.Resource) error {
+	if len(db.Data.State) > 0 {
+		return fmt.Errorf("internal error: state file for a recorded deployment carries %d resources, expected none", len(db.Data.State))
+	}
+
+	// Built first and assigned together, so a malformed envelope leaves the state alone rather than
+	// half filled.
+	resources := make(map[string]ResourceEntry, len(recorded))
+	stateIDs := make(map[string]string, len(recorded))
+	for _, res := range recorded {
+		entry, err := stateEntry(res)
+		if err != nil {
+			return err
+		}
+		resources[res.Key] = entry
+		stateIDs[res.Key] = entry.ID
+	}
+
+	db.Data.State = resources
+	db.stateIDs = stateIDs
+	return nil
+}
+
+// stateEntry unwraps the envelope the write path recorded for a resource.
+func stateEntry(res dms.Resource) (ResourceEntry, error) {
+	var recorded RecordedState
+	if res.State != "" {
+		// The service stores state as an opaque string, so it arrives as the serialized
+		// envelope the write side sent.
+		if err := json.Unmarshal([]byte(res.State), &recorded); err != nil {
+			return ResourceEntry{}, fmt.Errorf("interpreting state recorded for %s: %w", res.Key, err)
+		}
+	}
+
+	return ResourceEntry{
+		ID:        res.ID,
+		State:     recorded.State,
+		DependsOn: recorded.DependsOn,
+	}, nil
+}
diff --git a/bundle/direct/dstate/dms_test.go b/bundle/direct/dstate/dms_test.go
new file mode 100644
index 00000000000..ab4e1bc017f
--- /dev/null
+++ b/bundle/direct/dstate/dms_test.go
@@ -0,0 +1,101 @@
+package dstate
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/databricks/cli/bundle/deployplan"
+	"github.com/databricks/cli/libs/dms"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestApplyDMSState(t *testing.T) {
+	// The service stores state as an opaque string, so the envelope the write path sent
+	// arrives verbatim.
+	envelope := `{"state":{"name":"foo"},"depends_on":[{"node":"resources.pipelines.bar","label":"${resources.pipelines.bar.id}"}]}`
+
+	// What the file loaded, for the cases that check it is replaced or survives.
+	fileState := map[string]ResourceEntry{
+		"resources.jobs.bar": {ID: "file-id", State: json.RawMessage(`{"name":"from-file"}`)},
+	}
+
+	tests := []struct {
+		name     string
+		existing map[string]ResourceEntry
+		recorded []dms.Resource
+		want     map[string]ResourceEntry
+		wantErr  string
+	}{
+		{
+			name: "the envelope is unwrapped, depends_on and all",
+			recorded: []dms.Resource{
+				{Key: "resources.jobs.foo", ID: "123", State: envelope},
+				{Key: "resources.pipelines.bar", ID: "456"},
+			},
+			// depends_on comes back from the envelope, so a bundle whose local state was
+			// wiped still has the edges needed for delete ordering.
+			want: map[string]ResourceEntry{
+				"resources.jobs.foo": {
+					ID:        "123",
+					State:     json.RawMessage(`{"name":"foo"}`),
+					DependsOn: []deployplan.DependsOnEntry{{Node: "resources.pipelines.bar", Label: "${resources.pipelines.bar.id}"}},
+				},
+				"resources.pipelines.bar": {ID: "456"},
+			},
+		},
+		{
+			// Nil is what a list holding nothing returns, and it means a successful deploy of
+			// nothing rather than missing data.
+			name: "nothing recorded leaves the state empty",
+			want: map[string]ResourceEntry{},
+		},
+		{
+			// The good resource comes first, so the error lands mid-way: the state has to be left
+			// alone rather than end up half filled.
+			name: "a malformed envelope leaves the state alone",
+			recorded: []dms.Resource{
+				{Key: "resources.jobs.ok", ID: "999", State: `{"state":{"name":"ok"}}`},
+				{Key: "resources.jobs.foo", ID: "123", State: "not json"},
+			},
+			wantErr: "interpreting state recorded for resources.jobs.foo",
+			want:    nil,
+		},
+		{
+			// A recorded deployment's file is an empty shell, so resources in it mean the state was
+			// not the one recording wrote.
+			name:     "resources loaded from the file are refused",
+			existing: fileState,
+			recorded: []dms.Resource{{Key: "resources.jobs.foo", ID: "dms-id", State: `{"state":{"name":"from-dms"}}`}},
+			wantErr:  "carries 1 resources, expected none",
+			want:     fileState,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var db DeploymentState
+			db.Data.State = tt.existing
+			db.stateIDs = stateIDsOf(tt.existing)
+
+			err := db.applyDMSState(tt.recorded)
+			if tt.wantErr != "" {
+				assert.ErrorContains(t, err, tt.wantErr)
+			} else {
+				require.NoError(t, err)
+			}
+
+			assert.Equal(t, tt.want, db.Data.State)
+			assert.Equal(t, stateIDsOf(tt.want), db.stateIDs)
+		})
+	}
+}
+
+// stateIDsOf is the id index the state keeps alongside its entries.
+func stateIDsOf(entries map[string]ResourceEntry) map[string]string {
+	ids := make(map[string]string, len(entries))
+	for key, entry := range entries {
+		ids[key] = entry.ID
+	}
+	return ids
+}
diff --git a/bundle/direct/dstate/migrate.go b/bundle/direct/dstate/migrate.go
index 381d63a12eb..e0ce585bedf 100644
--- a/bundle/direct/dstate/migrate.go
+++ b/bundle/direct/dstate/migrate.go
@@ -13,12 +13,16 @@ import (
 // migrateState runs all necessary migrations on the database.
 // It is called after loading state from disk.
 func migrateState(db *Database) error {
-	if db.StateVersion == currentStateVersion {
-		return nil
-	}
 	if db.StateVersion > currentStateVersion {
 		return fmt.Errorf("state version %d is newer than supported version %d; upgrade the CLI", db.StateVersion, currentStateVersion)
 	}
+	if err := assertNoUnsupportedFeatures(db.Features); err != nil {
+		return err
+	}
+
+	if db.StateVersion == currentStateVersion {
+		return nil
+	}
 
 	for version := db.StateVersion; version < currentStateVersion; version++ {
 		fn, ok := migrations[version]
@@ -39,6 +43,8 @@ func migrateState(db *Database) error {
 var migrations = map[int]func(*Database) error{
 	0: migrateV1ToV2,
 	1: migrateV1ToV2,
+	// Version 3 adds feature flags; existing states need no data changes.
+	2: func(*Database) error { return nil },
 }
 
 // migrateV1ToV2 migrates permissions and grants entries from the old format
diff --git a/bundle/direct/dstate/state.go b/bundle/direct/dstate/state.go
index 3f6bcce2fc5..4d2a82546f9 100644
--- a/bundle/direct/dstate/state.go
+++ b/bundle/direct/dstate/state.go
@@ -1,36 +1,164 @@
 package dstate
 
 import (
+	"bufio"
+	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"io/fs"
+	"maps"
 	"os"
 	"path/filepath"
+	"slices"
 	"strings"
 	"sync"
+	"uuid"
 
+	"github.com/databricks/cli/bundle/config"
 	"github.com/databricks/cli/bundle/deployplan"
 	"github.com/databricks/cli/bundle/statemgmt/resourcestate"
 	"github.com/databricks/cli/internal/build"
-	"github.com/google/uuid"
+	"github.com/databricks/cli/libs/atomicfile"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/dms"
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/retry"
+	"github.com/databricks/databricks-sdk-go/service/bundledeployments"
 )
 
-const currentStateVersion = 2
+const (
+	// currentStateVersion is the schema version written by this CLI and the version
+	// legacy states are migrated up to on load.
+	currentStateVersion = 3
+	initialBufferSize   = 64 * 1024
+	maxWalEntrySize     = 10 * 1024 * 1024
+	walSuffix           = ".wal"
+)
+
+// FeatureDeploymentHistory marks a state whose resources are also recorded with the
+// deployment metadata service. Both stores are kept in step, so the marker is what tells a
+// reader the two already agree. A CLI that does not know the name refuses the state rather
+// than deploying over a deployment it would leave the service out of step with.
+//
+// The marker is sticky: once a deployment is recorded, the service holds resources that a
+// CLI which is not recording must not touch. So turning recording off does not clear it, and
+// deploying such a state without recording is refused.
+const FeatureDeploymentHistory = "deployment_history"
+
+// featuresDocURL explains the state-features mechanism in the error shown when this CLI refuses a
+// state that depends on a feature it does not recognize.
+const featuresDocURL = "https://docs.databricks.com/aws/en/dev-tools/bundles/state-features#state-features"
+
+// recognizedFeatures is the set of state feature flags this CLI understands. A state depending on
+// any feature not listed here is refused (see checkStateFeatures), so a newer CLI's feature is not
+// silently clobbered by this one.
+var recognizedFeatures = map[string]struct{}{
+	FeatureDeploymentHistory: {},
+}
+
+// assertNoUnsupportedFeatures refuses a state that depends on a feature this CLI does not recognize.
+func assertNoUnsupportedFeatures(features map[string]struct{}) error {
+	var unsupported []string
+	for feature := range features {
+		if _, ok := recognizedFeatures[feature]; !ok {
+			unsupported = append(unsupported, feature)
+		}
+	}
+	if len(unsupported) == 0 {
+		return nil
+	}
+	slices.Sort(unsupported)
+	return fmt.Errorf("the deployment state requires features this CLI does not support: %s; upgrade to the latest CLI version and see %s for more information", strings.Join(unsupported, ", "), featuresDocURL)
+}
+
+// errStaleWAL is returned when the WAL serial is behind the expected serial.
+// The caller should delete the stale WAL and proceed normally.
+var errStaleWAL = errors.New("stale WAL")
+
+// ErrUnsettingRecording is returned by Open when an operation that does not support deployment
+// history (such as unbind) reaches a recorded state. Callers present an operation-appropriate
+// message via errors.Is.
+var ErrUnsettingRecording = errors.New("this operation is not supported for a deployment that records deployment history")
 
 type DeploymentState struct {
-	Path string
-	Data Database
-	mu   sync.Mutex
+	Path    string
+	Data    Database
+	mu      sync.Mutex
+	walFile *os.File
+
+	// openedForWrite records write mode explicitly. It used to be implied by walFile, but a recorded
+	// deployment writes no WAL, so the two are no longer the same question.
+	openedForWrite bool
+
+	// Maps resource key to ID. Unlike Data.State, this is up to date during writes (deploys).
+	stateIDs map[string]string
+
+	// operationBuffer records each state write with DMS. Nil unless the bundle records deployment
+	// history, in which case InitializeOperationBuffer installs it once the version exists.
+	operationBuffer *dms.OperationBuffer
+
+	// versionCompleted makes CompleteVersion a no-op after the first call, so a deferred safety-net
+	// completion after an explicit one does nothing.
+	versionCompleted bool
+
+	// recordsHistory is whether this deployment records history, decided by Open from the state's
+	// features. Cached because it outlives the features themselves: Finalize resets Data, and
+	// CompleteVersion runs after that.
+	recordsHistory bool
+
+	// DeploymentID is the recorded deployment's id. Set at Open, or by the first deploy that creates
+	// the deployment, which Open cannot know about.
+	DeploymentID string
+
+	// VersionID is the service-owned counter for recorded deployments. A copy is stored in
+	// resources.json as Serial to ensure outdated resource state is not read.
+	// Open always takes the authoritative value from the service.
+	VersionID int
+}
+
+// OpenDmsArgs identifies the recorded deployment Open reads from. The zero value means the
+// bundle does not record deployment history, or no deployment exists for it yet.
+type OpenDmsArgs struct {
+	// DeploymentID is the deployment's server-minted id.
+	DeploymentID string
+
+	// LastVersionID is the most recent version the service has recorded, zero when it has none.
+	// Open takes the state's version from it: the service owns the number.
+	//
+	// Equivalent to serial for a file based deployment that uses resources.json to track state,
+	LastVersionID int
+}
+
+type Header struct {
+	StateVersion int `json:"state_version"`
+
+	// CLIVersion is the version of the CLI that last wrote this state. It is
+	// refreshed from the WAL header on every deploy that commits changes, so it
+	// tracks the most recent writer rather than the CLI that created the state.
+	CLIVersion string `json:"cli_version"`
+
+	Lineage string `json:"lineage"`
+
+	// Serial counts state writes. For recorded deployments it is a copy of the current DMS version
+	// to ensure outdated resource state is not read; the service remains the source of truth.
+	Serial int `json:"serial,omitempty"`
+
+	// Features maps each feature flag this state depends on to a (currently empty)
+	// value. It is read to detect a state that depends on features this CLI lacks and
+	// refuse it (see migrateState). It is a map so a future CLI can attach per-feature
+	// data without reshaping the state. Empty/omitted for states that use no features.
+	Features map[string]struct{} `json:"features,omitempty"`
 }
 
 type Database struct {
-	StateVersion int                      `json:"state_version"`
-	CLIVersion   string                   `json:"cli_version"`
-	Lineage      string                   `json:"lineage"`
-	Serial       int                      `json:"serial"`
-	State        map[string]ResourceEntry `json:"state"`
+	Header
+
+	// Maps resource key to ResourceEntry which includes ID + full serialized state.
+	// This is not updated during write/deploy, those writes go to WAL instead.
+	// The State is then reconstructed from WAL.
+	State map[string]ResourceEntry `json:"state"`
 }
 
 type ResourceEntry struct {
@@ -39,6 +167,116 @@ type ResourceEntry struct {
 	DependsOn []deployplan.DependsOnEntry `json:"depends_on,omitempty"`
 }
 
+type WALEntry struct {
+	Key   string         `json:"k"`
+	Value *ResourceEntry `json:"v,omitempty"` // nil means delete
+}
+
+// InitializeOperationBuffer opens the operation buffer that records each subsequent state write with
+// DMS under deploymentID and versionID, so what the service holds mirrors the WAL. It uses the client
+// Open built, so it is called only when the deployment records history, and once the version exists
+// (after approval) - which is why it is not an Open option. It also records the id a first deploy
+// just created, which Open could not know, so CompleteVersion later has it.
+func (db *DeploymentState) InitializeOperationBuffer(ctx context.Context, deploymentID string, versionID int) {
+	buf := dms.StartOperationBuffer(ctx, deploymentID, versionID)
+
+	db.mu.Lock()
+	defer db.mu.Unlock()
+	db.operationBuffer = buf
+	db.DeploymentID = deploymentID
+	db.VersionID = versionID
+}
+
+// getOperationBuffer returns the buffer for the open version, nil when no version is open.
+func (db *DeploymentState) getOperationBuffer() *dms.OperationBuffer {
+	db.mu.Lock()
+	defer db.mu.Unlock()
+	return db.operationBuffer
+}
+
+// RecordingError reports whether recording state writes to the service has failed, so the apply
+// stops touching resources once the service is no longer keeping up. Nil when the bundle does not
+// record deployment history or recording is healthy.
+func (db *DeploymentState) RecordingError() error {
+	buf := db.getOperationBuffer()
+	if buf == nil {
+		return nil
+	}
+	return buf.Err()
+}
+
+// CompleteVersion marks the recorded version done, reporting whether it completed here. A no-op
+// returning false when no version was created (the bundle does not record history, or a deploy was
+// declined) or the version was already completed, so a deferred safety-net call after an explicit
+// one does nothing. Finalize has already drained the buffered operations. It reads only fields that
+// survive Finalize's reset and asserts nothing, so it is safe to call after the state is closed.
+func (db *DeploymentState) CompleteVersion(ctx context.Context, success bool) (bool, error) {
+	if !db.IsDeploymentMetadataService() {
+		return false, nil
+	}
+
+	db.mu.Lock()
+	buf := db.operationBuffer
+	if buf == nil || db.versionCompleted {
+		db.mu.Unlock()
+		return false, nil
+	}
+	db.versionCompleted = true
+	deploymentID, versionID := db.DeploymentID, db.VersionID
+	db.mu.Unlock()
+
+	// A recording failure fails the version even when the caller counted the deploy a success: the
+	// service does not then hold everything the WAL does. Finalize already drained and surfaced it;
+	// this reads the drained buffer's error so a destroy whose uploads failed keeps its record.
+	if buf.Err() != nil {
+		success = false
+	}
+
+	reason := bundledeployments.VersionCompleteVersionCompleteSuccess
+	if !success {
+		reason = bundledeployments.VersionCompleteVersionCompleteFailure
+	}
+	w := cmdctx.WorkspaceClient(ctx)
+	_, err := w.BundleDeployments.CompleteVersion(ctx, bundledeployments.CompleteVersionRequest{
+		Name:             dms.VersionName(deploymentID, versionID),
+		CompletionReason: reason,
+	})
+	if err != nil {
+		return false, err
+	}
+	log.Infof(ctx, "Completed deployment version: deployment=%s version=%d reason=%s", deploymentID, versionID, reason)
+	// Report the success value the version completed with, not merely that it completed: a destroy
+	// deletes the deployment record only for a version that completed successfully.
+	return success, nil
+}
+
+// RecordFailure records that a resource did not apply, so the history says why rather than
+// leaving the resource out. resourceID is the id it had before the failure.
+func (db *DeploymentState) RecordFailure(resourceKey, resourceID string, cause error) {
+	if !db.IsDeploymentMetadataService() {
+		return
+	}
+
+	// The service refuses a failure that leaves a live resource described by nothing, so re-state
+	// what it still has. An empty resourceID means there is nothing left: a create that never
+	// landed, or a recreate whose delete already went through.
+	var recorded json.RawMessage
+	if entry, ok := db.GetResourceEntry(resourceKey); resourceID != "" && ok && len(entry.State) > 0 {
+		var err error
+		recorded, err = json.Marshal(RecordedState{State: entry.State, DependsOn: entry.DependsOn})
+		if err != nil {
+			// Nothing the caller can act on, so record the failure without the state.
+			recorded = nil
+		}
+	}
+
+	// A failure is normally recorded only while a version is open, so the buffer is set; nil means
+	// no version was created, and there is nothing to record against.
+	if buf := db.getOperationBuffer(); buf != nil {
+		buf.RecordFailure(resourceKey, resourceID, recorded, cause)
+	}
+}
+
 func NewDatabase(lineage string, serial int) Database {
 	return Database{
 		StateVersion: currentStateVersion,
@@ -49,8 +287,9 @@ func NewDatabase(lineage string, serial int) Database {
 	}
 }
 
-func (db *DeploymentState) SaveState(key, newID string, state any, dependsOn []deployplan.DependsOnEntry) error {
-	db.AssertOpened()
+// SaveState records the resource's state after an operation was applied to it.
+func (db *DeploymentState) SaveState(ctx context.Context, key, newID string, state any, dependsOn []deployplan.DependsOnEntry) error {
+	db.AssertOpenedForWrite()
 	db.mu.Lock()
 	defer db.mu.Unlock()
 
@@ -58,36 +297,69 @@ func (db *DeploymentState) SaveState(key, newID string, state any, dependsOn []d
 		db.Data.State = make(map[string]ResourceEntry)
 	}
 
-	jsonMessage, err := json.MarshalIndent(state, "  ", " ")
+	jsonMessage, err := json.Marshal(state)
 	if err != nil {
 		return err
 	}
-
-	db.Data.State[key] = ResourceEntry{
+	entry := ResourceEntry{
 		ID:        newID,
 		State:     json.RawMessage(jsonMessage),
 		DependsOn: dependsOn,
 	}
 
-	return nil
+	// A recorded deployment persists through the service, everything else through the WAL. The
+	// entry is still kept in memory: Finalize exports it for metadata.json and the deploy summary,
+	// and dataForFile empties State again before the tombstone is written.
+	if db.isDeploymentMetadataService() {
+		db.Data.State[key] = entry
+		db.stateIDs[key] = newID
+		if buf := db.operationBuffer; buf != nil {
+			recorded, err := json.Marshal(RecordedState{State: entry.State, DependsOn: dependsOn})
+			if err != nil {
+				return err
+			}
+			buf.RecordOperation(ctx, key, false, newID, recorded)
+		}
+		return nil
+	}
+
+	err = appendJSONLine(db.walFile, WALEntry{Key: key, Value: &entry})
+	if err == nil {
+		db.stateIDs[key] = newID
+	}
+	return err
 }
 
-func (db *DeploymentState) DeleteState(key string) error {
-	db.AssertOpened()
+// DeleteState drops the resource's state entry: the resource is gone. inProgress records the
+// operation as unfinished, which is what the first half of a recreate wants - an interrupted
+// deploy must not leave the resource described as finished.
+func (db *DeploymentState) DeleteState(ctx context.Context, key string, inProgress bool) error {
+	db.AssertOpenedForWrite()
 	db.mu.Lock()
 	defer db.mu.Unlock()
 
 	if db.Data.State == nil {
 		return nil
 	}
+	// Read before the delete below: DMS needs the id to say which resource went away.
+	deletedID := db.stateIDs[key]
 
-	delete(db.Data.State, key)
+	// A recorded deployment persists through the service, everything else through the WAL.
+	if db.isDeploymentMetadataService() {
+		if buf := db.operationBuffer; buf != nil {
+			buf.RecordOperation(ctx, key, inProgress, deletedID, nil)
+		}
+	} else if err := appendJSONLine(db.walFile, WALEntry{Key: key}); err != nil {
+		return err
+	}
 
+	delete(db.stateIDs, key)
 	return nil
 }
 
-func (db *DeploymentState) getResourceEntry(key string) (ResourceEntry, bool) {
-	db.AssertOpened()
+func (db *DeploymentState) GetResourceEntry(key string) (ResourceEntry, bool) {
+	// Note, if opened for write, you get the state that you had at the beginning of deploy, not most recent one
+	db.AssertOpenedForReadOrWrite()
 	db.mu.Lock()
 	defer db.mu.Unlock()
 
@@ -99,18 +371,103 @@ func (db *DeploymentState) getResourceEntry(key string) (ResourceEntry, bool) {
 	return result, ok
 }
 
-// GetResourceEntry returns the full resource entry for the given key.
-func (db *DeploymentState) GetResourceEntry(key string) (ResourceEntry, bool) {
-	return db.getResourceEntry(key)
-}
-
 // GetResourceID returns the ID of the resource for the given key, or an empty string if not found.
 func (db *DeploymentState) GetResourceID(key string) string {
-	entry, _ := db.getResourceEntry(key)
-	return entry.ID
+	db.AssertOpenedForReadOrWrite()
+	db.mu.Lock()
+	defer db.mu.Unlock()
+
+	return db.stateIDs[key]
+}
+
+// StateCLIVersion returns the CLI version that last wrote the state, or an empty
+// string if the state does not record one (a fresh state that this CLI has not
+// written yet). It is the version stored in the on-disk header, not the running
+// build's version.
+func (db *DeploymentState) StateCLIVersion() string {
+	db.AssertOpenedForReadOrWrite()
+	db.mu.Lock()
+	defer db.mu.Unlock()
+
+	return db.Data.CLIVersion
+}
+
+// StateFeatures returns the feature flags this state depends on, the signal a plan
+// carries so deploy --plan can reject a plan built for a different feature set.
+func (db *DeploymentState) StateFeatures() map[string]struct{} {
+	db.mu.Lock()
+	defer db.mu.Unlock()
+	// Copied so callers cannot modify the state's set of features.
+	return maps.Clone(db.Data.Features)
+}
+
+// GetSerial reports the counter a saved plan is validated against: the service's version for a
+// deployment that records history, and the state serial otherwise. When the deployment uses the
+// deployment metadata service, the serial from resources.json is not used for plan validation.
+func (db *DeploymentState) GetSerial() int {
+	db.mu.Lock()
+	defer db.mu.Unlock()
+	if db.isDeploymentMetadataService() {
+		return db.VersionID
+	}
+	return db.Data.Serial
+}
+
+// isDeploymentMetadataService is IsDeploymentMetadataService for callers already holding db.mu.
+func (db *DeploymentState) isDeploymentMetadataService() bool {
+	return db.recordsHistory
+}
+
+// IsDeploymentMetadataService reports whether this deployment's resource state lives in the
+// deployment metadata service rather than the state file. The state's features are the source of
+// truth; valid only after Open.
+func (db *DeploymentState) IsDeploymentMetadataService() bool {
+	db.mu.Lock()
+	defer db.mu.Unlock()
+	return db.isDeploymentMetadataService()
+}
+
+// GetOrInitLineage returns the deployment lineage, generating and storing a new
+// one if the state does not have one yet. It is the single place the lineage is
+// initialized, shared so the direct deployment engine (when it writes state, via
+// Open/UpgradeToWrite) and DMS (when it records a deployment) always agree on the
+// value.
+//
+// DMS needs this before the engine writes state: it records the version at lock
+// time, which is before the engine assigns the lineage at plan-apply time.
+// Seeding db.Data.Lineage here means the subsequent write reuses the same value
+// instead of minting a different one.
+//
+// It does not take db.mu: Open and UpgradeToWrite already hold it, and the DMS
+// recorder calls it during deploy setup, before any concurrent state writes.
+func (db *DeploymentState) GetOrInitLineage() string {
+	if db.Data.Lineage == "" {
+		db.Data.Lineage = uuid.New().String()
+	}
+	return db.Data.Lineage
 }
 
-func (db *DeploymentState) Open(path string) error {
+type (
+	// If true, then Open reads the WAL and merges it in the state. If false, and WAL is present, Open returns an error.
+	WithRecovery bool
+
+	// If true, the state is opened in Write mode, which enables methods such as SaveState
+	// but disables GetResourceEntry (since writes go strictly into WAL and not in memory).
+	WithWrite bool
+
+	// If true, the deployment records history with the metadata service: Open builds a DMS
+	// client from the workspace client, reads resources from the service, and refuses a state
+	// that tracks resources without the recording marker. It forces WithRecovery off, since the
+	// service is the source of truth and a leftover WAL is discarded rather than replayed.
+	WithDeploymentHistory bool
+)
+
+// Open reads the deployment state from disk, recovering the WAL when withRecovery is set.
+// When withDeploymentHistory is set it builds a DMS client from wsClient and reads resources from
+// the service instead, with dmsDeploymentID the id the service holds (empty before the first
+// recorded deploy). Lineage comes from the file. Open only reads through the client -
+// InitializeOperationBuffer installs the write path once a version exists.
+func (db *DeploymentState) Open(ctx context.Context, path string, withRecovery WithRecovery, withWrite WithWrite, withDeploymentHistory WithDeploymentHistory, dmsDeployment OpenDmsArgs) error {
 	db.mu.Lock()
 	defer db.mu.Unlock()
 
@@ -118,57 +475,464 @@ func (db *DeploymentState) Open(path string) error {
 		panic(fmt.Sprintf("state already opened: %v, cannot open %v", db.Path, path))
 	}
 
-	data, err := os.ReadFile(path)
+	err := db.unlockedOpen(ctx, path, withRecovery, withWrite, withDeploymentHistory, dmsDeployment)
 	if err != nil {
-		if errors.Is(err, fs.ErrNotExist) {
-			// Create new database with serial=0, will be incremented to 1 in Finalize()
-			db.Data = NewDatabase("", 0)
-			db.Path = path
-			return nil
-		}
-		return err
+		// A failed open must leave the receiver closed. unlockedOpen assigns
+		// db.Path before every fallible step, so without this the receiver stays
+		// half-initialized and the next Open on it hits the panic above instead
+		// of reporting the real error.
+		db.reset()
+	}
+	return err
+}
+
+// reset returns the receiver to the not-opened state. Callers must hold db.mu.
+func (db *DeploymentState) reset() {
+	if db.walFile != nil {
+		db.walFile.Close()
+		db.walFile = nil
 	}
+	db.Path = ""
+	db.Data = Database{}
+	db.stateIDs = nil
+	db.openedForWrite = false
+}
+
+func (db *DeploymentState) unlockedOpen(ctx context.Context, path string, withRecovery WithRecovery, withWrite WithWrite, withDeploymentHistory WithDeploymentHistory, dmsDeployment OpenDmsArgs) error {
+	db.Path = path
+	// Cleared here rather than in reset, which CompleteVersion needs it to survive: the same state
+	// is reopened (see bind.go), and a stale value would misroute a non-recording open.
+	db.recordsHistory = false
 
-	err = json.Unmarshal(data, &db.Data)
+	// The state file is the source of truth for whether this deployment records history: read it
+	// first.
+	data, err := os.ReadFile(db.Path)
 	if err != nil {
-		return err
+		if errors.Is(err, fs.ErrNotExist) {
+			db.Data = NewDatabase("", 0)
+		} else {
+			return err
+		}
+	} else {
+		if err := json.Unmarshal(data, &db.Data); err != nil {
+			return err
+		}
 	}
 
 	if err := migrateState(&db.Data); err != nil {
 		return fmt.Errorf("migrating state %s: %w", path, err)
 	}
 
+	db.stateIDs = make(map[string]string)
+	for key, entry := range db.Data.State {
+		db.stateIDs[key] = entry.ID
+	}
+
+	recording := bool(withDeploymentHistory)
+
+	walPath := db.Path + walSuffix
+	_, err = os.Stat(walPath)
+	switch {
+	case errors.Is(err, fs.ErrNotExist):
+		// no WAL, nothing to do
+	case err != nil:
+		return fmt.Errorf("failed to stat WAL file %s: %w", walPath, err)
+	default: // WAL exists
+		switch {
+		case recording:
+			// A recorded deployment writes no WAL, so finding one means this state was written by a
+			// deployment that did not record history. Refuse rather than discard it: the file is the
+			// only record of that deploy's writes, and recording is refused below anyway.
+			return fmt.Errorf("unexpected WAL file found at %s: this deployment records deployment history, which does not write one", walPath)
+		case bool(withRecovery):
+			if err := db.replayWAL(ctx); err != nil {
+				return fmt.Errorf("reading state from %s: %w", path, err)
+			}
+		default:
+			return fmt.Errorf("unexpected WAL file found at %s", walPath)
+		}
+	}
+
+	// Reconcile the config against the state. A brand-new deployment is where recording begins, so
+	// the config bootstraps the marker there. On an existing deployment the state is authoritative:
+	// the config can neither start recording one that was not (its resources would be created a
+	// second time) nor stop recording one that is (the service still holds it).
+	_, recorded := db.Data.Features[FeatureDeploymentHistory]
+	if recording && recorded && db.Data.Serial > dmsDeployment.LastVersionID {
+		return fmt.Errorf("inconsistent deployment state: resource state serial (%d) is ahead of deployment history version (%d)", db.Data.Serial, dmsDeployment.LastVersionID)
+	}
+	switch {
+	case recording && !recorded && len(db.Data.State) == 0:
+		if db.Data.Features == nil {
+			db.Data.Features = make(map[string]struct{}, 1)
+		}
+		db.Data.Features[FeatureDeploymentHistory] = struct{}{}
+		recorded = true
+	case recording && !recorded:
+		return errors.New(`enabling experimental.deployment_history for an existing deployment is not supported
+
+Run "databricks bundle destroy" first, then deploy again with deployment history enabled`)
+	case !recording && recorded:
+		return ErrUnsettingRecording
+	}
+
+	db.recordsHistory = recorded
+
+	if recorded {
+		// The service is the source of truth for a recorded deployment; the file is a tombstone
+		// carrying only the marker, and applyDMSState loads the resources the service holds.
+		db.DeploymentID = dmsDeployment.DeploymentID
+
+		if dmsDeployment.DeploymentID != "" {
+			w := cmdctx.WorkspaceClient(ctx)
+			recorded, err := retry.With(ctx, retry.IsTransientRead, func() ([]bundledeployments.Resource, error) {
+				return w.BundleDeployments.ListResourcesAll(ctx, bundledeployments.ListResourcesRequest{
+					Parent: dms.DeploymentName(dmsDeployment.DeploymentID),
+				})
+			})
+			if err != nil {
+				return fmt.Errorf("listing resources from the deployment history service: %w", err)
+			}
+			resources := make([]dms.Resource, len(recorded))
+			for i, res := range recorded {
+				// DMS keys drop the "resources." prefix; add it back for local state.
+				resources[i] = dms.Resource{
+					Key:   dms.StatePrefix + res.ResourceKey,
+					ID:    res.ResourceId,
+					State: res.State,
+				}
+			}
+			if err := db.applyDMSState(resources); err != nil {
+				return err
+			}
+		}
+
+		// The service owns the version number; the state file stores a copy.
+		// No deployment yet means no versions, hence zero.
+		db.VersionID = dmsDeployment.LastVersionID
+	}
+
+	if withWrite {
+		db.openedForWrite = true
+
+		// A recorded deployment needs no WAL: every state write goes to the service as it happens,
+		// and Open recovers from there rather than replaying a log. Stamp the header fields the
+		// replay would have carried over, then skip the file. The serial is left alone: under
+		// recording it comes from the deployment's last_version_id.
+		if db.isDeploymentMetadataService() {
+			db.Data.Lineage = db.GetOrInitLineage()
+			db.Data.StateVersion = currentStateVersion
+			db.Data.CLIVersion = build.GetInfo().Version
+			return nil
+		}
+
+		if err := os.MkdirAll(filepath.Dir(walPath), 0o755); err != nil {
+			return fmt.Errorf("failed to create state directory: %w", err)
+		}
+		walFile, err := os.OpenFile(walPath, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0o600)
+		if err != nil {
+			return fmt.Errorf("failed to open WAL file %s: %w", walPath, err)
+		}
+		db.walFile = walFile
+		walHead := Header{
+			Lineage:      db.GetOrInitLineage(),
+			Serial:       db.Data.Serial + 1,
+			StateVersion: currentStateVersion,
+			CLIVersion:   build.GetInfo().Version,
+		}
+		if err := appendJSONLine(db.walFile, walHead); err != nil {
+			// Remove the WAL created just above: O_EXCL means it is ours, and
+			// without a header it carries nothing to recover. Leaving it makes
+			// every later open fail, with recovery on the header parse and
+			// without it on the unexpected WAL file.
+			db.walFile.Close()
+			db.walFile = nil
+			os.Remove(walPath)
+			return fmt.Errorf("failed to write WAL header to %s: %w", walPath, err)
+		}
+	}
+
+	return nil
+}
+
+// OpenWithData initializes the state from an in-memory database without reading from disk.
+// The state is opened in read mode; call UpgradeToWrite to transition to write mode.
+func (db *DeploymentState) OpenWithData(path string, data Database) {
+	db.mu.Lock()
+	defer db.mu.Unlock()
+
+	if db.Path != "" {
+		panic(fmt.Sprintf("state already opened: %v, cannot open %v", db.Path, path))
+	}
+
 	db.Path = path
+	db.Data = data
+	db.stateIDs = make(map[string]string)
+	for key, entry := range data.State {
+		db.stateIDs[key] = entry.ID
+	}
+}
+
+func (db *DeploymentState) replayWAL(ctx context.Context) error {
+	walPath := db.Path + walSuffix
+	hasEntries, err := db.mergeWalIntoState(ctx)
+	if err != nil {
+		if errors.Is(err, errStaleWAL) {
+			log.Debugf(ctx, "Deleting stale WAL file %s", walPath)
+			_ = os.Remove(walPath)
+			return nil
+		}
+		return fmt.Errorf("WAL recovery failed: %w", err)
+	}
+	if hasEntries {
+		if err := db.unlockedSave(); err != nil {
+			return err
+		}
+	}
+	if err := os.Remove(walPath); err != nil {
+		return fmt.Errorf("failed to remove WAL file %s: %w", walPath, err)
+	}
 	return nil
 }
 
-func (db *DeploymentState) Finalize() error {
+func (db *DeploymentState) mergeWalIntoState(ctx context.Context) (bool, error) {
+	if db.walFile != nil {
+		panic("internal error: walFile must be closed")
+	}
+
+	walPath := db.Path + walSuffix
+	walFile, err := os.Open(walPath)
+	if err != nil {
+		return false, fmt.Errorf("failed to open WAL file %s: %w", walPath, err)
+	}
+	defer walFile.Close()
+
+	scanner := bufio.NewScanner(walFile)
+	scanner.Buffer(make([]byte, 0, initialBufferSize), maxWalEntrySize)
+	lineNumber := 0
+	var corruptedLines [][]byte
+	var (
+		newSerial     int
+		newCLIVersion string
+	)
+
+	for scanner.Scan() {
+		lineNumber++
+		line := scanner.Bytes()
+		if lineNumber == 1 {
+			var header Header
+			if err := json.Unmarshal(line, &header); err != nil {
+				return false, fmt.Errorf("failed to parse WAL header: %w", err)
+			}
+
+			if db.Data.Lineage == "" && header.Lineage != "" {
+				db.Data.Lineage = header.Lineage
+			} else if db.Data.Lineage != header.Lineage {
+				return false, fmt.Errorf("WAL lineage (%q) does not match state lineage (%q)", header.Lineage, db.Data.Lineage)
+			}
+
+			expectedSerial := db.Data.Serial + 1
+			if header.Serial < expectedSerial {
+				return false, errStaleWAL
+			}
+			if header.Serial > expectedSerial {
+				return false, fmt.Errorf("WAL serial (%d) is ahead of expected (%d), state may be corrupted", header.Serial, expectedSerial)
+			}
+			newSerial = header.Serial
+			newCLIVersion = header.CLIVersion
+		} else {
+			var entry WALEntry
+			if err := json.Unmarshal(line, &entry); err != nil {
+				log.Warnf(ctx, "Skipping corrupted WAL entry at %s:%d: %v", walPath, lineNumber, err)
+				corruptedLines = append(corruptedLines, append([]byte(nil), line...))
+				continue
+			}
+			if db.Data.State == nil {
+				db.Data.State = make(map[string]ResourceEntry)
+			}
+			if entry.Value == nil {
+				delete(db.Data.State, entry.Key)
+				delete(db.stateIDs, entry.Key)
+			} else {
+				db.Data.State[entry.Key] = *entry.Value
+				db.stateIDs[entry.Key] = entry.Value.ID
+			}
+		}
+	}
+
+	if err := scanner.Err(); err != nil {
+		return false, err
+	}
+
+	if len(corruptedLines) > 0 {
+		corruptedPath := walPath + ".corrupted"
+		corruptedData := bytes.Join(corruptedLines, []byte("\n"))
+		if writeErr := os.WriteFile(corruptedPath, corruptedData, 0o600); writeErr != nil {
+			log.Warnf(ctx, "Failed to save corrupted WAL entries to %s: %v", corruptedPath, writeErr)
+		} else {
+			log.Warnf(ctx, "Saved %d corrupted WAL entries to %s", len(corruptedLines), corruptedPath)
+		}
+	}
+
+	hasEntries := lineNumber > 1
+
+	// Only advance the serial when the WAL carried entries, because the caller
+	// (replayWAL) persists the new state file only in that case. A header-only
+	// WAL is a deploy that started but committed nothing; advancing the serial
+	// for it leaves the in-memory serial ahead of the persisted one, so the
+	// next deploy writes its WAL header at serial+2 and recovery rejects it as
+	// "ahead of expected". See acceptance/bundle/deploy/wal/header-only-wal.
+	//
+	// The CLI version moves with the serial for the same reason: it records the
+	// CLI that last wrote the state, so it is only accurate once that write is
+	// persisted. Without this the field keeps the version of the CLI that first
+	// created the state, no matter how many times a newer CLI deploys over it.
+	if hasEntries {
+		db.Data.Serial = newSerial
+		db.Data.CLIVersion = newCLIVersion
+	}
+
+	return hasEntries, nil
+}
+
+// Finalize replays the WAL (if open for write), captures the resulting state, and resets.
+// Safe to call multiple times or on an already-finalized state.
+// Returns the exported state as of the end of this operation.
+func (db *DeploymentState) Finalize(ctx context.Context) (resourcestate.ExportedResourcesMap, error) {
 	db.mu.Lock()
 	defer db.mu.Unlock()
 
-	// Generate lineage on first save
-	if db.Data.Lineage == "" {
-		db.Data.Lineage = uuid.New().String()
+	if db.Path == "" {
+		return nil, nil
 	}
 
-	db.Data.Serial++
+	var err error
 
+	if db.walFile != nil {
+		closeErr := db.walFile.Close()
+		if closeErr != nil {
+			log.Warnf(ctx, "Error when closing .wal file, possibly corrupted state file: %s", closeErr)
+		}
+		db.walFile = nil
+		err = db.replayWAL(ctx)
+	} else if db.openedForWrite && db.isDeploymentMetadataService() {
+		// replayWAL is what normally persists the file. Without one, write the tombstone here so
+		// the header (lineage, state version, CLI version) still lands on disk - even when no
+		// operations were recorded, since the deployment and any version this run created exist
+		// either way.
+		err = db.unlockedSave()
+	}
+
+	// Wait until all operations are recorded in the service.
+	if db.isDeploymentMetadataService() && db.operationBuffer != nil {
+		if drainErr := db.operationBuffer.Drain(); drainErr != nil {
+			err = errors.Join(err, drainErr)
+		}
+	}
+
+	state := ExportStateFromData(db.Data)
+
+	db.reset()
+
+	return state, err
+}
+
+// UpgradeToWrite transitions from read mode to write mode without re-reading state.
+// State must already be open for read. This initializes the WAL for writing.
+func (db *DeploymentState) UpgradeToWrite() error {
+	db.mu.Lock()
+	defer db.mu.Unlock()
+
+	if db.Path == "" {
+		return errors.New("internal error: DeploymentState must be opened first")
+	}
+	if db.openedForWrite {
+		return errors.New("internal error: DeploymentState is already open for write")
+	}
+	db.openedForWrite = true
+
+	// As in Open: a recorded deployment writes no WAL, so stamp the header and skip the file.
+	if db.isDeploymentMetadataService() {
+		db.Data.Lineage = db.GetOrInitLineage()
+		db.Data.StateVersion = currentStateVersion
+		db.Data.CLIVersion = build.GetInfo().Version
+		return nil
+	}
+
+	walPath := db.Path + walSuffix
+	if err := os.MkdirAll(filepath.Dir(walPath), 0o755); err != nil {
+		return fmt.Errorf("failed to create state directory: %w", err)
+	}
+	walFile, err := os.OpenFile(walPath, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0o600)
+	if err != nil {
+		return fmt.Errorf("failed to open WAL file %s: %w", walPath, err)
+	}
+	db.walFile = walFile
+
+	walHead := Header{
+		Lineage:      db.GetOrInitLineage(),
+		Serial:       db.Data.Serial + 1,
+		StateVersion: currentStateVersion,
+		CLIVersion:   build.GetInfo().Version,
+	}
+	return appendJSONLine(db.walFile, walHead)
+}
+
+// Persist writes the current in-memory state to its file immediately, without a WAL cycle.
+// Used to materialize a freshly opened state that produces no WAL entries - e.g. an empty
+// migrated state - as a base file on disk, so a later write has a base and Finalize's
+// header-only WAL leaves it intact.
+func (db *DeploymentState) Persist() error {
+	db.mu.Lock()
+	defer db.mu.Unlock()
 	return db.unlockedSave()
 }
 
-func (db *DeploymentState) AssertOpened() {
+// IsOpen reports whether the state has been opened (for read or write). It lets
+// callers probe the state without risking the panic in AssertOpenedForReadOrWrite,
+// e.g. code paths shared with the terraform engine where the state DB is never opened.
+func (db *DeploymentState) IsOpen() bool {
+	return db.Path != ""
+}
+
+func (db *DeploymentState) AssertOpenedForReadOrWrite() {
 	if db.Path == "" {
 		panic("internal error: DeploymentState must be opened first")
 	}
 }
 
-func (db *DeploymentState) ExportState(ctx context.Context) resourcestate.ExportedResourcesMap {
+func (db *DeploymentState) AssertOpenedForRead() {
+	db.AssertOpenedForReadOrWrite()
+	if db.openedForWrite {
+		panic("internal error: DeploymentState must be opened in read mode")
+	}
+}
+
+func (db *DeploymentState) AssertOpenedForWrite() {
+	db.AssertOpenedForReadOrWrite()
+	if !db.openedForWrite {
+		panic("internal error: DeploymentState must be opened in write mode")
+	}
+}
+
+// ExportStateFromData extracts resource IDs and ETags from a database snapshot.
+func ExportStateFromData(data Database) resourcestate.ExportedResourcesMap {
 	result := make(resourcestate.ExportedResourcesMap)
-	for key, entry := range db.Data.State {
+	for key, entry := range data.State {
+		// Match on the exact resource type, not a substring of the key, so a
+		// sub-resource entry like resources.<group>.<name>.permissions is not
+		// mistaken for the resource itself.
+		resourceType := config.GetResourceTypeFromKey(key)
+
 		var etag string
-		// Extract etag for dashboards.
-		// covered by test case: bundle/deploy/dashboard/detect-change
-		if strings.Contains(key, ".dashboards.") && len(entry.State) > 0 {
+		// Extract etag for resources that use it for drift detection
+		// (dashboards and genie_spaces). Both follow the same pattern of
+		// persisting the backend-returned etag in state and comparing it
+		// against the remote on the next plan via OverrideChangeDesc.
+		// covered by test cases:
+		//   - bundle/deploy/dashboard/detect-change
+		//   - bundle/resources/genie_spaces/simple
+		if (resourceType == "dashboards" || resourceType == "genie_spaces") && len(entry.State) > 0 {
 			var holder struct {
 				Etag string `json:"etag"`
 			}
@@ -177,31 +941,82 @@ func (db *DeploymentState) ExportState(ctx context.Context) resourcestate.Export
 			}
 		}
 
+		// Persist a run's resolved job_id so read-only commands can build its
+		// URL; in config it is a deploy-time-only ${resources.jobs.*.id} reference.
+		var jobID int64
+		if resourceType == "job_runs" && len(entry.State) > 0 {
+			var holder struct {
+				JobID int64 `json:"job_id"`
+			}
+			if err := json.Unmarshal(entry.State, &holder); err == nil {
+				jobID = holder.JobID
+			}
+		}
+
 		result[key] = resourcestate.ResourceState{
-			ID:   entry.ID,
-			ETag: etag,
+			ID:             entry.ID,
+			ETag:           etag,
+			JobID:          jobID,
+			StateSizeBytes: len(entry.State),
 		}
 	}
 	return result
 }
 
+func (db *DeploymentState) ExportState(ctx context.Context) resourcestate.ExportedResourcesMap {
+	return ExportStateFromData(db.Data)
+}
+
+// unlockedSave persists the in-memory state to db.Path by writing a temp file in
+// the same directory and renaming it over the destination, so an interrupted save
+// cannot leave a half-written state file behind.
+//
+// Writing in place would be unrecoverable: replayWAL saves the merged state and
+// only then removes the WAL, and Open parses the state file before it looks at
+// the WAL. A torn write would therefore leave a state file that Open rejects
+// next to an intact WAL it never reads.
 func (db *DeploymentState) unlockedSave() error {
-	db.AssertOpened()
-	data, err := json.MarshalIndent(db.Data, "", " ")
+	data, err := json.MarshalIndent(db.dataForFile(), "", " ")
 	if err != nil {
 		return err
 	}
 
-	// Create parent directories if they don't exist
-	dir := filepath.Dir(db.Path)
-	if err := os.MkdirAll(dir, 0o755); err != nil {
-		return fmt.Errorf("failed to create directory %#v: %w", dir, err)
+	if err := atomicfile.Write(db.Path, data, 0o600, atomicfile.MkDir(0o755)); err != nil {
+		return fmt.Errorf("failed to save resources state to %#v: %w", db.Path, err)
+	}
+
+	return nil
+}
+
+// Data to persist in the remote resources.json file.
+func (db *DeploymentState) dataForFile() Database {
+	if db.isDeploymentMetadataService() {
+		header := db.Data.Header
+		if header.Features == nil {
+			header.Features = make(map[string]struct{})
+		}
+		header.Features[FeatureDeploymentHistory] = struct{}{}
+		// Store a copy of the current version to ensure outdated resource state is not read.
+		// Open still takes the authoritative version from the service.
+		header.Serial = db.VersionID
+
+		return Database{
+			Header: header,
+			State:  map[string]ResourceEntry{},
+		}
 	}
 
-	err = os.WriteFile(db.Path, data, 0o600)
+	return db.Data
+}
+
+func appendJSONLine(file *os.File, obj any) error {
+	data, err := json.Marshal(obj)
 	if err != nil {
-		return fmt.Errorf("failed to save resources state to %#v: %w", db.Path, err)
+		return err
 	}
+	data = append(data, '\n')
 
-	return nil
+	_, err = file.Write(data)
+	// no fsync here, not needed
+	return err
 }
diff --git a/bundle/direct/dstate/state_test.go b/bundle/direct/dstate/state_test.go
index acd2a9e5336..72ec263f7b7 100644
--- a/bundle/direct/dstate/state_test.go
+++ b/bundle/direct/dstate/state_test.go
@@ -1,53 +1,418 @@
 package dstate
 
 import (
+	"encoding/json"
+	"os"
 	"path/filepath"
 	"testing"
 
+	"github.com/databricks/cli/internal/build"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/testserver"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/service/bundledeployments"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
+func mustFinalize(t *testing.T, db *DeploymentState) {
+	t.Helper()
+	_, err := db.Finalize(t.Context())
+	require.NoError(t, err)
+}
+
 func TestOpenSaveFinalizeRoundTrip(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "state.json")
 
 	var db DeploymentState
-	require.NoError(t, db.Open(path))
+	require.NoError(t, db.Open(t.Context(), path, WithRecovery(true), WithWrite(true), WithDeploymentHistory(false), OpenDmsArgs{}))
 
-	require.NoError(t, db.SaveState("jobs.my_job", "123", map[string]string{"key": "val"}, nil))
-	require.NoError(t, db.Finalize())
+	require.NoError(t, db.SaveState(t.Context(), "jobs.my_job", "123", map[string]string{"key": "val"}, nil))
+	mustFinalize(t, &db)
 
 	// Re-open and verify persisted data.
 	var db2 DeploymentState
-	require.NoError(t, db2.Open(path))
+	require.NoError(t, db2.Open(t.Context(), path, WithRecovery(false), WithWrite(false), WithDeploymentHistory(false), OpenDmsArgs{}))
 	assert.Equal(t, 1, db2.Data.Serial)
 	assert.Equal(t, "123", db2.GetResourceID("jobs.my_job"))
+	mustFinalize(t, &db2)
+}
+
+func TestFinalizeWithNoEntriesDoesNotWriteStateFile(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "state.json")
+
+	var db DeploymentState
+	require.NoError(t, db.Open(t.Context(), path, WithRecovery(true), WithWrite(true), WithDeploymentHistory(false), OpenDmsArgs{}))
+	mustFinalize(t, &db)
+
+	_, err := os.Stat(path)
+	assert.ErrorIs(t, err, os.ErrNotExist)
+}
+
+func TestDataForFileSerial(t *testing.T) {
+	tests := []struct {
+		name       string
+		recording  bool
+		versionID  int
+		wantSerial int
+	}{
+		{name: "direct state keeps its serial", versionID: 7, wantSerial: 3},
+		{name: "recorded state caches the current version", recording: true, versionID: 7, wantSerial: 7},
+		{name: "no recorded version omits the serial", recording: true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			db := DeploymentState{
+				Data:           NewDatabase("test-lineage", 3),
+				recordsHistory: tt.recording,
+				VersionID:      tt.versionID,
+			}
+			db.Data.State["resources.jobs.foo"] = ResourceEntry{ID: "123", State: json.RawMessage(`{"name":"foo"}`)}
+
+			snapshot := db.dataForFile()
+			assert.Equal(t, tt.wantSerial, snapshot.Serial)
+			assert.Equal(t, 3, db.Data.Serial)
+			assert.Len(t, db.Data.State, 1)
+			if tt.recording {
+				assert.Empty(t, snapshot.State)
+				assert.Contains(t, snapshot.Features, FeatureDeploymentHistory)
+			} else {
+				assert.Equal(t, db.Data.State, snapshot.State)
+			}
+			data, err := json.Marshal(snapshot)
+			require.NoError(t, err)
+			if tt.wantSerial == 0 {
+				assert.NotContains(t, string(data), `"serial"`)
+			}
+		})
+	}
+}
+
+func TestOpenUsesDMSVersionForSerial(t *testing.T) {
+	server := testserver.New(t)
+	server.Handle("GET", "/api/2.0/bundle/deployments/123/resources", func(req testserver.Request) any {
+		return bundledeployments.ListResourcesResponse{}
+	})
+	testserver.AddDefaultHandlers(server)
+	client, err := databricks.NewWorkspaceClient(&databricks.Config{Host: server.URL, Token: "testtoken"})
+	require.NoError(t, err)
+
+	tests := []struct {
+		name          string
+		omitSerial    bool
+		fileSerial    int
+		unmarked      bool
+		deploymentID  string
+		lastVersionID int
+		wantErr       string
+	}{
+		{
+			name:          "legacy missing serial",
+			omitSerial:    true,
+			deploymentID:  "123",
+			lastVersionID: 7,
+		},
+		{
+			name:          "legacy zero serial",
+			deploymentID:  "123",
+			lastVersionID: 7,
+		},
+		{
+			name:          "serial copy behind service",
+			fileSerial:    2,
+			deploymentID:  "123",
+			lastVersionID: 7,
+		},
+		{
+			name:          "serial copy equal to service",
+			fileSerial:    7,
+			deploymentID:  "123",
+			lastVersionID: 7,
+		},
+		{
+			name:          "serial copy ahead of service",
+			fileSerial:    99,
+			deploymentID:  "123",
+			lastVersionID: 7,
+			wantErr:       "resource state serial (99) is ahead of deployment history version (7)",
+		},
+		{
+			name: "no deployment has version zero",
+		},
+		{
+			name:       "positive serial copy without deployment",
+			fileSerial: 99,
+			wantErr:    "resource state serial (99) is ahead of deployment history version (0)",
+		},
+		{
+			name:         "positive serial copy without recorded version",
+			fileSerial:   1,
+			deploymentID: "123",
+			wantErr:      "resource state serial (1) is ahead of deployment history version (0)",
+		},
+		{
+			name:          "unmarked serial can be ahead of service",
+			fileSerial:    99,
+			unmarked:      true,
+			deploymentID:  "123",
+			lastVersionID: 7,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			path := filepath.Join(t.TempDir(), "resources.json")
+			seed := map[string]any{
+				"state_version": currentStateVersion,
+				"lineage":       "test-lineage",
+				"features":      map[string]struct{}{FeatureDeploymentHistory: {}},
+				"state":         map[string]ResourceEntry{},
+			}
+			if !tt.omitSerial {
+				seed["serial"] = tt.fileSerial
+			}
+			if tt.unmarked {
+				delete(seed, "features")
+			}
+			data, err := json.Marshal(seed)
+			require.NoError(t, err)
+			require.NoError(t, os.WriteFile(path, data, 0o600))
+
+			ctx := cmdctx.SetWorkspaceClient(t.Context(), client)
+			var db DeploymentState
+			err = db.Open(ctx, path, WithRecovery(false), WithWrite(false), WithDeploymentHistory(true), OpenDmsArgs{
+				DeploymentID: tt.deploymentID, LastVersionID: tt.lastVersionID,
+			})
+			if tt.wantErr != "" {
+				require.EqualError(t, err, "inconsistent deployment state: "+tt.wantErr)
+				assert.False(t, db.IsOpen())
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tt.lastVersionID, db.GetSerial())
+			mustFinalize(t, &db)
+		})
+	}
+}
+
+func TestExportStateFromDataJobRunJobID(t *testing.T) {
+	data := Database{
+		State: map[string]ResourceEntry{
+			"resources.job_runs.my_run": {
+				ID:    "456",
+				State: json.RawMessage(`{"job_id": 123}`),
+			},
+			// A permissions sub-resource entry shares the ".job_runs." infix but
+			// is not a run. Its state even carries a job_id to prove we match on
+			// the exact resource type, not a substring of the key.
+			"resources.job_runs.my_run.permissions": {
+				ID:    "456",
+				State: json.RawMessage(`{"job_id": 999}`),
+			},
+		},
+	}
+
+	result := ExportStateFromData(data)
+
+	assert.Equal(t, int64(123), result["resources.job_runs.my_run"].JobID)
+	assert.Equal(t, int64(0), result["resources.job_runs.my_run.permissions"].JobID)
+}
+
+func TestExportStateFromDataDashboardEtag(t *testing.T) {
+	data := Database{
+		State: map[string]ResourceEntry{
+			"resources.dashboards.my_dash": {
+				ID:    "abc",
+				State: json.RawMessage(`{"etag": "v1"}`),
+			},
+			// A permissions sub-resource entry shares the ".dashboards." infix but
+			// is not a dashboard; its etag must not be lifted onto it.
+			"resources.dashboards.my_dash.permissions": {
+				ID:    "abc",
+				State: json.RawMessage(`{"etag": "v2"}`),
+			},
+		},
+	}
+
+	result := ExportStateFromData(data)
+
+	assert.Equal(t, "v1", result["resources.dashboards.my_dash"].ETag)
+	assert.Empty(t, result["resources.dashboards.my_dash.permissions"].ETag)
 }
 
 func TestPanicOnDoubleOpen(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "state.json")
 
 	var db DeploymentState
-	require.NoError(t, db.Open(path))
+	require.NoError(t, db.Open(t.Context(), path, WithRecovery(true), WithWrite(true), WithDeploymentHistory(false), OpenDmsArgs{}))
 
 	assert.Panics(t, func() {
-		_ = db.Open(path)
+		_ = db.Open(t.Context(), path, WithRecovery(true), WithWrite(true), WithDeploymentHistory(false), OpenDmsArgs{})
 	})
+	mustFinalize(t, &db)
 }
 
-func TestDeleteState(t *testing.T) {
+// TestCLIVersionRecordsLastWriter pins that cli_version tracks the CLI that last
+// wrote the state, not the one that created it. Previously the field was only set
+// when the state was first created: the WAL header carried the deploying CLI's
+// version but replay dropped it, so a state stayed pinned to its original writer
+// no matter how many times a newer CLI deployed over it.
+func TestCLIVersionRecordsLastWriter(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "state.json")
+
+	// A state written by some older CLI.
+	seed := `{"state_version":2,"cli_version":"0.1.2","lineage":"test-lineage","serial":1,"state":{}}`
+	require.NoError(t, os.WriteFile(path, []byte(seed), 0o600))
+
+	var db DeploymentState
+	require.NoError(t, db.Open(t.Context(), path, WithRecovery(true), WithWrite(true), WithDeploymentHistory(false), OpenDmsArgs{}))
+	require.NoError(t, db.SaveState(t.Context(), "resources.jobs.my_job", "123", map[string]string{"k": "v"}, nil))
+	mustFinalize(t, &db)
+
+	var reopened DeploymentState
+	require.NoError(t, reopened.Open(t.Context(), path, WithRecovery(false), WithWrite(false), WithDeploymentHistory(false), OpenDmsArgs{}))
+	assert.Equal(t, build.GetInfo().Version, reopened.Data.CLIVersion)
+	assert.Equal(t, 2, reopened.Data.Serial)
+	mustFinalize(t, &reopened)
+}
+
+// TestHeaderOnlyWALDoesNotUpdateCLIVersion is the counterpart to the serial
+// invariant below: a deploy that commits nothing does not persist a state file,
+// so it must not claim to have written one.
+func TestHeaderOnlyWALDoesNotUpdateCLIVersion(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "state.json")
+	walPath := path + walSuffix
 
+	seed := `{"state_version":2,"cli_version":"0.1.2","lineage":"test-lineage","serial":1,"state":{}}`
+	require.NoError(t, os.WriteFile(path, []byte(seed), 0o600))
+
+	header := Header{Lineage: "test-lineage", Serial: 2, StateVersion: currentStateVersion, CLIVersion: build.GetInfo().Version}
+	headerLine, err := json.Marshal(header)
+	require.NoError(t, err)
+	require.NoError(t, os.WriteFile(walPath, append(headerLine, '\n'), 0o600))
+
+	var recovered DeploymentState
+	require.NoError(t, recovered.Open(t.Context(), path, WithRecovery(true), WithWrite(false), WithDeploymentHistory(false), OpenDmsArgs{}))
+	assert.Equal(t, "0.1.2", recovered.Data.CLIVersion, "a header-only WAL wrote no state, so the version must not move")
+	assert.Equal(t, 1, recovered.Data.Serial)
+	mustFinalize(t, &recovered)
+}
+
+func TestHeaderOnlyWALRecoveryDoesNotAdvanceSerial(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "state.json")
+	walPath := path + walSuffix
+
+	// Commit serial 1 with one resource.
 	var db DeploymentState
-	require.NoError(t, db.Open(path))
-	require.NoError(t, db.SaveState("jobs.my_job", "123", map[string]string{}, nil))
-	require.NoError(t, db.Finalize())
+	require.NoError(t, db.Open(t.Context(), path, WithRecovery(true), WithWrite(true), WithDeploymentHistory(false), OpenDmsArgs{}))
+	require.NoError(t, db.SaveState(t.Context(), "jobs.my_job", "123", map[string]string{}, nil))
+	mustFinalize(t, &db)
+
+	var committed DeploymentState
+	require.NoError(t, committed.Open(t.Context(), path, WithRecovery(false), WithWrite(false), WithDeploymentHistory(false), OpenDmsArgs{}))
+	lineage := committed.Data.Lineage
+	require.Equal(t, 1, committed.Data.Serial)
+	mustFinalize(t, &committed)
+
+	// A deploy that opens the WAL for write but commits nothing (e.g. planning
+	// fails after UpgradeToWrite) leaves a header-only WAL behind, here at the
+	// expected serial 2. Recovering it must not advance the serial past the
+	// committed 1, otherwise a second such failed deploy would write its header
+	// at serial 3 and be rejected as ahead of the committed state.
+	header := Header{Lineage: lineage, Serial: 2, StateVersion: currentStateVersion}
+	headerLine, err := json.Marshal(header)
+	require.NoError(t, err)
+	require.NoError(t, os.WriteFile(walPath, append(headerLine, '\n'), 0o600))
+
+	var recovered DeploymentState
+	require.NoError(t, recovered.Open(t.Context(), path, WithRecovery(true), WithWrite(false), WithDeploymentHistory(false), OpenDmsArgs{}))
+	assert.Equal(t, 1, recovered.Data.Serial)
+	assert.Equal(t, "123", recovered.GetResourceID("jobs.my_job"))
+	assert.NoFileExists(t, walPath)
+	mustFinalize(t, &recovered)
+}
+
+func TestEmptyFeatureStateAcceptedWithoutFlippingVersion(t *testing.T) {
+	empty := &Database{StateVersion: 3}
+	require.NoError(t, migrateState(empty))
+	assert.Equal(t, 3, empty.StateVersion, "v3 + no features keeps its on-disk version, not flipped to v2")
+
+	// Version 3 states with unknown features must still be refused.
+	withFeature := &Database{
+		StateVersion: 3,
+		Features:     map[string]struct{}{"future_feature": {}},
+	}
+	err := migrateState(withFeature)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "requires features this CLI does not support")
+	assert.Contains(t, err.Error(), "future_feature")
+	assert.Contains(t, err.Error(), "upgrade to the latest CLI version")
+	assert.Contains(t, err.Error(), featuresDocURL)
+}
+
+func TestDeleteState(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "state.json")
 
-	require.NoError(t, db.DeleteState("jobs.my_job"))
-	require.NoError(t, db.Finalize())
+	var db DeploymentState
+	require.NoError(t, db.Open(t.Context(), path, WithRecovery(true), WithWrite(true), WithDeploymentHistory(false), OpenDmsArgs{}))
+	require.NoError(t, db.SaveState(t.Context(), "jobs.my_job", "123", map[string]string{}, nil))
+	mustFinalize(t, &db)
 
 	var db2 DeploymentState
-	require.NoError(t, db2.Open(path))
-	assert.Equal(t, 2, db2.Data.Serial)
-	assert.Equal(t, "", db2.GetResourceID("jobs.my_job"))
+	require.NoError(t, db2.Open(t.Context(), path, WithRecovery(true), WithWrite(true), WithDeploymentHistory(false), OpenDmsArgs{}))
+	require.NoError(t, db2.DeleteState(t.Context(), "jobs.my_job", false))
+	mustFinalize(t, &db2)
+
+	var db3 DeploymentState
+	require.NoError(t, db3.Open(t.Context(), path, WithRecovery(false), WithWrite(false), WithDeploymentHistory(false), OpenDmsArgs{}))
+	assert.Equal(t, 2, db3.Data.Serial)
+	assert.Empty(t, db3.GetResourceID("jobs.my_job"))
+	mustFinalize(t, &db3)
+}
+
+func TestGetOrInitLineageReadableBeforeWriteAndPersisted(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "state.json")
+
+	// Fresh state opened read-only, as the deploy does before planning: no
+	// lineage yet.
+	var db DeploymentState
+	require.NoError(t, db.Open(t.Context(), path, WithRecovery(true), WithWrite(false), WithDeploymentHistory(false), OpenDmsArgs{}))
+	require.Empty(t, db.Data.Lineage)
+
+	// GetOrInitLineage initializes the lineage and makes it readable before any
+	// write (i.e. before planning), and is stable across calls.
+	lineage := db.GetOrInitLineage()
+	require.NotEmpty(t, lineage)
+	require.Equal(t, lineage, db.GetOrInitLineage())
+
+	// Upgrading to write reuses the same lineage (it goes into the WAL header),
+	// and a write makes it durable.
+	require.NoError(t, db.UpgradeToWrite())
+	require.NoError(t, db.SaveState(t.Context(), "jobs.my_job", "123", map[string]string{}, nil))
+	mustFinalize(t, &db)
+
+	// Re-open: the persisted lineage matches the one read before the write.
+	var reopened DeploymentState
+	require.NoError(t, reopened.Open(t.Context(), path, WithRecovery(false), WithWrite(false), WithDeploymentHistory(false), OpenDmsArgs{}))
+	assert.Equal(t, lineage, reopened.Data.Lineage)
+	mustFinalize(t, &reopened)
+}
+
+// TestOpenFailureLeavesStateClosed pins that a failed Open leaves the receiver
+// closed. Open assigns db.Path before the steps that can fail, so an unreadable
+// state file used to leave Path set: the next Open on the same value panicked
+// with "state already opened" instead of reporting the real error.
+func TestOpenFailureLeavesStateClosed(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "state.json")
+	require.NoError(t, os.WriteFile(path, []byte("{not json"), 0o600))
+
+	var db DeploymentState
+	require.Error(t, db.Open(t.Context(), path, WithRecovery(true), WithWrite(true), WithDeploymentHistory(false), OpenDmsArgs{}))
+	assert.Empty(t, db.Path)
+
+	// Once the state file is readable, the same receiver opens without panicking.
+	seed := `{"state_version":2,"cli_version":"0.1.2","lineage":"test-lineage","serial":1,"state":{}}`
+	require.NoError(t, os.WriteFile(path, []byte(seed), 0o600))
+	require.NoError(t, db.Open(t.Context(), path, WithRecovery(true), WithWrite(true), WithDeploymentHistory(false), OpenDmsArgs{}))
+	assert.Equal(t, "test-lineage", db.Data.Lineage)
+	mustFinalize(t, &db)
 }
diff --git a/bundle/direct/maxwait.go b/bundle/direct/maxwait.go
new file mode 100644
index 00000000000..6a9fff26ac9
--- /dev/null
+++ b/bundle/direct/maxwait.go
@@ -0,0 +1,96 @@
+package direct
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+	"time"
+
+	bundleenv "github.com/databricks/cli/bundle/env"
+	"github.com/databricks/cli/libs/dagrun"
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/databricks-sdk-go/retries"
+)
+
+// maxWaitUnset means "no cap configured", which must stay distinguishable from an explicit
+// 0 ("do not wait at all").
+const maxWaitUnset = time.Duration(-1)
+
+// resourceMaxWait returns the cap on waiting for a resource to reach its target state, or
+// maxWaitUnset when the environment variable is absent. Unlike the retry interval, a malformed
+// value is an error rather than a silent fallback: ignoring a typo would restore the
+// multi-hour default wait that the user was trying to shorten.
+func resourceMaxWait(ctx context.Context) (time.Duration, error) {
+	v, ok := bundleenv.ResourceMaxWait(ctx)
+	if !ok {
+		return maxWaitUnset, nil
+	}
+	seconds, err := strconv.Atoi(v)
+	if err != nil || seconds < 0 {
+		return maxWaitUnset, fmt.Errorf("invalid %s=%q: expected a non-negative number of seconds", bundleenv.ResourceMaxWaitVariable, v)
+	}
+	return time.Duration(seconds) * time.Second, nil
+}
+
+// hasBlockingDependents reports whether any node that runs after resourceKey needs it to have
+// reached its target state.
+//
+// Child nodes (.permissions, .grants) are excluded: they reference nothing but the parent's id
+// (see PrepareGrantsInputConfig and PreparePermissionsInputConfig), which DoCreate returns
+// before the wait even starts, so they attach to a resource that exists but is not yet
+// provisioned. Only a 4-segment key can have a 3-segment resource key as its prefix, so the
+// prefix test cannot match a sibling.
+func hasBlockingDependents(g *dagrun.Graph, resourceKey string) bool {
+	for _, edge := range g.Adj[resourceKey] {
+		if !strings.HasPrefix(edge.To, resourceKey+".") {
+			return true
+		}
+	}
+	return false
+}
+
+// waitCapped runs wait under maxWait. When the cap expires the wait is abandoned with a
+// warning instead of failing the deployment: state is written before the wait, so the
+// resource stays tracked and the next plan reconciles it. Genuine failures still propagate,
+// since retries reports those without a timeout error.
+func waitCapped[T any](ctx context.Context, maxWait time.Duration, description string, wait func(context.Context) (T, error)) (T, error) {
+	if maxWait == maxWaitUnset {
+		return wait(ctx)
+	}
+
+	if maxWait == 0 {
+		// Skip the call rather than starting a poll that is already out of time, which would
+		// spend one request to learn what the caller has already said it does not care about.
+		log.Warnf(ctx, "Not waiting for %s (%s=0); it may still be in progress", description, bundleenv.ResourceMaxWaitVariable)
+		var zero T
+		return zero, nil
+	}
+
+	waitCtx, cancel := context.WithTimeout(ctx, maxWait)
+	defer cancel()
+
+	result, err := wait(waitCtx)
+
+	// waitCtx expired but ctx did not: the cap fired rather than the whole deployment being
+	// cancelled, which must keep failing so an interrupt is not swallowed.
+	if err != nil && waitCtx.Err() != nil && ctx.Err() == nil && isWaitTimeout(err) {
+		log.Warnf(ctx, "Stopped waiting for %s after %s (%s); it may still be in progress", description, maxWait, bundleenv.ResourceMaxWaitVariable)
+		var zero T
+		return zero, nil
+	}
+
+	return result, err
+}
+
+// isWaitTimeout reports whether err is a wait that ran out of time rather than a resource
+// that failed. Two shapes reach here: retries.Poll reports a deadline as ErrTimedOut wrapping
+// the last poll message, while retry.With returns a bare context error when the deadline lands
+// while it sleeps between transient-error retries.
+func isWaitTimeout(err error) bool {
+	if _, ok := errors.AsType[*retries.ErrTimedOut](err); ok {
+		return true
+	}
+	return errors.Is(err, context.DeadlineExceeded)
+}
diff --git a/bundle/direct/maxwait_test.go b/bundle/direct/maxwait_test.go
new file mode 100644
index 00000000000..da4fcdeaa43
--- /dev/null
+++ b/bundle/direct/maxwait_test.go
@@ -0,0 +1,168 @@
+package direct
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	bundleenv "github.com/databricks/cli/bundle/env"
+	"github.com/databricks/cli/libs/dagrun"
+	"github.com/databricks/cli/libs/env"
+	"github.com/databricks/databricks-sdk-go/retries"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestResourceMaxWait(t *testing.T) {
+	tests := []struct {
+		name    string
+		value   string
+		set     bool
+		want    time.Duration
+		wantErr string
+	}{
+		{name: "unset", want: maxWaitUnset},
+		{name: "seconds", value: "90", set: true, want: 90 * time.Second},
+		{name: "zero does not wait", value: "0", set: true, want: 0},
+		{name: "typo", value: "6O", set: true, wantErr: `invalid DATABRICKS_BUNDLE_RESOURCE_MAX_WAIT="6O"`},
+		{name: "negative", value: "-5", set: true, wantErr: `invalid DATABRICKS_BUNDLE_RESOURCE_MAX_WAIT="-5"`},
+		{name: "duration syntax is not accepted", value: "1m", set: true, wantErr: `invalid DATABRICKS_BUNDLE_RESOURCE_MAX_WAIT="1m"`},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx := t.Context()
+			if tc.set {
+				ctx = env.Set(ctx, bundleenv.ResourceMaxWaitVariable, tc.value)
+			}
+
+			got, err := resourceMaxWait(ctx)
+			if tc.wantErr != "" {
+				require.ErrorContains(t, err, tc.wantErr)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tc.want, got)
+		})
+	}
+}
+
+// TestWaitCappedAbandonsPoll covers the shape produced by retries.Poll, which every resource
+// wait goes through: the parent deadline wins over the resource's own timeout and surfaces as
+// ErrTimedOut rather than a context error.
+func TestWaitCappedAbandonsPoll(t *testing.T) {
+	polls := 0
+	_, err := waitCapped(t.Context(), 50*time.Millisecond, "test resource", func(ctx context.Context) (any, error) {
+		return retries.Poll(ctx, time.Hour, func() (*struct{}, *retries.Err) {
+			polls++
+			return nil, retries.Continues("still provisioning")
+		})
+	})
+
+	require.NoError(t, err)
+	assert.Positive(t, polls)
+}
+
+// TestWaitCappedAbandonsBareContextError covers the other shape: retry.With returns ctx.Err()
+// directly when the cap lands while it sleeps between transient-error retries.
+func TestWaitCappedAbandonsBareContextError(t *testing.T) {
+	_, err := waitCapped(t.Context(), 20*time.Millisecond, "test resource", waitForCtx)
+	require.NoError(t, err)
+}
+
+func TestWaitCappedPropagatesFailure(t *testing.T) {
+	sentinel := errors.New("index failed to provision")
+
+	_, err := waitCapped(t.Context(), time.Minute, "test resource", func(ctx context.Context) (any, error) {
+		return retries.Poll(ctx, time.Hour, func() (*struct{}, *retries.Err) {
+			return nil, retries.Halt(sentinel)
+		})
+	})
+
+	require.ErrorIs(t, err, sentinel)
+}
+
+// TestWaitCappedPropagatesCancellation asserts the cap does not swallow the deployment being
+// cancelled or timing out as a whole, which would carry on past the user's interrupt.
+func TestWaitCappedPropagatesCancellation(t *testing.T) {
+	t.Run("cancelled", func(t *testing.T) {
+		ctx, cancel := context.WithCancel(t.Context())
+		cancel()
+
+		_, err := waitCapped(ctx, time.Minute, "test resource", waitForCtx)
+		require.ErrorIs(t, err, context.Canceled)
+	})
+
+	t.Run("parent deadline", func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(t.Context(), 20*time.Millisecond)
+		defer cancel()
+
+		// Cap is longer than the parent deadline, so the parent is what expires.
+		_, err := waitCapped(ctx, time.Minute, "test resource", waitForCtx)
+		require.ErrorIs(t, err, context.DeadlineExceeded)
+	})
+}
+
+func TestWaitCappedUnsetAddsNoDeadline(t *testing.T) {
+	_, err := waitCapped(t.Context(), maxWaitUnset, "test resource", func(ctx context.Context) (struct{}, error) {
+		_, ok := ctx.Deadline()
+		assert.False(t, ok, "unset cap must not impose a deadline")
+		return struct{}{}, nil
+	})
+	require.NoError(t, err)
+}
+
+func TestWaitCappedZeroDoesNotWait(t *testing.T) {
+	called := false
+	_, err := waitCapped(t.Context(), 0, "test resource", func(ctx context.Context) (struct{}, error) {
+		called = true
+		return struct{}{}, nil
+	})
+	require.NoError(t, err)
+	assert.False(t, called, "a zero cap must not call the wait at all")
+}
+
+// waitForCtx blocks until the context is done and reports its error, standing in for a wait
+// that never observes its resource becoming ready.
+func waitForCtx(ctx context.Context) (struct{}, error) {
+	<-ctx.Done()
+	return struct{}{}, ctx.Err()
+}
+
+func TestHasBlockingDependents(t *testing.T) {
+	const index = "resources.vector_search_indexes.foo"
+
+	tests := []struct {
+		name  string
+		edges []string
+		want  bool
+	}{
+		{name: "no dependents", want: false},
+		{name: "grants child does not block", edges: []string{index + ".grants"}, want: false},
+		{name: "permissions child does not block", edges: []string{index + ".permissions"}, want: false},
+		{name: "another resource blocks", edges: []string{"resources.jobs.bar"}, want: true},
+		{
+			name:  "child and resource together",
+			edges: []string{index + ".grants", "resources.jobs.bar"},
+			want:  true,
+		},
+		{
+			// A sibling sharing a name prefix is not a child, so it must still block.
+			name:  "name-prefixed sibling blocks",
+			edges: []string{"resources.vector_search_indexes.foobar"},
+			want:  true,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			g := dagrun.NewGraph()
+			g.AddNode(index)
+			for _, to := range tc.edges {
+				g.AddDirectedEdge(index, to, "label")
+			}
+			assert.Equal(t, tc.want, hasBlockingDependents(g, index))
+		})
+	}
+}
diff --git a/bundle/direct/pkg.go b/bundle/direct/pkg.go
index 58b9bc6b4b1..ea7ae1e51b6 100644
--- a/bundle/direct/pkg.go
+++ b/bundle/direct/pkg.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"reflect"
 	"sync"
+	"time"
 
 	"github.com/databricks/cli/bundle/deployplan"
 	"github.com/databricks/cli/bundle/direct/dresources"
@@ -35,6 +36,11 @@ type DeploymentUnit struct {
 
 	// DependsOn lists resources this resource depends on (persisted in state).
 	DependsOn []deployplan.DependsOnEntry
+
+	// MaxWait caps how long to wait for this resource to reach its target state. Must be set
+	// to maxWaitUnset to fall back to the resource's own timeout: the zero value is a valid
+	// cap meaning "do not wait at all". See resourceMaxWait and unitMaxWait.
+	MaxWait time.Duration
 }
 
 // DeploymentBundle holds everything needed to deploy a bundle
@@ -64,7 +70,9 @@ func (d *DeploymentUnit) SetRemoteState(remoteState any) error {
 	return nil
 }
 
+// ExportState exports the current deployment state as a resource map.
+// StateDB must already be open for read before calling this function.
 func (b *DeploymentBundle) ExportState(ctx context.Context) resourcestate.ExportedResourcesMap {
-	b.StateDB.AssertOpened()
+	b.StateDB.AssertOpenedForRead()
 	return b.StateDB.ExportState(ctx)
 }
diff --git a/bundle/direct/redact.go b/bundle/direct/redact.go
new file mode 100644
index 00000000000..b44ab74e7b4
--- /dev/null
+++ b/bundle/direct/redact.go
@@ -0,0 +1,99 @@
+package direct
+
+import (
+	"fmt"
+	"slices"
+
+	"github.com/databricks/cli/bundle/deployplan"
+	"github.com/databricks/cli/bundle/direct/dresources"
+	"github.com/databricks/cli/libs/structs/structaccess"
+	"github.com/databricks/cli/libs/structs/structpath"
+)
+
+const sensitiveRedactedValue = "[redacted]"
+
+// redactSensitiveFields replaces (or zeros) scalar fields in s (a pointer to a typed struct)
+// that the adapter marks as sensitive. replacement is what to set the field to; pass
+// sensitiveRedactedValue for plan output display, or "" for state-file storage.
+func redactSensitiveFields(adapter *dresources.Adapter, s any, replacement string) error {
+	if s == nil {
+		return nil
+	}
+
+	fields := adapter.GetSensitiveFields()
+	for _, field := range fields {
+		path, err := structpath.ParsePath(field)
+		if err != nil {
+			return fmt.Errorf("parsing sensitive field path %q: %w", field, err)
+		}
+
+		fv, err := structaccess.Get(s, path)
+		if err != nil {
+			continue
+		}
+		if fv == nil {
+			// structaccess.Get returns nil for omitempty fields whose value is zero.
+			// Such fields are absent from JSON, so there is nothing to redact or zero.
+			continue
+		}
+		_ = structaccess.Set(s, path, replacement)
+	}
+
+	return nil
+}
+
+// redactStruct replaces sensitive fields with "[redacted]" for display in plan output.
+func redactStruct(adapter *dresources.Adapter, s any) error {
+	return redactSensitiveFields(adapter, s, sensitiveRedactedValue)
+}
+
+// zeroSensitiveFields clears sensitive fields to their zero value for safe storage in
+// the state file. This avoids a false "local change" diff on the next plan (the state
+// stores "" instead of the actual value, so old==new==nil/zero and drift detection
+// falls back to remote comparison via RemoteAlreadySet).
+func zeroSensitiveFields(adapter *dresources.Adapter, s any) error {
+	return redactSensitiveFields(adapter, s, "")
+}
+
+// redactChanges replaces the Old, New, and Remote values in any ChangeDesc whose
+// path is marked sensitive by the adapter, so the plan output does not leak them.
+// Empty/nil values are left as-is (they carry no secret).
+func redactChanges(adapter *dresources.Adapter, changes deployplan.Changes) error {
+	fields := adapter.GetSensitiveFields()
+	for pathString, ch := range changes {
+		if slices.Contains(fields, pathString) {
+			if v, ok := ch.Old.(string); ok && v != "" {
+				ch.Old = sensitiveRedactedValue
+			}
+			if v, ok := ch.New.(string); ok && v != "" {
+				ch.New = sensitiveRedactedValue
+			}
+			if v, ok := ch.Remote.(string); ok && v != "" {
+				ch.Remote = sensitiveRedactedValue
+			}
+		}
+	}
+	return nil
+}
+
+// redactPlanEntry redacts sensitive fields from remote_state and changes of a plan
+// entry. new_state is already redacted before serialization in makePlan.
+func redactPlanEntry(adapter *dresources.Adapter, entry *deployplan.PlanEntry) error {
+	if len(adapter.GetSensitiveFields()) == 0 {
+		return nil
+	}
+
+	if entry.RemoteState != nil {
+		if err := redactStruct(adapter, entry.RemoteState); err != nil {
+			return fmt.Errorf("redacting remote_state: %w", err)
+		}
+	}
+
+	if entry.Changes != nil {
+		if err := redactChanges(adapter, entry.Changes); err != nil {
+			return fmt.Errorf("redacting changes: %w", err)
+		}
+	}
+
+	return nil
+}
diff --git a/bundle/direct/resolve_config.go b/bundle/direct/resolve_config.go
new file mode 100644
index 00000000000..8ce28d710e1
--- /dev/null
+++ b/bundle/direct/resolve_config.go
@@ -0,0 +1,71 @@
+package direct
+
+import (
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/dyn/convert"
+	"github.com/databricks/cli/libs/dyn/dynvar"
+	"github.com/databricks/cli/libs/dyn/jsonloader"
+)
+
+var resourcesPrefix = dyn.MustPathFromString("resources")
+
+// ResolveConfigAgainstState resolves ${resources.*} references within the resource at
+// target so its runner ("bundle run") sees concrete values rather than references. For a
+// reference resources.<group>.<name>.<field>, the value is taken from that resource's
+// persisted state (the source of truth after deploy) when available, falling back to
+// the config for anything not in state. Non-resource references are left untouched, and
+// references that resolve to neither are left as-is rather than failing the command.
+//
+// Only the target resource is resolved: its runner is the sole consumer of resolved
+// config, so resolving other resources is unnecessary work. It is also unsafe — an
+// unrelated resource may reference a resource that was never deployed, whose ${...}.id
+// falls back to an empty config string and then fails int type-checking.
+//
+// The state DB holds fields like the immutable snapshot's full_path that never reach the
+// config, so it must be open.
+func (b *DeploymentBundle) ResolveConfigAgainstState(cfg *config.Root, target dyn.Path) error {
+	return cfg.Mutate(func(root dyn.Value) (dyn.Value, error) {
+		// Fall back to the fully-normalized config so references to fields that are
+		// implied (not explicitly set) still resolve.
+		normalized, _ := convert.Normalize(cfg, root, convert.IncludeMissingFields)
+
+		return dyn.MapByPath(root, target, func(_ dyn.Path, resource dyn.Value) (dyn.Value, error) {
+			return dynvar.Resolve(resource, func(path dyn.Path) (dyn.Value, error) {
+				if !path.HasPrefix(resourcesPrefix) {
+					return dyn.InvalidValue, dynvar.ErrSkipResolution
+				}
+				if v, ok := b.lookupStateField(path); ok {
+					return v, nil
+				}
+				v, err := dyn.GetByPath(normalized, path)
+				if err != nil {
+					return dyn.InvalidValue, dynvar.ErrSkipResolution
+				}
+				return v, nil
+			})
+		})
+	})
+}
+
+// lookupStateField returns the value at resources.<group>.<name>.<field...> from the
+// resource's persisted state, if that resource is in state and holds the field.
+func (b *DeploymentBundle) lookupStateField(path dyn.Path) (dyn.Value, bool) {
+	if len(path) < 4 || path[0].Key() != "resources" {
+		return dyn.InvalidValue, false
+	}
+	resourceKey := "resources." + path[1].Key() + "." + path[2].Key()
+	entry, ok := b.StateDB.GetResourceEntry(resourceKey)
+	if !ok || len(entry.State) == 0 {
+		return dyn.InvalidValue, false
+	}
+	stateVal, err := jsonloader.LoadJSON(entry.State, resourceKey)
+	if err != nil {
+		return dyn.InvalidValue, false
+	}
+	fieldVal, err := dyn.GetByPath(stateVal, path[3:])
+	if err != nil || !fieldVal.IsValid() {
+		return dyn.InvalidValue, false
+	}
+	return fieldVal, true
+}
diff --git a/bundle/direct/tools/generate_apitypes.py b/bundle/direct/tools/generate_apitypes.py
index 78815eae0e2..40edd510f01 100644
--- a/bundle/direct/tools/generate_apitypes.py
+++ b/bundle/direct/tools/generate_apitypes.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 """
-Find candidate types from openapi.json that match resource shapes in out.fields.txt and save them (apitypes.generated.yml).
+Find candidate types from cli.json that match resource shapes in out.fields.txt and save them (apitypes.generated.yml).
 
 The types are found based on top level field overlap between bundle schema and API type.
 
@@ -37,23 +37,41 @@ def parse_out_fields(path):
 
 
 def get_schema_fields(schemas):
-    """Get top-level field names for each schema type."""
+    """Get top-level field names for each schema type.
+
+    >>> get_schema_fields({})
+    {}
+
+    >>> get_schema_fields({"TypeA": {"fields": {"x": {}}}})
+    {'TypeA': {'x'}}
+
+    >>> result = get_schema_fields({"A": {"fields": {"x": {}}}, "B": {"fields": {"y": {}, "z": {}}}})
+    >>> result["A"]
+    {'x'}
+    >>> sorted(result["B"])
+    ['y', 'z']
+
+    Types with no fields are dropped:
+
+    >>> sorted(get_schema_fields({"TypeA": {"fields": {}}, "TypeB": {"fields": {"x": {}}}}))
+    ['TypeB']
+    """
     schema_fields = {}
     for name, schema in schemas.items():
-        props = schema.get("properties", {})
+        props = schema.get("fields", {})
         if props:
             schema_fields[name] = set(props.keys())
     return schema_fields
 
 
 def main():
-    parser = argparse.ArgumentParser(description="Generate apitypes.yml from OpenAPI schema")
-    parser.add_argument("apischema", type=Path, help="Path to OpenAPI schema JSON file")
+    parser = argparse.ArgumentParser(description="Generate apitypes.yml from the cli.json schema block")
+    parser.add_argument("apischema", type=Path, help="Path to cli.json schema block")
     parser.add_argument("out_fields", type=Path, help="Path to out.fields.txt file")
     args = parser.parse_args()
 
     resource_fields = parse_out_fields(args.out_fields)
-    schemas = json.loads(args.apischema.read_text()).get("components", {}).get("schemas", {})
+    schemas = json.loads(args.apischema.read_text())["schemas"]
     schema_fields = get_schema_fields(schemas)
 
     field_counts = Counter()
@@ -90,7 +108,7 @@ def main():
 
         print(f"\n{resource}: {len(res_fields)} fields, max_score={max_score:.2f}", file=sys.stderr)
         top_pct = candidates[0][0] if candidates else 0
-        for pct, score, schema_name, overlap, s_fields in candidates[:5]:
+        for pct, _score, schema_name, overlap, s_fields in candidates[:5]:
             # Only show if >= 80% or within 20% of top entry
             if pct < 80 and (top_pct - pct) >= 20:
                 continue
@@ -103,7 +121,7 @@ def main():
 
     print("# Generated, do not edit. Override via apitypes.yml")
     for resource in sorted(top_matches):
-        print("")
+        print()
         print(f"{resource}: {top_matches[resource]}")
 
 
diff --git a/bundle/direct/tools/generate_resources.py b/bundle/direct/tools/generate_resources.py
index eb453dae17c..01302fedc79 100644
--- a/bundle/direct/tools/generate_resources.py
+++ b/bundle/direct/tools/generate_resources.py
@@ -1,6 +1,14 @@
 #!/usr/bin/env python3
+# /// script
+# dependencies = [
+#   "pyyaml",
+# ]
+# ///
 """
-Generate resources.generated.yml from OpenAPI schema field behaviors.
+Generate per-resource <resource_type>.generated.yml files from cli.json field behaviors.
+
+A resource with no field behaviors gets no file; a stale file left over from a
+previous run is removed.
 """
 
 import argparse
@@ -28,51 +36,80 @@ def parse_apitypes(generated_path, override_path):
 
 
 def parse_out_fields(path):
-    """Parse out.fields.txt to extract STATE field names per resource."""
+    """Parse out.fields.txt to extract STATE field names per resource and array element types."""
     state_fields = {}
+    array_element_types = {}  # (resource, base_path) -> element_type
 
     for line in path.read_text().splitlines():
         parts = line.split("\t")
         if len(parts) < 3 or not parts[0].startswith("resources."):
             continue
 
-        field_path, flags = parts[0], parts[2:]
+        field_path, field_type, flags = parts[0], parts[1], parts[2:]
         if "STATE" not in flags and "ALL" not in flags:
             continue
 
         # Field line: resources.<name>.*.<field>
         match = re.match(r"resources\.([a-z_]+)\.\*\.(.+)", field_path)
-        if match and "[*]" not in match.group(2):
-            state_fields.setdefault(match.group(1), set()).add(match.group(2))
+        if not match:
+            continue
+        resource, rest = match.group(1), match.group(2)
+
+        # Array element type declarations (path ends with [*]): record the element type
+        # so the generator can traverse into array element schemas that lack a ref in the
+        # OpenAPI schema (e.g. App.resources[] -> AppResource).
+        if rest.endswith("[*]"):
+            base_path = rest[:-3]
+            elem_type = field_type.lstrip("*")
+            array_element_types[(resource, base_path)] = elem_type
+
+        state_fields.setdefault(resource, set()).add(rest)
 
-    return state_fields
+    return state_fields, array_element_types
 
 
-def get_field_behaviors(schemas, type_name):
+def get_field_behaviors(schemas, type_name, resource_name=None, array_element_types=None):
     """Extract field behaviors from a schema, propagating INPUT_ONLY/OUTPUT_ONLY from containers."""
     if type_name not in schemas:
         return {}
+    if array_element_types is None:
+        array_element_types = {}
 
     def extract(schema, prefix, visited, depth, inherited):
-        if depth > 4:
-            return {}
+        # `visited` holds the ref types on the path from the root to here, so a type
+        # that transitively references itself terminates the recursion. It is scoped
+        # to the current path (each branch gets its own copy via `visited | {ref}`),
+        # not global, so a type reused at sibling paths is expanded at each one — e.g.
+        # ModelServiceConfigDestinationConfig under both config.routing.destinations[*]
+        # and config.routing.fallback.destinations[*]. max_depth is a runaway guard
+        # only; real fields reach depth 5 (e.g.
+        # external_model.custom_provider_config.bearer_token_auth.token_plaintext).
+        max_depth = 10
+        if depth > max_depth:
+            raise Exception(f"Nested field found at depth {depth} ({max_depth=})")
         results = {}
-        for name, prop in schema.get("properties", {}).items():
+        for name, prop in schema.get("fields", {}).items():
             path = f"{prefix}.{name}" if prefix else name
-            behaviors = list(prop.get("x-databricks-field-behaviors", []))
-            if prop.get("x-databricks-immutable") and "IMMUTABLE" not in behaviors:
-                behaviors.append("IMMUTABLE")
+            behaviors = list(prop.get("behaviors", []))
             for b in inherited:
                 if b not in behaviors:
                     behaviors.append(b)
             if behaviors:
                 results[path] = behaviors
-            if "$ref" in prop:
-                ref = prop["$ref"].split("/")[-1]
+            if "ref" in prop:
+                ref = prop["ref"]
                 if ref in schemas and ref not in visited:
-                    visited.add(ref)
                     propagate = [b for b in behaviors if b in ("INPUT_ONLY", "OUTPUT_ONLY")]
-                    results.update(extract(schemas[ref], path, visited, depth + 1, propagate))
+                    results.update(extract(schemas[ref], path, visited | {ref}, depth + 1, propagate))
+            elif resource_name is not None:
+                # For array fields with no ref in the schema, use the element type from
+                # out.fields.txt (e.g. App.resources[] -> AppResource).
+                elem_type = array_element_types.get((resource_name, path))
+                if elem_type and elem_type in schemas and elem_type not in visited:
+                    propagate = [b for b in behaviors if b in ("INPUT_ONLY", "OUTPUT_ONLY")]
+                    results.update(
+                        extract(schemas[elem_type], f"{path}[*]", visited | {elem_type}, depth + 1, propagate)
+                    )
         return results
 
     # Find INPUT_ONLY/OUTPUT_ONLY from container types that reference this type
@@ -84,10 +121,10 @@ def find_inherited_behaviors(schemas, type_name):
     """Find INPUT_ONLY/OUTPUT_ONLY behaviors from containers that reference type_name."""
     inherited = []
     for container_schema in schemas.values():
-        for field_prop in container_schema.get("properties", {}).values():
-            if field_prop.get("$ref", "").split("/")[-1] != type_name:
+        for field_prop in container_schema.get("fields", {}).values():
+            if field_prop.get("ref", "") != type_name:
                 continue
-            behaviors = field_prop.get("x-databricks-field-behaviors", [])
+            behaviors = field_prop.get("behaviors", [])
             if "INPUT_ONLY" in behaviors and "INPUT_ONLY" not in inherited:
                 inherited.append("INPUT_ONLY")
             if "OUTPUT_ONLY" in behaviors and "OUTPUT_ONLY" not in inherited:
@@ -106,7 +143,9 @@ def filter_prefixes(fields):
 
 def write_field_group(lines, header, fields):
     """Write a group of fields with field and reason, grouped by behavior."""
-    lines.append(f"\n    {header}:")
+    if lines:
+        lines.append("")
+    lines.append(f"{header}:")
     # Group by behavior
     by_behavior = {}
     for field, behavior in fields:
@@ -118,77 +157,84 @@ def write_field_group(lines, header, fields):
         first = False
         reason = f"spec:{behavior.lower()}"
         for field in by_behavior[behavior]:
-            lines.append(f"      - field: {field}")
-            lines.append(f"        reason: {reason}")
+            lines.append(f"  - field: {field}")
+            lines.append(f"    reason: {reason}")
 
 
-def generate(resource_behaviors):
-    """Generate resources.yml."""
-    lines = [
-        """# Generated, do not edit. API field behaviors from OpenAPI schema.
-#
-# For manual edits and schema description, see resources.yml.
+GENERATED_SUFFIX = ".generated.yml"
 
-resources:"""
-    ]
+HEADER = "# Generated, do not edit."
 
-    for resource in sorted(resource_behaviors):
-        behaviors = resource_behaviors[resource]
 
-        ignore_remote, recreate = [], []
-        for field, fb in sorted(behaviors.items()):
-            if "OUTPUT_ONLY" in fb:
-                ignore_remote.append((field, "OUTPUT_ONLY"))
-            elif "INPUT_ONLY" in fb:
-                ignore_remote.append((field, "INPUT_ONLY"))
-            if "IMMUTABLE" in fb:
-                recreate.append((field, "IMMUTABLE"))
+def generate(behaviors):
+    """Render one resource's field behaviors, or "" if it has none."""
+    ignore_remote, recreate = [], []
+    for field, fb in sorted(behaviors.items()):
+        if "OUTPUT_ONLY" in fb:
+            ignore_remote.append((field, "OUTPUT_ONLY"))
+        elif "INPUT_ONLY" in fb:
+            ignore_remote.append((field, "INPUT_ONLY"))
+        if "IMMUTABLE" in fb:
+            recreate.append((field, "IMMUTABLE"))
 
-        ignore_remote = filter_prefixes(ignore_remote)
-        recreate = filter_prefixes(recreate)
+    ignore_remote = filter_prefixes(ignore_remote)
+    recreate = filter_prefixes(recreate)
 
-        if not ignore_remote and not recreate:
-            lines.append(f"\n  # {resource}: no api field behaviors")
-            continue
+    if not ignore_remote and not recreate:
+        return ""
 
-        lines.append(f"\n  {resource}:")
+    lines = []
+    if recreate:
+        write_field_group(lines, "recreate_on_changes", recreate)
+    if ignore_remote:
+        write_field_group(lines, "ignore_remote_changes", ignore_remote)
 
-        if recreate:
-            write_field_group(lines, "recreate_on_changes", recreate)
+    return HEADER + "\n\n" + "\n".join(lines) + "\n"
 
-        if ignore_remote:
-            write_field_group(lines, "ignore_remote_changes", ignore_remote)
 
-    while lines and lines[-1] == "":
-        lines.pop()
+def write_files(outdir, resource_behaviors):
+    """Write <resource_type>.generated.yml per resource, pruning files that are now empty."""
+    written = set()
+    for resource, behaviors in sorted(resource_behaviors.items()):
+        content = generate(behaviors)
+        if not content:
+            continue
+        path = outdir / (resource + GENERATED_SUFFIX)
+        path.write_text(content)
+        written.add(path)
+
+    for path in sorted(outdir.glob("*" + GENERATED_SUFFIX)):
+        if path not in written:
+            path.unlink()
 
-    return "\n".join(lines)
+    print(f"wrote {len(written)} files to {outdir}", file=sys.stderr)
 
 
 def main():
-    parser = argparse.ArgumentParser(description="Generate resources YAML from OpenAPI schema")
-    parser.add_argument("apischema", type=Path, help="Path to OpenAPI schema JSON file")
+    parser = argparse.ArgumentParser(description="Generate resources YAML from the cli.json schema block")
+    parser.add_argument("apischema", type=Path, help="Path to cli.json schema block")
     parser.add_argument("apitypes", type=Path, help="Path to apitypes.generated.yml file")
     parser.add_argument("apitypes_override", type=Path, help="Path to apitypes.yml override file")
     parser.add_argument("out_fields", type=Path, help="Path to out.fields.txt file")
+    parser.add_argument("outdir", type=Path, help="Directory to write <resource_type>.generated.yml files to")
     args = parser.parse_args()
 
     resource_types = parse_apitypes(args.apitypes, args.apitypes_override)
-    state_fields = parse_out_fields(args.out_fields)
-    schemas = json.loads(args.apischema.read_text()).get("components", {}).get("schemas", {})
+    state_fields, array_element_types = parse_out_fields(args.out_fields)
+    schemas = json.loads(args.apischema.read_text())["schemas"]
 
     resource_behaviors = {}
     for resource, type_name in sorted(resource_types.items()):
         fields = state_fields.get(resource, set())
         print(f"\n{resource}: type={type_name}", file=sys.stderr)
-        all_behaviors = get_field_behaviors(schemas, type_name)
+        all_behaviors = get_field_behaviors(schemas, type_name, resource, array_element_types)
         if all_behaviors:
             print(f"  field behaviors from {type_name}:", file=sys.stderr)
             for field in sorted(all_behaviors):
                 print(f"    {field}: {all_behaviors[field]}", file=sys.stderr)
         resource_behaviors[resource] = {f: b for f, b in all_behaviors.items() if f in fields}
 
-    print(generate(resource_behaviors))
+    write_files(args.outdir, resource_behaviors)
 
 
 if __name__ == "__main__":
diff --git a/bundle/direct/unescape.go b/bundle/direct/unescape.go
new file mode 100644
index 00000000000..31f9925e098
--- /dev/null
+++ b/bundle/direct/unescape.go
@@ -0,0 +1,40 @@
+package direct
+
+import (
+	"fmt"
+	"reflect"
+	"strings"
+
+	"github.com/databricks/cli/libs/dyn/dynvar"
+	"github.com/databricks/cli/libs/structs/structaccess"
+	"github.com/databricks/cli/libs/structs/structpath"
+	"github.com/databricks/cli/libs/structs/structwalk"
+)
+
+// unescapeRefs rewrites "$${" to "${" in every string field of state, in place.
+// Configs use "$${...}" for placeholders that the Databricks runtime interprets,
+// so the API must receive them with a single "$".
+func unescapeRefs(state any) error {
+	var paths []*structpath.PathNode
+	var values []string
+
+	err := structwalk.Walk(state, func(path *structpath.PathNode, val any, _ *reflect.StructField) {
+		s, ok := val.(string)
+		if !ok || !strings.Contains(s, "$${") {
+			return
+		}
+		paths = append(paths, path)
+		values = append(values, dynvar.Unescape(s))
+	})
+	if err != nil {
+		return err
+	}
+
+	for i, path := range paths {
+		if err := structaccess.Set(state, path, values[i]); err != nil {
+			return fmt.Errorf("unescaping %s: %w", path, err)
+		}
+	}
+
+	return nil
+}
diff --git a/bundle/direct/util.go b/bundle/direct/util.go
index 43c39c9a67f..1ec180fd20e 100644
--- a/bundle/direct/util.go
+++ b/bundle/direct/util.go
@@ -6,6 +6,18 @@ import (
 	"github.com/databricks/databricks-sdk-go/apierr"
 )
 
-func isResourceGone(err error) bool {
-	return errors.Is(err, apierr.ErrResourceDoesNotExist) || errors.Is(err, apierr.ErrNotFound)
+// isManagedByParent reports whether err is an API error carrying the
+// declarative_context=MANAGED_BY_PARENT marker in ErrorInfo.metadata. The
+// server uses this to signal that a resource's lifecycle is owned by a
+// parent (e.g. a Lakebase RW endpoint inside a branch, or a root branch
+// inside a project) and the standalone Delete can be safely disregarded —
+// the parent's Delete will cascade-clean. Mirrors the TF provider's
+// declarative.IsDeleteError suppression.
+func isManagedByParent(err error) bool {
+	apiErr, ok := errors.AsType[*apierr.APIError](err)
+	if !ok || apiErr == nil {
+		return false
+	}
+	info := apiErr.ErrorDetails().ErrorInfo
+	return info != nil && info.Metadata["declarative_context"] == "MANAGED_BY_PARENT"
 }
diff --git a/bundle/docsgen/README.md b/bundle/docsgen/README.md
deleted file mode 100644
index 0468945dc7d..00000000000
--- a/bundle/docsgen/README.md
+++ /dev/null
@@ -1,79 +0,0 @@
-## docs-autogen
-
-1. Install [Golang](https://go.dev/doc/install)
-2. Run `./task generate-docs` from the repo
-3. See generated documents in `./bundle/docsgen/output` directory
-4. To change descriptions update content in `./bundle/internal/schema/annotations.yml` or `./bundle/internal/schema/annotations_openapi_overrides.yml` and re-run `./task generate-docs`
-
-For simpler usage run it together with copy command to move resulting files to local `docs` repo. Note that it will overwrite any local changes in affected files. Example:
-
-```
-task generate-docs && cp bundle/docgen/output/*.md ../docs/source/dev-tools/bundles
-```
-
-To change intro sections for files update them in `templates/` directory
-
-### Annotation file structure
-
-```yaml
-"<root-type-name>":
-  "<property-name>":
-    description: Description of the property, only plain text is supported
-    markdown_description: Description with markdown support, if defined it will override the value in docs and in JSON-schema
-    markdown_examples: Custom block for any example, in free form, Markdown is supported
-    title: JSON-schema title, not used in docs
-    default: Default value of the property, not used in docs
-    enum: Possible values of enum-type, not used in docs
-```
-
-Descriptions with `PLACEHOLDER` value are not displayed in docs and JSON-schema
-
-All relative links like `[_](/dev-tools/bundles/settings.md#cluster_id)` are kept as is in docs but converted to absolute links in JSON schema
-
-To change description for type itself (not its fields) use `"_"`:
-
-```yaml
-github.com/databricks/cli/bundle/config/resources.Cluster:
-  "_":
-    "markdown_description": |-
-      The cluster resource defines an [all-purpose cluster](/api/workspace/clusters/create).
-```
-
-### Example annotation
-
-```yaml
-github.com/databricks/cli/bundle/config.Bundle:
-  "cluster_id":
-    "description": |-
-      The ID of a cluster to use to run the bundle.
-    "markdown_description": |-
-      The ID of a cluster to use to run the bundle. See [_](/dev-tools/bundles/settings.md#cluster_id).
-  "compute_id":
-    "description": |-
-      PLACEHOLDER
-  "databricks_cli_version":
-    "description": |-
-      The Databricks CLI version to use for the bundle.
-    "markdown_description": |-
-      The Databricks CLI version to use for the bundle. See [_](/dev-tools/bundles/settings.md#databricks_cli_version).
-  "deployment":
-    "description": |-
-      The definition of the bundle deployment
-    "markdown_description": |-
-      The definition of the bundle deployment. For supported attributes, see [_](#deployment) and [_](/dev-tools/bundles/deployment-modes.md).
-  "git":
-    "description": |-
-      The Git version control details that are associated with your bundle.
-    "markdown_description": |-
-      The Git version control details that are associated with your bundle. For supported attributes, see [_](#git) and [_](/dev-tools/bundles/settings.md#git).
-  "name":
-    "description": |-
-      The name of the bundle.
-  "uuid":
-    "description": |-
-      PLACEHOLDER
-```
-
-### TODO
-
-Add file watcher to track changes in the annotation files and re-run `./task generate-docs` script automtically
diff --git a/bundle/docsgen/main.go b/bundle/docsgen/main.go
deleted file mode 100644
index c06811ebbdd..00000000000
--- a/bundle/docsgen/main.go
+++ /dev/null
@@ -1,154 +0,0 @@
-package main
-
-import (
-	"errors"
-	"fmt"
-	"io/fs"
-	"log"
-	"os"
-	"path"
-	"reflect"
-	"strings"
-	"time"
-
-	"github.com/databricks/cli/bundle/config"
-	"github.com/databricks/cli/bundle/internal/annotation"
-	"github.com/databricks/cli/libs/jsonschema"
-)
-
-const (
-	rootFileName      = "reference.md"
-	resourcesFileName = "resources.md"
-)
-
-func main() {
-	if len(os.Args) != 3 {
-		fmt.Println("Usage: go run main.go <annotation-file> <output-file>")
-		os.Exit(1)
-	}
-
-	annotationDir := os.Args[1]
-	docsDir := os.Args[2]
-	outputDir := path.Join(docsDir, "output")
-	templatesDir := path.Join(docsDir, "templates")
-
-	if _, err := os.Stat(outputDir); errors.Is(err, fs.ErrNotExist) {
-		if err := os.MkdirAll(outputDir, 0o755); err != nil {
-			log.Fatal(err)
-		}
-	}
-
-	rootHeader, err := os.ReadFile(path.Join(templatesDir, rootFileName))
-	if err != nil {
-		log.Fatal(err)
-	}
-	err = generateDocs(
-		[]string{path.Join(annotationDir, "annotations.yml")},
-		path.Join(outputDir, rootFileName),
-		reflect.TypeFor[config.Root](),
-		fillTemplateVariables(string(rootHeader)),
-	)
-	if err != nil {
-		log.Fatal(err)
-	}
-	resourcesHeader, err := os.ReadFile(path.Join(templatesDir, resourcesFileName))
-	if err != nil {
-		log.Fatal(err)
-	}
-	err = generateDocs(
-		[]string{path.Join(annotationDir, "annotations_openapi.yml"), path.Join(annotationDir, "annotations_openapi_overrides.yml"), path.Join(annotationDir, "annotations.yml")},
-		path.Join(outputDir, resourcesFileName),
-		reflect.TypeFor[config.Resources](),
-		fillTemplateVariables(string(resourcesHeader)),
-	)
-	if err != nil {
-		log.Fatal(err)
-	}
-}
-
-func generateDocs(inputPaths []string, outputPath string, rootType reflect.Type, header string) error {
-	annotations, err := annotation.LoadAndMerge(inputPaths)
-	if err != nil {
-		log.Fatal(err)
-	}
-
-	// schemas is used to resolve references to schemas
-	schemas := map[string]*jsonschema.Schema{}
-	// ownFields is used to track fields that are defined in the annotation file and should be included in the docs page
-	ownFields := map[string]bool{}
-
-	s, err := jsonschema.FromType(rootType, []func(reflect.Type, jsonschema.Schema) jsonschema.Schema{
-		func(typ reflect.Type, s jsonschema.Schema) jsonschema.Schema {
-			_, isOwnField := annotations[jsonschema.TypePath(typ)]
-			if isOwnField {
-				ownFields[jsonschema.TypePath(typ)] = true
-			}
-
-			refPath := getPath(typ)
-			shouldHandle := strings.HasPrefix(refPath, "github.com")
-			if !shouldHandle {
-				schemas[jsonschema.TypePath(typ)] = &s
-				return s
-			}
-
-			a := annotations[refPath]
-			if a == nil {
-				a = map[string]annotation.Descriptor{}
-			}
-
-			rootTypeAnnotation, ok := a["_"]
-			if ok {
-				assignAnnotation(&s, rootTypeAnnotation)
-			}
-
-			for k, v := range s.Properties {
-				assignAnnotation(v, a[k])
-			}
-
-			schemas[jsonschema.TypePath(typ)] = &s
-			return s
-		},
-	})
-	if err != nil {
-		log.Fatal(err)
-	}
-
-	nodes := buildNodes(s, schemas, ownFields)
-	err = buildMarkdown(nodes, outputPath, header)
-	if err != nil {
-		log.Fatal(err)
-	}
-	return nil
-}
-
-func getPath(typ reflect.Type) string {
-	return typ.PkgPath() + "." + typ.Name()
-}
-
-func assignAnnotation(s *jsonschema.Schema, a annotation.Descriptor) {
-	if a.Description != "" && a.Description != annotation.Placeholder {
-		s.Description = a.Description
-	}
-	if a.MarkdownDescription != "" {
-		s.MarkdownDescription = a.MarkdownDescription
-	}
-	if a.MarkdownExamples != "" {
-		s.Examples = []string{a.MarkdownExamples}
-	}
-	if a.DeprecationMessage != "" {
-		s.Deprecated = true
-		s.DeprecationMessage = a.DeprecationMessage
-	}
-	if a.Preview == "PRIVATE" {
-		s.DoNotSuggest = true
-		s.Preview = a.Preview
-	}
-	if a.OutputOnly != nil && *a.OutputOnly {
-		s.DoNotSuggest = true
-	}
-}
-
-func fillTemplateVariables(s string) string {
-	currentDate := time.Now().Format("2006-01-02")
-	return strings.ReplaceAll(s, "{{update_date}}", currentDate)
-}
diff --git a/bundle/docsgen/markdown.go b/bundle/docsgen/markdown.go
deleted file mode 100644
index 4055e362bda..00000000000
--- a/bundle/docsgen/markdown.go
+++ /dev/null
@@ -1,111 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"log"
-	"os"
-	"strings"
-)
-
-func buildMarkdown(nodes []rootNode, outputFile, header string) error {
-	m := newMardownRenderer()
-	m = m.PlainText(header)
-	for _, node := range nodes {
-		m = m.LF()
-		title := node.Title
-		if node.TopLevel {
-			m = m.H2(title)
-		} else {
-			m = m.H3(title)
-		}
-		m = m.LF()
-
-		if node.Type != "" {
-			m = m.PlainText(fmt.Sprintf("**`Type: %s`**", node.Type))
-			m = m.LF()
-		}
-		m = m.PlainText(node.Description)
-		m = m.LF()
-
-		if len(node.ObjectKeyAttributes) > 0 {
-			n := pickLastWord(node.Title)
-			n = removePluralForm(n)
-			m = m.CodeBlocks("yaml", fmt.Sprintf("%ss:\n  <%s-name>:\n    <%s-field-name>: <%s-field-value>", n, n, n, n))
-			m = m.LF()
-			m = buildAttributeTable(m, node.ObjectKeyAttributes)
-		} else if len(node.ArrayItemAttributes) > 0 {
-			m = m.LF()
-			m = buildAttributeTable(m, node.ArrayItemAttributes)
-		} else if len(node.Attributes) > 0 {
-			m = m.LF()
-			m = buildAttributeTable(m, node.Attributes)
-		}
-
-		if node.Example != "" {
-			m = m.LF()
-			m = m.PlainText("**Example**")
-			m = m.LF()
-			m = m.PlainText(node.Example)
-		}
-	}
-
-	f, err := os.Create(outputFile)
-	if err != nil {
-		log.Fatal(err)
-	}
-	_, err = f.WriteString(m.String())
-	if err != nil {
-		log.Fatal(err)
-	}
-	return f.Close()
-}
-
-func pickLastWord(s string) string {
-	words := strings.Split(s, ".")
-	return words[len(words)-1]
-}
-
-// Build a custom table which we use in Databricks website
-func buildAttributeTable(m *markdownRenderer, attributes []attributeNode) *markdownRenderer {
-	m = m.LF()
-	m = m.PlainText(":::list-table")
-	m = m.LF()
-
-	m = m.PlainText("- - Key")
-	m = m.PlainText("  - Type")
-	m = m.PlainText("  - Description")
-	m = m.LF()
-
-	for _, a := range attributes {
-		m = m.PlainText("- - " + fmt.Sprintf("`%s`", a.Title))
-		m = m.PlainText("  - " + a.Type)
-		m = m.PlainText("  - " + formatDescription(a))
-		m = m.LF()
-	}
-
-	m = m.PlainText(":::")
-	m = m.LF()
-
-	return m
-}
-
-func formatDescription(a attributeNode) string {
-	s := strings.ReplaceAll(a.Description, "\n", " ")
-	if a.Link != "" {
-		if strings.HasSuffix(s, ".") {
-			s += " "
-		} else if s != "" {
-			s += ". "
-		}
-		s += fmt.Sprintf("See [\\_](#%s).", cleanAnchor(a.Link))
-	}
-	return s
-}
-
-// Docs framework does not allow special characters in anchor links and strip them out by default
-// We need to clean them up to make sure the links pass the validation
-func cleanAnchor(s string) string {
-	s = strings.ReplaceAll(s, ".", "")
-	s = strings.ReplaceAll(s, nameFieldWithFormat, nameField)
-	return s
-}
diff --git a/bundle/docsgen/markdown_test.go b/bundle/docsgen/markdown_test.go
deleted file mode 100644
index 5463eeef3c0..00000000000
--- a/bundle/docsgen/markdown_test.go
+++ /dev/null
@@ -1,42 +0,0 @@
-package main
-
-import (
-	"path/filepath"
-	"testing"
-
-	"github.com/databricks/cli/internal/testutil"
-	"github.com/stretchr/testify/require"
-)
-
-func TestBuildMarkdownAnchors(t *testing.T) {
-	nodes := []rootNode{
-		{
-			Title:       "some_field",
-			TopLevel:    true,
-			Type:        "Map",
-			Description: "This is a description",
-			Attributes: []attributeNode{
-				{
-					Title:       "my_attribute",
-					Type:        "Map",
-					Description: "Desc with link",
-					Link:        "some_field._name_.my_attribute",
-				},
-			},
-		},
-		{
-			Title:       "some_field._name_.my_attribute",
-			TopLevel:    false,
-			Type:        "Boolean",
-			Description: "Another description",
-		},
-	}
-	tmpDir := t.TempDir()
-	path := filepath.Join(tmpDir, "output.md")
-
-	err := buildMarkdown(nodes, path, "Header")
-	require.NoError(t, err)
-
-	expected := testutil.ReadFile(t, "testdata/anchors.md")
-	testutil.AssertFileContents(t, path, expected)
-}
diff --git a/bundle/docsgen/nodes.go b/bundle/docsgen/nodes.go
deleted file mode 100644
index a6f629ca429..00000000000
--- a/bundle/docsgen/nodes.go
+++ /dev/null
@@ -1,247 +0,0 @@
-package main
-
-import (
-	"cmp"
-	"slices"
-	"strings"
-
-	"github.com/databricks/cli/libs/jsonschema"
-)
-
-// rootNode is an intermediate representation of resolved JSON-schema item that is used to generate documentation
-// Every schema node goes follows this conversion `JSON-schema -> rootNode -> markdown text`
-type rootNode struct {
-	Title               string
-	Description         string
-	Attributes          []attributeNode
-	Example             string
-	ObjectKeyAttributes []attributeNode
-	ArrayItemAttributes []attributeNode
-	TopLevel            bool
-	Type                string
-}
-
-type attributeNode struct {
-	Title       string
-	Type        string
-	Description string
-	Link        string
-}
-
-type rootProp struct {
-	// k is the name of the property
-	k string
-	// v is the corresponding json-schema node
-	v *jsonschema.Schema
-	// topLevel is true only for direct properties of the schema of root type (e.g. config.Root or config.Resources)
-	// Example: config.Root has .
-	topLevel bool
-	// circular indicates if property was added by recursive type, e.g. task.for_each_task.task.for_each_task
-	// These entries don't expand further and don't add any new nodes from their properties
-	circular bool
-}
-
-const MapType = "Map"
-
-// buildNodes converts JSON-schema to a flat list of rootNode items that are then used to generate markdown documentation
-// It recursively traverses the schema expanding the resulting list with new items for every properties of nodes `object` and `array` type
-func buildNodes(s jsonschema.Schema, refs map[string]*jsonschema.Schema, ownFields map[string]bool) []rootNode {
-	var rootProps []rootProp
-	for k, v := range s.Properties {
-		rootProps = append(rootProps, rootProp{k, v, true, false})
-	}
-	nodes := make([]rootNode, 0, len(rootProps))
-	visited := make(map[string]bool)
-
-	for i := 0; i < len(rootProps); i++ {
-		item := rootProps[i]
-		k := item.k
-		v := item.v
-
-		if visited[k] {
-			continue
-		}
-		visited[k] = true
-		v = resolveRefs(v, refs)
-
-		if v.Deprecated {
-			continue
-		}
-		if v.DoNotSuggest {
-			continue
-		}
-
-		node := rootNode{
-			Title:       k,
-			Description: getDescription(v),
-			TopLevel:    item.topLevel,
-			Example:     getExample(v),
-			Type:        getHumanReadableType(v.Type),
-		}
-
-		hasProperties := len(v.Properties) > 0
-		if hasProperties {
-			node.Attributes = getAttributes(v.Properties, refs, ownFields, k, item.circular)
-		}
-
-		mapValueType := getMapValueType(v, refs)
-		if mapValueType != nil {
-			d := getDescription(mapValueType)
-			if d != "" {
-				node.Description = d
-			}
-			if node.Example == "" {
-				node.Example = getExample(mapValueType)
-			}
-			node.ObjectKeyAttributes = getAttributes(mapValueType.Properties, refs, ownFields, getMapKeyPrefix(k), item.circular)
-		}
-
-		arrayItemType := resolveRefs(v.Items, refs)
-		if arrayItemType != nil {
-			node.ArrayItemAttributes = getAttributes(arrayItemType.Properties, refs, ownFields, k, item.circular)
-		}
-
-		nodes = append(nodes, node)
-
-		// Whether we should add new root props from the children of the current JSON-schema node to include their definitions to this document
-		shouldAddNewProps := !item.circular
-		if shouldAddNewProps {
-			var newProps []rootProp
-			// Adds node with definition for the properties. Example:
-			// bundle:
-			//  prop-name: <value>
-			if hasProperties {
-				newProps = append(newProps, extractNodes(k, v.Properties, refs, ownFields)...)
-			}
-
-			// Adds node with definition for the type of array item. Example:
-			// permissions:
-			//  - <item>
-			if arrayItemType != nil {
-				newProps = append(newProps, extractNodes(k, arrayItemType.Properties, refs, ownFields)...)
-			}
-			// Adds node with definition for the type of the Map value. Example:
-			// targets:
-			//   <key>: <value>
-			if mapValueType != nil {
-				newProps = append(newProps, extractNodes(getMapKeyPrefix(k), mapValueType.Properties, refs, ownFields)...)
-			}
-
-			rootProps = append(rootProps, newProps...)
-		}
-	}
-
-	slices.SortFunc(nodes, func(a, b rootNode) int {
-		return cmp.Compare(a.Title, b.Title)
-	})
-	return nodes
-}
-
-func getMapValueType(v *jsonschema.Schema, refs map[string]*jsonschema.Schema) *jsonschema.Schema {
-	additionalProps, ok := v.AdditionalProperties.(*jsonschema.Schema)
-	if ok {
-		return resolveRefs(additionalProps, refs)
-	}
-	return nil
-}
-
-const (
-	nameField           = "name"
-	nameFieldWithFormat = "_name_"
-)
-
-func getMapKeyPrefix(s string) string {
-	return s + "." + nameFieldWithFormat
-}
-
-func removePluralForm(s string) string {
-	if before, ok := strings.CutSuffix(s, "s"); ok {
-		return before
-	}
-	return s
-}
-
-func getHumanReadableType(t jsonschema.Type) string {
-	typesMapping := map[string]string{
-		"string":  "String",
-		"integer": "Integer",
-		"boolean": "Boolean",
-		"array":   "Sequence",
-		"object":  "Map",
-	}
-	return typesMapping[string(t)]
-}
-
-func getAttributes(props, refs map[string]*jsonschema.Schema, ownFields map[string]bool, prefix string, circular bool) []attributeNode {
-	var attributes []attributeNode
-	for k, v := range props {
-		v = resolveRefs(v, refs)
-		if v.DoNotSuggest {
-			continue
-		}
-		typeString := getHumanReadableType(v.Type)
-		if typeString == "" {
-			typeString = "Any"
-		}
-		var reference string
-		if isReferenceType(v, refs, ownFields) && !circular && !v.Deprecated {
-			reference = prefix + "." + k
-		}
-		attributes = append(attributes, attributeNode{
-			Title:       k,
-			Type:        typeString,
-			Description: getDescription(v),
-			Link:        reference,
-		})
-	}
-	slices.SortFunc(attributes, func(a, b attributeNode) int {
-		return cmp.Compare(a.Title, b.Title)
-	})
-	return attributes
-}
-
-func getDescription(s *jsonschema.Schema) string {
-	if s.DeprecationMessage != "" {
-		return s.DeprecationMessage
-	}
-	if s.MarkdownDescription != "" {
-		return s.MarkdownDescription
-	}
-	return s.Description
-}
-
-func shouldExtract(ref string, ownFields map[string]bool) bool {
-	if i := strings.Index(ref, "github.com"); i >= 0 {
-		ref = ref[i:]
-	}
-	_, isCustomField := ownFields[ref]
-	return isCustomField
-}
-
-// extractNodes returns a list of rootProp items for all properties of the json-schema node that should be extracted based on context
-// E.g. we extract all propert
-func extractNodes(prefix string, props, refs map[string]*jsonschema.Schema, ownFields map[string]bool) []rootProp {
-	var nodes []rootProp
-	for k, v := range props {
-		if v.Reference != nil && !shouldExtract(*v.Reference, ownFields) {
-			continue
-		}
-		v = resolveRefs(v, refs)
-		if v.Type == "object" || v.Type == "array" {
-			nodes = append(nodes, rootProp{prefix + "." + k, v, false, isCycleField(k)})
-		}
-	}
-	return nodes
-}
-
-func isCycleField(field string) bool {
-	return field == "for_each_task"
-}
-
-func getExample(v *jsonschema.Schema) string {
-	examples := getExamples(v.Examples)
-	if len(examples) == 0 {
-		return ""
-	}
-	return examples[0]
-}
diff --git a/bundle/docsgen/nodes_test.go b/bundle/docsgen/nodes_test.go
deleted file mode 100644
index 028bf1eff62..00000000000
--- a/bundle/docsgen/nodes_test.go
+++ /dev/null
@@ -1,176 +0,0 @@
-package main
-
-import (
-	"testing"
-
-	"github.com/databricks/cli/libs/jsonschema"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestBuildNodes_ChildExpansion(t *testing.T) {
-	tests := []struct {
-		name      string
-		schema    jsonschema.Schema
-		refs      map[string]*jsonschema.Schema
-		ownFields map[string]bool
-		wantNodes []rootNode
-	}{
-		{
-			name: "array expansion",
-			schema: jsonschema.Schema{
-				Type: "object",
-				Properties: map[string]*jsonschema.Schema{
-					"list": {
-						Type: "array",
-						Items: &jsonschema.Schema{
-							Type: "object",
-							Properties: map[string]*jsonschema.Schema{
-								"listSub": {Reference: strPtr("#/$defs/github.com/listSub")},
-							},
-						},
-					},
-				},
-			},
-			refs: map[string]*jsonschema.Schema{
-				"github.com/listSub": {Type: "array", Items: &jsonschema.Schema{Type: "object", Properties: map[string]*jsonschema.Schema{"subField": {Type: "string"}}}},
-			},
-			ownFields: map[string]bool{"github.com/listSub": true},
-			wantNodes: []rootNode{
-				{
-					Title:    "list",
-					TopLevel: true,
-					Type:     "Sequence",
-					ArrayItemAttributes: []attributeNode{
-						{Title: "listSub", Type: "Sequence", Link: "list.listSub"},
-					},
-				},
-				{
-					Title: "list.listSub",
-					Type:  "Sequence",
-					ArrayItemAttributes: []attributeNode{
-						{Title: "subField", Type: "String"},
-					},
-				},
-			},
-		},
-		{
-			name: "map expansion",
-			schema: jsonschema.Schema{
-				Type: "object",
-				Properties: map[string]*jsonschema.Schema{
-					"myMap": {
-						Type: "object",
-						AdditionalProperties: &jsonschema.Schema{
-							Reference: strPtr("#/$defs/github.com/myMap"),
-							Properties: map[string]*jsonschema.Schema{
-								"mapSub": {Type: "object", Reference: strPtr("#/$defs/github.com/mapSub")},
-							},
-						},
-					},
-				},
-			},
-			refs: map[string]*jsonschema.Schema{
-				"github.com/myMap": {
-					Type: "object",
-					Properties: map[string]*jsonschema.Schema{
-						"mapSub": {Type: "boolean", Reference: strPtr("#/$defs/github.com/mapSub")},
-					},
-				},
-				"github.com/mapSub": {
-					Type: "object",
-					Properties: map[string]*jsonschema.Schema{
-						"deepSub": {Type: "boolean"},
-					},
-				},
-			},
-			ownFields: map[string]bool{
-				"github.com/myMap":  true,
-				"github.com/mapSub": true,
-			},
-			wantNodes: []rootNode{
-				{
-					Title:    "myMap",
-					TopLevel: true,
-					Type:     "Map",
-					ObjectKeyAttributes: []attributeNode{
-						{Title: "mapSub", Type: "Map", Link: "myMap._name_.mapSub"},
-					},
-				},
-				{
-					Title: "myMap._name_.mapSub",
-					Type:  "Map",
-					Attributes: []attributeNode{
-						{Title: "deepSub", Type: "Boolean"},
-					},
-				},
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := buildNodes(tt.schema, tt.refs, tt.ownFields)
-			assert.Equal(t, tt.wantNodes, got)
-		})
-	}
-}
-
-func TestDeprecatedFields(t *testing.T) {
-	s := jsonschema.Schema{
-		Type: "object",
-		Properties: map[string]*jsonschema.Schema{
-			"deprecatedField": {Deprecated: true},
-			"notDeprecatedField": {
-				Properties: map[string]*jsonschema.Schema{
-					"nestedDeprecatedField": {
-						Deprecated:  true,
-						Description: "nested description",
-						Extension: jsonschema.Extension{
-							DeprecationMessage: "nested deprecation message",
-						},
-					},
-					"nestedNotDeprecatedField": {},
-				},
-			},
-		},
-	}
-	nodes := buildNodes(s, nil, nil)
-	assert.Len(t, nodes, 1)
-	assert.Equal(t, "notDeprecatedField", nodes[0].Title)
-
-	assert.Len(t, nodes[0].Attributes, 2)
-	assert.Equal(t, "nested deprecation message", nodes[0].Attributes[0].Description)
-}
-
-func TestDoNotSuggestFields(t *testing.T) {
-	s := jsonschema.Schema{
-		Type: "object",
-		Properties: map[string]*jsonschema.Schema{
-			"doNotSuggestField": {Extension: jsonschema.Extension{DoNotSuggest: true}},
-			"notDoNotSuggestField": {
-				Properties: map[string]*jsonschema.Schema{
-					"nestedDoNotSuggestField": {
-						Description: "nested description",
-						Extension: jsonschema.Extension{
-							DeprecationMessage: "nested do message",
-							DoNotSuggest:       true,
-						},
-					},
-					"nestedNotDoNotSuggestField": {
-						Description: "nested suggested field",
-					},
-				},
-			},
-		},
-	}
-	nodes := buildNodes(s, nil, nil)
-	assert.Len(t, nodes, 1)
-	assert.Equal(t, "notDoNotSuggestField", nodes[0].Title)
-
-	assert.Len(t, nodes[0].Attributes, 1)
-	assert.Equal(t, "nestedNotDoNotSuggestField", nodes[0].Attributes[0].Title)
-}
-
-func strPtr(s string) *string {
-	return &s
-}
diff --git a/bundle/docsgen/output/reference.md b/bundle/docsgen/output/reference.md
deleted file mode 100644
index ea8f922575e..00000000000
--- a/bundle/docsgen/output/reference.md
+++ /dev/null
@@ -1,4568 +0,0 @@
----
-description: 'Configuration reference for databricks.yml'
-last_update:
-  date: 2026-04-23
----
-
-<!--DO NOT EDIT. This file is autogenerated with https://github.com/databricks/cli-->
-
-# Configuration reference
-
-This article provides reference for keys supported by :re[DABS] configuration (YAML). See [\_](/dev-tools/bundles/index.md).
-
-For complete bundle examples, see [\_](/dev-tools/bundles/resource-examples.md) and the [bundle-examples GitHub repository](https://github.com/databricks/bundle-examples).
-
-  
-## artifacts
-  
-**`Type: Map`**
-  
-Defines the attributes to build artifacts, where each key is the name of the artifact, and the value is a Map that defines the artifact build settings. For information about the `artifacts` mapping, see [\_](/dev-tools/bundles/settings.md#artifacts).
-
-Artifact settings defined in the top level of the bundle configuration can be overridden in the `targets` mapping. See [\_](/dev-tools/bundles/artifact-overrides.md).
-  
-```yaml
-artifacts:
-  <artifact-name>:
-    <artifact-field-name>: <artifact-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `build`
-  - String
-  - An optional set of build commands to run locally before deployment.
-  
-- - `dynamic_version`
-  - Boolean
-  - Whether to patch the wheel version dynamically based on the timestamp of the whl file. If this is set to `true`, new code can be deployed without having to update the version in `setup.py` or `pyproject.toml`. This setting is only valid when `type` is set to `whl`. See [\_](/dev-tools/bundles/settings.md#bundle-syntax-mappings-artifacts).
-  
-- - `executable`
-  - String
-  - The executable type. Valid values are `bash`, `sh`, and `cmd`.
-  
-- - `files`
-  - Sequence
-  - The relative or absolute path to the built artifact files. See [\_](#artifactsnamefiles).
-  
-- - `path`
-  - String
-  - The local path of the directory for the artifact.
-  
-- - `type`
-  - String
-  - Required if the artifact is a Python wheel. The type of the artifact. Valid values are `whl` and `jar`.
-  
-:::
-  
-  
-**Example**
-  
-```yaml
-artifacts:
-  default:
-    type: whl
-    build: poetry build
-    path: .
-```
-  
-### artifacts._name_.files
-  
-**`Type: Sequence`**
-  
-The relative or absolute path to the built artifact files.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `source`
-  - String
-  - Required. The artifact source file.
-  
-:::
-  
-  
-## bundle
-  
-**`Type: Map`**
-  
-The bundle attributes when deploying to this target,
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `cluster_id`
-  - String
-  - The ID of a cluster to use to run the bundle. See [\_](/dev-tools/bundles/settings.md#cluster_id).
-  
-- - `compute_id`
-  - String
-  - Deprecated. The ID of the compute to use to run the bundle.
-  
-- - `databricks_cli_version`
-  - String
-  - The Databricks CLI version to use for the bundle. See [\_](/dev-tools/bundles/settings.md#databricks_cli_version).
-  
-- - `deployment`
-  - Map
-  - The definition of the bundle deployment. For supported attributes see [\_](/dev-tools/bundles/deployment-modes.md). See [\_](#bundledeployment).
-  
-- - `engine`
-  - String
-  - The deployment engine to use. Valid values are `terraform` and `direct`. Takes priority over `DATABRICKS_BUNDLE_ENGINE` environment variable. Default is "terraform".
-  
-- - `git`
-  - Map
-  - The Git version control details that are associated with your bundle. For supported attributes see [\_](/dev-tools/bundles/settings.md#git). See [\_](#bundlegit).
-  
-- - `name`
-  - String
-  - The name of the bundle.
-  
-- - `uuid`
-  - String
-  - Reserved. A Universally Unique Identifier (UUID) for the bundle that uniquely identifies the bundle in internal Databricks systems. This is generated when a bundle project is initialized using a Databricks template (using the `databricks bundle init` command).
-  
-:::
-  
-  
-### bundle.deployment
-  
-**`Type: Map`**
-  
-The definition of the bundle deployment. For supported attributes see [\_](/dev-tools/bundles/deployment-modes.md).
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `fail_on_active_runs`
-  - Boolean
-  - Whether to fail on active runs. If this is set to true a deployment that is running can be interrupted.
-  
-- - `lock`
-  - Map
-  - The deployment lock attributes. See [\_](#bundledeploymentlock).
-  
-:::
-  
-  
-### bundle.deployment.lock
-  
-**`Type: Map`**
-  
-The deployment lock attributes.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `enabled`
-  - Boolean
-  - Whether this lock is enabled.
-  
-- - `force`
-  - Boolean
-  - Whether to force this lock if it is enabled.
-  
-:::
-  
-  
-### bundle.git
-  
-**`Type: Map`**
-  
-The Git version control details that are associated with your bundle. For supported attributes see [\_](/dev-tools/bundles/settings.md#git).
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `branch`
-  - String
-  - The Git branch name. See [\_](/dev-tools/bundles/settings.md#git).
-  
-- - `origin_url`
-  - String
-  - The origin URL of the repository. See [\_](/dev-tools/bundles/settings.md#git).
-  
-:::
-  
-  
-## experimental
-  
-**`Type: Map`**
-  
-Defines attributes for experimental features.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `pydabs`
-  - Map
-  - Deprecated: please use python instead
-  
-- - `python`
-  - Map
-  - Configures loading of Python code defined with 'databricks-bundles' package. See [\_](#experimentalpython).
-  
-- - `python_wheel_wrapper`
-  - Boolean
-  - Whether to use a Python wheel wrapper.
-  
-- - `scripts`
-  - Map
-  - The commands to run.
-  
-- - `skip_artifact_cleanup`
-  - Boolean
-  - Determines whether to skip cleaning up the .internal folder
-  
-- - `skip_name_prefix_for_schema`
-  - Boolean
-  - Skip adding the prefix that is either set in `presets.name_prefix` or computed when `mode: development` is set, to the names of UC schemas defined in the bundle.
-  
-- - `use_legacy_run_as`
-  - Boolean
-  - Whether to use the legacy run_as behavior.
-  
-:::
-  
-  
-### experimental.python
-  
-**`Type: Map`**
-  
-Configures loading of Python code defined with 'databricks-bundles' package.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `mutators`
-  - Sequence
-  - Mutators contains a list of fully qualified function paths to mutator functions.  Example: ["my_project.mutators:add_default_cluster"]
-  
-- - `resources`
-  - Sequence
-  - Resources contains a list of fully qualified function paths to load resources defined in Python code.  Example: ["my_project.resources:load_resources"]
-  
-- - `venv_path`
-  - String
-  - VEnvPath is path to the virtual environment.  If enabled, Python code will execute within this environment. If disabled, it defaults to using the Python interpreter available in the current shell.
-  
-:::
-  
-  
-## include
-  
-**`Type: Sequence`**
-  
-Specifies a list of path globs that contain configuration files to include within the bundle. See [\_](/dev-tools/bundles/settings.md#include).
-  
-  
-## permissions
-  
-**`Type: Sequence`**
-  
-A Sequence that defines the permissions to apply to experiments, jobs, pipelines, and models defined in the bundle, where each item in the sequence is a permission for a specific entity.
-
-See [\_](/dev-tools/bundles/settings.md#permissions) and [\_](/dev-tools/bundles/permissions.md).
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `group_name`
-  - String
-  - The name of the group that has the permission set in level.
-  
-- - `level`
-  - String
-  - The allowed permission for user, group, service principal defined for this permission.
-  
-- - `service_principal_name`
-  - String
-  - The name of the service principal that has the permission set in level.
-  
-- - `user_name`
-  - String
-  - The name of the user that has the permission set in level.
-  
-:::
-  
-  
-**Example**
-  
-```yaml
-permissions:
-  - level: CAN_VIEW
-    group_name: test-group
-  - level: CAN_MANAGE
-    user_name: someone@example.com
-  - level: CAN_RUN
-    service_principal_name: 123456-abcdef
-```
-  
-## presets
-  
-**`Type: Map`**
-  
-Defines bundle deployment presets. See [\_](/dev-tools/bundles/deployment-modes.md#presets).
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `artifacts_dynamic_version`
-  - Boolean
-  - Whether to enable dynamic_version on all artifacts.
-  
-- - `jobs_max_concurrent_runs`
-  - Integer
-  - The maximum concurrent runs for a job.
-  
-- - `name_prefix`
-  - String
-  - The prefix for job runs of the bundle.
-  
-- - `pipelines_development`
-  - Boolean
-  - Whether pipeline deployments should be locked in development mode.
-  
-- - `source_linked_deployment`
-  - Boolean
-  - Whether to link the deployment to the bundle source.
-  
-- - `tags`
-  - Map
-  - The tags for the bundle deployment.
-  
-- - `trigger_pause_status`
-  - String
-  - A pause status to apply to all job triggers and schedules. Valid values are PAUSED or UNPAUSED.
-  
-:::
-  
-  
-## python
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `mutators`
-  - Sequence
-  - Mutators contains a list of fully qualified function paths to mutator functions.  Example: ["my_project.mutators:add_default_cluster"]
-  
-- - `resources`
-  - Sequence
-  - Resources contains a list of fully qualified function paths to load resources defined in Python code.  Example: ["my_project.resources:load_resources"]
-  
-- - `venv_path`
-  - String
-  - VEnvPath is path to the virtual environment.  If enabled, Python code will execute within this environment. If disabled, it defaults to using the Python interpreter available in the current shell.
-  
-:::
-  
-  
-## resources
-  
-**`Type: Map`**
-  
-A Map that defines the resources for the bundle, where each key is the name of the resource, and the value is a Map that defines the resource. For more information about Declarative Automation Bundles supported resources, and resource definition reference, see [\_](/dev-tools/bundles/resources.md).
-
-```yaml
-resources:
-  <resource-type>:
-    <resource-name>:
-      <resource-field-name>: <resource-field-value>
-```
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `alerts`
-  - Map
-  - See [\_](#resourcesalerts).
-  
-- - `apps`
-  - Map
-  - The app resource defines a [Databricks app](/api/workspace/apps/create). For information about Databricks Apps, see [\_](/dev-tools/databricks-apps/index.md). See [\_](#resourcesapps).
-  
-- - `catalogs`
-  - Map
-  - See [\_](#resourcescatalogs).
-  
-- - `clusters`
-  - Map
-  - The cluster definitions for the bundle, where each key is the name of a cluster. See [\_](/dev-tools/bundles/resources.md#clusters).
-  
-- - `dashboards`
-  - Map
-  - The dashboard definitions for the bundle, where each key is the name of the dashboard. See [\_](/dev-tools/bundles/resources.md#dashboards). See [\_](#resourcesdashboards).
-  
-- - `database_catalogs`
-  - Map
-  - 
-  
-- - `database_instances`
-  - Map
-  - See [\_](#resourcesdatabase_instances).
-  
-- - `experiments`
-  - Map
-  - The experiment definitions for the bundle, where each key is the name of the experiment. See [\_](/dev-tools/bundles/resources.md#experiments).
-  
-- - `external_locations`
-  - Map
-  - See [\_](#resourcesexternal_locations).
-  
-- - `jobs`
-  - Map
-  - The job definitions for the bundle, where each key is the name of the job. See [\_](/dev-tools/bundles/resources.md#jobs).
-  
-- - `model_serving_endpoints`
-  - Map
-  - The model serving endpoint definitions for the bundle, where each key is the name of the model serving endpoint. See [\_](/dev-tools/bundles/resources.md#model_serving_endpoints).
-  
-- - `models`
-  - Map
-  - The model definitions for the bundle, where each key is the name of the model. See [\_](/dev-tools/bundles/resources.md#models).
-  
-- - `pipelines`
-  - Map
-  - The pipeline definitions for the bundle, where each key is the name of the pipeline. See [\_](/dev-tools/bundles/resources.md#pipelines).
-  
-- - `postgres_branches`
-  - Map
-  - See [\_](#resourcespostgres_branches).
-  
-- - `postgres_endpoints`
-  - Map
-  - See [\_](#resourcespostgres_endpoints).
-  
-- - `postgres_projects`
-  - Map
-  - See [\_](#resourcespostgres_projects).
-  
-- - `quality_monitors`
-  - Map
-  - The quality monitor definitions for the bundle, where each key is the name of the quality monitor. See [\_](/dev-tools/bundles/resources.md#quality_monitors).
-  
-- - `registered_models`
-  - Map
-  - The registered model definitions for the bundle, where each key is the name of the Unity Catalog registered model. See [\_](/dev-tools/bundles/resources.md#registered_models)
-  
-- - `schemas`
-  - Map
-  - The schema definitions for the bundle, where each key is the name of the schema. See [\_](/dev-tools/bundles/resources.md#schemas).
-  
-- - `secret_scopes`
-  - Map
-  - The secret scope definitions for the bundle, where each key is the name of the secret scope. See [\_](/dev-tools/bundles/resources.md#secret_scopes). See [\_](#resourcessecret_scopes).
-  
-- - `sql_warehouses`
-  - Map
-  - The SQL warehouse definitions for the bundle, where each key is the name of the warehouse. See [\_](/dev-tools/bundles/resources.md#sql_warehouses).
-  
-- - `synced_database_tables`
-  - Map
-  - See [\_](#resourcessynced_database_tables).
-  
-- - `vector_search_endpoints`
-  - Map
-  - See [\_](#resourcesvector_search_endpoints).
-  
-- - `volumes`
-  - Map
-  - The volume definitions for the bundle, where each key is the name of the volume. See [\_](/dev-tools/bundles/resources.md#volumes).
-  
-:::
-  
-  
-### resources.alerts
-  
-**`Type: Map`**
-  
-
-  
-```yaml
-alerts:
-  <alert-name>:
-    <alert-field-name>: <alert-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `create_time`
-  - String
-  - 
-  
-- - `custom_description`
-  - String
-  - 
-  
-- - `custom_summary`
-  - String
-  - 
-  
-- - `display_name`
-  - String
-  - 
-  
-- - `effective_run_as`
-  - Map
-  - See [\_](#resourcesalertsnameeffective_run_as).
-  
-- - `evaluation`
-  - Map
-  - See [\_](#resourcesalertsnameevaluation).
-  
-- - `file_path`
-  - String
-  - 
-  
-- - `id`
-  - String
-  - 
-  
-- - `lifecycle`
-  - Map
-  - See [\_](#resourcesalertsnamelifecycle).
-  
-- - `lifecycle_state`
-  - String
-  - 
-  
-- - `owner_user_name`
-  - String
-  - 
-  
-- - `parent_path`
-  - String
-  - 
-  
-- - `permissions`
-  - Sequence
-  - See [\_](#resourcesalertsnamepermissions).
-  
-- - `query_text`
-  - String
-  - 
-  
-- - `run_as`
-  - Map
-  - See [\_](#resourcesalertsnamerun_as).
-  
-- - `run_as_user_name`
-  - String
-  - 
-  
-- - `schedule`
-  - Map
-  - See [\_](#resourcesalertsnameschedule).
-  
-- - `update_time`
-  - String
-  - 
-  
-- - `warehouse_id`
-  - String
-  - 
-  
-:::
-  
-  
-### resources.alerts._name_.lifecycle
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-### resources.alerts._name_.permissions
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `group_name`
-  - String
-  - The name of the group that has the permission set in level.
-  
-- - `level`
-  - String
-  - The allowed permission for user, group, service principal defined for this permission.
-  
-- - `service_principal_name`
-  - String
-  - The name of the service principal that has the permission set in level.
-  
-- - `user_name`
-  - String
-  - The name of the user that has the permission set in level.
-  
-:::
-  
-  
-### resources.apps
-  
-**`Type: Map`**
-  
-The app resource defines a [Databricks app](/api/workspace/apps/create). For information about Databricks Apps, see [\_](/dev-tools/databricks-apps/index.md).
-  
-```yaml
-apps:
-  <app-name>:
-    <app-field-name>: <app-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `active_deployment`
-  - Map
-  - See [\_](#resourcesappsnameactive_deployment).
-  
-- - `app_status`
-  - Map
-  - See [\_](#resourcesappsnameapp_status).
-  
-- - `budget_policy_id`
-  - String
-  - 
-  
-- - `compute_size`
-  - String
-  - 
-  
-- - `compute_status`
-  - Map
-  - See [\_](#resourcesappsnamecompute_status).
-  
-- - `config`
-  - Map
-  - See [\_](#resourcesappsnameconfig).
-  
-- - `create_time`
-  - String
-  - 
-  
-- - `creator`
-  - String
-  - 
-  
-- - `default_source_code_path`
-  - String
-  - 
-  
-- - `description`
-  - String
-  - 
-  
-- - `effective_budget_policy_id`
-  - String
-  - 
-  
-- - `effective_usage_policy_id`
-  - String
-  - 
-  
-- - `effective_user_api_scopes`
-  - Sequence
-  - 
-  
-- - `git_repository`
-  - Map
-  - See [\_](#resourcesappsnamegit_repository).
-  
-- - `git_source`
-  - Map
-  - Git source configuration for app deployments. Specifies which git reference (branch, tag, or commit) to use when deploying the app. Used in conjunction with git_repository to deploy code directly from git. The source_code_path within git_source specifies the relative path to the app code within the repository. See [\_](#resourcesappsnamegit_source).
-  
-- - `id`
-  - String
-  - 
-  
-- - `lifecycle`
-  - Map
-  - See [\_](#resourcesappsnamelifecycle).
-  
-- - `name`
-  - String
-  - 
-  
-- - `oauth2_app_client_id`
-  - String
-  - 
-  
-- - `oauth2_app_integration_id`
-  - String
-  - 
-  
-- - `pending_deployment`
-  - Map
-  - See [\_](#resourcesappsnamepending_deployment).
-  
-- - `permissions`
-  - Sequence
-  - See [\_](#resourcesappsnamepermissions).
-  
-- - `resources`
-  - Sequence
-  - See [\_](#resourcesappsnameresources).
-  
-- - `service_principal_client_id`
-  - String
-  - 
-  
-- - `service_principal_id`
-  - Integer
-  - 
-  
-- - `service_principal_name`
-  - String
-  - 
-  
-- - `source_code_path`
-  - String
-  - 
-  
-- - `space`
-  - String
-  - 
-  
-- - `telemetry_export_destinations`
-  - Sequence
-  - See [\_](#resourcesappsnametelemetry_export_destinations).
-  
-- - `update_time`
-  - String
-  - 
-  
-- - `updater`
-  - String
-  - 
-  
-- - `url`
-  - String
-  - 
-  
-- - `usage_policy_id`
-  - String
-  - 
-  
-- - `user_api_scopes`
-  - Sequence
-  - 
-  
-:::
-  
-  
-### resources.apps._name_.config
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `command`
-  - Sequence
-  - 
-  
-- - `env`
-  - Sequence
-  - See [\_](#resourcesappsnameconfigenv).
-  
-:::
-  
-  
-### resources.apps._name_.config.env
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `name`
-  - String
-  - 
-  
-- - `value`
-  - String
-  - 
-  
-- - `value_from`
-  - String
-  - 
-  
-:::
-  
-  
-### resources.apps._name_.lifecycle
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-- - `started`
-  - Boolean
-  - Lifecycle setting to deploy the resource in started mode. Only supported for apps, clusters, and sql_warehouses in direct deployment mode.
-  
-:::
-  
-  
-### resources.apps._name_.permissions
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `group_name`
-  - String
-  - 
-  
-- - `level`
-  - String
-  - 
-  
-- - `service_principal_name`
-  - String
-  - 
-  
-- - `user_name`
-  - String
-  - 
-  
-:::
-  
-  
-### resources.catalogs
-  
-**`Type: Map`**
-  
-
-  
-```yaml
-catalogs:
-  <catalog-name>:
-    <catalog-field-name>: <catalog-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `comment`
-  - String
-  - 
-  
-- - `connection_name`
-  - String
-  - 
-  
-- - `grants`
-  - Sequence
-  - See [\_](#resourcescatalogsnamegrants).
-  
-- - `lifecycle`
-  - Map
-  - See [\_](#resourcescatalogsnamelifecycle).
-  
-- - `managed_encryption_settings`
-  - Map
-  - See [\_](#resourcescatalogsnamemanaged_encryption_settings).
-  
-- - `name`
-  - String
-  - 
-  
-- - `options`
-  - Map
-  - 
-  
-- - `properties`
-  - Map
-  - 
-  
-- - `provider_name`
-  - String
-  - 
-  
-- - `share_name`
-  - String
-  - 
-  
-- - `storage_root`
-  - String
-  - 
-  
-:::
-  
-  
-### resources.catalogs._name_.lifecycle
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-### resources.dashboards
-  
-**`Type: Map`**
-  
-The dashboard definitions for the bundle, where each key is the name of the dashboard. See [\_](/dev-tools/bundles/resources.md#dashboards).
-  
-```yaml
-dashboards:
-  <dashboard-name>:
-    <dashboard-field-name>: <dashboard-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `create_time`
-  - String
-  - 
-  
-- - `dashboard_id`
-  - String
-  - 
-  
-- - `dataset_catalog`
-  - String
-  - Sets the default catalog for all datasets in this dashboard. When set, this overrides the catalog specified in individual dataset definitions.
-  
-- - `dataset_schema`
-  - String
-  - Sets the default schema for all datasets in this dashboard. When set, this overrides the schema specified in individual dataset definitions.
-  
-- - `display_name`
-  - String
-  - 
-  
-- - `embed_credentials`
-  - Boolean
-  - 
-  
-- - `etag`
-  - String
-  - 
-  
-- - `file_path`
-  - String
-  - 
-  
-- - `lifecycle`
-  - Map
-  - See [\_](#resourcesdashboardsnamelifecycle).
-  
-- - `lifecycle_state`
-  - String
-  - 
-  
-- - `parent_path`
-  - String
-  - 
-  
-- - `path`
-  - String
-  - 
-  
-- - `permissions`
-  - Sequence
-  - See [\_](#resourcesdashboardsnamepermissions).
-  
-- - `serialized_dashboard`
-  - Any
-  - 
-  
-- - `update_time`
-  - String
-  - 
-  
-- - `warehouse_id`
-  - String
-  - 
-  
-:::
-  
-  
-### resources.dashboards._name_.lifecycle
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-### resources.dashboards._name_.permissions
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `group_name`
-  - String
-  - The name of the group that has the permission set in level.
-  
-- - `level`
-  - String
-  - The allowed permission for user, group, service principal defined for this permission.
-  
-- - `service_principal_name`
-  - String
-  - The name of the service principal that has the permission set in level.
-  
-- - `user_name`
-  - String
-  - The name of the user that has the permission set in level.
-  
-:::
-  
-  
-### resources.database_instances
-  
-**`Type: Map`**
-  
-
-  
-```yaml
-database_instances:
-  <database_instance-name>:
-    <database_instance-field-name>: <database_instance-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `capacity`
-  - String
-  - 
-  
-- - `child_instance_refs`
-  - Sequence
-  - See [\_](#resourcesdatabase_instancesnamechild_instance_refs).
-  
-- - `creation_time`
-  - String
-  - 
-  
-- - `creator`
-  - String
-  - 
-  
-- - `custom_tags`
-  - Sequence
-  - See [\_](#resourcesdatabase_instancesnamecustom_tags).
-  
-- - `effective_capacity`
-  - String
-  - 
-  
-- - `effective_custom_tags`
-  - Sequence
-  - See [\_](#resourcesdatabase_instancesnameeffective_custom_tags).
-  
-- - `effective_enable_pg_native_login`
-  - Boolean
-  - 
-  
-- - `effective_enable_readable_secondaries`
-  - Boolean
-  - 
-  
-- - `effective_node_count`
-  - Integer
-  - 
-  
-- - `effective_retention_window_in_days`
-  - Integer
-  - 
-  
-- - `effective_stopped`
-  - Boolean
-  - 
-  
-- - `effective_usage_policy_id`
-  - String
-  - 
-  
-- - `enable_pg_native_login`
-  - Boolean
-  - 
-  
-- - `enable_readable_secondaries`
-  - Boolean
-  - 
-  
-- - `lifecycle`
-  - Map
-  - See [\_](#resourcesdatabase_instancesnamelifecycle).
-  
-- - `name`
-  - String
-  - 
-  
-- - `node_count`
-  - Integer
-  - 
-  
-- - `parent_instance_ref`
-  - Map
-  - See [\_](#resourcesdatabase_instancesnameparent_instance_ref).
-  
-- - `permissions`
-  - Sequence
-  - See [\_](#resourcesdatabase_instancesnamepermissions).
-  
-- - `pg_version`
-  - String
-  - 
-  
-- - `read_only_dns`
-  - String
-  - 
-  
-- - `read_write_dns`
-  - String
-  - 
-  
-- - `retention_window_in_days`
-  - Integer
-  - 
-  
-- - `state`
-  - String
-  - 
-  
-- - `stopped`
-  - Boolean
-  - 
-  
-- - `uid`
-  - String
-  - 
-  
-- - `usage_policy_id`
-  - String
-  - 
-  
-:::
-  
-  
-### resources.database_instances._name_.lifecycle
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-### resources.database_instances._name_.permissions
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `group_name`
-  - String
-  - The name of the group that has the permission set in level.
-  
-- - `level`
-  - String
-  - The allowed permission for user, group, service principal defined for this permission.
-  
-- - `service_principal_name`
-  - String
-  - The name of the service principal that has the permission set in level.
-  
-- - `user_name`
-  - String
-  - The name of the user that has the permission set in level.
-  
-:::
-  
-  
-### resources.external_locations
-  
-**`Type: Map`**
-  
-
-  
-```yaml
-external_locations:
-  <external_location-name>:
-    <external_location-field-name>: <external_location-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `comment`
-  - String
-  - 
-  
-- - `credential_name`
-  - String
-  - 
-  
-- - `effective_enable_file_events`
-  - Boolean
-  - 
-  
-- - `effective_file_event_queue`
-  - Map
-  - See [\_](#resourcesexternal_locationsnameeffective_file_event_queue).
-  
-- - `enable_file_events`
-  - Boolean
-  - 
-  
-- - `encryption_details`
-  - Map
-  - See [\_](#resourcesexternal_locationsnameencryption_details).
-  
-- - `fallback`
-  - Boolean
-  - 
-  
-- - `file_event_queue`
-  - Map
-  - See [\_](#resourcesexternal_locationsnamefile_event_queue).
-  
-- - `grants`
-  - Sequence
-  - See [\_](#resourcesexternal_locationsnamegrants).
-  
-- - `lifecycle`
-  - Map
-  - See [\_](#resourcesexternal_locationsnamelifecycle).
-  
-- - `name`
-  - String
-  - 
-  
-- - `read_only`
-  - Boolean
-  - 
-  
-- - `skip_validation`
-  - Boolean
-  - 
-  
-- - `url`
-  - String
-  - 
-  
-:::
-  
-  
-### resources.external_locations._name_.lifecycle
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-### resources.postgres_branches
-  
-**`Type: Map`**
-  
-
-  
-```yaml
-postgres_branches:
-  <postgres_branche-name>:
-    <postgres_branche-field-name>: <postgres_branche-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `branch_id`
-  - String
-  - 
-  
-- - `expire_time`
-  - Map
-  - 
-  
-- - `is_protected`
-  - Boolean
-  - 
-  
-- - `lifecycle`
-  - Map
-  - See [\_](#resourcespostgres_branchesnamelifecycle).
-  
-- - `no_expiry`
-  - Boolean
-  - 
-  
-- - `parent`
-  - String
-  - 
-  
-- - `source_branch`
-  - String
-  - 
-  
-- - `source_branch_lsn`
-  - String
-  - 
-  
-- - `source_branch_time`
-  - Map
-  - 
-  
-- - `ttl`
-  - String
-  - 
-  
-:::
-  
-  
-### resources.postgres_branches._name_.lifecycle
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-### resources.postgres_endpoints
-  
-**`Type: Map`**
-  
-
-  
-```yaml
-postgres_endpoints:
-  <postgres_endpoint-name>:
-    <postgres_endpoint-field-name>: <postgres_endpoint-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `autoscaling_limit_max_cu`
-  - Any
-  - 
-  
-- - `autoscaling_limit_min_cu`
-  - Any
-  - 
-  
-- - `disabled`
-  - Boolean
-  - 
-  
-- - `endpoint_id`
-  - String
-  - 
-  
-- - `endpoint_type`
-  - String
-  - 
-  
-- - `group`
-  - Map
-  - See [\_](#resourcespostgres_endpointsnamegroup).
-  
-- - `lifecycle`
-  - Map
-  - See [\_](#resourcespostgres_endpointsnamelifecycle).
-  
-- - `no_suspension`
-  - Boolean
-  - 
-  
-- - `parent`
-  - String
-  - 
-  
-- - `settings`
-  - Map
-  - See [\_](#resourcespostgres_endpointsnamesettings).
-  
-- - `suspend_timeout_duration`
-  - String
-  - 
-  
-:::
-  
-  
-### resources.postgres_endpoints._name_.lifecycle
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-### resources.postgres_projects
-  
-**`Type: Map`**
-  
-
-  
-```yaml
-postgres_projects:
-  <postgres_project-name>:
-    <postgres_project-field-name>: <postgres_project-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `budget_policy_id`
-  - String
-  - 
-  
-- - `custom_tags`
-  - Sequence
-  - See [\_](#resourcespostgres_projectsnamecustom_tags).
-  
-- - `default_branch`
-  - String
-  - 
-  
-- - `default_endpoint_settings`
-  - Map
-  - See [\_](#resourcespostgres_projectsnamedefault_endpoint_settings).
-  
-- - `display_name`
-  - String
-  - 
-  
-- - `enable_pg_native_login`
-  - Boolean
-  - 
-  
-- - `history_retention_duration`
-  - String
-  - 
-  
-- - `lifecycle`
-  - Map
-  - See [\_](#resourcespostgres_projectsnamelifecycle).
-  
-- - `permissions`
-  - Sequence
-  - See [\_](#resourcespostgres_projectsnamepermissions).
-  
-- - `pg_version`
-  - Integer
-  - 
-  
-- - `project_id`
-  - String
-  - 
-  
-:::
-  
-  
-### resources.postgres_projects._name_.lifecycle
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-### resources.postgres_projects._name_.permissions
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `group_name`
-  - String
-  - The name of the group that has the permission set in level.
-  
-- - `level`
-  - String
-  - The allowed permission for user, group, service principal defined for this permission.
-  
-- - `service_principal_name`
-  - String
-  - The name of the service principal that has the permission set in level.
-  
-- - `user_name`
-  - String
-  - The name of the user that has the permission set in level.
-  
-:::
-  
-  
-### resources.secret_scopes
-  
-**`Type: Map`**
-  
-The secret scope definitions for the bundle, where each key is the name of the secret scope. See [\_](/dev-tools/bundles/resources.md#secret_scopes).
-  
-```yaml
-secret_scopes:
-  <secret_scope-name>:
-    <secret_scope-field-name>: <secret_scope-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `backend_type`
-  - String
-  - The backend type the scope will be created with. If not specified, will default to `DATABRICKS`
-  
-- - `keyvault_metadata`
-  - Map
-  - The metadata for the secret scope if the `backend_type` is `AZURE_KEYVAULT`. See [\_](#resourcessecret_scopesnamekeyvault_metadata).
-  
-- - `lifecycle`
-  - Map
-  - Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed. See [\_](#resourcessecret_scopesnamelifecycle).
-  
-- - `name`
-  - String
-  - Scope name requested by the user. Scope names are unique.
-  
-- - `permissions`
-  - Sequence
-  - The permissions to apply to the secret scope. Permissions are managed via secret scope ACLs. See [\_](#resourcessecret_scopesnamepermissions).
-  
-:::
-  
-  
-### resources.secret_scopes._name_.lifecycle
-  
-**`Type: Map`**
-  
-Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-### resources.secret_scopes._name_.permissions
-  
-**`Type: Sequence`**
-  
-The permissions to apply to the secret scope. Permissions are managed via secret scope ACLs.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `group_name`
-  - String
-  - The name of the group that has the permission set in level. This field translates to a `principal` field in secret scope ACL.
-  
-- - `level`
-  - String
-  - The allowed permission for user, group, service principal defined for this permission.
-  
-- - `service_principal_name`
-  - String
-  - The application ID of an active service principal. This field translates to a `principal` field in secret scope ACL.
-  
-- - `user_name`
-  - String
-  - The name of the user that has the permission set in level. This field translates to a `principal` field in secret scope ACL.
-  
-:::
-  
-  
-### resources.synced_database_tables
-  
-**`Type: Map`**
-  
-
-  
-```yaml
-synced_database_tables:
-  <synced_database_table-name>:
-    <synced_database_table-field-name>: <synced_database_table-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `data_synchronization_status`
-  - Map
-  - See [\_](#resourcessynced_database_tablesnamedata_synchronization_status).
-  
-- - `database_instance_name`
-  - String
-  - 
-  
-- - `effective_database_instance_name`
-  - String
-  - 
-  
-- - `effective_logical_database_name`
-  - String
-  - 
-  
-- - `lifecycle`
-  - Map
-  - See [\_](#resourcessynced_database_tablesnamelifecycle).
-  
-- - `logical_database_name`
-  - String
-  - 
-  
-- - `name`
-  - String
-  - 
-  
-- - `spec`
-  - Map
-  - See [\_](#resourcessynced_database_tablesnamespec).
-  
-- - `unity_catalog_provisioning_state`
-  - String
-  - 
-  
-:::
-  
-  
-### resources.synced_database_tables._name_.lifecycle
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-### resources.vector_search_endpoints
-  
-**`Type: Map`**
-  
-
-  
-```yaml
-vector_search_endpoints:
-  <vector_search_endpoint-name>:
-    <vector_search_endpoint-field-name>: <vector_search_endpoint-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `budget_policy_id`
-  - String
-  - 
-  
-- - `endpoint_type`
-  - String
-  - 
-  
-- - `lifecycle`
-  - Map
-  - See [\_](#resourcesvector_search_endpointsnamelifecycle).
-  
-- - `min_qps`
-  - Integer
-  - 
-  
-- - `name`
-  - String
-  - 
-  
-- - `permissions`
-  - Sequence
-  - See [\_](#resourcesvector_search_endpointsnamepermissions).
-  
-- - `usage_policy_id`
-  - String
-  - 
-  
-:::
-  
-  
-### resources.vector_search_endpoints._name_.lifecycle
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-### resources.vector_search_endpoints._name_.permissions
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `group_name`
-  - String
-  - The name of the group that has the permission set in level.
-  
-- - `level`
-  - String
-  - The allowed permission for user, group, service principal defined for this permission.
-  
-- - `service_principal_name`
-  - String
-  - The name of the service principal that has the permission set in level.
-  
-- - `user_name`
-  - String
-  - The name of the user that has the permission set in level.
-  
-:::
-  
-  
-## run_as
-  
-**`Type: Map`**
-  
-The identity to use when running Declarative Automation Bundles resources. See [\_](/dev-tools/bundles/run-as.md).
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `group_name`
-  - String
-  - 
-  
-- - `service_principal_name`
-  - String
-  - The application ID of an active service principal. Setting this field requires the `servicePrincipal/user` role.
-  
-- - `user_name`
-  - String
-  - The email of an active workspace user. Non-admin users can only set this field to their own email.
-  
-:::
-  
-  
-## scripts
-  
-**`Type: Map`**
-  
-
-  
-```yaml
-scripts:
-  <script-name>:
-    <script-field-name>: <script-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `content`
-  - String
-  - 
-  
-:::
-  
-  
-## sync
-  
-**`Type: Map`**
-  
-The files and file paths to include or exclude in the bundle. See [\_](/dev-tools/bundles/settings.md#sync).
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `exclude`
-  - Sequence
-  - A list of files or folders to exclude from the bundle.
-  
-- - `include`
-  - Sequence
-  - A list of files or folders to include in the bundle.
-  
-- - `paths`
-  - Sequence
-  - The local folder paths, which can be outside the bundle root, to synchronize to the workspace when the bundle is deployed.
-  
-:::
-  
-  
-## targets
-  
-**`Type: Map`**
-  
-Defines deployment targets for the bundle. See [\_](/dev-tools/bundles/settings.md#targets)
-  
-```yaml
-targets:
-  <target-name>:
-    <target-field-name>: <target-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `artifacts`
-  - Map
-  - The artifacts to include in the target deployment. See [\_](#targetsnameartifacts).
-  
-- - `bundle`
-  - Map
-  - The bundle attributes when deploying to this target. See [\_](#targetsnamebundle).
-  
-- - `cluster_id`
-  - String
-  - The ID of the cluster to use for this target.
-  
-- - `compute_id`
-  - String
-  - Deprecated: please use cluster_id instead
-  
-- - `default`
-  - Boolean
-  - Whether this target is the default target.
-  
-- - `git`
-  - Map
-  - The Git version control settings for the target. See [\_](#targetsnamegit).
-  
-- - `mode`
-  - String
-  - The deployment mode for the target. Valid values are `development` or `production`. See [\_](/dev-tools/bundles/deployment-modes.md).
-  
-- - `permissions`
-  - Sequence
-  - The permissions for deploying and running the bundle in the target. See [\_](#targetsnamepermissions).
-  
-- - `presets`
-  - Map
-  - The deployment presets for the target. See [\_](#targetsnamepresets).
-  
-- - `resources`
-  - Map
-  - The resource definitions for the target. See [\_](#targetsnameresources).
-  
-- - `run_as`
-  - Map
-  - The identity to use to run the bundle, see [\_](/dev-tools/bundles/run-as.md). See [\_](#targetsnamerun_as).
-  
-- - `sync`
-  - Map
-  - The local paths to sync to the target workspace when a bundle is run or deployed. See [\_](#targetsnamesync).
-  
-- - `variables`
-  - Map
-  - The custom variable definitions for the target. See [\_](#targetsnamevariables).
-  
-- - `workspace`
-  - Map
-  - The Databricks workspace for the target. See [\_](#targetsnameworkspace).
-  
-:::
-  
-  
-### targets._name_.artifacts
-  
-**`Type: Map`**
-  
-The artifacts to include in the target deployment.
-  
-```yaml
-artifacts:
-  <artifact-name>:
-    <artifact-field-name>: <artifact-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `build`
-  - String
-  - An optional set of build commands to run locally before deployment.
-  
-- - `dynamic_version`
-  - Boolean
-  - Whether to patch the wheel version dynamically based on the timestamp of the whl file. If this is set to `true`, new code can be deployed without having to update the version in `setup.py` or `pyproject.toml`. This setting is only valid when `type` is set to `whl`. See [\_](/dev-tools/bundles/settings.md#bundle-syntax-mappings-artifacts).
-  
-- - `executable`
-  - String
-  - The executable type. Valid values are `bash`, `sh`, and `cmd`.
-  
-- - `files`
-  - Sequence
-  - The relative or absolute path to the built artifact files. See [\_](#targetsnameartifactsnamefiles).
-  
-- - `path`
-  - String
-  - The local path of the directory for the artifact.
-  
-- - `type`
-  - String
-  - Required if the artifact is a Python wheel. The type of the artifact. Valid values are `whl` and `jar`.
-  
-:::
-  
-  
-### targets._name_.artifacts._name_.files
-  
-**`Type: Sequence`**
-  
-The relative or absolute path to the built artifact files.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `source`
-  - String
-  - Required. The artifact source file.
-  
-:::
-  
-  
-### targets._name_.bundle
-  
-**`Type: Map`**
-  
-The bundle attributes when deploying to this target.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `cluster_id`
-  - String
-  - The ID of a cluster to use to run the bundle. See [\_](/dev-tools/bundles/settings.md#cluster_id).
-  
-- - `compute_id`
-  - String
-  - Deprecated. The ID of the compute to use to run the bundle.
-  
-- - `databricks_cli_version`
-  - String
-  - The Databricks CLI version to use for the bundle. See [\_](/dev-tools/bundles/settings.md#databricks_cli_version).
-  
-- - `deployment`
-  - Map
-  - The definition of the bundle deployment. For supported attributes see [\_](/dev-tools/bundles/deployment-modes.md). See [\_](#targetsnamebundledeployment).
-  
-- - `engine`
-  - String
-  - The deployment engine to use. Valid values are `terraform` and `direct`. Takes priority over `DATABRICKS_BUNDLE_ENGINE` environment variable. Default is "terraform".
-  
-- - `git`
-  - Map
-  - The Git version control details that are associated with your bundle. For supported attributes see [\_](/dev-tools/bundles/settings.md#git). See [\_](#targetsnamebundlegit).
-  
-- - `name`
-  - String
-  - The name of the bundle.
-  
-- - `uuid`
-  - String
-  - Reserved. A Universally Unique Identifier (UUID) for the bundle that uniquely identifies the bundle in internal Databricks systems. This is generated when a bundle project is initialized using a Databricks template (using the `databricks bundle init` command).
-  
-:::
-  
-  
-### targets._name_.bundle.deployment
-  
-**`Type: Map`**
-  
-The definition of the bundle deployment. For supported attributes see [\_](/dev-tools/bundles/deployment-modes.md).
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `fail_on_active_runs`
-  - Boolean
-  - Whether to fail on active runs. If this is set to true a deployment that is running can be interrupted.
-  
-- - `lock`
-  - Map
-  - The deployment lock attributes. See [\_](#targetsnamebundledeploymentlock).
-  
-:::
-  
-  
-### targets._name_.bundle.deployment.lock
-  
-**`Type: Map`**
-  
-The deployment lock attributes.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `enabled`
-  - Boolean
-  - Whether this lock is enabled.
-  
-- - `force`
-  - Boolean
-  - Whether to force this lock if it is enabled.
-  
-:::
-  
-  
-### targets._name_.bundle.git
-  
-**`Type: Map`**
-  
-The Git version control details that are associated with your bundle. For supported attributes see [\_](/dev-tools/bundles/settings.md#git).
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `branch`
-  - String
-  - The Git branch name. See [\_](/dev-tools/bundles/settings.md#git).
-  
-- - `origin_url`
-  - String
-  - The origin URL of the repository. See [\_](/dev-tools/bundles/settings.md#git).
-  
-:::
-  
-  
-### targets._name_.git
-  
-**`Type: Map`**
-  
-The Git version control settings for the target.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `branch`
-  - String
-  - The Git branch name. See [\_](/dev-tools/bundles/settings.md#git).
-  
-- - `origin_url`
-  - String
-  - The origin URL of the repository. See [\_](/dev-tools/bundles/settings.md#git).
-  
-:::
-  
-  
-### targets._name_.permissions
-  
-**`Type: Sequence`**
-  
-The permissions for deploying and running the bundle in the target.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `group_name`
-  - String
-  - The name of the group that has the permission set in level.
-  
-- - `level`
-  - String
-  - The allowed permission for user, group, service principal defined for this permission.
-  
-- - `service_principal_name`
-  - String
-  - The name of the service principal that has the permission set in level.
-  
-- - `user_name`
-  - String
-  - The name of the user that has the permission set in level.
-  
-:::
-  
-  
-### targets._name_.presets
-  
-**`Type: Map`**
-  
-The deployment presets for the target.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `artifacts_dynamic_version`
-  - Boolean
-  - Whether to enable dynamic_version on all artifacts.
-  
-- - `jobs_max_concurrent_runs`
-  - Integer
-  - The maximum concurrent runs for a job.
-  
-- - `name_prefix`
-  - String
-  - The prefix for job runs of the bundle.
-  
-- - `pipelines_development`
-  - Boolean
-  - Whether pipeline deployments should be locked in development mode.
-  
-- - `source_linked_deployment`
-  - Boolean
-  - Whether to link the deployment to the bundle source.
-  
-- - `tags`
-  - Map
-  - The tags for the bundle deployment.
-  
-- - `trigger_pause_status`
-  - String
-  - A pause status to apply to all job triggers and schedules. Valid values are PAUSED or UNPAUSED.
-  
-:::
-  
-  
-### targets._name_.resources
-  
-**`Type: Map`**
-  
-The resource definitions for the target.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `alerts`
-  - Map
-  - See [\_](#targetsnameresourcesalerts).
-  
-- - `apps`
-  - Map
-  - The app resource defines a [Databricks app](/api/workspace/apps/create). For information about Databricks Apps, see [\_](/dev-tools/databricks-apps/index.md). See [\_](#targetsnameresourcesapps).
-  
-- - `catalogs`
-  - Map
-  - See [\_](#targetsnameresourcescatalogs).
-  
-- - `clusters`
-  - Map
-  - The cluster definitions for the bundle, where each key is the name of a cluster. See [\_](/dev-tools/bundles/resources.md#clusters).
-  
-- - `dashboards`
-  - Map
-  - The dashboard definitions for the bundle, where each key is the name of the dashboard. See [\_](/dev-tools/bundles/resources.md#dashboards). See [\_](#targetsnameresourcesdashboards).
-  
-- - `database_catalogs`
-  - Map
-  - 
-  
-- - `database_instances`
-  - Map
-  - See [\_](#targetsnameresourcesdatabase_instances).
-  
-- - `experiments`
-  - Map
-  - The experiment definitions for the bundle, where each key is the name of the experiment. See [\_](/dev-tools/bundles/resources.md#experiments).
-  
-- - `external_locations`
-  - Map
-  - See [\_](#targetsnameresourcesexternal_locations).
-  
-- - `jobs`
-  - Map
-  - The job definitions for the bundle, where each key is the name of the job. See [\_](/dev-tools/bundles/resources.md#jobs).
-  
-- - `model_serving_endpoints`
-  - Map
-  - The model serving endpoint definitions for the bundle, where each key is the name of the model serving endpoint. See [\_](/dev-tools/bundles/resources.md#model_serving_endpoints).
-  
-- - `models`
-  - Map
-  - The model definitions for the bundle, where each key is the name of the model. See [\_](/dev-tools/bundles/resources.md#models).
-  
-- - `pipelines`
-  - Map
-  - The pipeline definitions for the bundle, where each key is the name of the pipeline. See [\_](/dev-tools/bundles/resources.md#pipelines).
-  
-- - `postgres_branches`
-  - Map
-  - See [\_](#targetsnameresourcespostgres_branches).
-  
-- - `postgres_endpoints`
-  - Map
-  - See [\_](#targetsnameresourcespostgres_endpoints).
-  
-- - `postgres_projects`
-  - Map
-  - See [\_](#targetsnameresourcespostgres_projects).
-  
-- - `quality_monitors`
-  - Map
-  - The quality monitor definitions for the bundle, where each key is the name of the quality monitor. See [\_](/dev-tools/bundles/resources.md#quality_monitors).
-  
-- - `registered_models`
-  - Map
-  - The registered model definitions for the bundle, where each key is the name of the Unity Catalog registered model. See [\_](/dev-tools/bundles/resources.md#registered_models)
-  
-- - `schemas`
-  - Map
-  - The schema definitions for the bundle, where each key is the name of the schema. See [\_](/dev-tools/bundles/resources.md#schemas).
-  
-- - `secret_scopes`
-  - Map
-  - The secret scope definitions for the bundle, where each key is the name of the secret scope. See [\_](/dev-tools/bundles/resources.md#secret_scopes). See [\_](#targetsnameresourcessecret_scopes).
-  
-- - `sql_warehouses`
-  - Map
-  - The SQL warehouse definitions for the bundle, where each key is the name of the warehouse. See [\_](/dev-tools/bundles/resources.md#sql_warehouses).
-  
-- - `synced_database_tables`
-  - Map
-  - See [\_](#targetsnameresourcessynced_database_tables).
-  
-- - `vector_search_endpoints`
-  - Map
-  - See [\_](#targetsnameresourcesvector_search_endpoints).
-  
-- - `volumes`
-  - Map
-  - The volume definitions for the bundle, where each key is the name of the volume. See [\_](/dev-tools/bundles/resources.md#volumes).
-  
-:::
-  
-  
-### targets._name_.resources.alerts
-  
-**`Type: Map`**
-  
-
-  
-```yaml
-alerts:
-  <alert-name>:
-    <alert-field-name>: <alert-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `create_time`
-  - String
-  - 
-  
-- - `custom_description`
-  - String
-  - 
-  
-- - `custom_summary`
-  - String
-  - 
-  
-- - `display_name`
-  - String
-  - 
-  
-- - `effective_run_as`
-  - Map
-  - See [\_](#targetsnameresourcesalertsnameeffective_run_as).
-  
-- - `evaluation`
-  - Map
-  - See [\_](#targetsnameresourcesalertsnameevaluation).
-  
-- - `file_path`
-  - String
-  - 
-  
-- - `id`
-  - String
-  - 
-  
-- - `lifecycle`
-  - Map
-  - See [\_](#targetsnameresourcesalertsnamelifecycle).
-  
-- - `lifecycle_state`
-  - String
-  - 
-  
-- - `owner_user_name`
-  - String
-  - 
-  
-- - `parent_path`
-  - String
-  - 
-  
-- - `permissions`
-  - Sequence
-  - See [\_](#targetsnameresourcesalertsnamepermissions).
-  
-- - `query_text`
-  - String
-  - 
-  
-- - `run_as`
-  - Map
-  - See [\_](#targetsnameresourcesalertsnamerun_as).
-  
-- - `run_as_user_name`
-  - String
-  - 
-  
-- - `schedule`
-  - Map
-  - See [\_](#targetsnameresourcesalertsnameschedule).
-  
-- - `update_time`
-  - String
-  - 
-  
-- - `warehouse_id`
-  - String
-  - 
-  
-:::
-  
-  
-### targets._name_.resources.alerts._name_.lifecycle
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-### targets._name_.resources.alerts._name_.permissions
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `group_name`
-  - String
-  - The name of the group that has the permission set in level.
-  
-- - `level`
-  - String
-  - The allowed permission for user, group, service principal defined for this permission.
-  
-- - `service_principal_name`
-  - String
-  - The name of the service principal that has the permission set in level.
-  
-- - `user_name`
-  - String
-  - The name of the user that has the permission set in level.
-  
-:::
-  
-  
-### targets._name_.resources.apps
-  
-**`Type: Map`**
-  
-The app resource defines a [Databricks app](/api/workspace/apps/create). For information about Databricks Apps, see [\_](/dev-tools/databricks-apps/index.md).
-  
-```yaml
-apps:
-  <app-name>:
-    <app-field-name>: <app-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `active_deployment`
-  - Map
-  - See [\_](#targetsnameresourcesappsnameactive_deployment).
-  
-- - `app_status`
-  - Map
-  - See [\_](#targetsnameresourcesappsnameapp_status).
-  
-- - `budget_policy_id`
-  - String
-  - 
-  
-- - `compute_size`
-  - String
-  - 
-  
-- - `compute_status`
-  - Map
-  - See [\_](#targetsnameresourcesappsnamecompute_status).
-  
-- - `config`
-  - Map
-  - See [\_](#targetsnameresourcesappsnameconfig).
-  
-- - `create_time`
-  - String
-  - 
-  
-- - `creator`
-  - String
-  - 
-  
-- - `default_source_code_path`
-  - String
-  - 
-  
-- - `description`
-  - String
-  - 
-  
-- - `effective_budget_policy_id`
-  - String
-  - 
-  
-- - `effective_usage_policy_id`
-  - String
-  - 
-  
-- - `effective_user_api_scopes`
-  - Sequence
-  - 
-  
-- - `git_repository`
-  - Map
-  - See [\_](#targetsnameresourcesappsnamegit_repository).
-  
-- - `git_source`
-  - Map
-  - Git source configuration for app deployments. Specifies which git reference (branch, tag, or commit) to use when deploying the app. Used in conjunction with git_repository to deploy code directly from git. The source_code_path within git_source specifies the relative path to the app code within the repository. See [\_](#targetsnameresourcesappsnamegit_source).
-  
-- - `id`
-  - String
-  - 
-  
-- - `lifecycle`
-  - Map
-  - See [\_](#targetsnameresourcesappsnamelifecycle).
-  
-- - `name`
-  - String
-  - 
-  
-- - `oauth2_app_client_id`
-  - String
-  - 
-  
-- - `oauth2_app_integration_id`
-  - String
-  - 
-  
-- - `pending_deployment`
-  - Map
-  - See [\_](#targetsnameresourcesappsnamepending_deployment).
-  
-- - `permissions`
-  - Sequence
-  - See [\_](#targetsnameresourcesappsnamepermissions).
-  
-- - `resources`
-  - Sequence
-  - See [\_](#targetsnameresourcesappsnameresources).
-  
-- - `service_principal_client_id`
-  - String
-  - 
-  
-- - `service_principal_id`
-  - Integer
-  - 
-  
-- - `service_principal_name`
-  - String
-  - 
-  
-- - `source_code_path`
-  - String
-  - 
-  
-- - `space`
-  - String
-  - 
-  
-- - `telemetry_export_destinations`
-  - Sequence
-  - See [\_](#targetsnameresourcesappsnametelemetry_export_destinations).
-  
-- - `update_time`
-  - String
-  - 
-  
-- - `updater`
-  - String
-  - 
-  
-- - `url`
-  - String
-  - 
-  
-- - `usage_policy_id`
-  - String
-  - 
-  
-- - `user_api_scopes`
-  - Sequence
-  - 
-  
-:::
-  
-  
-### targets._name_.resources.apps._name_.config
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `command`
-  - Sequence
-  - 
-  
-- - `env`
-  - Sequence
-  - See [\_](#targetsnameresourcesappsnameconfigenv).
-  
-:::
-  
-  
-### targets._name_.resources.apps._name_.config.env
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `name`
-  - String
-  - 
-  
-- - `value`
-  - String
-  - 
-  
-- - `value_from`
-  - String
-  - 
-  
-:::
-  
-  
-### targets._name_.resources.apps._name_.lifecycle
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-- - `started`
-  - Boolean
-  - Lifecycle setting to deploy the resource in started mode. Only supported for apps, clusters, and sql_warehouses in direct deployment mode.
-  
-:::
-  
-  
-### targets._name_.resources.apps._name_.permissions
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `group_name`
-  - String
-  - 
-  
-- - `level`
-  - String
-  - 
-  
-- - `service_principal_name`
-  - String
-  - 
-  
-- - `user_name`
-  - String
-  - 
-  
-:::
-  
-  
-### targets._name_.resources.catalogs
-  
-**`Type: Map`**
-  
-
-  
-```yaml
-catalogs:
-  <catalog-name>:
-    <catalog-field-name>: <catalog-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `comment`
-  - String
-  - 
-  
-- - `connection_name`
-  - String
-  - 
-  
-- - `grants`
-  - Sequence
-  - See [\_](#targetsnameresourcescatalogsnamegrants).
-  
-- - `lifecycle`
-  - Map
-  - See [\_](#targetsnameresourcescatalogsnamelifecycle).
-  
-- - `managed_encryption_settings`
-  - Map
-  - See [\_](#targetsnameresourcescatalogsnamemanaged_encryption_settings).
-  
-- - `name`
-  - String
-  - 
-  
-- - `options`
-  - Map
-  - 
-  
-- - `properties`
-  - Map
-  - 
-  
-- - `provider_name`
-  - String
-  - 
-  
-- - `share_name`
-  - String
-  - 
-  
-- - `storage_root`
-  - String
-  - 
-  
-:::
-  
-  
-### targets._name_.resources.catalogs._name_.lifecycle
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-### targets._name_.resources.dashboards
-  
-**`Type: Map`**
-  
-The dashboard definitions for the bundle, where each key is the name of the dashboard. See [\_](/dev-tools/bundles/resources.md#dashboards).
-  
-```yaml
-dashboards:
-  <dashboard-name>:
-    <dashboard-field-name>: <dashboard-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `create_time`
-  - String
-  - 
-  
-- - `dashboard_id`
-  - String
-  - 
-  
-- - `dataset_catalog`
-  - String
-  - Sets the default catalog for all datasets in this dashboard. When set, this overrides the catalog specified in individual dataset definitions.
-  
-- - `dataset_schema`
-  - String
-  - Sets the default schema for all datasets in this dashboard. When set, this overrides the schema specified in individual dataset definitions.
-  
-- - `display_name`
-  - String
-  - 
-  
-- - `embed_credentials`
-  - Boolean
-  - 
-  
-- - `etag`
-  - String
-  - 
-  
-- - `file_path`
-  - String
-  - 
-  
-- - `lifecycle`
-  - Map
-  - See [\_](#targetsnameresourcesdashboardsnamelifecycle).
-  
-- - `lifecycle_state`
-  - String
-  - 
-  
-- - `parent_path`
-  - String
-  - 
-  
-- - `path`
-  - String
-  - 
-  
-- - `permissions`
-  - Sequence
-  - See [\_](#targetsnameresourcesdashboardsnamepermissions).
-  
-- - `serialized_dashboard`
-  - Any
-  - 
-  
-- - `update_time`
-  - String
-  - 
-  
-- - `warehouse_id`
-  - String
-  - 
-  
-:::
-  
-  
-### targets._name_.resources.dashboards._name_.lifecycle
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-### targets._name_.resources.dashboards._name_.permissions
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `group_name`
-  - String
-  - The name of the group that has the permission set in level.
-  
-- - `level`
-  - String
-  - The allowed permission for user, group, service principal defined for this permission.
-  
-- - `service_principal_name`
-  - String
-  - The name of the service principal that has the permission set in level.
-  
-- - `user_name`
-  - String
-  - The name of the user that has the permission set in level.
-  
-:::
-  
-  
-### targets._name_.resources.database_instances
-  
-**`Type: Map`**
-  
-
-  
-```yaml
-database_instances:
-  <database_instance-name>:
-    <database_instance-field-name>: <database_instance-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `capacity`
-  - String
-  - 
-  
-- - `child_instance_refs`
-  - Sequence
-  - See [\_](#targetsnameresourcesdatabase_instancesnamechild_instance_refs).
-  
-- - `creation_time`
-  - String
-  - 
-  
-- - `creator`
-  - String
-  - 
-  
-- - `custom_tags`
-  - Sequence
-  - See [\_](#targetsnameresourcesdatabase_instancesnamecustom_tags).
-  
-- - `effective_capacity`
-  - String
-  - 
-  
-- - `effective_custom_tags`
-  - Sequence
-  - See [\_](#targetsnameresourcesdatabase_instancesnameeffective_custom_tags).
-  
-- - `effective_enable_pg_native_login`
-  - Boolean
-  - 
-  
-- - `effective_enable_readable_secondaries`
-  - Boolean
-  - 
-  
-- - `effective_node_count`
-  - Integer
-  - 
-  
-- - `effective_retention_window_in_days`
-  - Integer
-  - 
-  
-- - `effective_stopped`
-  - Boolean
-  - 
-  
-- - `effective_usage_policy_id`
-  - String
-  - 
-  
-- - `enable_pg_native_login`
-  - Boolean
-  - 
-  
-- - `enable_readable_secondaries`
-  - Boolean
-  - 
-  
-- - `lifecycle`
-  - Map
-  - See [\_](#targetsnameresourcesdatabase_instancesnamelifecycle).
-  
-- - `name`
-  - String
-  - 
-  
-- - `node_count`
-  - Integer
-  - 
-  
-- - `parent_instance_ref`
-  - Map
-  - See [\_](#targetsnameresourcesdatabase_instancesnameparent_instance_ref).
-  
-- - `permissions`
-  - Sequence
-  - See [\_](#targetsnameresourcesdatabase_instancesnamepermissions).
-  
-- - `pg_version`
-  - String
-  - 
-  
-- - `read_only_dns`
-  - String
-  - 
-  
-- - `read_write_dns`
-  - String
-  - 
-  
-- - `retention_window_in_days`
-  - Integer
-  - 
-  
-- - `state`
-  - String
-  - 
-  
-- - `stopped`
-  - Boolean
-  - 
-  
-- - `uid`
-  - String
-  - 
-  
-- - `usage_policy_id`
-  - String
-  - 
-  
-:::
-  
-  
-### targets._name_.resources.database_instances._name_.lifecycle
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-### targets._name_.resources.database_instances._name_.permissions
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `group_name`
-  - String
-  - The name of the group that has the permission set in level.
-  
-- - `level`
-  - String
-  - The allowed permission for user, group, service principal defined for this permission.
-  
-- - `service_principal_name`
-  - String
-  - The name of the service principal that has the permission set in level.
-  
-- - `user_name`
-  - String
-  - The name of the user that has the permission set in level.
-  
-:::
-  
-  
-### targets._name_.resources.external_locations
-  
-**`Type: Map`**
-  
-
-  
-```yaml
-external_locations:
-  <external_location-name>:
-    <external_location-field-name>: <external_location-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `comment`
-  - String
-  - 
-  
-- - `credential_name`
-  - String
-  - 
-  
-- - `effective_enable_file_events`
-  - Boolean
-  - 
-  
-- - `effective_file_event_queue`
-  - Map
-  - See [\_](#targetsnameresourcesexternal_locationsnameeffective_file_event_queue).
-  
-- - `enable_file_events`
-  - Boolean
-  - 
-  
-- - `encryption_details`
-  - Map
-  - See [\_](#targetsnameresourcesexternal_locationsnameencryption_details).
-  
-- - `fallback`
-  - Boolean
-  - 
-  
-- - `file_event_queue`
-  - Map
-  - See [\_](#targetsnameresourcesexternal_locationsnamefile_event_queue).
-  
-- - `grants`
-  - Sequence
-  - See [\_](#targetsnameresourcesexternal_locationsnamegrants).
-  
-- - `lifecycle`
-  - Map
-  - See [\_](#targetsnameresourcesexternal_locationsnamelifecycle).
-  
-- - `name`
-  - String
-  - 
-  
-- - `read_only`
-  - Boolean
-  - 
-  
-- - `skip_validation`
-  - Boolean
-  - 
-  
-- - `url`
-  - String
-  - 
-  
-:::
-  
-  
-### targets._name_.resources.external_locations._name_.lifecycle
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-### targets._name_.resources.postgres_branches
-  
-**`Type: Map`**
-  
-
-  
-```yaml
-postgres_branches:
-  <postgres_branche-name>:
-    <postgres_branche-field-name>: <postgres_branche-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `branch_id`
-  - String
-  - 
-  
-- - `expire_time`
-  - Map
-  - 
-  
-- - `is_protected`
-  - Boolean
-  - 
-  
-- - `lifecycle`
-  - Map
-  - See [\_](#targetsnameresourcespostgres_branchesnamelifecycle).
-  
-- - `no_expiry`
-  - Boolean
-  - 
-  
-- - `parent`
-  - String
-  - 
-  
-- - `source_branch`
-  - String
-  - 
-  
-- - `source_branch_lsn`
-  - String
-  - 
-  
-- - `source_branch_time`
-  - Map
-  - 
-  
-- - `ttl`
-  - String
-  - 
-  
-:::
-  
-  
-### targets._name_.resources.postgres_branches._name_.lifecycle
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-### targets._name_.resources.postgres_endpoints
-  
-**`Type: Map`**
-  
-
-  
-```yaml
-postgres_endpoints:
-  <postgres_endpoint-name>:
-    <postgres_endpoint-field-name>: <postgres_endpoint-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `autoscaling_limit_max_cu`
-  - Any
-  - 
-  
-- - `autoscaling_limit_min_cu`
-  - Any
-  - 
-  
-- - `disabled`
-  - Boolean
-  - 
-  
-- - `endpoint_id`
-  - String
-  - 
-  
-- - `endpoint_type`
-  - String
-  - 
-  
-- - `group`
-  - Map
-  - See [\_](#targetsnameresourcespostgres_endpointsnamegroup).
-  
-- - `lifecycle`
-  - Map
-  - See [\_](#targetsnameresourcespostgres_endpointsnamelifecycle).
-  
-- - `no_suspension`
-  - Boolean
-  - 
-  
-- - `parent`
-  - String
-  - 
-  
-- - `settings`
-  - Map
-  - See [\_](#targetsnameresourcespostgres_endpointsnamesettings).
-  
-- - `suspend_timeout_duration`
-  - String
-  - 
-  
-:::
-  
-  
-### targets._name_.resources.postgres_endpoints._name_.lifecycle
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-### targets._name_.resources.postgres_projects
-  
-**`Type: Map`**
-  
-
-  
-```yaml
-postgres_projects:
-  <postgres_project-name>:
-    <postgres_project-field-name>: <postgres_project-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `budget_policy_id`
-  - String
-  - 
-  
-- - `custom_tags`
-  - Sequence
-  - See [\_](#targetsnameresourcespostgres_projectsnamecustom_tags).
-  
-- - `default_branch`
-  - String
-  - 
-  
-- - `default_endpoint_settings`
-  - Map
-  - See [\_](#targetsnameresourcespostgres_projectsnamedefault_endpoint_settings).
-  
-- - `display_name`
-  - String
-  - 
-  
-- - `enable_pg_native_login`
-  - Boolean
-  - 
-  
-- - `history_retention_duration`
-  - String
-  - 
-  
-- - `lifecycle`
-  - Map
-  - See [\_](#targetsnameresourcespostgres_projectsnamelifecycle).
-  
-- - `permissions`
-  - Sequence
-  - See [\_](#targetsnameresourcespostgres_projectsnamepermissions).
-  
-- - `pg_version`
-  - Integer
-  - 
-  
-- - `project_id`
-  - String
-  - 
-  
-:::
-  
-  
-### targets._name_.resources.postgres_projects._name_.lifecycle
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-### targets._name_.resources.postgres_projects._name_.permissions
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `group_name`
-  - String
-  - The name of the group that has the permission set in level.
-  
-- - `level`
-  - String
-  - The allowed permission for user, group, service principal defined for this permission.
-  
-- - `service_principal_name`
-  - String
-  - The name of the service principal that has the permission set in level.
-  
-- - `user_name`
-  - String
-  - The name of the user that has the permission set in level.
-  
-:::
-  
-  
-### targets._name_.resources.secret_scopes
-  
-**`Type: Map`**
-  
-The secret scope definitions for the bundle, where each key is the name of the secret scope. See [\_](/dev-tools/bundles/resources.md#secret_scopes).
-  
-```yaml
-secret_scopes:
-  <secret_scope-name>:
-    <secret_scope-field-name>: <secret_scope-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `backend_type`
-  - String
-  - The backend type the scope will be created with. If not specified, will default to `DATABRICKS`
-  
-- - `keyvault_metadata`
-  - Map
-  - The metadata for the secret scope if the `backend_type` is `AZURE_KEYVAULT`. See [\_](#targetsnameresourcessecret_scopesnamekeyvault_metadata).
-  
-- - `lifecycle`
-  - Map
-  - Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed. See [\_](#targetsnameresourcessecret_scopesnamelifecycle).
-  
-- - `name`
-  - String
-  - Scope name requested by the user. Scope names are unique.
-  
-- - `permissions`
-  - Sequence
-  - The permissions to apply to the secret scope. Permissions are managed via secret scope ACLs. See [\_](#targetsnameresourcessecret_scopesnamepermissions).
-  
-:::
-  
-  
-### targets._name_.resources.secret_scopes._name_.lifecycle
-  
-**`Type: Map`**
-  
-Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-### targets._name_.resources.secret_scopes._name_.permissions
-  
-**`Type: Sequence`**
-  
-The permissions to apply to the secret scope. Permissions are managed via secret scope ACLs.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `group_name`
-  - String
-  - The name of the group that has the permission set in level. This field translates to a `principal` field in secret scope ACL.
-  
-- - `level`
-  - String
-  - The allowed permission for user, group, service principal defined for this permission.
-  
-- - `service_principal_name`
-  - String
-  - The application ID of an active service principal. This field translates to a `principal` field in secret scope ACL.
-  
-- - `user_name`
-  - String
-  - The name of the user that has the permission set in level. This field translates to a `principal` field in secret scope ACL.
-  
-:::
-  
-  
-### targets._name_.resources.synced_database_tables
-  
-**`Type: Map`**
-  
-
-  
-```yaml
-synced_database_tables:
-  <synced_database_table-name>:
-    <synced_database_table-field-name>: <synced_database_table-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `data_synchronization_status`
-  - Map
-  - See [\_](#targetsnameresourcessynced_database_tablesnamedata_synchronization_status).
-  
-- - `database_instance_name`
-  - String
-  - 
-  
-- - `effective_database_instance_name`
-  - String
-  - 
-  
-- - `effective_logical_database_name`
-  - String
-  - 
-  
-- - `lifecycle`
-  - Map
-  - See [\_](#targetsnameresourcessynced_database_tablesnamelifecycle).
-  
-- - `logical_database_name`
-  - String
-  - 
-  
-- - `name`
-  - String
-  - 
-  
-- - `spec`
-  - Map
-  - See [\_](#targetsnameresourcessynced_database_tablesnamespec).
-  
-- - `unity_catalog_provisioning_state`
-  - String
-  - 
-  
-:::
-  
-  
-### targets._name_.resources.synced_database_tables._name_.lifecycle
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-### targets._name_.resources.vector_search_endpoints
-  
-**`Type: Map`**
-  
-
-  
-```yaml
-vector_search_endpoints:
-  <vector_search_endpoint-name>:
-    <vector_search_endpoint-field-name>: <vector_search_endpoint-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `budget_policy_id`
-  - String
-  - 
-  
-- - `endpoint_type`
-  - String
-  - 
-  
-- - `lifecycle`
-  - Map
-  - See [\_](#targetsnameresourcesvector_search_endpointsnamelifecycle).
-  
-- - `min_qps`
-  - Integer
-  - 
-  
-- - `name`
-  - String
-  - 
-  
-- - `permissions`
-  - Sequence
-  - See [\_](#targetsnameresourcesvector_search_endpointsnamepermissions).
-  
-- - `usage_policy_id`
-  - String
-  - 
-  
-:::
-  
-  
-### targets._name_.resources.vector_search_endpoints._name_.lifecycle
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-### targets._name_.resources.vector_search_endpoints._name_.permissions
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `group_name`
-  - String
-  - The name of the group that has the permission set in level.
-  
-- - `level`
-  - String
-  - The allowed permission for user, group, service principal defined for this permission.
-  
-- - `service_principal_name`
-  - String
-  - The name of the service principal that has the permission set in level.
-  
-- - `user_name`
-  - String
-  - The name of the user that has the permission set in level.
-  
-:::
-  
-  
-### targets._name_.run_as
-  
-**`Type: Map`**
-  
-The identity to use to run the bundle, see [\_](/dev-tools/bundles/run-as.md).
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `group_name`
-  - String
-  - 
-  
-- - `service_principal_name`
-  - String
-  - The application ID of an active service principal. Setting this field requires the `servicePrincipal/user` role.
-  
-- - `user_name`
-  - String
-  - The email of an active workspace user. Non-admin users can only set this field to their own email.
-  
-:::
-  
-  
-### targets._name_.sync
-  
-**`Type: Map`**
-  
-The local paths to sync to the target workspace when a bundle is run or deployed.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `exclude`
-  - Sequence
-  - A list of files or folders to exclude from the bundle.
-  
-- - `include`
-  - Sequence
-  - A list of files or folders to include in the bundle.
-  
-- - `paths`
-  - Sequence
-  - The local folder paths, which can be outside the bundle root, to synchronize to the workspace when the bundle is deployed.
-  
-:::
-  
-  
-### targets._name_.variables
-  
-**`Type: Map`**
-  
-The custom variable definitions for the target.
-  
-```yaml
-variables:
-  <variable-name>:
-    <variable-field-name>: <variable-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `default`
-  - Any
-  - The default value for the variable.
-  
-- - `description`
-  - String
-  - The description of the variable.
-  
-- - `lookup`
-  - Map
-  - The name of the alert, cluster_policy, cluster, dashboard, instance_pool, job, metastore, pipeline, query, service_principal, or warehouse object for which to retrieve an ID. See [\_](#targetsnamevariablesnamelookup).
-  
-- - `type`
-  - String
-  - The type of the variable.
-  
-:::
-  
-  
-### targets._name_.variables._name_.lookup
-  
-**`Type: Map`**
-  
-The name of the alert, cluster_policy, cluster, dashboard, instance_pool, job, metastore, pipeline, query, service_principal, or warehouse object for which to retrieve an ID.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `alert`
-  - String
-  - The name of the alert for which to retrieve an ID.
-  
-- - `cluster`
-  - String
-  - The name of the cluster for which to retrieve an ID.
-  
-- - `cluster_policy`
-  - String
-  - The name of the cluster_policy for which to retrieve an ID.
-  
-- - `dashboard`
-  - String
-  - The name of the dashboard for which to retrieve an ID.
-  
-- - `instance_pool`
-  - String
-  - The name of the instance_pool for which to retrieve an ID.
-  
-- - `job`
-  - String
-  - The name of the job for which to retrieve an ID.
-  
-- - `metastore`
-  - String
-  - The name of the metastore for which to retrieve an ID.
-  
-- - `notification_destination`
-  - String
-  - The name of the notification_destination for which to retrieve an ID.
-  
-- - `pipeline`
-  - String
-  - The name of the pipeline for which to retrieve an ID.
-  
-- - `query`
-  - String
-  - The name of the query for which to retrieve an ID.
-  
-- - `service_principal`
-  - String
-  - The name of the service_principal for which to retrieve an ID.
-  
-- - `warehouse`
-  - String
-  - The name of the warehouse for which to retrieve an ID.
-  
-:::
-  
-  
-### targets._name_.workspace
-  
-**`Type: Map`**
-  
-The Databricks workspace for the target.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `account_id`
-  - String
-  - The Databricks account ID.
-  
-- - `artifact_path`
-  - String
-  - The artifact path to use within the workspace for both deployments and job runs
-  
-- - `auth_type`
-  - String
-  - The authentication type.
-  
-- - `azure_client_id`
-  - String
-  - The Azure client ID
-  
-- - `azure_environment`
-  - String
-  - The Azure environment
-  
-- - `azure_login_app_id`
-  - String
-  - The Azure login app ID
-  
-- - `azure_tenant_id`
-  - String
-  - The Azure tenant ID
-  
-- - `azure_use_msi`
-  - Boolean
-  - Whether to use MSI for Azure
-  
-- - `azure_workspace_resource_id`
-  - String
-  - The Azure workspace resource ID
-  
-- - `client_id`
-  - String
-  - The client ID for the workspace
-  
-- - `experimental_is_unified_host`
-  - Boolean
-  - Deprecated: no-op. Unified hosts are now detected automatically from /.well-known/databricks-config. Retained for schema compatibility with existing databricks.yml files.
-  
-- - `file_path`
-  - String
-  - The file path to use within the workspace for both deployments and job runs
-  
-- - `google_service_account`
-  - String
-  - The Google service account name
-  
-- - `host`
-  - String
-  - The Databricks workspace host URL
-  
-- - `profile`
-  - String
-  - The Databricks workspace profile name
-  
-- - `resource_path`
-  - String
-  - The workspace resource path
-  
-- - `root_path`
-  - String
-  - The Databricks workspace root path
-  
-- - `state_path`
-  - String
-  - The workspace state path
-  
-- - `workspace_id`
-  - String
-  - The Databricks workspace ID
-  
-:::
-  
-  
-## variables
-  
-**`Type: Map`**
-  
-Defines a custom variable for the bundle. See [\_](/dev-tools/bundles/settings.md#variables).
-  
-```yaml
-variables:
-  <variable-name>:
-    <variable-field-name>: <variable-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `default`
-  - Any
-  - The default value for the variable.
-  
-- - `description`
-  - String
-  - The description of the variable
-  
-- - `lookup`
-  - Map
-  - The name of the `alert`, `cluster_policy`, `cluster`, `dashboard`, `instance_pool`, `job`, `metastore`, `pipeline`, `query`, `service_principal`, or `warehouse` object for which to retrieve an ID. See [\_](#variablesnamelookup).
-  
-- - `type`
-  - String
-  - The type of the variable.
-  
-:::
-  
-  
-### variables._name_.lookup
-  
-**`Type: Map`**
-  
-The name of the `alert`, `cluster_policy`, `cluster`, `dashboard`, `instance_pool`, `job`, `metastore`, `pipeline`, `query`, `service_principal`, or `warehouse` object for which to retrieve an ID.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `alert`
-  - String
-  - The name of the alert for which to retrieve an ID.
-  
-- - `cluster`
-  - String
-  - The name of the cluster for which to retrieve an ID.
-  
-- - `cluster_policy`
-  - String
-  - The name of the cluster_policy for which to retrieve an ID.
-  
-- - `dashboard`
-  - String
-  - The name of the dashboard for which to retrieve an ID.
-  
-- - `instance_pool`
-  - String
-  - The name of the instance_pool for which to retrieve an ID.
-  
-- - `job`
-  - String
-  - The name of the job for which to retrieve an ID.
-  
-- - `metastore`
-  - String
-  - The name of the metastore for which to retrieve an ID.
-  
-- - `notification_destination`
-  - String
-  - The name of the notification_destination for which to retrieve an ID.
-  
-- - `pipeline`
-  - String
-  - The name of the pipeline for which to retrieve an ID.
-  
-- - `query`
-  - String
-  - The name of the query for which to retrieve an ID.
-  
-- - `service_principal`
-  - String
-  - The name of the service_principal for which to retrieve an ID.
-  
-- - `warehouse`
-  - String
-  - The name of the warehouse for which to retrieve an ID.
-  
-:::
-  
-  
-## workspace
-  
-**`Type: Map`**
-  
-Defines the Databricks workspace for the bundle. See [\_](/dev-tools/bundles/settings.md#workspace).
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `account_id`
-  - String
-  - The Databricks account ID.
-  
-- - `artifact_path`
-  - String
-  - The artifact path to use within the workspace for both deployments and job runs
-  
-- - `auth_type`
-  - String
-  - The authentication type.
-  
-- - `azure_client_id`
-  - String
-  - The Azure client ID
-  
-- - `azure_environment`
-  - String
-  - The Azure environment
-  
-- - `azure_login_app_id`
-  - String
-  - The Azure login app ID
-  
-- - `azure_tenant_id`
-  - String
-  - The Azure tenant ID
-  
-- - `azure_use_msi`
-  - Boolean
-  - Whether to use MSI for Azure
-  
-- - `azure_workspace_resource_id`
-  - String
-  - The Azure workspace resource ID
-  
-- - `client_id`
-  - String
-  - The client ID for the workspace
-  
-- - `experimental_is_unified_host`
-  - Boolean
-  - Deprecated: no-op. Unified hosts are now detected automatically from /.well-known/databricks-config. Retained for schema compatibility with existing databricks.yml files.
-  
-- - `file_path`
-  - String
-  - The file path to use within the workspace for both deployments and job runs
-  
-- - `google_service_account`
-  - String
-  - The Google service account name
-  
-- - `host`
-  - String
-  - The Databricks workspace host URL
-  
-- - `profile`
-  - String
-  - The Databricks workspace profile name
-  
-- - `resource_path`
-  - String
-  - The workspace resource path
-  
-- - `root_path`
-  - String
-  - The Databricks workspace root path
-  
-- - `state_path`
-  - String
-  - The workspace state path
-  
-- - `workspace_id`
-  - String
-  - The Databricks workspace ID
-  
-:::
-  
\ No newline at end of file
diff --git a/bundle/docsgen/output/resources.md b/bundle/docsgen/output/resources.md
deleted file mode 100644
index e262f4620b6..00000000000
--- a/bundle/docsgen/output/resources.md
+++ /dev/null
@@ -1,11676 +0,0 @@
----
-description: 'Learn about resources supported by Declarative Automation Bundles and how to configure them.'
-last_update:
-  date: 2026-04-23
----
-
-<!-- DO NOT EDIT. This file is autogenerated with https://github.com/databricks/cli -->
-
-# :re[DABS] resources
-
-:re[DABS] allows you to specify information about the :re[Databricks] resources used by the bundle in the `resources` mapping in the bundle configuration. See [resources mapping](/dev-tools/bundles/settings.md#resources) and [resources key reference](/dev-tools/bundles/reference.md#resources).
-
-This article outlines supported resource types for bundles and provides details and an example for each supported type. For additional examples, see [\_](/dev-tools/bundles/resource-examples.md).
-
-:::tip
-
-To generate YAML for any existing resource, use the `databricks bundle generate` command. See [\_](/dev-tools/cli/bundle-commands.md#generate).
-
-:::
-
-## <a id="resource-types"></a>Supported resources
-
-The following table lists supported resource types for bundles. Some resources can be created by defining them in a bundle and deploying the bundle, and some resources only support referencing an existing resource to include in the bundle.
-
-Resources are defined using the corresponding [Databricks REST API](/api/workspace/introduction) object’s create operation request payload, where the object’s supported fields, expressed as YAML, are the resource’s supported properties. Links to documentation for each resource’s corresponding payloads are listed in the table.
-
-:::tip
-
-The `databricks bundle validate` command returns warnings if unknown resource properties are found in bundle configuration files.
-
-:::
-
-::::aws-azure
-
-:::list-table
-
-- - Resource
-  - Create support
-  - Corresponding REST API object
-- - [app](#apps)
-  - ✓
-  - [App object](/api/workspace/apps/create)
-- - [cluster](#clusters)
-  - ✓
-  - [Cluster object](/api/workspace/clusters/create)
-- - [dashboard](#dashboards)
-  -
-  - [Dashboard object](/api/workspace/lakeview/create)
-- - [experiment](#experiments)
-  - ✓
-  - [Experiment object](/api/workspace/experiments/createexperiment)
-- - [job](#job)
-  - ✓
-  - [Job object](/api/workspace/jobs/create)
-- - [model (legacy)](#models)
-  - ✓
-  - [Model (legacy) object](/api/workspace/modelregistry/createmodel)
-- - [model_serving_endpoint](#model_serving_endpoints)
-  - ✓
-  - [Model serving endpoint object](/api/workspace/servingendpoints/create)
-- - [pipeline](#pipeline)
-  - ✓
-  - [Pipeline object](/api/workspace/pipelines/create)
-- - [quality_monitor](#quality_monitors)
-  - ✓
-  - [Quality monitor object](/api/workspace/qualitymonitors/create)
-- - [registered_model](#registered_models) (:re[UC])
-  - ✓
-  - [Registered model object](/api/workspace/registeredmodels/create)
-- - [schema](#schemas) (:re[UC])
-  - ✓
-  - [Schema object](/api/workspace/schemas/create)
-- - [volume](#volumes) (:re[UC])
-  - ✓
-  - [Volume object](/api/workspace/volumes/create)
-
-:::
-
-::::
-
-::::gcp
-
-:::list-table
-
-- - Resource
-  - Create support
-  - Corresponding REST API object
-- - [cluster](#clusters)
-  - ✓
-  - [Cluster object](/api/workspace/clusters/create)
-- - [dashboard](#dashboards)
-  -
-  - [Dashboard object](/api/workspace/lakeview/create)
-- - [experiment](#experiments)
-  - ✓
-  - [Experiment object](/api/workspace/experiments/createexperiment)
-- - [job](#jobs)
-  - ✓
-  - [Job object](/api/workspace/jobs/create)
-- - [model (legacy)](#models)
-  - ✓
-  - [Model (legacy) object](/api/workspace/modelregistry/createmodel)
-- - [model_serving_endpoint](#model_serving_endpoints)
-  - ✓
-  - [Model serving endpoint object](/api/workspace/servingendpoints/create)
-- - [pipeline](#pipelines)
-  - ✓
-  - [Pipeline object]](/api/workspace/pipelines/create)
-- - [quality_monitor](#quality_monitors)
-  - ✓
-  - [Quality monitor object](/api/workspace/qualitymonitors/create)
-- - [registered_model](#registered_models) (:re[UC])
-  - ✓
-  - [Registered model object](/api/workspace/registeredmodels/create)
-- - [schema](#schemas) (:re[UC])
-  - ✓
-  - [Schema object](/api/workspace/schemas/create)
-- - [volume](#volumes) (:re[UC])
-  - ✓
-  - [Volume object](/api/workspace/volumes/create)
-
-:::
-
-::::
-
-  
-## alerts
-  
-**`Type: Map`**
-  
-
-  
-```yaml
-alerts:
-  <alert-name>:
-    <alert-field-name>: <alert-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `custom_description`
-  - String
-  - 
-  
-- - `custom_summary`
-  - String
-  - 
-  
-- - `display_name`
-  - String
-  - 
-  
-- - `evaluation`
-  - Map
-  - See [\_](#alertsnameevaluation).
-  
-- - `file_path`
-  - String
-  - 
-  
-- - `lifecycle`
-  - Map
-  - See [\_](#alertsnamelifecycle).
-  
-- - `parent_path`
-  - String
-  - 
-  
-- - `permissions`
-  - Sequence
-  - See [\_](#alertsnamepermissions).
-  
-- - `query_text`
-  - String
-  - 
-  
-- - `run_as`
-  - Map
-  - See [\_](#alertsnamerun_as).
-  
-- - `run_as_user_name`
-  - String
-  - This field is deprecated
-  
-- - `schedule`
-  - Map
-  - See [\_](#alertsnameschedule).
-  
-- - `warehouse_id`
-  - String
-  - 
-  
-:::
-  
-  
-### alerts._name_.evaluation
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `comparison_operator`
-  - String
-  - Operator used for comparison in alert evaluation.
-  
-- - `empty_result_state`
-  - String
-  - Alert state if result is empty. Please avoid setting this field to be `UNKNOWN` because `UNKNOWN` state is planned to be deprecated.
-  
-- - `notification`
-  - Map
-  - User or Notification Destination to notify when alert is triggered. See [\_](#alertsnameevaluationnotification).
-  
-- - `source`
-  - Map
-  - Source column from result to use to evaluate alert. See [\_](#alertsnameevaluationsource).
-  
-- - `threshold`
-  - Map
-  - Threshold to user for alert evaluation, can be a column or a value. See [\_](#alertsnameevaluationthreshold).
-  
-:::
-  
-  
-### alerts._name_.evaluation.notification
-  
-**`Type: Map`**
-  
-User or Notification Destination to notify when alert is triggered.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `notify_on_ok`
-  - Boolean
-  - Whether to notify alert subscribers when alert returns back to normal.
-  
-- - `retrigger_seconds`
-  - Integer
-  - Number of seconds an alert waits after being triggered before it is allowed to send another notification. If set to 0 or omitted, the alert will not send any further notifications after the first trigger Setting this value to 1 allows the alert to send a notification on every evaluation where the condition is met, effectively making it always retrigger for notification purposes.
-  
-- - `subscriptions`
-  - Sequence
-  - See [\_](#alertsnameevaluationnotificationsubscriptions).
-  
-:::
-  
-  
-### alerts._name_.evaluation.notification.subscriptions
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `destination_id`
-  - String
-  - 
-  
-- - `user_email`
-  - String
-  - 
-  
-:::
-  
-  
-### alerts._name_.evaluation.source
-  
-**`Type: Map`**
-  
-Source column from result to use to evaluate alert
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `aggregation`
-  - String
-  - 
-  
-- - `display`
-  - String
-  - 
-  
-- - `name`
-  - String
-  - 
-  
-:::
-  
-  
-### alerts._name_.evaluation.threshold
-  
-**`Type: Map`**
-  
-Threshold to user for alert evaluation, can be a column or a value.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `column`
-  - Map
-  - See [\_](#alertsnameevaluationthresholdcolumn).
-  
-- - `value`
-  - Map
-  - See [\_](#alertsnameevaluationthresholdvalue).
-  
-:::
-  
-  
-### alerts._name_.evaluation.threshold.column
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `aggregation`
-  - String
-  - 
-  
-- - `display`
-  - String
-  - 
-  
-- - `name`
-  - String
-  - 
-  
-:::
-  
-  
-### alerts._name_.evaluation.threshold.value
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `bool_value`
-  - Boolean
-  - 
-  
-- - `double_value`
-  - Any
-  - 
-  
-- - `string_value`
-  - String
-  - 
-  
-:::
-  
-  
-### alerts._name_.lifecycle
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-### alerts._name_.permissions
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `group_name`
-  - String
-  - The name of the group that has the permission set in level.
-  
-- - `level`
-  - String
-  - The allowed permission for user, group, service principal defined for this permission.
-  
-- - `service_principal_name`
-  - String
-  - The name of the service principal that has the permission set in level.
-  
-- - `user_name`
-  - String
-  - The name of the user that has the permission set in level.
-  
-:::
-  
-  
-### alerts._name_.run_as
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `service_principal_name`
-  - String
-  - Application ID of an active service principal. Setting this field requires the `servicePrincipal/user` role.
-  
-- - `user_name`
-  - String
-  - The email of an active workspace user. Can only set this field to their own email.
-  
-:::
-  
-  
-### alerts._name_.schedule
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `pause_status`
-  - String
-  - Indicate whether this schedule is paused or not.
-  
-- - `quartz_cron_schedule`
-  - String
-  - A cron expression using quartz syntax that specifies the schedule for this pipeline. Should use the quartz format described here: http://www.quartz-scheduler.org/documentation/quartz-2.1.7/tutorials/tutorial-lesson-06.html
-  
-- - `timezone_id`
-  - String
-  - A Java timezone id. The schedule will be resolved using this timezone. This will be combined with the quartz_cron_schedule to determine the schedule. See https://docs.databricks.com/sql/language-manual/sql-ref-syntax-aux-conf-mgmt-set-timezone.html for details.
-  
-:::
-  
-  
-## apps
-  
-**`Type: Map`**
-  
-The app resource defines a [Databricks app](/api/workspace/apps/create). For information about Databricks Apps, see [\_](/dev-tools/databricks-apps/index.md).
-  
-```yaml
-apps:
-  <app-name>:
-    <app-field-name>: <app-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `budget_policy_id`
-  - String
-  - 
-  
-- - `compute_size`
-  - String
-  - 
-  
-- - `config`
-  - Map
-  - See [\_](#appsnameconfig).
-  
-- - `description`
-  - String
-  - The description of the app.
-  
-- - `git_source`
-  - Map
-  - Git source configuration for app deployments. Specifies which git reference (branch, tag, or commit) to use when deploying the app. Used in conjunction with git_repository to deploy code directly from git. The source_code_path within git_source specifies the relative path to the app code within the repository. See [\_](#appsnamegit_source).
-  
-- - `lifecycle`
-  - Map
-  - Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed. See [\_](#appsnamelifecycle).
-  
-- - `name`
-  - String
-  - The name of the app. The name must contain only lowercase alphanumeric characters and hyphens. It must be unique within the workspace.
-  
-- - `permissions`
-  - Sequence
-  - See [\_](#appsnamepermissions).
-  
-- - `resources`
-  - Sequence
-  - Resources for the app. See [\_](#appsnameresources).
-  
-- - `source_code_path`
-  - String
-  - 
-  
-- - `telemetry_export_destinations`
-  - Sequence
-  - See [\_](#appsnametelemetry_export_destinations).
-  
-- - `usage_policy_id`
-  - String
-  - 
-  
-- - `user_api_scopes`
-  - Sequence
-  - 
-  
-:::
-  
-  
-### apps._name_.config
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `command`
-  - Sequence
-  - 
-  
-- - `env`
-  - Sequence
-  - See [\_](#appsnameconfigenv).
-  
-:::
-  
-  
-### apps._name_.config.env
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `name`
-  - String
-  - 
-  
-- - `value`
-  - String
-  - 
-  
-- - `value_from`
-  - String
-  - 
-  
-:::
-  
-  
-### apps._name_.git_source
-  
-**`Type: Map`**
-  
-Git source configuration for app deployments. Specifies which git reference (branch, tag, or commit)
-to use when deploying the app. Used in conjunction with git_repository to deploy code directly from git.
-The source_code_path within git_source specifies the relative path to the app code within the repository.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `branch`
-  - String
-  - Git branch to checkout.
-  
-- - `commit`
-  - String
-  - Git commit SHA to checkout.
-  
-- - `source_code_path`
-  - String
-  - Relative path to the app source code within the Git repository. If not specified, the root of the repository is used.
-  
-- - `tag`
-  - String
-  - Git tag to checkout.
-  
-:::
-  
-  
-### apps._name_.lifecycle
-  
-**`Type: Map`**
-  
-Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-- - `started`
-  - Boolean
-  - Lifecycle setting to deploy the resource in started mode. Only supported for apps, clusters, and sql_warehouses in direct deployment mode.
-  
-:::
-  
-  
-### apps._name_.permissions
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `group_name`
-  - String
-  - 
-  
-- - `level`
-  - String
-  - Permission level
-  
-- - `service_principal_name`
-  - String
-  - 
-  
-- - `user_name`
-  - String
-  - 
-  
-:::
-  
-  
-### apps._name_.resources
-  
-**`Type: Sequence`**
-  
-Resources for the app.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `app`
-  - Map
-  - See [\_](#appsnameresourcesapp).
-  
-- - `database`
-  - Map
-  - See [\_](#appsnameresourcesdatabase).
-  
-- - `description`
-  - String
-  - Description of the App Resource.
-  
-- - `experiment`
-  - Map
-  - See [\_](#appsnameresourcesexperiment).
-  
-- - `genie_space`
-  - Map
-  - See [\_](#appsnameresourcesgenie_space).
-  
-- - `job`
-  - Map
-  - See [\_](#appsnameresourcesjob).
-  
-- - `name`
-  - String
-  - Name of the App Resource.
-  
-- - `postgres`
-  - Map
-  - See [\_](#appsnameresourcespostgres).
-  
-- - `secret`
-  - Map
-  - See [\_](#appsnameresourcessecret).
-  
-- - `serving_endpoint`
-  - Map
-  - See [\_](#appsnameresourcesserving_endpoint).
-  
-- - `sql_warehouse`
-  - Map
-  - See [\_](#appsnameresourcessql_warehouse).
-  
-- - `uc_securable`
-  - Map
-  - See [\_](#appsnameresourcesuc_securable).
-  
-:::
-  
-  
-### apps._name_.resources.app
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `name`
-  - String
-  - 
-  
-- - `permission`
-  - String
-  - 
-  
-:::
-  
-  
-### apps._name_.resources.database
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `database_name`
-  - String
-  - 
-  
-- - `instance_name`
-  - String
-  - 
-  
-- - `permission`
-  - String
-  - 
-  
-:::
-  
-  
-### apps._name_.resources.experiment
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `experiment_id`
-  - String
-  - 
-  
-- - `permission`
-  - String
-  - 
-  
-:::
-  
-  
-### apps._name_.resources.genie_space
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `name`
-  - String
-  - 
-  
-- - `permission`
-  - String
-  - 
-  
-- - `space_id`
-  - String
-  - 
-  
-:::
-  
-  
-### apps._name_.resources.job
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `id`
-  - String
-  - 
-  
-- - `permission`
-  - String
-  - 
-  
-:::
-  
-  
-### apps._name_.resources.postgres
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `branch`
-  - String
-  - 
-  
-- - `database`
-  - String
-  - 
-  
-- - `permission`
-  - String
-  - 
-  
-:::
-  
-  
-### apps._name_.resources.secret
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `key`
-  - String
-  - 
-  
-- - `permission`
-  - String
-  - Permission to grant on the secret scope. Supported permissions are: "READ", "WRITE", "MANAGE".
-  
-- - `scope`
-  - String
-  - 
-  
-:::
-  
-  
-### apps._name_.resources.serving_endpoint
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `name`
-  - String
-  - 
-  
-- - `permission`
-  - String
-  - 
-  
-:::
-  
-  
-### apps._name_.resources.sql_warehouse
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `id`
-  - String
-  - 
-  
-- - `permission`
-  - String
-  - 
-  
-:::
-  
-  
-### apps._name_.resources.uc_securable
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `permission`
-  - String
-  - 
-  
-- - `securable_full_name`
-  - String
-  - 
-  
-- - `securable_type`
-  - String
-  - 
-  
-:::
-  
-  
-### apps._name_.telemetry_export_destinations
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `unity_catalog`
-  - Map
-  - Unity Catalog Destinations for OTEL telemetry export. See [\_](#appsnametelemetry_export_destinationsunity_catalog).
-  
-:::
-  
-  
-### apps._name_.telemetry_export_destinations.unity_catalog
-  
-**`Type: Map`**
-  
-Unity Catalog Destinations for OTEL telemetry export.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `logs_table`
-  - String
-  - Unity Catalog table for OTEL logs.
-  
-- - `metrics_table`
-  - String
-  - Unity Catalog table for OTEL metrics.
-  
-- - `traces_table`
-  - String
-  - Unity Catalog table for OTEL traces (spans).
-  
-:::
-  
-  
-## catalogs
-  
-**`Type: Map`**
-  
-
-  
-```yaml
-catalogs:
-  <catalog-name>:
-    <catalog-field-name>: <catalog-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `comment`
-  - String
-  - 
-  
-- - `connection_name`
-  - String
-  - 
-  
-- - `grants`
-  - Sequence
-  - See [\_](#catalogsnamegrants).
-  
-- - `lifecycle`
-  - Map
-  - See [\_](#catalogsnamelifecycle).
-  
-- - `name`
-  - String
-  - 
-  
-- - `options`
-  - Map
-  - 
-  
-- - `properties`
-  - Map
-  - 
-  
-- - `provider_name`
-  - String
-  - 
-  
-- - `share_name`
-  - String
-  - 
-  
-- - `storage_root`
-  - String
-  - 
-  
-:::
-  
-  
-### catalogs._name_.grants
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `principal`
-  - String
-  - The principal (user email address or group name). For deleted principals, `principal` is empty while `principal_id` is populated.
-  
-- - `privileges`
-  - Sequence
-  - The privileges assigned to the principal.
-  
-:::
-  
-  
-### catalogs._name_.grants.privileges
-  
-**`Type: Sequence`**
-  
-The privileges assigned to the principal.
-  
-  
-### catalogs._name_.lifecycle
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-## clusters
-  
-**`Type: Map`**
-  
-The cluster resource defines an [all-purpose cluster](/api/workspace/clusters/create).
-  
-```yaml
-clusters:
-  <cluster-name>:
-    <cluster-field-name>: <cluster-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `apply_policy_default_values`
-  - Boolean
-  - When set to true, fixed and default values from the policy will be used for fields that are omitted. When set to false, only fixed values from the policy will be applied.
-  
-- - `autoscale`
-  - Map
-  - Parameters needed in order to automatically scale clusters up and down based on load. Note: autoscaling works best with DB runtime versions 3.0 or later. See [\_](#clustersnameautoscale).
-  
-- - `autotermination_minutes`
-  - Integer
-  - Automatically terminates the cluster after it is inactive for this time in minutes. If not set, this cluster will not be automatically terminated. If specified, the threshold must be between 10 and 10000 minutes. Users can also set this value to 0 to explicitly disable automatic termination.
-  
-- - `aws_attributes`
-  - Map
-  - Attributes related to clusters running on Amazon Web Services. If not specified at cluster creation, a set of default values will be used. See [\_](#clustersnameaws_attributes).
-  
-- - `azure_attributes`
-  - Map
-  - Attributes related to clusters running on Microsoft Azure. If not specified at cluster creation, a set of default values will be used. See [\_](#clustersnameazure_attributes).
-  
-- - `cluster_log_conf`
-  - Map
-  - The configuration for delivering spark logs to a long-term storage destination. Three kinds of destinations (DBFS, S3 and Unity Catalog volumes) are supported. Only one destination can be specified for one cluster. If the conf is given, the logs will be delivered to the destination every `5 mins`. The destination of driver logs is `$destination/$clusterId/driver`, while the destination of executor logs is `$destination/$clusterId/executor`. See [\_](#clustersnamecluster_log_conf).
-  
-- - `cluster_name`
-  - String
-  - Cluster name requested by the user. This doesn't have to be unique. If not specified at creation, the cluster name will be an empty string. For job clusters, the cluster name is automatically set based on the job and job run IDs.
-  
-- - `custom_tags`
-  - Map
-  - Additional tags for cluster resources. Databricks will tag all cluster resources (e.g., AWS instances and EBS volumes) with these tags in addition to `default_tags`. Notes:  - Currently, Databricks allows at most 45 custom tags  - Clusters can only reuse cloud resources if the resources' tags are a subset of the cluster tags
-  
-- - `data_security_mode`
-  - String
-  - Data security mode decides what data governance model to use when accessing data from a cluster.  The following modes can only be used when `kind = CLASSIC_PREVIEW`. * `DATA_SECURITY_MODE_AUTO`: Databricks will choose the most appropriate access mode depending on your compute configuration. * `DATA_SECURITY_MODE_STANDARD`: Alias for `USER_ISOLATION`. * `DATA_SECURITY_MODE_DEDICATED`: Alias for `SINGLE_USER`.  The following modes can be used regardless of `kind`. * `NONE`: No security isolation for multiple users sharing the cluster. Data governance features are not available in this mode. * `SINGLE_USER`: A secure cluster that can only be exclusively used by a single user specified in `single_user_name`. Most programming languages, cluster features and data governance features are available in this mode. * `USER_ISOLATION`: A secure cluster that can be shared by multiple users. Cluster users are fully isolated so that they cannot see each other's data and credentials. Most data governance features are supported in this mode. But programming languages and cluster features might be limited.  The following modes are deprecated starting with Databricks Runtime 15.0 and will be removed for future Databricks Runtime versions:  * `LEGACY_TABLE_ACL`: This mode is for users migrating from legacy Table ACL clusters. * `LEGACY_PASSTHROUGH`: This mode is for users migrating from legacy Passthrough on high concurrency clusters. * `LEGACY_SINGLE_USER`: This mode is for users migrating from legacy Passthrough on standard clusters. * `LEGACY_SINGLE_USER_STANDARD`: This mode provides a way that doesn’t have UC nor passthrough enabled.
-  
-- - `docker_image`
-  - Map
-  - See [\_](#clustersnamedocker_image).
-  
-- - `driver_instance_pool_id`
-  - String
-  - The optional ID of the instance pool for the driver of the cluster belongs. The pool cluster uses the instance pool with id (instance_pool_id) if the driver pool is not assigned.
-  
-- - `driver_node_type_flexibility`
-  - Map
-  - Flexible node type configuration for the driver node. See [\_](#clustersnamedriver_node_type_flexibility).
-  
-- - `driver_node_type_id`
-  - String
-  - The node type of the Spark driver. Note that this field is optional; if unset, the driver node type will be set as the same value as `node_type_id` defined above.  This field, along with node_type_id, should not be set if virtual_cluster_size is set. If both driver_node_type_id, node_type_id, and virtual_cluster_size are specified, driver_node_type_id and node_type_id take precedence.
-  
-- - `enable_elastic_disk`
-  - Boolean
-  - Autoscaling Local Storage: when enabled, this cluster will dynamically acquire additional disk space when its Spark workers are running low on disk space.
-  
-- - `enable_local_disk_encryption`
-  - Boolean
-  - Whether to enable LUKS on cluster VMs' local disks
-  
-- - `gcp_attributes`
-  - Map
-  - Attributes related to clusters running on Google Cloud Platform. If not specified at cluster creation, a set of default values will be used. See [\_](#clustersnamegcp_attributes).
-  
-- - `init_scripts`
-  - Sequence
-  - The configuration for storing init scripts. Any number of destinations can be specified. The scripts are executed sequentially in the order provided. If `cluster_log_conf` is specified, init script logs are sent to `<destination>/<cluster-ID>/init_scripts`. See [\_](#clustersnameinit_scripts).
-  
-- - `instance_pool_id`
-  - String
-  - The optional ID of the instance pool to which the cluster belongs.
-  
-- - `is_single_node`
-  - Boolean
-  - This field can only be used when `kind = CLASSIC_PREVIEW`.  When set to true, Databricks will automatically set single node related `custom_tags`, `spark_conf`, and `num_workers`
-  
-- - `kind`
-  - String
-  - 
-  
-- - `lifecycle`
-  - Map
-  - Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed. See [\_](#clustersnamelifecycle).
-  
-- - `node_type_id`
-  - String
-  - This field encodes, through a single value, the resources available to each of the Spark nodes in this cluster. For example, the Spark nodes can be provisioned and optimized for memory or compute intensive workloads. A list of available node types can be retrieved by using the :method:clusters/listNodeTypes API call.
-  
-- - `num_workers`
-  - Integer
-  - Number of worker nodes that this cluster should have. A cluster has one Spark Driver and `num_workers` Executors for a total of `num_workers` + 1 Spark nodes.  Note: When reading the properties of a cluster, this field reflects the desired number of workers rather than the actual current number of workers. For instance, if a cluster is resized from 5 to 10 workers, this field will immediately be updated to reflect the target size of 10 workers, whereas the workers listed in `spark_info` will gradually increase from 5 to 10 as the new nodes are provisioned.
-  
-- - `permissions`
-  - Sequence
-  - See [\_](#clustersnamepermissions).
-  
-- - `policy_id`
-  - String
-  - The ID of the cluster policy used to create the cluster if applicable.
-  
-- - `remote_disk_throughput`
-  - Integer
-  - If set, what the configurable throughput (in Mb/s) for the remote disk is. Currently only supported for GCP HYPERDISK_BALANCED disks.
-  
-- - `runtime_engine`
-  - String
-  - 
-  
-- - `single_user_name`
-  - String
-  - Single user name if data_security_mode is `SINGLE_USER`
-  
-- - `spark_conf`
-  - Map
-  - An object containing a set of optional, user-specified Spark configuration key-value pairs. Users can also pass in a string of extra JVM options to the driver and the executors via `spark.driver.extraJavaOptions` and `spark.executor.extraJavaOptions` respectively.
-  
-- - `spark_env_vars`
-  - Map
-  - An object containing a set of optional, user-specified environment variable key-value pairs. Please note that key-value pair of the form (X,Y) will be exported as is (i.e., `export X='Y'`) while launching the driver and workers.  In order to specify an additional set of `SPARK_DAEMON_JAVA_OPTS`, we recommend appending them to `$SPARK_DAEMON_JAVA_OPTS` as shown in the example below. This ensures that all default databricks managed environmental variables are included as well.  Example Spark environment variables: `{"SPARK_WORKER_MEMORY": "28000m", "SPARK_LOCAL_DIRS": "/local_disk0"}` or `{"SPARK_DAEMON_JAVA_OPTS": "$SPARK_DAEMON_JAVA_OPTS -Dspark.shuffle.service.enabled=true"}`
-  
-- - `spark_version`
-  - String
-  - The Spark version of the cluster, e.g. `3.3.x-scala2.11`. A list of available Spark versions can be retrieved by using the :method:clusters/sparkVersions API call.
-  
-- - `ssh_public_keys`
-  - Sequence
-  - SSH public key contents that will be added to each Spark node in this cluster. The corresponding private keys can be used to login with the user name `ubuntu` on port `2200`. Up to 10 keys can be specified.
-  
-- - `total_initial_remote_disk_size`
-  - Integer
-  - If set, what the total initial volume size (in GB) of the remote disks should be. Currently only supported for GCP HYPERDISK_BALANCED disks.
-  
-- - `use_ml_runtime`
-  - Boolean
-  - This field can only be used when `kind = CLASSIC_PREVIEW`.  `effective_spark_version` is determined by `spark_version` (DBR release), this field `use_ml_runtime`, and whether `node_type_id` is gpu node or not.
-  
-- - `worker_node_type_flexibility`
-  - Map
-  - Flexible node type configuration for worker nodes. See [\_](#clustersnameworker_node_type_flexibility).
-  
-- - `workload_type`
-  - Map
-  - Cluster Attributes showing for clusters workload types. See [\_](#clustersnameworkload_type).
-  
-:::
-  
-  
-**Example**
-  
-The following example creates a cluster named `my_cluster` and sets that as the cluster to use to run the notebook in `my_job`:
-
-```yaml
-bundle:
-  name: clusters
-
-resources:
-  clusters:
-    my_cluster:
-      num_workers: 2
-      node_type_id: "i3.xlarge"
-      autoscale:
-        min_workers: 2
-        max_workers: 7
-      spark_version: "13.3.x-scala2.12"
-      spark_conf:
-        "spark.executor.memory": "2g"
-
-  jobs:
-    my_job:
-      tasks:
-        - task_key: test_task
-          notebook_task:
-            notebook_path: "./src/my_notebook.py"
-```
-  
-### clusters._name_.autoscale
-  
-**`Type: Map`**
-  
-Parameters needed in order to automatically scale clusters up and down based on load.
-Note: autoscaling works best with DB runtime versions 3.0 or later.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `max_workers`
-  - Integer
-  - The maximum number of workers to which the cluster can scale up when overloaded. Note that `max_workers` must be strictly greater than `min_workers`.
-  
-- - `min_workers`
-  - Integer
-  - The minimum number of workers to which the cluster can scale down when underutilized. It is also the initial number of workers the cluster will have after creation.
-  
-:::
-  
-  
-### clusters._name_.aws_attributes
-  
-**`Type: Map`**
-  
-Attributes related to clusters running on Amazon Web Services.
-If not specified at cluster creation, a set of default values will be used.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `availability`
-  - String
-  - Availability type used for all subsequent nodes past the `first_on_demand` ones.  Note: If `first_on_demand` is zero, this availability type will be used for the entire cluster.
-  
-- - `ebs_volume_count`
-  - Integer
-  - The number of volumes launched for each instance. Users can choose up to 10 volumes. This feature is only enabled for supported node types. Legacy node types cannot specify custom EBS volumes. For node types with no instance store, at least one EBS volume needs to be specified; otherwise, cluster creation will fail.  These EBS volumes will be mounted at `/ebs0`, `/ebs1`, and etc. Instance store volumes will be mounted at `/local_disk0`, `/local_disk1`, and etc.  If EBS volumes are attached, Databricks will configure Spark to use only the EBS volumes for scratch storage because heterogenously sized scratch devices can lead to inefficient disk utilization. If no EBS volumes are attached, Databricks will configure Spark to use instance store volumes.  Please note that if EBS volumes are specified, then the Spark configuration `spark.local.dir` will be overridden.
-  
-- - `ebs_volume_iops`
-  - Integer
-  - If using gp3 volumes, what IOPS to use for the disk. If this is not set, the maximum performance of a gp2 volume with the same volume size will be used.
-  
-- - `ebs_volume_size`
-  - Integer
-  - The size of each EBS volume (in GiB) launched for each instance. For general purpose SSD, this value must be within the range 100 - 4096. For throughput optimized HDD, this value must be within the range 500 - 4096.
-  
-- - `ebs_volume_throughput`
-  - Integer
-  - If using gp3 volumes, what throughput to use for the disk. If this is not set, the maximum performance of a gp2 volume with the same volume size will be used.
-  
-- - `ebs_volume_type`
-  - String
-  - All EBS volume types that Databricks supports. See https://aws.amazon.com/ebs/details/ for details.
-  
-- - `first_on_demand`
-  - Integer
-  - The first `first_on_demand` nodes of the cluster will be placed on on-demand instances. If this value is greater than 0, the cluster driver node in particular will be placed on an on-demand instance. If this value is greater than or equal to the current cluster size, all nodes will be placed on on-demand instances. If this value is less than the current cluster size, `first_on_demand` nodes will be placed on on-demand instances and the remainder will be placed on `availability` instances. Note that this value does not affect cluster size and cannot currently be mutated over the lifetime of a cluster.
-  
-- - `instance_profile_arn`
-  - String
-  - Nodes for this cluster will only be placed on AWS instances with this instance profile. If ommitted, nodes will be placed on instances without an IAM instance profile. The instance profile must have previously been added to the Databricks environment by an account administrator.  This feature may only be available to certain customer plans.
-  
-- - `spot_bid_price_percent`
-  - Integer
-  - The bid price for AWS spot instances, as a percentage of the corresponding instance type's on-demand price. For example, if this field is set to 50, and the cluster needs a new `r3.xlarge` spot instance, then the bid price is half of the price of on-demand `r3.xlarge` instances. Similarly, if this field is set to 200, the bid price is twice the price of on-demand `r3.xlarge` instances. If not specified, the default value is 100. When spot instances are requested for this cluster, only spot instances whose bid price percentage matches this field will be considered. Note that, for safety, we enforce this field to be no more than 10000.
-  
-- - `zone_id`
-  - String
-  - Identifier for the availability zone/datacenter in which the cluster resides. This string will be of a form like "us-west-2a". The provided availability zone must be in the same region as the Databricks deployment. For example, "us-west-2a" is not a valid zone id if the Databricks deployment resides in the "us-east-1" region. This is an optional field at cluster creation, and if not specified, the zone "auto" will be used. If the zone specified is "auto", will try to place cluster in a zone with high availability, and will retry placement in a different AZ if there is not enough capacity.  The list of available zones as well as the default value can be found by using the `List Zones` method.
-  
-:::
-  
-  
-### clusters._name_.azure_attributes
-  
-**`Type: Map`**
-  
-Attributes related to clusters running on Microsoft Azure.
-If not specified at cluster creation, a set of default values will be used.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `availability`
-  - String
-  - Availability type used for all subsequent nodes past the `first_on_demand` ones. Note: If `first_on_demand` is zero, this availability type will be used for the entire cluster.
-  
-- - `first_on_demand`
-  - Integer
-  - The first `first_on_demand` nodes of the cluster will be placed on on-demand instances. This value should be greater than 0, to make sure the cluster driver node is placed on an on-demand instance. If this value is greater than or equal to the current cluster size, all nodes will be placed on on-demand instances. If this value is less than the current cluster size, `first_on_demand` nodes will be placed on on-demand instances and the remainder will be placed on `availability` instances. Note that this value does not affect cluster size and cannot currently be mutated over the lifetime of a cluster.
-  
-- - `log_analytics_info`
-  - Map
-  - Defines values necessary to configure and run Azure Log Analytics agent. See [\_](#clustersnameazure_attributeslog_analytics_info).
-  
-- - `spot_bid_max_price`
-  - Any
-  - The max bid price to be used for Azure spot instances. The Max price for the bid cannot be higher than the on-demand price of the instance. If not specified, the default value is -1, which specifies that the instance cannot be evicted on the basis of price, and only on the basis of availability. Further, the value should > 0 or -1.
-  
-:::
-  
-  
-### clusters._name_.azure_attributes.log_analytics_info
-  
-**`Type: Map`**
-  
-Defines values necessary to configure and run Azure Log Analytics agent
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `log_analytics_primary_key`
-  - String
-  - The primary key for the Azure Log Analytics agent configuration
-  
-- - `log_analytics_workspace_id`
-  - String
-  - The workspace ID for the Azure Log Analytics agent configuration
-  
-:::
-  
-  
-### clusters._name_.cluster_log_conf
-  
-**`Type: Map`**
-  
-The configuration for delivering spark logs to a long-term storage destination.
-Three kinds of destinations (DBFS, S3 and Unity Catalog volumes) are supported. Only one destination can be specified
-for one cluster. If the conf is given, the logs will be delivered to the destination every
-`5 mins`. The destination of driver logs is `$destination/$clusterId/driver`, while
-the destination of executor logs is `$destination/$clusterId/executor`.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `dbfs`
-  - Map
-  - destination needs to be provided. e.g. `{ "dbfs" : { "destination" : "dbfs:/home/cluster_log" } }`. See [\_](#clustersnamecluster_log_confdbfs).
-  
-- - `s3`
-  - Map
-  - destination and either the region or endpoint need to be provided. e.g. `{ "s3": { "destination" : "s3://cluster_log_bucket/prefix", "region" : "us-west-2" } }` Cluster iam role is used to access s3, please make sure the cluster iam role in `instance_profile_arn` has permission to write data to the s3 destination. See [\_](#clustersnamecluster_log_confs3).
-  
-- - `volumes`
-  - Map
-  - destination needs to be provided, e.g. `{ "volumes": { "destination": "/Volumes/catalog/schema/volume/cluster_log" } }`. See [\_](#clustersnamecluster_log_confvolumes).
-  
-:::
-  
-  
-### clusters._name_.cluster_log_conf.dbfs
-  
-**`Type: Map`**
-  
-destination needs to be provided. e.g.
-`{ "dbfs" : { "destination" : "dbfs:/home/cluster_log" } }`
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `destination`
-  - String
-  - dbfs destination, e.g. `dbfs:/my/path`
-  
-:::
-  
-  
-### clusters._name_.cluster_log_conf.s3
-  
-**`Type: Map`**
-  
-destination and either the region or endpoint need to be provided. e.g.
-`{ "s3": { "destination" : "s3://cluster_log_bucket/prefix", "region" : "us-west-2" } }`
-Cluster iam role is used to access s3, please make sure the cluster iam role in
-`instance_profile_arn` has permission to write data to the s3 destination.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `canned_acl`
-  - String
-  - (Optional) Set canned access control list for the logs, e.g. `bucket-owner-full-control`. If `canned_cal` is set, please make sure the cluster iam role has `s3:PutObjectAcl` permission on the destination bucket and prefix. The full list of possible canned acl can be found at http://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl. Please also note that by default only the object owner gets full controls. If you are using cross account role for writing data, you may want to set `bucket-owner-full-control` to make bucket owner able to read the logs.
-  
-- - `destination`
-  - String
-  - S3 destination, e.g. `s3://my-bucket/some-prefix` Note that logs will be delivered using cluster iam role, please make sure you set cluster iam role and the role has write access to the destination. Please also note that you cannot use AWS keys to deliver logs.
-  
-- - `enable_encryption`
-  - Boolean
-  - (Optional) Flag to enable server side encryption, `false` by default.
-  
-- - `encryption_type`
-  - String
-  - (Optional) The encryption type, it could be `sse-s3` or `sse-kms`. It will be used only when encryption is enabled and the default type is `sse-s3`.
-  
-- - `endpoint`
-  - String
-  - S3 endpoint, e.g. `https://s3-us-west-2.amazonaws.com`. Either region or endpoint needs to be set. If both are set, endpoint will be used.
-  
-- - `kms_key`
-  - String
-  - (Optional) Kms key which will be used if encryption is enabled and encryption type is set to `sse-kms`.
-  
-- - `region`
-  - String
-  - S3 region, e.g. `us-west-2`. Either region or endpoint needs to be set. If both are set, endpoint will be used.
-  
-:::
-  
-  
-### clusters._name_.cluster_log_conf.volumes
-  
-**`Type: Map`**
-  
-destination needs to be provided, e.g.
-`{ "volumes": { "destination": "/Volumes/catalog/schema/volume/cluster_log" } }`
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `destination`
-  - String
-  - UC Volumes destination, e.g. `/Volumes/catalog/schema/vol1/init-scripts/setup-datadog.sh` or `dbfs:/Volumes/catalog/schema/vol1/init-scripts/setup-datadog.sh`
-  
-:::
-  
-  
-### clusters._name_.docker_image
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `basic_auth`
-  - Map
-  - See [\_](#clustersnamedocker_imagebasic_auth).
-  
-- - `url`
-  - String
-  - URL of the docker image.
-  
-:::
-  
-  
-### clusters._name_.docker_image.basic_auth
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `password`
-  - String
-  - Password of the user
-  
-- - `username`
-  - String
-  - Name of the user
-  
-:::
-  
-  
-### clusters._name_.driver_node_type_flexibility
-  
-**`Type: Map`**
-  
-Flexible node type configuration for the driver node.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `alternate_node_type_ids`
-  - Sequence
-  - A list of node type IDs to use as fallbacks when the primary node type is unavailable.
-  
-:::
-  
-  
-### clusters._name_.gcp_attributes
-  
-**`Type: Map`**
-  
-Attributes related to clusters running on Google Cloud Platform.
-If not specified at cluster creation, a set of default values will be used.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `availability`
-  - String
-  - This field determines whether the instance pool will contain preemptible VMs, on-demand VMs, or preemptible VMs with a fallback to on-demand VMs if the former is unavailable.
-  
-- - `boot_disk_size`
-  - Integer
-  - Boot disk size in GB
-  
-- - `first_on_demand`
-  - Integer
-  - The first `first_on_demand` nodes of the cluster will be placed on on-demand instances. This value should be greater than 0, to make sure the cluster driver node is placed on an on-demand instance. If this value is greater than or equal to the current cluster size, all nodes will be placed on on-demand instances. If this value is less than the current cluster size, `first_on_demand` nodes will be placed on on-demand instances and the remainder will be placed on `availability` instances. Note that this value does not affect cluster size and cannot currently be mutated over the lifetime of a cluster.
-  
-- - `google_service_account`
-  - String
-  - If provided, the cluster will impersonate the google service account when accessing gcloud services (like GCS). The google service account must have previously been added to the Databricks environment by an account administrator.
-  
-- - `local_ssd_count`
-  - Integer
-  - If provided, each node (workers and driver) in the cluster will have this number of local SSDs attached. Each local SSD is 375GB in size. Refer to [GCP documentation](https://cloud.google.com/compute/docs/disks/local-ssd#choose_number_local_ssds) for the supported number of local SSDs for each instance type.
-  
-- - `use_preemptible_executors`
-  - Boolean
-  - This field is deprecated
-  
-- - `zone_id`
-  - String
-  - Identifier for the availability zone in which the cluster resides. This can be one of the following: - "HA" => High availability, spread nodes across availability zones for a Databricks deployment region [default]. - "AUTO" => Databricks picks an availability zone to schedule the cluster on. - A GCP availability zone => Pick One of the available zones for (machine type + region) from https://cloud.google.com/compute/docs/regions-zones.
-  
-:::
-  
-  
-### clusters._name_.init_scripts
-  
-**`Type: Sequence`**
-  
-The configuration for storing init scripts. Any number of destinations can be specified.
-The scripts are executed sequentially in the order provided.
-If `cluster_log_conf` is specified, init script logs are sent to `<destination>/<cluster-ID>/init_scripts`.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `abfss`
-  - Map
-  - Contains the Azure Data Lake Storage destination path. See [\_](#clustersnameinit_scriptsabfss).
-  
-- - `dbfs`
-  - Map
-  - This field is deprecated
-  
-- - `file`
-  - Map
-  - destination needs to be provided, e.g. `{ "file": { "destination": "file:/my/local/file.sh" } }`. See [\_](#clustersnameinit_scriptsfile).
-  
-- - `gcs`
-  - Map
-  - destination needs to be provided, e.g. `{ "gcs": { "destination": "gs://my-bucket/file.sh" } }`. See [\_](#clustersnameinit_scriptsgcs).
-  
-- - `s3`
-  - Map
-  - destination and either the region or endpoint need to be provided. e.g. `{ \"s3\": { \"destination\": \"s3://cluster_log_bucket/prefix\", \"region\": \"us-west-2\" } }` Cluster iam role is used to access s3, please make sure the cluster iam role in `instance_profile_arn` has permission to write data to the s3 destination. See [\_](#clustersnameinit_scriptss3).
-  
-- - `volumes`
-  - Map
-  - destination needs to be provided. e.g. `{ \"volumes\" : { \"destination\" : \"/Volumes/my-init.sh\" } }`. See [\_](#clustersnameinit_scriptsvolumes).
-  
-- - `workspace`
-  - Map
-  - destination needs to be provided, e.g. `{ "workspace": { "destination": "/cluster-init-scripts/setup-datadog.sh" } }`. See [\_](#clustersnameinit_scriptsworkspace).
-  
-:::
-  
-  
-### clusters._name_.init_scripts.abfss
-  
-**`Type: Map`**
-  
-Contains the Azure Data Lake Storage destination path
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `destination`
-  - String
-  - abfss destination, e.g. `abfss://<container-name>@<storage-account-name>.dfs.core.windows.net/<directory-name>`.
-  
-:::
-  
-  
-### clusters._name_.init_scripts.file
-  
-**`Type: Map`**
-  
-destination needs to be provided, e.g.
-`{ "file": { "destination": "file:/my/local/file.sh" } }`
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `destination`
-  - String
-  - local file destination, e.g. `file:/my/local/file.sh`
-  
-:::
-  
-  
-### clusters._name_.init_scripts.gcs
-  
-**`Type: Map`**
-  
-destination needs to be provided, e.g.
-`{ "gcs": { "destination": "gs://my-bucket/file.sh" } }`
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `destination`
-  - String
-  - GCS destination/URI, e.g. `gs://my-bucket/some-prefix`
-  
-:::
-  
-  
-### clusters._name_.init_scripts.s3
-  
-**`Type: Map`**
-  
-destination and either the region or endpoint need to be provided. e.g.
-`{ \"s3\": { \"destination\": \"s3://cluster_log_bucket/prefix\", \"region\": \"us-west-2\" } }`
-Cluster iam role is used to access s3, please make sure the cluster iam role in
-`instance_profile_arn` has permission to write data to the s3 destination.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `canned_acl`
-  - String
-  - (Optional) Set canned access control list for the logs, e.g. `bucket-owner-full-control`. If `canned_cal` is set, please make sure the cluster iam role has `s3:PutObjectAcl` permission on the destination bucket and prefix. The full list of possible canned acl can be found at http://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl. Please also note that by default only the object owner gets full controls. If you are using cross account role for writing data, you may want to set `bucket-owner-full-control` to make bucket owner able to read the logs.
-  
-- - `destination`
-  - String
-  - S3 destination, e.g. `s3://my-bucket/some-prefix` Note that logs will be delivered using cluster iam role, please make sure you set cluster iam role and the role has write access to the destination. Please also note that you cannot use AWS keys to deliver logs.
-  
-- - `enable_encryption`
-  - Boolean
-  - (Optional) Flag to enable server side encryption, `false` by default.
-  
-- - `encryption_type`
-  - String
-  - (Optional) The encryption type, it could be `sse-s3` or `sse-kms`. It will be used only when encryption is enabled and the default type is `sse-s3`.
-  
-- - `endpoint`
-  - String
-  - S3 endpoint, e.g. `https://s3-us-west-2.amazonaws.com`. Either region or endpoint needs to be set. If both are set, endpoint will be used.
-  
-- - `kms_key`
-  - String
-  - (Optional) Kms key which will be used if encryption is enabled and encryption type is set to `sse-kms`.
-  
-- - `region`
-  - String
-  - S3 region, e.g. `us-west-2`. Either region or endpoint needs to be set. If both are set, endpoint will be used.
-  
-:::
-  
-  
-### clusters._name_.init_scripts.volumes
-  
-**`Type: Map`**
-  
-destination needs to be provided. e.g.
-`{ \"volumes\" : { \"destination\" : \"/Volumes/my-init.sh\" } }`
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `destination`
-  - String
-  - UC Volumes destination, e.g. `/Volumes/catalog/schema/vol1/init-scripts/setup-datadog.sh` or `dbfs:/Volumes/catalog/schema/vol1/init-scripts/setup-datadog.sh`
-  
-:::
-  
-  
-### clusters._name_.init_scripts.workspace
-  
-**`Type: Map`**
-  
-destination needs to be provided, e.g.
-`{ "workspace": { "destination": "/cluster-init-scripts/setup-datadog.sh" } }`
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `destination`
-  - String
-  - wsfs destination, e.g. `workspace:/cluster-init-scripts/setup-datadog.sh`
-  
-:::
-  
-  
-### clusters._name_.lifecycle
-  
-**`Type: Map`**
-  
-Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-### clusters._name_.permissions
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `group_name`
-  - String
-  - 
-  
-- - `level`
-  - String
-  - Permission level
-  
-- - `service_principal_name`
-  - String
-  - 
-  
-- - `user_name`
-  - String
-  - 
-  
-:::
-  
-  
-### clusters._name_.worker_node_type_flexibility
-  
-**`Type: Map`**
-  
-Flexible node type configuration for worker nodes.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `alternate_node_type_ids`
-  - Sequence
-  - A list of node type IDs to use as fallbacks when the primary node type is unavailable.
-  
-:::
-  
-  
-### clusters._name_.workload_type
-  
-**`Type: Map`**
-  
-Cluster Attributes showing for clusters workload types.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `clients`
-  - Map
-  - defined what type of clients can use the cluster. E.g. Notebooks, Jobs. See [\_](#clustersnameworkload_typeclients).
-  
-:::
-  
-  
-### clusters._name_.workload_type.clients
-  
-**`Type: Map`**
-  
-defined what type of clients can use the cluster. E.g. Notebooks, Jobs
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `jobs`
-  - Boolean
-  - With jobs set, the cluster can be used for jobs
-  
-- - `notebooks`
-  - Boolean
-  - With notebooks set, this cluster can be used for notebooks
-  
-:::
-  
-  
-## dashboards
-  
-**`Type: Map`**
-  
-The dashboard resource allows you to manage [AI/BI dashboards](/api/workspace/lakeview/create) in a bundle. For information about AI/BI dashboards, see [_](/dashboards/index.md).
-  
-```yaml
-dashboards:
-  <dashboard-name>:
-    <dashboard-field-name>: <dashboard-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `create_time`
-  - String
-  - The timestamp of when the dashboard was created.
-  
-- - `dashboard_id`
-  - String
-  - UUID identifying the dashboard.
-  
-- - `dataset_catalog`
-  - String
-  - Sets the default catalog for all datasets in this dashboard. When set, this overrides the catalog specified in individual dataset definitions.
-  
-- - `dataset_schema`
-  - String
-  - Sets the default schema for all datasets in this dashboard. When set, this overrides the schema specified in individual dataset definitions.
-  
-- - `display_name`
-  - String
-  - The display name of the dashboard.
-  
-- - `embed_credentials`
-  - Boolean
-  - 
-  
-- - `etag`
-  - String
-  - The etag for the dashboard. Can be optionally provided on updates to ensure that the dashboard has not been modified since the last read. This field is excluded in List Dashboards responses.
-  
-- - `file_path`
-  - String
-  - 
-  
-- - `lifecycle`
-  - Map
-  - Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed. See [\_](#dashboardsnamelifecycle).
-  
-- - `lifecycle_state`
-  - String
-  - The state of the dashboard resource. Used for tracking trashed status.
-  
-- - `parent_path`
-  - String
-  - The workspace path of the folder containing the dashboard. Includes leading slash and no trailing slash. This field is excluded in List Dashboards responses.
-  
-- - `path`
-  - String
-  - The workspace path of the dashboard asset, including the file name. Exported dashboards always have the file extension `.lvdash.json`. This field is excluded in List Dashboards responses.
-  
-- - `permissions`
-  - Sequence
-  - See [\_](#dashboardsnamepermissions).
-  
-- - `serialized_dashboard`
-  - Any
-  - The contents of the dashboard in serialized string form. This field is excluded in List Dashboards responses. Use the [get dashboard API](https://docs.databricks.com/api/workspace/lakeview/get) to retrieve an example response, which includes the `serialized_dashboard` field. This field provides the structure of the JSON string that represents the dashboard's layout and components.
-  
-- - `update_time`
-  - String
-  - The timestamp of when the dashboard was last updated by the user. This field is excluded in List Dashboards responses.
-  
-- - `warehouse_id`
-  - String
-  - The warehouse ID used to run the dashboard.
-  
-:::
-  
-  
-**Example**
-  
-The following example includes and deploys the sample __NYC Taxi Trip Analysis__ dashboard to the Databricks workspace.
-
-``` yaml
-resources:
-  dashboards:
-    nyc_taxi_trip_analysis:
-      display_name: "NYC Taxi Trip Analysis"
-      file_path: ../src/nyc_taxi_trip_analysis.lvdash.json
-      warehouse_id: ${var.warehouse_id}
-```
-If you use the UI to modify the dashboard, modifications made through the UI are not applied to the dashboard JSON file in the local bundle unless you explicitly update it using `bundle generate`. You can use the `--watch` option to continuously poll and retrieve changes to the dashboard. See [_](/dev-tools/cli/bundle-commands.md#generate).
-
-In addition, if you attempt to deploy a bundle that contains a dashboard JSON file that is different than the one in the remote workspace, an error will occur. To force the deploy and overwrite the dashboard in the remote workspace with the local one, use the `--force` option. See [_](/dev-tools/cli/bundle-commands.md#deploy).
-  
-### dashboards._name_.lifecycle
-  
-**`Type: Map`**
-  
-Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-### dashboards._name_.permissions
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `group_name`
-  - String
-  - The name of the group that has the permission set in level.
-  
-- - `level`
-  - String
-  - The allowed permission for user, group, service principal defined for this permission.
-  
-- - `service_principal_name`
-  - String
-  - The name of the service principal that has the permission set in level.
-  
-- - `user_name`
-  - String
-  - The name of the user that has the permission set in level.
-  
-:::
-  
-  
-## database_catalogs
-  
-**`Type: Map`**
-  
-
-  
-```yaml
-database_catalogs:
-  <database_catalog-name>:
-    <database_catalog-field-name>: <database_catalog-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `create_database_if_not_exists`
-  - Boolean
-  - 
-  
-- - `database_instance_name`
-  - String
-  - The name of the DatabaseInstance housing the database.
-  
-- - `database_name`
-  - String
-  - The name of the database (in a instance) associated with the catalog.
-  
-- - `lifecycle`
-  - Map
-  - Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed. See [\_](#database_catalogsnamelifecycle).
-  
-- - `name`
-  - String
-  - The name of the catalog in UC.
-  
-:::
-  
-  
-### database_catalogs._name_.lifecycle
-  
-**`Type: Map`**
-  
-Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-## database_instances
-  
-**`Type: Map`**
-  
-A DatabaseInstance represents a logical Postgres instance, comprised of both compute and storage.
-  
-```yaml
-database_instances:
-  <database_instance-name>:
-    <database_instance-field-name>: <database_instance-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `capacity`
-  - String
-  - The sku of the instance. Valid values are "CU_1", "CU_2", "CU_4", "CU_8".
-  
-- - `custom_tags`
-  - Sequence
-  - Custom tags associated with the instance. This field is only included on create and update responses. See [\_](#database_instancesnamecustom_tags).
-  
-- - `enable_pg_native_login`
-  - Boolean
-  - Whether to enable PG native password login on the instance. Defaults to false.
-  
-- - `enable_readable_secondaries`
-  - Boolean
-  - Whether to enable secondaries to serve read-only traffic. Defaults to false.
-  
-- - `lifecycle`
-  - Map
-  - Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed. See [\_](#database_instancesnamelifecycle).
-  
-- - `name`
-  - String
-  - The name of the instance. This is the unique identifier for the instance.
-  
-- - `node_count`
-  - Integer
-  - The number of nodes in the instance, composed of 1 primary and 0 or more secondaries. Defaults to 1 primary and 0 secondaries. This field is input only, see effective_node_count for the output.
-  
-- - `parent_instance_ref`
-  - Map
-  - The ref of the parent instance. This is only available if the instance is child instance. Input: For specifying the parent instance to create a child instance. Optional. Output: Only populated if provided as input to create a child instance. See [\_](#database_instancesnameparent_instance_ref).
-  
-- - `permissions`
-  - Sequence
-  - See [\_](#database_instancesnamepermissions).
-  
-- - `retention_window_in_days`
-  - Integer
-  - The retention window for the instance. This is the time window in days for which the historical data is retained. The default value is 7 days. Valid values are 2 to 35 days.
-  
-- - `stopped`
-  - Boolean
-  - Whether to stop the instance. An input only param, see effective_stopped for the output.
-  
-- - `usage_policy_id`
-  - String
-  - The desired usage policy to associate with the instance.
-  
-:::
-  
-  
-### database_instances._name_.custom_tags
-  
-**`Type: Sequence`**
-  
-Custom tags associated with the instance. This field is only included on create and update responses.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `key`
-  - String
-  - The key of the custom tag.
-  
-- - `value`
-  - String
-  - The value of the custom tag.
-  
-:::
-  
-  
-### database_instances._name_.lifecycle
-  
-**`Type: Map`**
-  
-Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-### database_instances._name_.parent_instance_ref
-  
-**`Type: Map`**
-  
-The ref of the parent instance. This is only available if the instance is
-child instance.
-Input: For specifying the parent instance to create a child instance. Optional.
-Output: Only populated if provided as input to create a child instance.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `branch_time`
-  - String
-  - Branch time of the ref database instance. For a parent ref instance, this is the point in time on the parent instance from which the instance was created. For a child ref instance, this is the point in time on the instance from which the child instance was created. Input: For specifying the point in time to create a child instance. Optional. Output: Only populated if provided as input to create a child instance.
-  
-- - `lsn`
-  - String
-  - User-specified WAL LSN of the ref database instance.  Input: For specifying the WAL LSN to create a child instance. Optional. Output: Only populated if provided as input to create a child instance.
-  
-- - `name`
-  - String
-  - Name of the ref database instance.
-  
-:::
-  
-  
-### database_instances._name_.permissions
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `group_name`
-  - String
-  - The name of the group that has the permission set in level.
-  
-- - `level`
-  - String
-  - The allowed permission for user, group, service principal defined for this permission.
-  
-- - `service_principal_name`
-  - String
-  - The name of the service principal that has the permission set in level.
-  
-- - `user_name`
-  - String
-  - The name of the user that has the permission set in level.
-  
-:::
-  
-  
-## experiments
-  
-**`Type: Map`**
-  
-The experiment resource allows you to define [MLflow experiments](/api/workspace/experiments/createexperiment) in a bundle. For information about MLflow experiments, see [_](/mlflow/experiments.md).
-  
-```yaml
-experiments:
-  <experiment-name>:
-    <experiment-field-name>: <experiment-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `artifact_location`
-  - String
-  - Location where all artifacts for the experiment are stored. If not provided, the remote server will select an appropriate default.
-  
-- - `lifecycle`
-  - Map
-  - Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed. See [\_](#experimentsnamelifecycle).
-  
-- - `name`
-  - String
-  - Experiment name.
-  
-- - `permissions`
-  - Sequence
-  - See [\_](#experimentsnamepermissions).
-  
-- - `tags`
-  - Sequence
-  - A collection of tags to set on the experiment. Maximum tag size and number of tags per request depends on the storage backend. All storage backends are guaranteed to support tag keys up to 250 bytes in size and tag values up to 5000 bytes in size. All storage backends are also guaranteed to support up to 20 tags per request. See [\_](#experimentsnametags).
-  
-:::
-  
-  
-**Example**
-  
-The following example defines an experiment that all users can view:
-
-```yaml
-resources:
-  experiments:
-    experiment:
-      name: my_ml_experiment
-      permissions:
-        - level: CAN_READ
-          group_name: users
-      description: MLflow experiment used to track runs
-```
-  
-### experiments._name_.lifecycle
-  
-**`Type: Map`**
-  
-Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-### experiments._name_.permissions
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `group_name`
-  - String
-  - 
-  
-- - `level`
-  - String
-  - Permission level
-  
-- - `service_principal_name`
-  - String
-  - 
-  
-- - `user_name`
-  - String
-  - 
-  
-:::
-  
-  
-### experiments._name_.tags
-  
-**`Type: Sequence`**
-  
-A collection of tags to set on the experiment. Maximum tag size and number of tags per request
-depends on the storage backend. All storage backends are guaranteed to support tag keys up
-to 250 bytes in size and tag values up to 5000 bytes in size. All storage backends are also
-guaranteed to support up to 20 tags per request.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `key`
-  - String
-  - The tag key.
-  
-- - `value`
-  - String
-  - The tag value.
-  
-:::
-  
-  
-## external_locations
-  
-**`Type: Map`**
-  
-
-  
-```yaml
-external_locations:
-  <external_location-name>:
-    <external_location-field-name>: <external_location-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `comment`
-  - String
-  - 
-  
-- - `credential_name`
-  - String
-  - 
-  
-- - `enable_file_events`
-  - Boolean
-  - 
-  
-- - `encryption_details`
-  - Map
-  - Encryption options that apply to clients connecting to cloud storage. See [\_](#external_locationsnameencryption_details).
-  
-- - `fallback`
-  - Boolean
-  - 
-  
-- - `file_event_queue`
-  - Map
-  - See [\_](#external_locationsnamefile_event_queue).
-  
-- - `grants`
-  - Sequence
-  - See [\_](#external_locationsnamegrants).
-  
-- - `lifecycle`
-  - Map
-  - See [\_](#external_locationsnamelifecycle).
-  
-- - `name`
-  - String
-  - 
-  
-- - `read_only`
-  - Boolean
-  - 
-  
-- - `skip_validation`
-  - Boolean
-  - 
-  
-- - `url`
-  - String
-  - 
-  
-:::
-  
-  
-### external_locations._name_.encryption_details
-  
-**`Type: Map`**
-  
-Encryption options that apply to clients connecting to cloud storage.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `sse_encryption_details`
-  - Map
-  - Server-Side Encryption properties for clients communicating with AWS s3. See [\_](#external_locationsnameencryption_detailssse_encryption_details).
-  
-:::
-  
-  
-### external_locations._name_.encryption_details.sse_encryption_details
-  
-**`Type: Map`**
-  
-Server-Side Encryption properties for clients communicating with AWS s3.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `algorithm`
-  - String
-  - SSE algorithm to use for encrypting S3 objects
-  
-- - `aws_kms_key_arn`
-  - String
-  - 
-  
-:::
-  
-  
-### external_locations._name_.file_event_queue
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `managed_aqs`
-  - Map
-  - See [\_](#external_locationsnamefile_event_queuemanaged_aqs).
-  
-- - `managed_pubsub`
-  - Map
-  - See [\_](#external_locationsnamefile_event_queuemanaged_pubsub).
-  
-- - `managed_sqs`
-  - Map
-  - See [\_](#external_locationsnamefile_event_queuemanaged_sqs).
-  
-- - `provided_aqs`
-  - Map
-  - See [\_](#external_locationsnamefile_event_queueprovided_aqs).
-  
-- - `provided_pubsub`
-  - Map
-  - See [\_](#external_locationsnamefile_event_queueprovided_pubsub).
-  
-- - `provided_sqs`
-  - Map
-  - See [\_](#external_locationsnamefile_event_queueprovided_sqs).
-  
-:::
-  
-  
-### external_locations._name_.file_event_queue.managed_aqs
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `queue_url`
-  - String
-  - 
-  
-- - `resource_group`
-  - String
-  - 
-  
-- - `subscription_id`
-  - String
-  - 
-  
-:::
-  
-  
-### external_locations._name_.file_event_queue.managed_pubsub
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `subscription_name`
-  - String
-  - 
-  
-:::
-  
-  
-### external_locations._name_.file_event_queue.managed_sqs
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `queue_url`
-  - String
-  - 
-  
-:::
-  
-  
-### external_locations._name_.file_event_queue.provided_aqs
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `queue_url`
-  - String
-  - 
-  
-- - `resource_group`
-  - String
-  - 
-  
-- - `subscription_id`
-  - String
-  - 
-  
-:::
-  
-  
-### external_locations._name_.file_event_queue.provided_pubsub
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `subscription_name`
-  - String
-  - 
-  
-:::
-  
-  
-### external_locations._name_.file_event_queue.provided_sqs
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `queue_url`
-  - String
-  - 
-  
-:::
-  
-  
-### external_locations._name_.grants
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `principal`
-  - String
-  - The principal (user email address or group name). For deleted principals, `principal` is empty while `principal_id` is populated.
-  
-- - `privileges`
-  - Sequence
-  - The privileges assigned to the principal.
-  
-:::
-  
-  
-### external_locations._name_.grants.privileges
-  
-**`Type: Sequence`**
-  
-The privileges assigned to the principal.
-  
-  
-### external_locations._name_.lifecycle
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-## jobs
-  
-**`Type: Map`**
-  
-The job resource allows you to define [jobs and their corresponding tasks](/api/workspace/jobs/create) in your bundle. For information about jobs, see [_](/jobs/index.md). For a tutorial that uses a Declarative Automation Bundles template to create a job, see [_](/dev-tools/bundles/jobs-tutorial.md).
-  
-```yaml
-jobs:
-  <job-name>:
-    <job-field-name>: <job-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `budget_policy_id`
-  - String
-  - The id of the user specified budget policy to use for this job. If not specified, a default budget policy may be applied when creating or modifying the job. See `effective_budget_policy_id` for the budget policy used by this workload.
-  
-- - `continuous`
-  - Map
-  - An optional continuous property for this job. The continuous property will ensure that there is always one run executing. Only one of `schedule` and `continuous` can be used. See [\_](#jobsnamecontinuous).
-  
-- - `deployment`
-  - Map
-  - Deployment information for jobs managed by external sources. See [\_](#jobsnamedeployment).
-  
-- - `description`
-  - String
-  - An optional description for the job. The maximum length is 27700 characters in UTF-8 encoding.
-  
-- - `edit_mode`
-  - String
-  - Edit mode of the job.  * `UI_LOCKED`: The job is in a locked UI state and cannot be modified. * `EDITABLE`: The job is in an editable state and can be modified.
-  
-- - `email_notifications`
-  - Map
-  - An optional set of email addresses that is notified when runs of this job begin or complete as well as when this job is deleted. See [\_](#jobsnameemail_notifications).
-  
-- - `environments`
-  - Sequence
-  - A list of task execution environment specifications that can be referenced by serverless tasks of this job. For serverless notebook tasks, if the environment_key is not specified, the notebook environment will be used if present. If a jobs environment is specified, it will override the notebook environment. For other serverless tasks, the task environment is required to be specified using environment_key in the task settings. See [\_](#jobsnameenvironments).
-  
-- - `format`
-  - String
-  - This field is deprecated
-  
-- - `git_source`
-  - Map
-  - An optional specification for a remote Git repository containing the source code used by tasks. Version-controlled source code is supported by notebook, dbt, Python script, and SQL File tasks.  If `git_source` is set, these tasks retrieve the file from the remote repository by default. However, this behavior can be overridden by setting `source` to `WORKSPACE` on the task.  Note: dbt and SQL File tasks support only version-controlled sources. If dbt or SQL File tasks are used, `git_source` must be defined on the job. See [\_](#jobsnamegit_source).
-  
-- - `health`
-  - Map
-  - An optional set of health rules that can be defined for this job. See [\_](#jobsnamehealth).
-  
-- - `job_clusters`
-  - Sequence
-  - A list of job cluster specifications that can be shared and reused by tasks of this job. Libraries cannot be declared in a shared job cluster. You must declare dependent libraries in task settings. See [\_](#jobsnamejob_clusters).
-  
-- - `lifecycle`
-  - Map
-  - Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed. See [\_](#jobsnamelifecycle).
-  
-- - `max_concurrent_runs`
-  - Integer
-  - An optional maximum allowed number of concurrent runs of the job. Set this value if you want to be able to execute multiple runs of the same job concurrently. This is useful for example if you trigger your job on a frequent schedule and want to allow consecutive runs to overlap with each other, or if you want to trigger multiple runs which differ by their input parameters. This setting affects only new runs. For example, suppose the job’s concurrency is 4 and there are 4 concurrent active runs. Then setting the concurrency to 3 won’t kill any of the active runs. However, from then on, new runs are skipped unless there are fewer than 3 active runs. This value cannot exceed 1000. Setting this value to `0` causes all new runs to be skipped.
-  
-- - `name`
-  - String
-  - An optional name for the job. The maximum length is 4096 bytes in UTF-8 encoding.
-  
-- - `notification_settings`
-  - Map
-  - Optional notification settings that are used when sending notifications to each of the `email_notifications` and `webhook_notifications` for this job. See [\_](#jobsnamenotification_settings).
-  
-- - `parameters`
-  - Sequence
-  - Job-level parameter definitions. See [\_](#jobsnameparameters).
-  
-- - `performance_target`
-  - String
-  - The performance mode on a serverless job. This field determines the level of compute performance or cost-efficiency for the run. The performance target does not apply to tasks that run on Serverless GPU compute.  * `STANDARD`: Enables cost-efficient execution of serverless workloads. * `PERFORMANCE_OPTIMIZED`: Prioritizes fast startup and execution times through rapid scaling and optimized cluster performance.
-  
-- - `permissions`
-  - Sequence
-  - See [\_](#jobsnamepermissions).
-  
-- - `queue`
-  - Map
-  - The queue settings of the job. See [\_](#jobsnamequeue).
-  
-- - `run_as`
-  - Map
-  - Write-only setting. Specifies the user or service principal that the job runs as. If not specified, the job runs as the user who created the job.  Either `user_name` or `service_principal_name` should be specified. If not, an error is thrown. See [\_](#jobsnamerun_as).
-  
-- - `schedule`
-  - Map
-  - An optional periodic schedule for this job. The default behavior is that the job only runs when triggered by clicking “Run Now” in the Jobs UI or sending an API request to `runNow`. See [\_](#jobsnameschedule).
-  
-- - `tags`
-  - Map
-  - A map of tags associated with the job. These are forwarded to the cluster as cluster tags for jobs clusters, and are subject to the same limitations as cluster tags. A maximum of 25 tags can be added to the job.
-  
-- - `tasks`
-  - Sequence
-  - A list of task specifications to be executed by this job. It supports up to 1000 elements in write endpoints (:method:jobs/create, :method:jobs/reset, :method:jobs/update, :method:jobs/submit). Read endpoints return only 100 tasks. If more than 100 tasks are available, you can paginate through them using :method:jobs/get. Use the `next_page_token` field at the object root to determine if more results are available. See [\_](#jobsnametasks).
-  
-- - `timeout_seconds`
-  - Integer
-  - An optional timeout applied to each run of this job. A value of `0` means no timeout.
-  
-- - `trigger`
-  - Map
-  - A configuration to trigger a run when certain conditions are met. The default behavior is that the job runs only when triggered by clicking “Run Now” in the Jobs UI or sending an API request to `runNow`. See [\_](#jobsnametrigger).
-  
-- - `webhook_notifications`
-  - Map
-  - A collection of system notification IDs to notify when runs of this job begin or complete. See [\_](#jobsnamewebhook_notifications).
-  
-:::
-  
-  
-**Example**
-  
-The following example defines a job with the resource key `hello-job` with one notebook task:
-
-```yaml
-resources:
-  jobs:
-    hello-job:
-      name: hello-job
-      tasks:
-        - task_key: hello-task
-          notebook_task:
-            notebook_path: ./hello.py
-```
-
-For information about defining job tasks and overriding job settings, see [_](/dev-tools/bundles/job-task-types.md), [_](/dev-tools/bundles/job-task-override.md), and [_](/dev-tools/bundles/cluster-override.md).
-  
-### jobs._name_.continuous
-  
-**`Type: Map`**
-  
-An optional continuous property for this job. The continuous property will ensure that there is always one run executing. Only one of `schedule` and `continuous` can be used.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `pause_status`
-  - String
-  - Indicate whether the continuous execution of the job is paused or not. Defaults to UNPAUSED.
-  
-- - `task_retry_mode`
-  - String
-  - Indicate whether the continuous job is applying task level retries or not. Defaults to NEVER.
-  
-:::
-  
-  
-### jobs._name_.deployment
-  
-**`Type: Map`**
-  
-Deployment information for jobs managed by external sources.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `kind`
-  - String
-  - The kind of deployment that manages the job.  * `BUNDLE`: The job is managed by Databricks Asset Bundle. * `SYSTEM_MANAGED`: The job is managed by Databricks and is read-only.
-  
-- - `metadata_file_path`
-  - String
-  - Path of the file that contains deployment metadata.
-  
-:::
-  
-  
-### jobs._name_.email_notifications
-  
-**`Type: Map`**
-  
-An optional set of email addresses that is notified when runs of this job begin or complete as well as when this job is deleted.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `no_alert_for_skipped_runs`
-  - Boolean
-  - This field is deprecated
-  
-- - `on_duration_warning_threshold_exceeded`
-  - Sequence
-  - A list of email addresses to be notified when the duration of a run exceeds the threshold specified for the `RUN_DURATION_SECONDS` metric in the `health` field. If no rule for the `RUN_DURATION_SECONDS` metric is specified in the `health` field for the job, notifications are not sent.
-  
-- - `on_failure`
-  - Sequence
-  - A list of email addresses to be notified when a run unsuccessfully completes. A run is considered to have completed unsuccessfully if it ends with an `INTERNAL_ERROR` `life_cycle_state` or a `FAILED`, or `TIMED_OUT` result_state. If this is not specified on job creation, reset, or update the list is empty, and notifications are not sent.
-  
-- - `on_start`
-  - Sequence
-  - A list of email addresses to be notified when a run begins. If not specified on job creation, reset, or update, the list is empty, and notifications are not sent.
-  
-- - `on_streaming_backlog_exceeded`
-  - Sequence
-  - A list of email addresses to notify when any streaming backlog thresholds are exceeded for any stream. Streaming backlog thresholds can be set in the `health` field using the following metrics: `STREAMING_BACKLOG_BYTES`, `STREAMING_BACKLOG_RECORDS`, `STREAMING_BACKLOG_SECONDS`, or `STREAMING_BACKLOG_FILES`. Alerting is based on the 10-minute average of these metrics. If the issue persists, notifications are resent every 30 minutes.
-  
-- - `on_success`
-  - Sequence
-  - A list of email addresses to be notified when a run successfully completes. A run is considered to have completed successfully if it ends with a `TERMINATED` `life_cycle_state` and a `SUCCESS` result_state. If not specified on job creation, reset, or update, the list is empty, and notifications are not sent.
-  
-:::
-  
-  
-### jobs._name_.environments
-  
-**`Type: Sequence`**
-  
-A list of task execution environment specifications that can be referenced by serverless tasks of this job.
-For serverless notebook tasks, if the environment_key is not specified, the notebook environment will be used if present. If a jobs environment is specified, it will override the notebook environment.
-For other serverless tasks, the task environment is required to be specified using environment_key in the task settings.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `environment_key`
-  - String
-  - The key of an environment. It has to be unique within a job.
-  
-- - `spec`
-  - Map
-  - The environment entity used to preserve serverless environment side panel, jobs' environment for non-notebook task, and DLT's environment for classic and serverless pipelines. In this minimal environment spec, only pip and java dependencies are supported. See [\_](#jobsnameenvironmentsspec).
-  
-:::
-  
-  
-### jobs._name_.environments.spec
-  
-**`Type: Map`**
-  
-The environment entity used to preserve serverless environment side panel, jobs' environment for non-notebook task, and DLT's environment for classic and serverless pipelines.
-In this minimal environment spec, only pip and java dependencies are supported.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `base_environment`
-  - String
-  - The base environment this environment is built on top of. A base environment defines the environment version and a list of dependencies for serverless compute. The value can be a file path to a custom `env.yaml` file (e.g., `/Workspace/path/to/env.yaml`). Support for a Databricks-provided base environment ID (e.g., `workspace-base-environments/databricks_ai_v4`) and workspace base environment ID (e.g., `workspace-base-environments/dbe_b849b66e-b31a-4cb5-b161-1f2b10877fb7`) is in Beta. Either `environment_version` or `base_environment` can be provided.  For more information, see
-  
-- - `client`
-  - String
-  - This field is deprecated
-  
-- - `dependencies`
-  - Sequence
-  - List of pip dependencies, as supported by the version of pip in this environment.
-  
-- - `environment_version`
-  - String
-  - Either `environment_version` or `base_environment` needs to be provided. Environment version used by the environment. Each version comes with a specific Python version and a set of Python packages. The version is a string, consisting of an integer.
-  
-- - `java_dependencies`
-  - Sequence
-  - 
-  
-:::
-  
-  
-### jobs._name_.git_source
-  
-**`Type: Map`**
-  
-An optional specification for a remote Git repository containing the source code used by tasks. Version-controlled source code is supported by notebook, dbt, Python script, and SQL File tasks.
-
-If `git_source` is set, these tasks retrieve the file from the remote repository by default. However, this behavior can be overridden by setting `source` to `WORKSPACE` on the task.
-
-Note: dbt and SQL File tasks support only version-controlled sources. If dbt or SQL File tasks are used, `git_source` must be defined on the job.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `git_branch`
-  - String
-  - Name of the branch to be checked out and used by this job. This field cannot be specified in conjunction with git_tag or git_commit.
-  
-- - `git_commit`
-  - String
-  - Commit to be checked out and used by this job. This field cannot be specified in conjunction with git_branch or git_tag.
-  
-- - `git_provider`
-  - String
-  - Unique identifier of the service used to host the Git repository. The value is case insensitive.
-  
-- - `git_snapshot`
-  - Map
-  - Read-only state of the remote repository at the time the job was run. This field is only included on job runs. See [\_](#jobsnamegit_sourcegit_snapshot).
-  
-- - `git_tag`
-  - String
-  - Name of the tag to be checked out and used by this job. This field cannot be specified in conjunction with git_branch or git_commit.
-  
-- - `git_url`
-  - String
-  - URL of the repository to be cloned by this job.
-  
-- - `sparse_checkout`
-  - Map
-  - See [\_](#jobsnamegit_sourcesparse_checkout).
-  
-:::
-  
-  
-### jobs._name_.git_source.git_snapshot
-  
-**`Type: Map`**
-  
-Read-only state of the remote repository at the time the job was run. This field is only included on job runs.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `used_commit`
-  - String
-  - Commit that was used to execute the run. If git_branch was specified, this points to the HEAD of the branch at the time of the run; if git_tag was specified, this points to the commit the tag points to.
-  
-:::
-  
-  
-### jobs._name_.git_source.sparse_checkout
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `patterns`
-  - Sequence
-  - List of patterns to include for sparse checkout.
-  
-:::
-  
-  
-### jobs._name_.health
-  
-**`Type: Map`**
-  
-An optional set of health rules that can be defined for this job.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `rules`
-  - Sequence
-  - See [\_](#jobsnamehealthrules).
-  
-:::
-  
-  
-### jobs._name_.health.rules
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `metric`
-  - String
-  - Specifies the health metric that is being evaluated for a particular health rule.  * `RUN_DURATION_SECONDS`: Expected total time for a run in seconds. * `STREAMING_BACKLOG_BYTES`: An estimate of the maximum bytes of data waiting to be consumed across all streams. This metric is in Public Preview. * `STREAMING_BACKLOG_RECORDS`: An estimate of the maximum offset lag across all streams. This metric is in Public Preview. * `STREAMING_BACKLOG_SECONDS`: An estimate of the maximum consumer delay across all streams. This metric is in Public Preview. * `STREAMING_BACKLOG_FILES`: An estimate of the maximum number of outstanding files across all streams. This metric is in Public Preview.
-  
-- - `op`
-  - String
-  - Specifies the operator used to compare the health metric value with the specified threshold.
-  
-- - `value`
-  - Integer
-  - Specifies the threshold value that the health metric should obey to satisfy the health rule.
-  
-:::
-  
-  
-### jobs._name_.job_clusters
-  
-**`Type: Sequence`**
-  
-A list of job cluster specifications that can be shared and reused by tasks of this job. Libraries cannot be declared in a shared job cluster. You must declare dependent libraries in task settings.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `job_cluster_key`
-  - String
-  - A unique name for the job cluster. This field is required and must be unique within the job. `JobTaskSettings` may refer to this field to determine which cluster to launch for the task execution.
-  
-- - `new_cluster`
-  - Map
-  - If new_cluster, a description of a cluster that is created for each task. See [\_](#jobsnamejob_clustersnew_cluster).
-  
-:::
-  
-  
-### jobs._name_.job_clusters.new_cluster
-  
-**`Type: Map`**
-  
-If new_cluster, a description of a cluster that is created for each task.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `apply_policy_default_values`
-  - Boolean
-  - When set to true, fixed and default values from the policy will be used for fields that are omitted. When set to false, only fixed values from the policy will be applied.
-  
-- - `autoscale`
-  - Map
-  - Parameters needed in order to automatically scale clusters up and down based on load. Note: autoscaling works best with DB runtime versions 3.0 or later. See [\_](#jobsnamejob_clustersnew_clusterautoscale).
-  
-- - `autotermination_minutes`
-  - Integer
-  - Automatically terminates the cluster after it is inactive for this time in minutes. If not set, this cluster will not be automatically terminated. If specified, the threshold must be between 10 and 10000 minutes. Users can also set this value to 0 to explicitly disable automatic termination.
-  
-- - `aws_attributes`
-  - Map
-  - Attributes related to clusters running on Amazon Web Services. If not specified at cluster creation, a set of default values will be used. See [\_](#jobsnamejob_clustersnew_clusteraws_attributes).
-  
-- - `azure_attributes`
-  - Map
-  - Attributes related to clusters running on Microsoft Azure. If not specified at cluster creation, a set of default values will be used. See [\_](#jobsnamejob_clustersnew_clusterazure_attributes).
-  
-- - `cluster_log_conf`
-  - Map
-  - The configuration for delivering spark logs to a long-term storage destination. Three kinds of destinations (DBFS, S3 and Unity Catalog volumes) are supported. Only one destination can be specified for one cluster. If the conf is given, the logs will be delivered to the destination every `5 mins`. The destination of driver logs is `$destination/$clusterId/driver`, while the destination of executor logs is `$destination/$clusterId/executor`. See [\_](#jobsnamejob_clustersnew_clustercluster_log_conf).
-  
-- - `cluster_name`
-  - String
-  - Cluster name requested by the user. This doesn't have to be unique. If not specified at creation, the cluster name will be an empty string. For job clusters, the cluster name is automatically set based on the job and job run IDs.
-  
-- - `custom_tags`
-  - Map
-  - Additional tags for cluster resources. Databricks will tag all cluster resources (e.g., AWS instances and EBS volumes) with these tags in addition to `default_tags`. Notes:  - Currently, Databricks allows at most 45 custom tags  - Clusters can only reuse cloud resources if the resources' tags are a subset of the cluster tags
-  
-- - `data_security_mode`
-  - String
-  - Data security mode decides what data governance model to use when accessing data from a cluster.  The following modes can only be used when `kind = CLASSIC_PREVIEW`. * `DATA_SECURITY_MODE_AUTO`: Databricks will choose the most appropriate access mode depending on your compute configuration. * `DATA_SECURITY_MODE_STANDARD`: Alias for `USER_ISOLATION`. * `DATA_SECURITY_MODE_DEDICATED`: Alias for `SINGLE_USER`.  The following modes can be used regardless of `kind`. * `NONE`: No security isolation for multiple users sharing the cluster. Data governance features are not available in this mode. * `SINGLE_USER`: A secure cluster that can only be exclusively used by a single user specified in `single_user_name`. Most programming languages, cluster features and data governance features are available in this mode. * `USER_ISOLATION`: A secure cluster that can be shared by multiple users. Cluster users are fully isolated so that they cannot see each other's data and credentials. Most data governance features are supported in this mode. But programming languages and cluster features might be limited.  The following modes are deprecated starting with Databricks Runtime 15.0 and will be removed for future Databricks Runtime versions:  * `LEGACY_TABLE_ACL`: This mode is for users migrating from legacy Table ACL clusters. * `LEGACY_PASSTHROUGH`: This mode is for users migrating from legacy Passthrough on high concurrency clusters. * `LEGACY_SINGLE_USER`: This mode is for users migrating from legacy Passthrough on standard clusters. * `LEGACY_SINGLE_USER_STANDARD`: This mode provides a way that doesn’t have UC nor passthrough enabled.
-  
-- - `docker_image`
-  - Map
-  - See [\_](#jobsnamejob_clustersnew_clusterdocker_image).
-  
-- - `driver_instance_pool_id`
-  - String
-  - The optional ID of the instance pool for the driver of the cluster belongs. The pool cluster uses the instance pool with id (instance_pool_id) if the driver pool is not assigned.
-  
-- - `driver_node_type_flexibility`
-  - Map
-  - Flexible node type configuration for the driver node. See [\_](#jobsnamejob_clustersnew_clusterdriver_node_type_flexibility).
-  
-- - `driver_node_type_id`
-  - String
-  - The node type of the Spark driver. Note that this field is optional; if unset, the driver node type will be set as the same value as `node_type_id` defined above.  This field, along with node_type_id, should not be set if virtual_cluster_size is set. If both driver_node_type_id, node_type_id, and virtual_cluster_size are specified, driver_node_type_id and node_type_id take precedence.
-  
-- - `enable_elastic_disk`
-  - Boolean
-  - Autoscaling Local Storage: when enabled, this cluster will dynamically acquire additional disk space when its Spark workers are running low on disk space.
-  
-- - `enable_local_disk_encryption`
-  - Boolean
-  - Whether to enable LUKS on cluster VMs' local disks
-  
-- - `gcp_attributes`
-  - Map
-  - Attributes related to clusters running on Google Cloud Platform. If not specified at cluster creation, a set of default values will be used. See [\_](#jobsnamejob_clustersnew_clustergcp_attributes).
-  
-- - `init_scripts`
-  - Sequence
-  - The configuration for storing init scripts. Any number of destinations can be specified. The scripts are executed sequentially in the order provided. If `cluster_log_conf` is specified, init script logs are sent to `<destination>/<cluster-ID>/init_scripts`. See [\_](#jobsnamejob_clustersnew_clusterinit_scripts).
-  
-- - `instance_pool_id`
-  - String
-  - The optional ID of the instance pool to which the cluster belongs.
-  
-- - `is_single_node`
-  - Boolean
-  - This field can only be used when `kind = CLASSIC_PREVIEW`.  When set to true, Databricks will automatically set single node related `custom_tags`, `spark_conf`, and `num_workers`
-  
-- - `kind`
-  - String
-  - 
-  
-- - `node_type_id`
-  - String
-  - This field encodes, through a single value, the resources available to each of the Spark nodes in this cluster. For example, the Spark nodes can be provisioned and optimized for memory or compute intensive workloads. A list of available node types can be retrieved by using the :method:clusters/listNodeTypes API call.
-  
-- - `num_workers`
-  - Integer
-  - Number of worker nodes that this cluster should have. A cluster has one Spark Driver and `num_workers` Executors for a total of `num_workers` + 1 Spark nodes.  Note: When reading the properties of a cluster, this field reflects the desired number of workers rather than the actual current number of workers. For instance, if a cluster is resized from 5 to 10 workers, this field will immediately be updated to reflect the target size of 10 workers, whereas the workers listed in `spark_info` will gradually increase from 5 to 10 as the new nodes are provisioned.
-  
-- - `policy_id`
-  - String
-  - The ID of the cluster policy used to create the cluster if applicable.
-  
-- - `remote_disk_throughput`
-  - Integer
-  - If set, what the configurable throughput (in Mb/s) for the remote disk is. Currently only supported for GCP HYPERDISK_BALANCED disks.
-  
-- - `runtime_engine`
-  - String
-  - 
-  
-- - `single_user_name`
-  - String
-  - Single user name if data_security_mode is `SINGLE_USER`
-  
-- - `spark_conf`
-  - Map
-  - An object containing a set of optional, user-specified Spark configuration key-value pairs. Users can also pass in a string of extra JVM options to the driver and the executors via `spark.driver.extraJavaOptions` and `spark.executor.extraJavaOptions` respectively.
-  
-- - `spark_env_vars`
-  - Map
-  - An object containing a set of optional, user-specified environment variable key-value pairs. Please note that key-value pair of the form (X,Y) will be exported as is (i.e., `export X='Y'`) while launching the driver and workers.  In order to specify an additional set of `SPARK_DAEMON_JAVA_OPTS`, we recommend appending them to `$SPARK_DAEMON_JAVA_OPTS` as shown in the example below. This ensures that all default databricks managed environmental variables are included as well.  Example Spark environment variables: `{"SPARK_WORKER_MEMORY": "28000m", "SPARK_LOCAL_DIRS": "/local_disk0"}` or `{"SPARK_DAEMON_JAVA_OPTS": "$SPARK_DAEMON_JAVA_OPTS -Dspark.shuffle.service.enabled=true"}`
-  
-- - `spark_version`
-  - String
-  - The Spark version of the cluster, e.g. `3.3.x-scala2.11`. A list of available Spark versions can be retrieved by using the :method:clusters/sparkVersions API call.
-  
-- - `ssh_public_keys`
-  - Sequence
-  - SSH public key contents that will be added to each Spark node in this cluster. The corresponding private keys can be used to login with the user name `ubuntu` on port `2200`. Up to 10 keys can be specified.
-  
-- - `total_initial_remote_disk_size`
-  - Integer
-  - If set, what the total initial volume size (in GB) of the remote disks should be. Currently only supported for GCP HYPERDISK_BALANCED disks.
-  
-- - `use_ml_runtime`
-  - Boolean
-  - This field can only be used when `kind = CLASSIC_PREVIEW`.  `effective_spark_version` is determined by `spark_version` (DBR release), this field `use_ml_runtime`, and whether `node_type_id` is gpu node or not.
-  
-- - `worker_node_type_flexibility`
-  - Map
-  - Flexible node type configuration for worker nodes. See [\_](#jobsnamejob_clustersnew_clusterworker_node_type_flexibility).
-  
-- - `workload_type`
-  - Map
-  - Cluster Attributes showing for clusters workload types. See [\_](#jobsnamejob_clustersnew_clusterworkload_type).
-  
-:::
-  
-  
-### jobs._name_.job_clusters.new_cluster.autoscale
-  
-**`Type: Map`**
-  
-Parameters needed in order to automatically scale clusters up and down based on load.
-Note: autoscaling works best with DB runtime versions 3.0 or later.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `max_workers`
-  - Integer
-  - The maximum number of workers to which the cluster can scale up when overloaded. Note that `max_workers` must be strictly greater than `min_workers`.
-  
-- - `min_workers`
-  - Integer
-  - The minimum number of workers to which the cluster can scale down when underutilized. It is also the initial number of workers the cluster will have after creation.
-  
-:::
-  
-  
-### jobs._name_.job_clusters.new_cluster.aws_attributes
-  
-**`Type: Map`**
-  
-Attributes related to clusters running on Amazon Web Services.
-If not specified at cluster creation, a set of default values will be used.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `availability`
-  - String
-  - Availability type used for all subsequent nodes past the `first_on_demand` ones.  Note: If `first_on_demand` is zero, this availability type will be used for the entire cluster.
-  
-- - `ebs_volume_count`
-  - Integer
-  - The number of volumes launched for each instance. Users can choose up to 10 volumes. This feature is only enabled for supported node types. Legacy node types cannot specify custom EBS volumes. For node types with no instance store, at least one EBS volume needs to be specified; otherwise, cluster creation will fail.  These EBS volumes will be mounted at `/ebs0`, `/ebs1`, and etc. Instance store volumes will be mounted at `/local_disk0`, `/local_disk1`, and etc.  If EBS volumes are attached, Databricks will configure Spark to use only the EBS volumes for scratch storage because heterogenously sized scratch devices can lead to inefficient disk utilization. If no EBS volumes are attached, Databricks will configure Spark to use instance store volumes.  Please note that if EBS volumes are specified, then the Spark configuration `spark.local.dir` will be overridden.
-  
-- - `ebs_volume_iops`
-  - Integer
-  - If using gp3 volumes, what IOPS to use for the disk. If this is not set, the maximum performance of a gp2 volume with the same volume size will be used.
-  
-- - `ebs_volume_size`
-  - Integer
-  - The size of each EBS volume (in GiB) launched for each instance. For general purpose SSD, this value must be within the range 100 - 4096. For throughput optimized HDD, this value must be within the range 500 - 4096.
-  
-- - `ebs_volume_throughput`
-  - Integer
-  - If using gp3 volumes, what throughput to use for the disk. If this is not set, the maximum performance of a gp2 volume with the same volume size will be used.
-  
-- - `ebs_volume_type`
-  - String
-  - All EBS volume types that Databricks supports. See https://aws.amazon.com/ebs/details/ for details.
-  
-- - `first_on_demand`
-  - Integer
-  - The first `first_on_demand` nodes of the cluster will be placed on on-demand instances. If this value is greater than 0, the cluster driver node in particular will be placed on an on-demand instance. If this value is greater than or equal to the current cluster size, all nodes will be placed on on-demand instances. If this value is less than the current cluster size, `first_on_demand` nodes will be placed on on-demand instances and the remainder will be placed on `availability` instances. Note that this value does not affect cluster size and cannot currently be mutated over the lifetime of a cluster.
-  
-- - `instance_profile_arn`
-  - String
-  - Nodes for this cluster will only be placed on AWS instances with this instance profile. If ommitted, nodes will be placed on instances without an IAM instance profile. The instance profile must have previously been added to the Databricks environment by an account administrator.  This feature may only be available to certain customer plans.
-  
-- - `spot_bid_price_percent`
-  - Integer
-  - The bid price for AWS spot instances, as a percentage of the corresponding instance type's on-demand price. For example, if this field is set to 50, and the cluster needs a new `r3.xlarge` spot instance, then the bid price is half of the price of on-demand `r3.xlarge` instances. Similarly, if this field is set to 200, the bid price is twice the price of on-demand `r3.xlarge` instances. If not specified, the default value is 100. When spot instances are requested for this cluster, only spot instances whose bid price percentage matches this field will be considered. Note that, for safety, we enforce this field to be no more than 10000.
-  
-- - `zone_id`
-  - String
-  - Identifier for the availability zone/datacenter in which the cluster resides. This string will be of a form like "us-west-2a". The provided availability zone must be in the same region as the Databricks deployment. For example, "us-west-2a" is not a valid zone id if the Databricks deployment resides in the "us-east-1" region. This is an optional field at cluster creation, and if not specified, the zone "auto" will be used. If the zone specified is "auto", will try to place cluster in a zone with high availability, and will retry placement in a different AZ if there is not enough capacity.  The list of available zones as well as the default value can be found by using the `List Zones` method.
-  
-:::
-  
-  
-### jobs._name_.job_clusters.new_cluster.azure_attributes
-  
-**`Type: Map`**
-  
-Attributes related to clusters running on Microsoft Azure.
-If not specified at cluster creation, a set of default values will be used.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `availability`
-  - String
-  - Availability type used for all subsequent nodes past the `first_on_demand` ones. Note: If `first_on_demand` is zero, this availability type will be used for the entire cluster.
-  
-- - `first_on_demand`
-  - Integer
-  - The first `first_on_demand` nodes of the cluster will be placed on on-demand instances. This value should be greater than 0, to make sure the cluster driver node is placed on an on-demand instance. If this value is greater than or equal to the current cluster size, all nodes will be placed on on-demand instances. If this value is less than the current cluster size, `first_on_demand` nodes will be placed on on-demand instances and the remainder will be placed on `availability` instances. Note that this value does not affect cluster size and cannot currently be mutated over the lifetime of a cluster.
-  
-- - `log_analytics_info`
-  - Map
-  - Defines values necessary to configure and run Azure Log Analytics agent. See [\_](#jobsnamejob_clustersnew_clusterazure_attributeslog_analytics_info).
-  
-- - `spot_bid_max_price`
-  - Any
-  - The max bid price to be used for Azure spot instances. The Max price for the bid cannot be higher than the on-demand price of the instance. If not specified, the default value is -1, which specifies that the instance cannot be evicted on the basis of price, and only on the basis of availability. Further, the value should > 0 or -1.
-  
-:::
-  
-  
-### jobs._name_.job_clusters.new_cluster.azure_attributes.log_analytics_info
-  
-**`Type: Map`**
-  
-Defines values necessary to configure and run Azure Log Analytics agent
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `log_analytics_primary_key`
-  - String
-  - The primary key for the Azure Log Analytics agent configuration
-  
-- - `log_analytics_workspace_id`
-  - String
-  - The workspace ID for the Azure Log Analytics agent configuration
-  
-:::
-  
-  
-### jobs._name_.job_clusters.new_cluster.cluster_log_conf
-  
-**`Type: Map`**
-  
-The configuration for delivering spark logs to a long-term storage destination.
-Three kinds of destinations (DBFS, S3 and Unity Catalog volumes) are supported. Only one destination can be specified
-for one cluster. If the conf is given, the logs will be delivered to the destination every
-`5 mins`. The destination of driver logs is `$destination/$clusterId/driver`, while
-the destination of executor logs is `$destination/$clusterId/executor`.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `dbfs`
-  - Map
-  - destination needs to be provided. e.g. `{ "dbfs" : { "destination" : "dbfs:/home/cluster_log" } }`. See [\_](#jobsnamejob_clustersnew_clustercluster_log_confdbfs).
-  
-- - `s3`
-  - Map
-  - destination and either the region or endpoint need to be provided. e.g. `{ "s3": { "destination" : "s3://cluster_log_bucket/prefix", "region" : "us-west-2" } }` Cluster iam role is used to access s3, please make sure the cluster iam role in `instance_profile_arn` has permission to write data to the s3 destination. See [\_](#jobsnamejob_clustersnew_clustercluster_log_confs3).
-  
-- - `volumes`
-  - Map
-  - destination needs to be provided, e.g. `{ "volumes": { "destination": "/Volumes/catalog/schema/volume/cluster_log" } }`. See [\_](#jobsnamejob_clustersnew_clustercluster_log_confvolumes).
-  
-:::
-  
-  
-### jobs._name_.job_clusters.new_cluster.cluster_log_conf.dbfs
-  
-**`Type: Map`**
-  
-destination needs to be provided. e.g.
-`{ "dbfs" : { "destination" : "dbfs:/home/cluster_log" } }`
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `destination`
-  - String
-  - dbfs destination, e.g. `dbfs:/my/path`
-  
-:::
-  
-  
-### jobs._name_.job_clusters.new_cluster.cluster_log_conf.s3
-  
-**`Type: Map`**
-  
-destination and either the region or endpoint need to be provided. e.g.
-`{ "s3": { "destination" : "s3://cluster_log_bucket/prefix", "region" : "us-west-2" } }`
-Cluster iam role is used to access s3, please make sure the cluster iam role in
-`instance_profile_arn` has permission to write data to the s3 destination.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `canned_acl`
-  - String
-  - (Optional) Set canned access control list for the logs, e.g. `bucket-owner-full-control`. If `canned_cal` is set, please make sure the cluster iam role has `s3:PutObjectAcl` permission on the destination bucket and prefix. The full list of possible canned acl can be found at http://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl. Please also note that by default only the object owner gets full controls. If you are using cross account role for writing data, you may want to set `bucket-owner-full-control` to make bucket owner able to read the logs.
-  
-- - `destination`
-  - String
-  - S3 destination, e.g. `s3://my-bucket/some-prefix` Note that logs will be delivered using cluster iam role, please make sure you set cluster iam role and the role has write access to the destination. Please also note that you cannot use AWS keys to deliver logs.
-  
-- - `enable_encryption`
-  - Boolean
-  - (Optional) Flag to enable server side encryption, `false` by default.
-  
-- - `encryption_type`
-  - String
-  - (Optional) The encryption type, it could be `sse-s3` or `sse-kms`. It will be used only when encryption is enabled and the default type is `sse-s3`.
-  
-- - `endpoint`
-  - String
-  - S3 endpoint, e.g. `https://s3-us-west-2.amazonaws.com`. Either region or endpoint needs to be set. If both are set, endpoint will be used.
-  
-- - `kms_key`
-  - String
-  - (Optional) Kms key which will be used if encryption is enabled and encryption type is set to `sse-kms`.
-  
-- - `region`
-  - String
-  - S3 region, e.g. `us-west-2`. Either region or endpoint needs to be set. If both are set, endpoint will be used.
-  
-:::
-  
-  
-### jobs._name_.job_clusters.new_cluster.cluster_log_conf.volumes
-  
-**`Type: Map`**
-  
-destination needs to be provided, e.g.
-`{ "volumes": { "destination": "/Volumes/catalog/schema/volume/cluster_log" } }`
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `destination`
-  - String
-  - UC Volumes destination, e.g. `/Volumes/catalog/schema/vol1/init-scripts/setup-datadog.sh` or `dbfs:/Volumes/catalog/schema/vol1/init-scripts/setup-datadog.sh`
-  
-:::
-  
-  
-### jobs._name_.job_clusters.new_cluster.docker_image
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `basic_auth`
-  - Map
-  - See [\_](#jobsnamejob_clustersnew_clusterdocker_imagebasic_auth).
-  
-- - `url`
-  - String
-  - URL of the docker image.
-  
-:::
-  
-  
-### jobs._name_.job_clusters.new_cluster.docker_image.basic_auth
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `password`
-  - String
-  - Password of the user
-  
-- - `username`
-  - String
-  - Name of the user
-  
-:::
-  
-  
-### jobs._name_.job_clusters.new_cluster.driver_node_type_flexibility
-  
-**`Type: Map`**
-  
-Flexible node type configuration for the driver node.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `alternate_node_type_ids`
-  - Sequence
-  - A list of node type IDs to use as fallbacks when the primary node type is unavailable.
-  
-:::
-  
-  
-### jobs._name_.job_clusters.new_cluster.gcp_attributes
-  
-**`Type: Map`**
-  
-Attributes related to clusters running on Google Cloud Platform.
-If not specified at cluster creation, a set of default values will be used.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `availability`
-  - String
-  - This field determines whether the instance pool will contain preemptible VMs, on-demand VMs, or preemptible VMs with a fallback to on-demand VMs if the former is unavailable.
-  
-- - `boot_disk_size`
-  - Integer
-  - Boot disk size in GB
-  
-- - `first_on_demand`
-  - Integer
-  - The first `first_on_demand` nodes of the cluster will be placed on on-demand instances. This value should be greater than 0, to make sure the cluster driver node is placed on an on-demand instance. If this value is greater than or equal to the current cluster size, all nodes will be placed on on-demand instances. If this value is less than the current cluster size, `first_on_demand` nodes will be placed on on-demand instances and the remainder will be placed on `availability` instances. Note that this value does not affect cluster size and cannot currently be mutated over the lifetime of a cluster.
-  
-- - `google_service_account`
-  - String
-  - If provided, the cluster will impersonate the google service account when accessing gcloud services (like GCS). The google service account must have previously been added to the Databricks environment by an account administrator.
-  
-- - `local_ssd_count`
-  - Integer
-  - If provided, each node (workers and driver) in the cluster will have this number of local SSDs attached. Each local SSD is 375GB in size. Refer to [GCP documentation](https://cloud.google.com/compute/docs/disks/local-ssd#choose_number_local_ssds) for the supported number of local SSDs for each instance type.
-  
-- - `use_preemptible_executors`
-  - Boolean
-  - This field is deprecated
-  
-- - `zone_id`
-  - String
-  - Identifier for the availability zone in which the cluster resides. This can be one of the following: - "HA" => High availability, spread nodes across availability zones for a Databricks deployment region [default]. - "AUTO" => Databricks picks an availability zone to schedule the cluster on. - A GCP availability zone => Pick One of the available zones for (machine type + region) from https://cloud.google.com/compute/docs/regions-zones.
-  
-:::
-  
-  
-### jobs._name_.job_clusters.new_cluster.init_scripts
-  
-**`Type: Sequence`**
-  
-The configuration for storing init scripts. Any number of destinations can be specified.
-The scripts are executed sequentially in the order provided.
-If `cluster_log_conf` is specified, init script logs are sent to `<destination>/<cluster-ID>/init_scripts`.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `abfss`
-  - Map
-  - Contains the Azure Data Lake Storage destination path. See [\_](#jobsnamejob_clustersnew_clusterinit_scriptsabfss).
-  
-- - `dbfs`
-  - Map
-  - This field is deprecated
-  
-- - `file`
-  - Map
-  - destination needs to be provided, e.g. `{ "file": { "destination": "file:/my/local/file.sh" } }`. See [\_](#jobsnamejob_clustersnew_clusterinit_scriptsfile).
-  
-- - `gcs`
-  - Map
-  - destination needs to be provided, e.g. `{ "gcs": { "destination": "gs://my-bucket/file.sh" } }`. See [\_](#jobsnamejob_clustersnew_clusterinit_scriptsgcs).
-  
-- - `s3`
-  - Map
-  - destination and either the region or endpoint need to be provided. e.g. `{ \"s3\": { \"destination\": \"s3://cluster_log_bucket/prefix\", \"region\": \"us-west-2\" } }` Cluster iam role is used to access s3, please make sure the cluster iam role in `instance_profile_arn` has permission to write data to the s3 destination. See [\_](#jobsnamejob_clustersnew_clusterinit_scriptss3).
-  
-- - `volumes`
-  - Map
-  - destination needs to be provided. e.g. `{ \"volumes\" : { \"destination\" : \"/Volumes/my-init.sh\" } }`. See [\_](#jobsnamejob_clustersnew_clusterinit_scriptsvolumes).
-  
-- - `workspace`
-  - Map
-  - destination needs to be provided, e.g. `{ "workspace": { "destination": "/cluster-init-scripts/setup-datadog.sh" } }`. See [\_](#jobsnamejob_clustersnew_clusterinit_scriptsworkspace).
-  
-:::
-  
-  
-### jobs._name_.job_clusters.new_cluster.init_scripts.abfss
-  
-**`Type: Map`**
-  
-Contains the Azure Data Lake Storage destination path
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `destination`
-  - String
-  - abfss destination, e.g. `abfss://<container-name>@<storage-account-name>.dfs.core.windows.net/<directory-name>`.
-  
-:::
-  
-  
-### jobs._name_.job_clusters.new_cluster.init_scripts.file
-  
-**`Type: Map`**
-  
-destination needs to be provided, e.g.
-`{ "file": { "destination": "file:/my/local/file.sh" } }`
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `destination`
-  - String
-  - local file destination, e.g. `file:/my/local/file.sh`
-  
-:::
-  
-  
-### jobs._name_.job_clusters.new_cluster.init_scripts.gcs
-  
-**`Type: Map`**
-  
-destination needs to be provided, e.g.
-`{ "gcs": { "destination": "gs://my-bucket/file.sh" } }`
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `destination`
-  - String
-  - GCS destination/URI, e.g. `gs://my-bucket/some-prefix`
-  
-:::
-  
-  
-### jobs._name_.job_clusters.new_cluster.init_scripts.s3
-  
-**`Type: Map`**
-  
-destination and either the region or endpoint need to be provided. e.g.
-`{ \"s3\": { \"destination\": \"s3://cluster_log_bucket/prefix\", \"region\": \"us-west-2\" } }`
-Cluster iam role is used to access s3, please make sure the cluster iam role in
-`instance_profile_arn` has permission to write data to the s3 destination.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `canned_acl`
-  - String
-  - (Optional) Set canned access control list for the logs, e.g. `bucket-owner-full-control`. If `canned_cal` is set, please make sure the cluster iam role has `s3:PutObjectAcl` permission on the destination bucket and prefix. The full list of possible canned acl can be found at http://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl. Please also note that by default only the object owner gets full controls. If you are using cross account role for writing data, you may want to set `bucket-owner-full-control` to make bucket owner able to read the logs.
-  
-- - `destination`
-  - String
-  - S3 destination, e.g. `s3://my-bucket/some-prefix` Note that logs will be delivered using cluster iam role, please make sure you set cluster iam role and the role has write access to the destination. Please also note that you cannot use AWS keys to deliver logs.
-  
-- - `enable_encryption`
-  - Boolean
-  - (Optional) Flag to enable server side encryption, `false` by default.
-  
-- - `encryption_type`
-  - String
-  - (Optional) The encryption type, it could be `sse-s3` or `sse-kms`. It will be used only when encryption is enabled and the default type is `sse-s3`.
-  
-- - `endpoint`
-  - String
-  - S3 endpoint, e.g. `https://s3-us-west-2.amazonaws.com`. Either region or endpoint needs to be set. If both are set, endpoint will be used.
-  
-- - `kms_key`
-  - String
-  - (Optional) Kms key which will be used if encryption is enabled and encryption type is set to `sse-kms`.
-  
-- - `region`
-  - String
-  - S3 region, e.g. `us-west-2`. Either region or endpoint needs to be set. If both are set, endpoint will be used.
-  
-:::
-  
-  
-### jobs._name_.job_clusters.new_cluster.init_scripts.volumes
-  
-**`Type: Map`**
-  
-destination needs to be provided. e.g.
-`{ \"volumes\" : { \"destination\" : \"/Volumes/my-init.sh\" } }`
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `destination`
-  - String
-  - UC Volumes destination, e.g. `/Volumes/catalog/schema/vol1/init-scripts/setup-datadog.sh` or `dbfs:/Volumes/catalog/schema/vol1/init-scripts/setup-datadog.sh`
-  
-:::
-  
-  
-### jobs._name_.job_clusters.new_cluster.init_scripts.workspace
-  
-**`Type: Map`**
-  
-destination needs to be provided, e.g.
-`{ "workspace": { "destination": "/cluster-init-scripts/setup-datadog.sh" } }`
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `destination`
-  - String
-  - wsfs destination, e.g. `workspace:/cluster-init-scripts/setup-datadog.sh`
-  
-:::
-  
-  
-### jobs._name_.job_clusters.new_cluster.worker_node_type_flexibility
-  
-**`Type: Map`**
-  
-Flexible node type configuration for worker nodes.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `alternate_node_type_ids`
-  - Sequence
-  - A list of node type IDs to use as fallbacks when the primary node type is unavailable.
-  
-:::
-  
-  
-### jobs._name_.job_clusters.new_cluster.workload_type
-  
-**`Type: Map`**
-  
-Cluster Attributes showing for clusters workload types.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `clients`
-  - Map
-  - defined what type of clients can use the cluster. E.g. Notebooks, Jobs. See [\_](#jobsnamejob_clustersnew_clusterworkload_typeclients).
-  
-:::
-  
-  
-### jobs._name_.job_clusters.new_cluster.workload_type.clients
-  
-**`Type: Map`**
-  
-defined what type of clients can use the cluster. E.g. Notebooks, Jobs
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `jobs`
-  - Boolean
-  - With jobs set, the cluster can be used for jobs
-  
-- - `notebooks`
-  - Boolean
-  - With notebooks set, this cluster can be used for notebooks
-  
-:::
-  
-  
-### jobs._name_.lifecycle
-  
-**`Type: Map`**
-  
-Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-### jobs._name_.notification_settings
-  
-**`Type: Map`**
-  
-Optional notification settings that are used when sending notifications to each of the `email_notifications` and `webhook_notifications` for this job.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `no_alert_for_canceled_runs`
-  - Boolean
-  - If true, do not send notifications to recipients specified in `on_failure` if the run is canceled.
-  
-- - `no_alert_for_skipped_runs`
-  - Boolean
-  - If true, do not send notifications to recipients specified in `on_failure` if the run is skipped.
-  
-:::
-  
-  
-### jobs._name_.parameters
-  
-**`Type: Sequence`**
-  
-Job-level parameter definitions
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `default`
-  - String
-  - Default value of the parameter.
-  
-- - `name`
-  - String
-  - The name of the defined parameter. May only contain alphanumeric characters, `_`, `-`, and `.`
-  
-:::
-  
-  
-### jobs._name_.permissions
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `group_name`
-  - String
-  - 
-  
-- - `level`
-  - String
-  - Permission level
-  
-- - `service_principal_name`
-  - String
-  - 
-  
-- - `user_name`
-  - String
-  - 
-  
-:::
-  
-  
-### jobs._name_.queue
-  
-**`Type: Map`**
-  
-The queue settings of the job.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `enabled`
-  - Boolean
-  - If true, enable queueing for the job. This is a required field.
-  
-:::
-  
-  
-### jobs._name_.run_as
-  
-**`Type: Map`**
-  
-Write-only setting. Specifies the user or service principal that the job runs as. If not specified, the job runs as the user who created the job.
-
-Either `user_name` or `service_principal_name` should be specified. If not, an error is thrown.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `service_principal_name`
-  - String
-  - The application ID of an active service principal. Setting this field requires the `servicePrincipal/user` role.
-  
-- - `user_name`
-  - String
-  - The email of an active workspace user. Non-admin users can only set this field to their own email.
-  
-:::
-  
-  
-### jobs._name_.schedule
-  
-**`Type: Map`**
-  
-An optional periodic schedule for this job. The default behavior is that the job only runs when triggered by clicking “Run Now” in the Jobs UI or sending an API request to `runNow`.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `pause_status`
-  - String
-  - Indicate whether this schedule is paused or not.
-  
-- - `quartz_cron_expression`
-  - String
-  - A Cron expression using Quartz syntax that describes the schedule for a job. See [Cron Trigger](http://www.quartz-scheduler.org/documentation/quartz-2.3.0/tutorials/crontrigger.html) for details. This field is required.
-  
-- - `timezone_id`
-  - String
-  - A Java timezone ID. The schedule for a job is resolved with respect to this timezone. See [Java TimeZone](https://docs.oracle.com/javase/7/docs/api/java/util/TimeZone.html) for details. This field is required.
-  
-:::
-  
-  
-### jobs._name_.tasks
-  
-**`Type: Sequence`**
-  
-A list of task specifications to be executed by this job.
-It supports up to 1000 elements in write endpoints (:method:jobs/create, :method:jobs/reset, :method:jobs/update, :method:jobs/submit).
-Read endpoints return only 100 tasks. If more than 100 tasks are available, you can paginate through them using :method:jobs/get. Use the `next_page_token` field at the object root to determine if more results are available.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `alert_task`
-  - Map
-  - The task evaluates a Databricks alert and sends notifications to subscribers when the `alert_task` field is present. See [\_](#jobsnametasksalert_task).
-  
-- - `clean_rooms_notebook_task`
-  - Map
-  - The task runs a [clean rooms](https://docs.databricks.com/clean-rooms/index.html) notebook when the `clean_rooms_notebook_task` field is present. See [\_](#jobsnametasksclean_rooms_notebook_task).
-  
-- - `compute`
-  - Map
-  - Task level compute configuration. See [\_](#jobsnametaskscompute).
-  
-- - `condition_task`
-  - Map
-  - The task evaluates a condition that can be used to control the execution of other tasks when the `condition_task` field is present. The condition task does not require a cluster to execute and does not support retries or notifications. See [\_](#jobsnametaskscondition_task).
-  
-- - `dashboard_task`
-  - Map
-  - The task refreshes a dashboard and sends a snapshot to subscribers. See [\_](#jobsnametasksdashboard_task).
-  
-- - `dbt_task`
-  - Map
-  - The task runs one or more dbt commands when the `dbt_task` field is present. The dbt task requires both Databricks SQL and the ability to use a serverless or a pro SQL warehouse. See [\_](#jobsnametasksdbt_task).
-  
-- - `depends_on`
-  - Sequence
-  - An optional array of objects specifying the dependency graph of the task. All tasks specified in this field must complete before executing this task. The task will run only if the `run_if` condition is true. The key is `task_key`, and the value is the name assigned to the dependent task. See [\_](#jobsnametasksdepends_on).
-  
-- - `description`
-  - String
-  - An optional description for this task.
-  
-- - `disable_auto_optimization`
-  - Boolean
-  - An option to disable auto optimization in serverless
-  
-- - `email_notifications`
-  - Map
-  - An optional set of email addresses that is notified when runs of this task begin or complete as well as when this task is deleted. The default behavior is to not send any emails. See [\_](#jobsnametasksemail_notifications).
-  
-- - `environment_key`
-  - String
-  - The key that references an environment spec in a job. This field is required for Python script, Python wheel and dbt tasks when using serverless compute.
-  
-- - `existing_cluster_id`
-  - String
-  - If existing_cluster_id, the ID of an existing cluster that is used for all runs. When running jobs or tasks on an existing cluster, you may need to manually restart the cluster if it stops responding. We suggest running jobs and tasks on new clusters for greater reliability
-  
-- - `for_each_task`
-  - Map
-  - The task executes a nested task for every input provided when the `for_each_task` field is present. See [\_](#jobsnametasksfor_each_task).
-  
-- - `health`
-  - Map
-  - An optional set of health rules that can be defined for this job. See [\_](#jobsnametaskshealth).
-  
-- - `job_cluster_key`
-  - String
-  - If job_cluster_key, this task is executed reusing the cluster specified in `job.settings.job_clusters`.
-  
-- - `libraries`
-  - Sequence
-  - An optional list of libraries to be installed on the cluster. The default value is an empty list. See [\_](#jobsnametaskslibraries).
-  
-- - `max_retries`
-  - Integer
-  - An optional maximum number of times to retry an unsuccessful run. A run is considered to be unsuccessful if it completes with the `FAILED` result_state or `INTERNAL_ERROR` `life_cycle_state`. The value `-1` means to retry indefinitely and the value `0` means to never retry.
-  
-- - `min_retry_interval_millis`
-  - Integer
-  - An optional minimal interval in milliseconds between the start of the failed run and the subsequent retry run. The default behavior is that unsuccessful runs are immediately retried.
-  
-- - `new_cluster`
-  - Map
-  - If new_cluster, a description of a new cluster that is created for each run. See [\_](#jobsnametasksnew_cluster).
-  
-- - `notebook_task`
-  - Map
-  - The task runs a notebook when the `notebook_task` field is present. See [\_](#jobsnametasksnotebook_task).
-  
-- - `notification_settings`
-  - Map
-  - Optional notification settings that are used when sending notifications to each of the `email_notifications` and `webhook_notifications` for this task. See [\_](#jobsnametasksnotification_settings).
-  
-- - `pipeline_task`
-  - Map
-  - The task triggers a pipeline update when the `pipeline_task` field is present. Only pipelines configured to use triggered more are supported. See [\_](#jobsnametaskspipeline_task).
-  
-- - `power_bi_task`
-  - Map
-  - The task triggers a Power BI semantic model update when the `power_bi_task` field is present. See [\_](#jobsnametaskspower_bi_task).
-  
-- - `python_wheel_task`
-  - Map
-  - The task runs a Python wheel when the `python_wheel_task` field is present. See [\_](#jobsnametaskspython_wheel_task).
-  
-- - `retry_on_timeout`
-  - Boolean
-  - An optional policy to specify whether to retry a job when it times out. The default behavior is to not retry on timeout.
-  
-- - `run_if`
-  - String
-  - An optional value specifying the condition determining whether the task is run once its dependencies have been completed.  * `ALL_SUCCESS`: All dependencies have executed and succeeded * `AT_LEAST_ONE_SUCCESS`: At least one dependency has succeeded * `NONE_FAILED`: None of the dependencies have failed and at least one was executed * `ALL_DONE`: All dependencies have been completed * `AT_LEAST_ONE_FAILED`: At least one dependency failed * `ALL_FAILED`: ALl dependencies have failed
-  
-- - `run_job_task`
-  - Map
-  - The task triggers another job when the `run_job_task` field is present. See [\_](#jobsnametasksrun_job_task).
-  
-- - `spark_jar_task`
-  - Map
-  - The task runs a JAR when the `spark_jar_task` field is present. See [\_](#jobsnametasksspark_jar_task).
-  
-- - `spark_python_task`
-  - Map
-  - The task runs a Python file when the `spark_python_task` field is present. See [\_](#jobsnametasksspark_python_task).
-  
-- - `spark_submit_task`
-  - Map
-  - This field is deprecated
-  
-- - `sql_task`
-  - Map
-  - The task runs a SQL query or file, or it refreshes a SQL alert or a legacy SQL dashboard when the `sql_task` field is present. See [\_](#jobsnametaskssql_task).
-  
-- - `task_key`
-  - String
-  - A unique name for the task. This field is used to refer to this task from other tasks. This field is required and must be unique within its parent job. On Update or Reset, this field is used to reference the tasks to be updated or reset.
-  
-- - `timeout_seconds`
-  - Integer
-  - An optional timeout applied to each run of this job task. A value of `0` means no timeout.
-  
-- - `webhook_notifications`
-  - Map
-  - A collection of system notification IDs to notify when runs of this task begin or complete. The default behavior is to not send any system notifications. See [\_](#jobsnametaskswebhook_notifications).
-  
-:::
-  
-  
-### jobs._name_.tasks.alert_task
-  
-**`Type: Map`**
-  
-The task evaluates a Databricks alert and sends notifications to subscribers
-when the `alert_task` field is present.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `alert_id`
-  - String
-  - The alert_id is the canonical identifier of the alert.
-  
-- - `subscribers`
-  - Sequence
-  - The subscribers receive alert evaluation result notifications after the alert task is completed. The number of subscriptions is limited to 100. See [\_](#jobsnametasksalert_tasksubscribers).
-  
-- - `warehouse_id`
-  - String
-  - The warehouse_id identifies the warehouse settings used by the alert task.
-  
-- - `workspace_path`
-  - String
-  - The workspace_path is the path to the alert file in the workspace. The path: * must start with "/Workspace" * must be a normalized path. User has to select only one of alert_id or workspace_path to identify the alert.
-  
-:::
-  
-  
-### jobs._name_.tasks.alert_task.subscribers
-  
-**`Type: Sequence`**
-  
-The subscribers receive alert evaluation result notifications after the alert task is completed.
-The number of subscriptions is limited to 100.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `destination_id`
-  - String
-  - 
-  
-- - `user_name`
-  - String
-  - A valid workspace email address.
-  
-:::
-  
-  
-### jobs._name_.tasks.clean_rooms_notebook_task
-  
-**`Type: Map`**
-  
-The task runs a [clean rooms](https://docs.databricks.com/clean-rooms/index.html) notebook
-when the `clean_rooms_notebook_task` field is present.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `clean_room_name`
-  - String
-  - The clean room that the notebook belongs to.
-  
-- - `etag`
-  - String
-  - Checksum to validate the freshness of the notebook resource (i.e. the notebook being run is the latest version). It can be fetched by calling the :method:cleanroomassets/get API.
-  
-- - `notebook_base_parameters`
-  - Map
-  - Base parameters to be used for the clean room notebook job.
-  
-- - `notebook_name`
-  - String
-  - Name of the notebook being run.
-  
-:::
-  
-  
-### jobs._name_.tasks.compute
-  
-**`Type: Map`**
-  
-Task level compute configuration.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `hardware_accelerator`
-  - String
-  - Hardware accelerator configuration for Serverless GPU workloads.
-  
-:::
-  
-  
-### jobs._name_.tasks.condition_task
-  
-**`Type: Map`**
-  
-The task evaluates a condition that can be used to control the execution of other tasks when the `condition_task` field is present.
-The condition task does not require a cluster to execute and does not support retries or notifications.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `left`
-  - String
-  - The left operand of the condition task. Can be either a string value or a job state or parameter reference.
-  
-- - `op`
-  - String
-  - * `EQUAL_TO`, `NOT_EQUAL` operators perform string comparison of their operands. This means that `“12.0” == “12”` will evaluate to `false`. * `GREATER_THAN`, `GREATER_THAN_OR_EQUAL`, `LESS_THAN`, `LESS_THAN_OR_EQUAL` operators perform numeric comparison of their operands. `“12.0” >= “12”` will evaluate to `true`, `“10.0” >= “12”` will evaluate to `false`.  The boolean comparison to task values can be implemented with operators `EQUAL_TO`, `NOT_EQUAL`. If a task value was set to a boolean value, it will be serialized to `“true”` or `“false”` for the comparison.
-  
-- - `right`
-  - String
-  - The right operand of the condition task. Can be either a string value or a job state or parameter reference.
-  
-:::
-  
-  
-### jobs._name_.tasks.dashboard_task
-  
-**`Type: Map`**
-  
-The task refreshes a dashboard and sends a snapshot to subscribers.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `dashboard_id`
-  - String
-  - 
-  
-- - `subscription`
-  - Map
-  - See [\_](#jobsnametasksdashboard_tasksubscription).
-  
-- - `warehouse_id`
-  - String
-  - Optional: The warehouse id to execute the dashboard with for the schedule. If not specified, the default warehouse of the dashboard will be used.
-  
-:::
-  
-  
-### jobs._name_.tasks.dashboard_task.subscription
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `custom_subject`
-  - String
-  - Optional: Allows users to specify a custom subject line on the email sent to subscribers.
-  
-- - `paused`
-  - Boolean
-  - When true, the subscription will not send emails.
-  
-- - `subscribers`
-  - Sequence
-  - See [\_](#jobsnametasksdashboard_tasksubscriptionsubscribers).
-  
-:::
-  
-  
-### jobs._name_.tasks.dashboard_task.subscription.subscribers
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `destination_id`
-  - String
-  - 
-  
-- - `user_name`
-  - String
-  - 
-  
-:::
-  
-  
-### jobs._name_.tasks.dbt_task
-  
-**`Type: Map`**
-  
-The task runs one or more dbt commands when the `dbt_task` field is present. The dbt task requires both Databricks SQL and the ability to use a serverless or a pro SQL warehouse.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `catalog`
-  - String
-  - Optional name of the catalog to use. The value is the top level in the 3-level namespace of Unity Catalog (catalog / schema / relation). The catalog value can only be specified if a warehouse_id is specified. Requires dbt-databricks >= 1.1.1.
-  
-- - `commands`
-  - Sequence
-  - A list of dbt commands to execute. All commands must start with `dbt`. This parameter must not be empty. A maximum of up to 10 commands can be provided.
-  
-- - `profiles_directory`
-  - String
-  - Optional (relative) path to the profiles directory. Can only be specified if no warehouse_id is specified. If no warehouse_id is specified and this folder is unset, the root directory is used.
-  
-- - `project_directory`
-  - String
-  - Path to the project directory. Optional for Git sourced tasks, in which case if no value is provided, the root of the Git repository is used.
-  
-- - `schema`
-  - String
-  - Optional schema to write to. This parameter is only used when a warehouse_id is also provided. If not provided, the `default` schema is used.
-  
-- - `source`
-  - String
-  - Optional location type of the project directory. When set to `WORKSPACE`, the project will be retrieved from the local Databricks workspace. When set to `GIT`, the project will be retrieved from a Git repository defined in `git_source`. If the value is empty, the task will use `GIT` if `git_source` is defined and `WORKSPACE` otherwise.  * `WORKSPACE`: Project is located in Databricks workspace. * `GIT`: Project is located in cloud Git provider.
-  
-- - `warehouse_id`
-  - String
-  - ID of the SQL warehouse to connect to. If provided, we automatically generate and provide the profile and connection details to dbt. It can be overridden on a per-command basis by using the `--profiles-dir` command line argument.
-  
-:::
-  
-  
-### jobs._name_.tasks.depends_on
-  
-**`Type: Sequence`**
-  
-An optional array of objects specifying the dependency graph of the task. All tasks specified in this field must complete before executing this task. The task will run only if the `run_if` condition is true.
-The key is `task_key`, and the value is the name assigned to the dependent task.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `outcome`
-  - String
-  - Can only be specified on condition task dependencies. The outcome of the dependent task that must be met for this task to run.
-  
-- - `task_key`
-  - String
-  - The name of the task this task depends on.
-  
-:::
-  
-  
-### jobs._name_.tasks.email_notifications
-  
-**`Type: Map`**
-  
-An optional set of email addresses that is notified when runs of this task begin or complete as well as when this task is deleted. The default behavior is to not send any emails.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `no_alert_for_skipped_runs`
-  - Boolean
-  - This field is deprecated
-  
-- - `on_duration_warning_threshold_exceeded`
-  - Sequence
-  - A list of email addresses to be notified when the duration of a run exceeds the threshold specified for the `RUN_DURATION_SECONDS` metric in the `health` field. If no rule for the `RUN_DURATION_SECONDS` metric is specified in the `health` field for the job, notifications are not sent.
-  
-- - `on_failure`
-  - Sequence
-  - A list of email addresses to be notified when a run unsuccessfully completes. A run is considered to have completed unsuccessfully if it ends with an `INTERNAL_ERROR` `life_cycle_state` or a `FAILED`, or `TIMED_OUT` result_state. If this is not specified on job creation, reset, or update the list is empty, and notifications are not sent.
-  
-- - `on_start`
-  - Sequence
-  - A list of email addresses to be notified when a run begins. If not specified on job creation, reset, or update, the list is empty, and notifications are not sent.
-  
-- - `on_streaming_backlog_exceeded`
-  - Sequence
-  - A list of email addresses to notify when any streaming backlog thresholds are exceeded for any stream. Streaming backlog thresholds can be set in the `health` field using the following metrics: `STREAMING_BACKLOG_BYTES`, `STREAMING_BACKLOG_RECORDS`, `STREAMING_BACKLOG_SECONDS`, or `STREAMING_BACKLOG_FILES`. Alerting is based on the 10-minute average of these metrics. If the issue persists, notifications are resent every 30 minutes.
-  
-- - `on_success`
-  - Sequence
-  - A list of email addresses to be notified when a run successfully completes. A run is considered to have completed successfully if it ends with a `TERMINATED` `life_cycle_state` and a `SUCCESS` result_state. If not specified on job creation, reset, or update, the list is empty, and notifications are not sent.
-  
-:::
-  
-  
-### jobs._name_.tasks.for_each_task
-  
-**`Type: Map`**
-  
-The task executes a nested task for every input provided when the `for_each_task` field is present.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `concurrency`
-  - Integer
-  - An optional maximum allowed number of concurrent runs of the task. Set this value if you want to be able to execute multiple runs of the task concurrently.
-  
-- - `inputs`
-  - String
-  - Array for task to iterate on. This can be a JSON string or a reference to an array parameter.
-  
-- - `task`
-  - Map
-  - Configuration for the task that will be run for each element in the array
-  
-:::
-  
-  
-### jobs._name_.tasks.health
-  
-**`Type: Map`**
-  
-An optional set of health rules that can be defined for this job.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `rules`
-  - Sequence
-  - See [\_](#jobsnametaskshealthrules).
-  
-:::
-  
-  
-### jobs._name_.tasks.health.rules
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `metric`
-  - String
-  - Specifies the health metric that is being evaluated for a particular health rule.  * `RUN_DURATION_SECONDS`: Expected total time for a run in seconds. * `STREAMING_BACKLOG_BYTES`: An estimate of the maximum bytes of data waiting to be consumed across all streams. This metric is in Public Preview. * `STREAMING_BACKLOG_RECORDS`: An estimate of the maximum offset lag across all streams. This metric is in Public Preview. * `STREAMING_BACKLOG_SECONDS`: An estimate of the maximum consumer delay across all streams. This metric is in Public Preview. * `STREAMING_BACKLOG_FILES`: An estimate of the maximum number of outstanding files across all streams. This metric is in Public Preview.
-  
-- - `op`
-  - String
-  - Specifies the operator used to compare the health metric value with the specified threshold.
-  
-- - `value`
-  - Integer
-  - Specifies the threshold value that the health metric should obey to satisfy the health rule.
-  
-:::
-  
-  
-### jobs._name_.tasks.libraries
-  
-**`Type: Sequence`**
-  
-An optional list of libraries to be installed on the cluster.
-The default value is an empty list.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `cran`
-  - Map
-  - Specification of a CRAN library to be installed as part of the library. See [\_](#jobsnametaskslibrariescran).
-  
-- - `egg`
-  - String
-  - This field is deprecated
-  
-- - `jar`
-  - String
-  - URI of the JAR library to install. Supported URIs include Workspace paths, Unity Catalog Volumes paths, and S3 URIs. For example: `{ "jar": "/Workspace/path/to/library.jar" }`, `{ "jar" : "/Volumes/path/to/library.jar" }` or `{ "jar": "s3://my-bucket/library.jar" }`. If S3 is used, please make sure the cluster has read access on the library. You may need to launch the cluster with an IAM role to access the S3 URI.
-  
-- - `maven`
-  - Map
-  - Specification of a maven library to be installed. For example: `{ "coordinates": "org.jsoup:jsoup:1.7.2" }`. See [\_](#jobsnametaskslibrariesmaven).
-  
-- - `pypi`
-  - Map
-  - Specification of a PyPi library to be installed. For example: `{ "package": "simplejson" }`. See [\_](#jobsnametaskslibrariespypi).
-  
-- - `requirements`
-  - String
-  - URI of the requirements.txt file to install. Only Workspace paths and Unity Catalog Volumes paths are supported. For example: `{ "requirements": "/Workspace/path/to/requirements.txt" }` or `{ "requirements" : "/Volumes/path/to/requirements.txt" }`
-  
-- - `whl`
-  - String
-  - URI of the wheel library to install. Supported URIs include Workspace paths, Unity Catalog Volumes paths, and S3 URIs. For example: `{ "whl": "/Workspace/path/to/library.whl" }`, `{ "whl" : "/Volumes/path/to/library.whl" }` or `{ "whl": "s3://my-bucket/library.whl" }`. If S3 is used, please make sure the cluster has read access on the library. You may need to launch the cluster with an IAM role to access the S3 URI.
-  
-:::
-  
-  
-### jobs._name_.tasks.libraries.cran
-  
-**`Type: Map`**
-  
-Specification of a CRAN library to be installed as part of the library
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `package`
-  - String
-  - The name of the CRAN package to install.
-  
-- - `repo`
-  - String
-  - The repository where the package can be found. If not specified, the default CRAN repo is used.
-  
-:::
-  
-  
-### jobs._name_.tasks.libraries.maven
-  
-**`Type: Map`**
-  
-Specification of a maven library to be installed. For example:
-`{ "coordinates": "org.jsoup:jsoup:1.7.2" }`
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `coordinates`
-  - String
-  - Gradle-style maven coordinates. For example: "org.jsoup:jsoup:1.7.2".
-  
-- - `exclusions`
-  - Sequence
-  - List of dependences to exclude. For example: `["slf4j:slf4j", "*:hadoop-client"]`.  Maven dependency exclusions: https://maven.apache.org/guides/introduction/introduction-to-optional-and-excludes-dependencies.html.
-  
-- - `repo`
-  - String
-  - Maven repo to install the Maven package from. If omitted, both Maven Central Repository and Spark Packages are searched.
-  
-:::
-  
-  
-### jobs._name_.tasks.libraries.pypi
-  
-**`Type: Map`**
-  
-Specification of a PyPi library to be installed. For example:
-`{ "package": "simplejson" }`
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `package`
-  - String
-  - The name of the pypi package to install. An optional exact version specification is also supported. Examples: "simplejson" and "simplejson==3.8.0".
-  
-- - `repo`
-  - String
-  - The repository where the package can be found. If not specified, the default pip index is used.
-  
-:::
-  
-  
-### jobs._name_.tasks.new_cluster
-  
-**`Type: Map`**
-  
-If new_cluster, a description of a new cluster that is created for each run.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `apply_policy_default_values`
-  - Boolean
-  - When set to true, fixed and default values from the policy will be used for fields that are omitted. When set to false, only fixed values from the policy will be applied.
-  
-- - `autoscale`
-  - Map
-  - Parameters needed in order to automatically scale clusters up and down based on load. Note: autoscaling works best with DB runtime versions 3.0 or later. See [\_](#jobsnametasksnew_clusterautoscale).
-  
-- - `autotermination_minutes`
-  - Integer
-  - Automatically terminates the cluster after it is inactive for this time in minutes. If not set, this cluster will not be automatically terminated. If specified, the threshold must be between 10 and 10000 minutes. Users can also set this value to 0 to explicitly disable automatic termination.
-  
-- - `aws_attributes`
-  - Map
-  - Attributes related to clusters running on Amazon Web Services. If not specified at cluster creation, a set of default values will be used. See [\_](#jobsnametasksnew_clusteraws_attributes).
-  
-- - `azure_attributes`
-  - Map
-  - Attributes related to clusters running on Microsoft Azure. If not specified at cluster creation, a set of default values will be used. See [\_](#jobsnametasksnew_clusterazure_attributes).
-  
-- - `cluster_log_conf`
-  - Map
-  - The configuration for delivering spark logs to a long-term storage destination. Three kinds of destinations (DBFS, S3 and Unity Catalog volumes) are supported. Only one destination can be specified for one cluster. If the conf is given, the logs will be delivered to the destination every `5 mins`. The destination of driver logs is `$destination/$clusterId/driver`, while the destination of executor logs is `$destination/$clusterId/executor`. See [\_](#jobsnametasksnew_clustercluster_log_conf).
-  
-- - `cluster_name`
-  - String
-  - Cluster name requested by the user. This doesn't have to be unique. If not specified at creation, the cluster name will be an empty string. For job clusters, the cluster name is automatically set based on the job and job run IDs.
-  
-- - `custom_tags`
-  - Map
-  - Additional tags for cluster resources. Databricks will tag all cluster resources (e.g., AWS instances and EBS volumes) with these tags in addition to `default_tags`. Notes:  - Currently, Databricks allows at most 45 custom tags  - Clusters can only reuse cloud resources if the resources' tags are a subset of the cluster tags
-  
-- - `data_security_mode`
-  - String
-  - Data security mode decides what data governance model to use when accessing data from a cluster.  The following modes can only be used when `kind = CLASSIC_PREVIEW`. * `DATA_SECURITY_MODE_AUTO`: Databricks will choose the most appropriate access mode depending on your compute configuration. * `DATA_SECURITY_MODE_STANDARD`: Alias for `USER_ISOLATION`. * `DATA_SECURITY_MODE_DEDICATED`: Alias for `SINGLE_USER`.  The following modes can be used regardless of `kind`. * `NONE`: No security isolation for multiple users sharing the cluster. Data governance features are not available in this mode. * `SINGLE_USER`: A secure cluster that can only be exclusively used by a single user specified in `single_user_name`. Most programming languages, cluster features and data governance features are available in this mode. * `USER_ISOLATION`: A secure cluster that can be shared by multiple users. Cluster users are fully isolated so that they cannot see each other's data and credentials. Most data governance features are supported in this mode. But programming languages and cluster features might be limited.  The following modes are deprecated starting with Databricks Runtime 15.0 and will be removed for future Databricks Runtime versions:  * `LEGACY_TABLE_ACL`: This mode is for users migrating from legacy Table ACL clusters. * `LEGACY_PASSTHROUGH`: This mode is for users migrating from legacy Passthrough on high concurrency clusters. * `LEGACY_SINGLE_USER`: This mode is for users migrating from legacy Passthrough on standard clusters. * `LEGACY_SINGLE_USER_STANDARD`: This mode provides a way that doesn’t have UC nor passthrough enabled.
-  
-- - `docker_image`
-  - Map
-  - See [\_](#jobsnametasksnew_clusterdocker_image).
-  
-- - `driver_instance_pool_id`
-  - String
-  - The optional ID of the instance pool for the driver of the cluster belongs. The pool cluster uses the instance pool with id (instance_pool_id) if the driver pool is not assigned.
-  
-- - `driver_node_type_flexibility`
-  - Map
-  - Flexible node type configuration for the driver node. See [\_](#jobsnametasksnew_clusterdriver_node_type_flexibility).
-  
-- - `driver_node_type_id`
-  - String
-  - The node type of the Spark driver. Note that this field is optional; if unset, the driver node type will be set as the same value as `node_type_id` defined above.  This field, along with node_type_id, should not be set if virtual_cluster_size is set. If both driver_node_type_id, node_type_id, and virtual_cluster_size are specified, driver_node_type_id and node_type_id take precedence.
-  
-- - `enable_elastic_disk`
-  - Boolean
-  - Autoscaling Local Storage: when enabled, this cluster will dynamically acquire additional disk space when its Spark workers are running low on disk space.
-  
-- - `enable_local_disk_encryption`
-  - Boolean
-  - Whether to enable LUKS on cluster VMs' local disks
-  
-- - `gcp_attributes`
-  - Map
-  - Attributes related to clusters running on Google Cloud Platform. If not specified at cluster creation, a set of default values will be used. See [\_](#jobsnametasksnew_clustergcp_attributes).
-  
-- - `init_scripts`
-  - Sequence
-  - The configuration for storing init scripts. Any number of destinations can be specified. The scripts are executed sequentially in the order provided. If `cluster_log_conf` is specified, init script logs are sent to `<destination>/<cluster-ID>/init_scripts`. See [\_](#jobsnametasksnew_clusterinit_scripts).
-  
-- - `instance_pool_id`
-  - String
-  - The optional ID of the instance pool to which the cluster belongs.
-  
-- - `is_single_node`
-  - Boolean
-  - This field can only be used when `kind = CLASSIC_PREVIEW`.  When set to true, Databricks will automatically set single node related `custom_tags`, `spark_conf`, and `num_workers`
-  
-- - `kind`
-  - String
-  - 
-  
-- - `node_type_id`
-  - String
-  - This field encodes, through a single value, the resources available to each of the Spark nodes in this cluster. For example, the Spark nodes can be provisioned and optimized for memory or compute intensive workloads. A list of available node types can be retrieved by using the :method:clusters/listNodeTypes API call.
-  
-- - `num_workers`
-  - Integer
-  - Number of worker nodes that this cluster should have. A cluster has one Spark Driver and `num_workers` Executors for a total of `num_workers` + 1 Spark nodes.  Note: When reading the properties of a cluster, this field reflects the desired number of workers rather than the actual current number of workers. For instance, if a cluster is resized from 5 to 10 workers, this field will immediately be updated to reflect the target size of 10 workers, whereas the workers listed in `spark_info` will gradually increase from 5 to 10 as the new nodes are provisioned.
-  
-- - `policy_id`
-  - String
-  - The ID of the cluster policy used to create the cluster if applicable.
-  
-- - `remote_disk_throughput`
-  - Integer
-  - If set, what the configurable throughput (in Mb/s) for the remote disk is. Currently only supported for GCP HYPERDISK_BALANCED disks.
-  
-- - `runtime_engine`
-  - String
-  - 
-  
-- - `single_user_name`
-  - String
-  - Single user name if data_security_mode is `SINGLE_USER`
-  
-- - `spark_conf`
-  - Map
-  - An object containing a set of optional, user-specified Spark configuration key-value pairs. Users can also pass in a string of extra JVM options to the driver and the executors via `spark.driver.extraJavaOptions` and `spark.executor.extraJavaOptions` respectively.
-  
-- - `spark_env_vars`
-  - Map
-  - An object containing a set of optional, user-specified environment variable key-value pairs. Please note that key-value pair of the form (X,Y) will be exported as is (i.e., `export X='Y'`) while launching the driver and workers.  In order to specify an additional set of `SPARK_DAEMON_JAVA_OPTS`, we recommend appending them to `$SPARK_DAEMON_JAVA_OPTS` as shown in the example below. This ensures that all default databricks managed environmental variables are included as well.  Example Spark environment variables: `{"SPARK_WORKER_MEMORY": "28000m", "SPARK_LOCAL_DIRS": "/local_disk0"}` or `{"SPARK_DAEMON_JAVA_OPTS": "$SPARK_DAEMON_JAVA_OPTS -Dspark.shuffle.service.enabled=true"}`
-  
-- - `spark_version`
-  - String
-  - The Spark version of the cluster, e.g. `3.3.x-scala2.11`. A list of available Spark versions can be retrieved by using the :method:clusters/sparkVersions API call.
-  
-- - `ssh_public_keys`
-  - Sequence
-  - SSH public key contents that will be added to each Spark node in this cluster. The corresponding private keys can be used to login with the user name `ubuntu` on port `2200`. Up to 10 keys can be specified.
-  
-- - `total_initial_remote_disk_size`
-  - Integer
-  - If set, what the total initial volume size (in GB) of the remote disks should be. Currently only supported for GCP HYPERDISK_BALANCED disks.
-  
-- - `use_ml_runtime`
-  - Boolean
-  - This field can only be used when `kind = CLASSIC_PREVIEW`.  `effective_spark_version` is determined by `spark_version` (DBR release), this field `use_ml_runtime`, and whether `node_type_id` is gpu node or not.
-  
-- - `worker_node_type_flexibility`
-  - Map
-  - Flexible node type configuration for worker nodes. See [\_](#jobsnametasksnew_clusterworker_node_type_flexibility).
-  
-- - `workload_type`
-  - Map
-  - Cluster Attributes showing for clusters workload types. See [\_](#jobsnametasksnew_clusterworkload_type).
-  
-:::
-  
-  
-### jobs._name_.tasks.new_cluster.autoscale
-  
-**`Type: Map`**
-  
-Parameters needed in order to automatically scale clusters up and down based on load.
-Note: autoscaling works best with DB runtime versions 3.0 or later.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `max_workers`
-  - Integer
-  - The maximum number of workers to which the cluster can scale up when overloaded. Note that `max_workers` must be strictly greater than `min_workers`.
-  
-- - `min_workers`
-  - Integer
-  - The minimum number of workers to which the cluster can scale down when underutilized. It is also the initial number of workers the cluster will have after creation.
-  
-:::
-  
-  
-### jobs._name_.tasks.new_cluster.aws_attributes
-  
-**`Type: Map`**
-  
-Attributes related to clusters running on Amazon Web Services.
-If not specified at cluster creation, a set of default values will be used.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `availability`
-  - String
-  - Availability type used for all subsequent nodes past the `first_on_demand` ones.  Note: If `first_on_demand` is zero, this availability type will be used for the entire cluster.
-  
-- - `ebs_volume_count`
-  - Integer
-  - The number of volumes launched for each instance. Users can choose up to 10 volumes. This feature is only enabled for supported node types. Legacy node types cannot specify custom EBS volumes. For node types with no instance store, at least one EBS volume needs to be specified; otherwise, cluster creation will fail.  These EBS volumes will be mounted at `/ebs0`, `/ebs1`, and etc. Instance store volumes will be mounted at `/local_disk0`, `/local_disk1`, and etc.  If EBS volumes are attached, Databricks will configure Spark to use only the EBS volumes for scratch storage because heterogenously sized scratch devices can lead to inefficient disk utilization. If no EBS volumes are attached, Databricks will configure Spark to use instance store volumes.  Please note that if EBS volumes are specified, then the Spark configuration `spark.local.dir` will be overridden.
-  
-- - `ebs_volume_iops`
-  - Integer
-  - If using gp3 volumes, what IOPS to use for the disk. If this is not set, the maximum performance of a gp2 volume with the same volume size will be used.
-  
-- - `ebs_volume_size`
-  - Integer
-  - The size of each EBS volume (in GiB) launched for each instance. For general purpose SSD, this value must be within the range 100 - 4096. For throughput optimized HDD, this value must be within the range 500 - 4096.
-  
-- - `ebs_volume_throughput`
-  - Integer
-  - If using gp3 volumes, what throughput to use for the disk. If this is not set, the maximum performance of a gp2 volume with the same volume size will be used.
-  
-- - `ebs_volume_type`
-  - String
-  - All EBS volume types that Databricks supports. See https://aws.amazon.com/ebs/details/ for details.
-  
-- - `first_on_demand`
-  - Integer
-  - The first `first_on_demand` nodes of the cluster will be placed on on-demand instances. If this value is greater than 0, the cluster driver node in particular will be placed on an on-demand instance. If this value is greater than or equal to the current cluster size, all nodes will be placed on on-demand instances. If this value is less than the current cluster size, `first_on_demand` nodes will be placed on on-demand instances and the remainder will be placed on `availability` instances. Note that this value does not affect cluster size and cannot currently be mutated over the lifetime of a cluster.
-  
-- - `instance_profile_arn`
-  - String
-  - Nodes for this cluster will only be placed on AWS instances with this instance profile. If ommitted, nodes will be placed on instances without an IAM instance profile. The instance profile must have previously been added to the Databricks environment by an account administrator.  This feature may only be available to certain customer plans.
-  
-- - `spot_bid_price_percent`
-  - Integer
-  - The bid price for AWS spot instances, as a percentage of the corresponding instance type's on-demand price. For example, if this field is set to 50, and the cluster needs a new `r3.xlarge` spot instance, then the bid price is half of the price of on-demand `r3.xlarge` instances. Similarly, if this field is set to 200, the bid price is twice the price of on-demand `r3.xlarge` instances. If not specified, the default value is 100. When spot instances are requested for this cluster, only spot instances whose bid price percentage matches this field will be considered. Note that, for safety, we enforce this field to be no more than 10000.
-  
-- - `zone_id`
-  - String
-  - Identifier for the availability zone/datacenter in which the cluster resides. This string will be of a form like "us-west-2a". The provided availability zone must be in the same region as the Databricks deployment. For example, "us-west-2a" is not a valid zone id if the Databricks deployment resides in the "us-east-1" region. This is an optional field at cluster creation, and if not specified, the zone "auto" will be used. If the zone specified is "auto", will try to place cluster in a zone with high availability, and will retry placement in a different AZ if there is not enough capacity.  The list of available zones as well as the default value can be found by using the `List Zones` method.
-  
-:::
-  
-  
-### jobs._name_.tasks.new_cluster.azure_attributes
-  
-**`Type: Map`**
-  
-Attributes related to clusters running on Microsoft Azure.
-If not specified at cluster creation, a set of default values will be used.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `availability`
-  - String
-  - Availability type used for all subsequent nodes past the `first_on_demand` ones. Note: If `first_on_demand` is zero, this availability type will be used for the entire cluster.
-  
-- - `first_on_demand`
-  - Integer
-  - The first `first_on_demand` nodes of the cluster will be placed on on-demand instances. This value should be greater than 0, to make sure the cluster driver node is placed on an on-demand instance. If this value is greater than or equal to the current cluster size, all nodes will be placed on on-demand instances. If this value is less than the current cluster size, `first_on_demand` nodes will be placed on on-demand instances and the remainder will be placed on `availability` instances. Note that this value does not affect cluster size and cannot currently be mutated over the lifetime of a cluster.
-  
-- - `log_analytics_info`
-  - Map
-  - Defines values necessary to configure and run Azure Log Analytics agent. See [\_](#jobsnametasksnew_clusterazure_attributeslog_analytics_info).
-  
-- - `spot_bid_max_price`
-  - Any
-  - The max bid price to be used for Azure spot instances. The Max price for the bid cannot be higher than the on-demand price of the instance. If not specified, the default value is -1, which specifies that the instance cannot be evicted on the basis of price, and only on the basis of availability. Further, the value should > 0 or -1.
-  
-:::
-  
-  
-### jobs._name_.tasks.new_cluster.azure_attributes.log_analytics_info
-  
-**`Type: Map`**
-  
-Defines values necessary to configure and run Azure Log Analytics agent
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `log_analytics_primary_key`
-  - String
-  - The primary key for the Azure Log Analytics agent configuration
-  
-- - `log_analytics_workspace_id`
-  - String
-  - The workspace ID for the Azure Log Analytics agent configuration
-  
-:::
-  
-  
-### jobs._name_.tasks.new_cluster.cluster_log_conf
-  
-**`Type: Map`**
-  
-The configuration for delivering spark logs to a long-term storage destination.
-Three kinds of destinations (DBFS, S3 and Unity Catalog volumes) are supported. Only one destination can be specified
-for one cluster. If the conf is given, the logs will be delivered to the destination every
-`5 mins`. The destination of driver logs is `$destination/$clusterId/driver`, while
-the destination of executor logs is `$destination/$clusterId/executor`.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `dbfs`
-  - Map
-  - destination needs to be provided. e.g. `{ "dbfs" : { "destination" : "dbfs:/home/cluster_log" } }`. See [\_](#jobsnametasksnew_clustercluster_log_confdbfs).
-  
-- - `s3`
-  - Map
-  - destination and either the region or endpoint need to be provided. e.g. `{ "s3": { "destination" : "s3://cluster_log_bucket/prefix", "region" : "us-west-2" } }` Cluster iam role is used to access s3, please make sure the cluster iam role in `instance_profile_arn` has permission to write data to the s3 destination. See [\_](#jobsnametasksnew_clustercluster_log_confs3).
-  
-- - `volumes`
-  - Map
-  - destination needs to be provided, e.g. `{ "volumes": { "destination": "/Volumes/catalog/schema/volume/cluster_log" } }`. See [\_](#jobsnametasksnew_clustercluster_log_confvolumes).
-  
-:::
-  
-  
-### jobs._name_.tasks.new_cluster.cluster_log_conf.dbfs
-  
-**`Type: Map`**
-  
-destination needs to be provided. e.g.
-`{ "dbfs" : { "destination" : "dbfs:/home/cluster_log" } }`
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `destination`
-  - String
-  - dbfs destination, e.g. `dbfs:/my/path`
-  
-:::
-  
-  
-### jobs._name_.tasks.new_cluster.cluster_log_conf.s3
-  
-**`Type: Map`**
-  
-destination and either the region or endpoint need to be provided. e.g.
-`{ "s3": { "destination" : "s3://cluster_log_bucket/prefix", "region" : "us-west-2" } }`
-Cluster iam role is used to access s3, please make sure the cluster iam role in
-`instance_profile_arn` has permission to write data to the s3 destination.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `canned_acl`
-  - String
-  - (Optional) Set canned access control list for the logs, e.g. `bucket-owner-full-control`. If `canned_cal` is set, please make sure the cluster iam role has `s3:PutObjectAcl` permission on the destination bucket and prefix. The full list of possible canned acl can be found at http://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl. Please also note that by default only the object owner gets full controls. If you are using cross account role for writing data, you may want to set `bucket-owner-full-control` to make bucket owner able to read the logs.
-  
-- - `destination`
-  - String
-  - S3 destination, e.g. `s3://my-bucket/some-prefix` Note that logs will be delivered using cluster iam role, please make sure you set cluster iam role and the role has write access to the destination. Please also note that you cannot use AWS keys to deliver logs.
-  
-- - `enable_encryption`
-  - Boolean
-  - (Optional) Flag to enable server side encryption, `false` by default.
-  
-- - `encryption_type`
-  - String
-  - (Optional) The encryption type, it could be `sse-s3` or `sse-kms`. It will be used only when encryption is enabled and the default type is `sse-s3`.
-  
-- - `endpoint`
-  - String
-  - S3 endpoint, e.g. `https://s3-us-west-2.amazonaws.com`. Either region or endpoint needs to be set. If both are set, endpoint will be used.
-  
-- - `kms_key`
-  - String
-  - (Optional) Kms key which will be used if encryption is enabled and encryption type is set to `sse-kms`.
-  
-- - `region`
-  - String
-  - S3 region, e.g. `us-west-2`. Either region or endpoint needs to be set. If both are set, endpoint will be used.
-  
-:::
-  
-  
-### jobs._name_.tasks.new_cluster.cluster_log_conf.volumes
-  
-**`Type: Map`**
-  
-destination needs to be provided, e.g.
-`{ "volumes": { "destination": "/Volumes/catalog/schema/volume/cluster_log" } }`
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `destination`
-  - String
-  - UC Volumes destination, e.g. `/Volumes/catalog/schema/vol1/init-scripts/setup-datadog.sh` or `dbfs:/Volumes/catalog/schema/vol1/init-scripts/setup-datadog.sh`
-  
-:::
-  
-  
-### jobs._name_.tasks.new_cluster.docker_image
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `basic_auth`
-  - Map
-  - See [\_](#jobsnametasksnew_clusterdocker_imagebasic_auth).
-  
-- - `url`
-  - String
-  - URL of the docker image.
-  
-:::
-  
-  
-### jobs._name_.tasks.new_cluster.docker_image.basic_auth
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `password`
-  - String
-  - Password of the user
-  
-- - `username`
-  - String
-  - Name of the user
-  
-:::
-  
-  
-### jobs._name_.tasks.new_cluster.driver_node_type_flexibility
-  
-**`Type: Map`**
-  
-Flexible node type configuration for the driver node.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `alternate_node_type_ids`
-  - Sequence
-  - A list of node type IDs to use as fallbacks when the primary node type is unavailable.
-  
-:::
-  
-  
-### jobs._name_.tasks.new_cluster.gcp_attributes
-  
-**`Type: Map`**
-  
-Attributes related to clusters running on Google Cloud Platform.
-If not specified at cluster creation, a set of default values will be used.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `availability`
-  - String
-  - This field determines whether the instance pool will contain preemptible VMs, on-demand VMs, or preemptible VMs with a fallback to on-demand VMs if the former is unavailable.
-  
-- - `boot_disk_size`
-  - Integer
-  - Boot disk size in GB
-  
-- - `first_on_demand`
-  - Integer
-  - The first `first_on_demand` nodes of the cluster will be placed on on-demand instances. This value should be greater than 0, to make sure the cluster driver node is placed on an on-demand instance. If this value is greater than or equal to the current cluster size, all nodes will be placed on on-demand instances. If this value is less than the current cluster size, `first_on_demand` nodes will be placed on on-demand instances and the remainder will be placed on `availability` instances. Note that this value does not affect cluster size and cannot currently be mutated over the lifetime of a cluster.
-  
-- - `google_service_account`
-  - String
-  - If provided, the cluster will impersonate the google service account when accessing gcloud services (like GCS). The google service account must have previously been added to the Databricks environment by an account administrator.
-  
-- - `local_ssd_count`
-  - Integer
-  - If provided, each node (workers and driver) in the cluster will have this number of local SSDs attached. Each local SSD is 375GB in size. Refer to [GCP documentation](https://cloud.google.com/compute/docs/disks/local-ssd#choose_number_local_ssds) for the supported number of local SSDs for each instance type.
-  
-- - `use_preemptible_executors`
-  - Boolean
-  - This field is deprecated
-  
-- - `zone_id`
-  - String
-  - Identifier for the availability zone in which the cluster resides. This can be one of the following: - "HA" => High availability, spread nodes across availability zones for a Databricks deployment region [default]. - "AUTO" => Databricks picks an availability zone to schedule the cluster on. - A GCP availability zone => Pick One of the available zones for (machine type + region) from https://cloud.google.com/compute/docs/regions-zones.
-  
-:::
-  
-  
-### jobs._name_.tasks.new_cluster.init_scripts
-  
-**`Type: Sequence`**
-  
-The configuration for storing init scripts. Any number of destinations can be specified.
-The scripts are executed sequentially in the order provided.
-If `cluster_log_conf` is specified, init script logs are sent to `<destination>/<cluster-ID>/init_scripts`.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `abfss`
-  - Map
-  - Contains the Azure Data Lake Storage destination path. See [\_](#jobsnametasksnew_clusterinit_scriptsabfss).
-  
-- - `dbfs`
-  - Map
-  - This field is deprecated
-  
-- - `file`
-  - Map
-  - destination needs to be provided, e.g. `{ "file": { "destination": "file:/my/local/file.sh" } }`. See [\_](#jobsnametasksnew_clusterinit_scriptsfile).
-  
-- - `gcs`
-  - Map
-  - destination needs to be provided, e.g. `{ "gcs": { "destination": "gs://my-bucket/file.sh" } }`. See [\_](#jobsnametasksnew_clusterinit_scriptsgcs).
-  
-- - `s3`
-  - Map
-  - destination and either the region or endpoint need to be provided. e.g. `{ \"s3\": { \"destination\": \"s3://cluster_log_bucket/prefix\", \"region\": \"us-west-2\" } }` Cluster iam role is used to access s3, please make sure the cluster iam role in `instance_profile_arn` has permission to write data to the s3 destination. See [\_](#jobsnametasksnew_clusterinit_scriptss3).
-  
-- - `volumes`
-  - Map
-  - destination needs to be provided. e.g. `{ \"volumes\" : { \"destination\" : \"/Volumes/my-init.sh\" } }`. See [\_](#jobsnametasksnew_clusterinit_scriptsvolumes).
-  
-- - `workspace`
-  - Map
-  - destination needs to be provided, e.g. `{ "workspace": { "destination": "/cluster-init-scripts/setup-datadog.sh" } }`. See [\_](#jobsnametasksnew_clusterinit_scriptsworkspace).
-  
-:::
-  
-  
-### jobs._name_.tasks.new_cluster.init_scripts.abfss
-  
-**`Type: Map`**
-  
-Contains the Azure Data Lake Storage destination path
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `destination`
-  - String
-  - abfss destination, e.g. `abfss://<container-name>@<storage-account-name>.dfs.core.windows.net/<directory-name>`.
-  
-:::
-  
-  
-### jobs._name_.tasks.new_cluster.init_scripts.file
-  
-**`Type: Map`**
-  
-destination needs to be provided, e.g.
-`{ "file": { "destination": "file:/my/local/file.sh" } }`
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `destination`
-  - String
-  - local file destination, e.g. `file:/my/local/file.sh`
-  
-:::
-  
-  
-### jobs._name_.tasks.new_cluster.init_scripts.gcs
-  
-**`Type: Map`**
-  
-destination needs to be provided, e.g.
-`{ "gcs": { "destination": "gs://my-bucket/file.sh" } }`
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `destination`
-  - String
-  - GCS destination/URI, e.g. `gs://my-bucket/some-prefix`
-  
-:::
-  
-  
-### jobs._name_.tasks.new_cluster.init_scripts.s3
-  
-**`Type: Map`**
-  
-destination and either the region or endpoint need to be provided. e.g.
-`{ \"s3\": { \"destination\": \"s3://cluster_log_bucket/prefix\", \"region\": \"us-west-2\" } }`
-Cluster iam role is used to access s3, please make sure the cluster iam role in
-`instance_profile_arn` has permission to write data to the s3 destination.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `canned_acl`
-  - String
-  - (Optional) Set canned access control list for the logs, e.g. `bucket-owner-full-control`. If `canned_cal` is set, please make sure the cluster iam role has `s3:PutObjectAcl` permission on the destination bucket and prefix. The full list of possible canned acl can be found at http://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl. Please also note that by default only the object owner gets full controls. If you are using cross account role for writing data, you may want to set `bucket-owner-full-control` to make bucket owner able to read the logs.
-  
-- - `destination`
-  - String
-  - S3 destination, e.g. `s3://my-bucket/some-prefix` Note that logs will be delivered using cluster iam role, please make sure you set cluster iam role and the role has write access to the destination. Please also note that you cannot use AWS keys to deliver logs.
-  
-- - `enable_encryption`
-  - Boolean
-  - (Optional) Flag to enable server side encryption, `false` by default.
-  
-- - `encryption_type`
-  - String
-  - (Optional) The encryption type, it could be `sse-s3` or `sse-kms`. It will be used only when encryption is enabled and the default type is `sse-s3`.
-  
-- - `endpoint`
-  - String
-  - S3 endpoint, e.g. `https://s3-us-west-2.amazonaws.com`. Either region or endpoint needs to be set. If both are set, endpoint will be used.
-  
-- - `kms_key`
-  - String
-  - (Optional) Kms key which will be used if encryption is enabled and encryption type is set to `sse-kms`.
-  
-- - `region`
-  - String
-  - S3 region, e.g. `us-west-2`. Either region or endpoint needs to be set. If both are set, endpoint will be used.
-  
-:::
-  
-  
-### jobs._name_.tasks.new_cluster.init_scripts.volumes
-  
-**`Type: Map`**
-  
-destination needs to be provided. e.g.
-`{ \"volumes\" : { \"destination\" : \"/Volumes/my-init.sh\" } }`
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `destination`
-  - String
-  - UC Volumes destination, e.g. `/Volumes/catalog/schema/vol1/init-scripts/setup-datadog.sh` or `dbfs:/Volumes/catalog/schema/vol1/init-scripts/setup-datadog.sh`
-  
-:::
-  
-  
-### jobs._name_.tasks.new_cluster.init_scripts.workspace
-  
-**`Type: Map`**
-  
-destination needs to be provided, e.g.
-`{ "workspace": { "destination": "/cluster-init-scripts/setup-datadog.sh" } }`
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `destination`
-  - String
-  - wsfs destination, e.g. `workspace:/cluster-init-scripts/setup-datadog.sh`
-  
-:::
-  
-  
-### jobs._name_.tasks.new_cluster.worker_node_type_flexibility
-  
-**`Type: Map`**
-  
-Flexible node type configuration for worker nodes.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `alternate_node_type_ids`
-  - Sequence
-  - A list of node type IDs to use as fallbacks when the primary node type is unavailable.
-  
-:::
-  
-  
-### jobs._name_.tasks.new_cluster.workload_type
-  
-**`Type: Map`**
-  
-Cluster Attributes showing for clusters workload types.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `clients`
-  - Map
-  - defined what type of clients can use the cluster. E.g. Notebooks, Jobs. See [\_](#jobsnametasksnew_clusterworkload_typeclients).
-  
-:::
-  
-  
-### jobs._name_.tasks.new_cluster.workload_type.clients
-  
-**`Type: Map`**
-  
-defined what type of clients can use the cluster. E.g. Notebooks, Jobs
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `jobs`
-  - Boolean
-  - With jobs set, the cluster can be used for jobs
-  
-- - `notebooks`
-  - Boolean
-  - With notebooks set, this cluster can be used for notebooks
-  
-:::
-  
-  
-### jobs._name_.tasks.notebook_task
-  
-**`Type: Map`**
-  
-The task runs a notebook when the `notebook_task` field is present.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `base_parameters`
-  - Map
-  - Base parameters to be used for each run of this job. If the run is initiated by a call to :method:jobs/run Now with parameters specified, the two parameters maps are merged. If the same key is specified in `base_parameters` and in `run-now`, the value from `run-now` is used. Use [Task parameter variables](https://docs.databricks.com/jobs.html#parameter-variables) to set parameters containing information about job runs.  If the notebook takes a parameter that is not specified in the job’s `base_parameters` or the `run-now` override parameters, the default value from the notebook is used.  Retrieve these parameters in a notebook using [dbutils.widgets.get](https://docs.databricks.com/dev-tools/databricks-utils.html#dbutils-widgets).  The JSON representation of this field cannot exceed 1MB.
-  
-- - `notebook_path`
-  - String
-  - The path of the notebook to be run in the Databricks workspace or remote repository. For notebooks stored in the Databricks workspace, the path must be absolute and begin with a slash. For notebooks stored in a remote repository, the path must be relative. This field is required.
-  
-- - `source`
-  - String
-  - Optional location type of the notebook. When set to `WORKSPACE`, the notebook will be retrieved from the local Databricks workspace. When set to `GIT`, the notebook will be retrieved from a Git repository defined in `git_source`. If the value is empty, the task will use `GIT` if `git_source` is defined and `WORKSPACE` otherwise. * `WORKSPACE`: Notebook is located in Databricks workspace. * `GIT`: Notebook is located in cloud Git provider.
-  
-- - `warehouse_id`
-  - String
-  - Optional `warehouse_id` to run the notebook on a SQL warehouse. Classic SQL warehouses are NOT supported, please use serverless or pro SQL warehouses.  Note that SQL warehouses only support SQL cells; if the notebook contains non-SQL cells, the run will fail.
-  
-:::
-  
-  
-### jobs._name_.tasks.notification_settings
-  
-**`Type: Map`**
-  
-Optional notification settings that are used when sending notifications to each of the `email_notifications` and `webhook_notifications` for this task.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `alert_on_last_attempt`
-  - Boolean
-  - If true, do not send notifications to recipients specified in `on_start` for the retried runs and do not send notifications to recipients specified in `on_failure` until the last retry of the run.
-  
-- - `no_alert_for_canceled_runs`
-  - Boolean
-  - If true, do not send notifications to recipients specified in `on_failure` if the run is canceled.
-  
-- - `no_alert_for_skipped_runs`
-  - Boolean
-  - If true, do not send notifications to recipients specified in `on_failure` if the run is skipped.
-  
-:::
-  
-  
-### jobs._name_.tasks.pipeline_task
-  
-**`Type: Map`**
-  
-The task triggers a pipeline update when the `pipeline_task` field is present. Only pipelines configured to use triggered more are supported.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `full_refresh`
-  - Boolean
-  - If true, triggers a full refresh on the delta live table.
-  
-- - `pipeline_id`
-  - String
-  - The full name of the pipeline task to execute.
-  
-:::
-  
-  
-### jobs._name_.tasks.power_bi_task
-  
-**`Type: Map`**
-  
-The task triggers a Power BI semantic model update when the `power_bi_task` field is present.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `connection_resource_name`
-  - String
-  - The resource name of the UC connection to authenticate from Databricks to Power BI
-  
-- - `power_bi_model`
-  - Map
-  - The semantic model to update. See [\_](#jobsnametaskspower_bi_taskpower_bi_model).
-  
-- - `refresh_after_update`
-  - Boolean
-  - Whether the model should be refreshed after the update
-  
-- - `tables`
-  - Sequence
-  - The tables to be exported to Power BI. See [\_](#jobsnametaskspower_bi_tasktables).
-  
-- - `warehouse_id`
-  - String
-  - The SQL warehouse ID to use as the Power BI data source
-  
-:::
-  
-  
-### jobs._name_.tasks.power_bi_task.power_bi_model
-  
-**`Type: Map`**
-  
-The semantic model to update
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `authentication_method`
-  - String
-  - How the published Power BI model authenticates to Databricks
-  
-- - `model_name`
-  - String
-  - The name of the Power BI model
-  
-- - `overwrite_existing`
-  - Boolean
-  - Whether to overwrite existing Power BI models
-  
-- - `storage_mode`
-  - String
-  - The default storage mode of the Power BI model
-  
-- - `workspace_name`
-  - String
-  - The name of the Power BI workspace of the model
-  
-:::
-  
-  
-### jobs._name_.tasks.power_bi_task.tables
-  
-**`Type: Sequence`**
-  
-The tables to be exported to Power BI
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `catalog`
-  - String
-  - The catalog name in Databricks
-  
-- - `name`
-  - String
-  - The table name in Databricks
-  
-- - `schema`
-  - String
-  - The schema name in Databricks
-  
-- - `storage_mode`
-  - String
-  - The Power BI storage mode of the table
-  
-:::
-  
-  
-### jobs._name_.tasks.python_wheel_task
-  
-**`Type: Map`**
-  
-The task runs a Python wheel when the `python_wheel_task` field is present.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `entry_point`
-  - String
-  - Named entry point to use, if it does not exist in the metadata of the package it executes the function from the package directly using `$packageName.$entryPoint()`
-  
-- - `named_parameters`
-  - Map
-  - Command-line parameters passed to Python wheel task in the form of `["--name=task", "--data=dbfs:/path/to/data.json"]`. Leave it empty if `parameters` is not null.
-  
-- - `package_name`
-  - String
-  - Name of the package to execute
-  
-- - `parameters`
-  - Sequence
-  - Command-line parameters passed to Python wheel task. Leave it empty if `named_parameters` is not null.
-  
-:::
-  
-  
-### jobs._name_.tasks.run_job_task
-  
-**`Type: Map`**
-  
-The task triggers another job when the `run_job_task` field is present.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `job_id`
-  - Integer
-  - ID of the job to trigger.
-  
-- - `job_parameters`
-  - Map
-  - Job-level parameters used to trigger the job.
-  
-- - `pipeline_params`
-  - Map
-  - Controls whether the pipeline should perform a full refresh. See [\_](#jobsnametasksrun_job_taskpipeline_params).
-  
-:::
-  
-  
-### jobs._name_.tasks.run_job_task.pipeline_params
-  
-**`Type: Map`**
-  
-Controls whether the pipeline should perform a full refresh
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `full_refresh`
-  - Boolean
-  - If true, triggers a full refresh on the delta live table.
-  
-:::
-  
-  
-### jobs._name_.tasks.spark_jar_task
-  
-**`Type: Map`**
-  
-The task runs a JAR when the `spark_jar_task` field is present.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `jar_uri`
-  - String
-  - This field is deprecated
-  
-- - `main_class_name`
-  - String
-  - The full name of the class containing the main method to be executed. This class must be contained in a JAR provided as a library.  The code must use `SparkContext.getOrCreate` to obtain a Spark context; otherwise, runs of the job fail.
-  
-- - `parameters`
-  - Sequence
-  - Parameters passed to the main method.  Use [Task parameter variables](https://docs.databricks.com/jobs.html#parameter-variables) to set parameters containing information about job runs.
-  
-- - `run_as_repl`
-  - Boolean
-  - This field is deprecated
-  
-:::
-  
-  
-### jobs._name_.tasks.spark_python_task
-  
-**`Type: Map`**
-  
-The task runs a Python file when the `spark_python_task` field is present.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `parameters`
-  - Sequence
-  - Command line parameters passed to the Python file.  Use [Task parameter variables](https://docs.databricks.com/jobs.html#parameter-variables) to set parameters containing information about job runs.
-  
-- - `python_file`
-  - String
-  - The Python file to be executed. Cloud file URIs (such as dbfs:/, s3:/, adls:/, gcs:/) and workspace paths are supported. For python files stored in the Databricks workspace, the path must be absolute and begin with `/`. For files stored in a remote repository, the path must be relative. This field is required.
-  
-- - `source`
-  - String
-  - Optional location type of the Python file. When set to `WORKSPACE` or not specified, the file will be retrieved from the local Databricks workspace or cloud location (if the `python_file` has a URI format). When set to `GIT`, the Python file will be retrieved from a Git repository defined in `git_source`.  * `WORKSPACE`: The Python file is located in a Databricks workspace or at a cloud filesystem URI. * `GIT`: The Python file is located in a remote Git repository.
-  
-:::
-  
-  
-### jobs._name_.tasks.sql_task
-  
-**`Type: Map`**
-  
-The task runs a SQL query or file, or it refreshes a SQL alert or a legacy SQL dashboard when the `sql_task` field is present.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `alert`
-  - Map
-  - If alert, indicates that this job must refresh a SQL alert. See [\_](#jobsnametaskssql_taskalert).
-  
-- - `dashboard`
-  - Map
-  - If dashboard, indicates that this job must refresh a SQL dashboard. See [\_](#jobsnametaskssql_taskdashboard).
-  
-- - `file`
-  - Map
-  - If file, indicates that this job runs a SQL file in a remote Git repository. See [\_](#jobsnametaskssql_taskfile).
-  
-- - `parameters`
-  - Map
-  - Parameters to be used for each run of this job. The SQL alert task does not support custom parameters.
-  
-- - `query`
-  - Map
-  - If query, indicates that this job must execute a SQL query. See [\_](#jobsnametaskssql_taskquery).
-  
-- - `warehouse_id`
-  - String
-  - The canonical identifier of the SQL warehouse. Recommended to use with serverless or pro SQL warehouses. Classic SQL warehouses are only supported for SQL alert, dashboard and query tasks and are limited to scheduled single-task jobs.
-  
-:::
-  
-  
-### jobs._name_.tasks.sql_task.alert
-  
-**`Type: Map`**
-  
-If alert, indicates that this job must refresh a SQL alert.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `alert_id`
-  - String
-  - The canonical identifier of the SQL alert.
-  
-- - `pause_subscriptions`
-  - Boolean
-  - If true, the alert notifications are not sent to subscribers.
-  
-- - `subscriptions`
-  - Sequence
-  - If specified, alert notifications are sent to subscribers. See [\_](#jobsnametaskssql_taskalertsubscriptions).
-  
-:::
-  
-  
-### jobs._name_.tasks.sql_task.alert.subscriptions
-  
-**`Type: Sequence`**
-  
-If specified, alert notifications are sent to subscribers.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `destination_id`
-  - String
-  - The canonical identifier of the destination to receive email notification. This parameter is mutually exclusive with user_name. You cannot set both destination_id and user_name for subscription notifications.
-  
-- - `user_name`
-  - String
-  - The user name to receive the subscription email. This parameter is mutually exclusive with destination_id. You cannot set both destination_id and user_name for subscription notifications.
-  
-:::
-  
-  
-### jobs._name_.tasks.sql_task.dashboard
-  
-**`Type: Map`**
-  
-If dashboard, indicates that this job must refresh a SQL dashboard.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `custom_subject`
-  - String
-  - Subject of the email sent to subscribers of this task.
-  
-- - `dashboard_id`
-  - String
-  - The canonical identifier of the SQL dashboard.
-  
-- - `pause_subscriptions`
-  - Boolean
-  - If true, the dashboard snapshot is not taken, and emails are not sent to subscribers.
-  
-- - `subscriptions`
-  - Sequence
-  - If specified, dashboard snapshots are sent to subscriptions. See [\_](#jobsnametaskssql_taskdashboardsubscriptions).
-  
-:::
-  
-  
-### jobs._name_.tasks.sql_task.dashboard.subscriptions
-  
-**`Type: Sequence`**
-  
-If specified, dashboard snapshots are sent to subscriptions.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `destination_id`
-  - String
-  - The canonical identifier of the destination to receive email notification. This parameter is mutually exclusive with user_name. You cannot set both destination_id and user_name for subscription notifications.
-  
-- - `user_name`
-  - String
-  - The user name to receive the subscription email. This parameter is mutually exclusive with destination_id. You cannot set both destination_id and user_name for subscription notifications.
-  
-:::
-  
-  
-### jobs._name_.tasks.sql_task.file
-  
-**`Type: Map`**
-  
-If file, indicates that this job runs a SQL file in a remote Git repository.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `path`
-  - String
-  - Path of the SQL file. Must be relative if the source is a remote Git repository and absolute for workspace paths.
-  
-- - `source`
-  - String
-  - Optional location type of the SQL file. When set to `WORKSPACE`, the SQL file will be retrieved from the local Databricks workspace. When set to `GIT`, the SQL file will be retrieved from a Git repository defined in `git_source`. If the value is empty, the task will use `GIT` if `git_source` is defined and `WORKSPACE` otherwise.  * `WORKSPACE`: SQL file is located in Databricks workspace. * `GIT`: SQL file is located in cloud Git provider.
-  
-:::
-  
-  
-### jobs._name_.tasks.sql_task.query
-  
-**`Type: Map`**
-  
-If query, indicates that this job must execute a SQL query.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `query_id`
-  - String
-  - The canonical identifier of the SQL query.
-  
-:::
-  
-  
-### jobs._name_.tasks.webhook_notifications
-  
-**`Type: Map`**
-  
-A collection of system notification IDs to notify when runs of this task begin or complete. The default behavior is to not send any system notifications.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `on_duration_warning_threshold_exceeded`
-  - Sequence
-  - An optional list of system notification IDs to call when the duration of a run exceeds the threshold specified for the `RUN_DURATION_SECONDS` metric in the `health` field. A maximum of 3 destinations can be specified for the `on_duration_warning_threshold_exceeded` property. See [\_](#jobsnametaskswebhook_notificationson_duration_warning_threshold_exceeded).
-  
-- - `on_failure`
-  - Sequence
-  - An optional list of system notification IDs to call when the run fails. A maximum of 3 destinations can be specified for the `on_failure` property. See [\_](#jobsnametaskswebhook_notificationson_failure).
-  
-- - `on_start`
-  - Sequence
-  - An optional list of system notification IDs to call when the run starts. A maximum of 3 destinations can be specified for the `on_start` property. See [\_](#jobsnametaskswebhook_notificationson_start).
-  
-- - `on_streaming_backlog_exceeded`
-  - Sequence
-  - An optional list of system notification IDs to call when any streaming backlog thresholds are exceeded for any stream. Streaming backlog thresholds can be set in the `health` field using the following metrics: `STREAMING_BACKLOG_BYTES`, `STREAMING_BACKLOG_RECORDS`, `STREAMING_BACKLOG_SECONDS`, or `STREAMING_BACKLOG_FILES`. Alerting is based on the 10-minute average of these metrics. If the issue persists, notifications are resent every 30 minutes. A maximum of 3 destinations can be specified for the `on_streaming_backlog_exceeded` property. See [\_](#jobsnametaskswebhook_notificationson_streaming_backlog_exceeded).
-  
-- - `on_success`
-  - Sequence
-  - An optional list of system notification IDs to call when the run completes successfully. A maximum of 3 destinations can be specified for the `on_success` property. See [\_](#jobsnametaskswebhook_notificationson_success).
-  
-:::
-  
-  
-### jobs._name_.tasks.webhook_notifications.on_duration_warning_threshold_exceeded
-  
-**`Type: Sequence`**
-  
-An optional list of system notification IDs to call when the duration of a run exceeds the threshold specified for the `RUN_DURATION_SECONDS` metric in the `health` field. A maximum of 3 destinations can be specified for the `on_duration_warning_threshold_exceeded` property.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `id`
-  - String
-  - 
-  
-:::
-  
-  
-### jobs._name_.tasks.webhook_notifications.on_failure
-  
-**`Type: Sequence`**
-  
-An optional list of system notification IDs to call when the run fails. A maximum of 3 destinations can be specified for the `on_failure` property.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `id`
-  - String
-  - 
-  
-:::
-  
-  
-### jobs._name_.tasks.webhook_notifications.on_start
-  
-**`Type: Sequence`**
-  
-An optional list of system notification IDs to call when the run starts. A maximum of 3 destinations can be specified for the `on_start` property.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `id`
-  - String
-  - 
-  
-:::
-  
-  
-### jobs._name_.tasks.webhook_notifications.on_streaming_backlog_exceeded
-  
-**`Type: Sequence`**
-  
-An optional list of system notification IDs to call when any streaming backlog thresholds are exceeded for any stream.
-Streaming backlog thresholds can be set in the `health` field using the following metrics: `STREAMING_BACKLOG_BYTES`, `STREAMING_BACKLOG_RECORDS`, `STREAMING_BACKLOG_SECONDS`, or `STREAMING_BACKLOG_FILES`.
-Alerting is based on the 10-minute average of these metrics. If the issue persists, notifications are resent every 30 minutes.
-A maximum of 3 destinations can be specified for the `on_streaming_backlog_exceeded` property.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `id`
-  - String
-  - 
-  
-:::
-  
-  
-### jobs._name_.tasks.webhook_notifications.on_success
-  
-**`Type: Sequence`**
-  
-An optional list of system notification IDs to call when the run completes successfully. A maximum of 3 destinations can be specified for the `on_success` property.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `id`
-  - String
-  - 
-  
-:::
-  
-  
-### jobs._name_.trigger
-  
-**`Type: Map`**
-  
-A configuration to trigger a run when certain conditions are met. The default behavior is that the job runs only when triggered by clicking “Run Now” in the Jobs UI or sending an API request to `runNow`.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `file_arrival`
-  - Map
-  - File arrival trigger settings. See [\_](#jobsnametriggerfile_arrival).
-  
-- - `pause_status`
-  - String
-  - Whether this trigger is paused or not.
-  
-- - `periodic`
-  - Map
-  - Periodic trigger settings. See [\_](#jobsnametriggerperiodic).
-  
-- - `table_update`
-  - Map
-  - See [\_](#jobsnametriggertable_update).
-  
-:::
-  
-  
-### jobs._name_.trigger.file_arrival
-  
-**`Type: Map`**
-  
-File arrival trigger settings.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `min_time_between_triggers_seconds`
-  - Integer
-  - If set, the trigger starts a run only after the specified amount of time passed since the last time the trigger fired. The minimum allowed value is 60 seconds
-  
-- - `url`
-  - String
-  - URL to be monitored for file arrivals. The path must point to the root or a subpath of the external location.
-  
-- - `wait_after_last_change_seconds`
-  - Integer
-  - If set, the trigger starts a run only after no file activity has occurred for the specified amount of time. This makes it possible to wait for a batch of incoming files to arrive before triggering a run. The minimum allowed value is 60 seconds.
-  
-:::
-  
-  
-### jobs._name_.trigger.periodic
-  
-**`Type: Map`**
-  
-Periodic trigger settings.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `interval`
-  - Integer
-  - The interval at which the trigger should run.
-  
-- - `unit`
-  - String
-  - The unit of time for the interval.
-  
-:::
-  
-  
-### jobs._name_.trigger.table_update
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `condition`
-  - String
-  - The table(s) condition based on which to trigger a job run.
-  
-- - `min_time_between_triggers_seconds`
-  - Integer
-  - If set, the trigger starts a run only after the specified amount of time has passed since the last time the trigger fired. The minimum allowed value is 60 seconds.
-  
-- - `table_names`
-  - Sequence
-  - A list of tables to monitor for changes. The table name must be in the format `catalog_name.schema_name.table_name`.
-  
-- - `wait_after_last_change_seconds`
-  - Integer
-  - If set, the trigger starts a run only after no table updates have occurred for the specified time and can be used to wait for a series of table updates before triggering a run. The minimum allowed value is 60 seconds.
-  
-:::
-  
-  
-### jobs._name_.webhook_notifications
-  
-**`Type: Map`**
-  
-A collection of system notification IDs to notify when runs of this job begin or complete.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `on_duration_warning_threshold_exceeded`
-  - Sequence
-  - An optional list of system notification IDs to call when the duration of a run exceeds the threshold specified for the `RUN_DURATION_SECONDS` metric in the `health` field. A maximum of 3 destinations can be specified for the `on_duration_warning_threshold_exceeded` property. See [\_](#jobsnamewebhook_notificationson_duration_warning_threshold_exceeded).
-  
-- - `on_failure`
-  - Sequence
-  - An optional list of system notification IDs to call when the run fails. A maximum of 3 destinations can be specified for the `on_failure` property. See [\_](#jobsnamewebhook_notificationson_failure).
-  
-- - `on_start`
-  - Sequence
-  - An optional list of system notification IDs to call when the run starts. A maximum of 3 destinations can be specified for the `on_start` property. See [\_](#jobsnamewebhook_notificationson_start).
-  
-- - `on_streaming_backlog_exceeded`
-  - Sequence
-  - An optional list of system notification IDs to call when any streaming backlog thresholds are exceeded for any stream. Streaming backlog thresholds can be set in the `health` field using the following metrics: `STREAMING_BACKLOG_BYTES`, `STREAMING_BACKLOG_RECORDS`, `STREAMING_BACKLOG_SECONDS`, or `STREAMING_BACKLOG_FILES`. Alerting is based on the 10-minute average of these metrics. If the issue persists, notifications are resent every 30 minutes. A maximum of 3 destinations can be specified for the `on_streaming_backlog_exceeded` property. See [\_](#jobsnamewebhook_notificationson_streaming_backlog_exceeded).
-  
-- - `on_success`
-  - Sequence
-  - An optional list of system notification IDs to call when the run completes successfully. A maximum of 3 destinations can be specified for the `on_success` property. See [\_](#jobsnamewebhook_notificationson_success).
-  
-:::
-  
-  
-### jobs._name_.webhook_notifications.on_duration_warning_threshold_exceeded
-  
-**`Type: Sequence`**
-  
-An optional list of system notification IDs to call when the duration of a run exceeds the threshold specified for the `RUN_DURATION_SECONDS` metric in the `health` field. A maximum of 3 destinations can be specified for the `on_duration_warning_threshold_exceeded` property.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `id`
-  - String
-  - 
-  
-:::
-  
-  
-### jobs._name_.webhook_notifications.on_failure
-  
-**`Type: Sequence`**
-  
-An optional list of system notification IDs to call when the run fails. A maximum of 3 destinations can be specified for the `on_failure` property.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `id`
-  - String
-  - 
-  
-:::
-  
-  
-### jobs._name_.webhook_notifications.on_start
-  
-**`Type: Sequence`**
-  
-An optional list of system notification IDs to call when the run starts. A maximum of 3 destinations can be specified for the `on_start` property.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `id`
-  - String
-  - 
-  
-:::
-  
-  
-### jobs._name_.webhook_notifications.on_streaming_backlog_exceeded
-  
-**`Type: Sequence`**
-  
-An optional list of system notification IDs to call when any streaming backlog thresholds are exceeded for any stream.
-Streaming backlog thresholds can be set in the `health` field using the following metrics: `STREAMING_BACKLOG_BYTES`, `STREAMING_BACKLOG_RECORDS`, `STREAMING_BACKLOG_SECONDS`, or `STREAMING_BACKLOG_FILES`.
-Alerting is based on the 10-minute average of these metrics. If the issue persists, notifications are resent every 30 minutes.
-A maximum of 3 destinations can be specified for the `on_streaming_backlog_exceeded` property.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `id`
-  - String
-  - 
-  
-:::
-  
-  
-### jobs._name_.webhook_notifications.on_success
-  
-**`Type: Sequence`**
-  
-An optional list of system notification IDs to call when the run completes successfully. A maximum of 3 destinations can be specified for the `on_success` property.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `id`
-  - String
-  - 
-  
-:::
-  
-  
-## model_serving_endpoints
-  
-**`Type: Map`**
-  
-The model_serving_endpoint resource allows you to define [model serving endpoints](/api/workspace/servingendpoints/create). See [_](/machine-learning/model-serving/manage-serving-endpoints.md).
-  
-```yaml
-model_serving_endpoints:
-  <model_serving_endpoint-name>:
-    <model_serving_endpoint-field-name>: <model_serving_endpoint-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `ai_gateway`
-  - Map
-  - The AI Gateway configuration for the serving endpoint. NOTE: External model, provisioned throughput, and pay-per-token endpoints are fully supported; agent endpoints currently only support inference tables. See [\_](#model_serving_endpointsnameai_gateway).
-  
-- - `budget_policy_id`
-  - String
-  - The budget policy to be applied to the serving endpoint.
-  
-- - `config`
-  - Map
-  - The core config of the serving endpoint. See [\_](#model_serving_endpointsnameconfig).
-  
-- - `description`
-  - String
-  - 
-  
-- - `email_notifications`
-  - Map
-  - Email notification settings. See [\_](#model_serving_endpointsnameemail_notifications).
-  
-- - `lifecycle`
-  - Map
-  - Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed. See [\_](#model_serving_endpointsnamelifecycle).
-  
-- - `name`
-  - String
-  - The name of the serving endpoint. This field is required and must be unique across a Databricks workspace. An endpoint name can consist of alphanumeric characters, dashes, and underscores.
-  
-- - `permissions`
-  - Sequence
-  - See [\_](#model_serving_endpointsnamepermissions).
-  
-- - `rate_limits`
-  - Sequence
-  - This field is deprecated
-  
-- - `route_optimized`
-  - Boolean
-  - Enable route optimization for the serving endpoint.
-  
-- - `tags`
-  - Sequence
-  - Tags to be attached to the serving endpoint and automatically propagated to billing logs. See [\_](#model_serving_endpointsnametags).
-  
-:::
-  
-  
-**Example**
-  
-The following example defines a Unity Catalog model serving endpoint:
-
-```yaml
-resources:
-  model_serving_endpoints:
-    uc_model_serving_endpoint:
-      name: "uc-model-endpoint"
-      config:
-        served_entities:
-        - entity_name: "myCatalog.mySchema.my-ads-model"
-          entity_version: "10"
-          workload_size: "Small"
-          scale_to_zero_enabled: "true"
-        traffic_config:
-          routes:
-          - served_model_name: "my-ads-model-10"
-            traffic_percentage: "100"
-      tags:
-      - key: "team"
-        value: "data science"
-```
-  
-### model_serving_endpoints._name_.ai_gateway
-  
-**`Type: Map`**
-  
-The AI Gateway configuration for the serving endpoint. NOTE: External model, provisioned throughput, and pay-per-token endpoints are fully supported; agent endpoints currently only support inference tables.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `fallback_config`
-  - Map
-  - Configuration for traffic fallback which auto fallbacks to other served entities if the request to a served entity fails with certain error codes, to increase availability. See [\_](#model_serving_endpointsnameai_gatewayfallback_config).
-  
-- - `guardrails`
-  - Map
-  - Configuration for AI Guardrails to prevent unwanted data and unsafe data in requests and responses. See [\_](#model_serving_endpointsnameai_gatewayguardrails).
-  
-- - `inference_table_config`
-  - Map
-  - Configuration for payload logging using inference tables. Use these tables to monitor and audit data being sent to and received from model APIs and to improve model quality. See [\_](#model_serving_endpointsnameai_gatewayinference_table_config).
-  
-- - `rate_limits`
-  - Sequence
-  - Configuration for rate limits which can be set to limit endpoint traffic. See [\_](#model_serving_endpointsnameai_gatewayrate_limits).
-  
-- - `usage_tracking_config`
-  - Map
-  - Configuration to enable usage tracking using system tables. These tables allow you to monitor operational usage on endpoints and their associated costs. See [\_](#model_serving_endpointsnameai_gatewayusage_tracking_config).
-  
-:::
-  
-  
-### model_serving_endpoints._name_.ai_gateway.fallback_config
-  
-**`Type: Map`**
-  
-Configuration for traffic fallback which auto fallbacks to other served entities if the request to a served
-entity fails with certain error codes, to increase availability.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `enabled`
-  - Boolean
-  - Whether to enable traffic fallback. When a served entity in the serving endpoint returns specific error codes (e.g. 500), the request will automatically be round-robin attempted with other served entities in the same endpoint, following the order of served entity list, until a successful response is returned. If all attempts fail, return the last response with the error code.
-  
-:::
-  
-  
-### model_serving_endpoints._name_.ai_gateway.guardrails
-  
-**`Type: Map`**
-  
-Configuration for AI Guardrails to prevent unwanted data and unsafe data in requests and responses.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `input`
-  - Map
-  - Configuration for input guardrail filters. See [\_](#model_serving_endpointsnameai_gatewayguardrailsinput).
-  
-- - `output`
-  - Map
-  - Configuration for output guardrail filters. See [\_](#model_serving_endpointsnameai_gatewayguardrailsoutput).
-  
-:::
-  
-  
-### model_serving_endpoints._name_.ai_gateway.guardrails.input
-  
-**`Type: Map`**
-  
-Configuration for input guardrail filters.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `invalid_keywords`
-  - Sequence
-  - This field is deprecated
-  
-- - `pii`
-  - Map
-  - Configuration for guardrail PII filter. See [\_](#model_serving_endpointsnameai_gatewayguardrailsinputpii).
-  
-- - `safety`
-  - Boolean
-  - Indicates whether the safety filter is enabled.
-  
-- - `valid_topics`
-  - Sequence
-  - This field is deprecated
-  
-:::
-  
-  
-### model_serving_endpoints._name_.ai_gateway.guardrails.input.pii
-  
-**`Type: Map`**
-  
-Configuration for guardrail PII filter.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `behavior`
-  - String
-  - Configuration for input guardrail filters.
-  
-:::
-  
-  
-### model_serving_endpoints._name_.ai_gateway.guardrails.output
-  
-**`Type: Map`**
-  
-Configuration for output guardrail filters.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `invalid_keywords`
-  - Sequence
-  - This field is deprecated
-  
-- - `pii`
-  - Map
-  - Configuration for guardrail PII filter. See [\_](#model_serving_endpointsnameai_gatewayguardrailsoutputpii).
-  
-- - `safety`
-  - Boolean
-  - Indicates whether the safety filter is enabled.
-  
-- - `valid_topics`
-  - Sequence
-  - This field is deprecated
-  
-:::
-  
-  
-### model_serving_endpoints._name_.ai_gateway.guardrails.output.pii
-  
-**`Type: Map`**
-  
-Configuration for guardrail PII filter.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `behavior`
-  - String
-  - Configuration for input guardrail filters.
-  
-:::
-  
-  
-### model_serving_endpoints._name_.ai_gateway.inference_table_config
-  
-**`Type: Map`**
-  
-Configuration for payload logging using inference tables.
-Use these tables to monitor and audit data being sent to and received from model APIs and to improve model quality.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `catalog_name`
-  - String
-  - The name of the catalog in Unity Catalog. Required when enabling inference tables. NOTE: On update, you have to disable inference table first in order to change the catalog name.
-  
-- - `enabled`
-  - Boolean
-  - Indicates whether the inference table is enabled.
-  
-- - `schema_name`
-  - String
-  - The name of the schema in Unity Catalog. Required when enabling inference tables. NOTE: On update, you have to disable inference table first in order to change the schema name.
-  
-- - `table_name_prefix`
-  - String
-  - The prefix of the table in Unity Catalog. NOTE: On update, you have to disable inference table first in order to change the prefix name.
-  
-:::
-  
-  
-### model_serving_endpoints._name_.ai_gateway.rate_limits
-  
-**`Type: Sequence`**
-  
-Configuration for rate limits which can be set to limit endpoint traffic.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `calls`
-  - Integer
-  - Used to specify how many calls are allowed for a key within the renewal_period.
-  
-- - `key`
-  - String
-  - Key field for a rate limit. Currently, 'user', 'user_group, 'service_principal', and 'endpoint' are supported, with 'endpoint' being the default if not specified.
-  
-- - `principal`
-  - String
-  - Principal field for a user, user group, or service principal to apply rate limiting to. Accepts a user email, group name, or service principal application ID.
-  
-- - `renewal_period`
-  - String
-  - Renewal period field for a rate limit. Currently, only 'minute' is supported.
-  
-- - `tokens`
-  - Integer
-  - Used to specify how many tokens are allowed for a key within the renewal_period.
-  
-:::
-  
-  
-### model_serving_endpoints._name_.ai_gateway.usage_tracking_config
-  
-**`Type: Map`**
-  
-Configuration to enable usage tracking using system tables.
-These tables allow you to monitor operational usage on endpoints and their associated costs.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `enabled`
-  - Boolean
-  - Whether to enable usage tracking.
-  
-:::
-  
-  
-### model_serving_endpoints._name_.config
-  
-**`Type: Map`**
-  
-The core config of the serving endpoint.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `auto_capture_config`
-  - Map
-  - Configuration for Inference Tables which automatically logs requests and responses to Unity Catalog. Note: this field is deprecated for creating new provisioned throughput endpoints, or updating existing provisioned throughput endpoints that never have inference table configured; in these cases please use AI Gateway to manage inference tables. See [\_](#model_serving_endpointsnameconfigauto_capture_config).
-  
-- - `served_entities`
-  - Sequence
-  - The list of served entities under the serving endpoint config. See [\_](#model_serving_endpointsnameconfigserved_entities).
-  
-- - `served_models`
-  - Sequence
-  - (Deprecated, use served_entities instead) The list of served models under the serving endpoint config. See [\_](#model_serving_endpointsnameconfigserved_models).
-  
-- - `traffic_config`
-  - Map
-  - The traffic configuration associated with the serving endpoint config. See [\_](#model_serving_endpointsnameconfigtraffic_config).
-  
-:::
-  
-  
-### model_serving_endpoints._name_.config.auto_capture_config
-  
-**`Type: Map`**
-  
-Configuration for Inference Tables which automatically logs requests and responses to Unity Catalog.
-Note: this field is deprecated for creating new provisioned throughput endpoints,
-or updating existing provisioned throughput endpoints that never have inference table configured;
-in these cases please use AI Gateway to manage inference tables.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `catalog_name`
-  - String
-  - The name of the catalog in Unity Catalog. NOTE: On update, you cannot change the catalog name if the inference table is already enabled.
-  
-- - `enabled`
-  - Boolean
-  - Indicates whether the inference table is enabled.
-  
-- - `schema_name`
-  - String
-  - The name of the schema in Unity Catalog. NOTE: On update, you cannot change the schema name if the inference table is already enabled.
-  
-- - `table_name_prefix`
-  - String
-  - The prefix of the table in Unity Catalog. NOTE: On update, you cannot change the prefix name if the inference table is already enabled.
-  
-:::
-  
-  
-### model_serving_endpoints._name_.config.served_entities
-  
-**`Type: Sequence`**
-  
-The list of served entities under the serving endpoint config.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `burst_scaling_enabled`
-  - Boolean
-  - Whether burst scaling is enabled. When enabled (default), the endpoint can automatically scale up beyond provisioned capacity to handle traffic spikes. When disabled, the endpoint maintains fixed capacity at provisioned_model_units.
-  
-- - `entity_name`
-  - String
-  - The name of the entity to be served. The entity may be a model in the Databricks Model Registry, a model in the Unity Catalog (UC), or a function of type FEATURE_SPEC in the UC. If it is a UC object, the full name of the object should be given in the form of **catalog_name.schema_name.model_name**.
-  
-- - `entity_version`
-  - String
-  - 
-  
-- - `environment_vars`
-  - Map
-  - An object containing a set of optional, user-specified environment variable key-value pairs used for serving this entity. Note: this is an experimental feature and subject to change. Example entity environment variables that refer to Databricks secrets: `{"OPENAI_API_KEY": "{{secrets/my_scope/my_key}}", "DATABRICKS_TOKEN": "{{secrets/my_scope2/my_key2}}"}`
-  
-- - `external_model`
-  - Map
-  - The external model to be served. NOTE: Only one of external_model and (entity_name, entity_version, workload_size, workload_type, and scale_to_zero_enabled) can be specified with the latter set being used for custom model serving for a Databricks registered model. For an existing endpoint with external_model, it cannot be updated to an endpoint without external_model. If the endpoint is created without external_model, users cannot update it to add external_model later. The task type of all external models within an endpoint must be the same. See [\_](#model_serving_endpointsnameconfigserved_entitiesexternal_model).
-  
-- - `instance_profile_arn`
-  - String
-  - ARN of the instance profile that the served entity uses to access AWS resources.
-  
-- - `max_provisioned_concurrency`
-  - Integer
-  - The maximum provisioned concurrency that the endpoint can scale up to. Do not use if workload_size is specified.
-  
-- - `max_provisioned_throughput`
-  - Integer
-  - The maximum tokens per second that the endpoint can scale up to.
-  
-- - `min_provisioned_concurrency`
-  - Integer
-  - The minimum provisioned concurrency that the endpoint can scale down to. Do not use if workload_size is specified.
-  
-- - `min_provisioned_throughput`
-  - Integer
-  - The minimum tokens per second that the endpoint can scale down to.
-  
-- - `name`
-  - String
-  - The name of a served entity. It must be unique across an endpoint. A served entity name can consist of alphanumeric characters, dashes, and underscores. If not specified for an external model, this field defaults to external_model.name, with '.' and ':' replaced with '-', and if not specified for other entities, it defaults to entity_name-entity_version.
-  
-- - `provisioned_model_units`
-  - Integer
-  - The number of model units provisioned.
-  
-- - `scale_to_zero_enabled`
-  - Boolean
-  - Whether the compute resources for the served entity should scale down to zero.
-  
-- - `workload_size`
-  - String
-  - The workload size of the served entity. The workload size corresponds to a range of provisioned concurrency that the compute autoscales between. A single unit of provisioned concurrency can process one request at a time. Valid workload sizes are "Small" (4 - 4 provisioned concurrency), "Medium" (8 - 16 provisioned concurrency), and "Large" (16 - 64 provisioned concurrency). Additional custom workload sizes can also be used when available in the workspace. If scale-to-zero is enabled, the lower bound of the provisioned concurrency for each workload size is 0. Do not use if min_provisioned_concurrency and max_provisioned_concurrency are specified.
-  
-- - `workload_type`
-  - String
-  - The workload type of the served entity. The workload type selects which type of compute to use in the endpoint. The default value for this parameter is "CPU". For deep learning workloads, GPU acceleration is available by selecting workload types like GPU_SMALL and others. See the available [GPU types](https://docs.databricks.com/en/machine-learning/model-serving/create-manage-serving-endpoints.html#gpu-workload-types).
-  
-:::
-  
-  
-### model_serving_endpoints._name_.config.served_entities.external_model
-  
-**`Type: Map`**
-  
-The external model to be served. NOTE: Only one of external_model and (entity_name, entity_version, workload_size, workload_type, and scale_to_zero_enabled) can be specified with the latter set being used for custom model serving for a Databricks registered model. For an existing endpoint with external_model, it cannot be updated to an endpoint without external_model. If the endpoint is created without external_model, users cannot update it to add external_model later. The task type of all external models within an endpoint must be the same.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `ai21labs_config`
-  - Map
-  - AI21Labs Config. Only required if the provider is 'ai21labs'. See [\_](#model_serving_endpointsnameconfigserved_entitiesexternal_modelai21labs_config).
-  
-- - `amazon_bedrock_config`
-  - Map
-  - Amazon Bedrock Config. Only required if the provider is 'amazon-bedrock'. See [\_](#model_serving_endpointsnameconfigserved_entitiesexternal_modelamazon_bedrock_config).
-  
-- - `anthropic_config`
-  - Map
-  - Anthropic Config. Only required if the provider is 'anthropic'. See [\_](#model_serving_endpointsnameconfigserved_entitiesexternal_modelanthropic_config).
-  
-- - `cohere_config`
-  - Map
-  - Cohere Config. Only required if the provider is 'cohere'. See [\_](#model_serving_endpointsnameconfigserved_entitiesexternal_modelcohere_config).
-  
-- - `custom_provider_config`
-  - Map
-  - Custom Provider Config. Only required if the provider is 'custom'. See [\_](#model_serving_endpointsnameconfigserved_entitiesexternal_modelcustom_provider_config).
-  
-- - `databricks_model_serving_config`
-  - Map
-  - Databricks Model Serving Config. Only required if the provider is 'databricks-model-serving'. See [\_](#model_serving_endpointsnameconfigserved_entitiesexternal_modeldatabricks_model_serving_config).
-  
-- - `google_cloud_vertex_ai_config`
-  - Map
-  - Google Cloud Vertex AI Config. Only required if the provider is 'google-cloud-vertex-ai'. See [\_](#model_serving_endpointsnameconfigserved_entitiesexternal_modelgoogle_cloud_vertex_ai_config).
-  
-- - `name`
-  - String
-  - The name of the external model.
-  
-- - `openai_config`
-  - Map
-  - OpenAI Config. Only required if the provider is 'openai'. See [\_](#model_serving_endpointsnameconfigserved_entitiesexternal_modelopenai_config).
-  
-- - `palm_config`
-  - Map
-  - PaLM Config. Only required if the provider is 'palm'. See [\_](#model_serving_endpointsnameconfigserved_entitiesexternal_modelpalm_config).
-  
-- - `provider`
-  - String
-  - The name of the provider for the external model. Currently, the supported providers are 'ai21labs', 'anthropic', 'amazon-bedrock', 'cohere', 'databricks-model-serving', 'google-cloud-vertex-ai', 'openai', 'palm', and 'custom'.
-  
-- - `task`
-  - String
-  - The task type of the external model.
-  
-:::
-  
-  
-### model_serving_endpoints._name_.config.served_entities.external_model.ai21labs_config
-  
-**`Type: Map`**
-  
-AI21Labs Config. Only required if the provider is 'ai21labs'.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `ai21labs_api_key`
-  - String
-  - The Databricks secret key reference for an AI21 Labs API key. If you prefer to paste your API key directly, see `ai21labs_api_key_plaintext`. You must provide an API key using one of the following fields: `ai21labs_api_key` or `ai21labs_api_key_plaintext`.
-  
-- - `ai21labs_api_key_plaintext`
-  - String
-  - An AI21 Labs API key provided as a plaintext string. If you prefer to reference your key using Databricks Secrets, see `ai21labs_api_key`. You must provide an API key using one of the following fields: `ai21labs_api_key` or `ai21labs_api_key_plaintext`.
-  
-:::
-  
-  
-### model_serving_endpoints._name_.config.served_entities.external_model.amazon_bedrock_config
-  
-**`Type: Map`**
-  
-Amazon Bedrock Config. Only required if the provider is 'amazon-bedrock'.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `aws_access_key_id`
-  - String
-  - The Databricks secret key reference for an AWS access key ID with permissions to interact with Bedrock services. If you prefer to paste your API key directly, see `aws_access_key_id_plaintext`. You must provide an API key using one of the following fields: `aws_access_key_id` or `aws_access_key_id_plaintext`.
-  
-- - `aws_access_key_id_plaintext`
-  - String
-  - An AWS access key ID with permissions to interact with Bedrock services provided as a plaintext string. If you prefer to reference your key using Databricks Secrets, see `aws_access_key_id`. You must provide an API key using one of the following fields: `aws_access_key_id` or `aws_access_key_id_plaintext`.
-  
-- - `aws_region`
-  - String
-  - The AWS region to use. Bedrock has to be enabled there.
-  
-- - `aws_secret_access_key`
-  - String
-  - The Databricks secret key reference for an AWS secret access key paired with the access key ID, with permissions to interact with Bedrock services. If you prefer to paste your API key directly, see `aws_secret_access_key_plaintext`. You must provide an API key using one of the following fields: `aws_secret_access_key` or `aws_secret_access_key_plaintext`.
-  
-- - `aws_secret_access_key_plaintext`
-  - String
-  - An AWS secret access key paired with the access key ID, with permissions to interact with Bedrock services provided as a plaintext string. If you prefer to reference your key using Databricks Secrets, see `aws_secret_access_key`. You must provide an API key using one of the following fields: `aws_secret_access_key` or `aws_secret_access_key_plaintext`.
-  
-- - `bedrock_provider`
-  - String
-  - The underlying provider in Amazon Bedrock. Supported values (case insensitive) include: Anthropic, Cohere, AI21Labs, Amazon.
-  
-- - `instance_profile_arn`
-  - String
-  - ARN of the instance profile that the external model will use to access AWS resources. You must authenticate using an instance profile or access keys. If you prefer to authenticate using access keys, see `aws_access_key_id`, `aws_access_key_id_plaintext`, `aws_secret_access_key` and `aws_secret_access_key_plaintext`.
-  
-:::
-  
-  
-### model_serving_endpoints._name_.config.served_entities.external_model.anthropic_config
-  
-**`Type: Map`**
-  
-Anthropic Config. Only required if the provider is 'anthropic'.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `anthropic_api_key`
-  - String
-  - The Databricks secret key reference for an Anthropic API key. If you prefer to paste your API key directly, see `anthropic_api_key_plaintext`. You must provide an API key using one of the following fields: `anthropic_api_key` or `anthropic_api_key_plaintext`.
-  
-- - `anthropic_api_key_plaintext`
-  - String
-  - The Anthropic API key provided as a plaintext string. If you prefer to reference your key using Databricks Secrets, see `anthropic_api_key`. You must provide an API key using one of the following fields: `anthropic_api_key` or `anthropic_api_key_plaintext`.
-  
-:::
-  
-  
-### model_serving_endpoints._name_.config.served_entities.external_model.cohere_config
-  
-**`Type: Map`**
-  
-Cohere Config. Only required if the provider is 'cohere'.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `cohere_api_base`
-  - String
-  - This is an optional field to provide a customized base URL for the Cohere API. If left unspecified, the standard Cohere base URL is used.
-  
-- - `cohere_api_key`
-  - String
-  - The Databricks secret key reference for a Cohere API key. If you prefer to paste your API key directly, see `cohere_api_key_plaintext`. You must provide an API key using one of the following fields: `cohere_api_key` or `cohere_api_key_plaintext`.
-  
-- - `cohere_api_key_plaintext`
-  - String
-  - The Cohere API key provided as a plaintext string. If you prefer to reference your key using Databricks Secrets, see `cohere_api_key`. You must provide an API key using one of the following fields: `cohere_api_key` or `cohere_api_key_plaintext`.
-  
-:::
-  
-  
-### model_serving_endpoints._name_.config.served_entities.external_model.custom_provider_config
-  
-**`Type: Map`**
-  
-Custom Provider Config. Only required if the provider is 'custom'.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `api_key_auth`
-  - Map
-  - This is a field to provide API key authentication for the custom provider API. You can only specify one authentication method. See [\_](#model_serving_endpointsnameconfigserved_entitiesexternal_modelcustom_provider_configapi_key_auth).
-  
-- - `bearer_token_auth`
-  - Map
-  - This is a field to provide bearer token authentication for the custom provider API. You can only specify one authentication method. See [\_](#model_serving_endpointsnameconfigserved_entitiesexternal_modelcustom_provider_configbearer_token_auth).
-  
-- - `custom_provider_url`
-  - String
-  - This is a field to provide the URL of the custom provider API.
-  
-:::
-  
-  
-### model_serving_endpoints._name_.config.served_entities.external_model.custom_provider_config.api_key_auth
-  
-**`Type: Map`**
-  
-This is a field to provide API key authentication for the custom provider API.
-You can only specify one authentication method.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `key`
-  - String
-  - The name of the API key parameter used for authentication.
-  
-- - `value`
-  - String
-  - The Databricks secret key reference for an API Key. If you prefer to paste your token directly, see `value_plaintext`.
-  
-- - `value_plaintext`
-  - String
-  - The API Key provided as a plaintext string. If you prefer to reference your token using Databricks Secrets, see `value`.
-  
-:::
-  
-  
-### model_serving_endpoints._name_.config.served_entities.external_model.custom_provider_config.bearer_token_auth
-  
-**`Type: Map`**
-  
-This is a field to provide bearer token authentication for the custom provider API.
-You can only specify one authentication method.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `token`
-  - String
-  - The Databricks secret key reference for a token. If you prefer to paste your token directly, see `token_plaintext`.
-  
-- - `token_plaintext`
-  - String
-  - The token provided as a plaintext string. If you prefer to reference your token using Databricks Secrets, see `token`.
-  
-:::
-  
-  
-### model_serving_endpoints._name_.config.served_entities.external_model.databricks_model_serving_config
-  
-**`Type: Map`**
-  
-Databricks Model Serving Config. Only required if the provider is 'databricks-model-serving'.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `databricks_api_token`
-  - String
-  - The Databricks secret key reference for a Databricks API token that corresponds to a user or service principal with Can Query access to the model serving endpoint pointed to by this external model. If you prefer to paste your API key directly, see `databricks_api_token_plaintext`. You must provide an API key using one of the following fields: `databricks_api_token` or `databricks_api_token_plaintext`.
-  
-- - `databricks_api_token_plaintext`
-  - String
-  - The Databricks API token that corresponds to a user or service principal with Can Query access to the model serving endpoint pointed to by this external model provided as a plaintext string. If you prefer to reference your key using Databricks Secrets, see `databricks_api_token`. You must provide an API key using one of the following fields: `databricks_api_token` or `databricks_api_token_plaintext`.
-  
-- - `databricks_workspace_url`
-  - String
-  - The URL of the Databricks workspace containing the model serving endpoint pointed to by this external model.
-  
-:::
-  
-  
-### model_serving_endpoints._name_.config.served_entities.external_model.google_cloud_vertex_ai_config
-  
-**`Type: Map`**
-  
-Google Cloud Vertex AI Config. Only required if the provider is 'google-cloud-vertex-ai'.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `private_key`
-  - String
-  - The Databricks secret key reference for a private key for the service account which has access to the Google Cloud Vertex AI Service. See [Best practices for managing service account keys]. If you prefer to paste your API key directly, see `private_key_plaintext`. You must provide an API key using one of the following fields: `private_key` or `private_key_plaintext`  [Best practices for managing service account keys]: https://cloud.google.com/iam/docs/best-practices-for-managing-service-account-keys
-  
-- - `private_key_plaintext`
-  - String
-  - The private key for the service account which has access to the Google Cloud Vertex AI Service provided as a plaintext secret. See [Best practices for managing service account keys]. If you prefer to reference your key using Databricks Secrets, see `private_key`. You must provide an API key using one of the following fields: `private_key` or `private_key_plaintext`.  [Best practices for managing service account keys]: https://cloud.google.com/iam/docs/best-practices-for-managing-service-account-keys
-  
-- - `project_id`
-  - String
-  - This is the Google Cloud project id that the service account is associated with.
-  
-- - `region`
-  - String
-  - This is the region for the Google Cloud Vertex AI Service. See [supported regions] for more details. Some models are only available in specific regions.  [supported regions]: https://cloud.google.com/vertex-ai/docs/general/locations
-  
-:::
-  
-  
-### model_serving_endpoints._name_.config.served_entities.external_model.openai_config
-  
-**`Type: Map`**
-  
-OpenAI Config. Only required if the provider is 'openai'.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `microsoft_entra_client_id`
-  - String
-  - This field is only required for Azure AD OpenAI and is the Microsoft Entra Client ID.
-  
-- - `microsoft_entra_client_secret`
-  - String
-  - The Databricks secret key reference for a client secret used for Microsoft Entra ID authentication. If you prefer to paste your client secret directly, see `microsoft_entra_client_secret_plaintext`. You must provide an API key using one of the following fields: `microsoft_entra_client_secret` or `microsoft_entra_client_secret_plaintext`.
-  
-- - `microsoft_entra_client_secret_plaintext`
-  - String
-  - The client secret used for Microsoft Entra ID authentication provided as a plaintext string. If you prefer to reference your key using Databricks Secrets, see `microsoft_entra_client_secret`. You must provide an API key using one of the following fields: `microsoft_entra_client_secret` or `microsoft_entra_client_secret_plaintext`.
-  
-- - `microsoft_entra_tenant_id`
-  - String
-  - This field is only required for Azure AD OpenAI and is the Microsoft Entra Tenant ID.
-  
-- - `openai_api_base`
-  - String
-  - This is a field to provide a customized base URl for the OpenAI API. For Azure OpenAI, this field is required, and is the base URL for the Azure OpenAI API service provided by Azure. For other OpenAI API types, this field is optional, and if left unspecified, the standard OpenAI base URL is used.
-  
-- - `openai_api_key`
-  - String
-  - The Databricks secret key reference for an OpenAI API key using the OpenAI or Azure service. If you prefer to paste your API key directly, see `openai_api_key_plaintext`. You must provide an API key using one of the following fields: `openai_api_key` or `openai_api_key_plaintext`.
-  
-- - `openai_api_key_plaintext`
-  - String
-  - The OpenAI API key using the OpenAI or Azure service provided as a plaintext string. If you prefer to reference your key using Databricks Secrets, see `openai_api_key`. You must provide an API key using one of the following fields: `openai_api_key` or `openai_api_key_plaintext`.
-  
-- - `openai_api_type`
-  - String
-  - This is an optional field to specify the type of OpenAI API to use. For Azure OpenAI, this field is required, and adjust this parameter to represent the preferred security access validation protocol. For access token validation, use azure. For authentication using Azure Active Directory (Azure AD) use, azuread.
-  
-- - `openai_api_version`
-  - String
-  - This is an optional field to specify the OpenAI API version. For Azure OpenAI, this field is required, and is the version of the Azure OpenAI service to utilize, specified by a date.
-  
-- - `openai_deployment_name`
-  - String
-  - This field is only required for Azure OpenAI and is the name of the deployment resource for the Azure OpenAI service.
-  
-- - `openai_organization`
-  - String
-  - This is an optional field to specify the organization in OpenAI or Azure OpenAI.
-  
-:::
-  
-  
-### model_serving_endpoints._name_.config.served_entities.external_model.palm_config
-  
-**`Type: Map`**
-  
-PaLM Config. Only required if the provider is 'palm'.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `palm_api_key`
-  - String
-  - The Databricks secret key reference for a PaLM API key. If you prefer to paste your API key directly, see `palm_api_key_plaintext`. You must provide an API key using one of the following fields: `palm_api_key` or `palm_api_key_plaintext`.
-  
-- - `palm_api_key_plaintext`
-  - String
-  - The PaLM API key provided as a plaintext string. If you prefer to reference your key using Databricks Secrets, see `palm_api_key`. You must provide an API key using one of the following fields: `palm_api_key` or `palm_api_key_plaintext`.
-  
-:::
-  
-  
-### model_serving_endpoints._name_.config.served_models
-  
-**`Type: Sequence`**
-  
-(Deprecated, use served_entities instead) The list of served models under the serving endpoint config.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `burst_scaling_enabled`
-  - Boolean
-  - Whether burst scaling is enabled. When enabled (default), the endpoint can automatically scale up beyond provisioned capacity to handle traffic spikes. When disabled, the endpoint maintains fixed capacity at provisioned_model_units.
-  
-- - `environment_vars`
-  - Map
-  - An object containing a set of optional, user-specified environment variable key-value pairs used for serving this entity. Note: this is an experimental feature and subject to change. Example entity environment variables that refer to Databricks secrets: `{"OPENAI_API_KEY": "{{secrets/my_scope/my_key}}", "DATABRICKS_TOKEN": "{{secrets/my_scope2/my_key2}}"}`
-  
-- - `instance_profile_arn`
-  - String
-  - ARN of the instance profile that the served entity uses to access AWS resources.
-  
-- - `max_provisioned_concurrency`
-  - Integer
-  - The maximum provisioned concurrency that the endpoint can scale up to. Do not use if workload_size is specified.
-  
-- - `max_provisioned_throughput`
-  - Integer
-  - The maximum tokens per second that the endpoint can scale up to.
-  
-- - `min_provisioned_concurrency`
-  - Integer
-  - The minimum provisioned concurrency that the endpoint can scale down to. Do not use if workload_size is specified.
-  
-- - `min_provisioned_throughput`
-  - Integer
-  - The minimum tokens per second that the endpoint can scale down to.
-  
-- - `model_name`
-  - String
-  - 
-  
-- - `model_version`
-  - String
-  - 
-  
-- - `name`
-  - String
-  - The name of a served entity. It must be unique across an endpoint. A served entity name can consist of alphanumeric characters, dashes, and underscores. If not specified for an external model, this field defaults to external_model.name, with '.' and ':' replaced with '-', and if not specified for other entities, it defaults to entity_name-entity_version.
-  
-- - `provisioned_model_units`
-  - Integer
-  - The number of model units provisioned.
-  
-- - `scale_to_zero_enabled`
-  - Boolean
-  - Whether the compute resources for the served entity should scale down to zero.
-  
-- - `workload_size`
-  - String
-  - The workload size of the served entity. The workload size corresponds to a range of provisioned concurrency that the compute autoscales between. A single unit of provisioned concurrency can process one request at a time. Valid workload sizes are "Small" (4 - 4 provisioned concurrency), "Medium" (8 - 16 provisioned concurrency), and "Large" (16 - 64 provisioned concurrency). Additional custom workload sizes can also be used when available in the workspace. If scale-to-zero is enabled, the lower bound of the provisioned concurrency for each workload size is 0. Do not use if min_provisioned_concurrency and max_provisioned_concurrency are specified.
-  
-- - `workload_type`
-  - String
-  - The workload type of the served entity. The workload type selects which type of compute to use in the endpoint. The default value for this parameter is "CPU". For deep learning workloads, GPU acceleration is available by selecting workload types like GPU_SMALL and others. See the available [GPU types](https://docs.databricks.com/en/machine-learning/model-serving/create-manage-serving-endpoints.html#gpu-workload-types).
-  
-:::
-  
-  
-### model_serving_endpoints._name_.config.traffic_config
-  
-**`Type: Map`**
-  
-The traffic configuration associated with the serving endpoint config.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `routes`
-  - Sequence
-  - The list of routes that define traffic to each served entity. See [\_](#model_serving_endpointsnameconfigtraffic_configroutes).
-  
-:::
-  
-  
-### model_serving_endpoints._name_.config.traffic_config.routes
-  
-**`Type: Sequence`**
-  
-The list of routes that define traffic to each served entity.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `served_entity_name`
-  - String
-  - 
-  
-- - `served_model_name`
-  - String
-  - The name of the served model this route configures traffic for.
-  
-- - `traffic_percentage`
-  - Integer
-  - The percentage of endpoint traffic to send to this route. It must be an integer between 0 and 100 inclusive.
-  
-:::
-  
-  
-### model_serving_endpoints._name_.email_notifications
-  
-**`Type: Map`**
-  
-Email notification settings.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `on_update_failure`
-  - Sequence
-  - A list of email addresses to be notified when an endpoint fails to update its configuration or state.
-  
-- - `on_update_success`
-  - Sequence
-  - A list of email addresses to be notified when an endpoint successfully updates its configuration or state.
-  
-:::
-  
-  
-### model_serving_endpoints._name_.lifecycle
-  
-**`Type: Map`**
-  
-Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-### model_serving_endpoints._name_.permissions
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `group_name`
-  - String
-  - 
-  
-- - `level`
-  - String
-  - Permission level
-  
-- - `service_principal_name`
-  - String
-  - 
-  
-- - `user_name`
-  - String
-  - 
-  
-:::
-  
-  
-### model_serving_endpoints._name_.tags
-  
-**`Type: Sequence`**
-  
-Tags to be attached to the serving endpoint and automatically propagated to billing logs.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `key`
-  - String
-  - Key field for a serving endpoint tag.
-  
-- - `value`
-  - String
-  - Optional value field for a serving endpoint tag.
-  
-:::
-  
-  
-## models
-  
-**`Type: Map`**
-  
-The model resource allows you to define [legacy models](/api/workspace/modelregistry/createmodel) in bundles. Databricks recommends you use Unity Catalog [registered models](#registered-model) instead.
-  
-```yaml
-models:
-  <model-name>:
-    <model-field-name>: <model-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `description`
-  - String
-  - Optional description for registered model.
-  
-- - `lifecycle`
-  - Map
-  - Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed. See [\_](#modelsnamelifecycle).
-  
-- - `name`
-  - String
-  - Register models under this name
-  
-- - `permissions`
-  - Sequence
-  - See [\_](#modelsnamepermissions).
-  
-- - `tags`
-  - Sequence
-  - Additional metadata for registered model. See [\_](#modelsnametags).
-  
-:::
-  
-  
-### models._name_.lifecycle
-  
-**`Type: Map`**
-  
-Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-### models._name_.permissions
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `group_name`
-  - String
-  - 
-  
-- - `level`
-  - String
-  - Permission level
-  
-- - `service_principal_name`
-  - String
-  - 
-  
-- - `user_name`
-  - String
-  - 
-  
-:::
-  
-  
-### models._name_.tags
-  
-**`Type: Sequence`**
-  
-Additional metadata for registered model.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `key`
-  - String
-  - The tag key.
-  
-- - `value`
-  - String
-  - The tag value.
-  
-:::
-  
-  
-## pipelines
-  
-**`Type: Map`**
-  
-This resource allows you to create [pipelines](/api/workspace/pipelines/create). For information about pipelines, see [_](/dlt/index.md). For a tutorial that uses the Declarative Automation Bundles template to create a pipeline, see [_](/dev-tools/bundles/pipelines-tutorial.md).
-  
-```yaml
-pipelines:
-  <pipeline-name>:
-    <pipeline-field-name>: <pipeline-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `allow_duplicate_names`
-  - Boolean
-  - If false, deployment will fail if name conflicts with that of another pipeline.
-  
-- - `budget_policy_id`
-  - String
-  - Budget policy of this pipeline.
-  
-- - `catalog`
-  - String
-  - A catalog in Unity Catalog to publish data from this pipeline to. If `target` is specified, tables in this pipeline are published to a `target` schema inside `catalog` (for example, `catalog`.`target`.`table`). If `target` is not specified, no data is published to Unity Catalog.
-  
-- - `channel`
-  - String
-  - DLT Release Channel that specifies which version to use.
-  
-- - `clusters`
-  - Sequence
-  - Cluster settings for this pipeline deployment. See [\_](#pipelinesnameclusters).
-  
-- - `configuration`
-  - Map
-  - String-String configuration for this pipeline execution.
-  
-- - `continuous`
-  - Boolean
-  - Whether the pipeline is continuous or triggered. This replaces `trigger`.
-  
-- - `deployment`
-  - Map
-  - Deployment type of this pipeline. See [\_](#pipelinesnamedeployment).
-  
-- - `development`
-  - Boolean
-  - Whether the pipeline is in Development mode. Defaults to false.
-  
-- - `dry_run`
-  - Boolean
-  - 
-  
-- - `edition`
-  - String
-  - Pipeline product edition.
-  
-- - `environment`
-  - Map
-  - Environment specification for this pipeline used to install dependencies. See [\_](#pipelinesnameenvironment).
-  
-- - `event_log`
-  - Map
-  - Event log configuration for this pipeline. See [\_](#pipelinesnameevent_log).
-  
-- - `filters`
-  - Map
-  - Filters on which Pipeline packages to include in the deployed graph. See [\_](#pipelinesnamefilters).
-  
-- - `id`
-  - String
-  - Unique identifier for this pipeline.
-  
-- - `ingestion_definition`
-  - Map
-  - The configuration for a managed ingestion pipeline. These settings cannot be used with the 'libraries', 'schema', 'target', or 'catalog' settings. See [\_](#pipelinesnameingestion_definition).
-  
-- - `libraries`
-  - Sequence
-  - Libraries or code needed by this deployment. See [\_](#pipelinesnamelibraries).
-  
-- - `lifecycle`
-  - Map
-  - Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed. See [\_](#pipelinesnamelifecycle).
-  
-- - `name`
-  - String
-  - Friendly identifier for this pipeline.
-  
-- - `notifications`
-  - Sequence
-  - List of notification settings for this pipeline. See [\_](#pipelinesnamenotifications).
-  
-- - `permissions`
-  - Sequence
-  - See [\_](#pipelinesnamepermissions).
-  
-- - `photon`
-  - Boolean
-  - Whether Photon is enabled for this pipeline.
-  
-- - `root_path`
-  - String
-  - Root path for this pipeline. This is used as the root directory when editing the pipeline in the Databricks user interface and it is added to sys.path when executing Python sources during pipeline execution.
-  
-- - `run_as`
-  - Map
-  - Write-only setting, available only in Create/Update calls. Specifies the user or service principal that the pipeline runs as. If not specified, the pipeline runs as the user who created the pipeline.  Only `user_name` or `service_principal_name` can be specified. If both are specified, an error is thrown. See [\_](#pipelinesnamerun_as).
-  
-- - `schema`
-  - String
-  - The default schema (database) where tables are read from or published to.
-  
-- - `serverless`
-  - Boolean
-  - Whether serverless compute is enabled for this pipeline.
-  
-- - `storage`
-  - String
-  - DBFS root directory for storing checkpoints and tables.
-  
-- - `tags`
-  - Map
-  - A map of tags associated with the pipeline. These are forwarded to the cluster as cluster tags, and are therefore subject to the same limitations. A maximum of 25 tags can be added to the pipeline.
-  
-- - `target`
-  - String
-  - This field is deprecated
-  
-- - `trigger`
-  - Map
-  - Use continuous instead
-  
-:::
-  
-  
-**Example**
-  
-The following example defines a pipeline with the resource key `hello-pipeline`:
-
-```yaml
-resources:
-  pipelines:
-    hello-pipeline:
-      name: hello-pipeline
-      clusters:
-        - label: default
-          num_workers: 1
-      development: true
-      continuous: false
-      channel: CURRENT
-      edition: CORE
-      photon: false
-      libraries:
-        - notebook:
-            path: ./pipeline.py
-```
-  
-### pipelines._name_.clusters
-  
-**`Type: Sequence`**
-  
-Cluster settings for this pipeline deployment.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `apply_policy_default_values`
-  - Boolean
-  - Note: This field won't be persisted. Only API users will check this field.
-  
-- - `autoscale`
-  - Map
-  - Parameters needed in order to automatically scale clusters up and down based on load. Note: autoscaling works best with DB runtime versions 3.0 or later. See [\_](#pipelinesnameclustersautoscale).
-  
-- - `aws_attributes`
-  - Map
-  - Attributes related to clusters running on Amazon Web Services. If not specified at cluster creation, a set of default values will be used. See [\_](#pipelinesnameclustersaws_attributes).
-  
-- - `azure_attributes`
-  - Map
-  - Attributes related to clusters running on Microsoft Azure. If not specified at cluster creation, a set of default values will be used. See [\_](#pipelinesnameclustersazure_attributes).
-  
-- - `cluster_log_conf`
-  - Map
-  - The configuration for delivering spark logs to a long-term storage destination. Only dbfs destinations are supported. Only one destination can be specified for one cluster. If the conf is given, the logs will be delivered to the destination every `5 mins`. The destination of driver logs is `$destination/$clusterId/driver`, while the destination of executor logs is `$destination/$clusterId/executor`. See [\_](#pipelinesnameclusterscluster_log_conf).
-  
-- - `custom_tags`
-  - Map
-  - Additional tags for cluster resources. Databricks will tag all cluster resources (e.g., AWS instances and EBS volumes) with these tags in addition to `default_tags`. Notes:  - Currently, Databricks allows at most 45 custom tags  - Clusters can only reuse cloud resources if the resources' tags are a subset of the cluster tags
-  
-- - `driver_instance_pool_id`
-  - String
-  - The optional ID of the instance pool for the driver of the cluster belongs. The pool cluster uses the instance pool with id (instance_pool_id) if the driver pool is not assigned.
-  
-- - `driver_node_type_id`
-  - String
-  - The node type of the Spark driver. Note that this field is optional; if unset, the driver node type will be set as the same value as `node_type_id` defined above.
-  
-- - `enable_local_disk_encryption`
-  - Boolean
-  - Whether to enable local disk encryption for the cluster.
-  
-- - `gcp_attributes`
-  - Map
-  - Attributes related to clusters running on Google Cloud Platform. If not specified at cluster creation, a set of default values will be used. See [\_](#pipelinesnameclustersgcp_attributes).
-  
-- - `init_scripts`
-  - Sequence
-  - The configuration for storing init scripts. Any number of destinations can be specified. The scripts are executed sequentially in the order provided. If `cluster_log_conf` is specified, init script logs are sent to `<destination>/<cluster-ID>/init_scripts`. See [\_](#pipelinesnameclustersinit_scripts).
-  
-- - `instance_pool_id`
-  - String
-  - The optional ID of the instance pool to which the cluster belongs.
-  
-- - `label`
-  - String
-  - A label for the cluster specification, either `default` to configure the default cluster, or `maintenance` to configure the maintenance cluster. This field is optional. The default value is `default`.
-  
-- - `node_type_id`
-  - String
-  - This field encodes, through a single value, the resources available to each of the Spark nodes in this cluster. For example, the Spark nodes can be provisioned and optimized for memory or compute intensive workloads. A list of available node types can be retrieved by using the :method:clusters/listNodeTypes API call.
-  
-- - `num_workers`
-  - Integer
-  - Number of worker nodes that this cluster should have. A cluster has one Spark Driver and `num_workers` Executors for a total of `num_workers` + 1 Spark nodes.  Note: When reading the properties of a cluster, this field reflects the desired number of workers rather than the actual current number of workers. For instance, if a cluster is resized from 5 to 10 workers, this field will immediately be updated to reflect the target size of 10 workers, whereas the workers listed in `spark_info` will gradually increase from 5 to 10 as the new nodes are provisioned.
-  
-- - `policy_id`
-  - String
-  - The ID of the cluster policy used to create the cluster if applicable.
-  
-- - `spark_conf`
-  - Map
-  - An object containing a set of optional, user-specified Spark configuration key-value pairs. See :method:clusters/create for more details.
-  
-- - `spark_env_vars`
-  - Map
-  - An object containing a set of optional, user-specified environment variable key-value pairs. Please note that key-value pair of the form (X,Y) will be exported as is (i.e., `export X='Y'`) while launching the driver and workers.  In order to specify an additional set of `SPARK_DAEMON_JAVA_OPTS`, we recommend appending them to `$SPARK_DAEMON_JAVA_OPTS` as shown in the example below. This ensures that all default databricks managed environmental variables are included as well.  Example Spark environment variables: `{"SPARK_WORKER_MEMORY": "28000m", "SPARK_LOCAL_DIRS": "/local_disk0"}` or `{"SPARK_DAEMON_JAVA_OPTS": "$SPARK_DAEMON_JAVA_OPTS -Dspark.shuffle.service.enabled=true"}`
-  
-- - `ssh_public_keys`
-  - Sequence
-  - SSH public key contents that will be added to each Spark node in this cluster. The corresponding private keys can be used to login with the user name `ubuntu` on port `2200`. Up to 10 keys can be specified.
-  
-:::
-  
-  
-### pipelines._name_.clusters.autoscale
-  
-**`Type: Map`**
-  
-Parameters needed in order to automatically scale clusters up and down based on load.
-Note: autoscaling works best with DB runtime versions 3.0 or later.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `max_workers`
-  - Integer
-  - The maximum number of workers to which the cluster can scale up when overloaded. `max_workers` must be strictly greater than `min_workers`.
-  
-- - `min_workers`
-  - Integer
-  - The minimum number of workers the cluster can scale down to when underutilized. It is also the initial number of workers the cluster will have after creation.
-  
-- - `mode`
-  - String
-  - Databricks Enhanced Autoscaling optimizes cluster utilization by automatically allocating cluster resources based on workload volume, with minimal impact to the data processing latency of your pipelines. Enhanced Autoscaling is available for `updates` clusters only. The legacy autoscaling feature is used for `maintenance` clusters.
-  
-:::
-  
-  
-### pipelines._name_.clusters.aws_attributes
-  
-**`Type: Map`**
-  
-Attributes related to clusters running on Amazon Web Services.
-If not specified at cluster creation, a set of default values will be used.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `availability`
-  - String
-  - Availability type used for all subsequent nodes past the `first_on_demand` ones.  Note: If `first_on_demand` is zero, this availability type will be used for the entire cluster.
-  
-- - `ebs_volume_count`
-  - Integer
-  - The number of volumes launched for each instance. Users can choose up to 10 volumes. This feature is only enabled for supported node types. Legacy node types cannot specify custom EBS volumes. For node types with no instance store, at least one EBS volume needs to be specified; otherwise, cluster creation will fail.  These EBS volumes will be mounted at `/ebs0`, `/ebs1`, and etc. Instance store volumes will be mounted at `/local_disk0`, `/local_disk1`, and etc.  If EBS volumes are attached, Databricks will configure Spark to use only the EBS volumes for scratch storage because heterogenously sized scratch devices can lead to inefficient disk utilization. If no EBS volumes are attached, Databricks will configure Spark to use instance store volumes.  Please note that if EBS volumes are specified, then the Spark configuration `spark.local.dir` will be overridden.
-  
-- - `ebs_volume_iops`
-  - Integer
-  - If using gp3 volumes, what IOPS to use for the disk. If this is not set, the maximum performance of a gp2 volume with the same volume size will be used.
-  
-- - `ebs_volume_size`
-  - Integer
-  - The size of each EBS volume (in GiB) launched for each instance. For general purpose SSD, this value must be within the range 100 - 4096. For throughput optimized HDD, this value must be within the range 500 - 4096.
-  
-- - `ebs_volume_throughput`
-  - Integer
-  - If using gp3 volumes, what throughput to use for the disk. If this is not set, the maximum performance of a gp2 volume with the same volume size will be used.
-  
-- - `ebs_volume_type`
-  - String
-  - All EBS volume types that Databricks supports. See https://aws.amazon.com/ebs/details/ for details.
-  
-- - `first_on_demand`
-  - Integer
-  - The first `first_on_demand` nodes of the cluster will be placed on on-demand instances. If this value is greater than 0, the cluster driver node in particular will be placed on an on-demand instance. If this value is greater than or equal to the current cluster size, all nodes will be placed on on-demand instances. If this value is less than the current cluster size, `first_on_demand` nodes will be placed on on-demand instances and the remainder will be placed on `availability` instances. Note that this value does not affect cluster size and cannot currently be mutated over the lifetime of a cluster.
-  
-- - `instance_profile_arn`
-  - String
-  - Nodes for this cluster will only be placed on AWS instances with this instance profile. If ommitted, nodes will be placed on instances without an IAM instance profile. The instance profile must have previously been added to the Databricks environment by an account administrator.  This feature may only be available to certain customer plans.
-  
-- - `spot_bid_price_percent`
-  - Integer
-  - The bid price for AWS spot instances, as a percentage of the corresponding instance type's on-demand price. For example, if this field is set to 50, and the cluster needs a new `r3.xlarge` spot instance, then the bid price is half of the price of on-demand `r3.xlarge` instances. Similarly, if this field is set to 200, the bid price is twice the price of on-demand `r3.xlarge` instances. If not specified, the default value is 100. When spot instances are requested for this cluster, only spot instances whose bid price percentage matches this field will be considered. Note that, for safety, we enforce this field to be no more than 10000.
-  
-- - `zone_id`
-  - String
-  - Identifier for the availability zone/datacenter in which the cluster resides. This string will be of a form like "us-west-2a". The provided availability zone must be in the same region as the Databricks deployment. For example, "us-west-2a" is not a valid zone id if the Databricks deployment resides in the "us-east-1" region. This is an optional field at cluster creation, and if not specified, the zone "auto" will be used. If the zone specified is "auto", will try to place cluster in a zone with high availability, and will retry placement in a different AZ if there is not enough capacity.  The list of available zones as well as the default value can be found by using the `List Zones` method.
-  
-:::
-  
-  
-### pipelines._name_.clusters.azure_attributes
-  
-**`Type: Map`**
-  
-Attributes related to clusters running on Microsoft Azure.
-If not specified at cluster creation, a set of default values will be used.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `availability`
-  - String
-  - Availability type used for all subsequent nodes past the `first_on_demand` ones. Note: If `first_on_demand` is zero, this availability type will be used for the entire cluster.
-  
-- - `first_on_demand`
-  - Integer
-  - The first `first_on_demand` nodes of the cluster will be placed on on-demand instances. This value should be greater than 0, to make sure the cluster driver node is placed on an on-demand instance. If this value is greater than or equal to the current cluster size, all nodes will be placed on on-demand instances. If this value is less than the current cluster size, `first_on_demand` nodes will be placed on on-demand instances and the remainder will be placed on `availability` instances. Note that this value does not affect cluster size and cannot currently be mutated over the lifetime of a cluster.
-  
-- - `log_analytics_info`
-  - Map
-  - Defines values necessary to configure and run Azure Log Analytics agent. See [\_](#pipelinesnameclustersazure_attributeslog_analytics_info).
-  
-- - `spot_bid_max_price`
-  - Any
-  - The max bid price to be used for Azure spot instances. The Max price for the bid cannot be higher than the on-demand price of the instance. If not specified, the default value is -1, which specifies that the instance cannot be evicted on the basis of price, and only on the basis of availability. Further, the value should > 0 or -1.
-  
-:::
-  
-  
-### pipelines._name_.clusters.azure_attributes.log_analytics_info
-  
-**`Type: Map`**
-  
-Defines values necessary to configure and run Azure Log Analytics agent
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `log_analytics_primary_key`
-  - String
-  - The primary key for the Azure Log Analytics agent configuration
-  
-- - `log_analytics_workspace_id`
-  - String
-  - The workspace ID for the Azure Log Analytics agent configuration
-  
-:::
-  
-  
-### pipelines._name_.clusters.cluster_log_conf
-  
-**`Type: Map`**
-  
-The configuration for delivering spark logs to a long-term storage destination.
-Only dbfs destinations are supported. Only one destination can be specified
-for one cluster. If the conf is given, the logs will be delivered to the destination every
-`5 mins`. The destination of driver logs is `$destination/$clusterId/driver`, while
-the destination of executor logs is `$destination/$clusterId/executor`.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `dbfs`
-  - Map
-  - destination needs to be provided. e.g. `{ "dbfs" : { "destination" : "dbfs:/home/cluster_log" } }`. See [\_](#pipelinesnameclusterscluster_log_confdbfs).
-  
-- - `s3`
-  - Map
-  - destination and either the region or endpoint need to be provided. e.g. `{ "s3": { "destination" : "s3://cluster_log_bucket/prefix", "region" : "us-west-2" } }` Cluster iam role is used to access s3, please make sure the cluster iam role in `instance_profile_arn` has permission to write data to the s3 destination. See [\_](#pipelinesnameclusterscluster_log_confs3).
-  
-- - `volumes`
-  - Map
-  - destination needs to be provided, e.g. `{ "volumes": { "destination": "/Volumes/catalog/schema/volume/cluster_log" } }`. See [\_](#pipelinesnameclusterscluster_log_confvolumes).
-  
-:::
-  
-  
-### pipelines._name_.clusters.cluster_log_conf.dbfs
-  
-**`Type: Map`**
-  
-destination needs to be provided. e.g.
-`{ "dbfs" : { "destination" : "dbfs:/home/cluster_log" } }`
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `destination`
-  - String
-  - dbfs destination, e.g. `dbfs:/my/path`
-  
-:::
-  
-  
-### pipelines._name_.clusters.cluster_log_conf.s3
-  
-**`Type: Map`**
-  
-destination and either the region or endpoint need to be provided. e.g.
-`{ "s3": { "destination" : "s3://cluster_log_bucket/prefix", "region" : "us-west-2" } }`
-Cluster iam role is used to access s3, please make sure the cluster iam role in
-`instance_profile_arn` has permission to write data to the s3 destination.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `canned_acl`
-  - String
-  - (Optional) Set canned access control list for the logs, e.g. `bucket-owner-full-control`. If `canned_cal` is set, please make sure the cluster iam role has `s3:PutObjectAcl` permission on the destination bucket and prefix. The full list of possible canned acl can be found at http://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl. Please also note that by default only the object owner gets full controls. If you are using cross account role for writing data, you may want to set `bucket-owner-full-control` to make bucket owner able to read the logs.
-  
-- - `destination`
-  - String
-  - S3 destination, e.g. `s3://my-bucket/some-prefix` Note that logs will be delivered using cluster iam role, please make sure you set cluster iam role and the role has write access to the destination. Please also note that you cannot use AWS keys to deliver logs.
-  
-- - `enable_encryption`
-  - Boolean
-  - (Optional) Flag to enable server side encryption, `false` by default.
-  
-- - `encryption_type`
-  - String
-  - (Optional) The encryption type, it could be `sse-s3` or `sse-kms`. It will be used only when encryption is enabled and the default type is `sse-s3`.
-  
-- - `endpoint`
-  - String
-  - S3 endpoint, e.g. `https://s3-us-west-2.amazonaws.com`. Either region or endpoint needs to be set. If both are set, endpoint will be used.
-  
-- - `kms_key`
-  - String
-  - (Optional) Kms key which will be used if encryption is enabled and encryption type is set to `sse-kms`.
-  
-- - `region`
-  - String
-  - S3 region, e.g. `us-west-2`. Either region or endpoint needs to be set. If both are set, endpoint will be used.
-  
-:::
-  
-  
-### pipelines._name_.clusters.cluster_log_conf.volumes
-  
-**`Type: Map`**
-  
-destination needs to be provided, e.g.
-`{ "volumes": { "destination": "/Volumes/catalog/schema/volume/cluster_log" } }`
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `destination`
-  - String
-  - UC Volumes destination, e.g. `/Volumes/catalog/schema/vol1/init-scripts/setup-datadog.sh` or `dbfs:/Volumes/catalog/schema/vol1/init-scripts/setup-datadog.sh`
-  
-:::
-  
-  
-### pipelines._name_.clusters.gcp_attributes
-  
-**`Type: Map`**
-  
-Attributes related to clusters running on Google Cloud Platform.
-If not specified at cluster creation, a set of default values will be used.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `availability`
-  - String
-  - This field determines whether the instance pool will contain preemptible VMs, on-demand VMs, or preemptible VMs with a fallback to on-demand VMs if the former is unavailable.
-  
-- - `boot_disk_size`
-  - Integer
-  - Boot disk size in GB
-  
-- - `first_on_demand`
-  - Integer
-  - The first `first_on_demand` nodes of the cluster will be placed on on-demand instances. This value should be greater than 0, to make sure the cluster driver node is placed on an on-demand instance. If this value is greater than or equal to the current cluster size, all nodes will be placed on on-demand instances. If this value is less than the current cluster size, `first_on_demand` nodes will be placed on on-demand instances and the remainder will be placed on `availability` instances. Note that this value does not affect cluster size and cannot currently be mutated over the lifetime of a cluster.
-  
-- - `google_service_account`
-  - String
-  - If provided, the cluster will impersonate the google service account when accessing gcloud services (like GCS). The google service account must have previously been added to the Databricks environment by an account administrator.
-  
-- - `local_ssd_count`
-  - Integer
-  - If provided, each node (workers and driver) in the cluster will have this number of local SSDs attached. Each local SSD is 375GB in size. Refer to [GCP documentation](https://cloud.google.com/compute/docs/disks/local-ssd#choose_number_local_ssds) for the supported number of local SSDs for each instance type.
-  
-- - `use_preemptible_executors`
-  - Boolean
-  - This field is deprecated
-  
-- - `zone_id`
-  - String
-  - Identifier for the availability zone in which the cluster resides. This can be one of the following: - "HA" => High availability, spread nodes across availability zones for a Databricks deployment region [default]. - "AUTO" => Databricks picks an availability zone to schedule the cluster on. - A GCP availability zone => Pick One of the available zones for (machine type + region) from https://cloud.google.com/compute/docs/regions-zones.
-  
-:::
-  
-  
-### pipelines._name_.clusters.init_scripts
-  
-**`Type: Sequence`**
-  
-The configuration for storing init scripts. Any number of destinations can be specified. The scripts are executed sequentially in the order provided. If `cluster_log_conf` is specified, init script logs are sent to `<destination>/<cluster-ID>/init_scripts`.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `abfss`
-  - Map
-  - Contains the Azure Data Lake Storage destination path. See [\_](#pipelinesnameclustersinit_scriptsabfss).
-  
-- - `dbfs`
-  - Map
-  - This field is deprecated
-  
-- - `file`
-  - Map
-  - destination needs to be provided, e.g. `{ "file": { "destination": "file:/my/local/file.sh" } }`. See [\_](#pipelinesnameclustersinit_scriptsfile).
-  
-- - `gcs`
-  - Map
-  - destination needs to be provided, e.g. `{ "gcs": { "destination": "gs://my-bucket/file.sh" } }`. See [\_](#pipelinesnameclustersinit_scriptsgcs).
-  
-- - `s3`
-  - Map
-  - destination and either the region or endpoint need to be provided. e.g. `{ \"s3\": { \"destination\": \"s3://cluster_log_bucket/prefix\", \"region\": \"us-west-2\" } }` Cluster iam role is used to access s3, please make sure the cluster iam role in `instance_profile_arn` has permission to write data to the s3 destination. See [\_](#pipelinesnameclustersinit_scriptss3).
-  
-- - `volumes`
-  - Map
-  - destination needs to be provided. e.g. `{ \"volumes\" : { \"destination\" : \"/Volumes/my-init.sh\" } }`. See [\_](#pipelinesnameclustersinit_scriptsvolumes).
-  
-- - `workspace`
-  - Map
-  - destination needs to be provided, e.g. `{ "workspace": { "destination": "/cluster-init-scripts/setup-datadog.sh" } }`. See [\_](#pipelinesnameclustersinit_scriptsworkspace).
-  
-:::
-  
-  
-### pipelines._name_.clusters.init_scripts.abfss
-  
-**`Type: Map`**
-  
-Contains the Azure Data Lake Storage destination path
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `destination`
-  - String
-  - abfss destination, e.g. `abfss://<container-name>@<storage-account-name>.dfs.core.windows.net/<directory-name>`.
-  
-:::
-  
-  
-### pipelines._name_.clusters.init_scripts.file
-  
-**`Type: Map`**
-  
-destination needs to be provided, e.g.
-`{ "file": { "destination": "file:/my/local/file.sh" } }`
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `destination`
-  - String
-  - local file destination, e.g. `file:/my/local/file.sh`
-  
-:::
-  
-  
-### pipelines._name_.clusters.init_scripts.gcs
-  
-**`Type: Map`**
-  
-destination needs to be provided, e.g.
-`{ "gcs": { "destination": "gs://my-bucket/file.sh" } }`
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `destination`
-  - String
-  - GCS destination/URI, e.g. `gs://my-bucket/some-prefix`
-  
-:::
-  
-  
-### pipelines._name_.clusters.init_scripts.s3
-  
-**`Type: Map`**
-  
-destination and either the region or endpoint need to be provided. e.g.
-`{ \"s3\": { \"destination\": \"s3://cluster_log_bucket/prefix\", \"region\": \"us-west-2\" } }`
-Cluster iam role is used to access s3, please make sure the cluster iam role in
-`instance_profile_arn` has permission to write data to the s3 destination.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `canned_acl`
-  - String
-  - (Optional) Set canned access control list for the logs, e.g. `bucket-owner-full-control`. If `canned_cal` is set, please make sure the cluster iam role has `s3:PutObjectAcl` permission on the destination bucket and prefix. The full list of possible canned acl can be found at http://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl. Please also note that by default only the object owner gets full controls. If you are using cross account role for writing data, you may want to set `bucket-owner-full-control` to make bucket owner able to read the logs.
-  
-- - `destination`
-  - String
-  - S3 destination, e.g. `s3://my-bucket/some-prefix` Note that logs will be delivered using cluster iam role, please make sure you set cluster iam role and the role has write access to the destination. Please also note that you cannot use AWS keys to deliver logs.
-  
-- - `enable_encryption`
-  - Boolean
-  - (Optional) Flag to enable server side encryption, `false` by default.
-  
-- - `encryption_type`
-  - String
-  - (Optional) The encryption type, it could be `sse-s3` or `sse-kms`. It will be used only when encryption is enabled and the default type is `sse-s3`.
-  
-- - `endpoint`
-  - String
-  - S3 endpoint, e.g. `https://s3-us-west-2.amazonaws.com`. Either region or endpoint needs to be set. If both are set, endpoint will be used.
-  
-- - `kms_key`
-  - String
-  - (Optional) Kms key which will be used if encryption is enabled and encryption type is set to `sse-kms`.
-  
-- - `region`
-  - String
-  - S3 region, e.g. `us-west-2`. Either region or endpoint needs to be set. If both are set, endpoint will be used.
-  
-:::
-  
-  
-### pipelines._name_.clusters.init_scripts.volumes
-  
-**`Type: Map`**
-  
-destination needs to be provided. e.g.
-`{ \"volumes\" : { \"destination\" : \"/Volumes/my-init.sh\" } }`
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `destination`
-  - String
-  - UC Volumes destination, e.g. `/Volumes/catalog/schema/vol1/init-scripts/setup-datadog.sh` or `dbfs:/Volumes/catalog/schema/vol1/init-scripts/setup-datadog.sh`
-  
-:::
-  
-  
-### pipelines._name_.clusters.init_scripts.workspace
-  
-**`Type: Map`**
-  
-destination needs to be provided, e.g.
-`{ "workspace": { "destination": "/cluster-init-scripts/setup-datadog.sh" } }`
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `destination`
-  - String
-  - wsfs destination, e.g. `workspace:/cluster-init-scripts/setup-datadog.sh`
-  
-:::
-  
-  
-### pipelines._name_.deployment
-  
-**`Type: Map`**
-  
-Deployment type of this pipeline.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `kind`
-  - String
-  - The deployment method that manages the pipeline.
-  
-- - `metadata_file_path`
-  - String
-  - The path to the file containing metadata about the deployment.
-  
-:::
-  
-  
-### pipelines._name_.environment
-  
-**`Type: Map`**
-  
-Environment specification for this pipeline used to install dependencies.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `dependencies`
-  - Sequence
-  - List of pip dependencies, as supported by the version of pip in this environment. Each dependency is a pip requirement file line https://pip.pypa.io/en/stable/reference/requirements-file-format/ Allowed dependency could be <requirement specifier>, <archive url/path>, <local project path>(WSFS or Volumes in Databricks), <vcs project url>
-  
-:::
-  
-  
-### pipelines._name_.event_log
-  
-**`Type: Map`**
-  
-Event log configuration for this pipeline
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `catalog`
-  - String
-  - The UC catalog the event log is published under.
-  
-- - `name`
-  - String
-  - The name the event log is published to in UC.
-  
-- - `schema`
-  - String
-  - The UC schema the event log is published under.
-  
-:::
-  
-  
-### pipelines._name_.filters
-  
-**`Type: Map`**
-  
-Filters on which Pipeline packages to include in the deployed graph.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `exclude`
-  - Sequence
-  - Paths to exclude.
-  
-- - `include`
-  - Sequence
-  - Paths to include.
-  
-:::
-  
-  
-### pipelines._name_.ingestion_definition
-  
-**`Type: Map`**
-  
-The configuration for a managed ingestion pipeline. These settings cannot be used with the 'libraries', 'schema', 'target', or 'catalog' settings.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `connection_name`
-  - String
-  - The Unity Catalog connection that this ingestion pipeline uses to communicate with the source. This is used with both connectors for applications like Salesforce, Workday, and so on, and also database connectors like Oracle, (connector_type = QUERY_BASED OR connector_type = CDC). If connection name corresponds to database connectors like Oracle, and connector_type is not provided then connector_type defaults to QUERY_BASED. If connector_type is passed as CDC we use Combined Cdc Managed Ingestion pipeline. Under certain conditions, this can be replaced with ingestion_gateway_id to change the connector to Cdc Managed Ingestion Pipeline with Gateway pipeline.
-  
-- - `full_refresh_window`
-  - Map
-  - (Optional) A window that specifies a set of time ranges for snapshot queries in CDC. See [\_](#pipelinesnameingestion_definitionfull_refresh_window).
-  
-- - `ingestion_gateway_id`
-  - String
-  - Identifier for the gateway that is used by this ingestion pipeline to communicate with the source database. This is used with CDC connectors to databases like SQL Server using a gateway pipeline (connector_type = CDC). Under certain conditions, this can be replaced with connection_name to change the connector to Combined Cdc Managed Ingestion Pipeline.
-  
-- - `objects`
-  - Sequence
-  - Required. Settings specifying tables to replicate and the destination for the replicated tables. See [\_](#pipelinesnameingestion_definitionobjects).
-  
-- - `source_configurations`
-  - Sequence
-  - Top-level source configurations. See [\_](#pipelinesnameingestion_definitionsource_configurations).
-  
-- - `table_configuration`
-  - Map
-  - Configuration settings to control the ingestion of tables. These settings are applied to all tables in the pipeline. See [\_](#pipelinesnameingestion_definitiontable_configuration).
-  
-:::
-  
-  
-### pipelines._name_.ingestion_definition.full_refresh_window
-  
-**`Type: Map`**
-  
-(Optional) A window that specifies a set of time ranges for snapshot queries in CDC.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `days_of_week`
-  - Sequence
-  - Days of week in which the window is allowed to happen If not specified all days of the week will be used.
-  
-- - `start_hour`
-  - Integer
-  - An integer between 0 and 23 denoting the start hour for the window in the 24-hour day.
-  
-- - `time_zone_id`
-  - String
-  - Time zone id of window. See https://docs.databricks.com/sql/language-manual/sql-ref-syntax-aux-conf-mgmt-set-timezone.html for details. If not specified, UTC will be used.
-  
-:::
-  
-  
-### pipelines._name_.ingestion_definition.full_refresh_window.days_of_week
-  
-**`Type: Sequence`**
-  
-Days of week in which the window is allowed to happen
-If not specified all days of the week will be used.
-  
-  
-### pipelines._name_.ingestion_definition.objects
-  
-**`Type: Sequence`**
-  
-Required. Settings specifying tables to replicate and the destination for the replicated tables.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `report`
-  - Map
-  - Select a specific source report. See [\_](#pipelinesnameingestion_definitionobjectsreport).
-  
-- - `schema`
-  - Map
-  - Select all tables from a specific source schema. See [\_](#pipelinesnameingestion_definitionobjectsschema).
-  
-- - `table`
-  - Map
-  - Select a specific source table. See [\_](#pipelinesnameingestion_definitionobjectstable).
-  
-:::
-  
-  
-### pipelines._name_.ingestion_definition.objects.report
-  
-**`Type: Map`**
-  
-Select a specific source report.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `destination_catalog`
-  - String
-  - Required. Destination catalog to store table.
-  
-- - `destination_schema`
-  - String
-  - Required. Destination schema to store table.
-  
-- - `destination_table`
-  - String
-  - Required. Destination table name. The pipeline fails if a table with that name already exists.
-  
-- - `source_url`
-  - String
-  - Required. Report URL in the source system.
-  
-- - `table_configuration`
-  - Map
-  - Configuration settings to control the ingestion of tables. These settings override the table_configuration defined in the IngestionPipelineDefinition object. See [\_](#pipelinesnameingestion_definitionobjectsreporttable_configuration).
-  
-:::
-  
-  
-### pipelines._name_.ingestion_definition.objects.report.table_configuration
-  
-**`Type: Map`**
-  
-Configuration settings to control the ingestion of tables. These settings override the table_configuration defined in the IngestionPipelineDefinition object.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `auto_full_refresh_policy`
-  - Map
-  - (Optional, Mutable) Policy for auto full refresh, if enabled pipeline will automatically try to fix issues by doing a full refresh on the table in the retry run. auto_full_refresh_policy in table configuration will override the above level auto_full_refresh_policy. For example, { "auto_full_refresh_policy": { "enabled": true, "min_interval_hours": 23, } } If unspecified, auto full refresh is disabled. See [\_](#pipelinesnameingestion_definitionobjectsreporttable_configurationauto_full_refresh_policy).
-  
-- - `exclude_columns`
-  - Sequence
-  - A list of column names to be excluded for the ingestion. When not specified, include_columns fully controls what columns to be ingested. When specified, all other columns including future ones will be automatically included for ingestion. This field in mutually exclusive with `include_columns`.
-  
-- - `include_columns`
-  - Sequence
-  - A list of column names to be included for the ingestion. When not specified, all columns except ones in exclude_columns will be included. Future columns will be automatically included. When specified, all other future columns will be automatically excluded from ingestion. This field in mutually exclusive with `exclude_columns`.
-  
-- - `primary_keys`
-  - Sequence
-  - The primary key of the table used to apply changes.
-  
-- - `sequence_by`
-  - Sequence
-  - The column names specifying the logical order of events in the source data. Spark Declarative Pipelines uses this sequencing to handle change events that arrive out of order.
-  
-:::
-  
-  
-### pipelines._name_.ingestion_definition.objects.report.table_configuration.auto_full_refresh_policy
-  
-**`Type: Map`**
-  
-(Optional, Mutable) Policy for auto full refresh, if enabled pipeline will automatically try
-to fix issues by doing a full refresh on the table in the retry run. auto_full_refresh_policy
-in table configuration will override the above level auto_full_refresh_policy.
-For example,
-{
-"auto_full_refresh_policy": {
-"enabled": true,
-"min_interval_hours": 23,
-}
-}
-If unspecified, auto full refresh is disabled.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `enabled`
-  - Boolean
-  - (Required, Mutable) Whether to enable auto full refresh or not.
-  
-- - `min_interval_hours`
-  - Integer
-  - (Optional, Mutable) Specify the minimum interval in hours between the timestamp at which a table was last full refreshed and the current timestamp for triggering auto full If unspecified and autoFullRefresh is enabled then by default min_interval_hours is 24 hours.
-  
-:::
-  
-  
-### pipelines._name_.ingestion_definition.objects.schema
-  
-**`Type: Map`**
-  
-Select all tables from a specific source schema.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `destination_catalog`
-  - String
-  - Required. Destination catalog to store tables.
-  
-- - `destination_schema`
-  - String
-  - Required. Destination schema to store tables in. Tables with the same name as the source tables are created in this destination schema. The pipeline fails If a table with the same name already exists.
-  
-- - `source_catalog`
-  - String
-  - The source catalog name. Might be optional depending on the type of source.
-  
-- - `source_schema`
-  - String
-  - Required. Schema name in the source database.
-  
-- - `table_configuration`
-  - Map
-  - Configuration settings to control the ingestion of tables. These settings are applied to all tables in this schema and override the table_configuration defined in the IngestionPipelineDefinition object. See [\_](#pipelinesnameingestion_definitionobjectsschematable_configuration).
-  
-:::
-  
-  
-### pipelines._name_.ingestion_definition.objects.schema.table_configuration
-  
-**`Type: Map`**
-  
-Configuration settings to control the ingestion of tables. These settings are applied to all tables in this schema and override the table_configuration defined in the IngestionPipelineDefinition object.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `auto_full_refresh_policy`
-  - Map
-  - (Optional, Mutable) Policy for auto full refresh, if enabled pipeline will automatically try to fix issues by doing a full refresh on the table in the retry run. auto_full_refresh_policy in table configuration will override the above level auto_full_refresh_policy. For example, { "auto_full_refresh_policy": { "enabled": true, "min_interval_hours": 23, } } If unspecified, auto full refresh is disabled. See [\_](#pipelinesnameingestion_definitionobjectsschematable_configurationauto_full_refresh_policy).
-  
-- - `exclude_columns`
-  - Sequence
-  - A list of column names to be excluded for the ingestion. When not specified, include_columns fully controls what columns to be ingested. When specified, all other columns including future ones will be automatically included for ingestion. This field in mutually exclusive with `include_columns`.
-  
-- - `include_columns`
-  - Sequence
-  - A list of column names to be included for the ingestion. When not specified, all columns except ones in exclude_columns will be included. Future columns will be automatically included. When specified, all other future columns will be automatically excluded from ingestion. This field in mutually exclusive with `exclude_columns`.
-  
-- - `primary_keys`
-  - Sequence
-  - The primary key of the table used to apply changes.
-  
-- - `sequence_by`
-  - Sequence
-  - The column names specifying the logical order of events in the source data. Spark Declarative Pipelines uses this sequencing to handle change events that arrive out of order.
-  
-:::
-  
-  
-### pipelines._name_.ingestion_definition.objects.schema.table_configuration.auto_full_refresh_policy
-  
-**`Type: Map`**
-  
-(Optional, Mutable) Policy for auto full refresh, if enabled pipeline will automatically try
-to fix issues by doing a full refresh on the table in the retry run. auto_full_refresh_policy
-in table configuration will override the above level auto_full_refresh_policy.
-For example,
-{
-"auto_full_refresh_policy": {
-"enabled": true,
-"min_interval_hours": 23,
-}
-}
-If unspecified, auto full refresh is disabled.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `enabled`
-  - Boolean
-  - (Required, Mutable) Whether to enable auto full refresh or not.
-  
-- - `min_interval_hours`
-  - Integer
-  - (Optional, Mutable) Specify the minimum interval in hours between the timestamp at which a table was last full refreshed and the current timestamp for triggering auto full If unspecified and autoFullRefresh is enabled then by default min_interval_hours is 24 hours.
-  
-:::
-  
-  
-### pipelines._name_.ingestion_definition.objects.table
-  
-**`Type: Map`**
-  
-Select a specific source table.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `destination_catalog`
-  - String
-  - Required. Destination catalog to store table.
-  
-- - `destination_schema`
-  - String
-  - Required. Destination schema to store table.
-  
-- - `destination_table`
-  - String
-  - Optional. Destination table name. The pipeline fails if a table with that name already exists. If not set, the source table name is used.
-  
-- - `source_catalog`
-  - String
-  - Source catalog name. Might be optional depending on the type of source.
-  
-- - `source_schema`
-  - String
-  - Schema name in the source database. Might be optional depending on the type of source.
-  
-- - `source_table`
-  - String
-  - Required. Table name in the source database.
-  
-- - `table_configuration`
-  - Map
-  - Configuration settings to control the ingestion of tables. These settings override the table_configuration defined in the IngestionPipelineDefinition object and the SchemaSpec. See [\_](#pipelinesnameingestion_definitionobjectstabletable_configuration).
-  
-:::
-  
-  
-### pipelines._name_.ingestion_definition.objects.table.table_configuration
-  
-**`Type: Map`**
-  
-Configuration settings to control the ingestion of tables. These settings override the table_configuration defined in the IngestionPipelineDefinition object and the SchemaSpec.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `auto_full_refresh_policy`
-  - Map
-  - (Optional, Mutable) Policy for auto full refresh, if enabled pipeline will automatically try to fix issues by doing a full refresh on the table in the retry run. auto_full_refresh_policy in table configuration will override the above level auto_full_refresh_policy. For example, { "auto_full_refresh_policy": { "enabled": true, "min_interval_hours": 23, } } If unspecified, auto full refresh is disabled. See [\_](#pipelinesnameingestion_definitionobjectstabletable_configurationauto_full_refresh_policy).
-  
-- - `exclude_columns`
-  - Sequence
-  - A list of column names to be excluded for the ingestion. When not specified, include_columns fully controls what columns to be ingested. When specified, all other columns including future ones will be automatically included for ingestion. This field in mutually exclusive with `include_columns`.
-  
-- - `include_columns`
-  - Sequence
-  - A list of column names to be included for the ingestion. When not specified, all columns except ones in exclude_columns will be included. Future columns will be automatically included. When specified, all other future columns will be automatically excluded from ingestion. This field in mutually exclusive with `exclude_columns`.
-  
-- - `primary_keys`
-  - Sequence
-  - The primary key of the table used to apply changes.
-  
-- - `sequence_by`
-  - Sequence
-  - The column names specifying the logical order of events in the source data. Spark Declarative Pipelines uses this sequencing to handle change events that arrive out of order.
-  
-:::
-  
-  
-### pipelines._name_.ingestion_definition.objects.table.table_configuration.auto_full_refresh_policy
-  
-**`Type: Map`**
-  
-(Optional, Mutable) Policy for auto full refresh, if enabled pipeline will automatically try
-to fix issues by doing a full refresh on the table in the retry run. auto_full_refresh_policy
-in table configuration will override the above level auto_full_refresh_policy.
-For example,
-{
-"auto_full_refresh_policy": {
-"enabled": true,
-"min_interval_hours": 23,
-}
-}
-If unspecified, auto full refresh is disabled.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `enabled`
-  - Boolean
-  - (Required, Mutable) Whether to enable auto full refresh or not.
-  
-- - `min_interval_hours`
-  - Integer
-  - (Optional, Mutable) Specify the minimum interval in hours between the timestamp at which a table was last full refreshed and the current timestamp for triggering auto full If unspecified and autoFullRefresh is enabled then by default min_interval_hours is 24 hours.
-  
-:::
-  
-  
-### pipelines._name_.ingestion_definition.source_configurations
-  
-**`Type: Sequence`**
-  
-Top-level source configurations
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `catalog`
-  - Map
-  - Catalog-level source configuration parameters. See [\_](#pipelinesnameingestion_definitionsource_configurationscatalog).
-  
-:::
-  
-  
-### pipelines._name_.ingestion_definition.source_configurations.catalog
-  
-**`Type: Map`**
-  
-Catalog-level source configuration parameters
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `postgres`
-  - Map
-  - Postgres-specific catalog-level configuration parameters. See [\_](#pipelinesnameingestion_definitionsource_configurationscatalogpostgres).
-  
-- - `source_catalog`
-  - String
-  - Source catalog name
-  
-:::
-  
-  
-### pipelines._name_.ingestion_definition.source_configurations.catalog.postgres
-  
-**`Type: Map`**
-  
-Postgres-specific catalog-level configuration parameters
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `slot_config`
-  - Map
-  - Optional. The Postgres slot configuration to use for logical replication. See [\_](#pipelinesnameingestion_definitionsource_configurationscatalogpostgresslot_config).
-  
-:::
-  
-  
-### pipelines._name_.ingestion_definition.source_configurations.catalog.postgres.slot_config
-  
-**`Type: Map`**
-  
-Optional. The Postgres slot configuration to use for logical replication
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `publication_name`
-  - String
-  - The name of the publication to use for the Postgres source
-  
-- - `slot_name`
-  - String
-  - The name of the logical replication slot to use for the Postgres source
-  
-:::
-  
-  
-### pipelines._name_.ingestion_definition.table_configuration
-  
-**`Type: Map`**
-  
-Configuration settings to control the ingestion of tables. These settings are applied to all tables in the pipeline.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `auto_full_refresh_policy`
-  - Map
-  - (Optional, Mutable) Policy for auto full refresh, if enabled pipeline will automatically try to fix issues by doing a full refresh on the table in the retry run. auto_full_refresh_policy in table configuration will override the above level auto_full_refresh_policy. For example, { "auto_full_refresh_policy": { "enabled": true, "min_interval_hours": 23, } } If unspecified, auto full refresh is disabled. See [\_](#pipelinesnameingestion_definitiontable_configurationauto_full_refresh_policy).
-  
-- - `exclude_columns`
-  - Sequence
-  - A list of column names to be excluded for the ingestion. When not specified, include_columns fully controls what columns to be ingested. When specified, all other columns including future ones will be automatically included for ingestion. This field in mutually exclusive with `include_columns`.
-  
-- - `include_columns`
-  - Sequence
-  - A list of column names to be included for the ingestion. When not specified, all columns except ones in exclude_columns will be included. Future columns will be automatically included. When specified, all other future columns will be automatically excluded from ingestion. This field in mutually exclusive with `exclude_columns`.
-  
-- - `primary_keys`
-  - Sequence
-  - The primary key of the table used to apply changes.
-  
-- - `sequence_by`
-  - Sequence
-  - The column names specifying the logical order of events in the source data. Spark Declarative Pipelines uses this sequencing to handle change events that arrive out of order.
-  
-:::
-  
-  
-### pipelines._name_.ingestion_definition.table_configuration.auto_full_refresh_policy
-  
-**`Type: Map`**
-  
-(Optional, Mutable) Policy for auto full refresh, if enabled pipeline will automatically try
-to fix issues by doing a full refresh on the table in the retry run. auto_full_refresh_policy
-in table configuration will override the above level auto_full_refresh_policy.
-For example,
-{
-"auto_full_refresh_policy": {
-"enabled": true,
-"min_interval_hours": 23,
-}
-}
-If unspecified, auto full refresh is disabled.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `enabled`
-  - Boolean
-  - (Required, Mutable) Whether to enable auto full refresh or not.
-  
-- - `min_interval_hours`
-  - Integer
-  - (Optional, Mutable) Specify the minimum interval in hours between the timestamp at which a table was last full refreshed and the current timestamp for triggering auto full If unspecified and autoFullRefresh is enabled then by default min_interval_hours is 24 hours.
-  
-:::
-  
-  
-### pipelines._name_.libraries
-  
-**`Type: Sequence`**
-  
-Libraries or code needed by this deployment.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `file`
-  - Map
-  - The path to a file that defines a pipeline and is stored in the Databricks Repos. See [\_](#pipelinesnamelibrariesfile).
-  
-- - `glob`
-  - Map
-  - The unified field to include source codes. Each entry can be a notebook path, a file path, or a folder path that ends `/**`. This field cannot be used together with `notebook` or `file`. See [\_](#pipelinesnamelibrariesglob).
-  
-- - `notebook`
-  - Map
-  - The path to a notebook that defines a pipeline and is stored in the Databricks workspace. See [\_](#pipelinesnamelibrariesnotebook).
-  
-- - `whl`
-  - String
-  - This field is deprecated
-  
-:::
-  
-  
-### pipelines._name_.libraries.file
-  
-**`Type: Map`**
-  
-The path to a file that defines a pipeline and is stored in the Databricks Repos.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `path`
-  - String
-  - The absolute path of the source code.
-  
-:::
-  
-  
-### pipelines._name_.libraries.glob
-  
-**`Type: Map`**
-  
-The unified field to include source codes.
-Each entry can be a notebook path, a file path, or a folder path that ends `/**`.
-This field cannot be used together with `notebook` or `file`.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `include`
-  - String
-  - The source code to include for pipelines
-  
-:::
-  
-  
-### pipelines._name_.libraries.notebook
-  
-**`Type: Map`**
-  
-The path to a notebook that defines a pipeline and is stored in the Databricks workspace.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `path`
-  - String
-  - The absolute path of the source code.
-  
-:::
-  
-  
-### pipelines._name_.lifecycle
-  
-**`Type: Map`**
-  
-Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-### pipelines._name_.notifications
-  
-**`Type: Sequence`**
-  
-List of notification settings for this pipeline.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `alerts`
-  - Sequence
-  - A list of alerts that trigger the sending of notifications to the configured destinations. The supported alerts are:  * `on-update-success`: A pipeline update completes successfully. * `on-update-failure`: Each time a pipeline update fails. * `on-update-fatal-failure`: A pipeline update fails with a non-retryable (fatal) error. * `on-flow-failure`: A single data flow fails.
-  
-- - `email_recipients`
-  - Sequence
-  - A list of email addresses notified when a configured alert is triggered.
-  
-:::
-  
-  
-### pipelines._name_.permissions
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `group_name`
-  - String
-  - 
-  
-- - `level`
-  - String
-  - Permission level
-  
-- - `service_principal_name`
-  - String
-  - 
-  
-- - `user_name`
-  - String
-  - 
-  
-:::
-  
-  
-### pipelines._name_.run_as
-  
-**`Type: Map`**
-  
-Write-only setting, available only in Create/Update calls. Specifies the user or service principal that the pipeline runs as. If not specified, the pipeline runs as the user who created the pipeline.
-
-Only `user_name` or `service_principal_name` can be specified. If both are specified, an error is thrown.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `service_principal_name`
-  - String
-  - Application ID of an active service principal. Setting this field requires the `servicePrincipal/user` role.
-  
-- - `user_name`
-  - String
-  - The email of an active workspace user. Users can only set this field to their own email.
-  
-:::
-  
-  
-## postgres_branches
-  
-**`Type: Map`**
-  
-
-  
-```yaml
-postgres_branches:
-  <postgres_branche-name>:
-    <postgres_branche-field-name>: <postgres_branche-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `branch_id`
-  - String
-  - 
-  
-- - `expire_time`
-  - Map
-  - 
-  
-- - `is_protected`
-  - Boolean
-  - 
-  
-- - `lifecycle`
-  - Map
-  - See [\_](#postgres_branchesnamelifecycle).
-  
-- - `no_expiry`
-  - Boolean
-  - 
-  
-- - `parent`
-  - String
-  - 
-  
-- - `source_branch`
-  - String
-  - 
-  
-- - `source_branch_lsn`
-  - String
-  - 
-  
-- - `source_branch_time`
-  - Map
-  - 
-  
-- - `ttl`
-  - String
-  - 
-  
-:::
-  
-  
-### postgres_branches._name_.lifecycle
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-## postgres_endpoints
-  
-**`Type: Map`**
-  
-
-  
-```yaml
-postgres_endpoints:
-  <postgres_endpoint-name>:
-    <postgres_endpoint-field-name>: <postgres_endpoint-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `autoscaling_limit_max_cu`
-  - Any
-  - 
-  
-- - `autoscaling_limit_min_cu`
-  - Any
-  - 
-  
-- - `disabled`
-  - Boolean
-  - 
-  
-- - `endpoint_id`
-  - String
-  - 
-  
-- - `endpoint_type`
-  - String
-  - The compute endpoint type. Either `read_write` or `read_only`.
-  
-- - `group`
-  - Map
-  - See [\_](#postgres_endpointsnamegroup).
-  
-- - `lifecycle`
-  - Map
-  - See [\_](#postgres_endpointsnamelifecycle).
-  
-- - `no_suspension`
-  - Boolean
-  - 
-  
-- - `parent`
-  - String
-  - 
-  
-- - `settings`
-  - Map
-  - A collection of settings for a compute endpoint. See [\_](#postgres_endpointsnamesettings).
-  
-- - `suspend_timeout_duration`
-  - String
-  - 
-  
-:::
-  
-  
-### postgres_endpoints._name_.group
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `enable_readable_secondaries`
-  - Boolean
-  - Whether to allow read-only connections to read-write endpoints. Only relevant for read-write endpoints where size.max > 1.
-  
-- - `max`
-  - Integer
-  - The maximum number of computes in the endpoint group. Currently, this must be equal to min. Set to 1 for single compute endpoints, to disable HA. To manually suspend all computes in an endpoint group, set disabled to true on the EndpointSpec.
-  
-- - `min`
-  - Integer
-  - The minimum number of computes in the endpoint group. Currently, this must be equal to max. This must be greater than or equal to 1.
-  
-:::
-  
-  
-### postgres_endpoints._name_.lifecycle
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-### postgres_endpoints._name_.settings
-  
-**`Type: Map`**
-  
-A collection of settings for a compute endpoint.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `pg_settings`
-  - Map
-  - A raw representation of Postgres settings.
-  
-:::
-  
-  
-## postgres_projects
-  
-**`Type: Map`**
-  
-
-  
-```yaml
-postgres_projects:
-  <postgres_project-name>:
-    <postgres_project-field-name>: <postgres_project-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `budget_policy_id`
-  - String
-  - 
-  
-- - `custom_tags`
-  - Sequence
-  - See [\_](#postgres_projectsnamecustom_tags).
-  
-- - `default_branch`
-  - String
-  - 
-  
-- - `default_endpoint_settings`
-  - Map
-  - A collection of settings for a compute endpoint. See [\_](#postgres_projectsnamedefault_endpoint_settings).
-  
-- - `display_name`
-  - String
-  - 
-  
-- - `enable_pg_native_login`
-  - Boolean
-  - 
-  
-- - `history_retention_duration`
-  - String
-  - 
-  
-- - `lifecycle`
-  - Map
-  - See [\_](#postgres_projectsnamelifecycle).
-  
-- - `permissions`
-  - Sequence
-  - See [\_](#postgres_projectsnamepermissions).
-  
-- - `pg_version`
-  - Integer
-  - 
-  
-- - `project_id`
-  - String
-  - 
-  
-:::
-  
-  
-### postgres_projects._name_.custom_tags
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `key`
-  - String
-  - The key of the custom tag.
-  
-- - `value`
-  - String
-  - The value of the custom tag.
-  
-:::
-  
-  
-### postgres_projects._name_.default_endpoint_settings
-  
-**`Type: Map`**
-  
-A collection of settings for a compute endpoint.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `autoscaling_limit_max_cu`
-  - Any
-  - The maximum number of Compute Units. Minimum value is 0.5.
-  
-- - `autoscaling_limit_min_cu`
-  - Any
-  - The minimum number of Compute Units. Minimum value is 0.5.
-  
-- - `no_suspension`
-  - Boolean
-  - When set to true, explicitly disables automatic suspension (never suspend). Should be set to true when provided.
-  
-- - `pg_settings`
-  - Map
-  - A raw representation of Postgres settings.
-  
-- - `suspend_timeout_duration`
-  - String
-  - Duration of inactivity after which the compute endpoint is automatically suspended. If specified should be between 60s and 604800s (1 minute to 1 week).
-  
-:::
-  
-  
-### postgres_projects._name_.lifecycle
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-### postgres_projects._name_.permissions
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `group_name`
-  - String
-  - The name of the group that has the permission set in level.
-  
-- - `level`
-  - String
-  - The allowed permission for user, group, service principal defined for this permission.
-  
-- - `service_principal_name`
-  - String
-  - The name of the service principal that has the permission set in level.
-  
-- - `user_name`
-  - String
-  - The name of the user that has the permission set in level.
-  
-:::
-  
-  
-## quality_monitors
-  
-**`Type: Map`**
-  
-The quality_monitor resource allows you to define a Unity Catalog [table monitor](/api/workspace/qualitymonitors/create). For information about monitors, see [_](/machine-learning/model-serving/monitor-diagnose-endpoints.md).
-  
-```yaml
-quality_monitors:
-  <quality_monitor-name>:
-    <quality_monitor-field-name>: <quality_monitor-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `assets_dir`
-  - String
-  - [Create:REQ Update:IGN] Field for specifying the absolute path to a custom directory to store data-monitoring assets. Normally prepopulated to a default user location via UI and Python APIs.
-  
-- - `baseline_table_name`
-  - String
-  - [Create:OPT Update:OPT] Baseline table name. Baseline data is used to compute drift from the data in the monitored `table_name`. The baseline table and the monitored table shall have the same schema.
-  
-- - `custom_metrics`
-  - Sequence
-  - [Create:OPT Update:OPT] Custom metrics. See [\_](#quality_monitorsnamecustom_metrics).
-  
-- - `inference_log`
-  - Map
-  - See [\_](#quality_monitorsnameinference_log).
-  
-- - `latest_monitor_failure_msg`
-  - String
-  - [Create:ERR Update:IGN] The latest error message for a monitor failure.
-  
-- - `lifecycle`
-  - Map
-  - Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed. See [\_](#quality_monitorsnamelifecycle).
-  
-- - `notifications`
-  - Map
-  - [Create:OPT Update:OPT] Field for specifying notification settings. See [\_](#quality_monitorsnamenotifications).
-  
-- - `output_schema_name`
-  - String
-  - [Create:REQ Update:REQ] Schema where output tables are created. Needs to be in 2-level format {catalog}.{schema}
-  
-- - `schedule`
-  - Map
-  - [Create:OPT Update:OPT] The monitor schedule. See [\_](#quality_monitorsnameschedule).
-  
-- - `skip_builtin_dashboard`
-  - Boolean
-  - Whether to skip creating a default dashboard summarizing data quality metrics.
-  
-- - `slicing_exprs`
-  - Sequence
-  - [Create:OPT Update:OPT] List of column expressions to slice data with for targeted analysis. The data is grouped by each expression independently, resulting in a separate slice for each predicate and its complements. For example `slicing_exprs=[“col_1”, “col_2 > 10”]` will generate the following slices: two slices for `col_2 > 10` (True and False), and one slice per unique value in `col1`. For high-cardinality columns, only the top 100 unique values by frequency will generate slices.
-  
-- - `snapshot`
-  - Map
-  - Configuration for monitoring snapshot tables.
-  
-- - `table_name`
-  - String
-  - 
-  
-- - `time_series`
-  - Map
-  - Configuration for monitoring time series tables. See [\_](#quality_monitorsnametime_series).
-  
-- - `warehouse_id`
-  - String
-  - Optional argument to specify the warehouse for dashboard creation. If not specified, the first running warehouse will be used.
-  
-:::
-  
-  
-**Example**
-  
-The following example defines a quality monitor:
-
-```yaml
-resources:
-  quality_monitors:
-    my_quality_monitor:
-      table_name: dev.mlops_schema.predictions
-      output_schema_name: ${bundle.target}.mlops_schema
-      assets_dir: /Users/${workspace.current_user.userName}/databricks_lakehouse_monitoring
-      inference_log:
-        granularities: [1 day]
-        model_id_col: model_id
-        prediction_col: prediction
-        label_col: price
-        problem_type: PROBLEM_TYPE_REGRESSION
-        timestamp_col: timestamp
-      schedule:
-        quartz_cron_expression: 0 0 8 * * ? # Run Every day at 8am
-        timezone_id: UTC
-```
-  
-### quality_monitors._name_.custom_metrics
-  
-**`Type: Sequence`**
-  
-[Create:OPT Update:OPT] Custom metrics.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `definition`
-  - String
-  - Jinja template for a SQL expression that specifies how to compute the metric. See [create metric definition](https://docs.databricks.com/en/lakehouse-monitoring/custom-metrics.html#create-definition).
-  
-- - `input_columns`
-  - Sequence
-  - A list of column names in the input table the metric should be computed for. Can use ``":table"`` to indicate that the metric needs information from multiple columns.
-  
-- - `name`
-  - String
-  - Name of the metric in the output tables.
-  
-- - `output_data_type`
-  - String
-  - The output type of the custom metric.
-  
-- - `type`
-  - String
-  - Can only be one of ``"CUSTOM_METRIC_TYPE_AGGREGATE"``, ``"CUSTOM_METRIC_TYPE_DERIVED"``, or ``"CUSTOM_METRIC_TYPE_DRIFT"``. The ``"CUSTOM_METRIC_TYPE_AGGREGATE"`` and ``"CUSTOM_METRIC_TYPE_DERIVED"`` metrics are computed on a single table, whereas the ``"CUSTOM_METRIC_TYPE_DRIFT"`` compare metrics across baseline and input table, or across the two consecutive time windows. - CUSTOM_METRIC_TYPE_AGGREGATE: only depend on the existing columns in your table - CUSTOM_METRIC_TYPE_DERIVED: depend on previously computed aggregate metrics - CUSTOM_METRIC_TYPE_DRIFT:  depend on previously computed aggregate or derived metrics
-  
-:::
-  
-  
-### quality_monitors._name_.inference_log
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `granularities`
-  - Sequence
-  - Granularities for aggregating data into time windows based on their timestamp. Valid values are 5 minutes, 30 minutes, 1 hour, 1 day, n weeks, 1 month, or 1 year.
-  
-- - `label_col`
-  - String
-  - Column for the label.
-  
-- - `model_id_col`
-  - String
-  - Column for the model identifier.
-  
-- - `prediction_col`
-  - String
-  - Column for the prediction.
-  
-- - `prediction_proba_col`
-  - String
-  - Column for prediction probabilities
-  
-- - `problem_type`
-  - String
-  - Problem type the model aims to solve.
-  
-- - `timestamp_col`
-  - String
-  - Column for the timestamp.
-  
-:::
-  
-  
-### quality_monitors._name_.lifecycle
-  
-**`Type: Map`**
-  
-Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-### quality_monitors._name_.notifications
-  
-**`Type: Map`**
-  
-[Create:OPT Update:OPT] Field for specifying notification settings.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `on_failure`
-  - Map
-  - Destinations to send notifications on failure/timeout. See [\_](#quality_monitorsnamenotificationson_failure).
-  
-:::
-  
-  
-### quality_monitors._name_.notifications.on_failure
-  
-**`Type: Map`**
-  
-Destinations to send notifications on failure/timeout.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `email_addresses`
-  - Sequence
-  - The list of email addresses to send the notification to. A maximum of 5 email addresses is supported.
-  
-:::
-  
-  
-### quality_monitors._name_.schedule
-  
-**`Type: Map`**
-  
-[Create:OPT Update:OPT] The monitor schedule.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `pause_status`
-  - String
-  - Read only field that indicates whether a schedule is paused or not.
-  
-- - `quartz_cron_expression`
-  - String
-  - The expression that determines when to run the monitor. See [examples](https://www.quartz-scheduler.org/documentation/quartz-2.3.0/tutorials/crontrigger.html).
-  
-- - `timezone_id`
-  - String
-  - The timezone id (e.g., ``PST``) in which to evaluate the quartz expression.
-  
-:::
-  
-  
-### quality_monitors._name_.snapshot
-  
-**`Type: Map`**
-  
-Configuration for monitoring snapshot tables.
-  
-  
-### quality_monitors._name_.time_series
-  
-**`Type: Map`**
-  
-Configuration for monitoring time series tables.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `granularities`
-  - Sequence
-  - Granularities for aggregating data into time windows based on their timestamp. Valid values are 5 minutes, 30 minutes, 1 hour, 1 day, n weeks, 1 month, or 1 year.
-  
-- - `timestamp_col`
-  - String
-  - Column for the timestamp.
-  
-:::
-  
-  
-## registered_models
-  
-**`Type: Map`**
-  
-The registered model resource allows you to define models in Unity Catalog. For information about Unity Catalog [registered models](/api/workspace/registeredmodels/create), see [_](/machine-learning/manage-model-lifecycle/index.md).
-  
-```yaml
-registered_models:
-  <registered_model-name>:
-    <registered_model-field-name>: <registered_model-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `aliases`
-  - Sequence
-  - See [\_](#registered_modelsnamealiases).
-  
-- - `browse_only`
-  - Boolean
-  - 
-  
-- - `catalog_name`
-  - String
-  - The name of the catalog where the schema and the registered model reside
-  
-- - `comment`
-  - String
-  - The comment attached to the registered model
-  
-- - `created_at`
-  - Integer
-  - 
-  
-- - `created_by`
-  - String
-  - 
-  
-- - `full_name`
-  - String
-  - 
-  
-- - `grants`
-  - Sequence
-  - See [\_](#registered_modelsnamegrants).
-  
-- - `lifecycle`
-  - Map
-  - Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed. See [\_](#registered_modelsnamelifecycle).
-  
-- - `metastore_id`
-  - String
-  - 
-  
-- - `name`
-  - String
-  - The name of the registered model
-  
-- - `owner`
-  - String
-  - 
-  
-- - `schema_name`
-  - String
-  - The name of the schema where the registered model resides
-  
-- - `storage_location`
-  - String
-  - The storage location on the cloud under which model version data files are stored
-  
-- - `updated_at`
-  - Integer
-  - 
-  
-- - `updated_by`
-  - String
-  - 
-  
-:::
-  
-  
-**Example**
-  
-The following example defines a registered model in Unity Catalog:
-
-```yaml
-resources:
-  registered_models:
-      model:
-        name: my_model
-        catalog_name: ${bundle.target}
-        schema_name: mlops_schema
-        comment: Registered model in Unity Catalog for ${bundle.target} deployment target
-        grants:
-          - privileges:
-              - EXECUTE
-            principal: account users
-```
-  
-### registered_models._name_.aliases
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `alias_name`
-  - String
-  - Name of the alias, e.g. 'champion' or 'latest_stable'
-  
-- - `catalog_name`
-  - String
-  - 
-  
-- - `id`
-  - String
-  - 
-  
-- - `model_name`
-  - String
-  - 
-  
-- - `schema_name`
-  - String
-  - 
-  
-- - `version_num`
-  - Integer
-  - Integer version number of the model version to which this alias points.
-  
-:::
-  
-  
-### registered_models._name_.grants
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `principal`
-  - String
-  - The principal (user email address or group name). For deleted principals, `principal` is empty while `principal_id` is populated.
-  
-- - `privileges`
-  - Sequence
-  - The privileges assigned to the principal.
-  
-:::
-  
-  
-### registered_models._name_.grants.privileges
-  
-**`Type: Sequence`**
-  
-The privileges assigned to the principal.
-  
-  
-### registered_models._name_.lifecycle
-  
-**`Type: Map`**
-  
-Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-## schemas
-  
-**`Type: Map`**
-  
-The schema resource type allows you to define Unity Catalog [schemas](/api/workspace/schemas/create) for tables and other assets in your jobs and pipelines created as part of a bundle. A schema, different from other resource types, has the following limitations:
-
-- The owner of a schema resource is always the deployment user, and cannot be changed. If `run_as` is specified in the bundle, it will be ignored by operations on the schema.
-- Only fields supported by the corresponding [Schemas object create API](/api/workspace/schemas/create) are available for the schema resource. For example, `enable_predictive_optimization` is not supported as it is only available on the [update API](/api/workspace/schemas/update).
-  
-```yaml
-schemas:
-  <schema-name>:
-    <schema-field-name>: <schema-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `catalog_name`
-  - String
-  - Name of parent catalog.
-  
-- - `comment`
-  - String
-  - User-provided free-form text description.
-  
-- - `grants`
-  - Sequence
-  - See [\_](#schemasnamegrants).
-  
-- - `lifecycle`
-  - Map
-  - Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed. See [\_](#schemasnamelifecycle).
-  
-- - `name`
-  - String
-  - Name of schema, relative to parent catalog.
-  
-- - `properties`
-  - Map
-  - 
-  
-- - `storage_root`
-  - String
-  - Storage root URL for managed tables within schema.
-  
-:::
-  
-  
-**Example**
-  
-The following example defines a pipeline with the resource key `my_pipeline` that creates a Unity Catalog schema with the key `my_schema` as the target:
-
-```yaml
-resources:
-  pipelines:
-    my_pipeline:
-      name: test-pipeline-{{.unique_id}}
-      libraries:
-        - notebook:
-            path: ./nb.sql
-      development: true
-      catalog: main
-      target: ${resources.schemas.my_schema.id}
-
-  schemas:
-    my_schema:
-      name: test-schema-{{.unique_id}}
-      catalog_name: main
-      comment: This schema was created by DABs.
-```
-
-A top-level grants mapping is not supported by Declarative Automation Bundles, so if you want to set grants for a schema, define the grants for the schema within the `schemas` mapping. For more information about grants, see [_](/data-governance/unity-catalog/manage-privileges/index.md#grant).
-
-The following example defines a Unity Catalog schema with grants:
-
-```yaml
-resources:
-  schemas:
-    my_schema:
-      name: test-schema
-      grants:
-        - principal: users
-          privileges:
-            - CAN_MANAGE
-        - principal: my_team
-          privileges:
-            - CAN_READ
-      catalog_name: main
-  ```
-  
-### schemas._name_.grants
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `principal`
-  - String
-  - The principal (user email address or group name). For deleted principals, `principal` is empty while `principal_id` is populated.
-  
-- - `privileges`
-  - Sequence
-  - The privileges assigned to the principal.
-  
-:::
-  
-  
-### schemas._name_.grants.privileges
-  
-**`Type: Sequence`**
-  
-The privileges assigned to the principal.
-  
-  
-### schemas._name_.lifecycle
-  
-**`Type: Map`**
-  
-Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-## secret_scopes
-  
-**`Type: Map`**
-  
-The secret scope definitions for the bundle, where each key is the name of the secret scope. See [\_](/dev-tools/bundles/resources.md#secret_scopes).
-  
-```yaml
-secret_scopes:
-  <secret_scope-name>:
-    <secret_scope-field-name>: <secret_scope-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `backend_type`
-  - String
-  - The backend type the scope will be created with. If not specified, will default to `DATABRICKS`
-  
-- - `keyvault_metadata`
-  - Map
-  - The metadata for the secret scope if the `backend_type` is `AZURE_KEYVAULT`. See [\_](#secret_scopesnamekeyvault_metadata).
-  
-- - `lifecycle`
-  - Map
-  - Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed. See [\_](#secret_scopesnamelifecycle).
-  
-- - `name`
-  - String
-  - Scope name requested by the user. Scope names are unique.
-  
-- - `permissions`
-  - Sequence
-  - The permissions to apply to the secret scope. Permissions are managed via secret scope ACLs. See [\_](#secret_scopesnamepermissions).
-  
-:::
-  
-  
-### secret_scopes._name_.keyvault_metadata
-  
-**`Type: Map`**
-  
-The metadata for the secret scope if the `backend_type` is `AZURE_KEYVAULT`
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `dns_name`
-  - String
-  - The DNS of the KeyVault
-  
-- - `resource_id`
-  - String
-  - The resource id of the azure KeyVault that user wants to associate the scope with.
-  
-:::
-  
-  
-### secret_scopes._name_.lifecycle
-  
-**`Type: Map`**
-  
-Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-### secret_scopes._name_.permissions
-  
-**`Type: Sequence`**
-  
-The permissions to apply to the secret scope. Permissions are managed via secret scope ACLs.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `group_name`
-  - String
-  - The name of the group that has the permission set in level. This field translates to a `principal` field in secret scope ACL.
-  
-- - `level`
-  - String
-  - The allowed permission for user, group, service principal defined for this permission.
-  
-- - `service_principal_name`
-  - String
-  - The application ID of an active service principal. This field translates to a `principal` field in secret scope ACL.
-  
-- - `user_name`
-  - String
-  - The name of the user that has the permission set in level. This field translates to a `principal` field in secret scope ACL.
-  
-:::
-  
-  
-## sql_warehouses
-  
-**`Type: Map`**
-  
-Creates a new SQL warehouse.
-  
-```yaml
-sql_warehouses:
-  <sql_warehouse-name>:
-    <sql_warehouse-field-name>: <sql_warehouse-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `auto_stop_mins`
-  - Integer
-  - The amount of time in minutes that a SQL warehouse must be idle (i.e., no RUNNING queries) before it is automatically stopped.  Supported values: - Must be == 0 or >= 10 mins - 0 indicates no autostop.  Defaults to 120 mins
-  
-- - `channel`
-  - Map
-  - Channel Details. See [\_](#sql_warehousesnamechannel).
-  
-- - `cluster_size`
-  - String
-  - Size of the clusters allocated for this warehouse. Increasing the size of a spark cluster allows you to run larger queries on it. If you want to increase the number of concurrent queries, please tune max_num_clusters.  Supported values: - 2X-Small - X-Small - Small - Medium - Large - X-Large - 2X-Large - 3X-Large - 4X-Large - 5X-Large
-  
-- - `creator_name`
-  - String
-  - warehouse creator name
-  
-- - `enable_photon`
-  - Boolean
-  - Configures whether the warehouse should use Photon optimized clusters.  Defaults to true.
-  
-- - `enable_serverless_compute`
-  - Boolean
-  - Configures whether the warehouse should use serverless compute
-  
-- - `instance_profile_arn`
-  - String
-  - This field is deprecated
-  
-- - `lifecycle`
-  - Map
-  - Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed. See [\_](#sql_warehousesnamelifecycle).
-  
-- - `max_num_clusters`
-  - Integer
-  - Maximum number of clusters that the autoscaler will create to handle concurrent queries.  Supported values: - Must be >= min_num_clusters - Must be <= 40.  Defaults to min_clusters if unset.
-  
-- - `min_num_clusters`
-  - Integer
-  - Minimum number of available clusters that will be maintained for this SQL warehouse. Increasing this will ensure that a larger number of clusters are always running and therefore may reduce the cold start time for new queries. This is similar to reserved vs. revocable cores in a resource manager.  Supported values: - Must be > 0 - Must be <= min(max_num_clusters, 30)  Defaults to 1
-  
-- - `name`
-  - String
-  - Logical name for the cluster.  Supported values: - Must be unique within an org. - Must be less than 100 characters.
-  
-- - `permissions`
-  - Sequence
-  - See [\_](#sql_warehousesnamepermissions).
-  
-- - `spot_instance_policy`
-  - String
-  - EndpointSpotInstancePolicy configures whether the endpoint should use spot instances.  The breakdown of how the EndpointSpotInstancePolicy converts to per cloud configurations is:  +-------+--------------------------------------+--------------------------------+ | Cloud |            COST_OPTIMIZED            |     RELIABILITY_OPTIMIZED | +-------+--------------------------------------+--------------------------------+ | AWS   | On Demand Driver with Spot Executors | On Demand Driver and Executors | | AZURE | On Demand Driver and Executors       | On Demand Driver and Executors | +-------+--------------------------------------+--------------------------------+  While including "spot" in the enum name may limit the the future extensibility of this field because it limits this enum to denoting "spot or not", this is the field that PM recommends after discussion with customers per SC-48783.
-  
-- - `tags`
-  - Map
-  - A set of key-value pairs that will be tagged on all resources (e.g., AWS instances and EBS volumes) associated with this SQL warehouse.  Supported values: - Number of tags < 45. See [\_](#sql_warehousesnametags).
-  
-- - `warehouse_type`
-  - String
-  - 
-  
-:::
-  
-  
-### sql_warehouses._name_.channel
-  
-**`Type: Map`**
-  
-Channel Details
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `dbsql_version`
-  - String
-  - 
-  
-- - `name`
-  - String
-  - 
-  
-:::
-  
-  
-### sql_warehouses._name_.lifecycle
-  
-**`Type: Map`**
-  
-Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-### sql_warehouses._name_.permissions
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `group_name`
-  - String
-  - 
-  
-- - `level`
-  - String
-  - Permission level
-  
-- - `service_principal_name`
-  - String
-  - 
-  
-- - `user_name`
-  - String
-  - 
-  
-:::
-  
-  
-### sql_warehouses._name_.tags
-  
-**`Type: Map`**
-  
-A set of key-value pairs that will be tagged on all resources (e.g., AWS instances and EBS volumes) associated
-with this SQL warehouse.
-
-Supported values:
-- Number of tags < 45.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `custom_tags`
-  - Sequence
-  - See [\_](#sql_warehousesnametagscustom_tags).
-  
-:::
-  
-  
-### sql_warehouses._name_.tags.custom_tags
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `key`
-  - String
-  - 
-  
-- - `value`
-  - String
-  - 
-  
-:::
-  
-  
-## synced_database_tables
-  
-**`Type: Map`**
-  
-
-  
-```yaml
-synced_database_tables:
-  <synced_database_table-name>:
-    <synced_database_table-field-name>: <synced_database_table-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `database_instance_name`
-  - String
-  - 
-  
-- - `lifecycle`
-  - Map
-  - See [\_](#synced_database_tablesnamelifecycle).
-  
-- - `logical_database_name`
-  - String
-  - 
-  
-- - `name`
-  - String
-  - 
-  
-- - `spec`
-  - Map
-  - Specification of a synced database table. See [\_](#synced_database_tablesnamespec).
-  
-:::
-  
-  
-### synced_database_tables._name_.lifecycle
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-### synced_database_tables._name_.spec
-  
-**`Type: Map`**
-  
-Specification of a synced database table.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `create_database_objects_if_missing`
-  - Boolean
-  - If true, the synced table's logical database and schema resources in PG will be created if they do not already exist.
-  
-- - `existing_pipeline_id`
-  - String
-  - At most one of existing_pipeline_id and new_pipeline_spec should be defined.  If existing_pipeline_id is defined, the synced table will be bin packed into the existing pipeline referenced. This avoids creating a new pipeline and allows sharing existing compute. In this case, the scheduling_policy of this synced table must match the scheduling policy of the existing pipeline.
-  
-- - `new_pipeline_spec`
-  - Map
-  - At most one of existing_pipeline_id and new_pipeline_spec should be defined.  If new_pipeline_spec is defined, a new pipeline is created for this synced table. The location pointed to is used to store intermediate files (checkpoints, event logs etc). The caller must have write permissions to create Delta tables in the specified catalog and schema. Again, note this requires write permissions, whereas the source table only requires read permissions. See [\_](#synced_database_tablesnamespecnew_pipeline_spec).
-  
-- - `primary_key_columns`
-  - Sequence
-  - Primary Key columns to be used for data insert/update in the destination.
-  
-- - `scheduling_policy`
-  - String
-  - Scheduling policy of the underlying pipeline.
-  
-- - `source_table_full_name`
-  - String
-  - Three-part (catalog, schema, table) name of the source Delta table.
-  
-- - `timeseries_key`
-  - String
-  - Time series key to deduplicate (tie-break) rows with the same primary key.
-  
-:::
-  
-  
-### synced_database_tables._name_.spec.new_pipeline_spec
-  
-**`Type: Map`**
-  
-At most one of existing_pipeline_id and new_pipeline_spec should be defined.
-
-If new_pipeline_spec is defined, a new pipeline is created for this synced table. The location pointed to is used
-to store intermediate files (checkpoints, event logs etc). The caller must have write permissions to create Delta
-tables in the specified catalog and schema. Again, note this requires write permissions, whereas the source table
-only requires read permissions.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `budget_policy_id`
-  - String
-  - Budget policy to set on the newly created pipeline.
-  
-- - `storage_catalog`
-  - String
-  - This field needs to be specified if the destination catalog is a managed postgres catalog.  UC catalog for the pipeline to store intermediate files (checkpoints, event logs etc). This needs to be a standard catalog where the user has permissions to create Delta tables.
-  
-- - `storage_schema`
-  - String
-  - This field needs to be specified if the destination catalog is a managed postgres catalog.  UC schema for the pipeline to store intermediate files (checkpoints, event logs etc). This needs to be in the standard catalog where the user has permissions to create Delta tables.
-  
-:::
-  
-  
-## vector_search_endpoints
-  
-**`Type: Map`**
-  
-
-  
-```yaml
-vector_search_endpoints:
-  <vector_search_endpoint-name>:
-    <vector_search_endpoint-field-name>: <vector_search_endpoint-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `budget_policy_id`
-  - String
-  - 
-  
-- - `endpoint_type`
-  - String
-  - Type of endpoint.
-  
-- - `lifecycle`
-  - Map
-  - See [\_](#vector_search_endpointsnamelifecycle).
-  
-- - `min_qps`
-  - Integer
-  - 
-  
-- - `name`
-  - String
-  - 
-  
-- - `permissions`
-  - Sequence
-  - See [\_](#vector_search_endpointsnamepermissions).
-  
-:::
-  
-  
-### vector_search_endpoints._name_.lifecycle
-  
-**`Type: Map`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
-  
-### vector_search_endpoints._name_.permissions
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `group_name`
-  - String
-  - The name of the group that has the permission set in level.
-  
-- - `level`
-  - String
-  - The allowed permission for user, group, service principal defined for this permission.
-  
-- - `service_principal_name`
-  - String
-  - The name of the service principal that has the permission set in level.
-  
-- - `user_name`
-  - String
-  - The name of the user that has the permission set in level.
-  
-:::
-  
-  
-## volumes
-  
-**`Type: Map`**
-  
-The volume resource type allows you to define and create Unity Catalog [volumes](/api/workspace/volumes/create) as part of a bundle. When deploying a bundle with a volume defined, note that:
-
-- A volume cannot be referenced in the `artifact_path` for the bundle until it exists in the workspace. Hence, if you want to use Declarative Automation Bundles to create the volume, you must first define the volume in the bundle, deploy it to create the volume, then reference it in the `artifact_path` in subsequent deployments.
-
-- Volumes in the bundle are not prepended with the `dev_${workspace.current_user.short_name}` prefix when the deployment target has `mode: development` configured. However, you can manually configure this prefix. See [_](/dev-tools/bundles/deployment-modes.md#custom-presets).
-  
-```yaml
-volumes:
-  <volume-name>:
-    <volume-field-name>: <volume-field-value>
-```
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `catalog_name`
-  - String
-  - The name of the catalog where the schema and the volume are
-  
-- - `comment`
-  - String
-  - The comment attached to the volume
-  
-- - `grants`
-  - Sequence
-  - See [\_](#volumesnamegrants).
-  
-- - `lifecycle`
-  - Map
-  - Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed. See [\_](#volumesnamelifecycle).
-  
-- - `name`
-  - String
-  - The name of the volume
-  
-- - `schema_name`
-  - String
-  - The name of the schema where the volume is
-  
-- - `storage_location`
-  - String
-  - The storage location on the cloud
-  
-- - `volume_type`
-  - String
-  - 
-  
-:::
-  
-  
-**Example**
-  
-The following example creates a Unity Catalog volume with the key `my_volume`:
-
-```yaml
-resources:
-  volumes:
-    my_volume:
-      catalog_name: main
-      name: my_volume
-      schema_name: my_schema
-```
-
-For an example bundle that runs a job that writes to a file in Unity Catalog volume, see the [bundle-examples GitHub repository](https://github.com/databricks/bundle-examples/tree/main/knowledge_base/write_from_job_to_volume).
-  
-### volumes._name_.grants
-  
-**`Type: Sequence`**
-  
-
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `principal`
-  - String
-  - The principal (user email address or group name). For deleted principals, `principal` is empty while `principal_id` is populated.
-  
-- - `privileges`
-  - Sequence
-  - The privileges assigned to the principal.
-  
-:::
-  
-  
-### volumes._name_.grants.privileges
-  
-**`Type: Sequence`**
-  
-The privileges assigned to the principal.
-  
-  
-### volumes._name_.lifecycle
-  
-**`Type: Map`**
-  
-Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `prevent_destroy`
-  - Boolean
-  - Lifecycle setting to prevent the resource from being destroyed.
-  
-:::
-  
\ No newline at end of file
diff --git a/bundle/docsgen/refs.go b/bundle/docsgen/refs.go
deleted file mode 100644
index 5092dcd664b..00000000000
--- a/bundle/docsgen/refs.go
+++ /dev/null
@@ -1,110 +0,0 @@
-package main
-
-import (
-	"log"
-	"strings"
-
-	"github.com/databricks/cli/libs/jsonschema"
-)
-
-func isReferenceType(v *jsonschema.Schema, refs map[string]*jsonschema.Schema, ownFields map[string]bool) bool {
-	if v.Type != "object" && v.Type != "array" {
-		return false
-	}
-	if len(v.Properties) > 0 {
-		return true
-	}
-	if v.Items != nil {
-		items := resolveRefs(v.Items, refs)
-		if items != nil && items.Type == "object" {
-			return true
-		}
-	}
-	props := resolveAdditionalProperties(v)
-	if !isInOwnFields(props, ownFields) {
-		return false
-	}
-	if props != nil {
-		propsResolved := resolveRefs(props, refs)
-		return propsResolved.Type == "object"
-	}
-
-	return false
-}
-
-func isInOwnFields(node *jsonschema.Schema, ownFields map[string]bool) bool {
-	if node != nil && node.Reference != nil {
-		return ownFields[getRefType(node)]
-	}
-	return true
-}
-
-func resolveAdditionalProperties(v *jsonschema.Schema) *jsonschema.Schema {
-	if v.AdditionalProperties == nil {
-		return nil
-	}
-	additionalProps, ok := v.AdditionalProperties.(*jsonschema.Schema)
-	if !ok {
-		return nil
-	}
-	return additionalProps
-}
-
-func resolveRefs(s *jsonschema.Schema, schemas map[string]*jsonschema.Schema) *jsonschema.Schema {
-	if s == nil {
-		return nil
-	}
-
-	node := s
-	description := s.Description
-	markdownDescription := s.MarkdownDescription
-	examples := getExamples(s.Examples)
-	deprecated := s.Deprecated
-	deprecationMessage := s.DeprecationMessage
-	doNotSuggest := s.DoNotSuggest
-
-	for node.Reference != nil {
-		ref := getRefType(node)
-		newNode, ok := schemas[ref]
-		if !ok {
-			log.Printf("schema %s not found", ref)
-			break
-		}
-
-		if description == "" {
-			description = newNode.Description
-		}
-		if markdownDescription == "" {
-			markdownDescription = newNode.MarkdownDescription
-		}
-		if len(examples) == 0 {
-			examples = getExamples(newNode.Examples)
-		}
-
-		node = newNode
-	}
-
-	newNode := *node
-	newNode.Description = description
-	newNode.MarkdownDescription = markdownDescription
-	newNode.Examples = examples
-	newNode.Deprecated = deprecated
-	newNode.DeprecationMessage = deprecationMessage
-	newNode.DoNotSuggest = doNotSuggest
-	return &newNode
-}
-
-func getExamples(examples any) []string {
-	typedExamples, ok := examples.([]string)
-	if !ok {
-		return []string{}
-	}
-	return typedExamples
-}
-
-func getRefType(node *jsonschema.Schema) string {
-	if node.Reference == nil {
-		return ""
-	}
-	return strings.TrimPrefix(*node.Reference, "#/$defs/")
-}
diff --git a/bundle/docsgen/renderer.go b/bundle/docsgen/renderer.go
deleted file mode 100644
index 5f6c77258bd..00000000000
--- a/bundle/docsgen/renderer.go
+++ /dev/null
@@ -1,51 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"runtime"
-	"strings"
-)
-
-type markdownRenderer struct {
-	nodes []string
-}
-
-func newMardownRenderer() *markdownRenderer {
-	return &markdownRenderer{}
-}
-
-func (m *markdownRenderer) add(s string) *markdownRenderer {
-	m.nodes = append(m.nodes, s)
-	return m
-}
-
-func (m *markdownRenderer) PlainText(s string) *markdownRenderer {
-	return m.add(s)
-}
-
-func (m *markdownRenderer) LF() *markdownRenderer {
-	return m.add("  ")
-}
-
-func (m *markdownRenderer) H2(s string) *markdownRenderer {
-	return m.add("## " + s)
-}
-
-func (m *markdownRenderer) H3(s string) *markdownRenderer {
-	return m.add("### " + s)
-}
-
-func (m *markdownRenderer) CodeBlocks(lang, s string) *markdownRenderer {
-	return m.add(fmt.Sprintf("```%s%s%s%s```", lang, lineFeed(), s, lineFeed()))
-}
-
-func (m *markdownRenderer) String() string {
-	return strings.Join(m.nodes, lineFeed())
-}
-
-func lineFeed() string {
-	if runtime.GOOS == "windows" {
-		return "\r\n"
-	}
-	return "\n"
-}
diff --git a/bundle/docsgen/templates/reference.md b/bundle/docsgen/templates/reference.md
deleted file mode 100644
index 37aeb57f9ea..00000000000
--- a/bundle/docsgen/templates/reference.md
+++ /dev/null
@@ -1,13 +0,0 @@
----
-description: 'Configuration reference for databricks.yml'
-last_update:
-  date: {{update_date}}
----
-
-<!--DO NOT EDIT. This file is autogenerated with https://github.com/databricks/cli-->
-
-# Configuration reference
-
-This article provides reference for keys supported by :re[DABS] configuration (YAML). See [\_](/dev-tools/bundles/index.md).
-
-For complete bundle examples, see [\_](/dev-tools/bundles/resource-examples.md) and the [bundle-examples GitHub repository](https://github.com/databricks/bundle-examples).
diff --git a/bundle/docsgen/templates/resources.md b/bundle/docsgen/templates/resources.md
deleted file mode 100644
index ffc33f558bf..00000000000
--- a/bundle/docsgen/templates/resources.md
+++ /dev/null
@@ -1,124 +0,0 @@
----
-description: 'Learn about resources supported by Declarative Automation Bundles and how to configure them.'
-last_update:
-  date: {{update_date}}
----
-
-<!-- DO NOT EDIT. This file is autogenerated with https://github.com/databricks/cli -->
-
-# :re[DABS] resources
-
-:re[DABS] allows you to specify information about the :re[Databricks] resources used by the bundle in the `resources` mapping in the bundle configuration. See [resources mapping](/dev-tools/bundles/settings.md#resources) and [resources key reference](/dev-tools/bundles/reference.md#resources).
-
-This article outlines supported resource types for bundles and provides details and an example for each supported type. For additional examples, see [\_](/dev-tools/bundles/resource-examples.md).
-
-:::tip
-
-To generate YAML for any existing resource, use the `databricks bundle generate` command. See [\_](/dev-tools/cli/bundle-commands.md#generate).
-
-:::
-
-## <a id="resource-types"></a>Supported resources
-
-The following table lists supported resource types for bundles. Some resources can be created by defining them in a bundle and deploying the bundle, and some resources only support referencing an existing resource to include in the bundle.
-
-Resources are defined using the corresponding [Databricks REST API](/api/workspace/introduction) object’s create operation request payload, where the object’s supported fields, expressed as YAML, are the resource’s supported properties. Links to documentation for each resource’s corresponding payloads are listed in the table.
-
-:::tip
-
-The `databricks bundle validate` command returns warnings if unknown resource properties are found in bundle configuration files.
-
-:::
-
-::::aws-azure
-
-:::list-table
-
-- - Resource
-  - Create support
-  - Corresponding REST API object
-- - [app](#apps)
-  - ✓
-  - [App object](/api/workspace/apps/create)
-- - [cluster](#clusters)
-  - ✓
-  - [Cluster object](/api/workspace/clusters/create)
-- - [dashboard](#dashboards)
-  -
-  - [Dashboard object](/api/workspace/lakeview/create)
-- - [experiment](#experiments)
-  - ✓
-  - [Experiment object](/api/workspace/experiments/createexperiment)
-- - [job](#job)
-  - ✓
-  - [Job object](/api/workspace/jobs/create)
-- - [model (legacy)](#models)
-  - ✓
-  - [Model (legacy) object](/api/workspace/modelregistry/createmodel)
-- - [model_serving_endpoint](#model_serving_endpoints)
-  - ✓
-  - [Model serving endpoint object](/api/workspace/servingendpoints/create)
-- - [pipeline](#pipeline)
-  - ✓
-  - [Pipeline object](/api/workspace/pipelines/create)
-- - [quality_monitor](#quality_monitors)
-  - ✓
-  - [Quality monitor object](/api/workspace/qualitymonitors/create)
-- - [registered_model](#registered_models) (:re[UC])
-  - ✓
-  - [Registered model object](/api/workspace/registeredmodels/create)
-- - [schema](#schemas) (:re[UC])
-  - ✓
-  - [Schema object](/api/workspace/schemas/create)
-- - [volume](#volumes) (:re[UC])
-  - ✓
-  - [Volume object](/api/workspace/volumes/create)
-
-:::
-
-::::
-
-::::gcp
-
-:::list-table
-
-- - Resource
-  - Create support
-  - Corresponding REST API object
-- - [cluster](#clusters)
-  - ✓
-  - [Cluster object](/api/workspace/clusters/create)
-- - [dashboard](#dashboards)
-  -
-  - [Dashboard object](/api/workspace/lakeview/create)
-- - [experiment](#experiments)
-  - ✓
-  - [Experiment object](/api/workspace/experiments/createexperiment)
-- - [job](#jobs)
-  - ✓
-  - [Job object](/api/workspace/jobs/create)
-- - [model (legacy)](#models)
-  - ✓
-  - [Model (legacy) object](/api/workspace/modelregistry/createmodel)
-- - [model_serving_endpoint](#model_serving_endpoints)
-  - ✓
-  - [Model serving endpoint object](/api/workspace/servingendpoints/create)
-- - [pipeline](#pipelines)
-  - ✓
-  - [Pipeline object]](/api/workspace/pipelines/create)
-- - [quality_monitor](#quality_monitors)
-  - ✓
-  - [Quality monitor object](/api/workspace/qualitymonitors/create)
-- - [registered_model](#registered_models) (:re[UC])
-  - ✓
-  - [Registered model object](/api/workspace/registeredmodels/create)
-- - [schema](#schemas) (:re[UC])
-  - ✓
-  - [Schema object](/api/workspace/schemas/create)
-- - [volume](#volumes) (:re[UC])
-  - ✓
-  - [Volume object](/api/workspace/volumes/create)
-
-:::
-
-::::
diff --git a/bundle/docsgen/testdata/anchors.md b/bundle/docsgen/testdata/anchors.md
deleted file mode 100644
index 43f79c975ad..00000000000
--- a/bundle/docsgen/testdata/anchors.md
+++ /dev/null
@@ -1,29 +0,0 @@
-Header
-  
-## some_field
-  
-**`Type: Map`**
-  
-This is a description
-  
-  
-  
-:::list-table
-  
-- - Key
-  - Type
-  - Description
-  
-- - `my_attribute`
-  - Map
-  - Desc with link. See [\_](#some_fieldnamemy_attribute).
-  
-:::
-  
-  
-### some_field._name_.my_attribute
-  
-**`Type: Boolean`**
-  
-Another description
-  
\ No newline at end of file
diff --git a/bundle/env/dms.go b/bundle/env/dms.go
new file mode 100644
index 00000000000..a92d9f09a07
--- /dev/null
+++ b/bundle/env/dms.go
@@ -0,0 +1,20 @@
+package env
+
+import "context"
+
+// DeploymentHistoryVariable enables recording without setting the config field.
+// Exists for CLI acceptance tests so the whole bundle suite runs with recording on.
+// Deliberately undocumented.
+const DeploymentHistoryVariable = "DATABRICKS_BUNDLE_DEPLOYMENT_HISTORY"
+
+// RecordsDeploymentHistory reports whether recording is on, from config or env var. Single predicate
+// for all recording code paths, keeping them in sync. Explicit config takes priority over the env var.
+// The env var only counts as "true": anything
+// else - a typo like "TRUE" or "yes" - leaves recording off rather than silently enabling it.
+func RecordsDeploymentHistory(ctx context.Context, configured *bool) bool {
+	if configured != nil {
+		return *configured
+	}
+	value, _ := get(ctx, []string{DeploymentHistoryVariable})
+	return value == "true"
+}
diff --git a/bundle/env/dms_test.go b/bundle/env/dms_test.go
new file mode 100644
index 00000000000..5bfad6df39a
--- /dev/null
+++ b/bundle/env/dms_test.go
@@ -0,0 +1,55 @@
+package env
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/env"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestDeploymentHistoryEnv(t *testing.T) {
+	for _, tc := range []struct {
+		value string
+		want  bool
+	}{
+		{"true", true},
+		{"", false},
+		{"0", false},
+		{"false", false},
+		// Only "true" counts, so a near miss leaves recording off.
+		{"1", false},
+		{"TRUE", false},
+		{"yes", false},
+	} {
+		ctx := env.Set(t.Context(), DeploymentHistoryVariable, tc.value)
+		assert.Equal(t, tc.want, RecordsDeploymentHistory(ctx, nil), "value %q", tc.value)
+	}
+}
+
+func TestDeploymentHistoryEnvUnset(t *testing.T) {
+	assert.False(t, RecordsDeploymentHistory(t.Context(), nil))
+}
+
+func TestRecordsDeploymentHistory(t *testing.T) {
+	for _, tc := range []struct {
+		name       string
+		configured *bool
+		value      string
+		want       bool
+	}{
+		{"config true env true", new(true), "true", true},
+		{"config true env false", new(true), "false", true},
+		{"config true env unset", new(true), "", true},
+		{"config false env true", new(false), "true", false},
+		{"config false env false", new(false), "false", false},
+		{"config false env unset", new(false), "", false},
+		{"config unset env true", nil, "true", true},
+		{"config unset env false", nil, "false", false},
+		{"config unset env unset", nil, "", false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx := env.Set(t.Context(), DeploymentHistoryVariable, tc.value)
+			assert.Equal(t, tc.want, RecordsDeploymentHistory(ctx, tc.configured))
+		})
+	}
+}
diff --git a/bundle/env/env_test.go b/bundle/env/env_test.go
index 57de2c5dc3c..6e638de0ccd 100644
--- a/bundle/env/env_test.go
+++ b/bundle/env/env_test.go
@@ -19,7 +19,7 @@ func TestGetWithRealEnvSingleVariable(t *testing.T) {
 	// Not set.
 	v, ok = get(t.Context(), []string{"v2"})
 	require.False(t, ok)
-	assert.Equal(t, "", v)
+	assert.Empty(t, v)
 }
 
 func TestGetWithRealEnvMultipleVariables(t *testing.T) {
@@ -39,5 +39,5 @@ func TestGetWithRealEnvMultipleVariables(t *testing.T) {
 	// Not set.
 	v, ok := get(t.Context(), []string{"v2", "v3", "v4"})
 	require.False(t, ok)
-	assert.Equal(t, "", v)
+	assert.Empty(t, v)
 }
diff --git a/bundle/env/resource_max_wait.go b/bundle/env/resource_max_wait.go
new file mode 100644
index 00000000000..b836a0ab8d1
--- /dev/null
+++ b/bundle/env/resource_max_wait.go
@@ -0,0 +1,13 @@
+package env
+
+import "context"
+
+// ResourceMaxWaitVariable names the environment variable that caps how long deployment waits
+// for a resource to reach its target state.
+const ResourceMaxWaitVariable = "DATABRICKS_BUNDLE_RESOURCE_MAX_WAIT"
+
+// ResourceMaxWait returns the cap (in seconds) on waiting for a resource to reach its target
+// state.
+func ResourceMaxWait(ctx context.Context) (string, bool) {
+	return get(ctx, []string{ResourceMaxWaitVariable})
+}
diff --git a/bundle/env/root_test.go b/bundle/env/root_test.go
index 5e2e59995b8..3e18e65e0d8 100644
--- a/bundle/env/root_test.go
+++ b/bundle/env/root_test.go
@@ -37,6 +37,6 @@ func TestRoot(t *testing.T) {
 	t.Run("not set", func(t *testing.T) {
 		root, ok := Root(ctx)
 		assert.False(t, ok)
-		assert.Equal(t, "", root)
+		assert.Empty(t, root)
 	})
 }
diff --git a/bundle/env/strict_profile_match.go b/bundle/env/strict_profile_match.go
new file mode 100644
index 00000000000..6e750e160ed
--- /dev/null
+++ b/bundle/env/strict_profile_match.go
@@ -0,0 +1,24 @@
+package env
+
+import (
+	"context"
+
+	envlib "github.com/databricks/cli/libs/env"
+)
+
+// StrictProfileMatchVariable names the environment variable that enables strict
+// profile matching. When it is true, a bundle target with a host or workspace ID
+// must match exactly one workspace profile in the config file, even if
+// credentials are also set in the environment. A profile without a workspace_id
+// matches only targets without a workspace ID. Every section with a host counts,
+// including [DEFAULT]. A target with a workspace ID but no host uses the profile
+// from --profile, workspace.profile or [__settings__].default_profile instead. A
+// target with neither resolves as without strict mode.
+const StrictProfileMatchVariable = "DATABRICKS_BUNDLE_STRICT_PROFILE_MATCH"
+
+// StrictProfileMatch reports whether strict profile matching is enabled. The
+// value is read as a boolean, so "0" or "false" leave it off.
+func StrictProfileMatch(ctx context.Context) bool {
+	enabled, _ := envlib.GetBool(ctx, StrictProfileMatchVariable)
+	return enabled
+}
diff --git a/bundle/env/strict_profile_match_test.go b/bundle/env/strict_profile_match_test.go
new file mode 100644
index 00000000000..460a913e34e
--- /dev/null
+++ b/bundle/env/strict_profile_match_test.go
@@ -0,0 +1,30 @@
+package env
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/env"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestStrictProfileMatch(t *testing.T) {
+	for _, tc := range []struct {
+		value string
+		want  bool
+	}{
+		{"1", true},
+		{"true", true},
+		{"yes", true},
+		{"0", false},
+		{"false", false},
+		{"no", false},
+		{"", false},
+	} {
+		ctx := env.Set(t.Context(), StrictProfileMatchVariable, tc.value)
+		assert.Equal(t, tc.want, StrictProfileMatch(ctx), "value %q", tc.value)
+	}
+}
+
+func TestStrictProfileMatchUnset(t *testing.T) {
+	assert.False(t, StrictProfileMatch(t.Context()))
+}
diff --git a/bundle/env/target_test.go b/bundle/env/target_test.go
index 9d9029f92e2..52db065559c 100644
--- a/bundle/env/target_test.go
+++ b/bundle/env/target_test.go
@@ -37,6 +37,6 @@ func TestTarget(t *testing.T) {
 	t.Run("not set", func(t *testing.T) {
 		target, ok := Target(ctx)
 		assert.False(t, ok)
-		assert.Equal(t, "", target)
+		assert.Empty(t, target)
 	})
 }
diff --git a/bundle/env/temp_dir_test.go b/bundle/env/temp_dir_test.go
index 2a39bcc8758..062b1b0ed1d 100644
--- a/bundle/env/temp_dir_test.go
+++ b/bundle/env/temp_dir_test.go
@@ -22,6 +22,6 @@ func TestTempDir(t *testing.T) {
 	t.Run("not set", func(t *testing.T) {
 		tempDir, ok := TempDir(ctx)
 		assert.False(t, ok)
-		assert.Equal(t, "", tempDir)
+		assert.Empty(t, tempDir)
 	})
 }
diff --git a/bundle/generate/alert.go b/bundle/generate/alert.go
index 3f2428b72e3..eba68126dd8 100644
--- a/bundle/generate/alert.go
+++ b/bundle/generate/alert.go
@@ -1,6 +1,7 @@
 package generate
 
 import (
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/databricks-sdk-go/service/sql"
 )
@@ -9,9 +10,9 @@ func ConvertAlertToValue(alert *sql.AlertV2, filePath string) (dyn.Value, error)
 	// The majority of fields of the alert struct are present in .dbalert.json file.
 	// We copy the relevant fields manually.
 	dv := map[string]dyn.Value{
-		"display_name": dyn.NewValue(alert.DisplayName, []dyn.Location{{Line: 1}}),
-		"warehouse_id": dyn.NewValue(alert.WarehouseId, []dyn.Location{{Line: 2}}),
-		"file_path":    dyn.NewValue(filePath, []dyn.Location{{Line: 3}}),
+		"display_name": dyn.NewValue(alert.DisplayName, []diag.Location{{Line: 1}}),
+		"warehouse_id": dyn.NewValue(alert.WarehouseId, []diag.Location{{Line: 2}}),
+		"file_path":    dyn.NewValue(filePath, []diag.Location{{Line: 3}}),
 	}
 
 	return dyn.V(dv), nil
diff --git a/bundle/generate/app.go b/bundle/generate/app.go
index b4a37d8d6de..0714fc9b324 100644
--- a/bundle/generate/app.go
+++ b/bundle/generate/app.go
@@ -1,6 +1,7 @@
 package generate
 
 import (
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/cli/libs/dyn/convert"
 	"github.com/databricks/databricks-sdk-go/service/apps"
@@ -15,14 +16,69 @@ func ConvertAppToValue(app *apps.App, sourceCodePath string) (dyn.Value, error)
 	// The majority of fields of the app struct are read-only.
 	// We copy the relevant fields manually.
 	dv := map[string]dyn.Value{
-		"name":             dyn.NewValue(app.Name, []dyn.Location{{Line: 1}}),
-		"description":      dyn.NewValue(app.Description, []dyn.Location{{Line: 2}}),
-		"source_code_path": dyn.NewValue(sourceCodePath, []dyn.Location{{Line: 3}}),
+		"name":        dyn.NewValue(app.Name, []diag.Location{{Line: 1}}),
+		"description": dyn.NewValue(app.Description, []diag.Location{{Line: 2}}),
+	}
+
+	// For a git-backed app, emit git_repository + git_source instead of a
+	// workspace source_code_path. Otherwise the generated bundle would silently
+	// down-convert the app to workspace source and point source_code_path at a
+	// local directory that has nothing downloaded into it.
+	if app.GitRepository != nil {
+		dv["git_repository"] = gitRepositoryValue(app.GitRepository)
+		if gs := gitSourceValue(app); gs.Kind() != dyn.KindNil {
+			dv["git_source"] = gs
+		}
+	} else {
+		dv["source_code_path"] = dyn.NewValue(sourceCodePath, []diag.Location{{Line: 4}})
 	}
 
 	if ar.Kind() != dyn.KindNil {
-		dv["resources"] = ar.WithLocations([]dyn.Location{{Line: 5}})
+		dv["resources"] = ar.WithLocations([]diag.Location{{Line: 5}})
 	}
 
 	return dyn.V(dv), nil
 }
+
+func gitRepositoryValue(r *apps.GitRepository) dyn.Value {
+	m := map[string]dyn.Value{
+		"url":      dyn.NewValue(r.Url, []diag.Location{{Line: 1}}),
+		"provider": dyn.NewValue(r.Provider, []diag.Location{{Line: 2}}),
+	}
+	if r.AutoDeploy {
+		m["auto_deploy"] = dyn.NewValue(r.AutoDeploy, []diag.Location{{Line: 3}})
+	}
+	return dyn.NewValue(m, []diag.Location{{Line: 3}})
+}
+
+// gitSourceValue returns the reference the app deploys from (branch, tag, or
+// commit, plus an optional repo-relative source_code_path). It prefers the
+// configured git_source and falls back to the default source of the app's most
+// recent deployment. System-populated fields (resolved_commit and the nested
+// git_repository) are intentionally omitted.
+func gitSourceValue(app *apps.App) dyn.Value {
+	src := app.GitSource
+	if src == nil {
+		src = app.DefaultGitSource
+	}
+	if src == nil {
+		return dyn.NilValue
+	}
+
+	m := map[string]dyn.Value{}
+	switch {
+	case src.Branch != "":
+		m["branch"] = dyn.NewValue(src.Branch, []diag.Location{{Line: 1}})
+	case src.Tag != "":
+		m["tag"] = dyn.NewValue(src.Tag, []diag.Location{{Line: 1}})
+	case src.Commit != "":
+		m["commit"] = dyn.NewValue(src.Commit, []diag.Location{{Line: 1}})
+	}
+	if src.SourceCodePath != "" {
+		m["source_code_path"] = dyn.NewValue(src.SourceCodePath, []diag.Location{{Line: 2}})
+	}
+	if len(m) == 0 {
+		return dyn.NilValue
+	}
+	return dyn.NewValue(m, []diag.Location{{Line: 4}})
+}
diff --git a/bundle/generate/dashboard.go b/bundle/generate/dashboard.go
index 46014080693..6f045a39cb2 100644
--- a/bundle/generate/dashboard.go
+++ b/bundle/generate/dashboard.go
@@ -1,6 +1,7 @@
 package generate
 
 import (
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/databricks-sdk-go/service/dashboards"
 )
@@ -9,9 +10,9 @@ func ConvertDashboardToValue(dashboard *dashboards.Dashboard, filePath string) (
 	// The majority of fields of the dashboard struct are read-only.
 	// We copy the relevant fields manually.
 	dv := map[string]dyn.Value{
-		"display_name": dyn.NewValue(dashboard.DisplayName, []dyn.Location{{Line: 1}}),
-		"warehouse_id": dyn.NewValue(dashboard.WarehouseId, []dyn.Location{{Line: 2}}),
-		"file_path":    dyn.NewValue(filePath, []dyn.Location{{Line: 3}}),
+		"display_name": dyn.NewValue(dashboard.DisplayName, []diag.Location{{Line: 1}}),
+		"warehouse_id": dyn.NewValue(dashboard.WarehouseId, []diag.Location{{Line: 2}}),
+		"file_path":    dyn.NewValue(filePath, []diag.Location{{Line: 3}}),
 	}
 
 	return dyn.V(dv), nil
diff --git a/bundle/generate/downloader.go b/bundle/generate/downloader.go
index d37f2a12f47..6cacd948c58 100644
--- a/bundle/generate/downloader.go
+++ b/bundle/generate/downloader.go
@@ -10,7 +10,9 @@ import (
 	"path/filepath"
 	"strings"
 
+	"github.com/databricks/cli/libs/auth"
 	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/log"
 	"github.com/databricks/cli/libs/notebook"
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/service/jobs"
@@ -32,14 +34,44 @@ type Downloader struct {
 	sourceDir string
 	configDir string
 	basePath  string
+
+	// downloadSparkPythonFiles controls whether workspace files referenced by a
+	// spark_python_task are downloaded. It is opt-in because a Python file often
+	// imports sibling files that are not captured, so downloading only the entry
+	// point can produce a job that fails at runtime with missing imports.
+	downloadSparkPythonFiles bool
+}
+
+// DownloaderOption configures a Downloader.
+type DownloaderOption func(*Downloader)
+
+// WithSparkPythonFiles enables downloading workspace files referenced by a
+// spark_python_task.
+func WithSparkPythonFiles() DownloaderOption {
+	return func(n *Downloader) {
+		n.downloadSparkPythonFiles = true
+	}
 }
 
 func (n *Downloader) MarkTaskForDownload(ctx context.Context, task *jobs.Task) error {
-	if task.NotebookTask == nil {
-		return nil
+	if task.NotebookTask != nil {
+		return n.markNotebookForDownload(ctx, &task.NotebookTask.NotebookPath)
+	}
+
+	if n.downloadSparkPythonFiles && task.SparkPythonTask != nil && isWorkspaceFileTask(task.SparkPythonTask.Source, task.SparkPythonTask.PythonFile) {
+		return n.markFileForDownload(ctx, &task.SparkPythonTask.PythonFile)
 	}
 
-	return n.markNotebookForDownload(ctx, &task.NotebookTask.NotebookPath)
+	return nil
+}
+
+// isWorkspaceFileTask reports whether a task file lives in the Databricks
+// workspace and should be downloaded. Files sourced from Git (source: GIT) are
+// left to the Git repository, and python_file also accepts cloud URIs
+// (dbfs:/, s3:/, adls:/, gcs:/) which are not workspace paths; per the Jobs API,
+// workspace files are absolute and begin with "/".
+func isWorkspaceFileTask(source jobs.Source, filePath string) bool {
+	return source != jobs.SourceGit && strings.HasPrefix(filePath, "/")
 }
 
 func (n *Downloader) MarkPipelineLibraryForDownload(ctx context.Context, lib *pipelines.PipelineLibrary) error {
@@ -55,7 +87,7 @@ func (n *Downloader) MarkPipelineLibraryForDownload(ctx context.Context, lib *pi
 }
 
 func (n *Downloader) markFileForDownload(ctx context.Context, filePath *string) error {
-	_, err := n.w.Workspace.GetStatusByPath(ctx, *filePath) //nolint:staticcheck // Deprecated in SDK v0.127.0. Migration to WorkspaceHierarchyService tracked separately.
+	_, err := n.w.Workspace.GetStatusByPath(ctx, *filePath)
 	if err != nil {
 		return err
 	}
@@ -73,12 +105,12 @@ func (n *Downloader) markFileForDownload(ctx context.Context, filePath *string)
 		return err
 	}
 
-	*filePath = rel
+	*filePath = filepath.ToSlash(rel)
 	return nil
 }
 
 func (n *Downloader) MarkDirectoryForDownload(ctx context.Context, dirPath *string) error {
-	_, err := n.w.Workspace.GetStatusByPath(ctx, *dirPath) //nolint:staticcheck // Deprecated in SDK v0.127.0. Migration to WorkspaceHierarchyService tracked separately.
+	_, err := n.w.Workspace.GetStatusByPath(ctx, *dirPath)
 	if err != nil {
 		return err
 	}
@@ -94,13 +126,17 @@ func (n *Downloader) MarkDirectoryForDownload(ctx context.Context, dirPath *stri
 	}
 
 	for _, obj := range objects {
-		if obj.ObjectType == workspace.ObjectTypeDirectory {
+		switch obj.ObjectType {
+		case workspace.ObjectTypeDirectory:
 			continue
-		}
-
-		err := n.markFileForDownload(ctx, &obj.Path)
-		if err != nil {
-			return err
+		case workspace.ObjectTypeNotebook:
+			if err := n.markNotebookForDownload(ctx, &obj.Path); err != nil {
+				return err
+			}
+		default:
+			if err := n.markFileForDownload(ctx, &obj.Path); err != nil {
+				return err
+			}
 		}
 	}
 
@@ -109,7 +145,7 @@ func (n *Downloader) MarkDirectoryForDownload(ctx context.Context, dirPath *stri
 		return err
 	}
 
-	*dirPath = rel
+	*dirPath = filepath.ToSlash(rel)
 	return nil
 }
 
@@ -118,7 +154,7 @@ func (n *Downloader) MarkDirectoryForDownload(ctx context.Context, dirPath *stri
 func (n *Downloader) recursiveListWithExclusions(ctx context.Context, dirPath string) ([]workspace.ObjectInfo, error) {
 	var result []workspace.ObjectInfo
 
-	objects, err := n.w.Workspace.ListAll(ctx, workspace.ListWorkspaceRequest{ //nolint:staticcheck // Deprecated in SDK v0.127.0. Migration to WorkspaceHierarchyService tracked separately.
+	objects, err := n.w.Workspace.ListAll(ctx, workspace.ListWorkspaceRequest{
 		Path: dirPath,
 	})
 	if err != nil {
@@ -161,7 +197,7 @@ func (n *Downloader) markNotebookForDownload(ctx context.Context, notebookPath *
 		ctx,
 		http.MethodGet,
 		"/api/2.0/workspace/get-status",
-		nil,
+		auth.WorkspaceIDHeaders(n.w.Config),
 		nil,
 		map[string]string{
 			"path":               *notebookPath,
@@ -174,27 +210,30 @@ func (n *Downloader) markNotebookForDownload(ctx context.Context, notebookPath *
 	}
 
 	relPath := n.relativePath(*notebookPath)
-	// If the path has any extension, strip it
-	ext := path.Ext(relPath)
-	if ext != "" {
-		relPath = strings.TrimSuffix(relPath, ext)
-	}
-
-	ext = notebook.GetExtensionByLanguage(&workspace.ObjectInfo{
-		Language:   stat.Language,
-		ObjectType: stat.ObjectType,
-	})
 
-	if stat.ExportFormat == workspace.ExportFormatJupyter {
-		ext = ".ipynb"
+	relPath = notebook.StripExtension(relPath)
+
+	format := stat.ExportFormat
+	if fixed, ok := notebook.FixedExportFormat(stat.ObjectType); ok {
+		// These object types carry their full extension in the workspace path
+		// (preserved above) and report no export format, so we use a fixed one.
+		format = fixed
+	} else {
+		ext := notebook.GetExtensionByLanguage(&workspace.ObjectInfo{
+			Language:   stat.Language,
+			ObjectType: stat.ObjectType,
+		})
+		if format == workspace.ExportFormatJupyter {
+			ext = notebook.ExtensionJupyter
+		}
+		relPath += ext
 	}
 
-	relPath = relPath + ext
 	targetPath := filepath.Join(n.sourceDir, relPath)
 
 	n.files[targetPath] = exportFile{
 		path:   *notebookPath,
-		format: stat.ExportFormat,
+		format: format,
 	}
 
 	// Update the notebook path to be relative to the config dir
@@ -203,10 +242,78 @@ func (n *Downloader) markNotebookForDownload(ctx context.Context, notebookPath *
 		return err
 	}
 
-	*notebookPath = rel
+	*notebookPath = filepath.ToSlash(rel)
 	return nil
 }
 
+func (n *Downloader) MarkTasksForDownload(ctx context.Context, tasks []jobs.Task) error {
+	var paths []string
+	for _, task := range tasks {
+		if task.NotebookTask != nil {
+			paths = append(paths, task.NotebookTask.NotebookPath)
+		}
+		if n.downloadSparkPythonFiles && task.SparkPythonTask != nil && isWorkspaceFileTask(task.SparkPythonTask.Source, task.SparkPythonTask.PythonFile) {
+			paths = append(paths, task.SparkPythonTask.PythonFile)
+		}
+	}
+	if len(paths) > 0 {
+		n.basePath = commonDirPrefix(paths)
+	}
+	for i := range tasks {
+		if err := n.MarkTaskForDownload(ctx, &tasks[i]); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (n *Downloader) CleanupOldFiles(ctx context.Context) {
+	for targetPath := range n.files {
+		rel, err := filepath.Rel(n.sourceDir, targetPath)
+		if err != nil {
+			continue
+		}
+		if filepath.Base(rel) == rel {
+			continue
+		}
+		oldPath := filepath.Join(n.sourceDir, filepath.Base(rel))
+		if _, isNewFile := n.files[oldPath]; isNewFile {
+			continue
+		}
+		if err := os.Remove(oldPath); err == nil {
+			log.Infof(ctx, "Removed previously generated file %s", filepath.ToSlash(oldPath))
+		}
+	}
+}
+
+// commonDirPrefix returns the longest common directory-aligned prefix of the given paths.
+func commonDirPrefix(paths []string) string {
+	if len(paths) == 0 {
+		return ""
+	}
+	if len(paths) == 1 {
+		return path.Dir(paths[0])
+	}
+
+	prefix := paths[0]
+	for _, p := range paths[1:] {
+		for !strings.HasPrefix(p, prefix) {
+			prefix = prefix[:len(prefix)-1]
+			if prefix == "" {
+				return ""
+			}
+		}
+	}
+
+	// Truncate to last '/' to ensure directory alignment.
+	if i := strings.LastIndex(prefix, "/"); i >= 0 {
+		prefix = prefix[:i]
+	} else {
+		prefix = ""
+	}
+	return prefix
+}
+
 func (n *Downloader) relativePath(fullPath string) string {
 	basePath := path.Dir(fullPath)
 	if n.basePath != "" {
@@ -254,9 +361,8 @@ func (n *Downloader) FlushToDisk(ctx context.Context, force bool) error {
 			if err != nil {
 				return err
 			}
-			defer file.Close()
 
-			_, err = io.Copy(file, reader)
+			err = writeAndClose(file, reader)
 			if err != nil {
 				return err
 			}
@@ -269,11 +375,27 @@ func (n *Downloader) FlushToDisk(ctx context.Context, force bool) error {
 	return errs.Wait()
 }
 
-func NewDownloader(w *databricks.WorkspaceClient, sourceDir, configDir string) *Downloader {
-	return &Downloader{
+// writeAndClose copies src into dst and closes dst. A copy error takes
+// precedence; otherwise the Close error is returned because a failed Close
+// can mean buffered writes were lost and the file is truncated.
+func writeAndClose(dst io.WriteCloser, src io.Reader) error {
+	_, err := io.Copy(dst, src)
+	cerr := dst.Close()
+	if err == nil {
+		err = cerr
+	}
+	return err
+}
+
+func NewDownloader(w *databricks.WorkspaceClient, sourceDir, configDir string, opts ...DownloaderOption) *Downloader {
+	n := &Downloader{
 		files:     make(map[string]exportFile),
 		w:         w,
 		sourceDir: sourceDir,
 		configDir: configDir,
 	}
+	for _, opt := range opts {
+		opt(n)
+	}
+	return n
 }
diff --git a/bundle/generate/downloader_test.go b/bundle/generate/downloader_test.go
index d0877ac3d29..ed2e4e6e145 100644
--- a/bundle/generate/downloader_test.go
+++ b/bundle/generate/downloader_test.go
@@ -1,10 +1,22 @@
 package generate
 
 import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
 	"path/filepath"
+	"strings"
 	"testing"
+	"testing/iotest"
 
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/experimental/mocks"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
 	"github.com/databricks/databricks-sdk-go/service/workspace"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -28,7 +40,7 @@ func TestDownloader_MarkFileReturnsRelativePath(t *testing.T) {
 	}, nil)
 	err = downloader.markFileForDownload(ctx, &f1)
 	require.NoError(t, err)
-	assert.Equal(t, filepath.FromSlash("../source/c"), f1)
+	assert.Equal(t, "../source/c", f1)
 
 	// Test that the previous path doesn't influence the next path.
 	f2 := "/a/b/c/d"
@@ -37,7 +49,7 @@ func TestDownloader_MarkFileReturnsRelativePath(t *testing.T) {
 	}, nil)
 	err = downloader.markFileForDownload(ctx, &f2)
 	require.NoError(t, err)
-	assert.Equal(t, filepath.FromSlash("../source/d"), f2)
+	assert.Equal(t, "../source/d", f2)
 }
 
 func TestDownloader_DoesNotRecurseIntoNodeModules(t *testing.T) {
@@ -93,3 +105,479 @@ func TestDownloader_DoesNotRecurseIntoNodeModules(t *testing.T) {
 	assert.Contains(t, downloader.files, filepath.Join(sourceDir, "app.py"))
 	assert.Contains(t, downloader.files, filepath.Join(sourceDir, "src/index.js"))
 }
+
+func TestCommonDirPrefix(t *testing.T) {
+	tests := []struct {
+		name  string
+		paths []string
+		want  string
+	}{
+		{
+			name:  "empty",
+			paths: nil,
+			want:  "",
+		},
+		{
+			name:  "single path",
+			paths: []string{"/a/b/c"},
+			want:  "/a/b",
+		},
+		{
+			name:  "shared parent",
+			paths: []string{"/a/b/c", "/a/b/d"},
+			want:  "/a/b",
+		},
+		{
+			name:  "root divergence",
+			paths: []string{"/x/y", "/z/w"},
+			want:  "",
+		},
+		{
+			name:  "partial dir name safety",
+			paths: []string{"/a/bc/d", "/a/bd/e"},
+			want:  "/a",
+		},
+		{
+			name:  "nested shared prefix",
+			paths: []string{"/Users/user/project/etl/extract", "/Users/user/project/reporting/dashboard"},
+			want:  "/Users/user/project",
+		},
+		{
+			name:  "identical paths",
+			paths: []string{"/a/b/c", "/a/b/c"},
+			want:  "/a/b",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, commonDirPrefix(tt.paths))
+		})
+	}
+}
+
+func newTestWorkspaceClient(t *testing.T, handler http.HandlerFunc) *databricks.WorkspaceClient {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/.well-known/databricks-config" {
+			http.NotFound(w, r)
+			return
+		}
+
+		handler(w, r)
+	}))
+	t.Cleanup(server.Close)
+
+	w, err := databricks.NewWorkspaceClient(&databricks.Config{
+		Host:  server.URL,
+		Token: "test-token",
+	})
+	require.NoError(t, err)
+	return w
+}
+
+func notebookStatusHandler(t *testing.T) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/api/2.0/workspace/get-status" {
+			t.Fatalf("unexpected request path: %s", r.URL.Path)
+		}
+		resp := workspaceStatus{
+			Language:     workspace.LanguagePython,
+			ObjectType:   workspace.ObjectTypeNotebook,
+			ExportFormat: workspace.ExportFormatSource,
+		}
+		w.Header().Set("Content-Type", "application/json")
+		err := json.NewEncoder(w).Encode(resp)
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+}
+
+// designerStatusHandler mimics get-status for a Lakeflow Designer file: object
+// type DESIGNER_FILE and no export format reported.
+func designerStatusHandler(t *testing.T) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/api/2.0/workspace/get-status" {
+			t.Fatalf("unexpected request path: %s", r.URL.Path)
+		}
+		resp := workspaceStatus{
+			ObjectType: workspace.ObjectType("DESIGNER_FILE"),
+		}
+		w.Header().Set("Content-Type", "application/json")
+		assert.NoError(t, json.NewEncoder(w).Encode(resp))
+	}
+}
+
+func TestDownloader_MarkTasksForDownload_DesignerNotebook(t *testing.T) {
+	ctx := t.Context()
+	w := newTestWorkspaceClient(t, designerStatusHandler(t))
+
+	dir := "base/dir"
+	sourceDir := filepath.Join(dir, "source")
+	configDir := filepath.Join(dir, "config")
+	downloader := NewDownloader(w, sourceDir, configDir)
+
+	tasks := []jobs.Task{
+		{
+			TaskKey: "designer_task",
+			NotebookTask: &jobs.NotebookTask{
+				NotebookPath: "/Users/user/project/My Pipeline.designer.ipynb",
+			},
+		},
+	}
+
+	err := downloader.MarkTasksForDownload(ctx, tasks)
+	require.NoError(t, err)
+
+	// The ".designer.ipynb" suffix must be preserved, not stripped to ".designer".
+	assert.Equal(t, "../source/My Pipeline.designer.ipynb", tasks[0].NotebookTask.NotebookPath)
+	require.Len(t, downloader.files, 1)
+	f := downloader.files[filepath.Join(sourceDir, "My Pipeline.designer.ipynb")]
+	assert.Equal(t, "/Users/user/project/My Pipeline.designer.ipynb", f.path)
+	// Designer files round-trip as Jupyter notebooks even though get-status
+	// reports no export format.
+	assert.Equal(t, workspace.ExportFormatJupyter, f.format)
+}
+
+func TestDownloader_MarkTasksForDownload_PreservesStructure(t *testing.T) {
+	w := newTestWorkspaceClient(t, notebookStatusHandler(t))
+
+	dir := "base/dir"
+	sourceDir := filepath.Join(dir, "source")
+	configDir := filepath.Join(dir, "config")
+	downloader := NewDownloader(w, sourceDir, configDir)
+
+	tasks := []jobs.Task{
+		{
+			TaskKey: "extract_task",
+			NotebookTask: &jobs.NotebookTask{
+				NotebookPath: "/Users/user/project/etl/extract",
+			},
+		},
+		{
+			TaskKey: "dashboard_task",
+			NotebookTask: &jobs.NotebookTask{
+				NotebookPath: "/Users/user/project/reporting/dashboard",
+			},
+		},
+	}
+
+	err := downloader.MarkTasksForDownload(t.Context(), tasks)
+	require.NoError(t, err)
+
+	assert.Equal(t, "../source/etl/extract.py", tasks[0].NotebookTask.NotebookPath)
+	assert.Equal(t, "../source/reporting/dashboard.py", tasks[1].NotebookTask.NotebookPath)
+	assert.Len(t, downloader.files, 2)
+}
+
+func TestDownloader_MarkTasksForDownload_SingleNotebook(t *testing.T) {
+	ctx := t.Context()
+	w := newTestWorkspaceClient(t, notebookStatusHandler(t))
+
+	dir := "base/dir"
+	sourceDir := filepath.Join(dir, "source")
+	configDir := filepath.Join(dir, "config")
+	downloader := NewDownloader(w, sourceDir, configDir)
+
+	tasks := []jobs.Task{
+		{
+			TaskKey: "task1",
+			NotebookTask: &jobs.NotebookTask{
+				NotebookPath: "/Users/user/project/notebook",
+			},
+		},
+	}
+
+	err := downloader.MarkTasksForDownload(ctx, tasks)
+	require.NoError(t, err)
+
+	// Single notebook: basePath = path.Dir => same as old behavior.
+	assert.Equal(t, "../source/notebook.py", tasks[0].NotebookTask.NotebookPath)
+	assert.Len(t, downloader.files, 1)
+}
+
+func TestDownloader_MarkTasksForDownload_SparkPythonFile(t *testing.T) {
+	ctx := t.Context()
+	m := mocks.NewMockWorkspaceClient(t)
+
+	dir := "base/dir"
+	sourceDir := filepath.Join(dir, "source")
+	configDir := filepath.Join(dir, "config")
+	downloader := NewDownloader(m.WorkspaceClient, sourceDir, configDir, WithSparkPythonFiles())
+
+	pythonFile := "/Users/user/project/etl/job.py"
+	m.GetMockWorkspaceAPI().EXPECT().GetStatusByPath(ctx, pythonFile).Return(&workspace.ObjectInfo{
+		Path: pythonFile,
+	}, nil)
+
+	tasks := []jobs.Task{
+		{
+			TaskKey: "spark_python_task",
+			SparkPythonTask: &jobs.SparkPythonTask{
+				PythonFile: pythonFile,
+			},
+		},
+	}
+
+	err := downloader.MarkTasksForDownload(ctx, tasks)
+	require.NoError(t, err)
+
+	assert.Equal(t, "../source/job.py", tasks[0].SparkPythonTask.PythonFile)
+	require.Len(t, downloader.files, 1)
+	f := downloader.files[filepath.Join(sourceDir, "job.py")]
+	assert.Equal(t, pythonFile, f.path)
+	assert.Equal(t, workspace.ExportFormatSource, f.format)
+}
+
+func TestDownloader_MarkTasksForDownload_SparkPythonFileSkipped(t *testing.T) {
+	ctx := t.Context()
+	// Cloud URIs and Git-sourced files are not workspace paths, so no
+	// get-status/download requests should be made for them.
+	w := newTestWorkspaceClient(t, func(w http.ResponseWriter, r *http.Request) {
+		t.Fatalf("unexpected request: %s %s", r.Method, r.URL.Path)
+	})
+
+	downloader := NewDownloader(w, "source", "config", WithSparkPythonFiles())
+
+	tasks := []jobs.Task{
+		{
+			TaskKey: "cloud_uri_task",
+			SparkPythonTask: &jobs.SparkPythonTask{
+				PythonFile: "dbfs:/FileStore/job.py",
+			},
+		},
+		{
+			TaskKey: "git_task",
+			SparkPythonTask: &jobs.SparkPythonTask{
+				PythonFile: "etl/job.py",
+				Source:     jobs.SourceGit,
+			},
+		},
+	}
+
+	err := downloader.MarkTasksForDownload(ctx, tasks)
+	require.NoError(t, err)
+	assert.Empty(t, downloader.files)
+	assert.Equal(t, "dbfs:/FileStore/job.py", tasks[0].SparkPythonTask.PythonFile)
+	assert.Equal(t, "etl/job.py", tasks[1].SparkPythonTask.PythonFile)
+}
+
+func TestDownloader_MarkTasksForDownload_SparkPythonFileDisabledByDefault(t *testing.T) {
+	ctx := t.Context()
+	// Without WithSparkPythonFiles, workspace files referenced by a
+	// spark_python_task are left untouched, so no requests are made.
+	w := newTestWorkspaceClient(t, func(w http.ResponseWriter, r *http.Request) {
+		t.Fatalf("unexpected request: %s %s", r.Method, r.URL.Path)
+	})
+
+	downloader := NewDownloader(w, "source", "config")
+
+	pythonFile := "/Users/user/project/etl/job.py"
+	tasks := []jobs.Task{
+		{
+			TaskKey: "spark_python_task",
+			SparkPythonTask: &jobs.SparkPythonTask{
+				PythonFile: pythonFile,
+			},
+		},
+	}
+
+	err := downloader.MarkTasksForDownload(ctx, tasks)
+	require.NoError(t, err)
+	assert.Empty(t, downloader.files)
+	assert.Equal(t, pythonFile, tasks[0].SparkPythonTask.PythonFile)
+}
+
+func TestDownloader_MarkTasksForDownload_NoNotebooks(t *testing.T) {
+	ctx := t.Context()
+	w := newTestWorkspaceClient(t, func(w http.ResponseWriter, r *http.Request) {
+		t.Fatalf("unexpected request: %s %s", r.Method, r.URL.Path)
+	})
+
+	downloader := NewDownloader(w, "source", "config")
+
+	tasks := []jobs.Task{
+		{TaskKey: "spark_task"},
+		{TaskKey: "python_wheel_task"},
+	}
+
+	err := downloader.MarkTasksForDownload(ctx, tasks)
+	require.NoError(t, err)
+	assert.Empty(t, downloader.files)
+}
+
+func TestDownloader_FlushToDisk(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+
+	contents := map[string]string{
+		"/Users/user/project/notebook": "# Databricks notebook source\nprint(1)",
+		"/Users/user/project/utils.py": "def helper(): pass",
+	}
+	w := newTestWorkspaceClient(t, func(rw http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/api/2.0/workspace/export" {
+			t.Fatalf("unexpected request path: %s", r.URL.Path)
+		}
+		content, ok := contents[r.URL.Query().Get("path")]
+		if !ok {
+			t.Fatalf("unexpected export path: %s", r.URL.Query().Get("path"))
+		}
+		_, err := rw.Write([]byte(content))
+		if err != nil {
+			t.Fatal(err)
+		}
+	})
+
+	sourceDir := t.TempDir()
+	downloader := NewDownloader(w, sourceDir, "config")
+	downloader.files[filepath.Join(sourceDir, "notebook.py")] = exportFile{
+		path:   "/Users/user/project/notebook",
+		format: workspace.ExportFormatSource,
+	}
+	downloader.files[filepath.Join(sourceDir, "utils.py")] = exportFile{
+		path:   "/Users/user/project/utils.py",
+		format: workspace.ExportFormatSource,
+	}
+
+	err := downloader.FlushToDisk(ctx, false)
+	require.NoError(t, err)
+
+	data, err := os.ReadFile(filepath.Join(sourceDir, "notebook.py"))
+	require.NoError(t, err)
+	assert.Equal(t, contents["/Users/user/project/notebook"], string(data))
+
+	data, err = os.ReadFile(filepath.Join(sourceDir, "utils.py"))
+	require.NoError(t, err)
+	assert.Equal(t, contents["/Users/user/project/utils.py"], string(data))
+}
+
+type fakeWriteCloser struct {
+	bytes.Buffer
+	closeErr error
+}
+
+func (f *fakeWriteCloser) Close() error { return f.closeErr }
+
+func TestWriteAndClose(t *testing.T) {
+	closeErr := errors.New("close failed")
+	readErr := errors.New("read failed")
+
+	tests := []struct {
+		name     string
+		src      io.Reader
+		closeErr error
+		wantErr  error
+		wantData string
+	}{
+		{
+			name:     "success",
+			src:      strings.NewReader("data"),
+			wantData: "data",
+		},
+		{
+			name:     "close error is returned",
+			src:      strings.NewReader("data"),
+			closeErr: closeErr,
+			wantErr:  closeErr,
+			wantData: "data",
+		},
+		{
+			name:     "copy error takes precedence over close error",
+			src:      iotest.ErrReader(readErr),
+			closeErr: closeErr,
+			wantErr:  readErr,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			dst := &fakeWriteCloser{closeErr: tt.closeErr}
+			err := writeAndClose(dst, tt.src)
+			if tt.wantErr == nil {
+				assert.NoError(t, err)
+			} else {
+				assert.ErrorIs(t, err, tt.wantErr)
+			}
+			assert.Equal(t, tt.wantData, dst.String())
+		})
+	}
+}
+
+func TestDownloader_MarkDirectoryForDownload_NotebookGetsExtension(t *testing.T) {
+	ctx := t.Context()
+
+	rootPath := "/pipeline/root"
+	notebookPath := "/pipeline/root/ExploratoryNotebook"
+	filePath := "/pipeline/root/utils.py"
+
+	type listResponse struct {
+		Objects []workspace.ObjectInfo `json:"objects"`
+	}
+
+	w := newTestWorkspaceClient(t, func(rw http.ResponseWriter, r *http.Request) {
+		rw.Header().Set("Content-Type", "application/json")
+		switch r.URL.Path {
+		case "/api/2.0/workspace/list":
+			err := json.NewEncoder(rw).Encode(listResponse{
+				Objects: []workspace.ObjectInfo{
+					{Path: notebookPath, ObjectType: workspace.ObjectTypeNotebook},
+					{Path: filePath, ObjectType: workspace.ObjectTypeFile},
+				},
+			})
+			assert.NoError(t, err)
+		case "/api/2.0/workspace/get-status":
+			path := r.URL.Query().Get("path")
+			switch path {
+			case rootPath:
+				err := json.NewEncoder(rw).Encode(workspace.ObjectInfo{Path: rootPath})
+				assert.NoError(t, err)
+			case notebookPath:
+				err := json.NewEncoder(rw).Encode(workspaceStatus{
+					Language:     workspace.LanguagePython,
+					ObjectType:   workspace.ObjectTypeNotebook,
+					ExportFormat: workspace.ExportFormatSource,
+				})
+				assert.NoError(t, err)
+			case filePath:
+				err := json.NewEncoder(rw).Encode(workspace.ObjectInfo{Path: filePath})
+				assert.NoError(t, err)
+			default:
+				t.Fatalf("unexpected get-status path: %s", path)
+			}
+		default:
+			t.Fatalf("unexpected request: %s %s", r.Method, r.URL.Path)
+		}
+	})
+
+	dir := "base/dir"
+	sourceDir := filepath.Join(dir, "source")
+	configDir := filepath.Join(dir, "config")
+	downloader := NewDownloader(w, sourceDir, configDir)
+
+	err := downloader.MarkDirectoryForDownload(ctx, &rootPath)
+	require.NoError(t, err)
+
+	assert.Contains(t, downloader.files, filepath.Join(sourceDir, "ExploratoryNotebook.py"))
+	assert.NotContains(t, downloader.files, filepath.Join(sourceDir, "ExploratoryNotebook"))
+	assert.Contains(t, downloader.files, filepath.Join(sourceDir, "utils.py"))
+	assert.Len(t, downloader.files, 2)
+}
+
+func TestDownloader_CleanupOldFiles(t *testing.T) {
+	ctx := t.Context()
+	sourceDir := t.TempDir()
+
+	oldExtract := filepath.Join(sourceDir, "extract.py")
+	oldDashboard := filepath.Join(sourceDir, "dashboard.py")
+	unrelated := filepath.Join(sourceDir, "utils.py")
+	require.NoError(t, os.WriteFile(oldExtract, []byte("old"), 0o644))
+	require.NoError(t, os.WriteFile(oldDashboard, []byte("old"), 0o644))
+	require.NoError(t, os.WriteFile(unrelated, []byte("keep"), 0o644))
+
+	downloader := NewDownloader(nil, sourceDir, "config")
+	downloader.files[filepath.Join(sourceDir, "etl", "extract.py")] = exportFile{}
+	downloader.files[filepath.Join(sourceDir, "reporting", "dashboard.py")] = exportFile{}
+
+	downloader.CleanupOldFiles(ctx)
+
+	assert.NoFileExists(t, oldExtract)
+	assert.NoFileExists(t, oldDashboard)
+	assert.FileExists(t, unrelated)
+}
diff --git a/bundle/generate/genie_space.go b/bundle/generate/genie_space.go
new file mode 100644
index 00000000000..639c65f314b
--- /dev/null
+++ b/bundle/generate/genie_space.go
@@ -0,0 +1,29 @@
+package generate
+
+import (
+	"github.com/databricks/cli/libs/diag"
+	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/databricks-sdk-go/service/dashboards"
+)
+
+func ConvertGenieSpaceToValue(genieSpace *dashboards.GenieSpace, filePath string) (dyn.Value, error) {
+	// Emit only the fields a user authors in a bundle. serialized_space is
+	// written to a separate file and referenced via file_path, and output-only
+	// fields (e.g. space_id, etag) must not appear in the generated config, so
+	// we build the value field by field rather than marshaling the struct.
+	dv := map[string]dyn.Value{
+		"title":        dyn.NewValue(genieSpace.Title, []diag.Location{{Line: 1}}),
+		"warehouse_id": dyn.NewValue(genieSpace.WarehouseId, []diag.Location{{Line: 2}}),
+		"file_path":    dyn.NewValue(filePath, []diag.Location{{Line: 3}}),
+	}
+
+	if genieSpace.Description != "" {
+		dv["description"] = dyn.NewValue(genieSpace.Description, []diag.Location{{Line: 4}})
+	}
+
+	if genieSpace.ParentPath != "" {
+		dv["parent_path"] = dyn.NewValue(ensureWorkspacePrefix(genieSpace.ParentPath), []diag.Location{{Line: 5}})
+	}
+
+	return dyn.V(dv), nil
+}
diff --git a/bundle/generate/job.go b/bundle/generate/job.go
index 825caaf4ce6..801eee1f5bd 100644
--- a/bundle/generate/job.go
+++ b/bundle/generate/job.go
@@ -1,6 +1,7 @@
 package generate
 
 import (
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/cli/libs/dyn/yamlsaver"
 	"github.com/databricks/databricks-sdk-go/service/jobs"
@@ -23,7 +24,7 @@ func ConvertJobToValue(job *jobs.Job) (dyn.Value, error) {
 			tasks = append(tasks, v)
 		}
 		// We're using location lines to define the order of keys in exported YAML.
-		value["tasks"] = dyn.NewValue(tasks, []dyn.Location{{Line: jobOrder.Get("tasks")}})
+		value["tasks"] = dyn.NewValue(tasks, []diag.Location{{Line: jobOrder.Get("tasks")}})
 	}
 
 	// We're processing job.Settings.Parameters separately to retain empty default values.
@@ -31,13 +32,13 @@ func ConvertJobToValue(job *jobs.Job) (dyn.Value, error) {
 		var params []dyn.Value
 		for _, parameter := range job.Settings.Parameters {
 			p := map[string]dyn.Value{
-				"name":    dyn.NewValue(parameter.Name, []dyn.Location{{Line: 0}}), // We use Line: 0 to ensure that the name goes first.
-				"default": dyn.NewValue(parameter.Default, []dyn.Location{{Line: 1}}),
+				"name":    dyn.NewValue(parameter.Name, []diag.Location{{Line: 0}}), // We use Line: 0 to ensure that the name goes first.
+				"default": dyn.NewValue(parameter.Default, []diag.Location{{Line: 1}}),
 			}
 			params = append(params, dyn.V(p))
 		}
 
-		value["parameters"] = dyn.NewValue(params, []dyn.Location{{Line: jobOrder.Get("parameters")}})
+		value["parameters"] = dyn.NewValue(params, []diag.Location{{Line: jobOrder.Get("parameters")}})
 	}
 
 	return yamlsaver.ConvertToMapValue(job.Settings, jobOrder, []string{"format", "new_cluster", "existing_cluster_id"}, value)
diff --git a/bundle/generate/pipeline.go b/bundle/generate/pipeline.go
index 223ecba0a92..115330ea0f6 100644
--- a/bundle/generate/pipeline.go
+++ b/bundle/generate/pipeline.go
@@ -15,7 +15,7 @@ func ConvertPipelineToValue(pipeline *pipelines.PipelineSpec, rootPath, remoteRo
 		pipeline.RootPath = rootPath
 	}
 
-	if pipeline.Libraries != nil {
+	if pipeline.Libraries != nil && remoteRootPath != "" {
 		for i := range pipeline.Libraries {
 			lib := &pipeline.Libraries[i]
 			if lib.Glob != nil {
diff --git a/bundle/generate/utils.go b/bundle/generate/utils.go
new file mode 100644
index 00000000000..3d9d7155860
--- /dev/null
+++ b/bundle/generate/utils.go
@@ -0,0 +1,17 @@
+package generate
+
+import (
+	"path"
+	"strings"
+)
+
+// ensureWorkspacePrefix re-adds the /Workspace prefix that the Genie GET API
+// strips from parent_path, so the generated config matches the convention used
+// in hand-written bundles and in deployment state (mirrors the equivalent
+// helper in bundle/direct/dresources/dashboard.go).
+func ensureWorkspacePrefix(parentPath string) string {
+	if parentPath == "/Workspace" || strings.HasPrefix(parentPath, "/Workspace/") {
+		return parentPath
+	}
+	return path.Join("/Workspace", parentPath)
+}
diff --git a/bundle/include.go b/bundle/include.go
new file mode 100644
index 00000000000..a6527d9f792
--- /dev/null
+++ b/bundle/include.go
@@ -0,0 +1,41 @@
+package bundle
+
+import "path/filepath"
+
+// SetIncludePatterns records the raw (unexpanded) 'include' patterns from the
+// root databricks.yml. ProcessRootIncludes calls this before it overwrites
+// Config.Include with the expanded list of loaded files.
+func (b *Bundle) SetIncludePatterns(patterns []string) {
+	b.includePatterns = patterns
+}
+
+// IsFileIncluded reports whether absPath is matched by any of the root
+// 'include' patterns. absPath must be an absolute path. Patterns are resolved
+// against the files currently on disk, so a file generated after load is
+// matched only if it now satisfies one of the patterns.
+func (b *Bundle) IsFileIncluded(absPath string) bool {
+	for _, pattern := range b.includePatterns {
+		// Includes must be relative paths; the loader errors on absolute ones.
+		if filepath.IsAbs(pattern) {
+			continue
+		}
+
+		// Anchor the pattern to the bundle root, same as ProcessRootIncludes.
+		matches, err := filepath.Glob(filepath.Join(b.BundleRootPath, pattern))
+		if err != nil {
+			continue
+		}
+
+		for _, match := range matches {
+			absMatch, err := filepath.Abs(match)
+			if err != nil {
+				continue
+			}
+			if absMatch == absPath {
+				return true
+			}
+		}
+	}
+
+	return false
+}
diff --git a/bundle/include_test.go b/bundle/include_test.go
new file mode 100644
index 00000000000..470a28e45eb
--- /dev/null
+++ b/bundle/include_test.go
@@ -0,0 +1,68 @@
+package bundle
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestIsFileIncluded(t *testing.T) {
+	// Lay out a bundle root with a couple of resource files on disk, because
+	// IsFileIncluded resolves the include patterns with filepath.Glob against
+	// the files that actually exist.
+	root := t.TempDir()
+	included := filepath.Join(root, "resources", "my.job.yml")
+	nested := filepath.Join(root, "resources", "sub", "other.job.yml")
+	for _, f := range []string{included, nested} {
+		require.NoError(t, os.MkdirAll(filepath.Dir(f), 0o755))
+		require.NoError(t, os.WriteFile(f, []byte("{}"), 0o644))
+	}
+
+	tests := []struct {
+		name     string
+		patterns []string
+		filename string
+		want     bool
+	}{
+		{
+			name:     "matched by glob",
+			patterns: []string{"resources/*.yml"},
+			filename: included,
+			want:     true,
+		},
+		{
+			name:     "not matched, empty include",
+			patterns: nil,
+			filename: included,
+			want:     false,
+		},
+		{
+			name:     "glob is not recursive",
+			patterns: []string{"resources/*.yml"},
+			filename: nested,
+			want:     false,
+		},
+		{
+			name:     "matched by exact path",
+			patterns: []string{"resources/my.job.yml"},
+			filename: included,
+			want:     true,
+		},
+		{
+			name:     "absolute include pattern is ignored",
+			patterns: []string{included},
+			filename: included,
+			want:     false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			b := &Bundle{BundleRootPath: root}
+			b.SetIncludePatterns(tt.patterns)
+			require.Equal(t, tt.want, b.IsFileIncluded(tt.filename))
+		})
+	}
+}
diff --git a/bundle/internal/annotation/descriptor.go b/bundle/internal/annotation/descriptor.go
index 797746b0df8..eb2f348524c 100644
--- a/bundle/internal/annotation/descriptor.go
+++ b/bundle/internal/annotation/descriptor.go
@@ -1,15 +1,19 @@
 package annotation
 
+import "github.com/databricks/cli/internal/clijson"
+
 type Descriptor struct {
-	Description         string `json:"description,omitempty"`
-	MarkdownDescription string `json:"markdown_description,omitempty"`
-	Title               string `json:"title,omitempty"`
-	Default             any    `json:"default,omitempty"`
-	Enum                []any  `json:"enum,omitempty"`
-	MarkdownExamples    string `json:"markdown_examples,omitempty"`
-	DeprecationMessage  string `json:"deprecation_message,omitempty"`
-	Preview             string `json:"x-databricks-preview,omitempty"`
-	OutputOnly          *bool  `json:"x-databricks-field-behaviors_output_only,omitempty"`
+	Description         string                         `json:"description,omitempty"`
+	MarkdownDescription string                         `json:"markdown_description,omitempty"`
+	Title               string                         `json:"title,omitempty"`
+	Default             any                            `json:"default,omitempty"`
+	Enum                []any                          `json:"enum,omitempty"`
+	MarkdownExamples    string                         `json:"markdown_examples,omitempty"`
+	DeprecationMessage  string                         `json:"deprecation_message,omitempty"`
+	LaunchStage         clijson.LaunchStage            `json:"x-databricks-launch-stage,omitempty"`
+	EnumLaunchStages    map[string]clijson.LaunchStage `json:"x-databricks-enum-launch-stages,omitempty"`
+	EnumDescriptions    map[string]string              `json:"x-databricks-enum-descriptions,omitempty"`
+	OutputOnly          *bool                          `json:"x-databricks-field-behaviors_output_only,omitempty"`
 }
 
 const Placeholder = "PLACEHOLDER"
diff --git a/bundle/internal/annotation/file.go b/bundle/internal/annotation/file.go
index 0317f441a03..cd5474b4ae5 100644
--- a/bundle/internal/annotation/file.go
+++ b/bundle/internal/annotation/file.go
@@ -1,44 +1,32 @@
 package annotation
 
-import (
-	"bytes"
-	"os"
-
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/cli/libs/dyn/merge"
-	"github.com/databricks/cli/libs/dyn/yamlloader"
-)
+// TypeAnnotation holds the documentation for one Go type. Self documents the
+// type itself — it is applied to the type's JSON-schema $defs entry and is
+// where enum values live — and Fields documents each of the type's fields by
+// JSON name.
+type TypeAnnotation struct {
+	Self   Descriptor            `json:"type,omitempty"`
+	Fields map[string]Descriptor `json:"fields,omitempty"`
+}
 
-// Parsed file with annotations, expected format:
-// github.com/databricks/cli/bundle/config.Bundle:
-//
-//	cluster_id:
-//	   description: "Description"
-type File map[string]map[string]Descriptor
+// File is the in-memory annotations, keyed by Go type path, e.g.
+// "github.com/databricks/cli/bundle/config.Bundle".
+type File map[string]TypeAnnotation
 
-func LoadAndMerge(sources []string) (File, error) {
-	prev := dyn.NilValue
-	for _, path := range sources {
-		b, err := os.ReadFile(path)
-		if err != nil {
-			return nil, err
-		}
-		generated, err := yamlloader.LoadYAML(path, bytes.NewBuffer(b))
-		if err != nil {
-			return nil, err
-		}
-		prev, err = merge.Merge(prev, generated)
-		if err != nil {
-			return nil, err
-		}
+// SetField stores a descriptor for a field of typeKey, allocating the entry
+// and its field map as needed.
+func (f File) SetField(typeKey, name string, d Descriptor) {
+	ta := f[typeKey]
+	if ta.Fields == nil {
+		ta.Fields = map[string]Descriptor{}
 	}
+	ta.Fields[name] = d
+	f[typeKey] = ta
+}
 
-	var data File
-
-	err := convert.ToTyped(&data, prev)
-	if err != nil {
-		return nil, err
-	}
-	return data, nil
+// SetSelf stores the descriptor for the type itself.
+func (f File) SetSelf(typeKey string, d Descriptor) {
+	ta := f[typeKey]
+	ta.Self = d
+	f[typeKey] = ta
 }
diff --git a/bundle/internal/annotation/file_test.go b/bundle/internal/annotation/file_test.go
new file mode 100644
index 00000000000..22d04d93877
--- /dev/null
+++ b/bundle/internal/annotation/file_test.go
@@ -0,0 +1,36 @@
+package annotation
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestFileSetField(t *testing.T) {
+	f := File{}
+
+	// SetField allocates the type entry and its field map on first use.
+	f.SetField("pkg.Type", "a", Descriptor{Description: "A"})
+	f.SetField("pkg.Type", "b", Descriptor{Description: "B"})
+
+	assert.Equal(t, "A", f["pkg.Type"].Fields["a"].Description)
+	assert.Equal(t, "B", f["pkg.Type"].Fields["b"].Description)
+
+	// A later SetField overwrites the field, leaving siblings intact.
+	f.SetField("pkg.Type", "a", Descriptor{Description: "A2"})
+	assert.Equal(t, "A2", f["pkg.Type"].Fields["a"].Description)
+	assert.Equal(t, "B", f["pkg.Type"].Fields["b"].Description)
+}
+
+func TestFileSetSelf(t *testing.T) {
+	f := File{}
+
+	f.SetSelf("pkg.Type", Descriptor{Description: "the type"})
+	assert.Equal(t, "the type", f["pkg.Type"].Self.Description)
+
+	// SetSelf and SetField populate the same entry without clobbering each
+	// other.
+	f.SetField("pkg.Type", "a", Descriptor{Description: "A"})
+	assert.Equal(t, "the type", f["pkg.Type"].Self.Description)
+	assert.Equal(t, "A", f["pkg.Type"].Fields["a"].Description)
+}
diff --git a/bundle/internal/annotation/preview.go b/bundle/internal/annotation/preview.go
new file mode 100644
index 00000000000..b4be7348526
--- /dev/null
+++ b/bundle/internal/annotation/preview.go
@@ -0,0 +1,55 @@
+package annotation
+
+import "github.com/databricks/cli/internal/clijson"
+
+// previewTags maps each launch stage to the human-readable prefix prepended to
+// a field's or enum value's description. clijson owns the closed set of stages;
+// this map must cover every one (asserted by TestPreviewTagCoversAllStages). A
+// stage mapping to "" (GA) renders no prefix.
+var previewTags = map[clijson.LaunchStage]string{
+	clijson.LaunchStageGA:             "",
+	clijson.LaunchStagePublicPreview:  "[Public Preview]",
+	clijson.LaunchStagePublicBeta:     "[Beta]",
+	clijson.LaunchStagePrivatePreview: "[Private Preview]",
+}
+
+// PreviewTag returns the human-readable launch-stage prefix to prepend to a
+// field's or enum value's description. GA and the empty stage return "".
+func PreviewTag(stage clijson.LaunchStage) string {
+	return previewTags[stage]
+}
+
+// launchStageOverrides maps a bundle config resource type to the launch stage
+// its fields render at in the generated schema, regardless of the stage the
+// upstream contract assigns each field. It lets the CLI publish a resource at a
+// stage that differs from its API's own launch stage, so an upstream stage
+// change cannot silently alter the resource's label. Keys are the
+// fully-qualified Go type paths (PkgPath + "." + Name), matching getPath in
+// bundle/internal/schema.
+var launchStageOverrides = map[string]clijson.LaunchStage{
+	"github.com/databricks/cli/bundle/config/resources.PostgresBranch":           clijson.LaunchStagePublicBeta,
+	"github.com/databricks/cli/bundle/config/resources.PostgresCatalog":          clijson.LaunchStagePublicBeta,
+	"github.com/databricks/cli/bundle/config/resources.PostgresDatabase":         clijson.LaunchStagePublicBeta,
+	"github.com/databricks/cli/bundle/config/resources.PostgresEndpoint":         clijson.LaunchStagePublicBeta,
+	"github.com/databricks/cli/bundle/config/resources.PostgresProject":          clijson.LaunchStagePublicBeta,
+	"github.com/databricks/cli/bundle/config/resources.PostgresRole":             clijson.LaunchStagePublicBeta,
+	"github.com/databricks/cli/bundle/config/resources.PostgresSnapshotSchedule": clijson.LaunchStagePublicBeta,
+	"github.com/databricks/cli/bundle/config/resources.PostgresSyncedTable":      clijson.LaunchStagePublicBeta,
+}
+
+// OverrideLaunchStage raises a field's launch stage to the type's configured
+// override, unless the field's own stage is already more restrictive (see
+// clijson.MoreRestrictive), in which case the field's stage is kept. This lets
+// the CLI publish a resource at a chosen stage regardless of an upstream stage
+// change, while still respecting a field the contract restricts further. A field
+// of a type without a configured override is returned unchanged.
+func OverrideLaunchStage(typePath string, stage clijson.LaunchStage) clijson.LaunchStage {
+	override, ok := launchStageOverrides[typePath]
+	if !ok {
+		return stage
+	}
+	if clijson.MoreRestrictive(stage, override) {
+		return stage
+	}
+	return override
+}
diff --git a/bundle/internal/annotation/preview_test.go b/bundle/internal/annotation/preview_test.go
new file mode 100644
index 00000000000..d4169af3c26
--- /dev/null
+++ b/bundle/internal/annotation/preview_test.go
@@ -0,0 +1,60 @@
+package annotation_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/bundle/internal/annotation"
+	"github.com/databricks/cli/internal/clijson"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestPreviewTag(t *testing.T) {
+	tests := []struct {
+		launchStage clijson.LaunchStage
+		want        string
+	}{
+		{clijson.LaunchStagePublicPreview, "[Public Preview]"},
+		{clijson.LaunchStagePublicBeta, "[Beta]"},
+		{clijson.LaunchStagePrivatePreview, "[Private Preview]"},
+		{clijson.LaunchStageGA, ""},
+		{"", ""},
+		{"SOMETHING_ELSE", ""},
+	}
+	for _, tc := range tests {
+		assert.Equal(t, tc.want, annotation.PreviewTag(tc.launchStage))
+	}
+}
+
+// Every stage in the contract's closed set must have a tag entry, so a stage
+// added to clijson without a tag here is caught rather than rendering blank.
+// GA intentionally maps to the empty prefix; every other stage must be tagged.
+func TestPreviewTagCoversAllStages(t *testing.T) {
+	for _, stage := range clijson.LaunchStages {
+		if stage == clijson.LaunchStageGA {
+			assert.Empty(t, annotation.PreviewTag(stage))
+			continue
+		}
+		assert.NotEmpty(t, annotation.PreviewTag(stage), "stage %q has no preview tag", stage)
+	}
+}
+
+func TestOverrideLaunchStage(t *testing.T) {
+	const overridden = "github.com/databricks/cli/bundle/config/resources.PostgresProject"
+	tests := []struct {
+		name     string
+		typePath string
+		stage    clijson.LaunchStage
+		want     clijson.LaunchStage
+	}{
+		{"GA field is raised to the override", overridden, "", clijson.LaunchStagePublicBeta},
+		{"less-restrictive public-preview field is raised", overridden, clijson.LaunchStagePublicPreview, clijson.LaunchStagePublicBeta},
+		{"Beta field is unchanged", overridden, clijson.LaunchStagePublicBeta, clijson.LaunchStagePublicBeta},
+		{"more-restrictive private-preview field is kept", overridden, clijson.LaunchStagePrivatePreview, clijson.LaunchStagePrivatePreview},
+		{"field of a type with no override is unchanged", "github.com/databricks/cli/bundle/config/resources.Job", "", ""},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, annotation.OverrideLaunchStage(tc.typePath, tc.stage))
+		})
+	}
+}
diff --git a/bundle/internal/bundletest/location.go b/bundle/internal/bundletest/location.go
index 5dcd9d78f4d..b96cab0907d 100644
--- a/bundle/internal/bundletest/location.go
+++ b/bundle/internal/bundletest/location.go
@@ -2,13 +2,14 @@ package bundletest
 
 import (
 	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
 )
 
 // SetLocation sets the location of all values in the bundle to the given path.
 // This is useful for testing where we need to associate configuration
 // with the path it is loaded from.
-func SetLocation(b *bundle.Bundle, prefix string, locations []dyn.Location) {
+func SetLocation(b *bundle.Bundle, prefix string, locations []diag.Location) {
 	start := dyn.MustPathFromString(prefix)
 	err := b.Config.Mutate(func(root dyn.Value) (dyn.Value, error) {
 		return dyn.Walk(root, func(p dyn.Path, v dyn.Value) (dyn.Value, error) {
diff --git a/bundle/internal/schema/annotations.go b/bundle/internal/schema/annotations.go
index 26b9dcfc0de..548cf5ae95f 100644
--- a/bundle/internal/schema/annotations.go
+++ b/bundle/internal/schema/annotations.go
@@ -1,44 +1,103 @@
 package main
 
 import (
-	"bytes"
 	"fmt"
-	"maps"
-	"os"
 	"reflect"
 	"regexp"
-	"slices"
 	"strings"
 
-	yaml3 "go.yaml.in/yaml/v3"
-
 	"github.com/databricks/cli/bundle/internal/annotation"
+	"github.com/databricks/cli/internal/clijson"
 	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/cli/libs/dyn/convert"
 	"github.com/databricks/cli/libs/dyn/merge"
-	"github.com/databricks/cli/libs/dyn/yamlloader"
-	"github.com/databricks/cli/libs/dyn/yamlsaver"
 	"github.com/databricks/cli/libs/jsonschema"
 )
 
 type annotationHandler struct {
-	// Annotations read from all annotation files including all overrides
+	// Annotations from cli.json merged with the annotations file.
 	parsedAnnotations annotation.File
+	// Annotations from the annotations file only: the content the CLI owns
+	// and rewrites during sync.
+	fileAnnotations annotation.File
 	// Missing annotations for fields that are found in config that need to be added to the annotation file
 	missingAnnotations annotation.File
 }
 
 // Adds annotations to the JSON schema reading from the annotation files.
 // More details https://json-schema.org/understanding-json-schema/reference/annotations
-func newAnnotationHandler(sources []string) (*annotationHandler, error) {
-	data, err := annotation.LoadAndMerge(sources)
+func newAnnotationHandler(extracted, fromFile annotation.File) (*annotationHandler, error) {
+	merged, err := mergeAnnotationFiles(extracted, fromFile)
+	if err != nil {
+		return nil, err
+	}
+	return &annotationHandler{
+		parsedAnnotations:  merged,
+		fileAnnotations:    fromFile,
+		missingAnnotations: annotation.File{},
+	}, nil
+}
+
+// dropShadowingPlaceholders removes PLACEHOLDER descriptions from fromFile for
+// fields that cli.json documents. A PLACEHOLDER marks a field with no
+// documentation anywhere, so once upstream gains a description the marker is
+// stale and would otherwise shadow it in the merge, leaving the schema with no
+// description at all. fromFile is mutated in place: the sync step then rewrites
+// the annotations file without the stale markers. Entries that carry other
+// hand-authored fields (e.g. deprecation_message) lose only the placeholder.
+func dropShadowingPlaceholders(fromFile, extracted annotation.File) {
+	for typePath, ta := range fromFile {
+		for key, d := range ta.Fields {
+			if d.Description != annotation.Placeholder {
+				continue
+			}
+			if extracted[typePath].Fields[key].Description == "" {
+				// Genuinely undocumented: keep the TODO marker.
+				continue
+			}
+			d.Description = ""
+			if isEmptyDescriptor(d) {
+				delete(ta.Fields, key)
+			} else {
+				ta.Fields[key] = d
+			}
+		}
+		if len(ta.Fields) == 0 && isEmptyDescriptor(ta.Self) {
+			delete(fromFile, typePath)
+		}
+	}
+}
+
+// isEmptyDescriptor reports whether d carries no annotation data. It runs after
+// a stale placeholder is cleared, to decide whether the whole entry can be
+// dropped. Comparing against the zero value stays correct as new Descriptor
+// fields are added.
+func isEmptyDescriptor(d annotation.Descriptor) bool {
+	return reflect.DeepEqual(d, annotation.Descriptor{})
+}
+
+// mergeAnnotationFiles merges later layers over earlier ones with the same
+// semantics the on-disk annotation files used to be merged with: maps merge
+// recursively, scalars take the later value, sequences concatenate.
+func mergeAnnotationFiles(files ...annotation.File) (annotation.File, error) {
+	prev := dyn.NilValue
+	for _, f := range files {
+		v, err := convert.FromTyped(f, dyn.NilValue)
+		if err != nil {
+			return nil, err
+		}
+		prev, err = merge.Merge(prev, v)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	var data annotation.File
+	err := convert.ToTyped(&data, prev)
 	if err != nil {
 		return nil, err
 	}
-	d := &annotationHandler{}
-	d.parsedAnnotations = data
-	d.missingAnnotations = annotation.File{}
-	return d, nil
+	return data, nil
 }
 
 func (d *annotationHandler) addAnnotations(typ reflect.Type, s jsonschema.Schema) jsonschema.Schema {
@@ -48,70 +107,35 @@ func (d *annotationHandler) addAnnotations(typ reflect.Type, s jsonschema.Schema
 		return s
 	}
 
-	annotations := d.parsedAnnotations[refPath]
-	if annotations == nil {
-		annotations = map[string]annotation.Descriptor{}
-	}
-
-	rootTypeAnnotation, ok := annotations[RootTypeKey]
-	if ok {
-		assignAnnotation(&s, rootTypeAnnotation)
-	}
+	ta := d.parsedAnnotations[refPath]
+	assignAnnotation(&s, ta.Self)
 
 	for k, v := range s.Properties {
-		item := annotations[k]
+		item := ta.Fields[k]
 		if item.Description == "" {
 			item.Description = annotation.Placeholder
-
-			emptyAnnotations := d.missingAnnotations[refPath]
-			if emptyAnnotations == nil {
-				emptyAnnotations = map[string]annotation.Descriptor{}
-				d.missingAnnotations[refPath] = emptyAnnotations
-			}
-			emptyAnnotations[k] = item
+			d.missingAnnotations.SetField(refPath, k, annotation.Descriptor{Description: annotation.Placeholder})
 		}
 		assignAnnotation(v, item)
 	}
 	return s
 }
 
-// Writes missing annotations with placeholder values back to the annotation file
-func (d *annotationHandler) syncWithMissingAnnotations(outputPath string) error {
-	existingFile, err := os.ReadFile(outputPath)
-	if err != nil {
-		return err
-	}
-	existing, err := yamlloader.LoadYAML("", bytes.NewBuffer(existingFile))
-	if err != nil {
-		return err
-	}
-
-	for k := range d.missingAnnotations {
-		if !isCliPath(k) {
-			delete(d.missingAnnotations, k)
-			fmt.Printf("Missing annotations for `%s` that are not in CLI package, try to fetch latest OpenAPI spec and regenerate annotations\n", k)
-		}
-	}
-
-	missingAnnotations, err := convert.FromTyped(d.missingAnnotations, dyn.NilValue)
-	if err != nil {
-		return err
-	}
-
-	output, err := merge.Merge(existing, missingAnnotations)
+// Writes the annotations file back in canonical form, adding placeholder
+// descriptions for fields that have no documentation anywhere. Entries for
+// fields that no longer exist in the config are dropped with a warning.
+func (d *annotationHandler) syncWithMissingAnnotations(outputPath string, g *typeGraph) error {
+	updated, err := mergeAnnotationFiles(d.fileAnnotations, d.missingAnnotations)
 	if err != nil {
 		return err
 	}
 
-	var outputTyped annotation.File
-	err = convert.ToTyped(&outputTyped, output)
+	detached, err := saveAnnotationsFile(outputPath, updated, g)
 	if err != nil {
 		return err
 	}
-
-	err = saveYamlWithStyle(outputPath, outputTyped)
-	if err != nil {
-		return err
+	for _, k := range detached {
+		fmt.Printf("Dropping annotation for `%s`: no matching field in the bundle configuration\n", k)
 	}
 	return nil
 }
@@ -134,9 +158,17 @@ func assignAnnotation(s *jsonschema.Schema, a annotation.Descriptor) {
 		s.DeprecationMessage = a.DeprecationMessage
 	}
 
-	if a.Preview == "PRIVATE" {
+	// Private-preview fields are hidden from completions.
+	if a.LaunchStage == clijson.LaunchStagePrivatePreview {
 		s.DoNotSuggest = true
-		s.Preview = a.Preview
+	}
+
+	// Emit the launch stage for every field the contract stamps (GA included) so
+	// downstream codegen can read each field's stability, not just private
+	// preview. Fields the contract leaves unstamped stay empty. pydabs reads
+	// x-databricks-launch-stage from jsonschema.json.
+	if a.LaunchStage != "" {
+		s.LaunchStage = string(a.LaunchStage)
 	}
 
 	if a.OutputOnly != nil && *a.OutputOnly {
@@ -146,45 +178,54 @@ func assignAnnotation(s *jsonschema.Schema, a annotation.Descriptor) {
 	s.MarkdownDescription = convertLinksToAbsoluteUrl(a.MarkdownDescription)
 	s.Title = a.Title
 	s.Enum = a.Enum
+	s.EnumDescriptions = buildEnumDescriptions(a.Enum, a.EnumLaunchStages, a.EnumDescriptions)
+
+	// Surface launch stage in hover tooltips. Editors only render the standard
+	// description field, so the tag is baked into the text.
+	if tag := annotation.PreviewTag(a.LaunchStage); tag != "" {
+		s.Description = prefixWithPreviewTag(s.Description, tag)
+	}
 }
 
-func saveYamlWithStyle(outputPath string, annotations annotation.File) error {
-	annotationOrder := yamlsaver.NewOrder([]string{"description", "markdown_description", "title", "default", "enum"})
-	style := map[string]yaml3.Style{}
-
-	order := getAlphabeticalOrder(annotations)
-	dynMap := map[string]dyn.Value{}
-	for k, v := range annotations {
-		style[k] = yaml3.LiteralStyle
-
-		properties := map[string]dyn.Value{}
-		propertiesOrder := getAlphabeticalOrder(v)
-		for key, value := range v {
-			d, err := convert.FromTyped(value, dyn.NilValue)
-			if d.Kind() == dyn.KindNil || err != nil {
-				properties[key] = dyn.NewValue(map[string]dyn.Value{}, []dyn.Location{{Line: propertiesOrder.Get(key)}})
-				continue
-			}
-			val, err := yamlsaver.ConvertToMapValue(value, annotationOrder, []string{}, map[string]dyn.Value{})
-			if err != nil {
-				return err
-			}
-			properties[key] = val.WithLocations([]dyn.Location{{Line: propertiesOrder.Get(key)}})
+// buildEnumDescriptions produces the parallel enumDescriptions array VSCode
+// renders next to each enum value. Each entry combines the launch-stage tag
+// and the per-value description text. Returns nil when every entry would be
+// empty so the field is omitted from the schema. The enum slice is the same
+// one assigned to s.Enum, so the arrays stay index-aligned.
+func buildEnumDescriptions(enum []any, launchStages map[string]clijson.LaunchStage, descriptions map[string]string) []string {
+	if len(enum) == 0 || (len(launchStages) == 0 && len(descriptions) == 0) {
+		return nil
+	}
+	result := make([]string, len(enum))
+	hasContent := false
+	for i, v := range enum {
+		key, ok := v.(string)
+		if !ok {
+			continue
+		}
+		result[i] = prefixWithPreviewTag(descriptions[key], annotation.PreviewTag(launchStages[key]))
+		if result[i] != "" {
+			hasContent = true
 		}
-
-		dynMap[k] = dyn.NewValue(properties, []dyn.Location{{Line: order.Get(k)}})
 	}
-
-	saver := yamlsaver.NewSaverWithStyle(style)
-	err := saver.SaveAsYAML(dynMap, outputPath, true)
-	if err != nil {
-		return err
+	if !hasContent {
+		return nil
 	}
-	return nil
+	return result
 }
 
-func getAlphabeticalOrder[T any](mapping map[string]T) *yamlsaver.Order {
-	return yamlsaver.NewOrder(slices.Sorted(maps.Keys(mapping)))
+// prefixWithPreviewTag prepends the launch-stage tag to a description while
+// guarding against double-tagging — if the description already starts with
+// the tag, it is returned unchanged. An empty tag (GA) also takes the
+// HasPrefix path, returning the description as-is.
+func prefixWithPreviewTag(description, tag string) string {
+	if description == "" {
+		return tag
+	}
+	if strings.HasPrefix(description, tag) {
+		return description
+	}
+	return tag + " " + description
 }
 
 func convertLinksToAbsoluteUrl(s string) string {
@@ -232,7 +273,3 @@ func convertLinksToAbsoluteUrl(s string) string {
 
 	return result
 }
-
-func isCliPath(path string) bool {
-	return !strings.HasPrefix(path, "github.com/databricks/databricks-sdk-go")
-}
diff --git a/bundle/internal/schema/annotations.yml b/bundle/internal/schema/annotations.yml
index 2f28ca27596..1a5c4ccbfdd 100644
--- a/bundle/internal/schema/annotations.yml
+++ b/bundle/internal/schema/annotations.yml
@@ -1,1065 +1,2416 @@
-github.com/databricks/cli/bundle/config.Artifact:
-  "build":
-    "description": |-
-      An optional set of build commands to run locally before deployment.
-  "dynamic_version":
-    "description": |-
-      Whether to patch the wheel version dynamically based on the timestamp of the whl file. If this is set to `true`, new code can be deployed without having to update the version in `setup.py` or `pyproject.toml`. This setting is only valid when `type` is set to `whl`. See [\_](/dev-tools/bundles/settings.md#bundle-syntax-mappings-artifacts).
-  "executable":
-    "description": |-
-      The executable type. Valid values are `bash`, `sh`, and `cmd`.
-  "files":
-    "description": |-
-      The relative or absolute path to the built artifact files.
-  "path":
-    "description": |-
-      The local path of the directory for the artifact.
-  "type":
-    "description": |-
-      Required if the artifact is a Python wheel. The type of the artifact. Valid values are `whl` and `jar`.
-    "markdown_description": |-
-      Required if the artifact is a Python wheel. The type of the artifact. Valid values are `whl` and `jar`.
-github.com/databricks/cli/bundle/config.ArtifactFile:
-  "source":
-    "description": |-
-      Required. The artifact source file.
-github.com/databricks/cli/bundle/config.Bundle:
-  "cluster_id":
-    "description": |-
-      The ID of a cluster to use to run the bundle.
-    "markdown_description": |-
-      The ID of a cluster to use to run the bundle. See [\_](/dev-tools/bundles/settings.md#cluster_id).
-  "compute_id":
-    "description": |-
-      Deprecated. The ID of the compute to use to run the bundle.
-  "databricks_cli_version":
-    "description": |-
-      The Databricks CLI version to use for the bundle.
-    "markdown_description": |-
-      The Databricks CLI version to use for the bundle. See [\_](/dev-tools/bundles/settings.md#databricks_cli_version).
-  "deployment":
-    "description": |-
-      The definition of the bundle deployment
-    "markdown_description": |-
-      The definition of the bundle deployment. For supported attributes see [\_](/dev-tools/bundles/deployment-modes.md).
-  "engine":
-    "description": |-
-      The deployment engine to use. Valid values are `terraform` and `direct`. Takes priority over `DATABRICKS_BUNDLE_ENGINE` environment variable. Default is "terraform".
-  "git":
-    "description": |-
-      The Git version control details that are associated with your bundle.
-    "markdown_description": |-
-      The Git version control details that are associated with your bundle. For supported attributes see [\_](/dev-tools/bundles/settings.md#git).
-  "name":
-    "description": |-
-      The name of the bundle.
-  "uuid":
-    "description": |-
-      Reserved. A Universally Unique Identifier (UUID) for the bundle that uniquely identifies the bundle in internal Databricks systems. This is generated when a bundle project is initialized using a Databricks template (using the `databricks bundle init` command).
-github.com/databricks/cli/bundle/config.Deployment:
-  "fail_on_active_runs":
-    "description": |-
-      Whether to fail on active runs. If this is set to true a deployment that is running can be interrupted.
-  "lock":
-    "description": |-
-      The deployment lock attributes.
-github.com/databricks/cli/bundle/config.Experimental:
-  "pydabs":
-    "description": |-
-      The PyDABs configuration.
-    "deprecation_message": |-
-      Deprecated: please use python instead
-  "python":
-    "description": |-
-      Configures loading of Python code defined with 'databricks-bundles' package.
-  "python_wheel_wrapper":
-    "description": |-
-      Whether to use a Python wheel wrapper.
-  "scripts":
-    "description": |-
-      The commands to run.
-  "skip_artifact_cleanup":
-    "description": |-
-      Determines whether to skip cleaning up the .internal folder
-  "skip_name_prefix_for_schema":
-    "description": |-
-      Skip adding the prefix that is either set in `presets.name_prefix` or computed when `mode: development`
-      is set, to the names of UC schemas defined in the bundle.
-  "use_legacy_run_as":
-    "description": |-
-      Whether to use the legacy run_as behavior.
-github.com/databricks/cli/bundle/config.Git:
-  "branch":
-    "description": |-
-      The Git branch name.
-    "markdown_description": |-
-      The Git branch name. See [\_](/dev-tools/bundles/settings.md#git).
-  "origin_url":
-    "description": |-
-      The origin URL of the repository.
-    "markdown_description": |-
-      The origin URL of the repository. See [\_](/dev-tools/bundles/settings.md#git).
-github.com/databricks/cli/bundle/config.Lock:
-  "enabled":
-    "description": |-
-      Whether this lock is enabled.
-  "force":
-    "description": |-
-      Whether to force this lock if it is enabled.
-github.com/databricks/cli/bundle/config.Presets:
-  "artifacts_dynamic_version":
-    "description": |-
-      Whether to enable dynamic_version on all artifacts.
-  "jobs_max_concurrent_runs":
-    "description": |-
-      The maximum concurrent runs for a job.
-  "name_prefix":
-    "description": |-
-      The prefix for job runs of the bundle.
-  "pipelines_development":
-    "description": |-
-      Whether pipeline deployments should be locked in development mode.
-  "source_linked_deployment":
-    "description": |-
-      Whether to link the deployment to the bundle source.
-  "tags":
-    "description": |-
-      The tags for the bundle deployment.
-  "trigger_pause_status":
-    "description": |-
-      A pause status to apply to all job triggers and schedules. Valid values are PAUSED or UNPAUSED.
-github.com/databricks/cli/bundle/config.PyDABs:
-  "enabled":
-    "description": |-
-      Whether or not PyDABs (Private Preview) is enabled
-  "import":
-    "description": |-
-      The PyDABs project to import to discover resources, resource generator and mutators
-  "venv_path":
-    "description": |-
-      The Python virtual environment path
-github.com/databricks/cli/bundle/config.Python:
-  "mutators":
-    "description": |-
-      Mutators contains a list of fully qualified function paths to mutator functions.
+# This file contains the documentation the CLI owns for the bundle
+# configuration JSON schema: docs for fields that do not exist in the upstream
+# API spec (.codegen/cli.json), and overrides of upstream docs. Documentation
+# for everything else is inherited from cli.json at generation time and must
+# not be duplicated here.
+#
+# The structure mirrors the bundle configuration tree. The "$type" and
+# "$fields" keys are structural; every other key is a config field name.
+#   - A node documents one field: its inline keys (description,
+#     markdown_description, ...) apply to the field itself.
+#   - "$type" documents the type the field's value resolves to — for map and
+#     sequence fields, each entry. These docs are shared by every occurrence
+#     of the type; enum values also live here.
+#   - "$fields" holds the nodes of that type's fields (map and sequence levels
+#     are unwrapped implicitly).
+#   - Each type is expanded exactly once, at its first occurrence; fields of
+#     types that occur again later (for example everything under "targets")
+#     are documented at that first occurrence.
+#   - "description: PLACEHOLDER" marks fields that have no documentation yet.
+#
+# Running "task generate-schema" keeps this file in sync with the
+# configuration structure: it adds placeholders for new undocumented fields
+# and drops entries for fields that no longer exist.
+artifacts:
+  "description": |-
+    Defines the attributes to build an artifact
+  "markdown_description": |-
+    Defines the attributes to build artifacts, where each key is the name of the artifact, and the value is a Map that defines the artifact build settings. For information about the `artifacts` mapping, see [\_](/dev-tools/bundles/settings.md#artifacts).
 
-      Example: ["my_project.mutators:add_default_cluster"]
-  "resources":
-    "description": |-
-      Resources contains a list of fully qualified function paths to load resources
-      defined in Python code.
+    Artifact settings defined in the top level of the bundle configuration can be overridden in the `targets` mapping. See [\_](/dev-tools/bundles/artifact-overrides.md).
+  "markdown_examples": |-
+    ```yaml
+    artifacts:
+      default:
+        type: whl
+        build: poetry build
+        path: .
+    ```
+  "$fields":
+    "build":
+      "description": |-
+        An optional set of build commands to run locally before deployment.
+    "dynamic_version":
+      "description": |-
+        Whether to patch the wheel version dynamically based on the timestamp of the whl file. If this is set to `true`, new code can be deployed without having to update the version in `setup.py` or `pyproject.toml`. This setting is only valid when `type` is set to `whl`. See [\_](/dev-tools/bundles/settings.md#bundle-syntax-mappings-artifacts).
+    "executable":
+      "description": |-
+        The executable type. Valid values are `bash`, `sh`, and `cmd`.
+    "files":
+      "description": |-
+        The relative or absolute path to the built artifact files.
+      "$fields":
+        "source":
+          "description": |-
+            Required. The artifact source file.
+    "git":
+      "description": |-
+        For a `tgz` artifact, snapshot this git ref instead of the working tree. Mutually exclusive with `build`.
+      "$fields":
+        "branch":
+          "description": |-
+            The git branch to snapshot.
+        "commit":
+          "description": |-
+            The git commit to snapshot. Takes precedence over `branch` when both are set.
+    "include":
+      "description": |-
+        For a `tgz` artifact, subpaths of `path` to pack, relative to it; empty packs the whole `path`. `.gitignore` is honored; the bundle-wide sync include/exclude do not apply. Archive entries are named relative to `path`. Mutually exclusive with `build`.
+    "path":
+      "description": |-
+        The local path of the directory for the artifact.
+    "type":
+      "description": |-
+        The type of the artifact. Valid values are `whl`, `jar`, and `tgz`. Required if the artifact is a Python wheel.
+      "markdown_description": |-
+        The type of the artifact. Valid values are `whl`, `jar`, and `tgz`. Required if the artifact is a Python wheel.
+bundle:
+  "description": |-
+    The bundle attributes when deploying to this target.
+  "markdown_description": |-
+    The bundle attributes when deploying to this target,
+  "$fields":
+    "cluster_id":
+      "description": |-
+        The ID of a cluster to use to run the bundle.
+      "markdown_description": |-
+        The ID of a cluster to use to run the bundle. See [\_](/dev-tools/bundles/settings.md#cluster_id).
+    "compute_id":
+      "description": |-
+        Deprecated. The ID of the compute to use to run the bundle.
+    "databricks_cli_version":
+      "description": |-
+        The Databricks CLI version to use for the bundle.
+      "markdown_description": |-
+        The Databricks CLI version to use for the bundle. See [\_](/dev-tools/bundles/settings.md#databricks_cli_version).
+    "deployment":
+      "description": |-
+        The definition of the bundle deployment
+      "markdown_description": |-
+        The definition of the bundle deployment. For supported attributes see [\_](/dev-tools/bundles/deployment-modes.md).
+      "$fields":
+        "deployment_id":
+          "description": |-
+            The ID the deployment metadata service assigned to this bundle's deployment. Output only.
+        "fail_on_active_runs":
+          "description": |-
+            Whether to fail on active runs. If this is set to true a deployment that is running can be interrupted.
+        "latest_version_id":
+          "description": |-
+            The most recent version the deployment metadata service recorded for this deployment. Output only.
+        "lock":
+          "description": |-
+            The deployment lock attributes.
+          "$fields":
+            "enabled":
+              "description": |-
+                Whether this lock is enabled.
+            "force":
+              "description": |-
+                Whether to force this lock if it is enabled.
+    "engine":
+      "description": |-
+        The deployment engine to use. Valid values are `direct`. Takes priority over `DATABRICKS_BUNDLE_ENGINE` environment variable. Default is "direct".
+      "$type":
+        "enum":
+          - |-
+            direct
+        "x-databricks-enum-descriptions":
+          "direct": |-
+            Deploy by calling the Databricks APIs directly. This is the default.
+    "git":
+      "description": |-
+        The Git version control details that are associated with your bundle.
+      "markdown_description": |-
+        The Git version control details that are associated with your bundle. For supported attributes see [\_](/dev-tools/bundles/settings.md#git).
+      "$fields":
+        "branch":
+          "description": |-
+            The Git branch name.
+          "markdown_description": |-
+            The Git branch name. See [\_](/dev-tools/bundles/settings.md#git).
+        "origin_url":
+          "description": |-
+            The origin URL of the repository.
+          "markdown_description": |-
+            The origin URL of the repository. See [\_](/dev-tools/bundles/settings.md#git).
+    "name":
+      "description": |-
+        The name of the bundle.
+    "uuid":
+      "description": |-
+        Reserved. A Universally Unique Identifier (UUID) for the bundle that uniquely identifies the bundle in internal Databricks systems. This is generated when a bundle project is initialized using a Databricks template (using the `databricks bundle init` command).
+environments:
+  "description": |-
+    PLACEHOLDER
+  "deprecation_message": |-
+    Deprecated: please use targets instead
+experimental:
+  "description": |-
+    Defines attributes for experimental features.
+  "$fields":
+    "deployment_history":
+      "description": |-
+        Whether to record deployment history using the deployment metadata service (DMS), which tracks what changed across deployments.
+    "immutable_folder":
+      "description": |-
+        Whether to deploy bundle files and artifacts as a single immutable snapshot. When true, all files are packaged into a content-addressed archive and workspace.file_path and workspace.artifact_path are set to the resulting location.
+    "pydabs":
+      "description": |-
+        The PyDABs configuration.
+      "deprecation_message": |-
+        Deprecated: please use python instead
+      "$fields":
+        "enabled":
+          "description": |-
+            Whether or not PyDABs (Private Preview) is enabled
+    "python":
+      "description": |-
+        Configures loading of Python code defined with 'databricks-bundles' package.
+      "$fields":
+        "mutators":
+          "description": |-
+            Mutators contains a list of fully qualified function paths to mutator functions.
 
-      Example: ["my_project.resources:load_resources"]
-  "venv_path":
-    "description": |-
-      VEnvPath is path to the virtual environment.
+            Example: ["my_project.mutators:add_default_cluster"]
+        "resources":
+          "description": |-
+            Resources contains a list of fully qualified function paths to load resources
+            defined in Python code.
 
-      If enabled, Python code will execute within this environment. If disabled,
-      it defaults to using the Python interpreter available in the current shell.
-github.com/databricks/cli/bundle/config.Resources:
-  "alerts":
-    "description": |-
-      PLACEHOLDER
-  "apps":
-    "description": |-
-      The app resource defines a Databricks app.
-    "markdown_description": |-
-      The app resource defines a [Databricks app](/api/workspace/apps/create). For information about Databricks Apps, see [\_](/dev-tools/databricks-apps/index.md).
-  "catalogs":
-    "description": |-
-      PLACEHOLDER
-  "clusters":
-    "description": |-
-      The cluster definitions for the bundle, where each key is the name of a cluster.
-    "markdown_description": |-
-      The cluster definitions for the bundle, where each key is the name of a cluster. See [\_](/dev-tools/bundles/resources.md#clusters).
-  "dashboards":
-    "description": |-
-      The dashboard definitions for the bundle, where each key is the name of the dashboard.
-    "markdown_description": |-
-      The dashboard definitions for the bundle, where each key is the name of the dashboard. See [\_](/dev-tools/bundles/resources.md#dashboards).
-  "database_catalogs":
-    "description": |-
-      PLACEHOLDER
-  "database_instances":
-    "description": |-
-      PLACEHOLDER
-  "experiments":
-    "description": |-
-      The experiment definitions for the bundle, where each key is the name of the experiment.
-    "markdown_description": |-
-      The experiment definitions for the bundle, where each key is the name of the experiment. See [\_](/dev-tools/bundles/resources.md#experiments).
-  "external_locations":
-    "description": |-
-      PLACEHOLDER
-  "jobs":
-    "description": |-
-      The job definitions for the bundle, where each key is the name of the job.
-    "markdown_description": |-
-      The job definitions for the bundle, where each key is the name of the job. See [\_](/dev-tools/bundles/resources.md#jobs).
-  "model_serving_endpoints":
-    "description": |-
-      The model serving endpoint definitions for the bundle, where each key is the name of the model serving endpoint.
-    "markdown_description": |-
-      The model serving endpoint definitions for the bundle, where each key is the name of the model serving endpoint. See [\_](/dev-tools/bundles/resources.md#model_serving_endpoints).
-  "models":
-    "description": |-
-      The model definitions for the bundle, where each key is the name of the model.
-    "markdown_description": |-
-      The model definitions for the bundle, where each key is the name of the model. See [\_](/dev-tools/bundles/resources.md#models).
-  "pipelines":
-    "description": |-
-      The pipeline definitions for the bundle, where each key is the name of the pipeline.
-    "markdown_description": |-
-      The pipeline definitions for the bundle, where each key is the name of the pipeline. See [\_](/dev-tools/bundles/resources.md#pipelines).
-  "postgres_branches":
-    "description": |-
-      PLACEHOLDER
-  "postgres_endpoints":
-    "description": |-
-      PLACEHOLDER
-  "postgres_projects":
-    "description": |-
-      PLACEHOLDER
-  "quality_monitors":
-    "description": |-
-      The quality monitor definitions for the bundle, where each key is the name of the quality monitor.
-    "markdown_description": |-
-      The quality monitor definitions for the bundle, where each key is the name of the quality monitor. See [\_](/dev-tools/bundles/resources.md#quality_monitors).
-  "registered_models":
-    "description": |-
-      The registered model definitions for the bundle, where each key is the name of the Unity Catalog registered model.
-    "markdown_description": |-
-      The registered model definitions for the bundle, where each key is the name of the Unity Catalog registered model. See [\_](/dev-tools/bundles/resources.md#registered_models)
-  "schemas":
-    "description": |-
-      The schema definitions for the bundle, where each key is the name of the schema.
-    "markdown_description": |-
-      The schema definitions for the bundle, where each key is the name of the schema. See [\_](/dev-tools/bundles/resources.md#schemas).
-  "secret_scopes":
-    "description": |-
-      The secret scope definitions for the bundle, where each key is the name of the secret scope.
-    "markdown_description": |-
-      The secret scope definitions for the bundle, where each key is the name of the secret scope. See [\_](/dev-tools/bundles/resources.md#secret_scopes).
-  "sql_warehouses":
-    "description": |-
-      The SQL warehouse definitions for the bundle, where each key is the name of the warehouse.
-    "markdown_description": |-
-      The SQL warehouse definitions for the bundle, where each key is the name of the warehouse. See [\_](/dev-tools/bundles/resources.md#sql_warehouses).
-  "synced_database_tables":
-    "description": |-
-      PLACEHOLDER
-  "vector_search_endpoints":
-    "description": |-
-      PLACEHOLDER
-  "volumes":
-    "description": |-
-      The volume definitions for the bundle, where each key is the name of the volume.
-    "markdown_description": |-
-      The volume definitions for the bundle, where each key is the name of the volume. See [\_](/dev-tools/bundles/resources.md#volumes).
-github.com/databricks/cli/bundle/config.Root:
-  "artifacts":
-    "description": |-
-      Defines the attributes to build an artifact
-    "markdown_description": |-
-      Defines the attributes to build artifacts, where each key is the name of the artifact, and the value is a Map that defines the artifact build settings. For information about the `artifacts` mapping, see [\_](/dev-tools/bundles/settings.md#artifacts).
+            Example: ["my_project.resources:load_resources"]
+        "venv_path":
+          "description": |-
+            VEnvPath is path to the virtual environment.
 
-      Artifact settings defined in the top level of the bundle configuration can be overridden in the `targets` mapping. See [\_](/dev-tools/bundles/artifact-overrides.md).
-    "markdown_examples": |-
-      ```yaml
-      artifacts:
-        default:
-          type: whl
-          build: poetry build
-          path: .
-      ```
-  "bundle":
-    "description": |-
-      The bundle attributes when deploying to this target.
-    "markdown_description": |-
-      The bundle attributes when deploying to this target,
-  "environments":
-    "description": |-
-      PLACEHOLDER
-    "deprecation_message": |-
-      Deprecated: please use targets instead
-  "experimental":
-    "description": |-
-      Defines attributes for experimental features.
-  "include":
-    "description": |-
-      Specifies a list of path globs that contain configuration files to include within the bundle.
-    "markdown_description": |-
-      Specifies a list of path globs that contain configuration files to include within the bundle. See [\_](/dev-tools/bundles/settings.md#include).
-  "permissions":
-    "description": |-
-      Defines a permission for a specific entity.
-    "markdown_description": |-
-      A Sequence that defines the permissions to apply to experiments, jobs, pipelines, and models defined in the bundle, where each item in the sequence is a permission for a specific entity.
+            If enabled, Python code will execute within this environment. If disabled,
+            it defaults to using the Python interpreter available in the current shell.
+    "python_wheel_wrapper":
+      "description": |-
+        Whether to use a Python wheel wrapper.
+    "scripts":
+      "description": |-
+        The commands to run.
+    "skip_artifact_cleanup":
+      "description": |-
+        Determines whether to skip cleaning up the .internal folder
+    "skip_name_prefix_for_schema":
+      "description": |-
+        Skip adding the prefix that is either set in `presets.name_prefix` or computed when `mode: development`
+        is set, to the names of UC schemas defined in the bundle.
+    "use_legacy_run_as":
+      "description": |-
+        Whether to use the legacy run_as behavior.
+include:
+  "description": |-
+    Specifies a list of path globs that contain configuration files to include within the bundle.
+  "markdown_description": |-
+    Specifies a list of path globs that contain configuration files to include within the bundle. See [\_](/dev-tools/bundles/settings.md#include).
+permissions:
+  "description": |-
+    Defines a permission for a specific entity.
+  "markdown_description": |-
+    A Sequence that defines the permissions to apply to experiments, jobs, pipelines, and models defined in the bundle, where each item in the sequence is a permission for a specific entity.
 
-      See [\_](/dev-tools/bundles/settings.md#permissions) and [\_](/dev-tools/bundles/permissions.md).
-    "markdown_examples": |-
-      ```yaml
-      permissions:
-        - level: CAN_VIEW
-          group_name: test-group
-        - level: CAN_MANAGE
-          user_name: someone@example.com
-        - level: CAN_RUN
-          service_principal_name: 123456-abcdef
-      ```
-  "presets":
-    "description": |-
-      Defines bundle deployment presets.
-    "markdown_description": |-
-      Defines bundle deployment presets. See [\_](/dev-tools/bundles/deployment-modes.md#presets).
-  "python":
-    "description": |-
-      PLACEHOLDER
-  "resources":
-    "description": |-
-      A Map that defines the resources for the bundle, where each key is the name of the resource, and the value is a Map that defines the resource.
-    "markdown_description": |-
-      A Map that defines the resources for the bundle, where each key is the name of the resource, and the value is a Map that defines the resource. For more information about Declarative Automation Bundles supported resources, and resource definition reference, see [\_](/dev-tools/bundles/resources.md).
+    See [\_](/dev-tools/bundles/settings.md#permissions) and [\_](/dev-tools/bundles/permissions.md).
+  "markdown_examples": |-
+    ```yaml
+    permissions:
+      - level: CAN_VIEW
+        group_name: test-group
+      - level: CAN_MANAGE
+        user_name: someone@example.com
+      - level: CAN_RUN
+        service_principal_name: 123456-abcdef
+    ```
+presets:
+  "description": |-
+    Defines bundle deployment presets.
+  "markdown_description": |-
+    Defines bundle deployment presets. See [\_](/dev-tools/bundles/deployment-modes.md#presets).
+python:
+  "description": |-
+    PLACEHOLDER
+resources:
+  "description": |-
+    A Map that defines the resources for the bundle, where each key is the name of the resource, and the value is a Map that defines the resource.
+  "markdown_description": |-
+    A Map that defines the resources for the bundle, where each key is the name of the resource, and the value is a Map that defines the resource. For more information about Declarative Automation Bundles supported resources, and resource definition reference, see [\_](/dev-tools/bundles/resources.md).
 
-      ```yaml
-      resources:
-        <resource-type>:
-          <resource-name>:
-            <resource-field-name>: <resource-field-value>
-      ```
-  "run_as":
-    "description": |-
-      The identity to use when running Declarative Automation Bundles resources.
-    "markdown_description": |-
-      The identity to use when running Declarative Automation Bundles resources. See [\_](/dev-tools/bundles/run-as.md).
-  "scripts":
-    "description": |-
-      PLACEHOLDER
-  "sync":
-    "description": |-
-      The files and file paths to include or exclude in the bundle.
-    "markdown_description": |-
-      The files and file paths to include or exclude in the bundle. See [\_](/dev-tools/bundles/settings.md#sync).
-  "targets":
-    "description": |-
-      Defines deployment targets for the bundle.
-    "markdown_description": |-
-      Defines deployment targets for the bundle. See [\_](/dev-tools/bundles/settings.md#targets)
-  "variables":
-    "description": |-
-      A Map that defines the custom variables for the bundle, where each key is the name of the variable, and the value is a Map that defines the variable.
-  "workspace":
-    "description": |-
-      Defines the Databricks workspace for the bundle.
-    "markdown_description": |-
-      Defines the Databricks workspace for the bundle. See [\_](/dev-tools/bundles/settings.md#workspace).
-github.com/databricks/cli/bundle/config.Script:
-  "content":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/cli/bundle/config.Sync:
-  "exclude":
-    "description": |-
-      A list of files or folders to exclude from the bundle.
-  "include":
-    "description": |-
-      A list of files or folders to include in the bundle.
-  "paths":
-    "description": |-
-      The local folder paths, which can be outside the bundle root, to synchronize to the workspace when the bundle is deployed.
-github.com/databricks/cli/bundle/config.Target:
-  "artifacts":
-    "description": |-
-      The artifacts to include in the target deployment.
-  "bundle":
-    "description": |-
-      The bundle attributes when deploying to this target.
-  "cluster_id":
-    "description": |-
-      The ID of the cluster to use for this target.
-  "compute_id":
-    "description": |-
-      Deprecated. The ID of the compute to use for this target.
-    "deprecation_message": |-
-      Deprecated: please use cluster_id instead
-  "default":
-    "description": |-
-      Whether this target is the default target.
-  "git":
-    "description": |-
-      The Git version control settings for the target.
-  "mode":
-    "description": |-
-      The deployment mode for the target.
-    "markdown_description": |-
-      The deployment mode for the target. Valid values are `development` or `production`. See [\_](/dev-tools/bundles/deployment-modes.md).
-  "permissions":
-    "description": |-
-      The permissions for deploying and running the bundle in the target.
-  "presets":
-    "description": |-
-      The deployment presets for the target.
-  "resources":
-    "description": |-
-      The resource definitions for the target.
-  "run_as":
-    "description": |-
-      The identity to use to run the bundle.
-    "markdown_description": |-
-      The identity to use to run the bundle, see [\_](/dev-tools/bundles/run-as.md).
-  "sync":
-    "description": |-
-      The local paths to sync to the target workspace when a bundle is run or deployed.
-  "variables":
-    "description": |-
-      The custom variable definitions for the target.
-  "workspace":
-    "description": |-
-      The Databricks workspace for the target.
-github.com/databricks/cli/bundle/config.Workspace:
-  "account_id":
-    "description": |-
-      The Databricks account ID.
-  "artifact_path":
-    "description": |-
-      The artifact path to use within the workspace for both deployments and job runs
-  "auth_type":
-    "description": |-
-      The authentication type.
-  "azure_client_id":
-    "description": |-
-      The Azure client ID
-  "azure_environment":
-    "description": |-
-      The Azure environment
-  "azure_login_app_id":
-    "description": |-
-      The Azure login app ID
-  "azure_tenant_id":
-    "description": |-
-      The Azure tenant ID
-  "azure_use_msi":
-    "description": |-
-      Whether to use MSI for Azure
-  "azure_workspace_resource_id":
-    "description": |-
-      The Azure workspace resource ID
-  "client_id":
-    "description": |-
-      The client ID for the workspace
-  "experimental_is_unified_host":
-    "description": |-
-      Deprecated: no-op. Unified hosts are now detected automatically from /.well-known/databricks-config. Retained for schema compatibility with existing databricks.yml files.
-  "file_path":
-    "description": |-
-      The file path to use within the workspace for both deployments and job runs
-  "google_service_account":
-    "description": |-
-      The Google service account name
-  "host":
-    "description": |-
-      The Databricks workspace host URL
-  "profile":
-    "description": |-
-      The Databricks workspace profile name
-  "resource_path":
-    "description": |-
-      The workspace resource path
-  "root_path":
-    "description": |-
-      The Databricks workspace root path
-  "state_path":
-    "description": |-
-      The workspace state path
-  "workspace_id":
-    "description": |-
-      The Databricks workspace ID
-github.com/databricks/cli/bundle/config/engine.EngineType:
-  "_":
-    "enum":
-      - |-
-        terraform
-      - |-
-        direct
-github.com/databricks/cli/bundle/config/resources.Alert:
-  "create_time":
-    "description": |-
-      PLACEHOLDER
-  "custom_description":
-    "description": |-
-      PLACEHOLDER
-  "custom_summary":
-    "description": |-
-      PLACEHOLDER
-  "display_name":
-    "description": |-
-      PLACEHOLDER
-  "effective_run_as":
-    "description": |-
-      PLACEHOLDER
-  "id":
-    "description": |-
-      PLACEHOLDER
-  "lifecycle_state":
-    "description": |-
-      PLACEHOLDER
-  "owner_user_name":
-    "description": |-
-      PLACEHOLDER
-  "parent_path":
-    "description": |-
-      PLACEHOLDER
-  "query_text":
-    "description": |-
-      PLACEHOLDER
-  "run_as":
-    "description": |-
-      PLACEHOLDER
-  "run_as_user_name":
-    "description": |-
-      PLACEHOLDER
-  "update_time":
-    "description": |-
-      PLACEHOLDER
-  "warehouse_id":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/cli/bundle/config/resources.App:
-  "git_source":
-    "description": |-
-      Git source configuration for app deployments. Specifies which git reference (branch, tag, or commit)
-      to use when deploying the app. Used in conjunction with git_repository to deploy code directly from git.
-      The source_code_path within git_source specifies the relative path to the app code within the repository.
-github.com/databricks/cli/bundle/config/resources.AppConfig:
-  "command":
-    "description": |-
-      PLACEHOLDER
-  "env":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/cli/bundle/config/resources.AppEnvVar:
-  "name":
-    "description": |-
-      PLACEHOLDER
-  "value":
-    "description": |-
-      PLACEHOLDER
-  "value_from":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/cli/bundle/config/resources.AppPermission:
-  "group_name":
-    "description": |-
-      PLACEHOLDER
-  "level":
-    "description": |-
-      PLACEHOLDER
-  "service_principal_name":
-    "description": |-
-      PLACEHOLDER
-  "user_name":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/cli/bundle/config/resources.Catalog:
-  "comment":
-    "description": |-
-      PLACEHOLDER
-  "connection_name":
-    "description": |-
-      PLACEHOLDER
-  "name":
-    "description": |-
-      PLACEHOLDER
-  "options":
-    "description": |-
-      PLACEHOLDER
-  "properties":
-    "description": |-
-      PLACEHOLDER
-  "provider_name":
-    "description": |-
-      PLACEHOLDER
-  "share_name":
-    "description": |-
-      PLACEHOLDER
-  "storage_root":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/cli/bundle/config/resources.ClusterPermission:
-  "group_name":
-    "description": |-
-      PLACEHOLDER
-  "level":
-    "description": |-
-      PLACEHOLDER
-  "service_principal_name":
-    "description": |-
-      PLACEHOLDER
-  "user_name":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/cli/bundle/config/resources.Dashboard:
-  "dataset_catalog":
-    "description": |-
-      Sets the default catalog for all datasets in this dashboard. When set, this overrides the catalog specified in individual dataset definitions.
-  "dataset_schema":
-    "description": |-
-      Sets the default schema for all datasets in this dashboard. When set, this overrides the schema specified in individual dataset definitions.
-github.com/databricks/cli/bundle/config/resources.DatabaseInstance:
-  "effective_capacity":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/cli/bundle/config/resources.ExternalLocation:
-  "comment":
-    "description": |-
-      PLACEHOLDER
-  "credential_name":
-    "description": |-
-      PLACEHOLDER
-  "enable_file_events":
-    "description": |-
-      PLACEHOLDER
-  "encryption_details":
-    "description": |-
-      PLACEHOLDER
-  "fallback":
-    "description": |-
-      PLACEHOLDER
-  "file_event_queue":
-    "description": |-
-      PLACEHOLDER
-  "grants":
-    "description": |-
-      PLACEHOLDER
-  "lifecycle":
-    "description": |-
-      PLACEHOLDER
-  "name":
-    "description": |-
-      PLACEHOLDER
-  "read_only":
-    "description": |-
-      PLACEHOLDER
-  "skip_validation":
-    "description": |-
-      PLACEHOLDER
-  "url":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/cli/bundle/config/resources.JobPermission:
-  "group_name":
-    "description": |-
-      PLACEHOLDER
-  "level":
-    "description": |-
-      PLACEHOLDER
-  "service_principal_name":
-    "description": |-
-      PLACEHOLDER
-  "user_name":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/cli/bundle/config/resources.Lifecycle:
-  "prevent_destroy":
-    "description": |-
-      Lifecycle setting to prevent the resource from being destroyed.
-github.com/databricks/cli/bundle/config/resources.LifecycleWithStarted:
-  "prevent_destroy":
-    "description": |-
-      Lifecycle setting to prevent the resource from being destroyed.
-  "started":
-    "description": |-
-      Lifecycle setting to deploy the resource in started mode. Only supported for apps, clusters, and sql_warehouses in direct deployment mode.
-github.com/databricks/cli/bundle/config/resources.MlflowExperimentPermission:
-  "group_name":
-    "description": |-
-      PLACEHOLDER
-  "level":
-    "description": |-
-      PLACEHOLDER
-  "service_principal_name":
-    "description": |-
-      PLACEHOLDER
-  "user_name":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/cli/bundle/config/resources.MlflowModelPermission:
-  "group_name":
-    "description": |-
-      PLACEHOLDER
-  "level":
-    "description": |-
-      PLACEHOLDER
-  "service_principal_name":
-    "description": |-
-      PLACEHOLDER
-  "user_name":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/cli/bundle/config/resources.ModelServingEndpointPermission:
-  "group_name":
-    "description": |-
-      PLACEHOLDER
-  "level":
-    "description": |-
-      PLACEHOLDER
-  "service_principal_name":
-    "description": |-
-      PLACEHOLDER
-  "user_name":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/cli/bundle/config/resources.Permission:
-  "-":
-    "description": |-
-      Defines a permission for a specific entity.
-    "markdown_description": |-
-      Defines a permission for a specific entity. See [\_](/dev-tools/bundles/settings.md#permissions) and [\_](/dev-tools/bundles/permissions.md).
-  "group_name":
-    "description": |-
-      The name of the group that has the permission set in level.
-  "level":
-    "description": |-
-      The allowed permission for user, group, service principal defined for this permission.
-  "service_principal_name":
-    "description": |-
-      The name of the service principal that has the permission set in level.
-  "user_name":
-    "description": |-
-      The name of the user that has the permission set in level.
-github.com/databricks/cli/bundle/config/resources.PipelinePermission:
-  "group_name":
-    "description": |-
-      PLACEHOLDER
-  "level":
-    "description": |-
-      PLACEHOLDER
-  "service_principal_name":
-    "description": |-
-      PLACEHOLDER
-  "user_name":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/cli/bundle/config/resources.PostgresBranch:
-  "branch_id":
-    "description": |-
-      PLACEHOLDER
-  "create_time":
-    "description": |-
-      PLACEHOLDER
-  "expire_time":
-    "description": |-
-      PLACEHOLDER
-  "is_protected":
-    "description": |-
-      PLACEHOLDER
-  "lifecycle":
-    "description": |-
-      PLACEHOLDER
-  "name":
-    "description": |-
-      PLACEHOLDER
-  "no_expiry":
-    "description": |-
-      PLACEHOLDER
-  "parent":
-    "description": |-
-      PLACEHOLDER
-  "source_branch":
-    "description": |-
-      PLACEHOLDER
-  "source_branch_lsn":
-    "description": |-
-      PLACEHOLDER
-  "source_branch_time":
-    "description": |-
-      PLACEHOLDER
-  "spec":
-    "description": |-
-      PLACEHOLDER
-  "status":
-    "description": |-
-      PLACEHOLDER
-  "ttl":
-    "description": |-
-      PLACEHOLDER
-  "uid":
-    "description": |-
-      PLACEHOLDER
-  "update_time":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/cli/bundle/config/resources.PostgresEndpoint:
-  "autoscaling_limit_max_cu":
-    "description": |-
-      PLACEHOLDER
-  "autoscaling_limit_min_cu":
-    "description": |-
-      PLACEHOLDER
-  "create_time":
-    "description": |-
-      PLACEHOLDER
-  "disabled":
-    "description": |-
-      PLACEHOLDER
-  "endpoint_id":
-    "description": |-
-      PLACEHOLDER
-  "endpoint_type":
-    "description": |-
-      PLACEHOLDER
-  "group":
-    "description": |-
-      PLACEHOLDER
-  "lifecycle":
-    "description": |-
-      PLACEHOLDER
-  "name":
-    "description": |-
-      PLACEHOLDER
-  "no_suspension":
-    "description": |-
-      PLACEHOLDER
-  "parent":
-    "description": |-
-      PLACEHOLDER
-  "settings":
-    "description": |-
-      PLACEHOLDER
-  "spec":
-    "description": |-
-      PLACEHOLDER
-  "status":
-    "description": |-
-      PLACEHOLDER
-  "suspend_timeout_duration":
-    "description": |-
-      PLACEHOLDER
-  "uid":
-    "description": |-
-      PLACEHOLDER
-  "update_time":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/cli/bundle/config/resources.PostgresProject:
-  "budget_policy_id":
-    "description": |-
-      PLACEHOLDER
-  "create_time":
-    "description": |-
-      PLACEHOLDER
-  "custom_tags":
-    "description": |-
-      PLACEHOLDER
-  "default_branch":
-    "description": |-
-      PLACEHOLDER
-  "default_endpoint_settings":
-    "description": |-
-      PLACEHOLDER
-  "display_name":
-    "description": |-
-      PLACEHOLDER
-  "enable_pg_native_login":
-    "description": |-
-      PLACEHOLDER
-  "history_retention_duration":
-    "description": |-
-      PLACEHOLDER
-  "lifecycle":
-    "description": |-
-      PLACEHOLDER
-  "name":
-    "description": |-
-      PLACEHOLDER
-  "permissions":
-    "description": |-
-      PLACEHOLDER
-  "pg_version":
-    "description": |-
-      PLACEHOLDER
-  "project_id":
-    "description": |-
-      PLACEHOLDER
-  "spec":
-    "description": |-
-      PLACEHOLDER
-  "status":
-    "description": |-
-      PLACEHOLDER
-  "uid":
-    "description": |-
-      PLACEHOLDER
-  "update_time":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/cli/bundle/config/resources.SecretScope:
-  "backend_type":
-    "description": |-
-      The backend type the scope will be created with. If not specified, will default to `DATABRICKS`
-  "keyvault_metadata":
-    "description": |-
-      The metadata for the secret scope if the `backend_type` is `AZURE_KEYVAULT`
-  "lifecycle":
-    "description": |-
-      Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
-  "name":
-    "description": |-
-      Scope name requested by the user. Scope names are unique.
-  "permissions":
-    "description": |-
-      The permissions to apply to the secret scope. Permissions are managed via secret scope ACLs.
-github.com/databricks/cli/bundle/config/resources.SecretScopePermission:
-  "group_name":
-    "description": |-
-      The name of the group that has the permission set in level. This field translates to a `principal` field in secret scope ACL.
-  "level":
-    "description": |-
-      The allowed permission for user, group, service principal defined for this permission.
-  "service_principal_name":
-    "description": |-
-      The application ID of an active service principal. This field translates to a `principal` field in secret scope ACL.
-  "user_name":
-    "description": |-
-      The name of the user that has the permission set in level. This field translates to a `principal` field in secret scope ACL.
-github.com/databricks/cli/bundle/config/resources.SqlWarehousePermission:
-  "group_name":
-    "description": |-
-      PLACEHOLDER
-  "level":
-    "description": |-
-      PLACEHOLDER
-  "service_principal_name":
-    "description": |-
-      PLACEHOLDER
-  "user_name":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/cli/bundle/config/resources.SyncedDatabaseTable:
-  "data_synchronization_status":
-    "description": |-
-      PLACEHOLDER
-  "database_instance_name":
-    "description": |-
-      PLACEHOLDER
-  "effective_database_instance_name":
-    "description": |-
-      PLACEHOLDER
-  "effective_logical_database_name":
-    "description": |-
-      PLACEHOLDER
-  "logical_database_name":
-    "description": |-
-      PLACEHOLDER
-  "name":
-    "description": |-
-      PLACEHOLDER
-  "spec":
-    "description": |-
-      PLACEHOLDER
-  "unity_catalog_provisioning_state":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/cli/bundle/config/resources.VectorSearchEndpoint:
-  "budget_policy_id":
-    "description": |-
-      PLACEHOLDER
-  "endpoint_type":
-    "description": |-
-      PLACEHOLDER
-  "lifecycle":
-    "description": |-
-      PLACEHOLDER
-  "min_qps":
-    "description": |-
-      PLACEHOLDER
-  "name":
-    "description": |-
-      PLACEHOLDER
-  "permissions":
-    "description": |-
-      PLACEHOLDER
-  "usage_policy_id":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/cli/bundle/config/variable.Lookup:
-  "alert":
-    "description": |-
-      The name of the alert for which to retrieve an ID.
-  "cluster":
-    "description": |-
-      The name of the cluster for which to retrieve an ID.
-  "cluster_policy":
-    "description": |-
-      The name of the cluster_policy for which to retrieve an ID.
-  "dashboard":
-    "description": |-
-      The name of the dashboard for which to retrieve an ID.
-  "instance_pool":
-    "description": |-
-      The name of the instance_pool for which to retrieve an ID.
-  "job":
-    "description": |-
-      The name of the job for which to retrieve an ID.
-  "metastore":
-    "description": |-
-      The name of the metastore for which to retrieve an ID.
-  "notification_destination":
-    "description": |-
-      The name of the notification_destination for which to retrieve an ID.
-  "pipeline":
-    "description": |-
-      The name of the pipeline for which to retrieve an ID.
-  "query":
-    "description": |-
-      The name of the query for which to retrieve an ID.
-  "service_principal":
-    "description": |-
-      The name of the service_principal for which to retrieve an ID.
-  "warehouse":
-    "description": |-
-      The name of the warehouse for which to retrieve an ID.
-github.com/databricks/cli/bundle/config/variable.TargetVariable:
-  "default":
-    "description": |-
-      The default value for the variable.
-  "description":
-    "description": |-
-      The description of the variable.
-  "lookup":
-    "description": |-
-      The name of the alert, cluster_policy, cluster, dashboard, instance_pool, job, metastore, pipeline, query, service_principal, or warehouse object for which to retrieve an ID.
-  "markdown_description":
-    "description": |-
-      The type of the variable.
-  "type":
-    "description": |-
-      The type of the variable.
-github.com/databricks/cli/bundle/config/variable.Variable:
-  "_":
+    ```yaml
+    resources:
+      <resource-type>:
+        <resource-name>:
+          <resource-field-name>: <resource-field-value>
+    ```
+  "$fields":
+    "alerts":
+      "description": |-
+        PLACEHOLDER
+      "$fields":
+        "evaluation":
+          "description": |-
+            PLACEHOLDER
+          "$fields":
+            "notification":
+              "$fields":
+                "subscriptions":
+                  "description": |-
+                    PLACEHOLDER
+                  "$fields":
+                    "destination_id":
+                      "description": |-
+                        PLACEHOLDER
+                    "user_email":
+                      "description": |-
+                        PLACEHOLDER
+            "source":
+              "$fields":
+                "display":
+                  "description": |-
+                    PLACEHOLDER
+                "name":
+                  "description": |-
+                    PLACEHOLDER
+            "threshold":
+              "$fields":
+                "column":
+                  "description": |-
+                    PLACEHOLDER
+                "value":
+                  "description": |-
+                    PLACEHOLDER
+                  "$fields":
+                    "bool_value":
+                      "description": |-
+                        PLACEHOLDER
+                    "double_value":
+                      "description": |-
+                        PLACEHOLDER
+                    "string_value":
+                      "description": |-
+                        PLACEHOLDER
+        "file_path":
+          "description": |-
+            PLACEHOLDER
+        "lifecycle":
+          "description": |-
+            Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+        "permissions":
+          "description": |-
+            The permissions to apply to this resource.
+          "markdown_description": |-
+            A Sequence of permissions to apply to this resource, where each item grants a permission `level` to a single `user_name`, `group_name`, or `service_principal_name`. A principal cannot be set in both a resource's `permissions` and the top-level `permissions` mapping.
+
+            See [\_](/dev-tools/bundles/settings.md#permissions) and [\_](/dev-tools/bundles/permissions.md).
+          "markdown_examples": |-
+            ```yaml
+            permissions:
+              - level: CAN_VIEW
+                group_name: test-group
+              - level: CAN_MANAGE
+                user_name: someone@example.com
+              - level: CAN_RUN
+                service_principal_name: 123456-abcdef
+            ```
+        "schedule":
+          "description": |-
+            PLACEHOLDER
+    "apps":
+      "description": |-
+        The app resource defines a Databricks app.
+      "markdown_description": |-
+        The app resource defines a [Databricks app](/api/workspace/apps/create). For information about Databricks Apps, see [\_](/dev-tools/databricks-apps/index.md).
+      "$fields":
+        "app_status":
+          "description": |-
+            PLACEHOLDER
+        "budget_policy_id":
+          "description": |-
+            PLACEHOLDER
+        "compute_size":
+          "description": |-
+            PLACEHOLDER
+        "compute_status":
+          "description": |-
+            PLACEHOLDER
+        "config":
+          "description": |-
+            PLACEHOLDER
+          "$fields":
+            "command":
+              "description": |-
+                PLACEHOLDER
+            "env":
+              "description": |-
+                PLACEHOLDER
+              "$fields":
+                "name":
+                  "description": |-
+                    PLACEHOLDER
+                "value":
+                  "description": |-
+                    PLACEHOLDER
+                "value_from":
+                  "description": |-
+                    PLACEHOLDER
+        "effective_budget_policy_id":
+          "description": |-
+            PLACEHOLDER
+        "effective_usage_policy_id":
+          "description": |-
+            PLACEHOLDER
+        "git_source":
+          "description": |-
+            Git source configuration for app deployments. Specifies which git reference (branch, tag, or commit)
+            to use when deploying the app. Used in conjunction with git_repository to deploy code directly from git.
+            The source_code_path within git_source specifies the relative path to the app code within the repository.
+        "lifecycle":
+          "description": |-
+            Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+        "oauth2_app_client_id":
+          "description": |-
+            PLACEHOLDER
+        "oauth2_app_integration_id":
+          "description": |-
+            PLACEHOLDER
+        "permissions":
+          "description": |-
+            The permissions to apply to this resource.
+          "markdown_description": |-
+            A Sequence of permissions to apply to this resource, where each item grants a permission `level` to a single `user_name`, `group_name`, or `service_principal_name`. A principal cannot be set in both a resource's `permissions` and the top-level `permissions` mapping.
+
+            See [\_](/dev-tools/bundles/settings.md#permissions) and [\_](/dev-tools/bundles/permissions.md).
+          "markdown_examples": |-
+            ```yaml
+            permissions:
+              - level: CAN_VIEW
+                group_name: test-group
+              - level: CAN_MANAGE
+                user_name: someone@example.com
+              - level: CAN_RUN
+                service_principal_name: 123456-abcdef
+            ```
+          "$fields":
+            "group_name":
+              "description": |-
+                The name of the group granted the permission level.
+            "level":
+              "description": |-
+                The permission level to apply. The allowed levels depend on the resource type.
+            "service_principal_name":
+              "description": |-
+                The name of the service principal granted the permission level.
+            "user_name":
+              "description": |-
+                The name of the user granted the permission level.
+        "resources":
+          "$fields":
+            "app":
+              "description": |-
+                PLACEHOLDER
+              "$fields":
+                "name":
+                  "description": |-
+                    PLACEHOLDER
+                "permission":
+                  "description": |-
+                    PLACEHOLDER
+            "database":
+              "description": |-
+                PLACEHOLDER
+              "$fields":
+                "database_name":
+                  "description": |-
+                    PLACEHOLDER
+                "instance_name":
+                  "description": |-
+                    PLACEHOLDER
+                "permission":
+                  "description": |-
+                    PLACEHOLDER
+            "experiment":
+              "description": |-
+                PLACEHOLDER
+              "$fields":
+                "experiment_id":
+                  "description": |-
+                    PLACEHOLDER
+                "permission":
+                  "description": |-
+                    PLACEHOLDER
+            "genie_space":
+              "description": |-
+                PLACEHOLDER
+              "$fields":
+                "name":
+                  "description": |-
+                    PLACEHOLDER
+                "permission":
+                  "description": |-
+                    PLACEHOLDER
+                "space_id":
+                  "description": |-
+                    PLACEHOLDER
+            "job":
+              "description": |-
+                PLACEHOLDER
+            "postgres":
+              "description": |-
+                PLACEHOLDER
+              "$fields":
+                "branch":
+                  "description": |-
+                    PLACEHOLDER
+                "database":
+                  "description": |-
+                    PLACEHOLDER
+                "permission":
+                  "description": |-
+                    PLACEHOLDER
+            "secret":
+              "description": |-
+                PLACEHOLDER
+            "serving_endpoint":
+              "description": |-
+                PLACEHOLDER
+            "sql_warehouse":
+              "description": |-
+                PLACEHOLDER
+            "uc_securable":
+              "description": |-
+                PLACEHOLDER
+              "$fields":
+                "permission":
+                  "description": |-
+                    PLACEHOLDER
+                "securable_full_name":
+                  "description": |-
+                    PLACEHOLDER
+                "securable_type":
+                  "description": |-
+                    PLACEHOLDER
+        "service_principal_client_id":
+          "description": |-
+            PLACEHOLDER
+        "service_principal_id":
+          "description": |-
+            PLACEHOLDER
+        "service_principal_name":
+          "description": |-
+            PLACEHOLDER
+        "source_code_path":
+          "description": |-
+            PLACEHOLDER
+        "telemetry_export_destinations":
+          "description": |-
+            PLACEHOLDER
+        "usage_policy_id":
+          "description": |-
+            PLACEHOLDER
+        "user_api_scopes":
+          "description": |-
+            PLACEHOLDER
+    "catalogs":
+      "description": |-
+        PLACEHOLDER
+      "$fields":
+        "grants":
+          "description": |-
+            The Unity Catalog privileges to grant to principals on this securable.
+          "markdown_description": |-
+            A Sequence of Unity Catalog privilege grants on this securable, where each item grants a set of `privileges` to a `principal` (a user, group, or service principal).
+
+            See [\_](/data-governance/unity-catalog/manage-privileges/index.md).
+          "markdown_examples": |-
+            ```yaml
+            grants:
+              - principal: account users
+                privileges:
+                  - SELECT
+              - principal: data-engineers
+                privileges:
+                  - ALL_PRIVILEGES
+            ```
+        "lifecycle":
+          "description": |-
+            Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+        "managed_encryption_settings":
+          "$fields":
+            "azure_encryption_settings":
+              "$fields":
+                "azure_cmk_access_connector_id":
+                  "description": |-
+                    PLACEHOLDER
+                "azure_cmk_managed_identity_id":
+                  "description": |-
+                    PLACEHOLDER
+                "azure_tenant_id":
+                  "description": |-
+                    PLACEHOLDER
+    "cluster_policies":
+      "description": |-
+        PLACEHOLDER
+      "$fields":
+        "lifecycle":
+          "description": |-
+            PLACEHOLDER
+        "permissions":
+          "description": |-
+            The permissions to apply to this resource.
+          "markdown_description": |-
+            A Sequence of permissions to apply to this resource, where each item grants a permission `level` to a single `user_name`, `group_name`, or `service_principal_name`. A principal cannot be set in both a resource's `permissions` and the top-level `permissions` mapping.
+
+            See [\_](/dev-tools/bundles/settings.md#permissions) and [\_](/dev-tools/bundles/permissions.md).
+          "$fields":
+            "group_name":
+              "description": |-
+                The name of the group granted the permission level.
+            "level":
+              "description": |-
+                The permission level to apply. Cluster policies only support `CAN_USE`.
+            "service_principal_name":
+              "description": |-
+                The name of the service principal granted the permission level.
+            "user_name":
+              "description": |-
+                The name of the user granted the permission level.
+    "clusters":
+      "description": |-
+        The cluster definitions for the bundle, where each key is the name of a cluster.
+      "markdown_description": |-
+        The cluster definitions for the bundle, where each key is the name of a cluster. See [\_](/dev-tools/bundles/resources.md#clusters).
+      "$type":
+        "markdown_description": |-
+          The cluster resource defines an [all-purpose cluster](/api/workspace/clusters/create).
+        "markdown_examples": |-
+          The following example creates a cluster named `my_cluster` and sets that as the cluster to use to run the notebook in `my_job`:
+
+          ```yaml
+          bundle:
+            name: clusters
+
+          resources:
+            clusters:
+              my_cluster:
+                num_workers: 2
+                node_type_id: "i3.xlarge"
+                autoscale:
+                  min_workers: 2
+                  max_workers: 7
+                spark_version: "13.3.x-scala2.12"
+                spark_conf:
+                  "spark.executor.memory": "2g"
+
+            jobs:
+              my_job:
+                tasks:
+                  - task_key: test_task
+                    notebook_task:
+                      notebook_path: "./src/my_notebook.py"
+          ```
+      "$fields":
+        "libraries":
+          "description": |-
+            A list of libraries to install on the cluster. Installed via the Libraries API after the cluster is created.
+        "lifecycle":
+          "description": |-
+            Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+          "$fields":
+            "prevent_destroy":
+              "description": |-
+                Lifecycle setting to prevent the resource from being destroyed.
+            "started":
+              "description": |-
+                Lifecycle setting to deploy the resource in started mode. Only supported for apps, clusters, and sql_warehouses.
+        "permissions":
+          "description": |-
+            The permissions to apply to this resource.
+          "markdown_description": |-
+            A Sequence of permissions to apply to this resource, where each item grants a permission `level` to a single `user_name`, `group_name`, or `service_principal_name`. A principal cannot be set in both a resource's `permissions` and the top-level `permissions` mapping.
+
+            See [\_](/dev-tools/bundles/settings.md#permissions) and [\_](/dev-tools/bundles/permissions.md).
+          "markdown_examples": |-
+            ```yaml
+            permissions:
+              - level: CAN_VIEW
+                group_name: test-group
+              - level: CAN_MANAGE
+                user_name: someone@example.com
+              - level: CAN_RUN
+                service_principal_name: 123456-abcdef
+            ```
+          "$fields":
+            "group_name":
+              "description": |-
+                The name of the group granted the permission level.
+            "level":
+              "description": |-
+                The permission level to apply. The allowed levels depend on the resource type.
+            "service_principal_name":
+              "description": |-
+                The name of the service principal granted the permission level.
+            "user_name":
+              "description": |-
+                The name of the user granted the permission level.
+    "dashboards":
+      "description": |-
+        The dashboard definitions for the bundle, where each key is the name of the dashboard.
+      "markdown_description": |-
+        The dashboard definitions for the bundle, where each key is the name of the dashboard. See [\_](/dev-tools/bundles/resources.md#dashboards).
+      "$type":
+        "markdown_description": |-
+          The dashboard resource allows you to manage [AI/BI dashboards](/api/workspace/lakeview/create) in a bundle. For information about AI/BI dashboards, see [_](/dashboards/index.md).
+        "markdown_examples": |-
+          The following example includes and deploys the sample __NYC Taxi Trip Analysis__ dashboard to the Databricks workspace.
+
+          ``` yaml
+          resources:
+            dashboards:
+              nyc_taxi_trip_analysis:
+                display_name: "NYC Taxi Trip Analysis"
+                file_path: ../src/nyc_taxi_trip_analysis.lvdash.json
+                warehouse_id: ${var.warehouse_id}
+          ```
+          If you use the UI to modify the dashboard, modifications made through the UI are not applied to the dashboard JSON file in the local bundle unless you explicitly update it using `bundle generate`. You can use the `--watch` option to continuously poll and retrieve changes to the dashboard. See [_](/dev-tools/cli/bundle-commands.md#generate).
+
+          In addition, if you attempt to deploy a bundle that contains a dashboard JSON file that is different than the one in the remote workspace, an error will occur. To force the deploy and overwrite the dashboard in the remote workspace with the local one, use the `--force` option. See [_](/dev-tools/cli/bundle-commands.md#deploy).
+      "$fields":
+        "create_time":
+          "description": |-
+            The timestamp of when the dashboard was created.
+        "dashboard_id":
+          "description": |-
+            UUID identifying the dashboard.
+        "dataset_catalog":
+          "description": |-
+            Sets the default catalog for all datasets in this dashboard. When set, this overrides the catalog specified in individual dataset definitions.
+        "dataset_schema":
+          "description": |-
+            Sets the default schema for all datasets in this dashboard. When set, this overrides the schema specified in individual dataset definitions.
+        "display_name":
+          "description": |-
+            The display name of the dashboard.
+        "embed_credentials":
+          "description": |-
+            PLACEHOLDER
+        "etag":
+          "description": |-
+            The etag for the dashboard. Can be optionally provided on updates to ensure that the dashboard
+            has not been modified since the last read.
+            This field is excluded in List Dashboards responses.
+        "file_path":
+          "description": |-
+            PLACEHOLDER
+        "lifecycle":
+          "description": |-
+            Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+        "lifecycle_state":
+          "description": |-
+            The state of the dashboard resource. Used for tracking trashed status.
+        "parent_path":
+          "description": |-
+            The workspace path of the folder containing the dashboard. Includes leading slash and no
+            trailing slash.
+            This field is excluded in List Dashboards responses.
+        "path":
+          "description": |-
+            The workspace path of the dashboard asset, including the file name.
+            Exported dashboards always have the file extension `.lvdash.json`.
+            This field is excluded in List Dashboards responses.
+        "permissions":
+          "description": |-
+            The permissions to apply to this resource.
+          "markdown_description": |-
+            A Sequence of permissions to apply to this resource, where each item grants a permission `level` to a single `user_name`, `group_name`, or `service_principal_name`. A principal cannot be set in both a resource's `permissions` and the top-level `permissions` mapping.
+
+            See [\_](/dev-tools/bundles/settings.md#permissions) and [\_](/dev-tools/bundles/permissions.md).
+          "markdown_examples": |-
+            ```yaml
+            permissions:
+              - level: CAN_VIEW
+                group_name: test-group
+              - level: CAN_MANAGE
+                user_name: someone@example.com
+              - level: CAN_RUN
+                service_principal_name: 123456-abcdef
+            ```
+          "$fields":
+            "group_name":
+              "description": |-
+                The name of the group granted the permission level.
+            "level":
+              "description": |-
+                The permission level to apply. The allowed levels depend on the resource type.
+            "service_principal_name":
+              "description": |-
+                The name of the service principal granted the permission level.
+            "user_name":
+              "description": |-
+                The name of the user granted the permission level.
+        "serialized_dashboard":
+          "description": |-
+            The contents of the dashboard in serialized string form.
+            This field is excluded in List Dashboards responses.
+            Use the [get dashboard API](https://docs.databricks.com/api/workspace/lakeview/get)
+            to retrieve an example response, which includes the `serialized_dashboard` field.
+            This field provides the structure of the JSON string that represents the dashboard's
+            layout and components.
+        "update_time":
+          "description": |-
+            The timestamp of when the dashboard was last updated by the user.
+            This field is excluded in List Dashboards responses.
+        "warehouse_id":
+          "description": |-
+            The warehouse ID used to run the dashboard.
+    "database_catalogs":
+      "description": |-
+        PLACEHOLDER
+      "$fields":
+        "create_database_if_not_exists":
+          "description": |-
+            PLACEHOLDER
+        "lifecycle":
+          "description": |-
+            Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+        "uid":
+          "description": |-
+            PLACEHOLDER
+    "database_instances":
+      "description": |-
+        PLACEHOLDER
+      "$fields":
+        "lifecycle":
+          "description": |-
+            Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+        "permissions":
+          "description": |-
+            The permissions to apply to this resource.
+          "markdown_description": |-
+            A Sequence of permissions to apply to this resource, where each item grants a permission `level` to a single `user_name`, `group_name`, or `service_principal_name`. A principal cannot be set in both a resource's `permissions` and the top-level `permissions` mapping.
+
+            See [\_](/dev-tools/bundles/settings.md#permissions) and [\_](/dev-tools/bundles/permissions.md).
+          "markdown_examples": |-
+            ```yaml
+            permissions:
+              - level: CAN_VIEW
+                group_name: test-group
+              - level: CAN_MANAGE
+                user_name: someone@example.com
+              - level: CAN_RUN
+                service_principal_name: 123456-abcdef
+            ```
+    "experiments":
+      "description": |-
+        The experiment definitions for the bundle, where each key is the name of the experiment.
+      "markdown_description": |-
+        The experiment definitions for the bundle, where each key is the name of the experiment. See [\_](/dev-tools/bundles/resources.md#experiments).
+      "$type":
+        "markdown_description": |-
+          The experiment resource allows you to define [MLflow experiments](/api/workspace/experiments/createexperiment) in a bundle. For information about MLflow experiments, see [_](/mlflow/experiments.md).
+        "markdown_examples": |-
+          The following example defines an experiment that all users can view:
+
+          ```yaml
+          resources:
+            experiments:
+              experiment:
+                name: my_ml_experiment
+                permissions:
+                  - level: CAN_READ
+                    group_name: users
+                description: MLflow experiment used to track runs
+          ```
+      "$fields":
+        "lifecycle":
+          "description": |-
+            Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+        "permissions":
+          "description": |-
+            The permissions to apply to this resource.
+          "markdown_description": |-
+            A Sequence of permissions to apply to this resource, where each item grants a permission `level` to a single `user_name`, `group_name`, or `service_principal_name`. A principal cannot be set in both a resource's `permissions` and the top-level `permissions` mapping.
+
+            See [\_](/dev-tools/bundles/settings.md#permissions) and [\_](/dev-tools/bundles/permissions.md).
+          "markdown_examples": |-
+            ```yaml
+            permissions:
+              - level: CAN_VIEW
+                group_name: test-group
+              - level: CAN_MANAGE
+                user_name: someone@example.com
+              - level: CAN_RUN
+                service_principal_name: 123456-abcdef
+            ```
+          "$fields":
+            "group_name":
+              "description": |-
+                The name of the group granted the permission level.
+            "level":
+              "description": |-
+                The permission level to apply. The allowed levels depend on the resource type.
+            "service_principal_name":
+              "description": |-
+                The name of the service principal granted the permission level.
+            "user_name":
+              "description": |-
+                The name of the user granted the permission level.
+    "external_locations":
+      "description": |-
+        PLACEHOLDER
+      "$fields":
+        "effective_file_event_queue":
+          "$fields":
+            "managed_aqs":
+              "description": |-
+                PLACEHOLDER
+            "managed_pubsub":
+              "description": |-
+                PLACEHOLDER
+            "managed_sqs":
+              "description": |-
+                PLACEHOLDER
+            "provided_aqs":
+              "description": |-
+                PLACEHOLDER
+            "provided_pubsub":
+              "description": |-
+                PLACEHOLDER
+            "provided_sqs":
+              "description": |-
+                PLACEHOLDER
+        "encryption_details":
+          "$fields":
+            "sse_encryption_details":
+              "$fields":
+                "algorithm":
+                  "$type":
+                    "description": |-
+                      SSE algorithm to use for encrypting S3 objects
+        "grants":
+          "description": |-
+            The Unity Catalog privileges to grant to principals on this securable.
+          "markdown_description": |-
+            A Sequence of Unity Catalog privilege grants on this securable, where each item grants a set of `privileges` to a `principal` (a user, group, or service principal).
+
+            See [\_](/data-governance/unity-catalog/manage-privileges/index.md).
+          "markdown_examples": |-
+            ```yaml
+            grants:
+              - principal: account users
+                privileges:
+                  - SELECT
+              - principal: data-engineers
+                privileges:
+                  - ALL_PRIVILEGES
+            ```
+        "lifecycle":
+          "description": |-
+            Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    "features":
+      "description": |-
+        The feature definitions for the bundle, where each key is the name of the feature.
+      "markdown_description": |-
+        The feature definitions for the bundle, where each key is the name of the feature.
+      "$fields":
+        "filter_condition":
+          "description": |-
+            PLACEHOLDER
+        "function":
+          "$fields":
+            "aggregation_function":
+              "$fields":
+                "time_window":
+                  "$fields":
+                    "continuous":
+                      "description": |-
+                        PLACEHOLDER
+                    "sliding":
+                      "description": |-
+                        PLACEHOLDER
+                    "tumbling":
+                      "description": |-
+                        PLACEHOLDER
+            "extra_parameters":
+              "description": |-
+                PLACEHOLDER
+            "function_type":
+              "description": |-
+                PLACEHOLDER
+        "inputs":
+          "description": |-
+            PLACEHOLDER
+        "lifecycle":
+          "description": |-
+            PLACEHOLDER
+        "source":
+          "$fields":
+            "delta_table_source":
+              "$fields":
+                "entity_columns":
+                  "description": |-
+                    PLACEHOLDER
+                "timeseries_column":
+                  "description": |-
+                    PLACEHOLDER
+            "kafka_source":
+              "$fields":
+                "entity_column_identifiers":
+                  "description": |-
+                    PLACEHOLDER
+                "timeseries_column_identifier":
+                  "description": |-
+                    PLACEHOLDER
+        "time_window":
+          "description": |-
+            PLACEHOLDER
+    "genie_spaces":
+      "description": |-
+        PLACEHOLDER
+      "$fields":
+        "description":
+          "description": |-
+            Description of the Genie space shown alongside the title in the Databricks UI.
+        "etag":
+          "description": |-
+            PLACEHOLDER
+        "file_path":
+          "description": |-
+            Local path to a `.geniespace.json` file holding the serialized Genie space definition. The contents are inlined into `serialized_space` at deploy time. Mutually exclusive with an inline `serialized_space`.
+        "lifecycle":
+          "description": |-
+            Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+        "parent_path":
+          "description": |-
+            Workspace folder under which to create the Genie space. Immutable: changing this field recreates the resource.
+        "permissions":
+          "description": |-
+            The permissions to apply to this resource.
+          "markdown_description": |-
+            A Sequence of permissions to apply to this resource, where each item grants a permission `level` to a single `user_name`, `group_name`, or `service_principal_name`. A principal cannot be set in both a resource's `permissions` and the top-level `permissions` mapping.
+
+            See [\_](/dev-tools/bundles/settings.md#permissions) and [\_](/dev-tools/bundles/permissions.md).
+          "markdown_examples": |-
+            ```yaml
+            permissions:
+              - level: CAN_VIEW
+                group_name: test-group
+              - level: CAN_MANAGE
+                user_name: someone@example.com
+              - level: CAN_RUN
+                service_principal_name: 123456-abcdef
+            ```
+        "serialized_space":
+          "description": |-
+            Serialized Genie space body. May be provided inline as a JSON string (or YAML that will be marshalled to JSON) or referenced via `file_path`. To round-trip an existing space into a bundle, use `databricks bundle generate genie-space`.
+        "title":
+          "description": |-
+            Title of the Genie space shown in the Databricks UI.
+        "warehouse_id":
+          "description": |-
+            ID of the SQL warehouse used to run queries for this Genie space.
+    "instance_pools":
+      "description": |-
+        The instance pool definitions for the bundle, where each key is the name of the instance pool.
+      "markdown_description": |-
+        The instance pool definitions for the bundle, where each key is the name of the instance pool. See [\_](/dev-tools/bundles/resources.md#instance_pools).
+      "$type":
+        "markdown_description": |-
+          The instance pool resource defines an [instance pool](/api/workspace/instancepools/create), a set of idle, ready-to-use cloud instances that reduce cluster start and auto-scaling times.
+        "markdown_examples": |-
+          The following example creates an instance pool named `my_instance_pool`:
+
+          ```yaml
+          resources:
+            instance_pools:
+              my_instance_pool:
+                instance_pool_name: my_instance_pool
+                node_type_id: i3.xlarge
+                min_idle_instances: 2
+                max_capacity: 10
+                idle_instance_autotermination_minutes: 60
+          ```
+      "$fields":
+        "disk_spec":
+          "$fields":
+            "disk_iops":
+              "description": |-
+                The number of IOPS to provision for each attached disk.
+            "disk_throughput":
+              "description": |-
+                The disk throughput to provision for each attached disk, in MB per second.
+        "lifecycle":
+          "description": |-
+            Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+        "permissions":
+          "description": |-
+            The permissions to apply to this resource.
+          "markdown_description": |-
+            A Sequence of permissions to apply to this resource, where each item grants a permission `level` to a single `user_name`, `group_name`, or `service_principal_name`. A principal cannot be set in both a resource's `permissions` and the top-level `permissions` mapping.
+
+            See [\_](/dev-tools/bundles/settings.md#permissions) and [\_](/dev-tools/bundles/permissions.md).
+          "$fields":
+            "group_name":
+              "description": |-
+                The name of the group granted the permission level.
+            "level":
+              "description": |-
+                The permission level to apply. The allowed levels depend on the resource type.
+            "service_principal_name":
+              "description": |-
+                The name of the service principal granted the permission level.
+            "user_name":
+              "description": |-
+                The name of the user granted the permission level.
+    "job_runs":
+      "description": |-
+        The job run definitions for the bundle, where each key is the name of the job run. Each job run triggers a run of an existing job as part of bundle deployment.
+
+        The deployment waits for the run to finish and fails if it does not succeed, so other resources can reference the run's outcome, for example `${resources.job_runs.<name>.state.result_state}`. A run that did not succeed is run again on the next deployment.
+      "$fields":
+        "lifecycle":
+          "description": |-
+            Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed and when the run re-fires.
+          "$fields":
+            "prevent_destroy":
+              "description": |-
+                Lifecycle setting to prevent the resource from being destroyed.
+            "triggers":
+              "description": |-
+                Conditions that re-fire this job run (in addition to configuration changes).
+              "$fields":
+                "on_bundle_deploy":
+                  "description": |-
+                    If true, re-fire the run on every bundle deploy.
+                "on_file_change":
+                  "description": |-
+                    Path or glob relative to the defining YAML file. It must resolve under the sync root. Re-fire the run when a matched file's content hash changes, or when the set of matches appears or disappears. Only files the bundle syncs are hashed, so .gitignore and sync.exclude apply. Use * to match a single directory level; ** is not supported.
+        "python_named_params":
+          "description": |-
+            PLACEHOLDER
+    "jobs":
+      "description": |-
+        The job definitions for the bundle, where each key is the name of the job.
+      "markdown_description": |-
+        The job definitions for the bundle, where each key is the name of the job. See [\_](/dev-tools/bundles/resources.md#jobs).
+      "$type":
+        "markdown_description": |-
+          The job resource allows you to define [jobs and their corresponding tasks](/api/workspace/jobs/create) in your bundle. For information about jobs, see [_](/jobs/index.md). For a tutorial that uses a Declarative Automation Bundles template to create a job, see [_](/dev-tools/bundles/jobs-tutorial.md).
+        "markdown_examples": |-
+          The following example defines a job with the resource key `hello-job` with one notebook task:
+
+          ```yaml
+          resources:
+            jobs:
+              hello-job:
+                name: hello-job
+                tasks:
+                  - task_key: hello-task
+                    notebook_task:
+                      notebook_path: ./hello.py
+          ```
+
+          For information about defining job tasks and overriding job settings, see [_](/dev-tools/bundles/job-task-types.md), [_](/dev-tools/bundles/job-task-override.md), and [_](/dev-tools/bundles/cluster-override.md).
+      "$fields":
+        "environments":
+          "$fields":
+            "spec":
+              "$fields":
+                "dependencies":
+                  "description": |-
+                    List of pip dependencies, as supported by the version of pip in this environment.
+        "git_source":
+          "$fields":
+            "sparse_checkout":
+              "description": |-
+                PLACEHOLDER
+        "health":
+          "$fields":
+            "rules":
+              "description": |-
+                PLACEHOLDER
+        "job_clusters":
+          "$fields":
+            "new_cluster":
+              "$fields":
+                "azure_attributes":
+                  "$fields":
+                    "log_analytics_info":
+                      "$fields":
+                        "log_analytics_primary_key":
+                          "description": |-
+                            The primary key for the Azure Log Analytics agent configuration
+                        "log_analytics_workspace_id":
+                          "description": |-
+                            The workspace ID for the Azure Log Analytics agent configuration
+                "init_scripts":
+                  "$fields":
+                    "abfss":
+                      "description": |-
+                        Contains the Azure Data Lake Storage destination path
+        "lifecycle":
+          "description": |-
+            Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+          "$fields":
+            "prevent_destroy":
+              "description": |-
+                Lifecycle setting to prevent the resource from being destroyed.
+        "permissions":
+          "description": |-
+            The permissions to apply to this resource.
+          "markdown_description": |-
+            A Sequence of permissions to apply to this resource, where each item grants a permission `level` to a single `user_name`, `group_name`, or `service_principal_name`. A principal cannot be set in both a resource's `permissions` and the top-level `permissions` mapping.
+
+            See [\_](/dev-tools/bundles/settings.md#permissions) and [\_](/dev-tools/bundles/permissions.md).
+          "markdown_examples": |-
+            ```yaml
+            permissions:
+              - level: CAN_VIEW
+                group_name: test-group
+              - level: CAN_MANAGE
+                user_name: someone@example.com
+              - level: CAN_RUN
+                service_principal_name: 123456-abcdef
+            ```
+          "$fields":
+            "group_name":
+              "description": |-
+                The name of the group granted the permission level.
+            "level":
+              "description": |-
+                The permission level to apply. The allowed levels depend on the resource type.
+            "service_principal_name":
+              "description": |-
+                The name of the service principal granted the permission level.
+            "user_name":
+              "description": |-
+                The name of the user granted the permission level.
+        "run_as":
+          "$fields":
+            "service_principal_name":
+              "description": |-
+                The application ID of an active service principal. Setting this field requires the `servicePrincipal/user` role.
+            "user_name":
+              "description": |-
+                The email of an active workspace user. Non-admin users can only set this field to their own email.
+        "tasks":
+          "$fields":
+            "alert_task":
+              "$fields":
+                "subscribers":
+                  "$fields":
+                    "destination_id":
+                      "description": |-
+                        PLACEHOLDER
+            "dbt_platform_task":
+              "description": |-
+                PLACEHOLDER
+            "gen_ai_compute_task":
+              "$fields":
+                "compute":
+                  "description": |-
+                    PLACEHOLDER
+            "python_operator_task":
+              "$fields":
+                "parameters":
+                  "$fields":
+                    "name":
+                      "description": |-
+                        PLACEHOLDER
+                    "value":
+                      "description": |-
+                        PLACEHOLDER
+            "run_job_task":
+              "$fields":
+                "python_named_params":
+                  "description": |-
+                    PLACEHOLDER
+            "webhook_notifications":
+              "$fields":
+                "on_duration_warning_threshold_exceeded":
+                  "$fields":
+                    "id":
+                      "description": |-
+                        PLACEHOLDER
+        "trigger":
+          "$fields":
+            "model":
+              "description": |-
+                PLACEHOLDER
+            "table_update":
+              "description": |-
+                PLACEHOLDER
+    "mcp_services":
+      "description": |-
+        PLACEHOLDER
+      "$fields":
+        "comment":
+          "description": |-
+            PLACEHOLDER
+        "config":
+          "description": |-
+            PLACEHOLDER
+        "grants":
+          "description": |-
+            PLACEHOLDER
+        "lifecycle":
+          "description": |-
+            PLACEHOLDER
+        "mcp_service_id":
+          "description": |-
+            PLACEHOLDER
+        "parent":
+          "description": |-
+            PLACEHOLDER
+    "model_provider_services":
+      "description": |-
+        PLACEHOLDER
+      "$fields":
+        "comment":
+          "description": |-
+            PLACEHOLDER
+        "config":
+          "description": |-
+            PLACEHOLDER
+        "grants":
+          "description": |-
+            PLACEHOLDER
+        "lifecycle":
+          "description": |-
+            PLACEHOLDER
+        "model_provider_service_id":
+          "description": |-
+            PLACEHOLDER
+        "parent":
+          "description": |-
+            PLACEHOLDER
+    "model_services":
+      "description": |-
+        PLACEHOLDER
+      "$fields":
+        "comment":
+          "description": |-
+            PLACEHOLDER
+        "config":
+          "description": |-
+            PLACEHOLDER
+        "grants":
+          "description": |-
+            PLACEHOLDER
+        "lifecycle":
+          "description": |-
+            PLACEHOLDER
+        "model_service_id":
+          "description": |-
+            PLACEHOLDER
+        "parent":
+          "description": |-
+            PLACEHOLDER
+    "model_serving_endpoints":
+      "description": |-
+        The model serving endpoint definitions for the bundle, where each key is the name of the model serving endpoint.
+      "markdown_description": |-
+        The model serving endpoint definitions for the bundle, where each key is the name of the model serving endpoint. See [\_](/dev-tools/bundles/resources.md#model_serving_endpoints).
+      "$type":
+        "markdown_description": |-
+          The model_serving_endpoint resource allows you to define [model serving endpoints](/api/workspace/servingendpoints/create). See [_](/machine-learning/model-serving/manage-serving-endpoints.md).
+        "markdown_examples": |-
+          The following example defines a Unity Catalog model serving endpoint:
+
+          ```yaml
+          resources:
+            model_serving_endpoints:
+              uc_model_serving_endpoint:
+                name: "uc-model-endpoint"
+                config:
+                  served_entities:
+                  - entity_name: "myCatalog.mySchema.my-ads-model"
+                    entity_version: "10"
+                    workload_size: "Small"
+                    scale_to_zero_enabled: "true"
+                  traffic_config:
+                    routes:
+                    - served_model_name: "my-ads-model-10"
+                      traffic_percentage: "100"
+                tags:
+                - key: "team"
+                  value: "data science"
+          ```
+      "$fields":
+        "config":
+          "$fields":
+            "served_entities":
+              "$fields":
+                "entity_version":
+                  "description": |-
+                    PLACEHOLDER
+            "served_models":
+              "$fields":
+                "model_name":
+                  "description": |-
+                    PLACEHOLDER
+                "model_version":
+                  "description": |-
+                    PLACEHOLDER
+            "traffic_config":
+              "$fields":
+                "routes":
+                  "$fields":
+                    "served_entity_name":
+                      "description": |-
+                        PLACEHOLDER
+        "description":
+          "description": |-
+            PLACEHOLDER
+        "lifecycle":
+          "description": |-
+            Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+        "permissions":
+          "description": |-
+            The permissions to apply to this resource.
+          "markdown_description": |-
+            A Sequence of permissions to apply to this resource, where each item grants a permission `level` to a single `user_name`, `group_name`, or `service_principal_name`. A principal cannot be set in both a resource's `permissions` and the top-level `permissions` mapping.
+
+            See [\_](/dev-tools/bundles/settings.md#permissions) and [\_](/dev-tools/bundles/permissions.md).
+          "markdown_examples": |-
+            ```yaml
+            permissions:
+              - level: CAN_VIEW
+                group_name: test-group
+              - level: CAN_MANAGE
+                user_name: someone@example.com
+              - level: CAN_RUN
+                service_principal_name: 123456-abcdef
+            ```
+          "$fields":
+            "group_name":
+              "description": |-
+                The name of the group granted the permission level.
+            "level":
+              "description": |-
+                The permission level to apply. The allowed levels depend on the resource type.
+            "service_principal_name":
+              "description": |-
+                The name of the service principal granted the permission level.
+            "user_name":
+              "description": |-
+                The name of the user granted the permission level.
+    "models":
+      "description": |-
+        The model definitions for the bundle, where each key is the name of the model.
+      "markdown_description": |-
+        The model definitions for the bundle, where each key is the name of the model. See [\_](/dev-tools/bundles/resources.md#models).
+      "$type":
+        "markdown_description": |-
+          The model resource allows you to define [legacy models](/api/workspace/modelregistry/createmodel) in bundles. Databricks recommends you use Unity Catalog [registered models](#registered-model) instead.
+      "$fields":
+        "lifecycle":
+          "description": |-
+            Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+        "permissions":
+          "description": |-
+            The permissions to apply to this resource.
+          "markdown_description": |-
+            A Sequence of permissions to apply to this resource, where each item grants a permission `level` to a single `user_name`, `group_name`, or `service_principal_name`. A principal cannot be set in both a resource's `permissions` and the top-level `permissions` mapping.
+
+            See [\_](/dev-tools/bundles/settings.md#permissions) and [\_](/dev-tools/bundles/permissions.md).
+          "markdown_examples": |-
+            ```yaml
+            permissions:
+              - level: CAN_VIEW
+                group_name: test-group
+              - level: CAN_MANAGE
+                user_name: someone@example.com
+              - level: CAN_RUN
+                service_principal_name: 123456-abcdef
+            ```
+          "$fields":
+            "group_name":
+              "description": |-
+                The name of the group granted the permission level.
+            "level":
+              "description": |-
+                The permission level to apply. The allowed levels depend on the resource type.
+            "service_principal_name":
+              "description": |-
+                The name of the service principal granted the permission level.
+            "user_name":
+              "description": |-
+                The name of the user granted the permission level.
+    "pipelines":
+      "description": |-
+        The pipeline definitions for the bundle, where each key is the name of the pipeline.
+      "markdown_description": |-
+        The pipeline definitions for the bundle, where each key is the name of the pipeline. See [\_](/dev-tools/bundles/resources.md#pipelines).
+      "$type":
+        "markdown_description": |-
+          This resource allows you to create [pipelines](/api/workspace/pipelines/create). For information about pipelines, see [_](/dlt/index.md). For a tutorial that uses the Declarative Automation Bundles template to create a pipeline, see [_](/dev-tools/bundles/pipelines-tutorial.md).
+        "markdown_examples": |-
+          The following example defines a pipeline with the resource key `hello-pipeline`:
+
+          ```yaml
+          resources:
+            pipelines:
+              hello-pipeline:
+                name: hello-pipeline
+                clusters:
+                  - label: default
+                    num_workers: 1
+                development: true
+                continuous: false
+                channel: CURRENT
+                edition: CORE
+                photon: false
+                libraries:
+                  - notebook:
+                      path: ./pipeline.py
+          ```
+      "$fields":
+        "cascade_on_destroy":
+          "description": |-
+            Whether destroying the pipeline also deletes its datasets (MVs, STs, Views). Defaults to true (the server default). Set to false to retain the datasets when the pipeline is deleted. Only affects the delete operation.
+        "ingestion_definition":
+          "$fields":
+            "objects":
+              "$fields":
+                "schema":
+                  "$fields":
+                    "connector_options":
+                      "$fields":
+                        "gdrive_options":
+                          "description": |-
+                            PLACEHOLDER
+                          "$fields":
+                            "entity_type":
+                              "description": |-
+                                PLACEHOLDER
+                            "file_ingestion_options":
+                              "description": |-
+                                PLACEHOLDER
+                              "$fields":
+                                "corrupt_record_column":
+                                  "description": |-
+                                    PLACEHOLDER
+                                "ignore_corrupt_files":
+                                  "description": |-
+                                    PLACEHOLDER
+                                "infer_column_types":
+                                  "description": |-
+                                    PLACEHOLDER
+                                "rescued_data_column":
+                                  "description": |-
+                                    PLACEHOLDER
+                                "single_variant_column":
+                                  "description": |-
+                                    PLACEHOLDER
+                        "kafka_options":
+                          "description": |-
+                            PLACEHOLDER
+                          "$fields":
+                            "key_transformer":
+                              "$fields":
+                                "avro_options":
+                                  "description": |-
+                                    PLACEHOLDER
+                                "json_options":
+                                  "description": |-
+                                    PLACEHOLDER
+                                "protobuf_options":
+                                  "description": |-
+                                    PLACEHOLDER
+                        "sharepoint_options":
+                          "description": |-
+                            PLACEHOLDER
+            "source_configurations":
+              "$fields":
+                "google_ads_config":
+                  "description": |-
+                    PLACEHOLDER
+        "libraries":
+          "$fields":
+            "whl":
+              "deprecation_message": |-
+                This field is deprecated
+        "lifecycle":
+          "description": |-
+            Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+        "permissions":
+          "description": |-
+            The permissions to apply to this resource.
+          "markdown_description": |-
+            A Sequence of permissions to apply to this resource, where each item grants a permission `level` to a single `user_name`, `group_name`, or `service_principal_name`. A principal cannot be set in both a resource's `permissions` and the top-level `permissions` mapping.
+
+            See [\_](/dev-tools/bundles/settings.md#permissions) and [\_](/dev-tools/bundles/permissions.md).
+          "markdown_examples": |-
+            ```yaml
+            permissions:
+              - level: CAN_VIEW
+                group_name: test-group
+              - level: CAN_MANAGE
+                user_name: someone@example.com
+              - level: CAN_RUN
+                service_principal_name: 123456-abcdef
+            ```
+          "$fields":
+            "group_name":
+              "description": |-
+                The name of the group granted the permission level.
+            "level":
+              "description": |-
+                The permission level to apply. The allowed levels depend on the resource type.
+            "service_principal_name":
+              "description": |-
+                The name of the service principal granted the permission level.
+            "user_name":
+              "description": |-
+                The name of the user granted the permission level.
+        "trigger":
+          "deprecation_message": |-
+            Use continuous instead
+          "$fields":
+            "cron":
+              "description": |-
+                PLACEHOLDER
+              "$fields":
+                "quartz_cron_schedule":
+                  "description": |-
+                    PLACEHOLDER
+                "timezone_id":
+                  "description": |-
+                    PLACEHOLDER
+            "manual":
+              "description": |-
+                PLACEHOLDER
+    "postgres_branches":
+      "description": |-
+        The Postgres branch definitions for the bundle, where each key is the name of the branch. Each entry defines a branch of a Lakebase Autoscaling project, holding its own copy of the project's databases and roles.
+      "$fields":
+        "branch_id":
+          "description": |-
+            The ID to use for the branch; becomes the final component of the branch's resource name. Must be 1-63 characters long, start with a lowercase letter, and contain only lowercase letters, numbers, and hyphens. For example, `development` becomes `projects/my-app/branches/development`.
+        "lifecycle":
+          "description": |-
+            Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+        "parent":
+          "description": |-
+            The project containing this branch (API resource hierarchy). Format: projects/{project_id}
+
+            This field indicates where the branch exists in the resource hierarchy. For point-in-time branching from another branch, see `source_branch`.
+        "purge_on_delete":
+          "description": |-
+            When true, permanently delete the branch when the bundle is destroyed. When false or unset, the branch is soft deleted and can be restored within its retention window.
+        "replace_existing":
+          "description": |-
+            When true, take over an existing branch with the same ID instead of failing with an ALREADY_EXISTS error. Use it to bring a branch that already exists on the project (for example, the production branch created with the project) under bundle management. Only takes effect when the branch is created.
+    "postgres_catalogs":
+      "description": |-
+        The Postgres catalog definitions for the bundle, where each key is the name of the catalog. Each entry binds a Unity Catalog catalog to a Postgres database on a Lakebase Autoscaling branch.
+      "$fields":
+        "catalog_id":
+          "description": |-
+            The ID of the catalog in Unity Catalog; becomes the full resource name. For example, `my_catalog` becomes `catalogs/my_catalog`.
+        "lifecycle":
+          "description": |-
+            Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    "postgres_databases":
+      "description": |-
+        The Postgres database definitions for the bundle, where each key is the name of the database. Each entry defines a database on a Lakebase Autoscaling branch.
+      "$fields":
+        "database_id":
+          "description": |-
+            The ID to use for the database; becomes the final component of the database's resource name and the database name in Postgres. Must be 4-63 characters and use only characters available in DNS names, as defined by RFC 1123. If not specified, it is generated automatically.
+        "lifecycle":
+          "description": |-
+            Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+        "parent":
+          "description": |-
+            The branch containing this database. Format: projects/{project_id}/branches/{branch_id}
+        "replace_existing":
+          "description": |-
+            When true, take over an existing database with the same ID instead of failing with an ALREADY_EXISTS error. Use it to bring a database that already exists on the branch under bundle management. Only takes effect when the database is created.
+    "postgres_endpoints":
+      "description": |-
+        The Postgres endpoint definitions for the bundle, where each key is the name of the endpoint. Each entry defines a compute endpoint that serves queries for a Lakebase Autoscaling branch.
+      "$fields":
+        "endpoint_id":
+          "description": |-
+            The ID to use for the endpoint; becomes the final component of the endpoint's resource name. Must be 1-63 characters long, start with a lowercase letter, and contain only lowercase letters, numbers, and hyphens. For example, `primary` becomes `projects/my-app/branches/development/endpoints/primary`.
+        "lifecycle":
+          "description": |-
+            Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+        "parent":
+          "description": |-
+            The branch containing this endpoint (API resource hierarchy). Format: projects/{project_id}/branches/{branch_id}
+        "replace_existing":
+          "description": |-
+            When true, take over an existing endpoint with the same ID instead of failing with an ALREADY_EXISTS error. Use it to bring an endpoint that already exists on the branch (for example, the primary read-write endpoint created with the branch) under bundle management. Only takes effect when the endpoint is created.
+    "postgres_projects":
+      "description": |-
+        The Postgres project definitions for the bundle, where each key is the name of the project. Each entry defines a Lakebase Autoscaling project, the top-level container for branches, endpoints, databases, and roles.
+      "$fields":
+        "lifecycle":
+          "description": |-
+            Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+        "permissions":
+          "description": |-
+            The permissions to apply to this resource.
+          "markdown_description": |-
+            A Sequence of permissions to apply to this resource, where each item grants a permission `level` to a single `user_name`, `group_name`, or `service_principal_name`. A principal cannot be set in both a resource's `permissions` and the top-level `permissions` mapping.
+
+            See [\_](/dev-tools/bundles/settings.md#permissions) and [\_](/dev-tools/bundles/permissions.md).
+          "markdown_examples": |-
+            ```yaml
+            permissions:
+              - level: CAN_VIEW
+                group_name: test-group
+              - level: CAN_MANAGE
+                user_name: someone@example.com
+              - level: CAN_RUN
+                service_principal_name: 123456-abcdef
+            ```
+        "project_id":
+          "description": |-
+            The ID to use for the project; becomes the final component of the project's resource name. Must be 1-63 characters long, start with a lowercase letter, and contain only lowercase letters, numbers, and hyphens. For example, `my-app` becomes `projects/my-app`.
+        "purge_on_delete":
+          "description": |-
+            When true, permanently delete the project when the bundle is destroyed. When false or unset, the project is soft deleted and can be restored within its retention window.
+    "postgres_roles":
+      "description": |-
+        The Postgres role definitions for the bundle, where each key is the name of the role. Each entry defines a role on a Lakebase Autoscaling branch, optionally backed by a Databricks identity.
+      "$fields":
+        "attributes":
+          "description": |-
+            The desired API-exposed Postgres role attributes to associate with the role.
+          "$fields":
+            "bypassrls":
+              "description": |-
+                Grants the Postgres `BYPASSRLS` attribute, which lets the role bypass every row-level security policy.
+            "createdb":
+              "description": |-
+                Grants the Postgres `CREATEDB` attribute, which lets the role create databases.
+            "createrole":
+              "description": |-
+                Grants the Postgres `CREATEROLE` attribute, which lets the role create, alter, and drop other roles.
+        "auth_method":
+          "description": |-
+            How the role is authenticated when connecting to Postgres. If left unspecified, a meaningful authentication method is derived from the identity_type.
+        "identity_type":
+          "description": |-
+            The type of the Databricks managed identity that this Role represents. Leave empty to create a regular Postgres role not associated with a Databricks identity.
+        "lifecycle":
+          "description": |-
+            Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+        "membership_roles":
+          "description": |-
+            Standard roles that this role is a member of.
+        "parent":
+          "description": |-
+            The branch where this role is created. Format projects/{project_id}/branches/{branch_id}.
+        "postgres_role":
+          "description": |-
+            The name of the Postgres role. Required when creating the role.
+        "replace_existing":
+          "description": |-
+            When true, take over an existing role with the same ID instead of failing with an ALREADY_EXISTS error. Use it to bring a role that already exists on the branch (for example, one inherited from the parent branch) under bundle management. Only takes effect when the role is created.
+        "role_id":
+          "description": |-
+            The user-specified role ID; becomes the final component of the role's resource name. Must be 4-63 characters, lowercase letters, numbers, and hyphens (RFC 1123).
+    "postgres_snapshot_schedules":
+      "description": |-
+        The Postgres snapshot schedule definitions for the bundle, where each key is the name of the snapshot schedule. Each entry configures the automatic-snapshot cadences for a branch of a Lakebase Autoscaling project.
+      "$fields":
+        "branch":
+          "description": |-
+            The branch whose automatic-snapshot schedule this manages. Format: projects/{project_id}/branches/{branch_id}
+        "lifecycle":
+          "description": |-
+            Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+        "schedule":
+          "description": |-
+            The cadences at which automatic snapshots are taken. An empty set disables automatic snapshots. When several cadences fire together, one snapshot is taken and retained for the longest of their retentions.
+    "postgres_synced_tables":
+      "description": |-
+        The Postgres synced table definitions for the bundle, where each key is the name of the synced table. Each entry continuously replicates a Unity Catalog Delta source table into a Postgres table on a Lakebase Autoscaling instance.
+      "$fields":
+        "lifecycle":
+          "description": |-
+            Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+        "synced_table_id":
+          "description": |-
+            The ID to use for the synced table; becomes the final component of the synced table's resource name. It is the synced table name, a `{catalog}.{schema}.{table}` tuple of Unity Catalog entity names.
+
+            It names both an online view in Unity Catalog, accessible through Lakehouse Federation, and a Postgres table named `{table}` in schema `{schema}` in the connected Postgres database.
+    "quality_monitors":
+      "description": |-
+        The quality monitor definitions for the bundle, where each key is the name of the quality monitor.
+      "markdown_description": |-
+        The quality monitor definitions for the bundle, where each key is the name of the quality monitor. See [\_](/dev-tools/bundles/resources.md#quality_monitors).
+      "$type":
+        "markdown_description": |-
+          The quality_monitor resource allows you to define a Unity Catalog [table monitor](/api/workspace/qualitymonitors/create). For information about monitors, see [_](/machine-learning/model-serving/monitor-diagnose-endpoints.md).
+        "markdown_examples": |-
+          The following example defines a quality monitor:
+
+          ```yaml
+          resources:
+            quality_monitors:
+              my_quality_monitor:
+                table_name: dev.mlops_schema.predictions
+                output_schema_name: ${bundle.target}.mlops_schema
+                assets_dir: /Users/${workspace.current_user.userName}/databricks_lakehouse_monitoring
+                inference_log:
+                  granularities: [1 day]
+                  model_id_col: model_id
+                  prediction_col: prediction
+                  label_col: price
+                  problem_type: PROBLEM_TYPE_REGRESSION
+                  timestamp_col: timestamp
+                schedule:
+                  quartz_cron_expression: 0 0 8 * * ? # Run Every day at 8am
+                  timezone_id: UTC
+          ```
+      "$fields":
+        "inference_log":
+          "description": |-
+            PLACEHOLDER
+          "$fields":
+            "granularities":
+              "description": |-
+                Granularities for aggregating data into time windows based on their timestamp. Valid values are 5 minutes, 30 minutes, 1 hour, 1 day, n weeks, 1 month, or 1 year.
+        "lifecycle":
+          "description": |-
+            Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+        "table_name":
+          "description": |-
+            PLACEHOLDER
+        "time_series":
+          "$fields":
+            "granularities":
+              "description": |-
+                Granularities for aggregating data into time windows based on their timestamp. Valid values are 5 minutes, 30 minutes, 1 hour, 1 day, n weeks, 1 month, or 1 year.
+    "registered_models":
+      "description": |-
+        The registered model definitions for the bundle, where each key is the name of the Unity Catalog registered model.
+      "markdown_description": |-
+        The registered model definitions for the bundle, where each key is the name of the Unity Catalog registered model. See [\_](/dev-tools/bundles/resources.md#registered_models)
+      "$type":
+        "markdown_description": |-
+          The registered model resource allows you to define models in Unity Catalog. For information about Unity Catalog [registered models](/api/workspace/registeredmodels/create), see [_](/machine-learning/manage-model-lifecycle/index.md).
+        "markdown_examples": |-
+          The following example defines a registered model in Unity Catalog:
+
+          ```yaml
+          resources:
+            registered_models:
+                model:
+                  name: my_model
+                  catalog_name: ${bundle.target}
+                  schema_name: mlops_schema
+                  comment: Registered model in Unity Catalog for ${bundle.target} deployment target
+                  grants:
+                    - privileges:
+                        - EXECUTE
+                      principal: account users
+          ```
+      "$fields":
+        "grants":
+          "description": |-
+            The Unity Catalog privileges to grant to principals on this securable.
+          "markdown_description": |-
+            A Sequence of Unity Catalog privilege grants on this securable, where each item grants a set of `privileges` to a `principal` (a user, group, or service principal).
+
+            See [\_](/data-governance/unity-catalog/manage-privileges/index.md).
+          "markdown_examples": |-
+            ```yaml
+            grants:
+              - principal: account users
+                privileges:
+                  - SELECT
+              - principal: data-engineers
+                privileges:
+                  - ALL_PRIVILEGES
+            ```
+        "lifecycle":
+          "description": |-
+            Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    "schemas":
+      "description": |-
+        The schema definitions for the bundle, where each key is the name of the schema.
+      "markdown_description": |-
+        The schema definitions for the bundle, where each key is the name of the schema. See [\_](/dev-tools/bundles/resources.md#schemas).
+      "$type":
+        "markdown_description": |-
+          The schema resource type allows you to define Unity Catalog [schemas](/api/workspace/schemas/create) for tables and other assets in your jobs and pipelines created as part of a bundle. A schema, different from other resource types, has the following limitations:
+
+          - The owner of a schema resource is always the deployment user, and cannot be changed. If `run_as` is specified in the bundle, it will be ignored by operations on the schema.
+          - Only fields supported by the corresponding [Schemas object create API](/api/workspace/schemas/create) are available for the schema resource. For example, `enable_predictive_optimization` is not supported as it is only available on the [update API](/api/workspace/schemas/update).
+        "markdown_examples": |-
+          The following example defines a pipeline with the resource key `my_pipeline` that creates a Unity Catalog schema with the key `my_schema` as the target:
+
+          ```yaml
+          resources:
+            pipelines:
+              my_pipeline:
+                name: test-pipeline-{{.unique_id}}
+                libraries:
+                  - notebook:
+                      path: ./nb.sql
+                development: true
+                catalog: main
+                target: ${resources.schemas.my_schema.id}
+
+            schemas:
+              my_schema:
+                name: test-schema-{{.unique_id}}
+                catalog_name: main
+                comment: This schema was created by DABs.
+          ```
+
+          A top-level grants mapping is not supported by Declarative Automation Bundles, so if you want to set grants for a schema, define the grants for the schema within the `schemas` mapping. For more information about grants, see [_](/data-governance/unity-catalog/manage-privileges/index.md#grant).
+
+          The following example defines a Unity Catalog schema with grants:
+
+          ```yaml
+          resources:
+            schemas:
+              my_schema:
+                name: test-schema
+                grants:
+                  - principal: users
+                    privileges:
+                      - CAN_MANAGE
+                  - principal: my_team
+                    privileges:
+                      - CAN_READ
+                catalog_name: main
+            ```
+      "$fields":
+        "grants":
+          "description": |-
+            The Unity Catalog privileges to grant to principals on this securable.
+          "markdown_description": |-
+            A Sequence of Unity Catalog privilege grants on this securable, where each item grants a set of `privileges` to a `principal` (a user, group, or service principal).
+
+            See [\_](/data-governance/unity-catalog/manage-privileges/index.md).
+          "markdown_examples": |-
+            ```yaml
+            grants:
+              - principal: account users
+                privileges:
+                  - SELECT
+              - principal: data-engineers
+                privileges:
+                  - ALL_PRIVILEGES
+            ```
+        "lifecycle":
+          "description": |-
+            Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    "secret_scopes":
+      "description": |-
+        The secret scope definitions for the bundle, where each key is the name of the secret scope.
+      "markdown_description": |-
+        The secret scope definitions for the bundle, where each key is the name of the secret scope. See [\_](/dev-tools/bundles/resources.md#secret_scopes).
+      "$fields":
+        "backend_type":
+          "description": |-
+            The backend type the scope will be created with. If not specified, will default to `DATABRICKS`
+        "keyvault_metadata":
+          "description": |-
+            The metadata for the secret scope if the `backend_type` is `AZURE_KEYVAULT`
+        "lifecycle":
+          "description": |-
+            Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+        "name":
+          "description": |-
+            Scope name requested by the user. Scope names are unique.
+        "permissions":
+          "description": |-
+            The permissions to apply to the secret scope. Permissions are managed via secret scope ACLs.
+          "$fields":
+            "group_name":
+              "description": |-
+                The name of the group granted the permission level. This field translates to a `principal` field in secret scope ACL.
+            "level":
+              "description": |-
+                The permission level to apply. The allowed levels depend on the resource type.
+              "$type":
+                "enum":
+                  - |-
+                    READ
+                  - |-
+                    WRITE
+                  - |-
+                    MANAGE
+            "service_principal_name":
+              "description": |-
+                The application ID of an active service principal. This field translates to a `principal` field in secret scope ACL.
+            "user_name":
+              "description": |-
+                The name of the user granted the permission level. This field translates to a `principal` field in secret scope ACL.
+    "secrets":
+      "description": |-
+        The Unity Catalog secret definitions for the bundle, where each key is the name of the secret.
+      "markdown_description": |-
+        The Unity Catalog secret definitions for the bundle, where each key is the name of the secret. See [\_](/dev-tools/bundles/resources.md#secrets).
+      "$fields":
+        "catalog_name":
+          "description": |-
+            The name of the catalog where the schema and the secret reside.
+        "comment":
+          "description": |-
+            User-provided free-form text description of the secret.
+        "expire_time":
+          "description": |-
+            User-provided expiration time of the secret. Purely informational; does not trigger automatic actions.
+        "grants":
+          "description": |-
+            The grants to apply on this secret.
+        "lifecycle":
+          "description": |-
+            Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+        "name":
+          "description": |-
+            The name of the secret, relative to its parent schema.
+        "schema_name":
+          "description": |-
+            The name of the schema where the secret resides.
+        "value":
+          "description": |-
+            The secret value to store. Must be a variable reference (e.g. ${var.my_secret}) to prevent plain-text secrets in configuration files.
+    "sql_warehouses":
+      "description": |-
+        The SQL warehouse definitions for the bundle, where each key is the name of the warehouse.
+      "markdown_description": |-
+        The SQL warehouse definitions for the bundle, where each key is the name of the warehouse. See [\_](/dev-tools/bundles/resources.md#sql_warehouses).
+      "$fields":
+        "channel":
+          "$fields":
+            "dbsql_version":
+              "description": |-
+                PLACEHOLDER
+            "name":
+              "description": |-
+                PLACEHOLDER
+        "enable_photon":
+          "description": |-
+            Configures whether the warehouse should use Photon optimized clusters.
+
+            Defaults to true.
+        "lifecycle":
+          "description": |-
+            Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+        "permissions":
+          "description": |-
+            The permissions to apply to this resource.
+          "markdown_description": |-
+            A Sequence of permissions to apply to this resource, where each item grants a permission `level` to a single `user_name`, `group_name`, or `service_principal_name`. A principal cannot be set in both a resource's `permissions` and the top-level `permissions` mapping.
+
+            See [\_](/dev-tools/bundles/settings.md#permissions) and [\_](/dev-tools/bundles/permissions.md).
+          "markdown_examples": |-
+            ```yaml
+            permissions:
+              - level: CAN_VIEW
+                group_name: test-group
+              - level: CAN_MANAGE
+                user_name: someone@example.com
+              - level: CAN_RUN
+                service_principal_name: 123456-abcdef
+            ```
+          "$fields":
+            "group_name":
+              "description": |-
+                The name of the group granted the permission level.
+            "level":
+              "description": |-
+                The permission level to apply. The allowed levels depend on the resource type.
+            "service_principal_name":
+              "description": |-
+                The name of the service principal granted the permission level.
+            "user_name":
+              "description": |-
+                The name of the user granted the permission level.
+        "tags":
+          "$fields":
+            "custom_tags":
+              "description": |-
+                PLACEHOLDER
+              "$fields":
+                "key":
+                  "description": |-
+                    PLACEHOLDER
+                "value":
+                  "description": |-
+                    PLACEHOLDER
+    "synced_database_tables":
+      "description": |-
+        PLACEHOLDER
+      "$fields":
+        "data_synchronization_status":
+          "$fields":
+            "last_sync":
+              "$fields":
+                "delta_table_sync_info":
+                  "description": |-
+                    PLACEHOLDER
+        "lifecycle":
+          "description": |-
+            Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    "vector_search_endpoints":
+      "description": |-
+        PLACEHOLDER
+      "$fields":
+        "lifecycle":
+          "description": |-
+            Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+        "permissions":
+          "description": |-
+            The permissions to apply to this resource.
+          "markdown_description": |-
+            A Sequence of permissions to apply to this resource, where each item grants a permission `level` to a single `user_name`, `group_name`, or `service_principal_name`. A principal cannot be set in both a resource's `permissions` and the top-level `permissions` mapping.
+
+            See [\_](/dev-tools/bundles/settings.md#permissions) and [\_](/dev-tools/bundles/permissions.md).
+          "markdown_examples": |-
+            ```yaml
+            permissions:
+              - level: CAN_VIEW
+                group_name: test-group
+              - level: CAN_MANAGE
+                user_name: someone@example.com
+              - level: CAN_RUN
+                service_principal_name: 123456-abcdef
+            ```
+          "$fields":
+            "group_name":
+              "description": |-
+                PLACEHOLDER
+            "level":
+              "description": |-
+                PLACEHOLDER
+            "service_principal_name":
+              "description": |-
+                PLACEHOLDER
+            "user_name":
+              "description": |-
+                PLACEHOLDER
+    "vector_search_indexes":
+      "description": |-
+        PLACEHOLDER
+      "$fields":
+        "grants":
+          "description": |-
+            The Unity Catalog privileges to grant to principals on this securable.
+          "markdown_description": |-
+            A Sequence of Unity Catalog privilege grants on this securable, where each item grants a set of `privileges` to a `principal` (a user, group, or service principal).
+
+            See [\_](/data-governance/unity-catalog/manage-privileges/index.md).
+          "markdown_examples": |-
+            ```yaml
+            grants:
+              - principal: account users
+                privileges:
+                  - SELECT
+              - principal: data-engineers
+                privileges:
+                  - ALL_PRIVILEGES
+            ```
+        "lifecycle":
+          "description": |-
+            Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    "volumes":
+      "description": |-
+        The volume definitions for the bundle, where each key is the name of the volume.
+      "markdown_description": |-
+        The volume definitions for the bundle, where each key is the name of the volume. See [\_](/dev-tools/bundles/resources.md#volumes).
+      "$type":
+        "markdown_description": |-
+          The volume resource type allows you to define and create Unity Catalog [volumes](/api/workspace/volumes/create) as part of a bundle. When deploying a bundle with a volume defined, note that:
+
+          - A volume cannot be referenced in the `artifact_path` for the bundle until it exists in the workspace. Hence, if you want to use Declarative Automation Bundles to create the volume, you must first define the volume in the bundle, deploy it to create the volume, then reference it in the `artifact_path` in subsequent deployments.
+
+          - Volumes in the bundle are not prepended with the `dev_${workspace.current_user.short_name}` prefix when the deployment target has `mode: development` configured. However, you can manually configure this prefix. See [_](/dev-tools/bundles/deployment-modes.md#custom-presets).
+        "markdown_examples": |-
+          The following example creates a Unity Catalog volume with the key `my_volume`:
+
+          ```yaml
+          resources:
+            volumes:
+              my_volume:
+                catalog_name: main
+                name: my_volume
+                schema_name: my_schema
+          ```
+
+          For an example bundle that runs a job that writes to a file in Unity Catalog volume, see the [bundle-examples GitHub repository](https://github.com/databricks/bundle-examples/tree/main/knowledge_base/write_from_job_to_volume).
+      "$fields":
+        "grants":
+          "description": |-
+            The Unity Catalog privileges to grant to principals on this securable.
+          "markdown_description": |-
+            A Sequence of Unity Catalog privilege grants on this securable, where each item grants a set of `privileges` to a `principal` (a user, group, or service principal).
+
+            See [\_](/data-governance/unity-catalog/manage-privileges/index.md).
+          "markdown_examples": |-
+            ```yaml
+            grants:
+              - principal: account users
+                privileges:
+                  - SELECT
+              - principal: data-engineers
+                privileges:
+                  - ALL_PRIVILEGES
+            ```
+        "lifecycle":
+          "description": |-
+            Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+run_as:
+  "description": |-
+    The identity to use when running Declarative Automation Bundles resources.
+  "markdown_description": |-
+    The identity to use when running Declarative Automation Bundles resources. See [\_](/dev-tools/bundles/run-as.md).
+scripts:
+  "description": |-
+    PLACEHOLDER
+  "$fields":
+    "content":
+      "description": |-
+        PLACEHOLDER
+    "env":
+      "description": |-
+        A map of environment variables to export when running the script. Values may reference `${bundle.*}`, `${workspace.*}`, and `${var.*}` and are resolved before the script runs; reference them from `content` with `$NAME`.
+sync:
+  "description": |-
+    The files and file paths to include or exclude in the bundle.
+  "markdown_description": |-
+    The files and file paths to include or exclude in the bundle. See [\_](/dev-tools/bundles/settings.md#sync).
+targets:
+  "description": |-
+    Defines deployment targets for the bundle.
+  "markdown_description": |-
+    Defines deployment targets for the bundle. See [\_](/dev-tools/bundles/settings.md#targets)
+  "$fields":
+    "artifacts":
+      "description": |-
+        The artifacts to include in the target deployment.
+    "bundle":
+      "description": |-
+        The bundle attributes when deploying to this target.
+    "cluster_id":
+      "description": |-
+        The ID of the cluster to use for this target.
+    "compute_id":
+      "description": |-
+        Deprecated. The ID of the compute to use for this target.
+      "deprecation_message": |-
+        Deprecated: please use cluster_id instead
+    "default":
+      "description": |-
+        Whether this target is the default target.
+    "git":
+      "description": |-
+        The Git version control settings for the target.
+    "mode":
+      "description": |-
+        The deployment mode for the target.
+      "markdown_description": |-
+        The deployment mode for the target. Valid values are `development` or `production`. See [\_](/dev-tools/bundles/deployment-modes.md).
+    "permissions":
+      "description": |-
+        The permissions for deploying and running the bundle in the target.
+    "presets":
+      "description": |-
+        The deployment presets for the target.
+      "$fields":
+        "artifacts_dynamic_version":
+          "description": |-
+            Whether to enable dynamic_version on all artifacts.
+        "jobs_max_concurrent_runs":
+          "description": |-
+            The maximum concurrent runs for a job.
+        "name_prefix":
+          "description": |-
+            The prefix for job runs of the bundle.
+        "pipelines_development":
+          "description": |-
+            Whether pipeline deployments should be locked in development mode.
+        "source_linked_deployment":
+          "description": |-
+            Whether to link the deployment to the bundle source.
+        "tags":
+          "description": |-
+            The tags for the bundle deployment.
+        "trigger_pause_status":
+          "description": |-
+            A pause status to apply to all job triggers and schedules. Valid values are PAUSED or UNPAUSED.
+    "resources":
+      "description": |-
+        The resource definitions for the target.
+    "run_as":
+      "description": |-
+        The identity to use to run the bundle.
+      "markdown_description": |-
+        The identity to use to run the bundle, see [\_](/dev-tools/bundles/run-as.md).
+    "sync":
+      "description": |-
+        The local paths to sync to the target workspace when a bundle is run or deployed.
+      "$fields":
+        "exclude":
+          "description": |-
+            A list of files or folders to exclude from the bundle.
+        "include":
+          "description": |-
+            A list of files or folders to include in the bundle.
+        "paths":
+          "description": |-
+            The local folder paths, which can be outside the bundle root, to synchronize to the workspace when the bundle is deployed.
+    "variables":
+      "description": |-
+        The custom variable definitions for the target.
+      "$fields":
+        "default":
+          "description": |-
+            The default value for the variable.
+        "description":
+          "description": |-
+            The description of the variable.
+        "lookup":
+          "description": |-
+            The name of the alert, cluster_policy, cluster, dashboard, instance_pool, job, metastore, pipeline, query, service_principal, or warehouse object for which to retrieve an ID.
+        "type":
+          "description": |-
+            The type of the variable.
+    "workspace":
+      "description": |-
+        The Databricks workspace for the target.
+variables:
+  "description": |-
+    A Map that defines the custom variables for the bundle, where each key is the name of the variable, and the value is a Map that defines the variable.
+  "$type":
     "description": |-
       Defines a custom variable for the bundle.
     "markdown_description": |-
       Defines a custom variable for the bundle. See [\_](/dev-tools/bundles/settings.md#variables).
-  "default":
-    "description": |-
-      The default value for the variable.
-  "description":
-    "description": |-
-      The description of the variable
-  "lookup":
-    "description": |-
-      The name of the alert, cluster_policy, cluster, dashboard, instance_pool, job, metastore, pipeline, query, service_principal, or warehouse object for which to retrieve an ID.
-    "markdown_description": |-
-      The name of the `alert`, `cluster_policy`, `cluster`, `dashboard`, `instance_pool`, `job`, `metastore`, `pipeline`, `query`, `service_principal`, or `warehouse` object for which to retrieve an ID.
-  "type":
-    "description": |-
-      The type of the variable.
-github.com/databricks/databricks-sdk-go/service/jobs.JobRunAs:
-  "service_principal_name":
-    "description": |-
-      The application ID of an active service principal. Setting this field requires the `servicePrincipal/user` role.
-  "user_name":
-    "description": |-
-      The email of an active workspace user. Non-admin users can only set this field to their own email.
+  "$fields":
+    "default":
+      "description": |-
+        The default value for the variable.
+    "description":
+      "description": |-
+        The description of the variable
+    "lookup":
+      "description": |-
+        The name of the alert, cluster_policy, cluster, dashboard, instance_pool, job, metastore, pipeline, query, service_principal, or warehouse object for which to retrieve an ID.
+      "markdown_description": |-
+        The name of the `alert`, `cluster_policy`, `cluster`, `dashboard`, `instance_pool`, `job`, `metastore`, `pipeline`, `query`, `service_principal`, or `warehouse` object for which to retrieve an ID.
+      "$fields":
+        "alert":
+          "description": |-
+            The name of the alert for which to retrieve an ID.
+        "cluster":
+          "description": |-
+            The name of the cluster for which to retrieve an ID.
+        "cluster_policy":
+          "description": |-
+            The name of the cluster_policy for which to retrieve an ID.
+        "dashboard":
+          "description": |-
+            The name of the dashboard for which to retrieve an ID.
+        "instance_pool":
+          "description": |-
+            The name of the instance_pool for which to retrieve an ID.
+        "job":
+          "description": |-
+            The name of the job for which to retrieve an ID.
+        "metastore":
+          "description": |-
+            The name of the metastore for which to retrieve an ID.
+        "notification_destination":
+          "description": |-
+            The name of the notification_destination for which to retrieve an ID.
+        "pipeline":
+          "description": |-
+            The name of the pipeline for which to retrieve an ID.
+        "query":
+          "description": |-
+            The name of the query for which to retrieve an ID.
+        "service_principal":
+          "description": |-
+            The name of the service_principal for which to retrieve an ID.
+        "warehouse":
+          "description": |-
+            The name of the warehouse for which to retrieve an ID.
+    "type":
+      "description": |-
+        The type of the variable.
+workspace:
+  "description": |-
+    Defines the Databricks workspace for the bundle.
+  "markdown_description": |-
+    Defines the Databricks workspace for the bundle. See [\_](/dev-tools/bundles/settings.md#workspace).
+  "$fields":
+    "account_id":
+      "description": |-
+        The Databricks account ID.
+    "artifact_path":
+      "description": |-
+        The artifact path to use within the workspace for both deployments and job runs
+    "auth_type":
+      "description": |-
+        The authentication type.
+    "azure_client_id":
+      "description": |-
+        The Azure client ID
+    "azure_environment":
+      "description": |-
+        The Azure environment
+    "azure_login_app_id":
+      "description": |-
+        The Azure login app ID
+    "azure_tenant_id":
+      "description": |-
+        The Azure tenant ID
+    "azure_use_msi":
+      "description": |-
+        Whether to use MSI for Azure
+    "azure_workspace_resource_id":
+      "description": |-
+        The Azure workspace resource ID
+    "client_id":
+      "description": |-
+        The client ID for the workspace
+    "experimental_is_unified_host":
+      "description": |-
+        Deprecated: no-op. Unified hosts are now detected automatically from /.well-known/databricks-config. Retained for schema compatibility with existing databricks.yml files.
+    "file_path":
+      "description": |-
+        The file path to use within the workspace for both deployments and job runs
+    "google_service_account":
+      "description": |-
+        The Google service account name
+    "host":
+      "description": |-
+        The Databricks workspace host URL
+    "profile":
+      "description": |-
+        The Databricks workspace profile name
+    "resource_path":
+      "description": |-
+        The workspace resource path
+    "root_path":
+      "description": |-
+        The Databricks workspace root path
+    "state_path":
+      "description": |-
+        The workspace state path
+    "workspace_id":
+      "description": |-
+        The Databricks workspace ID
diff --git a/bundle/internal/schema/annotations_file.go b/bundle/internal/schema/annotations_file.go
new file mode 100644
index 00000000000..78e279f4476
--- /dev/null
+++ b/bundle/internal/schema/annotations_file.go
@@ -0,0 +1,419 @@
+package main
+
+import (
+	"bytes"
+	"fmt"
+	"os"
+	"reflect"
+	"slices"
+	"strings"
+
+	yaml3 "go.yaml.in/yaml/v3"
+
+	"github.com/databricks/cli/bundle/internal/annotation"
+	"github.com/databricks/cli/libs/diag"
+	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/dyn/convert"
+	"github.com/databricks/cli/libs/dyn/yamlloader"
+	"github.com/databricks/cli/libs/dyn/yamlsaver"
+)
+
+// fieldsKey nests a type's block of field nodes inside the node of a field
+// that resolves to it.
+//
+// typeDocKey holds the documentation for the type a field's value resolves to
+// (for map and sequence fields: each entry). It is applied to the type's
+// shared $defs entry, so it shows up at every occurrence of the type; this is
+// also where enum values live.
+//
+// Both are "$"-prefixed so they cannot be mistaken for — or collide with — a
+// config field of the same name (e.g. artifacts.*.type), which always appears
+// as a bare key inside "$fields".
+const (
+	fieldsKey  = "$fields"
+	typeDocKey = "$type"
+)
+
+// lineTypeDoc and lineFields sort the "$type" and "$fields" keys after a
+// node's inline descriptor keys, which the saver orders with small line
+// numbers (see descriptorKeyOrder).
+const (
+	lineTypeDoc = 9999
+	lineFields  = 10000
+)
+
+const annotationsFileHeader = `# This file contains the documentation the CLI owns for the bundle
+# configuration JSON schema: docs for fields that do not exist in the upstream
+# API spec (.codegen/cli.json), and overrides of upstream docs. Documentation
+# for everything else is inherited from cli.json at generation time and must
+# not be duplicated here.
+#
+# The structure mirrors the bundle configuration tree. The "$type" and
+# "$fields" keys are structural; every other key is a config field name.
+#   - A node documents one field: its inline keys (description,
+#     markdown_description, ...) apply to the field itself.
+#   - "$type" documents the type the field's value resolves to — for map and
+#     sequence fields, each entry. These docs are shared by every occurrence
+#     of the type; enum values also live here.
+#   - "$fields" holds the nodes of that type's fields (map and sequence levels
+#     are unwrapped implicitly).
+#   - Each type is expanded exactly once, at its first occurrence; fields of
+#     types that occur again later (for example everything under "targets")
+#     are documented at that first occurrence.
+#   - "description: PLACEHOLDER" marks fields that have no documentation yet.
+#
+# Running "task generate-schema" keeps this file in sync with the
+# configuration structure: it adds placeholders for new undocumented fields
+# and drops entries for fields that no longer exist.
+`
+
+// descriptorKeys is the set of YAML keys a node carries inline (the JSON tags
+// of annotation.Descriptor).
+var descriptorKeys = func() map[string]bool {
+	keys := map[string]bool{}
+	for field := range reflect.TypeFor[annotation.Descriptor]().Fields() {
+		keys[strings.Split(field.Tag.Get("json"), ",")[0]] = true
+	}
+	return keys
+}()
+
+// descriptorKeyOrder is the leading key order for a serialized descriptor,
+// matching the formatting of the previous annotation files. Remaining keys
+// follow alphabetically.
+var descriptorKeyOrder = []string{"description", "markdown_description", "title", "default", "enum"}
+
+// descriptorToMap serializes d into dst with its keys ordered. It returns the
+// nil value (writing nothing) when d carries no content.
+//
+// The empty check relies on the dyn.NilValue reference: with a nil reference,
+// FromTyped omits zero-valued fields, so an all-zero descriptor collapses to
+// KindNil rather than an empty map. Do not pass a map reference here, or empty
+// descriptors would start serializing as "{}".
+func descriptorToMap(d annotation.Descriptor, dst map[string]dyn.Value) (dyn.Value, error) {
+	v, err := convert.FromTyped(d, dyn.NilValue)
+	if err != nil || v.Kind() == dyn.KindNil {
+		return dyn.NilValue, err
+	}
+	return yamlsaver.ConvertToMapValue(d, yamlsaver.NewOrder(descriptorKeyOrder), []string{}, dst)
+}
+
+// descriptorEmpty reports whether d carries no documentation. See
+// descriptorToMap for why the nil reference is what makes this work.
+func descriptorEmpty(d annotation.Descriptor) bool {
+	v, err := convert.FromTyped(d, dyn.NilValue)
+	return err == nil && v.Kind() == dyn.KindNil
+}
+
+// loadAnnotationsFile reads the tree-format annotations file and flattens it
+// into per-type annotations. Tree positions that do not resolve to a type or
+// field in the config (stale entries, typos) are returned in unknown; they
+// are not loaded, so the next save drops them.
+func loadAnnotationsFile(path string, g *typeGraph) (annotation.File, []string, error) {
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return nil, nil, err
+	}
+	v, err := yamlloader.LoadYAML(path, bytes.NewBuffer(b))
+	if err != nil {
+		return nil, nil, err
+	}
+
+	l := &fileLoader{graph: g, data: annotation.File{}}
+	err = l.block(v, g.root, "")
+	if err != nil {
+		return nil, nil, err
+	}
+	return l.data, l.unknown, nil
+}
+
+type fileLoader struct {
+	graph   *typeGraph
+	data    annotation.File
+	unknown []string
+}
+
+// block loads one type's block of field nodes.
+func (l *fileLoader) block(v dyn.Value, typeKey, where string) error {
+	if v.Kind() == dyn.KindNil {
+		return nil
+	}
+	m, ok := v.AsMap()
+	if !ok {
+		return fmt.Errorf("%s: expected a mapping, got %s", where, v.Kind())
+	}
+
+	for _, pair := range m.Pairs() {
+		key := pair.Key.MustString()
+		child := where + "." + key
+		if where == "" {
+			child = key
+		}
+
+		edge, ok := l.graph.edge(typeKey, key)
+		if !ok {
+			l.unknown = append(l.unknown, child)
+			continue
+		}
+		err := l.node(pair.Value, typeKey, edge, child)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// node loads one field's node: the inline descriptor for the field, the
+// "$type" docs for the type it resolves to, and the "$fields" block of that
+// type's fields.
+func (l *fileLoader) node(v dyn.Value, typeKey string, edge fieldEdge, where string) error {
+	if v.Kind() == dyn.KindNil {
+		return nil
+	}
+	m, ok := v.AsMap()
+	if !ok {
+		return fmt.Errorf("%s: expected a mapping, got %s", where, v.Kind())
+	}
+
+	desc := dyn.NewMapping()
+	for _, pair := range m.Pairs() {
+		key := pair.Key.MustString()
+		switch {
+		case key == fieldsKey && edge.typ != "":
+			err := l.block(pair.Value, edge.typ, where+"."+fieldsKey)
+			if err != nil {
+				return err
+			}
+		case key == typeDocKey && edge.typ != "":
+			d, ok, err := l.descriptor(pair.Value, where+"."+typeDocKey)
+			if err != nil {
+				return err
+			}
+			if ok {
+				l.data.SetSelf(edge.typ, d)
+			}
+		case descriptorKeys[key]:
+			desc.SetLoc(key, nil, pair.Value)
+		default:
+			l.unknown = append(l.unknown, where+"."+key)
+		}
+	}
+
+	if desc.Len() > 0 {
+		d, err := toDescriptor(desc, where)
+		if err != nil {
+			return err
+		}
+		l.data.SetField(typeKey, edge.name, d)
+	}
+	return nil
+}
+
+// descriptor parses a mapping of descriptor keys (the value of a "$type" key).
+// Non-descriptor keys are flagged as unknown. The second return is false when
+// the mapping carries no descriptor keys.
+func (l *fileLoader) descriptor(v dyn.Value, where string) (annotation.Descriptor, bool, error) {
+	m, ok := v.AsMap()
+	if !ok {
+		return annotation.Descriptor{}, false, fmt.Errorf("%s: expected a mapping, got %s", where, v.Kind())
+	}
+	desc := dyn.NewMapping()
+	for _, pair := range m.Pairs() {
+		key := pair.Key.MustString()
+		if descriptorKeys[key] {
+			desc.SetLoc(key, nil, pair.Value)
+		} else {
+			l.unknown = append(l.unknown, where+"."+key)
+		}
+	}
+	if desc.Len() == 0 {
+		return annotation.Descriptor{}, false, nil
+	}
+	d, err := toDescriptor(desc, where)
+	return d, err == nil, err
+}
+
+// toDescriptor converts a mapping of descriptor keys to a typed descriptor.
+func toDescriptor(desc dyn.Mapping, where string) (annotation.Descriptor, error) {
+	var d annotation.Descriptor
+	err := convert.ToTyped(&d, dyn.V(desc))
+	if err != nil {
+		return annotation.Descriptor{}, fmt.Errorf("%s: %w", where, err)
+	}
+	return d, nil
+}
+
+// saveAnnotationsFile writes data to path in the canonical tree layout: a
+// depth-first walk over the config type graph in struct declaration order
+// expands every type at its first occurrence; keys are emitted alphabetically.
+// Entries that no tree position consumed (fields or types that no longer
+// exist) are returned as detached and are not written.
+func saveAnnotationsFile(path string, data annotation.File, g *typeGraph) ([]string, error) {
+	s := &fileSaver{
+		graph:        g,
+		data:         data,
+		visited:      map[string]bool{g.root: true},
+		expandAt:     map[edgeKey]bool{},
+		consumed:     map[edgeKey]bool{},
+		selfConsumed: map[string]bool{},
+	}
+	s.assignCanonical(g.root)
+
+	root, err := s.block(g.root)
+	if err != nil {
+		return nil, err
+	}
+
+	// Style every top-level key so all nested scalars render in literal block
+	// style, matching the formatting of the previous annotation files.
+	style := map[string]yaml3.Style{}
+	for k := range root {
+		style[k] = yaml3.LiteralStyle
+	}
+	err = yamlsaver.NewSaverWithStyle(style).SaveAsYAML(root, path, true)
+	if err != nil {
+		return nil, err
+	}
+	err = prependCommentToFile(path, annotationsFileHeader)
+	if err != nil {
+		return nil, err
+	}
+	return s.detached(), nil
+}
+
+type edgeKey struct {
+	typ  string
+	name string
+}
+
+type fileSaver struct {
+	graph        *typeGraph
+	data         annotation.File
+	visited      map[string]bool
+	expandAt     map[edgeKey]bool
+	consumed     map[edgeKey]bool
+	selfConsumed map[string]bool
+}
+
+// assignCanonical walks the type graph depth-first in struct declaration
+// order and records, for every type, the field edge at which it is expanded.
+func (s *fileSaver) assignCanonical(typeKey string) {
+	for _, edge := range s.graph.fields[typeKey] {
+		if edge.typ == "" || s.visited[edge.typ] {
+			continue
+		}
+		s.visited[edge.typ] = true
+		s.expandAt[edgeKey{typeKey, edge.name}] = true
+		s.assignCanonical(edge.typ)
+	}
+}
+
+// block renders one type's block of field nodes, emitted alphabetically.
+// Lines in the value locations encode the output order for the YAML saver.
+func (s *fileSaver) block(typeKey string) (map[string]dyn.Value, error) {
+	out := map[string]dyn.Value{}
+	line := 0
+
+	edges := slices.Clone(s.graph.fields[typeKey])
+	slices.SortFunc(edges, func(a, b fieldEdge) int {
+		return strings.Compare(a.name, b.name)
+	})
+	for _, edge := range edges {
+		node, err := s.node(typeKey, edge)
+		if err != nil {
+			return nil, err
+		}
+		if len(node) > 0 {
+			out[edge.name] = dyn.NewValue(node, []diag.Location{{Line: line}})
+			line++
+		}
+	}
+	return out, nil
+}
+
+// node renders one field's node: the inline field descriptor plus, at the
+// field's canonical position, the resolved type's "$type" docs and the
+// "fields" block of its fields.
+func (s *fileSaver) node(typeKey string, edge fieldEdge) (map[string]dyn.Value, error) {
+	out := map[string]dyn.Value{}
+
+	// The inline descriptor keys are written directly into the node, sharing
+	// it with the "$type" and "$fields" keys added below.
+	if d, ok := s.takeField(typeKey, edge.name); ok {
+		if _, err := descriptorToMap(d, out); err != nil {
+			return nil, err
+		}
+	}
+
+	if s.expandAt[edgeKey{typeKey, edge.name}] {
+		v, err := descriptorToMap(s.takeSelf(edge.typ), map[string]dyn.Value{})
+		if err != nil {
+			return nil, err
+		}
+		if v.Kind() != dyn.KindNil {
+			out[typeDocKey] = v.WithLocations([]diag.Location{{Line: lineTypeDoc}})
+		}
+
+		child, err := s.block(edge.typ)
+		if err != nil {
+			return nil, err
+		}
+		if len(child) > 0 {
+			out[fieldsKey] = dyn.NewValue(child, []diag.Location{{Line: lineFields}})
+		}
+	}
+	return out, nil
+}
+
+// takeField returns the descriptor for a field and marks it consumed for the
+// detached-entry report.
+func (s *fileSaver) takeField(typeKey, name string) (annotation.Descriptor, bool) {
+	d, ok := s.data[typeKey].Fields[name]
+	if ok {
+		s.consumed[edgeKey{typeKey, name}] = true
+	}
+	return d, ok
+}
+
+// takeSelf returns a type's own descriptor and marks it accounted for, whether
+// or not it carries any docs (expanding the type is what consumes it).
+func (s *fileSaver) takeSelf(typeKey string) annotation.Descriptor {
+	s.selfConsumed[typeKey] = true
+	return s.data[typeKey].Self
+}
+
+// detached returns the data entries no tree position consumed, sorted. These
+// are fields or types that no longer exist in the config.
+func (s *fileSaver) detached() []string {
+	var out []string
+	for typeKey, ta := range s.data {
+		if !s.selfConsumed[typeKey] && !descriptorEmpty(ta.Self) {
+			out = append(out, typeKey+": (type)")
+		}
+		for name := range ta.Fields {
+			if !s.consumed[edgeKey{typeKey, name}] {
+				out = append(out, typeKey+": "+name)
+			}
+		}
+	}
+	slices.Sort(out)
+	return out
+}
+
+func prependCommentToFile(outputPath, comment string) error {
+	b, err := os.ReadFile(outputPath)
+	if err != nil {
+		return err
+	}
+	f, err := os.OpenFile(outputPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o644)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	_, err = f.WriteString(comment)
+	if err != nil {
+		return err
+	}
+	_, err = f.Write(b)
+	return err
+}
diff --git a/bundle/internal/schema/annotations_file_test.go b/bundle/internal/schema/annotations_file_test.go
new file mode 100644
index 00000000000..42899b0c184
--- /dev/null
+++ b/bundle/internal/schema/annotations_file_test.go
@@ -0,0 +1,169 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"reflect"
+	"testing"
+
+	"github.com/databricks/cli/bundle/internal/annotation"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAnnotationsFileRoundTrip(t *testing.T) {
+	g, err := newTypeGraph(reflect.TypeFor[tgRoot]())
+	require.NoError(t, err)
+
+	data := annotation.File{
+		getPath(reflect.TypeFor[tgRoot]()): {
+			Fields: map[string]annotation.Descriptor{
+				"first":   {Description: "First field."},
+				"by_name": {Description: "Map field.", MarkdownDescription: "Map field. See [_](/foo.md)."},
+			},
+		},
+		getPath(reflect.TypeFor[tgNested]()): {
+			Self: annotation.Descriptor{Description: "A nested type."},
+			Fields: map[string]annotation.Descriptor{
+				"description": {Description: annotation.Placeholder},
+				"again":       {Description: "Recursive field."},
+			},
+		},
+		getPath(reflect.TypeFor[tgMode]()): {
+			Self: annotation.Descriptor{Enum: []any{"a", "b"}},
+		},
+		getPath(reflect.TypeFor[tgItem]()): {
+			Fields: map[string]annotation.Descriptor{
+				"inner": {Description: "Inner docs."},
+			},
+		},
+	}
+
+	path := filepath.Join(t.TempDir(), "annotations.yml")
+	detached, err := saveAnnotationsFile(path, data, g)
+	require.NoError(t, err)
+	assert.Empty(t, detached)
+
+	b, err := os.ReadFile(path)
+	require.NoError(t, err)
+
+	// Keys are emitted alphabetically; tgNested expands under `first` (its
+	// canonical position in declaration order), so `by_name`, which resolves
+	// to the same type, carries no `$type` or `$fields` keys. `plain` has no
+	// content and is omitted entirely.
+	expected := annotationsFileHeader + `by_name:
+  "description": |-
+    Map field.
+  "markdown_description": |-
+    Map field. See [_](/foo.md).
+first:
+  "description": |-
+    First field.
+  "$type":
+    "description": |-
+      A nested type.
+  "$fields":
+    "again":
+      "description": |-
+        Recursive field.
+    "description":
+      "description": |-
+        PLACEHOLDER
+items:
+  "$fields":
+    "inner":
+      "description": |-
+        Inner docs.
+mode:
+  "$type":
+    "enum":
+      - |-
+        a
+      - |-
+        b
+`
+	assert.Equal(t, expected, string(b))
+
+	loaded, unknown, err := loadAnnotationsFile(path, g)
+	require.NoError(t, err)
+	assert.Empty(t, unknown)
+	assert.Equal(t, data, loaded)
+
+	// Saving the loaded data again must be byte-identical.
+	path2 := filepath.Join(t.TempDir(), "annotations.yml")
+	_, err = saveAnnotationsFile(path2, loaded, g)
+	require.NoError(t, err)
+	b2, err := os.ReadFile(path2)
+	require.NoError(t, err)
+	assert.Equal(t, string(b), string(b2))
+}
+
+func TestAnnotationsFileUnknownEntries(t *testing.T) {
+	g, err := newTypeGraph(reflect.TypeFor[tgRoot]())
+	require.NoError(t, err)
+
+	path := filepath.Join(t.TempDir(), "annotations.yml")
+	err = os.WriteFile(path, []byte(`first:
+  description: |-
+    Valid entry.
+  bogus_key: |-
+    Not a descriptor key.
+  type:
+    description: |-
+      Unprefixed "type" is not the structural key, so it is unknown here.
+  $fields:
+    no_such_field:
+      description: |-
+        Field does not exist.
+plain:
+  $fields:
+    nested:
+      description: |-
+        Primitive fields have no nested fields.
+  $type:
+    description: |-
+      Primitive fields have no type docs.
+`), 0o644)
+	require.NoError(t, err)
+
+	data, unknown, err := loadAnnotationsFile(path, g)
+	require.NoError(t, err)
+	assert.Equal(t, []string{
+		"first.bogus_key",
+		"first.type",
+		"first.$fields.no_such_field",
+		"plain.$fields",
+		"plain.$type",
+	}, unknown)
+
+	// The valid entry is still loaded.
+	assert.Equal(t, "Valid entry.", data[getPath(reflect.TypeFor[tgRoot]())].Fields["first"].Description)
+}
+
+func TestAnnotationsFileDetachedEntries(t *testing.T) {
+	g, err := newTypeGraph(reflect.TypeFor[tgRoot]())
+	require.NoError(t, err)
+
+	data := annotation.File{
+		getPath(reflect.TypeFor[tgRoot]()): {
+			Fields: map[string]annotation.Descriptor{
+				"no_such_field": {Description: "Stale."},
+			},
+		},
+		"github.com/databricks/cli/no/such.Type": {
+			Self: annotation.Descriptor{Description: "Stale type."},
+			Fields: map[string]annotation.Descriptor{
+				"field": {Description: "Stale."},
+			},
+		},
+	}
+
+	path := filepath.Join(t.TempDir(), "annotations.yml")
+	detached, err := saveAnnotationsFile(path, data, g)
+	require.NoError(t, err)
+	assert.Equal(t, []string{
+		"github.com/databricks/cli/bundle/internal/schema.tgRoot: no_such_field",
+		"github.com/databricks/cli/no/such.Type: (type)",
+		"github.com/databricks/cli/no/such.Type: field",
+	}, detached)
+}
diff --git a/bundle/internal/schema/annotations_openapi.yml b/bundle/internal/schema/annotations_openapi.yml
deleted file mode 100644
index 84a4b01b545..00000000000
--- a/bundle/internal/schema/annotations_openapi.yml
+++ /dev/null
@@ -1,6254 +0,0 @@
-# This file is auto-generated. DO NOT EDIT.
-github.com/databricks/cli/bundle/config/resources.Alert:
-  "create_time":
-    "description": |-
-      The timestamp indicating when the alert was created.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "custom_description":
-    "description": |-
-      Custom description for the alert. support mustache template.
-  "custom_summary":
-    "description": |-
-      Custom summary for the alert. support mustache template.
-  "display_name":
-    "description": |-
-      The display name of the alert.
-  "effective_run_as":
-    "description": |-
-      The actual identity that will be used to execute the alert.
-      This is an output-only field that shows the resolved run-as identity after applying
-      permissions and defaults.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "evaluation": {}
-  "id":
-    "description": |-
-      UUID identifying the alert.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "lifecycle_state":
-    "description": |-
-      Indicates whether the query is trashed.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "owner_user_name":
-    "description": |-
-      The owner's username. This field is set to "Unavailable" if the user has been deleted.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "parent_path":
-    "description": |-
-      The workspace path of the folder containing the alert. Can only be set on create, and cannot be updated.
-  "query_text":
-    "description": |-
-      Text of the query to be run.
-  "run_as":
-    "description": |-
-      Specifies the identity that will be used to run the alert.
-      This field allows you to configure alerts to run as a specific user or service principal.
-      - For user identity: Set `user_name` to the email of an active workspace user. Users can only set this to their own email.
-      - For service principal: Set `service_principal_name` to the application ID. Requires the `servicePrincipal/user` role.
-      If not specified, the alert will run as the request user.
-  "run_as_user_name":
-    "description": |-
-      The run as username or application ID of service principal.
-      On Create and Update, this field can be set to application ID of an active service principal. Setting this field requires the servicePrincipal/user role.
-      Deprecated: Use `run_as` field instead. This field will be removed in a future release.
-    "deprecation_message": |-
-      This field is deprecated
-  "schedule": {}
-  "update_time":
-    "description": |-
-      The timestamp indicating when the alert was updated.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "warehouse_id":
-    "description": |-
-      ID of the SQL warehouse attached to the alert.
-github.com/databricks/cli/bundle/config/resources.App:
-  "active_deployment":
-    "description": |-
-      The active deployment of the app. A deployment is considered active when it has been deployed
-      to the app compute.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "app_status":
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "budget_policy_id": {}
-  "compute_size": {}
-  "compute_status":
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "create_time":
-    "description": |-
-      The creation time of the app. Formatted timestamp in ISO 6801.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "creator":
-    "description": |-
-      The email of the user that created the app.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "default_source_code_path":
-    "description": |-
-      The default workspace file system path of the source code from which app deployment are
-      created. This field tracks the workspace source code path of the last active deployment.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "description":
-    "description": |-
-      The description of the app.
-  "effective_budget_policy_id":
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "effective_usage_policy_id":
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "effective_user_api_scopes":
-    "description": |-
-      The effective api scopes granted to the user access token.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "git_repository":
-    "description": |-
-      Git repository configuration for app deployments. When specified, deployments can
-      reference code from this repository by providing only the git reference (branch, tag, or commit).
-    "x-databricks-preview": |-
-      PRIVATE
-  "id":
-    "description": |-
-      The unique identifier of the app.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "name":
-    "description": |-
-      The name of the app. The name must contain only lowercase alphanumeric characters and hyphens.
-      It must be unique within the workspace.
-  "oauth2_app_client_id":
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "oauth2_app_integration_id":
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "pending_deployment":
-    "description": |-
-      The pending deployment of the app. A deployment is considered pending when it is being prepared
-      for deployment to the app compute.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "resources":
-    "description": |-
-      Resources for the app.
-  "service_principal_client_id":
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "service_principal_id":
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "service_principal_name":
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "space":
-    "description": |-
-      Name of the space this app belongs to.
-    "x-databricks-preview": |-
-      PRIVATE
-  "telemetry_export_destinations": {}
-  "update_time":
-    "description": |-
-      The update time of the app. Formatted timestamp in ISO 6801.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "updater":
-    "description": |-
-      The email of the user that last updated the app.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "url":
-    "description": |-
-      The URL of the app once it is deployed.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "usage_policy_id": {}
-  "user_api_scopes": {}
-github.com/databricks/cli/bundle/config/resources.Catalog:
-  "comment":
-    "description": |-
-      User-provided free-form text description.
-  "connection_name":
-    "description": |-
-      The name of the connection to an external data source.
-  "managed_encryption_settings":
-    "description": |-
-      Control CMK encryption for managed catalog data
-    "x-databricks-preview": |-
-      PRIVATE
-  "name":
-    "description": |-
-      Name of catalog.
-  "options":
-    "description": |-
-      A map of key-value properties attached to the securable.
-  "properties":
-    "description": |-
-      A map of key-value properties attached to the securable.
-  "provider_name":
-    "description": |-
-      The name of delta sharing provider.
-
-      A Delta Sharing catalog is a catalog that is based on a Delta share on a remote sharing server.
-  "share_name":
-    "description": |-
-      The name of the share under the share provider.
-  "storage_root":
-    "description": |-
-      Storage root URL for managed tables within catalog.
-github.com/databricks/cli/bundle/config/resources.Cluster:
-  "_":
-    "description": |-
-      Contains a snapshot of the latest user specified settings that were used to create/edit the cluster.
-  "apply_policy_default_values":
-    "description": |-
-      When set to true, fixed and default values from the policy will be used for fields that are omitted. When set to false, only fixed values from the policy will be applied.
-  "autoscale":
-    "description": |-
-      Parameters needed in order to automatically scale clusters up and down based on load.
-      Note: autoscaling works best with DB runtime versions 3.0 or later.
-  "autotermination_minutes":
-    "description": |-
-      Automatically terminates the cluster after it is inactive for this time in minutes. If not set,
-      this cluster will not be automatically terminated. If specified, the threshold must be between
-      10 and 10000 minutes.
-      Users can also set this value to 0 to explicitly disable automatic termination.
-  "aws_attributes":
-    "description": |-
-      Attributes related to clusters running on Amazon Web Services.
-      If not specified at cluster creation, a set of default values will be used.
-  "azure_attributes":
-    "description": |-
-      Attributes related to clusters running on Microsoft Azure.
-      If not specified at cluster creation, a set of default values will be used.
-  "cluster_log_conf":
-    "description": |-
-      The configuration for delivering spark logs to a long-term storage destination.
-      Three kinds of destinations (DBFS, S3 and Unity Catalog volumes) are supported. Only one destination can be specified
-      for one cluster. If the conf is given, the logs will be delivered to the destination every
-      `5 mins`. The destination of driver logs is `$destination/$clusterId/driver`, while
-      the destination of executor logs is `$destination/$clusterId/executor`.
-  "cluster_name":
-    "description": |-
-      Cluster name requested by the user. This doesn't have to be unique.
-      If not specified at creation, the cluster name will be an empty string.
-      For job clusters, the cluster name is automatically set based on the job and job run IDs.
-  "custom_tags":
-    "description": |-
-      Additional tags for cluster resources. Databricks will tag all cluster resources (e.g., AWS
-      instances and EBS volumes) with these tags in addition to `default_tags`. Notes:
-
-      - Currently, Databricks allows at most 45 custom tags
-
-      - Clusters can only reuse cloud resources if the resources' tags are a subset of the cluster tags
-  "data_security_mode":
-    "description": |-
-      Data security mode decides what data governance model to use when accessing data
-      from a cluster.
-
-      The following modes can only be used when `kind = CLASSIC_PREVIEW`.
-      * `DATA_SECURITY_MODE_AUTO`: Databricks will choose the most appropriate access mode depending on your compute configuration.
-      * `DATA_SECURITY_MODE_STANDARD`: Alias for `USER_ISOLATION`.
-      * `DATA_SECURITY_MODE_DEDICATED`: Alias for `SINGLE_USER`.
-
-      The following modes can be used regardless of `kind`.
-      * `NONE`: No security isolation for multiple users sharing the cluster. Data governance features are not available in this mode.
-      * `SINGLE_USER`: A secure cluster that can only be exclusively used by a single user specified in `single_user_name`. Most programming languages, cluster features and data governance features are available in this mode.
-      * `USER_ISOLATION`: A secure cluster that can be shared by multiple users. Cluster users are fully isolated so that they cannot see each other's data and credentials. Most data governance features are supported in this mode. But programming languages and cluster features might be limited.
-
-      The following modes are deprecated starting with Databricks Runtime 15.0 and
-      will be removed for future Databricks Runtime versions:
-
-      * `LEGACY_TABLE_ACL`: This mode is for users migrating from legacy Table ACL clusters.
-      * `LEGACY_PASSTHROUGH`: This mode is for users migrating from legacy Passthrough on high concurrency clusters.
-      * `LEGACY_SINGLE_USER`: This mode is for users migrating from legacy Passthrough on standard clusters.
-      * `LEGACY_SINGLE_USER_STANDARD`: This mode provides a way that doesn’t have UC nor passthrough enabled.
-  "docker_image":
-    "description": |-
-      Custom docker image BYOC
-  "driver_instance_pool_id":
-    "description": |-
-      The optional ID of the instance pool for the driver of the cluster belongs.
-      The pool cluster uses the instance pool with id (instance_pool_id) if the driver pool is not
-      assigned.
-  "driver_node_type_flexibility":
-    "description": |-
-      Flexible node type configuration for the driver node.
-  "driver_node_type_id":
-    "description": |-
-      The node type of the Spark driver.
-      Note that this field is optional; if unset, the driver node type will be set as the same value
-      as `node_type_id` defined above.
-
-      This field, along with node_type_id, should not be set if virtual_cluster_size is set.
-      If both driver_node_type_id, node_type_id, and virtual_cluster_size are specified, driver_node_type_id and node_type_id take precedence.
-  "enable_elastic_disk":
-    "description": |-
-      Autoscaling Local Storage: when enabled, this cluster will dynamically acquire additional disk
-      space when its Spark workers are running low on disk space.
-  "enable_local_disk_encryption":
-    "description": |-
-      Whether to enable LUKS on cluster VMs' local disks
-  "gcp_attributes":
-    "description": |-
-      Attributes related to clusters running on Google Cloud Platform.
-      If not specified at cluster creation, a set of default values will be used.
-  "init_scripts":
-    "description": |-
-      The configuration for storing init scripts. Any number of destinations can be specified.
-      The scripts are executed sequentially in the order provided.
-      If `cluster_log_conf` is specified, init script logs are sent to `<destination>/<cluster-ID>/init_scripts`.
-  "instance_pool_id":
-    "description": |-
-      The optional ID of the instance pool to which the cluster belongs.
-  "is_single_node":
-    "description": |-
-      This field can only be used when `kind = CLASSIC_PREVIEW`.
-
-      When set to true, Databricks will automatically set single node related `custom_tags`, `spark_conf`, and `num_workers`
-  "kind":
-    "description": |-
-      The kind of compute described by this compute specification.
-
-      Depending on `kind`, different validations and default values will be applied.
-
-      Clusters with `kind = CLASSIC_PREVIEW` support the following fields, whereas clusters with no specified `kind` do not.
-      * [is_single_node](/api/workspace/clusters/create#is_single_node)
-      * [use_ml_runtime](/api/workspace/clusters/create#use_ml_runtime)
-      * [data_security_mode](/api/workspace/clusters/create#data_security_mode) set to `DATA_SECURITY_MODE_AUTO`, `DATA_SECURITY_MODE_DEDICATED`, or `DATA_SECURITY_MODE_STANDARD`
-
-      By using the [simple form](https://docs.databricks.com/compute/simple-form.html), your clusters are automatically using `kind = CLASSIC_PREVIEW`.
-  "node_type_id":
-    "description": |-
-      This field encodes, through a single value, the resources available to each of
-      the Spark nodes in this cluster. For example, the Spark nodes can be provisioned
-      and optimized for memory or compute intensive workloads. A list of available node
-      types can be retrieved by using the :method:clusters/listNodeTypes API call.
-  "num_workers":
-    "description": |-
-      Number of worker nodes that this cluster should have. A cluster has one Spark Driver
-      and `num_workers` Executors for a total of `num_workers` + 1 Spark nodes.
-
-      Note: When reading the properties of a cluster, this field reflects the desired number
-      of workers rather than the actual current number of workers. For instance, if a cluster
-      is resized from 5 to 10 workers, this field will immediately be updated to reflect
-      the target size of 10 workers, whereas the workers listed in `spark_info` will gradually
-      increase from 5 to 10 as the new nodes are provisioned.
-  "policy_id":
-    "description": |-
-      The ID of the cluster policy used to create the cluster if applicable.
-  "remote_disk_throughput":
-    "description": |-
-      If set, what the configurable throughput (in Mb/s) for the remote disk is. Currently only supported for GCP HYPERDISK_BALANCED disks.
-  "runtime_engine":
-    "description": |-
-      Determines the cluster's runtime engine, either standard or Photon.
-
-      This field is not compatible with legacy `spark_version` values that contain `-photon-`.
-      Remove `-photon-` from the `spark_version` and set `runtime_engine` to `PHOTON`.
-
-      If left unspecified, the runtime engine defaults to standard unless the spark_version
-      contains -photon-, in which case Photon will be used.
-  "single_user_name":
-    "description": |-
-      Single user name if data_security_mode is `SINGLE_USER`
-  "spark_conf":
-    "description": |-
-      An object containing a set of optional, user-specified Spark configuration key-value pairs.
-      Users can also pass in a string of extra JVM options to the driver and the executors via
-      `spark.driver.extraJavaOptions` and `spark.executor.extraJavaOptions` respectively.
-  "spark_env_vars":
-    "description": |-
-      An object containing a set of optional, user-specified environment variable key-value pairs.
-      Please note that key-value pair of the form (X,Y) will be exported as is (i.e.,
-      `export X='Y'`) while launching the driver and workers.
-
-      In order to specify an additional set of `SPARK_DAEMON_JAVA_OPTS`, we recommend appending
-      them to `$SPARK_DAEMON_JAVA_OPTS` as shown in the example below. This ensures that all
-      default databricks managed environmental variables are included as well.
-
-      Example Spark environment variables:
-      `{"SPARK_WORKER_MEMORY": "28000m", "SPARK_LOCAL_DIRS": "/local_disk0"}` or
-      `{"SPARK_DAEMON_JAVA_OPTS": "$SPARK_DAEMON_JAVA_OPTS -Dspark.shuffle.service.enabled=true"}`
-  "spark_version":
-    "description": |-
-      The Spark version of the cluster, e.g. `3.3.x-scala2.11`.
-      A list of available Spark versions can be retrieved by using
-      the :method:clusters/sparkVersions API call.
-  "ssh_public_keys":
-    "description": |-
-      SSH public key contents that will be added to each Spark node in this cluster. The
-      corresponding private keys can be used to login with the user name `ubuntu` on port `2200`.
-      Up to 10 keys can be specified.
-  "total_initial_remote_disk_size":
-    "description": |-
-      If set, what the total initial volume size (in GB) of the remote disks should be. Currently only supported for GCP HYPERDISK_BALANCED disks.
-  "use_ml_runtime":
-    "description": |-
-      This field can only be used when `kind = CLASSIC_PREVIEW`.
-
-      `effective_spark_version` is determined by `spark_version` (DBR release), this field `use_ml_runtime`, and whether `node_type_id` is gpu node or not.
-  "worker_node_type_flexibility":
-    "description": |-
-      Flexible node type configuration for worker nodes.
-  "workload_type":
-    "description": |-
-      Cluster Attributes showing for clusters workload types.
-github.com/databricks/cli/bundle/config/resources.DatabaseCatalog:
-  "create_database_if_not_exists": {}
-  "database_instance_name":
-    "description": |-
-      The name of the DatabaseInstance housing the database.
-  "database_name":
-    "description": |-
-      The name of the database (in a instance) associated with the catalog.
-  "name":
-    "description": |-
-      The name of the catalog in UC.
-  "uid":
-    "x-databricks-field-behaviors_output_only": |-
-      true
-github.com/databricks/cli/bundle/config/resources.DatabaseInstance:
-  "_":
-    "description": |-
-      A DatabaseInstance represents a logical Postgres instance, comprised of both compute and storage.
-  "capacity":
-    "description": |-
-      The sku of the instance. Valid values are "CU_1", "CU_2", "CU_4", "CU_8".
-  "child_instance_refs":
-    "description": |-
-      The refs of the child instances. This is only available if the instance is
-      parent instance.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "creation_time":
-    "description": |-
-      The timestamp when the instance was created.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "creator":
-    "description": |-
-      The email of the creator of the instance.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "custom_tags":
-    "description": |-
-      Custom tags associated with the instance. This field is only included on create and update responses.
-  "effective_capacity":
-    "description": |-
-      Deprecated. The sku of the instance; this field will always match the value of capacity.
-      This is an output only field that contains the value computed from the input field combined with
-      server side defaults. Use the field without the effective_ prefix to set the value.
-    "deprecation_message": |-
-      This field is deprecated
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "effective_custom_tags":
-    "description": |-
-      The recorded custom tags associated with the instance.
-      This is an output only field that contains the value computed from the input field combined with
-      server side defaults. Use the field without the effective_ prefix to set the value.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "effective_enable_pg_native_login":
-    "description": |-
-      Whether the instance has PG native password login enabled.
-      This is an output only field that contains the value computed from the input field combined with
-      server side defaults. Use the field without the effective_ prefix to set the value.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "effective_enable_readable_secondaries":
-    "description": |-
-      Whether secondaries serving read-only traffic are enabled. Defaults to false.
-      This is an output only field that contains the value computed from the input field combined with
-      server side defaults. Use the field without the effective_ prefix to set the value.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "effective_node_count":
-    "description": |-
-      The number of nodes in the instance, composed of 1 primary and 0 or more secondaries. Defaults to
-      1 primary and 0 secondaries.
-      This is an output only field that contains the value computed from the input field combined with
-      server side defaults. Use the field without the effective_ prefix to set the value.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "effective_retention_window_in_days":
-    "description": |-
-      The retention window for the instance. This is the time window in days
-      for which the historical data is retained.
-      This is an output only field that contains the value computed from the input field combined with
-      server side defaults. Use the field without the effective_ prefix to set the value.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "effective_stopped":
-    "description": |-
-      Whether the instance is stopped.
-      This is an output only field that contains the value computed from the input field combined with
-      server side defaults. Use the field without the effective_ prefix to set the value.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "effective_usage_policy_id":
-    "description": |-
-      The policy that is applied to the instance.
-      This is an output only field that contains the value computed from the input field combined with
-      server side defaults. Use the field without the effective_ prefix to set the value.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "enable_pg_native_login":
-    "description": |-
-      Whether to enable PG native password login on the instance. Defaults to false.
-  "enable_readable_secondaries":
-    "description": |-
-      Whether to enable secondaries to serve read-only traffic. Defaults to false.
-  "name":
-    "description": |-
-      The name of the instance. This is the unique identifier for the instance.
-  "node_count":
-    "description": |-
-      The number of nodes in the instance, composed of 1 primary and 0 or more secondaries. Defaults to
-      1 primary and 0 secondaries. This field is input only, see effective_node_count for the output.
-  "parent_instance_ref":
-    "description": |-
-      The ref of the parent instance. This is only available if the instance is
-      child instance.
-      Input: For specifying the parent instance to create a child instance. Optional.
-      Output: Only populated if provided as input to create a child instance.
-  "pg_version":
-    "description": |-
-      The version of Postgres running on the instance.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "read_only_dns":
-    "description": |-
-      The DNS endpoint to connect to the instance for read only access. This is only available if
-      enable_readable_secondaries is true.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "read_write_dns":
-    "description": |-
-      The DNS endpoint to connect to the instance for read+write access.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "retention_window_in_days":
-    "description": |-
-      The retention window for the instance. This is the time window in days
-      for which the historical data is retained. The default value is 7 days.
-      Valid values are 2 to 35 days.
-  "state":
-    "description": |-
-      The current state of the instance.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "stopped":
-    "description": |-
-      Whether to stop the instance. An input only param, see effective_stopped for the output.
-  "uid":
-    "description": |-
-      An immutable UUID identifier for the instance.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "usage_policy_id":
-    "description": |-
-      The desired usage policy to associate with the instance.
-github.com/databricks/cli/bundle/config/resources.ExternalLocation:
-  "comment":
-    "description": |-
-      User-provided free-form text description.
-  "credential_name":
-    "description": |-
-      Name of the storage credential used with this location.
-  "effective_enable_file_events":
-    "description": |-
-      The effective value of `enable_file_events` after applying server-side defaults.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "effective_file_event_queue":
-    "description": |-
-      The effective file event queue configuration after applying server-side defaults.
-      Always populated when a queue is provisioned, regardless of whether the user explicitly
-      set `enable_file_events`. Use this field instead of `file_event_queue` for reading
-      the actual queue state.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "enable_file_events":
-    "description": |-
-      Whether to enable file events on this external location. Default to `true`. Set to `false` to disable file events.
-      The actual applied value may differ due to server-side defaults; check `effective_enable_file_events` for the effective state.
-  "encryption_details":
-    "description": |-
-      Encryption options that apply to clients connecting to cloud storage.
-  "fallback":
-    "description": |-
-      Indicates whether fallback mode is enabled for this external location. When fallback mode is enabled, the access to the location falls back to cluster credentials if UC credentials are not sufficient.
-  "file_event_queue":
-    "description": |-
-      File event queue settings. If `enable_file_events` is not `false`, must be defined and have exactly one of the documented properties.
-  "name":
-    "description": |-
-      Name of the external location.
-  "read_only":
-    "description": |-
-      Indicates whether the external location is read-only.
-  "skip_validation":
-    "description": |-
-      Skips validation of the storage credential associated with the external location.
-  "url":
-    "description": |-
-      Path URL of the external location.
-github.com/databricks/cli/bundle/config/resources.Job:
-  "budget_policy_id":
-    "description": |-
-      The id of the user specified budget policy to use for this job.
-      If not specified, a default budget policy may be applied when creating or modifying the job.
-      See `effective_budget_policy_id` for the budget policy used by this workload.
-  "continuous":
-    "description": |-
-      An optional continuous property for this job. The continuous property will ensure that there is always one run executing. Only one of `schedule` and `continuous` can be used.
-  "deployment":
-    "description": |-
-      Deployment information for jobs managed by external sources.
-  "description":
-    "description": |-
-      An optional description for the job. The maximum length is 27700 characters in UTF-8 encoding.
-  "edit_mode":
-    "description": |-
-      Edit mode of the job.
-
-      * `UI_LOCKED`: The job is in a locked UI state and cannot be modified.
-      * `EDITABLE`: The job is in an editable state and can be modified.
-  "email_notifications":
-    "description": |-
-      An optional set of email addresses that is notified when runs of this job begin or complete as well as when this job is deleted.
-  "environments":
-    "description": |-
-      A list of task execution environment specifications that can be referenced by serverless tasks of this job.
-      For serverless notebook tasks, if the environment_key is not specified, the notebook environment will be used if present. If a jobs environment is specified, it will override the notebook environment.
-      For other serverless tasks, the task environment is required to be specified using environment_key in the task settings.
-  "format":
-    "description": |-
-      Used to tell what is the format of the job. This field is ignored in Create/Update/Reset calls. When using the Jobs API 2.1 this value is always set to `"MULTI_TASK"`.
-    "deprecation_message": |-
-      This field is deprecated
-  "git_source":
-    "description": |-
-      An optional specification for a remote Git repository containing the source code used by tasks. Version-controlled source code is supported by notebook, dbt, Python script, and SQL File tasks.
-
-      If `git_source` is set, these tasks retrieve the file from the remote repository by default. However, this behavior can be overridden by setting `source` to `WORKSPACE` on the task.
-
-      Note: dbt and SQL File tasks support only version-controlled sources. If dbt or SQL File tasks are used, `git_source` must be defined on the job.
-  "health":
-    "description": |-
-      An optional set of health rules that can be defined for this job.
-  "job_clusters":
-    "description": |-
-      A list of job cluster specifications that can be shared and reused by tasks of this job. Libraries cannot be declared in a shared job cluster. You must declare dependent libraries in task settings.
-  "max_concurrent_runs":
-    "description": |-
-      An optional maximum allowed number of concurrent runs of the job.
-      Set this value if you want to be able to execute multiple runs of the same job concurrently.
-      This is useful for example if you trigger your job on a frequent schedule and want to allow consecutive runs to overlap with each other, or if you want to trigger multiple runs which differ by their input parameters.
-      This setting affects only new runs. For example, suppose the job’s concurrency is 4 and there are 4 concurrent active runs. Then setting the concurrency to 3 won’t kill any of the active runs.
-      However, from then on, new runs are skipped unless there are fewer than 3 active runs.
-      This value cannot exceed 1000. Setting this value to `0` causes all new runs to be skipped.
-  "name":
-    "description": |-
-      An optional name for the job. The maximum length is 4096 bytes in UTF-8 encoding.
-  "notification_settings":
-    "description": |-
-      Optional notification settings that are used when sending notifications to each of the `email_notifications` and `webhook_notifications` for this job.
-  "parameters":
-    "description": |-
-      Job-level parameter definitions
-  "performance_target":
-    "description": |-
-      The performance mode on a serverless job. This field determines the level of compute performance or cost-efficiency for the run.
-      The performance target does not apply to tasks that run on Serverless GPU compute.
-
-      * `STANDARD`: Enables cost-efficient execution of serverless workloads.
-      * `PERFORMANCE_OPTIMIZED`: Prioritizes fast startup and execution times through rapid scaling and optimized cluster performance.
-  "queue":
-    "description": |-
-      The queue settings of the job.
-  "run_as":
-    "description": |-
-      The user or service principal that the job runs as, if specified in the request.
-      This field indicates the explicit configuration of `run_as` for the job.
-      To find the value in all cases, explicit or implicit, use `run_as_user_name`.
-  "schedule":
-    "description": |-
-      An optional periodic schedule for this job. The default behavior is that the job only runs when triggered by clicking “Run Now” in the Jobs UI or sending an API request to `runNow`.
-  "tags":
-    "description": |-
-      A map of tags associated with the job. These are forwarded to the cluster as cluster tags for jobs clusters, and are subject to the same limitations as cluster tags. A maximum of 25 tags can be added to the job.
-  "tasks":
-    "description": |-
-      A list of task specifications to be executed by this job.
-      It supports up to 1000 elements in write endpoints (:method:jobs/create, :method:jobs/reset, :method:jobs/update, :method:jobs/submit).
-      Read endpoints return only 100 tasks. If more than 100 tasks are available, you can paginate through them using :method:jobs/get. Use the `next_page_token` field at the object root to determine if more results are available.
-  "timeout_seconds":
-    "description": |-
-      An optional timeout applied to each run of this job. A value of `0` means no timeout.
-  "trigger":
-    "description": |-
-      A configuration to trigger a run when certain conditions are met. The default behavior is that the job runs only when triggered by clicking “Run Now” in the Jobs UI or sending an API request to `runNow`.
-  "usage_policy_id":
-    "description": |-
-      The id of the user specified usage policy to use for this job.
-      If not specified, a default usage policy may be applied when creating or modifying the job.
-      See `effective_usage_policy_id` for the usage policy used by this workload.
-    "x-databricks-preview": |-
-      PRIVATE
-  "webhook_notifications":
-    "description": |-
-      A collection of system notification IDs to notify when runs of this job begin or complete.
-github.com/databricks/cli/bundle/config/resources.MlflowExperiment:
-  "artifact_location":
-    "description": |-
-      Location where all artifacts for the experiment are stored.
-      If not provided, the remote server will select an appropriate default.
-  "name":
-    "description": |-
-      Experiment name.
-  "tags":
-    "description": |-
-      A collection of tags to set on the experiment. Maximum tag size and number of tags per request
-      depends on the storage backend. All storage backends are guaranteed to support tag keys up
-      to 250 bytes in size and tag values up to 5000 bytes in size. All storage backends are also
-      guaranteed to support up to 20 tags per request.
-github.com/databricks/cli/bundle/config/resources.MlflowModel:
-  "description":
-    "description": |-
-      Optional description for registered model.
-  "name":
-    "description": |-
-      Register models under this name
-  "tags":
-    "description": |-
-      Additional metadata for registered model.
-github.com/databricks/cli/bundle/config/resources.ModelServingEndpoint:
-  "ai_gateway":
-    "description": |-
-      The AI Gateway configuration for the serving endpoint. NOTE: External model, provisioned throughput, and pay-per-token endpoints are fully supported; agent endpoints currently only support inference tables.
-  "budget_policy_id":
-    "description": |-
-      The budget policy to be applied to the serving endpoint.
-  "config":
-    "description": |-
-      The core config of the serving endpoint.
-  "description": {}
-  "email_notifications":
-    "description": |-
-      Email notification settings.
-  "name":
-    "description": |-
-      The name of the serving endpoint. This field is required and must be unique across a Databricks workspace.
-      An endpoint name can consist of alphanumeric characters, dashes, and underscores.
-  "rate_limits":
-    "description": |-
-      Rate limits to be applied to the serving endpoint. NOTE: this field is deprecated, please use AI Gateway to manage rate limits.
-    "deprecation_message": |-
-      This field is deprecated
-  "route_optimized":
-    "description": |-
-      Enable route optimization for the serving endpoint.
-  "tags":
-    "description": |-
-      Tags to be attached to the serving endpoint and automatically propagated to billing logs.
-github.com/databricks/cli/bundle/config/resources.Pipeline:
-  "allow_duplicate_names":
-    "description": |-
-      If false, deployment will fail if name conflicts with that of another pipeline.
-  "budget_policy_id":
-    "description": |-
-      Budget policy of this pipeline.
-  "catalog":
-    "description": |-
-      A catalog in Unity Catalog to publish data from this pipeline to. If `target` is specified, tables in this pipeline are published to a `target` schema inside `catalog` (for example, `catalog`.`target`.`table`). If `target` is not specified, no data is published to Unity Catalog.
-  "channel":
-    "description": |-
-      DLT Release Channel that specifies which version to use.
-  "clusters":
-    "description": |-
-      Cluster settings for this pipeline deployment.
-  "configuration":
-    "description": |-
-      String-String configuration for this pipeline execution.
-  "continuous":
-    "description": |-
-      Whether the pipeline is continuous or triggered. This replaces `trigger`.
-  "deployment":
-    "description": |-
-      Deployment type of this pipeline.
-  "development":
-    "description": |-
-      Whether the pipeline is in Development mode. Defaults to false.
-  "dry_run": {}
-  "edition":
-    "description": |-
-      Pipeline product edition.
-  "environment":
-    "description": |-
-      Environment specification for this pipeline used to install dependencies.
-  "event_log":
-    "description": |-
-      Event log configuration for this pipeline
-  "filters":
-    "description": |-
-      Filters on which Pipeline packages to include in the deployed graph.
-  "gateway_definition":
-    "description": |-
-      The definition of a gateway pipeline to support change data capture.
-    "x-databricks-preview": |-
-      PRIVATE
-  "id":
-    "description": |-
-      Unique identifier for this pipeline.
-  "ingestion_definition":
-    "description": |-
-      The configuration for a managed ingestion pipeline. These settings cannot be used with the 'libraries', 'schema', 'target', or 'catalog' settings.
-  "libraries":
-    "description": |-
-      Libraries or code needed by this deployment.
-  "name":
-    "description": |-
-      Friendly identifier for this pipeline.
-  "notifications":
-    "description": |-
-      List of notification settings for this pipeline.
-  "photon":
-    "description": |-
-      Whether Photon is enabled for this pipeline.
-  "restart_window":
-    "description": |-
-      Restart window of this pipeline.
-    "x-databricks-preview": |-
-      PRIVATE
-  "root_path":
-    "description": |-
-      Root path for this pipeline.
-      This is used as the root directory when editing the pipeline in the Databricks user interface and it is
-      added to sys.path when executing Python sources during pipeline execution.
-  "run_as":
-    "description": |-
-      Write-only setting, available only in Create/Update calls. Specifies the user or service principal that the pipeline runs as. If not specified, the pipeline runs as the user who created the pipeline.
-
-      Only `user_name` or `service_principal_name` can be specified. If both are specified, an error is thrown.
-  "schema":
-    "description": |-
-      The default schema (database) where tables are read from or published to.
-  "serverless":
-    "description": |-
-      Whether serverless compute is enabled for this pipeline.
-  "storage":
-    "description": |-
-      DBFS root directory for storing checkpoints and tables.
-  "tags":
-    "description": |-
-      A map of tags associated with the pipeline.
-      These are forwarded to the cluster as cluster tags, and are therefore subject to the same limitations.
-      A maximum of 25 tags can be added to the pipeline.
-  "target":
-    "description": |-
-      Target schema (database) to add tables in this pipeline to. Exactly one of `schema` or `target` must be specified. To publish to Unity Catalog, also specify `catalog`. This legacy field is deprecated for pipeline creation in favor of the `schema` field.
-    "deprecation_message": |-
-      This field is deprecated
-  "trigger":
-    "description": |-
-      Which pipeline trigger to use. Deprecated: Use `continuous` instead.
-    "deprecation_message": |-
-      This field is deprecated
-  "usage_policy_id":
-    "description": |-
-      Usage policy of this pipeline.
-    "x-databricks-preview": |-
-      PRIVATE
-github.com/databricks/cli/bundle/config/resources.QualityMonitor:
-  "assets_dir":
-    "description": |-
-      [Create:REQ Update:IGN] Field for specifying the absolute path to a custom directory to store data-monitoring
-      assets. Normally prepopulated to a default user location via UI and Python APIs.
-  "baseline_table_name":
-    "description": |-
-      [Create:OPT Update:OPT] Baseline table name.
-      Baseline data is used to compute drift from the data in the monitored `table_name`.
-      The baseline table and the monitored table shall have the same schema.
-  "custom_metrics":
-    "description": |-
-      [Create:OPT Update:OPT] Custom metrics.
-  "data_classification_config":
-    "description": |-
-      [Create:OPT Update:OPT] Data classification related config.
-    "x-databricks-preview": |-
-      PRIVATE
-  "inference_log": {}
-  "latest_monitor_failure_msg":
-    "description": |-
-      [Create:ERR Update:IGN] The latest error message for a monitor failure.
-  "notifications":
-    "description": |-
-      [Create:OPT Update:OPT] Field for specifying notification settings.
-  "output_schema_name":
-    "description": |-
-      [Create:REQ Update:REQ] Schema where output tables are created. Needs to be in 2-level format {catalog}.{schema}
-  "schedule":
-    "description": |-
-      [Create:OPT Update:OPT] The monitor schedule.
-  "skip_builtin_dashboard":
-    "description": |-
-      Whether to skip creating a default dashboard summarizing data quality metrics.
-  "slicing_exprs":
-    "description": |-
-      [Create:OPT Update:OPT] List of column expressions to slice data with for targeted analysis. The data is grouped by
-      each expression independently, resulting in a separate slice for each predicate and its
-      complements. For example `slicing_exprs=[“col_1”, “col_2 > 10”]` will generate the following
-      slices: two slices for `col_2 > 10` (True and False), and one slice per unique value in
-      `col1`. For high-cardinality columns, only the top 100 unique values by frequency will
-      generate slices.
-  "snapshot":
-    "description": |-
-      Configuration for monitoring snapshot tables.
-  "time_series":
-    "description": |-
-      Configuration for monitoring time series tables.
-  "warehouse_id":
-    "description": |-
-      Optional argument to specify the warehouse for dashboard creation. If not specified, the first running
-      warehouse will be used.
-github.com/databricks/cli/bundle/config/resources.RegisteredModel:
-  "aliases":
-    "description": |-
-      List of aliases associated with the registered model
-  "browse_only":
-    "description": |-
-      Indicates whether the principal is limited to retrieving metadata for the associated object through the BROWSE privilege when include_browse is enabled in the request.
-  "catalog_name":
-    "description": |-
-      The name of the catalog where the schema and the registered model reside
-  "comment":
-    "description": |-
-      The comment attached to the registered model
-  "created_at":
-    "description": |-
-      Creation timestamp of the registered model in milliseconds since the Unix epoch
-  "created_by":
-    "description": |-
-      The identifier of the user who created the registered model
-  "full_name":
-    "description": |-
-      The three-level (fully qualified) name of the registered model
-  "metastore_id":
-    "description": |-
-      The unique identifier of the metastore
-  "name":
-    "description": |-
-      The name of the registered model
-  "owner":
-    "description": |-
-      The identifier of the user who owns the registered model
-  "schema_name":
-    "description": |-
-      The name of the schema where the registered model resides
-  "storage_location":
-    "description": |-
-      The storage location on the cloud under which model version data files are stored
-  "updated_at":
-    "description": |-
-      Last-update timestamp of the registered model in milliseconds since the Unix epoch
-  "updated_by":
-    "description": |-
-      The identifier of the user who updated the registered model last time
-github.com/databricks/cli/bundle/config/resources.Schema:
-  "catalog_name":
-    "description": |-
-      Name of parent catalog.
-  "comment":
-    "description": |-
-      User-provided free-form text description.
-  "name":
-    "description": |-
-      Name of schema, relative to parent catalog.
-  "properties":
-    "description": |-
-      A map of key-value properties attached to the securable.
-  "storage_root":
-    "description": |-
-      Storage root URL for managed tables within schema.
-github.com/databricks/cli/bundle/config/resources.SqlWarehouse:
-  "_":
-    "description": |-
-      Creates a new SQL warehouse.
-  "auto_stop_mins":
-    "description": |-
-      The amount of time in minutes that a SQL warehouse must be idle (i.e., no
-      RUNNING queries) before it is automatically stopped.
-
-      Supported values:
-      - Must be == 0 or >= 10 mins
-      - 0 indicates no autostop.
-
-      Defaults to 120 mins
-  "channel":
-    "description": |-
-      Channel Details
-  "cluster_size":
-    "description": |-
-      Size of the clusters allocated for this warehouse.
-      Increasing the size of a spark cluster allows you to run larger queries on
-      it. If you want to increase the number of concurrent queries, please tune
-      max_num_clusters.
-
-      Supported values:
-      - 2X-Small
-      - X-Small
-      - Small
-      - Medium
-      - Large
-      - X-Large
-      - 2X-Large
-      - 3X-Large
-      - 4X-Large
-      - 5X-Large
-  "creator_name":
-    "description": |-
-      warehouse creator name
-  "enable_photon":
-    "description": |-
-      Configures whether the warehouse should use Photon optimized clusters.
-
-      Defaults to true.
-  "enable_serverless_compute":
-    "description": |-
-      Configures whether the warehouse should use serverless compute
-  "instance_profile_arn":
-    "description": |-
-      Deprecated. Instance profile used to pass IAM role to the cluster
-    "deprecation_message": |-
-      This field is deprecated
-  "max_num_clusters":
-    "description": |-
-      Maximum number of clusters that the autoscaler will create to handle
-      concurrent queries.
-
-      Supported values:
-      - Must be >= min_num_clusters
-      - Must be <= 40.
-
-      Defaults to min_clusters if unset.
-  "min_num_clusters":
-    "description": |-
-      Minimum number of available clusters that will be maintained for this SQL
-      warehouse. Increasing this will ensure that a larger number of clusters are
-      always running and therefore may reduce the cold start time for new
-      queries. This is similar to reserved vs. revocable cores in a resource
-      manager.
-
-      Supported values:
-      - Must be > 0
-      - Must be <= min(max_num_clusters, 30)
-
-      Defaults to 1
-  "name":
-    "description": |-
-      Logical name for the cluster.
-
-      Supported values:
-      - Must be unique within an org.
-      - Must be less than 100 characters.
-  "spot_instance_policy":
-    "description": |-
-      Configurations whether the endpoint should use spot instances.
-  "tags":
-    "description": |-
-      A set of key-value pairs that will be tagged on all resources (e.g., AWS instances and EBS volumes) associated
-      with this SQL warehouse.
-
-      Supported values:
-      - Number of tags < 45.
-  "warehouse_type":
-    "description": |-
-      Warehouse type: `PRO` or `CLASSIC`. If you want to use serverless compute,
-      you must set to `PRO` and also set the field `enable_serverless_compute` to `true`.
-github.com/databricks/cli/bundle/config/resources.SyncedDatabaseTable:
-  "data_synchronization_status":
-    "description": |-
-      Synced Table data synchronization status
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "database_instance_name":
-    "description": |-
-      Name of the target database instance. This is required when creating synced database tables in standard catalogs.
-      This is optional when creating synced database tables in registered catalogs. If this field is specified
-      when creating synced database tables in registered catalogs, the database instance name MUST
-      match that of the registered catalog (or the request will be rejected).
-  "effective_database_instance_name":
-    "description": |-
-      The name of the database instance that this table is registered to. This field is always returned, and for
-      tables inside database catalogs is inferred database instance associated with the catalog.
-      This is an output only field that contains the value computed from the input field combined with
-      server side defaults. Use the field without the effective_ prefix to set the value.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "effective_logical_database_name":
-    "description": |-
-      The name of the logical database that this table is registered to.
-      This is an output only field that contains the value computed from the input field combined with
-      server side defaults. Use the field without the effective_ prefix to set the value.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "logical_database_name":
-    "description": |-
-      Target Postgres database object (logical database) name for this table.
-
-      When creating a synced table in a registered Postgres catalog, the
-      target Postgres database name is inferred to be that of the registered catalog.
-      If this field is specified in this scenario, the Postgres database name MUST
-      match that of the registered catalog (or the request will be rejected).
-
-      When creating a synced table in a standard catalog, this field is required.
-      In this scenario, specifying this field will allow targeting an arbitrary postgres database.
-      Note that this has implications for the `create_database_objects_is_missing` field in `spec`.
-  "name":
-    "description": |-
-      Full three-part (catalog, schema, table) name of the table.
-  "spec":
-    "description": |-
-      Specification of a synced database table.
-  "unity_catalog_provisioning_state":
-    "description": |-
-      The provisioning state of the synced table entity in Unity Catalog. This is distinct from the
-      state of the data synchronization pipeline (i.e. the table may be in "ACTIVE" but the pipeline
-      may be in "PROVISIONING" as it runs asynchronously).
-    "x-databricks-field-behaviors_output_only": |-
-      true
-github.com/databricks/cli/bundle/config/resources.VectorSearchEndpoint:
-  "budget_policy_id":
-    "description": |-
-      The budget policy id to be applied
-  "endpoint_type":
-    "description": |-
-      Type of endpoint
-  "min_qps":
-    "description": |-
-      Min QPS for the endpoint. Mutually exclusive with num_replicas.
-      The actual replica count is calculated at index creation/sync time based on this value.
-  "name":
-    "description": |-
-      Name of the vector search endpoint
-  "usage_policy_id":
-    "description": |-
-      The usage policy id to be applied once we've migrated to usage policies
-    "x-databricks-preview": |-
-      PRIVATE
-github.com/databricks/cli/bundle/config/resources.Volume:
-  "catalog_name":
-    "description": |-
-      The name of the catalog where the schema and the volume are
-  "comment":
-    "description": |-
-      The comment attached to the volume
-  "name":
-    "description": |-
-      The name of the volume
-  "schema_name":
-    "description": |-
-      The name of the schema where the volume is
-  "storage_location":
-    "description": |-
-      The storage location on the cloud
-  "volume_type":
-    "description": |-
-      The type of the volume. An external volume is located in the specified external location.
-      A managed volume is located in the default location which is specified by the parent schema, or the parent catalog, or the Metastore.
-      [Learn more](https://docs.databricks.com/aws/en/volumes/managed-vs-external)
-github.com/databricks/databricks-sdk-go/service/apps.AppDeployment:
-  "command":
-    "description": |-
-      The command with which to run the app. This will override the command specified in the app.yaml file.
-  "create_time":
-    "description": |-
-      The creation time of the deployment. Formatted timestamp in ISO 6801.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "creator":
-    "description": |-
-      The email of the user creates the deployment.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "deployment_artifacts":
-    "description": |-
-      The deployment artifacts for an app.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "deployment_id":
-    "description": |-
-      The unique id of the deployment.
-  "env_vars":
-    "description": |-
-      The environment variables to set in the app runtime environment. This will override the environment variables specified in the app.yaml file.
-  "git_source":
-    "description": |-
-      Git repository to use as the source for the app deployment.
-    "x-databricks-preview": |-
-      PRIVATE
-  "mode":
-    "description": |-
-      The mode of which the deployment will manage the source code.
-  "source_code_path":
-    "description": |-
-      The workspace file system path of the source code used to create the app deployment. This is different from
-      `deployment_artifacts.source_code_path`, which is the path used by the deployed app. The former refers
-      to the original source code location of the app in the workspace during deployment creation, whereas
-      the latter provides a system generated stable snapshotted source code path used by the deployment.
-  "status":
-    "description": |-
-      Status and status message of the deployment
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "update_time":
-    "description": |-
-      The update time of the deployment. Formatted timestamp in ISO 6801.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-github.com/databricks/databricks-sdk-go/service/apps.AppDeploymentArtifacts:
-  "source_code_path":
-    "description": |-
-      The snapshotted workspace file system path of the source code loaded by the deployed app.
-github.com/databricks/databricks-sdk-go/service/apps.AppDeploymentMode:
-  "_":
-    "enum":
-      - |-
-        SNAPSHOT
-      - |-
-        AUTO_SYNC
-github.com/databricks/databricks-sdk-go/service/apps.AppDeploymentState:
-  "_":
-    "enum":
-      - |-
-        SUCCEEDED
-      - |-
-        FAILED
-      - |-
-        IN_PROGRESS
-      - |-
-        CANCELLED
-github.com/databricks/databricks-sdk-go/service/apps.AppDeploymentStatus:
-  "message":
-    "description": |-
-      Message corresponding with the deployment state.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "state":
-    "description": |-
-      State of the deployment.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-github.com/databricks/databricks-sdk-go/service/apps.AppPermissionLevel:
-  "_":
-    "description": |-
-      Permission level
-    "enum":
-      - |-
-        CAN_MANAGE
-      - |-
-        CAN_USE
-github.com/databricks/databricks-sdk-go/service/apps.AppResource:
-  "app": {}
-  "database": {}
-  "description":
-    "description": |-
-      Description of the App Resource.
-  "experiment": {}
-  "genie_space": {}
-  "job": {}
-  "name":
-    "description": |-
-      Name of the App Resource.
-  "postgres": {}
-  "secret": {}
-  "serving_endpoint": {}
-  "sql_warehouse": {}
-  "uc_securable": {}
-github.com/databricks/databricks-sdk-go/service/apps.AppResourceApp:
-  "name": {}
-  "permission": {}
-github.com/databricks/databricks-sdk-go/service/apps.AppResourceAppAppPermission:
-  "_":
-    "enum":
-      - |-
-        CAN_USE
-github.com/databricks/databricks-sdk-go/service/apps.AppResourceDatabase:
-  "database_name": {}
-  "instance_name": {}
-  "permission": {}
-github.com/databricks/databricks-sdk-go/service/apps.AppResourceDatabaseDatabasePermission:
-  "_":
-    "enum":
-      - |-
-        CAN_CONNECT_AND_CREATE
-github.com/databricks/databricks-sdk-go/service/apps.AppResourceExperiment:
-  "experiment_id": {}
-  "permission": {}
-github.com/databricks/databricks-sdk-go/service/apps.AppResourceExperimentExperimentPermission:
-  "_":
-    "enum":
-      - |-
-        CAN_MANAGE
-      - |-
-        CAN_EDIT
-      - |-
-        CAN_READ
-github.com/databricks/databricks-sdk-go/service/apps.AppResourceGenieSpace:
-  "name": {}
-  "permission": {}
-  "space_id": {}
-github.com/databricks/databricks-sdk-go/service/apps.AppResourceGenieSpaceGenieSpacePermission:
-  "_":
-    "enum":
-      - |-
-        CAN_MANAGE
-      - |-
-        CAN_EDIT
-      - |-
-        CAN_RUN
-      - |-
-        CAN_VIEW
-github.com/databricks/databricks-sdk-go/service/apps.AppResourceJob:
-  "id":
-    "description": |-
-      Id of the job to grant permission on.
-  "permission":
-    "description": |-
-      Permissions to grant on the Job. Supported permissions are: "CAN_MANAGE", "IS_OWNER", "CAN_MANAGE_RUN", "CAN_VIEW".
-github.com/databricks/databricks-sdk-go/service/apps.AppResourceJobJobPermission:
-  "_":
-    "enum":
-      - |-
-        CAN_MANAGE
-      - |-
-        IS_OWNER
-      - |-
-        CAN_MANAGE_RUN
-      - |-
-        CAN_VIEW
-github.com/databricks/databricks-sdk-go/service/apps.AppResourcePostgres:
-  "branch": {}
-  "database": {}
-  "permission": {}
-github.com/databricks/databricks-sdk-go/service/apps.AppResourcePostgresPostgresPermission:
-  "_":
-    "enum":
-      - |-
-        CAN_CONNECT_AND_CREATE
-github.com/databricks/databricks-sdk-go/service/apps.AppResourceSecret:
-  "key":
-    "description": |-
-      Key of the secret to grant permission on.
-  "permission":
-    "description": |-
-      Permission to grant on the secret scope. For secrets, only one permission is allowed. Permission must be one of: "READ", "WRITE", "MANAGE".
-  "scope":
-    "description": |-
-      Scope of the secret to grant permission on.
-github.com/databricks/databricks-sdk-go/service/apps.AppResourceSecretSecretPermission:
-  "_":
-    "description": |-
-      Permission to grant on the secret scope. Supported permissions are: "READ", "WRITE", "MANAGE".
-    "enum":
-      - |-
-        READ
-      - |-
-        WRITE
-      - |-
-        MANAGE
-github.com/databricks/databricks-sdk-go/service/apps.AppResourceServingEndpoint:
-  "name":
-    "description": |-
-      Name of the serving endpoint to grant permission on.
-  "permission":
-    "description": |-
-      Permission to grant on the serving endpoint. Supported permissions are: "CAN_MANAGE", "CAN_QUERY", "CAN_VIEW".
-github.com/databricks/databricks-sdk-go/service/apps.AppResourceServingEndpointServingEndpointPermission:
-  "_":
-    "enum":
-      - |-
-        CAN_MANAGE
-      - |-
-        CAN_QUERY
-      - |-
-        CAN_VIEW
-github.com/databricks/databricks-sdk-go/service/apps.AppResourceSqlWarehouse:
-  "id":
-    "description": |-
-      Id of the SQL warehouse to grant permission on.
-  "permission":
-    "description": |-
-      Permission to grant on the SQL warehouse. Supported permissions are: "CAN_MANAGE", "CAN_USE", "IS_OWNER".
-github.com/databricks/databricks-sdk-go/service/apps.AppResourceSqlWarehouseSqlWarehousePermission:
-  "_":
-    "enum":
-      - |-
-        CAN_MANAGE
-      - |-
-        CAN_USE
-      - |-
-        IS_OWNER
-github.com/databricks/databricks-sdk-go/service/apps.AppResourceUcSecurable:
-  "permission": {}
-  "securable_full_name": {}
-  "securable_kind":
-    "description": |-
-      The securable kind from Unity Catalog.
-      See https://docs.databricks.com/api/workspace/tables/get#securable_kind_manifest-securable_kind.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "securable_type": {}
-github.com/databricks/databricks-sdk-go/service/apps.AppResourceUcSecurableUcSecurablePermission:
-  "_":
-    "enum":
-      - |-
-        READ_VOLUME
-      - |-
-        WRITE_VOLUME
-      - |-
-        SELECT
-      - |-
-        EXECUTE
-      - |-
-        USE_CONNECTION
-      - |-
-        MODIFY
-github.com/databricks/databricks-sdk-go/service/apps.AppResourceUcSecurableUcSecurableType:
-  "_":
-    "enum":
-      - |-
-        VOLUME
-      - |-
-        TABLE
-      - |-
-        FUNCTION
-      - |-
-        CONNECTION
-github.com/databricks/databricks-sdk-go/service/apps.ApplicationState:
-  "_":
-    "enum":
-      - |-
-        DEPLOYING
-      - |-
-        RUNNING
-      - |-
-        CRASHED
-      - |-
-        UNAVAILABLE
-github.com/databricks/databricks-sdk-go/service/apps.ApplicationStatus:
-  "message":
-    "description": |-
-      Application status message
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "state":
-    "description": |-
-      State of the application.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-github.com/databricks/databricks-sdk-go/service/apps.ComputeSize:
-  "_":
-    "enum":
-      - |-
-        MEDIUM
-      - |-
-        LARGE
-github.com/databricks/databricks-sdk-go/service/apps.ComputeState:
-  "_":
-    "enum":
-      - |-
-        ERROR
-      - |-
-        DELETING
-      - |-
-        STARTING
-      - |-
-        STOPPING
-      - |-
-        UPDATING
-      - |-
-        STOPPED
-      - |-
-        ACTIVE
-github.com/databricks/databricks-sdk-go/service/apps.ComputeStatus:
-  "active_instances":
-    "description": |-
-      The number of compute instances currently serving requests for this
-      application. An instance is considered active if it is reachable and ready
-      to handle requests.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-    "x-databricks-preview": |-
-      PRIVATE
-  "message":
-    "description": |-
-      Compute status message
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "state":
-    "description": |-
-      State of the app compute.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-github.com/databricks/databricks-sdk-go/service/apps.EnvVar:
-  "name":
-    "description": |-
-      The name of the environment variable.
-  "value":
-    "description": |-
-      The value for the environment variable.
-  "value_from":
-    "description": |-
-      The name of an external Databricks resource that contains the value, such as a secret or a database table.
-github.com/databricks/databricks-sdk-go/service/apps.GitRepository:
-  "_":
-    "description": |-
-      Git repository configuration specifying the location of the repository.
-  "provider":
-    "description": |-
-      Git provider. Case insensitive. Supported values: gitHub, gitHubEnterprise, bitbucketCloud,
-      bitbucketServer, azureDevOpsServices, gitLab, gitLabEnterpriseEdition, awsCodeCommit.
-  "url":
-    "description": |-
-      URL of the Git repository.
-github.com/databricks/databricks-sdk-go/service/apps.GitSource:
-  "_":
-    "description": |-
-      Complete git source specification including repository location and reference.
-  "branch":
-    "description": |-
-      Git branch to checkout.
-  "commit":
-    "description": |-
-      Git commit SHA to checkout.
-  "git_repository":
-    "description": |-
-      Git repository configuration. Populated from the app's git_repository configuration.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "resolved_commit":
-    "description": |-
-      The resolved commit SHA that was actually used for the deployment. This is populated by the
-      system after resolving the reference (branch, tag, or commit). If commit is specified
-      directly, this will match commit. If a branch or tag is specified, this contains the
-      commit SHA that the branch or tag pointed to at deployment time.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-    "x-databricks-preview": |-
-      PRIVATE
-  "source_code_path":
-    "description": |-
-      Relative path to the app source code within the Git repository. If not specified, the root
-      of the repository is used.
-  "tag":
-    "description": |-
-      Git tag to checkout.
-github.com/databricks/databricks-sdk-go/service/apps.TelemetryExportDestination:
-  "_":
-    "description": |-
-      A single telemetry export destination with its configuration and status.
-  "unity_catalog":
-    "description": |-
-      Unity Catalog Destinations for OTEL telemetry export.
-github.com/databricks/databricks-sdk-go/service/apps.UnityCatalog:
-  "_":
-    "description": |-
-      Unity Catalog Destinations for OTEL telemetry export.
-  "logs_table":
-    "description": |-
-      Unity Catalog table for OTEL logs.
-  "metrics_table":
-    "description": |-
-      Unity Catalog table for OTEL metrics.
-  "traces_table":
-    "description": |-
-      Unity Catalog table for OTEL traces (spans).
-github.com/databricks/databricks-sdk-go/service/catalog.AwsSqsQueue:
-  "managed_resource_id":
-    "description": |-
-      Unique identifier included in the name of file events managed cloud resources.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "queue_url":
-    "description": |-
-      The AQS queue url in the format https://sqs.{region}.amazonaws.com/{account id}/{queue name}.
-      Only required for provided_sqs.
-github.com/databricks/databricks-sdk-go/service/catalog.AzureEncryptionSettings:
-  "azure_cmk_access_connector_id": {}
-  "azure_cmk_managed_identity_id": {}
-  "azure_tenant_id": {}
-github.com/databricks/databricks-sdk-go/service/catalog.AzureQueueStorage:
-  "managed_resource_id":
-    "description": |-
-      Unique identifier included in the name of file events managed cloud resources.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "queue_url":
-    "description": |-
-      The AQS queue url in the format https://{storage account}.queue.core.windows.net/{queue name}
-      Only required for provided_aqs.
-  "resource_group":
-    "description": |-
-      Optional resource group for the queue, event grid subscription, and external location storage
-      account.
-      Only required for locations with a service principal storage credential
-  "subscription_id":
-    "description": |-
-      Optional subscription id for the queue, event grid subscription, and external location storage
-      account.
-      Required for locations with a service principal storage credential
-github.com/databricks/databricks-sdk-go/service/catalog.EncryptionDetails:
-  "_":
-    "description": |-
-      Encryption options that apply to clients connecting to cloud storage.
-  "sse_encryption_details":
-    "description": |-
-      Server-Side Encryption properties for clients communicating with AWS s3.
-github.com/databricks/databricks-sdk-go/service/catalog.EncryptionSettings:
-  "_":
-    "description": |-
-      Encryption Settings are used to carry metadata for securable encryption at rest.
-      Currently used for catalogs, we can use the information supplied here to interact with a CMK.
-  "azure_encryption_settings":
-    "description": |-
-      optional Azure settings - only required if an Azure CMK is used.
-  "azure_key_vault_key_id":
-    "description": |-
-      the AKV URL in Azure, null otherwise.
-  "customer_managed_key_id":
-    "description": |-
-      the CMK uuid in AWS and GCP, null otherwise.
-github.com/databricks/databricks-sdk-go/service/catalog.FileEventQueue:
-  "managed_aqs": {}
-  "managed_pubsub": {}
-  "managed_sqs": {}
-  "provided_aqs": {}
-  "provided_pubsub": {}
-  "provided_sqs": {}
-github.com/databricks/databricks-sdk-go/service/catalog.GcpPubsub:
-  "managed_resource_id":
-    "description": |-
-      Unique identifier included in the name of file events managed cloud resources.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "subscription_name":
-    "description": |-
-      The Pub/Sub subscription name in the format projects/{project}/subscriptions/{subscription name}.
-      Only required for provided_pubsub.
-github.com/databricks/databricks-sdk-go/service/catalog.MonitorCronSchedule:
-  "pause_status":
-    "description": |-
-      Read only field that indicates whether a schedule is paused or not.
-  "quartz_cron_expression":
-    "description": |-
-      The expression that determines when to run the monitor. See [examples](https://www.quartz-scheduler.org/documentation/quartz-2.3.0/tutorials/crontrigger.html).
-  "timezone_id":
-    "description": |-
-      The timezone id (e.g., ``PST``) in which to evaluate the quartz expression.
-github.com/databricks/databricks-sdk-go/service/catalog.MonitorCronSchedulePauseStatus:
-  "_":
-    "description": |-
-      Source link: https://src.dev.databricks.com/databricks/universe/-/blob/elastic-spark-common/api/messages/schedule.proto
-      Monitoring workflow schedule pause status.
-    "enum":
-      - |-
-        UNSPECIFIED
-      - |-
-        UNPAUSED
-      - |-
-        PAUSED
-github.com/databricks/databricks-sdk-go/service/catalog.MonitorDataClassificationConfig:
-  "_":
-    "description": |-
-      Data classification related configuration.
-  "enabled":
-    "description": |-
-      Whether to enable data classification.
-github.com/databricks/databricks-sdk-go/service/catalog.MonitorDestination:
-  "email_addresses":
-    "description": |-
-      The list of email addresses to send the notification to. A maximum of 5 email addresses is supported.
-github.com/databricks/databricks-sdk-go/service/catalog.MonitorInferenceLog:
-  "granularities":
-    "description": |-
-      List of granularities to use when aggregating data into time windows based on their timestamp.
-  "label_col":
-    "description": |-
-      Column for the label.
-  "model_id_col":
-    "description": |-
-      Column for the model identifier.
-  "prediction_col":
-    "description": |-
-      Column for the prediction.
-  "prediction_proba_col":
-    "description": |-
-      Column for prediction probabilities
-  "problem_type":
-    "description": |-
-      Problem type the model aims to solve.
-  "timestamp_col":
-    "description": |-
-      Column for the timestamp.
-github.com/databricks/databricks-sdk-go/service/catalog.MonitorInferenceLogProblemType:
-  "_":
-    "enum":
-      - |-
-        PROBLEM_TYPE_CLASSIFICATION
-      - |-
-        PROBLEM_TYPE_REGRESSION
-github.com/databricks/databricks-sdk-go/service/catalog.MonitorMetric:
-  "_":
-    "description": |-
-      Custom metric definition.
-  "definition":
-    "description": |-
-      Jinja template for a SQL expression that specifies how to compute the metric. See [create metric definition](https://docs.databricks.com/en/lakehouse-monitoring/custom-metrics.html#create-definition).
-  "input_columns":
-    "description": |-
-      A list of column names in the input table the metric should be computed for.
-      Can use ``":table"`` to indicate that the metric needs information from multiple columns.
-  "name":
-    "description": |-
-      Name of the metric in the output tables.
-  "output_data_type":
-    "description": |-
-      The output type of the custom metric.
-  "type":
-    "description": |-
-      Can only be one of ``"CUSTOM_METRIC_TYPE_AGGREGATE"``, ``"CUSTOM_METRIC_TYPE_DERIVED"``, or ``"CUSTOM_METRIC_TYPE_DRIFT"``.
-      The ``"CUSTOM_METRIC_TYPE_AGGREGATE"`` and ``"CUSTOM_METRIC_TYPE_DERIVED"`` metrics
-      are computed on a single table, whereas the ``"CUSTOM_METRIC_TYPE_DRIFT"`` compare metrics across
-      baseline and input table, or across the two consecutive time windows.
-      - CUSTOM_METRIC_TYPE_AGGREGATE: only depend on the existing columns in your table
-      - CUSTOM_METRIC_TYPE_DERIVED: depend on previously computed aggregate metrics
-      - CUSTOM_METRIC_TYPE_DRIFT:  depend on previously computed aggregate or derived metrics
-github.com/databricks/databricks-sdk-go/service/catalog.MonitorMetricType:
-  "_":
-    "description": |-
-      Can only be one of ``\"CUSTOM_METRIC_TYPE_AGGREGATE\"``, ``\"CUSTOM_METRIC_TYPE_DERIVED\"``, or ``\"CUSTOM_METRIC_TYPE_DRIFT\"``.
-      The ``\"CUSTOM_METRIC_TYPE_AGGREGATE\"`` and ``\"CUSTOM_METRIC_TYPE_DERIVED\"`` metrics
-      are computed on a single table, whereas the ``\"CUSTOM_METRIC_TYPE_DRIFT\"`` compare metrics across
-      baseline and input table, or across the two consecutive time windows.
-      - CUSTOM_METRIC_TYPE_AGGREGATE: only depend on the existing columns in your table
-      - CUSTOM_METRIC_TYPE_DERIVED: depend on previously computed aggregate metrics
-      - CUSTOM_METRIC_TYPE_DRIFT:  depend on previously computed aggregate or derived metrics
-    "enum":
-      - |-
-        CUSTOM_METRIC_TYPE_AGGREGATE
-      - |-
-        CUSTOM_METRIC_TYPE_DERIVED
-      - |-
-        CUSTOM_METRIC_TYPE_DRIFT
-github.com/databricks/databricks-sdk-go/service/catalog.MonitorNotifications:
-  "on_failure":
-    "description": |-
-      Destinations to send notifications on failure/timeout.
-  "on_new_classification_tag_detected":
-    "description": |-
-      Destinations to send notifications on new classification tag detected.
-    "x-databricks-preview": |-
-      PRIVATE
-github.com/databricks/databricks-sdk-go/service/catalog.MonitorSnapshot:
-  "_":
-    "description": |-
-      Snapshot analysis configuration
-github.com/databricks/databricks-sdk-go/service/catalog.MonitorTimeSeries:
-  "_":
-    "description": |-
-      Time series analysis configuration.
-  "granularities":
-    "description": |-
-      Granularities for aggregating data into time windows based on their timestamp. Currently the following static
-      granularities are supported:
-      {``\"5 minutes\"``, ``\"30 minutes\"``, ``\"1 hour\"``, ``\"1 day\"``, ``\"\u003cn\u003e week(s)\"``, ``\"1 month\"``, ``\"1 year\"``}.
-  "timestamp_col":
-    "description": |-
-      Column for the timestamp.
-github.com/databricks/databricks-sdk-go/service/catalog.Privilege:
-  "_":
-    "enum":
-      - |-
-        SELECT
-      - |-
-        READ_PRIVATE_FILES
-      - |-
-        WRITE_PRIVATE_FILES
-      - |-
-        CREATE
-      - |-
-        USAGE
-      - |-
-        USE_CATALOG
-      - |-
-        USE_SCHEMA
-      - |-
-        CREATE_SCHEMA
-      - |-
-        CREATE_VIEW
-      - |-
-        CREATE_EXTERNAL_TABLE
-      - |-
-        CREATE_MATERIALIZED_VIEW
-      - |-
-        CREATE_FUNCTION
-      - |-
-        CREATE_MODEL
-      - |-
-        CREATE_CATALOG
-      - |-
-        CREATE_MANAGED_STORAGE
-      - |-
-        CREATE_EXTERNAL_LOCATION
-      - |-
-        CREATE_STORAGE_CREDENTIAL
-      - |-
-        CREATE_SERVICE_CREDENTIAL
-      - |-
-        ACCESS
-      - |-
-        CREATE_SHARE
-      - |-
-        CREATE_RECIPIENT
-      - |-
-        CREATE_PROVIDER
-      - |-
-        USE_SHARE
-      - |-
-        USE_RECIPIENT
-      - |-
-        USE_PROVIDER
-      - |-
-        USE_MARKETPLACE_ASSETS
-      - |-
-        SET_SHARE_PERMISSION
-      - |-
-        MODIFY
-      - |-
-        REFRESH
-      - |-
-        EXECUTE
-      - |-
-        READ_FILES
-      - |-
-        WRITE_FILES
-      - |-
-        CREATE_TABLE
-      - |-
-        ALL_PRIVILEGES
-      - |-
-        CREATE_CONNECTION
-      - |-
-        USE_CONNECTION
-      - |-
-        APPLY_TAG
-      - |-
-        CREATE_FOREIGN_CATALOG
-      - |-
-        CREATE_FOREIGN_SECURABLE
-      - |-
-        MANAGE_ALLOWLIST
-      - |-
-        CREATE_VOLUME
-      - |-
-        CREATE_EXTERNAL_VOLUME
-      - |-
-        READ_VOLUME
-      - |-
-        WRITE_VOLUME
-      - |-
-        MANAGE
-      - |-
-        BROWSE
-      - |-
-        CREATE_CLEAN_ROOM
-      - |-
-        MODIFY_CLEAN_ROOM
-      - |-
-        EXECUTE_CLEAN_ROOM_TASK
-      - |-
-        EXTERNAL_USE_SCHEMA
-github.com/databricks/databricks-sdk-go/service/catalog.PrivilegeAssignment:
-  "principal":
-    "description": |-
-      The principal (user email address or group name).
-      For deleted principals, `principal` is empty while `principal_id` is populated.
-  "privileges":
-    "description": |-
-      The privileges assigned to the principal.
-github.com/databricks/databricks-sdk-go/service/catalog.RegisteredModelAlias:
-  "alias_name":
-    "description": |-
-      Name of the alias, e.g. 'champion' or 'latest_stable'
-  "catalog_name":
-    "description": |-
-      The name of the catalog containing the model version
-  "id":
-    "description": |-
-      The unique identifier of the alias
-  "model_name":
-    "description": |-
-      The name of the parent registered model of the model version, relative to parent schema
-  "schema_name":
-    "description": |-
-      The name of the schema containing the model version, relative to parent catalog
-  "version_num":
-    "description": |-
-      Integer version number of the model version to which this alias points.
-github.com/databricks/databricks-sdk-go/service/catalog.SseEncryptionDetails:
-  "_":
-    "description": |-
-      Server-Side Encryption properties for clients communicating with AWS s3.
-  "algorithm":
-    "description": |-
-      Sets the value of the 'x-amz-server-side-encryption' header in S3 request.
-  "aws_kms_key_arn":
-    "description": |-
-      Optional. The ARN of the SSE-KMS key used with the S3 location, when algorithm = "SSE-KMS".
-      Sets the value of the 'x-amz-server-side-encryption-aws-kms-key-id' header.
-github.com/databricks/databricks-sdk-go/service/catalog.SseEncryptionDetailsAlgorithm:
-  "_":
-    "enum":
-      - |-
-        AWS_SSE_S3
-      - |-
-        AWS_SSE_KMS
-github.com/databricks/databricks-sdk-go/service/catalog.VolumeType:
-  "_":
-    "enum":
-      - |-
-        MANAGED
-      - |-
-        EXTERNAL
-github.com/databricks/databricks-sdk-go/service/compute.Adlsgen2Info:
-  "_":
-    "description": |-
-      A storage location in Adls Gen2
-  "destination":
-    "description": |-
-      abfss destination, e.g. `abfss://<container-name>@<storage-account-name>.dfs.core.windows.net/<directory-name>`.
-github.com/databricks/databricks-sdk-go/service/compute.AutoScale:
-  "max_workers":
-    "description": |-
-      The maximum number of workers to which the cluster can scale up when overloaded.
-      Note that `max_workers` must be strictly greater than `min_workers`.
-  "min_workers":
-    "description": |-
-      The minimum number of workers to which the cluster can scale down when underutilized.
-      It is also the initial number of workers the cluster will have after creation.
-github.com/databricks/databricks-sdk-go/service/compute.AwsAttributes:
-  "_":
-    "description": |-
-      Attributes set during cluster creation which are related to Amazon Web Services.
-  "availability":
-    "description": |-
-      Availability type used for all subsequent nodes past the `first_on_demand` ones.
-
-      Note: If `first_on_demand` is zero, this availability type will be used for the entire cluster.
-  "ebs_volume_count":
-    "description": |-
-      The number of volumes launched for each instance. Users can choose up to 10 volumes.
-      This feature is only enabled for supported node types. Legacy node types cannot specify
-      custom EBS volumes.
-      For node types with no instance store, at least one EBS volume needs to be specified;
-      otherwise, cluster creation will fail.
-
-      These EBS volumes will be mounted at `/ebs0`, `/ebs1`, and etc.
-      Instance store volumes will be mounted at `/local_disk0`, `/local_disk1`, and etc.
-
-      If EBS volumes are attached, Databricks will configure Spark to use only the EBS volumes for
-      scratch storage because heterogenously sized scratch devices can lead to inefficient disk
-      utilization. If no EBS volumes are attached, Databricks will configure Spark to use instance
-      store volumes.
-
-      Please note that if EBS volumes are specified, then the Spark configuration `spark.local.dir`
-      will be overridden.
-  "ebs_volume_iops":
-    "description": |-
-      If using gp3 volumes, what IOPS to use for the disk. If this is not set, the maximum performance of a gp2 volume with the same volume size will be used.
-  "ebs_volume_size":
-    "description": |-
-      The size of each EBS volume (in GiB) launched for each instance. For general purpose
-      SSD, this value must be within the range 100 - 4096. For throughput optimized HDD,
-      this value must be within the range 500 - 4096.
-  "ebs_volume_throughput":
-    "description": |-
-      If using gp3 volumes, what throughput to use for the disk. If this is not set, the maximum performance of a gp2 volume with the same volume size will be used.
-  "ebs_volume_type":
-    "description": |-
-      The type of EBS volumes that will be launched with this cluster.
-  "first_on_demand":
-    "description": |-
-      The first `first_on_demand` nodes of the cluster will be placed on on-demand instances.
-      If this value is greater than 0, the cluster driver node in particular will be placed on an
-      on-demand instance. If this value is greater than or equal to the current cluster size, all
-      nodes will be placed on on-demand instances. If this value is less than the current cluster
-      size, `first_on_demand` nodes will be placed on on-demand instances and the remainder will
-      be placed on `availability` instances. Note that this value does not affect
-      cluster size and cannot currently be mutated over the lifetime of a cluster.
-  "instance_profile_arn":
-    "description": |-
-      Nodes for this cluster will only be placed on AWS instances with this instance profile. If
-      ommitted, nodes will be placed on instances without an IAM instance profile. The instance
-      profile must have previously been added to the Databricks environment by an account
-      administrator.
-
-      This feature may only be available to certain customer plans.
-  "spot_bid_price_percent":
-    "description": |-
-      The bid price for AWS spot instances, as a percentage of the corresponding instance type's
-      on-demand price.
-      For example, if this field is set to 50, and the cluster needs a new `r3.xlarge` spot
-      instance, then the bid price is half of the price of
-      on-demand `r3.xlarge` instances. Similarly, if this field is set to 200, the bid price is twice
-      the price of on-demand `r3.xlarge` instances. If not specified, the default value is 100.
-      When spot instances are requested for this cluster, only spot instances whose bid price
-      percentage matches this field will be considered.
-      Note that, for safety, we enforce this field to be no more than 10000.
-  "zone_id":
-    "description": |-
-      Identifier for the availability zone/datacenter in which the cluster resides.
-      This string will be of a form like "us-west-2a". The provided availability
-      zone must be in the same region as the Databricks deployment. For example, "us-west-2a"
-      is not a valid zone id if the Databricks deployment resides in the "us-east-1" region.
-      This is an optional field at cluster creation, and if not specified, the zone "auto" will be used.
-      If the zone specified is "auto", will try to place cluster in a zone with high availability,
-      and will retry placement in a different AZ if there is not enough capacity.
-
-      The list of available zones as well as the default value can be found by using the
-      `List Zones` method.
-github.com/databricks/databricks-sdk-go/service/compute.AwsAvailability:
-  "_":
-    "description": |-
-      Availability type used for all subsequent nodes past the `first_on_demand` ones.
-
-      Note: If `first_on_demand` is zero, this availability type will be used for the entire cluster.
-    "enum":
-      - |-
-        SPOT
-      - |-
-        ON_DEMAND
-      - |-
-        SPOT_WITH_FALLBACK
-github.com/databricks/databricks-sdk-go/service/compute.AzureAttributes:
-  "_":
-    "description": |-
-      Attributes set during cluster creation which are related to Microsoft Azure.
-  "availability":
-    "description": |-
-      Availability type used for all subsequent nodes past the `first_on_demand` ones.
-      Note: If `first_on_demand` is zero, this availability
-      type will be used for the entire cluster.
-  "first_on_demand":
-    "description": |-
-      The first `first_on_demand` nodes of the cluster will be placed on on-demand instances.
-      This value should be greater than 0, to make sure the cluster driver node is placed on an
-      on-demand instance. If this value is greater than or equal to the current cluster size, all
-      nodes will be placed on on-demand instances. If this value is less than the current cluster
-      size, `first_on_demand` nodes will be placed on on-demand instances and the remainder will
-      be placed on `availability` instances. Note that this value does not affect
-      cluster size and cannot currently be mutated over the lifetime of a cluster.
-  "log_analytics_info":
-    "description": |-
-      Defines values necessary to configure and run Azure Log Analytics agent
-  "spot_bid_max_price":
-    "description": |-
-      The max bid price to be used for Azure spot instances.
-      The Max price for the bid cannot be higher than the on-demand price of the instance.
-      If not specified, the default value is -1, which specifies that the instance cannot be evicted
-      on the basis of price, and only on the basis of availability. Further, the value should > 0 or -1.
-github.com/databricks/databricks-sdk-go/service/compute.AzureAvailability:
-  "_":
-    "description": |-
-      Availability type used for all subsequent nodes past the `first_on_demand` ones.
-      Note: If `first_on_demand` is zero, this availability type will be used for the entire cluster.
-    "enum":
-      - |-
-        SPOT_AZURE
-      - |-
-        ON_DEMAND_AZURE
-      - |-
-        SPOT_WITH_FALLBACK_AZURE
-github.com/databricks/databricks-sdk-go/service/compute.ClientsTypes:
-  "jobs":
-    "description": |-
-      With jobs set, the cluster can be used for jobs
-  "notebooks":
-    "description": |-
-      With notebooks set, this cluster can be used for notebooks
-github.com/databricks/databricks-sdk-go/service/compute.ClusterLogConf:
-  "_":
-    "description": |-
-      Cluster log delivery config
-  "dbfs":
-    "description": |-
-      destination needs to be provided. e.g.
-      `{ "dbfs" : { "destination" : "dbfs:/home/cluster_log" } }`
-  "s3":
-    "description": |-
-      destination and either the region or endpoint need to be provided. e.g.
-      `{ "s3": { "destination" : "s3://cluster_log_bucket/prefix", "region" : "us-west-2" } }`
-      Cluster iam role is used to access s3, please make sure the cluster iam role in
-      `instance_profile_arn` has permission to write data to the s3 destination.
-  "volumes":
-    "description": |-
-      destination needs to be provided, e.g.
-      `{ "volumes": { "destination": "/Volumes/catalog/schema/volume/cluster_log" } }`
-github.com/databricks/databricks-sdk-go/service/compute.ClusterPermissionLevel:
-  "_":
-    "description": |-
-      Permission level
-    "enum":
-      - |-
-        CAN_MANAGE
-      - |-
-        CAN_RESTART
-      - |-
-        CAN_ATTACH_TO
-github.com/databricks/databricks-sdk-go/service/compute.ClusterSpec:
-  "_":
-    "description": |-
-      Contains a snapshot of the latest user specified settings that were used to create/edit the cluster.
-  "apply_policy_default_values":
-    "description": |-
-      When set to true, fixed and default values from the policy will be used for fields that are omitted. When set to false, only fixed values from the policy will be applied.
-  "autoscale":
-    "description": |-
-      Parameters needed in order to automatically scale clusters up and down based on load.
-      Note: autoscaling works best with DB runtime versions 3.0 or later.
-  "autotermination_minutes":
-    "description": |-
-      Automatically terminates the cluster after it is inactive for this time in minutes. If not set,
-      this cluster will not be automatically terminated. If specified, the threshold must be between
-      10 and 10000 minutes.
-      Users can also set this value to 0 to explicitly disable automatic termination.
-  "aws_attributes":
-    "description": |-
-      Attributes related to clusters running on Amazon Web Services.
-      If not specified at cluster creation, a set of default values will be used.
-  "azure_attributes":
-    "description": |-
-      Attributes related to clusters running on Microsoft Azure.
-      If not specified at cluster creation, a set of default values will be used.
-  "cluster_log_conf":
-    "description": |-
-      The configuration for delivering spark logs to a long-term storage destination.
-      Three kinds of destinations (DBFS, S3 and Unity Catalog volumes) are supported. Only one destination can be specified
-      for one cluster. If the conf is given, the logs will be delivered to the destination every
-      `5 mins`. The destination of driver logs is `$destination/$clusterId/driver`, while
-      the destination of executor logs is `$destination/$clusterId/executor`.
-  "cluster_name":
-    "description": |-
-      Cluster name requested by the user. This doesn't have to be unique.
-      If not specified at creation, the cluster name will be an empty string.
-      For job clusters, the cluster name is automatically set based on the job and job run IDs.
-  "custom_tags":
-    "description": |-
-      Additional tags for cluster resources. Databricks will tag all cluster resources (e.g., AWS
-      instances and EBS volumes) with these tags in addition to `default_tags`. Notes:
-
-      - Currently, Databricks allows at most 45 custom tags
-
-      - Clusters can only reuse cloud resources if the resources' tags are a subset of the cluster tags
-  "data_security_mode":
-    "description": |-
-      Data security mode decides what data governance model to use when accessing data
-      from a cluster.
-
-      The following modes can only be used when `kind = CLASSIC_PREVIEW`.
-      * `DATA_SECURITY_MODE_AUTO`: Databricks will choose the most appropriate access mode depending on your compute configuration.
-      * `DATA_SECURITY_MODE_STANDARD`: Alias for `USER_ISOLATION`.
-      * `DATA_SECURITY_MODE_DEDICATED`: Alias for `SINGLE_USER`.
-
-      The following modes can be used regardless of `kind`.
-      * `NONE`: No security isolation for multiple users sharing the cluster. Data governance features are not available in this mode.
-      * `SINGLE_USER`: A secure cluster that can only be exclusively used by a single user specified in `single_user_name`. Most programming languages, cluster features and data governance features are available in this mode.
-      * `USER_ISOLATION`: A secure cluster that can be shared by multiple users. Cluster users are fully isolated so that they cannot see each other's data and credentials. Most data governance features are supported in this mode. But programming languages and cluster features might be limited.
-
-      The following modes are deprecated starting with Databricks Runtime 15.0 and
-      will be removed for future Databricks Runtime versions:
-
-      * `LEGACY_TABLE_ACL`: This mode is for users migrating from legacy Table ACL clusters.
-      * `LEGACY_PASSTHROUGH`: This mode is for users migrating from legacy Passthrough on high concurrency clusters.
-      * `LEGACY_SINGLE_USER`: This mode is for users migrating from legacy Passthrough on standard clusters.
-      * `LEGACY_SINGLE_USER_STANDARD`: This mode provides a way that doesn’t have UC nor passthrough enabled.
-  "docker_image":
-    "description": |-
-      Custom docker image BYOC
-  "driver_instance_pool_id":
-    "description": |-
-      The optional ID of the instance pool for the driver of the cluster belongs.
-      The pool cluster uses the instance pool with id (instance_pool_id) if the driver pool is not
-      assigned.
-  "driver_node_type_flexibility":
-    "description": |-
-      Flexible node type configuration for the driver node.
-  "driver_node_type_id":
-    "description": |-
-      The node type of the Spark driver.
-      Note that this field is optional; if unset, the driver node type will be set as the same value
-      as `node_type_id` defined above.
-
-      This field, along with node_type_id, should not be set if virtual_cluster_size is set.
-      If both driver_node_type_id, node_type_id, and virtual_cluster_size are specified, driver_node_type_id and node_type_id take precedence.
-  "enable_elastic_disk":
-    "description": |-
-      Autoscaling Local Storage: when enabled, this cluster will dynamically acquire additional disk
-      space when its Spark workers are running low on disk space.
-  "enable_local_disk_encryption":
-    "description": |-
-      Whether to enable LUKS on cluster VMs' local disks
-  "gcp_attributes":
-    "description": |-
-      Attributes related to clusters running on Google Cloud Platform.
-      If not specified at cluster creation, a set of default values will be used.
-  "init_scripts":
-    "description": |-
-      The configuration for storing init scripts. Any number of destinations can be specified.
-      The scripts are executed sequentially in the order provided.
-      If `cluster_log_conf` is specified, init script logs are sent to `<destination>/<cluster-ID>/init_scripts`.
-  "instance_pool_id":
-    "description": |-
-      The optional ID of the instance pool to which the cluster belongs.
-  "is_single_node":
-    "description": |-
-      This field can only be used when `kind = CLASSIC_PREVIEW`.
-
-      When set to true, Databricks will automatically set single node related `custom_tags`, `spark_conf`, and `num_workers`
-  "kind":
-    "description": |-
-      The kind of compute described by this compute specification.
-
-      Depending on `kind`, different validations and default values will be applied.
-
-      Clusters with `kind = CLASSIC_PREVIEW` support the following fields, whereas clusters with no specified `kind` do not.
-      * [is_single_node](/api/workspace/clusters/create#is_single_node)
-      * [use_ml_runtime](/api/workspace/clusters/create#use_ml_runtime)
-      * [data_security_mode](/api/workspace/clusters/create#data_security_mode) set to `DATA_SECURITY_MODE_AUTO`, `DATA_SECURITY_MODE_DEDICATED`, or `DATA_SECURITY_MODE_STANDARD`
-
-      By using the [simple form](https://docs.databricks.com/compute/simple-form.html), your clusters are automatically using `kind = CLASSIC_PREVIEW`.
-  "node_type_id":
-    "description": |-
-      This field encodes, through a single value, the resources available to each of
-      the Spark nodes in this cluster. For example, the Spark nodes can be provisioned
-      and optimized for memory or compute intensive workloads. A list of available node
-      types can be retrieved by using the :method:clusters/listNodeTypes API call.
-  "num_workers":
-    "description": |-
-      Number of worker nodes that this cluster should have. A cluster has one Spark Driver
-      and `num_workers` Executors for a total of `num_workers` + 1 Spark nodes.
-
-      Note: When reading the properties of a cluster, this field reflects the desired number
-      of workers rather than the actual current number of workers. For instance, if a cluster
-      is resized from 5 to 10 workers, this field will immediately be updated to reflect
-      the target size of 10 workers, whereas the workers listed in `spark_info` will gradually
-      increase from 5 to 10 as the new nodes are provisioned.
-  "policy_id":
-    "description": |-
-      The ID of the cluster policy used to create the cluster if applicable.
-  "remote_disk_throughput":
-    "description": |-
-      If set, what the configurable throughput (in Mb/s) for the remote disk is. Currently only supported for GCP HYPERDISK_BALANCED disks.
-  "runtime_engine":
-    "description": |-
-      Determines the cluster's runtime engine, either standard or Photon.
-
-      This field is not compatible with legacy `spark_version` values that contain `-photon-`.
-      Remove `-photon-` from the `spark_version` and set `runtime_engine` to `PHOTON`.
-
-      If left unspecified, the runtime engine defaults to standard unless the spark_version
-      contains -photon-, in which case Photon will be used.
-  "single_user_name":
-    "description": |-
-      Single user name if data_security_mode is `SINGLE_USER`
-  "spark_conf":
-    "description": |-
-      An object containing a set of optional, user-specified Spark configuration key-value pairs.
-      Users can also pass in a string of extra JVM options to the driver and the executors via
-      `spark.driver.extraJavaOptions` and `spark.executor.extraJavaOptions` respectively.
-  "spark_env_vars":
-    "description": |-
-      An object containing a set of optional, user-specified environment variable key-value pairs.
-      Please note that key-value pair of the form (X,Y) will be exported as is (i.e.,
-      `export X='Y'`) while launching the driver and workers.
-
-      In order to specify an additional set of `SPARK_DAEMON_JAVA_OPTS`, we recommend appending
-      them to `$SPARK_DAEMON_JAVA_OPTS` as shown in the example below. This ensures that all
-      default databricks managed environmental variables are included as well.
-
-      Example Spark environment variables:
-      `{"SPARK_WORKER_MEMORY": "28000m", "SPARK_LOCAL_DIRS": "/local_disk0"}` or
-      `{"SPARK_DAEMON_JAVA_OPTS": "$SPARK_DAEMON_JAVA_OPTS -Dspark.shuffle.service.enabled=true"}`
-  "spark_version":
-    "description": |-
-      The Spark version of the cluster, e.g. `3.3.x-scala2.11`.
-      A list of available Spark versions can be retrieved by using
-      the :method:clusters/sparkVersions API call.
-  "ssh_public_keys":
-    "description": |-
-      SSH public key contents that will be added to each Spark node in this cluster. The
-      corresponding private keys can be used to login with the user name `ubuntu` on port `2200`.
-      Up to 10 keys can be specified.
-  "total_initial_remote_disk_size":
-    "description": |-
-      If set, what the total initial volume size (in GB) of the remote disks should be. Currently only supported for GCP HYPERDISK_BALANCED disks.
-  "use_ml_runtime":
-    "description": |-
-      This field can only be used when `kind = CLASSIC_PREVIEW`.
-
-      `effective_spark_version` is determined by `spark_version` (DBR release), this field `use_ml_runtime`, and whether `node_type_id` is gpu node or not.
-  "worker_node_type_flexibility":
-    "description": |-
-      Flexible node type configuration for worker nodes.
-  "workload_type":
-    "description": |-
-      Cluster Attributes showing for clusters workload types.
-github.com/databricks/databricks-sdk-go/service/compute.DataSecurityMode:
-  "_":
-    "description": |-
-      Data security mode decides what data governance model to use when accessing data
-      from a cluster.
-
-      The following modes can only be used when `kind = CLASSIC_PREVIEW`.
-      * `DATA_SECURITY_MODE_AUTO`: Databricks will choose the most appropriate access mode depending on your compute configuration.
-      * `DATA_SECURITY_MODE_STANDARD`: Alias for `USER_ISOLATION`.
-      * `DATA_SECURITY_MODE_DEDICATED`: Alias for `SINGLE_USER`.
-
-      The following modes can be used regardless of `kind`.
-      * `NONE`: No security isolation for multiple users sharing the cluster. Data governance features are not available in this mode.
-      * `SINGLE_USER`: A secure cluster that can only be exclusively used by a single user specified in `single_user_name`. Most programming languages, cluster features and data governance features are available in this mode.
-      * `USER_ISOLATION`: A secure cluster that can be shared by multiple users. Cluster users are fully isolated so that they cannot see each other's data and credentials. Most data governance features are supported in this mode. But programming languages and cluster features might be limited.
-
-      The following modes are deprecated starting with Databricks Runtime 15.0 and
-      will be removed for future Databricks Runtime versions:
-
-      * `LEGACY_TABLE_ACL`: This mode is for users migrating from legacy Table ACL clusters.
-      * `LEGACY_PASSTHROUGH`: This mode is for users migrating from legacy Passthrough on high concurrency clusters.
-      * `LEGACY_SINGLE_USER`: This mode is for users migrating from legacy Passthrough on standard clusters.
-      * `LEGACY_SINGLE_USER_STANDARD`: This mode provides a way that doesn’t have UC nor passthrough enabled.
-    "enum":
-      - |-
-        NONE
-      - |-
-        SINGLE_USER
-      - |-
-        USER_ISOLATION
-      - |-
-        LEGACY_TABLE_ACL
-      - |-
-        LEGACY_PASSTHROUGH
-      - |-
-        LEGACY_SINGLE_USER
-      - |-
-        LEGACY_SINGLE_USER_STANDARD
-      - |-
-        DATA_SECURITY_MODE_STANDARD
-      - |-
-        DATA_SECURITY_MODE_DEDICATED
-      - |-
-        DATA_SECURITY_MODE_AUTO
-github.com/databricks/databricks-sdk-go/service/compute.DbfsStorageInfo:
-  "_":
-    "description": |-
-      A storage location in DBFS
-  "destination":
-    "description": |-
-      dbfs destination, e.g. `dbfs:/my/path`
-github.com/databricks/databricks-sdk-go/service/compute.DockerBasicAuth:
-  "password":
-    "description": |-
-      Password of the user
-  "username":
-    "description": |-
-      Name of the user
-github.com/databricks/databricks-sdk-go/service/compute.DockerImage:
-  "basic_auth":
-    "description": |-
-      Basic auth with username and password
-  "url":
-    "description": |-
-      URL of the docker image.
-github.com/databricks/databricks-sdk-go/service/compute.EbsVolumeType:
-  "_":
-    "description": |-
-      All EBS volume types that Databricks supports.
-      See https://aws.amazon.com/ebs/details/ for details.
-    "enum":
-      - |-
-        GENERAL_PURPOSE_SSD
-      - |-
-        THROUGHPUT_OPTIMIZED_HDD
-github.com/databricks/databricks-sdk-go/service/compute.Environment:
-  "_":
-    "description": |-
-      The environment entity used to preserve serverless environment side panel, jobs' environment for non-notebook task, and DLT's environment for classic and serverless pipelines.
-      In this minimal environment spec, only pip and java dependencies are supported.
-  "base_environment":
-    "description": |-
-      The base environment this environment is built on top of. A base environment defines the environment version and a
-      list of dependencies for serverless compute. The value can be a file path to a custom `env.yaml` file
-      (e.g., `/Workspace/path/to/env.yaml`). Support for a Databricks-provided base environment ID
-      (e.g., `workspace-base-environments/databricks_ai_v4`) and workspace base environment ID
-      (e.g., `workspace-base-environments/dbe_b849b66e-b31a-4cb5-b161-1f2b10877fb7`) is in Beta.
-      Either `environment_version` or `base_environment` can be provided.  For more information, see
-  "client":
-    "description": |-
-      Use `environment_version` instead.
-    "deprecation_message": |-
-      This field is deprecated
-  "dependencies":
-    "description": |-
-      List of pip dependencies, as supported by the version of pip in this environment.
-      Each dependency is a valid pip requirements file line per https://pip.pypa.io/en/stable/reference/requirements-file-format/.
-      Allowed dependencies include a requirement specifier, an archive URL, a local project path (such as WSFS or UC Volumes in Databricks), or a VCS project URL.
-  "environment_version":
-    "description": |-
-      Either `environment_version` or `base_environment` needs to be provided. Environment version used by the environment.
-      Each version comes with a specific Python version and a set of Python packages.
-      The version is a string, consisting of an integer.
-  "java_dependencies":
-    "description": |-
-      List of java dependencies. Each dependency is a string representing a java library path. For example: `/Volumes/path/to/test.jar`.
-github.com/databricks/databricks-sdk-go/service/compute.GcpAttributes:
-  "_":
-    "description": |-
-      Attributes set during cluster creation which are related to GCP.
-  "availability":
-    "description": |-
-      This field determines whether the spark executors will be scheduled to run on preemptible
-      VMs, on-demand VMs, or preemptible VMs with a fallback to on-demand VMs if the former is unavailable.
-  "boot_disk_size":
-    "description": |-
-      Boot disk size in GB
-  "first_on_demand":
-    "description": |-
-      The first `first_on_demand` nodes of the cluster will be placed on on-demand instances.
-      This value should be greater than 0, to make sure the cluster driver node is placed on an
-      on-demand instance. If this value is greater than or equal to the current cluster size, all
-      nodes will be placed on on-demand instances. If this value is less than the current cluster
-      size, `first_on_demand` nodes will be placed on on-demand instances and the remainder will
-      be placed on `availability` instances. Note that this value does not affect
-      cluster size and cannot currently be mutated over the lifetime of a cluster.
-  "google_service_account":
-    "description": |-
-      If provided, the cluster will impersonate the google service account when accessing
-      gcloud services (like GCS). The google service account
-      must have previously been added to the Databricks environment by an account
-      administrator.
-  "local_ssd_count":
-    "description": |-
-      If provided, each node (workers and driver) in the cluster will have this number of local SSDs attached.
-      Each local SSD is 375GB in size.
-      Refer to [GCP documentation](https://cloud.google.com/compute/docs/disks/local-ssd#choose_number_local_ssds)
-      for the supported number of local SSDs for each instance type.
-  "use_preemptible_executors":
-    "description": |-
-      This field determines whether the spark executors will be scheduled to run on preemptible
-      VMs (when set to true) versus standard compute engine VMs (when set to false; default).
-      Note: Soon to be deprecated, use the 'availability' field instead.
-    "deprecation_message": |-
-      This field is deprecated
-  "zone_id":
-    "description": |-
-      Identifier for the availability zone in which the cluster resides.
-      This can be one of the following:
-      - "HA" => High availability, spread nodes across availability zones for a Databricks deployment region [default].
-      - "AUTO" => Databricks picks an availability zone to schedule the cluster on.
-      - A GCP availability zone => Pick One of the available zones for (machine type + region) from
-      https://cloud.google.com/compute/docs/regions-zones.
-github.com/databricks/databricks-sdk-go/service/compute.GcpAvailability:
-  "_":
-    "description": |-
-      This field determines whether the instance pool will contain preemptible
-      VMs, on-demand VMs, or preemptible VMs with a fallback to on-demand VMs if the former is unavailable.
-    "enum":
-      - |-
-        PREEMPTIBLE_GCP
-      - |-
-        ON_DEMAND_GCP
-      - |-
-        PREEMPTIBLE_WITH_FALLBACK_GCP
-github.com/databricks/databricks-sdk-go/service/compute.GcsStorageInfo:
-  "_":
-    "description": |-
-      A storage location in Google Cloud Platform's GCS
-  "destination":
-    "description": |-
-      GCS destination/URI, e.g. `gs://my-bucket/some-prefix`
-github.com/databricks/databricks-sdk-go/service/compute.HardwareAcceleratorType:
-  "_":
-    "description": |-
-      HardwareAcceleratorType: The type of hardware accelerator to use for compute workloads.
-      NOTE: This enum is referenced and is intended to be used by other Databricks services
-      that need to specify hardware accelerator requirements for AI compute workloads.
-    "enum":
-      - |-
-        GPU_1xA10
-      - |-
-        GPU_8xH100
-github.com/databricks/databricks-sdk-go/service/compute.InitScriptInfo:
-  "_":
-    "description": |-
-      Config for an individual init script
-      Next ID: 11
-  "abfss":
-    "description": |-
-      destination needs to be provided, e.g.
-      `abfss://<container-name>@<storage-account-name>.dfs.core.windows.net/<directory-name>`
-  "dbfs":
-    "description": |-
-      destination needs to be provided. e.g.
-      `{ "dbfs": { "destination" : "dbfs:/home/cluster_log" } }`
-    "deprecation_message": |-
-      This field is deprecated
-  "file":
-    "description": |-
-      destination needs to be provided, e.g.
-      `{ "file": { "destination": "file:/my/local/file.sh" } }`
-  "gcs":
-    "description": |-
-      destination needs to be provided, e.g.
-      `{ "gcs": { "destination": "gs://my-bucket/file.sh" } }`
-  "s3":
-    "description": |-
-      destination and either the region or endpoint need to be provided. e.g.
-      `{ \"s3\": { \"destination\": \"s3://cluster_log_bucket/prefix\", \"region\": \"us-west-2\" } }`
-      Cluster iam role is used to access s3, please make sure the cluster iam role in
-      `instance_profile_arn` has permission to write data to the s3 destination.
-  "volumes":
-    "description": |-
-      destination needs to be provided. e.g.
-      `{ \"volumes\" : { \"destination\" : \"/Volumes/my-init.sh\" } }`
-  "workspace":
-    "description": |-
-      destination needs to be provided, e.g.
-      `{ "workspace": { "destination": "/cluster-init-scripts/setup-datadog.sh" } }`
-github.com/databricks/databricks-sdk-go/service/compute.Library:
-  "cran":
-    "description": |-
-      Specification of a CRAN library to be installed as part of the library
-  "egg":
-    "description": |-
-      Deprecated. URI of the egg library to install. Installing Python egg files is deprecated and is not supported in Databricks Runtime 14.0 and above.
-    "deprecation_message": |-
-      This field is deprecated
-  "jar":
-    "description": |-
-      URI of the JAR library to install. Supported URIs include Workspace paths, Unity Catalog Volumes paths, and S3 URIs.
-      For example: `{ "jar": "/Workspace/path/to/library.jar" }`, `{ "jar" : "/Volumes/path/to/library.jar" }` or
-      `{ "jar": "s3://my-bucket/library.jar" }`.
-      If S3 is used, please make sure the cluster has read access on the library. You may need to
-      launch the cluster with an IAM role to access the S3 URI.
-  "maven":
-    "description": |-
-      Specification of a maven library to be installed. For example:
-      `{ "coordinates": "org.jsoup:jsoup:1.7.2" }`
-  "pypi":
-    "description": |-
-      Specification of a PyPi library to be installed. For example:
-      `{ "package": "simplejson" }`
-  "requirements":
-    "description": |-
-      URI of the requirements.txt file to install. Only Workspace paths and Unity Catalog Volumes paths are supported.
-      For example: `{ "requirements": "/Workspace/path/to/requirements.txt" }` or `{ "requirements" : "/Volumes/path/to/requirements.txt" }`
-  "whl":
-    "description": |-
-      URI of the wheel library to install. Supported URIs include Workspace paths, Unity Catalog Volumes paths, and S3 URIs.
-      For example: `{ "whl": "/Workspace/path/to/library.whl" }`, `{ "whl" : "/Volumes/path/to/library.whl" }` or
-      `{ "whl": "s3://my-bucket/library.whl" }`.
-      If S3 is used, please make sure the cluster has read access on the library. You may need to
-      launch the cluster with an IAM role to access the S3 URI.
-github.com/databricks/databricks-sdk-go/service/compute.LocalFileInfo:
-  "destination":
-    "description": |-
-      local file destination, e.g. `file:/my/local/file.sh`
-github.com/databricks/databricks-sdk-go/service/compute.LogAnalyticsInfo:
-  "log_analytics_primary_key": {}
-  "log_analytics_workspace_id": {}
-github.com/databricks/databricks-sdk-go/service/compute.MavenLibrary:
-  "coordinates":
-    "description": |-
-      Gradle-style maven coordinates. For example: "org.jsoup:jsoup:1.7.2".
-  "exclusions":
-    "description": |-
-      List of dependences to exclude. For example: `["slf4j:slf4j", "*:hadoop-client"]`.
-
-      Maven dependency exclusions:
-      https://maven.apache.org/guides/introduction/introduction-to-optional-and-excludes-dependencies.html.
-  "repo":
-    "description": |-
-      Maven repo to install the Maven package from. If omitted, both Maven Central Repository
-      and Spark Packages are searched.
-github.com/databricks/databricks-sdk-go/service/compute.NodeTypeFlexibility:
-  "_":
-    "description": |-
-      Configuration for flexible node types, allowing fallback to alternate node types during cluster launch and upscale.
-  "alternate_node_type_ids":
-    "description": |-
-      A list of node type IDs to use as fallbacks when the primary node type is unavailable.
-github.com/databricks/databricks-sdk-go/service/compute.PythonPyPiLibrary:
-  "package":
-    "description": |-
-      The name of the pypi package to install. An optional exact version specification is also
-      supported. Examples: "simplejson" and "simplejson==3.8.0".
-  "repo":
-    "description": |-
-      The repository where the package can be found. If not specified, the default pip index is
-      used.
-github.com/databricks/databricks-sdk-go/service/compute.RCranLibrary:
-  "package":
-    "description": |-
-      The name of the CRAN package to install.
-  "repo":
-    "description": |-
-      The repository where the package can be found. If not specified, the default CRAN repo is used.
-github.com/databricks/databricks-sdk-go/service/compute.RuntimeEngine:
-  "_":
-    "enum":
-      - |-
-        NULL
-      - |-
-        STANDARD
-      - |-
-        PHOTON
-github.com/databricks/databricks-sdk-go/service/compute.S3StorageInfo:
-  "_":
-    "description": |-
-      A storage location in Amazon S3
-  "canned_acl":
-    "description": |-
-      (Optional) Set canned access control list for the logs, e.g. `bucket-owner-full-control`.
-      If `canned_cal` is set, please make sure the cluster iam role has `s3:PutObjectAcl` permission on
-      the destination bucket and prefix. The full list of possible canned acl can be found at
-      http://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl.
-      Please also note that by default only the object owner gets full controls. If you are using cross account
-      role for writing data, you may want to set `bucket-owner-full-control` to make bucket owner able to
-      read the logs.
-  "destination":
-    "description": |-
-      S3 destination, e.g. `s3://my-bucket/some-prefix` Note that logs will be delivered using
-      cluster iam role, please make sure you set cluster iam role and the role has write access to the
-      destination. Please also note that you cannot use AWS keys to deliver logs.
-  "enable_encryption":
-    "description": |-
-      (Optional) Flag to enable server side encryption, `false` by default.
-  "encryption_type":
-    "description": |-
-      (Optional) The encryption type, it could be `sse-s3` or `sse-kms`. It will be used only when
-      encryption is enabled and the default type is `sse-s3`.
-  "endpoint":
-    "description": |-
-      S3 endpoint, e.g. `https://s3-us-west-2.amazonaws.com`. Either region or endpoint needs to be set.
-      If both are set, endpoint will be used.
-  "kms_key":
-    "description": |-
-      (Optional) Kms key which will be used if encryption is enabled and encryption type is set to `sse-kms`.
-  "region":
-    "description": |-
-      S3 region, e.g. `us-west-2`. Either region or endpoint needs to be set. If both are set,
-      endpoint will be used.
-github.com/databricks/databricks-sdk-go/service/compute.VolumesStorageInfo:
-  "_":
-    "description": |-
-      A storage location back by UC Volumes.
-  "destination":
-    "description": |-
-      UC Volumes destination, e.g. `/Volumes/catalog/schema/vol1/init-scripts/setup-datadog.sh`
-      or `dbfs:/Volumes/catalog/schema/vol1/init-scripts/setup-datadog.sh`
-github.com/databricks/databricks-sdk-go/service/compute.WorkloadType:
-  "_":
-    "description": |-
-      Cluster Attributes showing for clusters workload types.
-  "clients":
-    "description": |-
-      defined what type of clients can use the cluster. E.g. Notebooks, Jobs
-github.com/databricks/databricks-sdk-go/service/compute.WorkspaceStorageInfo:
-  "_":
-    "description": |-
-      A storage location in Workspace Filesystem (WSFS)
-  "destination":
-    "description": |-
-      wsfs destination, e.g. `workspace:/cluster-init-scripts/setup-datadog.sh`
-github.com/databricks/databricks-sdk-go/service/dashboards.LifecycleState:
-  "_":
-    "enum":
-      - |-
-        ACTIVE
-      - |-
-        TRASHED
-github.com/databricks/databricks-sdk-go/service/database.CustomTag:
-  "key":
-    "description": |-
-      The key of the custom tag.
-  "value":
-    "description": |-
-      The value of the custom tag.
-github.com/databricks/databricks-sdk-go/service/database.DatabaseInstanceRef:
-  "_":
-    "description": |-
-      DatabaseInstanceRef is a reference to a database instance. It is used in the
-      DatabaseInstance object to refer to the parent instance of an instance and
-      to refer the child instances of an instance.
-      To specify as a parent instance during creation of an instance,
-      the lsn and branch_time fields are optional. If not specified, the child
-      instance will be created from the latest lsn of the parent.
-      If both lsn and branch_time are specified, the lsn will be used to create
-      the child instance.
-  "branch_time":
-    "description": |-
-      Branch time of the ref database instance.
-      For a parent ref instance, this is the point in time on the parent instance from which the
-      instance was created.
-      For a child ref instance, this is the point in time on the instance from which the child
-      instance was created.
-      Input: For specifying the point in time to create a child instance. Optional.
-      Output: Only populated if provided as input to create a child instance.
-  "effective_lsn":
-    "description": |-
-      For a parent ref instance, this is the LSN on the parent instance from which the
-      instance was created.
-      For a child ref instance, this is the LSN on the instance from which the child instance
-      was created.
-      This is an output only field that contains the value computed from the input field combined with
-      server side defaults. Use the field without the effective_ prefix to set the value.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "lsn":
-    "description": |-
-      User-specified WAL LSN of the ref database instance.
-
-      Input: For specifying the WAL LSN to create a child instance. Optional.
-      Output: Only populated if provided as input to create a child instance.
-  "name":
-    "description": |-
-      Name of the ref database instance.
-  "uid":
-    "description": |-
-      Id of the ref database instance.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-github.com/databricks/databricks-sdk-go/service/database.DatabaseInstanceState:
-  "_":
-    "enum":
-      - |-
-        STARTING
-      - |-
-        AVAILABLE
-      - |-
-        DELETING
-      - |-
-        STOPPED
-      - |-
-        UPDATING
-      - |-
-        FAILING_OVER
-github.com/databricks/databricks-sdk-go/service/database.DeltaTableSyncInfo:
-  "delta_commit_timestamp":
-    "description": |-
-      The timestamp when the above Delta version was committed in the source Delta table.
-      Note: This is the Delta commit time, not the time the data was written to the synced table.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "delta_commit_version":
-    "description": |-
-      The Delta Lake commit version that was last successfully synced.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-github.com/databricks/databricks-sdk-go/service/database.NewPipelineSpec:
-  "_":
-    "description": |-
-      Custom fields that user can set for pipeline while creating SyncedDatabaseTable.
-      Note that other fields of pipeline are still inferred by table def internally
-  "budget_policy_id":
-    "description": |-
-      Budget policy to set on the newly created pipeline.
-  "storage_catalog":
-    "description": |-
-      This field needs to be specified if the destination catalog is a managed postgres catalog.
-
-      UC catalog for the pipeline to store intermediate files (checkpoints, event logs etc).
-      This needs to be a standard catalog where the user has permissions to create Delta tables.
-  "storage_schema":
-    "description": |-
-      This field needs to be specified if the destination catalog is a managed postgres catalog.
-
-      UC schema for the pipeline to store intermediate files (checkpoints, event logs etc).
-      This needs to be in the standard catalog where the user has permissions to create Delta tables.
-github.com/databricks/databricks-sdk-go/service/database.ProvisioningInfoState:
-  "_":
-    "enum":
-      - |-
-        PROVISIONING
-      - |-
-        ACTIVE
-      - |-
-        FAILED
-      - |-
-        DELETING
-      - |-
-        UPDATING
-      - |-
-        DEGRADED
-github.com/databricks/databricks-sdk-go/service/database.ProvisioningPhase:
-  "_":
-    "enum":
-      - |-
-        PROVISIONING_PHASE_MAIN
-      - |-
-        PROVISIONING_PHASE_INDEX_SCAN
-      - |-
-        PROVISIONING_PHASE_INDEX_SORT
-github.com/databricks/databricks-sdk-go/service/database.SyncedTableContinuousUpdateStatus:
-  "_":
-    "description": |-
-      Detailed status of a synced table. Shown if the synced table is in the SYNCED_CONTINUOUS_UPDATE
-      or the SYNCED_UPDATING_PIPELINE_RESOURCES state.
-  "initial_pipeline_sync_progress":
-    "description": |-
-      Progress of the initial data synchronization.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "last_processed_commit_version":
-    "description": |-
-      The last source table Delta version that was successfully synced to the synced table.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "timestamp":
-    "description": |-
-      The end timestamp of the last time any data was synchronized from the source table to the synced
-      table. This is when the data is available in the synced table.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-github.com/databricks/databricks-sdk-go/service/database.SyncedTableFailedStatus:
-  "_":
-    "description": |-
-      Detailed status of a synced table. Shown if the synced table is in the OFFLINE_FAILED or the
-      SYNCED_PIPELINE_FAILED state.
-  "last_processed_commit_version":
-    "description": |-
-      The last source table Delta version that was successfully synced to the synced table.
-      The last source table Delta version that was synced to the synced table.
-      Only populated if the table is still
-      synced and available for serving.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "timestamp":
-    "description": |-
-      The end timestamp of the last time any data was synchronized from the source table to the synced
-      table. Only populated if the table is still synced and available for serving.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-github.com/databricks/databricks-sdk-go/service/database.SyncedTablePipelineProgress:
-  "_":
-    "description": |-
-      Progress information of the Synced Table data synchronization pipeline.
-  "estimated_completion_time_seconds":
-    "description": |-
-      The estimated time remaining to complete this update in seconds.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "latest_version_currently_processing":
-    "description": |-
-      The source table Delta version that was last processed by the pipeline. The pipeline may not
-      have completely processed this version yet.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "provisioning_phase":
-    "description": |-
-      The current phase of the data synchronization pipeline.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "sync_progress_completion":
-    "description": |-
-      The completion ratio of this update. This is a number between 0 and 1.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "synced_row_count":
-    "description": |-
-      The number of rows that have been synced in this update.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "total_row_count":
-    "description": |-
-      The total number of rows that need to be synced in this update. This number may be an estimate.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-github.com/databricks/databricks-sdk-go/service/database.SyncedTablePosition:
-  "delta_table_sync_info":
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "sync_end_timestamp":
-    "description": |-
-      The end timestamp of the most recent successful synchronization.
-      This is the time when the data is available in the synced table.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "sync_start_timestamp":
-    "description": |-
-      The starting timestamp of the most recent successful synchronization from the source table
-      to the destination (synced) table.
-      Note this is the starting timestamp of the sync operation, not the end time.
-      E.g., for a batch, this is the time when the sync operation started.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-github.com/databricks/databricks-sdk-go/service/database.SyncedTableProvisioningStatus:
-  "_":
-    "description": |-
-      Detailed status of a synced table. Shown if the synced table is in the
-      PROVISIONING_PIPELINE_RESOURCES or the PROVISIONING_INITIAL_SNAPSHOT state.
-  "initial_pipeline_sync_progress":
-    "description": |-
-      Details about initial data synchronization. Only populated when in the
-      PROVISIONING_INITIAL_SNAPSHOT state.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-github.com/databricks/databricks-sdk-go/service/database.SyncedTableSchedulingPolicy:
-  "_":
-    "enum":
-      - |-
-        CONTINUOUS
-      - |-
-        TRIGGERED
-      - |-
-        SNAPSHOT
-github.com/databricks/databricks-sdk-go/service/database.SyncedTableSpec:
-  "_":
-    "description": |-
-      Specification of a synced database table.
-  "create_database_objects_if_missing":
-    "description": |-
-      If true, the synced table's logical database and schema resources in PG
-      will be created if they do not already exist.
-  "existing_pipeline_id":
-    "description": |-
-      At most one of existing_pipeline_id and new_pipeline_spec should be defined.
-
-      If existing_pipeline_id is defined, the synced table will be bin packed into the existing pipeline
-      referenced. This avoids creating a new pipeline and allows sharing existing compute.
-      In this case, the scheduling_policy of this synced table must match the scheduling policy of the existing pipeline.
-  "new_pipeline_spec":
-    "description": |-
-      At most one of existing_pipeline_id and new_pipeline_spec should be defined.
-
-      If new_pipeline_spec is defined, a new pipeline is created for this synced table. The location pointed to is used
-      to store intermediate files (checkpoints, event logs etc). The caller must have write permissions to create Delta
-      tables in the specified catalog and schema. Again, note this requires write permissions, whereas the source table
-      only requires read permissions.
-  "primary_key_columns":
-    "description": |-
-      Primary Key columns to be used for data insert/update in the destination.
-  "scheduling_policy":
-    "description": |-
-      Scheduling policy of the underlying pipeline.
-  "source_table_full_name":
-    "description": |-
-      Three-part (catalog, schema, table) name of the source Delta table.
-  "timeseries_key":
-    "description": |-
-      Time series key to deduplicate (tie-break) rows with the same primary key.
-github.com/databricks/databricks-sdk-go/service/database.SyncedTableState:
-  "_":
-    "description": |-
-      The state of a synced table.
-    "enum":
-      - |-
-        SYNCED_TABLE_PROVISIONING
-      - |-
-        SYNCED_TABLE_PROVISIONING_PIPELINE_RESOURCES
-      - |-
-        SYNCED_TABLE_PROVISIONING_INITIAL_SNAPSHOT
-      - |-
-        SYNCED_TABLE_ONLINE
-      - |-
-        SYNCED_TABLE_ONLINE_CONTINUOUS_UPDATE
-      - |-
-        SYNCED_TABLE_ONLINE_TRIGGERED_UPDATE
-      - |-
-        SYNCED_TABLE_ONLINE_NO_PENDING_UPDATE
-      - |-
-        SYNCED_TABLED_OFFLINE
-      - |-
-        SYNCED_TABLE_OFFLINE_FAILED
-      - |-
-        SYNCED_TABLE_ONLINE_PIPELINE_FAILED
-      - |-
-        SYNCED_TABLE_ONLINE_UPDATING_PIPELINE_RESOURCES
-github.com/databricks/databricks-sdk-go/service/database.SyncedTableStatus:
-  "_":
-    "description": |-
-      Status of a synced table.
-  "continuous_update_status":
-    "description": |-
-      Detailed status of a synced table. Shown if the synced table is in the SYNCED_CONTINUOUS_UPDATE
-      or the SYNCED_UPDATING_PIPELINE_RESOURCES state.
-  "detailed_state":
-    "description": |-
-      The state of the synced table.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "failed_status":
-    "description": |-
-      Detailed status of a synced table. Shown if the synced table is in the OFFLINE_FAILED or the
-      SYNCED_PIPELINE_FAILED state.
-  "last_sync":
-    "description": |-
-      Summary of the last successful synchronization from source to destination.
-
-      Will always be present if there has been a successful sync. Even if the most recent syncs have failed.
-
-      Limitation:
-      The only exception is if the synced table is doing a FULL REFRESH, then the last sync information
-      will not be available until the full refresh is complete. This limitation will be addressed in a future version.
-
-      This top-level field is a convenience for consumers who want easy access to last sync information
-      without having to traverse detailed_status.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "message":
-    "description": |-
-      A text description of the current state of the synced table.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "pipeline_id":
-    "description": |-
-      ID of the associated pipeline. The pipeline ID may have been provided by the client
-      (in the case of bin packing), or generated by the server (when creating a new pipeline).
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "provisioning_status":
-    "description": |-
-      Detailed status of a synced table. Shown if the synced table is in the
-      PROVISIONING_PIPELINE_RESOURCES or the PROVISIONING_INITIAL_SNAPSHOT state.
-  "triggered_update_status":
-    "description": |-
-      Detailed status of a synced table. Shown if the synced table is in the SYNCED_TRIGGERED_UPDATE
-      or the SYNCED_NO_PENDING_UPDATE state.
-github.com/databricks/databricks-sdk-go/service/database.SyncedTableTriggeredUpdateStatus:
-  "_":
-    "description": |-
-      Detailed status of a synced table. Shown if the synced table is in the SYNCED_TRIGGERED_UPDATE
-      or the SYNCED_NO_PENDING_UPDATE state.
-  "last_processed_commit_version":
-    "description": |-
-      The last source table Delta version that was successfully synced to the synced table.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "timestamp":
-    "description": |-
-      The end timestamp of the last time any data was synchronized from the source table to the synced
-      table. This is when the data is available in the synced table.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "triggered_update_progress":
-    "description": |-
-      Progress of the active data synchronization pipeline.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-github.com/databricks/databricks-sdk-go/service/iam.PermissionLevel:
-  "_":
-    "description": |-
-      Permission level
-    "enum":
-      - |-
-        CAN_MANAGE
-      - |-
-        CAN_RESTART
-      - |-
-        CAN_ATTACH_TO
-      - |-
-        IS_OWNER
-      - |-
-        CAN_MANAGE_RUN
-      - |-
-        CAN_VIEW
-      - |-
-        CAN_READ
-      - |-
-        CAN_RUN
-      - |-
-        CAN_EDIT
-      - |-
-        CAN_USE
-      - |-
-        CAN_MANAGE_STAGING_VERSIONS
-      - |-
-        CAN_MANAGE_PRODUCTION_VERSIONS
-      - |-
-        CAN_EDIT_METADATA
-      - |-
-        CAN_VIEW_METADATA
-      - |-
-        CAN_BIND
-      - |-
-        CAN_QUERY
-      - |-
-        CAN_MONITOR
-      - |-
-        CAN_CREATE
-      - |-
-        CAN_MONITOR_ONLY
-      - |-
-        CAN_CREATE_APP
-github.com/databricks/databricks-sdk-go/service/jobs.AlertTask:
-  "alert_id":
-    "description": |-
-      The alert_id is the canonical identifier of the alert.
-  "subscribers":
-    "description": |-
-      The subscribers receive alert evaluation result notifications after the alert task is completed.
-      The number of subscriptions is limited to 100.
-  "warehouse_id":
-    "description": |-
-      The warehouse_id identifies the warehouse settings used by the alert task.
-  "workspace_path":
-    "description": |-
-      The workspace_path is the path to the alert file in the workspace. The path:
-      * must start with "/Workspace"
-      * must be a normalized path.
-      User has to select only one of alert_id or workspace_path to identify the alert.
-github.com/databricks/databricks-sdk-go/service/jobs.AlertTaskSubscriber:
-  "_":
-    "description": |-
-      Represents a subscriber that will receive alert notifications.
-      A subscriber can be either a user (via email) or a notification destination (via destination_id).
-  "destination_id": {}
-  "user_name":
-    "description": |-
-      A valid workspace email address.
-github.com/databricks/databricks-sdk-go/service/jobs.AuthenticationMethod:
-  "_":
-    "enum":
-      - |-
-        OAUTH
-      - |-
-        PAT
-github.com/databricks/databricks-sdk-go/service/jobs.CleanRoomsNotebookTask:
-  "_":
-    "description": |-
-      Clean Rooms notebook task for V1 Clean Room service (GA).
-      Replaces the deprecated CleanRoomNotebookTask (defined above) which was for V0 service.
-  "clean_room_name":
-    "description": |-
-      The clean room that the notebook belongs to.
-  "etag":
-    "description": |-
-      Checksum to validate the freshness of the notebook resource (i.e. the notebook being run is the latest version).
-      It can be fetched by calling the :method:cleanroomassets/get API.
-  "notebook_base_parameters":
-    "description": |-
-      Base parameters to be used for the clean room notebook job.
-  "notebook_name":
-    "description": |-
-      Name of the notebook being run.
-github.com/databricks/databricks-sdk-go/service/jobs.Compute:
-  "hardware_accelerator":
-    "description": |-
-      Hardware accelerator configuration for Serverless GPU workloads.
-github.com/databricks/databricks-sdk-go/service/jobs.ComputeConfig:
-  "gpu_node_pool_id":
-    "description": |-
-      IDof the GPU pool to use.
-  "gpu_type":
-    "description": |-
-      GPU type.
-  "num_gpus":
-    "description": |-
-      Number of GPUs.
-github.com/databricks/databricks-sdk-go/service/jobs.Condition:
-  "_":
-    "enum":
-      - |-
-        ANY_UPDATED
-      - |-
-        ALL_UPDATED
-github.com/databricks/databricks-sdk-go/service/jobs.ConditionTask:
-  "left":
-    "description": |-
-      The left operand of the condition task. Can be either a string value or a job state or parameter reference.
-  "op":
-    "description": |-
-      * `EQUAL_TO`, `NOT_EQUAL` operators perform string comparison of their operands. This means that `“12.0” == “12”` will evaluate to `false`.
-      * `GREATER_THAN`, `GREATER_THAN_OR_EQUAL`, `LESS_THAN`, `LESS_THAN_OR_EQUAL` operators perform numeric comparison of their operands. `“12.0” >= “12”` will evaluate to `true`, `“10.0” >= “12”` will evaluate to `false`.
-
-      The boolean comparison to task values can be implemented with operators `EQUAL_TO`, `NOT_EQUAL`. If a task value was set to a boolean value, it will be serialized to `“true”` or `“false”` for the comparison.
-  "right":
-    "description": |-
-      The right operand of the condition task. Can be either a string value or a job state or parameter reference.
-github.com/databricks/databricks-sdk-go/service/jobs.ConditionTaskOp:
-  "_":
-    "description": |-
-      * `EQUAL_TO`, `NOT_EQUAL` operators perform string comparison of their operands. This means that `“12.0” == “12”` will evaluate to `false`.
-      * `GREATER_THAN`, `GREATER_THAN_OR_EQUAL`, `LESS_THAN`, `LESS_THAN_OR_EQUAL` operators perform numeric comparison of their operands. `“12.0” >= “12”` will evaluate to `true`, `“10.0” >= “12”` will evaluate to `false`.
-
-      The boolean comparison to task values can be implemented with operators `EQUAL_TO`, `NOT_EQUAL`. If a task value was set to a boolean value, it will be serialized to `“true”` or `“false”` for the comparison.
-    "enum":
-      - |-
-        EQUAL_TO
-      - |-
-        GREATER_THAN
-      - |-
-        GREATER_THAN_OR_EQUAL
-      - |-
-        LESS_THAN
-      - |-
-        LESS_THAN_OR_EQUAL
-      - |-
-        NOT_EQUAL
-github.com/databricks/databricks-sdk-go/service/jobs.Continuous:
-  "pause_status":
-    "description": |-
-      Indicate whether the continuous execution of the job is paused or not. Defaults to UNPAUSED.
-  "task_retry_mode":
-    "description": |-
-      Indicate whether the continuous job is applying task level retries or not. Defaults to NEVER.
-github.com/databricks/databricks-sdk-go/service/jobs.CronSchedule:
-  "pause_status":
-    "description": |-
-      Indicate whether this schedule is paused or not.
-  "quartz_cron_expression":
-    "description": |-
-      A Cron expression using Quartz syntax that describes the schedule for a job. See [Cron Trigger](http://www.quartz-scheduler.org/documentation/quartz-2.3.0/tutorials/crontrigger.html) for details. This field is required.
-  "timezone_id":
-    "description": |-
-      A Java timezone ID. The schedule for a job is resolved with respect to this timezone. See [Java TimeZone](https://docs.oracle.com/javase/7/docs/api/java/util/TimeZone.html) for details. This field is required.
-github.com/databricks/databricks-sdk-go/service/jobs.DashboardTask:
-  "_":
-    "description": |-
-      Configures the Lakeview Dashboard job task type.
-  "dashboard_id":
-    "description": |-
-      The identifier of the dashboard to refresh.
-  "filters":
-    "description": |-
-      Dashboard task parameters. Used to apply dashboard filter values during dashboard task execution. Parameter values get applied to any dashboard filters that have a matching URL identifier as the parameter key.
-      The parameter value format is dependent on the filter type:
-      - For text and single-select filters, provide a single value (e.g. `"value"`)
-      - For date and datetime filters, provide the value in ISO 8601 format (e.g. `"2000-01-01T00:00:00"`)
-      - For multi-select filters, provide a JSON array of values (e.g. `"[\"value1\",\"value2\"]"`)
-      - For range and date range filters, provide a JSON object with `start` and `end` (e.g. `"{\"start\":\"1\",\"end\":\"10\"}"`)
-    "x-databricks-preview": |-
-      PRIVATE
-  "subscription":
-    "description": |-
-      Optional: subscription configuration for sending the dashboard snapshot.
-  "warehouse_id":
-    "description": |-
-      Optional: The warehouse id to execute the dashboard with for the schedule.
-      If not specified, the default warehouse of the dashboard will be used.
-github.com/databricks/databricks-sdk-go/service/jobs.DbtCloudTask:
-  "_":
-    "description": |-
-      Deprecated in favor of DbtPlatformTask
-  "connection_resource_name":
-    "description": |-
-      The resource name of the UC connection that authenticates the dbt Cloud for this task
-  "dbt_cloud_job_id":
-    "description": |-
-      Id of the dbt Cloud job to be triggered
-github.com/databricks/databricks-sdk-go/service/jobs.DbtPlatformTask:
-  "connection_resource_name":
-    "description": |-
-      The resource name of the UC connection that authenticates the dbt platform for this task
-  "dbt_platform_job_id":
-    "description": |-
-      Id of the dbt platform job to be triggered. Specified as a string for maximum compatibility with clients.
-github.com/databricks/databricks-sdk-go/service/jobs.DbtTask:
-  "catalog":
-    "description": |-
-      Optional name of the catalog to use. The value is the top level in the 3-level namespace of Unity Catalog (catalog / schema / relation). The catalog value can only be specified if a warehouse_id is specified. Requires dbt-databricks >= 1.1.1.
-  "commands":
-    "description": |-
-      A list of dbt commands to execute. All commands must start with `dbt`. This parameter must not be empty. A maximum of up to 10 commands can be provided.
-  "profiles_directory":
-    "description": |-
-      Optional (relative) path to the profiles directory. Can only be specified if no warehouse_id is specified. If no warehouse_id is specified and this folder is unset, the root directory is used.
-  "project_directory":
-    "description": |-
-      Path to the project directory. Optional for Git sourced tasks, in which
-      case if no value is provided, the root of the Git repository is used.
-  "schema":
-    "description": |-
-      Optional schema to write to. This parameter is only used when a warehouse_id is also provided. If not provided, the `default` schema is used.
-  "source":
-    "description": |-
-      Optional location type of the project directory. When set to `WORKSPACE`, the project will be retrieved
-      from the local Databricks workspace. When set to `GIT`, the project will be retrieved from a Git repository
-      defined in `git_source`. If the value is empty, the task will use `GIT` if `git_source` is defined and `WORKSPACE` otherwise.
-
-      * `WORKSPACE`: Project is located in Databricks workspace.
-      * `GIT`: Project is located in cloud Git provider.
-  "warehouse_id":
-    "description": |-
-      ID of the SQL warehouse to connect to. If provided, we automatically generate and provide the profile and connection details to dbt. It can be overridden on a per-command basis by using the `--profiles-dir` command line argument.
-github.com/databricks/databricks-sdk-go/service/jobs.FileArrivalTriggerConfiguration:
-  "min_time_between_triggers_seconds":
-    "description": |-
-      If set, the trigger starts a run only after the specified amount of time passed since
-      the last time the trigger fired. The minimum allowed value is 60 seconds
-  "url":
-    "description": |-
-      URL to be monitored for file arrivals. The path must point to the root or a subpath of the external location.
-  "wait_after_last_change_seconds":
-    "description": |-
-      If set, the trigger starts a run only after no file activity has occurred for the specified amount of time.
-      This makes it possible to wait for a batch of incoming files to arrive before triggering a run. The
-      minimum allowed value is 60 seconds.
-github.com/databricks/databricks-sdk-go/service/jobs.ForEachTask:
-  "concurrency":
-    "description": |-
-      An optional maximum allowed number of concurrent runs of the task.
-      Set this value if you want to be able to execute multiple runs of the task concurrently.
-  "inputs":
-    "description": |-
-      Array for task to iterate on. This can be a JSON string or a reference to
-      an array parameter.
-  "task":
-    "description": |-
-      Configuration for the task that will be run for each element in the array
-github.com/databricks/databricks-sdk-go/service/jobs.Format:
-  "_":
-    "enum":
-      - |-
-        SINGLE_TASK
-      - |-
-        MULTI_TASK
-github.com/databricks/databricks-sdk-go/service/jobs.GenAiComputeTask:
-  "command":
-    "description": |-
-      Command launcher to run the actual script, e.g. bash, python etc.
-  "compute": {}
-  "dl_runtime_image":
-    "description": |-
-      Runtime image
-  "mlflow_experiment_name":
-    "description": |-
-      Optional string containing the name of the MLflow experiment to log the run to. If name is not
-      found, backend will create the mlflow experiment using the name.
-  "source":
-    "description": |-
-      Optional location type of the training script. When set to `WORKSPACE`, the script will be retrieved from the local Databricks workspace. When set to `GIT`, the script will be retrieved from a Git repository
-      defined in `git_source`. If the value is empty, the task will use `GIT` if `git_source` is defined and `WORKSPACE` otherwise.
-      * `WORKSPACE`: Script is located in Databricks workspace.
-      * `GIT`: Script is located in cloud Git provider.
-  "training_script_path":
-    "description": |-
-      The training script file path to be executed. Cloud file URIs (such as dbfs:/, s3:/, adls:/, gcs:/) and workspace paths are supported. For python files stored in the Databricks workspace, the path must be absolute and begin with `/`. For files stored in a remote repository, the path must be relative. This field is required.
-  "yaml_parameters":
-    "description": |-
-      Optional string containing model parameters passed to the training script in yaml format.
-      If present, then the content in yaml_parameters_file_path will be ignored.
-  "yaml_parameters_file_path":
-    "description": |-
-      Optional path to a YAML file containing model parameters passed to the training script.
-github.com/databricks/databricks-sdk-go/service/jobs.GitProvider:
-  "_":
-    "enum":
-      - |-
-        gitHub
-      - |-
-        bitbucketCloud
-      - |-
-        azureDevOpsServices
-      - |-
-        gitHubEnterprise
-      - |-
-        bitbucketServer
-      - |-
-        gitLab
-      - |-
-        gitLabEnterpriseEdition
-      - |-
-        awsCodeCommit
-github.com/databricks/databricks-sdk-go/service/jobs.GitSnapshot:
-  "_":
-    "description": |-
-      Read-only state of the remote repository at the time the job was run. This field is only included on job runs.
-  "used_commit":
-    "description": |-
-      Commit that was used to execute the run. If git_branch was specified, this points to the HEAD of the branch at the time of the run; if git_tag was specified, this points to the commit the tag points to.
-github.com/databricks/databricks-sdk-go/service/jobs.GitSource:
-  "_":
-    "description": |-
-      An optional specification for a remote Git repository containing the source code used by tasks. Version-controlled source code is supported by notebook, dbt, Python script, and SQL File tasks.
-
-      If `git_source` is set, these tasks retrieve the file from the remote repository by default. However, this behavior can be overridden by setting `source` to `WORKSPACE` on the task.
-
-      Note: dbt and SQL File tasks support only version-controlled sources. If dbt or SQL File tasks are used, `git_source` must be defined on the job.
-  "git_branch":
-    "description": |-
-      Name of the branch to be checked out and used by this job. This field cannot be specified in conjunction with git_tag or git_commit.
-  "git_commit":
-    "description": |-
-      Commit to be checked out and used by this job. This field cannot be specified in conjunction with git_branch or git_tag.
-  "git_provider":
-    "description": |-
-      Unique identifier of the service used to host the Git repository. The value is case insensitive.
-  "git_snapshot":
-    "description": |-
-      Read-only state of the remote repository at the time the job was run. This field is only included on job runs.
-  "git_tag":
-    "description": |-
-      Name of the tag to be checked out and used by this job. This field cannot be specified in conjunction with git_branch or git_commit.
-  "git_url":
-    "description": |-
-      URL of the repository to be cloned by this job.
-  "job_source":
-    "description": |-
-      The source of the job specification in the remote repository when the job is source controlled.
-    "deprecation_message": |-
-      This field is deprecated
-    "x-databricks-preview": |-
-      PRIVATE
-  "sparse_checkout": {}
-github.com/databricks/databricks-sdk-go/service/jobs.JobCluster:
-  "job_cluster_key":
-    "description": |-
-      A unique name for the job cluster. This field is required and must be unique within the job.
-      `JobTaskSettings` may refer to this field to determine which cluster to launch for the task execution.
-  "new_cluster":
-    "description": |-
-      If new_cluster, a description of a cluster that is created for each task.
-github.com/databricks/databricks-sdk-go/service/jobs.JobDeployment:
-  "kind":
-    "description": |-
-      The kind of deployment that manages the job.
-
-      * `BUNDLE`: The job is managed by Databricks Asset Bundle.
-      * `SYSTEM_MANAGED`: The job is managed by Databricks and is read-only.
-  "metadata_file_path":
-    "description": |-
-      Path of the file that contains deployment metadata.
-github.com/databricks/databricks-sdk-go/service/jobs.JobDeploymentKind:
-  "_":
-    "description": |-
-      * `BUNDLE`: The job is managed by Databricks Asset Bundle.
-      * `SYSTEM_MANAGED`: The job is managed by Databricks and is read-only.
-    "enum":
-      - |-
-        BUNDLE
-      - |-
-        SYSTEM_MANAGED
-github.com/databricks/databricks-sdk-go/service/jobs.JobEditMode:
-  "_":
-    "description": |-
-      Edit mode of the job.
-
-      * `UI_LOCKED`: The job is in a locked UI state and cannot be modified.
-      * `EDITABLE`: The job is in an editable state and can be modified.
-    "enum":
-      - |-
-        UI_LOCKED
-      - |-
-        EDITABLE
-github.com/databricks/databricks-sdk-go/service/jobs.JobEmailNotifications:
-  "no_alert_for_skipped_runs":
-    "description": |-
-      If true, do not send email to recipients specified in `on_failure` if the run is skipped.
-      This field is `deprecated`. Please use the `notification_settings.no_alert_for_skipped_runs` field.
-    "deprecation_message": |-
-      This field is deprecated
-  "on_duration_warning_threshold_exceeded":
-    "description": |-
-      A list of email addresses to be notified when the duration of a run exceeds the threshold specified for the `RUN_DURATION_SECONDS` metric in the `health` field. If no rule for the `RUN_DURATION_SECONDS` metric is specified in the `health` field for the job, notifications are not sent.
-  "on_failure":
-    "description": |-
-      A list of email addresses to be notified when a run unsuccessfully completes. A run is considered to have completed unsuccessfully if it ends with an `INTERNAL_ERROR` `life_cycle_state` or a `FAILED`, or `TIMED_OUT` result_state. If this is not specified on job creation, reset, or update the list is empty, and notifications are not sent.
-  "on_start":
-    "description": |-
-      A list of email addresses to be notified when a run begins. If not specified on job creation, reset, or update, the list is empty, and notifications are not sent.
-  "on_streaming_backlog_exceeded":
-    "description": |-
-      A list of email addresses to notify when any streaming backlog thresholds are exceeded for any stream.
-      Streaming backlog thresholds can be set in the `health` field using the following metrics: `STREAMING_BACKLOG_BYTES`, `STREAMING_BACKLOG_RECORDS`, `STREAMING_BACKLOG_SECONDS`, or `STREAMING_BACKLOG_FILES`.
-      Alerting is based on the 10-minute average of these metrics. If the issue persists, notifications are resent every 30 minutes.
-  "on_success":
-    "description": |-
-      A list of email addresses to be notified when a run successfully completes. A run is considered to have completed successfully if it ends with a `TERMINATED` `life_cycle_state` and a `SUCCESS` result_state. If not specified on job creation, reset, or update, the list is empty, and notifications are not sent.
-github.com/databricks/databricks-sdk-go/service/jobs.JobEnvironment:
-  "environment_key":
-    "description": |-
-      The key of an environment. It has to be unique within a job.
-  "spec":
-    "description": |-
-      The environment entity used to preserve serverless environment side panel, jobs' environment for non-notebook task, and DLT's environment for classic and serverless pipelines.
-      In this minimal environment spec, only pip and java dependencies are supported.
-github.com/databricks/databricks-sdk-go/service/jobs.JobNotificationSettings:
-  "no_alert_for_canceled_runs":
-    "description": |-
-      If true, do not send notifications to recipients specified in `on_failure` if the run is canceled.
-  "no_alert_for_skipped_runs":
-    "description": |-
-      If true, do not send notifications to recipients specified in `on_failure` if the run is skipped.
-github.com/databricks/databricks-sdk-go/service/jobs.JobParameterDefinition:
-  "default":
-    "description": |-
-      Default value of the parameter.
-  "name":
-    "description": |-
-      The name of the defined parameter. May only contain alphanumeric characters, `_`, `-`, and `.`
-github.com/databricks/databricks-sdk-go/service/jobs.JobPermissionLevel:
-  "_":
-    "description": |-
-      Permission level
-    "enum":
-      - |-
-        CAN_MANAGE
-      - |-
-        IS_OWNER
-      - |-
-        CAN_MANAGE_RUN
-      - |-
-        CAN_VIEW
-github.com/databricks/databricks-sdk-go/service/jobs.JobRunAs:
-  "_":
-    "description": |-
-      Write-only setting. Specifies the user or service principal that the job runs as. If not specified, the job runs as the user who created the job.
-
-      Either `user_name` or `service_principal_name` should be specified. If not, an error is thrown.
-  "group_name":
-    "description": |-
-      Group name of an account group assigned to the workspace. Setting this field requires being a member of the group.
-    "x-databricks-preview": |-
-      PRIVATE
-  "service_principal_name":
-    "description": |-
-      Application ID of an active service principal. Setting this field requires the `servicePrincipal/user` role.
-  "user_name":
-    "description": |-
-      The email of an active workspace user. Non-admin users can only set this field to their own email.
-github.com/databricks/databricks-sdk-go/service/jobs.JobSource:
-  "_":
-    "description": |-
-      The source of the job specification in the remote repository when the job is source controlled.
-  "dirty_state":
-    "description": |-
-      Dirty state indicates the job is not fully synced with the job specification in the remote repository.
-
-      Possible values are:
-      * `NOT_SYNCED`: The job is not yet synced with the remote job specification. Import the remote job specification from UI to make the job fully synced.
-      * `DISCONNECTED`: The job is temporary disconnected from the remote job specification and is allowed for live edit. Import the remote job specification again from UI to make the job fully synced.
-  "import_from_git_branch":
-    "description": |-
-      Name of the branch which the job is imported from.
-  "job_config_path":
-    "description": |-
-      Path of the job YAML file that contains the job specification.
-github.com/databricks/databricks-sdk-go/service/jobs.JobSourceDirtyState:
-  "_":
-    "description": |-
-      Dirty state indicates the job is not fully synced with the job specification
-      in the remote repository.
-
-      Possible values are:
-      * `NOT_SYNCED`: The job is not yet synced with the remote job specification. Import the remote job specification from UI to make the job fully synced.
-      * `DISCONNECTED`: The job is temporary disconnected from the remote job specification and is allowed for live edit. Import the remote job specification again from UI to make the job fully synced.
-    "enum":
-      - |-
-        NOT_SYNCED
-      - |-
-        DISCONNECTED
-github.com/databricks/databricks-sdk-go/service/jobs.JobsHealthMetric:
-  "_":
-    "description": |-
-      Specifies the health metric that is being evaluated for a particular health rule.
-
-      * `RUN_DURATION_SECONDS`: Expected total time for a run in seconds.
-      * `STREAMING_BACKLOG_BYTES`: An estimate of the maximum bytes of data waiting to be consumed across all streams. This metric is in Public Preview.
-      * `STREAMING_BACKLOG_RECORDS`: An estimate of the maximum offset lag across all streams. This metric is in Public Preview.
-      * `STREAMING_BACKLOG_SECONDS`: An estimate of the maximum consumer delay across all streams. This metric is in Public Preview.
-      * `STREAMING_BACKLOG_FILES`: An estimate of the maximum number of outstanding files across all streams. This metric is in Public Preview.
-    "enum":
-      - |-
-        RUN_DURATION_SECONDS
-      - |-
-        STREAMING_BACKLOG_BYTES
-      - |-
-        STREAMING_BACKLOG_RECORDS
-      - |-
-        STREAMING_BACKLOG_SECONDS
-      - |-
-        STREAMING_BACKLOG_FILES
-github.com/databricks/databricks-sdk-go/service/jobs.JobsHealthOperator:
-  "_":
-    "description": |-
-      Specifies the operator used to compare the health metric value with the specified threshold.
-    "enum":
-      - |-
-        GREATER_THAN
-github.com/databricks/databricks-sdk-go/service/jobs.JobsHealthRule:
-  "metric":
-    "description": |-
-      Specifies the health metric that is being evaluated for a particular health rule.
-
-      * `RUN_DURATION_SECONDS`: Expected total time for a run in seconds.
-      * `STREAMING_BACKLOG_BYTES`: An estimate of the maximum bytes of data waiting to be consumed across all streams. This metric is in Public Preview.
-      * `STREAMING_BACKLOG_RECORDS`: An estimate of the maximum offset lag across all streams. This metric is in Public Preview.
-      * `STREAMING_BACKLOG_SECONDS`: An estimate of the maximum consumer delay across all streams. This metric is in Public Preview.
-      * `STREAMING_BACKLOG_FILES`: An estimate of the maximum number of outstanding files across all streams. This metric is in Public Preview.
-  "op":
-    "description": |-
-      Specifies the operator used to compare the health metric value with the specified threshold.
-  "value":
-    "description": |-
-      Specifies the threshold value that the health metric should obey to satisfy the health rule.
-github.com/databricks/databricks-sdk-go/service/jobs.JobsHealthRules:
-  "_":
-    "description": |-
-      An optional set of health rules that can be defined for this job.
-  "rules": {}
-github.com/databricks/databricks-sdk-go/service/jobs.ModelTriggerConfiguration:
-  "aliases":
-    "description": |-
-      Aliases of the model versions to monitor. Can only be used in conjunction with condition MODEL_ALIAS_SET.
-  "condition":
-    "description": |-
-      The condition based on which to trigger a job run.
-  "min_time_between_triggers_seconds":
-    "description": |-
-      If set, the trigger starts a run only after the specified amount of time has passed since
-      the last time the trigger fired. The minimum allowed value is 60 seconds.
-  "securable_name":
-    "description": |-
-      Name of the securable to monitor ("mycatalog.myschema.mymodel" in the case of model-level triggers,
-      "mycatalog.myschema" in the case of schema-level triggers) or empty in the case of metastore-level triggers.
-  "wait_after_last_change_seconds":
-    "description": |-
-      If set, the trigger starts a run only after no model updates have occurred for the specified time
-      and can be used to wait for a series of model updates before triggering a run. The
-      minimum allowed value is 60 seconds.
-github.com/databricks/databricks-sdk-go/service/jobs.ModelTriggerConfigurationCondition:
-  "_":
-    "enum":
-      - |-
-        MODEL_CREATED
-      - |-
-        MODEL_VERSION_READY
-      - |-
-        MODEL_ALIAS_SET
-github.com/databricks/databricks-sdk-go/service/jobs.NotebookTask:
-  "base_parameters":
-    "description": |-
-      Base parameters to be used for each run of this job. If the run is initiated by a call to :method:jobs/run
-      Now with parameters specified, the two parameters maps are merged. If the same key is specified in
-      `base_parameters` and in `run-now`, the value from `run-now` is used.
-      Use [Task parameter variables](https://docs.databricks.com/jobs.html#parameter-variables) to set parameters containing information about job runs.
-
-      If the notebook takes a parameter that is not specified in the job’s `base_parameters` or the `run-now` override parameters,
-      the default value from the notebook is used.
-
-      Retrieve these parameters in a notebook using [dbutils.widgets.get](https://docs.databricks.com/dev-tools/databricks-utils.html#dbutils-widgets).
-
-      The JSON representation of this field cannot exceed 1MB.
-  "notebook_path":
-    "description": |-
-      The path of the notebook to be run in the Databricks workspace or remote repository.
-      For notebooks stored in the Databricks workspace, the path must be absolute and begin with a slash.
-      For notebooks stored in a remote repository, the path must be relative. This field is required.
-  "source":
-    "description": |-
-      Optional location type of the notebook. When set to `WORKSPACE`, the notebook will be retrieved from the local Databricks workspace. When set to `GIT`, the notebook will be retrieved from a Git repository
-      defined in `git_source`. If the value is empty, the task will use `GIT` if `git_source` is defined and `WORKSPACE` otherwise.
-      * `WORKSPACE`: Notebook is located in Databricks workspace.
-      * `GIT`: Notebook is located in cloud Git provider.
-  "warehouse_id":
-    "description": |-
-      Optional `warehouse_id` to run the notebook on a SQL warehouse. Classic SQL warehouses are NOT supported, please use serverless or pro SQL warehouses.
-
-      Note that SQL warehouses only support SQL cells; if the notebook contains non-SQL cells, the run will fail.
-github.com/databricks/databricks-sdk-go/service/jobs.PauseStatus:
-  "_":
-    "enum":
-      - |-
-        UNPAUSED
-      - |-
-        PAUSED
-github.com/databricks/databricks-sdk-go/service/jobs.PerformanceTarget:
-  "_":
-    "description": |-
-      PerformanceTarget defines how performant (lower latency) or cost efficient the execution of run on serverless compute should be.
-      The performance mode on the job or pipeline should map to a performance setting that is passed to Cluster Manager
-      (see cluster-common PerformanceTarget).
-    "enum":
-      - |-
-        PERFORMANCE_OPTIMIZED
-      - |-
-        STANDARD
-github.com/databricks/databricks-sdk-go/service/jobs.PeriodicTriggerConfiguration:
-  "interval":
-    "description": |-
-      The interval at which the trigger should run.
-  "unit":
-    "description": |-
-      The unit of time for the interval.
-github.com/databricks/databricks-sdk-go/service/jobs.PeriodicTriggerConfigurationTimeUnit:
-  "_":
-    "enum":
-      - |-
-        HOURS
-      - |-
-        DAYS
-      - |-
-        WEEKS
-github.com/databricks/databricks-sdk-go/service/jobs.PipelineParams:
-  "full_refresh":
-    "description": |-
-      If true, triggers a full refresh on the delta live table.
-github.com/databricks/databricks-sdk-go/service/jobs.PipelineTask:
-  "full_refresh":
-    "description": |-
-      If true, triggers a full refresh on the delta live table.
-  "pipeline_id":
-    "description": |-
-      The full name of the pipeline task to execute.
-github.com/databricks/databricks-sdk-go/service/jobs.PowerBiModel:
-  "authentication_method":
-    "description": |-
-      How the published Power BI model authenticates to Databricks
-  "model_name":
-    "description": |-
-      The name of the Power BI model
-  "overwrite_existing":
-    "description": |-
-      Whether to overwrite existing Power BI models
-  "storage_mode":
-    "description": |-
-      The default storage mode of the Power BI model
-  "workspace_name":
-    "description": |-
-      The name of the Power BI workspace of the model
-github.com/databricks/databricks-sdk-go/service/jobs.PowerBiTable:
-  "catalog":
-    "description": |-
-      The catalog name in Databricks
-  "name":
-    "description": |-
-      The table name in Databricks
-  "schema":
-    "description": |-
-      The schema name in Databricks
-  "storage_mode":
-    "description": |-
-      The Power BI storage mode of the table
-github.com/databricks/databricks-sdk-go/service/jobs.PowerBiTask:
-  "connection_resource_name":
-    "description": |-
-      The resource name of the UC connection to authenticate from Databricks to Power BI
-  "power_bi_model":
-    "description": |-
-      The semantic model to update
-  "refresh_after_update":
-    "description": |-
-      Whether the model should be refreshed after the update
-  "tables":
-    "description": |-
-      The tables to be exported to Power BI
-  "warehouse_id":
-    "description": |-
-      The SQL warehouse ID to use as the Power BI data source
-github.com/databricks/databricks-sdk-go/service/jobs.PythonWheelTask:
-  "entry_point":
-    "description": |-
-      Named entry point to use, if it does not exist in the metadata of the package it executes the function from the package directly using `$packageName.$entryPoint()`
-  "named_parameters":
-    "description": |-
-      Command-line parameters passed to Python wheel task in the form of `["--name=task", "--data=dbfs:/path/to/data.json"]`. Leave it empty if `parameters` is not null.
-  "package_name":
-    "description": |-
-      Name of the package to execute
-  "parameters":
-    "description": |-
-      Command-line parameters passed to Python wheel task. Leave it empty if `named_parameters` is not null.
-github.com/databricks/databricks-sdk-go/service/jobs.QueueSettings:
-  "enabled":
-    "description": |-
-      If true, enable queueing for the job. This is a required field.
-github.com/databricks/databricks-sdk-go/service/jobs.RunIf:
-  "_":
-    "description": |-
-      An optional value indicating the condition that determines whether the task should be run once its dependencies have been completed. When omitted, defaults to `ALL_SUCCESS`.
-
-      Possible values are:
-      * `ALL_SUCCESS`: All dependencies have executed and succeeded
-      * `AT_LEAST_ONE_SUCCESS`: At least one dependency has succeeded
-      * `NONE_FAILED`: None of the dependencies have failed and at least one was executed
-      * `ALL_DONE`: All dependencies have been completed
-      * `AT_LEAST_ONE_FAILED`: At least one dependency failed
-      * `ALL_FAILED`: ALl dependencies have failed
-    "enum":
-      - |-
-        ALL_SUCCESS
-      - |-
-        ALL_DONE
-      - |-
-        NONE_FAILED
-      - |-
-        AT_LEAST_ONE_SUCCESS
-      - |-
-        ALL_FAILED
-      - |-
-        AT_LEAST_ONE_FAILED
-github.com/databricks/databricks-sdk-go/service/jobs.RunJobTask:
-  "dbt_commands":
-    "description": |-
-      An array of commands to execute for jobs with the dbt task, for example `"dbt_commands": ["dbt deps", "dbt seed", "dbt deps", "dbt seed", "dbt run"]`
-
-      ⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.
-    "deprecation_message": |-
-      This field is deprecated
-    "x-databricks-preview": |-
-      PRIVATE
-  "jar_params":
-    "description": |-
-      A list of parameters for jobs with Spark JAR tasks, for example `"jar_params": ["john doe", "35"]`.
-      The parameters are used to invoke the main function of the main class specified in the Spark JAR task.
-      If not specified upon `run-now`, it defaults to an empty list.
-      jar_params cannot be specified in conjunction with notebook_params.
-      The JSON representation of this field (for example `{"jar_params":["john doe","35"]}`) cannot exceed 10,000 bytes.
-
-      ⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.
-    "deprecation_message": |-
-      This field is deprecated
-    "x-databricks-preview": |-
-      PRIVATE
-  "job_id":
-    "description": |-
-      ID of the job to trigger.
-  "job_parameters":
-    "description": |-
-      Job-level parameters used to trigger the job.
-  "notebook_params":
-    "description": |-
-      A map from keys to values for jobs with notebook task, for example `"notebook_params": {"name": "john doe", "age": "35"}`.
-      The map is passed to the notebook and is accessible through the [dbutils.widgets.get](https://docs.databricks.com/dev-tools/databricks-utils.html) function.
-
-      If not specified upon `run-now`, the triggered run uses the job’s base parameters.
-
-      notebook_params cannot be specified in conjunction with jar_params.
-
-      ⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.
-
-      The JSON representation of this field (for example `{"notebook_params":{"name":"john doe","age":"35"}}`) cannot exceed 10,000 bytes.
-    "deprecation_message": |-
-      This field is deprecated
-    "x-databricks-preview": |-
-      PRIVATE
-  "pipeline_params":
-    "description": |-
-      Controls whether the pipeline should perform a full refresh
-  "python_named_params":
-    "deprecation_message": |-
-      This field is deprecated
-    "x-databricks-preview": |-
-      PRIVATE
-  "python_params":
-    "description": |-
-      A list of parameters for jobs with Python tasks, for example `"python_params": ["john doe", "35"]`.
-      The parameters are passed to Python file as command-line parameters. If specified upon `run-now`, it would overwrite
-      the parameters specified in job setting. The JSON representation of this field (for example `{"python_params":["john doe","35"]}`)
-      cannot exceed 10,000 bytes.
-
-      ⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.
-
-      Important
-
-      These parameters accept only Latin characters (ASCII character set). Using non-ASCII characters returns an error.
-      Examples of invalid, non-ASCII characters are Chinese, Japanese kanjis, and emojis.
-    "deprecation_message": |-
-      This field is deprecated
-    "x-databricks-preview": |-
-      PRIVATE
-  "spark_submit_params":
-    "description": |-
-      A list of parameters for jobs with spark submit task, for example `"spark_submit_params": ["--class", "org.apache.spark.examples.SparkPi"]`.
-      The parameters are passed to spark-submit script as command-line parameters. If specified upon `run-now`, it would overwrite the
-      parameters specified in job setting. The JSON representation of this field (for example `{"python_params":["john doe","35"]}`)
-      cannot exceed 10,000 bytes.
-
-      ⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.
-
-      Important
-
-      These parameters accept only Latin characters (ASCII character set). Using non-ASCII characters returns an error.
-      Examples of invalid, non-ASCII characters are Chinese, Japanese kanjis, and emojis.
-    "deprecation_message": |-
-      This field is deprecated
-    "x-databricks-preview": |-
-      PRIVATE
-  "sql_params":
-    "description": |-
-      A map from keys to values for jobs with SQL task, for example `"sql_params": {"name": "john doe", "age": "35"}`. The SQL alert task does not support custom parameters.
-
-      ⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.
-    "deprecation_message": |-
-      This field is deprecated
-    "x-databricks-preview": |-
-      PRIVATE
-github.com/databricks/databricks-sdk-go/service/jobs.Source:
-  "_":
-    "description": |-
-      Optional location type of the SQL file. When set to `WORKSPACE`, the SQL file will be retrieved\
-      from the local Databricks workspace. When set to `GIT`, the SQL file will be retrieved from a Git repository
-      defined in `git_source`. If the value is empty, the task will use `GIT` if `git_source` is defined and `WORKSPACE` otherwise.
-
-      * `WORKSPACE`: SQL file is located in Databricks workspace.
-      * `GIT`: SQL file is located in cloud Git provider.
-    "enum":
-      - |-
-        WORKSPACE
-      - |-
-        GIT
-github.com/databricks/databricks-sdk-go/service/jobs.SparkJarTask:
-  "jar_uri":
-    "description": |-
-      Deprecated since 04/2016. For classic compute, provide a `jar` through the `libraries` field instead. For serverless compute, provide a `jar` though the `java_dependencies` field inside the `environments` list.
-
-      See the examples of classic and serverless compute usage at the top of the page.
-    "deprecation_message": |-
-      This field is deprecated
-  "main_class_name":
-    "description": |-
-      The full name of the class containing the main method to be executed. This class must be contained in a JAR provided as a library.
-
-      The code must use `SparkContext.getOrCreate` to obtain a Spark context; otherwise, runs of the job fail.
-  "parameters":
-    "description": |-
-      Parameters passed to the main method.
-
-      Use [Task parameter variables](https://docs.databricks.com/jobs.html#parameter-variables) to set parameters containing information about job runs.
-  "run_as_repl":
-    "description": |-
-      Deprecated. A value of `false` is no longer supported.
-    "deprecation_message": |-
-      This field is deprecated
-github.com/databricks/databricks-sdk-go/service/jobs.SparkPythonTask:
-  "parameters":
-    "description": |-
-      Command line parameters passed to the Python file.
-
-      Use [Task parameter variables](https://docs.databricks.com/jobs.html#parameter-variables) to set parameters containing information about job runs.
-  "python_file":
-    "description": |-
-      The Python file to be executed. Cloud file URIs (such as dbfs:/, s3:/, adls:/, gcs:/) and workspace paths are supported. For python files stored in the Databricks workspace, the path must be absolute and begin with `/`. For files stored in a remote repository, the path must be relative. This field is required.
-  "source":
-    "description": |-
-      Optional location type of the Python file. When set to `WORKSPACE` or not specified, the file will be retrieved from the local
-      Databricks workspace or cloud location (if the `python_file` has a URI format). When set to `GIT`,
-      the Python file will be retrieved from a Git repository defined in `git_source`.
-
-      * `WORKSPACE`: The Python file is located in a Databricks workspace or at a cloud filesystem URI.
-      * `GIT`: The Python file is located in a remote Git repository.
-github.com/databricks/databricks-sdk-go/service/jobs.SparkSubmitTask:
-  "parameters":
-    "description": |-
-      Command-line parameters passed to spark submit.
-
-      Use [Task parameter variables](https://docs.databricks.com/jobs.html#parameter-variables) to set parameters containing information about job runs.
-github.com/databricks/databricks-sdk-go/service/jobs.SparseCheckout:
-  "patterns":
-    "description": |-
-      List of patterns to include for sparse checkout.
-github.com/databricks/databricks-sdk-go/service/jobs.SqlTask:
-  "alert":
-    "description": |-
-      If alert, indicates that this job must refresh a SQL alert.
-  "dashboard":
-    "description": |-
-      If dashboard, indicates that this job must refresh a SQL dashboard.
-  "file":
-    "description": |-
-      If file, indicates that this job runs a SQL file in a remote Git repository.
-  "parameters":
-    "description": |-
-      Parameters to be used for each run of this job. The SQL alert task does not support custom parameters.
-  "query":
-    "description": |-
-      If query, indicates that this job must execute a SQL query.
-  "warehouse_id":
-    "description": |-
-      The canonical identifier of the SQL warehouse. Recommended to use with serverless or pro SQL warehouses. Classic SQL warehouses are only supported for SQL alert, dashboard and query tasks and are limited to scheduled single-task jobs.
-github.com/databricks/databricks-sdk-go/service/jobs.SqlTaskAlert:
-  "alert_id":
-    "description": |-
-      The canonical identifier of the SQL alert.
-  "pause_subscriptions":
-    "description": |-
-      If true, the alert notifications are not sent to subscribers.
-  "subscriptions":
-    "description": |-
-      If specified, alert notifications are sent to subscribers.
-github.com/databricks/databricks-sdk-go/service/jobs.SqlTaskDashboard:
-  "custom_subject":
-    "description": |-
-      Subject of the email sent to subscribers of this task.
-  "dashboard_id":
-    "description": |-
-      The canonical identifier of the SQL dashboard.
-  "pause_subscriptions":
-    "description": |-
-      If true, the dashboard snapshot is not taken, and emails are not sent to subscribers.
-  "subscriptions":
-    "description": |-
-      If specified, dashboard snapshots are sent to subscriptions.
-github.com/databricks/databricks-sdk-go/service/jobs.SqlTaskFile:
-  "path":
-    "description": |-
-      Path of the SQL file. Must be relative if the source is a remote Git repository and absolute for workspace paths.
-  "source":
-    "description": |-
-      Optional location type of the SQL file. When set to `WORKSPACE`, the SQL file will be retrieved
-      from the local Databricks workspace. When set to `GIT`, the SQL file will be retrieved from a Git repository
-      defined in `git_source`. If the value is empty, the task will use `GIT` if `git_source` is defined and `WORKSPACE` otherwise.
-
-      * `WORKSPACE`: SQL file is located in Databricks workspace.
-      * `GIT`: SQL file is located in cloud Git provider.
-github.com/databricks/databricks-sdk-go/service/jobs.SqlTaskQuery:
-  "query_id":
-    "description": |-
-      The canonical identifier of the SQL query.
-github.com/databricks/databricks-sdk-go/service/jobs.SqlTaskSubscription:
-  "destination_id":
-    "description": |-
-      The canonical identifier of the destination to receive email notification. This parameter is mutually exclusive with user_name. You cannot set both destination_id and user_name for subscription notifications.
-  "user_name":
-    "description": |-
-      The user name to receive the subscription email. This parameter is mutually exclusive with destination_id. You cannot set both destination_id and user_name for subscription notifications.
-github.com/databricks/databricks-sdk-go/service/jobs.StorageMode:
-  "_":
-    "enum":
-      - |-
-        DIRECT_QUERY
-      - |-
-        IMPORT
-      - |-
-        DUAL
-github.com/databricks/databricks-sdk-go/service/jobs.Subscription:
-  "custom_subject":
-    "description": |-
-      Optional: Allows users to specify a custom subject line on the email sent
-      to subscribers.
-  "paused":
-    "description": |-
-      When true, the subscription will not send emails.
-  "subscribers":
-    "description": |-
-      The list of subscribers to send the snapshot of the dashboard to.
-github.com/databricks/databricks-sdk-go/service/jobs.SubscriptionSubscriber:
-  "destination_id":
-    "description": |-
-      A snapshot of the dashboard will be sent to the destination when the `destination_id` field is present.
-  "user_name":
-    "description": |-
-      A snapshot of the dashboard will be sent to the user's email when the `user_name` field is present.
-github.com/databricks/databricks-sdk-go/service/jobs.TableUpdateTriggerConfiguration:
-  "condition":
-    "description": |-
-      The table(s) condition based on which to trigger a job run.
-  "min_time_between_triggers_seconds":
-    "description": |-
-      If set, the trigger starts a run only after the specified amount of time has passed since
-      the last time the trigger fired. The minimum allowed value is 60 seconds.
-  "table_names":
-    "description": |-
-      A list of tables to monitor for changes. The table name must be in the format `catalog_name.schema_name.table_name`.
-  "wait_after_last_change_seconds":
-    "description": |-
-      If set, the trigger starts a run only after no table updates have occurred for the specified time
-      and can be used to wait for a series of table updates before triggering a run. The
-      minimum allowed value is 60 seconds.
-github.com/databricks/databricks-sdk-go/service/jobs.Task:
-  "alert_task":
-    "description": |-
-      The task evaluates a Databricks alert and sends notifications to subscribers
-      when the `alert_task` field is present.
-  "clean_rooms_notebook_task":
-    "description": |-
-      The task runs a [clean rooms](https://docs.databricks.com/clean-rooms/index.html) notebook
-      when the `clean_rooms_notebook_task` field is present.
-  "compute":
-    "description": |-
-      Task level compute configuration.
-  "condition_task":
-    "description": |-
-      The task evaluates a condition that can be used to control the execution of other tasks when the `condition_task` field is present.
-      The condition task does not require a cluster to execute and does not support retries or notifications.
-  "dashboard_task":
-    "description": |-
-      The task refreshes a dashboard and sends a snapshot to subscribers.
-  "dbt_cloud_task":
-    "description": |-
-      Task type for dbt cloud, deprecated in favor of the new name dbt_platform_task
-    "deprecation_message": |-
-      This field is deprecated
-    "x-databricks-preview": |-
-      PRIVATE
-  "dbt_platform_task":
-    "x-databricks-preview": |-
-      PRIVATE
-  "dbt_task":
-    "description": |-
-      The task runs one or more dbt commands when the `dbt_task` field is present. The dbt task requires both Databricks SQL and the ability to use a serverless or a pro SQL warehouse.
-  "depends_on":
-    "description": |-
-      An optional array of objects specifying the dependency graph of the task. All tasks specified in this field must complete before executing this task. The task will run only if the `run_if` condition is true.
-      The key is `task_key`, and the value is the name assigned to the dependent task.
-  "description":
-    "description": |-
-      An optional description for this task.
-  "disable_auto_optimization":
-    "description": |-
-      An option to disable auto optimization in serverless
-  "disabled":
-    "description": |-
-      An optional flag to disable the task. If set to true, the task will not run even if it is part of a job.
-    "x-databricks-preview": |-
-      PRIVATE
-  "email_notifications":
-    "description": |-
-      An optional set of email addresses that is notified when runs of this task begin or complete as well as when this task is deleted. The default behavior is to not send any emails.
-  "environment_key":
-    "description": |-
-      The key that references an environment spec in a job. This field is required for Python script, Python wheel and dbt tasks when using serverless compute.
-  "existing_cluster_id":
-    "description": |-
-      If existing_cluster_id, the ID of an existing cluster that is used for all runs.
-      When running jobs or tasks on an existing cluster, you may need to manually restart
-      the cluster if it stops responding. We suggest running jobs and tasks on new clusters for
-      greater reliability
-  "for_each_task":
-    "description": |-
-      The task executes a nested task for every input provided when the `for_each_task` field is present.
-  "gen_ai_compute_task":
-    "x-databricks-preview": |-
-      PRIVATE
-  "health":
-    "description": |-
-      An optional set of health rules that can be defined for this job.
-  "job_cluster_key":
-    "description": |-
-      If job_cluster_key, this task is executed reusing the cluster specified in `job.settings.job_clusters`.
-  "libraries":
-    "description": |-
-      An optional list of libraries to be installed on the cluster.
-      The default value is an empty list.
-  "max_retries":
-    "description": |-
-      An optional maximum number of times to retry an unsuccessful run. A run is considered to be unsuccessful if it completes with the `FAILED` result_state or `INTERNAL_ERROR` `life_cycle_state`. The value `-1` means to retry indefinitely and the value `0` means to never retry.
-  "min_retry_interval_millis":
-    "description": |-
-      An optional minimal interval in milliseconds between the start of the failed run and the subsequent retry run. The default behavior is that unsuccessful runs are immediately retried.
-  "new_cluster":
-    "description": |-
-      If new_cluster, a description of a new cluster that is created for each run.
-  "notebook_task":
-    "description": |-
-      The task runs a notebook when the `notebook_task` field is present.
-  "notification_settings":
-    "description": |-
-      Optional notification settings that are used when sending notifications to each of the `email_notifications` and `webhook_notifications` for this task.
-  "pipeline_task":
-    "description": |-
-      The task triggers a pipeline update when the `pipeline_task` field is present. Only pipelines configured to use triggered more are supported.
-  "power_bi_task":
-    "description": |-
-      The task triggers a Power BI semantic model update when the `power_bi_task` field is present.
-  "python_wheel_task":
-    "description": |-
-      The task runs a Python wheel when the `python_wheel_task` field is present.
-  "retry_on_timeout":
-    "description": |-
-      An optional policy to specify whether to retry a job when it times out. The default behavior
-      is to not retry on timeout.
-  "run_if":
-    "description": |-
-      An optional value specifying the condition determining whether the task is run once its dependencies have been completed.
-
-      * `ALL_SUCCESS`: All dependencies have executed and succeeded
-      * `AT_LEAST_ONE_SUCCESS`: At least one dependency has succeeded
-      * `NONE_FAILED`: None of the dependencies have failed and at least one was executed
-      * `ALL_DONE`: All dependencies have been completed
-      * `AT_LEAST_ONE_FAILED`: At least one dependency failed
-      * `ALL_FAILED`: ALl dependencies have failed
-  "run_job_task":
-    "description": |-
-      The task triggers another job when the `run_job_task` field is present.
-  "spark_jar_task":
-    "description": |-
-      The task runs a JAR when the `spark_jar_task` field is present.
-  "spark_python_task":
-    "description": |-
-      The task runs a Python file when the `spark_python_task` field is present.
-  "spark_submit_task":
-    "description": |-
-      (Legacy) The task runs the spark-submit script when the spark_submit_task field is present. Databricks recommends using the spark_jar_task instead; see [Spark Submit task for jobs](/jobs/spark-submit).
-    "deprecation_message": |-
-      This field is deprecated
-  "sql_task":
-    "description": |-
-      The task runs a SQL query or file, or it refreshes a SQL alert or a legacy SQL dashboard when the `sql_task` field is present.
-  "task_key":
-    "description": |-
-      A unique name for the task. This field is used to refer to this task from other tasks.
-      This field is required and must be unique within its parent job.
-      On Update or Reset, this field is used to reference the tasks to be updated or reset.
-  "timeout_seconds":
-    "description": |-
-      An optional timeout applied to each run of this job task. A value of `0` means no timeout.
-  "webhook_notifications":
-    "description": |-
-      A collection of system notification IDs to notify when runs of this task begin or complete. The default behavior is to not send any system notifications.
-github.com/databricks/databricks-sdk-go/service/jobs.TaskDependency:
-  "outcome":
-    "description": |-
-      Can only be specified on condition task dependencies. The outcome of the dependent task that must be met for this task to run.
-  "task_key":
-    "description": |-
-      The name of the task this task depends on.
-github.com/databricks/databricks-sdk-go/service/jobs.TaskEmailNotifications:
-  "no_alert_for_skipped_runs":
-    "description": |-
-      If true, do not send email to recipients specified in `on_failure` if the run is skipped.
-      This field is `deprecated`. Please use the `notification_settings.no_alert_for_skipped_runs` field.
-    "deprecation_message": |-
-      This field is deprecated
-  "on_duration_warning_threshold_exceeded":
-    "description": |-
-      A list of email addresses to be notified when the duration of a run exceeds the threshold specified for the `RUN_DURATION_SECONDS` metric in the `health` field. If no rule for the `RUN_DURATION_SECONDS` metric is specified in the `health` field for the job, notifications are not sent.
-  "on_failure":
-    "description": |-
-      A list of email addresses to be notified when a run unsuccessfully completes. A run is considered to have completed unsuccessfully if it ends with an `INTERNAL_ERROR` `life_cycle_state` or a `FAILED`, or `TIMED_OUT` result_state. If this is not specified on job creation, reset, or update the list is empty, and notifications are not sent.
-  "on_start":
-    "description": |-
-      A list of email addresses to be notified when a run begins. If not specified on job creation, reset, or update, the list is empty, and notifications are not sent.
-  "on_streaming_backlog_exceeded":
-    "description": |-
-      A list of email addresses to notify when any streaming backlog thresholds are exceeded for any stream.
-      Streaming backlog thresholds can be set in the `health` field using the following metrics: `STREAMING_BACKLOG_BYTES`, `STREAMING_BACKLOG_RECORDS`, `STREAMING_BACKLOG_SECONDS`, or `STREAMING_BACKLOG_FILES`.
-      Alerting is based on the 10-minute average of these metrics. If the issue persists, notifications are resent every 30 minutes.
-  "on_success":
-    "description": |-
-      A list of email addresses to be notified when a run successfully completes. A run is considered to have completed successfully if it ends with a `TERMINATED` `life_cycle_state` and a `SUCCESS` result_state. If not specified on job creation, reset, or update, the list is empty, and notifications are not sent.
-github.com/databricks/databricks-sdk-go/service/jobs.TaskNotificationSettings:
-  "alert_on_last_attempt":
-    "description": |-
-      If true, do not send notifications to recipients specified in `on_start` for the retried runs and do not send notifications to recipients specified in `on_failure` until the last retry of the run.
-  "no_alert_for_canceled_runs":
-    "description": |-
-      If true, do not send notifications to recipients specified in `on_failure` if the run is canceled.
-  "no_alert_for_skipped_runs":
-    "description": |-
-      If true, do not send notifications to recipients specified in `on_failure` if the run is skipped.
-github.com/databricks/databricks-sdk-go/service/jobs.TaskRetryMode:
-  "_":
-    "description": |-
-      task retry mode of the continuous job
-      * NEVER: The failed task will not be retried.
-      * ON_FAILURE: Retry a failed task if at least one other task in the job is still running its first attempt.
-      When this condition is no longer met or the retry limit is reached, the job run is cancelled and a new run is started.
-    "enum":
-      - |-
-        NEVER
-      - |-
-        ON_FAILURE
-github.com/databricks/databricks-sdk-go/service/jobs.TriggerSettings:
-  "file_arrival":
-    "description": |-
-      File arrival trigger settings.
-  "model":
-    "x-databricks-preview": |-
-      PRIVATE
-  "pause_status":
-    "description": |-
-      Whether this trigger is paused or not.
-  "periodic":
-    "description": |-
-      Periodic trigger settings.
-  "table_update": {}
-github.com/databricks/databricks-sdk-go/service/jobs.Webhook:
-  "id": {}
-github.com/databricks/databricks-sdk-go/service/jobs.WebhookNotifications:
-  "on_duration_warning_threshold_exceeded":
-    "description": |-
-      An optional list of system notification IDs to call when the duration of a run exceeds the threshold specified for the `RUN_DURATION_SECONDS` metric in the `health` field. A maximum of 3 destinations can be specified for the `on_duration_warning_threshold_exceeded` property.
-  "on_failure":
-    "description": |-
-      An optional list of system notification IDs to call when the run fails. A maximum of 3 destinations can be specified for the `on_failure` property.
-  "on_start":
-    "description": |-
-      An optional list of system notification IDs to call when the run starts. A maximum of 3 destinations can be specified for the `on_start` property.
-  "on_streaming_backlog_exceeded":
-    "description": |-
-      An optional list of system notification IDs to call when any streaming backlog thresholds are exceeded for any stream.
-      Streaming backlog thresholds can be set in the `health` field using the following metrics: `STREAMING_BACKLOG_BYTES`, `STREAMING_BACKLOG_RECORDS`, `STREAMING_BACKLOG_SECONDS`, or `STREAMING_BACKLOG_FILES`.
-      Alerting is based on the 10-minute average of these metrics. If the issue persists, notifications are resent every 30 minutes.
-      A maximum of 3 destinations can be specified for the `on_streaming_backlog_exceeded` property.
-  "on_success":
-    "description": |-
-      An optional list of system notification IDs to call when the run completes successfully. A maximum of 3 destinations can be specified for the `on_success` property.
-github.com/databricks/databricks-sdk-go/service/ml.ExperimentPermissionLevel:
-  "_":
-    "description": |-
-      Permission level
-    "enum":
-      - |-
-        CAN_MANAGE
-      - |-
-        CAN_EDIT
-      - |-
-        CAN_READ
-github.com/databricks/databricks-sdk-go/service/ml.ExperimentTag:
-  "_":
-    "description": |-
-      A tag for an experiment.
-  "key":
-    "description": |-
-      The tag key.
-  "value":
-    "description": |-
-      The tag value.
-github.com/databricks/databricks-sdk-go/service/ml.ModelTag:
-  "_":
-    "description": |-
-      Tag for a registered model
-  "key":
-    "description": |-
-      The tag key.
-  "value":
-    "description": |-
-      The tag value.
-github.com/databricks/databricks-sdk-go/service/ml.RegisteredModelPermissionLevel:
-  "_":
-    "description": |-
-      Permission level
-    "enum":
-      - |-
-        CAN_MANAGE
-      - |-
-        CAN_MANAGE_PRODUCTION_VERSIONS
-      - |-
-        CAN_MANAGE_STAGING_VERSIONS
-      - |-
-        CAN_EDIT
-      - |-
-        CAN_READ
-github.com/databricks/databricks-sdk-go/service/pipelines.AutoFullRefreshPolicy:
-  "_":
-    "description": |-
-      Policy for auto full refresh.
-  "enabled":
-    "description": |-
-      (Required, Mutable) Whether to enable auto full refresh or not.
-  "min_interval_hours":
-    "description": |-
-      (Optional, Mutable) Specify the minimum interval in hours between the timestamp
-      at which a table was last full refreshed and the current timestamp for triggering auto full
-      If unspecified and autoFullRefresh is enabled then by default min_interval_hours is 24 hours.
-github.com/databricks/databricks-sdk-go/service/pipelines.ConnectionParameters:
-  "source_catalog":
-    "description": |-
-      Source catalog for initial connection.
-      This is necessary for schema exploration in some database systems like Oracle, and optional but nice-to-have
-      in some other database systems like Postgres.
-      For Oracle databases, this maps to a service name.
-    "x-databricks-preview": |-
-      PRIVATE
-github.com/databricks/databricks-sdk-go/service/pipelines.ConnectorOptions:
-  "_":
-    "description": |-
-      Wrapper message for source-specific options to support multiple connector types
-  "gdrive_options":
-    "x-databricks-preview": |-
-      PRIVATE
-  "google_ads_options":
-    "description": |-
-      Google Ads specific options for ingestion (object-level).
-      When set, these values override the corresponding fields in GoogleAdsConfig
-      (source_configurations).
-    "x-databricks-preview": |-
-      PRIVATE
-  "sharepoint_options":
-    "x-databricks-preview": |-
-      PRIVATE
-  "tiktok_ads_options":
-    "description": |-
-      TikTok Ads specific options for ingestion
-    "x-databricks-preview": |-
-      PRIVATE
-github.com/databricks/databricks-sdk-go/service/pipelines.ConnectorType:
-  "_":
-    "description": |-
-      For certain database sources LakeFlow Connect offers both query based and cdc
-      ingestion, ConnectorType can bse used to convey the type of ingestion.
-      If connection_name is provided for database sources, we default to Query Based ingestion
-    "enum":
-      - |-
-        CDC
-      - |-
-        QUERY_BASED
-github.com/databricks/databricks-sdk-go/service/pipelines.CronTrigger:
-  "quartz_cron_schedule": {}
-  "timezone_id": {}
-github.com/databricks/databricks-sdk-go/service/pipelines.DataStagingOptions:
-  "_":
-    "description": |-
-      Location of staged data storage
-  "catalog_name":
-    "description": |-
-      (Required, Immutable) The name of the catalog for the connector's staging storage location.
-  "schema_name":
-    "description": |-
-      (Required, Immutable) The name of the schema for the connector's staging storage location.
-  "volume_name":
-    "description": |-
-      (Optional) The Unity Catalog-compatible name for the storage location.
-      This is the volume to use for the data that is extracted by the connector.
-      Spark Declarative Pipelines system will automatically create the volume under the catalog and schema.
-      For Combined Cdc Managed Ingestion pipelines default name for the volume would be :
-      __databricks_ingestion_gateway_staging_data-$pipelineId
-github.com/databricks/databricks-sdk-go/service/pipelines.DayOfWeek:
-  "_":
-    "description": |-
-      Days of week in which the window is allowed to happen.
-      If not specified all days of the week will be used.
-    "enum":
-      - |-
-        MONDAY
-      - |-
-        TUESDAY
-      - |-
-        WEDNESDAY
-      - |-
-        THURSDAY
-      - |-
-        FRIDAY
-      - |-
-        SATURDAY
-      - |-
-        SUNDAY
-github.com/databricks/databricks-sdk-go/service/pipelines.DeploymentKind:
-  "_":
-    "description": |-
-      The deployment method that manages the pipeline:
-      - BUNDLE: The pipeline is managed by a Databricks Asset Bundle.
-    "enum":
-      - |-
-        BUNDLE
-github.com/databricks/databricks-sdk-go/service/pipelines.EventLogSpec:
-  "_":
-    "description": |-
-      Configurable event log parameters.
-  "catalog":
-    "description": |-
-      The UC catalog the event log is published under.
-  "name":
-    "description": |-
-      The name the event log is published to in UC.
-  "schema":
-    "description": |-
-      The UC schema the event log is published under.
-github.com/databricks/databricks-sdk-go/service/pipelines.FileFilter:
-  "modified_after":
-    "description": |-
-      Include files with modification times occurring after the specified time.
-      Timestamp format: YYYY-MM-DDTHH:mm:ss (e.g. 2020-06-01T13:00:00)
-      Based on https://spark.apache.org/docs/latest/sql-data-sources-generic-options.html#modification-time-path-filters
-  "modified_before":
-    "description": |-
-      Include files with modification times occurring before the specified time.
-      Timestamp format: YYYY-MM-DDTHH:mm:ss (e.g. 2020-06-01T13:00:00)
-      Based on https://spark.apache.org/docs/latest/sql-data-sources-generic-options.html#modification-time-path-filters
-  "path_filter":
-    "description": |-
-      Include files with file names matching the pattern
-      Based on https://spark.apache.org/docs/latest/sql-data-sources-generic-options.html#path-glob-filter
-github.com/databricks/databricks-sdk-go/service/pipelines.FileIngestionOptions:
-  "corrupt_record_column": {}
-  "file_filters":
-    "description": |-
-      Generic options
-  "format":
-    "description": |-
-      required for TableSpec
-  "format_options":
-    "description": |-
-      Format-specific options
-      Based on https://docs.databricks.com/aws/en/ingestion/cloud-object-storage/auto-loader/options#file-format-options
-  "ignore_corrupt_files": {}
-  "infer_column_types": {}
-  "reader_case_sensitive":
-    "description": |-
-      Column name case sensitivity
-      https://docs.databricks.com/aws/en/ingestion/cloud-object-storage/auto-loader/schema#change-case-sensitive-behavior
-  "rescued_data_column": {}
-  "schema_evolution_mode":
-    "description": |-
-      Based on https://docs.databricks.com/aws/en/ingestion/cloud-object-storage/auto-loader/schema#how-does-auto-loader-schema-evolution-work
-  "schema_hints":
-    "description": |-
-      Override inferred schema of specific columns
-      Based on https://docs.databricks.com/aws/en/ingestion/cloud-object-storage/auto-loader/schema#override-schema-inference-with-schema-hints
-  "single_variant_column": {}
-github.com/databricks/databricks-sdk-go/service/pipelines.FileIngestionOptionsFileFormat:
-  "_":
-    "enum":
-      - |-
-        BINARYFILE
-      - |-
-        JSON
-      - |-
-        CSV
-      - |-
-        XML
-      - |-
-        EXCEL
-      - |-
-        PARQUET
-      - |-
-        AVRO
-      - |-
-        ORC
-github.com/databricks/databricks-sdk-go/service/pipelines.FileIngestionOptionsSchemaEvolutionMode:
-  "_":
-    "description": |-
-      Based on https://docs.databricks.com/aws/en/ingestion/cloud-object-storage/auto-loader/schema#how-does-auto-loader-schema-evolution-work
-    "enum":
-      - |-
-        ADD_NEW_COLUMNS_WITH_TYPE_WIDENING
-      - |-
-        ADD_NEW_COLUMNS
-      - |-
-        RESCUE
-      - |-
-        FAIL_ON_NEW_COLUMNS
-      - |-
-        NONE
-github.com/databricks/databricks-sdk-go/service/pipelines.FileLibrary:
-  "path":
-    "description": |-
-      The absolute path of the source code.
-github.com/databricks/databricks-sdk-go/service/pipelines.Filters:
-  "exclude":
-    "description": |-
-      Paths to exclude.
-  "include":
-    "description": |-
-      Paths to include.
-github.com/databricks/databricks-sdk-go/service/pipelines.GoogleAdsOptions:
-  "_":
-    "description": |-
-      Google Ads specific options for ingestion (object-level).
-      When set, these values override the corresponding fields in GoogleAdsConfig
-      (source_configurations).
-  "lookback_window_days":
-    "description": |-
-      (Optional) Number of days to look back for report tables to capture late-arriving data.
-      If not specified, defaults to 30 days.
-  "manager_account_id":
-    "description": |-
-      (Optional at this level) Manager Account ID (also called MCC Account ID) used to list
-      and access customer accounts under this manager account.
-      Overrides GoogleAdsConfig.manager_account_id from source_configurations when set.
-  "sync_start_date":
-    "description": |-
-      (Optional) Start date for the initial sync of report tables in YYYY-MM-DD format.
-      This determines the earliest date from which to sync historical data.
-      If not specified, defaults to 2 years of historical data.
-github.com/databricks/databricks-sdk-go/service/pipelines.GoogleDriveOptions:
-  "entity_type": {}
-  "file_ingestion_options": {}
-  "url":
-    "description": |-
-      Google Drive URL.
-github.com/databricks/databricks-sdk-go/service/pipelines.GoogleDriveOptionsGoogleDriveEntityType:
-  "_":
-    "enum":
-      - |-
-        FILE
-      - |-
-        FILE_METADATA
-      - |-
-        PERMISSION
-github.com/databricks/databricks-sdk-go/service/pipelines.IngestionConfig:
-  "report":
-    "description": |-
-      Select a specific source report.
-  "schema":
-    "description": |-
-      Select all tables from a specific source schema.
-  "table":
-    "description": |-
-      Select a specific source table.
-github.com/databricks/databricks-sdk-go/service/pipelines.IngestionGatewayPipelineDefinition:
-  "connection_id":
-    "description": |-
-      [Deprecated, use connection_name instead] Immutable. The Unity Catalog connection that this gateway pipeline uses to communicate with the source.
-    "deprecation_message": |-
-      This field is deprecated
-  "connection_name":
-    "description": |-
-      Immutable. The Unity Catalog connection that this gateway pipeline uses to communicate with the source.
-  "connection_parameters":
-    "description": |-
-      Optional, Internal. Parameters required to establish an initial connection with the source.
-    "x-databricks-preview": |-
-      PRIVATE
-  "gateway_storage_catalog":
-    "description": |-
-      Required, Immutable. The name of the catalog for the gateway pipeline's storage location.
-  "gateway_storage_name":
-    "description": |-
-      Optional. The Unity Catalog-compatible name for the gateway storage location.
-      This is the destination to use for the data that is extracted by the gateway.
-      Spark Declarative Pipelines system will automatically create the storage location under the catalog and schema.
-  "gateway_storage_schema":
-    "description": |-
-      Required, Immutable. The name of the schema for the gateway pipelines's storage location.
-github.com/databricks/databricks-sdk-go/service/pipelines.IngestionPipelineDefinition:
-  "connection_name":
-    "description": |-
-      The Unity Catalog connection that this ingestion pipeline uses to communicate with the source. This is used with
-      both connectors for applications like Salesforce, Workday, and so on, and also database connectors like Oracle,
-      (connector_type = QUERY_BASED OR connector_type = CDC).
-      If connection name corresponds to database connectors like Oracle, and connector_type is not provided then
-      connector_type defaults to QUERY_BASED. If connector_type is passed as CDC we use Combined Cdc Managed Ingestion
-      pipeline.
-      Under certain conditions, this can be replaced with ingestion_gateway_id to change the connector to Cdc Managed
-      Ingestion Pipeline with Gateway pipeline.
-  "connector_type":
-    "description": |-
-      (Optional) Connector Type for sources. Ex: CDC, Query Based.
-    "x-databricks-preview": |-
-      PRIVATE
-  "data_staging_options":
-    "description": |-
-      (Optional) Location of staged data storage. This is required for migration from Cdc Managed Ingestion Pipeline
-      with Gateway pipeline to Combined Cdc Managed Ingestion Pipeline.
-      If not specified, the volume for staged data will be created in catalog and schema/target specified in the
-      top level pipeline definition.
-    "x-databricks-preview": |-
-      PRIVATE
-  "full_refresh_window":
-    "description": |-
-      (Optional) A window that specifies a set of time ranges for snapshot queries in CDC.
-  "ingest_from_uc_foreign_catalog":
-    "description": |-
-      Immutable. If set to true, the pipeline will ingest tables from the
-      UC foreign catalogs directly without the need to specify a UC connection or ingestion gateway.
-      The `source_catalog` fields in objects of IngestionConfig are interpreted as
-      the UC foreign catalogs to ingest from.
-    "x-databricks-preview": |-
-      PRIVATE
-  "ingestion_gateway_id":
-    "description": |-
-      Identifier for the gateway that is used by this ingestion pipeline to communicate with the source database.
-      This is used with CDC connectors to databases like SQL Server using a gateway pipeline (connector_type = CDC).
-      Under certain conditions, this can be replaced with connection_name to change the connector to Combined Cdc
-      Managed Ingestion Pipeline.
-  "netsuite_jar_path":
-    "description": |-
-      Netsuite only configuration. When the field is set for a netsuite connector,
-      the jar stored in the field will be validated and added to the classpath of
-      pipeline's cluster.
-    "x-databricks-preview": |-
-      PRIVATE
-  "objects":
-    "description": |-
-      Required. Settings specifying tables to replicate and the destination for the replicated tables.
-  "source_configurations":
-    "description": |-
-      Top-level source configurations
-  "source_type":
-    "description": |-
-      The type of the foreign source.
-      The source type will be inferred from the source connection or ingestion gateway.
-      This field is output only and will be ignored if provided.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "table_configuration":
-    "description": |-
-      Configuration settings to control the ingestion of tables. These settings are applied to all tables in the pipeline.
-? github.com/databricks/databricks-sdk-go/service/pipelines.IngestionPipelineDefinitionTableSpecificConfigQueryBasedConnectorConfig
-: "_":
-    "description": |-
-      Configurations that are only applicable for query-based ingestion connectors.
-  "cursor_columns":
-    "description": |-
-      The names of the monotonically increasing columns in the source table that are used to enable
-      the table to be read and ingested incrementally through structured streaming.
-      The columns are allowed to have repeated values but have to be non-decreasing.
-      If the source data is merged into the destination (e.g., using SCD Type 1 or Type 2), these
-      columns will implicitly define the `sequence_by` behavior. You can still explicitly set
-      `sequence_by` to override this default.
-    "x-databricks-preview": |-
-      PRIVATE
-  "deletion_condition":
-    "description": |-
-      Specifies a SQL WHERE condition that specifies that the source row has been deleted.
-      This is sometimes referred to as "soft-deletes".
-      For example: "Operation = 'DELETE'" or "is_deleted = true".
-      This field is orthogonal to `hard_deletion_sync_interval_in_seconds`,
-      one for soft-deletes and the other for hard-deletes.
-      See also the hard_deletion_sync_min_interval_in_seconds field for
-      handling of "hard deletes" where the source rows are physically removed from the table.
-    "x-databricks-preview": |-
-      PRIVATE
-  "hard_deletion_sync_min_interval_in_seconds":
-    "description": |-
-      Specifies the minimum interval (in seconds) between snapshots on primary keys
-      for detecting and synchronizing hard deletions—i.e., rows that have been
-      physically removed from the source table.
-      This interval acts as a lower bound. If ingestion runs less frequently than
-      this value, hard deletion synchronization will align with the actual ingestion
-      frequency instead of happening more often.
-      If not set, hard deletion synchronization via snapshots is disabled.
-      This field is mutable and can be updated without triggering a full snapshot.
-    "x-databricks-preview": |-
-      PRIVATE
-github.com/databricks/databricks-sdk-go/service/pipelines.IngestionPipelineDefinitionWorkdayReportParameters:
-  "incremental":
-    "description": |-
-      (Optional) Marks the report as incremental.
-      This field is deprecated and should not be used. Use `parameters` instead. The incremental behavior is now
-      controlled by the `parameters` field.
-    "deprecation_message": |-
-      This field is deprecated
-  "parameters":
-    "description": |-
-      Parameters for the Workday report. Each key represents the parameter name (e.g., "start_date", "end_date"),
-      and the corresponding value is a SQL-like expression used to compute the parameter value at runtime.
-      Example:
-      {
-      "start_date": "{ coalesce(current_offset(), date(\"2025-02-01\")) }",
-      "end_date": "{ current_date() - INTERVAL 1 DAY }"
-      }
-  "report_parameters":
-    "description": |-
-      (Optional) Additional custom parameters for Workday Report
-      This field is deprecated and should not be used. Use `parameters` instead.
-    "deprecation_message": |-
-      This field is deprecated
-github.com/databricks/databricks-sdk-go/service/pipelines.IngestionPipelineDefinitionWorkdayReportParametersQueryKeyValue:
-  "key":
-    "description": |-
-      Key for the report parameter, can be a column name or other metadata
-  "value":
-    "description": |-
-      Value for the report parameter.
-      Possible values it can take are these sql functions:
-      1. coalesce(current_offset(), date("YYYY-MM-DD")) -> if current_offset() is null, then the passed date, else current_offset()
-      2. current_date()
-      3. date_sub(current_date(), x) -> subtract x (some non-negative integer) days from current date
-github.com/databricks/databricks-sdk-go/service/pipelines.IngestionSourceType:
-  "_":
-    "enum":
-      - |-
-        MYSQL
-      - |-
-        POSTGRESQL
-      - |-
-        SQLSERVER
-      - |-
-        SALESFORCE
-      - |-
-        BIGQUERY
-      - |-
-        NETSUITE
-      - |-
-        WORKDAY_RAAS
-      - |-
-        GA4_RAW_DATA
-      - |-
-        SERVICENOW
-      - |-
-        MANAGED_POSTGRESQL
-      - |-
-        ORACLE
-      - |-
-        TERADATA
-      - |-
-        SHAREPOINT
-      - |-
-        DYNAMICS365
-      - |-
-        GOOGLE_DRIVE
-      - |-
-        FOREIGN_CATALOG
-github.com/databricks/databricks-sdk-go/service/pipelines.ManualTrigger: {}
-github.com/databricks/databricks-sdk-go/service/pipelines.NotebookLibrary:
-  "path":
-    "description": |-
-      The absolute path of the source code.
-github.com/databricks/databricks-sdk-go/service/pipelines.Notifications:
-  "alerts":
-    "description": |-
-      A list of alerts that trigger the sending of notifications to the configured
-      destinations. The supported alerts are:
-
-      * `on-update-success`: A pipeline update completes successfully.
-      * `on-update-failure`: Each time a pipeline update fails.
-      * `on-update-fatal-failure`: A pipeline update fails with a non-retryable (fatal) error.
-      * `on-flow-failure`: A single data flow fails.
-  "email_recipients":
-    "description": |-
-      A list of email addresses notified when a configured alert is triggered.
-github.com/databricks/databricks-sdk-go/service/pipelines.OperationTimeWindow:
-  "_":
-    "description": |-
-      Proto representing a window
-  "days_of_week":
-    "description": |-
-      Days of week in which the window is allowed to happen
-      If not specified all days of the week will be used.
-  "start_hour":
-    "description": |-
-      An integer between 0 and 23 denoting the start hour for the window in the 24-hour day.
-  "time_zone_id":
-    "description": |-
-      Time zone id of window. See https://docs.databricks.com/sql/language-manual/sql-ref-syntax-aux-conf-mgmt-set-timezone.html for details.
-      If not specified, UTC will be used.
-github.com/databricks/databricks-sdk-go/service/pipelines.PathPattern:
-  "include":
-    "description": |-
-      The source code to include for pipelines
-github.com/databricks/databricks-sdk-go/service/pipelines.PipelineCluster:
-  "apply_policy_default_values":
-    "description": |-
-      Note: This field won't be persisted. Only API users will check this field.
-  "autoscale":
-    "description": |-
-      Parameters needed in order to automatically scale clusters up and down based on load.
-      Note: autoscaling works best with DB runtime versions 3.0 or later.
-  "aws_attributes":
-    "description": |-
-      Attributes related to clusters running on Amazon Web Services.
-      If not specified at cluster creation, a set of default values will be used.
-  "azure_attributes":
-    "description": |-
-      Attributes related to clusters running on Microsoft Azure.
-      If not specified at cluster creation, a set of default values will be used.
-  "cluster_log_conf":
-    "description": |-
-      The configuration for delivering spark logs to a long-term storage destination.
-      Only dbfs destinations are supported. Only one destination can be specified
-      for one cluster. If the conf is given, the logs will be delivered to the destination every
-      `5 mins`. The destination of driver logs is `$destination/$clusterId/driver`, while
-      the destination of executor logs is `$destination/$clusterId/executor`.
-  "custom_tags":
-    "description": |-
-      Additional tags for cluster resources. Databricks will tag all cluster resources (e.g., AWS
-      instances and EBS volumes) with these tags in addition to `default_tags`. Notes:
-
-      - Currently, Databricks allows at most 45 custom tags
-
-      - Clusters can only reuse cloud resources if the resources' tags are a subset of the cluster tags
-  "driver_instance_pool_id":
-    "description": |-
-      The optional ID of the instance pool for the driver of the cluster belongs.
-      The pool cluster uses the instance pool with id (instance_pool_id) if the driver pool is not
-      assigned.
-  "driver_node_type_id":
-    "description": |-
-      The node type of the Spark driver.
-      Note that this field is optional; if unset, the driver node type will be set as the same value
-      as `node_type_id` defined above.
-  "enable_local_disk_encryption":
-    "description": |-
-      Whether to enable local disk encryption for the cluster.
-  "gcp_attributes":
-    "description": |-
-      Attributes related to clusters running on Google Cloud Platform.
-      If not specified at cluster creation, a set of default values will be used.
-  "init_scripts":
-    "description": |-
-      The configuration for storing init scripts. Any number of destinations can be specified. The scripts are executed sequentially in the order provided. If `cluster_log_conf` is specified, init script logs are sent to `<destination>/<cluster-ID>/init_scripts`.
-  "instance_pool_id":
-    "description": |-
-      The optional ID of the instance pool to which the cluster belongs.
-  "label":
-    "description": |-
-      A label for the cluster specification, either `default` to configure the default cluster, or `maintenance` to configure the maintenance cluster. This field is optional. The default value is `default`.
-  "node_type_id":
-    "description": |-
-      This field encodes, through a single value, the resources available to each of
-      the Spark nodes in this cluster. For example, the Spark nodes can be provisioned
-      and optimized for memory or compute intensive workloads. A list of available node
-      types can be retrieved by using the :method:clusters/listNodeTypes API call.
-  "num_workers":
-    "description": |-
-      Number of worker nodes that this cluster should have. A cluster has one Spark Driver
-      and `num_workers` Executors for a total of `num_workers` + 1 Spark nodes.
-
-      Note: When reading the properties of a cluster, this field reflects the desired number
-      of workers rather than the actual current number of workers. For instance, if a cluster
-      is resized from 5 to 10 workers, this field will immediately be updated to reflect
-      the target size of 10 workers, whereas the workers listed in `spark_info` will gradually
-      increase from 5 to 10 as the new nodes are provisioned.
-  "policy_id":
-    "description": |-
-      The ID of the cluster policy used to create the cluster if applicable.
-  "spark_conf":
-    "description": |-
-      An object containing a set of optional, user-specified Spark configuration key-value pairs.
-      See :method:clusters/create for more details.
-  "spark_env_vars":
-    "description": |-
-      An object containing a set of optional, user-specified environment variable key-value pairs.
-      Please note that key-value pair of the form (X,Y) will be exported as is (i.e.,
-      `export X='Y'`) while launching the driver and workers.
-
-      In order to specify an additional set of `SPARK_DAEMON_JAVA_OPTS`, we recommend appending
-      them to `$SPARK_DAEMON_JAVA_OPTS` as shown in the example below. This ensures that all
-      default databricks managed environmental variables are included as well.
-
-      Example Spark environment variables:
-      `{"SPARK_WORKER_MEMORY": "28000m", "SPARK_LOCAL_DIRS": "/local_disk0"}` or
-      `{"SPARK_DAEMON_JAVA_OPTS": "$SPARK_DAEMON_JAVA_OPTS -Dspark.shuffle.service.enabled=true"}`
-  "ssh_public_keys":
-    "description": |-
-      SSH public key contents that will be added to each Spark node in this cluster. The
-      corresponding private keys can be used to login with the user name `ubuntu` on port `2200`.
-      Up to 10 keys can be specified.
-github.com/databricks/databricks-sdk-go/service/pipelines.PipelineClusterAutoscale:
-  "max_workers":
-    "description": |-
-      The maximum number of workers to which the cluster can scale up when overloaded. `max_workers` must be strictly greater than `min_workers`.
-  "min_workers":
-    "description": |-
-      The minimum number of workers the cluster can scale down to when underutilized.
-      It is also the initial number of workers the cluster will have after creation.
-  "mode":
-    "description": |-
-      Databricks Enhanced Autoscaling optimizes cluster utilization by automatically
-      allocating cluster resources based on workload volume, with minimal impact to
-      the data processing latency of your pipelines. Enhanced Autoscaling is available
-      for `updates` clusters only. The legacy autoscaling feature is used for `maintenance`
-      clusters.
-github.com/databricks/databricks-sdk-go/service/pipelines.PipelineClusterAutoscaleMode:
-  "_":
-    "description": |-
-      Databricks Enhanced Autoscaling optimizes cluster utilization by automatically
-      allocating cluster resources based on workload volume, with minimal impact to
-      the data processing latency of your pipelines. Enhanced Autoscaling is available
-      for `updates` clusters only. The legacy autoscaling feature is used for `maintenance`
-      clusters.
-    "enum":
-      - |-
-        ENHANCED
-      - |-
-        LEGACY
-github.com/databricks/databricks-sdk-go/service/pipelines.PipelineDeployment:
-  "kind":
-    "description": |-
-      The deployment method that manages the pipeline.
-  "metadata_file_path":
-    "description": |-
-      The path to the file containing metadata about the deployment.
-github.com/databricks/databricks-sdk-go/service/pipelines.PipelineLibrary:
-  "file":
-    "description": |-
-      The path to a file that defines a pipeline and is stored in the Databricks Repos.
-  "glob":
-    "description": |-
-      The unified field to include source codes.
-      Each entry can be a notebook path, a file path, or a folder path that ends `/**`.
-      This field cannot be used together with `notebook` or `file`.
-  "jar":
-    "description": |-
-      URI of the jar to be installed. Currently only DBFS is supported.
-    "x-databricks-preview": |-
-      PRIVATE
-  "maven":
-    "description": |-
-      Specification of a maven library to be installed.
-    "x-databricks-preview": |-
-      PRIVATE
-  "notebook":
-    "description": |-
-      The path to a notebook that defines a pipeline and is stored in the Databricks workspace.
-  "whl":
-    "description": |-
-      URI of the whl to be installed.
-    "deprecation_message": |-
-      This field is deprecated
-github.com/databricks/databricks-sdk-go/service/pipelines.PipelinePermissionLevel:
-  "_":
-    "description": |-
-      Permission level
-    "enum":
-      - |-
-        CAN_MANAGE
-      - |-
-        IS_OWNER
-      - |-
-        CAN_RUN
-      - |-
-        CAN_VIEW
-github.com/databricks/databricks-sdk-go/service/pipelines.PipelineTrigger:
-  "cron": {}
-  "manual": {}
-github.com/databricks/databricks-sdk-go/service/pipelines.PipelinesEnvironment:
-  "_":
-    "description": |-
-      The environment entity used to preserve serverless environment side panel, jobs' environment for non-notebook task, and DLT's environment for classic and serverless pipelines.
-      In this minimal environment spec, only pip dependencies are supported.
-  "dependencies":
-    "description": |-
-      List of pip dependencies, as supported by the version of pip in this environment.
-      Each dependency is a pip requirement file line https://pip.pypa.io/en/stable/reference/requirements-file-format/
-      Allowed dependency could be <requirement specifier>, <archive url/path>, <local project path>(WSFS or Volumes in Databricks), <vcs project url>
-  "environment_version":
-    "description": |-
-      The environment version of the serverless Python environment used to execute
-      customer Python code. Each environment version includes a specific Python
-      version and a curated set of pre-installed libraries with defined versions,
-      providing a stable and reproducible execution environment.
-
-      Databricks supports a three-year lifecycle for each environment version.
-      For available versions and their included packages, see
-      https://docs.databricks.com/aws/en/release-notes/serverless/environment-version/
-
-      The value should be a string representing the environment version number, for example: `"4"`.
-    "x-databricks-preview": |-
-      PRIVATE
-github.com/databricks/databricks-sdk-go/service/pipelines.PostgresCatalogConfig:
-  "_":
-    "description": |-
-      PG-specific catalog-level configuration parameters
-  "slot_config":
-    "description": |-
-      Optional. The Postgres slot configuration to use for logical replication
-github.com/databricks/databricks-sdk-go/service/pipelines.PostgresSlotConfig:
-  "_":
-    "description": |-
-      PostgresSlotConfig contains the configuration for a Postgres logical replication slot
-  "publication_name":
-    "description": |-
-      The name of the publication to use for the Postgres source
-  "slot_name":
-    "description": |-
-      The name of the logical replication slot to use for the Postgres source
-github.com/databricks/databricks-sdk-go/service/pipelines.ReportSpec:
-  "destination_catalog":
-    "description": |-
-      Required. Destination catalog to store table.
-  "destination_schema":
-    "description": |-
-      Required. Destination schema to store table.
-  "destination_table":
-    "description": |-
-      Required. Destination table name. The pipeline fails if a table with that name already exists.
-  "source_url":
-    "description": |-
-      Required. Report URL in the source system.
-  "table_configuration":
-    "description": |-
-      Configuration settings to control the ingestion of tables. These settings override the table_configuration defined in the IngestionPipelineDefinition object.
-github.com/databricks/databricks-sdk-go/service/pipelines.RestartWindow:
-  "days_of_week":
-    "description": |-
-      Days of week in which the restart is allowed to happen (within a five-hour window starting at start_hour).
-      If not specified all days of the week will be used.
-  "start_hour":
-    "description": |-
-      An integer between 0 and 23 denoting the start hour for the restart window in the 24-hour day.
-      Continuous pipeline restart is triggered only within a five-hour window starting at this hour.
-  "time_zone_id":
-    "description": |-
-      Time zone id of restart window. See https://docs.databricks.com/sql/language-manual/sql-ref-syntax-aux-conf-mgmt-set-timezone.html for details.
-      If not specified, UTC will be used.
-github.com/databricks/databricks-sdk-go/service/pipelines.RunAs:
-  "_":
-    "description": |-
-      Write-only setting, available only in Create/Update calls. Specifies the user or service principal that the pipeline runs as. If not specified, the pipeline runs as the user who created the pipeline.
-
-      Only `user_name` or `service_principal_name` can be specified. If both are specified, an error is thrown.
-  "service_principal_name":
-    "description": |-
-      Application ID of an active service principal. Setting this field requires the `servicePrincipal/user` role.
-  "user_name":
-    "description": |-
-      The email of an active workspace user. Users can only set this field to their own email.
-github.com/databricks/databricks-sdk-go/service/pipelines.SchemaSpec:
-  "connector_options":
-    "description": |-
-      (Optional) Source Specific Connector Options
-    "x-databricks-preview": |-
-      PRIVATE
-  "destination_catalog":
-    "description": |-
-      Required. Destination catalog to store tables.
-  "destination_schema":
-    "description": |-
-      Required. Destination schema to store tables in. Tables with the same name as the source tables are created in this destination schema. The pipeline fails If a table with the same name already exists.
-  "source_catalog":
-    "description": |-
-      The source catalog name. Might be optional depending on the type of source.
-  "source_schema":
-    "description": |-
-      Required. Schema name in the source database.
-  "table_configuration":
-    "description": |-
-      Configuration settings to control the ingestion of tables. These settings are applied to all tables in this schema and override the table_configuration defined in the IngestionPipelineDefinition object.
-github.com/databricks/databricks-sdk-go/service/pipelines.SharepointOptions:
-  "entity_type":
-    "description": |-
-      (Optional) The type of SharePoint entity to ingest.
-      If not specified, defaults to FILE.
-  "file_ingestion_options":
-    "description": |-
-      (Optional) File ingestion options for processing files.
-  "url":
-    "description": |-
-      Required. The SharePoint URL.
-github.com/databricks/databricks-sdk-go/service/pipelines.SharepointOptionsSharepointEntityType:
-  "_":
-    "enum":
-      - |-
-        FILE
-      - |-
-        FILE_METADATA
-      - |-
-        PERMISSION
-      - |-
-        LIST
-github.com/databricks/databricks-sdk-go/service/pipelines.SourceCatalogConfig:
-  "_":
-    "description": |-
-      SourceCatalogConfig contains catalog-level custom configuration parameters for each source
-  "postgres":
-    "description": |-
-      Postgres-specific catalog-level configuration parameters
-  "source_catalog":
-    "description": |-
-      Source catalog name
-github.com/databricks/databricks-sdk-go/service/pipelines.SourceConfig:
-  "catalog":
-    "description": |-
-      Catalog-level source configuration parameters
-github.com/databricks/databricks-sdk-go/service/pipelines.TableSpec:
-  "connector_options":
-    "description": |-
-      (Optional) Source Specific Connector Options
-    "x-databricks-preview": |-
-      PRIVATE
-  "destination_catalog":
-    "description": |-
-      Required. Destination catalog to store table.
-  "destination_schema":
-    "description": |-
-      Required. Destination schema to store table.
-  "destination_table":
-    "description": |-
-      Optional. Destination table name. The pipeline fails if a table with that name already exists. If not set, the source table name is used.
-  "source_catalog":
-    "description": |-
-      Source catalog name. Might be optional depending on the type of source.
-  "source_schema":
-    "description": |-
-      Schema name in the source database. Might be optional depending on the type of source.
-  "source_table":
-    "description": |-
-      Required. Table name in the source database.
-  "table_configuration":
-    "description": |-
-      Configuration settings to control the ingestion of tables. These settings override the table_configuration defined in the IngestionPipelineDefinition object and the SchemaSpec.
-github.com/databricks/databricks-sdk-go/service/pipelines.TableSpecificConfig:
-  "auto_full_refresh_policy":
-    "description": |-
-      (Optional, Mutable) Policy for auto full refresh, if enabled pipeline will automatically try
-      to fix issues by doing a full refresh on the table in the retry run. auto_full_refresh_policy
-      in table configuration will override the above level auto_full_refresh_policy.
-      For example,
-      {
-      "auto_full_refresh_policy": {
-      "enabled": true,
-      "min_interval_hours": 23,
-      }
-      }
-      If unspecified, auto full refresh is disabled.
-  "exclude_columns":
-    "description": |-
-      A list of column names to be excluded for the ingestion.
-      When not specified, include_columns fully controls what columns to be ingested.
-      When specified, all other columns including future ones will be automatically included for ingestion.
-      This field in mutually exclusive with `include_columns`.
-  "include_columns":
-    "description": |-
-      A list of column names to be included for the ingestion.
-      When not specified, all columns except ones in exclude_columns will be included. Future
-      columns will be automatically included.
-      When specified, all other future columns will be automatically excluded from ingestion.
-      This field in mutually exclusive with `exclude_columns`.
-  "primary_keys":
-    "description": |-
-      The primary key of the table used to apply changes.
-  "query_based_connector_config":
-    "description": |-
-      Configurations that are only applicable for query-based ingestion connectors.
-    "x-databricks-preview": |-
-      PRIVATE
-  "row_filter":
-    "description": |-
-      (Optional, Immutable) The row filter condition to be applied to the table.
-      It must not contain the WHERE keyword, only the actual filter condition.
-      It must be in DBSQL format.
-    "x-databricks-preview": |-
-      PRIVATE
-  "salesforce_include_formula_fields":
-    "description": |-
-      If true, formula fields defined in the table are included in the ingestion. This setting is only valid for the Salesforce connector
-    "x-databricks-preview": |-
-      PRIVATE
-  "scd_type":
-    "description": |-
-      The SCD type to use to ingest the table.
-    "x-databricks-preview": |-
-      PRIVATE
-  "sequence_by":
-    "description": |-
-      The column names specifying the logical order of events in the source data. Spark Declarative Pipelines uses this sequencing to handle change events that arrive out of order.
-  "workday_report_parameters":
-    "description": |-
-      (Optional) Additional custom parameters for Workday Report
-    "x-databricks-preview": |-
-      PRIVATE
-github.com/databricks/databricks-sdk-go/service/pipelines.TableSpecificConfigScdType:
-  "_":
-    "description": |-
-      The SCD type to use to ingest the table.
-    "enum":
-      - |-
-        SCD_TYPE_1
-      - |-
-        SCD_TYPE_2
-      - |-
-        APPEND_ONLY
-github.com/databricks/databricks-sdk-go/service/pipelines.TikTokAdsOptions:
-  "_":
-    "description": |-
-      TikTok Ads specific options for ingestion
-  "data_level":
-    "description": |-
-      (Optional) Data level for the report.
-      If not specified, defaults to AUCTION_CAMPAIGN.
-  "dimensions":
-    "description": |-
-      (Optional) Dimensions to include in the report.
-      Examples: "campaign_id", "adgroup_id", "ad_id", "stat_time_day", "stat_time_hour"
-      If not specified, defaults to campaign_id.
-  "lookback_window_days":
-    "description": |-
-      (Optional) Number of days to look back for report tables during incremental sync
-      to capture late-arriving conversions and attribution data.
-      If not specified, defaults to 7 days.
-  "metrics":
-    "description": |-
-      (Optional) Metrics to include in the report.
-      Examples: "spend", "impressions", "clicks", "conversion", "cpc"
-      If not specified, defaults to basic metrics (spend, impressions, clicks, etc.)
-  "query_lifetime":
-    "description": |-
-      (Optional) Whether to request lifetime metrics (all-time aggregated data).
-      When true, the report returns all-time data.
-      If not specified, defaults to false.
-  "report_type":
-    "description": |-
-      (Optional) Report type for the TikTok Ads API.
-      If not specified, defaults to BASIC.
-  "sync_start_date":
-    "description": |-
-      (Optional) Start date for the initial sync of report tables in YYYY-MM-DD format.
-      This determines the earliest date from which to sync historical data.
-      If not specified, defaults to 1 year of historical data for daily reports
-      and 30 days for hourly reports.
-github.com/databricks/databricks-sdk-go/service/pipelines.TikTokAdsOptionsTikTokDataLevel:
-  "_":
-    "description": |-
-      Data level for TikTok Ads report aggregation.
-    "enum":
-      - |-
-        AUCTION_ADVERTISER
-      - |-
-        AUCTION_CAMPAIGN
-      - |-
-        AUCTION_ADGROUP
-      - |-
-        AUCTION_AD
-github.com/databricks/databricks-sdk-go/service/pipelines.TikTokAdsOptionsTikTokReportType:
-  "_":
-    "description": |-
-      Report type for TikTok Ads API.
-    "enum":
-      - |-
-        BASIC
-      - |-
-        AUDIENCE
-      - |-
-        PLAYABLE_AD
-      - |-
-        DSA
-      - |-
-        BUSINESS_CENTER
-      - |-
-        GMV_MAX
-github.com/databricks/databricks-sdk-go/service/postgres.EndpointGroupSpec:
-  "enable_readable_secondaries":
-    "description": |-
-      Whether to allow read-only connections to read-write endpoints. Only relevant for read-write endpoints where
-      size.max > 1.
-  "max":
-    "description": |-
-      The maximum number of computes in the endpoint group. Currently, this must be equal to min. Set to 1 for single
-      compute endpoints, to disable HA. To manually suspend all computes in an endpoint group, set disabled to
-      true on the EndpointSpec.
-  "min":
-    "description": |-
-      The minimum number of computes in the endpoint group. Currently, this must be equal to max. This must be greater
-      than or equal to 1.
-github.com/databricks/databricks-sdk-go/service/postgres.EndpointSettings:
-  "_":
-    "description": |-
-      A collection of settings for a compute endpoint.
-  "pg_settings":
-    "description": |-
-      A raw representation of Postgres settings.
-github.com/databricks/databricks-sdk-go/service/postgres.EndpointType:
-  "_":
-    "description": |-
-      The compute endpoint type. Either `read_write` or `read_only`.
-    "enum":
-      - |-
-        ENDPOINT_TYPE_READ_WRITE
-      - |-
-        ENDPOINT_TYPE_READ_ONLY
-github.com/databricks/databricks-sdk-go/service/postgres.ProjectCustomTag:
-  "key":
-    "description": |-
-      The key of the custom tag.
-  "value":
-    "description": |-
-      The value of the custom tag.
-github.com/databricks/databricks-sdk-go/service/postgres.ProjectDefaultEndpointSettings:
-  "_":
-    "description": |-
-      A collection of settings for a compute endpoint.
-  "autoscaling_limit_max_cu":
-    "description": |-
-      The maximum number of Compute Units. Minimum value is 0.5.
-  "autoscaling_limit_min_cu":
-    "description": |-
-      The minimum number of Compute Units. Minimum value is 0.5.
-  "no_suspension":
-    "description": |-
-      When set to true, explicitly disables automatic suspension (never suspend).
-      Should be set to true when provided.
-  "pg_settings":
-    "description": |-
-      A raw representation of Postgres settings.
-  "suspend_timeout_duration":
-    "description": |-
-      Duration of inactivity after which the compute endpoint is automatically suspended.
-      If specified should be between 60s and 604800s (1 minute to 1 week).
-github.com/databricks/databricks-sdk-go/service/serving.Ai21LabsConfig:
-  "ai21labs_api_key":
-    "description": |-
-      The Databricks secret key reference for an AI21 Labs API key. If you
-      prefer to paste your API key directly, see `ai21labs_api_key_plaintext`.
-      You must provide an API key using one of the following fields:
-      `ai21labs_api_key` or `ai21labs_api_key_plaintext`.
-  "ai21labs_api_key_plaintext":
-    "description": |-
-      An AI21 Labs API key provided as a plaintext string. If you prefer to
-      reference your key using Databricks Secrets, see `ai21labs_api_key`. You
-      must provide an API key using one of the following fields:
-      `ai21labs_api_key` or `ai21labs_api_key_plaintext`.
-github.com/databricks/databricks-sdk-go/service/serving.AiGatewayConfig:
-  "fallback_config":
-    "description": |-
-      Configuration for traffic fallback which auto fallbacks to other served entities if the request to a served
-      entity fails with certain error codes, to increase availability.
-  "guardrails":
-    "description": |-
-      Configuration for AI Guardrails to prevent unwanted data and unsafe data in requests and responses.
-  "inference_table_config":
-    "description": |-
-      Configuration for payload logging using inference tables.
-      Use these tables to monitor and audit data being sent to and received from model APIs and to improve model quality.
-  "rate_limits":
-    "description": |-
-      Configuration for rate limits which can be set to limit endpoint traffic.
-  "usage_tracking_config":
-    "description": |-
-      Configuration to enable usage tracking using system tables.
-      These tables allow you to monitor operational usage on endpoints and their associated costs.
-github.com/databricks/databricks-sdk-go/service/serving.AiGatewayGuardrailParameters:
-  "invalid_keywords":
-    "description": |-
-      List of invalid keywords.
-      AI guardrail uses keyword or string matching to decide if the keyword exists in the request or response content.
-    "deprecation_message": |-
-      This field is deprecated
-  "pii":
-    "description": |-
-      Configuration for guardrail PII filter.
-  "safety":
-    "description": |-
-      Indicates whether the safety filter is enabled.
-  "valid_topics":
-    "description": |-
-      The list of allowed topics.
-      Given a chat request, this guardrail flags the request if its topic is not in the allowed topics.
-    "deprecation_message": |-
-      This field is deprecated
-github.com/databricks/databricks-sdk-go/service/serving.AiGatewayGuardrailPiiBehavior:
-  "behavior":
-    "description": |-
-      Configuration for input guardrail filters.
-github.com/databricks/databricks-sdk-go/service/serving.AiGatewayGuardrailPiiBehaviorBehavior:
-  "_":
-    "enum":
-      - |-
-        NONE
-      - |-
-        BLOCK
-      - |-
-        MASK
-github.com/databricks/databricks-sdk-go/service/serving.AiGatewayGuardrails:
-  "input":
-    "description": |-
-      Configuration for input guardrail filters.
-  "output":
-    "description": |-
-      Configuration for output guardrail filters.
-github.com/databricks/databricks-sdk-go/service/serving.AiGatewayInferenceTableConfig:
-  "catalog_name":
-    "description": |-
-      The name of the catalog in Unity Catalog. Required when enabling inference tables.
-      NOTE: On update, you have to disable inference table first in order to change the catalog name.
-  "enabled":
-    "description": |-
-      Indicates whether the inference table is enabled.
-  "schema_name":
-    "description": |-
-      The name of the schema in Unity Catalog. Required when enabling inference tables.
-      NOTE: On update, you have to disable inference table first in order to change the schema name.
-  "table_name_prefix":
-    "description": |-
-      The prefix of the table in Unity Catalog.
-      NOTE: On update, you have to disable inference table first in order to change the prefix name.
-github.com/databricks/databricks-sdk-go/service/serving.AiGatewayRateLimit:
-  "calls":
-    "description": |-
-      Used to specify how many calls are allowed for a key within the renewal_period.
-  "key":
-    "description": |-
-      Key field for a rate limit. Currently, 'user', 'user_group, 'service_principal', and 'endpoint' are supported,
-      with 'endpoint' being the default if not specified.
-  "principal":
-    "description": |-
-      Principal field for a user, user group, or service principal to apply rate limiting to. Accepts a user email, group name, or service principal application ID.
-  "renewal_period":
-    "description": |-
-      Renewal period field for a rate limit. Currently, only 'minute' is supported.
-  "tokens":
-    "description": |-
-      Used to specify how many tokens are allowed for a key within the renewal_period.
-github.com/databricks/databricks-sdk-go/service/serving.AiGatewayRateLimitKey:
-  "_":
-    "enum":
-      - |-
-        user
-      - |-
-        endpoint
-      - |-
-        user_group
-      - |-
-        service_principal
-github.com/databricks/databricks-sdk-go/service/serving.AiGatewayRateLimitRenewalPeriod:
-  "_":
-    "enum":
-      - |-
-        minute
-github.com/databricks/databricks-sdk-go/service/serving.AiGatewayUsageTrackingConfig:
-  "enabled":
-    "description": |-
-      Whether to enable usage tracking.
-github.com/databricks/databricks-sdk-go/service/serving.AmazonBedrockConfig:
-  "aws_access_key_id":
-    "description": |-
-      The Databricks secret key reference for an AWS access key ID with
-      permissions to interact with Bedrock services. If you prefer to paste
-      your API key directly, see `aws_access_key_id_plaintext`. You must provide an API
-      key using one of the following fields: `aws_access_key_id` or
-      `aws_access_key_id_plaintext`.
-  "aws_access_key_id_plaintext":
-    "description": |-
-      An AWS access key ID with permissions to interact with Bedrock services
-      provided as a plaintext string. If you prefer to reference your key using
-      Databricks Secrets, see `aws_access_key_id`. You must provide an API key
-      using one of the following fields: `aws_access_key_id` or
-      `aws_access_key_id_plaintext`.
-  "aws_region":
-    "description": |-
-      The AWS region to use. Bedrock has to be enabled there.
-  "aws_secret_access_key":
-    "description": |-
-      The Databricks secret key reference for an AWS secret access key paired
-      with the access key ID, with permissions to interact with Bedrock
-      services. If you prefer to paste your API key directly, see
-      `aws_secret_access_key_plaintext`. You must provide an API key using one
-      of the following fields: `aws_secret_access_key` or
-      `aws_secret_access_key_plaintext`.
-  "aws_secret_access_key_plaintext":
-    "description": |-
-      An AWS secret access key paired with the access key ID, with permissions
-      to interact with Bedrock services provided as a plaintext string. If you
-      prefer to reference your key using Databricks Secrets, see
-      `aws_secret_access_key`. You must provide an API key using one of the
-      following fields: `aws_secret_access_key` or
-      `aws_secret_access_key_plaintext`.
-  "bedrock_provider":
-    "description": |-
-      The underlying provider in Amazon Bedrock. Supported values (case
-      insensitive) include: Anthropic, Cohere, AI21Labs, Amazon.
-  "instance_profile_arn":
-    "description": |-
-      ARN of the instance profile that the external model will use to access AWS resources.
-      You must authenticate using an instance profile or access keys.
-      If you prefer to authenticate using access keys, see `aws_access_key_id`,
-      `aws_access_key_id_plaintext`, `aws_secret_access_key` and `aws_secret_access_key_plaintext`.
-github.com/databricks/databricks-sdk-go/service/serving.AmazonBedrockConfigBedrockProvider:
-  "_":
-    "enum":
-      - |-
-        anthropic
-      - |-
-        cohere
-      - |-
-        ai21labs
-      - |-
-        amazon
-github.com/databricks/databricks-sdk-go/service/serving.AnthropicConfig:
-  "anthropic_api_key":
-    "description": |-
-      The Databricks secret key reference for an Anthropic API key. If you
-      prefer to paste your API key directly, see `anthropic_api_key_plaintext`.
-      You must provide an API key using one of the following fields:
-      `anthropic_api_key` or `anthropic_api_key_plaintext`.
-  "anthropic_api_key_plaintext":
-    "description": |-
-      The Anthropic API key provided as a plaintext string. If you prefer to
-      reference your key using Databricks Secrets, see `anthropic_api_key`. You
-      must provide an API key using one of the following fields:
-      `anthropic_api_key` or `anthropic_api_key_plaintext`.
-github.com/databricks/databricks-sdk-go/service/serving.ApiKeyAuth:
-  "key":
-    "description": |-
-      The name of the API key parameter used for authentication.
-  "value":
-    "description": |-
-      The Databricks secret key reference for an API Key.
-      If you prefer to paste your token directly, see `value_plaintext`.
-  "value_plaintext":
-    "description": |-
-      The API Key provided as a plaintext string. If you prefer to reference your
-      token using Databricks Secrets, see `value`.
-github.com/databricks/databricks-sdk-go/service/serving.AutoCaptureConfigInput:
-  "catalog_name":
-    "description": |-
-      The name of the catalog in Unity Catalog. NOTE: On update, you cannot change the catalog name if the inference table is already enabled.
-  "enabled":
-    "description": |-
-      Indicates whether the inference table is enabled.
-  "schema_name":
-    "description": |-
-      The name of the schema in Unity Catalog. NOTE: On update, you cannot change the schema name if the inference table is already enabled.
-  "table_name_prefix":
-    "description": |-
-      The prefix of the table in Unity Catalog. NOTE: On update, you cannot change the prefix name if the inference table is already enabled.
-github.com/databricks/databricks-sdk-go/service/serving.BearerTokenAuth:
-  "token":
-    "description": |-
-      The Databricks secret key reference for a token.
-      If you prefer to paste your token directly, see `token_plaintext`.
-  "token_plaintext":
-    "description": |-
-      The token provided as a plaintext string. If you prefer to reference your
-      token using Databricks Secrets, see `token`.
-github.com/databricks/databricks-sdk-go/service/serving.CohereConfig:
-  "cohere_api_base":
-    "description": |-
-      This is an optional field to provide a customized base URL for the Cohere
-      API. If left unspecified, the standard Cohere base URL is used.
-  "cohere_api_key":
-    "description": |-
-      The Databricks secret key reference for a Cohere API key. If you prefer
-      to paste your API key directly, see `cohere_api_key_plaintext`. You must
-      provide an API key using one of the following fields: `cohere_api_key` or
-      `cohere_api_key_plaintext`.
-  "cohere_api_key_plaintext":
-    "description": |-
-      The Cohere API key provided as a plaintext string. If you prefer to
-      reference your key using Databricks Secrets, see `cohere_api_key`. You
-      must provide an API key using one of the following fields:
-      `cohere_api_key` or `cohere_api_key_plaintext`.
-github.com/databricks/databricks-sdk-go/service/serving.CustomProviderConfig:
-  "_":
-    "description": |-
-      Configs needed to create a custom provider model route.
-  "api_key_auth":
-    "description": |-
-      This is a field to provide API key authentication for the custom provider API.
-      You can only specify one authentication method.
-  "bearer_token_auth":
-    "description": |-
-      This is a field to provide bearer token authentication for the custom provider API.
-      You can only specify one authentication method.
-  "custom_provider_url":
-    "description": |-
-      This is a field to provide the URL of the custom provider API.
-github.com/databricks/databricks-sdk-go/service/serving.DatabricksModelServingConfig:
-  "databricks_api_token":
-    "description": |-
-      The Databricks secret key reference for a Databricks API token that
-      corresponds to a user or service principal with Can Query access to the
-      model serving endpoint pointed to by this external model. If you prefer
-      to paste your API key directly, see `databricks_api_token_plaintext`. You
-      must provide an API key using one of the following fields:
-      `databricks_api_token` or `databricks_api_token_plaintext`.
-  "databricks_api_token_plaintext":
-    "description": |-
-      The Databricks API token that corresponds to a user or service principal
-      with Can Query access to the model serving endpoint pointed to by this
-      external model provided as a plaintext string. If you prefer to reference
-      your key using Databricks Secrets, see `databricks_api_token`. You must
-      provide an API key using one of the following fields:
-      `databricks_api_token` or `databricks_api_token_plaintext`.
-  "databricks_workspace_url":
-    "description": |-
-      The URL of the Databricks workspace containing the model serving endpoint
-      pointed to by this external model.
-github.com/databricks/databricks-sdk-go/service/serving.EmailNotifications:
-  "on_update_failure":
-    "description": |-
-      A list of email addresses to be notified when an endpoint fails to update its configuration or state.
-  "on_update_success":
-    "description": |-
-      A list of email addresses to be notified when an endpoint successfully updates its configuration or state.
-github.com/databricks/databricks-sdk-go/service/serving.EndpointCoreConfigInput:
-  "auto_capture_config":
-    "description": |-
-      Configuration for Inference Tables which automatically logs requests and responses to Unity Catalog.
-      Note: this field is deprecated for creating new provisioned throughput endpoints,
-      or updating existing provisioned throughput endpoints that never have inference table configured;
-      in these cases please use AI Gateway to manage inference tables.
-  "served_entities":
-    "description": |-
-      The list of served entities under the serving endpoint config.
-  "served_models":
-    "description": |-
-      (Deprecated, use served_entities instead) The list of served models under the serving endpoint config.
-  "traffic_config":
-    "description": |-
-      The traffic configuration associated with the serving endpoint config.
-github.com/databricks/databricks-sdk-go/service/serving.EndpointTag:
-  "key":
-    "description": |-
-      Key field for a serving endpoint tag.
-  "value":
-    "description": |-
-      Optional value field for a serving endpoint tag.
-github.com/databricks/databricks-sdk-go/service/serving.ExternalModel:
-  "ai21labs_config":
-    "description": |-
-      AI21Labs Config. Only required if the provider is 'ai21labs'.
-  "amazon_bedrock_config":
-    "description": |-
-      Amazon Bedrock Config. Only required if the provider is 'amazon-bedrock'.
-  "anthropic_config":
-    "description": |-
-      Anthropic Config. Only required if the provider is 'anthropic'.
-  "cohere_config":
-    "description": |-
-      Cohere Config. Only required if the provider is 'cohere'.
-  "custom_provider_config":
-    "description": |-
-      Custom Provider Config. Only required if the provider is 'custom'.
-  "databricks_model_serving_config":
-    "description": |-
-      Databricks Model Serving Config. Only required if the provider is 'databricks-model-serving'.
-  "google_cloud_vertex_ai_config":
-    "description": |-
-      Google Cloud Vertex AI Config. Only required if the provider is 'google-cloud-vertex-ai'.
-  "name":
-    "description": |-
-      The name of the external model.
-  "openai_config":
-    "description": |-
-      OpenAI Config. Only required if the provider is 'openai'.
-  "palm_config":
-    "description": |-
-      PaLM Config. Only required if the provider is 'palm'.
-  "provider":
-    "description": |-
-      The name of the provider for the external model. Currently, the supported providers are 'ai21labs', 'anthropic', 'amazon-bedrock', 'cohere', 'databricks-model-serving', 'google-cloud-vertex-ai', 'openai', 'palm', and 'custom'.
-  "task":
-    "description": |-
-      The task type of the external model.
-github.com/databricks/databricks-sdk-go/service/serving.ExternalModelProvider:
-  "_":
-    "enum":
-      - |-
-        ai21labs
-      - |-
-        anthropic
-      - |-
-        amazon-bedrock
-      - |-
-        cohere
-      - |-
-        databricks-model-serving
-      - |-
-        google-cloud-vertex-ai
-      - |-
-        openai
-      - |-
-        palm
-      - |-
-        custom
-github.com/databricks/databricks-sdk-go/service/serving.FallbackConfig:
-  "enabled":
-    "description": |-
-      Whether to enable traffic fallback. When a served entity in the serving endpoint returns specific error
-      codes (e.g. 500), the request will automatically be round-robin attempted with other served entities in the same
-      endpoint, following the order of served entity list, until a successful response is returned.
-      If all attempts fail, return the last response with the error code.
-github.com/databricks/databricks-sdk-go/service/serving.GoogleCloudVertexAiConfig:
-  "private_key":
-    "description": |-
-      The Databricks secret key reference for a private key for the service
-      account which has access to the Google Cloud Vertex AI Service. See [Best
-      practices for managing service account keys]. If you prefer to paste your
-      API key directly, see `private_key_plaintext`. You must provide an API
-      key using one of the following fields: `private_key` or
-      `private_key_plaintext`
-
-      [Best practices for managing service account keys]: https://cloud.google.com/iam/docs/best-practices-for-managing-service-account-keys
-  "private_key_plaintext":
-    "description": |-
-      The private key for the service account which has access to the Google
-      Cloud Vertex AI Service provided as a plaintext secret. See [Best
-      practices for managing service account keys]. If you prefer to reference
-      your key using Databricks Secrets, see `private_key`. You must provide an
-      API key using one of the following fields: `private_key` or
-      `private_key_plaintext`.
-
-      [Best practices for managing service account keys]: https://cloud.google.com/iam/docs/best-practices-for-managing-service-account-keys
-  "project_id":
-    "description": |-
-      This is the Google Cloud project id that the service account is
-      associated with.
-  "region":
-    "description": |-
-      This is the region for the Google Cloud Vertex AI Service. See [supported
-      regions] for more details. Some models are only available in specific
-      regions.
-
-      [supported regions]: https://cloud.google.com/vertex-ai/docs/general/locations
-github.com/databricks/databricks-sdk-go/service/serving.OpenAiConfig:
-  "_":
-    "description": |-
-      Configs needed to create an OpenAI model route.
-  "microsoft_entra_client_id":
-    "description": |-
-      This field is only required for Azure AD OpenAI and is the Microsoft
-      Entra Client ID.
-  "microsoft_entra_client_secret":
-    "description": |-
-      The Databricks secret key reference for a client secret used for
-      Microsoft Entra ID authentication. If you prefer to paste your client
-      secret directly, see `microsoft_entra_client_secret_plaintext`. You must
-      provide an API key using one of the following fields:
-      `microsoft_entra_client_secret` or
-      `microsoft_entra_client_secret_plaintext`.
-  "microsoft_entra_client_secret_plaintext":
-    "description": |-
-      The client secret used for Microsoft Entra ID authentication provided as
-      a plaintext string. If you prefer to reference your key using Databricks
-      Secrets, see `microsoft_entra_client_secret`. You must provide an API key
-      using one of the following fields: `microsoft_entra_client_secret` or
-      `microsoft_entra_client_secret_plaintext`.
-  "microsoft_entra_tenant_id":
-    "description": |-
-      This field is only required for Azure AD OpenAI and is the Microsoft
-      Entra Tenant ID.
-  "openai_api_base":
-    "description": |-
-      This is a field to provide a customized base URl for the OpenAI API. For
-      Azure OpenAI, this field is required, and is the base URL for the Azure
-      OpenAI API service provided by Azure. For other OpenAI API types, this
-      field is optional, and if left unspecified, the standard OpenAI base URL
-      is used.
-  "openai_api_key":
-    "description": |-
-      The Databricks secret key reference for an OpenAI API key using the
-      OpenAI or Azure service. If you prefer to paste your API key directly,
-      see `openai_api_key_plaintext`. You must provide an API key using one of
-      the following fields: `openai_api_key` or `openai_api_key_plaintext`.
-  "openai_api_key_plaintext":
-    "description": |-
-      The OpenAI API key using the OpenAI or Azure service provided as a
-      plaintext string. If you prefer to reference your key using Databricks
-      Secrets, see `openai_api_key`. You must provide an API key using one of
-      the following fields: `openai_api_key` or `openai_api_key_plaintext`.
-  "openai_api_type":
-    "description": |-
-      This is an optional field to specify the type of OpenAI API to use. For
-      Azure OpenAI, this field is required, and adjust this parameter to
-      represent the preferred security access validation protocol. For access
-      token validation, use azure. For authentication using Azure Active
-      Directory (Azure AD) use, azuread.
-  "openai_api_version":
-    "description": |-
-      This is an optional field to specify the OpenAI API version. For Azure
-      OpenAI, this field is required, and is the version of the Azure OpenAI
-      service to utilize, specified by a date.
-  "openai_deployment_name":
-    "description": |-
-      This field is only required for Azure OpenAI and is the name of the
-      deployment resource for the Azure OpenAI service.
-  "openai_organization":
-    "description": |-
-      This is an optional field to specify the organization in OpenAI or Azure
-      OpenAI.
-github.com/databricks/databricks-sdk-go/service/serving.PaLmConfig:
-  "palm_api_key":
-    "description": |-
-      The Databricks secret key reference for a PaLM API key. If you prefer to
-      paste your API key directly, see `palm_api_key_plaintext`. You must
-      provide an API key using one of the following fields: `palm_api_key` or
-      `palm_api_key_plaintext`.
-  "palm_api_key_plaintext":
-    "description": |-
-      The PaLM API key provided as a plaintext string. If you prefer to
-      reference your key using Databricks Secrets, see `palm_api_key`. You must
-      provide an API key using one of the following fields: `palm_api_key` or
-      `palm_api_key_plaintext`.
-github.com/databricks/databricks-sdk-go/service/serving.RateLimit:
-  "calls":
-    "description": |-
-      Used to specify how many calls are allowed for a key within the renewal_period.
-  "key":
-    "description": |-
-      Key field for a serving endpoint rate limit. Currently, only 'user' and 'endpoint' are supported, with 'endpoint' being the default if not specified.
-  "renewal_period":
-    "description": |-
-      Renewal period field for a serving endpoint rate limit. Currently, only 'minute' is supported.
-github.com/databricks/databricks-sdk-go/service/serving.RateLimitKey:
-  "_":
-    "enum":
-      - |-
-        user
-      - |-
-        endpoint
-github.com/databricks/databricks-sdk-go/service/serving.RateLimitRenewalPeriod:
-  "_":
-    "enum":
-      - |-
-        minute
-github.com/databricks/databricks-sdk-go/service/serving.Route:
-  "served_entity_name": {}
-  "served_model_name":
-    "description": |-
-      The name of the served model this route configures traffic for.
-  "traffic_percentage":
-    "description": |-
-      The percentage of endpoint traffic to send to this route. It must be an integer between 0 and 100 inclusive.
-github.com/databricks/databricks-sdk-go/service/serving.ServedEntityInput:
-  "burst_scaling_enabled":
-    "description": |-
-      Whether burst scaling is enabled. When enabled (default), the endpoint can automatically
-      scale up beyond provisioned capacity to handle traffic spikes. When disabled, the endpoint
-      maintains fixed capacity at provisioned_model_units.
-  "entity_name":
-    "description": |-
-      The name of the entity to be served. The entity may be a model in the Databricks Model Registry, a model in the Unity Catalog (UC), or a function of type FEATURE_SPEC in the UC. If it is a UC object, the full name of the object should be given in the form of **catalog_name.schema_name.model_name**.
-  "entity_version": {}
-  "environment_vars":
-    "description": |-
-      An object containing a set of optional, user-specified environment variable key-value pairs used for serving this entity. Note: this is an experimental feature and subject to change. Example entity environment variables that refer to Databricks secrets: `{"OPENAI_API_KEY": "{{secrets/my_scope/my_key}}", "DATABRICKS_TOKEN": "{{secrets/my_scope2/my_key2}}"}`
-  "external_model":
-    "description": |-
-      The external model to be served. NOTE: Only one of external_model and (entity_name, entity_version, workload_size, workload_type, and scale_to_zero_enabled) can be specified with the latter set being used for custom model serving for a Databricks registered model. For an existing endpoint with external_model, it cannot be updated to an endpoint without external_model. If the endpoint is created without external_model, users cannot update it to add external_model later. The task type of all external models within an endpoint must be the same.
-  "instance_profile_arn":
-    "description": |-
-      ARN of the instance profile that the served entity uses to access AWS resources.
-  "max_provisioned_concurrency":
-    "description": |-
-      The maximum provisioned concurrency that the endpoint can scale up to. Do not use if workload_size is specified.
-  "max_provisioned_throughput":
-    "description": |-
-      The maximum tokens per second that the endpoint can scale up to.
-  "min_provisioned_concurrency":
-    "description": |-
-      The minimum provisioned concurrency that the endpoint can scale down to. Do not use if workload_size is specified.
-  "min_provisioned_throughput":
-    "description": |-
-      The minimum tokens per second that the endpoint can scale down to.
-  "name":
-    "description": |-
-      The name of a served entity. It must be unique across an endpoint. A served entity name can consist of alphanumeric characters, dashes, and underscores. If not specified for an external model, this field defaults to external_model.name, with '.' and ':' replaced with '-', and if not specified for other entities, it defaults to entity_name-entity_version.
-  "provisioned_model_units":
-    "description": |-
-      The number of model units provisioned.
-  "scale_to_zero_enabled":
-    "description": |-
-      Whether the compute resources for the served entity should scale down to zero.
-  "workload_size":
-    "description": |-
-      The workload size of the served entity. The workload size corresponds to a range of provisioned concurrency that the compute autoscales between. A single unit of provisioned concurrency can process one request at a time. Valid workload sizes are "Small" (4 - 4 provisioned concurrency), "Medium" (8 - 16 provisioned concurrency), and "Large" (16 - 64 provisioned concurrency). Additional custom workload sizes can also be used when available in the workspace. If scale-to-zero is enabled, the lower bound of the provisioned concurrency for each workload size is 0. Do not use if min_provisioned_concurrency and max_provisioned_concurrency are specified.
-  "workload_type":
-    "description": |-
-      The workload type of the served entity. The workload type selects which type of compute to use in the endpoint. The default value for this parameter is "CPU". For deep learning workloads, GPU acceleration is available by selecting workload types like GPU_SMALL and others. See the available [GPU types](https://docs.databricks.com/en/machine-learning/model-serving/create-manage-serving-endpoints.html#gpu-workload-types).
-github.com/databricks/databricks-sdk-go/service/serving.ServedModelInput:
-  "burst_scaling_enabled":
-    "description": |-
-      Whether burst scaling is enabled. When enabled (default), the endpoint can automatically
-      scale up beyond provisioned capacity to handle traffic spikes. When disabled, the endpoint
-      maintains fixed capacity at provisioned_model_units.
-  "environment_vars":
-    "description": |-
-      An object containing a set of optional, user-specified environment variable key-value pairs used for serving this entity. Note: this is an experimental feature and subject to change. Example entity environment variables that refer to Databricks secrets: `{"OPENAI_API_KEY": "{{secrets/my_scope/my_key}}", "DATABRICKS_TOKEN": "{{secrets/my_scope2/my_key2}}"}`
-  "instance_profile_arn":
-    "description": |-
-      ARN of the instance profile that the served entity uses to access AWS resources.
-  "max_provisioned_concurrency":
-    "description": |-
-      The maximum provisioned concurrency that the endpoint can scale up to. Do not use if workload_size is specified.
-  "max_provisioned_throughput":
-    "description": |-
-      The maximum tokens per second that the endpoint can scale up to.
-  "min_provisioned_concurrency":
-    "description": |-
-      The minimum provisioned concurrency that the endpoint can scale down to. Do not use if workload_size is specified.
-  "min_provisioned_throughput":
-    "description": |-
-      The minimum tokens per second that the endpoint can scale down to.
-  "model_name": {}
-  "model_version": {}
-  "name":
-    "description": |-
-      The name of a served entity. It must be unique across an endpoint. A served entity name can consist of alphanumeric characters, dashes, and underscores. If not specified for an external model, this field defaults to external_model.name, with '.' and ':' replaced with '-', and if not specified for other entities, it defaults to entity_name-entity_version.
-  "provisioned_model_units":
-    "description": |-
-      The number of model units provisioned.
-  "scale_to_zero_enabled":
-    "description": |-
-      Whether the compute resources for the served entity should scale down to zero.
-  "workload_size":
-    "description": |-
-      The workload size of the served entity. The workload size corresponds to a range of provisioned concurrency that the compute autoscales between. A single unit of provisioned concurrency can process one request at a time. Valid workload sizes are "Small" (4 - 4 provisioned concurrency), "Medium" (8 - 16 provisioned concurrency), and "Large" (16 - 64 provisioned concurrency). Additional custom workload sizes can also be used when available in the workspace. If scale-to-zero is enabled, the lower bound of the provisioned concurrency for each workload size is 0. Do not use if min_provisioned_concurrency and max_provisioned_concurrency are specified.
-  "workload_type":
-    "description": |-
-      The workload type of the served entity. The workload type selects which type of compute to use in the endpoint. The default value for this parameter is "CPU". For deep learning workloads, GPU acceleration is available by selecting workload types like GPU_SMALL and others. See the available [GPU types](https://docs.databricks.com/en/machine-learning/model-serving/create-manage-serving-endpoints.html#gpu-workload-types).
-github.com/databricks/databricks-sdk-go/service/serving.ServedModelInputWorkloadType:
-  "_":
-    "description": |-
-      Please keep this in sync with with workload types in InferenceEndpointEntities.scala
-    "enum":
-      - |-
-        CPU
-      - |-
-        GPU_MEDIUM
-      - |-
-        GPU_SMALL
-      - |-
-        GPU_LARGE
-      - |-
-        MULTIGPU_MEDIUM
-github.com/databricks/databricks-sdk-go/service/serving.ServingEndpointPermissionLevel:
-  "_":
-    "description": |-
-      Permission level
-    "enum":
-      - |-
-        CAN_MANAGE
-      - |-
-        CAN_QUERY
-      - |-
-        CAN_VIEW
-github.com/databricks/databricks-sdk-go/service/serving.ServingModelWorkloadType:
-  "_":
-    "description": |-
-      Please keep this in sync with with workload types in InferenceEndpointEntities.scala
-    "enum":
-      - |-
-        CPU
-      - |-
-        GPU_MEDIUM
-      - |-
-        GPU_SMALL
-      - |-
-        GPU_LARGE
-      - |-
-        MULTIGPU_MEDIUM
-github.com/databricks/databricks-sdk-go/service/serving.TrafficConfig:
-  "routes":
-    "description": |-
-      The list of routes that define traffic to each served entity.
-github.com/databricks/databricks-sdk-go/service/sql.Aggregation:
-  "_":
-    "enum":
-      - |-
-        SUM
-      - |-
-        COUNT
-      - |-
-        COUNT_DISTINCT
-      - |-
-        AVG
-      - |-
-        MEDIAN
-      - |-
-        MIN
-      - |-
-        MAX
-      - |-
-        STDDEV
-github.com/databricks/databricks-sdk-go/service/sql.AlertEvaluationState:
-  "_":
-    "description": |-
-      UNSPECIFIED - default unspecify value for proto enum, do not use it in the code
-      UNKNOWN - alert not yet evaluated
-      TRIGGERED - alert is triggered
-      OK - alert is not triggered
-      ERROR - alert evaluation failed
-    "enum":
-      - |-
-        UNKNOWN
-      - |-
-        TRIGGERED
-      - |-
-        OK
-      - |-
-        ERROR
-github.com/databricks/databricks-sdk-go/service/sql.AlertLifecycleState:
-  "_":
-    "enum":
-      - |-
-        ACTIVE
-      - |-
-        DELETED
-github.com/databricks/databricks-sdk-go/service/sql.AlertV2Evaluation:
-  "comparison_operator":
-    "description": |-
-      Operator used for comparison in alert evaluation.
-  "empty_result_state":
-    "description": |-
-      Alert state if result is empty. Please avoid setting this field to be `UNKNOWN` because `UNKNOWN` state is planned to be deprecated.
-  "last_evaluated_at":
-    "description": |-
-      Timestamp of the last evaluation.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "notification":
-    "description": |-
-      User or Notification Destination to notify when alert is triggered.
-  "source":
-    "description": |-
-      Source column from result to use to evaluate alert
-  "state":
-    "description": |-
-      Latest state of alert evaluation.
-    "x-databricks-field-behaviors_output_only": |-
-      true
-  "threshold":
-    "description": |-
-      Threshold to user for alert evaluation, can be a column or a value.
-github.com/databricks/databricks-sdk-go/service/sql.AlertV2Notification:
-  "notify_on_ok":
-    "description": |-
-      Whether to notify alert subscribers when alert returns back to normal.
-  "retrigger_seconds":
-    "description": |-
-      Number of seconds an alert waits after being triggered before it is allowed to send another notification.
-      If set to 0 or omitted, the alert will not send any further notifications after the first trigger
-      Setting this value to 1 allows the alert to send a notification on every evaluation where the condition is met, effectively making it always retrigger for notification purposes.
-  "subscriptions": {}
-github.com/databricks/databricks-sdk-go/service/sql.AlertV2Operand:
-  "column": {}
-  "value": {}
-github.com/databricks/databricks-sdk-go/service/sql.AlertV2OperandColumn:
-  "aggregation":
-    "description": |-
-      If not set, the behavior is equivalent to using `First row` in the UI.
-  "display": {}
-  "name": {}
-github.com/databricks/databricks-sdk-go/service/sql.AlertV2OperandValue:
-  "bool_value": {}
-  "double_value": {}
-  "string_value": {}
-github.com/databricks/databricks-sdk-go/service/sql.AlertV2RunAs:
-  "service_principal_name":
-    "description": |-
-      Application ID of an active service principal. Setting this field requires the `servicePrincipal/user` role.
-  "user_name":
-    "description": |-
-      The email of an active workspace user. Can only set this field to their own email.
-github.com/databricks/databricks-sdk-go/service/sql.AlertV2Subscription:
-  "destination_id": {}
-  "user_email": {}
-github.com/databricks/databricks-sdk-go/service/sql.Channel:
-  "_":
-    "description": |-
-      Configures the channel name and DBSQL version of the warehouse. CHANNEL_NAME_CUSTOM should be chosen only when `dbsql_version` is specified.
-  "dbsql_version": {}
-  "name": {}
-github.com/databricks/databricks-sdk-go/service/sql.ChannelName:
-  "_":
-    "enum":
-      - |-
-        CHANNEL_NAME_PREVIEW
-      - |-
-        CHANNEL_NAME_CURRENT
-      - |-
-        CHANNEL_NAME_PREVIOUS
-      - |-
-        CHANNEL_NAME_CUSTOM
-github.com/databricks/databricks-sdk-go/service/sql.ComparisonOperator:
-  "_":
-    "enum":
-      - |-
-        LESS_THAN
-      - |-
-        GREATER_THAN
-      - |-
-        EQUAL
-      - |-
-        NOT_EQUAL
-      - |-
-        GREATER_THAN_OR_EQUAL
-      - |-
-        LESS_THAN_OR_EQUAL
-      - |-
-        IS_NULL
-      - |-
-        IS_NOT_NULL
-github.com/databricks/databricks-sdk-go/service/sql.CreateWarehouseRequestWarehouseType:
-  "_":
-    "enum":
-      - |-
-        TYPE_UNSPECIFIED
-      - |-
-        CLASSIC
-      - |-
-        PRO
-github.com/databricks/databricks-sdk-go/service/sql.CronSchedule:
-  "pause_status":
-    "description": |-
-      Indicate whether this schedule is paused or not.
-  "quartz_cron_schedule":
-    "description": |-
-      A cron expression using quartz syntax that specifies the schedule for this pipeline.
-      Should use the quartz format described here: http://www.quartz-scheduler.org/documentation/quartz-2.1.7/tutorials/tutorial-lesson-06.html
-  "timezone_id":
-    "description": |-
-      A Java timezone id. The schedule will be resolved using this timezone.
-      This will be combined with the quartz_cron_schedule to determine the schedule.
-      See https://docs.databricks.com/sql/language-manual/sql-ref-syntax-aux-conf-mgmt-set-timezone.html for details.
-github.com/databricks/databricks-sdk-go/service/sql.EndpointTagPair:
-  "key": {}
-  "value": {}
-github.com/databricks/databricks-sdk-go/service/sql.EndpointTags:
-  "custom_tags": {}
-github.com/databricks/databricks-sdk-go/service/sql.SchedulePauseStatus:
-  "_":
-    "enum":
-      - |-
-        UNPAUSED
-      - |-
-        PAUSED
-github.com/databricks/databricks-sdk-go/service/sql.SpotInstancePolicy:
-  "_":
-    "description": |-
-      EndpointSpotInstancePolicy configures whether the endpoint should use spot
-      instances.
-
-      The breakdown of how the EndpointSpotInstancePolicy converts to per cloud
-      configurations is:
-
-      +-------+--------------------------------------+--------------------------------+
-      | Cloud |            COST_OPTIMIZED            |     RELIABILITY_OPTIMIZED |
-      +-------+--------------------------------------+--------------------------------+
-      | AWS   | On Demand Driver with Spot Executors | On Demand Driver and
-      Executors | | AZURE | On Demand Driver and Executors       | On Demand Driver
-      and Executors |
-      +-------+--------------------------------------+--------------------------------+
-
-      While including "spot" in the enum name may limit the the future
-      extensibility of this field because it limits this enum to denoting "spot or
-      not", this is the field that PM recommends after discussion with customers
-      per SC-48783.
-    "enum":
-      - |-
-        POLICY_UNSPECIFIED
-      - |-
-        COST_OPTIMIZED
-      - |-
-        RELIABILITY_OPTIMIZED
-github.com/databricks/databricks-sdk-go/service/sql.WarehousePermissionLevel:
-  "_":
-    "description": |-
-      Permission level
-    "enum":
-      - |-
-        CAN_MANAGE
-      - |-
-        IS_OWNER
-      - |-
-        CAN_USE
-      - |-
-        CAN_MONITOR
-      - |-
-        CAN_VIEW
-github.com/databricks/databricks-sdk-go/service/vectorsearch.EndpointType:
-  "_":
-    "description": |-
-      Type of endpoint.
-    "enum":
-      - |-
-        STORAGE_OPTIMIZED
-      - |-
-        STANDARD
-github.com/databricks/databricks-sdk-go/service/workspace.AzureKeyVaultSecretScopeMetadata:
-  "_":
-    "description": |-
-      The metadata of the Azure KeyVault for a secret scope of type `AZURE_KEYVAULT`
-  "dns_name":
-    "description": |-
-      The DNS of the KeyVault
-  "resource_id":
-    "description": |-
-      The resource id of the azure KeyVault that user wants to associate the scope with.
-github.com/databricks/databricks-sdk-go/service/workspace.ScopeBackendType:
-  "_":
-    "description": |-
-      The types of secret scope backends in the Secret Manager. Azure KeyVault backed secret scopes
-      will be supported in a later release.
-    "enum":
-      - |-
-        DATABRICKS
-      - |-
-        AZURE_KEYVAULT
diff --git a/bundle/internal/schema/annotations_openapi_overrides.yml b/bundle/internal/schema/annotations_openapi_overrides.yml
deleted file mode 100644
index 690e0c852ee..00000000000
--- a/bundle/internal/schema/annotations_openapi_overrides.yml
+++ /dev/null
@@ -1,1100 +0,0 @@
-github.com/databricks/cli/bundle/config/resources.Alert:
-  "evaluation":
-    "description": |-
-      PLACEHOLDER
-  "file_path":
-    "description": |-
-      PLACEHOLDER
-  "lifecycle":
-    "description": |-
-      PLACEHOLDER
-  "permissions":
-    "description": |-
-      PLACEHOLDER
-  "schedule":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/cli/bundle/config/resources.App:
-  "app_status":
-    "description": |-
-      PLACEHOLDER
-  "budget_policy_id":
-    "description": |-
-      PLACEHOLDER
-  "compute_size":
-    "description": |-
-      PLACEHOLDER
-  "compute_status":
-    "description": |-
-      PLACEHOLDER
-  "config":
-    "description": |-
-      PLACEHOLDER
-  "effective_budget_policy_id":
-    "description": |-
-      PLACEHOLDER
-  "effective_usage_policy_id":
-    "description": |-
-      PLACEHOLDER
-  "git_source":
-    "description": |-
-      PLACEHOLDER
-  "lifecycle":
-    "description": |-
-      Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
-  "oauth2_app_client_id":
-    "description": |-
-      PLACEHOLDER
-  "oauth2_app_integration_id":
-    "description": |-
-      PLACEHOLDER
-  "permissions":
-    "description": |-
-      PLACEHOLDER
-  "service_principal_client_id":
-    "description": |-
-      PLACEHOLDER
-  "service_principal_id":
-    "description": |-
-      PLACEHOLDER
-  "service_principal_name":
-    "description": |-
-      PLACEHOLDER
-  "source_code_path":
-    "description": |-
-      PLACEHOLDER
-  "telemetry_export_destinations":
-    "description": |-
-      PLACEHOLDER
-  "usage_policy_id":
-    "description": |-
-      PLACEHOLDER
-  "user_api_scopes":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/cli/bundle/config/resources.Catalog:
-  "grants":
-    "description": |-
-      PLACEHOLDER
-  "lifecycle":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/cli/bundle/config/resources.Cluster:
-  "_":
-    "markdown_description": |-
-      The cluster resource defines an [all-purpose cluster](/api/workspace/clusters/create).
-    "markdown_examples": |-
-      The following example creates a cluster named `my_cluster` and sets that as the cluster to use to run the notebook in `my_job`:
-
-      ```yaml
-      bundle:
-        name: clusters
-
-      resources:
-        clusters:
-          my_cluster:
-            num_workers: 2
-            node_type_id: "i3.xlarge"
-            autoscale:
-              min_workers: 2
-              max_workers: 7
-            spark_version: "13.3.x-scala2.12"
-            spark_conf:
-              "spark.executor.memory": "2g"
-
-        jobs:
-          my_job:
-            tasks:
-              - task_key: test_task
-                notebook_task:
-                  notebook_path: "./src/my_notebook.py"
-      ```
-  "data_security_mode":
-    "description": |-
-      PLACEHOLDER
-  "docker_image":
-    "description": |-
-      PLACEHOLDER
-  "kind":
-    "description": |-
-      PLACEHOLDER
-  "lifecycle":
-    "description": |-
-      Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
-  "permissions":
-    "description": |-
-      PLACEHOLDER
-  "runtime_engine":
-    "description": |-
-      PLACEHOLDER
-  "workload_type":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/cli/bundle/config/resources.Dashboard:
-  "_":
-    "markdown_description": |-
-      The dashboard resource allows you to manage [AI/BI dashboards](/api/workspace/lakeview/create) in a bundle. For information about AI/BI dashboards, see [_](/dashboards/index.md).
-    "markdown_examples": |-
-      The following example includes and deploys the sample __NYC Taxi Trip Analysis__ dashboard to the Databricks workspace.
-
-      ``` yaml
-      resources:
-        dashboards:
-          nyc_taxi_trip_analysis:
-            display_name: "NYC Taxi Trip Analysis"
-            file_path: ../src/nyc_taxi_trip_analysis.lvdash.json
-            warehouse_id: ${var.warehouse_id}
-      ```
-      If you use the UI to modify the dashboard, modifications made through the UI are not applied to the dashboard JSON file in the local bundle unless you explicitly update it using `bundle generate`. You can use the `--watch` option to continuously poll and retrieve changes to the dashboard. See [_](/dev-tools/cli/bundle-commands.md#generate).
-
-      In addition, if you attempt to deploy a bundle that contains a dashboard JSON file that is different than the one in the remote workspace, an error will occur. To force the deploy and overwrite the dashboard in the remote workspace with the local one, use the `--force` option. See [_](/dev-tools/cli/bundle-commands.md#deploy).
-  "create_time":
-    "description": |-
-      The timestamp of when the dashboard was created.
-  "dashboard_id":
-    "description": |-
-      UUID identifying the dashboard.
-  "display_name":
-    "description": |-
-      The display name of the dashboard.
-  "embed_credentials":
-    "description": |-
-      PLACEHOLDER
-  "etag":
-    "description": |-
-      The etag for the dashboard. Can be optionally provided on updates to ensure that the dashboard
-      has not been modified since the last read.
-      This field is excluded in List Dashboards responses.
-  "file_path":
-    "description": |-
-      PLACEHOLDER
-  "lifecycle":
-    "description": |-
-      Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
-  "lifecycle_state":
-    "description": |-
-      The state of the dashboard resource. Used for tracking trashed status.
-  "parent_path":
-    "description": |-
-      The workspace path of the folder containing the dashboard. Includes leading slash and no
-      trailing slash.
-      This field is excluded in List Dashboards responses.
-  "path":
-    "description": |-
-      The workspace path of the dashboard asset, including the file name.
-      Exported dashboards always have the file extension `.lvdash.json`.
-      This field is excluded in List Dashboards responses.
-  "permissions":
-    "description": |-
-      PLACEHOLDER
-  "serialized_dashboard":
-    "description": |-
-      The contents of the dashboard in serialized string form.
-      This field is excluded in List Dashboards responses.
-      Use the [get dashboard API](https://docs.databricks.com/api/workspace/lakeview/get)
-      to retrieve an example response, which includes the `serialized_dashboard` field.
-      This field provides the structure of the JSON string that represents the dashboard's
-      layout and components.
-  "update_time":
-    "description": |-
-      The timestamp of when the dashboard was last updated by the user.
-      This field is excluded in List Dashboards responses.
-  "warehouse_id":
-    "description": |-
-      The warehouse ID used to run the dashboard.
-github.com/databricks/cli/bundle/config/resources.DatabaseCatalog:
-  "create_database_if_not_exists":
-    "description": |-
-      PLACEHOLDER
-  "lifecycle":
-    "description": |-
-      Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
-  "uid":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/cli/bundle/config/resources.DatabaseInstance:
-  "lifecycle":
-    "description": |-
-      Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
-  "permissions":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/cli/bundle/config/resources.ExternalLocation:
-  "grants":
-    "description": |-
-      PLACEHOLDER
-  "lifecycle":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/cli/bundle/config/resources.Job:
-  "_":
-    "markdown_description": |-
-      The job resource allows you to define [jobs and their corresponding tasks](/api/workspace/jobs/create) in your bundle. For information about jobs, see [_](/jobs/index.md). For a tutorial that uses a Declarative Automation Bundles template to create a job, see [_](/dev-tools/bundles/jobs-tutorial.md).
-    "markdown_examples": |-
-      The following example defines a job with the resource key `hello-job` with one notebook task:
-
-      ```yaml
-      resources:
-        jobs:
-          hello-job:
-            name: hello-job
-            tasks:
-              - task_key: hello-task
-                notebook_task:
-                  notebook_path: ./hello.py
-      ```
-
-      For information about defining job tasks and overriding job settings, see [_](/dev-tools/bundles/job-task-types.md), [_](/dev-tools/bundles/job-task-override.md), and [_](/dev-tools/bundles/cluster-override.md).
-  "health":
-    "description": |-
-      PLACEHOLDER
-  "lifecycle":
-    "description": |-
-      Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
-  "permissions":
-    "description": |-
-      PLACEHOLDER
-  "run_as":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/cli/bundle/config/resources.MlflowExperiment:
-  "_":
-    "markdown_description": |-
-      The experiment resource allows you to define [MLflow experiments](/api/workspace/experiments/createexperiment) in a bundle. For information about MLflow experiments, see [_](/mlflow/experiments.md).
-    "markdown_examples": |-
-      The following example defines an experiment that all users can view:
-
-      ```yaml
-      resources:
-        experiments:
-          experiment:
-            name: my_ml_experiment
-            permissions:
-              - level: CAN_READ
-                group_name: users
-            description: MLflow experiment used to track runs
-      ```
-  "lifecycle":
-    "description": |-
-      Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
-  "permissions":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/cli/bundle/config/resources.MlflowModel:
-  "_":
-    "markdown_description": |-
-      The model resource allows you to define [legacy models](/api/workspace/modelregistry/createmodel) in bundles. Databricks recommends you use Unity Catalog [registered models](#registered-model) instead.
-  "lifecycle":
-    "description": |-
-      Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
-  "permissions":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/cli/bundle/config/resources.ModelServingEndpoint:
-  "_":
-    "markdown_description": |-
-      The model_serving_endpoint resource allows you to define [model serving endpoints](/api/workspace/servingendpoints/create). See [_](/machine-learning/model-serving/manage-serving-endpoints.md).
-    "markdown_examples": |-
-      The following example defines a Unity Catalog model serving endpoint:
-
-      ```yaml
-      resources:
-        model_serving_endpoints:
-          uc_model_serving_endpoint:
-            name: "uc-model-endpoint"
-            config:
-              served_entities:
-              - entity_name: "myCatalog.mySchema.my-ads-model"
-                entity_version: "10"
-                workload_size: "Small"
-                scale_to_zero_enabled: "true"
-              traffic_config:
-                routes:
-                - served_model_name: "my-ads-model-10"
-                  traffic_percentage: "100"
-            tags:
-            - key: "team"
-              value: "data science"
-      ```
-  "description":
-    "description": |-
-      PLACEHOLDER
-  "lifecycle":
-    "description": |-
-      Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
-  "permissions":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/cli/bundle/config/resources.Pipeline:
-  "_":
-    "markdown_description": |-
-      This resource allows you to create [pipelines](/api/workspace/pipelines/create). For information about pipelines, see [_](/dlt/index.md). For a tutorial that uses the Declarative Automation Bundles template to create a pipeline, see [_](/dev-tools/bundles/pipelines-tutorial.md).
-    "markdown_examples": |-
-      The following example defines a pipeline with the resource key `hello-pipeline`:
-
-      ```yaml
-      resources:
-        pipelines:
-          hello-pipeline:
-            name: hello-pipeline
-            clusters:
-              - label: default
-                num_workers: 1
-            development: true
-            continuous: false
-            channel: CURRENT
-            edition: CORE
-            photon: false
-            libraries:
-              - notebook:
-                  path: ./pipeline.py
-      ```
-  "dry_run":
-    "description": |-
-      PLACEHOLDER
-  "lifecycle":
-    "description": |-
-      Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
-  "permissions":
-    "description": |-
-      PLACEHOLDER
-  "run_as":
-    "description": |-
-      PLACEHOLDER
-  "trigger":
-    "deprecation_message": |-
-      Use continuous instead
-github.com/databricks/cli/bundle/config/resources.QualityMonitor:
-  "_":
-    "markdown_description": |-
-      The quality_monitor resource allows you to define a Unity Catalog [table monitor](/api/workspace/qualitymonitors/create). For information about monitors, see [_](/machine-learning/model-serving/monitor-diagnose-endpoints.md).
-    "markdown_examples": |-
-      The following example defines a quality monitor:
-
-      ```yaml
-      resources:
-        quality_monitors:
-          my_quality_monitor:
-            table_name: dev.mlops_schema.predictions
-            output_schema_name: ${bundle.target}.mlops_schema
-            assets_dir: /Users/${workspace.current_user.userName}/databricks_lakehouse_monitoring
-            inference_log:
-              granularities: [1 day]
-              model_id_col: model_id
-              prediction_col: prediction
-              label_col: price
-              problem_type: PROBLEM_TYPE_REGRESSION
-              timestamp_col: timestamp
-            schedule:
-              quartz_cron_expression: 0 0 8 * * ? # Run Every day at 8am
-              timezone_id: UTC
-      ```
-  "inference_log":
-    "description": |-
-      PLACEHOLDER
-  "lifecycle":
-    "description": |-
-      Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
-  "table_name":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/cli/bundle/config/resources.RegisteredModel:
-  "_":
-    "markdown_description": |-
-      The registered model resource allows you to define models in Unity Catalog. For information about Unity Catalog [registered models](/api/workspace/registeredmodels/create), see [_](/machine-learning/manage-model-lifecycle/index.md).
-    "markdown_examples": |-
-      The following example defines a registered model in Unity Catalog:
-
-      ```yaml
-      resources:
-        registered_models:
-            model:
-              name: my_model
-              catalog_name: ${bundle.target}
-              schema_name: mlops_schema
-              comment: Registered model in Unity Catalog for ${bundle.target} deployment target
-              grants:
-                - privileges:
-                    - EXECUTE
-                  principal: account users
-      ```
-  "aliases":
-    "description": |-
-      PLACEHOLDER
-  "browse_only":
-    "description": |-
-      PLACEHOLDER
-  "created_at":
-    "description": |-
-      PLACEHOLDER
-  "created_by":
-    "description": |-
-      PLACEHOLDER
-  "full_name":
-    "description": |-
-      PLACEHOLDER
-  "grants":
-    "description": |-
-      PLACEHOLDER
-  "lifecycle":
-    "description": |-
-      Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
-  "metastore_id":
-    "description": |-
-      PLACEHOLDER
-  "owner":
-    "description": |-
-      PLACEHOLDER
-  "updated_at":
-    "description": |-
-      PLACEHOLDER
-  "updated_by":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/cli/bundle/config/resources.Schema:
-  "_":
-    "markdown_description": |-
-      The schema resource type allows you to define Unity Catalog [schemas](/api/workspace/schemas/create) for tables and other assets in your jobs and pipelines created as part of a bundle. A schema, different from other resource types, has the following limitations:
-
-      - The owner of a schema resource is always the deployment user, and cannot be changed. If `run_as` is specified in the bundle, it will be ignored by operations on the schema.
-      - Only fields supported by the corresponding [Schemas object create API](/api/workspace/schemas/create) are available for the schema resource. For example, `enable_predictive_optimization` is not supported as it is only available on the [update API](/api/workspace/schemas/update).
-    "markdown_examples": |-
-      The following example defines a pipeline with the resource key `my_pipeline` that creates a Unity Catalog schema with the key `my_schema` as the target:
-
-      ```yaml
-      resources:
-        pipelines:
-          my_pipeline:
-            name: test-pipeline-{{.unique_id}}
-            libraries:
-              - notebook:
-                  path: ./nb.sql
-            development: true
-            catalog: main
-            target: ${resources.schemas.my_schema.id}
-
-        schemas:
-          my_schema:
-            name: test-schema-{{.unique_id}}
-            catalog_name: main
-            comment: This schema was created by DABs.
-      ```
-
-      A top-level grants mapping is not supported by Declarative Automation Bundles, so if you want to set grants for a schema, define the grants for the schema within the `schemas` mapping. For more information about grants, see [_](/data-governance/unity-catalog/manage-privileges/index.md#grant).
-
-      The following example defines a Unity Catalog schema with grants:
-
-      ```yaml
-      resources:
-        schemas:
-          my_schema:
-            name: test-schema
-            grants:
-              - principal: users
-                privileges:
-                  - CAN_MANAGE
-              - principal: my_team
-                privileges:
-                  - CAN_READ
-            catalog_name: main
-        ```
-  "grants":
-    "description": |-
-      PLACEHOLDER
-  "lifecycle":
-    "description": |-
-      Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
-  "properties":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/cli/bundle/config/resources.SecretScopePermissionLevel:
-  "_":
-    "enum":
-      - |-
-        READ
-      - |-
-        WRITE
-      - |-
-        MANAGE
-github.com/databricks/cli/bundle/config/resources.SqlWarehouse:
-  "enable_photon":
-    "description": |-
-      Configures whether the warehouse should use Photon optimized clusters.
-
-      Defaults to true.
-  "lifecycle":
-    "description": |-
-      Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
-  "permissions":
-    "description": |-
-      PLACEHOLDER
-  "spot_instance_policy":
-    "description": |-
-      PLACEHOLDER
-  "warehouse_type":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/cli/bundle/config/resources.SyncedDatabaseTable:
-  "lifecycle":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/cli/bundle/config/resources.VectorSearchEndpoint:
-  "lifecycle":
-    "description": |-
-      PLACEHOLDER
-  "permissions":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/cli/bundle/config/resources.Volume:
-  "_":
-    "markdown_description": |-
-      The volume resource type allows you to define and create Unity Catalog [volumes](/api/workspace/volumes/create) as part of a bundle. When deploying a bundle with a volume defined, note that:
-
-      - A volume cannot be referenced in the `artifact_path` for the bundle until it exists in the workspace. Hence, if you want to use Declarative Automation Bundles to create the volume, you must first define the volume in the bundle, deploy it to create the volume, then reference it in the `artifact_path` in subsequent deployments.
-
-      - Volumes in the bundle are not prepended with the `dev_${workspace.current_user.short_name}` prefix when the deployment target has `mode: development` configured. However, you can manually configure this prefix. See [_](/dev-tools/bundles/deployment-modes.md#custom-presets).
-    "markdown_examples": |-
-      The following example creates a Unity Catalog volume with the key `my_volume`:
-
-      ```yaml
-      resources:
-        volumes:
-          my_volume:
-            catalog_name: main
-            name: my_volume
-            schema_name: my_schema
-      ```
-
-      For an example bundle that runs a job that writes to a file in Unity Catalog volume, see the [bundle-examples GitHub repository](https://github.com/databricks/bundle-examples/tree/main/knowledge_base/write_from_job_to_volume).
-  "grants":
-    "description": |-
-      PLACEHOLDER
-  "lifecycle":
-    "description": |-
-      Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
-  "volume_type":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/apps.AppDeployment:
-  "create_time":
-    "description": |-
-      PLACEHOLDER
-  "creator":
-    "description": |-
-      PLACEHOLDER
-  "deployment_artifacts":
-    "description": |-
-      PLACEHOLDER
-  "deployment_id":
-    "description": |-
-      PLACEHOLDER
-  "mode":
-    "description": |-
-      PLACEHOLDER
-  "source_code_path":
-    "description": |-
-      PLACEHOLDER
-  "status":
-    "description": |-
-      PLACEHOLDER
-  "update_time":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/apps.AppDeploymentArtifacts:
-  "source_code_path":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/apps.AppDeploymentStatus:
-  "message":
-    "description": |-
-      PLACEHOLDER
-  "state":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/apps.AppResource:
-  "app":
-    "description": |-
-      PLACEHOLDER
-  "database":
-    "description": |-
-      PLACEHOLDER
-  "experiment":
-    "description": |-
-      PLACEHOLDER
-  "genie_space":
-    "description": |-
-      PLACEHOLDER
-  "job":
-    "description": |-
-      PLACEHOLDER
-  "postgres":
-    "description": |-
-      PLACEHOLDER
-  "secret":
-    "description": |-
-      PLACEHOLDER
-  "serving_endpoint":
-    "description": |-
-      PLACEHOLDER
-  "sql_warehouse":
-    "description": |-
-      PLACEHOLDER
-  "uc_securable":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/apps.AppResourceApp:
-  "name":
-    "description": |-
-      PLACEHOLDER
-  "permission":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/apps.AppResourceDatabase:
-  "database_name":
-    "description": |-
-      PLACEHOLDER
-  "instance_name":
-    "description": |-
-      PLACEHOLDER
-  "permission":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/apps.AppResourceExperiment:
-  "experiment_id":
-    "description": |-
-      PLACEHOLDER
-  "permission":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/apps.AppResourceGenieSpace:
-  "name":
-    "description": |-
-      PLACEHOLDER
-  "permission":
-    "description": |-
-      PLACEHOLDER
-  "space_id":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/apps.AppResourceJob:
-  "id":
-    "description": |-
-      PLACEHOLDER
-  "permission":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/apps.AppResourcePostgres:
-  "branch":
-    "description": |-
-      PLACEHOLDER
-  "database":
-    "description": |-
-      PLACEHOLDER
-  "permission":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/apps.AppResourceSecret:
-  "key":
-    "description": |-
-      PLACEHOLDER
-  "permission":
-    "description": |-
-      PLACEHOLDER
-  "scope":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/apps.AppResourceServingEndpoint:
-  "name":
-    "description": |-
-      PLACEHOLDER
-  "permission":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/apps.AppResourceSqlWarehouse:
-  "id":
-    "description": |-
-      PLACEHOLDER
-  "permission":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/apps.AppResourceUcSecurable:
-  "permission":
-    "description": |-
-      PLACEHOLDER
-  "securable_full_name":
-    "description": |-
-      PLACEHOLDER
-  "securable_type":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/apps.ApplicationStatus:
-  "message":
-    "description": |-
-      PLACEHOLDER
-  "state":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/apps.ComputeStatus:
-  "message":
-    "description": |-
-      PLACEHOLDER
-  "state": {}
-github.com/databricks/databricks-sdk-go/service/catalog.AwsSqsQueue:
-  "managed_resource_id":
-    "description": |-
-      PLACEHOLDER
-  "queue_url":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/catalog.AzureEncryptionSettings:
-  "azure_cmk_access_connector_id":
-    "description": |-
-      PLACEHOLDER
-  "azure_cmk_managed_identity_id":
-    "description": |-
-      PLACEHOLDER
-  "azure_tenant_id":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/catalog.AzureQueueStorage:
-  "managed_resource_id":
-    "description": |-
-      PLACEHOLDER
-  "queue_url":
-    "description": |-
-      PLACEHOLDER
-  "resource_group":
-    "description": |-
-      PLACEHOLDER
-  "subscription_id":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/catalog.EncryptionDetails:
-  "sse_encryption_details":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/catalog.FileEventQueue:
-  "managed_aqs":
-    "description": |-
-      PLACEHOLDER
-  "managed_pubsub":
-    "description": |-
-      PLACEHOLDER
-  "managed_sqs":
-    "description": |-
-      PLACEHOLDER
-  "provided_aqs":
-    "description": |-
-      PLACEHOLDER
-  "provided_pubsub":
-    "description": |-
-      PLACEHOLDER
-  "provided_sqs":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/catalog.GcpPubsub:
-  "managed_resource_id":
-    "description": |-
-      PLACEHOLDER
-  "subscription_name":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/catalog.MonitorInferenceLog:
-  "granularities":
-    "description": |-
-      Granularities for aggregating data into time windows based on their timestamp. Valid values are 5 minutes, 30 minutes, 1 hour, 1 day, n weeks, 1 month, or 1 year.
-github.com/databricks/databricks-sdk-go/service/catalog.MonitorTimeSeries:
-  "granularities":
-    "description": |-
-      Granularities for aggregating data into time windows based on their timestamp. Valid values are 5 minutes, 30 minutes, 1 hour, 1 day, n weeks, 1 month, or 1 year.
-github.com/databricks/databricks-sdk-go/service/catalog.RegisteredModelAlias:
-  "catalog_name":
-    "description": |-
-      PLACEHOLDER
-  "id":
-    "description": |-
-      PLACEHOLDER
-  "model_name":
-    "description": |-
-      PLACEHOLDER
-  "schema_name":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/catalog.SseEncryptionDetails:
-  "algorithm":
-    "description": |-
-      PLACEHOLDER
-  "aws_kms_key_arn":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/catalog.SseEncryptionDetailsAlgorithm:
-  "_":
-    "description": |-
-      SSE algorithm to use for encrypting S3 objects
-    "enum":
-      - |-
-        AWS_SSE_KMS
-      - |-
-        AWS_SSE_S3
-github.com/databricks/databricks-sdk-go/service/compute.AwsAttributes:
-  "availability":
-    "description": |-
-      PLACEHOLDER
-  "ebs_volume_type":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/compute.AzureAttributes:
-  "availability":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/compute.ClusterSpec:
-  "data_security_mode":
-    "description": |-
-      PLACEHOLDER
-  "docker_image":
-    "description": |-
-      PLACEHOLDER
-  "kind":
-    "description": |-
-      PLACEHOLDER
-  "runtime_engine":
-    "description": |-
-      PLACEHOLDER
-  "workload_type":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/compute.DockerImage:
-  "basic_auth":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/compute.Environment:
-  "dependencies":
-    "description": |-
-      List of pip dependencies, as supported by the version of pip in this environment.
-  "java_dependencies":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/compute.GcpAttributes:
-  "availability":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/compute.InitScriptInfo:
-  "abfss":
-    "description": |-
-      Contains the Azure Data Lake Storage destination path
-github.com/databricks/databricks-sdk-go/service/compute.Kind:
-  "_":
-    "enum":
-      - |-
-        CLASSIC_PREVIEW
-github.com/databricks/databricks-sdk-go/service/compute.LogAnalyticsInfo:
-  "log_analytics_primary_key":
-    "description": |-
-      The primary key for the Azure Log Analytics agent configuration
-  "log_analytics_workspace_id":
-    "description": |-
-      The workspace ID for the Azure Log Analytics agent configuration
-github.com/databricks/databricks-sdk-go/service/database.SyncedTablePosition:
-  "delta_table_sync_info":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/jobs.AlertTaskSubscriber:
-  "destination_id":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/jobs.DashboardTask:
-  "dashboard_id":
-    "description": |-
-      PLACEHOLDER
-  "subscription":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/jobs.GenAiComputeTask:
-  "compute":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/jobs.GitSource:
-  "git_snapshot":
-    "description": |-
-      PLACEHOLDER
-  "sparse_checkout":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/jobs.JobEnvironment:
-  "spec":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/jobs.JobsHealthRule:
-  "metric":
-    "description": |-
-      PLACEHOLDER
-  "op":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/jobs.JobsHealthRules:
-  "rules":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/jobs.RunJobTask:
-  "python_named_params":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/jobs.Subscription:
-  "subscribers":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/jobs.SubscriptionSubscriber:
-  "destination_id":
-    "description": |-
-      PLACEHOLDER
-  "user_name":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/jobs.Task:
-  "dbt_platform_task":
-    "description": |-
-      PLACEHOLDER
-  "gen_ai_compute_task":
-    "description": |-
-      PLACEHOLDER
-  "health":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/jobs.TriggerSettings:
-  "model":
-    "description": |-
-      PLACEHOLDER
-  "table_update":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/jobs.Webhook:
-  "id":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/pipelines.ConnectorOptions:
-  "gdrive_options":
-    "description": |-
-      PLACEHOLDER
-  "sharepoint_options":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/pipelines.CronTrigger:
-  "quartz_cron_schedule":
-    "description": |-
-      PLACEHOLDER
-  "timezone_id":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/pipelines.FileIngestionOptions:
-  "corrupt_record_column":
-    "description": |-
-      PLACEHOLDER
-  "ignore_corrupt_files":
-    "description": |-
-      PLACEHOLDER
-  "infer_column_types":
-    "description": |-
-      PLACEHOLDER
-  "rescued_data_column":
-    "description": |-
-      PLACEHOLDER
-  "single_variant_column":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/pipelines.GoogleDriveOptions:
-  "entity_type":
-    "description": |-
-      PLACEHOLDER
-  "file_ingestion_options":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/pipelines.IngestionPipelineDefinition:
-  "netsuite_jar_path":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/pipelines.PipelineLibrary:
-  "whl":
-    "deprecation_message": |-
-      This field is deprecated
-github.com/databricks/databricks-sdk-go/service/pipelines.PipelineTrigger:
-  "cron":
-    "description": |-
-      PLACEHOLDER
-  "manual":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/pipelines.TableSpecificConfig:
-  "workday_report_parameters":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/serving.Route:
-  "served_entity_name":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/serving.ServedEntityInput:
-  "entity_version":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/serving.ServedModelInput:
-  "model_name":
-    "description": |-
-      PLACEHOLDER
-  "model_version":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/sql.AlertV2Notification:
-  "subscriptions":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/sql.AlertV2Operand:
-  "column":
-    "description": |-
-      PLACEHOLDER
-  "value":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/sql.AlertV2OperandColumn:
-  "aggregation":
-    "description": |-
-      PLACEHOLDER
-  "display":
-    "description": |-
-      PLACEHOLDER
-  "name":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/sql.AlertV2OperandValue:
-  "bool_value":
-    "description": |-
-      PLACEHOLDER
-  "double_value":
-    "description": |-
-      PLACEHOLDER
-  "string_value":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/sql.AlertV2Subscription:
-  "destination_id":
-    "description": |-
-      PLACEHOLDER
-  "user_email":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/sql.Channel:
-  "dbsql_version":
-    "description": |-
-      PLACEHOLDER
-  "name":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/sql.EndpointTagPair:
-  "key":
-    "description": |-
-      PLACEHOLDER
-  "value":
-    "description": |-
-      PLACEHOLDER
-github.com/databricks/databricks-sdk-go/service/sql.EndpointTags:
-  "custom_tags":
-    "description": |-
-      PLACEHOLDER
diff --git a/bundle/internal/schema/annotations_test.go b/bundle/internal/schema/annotations_test.go
index 0e159335967..3ad9bae6fd6 100644
--- a/bundle/internal/schema/annotations_test.go
+++ b/bundle/internal/schema/annotations_test.go
@@ -2,6 +2,12 @@ package main
 
 import (
 	"testing"
+
+	"github.com/databricks/cli/bundle/internal/annotation"
+	"github.com/databricks/cli/internal/clijson"
+	"github.com/databricks/cli/libs/jsonschema"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestConvertLinksToAbsoluteUrl(t *testing.T) {
@@ -46,3 +52,221 @@ func TestConvertLinksToAbsoluteUrl(t *testing.T) {
 		}
 	}
 }
+
+const testTypePath = "github.com/databricks/cli/bundle/config.Foo"
+
+func TestDropShadowingPlaceholders(t *testing.T) {
+	tests := []struct {
+		name      string
+		fromFile  annotation.File
+		extracted annotation.File
+		want      annotation.File
+	}{
+		{
+			name: "placeholder shadowing an upstream description is dropped",
+			fromFile: annotation.File{
+				testTypePath: {Fields: map[string]annotation.Descriptor{"field": {Description: annotation.Placeholder}}},
+			},
+			extracted: annotation.File{
+				testTypePath: {Fields: map[string]annotation.Descriptor{"field": {Description: "upstream description"}}},
+			},
+			want: annotation.File{},
+		},
+		{
+			name: "placeholder without upstream description is kept",
+			fromFile: annotation.File{
+				testTypePath: {Fields: map[string]annotation.Descriptor{"field": {Description: annotation.Placeholder}}},
+			},
+			extracted: annotation.File{},
+			want: annotation.File{
+				testTypePath: {Fields: map[string]annotation.Descriptor{"field": {Description: annotation.Placeholder}}},
+			},
+		},
+		{
+			name: "placeholder with other fields loses only the placeholder",
+			fromFile: annotation.File{
+				testTypePath: {Fields: map[string]annotation.Descriptor{"field": {Description: annotation.Placeholder, DeprecationMessage: "deprecated"}}},
+			},
+			extracted: annotation.File{
+				testTypePath: {Fields: map[string]annotation.Descriptor{"field": {Description: "upstream description"}}},
+			},
+			want: annotation.File{
+				testTypePath: {Fields: map[string]annotation.Descriptor{"field": {DeprecationMessage: "deprecated"}}},
+			},
+		},
+		{
+			name: "real description override is untouched",
+			fromFile: annotation.File{
+				testTypePath: {Fields: map[string]annotation.Descriptor{"field": {Description: "hand-written override"}}},
+			},
+			extracted: annotation.File{
+				testTypePath: {Fields: map[string]annotation.Descriptor{"field": {Description: "upstream description"}}},
+			},
+			want: annotation.File{
+				testTypePath: {Fields: map[string]annotation.Descriptor{"field": {Description: "hand-written override"}}},
+			},
+		},
+		{
+			name: "other fields of the same type are kept",
+			fromFile: annotation.File{
+				testTypePath: {Fields: map[string]annotation.Descriptor{
+					"stale": {Description: annotation.Placeholder},
+					"todo":  {Description: annotation.Placeholder},
+				}},
+			},
+			extracted: annotation.File{
+				testTypePath: {Fields: map[string]annotation.Descriptor{"stale": {Description: "upstream description"}}},
+			},
+			want: annotation.File{
+				testTypePath: {Fields: map[string]annotation.Descriptor{"todo": {Description: annotation.Placeholder}}},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			dropShadowingPlaceholders(test.fromFile, test.extracted)
+			assert.Equal(t, test.want, test.fromFile)
+		})
+	}
+}
+
+// A stale placeholder must not swallow the upstream description in the merged
+// view the schema is generated from.
+func TestStalePlaceholderDoesNotShadowMergedDescription(t *testing.T) {
+	extracted := annotation.File{
+		testTypePath: {Fields: map[string]annotation.Descriptor{"field": {Description: "upstream description"}}},
+	}
+	fromFile := annotation.File{
+		testTypePath: {Fields: map[string]annotation.Descriptor{"field": {Description: annotation.Placeholder, DeprecationMessage: "deprecated"}}},
+	}
+
+	dropShadowingPlaceholders(fromFile, extracted)
+	h, err := newAnnotationHandler(extracted, fromFile)
+	require.NoError(t, err)
+
+	merged := h.parsedAnnotations[testTypePath].Fields["field"]
+	assert.Equal(t, "upstream description", merged.Description)
+	assert.Equal(t, "deprecated", merged.DeprecationMessage)
+}
+
+func TestAssignAnnotationLaunchStage(t *testing.T) {
+	// Each stamped stage emits x-databricks-launch-stage and prefixes the
+	// description with its tag (GA renders no tag); only private preview also
+	// hides the field from autocomplete.
+	tests := []struct {
+		name         string
+		stage        clijson.LaunchStage
+		wantDesc     string
+		wantSuppress bool
+	}{
+		{"private preview", clijson.LaunchStagePrivatePreview, "[Private Preview] A field.", true},
+		{"public beta", clijson.LaunchStagePublicBeta, "[Beta] A field.", false},
+		{"public preview", clijson.LaunchStagePublicPreview, "[Public Preview] A field.", false},
+		{"GA", clijson.LaunchStageGA, "A field.", false},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			s := &jsonschema.Schema{}
+			assignAnnotation(s, annotation.Descriptor{Description: "A field.", LaunchStage: tc.stage})
+			assert.Equal(t, tc.wantDesc, s.Description)
+			assert.Equal(t, tc.wantSuppress, s.DoNotSuggest)
+			assert.Equal(t, string(tc.stage), s.LaunchStage)
+		})
+	}
+
+	t.Run("unstamped field emits no stage", func(t *testing.T) {
+		s := &jsonschema.Schema{}
+		assignAnnotation(s, annotation.Descriptor{Description: "A field."})
+		assert.Equal(t, "A field.", s.Description)
+		assert.Empty(t, s.LaunchStage)
+	})
+
+	t.Run("per-enum-value launch stages do not leak into description", func(t *testing.T) {
+		s := &jsonschema.Schema{}
+		assignAnnotation(s, annotation.Descriptor{
+			Description: "Type of endpoint.",
+			Enum:        []any{"STORAGE_OPTIMIZED", "STANDARD"},
+			EnumLaunchStages: map[string]clijson.LaunchStage{
+				"STORAGE_OPTIMIZED": "PUBLIC_PREVIEW",
+			},
+		})
+		assert.Equal(t, "Type of endpoint.", s.Description)
+		assert.Equal(t, []string{"[Public Preview]", ""}, s.EnumDescriptions)
+	})
+}
+
+func TestPrefixWithPreviewTagNoDoubleTag(t *testing.T) {
+	t.Run("empty description becomes the tag", func(t *testing.T) {
+		assert.Equal(t, "[Public Preview]", prefixWithPreviewTag("", "[Public Preview]"))
+	})
+
+	t.Run("normal description is prefixed once", func(t *testing.T) {
+		assert.Equal(t, "[Public Preview] A field.", prefixWithPreviewTag("A field.", "[Public Preview]"))
+	})
+
+	t.Run("description already starting with the tag is left alone", func(t *testing.T) {
+		got := prefixWithPreviewTag("[Public Preview] Already tagged.", "[Public Preview]")
+		assert.Equal(t, "[Public Preview] Already tagged.", got)
+	})
+
+	t.Run("different tag still prepends even if description has another tag", func(t *testing.T) {
+		got := prefixWithPreviewTag("[Private Preview] foo", "[Public Preview]")
+		assert.Equal(t, "[Public Preview] [Private Preview] foo", got)
+	})
+}
+
+func TestBuildEnumDescriptions(t *testing.T) {
+	enum := []any{"STORAGE_OPTIMIZED", "STANDARD"}
+
+	t.Run("combines launch stage and description per value", func(t *testing.T) {
+		got := buildEnumDescriptions(
+			enum,
+			map[string]clijson.LaunchStage{"STORAGE_OPTIMIZED": "PUBLIC_PREVIEW"},
+			map[string]string{
+				"STORAGE_OPTIMIZED": "Storage-optimized endpoint.",
+				"STANDARD":          "Standard endpoint.",
+			},
+		)
+		assert.Equal(t, []string{
+			"[Public Preview] Storage-optimized endpoint.",
+			"Standard endpoint.",
+		}, got)
+	})
+
+	t.Run("launch stage only emits bracketed label", func(t *testing.T) {
+		got := buildEnumDescriptions(
+			enum,
+			map[string]clijson.LaunchStage{"STORAGE_OPTIMIZED": "PUBLIC_BETA"},
+			nil,
+		)
+		assert.Equal(t, []string{"[Beta]", ""}, got)
+	})
+
+	t.Run("description only is preserved verbatim", func(t *testing.T) {
+		got := buildEnumDescriptions(
+			enum,
+			nil,
+			map[string]string{"STORAGE_OPTIMIZED": "Storage-optimized endpoint."},
+		)
+		assert.Equal(t, []string{"Storage-optimized endpoint.", ""}, got)
+	})
+
+	t.Run("returns nil when neither stage nor description has content", func(t *testing.T) {
+		assert.Nil(t, buildEnumDescriptions(enum, nil, nil))
+		assert.Nil(t, buildEnumDescriptions(
+			enum,
+			map[string]clijson.LaunchStage{"STORAGE_OPTIMIZED": "GA"},
+			nil,
+		))
+	})
+
+	t.Run("non-string enum entries leave an empty slot", func(t *testing.T) {
+		got := buildEnumDescriptions(
+			[]any{"A", 42, "B"},
+			map[string]clijson.LaunchStage{"A": "PUBLIC_PREVIEW", "B": "PUBLIC_BETA"},
+			nil,
+		)
+		assert.Equal(t, []string{"[Public Preview]", "", "[Beta]"}, got)
+	})
+}
diff --git a/bundle/internal/schema/main.go b/bundle/internal/schema/main.go
index f8bc399134e..01a743933b2 100644
--- a/bundle/internal/schema/main.go
+++ b/bundle/internal/schema/main.go
@@ -12,12 +12,18 @@ import (
 	"github.com/databricks/cli/bundle/config"
 	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/cli/bundle/config/variable"
+	"github.com/databricks/cli/internal/clijson"
+	"github.com/databricks/cli/libs/dyn/dynvar"
 	"github.com/databricks/cli/libs/jsonschema"
 	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/databricks/databricks-sdk-go/service/pipelines"
 )
 
+// interpolationPattern builds a JSON Schema regex for ${prefix.path...} references.
+// Path segments use [dynvar.BaseVarDef]; unlike the runtime matcher in ref.go, this
+// requires a fixed prefix (var, resources, ...) and at least one ".segment" after it.
 func interpolationPattern(s string) string {
-	return fmt.Sprintf(`\$\{(%s(\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\[[0-9]+\])*)+)\}`, s)
+	return fmt.Sprintf(`\$\{(%s(\.%s(\[[0-9]+\])*)+)\}`, s, dynvar.BaseVarDef)
 }
 
 func addInterpolationPatterns(typ reflect.Type, s jsonschema.Schema) jsonschema.Schema {
@@ -98,6 +104,10 @@ func removeJobsFields(typ reflect.Type, s jsonschema.Schema) jsonschema.Schema {
 		delete(s.Properties, "deployment")
 		delete(s.Properties, "edit_mode")
 
+	case reflect.TypeFor[resources.JobRun]():
+		// CLI-managed; not user-configurable.
+		delete(s.Properties, "idempotency_token")
+
 	case reflect.TypeFor[jobs.GitSource]():
 		// These fields are readonly and are not meant to be set by the user.
 		delete(s.Properties, "job_source")
@@ -128,6 +138,25 @@ func removePipelineFields(typ reflect.Type, s jsonschema.Schema) jsonschema.Sche
 	return s
 }
 
+// removeDeploymentFields strips deployment_id and version_id from the job and
+// pipeline deployment blocks. The CLI sets these to track the bundle
+// deployment in the Deployment Metadata Service; they are not user-configurable,
+// so they must not appear in the JSON schema or the generated annotation files.
+// The parent "deployment" block is already removed from the Job and Pipeline
+// schemas (see removeJobsFields / removePipelineFields); this removes the fields
+// from the JobDeployment / PipelineDeployment type definitions themselves.
+func removeDeploymentFields(typ reflect.Type, s jsonschema.Schema) jsonschema.Schema {
+	switch typ {
+	case reflect.TypeFor[jobs.JobDeployment](), reflect.TypeFor[pipelines.PipelineDeployment]():
+		delete(s.Properties, "deployment_id")
+		delete(s.Properties, "version_id")
+	default:
+		// Do nothing
+	}
+
+	return s
+}
+
 // While volume_type is required in the volume create API, DABs automatically sets
 // it's value to "MANAGED" if it's not provided. Thus, we make it optional
 // in the bundle schema.
@@ -181,43 +210,73 @@ func removeOutputOnlyFields(typ reflect.Type, s jsonschema.Schema) jsonschema.Sc
 }
 
 func main() {
-	if len(os.Args) < 3 {
-		fmt.Println("Usage: go run main.go <work-dir> <output-file> [--docs]")
+	if len(os.Args) < 4 {
+		fmt.Println("Usage: go run main.go <work-dir> <output-file> <cli-json> [--docs]")
 		os.Exit(1)
 	}
 
-	// Directory with annotation files
+	// Directory with the annotations file
 	workdir := os.Args[1]
 	// Output file, where the generated JSON schema will be written to.
 	outputFile := os.Args[2]
+	// The .codegen/cli.json spec. Its schema graph carries the descriptions,
+	// enums and field behaviors the CLI reflects onto its config types.
+	cliJSONFile := os.Args[3]
 
 	// When --docs is passed, skip interpolation patterns and add sinceVersion annotations.
 	// This generates a schema optimized for documentation.
-	docsMode := len(os.Args) >= 4 && os.Args[3] == "--docs"
+	docsMode := len(os.Args) >= 5 && os.Args[4] == "--docs"
+
+	generateSchema(workdir, outputFile, cliJSONFile, docsMode)
+}
 
-	generateSchema(workdir, outputFile, docsMode)
+// configTypeGraph builds the type graph for the bundle config root with the
+// schema generator's structural field prunes applied, so the annotations file
+// only documents fields the generated schema actually contains. Both the
+// generator and the detached-annotation test use it to stay in lockstep.
+func configTypeGraph() (*typeGraph, error) {
+	return newTypeGraph(reflect.TypeFor[config.Root](), removeJobsFields, removePipelineFields)
 }
 
-func generateSchema(workdir, outputFile string, docsMode bool) {
+func generateSchema(workdir, outputFile, cliJSONFile string, docsMode bool) {
 	annotationsPath := filepath.Join(workdir, "annotations.yml")
-	annotationsOpenApiPath := filepath.Join(workdir, "annotations_openapi.yml")
-	annotationsOpenApiOverridesPath := filepath.Join(workdir, "annotations_openapi_overrides.yml")
 
-	// Input file, the databricks openapi spec.
-	inputFile := os.Getenv("DATABRICKS_OPENAPI_SPEC") //nolint:forbidigo // main() entry point, no ctx
-	if inputFile != "" {
-		p, err := newParser(inputFile)
-		if err != nil {
-			log.Fatal(err)
-		}
-		fmt.Printf("Writing OpenAPI annotations to %s\n", annotationsOpenApiPath)
-		err = p.extractAnnotations(reflect.TypeFor[config.Root](), annotationsOpenApiPath, annotationsOpenApiOverridesPath)
-		if err != nil {
-			log.Fatal(err)
-		}
+	// The cli.json schema graph is keyed by SDK type name (e.g.
+	// "jobs.JobSettings"); the annotation parser matches Go SDK types against
+	// those keys directly.
+	doc, err := clijson.Parse(cliJSONFile)
+	if err != nil {
+		log.Fatal(err)
+	}
+	if len(doc.Schemas) == 0 {
+		log.Fatalf("no schemas found in %s", cliJSONFile)
+	}
+
+	extracted, err := newParser(doc.Schemas).extractAnnotations(reflect.TypeFor[config.Root]())
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	graph, err := configTypeGraph()
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	fromFile, unknown, err := loadAnnotationsFile(annotationsPath, graph)
+	if err != nil {
+		log.Fatal(err)
 	}
+	for _, k := range unknown {
+		fmt.Printf("Dropping annotation at `%s`: no matching field in the bundle configuration\n", k)
+	}
+
+	// fromFile feeds both the merge in newAnnotationHandler and the
+	// annotations-file rewrite in syncWithMissingAnnotations, so drop stale
+	// placeholders first: a marker upstream now documents would otherwise
+	// shadow the real description.
+	dropShadowingPlaceholders(fromFile, extracted)
 
-	a, err := newAnnotationHandler([]string{annotationsOpenApiPath, annotationsOpenApiOverridesPath, annotationsPath})
+	a, err := newAnnotationHandler(extracted, fromFile)
 	if err != nil {
 		log.Fatal(err)
 	}
@@ -225,6 +284,7 @@ func generateSchema(workdir, outputFile string, docsMode bool) {
 	transforms := []func(reflect.Type, jsonschema.Schema) jsonschema.Schema{
 		removeJobsFields,
 		removePipelineFields,
+		removeDeploymentFields,
 		makeVolumeTypeOptional,
 		a.addAnnotations,
 		removeOutputOnlyFields,
@@ -249,7 +309,7 @@ func generateSchema(workdir, outputFile string, docsMode bool) {
 	}
 
 	// Overwrite the input annotation file, adding missing annotations
-	err = a.syncWithMissingAnnotations(annotationsPath)
+	err = a.syncWithMissingAnnotations(annotationsPath, graph)
 	if err != nil {
 		log.Fatal(err)
 	}
diff --git a/bundle/internal/schema/main_test.go b/bundle/internal/schema/main_test.go
index 0d0e6868ba8..92184a2d48f 100644
--- a/bundle/internal/schema/main_test.go
+++ b/bundle/internal/schema/main_test.go
@@ -9,16 +9,31 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/databricks/cli/bundle/config"
-	"github.com/databricks/cli/bundle/internal/annotation"
+	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/cli/libs/dyn/merge"
 	"github.com/databricks/cli/libs/dyn/yamlloader"
 	"github.com/databricks/cli/libs/jsonschema"
 	"github.com/stretchr/testify/assert"
-	"go.yaml.in/yaml/v3"
+	"github.com/stretchr/testify/require"
 )
 
+const cliJSONPath = "../../../.codegen/cli.json"
+
+func TestJobRunIdempotencyTokenIsNotInSchema(t *testing.T) {
+	s := jsonschema.Schema{
+		Properties: map[string]*jsonschema.Schema{
+			"idempotency_token": {},
+			"job_id":            {},
+		},
+	}
+
+	s = removeJobsFields(reflect.TypeFor[resources.JobRun](), s)
+
+	assert.NotContains(t, s.Properties, "idempotency_token")
+	assert.Contains(t, s.Properties, "job_id")
+}
+
 func copyFile(src, dst string) error {
 	in, err := os.Open(src)
 	if err != nil {
@@ -41,110 +56,60 @@ func copyFile(src, dst string) error {
 }
 
 // Checks whether descriptions are added for new config fields in the annotations.yml file
-// If this test fails either manually add descriptions to the `annotations.yml` or do the following:
-//  1. for fields described outside of CLI package fetch latest schema from the OpenAPI spec and add path to file to DATABRICKS_OPENAPI_SPEC env variable
-//  2. run `./task generate-schema` from the repository root to add placeholder descriptions
+// If this test fails:
+//  1. run `./task generate-schema` from the repository root to add placeholder descriptions
 //  2. replace all "PLACEHOLDER" values with the actual descriptions if possible
-//  3. run `./task generate-schema` again to regenerate the schema with acutal descriptions
+//  3. run `./task generate-schema` again to regenerate the schema with actual descriptions
 func TestRequiredAnnotationsForNewFields(t *testing.T) {
 	workdir := t.TempDir()
 	annotationsPath := path.Join(workdir, "annotations.yml")
-	annotationsOpenApiPath := path.Join(workdir, "annotations_openapi.yml")
-	annotationsOpenApiOverridesPath := path.Join(workdir, "annotations_openapi_overrides.yml")
 
-	// Copy existing annotation files from the same folder as this test
 	err := copyFile("annotations.yml", annotationsPath)
-	assert.NoError(t, err)
-	err = copyFile("annotations_openapi.yml", annotationsOpenApiPath)
-	assert.NoError(t, err)
-	err = copyFile("annotations_openapi_overrides.yml", annotationsOpenApiOverridesPath)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
-	generateSchema(workdir, path.Join(t.TempDir(), "schema.json"), false)
+	generateSchema(workdir, path.Join(t.TempDir(), "schema.json"), cliJSONPath, false)
 
 	originalFile, err := os.ReadFile("annotations.yml")
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	currentFile, err := os.ReadFile(annotationsPath)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	original, err := yamlloader.LoadYAML("", bytes.NewBuffer(originalFile))
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	current, err := yamlloader.LoadYAML("", bytes.NewBuffer(currentFile))
-	assert.NoError(t, err)
-
-	// Collect added paths.
-	var updatedFieldPaths []string
+	require.NoError(t, err)
+
+	// Regenerating from the committed file must be a no-op: no new placeholders
+	// (a new undocumented config field) and no deletes/updates (stale
+	// placeholders not yet pruned). VisitDelete/VisitUpdate must be set or
+	// Override panics on any change.
+	var addedFieldPaths []string
+	var changedFieldPaths []string
 	_, err = merge.Override(original, current, merge.OverrideVisitor{
 		VisitInsert: func(basePath dyn.Path, right dyn.Value) (dyn.Value, error) {
-			updatedFieldPaths = append(updatedFieldPaths, basePath.String())
+			addedFieldPaths = append(addedFieldPaths, basePath.String())
 			return right, nil
 		},
-	})
-	assert.NoError(t, err)
-	assert.Empty(t, updatedFieldPaths, "Missing JSON-schema descriptions for new config fields in bundle/internal/schema/annotations.yml:\n%s", strings.Join(updatedFieldPaths, "\n"))
-}
-
-// Checks whether types in annotation files are still present in Config type
-func TestNoDetachedAnnotations(t *testing.T) {
-	files := []string{
-		"annotations.yml",
-		"annotations_openapi.yml",
-		"annotations_openapi_overrides.yml",
-	}
-
-	types := map[string]bool{}
-	for _, file := range files {
-		annotations, err := getAnnotations(file)
-		assert.NoError(t, err)
-		for k := range annotations {
-			types[k] = false
-		}
-	}
-
-	_, err := jsonschema.FromType(reflect.TypeFor[config.Root](), []func(reflect.Type, jsonschema.Schema) jsonschema.Schema{
-		func(typ reflect.Type, s jsonschema.Schema) jsonschema.Schema {
-			delete(types, getPath(typ))
-			return s
+		VisitDelete: func(basePath dyn.Path, left dyn.Value) error {
+			changedFieldPaths = append(changedFieldPaths, basePath.String())
+			return nil
+		},
+		VisitUpdate: func(basePath dyn.Path, left, right dyn.Value) (dyn.Value, error) {
+			changedFieldPaths = append(changedFieldPaths, basePath.String())
+			return right, nil
 		},
 	})
 	assert.NoError(t, err)
-
-	for typ := range types {
-		t.Errorf("Type `%s` in annotations file is not found in `root.Config` type", typ)
-	}
-	assert.Empty(t, types, "Detached annotations found, regenerate schema and check for package path changes")
+	assert.Empty(t, addedFieldPaths, "Missing JSON-schema descriptions for new config fields in bundle/internal/schema/annotations.yml:\n%s", strings.Join(addedFieldPaths, "\n"))
+	assert.Empty(t, changedFieldPaths, "annotations.yml is out of sync; run `./task generate-schema` and commit the result:\n%s", strings.Join(changedFieldPaths, "\n"))
 }
 
-func getAnnotations(path string) (annotation.File, error) {
-	b, err := os.ReadFile(path)
-	if err != nil {
-		return nil, err
-	}
-
-	var data annotation.File
-	err = yaml.Unmarshal(b, &data)
-	return data, err
-}
-
-//deadcode:allow disabled pending annotation system overhaul; preserved intentionally
-func DisabledTestNoDuplicatedAnnotations(t *testing.T) {
-	// Check for duplicated annotations in annotation files
-	files := []string{
-		"annotations_openapi_overrides.yml",
-		"annotations.yml",
-	}
+// Checks that the annotations file only contains entries that match the
+// current bundle configuration structure.
+func TestNoDetachedAnnotations(t *testing.T) {
+	g, err := configTypeGraph()
+	require.NoError(t, err)
 
-	annotations := map[string]string{}
-	for _, file := range files {
-		annotationsFile, err := getAnnotations(file)
-		assert.NoError(t, err)
-		for typ, props := range annotationsFile {
-			for prop := range props {
-				key := typ + "_" + prop
-				if prevFile, ok := annotations[key]; ok {
-					t.Errorf("Annotation `%s` is duplicated in %s and %s", key, prevFile, file)
-				}
-				annotations[key] = file
-			}
-		}
-	}
+	_, unknown, err := loadAnnotationsFile("annotations.yml", g)
+	require.NoError(t, err)
+	assert.Empty(t, unknown, "Detached annotations found; run `./task generate-schema` to drop them")
 }
diff --git a/bundle/internal/schema/parser.go b/bundle/internal/schema/parser.go
index d72524dc59c..c9698749267 100644
--- a/bundle/internal/schema/parser.go
+++ b/bundle/internal/schema/parser.go
@@ -1,274 +1,252 @@
 package main
 
 import (
-	"bytes"
-	"encoding/json"
+	"errors"
 	"fmt"
-	"os"
 	"path"
 	"reflect"
 	"slices"
 	"strings"
 
 	"github.com/databricks/cli/bundle/internal/annotation"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/cli/libs/dyn/yamlloader"
+	"github.com/databricks/cli/internal/clijson"
 	"github.com/databricks/cli/libs/jsonschema"
 )
 
-type Components struct {
-	Schemas map[string]jsonschema.Schema `json:"schemas,omitempty"`
+type annotationParser struct {
+	ref map[string]*clijson.SchemaJSON
 }
 
-type Specification struct {
-	Components Components `json:"components"`
-}
-
-type openapiParser struct {
-	ref map[string]jsonschema.Schema
-}
+// deprecationMessage is the message emitted for any field or type that the spec
+// marks as deprecated. The spec (.codegen/cli.json) carries only a deprecated
+// flag, not a message, so we synthesize a fixed one here.
+const deprecationMessage = "This field is deprecated"
 
-const RootTypeKey = "_"
-
-func newParser(path string) (*openapiParser, error) {
-	b, err := os.ReadFile(path)
-	if err != nil {
-		return nil, err
-	}
-
-	spec := Specification{}
-	err = json.Unmarshal(b, &spec)
-	if err != nil {
-		return nil, err
+// deprecationMessageFor returns the deprecation message for a deprecated field
+// or type, or an empty string when it is not deprecated.
+func deprecationMessageFor(deprecated bool) string {
+	if deprecated {
+		return deprecationMessage
 	}
+	return ""
+}
 
-	p := &openapiParser{}
-	p.ref = spec.Components.Schemas
-	return p, nil
+func newParser(schemas map[string]*clijson.SchemaJSON) *annotationParser {
+	return &annotationParser{ref: schemas}
 }
 
 // This function checks if the input type:
 // 1. Is a Databricks Go SDK type.
-// 2. Has a Databricks Go SDK type embedded in it.
+// 2. Has a Databricks Go SDK type embedded in it, at any depth.
 //
-// If the above conditions are met, the function returns the JSON schema
-// corresponding to the Databricks Go SDK type from the OpenAPI spec.
-func (p *openapiParser) findRef(typ reflect.Type) (jsonschema.Schema, bool) {
-	typs := []reflect.Type{typ}
+// If the above conditions are met, the function returns the schema
+// corresponding to the Databricks Go SDK type from the spec.
+//
+// Embedded structs are traversed breadth first, mirroring how
+// [jsonschema.FromType] flattens them, so the shallowest SDK type present in
+// the spec wins. Traversing past the first level matters because some resources
+// wrap the SDK spec in an intermediate struct rather than embedding it directly
+// (e.g. PostgresProject -> PostgresProjectConfig -> postgres.ProjectSpec).
+func (p *annotationParser) findRef(typ reflect.Type) (*clijson.SchemaJSON, bool) {
+	bfsQueue := []reflect.Type{typ}
+
+	for len(bfsQueue) > 0 {
+		ctyp := bfsQueue[0]
+		bfsQueue = bfsQueue[1:]
+
+		if ref, ok := p.lookupSDKType(ctyp); ok {
+			return ref, true
+		}
+
+		if ctyp.Kind() != reflect.Struct {
+			continue
+		}
 
-	// Check for embedded Databricks Go SDK types.
-	if typ.Kind() == reflect.Struct {
-		for i := range typ.NumField() {
-			if !typ.Field(i).Anonymous {
+		for field := range ctyp.Fields() {
+			if !field.Anonymous {
 				continue
 			}
 
 			// Deference current type if it's a pointer.
-			ctyp := typ.Field(i).Type
-			for ctyp.Kind() == reflect.Ptr {
-				ctyp = ctyp.Elem()
+			ftyp := field.Type
+			for ftyp.Kind() == reflect.Pointer {
+				ftyp = ftyp.Elem()
 			}
 
-			typs = append(typs, ctyp)
+			bfsQueue = append(bfsQueue, ftyp)
 		}
 	}
 
-	for _, ctyp := range typs {
-		// Skip if it's not a Go SDK type.
-		if !strings.HasPrefix(ctyp.PkgPath(), "github.com/databricks/databricks-sdk-go") {
-			continue
-		}
+	return nil, false
+}
 
-		pkgName := path.Base(ctyp.PkgPath())
-		k := fmt.Sprintf("%s.%s", pkgName, ctyp.Name())
+// lookupSDKType returns the spec schema for a Databricks Go SDK type, if the
+// spec defines one for it.
+func (p *annotationParser) lookupSDKType(typ reflect.Type) (*clijson.SchemaJSON, bool) {
+	if !strings.HasPrefix(typ.PkgPath(), "github.com/databricks/databricks-sdk-go") {
+		return nil, false
+	}
 
-		// Skip if the type is not in the openapi spec.
-		_, ok := p.ref[k]
-		if !ok {
-			k = mapIncorrectTypNames(k)
-			_, ok = p.ref[k]
-			if !ok {
-				continue
-			}
-		}
+	k := fmt.Sprintf("%s.%s", path.Base(typ.PkgPath()), typ.Name())
+	ref, ok := p.ref[k]
+	return ref, ok
+}
 
-		// Return the first Go SDK type found in the openapi spec.
-		return p.ref[k], true
+// normalizeLaunchStage validates the contract's launch stage and drops GA so it
+// isn't persisted in the annotation file. GA is the implicit default for any
+// field that isn't in a preview, so storing it would add a stage to thousands
+// of entries for no benefit. It errors on any stage the CLI doesn't recognize
+// so a stage introduced upstream fails codegen instead of silently rendering as
+// GA (see clijson.ParseLaunchStage).
+func normalizeLaunchStage(launchStage string) (clijson.LaunchStage, error) {
+	stage, err := clijson.ParseLaunchStage(launchStage)
+	if err != nil {
+		return "", err
+	}
+	if stage == clijson.LaunchStageGA {
+		return "", nil
 	}
+	return stage, nil
+}
 
-	return jsonschema.Schema{}, false
+// notableEnumLaunchStages keeps only the enum values whose launch stage is
+// worth surfacing (i.e. not GA), so the annotation file isn't polluted with a
+// stage for every value of a GA enum. Returns nil when nothing remains.
+func notableEnumLaunchStages(stages map[string]string) (map[string]clijson.LaunchStage, error) {
+	result := map[string]clijson.LaunchStage{}
+	for value, stage := range stages {
+		ls, err := normalizeLaunchStage(stage)
+		if err != nil {
+			return nil, err
+		}
+		if ls != "" {
+			result[value] = ls
+		}
+	}
+	if len(result) == 0 {
+		return nil, nil
+	}
+	return result, nil
 }
 
-// Fix inconsistent type names between the Go SDK and the OpenAPI spec.
-// E.g. "serving.PaLmConfig" in the Go SDK is "serving.PaLMConfig" in the OpenAPI spec.
-func mapIncorrectTypNames(ref string) string {
-	switch ref {
-	case "serving.PaLmConfig":
-		return "serving.PaLMConfig"
-	case "serving.OpenAiConfig":
-		return "serving.OpenAIConfig"
-	case "serving.GoogleCloudVertexAiConfig":
-		return "serving.GoogleCloudVertexAIConfig"
-	case "serving.Ai21LabsConfig":
-		return "serving.AI21LabsConfig"
-	default:
-		return ref
+// nonEmptyEnumDescriptions drops blank per-value descriptions so the annotation
+// file stays clean. Returns nil when nothing remains.
+func nonEmptyEnumDescriptions(descriptions map[string]string) map[string]string {
+	result := map[string]string{}
+	for value, desc := range descriptions {
+		if desc != "" {
+			result[value] = desc
+		}
+	}
+	if len(result) == 0 {
+		return nil
+	}
+	return result
+}
+
+// enumValues converts the contract's []string enum into the []any the
+// annotation descriptor carries (its Enum field predates the typed contract).
+func enumValues(vals []string) []any {
+	if len(vals) == 0 {
+		return nil
+	}
+	out := make([]any, len(vals))
+	for i, v := range vals {
+		out[i] = v
 	}
+	return out
 }
 
-func isOutputOnly(s jsonschema.Schema) *bool {
-	if s.FieldBehaviors == nil || !slices.Contains(s.FieldBehaviors, "OUTPUT_ONLY") {
+func isOutputOnly(behaviors []string) *bool {
+	if !slices.Contains(behaviors, "OUTPUT_ONLY") {
 		return nil
 	}
 	res := true
 	return &res
 }
 
-// Use the OpenAPI spec to load descriptions for the given type.
-func (p *openapiParser) extractAnnotations(typ reflect.Type, outputPath, overridesPath string) error {
+// Use the spec to load descriptions for the given type.
+func (p *annotationParser) extractAnnotations(typ reflect.Type) (annotation.File, error) {
 	annotations := annotation.File{}
-	overrides := annotation.File{}
-
-	b, err := os.ReadFile(overridesPath)
-	if err != nil {
-		return err
-	}
-	overridesDyn, err := yamlloader.LoadYAML(overridesPath, bytes.NewBuffer(b))
-	if err != nil {
-		return err
-	}
-	err = convert.ToTyped(&overrides, overridesDyn)
-	if err != nil {
-		return err
-	}
-	if overrides == nil {
-		overrides = annotation.File{}
-	}
 
-	_, err = jsonschema.FromType(typ, []func(reflect.Type, jsonschema.Schema) jsonschema.Schema{
+	// Launch-stage validation happens inside the transform callback below, which
+	// cannot return an error, so failures accumulate here and are returned after.
+	var stageErr error
+	_, err := jsonschema.FromType(typ, []func(reflect.Type, jsonschema.Schema) jsonschema.Schema{
 		func(typ reflect.Type, s jsonschema.Schema) jsonschema.Schema {
+			basePath := getPath(typ)
+			// A type carries no launch stage by default, so we set to GA, unless
+			// overridden. Compute the override before findRef so it still applies to
+			// a resource with no spec type in cli.json (findRef miss) — e.g. the
+			// hand-written postgres_snapshot_schedules singleton — which would
+			// otherwise ship unlabelled despite its launchStageOverrides entry.
+			typeLaunchStage := annotation.OverrideLaunchStage(basePath, "")
+
 			ref, ok := p.findRef(typ)
 			if !ok {
+				if typeLaunchStage != "" {
+					annotations.SetSelf(basePath, annotation.Descriptor{LaunchStage: typeLaunchStage})
+				}
 				return s
 			}
 
-			basePath := getPath(typ)
-			pkg := map[string]annotation.Descriptor{}
-			annotations[basePath] = pkg
-			preview := ref.Preview
-			if preview == "PUBLIC" {
-				preview = ""
+			enumLaunchStages, enumErr := notableEnumLaunchStages(ref.EnumLaunchStages)
+			if enumErr != nil {
+				stageErr = errors.Join(stageErr, fmt.Errorf("%s: %w", basePath, enumErr))
 			}
-			outputOnly := isOutputOnly(ref)
-			if ref.Description != "" || ref.Enum != nil || ref.Deprecated || ref.DeprecationMessage != "" || preview != "" || outputOnly != nil {
-				if ref.Deprecated && ref.DeprecationMessage == "" {
-					ref.DeprecationMessage = "This field is deprecated"
-				}
-
-				pkg[RootTypeKey] = annotation.Descriptor{
-					Description:        ref.Description,
-					Enum:               ref.Enum,
-					DeprecationMessage: ref.DeprecationMessage,
-					Preview:            preview,
-					OutputOnly:         outputOnly,
-				}
+			enumDescriptions := nonEmptyEnumDescriptions(ref.EnumDescriptions)
+			if ref.Description != "" || ref.Enum != nil || enumLaunchStages != nil || enumDescriptions != nil || typeLaunchStage != "" {
+				annotations.SetSelf(basePath, annotation.Descriptor{
+					Description:      ref.Description,
+					LaunchStage:      typeLaunchStage,
+					Enum:             enumValues(ref.Enum),
+					EnumLaunchStages: enumLaunchStages,
+					EnumDescriptions: enumDescriptions,
+				})
 			}
 
 			for k := range s.Properties {
-				if refProp, ok := ref.Properties[k]; ok {
-					preview = refProp.Preview
-					if preview == "PUBLIC" {
-						preview = ""
-					}
-
-					if refProp.Deprecated && refProp.DeprecationMessage == "" {
-						refProp.DeprecationMessage = "This field is deprecated"
+				if refProp, ok := ref.Fields[k]; ok {
+					// An empty stage means the contract assigns none; keep it
+					// unmarked rather than letting ParseLaunchStage default it to GA.
+					var launchStage clijson.LaunchStage
+					if refProp.LaunchStage != "" {
+						stage, fieldErr := clijson.ParseLaunchStage(refProp.LaunchStage)
+						if fieldErr != nil {
+							stageErr = errors.Join(stageErr, fmt.Errorf("%s.%s: %w", basePath, k, fieldErr))
+						}
+						launchStage = stage
 					}
+					// Apply custom launch stage override (e.g. keep resource in Beta despite API being GA)
+					launchStage = annotation.OverrideLaunchStage(basePath, launchStage)
 
 					description := refProp.Description
 
 					// If the field doesn't have a description, try to find the referenced type
 					// and use its description. This handles cases where the field references
 					// a type that has a description but the field itself doesn't.
-					if description == "" && refProp.Reference != nil {
-						refPath := *refProp.Reference
-						refTypeName := strings.TrimPrefix(refPath, "#/components/schemas/")
-						if refType, ok := p.ref[refTypeName]; ok {
+					if description == "" && refProp.Ref != "" {
+						if refType, ok := p.ref[refProp.Ref]; ok {
 							description = refType.Description
 						}
 					}
 
-					pkg[k] = annotation.Descriptor{
+					annotations.SetField(basePath, k, annotation.Descriptor{
 						Description:        description,
-						Enum:               refProp.Enum,
-						Preview:            preview,
-						DeprecationMessage: refProp.DeprecationMessage,
-						OutputOnly:         isOutputOnly(*refProp),
-					}
-					if description == "" {
-						addEmptyOverride(k, basePath, overrides)
-					}
-				} else {
-					addEmptyOverride(k, basePath, overrides)
+						LaunchStage:        launchStage,
+						DeprecationMessage: deprecationMessageFor(refProp.Deprecated),
+						OutputOnly:         isOutputOnly(refProp.Behaviors),
+					})
 				}
 			}
 			return s
 		},
 	})
 	if err != nil {
-		return err
-	}
-
-	err = saveYamlWithStyle(overridesPath, overrides)
-	if err != nil {
-		return err
-	}
-	err = saveYamlWithStyle(outputPath, annotations)
-	if err != nil {
-		return err
-	}
-	err = prependCommentToFile(outputPath, "# This file is auto-generated. DO NOT EDIT.\n")
-	if err != nil {
-		return err
-	}
-	return nil
-}
-
-func prependCommentToFile(outputPath, comment string) error {
-	b, err := os.ReadFile(outputPath)
-	if err != nil {
-		return err
-	}
-	f, err := os.OpenFile(outputPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o644)
-	if err != nil {
-		return err
-	}
-	defer f.Close()
-
-	_, err = f.WriteString(comment)
-	if err != nil {
-		return err
-	}
-	_, err = f.Write(b)
-	return err
-}
-
-func addEmptyOverride(key, pkg string, overridesFile annotation.File) {
-	if overridesFile[pkg] == nil {
-		overridesFile[pkg] = map[string]annotation.Descriptor{}
-	}
-
-	overrides := overridesFile[pkg]
-	if overrides[key].Description == "" {
-		overrides[key] = annotation.Descriptor{Description: annotation.Placeholder}
-	}
-
-	a, ok := overrides[key]
-	if !ok {
-		a = annotation.Descriptor{}
+		return nil, err
 	}
-	if a.Description == "" {
-		a.Description = annotation.Placeholder
+	if stageErr != nil {
+		return nil, stageErr
 	}
-	overrides[key] = a
+	return annotations, nil
 }
diff --git a/bundle/internal/schema/parser_test.go b/bundle/internal/schema/parser_test.go
new file mode 100644
index 00000000000..c89e7b8f832
--- /dev/null
+++ b/bundle/internal/schema/parser_test.go
@@ -0,0 +1,241 @@
+package main
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/cli/bundle/internal/annotation"
+	"github.com/databricks/cli/internal/clijson"
+	"github.com/databricks/databricks-sdk-go/service/postgres"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// testProjectConfig and testProject mirror the shape of resources.PostgresProject:
+// the SDK spec is embedded two levels down, behind an intermediate config struct.
+type testProjectConfig struct {
+	postgres.ProjectSpec
+
+	ProjectId string `json:"project_id"`
+}
+
+type testProject struct {
+	testProjectConfig
+}
+
+func TestFindRefNestedEmbeddedSDKType(t *testing.T) {
+	spec := &clijson.SchemaJSON{Description: "A Lakebase project."}
+	p := newParser(map[string]*clijson.SchemaJSON{"postgres.ProjectSpec": spec})
+
+	t.Run("resolves a spec embedded below the first level", func(t *testing.T) {
+		got, ok := p.findRef(reflect.TypeFor[testProject]())
+		require.True(t, ok)
+		assert.Same(t, spec, got)
+	})
+
+	t.Run("resolves the SDK type itself", func(t *testing.T) {
+		got, ok := p.findRef(reflect.TypeFor[postgres.ProjectSpec]())
+		require.True(t, ok)
+		assert.Same(t, spec, got)
+	})
+
+	t.Run("reports no match when the spec omits the type", func(t *testing.T) {
+		_, ok := newParser(nil).findRef(reflect.TypeFor[testProject]())
+		assert.False(t, ok)
+	})
+}
+
+// Descriptions and launch stages from a spec embedded below the first level must
+// land on the wrapping resource type, since that is where the schema generator
+// flattens the spec's fields to.
+func TestExtractAnnotationsNestedEmbeddedSDKType(t *testing.T) {
+	p := newParser(map[string]*clijson.SchemaJSON{
+		"postgres.ProjectSpec": {
+			Fields: map[string]*clijson.SchemaFieldJSON{
+				"display_name": {
+					Description: "Human-readable project name.",
+					LaunchStage: "PUBLIC_BETA",
+				},
+			},
+		},
+	})
+
+	annotations, err := p.extractAnnotations(reflect.TypeFor[testProject]())
+	require.NoError(t, err)
+
+	got := annotations[getPath(reflect.TypeFor[testProject]())].Fields["display_name"]
+	assert.Equal(t, "Human-readable project name.", got.Description)
+	assert.Equal(t, clijson.LaunchStagePublicBeta, got.LaunchStage)
+}
+
+// TestPostgresResourcesHaveLaunchStageOverride asserts every Postgres resource
+// type is pinned to Beta via a launch-stage override, so an upstream stage
+// change cannot silently alter its label (see annotation.OverrideLaunchStage).
+//
+// postgresResources is spelled out explicitly so the expected set is visible on
+// the page, but it is also cross-checked against the Postgres resources actually
+// declared on config.Resources: a new resource missing from this list fails the
+// completeness check, which is the reminder to add it here AND to
+// launchStageOverrides in bundle/internal/annotation/preview.go.
+func TestPostgresResourcesHaveLaunchStageOverride(t *testing.T) {
+	postgresResources := []reflect.Type{
+		reflect.TypeFor[resources.PostgresBranch](),
+		reflect.TypeFor[resources.PostgresCatalog](),
+		reflect.TypeFor[resources.PostgresDatabase](),
+		reflect.TypeFor[resources.PostgresEndpoint](),
+		reflect.TypeFor[resources.PostgresProject](),
+		reflect.TypeFor[resources.PostgresRole](),
+		reflect.TypeFor[resources.PostgresSnapshotSchedule](),
+		reflect.TypeFor[resources.PostgresSyncedTable](),
+	}
+
+	// The list must cover every Postgres resource on config.Resources, so a
+	// newly added one can't slip through unpinned.
+	listed := make(map[reflect.Type]bool, len(postgresResources))
+	for _, typ := range postgresResources {
+		listed[typ] = true
+	}
+	for _, f := range reflect.VisibleFields(reflect.TypeFor[config.Resources]()) {
+		if !strings.HasPrefix(f.Name, "Postgres") {
+			continue
+		}
+		// Each resource is a map[string]*resources.PostgresX; unwrap to the
+		// element struct the schema generator keys annotations by.
+		elem := f.Type.Elem()
+		for elem.Kind() == reflect.Pointer {
+			elem = elem.Elem()
+		}
+		assert.Truef(t, listed[elem],
+			"resource %s (%s) is not covered by this test; add it to postgresResources", f.Name, getPath(elem))
+	}
+
+	for _, typ := range postgresResources {
+		typePath := getPath(typ)
+		// A configured type returns its override for any input; an unconfigured
+		// one returns the input unchanged, so a GA input that survives as GA
+		// (rather than becoming Beta) means the override is missing.
+		stage := annotation.OverrideLaunchStage(typePath, clijson.LaunchStageGA)
+		assert.Equalf(t, clijson.LaunchStagePublicBeta, stage,
+			"resource %s has no launch-stage override; add it to launchStageOverrides in bundle/internal/annotation/preview.go", typePath)
+	}
+}
+
+// TestExtractAnnotationsOverridesLaunchStage feeds a GA launch stage for a real
+// field of an overridden resource and asserts extractAnnotations rewrites it to
+// the override, so an upstream stage change does not alter the label.
+// auth_method is a field of postgres.RoleRoleSpec, embedded by
+// resources.PostgresRole.
+func TestExtractAnnotationsOverridesLaunchStage(t *testing.T) {
+	p := newParser(map[string]*clijson.SchemaJSON{
+		"postgres.RoleRoleSpec": {
+			Fields: map[string]*clijson.SchemaFieldJSON{
+				"auth_method": {
+					Description: "How the role authenticates.",
+					LaunchStage: "GA",
+				},
+			},
+		},
+	})
+
+	annotations, err := p.extractAnnotations(reflect.TypeFor[resources.PostgresRole]())
+	require.NoError(t, err)
+
+	got := annotations[getPath(reflect.TypeFor[resources.PostgresRole]())].Fields["auth_method"]
+	assert.Equal(t, clijson.LaunchStagePublicBeta, got.LaunchStage)
+}
+
+// TestExtractAnnotationsStampsTypeLaunchStage asserts a resource type in the
+// override map carries the override stage on its own (self) descriptor, so the
+// type-level x-databricks-launch-stage is emitted, not just its fields'. The
+// contract carries no type-level stage, so the override map is the only source.
+func TestExtractAnnotationsStampsTypeLaunchStage(t *testing.T) {
+	p := newParser(map[string]*clijson.SchemaJSON{
+		"postgres.RoleRoleSpec": {Fields: map[string]*clijson.SchemaFieldJSON{}},
+	})
+
+	annotations, err := p.extractAnnotations(reflect.TypeFor[resources.PostgresRole]())
+	require.NoError(t, err)
+
+	self := annotations[getPath(reflect.TypeFor[resources.PostgresRole]())].Self
+	assert.Equal(t, clijson.LaunchStagePublicBeta, self.LaunchStage)
+}
+
+func TestNormalizeLaunchStage(t *testing.T) {
+	tests := []struct {
+		input string
+		want  clijson.LaunchStage
+	}{
+		{"GA", ""},
+		{"", ""},
+		{"PUBLIC_PREVIEW", clijson.LaunchStagePublicPreview},
+		{"PUBLIC_BETA", clijson.LaunchStagePublicBeta},
+		{"PRIVATE_PREVIEW", clijson.LaunchStagePrivatePreview},
+	}
+	for _, tc := range tests {
+		got, err := normalizeLaunchStage(tc.input)
+		require.NoError(t, err)
+		assert.Equal(t, tc.want, got)
+	}
+}
+
+func TestNormalizeLaunchStageUnknown(t *testing.T) {
+	_, err := normalizeLaunchStage("SOMETHING_ELSE")
+	assert.Error(t, err)
+}
+
+func TestNotableEnumLaunchStages(t *testing.T) {
+	t.Run("drops GA, keeps preview values", func(t *testing.T) {
+		got, err := notableEnumLaunchStages(map[string]string{
+			"STORAGE_OPTIMIZED": "PUBLIC_PREVIEW",
+			"STANDARD":          "GA",
+		})
+		require.NoError(t, err)
+		assert.Equal(t, map[string]clijson.LaunchStage{"STORAGE_OPTIMIZED": clijson.LaunchStagePublicPreview}, got)
+	})
+
+	t.Run("returns nil when every value is GA", func(t *testing.T) {
+		got, err := notableEnumLaunchStages(map[string]string{"STANDARD": "GA"})
+		require.NoError(t, err)
+		assert.Nil(t, got)
+	})
+
+	t.Run("returns nil for empty input", func(t *testing.T) {
+		got, err := notableEnumLaunchStages(nil)
+		require.NoError(t, err)
+		assert.Nil(t, got)
+	})
+
+	t.Run("errors on unknown stage", func(t *testing.T) {
+		_, err := notableEnumLaunchStages(map[string]string{"X": "SOMETHING_ELSE"})
+		assert.Error(t, err)
+	})
+}
+
+func TestNonEmptyEnumDescriptions(t *testing.T) {
+	t.Run("keeps non-empty descriptions", func(t *testing.T) {
+		got := nonEmptyEnumDescriptions(map[string]string{
+			"STORAGE_OPTIMIZED": "Storage-optimized endpoint.",
+			"STANDARD":          "Standard endpoint.",
+		})
+		assert.Equal(t, map[string]string{
+			"STORAGE_OPTIMIZED": "Storage-optimized endpoint.",
+			"STANDARD":          "Standard endpoint.",
+		}, got)
+	})
+
+	t.Run("drops empty descriptions", func(t *testing.T) {
+		got := nonEmptyEnumDescriptions(map[string]string{
+			"STORAGE_OPTIMIZED": "Storage-optimized endpoint.",
+			"STANDARD":          "",
+		})
+		assert.Equal(t, map[string]string{"STORAGE_OPTIMIZED": "Storage-optimized endpoint."}, got)
+	})
+
+	t.Run("returns nil for empty input", func(t *testing.T) {
+		assert.Nil(t, nonEmptyEnumDescriptions(nil))
+		assert.Nil(t, nonEmptyEnumDescriptions(map[string]string{"STANDARD": ""}))
+	})
+}
diff --git a/bundle/internal/schema/testdata/fail/invalid_unicode_variable_reference.yml b/bundle/internal/schema/testdata/fail/invalid_unicode_variable_reference.yml
new file mode 100644
index 00000000000..7716d67f87f
--- /dev/null
+++ b/bundle/internal/schema/testdata/fail/invalid_unicode_variable_reference.yml
@@ -0,0 +1,7 @@
+bundle:
+  name: invalid-unicode-ref
+
+resources:
+  jobs:
+    foo:
+      max_concurrent_runs: ${var.🌍}
diff --git a/bundle/internal/schema/testdata/fail/nfd_unicode_variable_reference.yml b/bundle/internal/schema/testdata/fail/nfd_unicode_variable_reference.yml
new file mode 100644
index 00000000000..cf77eda7543
--- /dev/null
+++ b/bundle/internal/schema/testdata/fail/nfd_unicode_variable_reference.yml
@@ -0,0 +1,8 @@
+bundle:
+  name: nfd-unicode-ref
+
+resources:
+  jobs:
+    foo:
+      # café in NFD (e + U+0301 combining acute); not accepted by \p{L} segment matching.
+      max_concurrent_runs: ${var.café}
diff --git a/bundle/internal/schema/testdata/pass/cjk_numeral_variable_reference.yml b/bundle/internal/schema/testdata/pass/cjk_numeral_variable_reference.yml
new file mode 100644
index 00000000000..3116c8d2e61
--- /dev/null
+++ b/bundle/internal/schema/testdata/pass/cjk_numeral_variable_reference.yml
@@ -0,0 +1,11 @@
+bundle:
+  name: cjk-numeral-var
+
+variables:
+  九世界:
+    default: 1
+
+resources:
+  jobs:
+    foo:
+      max_concurrent_runs: ${var.九世界}
diff --git a/bundle/internal/schema/testdata/pass/unicode_variable_reference.yml b/bundle/internal/schema/testdata/pass/unicode_variable_reference.yml
new file mode 100644
index 00000000000..e513139038e
--- /dev/null
+++ b/bundle/internal/schema/testdata/pass/unicode_variable_reference.yml
@@ -0,0 +1,11 @@
+bundle:
+  name: unicode-vars
+
+variables:
+  变量:
+    default: hello
+
+resources:
+  jobs:
+    foo:
+      name: ${var.变量}
diff --git a/bundle/internal/schema/testdata/pass/variable_reference_separators.yml b/bundle/internal/schema/testdata/pass/variable_reference_separators.yml
new file mode 100644
index 00000000000..4f6743cdd95
--- /dev/null
+++ b/bundle/internal/schema/testdata/pass/variable_reference_separators.yml
@@ -0,0 +1,11 @@
+bundle:
+  name: separator-vars
+
+variables:
+  world__world:
+    default: hello
+
+resources:
+  jobs:
+    foo:
+      name: ${var.world__world}
diff --git a/bundle/internal/schema/typegraph.go b/bundle/internal/schema/typegraph.go
new file mode 100644
index 00000000000..f1be78d7377
--- /dev/null
+++ b/bundle/internal/schema/typegraph.go
@@ -0,0 +1,152 @@
+package main
+
+import (
+	"container/list"
+	"errors"
+	"fmt"
+	"reflect"
+	"slices"
+	"strings"
+
+	"github.com/databricks/cli/libs/jsonschema"
+)
+
+// typeGraph captures, for every annotatable type reachable from the root
+// config type, the properties the JSON schema generator emits for it and the
+// type each property resolves to. The property set and the resolution targets
+// come from jsonschema.FromType itself so the graph cannot drift from the
+// generated schema; reflection is only used to recover struct declaration
+// order, which the schema's Properties map loses.
+type typeGraph struct {
+	// root is the type path of the root type.
+	root string
+	// fields maps a type path to its properties in struct declaration order.
+	// Non-struct types (enums) are present with no properties.
+	fields map[string][]fieldEdge
+}
+
+// fieldEdge is one property of a type: the property name and the type path of
+// the type it resolves to after unwrapping pointers, slices and maps. typ is
+// empty for properties whose type cannot carry annotations (primitives,
+// interface).
+type fieldEdge struct {
+	name string
+	typ  string
+}
+
+// newTypeGraph builds the graph for root. The transforms are the schema
+// generator's structural field-pruning transforms; they run before each type's
+// fields are recorded so the graph mirrors the fields the schema actually
+// emits (a field the generator deletes must not be documentable). Annotation-
+// dependent prunes like output-only removal are not replicated: those fields
+// carry upstream docs, so they never surface as undocumented placeholders.
+func newTypeGraph(root reflect.Type, transforms ...func(reflect.Type, jsonschema.Schema) jsonschema.Schema) (*typeGraph, error) {
+	g := &typeGraph{
+		root:   getPath(root),
+		fields: map[string][]fieldEdge{},
+	}
+
+	var errs []error
+	capture := func(typ reflect.Type, s jsonschema.Schema) jsonschema.Schema {
+		refPath := getPath(typ)
+		if !strings.HasPrefix(refPath, "github.com") {
+			return s
+		}
+
+		var edges []fieldEdge
+		if typ.Kind() == reflect.Struct {
+			for _, name := range structFieldOrder(typ, s.Properties) {
+				edges = append(edges, fieldEdge{name: name, typ: resolveEdgeType(s.Properties[name])})
+			}
+			// structFieldOrder only orders names the schema emitted, so a
+			// mismatch means its struct walk failed to reach a property —
+			// i.e. it diverged from the generator's own field handling.
+			if len(edges) != len(s.Properties) {
+				errs = append(errs, fmt.Errorf("type graph for %s reached %d of %d schema properties", refPath, len(edges), len(s.Properties)))
+			}
+		}
+
+		g.fields[refPath] = edges
+		return s
+	}
+
+	_, err := jsonschema.FromType(root, append(slices.Clone(transforms), capture))
+	if err != nil {
+		return nil, err
+	}
+	return g, errors.Join(errs...)
+}
+
+// edge returns the property of the given type with the given name.
+func (g *typeGraph) edge(typeKey, name string) (fieldEdge, bool) {
+	for _, e := range g.fields[typeKey] {
+		if e.name == name {
+			return e, true
+		}
+	}
+	return fieldEdge{}, false
+}
+
+// structFieldOrder returns the names in props ordered by where each field is
+// declared in typ, flattening embedded structs breadth-first like
+// jsonschema.FromType. Membership in props is authoritative — it already
+// reflects every skip rule the generator applies — so reflection here only
+// recovers the declaration order the schema's property map loses.
+func structFieldOrder(typ reflect.Type, props map[string]*jsonschema.Schema) []string {
+	var names []string
+	seen := map[string]bool{}
+	bfsQueue := list.New()
+
+	for field := range typ.Fields() {
+		bfsQueue.PushBack(field)
+	}
+	for bfsQueue.Len() > 0 {
+		front := bfsQueue.Front()
+		field := front.Value.(reflect.StructField)
+		bfsQueue.Remove(front)
+
+		if field.Anonymous {
+			fieldType := field.Type
+			if fieldType.Kind() == reflect.Pointer {
+				fieldType = fieldType.Elem()
+			}
+			for f := range fieldType.Fields() {
+				bfsQueue.PushBack(f)
+			}
+			continue
+		}
+
+		name, _, _ := strings.Cut(field.Tag.Get("json"), ",")
+		if seen[name] {
+			continue
+		}
+		if _, ok := props[name]; !ok {
+			continue
+		}
+		seen[name] = true
+		names = append(names, name)
+	}
+	return names
+}
+
+// resolveEdgeType maps a property's $ref to the type path of its annotatable
+// element type, unwrapping the slice/ and map/ levels that the schema's type
+// paths insert for repeated and keyed fields.
+func resolveEdgeType(prop *jsonschema.Schema) string {
+	if prop.Reference == nil {
+		return ""
+	}
+	ref := strings.TrimPrefix(*prop.Reference, "#/$defs/")
+	for {
+		switch {
+		case strings.HasPrefix(ref, "slice/"):
+			ref = strings.TrimPrefix(ref, "slice/")
+		case strings.HasPrefix(ref, "map/"):
+			ref = strings.TrimPrefix(ref, "map/")
+		case strings.HasPrefix(ref, "github.com"):
+			return ref
+		default:
+			return ""
+		}
+	}
+}
diff --git a/bundle/internal/schema/typegraph_test.go b/bundle/internal/schema/typegraph_test.go
new file mode 100644
index 00000000000..a5bf186c7eb
--- /dev/null
+++ b/bundle/internal/schema/typegraph_test.go
@@ -0,0 +1,76 @@
+package main
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type tgRoot struct {
+	First  tgNested            `json:"first"`
+	ByName map[string]tgNested `json:"by_name,omitempty"`
+	Items  []tgItem            `json:"items,omitempty"`
+	Plain  string              `json:"plain,omitempty"`
+	Mode   tgMode              `json:"mode,omitempty"`
+	Skip   string              `json:"-"`
+	Hidden string              `json:"hidden,omitempty" bundle:"internal"`
+}
+
+type tgNested struct {
+	Description string    `json:"description,omitempty"`
+	Fields      string    `json:"fields,omitempty"`
+	Again       *tgNested `json:"again,omitempty"`
+}
+
+type tgItem struct {
+	tgEmbedded
+	Name string `json:"name,omitempty"`
+}
+
+type tgEmbedded struct {
+	Inner tgNested `json:"inner,omitempty"`
+}
+
+type tgMode string
+
+func TestTypeGraph(t *testing.T) {
+	g, err := newTypeGraph(reflect.TypeFor[tgRoot]())
+	require.NoError(t, err)
+
+	rootKey := getPath(reflect.TypeFor[tgRoot]())
+	nestedKey := getPath(reflect.TypeFor[tgNested]())
+	itemKey := getPath(reflect.TypeFor[tgItem]())
+	modeKey := getPath(reflect.TypeFor[tgMode]())
+
+	assert.Equal(t, rootKey, g.root)
+
+	// Properties are in struct declaration order; map and slice fields resolve
+	// to their element type; fields skipped by the schema generator are absent.
+	assert.Equal(t, []fieldEdge{
+		{name: "first", typ: nestedKey},
+		{name: "by_name", typ: nestedKey},
+		{name: "items", typ: itemKey},
+		{name: "plain", typ: ""},
+		{name: "mode", typ: modeKey},
+	}, g.fields[rootKey])
+
+	// Top-level fields precede embedded ones, matching the schema generator.
+	assert.Equal(t, []fieldEdge{
+		{name: "name", typ: ""},
+		{name: "inner", typ: nestedKey},
+	}, g.fields[itemKey])
+
+	// Cyclic self-reference resolves to the type itself.
+	assert.Equal(t, []fieldEdge{
+		{name: "description", typ: ""},
+		{name: "fields", typ: ""},
+		{name: "again", typ: nestedKey},
+	}, g.fields[nestedKey])
+
+	// Named string types (enums) are annotatable types without properties.
+	edges, ok := g.fields[modeKey]
+	assert.True(t, ok)
+	assert.Empty(t, edges)
+}
diff --git a/bundle/internal/tf/.gitattributes b/bundle/internal/tf/.gitattributes
deleted file mode 100644
index 208129959e6..00000000000
--- a/bundle/internal/tf/.gitattributes
+++ /dev/null
@@ -1 +0,0 @@
-schema/*.go linguist-generated=true
diff --git a/bundle/internal/tf/codegen/.gitignore b/bundle/internal/tf/codegen/.gitignore
deleted file mode 100644
index 72f05fc4962..00000000000
--- a/bundle/internal/tf/codegen/.gitignore
+++ /dev/null
@@ -1,3 +0,0 @@
-/codegen
-/tmp
-/.vscode
diff --git a/bundle/internal/tf/codegen/README.md b/bundle/internal/tf/codegen/README.md
deleted file mode 100644
index f309785a21c..00000000000
--- a/bundle/internal/tf/codegen/README.md
+++ /dev/null
@@ -1,22 +0,0 @@
-Use this tool to generate equivalent Go types from Terraform provider schema.
-
-## Usage
-
-The entry point for this tool is `.`.
-
-It uses `./tmp` a temporary data directory and `../schema` as output directory.
-
-It automatically installs the Terraform binary as well as the Databricks Terraform provider.
-It also fetches SHA256 checksums for the provider archive from GitHub releases.
-
-Run with:
-
-```go
-go run .
-```
-
-How to regenerate Go structs from an updated terraform provider?
-1. Bump version in ./schema/version.go
-2. Delete `./tmp` if it exists
-3. Run `go run .`
-4. Run `gofmt -s -w ../schema`
diff --git a/bundle/internal/tf/codegen/generator/generator.go b/bundle/internal/tf/codegen/generator/generator.go
deleted file mode 100644
index 0acf9caecf2..00000000000
--- a/bundle/internal/tf/codegen/generator/generator.go
+++ /dev/null
@@ -1,168 +0,0 @@
-// Package generator produces Go types from the Terraform provider schema.
-package generator
-
-import (
-	"context"
-	"fmt"
-	"log"
-	"maps"
-	"os"
-	"path/filepath"
-	"slices"
-	"strings"
-	"text/template"
-
-	schemapkg "github.com/databricks/cli/bundle/internal/tf/codegen/schema"
-	tfjson "github.com/hashicorp/terraform-json"
-)
-
-func normalizeName(name string) string {
-	return strings.TrimPrefix(name, "databricks_")
-}
-
-type collection struct {
-	OutputFile string
-	Blocks     []*namedBlock
-}
-
-func (c *collection) Generate(path string) error {
-	tmpl := template.Must(template.ParseFiles(fmt.Sprintf("./templates/%s.tmpl", c.OutputFile)))
-	f, err := os.Create(filepath.Join(path, c.OutputFile))
-	if err != nil {
-		return err
-	}
-
-	defer func() { _ = f.Close() }()
-
-	return tmpl.Execute(f, c)
-}
-
-type root struct {
-	OutputFile                 string
-	ProviderVersion            string
-	ProviderChecksumLinuxAmd64 string
-	ProviderChecksumLinuxArm64 string
-}
-
-func (r *root) Generate(path string) error {
-	tmpl := template.Must(template.ParseFiles(fmt.Sprintf("./templates/%s.tmpl", r.OutputFile)))
-	f, err := os.Create(filepath.Join(path, r.OutputFile))
-	if err != nil {
-		return err
-	}
-
-	defer func() { _ = f.Close() }()
-
-	return tmpl.Execute(f, r)
-}
-
-// Run generates Go type files under path for every resource and data source in schema.
-func Run(_ context.Context, schema *tfjson.ProviderSchema, checksums *schemapkg.ProviderChecksums, path string) error {
-	// Generate types for resources
-	var resources []*namedBlock
-	for _, k := range slices.Sorted(maps.Keys(schema.ResourceSchemas)) {
-		// Skipping all plugin framework struct generation.
-		// TODO: This is a temporary fix, generation should be fixed in the future.
-		if strings.HasSuffix(k, "_pluginframework") {
-			continue
-		}
-
-		v := schema.ResourceSchemas[k]
-		b := &namedBlock{
-			filePattern:    "resource_%s.go",
-			typeNamePrefix: "Resource",
-			name:           k,
-			block:          v.Block,
-		}
-
-		// Skip fields generation for resource_quality_monitor to avoid unwanted changes,
-		// as of August 2025 the generator turns pointer fields into slices, which breaks the resource behaviour.
-		// See https://github.com/databricks/cli/pull/3462
-		if k == "databricks_quality_monitor" {
-			log.Printf("Warning: Skipping file generation for %s to avoid known unwanted changes", k)
-		} else {
-			err := b.Generate(path)
-			if err != nil {
-				return err
-			}
-		}
-		resources = append(resources, b)
-	}
-
-	// Generate types for data sources.
-	var dataSources []*namedBlock
-	for _, k := range slices.Sorted(maps.Keys(schema.DataSourceSchemas)) {
-		// Skipping all plugin framework struct generation.
-		// TODO: This is a temporary fix, generation should be fixed in the future.
-		if strings.HasSuffix(k, "_pluginframework") {
-			continue
-		}
-
-		v := schema.DataSourceSchemas[k]
-		b := &namedBlock{
-			filePattern:    "data_source_%s.go",
-			typeNamePrefix: "DataSource",
-			name:           k,
-			block:          v.Block,
-		}
-		err := b.Generate(path)
-		if err != nil {
-			return err
-		}
-		dataSources = append(dataSources, b)
-	}
-
-	// Generate type for provider configuration.
-	{
-		b := &namedBlock{
-			filePattern:    "%s.go",
-			typeNamePrefix: "",
-			name:           "config",
-			block:          schema.ConfigSchema.Block,
-		}
-		err := b.Generate(path)
-		if err != nil {
-			return err
-		}
-	}
-
-	// Generate resources.go
-	{
-		cr := &collection{
-			OutputFile: "resources.go",
-			Blocks:     resources,
-		}
-		err := cr.Generate(path)
-		if err != nil {
-			return err
-		}
-	}
-
-	// Generate data_sources.go
-	{
-		cr := &collection{
-			OutputFile: "data_sources.go",
-			Blocks:     dataSources,
-		}
-		err := cr.Generate(path)
-		if err != nil {
-			return err
-		}
-	}
-
-	// Generate root.go
-	{
-		r := &root{
-			OutputFile:                 "root.go",
-			ProviderVersion:            schemapkg.ProviderVersion,
-			ProviderChecksumLinuxAmd64: checksums.LinuxAmd64,
-			ProviderChecksumLinuxArm64: checksums.LinuxArm64,
-		}
-		err := r.Generate(path)
-		if err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
diff --git a/bundle/internal/tf/codegen/generator/named_block.go b/bundle/internal/tf/codegen/generator/named_block.go
deleted file mode 100644
index 5cb5bcc9b71..00000000000
--- a/bundle/internal/tf/codegen/generator/named_block.go
+++ /dev/null
@@ -1,60 +0,0 @@
-package generator
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-	"text/template"
-
-	tfjson "github.com/hashicorp/terraform-json"
-	"github.com/iancoleman/strcase"
-)
-
-type namedBlock struct {
-	filePattern    string
-	typeNamePrefix string
-	name           string
-	block          *tfjson.SchemaBlock
-}
-
-func (b *namedBlock) FieldName() string {
-	return b.camelName()
-}
-
-func (b *namedBlock) TypeBase() []string {
-	return []string{b.typeNamePrefix, b.camelName()}
-}
-
-func (b *namedBlock) TypeName() string {
-	return strings.Join(b.TypeBase(), "")
-}
-
-func (b *namedBlock) TerraformName() string {
-	return b.name
-}
-
-func (b *namedBlock) normalizedName() string {
-	return normalizeName(b.name)
-}
-
-func (b *namedBlock) camelName() string {
-	return strcase.ToCamel(b.normalizedName())
-}
-
-func (b *namedBlock) Generate(path string) error {
-	w, err := walk(b.block, []string{b.typeNamePrefix, b.camelName()}, b.name)
-	if err != nil {
-		return err
-	}
-
-	f, err := os.Create(filepath.Join(path, fmt.Sprintf(b.filePattern, b.normalizedName())))
-	if err != nil {
-		return err
-	}
-
-	defer func() { _ = f.Close() }()
-
-	tmpl := template.Must(template.ParseFiles("./templates/block.go.tmpl"))
-	return tmpl.Execute(f, w)
-}
diff --git a/bundle/internal/tf/codegen/generator/walker.go b/bundle/internal/tf/codegen/generator/walker.go
deleted file mode 100644
index aff905c492e..00000000000
--- a/bundle/internal/tf/codegen/generator/walker.go
+++ /dev/null
@@ -1,230 +0,0 @@
-package generator
-
-import (
-	"fmt"
-	"maps"
-	"slices"
-	"strings"
-
-	tfjson "github.com/hashicorp/terraform-json"
-	"github.com/iancoleman/strcase"
-	"github.com/zclconf/go-cty/cty"
-)
-
-type field struct {
-	Name string
-	Type string
-	Tag  string
-}
-
-type structType struct {
-	Name   string
-	Fields []field
-}
-
-// walker represents the set of types to declare to
-// represent a [tfjson.SchemaBlock] as Go structs.
-// See the [walk] function for usage.
-type walker struct {
-	StructTypes  []structType
-	resourceName string // The Terraform resource name (e.g., "databricks_postgres_endpoint")
-}
-
-// floatAttributePaths is an allowlist of attribute paths (resource_name.field_path)
-// that should be mapped to float64 instead of int for cty.Number types.
-// Generated from Terraform provider schema based on databricks-sdk-go types.
-var floatAttributePaths = map[string]bool{
-	// Alert thresholds - double_value fields hold fractional values (e.g., 1.3)
-	"databricks_alert_v2.evaluation.threshold.value.double_value": true,
-
-	// Postgres Service - autoscaling compute units support fractional values (e.g., 0.5 CU)
-	"databricks_postgres_endpoint.spec.autoscaling_limit_max_cu":                                      true,
-	"databricks_postgres_endpoint.spec.autoscaling_limit_min_cu":                                      true,
-	"databricks_postgres_endpoint.status.autoscaling_limit_max_cu":                                    true,
-	"databricks_postgres_endpoint.status.autoscaling_limit_min_cu":                                    true,
-	"databricks_postgres_endpoints.endpoints.spec.autoscaling_limit_max_cu":                           true,
-	"databricks_postgres_endpoints.endpoints.spec.autoscaling_limit_min_cu":                           true,
-	"databricks_postgres_endpoints.endpoints.status.autoscaling_limit_max_cu":                         true,
-	"databricks_postgres_endpoints.endpoints.status.autoscaling_limit_min_cu":                         true,
-	"databricks_postgres_project.spec.default_endpoint_settings.autoscaling_limit_max_cu":             true,
-	"databricks_postgres_project.spec.default_endpoint_settings.autoscaling_limit_min_cu":             true,
-	"databricks_postgres_project.status.default_endpoint_settings.autoscaling_limit_max_cu":           true,
-	"databricks_postgres_project.status.default_endpoint_settings.autoscaling_limit_min_cu":           true,
-	"databricks_postgres_projects.projects.spec.default_endpoint_settings.autoscaling_limit_max_cu":   true,
-	"databricks_postgres_projects.projects.spec.default_endpoint_settings.autoscaling_limit_min_cu":   true,
-	"databricks_postgres_projects.projects.status.default_endpoint_settings.autoscaling_limit_max_cu": true,
-	"databricks_postgres_projects.projects.status.default_endpoint_settings.autoscaling_limit_min_cu": true,
-}
-
-// buildAttributePath constructs the attribute path from the type name path.
-// For example: ["Resource", "PostgresEndpoint", "Spec"] + "autoscaling_limit_min_cu" -> "spec.autoscaling_limit_min_cu"
-func buildAttributePath(name []string, fieldName string) string {
-	// Skip the type prefix (Resource/DataSource) and resource name (first 2 elements)
-	// and convert remaining CamelCase to snake_case
-	var parts []string
-	for i := 2; i < len(name); i++ {
-		parts = append(parts, toSnakeCase(name[i]))
-	}
-	parts = append(parts, fieldName)
-	return strings.Join(parts, ".")
-}
-
-// toSnakeCase converts CamelCase to snake_case
-func toSnakeCase(s string) string {
-	var result strings.Builder
-	for i, r := range s {
-		if i > 0 && 'A' <= r && r <= 'Z' {
-			result.WriteRune('_')
-		}
-		result.WriteRune(r)
-	}
-	return strings.ToLower(result.String())
-}
-
-func processAttributeType(typ cty.Type, resourceName, attributePath string) string {
-	var out string
-
-	switch {
-	case typ.IsPrimitiveType():
-		switch {
-		case typ.Equals(cty.Bool):
-			out = "bool"
-		case typ.Equals(cty.Number):
-			// Check if this resource + attribute path should be float64
-			fullPath := resourceName + "." + attributePath
-			if floatAttributePaths[fullPath] {
-				out = "float64"
-			} else {
-				out = "int"
-			}
-		case typ.Equals(cty.String):
-			out = "string"
-		default:
-			panic("No idea what to do for: " + typ.FriendlyName())
-		}
-	case typ.IsMapType():
-		out = "map[string]" + processAttributeType(*typ.MapElementType(), resourceName, attributePath)
-	case typ.IsSetType():
-		out = "[]" + processAttributeType(*typ.SetElementType(), resourceName, attributePath)
-	case typ.IsListType():
-		out = "[]" + processAttributeType(*typ.ListElementType(), resourceName, attributePath)
-	case typ.IsObjectType():
-		out = "any"
-	default:
-		panic("No idea what to do for: " + typ.FriendlyName())
-	}
-
-	return out
-}
-
-func nestedBlockKeys(block *tfjson.SchemaBlock) []string {
-	keys := slices.Sorted(maps.Keys(block.NestedBlocks))
-
-	// Remove TF specific "timeouts" block.
-	if i := slices.Index(keys, "timeouts"); i != -1 {
-		keys = slices.Delete(keys, i, i+1)
-	}
-
-	return keys
-}
-
-func nestedField(name []string, k string, isRef bool) field {
-	// Collect field properties.
-	fieldName := strcase.ToCamel(k)
-	fieldTypePrefix := ""
-	if isRef {
-		fieldTypePrefix = "*"
-	} else {
-		fieldTypePrefix = "[]"
-	}
-	fieldType := fmt.Sprintf("%s%s", fieldTypePrefix, strings.Join(append(name, strcase.ToCamel(k)), ""))
-	fieldTag := k + ",omitempty"
-
-	return field{
-		Name: fieldName,
-		Type: fieldType,
-		Tag:  fieldTag,
-	}
-}
-
-func (w *walker) walk(block *tfjson.SchemaBlock, name []string) error {
-	// Produce nested types before this block itself.
-	// This ensures types are defined before they are referenced.
-	for _, k := range nestedBlockKeys(block) {
-		v := block.NestedBlocks[k]
-		err := w.walk(v.Block, append(name, strcase.ToCamel(k)))
-		if err != nil {
-			return err
-		}
-	}
-
-	// Declare type.
-	typ := structType{
-		Name: strings.Join(name, ""),
-	}
-
-	// Declare attributes.
-	for _, k := range slices.Sorted(maps.Keys(block.Attributes)) {
-		v := block.Attributes[k]
-
-		// Assert the attribute type is always set.
-		if v.AttributeType == cty.NilType && v.AttributeNestedType == nil {
-			return fmt.Errorf("unexpected nil type for attribute %s", k)
-		}
-
-		// If there is a nested type, walk it and continue to next attribute.
-		if v.AttributeNestedType != nil {
-			nestedBlock := &tfjson.SchemaBlock{
-				Attributes: v.AttributeNestedType.Attributes,
-			}
-			err := w.walk(nestedBlock, append(name, strcase.ToCamel(k)))
-			if err != nil {
-				return err
-			}
-			// Append to list of fields for type.
-			typ.Fields = append(typ.Fields, nestedField(name, k, v.AttributeNestedType.NestingMode == tfjson.SchemaNestingModeSingle))
-			continue
-		}
-
-		// Collect field properties.
-		fieldName := strcase.ToCamel(k)
-		attributePath := buildAttributePath(name, k)
-		fieldType := processAttributeType(v.AttributeType, w.resourceName, attributePath)
-		if v.Required && v.Optional {
-			return fmt.Errorf("both required and optional are set for attribute %s", k)
-		}
-		var fieldTag string
-		if v.Required {
-			fieldTag = k
-		} else {
-			fieldTag = k + ",omitempty"
-		}
-
-		// Append to list of fields for type.
-		typ.Fields = append(typ.Fields, field{
-			Name: fieldName,
-			Type: fieldType,
-			Tag:  fieldTag,
-		})
-	}
-
-	// Declare nested blocks.
-	for _, k := range nestedBlockKeys(block) {
-		v := block.NestedBlocks[k]
-		// Append to list of fields for type.
-		typ.Fields = append(typ.Fields, nestedField(name, k, v.MaxItems == 1))
-	}
-
-	// Append type to list of structs.
-	w.StructTypes = append(w.StructTypes, typ)
-	return nil
-}
-
-// walk recursively traverses [tfjson.SchemaBlock] and returns the
-// set of types to declare to represents it as Go structs.
-// The resourceName parameter is the Terraform resource name (e.g., "databricks_postgres_endpoint").
-func walk(block *tfjson.SchemaBlock, name []string, resourceName string) (*walker, error) {
-	w := &walker{resourceName: resourceName}
-	err := w.walk(block, name)
-	return w, err
-}
diff --git a/bundle/internal/tf/codegen/go.mod b/bundle/internal/tf/codegen/go.mod
deleted file mode 100644
index 14ba8f47ebb..00000000000
--- a/bundle/internal/tf/codegen/go.mod
+++ /dev/null
@@ -1,26 +0,0 @@
-module github.com/databricks/cli/bundle/internal/tf/codegen
-
-go 1.25.0
-
-toolchain go1.25.9
-
-require (
-	github.com/hashicorp/go-version v1.7.0
-	github.com/hashicorp/hc-install v0.9.2
-	github.com/hashicorp/terraform-exec v0.24.0
-	github.com/hashicorp/terraform-json v0.27.2
-	github.com/iancoleman/strcase v0.3.0
-	github.com/zclconf/go-cty v1.16.4
-)
-
-require (
-	github.com/ProtonMail/go-crypto v1.1.6 // indirect
-	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
-	github.com/cloudflare/circl v1.6.3 // indirect
-	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
-	golang.org/x/crypto v0.45.0 // indirect
-	golang.org/x/mod v0.30.0 // indirect
-	golang.org/x/sys v0.38.0 // indirect
-	golang.org/x/text v0.31.0 // indirect
-)
diff --git a/bundle/internal/tf/codegen/go.sum b/bundle/internal/tf/codegen/go.sum
deleted file mode 100644
index 4bf08058d86..00000000000
--- a/bundle/internal/tf/codegen/go.sum
+++ /dev/null
@@ -1,74 +0,0 @@
-dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk=
-dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
-github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
-github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
-github.com/ProtonMail/go-crypto v1.1.6 h1:ZcV+Ropw6Qn0AX9brlQLAUXfqLBc7Bl+f/DmNxpLfdw=
-github.com/ProtonMail/go-crypto v1.1.6/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE=
-github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew1u1fNQOlOtuGxQY=
-github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4=
-github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8=
-github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4=
-github.com/cyphar/filepath-securejoin v0.4.1 h1:JyxxyPEaktOD+GAnqIqTf9A8tHyAG22rowi7HkoSU1s=
-github.com/cyphar/filepath-securejoin v0.4.1/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGLDGQL7h7bg04C/+u9jI=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
-github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
-github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM=
-github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE=
-github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
-github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
-github.com/go-git/go-billy/v5 v5.6.2 h1:6Q86EsPXMa7c3YZ3aLAQsMA0VlWmy43r6FHqa/UNbRM=
-github.com/go-git/go-billy/v5 v5.6.2/go.mod h1:rcFC2rAsp/erv7CMz9GczHcuD0D32fWzH+MJAU+jaUU=
-github.com/go-git/go-git/v5 v5.14.0 h1:/MD3lCrGjCen5WfEAzKg00MJJffKhC8gzS80ycmCi60=
-github.com/go-git/go-git/v5 v5.14.0/go.mod h1:Z5Xhoia5PcWA3NF8vRLURn9E5FRhSl7dGj9ItW3Wk5k=
-github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ=
-github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw=
-github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
-github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
-github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
-github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
-github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
-github.com/hashicorp/go-retryablehttp v0.7.7 h1:C8hUCYzor8PIfXHa4UrZkU4VvK8o9ISHxT2Q8+VepXU=
-github.com/hashicorp/go-retryablehttp v0.7.7/go.mod h1:pkQpWZeYWskR+D1tR2O5OcBFOxfA7DoAO6xtkuQnHTk=
-github.com/hashicorp/go-version v1.7.0 h1:5tqGy27NaOTB8yJKUZELlFAS/LTKJkrmONwQKeRZfjY=
-github.com/hashicorp/go-version v1.7.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
-github.com/hashicorp/hc-install v0.9.2 h1:v80EtNX4fCVHqzL9Lg/2xkp62bbvQMnvPQ0G+OmtO24=
-github.com/hashicorp/hc-install v0.9.2/go.mod h1:XUqBQNnuT4RsxoxiM9ZaUk0NX8hi2h+Lb6/c0OZnC/I=
-github.com/hashicorp/terraform-exec v0.24.0 h1:mL0xlk9H5g2bn0pPF6JQZk5YlByqSqrO5VoaNtAf8OE=
-github.com/hashicorp/terraform-exec v0.24.0/go.mod h1:lluc/rDYfAhYdslLJQg3J0oDqo88oGQAdHR+wDqFvo4=
-github.com/hashicorp/terraform-json v0.27.2 h1:BwGuzM6iUPqf9JYM/Z4AF1OJ5VVJEEzoKST/tRDBJKU=
-github.com/hashicorp/terraform-json v0.27.2/go.mod h1:GzPLJ1PLdUG5xL6xn1OXWIjteQRT2CNT9o/6A9mi9hE=
-github.com/iancoleman/strcase v0.3.0 h1:nTXanmYxhfFAMjZL34Ov6gkzEsSJZ5DbhxWjvSASxEI=
-github.com/iancoleman/strcase v0.3.0/go.mod h1:iwCmte+B7n89clKwxIoIXy/HfoL7AsD47ZCWhYzw7ho=
-github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
-github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
-github.com/kevinburke/ssh_config v1.2.0 h1:x584FjTGwHzMwvHx18PXxbBVzfnxogHaAReU4gf13a4=
-github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
-github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
-github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/pjbgf/sha1cd v0.3.2 h1:a9wb0bp1oC2TGwStyn0Umc/IGKQnEgF0vVaZ8QF8eo4=
-github.com/pjbgf/sha1cd v0.3.2/go.mod h1:zQWigSxVmsHEZow5qaLtPYxpcKMMQpa09ixqBxuCS6A=
-github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8=
-github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
-github.com/skeema/knownhosts v1.3.1 h1:X2osQ+RAjK76shCbvhHHHVl3ZlgDm8apHEHFqRjnBY8=
-github.com/skeema/knownhosts v1.3.1/go.mod h1:r7KTdC8l4uxWRyK2TpQZ/1o5HaSzh06ePQNxPwTcfiY=
-github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM=
-github.com/xanzy/ssh-agent v0.3.3/go.mod h1:6dzNDKs0J9rVPHPhaGCukekBHKqfl+L3KghI1Bc68Uw=
-github.com/zclconf/go-cty v1.16.4 h1:QGXaag7/7dCzb+odlGrgr+YmYZFaOCMW6DEpS+UD1eE=
-github.com/zclconf/go-cty v1.16.4/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE=
-golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
-golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
-golang.org/x/mod v0.30.0 h1:fDEXFVZ/fmCKProc/yAXXUijritrDzahmwwefnjoPFk=
-golang.org/x/mod v0.30.0/go.mod h1:lAsf5O2EvJeSFMiBxXDki7sCgAxEUcZHXoXMKT4GJKc=
-golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
-golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
-golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
-golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
-golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
-gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
-gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
diff --git a/bundle/internal/tf/codegen/main.go b/bundle/internal/tf/codegen/main.go
deleted file mode 100644
index 0671b559c05..00000000000
--- a/bundle/internal/tf/codegen/main.go
+++ /dev/null
@@ -1,32 +0,0 @@
-// Command codegen generates Go types from the Databricks Terraform provider schema.
-package main
-
-import (
-	"context"
-	"log"
-
-	"github.com/databricks/cli/bundle/internal/tf/codegen/generator"
-	"github.com/databricks/cli/bundle/internal/tf/codegen/schema"
-)
-
-func main() {
-	ctx := context.Background()
-
-	s, err := schema.Load(ctx)
-	if err != nil {
-		log.Fatal(err)
-	}
-
-	log.Printf("fetching provider checksums for v%s", schema.ProviderVersion)
-	checksums, err := schema.FetchProviderChecksums(schema.ProviderVersion)
-	if err != nil {
-		log.Fatal(err)
-	}
-	log.Printf("  linux_amd64: %s", checksums.LinuxAmd64)
-	log.Printf("  linux_arm64: %s", checksums.LinuxArm64)
-
-	err = generator.Run(ctx, s, checksums, "../schema")
-	if err != nil {
-		log.Fatal(err)
-	}
-}
diff --git a/bundle/internal/tf/codegen/schema/checksum.go b/bundle/internal/tf/codegen/schema/checksum.go
deleted file mode 100644
index a05d509a76a..00000000000
--- a/bundle/internal/tf/codegen/schema/checksum.go
+++ /dev/null
@@ -1,115 +0,0 @@
-package schema
-
-import (
-	"bufio"
-	"crypto/sha256"
-	"encoding/hex"
-	"fmt"
-	"io"
-	"log"
-	"net/http"
-	"strings"
-)
-
-// ProviderChecksums holds the SHA256 checksums for the Databricks Terraform
-// provider archive for supported Linux architectures.
-type ProviderChecksums struct {
-	LinuxAmd64 string
-	LinuxArm64 string
-}
-
-// FetchProviderChecksums downloads the SHA256SUMS file from the GitHub release
-// for the given provider version and extracts checksums for the linux_amd64 and
-// linux_arm64 archives. It also downloads both zips to verify that the parsed
-// checksums are correct.
-// https://github.com/databricks/terraform-provider-databricks/releases
-func FetchProviderChecksums(version string) (*ProviderChecksums, error) {
-	url := fmt.Sprintf(
-		"https://github.com/databricks/terraform-provider-databricks/releases/download/v%s/terraform-provider-databricks_%s_SHA256SUMS",
-		version, version,
-	)
-
-	resp, err := http.Get(url)
-	if err != nil {
-		return nil, fmt.Errorf("downloading SHA256SUMS for provider v%s: %w", version, err)
-	}
-	defer func() { _ = resp.Body.Close() }()
-
-	if resp.StatusCode != http.StatusOK {
-		return nil, fmt.Errorf("downloading SHA256SUMS for provider v%s: HTTP %s", version, resp.Status)
-	}
-
-	checksums := &ProviderChecksums{}
-	amd64Suffix := fmt.Sprintf("terraform-provider-databricks_%s_linux_amd64.zip", version)
-	arm64Suffix := fmt.Sprintf("terraform-provider-databricks_%s_linux_arm64.zip", version)
-
-	scanner := bufio.NewScanner(resp.Body)
-	for scanner.Scan() {
-		line := scanner.Text()
-		parts := strings.Fields(line)
-		if len(parts) != 2 {
-			continue
-		}
-		switch parts[1] {
-		case amd64Suffix:
-			checksums.LinuxAmd64 = parts[0]
-		case arm64Suffix:
-			checksums.LinuxArm64 = parts[0]
-		}
-	}
-	if err := scanner.Err(); err != nil {
-		return nil, fmt.Errorf("reading SHA256SUMS for provider v%s: %w", version, err)
-	}
-
-	if checksums.LinuxAmd64 == "" {
-		return nil, fmt.Errorf("checksum not found for %s in SHA256SUMS", amd64Suffix)
-	}
-	if checksums.LinuxArm64 == "" {
-		return nil, fmt.Errorf("checksum not found for %s in SHA256SUMS", arm64Suffix)
-	}
-
-	// Sanity check: download both zips and verify the checksums match.
-	err = verifyProviderChecksum(version, "linux_amd64", checksums.LinuxAmd64)
-	if err != nil {
-		return nil, err
-	}
-	err = verifyProviderChecksum(version, "linux_arm64", checksums.LinuxArm64)
-	if err != nil {
-		return nil, err
-	}
-
-	return checksums, nil
-}
-
-// verifyProviderChecksum downloads the provider zip for the given platform and
-// verifies it matches the expected SHA256 checksum.
-func verifyProviderChecksum(version, platform, expectedChecksum string) error {
-	url := fmt.Sprintf(
-		"https://github.com/databricks/terraform-provider-databricks/releases/download/v%s/terraform-provider-databricks_%s_%s.zip",
-		version, version, platform,
-	)
-
-	log.Printf("verifying checksum for %s provider archive", platform)
-	resp, err := http.Get(url)
-	if err != nil {
-		return fmt.Errorf("downloading provider archive for checksum verification: %w", err)
-	}
-	defer func() { _ = resp.Body.Close() }()
-
-	if resp.StatusCode != http.StatusOK {
-		return fmt.Errorf("downloading provider archive for checksum verification: HTTP %s", resp.Status)
-	}
-
-	hash := sha256.New()
-	if _, err := io.Copy(hash, resp.Body); err != nil {
-		return fmt.Errorf("computing checksum for provider archive: %w", err)
-	}
-
-	actualChecksum := hex.EncodeToString(hash.Sum(nil))
-	if actualChecksum != expectedChecksum {
-		return fmt.Errorf("checksum mismatch for %s provider archive: expected %s, got %s", platform, expectedChecksum, actualChecksum)
-	}
-
-	log.Printf("checksum verified for %s provider archive", platform)
-	return nil
-}
diff --git a/bundle/internal/tf/codegen/schema/generate.go b/bundle/internal/tf/codegen/schema/generate.go
deleted file mode 100644
index 465183ca3b5..00000000000
--- a/bundle/internal/tf/codegen/schema/generate.go
+++ /dev/null
@@ -1,108 +0,0 @@
-package schema
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"log"
-	"os"
-	"path/filepath"
-
-	"github.com/hashicorp/go-version"
-	"github.com/hashicorp/hc-install/product"
-	"github.com/hashicorp/hc-install/releases"
-	"github.com/hashicorp/terraform-exec/tfexec"
-)
-
-func (s *Schema) writeTerraformBlock(_ context.Context) error {
-	body := map[string]any{
-		"terraform": map[string]any{
-			"required_providers": map[string]any{
-				"databricks": map[string]any{
-					"source":  "databricks/databricks",
-					"version": ProviderVersion,
-				},
-			},
-		},
-	}
-
-	buf, err := json.MarshalIndent(body, "", "  ")
-	if err != nil {
-		return err
-	}
-
-	return os.WriteFile(filepath.Join(s.WorkingDir, "main.tf.json"), buf, 0o644)
-}
-
-func (s *Schema) installTerraform(ctx context.Context) (path string, err error) {
-	installDir := filepath.Join(s.WorkingDir, "bin")
-	err = os.MkdirAll(installDir, 0o755)
-	if err != nil {
-		return path, err
-	}
-
-	installer := &releases.ExactVersion{
-		Product:    product.Terraform,
-		Version:    version.Must(version.NewVersion("1.5.5")),
-		InstallDir: installDir,
-	}
-
-	installer.SetLogger(log.Default())
-
-	path, err = installer.Install(ctx)
-	return path, err
-}
-
-func (s *Schema) generateSchema(ctx context.Context, execPath string) error {
-	tf, err := tfexec.NewTerraform(s.WorkingDir, execPath)
-	if err != nil {
-		return err
-	}
-
-	log.Printf("running `terraform init`")
-	err = tf.Init(ctx, tfexec.Upgrade(true))
-	if err != nil {
-		return err
-	}
-
-	log.Printf("acquiring provider schema")
-	schemas, err := tf.ProvidersSchema(ctx)
-	if err != nil {
-		return err
-	}
-
-	// Find the databricks provider definition.
-	_, ok := schemas.Schemas[DatabricksProvider]
-	if !ok {
-		return fmt.Errorf("schema file doesn't include schema for %s", DatabricksProvider)
-	}
-
-	buf, err := json.MarshalIndent(schemas, "", "  ")
-	if err != nil {
-		return err
-	}
-
-	return os.WriteFile(s.ProviderSchemaFile, buf, 0o644)
-}
-
-// Generate produces the provider schema JSON file on disk.
-func (s *Schema) Generate(ctx context.Context) error {
-	var err error
-
-	err = s.writeTerraformBlock(ctx)
-	if err != nil {
-		return err
-	}
-
-	path, err := s.installTerraform(ctx)
-	if err != nil {
-		return err
-	}
-
-	err = s.generateSchema(ctx, path)
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
diff --git a/bundle/internal/tf/codegen/schema/load.go b/bundle/internal/tf/codegen/schema/load.go
deleted file mode 100644
index 6a19eb0378e..00000000000
--- a/bundle/internal/tf/codegen/schema/load.go
+++ /dev/null
@@ -1,37 +0,0 @@
-package schema
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"os"
-
-	tfjson "github.com/hashicorp/terraform-json"
-)
-
-// Load reads the provider schema JSON file and returns the Databricks provider schema.
-func (s *Schema) Load(_ context.Context) (*tfjson.ProviderSchema, error) {
-	buf, err := os.ReadFile(s.ProviderSchemaFile)
-	if err != nil {
-		return nil, err
-	}
-
-	var document tfjson.ProviderSchemas
-	err = json.Unmarshal(buf, &document)
-	if err != nil {
-		return nil, err
-	}
-
-	err = document.Validate()
-	if err != nil {
-		return nil, fmt.Errorf("invalid schema: %w", err)
-	}
-
-	// Find the databricks provider definition.
-	schema, ok := document.Schemas[DatabricksProvider]
-	if !ok {
-		return nil, fmt.Errorf("schema file doesn't include schema for %s", DatabricksProvider)
-	}
-
-	return schema, nil
-}
diff --git a/bundle/internal/tf/codegen/schema/schema.go b/bundle/internal/tf/codegen/schema/schema.go
deleted file mode 100644
index ce3d2e1355a..00000000000
--- a/bundle/internal/tf/codegen/schema/schema.go
+++ /dev/null
@@ -1,60 +0,0 @@
-// Package schema fetches and loads the Terraform provider schema used by
-// the codegen step.
-package schema
-
-import (
-	"context"
-	"errors"
-	"io/fs"
-	"os"
-	"path/filepath"
-
-	tfjson "github.com/hashicorp/terraform-json"
-)
-
-// DatabricksProvider is the fully qualified Terraform provider address.
-const DatabricksProvider = "registry.terraform.io/databricks/databricks"
-
-// Schema describes the on-disk location of the provider schema artifacts.
-type Schema struct {
-	WorkingDir string
-
-	ProviderSchemaFile string
-}
-
-// New creates a Schema rooted at ./tmp under the current working directory.
-func New() (*Schema, error) {
-	wd, err := os.Getwd()
-	if err != nil {
-		return nil, err
-	}
-
-	tmpdir := filepath.Join(wd, "./tmp")
-	err = os.MkdirAll(tmpdir, 0o755)
-	if err != nil {
-		return nil, err
-	}
-
-	return &Schema{
-		WorkingDir:         tmpdir,
-		ProviderSchemaFile: filepath.Join(tmpdir, "provider.json"),
-	}, nil
-}
-
-// Load returns the parsed provider schema, fetching and generating it if needed.
-func Load(ctx context.Context) (*tfjson.ProviderSchema, error) {
-	s, err := New()
-	if err != nil {
-		return nil, err
-	}
-
-	// Generate schema file if it doesn't exist.
-	if _, err := os.Stat(s.ProviderSchemaFile); errors.Is(err, fs.ErrNotExist) {
-		err = s.Generate(ctx)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	return s.Load(ctx)
-}
diff --git a/bundle/internal/tf/codegen/schema/version.go b/bundle/internal/tf/codegen/schema/version.go
deleted file mode 100644
index 8b270d7670b..00000000000
--- a/bundle/internal/tf/codegen/schema/version.go
+++ /dev/null
@@ -1,4 +0,0 @@
-package schema
-
-// ProviderVersion is the version of the Databricks Terraform provider used for codegen.
-const ProviderVersion = "1.113.0"
diff --git a/bundle/internal/tf/codegen/templates/block.go.tmpl b/bundle/internal/tf/codegen/templates/block.go.tmpl
deleted file mode 100644
index 9b457cce708..00000000000
--- a/bundle/internal/tf/codegen/templates/block.go.tmpl
+++ /dev/null
@@ -1,11 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-{{ range .StructTypes }}
-type {{ .Name }} struct {
-    {{- range .Fields }}
-    {{ .Name }} {{ .Type }} `json:"{{ .Tag }}"`
-    {{- end }}
-}
-{{ end }}
diff --git a/bundle/internal/tf/codegen/templates/data_sources.go.tmpl b/bundle/internal/tf/codegen/templates/data_sources.go.tmpl
deleted file mode 100644
index 9d998d4973f..00000000000
--- a/bundle/internal/tf/codegen/templates/data_sources.go.tmpl
+++ /dev/null
@@ -1,17 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSources struct {
-	{{- range .Blocks }}
-	{{ .FieldName }} map[string]any `json:"{{ .TerraformName }},omitempty"`
-	{{- end }}
-}
-
-func NewDataSources() *DataSources {
-	return &DataSources{
-		{{- range .Blocks }}
-		{{ .FieldName }}: make(map[string]any),
-		{{- end }}
-	}
-}
diff --git a/bundle/internal/tf/codegen/templates/resources.go.tmpl b/bundle/internal/tf/codegen/templates/resources.go.tmpl
deleted file mode 100644
index 91407a00e1f..00000000000
--- a/bundle/internal/tf/codegen/templates/resources.go.tmpl
+++ /dev/null
@@ -1,17 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type Resources struct {
-	{{- range .Blocks }}
-	{{ .FieldName }} map[string]any `json:"{{ .TerraformName }},omitempty"`
-	{{- end }}
-}
-
-func NewResources() *Resources {
-	return &Resources{
-        {{- range .Blocks }}
-        {{ .FieldName }}: make(map[string]any),
-        {{- end }}
-	}
-}
diff --git a/bundle/internal/tf/codegen/templates/root.go.tmpl b/bundle/internal/tf/codegen/templates/root.go.tmpl
deleted file mode 100644
index fc356042cd3..00000000000
--- a/bundle/internal/tf/codegen/templates/root.go.tmpl
+++ /dev/null
@@ -1,39 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-package schema
-
-type Providers struct {
-	Databricks *Config `json:"databricks,omitempty"`
-}
-
-func NewProviders() *Providers {
-	return &Providers{
-		Databricks: &Config{},
-	}
-}
-
-type Root struct {
-	Terraform map[string]any `json:"terraform"`
-
-	Provider *Providers   `json:"provider,omitempty"`
-	Data     *DataSources `json:"data,omitempty"`
-	Resource *Resources   `json:"resource,omitempty"`
-}
-
-const ProviderHost = "registry.terraform.io"
-const ProviderSource = "databricks/databricks"
-const ProviderVersion = "{{ .ProviderVersion }}"
-const ProviderChecksumLinuxAmd64 = "{{ .ProviderChecksumLinuxAmd64 }}"
-const ProviderChecksumLinuxArm64 = "{{ .ProviderChecksumLinuxArm64 }}"
-
-func NewRoot() *Root {
-	return &Root{
-		Terraform: map[string]any{
-			"required_providers": map[string]any{
-				"databricks": map[string]any{
-					"source": ProviderSource,
-					"version": ProviderVersion,
-				},
-			},
-		},
-	}
-}
diff --git a/bundle/internal/tf/codegen/test-output-unit-codegen.json b/bundle/internal/tf/codegen/test-output-unit-codegen.json
new file mode 100644
index 00000000000..0d972f9c7c8
--- /dev/null
+++ b/bundle/internal/tf/codegen/test-output-unit-codegen.json
@@ -0,0 +1,9 @@
+{"Time":"2026-10-05T15:53:15.831243+02:00","Action":"start","Package":"github.com/databricks/cli/bundle/internal/tf/codegen"}
+{"Time":"2026-10-05T15:53:15.831346+02:00","Action":"output","Package":"github.com/databricks/cli/bundle/internal/tf/codegen","Output":"?   \tgithub.com/databricks/cli/bundle/internal/tf/codegen\t[no test files]\n"}
+{"Time":"2026-10-05T15:53:15.831356+02:00","Action":"skip","Package":"github.com/databricks/cli/bundle/internal/tf/codegen","Elapsed":0}
+{"Time":"2026-10-05T15:53:15.831369+02:00","Action":"start","Package":"github.com/databricks/cli/bundle/internal/tf/codegen/generator"}
+{"Time":"2026-10-05T15:53:15.831395+02:00","Action":"output","Package":"github.com/databricks/cli/bundle/internal/tf/codegen/generator","Output":"?   \tgithub.com/databricks/cli/bundle/internal/tf/codegen/generator\t[no test files]\n"}
+{"Time":"2026-10-05T15:53:15.831401+02:00","Action":"start","Package":"github.com/databricks/cli/bundle/internal/tf/codegen/schema"}
+{"Time":"2026-10-05T15:53:15.831403+02:00","Action":"output","Package":"github.com/databricks/cli/bundle/internal/tf/codegen/schema","Output":"?   \tgithub.com/databricks/cli/bundle/internal/tf/codegen/schema\t[no test files]\n"}
+{"Time":"2026-10-05T15:53:15.831403+02:00","Action":"skip","Package":"github.com/databricks/cli/bundle/internal/tf/codegen/generator","Elapsed":0}
+{"Time":"2026-10-05T15:53:15.831412+02:00","Action":"skip","Package":"github.com/databricks/cli/bundle/internal/tf/codegen/schema","Elapsed":0}
diff --git a/bundle/internal/tf/schema/config.go b/bundle/internal/tf/schema/config.go
deleted file mode 100644
index e2c68d0e2f4..00000000000
--- a/bundle/internal/tf/schema/config.go
+++ /dev/null
@@ -1,48 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type Config struct {
-	AccountId                  string   `json:"account_id,omitempty"`
-	ActionsIdTokenRequestToken string   `json:"actions_id_token_request_token,omitempty"`
-	ActionsIdTokenRequestUrl   string   `json:"actions_id_token_request_url,omitempty"`
-	Audience                   string   `json:"audience,omitempty"`
-	AuthType                   string   `json:"auth_type,omitempty"`
-	AzureClientId              string   `json:"azure_client_id,omitempty"`
-	AzureClientSecret          string   `json:"azure_client_secret,omitempty"`
-	AzureEnvironment           string   `json:"azure_environment,omitempty"`
-	AzureLoginAppId            string   `json:"azure_login_app_id,omitempty"`
-	AzureTenantId              string   `json:"azure_tenant_id,omitempty"`
-	AzureUseMsi                bool     `json:"azure_use_msi,omitempty"`
-	AzureWorkspaceResourceId   string   `json:"azure_workspace_resource_id,omitempty"`
-	ClientId                   string   `json:"client_id,omitempty"`
-	ClientSecret               string   `json:"client_secret,omitempty"`
-	Cloud                      string   `json:"cloud,omitempty"`
-	ClusterId                  string   `json:"cluster_id,omitempty"`
-	ConfigFile                 string   `json:"config_file,omitempty"`
-	DatabricksCliPath          string   `json:"databricks_cli_path,omitempty"`
-	DatabricksIdTokenFilepath  string   `json:"databricks_id_token_filepath,omitempty"`
-	DebugHeaders               bool     `json:"debug_headers,omitempty"`
-	DebugTruncateBytes         int      `json:"debug_truncate_bytes,omitempty"`
-	DisableOauthRefreshToken   bool     `json:"disable_oauth_refresh_token,omitempty"`
-	DiscoveryUrl               string   `json:"discovery_url,omitempty"`
-	ExperimentalIsUnifiedHost  bool     `json:"experimental_is_unified_host,omitempty"`
-	GoogleCredentials          string   `json:"google_credentials,omitempty"`
-	GoogleServiceAccount       string   `json:"google_service_account,omitempty"`
-	Host                       string   `json:"host,omitempty"`
-	HttpTimeoutSeconds         int      `json:"http_timeout_seconds,omitempty"`
-	MetadataServiceUrl         string   `json:"metadata_service_url,omitempty"`
-	OauthCallbackPort          int      `json:"oauth_callback_port,omitempty"`
-	OidcTokenEnv               string   `json:"oidc_token_env,omitempty"`
-	Password                   string   `json:"password,omitempty"`
-	Profile                    string   `json:"profile,omitempty"`
-	RateLimit                  int      `json:"rate_limit,omitempty"`
-	RetryTimeoutSeconds        int      `json:"retry_timeout_seconds,omitempty"`
-	Scopes                     []string `json:"scopes,omitempty"`
-	ServerlessComputeId        string   `json:"serverless_compute_id,omitempty"`
-	SkipVerify                 bool     `json:"skip_verify,omitempty"`
-	Token                      string   `json:"token,omitempty"`
-	Username                   string   `json:"username,omitempty"`
-	WarehouseId                string   `json:"warehouse_id,omitempty"`
-	WorkspaceId                string   `json:"workspace_id,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_account_federation_policies.go b/bundle/internal/tf/schema/data_source_account_federation_policies.go
deleted file mode 100644
index 32c4ab1b914..00000000000
--- a/bundle/internal/tf/schema/data_source_account_federation_policies.go
+++ /dev/null
@@ -1,28 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceAccountFederationPoliciesPoliciesOidcPolicy struct {
-	Audiences    []string `json:"audiences,omitempty"`
-	Issuer       string   `json:"issuer,omitempty"`
-	JwksJson     string   `json:"jwks_json,omitempty"`
-	JwksUri      string   `json:"jwks_uri,omitempty"`
-	Subject      string   `json:"subject,omitempty"`
-	SubjectClaim string   `json:"subject_claim,omitempty"`
-}
-
-type DataSourceAccountFederationPoliciesPolicies struct {
-	CreateTime         string                                                 `json:"create_time,omitempty"`
-	Description        string                                                 `json:"description,omitempty"`
-	Name               string                                                 `json:"name,omitempty"`
-	OidcPolicy         *DataSourceAccountFederationPoliciesPoliciesOidcPolicy `json:"oidc_policy,omitempty"`
-	PolicyId           string                                                 `json:"policy_id"`
-	ServicePrincipalId int                                                    `json:"service_principal_id,omitempty"`
-	Uid                string                                                 `json:"uid,omitempty"`
-	UpdateTime         string                                                 `json:"update_time,omitempty"`
-}
-
-type DataSourceAccountFederationPolicies struct {
-	PageSize int                                           `json:"page_size,omitempty"`
-	Policies []DataSourceAccountFederationPoliciesPolicies `json:"policies,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_account_federation_policy.go b/bundle/internal/tf/schema/data_source_account_federation_policy.go
deleted file mode 100644
index cc0b881e0aa..00000000000
--- a/bundle/internal/tf/schema/data_source_account_federation_policy.go
+++ /dev/null
@@ -1,23 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceAccountFederationPolicyOidcPolicy struct {
-	Audiences    []string `json:"audiences,omitempty"`
-	Issuer       string   `json:"issuer,omitempty"`
-	JwksJson     string   `json:"jwks_json,omitempty"`
-	JwksUri      string   `json:"jwks_uri,omitempty"`
-	Subject      string   `json:"subject,omitempty"`
-	SubjectClaim string   `json:"subject_claim,omitempty"`
-}
-
-type DataSourceAccountFederationPolicy struct {
-	CreateTime         string                                       `json:"create_time,omitempty"`
-	Description        string                                       `json:"description,omitempty"`
-	Name               string                                       `json:"name,omitempty"`
-	OidcPolicy         *DataSourceAccountFederationPolicyOidcPolicy `json:"oidc_policy,omitempty"`
-	PolicyId           string                                       `json:"policy_id"`
-	ServicePrincipalId int                                          `json:"service_principal_id,omitempty"`
-	Uid                string                                       `json:"uid,omitempty"`
-	UpdateTime         string                                       `json:"update_time,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_account_network_policies.go b/bundle/internal/tf/schema/data_source_account_network_policies.go
deleted file mode 100644
index 2d91042f2f3..00000000000
--- a/bundle/internal/tf/schema/data_source_account_network_policies.go
+++ /dev/null
@@ -1,244 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceAccountNetworkPoliciesItemsEgressNetworkAccessAllowedInternetDestinations struct {
-	Destination             string `json:"destination,omitempty"`
-	InternetDestinationType string `json:"internet_destination_type,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsEgressNetworkAccessAllowedStorageDestinations struct {
-	AzureStorageAccount    string `json:"azure_storage_account,omitempty"`
-	AzureStorageService    string `json:"azure_storage_service,omitempty"`
-	BucketName             string `json:"bucket_name,omitempty"`
-	Region                 string `json:"region,omitempty"`
-	StorageDestinationType string `json:"storage_destination_type,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsEgressNetworkAccessPolicyEnforcement struct {
-	DryRunModeProductFilter []string `json:"dry_run_mode_product_filter,omitempty"`
-	EnforcementMode         string   `json:"enforcement_mode,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsEgressNetworkAccess struct {
-	AllowedInternetDestinations []DataSourceAccountNetworkPoliciesItemsEgressNetworkAccessAllowedInternetDestinations `json:"allowed_internet_destinations,omitempty"`
-	AllowedStorageDestinations  []DataSourceAccountNetworkPoliciesItemsEgressNetworkAccessAllowedStorageDestinations  `json:"allowed_storage_destinations,omitempty"`
-	PolicyEnforcement           *DataSourceAccountNetworkPoliciesItemsEgressNetworkAccessPolicyEnforcement            `json:"policy_enforcement,omitempty"`
-	RestrictionMode             string                                                                                `json:"restriction_mode"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsEgress struct {
-	NetworkAccess *DataSourceAccountNetworkPoliciesItemsEgressNetworkAccess `json:"network_access,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngressPublicAccessAllowRulesAuthenticationIdentities struct {
-	PrincipalId   int    `json:"principal_id,omitempty"`
-	PrincipalType string `json:"principal_type,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngressPublicAccessAllowRulesAuthentication struct {
-	Identities   []DataSourceAccountNetworkPoliciesItemsIngressPublicAccessAllowRulesAuthenticationIdentities `json:"identities,omitempty"`
-	IdentityType string                                                                                       `json:"identity_type,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngressPublicAccessAllowRulesDestinationWorkspaceApi struct {
-	Scopes []string `json:"scopes,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngressPublicAccessAllowRulesDestinationWorkspaceUi struct {
-	AllDestinations bool `json:"all_destinations,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngressPublicAccessAllowRulesDestination struct {
-	AllDestinations bool                                                                                       `json:"all_destinations,omitempty"`
-	WorkspaceApi    *DataSourceAccountNetworkPoliciesItemsIngressPublicAccessAllowRulesDestinationWorkspaceApi `json:"workspace_api,omitempty"`
-	WorkspaceUi     *DataSourceAccountNetworkPoliciesItemsIngressPublicAccessAllowRulesDestinationWorkspaceUi  `json:"workspace_ui,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngressPublicAccessAllowRulesOriginExcludedIpRanges struct {
-	IpRanges []string `json:"ip_ranges,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngressPublicAccessAllowRulesOriginIncludedIpRanges struct {
-	IpRanges []string `json:"ip_ranges,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngressPublicAccessAllowRulesOrigin struct {
-	AllIpRanges      bool                                                                                      `json:"all_ip_ranges,omitempty"`
-	ExcludedIpRanges *DataSourceAccountNetworkPoliciesItemsIngressPublicAccessAllowRulesOriginExcludedIpRanges `json:"excluded_ip_ranges,omitempty"`
-	IncludedIpRanges *DataSourceAccountNetworkPoliciesItemsIngressPublicAccessAllowRulesOriginIncludedIpRanges `json:"included_ip_ranges,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngressPublicAccessAllowRules struct {
-	Authentication *DataSourceAccountNetworkPoliciesItemsIngressPublicAccessAllowRulesAuthentication `json:"authentication,omitempty"`
-	Destination    *DataSourceAccountNetworkPoliciesItemsIngressPublicAccessAllowRulesDestination    `json:"destination,omitempty"`
-	Label          string                                                                            `json:"label,omitempty"`
-	Origin         *DataSourceAccountNetworkPoliciesItemsIngressPublicAccessAllowRulesOrigin         `json:"origin,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngressPublicAccessDenyRulesAuthenticationIdentities struct {
-	PrincipalId   int    `json:"principal_id,omitempty"`
-	PrincipalType string `json:"principal_type,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngressPublicAccessDenyRulesAuthentication struct {
-	Identities   []DataSourceAccountNetworkPoliciesItemsIngressPublicAccessDenyRulesAuthenticationIdentities `json:"identities,omitempty"`
-	IdentityType string                                                                                      `json:"identity_type,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngressPublicAccessDenyRulesDestinationWorkspaceApi struct {
-	Scopes []string `json:"scopes,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngressPublicAccessDenyRulesDestinationWorkspaceUi struct {
-	AllDestinations bool `json:"all_destinations,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngressPublicAccessDenyRulesDestination struct {
-	AllDestinations bool                                                                                      `json:"all_destinations,omitempty"`
-	WorkspaceApi    *DataSourceAccountNetworkPoliciesItemsIngressPublicAccessDenyRulesDestinationWorkspaceApi `json:"workspace_api,omitempty"`
-	WorkspaceUi     *DataSourceAccountNetworkPoliciesItemsIngressPublicAccessDenyRulesDestinationWorkspaceUi  `json:"workspace_ui,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngressPublicAccessDenyRulesOriginExcludedIpRanges struct {
-	IpRanges []string `json:"ip_ranges,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngressPublicAccessDenyRulesOriginIncludedIpRanges struct {
-	IpRanges []string `json:"ip_ranges,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngressPublicAccessDenyRulesOrigin struct {
-	AllIpRanges      bool                                                                                     `json:"all_ip_ranges,omitempty"`
-	ExcludedIpRanges *DataSourceAccountNetworkPoliciesItemsIngressPublicAccessDenyRulesOriginExcludedIpRanges `json:"excluded_ip_ranges,omitempty"`
-	IncludedIpRanges *DataSourceAccountNetworkPoliciesItemsIngressPublicAccessDenyRulesOriginIncludedIpRanges `json:"included_ip_ranges,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngressPublicAccessDenyRules struct {
-	Authentication *DataSourceAccountNetworkPoliciesItemsIngressPublicAccessDenyRulesAuthentication `json:"authentication,omitempty"`
-	Destination    *DataSourceAccountNetworkPoliciesItemsIngressPublicAccessDenyRulesDestination    `json:"destination,omitempty"`
-	Label          string                                                                           `json:"label,omitempty"`
-	Origin         *DataSourceAccountNetworkPoliciesItemsIngressPublicAccessDenyRulesOrigin         `json:"origin,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngressPublicAccess struct {
-	AllowRules      []DataSourceAccountNetworkPoliciesItemsIngressPublicAccessAllowRules `json:"allow_rules,omitempty"`
-	DenyRules       []DataSourceAccountNetworkPoliciesItemsIngressPublicAccessDenyRules  `json:"deny_rules,omitempty"`
-	RestrictionMode string                                                               `json:"restriction_mode"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngress struct {
-	PublicAccess *DataSourceAccountNetworkPoliciesItemsIngressPublicAccess `json:"public_access,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngressDryRunPublicAccessAllowRulesAuthenticationIdentities struct {
-	PrincipalId   int    `json:"principal_id,omitempty"`
-	PrincipalType string `json:"principal_type,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngressDryRunPublicAccessAllowRulesAuthentication struct {
-	Identities   []DataSourceAccountNetworkPoliciesItemsIngressDryRunPublicAccessAllowRulesAuthenticationIdentities `json:"identities,omitempty"`
-	IdentityType string                                                                                             `json:"identity_type,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngressDryRunPublicAccessAllowRulesDestinationWorkspaceApi struct {
-	Scopes []string `json:"scopes,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngressDryRunPublicAccessAllowRulesDestinationWorkspaceUi struct {
-	AllDestinations bool `json:"all_destinations,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngressDryRunPublicAccessAllowRulesDestination struct {
-	AllDestinations bool                                                                                             `json:"all_destinations,omitempty"`
-	WorkspaceApi    *DataSourceAccountNetworkPoliciesItemsIngressDryRunPublicAccessAllowRulesDestinationWorkspaceApi `json:"workspace_api,omitempty"`
-	WorkspaceUi     *DataSourceAccountNetworkPoliciesItemsIngressDryRunPublicAccessAllowRulesDestinationWorkspaceUi  `json:"workspace_ui,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngressDryRunPublicAccessAllowRulesOriginExcludedIpRanges struct {
-	IpRanges []string `json:"ip_ranges,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngressDryRunPublicAccessAllowRulesOriginIncludedIpRanges struct {
-	IpRanges []string `json:"ip_ranges,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngressDryRunPublicAccessAllowRulesOrigin struct {
-	AllIpRanges      bool                                                                                            `json:"all_ip_ranges,omitempty"`
-	ExcludedIpRanges *DataSourceAccountNetworkPoliciesItemsIngressDryRunPublicAccessAllowRulesOriginExcludedIpRanges `json:"excluded_ip_ranges,omitempty"`
-	IncludedIpRanges *DataSourceAccountNetworkPoliciesItemsIngressDryRunPublicAccessAllowRulesOriginIncludedIpRanges `json:"included_ip_ranges,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngressDryRunPublicAccessAllowRules struct {
-	Authentication *DataSourceAccountNetworkPoliciesItemsIngressDryRunPublicAccessAllowRulesAuthentication `json:"authentication,omitempty"`
-	Destination    *DataSourceAccountNetworkPoliciesItemsIngressDryRunPublicAccessAllowRulesDestination    `json:"destination,omitempty"`
-	Label          string                                                                                  `json:"label,omitempty"`
-	Origin         *DataSourceAccountNetworkPoliciesItemsIngressDryRunPublicAccessAllowRulesOrigin         `json:"origin,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngressDryRunPublicAccessDenyRulesAuthenticationIdentities struct {
-	PrincipalId   int    `json:"principal_id,omitempty"`
-	PrincipalType string `json:"principal_type,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngressDryRunPublicAccessDenyRulesAuthentication struct {
-	Identities   []DataSourceAccountNetworkPoliciesItemsIngressDryRunPublicAccessDenyRulesAuthenticationIdentities `json:"identities,omitempty"`
-	IdentityType string                                                                                            `json:"identity_type,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngressDryRunPublicAccessDenyRulesDestinationWorkspaceApi struct {
-	Scopes []string `json:"scopes,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngressDryRunPublicAccessDenyRulesDestinationWorkspaceUi struct {
-	AllDestinations bool `json:"all_destinations,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngressDryRunPublicAccessDenyRulesDestination struct {
-	AllDestinations bool                                                                                            `json:"all_destinations,omitempty"`
-	WorkspaceApi    *DataSourceAccountNetworkPoliciesItemsIngressDryRunPublicAccessDenyRulesDestinationWorkspaceApi `json:"workspace_api,omitempty"`
-	WorkspaceUi     *DataSourceAccountNetworkPoliciesItemsIngressDryRunPublicAccessDenyRulesDestinationWorkspaceUi  `json:"workspace_ui,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngressDryRunPublicAccessDenyRulesOriginExcludedIpRanges struct {
-	IpRanges []string `json:"ip_ranges,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngressDryRunPublicAccessDenyRulesOriginIncludedIpRanges struct {
-	IpRanges []string `json:"ip_ranges,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngressDryRunPublicAccessDenyRulesOrigin struct {
-	AllIpRanges      bool                                                                                           `json:"all_ip_ranges,omitempty"`
-	ExcludedIpRanges *DataSourceAccountNetworkPoliciesItemsIngressDryRunPublicAccessDenyRulesOriginExcludedIpRanges `json:"excluded_ip_ranges,omitempty"`
-	IncludedIpRanges *DataSourceAccountNetworkPoliciesItemsIngressDryRunPublicAccessDenyRulesOriginIncludedIpRanges `json:"included_ip_ranges,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngressDryRunPublicAccessDenyRules struct {
-	Authentication *DataSourceAccountNetworkPoliciesItemsIngressDryRunPublicAccessDenyRulesAuthentication `json:"authentication,omitempty"`
-	Destination    *DataSourceAccountNetworkPoliciesItemsIngressDryRunPublicAccessDenyRulesDestination    `json:"destination,omitempty"`
-	Label          string                                                                                 `json:"label,omitempty"`
-	Origin         *DataSourceAccountNetworkPoliciesItemsIngressDryRunPublicAccessDenyRulesOrigin         `json:"origin,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngressDryRunPublicAccess struct {
-	AllowRules      []DataSourceAccountNetworkPoliciesItemsIngressDryRunPublicAccessAllowRules `json:"allow_rules,omitempty"`
-	DenyRules       []DataSourceAccountNetworkPoliciesItemsIngressDryRunPublicAccessDenyRules  `json:"deny_rules,omitempty"`
-	RestrictionMode string                                                                     `json:"restriction_mode"`
-}
-
-type DataSourceAccountNetworkPoliciesItemsIngressDryRun struct {
-	PublicAccess *DataSourceAccountNetworkPoliciesItemsIngressDryRunPublicAccess `json:"public_access,omitempty"`
-}
-
-type DataSourceAccountNetworkPoliciesItems struct {
-	AccountId       string                                              `json:"account_id,omitempty"`
-	Egress          *DataSourceAccountNetworkPoliciesItemsEgress        `json:"egress,omitempty"`
-	Ingress         *DataSourceAccountNetworkPoliciesItemsIngress       `json:"ingress,omitempty"`
-	IngressDryRun   *DataSourceAccountNetworkPoliciesItemsIngressDryRun `json:"ingress_dry_run,omitempty"`
-	NetworkPolicyId string                                              `json:"network_policy_id"`
-}
-
-type DataSourceAccountNetworkPolicies struct {
-	Items []DataSourceAccountNetworkPoliciesItems `json:"items,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_account_network_policy.go b/bundle/internal/tf/schema/data_source_account_network_policy.go
deleted file mode 100644
index e788484c537..00000000000
--- a/bundle/internal/tf/schema/data_source_account_network_policy.go
+++ /dev/null
@@ -1,240 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceAccountNetworkPolicyEgressNetworkAccessAllowedInternetDestinations struct {
-	Destination             string `json:"destination,omitempty"`
-	InternetDestinationType string `json:"internet_destination_type,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyEgressNetworkAccessAllowedStorageDestinations struct {
-	AzureStorageAccount    string `json:"azure_storage_account,omitempty"`
-	AzureStorageService    string `json:"azure_storage_service,omitempty"`
-	BucketName             string `json:"bucket_name,omitempty"`
-	Region                 string `json:"region,omitempty"`
-	StorageDestinationType string `json:"storage_destination_type,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyEgressNetworkAccessPolicyEnforcement struct {
-	DryRunModeProductFilter []string `json:"dry_run_mode_product_filter,omitempty"`
-	EnforcementMode         string   `json:"enforcement_mode,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyEgressNetworkAccess struct {
-	AllowedInternetDestinations []DataSourceAccountNetworkPolicyEgressNetworkAccessAllowedInternetDestinations `json:"allowed_internet_destinations,omitempty"`
-	AllowedStorageDestinations  []DataSourceAccountNetworkPolicyEgressNetworkAccessAllowedStorageDestinations  `json:"allowed_storage_destinations,omitempty"`
-	PolicyEnforcement           *DataSourceAccountNetworkPolicyEgressNetworkAccessPolicyEnforcement            `json:"policy_enforcement,omitempty"`
-	RestrictionMode             string                                                                         `json:"restriction_mode"`
-}
-
-type DataSourceAccountNetworkPolicyEgress struct {
-	NetworkAccess *DataSourceAccountNetworkPolicyEgressNetworkAccess `json:"network_access,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyIngressPublicAccessAllowRulesAuthenticationIdentities struct {
-	PrincipalId   int    `json:"principal_id,omitempty"`
-	PrincipalType string `json:"principal_type,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyIngressPublicAccessAllowRulesAuthentication struct {
-	Identities   []DataSourceAccountNetworkPolicyIngressPublicAccessAllowRulesAuthenticationIdentities `json:"identities,omitempty"`
-	IdentityType string                                                                                `json:"identity_type,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyIngressPublicAccessAllowRulesDestinationWorkspaceApi struct {
-	Scopes []string `json:"scopes,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyIngressPublicAccessAllowRulesDestinationWorkspaceUi struct {
-	AllDestinations bool `json:"all_destinations,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyIngressPublicAccessAllowRulesDestination struct {
-	AllDestinations bool                                                                                `json:"all_destinations,omitempty"`
-	WorkspaceApi    *DataSourceAccountNetworkPolicyIngressPublicAccessAllowRulesDestinationWorkspaceApi `json:"workspace_api,omitempty"`
-	WorkspaceUi     *DataSourceAccountNetworkPolicyIngressPublicAccessAllowRulesDestinationWorkspaceUi  `json:"workspace_ui,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyIngressPublicAccessAllowRulesOriginExcludedIpRanges struct {
-	IpRanges []string `json:"ip_ranges,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyIngressPublicAccessAllowRulesOriginIncludedIpRanges struct {
-	IpRanges []string `json:"ip_ranges,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyIngressPublicAccessAllowRulesOrigin struct {
-	AllIpRanges      bool                                                                               `json:"all_ip_ranges,omitempty"`
-	ExcludedIpRanges *DataSourceAccountNetworkPolicyIngressPublicAccessAllowRulesOriginExcludedIpRanges `json:"excluded_ip_ranges,omitempty"`
-	IncludedIpRanges *DataSourceAccountNetworkPolicyIngressPublicAccessAllowRulesOriginIncludedIpRanges `json:"included_ip_ranges,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyIngressPublicAccessAllowRules struct {
-	Authentication *DataSourceAccountNetworkPolicyIngressPublicAccessAllowRulesAuthentication `json:"authentication,omitempty"`
-	Destination    *DataSourceAccountNetworkPolicyIngressPublicAccessAllowRulesDestination    `json:"destination,omitempty"`
-	Label          string                                                                     `json:"label,omitempty"`
-	Origin         *DataSourceAccountNetworkPolicyIngressPublicAccessAllowRulesOrigin         `json:"origin,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyIngressPublicAccessDenyRulesAuthenticationIdentities struct {
-	PrincipalId   int    `json:"principal_id,omitempty"`
-	PrincipalType string `json:"principal_type,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyIngressPublicAccessDenyRulesAuthentication struct {
-	Identities   []DataSourceAccountNetworkPolicyIngressPublicAccessDenyRulesAuthenticationIdentities `json:"identities,omitempty"`
-	IdentityType string                                                                               `json:"identity_type,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyIngressPublicAccessDenyRulesDestinationWorkspaceApi struct {
-	Scopes []string `json:"scopes,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyIngressPublicAccessDenyRulesDestinationWorkspaceUi struct {
-	AllDestinations bool `json:"all_destinations,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyIngressPublicAccessDenyRulesDestination struct {
-	AllDestinations bool                                                                               `json:"all_destinations,omitempty"`
-	WorkspaceApi    *DataSourceAccountNetworkPolicyIngressPublicAccessDenyRulesDestinationWorkspaceApi `json:"workspace_api,omitempty"`
-	WorkspaceUi     *DataSourceAccountNetworkPolicyIngressPublicAccessDenyRulesDestinationWorkspaceUi  `json:"workspace_ui,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyIngressPublicAccessDenyRulesOriginExcludedIpRanges struct {
-	IpRanges []string `json:"ip_ranges,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyIngressPublicAccessDenyRulesOriginIncludedIpRanges struct {
-	IpRanges []string `json:"ip_ranges,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyIngressPublicAccessDenyRulesOrigin struct {
-	AllIpRanges      bool                                                                              `json:"all_ip_ranges,omitempty"`
-	ExcludedIpRanges *DataSourceAccountNetworkPolicyIngressPublicAccessDenyRulesOriginExcludedIpRanges `json:"excluded_ip_ranges,omitempty"`
-	IncludedIpRanges *DataSourceAccountNetworkPolicyIngressPublicAccessDenyRulesOriginIncludedIpRanges `json:"included_ip_ranges,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyIngressPublicAccessDenyRules struct {
-	Authentication *DataSourceAccountNetworkPolicyIngressPublicAccessDenyRulesAuthentication `json:"authentication,omitempty"`
-	Destination    *DataSourceAccountNetworkPolicyIngressPublicAccessDenyRulesDestination    `json:"destination,omitempty"`
-	Label          string                                                                    `json:"label,omitempty"`
-	Origin         *DataSourceAccountNetworkPolicyIngressPublicAccessDenyRulesOrigin         `json:"origin,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyIngressPublicAccess struct {
-	AllowRules      []DataSourceAccountNetworkPolicyIngressPublicAccessAllowRules `json:"allow_rules,omitempty"`
-	DenyRules       []DataSourceAccountNetworkPolicyIngressPublicAccessDenyRules  `json:"deny_rules,omitempty"`
-	RestrictionMode string                                                        `json:"restriction_mode"`
-}
-
-type DataSourceAccountNetworkPolicyIngress struct {
-	PublicAccess *DataSourceAccountNetworkPolicyIngressPublicAccess `json:"public_access,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyIngressDryRunPublicAccessAllowRulesAuthenticationIdentities struct {
-	PrincipalId   int    `json:"principal_id,omitempty"`
-	PrincipalType string `json:"principal_type,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyIngressDryRunPublicAccessAllowRulesAuthentication struct {
-	Identities   []DataSourceAccountNetworkPolicyIngressDryRunPublicAccessAllowRulesAuthenticationIdentities `json:"identities,omitempty"`
-	IdentityType string                                                                                      `json:"identity_type,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyIngressDryRunPublicAccessAllowRulesDestinationWorkspaceApi struct {
-	Scopes []string `json:"scopes,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyIngressDryRunPublicAccessAllowRulesDestinationWorkspaceUi struct {
-	AllDestinations bool `json:"all_destinations,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyIngressDryRunPublicAccessAllowRulesDestination struct {
-	AllDestinations bool                                                                                      `json:"all_destinations,omitempty"`
-	WorkspaceApi    *DataSourceAccountNetworkPolicyIngressDryRunPublicAccessAllowRulesDestinationWorkspaceApi `json:"workspace_api,omitempty"`
-	WorkspaceUi     *DataSourceAccountNetworkPolicyIngressDryRunPublicAccessAllowRulesDestinationWorkspaceUi  `json:"workspace_ui,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyIngressDryRunPublicAccessAllowRulesOriginExcludedIpRanges struct {
-	IpRanges []string `json:"ip_ranges,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyIngressDryRunPublicAccessAllowRulesOriginIncludedIpRanges struct {
-	IpRanges []string `json:"ip_ranges,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyIngressDryRunPublicAccessAllowRulesOrigin struct {
-	AllIpRanges      bool                                                                                     `json:"all_ip_ranges,omitempty"`
-	ExcludedIpRanges *DataSourceAccountNetworkPolicyIngressDryRunPublicAccessAllowRulesOriginExcludedIpRanges `json:"excluded_ip_ranges,omitempty"`
-	IncludedIpRanges *DataSourceAccountNetworkPolicyIngressDryRunPublicAccessAllowRulesOriginIncludedIpRanges `json:"included_ip_ranges,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyIngressDryRunPublicAccessAllowRules struct {
-	Authentication *DataSourceAccountNetworkPolicyIngressDryRunPublicAccessAllowRulesAuthentication `json:"authentication,omitempty"`
-	Destination    *DataSourceAccountNetworkPolicyIngressDryRunPublicAccessAllowRulesDestination    `json:"destination,omitempty"`
-	Label          string                                                                           `json:"label,omitempty"`
-	Origin         *DataSourceAccountNetworkPolicyIngressDryRunPublicAccessAllowRulesOrigin         `json:"origin,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyIngressDryRunPublicAccessDenyRulesAuthenticationIdentities struct {
-	PrincipalId   int    `json:"principal_id,omitempty"`
-	PrincipalType string `json:"principal_type,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyIngressDryRunPublicAccessDenyRulesAuthentication struct {
-	Identities   []DataSourceAccountNetworkPolicyIngressDryRunPublicAccessDenyRulesAuthenticationIdentities `json:"identities,omitempty"`
-	IdentityType string                                                                                     `json:"identity_type,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyIngressDryRunPublicAccessDenyRulesDestinationWorkspaceApi struct {
-	Scopes []string `json:"scopes,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyIngressDryRunPublicAccessDenyRulesDestinationWorkspaceUi struct {
-	AllDestinations bool `json:"all_destinations,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyIngressDryRunPublicAccessDenyRulesDestination struct {
-	AllDestinations bool                                                                                     `json:"all_destinations,omitempty"`
-	WorkspaceApi    *DataSourceAccountNetworkPolicyIngressDryRunPublicAccessDenyRulesDestinationWorkspaceApi `json:"workspace_api,omitempty"`
-	WorkspaceUi     *DataSourceAccountNetworkPolicyIngressDryRunPublicAccessDenyRulesDestinationWorkspaceUi  `json:"workspace_ui,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyIngressDryRunPublicAccessDenyRulesOriginExcludedIpRanges struct {
-	IpRanges []string `json:"ip_ranges,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyIngressDryRunPublicAccessDenyRulesOriginIncludedIpRanges struct {
-	IpRanges []string `json:"ip_ranges,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyIngressDryRunPublicAccessDenyRulesOrigin struct {
-	AllIpRanges      bool                                                                                    `json:"all_ip_ranges,omitempty"`
-	ExcludedIpRanges *DataSourceAccountNetworkPolicyIngressDryRunPublicAccessDenyRulesOriginExcludedIpRanges `json:"excluded_ip_ranges,omitempty"`
-	IncludedIpRanges *DataSourceAccountNetworkPolicyIngressDryRunPublicAccessDenyRulesOriginIncludedIpRanges `json:"included_ip_ranges,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyIngressDryRunPublicAccessDenyRules struct {
-	Authentication *DataSourceAccountNetworkPolicyIngressDryRunPublicAccessDenyRulesAuthentication `json:"authentication,omitempty"`
-	Destination    *DataSourceAccountNetworkPolicyIngressDryRunPublicAccessDenyRulesDestination    `json:"destination,omitempty"`
-	Label          string                                                                          `json:"label,omitempty"`
-	Origin         *DataSourceAccountNetworkPolicyIngressDryRunPublicAccessDenyRulesOrigin         `json:"origin,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicyIngressDryRunPublicAccess struct {
-	AllowRules      []DataSourceAccountNetworkPolicyIngressDryRunPublicAccessAllowRules `json:"allow_rules,omitempty"`
-	DenyRules       []DataSourceAccountNetworkPolicyIngressDryRunPublicAccessDenyRules  `json:"deny_rules,omitempty"`
-	RestrictionMode string                                                              `json:"restriction_mode"`
-}
-
-type DataSourceAccountNetworkPolicyIngressDryRun struct {
-	PublicAccess *DataSourceAccountNetworkPolicyIngressDryRunPublicAccess `json:"public_access,omitempty"`
-}
-
-type DataSourceAccountNetworkPolicy struct {
-	AccountId       string                                       `json:"account_id,omitempty"`
-	Egress          *DataSourceAccountNetworkPolicyEgress        `json:"egress,omitempty"`
-	Ingress         *DataSourceAccountNetworkPolicyIngress       `json:"ingress,omitempty"`
-	IngressDryRun   *DataSourceAccountNetworkPolicyIngressDryRun `json:"ingress_dry_run,omitempty"`
-	NetworkPolicyId string                                       `json:"network_policy_id"`
-}
diff --git a/bundle/internal/tf/schema/data_source_account_setting_user_preference_v2.go b/bundle/internal/tf/schema/data_source_account_setting_user_preference_v2.go
deleted file mode 100644
index c120211fd3a..00000000000
--- a/bundle/internal/tf/schema/data_source_account_setting_user_preference_v2.go
+++ /dev/null
@@ -1,28 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceAccountSettingUserPreferenceV2BooleanVal struct {
-	Value bool `json:"value,omitempty"`
-}
-
-type DataSourceAccountSettingUserPreferenceV2EffectiveBooleanVal struct {
-	Value bool `json:"value,omitempty"`
-}
-
-type DataSourceAccountSettingUserPreferenceV2EffectiveStringVal struct {
-	Value string `json:"value,omitempty"`
-}
-
-type DataSourceAccountSettingUserPreferenceV2StringVal struct {
-	Value string `json:"value,omitempty"`
-}
-
-type DataSourceAccountSettingUserPreferenceV2 struct {
-	BooleanVal          *DataSourceAccountSettingUserPreferenceV2BooleanVal          `json:"boolean_val,omitempty"`
-	EffectiveBooleanVal *DataSourceAccountSettingUserPreferenceV2EffectiveBooleanVal `json:"effective_boolean_val,omitempty"`
-	EffectiveStringVal  *DataSourceAccountSettingUserPreferenceV2EffectiveStringVal  `json:"effective_string_val,omitempty"`
-	Name                string                                                       `json:"name"`
-	StringVal           *DataSourceAccountSettingUserPreferenceV2StringVal           `json:"string_val,omitempty"`
-	UserId              string                                                       `json:"user_id"`
-}
diff --git a/bundle/internal/tf/schema/data_source_account_setting_v2.go b/bundle/internal/tf/schema/data_source_account_setting_v2.go
deleted file mode 100644
index 3279de8eabb..00000000000
--- a/bundle/internal/tf/schema/data_source_account_setting_v2.go
+++ /dev/null
@@ -1,139 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceAccountSettingV2AibiDashboardEmbeddingAccessPolicy struct {
-	AccessPolicyType string `json:"access_policy_type"`
-}
-
-type DataSourceAccountSettingV2AibiDashboardEmbeddingApprovedDomains struct {
-	ApprovedDomains []string `json:"approved_domains,omitempty"`
-}
-
-type DataSourceAccountSettingV2AutomaticClusterUpdateWorkspaceEnablementDetails struct {
-	ForcedForComplianceMode           bool `json:"forced_for_compliance_mode,omitempty"`
-	UnavailableForDisabledEntitlement bool `json:"unavailable_for_disabled_entitlement,omitempty"`
-	UnavailableForNonEnterpriseTier   bool `json:"unavailable_for_non_enterprise_tier,omitempty"`
-}
-
-type DataSourceAccountSettingV2AutomaticClusterUpdateWorkspaceMaintenanceWindowWeekDayBasedScheduleWindowStartTime struct {
-	Hours   int `json:"hours,omitempty"`
-	Minutes int `json:"minutes,omitempty"`
-}
-
-type DataSourceAccountSettingV2AutomaticClusterUpdateWorkspaceMaintenanceWindowWeekDayBasedSchedule struct {
-	DayOfWeek       string                                                                                                         `json:"day_of_week,omitempty"`
-	Frequency       string                                                                                                         `json:"frequency,omitempty"`
-	WindowStartTime *DataSourceAccountSettingV2AutomaticClusterUpdateWorkspaceMaintenanceWindowWeekDayBasedScheduleWindowStartTime `json:"window_start_time,omitempty"`
-}
-
-type DataSourceAccountSettingV2AutomaticClusterUpdateWorkspaceMaintenanceWindow struct {
-	WeekDayBasedSchedule *DataSourceAccountSettingV2AutomaticClusterUpdateWorkspaceMaintenanceWindowWeekDayBasedSchedule `json:"week_day_based_schedule,omitempty"`
-}
-
-type DataSourceAccountSettingV2AutomaticClusterUpdateWorkspace struct {
-	CanToggle                       bool                                                                        `json:"can_toggle,omitempty"`
-	Enabled                         bool                                                                        `json:"enabled,omitempty"`
-	EnablementDetails               *DataSourceAccountSettingV2AutomaticClusterUpdateWorkspaceEnablementDetails `json:"enablement_details,omitempty"`
-	MaintenanceWindow               *DataSourceAccountSettingV2AutomaticClusterUpdateWorkspaceMaintenanceWindow `json:"maintenance_window,omitempty"`
-	RestartEvenIfNoUpdatesAvailable bool                                                                        `json:"restart_even_if_no_updates_available,omitempty"`
-}
-
-type DataSourceAccountSettingV2BooleanVal struct {
-	Value bool `json:"value,omitempty"`
-}
-
-type DataSourceAccountSettingV2EffectiveAibiDashboardEmbeddingAccessPolicy struct {
-	AccessPolicyType string `json:"access_policy_type"`
-}
-
-type DataSourceAccountSettingV2EffectiveAibiDashboardEmbeddingApprovedDomains struct {
-	ApprovedDomains []string `json:"approved_domains,omitempty"`
-}
-
-type DataSourceAccountSettingV2EffectiveAutomaticClusterUpdateWorkspaceEnablementDetails struct {
-	ForcedForComplianceMode           bool `json:"forced_for_compliance_mode,omitempty"`
-	UnavailableForDisabledEntitlement bool `json:"unavailable_for_disabled_entitlement,omitempty"`
-	UnavailableForNonEnterpriseTier   bool `json:"unavailable_for_non_enterprise_tier,omitempty"`
-}
-
-type DataSourceAccountSettingV2EffectiveAutomaticClusterUpdateWorkspaceMaintenanceWindowWeekDayBasedScheduleWindowStartTime struct {
-	Hours   int `json:"hours,omitempty"`
-	Minutes int `json:"minutes,omitempty"`
-}
-
-type DataSourceAccountSettingV2EffectiveAutomaticClusterUpdateWorkspaceMaintenanceWindowWeekDayBasedSchedule struct {
-	DayOfWeek       string                                                                                                                  `json:"day_of_week,omitempty"`
-	Frequency       string                                                                                                                  `json:"frequency,omitempty"`
-	WindowStartTime *DataSourceAccountSettingV2EffectiveAutomaticClusterUpdateWorkspaceMaintenanceWindowWeekDayBasedScheduleWindowStartTime `json:"window_start_time,omitempty"`
-}
-
-type DataSourceAccountSettingV2EffectiveAutomaticClusterUpdateWorkspaceMaintenanceWindow struct {
-	WeekDayBasedSchedule *DataSourceAccountSettingV2EffectiveAutomaticClusterUpdateWorkspaceMaintenanceWindowWeekDayBasedSchedule `json:"week_day_based_schedule,omitempty"`
-}
-
-type DataSourceAccountSettingV2EffectiveAutomaticClusterUpdateWorkspace struct {
-	CanToggle                       bool                                                                                 `json:"can_toggle,omitempty"`
-	Enabled                         bool                                                                                 `json:"enabled,omitempty"`
-	EnablementDetails               *DataSourceAccountSettingV2EffectiveAutomaticClusterUpdateWorkspaceEnablementDetails `json:"enablement_details,omitempty"`
-	MaintenanceWindow               *DataSourceAccountSettingV2EffectiveAutomaticClusterUpdateWorkspaceMaintenanceWindow `json:"maintenance_window,omitempty"`
-	RestartEvenIfNoUpdatesAvailable bool                                                                                 `json:"restart_even_if_no_updates_available,omitempty"`
-}
-
-type DataSourceAccountSettingV2EffectiveBooleanVal struct {
-	Value bool `json:"value,omitempty"`
-}
-
-type DataSourceAccountSettingV2EffectiveIntegerVal struct {
-	Value int `json:"value,omitempty"`
-}
-
-type DataSourceAccountSettingV2EffectivePersonalCompute struct {
-	Value string `json:"value,omitempty"`
-}
-
-type DataSourceAccountSettingV2EffectiveRestrictWorkspaceAdmins struct {
-	DisableGovTagCreation bool   `json:"disable_gov_tag_creation,omitempty"`
-	Status                string `json:"status"`
-}
-
-type DataSourceAccountSettingV2EffectiveStringVal struct {
-	Value string `json:"value,omitempty"`
-}
-
-type DataSourceAccountSettingV2IntegerVal struct {
-	Value int `json:"value,omitempty"`
-}
-
-type DataSourceAccountSettingV2PersonalCompute struct {
-	Value string `json:"value,omitempty"`
-}
-
-type DataSourceAccountSettingV2RestrictWorkspaceAdmins struct {
-	DisableGovTagCreation bool   `json:"disable_gov_tag_creation,omitempty"`
-	Status                string `json:"status"`
-}
-
-type DataSourceAccountSettingV2StringVal struct {
-	Value string `json:"value,omitempty"`
-}
-
-type DataSourceAccountSettingV2 struct {
-	AibiDashboardEmbeddingAccessPolicy             *DataSourceAccountSettingV2AibiDashboardEmbeddingAccessPolicy             `json:"aibi_dashboard_embedding_access_policy,omitempty"`
-	AibiDashboardEmbeddingApprovedDomains          *DataSourceAccountSettingV2AibiDashboardEmbeddingApprovedDomains          `json:"aibi_dashboard_embedding_approved_domains,omitempty"`
-	AutomaticClusterUpdateWorkspace                *DataSourceAccountSettingV2AutomaticClusterUpdateWorkspace                `json:"automatic_cluster_update_workspace,omitempty"`
-	BooleanVal                                     *DataSourceAccountSettingV2BooleanVal                                     `json:"boolean_val,omitempty"`
-	EffectiveAibiDashboardEmbeddingAccessPolicy    *DataSourceAccountSettingV2EffectiveAibiDashboardEmbeddingAccessPolicy    `json:"effective_aibi_dashboard_embedding_access_policy,omitempty"`
-	EffectiveAibiDashboardEmbeddingApprovedDomains *DataSourceAccountSettingV2EffectiveAibiDashboardEmbeddingApprovedDomains `json:"effective_aibi_dashboard_embedding_approved_domains,omitempty"`
-	EffectiveAutomaticClusterUpdateWorkspace       *DataSourceAccountSettingV2EffectiveAutomaticClusterUpdateWorkspace       `json:"effective_automatic_cluster_update_workspace,omitempty"`
-	EffectiveBooleanVal                            *DataSourceAccountSettingV2EffectiveBooleanVal                            `json:"effective_boolean_val,omitempty"`
-	EffectiveIntegerVal                            *DataSourceAccountSettingV2EffectiveIntegerVal                            `json:"effective_integer_val,omitempty"`
-	EffectivePersonalCompute                       *DataSourceAccountSettingV2EffectivePersonalCompute                       `json:"effective_personal_compute,omitempty"`
-	EffectiveRestrictWorkspaceAdmins               *DataSourceAccountSettingV2EffectiveRestrictWorkspaceAdmins               `json:"effective_restrict_workspace_admins,omitempty"`
-	EffectiveStringVal                             *DataSourceAccountSettingV2EffectiveStringVal                             `json:"effective_string_val,omitempty"`
-	IntegerVal                                     *DataSourceAccountSettingV2IntegerVal                                     `json:"integer_val,omitempty"`
-	Name                                           string                                                                    `json:"name"`
-	PersonalCompute                                *DataSourceAccountSettingV2PersonalCompute                                `json:"personal_compute,omitempty"`
-	RestrictWorkspaceAdmins                        *DataSourceAccountSettingV2RestrictWorkspaceAdmins                        `json:"restrict_workspace_admins,omitempty"`
-	StringVal                                      *DataSourceAccountSettingV2StringVal                                      `json:"string_val,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_alert_v2.go b/bundle/internal/tf/schema/data_source_alert_v2.go
deleted file mode 100644
index 246b1f1f1dd..00000000000
--- a/bundle/internal/tf/schema/data_source_alert_v2.go
+++ /dev/null
@@ -1,89 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceAlertV2EffectiveRunAs struct {
-	ServicePrincipalName string `json:"service_principal_name,omitempty"`
-	UserName             string `json:"user_name,omitempty"`
-}
-
-type DataSourceAlertV2EvaluationNotificationSubscriptions struct {
-	DestinationId string `json:"destination_id,omitempty"`
-	UserEmail     string `json:"user_email,omitempty"`
-}
-
-type DataSourceAlertV2EvaluationNotification struct {
-	EffectiveNotifyOnOk       bool                                                   `json:"effective_notify_on_ok,omitempty"`
-	EffectiveRetriggerSeconds int                                                    `json:"effective_retrigger_seconds,omitempty"`
-	NotifyOnOk                bool                                                   `json:"notify_on_ok,omitempty"`
-	RetriggerSeconds          int                                                    `json:"retrigger_seconds,omitempty"`
-	Subscriptions             []DataSourceAlertV2EvaluationNotificationSubscriptions `json:"subscriptions,omitempty"`
-}
-
-type DataSourceAlertV2EvaluationSource struct {
-	Aggregation string `json:"aggregation,omitempty"`
-	Display     string `json:"display,omitempty"`
-	Name        string `json:"name"`
-}
-
-type DataSourceAlertV2EvaluationThresholdColumn struct {
-	Aggregation string `json:"aggregation,omitempty"`
-	Display     string `json:"display,omitempty"`
-	Name        string `json:"name"`
-}
-
-type DataSourceAlertV2EvaluationThresholdValue struct {
-	BoolValue   bool    `json:"bool_value,omitempty"`
-	DoubleValue float64 `json:"double_value,omitempty"`
-	StringValue string  `json:"string_value,omitempty"`
-}
-
-type DataSourceAlertV2EvaluationThreshold struct {
-	Column *DataSourceAlertV2EvaluationThresholdColumn `json:"column,omitempty"`
-	Value  *DataSourceAlertV2EvaluationThresholdValue  `json:"value,omitempty"`
-}
-
-type DataSourceAlertV2Evaluation struct {
-	ComparisonOperator string                                   `json:"comparison_operator"`
-	EmptyResultState   string                                   `json:"empty_result_state,omitempty"`
-	LastEvaluatedAt    string                                   `json:"last_evaluated_at,omitempty"`
-	Notification       *DataSourceAlertV2EvaluationNotification `json:"notification,omitempty"`
-	Source             *DataSourceAlertV2EvaluationSource       `json:"source,omitempty"`
-	State              string                                   `json:"state,omitempty"`
-	Threshold          *DataSourceAlertV2EvaluationThreshold    `json:"threshold,omitempty"`
-}
-
-type DataSourceAlertV2ProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceAlertV2RunAs struct {
-	ServicePrincipalName string `json:"service_principal_name,omitempty"`
-	UserName             string `json:"user_name,omitempty"`
-}
-
-type DataSourceAlertV2Schedule struct {
-	PauseStatus        string `json:"pause_status,omitempty"`
-	QuartzCronSchedule string `json:"quartz_cron_schedule"`
-	TimezoneId         string `json:"timezone_id"`
-}
-
-type DataSourceAlertV2 struct {
-	CreateTime        string                           `json:"create_time,omitempty"`
-	CustomDescription string                           `json:"custom_description,omitempty"`
-	CustomSummary     string                           `json:"custom_summary,omitempty"`
-	DisplayName       string                           `json:"display_name,omitempty"`
-	EffectiveRunAs    *DataSourceAlertV2EffectiveRunAs `json:"effective_run_as,omitempty"`
-	Evaluation        *DataSourceAlertV2Evaluation     `json:"evaluation,omitempty"`
-	Id                string                           `json:"id"`
-	LifecycleState    string                           `json:"lifecycle_state,omitempty"`
-	OwnerUserName     string                           `json:"owner_user_name,omitempty"`
-	ParentPath        string                           `json:"parent_path,omitempty"`
-	ProviderConfig    *DataSourceAlertV2ProviderConfig `json:"provider_config,omitempty"`
-	QueryText         string                           `json:"query_text,omitempty"`
-	RunAs             *DataSourceAlertV2RunAs          `json:"run_as,omitempty"`
-	RunAsUserName     string                           `json:"run_as_user_name,omitempty"`
-	Schedule          *DataSourceAlertV2Schedule       `json:"schedule,omitempty"`
-	UpdateTime        string                           `json:"update_time,omitempty"`
-	WarehouseId       string                           `json:"warehouse_id,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_alerts_v2.go b/bundle/internal/tf/schema/data_source_alerts_v2.go
deleted file mode 100644
index b24581aefe4..00000000000
--- a/bundle/internal/tf/schema/data_source_alerts_v2.go
+++ /dev/null
@@ -1,99 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceAlertsV2AlertsEffectiveRunAs struct {
-	ServicePrincipalName string `json:"service_principal_name,omitempty"`
-	UserName             string `json:"user_name,omitempty"`
-}
-
-type DataSourceAlertsV2AlertsEvaluationNotificationSubscriptions struct {
-	DestinationId string `json:"destination_id,omitempty"`
-	UserEmail     string `json:"user_email,omitempty"`
-}
-
-type DataSourceAlertsV2AlertsEvaluationNotification struct {
-	EffectiveNotifyOnOk       bool                                                          `json:"effective_notify_on_ok,omitempty"`
-	EffectiveRetriggerSeconds int                                                           `json:"effective_retrigger_seconds,omitempty"`
-	NotifyOnOk                bool                                                          `json:"notify_on_ok,omitempty"`
-	RetriggerSeconds          int                                                           `json:"retrigger_seconds,omitempty"`
-	Subscriptions             []DataSourceAlertsV2AlertsEvaluationNotificationSubscriptions `json:"subscriptions,omitempty"`
-}
-
-type DataSourceAlertsV2AlertsEvaluationSource struct {
-	Aggregation string `json:"aggregation,omitempty"`
-	Display     string `json:"display,omitempty"`
-	Name        string `json:"name"`
-}
-
-type DataSourceAlertsV2AlertsEvaluationThresholdColumn struct {
-	Aggregation string `json:"aggregation,omitempty"`
-	Display     string `json:"display,omitempty"`
-	Name        string `json:"name"`
-}
-
-type DataSourceAlertsV2AlertsEvaluationThresholdValue struct {
-	BoolValue   bool   `json:"bool_value,omitempty"`
-	DoubleValue int    `json:"double_value,omitempty"`
-	StringValue string `json:"string_value,omitempty"`
-}
-
-type DataSourceAlertsV2AlertsEvaluationThreshold struct {
-	Column *DataSourceAlertsV2AlertsEvaluationThresholdColumn `json:"column,omitempty"`
-	Value  *DataSourceAlertsV2AlertsEvaluationThresholdValue  `json:"value,omitempty"`
-}
-
-type DataSourceAlertsV2AlertsEvaluation struct {
-	ComparisonOperator string                                          `json:"comparison_operator"`
-	EmptyResultState   string                                          `json:"empty_result_state,omitempty"`
-	LastEvaluatedAt    string                                          `json:"last_evaluated_at,omitempty"`
-	Notification       *DataSourceAlertsV2AlertsEvaluationNotification `json:"notification,omitempty"`
-	Source             *DataSourceAlertsV2AlertsEvaluationSource       `json:"source,omitempty"`
-	State              string                                          `json:"state,omitempty"`
-	Threshold          *DataSourceAlertsV2AlertsEvaluationThreshold    `json:"threshold,omitempty"`
-}
-
-type DataSourceAlertsV2AlertsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceAlertsV2AlertsRunAs struct {
-	ServicePrincipalName string `json:"service_principal_name,omitempty"`
-	UserName             string `json:"user_name,omitempty"`
-}
-
-type DataSourceAlertsV2AlertsSchedule struct {
-	PauseStatus        string `json:"pause_status,omitempty"`
-	QuartzCronSchedule string `json:"quartz_cron_schedule"`
-	TimezoneId         string `json:"timezone_id"`
-}
-
-type DataSourceAlertsV2Alerts struct {
-	CreateTime        string                                  `json:"create_time,omitempty"`
-	CustomDescription string                                  `json:"custom_description,omitempty"`
-	CustomSummary     string                                  `json:"custom_summary,omitempty"`
-	DisplayName       string                                  `json:"display_name,omitempty"`
-	EffectiveRunAs    *DataSourceAlertsV2AlertsEffectiveRunAs `json:"effective_run_as,omitempty"`
-	Evaluation        *DataSourceAlertsV2AlertsEvaluation     `json:"evaluation,omitempty"`
-	Id                string                                  `json:"id"`
-	LifecycleState    string                                  `json:"lifecycle_state,omitempty"`
-	OwnerUserName     string                                  `json:"owner_user_name,omitempty"`
-	ParentPath        string                                  `json:"parent_path,omitempty"`
-	ProviderConfig    *DataSourceAlertsV2AlertsProviderConfig `json:"provider_config,omitempty"`
-	QueryText         string                                  `json:"query_text,omitempty"`
-	RunAs             *DataSourceAlertsV2AlertsRunAs          `json:"run_as,omitempty"`
-	RunAsUserName     string                                  `json:"run_as_user_name,omitempty"`
-	Schedule          *DataSourceAlertsV2AlertsSchedule       `json:"schedule,omitempty"`
-	UpdateTime        string                                  `json:"update_time,omitempty"`
-	WarehouseId       string                                  `json:"warehouse_id,omitempty"`
-}
-
-type DataSourceAlertsV2ProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceAlertsV2 struct {
-	Alerts         []DataSourceAlertsV2Alerts        `json:"alerts,omitempty"`
-	PageSize       int                               `json:"page_size,omitempty"`
-	ProviderConfig *DataSourceAlertsV2ProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_app.go b/bundle/internal/tf/schema/data_source_app.go
deleted file mode 100644
index 3c3df220cbd..00000000000
--- a/bundle/internal/tf/schema/data_source_app.go
+++ /dev/null
@@ -1,228 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceAppAppActiveDeploymentDeploymentArtifacts struct {
-	SourceCodePath string `json:"source_code_path,omitempty"`
-}
-
-type DataSourceAppAppActiveDeploymentEnvVars struct {
-	Name      string `json:"name,omitempty"`
-	Value     string `json:"value,omitempty"`
-	ValueFrom string `json:"value_from,omitempty"`
-}
-
-type DataSourceAppAppActiveDeploymentGitSourceGitRepository struct {
-	Provider string `json:"provider"`
-	Url      string `json:"url"`
-}
-
-type DataSourceAppAppActiveDeploymentGitSource struct {
-	Branch         string                                                  `json:"branch,omitempty"`
-	Commit         string                                                  `json:"commit,omitempty"`
-	GitRepository  *DataSourceAppAppActiveDeploymentGitSourceGitRepository `json:"git_repository,omitempty"`
-	ResolvedCommit string                                                  `json:"resolved_commit,omitempty"`
-	SourceCodePath string                                                  `json:"source_code_path,omitempty"`
-	Tag            string                                                  `json:"tag,omitempty"`
-}
-
-type DataSourceAppAppActiveDeploymentStatus struct {
-	Message string `json:"message,omitempty"`
-	State   string `json:"state,omitempty"`
-}
-
-type DataSourceAppAppActiveDeployment struct {
-	Command             []string                                             `json:"command,omitempty"`
-	CreateTime          string                                               `json:"create_time,omitempty"`
-	Creator             string                                               `json:"creator,omitempty"`
-	DeploymentArtifacts *DataSourceAppAppActiveDeploymentDeploymentArtifacts `json:"deployment_artifacts,omitempty"`
-	DeploymentId        string                                               `json:"deployment_id,omitempty"`
-	EnvVars             []DataSourceAppAppActiveDeploymentEnvVars            `json:"env_vars,omitempty"`
-	GitSource           *DataSourceAppAppActiveDeploymentGitSource           `json:"git_source,omitempty"`
-	Mode                string                                               `json:"mode,omitempty"`
-	SourceCodePath      string                                               `json:"source_code_path,omitempty"`
-	Status              *DataSourceAppAppActiveDeploymentStatus              `json:"status,omitempty"`
-	UpdateTime          string                                               `json:"update_time,omitempty"`
-}
-
-type DataSourceAppAppAppStatus struct {
-	Message string `json:"message,omitempty"`
-	State   string `json:"state,omitempty"`
-}
-
-type DataSourceAppAppComputeStatus struct {
-	ActiveInstances int    `json:"active_instances,omitempty"`
-	Message         string `json:"message,omitempty"`
-	State           string `json:"state,omitempty"`
-}
-
-type DataSourceAppAppGitRepository struct {
-	Provider string `json:"provider"`
-	Url      string `json:"url"`
-}
-
-type DataSourceAppAppPendingDeploymentDeploymentArtifacts struct {
-	SourceCodePath string `json:"source_code_path,omitempty"`
-}
-
-type DataSourceAppAppPendingDeploymentEnvVars struct {
-	Name      string `json:"name,omitempty"`
-	Value     string `json:"value,omitempty"`
-	ValueFrom string `json:"value_from,omitempty"`
-}
-
-type DataSourceAppAppPendingDeploymentGitSourceGitRepository struct {
-	Provider string `json:"provider"`
-	Url      string `json:"url"`
-}
-
-type DataSourceAppAppPendingDeploymentGitSource struct {
-	Branch         string                                                   `json:"branch,omitempty"`
-	Commit         string                                                   `json:"commit,omitempty"`
-	GitRepository  *DataSourceAppAppPendingDeploymentGitSourceGitRepository `json:"git_repository,omitempty"`
-	ResolvedCommit string                                                   `json:"resolved_commit,omitempty"`
-	SourceCodePath string                                                   `json:"source_code_path,omitempty"`
-	Tag            string                                                   `json:"tag,omitempty"`
-}
-
-type DataSourceAppAppPendingDeploymentStatus struct {
-	Message string `json:"message,omitempty"`
-	State   string `json:"state,omitempty"`
-}
-
-type DataSourceAppAppPendingDeployment struct {
-	Command             []string                                              `json:"command,omitempty"`
-	CreateTime          string                                                `json:"create_time,omitempty"`
-	Creator             string                                                `json:"creator,omitempty"`
-	DeploymentArtifacts *DataSourceAppAppPendingDeploymentDeploymentArtifacts `json:"deployment_artifacts,omitempty"`
-	DeploymentId        string                                                `json:"deployment_id,omitempty"`
-	EnvVars             []DataSourceAppAppPendingDeploymentEnvVars            `json:"env_vars,omitempty"`
-	GitSource           *DataSourceAppAppPendingDeploymentGitSource           `json:"git_source,omitempty"`
-	Mode                string                                                `json:"mode,omitempty"`
-	SourceCodePath      string                                                `json:"source_code_path,omitempty"`
-	Status              *DataSourceAppAppPendingDeploymentStatus              `json:"status,omitempty"`
-	UpdateTime          string                                                `json:"update_time,omitempty"`
-}
-
-type DataSourceAppAppResourcesApp struct {
-	Name       string `json:"name,omitempty"`
-	Permission string `json:"permission,omitempty"`
-}
-
-type DataSourceAppAppResourcesDatabase struct {
-	DatabaseName string `json:"database_name"`
-	InstanceName string `json:"instance_name"`
-	Permission   string `json:"permission"`
-}
-
-type DataSourceAppAppResourcesExperiment struct {
-	ExperimentId string `json:"experiment_id"`
-	Permission   string `json:"permission"`
-}
-
-type DataSourceAppAppResourcesGenieSpace struct {
-	Name       string `json:"name"`
-	Permission string `json:"permission"`
-	SpaceId    string `json:"space_id"`
-}
-
-type DataSourceAppAppResourcesJob struct {
-	Id         string `json:"id"`
-	Permission string `json:"permission"`
-}
-
-type DataSourceAppAppResourcesPostgres struct {
-	Branch     string `json:"branch,omitempty"`
-	Database   string `json:"database,omitempty"`
-	Permission string `json:"permission,omitempty"`
-}
-
-type DataSourceAppAppResourcesSecret struct {
-	Key        string `json:"key"`
-	Permission string `json:"permission"`
-	Scope      string `json:"scope"`
-}
-
-type DataSourceAppAppResourcesServingEndpoint struct {
-	Name       string `json:"name"`
-	Permission string `json:"permission"`
-}
-
-type DataSourceAppAppResourcesSqlWarehouse struct {
-	Id         string `json:"id"`
-	Permission string `json:"permission"`
-}
-
-type DataSourceAppAppResourcesUcSecurable struct {
-	Permission        string `json:"permission"`
-	SecurableFullName string `json:"securable_full_name"`
-	SecurableKind     string `json:"securable_kind,omitempty"`
-	SecurableType     string `json:"securable_type"`
-}
-
-type DataSourceAppAppResources struct {
-	App             *DataSourceAppAppResourcesApp             `json:"app,omitempty"`
-	Database        *DataSourceAppAppResourcesDatabase        `json:"database,omitempty"`
-	Description     string                                    `json:"description,omitempty"`
-	Experiment      *DataSourceAppAppResourcesExperiment      `json:"experiment,omitempty"`
-	GenieSpace      *DataSourceAppAppResourcesGenieSpace      `json:"genie_space,omitempty"`
-	Job             *DataSourceAppAppResourcesJob             `json:"job,omitempty"`
-	Name            string                                    `json:"name"`
-	Postgres        *DataSourceAppAppResourcesPostgres        `json:"postgres,omitempty"`
-	Secret          *DataSourceAppAppResourcesSecret          `json:"secret,omitempty"`
-	ServingEndpoint *DataSourceAppAppResourcesServingEndpoint `json:"serving_endpoint,omitempty"`
-	SqlWarehouse    *DataSourceAppAppResourcesSqlWarehouse    `json:"sql_warehouse,omitempty"`
-	UcSecurable     *DataSourceAppAppResourcesUcSecurable     `json:"uc_securable,omitempty"`
-}
-
-type DataSourceAppAppTelemetryExportDestinationsUnityCatalog struct {
-	LogsTable    string `json:"logs_table"`
-	MetricsTable string `json:"metrics_table"`
-	TracesTable  string `json:"traces_table"`
-}
-
-type DataSourceAppAppTelemetryExportDestinations struct {
-	UnityCatalog *DataSourceAppAppTelemetryExportDestinationsUnityCatalog `json:"unity_catalog,omitempty"`
-}
-
-type DataSourceAppApp struct {
-	ActiveDeployment            *DataSourceAppAppActiveDeployment             `json:"active_deployment,omitempty"`
-	AppStatus                   *DataSourceAppAppAppStatus                    `json:"app_status,omitempty"`
-	BudgetPolicyId              string                                        `json:"budget_policy_id,omitempty"`
-	ComputeSize                 string                                        `json:"compute_size,omitempty"`
-	ComputeStatus               *DataSourceAppAppComputeStatus                `json:"compute_status,omitempty"`
-	CreateTime                  string                                        `json:"create_time,omitempty"`
-	Creator                     string                                        `json:"creator,omitempty"`
-	DefaultSourceCodePath       string                                        `json:"default_source_code_path,omitempty"`
-	Description                 string                                        `json:"description,omitempty"`
-	EffectiveBudgetPolicyId     string                                        `json:"effective_budget_policy_id,omitempty"`
-	EffectiveUsagePolicyId      string                                        `json:"effective_usage_policy_id,omitempty"`
-	EffectiveUserApiScopes      []string                                      `json:"effective_user_api_scopes,omitempty"`
-	GitRepository               *DataSourceAppAppGitRepository                `json:"git_repository,omitempty"`
-	Id                          string                                        `json:"id,omitempty"`
-	Name                        string                                        `json:"name"`
-	Oauth2AppClientId           string                                        `json:"oauth2_app_client_id,omitempty"`
-	Oauth2AppIntegrationId      string                                        `json:"oauth2_app_integration_id,omitempty"`
-	PendingDeployment           *DataSourceAppAppPendingDeployment            `json:"pending_deployment,omitempty"`
-	Resources                   []DataSourceAppAppResources                   `json:"resources,omitempty"`
-	ServicePrincipalClientId    string                                        `json:"service_principal_client_id,omitempty"`
-	ServicePrincipalId          int                                           `json:"service_principal_id,omitempty"`
-	ServicePrincipalName        string                                        `json:"service_principal_name,omitempty"`
-	Space                       string                                        `json:"space,omitempty"`
-	TelemetryExportDestinations []DataSourceAppAppTelemetryExportDestinations `json:"telemetry_export_destinations,omitempty"`
-	UpdateTime                  string                                        `json:"update_time,omitempty"`
-	Updater                     string                                        `json:"updater,omitempty"`
-	Url                         string                                        `json:"url,omitempty"`
-	UsagePolicyId               string                                        `json:"usage_policy_id,omitempty"`
-	UserApiScopes               []string                                      `json:"user_api_scopes,omitempty"`
-}
-
-type DataSourceAppProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceApp struct {
-	App            *DataSourceAppApp            `json:"app,omitempty"`
-	Name           string                       `json:"name"`
-	ProviderConfig *DataSourceAppProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_app_space.go b/bundle/internal/tf/schema/data_source_app_space.go
deleted file mode 100644
index 3a1e124d5ce..00000000000
--- a/bundle/internal/tf/schema/data_source_app_space.go
+++ /dev/null
@@ -1,103 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceAppSpaceProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceAppSpaceResourcesApp struct {
-	Name       string `json:"name,omitempty"`
-	Permission string `json:"permission,omitempty"`
-}
-
-type DataSourceAppSpaceResourcesDatabase struct {
-	DatabaseName string `json:"database_name"`
-	InstanceName string `json:"instance_name"`
-	Permission   string `json:"permission"`
-}
-
-type DataSourceAppSpaceResourcesExperiment struct {
-	ExperimentId string `json:"experiment_id"`
-	Permission   string `json:"permission"`
-}
-
-type DataSourceAppSpaceResourcesGenieSpace struct {
-	Name       string `json:"name"`
-	Permission string `json:"permission"`
-	SpaceId    string `json:"space_id"`
-}
-
-type DataSourceAppSpaceResourcesJob struct {
-	Id         string `json:"id"`
-	Permission string `json:"permission"`
-}
-
-type DataSourceAppSpaceResourcesPostgres struct {
-	Branch     string `json:"branch,omitempty"`
-	Database   string `json:"database,omitempty"`
-	Permission string `json:"permission,omitempty"`
-}
-
-type DataSourceAppSpaceResourcesSecret struct {
-	Key        string `json:"key"`
-	Permission string `json:"permission"`
-	Scope      string `json:"scope"`
-}
-
-type DataSourceAppSpaceResourcesServingEndpoint struct {
-	Name       string `json:"name"`
-	Permission string `json:"permission"`
-}
-
-type DataSourceAppSpaceResourcesSqlWarehouse struct {
-	Id         string `json:"id"`
-	Permission string `json:"permission"`
-}
-
-type DataSourceAppSpaceResourcesUcSecurable struct {
-	Permission        string `json:"permission"`
-	SecurableFullName string `json:"securable_full_name"`
-	SecurableKind     string `json:"securable_kind,omitempty"`
-	SecurableType     string `json:"securable_type"`
-}
-
-type DataSourceAppSpaceResources struct {
-	App             *DataSourceAppSpaceResourcesApp             `json:"app,omitempty"`
-	Database        *DataSourceAppSpaceResourcesDatabase        `json:"database,omitempty"`
-	Description     string                                      `json:"description,omitempty"`
-	Experiment      *DataSourceAppSpaceResourcesExperiment      `json:"experiment,omitempty"`
-	GenieSpace      *DataSourceAppSpaceResourcesGenieSpace      `json:"genie_space,omitempty"`
-	Job             *DataSourceAppSpaceResourcesJob             `json:"job,omitempty"`
-	Name            string                                      `json:"name"`
-	Postgres        *DataSourceAppSpaceResourcesPostgres        `json:"postgres,omitempty"`
-	Secret          *DataSourceAppSpaceResourcesSecret          `json:"secret,omitempty"`
-	ServingEndpoint *DataSourceAppSpaceResourcesServingEndpoint `json:"serving_endpoint,omitempty"`
-	SqlWarehouse    *DataSourceAppSpaceResourcesSqlWarehouse    `json:"sql_warehouse,omitempty"`
-	UcSecurable     *DataSourceAppSpaceResourcesUcSecurable     `json:"uc_securable,omitempty"`
-}
-
-type DataSourceAppSpaceStatus struct {
-	Message string `json:"message,omitempty"`
-	State   string `json:"state,omitempty"`
-}
-
-type DataSourceAppSpace struct {
-	CreateTime               string                            `json:"create_time,omitempty"`
-	Creator                  string                            `json:"creator,omitempty"`
-	Description              string                            `json:"description,omitempty"`
-	EffectiveUsagePolicyId   string                            `json:"effective_usage_policy_id,omitempty"`
-	EffectiveUserApiScopes   []string                          `json:"effective_user_api_scopes,omitempty"`
-	Id                       string                            `json:"id,omitempty"`
-	Name                     string                            `json:"name"`
-	ProviderConfig           *DataSourceAppSpaceProviderConfig `json:"provider_config,omitempty"`
-	Resources                []DataSourceAppSpaceResources     `json:"resources,omitempty"`
-	ServicePrincipalClientId string                            `json:"service_principal_client_id,omitempty"`
-	ServicePrincipalId       int                               `json:"service_principal_id,omitempty"`
-	ServicePrincipalName     string                            `json:"service_principal_name,omitempty"`
-	Status                   *DataSourceAppSpaceStatus         `json:"status,omitempty"`
-	UpdateTime               string                            `json:"update_time,omitempty"`
-	Updater                  string                            `json:"updater,omitempty"`
-	UsagePolicyId            string                            `json:"usage_policy_id,omitempty"`
-	UserApiScopes            []string                          `json:"user_api_scopes,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_app_spaces.go b/bundle/internal/tf/schema/data_source_app_spaces.go
deleted file mode 100644
index a00255ad025..00000000000
--- a/bundle/internal/tf/schema/data_source_app_spaces.go
+++ /dev/null
@@ -1,113 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceAppSpacesProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceAppSpacesSpacesProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceAppSpacesSpacesResourcesApp struct {
-	Name       string `json:"name,omitempty"`
-	Permission string `json:"permission,omitempty"`
-}
-
-type DataSourceAppSpacesSpacesResourcesDatabase struct {
-	DatabaseName string `json:"database_name"`
-	InstanceName string `json:"instance_name"`
-	Permission   string `json:"permission"`
-}
-
-type DataSourceAppSpacesSpacesResourcesExperiment struct {
-	ExperimentId string `json:"experiment_id"`
-	Permission   string `json:"permission"`
-}
-
-type DataSourceAppSpacesSpacesResourcesGenieSpace struct {
-	Name       string `json:"name"`
-	Permission string `json:"permission"`
-	SpaceId    string `json:"space_id"`
-}
-
-type DataSourceAppSpacesSpacesResourcesJob struct {
-	Id         string `json:"id"`
-	Permission string `json:"permission"`
-}
-
-type DataSourceAppSpacesSpacesResourcesPostgres struct {
-	Branch     string `json:"branch,omitempty"`
-	Database   string `json:"database,omitempty"`
-	Permission string `json:"permission,omitempty"`
-}
-
-type DataSourceAppSpacesSpacesResourcesSecret struct {
-	Key        string `json:"key"`
-	Permission string `json:"permission"`
-	Scope      string `json:"scope"`
-}
-
-type DataSourceAppSpacesSpacesResourcesServingEndpoint struct {
-	Name       string `json:"name"`
-	Permission string `json:"permission"`
-}
-
-type DataSourceAppSpacesSpacesResourcesSqlWarehouse struct {
-	Id         string `json:"id"`
-	Permission string `json:"permission"`
-}
-
-type DataSourceAppSpacesSpacesResourcesUcSecurable struct {
-	Permission        string `json:"permission"`
-	SecurableFullName string `json:"securable_full_name"`
-	SecurableKind     string `json:"securable_kind,omitempty"`
-	SecurableType     string `json:"securable_type"`
-}
-
-type DataSourceAppSpacesSpacesResources struct {
-	App             *DataSourceAppSpacesSpacesResourcesApp             `json:"app,omitempty"`
-	Database        *DataSourceAppSpacesSpacesResourcesDatabase        `json:"database,omitempty"`
-	Description     string                                             `json:"description,omitempty"`
-	Experiment      *DataSourceAppSpacesSpacesResourcesExperiment      `json:"experiment,omitempty"`
-	GenieSpace      *DataSourceAppSpacesSpacesResourcesGenieSpace      `json:"genie_space,omitempty"`
-	Job             *DataSourceAppSpacesSpacesResourcesJob             `json:"job,omitempty"`
-	Name            string                                             `json:"name"`
-	Postgres        *DataSourceAppSpacesSpacesResourcesPostgres        `json:"postgres,omitempty"`
-	Secret          *DataSourceAppSpacesSpacesResourcesSecret          `json:"secret,omitempty"`
-	ServingEndpoint *DataSourceAppSpacesSpacesResourcesServingEndpoint `json:"serving_endpoint,omitempty"`
-	SqlWarehouse    *DataSourceAppSpacesSpacesResourcesSqlWarehouse    `json:"sql_warehouse,omitempty"`
-	UcSecurable     *DataSourceAppSpacesSpacesResourcesUcSecurable     `json:"uc_securable,omitempty"`
-}
-
-type DataSourceAppSpacesSpacesStatus struct {
-	Message string `json:"message,omitempty"`
-	State   string `json:"state,omitempty"`
-}
-
-type DataSourceAppSpacesSpaces struct {
-	CreateTime               string                                   `json:"create_time,omitempty"`
-	Creator                  string                                   `json:"creator,omitempty"`
-	Description              string                                   `json:"description,omitempty"`
-	EffectiveUsagePolicyId   string                                   `json:"effective_usage_policy_id,omitempty"`
-	EffectiveUserApiScopes   []string                                 `json:"effective_user_api_scopes,omitempty"`
-	Id                       string                                   `json:"id,omitempty"`
-	Name                     string                                   `json:"name"`
-	ProviderConfig           *DataSourceAppSpacesSpacesProviderConfig `json:"provider_config,omitempty"`
-	Resources                []DataSourceAppSpacesSpacesResources     `json:"resources,omitempty"`
-	ServicePrincipalClientId string                                   `json:"service_principal_client_id,omitempty"`
-	ServicePrincipalId       int                                      `json:"service_principal_id,omitempty"`
-	ServicePrincipalName     string                                   `json:"service_principal_name,omitempty"`
-	Status                   *DataSourceAppSpacesSpacesStatus         `json:"status,omitempty"`
-	UpdateTime               string                                   `json:"update_time,omitempty"`
-	Updater                  string                                   `json:"updater,omitempty"`
-	UsagePolicyId            string                                   `json:"usage_policy_id,omitempty"`
-	UserApiScopes            []string                                 `json:"user_api_scopes,omitempty"`
-}
-
-type DataSourceAppSpaces struct {
-	PageSize       int                                `json:"page_size,omitempty"`
-	ProviderConfig *DataSourceAppSpacesProviderConfig `json:"provider_config,omitempty"`
-	Spaces         []DataSourceAppSpacesSpaces        `json:"spaces,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_apps.go b/bundle/internal/tf/schema/data_source_apps.go
deleted file mode 100644
index 9f775036f84..00000000000
--- a/bundle/internal/tf/schema/data_source_apps.go
+++ /dev/null
@@ -1,227 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceAppsAppActiveDeploymentDeploymentArtifacts struct {
-	SourceCodePath string `json:"source_code_path,omitempty"`
-}
-
-type DataSourceAppsAppActiveDeploymentEnvVars struct {
-	Name      string `json:"name,omitempty"`
-	Value     string `json:"value,omitempty"`
-	ValueFrom string `json:"value_from,omitempty"`
-}
-
-type DataSourceAppsAppActiveDeploymentGitSourceGitRepository struct {
-	Provider string `json:"provider"`
-	Url      string `json:"url"`
-}
-
-type DataSourceAppsAppActiveDeploymentGitSource struct {
-	Branch         string                                                   `json:"branch,omitempty"`
-	Commit         string                                                   `json:"commit,omitempty"`
-	GitRepository  *DataSourceAppsAppActiveDeploymentGitSourceGitRepository `json:"git_repository,omitempty"`
-	ResolvedCommit string                                                   `json:"resolved_commit,omitempty"`
-	SourceCodePath string                                                   `json:"source_code_path,omitempty"`
-	Tag            string                                                   `json:"tag,omitempty"`
-}
-
-type DataSourceAppsAppActiveDeploymentStatus struct {
-	Message string `json:"message,omitempty"`
-	State   string `json:"state,omitempty"`
-}
-
-type DataSourceAppsAppActiveDeployment struct {
-	Command             []string                                              `json:"command,omitempty"`
-	CreateTime          string                                                `json:"create_time,omitempty"`
-	Creator             string                                                `json:"creator,omitempty"`
-	DeploymentArtifacts *DataSourceAppsAppActiveDeploymentDeploymentArtifacts `json:"deployment_artifacts,omitempty"`
-	DeploymentId        string                                                `json:"deployment_id,omitempty"`
-	EnvVars             []DataSourceAppsAppActiveDeploymentEnvVars            `json:"env_vars,omitempty"`
-	GitSource           *DataSourceAppsAppActiveDeploymentGitSource           `json:"git_source,omitempty"`
-	Mode                string                                                `json:"mode,omitempty"`
-	SourceCodePath      string                                                `json:"source_code_path,omitempty"`
-	Status              *DataSourceAppsAppActiveDeploymentStatus              `json:"status,omitempty"`
-	UpdateTime          string                                                `json:"update_time,omitempty"`
-}
-
-type DataSourceAppsAppAppStatus struct {
-	Message string `json:"message,omitempty"`
-	State   string `json:"state,omitempty"`
-}
-
-type DataSourceAppsAppComputeStatus struct {
-	ActiveInstances int    `json:"active_instances,omitempty"`
-	Message         string `json:"message,omitempty"`
-	State           string `json:"state,omitempty"`
-}
-
-type DataSourceAppsAppGitRepository struct {
-	Provider string `json:"provider"`
-	Url      string `json:"url"`
-}
-
-type DataSourceAppsAppPendingDeploymentDeploymentArtifacts struct {
-	SourceCodePath string `json:"source_code_path,omitempty"`
-}
-
-type DataSourceAppsAppPendingDeploymentEnvVars struct {
-	Name      string `json:"name,omitempty"`
-	Value     string `json:"value,omitempty"`
-	ValueFrom string `json:"value_from,omitempty"`
-}
-
-type DataSourceAppsAppPendingDeploymentGitSourceGitRepository struct {
-	Provider string `json:"provider"`
-	Url      string `json:"url"`
-}
-
-type DataSourceAppsAppPendingDeploymentGitSource struct {
-	Branch         string                                                    `json:"branch,omitempty"`
-	Commit         string                                                    `json:"commit,omitempty"`
-	GitRepository  *DataSourceAppsAppPendingDeploymentGitSourceGitRepository `json:"git_repository,omitempty"`
-	ResolvedCommit string                                                    `json:"resolved_commit,omitempty"`
-	SourceCodePath string                                                    `json:"source_code_path,omitempty"`
-	Tag            string                                                    `json:"tag,omitempty"`
-}
-
-type DataSourceAppsAppPendingDeploymentStatus struct {
-	Message string `json:"message,omitempty"`
-	State   string `json:"state,omitempty"`
-}
-
-type DataSourceAppsAppPendingDeployment struct {
-	Command             []string                                               `json:"command,omitempty"`
-	CreateTime          string                                                 `json:"create_time,omitempty"`
-	Creator             string                                                 `json:"creator,omitempty"`
-	DeploymentArtifacts *DataSourceAppsAppPendingDeploymentDeploymentArtifacts `json:"deployment_artifacts,omitempty"`
-	DeploymentId        string                                                 `json:"deployment_id,omitempty"`
-	EnvVars             []DataSourceAppsAppPendingDeploymentEnvVars            `json:"env_vars,omitempty"`
-	GitSource           *DataSourceAppsAppPendingDeploymentGitSource           `json:"git_source,omitempty"`
-	Mode                string                                                 `json:"mode,omitempty"`
-	SourceCodePath      string                                                 `json:"source_code_path,omitempty"`
-	Status              *DataSourceAppsAppPendingDeploymentStatus              `json:"status,omitempty"`
-	UpdateTime          string                                                 `json:"update_time,omitempty"`
-}
-
-type DataSourceAppsAppResourcesApp struct {
-	Name       string `json:"name,omitempty"`
-	Permission string `json:"permission,omitempty"`
-}
-
-type DataSourceAppsAppResourcesDatabase struct {
-	DatabaseName string `json:"database_name"`
-	InstanceName string `json:"instance_name"`
-	Permission   string `json:"permission"`
-}
-
-type DataSourceAppsAppResourcesExperiment struct {
-	ExperimentId string `json:"experiment_id"`
-	Permission   string `json:"permission"`
-}
-
-type DataSourceAppsAppResourcesGenieSpace struct {
-	Name       string `json:"name"`
-	Permission string `json:"permission"`
-	SpaceId    string `json:"space_id"`
-}
-
-type DataSourceAppsAppResourcesJob struct {
-	Id         string `json:"id"`
-	Permission string `json:"permission"`
-}
-
-type DataSourceAppsAppResourcesPostgres struct {
-	Branch     string `json:"branch,omitempty"`
-	Database   string `json:"database,omitempty"`
-	Permission string `json:"permission,omitempty"`
-}
-
-type DataSourceAppsAppResourcesSecret struct {
-	Key        string `json:"key"`
-	Permission string `json:"permission"`
-	Scope      string `json:"scope"`
-}
-
-type DataSourceAppsAppResourcesServingEndpoint struct {
-	Name       string `json:"name"`
-	Permission string `json:"permission"`
-}
-
-type DataSourceAppsAppResourcesSqlWarehouse struct {
-	Id         string `json:"id"`
-	Permission string `json:"permission"`
-}
-
-type DataSourceAppsAppResourcesUcSecurable struct {
-	Permission        string `json:"permission"`
-	SecurableFullName string `json:"securable_full_name"`
-	SecurableKind     string `json:"securable_kind,omitempty"`
-	SecurableType     string `json:"securable_type"`
-}
-
-type DataSourceAppsAppResources struct {
-	App             *DataSourceAppsAppResourcesApp             `json:"app,omitempty"`
-	Database        *DataSourceAppsAppResourcesDatabase        `json:"database,omitempty"`
-	Description     string                                     `json:"description,omitempty"`
-	Experiment      *DataSourceAppsAppResourcesExperiment      `json:"experiment,omitempty"`
-	GenieSpace      *DataSourceAppsAppResourcesGenieSpace      `json:"genie_space,omitempty"`
-	Job             *DataSourceAppsAppResourcesJob             `json:"job,omitempty"`
-	Name            string                                     `json:"name"`
-	Postgres        *DataSourceAppsAppResourcesPostgres        `json:"postgres,omitempty"`
-	Secret          *DataSourceAppsAppResourcesSecret          `json:"secret,omitempty"`
-	ServingEndpoint *DataSourceAppsAppResourcesServingEndpoint `json:"serving_endpoint,omitempty"`
-	SqlWarehouse    *DataSourceAppsAppResourcesSqlWarehouse    `json:"sql_warehouse,omitempty"`
-	UcSecurable     *DataSourceAppsAppResourcesUcSecurable     `json:"uc_securable,omitempty"`
-}
-
-type DataSourceAppsAppTelemetryExportDestinationsUnityCatalog struct {
-	LogsTable    string `json:"logs_table"`
-	MetricsTable string `json:"metrics_table"`
-	TracesTable  string `json:"traces_table"`
-}
-
-type DataSourceAppsAppTelemetryExportDestinations struct {
-	UnityCatalog *DataSourceAppsAppTelemetryExportDestinationsUnityCatalog `json:"unity_catalog,omitempty"`
-}
-
-type DataSourceAppsApp struct {
-	ActiveDeployment            *DataSourceAppsAppActiveDeployment             `json:"active_deployment,omitempty"`
-	AppStatus                   *DataSourceAppsAppAppStatus                    `json:"app_status,omitempty"`
-	BudgetPolicyId              string                                         `json:"budget_policy_id,omitempty"`
-	ComputeSize                 string                                         `json:"compute_size,omitempty"`
-	ComputeStatus               *DataSourceAppsAppComputeStatus                `json:"compute_status,omitempty"`
-	CreateTime                  string                                         `json:"create_time,omitempty"`
-	Creator                     string                                         `json:"creator,omitempty"`
-	DefaultSourceCodePath       string                                         `json:"default_source_code_path,omitempty"`
-	Description                 string                                         `json:"description,omitempty"`
-	EffectiveBudgetPolicyId     string                                         `json:"effective_budget_policy_id,omitempty"`
-	EffectiveUsagePolicyId      string                                         `json:"effective_usage_policy_id,omitempty"`
-	EffectiveUserApiScopes      []string                                       `json:"effective_user_api_scopes,omitempty"`
-	GitRepository               *DataSourceAppsAppGitRepository                `json:"git_repository,omitempty"`
-	Id                          string                                         `json:"id,omitempty"`
-	Name                        string                                         `json:"name"`
-	Oauth2AppClientId           string                                         `json:"oauth2_app_client_id,omitempty"`
-	Oauth2AppIntegrationId      string                                         `json:"oauth2_app_integration_id,omitempty"`
-	PendingDeployment           *DataSourceAppsAppPendingDeployment            `json:"pending_deployment,omitempty"`
-	Resources                   []DataSourceAppsAppResources                   `json:"resources,omitempty"`
-	ServicePrincipalClientId    string                                         `json:"service_principal_client_id,omitempty"`
-	ServicePrincipalId          int                                            `json:"service_principal_id,omitempty"`
-	ServicePrincipalName        string                                         `json:"service_principal_name,omitempty"`
-	Space                       string                                         `json:"space,omitempty"`
-	TelemetryExportDestinations []DataSourceAppsAppTelemetryExportDestinations `json:"telemetry_export_destinations,omitempty"`
-	UpdateTime                  string                                         `json:"update_time,omitempty"`
-	Updater                     string                                         `json:"updater,omitempty"`
-	Url                         string                                         `json:"url,omitempty"`
-	UsagePolicyId               string                                         `json:"usage_policy_id,omitempty"`
-	UserApiScopes               []string                                       `json:"user_api_scopes,omitempty"`
-}
-
-type DataSourceAppsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceApps struct {
-	App            []DataSourceAppsApp           `json:"app,omitempty"`
-	ProviderConfig *DataSourceAppsProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_apps_settings_custom_template.go b/bundle/internal/tf/schema/data_source_apps_settings_custom_template.go
deleted file mode 100644
index afd082a22e4..00000000000
--- a/bundle/internal/tf/schema/data_source_apps_settings_custom_template.go
+++ /dev/null
@@ -1,61 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceAppsSettingsCustomTemplateManifestResourceSpecsExperimentSpec struct {
-	Permission string `json:"permission"`
-}
-
-type DataSourceAppsSettingsCustomTemplateManifestResourceSpecsJobSpec struct {
-	Permission string `json:"permission"`
-}
-
-type DataSourceAppsSettingsCustomTemplateManifestResourceSpecsSecretSpec struct {
-	Permission string `json:"permission"`
-}
-
-type DataSourceAppsSettingsCustomTemplateManifestResourceSpecsServingEndpointSpec struct {
-	Permission string `json:"permission"`
-}
-
-type DataSourceAppsSettingsCustomTemplateManifestResourceSpecsSqlWarehouseSpec struct {
-	Permission string `json:"permission"`
-}
-
-type DataSourceAppsSettingsCustomTemplateManifestResourceSpecsUcSecurableSpec struct {
-	Permission    string `json:"permission"`
-	SecurableType string `json:"securable_type"`
-}
-
-type DataSourceAppsSettingsCustomTemplateManifestResourceSpecs struct {
-	Description         string                                                                        `json:"description,omitempty"`
-	ExperimentSpec      *DataSourceAppsSettingsCustomTemplateManifestResourceSpecsExperimentSpec      `json:"experiment_spec,omitempty"`
-	JobSpec             *DataSourceAppsSettingsCustomTemplateManifestResourceSpecsJobSpec             `json:"job_spec,omitempty"`
-	Name                string                                                                        `json:"name"`
-	SecretSpec          *DataSourceAppsSettingsCustomTemplateManifestResourceSpecsSecretSpec          `json:"secret_spec,omitempty"`
-	ServingEndpointSpec *DataSourceAppsSettingsCustomTemplateManifestResourceSpecsServingEndpointSpec `json:"serving_endpoint_spec,omitempty"`
-	SqlWarehouseSpec    *DataSourceAppsSettingsCustomTemplateManifestResourceSpecsSqlWarehouseSpec    `json:"sql_warehouse_spec,omitempty"`
-	UcSecurableSpec     *DataSourceAppsSettingsCustomTemplateManifestResourceSpecsUcSecurableSpec     `json:"uc_securable_spec,omitempty"`
-}
-
-type DataSourceAppsSettingsCustomTemplateManifest struct {
-	Description   string                                                      `json:"description,omitempty"`
-	Name          string                                                      `json:"name"`
-	ResourceSpecs []DataSourceAppsSettingsCustomTemplateManifestResourceSpecs `json:"resource_specs,omitempty"`
-	Version       int                                                         `json:"version"`
-}
-
-type DataSourceAppsSettingsCustomTemplateProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceAppsSettingsCustomTemplate struct {
-	Creator        string                                              `json:"creator,omitempty"`
-	Description    string                                              `json:"description,omitempty"`
-	GitProvider    string                                              `json:"git_provider,omitempty"`
-	GitRepo        string                                              `json:"git_repo,omitempty"`
-	Manifest       *DataSourceAppsSettingsCustomTemplateManifest       `json:"manifest,omitempty"`
-	Name           string                                              `json:"name"`
-	Path           string                                              `json:"path,omitempty"`
-	ProviderConfig *DataSourceAppsSettingsCustomTemplateProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_apps_settings_custom_templates.go b/bundle/internal/tf/schema/data_source_apps_settings_custom_templates.go
deleted file mode 100644
index 5c846dba929..00000000000
--- a/bundle/internal/tf/schema/data_source_apps_settings_custom_templates.go
+++ /dev/null
@@ -1,71 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceAppsSettingsCustomTemplatesProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceAppsSettingsCustomTemplatesTemplatesManifestResourceSpecsExperimentSpec struct {
-	Permission string `json:"permission"`
-}
-
-type DataSourceAppsSettingsCustomTemplatesTemplatesManifestResourceSpecsJobSpec struct {
-	Permission string `json:"permission"`
-}
-
-type DataSourceAppsSettingsCustomTemplatesTemplatesManifestResourceSpecsSecretSpec struct {
-	Permission string `json:"permission"`
-}
-
-type DataSourceAppsSettingsCustomTemplatesTemplatesManifestResourceSpecsServingEndpointSpec struct {
-	Permission string `json:"permission"`
-}
-
-type DataSourceAppsSettingsCustomTemplatesTemplatesManifestResourceSpecsSqlWarehouseSpec struct {
-	Permission string `json:"permission"`
-}
-
-type DataSourceAppsSettingsCustomTemplatesTemplatesManifestResourceSpecsUcSecurableSpec struct {
-	Permission    string `json:"permission"`
-	SecurableType string `json:"securable_type"`
-}
-
-type DataSourceAppsSettingsCustomTemplatesTemplatesManifestResourceSpecs struct {
-	Description         string                                                                                  `json:"description,omitempty"`
-	ExperimentSpec      *DataSourceAppsSettingsCustomTemplatesTemplatesManifestResourceSpecsExperimentSpec      `json:"experiment_spec,omitempty"`
-	JobSpec             *DataSourceAppsSettingsCustomTemplatesTemplatesManifestResourceSpecsJobSpec             `json:"job_spec,omitempty"`
-	Name                string                                                                                  `json:"name"`
-	SecretSpec          *DataSourceAppsSettingsCustomTemplatesTemplatesManifestResourceSpecsSecretSpec          `json:"secret_spec,omitempty"`
-	ServingEndpointSpec *DataSourceAppsSettingsCustomTemplatesTemplatesManifestResourceSpecsServingEndpointSpec `json:"serving_endpoint_spec,omitempty"`
-	SqlWarehouseSpec    *DataSourceAppsSettingsCustomTemplatesTemplatesManifestResourceSpecsSqlWarehouseSpec    `json:"sql_warehouse_spec,omitempty"`
-	UcSecurableSpec     *DataSourceAppsSettingsCustomTemplatesTemplatesManifestResourceSpecsUcSecurableSpec     `json:"uc_securable_spec,omitempty"`
-}
-
-type DataSourceAppsSettingsCustomTemplatesTemplatesManifest struct {
-	Description   string                                                                `json:"description,omitempty"`
-	Name          string                                                                `json:"name"`
-	ResourceSpecs []DataSourceAppsSettingsCustomTemplatesTemplatesManifestResourceSpecs `json:"resource_specs,omitempty"`
-	Version       int                                                                   `json:"version"`
-}
-
-type DataSourceAppsSettingsCustomTemplatesTemplatesProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceAppsSettingsCustomTemplatesTemplates struct {
-	Creator        string                                                        `json:"creator,omitempty"`
-	Description    string                                                        `json:"description,omitempty"`
-	GitProvider    string                                                        `json:"git_provider,omitempty"`
-	GitRepo        string                                                        `json:"git_repo,omitempty"`
-	Manifest       *DataSourceAppsSettingsCustomTemplatesTemplatesManifest       `json:"manifest,omitempty"`
-	Name           string                                                        `json:"name"`
-	Path           string                                                        `json:"path,omitempty"`
-	ProviderConfig *DataSourceAppsSettingsCustomTemplatesTemplatesProviderConfig `json:"provider_config,omitempty"`
-}
-
-type DataSourceAppsSettingsCustomTemplates struct {
-	PageSize       int                                                  `json:"page_size,omitempty"`
-	ProviderConfig *DataSourceAppsSettingsCustomTemplatesProviderConfig `json:"provider_config,omitempty"`
-	Templates      []DataSourceAppsSettingsCustomTemplatesTemplates     `json:"templates,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_apps_space.go b/bundle/internal/tf/schema/data_source_apps_space.go
deleted file mode 100644
index bd431afbb78..00000000000
--- a/bundle/internal/tf/schema/data_source_apps_space.go
+++ /dev/null
@@ -1,91 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceAppsSpaceProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceAppsSpaceResourcesDatabase struct {
-	DatabaseName string `json:"database_name"`
-	InstanceName string `json:"instance_name"`
-	Permission   string `json:"permission"`
-}
-
-type DataSourceAppsSpaceResourcesExperiment struct {
-	ExperimentId string `json:"experiment_id"`
-	Permission   string `json:"permission"`
-}
-
-type DataSourceAppsSpaceResourcesGenieSpace struct {
-	Name       string `json:"name"`
-	Permission string `json:"permission"`
-	SpaceId    string `json:"space_id"`
-}
-
-type DataSourceAppsSpaceResourcesJob struct {
-	Id         string `json:"id"`
-	Permission string `json:"permission"`
-}
-
-type DataSourceAppsSpaceResourcesSecret struct {
-	Key        string `json:"key"`
-	Permission string `json:"permission"`
-	Scope      string `json:"scope"`
-}
-
-type DataSourceAppsSpaceResourcesServingEndpoint struct {
-	Name       string `json:"name"`
-	Permission string `json:"permission"`
-}
-
-type DataSourceAppsSpaceResourcesSqlWarehouse struct {
-	Id         string `json:"id"`
-	Permission string `json:"permission"`
-}
-
-type DataSourceAppsSpaceResourcesUcSecurable struct {
-	Permission        string `json:"permission"`
-	SecurableFullName string `json:"securable_full_name"`
-	SecurableType     string `json:"securable_type"`
-}
-
-type DataSourceAppsSpaceResources struct {
-	Database        *DataSourceAppsSpaceResourcesDatabase        `json:"database,omitempty"`
-	Description     string                                       `json:"description,omitempty"`
-	Experiment      *DataSourceAppsSpaceResourcesExperiment      `json:"experiment,omitempty"`
-	GenieSpace      *DataSourceAppsSpaceResourcesGenieSpace      `json:"genie_space,omitempty"`
-	Job             *DataSourceAppsSpaceResourcesJob             `json:"job,omitempty"`
-	Name            string                                       `json:"name"`
-	Secret          *DataSourceAppsSpaceResourcesSecret          `json:"secret,omitempty"`
-	ServingEndpoint *DataSourceAppsSpaceResourcesServingEndpoint `json:"serving_endpoint,omitempty"`
-	SqlWarehouse    *DataSourceAppsSpaceResourcesSqlWarehouse    `json:"sql_warehouse,omitempty"`
-	UcSecurable     *DataSourceAppsSpaceResourcesUcSecurable     `json:"uc_securable,omitempty"`
-}
-
-type DataSourceAppsSpaceStatus struct {
-	Message string `json:"message,omitempty"`
-	State   string `json:"state,omitempty"`
-}
-
-type DataSourceAppsSpace struct {
-	CreateTime               string                             `json:"create_time,omitempty"`
-	Creator                  string                             `json:"creator,omitempty"`
-	Description              string                             `json:"description,omitempty"`
-	EffectiveUsagePolicyId   string                             `json:"effective_usage_policy_id,omitempty"`
-	EffectiveUserApiScopes   []string                           `json:"effective_user_api_scopes,omitempty"`
-	Id                       string                             `json:"id,omitempty"`
-	Name                     string                             `json:"name"`
-	Oauth2AppClientId        string                             `json:"oauth2_app_client_id,omitempty"`
-	Oauth2AppIntegrationId   string                             `json:"oauth2_app_integration_id,omitempty"`
-	ProviderConfig           *DataSourceAppsSpaceProviderConfig `json:"provider_config,omitempty"`
-	Resources                []DataSourceAppsSpaceResources     `json:"resources,omitempty"`
-	ServicePrincipalClientId string                             `json:"service_principal_client_id,omitempty"`
-	ServicePrincipalId       int                                `json:"service_principal_id,omitempty"`
-	ServicePrincipalName     string                             `json:"service_principal_name,omitempty"`
-	Status                   *DataSourceAppsSpaceStatus         `json:"status,omitempty"`
-	UpdateTime               string                             `json:"update_time,omitempty"`
-	Updater                  string                             `json:"updater,omitempty"`
-	UsagePolicyId            string                             `json:"usage_policy_id,omitempty"`
-	UserApiScopes            []string                           `json:"user_api_scopes,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_apps_spaces.go b/bundle/internal/tf/schema/data_source_apps_spaces.go
deleted file mode 100644
index af7c7932732..00000000000
--- a/bundle/internal/tf/schema/data_source_apps_spaces.go
+++ /dev/null
@@ -1,101 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceAppsSpacesProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceAppsSpacesSpacesProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceAppsSpacesSpacesResourcesDatabase struct {
-	DatabaseName string `json:"database_name"`
-	InstanceName string `json:"instance_name"`
-	Permission   string `json:"permission"`
-}
-
-type DataSourceAppsSpacesSpacesResourcesExperiment struct {
-	ExperimentId string `json:"experiment_id"`
-	Permission   string `json:"permission"`
-}
-
-type DataSourceAppsSpacesSpacesResourcesGenieSpace struct {
-	Name       string `json:"name"`
-	Permission string `json:"permission"`
-	SpaceId    string `json:"space_id"`
-}
-
-type DataSourceAppsSpacesSpacesResourcesJob struct {
-	Id         string `json:"id"`
-	Permission string `json:"permission"`
-}
-
-type DataSourceAppsSpacesSpacesResourcesSecret struct {
-	Key        string `json:"key"`
-	Permission string `json:"permission"`
-	Scope      string `json:"scope"`
-}
-
-type DataSourceAppsSpacesSpacesResourcesServingEndpoint struct {
-	Name       string `json:"name"`
-	Permission string `json:"permission"`
-}
-
-type DataSourceAppsSpacesSpacesResourcesSqlWarehouse struct {
-	Id         string `json:"id"`
-	Permission string `json:"permission"`
-}
-
-type DataSourceAppsSpacesSpacesResourcesUcSecurable struct {
-	Permission        string `json:"permission"`
-	SecurableFullName string `json:"securable_full_name"`
-	SecurableType     string `json:"securable_type"`
-}
-
-type DataSourceAppsSpacesSpacesResources struct {
-	Database        *DataSourceAppsSpacesSpacesResourcesDatabase        `json:"database,omitempty"`
-	Description     string                                              `json:"description,omitempty"`
-	Experiment      *DataSourceAppsSpacesSpacesResourcesExperiment      `json:"experiment,omitempty"`
-	GenieSpace      *DataSourceAppsSpacesSpacesResourcesGenieSpace      `json:"genie_space,omitempty"`
-	Job             *DataSourceAppsSpacesSpacesResourcesJob             `json:"job,omitempty"`
-	Name            string                                              `json:"name"`
-	Secret          *DataSourceAppsSpacesSpacesResourcesSecret          `json:"secret,omitempty"`
-	ServingEndpoint *DataSourceAppsSpacesSpacesResourcesServingEndpoint `json:"serving_endpoint,omitempty"`
-	SqlWarehouse    *DataSourceAppsSpacesSpacesResourcesSqlWarehouse    `json:"sql_warehouse,omitempty"`
-	UcSecurable     *DataSourceAppsSpacesSpacesResourcesUcSecurable     `json:"uc_securable,omitempty"`
-}
-
-type DataSourceAppsSpacesSpacesStatus struct {
-	Message string `json:"message,omitempty"`
-	State   string `json:"state,omitempty"`
-}
-
-type DataSourceAppsSpacesSpaces struct {
-	CreateTime               string                                    `json:"create_time,omitempty"`
-	Creator                  string                                    `json:"creator,omitempty"`
-	Description              string                                    `json:"description,omitempty"`
-	EffectiveUsagePolicyId   string                                    `json:"effective_usage_policy_id,omitempty"`
-	EffectiveUserApiScopes   []string                                  `json:"effective_user_api_scopes,omitempty"`
-	Id                       string                                    `json:"id,omitempty"`
-	Name                     string                                    `json:"name"`
-	Oauth2AppClientId        string                                    `json:"oauth2_app_client_id,omitempty"`
-	Oauth2AppIntegrationId   string                                    `json:"oauth2_app_integration_id,omitempty"`
-	ProviderConfig           *DataSourceAppsSpacesSpacesProviderConfig `json:"provider_config,omitempty"`
-	Resources                []DataSourceAppsSpacesSpacesResources     `json:"resources,omitempty"`
-	ServicePrincipalClientId string                                    `json:"service_principal_client_id,omitempty"`
-	ServicePrincipalId       int                                       `json:"service_principal_id,omitempty"`
-	ServicePrincipalName     string                                    `json:"service_principal_name,omitempty"`
-	Status                   *DataSourceAppsSpacesSpacesStatus         `json:"status,omitempty"`
-	UpdateTime               string                                    `json:"update_time,omitempty"`
-	Updater                  string                                    `json:"updater,omitempty"`
-	UsagePolicyId            string                                    `json:"usage_policy_id,omitempty"`
-	UserApiScopes            []string                                  `json:"user_api_scopes,omitempty"`
-}
-
-type DataSourceAppsSpaces struct {
-	PageSize       int                                 `json:"page_size,omitempty"`
-	ProviderConfig *DataSourceAppsSpacesProviderConfig `json:"provider_config,omitempty"`
-	Spaces         []DataSourceAppsSpacesSpaces        `json:"spaces,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_aws_assume_role_policy.go b/bundle/internal/tf/schema/data_source_aws_assume_role_policy.go
deleted file mode 100644
index 25fea09022e..00000000000
--- a/bundle/internal/tf/schema/data_source_aws_assume_role_policy.go
+++ /dev/null
@@ -1,12 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceAwsAssumeRolePolicy struct {
-	AwsPartition        string `json:"aws_partition,omitempty"`
-	DatabricksAccountId string `json:"databricks_account_id,omitempty"`
-	ExternalId          string `json:"external_id"`
-	ForLogDelivery      bool   `json:"for_log_delivery,omitempty"`
-	Id                  string `json:"id,omitempty"`
-	Json                string `json:"json,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_aws_bucket_policy.go b/bundle/internal/tf/schema/data_source_aws_bucket_policy.go
deleted file mode 100644
index d6b26c8cdf6..00000000000
--- a/bundle/internal/tf/schema/data_source_aws_bucket_policy.go
+++ /dev/null
@@ -1,13 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceAwsBucketPolicy struct {
-	AwsPartition          string `json:"aws_partition,omitempty"`
-	Bucket                string `json:"bucket"`
-	DatabricksAccountId   string `json:"databricks_account_id,omitempty"`
-	DatabricksE2AccountId string `json:"databricks_e2_account_id,omitempty"`
-	FullAccessRole        string `json:"full_access_role,omitempty"`
-	Id                    string `json:"id,omitempty"`
-	Json                  string `json:"json,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_aws_crossaccount_policy.go b/bundle/internal/tf/schema/data_source_aws_crossaccount_policy.go
deleted file mode 100644
index 9591940db98..00000000000
--- a/bundle/internal/tf/schema/data_source_aws_crossaccount_policy.go
+++ /dev/null
@@ -1,15 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceAwsCrossaccountPolicy struct {
-	AwsAccountId    string   `json:"aws_account_id,omitempty"`
-	AwsPartition    string   `json:"aws_partition,omitempty"`
-	Id              string   `json:"id,omitempty"`
-	Json            string   `json:"json,omitempty"`
-	PassRoles       []string `json:"pass_roles,omitempty"`
-	PolicyType      string   `json:"policy_type,omitempty"`
-	Region          string   `json:"region,omitempty"`
-	SecurityGroupId string   `json:"security_group_id,omitempty"`
-	VpcId           string   `json:"vpc_id,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_aws_unity_catalog_assume_role_policy.go b/bundle/internal/tf/schema/data_source_aws_unity_catalog_assume_role_policy.go
deleted file mode 100644
index 29d47f92392..00000000000
--- a/bundle/internal/tf/schema/data_source_aws_unity_catalog_assume_role_policy.go
+++ /dev/null
@@ -1,13 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceAwsUnityCatalogAssumeRolePolicy struct {
-	AwsAccountId       string `json:"aws_account_id"`
-	AwsPartition       string `json:"aws_partition,omitempty"`
-	ExternalId         string `json:"external_id"`
-	Id                 string `json:"id,omitempty"`
-	Json               string `json:"json,omitempty"`
-	RoleName           string `json:"role_name"`
-	UnityCatalogIamArn string `json:"unity_catalog_iam_arn,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_aws_unity_catalog_policy.go b/bundle/internal/tf/schema/data_source_aws_unity_catalog_policy.go
deleted file mode 100644
index 6d6acc57dde..00000000000
--- a/bundle/internal/tf/schema/data_source_aws_unity_catalog_policy.go
+++ /dev/null
@@ -1,13 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceAwsUnityCatalogPolicy struct {
-	AwsAccountId string `json:"aws_account_id"`
-	AwsPartition string `json:"aws_partition,omitempty"`
-	BucketName   string `json:"bucket_name"`
-	Id           string `json:"id,omitempty"`
-	Json         string `json:"json,omitempty"`
-	KmsName      string `json:"kms_name,omitempty"`
-	RoleName     string `json:"role_name"`
-}
diff --git a/bundle/internal/tf/schema/data_source_budget_policies.go b/bundle/internal/tf/schema/data_source_budget_policies.go
deleted file mode 100644
index 42bb796128c..00000000000
--- a/bundle/internal/tf/schema/data_source_budget_policies.go
+++ /dev/null
@@ -1,33 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceBudgetPoliciesFilterBy struct {
-	CreatorUserId   int    `json:"creator_user_id,omitempty"`
-	CreatorUserName string `json:"creator_user_name,omitempty"`
-	PolicyName      string `json:"policy_name,omitempty"`
-}
-
-type DataSourceBudgetPoliciesPoliciesCustomTags struct {
-	Key   string `json:"key"`
-	Value string `json:"value,omitempty"`
-}
-
-type DataSourceBudgetPoliciesPolicies struct {
-	BindingWorkspaceIds []int                                        `json:"binding_workspace_ids,omitempty"`
-	CustomTags          []DataSourceBudgetPoliciesPoliciesCustomTags `json:"custom_tags,omitempty"`
-	PolicyId            string                                       `json:"policy_id"`
-	PolicyName          string                                       `json:"policy_name,omitempty"`
-}
-
-type DataSourceBudgetPoliciesSortSpec struct {
-	Descending bool   `json:"descending,omitempty"`
-	Field      string `json:"field,omitempty"`
-}
-
-type DataSourceBudgetPolicies struct {
-	FilterBy *DataSourceBudgetPoliciesFilterBy  `json:"filter_by,omitempty"`
-	PageSize int                                `json:"page_size,omitempty"`
-	Policies []DataSourceBudgetPoliciesPolicies `json:"policies,omitempty"`
-	SortSpec *DataSourceBudgetPoliciesSortSpec  `json:"sort_spec,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_budget_policy.go b/bundle/internal/tf/schema/data_source_budget_policy.go
deleted file mode 100644
index 6feed5b4a9a..00000000000
--- a/bundle/internal/tf/schema/data_source_budget_policy.go
+++ /dev/null
@@ -1,15 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceBudgetPolicyCustomTags struct {
-	Key   string `json:"key"`
-	Value string `json:"value,omitempty"`
-}
-
-type DataSourceBudgetPolicy struct {
-	BindingWorkspaceIds []int                              `json:"binding_workspace_ids,omitempty"`
-	CustomTags          []DataSourceBudgetPolicyCustomTags `json:"custom_tags,omitempty"`
-	PolicyId            string                             `json:"policy_id"`
-	PolicyName          string                             `json:"policy_name,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_catalog.go b/bundle/internal/tf/schema/data_source_catalog.go
deleted file mode 100644
index 5c293cd0e60..00000000000
--- a/bundle/internal/tf/schema/data_source_catalog.go
+++ /dev/null
@@ -1,63 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceCatalogCatalogInfoEffectivePredictiveOptimizationFlag struct {
-	InheritedFromName string `json:"inherited_from_name,omitempty"`
-	InheritedFromType string `json:"inherited_from_type,omitempty"`
-	Value             string `json:"value"`
-}
-
-type DataSourceCatalogCatalogInfoManagedEncryptionSettingsAzureEncryptionSettings struct {
-	AzureCmkAccessConnectorId string `json:"azure_cmk_access_connector_id,omitempty"`
-	AzureCmkManagedIdentityId string `json:"azure_cmk_managed_identity_id,omitempty"`
-	AzureTenantId             string `json:"azure_tenant_id"`
-}
-
-type DataSourceCatalogCatalogInfoManagedEncryptionSettings struct {
-	AzureKeyVaultKeyId      string                                                                        `json:"azure_key_vault_key_id,omitempty"`
-	CustomerManagedKeyId    string                                                                        `json:"customer_managed_key_id,omitempty"`
-	AzureEncryptionSettings *DataSourceCatalogCatalogInfoManagedEncryptionSettingsAzureEncryptionSettings `json:"azure_encryption_settings,omitempty"`
-}
-
-type DataSourceCatalogCatalogInfoProvisioningInfo struct {
-	State string `json:"state,omitempty"`
-}
-
-type DataSourceCatalogCatalogInfo struct {
-	BrowseOnly                          bool                                                             `json:"browse_only,omitempty"`
-	CatalogType                         string                                                           `json:"catalog_type,omitempty"`
-	Comment                             string                                                           `json:"comment,omitempty"`
-	ConnectionName                      string                                                           `json:"connection_name,omitempty"`
-	CreatedAt                           int                                                              `json:"created_at,omitempty"`
-	CreatedBy                           string                                                           `json:"created_by,omitempty"`
-	EnablePredictiveOptimization        string                                                           `json:"enable_predictive_optimization,omitempty"`
-	FullName                            string                                                           `json:"full_name,omitempty"`
-	IsolationMode                       string                                                           `json:"isolation_mode,omitempty"`
-	MetastoreId                         string                                                           `json:"metastore_id,omitempty"`
-	Name                                string                                                           `json:"name,omitempty"`
-	Options                             map[string]string                                                `json:"options,omitempty"`
-	Owner                               string                                                           `json:"owner,omitempty"`
-	Properties                          map[string]string                                                `json:"properties,omitempty"`
-	ProviderName                        string                                                           `json:"provider_name,omitempty"`
-	SecurableType                       string                                                           `json:"securable_type,omitempty"`
-	ShareName                           string                                                           `json:"share_name,omitempty"`
-	StorageLocation                     string                                                           `json:"storage_location,omitempty"`
-	StorageRoot                         string                                                           `json:"storage_root,omitempty"`
-	UpdatedAt                           int                                                              `json:"updated_at,omitempty"`
-	UpdatedBy                           string                                                           `json:"updated_by,omitempty"`
-	EffectivePredictiveOptimizationFlag *DataSourceCatalogCatalogInfoEffectivePredictiveOptimizationFlag `json:"effective_predictive_optimization_flag,omitempty"`
-	ManagedEncryptionSettings           *DataSourceCatalogCatalogInfoManagedEncryptionSettings           `json:"managed_encryption_settings,omitempty"`
-	ProvisioningInfo                    *DataSourceCatalogCatalogInfoProvisioningInfo                    `json:"provisioning_info,omitempty"`
-}
-
-type DataSourceCatalogProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceCatalog struct {
-	Id             string                           `json:"id,omitempty"`
-	Name           string                           `json:"name"`
-	CatalogInfo    *DataSourceCatalogCatalogInfo    `json:"catalog_info,omitempty"`
-	ProviderConfig *DataSourceCatalogProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_catalogs.go b/bundle/internal/tf/schema/data_source_catalogs.go
deleted file mode 100644
index dfe5b2a59a7..00000000000
--- a/bundle/internal/tf/schema/data_source_catalogs.go
+++ /dev/null
@@ -1,13 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceCatalogsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceCatalogs struct {
-	Id             string                            `json:"id,omitempty"`
-	Ids            []string                          `json:"ids,omitempty"`
-	ProviderConfig *DataSourceCatalogsProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_clean_room_asset.go b/bundle/internal/tf/schema/data_source_clean_room_asset.go
deleted file mode 100644
index 3e6d2e6005e..00000000000
--- a/bundle/internal/tf/schema/data_source_clean_room_asset.go
+++ /dev/null
@@ -1,137 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceCleanRoomAssetForeignTableColumnsMask struct {
-	FunctionName     string   `json:"function_name,omitempty"`
-	UsingColumnNames []string `json:"using_column_names,omitempty"`
-}
-
-type DataSourceCleanRoomAssetForeignTableColumns struct {
-	Comment          string                                           `json:"comment,omitempty"`
-	Mask             *DataSourceCleanRoomAssetForeignTableColumnsMask `json:"mask,omitempty"`
-	Name             string                                           `json:"name,omitempty"`
-	Nullable         bool                                             `json:"nullable,omitempty"`
-	PartitionIndex   int                                              `json:"partition_index,omitempty"`
-	Position         int                                              `json:"position,omitempty"`
-	TypeIntervalType string                                           `json:"type_interval_type,omitempty"`
-	TypeJson         string                                           `json:"type_json,omitempty"`
-	TypeName         string                                           `json:"type_name,omitempty"`
-	TypePrecision    int                                              `json:"type_precision,omitempty"`
-	TypeScale        int                                              `json:"type_scale,omitempty"`
-	TypeText         string                                           `json:"type_text,omitempty"`
-}
-
-type DataSourceCleanRoomAssetForeignTable struct {
-	Columns []DataSourceCleanRoomAssetForeignTableColumns `json:"columns,omitempty"`
-}
-
-type DataSourceCleanRoomAssetForeignTableLocalDetails struct {
-	LocalName string `json:"local_name"`
-}
-
-type DataSourceCleanRoomAssetNotebookReviews struct {
-	Comment                   string `json:"comment,omitempty"`
-	CreatedAtMillis           int    `json:"created_at_millis,omitempty"`
-	ReviewState               string `json:"review_state,omitempty"`
-	ReviewSubReason           string `json:"review_sub_reason,omitempty"`
-	ReviewerCollaboratorAlias string `json:"reviewer_collaborator_alias,omitempty"`
-}
-
-type DataSourceCleanRoomAssetNotebook struct {
-	Etag                      string                                    `json:"etag,omitempty"`
-	NotebookContent           string                                    `json:"notebook_content"`
-	ReviewState               string                                    `json:"review_state,omitempty"`
-	Reviews                   []DataSourceCleanRoomAssetNotebookReviews `json:"reviews,omitempty"`
-	RunnerCollaboratorAliases []string                                  `json:"runner_collaborator_aliases,omitempty"`
-}
-
-type DataSourceCleanRoomAssetTableColumnsMask struct {
-	FunctionName     string   `json:"function_name,omitempty"`
-	UsingColumnNames []string `json:"using_column_names,omitempty"`
-}
-
-type DataSourceCleanRoomAssetTableColumns struct {
-	Comment          string                                    `json:"comment,omitempty"`
-	Mask             *DataSourceCleanRoomAssetTableColumnsMask `json:"mask,omitempty"`
-	Name             string                                    `json:"name,omitempty"`
-	Nullable         bool                                      `json:"nullable,omitempty"`
-	PartitionIndex   int                                       `json:"partition_index,omitempty"`
-	Position         int                                       `json:"position,omitempty"`
-	TypeIntervalType string                                    `json:"type_interval_type,omitempty"`
-	TypeJson         string                                    `json:"type_json,omitempty"`
-	TypeName         string                                    `json:"type_name,omitempty"`
-	TypePrecision    int                                       `json:"type_precision,omitempty"`
-	TypeScale        int                                       `json:"type_scale,omitempty"`
-	TypeText         string                                    `json:"type_text,omitempty"`
-}
-
-type DataSourceCleanRoomAssetTable struct {
-	Columns []DataSourceCleanRoomAssetTableColumns `json:"columns,omitempty"`
-}
-
-type DataSourceCleanRoomAssetTableLocalDetailsPartitionsValue struct {
-	Name                 string `json:"name,omitempty"`
-	Op                   string `json:"op,omitempty"`
-	RecipientPropertyKey string `json:"recipient_property_key,omitempty"`
-	Value                string `json:"value,omitempty"`
-}
-
-type DataSourceCleanRoomAssetTableLocalDetailsPartitions struct {
-	Value []DataSourceCleanRoomAssetTableLocalDetailsPartitionsValue `json:"value,omitempty"`
-}
-
-type DataSourceCleanRoomAssetTableLocalDetails struct {
-	LocalName  string                                                `json:"local_name"`
-	Partitions []DataSourceCleanRoomAssetTableLocalDetailsPartitions `json:"partitions,omitempty"`
-}
-
-type DataSourceCleanRoomAssetViewColumnsMask struct {
-	FunctionName     string   `json:"function_name,omitempty"`
-	UsingColumnNames []string `json:"using_column_names,omitempty"`
-}
-
-type DataSourceCleanRoomAssetViewColumns struct {
-	Comment          string                                   `json:"comment,omitempty"`
-	Mask             *DataSourceCleanRoomAssetViewColumnsMask `json:"mask,omitempty"`
-	Name             string                                   `json:"name,omitempty"`
-	Nullable         bool                                     `json:"nullable,omitempty"`
-	PartitionIndex   int                                      `json:"partition_index,omitempty"`
-	Position         int                                      `json:"position,omitempty"`
-	TypeIntervalType string                                   `json:"type_interval_type,omitempty"`
-	TypeJson         string                                   `json:"type_json,omitempty"`
-	TypeName         string                                   `json:"type_name,omitempty"`
-	TypePrecision    int                                      `json:"type_precision,omitempty"`
-	TypeScale        int                                      `json:"type_scale,omitempty"`
-	TypeText         string                                   `json:"type_text,omitempty"`
-}
-
-type DataSourceCleanRoomAssetView struct {
-	Columns []DataSourceCleanRoomAssetViewColumns `json:"columns,omitempty"`
-}
-
-type DataSourceCleanRoomAssetViewLocalDetails struct {
-	LocalName string `json:"local_name"`
-}
-
-type DataSourceCleanRoomAssetVolumeLocalDetails struct {
-	LocalName string `json:"local_name"`
-}
-
-type DataSourceCleanRoomAsset struct {
-	AddedAt                  int                                               `json:"added_at,omitempty"`
-	AssetType                string                                            `json:"asset_type"`
-	CleanRoomName            string                                            `json:"clean_room_name,omitempty"`
-	ForeignTable             *DataSourceCleanRoomAssetForeignTable             `json:"foreign_table,omitempty"`
-	ForeignTableLocalDetails *DataSourceCleanRoomAssetForeignTableLocalDetails `json:"foreign_table_local_details,omitempty"`
-	Name                     string                                            `json:"name"`
-	Notebook                 *DataSourceCleanRoomAssetNotebook                 `json:"notebook,omitempty"`
-	OwnerCollaboratorAlias   string                                            `json:"owner_collaborator_alias,omitempty"`
-	Status                   string                                            `json:"status,omitempty"`
-	Table                    *DataSourceCleanRoomAssetTable                    `json:"table,omitempty"`
-	TableLocalDetails        *DataSourceCleanRoomAssetTableLocalDetails        `json:"table_local_details,omitempty"`
-	View                     *DataSourceCleanRoomAssetView                     `json:"view,omitempty"`
-	ViewLocalDetails         *DataSourceCleanRoomAssetViewLocalDetails         `json:"view_local_details,omitempty"`
-	VolumeLocalDetails       *DataSourceCleanRoomAssetVolumeLocalDetails       `json:"volume_local_details,omitempty"`
-	WorkspaceId              string                                            `json:"workspace_id,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_clean_room_asset_revisions_clean_room_asset.go b/bundle/internal/tf/schema/data_source_clean_room_asset_revisions_clean_room_asset.go
deleted file mode 100644
index abcaf163c75..00000000000
--- a/bundle/internal/tf/schema/data_source_clean_room_asset_revisions_clean_room_asset.go
+++ /dev/null
@@ -1,137 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceCleanRoomAssetRevisionsCleanRoomAssetForeignTableColumnsMask struct {
-	FunctionName     string   `json:"function_name,omitempty"`
-	UsingColumnNames []string `json:"using_column_names,omitempty"`
-}
-
-type DataSourceCleanRoomAssetRevisionsCleanRoomAssetForeignTableColumns struct {
-	Comment          string                                                                  `json:"comment,omitempty"`
-	Mask             *DataSourceCleanRoomAssetRevisionsCleanRoomAssetForeignTableColumnsMask `json:"mask,omitempty"`
-	Name             string                                                                  `json:"name,omitempty"`
-	Nullable         bool                                                                    `json:"nullable,omitempty"`
-	PartitionIndex   int                                                                     `json:"partition_index,omitempty"`
-	Position         int                                                                     `json:"position,omitempty"`
-	TypeIntervalType string                                                                  `json:"type_interval_type,omitempty"`
-	TypeJson         string                                                                  `json:"type_json,omitempty"`
-	TypeName         string                                                                  `json:"type_name,omitempty"`
-	TypePrecision    int                                                                     `json:"type_precision,omitempty"`
-	TypeScale        int                                                                     `json:"type_scale,omitempty"`
-	TypeText         string                                                                  `json:"type_text,omitempty"`
-}
-
-type DataSourceCleanRoomAssetRevisionsCleanRoomAssetForeignTable struct {
-	Columns []DataSourceCleanRoomAssetRevisionsCleanRoomAssetForeignTableColumns `json:"columns,omitempty"`
-}
-
-type DataSourceCleanRoomAssetRevisionsCleanRoomAssetForeignTableLocalDetails struct {
-	LocalName string `json:"local_name"`
-}
-
-type DataSourceCleanRoomAssetRevisionsCleanRoomAssetNotebookReviews struct {
-	Comment                   string `json:"comment,omitempty"`
-	CreatedAtMillis           int    `json:"created_at_millis,omitempty"`
-	ReviewState               string `json:"review_state,omitempty"`
-	ReviewSubReason           string `json:"review_sub_reason,omitempty"`
-	ReviewerCollaboratorAlias string `json:"reviewer_collaborator_alias,omitempty"`
-}
-
-type DataSourceCleanRoomAssetRevisionsCleanRoomAssetNotebook struct {
-	Etag                      string                                                           `json:"etag,omitempty"`
-	NotebookContent           string                                                           `json:"notebook_content"`
-	ReviewState               string                                                           `json:"review_state,omitempty"`
-	Reviews                   []DataSourceCleanRoomAssetRevisionsCleanRoomAssetNotebookReviews `json:"reviews,omitempty"`
-	RunnerCollaboratorAliases []string                                                         `json:"runner_collaborator_aliases,omitempty"`
-}
-
-type DataSourceCleanRoomAssetRevisionsCleanRoomAssetTableColumnsMask struct {
-	FunctionName     string   `json:"function_name,omitempty"`
-	UsingColumnNames []string `json:"using_column_names,omitempty"`
-}
-
-type DataSourceCleanRoomAssetRevisionsCleanRoomAssetTableColumns struct {
-	Comment          string                                                           `json:"comment,omitempty"`
-	Mask             *DataSourceCleanRoomAssetRevisionsCleanRoomAssetTableColumnsMask `json:"mask,omitempty"`
-	Name             string                                                           `json:"name,omitempty"`
-	Nullable         bool                                                             `json:"nullable,omitempty"`
-	PartitionIndex   int                                                              `json:"partition_index,omitempty"`
-	Position         int                                                              `json:"position,omitempty"`
-	TypeIntervalType string                                                           `json:"type_interval_type,omitempty"`
-	TypeJson         string                                                           `json:"type_json,omitempty"`
-	TypeName         string                                                           `json:"type_name,omitempty"`
-	TypePrecision    int                                                              `json:"type_precision,omitempty"`
-	TypeScale        int                                                              `json:"type_scale,omitempty"`
-	TypeText         string                                                           `json:"type_text,omitempty"`
-}
-
-type DataSourceCleanRoomAssetRevisionsCleanRoomAssetTable struct {
-	Columns []DataSourceCleanRoomAssetRevisionsCleanRoomAssetTableColumns `json:"columns,omitempty"`
-}
-
-type DataSourceCleanRoomAssetRevisionsCleanRoomAssetTableLocalDetailsPartitionsValue struct {
-	Name                 string `json:"name,omitempty"`
-	Op                   string `json:"op,omitempty"`
-	RecipientPropertyKey string `json:"recipient_property_key,omitempty"`
-	Value                string `json:"value,omitempty"`
-}
-
-type DataSourceCleanRoomAssetRevisionsCleanRoomAssetTableLocalDetailsPartitions struct {
-	Value []DataSourceCleanRoomAssetRevisionsCleanRoomAssetTableLocalDetailsPartitionsValue `json:"value,omitempty"`
-}
-
-type DataSourceCleanRoomAssetRevisionsCleanRoomAssetTableLocalDetails struct {
-	LocalName  string                                                                       `json:"local_name"`
-	Partitions []DataSourceCleanRoomAssetRevisionsCleanRoomAssetTableLocalDetailsPartitions `json:"partitions,omitempty"`
-}
-
-type DataSourceCleanRoomAssetRevisionsCleanRoomAssetViewColumnsMask struct {
-	FunctionName     string   `json:"function_name,omitempty"`
-	UsingColumnNames []string `json:"using_column_names,omitempty"`
-}
-
-type DataSourceCleanRoomAssetRevisionsCleanRoomAssetViewColumns struct {
-	Comment          string                                                          `json:"comment,omitempty"`
-	Mask             *DataSourceCleanRoomAssetRevisionsCleanRoomAssetViewColumnsMask `json:"mask,omitempty"`
-	Name             string                                                          `json:"name,omitempty"`
-	Nullable         bool                                                            `json:"nullable,omitempty"`
-	PartitionIndex   int                                                             `json:"partition_index,omitempty"`
-	Position         int                                                             `json:"position,omitempty"`
-	TypeIntervalType string                                                          `json:"type_interval_type,omitempty"`
-	TypeJson         string                                                          `json:"type_json,omitempty"`
-	TypeName         string                                                          `json:"type_name,omitempty"`
-	TypePrecision    int                                                             `json:"type_precision,omitempty"`
-	TypeScale        int                                                             `json:"type_scale,omitempty"`
-	TypeText         string                                                          `json:"type_text,omitempty"`
-}
-
-type DataSourceCleanRoomAssetRevisionsCleanRoomAssetView struct {
-	Columns []DataSourceCleanRoomAssetRevisionsCleanRoomAssetViewColumns `json:"columns,omitempty"`
-}
-
-type DataSourceCleanRoomAssetRevisionsCleanRoomAssetViewLocalDetails struct {
-	LocalName string `json:"local_name"`
-}
-
-type DataSourceCleanRoomAssetRevisionsCleanRoomAssetVolumeLocalDetails struct {
-	LocalName string `json:"local_name"`
-}
-
-type DataSourceCleanRoomAssetRevisionsCleanRoomAsset struct {
-	AddedAt                  int                                                                      `json:"added_at,omitempty"`
-	AssetType                string                                                                   `json:"asset_type"`
-	CleanRoomName            string                                                                   `json:"clean_room_name,omitempty"`
-	ForeignTable             *DataSourceCleanRoomAssetRevisionsCleanRoomAssetForeignTable             `json:"foreign_table,omitempty"`
-	ForeignTableLocalDetails *DataSourceCleanRoomAssetRevisionsCleanRoomAssetForeignTableLocalDetails `json:"foreign_table_local_details,omitempty"`
-	Name                     string                                                                   `json:"name"`
-	Notebook                 *DataSourceCleanRoomAssetRevisionsCleanRoomAssetNotebook                 `json:"notebook,omitempty"`
-	OwnerCollaboratorAlias   string                                                                   `json:"owner_collaborator_alias,omitempty"`
-	Status                   string                                                                   `json:"status,omitempty"`
-	Table                    *DataSourceCleanRoomAssetRevisionsCleanRoomAssetTable                    `json:"table,omitempty"`
-	TableLocalDetails        *DataSourceCleanRoomAssetRevisionsCleanRoomAssetTableLocalDetails        `json:"table_local_details,omitempty"`
-	View                     *DataSourceCleanRoomAssetRevisionsCleanRoomAssetView                     `json:"view,omitempty"`
-	ViewLocalDetails         *DataSourceCleanRoomAssetRevisionsCleanRoomAssetViewLocalDetails         `json:"view_local_details,omitempty"`
-	VolumeLocalDetails       *DataSourceCleanRoomAssetRevisionsCleanRoomAssetVolumeLocalDetails       `json:"volume_local_details,omitempty"`
-	WorkspaceId              string                                                                   `json:"workspace_id,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_clean_room_asset_revisions_clean_room_assets.go b/bundle/internal/tf/schema/data_source_clean_room_asset_revisions_clean_room_assets.go
deleted file mode 100644
index 8b896d09453..00000000000
--- a/bundle/internal/tf/schema/data_source_clean_room_asset_revisions_clean_room_assets.go
+++ /dev/null
@@ -1,142 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceCleanRoomAssetRevisionsCleanRoomAssetsRevisionsForeignTableColumnsMask struct {
-	FunctionName     string   `json:"function_name,omitempty"`
-	UsingColumnNames []string `json:"using_column_names,omitempty"`
-}
-
-type DataSourceCleanRoomAssetRevisionsCleanRoomAssetsRevisionsForeignTableColumns struct {
-	Comment          string                                                                            `json:"comment,omitempty"`
-	Mask             *DataSourceCleanRoomAssetRevisionsCleanRoomAssetsRevisionsForeignTableColumnsMask `json:"mask,omitempty"`
-	Name             string                                                                            `json:"name,omitempty"`
-	Nullable         bool                                                                              `json:"nullable,omitempty"`
-	PartitionIndex   int                                                                               `json:"partition_index,omitempty"`
-	Position         int                                                                               `json:"position,omitempty"`
-	TypeIntervalType string                                                                            `json:"type_interval_type,omitempty"`
-	TypeJson         string                                                                            `json:"type_json,omitempty"`
-	TypeName         string                                                                            `json:"type_name,omitempty"`
-	TypePrecision    int                                                                               `json:"type_precision,omitempty"`
-	TypeScale        int                                                                               `json:"type_scale,omitempty"`
-	TypeText         string                                                                            `json:"type_text,omitempty"`
-}
-
-type DataSourceCleanRoomAssetRevisionsCleanRoomAssetsRevisionsForeignTable struct {
-	Columns []DataSourceCleanRoomAssetRevisionsCleanRoomAssetsRevisionsForeignTableColumns `json:"columns,omitempty"`
-}
-
-type DataSourceCleanRoomAssetRevisionsCleanRoomAssetsRevisionsForeignTableLocalDetails struct {
-	LocalName string `json:"local_name"`
-}
-
-type DataSourceCleanRoomAssetRevisionsCleanRoomAssetsRevisionsNotebookReviews struct {
-	Comment                   string `json:"comment,omitempty"`
-	CreatedAtMillis           int    `json:"created_at_millis,omitempty"`
-	ReviewState               string `json:"review_state,omitempty"`
-	ReviewSubReason           string `json:"review_sub_reason,omitempty"`
-	ReviewerCollaboratorAlias string `json:"reviewer_collaborator_alias,omitempty"`
-}
-
-type DataSourceCleanRoomAssetRevisionsCleanRoomAssetsRevisionsNotebook struct {
-	Etag                      string                                                                     `json:"etag,omitempty"`
-	NotebookContent           string                                                                     `json:"notebook_content"`
-	ReviewState               string                                                                     `json:"review_state,omitempty"`
-	Reviews                   []DataSourceCleanRoomAssetRevisionsCleanRoomAssetsRevisionsNotebookReviews `json:"reviews,omitempty"`
-	RunnerCollaboratorAliases []string                                                                   `json:"runner_collaborator_aliases,omitempty"`
-}
-
-type DataSourceCleanRoomAssetRevisionsCleanRoomAssetsRevisionsTableColumnsMask struct {
-	FunctionName     string   `json:"function_name,omitempty"`
-	UsingColumnNames []string `json:"using_column_names,omitempty"`
-}
-
-type DataSourceCleanRoomAssetRevisionsCleanRoomAssetsRevisionsTableColumns struct {
-	Comment          string                                                                     `json:"comment,omitempty"`
-	Mask             *DataSourceCleanRoomAssetRevisionsCleanRoomAssetsRevisionsTableColumnsMask `json:"mask,omitempty"`
-	Name             string                                                                     `json:"name,omitempty"`
-	Nullable         bool                                                                       `json:"nullable,omitempty"`
-	PartitionIndex   int                                                                        `json:"partition_index,omitempty"`
-	Position         int                                                                        `json:"position,omitempty"`
-	TypeIntervalType string                                                                     `json:"type_interval_type,omitempty"`
-	TypeJson         string                                                                     `json:"type_json,omitempty"`
-	TypeName         string                                                                     `json:"type_name,omitempty"`
-	TypePrecision    int                                                                        `json:"type_precision,omitempty"`
-	TypeScale        int                                                                        `json:"type_scale,omitempty"`
-	TypeText         string                                                                     `json:"type_text,omitempty"`
-}
-
-type DataSourceCleanRoomAssetRevisionsCleanRoomAssetsRevisionsTable struct {
-	Columns []DataSourceCleanRoomAssetRevisionsCleanRoomAssetsRevisionsTableColumns `json:"columns,omitempty"`
-}
-
-type DataSourceCleanRoomAssetRevisionsCleanRoomAssetsRevisionsTableLocalDetailsPartitionsValue struct {
-	Name                 string `json:"name,omitempty"`
-	Op                   string `json:"op,omitempty"`
-	RecipientPropertyKey string `json:"recipient_property_key,omitempty"`
-	Value                string `json:"value,omitempty"`
-}
-
-type DataSourceCleanRoomAssetRevisionsCleanRoomAssetsRevisionsTableLocalDetailsPartitions struct {
-	Value []DataSourceCleanRoomAssetRevisionsCleanRoomAssetsRevisionsTableLocalDetailsPartitionsValue `json:"value,omitempty"`
-}
-
-type DataSourceCleanRoomAssetRevisionsCleanRoomAssetsRevisionsTableLocalDetails struct {
-	LocalName  string                                                                                 `json:"local_name"`
-	Partitions []DataSourceCleanRoomAssetRevisionsCleanRoomAssetsRevisionsTableLocalDetailsPartitions `json:"partitions,omitempty"`
-}
-
-type DataSourceCleanRoomAssetRevisionsCleanRoomAssetsRevisionsViewColumnsMask struct {
-	FunctionName     string   `json:"function_name,omitempty"`
-	UsingColumnNames []string `json:"using_column_names,omitempty"`
-}
-
-type DataSourceCleanRoomAssetRevisionsCleanRoomAssetsRevisionsViewColumns struct {
-	Comment          string                                                                    `json:"comment,omitempty"`
-	Mask             *DataSourceCleanRoomAssetRevisionsCleanRoomAssetsRevisionsViewColumnsMask `json:"mask,omitempty"`
-	Name             string                                                                    `json:"name,omitempty"`
-	Nullable         bool                                                                      `json:"nullable,omitempty"`
-	PartitionIndex   int                                                                       `json:"partition_index,omitempty"`
-	Position         int                                                                       `json:"position,omitempty"`
-	TypeIntervalType string                                                                    `json:"type_interval_type,omitempty"`
-	TypeJson         string                                                                    `json:"type_json,omitempty"`
-	TypeName         string                                                                    `json:"type_name,omitempty"`
-	TypePrecision    int                                                                       `json:"type_precision,omitempty"`
-	TypeScale        int                                                                       `json:"type_scale,omitempty"`
-	TypeText         string                                                                    `json:"type_text,omitempty"`
-}
-
-type DataSourceCleanRoomAssetRevisionsCleanRoomAssetsRevisionsView struct {
-	Columns []DataSourceCleanRoomAssetRevisionsCleanRoomAssetsRevisionsViewColumns `json:"columns,omitempty"`
-}
-
-type DataSourceCleanRoomAssetRevisionsCleanRoomAssetsRevisionsViewLocalDetails struct {
-	LocalName string `json:"local_name"`
-}
-
-type DataSourceCleanRoomAssetRevisionsCleanRoomAssetsRevisionsVolumeLocalDetails struct {
-	LocalName string `json:"local_name"`
-}
-
-type DataSourceCleanRoomAssetRevisionsCleanRoomAssetsRevisions struct {
-	AddedAt                  int                                                                                `json:"added_at,omitempty"`
-	AssetType                string                                                                             `json:"asset_type"`
-	CleanRoomName            string                                                                             `json:"clean_room_name,omitempty"`
-	ForeignTable             *DataSourceCleanRoomAssetRevisionsCleanRoomAssetsRevisionsForeignTable             `json:"foreign_table,omitempty"`
-	ForeignTableLocalDetails *DataSourceCleanRoomAssetRevisionsCleanRoomAssetsRevisionsForeignTableLocalDetails `json:"foreign_table_local_details,omitempty"`
-	Name                     string                                                                             `json:"name"`
-	Notebook                 *DataSourceCleanRoomAssetRevisionsCleanRoomAssetsRevisionsNotebook                 `json:"notebook,omitempty"`
-	OwnerCollaboratorAlias   string                                                                             `json:"owner_collaborator_alias,omitempty"`
-	Status                   string                                                                             `json:"status,omitempty"`
-	Table                    *DataSourceCleanRoomAssetRevisionsCleanRoomAssetsRevisionsTable                    `json:"table,omitempty"`
-	TableLocalDetails        *DataSourceCleanRoomAssetRevisionsCleanRoomAssetsRevisionsTableLocalDetails        `json:"table_local_details,omitempty"`
-	View                     *DataSourceCleanRoomAssetRevisionsCleanRoomAssetsRevisionsView                     `json:"view,omitempty"`
-	ViewLocalDetails         *DataSourceCleanRoomAssetRevisionsCleanRoomAssetsRevisionsViewLocalDetails         `json:"view_local_details,omitempty"`
-	VolumeLocalDetails       *DataSourceCleanRoomAssetRevisionsCleanRoomAssetsRevisionsVolumeLocalDetails       `json:"volume_local_details,omitempty"`
-}
-
-type DataSourceCleanRoomAssetRevisionsCleanRoomAssets struct {
-	Name        string                                                      `json:"name"`
-	Revisions   []DataSourceCleanRoomAssetRevisionsCleanRoomAssetsRevisions `json:"revisions,omitempty"`
-	WorkspaceId string                                                      `json:"workspace_id,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_clean_room_assets.go b/bundle/internal/tf/schema/data_source_clean_room_assets.go
deleted file mode 100644
index 06c2b5697ad..00000000000
--- a/bundle/internal/tf/schema/data_source_clean_room_assets.go
+++ /dev/null
@@ -1,142 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceCleanRoomAssetsAssetsForeignTableColumnsMask struct {
-	FunctionName     string   `json:"function_name,omitempty"`
-	UsingColumnNames []string `json:"using_column_names,omitempty"`
-}
-
-type DataSourceCleanRoomAssetsAssetsForeignTableColumns struct {
-	Comment          string                                                  `json:"comment,omitempty"`
-	Mask             *DataSourceCleanRoomAssetsAssetsForeignTableColumnsMask `json:"mask,omitempty"`
-	Name             string                                                  `json:"name,omitempty"`
-	Nullable         bool                                                    `json:"nullable,omitempty"`
-	PartitionIndex   int                                                     `json:"partition_index,omitempty"`
-	Position         int                                                     `json:"position,omitempty"`
-	TypeIntervalType string                                                  `json:"type_interval_type,omitempty"`
-	TypeJson         string                                                  `json:"type_json,omitempty"`
-	TypeName         string                                                  `json:"type_name,omitempty"`
-	TypePrecision    int                                                     `json:"type_precision,omitempty"`
-	TypeScale        int                                                     `json:"type_scale,omitempty"`
-	TypeText         string                                                  `json:"type_text,omitempty"`
-}
-
-type DataSourceCleanRoomAssetsAssetsForeignTable struct {
-	Columns []DataSourceCleanRoomAssetsAssetsForeignTableColumns `json:"columns,omitempty"`
-}
-
-type DataSourceCleanRoomAssetsAssetsForeignTableLocalDetails struct {
-	LocalName string `json:"local_name"`
-}
-
-type DataSourceCleanRoomAssetsAssetsNotebookReviews struct {
-	Comment                   string `json:"comment,omitempty"`
-	CreatedAtMillis           int    `json:"created_at_millis,omitempty"`
-	ReviewState               string `json:"review_state,omitempty"`
-	ReviewSubReason           string `json:"review_sub_reason,omitempty"`
-	ReviewerCollaboratorAlias string `json:"reviewer_collaborator_alias,omitempty"`
-}
-
-type DataSourceCleanRoomAssetsAssetsNotebook struct {
-	Etag                      string                                           `json:"etag,omitempty"`
-	NotebookContent           string                                           `json:"notebook_content"`
-	ReviewState               string                                           `json:"review_state,omitempty"`
-	Reviews                   []DataSourceCleanRoomAssetsAssetsNotebookReviews `json:"reviews,omitempty"`
-	RunnerCollaboratorAliases []string                                         `json:"runner_collaborator_aliases,omitempty"`
-}
-
-type DataSourceCleanRoomAssetsAssetsTableColumnsMask struct {
-	FunctionName     string   `json:"function_name,omitempty"`
-	UsingColumnNames []string `json:"using_column_names,omitempty"`
-}
-
-type DataSourceCleanRoomAssetsAssetsTableColumns struct {
-	Comment          string                                           `json:"comment,omitempty"`
-	Mask             *DataSourceCleanRoomAssetsAssetsTableColumnsMask `json:"mask,omitempty"`
-	Name             string                                           `json:"name,omitempty"`
-	Nullable         bool                                             `json:"nullable,omitempty"`
-	PartitionIndex   int                                              `json:"partition_index,omitempty"`
-	Position         int                                              `json:"position,omitempty"`
-	TypeIntervalType string                                           `json:"type_interval_type,omitempty"`
-	TypeJson         string                                           `json:"type_json,omitempty"`
-	TypeName         string                                           `json:"type_name,omitempty"`
-	TypePrecision    int                                              `json:"type_precision,omitempty"`
-	TypeScale        int                                              `json:"type_scale,omitempty"`
-	TypeText         string                                           `json:"type_text,omitempty"`
-}
-
-type DataSourceCleanRoomAssetsAssetsTable struct {
-	Columns []DataSourceCleanRoomAssetsAssetsTableColumns `json:"columns,omitempty"`
-}
-
-type DataSourceCleanRoomAssetsAssetsTableLocalDetailsPartitionsValue struct {
-	Name                 string `json:"name,omitempty"`
-	Op                   string `json:"op,omitempty"`
-	RecipientPropertyKey string `json:"recipient_property_key,omitempty"`
-	Value                string `json:"value,omitempty"`
-}
-
-type DataSourceCleanRoomAssetsAssetsTableLocalDetailsPartitions struct {
-	Value []DataSourceCleanRoomAssetsAssetsTableLocalDetailsPartitionsValue `json:"value,omitempty"`
-}
-
-type DataSourceCleanRoomAssetsAssetsTableLocalDetails struct {
-	LocalName  string                                                       `json:"local_name"`
-	Partitions []DataSourceCleanRoomAssetsAssetsTableLocalDetailsPartitions `json:"partitions,omitempty"`
-}
-
-type DataSourceCleanRoomAssetsAssetsViewColumnsMask struct {
-	FunctionName     string   `json:"function_name,omitempty"`
-	UsingColumnNames []string `json:"using_column_names,omitempty"`
-}
-
-type DataSourceCleanRoomAssetsAssetsViewColumns struct {
-	Comment          string                                          `json:"comment,omitempty"`
-	Mask             *DataSourceCleanRoomAssetsAssetsViewColumnsMask `json:"mask,omitempty"`
-	Name             string                                          `json:"name,omitempty"`
-	Nullable         bool                                            `json:"nullable,omitempty"`
-	PartitionIndex   int                                             `json:"partition_index,omitempty"`
-	Position         int                                             `json:"position,omitempty"`
-	TypeIntervalType string                                          `json:"type_interval_type,omitempty"`
-	TypeJson         string                                          `json:"type_json,omitempty"`
-	TypeName         string                                          `json:"type_name,omitempty"`
-	TypePrecision    int                                             `json:"type_precision,omitempty"`
-	TypeScale        int                                             `json:"type_scale,omitempty"`
-	TypeText         string                                          `json:"type_text,omitempty"`
-}
-
-type DataSourceCleanRoomAssetsAssetsView struct {
-	Columns []DataSourceCleanRoomAssetsAssetsViewColumns `json:"columns,omitempty"`
-}
-
-type DataSourceCleanRoomAssetsAssetsViewLocalDetails struct {
-	LocalName string `json:"local_name"`
-}
-
-type DataSourceCleanRoomAssetsAssetsVolumeLocalDetails struct {
-	LocalName string `json:"local_name"`
-}
-
-type DataSourceCleanRoomAssetsAssets struct {
-	AddedAt                  int                                                      `json:"added_at,omitempty"`
-	AssetType                string                                                   `json:"asset_type"`
-	CleanRoomName            string                                                   `json:"clean_room_name,omitempty"`
-	ForeignTable             *DataSourceCleanRoomAssetsAssetsForeignTable             `json:"foreign_table,omitempty"`
-	ForeignTableLocalDetails *DataSourceCleanRoomAssetsAssetsForeignTableLocalDetails `json:"foreign_table_local_details,omitempty"`
-	Name                     string                                                   `json:"name"`
-	Notebook                 *DataSourceCleanRoomAssetsAssetsNotebook                 `json:"notebook,omitempty"`
-	OwnerCollaboratorAlias   string                                                   `json:"owner_collaborator_alias,omitempty"`
-	Status                   string                                                   `json:"status,omitempty"`
-	Table                    *DataSourceCleanRoomAssetsAssetsTable                    `json:"table,omitempty"`
-	TableLocalDetails        *DataSourceCleanRoomAssetsAssetsTableLocalDetails        `json:"table_local_details,omitempty"`
-	View                     *DataSourceCleanRoomAssetsAssetsView                     `json:"view,omitempty"`
-	ViewLocalDetails         *DataSourceCleanRoomAssetsAssetsViewLocalDetails         `json:"view_local_details,omitempty"`
-	VolumeLocalDetails       *DataSourceCleanRoomAssetsAssetsVolumeLocalDetails       `json:"volume_local_details,omitempty"`
-}
-
-type DataSourceCleanRoomAssets struct {
-	Assets        []DataSourceCleanRoomAssetsAssets `json:"assets,omitempty"`
-	CleanRoomName string                            `json:"clean_room_name"`
-	WorkspaceId   string                            `json:"workspace_id,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_clean_room_auto_approval_rule.go b/bundle/internal/tf/schema/data_source_clean_room_auto_approval_rule.go
deleted file mode 100644
index 7d4d29cbece..00000000000
--- a/bundle/internal/tf/schema/data_source_clean_room_auto_approval_rule.go
+++ /dev/null
@@ -1,14 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceCleanRoomAutoApprovalRule struct {
-	AuthorCollaboratorAlias    string `json:"author_collaborator_alias,omitempty"`
-	AuthorScope                string `json:"author_scope,omitempty"`
-	CleanRoomName              string `json:"clean_room_name,omitempty"`
-	CreatedAt                  int    `json:"created_at,omitempty"`
-	RuleId                     string `json:"rule_id,omitempty"`
-	RuleOwnerCollaboratorAlias string `json:"rule_owner_collaborator_alias,omitempty"`
-	RunnerCollaboratorAlias    string `json:"runner_collaborator_alias,omitempty"`
-	WorkspaceId                string `json:"workspace_id,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_clean_room_auto_approval_rules.go b/bundle/internal/tf/schema/data_source_clean_room_auto_approval_rules.go
deleted file mode 100644
index 19bfb2cdd8d..00000000000
--- a/bundle/internal/tf/schema/data_source_clean_room_auto_approval_rules.go
+++ /dev/null
@@ -1,18 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceCleanRoomAutoApprovalRulesRules struct {
-	AuthorCollaboratorAlias    string `json:"author_collaborator_alias,omitempty"`
-	AuthorScope                string `json:"author_scope,omitempty"`
-	CleanRoomName              string `json:"clean_room_name,omitempty"`
-	CreatedAt                  int    `json:"created_at,omitempty"`
-	RuleId                     string `json:"rule_id,omitempty"`
-	RuleOwnerCollaboratorAlias string `json:"rule_owner_collaborator_alias,omitempty"`
-	RunnerCollaboratorAlias    string `json:"runner_collaborator_alias,omitempty"`
-}
-
-type DataSourceCleanRoomAutoApprovalRules struct {
-	Rules       []DataSourceCleanRoomAutoApprovalRulesRules `json:"rules,omitempty"`
-	WorkspaceId string                                      `json:"workspace_id,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_clean_rooms_clean_room.go b/bundle/internal/tf/schema/data_source_clean_rooms_clean_room.go
deleted file mode 100644
index 3b301c620f1..00000000000
--- a/bundle/internal/tf/schema/data_source_clean_rooms_clean_room.go
+++ /dev/null
@@ -1,88 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceCleanRoomsCleanRoomOutputCatalog struct {
-	CatalogName string `json:"catalog_name,omitempty"`
-	Status      string `json:"status,omitempty"`
-}
-
-type DataSourceCleanRoomsCleanRoomRemoteDetailedInfoCollaborators struct {
-	CollaboratorAlias          string `json:"collaborator_alias"`
-	DisplayName                string `json:"display_name,omitempty"`
-	GlobalMetastoreId          string `json:"global_metastore_id,omitempty"`
-	InviteRecipientEmail       string `json:"invite_recipient_email,omitempty"`
-	InviteRecipientWorkspaceId int    `json:"invite_recipient_workspace_id,omitempty"`
-	OrganizationName           string `json:"organization_name,omitempty"`
-}
-
-type DataSourceCleanRoomsCleanRoomRemoteDetailedInfoComplianceSecurityProfile struct {
-	ComplianceStandards []string `json:"compliance_standards,omitempty"`
-	IsEnabled           bool     `json:"is_enabled,omitempty"`
-}
-
-type DataSourceCleanRoomsCleanRoomRemoteDetailedInfoCreator struct {
-	CollaboratorAlias          string `json:"collaborator_alias"`
-	DisplayName                string `json:"display_name,omitempty"`
-	GlobalMetastoreId          string `json:"global_metastore_id,omitempty"`
-	InviteRecipientEmail       string `json:"invite_recipient_email,omitempty"`
-	InviteRecipientWorkspaceId int    `json:"invite_recipient_workspace_id,omitempty"`
-	OrganizationName           string `json:"organization_name,omitempty"`
-}
-
-type DataSourceCleanRoomsCleanRoomRemoteDetailedInfoEgressNetworkPolicyInternetAccessAllowedInternetDestinations struct {
-	Destination string `json:"destination,omitempty"`
-	Protocol    string `json:"protocol,omitempty"`
-	Type        string `json:"type,omitempty"`
-}
-
-type DataSourceCleanRoomsCleanRoomRemoteDetailedInfoEgressNetworkPolicyInternetAccessAllowedStorageDestinations struct {
-	AllowedPaths        []string `json:"allowed_paths,omitempty"`
-	AzureContainer      string   `json:"azure_container,omitempty"`
-	AzureDnsZone        string   `json:"azure_dns_zone,omitempty"`
-	AzureStorageAccount string   `json:"azure_storage_account,omitempty"`
-	AzureStorageService string   `json:"azure_storage_service,omitempty"`
-	BucketName          string   `json:"bucket_name,omitempty"`
-	Region              string   `json:"region,omitempty"`
-	Type                string   `json:"type,omitempty"`
-}
-
-type DataSourceCleanRoomsCleanRoomRemoteDetailedInfoEgressNetworkPolicyInternetAccessLogOnlyMode struct {
-	LogOnlyModeType string   `json:"log_only_mode_type,omitempty"`
-	Workloads       []string `json:"workloads,omitempty"`
-}
-
-type DataSourceCleanRoomsCleanRoomRemoteDetailedInfoEgressNetworkPolicyInternetAccess struct {
-	AllowedInternetDestinations []DataSourceCleanRoomsCleanRoomRemoteDetailedInfoEgressNetworkPolicyInternetAccessAllowedInternetDestinations `json:"allowed_internet_destinations,omitempty"`
-	AllowedStorageDestinations  []DataSourceCleanRoomsCleanRoomRemoteDetailedInfoEgressNetworkPolicyInternetAccessAllowedStorageDestinations  `json:"allowed_storage_destinations,omitempty"`
-	LogOnlyMode                 *DataSourceCleanRoomsCleanRoomRemoteDetailedInfoEgressNetworkPolicyInternetAccessLogOnlyMode                  `json:"log_only_mode,omitempty"`
-	RestrictionMode             string                                                                                                        `json:"restriction_mode,omitempty"`
-}
-
-type DataSourceCleanRoomsCleanRoomRemoteDetailedInfoEgressNetworkPolicy struct {
-	InternetAccess *DataSourceCleanRoomsCleanRoomRemoteDetailedInfoEgressNetworkPolicyInternetAccess `json:"internet_access,omitempty"`
-}
-
-type DataSourceCleanRoomsCleanRoomRemoteDetailedInfo struct {
-	CentralCleanRoomId        string                                                                    `json:"central_clean_room_id,omitempty"`
-	CloudVendor               string                                                                    `json:"cloud_vendor,omitempty"`
-	Collaborators             []DataSourceCleanRoomsCleanRoomRemoteDetailedInfoCollaborators            `json:"collaborators,omitempty"`
-	ComplianceSecurityProfile *DataSourceCleanRoomsCleanRoomRemoteDetailedInfoComplianceSecurityProfile `json:"compliance_security_profile,omitempty"`
-	Creator                   *DataSourceCleanRoomsCleanRoomRemoteDetailedInfoCreator                   `json:"creator,omitempty"`
-	EgressNetworkPolicy       *DataSourceCleanRoomsCleanRoomRemoteDetailedInfoEgressNetworkPolicy       `json:"egress_network_policy,omitempty"`
-	Region                    string                                                                    `json:"region,omitempty"`
-}
-
-type DataSourceCleanRoomsCleanRoom struct {
-	AccessRestricted       string                                           `json:"access_restricted,omitempty"`
-	Comment                string                                           `json:"comment,omitempty"`
-	CreatedAt              int                                              `json:"created_at,omitempty"`
-	LocalCollaboratorAlias string                                           `json:"local_collaborator_alias,omitempty"`
-	Name                   string                                           `json:"name,omitempty"`
-	OutputCatalog          *DataSourceCleanRoomsCleanRoomOutputCatalog      `json:"output_catalog,omitempty"`
-	Owner                  string                                           `json:"owner,omitempty"`
-	RemoteDetailedInfo     *DataSourceCleanRoomsCleanRoomRemoteDetailedInfo `json:"remote_detailed_info,omitempty"`
-	Status                 string                                           `json:"status,omitempty"`
-	UpdatedAt              int                                              `json:"updated_at,omitempty"`
-	WorkspaceId            string                                           `json:"workspace_id,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_clean_rooms_clean_rooms.go b/bundle/internal/tf/schema/data_source_clean_rooms_clean_rooms.go
deleted file mode 100644
index 413d2f91a46..00000000000
--- a/bundle/internal/tf/schema/data_source_clean_rooms_clean_rooms.go
+++ /dev/null
@@ -1,92 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceCleanRoomsCleanRoomsCleanRoomsOutputCatalog struct {
-	CatalogName string `json:"catalog_name,omitempty"`
-	Status      string `json:"status,omitempty"`
-}
-
-type DataSourceCleanRoomsCleanRoomsCleanRoomsRemoteDetailedInfoCollaborators struct {
-	CollaboratorAlias          string `json:"collaborator_alias"`
-	DisplayName                string `json:"display_name,omitempty"`
-	GlobalMetastoreId          string `json:"global_metastore_id,omitempty"`
-	InviteRecipientEmail       string `json:"invite_recipient_email,omitempty"`
-	InviteRecipientWorkspaceId int    `json:"invite_recipient_workspace_id,omitempty"`
-	OrganizationName           string `json:"organization_name,omitempty"`
-}
-
-type DataSourceCleanRoomsCleanRoomsCleanRoomsRemoteDetailedInfoComplianceSecurityProfile struct {
-	ComplianceStandards []string `json:"compliance_standards,omitempty"`
-	IsEnabled           bool     `json:"is_enabled,omitempty"`
-}
-
-type DataSourceCleanRoomsCleanRoomsCleanRoomsRemoteDetailedInfoCreator struct {
-	CollaboratorAlias          string `json:"collaborator_alias"`
-	DisplayName                string `json:"display_name,omitempty"`
-	GlobalMetastoreId          string `json:"global_metastore_id,omitempty"`
-	InviteRecipientEmail       string `json:"invite_recipient_email,omitempty"`
-	InviteRecipientWorkspaceId int    `json:"invite_recipient_workspace_id,omitempty"`
-	OrganizationName           string `json:"organization_name,omitempty"`
-}
-
-type DataSourceCleanRoomsCleanRoomsCleanRoomsRemoteDetailedInfoEgressNetworkPolicyInternetAccessAllowedInternetDestinations struct {
-	Destination string `json:"destination,omitempty"`
-	Protocol    string `json:"protocol,omitempty"`
-	Type        string `json:"type,omitempty"`
-}
-
-type DataSourceCleanRoomsCleanRoomsCleanRoomsRemoteDetailedInfoEgressNetworkPolicyInternetAccessAllowedStorageDestinations struct {
-	AllowedPaths        []string `json:"allowed_paths,omitempty"`
-	AzureContainer      string   `json:"azure_container,omitempty"`
-	AzureDnsZone        string   `json:"azure_dns_zone,omitempty"`
-	AzureStorageAccount string   `json:"azure_storage_account,omitempty"`
-	AzureStorageService string   `json:"azure_storage_service,omitempty"`
-	BucketName          string   `json:"bucket_name,omitempty"`
-	Region              string   `json:"region,omitempty"`
-	Type                string   `json:"type,omitempty"`
-}
-
-type DataSourceCleanRoomsCleanRoomsCleanRoomsRemoteDetailedInfoEgressNetworkPolicyInternetAccessLogOnlyMode struct {
-	LogOnlyModeType string   `json:"log_only_mode_type,omitempty"`
-	Workloads       []string `json:"workloads,omitempty"`
-}
-
-type DataSourceCleanRoomsCleanRoomsCleanRoomsRemoteDetailedInfoEgressNetworkPolicyInternetAccess struct {
-	AllowedInternetDestinations []DataSourceCleanRoomsCleanRoomsCleanRoomsRemoteDetailedInfoEgressNetworkPolicyInternetAccessAllowedInternetDestinations `json:"allowed_internet_destinations,omitempty"`
-	AllowedStorageDestinations  []DataSourceCleanRoomsCleanRoomsCleanRoomsRemoteDetailedInfoEgressNetworkPolicyInternetAccessAllowedStorageDestinations  `json:"allowed_storage_destinations,omitempty"`
-	LogOnlyMode                 *DataSourceCleanRoomsCleanRoomsCleanRoomsRemoteDetailedInfoEgressNetworkPolicyInternetAccessLogOnlyMode                  `json:"log_only_mode,omitempty"`
-	RestrictionMode             string                                                                                                                   `json:"restriction_mode,omitempty"`
-}
-
-type DataSourceCleanRoomsCleanRoomsCleanRoomsRemoteDetailedInfoEgressNetworkPolicy struct {
-	InternetAccess *DataSourceCleanRoomsCleanRoomsCleanRoomsRemoteDetailedInfoEgressNetworkPolicyInternetAccess `json:"internet_access,omitempty"`
-}
-
-type DataSourceCleanRoomsCleanRoomsCleanRoomsRemoteDetailedInfo struct {
-	CentralCleanRoomId        string                                                                               `json:"central_clean_room_id,omitempty"`
-	CloudVendor               string                                                                               `json:"cloud_vendor,omitempty"`
-	Collaborators             []DataSourceCleanRoomsCleanRoomsCleanRoomsRemoteDetailedInfoCollaborators            `json:"collaborators,omitempty"`
-	ComplianceSecurityProfile *DataSourceCleanRoomsCleanRoomsCleanRoomsRemoteDetailedInfoComplianceSecurityProfile `json:"compliance_security_profile,omitempty"`
-	Creator                   *DataSourceCleanRoomsCleanRoomsCleanRoomsRemoteDetailedInfoCreator                   `json:"creator,omitempty"`
-	EgressNetworkPolicy       *DataSourceCleanRoomsCleanRoomsCleanRoomsRemoteDetailedInfoEgressNetworkPolicy       `json:"egress_network_policy,omitempty"`
-	Region                    string                                                                               `json:"region,omitempty"`
-}
-
-type DataSourceCleanRoomsCleanRoomsCleanRooms struct {
-	AccessRestricted       string                                                      `json:"access_restricted,omitempty"`
-	Comment                string                                                      `json:"comment,omitempty"`
-	CreatedAt              int                                                         `json:"created_at,omitempty"`
-	LocalCollaboratorAlias string                                                      `json:"local_collaborator_alias,omitempty"`
-	Name                   string                                                      `json:"name,omitempty"`
-	OutputCatalog          *DataSourceCleanRoomsCleanRoomsCleanRoomsOutputCatalog      `json:"output_catalog,omitempty"`
-	Owner                  string                                                      `json:"owner,omitempty"`
-	RemoteDetailedInfo     *DataSourceCleanRoomsCleanRoomsCleanRoomsRemoteDetailedInfo `json:"remote_detailed_info,omitempty"`
-	Status                 string                                                      `json:"status,omitempty"`
-	UpdatedAt              int                                                         `json:"updated_at,omitempty"`
-}
-
-type DataSourceCleanRoomsCleanRooms struct {
-	CleanRooms  []DataSourceCleanRoomsCleanRoomsCleanRooms `json:"clean_rooms,omitempty"`
-	WorkspaceId string                                     `json:"workspace_id,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_cluster.go b/bundle/internal/tf/schema/data_source_cluster.go
deleted file mode 100644
index b3f7d3a2d44..00000000000
--- a/bundle/internal/tf/schema/data_source_cluster.go
+++ /dev/null
@@ -1,466 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceClusterClusterInfoAutoscale struct {
-	MaxWorkers int `json:"max_workers,omitempty"`
-	MinWorkers int `json:"min_workers,omitempty"`
-}
-
-type DataSourceClusterClusterInfoAwsAttributes struct {
-	Availability        string `json:"availability,omitempty"`
-	EbsVolumeCount      int    `json:"ebs_volume_count,omitempty"`
-	EbsVolumeIops       int    `json:"ebs_volume_iops,omitempty"`
-	EbsVolumeSize       int    `json:"ebs_volume_size,omitempty"`
-	EbsVolumeThroughput int    `json:"ebs_volume_throughput,omitempty"`
-	EbsVolumeType       string `json:"ebs_volume_type,omitempty"`
-	FirstOnDemand       int    `json:"first_on_demand,omitempty"`
-	InstanceProfileArn  string `json:"instance_profile_arn,omitempty"`
-	SpotBidPricePercent int    `json:"spot_bid_price_percent,omitempty"`
-	ZoneId              string `json:"zone_id,omitempty"`
-}
-
-type DataSourceClusterClusterInfoAzureAttributesLogAnalyticsInfo struct {
-	LogAnalyticsPrimaryKey  string `json:"log_analytics_primary_key,omitempty"`
-	LogAnalyticsWorkspaceId string `json:"log_analytics_workspace_id,omitempty"`
-}
-
-type DataSourceClusterClusterInfoAzureAttributes struct {
-	Availability     string                                                       `json:"availability,omitempty"`
-	FirstOnDemand    int                                                          `json:"first_on_demand,omitempty"`
-	SpotBidMaxPrice  int                                                          `json:"spot_bid_max_price,omitempty"`
-	LogAnalyticsInfo *DataSourceClusterClusterInfoAzureAttributesLogAnalyticsInfo `json:"log_analytics_info,omitempty"`
-}
-
-type DataSourceClusterClusterInfoClusterLogConfDbfs struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceClusterClusterInfoClusterLogConfS3 struct {
-	CannedAcl        string `json:"canned_acl,omitempty"`
-	Destination      string `json:"destination"`
-	EnableEncryption bool   `json:"enable_encryption,omitempty"`
-	EncryptionType   string `json:"encryption_type,omitempty"`
-	Endpoint         string `json:"endpoint,omitempty"`
-	KmsKey           string `json:"kms_key,omitempty"`
-	Region           string `json:"region,omitempty"`
-}
-
-type DataSourceClusterClusterInfoClusterLogConfVolumes struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceClusterClusterInfoClusterLogConf struct {
-	Dbfs    *DataSourceClusterClusterInfoClusterLogConfDbfs    `json:"dbfs,omitempty"`
-	S3      *DataSourceClusterClusterInfoClusterLogConfS3      `json:"s3,omitempty"`
-	Volumes *DataSourceClusterClusterInfoClusterLogConfVolumes `json:"volumes,omitempty"`
-}
-
-type DataSourceClusterClusterInfoClusterLogStatus struct {
-	LastAttempted int    `json:"last_attempted,omitempty"`
-	LastException string `json:"last_exception,omitempty"`
-}
-
-type DataSourceClusterClusterInfoDockerImageBasicAuth struct {
-	Password string `json:"password,omitempty"`
-	Username string `json:"username,omitempty"`
-}
-
-type DataSourceClusterClusterInfoDockerImage struct {
-	Url       string                                            `json:"url,omitempty"`
-	BasicAuth *DataSourceClusterClusterInfoDockerImageBasicAuth `json:"basic_auth,omitempty"`
-}
-
-type DataSourceClusterClusterInfoDriverNodeAwsAttributes struct {
-	IsSpot bool `json:"is_spot,omitempty"`
-}
-
-type DataSourceClusterClusterInfoDriver struct {
-	HostPrivateIp     string                                               `json:"host_private_ip,omitempty"`
-	InstanceId        string                                               `json:"instance_id,omitempty"`
-	NodeId            string                                               `json:"node_id,omitempty"`
-	PrivateIp         string                                               `json:"private_ip,omitempty"`
-	PublicDns         string                                               `json:"public_dns,omitempty"`
-	StartTimestamp    int                                                  `json:"start_timestamp,omitempty"`
-	NodeAwsAttributes *DataSourceClusterClusterInfoDriverNodeAwsAttributes `json:"node_aws_attributes,omitempty"`
-}
-
-type DataSourceClusterClusterInfoDriverNodeTypeFlexibility struct {
-	AlternateNodeTypeIds []string `json:"alternate_node_type_ids,omitempty"`
-}
-
-type DataSourceClusterClusterInfoExecutorsNodeAwsAttributes struct {
-	IsSpot bool `json:"is_spot,omitempty"`
-}
-
-type DataSourceClusterClusterInfoExecutors struct {
-	HostPrivateIp     string                                                  `json:"host_private_ip,omitempty"`
-	InstanceId        string                                                  `json:"instance_id,omitempty"`
-	NodeId            string                                                  `json:"node_id,omitempty"`
-	PrivateIp         string                                                  `json:"private_ip,omitempty"`
-	PublicDns         string                                                  `json:"public_dns,omitempty"`
-	StartTimestamp    int                                                     `json:"start_timestamp,omitempty"`
-	NodeAwsAttributes *DataSourceClusterClusterInfoExecutorsNodeAwsAttributes `json:"node_aws_attributes,omitempty"`
-}
-
-type DataSourceClusterClusterInfoGcpAttributes struct {
-	Availability            string `json:"availability,omitempty"`
-	BootDiskSize            int    `json:"boot_disk_size,omitempty"`
-	FirstOnDemand           int    `json:"first_on_demand,omitempty"`
-	GoogleServiceAccount    string `json:"google_service_account,omitempty"`
-	LocalSsdCount           int    `json:"local_ssd_count,omitempty"`
-	UsePreemptibleExecutors bool   `json:"use_preemptible_executors,omitempty"`
-	ZoneId                  string `json:"zone_id,omitempty"`
-}
-
-type DataSourceClusterClusterInfoInitScriptsAbfss struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceClusterClusterInfoInitScriptsDbfs struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceClusterClusterInfoInitScriptsFile struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceClusterClusterInfoInitScriptsGcs struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceClusterClusterInfoInitScriptsS3 struct {
-	CannedAcl        string `json:"canned_acl,omitempty"`
-	Destination      string `json:"destination"`
-	EnableEncryption bool   `json:"enable_encryption,omitempty"`
-	EncryptionType   string `json:"encryption_type,omitempty"`
-	Endpoint         string `json:"endpoint,omitempty"`
-	KmsKey           string `json:"kms_key,omitempty"`
-	Region           string `json:"region,omitempty"`
-}
-
-type DataSourceClusterClusterInfoInitScriptsVolumes struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceClusterClusterInfoInitScriptsWorkspace struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceClusterClusterInfoInitScripts struct {
-	Abfss     *DataSourceClusterClusterInfoInitScriptsAbfss     `json:"abfss,omitempty"`
-	Dbfs      *DataSourceClusterClusterInfoInitScriptsDbfs      `json:"dbfs,omitempty"`
-	File      *DataSourceClusterClusterInfoInitScriptsFile      `json:"file,omitempty"`
-	Gcs       *DataSourceClusterClusterInfoInitScriptsGcs       `json:"gcs,omitempty"`
-	S3        *DataSourceClusterClusterInfoInitScriptsS3        `json:"s3,omitempty"`
-	Volumes   *DataSourceClusterClusterInfoInitScriptsVolumes   `json:"volumes,omitempty"`
-	Workspace *DataSourceClusterClusterInfoInitScriptsWorkspace `json:"workspace,omitempty"`
-}
-
-type DataSourceClusterClusterInfoSpecAutoscale struct {
-	MaxWorkers int `json:"max_workers,omitempty"`
-	MinWorkers int `json:"min_workers,omitempty"`
-}
-
-type DataSourceClusterClusterInfoSpecAwsAttributes struct {
-	Availability        string `json:"availability,omitempty"`
-	EbsVolumeCount      int    `json:"ebs_volume_count,omitempty"`
-	EbsVolumeIops       int    `json:"ebs_volume_iops,omitempty"`
-	EbsVolumeSize       int    `json:"ebs_volume_size,omitempty"`
-	EbsVolumeThroughput int    `json:"ebs_volume_throughput,omitempty"`
-	EbsVolumeType       string `json:"ebs_volume_type,omitempty"`
-	FirstOnDemand       int    `json:"first_on_demand,omitempty"`
-	InstanceProfileArn  string `json:"instance_profile_arn,omitempty"`
-	SpotBidPricePercent int    `json:"spot_bid_price_percent,omitempty"`
-	ZoneId              string `json:"zone_id,omitempty"`
-}
-
-type DataSourceClusterClusterInfoSpecAzureAttributesLogAnalyticsInfo struct {
-	LogAnalyticsPrimaryKey  string `json:"log_analytics_primary_key,omitempty"`
-	LogAnalyticsWorkspaceId string `json:"log_analytics_workspace_id,omitempty"`
-}
-
-type DataSourceClusterClusterInfoSpecAzureAttributes struct {
-	Availability     string                                                           `json:"availability,omitempty"`
-	FirstOnDemand    int                                                              `json:"first_on_demand,omitempty"`
-	SpotBidMaxPrice  int                                                              `json:"spot_bid_max_price,omitempty"`
-	LogAnalyticsInfo *DataSourceClusterClusterInfoSpecAzureAttributesLogAnalyticsInfo `json:"log_analytics_info,omitempty"`
-}
-
-type DataSourceClusterClusterInfoSpecClusterLogConfDbfs struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceClusterClusterInfoSpecClusterLogConfS3 struct {
-	CannedAcl        string `json:"canned_acl,omitempty"`
-	Destination      string `json:"destination"`
-	EnableEncryption bool   `json:"enable_encryption,omitempty"`
-	EncryptionType   string `json:"encryption_type,omitempty"`
-	Endpoint         string `json:"endpoint,omitempty"`
-	KmsKey           string `json:"kms_key,omitempty"`
-	Region           string `json:"region,omitempty"`
-}
-
-type DataSourceClusterClusterInfoSpecClusterLogConfVolumes struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceClusterClusterInfoSpecClusterLogConf struct {
-	Dbfs    *DataSourceClusterClusterInfoSpecClusterLogConfDbfs    `json:"dbfs,omitempty"`
-	S3      *DataSourceClusterClusterInfoSpecClusterLogConfS3      `json:"s3,omitempty"`
-	Volumes *DataSourceClusterClusterInfoSpecClusterLogConfVolumes `json:"volumes,omitempty"`
-}
-
-type DataSourceClusterClusterInfoSpecClusterMountInfoNetworkFilesystemInfo struct {
-	MountOptions  string `json:"mount_options,omitempty"`
-	ServerAddress string `json:"server_address"`
-}
-
-type DataSourceClusterClusterInfoSpecClusterMountInfo struct {
-	LocalMountDirPath     string                                                                 `json:"local_mount_dir_path"`
-	RemoteMountDirPath    string                                                                 `json:"remote_mount_dir_path,omitempty"`
-	NetworkFilesystemInfo *DataSourceClusterClusterInfoSpecClusterMountInfoNetworkFilesystemInfo `json:"network_filesystem_info,omitempty"`
-}
-
-type DataSourceClusterClusterInfoSpecDockerImageBasicAuth struct {
-	Password string `json:"password"`
-	Username string `json:"username"`
-}
-
-type DataSourceClusterClusterInfoSpecDockerImage struct {
-	Url       string                                                `json:"url"`
-	BasicAuth *DataSourceClusterClusterInfoSpecDockerImageBasicAuth `json:"basic_auth,omitempty"`
-}
-
-type DataSourceClusterClusterInfoSpecDriverNodeTypeFlexibility struct {
-	AlternateNodeTypeIds []string `json:"alternate_node_type_ids,omitempty"`
-}
-
-type DataSourceClusterClusterInfoSpecGcpAttributes struct {
-	Availability            string `json:"availability,omitempty"`
-	BootDiskSize            int    `json:"boot_disk_size,omitempty"`
-	FirstOnDemand           int    `json:"first_on_demand,omitempty"`
-	GoogleServiceAccount    string `json:"google_service_account,omitempty"`
-	LocalSsdCount           int    `json:"local_ssd_count,omitempty"`
-	UsePreemptibleExecutors bool   `json:"use_preemptible_executors,omitempty"`
-	ZoneId                  string `json:"zone_id,omitempty"`
-}
-
-type DataSourceClusterClusterInfoSpecInitScriptsAbfss struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceClusterClusterInfoSpecInitScriptsDbfs struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceClusterClusterInfoSpecInitScriptsFile struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceClusterClusterInfoSpecInitScriptsGcs struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceClusterClusterInfoSpecInitScriptsS3 struct {
-	CannedAcl        string `json:"canned_acl,omitempty"`
-	Destination      string `json:"destination"`
-	EnableEncryption bool   `json:"enable_encryption,omitempty"`
-	EncryptionType   string `json:"encryption_type,omitempty"`
-	Endpoint         string `json:"endpoint,omitempty"`
-	KmsKey           string `json:"kms_key,omitempty"`
-	Region           string `json:"region,omitempty"`
-}
-
-type DataSourceClusterClusterInfoSpecInitScriptsVolumes struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceClusterClusterInfoSpecInitScriptsWorkspace struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceClusterClusterInfoSpecInitScripts struct {
-	Abfss     *DataSourceClusterClusterInfoSpecInitScriptsAbfss     `json:"abfss,omitempty"`
-	Dbfs      *DataSourceClusterClusterInfoSpecInitScriptsDbfs      `json:"dbfs,omitempty"`
-	File      *DataSourceClusterClusterInfoSpecInitScriptsFile      `json:"file,omitempty"`
-	Gcs       *DataSourceClusterClusterInfoSpecInitScriptsGcs       `json:"gcs,omitempty"`
-	S3        *DataSourceClusterClusterInfoSpecInitScriptsS3        `json:"s3,omitempty"`
-	Volumes   *DataSourceClusterClusterInfoSpecInitScriptsVolumes   `json:"volumes,omitempty"`
-	Workspace *DataSourceClusterClusterInfoSpecInitScriptsWorkspace `json:"workspace,omitempty"`
-}
-
-type DataSourceClusterClusterInfoSpecLibraryCran struct {
-	Package string `json:"package"`
-	Repo    string `json:"repo,omitempty"`
-}
-
-type DataSourceClusterClusterInfoSpecLibraryMaven struct {
-	Coordinates string   `json:"coordinates"`
-	Exclusions  []string `json:"exclusions,omitempty"`
-	Repo        string   `json:"repo,omitempty"`
-}
-
-type DataSourceClusterClusterInfoSpecLibraryProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceClusterClusterInfoSpecLibraryPypi struct {
-	Package string `json:"package"`
-	Repo    string `json:"repo,omitempty"`
-}
-
-type DataSourceClusterClusterInfoSpecLibrary struct {
-	Egg            string                                                 `json:"egg,omitempty"`
-	Jar            string                                                 `json:"jar,omitempty"`
-	Requirements   string                                                 `json:"requirements,omitempty"`
-	Whl            string                                                 `json:"whl,omitempty"`
-	Cran           *DataSourceClusterClusterInfoSpecLibraryCran           `json:"cran,omitempty"`
-	Maven          *DataSourceClusterClusterInfoSpecLibraryMaven          `json:"maven,omitempty"`
-	ProviderConfig *DataSourceClusterClusterInfoSpecLibraryProviderConfig `json:"provider_config,omitempty"`
-	Pypi           *DataSourceClusterClusterInfoSpecLibraryPypi           `json:"pypi,omitempty"`
-}
-
-type DataSourceClusterClusterInfoSpecProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceClusterClusterInfoSpecWorkerNodeTypeFlexibility struct {
-	AlternateNodeTypeIds []string `json:"alternate_node_type_ids,omitempty"`
-}
-
-type DataSourceClusterClusterInfoSpecWorkloadTypeClients struct {
-	Jobs      bool `json:"jobs,omitempty"`
-	Notebooks bool `json:"notebooks,omitempty"`
-}
-
-type DataSourceClusterClusterInfoSpecWorkloadType struct {
-	Clients *DataSourceClusterClusterInfoSpecWorkloadTypeClients `json:"clients,omitempty"`
-}
-
-type DataSourceClusterClusterInfoSpec struct {
-	ApplyPolicyDefaultValues   bool                                                       `json:"apply_policy_default_values,omitempty"`
-	ClusterId                  string                                                     `json:"cluster_id,omitempty"`
-	ClusterName                string                                                     `json:"cluster_name,omitempty"`
-	CustomTags                 map[string]string                                          `json:"custom_tags,omitempty"`
-	DataSecurityMode           string                                                     `json:"data_security_mode,omitempty"`
-	DriverInstancePoolId       string                                                     `json:"driver_instance_pool_id,omitempty"`
-	DriverNodeTypeId           string                                                     `json:"driver_node_type_id,omitempty"`
-	EnableElasticDisk          bool                                                       `json:"enable_elastic_disk,omitempty"`
-	EnableLocalDiskEncryption  bool                                                       `json:"enable_local_disk_encryption,omitempty"`
-	IdempotencyToken           string                                                     `json:"idempotency_token,omitempty"`
-	InstancePoolId             string                                                     `json:"instance_pool_id,omitempty"`
-	IsSingleNode               bool                                                       `json:"is_single_node,omitempty"`
-	Kind                       string                                                     `json:"kind,omitempty"`
-	NodeTypeId                 string                                                     `json:"node_type_id,omitempty"`
-	NumWorkers                 int                                                        `json:"num_workers,omitempty"`
-	PolicyId                   string                                                     `json:"policy_id,omitempty"`
-	RemoteDiskThroughput       int                                                        `json:"remote_disk_throughput,omitempty"`
-	RuntimeEngine              string                                                     `json:"runtime_engine,omitempty"`
-	SingleUserName             string                                                     `json:"single_user_name,omitempty"`
-	SparkConf                  map[string]string                                          `json:"spark_conf,omitempty"`
-	SparkEnvVars               map[string]string                                          `json:"spark_env_vars,omitempty"`
-	SparkVersion               string                                                     `json:"spark_version,omitempty"`
-	SshPublicKeys              []string                                                   `json:"ssh_public_keys,omitempty"`
-	TotalInitialRemoteDiskSize int                                                        `json:"total_initial_remote_disk_size,omitempty"`
-	UseMlRuntime               bool                                                       `json:"use_ml_runtime,omitempty"`
-	Autoscale                  *DataSourceClusterClusterInfoSpecAutoscale                 `json:"autoscale,omitempty"`
-	AwsAttributes              *DataSourceClusterClusterInfoSpecAwsAttributes             `json:"aws_attributes,omitempty"`
-	AzureAttributes            *DataSourceClusterClusterInfoSpecAzureAttributes           `json:"azure_attributes,omitempty"`
-	ClusterLogConf             *DataSourceClusterClusterInfoSpecClusterLogConf            `json:"cluster_log_conf,omitempty"`
-	ClusterMountInfo           []DataSourceClusterClusterInfoSpecClusterMountInfo         `json:"cluster_mount_info,omitempty"`
-	DockerImage                *DataSourceClusterClusterInfoSpecDockerImage               `json:"docker_image,omitempty"`
-	DriverNodeTypeFlexibility  *DataSourceClusterClusterInfoSpecDriverNodeTypeFlexibility `json:"driver_node_type_flexibility,omitempty"`
-	GcpAttributes              *DataSourceClusterClusterInfoSpecGcpAttributes             `json:"gcp_attributes,omitempty"`
-	InitScripts                []DataSourceClusterClusterInfoSpecInitScripts              `json:"init_scripts,omitempty"`
-	Library                    []DataSourceClusterClusterInfoSpecLibrary                  `json:"library,omitempty"`
-	ProviderConfig             *DataSourceClusterClusterInfoSpecProviderConfig            `json:"provider_config,omitempty"`
-	WorkerNodeTypeFlexibility  *DataSourceClusterClusterInfoSpecWorkerNodeTypeFlexibility `json:"worker_node_type_flexibility,omitempty"`
-	WorkloadType               *DataSourceClusterClusterInfoSpecWorkloadType              `json:"workload_type,omitempty"`
-}
-
-type DataSourceClusterClusterInfoTerminationReason struct {
-	Code       string            `json:"code,omitempty"`
-	Parameters map[string]string `json:"parameters,omitempty"`
-	Type       string            `json:"type,omitempty"`
-}
-
-type DataSourceClusterClusterInfoWorkerNodeTypeFlexibility struct {
-	AlternateNodeTypeIds []string `json:"alternate_node_type_ids,omitempty"`
-}
-
-type DataSourceClusterClusterInfoWorkloadTypeClients struct {
-	Jobs      bool `json:"jobs,omitempty"`
-	Notebooks bool `json:"notebooks,omitempty"`
-}
-
-type DataSourceClusterClusterInfoWorkloadType struct {
-	Clients *DataSourceClusterClusterInfoWorkloadTypeClients `json:"clients,omitempty"`
-}
-
-type DataSourceClusterClusterInfo struct {
-	AutoterminationMinutes     int                                                    `json:"autotermination_minutes,omitempty"`
-	ClusterCores               int                                                    `json:"cluster_cores,omitempty"`
-	ClusterId                  string                                                 `json:"cluster_id,omitempty"`
-	ClusterMemoryMb            int                                                    `json:"cluster_memory_mb,omitempty"`
-	ClusterName                string                                                 `json:"cluster_name,omitempty"`
-	ClusterSource              string                                                 `json:"cluster_source,omitempty"`
-	CreatorUserName            string                                                 `json:"creator_user_name,omitempty"`
-	CustomTags                 map[string]string                                      `json:"custom_tags,omitempty"`
-	DataSecurityMode           string                                                 `json:"data_security_mode,omitempty"`
-	DefaultTags                map[string]string                                      `json:"default_tags,omitempty"`
-	DriverInstancePoolId       string                                                 `json:"driver_instance_pool_id,omitempty"`
-	DriverNodeTypeId           string                                                 `json:"driver_node_type_id,omitempty"`
-	EnableElasticDisk          bool                                                   `json:"enable_elastic_disk,omitempty"`
-	EnableLocalDiskEncryption  bool                                                   `json:"enable_local_disk_encryption,omitempty"`
-	InstancePoolId             string                                                 `json:"instance_pool_id,omitempty"`
-	IsSingleNode               bool                                                   `json:"is_single_node,omitempty"`
-	JdbcPort                   int                                                    `json:"jdbc_port,omitempty"`
-	Kind                       string                                                 `json:"kind,omitempty"`
-	LastRestartedTime          int                                                    `json:"last_restarted_time,omitempty"`
-	LastStateLossTime          int                                                    `json:"last_state_loss_time,omitempty"`
-	NodeTypeId                 string                                                 `json:"node_type_id,omitempty"`
-	NumWorkers                 int                                                    `json:"num_workers,omitempty"`
-	PolicyId                   string                                                 `json:"policy_id,omitempty"`
-	RemoteDiskThroughput       int                                                    `json:"remote_disk_throughput,omitempty"`
-	RuntimeEngine              string                                                 `json:"runtime_engine,omitempty"`
-	SingleUserName             string                                                 `json:"single_user_name,omitempty"`
-	SparkConf                  map[string]string                                      `json:"spark_conf,omitempty"`
-	SparkContextId             int                                                    `json:"spark_context_id,omitempty"`
-	SparkEnvVars               map[string]string                                      `json:"spark_env_vars,omitempty"`
-	SparkVersion               string                                                 `json:"spark_version,omitempty"`
-	SshPublicKeys              []string                                               `json:"ssh_public_keys,omitempty"`
-	StartTime                  int                                                    `json:"start_time,omitempty"`
-	State                      string                                                 `json:"state,omitempty"`
-	StateMessage               string                                                 `json:"state_message,omitempty"`
-	TerminatedTime             int                                                    `json:"terminated_time,omitempty"`
-	TotalInitialRemoteDiskSize int                                                    `json:"total_initial_remote_disk_size,omitempty"`
-	UseMlRuntime               bool                                                   `json:"use_ml_runtime,omitempty"`
-	Autoscale                  *DataSourceClusterClusterInfoAutoscale                 `json:"autoscale,omitempty"`
-	AwsAttributes              *DataSourceClusterClusterInfoAwsAttributes             `json:"aws_attributes,omitempty"`
-	AzureAttributes            *DataSourceClusterClusterInfoAzureAttributes           `json:"azure_attributes,omitempty"`
-	ClusterLogConf             *DataSourceClusterClusterInfoClusterLogConf            `json:"cluster_log_conf,omitempty"`
-	ClusterLogStatus           *DataSourceClusterClusterInfoClusterLogStatus          `json:"cluster_log_status,omitempty"`
-	DockerImage                *DataSourceClusterClusterInfoDockerImage               `json:"docker_image,omitempty"`
-	Driver                     *DataSourceClusterClusterInfoDriver                    `json:"driver,omitempty"`
-	DriverNodeTypeFlexibility  *DataSourceClusterClusterInfoDriverNodeTypeFlexibility `json:"driver_node_type_flexibility,omitempty"`
-	Executors                  []DataSourceClusterClusterInfoExecutors                `json:"executors,omitempty"`
-	GcpAttributes              *DataSourceClusterClusterInfoGcpAttributes             `json:"gcp_attributes,omitempty"`
-	InitScripts                []DataSourceClusterClusterInfoInitScripts              `json:"init_scripts,omitempty"`
-	Spec                       *DataSourceClusterClusterInfoSpec                      `json:"spec,omitempty"`
-	TerminationReason          *DataSourceClusterClusterInfoTerminationReason         `json:"termination_reason,omitempty"`
-	WorkerNodeTypeFlexibility  *DataSourceClusterClusterInfoWorkerNodeTypeFlexibility `json:"worker_node_type_flexibility,omitempty"`
-	WorkloadType               *DataSourceClusterClusterInfoWorkloadType              `json:"workload_type,omitempty"`
-}
-
-type DataSourceClusterProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceCluster struct {
-	ClusterId      string                           `json:"cluster_id,omitempty"`
-	ClusterName    string                           `json:"cluster_name,omitempty"`
-	Id             string                           `json:"id,omitempty"`
-	ClusterInfo    *DataSourceClusterClusterInfo    `json:"cluster_info,omitempty"`
-	ProviderConfig *DataSourceClusterProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_cluster_policy.go b/bundle/internal/tf/schema/data_source_cluster_policy.go
deleted file mode 100644
index c8e60faf3d4..00000000000
--- a/bundle/internal/tf/schema/data_source_cluster_policy.go
+++ /dev/null
@@ -1,19 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceClusterPolicyProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceClusterPolicy struct {
-	Definition                      string                                 `json:"definition,omitempty"`
-	Description                     string                                 `json:"description,omitempty"`
-	Id                              string                                 `json:"id,omitempty"`
-	IsDefault                       bool                                   `json:"is_default,omitempty"`
-	MaxClustersPerUser              int                                    `json:"max_clusters_per_user,omitempty"`
-	Name                            string                                 `json:"name,omitempty"`
-	PolicyFamilyDefinitionOverrides string                                 `json:"policy_family_definition_overrides,omitempty"`
-	PolicyFamilyId                  string                                 `json:"policy_family_id,omitempty"`
-	ProviderConfig                  *DataSourceClusterPolicyProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_clusters.go b/bundle/internal/tf/schema/data_source_clusters.go
deleted file mode 100644
index 6a4f9f3e5a8..00000000000
--- a/bundle/internal/tf/schema/data_source_clusters.go
+++ /dev/null
@@ -1,22 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceClustersFilterBy struct {
-	ClusterSources []string `json:"cluster_sources,omitempty"`
-	ClusterStates  []string `json:"cluster_states,omitempty"`
-	IsPinned       bool     `json:"is_pinned,omitempty"`
-	PolicyId       string   `json:"policy_id,omitempty"`
-}
-
-type DataSourceClustersProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceClusters struct {
-	ClusterNameContains string                            `json:"cluster_name_contains,omitempty"`
-	Id                  string                            `json:"id,omitempty"`
-	Ids                 []string                          `json:"ids,omitempty"`
-	FilterBy            *DataSourceClustersFilterBy       `json:"filter_by,omitempty"`
-	ProviderConfig      *DataSourceClustersProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_current_config.go b/bundle/internal/tf/schema/data_source_current_config.go
deleted file mode 100644
index 0dc751a724d..00000000000
--- a/bundle/internal/tf/schema/data_source_current_config.go
+++ /dev/null
@@ -1,19 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceCurrentConfigProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceCurrentConfig struct {
-	AccountId      string                                 `json:"account_id,omitempty"`
-	Api            string                                 `json:"api,omitempty"`
-	AuthType       string                                 `json:"auth_type,omitempty"`
-	Cloud          string                                 `json:"cloud,omitempty"`
-	CloudType      string                                 `json:"cloud_type,omitempty"`
-	Host           string                                 `json:"host,omitempty"`
-	Id             string                                 `json:"id,omitempty"`
-	IsAccount      bool                                   `json:"is_account,omitempty"`
-	ProviderConfig *DataSourceCurrentConfigProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_current_metastore.go b/bundle/internal/tf/schema/data_source_current_metastore.go
deleted file mode 100644
index 52c2c43f57f..00000000000
--- a/bundle/internal/tf/schema/data_source_current_metastore.go
+++ /dev/null
@@ -1,35 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceCurrentMetastoreMetastoreInfo struct {
-	Cloud                                       string `json:"cloud,omitempty"`
-	CreatedAt                                   int    `json:"created_at,omitempty"`
-	CreatedBy                                   string `json:"created_by,omitempty"`
-	DefaultDataAccessConfigId                   string `json:"default_data_access_config_id,omitempty"`
-	DeltaSharingOrganizationName                string `json:"delta_sharing_organization_name,omitempty"`
-	DeltaSharingRecipientTokenLifetimeInSeconds int    `json:"delta_sharing_recipient_token_lifetime_in_seconds,omitempty"`
-	DeltaSharingScope                           string `json:"delta_sharing_scope,omitempty"`
-	ExternalAccessEnabled                       bool   `json:"external_access_enabled,omitempty"`
-	GlobalMetastoreId                           string `json:"global_metastore_id,omitempty"`
-	MetastoreId                                 string `json:"metastore_id,omitempty"`
-	Name                                        string `json:"name,omitempty"`
-	Owner                                       string `json:"owner,omitempty"`
-	PrivilegeModelVersion                       string `json:"privilege_model_version,omitempty"`
-	Region                                      string `json:"region,omitempty"`
-	StorageRoot                                 string `json:"storage_root,omitempty"`
-	StorageRootCredentialId                     string `json:"storage_root_credential_id,omitempty"`
-	StorageRootCredentialName                   string `json:"storage_root_credential_name,omitempty"`
-	UpdatedAt                                   int    `json:"updated_at,omitempty"`
-	UpdatedBy                                   string `json:"updated_by,omitempty"`
-}
-
-type DataSourceCurrentMetastoreProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceCurrentMetastore struct {
-	Id             string                                    `json:"id,omitempty"`
-	MetastoreInfo  *DataSourceCurrentMetastoreMetastoreInfo  `json:"metastore_info,omitempty"`
-	ProviderConfig *DataSourceCurrentMetastoreProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_current_user.go b/bundle/internal/tf/schema/data_source_current_user.go
deleted file mode 100644
index cdf33ade244..00000000000
--- a/bundle/internal/tf/schema/data_source_current_user.go
+++ /dev/null
@@ -1,19 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceCurrentUserProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceCurrentUser struct {
-	AclPrincipalId string                               `json:"acl_principal_id,omitempty"`
-	Alphanumeric   string                               `json:"alphanumeric,omitempty"`
-	ExternalId     string                               `json:"external_id,omitempty"`
-	Home           string                               `json:"home,omitempty"`
-	Id             string                               `json:"id,omitempty"`
-	Repos          string                               `json:"repos,omitempty"`
-	UserName       string                               `json:"user_name,omitempty"`
-	WorkspaceUrl   string                               `json:"workspace_url,omitempty"`
-	ProviderConfig *DataSourceCurrentUserProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_dashboards.go b/bundle/internal/tf/schema/data_source_dashboards.go
deleted file mode 100644
index a86458a0883..00000000000
--- a/bundle/internal/tf/schema/data_source_dashboards.go
+++ /dev/null
@@ -1,26 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceDashboardsDashboards struct {
-	CreateTime          string `json:"create_time,omitempty"`
-	DashboardId         string `json:"dashboard_id,omitempty"`
-	DisplayName         string `json:"display_name,omitempty"`
-	Etag                string `json:"etag,omitempty"`
-	LifecycleState      string `json:"lifecycle_state,omitempty"`
-	ParentPath          string `json:"parent_path,omitempty"`
-	Path                string `json:"path,omitempty"`
-	SerializedDashboard string `json:"serialized_dashboard,omitempty"`
-	UpdateTime          string `json:"update_time,omitempty"`
-	WarehouseId         string `json:"warehouse_id,omitempty"`
-}
-
-type DataSourceDashboardsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceDashboards struct {
-	DashboardNameContains string                              `json:"dashboard_name_contains,omitempty"`
-	Dashboards            []DataSourceDashboardsDashboards    `json:"dashboards,omitempty"`
-	ProviderConfig        *DataSourceDashboardsProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_data_classification_catalog_config.go b/bundle/internal/tf/schema/data_source_data_classification_catalog_config.go
deleted file mode 100644
index f6473f72707..00000000000
--- a/bundle/internal/tf/schema/data_source_data_classification_catalog_config.go
+++ /dev/null
@@ -1,23 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceDataClassificationCatalogConfigAutoTagConfigs struct {
-	AutoTaggingMode   string `json:"auto_tagging_mode"`
-	ClassificationTag string `json:"classification_tag"`
-}
-
-type DataSourceDataClassificationCatalogConfigIncludedSchemas struct {
-	Names []string `json:"names"`
-}
-
-type DataSourceDataClassificationCatalogConfigProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceDataClassificationCatalogConfig struct {
-	AutoTagConfigs  []DataSourceDataClassificationCatalogConfigAutoTagConfigs `json:"auto_tag_configs,omitempty"`
-	IncludedSchemas *DataSourceDataClassificationCatalogConfigIncludedSchemas `json:"included_schemas,omitempty"`
-	Name            string                                                    `json:"name"`
-	ProviderConfig  *DataSourceDataClassificationCatalogConfigProviderConfig  `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_data_quality_monitor.go b/bundle/internal/tf/schema/data_source_data_quality_monitor.go
deleted file mode 100644
index aca5e6e881c..00000000000
--- a/bundle/internal/tf/schema/data_source_data_quality_monitor.go
+++ /dev/null
@@ -1,81 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceDataQualityMonitorAnomalyDetectionConfig struct {
-	ExcludedTableFullNames []string `json:"excluded_table_full_names,omitempty"`
-}
-
-type DataSourceDataQualityMonitorDataProfilingConfigCustomMetrics struct {
-	Definition     string   `json:"definition"`
-	InputColumns   []string `json:"input_columns"`
-	Name           string   `json:"name"`
-	OutputDataType string   `json:"output_data_type"`
-	Type           string   `json:"type"`
-}
-
-type DataSourceDataQualityMonitorDataProfilingConfigInferenceLog struct {
-	Granularities    []string `json:"granularities"`
-	LabelColumn      string   `json:"label_column,omitempty"`
-	ModelIdColumn    string   `json:"model_id_column"`
-	PredictionColumn string   `json:"prediction_column"`
-	ProblemType      string   `json:"problem_type"`
-	TimestampColumn  string   `json:"timestamp_column"`
-}
-
-type DataSourceDataQualityMonitorDataProfilingConfigNotificationSettingsOnFailure struct {
-	EmailAddresses []string `json:"email_addresses,omitempty"`
-}
-
-type DataSourceDataQualityMonitorDataProfilingConfigNotificationSettings struct {
-	OnFailure *DataSourceDataQualityMonitorDataProfilingConfigNotificationSettingsOnFailure `json:"on_failure,omitempty"`
-}
-
-type DataSourceDataQualityMonitorDataProfilingConfigSchedule struct {
-	PauseStatus          string `json:"pause_status,omitempty"`
-	QuartzCronExpression string `json:"quartz_cron_expression"`
-	TimezoneId           string `json:"timezone_id"`
-}
-
-type DataSourceDataQualityMonitorDataProfilingConfigSnapshot struct {
-}
-
-type DataSourceDataQualityMonitorDataProfilingConfigTimeSeries struct {
-	Granularities   []string `json:"granularities"`
-	TimestampColumn string   `json:"timestamp_column"`
-}
-
-type DataSourceDataQualityMonitorDataProfilingConfig struct {
-	AssetsDir                   string                                                               `json:"assets_dir,omitempty"`
-	BaselineTableName           string                                                               `json:"baseline_table_name,omitempty"`
-	CustomMetrics               []DataSourceDataQualityMonitorDataProfilingConfigCustomMetrics       `json:"custom_metrics,omitempty"`
-	DashboardId                 string                                                               `json:"dashboard_id,omitempty"`
-	DriftMetricsTableName       string                                                               `json:"drift_metrics_table_name,omitempty"`
-	EffectiveWarehouseId        string                                                               `json:"effective_warehouse_id,omitempty"`
-	InferenceLog                *DataSourceDataQualityMonitorDataProfilingConfigInferenceLog         `json:"inference_log,omitempty"`
-	LatestMonitorFailureMessage string                                                               `json:"latest_monitor_failure_message,omitempty"`
-	MonitorVersion              int                                                                  `json:"monitor_version,omitempty"`
-	MonitoredTableName          string                                                               `json:"monitored_table_name,omitempty"`
-	NotificationSettings        *DataSourceDataQualityMonitorDataProfilingConfigNotificationSettings `json:"notification_settings,omitempty"`
-	OutputSchemaId              string                                                               `json:"output_schema_id"`
-	ProfileMetricsTableName     string                                                               `json:"profile_metrics_table_name,omitempty"`
-	Schedule                    *DataSourceDataQualityMonitorDataProfilingConfigSchedule             `json:"schedule,omitempty"`
-	SkipBuiltinDashboard        bool                                                                 `json:"skip_builtin_dashboard,omitempty"`
-	SlicingExprs                []string                                                             `json:"slicing_exprs,omitempty"`
-	Snapshot                    *DataSourceDataQualityMonitorDataProfilingConfigSnapshot             `json:"snapshot,omitempty"`
-	Status                      string                                                               `json:"status,omitempty"`
-	TimeSeries                  *DataSourceDataQualityMonitorDataProfilingConfigTimeSeries           `json:"time_series,omitempty"`
-	WarehouseId                 string                                                               `json:"warehouse_id,omitempty"`
-}
-
-type DataSourceDataQualityMonitorProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceDataQualityMonitor struct {
-	AnomalyDetectionConfig *DataSourceDataQualityMonitorAnomalyDetectionConfig `json:"anomaly_detection_config,omitempty"`
-	DataProfilingConfig    *DataSourceDataQualityMonitorDataProfilingConfig    `json:"data_profiling_config,omitempty"`
-	ObjectId               string                                              `json:"object_id"`
-	ObjectType             string                                              `json:"object_type"`
-	ProviderConfig         *DataSourceDataQualityMonitorProviderConfig         `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_data_quality_monitors.go b/bundle/internal/tf/schema/data_source_data_quality_monitors.go
deleted file mode 100644
index be7417e3825..00000000000
--- a/bundle/internal/tf/schema/data_source_data_quality_monitors.go
+++ /dev/null
@@ -1,91 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceDataQualityMonitorsMonitorsAnomalyDetectionConfig struct {
-	ExcludedTableFullNames []string `json:"excluded_table_full_names,omitempty"`
-}
-
-type DataSourceDataQualityMonitorsMonitorsDataProfilingConfigCustomMetrics struct {
-	Definition     string   `json:"definition"`
-	InputColumns   []string `json:"input_columns"`
-	Name           string   `json:"name"`
-	OutputDataType string   `json:"output_data_type"`
-	Type           string   `json:"type"`
-}
-
-type DataSourceDataQualityMonitorsMonitorsDataProfilingConfigInferenceLog struct {
-	Granularities    []string `json:"granularities"`
-	LabelColumn      string   `json:"label_column,omitempty"`
-	ModelIdColumn    string   `json:"model_id_column"`
-	PredictionColumn string   `json:"prediction_column"`
-	ProblemType      string   `json:"problem_type"`
-	TimestampColumn  string   `json:"timestamp_column"`
-}
-
-type DataSourceDataQualityMonitorsMonitorsDataProfilingConfigNotificationSettingsOnFailure struct {
-	EmailAddresses []string `json:"email_addresses,omitempty"`
-}
-
-type DataSourceDataQualityMonitorsMonitorsDataProfilingConfigNotificationSettings struct {
-	OnFailure *DataSourceDataQualityMonitorsMonitorsDataProfilingConfigNotificationSettingsOnFailure `json:"on_failure,omitempty"`
-}
-
-type DataSourceDataQualityMonitorsMonitorsDataProfilingConfigSchedule struct {
-	PauseStatus          string `json:"pause_status,omitempty"`
-	QuartzCronExpression string `json:"quartz_cron_expression"`
-	TimezoneId           string `json:"timezone_id"`
-}
-
-type DataSourceDataQualityMonitorsMonitorsDataProfilingConfigSnapshot struct {
-}
-
-type DataSourceDataQualityMonitorsMonitorsDataProfilingConfigTimeSeries struct {
-	Granularities   []string `json:"granularities"`
-	TimestampColumn string   `json:"timestamp_column"`
-}
-
-type DataSourceDataQualityMonitorsMonitorsDataProfilingConfig struct {
-	AssetsDir                   string                                                                        `json:"assets_dir,omitempty"`
-	BaselineTableName           string                                                                        `json:"baseline_table_name,omitempty"`
-	CustomMetrics               []DataSourceDataQualityMonitorsMonitorsDataProfilingConfigCustomMetrics       `json:"custom_metrics,omitempty"`
-	DashboardId                 string                                                                        `json:"dashboard_id,omitempty"`
-	DriftMetricsTableName       string                                                                        `json:"drift_metrics_table_name,omitempty"`
-	EffectiveWarehouseId        string                                                                        `json:"effective_warehouse_id,omitempty"`
-	InferenceLog                *DataSourceDataQualityMonitorsMonitorsDataProfilingConfigInferenceLog         `json:"inference_log,omitempty"`
-	LatestMonitorFailureMessage string                                                                        `json:"latest_monitor_failure_message,omitempty"`
-	MonitorVersion              int                                                                           `json:"monitor_version,omitempty"`
-	MonitoredTableName          string                                                                        `json:"monitored_table_name,omitempty"`
-	NotificationSettings        *DataSourceDataQualityMonitorsMonitorsDataProfilingConfigNotificationSettings `json:"notification_settings,omitempty"`
-	OutputSchemaId              string                                                                        `json:"output_schema_id"`
-	ProfileMetricsTableName     string                                                                        `json:"profile_metrics_table_name,omitempty"`
-	Schedule                    *DataSourceDataQualityMonitorsMonitorsDataProfilingConfigSchedule             `json:"schedule,omitempty"`
-	SkipBuiltinDashboard        bool                                                                          `json:"skip_builtin_dashboard,omitempty"`
-	SlicingExprs                []string                                                                      `json:"slicing_exprs,omitempty"`
-	Snapshot                    *DataSourceDataQualityMonitorsMonitorsDataProfilingConfigSnapshot             `json:"snapshot,omitempty"`
-	Status                      string                                                                        `json:"status,omitempty"`
-	TimeSeries                  *DataSourceDataQualityMonitorsMonitorsDataProfilingConfigTimeSeries           `json:"time_series,omitempty"`
-	WarehouseId                 string                                                                        `json:"warehouse_id,omitempty"`
-}
-
-type DataSourceDataQualityMonitorsMonitorsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceDataQualityMonitorsMonitors struct {
-	AnomalyDetectionConfig *DataSourceDataQualityMonitorsMonitorsAnomalyDetectionConfig `json:"anomaly_detection_config,omitempty"`
-	DataProfilingConfig    *DataSourceDataQualityMonitorsMonitorsDataProfilingConfig    `json:"data_profiling_config,omitempty"`
-	ObjectId               string                                                       `json:"object_id"`
-	ObjectType             string                                                       `json:"object_type"`
-	ProviderConfig         *DataSourceDataQualityMonitorsMonitorsProviderConfig         `json:"provider_config,omitempty"`
-}
-
-type DataSourceDataQualityMonitorsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceDataQualityMonitors struct {
-	Monitors       []DataSourceDataQualityMonitorsMonitors      `json:"monitors,omitempty"`
-	PageSize       int                                          `json:"page_size,omitempty"`
-	ProviderConfig *DataSourceDataQualityMonitorsProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_data_quality_refresh.go b/bundle/internal/tf/schema/data_source_data_quality_refresh.go
deleted file mode 100644
index 10078356f87..00000000000
--- a/bundle/internal/tf/schema/data_source_data_quality_refresh.go
+++ /dev/null
@@ -1,19 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceDataQualityRefreshProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceDataQualityRefresh struct {
-	EndTimeMs      int                                         `json:"end_time_ms,omitempty"`
-	Message        string                                      `json:"message,omitempty"`
-	ObjectId       string                                      `json:"object_id"`
-	ObjectType     string                                      `json:"object_type"`
-	ProviderConfig *DataSourceDataQualityRefreshProviderConfig `json:"provider_config,omitempty"`
-	RefreshId      int                                         `json:"refresh_id"`
-	StartTimeMs    int                                         `json:"start_time_ms,omitempty"`
-	State          string                                      `json:"state,omitempty"`
-	Trigger        string                                      `json:"trigger,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_data_quality_refreshes.go b/bundle/internal/tf/schema/data_source_data_quality_refreshes.go
deleted file mode 100644
index fb58d1dc078..00000000000
--- a/bundle/internal/tf/schema/data_source_data_quality_refreshes.go
+++ /dev/null
@@ -1,31 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceDataQualityRefreshesProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceDataQualityRefreshesRefreshesProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceDataQualityRefreshesRefreshes struct {
-	EndTimeMs      int                                                    `json:"end_time_ms,omitempty"`
-	Message        string                                                 `json:"message,omitempty"`
-	ObjectId       string                                                 `json:"object_id"`
-	ObjectType     string                                                 `json:"object_type"`
-	ProviderConfig *DataSourceDataQualityRefreshesRefreshesProviderConfig `json:"provider_config,omitempty"`
-	RefreshId      int                                                    `json:"refresh_id"`
-	StartTimeMs    int                                                    `json:"start_time_ms,omitempty"`
-	State          string                                                 `json:"state,omitempty"`
-	Trigger        string                                                 `json:"trigger,omitempty"`
-}
-
-type DataSourceDataQualityRefreshes struct {
-	ObjectId       string                                        `json:"object_id"`
-	ObjectType     string                                        `json:"object_type"`
-	PageSize       int                                           `json:"page_size,omitempty"`
-	ProviderConfig *DataSourceDataQualityRefreshesProviderConfig `json:"provider_config,omitempty"`
-	Refreshes      []DataSourceDataQualityRefreshesRefreshes     `json:"refreshes,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_database_database_catalog.go b/bundle/internal/tf/schema/data_source_database_database_catalog.go
deleted file mode 100644
index 63ce16ffcd5..00000000000
--- a/bundle/internal/tf/schema/data_source_database_database_catalog.go
+++ /dev/null
@@ -1,16 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceDatabaseDatabaseCatalogProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceDatabaseDatabaseCatalog struct {
-	CreateDatabaseIfNotExists bool                                             `json:"create_database_if_not_exists,omitempty"`
-	DatabaseInstanceName      string                                           `json:"database_instance_name,omitempty"`
-	DatabaseName              string                                           `json:"database_name,omitempty"`
-	Name                      string                                           `json:"name"`
-	ProviderConfig            *DataSourceDatabaseDatabaseCatalogProviderConfig `json:"provider_config,omitempty"`
-	Uid                       string                                           `json:"uid,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_database_database_catalogs.go b/bundle/internal/tf/schema/data_source_database_database_catalogs.go
deleted file mode 100644
index f44ca414673..00000000000
--- a/bundle/internal/tf/schema/data_source_database_database_catalogs.go
+++ /dev/null
@@ -1,27 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceDatabaseDatabaseCatalogsDatabaseCatalogsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceDatabaseDatabaseCatalogsDatabaseCatalogs struct {
-	CreateDatabaseIfNotExists bool                                                              `json:"create_database_if_not_exists,omitempty"`
-	DatabaseInstanceName      string                                                            `json:"database_instance_name,omitempty"`
-	DatabaseName              string                                                            `json:"database_name,omitempty"`
-	Name                      string                                                            `json:"name"`
-	ProviderConfig            *DataSourceDatabaseDatabaseCatalogsDatabaseCatalogsProviderConfig `json:"provider_config,omitempty"`
-	Uid                       string                                                            `json:"uid,omitempty"`
-}
-
-type DataSourceDatabaseDatabaseCatalogsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceDatabaseDatabaseCatalogs struct {
-	DatabaseCatalogs []DataSourceDatabaseDatabaseCatalogsDatabaseCatalogs `json:"database_catalogs,omitempty"`
-	InstanceName     string                                               `json:"instance_name"`
-	PageSize         int                                                  `json:"page_size,omitempty"`
-	ProviderConfig   *DataSourceDatabaseDatabaseCatalogsProviderConfig    `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_database_instance.go b/bundle/internal/tf/schema/data_source_database_instance.go
deleted file mode 100644
index bf9ca7ca4db..00000000000
--- a/bundle/internal/tf/schema/data_source_database_instance.go
+++ /dev/null
@@ -1,63 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceDatabaseInstanceChildInstanceRefs struct {
-	BranchTime   string `json:"branch_time,omitempty"`
-	EffectiveLsn string `json:"effective_lsn,omitempty"`
-	Lsn          string `json:"lsn,omitempty"`
-	Name         string `json:"name,omitempty"`
-	Uid          string `json:"uid,omitempty"`
-}
-
-type DataSourceDatabaseInstanceCustomTags struct {
-	Key   string `json:"key,omitempty"`
-	Value string `json:"value,omitempty"`
-}
-
-type DataSourceDatabaseInstanceEffectiveCustomTags struct {
-	Key   string `json:"key,omitempty"`
-	Value string `json:"value,omitempty"`
-}
-
-type DataSourceDatabaseInstanceParentInstanceRef struct {
-	BranchTime   string `json:"branch_time,omitempty"`
-	EffectiveLsn string `json:"effective_lsn,omitempty"`
-	Lsn          string `json:"lsn,omitempty"`
-	Name         string `json:"name,omitempty"`
-	Uid          string `json:"uid,omitempty"`
-}
-
-type DataSourceDatabaseInstanceProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceDatabaseInstance struct {
-	Capacity                           string                                          `json:"capacity,omitempty"`
-	ChildInstanceRefs                  []DataSourceDatabaseInstanceChildInstanceRefs   `json:"child_instance_refs,omitempty"`
-	CreationTime                       string                                          `json:"creation_time,omitempty"`
-	Creator                            string                                          `json:"creator,omitempty"`
-	CustomTags                         []DataSourceDatabaseInstanceCustomTags          `json:"custom_tags,omitempty"`
-	EffectiveCapacity                  string                                          `json:"effective_capacity,omitempty"`
-	EffectiveCustomTags                []DataSourceDatabaseInstanceEffectiveCustomTags `json:"effective_custom_tags,omitempty"`
-	EffectiveEnablePgNativeLogin       bool                                            `json:"effective_enable_pg_native_login,omitempty"`
-	EffectiveEnableReadableSecondaries bool                                            `json:"effective_enable_readable_secondaries,omitempty"`
-	EffectiveNodeCount                 int                                             `json:"effective_node_count,omitempty"`
-	EffectiveRetentionWindowInDays     int                                             `json:"effective_retention_window_in_days,omitempty"`
-	EffectiveStopped                   bool                                            `json:"effective_stopped,omitempty"`
-	EffectiveUsagePolicyId             string                                          `json:"effective_usage_policy_id,omitempty"`
-	EnablePgNativeLogin                bool                                            `json:"enable_pg_native_login,omitempty"`
-	EnableReadableSecondaries          bool                                            `json:"enable_readable_secondaries,omitempty"`
-	Name                               string                                          `json:"name"`
-	NodeCount                          int                                             `json:"node_count,omitempty"`
-	ParentInstanceRef                  *DataSourceDatabaseInstanceParentInstanceRef    `json:"parent_instance_ref,omitempty"`
-	PgVersion                          string                                          `json:"pg_version,omitempty"`
-	ProviderConfig                     *DataSourceDatabaseInstanceProviderConfig       `json:"provider_config,omitempty"`
-	ReadOnlyDns                        string                                          `json:"read_only_dns,omitempty"`
-	ReadWriteDns                       string                                          `json:"read_write_dns,omitempty"`
-	RetentionWindowInDays              int                                             `json:"retention_window_in_days,omitempty"`
-	State                              string                                          `json:"state,omitempty"`
-	Stopped                            bool                                            `json:"stopped,omitempty"`
-	Uid                                string                                          `json:"uid,omitempty"`
-	UsagePolicyId                      string                                          `json:"usage_policy_id,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_database_instances.go b/bundle/internal/tf/schema/data_source_database_instances.go
deleted file mode 100644
index 74d70e1badb..00000000000
--- a/bundle/internal/tf/schema/data_source_database_instances.go
+++ /dev/null
@@ -1,73 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceDatabaseInstancesDatabaseInstancesChildInstanceRefs struct {
-	BranchTime   string `json:"branch_time,omitempty"`
-	EffectiveLsn string `json:"effective_lsn,omitempty"`
-	Lsn          string `json:"lsn,omitempty"`
-	Name         string `json:"name,omitempty"`
-	Uid          string `json:"uid,omitempty"`
-}
-
-type DataSourceDatabaseInstancesDatabaseInstancesCustomTags struct {
-	Key   string `json:"key,omitempty"`
-	Value string `json:"value,omitempty"`
-}
-
-type DataSourceDatabaseInstancesDatabaseInstancesEffectiveCustomTags struct {
-	Key   string `json:"key,omitempty"`
-	Value string `json:"value,omitempty"`
-}
-
-type DataSourceDatabaseInstancesDatabaseInstancesParentInstanceRef struct {
-	BranchTime   string `json:"branch_time,omitempty"`
-	EffectiveLsn string `json:"effective_lsn,omitempty"`
-	Lsn          string `json:"lsn,omitempty"`
-	Name         string `json:"name,omitempty"`
-	Uid          string `json:"uid,omitempty"`
-}
-
-type DataSourceDatabaseInstancesDatabaseInstancesProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceDatabaseInstancesDatabaseInstances struct {
-	Capacity                           string                                                            `json:"capacity,omitempty"`
-	ChildInstanceRefs                  []DataSourceDatabaseInstancesDatabaseInstancesChildInstanceRefs   `json:"child_instance_refs,omitempty"`
-	CreationTime                       string                                                            `json:"creation_time,omitempty"`
-	Creator                            string                                                            `json:"creator,omitempty"`
-	CustomTags                         []DataSourceDatabaseInstancesDatabaseInstancesCustomTags          `json:"custom_tags,omitempty"`
-	EffectiveCapacity                  string                                                            `json:"effective_capacity,omitempty"`
-	EffectiveCustomTags                []DataSourceDatabaseInstancesDatabaseInstancesEffectiveCustomTags `json:"effective_custom_tags,omitempty"`
-	EffectiveEnablePgNativeLogin       bool                                                              `json:"effective_enable_pg_native_login,omitempty"`
-	EffectiveEnableReadableSecondaries bool                                                              `json:"effective_enable_readable_secondaries,omitempty"`
-	EffectiveNodeCount                 int                                                               `json:"effective_node_count,omitempty"`
-	EffectiveRetentionWindowInDays     int                                                               `json:"effective_retention_window_in_days,omitempty"`
-	EffectiveStopped                   bool                                                              `json:"effective_stopped,omitempty"`
-	EffectiveUsagePolicyId             string                                                            `json:"effective_usage_policy_id,omitempty"`
-	EnablePgNativeLogin                bool                                                              `json:"enable_pg_native_login,omitempty"`
-	EnableReadableSecondaries          bool                                                              `json:"enable_readable_secondaries,omitempty"`
-	Name                               string                                                            `json:"name"`
-	NodeCount                          int                                                               `json:"node_count,omitempty"`
-	ParentInstanceRef                  *DataSourceDatabaseInstancesDatabaseInstancesParentInstanceRef    `json:"parent_instance_ref,omitempty"`
-	PgVersion                          string                                                            `json:"pg_version,omitempty"`
-	ProviderConfig                     *DataSourceDatabaseInstancesDatabaseInstancesProviderConfig       `json:"provider_config,omitempty"`
-	ReadOnlyDns                        string                                                            `json:"read_only_dns,omitempty"`
-	ReadWriteDns                       string                                                            `json:"read_write_dns,omitempty"`
-	RetentionWindowInDays              int                                                               `json:"retention_window_in_days,omitempty"`
-	State                              string                                                            `json:"state,omitempty"`
-	Stopped                            bool                                                              `json:"stopped,omitempty"`
-	Uid                                string                                                            `json:"uid,omitempty"`
-	UsagePolicyId                      string                                                            `json:"usage_policy_id,omitempty"`
-}
-
-type DataSourceDatabaseInstancesProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceDatabaseInstances struct {
-	DatabaseInstances []DataSourceDatabaseInstancesDatabaseInstances `json:"database_instances,omitempty"`
-	PageSize          int                                            `json:"page_size,omitempty"`
-	ProviderConfig    *DataSourceDatabaseInstancesProviderConfig     `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_database_synced_database_table.go b/bundle/internal/tf/schema/data_source_database_synced_database_table.go
deleted file mode 100644
index 1ac48769e41..00000000000
--- a/bundle/internal/tf/schema/data_source_database_synced_database_table.go
+++ /dev/null
@@ -1,105 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceDatabaseSyncedDatabaseTableDataSynchronizationStatusContinuousUpdateStatusInitialPipelineSyncProgress struct {
-	EstimatedCompletionTimeSeconds   int    `json:"estimated_completion_time_seconds,omitempty"`
-	LatestVersionCurrentlyProcessing int    `json:"latest_version_currently_processing,omitempty"`
-	ProvisioningPhase                string `json:"provisioning_phase,omitempty"`
-	SyncProgressCompletion           int    `json:"sync_progress_completion,omitempty"`
-	SyncedRowCount                   int    `json:"synced_row_count,omitempty"`
-	TotalRowCount                    int    `json:"total_row_count,omitempty"`
-}
-
-type DataSourceDatabaseSyncedDatabaseTableDataSynchronizationStatusContinuousUpdateStatus struct {
-	InitialPipelineSyncProgress *DataSourceDatabaseSyncedDatabaseTableDataSynchronizationStatusContinuousUpdateStatusInitialPipelineSyncProgress `json:"initial_pipeline_sync_progress,omitempty"`
-	LastProcessedCommitVersion  int                                                                                                              `json:"last_processed_commit_version,omitempty"`
-	Timestamp                   string                                                                                                           `json:"timestamp,omitempty"`
-}
-
-type DataSourceDatabaseSyncedDatabaseTableDataSynchronizationStatusFailedStatus struct {
-	LastProcessedCommitVersion int    `json:"last_processed_commit_version,omitempty"`
-	Timestamp                  string `json:"timestamp,omitempty"`
-}
-
-type DataSourceDatabaseSyncedDatabaseTableDataSynchronizationStatusLastSyncDeltaTableSyncInfo struct {
-	DeltaCommitTimestamp string `json:"delta_commit_timestamp,omitempty"`
-	DeltaCommitVersion   int    `json:"delta_commit_version,omitempty"`
-}
-
-type DataSourceDatabaseSyncedDatabaseTableDataSynchronizationStatusLastSync struct {
-	DeltaTableSyncInfo *DataSourceDatabaseSyncedDatabaseTableDataSynchronizationStatusLastSyncDeltaTableSyncInfo `json:"delta_table_sync_info,omitempty"`
-	SyncEndTimestamp   string                                                                                    `json:"sync_end_timestamp,omitempty"`
-	SyncStartTimestamp string                                                                                    `json:"sync_start_timestamp,omitempty"`
-}
-
-type DataSourceDatabaseSyncedDatabaseTableDataSynchronizationStatusProvisioningStatusInitialPipelineSyncProgress struct {
-	EstimatedCompletionTimeSeconds   int    `json:"estimated_completion_time_seconds,omitempty"`
-	LatestVersionCurrentlyProcessing int    `json:"latest_version_currently_processing,omitempty"`
-	ProvisioningPhase                string `json:"provisioning_phase,omitempty"`
-	SyncProgressCompletion           int    `json:"sync_progress_completion,omitempty"`
-	SyncedRowCount                   int    `json:"synced_row_count,omitempty"`
-	TotalRowCount                    int    `json:"total_row_count,omitempty"`
-}
-
-type DataSourceDatabaseSyncedDatabaseTableDataSynchronizationStatusProvisioningStatus struct {
-	InitialPipelineSyncProgress *DataSourceDatabaseSyncedDatabaseTableDataSynchronizationStatusProvisioningStatusInitialPipelineSyncProgress `json:"initial_pipeline_sync_progress,omitempty"`
-}
-
-type DataSourceDatabaseSyncedDatabaseTableDataSynchronizationStatusTriggeredUpdateStatusTriggeredUpdateProgress struct {
-	EstimatedCompletionTimeSeconds   int    `json:"estimated_completion_time_seconds,omitempty"`
-	LatestVersionCurrentlyProcessing int    `json:"latest_version_currently_processing,omitempty"`
-	ProvisioningPhase                string `json:"provisioning_phase,omitempty"`
-	SyncProgressCompletion           int    `json:"sync_progress_completion,omitempty"`
-	SyncedRowCount                   int    `json:"synced_row_count,omitempty"`
-	TotalRowCount                    int    `json:"total_row_count,omitempty"`
-}
-
-type DataSourceDatabaseSyncedDatabaseTableDataSynchronizationStatusTriggeredUpdateStatus struct {
-	LastProcessedCommitVersion int                                                                                                         `json:"last_processed_commit_version,omitempty"`
-	Timestamp                  string                                                                                                      `json:"timestamp,omitempty"`
-	TriggeredUpdateProgress    *DataSourceDatabaseSyncedDatabaseTableDataSynchronizationStatusTriggeredUpdateStatusTriggeredUpdateProgress `json:"triggered_update_progress,omitempty"`
-}
-
-type DataSourceDatabaseSyncedDatabaseTableDataSynchronizationStatus struct {
-	ContinuousUpdateStatus *DataSourceDatabaseSyncedDatabaseTableDataSynchronizationStatusContinuousUpdateStatus `json:"continuous_update_status,omitempty"`
-	DetailedState          string                                                                                `json:"detailed_state,omitempty"`
-	FailedStatus           *DataSourceDatabaseSyncedDatabaseTableDataSynchronizationStatusFailedStatus           `json:"failed_status,omitempty"`
-	LastSync               *DataSourceDatabaseSyncedDatabaseTableDataSynchronizationStatusLastSync               `json:"last_sync,omitempty"`
-	Message                string                                                                                `json:"message,omitempty"`
-	PipelineId             string                                                                                `json:"pipeline_id,omitempty"`
-	ProvisioningStatus     *DataSourceDatabaseSyncedDatabaseTableDataSynchronizationStatusProvisioningStatus     `json:"provisioning_status,omitempty"`
-	TriggeredUpdateStatus  *DataSourceDatabaseSyncedDatabaseTableDataSynchronizationStatusTriggeredUpdateStatus  `json:"triggered_update_status,omitempty"`
-}
-
-type DataSourceDatabaseSyncedDatabaseTableProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceDatabaseSyncedDatabaseTableSpecNewPipelineSpec struct {
-	BudgetPolicyId string `json:"budget_policy_id,omitempty"`
-	StorageCatalog string `json:"storage_catalog,omitempty"`
-	StorageSchema  string `json:"storage_schema,omitempty"`
-}
-
-type DataSourceDatabaseSyncedDatabaseTableSpec struct {
-	CreateDatabaseObjectsIfMissing bool                                                      `json:"create_database_objects_if_missing,omitempty"`
-	ExistingPipelineId             string                                                    `json:"existing_pipeline_id,omitempty"`
-	NewPipelineSpec                *DataSourceDatabaseSyncedDatabaseTableSpecNewPipelineSpec `json:"new_pipeline_spec,omitempty"`
-	PrimaryKeyColumns              []string                                                  `json:"primary_key_columns,omitempty"`
-	SchedulingPolicy               string                                                    `json:"scheduling_policy,omitempty"`
-	SourceTableFullName            string                                                    `json:"source_table_full_name,omitempty"`
-	TimeseriesKey                  string                                                    `json:"timeseries_key,omitempty"`
-}
-
-type DataSourceDatabaseSyncedDatabaseTable struct {
-	DataSynchronizationStatus     *DataSourceDatabaseSyncedDatabaseTableDataSynchronizationStatus `json:"data_synchronization_status,omitempty"`
-	DatabaseInstanceName          string                                                          `json:"database_instance_name,omitempty"`
-	EffectiveDatabaseInstanceName string                                                          `json:"effective_database_instance_name,omitempty"`
-	EffectiveLogicalDatabaseName  string                                                          `json:"effective_logical_database_name,omitempty"`
-	LogicalDatabaseName           string                                                          `json:"logical_database_name,omitempty"`
-	Name                          string                                                          `json:"name"`
-	ProviderConfig                *DataSourceDatabaseSyncedDatabaseTableProviderConfig            `json:"provider_config,omitempty"`
-	Spec                          *DataSourceDatabaseSyncedDatabaseTableSpec                      `json:"spec,omitempty"`
-	UnityCatalogProvisioningState string                                                          `json:"unity_catalog_provisioning_state,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_database_synced_database_tables.go b/bundle/internal/tf/schema/data_source_database_synced_database_tables.go
deleted file mode 100644
index e7e280fdf01..00000000000
--- a/bundle/internal/tf/schema/data_source_database_synced_database_tables.go
+++ /dev/null
@@ -1,116 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceDatabaseSyncedDatabaseTablesProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceDatabaseSyncedDatabaseTablesSyncedTablesDataSynchronizationStatusContinuousUpdateStatusInitialPipelineSyncProgress struct {
-	EstimatedCompletionTimeSeconds   int    `json:"estimated_completion_time_seconds,omitempty"`
-	LatestVersionCurrentlyProcessing int    `json:"latest_version_currently_processing,omitempty"`
-	ProvisioningPhase                string `json:"provisioning_phase,omitempty"`
-	SyncProgressCompletion           int    `json:"sync_progress_completion,omitempty"`
-	SyncedRowCount                   int    `json:"synced_row_count,omitempty"`
-	TotalRowCount                    int    `json:"total_row_count,omitempty"`
-}
-
-type DataSourceDatabaseSyncedDatabaseTablesSyncedTablesDataSynchronizationStatusContinuousUpdateStatus struct {
-	InitialPipelineSyncProgress *DataSourceDatabaseSyncedDatabaseTablesSyncedTablesDataSynchronizationStatusContinuousUpdateStatusInitialPipelineSyncProgress `json:"initial_pipeline_sync_progress,omitempty"`
-	LastProcessedCommitVersion  int                                                                                                                           `json:"last_processed_commit_version,omitempty"`
-	Timestamp                   string                                                                                                                        `json:"timestamp,omitempty"`
-}
-
-type DataSourceDatabaseSyncedDatabaseTablesSyncedTablesDataSynchronizationStatusFailedStatus struct {
-	LastProcessedCommitVersion int    `json:"last_processed_commit_version,omitempty"`
-	Timestamp                  string `json:"timestamp,omitempty"`
-}
-
-type DataSourceDatabaseSyncedDatabaseTablesSyncedTablesDataSynchronizationStatusLastSyncDeltaTableSyncInfo struct {
-	DeltaCommitTimestamp string `json:"delta_commit_timestamp,omitempty"`
-	DeltaCommitVersion   int    `json:"delta_commit_version,omitempty"`
-}
-
-type DataSourceDatabaseSyncedDatabaseTablesSyncedTablesDataSynchronizationStatusLastSync struct {
-	DeltaTableSyncInfo *DataSourceDatabaseSyncedDatabaseTablesSyncedTablesDataSynchronizationStatusLastSyncDeltaTableSyncInfo `json:"delta_table_sync_info,omitempty"`
-	SyncEndTimestamp   string                                                                                                 `json:"sync_end_timestamp,omitempty"`
-	SyncStartTimestamp string                                                                                                 `json:"sync_start_timestamp,omitempty"`
-}
-
-type DataSourceDatabaseSyncedDatabaseTablesSyncedTablesDataSynchronizationStatusProvisioningStatusInitialPipelineSyncProgress struct {
-	EstimatedCompletionTimeSeconds   int    `json:"estimated_completion_time_seconds,omitempty"`
-	LatestVersionCurrentlyProcessing int    `json:"latest_version_currently_processing,omitempty"`
-	ProvisioningPhase                string `json:"provisioning_phase,omitempty"`
-	SyncProgressCompletion           int    `json:"sync_progress_completion,omitempty"`
-	SyncedRowCount                   int    `json:"synced_row_count,omitempty"`
-	TotalRowCount                    int    `json:"total_row_count,omitempty"`
-}
-
-type DataSourceDatabaseSyncedDatabaseTablesSyncedTablesDataSynchronizationStatusProvisioningStatus struct {
-	InitialPipelineSyncProgress *DataSourceDatabaseSyncedDatabaseTablesSyncedTablesDataSynchronizationStatusProvisioningStatusInitialPipelineSyncProgress `json:"initial_pipeline_sync_progress,omitempty"`
-}
-
-type DataSourceDatabaseSyncedDatabaseTablesSyncedTablesDataSynchronizationStatusTriggeredUpdateStatusTriggeredUpdateProgress struct {
-	EstimatedCompletionTimeSeconds   int    `json:"estimated_completion_time_seconds,omitempty"`
-	LatestVersionCurrentlyProcessing int    `json:"latest_version_currently_processing,omitempty"`
-	ProvisioningPhase                string `json:"provisioning_phase,omitempty"`
-	SyncProgressCompletion           int    `json:"sync_progress_completion,omitempty"`
-	SyncedRowCount                   int    `json:"synced_row_count,omitempty"`
-	TotalRowCount                    int    `json:"total_row_count,omitempty"`
-}
-
-type DataSourceDatabaseSyncedDatabaseTablesSyncedTablesDataSynchronizationStatusTriggeredUpdateStatus struct {
-	LastProcessedCommitVersion int                                                                                                                      `json:"last_processed_commit_version,omitempty"`
-	Timestamp                  string                                                                                                                   `json:"timestamp,omitempty"`
-	TriggeredUpdateProgress    *DataSourceDatabaseSyncedDatabaseTablesSyncedTablesDataSynchronizationStatusTriggeredUpdateStatusTriggeredUpdateProgress `json:"triggered_update_progress,omitempty"`
-}
-
-type DataSourceDatabaseSyncedDatabaseTablesSyncedTablesDataSynchronizationStatus struct {
-	ContinuousUpdateStatus *DataSourceDatabaseSyncedDatabaseTablesSyncedTablesDataSynchronizationStatusContinuousUpdateStatus `json:"continuous_update_status,omitempty"`
-	DetailedState          string                                                                                             `json:"detailed_state,omitempty"`
-	FailedStatus           *DataSourceDatabaseSyncedDatabaseTablesSyncedTablesDataSynchronizationStatusFailedStatus           `json:"failed_status,omitempty"`
-	LastSync               *DataSourceDatabaseSyncedDatabaseTablesSyncedTablesDataSynchronizationStatusLastSync               `json:"last_sync,omitempty"`
-	Message                string                                                                                             `json:"message,omitempty"`
-	PipelineId             string                                                                                             `json:"pipeline_id,omitempty"`
-	ProvisioningStatus     *DataSourceDatabaseSyncedDatabaseTablesSyncedTablesDataSynchronizationStatusProvisioningStatus     `json:"provisioning_status,omitempty"`
-	TriggeredUpdateStatus  *DataSourceDatabaseSyncedDatabaseTablesSyncedTablesDataSynchronizationStatusTriggeredUpdateStatus  `json:"triggered_update_status,omitempty"`
-}
-
-type DataSourceDatabaseSyncedDatabaseTablesSyncedTablesProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceDatabaseSyncedDatabaseTablesSyncedTablesSpecNewPipelineSpec struct {
-	BudgetPolicyId string `json:"budget_policy_id,omitempty"`
-	StorageCatalog string `json:"storage_catalog,omitempty"`
-	StorageSchema  string `json:"storage_schema,omitempty"`
-}
-
-type DataSourceDatabaseSyncedDatabaseTablesSyncedTablesSpec struct {
-	CreateDatabaseObjectsIfMissing bool                                                                   `json:"create_database_objects_if_missing,omitempty"`
-	ExistingPipelineId             string                                                                 `json:"existing_pipeline_id,omitempty"`
-	NewPipelineSpec                *DataSourceDatabaseSyncedDatabaseTablesSyncedTablesSpecNewPipelineSpec `json:"new_pipeline_spec,omitempty"`
-	PrimaryKeyColumns              []string                                                               `json:"primary_key_columns,omitempty"`
-	SchedulingPolicy               string                                                                 `json:"scheduling_policy,omitempty"`
-	SourceTableFullName            string                                                                 `json:"source_table_full_name,omitempty"`
-	TimeseriesKey                  string                                                                 `json:"timeseries_key,omitempty"`
-}
-
-type DataSourceDatabaseSyncedDatabaseTablesSyncedTables struct {
-	DataSynchronizationStatus     *DataSourceDatabaseSyncedDatabaseTablesSyncedTablesDataSynchronizationStatus `json:"data_synchronization_status,omitempty"`
-	DatabaseInstanceName          string                                                                       `json:"database_instance_name,omitempty"`
-	EffectiveDatabaseInstanceName string                                                                       `json:"effective_database_instance_name,omitempty"`
-	EffectiveLogicalDatabaseName  string                                                                       `json:"effective_logical_database_name,omitempty"`
-	LogicalDatabaseName           string                                                                       `json:"logical_database_name,omitempty"`
-	Name                          string                                                                       `json:"name"`
-	ProviderConfig                *DataSourceDatabaseSyncedDatabaseTablesSyncedTablesProviderConfig            `json:"provider_config,omitempty"`
-	Spec                          *DataSourceDatabaseSyncedDatabaseTablesSyncedTablesSpec                      `json:"spec,omitempty"`
-	UnityCatalogProvisioningState string                                                                       `json:"unity_catalog_provisioning_state,omitempty"`
-}
-
-type DataSourceDatabaseSyncedDatabaseTables struct {
-	InstanceName   string                                                `json:"instance_name"`
-	PageSize       int                                                   `json:"page_size,omitempty"`
-	ProviderConfig *DataSourceDatabaseSyncedDatabaseTablesProviderConfig `json:"provider_config,omitempty"`
-	SyncedTables   []DataSourceDatabaseSyncedDatabaseTablesSyncedTables  `json:"synced_tables,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_dbfs_file.go b/bundle/internal/tf/schema/data_source_dbfs_file.go
deleted file mode 100644
index dfd0dc37cd0..00000000000
--- a/bundle/internal/tf/schema/data_source_dbfs_file.go
+++ /dev/null
@@ -1,16 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceDbfsFileProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceDbfsFile struct {
-	Content        string                            `json:"content,omitempty"`
-	FileSize       int                               `json:"file_size,omitempty"`
-	Id             string                            `json:"id,omitempty"`
-	LimitFileSize  bool                              `json:"limit_file_size"`
-	Path           string                            `json:"path"`
-	ProviderConfig *DataSourceDbfsFileProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_dbfs_file_paths.go b/bundle/internal/tf/schema/data_source_dbfs_file_paths.go
deleted file mode 100644
index 8a3fbde369e..00000000000
--- a/bundle/internal/tf/schema/data_source_dbfs_file_paths.go
+++ /dev/null
@@ -1,15 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceDbfsFilePathsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceDbfsFilePaths struct {
-	Id             string                                 `json:"id,omitempty"`
-	Path           string                                 `json:"path"`
-	PathList       []any                                  `json:"path_list,omitempty"`
-	Recursive      bool                                   `json:"recursive"`
-	ProviderConfig *DataSourceDbfsFilePathsProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_directory.go b/bundle/internal/tf/schema/data_source_directory.go
deleted file mode 100644
index fa31e37a506..00000000000
--- a/bundle/internal/tf/schema/data_source_directory.go
+++ /dev/null
@@ -1,15 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceDirectoryProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceDirectory struct {
-	Id             string                             `json:"id,omitempty"`
-	ObjectId       int                                `json:"object_id,omitempty"`
-	Path           string                             `json:"path"`
-	WorkspacePath  string                             `json:"workspace_path,omitempty"`
-	ProviderConfig *DataSourceDirectoryProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_endpoint.go b/bundle/internal/tf/schema/data_source_endpoint.go
deleted file mode 100644
index 39e726b8b1f..00000000000
--- a/bundle/internal/tf/schema/data_source_endpoint.go
+++ /dev/null
@@ -1,22 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceEndpointAzurePrivateEndpointInfo struct {
-	PrivateEndpointName         string `json:"private_endpoint_name"`
-	PrivateEndpointResourceGuid string `json:"private_endpoint_resource_guid"`
-	PrivateEndpointResourceId   string `json:"private_endpoint_resource_id,omitempty"`
-	PrivateLinkServiceId        string `json:"private_link_service_id,omitempty"`
-}
-
-type DataSourceEndpoint struct {
-	AccountId                string                                      `json:"account_id,omitempty"`
-	AzurePrivateEndpointInfo *DataSourceEndpointAzurePrivateEndpointInfo `json:"azure_private_endpoint_info,omitempty"`
-	CreateTime               string                                      `json:"create_time,omitempty"`
-	DisplayName              string                                      `json:"display_name,omitempty"`
-	EndpointId               string                                      `json:"endpoint_id,omitempty"`
-	Name                     string                                      `json:"name"`
-	Region                   string                                      `json:"region,omitempty"`
-	State                    string                                      `json:"state,omitempty"`
-	UseCase                  string                                      `json:"use_case,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_endpoints.go b/bundle/internal/tf/schema/data_source_endpoints.go
deleted file mode 100644
index 1cef5b123aa..00000000000
--- a/bundle/internal/tf/schema/data_source_endpoints.go
+++ /dev/null
@@ -1,28 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceEndpointsItemsAzurePrivateEndpointInfo struct {
-	PrivateEndpointName         string `json:"private_endpoint_name"`
-	PrivateEndpointResourceGuid string `json:"private_endpoint_resource_guid"`
-	PrivateEndpointResourceId   string `json:"private_endpoint_resource_id,omitempty"`
-	PrivateLinkServiceId        string `json:"private_link_service_id,omitempty"`
-}
-
-type DataSourceEndpointsItems struct {
-	AccountId                string                                            `json:"account_id,omitempty"`
-	AzurePrivateEndpointInfo *DataSourceEndpointsItemsAzurePrivateEndpointInfo `json:"azure_private_endpoint_info,omitempty"`
-	CreateTime               string                                            `json:"create_time,omitempty"`
-	DisplayName              string                                            `json:"display_name,omitempty"`
-	EndpointId               string                                            `json:"endpoint_id,omitempty"`
-	Name                     string                                            `json:"name"`
-	Region                   string                                            `json:"region,omitempty"`
-	State                    string                                            `json:"state,omitempty"`
-	UseCase                  string                                            `json:"use_case,omitempty"`
-}
-
-type DataSourceEndpoints struct {
-	Items    []DataSourceEndpointsItems `json:"items,omitempty"`
-	PageSize int                        `json:"page_size,omitempty"`
-	Parent   string                     `json:"parent"`
-}
diff --git a/bundle/internal/tf/schema/data_source_entity_tag_assignment.go b/bundle/internal/tf/schema/data_source_entity_tag_assignment.go
deleted file mode 100644
index 15ed8ee4137..00000000000
--- a/bundle/internal/tf/schema/data_source_entity_tag_assignment.go
+++ /dev/null
@@ -1,18 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceEntityTagAssignmentProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceEntityTagAssignment struct {
-	EntityName     string                                       `json:"entity_name"`
-	EntityType     string                                       `json:"entity_type"`
-	ProviderConfig *DataSourceEntityTagAssignmentProviderConfig `json:"provider_config,omitempty"`
-	SourceType     string                                       `json:"source_type,omitempty"`
-	TagKey         string                                       `json:"tag_key"`
-	TagValue       string                                       `json:"tag_value,omitempty"`
-	UpdateTime     string                                       `json:"update_time,omitempty"`
-	UpdatedBy      string                                       `json:"updated_by,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_entity_tag_assignments.go b/bundle/internal/tf/schema/data_source_entity_tag_assignments.go
deleted file mode 100644
index 50126aa3317..00000000000
--- a/bundle/internal/tf/schema/data_source_entity_tag_assignments.go
+++ /dev/null
@@ -1,30 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceEntityTagAssignmentsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceEntityTagAssignmentsTagAssignmentsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceEntityTagAssignmentsTagAssignments struct {
-	EntityName     string                                                      `json:"entity_name"`
-	EntityType     string                                                      `json:"entity_type"`
-	ProviderConfig *DataSourceEntityTagAssignmentsTagAssignmentsProviderConfig `json:"provider_config,omitempty"`
-	SourceType     string                                                      `json:"source_type,omitempty"`
-	TagKey         string                                                      `json:"tag_key"`
-	TagValue       string                                                      `json:"tag_value,omitempty"`
-	UpdateTime     string                                                      `json:"update_time,omitempty"`
-	UpdatedBy      string                                                      `json:"updated_by,omitempty"`
-}
-
-type DataSourceEntityTagAssignments struct {
-	EntityName     string                                         `json:"entity_name"`
-	EntityType     string                                         `json:"entity_type"`
-	MaxResults     int                                            `json:"max_results,omitempty"`
-	ProviderConfig *DataSourceEntityTagAssignmentsProviderConfig  `json:"provider_config,omitempty"`
-	TagAssignments []DataSourceEntityTagAssignmentsTagAssignments `json:"tag_assignments,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_environments_default_workspace_base_environment.go b/bundle/internal/tf/schema/data_source_environments_default_workspace_base_environment.go
deleted file mode 100644
index d44ad8ff58e..00000000000
--- a/bundle/internal/tf/schema/data_source_environments_default_workspace_base_environment.go
+++ /dev/null
@@ -1,14 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceEnvironmentsDefaultWorkspaceBaseEnvironmentProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceEnvironmentsDefaultWorkspaceBaseEnvironment struct {
-	CpuWorkspaceBaseEnvironment string                                                               `json:"cpu_workspace_base_environment,omitempty"`
-	GpuWorkspaceBaseEnvironment string                                                               `json:"gpu_workspace_base_environment,omitempty"`
-	Name                        string                                                               `json:"name"`
-	ProviderConfig              *DataSourceEnvironmentsDefaultWorkspaceBaseEnvironmentProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_environments_workspace_base_environment.go b/bundle/internal/tf/schema/data_source_environments_workspace_base_environment.go
deleted file mode 100644
index 83354027dd7..00000000000
--- a/bundle/internal/tf/schema/data_source_environments_workspace_base_environment.go
+++ /dev/null
@@ -1,23 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceEnvironmentsWorkspaceBaseEnvironmentProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceEnvironmentsWorkspaceBaseEnvironment struct {
-	BaseEnvironmentType          string                                                        `json:"base_environment_type,omitempty"`
-	CreateTime                   string                                                        `json:"create_time,omitempty"`
-	CreatorUserId                string                                                        `json:"creator_user_id,omitempty"`
-	DisplayName                  string                                                        `json:"display_name,omitempty"`
-	EffectiveBaseEnvironmentType string                                                        `json:"effective_base_environment_type,omitempty"`
-	Filepath                     string                                                        `json:"filepath,omitempty"`
-	IsDefault                    bool                                                          `json:"is_default,omitempty"`
-	LastUpdatedUserId            string                                                        `json:"last_updated_user_id,omitempty"`
-	Message                      string                                                        `json:"message,omitempty"`
-	Name                         string                                                        `json:"name"`
-	ProviderConfig               *DataSourceEnvironmentsWorkspaceBaseEnvironmentProviderConfig `json:"provider_config,omitempty"`
-	Status                       string                                                        `json:"status,omitempty"`
-	UpdateTime                   string                                                        `json:"update_time,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_environments_workspace_base_environments.go b/bundle/internal/tf/schema/data_source_environments_workspace_base_environments.go
deleted file mode 100644
index cb4a39cd2db..00000000000
--- a/bundle/internal/tf/schema/data_source_environments_workspace_base_environments.go
+++ /dev/null
@@ -1,33 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceEnvironmentsWorkspaceBaseEnvironmentsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceEnvironmentsWorkspaceBaseEnvironmentsWorkspaceBaseEnvironmentsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceEnvironmentsWorkspaceBaseEnvironmentsWorkspaceBaseEnvironments struct {
-	BaseEnvironmentType          string                                                                                  `json:"base_environment_type,omitempty"`
-	CreateTime                   string                                                                                  `json:"create_time,omitempty"`
-	CreatorUserId                string                                                                                  `json:"creator_user_id,omitempty"`
-	DisplayName                  string                                                                                  `json:"display_name,omitempty"`
-	EffectiveBaseEnvironmentType string                                                                                  `json:"effective_base_environment_type,omitempty"`
-	Filepath                     string                                                                                  `json:"filepath,omitempty"`
-	IsDefault                    bool                                                                                    `json:"is_default,omitempty"`
-	LastUpdatedUserId            string                                                                                  `json:"last_updated_user_id,omitempty"`
-	Message                      string                                                                                  `json:"message,omitempty"`
-	Name                         string                                                                                  `json:"name"`
-	ProviderConfig               *DataSourceEnvironmentsWorkspaceBaseEnvironmentsWorkspaceBaseEnvironmentsProviderConfig `json:"provider_config,omitempty"`
-	Status                       string                                                                                  `json:"status,omitempty"`
-	UpdateTime                   string                                                                                  `json:"update_time,omitempty"`
-}
-
-type DataSourceEnvironmentsWorkspaceBaseEnvironments struct {
-	PageSize                  int                                                                        `json:"page_size,omitempty"`
-	ProviderConfig            *DataSourceEnvironmentsWorkspaceBaseEnvironmentsProviderConfig             `json:"provider_config,omitempty"`
-	WorkspaceBaseEnvironments []DataSourceEnvironmentsWorkspaceBaseEnvironmentsWorkspaceBaseEnvironments `json:"workspace_base_environments,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_external_location.go b/bundle/internal/tf/schema/data_source_external_location.go
deleted file mode 100644
index 54038eb3205..00000000000
--- a/bundle/internal/tf/schema/data_source_external_location.go
+++ /dev/null
@@ -1,132 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceExternalLocationExternalLocationInfoEffectiveFileEventQueueManagedAqs struct {
-	ManagedResourceId string `json:"managed_resource_id,omitempty"`
-	QueueUrl          string `json:"queue_url,omitempty"`
-	ResourceGroup     string `json:"resource_group,omitempty"`
-	SubscriptionId    string `json:"subscription_id,omitempty"`
-}
-
-type DataSourceExternalLocationExternalLocationInfoEffectiveFileEventQueueManagedPubsub struct {
-	ManagedResourceId string `json:"managed_resource_id,omitempty"`
-	SubscriptionName  string `json:"subscription_name,omitempty"`
-}
-
-type DataSourceExternalLocationExternalLocationInfoEffectiveFileEventQueueManagedSqs struct {
-	ManagedResourceId string `json:"managed_resource_id,omitempty"`
-	QueueUrl          string `json:"queue_url,omitempty"`
-}
-
-type DataSourceExternalLocationExternalLocationInfoEffectiveFileEventQueueProvidedAqs struct {
-	ManagedResourceId string `json:"managed_resource_id,omitempty"`
-	QueueUrl          string `json:"queue_url,omitempty"`
-	ResourceGroup     string `json:"resource_group,omitempty"`
-	SubscriptionId    string `json:"subscription_id,omitempty"`
-}
-
-type DataSourceExternalLocationExternalLocationInfoEffectiveFileEventQueueProvidedPubsub struct {
-	ManagedResourceId string `json:"managed_resource_id,omitempty"`
-	SubscriptionName  string `json:"subscription_name,omitempty"`
-}
-
-type DataSourceExternalLocationExternalLocationInfoEffectiveFileEventQueueProvidedSqs struct {
-	ManagedResourceId string `json:"managed_resource_id,omitempty"`
-	QueueUrl          string `json:"queue_url,omitempty"`
-}
-
-type DataSourceExternalLocationExternalLocationInfoEffectiveFileEventQueue struct {
-	ManagedAqs     *DataSourceExternalLocationExternalLocationInfoEffectiveFileEventQueueManagedAqs     `json:"managed_aqs,omitempty"`
-	ManagedPubsub  *DataSourceExternalLocationExternalLocationInfoEffectiveFileEventQueueManagedPubsub  `json:"managed_pubsub,omitempty"`
-	ManagedSqs     *DataSourceExternalLocationExternalLocationInfoEffectiveFileEventQueueManagedSqs     `json:"managed_sqs,omitempty"`
-	ProvidedAqs    *DataSourceExternalLocationExternalLocationInfoEffectiveFileEventQueueProvidedAqs    `json:"provided_aqs,omitempty"`
-	ProvidedPubsub *DataSourceExternalLocationExternalLocationInfoEffectiveFileEventQueueProvidedPubsub `json:"provided_pubsub,omitempty"`
-	ProvidedSqs    *DataSourceExternalLocationExternalLocationInfoEffectiveFileEventQueueProvidedSqs    `json:"provided_sqs,omitempty"`
-}
-
-type DataSourceExternalLocationExternalLocationInfoEncryptionDetailsSseEncryptionDetails struct {
-	Algorithm    string `json:"algorithm,omitempty"`
-	AwsKmsKeyArn string `json:"aws_kms_key_arn,omitempty"`
-}
-
-type DataSourceExternalLocationExternalLocationInfoEncryptionDetails struct {
-	SseEncryptionDetails *DataSourceExternalLocationExternalLocationInfoEncryptionDetailsSseEncryptionDetails `json:"sse_encryption_details,omitempty"`
-}
-
-type DataSourceExternalLocationExternalLocationInfoFileEventQueueManagedAqs struct {
-	ManagedResourceId string `json:"managed_resource_id,omitempty"`
-	QueueUrl          string `json:"queue_url,omitempty"`
-	ResourceGroup     string `json:"resource_group,omitempty"`
-	SubscriptionId    string `json:"subscription_id,omitempty"`
-}
-
-type DataSourceExternalLocationExternalLocationInfoFileEventQueueManagedPubsub struct {
-	ManagedResourceId string `json:"managed_resource_id,omitempty"`
-	SubscriptionName  string `json:"subscription_name,omitempty"`
-}
-
-type DataSourceExternalLocationExternalLocationInfoFileEventQueueManagedSqs struct {
-	ManagedResourceId string `json:"managed_resource_id,omitempty"`
-	QueueUrl          string `json:"queue_url,omitempty"`
-}
-
-type DataSourceExternalLocationExternalLocationInfoFileEventQueueProvidedAqs struct {
-	ManagedResourceId string `json:"managed_resource_id,omitempty"`
-	QueueUrl          string `json:"queue_url,omitempty"`
-	ResourceGroup     string `json:"resource_group,omitempty"`
-	SubscriptionId    string `json:"subscription_id,omitempty"`
-}
-
-type DataSourceExternalLocationExternalLocationInfoFileEventQueueProvidedPubsub struct {
-	ManagedResourceId string `json:"managed_resource_id,omitempty"`
-	SubscriptionName  string `json:"subscription_name,omitempty"`
-}
-
-type DataSourceExternalLocationExternalLocationInfoFileEventQueueProvidedSqs struct {
-	ManagedResourceId string `json:"managed_resource_id,omitempty"`
-	QueueUrl          string `json:"queue_url,omitempty"`
-}
-
-type DataSourceExternalLocationExternalLocationInfoFileEventQueue struct {
-	ManagedAqs     *DataSourceExternalLocationExternalLocationInfoFileEventQueueManagedAqs     `json:"managed_aqs,omitempty"`
-	ManagedPubsub  *DataSourceExternalLocationExternalLocationInfoFileEventQueueManagedPubsub  `json:"managed_pubsub,omitempty"`
-	ManagedSqs     *DataSourceExternalLocationExternalLocationInfoFileEventQueueManagedSqs     `json:"managed_sqs,omitempty"`
-	ProvidedAqs    *DataSourceExternalLocationExternalLocationInfoFileEventQueueProvidedAqs    `json:"provided_aqs,omitempty"`
-	ProvidedPubsub *DataSourceExternalLocationExternalLocationInfoFileEventQueueProvidedPubsub `json:"provided_pubsub,omitempty"`
-	ProvidedSqs    *DataSourceExternalLocationExternalLocationInfoFileEventQueueProvidedSqs    `json:"provided_sqs,omitempty"`
-}
-
-type DataSourceExternalLocationExternalLocationInfo struct {
-	BrowseOnly                bool                                                                   `json:"browse_only,omitempty"`
-	Comment                   string                                                                 `json:"comment,omitempty"`
-	CreatedAt                 int                                                                    `json:"created_at,omitempty"`
-	CreatedBy                 string                                                                 `json:"created_by,omitempty"`
-	CredentialId              string                                                                 `json:"credential_id,omitempty"`
-	CredentialName            string                                                                 `json:"credential_name,omitempty"`
-	EffectiveEnableFileEvents bool                                                                   `json:"effective_enable_file_events,omitempty"`
-	EnableFileEvents          bool                                                                   `json:"enable_file_events,omitempty"`
-	Fallback                  bool                                                                   `json:"fallback,omitempty"`
-	IsolationMode             string                                                                 `json:"isolation_mode,omitempty"`
-	MetastoreId               string                                                                 `json:"metastore_id,omitempty"`
-	Name                      string                                                                 `json:"name,omitempty"`
-	Owner                     string                                                                 `json:"owner,omitempty"`
-	ReadOnly                  bool                                                                   `json:"read_only,omitempty"`
-	UpdatedAt                 int                                                                    `json:"updated_at,omitempty"`
-	UpdatedBy                 string                                                                 `json:"updated_by,omitempty"`
-	Url                       string                                                                 `json:"url,omitempty"`
-	EffectiveFileEventQueue   *DataSourceExternalLocationExternalLocationInfoEffectiveFileEventQueue `json:"effective_file_event_queue,omitempty"`
-	EncryptionDetails         *DataSourceExternalLocationExternalLocationInfoEncryptionDetails       `json:"encryption_details,omitempty"`
-	FileEventQueue            *DataSourceExternalLocationExternalLocationInfoFileEventQueue          `json:"file_event_queue,omitempty"`
-}
-
-type DataSourceExternalLocationProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceExternalLocation struct {
-	Id                   string                                          `json:"id,omitempty"`
-	Name                 string                                          `json:"name"`
-	ExternalLocationInfo *DataSourceExternalLocationExternalLocationInfo `json:"external_location_info,omitempty"`
-	ProviderConfig       *DataSourceExternalLocationProviderConfig       `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_external_locations.go b/bundle/internal/tf/schema/data_source_external_locations.go
deleted file mode 100644
index 33524023634..00000000000
--- a/bundle/internal/tf/schema/data_source_external_locations.go
+++ /dev/null
@@ -1,13 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceExternalLocationsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceExternalLocations struct {
-	Id             string                                     `json:"id,omitempty"`
-	Names          []string                                   `json:"names,omitempty"`
-	ProviderConfig *DataSourceExternalLocationsProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_external_metadata.go b/bundle/internal/tf/schema/data_source_external_metadata.go
deleted file mode 100644
index 5d1cd000186..00000000000
--- a/bundle/internal/tf/schema/data_source_external_metadata.go
+++ /dev/null
@@ -1,25 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceExternalMetadataProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceExternalMetadata struct {
-	Columns        []string                                  `json:"columns,omitempty"`
-	CreateTime     string                                    `json:"create_time,omitempty"`
-	CreatedBy      string                                    `json:"created_by,omitempty"`
-	Description    string                                    `json:"description,omitempty"`
-	EntityType     string                                    `json:"entity_type,omitempty"`
-	Id             string                                    `json:"id,omitempty"`
-	MetastoreId    string                                    `json:"metastore_id,omitempty"`
-	Name           string                                    `json:"name"`
-	Owner          string                                    `json:"owner,omitempty"`
-	Properties     map[string]string                         `json:"properties,omitempty"`
-	ProviderConfig *DataSourceExternalMetadataProviderConfig `json:"provider_config,omitempty"`
-	SystemType     string                                    `json:"system_type,omitempty"`
-	UpdateTime     string                                    `json:"update_time,omitempty"`
-	UpdatedBy      string                                    `json:"updated_by,omitempty"`
-	Url            string                                    `json:"url,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_external_metadatas.go b/bundle/internal/tf/schema/data_source_external_metadatas.go
deleted file mode 100644
index 9ccce94b4b5..00000000000
--- a/bundle/internal/tf/schema/data_source_external_metadatas.go
+++ /dev/null
@@ -1,35 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceExternalMetadatasExternalMetadataProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceExternalMetadatasExternalMetadata struct {
-	Columns        []string                                                   `json:"columns,omitempty"`
-	CreateTime     string                                                     `json:"create_time,omitempty"`
-	CreatedBy      string                                                     `json:"created_by,omitempty"`
-	Description    string                                                     `json:"description,omitempty"`
-	EntityType     string                                                     `json:"entity_type,omitempty"`
-	Id             string                                                     `json:"id,omitempty"`
-	MetastoreId    string                                                     `json:"metastore_id,omitempty"`
-	Name           string                                                     `json:"name"`
-	Owner          string                                                     `json:"owner,omitempty"`
-	Properties     map[string]string                                          `json:"properties,omitempty"`
-	ProviderConfig *DataSourceExternalMetadatasExternalMetadataProviderConfig `json:"provider_config,omitempty"`
-	SystemType     string                                                     `json:"system_type,omitempty"`
-	UpdateTime     string                                                     `json:"update_time,omitempty"`
-	UpdatedBy      string                                                     `json:"updated_by,omitempty"`
-	Url            string                                                     `json:"url,omitempty"`
-}
-
-type DataSourceExternalMetadatasProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceExternalMetadatas struct {
-	ExternalMetadata []DataSourceExternalMetadatasExternalMetadata `json:"external_metadata,omitempty"`
-	PageSize         int                                           `json:"page_size,omitempty"`
-	ProviderConfig   *DataSourceExternalMetadatasProviderConfig    `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_feature_engineering_feature.go b/bundle/internal/tf/schema/data_source_feature_engineering_feature.go
deleted file mode 100644
index 7cb9e275dc1..00000000000
--- a/bundle/internal/tf/schema/data_source_feature_engineering_feature.go
+++ /dev/null
@@ -1,210 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceFeatureEngineeringFeatureEntities struct {
-	Name string `json:"name"`
-}
-
-type DataSourceFeatureEngineeringFeatureFunctionAggregationFunctionApproxCountDistinct struct {
-	Input      string `json:"input"`
-	RelativeSd int    `json:"relative_sd,omitempty"`
-}
-
-type DataSourceFeatureEngineeringFeatureFunctionAggregationFunctionApproxPercentile struct {
-	Accuracy   int    `json:"accuracy,omitempty"`
-	Input      string `json:"input"`
-	Percentile int    `json:"percentile"`
-}
-
-type DataSourceFeatureEngineeringFeatureFunctionAggregationFunctionAvg struct {
-	Input string `json:"input"`
-}
-
-type DataSourceFeatureEngineeringFeatureFunctionAggregationFunctionCountFunction struct {
-	Input string `json:"input"`
-}
-
-type DataSourceFeatureEngineeringFeatureFunctionAggregationFunctionFirst struct {
-	Input string `json:"input"`
-}
-
-type DataSourceFeatureEngineeringFeatureFunctionAggregationFunctionLast struct {
-	Input string `json:"input"`
-}
-
-type DataSourceFeatureEngineeringFeatureFunctionAggregationFunctionMax struct {
-	Input string `json:"input"`
-}
-
-type DataSourceFeatureEngineeringFeatureFunctionAggregationFunctionMin struct {
-	Input string `json:"input"`
-}
-
-type DataSourceFeatureEngineeringFeatureFunctionAggregationFunctionStddevPop struct {
-	Input string `json:"input"`
-}
-
-type DataSourceFeatureEngineeringFeatureFunctionAggregationFunctionStddevSamp struct {
-	Input string `json:"input"`
-}
-
-type DataSourceFeatureEngineeringFeatureFunctionAggregationFunctionSum struct {
-	Input string `json:"input"`
-}
-
-type DataSourceFeatureEngineeringFeatureFunctionAggregationFunctionTimeWindowContinuous struct {
-	Offset         string `json:"offset,omitempty"`
-	WindowDuration string `json:"window_duration"`
-}
-
-type DataSourceFeatureEngineeringFeatureFunctionAggregationFunctionTimeWindowSliding struct {
-	SlideDuration  string `json:"slide_duration"`
-	WindowDuration string `json:"window_duration"`
-}
-
-type DataSourceFeatureEngineeringFeatureFunctionAggregationFunctionTimeWindowTumbling struct {
-	WindowDuration string `json:"window_duration"`
-}
-
-type DataSourceFeatureEngineeringFeatureFunctionAggregationFunctionTimeWindow struct {
-	Continuous *DataSourceFeatureEngineeringFeatureFunctionAggregationFunctionTimeWindowContinuous `json:"continuous,omitempty"`
-	Sliding    *DataSourceFeatureEngineeringFeatureFunctionAggregationFunctionTimeWindowSliding    `json:"sliding,omitempty"`
-	Tumbling   *DataSourceFeatureEngineeringFeatureFunctionAggregationFunctionTimeWindowTumbling   `json:"tumbling,omitempty"`
-}
-
-type DataSourceFeatureEngineeringFeatureFunctionAggregationFunctionVarPop struct {
-	Input string `json:"input"`
-}
-
-type DataSourceFeatureEngineeringFeatureFunctionAggregationFunctionVarSamp struct {
-	Input string `json:"input"`
-}
-
-type DataSourceFeatureEngineeringFeatureFunctionAggregationFunction struct {
-	ApproxCountDistinct *DataSourceFeatureEngineeringFeatureFunctionAggregationFunctionApproxCountDistinct `json:"approx_count_distinct,omitempty"`
-	ApproxPercentile    *DataSourceFeatureEngineeringFeatureFunctionAggregationFunctionApproxPercentile    `json:"approx_percentile,omitempty"`
-	Avg                 *DataSourceFeatureEngineeringFeatureFunctionAggregationFunctionAvg                 `json:"avg,omitempty"`
-	CountFunction       *DataSourceFeatureEngineeringFeatureFunctionAggregationFunctionCountFunction       `json:"count_function,omitempty"`
-	First               *DataSourceFeatureEngineeringFeatureFunctionAggregationFunctionFirst               `json:"first,omitempty"`
-	Last                *DataSourceFeatureEngineeringFeatureFunctionAggregationFunctionLast                `json:"last,omitempty"`
-	Max                 *DataSourceFeatureEngineeringFeatureFunctionAggregationFunctionMax                 `json:"max,omitempty"`
-	Min                 *DataSourceFeatureEngineeringFeatureFunctionAggregationFunctionMin                 `json:"min,omitempty"`
-	StddevPop           *DataSourceFeatureEngineeringFeatureFunctionAggregationFunctionStddevPop           `json:"stddev_pop,omitempty"`
-	StddevSamp          *DataSourceFeatureEngineeringFeatureFunctionAggregationFunctionStddevSamp          `json:"stddev_samp,omitempty"`
-	Sum                 *DataSourceFeatureEngineeringFeatureFunctionAggregationFunctionSum                 `json:"sum,omitempty"`
-	TimeWindow          *DataSourceFeatureEngineeringFeatureFunctionAggregationFunctionTimeWindow          `json:"time_window,omitempty"`
-	VarPop              *DataSourceFeatureEngineeringFeatureFunctionAggregationFunctionVarPop              `json:"var_pop,omitempty"`
-	VarSamp             *DataSourceFeatureEngineeringFeatureFunctionAggregationFunctionVarSamp             `json:"var_samp,omitempty"`
-}
-
-type DataSourceFeatureEngineeringFeatureFunctionColumnSelection struct {
-	Column string `json:"column"`
-}
-
-type DataSourceFeatureEngineeringFeatureFunctionExtraParameters struct {
-	Key   string `json:"key"`
-	Value string `json:"value"`
-}
-
-type DataSourceFeatureEngineeringFeatureFunction struct {
-	AggregationFunction *DataSourceFeatureEngineeringFeatureFunctionAggregationFunction `json:"aggregation_function,omitempty"`
-	ColumnSelection     *DataSourceFeatureEngineeringFeatureFunctionColumnSelection     `json:"column_selection,omitempty"`
-	ExtraParameters     []DataSourceFeatureEngineeringFeatureFunctionExtraParameters    `json:"extra_parameters,omitempty"`
-	FunctionType        string                                                          `json:"function_type,omitempty"`
-}
-
-type DataSourceFeatureEngineeringFeatureLineageContextJobContext struct {
-	JobId    int `json:"job_id,omitempty"`
-	JobRunId int `json:"job_run_id,omitempty"`
-}
-
-type DataSourceFeatureEngineeringFeatureLineageContext struct {
-	JobContext *DataSourceFeatureEngineeringFeatureLineageContextJobContext `json:"job_context,omitempty"`
-	NotebookId int                                                          `json:"notebook_id,omitempty"`
-}
-
-type DataSourceFeatureEngineeringFeatureProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceFeatureEngineeringFeatureSourceDeltaTableSource struct {
-	DataframeSchema   string   `json:"dataframe_schema,omitempty"`
-	EntityColumns     []string `json:"entity_columns,omitempty"`
-	FilterCondition   string   `json:"filter_condition,omitempty"`
-	FullName          string   `json:"full_name"`
-	TimeseriesColumn  string   `json:"timeseries_column,omitempty"`
-	TransformationSql string   `json:"transformation_sql,omitempty"`
-}
-
-type DataSourceFeatureEngineeringFeatureSourceKafkaSourceEntityColumnIdentifiers struct {
-	VariantExprPath string `json:"variant_expr_path"`
-}
-
-type DataSourceFeatureEngineeringFeatureSourceKafkaSourceTimeseriesColumnIdentifier struct {
-	VariantExprPath string `json:"variant_expr_path"`
-}
-
-type DataSourceFeatureEngineeringFeatureSourceKafkaSource struct {
-	EntityColumnIdentifiers    []DataSourceFeatureEngineeringFeatureSourceKafkaSourceEntityColumnIdentifiers   `json:"entity_column_identifiers,omitempty"`
-	FilterCondition            string                                                                          `json:"filter_condition,omitempty"`
-	Name                       string                                                                          `json:"name"`
-	TimeseriesColumnIdentifier *DataSourceFeatureEngineeringFeatureSourceKafkaSourceTimeseriesColumnIdentifier `json:"timeseries_column_identifier,omitempty"`
-}
-
-type DataSourceFeatureEngineeringFeatureSourceRequestSourceFlatSchemaFields struct {
-	DataType string `json:"data_type"`
-	Name     string `json:"name"`
-}
-
-type DataSourceFeatureEngineeringFeatureSourceRequestSourceFlatSchema struct {
-	Fields []DataSourceFeatureEngineeringFeatureSourceRequestSourceFlatSchemaFields `json:"fields,omitempty"`
-}
-
-type DataSourceFeatureEngineeringFeatureSourceRequestSource struct {
-	FlatSchema *DataSourceFeatureEngineeringFeatureSourceRequestSourceFlatSchema `json:"flat_schema,omitempty"`
-}
-
-type DataSourceFeatureEngineeringFeatureSource struct {
-	DeltaTableSource *DataSourceFeatureEngineeringFeatureSourceDeltaTableSource `json:"delta_table_source,omitempty"`
-	KafkaSource      *DataSourceFeatureEngineeringFeatureSourceKafkaSource      `json:"kafka_source,omitempty"`
-	RequestSource    *DataSourceFeatureEngineeringFeatureSourceRequestSource    `json:"request_source,omitempty"`
-}
-
-type DataSourceFeatureEngineeringFeatureTimeWindowContinuous struct {
-	Offset         string `json:"offset,omitempty"`
-	WindowDuration string `json:"window_duration"`
-}
-
-type DataSourceFeatureEngineeringFeatureTimeWindowSliding struct {
-	SlideDuration  string `json:"slide_duration"`
-	WindowDuration string `json:"window_duration"`
-}
-
-type DataSourceFeatureEngineeringFeatureTimeWindowTumbling struct {
-	WindowDuration string `json:"window_duration"`
-}
-
-type DataSourceFeatureEngineeringFeatureTimeWindow struct {
-	Continuous *DataSourceFeatureEngineeringFeatureTimeWindowContinuous `json:"continuous,omitempty"`
-	Sliding    *DataSourceFeatureEngineeringFeatureTimeWindowSliding    `json:"sliding,omitempty"`
-	Tumbling   *DataSourceFeatureEngineeringFeatureTimeWindowTumbling   `json:"tumbling,omitempty"`
-}
-
-type DataSourceFeatureEngineeringFeatureTimeseriesColumn struct {
-	Name string `json:"name"`
-}
-
-type DataSourceFeatureEngineeringFeature struct {
-	Description      string                                               `json:"description,omitempty"`
-	Entities         []DataSourceFeatureEngineeringFeatureEntities        `json:"entities,omitempty"`
-	FilterCondition  string                                               `json:"filter_condition,omitempty"`
-	FullName         string                                               `json:"full_name"`
-	Function         *DataSourceFeatureEngineeringFeatureFunction         `json:"function,omitempty"`
-	Inputs           []string                                             `json:"inputs,omitempty"`
-	LineageContext   *DataSourceFeatureEngineeringFeatureLineageContext   `json:"lineage_context,omitempty"`
-	ProviderConfig   *DataSourceFeatureEngineeringFeatureProviderConfig   `json:"provider_config,omitempty"`
-	Source           *DataSourceFeatureEngineeringFeatureSource           `json:"source,omitempty"`
-	TimeWindow       *DataSourceFeatureEngineeringFeatureTimeWindow       `json:"time_window,omitempty"`
-	TimeseriesColumn *DataSourceFeatureEngineeringFeatureTimeseriesColumn `json:"timeseries_column,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_feature_engineering_features.go b/bundle/internal/tf/schema/data_source_feature_engineering_features.go
deleted file mode 100644
index cc7a00b22d6..00000000000
--- a/bundle/internal/tf/schema/data_source_feature_engineering_features.go
+++ /dev/null
@@ -1,220 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceFeatureEngineeringFeaturesFeaturesEntities struct {
-	Name string `json:"name"`
-}
-
-type DataSourceFeatureEngineeringFeaturesFeaturesFunctionAggregationFunctionApproxCountDistinct struct {
-	Input      string `json:"input"`
-	RelativeSd int    `json:"relative_sd,omitempty"`
-}
-
-type DataSourceFeatureEngineeringFeaturesFeaturesFunctionAggregationFunctionApproxPercentile struct {
-	Accuracy   int    `json:"accuracy,omitempty"`
-	Input      string `json:"input"`
-	Percentile int    `json:"percentile"`
-}
-
-type DataSourceFeatureEngineeringFeaturesFeaturesFunctionAggregationFunctionAvg struct {
-	Input string `json:"input"`
-}
-
-type DataSourceFeatureEngineeringFeaturesFeaturesFunctionAggregationFunctionCountFunction struct {
-	Input string `json:"input"`
-}
-
-type DataSourceFeatureEngineeringFeaturesFeaturesFunctionAggregationFunctionFirst struct {
-	Input string `json:"input"`
-}
-
-type DataSourceFeatureEngineeringFeaturesFeaturesFunctionAggregationFunctionLast struct {
-	Input string `json:"input"`
-}
-
-type DataSourceFeatureEngineeringFeaturesFeaturesFunctionAggregationFunctionMax struct {
-	Input string `json:"input"`
-}
-
-type DataSourceFeatureEngineeringFeaturesFeaturesFunctionAggregationFunctionMin struct {
-	Input string `json:"input"`
-}
-
-type DataSourceFeatureEngineeringFeaturesFeaturesFunctionAggregationFunctionStddevPop struct {
-	Input string `json:"input"`
-}
-
-type DataSourceFeatureEngineeringFeaturesFeaturesFunctionAggregationFunctionStddevSamp struct {
-	Input string `json:"input"`
-}
-
-type DataSourceFeatureEngineeringFeaturesFeaturesFunctionAggregationFunctionSum struct {
-	Input string `json:"input"`
-}
-
-type DataSourceFeatureEngineeringFeaturesFeaturesFunctionAggregationFunctionTimeWindowContinuous struct {
-	Offset         string `json:"offset,omitempty"`
-	WindowDuration string `json:"window_duration"`
-}
-
-type DataSourceFeatureEngineeringFeaturesFeaturesFunctionAggregationFunctionTimeWindowSliding struct {
-	SlideDuration  string `json:"slide_duration"`
-	WindowDuration string `json:"window_duration"`
-}
-
-type DataSourceFeatureEngineeringFeaturesFeaturesFunctionAggregationFunctionTimeWindowTumbling struct {
-	WindowDuration string `json:"window_duration"`
-}
-
-type DataSourceFeatureEngineeringFeaturesFeaturesFunctionAggregationFunctionTimeWindow struct {
-	Continuous *DataSourceFeatureEngineeringFeaturesFeaturesFunctionAggregationFunctionTimeWindowContinuous `json:"continuous,omitempty"`
-	Sliding    *DataSourceFeatureEngineeringFeaturesFeaturesFunctionAggregationFunctionTimeWindowSliding    `json:"sliding,omitempty"`
-	Tumbling   *DataSourceFeatureEngineeringFeaturesFeaturesFunctionAggregationFunctionTimeWindowTumbling   `json:"tumbling,omitempty"`
-}
-
-type DataSourceFeatureEngineeringFeaturesFeaturesFunctionAggregationFunctionVarPop struct {
-	Input string `json:"input"`
-}
-
-type DataSourceFeatureEngineeringFeaturesFeaturesFunctionAggregationFunctionVarSamp struct {
-	Input string `json:"input"`
-}
-
-type DataSourceFeatureEngineeringFeaturesFeaturesFunctionAggregationFunction struct {
-	ApproxCountDistinct *DataSourceFeatureEngineeringFeaturesFeaturesFunctionAggregationFunctionApproxCountDistinct `json:"approx_count_distinct,omitempty"`
-	ApproxPercentile    *DataSourceFeatureEngineeringFeaturesFeaturesFunctionAggregationFunctionApproxPercentile    `json:"approx_percentile,omitempty"`
-	Avg                 *DataSourceFeatureEngineeringFeaturesFeaturesFunctionAggregationFunctionAvg                 `json:"avg,omitempty"`
-	CountFunction       *DataSourceFeatureEngineeringFeaturesFeaturesFunctionAggregationFunctionCountFunction       `json:"count_function,omitempty"`
-	First               *DataSourceFeatureEngineeringFeaturesFeaturesFunctionAggregationFunctionFirst               `json:"first,omitempty"`
-	Last                *DataSourceFeatureEngineeringFeaturesFeaturesFunctionAggregationFunctionLast                `json:"last,omitempty"`
-	Max                 *DataSourceFeatureEngineeringFeaturesFeaturesFunctionAggregationFunctionMax                 `json:"max,omitempty"`
-	Min                 *DataSourceFeatureEngineeringFeaturesFeaturesFunctionAggregationFunctionMin                 `json:"min,omitempty"`
-	StddevPop           *DataSourceFeatureEngineeringFeaturesFeaturesFunctionAggregationFunctionStddevPop           `json:"stddev_pop,omitempty"`
-	StddevSamp          *DataSourceFeatureEngineeringFeaturesFeaturesFunctionAggregationFunctionStddevSamp          `json:"stddev_samp,omitempty"`
-	Sum                 *DataSourceFeatureEngineeringFeaturesFeaturesFunctionAggregationFunctionSum                 `json:"sum,omitempty"`
-	TimeWindow          *DataSourceFeatureEngineeringFeaturesFeaturesFunctionAggregationFunctionTimeWindow          `json:"time_window,omitempty"`
-	VarPop              *DataSourceFeatureEngineeringFeaturesFeaturesFunctionAggregationFunctionVarPop              `json:"var_pop,omitempty"`
-	VarSamp             *DataSourceFeatureEngineeringFeaturesFeaturesFunctionAggregationFunctionVarSamp             `json:"var_samp,omitempty"`
-}
-
-type DataSourceFeatureEngineeringFeaturesFeaturesFunctionColumnSelection struct {
-	Column string `json:"column"`
-}
-
-type DataSourceFeatureEngineeringFeaturesFeaturesFunctionExtraParameters struct {
-	Key   string `json:"key"`
-	Value string `json:"value"`
-}
-
-type DataSourceFeatureEngineeringFeaturesFeaturesFunction struct {
-	AggregationFunction *DataSourceFeatureEngineeringFeaturesFeaturesFunctionAggregationFunction `json:"aggregation_function,omitempty"`
-	ColumnSelection     *DataSourceFeatureEngineeringFeaturesFeaturesFunctionColumnSelection     `json:"column_selection,omitempty"`
-	ExtraParameters     []DataSourceFeatureEngineeringFeaturesFeaturesFunctionExtraParameters    `json:"extra_parameters,omitempty"`
-	FunctionType        string                                                                   `json:"function_type,omitempty"`
-}
-
-type DataSourceFeatureEngineeringFeaturesFeaturesLineageContextJobContext struct {
-	JobId    int `json:"job_id,omitempty"`
-	JobRunId int `json:"job_run_id,omitempty"`
-}
-
-type DataSourceFeatureEngineeringFeaturesFeaturesLineageContext struct {
-	JobContext *DataSourceFeatureEngineeringFeaturesFeaturesLineageContextJobContext `json:"job_context,omitempty"`
-	NotebookId int                                                                   `json:"notebook_id,omitempty"`
-}
-
-type DataSourceFeatureEngineeringFeaturesFeaturesProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceFeatureEngineeringFeaturesFeaturesSourceDeltaTableSource struct {
-	DataframeSchema   string   `json:"dataframe_schema,omitempty"`
-	EntityColumns     []string `json:"entity_columns,omitempty"`
-	FilterCondition   string   `json:"filter_condition,omitempty"`
-	FullName          string   `json:"full_name"`
-	TimeseriesColumn  string   `json:"timeseries_column,omitempty"`
-	TransformationSql string   `json:"transformation_sql,omitempty"`
-}
-
-type DataSourceFeatureEngineeringFeaturesFeaturesSourceKafkaSourceEntityColumnIdentifiers struct {
-	VariantExprPath string `json:"variant_expr_path"`
-}
-
-type DataSourceFeatureEngineeringFeaturesFeaturesSourceKafkaSourceTimeseriesColumnIdentifier struct {
-	VariantExprPath string `json:"variant_expr_path"`
-}
-
-type DataSourceFeatureEngineeringFeaturesFeaturesSourceKafkaSource struct {
-	EntityColumnIdentifiers    []DataSourceFeatureEngineeringFeaturesFeaturesSourceKafkaSourceEntityColumnIdentifiers   `json:"entity_column_identifiers,omitempty"`
-	FilterCondition            string                                                                                   `json:"filter_condition,omitempty"`
-	Name                       string                                                                                   `json:"name"`
-	TimeseriesColumnIdentifier *DataSourceFeatureEngineeringFeaturesFeaturesSourceKafkaSourceTimeseriesColumnIdentifier `json:"timeseries_column_identifier,omitempty"`
-}
-
-type DataSourceFeatureEngineeringFeaturesFeaturesSourceRequestSourceFlatSchemaFields struct {
-	DataType string `json:"data_type"`
-	Name     string `json:"name"`
-}
-
-type DataSourceFeatureEngineeringFeaturesFeaturesSourceRequestSourceFlatSchema struct {
-	Fields []DataSourceFeatureEngineeringFeaturesFeaturesSourceRequestSourceFlatSchemaFields `json:"fields,omitempty"`
-}
-
-type DataSourceFeatureEngineeringFeaturesFeaturesSourceRequestSource struct {
-	FlatSchema *DataSourceFeatureEngineeringFeaturesFeaturesSourceRequestSourceFlatSchema `json:"flat_schema,omitempty"`
-}
-
-type DataSourceFeatureEngineeringFeaturesFeaturesSource struct {
-	DeltaTableSource *DataSourceFeatureEngineeringFeaturesFeaturesSourceDeltaTableSource `json:"delta_table_source,omitempty"`
-	KafkaSource      *DataSourceFeatureEngineeringFeaturesFeaturesSourceKafkaSource      `json:"kafka_source,omitempty"`
-	RequestSource    *DataSourceFeatureEngineeringFeaturesFeaturesSourceRequestSource    `json:"request_source,omitempty"`
-}
-
-type DataSourceFeatureEngineeringFeaturesFeaturesTimeWindowContinuous struct {
-	Offset         string `json:"offset,omitempty"`
-	WindowDuration string `json:"window_duration"`
-}
-
-type DataSourceFeatureEngineeringFeaturesFeaturesTimeWindowSliding struct {
-	SlideDuration  string `json:"slide_duration"`
-	WindowDuration string `json:"window_duration"`
-}
-
-type DataSourceFeatureEngineeringFeaturesFeaturesTimeWindowTumbling struct {
-	WindowDuration string `json:"window_duration"`
-}
-
-type DataSourceFeatureEngineeringFeaturesFeaturesTimeWindow struct {
-	Continuous *DataSourceFeatureEngineeringFeaturesFeaturesTimeWindowContinuous `json:"continuous,omitempty"`
-	Sliding    *DataSourceFeatureEngineeringFeaturesFeaturesTimeWindowSliding    `json:"sliding,omitempty"`
-	Tumbling   *DataSourceFeatureEngineeringFeaturesFeaturesTimeWindowTumbling   `json:"tumbling,omitempty"`
-}
-
-type DataSourceFeatureEngineeringFeaturesFeaturesTimeseriesColumn struct {
-	Name string `json:"name"`
-}
-
-type DataSourceFeatureEngineeringFeaturesFeatures struct {
-	Description      string                                                        `json:"description,omitempty"`
-	Entities         []DataSourceFeatureEngineeringFeaturesFeaturesEntities        `json:"entities,omitempty"`
-	FilterCondition  string                                                        `json:"filter_condition,omitempty"`
-	FullName         string                                                        `json:"full_name"`
-	Function         *DataSourceFeatureEngineeringFeaturesFeaturesFunction         `json:"function,omitempty"`
-	Inputs           []string                                                      `json:"inputs,omitempty"`
-	LineageContext   *DataSourceFeatureEngineeringFeaturesFeaturesLineageContext   `json:"lineage_context,omitempty"`
-	ProviderConfig   *DataSourceFeatureEngineeringFeaturesFeaturesProviderConfig   `json:"provider_config,omitempty"`
-	Source           *DataSourceFeatureEngineeringFeaturesFeaturesSource           `json:"source,omitempty"`
-	TimeWindow       *DataSourceFeatureEngineeringFeaturesFeaturesTimeWindow       `json:"time_window,omitempty"`
-	TimeseriesColumn *DataSourceFeatureEngineeringFeaturesFeaturesTimeseriesColumn `json:"timeseries_column,omitempty"`
-}
-
-type DataSourceFeatureEngineeringFeaturesProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceFeatureEngineeringFeatures struct {
-	Features       []DataSourceFeatureEngineeringFeaturesFeatures      `json:"features,omitempty"`
-	PageSize       int                                                 `json:"page_size,omitempty"`
-	ProviderConfig *DataSourceFeatureEngineeringFeaturesProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_feature_engineering_kafka_config.go b/bundle/internal/tf/schema/data_source_feature_engineering_kafka_config.go
deleted file mode 100644
index e16324ca395..00000000000
--- a/bundle/internal/tf/schema/data_source_feature_engineering_kafka_config.go
+++ /dev/null
@@ -1,50 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceFeatureEngineeringKafkaConfigAuthConfig struct {
-	UcServiceCredentialName string `json:"uc_service_credential_name,omitempty"`
-}
-
-type DataSourceFeatureEngineeringKafkaConfigBackfillSourceDeltaTableSource struct {
-	DataframeSchema   string   `json:"dataframe_schema,omitempty"`
-	EntityColumns     []string `json:"entity_columns,omitempty"`
-	FilterCondition   string   `json:"filter_condition,omitempty"`
-	FullName          string   `json:"full_name"`
-	TimeseriesColumn  string   `json:"timeseries_column,omitempty"`
-	TransformationSql string   `json:"transformation_sql,omitempty"`
-}
-
-type DataSourceFeatureEngineeringKafkaConfigBackfillSource struct {
-	DeltaTableSource *DataSourceFeatureEngineeringKafkaConfigBackfillSourceDeltaTableSource `json:"delta_table_source,omitempty"`
-}
-
-type DataSourceFeatureEngineeringKafkaConfigKeySchema struct {
-	JsonSchema string `json:"json_schema,omitempty"`
-}
-
-type DataSourceFeatureEngineeringKafkaConfigProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceFeatureEngineeringKafkaConfigSubscriptionMode struct {
-	Assign           string `json:"assign,omitempty"`
-	Subscribe        string `json:"subscribe,omitempty"`
-	SubscribePattern string `json:"subscribe_pattern,omitempty"`
-}
-
-type DataSourceFeatureEngineeringKafkaConfigValueSchema struct {
-	JsonSchema string `json:"json_schema,omitempty"`
-}
-
-type DataSourceFeatureEngineeringKafkaConfig struct {
-	AuthConfig       *DataSourceFeatureEngineeringKafkaConfigAuthConfig       `json:"auth_config,omitempty"`
-	BackfillSource   *DataSourceFeatureEngineeringKafkaConfigBackfillSource   `json:"backfill_source,omitempty"`
-	BootstrapServers string                                                   `json:"bootstrap_servers,omitempty"`
-	ExtraOptions     map[string]string                                        `json:"extra_options,omitempty"`
-	KeySchema        *DataSourceFeatureEngineeringKafkaConfigKeySchema        `json:"key_schema,omitempty"`
-	Name             string                                                   `json:"name"`
-	ProviderConfig   *DataSourceFeatureEngineeringKafkaConfigProviderConfig   `json:"provider_config,omitempty"`
-	SubscriptionMode *DataSourceFeatureEngineeringKafkaConfigSubscriptionMode `json:"subscription_mode,omitempty"`
-	ValueSchema      *DataSourceFeatureEngineeringKafkaConfigValueSchema      `json:"value_schema,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_feature_engineering_kafka_configs.go b/bundle/internal/tf/schema/data_source_feature_engineering_kafka_configs.go
deleted file mode 100644
index 41016125441..00000000000
--- a/bundle/internal/tf/schema/data_source_feature_engineering_kafka_configs.go
+++ /dev/null
@@ -1,60 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceFeatureEngineeringKafkaConfigsKafkaConfigsAuthConfig struct {
-	UcServiceCredentialName string `json:"uc_service_credential_name,omitempty"`
-}
-
-type DataSourceFeatureEngineeringKafkaConfigsKafkaConfigsBackfillSourceDeltaTableSource struct {
-	DataframeSchema   string   `json:"dataframe_schema,omitempty"`
-	EntityColumns     []string `json:"entity_columns,omitempty"`
-	FilterCondition   string   `json:"filter_condition,omitempty"`
-	FullName          string   `json:"full_name"`
-	TimeseriesColumn  string   `json:"timeseries_column,omitempty"`
-	TransformationSql string   `json:"transformation_sql,omitempty"`
-}
-
-type DataSourceFeatureEngineeringKafkaConfigsKafkaConfigsBackfillSource struct {
-	DeltaTableSource *DataSourceFeatureEngineeringKafkaConfigsKafkaConfigsBackfillSourceDeltaTableSource `json:"delta_table_source,omitempty"`
-}
-
-type DataSourceFeatureEngineeringKafkaConfigsKafkaConfigsKeySchema struct {
-	JsonSchema string `json:"json_schema,omitempty"`
-}
-
-type DataSourceFeatureEngineeringKafkaConfigsKafkaConfigsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceFeatureEngineeringKafkaConfigsKafkaConfigsSubscriptionMode struct {
-	Assign           string `json:"assign,omitempty"`
-	Subscribe        string `json:"subscribe,omitempty"`
-	SubscribePattern string `json:"subscribe_pattern,omitempty"`
-}
-
-type DataSourceFeatureEngineeringKafkaConfigsKafkaConfigsValueSchema struct {
-	JsonSchema string `json:"json_schema,omitempty"`
-}
-
-type DataSourceFeatureEngineeringKafkaConfigsKafkaConfigs struct {
-	AuthConfig       *DataSourceFeatureEngineeringKafkaConfigsKafkaConfigsAuthConfig       `json:"auth_config,omitempty"`
-	BackfillSource   *DataSourceFeatureEngineeringKafkaConfigsKafkaConfigsBackfillSource   `json:"backfill_source,omitempty"`
-	BootstrapServers string                                                                `json:"bootstrap_servers,omitempty"`
-	ExtraOptions     map[string]string                                                     `json:"extra_options,omitempty"`
-	KeySchema        *DataSourceFeatureEngineeringKafkaConfigsKafkaConfigsKeySchema        `json:"key_schema,omitempty"`
-	Name             string                                                                `json:"name"`
-	ProviderConfig   *DataSourceFeatureEngineeringKafkaConfigsKafkaConfigsProviderConfig   `json:"provider_config,omitempty"`
-	SubscriptionMode *DataSourceFeatureEngineeringKafkaConfigsKafkaConfigsSubscriptionMode `json:"subscription_mode,omitempty"`
-	ValueSchema      *DataSourceFeatureEngineeringKafkaConfigsKafkaConfigsValueSchema      `json:"value_schema,omitempty"`
-}
-
-type DataSourceFeatureEngineeringKafkaConfigsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceFeatureEngineeringKafkaConfigs struct {
-	KafkaConfigs   []DataSourceFeatureEngineeringKafkaConfigsKafkaConfigs  `json:"kafka_configs,omitempty"`
-	PageSize       int                                                     `json:"page_size,omitempty"`
-	ProviderConfig *DataSourceFeatureEngineeringKafkaConfigsProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_feature_engineering_materialized_feature.go b/bundle/internal/tf/schema/data_source_feature_engineering_materialized_feature.go
deleted file mode 100644
index bf0000ae622..00000000000
--- a/bundle/internal/tf/schema/data_source_feature_engineering_materialized_feature.go
+++ /dev/null
@@ -1,33 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceFeatureEngineeringMaterializedFeatureOfflineStoreConfig struct {
-	CatalogName     string `json:"catalog_name"`
-	SchemaName      string `json:"schema_name"`
-	TableNamePrefix string `json:"table_name_prefix"`
-}
-
-type DataSourceFeatureEngineeringMaterializedFeatureOnlineStoreConfig struct {
-	CatalogName     string `json:"catalog_name"`
-	OnlineStoreName string `json:"online_store_name"`
-	SchemaName      string `json:"schema_name"`
-	TableNamePrefix string `json:"table_name_prefix"`
-}
-
-type DataSourceFeatureEngineeringMaterializedFeatureProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceFeatureEngineeringMaterializedFeature struct {
-	CronSchedule            string                                                             `json:"cron_schedule,omitempty"`
-	FeatureName             string                                                             `json:"feature_name,omitempty"`
-	IsOnline                bool                                                               `json:"is_online,omitempty"`
-	LastMaterializationTime string                                                             `json:"last_materialization_time,omitempty"`
-	MaterializedFeatureId   string                                                             `json:"materialized_feature_id"`
-	OfflineStoreConfig      *DataSourceFeatureEngineeringMaterializedFeatureOfflineStoreConfig `json:"offline_store_config,omitempty"`
-	OnlineStoreConfig       *DataSourceFeatureEngineeringMaterializedFeatureOnlineStoreConfig  `json:"online_store_config,omitempty"`
-	PipelineScheduleState   string                                                             `json:"pipeline_schedule_state,omitempty"`
-	ProviderConfig          *DataSourceFeatureEngineeringMaterializedFeatureProviderConfig     `json:"provider_config,omitempty"`
-	TableName               string                                                             `json:"table_name,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_feature_engineering_materialized_features.go b/bundle/internal/tf/schema/data_source_feature_engineering_materialized_features.go
deleted file mode 100644
index 1b56f945487..00000000000
--- a/bundle/internal/tf/schema/data_source_feature_engineering_materialized_features.go
+++ /dev/null
@@ -1,44 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceFeatureEngineeringMaterializedFeaturesMaterializedFeaturesOfflineStoreConfig struct {
-	CatalogName     string `json:"catalog_name"`
-	SchemaName      string `json:"schema_name"`
-	TableNamePrefix string `json:"table_name_prefix"`
-}
-
-type DataSourceFeatureEngineeringMaterializedFeaturesMaterializedFeaturesOnlineStoreConfig struct {
-	CatalogName     string `json:"catalog_name"`
-	OnlineStoreName string `json:"online_store_name"`
-	SchemaName      string `json:"schema_name"`
-	TableNamePrefix string `json:"table_name_prefix"`
-}
-
-type DataSourceFeatureEngineeringMaterializedFeaturesMaterializedFeaturesProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceFeatureEngineeringMaterializedFeaturesMaterializedFeatures struct {
-	CronSchedule            string                                                                                  `json:"cron_schedule,omitempty"`
-	FeatureName             string                                                                                  `json:"feature_name,omitempty"`
-	IsOnline                bool                                                                                    `json:"is_online,omitempty"`
-	LastMaterializationTime string                                                                                  `json:"last_materialization_time,omitempty"`
-	MaterializedFeatureId   string                                                                                  `json:"materialized_feature_id"`
-	OfflineStoreConfig      *DataSourceFeatureEngineeringMaterializedFeaturesMaterializedFeaturesOfflineStoreConfig `json:"offline_store_config,omitempty"`
-	OnlineStoreConfig       *DataSourceFeatureEngineeringMaterializedFeaturesMaterializedFeaturesOnlineStoreConfig  `json:"online_store_config,omitempty"`
-	PipelineScheduleState   string                                                                                  `json:"pipeline_schedule_state,omitempty"`
-	ProviderConfig          *DataSourceFeatureEngineeringMaterializedFeaturesMaterializedFeaturesProviderConfig     `json:"provider_config,omitempty"`
-	TableName               string                                                                                  `json:"table_name,omitempty"`
-}
-
-type DataSourceFeatureEngineeringMaterializedFeaturesProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceFeatureEngineeringMaterializedFeatures struct {
-	FeatureName          string                                                                 `json:"feature_name,omitempty"`
-	MaterializedFeatures []DataSourceFeatureEngineeringMaterializedFeaturesMaterializedFeatures `json:"materialized_features,omitempty"`
-	PageSize             int                                                                    `json:"page_size,omitempty"`
-	ProviderConfig       *DataSourceFeatureEngineeringMaterializedFeaturesProviderConfig        `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_functions.go b/bundle/internal/tf/schema/data_source_functions.go
deleted file mode 100644
index 5c6005883e8..00000000000
--- a/bundle/internal/tf/schema/data_source_functions.go
+++ /dev/null
@@ -1,113 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceFunctionsFunctionsInputParamsParameters struct {
-	Comment          string `json:"comment,omitempty"`
-	Name             string `json:"name"`
-	ParameterDefault string `json:"parameter_default,omitempty"`
-	ParameterMode    string `json:"parameter_mode,omitempty"`
-	ParameterType    string `json:"parameter_type,omitempty"`
-	Position         int    `json:"position"`
-	TypeIntervalType string `json:"type_interval_type,omitempty"`
-	TypeJson         string `json:"type_json,omitempty"`
-	TypeName         string `json:"type_name"`
-	TypePrecision    int    `json:"type_precision,omitempty"`
-	TypeScale        int    `json:"type_scale,omitempty"`
-	TypeText         string `json:"type_text"`
-}
-
-type DataSourceFunctionsFunctionsInputParams struct {
-	Parameters []DataSourceFunctionsFunctionsInputParamsParameters `json:"parameters,omitempty"`
-}
-
-type DataSourceFunctionsFunctionsReturnParamsParameters struct {
-	Comment          string `json:"comment,omitempty"`
-	Name             string `json:"name"`
-	ParameterDefault string `json:"parameter_default,omitempty"`
-	ParameterMode    string `json:"parameter_mode,omitempty"`
-	ParameterType    string `json:"parameter_type,omitempty"`
-	Position         int    `json:"position"`
-	TypeIntervalType string `json:"type_interval_type,omitempty"`
-	TypeJson         string `json:"type_json,omitempty"`
-	TypeName         string `json:"type_name"`
-	TypePrecision    int    `json:"type_precision,omitempty"`
-	TypeScale        int    `json:"type_scale,omitempty"`
-	TypeText         string `json:"type_text"`
-}
-
-type DataSourceFunctionsFunctionsReturnParams struct {
-	Parameters []DataSourceFunctionsFunctionsReturnParamsParameters `json:"parameters,omitempty"`
-}
-
-type DataSourceFunctionsFunctionsRoutineDependenciesDependenciesConnection struct {
-	ConnectionName string `json:"connection_name,omitempty"`
-}
-
-type DataSourceFunctionsFunctionsRoutineDependenciesDependenciesCredential struct {
-	CredentialName string `json:"credential_name,omitempty"`
-}
-
-type DataSourceFunctionsFunctionsRoutineDependenciesDependenciesFunction struct {
-	FunctionFullName string `json:"function_full_name"`
-}
-
-type DataSourceFunctionsFunctionsRoutineDependenciesDependenciesTable struct {
-	TableFullName string `json:"table_full_name"`
-}
-
-type DataSourceFunctionsFunctionsRoutineDependenciesDependencies struct {
-	Connection *DataSourceFunctionsFunctionsRoutineDependenciesDependenciesConnection `json:"connection,omitempty"`
-	Credential *DataSourceFunctionsFunctionsRoutineDependenciesDependenciesCredential `json:"credential,omitempty"`
-	Function   *DataSourceFunctionsFunctionsRoutineDependenciesDependenciesFunction   `json:"function,omitempty"`
-	Table      *DataSourceFunctionsFunctionsRoutineDependenciesDependenciesTable      `json:"table,omitempty"`
-}
-
-type DataSourceFunctionsFunctionsRoutineDependencies struct {
-	Dependencies []DataSourceFunctionsFunctionsRoutineDependenciesDependencies `json:"dependencies,omitempty"`
-}
-
-type DataSourceFunctionsFunctions struct {
-	BrowseOnly          bool                                             `json:"browse_only,omitempty"`
-	CatalogName         string                                           `json:"catalog_name,omitempty"`
-	Comment             string                                           `json:"comment,omitempty"`
-	CreatedAt           int                                              `json:"created_at,omitempty"`
-	CreatedBy           string                                           `json:"created_by,omitempty"`
-	DataType            string                                           `json:"data_type,omitempty"`
-	ExternalLanguage    string                                           `json:"external_language,omitempty"`
-	ExternalName        string                                           `json:"external_name,omitempty"`
-	FullDataType        string                                           `json:"full_data_type,omitempty"`
-	FullName            string                                           `json:"full_name,omitempty"`
-	FunctionId          string                                           `json:"function_id,omitempty"`
-	InputParams         *DataSourceFunctionsFunctionsInputParams         `json:"input_params,omitempty"`
-	IsDeterministic     bool                                             `json:"is_deterministic,omitempty"`
-	IsNullCall          bool                                             `json:"is_null_call,omitempty"`
-	MetastoreId         string                                           `json:"metastore_id,omitempty"`
-	Name                string                                           `json:"name,omitempty"`
-	Owner               string                                           `json:"owner,omitempty"`
-	ParameterStyle      string                                           `json:"parameter_style,omitempty"`
-	Properties          string                                           `json:"properties,omitempty"`
-	ReturnParams        *DataSourceFunctionsFunctionsReturnParams        `json:"return_params,omitempty"`
-	RoutineBody         string                                           `json:"routine_body,omitempty"`
-	RoutineDefinition   string                                           `json:"routine_definition,omitempty"`
-	RoutineDependencies *DataSourceFunctionsFunctionsRoutineDependencies `json:"routine_dependencies,omitempty"`
-	SchemaName          string                                           `json:"schema_name,omitempty"`
-	SecurityType        string                                           `json:"security_type,omitempty"`
-	SpecificName        string                                           `json:"specific_name,omitempty"`
-	SqlDataAccess       string                                           `json:"sql_data_access,omitempty"`
-	SqlPath             string                                           `json:"sql_path,omitempty"`
-	UpdatedAt           int                                              `json:"updated_at,omitempty"`
-	UpdatedBy           string                                           `json:"updated_by,omitempty"`
-}
-
-type DataSourceFunctionsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceFunctions struct {
-	CatalogName    string                             `json:"catalog_name"`
-	Functions      []DataSourceFunctionsFunctions     `json:"functions,omitempty"`
-	IncludeBrowse  bool                               `json:"include_browse,omitempty"`
-	ProviderConfig *DataSourceFunctionsProviderConfig `json:"provider_config,omitempty"`
-	SchemaName     string                             `json:"schema_name"`
-}
diff --git a/bundle/internal/tf/schema/data_source_group.go b/bundle/internal/tf/schema/data_source_group.go
deleted file mode 100644
index c68aee75fb4..00000000000
--- a/bundle/internal/tf/schema/data_source_group.go
+++ /dev/null
@@ -1,28 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceGroupProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceGroup struct {
-	AclPrincipalId          string                         `json:"acl_principal_id,omitempty"`
-	AllowClusterCreate      bool                           `json:"allow_cluster_create,omitempty"`
-	AllowInstancePoolCreate bool                           `json:"allow_instance_pool_create,omitempty"`
-	Api                     string                         `json:"api,omitempty"`
-	ChildGroups             []string                       `json:"child_groups,omitempty"`
-	DatabricksSqlAccess     bool                           `json:"databricks_sql_access,omitempty"`
-	DisplayName             string                         `json:"display_name"`
-	ExternalId              string                         `json:"external_id,omitempty"`
-	Groups                  []string                       `json:"groups,omitempty"`
-	Id                      string                         `json:"id,omitempty"`
-	InstanceProfiles        []string                       `json:"instance_profiles,omitempty"`
-	Members                 []string                       `json:"members,omitempty"`
-	Recursive               bool                           `json:"recursive,omitempty"`
-	ServicePrincipals       []string                       `json:"service_principals,omitempty"`
-	Users                   []string                       `json:"users,omitempty"`
-	WorkspaceAccess         bool                           `json:"workspace_access,omitempty"`
-	WorkspaceConsume        bool                           `json:"workspace_consume,omitempty"`
-	ProviderConfig          *DataSourceGroupProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_instance_pool.go b/bundle/internal/tf/schema/data_source_instance_pool.go
deleted file mode 100644
index 7deade1f45f..00000000000
--- a/bundle/internal/tf/schema/data_source_instance_pool.go
+++ /dev/null
@@ -1,107 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceInstancePoolPoolInfoAwsAttributes struct {
-	Availability        string `json:"availability,omitempty"`
-	InstanceProfileArn  string `json:"instance_profile_arn,omitempty"`
-	SpotBidPricePercent int    `json:"spot_bid_price_percent,omitempty"`
-	ZoneId              string `json:"zone_id,omitempty"`
-}
-
-type DataSourceInstancePoolPoolInfoAzureAttributes struct {
-	Availability    string `json:"availability,omitempty"`
-	SpotBidMaxPrice int    `json:"spot_bid_max_price,omitempty"`
-}
-
-type DataSourceInstancePoolPoolInfoDiskSpecDiskType struct {
-	AzureDiskVolumeType string `json:"azure_disk_volume_type,omitempty"`
-	EbsVolumeType       string `json:"ebs_volume_type,omitempty"`
-}
-
-type DataSourceInstancePoolPoolInfoDiskSpec struct {
-	DiskCount int                                             `json:"disk_count,omitempty"`
-	DiskSize  int                                             `json:"disk_size,omitempty"`
-	DiskType  *DataSourceInstancePoolPoolInfoDiskSpecDiskType `json:"disk_type,omitempty"`
-}
-
-type DataSourceInstancePoolPoolInfoGcpAttributes struct {
-	GcpAvailability string `json:"gcp_availability,omitempty"`
-	LocalSsdCount   int    `json:"local_ssd_count,omitempty"`
-	ZoneId          string `json:"zone_id,omitempty"`
-}
-
-type DataSourceInstancePoolPoolInfoInstancePoolFleetAttributesFleetOnDemandOption struct {
-	AllocationStrategy      string `json:"allocation_strategy"`
-	InstancePoolsToUseCount int    `json:"instance_pools_to_use_count,omitempty"`
-}
-
-type DataSourceInstancePoolPoolInfoInstancePoolFleetAttributesFleetSpotOption struct {
-	AllocationStrategy      string `json:"allocation_strategy"`
-	InstancePoolsToUseCount int    `json:"instance_pools_to_use_count,omitempty"`
-}
-
-type DataSourceInstancePoolPoolInfoInstancePoolFleetAttributesLaunchTemplateOverride struct {
-	AvailabilityZone string `json:"availability_zone"`
-	InstanceType     string `json:"instance_type"`
-}
-
-type DataSourceInstancePoolPoolInfoInstancePoolFleetAttributes struct {
-	FleetOnDemandOption    *DataSourceInstancePoolPoolInfoInstancePoolFleetAttributesFleetOnDemandOption     `json:"fleet_on_demand_option,omitempty"`
-	FleetSpotOption        *DataSourceInstancePoolPoolInfoInstancePoolFleetAttributesFleetSpotOption         `json:"fleet_spot_option,omitempty"`
-	LaunchTemplateOverride []DataSourceInstancePoolPoolInfoInstancePoolFleetAttributesLaunchTemplateOverride `json:"launch_template_override,omitempty"`
-}
-
-type DataSourceInstancePoolPoolInfoNodeTypeFlexibility struct {
-	AlternateNodeTypeIds []string `json:"alternate_node_type_ids"`
-}
-
-type DataSourceInstancePoolPoolInfoPreloadedDockerImageBasicAuth struct {
-	Password string `json:"password"`
-	Username string `json:"username"`
-}
-
-type DataSourceInstancePoolPoolInfoPreloadedDockerImage struct {
-	Url       string                                                       `json:"url"`
-	BasicAuth *DataSourceInstancePoolPoolInfoPreloadedDockerImageBasicAuth `json:"basic_auth,omitempty"`
-}
-
-type DataSourceInstancePoolPoolInfoStats struct {
-	IdleCount        int `json:"idle_count,omitempty"`
-	PendingIdleCount int `json:"pending_idle_count,omitempty"`
-	PendingUsedCount int `json:"pending_used_count,omitempty"`
-	UsedCount        int `json:"used_count,omitempty"`
-}
-
-type DataSourceInstancePoolPoolInfo struct {
-	CustomTags                         map[string]string                                           `json:"custom_tags,omitempty"`
-	DefaultTags                        map[string]string                                           `json:"default_tags,omitempty"`
-	EnableElasticDisk                  bool                                                        `json:"enable_elastic_disk,omitempty"`
-	IdleInstanceAutoterminationMinutes int                                                         `json:"idle_instance_autotermination_minutes"`
-	InstancePoolId                     string                                                      `json:"instance_pool_id,omitempty"`
-	InstancePoolName                   string                                                      `json:"instance_pool_name"`
-	MaxCapacity                        int                                                         `json:"max_capacity,omitempty"`
-	MinIdleInstances                   int                                                         `json:"min_idle_instances,omitempty"`
-	NodeTypeId                         string                                                      `json:"node_type_id,omitempty"`
-	PreloadedSparkVersions             []string                                                    `json:"preloaded_spark_versions,omitempty"`
-	State                              string                                                      `json:"state,omitempty"`
-	AwsAttributes                      *DataSourceInstancePoolPoolInfoAwsAttributes                `json:"aws_attributes,omitempty"`
-	AzureAttributes                    *DataSourceInstancePoolPoolInfoAzureAttributes              `json:"azure_attributes,omitempty"`
-	DiskSpec                           *DataSourceInstancePoolPoolInfoDiskSpec                     `json:"disk_spec,omitempty"`
-	GcpAttributes                      *DataSourceInstancePoolPoolInfoGcpAttributes                `json:"gcp_attributes,omitempty"`
-	InstancePoolFleetAttributes        []DataSourceInstancePoolPoolInfoInstancePoolFleetAttributes `json:"instance_pool_fleet_attributes,omitempty"`
-	NodeTypeFlexibility                *DataSourceInstancePoolPoolInfoNodeTypeFlexibility          `json:"node_type_flexibility,omitempty"`
-	PreloadedDockerImage               []DataSourceInstancePoolPoolInfoPreloadedDockerImage        `json:"preloaded_docker_image,omitempty"`
-	Stats                              *DataSourceInstancePoolPoolInfoStats                        `json:"stats,omitempty"`
-}
-
-type DataSourceInstancePoolProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceInstancePool struct {
-	Id             string                                `json:"id,omitempty"`
-	Name           string                                `json:"name"`
-	PoolInfo       *DataSourceInstancePoolPoolInfo       `json:"pool_info,omitempty"`
-	ProviderConfig *DataSourceInstancePoolProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_instance_profiles.go b/bundle/internal/tf/schema/data_source_instance_profiles.go
deleted file mode 100644
index 28027f4b2e9..00000000000
--- a/bundle/internal/tf/schema/data_source_instance_profiles.go
+++ /dev/null
@@ -1,20 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceInstanceProfilesInstanceProfiles struct {
-	Arn     string `json:"arn,omitempty"`
-	IsMeta  bool   `json:"is_meta,omitempty"`
-	Name    string `json:"name,omitempty"`
-	RoleArn string `json:"role_arn,omitempty"`
-}
-
-type DataSourceInstanceProfilesProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceInstanceProfiles struct {
-	Id               string                                       `json:"id,omitempty"`
-	InstanceProfiles []DataSourceInstanceProfilesInstanceProfiles `json:"instance_profiles,omitempty"`
-	ProviderConfig   *DataSourceInstanceProfilesProviderConfig    `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_job.go b/bundle/internal/tf/schema/data_source_job.go
deleted file mode 100644
index 04aff874193..00000000000
--- a/bundle/internal/tf/schema/data_source_job.go
+++ /dev/null
@@ -1,1436 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceJobJobSettingsSettingsContinuous struct {
-	PauseStatus string `json:"pause_status,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsDbtTask struct {
-	Catalog           string   `json:"catalog,omitempty"`
-	Commands          []string `json:"commands"`
-	ProfilesDirectory string   `json:"profiles_directory,omitempty"`
-	ProjectDirectory  string   `json:"project_directory,omitempty"`
-	Schema            string   `json:"schema,omitempty"`
-	Source            string   `json:"source,omitempty"`
-	WarehouseId       string   `json:"warehouse_id,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsDeployment struct {
-	Kind             string `json:"kind"`
-	MetadataFilePath string `json:"metadata_file_path,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsEmailNotifications struct {
-	NoAlertForSkippedRuns              bool     `json:"no_alert_for_skipped_runs,omitempty"`
-	OnDurationWarningThresholdExceeded []string `json:"on_duration_warning_threshold_exceeded,omitempty"`
-	OnFailure                          []string `json:"on_failure,omitempty"`
-	OnStart                            []string `json:"on_start,omitempty"`
-	OnStreamingBacklogExceeded         []string `json:"on_streaming_backlog_exceeded,omitempty"`
-	OnSuccess                          []string `json:"on_success,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsEnvironmentSpec struct {
-	BaseEnvironment    string   `json:"base_environment,omitempty"`
-	Client             string   `json:"client,omitempty"`
-	Dependencies       []string `json:"dependencies,omitempty"`
-	EnvironmentVersion string   `json:"environment_version,omitempty"`
-	JavaDependencies   []string `json:"java_dependencies,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsEnvironment struct {
-	EnvironmentKey string                                           `json:"environment_key"`
-	Spec           *DataSourceJobJobSettingsSettingsEnvironmentSpec `json:"spec,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsGitSourceJobSource struct {
-	DirtyState          string `json:"dirty_state,omitempty"`
-	ImportFromGitBranch string `json:"import_from_git_branch"`
-	JobConfigPath       string `json:"job_config_path"`
-}
-
-type DataSourceJobJobSettingsSettingsGitSource struct {
-	Branch    string                                              `json:"branch,omitempty"`
-	Commit    string                                              `json:"commit,omitempty"`
-	Provider  string                                              `json:"provider,omitempty"`
-	Tag       string                                              `json:"tag,omitempty"`
-	Url       string                                              `json:"url"`
-	JobSource *DataSourceJobJobSettingsSettingsGitSourceJobSource `json:"job_source,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsHealthRules struct {
-	Metric string `json:"metric"`
-	Op     string `json:"op"`
-	Value  int    `json:"value"`
-}
-
-type DataSourceJobJobSettingsSettingsHealth struct {
-	Rules []DataSourceJobJobSettingsSettingsHealthRules `json:"rules,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsJobClusterNewClusterAutoscale struct {
-	MaxWorkers int `json:"max_workers,omitempty"`
-	MinWorkers int `json:"min_workers,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsJobClusterNewClusterAwsAttributes struct {
-	Availability        string `json:"availability,omitempty"`
-	EbsVolumeCount      int    `json:"ebs_volume_count,omitempty"`
-	EbsVolumeSize       int    `json:"ebs_volume_size,omitempty"`
-	EbsVolumeType       string `json:"ebs_volume_type,omitempty"`
-	FirstOnDemand       int    `json:"first_on_demand,omitempty"`
-	InstanceProfileArn  string `json:"instance_profile_arn,omitempty"`
-	SpotBidPricePercent int    `json:"spot_bid_price_percent,omitempty"`
-	ZoneId              string `json:"zone_id,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsJobClusterNewClusterAzureAttributes struct {
-	Availability    string `json:"availability,omitempty"`
-	FirstOnDemand   int    `json:"first_on_demand,omitempty"`
-	SpotBidMaxPrice int    `json:"spot_bid_max_price,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsJobClusterNewClusterClusterLogConfDbfs struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceJobJobSettingsSettingsJobClusterNewClusterClusterLogConfS3 struct {
-	CannedAcl        string `json:"canned_acl,omitempty"`
-	Destination      string `json:"destination"`
-	EnableEncryption bool   `json:"enable_encryption,omitempty"`
-	EncryptionType   string `json:"encryption_type,omitempty"`
-	Endpoint         string `json:"endpoint,omitempty"`
-	KmsKey           string `json:"kms_key,omitempty"`
-	Region           string `json:"region,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsJobClusterNewClusterClusterLogConf struct {
-	Dbfs *DataSourceJobJobSettingsSettingsJobClusterNewClusterClusterLogConfDbfs `json:"dbfs,omitempty"`
-	S3   *DataSourceJobJobSettingsSettingsJobClusterNewClusterClusterLogConfS3   `json:"s3,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsJobClusterNewClusterClusterMountInfoNetworkFilesystemInfo struct {
-	MountOptions  string `json:"mount_options,omitempty"`
-	ServerAddress string `json:"server_address"`
-}
-
-type DataSourceJobJobSettingsSettingsJobClusterNewClusterClusterMountInfo struct {
-	LocalMountDirPath     string                                                                                     `json:"local_mount_dir_path"`
-	RemoteMountDirPath    string                                                                                     `json:"remote_mount_dir_path,omitempty"`
-	NetworkFilesystemInfo *DataSourceJobJobSettingsSettingsJobClusterNewClusterClusterMountInfoNetworkFilesystemInfo `json:"network_filesystem_info,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsJobClusterNewClusterDockerImageBasicAuth struct {
-	Password string `json:"password"`
-	Username string `json:"username"`
-}
-
-type DataSourceJobJobSettingsSettingsJobClusterNewClusterDockerImage struct {
-	Url       string                                                                    `json:"url"`
-	BasicAuth *DataSourceJobJobSettingsSettingsJobClusterNewClusterDockerImageBasicAuth `json:"basic_auth,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsJobClusterNewClusterGcpAttributes struct {
-	Availability            string `json:"availability,omitempty"`
-	BootDiskSize            int    `json:"boot_disk_size,omitempty"`
-	GoogleServiceAccount    string `json:"google_service_account,omitempty"`
-	LocalSsdCount           int    `json:"local_ssd_count,omitempty"`
-	UsePreemptibleExecutors bool   `json:"use_preemptible_executors,omitempty"`
-	ZoneId                  string `json:"zone_id,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsJobClusterNewClusterInitScriptsAbfss struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceJobJobSettingsSettingsJobClusterNewClusterInitScriptsDbfs struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceJobJobSettingsSettingsJobClusterNewClusterInitScriptsFile struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceJobJobSettingsSettingsJobClusterNewClusterInitScriptsGcs struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceJobJobSettingsSettingsJobClusterNewClusterInitScriptsS3 struct {
-	CannedAcl        string `json:"canned_acl,omitempty"`
-	Destination      string `json:"destination"`
-	EnableEncryption bool   `json:"enable_encryption,omitempty"`
-	EncryptionType   string `json:"encryption_type,omitempty"`
-	Endpoint         string `json:"endpoint,omitempty"`
-	KmsKey           string `json:"kms_key,omitempty"`
-	Region           string `json:"region,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsJobClusterNewClusterInitScriptsVolumes struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceJobJobSettingsSettingsJobClusterNewClusterInitScriptsWorkspace struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceJobJobSettingsSettingsJobClusterNewClusterInitScripts struct {
-	Abfss     *DataSourceJobJobSettingsSettingsJobClusterNewClusterInitScriptsAbfss     `json:"abfss,omitempty"`
-	Dbfs      *DataSourceJobJobSettingsSettingsJobClusterNewClusterInitScriptsDbfs      `json:"dbfs,omitempty"`
-	File      *DataSourceJobJobSettingsSettingsJobClusterNewClusterInitScriptsFile      `json:"file,omitempty"`
-	Gcs       *DataSourceJobJobSettingsSettingsJobClusterNewClusterInitScriptsGcs       `json:"gcs,omitempty"`
-	S3        *DataSourceJobJobSettingsSettingsJobClusterNewClusterInitScriptsS3        `json:"s3,omitempty"`
-	Volumes   *DataSourceJobJobSettingsSettingsJobClusterNewClusterInitScriptsVolumes   `json:"volumes,omitempty"`
-	Workspace *DataSourceJobJobSettingsSettingsJobClusterNewClusterInitScriptsWorkspace `json:"workspace,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsJobClusterNewClusterWorkloadTypeClients struct {
-	Jobs      bool `json:"jobs,omitempty"`
-	Notebooks bool `json:"notebooks,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsJobClusterNewClusterWorkloadType struct {
-	Clients *DataSourceJobJobSettingsSettingsJobClusterNewClusterWorkloadTypeClients `json:"clients,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsJobClusterNewCluster struct {
-	ApplyPolicyDefaultValues  bool                                                                   `json:"apply_policy_default_values,omitempty"`
-	AutoterminationMinutes    int                                                                    `json:"autotermination_minutes,omitempty"`
-	ClusterId                 string                                                                 `json:"cluster_id,omitempty"`
-	ClusterName               string                                                                 `json:"cluster_name,omitempty"`
-	CustomTags                map[string]string                                                      `json:"custom_tags,omitempty"`
-	DataSecurityMode          string                                                                 `json:"data_security_mode,omitempty"`
-	DriverInstancePoolId      string                                                                 `json:"driver_instance_pool_id,omitempty"`
-	DriverNodeTypeId          string                                                                 `json:"driver_node_type_id,omitempty"`
-	EnableElasticDisk         bool                                                                   `json:"enable_elastic_disk,omitempty"`
-	EnableLocalDiskEncryption bool                                                                   `json:"enable_local_disk_encryption,omitempty"`
-	IdempotencyToken          string                                                                 `json:"idempotency_token,omitempty"`
-	InstancePoolId            string                                                                 `json:"instance_pool_id,omitempty"`
-	NodeTypeId                string                                                                 `json:"node_type_id,omitempty"`
-	NumWorkers                int                                                                    `json:"num_workers"`
-	PolicyId                  string                                                                 `json:"policy_id,omitempty"`
-	RuntimeEngine             string                                                                 `json:"runtime_engine,omitempty"`
-	SingleUserName            string                                                                 `json:"single_user_name,omitempty"`
-	SparkConf                 map[string]string                                                      `json:"spark_conf,omitempty"`
-	SparkEnvVars              map[string]string                                                      `json:"spark_env_vars,omitempty"`
-	SparkVersion              string                                                                 `json:"spark_version,omitempty"`
-	SshPublicKeys             []string                                                               `json:"ssh_public_keys,omitempty"`
-	Autoscale                 *DataSourceJobJobSettingsSettingsJobClusterNewClusterAutoscale         `json:"autoscale,omitempty"`
-	AwsAttributes             *DataSourceJobJobSettingsSettingsJobClusterNewClusterAwsAttributes     `json:"aws_attributes,omitempty"`
-	AzureAttributes           *DataSourceJobJobSettingsSettingsJobClusterNewClusterAzureAttributes   `json:"azure_attributes,omitempty"`
-	ClusterLogConf            *DataSourceJobJobSettingsSettingsJobClusterNewClusterClusterLogConf    `json:"cluster_log_conf,omitempty"`
-	ClusterMountInfo          []DataSourceJobJobSettingsSettingsJobClusterNewClusterClusterMountInfo `json:"cluster_mount_info,omitempty"`
-	DockerImage               *DataSourceJobJobSettingsSettingsJobClusterNewClusterDockerImage       `json:"docker_image,omitempty"`
-	GcpAttributes             *DataSourceJobJobSettingsSettingsJobClusterNewClusterGcpAttributes     `json:"gcp_attributes,omitempty"`
-	InitScripts               []DataSourceJobJobSettingsSettingsJobClusterNewClusterInitScripts      `json:"init_scripts,omitempty"`
-	WorkloadType              *DataSourceJobJobSettingsSettingsJobClusterNewClusterWorkloadType      `json:"workload_type,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsJobCluster struct {
-	JobClusterKey string                                                `json:"job_cluster_key"`
-	NewCluster    *DataSourceJobJobSettingsSettingsJobClusterNewCluster `json:"new_cluster,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsLibraryCran struct {
-	Package string `json:"package"`
-	Repo    string `json:"repo,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsLibraryMaven struct {
-	Coordinates string   `json:"coordinates"`
-	Exclusions  []string `json:"exclusions,omitempty"`
-	Repo        string   `json:"repo,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsLibraryProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceJobJobSettingsSettingsLibraryPypi struct {
-	Package string `json:"package"`
-	Repo    string `json:"repo,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsLibrary struct {
-	Egg            string                                                 `json:"egg,omitempty"`
-	Jar            string                                                 `json:"jar,omitempty"`
-	Requirements   string                                                 `json:"requirements,omitempty"`
-	Whl            string                                                 `json:"whl,omitempty"`
-	Cran           *DataSourceJobJobSettingsSettingsLibraryCran           `json:"cran,omitempty"`
-	Maven          *DataSourceJobJobSettingsSettingsLibraryMaven          `json:"maven,omitempty"`
-	ProviderConfig *DataSourceJobJobSettingsSettingsLibraryProviderConfig `json:"provider_config,omitempty"`
-	Pypi           *DataSourceJobJobSettingsSettingsLibraryPypi           `json:"pypi,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsNewClusterAutoscale struct {
-	MaxWorkers int `json:"max_workers,omitempty"`
-	MinWorkers int `json:"min_workers,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsNewClusterAwsAttributes struct {
-	Availability        string `json:"availability,omitempty"`
-	EbsVolumeCount      int    `json:"ebs_volume_count,omitempty"`
-	EbsVolumeSize       int    `json:"ebs_volume_size,omitempty"`
-	EbsVolumeType       string `json:"ebs_volume_type,omitempty"`
-	FirstOnDemand       int    `json:"first_on_demand,omitempty"`
-	InstanceProfileArn  string `json:"instance_profile_arn,omitempty"`
-	SpotBidPricePercent int    `json:"spot_bid_price_percent,omitempty"`
-	ZoneId              string `json:"zone_id,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsNewClusterAzureAttributes struct {
-	Availability    string `json:"availability,omitempty"`
-	FirstOnDemand   int    `json:"first_on_demand,omitempty"`
-	SpotBidMaxPrice int    `json:"spot_bid_max_price,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsNewClusterClusterLogConfDbfs struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceJobJobSettingsSettingsNewClusterClusterLogConfS3 struct {
-	CannedAcl        string `json:"canned_acl,omitempty"`
-	Destination      string `json:"destination"`
-	EnableEncryption bool   `json:"enable_encryption,omitempty"`
-	EncryptionType   string `json:"encryption_type,omitempty"`
-	Endpoint         string `json:"endpoint,omitempty"`
-	KmsKey           string `json:"kms_key,omitempty"`
-	Region           string `json:"region,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsNewClusterClusterLogConf struct {
-	Dbfs *DataSourceJobJobSettingsSettingsNewClusterClusterLogConfDbfs `json:"dbfs,omitempty"`
-	S3   *DataSourceJobJobSettingsSettingsNewClusterClusterLogConfS3   `json:"s3,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsNewClusterClusterMountInfoNetworkFilesystemInfo struct {
-	MountOptions  string `json:"mount_options,omitempty"`
-	ServerAddress string `json:"server_address"`
-}
-
-type DataSourceJobJobSettingsSettingsNewClusterClusterMountInfo struct {
-	LocalMountDirPath     string                                                                           `json:"local_mount_dir_path"`
-	RemoteMountDirPath    string                                                                           `json:"remote_mount_dir_path,omitempty"`
-	NetworkFilesystemInfo *DataSourceJobJobSettingsSettingsNewClusterClusterMountInfoNetworkFilesystemInfo `json:"network_filesystem_info,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsNewClusterDockerImageBasicAuth struct {
-	Password string `json:"password"`
-	Username string `json:"username"`
-}
-
-type DataSourceJobJobSettingsSettingsNewClusterDockerImage struct {
-	Url       string                                                          `json:"url"`
-	BasicAuth *DataSourceJobJobSettingsSettingsNewClusterDockerImageBasicAuth `json:"basic_auth,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsNewClusterGcpAttributes struct {
-	Availability            string `json:"availability,omitempty"`
-	BootDiskSize            int    `json:"boot_disk_size,omitempty"`
-	GoogleServiceAccount    string `json:"google_service_account,omitempty"`
-	LocalSsdCount           int    `json:"local_ssd_count,omitempty"`
-	UsePreemptibleExecutors bool   `json:"use_preemptible_executors,omitempty"`
-	ZoneId                  string `json:"zone_id,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsNewClusterInitScriptsAbfss struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceJobJobSettingsSettingsNewClusterInitScriptsDbfs struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceJobJobSettingsSettingsNewClusterInitScriptsFile struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceJobJobSettingsSettingsNewClusterInitScriptsGcs struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceJobJobSettingsSettingsNewClusterInitScriptsS3 struct {
-	CannedAcl        string `json:"canned_acl,omitempty"`
-	Destination      string `json:"destination"`
-	EnableEncryption bool   `json:"enable_encryption,omitempty"`
-	EncryptionType   string `json:"encryption_type,omitempty"`
-	Endpoint         string `json:"endpoint,omitempty"`
-	KmsKey           string `json:"kms_key,omitempty"`
-	Region           string `json:"region,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsNewClusterInitScriptsVolumes struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceJobJobSettingsSettingsNewClusterInitScriptsWorkspace struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceJobJobSettingsSettingsNewClusterInitScripts struct {
-	Abfss     *DataSourceJobJobSettingsSettingsNewClusterInitScriptsAbfss     `json:"abfss,omitempty"`
-	Dbfs      *DataSourceJobJobSettingsSettingsNewClusterInitScriptsDbfs      `json:"dbfs,omitempty"`
-	File      *DataSourceJobJobSettingsSettingsNewClusterInitScriptsFile      `json:"file,omitempty"`
-	Gcs       *DataSourceJobJobSettingsSettingsNewClusterInitScriptsGcs       `json:"gcs,omitempty"`
-	S3        *DataSourceJobJobSettingsSettingsNewClusterInitScriptsS3        `json:"s3,omitempty"`
-	Volumes   *DataSourceJobJobSettingsSettingsNewClusterInitScriptsVolumes   `json:"volumes,omitempty"`
-	Workspace *DataSourceJobJobSettingsSettingsNewClusterInitScriptsWorkspace `json:"workspace,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsNewClusterWorkloadTypeClients struct {
-	Jobs      bool `json:"jobs,omitempty"`
-	Notebooks bool `json:"notebooks,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsNewClusterWorkloadType struct {
-	Clients *DataSourceJobJobSettingsSettingsNewClusterWorkloadTypeClients `json:"clients,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsNewCluster struct {
-	ApplyPolicyDefaultValues  bool                                                         `json:"apply_policy_default_values,omitempty"`
-	AutoterminationMinutes    int                                                          `json:"autotermination_minutes,omitempty"`
-	ClusterId                 string                                                       `json:"cluster_id,omitempty"`
-	ClusterName               string                                                       `json:"cluster_name,omitempty"`
-	CustomTags                map[string]string                                            `json:"custom_tags,omitempty"`
-	DataSecurityMode          string                                                       `json:"data_security_mode,omitempty"`
-	DriverInstancePoolId      string                                                       `json:"driver_instance_pool_id,omitempty"`
-	DriverNodeTypeId          string                                                       `json:"driver_node_type_id,omitempty"`
-	EnableElasticDisk         bool                                                         `json:"enable_elastic_disk,omitempty"`
-	EnableLocalDiskEncryption bool                                                         `json:"enable_local_disk_encryption,omitempty"`
-	IdempotencyToken          string                                                       `json:"idempotency_token,omitempty"`
-	InstancePoolId            string                                                       `json:"instance_pool_id,omitempty"`
-	NodeTypeId                string                                                       `json:"node_type_id,omitempty"`
-	NumWorkers                int                                                          `json:"num_workers"`
-	PolicyId                  string                                                       `json:"policy_id,omitempty"`
-	RuntimeEngine             string                                                       `json:"runtime_engine,omitempty"`
-	SingleUserName            string                                                       `json:"single_user_name,omitempty"`
-	SparkConf                 map[string]string                                            `json:"spark_conf,omitempty"`
-	SparkEnvVars              map[string]string                                            `json:"spark_env_vars,omitempty"`
-	SparkVersion              string                                                       `json:"spark_version,omitempty"`
-	SshPublicKeys             []string                                                     `json:"ssh_public_keys,omitempty"`
-	Autoscale                 *DataSourceJobJobSettingsSettingsNewClusterAutoscale         `json:"autoscale,omitempty"`
-	AwsAttributes             *DataSourceJobJobSettingsSettingsNewClusterAwsAttributes     `json:"aws_attributes,omitempty"`
-	AzureAttributes           *DataSourceJobJobSettingsSettingsNewClusterAzureAttributes   `json:"azure_attributes,omitempty"`
-	ClusterLogConf            *DataSourceJobJobSettingsSettingsNewClusterClusterLogConf    `json:"cluster_log_conf,omitempty"`
-	ClusterMountInfo          []DataSourceJobJobSettingsSettingsNewClusterClusterMountInfo `json:"cluster_mount_info,omitempty"`
-	DockerImage               *DataSourceJobJobSettingsSettingsNewClusterDockerImage       `json:"docker_image,omitempty"`
-	GcpAttributes             *DataSourceJobJobSettingsSettingsNewClusterGcpAttributes     `json:"gcp_attributes,omitempty"`
-	InitScripts               []DataSourceJobJobSettingsSettingsNewClusterInitScripts      `json:"init_scripts,omitempty"`
-	WorkloadType              *DataSourceJobJobSettingsSettingsNewClusterWorkloadType      `json:"workload_type,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsNotebookTask struct {
-	BaseParameters map[string]string `json:"base_parameters,omitempty"`
-	NotebookPath   string            `json:"notebook_path"`
-	Source         string            `json:"source,omitempty"`
-	WarehouseId    string            `json:"warehouse_id,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsNotificationSettings struct {
-	NoAlertForCanceledRuns bool `json:"no_alert_for_canceled_runs,omitempty"`
-	NoAlertForSkippedRuns  bool `json:"no_alert_for_skipped_runs,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsParameter struct {
-	Default string `json:"default"`
-	Name    string `json:"name"`
-}
-
-type DataSourceJobJobSettingsSettingsPipelineTask struct {
-	FullRefresh bool   `json:"full_refresh,omitempty"`
-	PipelineId  string `json:"pipeline_id"`
-}
-
-type DataSourceJobJobSettingsSettingsPythonWheelTask struct {
-	EntryPoint      string            `json:"entry_point,omitempty"`
-	NamedParameters map[string]string `json:"named_parameters,omitempty"`
-	PackageName     string            `json:"package_name,omitempty"`
-	Parameters      []string          `json:"parameters,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsQueue struct {
-	Enabled bool `json:"enabled"`
-}
-
-type DataSourceJobJobSettingsSettingsRunAs struct {
-	ServicePrincipalName string `json:"service_principal_name,omitempty"`
-	UserName             string `json:"user_name,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsRunJobTask struct {
-	JobId         int               `json:"job_id"`
-	JobParameters map[string]string `json:"job_parameters,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsSchedule struct {
-	PauseStatus          string `json:"pause_status,omitempty"`
-	QuartzCronExpression string `json:"quartz_cron_expression"`
-	TimezoneId           string `json:"timezone_id"`
-}
-
-type DataSourceJobJobSettingsSettingsSparkJarTask struct {
-	JarUri        string   `json:"jar_uri,omitempty"`
-	MainClassName string   `json:"main_class_name,omitempty"`
-	Parameters    []string `json:"parameters,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsSparkPythonTask struct {
-	Parameters []string `json:"parameters,omitempty"`
-	PythonFile string   `json:"python_file"`
-	Source     string   `json:"source,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsSparkSubmitTask struct {
-	Parameters []string `json:"parameters,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskConditionTask struct {
-	Left  string `json:"left"`
-	Op    string `json:"op"`
-	Right string `json:"right"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskDashboardTaskSubscriptionSubscribers struct {
-	DestinationId string `json:"destination_id,omitempty"`
-	UserName      string `json:"user_name,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskDashboardTaskSubscription struct {
-	CustomSubject string                                                                     `json:"custom_subject,omitempty"`
-	Paused        bool                                                                       `json:"paused,omitempty"`
-	Subscribers   []DataSourceJobJobSettingsSettingsTaskDashboardTaskSubscriptionSubscribers `json:"subscribers,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskDashboardTask struct {
-	DashboardId  string                                                         `json:"dashboard_id,omitempty"`
-	Filters      map[string]string                                              `json:"filters,omitempty"`
-	WarehouseId  string                                                         `json:"warehouse_id,omitempty"`
-	Subscription *DataSourceJobJobSettingsSettingsTaskDashboardTaskSubscription `json:"subscription,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskDbtTask struct {
-	Catalog           string   `json:"catalog,omitempty"`
-	Commands          []string `json:"commands"`
-	ProfilesDirectory string   `json:"profiles_directory,omitempty"`
-	ProjectDirectory  string   `json:"project_directory,omitempty"`
-	Schema            string   `json:"schema,omitempty"`
-	Source            string   `json:"source,omitempty"`
-	WarehouseId       string   `json:"warehouse_id,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskDependsOn struct {
-	Outcome string `json:"outcome,omitempty"`
-	TaskKey string `json:"task_key"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskEmailNotifications struct {
-	NoAlertForSkippedRuns              bool     `json:"no_alert_for_skipped_runs,omitempty"`
-	OnDurationWarningThresholdExceeded []string `json:"on_duration_warning_threshold_exceeded,omitempty"`
-	OnFailure                          []string `json:"on_failure,omitempty"`
-	OnStart                            []string `json:"on_start,omitempty"`
-	OnStreamingBacklogExceeded         []string `json:"on_streaming_backlog_exceeded,omitempty"`
-	OnSuccess                          []string `json:"on_success,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskConditionTask struct {
-	Left  string `json:"left"`
-	Op    string `json:"op"`
-	Right string `json:"right"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskDashboardTaskSubscriptionSubscribers struct {
-	DestinationId string `json:"destination_id,omitempty"`
-	UserName      string `json:"user_name,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskDashboardTaskSubscription struct {
-	CustomSubject string                                                                                    `json:"custom_subject,omitempty"`
-	Paused        bool                                                                                      `json:"paused,omitempty"`
-	Subscribers   []DataSourceJobJobSettingsSettingsTaskForEachTaskTaskDashboardTaskSubscriptionSubscribers `json:"subscribers,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskDashboardTask struct {
-	DashboardId  string                                                                        `json:"dashboard_id,omitempty"`
-	Filters      map[string]string                                                             `json:"filters,omitempty"`
-	WarehouseId  string                                                                        `json:"warehouse_id,omitempty"`
-	Subscription *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskDashboardTaskSubscription `json:"subscription,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskDbtTask struct {
-	Catalog           string   `json:"catalog,omitempty"`
-	Commands          []string `json:"commands"`
-	ProfilesDirectory string   `json:"profiles_directory,omitempty"`
-	ProjectDirectory  string   `json:"project_directory,omitempty"`
-	Schema            string   `json:"schema,omitempty"`
-	Source            string   `json:"source,omitempty"`
-	WarehouseId       string   `json:"warehouse_id,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskDependsOn struct {
-	Outcome string `json:"outcome,omitempty"`
-	TaskKey string `json:"task_key"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskEmailNotifications struct {
-	NoAlertForSkippedRuns              bool     `json:"no_alert_for_skipped_runs,omitempty"`
-	OnDurationWarningThresholdExceeded []string `json:"on_duration_warning_threshold_exceeded,omitempty"`
-	OnFailure                          []string `json:"on_failure,omitempty"`
-	OnStart                            []string `json:"on_start,omitempty"`
-	OnStreamingBacklogExceeded         []string `json:"on_streaming_backlog_exceeded,omitempty"`
-	OnSuccess                          []string `json:"on_success,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskHealthRules struct {
-	Metric string `json:"metric"`
-	Op     string `json:"op"`
-	Value  int    `json:"value"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskHealth struct {
-	Rules []DataSourceJobJobSettingsSettingsTaskForEachTaskTaskHealthRules `json:"rules,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskLibraryCran struct {
-	Package string `json:"package"`
-	Repo    string `json:"repo,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskLibraryMaven struct {
-	Coordinates string   `json:"coordinates"`
-	Exclusions  []string `json:"exclusions,omitempty"`
-	Repo        string   `json:"repo,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskLibraryProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskLibraryPypi struct {
-	Package string `json:"package"`
-	Repo    string `json:"repo,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskLibrary struct {
-	Egg            string                                                                    `json:"egg,omitempty"`
-	Jar            string                                                                    `json:"jar,omitempty"`
-	Requirements   string                                                                    `json:"requirements,omitempty"`
-	Whl            string                                                                    `json:"whl,omitempty"`
-	Cran           *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskLibraryCran           `json:"cran,omitempty"`
-	Maven          *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskLibraryMaven          `json:"maven,omitempty"`
-	ProviderConfig *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskLibraryProviderConfig `json:"provider_config,omitempty"`
-	Pypi           *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskLibraryPypi           `json:"pypi,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterAutoscale struct {
-	MaxWorkers int `json:"max_workers,omitempty"`
-	MinWorkers int `json:"min_workers,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterAwsAttributes struct {
-	Availability        string `json:"availability,omitempty"`
-	EbsVolumeCount      int    `json:"ebs_volume_count,omitempty"`
-	EbsVolumeSize       int    `json:"ebs_volume_size,omitempty"`
-	EbsVolumeType       string `json:"ebs_volume_type,omitempty"`
-	FirstOnDemand       int    `json:"first_on_demand,omitempty"`
-	InstanceProfileArn  string `json:"instance_profile_arn,omitempty"`
-	SpotBidPricePercent int    `json:"spot_bid_price_percent,omitempty"`
-	ZoneId              string `json:"zone_id,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterAzureAttributes struct {
-	Availability    string `json:"availability,omitempty"`
-	FirstOnDemand   int    `json:"first_on_demand,omitempty"`
-	SpotBidMaxPrice int    `json:"spot_bid_max_price,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterClusterLogConfDbfs struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterClusterLogConfS3 struct {
-	CannedAcl        string `json:"canned_acl,omitempty"`
-	Destination      string `json:"destination"`
-	EnableEncryption bool   `json:"enable_encryption,omitempty"`
-	EncryptionType   string `json:"encryption_type,omitempty"`
-	Endpoint         string `json:"endpoint,omitempty"`
-	KmsKey           string `json:"kms_key,omitempty"`
-	Region           string `json:"region,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterClusterLogConf struct {
-	Dbfs *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterClusterLogConfDbfs `json:"dbfs,omitempty"`
-	S3   *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterClusterLogConfS3   `json:"s3,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterClusterMountInfoNetworkFilesystemInfo struct {
-	MountOptions  string `json:"mount_options,omitempty"`
-	ServerAddress string `json:"server_address"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterClusterMountInfo struct {
-	LocalMountDirPath     string                                                                                              `json:"local_mount_dir_path"`
-	RemoteMountDirPath    string                                                                                              `json:"remote_mount_dir_path,omitempty"`
-	NetworkFilesystemInfo *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterClusterMountInfoNetworkFilesystemInfo `json:"network_filesystem_info,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterDockerImageBasicAuth struct {
-	Password string `json:"password"`
-	Username string `json:"username"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterDockerImage struct {
-	Url       string                                                                             `json:"url"`
-	BasicAuth *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterDockerImageBasicAuth `json:"basic_auth,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterGcpAttributes struct {
-	Availability            string `json:"availability,omitempty"`
-	BootDiskSize            int    `json:"boot_disk_size,omitempty"`
-	GoogleServiceAccount    string `json:"google_service_account,omitempty"`
-	LocalSsdCount           int    `json:"local_ssd_count,omitempty"`
-	UsePreemptibleExecutors bool   `json:"use_preemptible_executors,omitempty"`
-	ZoneId                  string `json:"zone_id,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterInitScriptsAbfss struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterInitScriptsDbfs struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterInitScriptsFile struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterInitScriptsGcs struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterInitScriptsS3 struct {
-	CannedAcl        string `json:"canned_acl,omitempty"`
-	Destination      string `json:"destination"`
-	EnableEncryption bool   `json:"enable_encryption,omitempty"`
-	EncryptionType   string `json:"encryption_type,omitempty"`
-	Endpoint         string `json:"endpoint,omitempty"`
-	KmsKey           string `json:"kms_key,omitempty"`
-	Region           string `json:"region,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterInitScriptsVolumes struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterInitScriptsWorkspace struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterInitScripts struct {
-	Abfss     *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterInitScriptsAbfss     `json:"abfss,omitempty"`
-	Dbfs      *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterInitScriptsDbfs      `json:"dbfs,omitempty"`
-	File      *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterInitScriptsFile      `json:"file,omitempty"`
-	Gcs       *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterInitScriptsGcs       `json:"gcs,omitempty"`
-	S3        *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterInitScriptsS3        `json:"s3,omitempty"`
-	Volumes   *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterInitScriptsVolumes   `json:"volumes,omitempty"`
-	Workspace *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterInitScriptsWorkspace `json:"workspace,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterWorkloadTypeClients struct {
-	Jobs      bool `json:"jobs,omitempty"`
-	Notebooks bool `json:"notebooks,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterWorkloadType struct {
-	Clients *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterWorkloadTypeClients `json:"clients,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewCluster struct {
-	ApplyPolicyDefaultValues  bool                                                                            `json:"apply_policy_default_values,omitempty"`
-	AutoterminationMinutes    int                                                                             `json:"autotermination_minutes,omitempty"`
-	ClusterId                 string                                                                          `json:"cluster_id,omitempty"`
-	ClusterName               string                                                                          `json:"cluster_name,omitempty"`
-	CustomTags                map[string]string                                                               `json:"custom_tags,omitempty"`
-	DataSecurityMode          string                                                                          `json:"data_security_mode,omitempty"`
-	DriverInstancePoolId      string                                                                          `json:"driver_instance_pool_id,omitempty"`
-	DriverNodeTypeId          string                                                                          `json:"driver_node_type_id,omitempty"`
-	EnableElasticDisk         bool                                                                            `json:"enable_elastic_disk,omitempty"`
-	EnableLocalDiskEncryption bool                                                                            `json:"enable_local_disk_encryption,omitempty"`
-	IdempotencyToken          string                                                                          `json:"idempotency_token,omitempty"`
-	InstancePoolId            string                                                                          `json:"instance_pool_id,omitempty"`
-	NodeTypeId                string                                                                          `json:"node_type_id,omitempty"`
-	NumWorkers                int                                                                             `json:"num_workers"`
-	PolicyId                  string                                                                          `json:"policy_id,omitempty"`
-	RuntimeEngine             string                                                                          `json:"runtime_engine,omitempty"`
-	SingleUserName            string                                                                          `json:"single_user_name,omitempty"`
-	SparkConf                 map[string]string                                                               `json:"spark_conf,omitempty"`
-	SparkEnvVars              map[string]string                                                               `json:"spark_env_vars,omitempty"`
-	SparkVersion              string                                                                          `json:"spark_version,omitempty"`
-	SshPublicKeys             []string                                                                        `json:"ssh_public_keys,omitempty"`
-	Autoscale                 *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterAutoscale         `json:"autoscale,omitempty"`
-	AwsAttributes             *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterAwsAttributes     `json:"aws_attributes,omitempty"`
-	AzureAttributes           *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterAzureAttributes   `json:"azure_attributes,omitempty"`
-	ClusterLogConf            *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterClusterLogConf    `json:"cluster_log_conf,omitempty"`
-	ClusterMountInfo          []DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterClusterMountInfo `json:"cluster_mount_info,omitempty"`
-	DockerImage               *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterDockerImage       `json:"docker_image,omitempty"`
-	GcpAttributes             *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterGcpAttributes     `json:"gcp_attributes,omitempty"`
-	InitScripts               []DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterInitScripts      `json:"init_scripts,omitempty"`
-	WorkloadType              *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewClusterWorkloadType      `json:"workload_type,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNotebookTask struct {
-	BaseParameters map[string]string `json:"base_parameters,omitempty"`
-	NotebookPath   string            `json:"notebook_path"`
-	Source         string            `json:"source,omitempty"`
-	WarehouseId    string            `json:"warehouse_id,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNotificationSettings struct {
-	AlertOnLastAttempt     bool `json:"alert_on_last_attempt,omitempty"`
-	NoAlertForCanceledRuns bool `json:"no_alert_for_canceled_runs,omitempty"`
-	NoAlertForSkippedRuns  bool `json:"no_alert_for_skipped_runs,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskPipelineTask struct {
-	FullRefresh bool   `json:"full_refresh,omitempty"`
-	PipelineId  string `json:"pipeline_id"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskPowerBiTaskPowerBiModel struct {
-	AuthenticationMethod string `json:"authentication_method,omitempty"`
-	ModelName            string `json:"model_name,omitempty"`
-	OverwriteExisting    bool   `json:"overwrite_existing,omitempty"`
-	StorageMode          string `json:"storage_mode,omitempty"`
-	WorkspaceName        string `json:"workspace_name,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskPowerBiTaskTables struct {
-	Catalog     string `json:"catalog,omitempty"`
-	Name        string `json:"name,omitempty"`
-	Schema      string `json:"schema,omitempty"`
-	StorageMode string `json:"storage_mode,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskPowerBiTask struct {
-	ConnectionResourceName string                                                                      `json:"connection_resource_name,omitempty"`
-	RefreshAfterUpdate     bool                                                                        `json:"refresh_after_update,omitempty"`
-	WarehouseId            string                                                                      `json:"warehouse_id,omitempty"`
-	PowerBiModel           *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskPowerBiTaskPowerBiModel `json:"power_bi_model,omitempty"`
-	Tables                 []DataSourceJobJobSettingsSettingsTaskForEachTaskTaskPowerBiTaskTables      `json:"tables,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskPythonWheelTask struct {
-	EntryPoint      string            `json:"entry_point,omitempty"`
-	NamedParameters map[string]string `json:"named_parameters,omitempty"`
-	PackageName     string            `json:"package_name,omitempty"`
-	Parameters      []string          `json:"parameters,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskRunJobTask struct {
-	JobId         int               `json:"job_id"`
-	JobParameters map[string]string `json:"job_parameters,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskSparkJarTask struct {
-	JarUri        string   `json:"jar_uri,omitempty"`
-	MainClassName string   `json:"main_class_name,omitempty"`
-	Parameters    []string `json:"parameters,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskSparkPythonTask struct {
-	Parameters []string `json:"parameters,omitempty"`
-	PythonFile string   `json:"python_file"`
-	Source     string   `json:"source,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskSparkSubmitTask struct {
-	Parameters []string `json:"parameters,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskSqlTaskAlertSubscriptions struct {
-	DestinationId string `json:"destination_id,omitempty"`
-	UserName      string `json:"user_name,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskSqlTaskAlert struct {
-	AlertId            string                                                                         `json:"alert_id"`
-	PauseSubscriptions bool                                                                           `json:"pause_subscriptions,omitempty"`
-	Subscriptions      []DataSourceJobJobSettingsSettingsTaskForEachTaskTaskSqlTaskAlertSubscriptions `json:"subscriptions,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskSqlTaskDashboardSubscriptions struct {
-	DestinationId string `json:"destination_id,omitempty"`
-	UserName      string `json:"user_name,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskSqlTaskDashboard struct {
-	CustomSubject      string                                                                             `json:"custom_subject,omitempty"`
-	DashboardId        string                                                                             `json:"dashboard_id"`
-	PauseSubscriptions bool                                                                               `json:"pause_subscriptions,omitempty"`
-	Subscriptions      []DataSourceJobJobSettingsSettingsTaskForEachTaskTaskSqlTaskDashboardSubscriptions `json:"subscriptions,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskSqlTaskFile struct {
-	Path   string `json:"path"`
-	Source string `json:"source,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskSqlTaskQuery struct {
-	QueryId string `json:"query_id"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskSqlTask struct {
-	Parameters  map[string]string                                                    `json:"parameters,omitempty"`
-	WarehouseId string                                                               `json:"warehouse_id"`
-	Alert       *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskSqlTaskAlert     `json:"alert,omitempty"`
-	Dashboard   *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskSqlTaskDashboard `json:"dashboard,omitempty"`
-	File        *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskSqlTaskFile      `json:"file,omitempty"`
-	Query       *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskSqlTaskQuery     `json:"query,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskWebhookNotificationsOnDurationWarningThresholdExceeded struct {
-	Id string `json:"id"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskWebhookNotificationsOnFailure struct {
-	Id string `json:"id"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskWebhookNotificationsOnStart struct {
-	Id string `json:"id"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskWebhookNotificationsOnStreamingBacklogExceeded struct {
-	Id string `json:"id"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskWebhookNotificationsOnSuccess struct {
-	Id string `json:"id"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTaskWebhookNotifications struct {
-	OnDurationWarningThresholdExceeded []DataSourceJobJobSettingsSettingsTaskForEachTaskTaskWebhookNotificationsOnDurationWarningThresholdExceeded `json:"on_duration_warning_threshold_exceeded,omitempty"`
-	OnFailure                          []DataSourceJobJobSettingsSettingsTaskForEachTaskTaskWebhookNotificationsOnFailure                          `json:"on_failure,omitempty"`
-	OnStart                            []DataSourceJobJobSettingsSettingsTaskForEachTaskTaskWebhookNotificationsOnStart                            `json:"on_start,omitempty"`
-	OnStreamingBacklogExceeded         []DataSourceJobJobSettingsSettingsTaskForEachTaskTaskWebhookNotificationsOnStreamingBacklogExceeded         `json:"on_streaming_backlog_exceeded,omitempty"`
-	OnSuccess                          []DataSourceJobJobSettingsSettingsTaskForEachTaskTaskWebhookNotificationsOnSuccess                          `json:"on_success,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTaskTask struct {
-	Description            string                                                                   `json:"description,omitempty"`
-	EnvironmentKey         string                                                                   `json:"environment_key,omitempty"`
-	ExistingClusterId      string                                                                   `json:"existing_cluster_id,omitempty"`
-	JobClusterKey          string                                                                   `json:"job_cluster_key,omitempty"`
-	MaxRetries             int                                                                      `json:"max_retries,omitempty"`
-	MinRetryIntervalMillis int                                                                      `json:"min_retry_interval_millis,omitempty"`
-	RetryOnTimeout         bool                                                                     `json:"retry_on_timeout,omitempty"`
-	RunIf                  string                                                                   `json:"run_if,omitempty"`
-	TaskKey                string                                                                   `json:"task_key"`
-	TimeoutSeconds         int                                                                      `json:"timeout_seconds,omitempty"`
-	ConditionTask          *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskConditionTask        `json:"condition_task,omitempty"`
-	DashboardTask          *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskDashboardTask        `json:"dashboard_task,omitempty"`
-	DbtTask                *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskDbtTask              `json:"dbt_task,omitempty"`
-	DependsOn              []DataSourceJobJobSettingsSettingsTaskForEachTaskTaskDependsOn           `json:"depends_on,omitempty"`
-	EmailNotifications     *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskEmailNotifications   `json:"email_notifications,omitempty"`
-	Health                 *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskHealth               `json:"health,omitempty"`
-	Library                []DataSourceJobJobSettingsSettingsTaskForEachTaskTaskLibrary             `json:"library,omitempty"`
-	NewCluster             *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNewCluster           `json:"new_cluster,omitempty"`
-	NotebookTask           *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNotebookTask         `json:"notebook_task,omitempty"`
-	NotificationSettings   *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskNotificationSettings `json:"notification_settings,omitempty"`
-	PipelineTask           *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskPipelineTask         `json:"pipeline_task,omitempty"`
-	PowerBiTask            *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskPowerBiTask          `json:"power_bi_task,omitempty"`
-	PythonWheelTask        *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskPythonWheelTask      `json:"python_wheel_task,omitempty"`
-	RunJobTask             *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskRunJobTask           `json:"run_job_task,omitempty"`
-	SparkJarTask           *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskSparkJarTask         `json:"spark_jar_task,omitempty"`
-	SparkPythonTask        *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskSparkPythonTask      `json:"spark_python_task,omitempty"`
-	SparkSubmitTask        *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskSparkSubmitTask      `json:"spark_submit_task,omitempty"`
-	SqlTask                *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskSqlTask              `json:"sql_task,omitempty"`
-	WebhookNotifications   *DataSourceJobJobSettingsSettingsTaskForEachTaskTaskWebhookNotifications `json:"webhook_notifications,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskForEachTask struct {
-	Concurrency int                                                  `json:"concurrency,omitempty"`
-	Inputs      string                                               `json:"inputs"`
-	Task        *DataSourceJobJobSettingsSettingsTaskForEachTaskTask `json:"task,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskHealthRules struct {
-	Metric string `json:"metric"`
-	Op     string `json:"op"`
-	Value  int    `json:"value"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskHealth struct {
-	Rules []DataSourceJobJobSettingsSettingsTaskHealthRules `json:"rules,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskLibraryCran struct {
-	Package string `json:"package"`
-	Repo    string `json:"repo,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskLibraryMaven struct {
-	Coordinates string   `json:"coordinates"`
-	Exclusions  []string `json:"exclusions,omitempty"`
-	Repo        string   `json:"repo,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskLibraryProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskLibraryPypi struct {
-	Package string `json:"package"`
-	Repo    string `json:"repo,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskLibrary struct {
-	Egg            string                                                     `json:"egg,omitempty"`
-	Jar            string                                                     `json:"jar,omitempty"`
-	Requirements   string                                                     `json:"requirements,omitempty"`
-	Whl            string                                                     `json:"whl,omitempty"`
-	Cran           *DataSourceJobJobSettingsSettingsTaskLibraryCran           `json:"cran,omitempty"`
-	Maven          *DataSourceJobJobSettingsSettingsTaskLibraryMaven          `json:"maven,omitempty"`
-	ProviderConfig *DataSourceJobJobSettingsSettingsTaskLibraryProviderConfig `json:"provider_config,omitempty"`
-	Pypi           *DataSourceJobJobSettingsSettingsTaskLibraryPypi           `json:"pypi,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskNewClusterAutoscale struct {
-	MaxWorkers int `json:"max_workers,omitempty"`
-	MinWorkers int `json:"min_workers,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskNewClusterAwsAttributes struct {
-	Availability        string `json:"availability,omitempty"`
-	EbsVolumeCount      int    `json:"ebs_volume_count,omitempty"`
-	EbsVolumeSize       int    `json:"ebs_volume_size,omitempty"`
-	EbsVolumeType       string `json:"ebs_volume_type,omitempty"`
-	FirstOnDemand       int    `json:"first_on_demand,omitempty"`
-	InstanceProfileArn  string `json:"instance_profile_arn,omitempty"`
-	SpotBidPricePercent int    `json:"spot_bid_price_percent,omitempty"`
-	ZoneId              string `json:"zone_id,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskNewClusterAzureAttributes struct {
-	Availability    string `json:"availability,omitempty"`
-	FirstOnDemand   int    `json:"first_on_demand,omitempty"`
-	SpotBidMaxPrice int    `json:"spot_bid_max_price,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskNewClusterClusterLogConfDbfs struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskNewClusterClusterLogConfS3 struct {
-	CannedAcl        string `json:"canned_acl,omitempty"`
-	Destination      string `json:"destination"`
-	EnableEncryption bool   `json:"enable_encryption,omitempty"`
-	EncryptionType   string `json:"encryption_type,omitempty"`
-	Endpoint         string `json:"endpoint,omitempty"`
-	KmsKey           string `json:"kms_key,omitempty"`
-	Region           string `json:"region,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskNewClusterClusterLogConf struct {
-	Dbfs *DataSourceJobJobSettingsSettingsTaskNewClusterClusterLogConfDbfs `json:"dbfs,omitempty"`
-	S3   *DataSourceJobJobSettingsSettingsTaskNewClusterClusterLogConfS3   `json:"s3,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskNewClusterClusterMountInfoNetworkFilesystemInfo struct {
-	MountOptions  string `json:"mount_options,omitempty"`
-	ServerAddress string `json:"server_address"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskNewClusterClusterMountInfo struct {
-	LocalMountDirPath     string                                                                               `json:"local_mount_dir_path"`
-	RemoteMountDirPath    string                                                                               `json:"remote_mount_dir_path,omitempty"`
-	NetworkFilesystemInfo *DataSourceJobJobSettingsSettingsTaskNewClusterClusterMountInfoNetworkFilesystemInfo `json:"network_filesystem_info,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskNewClusterDockerImageBasicAuth struct {
-	Password string `json:"password"`
-	Username string `json:"username"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskNewClusterDockerImage struct {
-	Url       string                                                              `json:"url"`
-	BasicAuth *DataSourceJobJobSettingsSettingsTaskNewClusterDockerImageBasicAuth `json:"basic_auth,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskNewClusterGcpAttributes struct {
-	Availability            string `json:"availability,omitempty"`
-	BootDiskSize            int    `json:"boot_disk_size,omitempty"`
-	GoogleServiceAccount    string `json:"google_service_account,omitempty"`
-	LocalSsdCount           int    `json:"local_ssd_count,omitempty"`
-	UsePreemptibleExecutors bool   `json:"use_preemptible_executors,omitempty"`
-	ZoneId                  string `json:"zone_id,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskNewClusterInitScriptsAbfss struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskNewClusterInitScriptsDbfs struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskNewClusterInitScriptsFile struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskNewClusterInitScriptsGcs struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskNewClusterInitScriptsS3 struct {
-	CannedAcl        string `json:"canned_acl,omitempty"`
-	Destination      string `json:"destination"`
-	EnableEncryption bool   `json:"enable_encryption,omitempty"`
-	EncryptionType   string `json:"encryption_type,omitempty"`
-	Endpoint         string `json:"endpoint,omitempty"`
-	KmsKey           string `json:"kms_key,omitempty"`
-	Region           string `json:"region,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskNewClusterInitScriptsVolumes struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskNewClusterInitScriptsWorkspace struct {
-	Destination string `json:"destination"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskNewClusterInitScripts struct {
-	Abfss     *DataSourceJobJobSettingsSettingsTaskNewClusterInitScriptsAbfss     `json:"abfss,omitempty"`
-	Dbfs      *DataSourceJobJobSettingsSettingsTaskNewClusterInitScriptsDbfs      `json:"dbfs,omitempty"`
-	File      *DataSourceJobJobSettingsSettingsTaskNewClusterInitScriptsFile      `json:"file,omitempty"`
-	Gcs       *DataSourceJobJobSettingsSettingsTaskNewClusterInitScriptsGcs       `json:"gcs,omitempty"`
-	S3        *DataSourceJobJobSettingsSettingsTaskNewClusterInitScriptsS3        `json:"s3,omitempty"`
-	Volumes   *DataSourceJobJobSettingsSettingsTaskNewClusterInitScriptsVolumes   `json:"volumes,omitempty"`
-	Workspace *DataSourceJobJobSettingsSettingsTaskNewClusterInitScriptsWorkspace `json:"workspace,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskNewClusterWorkloadTypeClients struct {
-	Jobs      bool `json:"jobs,omitempty"`
-	Notebooks bool `json:"notebooks,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskNewClusterWorkloadType struct {
-	Clients *DataSourceJobJobSettingsSettingsTaskNewClusterWorkloadTypeClients `json:"clients,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskNewCluster struct {
-	ApplyPolicyDefaultValues  bool                                                             `json:"apply_policy_default_values,omitempty"`
-	AutoterminationMinutes    int                                                              `json:"autotermination_minutes,omitempty"`
-	ClusterId                 string                                                           `json:"cluster_id,omitempty"`
-	ClusterName               string                                                           `json:"cluster_name,omitempty"`
-	CustomTags                map[string]string                                                `json:"custom_tags,omitempty"`
-	DataSecurityMode          string                                                           `json:"data_security_mode,omitempty"`
-	DriverInstancePoolId      string                                                           `json:"driver_instance_pool_id,omitempty"`
-	DriverNodeTypeId          string                                                           `json:"driver_node_type_id,omitempty"`
-	EnableElasticDisk         bool                                                             `json:"enable_elastic_disk,omitempty"`
-	EnableLocalDiskEncryption bool                                                             `json:"enable_local_disk_encryption,omitempty"`
-	IdempotencyToken          string                                                           `json:"idempotency_token,omitempty"`
-	InstancePoolId            string                                                           `json:"instance_pool_id,omitempty"`
-	NodeTypeId                string                                                           `json:"node_type_id,omitempty"`
-	NumWorkers                int                                                              `json:"num_workers"`
-	PolicyId                  string                                                           `json:"policy_id,omitempty"`
-	RuntimeEngine             string                                                           `json:"runtime_engine,omitempty"`
-	SingleUserName            string                                                           `json:"single_user_name,omitempty"`
-	SparkConf                 map[string]string                                                `json:"spark_conf,omitempty"`
-	SparkEnvVars              map[string]string                                                `json:"spark_env_vars,omitempty"`
-	SparkVersion              string                                                           `json:"spark_version,omitempty"`
-	SshPublicKeys             []string                                                         `json:"ssh_public_keys,omitempty"`
-	Autoscale                 *DataSourceJobJobSettingsSettingsTaskNewClusterAutoscale         `json:"autoscale,omitempty"`
-	AwsAttributes             *DataSourceJobJobSettingsSettingsTaskNewClusterAwsAttributes     `json:"aws_attributes,omitempty"`
-	AzureAttributes           *DataSourceJobJobSettingsSettingsTaskNewClusterAzureAttributes   `json:"azure_attributes,omitempty"`
-	ClusterLogConf            *DataSourceJobJobSettingsSettingsTaskNewClusterClusterLogConf    `json:"cluster_log_conf,omitempty"`
-	ClusterMountInfo          []DataSourceJobJobSettingsSettingsTaskNewClusterClusterMountInfo `json:"cluster_mount_info,omitempty"`
-	DockerImage               *DataSourceJobJobSettingsSettingsTaskNewClusterDockerImage       `json:"docker_image,omitempty"`
-	GcpAttributes             *DataSourceJobJobSettingsSettingsTaskNewClusterGcpAttributes     `json:"gcp_attributes,omitempty"`
-	InitScripts               []DataSourceJobJobSettingsSettingsTaskNewClusterInitScripts      `json:"init_scripts,omitempty"`
-	WorkloadType              *DataSourceJobJobSettingsSettingsTaskNewClusterWorkloadType      `json:"workload_type,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskNotebookTask struct {
-	BaseParameters map[string]string `json:"base_parameters,omitempty"`
-	NotebookPath   string            `json:"notebook_path"`
-	Source         string            `json:"source,omitempty"`
-	WarehouseId    string            `json:"warehouse_id,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskNotificationSettings struct {
-	AlertOnLastAttempt     bool `json:"alert_on_last_attempt,omitempty"`
-	NoAlertForCanceledRuns bool `json:"no_alert_for_canceled_runs,omitempty"`
-	NoAlertForSkippedRuns  bool `json:"no_alert_for_skipped_runs,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskPipelineTask struct {
-	FullRefresh bool   `json:"full_refresh,omitempty"`
-	PipelineId  string `json:"pipeline_id"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskPowerBiTaskPowerBiModel struct {
-	AuthenticationMethod string `json:"authentication_method,omitempty"`
-	ModelName            string `json:"model_name,omitempty"`
-	OverwriteExisting    bool   `json:"overwrite_existing,omitempty"`
-	StorageMode          string `json:"storage_mode,omitempty"`
-	WorkspaceName        string `json:"workspace_name,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskPowerBiTaskTables struct {
-	Catalog     string `json:"catalog,omitempty"`
-	Name        string `json:"name,omitempty"`
-	Schema      string `json:"schema,omitempty"`
-	StorageMode string `json:"storage_mode,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskPowerBiTask struct {
-	ConnectionResourceName string                                                       `json:"connection_resource_name,omitempty"`
-	RefreshAfterUpdate     bool                                                         `json:"refresh_after_update,omitempty"`
-	WarehouseId            string                                                       `json:"warehouse_id,omitempty"`
-	PowerBiModel           *DataSourceJobJobSettingsSettingsTaskPowerBiTaskPowerBiModel `json:"power_bi_model,omitempty"`
-	Tables                 []DataSourceJobJobSettingsSettingsTaskPowerBiTaskTables      `json:"tables,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskPythonWheelTask struct {
-	EntryPoint      string            `json:"entry_point,omitempty"`
-	NamedParameters map[string]string `json:"named_parameters,omitempty"`
-	PackageName     string            `json:"package_name,omitempty"`
-	Parameters      []string          `json:"parameters,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskRunJobTask struct {
-	JobId         int               `json:"job_id"`
-	JobParameters map[string]string `json:"job_parameters,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskSparkJarTask struct {
-	JarUri        string   `json:"jar_uri,omitempty"`
-	MainClassName string   `json:"main_class_name,omitempty"`
-	Parameters    []string `json:"parameters,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskSparkPythonTask struct {
-	Parameters []string `json:"parameters,omitempty"`
-	PythonFile string   `json:"python_file"`
-	Source     string   `json:"source,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskSparkSubmitTask struct {
-	Parameters []string `json:"parameters,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskSqlTaskAlertSubscriptions struct {
-	DestinationId string `json:"destination_id,omitempty"`
-	UserName      string `json:"user_name,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskSqlTaskAlert struct {
-	AlertId            string                                                          `json:"alert_id"`
-	PauseSubscriptions bool                                                            `json:"pause_subscriptions,omitempty"`
-	Subscriptions      []DataSourceJobJobSettingsSettingsTaskSqlTaskAlertSubscriptions `json:"subscriptions,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskSqlTaskDashboardSubscriptions struct {
-	DestinationId string `json:"destination_id,omitempty"`
-	UserName      string `json:"user_name,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskSqlTaskDashboard struct {
-	CustomSubject      string                                                              `json:"custom_subject,omitempty"`
-	DashboardId        string                                                              `json:"dashboard_id"`
-	PauseSubscriptions bool                                                                `json:"pause_subscriptions,omitempty"`
-	Subscriptions      []DataSourceJobJobSettingsSettingsTaskSqlTaskDashboardSubscriptions `json:"subscriptions,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskSqlTaskFile struct {
-	Path   string `json:"path"`
-	Source string `json:"source,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskSqlTaskQuery struct {
-	QueryId string `json:"query_id"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskSqlTask struct {
-	Parameters  map[string]string                                     `json:"parameters,omitempty"`
-	WarehouseId string                                                `json:"warehouse_id"`
-	Alert       *DataSourceJobJobSettingsSettingsTaskSqlTaskAlert     `json:"alert,omitempty"`
-	Dashboard   *DataSourceJobJobSettingsSettingsTaskSqlTaskDashboard `json:"dashboard,omitempty"`
-	File        *DataSourceJobJobSettingsSettingsTaskSqlTaskFile      `json:"file,omitempty"`
-	Query       *DataSourceJobJobSettingsSettingsTaskSqlTaskQuery     `json:"query,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskWebhookNotificationsOnDurationWarningThresholdExceeded struct {
-	Id string `json:"id"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskWebhookNotificationsOnFailure struct {
-	Id string `json:"id"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskWebhookNotificationsOnStart struct {
-	Id string `json:"id"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskWebhookNotificationsOnStreamingBacklogExceeded struct {
-	Id string `json:"id"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskWebhookNotificationsOnSuccess struct {
-	Id string `json:"id"`
-}
-
-type DataSourceJobJobSettingsSettingsTaskWebhookNotifications struct {
-	OnDurationWarningThresholdExceeded []DataSourceJobJobSettingsSettingsTaskWebhookNotificationsOnDurationWarningThresholdExceeded `json:"on_duration_warning_threshold_exceeded,omitempty"`
-	OnFailure                          []DataSourceJobJobSettingsSettingsTaskWebhookNotificationsOnFailure                          `json:"on_failure,omitempty"`
-	OnStart                            []DataSourceJobJobSettingsSettingsTaskWebhookNotificationsOnStart                            `json:"on_start,omitempty"`
-	OnStreamingBacklogExceeded         []DataSourceJobJobSettingsSettingsTaskWebhookNotificationsOnStreamingBacklogExceeded         `json:"on_streaming_backlog_exceeded,omitempty"`
-	OnSuccess                          []DataSourceJobJobSettingsSettingsTaskWebhookNotificationsOnSuccess                          `json:"on_success,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTask struct {
-	Description            string                                                    `json:"description,omitempty"`
-	EnvironmentKey         string                                                    `json:"environment_key,omitempty"`
-	ExistingClusterId      string                                                    `json:"existing_cluster_id,omitempty"`
-	JobClusterKey          string                                                    `json:"job_cluster_key,omitempty"`
-	MaxRetries             int                                                       `json:"max_retries,omitempty"`
-	MinRetryIntervalMillis int                                                       `json:"min_retry_interval_millis,omitempty"`
-	RetryOnTimeout         bool                                                      `json:"retry_on_timeout,omitempty"`
-	RunIf                  string                                                    `json:"run_if,omitempty"`
-	TaskKey                string                                                    `json:"task_key"`
-	TimeoutSeconds         int                                                       `json:"timeout_seconds,omitempty"`
-	ConditionTask          *DataSourceJobJobSettingsSettingsTaskConditionTask        `json:"condition_task,omitempty"`
-	DashboardTask          *DataSourceJobJobSettingsSettingsTaskDashboardTask        `json:"dashboard_task,omitempty"`
-	DbtTask                *DataSourceJobJobSettingsSettingsTaskDbtTask              `json:"dbt_task,omitempty"`
-	DependsOn              []DataSourceJobJobSettingsSettingsTaskDependsOn           `json:"depends_on,omitempty"`
-	EmailNotifications     *DataSourceJobJobSettingsSettingsTaskEmailNotifications   `json:"email_notifications,omitempty"`
-	ForEachTask            *DataSourceJobJobSettingsSettingsTaskForEachTask          `json:"for_each_task,omitempty"`
-	Health                 *DataSourceJobJobSettingsSettingsTaskHealth               `json:"health,omitempty"`
-	Library                []DataSourceJobJobSettingsSettingsTaskLibrary             `json:"library,omitempty"`
-	NewCluster             *DataSourceJobJobSettingsSettingsTaskNewCluster           `json:"new_cluster,omitempty"`
-	NotebookTask           *DataSourceJobJobSettingsSettingsTaskNotebookTask         `json:"notebook_task,omitempty"`
-	NotificationSettings   *DataSourceJobJobSettingsSettingsTaskNotificationSettings `json:"notification_settings,omitempty"`
-	PipelineTask           *DataSourceJobJobSettingsSettingsTaskPipelineTask         `json:"pipeline_task,omitempty"`
-	PowerBiTask            *DataSourceJobJobSettingsSettingsTaskPowerBiTask          `json:"power_bi_task,omitempty"`
-	PythonWheelTask        *DataSourceJobJobSettingsSettingsTaskPythonWheelTask      `json:"python_wheel_task,omitempty"`
-	RunJobTask             *DataSourceJobJobSettingsSettingsTaskRunJobTask           `json:"run_job_task,omitempty"`
-	SparkJarTask           *DataSourceJobJobSettingsSettingsTaskSparkJarTask         `json:"spark_jar_task,omitempty"`
-	SparkPythonTask        *DataSourceJobJobSettingsSettingsTaskSparkPythonTask      `json:"spark_python_task,omitempty"`
-	SparkSubmitTask        *DataSourceJobJobSettingsSettingsTaskSparkSubmitTask      `json:"spark_submit_task,omitempty"`
-	SqlTask                *DataSourceJobJobSettingsSettingsTaskSqlTask              `json:"sql_task,omitempty"`
-	WebhookNotifications   *DataSourceJobJobSettingsSettingsTaskWebhookNotifications `json:"webhook_notifications,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTriggerFileArrival struct {
-	MinTimeBetweenTriggersSeconds int    `json:"min_time_between_triggers_seconds,omitempty"`
-	Url                           string `json:"url"`
-	WaitAfterLastChangeSeconds    int    `json:"wait_after_last_change_seconds,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTriggerPeriodic struct {
-	Interval int    `json:"interval"`
-	Unit     string `json:"unit"`
-}
-
-type DataSourceJobJobSettingsSettingsTriggerTableUpdate struct {
-	Condition                     string   `json:"condition,omitempty"`
-	MinTimeBetweenTriggersSeconds int      `json:"min_time_between_triggers_seconds,omitempty"`
-	TableNames                    []string `json:"table_names"`
-	WaitAfterLastChangeSeconds    int      `json:"wait_after_last_change_seconds,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsTrigger struct {
-	PauseStatus string                                              `json:"pause_status,omitempty"`
-	FileArrival *DataSourceJobJobSettingsSettingsTriggerFileArrival `json:"file_arrival,omitempty"`
-	Periodic    *DataSourceJobJobSettingsSettingsTriggerPeriodic    `json:"periodic,omitempty"`
-	TableUpdate *DataSourceJobJobSettingsSettingsTriggerTableUpdate `json:"table_update,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettingsWebhookNotificationsOnDurationWarningThresholdExceeded struct {
-	Id string `json:"id"`
-}
-
-type DataSourceJobJobSettingsSettingsWebhookNotificationsOnFailure struct {
-	Id string `json:"id"`
-}
-
-type DataSourceJobJobSettingsSettingsWebhookNotificationsOnStart struct {
-	Id string `json:"id"`
-}
-
-type DataSourceJobJobSettingsSettingsWebhookNotificationsOnStreamingBacklogExceeded struct {
-	Id string `json:"id"`
-}
-
-type DataSourceJobJobSettingsSettingsWebhookNotificationsOnSuccess struct {
-	Id string `json:"id"`
-}
-
-type DataSourceJobJobSettingsSettingsWebhookNotifications struct {
-	OnDurationWarningThresholdExceeded []DataSourceJobJobSettingsSettingsWebhookNotificationsOnDurationWarningThresholdExceeded `json:"on_duration_warning_threshold_exceeded,omitempty"`
-	OnFailure                          []DataSourceJobJobSettingsSettingsWebhookNotificationsOnFailure                          `json:"on_failure,omitempty"`
-	OnStart                            []DataSourceJobJobSettingsSettingsWebhookNotificationsOnStart                            `json:"on_start,omitempty"`
-	OnStreamingBacklogExceeded         []DataSourceJobJobSettingsSettingsWebhookNotificationsOnStreamingBacklogExceeded         `json:"on_streaming_backlog_exceeded,omitempty"`
-	OnSuccess                          []DataSourceJobJobSettingsSettingsWebhookNotificationsOnSuccess                          `json:"on_success,omitempty"`
-}
-
-type DataSourceJobJobSettingsSettings struct {
-	Description            string                                                `json:"description,omitempty"`
-	EditMode               string                                                `json:"edit_mode,omitempty"`
-	ExistingClusterId      string                                                `json:"existing_cluster_id,omitempty"`
-	Format                 string                                                `json:"format,omitempty"`
-	MaxConcurrentRuns      int                                                   `json:"max_concurrent_runs,omitempty"`
-	MaxRetries             int                                                   `json:"max_retries,omitempty"`
-	MinRetryIntervalMillis int                                                   `json:"min_retry_interval_millis,omitempty"`
-	Name                   string                                                `json:"name,omitempty"`
-	RetryOnTimeout         bool                                                  `json:"retry_on_timeout,omitempty"`
-	Tags                   map[string]string                                     `json:"tags,omitempty"`
-	TimeoutSeconds         int                                                   `json:"timeout_seconds,omitempty"`
-	Continuous             *DataSourceJobJobSettingsSettingsContinuous           `json:"continuous,omitempty"`
-	DbtTask                *DataSourceJobJobSettingsSettingsDbtTask              `json:"dbt_task,omitempty"`
-	Deployment             *DataSourceJobJobSettingsSettingsDeployment           `json:"deployment,omitempty"`
-	EmailNotifications     *DataSourceJobJobSettingsSettingsEmailNotifications   `json:"email_notifications,omitempty"`
-	Environment            []DataSourceJobJobSettingsSettingsEnvironment         `json:"environment,omitempty"`
-	GitSource              *DataSourceJobJobSettingsSettingsGitSource            `json:"git_source,omitempty"`
-	Health                 *DataSourceJobJobSettingsSettingsHealth               `json:"health,omitempty"`
-	JobCluster             []DataSourceJobJobSettingsSettingsJobCluster          `json:"job_cluster,omitempty"`
-	Library                []DataSourceJobJobSettingsSettingsLibrary             `json:"library,omitempty"`
-	NewCluster             *DataSourceJobJobSettingsSettingsNewCluster           `json:"new_cluster,omitempty"`
-	NotebookTask           *DataSourceJobJobSettingsSettingsNotebookTask         `json:"notebook_task,omitempty"`
-	NotificationSettings   *DataSourceJobJobSettingsSettingsNotificationSettings `json:"notification_settings,omitempty"`
-	Parameter              []DataSourceJobJobSettingsSettingsParameter           `json:"parameter,omitempty"`
-	PipelineTask           *DataSourceJobJobSettingsSettingsPipelineTask         `json:"pipeline_task,omitempty"`
-	PythonWheelTask        *DataSourceJobJobSettingsSettingsPythonWheelTask      `json:"python_wheel_task,omitempty"`
-	Queue                  *DataSourceJobJobSettingsSettingsQueue                `json:"queue,omitempty"`
-	RunAs                  *DataSourceJobJobSettingsSettingsRunAs                `json:"run_as,omitempty"`
-	RunJobTask             *DataSourceJobJobSettingsSettingsRunJobTask           `json:"run_job_task,omitempty"`
-	Schedule               *DataSourceJobJobSettingsSettingsSchedule             `json:"schedule,omitempty"`
-	SparkJarTask           *DataSourceJobJobSettingsSettingsSparkJarTask         `json:"spark_jar_task,omitempty"`
-	SparkPythonTask        *DataSourceJobJobSettingsSettingsSparkPythonTask      `json:"spark_python_task,omitempty"`
-	SparkSubmitTask        *DataSourceJobJobSettingsSettingsSparkSubmitTask      `json:"spark_submit_task,omitempty"`
-	Task                   []DataSourceJobJobSettingsSettingsTask                `json:"task,omitempty"`
-	Trigger                *DataSourceJobJobSettingsSettingsTrigger              `json:"trigger,omitempty"`
-	WebhookNotifications   *DataSourceJobJobSettingsSettingsWebhookNotifications `json:"webhook_notifications,omitempty"`
-}
-
-type DataSourceJobJobSettings struct {
-	CreatedTime     int                               `json:"created_time,omitempty"`
-	CreatorUserName string                            `json:"creator_user_name,omitempty"`
-	JobId           int                               `json:"job_id,omitempty"`
-	RunAsUserName   string                            `json:"run_as_user_name,omitempty"`
-	Settings        *DataSourceJobJobSettingsSettings `json:"settings,omitempty"`
-}
-
-type DataSourceJobProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceJob struct {
-	Id             string                       `json:"id,omitempty"`
-	JobId          string                       `json:"job_id,omitempty"`
-	JobName        string                       `json:"job_name,omitempty"`
-	Name           string                       `json:"name,omitempty"`
-	JobSettings    *DataSourceJobJobSettings    `json:"job_settings,omitempty"`
-	ProviderConfig *DataSourceJobProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_jobs.go b/bundle/internal/tf/schema/data_source_jobs.go
deleted file mode 100644
index f908f5e6374..00000000000
--- a/bundle/internal/tf/schema/data_source_jobs.go
+++ /dev/null
@@ -1,15 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceJobsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceJobs struct {
-	Id              string                        `json:"id,omitempty"`
-	Ids             map[string]string             `json:"ids,omitempty"`
-	JobNameContains string                        `json:"job_name_contains,omitempty"`
-	Key             string                        `json:"key,omitempty"`
-	ProviderConfig  *DataSourceJobsProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_knowledge_assistant.go b/bundle/internal/tf/schema/data_source_knowledge_assistant.go
deleted file mode 100644
index 594816e28da..00000000000
--- a/bundle/internal/tf/schema/data_source_knowledge_assistant.go
+++ /dev/null
@@ -1,22 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceKnowledgeAssistantProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceKnowledgeAssistant struct {
-	CreateTime     string                                      `json:"create_time,omitempty"`
-	Creator        string                                      `json:"creator,omitempty"`
-	Description    string                                      `json:"description,omitempty"`
-	DisplayName    string                                      `json:"display_name,omitempty"`
-	EndpointName   string                                      `json:"endpoint_name,omitempty"`
-	ErrorInfo      string                                      `json:"error_info,omitempty"`
-	ExperimentId   string                                      `json:"experiment_id,omitempty"`
-	Id             string                                      `json:"id,omitempty"`
-	Instructions   string                                      `json:"instructions,omitempty"`
-	Name           string                                      `json:"name"`
-	ProviderConfig *DataSourceKnowledgeAssistantProviderConfig `json:"provider_config,omitempty"`
-	State          string                                      `json:"state,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_knowledge_assistant_knowledge_source.go b/bundle/internal/tf/schema/data_source_knowledge_assistant_knowledge_source.go
deleted file mode 100644
index 1374e80515b..00000000000
--- a/bundle/internal/tf/schema/data_source_knowledge_assistant_knowledge_source.go
+++ /dev/null
@@ -1,37 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceKnowledgeAssistantKnowledgeSourceFileTable struct {
-	FileCol   string `json:"file_col"`
-	TableName string `json:"table_name"`
-}
-
-type DataSourceKnowledgeAssistantKnowledgeSourceFiles struct {
-	Path string `json:"path"`
-}
-
-type DataSourceKnowledgeAssistantKnowledgeSourceIndex struct {
-	DocUriCol string `json:"doc_uri_col"`
-	IndexName string `json:"index_name"`
-	TextCol   string `json:"text_col"`
-}
-
-type DataSourceKnowledgeAssistantKnowledgeSourceProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceKnowledgeAssistantKnowledgeSource struct {
-	CreateTime          string                                                     `json:"create_time,omitempty"`
-	Description         string                                                     `json:"description,omitempty"`
-	DisplayName         string                                                     `json:"display_name,omitempty"`
-	FileTable           *DataSourceKnowledgeAssistantKnowledgeSourceFileTable      `json:"file_table,omitempty"`
-	Files               *DataSourceKnowledgeAssistantKnowledgeSourceFiles          `json:"files,omitempty"`
-	Id                  string                                                     `json:"id,omitempty"`
-	Index               *DataSourceKnowledgeAssistantKnowledgeSourceIndex          `json:"index,omitempty"`
-	KnowledgeCutoffTime string                                                     `json:"knowledge_cutoff_time,omitempty"`
-	Name                string                                                     `json:"name"`
-	ProviderConfig      *DataSourceKnowledgeAssistantKnowledgeSourceProviderConfig `json:"provider_config,omitempty"`
-	SourceType          string                                                     `json:"source_type,omitempty"`
-	State               string                                                     `json:"state,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_knowledge_assistant_knowledge_sources.go b/bundle/internal/tf/schema/data_source_knowledge_assistant_knowledge_sources.go
deleted file mode 100644
index d0c059b6238..00000000000
--- a/bundle/internal/tf/schema/data_source_knowledge_assistant_knowledge_sources.go
+++ /dev/null
@@ -1,48 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceKnowledgeAssistantKnowledgeSourcesKnowledgeSourcesFileTable struct {
-	FileCol   string `json:"file_col"`
-	TableName string `json:"table_name"`
-}
-
-type DataSourceKnowledgeAssistantKnowledgeSourcesKnowledgeSourcesFiles struct {
-	Path string `json:"path"`
-}
-
-type DataSourceKnowledgeAssistantKnowledgeSourcesKnowledgeSourcesIndex struct {
-	DocUriCol string `json:"doc_uri_col"`
-	IndexName string `json:"index_name"`
-	TextCol   string `json:"text_col"`
-}
-
-type DataSourceKnowledgeAssistantKnowledgeSourcesKnowledgeSourcesProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceKnowledgeAssistantKnowledgeSourcesKnowledgeSources struct {
-	CreateTime          string                                                                      `json:"create_time,omitempty"`
-	Description         string                                                                      `json:"description,omitempty"`
-	DisplayName         string                                                                      `json:"display_name,omitempty"`
-	FileTable           *DataSourceKnowledgeAssistantKnowledgeSourcesKnowledgeSourcesFileTable      `json:"file_table,omitempty"`
-	Files               *DataSourceKnowledgeAssistantKnowledgeSourcesKnowledgeSourcesFiles          `json:"files,omitempty"`
-	Id                  string                                                                      `json:"id,omitempty"`
-	Index               *DataSourceKnowledgeAssistantKnowledgeSourcesKnowledgeSourcesIndex          `json:"index,omitempty"`
-	KnowledgeCutoffTime string                                                                      `json:"knowledge_cutoff_time,omitempty"`
-	Name                string                                                                      `json:"name"`
-	ProviderConfig      *DataSourceKnowledgeAssistantKnowledgeSourcesKnowledgeSourcesProviderConfig `json:"provider_config,omitempty"`
-	SourceType          string                                                                      `json:"source_type,omitempty"`
-	State               string                                                                      `json:"state,omitempty"`
-}
-
-type DataSourceKnowledgeAssistantKnowledgeSourcesProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceKnowledgeAssistantKnowledgeSources struct {
-	KnowledgeSources []DataSourceKnowledgeAssistantKnowledgeSourcesKnowledgeSources `json:"knowledge_sources,omitempty"`
-	PageSize         int                                                            `json:"page_size,omitempty"`
-	Parent           string                                                         `json:"parent"`
-	ProviderConfig   *DataSourceKnowledgeAssistantKnowledgeSourcesProviderConfig    `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_knowledge_assistants.go b/bundle/internal/tf/schema/data_source_knowledge_assistants.go
deleted file mode 100644
index 4b60da11016..00000000000
--- a/bundle/internal/tf/schema/data_source_knowledge_assistants.go
+++ /dev/null
@@ -1,32 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceKnowledgeAssistantsKnowledgeAssistantsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceKnowledgeAssistantsKnowledgeAssistants struct {
-	CreateTime     string                                                          `json:"create_time,omitempty"`
-	Creator        string                                                          `json:"creator,omitempty"`
-	Description    string                                                          `json:"description,omitempty"`
-	DisplayName    string                                                          `json:"display_name,omitempty"`
-	EndpointName   string                                                          `json:"endpoint_name,omitempty"`
-	ErrorInfo      string                                                          `json:"error_info,omitempty"`
-	ExperimentId   string                                                          `json:"experiment_id,omitempty"`
-	Id             string                                                          `json:"id,omitempty"`
-	Instructions   string                                                          `json:"instructions,omitempty"`
-	Name           string                                                          `json:"name"`
-	ProviderConfig *DataSourceKnowledgeAssistantsKnowledgeAssistantsProviderConfig `json:"provider_config,omitempty"`
-	State          string                                                          `json:"state,omitempty"`
-}
-
-type DataSourceKnowledgeAssistantsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceKnowledgeAssistants struct {
-	KnowledgeAssistants []DataSourceKnowledgeAssistantsKnowledgeAssistants `json:"knowledge_assistants,omitempty"`
-	PageSize            int                                                `json:"page_size,omitempty"`
-	ProviderConfig      *DataSourceKnowledgeAssistantsProviderConfig       `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_materialized_features_feature_tag.go b/bundle/internal/tf/schema/data_source_materialized_features_feature_tag.go
deleted file mode 100644
index a8f427afd56..00000000000
--- a/bundle/internal/tf/schema/data_source_materialized_features_feature_tag.go
+++ /dev/null
@@ -1,13 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceMaterializedFeaturesFeatureTagProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceMaterializedFeaturesFeatureTag struct {
-	Key            string                                                  `json:"key"`
-	ProviderConfig *DataSourceMaterializedFeaturesFeatureTagProviderConfig `json:"provider_config,omitempty"`
-	Value          string                                                  `json:"value,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_materialized_features_feature_tags.go b/bundle/internal/tf/schema/data_source_materialized_features_feature_tags.go
deleted file mode 100644
index c8a8610ec77..00000000000
--- a/bundle/internal/tf/schema/data_source_materialized_features_feature_tags.go
+++ /dev/null
@@ -1,25 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceMaterializedFeaturesFeatureTagsFeatureTagsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceMaterializedFeaturesFeatureTagsFeatureTags struct {
-	Key            string                                                              `json:"key"`
-	ProviderConfig *DataSourceMaterializedFeaturesFeatureTagsFeatureTagsProviderConfig `json:"provider_config,omitempty"`
-	Value          string                                                              `json:"value,omitempty"`
-}
-
-type DataSourceMaterializedFeaturesFeatureTagsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceMaterializedFeaturesFeatureTags struct {
-	FeatureName    string                                                   `json:"feature_name"`
-	FeatureTags    []DataSourceMaterializedFeaturesFeatureTagsFeatureTags   `json:"feature_tags,omitempty"`
-	PageSize       int                                                      `json:"page_size,omitempty"`
-	ProviderConfig *DataSourceMaterializedFeaturesFeatureTagsProviderConfig `json:"provider_config,omitempty"`
-	TableName      string                                                   `json:"table_name"`
-}
diff --git a/bundle/internal/tf/schema/data_source_metastore.go b/bundle/internal/tf/schema/data_source_metastore.go
deleted file mode 100644
index 4244febc692..00000000000
--- a/bundle/internal/tf/schema/data_source_metastore.go
+++ /dev/null
@@ -1,33 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceMetastoreMetastoreInfo struct {
-	Cloud                                       string `json:"cloud,omitempty"`
-	CreatedAt                                   int    `json:"created_at,omitempty"`
-	CreatedBy                                   string `json:"created_by,omitempty"`
-	DefaultDataAccessConfigId                   string `json:"default_data_access_config_id,omitempty"`
-	DeltaSharingOrganizationName                string `json:"delta_sharing_organization_name,omitempty"`
-	DeltaSharingRecipientTokenLifetimeInSeconds int    `json:"delta_sharing_recipient_token_lifetime_in_seconds,omitempty"`
-	DeltaSharingScope                           string `json:"delta_sharing_scope,omitempty"`
-	ExternalAccessEnabled                       bool   `json:"external_access_enabled,omitempty"`
-	GlobalMetastoreId                           string `json:"global_metastore_id,omitempty"`
-	MetastoreId                                 string `json:"metastore_id,omitempty"`
-	Name                                        string `json:"name,omitempty"`
-	Owner                                       string `json:"owner,omitempty"`
-	PrivilegeModelVersion                       string `json:"privilege_model_version,omitempty"`
-	Region                                      string `json:"region,omitempty"`
-	StorageRoot                                 string `json:"storage_root,omitempty"`
-	StorageRootCredentialId                     string `json:"storage_root_credential_id,omitempty"`
-	StorageRootCredentialName                   string `json:"storage_root_credential_name,omitempty"`
-	UpdatedAt                                   int    `json:"updated_at,omitempty"`
-	UpdatedBy                                   string `json:"updated_by,omitempty"`
-}
-
-type DataSourceMetastore struct {
-	Id            string                            `json:"id,omitempty"`
-	MetastoreId   string                            `json:"metastore_id,omitempty"`
-	Name          string                            `json:"name,omitempty"`
-	Region        string                            `json:"region,omitempty"`
-	MetastoreInfo *DataSourceMetastoreMetastoreInfo `json:"metastore_info,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_metastores.go b/bundle/internal/tf/schema/data_source_metastores.go
deleted file mode 100644
index c2b6854ee15..00000000000
--- a/bundle/internal/tf/schema/data_source_metastores.go
+++ /dev/null
@@ -1,8 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceMetastores struct {
-	Id  string            `json:"id,omitempty"`
-	Ids map[string]string `json:"ids,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_mlflow_experiment.go b/bundle/internal/tf/schema/data_source_mlflow_experiment.go
deleted file mode 100644
index 13a070ae16b..00000000000
--- a/bundle/internal/tf/schema/data_source_mlflow_experiment.go
+++ /dev/null
@@ -1,24 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceMlflowExperimentProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceMlflowExperimentTags struct {
-	Key   string `json:"key,omitempty"`
-	Value string `json:"value,omitempty"`
-}
-
-type DataSourceMlflowExperiment struct {
-	ArtifactLocation string                                    `json:"artifact_location,omitempty"`
-	CreationTime     int                                       `json:"creation_time,omitempty"`
-	ExperimentId     string                                    `json:"experiment_id,omitempty"`
-	Id               string                                    `json:"id,omitempty"`
-	LastUpdateTime   int                                       `json:"last_update_time,omitempty"`
-	LifecycleStage   string                                    `json:"lifecycle_stage,omitempty"`
-	Name             string                                    `json:"name,omitempty"`
-	ProviderConfig   *DataSourceMlflowExperimentProviderConfig `json:"provider_config,omitempty"`
-	Tags             []DataSourceMlflowExperimentTags          `json:"tags,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_mlflow_model.go b/bundle/internal/tf/schema/data_source_mlflow_model.go
deleted file mode 100644
index ac150cf955b..00000000000
--- a/bundle/internal/tf/schema/data_source_mlflow_model.go
+++ /dev/null
@@ -1,44 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceMlflowModelLatestVersionsTags struct {
-	Key   string `json:"key,omitempty"`
-	Value string `json:"value,omitempty"`
-}
-
-type DataSourceMlflowModelLatestVersions struct {
-	CreationTimestamp    int                                       `json:"creation_timestamp,omitempty"`
-	CurrentStage         string                                    `json:"current_stage,omitempty"`
-	Description          string                                    `json:"description,omitempty"`
-	LastUpdatedTimestamp int                                       `json:"last_updated_timestamp,omitempty"`
-	Name                 string                                    `json:"name,omitempty"`
-	RunId                string                                    `json:"run_id,omitempty"`
-	RunLink              string                                    `json:"run_link,omitempty"`
-	Source               string                                    `json:"source,omitempty"`
-	Status               string                                    `json:"status,omitempty"`
-	StatusMessage        string                                    `json:"status_message,omitempty"`
-	UserId               string                                    `json:"user_id,omitempty"`
-	Version              string                                    `json:"version,omitempty"`
-	Tags                 []DataSourceMlflowModelLatestVersionsTags `json:"tags,omitempty"`
-}
-
-type DataSourceMlflowModelProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceMlflowModelTags struct {
-	Key   string `json:"key,omitempty"`
-	Value string `json:"value,omitempty"`
-}
-
-type DataSourceMlflowModel struct {
-	Description     string                                `json:"description,omitempty"`
-	Id              string                                `json:"id,omitempty"`
-	Name            string                                `json:"name"`
-	PermissionLevel string                                `json:"permission_level,omitempty"`
-	UserId          string                                `json:"user_id,omitempty"`
-	LatestVersions  []DataSourceMlflowModelLatestVersions `json:"latest_versions,omitempty"`
-	ProviderConfig  *DataSourceMlflowModelProviderConfig  `json:"provider_config,omitempty"`
-	Tags            []DataSourceMlflowModelTags           `json:"tags,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_mlflow_models.go b/bundle/internal/tf/schema/data_source_mlflow_models.go
deleted file mode 100644
index 134c1202e96..00000000000
--- a/bundle/internal/tf/schema/data_source_mlflow_models.go
+++ /dev/null
@@ -1,13 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceMlflowModelsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceMlflowModels struct {
-	Id             string                                `json:"id,omitempty"`
-	Names          []string                              `json:"names,omitempty"`
-	ProviderConfig *DataSourceMlflowModelsProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_mws_credentials.go b/bundle/internal/tf/schema/data_source_mws_credentials.go
deleted file mode 100644
index 45fa3f817c6..00000000000
--- a/bundle/internal/tf/schema/data_source_mws_credentials.go
+++ /dev/null
@@ -1,13 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceMwsCredentialsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceMwsCredentials struct {
-	Id             string                                  `json:"id,omitempty"`
-	Ids            map[string]string                       `json:"ids,omitempty"`
-	ProviderConfig *DataSourceMwsCredentialsProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_mws_network_connectivity_config.go b/bundle/internal/tf/schema/data_source_mws_network_connectivity_config.go
deleted file mode 100644
index 89d8f08c2bc..00000000000
--- a/bundle/internal/tf/schema/data_source_mws_network_connectivity_config.go
+++ /dev/null
@@ -1,71 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceMwsNetworkConnectivityConfigEgressConfigDefaultRulesAwsStableIpRule struct {
-	CidrBlocks []string `json:"cidr_blocks,omitempty"`
-}
-
-type DataSourceMwsNetworkConnectivityConfigEgressConfigDefaultRulesAzureServiceEndpointRule struct {
-	Subnets        []string `json:"subnets,omitempty"`
-	TargetRegion   string   `json:"target_region,omitempty"`
-	TargetServices []string `json:"target_services,omitempty"`
-}
-
-type DataSourceMwsNetworkConnectivityConfigEgressConfigDefaultRules struct {
-	AwsStableIpRule          *DataSourceMwsNetworkConnectivityConfigEgressConfigDefaultRulesAwsStableIpRule          `json:"aws_stable_ip_rule,omitempty"`
-	AzureServiceEndpointRule *DataSourceMwsNetworkConnectivityConfigEgressConfigDefaultRulesAzureServiceEndpointRule `json:"azure_service_endpoint_rule,omitempty"`
-}
-
-type DataSourceMwsNetworkConnectivityConfigEgressConfigTargetRulesAwsPrivateEndpointRules struct {
-	AccountId                   string   `json:"account_id,omitempty"`
-	ConnectionState             string   `json:"connection_state,omitempty"`
-	CreationTime                int      `json:"creation_time,omitempty"`
-	Deactivated                 bool     `json:"deactivated,omitempty"`
-	DeactivatedAt               int      `json:"deactivated_at,omitempty"`
-	DomainNames                 []string `json:"domain_names,omitempty"`
-	Enabled                     bool     `json:"enabled,omitempty"`
-	EndpointService             string   `json:"endpoint_service,omitempty"`
-	ErrorMessage                string   `json:"error_message,omitempty"`
-	NetworkConnectivityConfigId string   `json:"network_connectivity_config_id,omitempty"`
-	ResourceNames               []string `json:"resource_names,omitempty"`
-	RuleId                      string   `json:"rule_id,omitempty"`
-	UpdatedTime                 int      `json:"updated_time,omitempty"`
-	VpcEndpointId               string   `json:"vpc_endpoint_id,omitempty"`
-}
-
-type DataSourceMwsNetworkConnectivityConfigEgressConfigTargetRulesAzurePrivateEndpointRules struct {
-	ConnectionState             string   `json:"connection_state,omitempty"`
-	CreationTime                int      `json:"creation_time,omitempty"`
-	Deactivated                 bool     `json:"deactivated,omitempty"`
-	DeactivatedAt               int      `json:"deactivated_at,omitempty"`
-	DomainNames                 []string `json:"domain_names,omitempty"`
-	EndpointName                string   `json:"endpoint_name,omitempty"`
-	ErrorMessage                string   `json:"error_message,omitempty"`
-	GroupId                     string   `json:"group_id,omitempty"`
-	NetworkConnectivityConfigId string   `json:"network_connectivity_config_id,omitempty"`
-	ResourceId                  string   `json:"resource_id,omitempty"`
-	RuleId                      string   `json:"rule_id,omitempty"`
-	UpdatedTime                 int      `json:"updated_time,omitempty"`
-}
-
-type DataSourceMwsNetworkConnectivityConfigEgressConfigTargetRules struct {
-	AwsPrivateEndpointRules   []DataSourceMwsNetworkConnectivityConfigEgressConfigTargetRulesAwsPrivateEndpointRules   `json:"aws_private_endpoint_rules,omitempty"`
-	AzurePrivateEndpointRules []DataSourceMwsNetworkConnectivityConfigEgressConfigTargetRulesAzurePrivateEndpointRules `json:"azure_private_endpoint_rules,omitempty"`
-}
-
-type DataSourceMwsNetworkConnectivityConfigEgressConfig struct {
-	DefaultRules *DataSourceMwsNetworkConnectivityConfigEgressConfigDefaultRules `json:"default_rules,omitempty"`
-	TargetRules  *DataSourceMwsNetworkConnectivityConfigEgressConfigTargetRules  `json:"target_rules,omitempty"`
-}
-
-type DataSourceMwsNetworkConnectivityConfig struct {
-	AccountId                   string                                              `json:"account_id,omitempty"`
-	CreationTime                int                                                 `json:"creation_time,omitempty"`
-	Id                          string                                              `json:"id,omitempty"`
-	Name                        string                                              `json:"name"`
-	NetworkConnectivityConfigId string                                              `json:"network_connectivity_config_id,omitempty"`
-	Region                      string                                              `json:"region,omitempty"`
-	UpdatedTime                 int                                                 `json:"updated_time,omitempty"`
-	EgressConfig                *DataSourceMwsNetworkConnectivityConfigEgressConfig `json:"egress_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_mws_network_connectivity_configs.go b/bundle/internal/tf/schema/data_source_mws_network_connectivity_configs.go
deleted file mode 100644
index 721483a9ea8..00000000000
--- a/bundle/internal/tf/schema/data_source_mws_network_connectivity_configs.go
+++ /dev/null
@@ -1,9 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceMwsNetworkConnectivityConfigs struct {
-	Id     string   `json:"id,omitempty"`
-	Names  []string `json:"names,omitempty"`
-	Region string   `json:"region,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_mws_workspaces.go b/bundle/internal/tf/schema/data_source_mws_workspaces.go
deleted file mode 100644
index 019a2d3eef4..00000000000
--- a/bundle/internal/tf/schema/data_source_mws_workspaces.go
+++ /dev/null
@@ -1,13 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceMwsWorkspacesProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceMwsWorkspaces struct {
-	Id             string                                 `json:"id,omitempty"`
-	Ids            map[string]int                         `json:"ids,omitempty"`
-	ProviderConfig *DataSourceMwsWorkspacesProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_node_type.go b/bundle/internal/tf/schema/data_source_node_type.go
deleted file mode 100644
index 9393f2b3dbc..00000000000
--- a/bundle/internal/tf/schema/data_source_node_type.go
+++ /dev/null
@@ -1,26 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceNodeTypeProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceNodeType struct {
-	Arm                   bool                              `json:"arm,omitempty"`
-	Category              string                            `json:"category,omitempty"`
-	Fleet                 bool                              `json:"fleet,omitempty"`
-	GbPerCore             int                               `json:"gb_per_core,omitempty"`
-	Graviton              bool                              `json:"graviton,omitempty"`
-	Id                    string                            `json:"id,omitempty"`
-	IsIoCacheEnabled      bool                              `json:"is_io_cache_enabled,omitempty"`
-	LocalDisk             bool                              `json:"local_disk,omitempty"`
-	LocalDiskMinSize      int                               `json:"local_disk_min_size,omitempty"`
-	MinCores              int                               `json:"min_cores,omitempty"`
-	MinGpus               int                               `json:"min_gpus,omitempty"`
-	MinMemoryGb           int                               `json:"min_memory_gb,omitempty"`
-	PhotonDriverCapable   bool                              `json:"photon_driver_capable,omitempty"`
-	PhotonWorkerCapable   bool                              `json:"photon_worker_capable,omitempty"`
-	SupportPortForwarding bool                              `json:"support_port_forwarding,omitempty"`
-	ProviderConfig        *DataSourceNodeTypeProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_notebook.go b/bundle/internal/tf/schema/data_source_notebook.go
deleted file mode 100644
index d43338efdec..00000000000
--- a/bundle/internal/tf/schema/data_source_notebook.go
+++ /dev/null
@@ -1,19 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceNotebookProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceNotebook struct {
-	Content        string                            `json:"content,omitempty"`
-	Format         string                            `json:"format"`
-	Id             string                            `json:"id,omitempty"`
-	Language       string                            `json:"language,omitempty"`
-	ObjectId       int                               `json:"object_id,omitempty"`
-	ObjectType     string                            `json:"object_type,omitempty"`
-	Path           string                            `json:"path"`
-	WorkspacePath  string                            `json:"workspace_path,omitempty"`
-	ProviderConfig *DataSourceNotebookProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_notebook_paths.go b/bundle/internal/tf/schema/data_source_notebook_paths.go
deleted file mode 100644
index 871a30812f5..00000000000
--- a/bundle/internal/tf/schema/data_source_notebook_paths.go
+++ /dev/null
@@ -1,15 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceNotebookPathsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceNotebookPaths struct {
-	Id               string                                 `json:"id,omitempty"`
-	NotebookPathList []any                                  `json:"notebook_path_list,omitempty"`
-	Path             string                                 `json:"path"`
-	Recursive        bool                                   `json:"recursive"`
-	ProviderConfig   *DataSourceNotebookPathsProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_notification_destinations.go b/bundle/internal/tf/schema/data_source_notification_destinations.go
deleted file mode 100644
index be66cc9a910..00000000000
--- a/bundle/internal/tf/schema/data_source_notification_destinations.go
+++ /dev/null
@@ -1,20 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceNotificationDestinationsNotificationDestinations struct {
-	DestinationType string `json:"destination_type,omitempty"`
-	DisplayName     string `json:"display_name,omitempty"`
-	Id              string `json:"id,omitempty"`
-}
-
-type DataSourceNotificationDestinationsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceNotificationDestinations struct {
-	DisplayNameContains      string                                                       `json:"display_name_contains,omitempty"`
-	NotificationDestinations []DataSourceNotificationDestinationsNotificationDestinations `json:"notification_destinations,omitempty"`
-	ProviderConfig           *DataSourceNotificationDestinationsProviderConfig            `json:"provider_config,omitempty"`
-	Type                     string                                                       `json:"type,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_online_store.go b/bundle/internal/tf/schema/data_source_online_store.go
deleted file mode 100644
index 4c1f3823f3b..00000000000
--- a/bundle/internal/tf/schema/data_source_online_store.go
+++ /dev/null
@@ -1,18 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceOnlineStoreProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceOnlineStore struct {
-	Capacity         string                               `json:"capacity,omitempty"`
-	CreationTime     string                               `json:"creation_time,omitempty"`
-	Creator          string                               `json:"creator,omitempty"`
-	Name             string                               `json:"name"`
-	ProviderConfig   *DataSourceOnlineStoreProviderConfig `json:"provider_config,omitempty"`
-	ReadReplicaCount int                                  `json:"read_replica_count,omitempty"`
-	State            string                               `json:"state,omitempty"`
-	UsagePolicyId    string                               `json:"usage_policy_id,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_online_stores.go b/bundle/internal/tf/schema/data_source_online_stores.go
deleted file mode 100644
index 3d33fabb4b0..00000000000
--- a/bundle/internal/tf/schema/data_source_online_stores.go
+++ /dev/null
@@ -1,28 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceOnlineStoresOnlineStoresProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceOnlineStoresOnlineStores struct {
-	Capacity         string                                            `json:"capacity,omitempty"`
-	CreationTime     string                                            `json:"creation_time,omitempty"`
-	Creator          string                                            `json:"creator,omitempty"`
-	Name             string                                            `json:"name"`
-	ProviderConfig   *DataSourceOnlineStoresOnlineStoresProviderConfig `json:"provider_config,omitempty"`
-	ReadReplicaCount int                                               `json:"read_replica_count,omitempty"`
-	State            string                                            `json:"state,omitempty"`
-	UsagePolicyId    string                                            `json:"usage_policy_id,omitempty"`
-}
-
-type DataSourceOnlineStoresProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceOnlineStores struct {
-	OnlineStores   []DataSourceOnlineStoresOnlineStores  `json:"online_stores,omitempty"`
-	PageSize       int                                   `json:"page_size,omitempty"`
-	ProviderConfig *DataSourceOnlineStoresProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_pipelines.go b/bundle/internal/tf/schema/data_source_pipelines.go
deleted file mode 100644
index bbd44a0b871..00000000000
--- a/bundle/internal/tf/schema/data_source_pipelines.go
+++ /dev/null
@@ -1,14 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourcePipelinesProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourcePipelines struct {
-	Id             string                             `json:"id,omitempty"`
-	Ids            []string                           `json:"ids,omitempty"`
-	PipelineName   string                             `json:"pipeline_name,omitempty"`
-	ProviderConfig *DataSourcePipelinesProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_policy_info.go b/bundle/internal/tf/schema/data_source_policy_info.go
deleted file mode 100644
index 8f901f3d392..00000000000
--- a/bundle/internal/tf/schema/data_source_policy_info.go
+++ /dev/null
@@ -1,54 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourcePolicyInfoColumnMaskUsing struct {
-	Alias    string `json:"alias,omitempty"`
-	Constant string `json:"constant,omitempty"`
-}
-
-type DataSourcePolicyInfoColumnMask struct {
-	FunctionName string                                `json:"function_name"`
-	OnColumn     string                                `json:"on_column"`
-	Using        []DataSourcePolicyInfoColumnMaskUsing `json:"using,omitempty"`
-}
-
-type DataSourcePolicyInfoMatchColumns struct {
-	Alias     string `json:"alias,omitempty"`
-	Condition string `json:"condition,omitempty"`
-}
-
-type DataSourcePolicyInfoProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourcePolicyInfoRowFilterUsing struct {
-	Alias    string `json:"alias,omitempty"`
-	Constant string `json:"constant,omitempty"`
-}
-
-type DataSourcePolicyInfoRowFilter struct {
-	FunctionName string                               `json:"function_name"`
-	Using        []DataSourcePolicyInfoRowFilterUsing `json:"using,omitempty"`
-}
-
-type DataSourcePolicyInfo struct {
-	ColumnMask          *DataSourcePolicyInfoColumnMask     `json:"column_mask,omitempty"`
-	Comment             string                              `json:"comment,omitempty"`
-	CreatedAt           int                                 `json:"created_at,omitempty"`
-	CreatedBy           string                              `json:"created_by,omitempty"`
-	ExceptPrincipals    []string                            `json:"except_principals,omitempty"`
-	ForSecurableType    string                              `json:"for_securable_type,omitempty"`
-	Id                  string                              `json:"id,omitempty"`
-	MatchColumns        []DataSourcePolicyInfoMatchColumns  `json:"match_columns,omitempty"`
-	Name                string                              `json:"name"`
-	OnSecurableFullname string                              `json:"on_securable_fullname"`
-	OnSecurableType     string                              `json:"on_securable_type"`
-	PolicyType          string                              `json:"policy_type,omitempty"`
-	ProviderConfig      *DataSourcePolicyInfoProviderConfig `json:"provider_config,omitempty"`
-	RowFilter           *DataSourcePolicyInfoRowFilter      `json:"row_filter,omitempty"`
-	ToPrincipals        []string                            `json:"to_principals,omitempty"`
-	UpdatedAt           int                                 `json:"updated_at,omitempty"`
-	UpdatedBy           string                              `json:"updated_by,omitempty"`
-	WhenCondition       string                              `json:"when_condition,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_policy_infos.go b/bundle/internal/tf/schema/data_source_policy_infos.go
deleted file mode 100644
index 0f82648ff5f..00000000000
--- a/bundle/internal/tf/schema/data_source_policy_infos.go
+++ /dev/null
@@ -1,67 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourcePolicyInfosPoliciesColumnMaskUsing struct {
-	Alias    string `json:"alias,omitempty"`
-	Constant string `json:"constant,omitempty"`
-}
-
-type DataSourcePolicyInfosPoliciesColumnMask struct {
-	FunctionName string                                         `json:"function_name"`
-	OnColumn     string                                         `json:"on_column"`
-	Using        []DataSourcePolicyInfosPoliciesColumnMaskUsing `json:"using,omitempty"`
-}
-
-type DataSourcePolicyInfosPoliciesMatchColumns struct {
-	Alias     string `json:"alias,omitempty"`
-	Condition string `json:"condition,omitempty"`
-}
-
-type DataSourcePolicyInfosPoliciesProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourcePolicyInfosPoliciesRowFilterUsing struct {
-	Alias    string `json:"alias,omitempty"`
-	Constant string `json:"constant,omitempty"`
-}
-
-type DataSourcePolicyInfosPoliciesRowFilter struct {
-	FunctionName string                                        `json:"function_name"`
-	Using        []DataSourcePolicyInfosPoliciesRowFilterUsing `json:"using,omitempty"`
-}
-
-type DataSourcePolicyInfosPolicies struct {
-	ColumnMask          *DataSourcePolicyInfosPoliciesColumnMask     `json:"column_mask,omitempty"`
-	Comment             string                                       `json:"comment,omitempty"`
-	CreatedAt           int                                          `json:"created_at,omitempty"`
-	CreatedBy           string                                       `json:"created_by,omitempty"`
-	ExceptPrincipals    []string                                     `json:"except_principals,omitempty"`
-	ForSecurableType    string                                       `json:"for_securable_type,omitempty"`
-	Id                  string                                       `json:"id,omitempty"`
-	MatchColumns        []DataSourcePolicyInfosPoliciesMatchColumns  `json:"match_columns,omitempty"`
-	Name                string                                       `json:"name"`
-	OnSecurableFullname string                                       `json:"on_securable_fullname"`
-	OnSecurableType     string                                       `json:"on_securable_type"`
-	PolicyType          string                                       `json:"policy_type,omitempty"`
-	ProviderConfig      *DataSourcePolicyInfosPoliciesProviderConfig `json:"provider_config,omitempty"`
-	RowFilter           *DataSourcePolicyInfosPoliciesRowFilter      `json:"row_filter,omitempty"`
-	ToPrincipals        []string                                     `json:"to_principals,omitempty"`
-	UpdatedAt           int                                          `json:"updated_at,omitempty"`
-	UpdatedBy           string                                       `json:"updated_by,omitempty"`
-	WhenCondition       string                                       `json:"when_condition,omitempty"`
-}
-
-type DataSourcePolicyInfosProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourcePolicyInfos struct {
-	IncludeInherited    bool                                 `json:"include_inherited,omitempty"`
-	MaxResults          int                                  `json:"max_results,omitempty"`
-	OnSecurableFullname string                               `json:"on_securable_fullname"`
-	OnSecurableType     string                               `json:"on_securable_type"`
-	Policies            []DataSourcePolicyInfosPolicies      `json:"policies,omitempty"`
-	ProviderConfig      *DataSourcePolicyInfosProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_postgres_branch.go b/bundle/internal/tf/schema/data_source_postgres_branch.go
deleted file mode 100644
index bbefd60f441..00000000000
--- a/bundle/internal/tf/schema/data_source_postgres_branch.go
+++ /dev/null
@@ -1,41 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourcePostgresBranchProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourcePostgresBranchSpec struct {
-	ExpireTime       string `json:"expire_time,omitempty"`
-	IsProtected      bool   `json:"is_protected,omitempty"`
-	NoExpiry         bool   `json:"no_expiry,omitempty"`
-	SourceBranch     string `json:"source_branch,omitempty"`
-	SourceBranchLsn  string `json:"source_branch_lsn,omitempty"`
-	SourceBranchTime string `json:"source_branch_time,omitempty"`
-	Ttl              string `json:"ttl,omitempty"`
-}
-
-type DataSourcePostgresBranchStatus struct {
-	CurrentState     string `json:"current_state,omitempty"`
-	Default          bool   `json:"default,omitempty"`
-	ExpireTime       string `json:"expire_time,omitempty"`
-	IsProtected      bool   `json:"is_protected,omitempty"`
-	LogicalSizeBytes int    `json:"logical_size_bytes,omitempty"`
-	PendingState     string `json:"pending_state,omitempty"`
-	SourceBranch     string `json:"source_branch,omitempty"`
-	SourceBranchLsn  string `json:"source_branch_lsn,omitempty"`
-	SourceBranchTime string `json:"source_branch_time,omitempty"`
-	StateChangeTime  string `json:"state_change_time,omitempty"`
-}
-
-type DataSourcePostgresBranch struct {
-	CreateTime     string                                  `json:"create_time,omitempty"`
-	Name           string                                  `json:"name"`
-	Parent         string                                  `json:"parent,omitempty"`
-	ProviderConfig *DataSourcePostgresBranchProviderConfig `json:"provider_config,omitempty"`
-	Spec           *DataSourcePostgresBranchSpec           `json:"spec,omitempty"`
-	Status         *DataSourcePostgresBranchStatus         `json:"status,omitempty"`
-	Uid            string                                  `json:"uid,omitempty"`
-	UpdateTime     string                                  `json:"update_time,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_postgres_branches.go b/bundle/internal/tf/schema/data_source_postgres_branches.go
deleted file mode 100644
index b7dd730bdcc..00000000000
--- a/bundle/internal/tf/schema/data_source_postgres_branches.go
+++ /dev/null
@@ -1,52 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourcePostgresBranchesBranchesProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourcePostgresBranchesBranchesSpec struct {
-	ExpireTime       string `json:"expire_time,omitempty"`
-	IsProtected      bool   `json:"is_protected,omitempty"`
-	NoExpiry         bool   `json:"no_expiry,omitempty"`
-	SourceBranch     string `json:"source_branch,omitempty"`
-	SourceBranchLsn  string `json:"source_branch_lsn,omitempty"`
-	SourceBranchTime string `json:"source_branch_time,omitempty"`
-	Ttl              string `json:"ttl,omitempty"`
-}
-
-type DataSourcePostgresBranchesBranchesStatus struct {
-	CurrentState     string `json:"current_state,omitempty"`
-	Default          bool   `json:"default,omitempty"`
-	ExpireTime       string `json:"expire_time,omitempty"`
-	IsProtected      bool   `json:"is_protected,omitempty"`
-	LogicalSizeBytes int    `json:"logical_size_bytes,omitempty"`
-	PendingState     string `json:"pending_state,omitempty"`
-	SourceBranch     string `json:"source_branch,omitempty"`
-	SourceBranchLsn  string `json:"source_branch_lsn,omitempty"`
-	SourceBranchTime string `json:"source_branch_time,omitempty"`
-	StateChangeTime  string `json:"state_change_time,omitempty"`
-}
-
-type DataSourcePostgresBranchesBranches struct {
-	CreateTime     string                                            `json:"create_time,omitempty"`
-	Name           string                                            `json:"name"`
-	Parent         string                                            `json:"parent,omitempty"`
-	ProviderConfig *DataSourcePostgresBranchesBranchesProviderConfig `json:"provider_config,omitempty"`
-	Spec           *DataSourcePostgresBranchesBranchesSpec           `json:"spec,omitempty"`
-	Status         *DataSourcePostgresBranchesBranchesStatus         `json:"status,omitempty"`
-	Uid            string                                            `json:"uid,omitempty"`
-	UpdateTime     string                                            `json:"update_time,omitempty"`
-}
-
-type DataSourcePostgresBranchesProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourcePostgresBranches struct {
-	Branches       []DataSourcePostgresBranchesBranches      `json:"branches,omitempty"`
-	PageSize       int                                       `json:"page_size,omitempty"`
-	Parent         string                                    `json:"parent"`
-	ProviderConfig *DataSourcePostgresBranchesProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_postgres_catalog.go b/bundle/internal/tf/schema/data_source_postgres_catalog.go
deleted file mode 100644
index 1a7df9c533f..00000000000
--- a/bundle/internal/tf/schema/data_source_postgres_catalog.go
+++ /dev/null
@@ -1,29 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourcePostgresCatalogProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourcePostgresCatalogSpec struct {
-	Branch                  string `json:"branch,omitempty"`
-	CreateDatabaseIfMissing bool   `json:"create_database_if_missing,omitempty"`
-	PostgresDatabase        string `json:"postgres_database"`
-}
-
-type DataSourcePostgresCatalogStatus struct {
-	Branch           string `json:"branch,omitempty"`
-	PostgresDatabase string `json:"postgres_database,omitempty"`
-	Project          string `json:"project,omitempty"`
-}
-
-type DataSourcePostgresCatalog struct {
-	CreateTime     string                                   `json:"create_time,omitempty"`
-	Name           string                                   `json:"name"`
-	ProviderConfig *DataSourcePostgresCatalogProviderConfig `json:"provider_config,omitempty"`
-	Spec           *DataSourcePostgresCatalogSpec           `json:"spec,omitempty"`
-	Status         *DataSourcePostgresCatalogStatus         `json:"status,omitempty"`
-	Uid            string                                   `json:"uid,omitempty"`
-	UpdateTime     string                                   `json:"update_time,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_postgres_database.go b/bundle/internal/tf/schema/data_source_postgres_database.go
deleted file mode 100644
index 230d7a4d2e0..00000000000
--- a/bundle/internal/tf/schema/data_source_postgres_database.go
+++ /dev/null
@@ -1,27 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourcePostgresDatabaseProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourcePostgresDatabaseSpec struct {
-	PostgresDatabase string `json:"postgres_database,omitempty"`
-	Role             string `json:"role,omitempty"`
-}
-
-type DataSourcePostgresDatabaseStatus struct {
-	PostgresDatabase string `json:"postgres_database,omitempty"`
-	Role             string `json:"role,omitempty"`
-}
-
-type DataSourcePostgresDatabase struct {
-	CreateTime     string                                    `json:"create_time,omitempty"`
-	Name           string                                    `json:"name"`
-	Parent         string                                    `json:"parent,omitempty"`
-	ProviderConfig *DataSourcePostgresDatabaseProviderConfig `json:"provider_config,omitempty"`
-	Spec           *DataSourcePostgresDatabaseSpec           `json:"spec,omitempty"`
-	Status         *DataSourcePostgresDatabaseStatus         `json:"status,omitempty"`
-	UpdateTime     string                                    `json:"update_time,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_postgres_databases.go b/bundle/internal/tf/schema/data_source_postgres_databases.go
deleted file mode 100644
index 6b6d144973b..00000000000
--- a/bundle/internal/tf/schema/data_source_postgres_databases.go
+++ /dev/null
@@ -1,38 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourcePostgresDatabasesDatabasesProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourcePostgresDatabasesDatabasesSpec struct {
-	PostgresDatabase string `json:"postgres_database,omitempty"`
-	Role             string `json:"role,omitempty"`
-}
-
-type DataSourcePostgresDatabasesDatabasesStatus struct {
-	PostgresDatabase string `json:"postgres_database,omitempty"`
-	Role             string `json:"role,omitempty"`
-}
-
-type DataSourcePostgresDatabasesDatabases struct {
-	CreateTime     string                                              `json:"create_time,omitempty"`
-	Name           string                                              `json:"name"`
-	Parent         string                                              `json:"parent,omitempty"`
-	ProviderConfig *DataSourcePostgresDatabasesDatabasesProviderConfig `json:"provider_config,omitempty"`
-	Spec           *DataSourcePostgresDatabasesDatabasesSpec           `json:"spec,omitempty"`
-	Status         *DataSourcePostgresDatabasesDatabasesStatus         `json:"status,omitempty"`
-	UpdateTime     string                                              `json:"update_time,omitempty"`
-}
-
-type DataSourcePostgresDatabasesProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourcePostgresDatabases struct {
-	Databases      []DataSourcePostgresDatabasesDatabases     `json:"databases,omitempty"`
-	PageSize       int                                        `json:"page_size,omitempty"`
-	Parent         string                                     `json:"parent"`
-	ProviderConfig *DataSourcePostgresDatabasesProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_postgres_endpoint.go b/bundle/internal/tf/schema/data_source_postgres_endpoint.go
deleted file mode 100644
index c3b3f9005ea..00000000000
--- a/bundle/internal/tf/schema/data_source_postgres_endpoint.go
+++ /dev/null
@@ -1,67 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourcePostgresEndpointProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourcePostgresEndpointSpecGroup struct {
-	EnableReadableSecondaries bool `json:"enable_readable_secondaries,omitempty"`
-	Max                       int  `json:"max"`
-	Min                       int  `json:"min"`
-}
-
-type DataSourcePostgresEndpointSpecSettings struct {
-	PgSettings map[string]string `json:"pg_settings,omitempty"`
-}
-
-type DataSourcePostgresEndpointSpec struct {
-	AutoscalingLimitMaxCu  float64                                 `json:"autoscaling_limit_max_cu,omitempty"`
-	AutoscalingLimitMinCu  float64                                 `json:"autoscaling_limit_min_cu,omitempty"`
-	Disabled               bool                                    `json:"disabled,omitempty"`
-	EndpointType           string                                  `json:"endpoint_type"`
-	Group                  *DataSourcePostgresEndpointSpecGroup    `json:"group,omitempty"`
-	NoSuspension           bool                                    `json:"no_suspension,omitempty"`
-	Settings               *DataSourcePostgresEndpointSpecSettings `json:"settings,omitempty"`
-	SuspendTimeoutDuration string                                  `json:"suspend_timeout_duration,omitempty"`
-}
-
-type DataSourcePostgresEndpointStatusGroup struct {
-	EnableReadableSecondaries bool `json:"enable_readable_secondaries,omitempty"`
-	Max                       int  `json:"max"`
-	Min                       int  `json:"min"`
-}
-
-type DataSourcePostgresEndpointStatusHosts struct {
-	Host         string `json:"host,omitempty"`
-	ReadOnlyHost string `json:"read_only_host,omitempty"`
-}
-
-type DataSourcePostgresEndpointStatusSettings struct {
-	PgSettings map[string]string `json:"pg_settings,omitempty"`
-}
-
-type DataSourcePostgresEndpointStatus struct {
-	AutoscalingLimitMaxCu  float64                                   `json:"autoscaling_limit_max_cu,omitempty"`
-	AutoscalingLimitMinCu  float64                                   `json:"autoscaling_limit_min_cu,omitempty"`
-	CurrentState           string                                    `json:"current_state,omitempty"`
-	Disabled               bool                                      `json:"disabled,omitempty"`
-	EndpointType           string                                    `json:"endpoint_type,omitempty"`
-	Group                  *DataSourcePostgresEndpointStatusGroup    `json:"group,omitempty"`
-	Hosts                  *DataSourcePostgresEndpointStatusHosts    `json:"hosts,omitempty"`
-	PendingState           string                                    `json:"pending_state,omitempty"`
-	Settings               *DataSourcePostgresEndpointStatusSettings `json:"settings,omitempty"`
-	SuspendTimeoutDuration string                                    `json:"suspend_timeout_duration,omitempty"`
-}
-
-type DataSourcePostgresEndpoint struct {
-	CreateTime     string                                    `json:"create_time,omitempty"`
-	Name           string                                    `json:"name"`
-	Parent         string                                    `json:"parent,omitempty"`
-	ProviderConfig *DataSourcePostgresEndpointProviderConfig `json:"provider_config,omitempty"`
-	Spec           *DataSourcePostgresEndpointSpec           `json:"spec,omitempty"`
-	Status         *DataSourcePostgresEndpointStatus         `json:"status,omitempty"`
-	Uid            string                                    `json:"uid,omitempty"`
-	UpdateTime     string                                    `json:"update_time,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_postgres_endpoints.go b/bundle/internal/tf/schema/data_source_postgres_endpoints.go
deleted file mode 100644
index 92384ca6adc..00000000000
--- a/bundle/internal/tf/schema/data_source_postgres_endpoints.go
+++ /dev/null
@@ -1,78 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourcePostgresEndpointsEndpointsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourcePostgresEndpointsEndpointsSpecGroup struct {
-	EnableReadableSecondaries bool `json:"enable_readable_secondaries,omitempty"`
-	Max                       int  `json:"max"`
-	Min                       int  `json:"min"`
-}
-
-type DataSourcePostgresEndpointsEndpointsSpecSettings struct {
-	PgSettings map[string]string `json:"pg_settings,omitempty"`
-}
-
-type DataSourcePostgresEndpointsEndpointsSpec struct {
-	AutoscalingLimitMaxCu  float64                                           `json:"autoscaling_limit_max_cu,omitempty"`
-	AutoscalingLimitMinCu  float64                                           `json:"autoscaling_limit_min_cu,omitempty"`
-	Disabled               bool                                              `json:"disabled,omitempty"`
-	EndpointType           string                                            `json:"endpoint_type"`
-	Group                  *DataSourcePostgresEndpointsEndpointsSpecGroup    `json:"group,omitempty"`
-	NoSuspension           bool                                              `json:"no_suspension,omitempty"`
-	Settings               *DataSourcePostgresEndpointsEndpointsSpecSettings `json:"settings,omitempty"`
-	SuspendTimeoutDuration string                                            `json:"suspend_timeout_duration,omitempty"`
-}
-
-type DataSourcePostgresEndpointsEndpointsStatusGroup struct {
-	EnableReadableSecondaries bool `json:"enable_readable_secondaries,omitempty"`
-	Max                       int  `json:"max"`
-	Min                       int  `json:"min"`
-}
-
-type DataSourcePostgresEndpointsEndpointsStatusHosts struct {
-	Host         string `json:"host,omitempty"`
-	ReadOnlyHost string `json:"read_only_host,omitempty"`
-}
-
-type DataSourcePostgresEndpointsEndpointsStatusSettings struct {
-	PgSettings map[string]string `json:"pg_settings,omitempty"`
-}
-
-type DataSourcePostgresEndpointsEndpointsStatus struct {
-	AutoscalingLimitMaxCu  float64                                             `json:"autoscaling_limit_max_cu,omitempty"`
-	AutoscalingLimitMinCu  float64                                             `json:"autoscaling_limit_min_cu,omitempty"`
-	CurrentState           string                                              `json:"current_state,omitempty"`
-	Disabled               bool                                                `json:"disabled,omitempty"`
-	EndpointType           string                                              `json:"endpoint_type,omitempty"`
-	Group                  *DataSourcePostgresEndpointsEndpointsStatusGroup    `json:"group,omitempty"`
-	Hosts                  *DataSourcePostgresEndpointsEndpointsStatusHosts    `json:"hosts,omitempty"`
-	PendingState           string                                              `json:"pending_state,omitempty"`
-	Settings               *DataSourcePostgresEndpointsEndpointsStatusSettings `json:"settings,omitempty"`
-	SuspendTimeoutDuration string                                              `json:"suspend_timeout_duration,omitempty"`
-}
-
-type DataSourcePostgresEndpointsEndpoints struct {
-	CreateTime     string                                              `json:"create_time,omitempty"`
-	Name           string                                              `json:"name"`
-	Parent         string                                              `json:"parent,omitempty"`
-	ProviderConfig *DataSourcePostgresEndpointsEndpointsProviderConfig `json:"provider_config,omitempty"`
-	Spec           *DataSourcePostgresEndpointsEndpointsSpec           `json:"spec,omitempty"`
-	Status         *DataSourcePostgresEndpointsEndpointsStatus         `json:"status,omitempty"`
-	Uid            string                                              `json:"uid,omitempty"`
-	UpdateTime     string                                              `json:"update_time,omitempty"`
-}
-
-type DataSourcePostgresEndpointsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourcePostgresEndpoints struct {
-	Endpoints      []DataSourcePostgresEndpointsEndpoints     `json:"endpoints,omitempty"`
-	PageSize       int                                        `json:"page_size,omitempty"`
-	Parent         string                                     `json:"parent"`
-	ProviderConfig *DataSourcePostgresEndpointsProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_postgres_project.go b/bundle/internal/tf/schema/data_source_postgres_project.go
deleted file mode 100644
index 8a9c3ccc69e..00000000000
--- a/bundle/internal/tf/schema/data_source_postgres_project.go
+++ /dev/null
@@ -1,79 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourcePostgresProjectInitialEndpointSpecGroup struct {
-	EnableReadableSecondaries bool `json:"enable_readable_secondaries,omitempty"`
-	Max                       int  `json:"max"`
-	Min                       int  `json:"min"`
-}
-
-type DataSourcePostgresProjectInitialEndpointSpec struct {
-	Group *DataSourcePostgresProjectInitialEndpointSpecGroup `json:"group,omitempty"`
-}
-
-type DataSourcePostgresProjectProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourcePostgresProjectSpecCustomTags struct {
-	Key   string `json:"key,omitempty"`
-	Value string `json:"value,omitempty"`
-}
-
-type DataSourcePostgresProjectSpecDefaultEndpointSettings struct {
-	AutoscalingLimitMaxCu  float64           `json:"autoscaling_limit_max_cu,omitempty"`
-	AutoscalingLimitMinCu  float64           `json:"autoscaling_limit_min_cu,omitempty"`
-	NoSuspension           bool              `json:"no_suspension,omitempty"`
-	PgSettings             map[string]string `json:"pg_settings,omitempty"`
-	SuspendTimeoutDuration string            `json:"suspend_timeout_duration,omitempty"`
-}
-
-type DataSourcePostgresProjectSpec struct {
-	BudgetPolicyId           string                                                `json:"budget_policy_id,omitempty"`
-	CustomTags               []DataSourcePostgresProjectSpecCustomTags             `json:"custom_tags,omitempty"`
-	DefaultBranch            string                                                `json:"default_branch,omitempty"`
-	DefaultEndpointSettings  *DataSourcePostgresProjectSpecDefaultEndpointSettings `json:"default_endpoint_settings,omitempty"`
-	DisplayName              string                                                `json:"display_name,omitempty"`
-	EnablePgNativeLogin      bool                                                  `json:"enable_pg_native_login,omitempty"`
-	HistoryRetentionDuration string                                                `json:"history_retention_duration,omitempty"`
-	PgVersion                int                                                   `json:"pg_version,omitempty"`
-}
-
-type DataSourcePostgresProjectStatusCustomTags struct {
-	Key   string `json:"key,omitempty"`
-	Value string `json:"value,omitempty"`
-}
-
-type DataSourcePostgresProjectStatusDefaultEndpointSettings struct {
-	AutoscalingLimitMaxCu  float64           `json:"autoscaling_limit_max_cu,omitempty"`
-	AutoscalingLimitMinCu  float64           `json:"autoscaling_limit_min_cu,omitempty"`
-	NoSuspension           bool              `json:"no_suspension,omitempty"`
-	PgSettings             map[string]string `json:"pg_settings,omitempty"`
-	SuspendTimeoutDuration string            `json:"suspend_timeout_duration,omitempty"`
-}
-
-type DataSourcePostgresProjectStatus struct {
-	BranchLogicalSizeLimitBytes int                                                     `json:"branch_logical_size_limit_bytes,omitempty"`
-	BudgetPolicyId              string                                                  `json:"budget_policy_id,omitempty"`
-	CustomTags                  []DataSourcePostgresProjectStatusCustomTags             `json:"custom_tags,omitempty"`
-	DefaultBranch               string                                                  `json:"default_branch,omitempty"`
-	DefaultEndpointSettings     *DataSourcePostgresProjectStatusDefaultEndpointSettings `json:"default_endpoint_settings,omitempty"`
-	DisplayName                 string                                                  `json:"display_name,omitempty"`
-	EnablePgNativeLogin         bool                                                    `json:"enable_pg_native_login,omitempty"`
-	HistoryRetentionDuration    string                                                  `json:"history_retention_duration,omitempty"`
-	Owner                       string                                                  `json:"owner,omitempty"`
-	PgVersion                   int                                                     `json:"pg_version,omitempty"`
-	SyntheticStorageSizeBytes   int                                                     `json:"synthetic_storage_size_bytes,omitempty"`
-}
-
-type DataSourcePostgresProject struct {
-	CreateTime          string                                        `json:"create_time,omitempty"`
-	InitialEndpointSpec *DataSourcePostgresProjectInitialEndpointSpec `json:"initial_endpoint_spec,omitempty"`
-	Name                string                                        `json:"name"`
-	ProviderConfig      *DataSourcePostgresProjectProviderConfig      `json:"provider_config,omitempty"`
-	Spec                *DataSourcePostgresProjectSpec                `json:"spec,omitempty"`
-	Status              *DataSourcePostgresProjectStatus              `json:"status,omitempty"`
-	Uid                 string                                        `json:"uid,omitempty"`
-	UpdateTime          string                                        `json:"update_time,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_postgres_projects.go b/bundle/internal/tf/schema/data_source_postgres_projects.go
deleted file mode 100644
index ca5aa51cf85..00000000000
--- a/bundle/internal/tf/schema/data_source_postgres_projects.go
+++ /dev/null
@@ -1,89 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourcePostgresProjectsProjectsInitialEndpointSpecGroup struct {
-	EnableReadableSecondaries bool `json:"enable_readable_secondaries,omitempty"`
-	Max                       int  `json:"max"`
-	Min                       int  `json:"min"`
-}
-
-type DataSourcePostgresProjectsProjectsInitialEndpointSpec struct {
-	Group *DataSourcePostgresProjectsProjectsInitialEndpointSpecGroup `json:"group,omitempty"`
-}
-
-type DataSourcePostgresProjectsProjectsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourcePostgresProjectsProjectsSpecCustomTags struct {
-	Key   string `json:"key,omitempty"`
-	Value string `json:"value,omitempty"`
-}
-
-type DataSourcePostgresProjectsProjectsSpecDefaultEndpointSettings struct {
-	AutoscalingLimitMaxCu  float64           `json:"autoscaling_limit_max_cu,omitempty"`
-	AutoscalingLimitMinCu  float64           `json:"autoscaling_limit_min_cu,omitempty"`
-	NoSuspension           bool              `json:"no_suspension,omitempty"`
-	PgSettings             map[string]string `json:"pg_settings,omitempty"`
-	SuspendTimeoutDuration string            `json:"suspend_timeout_duration,omitempty"`
-}
-
-type DataSourcePostgresProjectsProjectsSpec struct {
-	BudgetPolicyId           string                                                         `json:"budget_policy_id,omitempty"`
-	CustomTags               []DataSourcePostgresProjectsProjectsSpecCustomTags             `json:"custom_tags,omitempty"`
-	DefaultBranch            string                                                         `json:"default_branch,omitempty"`
-	DefaultEndpointSettings  *DataSourcePostgresProjectsProjectsSpecDefaultEndpointSettings `json:"default_endpoint_settings,omitempty"`
-	DisplayName              string                                                         `json:"display_name,omitempty"`
-	EnablePgNativeLogin      bool                                                           `json:"enable_pg_native_login,omitempty"`
-	HistoryRetentionDuration string                                                         `json:"history_retention_duration,omitempty"`
-	PgVersion                int                                                            `json:"pg_version,omitempty"`
-}
-
-type DataSourcePostgresProjectsProjectsStatusCustomTags struct {
-	Key   string `json:"key,omitempty"`
-	Value string `json:"value,omitempty"`
-}
-
-type DataSourcePostgresProjectsProjectsStatusDefaultEndpointSettings struct {
-	AutoscalingLimitMaxCu  float64           `json:"autoscaling_limit_max_cu,omitempty"`
-	AutoscalingLimitMinCu  float64           `json:"autoscaling_limit_min_cu,omitempty"`
-	NoSuspension           bool              `json:"no_suspension,omitempty"`
-	PgSettings             map[string]string `json:"pg_settings,omitempty"`
-	SuspendTimeoutDuration string            `json:"suspend_timeout_duration,omitempty"`
-}
-
-type DataSourcePostgresProjectsProjectsStatus struct {
-	BranchLogicalSizeLimitBytes int                                                              `json:"branch_logical_size_limit_bytes,omitempty"`
-	BudgetPolicyId              string                                                           `json:"budget_policy_id,omitempty"`
-	CustomTags                  []DataSourcePostgresProjectsProjectsStatusCustomTags             `json:"custom_tags,omitempty"`
-	DefaultBranch               string                                                           `json:"default_branch,omitempty"`
-	DefaultEndpointSettings     *DataSourcePostgresProjectsProjectsStatusDefaultEndpointSettings `json:"default_endpoint_settings,omitempty"`
-	DisplayName                 string                                                           `json:"display_name,omitempty"`
-	EnablePgNativeLogin         bool                                                             `json:"enable_pg_native_login,omitempty"`
-	HistoryRetentionDuration    string                                                           `json:"history_retention_duration,omitempty"`
-	Owner                       string                                                           `json:"owner,omitempty"`
-	PgVersion                   int                                                              `json:"pg_version,omitempty"`
-	SyntheticStorageSizeBytes   int                                                              `json:"synthetic_storage_size_bytes,omitempty"`
-}
-
-type DataSourcePostgresProjectsProjects struct {
-	CreateTime          string                                                 `json:"create_time,omitempty"`
-	InitialEndpointSpec *DataSourcePostgresProjectsProjectsInitialEndpointSpec `json:"initial_endpoint_spec,omitempty"`
-	Name                string                                                 `json:"name"`
-	ProviderConfig      *DataSourcePostgresProjectsProjectsProviderConfig      `json:"provider_config,omitempty"`
-	Spec                *DataSourcePostgresProjectsProjectsSpec                `json:"spec,omitempty"`
-	Status              *DataSourcePostgresProjectsProjectsStatus              `json:"status,omitempty"`
-	Uid                 string                                                 `json:"uid,omitempty"`
-	UpdateTime          string                                                 `json:"update_time,omitempty"`
-}
-
-type DataSourcePostgresProjectsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourcePostgresProjects struct {
-	PageSize       int                                       `json:"page_size,omitempty"`
-	Projects       []DataSourcePostgresProjectsProjects      `json:"projects,omitempty"`
-	ProviderConfig *DataSourcePostgresProjectsProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_postgres_role.go b/bundle/internal/tf/schema/data_source_postgres_role.go
deleted file mode 100644
index 2c012a8d605..00000000000
--- a/bundle/internal/tf/schema/data_source_postgres_role.go
+++ /dev/null
@@ -1,45 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourcePostgresRoleProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourcePostgresRoleSpecAttributes struct {
-	Bypassrls  bool `json:"bypassrls,omitempty"`
-	Createdb   bool `json:"createdb,omitempty"`
-	Createrole bool `json:"createrole,omitempty"`
-}
-
-type DataSourcePostgresRoleSpec struct {
-	Attributes      *DataSourcePostgresRoleSpecAttributes `json:"attributes,omitempty"`
-	AuthMethod      string                                `json:"auth_method,omitempty"`
-	IdentityType    string                                `json:"identity_type,omitempty"`
-	MembershipRoles []string                              `json:"membership_roles,omitempty"`
-	PostgresRole    string                                `json:"postgres_role,omitempty"`
-}
-
-type DataSourcePostgresRoleStatusAttributes struct {
-	Bypassrls  bool `json:"bypassrls,omitempty"`
-	Createdb   bool `json:"createdb,omitempty"`
-	Createrole bool `json:"createrole,omitempty"`
-}
-
-type DataSourcePostgresRoleStatus struct {
-	Attributes      *DataSourcePostgresRoleStatusAttributes `json:"attributes,omitempty"`
-	AuthMethod      string                                  `json:"auth_method,omitempty"`
-	IdentityType    string                                  `json:"identity_type,omitempty"`
-	MembershipRoles []string                                `json:"membership_roles,omitempty"`
-	PostgresRole    string                                  `json:"postgres_role,omitempty"`
-}
-
-type DataSourcePostgresRole struct {
-	CreateTime     string                                `json:"create_time,omitempty"`
-	Name           string                                `json:"name"`
-	Parent         string                                `json:"parent,omitempty"`
-	ProviderConfig *DataSourcePostgresRoleProviderConfig `json:"provider_config,omitempty"`
-	Spec           *DataSourcePostgresRoleSpec           `json:"spec,omitempty"`
-	Status         *DataSourcePostgresRoleStatus         `json:"status,omitempty"`
-	UpdateTime     string                                `json:"update_time,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_postgres_roles.go b/bundle/internal/tf/schema/data_source_postgres_roles.go
deleted file mode 100644
index 828e472d383..00000000000
--- a/bundle/internal/tf/schema/data_source_postgres_roles.go
+++ /dev/null
@@ -1,56 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourcePostgresRolesProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourcePostgresRolesRolesProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourcePostgresRolesRolesSpecAttributes struct {
-	Bypassrls  bool `json:"bypassrls,omitempty"`
-	Createdb   bool `json:"createdb,omitempty"`
-	Createrole bool `json:"createrole,omitempty"`
-}
-
-type DataSourcePostgresRolesRolesSpec struct {
-	Attributes      *DataSourcePostgresRolesRolesSpecAttributes `json:"attributes,omitempty"`
-	AuthMethod      string                                      `json:"auth_method,omitempty"`
-	IdentityType    string                                      `json:"identity_type,omitempty"`
-	MembershipRoles []string                                    `json:"membership_roles,omitempty"`
-	PostgresRole    string                                      `json:"postgres_role,omitempty"`
-}
-
-type DataSourcePostgresRolesRolesStatusAttributes struct {
-	Bypassrls  bool `json:"bypassrls,omitempty"`
-	Createdb   bool `json:"createdb,omitempty"`
-	Createrole bool `json:"createrole,omitempty"`
-}
-
-type DataSourcePostgresRolesRolesStatus struct {
-	Attributes      *DataSourcePostgresRolesRolesStatusAttributes `json:"attributes,omitempty"`
-	AuthMethod      string                                        `json:"auth_method,omitempty"`
-	IdentityType    string                                        `json:"identity_type,omitempty"`
-	MembershipRoles []string                                      `json:"membership_roles,omitempty"`
-	PostgresRole    string                                        `json:"postgres_role,omitempty"`
-}
-
-type DataSourcePostgresRolesRoles struct {
-	CreateTime     string                                      `json:"create_time,omitempty"`
-	Name           string                                      `json:"name"`
-	Parent         string                                      `json:"parent,omitempty"`
-	ProviderConfig *DataSourcePostgresRolesRolesProviderConfig `json:"provider_config,omitempty"`
-	Spec           *DataSourcePostgresRolesRolesSpec           `json:"spec,omitempty"`
-	Status         *DataSourcePostgresRolesRolesStatus         `json:"status,omitempty"`
-	UpdateTime     string                                      `json:"update_time,omitempty"`
-}
-
-type DataSourcePostgresRoles struct {
-	PageSize       int                                    `json:"page_size,omitempty"`
-	Parent         string                                 `json:"parent"`
-	ProviderConfig *DataSourcePostgresRolesProviderConfig `json:"provider_config,omitempty"`
-	Roles          []DataSourcePostgresRolesRoles         `json:"roles,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_postgres_synced_table.go b/bundle/internal/tf/schema/data_source_postgres_synced_table.go
deleted file mode 100644
index ea8899ba077..00000000000
--- a/bundle/internal/tf/schema/data_source_postgres_synced_table.go
+++ /dev/null
@@ -1,65 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourcePostgresSyncedTableProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourcePostgresSyncedTableSpecNewPipelineSpec struct {
-	BudgetPolicyId string `json:"budget_policy_id,omitempty"`
-	StorageCatalog string `json:"storage_catalog,omitempty"`
-	StorageSchema  string `json:"storage_schema,omitempty"`
-}
-
-type DataSourcePostgresSyncedTableSpec struct {
-	Branch                         string                                            `json:"branch,omitempty"`
-	CreateDatabaseObjectsIfMissing bool                                              `json:"create_database_objects_if_missing,omitempty"`
-	ExistingPipelineId             string                                            `json:"existing_pipeline_id,omitempty"`
-	NewPipelineSpec                *DataSourcePostgresSyncedTableSpecNewPipelineSpec `json:"new_pipeline_spec,omitempty"`
-	PostgresDatabase               string                                            `json:"postgres_database,omitempty"`
-	PrimaryKeyColumns              []string                                          `json:"primary_key_columns,omitempty"`
-	SchedulingPolicy               string                                            `json:"scheduling_policy,omitempty"`
-	SourceTableFullName            string                                            `json:"source_table_full_name,omitempty"`
-	TimeseriesKey                  string                                            `json:"timeseries_key,omitempty"`
-}
-
-type DataSourcePostgresSyncedTableStatusLastSyncDeltaTableSyncInfo struct {
-	DeltaCommitTime    string `json:"delta_commit_time,omitempty"`
-	DeltaCommitVersion int    `json:"delta_commit_version,omitempty"`
-}
-
-type DataSourcePostgresSyncedTableStatusLastSync struct {
-	DeltaTableSyncInfo *DataSourcePostgresSyncedTableStatusLastSyncDeltaTableSyncInfo `json:"delta_table_sync_info,omitempty"`
-	SyncEndTime        string                                                         `json:"sync_end_time,omitempty"`
-	SyncStartTime      string                                                         `json:"sync_start_time,omitempty"`
-}
-
-type DataSourcePostgresSyncedTableStatusOngoingSyncProgress struct {
-	EstimatedCompletionTimeSeconds   int `json:"estimated_completion_time_seconds,omitempty"`
-	LatestVersionCurrentlyProcessing int `json:"latest_version_currently_processing,omitempty"`
-	SyncProgressCompletion           int `json:"sync_progress_completion,omitempty"`
-	SyncedRowCount                   int `json:"synced_row_count,omitempty"`
-	TotalRowCount                    int `json:"total_row_count,omitempty"`
-}
-
-type DataSourcePostgresSyncedTableStatus struct {
-	DetailedState                 string                                                  `json:"detailed_state,omitempty"`
-	LastProcessedCommitVersion    int                                                     `json:"last_processed_commit_version,omitempty"`
-	LastSync                      *DataSourcePostgresSyncedTableStatusLastSync            `json:"last_sync,omitempty"`
-	LastSyncTime                  string                                                  `json:"last_sync_time,omitempty"`
-	Message                       string                                                  `json:"message,omitempty"`
-	OngoingSyncProgress           *DataSourcePostgresSyncedTableStatusOngoingSyncProgress `json:"ongoing_sync_progress,omitempty"`
-	PipelineId                    string                                                  `json:"pipeline_id,omitempty"`
-	ProvisioningPhase             string                                                  `json:"provisioning_phase,omitempty"`
-	UnityCatalogProvisioningState string                                                  `json:"unity_catalog_provisioning_state,omitempty"`
-}
-
-type DataSourcePostgresSyncedTable struct {
-	CreateTime     string                                       `json:"create_time,omitempty"`
-	Name           string                                       `json:"name"`
-	ProviderConfig *DataSourcePostgresSyncedTableProviderConfig `json:"provider_config,omitempty"`
-	Spec           *DataSourcePostgresSyncedTableSpec           `json:"spec,omitempty"`
-	Status         *DataSourcePostgresSyncedTableStatus         `json:"status,omitempty"`
-	Uid            string                                       `json:"uid,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_quality_monitor_v2.go b/bundle/internal/tf/schema/data_source_quality_monitor_v2.go
deleted file mode 100644
index 14a56c76121..00000000000
--- a/bundle/internal/tf/schema/data_source_quality_monitor_v2.go
+++ /dev/null
@@ -1,43 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceQualityMonitorV2AnomalyDetectionConfig struct {
-	ExcludedTableFullNames []string `json:"excluded_table_full_names,omitempty"`
-	LastRunId              string   `json:"last_run_id,omitempty"`
-	LatestRunStatus        string   `json:"latest_run_status,omitempty"`
-}
-
-type DataSourceQualityMonitorV2ProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceQualityMonitorV2ValidityCheckConfigurationsPercentNullValidityCheck struct {
-	ColumnNames []string `json:"column_names,omitempty"`
-	UpperBound  int      `json:"upper_bound,omitempty"`
-}
-
-type DataSourceQualityMonitorV2ValidityCheckConfigurationsRangeValidityCheck struct {
-	ColumnNames []string `json:"column_names,omitempty"`
-	LowerBound  int      `json:"lower_bound,omitempty"`
-	UpperBound  int      `json:"upper_bound,omitempty"`
-}
-
-type DataSourceQualityMonitorV2ValidityCheckConfigurationsUniquenessValidityCheck struct {
-	ColumnNames []string `json:"column_names,omitempty"`
-}
-
-type DataSourceQualityMonitorV2ValidityCheckConfigurations struct {
-	Name                     string                                                                         `json:"name,omitempty"`
-	PercentNullValidityCheck *DataSourceQualityMonitorV2ValidityCheckConfigurationsPercentNullValidityCheck `json:"percent_null_validity_check,omitempty"`
-	RangeValidityCheck       *DataSourceQualityMonitorV2ValidityCheckConfigurationsRangeValidityCheck       `json:"range_validity_check,omitempty"`
-	UniquenessValidityCheck  *DataSourceQualityMonitorV2ValidityCheckConfigurationsUniquenessValidityCheck  `json:"uniqueness_validity_check,omitempty"`
-}
-
-type DataSourceQualityMonitorV2 struct {
-	AnomalyDetectionConfig      *DataSourceQualityMonitorV2AnomalyDetectionConfig       `json:"anomaly_detection_config,omitempty"`
-	ObjectId                    string                                                  `json:"object_id"`
-	ObjectType                  string                                                  `json:"object_type"`
-	ProviderConfig              *DataSourceQualityMonitorV2ProviderConfig               `json:"provider_config,omitempty"`
-	ValidityCheckConfigurations []DataSourceQualityMonitorV2ValidityCheckConfigurations `json:"validity_check_configurations,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_quality_monitors_v2.go b/bundle/internal/tf/schema/data_source_quality_monitors_v2.go
deleted file mode 100644
index b0bd64c2fba..00000000000
--- a/bundle/internal/tf/schema/data_source_quality_monitors_v2.go
+++ /dev/null
@@ -1,53 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceQualityMonitorsV2ProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceQualityMonitorsV2QualityMonitorsAnomalyDetectionConfig struct {
-	ExcludedTableFullNames []string `json:"excluded_table_full_names,omitempty"`
-	LastRunId              string   `json:"last_run_id,omitempty"`
-	LatestRunStatus        string   `json:"latest_run_status,omitempty"`
-}
-
-type DataSourceQualityMonitorsV2QualityMonitorsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceQualityMonitorsV2QualityMonitorsValidityCheckConfigurationsPercentNullValidityCheck struct {
-	ColumnNames []string `json:"column_names,omitempty"`
-	UpperBound  int      `json:"upper_bound,omitempty"`
-}
-
-type DataSourceQualityMonitorsV2QualityMonitorsValidityCheckConfigurationsRangeValidityCheck struct {
-	ColumnNames []string `json:"column_names,omitempty"`
-	LowerBound  int      `json:"lower_bound,omitempty"`
-	UpperBound  int      `json:"upper_bound,omitempty"`
-}
-
-type DataSourceQualityMonitorsV2QualityMonitorsValidityCheckConfigurationsUniquenessValidityCheck struct {
-	ColumnNames []string `json:"column_names,omitempty"`
-}
-
-type DataSourceQualityMonitorsV2QualityMonitorsValidityCheckConfigurations struct {
-	Name                     string                                                                                         `json:"name,omitempty"`
-	PercentNullValidityCheck *DataSourceQualityMonitorsV2QualityMonitorsValidityCheckConfigurationsPercentNullValidityCheck `json:"percent_null_validity_check,omitempty"`
-	RangeValidityCheck       *DataSourceQualityMonitorsV2QualityMonitorsValidityCheckConfigurationsRangeValidityCheck       `json:"range_validity_check,omitempty"`
-	UniquenessValidityCheck  *DataSourceQualityMonitorsV2QualityMonitorsValidityCheckConfigurationsUniquenessValidityCheck  `json:"uniqueness_validity_check,omitempty"`
-}
-
-type DataSourceQualityMonitorsV2QualityMonitors struct {
-	AnomalyDetectionConfig      *DataSourceQualityMonitorsV2QualityMonitorsAnomalyDetectionConfig       `json:"anomaly_detection_config,omitempty"`
-	ObjectId                    string                                                                  `json:"object_id"`
-	ObjectType                  string                                                                  `json:"object_type"`
-	ProviderConfig              *DataSourceQualityMonitorsV2QualityMonitorsProviderConfig               `json:"provider_config,omitempty"`
-	ValidityCheckConfigurations []DataSourceQualityMonitorsV2QualityMonitorsValidityCheckConfigurations `json:"validity_check_configurations,omitempty"`
-}
-
-type DataSourceQualityMonitorsV2 struct {
-	PageSize        int                                          `json:"page_size,omitempty"`
-	ProviderConfig  *DataSourceQualityMonitorsV2ProviderConfig   `json:"provider_config,omitempty"`
-	QualityMonitors []DataSourceQualityMonitorsV2QualityMonitors `json:"quality_monitors,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_recipient_federation_policies.go b/bundle/internal/tf/schema/data_source_recipient_federation_policies.go
deleted file mode 100644
index cce97ff30a4..00000000000
--- a/bundle/internal/tf/schema/data_source_recipient_federation_policies.go
+++ /dev/null
@@ -1,23 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceRecipientFederationPoliciesPoliciesOidcPolicy struct {
-	Audiences    []string `json:"audiences,omitempty"`
-	Issuer       string   `json:"issuer"`
-	Subject      string   `json:"subject"`
-	SubjectClaim string   `json:"subject_claim"`
-}
-
-type DataSourceRecipientFederationPoliciesPolicies struct {
-	Comment    string                                                   `json:"comment,omitempty"`
-	CreateTime string                                                   `json:"create_time,omitempty"`
-	Id         string                                                   `json:"id,omitempty"`
-	Name       string                                                   `json:"name,omitempty"`
-	OidcPolicy *DataSourceRecipientFederationPoliciesPoliciesOidcPolicy `json:"oidc_policy,omitempty"`
-	UpdateTime string                                                   `json:"update_time,omitempty"`
-}
-
-type DataSourceRecipientFederationPolicies struct {
-	Policies []DataSourceRecipientFederationPoliciesPolicies `json:"policies,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_recipient_federation_policy.go b/bundle/internal/tf/schema/data_source_recipient_federation_policy.go
deleted file mode 100644
index 11b24a38ec5..00000000000
--- a/bundle/internal/tf/schema/data_source_recipient_federation_policy.go
+++ /dev/null
@@ -1,19 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceRecipientFederationPolicyOidcPolicy struct {
-	Audiences    []string `json:"audiences,omitempty"`
-	Issuer       string   `json:"issuer"`
-	Subject      string   `json:"subject"`
-	SubjectClaim string   `json:"subject_claim"`
-}
-
-type DataSourceRecipientFederationPolicy struct {
-	Comment    string                                         `json:"comment,omitempty"`
-	CreateTime string                                         `json:"create_time,omitempty"`
-	Id         string                                         `json:"id,omitempty"`
-	Name       string                                         `json:"name,omitempty"`
-	OidcPolicy *DataSourceRecipientFederationPolicyOidcPolicy `json:"oidc_policy,omitempty"`
-	UpdateTime string                                         `json:"update_time,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_registered_model.go b/bundle/internal/tf/schema/data_source_registered_model.go
deleted file mode 100644
index afa3841d5ed..00000000000
--- a/bundle/internal/tf/schema/data_source_registered_model.go
+++ /dev/null
@@ -1,41 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceRegisteredModelModelInfoAliases struct {
-	AliasName   string `json:"alias_name,omitempty"`
-	CatalogName string `json:"catalog_name,omitempty"`
-	Id          string `json:"id,omitempty"`
-	ModelName   string `json:"model_name,omitempty"`
-	SchemaName  string `json:"schema_name,omitempty"`
-	VersionNum  int    `json:"version_num,omitempty"`
-}
-
-type DataSourceRegisteredModelModelInfo struct {
-	Aliases         []DataSourceRegisteredModelModelInfoAliases `json:"aliases,omitempty"`
-	BrowseOnly      bool                                        `json:"browse_only,omitempty"`
-	CatalogName     string                                      `json:"catalog_name,omitempty"`
-	Comment         string                                      `json:"comment,omitempty"`
-	CreatedAt       int                                         `json:"created_at,omitempty"`
-	CreatedBy       string                                      `json:"created_by,omitempty"`
-	FullName        string                                      `json:"full_name,omitempty"`
-	MetastoreId     string                                      `json:"metastore_id,omitempty"`
-	Name            string                                      `json:"name,omitempty"`
-	Owner           string                                      `json:"owner,omitempty"`
-	SchemaName      string                                      `json:"schema_name,omitempty"`
-	StorageLocation string                                      `json:"storage_location,omitempty"`
-	UpdatedAt       int                                         `json:"updated_at,omitempty"`
-	UpdatedBy       string                                      `json:"updated_by,omitempty"`
-}
-
-type DataSourceRegisteredModelProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceRegisteredModel struct {
-	FullName       string                                   `json:"full_name"`
-	IncludeAliases bool                                     `json:"include_aliases,omitempty"`
-	IncludeBrowse  bool                                     `json:"include_browse,omitempty"`
-	ModelInfo      []DataSourceRegisteredModelModelInfo     `json:"model_info,omitempty"`
-	ProviderConfig *DataSourceRegisteredModelProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_registered_model_versions.go b/bundle/internal/tf/schema/data_source_registered_model_versions.go
deleted file mode 100644
index fa923bddaa6..00000000000
--- a/bundle/internal/tf/schema/data_source_registered_model_versions.go
+++ /dev/null
@@ -1,70 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceRegisteredModelVersionsModelVersionsAliases struct {
-	AliasName   string `json:"alias_name,omitempty"`
-	CatalogName string `json:"catalog_name,omitempty"`
-	Id          string `json:"id,omitempty"`
-	ModelName   string `json:"model_name,omitempty"`
-	SchemaName  string `json:"schema_name,omitempty"`
-	VersionNum  int    `json:"version_num,omitempty"`
-}
-
-type DataSourceRegisteredModelVersionsModelVersionsModelVersionDependenciesDependenciesConnection struct {
-	ConnectionName string `json:"connection_name,omitempty"`
-}
-
-type DataSourceRegisteredModelVersionsModelVersionsModelVersionDependenciesDependenciesCredential struct {
-	CredentialName string `json:"credential_name,omitempty"`
-}
-
-type DataSourceRegisteredModelVersionsModelVersionsModelVersionDependenciesDependenciesFunction struct {
-	FunctionFullName string `json:"function_full_name"`
-}
-
-type DataSourceRegisteredModelVersionsModelVersionsModelVersionDependenciesDependenciesTable struct {
-	TableFullName string `json:"table_full_name"`
-}
-
-type DataSourceRegisteredModelVersionsModelVersionsModelVersionDependenciesDependencies struct {
-	Connection []DataSourceRegisteredModelVersionsModelVersionsModelVersionDependenciesDependenciesConnection `json:"connection,omitempty"`
-	Credential []DataSourceRegisteredModelVersionsModelVersionsModelVersionDependenciesDependenciesCredential `json:"credential,omitempty"`
-	Function   []DataSourceRegisteredModelVersionsModelVersionsModelVersionDependenciesDependenciesFunction   `json:"function,omitempty"`
-	Table      []DataSourceRegisteredModelVersionsModelVersionsModelVersionDependenciesDependenciesTable      `json:"table,omitempty"`
-}
-
-type DataSourceRegisteredModelVersionsModelVersionsModelVersionDependencies struct {
-	Dependencies []DataSourceRegisteredModelVersionsModelVersionsModelVersionDependenciesDependencies `json:"dependencies,omitempty"`
-}
-
-type DataSourceRegisteredModelVersionsModelVersions struct {
-	Aliases                  []DataSourceRegisteredModelVersionsModelVersionsAliases                  `json:"aliases,omitempty"`
-	CatalogName              string                                                                   `json:"catalog_name,omitempty"`
-	Comment                  string                                                                   `json:"comment,omitempty"`
-	CreatedAt                int                                                                      `json:"created_at,omitempty"`
-	CreatedBy                string                                                                   `json:"created_by,omitempty"`
-	Id                       string                                                                   `json:"id,omitempty"`
-	MetastoreId              string                                                                   `json:"metastore_id,omitempty"`
-	ModelName                string                                                                   `json:"model_name,omitempty"`
-	ModelVersionDependencies []DataSourceRegisteredModelVersionsModelVersionsModelVersionDependencies `json:"model_version_dependencies,omitempty"`
-	RunId                    string                                                                   `json:"run_id,omitempty"`
-	RunWorkspaceId           int                                                                      `json:"run_workspace_id,omitempty"`
-	SchemaName               string                                                                   `json:"schema_name,omitempty"`
-	Source                   string                                                                   `json:"source,omitempty"`
-	Status                   string                                                                   `json:"status,omitempty"`
-	StorageLocation          string                                                                   `json:"storage_location,omitempty"`
-	UpdatedAt                int                                                                      `json:"updated_at,omitempty"`
-	UpdatedBy                string                                                                   `json:"updated_by,omitempty"`
-	Version                  int                                                                      `json:"version,omitempty"`
-}
-
-type DataSourceRegisteredModelVersionsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceRegisteredModelVersions struct {
-	FullName       string                                           `json:"full_name"`
-	ModelVersions  []DataSourceRegisteredModelVersionsModelVersions `json:"model_versions,omitempty"`
-	ProviderConfig *DataSourceRegisteredModelVersionsProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_rfa_access_request_destinations.go b/bundle/internal/tf/schema/data_source_rfa_access_request_destinations.go
deleted file mode 100644
index 9bb1cee7b73..00000000000
--- a/bundle/internal/tf/schema/data_source_rfa_access_request_destinations.go
+++ /dev/null
@@ -1,35 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceRfaAccessRequestDestinationsDestinationSourceSecurable struct {
-	FullName      string `json:"full_name,omitempty"`
-	ProviderShare string `json:"provider_share,omitempty"`
-	Type          string `json:"type,omitempty"`
-}
-
-type DataSourceRfaAccessRequestDestinationsDestinations struct {
-	DestinationId      string `json:"destination_id,omitempty"`
-	DestinationType    string `json:"destination_type,omitempty"`
-	SpecialDestination string `json:"special_destination,omitempty"`
-}
-
-type DataSourceRfaAccessRequestDestinationsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceRfaAccessRequestDestinationsSecurable struct {
-	FullName      string `json:"full_name,omitempty"`
-	ProviderShare string `json:"provider_share,omitempty"`
-	Type          string `json:"type,omitempty"`
-}
-
-type DataSourceRfaAccessRequestDestinations struct {
-	AreAnyDestinationsHidden   bool                                                              `json:"are_any_destinations_hidden,omitempty"`
-	DestinationSourceSecurable *DataSourceRfaAccessRequestDestinationsDestinationSourceSecurable `json:"destination_source_securable,omitempty"`
-	Destinations               []DataSourceRfaAccessRequestDestinationsDestinations              `json:"destinations,omitempty"`
-	FullName                   string                                                            `json:"full_name"`
-	ProviderConfig             *DataSourceRfaAccessRequestDestinationsProviderConfig             `json:"provider_config,omitempty"`
-	Securable                  *DataSourceRfaAccessRequestDestinationsSecurable                  `json:"securable,omitempty"`
-	SecurableType              string                                                            `json:"securable_type"`
-}
diff --git a/bundle/internal/tf/schema/data_source_schema.go b/bundle/internal/tf/schema/data_source_schema.go
deleted file mode 100644
index f6ec4455af4..00000000000
--- a/bundle/internal/tf/schema/data_source_schema.go
+++ /dev/null
@@ -1,41 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceSchemaProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceSchemaSchemaInfoEffectivePredictiveOptimizationFlag struct {
-	InheritedFromName string `json:"inherited_from_name,omitempty"`
-	InheritedFromType string `json:"inherited_from_type,omitempty"`
-	Value             string `json:"value"`
-}
-
-type DataSourceSchemaSchemaInfo struct {
-	BrowseOnly                          bool                                                           `json:"browse_only,omitempty"`
-	CatalogName                         string                                                         `json:"catalog_name,omitempty"`
-	CatalogType                         string                                                         `json:"catalog_type,omitempty"`
-	Comment                             string                                                         `json:"comment,omitempty"`
-	CreatedAt                           int                                                            `json:"created_at,omitempty"`
-	CreatedBy                           string                                                         `json:"created_by,omitempty"`
-	EnablePredictiveOptimization        string                                                         `json:"enable_predictive_optimization,omitempty"`
-	FullName                            string                                                         `json:"full_name,omitempty"`
-	MetastoreId                         string                                                         `json:"metastore_id,omitempty"`
-	Name                                string                                                         `json:"name,omitempty"`
-	Owner                               string                                                         `json:"owner,omitempty"`
-	Properties                          map[string]string                                              `json:"properties,omitempty"`
-	SchemaId                            string                                                         `json:"schema_id,omitempty"`
-	StorageLocation                     string                                                         `json:"storage_location,omitempty"`
-	StorageRoot                         string                                                         `json:"storage_root,omitempty"`
-	UpdatedAt                           int                                                            `json:"updated_at,omitempty"`
-	UpdatedBy                           string                                                         `json:"updated_by,omitempty"`
-	EffectivePredictiveOptimizationFlag *DataSourceSchemaSchemaInfoEffectivePredictiveOptimizationFlag `json:"effective_predictive_optimization_flag,omitempty"`
-}
-
-type DataSourceSchema struct {
-	Id             string                          `json:"id,omitempty"`
-	Name           string                          `json:"name"`
-	ProviderConfig *DataSourceSchemaProviderConfig `json:"provider_config,omitempty"`
-	SchemaInfo     *DataSourceSchemaSchemaInfo     `json:"schema_info,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_schemas.go b/bundle/internal/tf/schema/data_source_schemas.go
deleted file mode 100644
index d18f9e59023..00000000000
--- a/bundle/internal/tf/schema/data_source_schemas.go
+++ /dev/null
@@ -1,14 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceSchemasProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceSchemas struct {
-	CatalogName    string                           `json:"catalog_name"`
-	Id             string                           `json:"id,omitempty"`
-	Ids            []string                         `json:"ids,omitempty"`
-	ProviderConfig *DataSourceSchemasProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_service_principal.go b/bundle/internal/tf/schema/data_source_service_principal.go
deleted file mode 100644
index 86024a87e9c..00000000000
--- a/bundle/internal/tf/schema/data_source_service_principal.go
+++ /dev/null
@@ -1,21 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceServicePrincipalProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceServicePrincipal struct {
-	AclPrincipalId string                                    `json:"acl_principal_id,omitempty"`
-	Active         bool                                      `json:"active,omitempty"`
-	ApplicationId  string                                    `json:"application_id,omitempty"`
-	DisplayName    string                                    `json:"display_name,omitempty"`
-	ExternalId     string                                    `json:"external_id,omitempty"`
-	Home           string                                    `json:"home,omitempty"`
-	Id             string                                    `json:"id,omitempty"`
-	Repos          string                                    `json:"repos,omitempty"`
-	ScimId         string                                    `json:"scim_id,omitempty"`
-	SpId           string                                    `json:"sp_id,omitempty"`
-	ProviderConfig *DataSourceServicePrincipalProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_service_principal_federation_policies.go b/bundle/internal/tf/schema/data_source_service_principal_federation_policies.go
deleted file mode 100644
index 0c987fed3b1..00000000000
--- a/bundle/internal/tf/schema/data_source_service_principal_federation_policies.go
+++ /dev/null
@@ -1,29 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceServicePrincipalFederationPoliciesPoliciesOidcPolicy struct {
-	Audiences    []string `json:"audiences,omitempty"`
-	Issuer       string   `json:"issuer,omitempty"`
-	JwksJson     string   `json:"jwks_json,omitempty"`
-	JwksUri      string   `json:"jwks_uri,omitempty"`
-	Subject      string   `json:"subject,omitempty"`
-	SubjectClaim string   `json:"subject_claim,omitempty"`
-}
-
-type DataSourceServicePrincipalFederationPoliciesPolicies struct {
-	CreateTime         string                                                          `json:"create_time,omitempty"`
-	Description        string                                                          `json:"description,omitempty"`
-	Name               string                                                          `json:"name,omitempty"`
-	OidcPolicy         *DataSourceServicePrincipalFederationPoliciesPoliciesOidcPolicy `json:"oidc_policy,omitempty"`
-	PolicyId           string                                                          `json:"policy_id"`
-	ServicePrincipalId int                                                             `json:"service_principal_id"`
-	Uid                string                                                          `json:"uid,omitempty"`
-	UpdateTime         string                                                          `json:"update_time,omitempty"`
-}
-
-type DataSourceServicePrincipalFederationPolicies struct {
-	PageSize           int                                                    `json:"page_size,omitempty"`
-	Policies           []DataSourceServicePrincipalFederationPoliciesPolicies `json:"policies,omitempty"`
-	ServicePrincipalId int                                                    `json:"service_principal_id"`
-}
diff --git a/bundle/internal/tf/schema/data_source_service_principal_federation_policy.go b/bundle/internal/tf/schema/data_source_service_principal_federation_policy.go
deleted file mode 100644
index 8c20da79c82..00000000000
--- a/bundle/internal/tf/schema/data_source_service_principal_federation_policy.go
+++ /dev/null
@@ -1,23 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceServicePrincipalFederationPolicyOidcPolicy struct {
-	Audiences    []string `json:"audiences,omitempty"`
-	Issuer       string   `json:"issuer,omitempty"`
-	JwksJson     string   `json:"jwks_json,omitempty"`
-	JwksUri      string   `json:"jwks_uri,omitempty"`
-	Subject      string   `json:"subject,omitempty"`
-	SubjectClaim string   `json:"subject_claim,omitempty"`
-}
-
-type DataSourceServicePrincipalFederationPolicy struct {
-	CreateTime         string                                                `json:"create_time,omitempty"`
-	Description        string                                                `json:"description,omitempty"`
-	Name               string                                                `json:"name,omitempty"`
-	OidcPolicy         *DataSourceServicePrincipalFederationPolicyOidcPolicy `json:"oidc_policy,omitempty"`
-	PolicyId           string                                                `json:"policy_id"`
-	ServicePrincipalId int                                                   `json:"service_principal_id"`
-	Uid                string                                                `json:"uid,omitempty"`
-	UpdateTime         string                                                `json:"update_time,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_service_principals.go b/bundle/internal/tf/schema/data_source_service_principals.go
deleted file mode 100644
index 7a84f68b07d..00000000000
--- a/bundle/internal/tf/schema/data_source_service_principals.go
+++ /dev/null
@@ -1,28 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceServicePrincipalsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceServicePrincipalsServicePrincipals struct {
-	AclPrincipalId string `json:"acl_principal_id,omitempty"`
-	Active         bool   `json:"active,omitempty"`
-	ApplicationId  string `json:"application_id,omitempty"`
-	DisplayName    string `json:"display_name,omitempty"`
-	ExternalId     string `json:"external_id,omitempty"`
-	Home           string `json:"home,omitempty"`
-	Id             string `json:"id,omitempty"`
-	Repos          string `json:"repos,omitempty"`
-	ScimId         string `json:"scim_id,omitempty"`
-	SpId           string `json:"sp_id,omitempty"`
-}
-
-type DataSourceServicePrincipals struct {
-	ApplicationIds      []string                                       `json:"application_ids,omitempty"`
-	DisplayNameContains string                                         `json:"display_name_contains,omitempty"`
-	Id                  string                                         `json:"id,omitempty"`
-	ProviderConfig      *DataSourceServicePrincipalsProviderConfig     `json:"provider_config,omitempty"`
-	ServicePrincipals   []DataSourceServicePrincipalsServicePrincipals `json:"service_principals,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_serving_endpoints.go b/bundle/internal/tf/schema/data_source_serving_endpoints.go
deleted file mode 100644
index 6f312c6a75c..00000000000
--- a/bundle/internal/tf/schema/data_source_serving_endpoints.go
+++ /dev/null
@@ -1,212 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceServingEndpointsEndpointsAiGatewayFallbackConfig struct {
-	Enabled bool `json:"enabled"`
-}
-
-type DataSourceServingEndpointsEndpointsAiGatewayGuardrailsInputPii struct {
-	Behavior string `json:"behavior,omitempty"`
-}
-
-type DataSourceServingEndpointsEndpointsAiGatewayGuardrailsInput struct {
-	InvalidKeywords []string                                                         `json:"invalid_keywords,omitempty"`
-	Pii             []DataSourceServingEndpointsEndpointsAiGatewayGuardrailsInputPii `json:"pii,omitempty"`
-	Safety          bool                                                             `json:"safety,omitempty"`
-	ValidTopics     []string                                                         `json:"valid_topics,omitempty"`
-}
-
-type DataSourceServingEndpointsEndpointsAiGatewayGuardrailsOutputPii struct {
-	Behavior string `json:"behavior,omitempty"`
-}
-
-type DataSourceServingEndpointsEndpointsAiGatewayGuardrailsOutput struct {
-	InvalidKeywords []string                                                          `json:"invalid_keywords,omitempty"`
-	Pii             []DataSourceServingEndpointsEndpointsAiGatewayGuardrailsOutputPii `json:"pii,omitempty"`
-	Safety          bool                                                              `json:"safety,omitempty"`
-	ValidTopics     []string                                                          `json:"valid_topics,omitempty"`
-}
-
-type DataSourceServingEndpointsEndpointsAiGatewayGuardrails struct {
-	Input  []DataSourceServingEndpointsEndpointsAiGatewayGuardrailsInput  `json:"input,omitempty"`
-	Output []DataSourceServingEndpointsEndpointsAiGatewayGuardrailsOutput `json:"output,omitempty"`
-}
-
-type DataSourceServingEndpointsEndpointsAiGatewayInferenceTableConfig struct {
-	CatalogName     string `json:"catalog_name,omitempty"`
-	Enabled         bool   `json:"enabled,omitempty"`
-	SchemaName      string `json:"schema_name,omitempty"`
-	TableNamePrefix string `json:"table_name_prefix,omitempty"`
-}
-
-type DataSourceServingEndpointsEndpointsAiGatewayRateLimits struct {
-	Calls         int    `json:"calls,omitempty"`
-	Key           string `json:"key,omitempty"`
-	Principal     string `json:"principal,omitempty"`
-	RenewalPeriod string `json:"renewal_period"`
-	Tokens        int    `json:"tokens,omitempty"`
-}
-
-type DataSourceServingEndpointsEndpointsAiGatewayUsageTrackingConfig struct {
-	Enabled bool `json:"enabled,omitempty"`
-}
-
-type DataSourceServingEndpointsEndpointsAiGateway struct {
-	FallbackConfig       []DataSourceServingEndpointsEndpointsAiGatewayFallbackConfig       `json:"fallback_config,omitempty"`
-	Guardrails           []DataSourceServingEndpointsEndpointsAiGatewayGuardrails           `json:"guardrails,omitempty"`
-	InferenceTableConfig []DataSourceServingEndpointsEndpointsAiGatewayInferenceTableConfig `json:"inference_table_config,omitempty"`
-	RateLimits           []DataSourceServingEndpointsEndpointsAiGatewayRateLimits           `json:"rate_limits,omitempty"`
-	UsageTrackingConfig  []DataSourceServingEndpointsEndpointsAiGatewayUsageTrackingConfig  `json:"usage_tracking_config,omitempty"`
-}
-
-type DataSourceServingEndpointsEndpointsConfigServedEntitiesExternalModelAi21LabsConfig struct {
-	Ai21LabsApiKey          string `json:"ai21labs_api_key,omitempty"`
-	Ai21LabsApiKeyPlaintext string `json:"ai21labs_api_key_plaintext,omitempty"`
-}
-
-type DataSourceServingEndpointsEndpointsConfigServedEntitiesExternalModelAmazonBedrockConfig struct {
-	AwsAccessKeyId              string `json:"aws_access_key_id,omitempty"`
-	AwsAccessKeyIdPlaintext     string `json:"aws_access_key_id_plaintext,omitempty"`
-	AwsRegion                   string `json:"aws_region"`
-	AwsSecretAccessKey          string `json:"aws_secret_access_key,omitempty"`
-	AwsSecretAccessKeyPlaintext string `json:"aws_secret_access_key_plaintext,omitempty"`
-	BedrockProvider             string `json:"bedrock_provider"`
-	InstanceProfileArn          string `json:"instance_profile_arn,omitempty"`
-}
-
-type DataSourceServingEndpointsEndpointsConfigServedEntitiesExternalModelAnthropicConfig struct {
-	AnthropicApiKey          string `json:"anthropic_api_key,omitempty"`
-	AnthropicApiKeyPlaintext string `json:"anthropic_api_key_plaintext,omitempty"`
-}
-
-type DataSourceServingEndpointsEndpointsConfigServedEntitiesExternalModelCohereConfig struct {
-	CohereApiBase         string `json:"cohere_api_base,omitempty"`
-	CohereApiKey          string `json:"cohere_api_key,omitempty"`
-	CohereApiKeyPlaintext string `json:"cohere_api_key_plaintext,omitempty"`
-}
-
-type DataSourceServingEndpointsEndpointsConfigServedEntitiesExternalModelCustomProviderConfigApiKeyAuth struct {
-	Key            string `json:"key"`
-	Value          string `json:"value,omitempty"`
-	ValuePlaintext string `json:"value_plaintext,omitempty"`
-}
-
-type DataSourceServingEndpointsEndpointsConfigServedEntitiesExternalModelCustomProviderConfigBearerTokenAuth struct {
-	Token          string `json:"token,omitempty"`
-	TokenPlaintext string `json:"token_plaintext,omitempty"`
-}
-
-type DataSourceServingEndpointsEndpointsConfigServedEntitiesExternalModelCustomProviderConfig struct {
-	ApiKeyAuth        []DataSourceServingEndpointsEndpointsConfigServedEntitiesExternalModelCustomProviderConfigApiKeyAuth      `json:"api_key_auth,omitempty"`
-	BearerTokenAuth   []DataSourceServingEndpointsEndpointsConfigServedEntitiesExternalModelCustomProviderConfigBearerTokenAuth `json:"bearer_token_auth,omitempty"`
-	CustomProviderUrl string                                                                                                    `json:"custom_provider_url"`
-}
-
-type DataSourceServingEndpointsEndpointsConfigServedEntitiesExternalModelDatabricksModelServingConfig struct {
-	DatabricksApiToken          string `json:"databricks_api_token,omitempty"`
-	DatabricksApiTokenPlaintext string `json:"databricks_api_token_plaintext,omitempty"`
-	DatabricksWorkspaceUrl      string `json:"databricks_workspace_url"`
-}
-
-type DataSourceServingEndpointsEndpointsConfigServedEntitiesExternalModelGoogleCloudVertexAiConfig struct {
-	PrivateKey          string `json:"private_key,omitempty"`
-	PrivateKeyPlaintext string `json:"private_key_plaintext,omitempty"`
-	ProjectId           string `json:"project_id"`
-	Region              string `json:"region"`
-}
-
-type DataSourceServingEndpointsEndpointsConfigServedEntitiesExternalModelOpenaiConfig struct {
-	MicrosoftEntraClientId              string `json:"microsoft_entra_client_id,omitempty"`
-	MicrosoftEntraClientSecret          string `json:"microsoft_entra_client_secret,omitempty"`
-	MicrosoftEntraClientSecretPlaintext string `json:"microsoft_entra_client_secret_plaintext,omitempty"`
-	MicrosoftEntraTenantId              string `json:"microsoft_entra_tenant_id,omitempty"`
-	OpenaiApiBase                       string `json:"openai_api_base,omitempty"`
-	OpenaiApiKey                        string `json:"openai_api_key,omitempty"`
-	OpenaiApiKeyPlaintext               string `json:"openai_api_key_plaintext,omitempty"`
-	OpenaiApiType                       string `json:"openai_api_type,omitempty"`
-	OpenaiApiVersion                    string `json:"openai_api_version,omitempty"`
-	OpenaiDeploymentName                string `json:"openai_deployment_name,omitempty"`
-	OpenaiOrganization                  string `json:"openai_organization,omitempty"`
-}
-
-type DataSourceServingEndpointsEndpointsConfigServedEntitiesExternalModelPalmConfig struct {
-	PalmApiKey          string `json:"palm_api_key,omitempty"`
-	PalmApiKeyPlaintext string `json:"palm_api_key_plaintext,omitempty"`
-}
-
-type DataSourceServingEndpointsEndpointsConfigServedEntitiesExternalModel struct {
-	Ai21LabsConfig               []DataSourceServingEndpointsEndpointsConfigServedEntitiesExternalModelAi21LabsConfig               `json:"ai21labs_config,omitempty"`
-	AmazonBedrockConfig          []DataSourceServingEndpointsEndpointsConfigServedEntitiesExternalModelAmazonBedrockConfig          `json:"amazon_bedrock_config,omitempty"`
-	AnthropicConfig              []DataSourceServingEndpointsEndpointsConfigServedEntitiesExternalModelAnthropicConfig              `json:"anthropic_config,omitempty"`
-	CohereConfig                 []DataSourceServingEndpointsEndpointsConfigServedEntitiesExternalModelCohereConfig                 `json:"cohere_config,omitempty"`
-	CustomProviderConfig         []DataSourceServingEndpointsEndpointsConfigServedEntitiesExternalModelCustomProviderConfig         `json:"custom_provider_config,omitempty"`
-	DatabricksModelServingConfig []DataSourceServingEndpointsEndpointsConfigServedEntitiesExternalModelDatabricksModelServingConfig `json:"databricks_model_serving_config,omitempty"`
-	GoogleCloudVertexAiConfig    []DataSourceServingEndpointsEndpointsConfigServedEntitiesExternalModelGoogleCloudVertexAiConfig    `json:"google_cloud_vertex_ai_config,omitempty"`
-	Name                         string                                                                                             `json:"name"`
-	OpenaiConfig                 []DataSourceServingEndpointsEndpointsConfigServedEntitiesExternalModelOpenaiConfig                 `json:"openai_config,omitempty"`
-	PalmConfig                   []DataSourceServingEndpointsEndpointsConfigServedEntitiesExternalModelPalmConfig                   `json:"palm_config,omitempty"`
-	Provider                     string                                                                                             `json:"provider"`
-	Task                         string                                                                                             `json:"task"`
-}
-
-type DataSourceServingEndpointsEndpointsConfigServedEntitiesFoundationModel struct {
-	Description string `json:"description,omitempty"`
-	DisplayName string `json:"display_name,omitempty"`
-	Docs        string `json:"docs,omitempty"`
-	Name        string `json:"name,omitempty"`
-}
-
-type DataSourceServingEndpointsEndpointsConfigServedEntities struct {
-	EntityName      string                                                                   `json:"entity_name,omitempty"`
-	EntityVersion   string                                                                   `json:"entity_version,omitempty"`
-	ExternalModel   []DataSourceServingEndpointsEndpointsConfigServedEntitiesExternalModel   `json:"external_model,omitempty"`
-	FoundationModel []DataSourceServingEndpointsEndpointsConfigServedEntitiesFoundationModel `json:"foundation_model,omitempty"`
-	Name            string                                                                   `json:"name,omitempty"`
-}
-
-type DataSourceServingEndpointsEndpointsConfigServedModels struct {
-	ModelName    string `json:"model_name,omitempty"`
-	ModelVersion string `json:"model_version,omitempty"`
-	Name         string `json:"name,omitempty"`
-}
-
-type DataSourceServingEndpointsEndpointsConfig struct {
-	ServedEntities []DataSourceServingEndpointsEndpointsConfigServedEntities `json:"served_entities,omitempty"`
-	ServedModels   []DataSourceServingEndpointsEndpointsConfigServedModels   `json:"served_models,omitempty"`
-}
-
-type DataSourceServingEndpointsEndpointsState struct {
-	ConfigUpdate string `json:"config_update,omitempty"`
-	Ready        string `json:"ready,omitempty"`
-}
-
-type DataSourceServingEndpointsEndpointsTags struct {
-	Key   string `json:"key"`
-	Value string `json:"value,omitempty"`
-}
-
-type DataSourceServingEndpointsEndpoints struct {
-	AiGateway            []DataSourceServingEndpointsEndpointsAiGateway `json:"ai_gateway,omitempty"`
-	BudgetPolicyId       string                                         `json:"budget_policy_id,omitempty"`
-	Config               []DataSourceServingEndpointsEndpointsConfig    `json:"config,omitempty"`
-	CreationTimestamp    int                                            `json:"creation_timestamp,omitempty"`
-	Creator              string                                         `json:"creator,omitempty"`
-	Description          string                                         `json:"description,omitempty"`
-	Id                   string                                         `json:"id,omitempty"`
-	LastUpdatedTimestamp int                                            `json:"last_updated_timestamp,omitempty"`
-	Name                 string                                         `json:"name,omitempty"`
-	State                []DataSourceServingEndpointsEndpointsState     `json:"state,omitempty"`
-	Tags                 []DataSourceServingEndpointsEndpointsTags      `json:"tags,omitempty"`
-	Task                 string                                         `json:"task,omitempty"`
-	UsagePolicyId        string                                         `json:"usage_policy_id,omitempty"`
-}
-
-type DataSourceServingEndpointsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceServingEndpoints struct {
-	Endpoints      []DataSourceServingEndpointsEndpoints     `json:"endpoints,omitempty"`
-	ProviderConfig *DataSourceServingEndpointsProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_share.go b/bundle/internal/tf/schema/data_source_share.go
deleted file mode 100644
index 91a5afff537..00000000000
--- a/bundle/internal/tf/schema/data_source_share.go
+++ /dev/null
@@ -1,54 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceShareObjectPartitionValue struct {
-	Name                 string `json:"name,omitempty"`
-	Op                   string `json:"op,omitempty"`
-	RecipientPropertyKey string `json:"recipient_property_key,omitempty"`
-	Value                string `json:"value,omitempty"`
-}
-
-type DataSourceShareObjectPartition struct {
-	Value []DataSourceShareObjectPartitionValue `json:"value,omitempty"`
-}
-
-type DataSourceShareObject struct {
-	AddedAt                           int                              `json:"added_at,omitempty"`
-	AddedBy                           string                           `json:"added_by,omitempty"`
-	CdfEnabled                        bool                             `json:"cdf_enabled,omitempty"`
-	Comment                           string                           `json:"comment,omitempty"`
-	Content                           string                           `json:"content,omitempty"`
-	DataObjectType                    string                           `json:"data_object_type,omitempty"`
-	EffectiveCdfEnabled               bool                             `json:"effective_cdf_enabled,omitempty"`
-	EffectiveHistoryDataSharingStatus string                           `json:"effective_history_data_sharing_status,omitempty"`
-	EffectiveSharedAs                 string                           `json:"effective_shared_as,omitempty"`
-	EffectiveStartVersion             int                              `json:"effective_start_version,omitempty"`
-	EffectiveStringSharedAs           string                           `json:"effective_string_shared_as,omitempty"`
-	HistoryDataSharingStatus          string                           `json:"history_data_sharing_status,omitempty"`
-	Name                              string                           `json:"name"`
-	Partition                         []DataSourceShareObjectPartition `json:"partition,omitempty"`
-	SharedAs                          string                           `json:"shared_as,omitempty"`
-	StartVersion                      int                              `json:"start_version,omitempty"`
-	Status                            string                           `json:"status,omitempty"`
-	StringSharedAs                    string                           `json:"string_shared_as,omitempty"`
-}
-
-type DataSourceShareProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceShare struct {
-	Comment         string                         `json:"comment,omitempty"`
-	CreatedAt       int                            `json:"created_at,omitempty"`
-	CreatedBy       string                         `json:"created_by,omitempty"`
-	EffectiveOwner  string                         `json:"effective_owner,omitempty"`
-	Name            string                         `json:"name,omitempty"`
-	Object          []DataSourceShareObject        `json:"object,omitempty"`
-	Owner           string                         `json:"owner,omitempty"`
-	ProviderConfig  *DataSourceShareProviderConfig `json:"provider_config,omitempty"`
-	StorageLocation string                         `json:"storage_location,omitempty"`
-	StorageRoot     string                         `json:"storage_root,omitempty"`
-	UpdatedAt       int                            `json:"updated_at,omitempty"`
-	UpdatedBy       string                         `json:"updated_by,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_shares.go b/bundle/internal/tf/schema/data_source_shares.go
deleted file mode 100644
index a4d8d6c29b7..00000000000
--- a/bundle/internal/tf/schema/data_source_shares.go
+++ /dev/null
@@ -1,12 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceSharesProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceShares struct {
-	ProviderConfig *DataSourceSharesProviderConfig `json:"provider_config,omitempty"`
-	Shares         []string                        `json:"shares,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_spark_version.go b/bundle/internal/tf/schema/data_source_spark_version.go
deleted file mode 100644
index fdffbb94e82..00000000000
--- a/bundle/internal/tf/schema/data_source_spark_version.go
+++ /dev/null
@@ -1,22 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceSparkVersionProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceSparkVersion struct {
-	Beta            bool                                  `json:"beta,omitempty"`
-	Genomics        bool                                  `json:"genomics,omitempty"`
-	Gpu             bool                                  `json:"gpu,omitempty"`
-	Graviton        bool                                  `json:"graviton,omitempty"`
-	Id              string                                `json:"id,omitempty"`
-	Latest          bool                                  `json:"latest,omitempty"`
-	LongTermSupport bool                                  `json:"long_term_support,omitempty"`
-	Ml              bool                                  `json:"ml,omitempty"`
-	Photon          bool                                  `json:"photon,omitempty"`
-	Scala           string                                `json:"scala,omitempty"`
-	SparkVersion    string                                `json:"spark_version,omitempty"`
-	ProviderConfig  *DataSourceSparkVersionProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_sql_warehouse.go b/bundle/internal/tf/schema/data_source_sql_warehouse.go
deleted file mode 100644
index 107d1d0a068..00000000000
--- a/bundle/internal/tf/schema/data_source_sql_warehouse.go
+++ /dev/null
@@ -1,67 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceSqlWarehouseChannel struct {
-	DbsqlVersion string `json:"dbsql_version,omitempty"`
-	Name         string `json:"name,omitempty"`
-}
-
-type DataSourceSqlWarehouseHealthFailureReason struct {
-	Code       string            `json:"code,omitempty"`
-	Parameters map[string]string `json:"parameters,omitempty"`
-	Type       string            `json:"type,omitempty"`
-}
-
-type DataSourceSqlWarehouseHealth struct {
-	Details       string                                     `json:"details,omitempty"`
-	Message       string                                     `json:"message,omitempty"`
-	Status        string                                     `json:"status,omitempty"`
-	Summary       string                                     `json:"summary,omitempty"`
-	FailureReason *DataSourceSqlWarehouseHealthFailureReason `json:"failure_reason,omitempty"`
-}
-
-type DataSourceSqlWarehouseOdbcParams struct {
-	Hostname string `json:"hostname,omitempty"`
-	Path     string `json:"path,omitempty"`
-	Port     int    `json:"port,omitempty"`
-	Protocol string `json:"protocol,omitempty"`
-}
-
-type DataSourceSqlWarehouseProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceSqlWarehouseTagsCustomTags struct {
-	Key   string `json:"key,omitempty"`
-	Value string `json:"value,omitempty"`
-}
-
-type DataSourceSqlWarehouseTags struct {
-	CustomTags []DataSourceSqlWarehouseTagsCustomTags `json:"custom_tags,omitempty"`
-}
-
-type DataSourceSqlWarehouse struct {
-	AutoStopMins            int                                   `json:"auto_stop_mins,omitempty"`
-	ClusterSize             string                                `json:"cluster_size,omitempty"`
-	CreatorName             string                                `json:"creator_name,omitempty"`
-	DataSourceId            string                                `json:"data_source_id,omitempty"`
-	EnablePhoton            bool                                  `json:"enable_photon,omitempty"`
-	EnableServerlessCompute bool                                  `json:"enable_serverless_compute,omitempty"`
-	Id                      string                                `json:"id,omitempty"`
-	InstanceProfileArn      string                                `json:"instance_profile_arn,omitempty"`
-	JdbcUrl                 string                                `json:"jdbc_url,omitempty"`
-	MaxNumClusters          int                                   `json:"max_num_clusters,omitempty"`
-	MinNumClusters          int                                   `json:"min_num_clusters,omitempty"`
-	Name                    string                                `json:"name,omitempty"`
-	NumActiveSessions       int                                   `json:"num_active_sessions,omitempty"`
-	NumClusters             int                                   `json:"num_clusters,omitempty"`
-	SpotInstancePolicy      string                                `json:"spot_instance_policy,omitempty"`
-	State                   string                                `json:"state,omitempty"`
-	WarehouseType           string                                `json:"warehouse_type,omitempty"`
-	Channel                 *DataSourceSqlWarehouseChannel        `json:"channel,omitempty"`
-	Health                  *DataSourceSqlWarehouseHealth         `json:"health,omitempty"`
-	OdbcParams              *DataSourceSqlWarehouseOdbcParams     `json:"odbc_params,omitempty"`
-	ProviderConfig          *DataSourceSqlWarehouseProviderConfig `json:"provider_config,omitempty"`
-	Tags                    *DataSourceSqlWarehouseTags           `json:"tags,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_sql_warehouses.go b/bundle/internal/tf/schema/data_source_sql_warehouses.go
deleted file mode 100644
index b7ccd9d84db..00000000000
--- a/bundle/internal/tf/schema/data_source_sql_warehouses.go
+++ /dev/null
@@ -1,14 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceSqlWarehousesProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceSqlWarehouses struct {
-	Id                    string                                 `json:"id,omitempty"`
-	Ids                   []string                               `json:"ids,omitempty"`
-	WarehouseNameContains string                                 `json:"warehouse_name_contains,omitempty"`
-	ProviderConfig        *DataSourceSqlWarehousesProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_storage_credential.go b/bundle/internal/tf/schema/data_source_storage_credential.go
deleted file mode 100644
index 4940c4b83c9..00000000000
--- a/bundle/internal/tf/schema/data_source_storage_credential.go
+++ /dev/null
@@ -1,64 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceStorageCredentialProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceStorageCredentialStorageCredentialInfoAwsIamRole struct {
-	ExternalId         string `json:"external_id,omitempty"`
-	RoleArn            string `json:"role_arn"`
-	UnityCatalogIamArn string `json:"unity_catalog_iam_arn,omitempty"`
-}
-
-type DataSourceStorageCredentialStorageCredentialInfoAzureManagedIdentity struct {
-	AccessConnectorId string `json:"access_connector_id"`
-	CredentialId      string `json:"credential_id,omitempty"`
-	ManagedIdentityId string `json:"managed_identity_id,omitempty"`
-}
-
-type DataSourceStorageCredentialStorageCredentialInfoAzureServicePrincipal struct {
-	ApplicationId string `json:"application_id"`
-	ClientSecret  string `json:"client_secret"`
-	DirectoryId   string `json:"directory_id"`
-}
-
-type DataSourceStorageCredentialStorageCredentialInfoCloudflareApiToken struct {
-	AccessKeyId     string `json:"access_key_id"`
-	AccountId       string `json:"account_id"`
-	SecretAccessKey string `json:"secret_access_key"`
-}
-
-type DataSourceStorageCredentialStorageCredentialInfoDatabricksGcpServiceAccount struct {
-	CredentialId string `json:"credential_id,omitempty"`
-	Email        string `json:"email,omitempty"`
-}
-
-type DataSourceStorageCredentialStorageCredentialInfo struct {
-	Comment                     string                                                                       `json:"comment,omitempty"`
-	CreatedAt                   int                                                                          `json:"created_at,omitempty"`
-	CreatedBy                   string                                                                       `json:"created_by,omitempty"`
-	FullName                    string                                                                       `json:"full_name,omitempty"`
-	Id                          string                                                                       `json:"id,omitempty"`
-	IsolationMode               string                                                                       `json:"isolation_mode,omitempty"`
-	MetastoreId                 string                                                                       `json:"metastore_id,omitempty"`
-	Name                        string                                                                       `json:"name,omitempty"`
-	Owner                       string                                                                       `json:"owner,omitempty"`
-	ReadOnly                    bool                                                                         `json:"read_only,omitempty"`
-	UpdatedAt                   int                                                                          `json:"updated_at,omitempty"`
-	UpdatedBy                   string                                                                       `json:"updated_by,omitempty"`
-	UsedForManagedStorage       bool                                                                         `json:"used_for_managed_storage,omitempty"`
-	AwsIamRole                  *DataSourceStorageCredentialStorageCredentialInfoAwsIamRole                  `json:"aws_iam_role,omitempty"`
-	AzureManagedIdentity        *DataSourceStorageCredentialStorageCredentialInfoAzureManagedIdentity        `json:"azure_managed_identity,omitempty"`
-	AzureServicePrincipal       *DataSourceStorageCredentialStorageCredentialInfoAzureServicePrincipal       `json:"azure_service_principal,omitempty"`
-	CloudflareApiToken          *DataSourceStorageCredentialStorageCredentialInfoCloudflareApiToken          `json:"cloudflare_api_token,omitempty"`
-	DatabricksGcpServiceAccount *DataSourceStorageCredentialStorageCredentialInfoDatabricksGcpServiceAccount `json:"databricks_gcp_service_account,omitempty"`
-}
-
-type DataSourceStorageCredential struct {
-	Id                    string                                            `json:"id,omitempty"`
-	Name                  string                                            `json:"name"`
-	ProviderConfig        *DataSourceStorageCredentialProviderConfig        `json:"provider_config,omitempty"`
-	StorageCredentialInfo *DataSourceStorageCredentialStorageCredentialInfo `json:"storage_credential_info,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_storage_credentials.go b/bundle/internal/tf/schema/data_source_storage_credentials.go
deleted file mode 100644
index a1b068e333e..00000000000
--- a/bundle/internal/tf/schema/data_source_storage_credentials.go
+++ /dev/null
@@ -1,13 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceStorageCredentialsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceStorageCredentials struct {
-	Id             string                                      `json:"id,omitempty"`
-	Names          []string                                    `json:"names,omitempty"`
-	ProviderConfig *DataSourceStorageCredentialsProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_table.go b/bundle/internal/tf/schema/data_source_table.go
deleted file mode 100644
index e3511d87e33..00000000000
--- a/bundle/internal/tf/schema/data_source_table.go
+++ /dev/null
@@ -1,183 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceTableProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceTableTableInfoColumnsMaskUsingArguments struct {
-	Column   string `json:"column,omitempty"`
-	Constant string `json:"constant,omitempty"`
-}
-
-type DataSourceTableTableInfoColumnsMask struct {
-	FunctionName     string                                              `json:"function_name,omitempty"`
-	UsingColumnNames []string                                            `json:"using_column_names,omitempty"`
-	UsingArguments   []DataSourceTableTableInfoColumnsMaskUsingArguments `json:"using_arguments,omitempty"`
-}
-
-type DataSourceTableTableInfoColumns struct {
-	Comment          string                               `json:"comment,omitempty"`
-	Name             string                               `json:"name,omitempty"`
-	Nullable         bool                                 `json:"nullable,omitempty"`
-	PartitionIndex   int                                  `json:"partition_index,omitempty"`
-	Position         int                                  `json:"position,omitempty"`
-	TypeIntervalType string                               `json:"type_interval_type,omitempty"`
-	TypeJson         string                               `json:"type_json,omitempty"`
-	TypeName         string                               `json:"type_name,omitempty"`
-	TypePrecision    int                                  `json:"type_precision,omitempty"`
-	TypeScale        int                                  `json:"type_scale,omitempty"`
-	TypeText         string                               `json:"type_text,omitempty"`
-	Mask             *DataSourceTableTableInfoColumnsMask `json:"mask,omitempty"`
-}
-
-type DataSourceTableTableInfoDeltaRuntimePropertiesKvpairs struct {
-	DeltaRuntimeProperties map[string]string `json:"delta_runtime_properties"`
-}
-
-type DataSourceTableTableInfoEffectivePredictiveOptimizationFlag struct {
-	InheritedFromName string `json:"inherited_from_name,omitempty"`
-	InheritedFromType string `json:"inherited_from_type,omitempty"`
-	Value             string `json:"value"`
-}
-
-type DataSourceTableTableInfoEncryptionDetailsSseEncryptionDetails struct {
-	Algorithm    string `json:"algorithm,omitempty"`
-	AwsKmsKeyArn string `json:"aws_kms_key_arn,omitempty"`
-}
-
-type DataSourceTableTableInfoEncryptionDetails struct {
-	SseEncryptionDetails *DataSourceTableTableInfoEncryptionDetailsSseEncryptionDetails `json:"sse_encryption_details,omitempty"`
-}
-
-type DataSourceTableTableInfoRowFilterInputArguments struct {
-	Column   string `json:"column,omitempty"`
-	Constant string `json:"constant,omitempty"`
-}
-
-type DataSourceTableTableInfoRowFilter struct {
-	FunctionName     string                                            `json:"function_name"`
-	InputColumnNames []string                                          `json:"input_column_names"`
-	InputArguments   []DataSourceTableTableInfoRowFilterInputArguments `json:"input_arguments,omitempty"`
-}
-
-type DataSourceTableTableInfoSecurableKindManifestOptions struct {
-	AllowedValues []string `json:"allowed_values,omitempty"`
-	DefaultValue  string   `json:"default_value,omitempty"`
-	Description   string   `json:"description,omitempty"`
-	Hint          string   `json:"hint,omitempty"`
-	IsCopiable    bool     `json:"is_copiable,omitempty"`
-	IsCreatable   bool     `json:"is_creatable,omitempty"`
-	IsHidden      bool     `json:"is_hidden,omitempty"`
-	IsLoggable    bool     `json:"is_loggable,omitempty"`
-	IsRequired    bool     `json:"is_required,omitempty"`
-	IsSecret      bool     `json:"is_secret,omitempty"`
-	IsUpdatable   bool     `json:"is_updatable,omitempty"`
-	Name          string   `json:"name,omitempty"`
-	OauthStage    string   `json:"oauth_stage,omitempty"`
-	Type          string   `json:"type,omitempty"`
-}
-
-type DataSourceTableTableInfoSecurableKindManifest struct {
-	AssignablePrivileges []string                                               `json:"assignable_privileges,omitempty"`
-	Capabilities         []string                                               `json:"capabilities,omitempty"`
-	SecurableKind        string                                                 `json:"securable_kind,omitempty"`
-	SecurableType        string                                                 `json:"securable_type,omitempty"`
-	Options              []DataSourceTableTableInfoSecurableKindManifestOptions `json:"options,omitempty"`
-}
-
-type DataSourceTableTableInfoTableConstraintsForeignKeyConstraint struct {
-	ChildColumns  []string `json:"child_columns"`
-	Name          string   `json:"name"`
-	ParentColumns []string `json:"parent_columns"`
-	ParentTable   string   `json:"parent_table"`
-	Rely          bool     `json:"rely,omitempty"`
-}
-
-type DataSourceTableTableInfoTableConstraintsNamedTableConstraint struct {
-	Name string `json:"name"`
-}
-
-type DataSourceTableTableInfoTableConstraintsPrimaryKeyConstraint struct {
-	ChildColumns      []string `json:"child_columns"`
-	Name              string   `json:"name"`
-	Rely              bool     `json:"rely,omitempty"`
-	TimeseriesColumns []string `json:"timeseries_columns,omitempty"`
-}
-
-type DataSourceTableTableInfoTableConstraints struct {
-	ForeignKeyConstraint *DataSourceTableTableInfoTableConstraintsForeignKeyConstraint `json:"foreign_key_constraint,omitempty"`
-	NamedTableConstraint *DataSourceTableTableInfoTableConstraintsNamedTableConstraint `json:"named_table_constraint,omitempty"`
-	PrimaryKeyConstraint *DataSourceTableTableInfoTableConstraintsPrimaryKeyConstraint `json:"primary_key_constraint,omitempty"`
-}
-
-type DataSourceTableTableInfoViewDependenciesDependenciesConnection struct {
-	ConnectionName string `json:"connection_name,omitempty"`
-}
-
-type DataSourceTableTableInfoViewDependenciesDependenciesCredential struct {
-	CredentialName string `json:"credential_name,omitempty"`
-}
-
-type DataSourceTableTableInfoViewDependenciesDependenciesFunction struct {
-	FunctionFullName string `json:"function_full_name"`
-}
-
-type DataSourceTableTableInfoViewDependenciesDependenciesTable struct {
-	TableFullName string `json:"table_full_name"`
-}
-
-type DataSourceTableTableInfoViewDependenciesDependencies struct {
-	Connection *DataSourceTableTableInfoViewDependenciesDependenciesConnection `json:"connection,omitempty"`
-	Credential *DataSourceTableTableInfoViewDependenciesDependenciesCredential `json:"credential,omitempty"`
-	Function   *DataSourceTableTableInfoViewDependenciesDependenciesFunction   `json:"function,omitempty"`
-	Table      *DataSourceTableTableInfoViewDependenciesDependenciesTable      `json:"table,omitempty"`
-}
-
-type DataSourceTableTableInfoViewDependencies struct {
-	Dependencies []DataSourceTableTableInfoViewDependenciesDependencies `json:"dependencies,omitempty"`
-}
-
-type DataSourceTableTableInfo struct {
-	AccessPoint                         string                                                       `json:"access_point,omitempty"`
-	BrowseOnly                          bool                                                         `json:"browse_only,omitempty"`
-	CatalogName                         string                                                       `json:"catalog_name,omitempty"`
-	Comment                             string                                                       `json:"comment,omitempty"`
-	CreatedAt                           int                                                          `json:"created_at,omitempty"`
-	CreatedBy                           string                                                       `json:"created_by,omitempty"`
-	DataAccessConfigurationId           string                                                       `json:"data_access_configuration_id,omitempty"`
-	DataSourceFormat                    string                                                       `json:"data_source_format,omitempty"`
-	DeletedAt                           int                                                          `json:"deleted_at,omitempty"`
-	EnablePredictiveOptimization        string                                                       `json:"enable_predictive_optimization,omitempty"`
-	FullName                            string                                                       `json:"full_name,omitempty"`
-	MetastoreId                         string                                                       `json:"metastore_id,omitempty"`
-	Name                                string                                                       `json:"name,omitempty"`
-	Owner                               string                                                       `json:"owner,omitempty"`
-	PipelineId                          string                                                       `json:"pipeline_id,omitempty"`
-	Properties                          map[string]string                                            `json:"properties,omitempty"`
-	SchemaName                          string                                                       `json:"schema_name,omitempty"`
-	SqlPath                             string                                                       `json:"sql_path,omitempty"`
-	StorageCredentialName               string                                                       `json:"storage_credential_name,omitempty"`
-	StorageLocation                     string                                                       `json:"storage_location,omitempty"`
-	TableId                             string                                                       `json:"table_id,omitempty"`
-	TableType                           string                                                       `json:"table_type,omitempty"`
-	UpdatedAt                           int                                                          `json:"updated_at,omitempty"`
-	UpdatedBy                           string                                                       `json:"updated_by,omitempty"`
-	ViewDefinition                      string                                                       `json:"view_definition,omitempty"`
-	Columns                             []DataSourceTableTableInfoColumns                            `json:"columns,omitempty"`
-	DeltaRuntimePropertiesKvpairs       *DataSourceTableTableInfoDeltaRuntimePropertiesKvpairs       `json:"delta_runtime_properties_kvpairs,omitempty"`
-	EffectivePredictiveOptimizationFlag *DataSourceTableTableInfoEffectivePredictiveOptimizationFlag `json:"effective_predictive_optimization_flag,omitempty"`
-	EncryptionDetails                   *DataSourceTableTableInfoEncryptionDetails                   `json:"encryption_details,omitempty"`
-	RowFilter                           *DataSourceTableTableInfoRowFilter                           `json:"row_filter,omitempty"`
-	SecurableKindManifest               *DataSourceTableTableInfoSecurableKindManifest               `json:"securable_kind_manifest,omitempty"`
-	TableConstraints                    []DataSourceTableTableInfoTableConstraints                   `json:"table_constraints,omitempty"`
-	ViewDependencies                    *DataSourceTableTableInfoViewDependencies                    `json:"view_dependencies,omitempty"`
-}
-
-type DataSourceTable struct {
-	Id             string                         `json:"id,omitempty"`
-	Name           string                         `json:"name"`
-	ProviderConfig *DataSourceTableProviderConfig `json:"provider_config,omitempty"`
-	TableInfo      *DataSourceTableTableInfo      `json:"table_info,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_tables.go b/bundle/internal/tf/schema/data_source_tables.go
deleted file mode 100644
index 1f692434633..00000000000
--- a/bundle/internal/tf/schema/data_source_tables.go
+++ /dev/null
@@ -1,15 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceTablesProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceTables struct {
-	CatalogName    string                          `json:"catalog_name"`
-	Id             string                          `json:"id,omitempty"`
-	Ids            []string                        `json:"ids,omitempty"`
-	SchemaName     string                          `json:"schema_name"`
-	ProviderConfig *DataSourceTablesProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_tag_policies.go b/bundle/internal/tf/schema/data_source_tag_policies.go
deleted file mode 100644
index d5dbe527b8d..00000000000
--- a/bundle/internal/tf/schema/data_source_tag_policies.go
+++ /dev/null
@@ -1,31 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceTagPoliciesProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceTagPoliciesTagPoliciesProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceTagPoliciesTagPoliciesValues struct {
-	Name string `json:"name"`
-}
-
-type DataSourceTagPoliciesTagPolicies struct {
-	CreateTime     string                                          `json:"create_time,omitempty"`
-	Description    string                                          `json:"description,omitempty"`
-	Id             string                                          `json:"id,omitempty"`
-	ProviderConfig *DataSourceTagPoliciesTagPoliciesProviderConfig `json:"provider_config,omitempty"`
-	TagKey         string                                          `json:"tag_key"`
-	UpdateTime     string                                          `json:"update_time,omitempty"`
-	Values         []DataSourceTagPoliciesTagPoliciesValues        `json:"values,omitempty"`
-}
-
-type DataSourceTagPolicies struct {
-	PageSize       int                                  `json:"page_size,omitempty"`
-	ProviderConfig *DataSourceTagPoliciesProviderConfig `json:"provider_config,omitempty"`
-	TagPolicies    []DataSourceTagPoliciesTagPolicies   `json:"tag_policies,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_tag_policy.go b/bundle/internal/tf/schema/data_source_tag_policy.go
deleted file mode 100644
index d9e84e86dc9..00000000000
--- a/bundle/internal/tf/schema/data_source_tag_policy.go
+++ /dev/null
@@ -1,21 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceTagPolicyProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceTagPolicyValues struct {
-	Name string `json:"name"`
-}
-
-type DataSourceTagPolicy struct {
-	CreateTime     string                             `json:"create_time,omitempty"`
-	Description    string                             `json:"description,omitempty"`
-	Id             string                             `json:"id,omitempty"`
-	ProviderConfig *DataSourceTagPolicyProviderConfig `json:"provider_config,omitempty"`
-	TagKey         string                             `json:"tag_key"`
-	UpdateTime     string                             `json:"update_time,omitempty"`
-	Values         []DataSourceTagPolicyValues        `json:"values,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_user.go b/bundle/internal/tf/schema/data_source_user.go
deleted file mode 100644
index 4fc7924aae9..00000000000
--- a/bundle/internal/tf/schema/data_source_user.go
+++ /dev/null
@@ -1,23 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceUserProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceUser struct {
-	AclPrincipalId string                        `json:"acl_principal_id,omitempty"`
-	Active         bool                          `json:"active,omitempty"`
-	Alphanumeric   string                        `json:"alphanumeric,omitempty"`
-	Api            string                        `json:"api,omitempty"`
-	ApplicationId  string                        `json:"application_id,omitempty"`
-	DisplayName    string                        `json:"display_name,omitempty"`
-	ExternalId     string                        `json:"external_id,omitempty"`
-	Home           string                        `json:"home,omitempty"`
-	Id             string                        `json:"id,omitempty"`
-	Repos          string                        `json:"repos,omitempty"`
-	UserId         string                        `json:"user_id,omitempty"`
-	UserName       string                        `json:"user_name,omitempty"`
-	ProviderConfig *DataSourceUserProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_users.go b/bundle/internal/tf/schema/data_source_users.go
deleted file mode 100644
index 96326f7a291..00000000000
--- a/bundle/internal/tf/schema/data_source_users.go
+++ /dev/null
@@ -1,66 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceUsersProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceUsersUsersEmails struct {
-	Display string `json:"display,omitempty"`
-	Primary bool   `json:"primary,omitempty"`
-	Ref     string `json:"ref,omitempty"`
-	Type    string `json:"type,omitempty"`
-	Value   string `json:"value,omitempty"`
-}
-
-type DataSourceUsersUsersEntitlements struct {
-	Display string `json:"display,omitempty"`
-	Primary bool   `json:"primary,omitempty"`
-	Ref     string `json:"ref,omitempty"`
-	Type    string `json:"type,omitempty"`
-	Value   string `json:"value,omitempty"`
-}
-
-type DataSourceUsersUsersGroups struct {
-	Display string `json:"display,omitempty"`
-	Primary bool   `json:"primary,omitempty"`
-	Ref     string `json:"ref,omitempty"`
-	Type    string `json:"type,omitempty"`
-	Value   string `json:"value,omitempty"`
-}
-
-type DataSourceUsersUsersName struct {
-	FamilyName string `json:"family_name,omitempty"`
-	GivenName  string `json:"given_name,omitempty"`
-}
-
-type DataSourceUsersUsersRoles struct {
-	Display string `json:"display,omitempty"`
-	Primary bool   `json:"primary,omitempty"`
-	Ref     string `json:"ref,omitempty"`
-	Type    string `json:"type,omitempty"`
-	Value   string `json:"value,omitempty"`
-}
-
-type DataSourceUsersUsers struct {
-	Active       bool                               `json:"active,omitempty"`
-	DisplayName  string                             `json:"display_name,omitempty"`
-	Emails       []DataSourceUsersUsersEmails       `json:"emails,omitempty"`
-	Entitlements []DataSourceUsersUsersEntitlements `json:"entitlements,omitempty"`
-	ExternalId   string                             `json:"external_id,omitempty"`
-	Groups       []DataSourceUsersUsersGroups       `json:"groups,omitempty"`
-	Id           string                             `json:"id,omitempty"`
-	Name         *DataSourceUsersUsersName          `json:"name,omitempty"`
-	Roles        []DataSourceUsersUsersRoles        `json:"roles,omitempty"`
-	Schemas      []string                           `json:"schemas,omitempty"`
-	UserName     string                             `json:"user_name,omitempty"`
-}
-
-type DataSourceUsers struct {
-	Api             string                         `json:"api,omitempty"`
-	ExtraAttributes string                         `json:"extra_attributes,omitempty"`
-	Filter          string                         `json:"filter,omitempty"`
-	ProviderConfig  *DataSourceUsersProviderConfig `json:"provider_config,omitempty"`
-	Users           []DataSourceUsersUsers         `json:"users,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_views.go b/bundle/internal/tf/schema/data_source_views.go
deleted file mode 100644
index abdbc60b865..00000000000
--- a/bundle/internal/tf/schema/data_source_views.go
+++ /dev/null
@@ -1,15 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceViewsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceViews struct {
-	CatalogName    string                         `json:"catalog_name"`
-	Id             string                         `json:"id,omitempty"`
-	Ids            []string                       `json:"ids,omitempty"`
-	SchemaName     string                         `json:"schema_name"`
-	ProviderConfig *DataSourceViewsProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_volume.go b/bundle/internal/tf/schema/data_source_volume.go
deleted file mode 100644
index f62f6fdcbff..00000000000
--- a/bundle/internal/tf/schema/data_source_volume.go
+++ /dev/null
@@ -1,43 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceVolumeProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceVolumeVolumeInfoEncryptionDetailsSseEncryptionDetails struct {
-	Algorithm    string `json:"algorithm,omitempty"`
-	AwsKmsKeyArn string `json:"aws_kms_key_arn,omitempty"`
-}
-
-type DataSourceVolumeVolumeInfoEncryptionDetails struct {
-	SseEncryptionDetails *DataSourceVolumeVolumeInfoEncryptionDetailsSseEncryptionDetails `json:"sse_encryption_details,omitempty"`
-}
-
-type DataSourceVolumeVolumeInfo struct {
-	AccessPoint       string                                       `json:"access_point,omitempty"`
-	BrowseOnly        bool                                         `json:"browse_only,omitempty"`
-	CatalogName       string                                       `json:"catalog_name,omitempty"`
-	Comment           string                                       `json:"comment,omitempty"`
-	CreatedAt         int                                          `json:"created_at,omitempty"`
-	CreatedBy         string                                       `json:"created_by,omitempty"`
-	FullName          string                                       `json:"full_name,omitempty"`
-	MetastoreId       string                                       `json:"metastore_id,omitempty"`
-	Name              string                                       `json:"name,omitempty"`
-	Owner             string                                       `json:"owner,omitempty"`
-	SchemaName        string                                       `json:"schema_name,omitempty"`
-	StorageLocation   string                                       `json:"storage_location,omitempty"`
-	UpdatedAt         int                                          `json:"updated_at,omitempty"`
-	UpdatedBy         string                                       `json:"updated_by,omitempty"`
-	VolumeId          string                                       `json:"volume_id,omitempty"`
-	VolumeType        string                                       `json:"volume_type,omitempty"`
-	EncryptionDetails *DataSourceVolumeVolumeInfoEncryptionDetails `json:"encryption_details,omitempty"`
-}
-
-type DataSourceVolume struct {
-	Id             string                          `json:"id,omitempty"`
-	Name           string                          `json:"name"`
-	ProviderConfig *DataSourceVolumeProviderConfig `json:"provider_config,omitempty"`
-	VolumeInfo     *DataSourceVolumeVolumeInfo     `json:"volume_info,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_volumes.go b/bundle/internal/tf/schema/data_source_volumes.go
deleted file mode 100644
index 3618957c957..00000000000
--- a/bundle/internal/tf/schema/data_source_volumes.go
+++ /dev/null
@@ -1,14 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceVolumesProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceVolumes struct {
-	CatalogName    string                           `json:"catalog_name"`
-	Ids            []string                         `json:"ids,omitempty"`
-	ProviderConfig *DataSourceVolumesProviderConfig `json:"provider_config,omitempty"`
-	SchemaName     string                           `json:"schema_name"`
-}
diff --git a/bundle/internal/tf/schema/data_source_warehouses_default_warehouse_override.go b/bundle/internal/tf/schema/data_source_warehouses_default_warehouse_override.go
deleted file mode 100644
index 0521521bf0f..00000000000
--- a/bundle/internal/tf/schema/data_source_warehouses_default_warehouse_override.go
+++ /dev/null
@@ -1,15 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceWarehousesDefaultWarehouseOverrideProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceWarehousesDefaultWarehouseOverride struct {
-	DefaultWarehouseOverrideId string                                                      `json:"default_warehouse_override_id,omitempty"`
-	Name                       string                                                      `json:"name"`
-	ProviderConfig             *DataSourceWarehousesDefaultWarehouseOverrideProviderConfig `json:"provider_config,omitempty"`
-	Type                       string                                                      `json:"type,omitempty"`
-	WarehouseId                string                                                      `json:"warehouse_id,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_warehouses_default_warehouse_overrides.go b/bundle/internal/tf/schema/data_source_warehouses_default_warehouse_overrides.go
deleted file mode 100644
index 7939c1444e4..00000000000
--- a/bundle/internal/tf/schema/data_source_warehouses_default_warehouse_overrides.go
+++ /dev/null
@@ -1,25 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceWarehousesDefaultWarehouseOverridesDefaultWarehouseOverridesProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceWarehousesDefaultWarehouseOverridesDefaultWarehouseOverrides struct {
-	DefaultWarehouseOverrideId string                                                                                `json:"default_warehouse_override_id,omitempty"`
-	Name                       string                                                                                `json:"name"`
-	ProviderConfig             *DataSourceWarehousesDefaultWarehouseOverridesDefaultWarehouseOverridesProviderConfig `json:"provider_config,omitempty"`
-	Type                       string                                                                                `json:"type,omitempty"`
-	WarehouseId                string                                                                                `json:"warehouse_id,omitempty"`
-}
-
-type DataSourceWarehousesDefaultWarehouseOverridesProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceWarehousesDefaultWarehouseOverrides struct {
-	DefaultWarehouseOverrides []DataSourceWarehousesDefaultWarehouseOverridesDefaultWarehouseOverrides `json:"default_warehouse_overrides,omitempty"`
-	PageSize                  int                                                                      `json:"page_size,omitempty"`
-	ProviderConfig            *DataSourceWarehousesDefaultWarehouseOverridesProviderConfig             `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_workspace_entity_tag_assignment.go b/bundle/internal/tf/schema/data_source_workspace_entity_tag_assignment.go
deleted file mode 100644
index 9fa9a358354..00000000000
--- a/bundle/internal/tf/schema/data_source_workspace_entity_tag_assignment.go
+++ /dev/null
@@ -1,15 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceWorkspaceEntityTagAssignmentProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceWorkspaceEntityTagAssignment struct {
-	EntityId       string                                                `json:"entity_id"`
-	EntityType     string                                                `json:"entity_type"`
-	ProviderConfig *DataSourceWorkspaceEntityTagAssignmentProviderConfig `json:"provider_config,omitempty"`
-	TagKey         string                                                `json:"tag_key"`
-	TagValue       string                                                `json:"tag_value,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_workspace_entity_tag_assignments.go b/bundle/internal/tf/schema/data_source_workspace_entity_tag_assignments.go
deleted file mode 100644
index 7fa301dbed4..00000000000
--- a/bundle/internal/tf/schema/data_source_workspace_entity_tag_assignments.go
+++ /dev/null
@@ -1,27 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceWorkspaceEntityTagAssignmentsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceWorkspaceEntityTagAssignmentsTagAssignmentsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceWorkspaceEntityTagAssignmentsTagAssignments struct {
-	EntityId       string                                                               `json:"entity_id"`
-	EntityType     string                                                               `json:"entity_type"`
-	ProviderConfig *DataSourceWorkspaceEntityTagAssignmentsTagAssignmentsProviderConfig `json:"provider_config,omitempty"`
-	TagKey         string                                                               `json:"tag_key"`
-	TagValue       string                                                               `json:"tag_value,omitempty"`
-}
-
-type DataSourceWorkspaceEntityTagAssignments struct {
-	EntityId       string                                                  `json:"entity_id"`
-	EntityType     string                                                  `json:"entity_type"`
-	PageSize       int                                                     `json:"page_size,omitempty"`
-	ProviderConfig *DataSourceWorkspaceEntityTagAssignmentsProviderConfig  `json:"provider_config,omitempty"`
-	TagAssignments []DataSourceWorkspaceEntityTagAssignmentsTagAssignments `json:"tag_assignments,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_workspace_network_option.go b/bundle/internal/tf/schema/data_source_workspace_network_option.go
deleted file mode 100644
index fa4d48086a5..00000000000
--- a/bundle/internal/tf/schema/data_source_workspace_network_option.go
+++ /dev/null
@@ -1,8 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceWorkspaceNetworkOption struct {
-	NetworkPolicyId string `json:"network_policy_id,omitempty"`
-	WorkspaceId     int    `json:"workspace_id"`
-}
diff --git a/bundle/internal/tf/schema/data_source_workspace_setting_v2.go b/bundle/internal/tf/schema/data_source_workspace_setting_v2.go
deleted file mode 100644
index f65716e9af8..00000000000
--- a/bundle/internal/tf/schema/data_source_workspace_setting_v2.go
+++ /dev/null
@@ -1,144 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceWorkspaceSettingV2AibiDashboardEmbeddingAccessPolicy struct {
-	AccessPolicyType string `json:"access_policy_type"`
-}
-
-type DataSourceWorkspaceSettingV2AibiDashboardEmbeddingApprovedDomains struct {
-	ApprovedDomains []string `json:"approved_domains,omitempty"`
-}
-
-type DataSourceWorkspaceSettingV2AutomaticClusterUpdateWorkspaceEnablementDetails struct {
-	ForcedForComplianceMode           bool `json:"forced_for_compliance_mode,omitempty"`
-	UnavailableForDisabledEntitlement bool `json:"unavailable_for_disabled_entitlement,omitempty"`
-	UnavailableForNonEnterpriseTier   bool `json:"unavailable_for_non_enterprise_tier,omitempty"`
-}
-
-type DataSourceWorkspaceSettingV2AutomaticClusterUpdateWorkspaceMaintenanceWindowWeekDayBasedScheduleWindowStartTime struct {
-	Hours   int `json:"hours,omitempty"`
-	Minutes int `json:"minutes,omitempty"`
-}
-
-type DataSourceWorkspaceSettingV2AutomaticClusterUpdateWorkspaceMaintenanceWindowWeekDayBasedSchedule struct {
-	DayOfWeek       string                                                                                                           `json:"day_of_week,omitempty"`
-	Frequency       string                                                                                                           `json:"frequency,omitempty"`
-	WindowStartTime *DataSourceWorkspaceSettingV2AutomaticClusterUpdateWorkspaceMaintenanceWindowWeekDayBasedScheduleWindowStartTime `json:"window_start_time,omitempty"`
-}
-
-type DataSourceWorkspaceSettingV2AutomaticClusterUpdateWorkspaceMaintenanceWindow struct {
-	WeekDayBasedSchedule *DataSourceWorkspaceSettingV2AutomaticClusterUpdateWorkspaceMaintenanceWindowWeekDayBasedSchedule `json:"week_day_based_schedule,omitempty"`
-}
-
-type DataSourceWorkspaceSettingV2AutomaticClusterUpdateWorkspace struct {
-	CanToggle                       bool                                                                          `json:"can_toggle,omitempty"`
-	Enabled                         bool                                                                          `json:"enabled,omitempty"`
-	EnablementDetails               *DataSourceWorkspaceSettingV2AutomaticClusterUpdateWorkspaceEnablementDetails `json:"enablement_details,omitempty"`
-	MaintenanceWindow               *DataSourceWorkspaceSettingV2AutomaticClusterUpdateWorkspaceMaintenanceWindow `json:"maintenance_window,omitempty"`
-	RestartEvenIfNoUpdatesAvailable bool                                                                          `json:"restart_even_if_no_updates_available,omitempty"`
-}
-
-type DataSourceWorkspaceSettingV2BooleanVal struct {
-	Value bool `json:"value,omitempty"`
-}
-
-type DataSourceWorkspaceSettingV2EffectiveAibiDashboardEmbeddingAccessPolicy struct {
-	AccessPolicyType string `json:"access_policy_type"`
-}
-
-type DataSourceWorkspaceSettingV2EffectiveAibiDashboardEmbeddingApprovedDomains struct {
-	ApprovedDomains []string `json:"approved_domains,omitempty"`
-}
-
-type DataSourceWorkspaceSettingV2EffectiveAutomaticClusterUpdateWorkspaceEnablementDetails struct {
-	ForcedForComplianceMode           bool `json:"forced_for_compliance_mode,omitempty"`
-	UnavailableForDisabledEntitlement bool `json:"unavailable_for_disabled_entitlement,omitempty"`
-	UnavailableForNonEnterpriseTier   bool `json:"unavailable_for_non_enterprise_tier,omitempty"`
-}
-
-type DataSourceWorkspaceSettingV2EffectiveAutomaticClusterUpdateWorkspaceMaintenanceWindowWeekDayBasedScheduleWindowStartTime struct {
-	Hours   int `json:"hours,omitempty"`
-	Minutes int `json:"minutes,omitempty"`
-}
-
-type DataSourceWorkspaceSettingV2EffectiveAutomaticClusterUpdateWorkspaceMaintenanceWindowWeekDayBasedSchedule struct {
-	DayOfWeek       string                                                                                                                    `json:"day_of_week,omitempty"`
-	Frequency       string                                                                                                                    `json:"frequency,omitempty"`
-	WindowStartTime *DataSourceWorkspaceSettingV2EffectiveAutomaticClusterUpdateWorkspaceMaintenanceWindowWeekDayBasedScheduleWindowStartTime `json:"window_start_time,omitempty"`
-}
-
-type DataSourceWorkspaceSettingV2EffectiveAutomaticClusterUpdateWorkspaceMaintenanceWindow struct {
-	WeekDayBasedSchedule *DataSourceWorkspaceSettingV2EffectiveAutomaticClusterUpdateWorkspaceMaintenanceWindowWeekDayBasedSchedule `json:"week_day_based_schedule,omitempty"`
-}
-
-type DataSourceWorkspaceSettingV2EffectiveAutomaticClusterUpdateWorkspace struct {
-	CanToggle                       bool                                                                                   `json:"can_toggle,omitempty"`
-	Enabled                         bool                                                                                   `json:"enabled,omitempty"`
-	EnablementDetails               *DataSourceWorkspaceSettingV2EffectiveAutomaticClusterUpdateWorkspaceEnablementDetails `json:"enablement_details,omitempty"`
-	MaintenanceWindow               *DataSourceWorkspaceSettingV2EffectiveAutomaticClusterUpdateWorkspaceMaintenanceWindow `json:"maintenance_window,omitempty"`
-	RestartEvenIfNoUpdatesAvailable bool                                                                                   `json:"restart_even_if_no_updates_available,omitempty"`
-}
-
-type DataSourceWorkspaceSettingV2EffectiveBooleanVal struct {
-	Value bool `json:"value,omitempty"`
-}
-
-type DataSourceWorkspaceSettingV2EffectiveIntegerVal struct {
-	Value int `json:"value,omitempty"`
-}
-
-type DataSourceWorkspaceSettingV2EffectivePersonalCompute struct {
-	Value string `json:"value,omitempty"`
-}
-
-type DataSourceWorkspaceSettingV2EffectiveRestrictWorkspaceAdmins struct {
-	DisableGovTagCreation bool   `json:"disable_gov_tag_creation,omitempty"`
-	Status                string `json:"status"`
-}
-
-type DataSourceWorkspaceSettingV2EffectiveStringVal struct {
-	Value string `json:"value,omitempty"`
-}
-
-type DataSourceWorkspaceSettingV2IntegerVal struct {
-	Value int `json:"value,omitempty"`
-}
-
-type DataSourceWorkspaceSettingV2PersonalCompute struct {
-	Value string `json:"value,omitempty"`
-}
-
-type DataSourceWorkspaceSettingV2ProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceWorkspaceSettingV2RestrictWorkspaceAdmins struct {
-	DisableGovTagCreation bool   `json:"disable_gov_tag_creation,omitempty"`
-	Status                string `json:"status"`
-}
-
-type DataSourceWorkspaceSettingV2StringVal struct {
-	Value string `json:"value,omitempty"`
-}
-
-type DataSourceWorkspaceSettingV2 struct {
-	AibiDashboardEmbeddingAccessPolicy             *DataSourceWorkspaceSettingV2AibiDashboardEmbeddingAccessPolicy             `json:"aibi_dashboard_embedding_access_policy,omitempty"`
-	AibiDashboardEmbeddingApprovedDomains          *DataSourceWorkspaceSettingV2AibiDashboardEmbeddingApprovedDomains          `json:"aibi_dashboard_embedding_approved_domains,omitempty"`
-	AutomaticClusterUpdateWorkspace                *DataSourceWorkspaceSettingV2AutomaticClusterUpdateWorkspace                `json:"automatic_cluster_update_workspace,omitempty"`
-	BooleanVal                                     *DataSourceWorkspaceSettingV2BooleanVal                                     `json:"boolean_val,omitempty"`
-	EffectiveAibiDashboardEmbeddingAccessPolicy    *DataSourceWorkspaceSettingV2EffectiveAibiDashboardEmbeddingAccessPolicy    `json:"effective_aibi_dashboard_embedding_access_policy,omitempty"`
-	EffectiveAibiDashboardEmbeddingApprovedDomains *DataSourceWorkspaceSettingV2EffectiveAibiDashboardEmbeddingApprovedDomains `json:"effective_aibi_dashboard_embedding_approved_domains,omitempty"`
-	EffectiveAutomaticClusterUpdateWorkspace       *DataSourceWorkspaceSettingV2EffectiveAutomaticClusterUpdateWorkspace       `json:"effective_automatic_cluster_update_workspace,omitempty"`
-	EffectiveBooleanVal                            *DataSourceWorkspaceSettingV2EffectiveBooleanVal                            `json:"effective_boolean_val,omitempty"`
-	EffectiveIntegerVal                            *DataSourceWorkspaceSettingV2EffectiveIntegerVal                            `json:"effective_integer_val,omitempty"`
-	EffectivePersonalCompute                       *DataSourceWorkspaceSettingV2EffectivePersonalCompute                       `json:"effective_personal_compute,omitempty"`
-	EffectiveRestrictWorkspaceAdmins               *DataSourceWorkspaceSettingV2EffectiveRestrictWorkspaceAdmins               `json:"effective_restrict_workspace_admins,omitempty"`
-	EffectiveStringVal                             *DataSourceWorkspaceSettingV2EffectiveStringVal                             `json:"effective_string_val,omitempty"`
-	IntegerVal                                     *DataSourceWorkspaceSettingV2IntegerVal                                     `json:"integer_val,omitempty"`
-	Name                                           string                                                                      `json:"name"`
-	PersonalCompute                                *DataSourceWorkspaceSettingV2PersonalCompute                                `json:"personal_compute,omitempty"`
-	ProviderConfig                                 *DataSourceWorkspaceSettingV2ProviderConfig                                 `json:"provider_config,omitempty"`
-	RestrictWorkspaceAdmins                        *DataSourceWorkspaceSettingV2RestrictWorkspaceAdmins                        `json:"restrict_workspace_admins,omitempty"`
-	StringVal                                      *DataSourceWorkspaceSettingV2StringVal                                      `json:"string_val,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_source_zones.go b/bundle/internal/tf/schema/data_source_zones.go
deleted file mode 100644
index fdb8459adb1..00000000000
--- a/bundle/internal/tf/schema/data_source_zones.go
+++ /dev/null
@@ -1,14 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSourceZonesProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type DataSourceZones struct {
-	DefaultZone    string                         `json:"default_zone,omitempty"`
-	Id             string                         `json:"id,omitempty"`
-	Zones          []string                       `json:"zones,omitempty"`
-	ProviderConfig *DataSourceZonesProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/data_sources.go b/bundle/internal/tf/schema/data_sources.go
deleted file mode 100644
index 8dde049fe16..00000000000
--- a/bundle/internal/tf/schema/data_sources.go
+++ /dev/null
@@ -1,287 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type DataSources struct {
-	AccountFederationPolicies                   map[string]any `json:"databricks_account_federation_policies,omitempty"`
-	AccountFederationPolicy                     map[string]any `json:"databricks_account_federation_policy,omitempty"`
-	AccountNetworkPolicies                      map[string]any `json:"databricks_account_network_policies,omitempty"`
-	AccountNetworkPolicy                        map[string]any `json:"databricks_account_network_policy,omitempty"`
-	AccountSettingUserPreferenceV2              map[string]any `json:"databricks_account_setting_user_preference_v2,omitempty"`
-	AccountSettingV2                            map[string]any `json:"databricks_account_setting_v2,omitempty"`
-	AlertV2                                     map[string]any `json:"databricks_alert_v2,omitempty"`
-	AlertsV2                                    map[string]any `json:"databricks_alerts_v2,omitempty"`
-	App                                         map[string]any `json:"databricks_app,omitempty"`
-	AppSpace                                    map[string]any `json:"databricks_app_space,omitempty"`
-	AppSpaces                                   map[string]any `json:"databricks_app_spaces,omitempty"`
-	Apps                                        map[string]any `json:"databricks_apps,omitempty"`
-	AppsSettingsCustomTemplate                  map[string]any `json:"databricks_apps_settings_custom_template,omitempty"`
-	AppsSettingsCustomTemplates                 map[string]any `json:"databricks_apps_settings_custom_templates,omitempty"`
-	AwsAssumeRolePolicy                         map[string]any `json:"databricks_aws_assume_role_policy,omitempty"`
-	AwsBucketPolicy                             map[string]any `json:"databricks_aws_bucket_policy,omitempty"`
-	AwsCrossaccountPolicy                       map[string]any `json:"databricks_aws_crossaccount_policy,omitempty"`
-	AwsUnityCatalogAssumeRolePolicy             map[string]any `json:"databricks_aws_unity_catalog_assume_role_policy,omitempty"`
-	AwsUnityCatalogPolicy                       map[string]any `json:"databricks_aws_unity_catalog_policy,omitempty"`
-	BudgetPolicies                              map[string]any `json:"databricks_budget_policies,omitempty"`
-	BudgetPolicy                                map[string]any `json:"databricks_budget_policy,omitempty"`
-	Catalog                                     map[string]any `json:"databricks_catalog,omitempty"`
-	Catalogs                                    map[string]any `json:"databricks_catalogs,omitempty"`
-	Cluster                                     map[string]any `json:"databricks_cluster,omitempty"`
-	ClusterPolicy                               map[string]any `json:"databricks_cluster_policy,omitempty"`
-	Clusters                                    map[string]any `json:"databricks_clusters,omitempty"`
-	CurrentConfig                               map[string]any `json:"databricks_current_config,omitempty"`
-	CurrentMetastore                            map[string]any `json:"databricks_current_metastore,omitempty"`
-	CurrentUser                                 map[string]any `json:"databricks_current_user,omitempty"`
-	Dashboards                                  map[string]any `json:"databricks_dashboards,omitempty"`
-	DataClassificationCatalogConfig             map[string]any `json:"databricks_data_classification_catalog_config,omitempty"`
-	DataQualityMonitor                          map[string]any `json:"databricks_data_quality_monitor,omitempty"`
-	DataQualityMonitors                         map[string]any `json:"databricks_data_quality_monitors,omitempty"`
-	DataQualityRefresh                          map[string]any `json:"databricks_data_quality_refresh,omitempty"`
-	DataQualityRefreshes                        map[string]any `json:"databricks_data_quality_refreshes,omitempty"`
-	DatabaseDatabaseCatalog                     map[string]any `json:"databricks_database_database_catalog,omitempty"`
-	DatabaseDatabaseCatalogs                    map[string]any `json:"databricks_database_database_catalogs,omitempty"`
-	DatabaseInstance                            map[string]any `json:"databricks_database_instance,omitempty"`
-	DatabaseInstances                           map[string]any `json:"databricks_database_instances,omitempty"`
-	DatabaseSyncedDatabaseTable                 map[string]any `json:"databricks_database_synced_database_table,omitempty"`
-	DatabaseSyncedDatabaseTables                map[string]any `json:"databricks_database_synced_database_tables,omitempty"`
-	DbfsFile                                    map[string]any `json:"databricks_dbfs_file,omitempty"`
-	DbfsFilePaths                               map[string]any `json:"databricks_dbfs_file_paths,omitempty"`
-	Directory                                   map[string]any `json:"databricks_directory,omitempty"`
-	Endpoint                                    map[string]any `json:"databricks_endpoint,omitempty"`
-	Endpoints                                   map[string]any `json:"databricks_endpoints,omitempty"`
-	EntityTagAssignment                         map[string]any `json:"databricks_entity_tag_assignment,omitempty"`
-	EntityTagAssignments                        map[string]any `json:"databricks_entity_tag_assignments,omitempty"`
-	EnvironmentsDefaultWorkspaceBaseEnvironment map[string]any `json:"databricks_environments_default_workspace_base_environment,omitempty"`
-	EnvironmentsWorkspaceBaseEnvironment        map[string]any `json:"databricks_environments_workspace_base_environment,omitempty"`
-	EnvironmentsWorkspaceBaseEnvironments       map[string]any `json:"databricks_environments_workspace_base_environments,omitempty"`
-	ExternalLocation                            map[string]any `json:"databricks_external_location,omitempty"`
-	ExternalLocations                           map[string]any `json:"databricks_external_locations,omitempty"`
-	ExternalMetadata                            map[string]any `json:"databricks_external_metadata,omitempty"`
-	ExternalMetadatas                           map[string]any `json:"databricks_external_metadatas,omitempty"`
-	FeatureEngineeringFeature                   map[string]any `json:"databricks_feature_engineering_feature,omitempty"`
-	FeatureEngineeringFeatures                  map[string]any `json:"databricks_feature_engineering_features,omitempty"`
-	FeatureEngineeringKafkaConfig               map[string]any `json:"databricks_feature_engineering_kafka_config,omitempty"`
-	FeatureEngineeringKafkaConfigs              map[string]any `json:"databricks_feature_engineering_kafka_configs,omitempty"`
-	FeatureEngineeringMaterializedFeature       map[string]any `json:"databricks_feature_engineering_materialized_feature,omitempty"`
-	FeatureEngineeringMaterializedFeatures      map[string]any `json:"databricks_feature_engineering_materialized_features,omitempty"`
-	Functions                                   map[string]any `json:"databricks_functions,omitempty"`
-	Group                                       map[string]any `json:"databricks_group,omitempty"`
-	InstancePool                                map[string]any `json:"databricks_instance_pool,omitempty"`
-	InstanceProfiles                            map[string]any `json:"databricks_instance_profiles,omitempty"`
-	Job                                         map[string]any `json:"databricks_job,omitempty"`
-	Jobs                                        map[string]any `json:"databricks_jobs,omitempty"`
-	KnowledgeAssistant                          map[string]any `json:"databricks_knowledge_assistant,omitempty"`
-	KnowledgeAssistantKnowledgeSource           map[string]any `json:"databricks_knowledge_assistant_knowledge_source,omitempty"`
-	KnowledgeAssistantKnowledgeSources          map[string]any `json:"databricks_knowledge_assistant_knowledge_sources,omitempty"`
-	KnowledgeAssistants                         map[string]any `json:"databricks_knowledge_assistants,omitempty"`
-	MaterializedFeaturesFeatureTag              map[string]any `json:"databricks_materialized_features_feature_tag,omitempty"`
-	MaterializedFeaturesFeatureTags             map[string]any `json:"databricks_materialized_features_feature_tags,omitempty"`
-	Metastore                                   map[string]any `json:"databricks_metastore,omitempty"`
-	Metastores                                  map[string]any `json:"databricks_metastores,omitempty"`
-	MlflowExperiment                            map[string]any `json:"databricks_mlflow_experiment,omitempty"`
-	MlflowModel                                 map[string]any `json:"databricks_mlflow_model,omitempty"`
-	MlflowModels                                map[string]any `json:"databricks_mlflow_models,omitempty"`
-	MwsCredentials                              map[string]any `json:"databricks_mws_credentials,omitempty"`
-	MwsNetworkConnectivityConfig                map[string]any `json:"databricks_mws_network_connectivity_config,omitempty"`
-	MwsNetworkConnectivityConfigs               map[string]any `json:"databricks_mws_network_connectivity_configs,omitempty"`
-	MwsWorkspaces                               map[string]any `json:"databricks_mws_workspaces,omitempty"`
-	NodeType                                    map[string]any `json:"databricks_node_type,omitempty"`
-	Notebook                                    map[string]any `json:"databricks_notebook,omitempty"`
-	NotebookPaths                               map[string]any `json:"databricks_notebook_paths,omitempty"`
-	NotificationDestinations                    map[string]any `json:"databricks_notification_destinations,omitempty"`
-	OnlineStore                                 map[string]any `json:"databricks_online_store,omitempty"`
-	OnlineStores                                map[string]any `json:"databricks_online_stores,omitempty"`
-	Pipelines                                   map[string]any `json:"databricks_pipelines,omitempty"`
-	PolicyInfo                                  map[string]any `json:"databricks_policy_info,omitempty"`
-	PolicyInfos                                 map[string]any `json:"databricks_policy_infos,omitempty"`
-	PostgresBranch                              map[string]any `json:"databricks_postgres_branch,omitempty"`
-	PostgresBranches                            map[string]any `json:"databricks_postgres_branches,omitempty"`
-	PostgresCatalog                             map[string]any `json:"databricks_postgres_catalog,omitempty"`
-	PostgresDatabase                            map[string]any `json:"databricks_postgres_database,omitempty"`
-	PostgresDatabases                           map[string]any `json:"databricks_postgres_databases,omitempty"`
-	PostgresEndpoint                            map[string]any `json:"databricks_postgres_endpoint,omitempty"`
-	PostgresEndpoints                           map[string]any `json:"databricks_postgres_endpoints,omitempty"`
-	PostgresProject                             map[string]any `json:"databricks_postgres_project,omitempty"`
-	PostgresProjects                            map[string]any `json:"databricks_postgres_projects,omitempty"`
-	PostgresRole                                map[string]any `json:"databricks_postgres_role,omitempty"`
-	PostgresRoles                               map[string]any `json:"databricks_postgres_roles,omitempty"`
-	PostgresSyncedTable                         map[string]any `json:"databricks_postgres_synced_table,omitempty"`
-	QualityMonitorV2                            map[string]any `json:"databricks_quality_monitor_v2,omitempty"`
-	QualityMonitorsV2                           map[string]any `json:"databricks_quality_monitors_v2,omitempty"`
-	RegisteredModel                             map[string]any `json:"databricks_registered_model,omitempty"`
-	RegisteredModelVersions                     map[string]any `json:"databricks_registered_model_versions,omitempty"`
-	RfaAccessRequestDestinations                map[string]any `json:"databricks_rfa_access_request_destinations,omitempty"`
-	Schema                                      map[string]any `json:"databricks_schema,omitempty"`
-	Schemas                                     map[string]any `json:"databricks_schemas,omitempty"`
-	ServicePrincipal                            map[string]any `json:"databricks_service_principal,omitempty"`
-	ServicePrincipalFederationPolicies          map[string]any `json:"databricks_service_principal_federation_policies,omitempty"`
-	ServicePrincipalFederationPolicy            map[string]any `json:"databricks_service_principal_federation_policy,omitempty"`
-	ServicePrincipals                           map[string]any `json:"databricks_service_principals,omitempty"`
-	ServingEndpoints                            map[string]any `json:"databricks_serving_endpoints,omitempty"`
-	Share                                       map[string]any `json:"databricks_share,omitempty"`
-	Shares                                      map[string]any `json:"databricks_shares,omitempty"`
-	SparkVersion                                map[string]any `json:"databricks_spark_version,omitempty"`
-	SqlWarehouse                                map[string]any `json:"databricks_sql_warehouse,omitempty"`
-	SqlWarehouses                               map[string]any `json:"databricks_sql_warehouses,omitempty"`
-	StorageCredential                           map[string]any `json:"databricks_storage_credential,omitempty"`
-	StorageCredentials                          map[string]any `json:"databricks_storage_credentials,omitempty"`
-	Table                                       map[string]any `json:"databricks_table,omitempty"`
-	Tables                                      map[string]any `json:"databricks_tables,omitempty"`
-	TagPolicies                                 map[string]any `json:"databricks_tag_policies,omitempty"`
-	TagPolicy                                   map[string]any `json:"databricks_tag_policy,omitempty"`
-	User                                        map[string]any `json:"databricks_user,omitempty"`
-	Users                                       map[string]any `json:"databricks_users,omitempty"`
-	Views                                       map[string]any `json:"databricks_views,omitempty"`
-	Volume                                      map[string]any `json:"databricks_volume,omitempty"`
-	Volumes                                     map[string]any `json:"databricks_volumes,omitempty"`
-	WarehousesDefaultWarehouseOverride          map[string]any `json:"databricks_warehouses_default_warehouse_override,omitempty"`
-	WarehousesDefaultWarehouseOverrides         map[string]any `json:"databricks_warehouses_default_warehouse_overrides,omitempty"`
-	WorkspaceEntityTagAssignment                map[string]any `json:"databricks_workspace_entity_tag_assignment,omitempty"`
-	WorkspaceEntityTagAssignments               map[string]any `json:"databricks_workspace_entity_tag_assignments,omitempty"`
-	WorkspaceNetworkOption                      map[string]any `json:"databricks_workspace_network_option,omitempty"`
-	WorkspaceSettingV2                          map[string]any `json:"databricks_workspace_setting_v2,omitempty"`
-	Zones                                       map[string]any `json:"databricks_zones,omitempty"`
-}
-
-func NewDataSources() *DataSources {
-	return &DataSources{
-		AccountFederationPolicies:       make(map[string]any),
-		AccountFederationPolicy:         make(map[string]any),
-		AccountNetworkPolicies:          make(map[string]any),
-		AccountNetworkPolicy:            make(map[string]any),
-		AccountSettingUserPreferenceV2:  make(map[string]any),
-		AccountSettingV2:                make(map[string]any),
-		AlertV2:                         make(map[string]any),
-		AlertsV2:                        make(map[string]any),
-		App:                             make(map[string]any),
-		AppSpace:                        make(map[string]any),
-		AppSpaces:                       make(map[string]any),
-		Apps:                            make(map[string]any),
-		AppsSettingsCustomTemplate:      make(map[string]any),
-		AppsSettingsCustomTemplates:     make(map[string]any),
-		AwsAssumeRolePolicy:             make(map[string]any),
-		AwsBucketPolicy:                 make(map[string]any),
-		AwsCrossaccountPolicy:           make(map[string]any),
-		AwsUnityCatalogAssumeRolePolicy: make(map[string]any),
-		AwsUnityCatalogPolicy:           make(map[string]any),
-		BudgetPolicies:                  make(map[string]any),
-		BudgetPolicy:                    make(map[string]any),
-		Catalog:                         make(map[string]any),
-		Catalogs:                        make(map[string]any),
-		Cluster:                         make(map[string]any),
-		ClusterPolicy:                   make(map[string]any),
-		Clusters:                        make(map[string]any),
-		CurrentConfig:                   make(map[string]any),
-		CurrentMetastore:                make(map[string]any),
-		CurrentUser:                     make(map[string]any),
-		Dashboards:                      make(map[string]any),
-		DataClassificationCatalogConfig: make(map[string]any),
-		DataQualityMonitor:              make(map[string]any),
-		DataQualityMonitors:             make(map[string]any),
-		DataQualityRefresh:              make(map[string]any),
-		DataQualityRefreshes:            make(map[string]any),
-		DatabaseDatabaseCatalog:         make(map[string]any),
-		DatabaseDatabaseCatalogs:        make(map[string]any),
-		DatabaseInstance:                make(map[string]any),
-		DatabaseInstances:               make(map[string]any),
-		DatabaseSyncedDatabaseTable:     make(map[string]any),
-		DatabaseSyncedDatabaseTables:    make(map[string]any),
-		DbfsFile:                        make(map[string]any),
-		DbfsFilePaths:                   make(map[string]any),
-		Directory:                       make(map[string]any),
-		Endpoint:                        make(map[string]any),
-		Endpoints:                       make(map[string]any),
-		EntityTagAssignment:             make(map[string]any),
-		EntityTagAssignments:            make(map[string]any),
-		EnvironmentsDefaultWorkspaceBaseEnvironment: make(map[string]any),
-		EnvironmentsWorkspaceBaseEnvironment:        make(map[string]any),
-		EnvironmentsWorkspaceBaseEnvironments:       make(map[string]any),
-		ExternalLocation:                            make(map[string]any),
-		ExternalLocations:                           make(map[string]any),
-		ExternalMetadata:                            make(map[string]any),
-		ExternalMetadatas:                           make(map[string]any),
-		FeatureEngineeringFeature:                   make(map[string]any),
-		FeatureEngineeringFeatures:                  make(map[string]any),
-		FeatureEngineeringKafkaConfig:               make(map[string]any),
-		FeatureEngineeringKafkaConfigs:              make(map[string]any),
-		FeatureEngineeringMaterializedFeature:       make(map[string]any),
-		FeatureEngineeringMaterializedFeatures:      make(map[string]any),
-		Functions:                                   make(map[string]any),
-		Group:                                       make(map[string]any),
-		InstancePool:                                make(map[string]any),
-		InstanceProfiles:                            make(map[string]any),
-		Job:                                         make(map[string]any),
-		Jobs:                                        make(map[string]any),
-		KnowledgeAssistant:                          make(map[string]any),
-		KnowledgeAssistantKnowledgeSource:           make(map[string]any),
-		KnowledgeAssistantKnowledgeSources:          make(map[string]any),
-		KnowledgeAssistants:                         make(map[string]any),
-		MaterializedFeaturesFeatureTag:              make(map[string]any),
-		MaterializedFeaturesFeatureTags:             make(map[string]any),
-		Metastore:                                   make(map[string]any),
-		Metastores:                                  make(map[string]any),
-		MlflowExperiment:                            make(map[string]any),
-		MlflowModel:                                 make(map[string]any),
-		MlflowModels:                                make(map[string]any),
-		MwsCredentials:                              make(map[string]any),
-		MwsNetworkConnectivityConfig:                make(map[string]any),
-		MwsNetworkConnectivityConfigs:               make(map[string]any),
-		MwsWorkspaces:                               make(map[string]any),
-		NodeType:                                    make(map[string]any),
-		Notebook:                                    make(map[string]any),
-		NotebookPaths:                               make(map[string]any),
-		NotificationDestinations:                    make(map[string]any),
-		OnlineStore:                                 make(map[string]any),
-		OnlineStores:                                make(map[string]any),
-		Pipelines:                                   make(map[string]any),
-		PolicyInfo:                                  make(map[string]any),
-		PolicyInfos:                                 make(map[string]any),
-		PostgresBranch:                              make(map[string]any),
-		PostgresBranches:                            make(map[string]any),
-		PostgresCatalog:                             make(map[string]any),
-		PostgresDatabase:                            make(map[string]any),
-		PostgresDatabases:                           make(map[string]any),
-		PostgresEndpoint:                            make(map[string]any),
-		PostgresEndpoints:                           make(map[string]any),
-		PostgresProject:                             make(map[string]any),
-		PostgresProjects:                            make(map[string]any),
-		PostgresRole:                                make(map[string]any),
-		PostgresRoles:                               make(map[string]any),
-		PostgresSyncedTable:                         make(map[string]any),
-		QualityMonitorV2:                            make(map[string]any),
-		QualityMonitorsV2:                           make(map[string]any),
-		RegisteredModel:                             make(map[string]any),
-		RegisteredModelVersions:                     make(map[string]any),
-		RfaAccessRequestDestinations:                make(map[string]any),
-		Schema:                                      make(map[string]any),
-		Schemas:                                     make(map[string]any),
-		ServicePrincipal:                            make(map[string]any),
-		ServicePrincipalFederationPolicies:          make(map[string]any),
-		ServicePrincipalFederationPolicy:            make(map[string]any),
-		ServicePrincipals:                           make(map[string]any),
-		ServingEndpoints:                            make(map[string]any),
-		Share:                                       make(map[string]any),
-		Shares:                                      make(map[string]any),
-		SparkVersion:                                make(map[string]any),
-		SqlWarehouse:                                make(map[string]any),
-		SqlWarehouses:                               make(map[string]any),
-		StorageCredential:                           make(map[string]any),
-		StorageCredentials:                          make(map[string]any),
-		Table:                                       make(map[string]any),
-		Tables:                                      make(map[string]any),
-		TagPolicies:                                 make(map[string]any),
-		TagPolicy:                                   make(map[string]any),
-		User:                                        make(map[string]any),
-		Users:                                       make(map[string]any),
-		Views:                                       make(map[string]any),
-		Volume:                                      make(map[string]any),
-		Volumes:                                     make(map[string]any),
-		WarehousesDefaultWarehouseOverride:          make(map[string]any),
-		WarehousesDefaultWarehouseOverrides:         make(map[string]any),
-		WorkspaceEntityTagAssignment:                make(map[string]any),
-		WorkspaceEntityTagAssignments:               make(map[string]any),
-		WorkspaceNetworkOption:                      make(map[string]any),
-		WorkspaceSettingV2:                          make(map[string]any),
-		Zones:                                       make(map[string]any),
-	}
-}
diff --git a/bundle/internal/tf/schema/resource_access_control_rule_set.go b/bundle/internal/tf/schema/resource_access_control_rule_set.go
deleted file mode 100644
index 10f84ef066f..00000000000
--- a/bundle/internal/tf/schema/resource_access_control_rule_set.go
+++ /dev/null
@@ -1,21 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceAccessControlRuleSetGrantRules struct {
-	Principals []string `json:"principals,omitempty"`
-	Role       string   `json:"role"`
-}
-
-type ResourceAccessControlRuleSetProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceAccessControlRuleSet struct {
-	Api            string                                      `json:"api,omitempty"`
-	Etag           string                                      `json:"etag,omitempty"`
-	Id             string                                      `json:"id,omitempty"`
-	Name           string                                      `json:"name"`
-	GrantRules     []ResourceAccessControlRuleSetGrantRules    `json:"grant_rules,omitempty"`
-	ProviderConfig *ResourceAccessControlRuleSetProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_account_federation_policy.go b/bundle/internal/tf/schema/resource_account_federation_policy.go
deleted file mode 100644
index 3f837e883d0..00000000000
--- a/bundle/internal/tf/schema/resource_account_federation_policy.go
+++ /dev/null
@@ -1,23 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceAccountFederationPolicyOidcPolicy struct {
-	Audiences    []string `json:"audiences,omitempty"`
-	Issuer       string   `json:"issuer,omitempty"`
-	JwksJson     string   `json:"jwks_json,omitempty"`
-	JwksUri      string   `json:"jwks_uri,omitempty"`
-	Subject      string   `json:"subject,omitempty"`
-	SubjectClaim string   `json:"subject_claim,omitempty"`
-}
-
-type ResourceAccountFederationPolicy struct {
-	CreateTime         string                                     `json:"create_time,omitempty"`
-	Description        string                                     `json:"description,omitempty"`
-	Name               string                                     `json:"name,omitempty"`
-	OidcPolicy         *ResourceAccountFederationPolicyOidcPolicy `json:"oidc_policy,omitempty"`
-	PolicyId           string                                     `json:"policy_id,omitempty"`
-	ServicePrincipalId int                                        `json:"service_principal_id,omitempty"`
-	Uid                string                                     `json:"uid,omitempty"`
-	UpdateTime         string                                     `json:"update_time,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_account_network_policy.go b/bundle/internal/tf/schema/resource_account_network_policy.go
deleted file mode 100644
index 9cb5c8524dc..00000000000
--- a/bundle/internal/tf/schema/resource_account_network_policy.go
+++ /dev/null
@@ -1,240 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceAccountNetworkPolicyEgressNetworkAccessAllowedInternetDestinations struct {
-	Destination             string `json:"destination,omitempty"`
-	InternetDestinationType string `json:"internet_destination_type,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyEgressNetworkAccessAllowedStorageDestinations struct {
-	AzureStorageAccount    string `json:"azure_storage_account,omitempty"`
-	AzureStorageService    string `json:"azure_storage_service,omitempty"`
-	BucketName             string `json:"bucket_name,omitempty"`
-	Region                 string `json:"region,omitempty"`
-	StorageDestinationType string `json:"storage_destination_type,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyEgressNetworkAccessPolicyEnforcement struct {
-	DryRunModeProductFilter []string `json:"dry_run_mode_product_filter,omitempty"`
-	EnforcementMode         string   `json:"enforcement_mode,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyEgressNetworkAccess struct {
-	AllowedInternetDestinations []ResourceAccountNetworkPolicyEgressNetworkAccessAllowedInternetDestinations `json:"allowed_internet_destinations,omitempty"`
-	AllowedStorageDestinations  []ResourceAccountNetworkPolicyEgressNetworkAccessAllowedStorageDestinations  `json:"allowed_storage_destinations,omitempty"`
-	PolicyEnforcement           *ResourceAccountNetworkPolicyEgressNetworkAccessPolicyEnforcement            `json:"policy_enforcement,omitempty"`
-	RestrictionMode             string                                                                       `json:"restriction_mode"`
-}
-
-type ResourceAccountNetworkPolicyEgress struct {
-	NetworkAccess *ResourceAccountNetworkPolicyEgressNetworkAccess `json:"network_access,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyIngressPublicAccessAllowRulesAuthenticationIdentities struct {
-	PrincipalId   int    `json:"principal_id,omitempty"`
-	PrincipalType string `json:"principal_type,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyIngressPublicAccessAllowRulesAuthentication struct {
-	Identities   []ResourceAccountNetworkPolicyIngressPublicAccessAllowRulesAuthenticationIdentities `json:"identities,omitempty"`
-	IdentityType string                                                                              `json:"identity_type,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyIngressPublicAccessAllowRulesDestinationWorkspaceApi struct {
-	Scopes []string `json:"scopes,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyIngressPublicAccessAllowRulesDestinationWorkspaceUi struct {
-	AllDestinations bool `json:"all_destinations,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyIngressPublicAccessAllowRulesDestination struct {
-	AllDestinations bool                                                                              `json:"all_destinations,omitempty"`
-	WorkspaceApi    *ResourceAccountNetworkPolicyIngressPublicAccessAllowRulesDestinationWorkspaceApi `json:"workspace_api,omitempty"`
-	WorkspaceUi     *ResourceAccountNetworkPolicyIngressPublicAccessAllowRulesDestinationWorkspaceUi  `json:"workspace_ui,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyIngressPublicAccessAllowRulesOriginExcludedIpRanges struct {
-	IpRanges []string `json:"ip_ranges,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyIngressPublicAccessAllowRulesOriginIncludedIpRanges struct {
-	IpRanges []string `json:"ip_ranges,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyIngressPublicAccessAllowRulesOrigin struct {
-	AllIpRanges      bool                                                                             `json:"all_ip_ranges,omitempty"`
-	ExcludedIpRanges *ResourceAccountNetworkPolicyIngressPublicAccessAllowRulesOriginExcludedIpRanges `json:"excluded_ip_ranges,omitempty"`
-	IncludedIpRanges *ResourceAccountNetworkPolicyIngressPublicAccessAllowRulesOriginIncludedIpRanges `json:"included_ip_ranges,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyIngressPublicAccessAllowRules struct {
-	Authentication *ResourceAccountNetworkPolicyIngressPublicAccessAllowRulesAuthentication `json:"authentication,omitempty"`
-	Destination    *ResourceAccountNetworkPolicyIngressPublicAccessAllowRulesDestination    `json:"destination,omitempty"`
-	Label          string                                                                   `json:"label,omitempty"`
-	Origin         *ResourceAccountNetworkPolicyIngressPublicAccessAllowRulesOrigin         `json:"origin,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyIngressPublicAccessDenyRulesAuthenticationIdentities struct {
-	PrincipalId   int    `json:"principal_id,omitempty"`
-	PrincipalType string `json:"principal_type,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyIngressPublicAccessDenyRulesAuthentication struct {
-	Identities   []ResourceAccountNetworkPolicyIngressPublicAccessDenyRulesAuthenticationIdentities `json:"identities,omitempty"`
-	IdentityType string                                                                             `json:"identity_type,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyIngressPublicAccessDenyRulesDestinationWorkspaceApi struct {
-	Scopes []string `json:"scopes,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyIngressPublicAccessDenyRulesDestinationWorkspaceUi struct {
-	AllDestinations bool `json:"all_destinations,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyIngressPublicAccessDenyRulesDestination struct {
-	AllDestinations bool                                                                             `json:"all_destinations,omitempty"`
-	WorkspaceApi    *ResourceAccountNetworkPolicyIngressPublicAccessDenyRulesDestinationWorkspaceApi `json:"workspace_api,omitempty"`
-	WorkspaceUi     *ResourceAccountNetworkPolicyIngressPublicAccessDenyRulesDestinationWorkspaceUi  `json:"workspace_ui,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyIngressPublicAccessDenyRulesOriginExcludedIpRanges struct {
-	IpRanges []string `json:"ip_ranges,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyIngressPublicAccessDenyRulesOriginIncludedIpRanges struct {
-	IpRanges []string `json:"ip_ranges,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyIngressPublicAccessDenyRulesOrigin struct {
-	AllIpRanges      bool                                                                            `json:"all_ip_ranges,omitempty"`
-	ExcludedIpRanges *ResourceAccountNetworkPolicyIngressPublicAccessDenyRulesOriginExcludedIpRanges `json:"excluded_ip_ranges,omitempty"`
-	IncludedIpRanges *ResourceAccountNetworkPolicyIngressPublicAccessDenyRulesOriginIncludedIpRanges `json:"included_ip_ranges,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyIngressPublicAccessDenyRules struct {
-	Authentication *ResourceAccountNetworkPolicyIngressPublicAccessDenyRulesAuthentication `json:"authentication,omitempty"`
-	Destination    *ResourceAccountNetworkPolicyIngressPublicAccessDenyRulesDestination    `json:"destination,omitempty"`
-	Label          string                                                                  `json:"label,omitempty"`
-	Origin         *ResourceAccountNetworkPolicyIngressPublicAccessDenyRulesOrigin         `json:"origin,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyIngressPublicAccess struct {
-	AllowRules      []ResourceAccountNetworkPolicyIngressPublicAccessAllowRules `json:"allow_rules,omitempty"`
-	DenyRules       []ResourceAccountNetworkPolicyIngressPublicAccessDenyRules  `json:"deny_rules,omitempty"`
-	RestrictionMode string                                                      `json:"restriction_mode"`
-}
-
-type ResourceAccountNetworkPolicyIngress struct {
-	PublicAccess *ResourceAccountNetworkPolicyIngressPublicAccess `json:"public_access,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyIngressDryRunPublicAccessAllowRulesAuthenticationIdentities struct {
-	PrincipalId   int    `json:"principal_id,omitempty"`
-	PrincipalType string `json:"principal_type,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyIngressDryRunPublicAccessAllowRulesAuthentication struct {
-	Identities   []ResourceAccountNetworkPolicyIngressDryRunPublicAccessAllowRulesAuthenticationIdentities `json:"identities,omitempty"`
-	IdentityType string                                                                                    `json:"identity_type,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyIngressDryRunPublicAccessAllowRulesDestinationWorkspaceApi struct {
-	Scopes []string `json:"scopes,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyIngressDryRunPublicAccessAllowRulesDestinationWorkspaceUi struct {
-	AllDestinations bool `json:"all_destinations,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyIngressDryRunPublicAccessAllowRulesDestination struct {
-	AllDestinations bool                                                                                    `json:"all_destinations,omitempty"`
-	WorkspaceApi    *ResourceAccountNetworkPolicyIngressDryRunPublicAccessAllowRulesDestinationWorkspaceApi `json:"workspace_api,omitempty"`
-	WorkspaceUi     *ResourceAccountNetworkPolicyIngressDryRunPublicAccessAllowRulesDestinationWorkspaceUi  `json:"workspace_ui,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyIngressDryRunPublicAccessAllowRulesOriginExcludedIpRanges struct {
-	IpRanges []string `json:"ip_ranges,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyIngressDryRunPublicAccessAllowRulesOriginIncludedIpRanges struct {
-	IpRanges []string `json:"ip_ranges,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyIngressDryRunPublicAccessAllowRulesOrigin struct {
-	AllIpRanges      bool                                                                                   `json:"all_ip_ranges,omitempty"`
-	ExcludedIpRanges *ResourceAccountNetworkPolicyIngressDryRunPublicAccessAllowRulesOriginExcludedIpRanges `json:"excluded_ip_ranges,omitempty"`
-	IncludedIpRanges *ResourceAccountNetworkPolicyIngressDryRunPublicAccessAllowRulesOriginIncludedIpRanges `json:"included_ip_ranges,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyIngressDryRunPublicAccessAllowRules struct {
-	Authentication *ResourceAccountNetworkPolicyIngressDryRunPublicAccessAllowRulesAuthentication `json:"authentication,omitempty"`
-	Destination    *ResourceAccountNetworkPolicyIngressDryRunPublicAccessAllowRulesDestination    `json:"destination,omitempty"`
-	Label          string                                                                         `json:"label,omitempty"`
-	Origin         *ResourceAccountNetworkPolicyIngressDryRunPublicAccessAllowRulesOrigin         `json:"origin,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyIngressDryRunPublicAccessDenyRulesAuthenticationIdentities struct {
-	PrincipalId   int    `json:"principal_id,omitempty"`
-	PrincipalType string `json:"principal_type,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyIngressDryRunPublicAccessDenyRulesAuthentication struct {
-	Identities   []ResourceAccountNetworkPolicyIngressDryRunPublicAccessDenyRulesAuthenticationIdentities `json:"identities,omitempty"`
-	IdentityType string                                                                                   `json:"identity_type,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyIngressDryRunPublicAccessDenyRulesDestinationWorkspaceApi struct {
-	Scopes []string `json:"scopes,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyIngressDryRunPublicAccessDenyRulesDestinationWorkspaceUi struct {
-	AllDestinations bool `json:"all_destinations,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyIngressDryRunPublicAccessDenyRulesDestination struct {
-	AllDestinations bool                                                                                   `json:"all_destinations,omitempty"`
-	WorkspaceApi    *ResourceAccountNetworkPolicyIngressDryRunPublicAccessDenyRulesDestinationWorkspaceApi `json:"workspace_api,omitempty"`
-	WorkspaceUi     *ResourceAccountNetworkPolicyIngressDryRunPublicAccessDenyRulesDestinationWorkspaceUi  `json:"workspace_ui,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyIngressDryRunPublicAccessDenyRulesOriginExcludedIpRanges struct {
-	IpRanges []string `json:"ip_ranges,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyIngressDryRunPublicAccessDenyRulesOriginIncludedIpRanges struct {
-	IpRanges []string `json:"ip_ranges,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyIngressDryRunPublicAccessDenyRulesOrigin struct {
-	AllIpRanges      bool                                                                                  `json:"all_ip_ranges,omitempty"`
-	ExcludedIpRanges *ResourceAccountNetworkPolicyIngressDryRunPublicAccessDenyRulesOriginExcludedIpRanges `json:"excluded_ip_ranges,omitempty"`
-	IncludedIpRanges *ResourceAccountNetworkPolicyIngressDryRunPublicAccessDenyRulesOriginIncludedIpRanges `json:"included_ip_ranges,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyIngressDryRunPublicAccessDenyRules struct {
-	Authentication *ResourceAccountNetworkPolicyIngressDryRunPublicAccessDenyRulesAuthentication `json:"authentication,omitempty"`
-	Destination    *ResourceAccountNetworkPolicyIngressDryRunPublicAccessDenyRulesDestination    `json:"destination,omitempty"`
-	Label          string                                                                        `json:"label,omitempty"`
-	Origin         *ResourceAccountNetworkPolicyIngressDryRunPublicAccessDenyRulesOrigin         `json:"origin,omitempty"`
-}
-
-type ResourceAccountNetworkPolicyIngressDryRunPublicAccess struct {
-	AllowRules      []ResourceAccountNetworkPolicyIngressDryRunPublicAccessAllowRules `json:"allow_rules,omitempty"`
-	DenyRules       []ResourceAccountNetworkPolicyIngressDryRunPublicAccessDenyRules  `json:"deny_rules,omitempty"`
-	RestrictionMode string                                                            `json:"restriction_mode"`
-}
-
-type ResourceAccountNetworkPolicyIngressDryRun struct {
-	PublicAccess *ResourceAccountNetworkPolicyIngressDryRunPublicAccess `json:"public_access,omitempty"`
-}
-
-type ResourceAccountNetworkPolicy struct {
-	AccountId       string                                     `json:"account_id,omitempty"`
-	Egress          *ResourceAccountNetworkPolicyEgress        `json:"egress,omitempty"`
-	Ingress         *ResourceAccountNetworkPolicyIngress       `json:"ingress,omitempty"`
-	IngressDryRun   *ResourceAccountNetworkPolicyIngressDryRun `json:"ingress_dry_run,omitempty"`
-	NetworkPolicyId string                                     `json:"network_policy_id,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_account_setting_user_preference_v2.go b/bundle/internal/tf/schema/resource_account_setting_user_preference_v2.go
deleted file mode 100644
index e8d8908bb48..00000000000
--- a/bundle/internal/tf/schema/resource_account_setting_user_preference_v2.go
+++ /dev/null
@@ -1,28 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceAccountSettingUserPreferenceV2BooleanVal struct {
-	Value bool `json:"value,omitempty"`
-}
-
-type ResourceAccountSettingUserPreferenceV2EffectiveBooleanVal struct {
-	Value bool `json:"value,omitempty"`
-}
-
-type ResourceAccountSettingUserPreferenceV2EffectiveStringVal struct {
-	Value string `json:"value,omitempty"`
-}
-
-type ResourceAccountSettingUserPreferenceV2StringVal struct {
-	Value string `json:"value,omitempty"`
-}
-
-type ResourceAccountSettingUserPreferenceV2 struct {
-	BooleanVal          *ResourceAccountSettingUserPreferenceV2BooleanVal          `json:"boolean_val,omitempty"`
-	EffectiveBooleanVal *ResourceAccountSettingUserPreferenceV2EffectiveBooleanVal `json:"effective_boolean_val,omitempty"`
-	EffectiveStringVal  *ResourceAccountSettingUserPreferenceV2EffectiveStringVal  `json:"effective_string_val,omitempty"`
-	Name                string                                                     `json:"name,omitempty"`
-	StringVal           *ResourceAccountSettingUserPreferenceV2StringVal           `json:"string_val,omitempty"`
-	UserId              string                                                     `json:"user_id,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_account_setting_v2.go b/bundle/internal/tf/schema/resource_account_setting_v2.go
deleted file mode 100644
index aed9ba93944..00000000000
--- a/bundle/internal/tf/schema/resource_account_setting_v2.go
+++ /dev/null
@@ -1,139 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceAccountSettingV2AibiDashboardEmbeddingAccessPolicy struct {
-	AccessPolicyType string `json:"access_policy_type"`
-}
-
-type ResourceAccountSettingV2AibiDashboardEmbeddingApprovedDomains struct {
-	ApprovedDomains []string `json:"approved_domains,omitempty"`
-}
-
-type ResourceAccountSettingV2AutomaticClusterUpdateWorkspaceEnablementDetails struct {
-	ForcedForComplianceMode           bool `json:"forced_for_compliance_mode,omitempty"`
-	UnavailableForDisabledEntitlement bool `json:"unavailable_for_disabled_entitlement,omitempty"`
-	UnavailableForNonEnterpriseTier   bool `json:"unavailable_for_non_enterprise_tier,omitempty"`
-}
-
-type ResourceAccountSettingV2AutomaticClusterUpdateWorkspaceMaintenanceWindowWeekDayBasedScheduleWindowStartTime struct {
-	Hours   int `json:"hours,omitempty"`
-	Minutes int `json:"minutes,omitempty"`
-}
-
-type ResourceAccountSettingV2AutomaticClusterUpdateWorkspaceMaintenanceWindowWeekDayBasedSchedule struct {
-	DayOfWeek       string                                                                                                       `json:"day_of_week,omitempty"`
-	Frequency       string                                                                                                       `json:"frequency,omitempty"`
-	WindowStartTime *ResourceAccountSettingV2AutomaticClusterUpdateWorkspaceMaintenanceWindowWeekDayBasedScheduleWindowStartTime `json:"window_start_time,omitempty"`
-}
-
-type ResourceAccountSettingV2AutomaticClusterUpdateWorkspaceMaintenanceWindow struct {
-	WeekDayBasedSchedule *ResourceAccountSettingV2AutomaticClusterUpdateWorkspaceMaintenanceWindowWeekDayBasedSchedule `json:"week_day_based_schedule,omitempty"`
-}
-
-type ResourceAccountSettingV2AutomaticClusterUpdateWorkspace struct {
-	CanToggle                       bool                                                                      `json:"can_toggle,omitempty"`
-	Enabled                         bool                                                                      `json:"enabled,omitempty"`
-	EnablementDetails               *ResourceAccountSettingV2AutomaticClusterUpdateWorkspaceEnablementDetails `json:"enablement_details,omitempty"`
-	MaintenanceWindow               *ResourceAccountSettingV2AutomaticClusterUpdateWorkspaceMaintenanceWindow `json:"maintenance_window,omitempty"`
-	RestartEvenIfNoUpdatesAvailable bool                                                                      `json:"restart_even_if_no_updates_available,omitempty"`
-}
-
-type ResourceAccountSettingV2BooleanVal struct {
-	Value bool `json:"value,omitempty"`
-}
-
-type ResourceAccountSettingV2EffectiveAibiDashboardEmbeddingAccessPolicy struct {
-	AccessPolicyType string `json:"access_policy_type"`
-}
-
-type ResourceAccountSettingV2EffectiveAibiDashboardEmbeddingApprovedDomains struct {
-	ApprovedDomains []string `json:"approved_domains,omitempty"`
-}
-
-type ResourceAccountSettingV2EffectiveAutomaticClusterUpdateWorkspaceEnablementDetails struct {
-	ForcedForComplianceMode           bool `json:"forced_for_compliance_mode,omitempty"`
-	UnavailableForDisabledEntitlement bool `json:"unavailable_for_disabled_entitlement,omitempty"`
-	UnavailableForNonEnterpriseTier   bool `json:"unavailable_for_non_enterprise_tier,omitempty"`
-}
-
-type ResourceAccountSettingV2EffectiveAutomaticClusterUpdateWorkspaceMaintenanceWindowWeekDayBasedScheduleWindowStartTime struct {
-	Hours   int `json:"hours,omitempty"`
-	Minutes int `json:"minutes,omitempty"`
-}
-
-type ResourceAccountSettingV2EffectiveAutomaticClusterUpdateWorkspaceMaintenanceWindowWeekDayBasedSchedule struct {
-	DayOfWeek       string                                                                                                                `json:"day_of_week,omitempty"`
-	Frequency       string                                                                                                                `json:"frequency,omitempty"`
-	WindowStartTime *ResourceAccountSettingV2EffectiveAutomaticClusterUpdateWorkspaceMaintenanceWindowWeekDayBasedScheduleWindowStartTime `json:"window_start_time,omitempty"`
-}
-
-type ResourceAccountSettingV2EffectiveAutomaticClusterUpdateWorkspaceMaintenanceWindow struct {
-	WeekDayBasedSchedule *ResourceAccountSettingV2EffectiveAutomaticClusterUpdateWorkspaceMaintenanceWindowWeekDayBasedSchedule `json:"week_day_based_schedule,omitempty"`
-}
-
-type ResourceAccountSettingV2EffectiveAutomaticClusterUpdateWorkspace struct {
-	CanToggle                       bool                                                                               `json:"can_toggle,omitempty"`
-	Enabled                         bool                                                                               `json:"enabled,omitempty"`
-	EnablementDetails               *ResourceAccountSettingV2EffectiveAutomaticClusterUpdateWorkspaceEnablementDetails `json:"enablement_details,omitempty"`
-	MaintenanceWindow               *ResourceAccountSettingV2EffectiveAutomaticClusterUpdateWorkspaceMaintenanceWindow `json:"maintenance_window,omitempty"`
-	RestartEvenIfNoUpdatesAvailable bool                                                                               `json:"restart_even_if_no_updates_available,omitempty"`
-}
-
-type ResourceAccountSettingV2EffectiveBooleanVal struct {
-	Value bool `json:"value,omitempty"`
-}
-
-type ResourceAccountSettingV2EffectiveIntegerVal struct {
-	Value int `json:"value,omitempty"`
-}
-
-type ResourceAccountSettingV2EffectivePersonalCompute struct {
-	Value string `json:"value,omitempty"`
-}
-
-type ResourceAccountSettingV2EffectiveRestrictWorkspaceAdmins struct {
-	DisableGovTagCreation bool   `json:"disable_gov_tag_creation,omitempty"`
-	Status                string `json:"status"`
-}
-
-type ResourceAccountSettingV2EffectiveStringVal struct {
-	Value string `json:"value,omitempty"`
-}
-
-type ResourceAccountSettingV2IntegerVal struct {
-	Value int `json:"value,omitempty"`
-}
-
-type ResourceAccountSettingV2PersonalCompute struct {
-	Value string `json:"value,omitempty"`
-}
-
-type ResourceAccountSettingV2RestrictWorkspaceAdmins struct {
-	DisableGovTagCreation bool   `json:"disable_gov_tag_creation,omitempty"`
-	Status                string `json:"status"`
-}
-
-type ResourceAccountSettingV2StringVal struct {
-	Value string `json:"value,omitempty"`
-}
-
-type ResourceAccountSettingV2 struct {
-	AibiDashboardEmbeddingAccessPolicy             *ResourceAccountSettingV2AibiDashboardEmbeddingAccessPolicy             `json:"aibi_dashboard_embedding_access_policy,omitempty"`
-	AibiDashboardEmbeddingApprovedDomains          *ResourceAccountSettingV2AibiDashboardEmbeddingApprovedDomains          `json:"aibi_dashboard_embedding_approved_domains,omitempty"`
-	AutomaticClusterUpdateWorkspace                *ResourceAccountSettingV2AutomaticClusterUpdateWorkspace                `json:"automatic_cluster_update_workspace,omitempty"`
-	BooleanVal                                     *ResourceAccountSettingV2BooleanVal                                     `json:"boolean_val,omitempty"`
-	EffectiveAibiDashboardEmbeddingAccessPolicy    *ResourceAccountSettingV2EffectiveAibiDashboardEmbeddingAccessPolicy    `json:"effective_aibi_dashboard_embedding_access_policy,omitempty"`
-	EffectiveAibiDashboardEmbeddingApprovedDomains *ResourceAccountSettingV2EffectiveAibiDashboardEmbeddingApprovedDomains `json:"effective_aibi_dashboard_embedding_approved_domains,omitempty"`
-	EffectiveAutomaticClusterUpdateWorkspace       *ResourceAccountSettingV2EffectiveAutomaticClusterUpdateWorkspace       `json:"effective_automatic_cluster_update_workspace,omitempty"`
-	EffectiveBooleanVal                            *ResourceAccountSettingV2EffectiveBooleanVal                            `json:"effective_boolean_val,omitempty"`
-	EffectiveIntegerVal                            *ResourceAccountSettingV2EffectiveIntegerVal                            `json:"effective_integer_val,omitempty"`
-	EffectivePersonalCompute                       *ResourceAccountSettingV2EffectivePersonalCompute                       `json:"effective_personal_compute,omitempty"`
-	EffectiveRestrictWorkspaceAdmins               *ResourceAccountSettingV2EffectiveRestrictWorkspaceAdmins               `json:"effective_restrict_workspace_admins,omitempty"`
-	EffectiveStringVal                             *ResourceAccountSettingV2EffectiveStringVal                             `json:"effective_string_val,omitempty"`
-	IntegerVal                                     *ResourceAccountSettingV2IntegerVal                                     `json:"integer_val,omitempty"`
-	Name                                           string                                                                  `json:"name,omitempty"`
-	PersonalCompute                                *ResourceAccountSettingV2PersonalCompute                                `json:"personal_compute,omitempty"`
-	RestrictWorkspaceAdmins                        *ResourceAccountSettingV2RestrictWorkspaceAdmins                        `json:"restrict_workspace_admins,omitempty"`
-	StringVal                                      *ResourceAccountSettingV2StringVal                                      `json:"string_val,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_aibi_dashboard_embedding_access_policy_setting.go b/bundle/internal/tf/schema/resource_aibi_dashboard_embedding_access_policy_setting.go
deleted file mode 100644
index d249da26d49..00000000000
--- a/bundle/internal/tf/schema/resource_aibi_dashboard_embedding_access_policy_setting.go
+++ /dev/null
@@ -1,19 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceAibiDashboardEmbeddingAccessPolicySettingAibiDashboardEmbeddingAccessPolicy struct {
-	AccessPolicyType string `json:"access_policy_type"`
-}
-
-type ResourceAibiDashboardEmbeddingAccessPolicySettingProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceAibiDashboardEmbeddingAccessPolicySetting struct {
-	Etag                               string                                                                               `json:"etag,omitempty"`
-	Id                                 string                                                                               `json:"id,omitempty"`
-	SettingName                        string                                                                               `json:"setting_name,omitempty"`
-	AibiDashboardEmbeddingAccessPolicy *ResourceAibiDashboardEmbeddingAccessPolicySettingAibiDashboardEmbeddingAccessPolicy `json:"aibi_dashboard_embedding_access_policy,omitempty"`
-	ProviderConfig                     *ResourceAibiDashboardEmbeddingAccessPolicySettingProviderConfig                     `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_aibi_dashboard_embedding_approved_domains_setting.go b/bundle/internal/tf/schema/resource_aibi_dashboard_embedding_approved_domains_setting.go
deleted file mode 100644
index 523d622614e..00000000000
--- a/bundle/internal/tf/schema/resource_aibi_dashboard_embedding_approved_domains_setting.go
+++ /dev/null
@@ -1,19 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceAibiDashboardEmbeddingApprovedDomainsSettingAibiDashboardEmbeddingApprovedDomains struct {
-	ApprovedDomains []string `json:"approved_domains"`
-}
-
-type ResourceAibiDashboardEmbeddingApprovedDomainsSettingProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceAibiDashboardEmbeddingApprovedDomainsSetting struct {
-	Etag                                  string                                                                                     `json:"etag,omitempty"`
-	Id                                    string                                                                                     `json:"id,omitempty"`
-	SettingName                           string                                                                                     `json:"setting_name,omitempty"`
-	AibiDashboardEmbeddingApprovedDomains *ResourceAibiDashboardEmbeddingApprovedDomainsSettingAibiDashboardEmbeddingApprovedDomains `json:"aibi_dashboard_embedding_approved_domains,omitempty"`
-	ProviderConfig                        *ResourceAibiDashboardEmbeddingApprovedDomainsSettingProviderConfig                        `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_alert.go b/bundle/internal/tf/schema/resource_alert.go
deleted file mode 100644
index bfd7acc6cbd..00000000000
--- a/bundle/internal/tf/schema/resource_alert.go
+++ /dev/null
@@ -1,51 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceAlertConditionOperandColumn struct {
-	Name string `json:"name"`
-}
-
-type ResourceAlertConditionOperand struct {
-	Column *ResourceAlertConditionOperandColumn `json:"column,omitempty"`
-}
-
-type ResourceAlertConditionThresholdValue struct {
-	BoolValue   bool   `json:"bool_value,omitempty"`
-	DoubleValue int    `json:"double_value,omitempty"`
-	StringValue string `json:"string_value,omitempty"`
-}
-
-type ResourceAlertConditionThreshold struct {
-	Value *ResourceAlertConditionThresholdValue `json:"value,omitempty"`
-}
-
-type ResourceAlertCondition struct {
-	EmptyResultState string                           `json:"empty_result_state,omitempty"`
-	Op               string                           `json:"op"`
-	Operand          *ResourceAlertConditionOperand   `json:"operand,omitempty"`
-	Threshold        *ResourceAlertConditionThreshold `json:"threshold,omitempty"`
-}
-
-type ResourceAlertProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceAlert struct {
-	CreateTime         string                       `json:"create_time,omitempty"`
-	CustomBody         string                       `json:"custom_body,omitempty"`
-	CustomSubject      string                       `json:"custom_subject,omitempty"`
-	DisplayName        string                       `json:"display_name"`
-	Id                 string                       `json:"id,omitempty"`
-	LifecycleState     string                       `json:"lifecycle_state,omitempty"`
-	NotifyOnOk         bool                         `json:"notify_on_ok,omitempty"`
-	OwnerUserName      string                       `json:"owner_user_name,omitempty"`
-	ParentPath         string                       `json:"parent_path,omitempty"`
-	QueryId            string                       `json:"query_id"`
-	SecondsToRetrigger int                          `json:"seconds_to_retrigger,omitempty"`
-	State              string                       `json:"state,omitempty"`
-	TriggerTime        string                       `json:"trigger_time,omitempty"`
-	UpdateTime         string                       `json:"update_time,omitempty"`
-	Condition          *ResourceAlertCondition      `json:"condition,omitempty"`
-	ProviderConfig     *ResourceAlertProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_alert_v2.go b/bundle/internal/tf/schema/resource_alert_v2.go
deleted file mode 100644
index 147c4f5c79f..00000000000
--- a/bundle/internal/tf/schema/resource_alert_v2.go
+++ /dev/null
@@ -1,90 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceAlertV2EffectiveRunAs struct {
-	ServicePrincipalName string `json:"service_principal_name,omitempty"`
-	UserName             string `json:"user_name,omitempty"`
-}
-
-type ResourceAlertV2EvaluationNotificationSubscriptions struct {
-	DestinationId string `json:"destination_id,omitempty"`
-	UserEmail     string `json:"user_email,omitempty"`
-}
-
-type ResourceAlertV2EvaluationNotification struct {
-	EffectiveNotifyOnOk       bool                                                 `json:"effective_notify_on_ok,omitempty"`
-	EffectiveRetriggerSeconds int                                                  `json:"effective_retrigger_seconds,omitempty"`
-	NotifyOnOk                bool                                                 `json:"notify_on_ok,omitempty"`
-	RetriggerSeconds          int                                                  `json:"retrigger_seconds,omitempty"`
-	Subscriptions             []ResourceAlertV2EvaluationNotificationSubscriptions `json:"subscriptions,omitempty"`
-}
-
-type ResourceAlertV2EvaluationSource struct {
-	Aggregation string `json:"aggregation,omitempty"`
-	Display     string `json:"display,omitempty"`
-	Name        string `json:"name"`
-}
-
-type ResourceAlertV2EvaluationThresholdColumn struct {
-	Aggregation string `json:"aggregation,omitempty"`
-	Display     string `json:"display,omitempty"`
-	Name        string `json:"name"`
-}
-
-type ResourceAlertV2EvaluationThresholdValue struct {
-	BoolValue   bool    `json:"bool_value,omitempty"`
-	DoubleValue float64 `json:"double_value,omitempty"`
-	StringValue string  `json:"string_value,omitempty"`
-}
-
-type ResourceAlertV2EvaluationThreshold struct {
-	Column *ResourceAlertV2EvaluationThresholdColumn `json:"column,omitempty"`
-	Value  *ResourceAlertV2EvaluationThresholdValue  `json:"value,omitempty"`
-}
-
-type ResourceAlertV2Evaluation struct {
-	ComparisonOperator string                                 `json:"comparison_operator"`
-	EmptyResultState   string                                 `json:"empty_result_state,omitempty"`
-	LastEvaluatedAt    string                                 `json:"last_evaluated_at,omitempty"`
-	Notification       *ResourceAlertV2EvaluationNotification `json:"notification,omitempty"`
-	Source             *ResourceAlertV2EvaluationSource       `json:"source,omitempty"`
-	State              string                                 `json:"state,omitempty"`
-	Threshold          *ResourceAlertV2EvaluationThreshold    `json:"threshold,omitempty"`
-}
-
-type ResourceAlertV2ProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceAlertV2RunAs struct {
-	ServicePrincipalName string `json:"service_principal_name,omitempty"`
-	UserName             string `json:"user_name,omitempty"`
-}
-
-type ResourceAlertV2Schedule struct {
-	PauseStatus        string `json:"pause_status,omitempty"`
-	QuartzCronSchedule string `json:"quartz_cron_schedule"`
-	TimezoneId         string `json:"timezone_id"`
-}
-
-type ResourceAlertV2 struct {
-	CreateTime        string                         `json:"create_time,omitempty"`
-	CustomDescription string                         `json:"custom_description,omitempty"`
-	CustomSummary     string                         `json:"custom_summary,omitempty"`
-	DisplayName       string                         `json:"display_name"`
-	EffectiveRunAs    *ResourceAlertV2EffectiveRunAs `json:"effective_run_as,omitempty"`
-	Evaluation        *ResourceAlertV2Evaluation     `json:"evaluation,omitempty"`
-	Id                string                         `json:"id,omitempty"`
-	LifecycleState    string                         `json:"lifecycle_state,omitempty"`
-	OwnerUserName     string                         `json:"owner_user_name,omitempty"`
-	ParentPath        string                         `json:"parent_path,omitempty"`
-	ProviderConfig    *ResourceAlertV2ProviderConfig `json:"provider_config,omitempty"`
-	PurgeOnDelete     bool                           `json:"purge_on_delete,omitempty"`
-	QueryText         string                         `json:"query_text"`
-	RunAs             *ResourceAlertV2RunAs          `json:"run_as,omitempty"`
-	RunAsUserName     string                         `json:"run_as_user_name,omitempty"`
-	Schedule          *ResourceAlertV2Schedule       `json:"schedule,omitempty"`
-	UpdateTime        string                         `json:"update_time,omitempty"`
-	WarehouseId       string                         `json:"warehouse_id"`
-}
diff --git a/bundle/internal/tf/schema/resource_app.go b/bundle/internal/tf/schema/resource_app.go
deleted file mode 100644
index 02a1c2c3a6f..00000000000
--- a/bundle/internal/tf/schema/resource_app.go
+++ /dev/null
@@ -1,224 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceAppActiveDeploymentDeploymentArtifacts struct {
-	SourceCodePath string `json:"source_code_path,omitempty"`
-}
-
-type ResourceAppActiveDeploymentEnvVars struct {
-	Name      string `json:"name,omitempty"`
-	Value     string `json:"value,omitempty"`
-	ValueFrom string `json:"value_from,omitempty"`
-}
-
-type ResourceAppActiveDeploymentGitSourceGitRepository struct {
-	Provider string `json:"provider"`
-	Url      string `json:"url"`
-}
-
-type ResourceAppActiveDeploymentGitSource struct {
-	Branch         string                                             `json:"branch,omitempty"`
-	Commit         string                                             `json:"commit,omitempty"`
-	GitRepository  *ResourceAppActiveDeploymentGitSourceGitRepository `json:"git_repository,omitempty"`
-	ResolvedCommit string                                             `json:"resolved_commit,omitempty"`
-	SourceCodePath string                                             `json:"source_code_path,omitempty"`
-	Tag            string                                             `json:"tag,omitempty"`
-}
-
-type ResourceAppActiveDeploymentStatus struct {
-	Message string `json:"message,omitempty"`
-	State   string `json:"state,omitempty"`
-}
-
-type ResourceAppActiveDeployment struct {
-	Command             []string                                        `json:"command,omitempty"`
-	CreateTime          string                                          `json:"create_time,omitempty"`
-	Creator             string                                          `json:"creator,omitempty"`
-	DeploymentArtifacts *ResourceAppActiveDeploymentDeploymentArtifacts `json:"deployment_artifacts,omitempty"`
-	DeploymentId        string                                          `json:"deployment_id,omitempty"`
-	EnvVars             []ResourceAppActiveDeploymentEnvVars            `json:"env_vars,omitempty"`
-	GitSource           *ResourceAppActiveDeploymentGitSource           `json:"git_source,omitempty"`
-	Mode                string                                          `json:"mode,omitempty"`
-	SourceCodePath      string                                          `json:"source_code_path,omitempty"`
-	Status              *ResourceAppActiveDeploymentStatus              `json:"status,omitempty"`
-	UpdateTime          string                                          `json:"update_time,omitempty"`
-}
-
-type ResourceAppAppStatus struct {
-	Message string `json:"message,omitempty"`
-	State   string `json:"state,omitempty"`
-}
-
-type ResourceAppComputeStatus struct {
-	ActiveInstances int    `json:"active_instances,omitempty"`
-	Message         string `json:"message,omitempty"`
-	State           string `json:"state,omitempty"`
-}
-
-type ResourceAppGitRepository struct {
-	Provider string `json:"provider"`
-	Url      string `json:"url"`
-}
-
-type ResourceAppPendingDeploymentDeploymentArtifacts struct {
-	SourceCodePath string `json:"source_code_path,omitempty"`
-}
-
-type ResourceAppPendingDeploymentEnvVars struct {
-	Name      string `json:"name,omitempty"`
-	Value     string `json:"value,omitempty"`
-	ValueFrom string `json:"value_from,omitempty"`
-}
-
-type ResourceAppPendingDeploymentGitSourceGitRepository struct {
-	Provider string `json:"provider"`
-	Url      string `json:"url"`
-}
-
-type ResourceAppPendingDeploymentGitSource struct {
-	Branch         string                                              `json:"branch,omitempty"`
-	Commit         string                                              `json:"commit,omitempty"`
-	GitRepository  *ResourceAppPendingDeploymentGitSourceGitRepository `json:"git_repository,omitempty"`
-	ResolvedCommit string                                              `json:"resolved_commit,omitempty"`
-	SourceCodePath string                                              `json:"source_code_path,omitempty"`
-	Tag            string                                              `json:"tag,omitempty"`
-}
-
-type ResourceAppPendingDeploymentStatus struct {
-	Message string `json:"message,omitempty"`
-	State   string `json:"state,omitempty"`
-}
-
-type ResourceAppPendingDeployment struct {
-	Command             []string                                         `json:"command,omitempty"`
-	CreateTime          string                                           `json:"create_time,omitempty"`
-	Creator             string                                           `json:"creator,omitempty"`
-	DeploymentArtifacts *ResourceAppPendingDeploymentDeploymentArtifacts `json:"deployment_artifacts,omitempty"`
-	DeploymentId        string                                           `json:"deployment_id,omitempty"`
-	EnvVars             []ResourceAppPendingDeploymentEnvVars            `json:"env_vars,omitempty"`
-	GitSource           *ResourceAppPendingDeploymentGitSource           `json:"git_source,omitempty"`
-	Mode                string                                           `json:"mode,omitempty"`
-	SourceCodePath      string                                           `json:"source_code_path,omitempty"`
-	Status              *ResourceAppPendingDeploymentStatus              `json:"status,omitempty"`
-	UpdateTime          string                                           `json:"update_time,omitempty"`
-}
-
-type ResourceAppProviderConfig struct {
-	WorkspaceId string `json:"workspace_id,omitempty"`
-}
-
-type ResourceAppResourcesApp struct {
-	Name       string `json:"name,omitempty"`
-	Permission string `json:"permission,omitempty"`
-}
-
-type ResourceAppResourcesDatabase struct {
-	DatabaseName string `json:"database_name"`
-	InstanceName string `json:"instance_name"`
-	Permission   string `json:"permission"`
-}
-
-type ResourceAppResourcesExperiment struct {
-	ExperimentId string `json:"experiment_id"`
-	Permission   string `json:"permission"`
-}
-
-type ResourceAppResourcesGenieSpace struct {
-	Name       string `json:"name"`
-	Permission string `json:"permission"`
-	SpaceId    string `json:"space_id"`
-}
-
-type ResourceAppResourcesJob struct {
-	Id         string `json:"id"`
-	Permission string `json:"permission"`
-}
-
-type ResourceAppResourcesPostgres struct {
-	Branch     string `json:"branch,omitempty"`
-	Database   string `json:"database,omitempty"`
-	Permission string `json:"permission,omitempty"`
-}
-
-type ResourceAppResourcesSecret struct {
-	Key        string `json:"key"`
-	Permission string `json:"permission"`
-	Scope      string `json:"scope"`
-}
-
-type ResourceAppResourcesServingEndpoint struct {
-	Name       string `json:"name"`
-	Permission string `json:"permission"`
-}
-
-type ResourceAppResourcesSqlWarehouse struct {
-	Id         string `json:"id"`
-	Permission string `json:"permission"`
-}
-
-type ResourceAppResourcesUcSecurable struct {
-	Permission        string `json:"permission"`
-	SecurableFullName string `json:"securable_full_name"`
-	SecurableKind     string `json:"securable_kind,omitempty"`
-	SecurableType     string `json:"securable_type"`
-}
-
-type ResourceAppResources struct {
-	App             *ResourceAppResourcesApp             `json:"app,omitempty"`
-	Database        *ResourceAppResourcesDatabase        `json:"database,omitempty"`
-	Description     string                               `json:"description,omitempty"`
-	Experiment      *ResourceAppResourcesExperiment      `json:"experiment,omitempty"`
-	GenieSpace      *ResourceAppResourcesGenieSpace      `json:"genie_space,omitempty"`
-	Job             *ResourceAppResourcesJob             `json:"job,omitempty"`
-	Name            string                               `json:"name"`
-	Postgres        *ResourceAppResourcesPostgres        `json:"postgres,omitempty"`
-	Secret          *ResourceAppResourcesSecret          `json:"secret,omitempty"`
-	ServingEndpoint *ResourceAppResourcesServingEndpoint `json:"serving_endpoint,omitempty"`
-	SqlWarehouse    *ResourceAppResourcesSqlWarehouse    `json:"sql_warehouse,omitempty"`
-	UcSecurable     *ResourceAppResourcesUcSecurable     `json:"uc_securable,omitempty"`
-}
-
-type ResourceAppTelemetryExportDestinationsUnityCatalog struct {
-	LogsTable    string `json:"logs_table"`
-	MetricsTable string `json:"metrics_table"`
-	TracesTable  string `json:"traces_table"`
-}
-
-type ResourceAppTelemetryExportDestinations struct {
-	UnityCatalog *ResourceAppTelemetryExportDestinationsUnityCatalog `json:"unity_catalog,omitempty"`
-}
-
-type ResourceApp struct {
-	ActiveDeployment            *ResourceAppActiveDeployment             `json:"active_deployment,omitempty"`
-	AppStatus                   *ResourceAppAppStatus                    `json:"app_status,omitempty"`
-	BudgetPolicyId              string                                   `json:"budget_policy_id,omitempty"`
-	ComputeSize                 string                                   `json:"compute_size,omitempty"`
-	ComputeStatus               *ResourceAppComputeStatus                `json:"compute_status,omitempty"`
-	CreateTime                  string                                   `json:"create_time,omitempty"`
-	Creator                     string                                   `json:"creator,omitempty"`
-	DefaultSourceCodePath       string                                   `json:"default_source_code_path,omitempty"`
-	Description                 string                                   `json:"description,omitempty"`
-	EffectiveBudgetPolicyId     string                                   `json:"effective_budget_policy_id,omitempty"`
-	EffectiveUsagePolicyId      string                                   `json:"effective_usage_policy_id,omitempty"`
-	EffectiveUserApiScopes      []string                                 `json:"effective_user_api_scopes,omitempty"`
-	GitRepository               *ResourceAppGitRepository                `json:"git_repository,omitempty"`
-	Id                          string                                   `json:"id,omitempty"`
-	Name                        string                                   `json:"name"`
-	NoCompute                   bool                                     `json:"no_compute,omitempty"`
-	Oauth2AppClientId           string                                   `json:"oauth2_app_client_id,omitempty"`
-	Oauth2AppIntegrationId      string                                   `json:"oauth2_app_integration_id,omitempty"`
-	PendingDeployment           *ResourceAppPendingDeployment            `json:"pending_deployment,omitempty"`
-	ProviderConfig              *ResourceAppProviderConfig               `json:"provider_config,omitempty"`
-	Resources                   []ResourceAppResources                   `json:"resources,omitempty"`
-	ServicePrincipalClientId    string                                   `json:"service_principal_client_id,omitempty"`
-	ServicePrincipalId          int                                      `json:"service_principal_id,omitempty"`
-	ServicePrincipalName        string                                   `json:"service_principal_name,omitempty"`
-	Space                       string                                   `json:"space,omitempty"`
-	TelemetryExportDestinations []ResourceAppTelemetryExportDestinations `json:"telemetry_export_destinations,omitempty"`
-	UpdateTime                  string                                   `json:"update_time,omitempty"`
-	Updater                     string                                   `json:"updater,omitempty"`
-	Url                         string                                   `json:"url,omitempty"`
-	UsagePolicyId               string                                   `json:"usage_policy_id,omitempty"`
-	UserApiScopes               []string                                 `json:"user_api_scopes,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_app_space.go b/bundle/internal/tf/schema/resource_app_space.go
deleted file mode 100644
index a05ee123585..00000000000
--- a/bundle/internal/tf/schema/resource_app_space.go
+++ /dev/null
@@ -1,103 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceAppSpaceProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceAppSpaceResourcesApp struct {
-	Name       string `json:"name,omitempty"`
-	Permission string `json:"permission,omitempty"`
-}
-
-type ResourceAppSpaceResourcesDatabase struct {
-	DatabaseName string `json:"database_name"`
-	InstanceName string `json:"instance_name"`
-	Permission   string `json:"permission"`
-}
-
-type ResourceAppSpaceResourcesExperiment struct {
-	ExperimentId string `json:"experiment_id"`
-	Permission   string `json:"permission"`
-}
-
-type ResourceAppSpaceResourcesGenieSpace struct {
-	Name       string `json:"name"`
-	Permission string `json:"permission"`
-	SpaceId    string `json:"space_id"`
-}
-
-type ResourceAppSpaceResourcesJob struct {
-	Id         string `json:"id"`
-	Permission string `json:"permission"`
-}
-
-type ResourceAppSpaceResourcesPostgres struct {
-	Branch     string `json:"branch,omitempty"`
-	Database   string `json:"database,omitempty"`
-	Permission string `json:"permission,omitempty"`
-}
-
-type ResourceAppSpaceResourcesSecret struct {
-	Key        string `json:"key"`
-	Permission string `json:"permission"`
-	Scope      string `json:"scope"`
-}
-
-type ResourceAppSpaceResourcesServingEndpoint struct {
-	Name       string `json:"name"`
-	Permission string `json:"permission"`
-}
-
-type ResourceAppSpaceResourcesSqlWarehouse struct {
-	Id         string `json:"id"`
-	Permission string `json:"permission"`
-}
-
-type ResourceAppSpaceResourcesUcSecurable struct {
-	Permission        string `json:"permission"`
-	SecurableFullName string `json:"securable_full_name"`
-	SecurableKind     string `json:"securable_kind,omitempty"`
-	SecurableType     string `json:"securable_type"`
-}
-
-type ResourceAppSpaceResources struct {
-	App             *ResourceAppSpaceResourcesApp             `json:"app,omitempty"`
-	Database        *ResourceAppSpaceResourcesDatabase        `json:"database,omitempty"`
-	Description     string                                    `json:"description,omitempty"`
-	Experiment      *ResourceAppSpaceResourcesExperiment      `json:"experiment,omitempty"`
-	GenieSpace      *ResourceAppSpaceResourcesGenieSpace      `json:"genie_space,omitempty"`
-	Job             *ResourceAppSpaceResourcesJob             `json:"job,omitempty"`
-	Name            string                                    `json:"name"`
-	Postgres        *ResourceAppSpaceResourcesPostgres        `json:"postgres,omitempty"`
-	Secret          *ResourceAppSpaceResourcesSecret          `json:"secret,omitempty"`
-	ServingEndpoint *ResourceAppSpaceResourcesServingEndpoint `json:"serving_endpoint,omitempty"`
-	SqlWarehouse    *ResourceAppSpaceResourcesSqlWarehouse    `json:"sql_warehouse,omitempty"`
-	UcSecurable     *ResourceAppSpaceResourcesUcSecurable     `json:"uc_securable,omitempty"`
-}
-
-type ResourceAppSpaceStatus struct {
-	Message string `json:"message,omitempty"`
-	State   string `json:"state,omitempty"`
-}
-
-type ResourceAppSpace struct {
-	CreateTime               string                          `json:"create_time,omitempty"`
-	Creator                  string                          `json:"creator,omitempty"`
-	Description              string                          `json:"description,omitempty"`
-	EffectiveUsagePolicyId   string                          `json:"effective_usage_policy_id,omitempty"`
-	EffectiveUserApiScopes   []string                        `json:"effective_user_api_scopes,omitempty"`
-	Id                       string                          `json:"id,omitempty"`
-	Name                     string                          `json:"name"`
-	ProviderConfig           *ResourceAppSpaceProviderConfig `json:"provider_config,omitempty"`
-	Resources                []ResourceAppSpaceResources     `json:"resources,omitempty"`
-	ServicePrincipalClientId string                          `json:"service_principal_client_id,omitempty"`
-	ServicePrincipalId       int                             `json:"service_principal_id,omitempty"`
-	ServicePrincipalName     string                          `json:"service_principal_name,omitempty"`
-	Status                   *ResourceAppSpaceStatus         `json:"status,omitempty"`
-	UpdateTime               string                          `json:"update_time,omitempty"`
-	Updater                  string                          `json:"updater,omitempty"`
-	UsagePolicyId            string                          `json:"usage_policy_id,omitempty"`
-	UserApiScopes            []string                        `json:"user_api_scopes,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_apps_settings_custom_template.go b/bundle/internal/tf/schema/resource_apps_settings_custom_template.go
deleted file mode 100644
index 3c89f06fd8a..00000000000
--- a/bundle/internal/tf/schema/resource_apps_settings_custom_template.go
+++ /dev/null
@@ -1,61 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceAppsSettingsCustomTemplateManifestResourceSpecsExperimentSpec struct {
-	Permission string `json:"permission"`
-}
-
-type ResourceAppsSettingsCustomTemplateManifestResourceSpecsJobSpec struct {
-	Permission string `json:"permission"`
-}
-
-type ResourceAppsSettingsCustomTemplateManifestResourceSpecsSecretSpec struct {
-	Permission string `json:"permission"`
-}
-
-type ResourceAppsSettingsCustomTemplateManifestResourceSpecsServingEndpointSpec struct {
-	Permission string `json:"permission"`
-}
-
-type ResourceAppsSettingsCustomTemplateManifestResourceSpecsSqlWarehouseSpec struct {
-	Permission string `json:"permission"`
-}
-
-type ResourceAppsSettingsCustomTemplateManifestResourceSpecsUcSecurableSpec struct {
-	Permission    string `json:"permission"`
-	SecurableType string `json:"securable_type"`
-}
-
-type ResourceAppsSettingsCustomTemplateManifestResourceSpecs struct {
-	Description         string                                                                      `json:"description,omitempty"`
-	ExperimentSpec      *ResourceAppsSettingsCustomTemplateManifestResourceSpecsExperimentSpec      `json:"experiment_spec,omitempty"`
-	JobSpec             *ResourceAppsSettingsCustomTemplateManifestResourceSpecsJobSpec             `json:"job_spec,omitempty"`
-	Name                string                                                                      `json:"name"`
-	SecretSpec          *ResourceAppsSettingsCustomTemplateManifestResourceSpecsSecretSpec          `json:"secret_spec,omitempty"`
-	ServingEndpointSpec *ResourceAppsSettingsCustomTemplateManifestResourceSpecsServingEndpointSpec `json:"serving_endpoint_spec,omitempty"`
-	SqlWarehouseSpec    *ResourceAppsSettingsCustomTemplateManifestResourceSpecsSqlWarehouseSpec    `json:"sql_warehouse_spec,omitempty"`
-	UcSecurableSpec     *ResourceAppsSettingsCustomTemplateManifestResourceSpecsUcSecurableSpec     `json:"uc_securable_spec,omitempty"`
-}
-
-type ResourceAppsSettingsCustomTemplateManifest struct {
-	Description   string                                                    `json:"description,omitempty"`
-	Name          string                                                    `json:"name"`
-	ResourceSpecs []ResourceAppsSettingsCustomTemplateManifestResourceSpecs `json:"resource_specs,omitempty"`
-	Version       int                                                       `json:"version"`
-}
-
-type ResourceAppsSettingsCustomTemplateProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceAppsSettingsCustomTemplate struct {
-	Creator        string                                            `json:"creator,omitempty"`
-	Description    string                                            `json:"description,omitempty"`
-	GitProvider    string                                            `json:"git_provider"`
-	GitRepo        string                                            `json:"git_repo"`
-	Manifest       *ResourceAppsSettingsCustomTemplateManifest       `json:"manifest,omitempty"`
-	Name           string                                            `json:"name"`
-	Path           string                                            `json:"path"`
-	ProviderConfig *ResourceAppsSettingsCustomTemplateProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_apps_space.go b/bundle/internal/tf/schema/resource_apps_space.go
deleted file mode 100644
index a107c3974c8..00000000000
--- a/bundle/internal/tf/schema/resource_apps_space.go
+++ /dev/null
@@ -1,91 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceAppsSpaceProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceAppsSpaceResourcesDatabase struct {
-	DatabaseName string `json:"database_name"`
-	InstanceName string `json:"instance_name"`
-	Permission   string `json:"permission"`
-}
-
-type ResourceAppsSpaceResourcesExperiment struct {
-	ExperimentId string `json:"experiment_id"`
-	Permission   string `json:"permission"`
-}
-
-type ResourceAppsSpaceResourcesGenieSpace struct {
-	Name       string `json:"name"`
-	Permission string `json:"permission"`
-	SpaceId    string `json:"space_id"`
-}
-
-type ResourceAppsSpaceResourcesJob struct {
-	Id         string `json:"id"`
-	Permission string `json:"permission"`
-}
-
-type ResourceAppsSpaceResourcesSecret struct {
-	Key        string `json:"key"`
-	Permission string `json:"permission"`
-	Scope      string `json:"scope"`
-}
-
-type ResourceAppsSpaceResourcesServingEndpoint struct {
-	Name       string `json:"name"`
-	Permission string `json:"permission"`
-}
-
-type ResourceAppsSpaceResourcesSqlWarehouse struct {
-	Id         string `json:"id"`
-	Permission string `json:"permission"`
-}
-
-type ResourceAppsSpaceResourcesUcSecurable struct {
-	Permission        string `json:"permission"`
-	SecurableFullName string `json:"securable_full_name"`
-	SecurableType     string `json:"securable_type"`
-}
-
-type ResourceAppsSpaceResources struct {
-	Database        *ResourceAppsSpaceResourcesDatabase        `json:"database,omitempty"`
-	Description     string                                     `json:"description,omitempty"`
-	Experiment      *ResourceAppsSpaceResourcesExperiment      `json:"experiment,omitempty"`
-	GenieSpace      *ResourceAppsSpaceResourcesGenieSpace      `json:"genie_space,omitempty"`
-	Job             *ResourceAppsSpaceResourcesJob             `json:"job,omitempty"`
-	Name            string                                     `json:"name"`
-	Secret          *ResourceAppsSpaceResourcesSecret          `json:"secret,omitempty"`
-	ServingEndpoint *ResourceAppsSpaceResourcesServingEndpoint `json:"serving_endpoint,omitempty"`
-	SqlWarehouse    *ResourceAppsSpaceResourcesSqlWarehouse    `json:"sql_warehouse,omitempty"`
-	UcSecurable     *ResourceAppsSpaceResourcesUcSecurable     `json:"uc_securable,omitempty"`
-}
-
-type ResourceAppsSpaceStatus struct {
-	Message string `json:"message,omitempty"`
-	State   string `json:"state,omitempty"`
-}
-
-type ResourceAppsSpace struct {
-	CreateTime               string                           `json:"create_time,omitempty"`
-	Creator                  string                           `json:"creator,omitempty"`
-	Description              string                           `json:"description,omitempty"`
-	EffectiveUsagePolicyId   string                           `json:"effective_usage_policy_id,omitempty"`
-	EffectiveUserApiScopes   []string                         `json:"effective_user_api_scopes,omitempty"`
-	Id                       string                           `json:"id,omitempty"`
-	Name                     string                           `json:"name,omitempty"`
-	Oauth2AppClientId        string                           `json:"oauth2_app_client_id,omitempty"`
-	Oauth2AppIntegrationId   string                           `json:"oauth2_app_integration_id,omitempty"`
-	ProviderConfig           *ResourceAppsSpaceProviderConfig `json:"provider_config,omitempty"`
-	Resources                []ResourceAppsSpaceResources     `json:"resources,omitempty"`
-	ServicePrincipalClientId string                           `json:"service_principal_client_id,omitempty"`
-	ServicePrincipalId       int                              `json:"service_principal_id,omitempty"`
-	ServicePrincipalName     string                           `json:"service_principal_name,omitempty"`
-	Status                   *ResourceAppsSpaceStatus         `json:"status,omitempty"`
-	UpdateTime               string                           `json:"update_time,omitempty"`
-	Updater                  string                           `json:"updater,omitempty"`
-	UsagePolicyId            string                           `json:"usage_policy_id,omitempty"`
-	UserApiScopes            []string                         `json:"user_api_scopes,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_artifact_allowlist.go b/bundle/internal/tf/schema/resource_artifact_allowlist.go
deleted file mode 100644
index a66c720a76a..00000000000
--- a/bundle/internal/tf/schema/resource_artifact_allowlist.go
+++ /dev/null
@@ -1,22 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceArtifactAllowlistArtifactMatcher struct {
-	Artifact  string `json:"artifact"`
-	MatchType string `json:"match_type"`
-}
-
-type ResourceArtifactAllowlistProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceArtifactAllowlist struct {
-	ArtifactType    string                                     `json:"artifact_type"`
-	CreatedAt       int                                        `json:"created_at,omitempty"`
-	CreatedBy       string                                     `json:"created_by,omitempty"`
-	Id              string                                     `json:"id,omitempty"`
-	MetastoreId     string                                     `json:"metastore_id,omitempty"`
-	ArtifactMatcher []ResourceArtifactAllowlistArtifactMatcher `json:"artifact_matcher,omitempty"`
-	ProviderConfig  *ResourceArtifactAllowlistProviderConfig   `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_automatic_cluster_update_workspace_setting.go b/bundle/internal/tf/schema/resource_automatic_cluster_update_workspace_setting.go
deleted file mode 100644
index 3ce38b1d028..00000000000
--- a/bundle/internal/tf/schema/resource_automatic_cluster_update_workspace_setting.go
+++ /dev/null
@@ -1,38 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceAutomaticClusterUpdateWorkspaceSettingAutomaticClusterUpdateWorkspaceMaintenanceWindowWeekDayBasedScheduleWindowStartTime struct {
-	Hours   int `json:"hours"`
-	Minutes int `json:"minutes"`
-}
-
-type ResourceAutomaticClusterUpdateWorkspaceSettingAutomaticClusterUpdateWorkspaceMaintenanceWindowWeekDayBasedSchedule struct {
-	DayOfWeek       string                                                                                                                             `json:"day_of_week"`
-	Frequency       string                                                                                                                             `json:"frequency"`
-	WindowStartTime *ResourceAutomaticClusterUpdateWorkspaceSettingAutomaticClusterUpdateWorkspaceMaintenanceWindowWeekDayBasedScheduleWindowStartTime `json:"window_start_time,omitempty"`
-}
-
-type ResourceAutomaticClusterUpdateWorkspaceSettingAutomaticClusterUpdateWorkspaceMaintenanceWindow struct {
-	WeekDayBasedSchedule *ResourceAutomaticClusterUpdateWorkspaceSettingAutomaticClusterUpdateWorkspaceMaintenanceWindowWeekDayBasedSchedule `json:"week_day_based_schedule,omitempty"`
-}
-
-type ResourceAutomaticClusterUpdateWorkspaceSettingAutomaticClusterUpdateWorkspace struct {
-	CanToggle                       bool                                                                                            `json:"can_toggle,omitempty"`
-	Enabled                         bool                                                                                            `json:"enabled"`
-	EnablementDetails               []any                                                                                           `json:"enablement_details,omitempty"`
-	RestartEvenIfNoUpdatesAvailable bool                                                                                            `json:"restart_even_if_no_updates_available,omitempty"`
-	MaintenanceWindow               *ResourceAutomaticClusterUpdateWorkspaceSettingAutomaticClusterUpdateWorkspaceMaintenanceWindow `json:"maintenance_window,omitempty"`
-}
-
-type ResourceAutomaticClusterUpdateWorkspaceSettingProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceAutomaticClusterUpdateWorkspaceSetting struct {
-	Etag                            string                                                                         `json:"etag,omitempty"`
-	Id                              string                                                                         `json:"id,omitempty"`
-	SettingName                     string                                                                         `json:"setting_name,omitempty"`
-	AutomaticClusterUpdateWorkspace *ResourceAutomaticClusterUpdateWorkspaceSettingAutomaticClusterUpdateWorkspace `json:"automatic_cluster_update_workspace,omitempty"`
-	ProviderConfig                  *ResourceAutomaticClusterUpdateWorkspaceSettingProviderConfig                  `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_aws_s3_mount.go b/bundle/internal/tf/schema/resource_aws_s3_mount.go
deleted file mode 100644
index f69f10193be..00000000000
--- a/bundle/internal/tf/schema/resource_aws_s3_mount.go
+++ /dev/null
@@ -1,12 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceAwsS3Mount struct {
-	ClusterId       string `json:"cluster_id,omitempty"`
-	Id              string `json:"id,omitempty"`
-	InstanceProfile string `json:"instance_profile,omitempty"`
-	MountName       string `json:"mount_name"`
-	S3BucketName    string `json:"s3_bucket_name"`
-	Source          string `json:"source,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_azure_adls_gen1_mount.go b/bundle/internal/tf/schema/resource_azure_adls_gen1_mount.go
deleted file mode 100644
index b50b1a619d3..00000000000
--- a/bundle/internal/tf/schema/resource_azure_adls_gen1_mount.go
+++ /dev/null
@@ -1,17 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceAzureAdlsGen1Mount struct {
-	ClientId            string `json:"client_id"`
-	ClientSecretKey     string `json:"client_secret_key"`
-	ClientSecretScope   string `json:"client_secret_scope"`
-	ClusterId           string `json:"cluster_id,omitempty"`
-	Directory           string `json:"directory,omitempty"`
-	Id                  string `json:"id,omitempty"`
-	MountName           string `json:"mount_name"`
-	Source              string `json:"source,omitempty"`
-	SparkConfPrefix     string `json:"spark_conf_prefix,omitempty"`
-	StorageResourceName string `json:"storage_resource_name"`
-	TenantId            string `json:"tenant_id"`
-}
diff --git a/bundle/internal/tf/schema/resource_azure_adls_gen2_mount.go b/bundle/internal/tf/schema/resource_azure_adls_gen2_mount.go
deleted file mode 100644
index 6e2ea08e82f..00000000000
--- a/bundle/internal/tf/schema/resource_azure_adls_gen2_mount.go
+++ /dev/null
@@ -1,19 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceAzureAdlsGen2Mount struct {
-	ClientId             string `json:"client_id"`
-	ClientSecretKey      string `json:"client_secret_key"`
-	ClientSecretScope    string `json:"client_secret_scope"`
-	ClusterId            string `json:"cluster_id,omitempty"`
-	ContainerName        string `json:"container_name"`
-	Directory            string `json:"directory,omitempty"`
-	Environment          string `json:"environment,omitempty"`
-	Id                   string `json:"id,omitempty"`
-	InitializeFileSystem bool   `json:"initialize_file_system"`
-	MountName            string `json:"mount_name"`
-	Source               string `json:"source,omitempty"`
-	StorageAccountName   string `json:"storage_account_name"`
-	TenantId             string `json:"tenant_id"`
-}
diff --git a/bundle/internal/tf/schema/resource_azure_blob_mount.go b/bundle/internal/tf/schema/resource_azure_blob_mount.go
deleted file mode 100644
index f0720586dfc..00000000000
--- a/bundle/internal/tf/schema/resource_azure_blob_mount.go
+++ /dev/null
@@ -1,16 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceAzureBlobMount struct {
-	AuthType           string `json:"auth_type"`
-	ClusterId          string `json:"cluster_id,omitempty"`
-	ContainerName      string `json:"container_name"`
-	Directory          string `json:"directory,omitempty"`
-	Id                 string `json:"id,omitempty"`
-	MountName          string `json:"mount_name"`
-	Source             string `json:"source,omitempty"`
-	StorageAccountName string `json:"storage_account_name"`
-	TokenSecretKey     string `json:"token_secret_key"`
-	TokenSecretScope   string `json:"token_secret_scope"`
-}
diff --git a/bundle/internal/tf/schema/resource_budget.go b/bundle/internal/tf/schema/resource_budget.go
deleted file mode 100644
index 5566eb939a7..00000000000
--- a/bundle/internal/tf/schema/resource_budget.go
+++ /dev/null
@@ -1,49 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceBudgetAlertConfigurationsActionConfigurations struct {
-	ActionConfigurationId string `json:"action_configuration_id,omitempty"`
-	ActionType            string `json:"action_type,omitempty"`
-	Target                string `json:"target,omitempty"`
-}
-
-type ResourceBudgetAlertConfigurations struct {
-	AlertConfigurationId string                                                  `json:"alert_configuration_id,omitempty"`
-	QuantityThreshold    string                                                  `json:"quantity_threshold,omitempty"`
-	QuantityType         string                                                  `json:"quantity_type,omitempty"`
-	TimePeriod           string                                                  `json:"time_period,omitempty"`
-	TriggerType          string                                                  `json:"trigger_type,omitempty"`
-	ActionConfigurations []ResourceBudgetAlertConfigurationsActionConfigurations `json:"action_configurations,omitempty"`
-}
-
-type ResourceBudgetFilterTagsValue struct {
-	Operator string   `json:"operator,omitempty"`
-	Values   []string `json:"values,omitempty"`
-}
-
-type ResourceBudgetFilterTags struct {
-	Key   string                         `json:"key,omitempty"`
-	Value *ResourceBudgetFilterTagsValue `json:"value,omitempty"`
-}
-
-type ResourceBudgetFilterWorkspaceId struct {
-	Operator string `json:"operator,omitempty"`
-	Values   []int  `json:"values,omitempty"`
-}
-
-type ResourceBudgetFilter struct {
-	Tags        []ResourceBudgetFilterTags       `json:"tags,omitempty"`
-	WorkspaceId *ResourceBudgetFilterWorkspaceId `json:"workspace_id,omitempty"`
-}
-
-type ResourceBudget struct {
-	AccountId             string                              `json:"account_id,omitempty"`
-	BudgetConfigurationId string                              `json:"budget_configuration_id,omitempty"`
-	CreateTime            int                                 `json:"create_time,omitempty"`
-	DisplayName           string                              `json:"display_name,omitempty"`
-	Id                    string                              `json:"id,omitempty"`
-	UpdateTime            int                                 `json:"update_time,omitempty"`
-	AlertConfigurations   []ResourceBudgetAlertConfigurations `json:"alert_configurations,omitempty"`
-	Filter                *ResourceBudgetFilter               `json:"filter,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_budget_policy.go b/bundle/internal/tf/schema/resource_budget_policy.go
deleted file mode 100644
index 914572c4763..00000000000
--- a/bundle/internal/tf/schema/resource_budget_policy.go
+++ /dev/null
@@ -1,15 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceBudgetPolicyCustomTags struct {
-	Key   string `json:"key"`
-	Value string `json:"value,omitempty"`
-}
-
-type ResourceBudgetPolicy struct {
-	BindingWorkspaceIds []int                            `json:"binding_workspace_ids,omitempty"`
-	CustomTags          []ResourceBudgetPolicyCustomTags `json:"custom_tags,omitempty"`
-	PolicyId            string                           `json:"policy_id,omitempty"`
-	PolicyName          string                           `json:"policy_name,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_catalog.go b/bundle/internal/tf/schema/resource_catalog.go
deleted file mode 100644
index 1245cded7a6..00000000000
--- a/bundle/internal/tf/schema/resource_catalog.go
+++ /dev/null
@@ -1,59 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceCatalogEffectivePredictiveOptimizationFlag struct {
-	InheritedFromName string `json:"inherited_from_name,omitempty"`
-	InheritedFromType string `json:"inherited_from_type,omitempty"`
-	Value             string `json:"value"`
-}
-
-type ResourceCatalogManagedEncryptionSettingsAzureEncryptionSettings struct {
-	AzureCmkAccessConnectorId string `json:"azure_cmk_access_connector_id,omitempty"`
-	AzureCmkManagedIdentityId string `json:"azure_cmk_managed_identity_id,omitempty"`
-	AzureTenantId             string `json:"azure_tenant_id"`
-}
-
-type ResourceCatalogManagedEncryptionSettings struct {
-	AzureKeyVaultKeyId      string                                                           `json:"azure_key_vault_key_id,omitempty"`
-	CustomerManagedKeyId    string                                                           `json:"customer_managed_key_id,omitempty"`
-	AzureEncryptionSettings *ResourceCatalogManagedEncryptionSettingsAzureEncryptionSettings `json:"azure_encryption_settings,omitempty"`
-}
-
-type ResourceCatalogProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceCatalogProvisioningInfo struct {
-	State string `json:"state,omitempty"`
-}
-
-type ResourceCatalog struct {
-	BrowseOnly                          bool                                                `json:"browse_only,omitempty"`
-	CatalogType                         string                                              `json:"catalog_type,omitempty"`
-	Comment                             string                                              `json:"comment,omitempty"`
-	ConnectionName                      string                                              `json:"connection_name,omitempty"`
-	CreatedAt                           int                                                 `json:"created_at,omitempty"`
-	CreatedBy                           string                                              `json:"created_by,omitempty"`
-	EnablePredictiveOptimization        string                                              `json:"enable_predictive_optimization,omitempty"`
-	ForceDestroy                        bool                                                `json:"force_destroy,omitempty"`
-	FullName                            string                                              `json:"full_name,omitempty"`
-	Id                                  string                                              `json:"id,omitempty"`
-	IsolationMode                       string                                              `json:"isolation_mode,omitempty"`
-	MetastoreId                         string                                              `json:"metastore_id,omitempty"`
-	Name                                string                                              `json:"name,omitempty"`
-	Options                             map[string]string                                   `json:"options,omitempty"`
-	Owner                               string                                              `json:"owner,omitempty"`
-	Properties                          map[string]string                                   `json:"properties,omitempty"`
-	ProviderName                        string                                              `json:"provider_name,omitempty"`
-	SecurableType                       string                                              `json:"securable_type,omitempty"`
-	ShareName                           string                                              `json:"share_name,omitempty"`
-	StorageLocation                     string                                              `json:"storage_location,omitempty"`
-	StorageRoot                         string                                              `json:"storage_root,omitempty"`
-	UpdatedAt                           int                                                 `json:"updated_at,omitempty"`
-	UpdatedBy                           string                                              `json:"updated_by,omitempty"`
-	EffectivePredictiveOptimizationFlag *ResourceCatalogEffectivePredictiveOptimizationFlag `json:"effective_predictive_optimization_flag,omitempty"`
-	ManagedEncryptionSettings           *ResourceCatalogManagedEncryptionSettings           `json:"managed_encryption_settings,omitempty"`
-	ProviderConfig                      *ResourceCatalogProviderConfig                      `json:"provider_config,omitempty"`
-	ProvisioningInfo                    *ResourceCatalogProvisioningInfo                    `json:"provisioning_info,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_catalog_workspace_binding.go b/bundle/internal/tf/schema/resource_catalog_workspace_binding.go
deleted file mode 100644
index dd805772802..00000000000
--- a/bundle/internal/tf/schema/resource_catalog_workspace_binding.go
+++ /dev/null
@@ -1,17 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceCatalogWorkspaceBindingProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceCatalogWorkspaceBinding struct {
-	BindingType    string                                         `json:"binding_type,omitempty"`
-	CatalogName    string                                         `json:"catalog_name,omitempty"`
-	Id             string                                         `json:"id,omitempty"`
-	SecurableName  string                                         `json:"securable_name,omitempty"`
-	SecurableType  string                                         `json:"securable_type,omitempty"`
-	WorkspaceId    int                                            `json:"workspace_id"`
-	ProviderConfig *ResourceCatalogWorkspaceBindingProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_clean_room_asset.go b/bundle/internal/tf/schema/resource_clean_room_asset.go
deleted file mode 100644
index 500f9524e8f..00000000000
--- a/bundle/internal/tf/schema/resource_clean_room_asset.go
+++ /dev/null
@@ -1,137 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceCleanRoomAssetForeignTableColumnsMask struct {
-	FunctionName     string   `json:"function_name,omitempty"`
-	UsingColumnNames []string `json:"using_column_names,omitempty"`
-}
-
-type ResourceCleanRoomAssetForeignTableColumns struct {
-	Comment          string                                         `json:"comment,omitempty"`
-	Mask             *ResourceCleanRoomAssetForeignTableColumnsMask `json:"mask,omitempty"`
-	Name             string                                         `json:"name,omitempty"`
-	Nullable         bool                                           `json:"nullable,omitempty"`
-	PartitionIndex   int                                            `json:"partition_index,omitempty"`
-	Position         int                                            `json:"position,omitempty"`
-	TypeIntervalType string                                         `json:"type_interval_type,omitempty"`
-	TypeJson         string                                         `json:"type_json,omitempty"`
-	TypeName         string                                         `json:"type_name,omitempty"`
-	TypePrecision    int                                            `json:"type_precision,omitempty"`
-	TypeScale        int                                            `json:"type_scale,omitempty"`
-	TypeText         string                                         `json:"type_text,omitempty"`
-}
-
-type ResourceCleanRoomAssetForeignTable struct {
-	Columns []ResourceCleanRoomAssetForeignTableColumns `json:"columns,omitempty"`
-}
-
-type ResourceCleanRoomAssetForeignTableLocalDetails struct {
-	LocalName string `json:"local_name"`
-}
-
-type ResourceCleanRoomAssetNotebookReviews struct {
-	Comment                   string `json:"comment,omitempty"`
-	CreatedAtMillis           int    `json:"created_at_millis,omitempty"`
-	ReviewState               string `json:"review_state,omitempty"`
-	ReviewSubReason           string `json:"review_sub_reason,omitempty"`
-	ReviewerCollaboratorAlias string `json:"reviewer_collaborator_alias,omitempty"`
-}
-
-type ResourceCleanRoomAssetNotebook struct {
-	Etag                      string                                  `json:"etag,omitempty"`
-	NotebookContent           string                                  `json:"notebook_content"`
-	ReviewState               string                                  `json:"review_state,omitempty"`
-	Reviews                   []ResourceCleanRoomAssetNotebookReviews `json:"reviews,omitempty"`
-	RunnerCollaboratorAliases []string                                `json:"runner_collaborator_aliases,omitempty"`
-}
-
-type ResourceCleanRoomAssetTableColumnsMask struct {
-	FunctionName     string   `json:"function_name,omitempty"`
-	UsingColumnNames []string `json:"using_column_names,omitempty"`
-}
-
-type ResourceCleanRoomAssetTableColumns struct {
-	Comment          string                                  `json:"comment,omitempty"`
-	Mask             *ResourceCleanRoomAssetTableColumnsMask `json:"mask,omitempty"`
-	Name             string                                  `json:"name,omitempty"`
-	Nullable         bool                                    `json:"nullable,omitempty"`
-	PartitionIndex   int                                     `json:"partition_index,omitempty"`
-	Position         int                                     `json:"position,omitempty"`
-	TypeIntervalType string                                  `json:"type_interval_type,omitempty"`
-	TypeJson         string                                  `json:"type_json,omitempty"`
-	TypeName         string                                  `json:"type_name,omitempty"`
-	TypePrecision    int                                     `json:"type_precision,omitempty"`
-	TypeScale        int                                     `json:"type_scale,omitempty"`
-	TypeText         string                                  `json:"type_text,omitempty"`
-}
-
-type ResourceCleanRoomAssetTable struct {
-	Columns []ResourceCleanRoomAssetTableColumns `json:"columns,omitempty"`
-}
-
-type ResourceCleanRoomAssetTableLocalDetailsPartitionsValue struct {
-	Name                 string `json:"name,omitempty"`
-	Op                   string `json:"op,omitempty"`
-	RecipientPropertyKey string `json:"recipient_property_key,omitempty"`
-	Value                string `json:"value,omitempty"`
-}
-
-type ResourceCleanRoomAssetTableLocalDetailsPartitions struct {
-	Value []ResourceCleanRoomAssetTableLocalDetailsPartitionsValue `json:"value,omitempty"`
-}
-
-type ResourceCleanRoomAssetTableLocalDetails struct {
-	LocalName  string                                              `json:"local_name"`
-	Partitions []ResourceCleanRoomAssetTableLocalDetailsPartitions `json:"partitions,omitempty"`
-}
-
-type ResourceCleanRoomAssetViewColumnsMask struct {
-	FunctionName     string   `json:"function_name,omitempty"`
-	UsingColumnNames []string `json:"using_column_names,omitempty"`
-}
-
-type ResourceCleanRoomAssetViewColumns struct {
-	Comment          string                                 `json:"comment,omitempty"`
-	Mask             *ResourceCleanRoomAssetViewColumnsMask `json:"mask,omitempty"`
-	Name             string                                 `json:"name,omitempty"`
-	Nullable         bool                                   `json:"nullable,omitempty"`
-	PartitionIndex   int                                    `json:"partition_index,omitempty"`
-	Position         int                                    `json:"position,omitempty"`
-	TypeIntervalType string                                 `json:"type_interval_type,omitempty"`
-	TypeJson         string                                 `json:"type_json,omitempty"`
-	TypeName         string                                 `json:"type_name,omitempty"`
-	TypePrecision    int                                    `json:"type_precision,omitempty"`
-	TypeScale        int                                    `json:"type_scale,omitempty"`
-	TypeText         string                                 `json:"type_text,omitempty"`
-}
-
-type ResourceCleanRoomAssetView struct {
-	Columns []ResourceCleanRoomAssetViewColumns `json:"columns,omitempty"`
-}
-
-type ResourceCleanRoomAssetViewLocalDetails struct {
-	LocalName string `json:"local_name"`
-}
-
-type ResourceCleanRoomAssetVolumeLocalDetails struct {
-	LocalName string `json:"local_name"`
-}
-
-type ResourceCleanRoomAsset struct {
-	AddedAt                  int                                             `json:"added_at,omitempty"`
-	AssetType                string                                          `json:"asset_type"`
-	CleanRoomName            string                                          `json:"clean_room_name,omitempty"`
-	ForeignTable             *ResourceCleanRoomAssetForeignTable             `json:"foreign_table,omitempty"`
-	ForeignTableLocalDetails *ResourceCleanRoomAssetForeignTableLocalDetails `json:"foreign_table_local_details,omitempty"`
-	Name                     string                                          `json:"name"`
-	Notebook                 *ResourceCleanRoomAssetNotebook                 `json:"notebook,omitempty"`
-	OwnerCollaboratorAlias   string                                          `json:"owner_collaborator_alias,omitempty"`
-	Status                   string                                          `json:"status,omitempty"`
-	Table                    *ResourceCleanRoomAssetTable                    `json:"table,omitempty"`
-	TableLocalDetails        *ResourceCleanRoomAssetTableLocalDetails        `json:"table_local_details,omitempty"`
-	View                     *ResourceCleanRoomAssetView                     `json:"view,omitempty"`
-	ViewLocalDetails         *ResourceCleanRoomAssetViewLocalDetails         `json:"view_local_details,omitempty"`
-	VolumeLocalDetails       *ResourceCleanRoomAssetVolumeLocalDetails       `json:"volume_local_details,omitempty"`
-	WorkspaceId              string                                          `json:"workspace_id,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_clean_room_auto_approval_rule.go b/bundle/internal/tf/schema/resource_clean_room_auto_approval_rule.go
deleted file mode 100644
index b871f5677ea..00000000000
--- a/bundle/internal/tf/schema/resource_clean_room_auto_approval_rule.go
+++ /dev/null
@@ -1,14 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceCleanRoomAutoApprovalRule struct {
-	AuthorCollaboratorAlias    string `json:"author_collaborator_alias,omitempty"`
-	AuthorScope                string `json:"author_scope,omitempty"`
-	CleanRoomName              string `json:"clean_room_name,omitempty"`
-	CreatedAt                  int    `json:"created_at,omitempty"`
-	RuleId                     string `json:"rule_id,omitempty"`
-	RuleOwnerCollaboratorAlias string `json:"rule_owner_collaborator_alias,omitempty"`
-	RunnerCollaboratorAlias    string `json:"runner_collaborator_alias,omitempty"`
-	WorkspaceId                string `json:"workspace_id,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_clean_rooms_clean_room.go b/bundle/internal/tf/schema/resource_clean_rooms_clean_room.go
deleted file mode 100644
index 9c74d95d6ca..00000000000
--- a/bundle/internal/tf/schema/resource_clean_rooms_clean_room.go
+++ /dev/null
@@ -1,88 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceCleanRoomsCleanRoomOutputCatalog struct {
-	CatalogName string `json:"catalog_name,omitempty"`
-	Status      string `json:"status,omitempty"`
-}
-
-type ResourceCleanRoomsCleanRoomRemoteDetailedInfoCollaborators struct {
-	CollaboratorAlias          string `json:"collaborator_alias"`
-	DisplayName                string `json:"display_name,omitempty"`
-	GlobalMetastoreId          string `json:"global_metastore_id,omitempty"`
-	InviteRecipientEmail       string `json:"invite_recipient_email,omitempty"`
-	InviteRecipientWorkspaceId int    `json:"invite_recipient_workspace_id,omitempty"`
-	OrganizationName           string `json:"organization_name,omitempty"`
-}
-
-type ResourceCleanRoomsCleanRoomRemoteDetailedInfoComplianceSecurityProfile struct {
-	ComplianceStandards []string `json:"compliance_standards,omitempty"`
-	IsEnabled           bool     `json:"is_enabled,omitempty"`
-}
-
-type ResourceCleanRoomsCleanRoomRemoteDetailedInfoCreator struct {
-	CollaboratorAlias          string `json:"collaborator_alias"`
-	DisplayName                string `json:"display_name,omitempty"`
-	GlobalMetastoreId          string `json:"global_metastore_id,omitempty"`
-	InviteRecipientEmail       string `json:"invite_recipient_email,omitempty"`
-	InviteRecipientWorkspaceId int    `json:"invite_recipient_workspace_id,omitempty"`
-	OrganizationName           string `json:"organization_name,omitempty"`
-}
-
-type ResourceCleanRoomsCleanRoomRemoteDetailedInfoEgressNetworkPolicyInternetAccessAllowedInternetDestinations struct {
-	Destination string `json:"destination,omitempty"`
-	Protocol    string `json:"protocol,omitempty"`
-	Type        string `json:"type,omitempty"`
-}
-
-type ResourceCleanRoomsCleanRoomRemoteDetailedInfoEgressNetworkPolicyInternetAccessAllowedStorageDestinations struct {
-	AllowedPaths        []string `json:"allowed_paths,omitempty"`
-	AzureContainer      string   `json:"azure_container,omitempty"`
-	AzureDnsZone        string   `json:"azure_dns_zone,omitempty"`
-	AzureStorageAccount string   `json:"azure_storage_account,omitempty"`
-	AzureStorageService string   `json:"azure_storage_service,omitempty"`
-	BucketName          string   `json:"bucket_name,omitempty"`
-	Region              string   `json:"region,omitempty"`
-	Type                string   `json:"type,omitempty"`
-}
-
-type ResourceCleanRoomsCleanRoomRemoteDetailedInfoEgressNetworkPolicyInternetAccessLogOnlyMode struct {
-	LogOnlyModeType string   `json:"log_only_mode_type,omitempty"`
-	Workloads       []string `json:"workloads,omitempty"`
-}
-
-type ResourceCleanRoomsCleanRoomRemoteDetailedInfoEgressNetworkPolicyInternetAccess struct {
-	AllowedInternetDestinations []ResourceCleanRoomsCleanRoomRemoteDetailedInfoEgressNetworkPolicyInternetAccessAllowedInternetDestinations `json:"allowed_internet_destinations,omitempty"`
-	AllowedStorageDestinations  []ResourceCleanRoomsCleanRoomRemoteDetailedInfoEgressNetworkPolicyInternetAccessAllowedStorageDestinations  `json:"allowed_storage_destinations,omitempty"`
-	LogOnlyMode                 *ResourceCleanRoomsCleanRoomRemoteDetailedInfoEgressNetworkPolicyInternetAccessLogOnlyMode                  `json:"log_only_mode,omitempty"`
-	RestrictionMode             string                                                                                                      `json:"restriction_mode,omitempty"`
-}
-
-type ResourceCleanRoomsCleanRoomRemoteDetailedInfoEgressNetworkPolicy struct {
-	InternetAccess *ResourceCleanRoomsCleanRoomRemoteDetailedInfoEgressNetworkPolicyInternetAccess `json:"internet_access,omitempty"`
-}
-
-type ResourceCleanRoomsCleanRoomRemoteDetailedInfo struct {
-	CentralCleanRoomId        string                                                                  `json:"central_clean_room_id,omitempty"`
-	CloudVendor               string                                                                  `json:"cloud_vendor,omitempty"`
-	Collaborators             []ResourceCleanRoomsCleanRoomRemoteDetailedInfoCollaborators            `json:"collaborators,omitempty"`
-	ComplianceSecurityProfile *ResourceCleanRoomsCleanRoomRemoteDetailedInfoComplianceSecurityProfile `json:"compliance_security_profile,omitempty"`
-	Creator                   *ResourceCleanRoomsCleanRoomRemoteDetailedInfoCreator                   `json:"creator,omitempty"`
-	EgressNetworkPolicy       *ResourceCleanRoomsCleanRoomRemoteDetailedInfoEgressNetworkPolicy       `json:"egress_network_policy,omitempty"`
-	Region                    string                                                                  `json:"region,omitempty"`
-}
-
-type ResourceCleanRoomsCleanRoom struct {
-	AccessRestricted       string                                         `json:"access_restricted,omitempty"`
-	Comment                string                                         `json:"comment,omitempty"`
-	CreatedAt              int                                            `json:"created_at,omitempty"`
-	LocalCollaboratorAlias string                                         `json:"local_collaborator_alias,omitempty"`
-	Name                   string                                         `json:"name,omitempty"`
-	OutputCatalog          *ResourceCleanRoomsCleanRoomOutputCatalog      `json:"output_catalog,omitempty"`
-	Owner                  string                                         `json:"owner,omitempty"`
-	RemoteDetailedInfo     *ResourceCleanRoomsCleanRoomRemoteDetailedInfo `json:"remote_detailed_info,omitempty"`
-	Status                 string                                         `json:"status,omitempty"`
-	UpdatedAt              int                                            `json:"updated_at,omitempty"`
-	WorkspaceId            string                                         `json:"workspace_id,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_cluster.go b/bundle/internal/tf/schema/resource_cluster.go
deleted file mode 100644
index 35070eb8577..00000000000
--- a/bundle/internal/tf/schema/resource_cluster.go
+++ /dev/null
@@ -1,227 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceClusterAutoscale struct {
-	MaxWorkers int `json:"max_workers,omitempty"`
-	MinWorkers int `json:"min_workers,omitempty"`
-}
-
-type ResourceClusterAwsAttributes struct {
-	Availability        string `json:"availability,omitempty"`
-	EbsVolumeCount      int    `json:"ebs_volume_count,omitempty"`
-	EbsVolumeIops       int    `json:"ebs_volume_iops,omitempty"`
-	EbsVolumeSize       int    `json:"ebs_volume_size,omitempty"`
-	EbsVolumeThroughput int    `json:"ebs_volume_throughput,omitempty"`
-	EbsVolumeType       string `json:"ebs_volume_type,omitempty"`
-	FirstOnDemand       int    `json:"first_on_demand,omitempty"`
-	InstanceProfileArn  string `json:"instance_profile_arn,omitempty"`
-	SpotBidPricePercent int    `json:"spot_bid_price_percent,omitempty"`
-	ZoneId              string `json:"zone_id,omitempty"`
-}
-
-type ResourceClusterAzureAttributesLogAnalyticsInfo struct {
-	LogAnalyticsPrimaryKey  string `json:"log_analytics_primary_key,omitempty"`
-	LogAnalyticsWorkspaceId string `json:"log_analytics_workspace_id,omitempty"`
-}
-
-type ResourceClusterAzureAttributes struct {
-	Availability     string                                          `json:"availability,omitempty"`
-	FirstOnDemand    int                                             `json:"first_on_demand,omitempty"`
-	SpotBidMaxPrice  int                                             `json:"spot_bid_max_price,omitempty"`
-	LogAnalyticsInfo *ResourceClusterAzureAttributesLogAnalyticsInfo `json:"log_analytics_info,omitempty"`
-}
-
-type ResourceClusterClusterLogConfDbfs struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceClusterClusterLogConfS3 struct {
-	CannedAcl        string `json:"canned_acl,omitempty"`
-	Destination      string `json:"destination"`
-	EnableEncryption bool   `json:"enable_encryption,omitempty"`
-	EncryptionType   string `json:"encryption_type,omitempty"`
-	Endpoint         string `json:"endpoint,omitempty"`
-	KmsKey           string `json:"kms_key,omitempty"`
-	Region           string `json:"region,omitempty"`
-}
-
-type ResourceClusterClusterLogConfVolumes struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceClusterClusterLogConf struct {
-	Dbfs    *ResourceClusterClusterLogConfDbfs    `json:"dbfs,omitempty"`
-	S3      *ResourceClusterClusterLogConfS3      `json:"s3,omitempty"`
-	Volumes *ResourceClusterClusterLogConfVolumes `json:"volumes,omitempty"`
-}
-
-type ResourceClusterClusterMountInfoNetworkFilesystemInfo struct {
-	MountOptions  string `json:"mount_options,omitempty"`
-	ServerAddress string `json:"server_address"`
-}
-
-type ResourceClusterClusterMountInfo struct {
-	LocalMountDirPath     string                                                `json:"local_mount_dir_path"`
-	RemoteMountDirPath    string                                                `json:"remote_mount_dir_path,omitempty"`
-	NetworkFilesystemInfo *ResourceClusterClusterMountInfoNetworkFilesystemInfo `json:"network_filesystem_info,omitempty"`
-}
-
-type ResourceClusterDockerImageBasicAuth struct {
-	Password string `json:"password"`
-	Username string `json:"username"`
-}
-
-type ResourceClusterDockerImage struct {
-	Url       string                               `json:"url"`
-	BasicAuth *ResourceClusterDockerImageBasicAuth `json:"basic_auth,omitempty"`
-}
-
-type ResourceClusterDriverNodeTypeFlexibility struct {
-	AlternateNodeTypeIds []string `json:"alternate_node_type_ids,omitempty"`
-}
-
-type ResourceClusterGcpAttributes struct {
-	Availability            string `json:"availability,omitempty"`
-	BootDiskSize            int    `json:"boot_disk_size,omitempty"`
-	FirstOnDemand           int    `json:"first_on_demand,omitempty"`
-	GoogleServiceAccount    string `json:"google_service_account,omitempty"`
-	LocalSsdCount           int    `json:"local_ssd_count,omitempty"`
-	UsePreemptibleExecutors bool   `json:"use_preemptible_executors,omitempty"`
-	ZoneId                  string `json:"zone_id,omitempty"`
-}
-
-type ResourceClusterInitScriptsAbfss struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceClusterInitScriptsDbfs struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceClusterInitScriptsFile struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceClusterInitScriptsGcs struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceClusterInitScriptsS3 struct {
-	CannedAcl        string `json:"canned_acl,omitempty"`
-	Destination      string `json:"destination"`
-	EnableEncryption bool   `json:"enable_encryption,omitempty"`
-	EncryptionType   string `json:"encryption_type,omitempty"`
-	Endpoint         string `json:"endpoint,omitempty"`
-	KmsKey           string `json:"kms_key,omitempty"`
-	Region           string `json:"region,omitempty"`
-}
-
-type ResourceClusterInitScriptsVolumes struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceClusterInitScriptsWorkspace struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceClusterInitScripts struct {
-	Abfss     *ResourceClusterInitScriptsAbfss     `json:"abfss,omitempty"`
-	Dbfs      *ResourceClusterInitScriptsDbfs      `json:"dbfs,omitempty"`
-	File      *ResourceClusterInitScriptsFile      `json:"file,omitempty"`
-	Gcs       *ResourceClusterInitScriptsGcs       `json:"gcs,omitempty"`
-	S3        *ResourceClusterInitScriptsS3        `json:"s3,omitempty"`
-	Volumes   *ResourceClusterInitScriptsVolumes   `json:"volumes,omitempty"`
-	Workspace *ResourceClusterInitScriptsWorkspace `json:"workspace,omitempty"`
-}
-
-type ResourceClusterLibraryCran struct {
-	Package string `json:"package"`
-	Repo    string `json:"repo,omitempty"`
-}
-
-type ResourceClusterLibraryMaven struct {
-	Coordinates string   `json:"coordinates"`
-	Exclusions  []string `json:"exclusions,omitempty"`
-	Repo        string   `json:"repo,omitempty"`
-}
-
-type ResourceClusterLibraryPypi struct {
-	Package string `json:"package"`
-	Repo    string `json:"repo,omitempty"`
-}
-
-type ResourceClusterLibrary struct {
-	Egg          string                       `json:"egg,omitempty"`
-	Jar          string                       `json:"jar,omitempty"`
-	Requirements string                       `json:"requirements,omitempty"`
-	Whl          string                       `json:"whl,omitempty"`
-	Cran         *ResourceClusterLibraryCran  `json:"cran,omitempty"`
-	Maven        *ResourceClusterLibraryMaven `json:"maven,omitempty"`
-	Pypi         *ResourceClusterLibraryPypi  `json:"pypi,omitempty"`
-}
-
-type ResourceClusterProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceClusterWorkerNodeTypeFlexibility struct {
-	AlternateNodeTypeIds []string `json:"alternate_node_type_ids,omitempty"`
-}
-
-type ResourceClusterWorkloadTypeClients struct {
-	Jobs      bool `json:"jobs,omitempty"`
-	Notebooks bool `json:"notebooks,omitempty"`
-}
-
-type ResourceClusterWorkloadType struct {
-	Clients *ResourceClusterWorkloadTypeClients `json:"clients,omitempty"`
-}
-
-type ResourceCluster struct {
-	ApplyPolicyDefaultValues   bool                                      `json:"apply_policy_default_values,omitempty"`
-	AutoterminationMinutes     int                                       `json:"autotermination_minutes,omitempty"`
-	ClusterId                  string                                    `json:"cluster_id,omitempty"`
-	ClusterName                string                                    `json:"cluster_name,omitempty"`
-	CustomTags                 map[string]string                         `json:"custom_tags,omitempty"`
-	DataSecurityMode           string                                    `json:"data_security_mode,omitempty"`
-	DefaultTags                map[string]string                         `json:"default_tags,omitempty"`
-	DriverInstancePoolId       string                                    `json:"driver_instance_pool_id,omitempty"`
-	DriverNodeTypeId           string                                    `json:"driver_node_type_id,omitempty"`
-	EnableElasticDisk          bool                                      `json:"enable_elastic_disk,omitempty"`
-	EnableLocalDiskEncryption  bool                                      `json:"enable_local_disk_encryption,omitempty"`
-	Id                         string                                    `json:"id,omitempty"`
-	IdempotencyToken           string                                    `json:"idempotency_token,omitempty"`
-	InstancePoolId             string                                    `json:"instance_pool_id,omitempty"`
-	IsPinned                   bool                                      `json:"is_pinned,omitempty"`
-	IsSingleNode               bool                                      `json:"is_single_node,omitempty"`
-	Kind                       string                                    `json:"kind,omitempty"`
-	NoWait                     bool                                      `json:"no_wait,omitempty"`
-	NodeTypeId                 string                                    `json:"node_type_id,omitempty"`
-	NumWorkers                 int                                       `json:"num_workers,omitempty"`
-	PolicyId                   string                                    `json:"policy_id,omitempty"`
-	RemoteDiskThroughput       int                                       `json:"remote_disk_throughput,omitempty"`
-	RuntimeEngine              string                                    `json:"runtime_engine,omitempty"`
-	SingleUserName             string                                    `json:"single_user_name,omitempty"`
-	SparkConf                  map[string]string                         `json:"spark_conf,omitempty"`
-	SparkEnvVars               map[string]string                         `json:"spark_env_vars,omitempty"`
-	SparkVersion               string                                    `json:"spark_version"`
-	SshPublicKeys              []string                                  `json:"ssh_public_keys,omitempty"`
-	State                      string                                    `json:"state,omitempty"`
-	TotalInitialRemoteDiskSize int                                       `json:"total_initial_remote_disk_size,omitempty"`
-	Url                        string                                    `json:"url,omitempty"`
-	UseMlRuntime               bool                                      `json:"use_ml_runtime,omitempty"`
-	Autoscale                  *ResourceClusterAutoscale                 `json:"autoscale,omitempty"`
-	AwsAttributes              *ResourceClusterAwsAttributes             `json:"aws_attributes,omitempty"`
-	AzureAttributes            *ResourceClusterAzureAttributes           `json:"azure_attributes,omitempty"`
-	ClusterLogConf             *ResourceClusterClusterLogConf            `json:"cluster_log_conf,omitempty"`
-	ClusterMountInfo           []ResourceClusterClusterMountInfo         `json:"cluster_mount_info,omitempty"`
-	DockerImage                *ResourceClusterDockerImage               `json:"docker_image,omitempty"`
-	DriverNodeTypeFlexibility  *ResourceClusterDriverNodeTypeFlexibility `json:"driver_node_type_flexibility,omitempty"`
-	GcpAttributes              *ResourceClusterGcpAttributes             `json:"gcp_attributes,omitempty"`
-	InitScripts                []ResourceClusterInitScripts              `json:"init_scripts,omitempty"`
-	Library                    []ResourceClusterLibrary                  `json:"library,omitempty"`
-	ProviderConfig             *ResourceClusterProviderConfig            `json:"provider_config,omitempty"`
-	WorkerNodeTypeFlexibility  *ResourceClusterWorkerNodeTypeFlexibility `json:"worker_node_type_flexibility,omitempty"`
-	WorkloadType               *ResourceClusterWorkloadType              `json:"workload_type,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_cluster_policy.go b/bundle/internal/tf/schema/resource_cluster_policy.go
deleted file mode 100644
index e1c7c414641..00000000000
--- a/bundle/internal/tf/schema/resource_cluster_policy.go
+++ /dev/null
@@ -1,51 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceClusterPolicyLibrariesCran struct {
-	Package string `json:"package"`
-	Repo    string `json:"repo,omitempty"`
-}
-
-type ResourceClusterPolicyLibrariesMaven struct {
-	Coordinates string   `json:"coordinates"`
-	Exclusions  []string `json:"exclusions,omitempty"`
-	Repo        string   `json:"repo,omitempty"`
-}
-
-type ResourceClusterPolicyLibrariesProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceClusterPolicyLibrariesPypi struct {
-	Package string `json:"package"`
-	Repo    string `json:"repo,omitempty"`
-}
-
-type ResourceClusterPolicyLibraries struct {
-	Egg            string                                        `json:"egg,omitempty"`
-	Jar            string                                        `json:"jar,omitempty"`
-	Requirements   string                                        `json:"requirements,omitempty"`
-	Whl            string                                        `json:"whl,omitempty"`
-	Cran           *ResourceClusterPolicyLibrariesCran           `json:"cran,omitempty"`
-	Maven          *ResourceClusterPolicyLibrariesMaven          `json:"maven,omitempty"`
-	ProviderConfig *ResourceClusterPolicyLibrariesProviderConfig `json:"provider_config,omitempty"`
-	Pypi           *ResourceClusterPolicyLibrariesPypi           `json:"pypi,omitempty"`
-}
-
-type ResourceClusterPolicyProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceClusterPolicy struct {
-	Definition                      string                               `json:"definition,omitempty"`
-	Description                     string                               `json:"description,omitempty"`
-	Id                              string                               `json:"id,omitempty"`
-	MaxClustersPerUser              int                                  `json:"max_clusters_per_user,omitempty"`
-	Name                            string                               `json:"name,omitempty"`
-	PolicyFamilyDefinitionOverrides string                               `json:"policy_family_definition_overrides,omitempty"`
-	PolicyFamilyId                  string                               `json:"policy_family_id,omitempty"`
-	PolicyId                        string                               `json:"policy_id,omitempty"`
-	Libraries                       []ResourceClusterPolicyLibraries     `json:"libraries,omitempty"`
-	ProviderConfig                  *ResourceClusterPolicyProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_compliance_security_profile_workspace_setting.go b/bundle/internal/tf/schema/resource_compliance_security_profile_workspace_setting.go
deleted file mode 100644
index 0e3ecc332c6..00000000000
--- a/bundle/internal/tf/schema/resource_compliance_security_profile_workspace_setting.go
+++ /dev/null
@@ -1,20 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceComplianceSecurityProfileWorkspaceSettingComplianceSecurityProfileWorkspace struct {
-	ComplianceStandards []string `json:"compliance_standards"`
-	IsEnabled           bool     `json:"is_enabled"`
-}
-
-type ResourceComplianceSecurityProfileWorkspaceSettingProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceComplianceSecurityProfileWorkspaceSetting struct {
-	Etag                               string                                                                               `json:"etag,omitempty"`
-	Id                                 string                                                                               `json:"id,omitempty"`
-	SettingName                        string                                                                               `json:"setting_name,omitempty"`
-	ComplianceSecurityProfileWorkspace *ResourceComplianceSecurityProfileWorkspaceSettingComplianceSecurityProfileWorkspace `json:"compliance_security_profile_workspace,omitempty"`
-	ProviderConfig                     *ResourceComplianceSecurityProfileWorkspaceSettingProviderConfig                     `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_connection.go b/bundle/internal/tf/schema/resource_connection.go
deleted file mode 100644
index c27293c455e..00000000000
--- a/bundle/internal/tf/schema/resource_connection.go
+++ /dev/null
@@ -1,30 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceConnectionProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceConnection struct {
-	Comment          string                            `json:"comment,omitempty"`
-	ConnectionId     string                            `json:"connection_id,omitempty"`
-	ConnectionType   string                            `json:"connection_type,omitempty"`
-	CreatedAt        int                               `json:"created_at,omitempty"`
-	CreatedBy        string                            `json:"created_by,omitempty"`
-	CredentialType   string                            `json:"credential_type,omitempty"`
-	FullName         string                            `json:"full_name,omitempty"`
-	Id               string                            `json:"id,omitempty"`
-	MetastoreId      string                            `json:"metastore_id,omitempty"`
-	Name             string                            `json:"name,omitempty"`
-	Options          map[string]string                 `json:"options,omitempty"`
-	Owner            string                            `json:"owner,omitempty"`
-	Properties       map[string]string                 `json:"properties,omitempty"`
-	ProvisioningInfo []any                             `json:"provisioning_info,omitempty"`
-	ReadOnly         bool                              `json:"read_only,omitempty"`
-	SecurableType    string                            `json:"securable_type,omitempty"`
-	UpdatedAt        int                               `json:"updated_at,omitempty"`
-	UpdatedBy        string                            `json:"updated_by,omitempty"`
-	Url              string                            `json:"url,omitempty"`
-	ProviderConfig   *ResourceConnectionProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_credential.go b/bundle/internal/tf/schema/resource_credential.go
deleted file mode 100644
index bd8aae572c6..00000000000
--- a/bundle/internal/tf/schema/resource_credential.go
+++ /dev/null
@@ -1,57 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceCredentialAwsIamRole struct {
-	ExternalId         string `json:"external_id,omitempty"`
-	RoleArn            string `json:"role_arn,omitempty"`
-	UnityCatalogIamArn string `json:"unity_catalog_iam_arn,omitempty"`
-}
-
-type ResourceCredentialAzureManagedIdentity struct {
-	AccessConnectorId string `json:"access_connector_id"`
-	CredentialId      string `json:"credential_id,omitempty"`
-	ManagedIdentityId string `json:"managed_identity_id,omitempty"`
-}
-
-type ResourceCredentialAzureServicePrincipal struct {
-	ApplicationId string `json:"application_id"`
-	ClientSecret  string `json:"client_secret"`
-	DirectoryId   string `json:"directory_id"`
-}
-
-type ResourceCredentialDatabricksGcpServiceAccount struct {
-	CredentialId string `json:"credential_id,omitempty"`
-	Email        string `json:"email,omitempty"`
-	PrivateKeyId string `json:"private_key_id,omitempty"`
-}
-
-type ResourceCredentialProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceCredential struct {
-	Comment                     string                                         `json:"comment,omitempty"`
-	CreatedAt                   int                                            `json:"created_at,omitempty"`
-	CreatedBy                   string                                         `json:"created_by,omitempty"`
-	CredentialId                string                                         `json:"credential_id,omitempty"`
-	ForceDestroy                bool                                           `json:"force_destroy,omitempty"`
-	ForceUpdate                 bool                                           `json:"force_update,omitempty"`
-	FullName                    string                                         `json:"full_name,omitempty"`
-	Id                          string                                         `json:"id,omitempty"`
-	IsolationMode               string                                         `json:"isolation_mode,omitempty"`
-	MetastoreId                 string                                         `json:"metastore_id,omitempty"`
-	Name                        string                                         `json:"name"`
-	Owner                       string                                         `json:"owner,omitempty"`
-	Purpose                     string                                         `json:"purpose"`
-	ReadOnly                    bool                                           `json:"read_only,omitempty"`
-	SkipValidation              bool                                           `json:"skip_validation,omitempty"`
-	UpdatedAt                   int                                            `json:"updated_at,omitempty"`
-	UpdatedBy                   string                                         `json:"updated_by,omitempty"`
-	UsedForManagedStorage       bool                                           `json:"used_for_managed_storage,omitempty"`
-	AwsIamRole                  *ResourceCredentialAwsIamRole                  `json:"aws_iam_role,omitempty"`
-	AzureManagedIdentity        *ResourceCredentialAzureManagedIdentity        `json:"azure_managed_identity,omitempty"`
-	AzureServicePrincipal       *ResourceCredentialAzureServicePrincipal       `json:"azure_service_principal,omitempty"`
-	DatabricksGcpServiceAccount *ResourceCredentialDatabricksGcpServiceAccount `json:"databricks_gcp_service_account,omitempty"`
-	ProviderConfig              *ResourceCredentialProviderConfig              `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_custom_app_integration.go b/bundle/internal/tf/schema/resource_custom_app_integration.go
deleted file mode 100644
index dceca2ab08a..00000000000
--- a/bundle/internal/tf/schema/resource_custom_app_integration.go
+++ /dev/null
@@ -1,26 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceCustomAppIntegrationTokenAccessPolicy struct {
-	AbsoluteSessionLifetimeInMinutes int  `json:"absolute_session_lifetime_in_minutes,omitempty"`
-	AccessTokenTtlInMinutes          int  `json:"access_token_ttl_in_minutes,omitempty"`
-	EnableSingleUseRefreshTokens     bool `json:"enable_single_use_refresh_tokens,omitempty"`
-	RefreshTokenTtlInMinutes         int  `json:"refresh_token_ttl_in_minutes,omitempty"`
-}
-
-type ResourceCustomAppIntegration struct {
-	ClientId             string                                         `json:"client_id,omitempty"`
-	ClientSecret         string                                         `json:"client_secret,omitempty"`
-	Confidential         bool                                           `json:"confidential,omitempty"`
-	CreateTime           string                                         `json:"create_time,omitempty"`
-	CreatedBy            int                                            `json:"created_by,omitempty"`
-	CreatorUsername      string                                         `json:"creator_username,omitempty"`
-	Id                   string                                         `json:"id,omitempty"`
-	IntegrationId        string                                         `json:"integration_id,omitempty"`
-	Name                 string                                         `json:"name,omitempty"`
-	RedirectUrls         []string                                       `json:"redirect_urls,omitempty"`
-	Scopes               []string                                       `json:"scopes,omitempty"`
-	UserAuthorizedScopes []string                                       `json:"user_authorized_scopes,omitempty"`
-	TokenAccessPolicy    *ResourceCustomAppIntegrationTokenAccessPolicy `json:"token_access_policy,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_dashboard.go b/bundle/internal/tf/schema/resource_dashboard.go
deleted file mode 100644
index 41ed9641eb8..00000000000
--- a/bundle/internal/tf/schema/resource_dashboard.go
+++ /dev/null
@@ -1,28 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceDashboardProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceDashboard struct {
-	CreateTime              string                           `json:"create_time,omitempty"`
-	DashboardChangeDetected bool                             `json:"dashboard_change_detected,omitempty"`
-	DashboardId             string                           `json:"dashboard_id,omitempty"`
-	DatasetCatalog          string                           `json:"dataset_catalog,omitempty"`
-	DatasetSchema           string                           `json:"dataset_schema,omitempty"`
-	DisplayName             string                           `json:"display_name"`
-	EmbedCredentials        bool                             `json:"embed_credentials,omitempty"`
-	Etag                    string                           `json:"etag,omitempty"`
-	FilePath                string                           `json:"file_path,omitempty"`
-	Id                      string                           `json:"id,omitempty"`
-	LifecycleState          string                           `json:"lifecycle_state,omitempty"`
-	Md5                     string                           `json:"md5,omitempty"`
-	ParentPath              string                           `json:"parent_path"`
-	Path                    string                           `json:"path,omitempty"`
-	SerializedDashboard     string                           `json:"serialized_dashboard,omitempty"`
-	UpdateTime              string                           `json:"update_time,omitempty"`
-	WarehouseId             string                           `json:"warehouse_id"`
-	ProviderConfig          *ResourceDashboardProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_data_classification_catalog_config.go b/bundle/internal/tf/schema/resource_data_classification_catalog_config.go
deleted file mode 100644
index 14546faf18f..00000000000
--- a/bundle/internal/tf/schema/resource_data_classification_catalog_config.go
+++ /dev/null
@@ -1,24 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceDataClassificationCatalogConfigAutoTagConfigs struct {
-	AutoTaggingMode   string `json:"auto_tagging_mode"`
-	ClassificationTag string `json:"classification_tag"`
-}
-
-type ResourceDataClassificationCatalogConfigIncludedSchemas struct {
-	Names []string `json:"names"`
-}
-
-type ResourceDataClassificationCatalogConfigProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceDataClassificationCatalogConfig struct {
-	AutoTagConfigs  []ResourceDataClassificationCatalogConfigAutoTagConfigs `json:"auto_tag_configs,omitempty"`
-	IncludedSchemas *ResourceDataClassificationCatalogConfigIncludedSchemas `json:"included_schemas,omitempty"`
-	Name            string                                                  `json:"name,omitempty"`
-	Parent          string                                                  `json:"parent"`
-	ProviderConfig  *ResourceDataClassificationCatalogConfigProviderConfig  `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_data_quality_monitor.go b/bundle/internal/tf/schema/resource_data_quality_monitor.go
deleted file mode 100644
index d6d9af24466..00000000000
--- a/bundle/internal/tf/schema/resource_data_quality_monitor.go
+++ /dev/null
@@ -1,81 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceDataQualityMonitorAnomalyDetectionConfig struct {
-	ExcludedTableFullNames []string `json:"excluded_table_full_names,omitempty"`
-}
-
-type ResourceDataQualityMonitorDataProfilingConfigCustomMetrics struct {
-	Definition     string   `json:"definition"`
-	InputColumns   []string `json:"input_columns"`
-	Name           string   `json:"name"`
-	OutputDataType string   `json:"output_data_type"`
-	Type           string   `json:"type"`
-}
-
-type ResourceDataQualityMonitorDataProfilingConfigInferenceLog struct {
-	Granularities    []string `json:"granularities"`
-	LabelColumn      string   `json:"label_column,omitempty"`
-	ModelIdColumn    string   `json:"model_id_column"`
-	PredictionColumn string   `json:"prediction_column"`
-	ProblemType      string   `json:"problem_type"`
-	TimestampColumn  string   `json:"timestamp_column"`
-}
-
-type ResourceDataQualityMonitorDataProfilingConfigNotificationSettingsOnFailure struct {
-	EmailAddresses []string `json:"email_addresses,omitempty"`
-}
-
-type ResourceDataQualityMonitorDataProfilingConfigNotificationSettings struct {
-	OnFailure *ResourceDataQualityMonitorDataProfilingConfigNotificationSettingsOnFailure `json:"on_failure,omitempty"`
-}
-
-type ResourceDataQualityMonitorDataProfilingConfigSchedule struct {
-	PauseStatus          string `json:"pause_status,omitempty"`
-	QuartzCronExpression string `json:"quartz_cron_expression"`
-	TimezoneId           string `json:"timezone_id"`
-}
-
-type ResourceDataQualityMonitorDataProfilingConfigSnapshot struct {
-}
-
-type ResourceDataQualityMonitorDataProfilingConfigTimeSeries struct {
-	Granularities   []string `json:"granularities"`
-	TimestampColumn string   `json:"timestamp_column"`
-}
-
-type ResourceDataQualityMonitorDataProfilingConfig struct {
-	AssetsDir                   string                                                             `json:"assets_dir,omitempty"`
-	BaselineTableName           string                                                             `json:"baseline_table_name,omitempty"`
-	CustomMetrics               []ResourceDataQualityMonitorDataProfilingConfigCustomMetrics       `json:"custom_metrics,omitempty"`
-	DashboardId                 string                                                             `json:"dashboard_id,omitempty"`
-	DriftMetricsTableName       string                                                             `json:"drift_metrics_table_name,omitempty"`
-	EffectiveWarehouseId        string                                                             `json:"effective_warehouse_id,omitempty"`
-	InferenceLog                *ResourceDataQualityMonitorDataProfilingConfigInferenceLog         `json:"inference_log,omitempty"`
-	LatestMonitorFailureMessage string                                                             `json:"latest_monitor_failure_message,omitempty"`
-	MonitorVersion              int                                                                `json:"monitor_version,omitempty"`
-	MonitoredTableName          string                                                             `json:"monitored_table_name,omitempty"`
-	NotificationSettings        *ResourceDataQualityMonitorDataProfilingConfigNotificationSettings `json:"notification_settings,omitempty"`
-	OutputSchemaId              string                                                             `json:"output_schema_id"`
-	ProfileMetricsTableName     string                                                             `json:"profile_metrics_table_name,omitempty"`
-	Schedule                    *ResourceDataQualityMonitorDataProfilingConfigSchedule             `json:"schedule,omitempty"`
-	SkipBuiltinDashboard        bool                                                               `json:"skip_builtin_dashboard,omitempty"`
-	SlicingExprs                []string                                                           `json:"slicing_exprs,omitempty"`
-	Snapshot                    *ResourceDataQualityMonitorDataProfilingConfigSnapshot             `json:"snapshot,omitempty"`
-	Status                      string                                                             `json:"status,omitempty"`
-	TimeSeries                  *ResourceDataQualityMonitorDataProfilingConfigTimeSeries           `json:"time_series,omitempty"`
-	WarehouseId                 string                                                             `json:"warehouse_id,omitempty"`
-}
-
-type ResourceDataQualityMonitorProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceDataQualityMonitor struct {
-	AnomalyDetectionConfig *ResourceDataQualityMonitorAnomalyDetectionConfig `json:"anomaly_detection_config,omitempty"`
-	DataProfilingConfig    *ResourceDataQualityMonitorDataProfilingConfig    `json:"data_profiling_config,omitempty"`
-	ObjectId               string                                            `json:"object_id"`
-	ObjectType             string                                            `json:"object_type"`
-	ProviderConfig         *ResourceDataQualityMonitorProviderConfig         `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_data_quality_refresh.go b/bundle/internal/tf/schema/resource_data_quality_refresh.go
deleted file mode 100644
index 8a31a27d0b1..00000000000
--- a/bundle/internal/tf/schema/resource_data_quality_refresh.go
+++ /dev/null
@@ -1,19 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceDataQualityRefreshProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceDataQualityRefresh struct {
-	EndTimeMs      int                                       `json:"end_time_ms,omitempty"`
-	Message        string                                    `json:"message,omitempty"`
-	ObjectId       string                                    `json:"object_id"`
-	ObjectType     string                                    `json:"object_type"`
-	ProviderConfig *ResourceDataQualityRefreshProviderConfig `json:"provider_config,omitempty"`
-	RefreshId      int                                       `json:"refresh_id,omitempty"`
-	StartTimeMs    int                                       `json:"start_time_ms,omitempty"`
-	State          string                                    `json:"state,omitempty"`
-	Trigger        string                                    `json:"trigger,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_database_database_catalog.go b/bundle/internal/tf/schema/resource_database_database_catalog.go
deleted file mode 100644
index 56b2d2811fb..00000000000
--- a/bundle/internal/tf/schema/resource_database_database_catalog.go
+++ /dev/null
@@ -1,16 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceDatabaseDatabaseCatalogProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceDatabaseDatabaseCatalog struct {
-	CreateDatabaseIfNotExists bool                                           `json:"create_database_if_not_exists,omitempty"`
-	DatabaseInstanceName      string                                         `json:"database_instance_name"`
-	DatabaseName              string                                         `json:"database_name"`
-	Name                      string                                         `json:"name"`
-	ProviderConfig            *ResourceDatabaseDatabaseCatalogProviderConfig `json:"provider_config,omitempty"`
-	Uid                       string                                         `json:"uid,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_database_instance.go b/bundle/internal/tf/schema/resource_database_instance.go
deleted file mode 100644
index d464813de63..00000000000
--- a/bundle/internal/tf/schema/resource_database_instance.go
+++ /dev/null
@@ -1,64 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceDatabaseInstanceChildInstanceRefs struct {
-	BranchTime   string `json:"branch_time,omitempty"`
-	EffectiveLsn string `json:"effective_lsn,omitempty"`
-	Lsn          string `json:"lsn,omitempty"`
-	Name         string `json:"name,omitempty"`
-	Uid          string `json:"uid,omitempty"`
-}
-
-type ResourceDatabaseInstanceCustomTags struct {
-	Key   string `json:"key,omitempty"`
-	Value string `json:"value,omitempty"`
-}
-
-type ResourceDatabaseInstanceEffectiveCustomTags struct {
-	Key   string `json:"key,omitempty"`
-	Value string `json:"value,omitempty"`
-}
-
-type ResourceDatabaseInstanceParentInstanceRef struct {
-	BranchTime   string `json:"branch_time,omitempty"`
-	EffectiveLsn string `json:"effective_lsn,omitempty"`
-	Lsn          string `json:"lsn,omitempty"`
-	Name         string `json:"name,omitempty"`
-	Uid          string `json:"uid,omitempty"`
-}
-
-type ResourceDatabaseInstanceProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceDatabaseInstance struct {
-	Capacity                           string                                        `json:"capacity,omitempty"`
-	ChildInstanceRefs                  []ResourceDatabaseInstanceChildInstanceRefs   `json:"child_instance_refs,omitempty"`
-	CreationTime                       string                                        `json:"creation_time,omitempty"`
-	Creator                            string                                        `json:"creator,omitempty"`
-	CustomTags                         []ResourceDatabaseInstanceCustomTags          `json:"custom_tags,omitempty"`
-	EffectiveCapacity                  string                                        `json:"effective_capacity,omitempty"`
-	EffectiveCustomTags                []ResourceDatabaseInstanceEffectiveCustomTags `json:"effective_custom_tags,omitempty"`
-	EffectiveEnablePgNativeLogin       bool                                          `json:"effective_enable_pg_native_login,omitempty"`
-	EffectiveEnableReadableSecondaries bool                                          `json:"effective_enable_readable_secondaries,omitempty"`
-	EffectiveNodeCount                 int                                           `json:"effective_node_count,omitempty"`
-	EffectiveRetentionWindowInDays     int                                           `json:"effective_retention_window_in_days,omitempty"`
-	EffectiveStopped                   bool                                          `json:"effective_stopped,omitempty"`
-	EffectiveUsagePolicyId             string                                        `json:"effective_usage_policy_id,omitempty"`
-	EnablePgNativeLogin                bool                                          `json:"enable_pg_native_login,omitempty"`
-	EnableReadableSecondaries          bool                                          `json:"enable_readable_secondaries,omitempty"`
-	Name                               string                                        `json:"name"`
-	NodeCount                          int                                           `json:"node_count,omitempty"`
-	ParentInstanceRef                  *ResourceDatabaseInstanceParentInstanceRef    `json:"parent_instance_ref,omitempty"`
-	PgVersion                          string                                        `json:"pg_version,omitempty"`
-	ProviderConfig                     *ResourceDatabaseInstanceProviderConfig       `json:"provider_config,omitempty"`
-	PurgeOnDelete                      bool                                          `json:"purge_on_delete,omitempty"`
-	ReadOnlyDns                        string                                        `json:"read_only_dns,omitempty"`
-	ReadWriteDns                       string                                        `json:"read_write_dns,omitempty"`
-	RetentionWindowInDays              int                                           `json:"retention_window_in_days,omitempty"`
-	State                              string                                        `json:"state,omitempty"`
-	Stopped                            bool                                          `json:"stopped,omitempty"`
-	Uid                                string                                        `json:"uid,omitempty"`
-	UsagePolicyId                      string                                        `json:"usage_policy_id,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_database_synced_database_table.go b/bundle/internal/tf/schema/resource_database_synced_database_table.go
deleted file mode 100644
index 1156775f039..00000000000
--- a/bundle/internal/tf/schema/resource_database_synced_database_table.go
+++ /dev/null
@@ -1,105 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceDatabaseSyncedDatabaseTableDataSynchronizationStatusContinuousUpdateStatusInitialPipelineSyncProgress struct {
-	EstimatedCompletionTimeSeconds   int    `json:"estimated_completion_time_seconds,omitempty"`
-	LatestVersionCurrentlyProcessing int    `json:"latest_version_currently_processing,omitempty"`
-	ProvisioningPhase                string `json:"provisioning_phase,omitempty"`
-	SyncProgressCompletion           int    `json:"sync_progress_completion,omitempty"`
-	SyncedRowCount                   int    `json:"synced_row_count,omitempty"`
-	TotalRowCount                    int    `json:"total_row_count,omitempty"`
-}
-
-type ResourceDatabaseSyncedDatabaseTableDataSynchronizationStatusContinuousUpdateStatus struct {
-	InitialPipelineSyncProgress *ResourceDatabaseSyncedDatabaseTableDataSynchronizationStatusContinuousUpdateStatusInitialPipelineSyncProgress `json:"initial_pipeline_sync_progress,omitempty"`
-	LastProcessedCommitVersion  int                                                                                                            `json:"last_processed_commit_version,omitempty"`
-	Timestamp                   string                                                                                                         `json:"timestamp,omitempty"`
-}
-
-type ResourceDatabaseSyncedDatabaseTableDataSynchronizationStatusFailedStatus struct {
-	LastProcessedCommitVersion int    `json:"last_processed_commit_version,omitempty"`
-	Timestamp                  string `json:"timestamp,omitempty"`
-}
-
-type ResourceDatabaseSyncedDatabaseTableDataSynchronizationStatusLastSyncDeltaTableSyncInfo struct {
-	DeltaCommitTimestamp string `json:"delta_commit_timestamp,omitempty"`
-	DeltaCommitVersion   int    `json:"delta_commit_version,omitempty"`
-}
-
-type ResourceDatabaseSyncedDatabaseTableDataSynchronizationStatusLastSync struct {
-	DeltaTableSyncInfo *ResourceDatabaseSyncedDatabaseTableDataSynchronizationStatusLastSyncDeltaTableSyncInfo `json:"delta_table_sync_info,omitempty"`
-	SyncEndTimestamp   string                                                                                  `json:"sync_end_timestamp,omitempty"`
-	SyncStartTimestamp string                                                                                  `json:"sync_start_timestamp,omitempty"`
-}
-
-type ResourceDatabaseSyncedDatabaseTableDataSynchronizationStatusProvisioningStatusInitialPipelineSyncProgress struct {
-	EstimatedCompletionTimeSeconds   int    `json:"estimated_completion_time_seconds,omitempty"`
-	LatestVersionCurrentlyProcessing int    `json:"latest_version_currently_processing,omitempty"`
-	ProvisioningPhase                string `json:"provisioning_phase,omitempty"`
-	SyncProgressCompletion           int    `json:"sync_progress_completion,omitempty"`
-	SyncedRowCount                   int    `json:"synced_row_count,omitempty"`
-	TotalRowCount                    int    `json:"total_row_count,omitempty"`
-}
-
-type ResourceDatabaseSyncedDatabaseTableDataSynchronizationStatusProvisioningStatus struct {
-	InitialPipelineSyncProgress *ResourceDatabaseSyncedDatabaseTableDataSynchronizationStatusProvisioningStatusInitialPipelineSyncProgress `json:"initial_pipeline_sync_progress,omitempty"`
-}
-
-type ResourceDatabaseSyncedDatabaseTableDataSynchronizationStatusTriggeredUpdateStatusTriggeredUpdateProgress struct {
-	EstimatedCompletionTimeSeconds   int    `json:"estimated_completion_time_seconds,omitempty"`
-	LatestVersionCurrentlyProcessing int    `json:"latest_version_currently_processing,omitempty"`
-	ProvisioningPhase                string `json:"provisioning_phase,omitempty"`
-	SyncProgressCompletion           int    `json:"sync_progress_completion,omitempty"`
-	SyncedRowCount                   int    `json:"synced_row_count,omitempty"`
-	TotalRowCount                    int    `json:"total_row_count,omitempty"`
-}
-
-type ResourceDatabaseSyncedDatabaseTableDataSynchronizationStatusTriggeredUpdateStatus struct {
-	LastProcessedCommitVersion int                                                                                                       `json:"last_processed_commit_version,omitempty"`
-	Timestamp                  string                                                                                                    `json:"timestamp,omitempty"`
-	TriggeredUpdateProgress    *ResourceDatabaseSyncedDatabaseTableDataSynchronizationStatusTriggeredUpdateStatusTriggeredUpdateProgress `json:"triggered_update_progress,omitempty"`
-}
-
-type ResourceDatabaseSyncedDatabaseTableDataSynchronizationStatus struct {
-	ContinuousUpdateStatus *ResourceDatabaseSyncedDatabaseTableDataSynchronizationStatusContinuousUpdateStatus `json:"continuous_update_status,omitempty"`
-	DetailedState          string                                                                              `json:"detailed_state,omitempty"`
-	FailedStatus           *ResourceDatabaseSyncedDatabaseTableDataSynchronizationStatusFailedStatus           `json:"failed_status,omitempty"`
-	LastSync               *ResourceDatabaseSyncedDatabaseTableDataSynchronizationStatusLastSync               `json:"last_sync,omitempty"`
-	Message                string                                                                              `json:"message,omitempty"`
-	PipelineId             string                                                                              `json:"pipeline_id,omitempty"`
-	ProvisioningStatus     *ResourceDatabaseSyncedDatabaseTableDataSynchronizationStatusProvisioningStatus     `json:"provisioning_status,omitempty"`
-	TriggeredUpdateStatus  *ResourceDatabaseSyncedDatabaseTableDataSynchronizationStatusTriggeredUpdateStatus  `json:"triggered_update_status,omitempty"`
-}
-
-type ResourceDatabaseSyncedDatabaseTableProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceDatabaseSyncedDatabaseTableSpecNewPipelineSpec struct {
-	BudgetPolicyId string `json:"budget_policy_id,omitempty"`
-	StorageCatalog string `json:"storage_catalog,omitempty"`
-	StorageSchema  string `json:"storage_schema,omitempty"`
-}
-
-type ResourceDatabaseSyncedDatabaseTableSpec struct {
-	CreateDatabaseObjectsIfMissing bool                                                    `json:"create_database_objects_if_missing,omitempty"`
-	ExistingPipelineId             string                                                  `json:"existing_pipeline_id,omitempty"`
-	NewPipelineSpec                *ResourceDatabaseSyncedDatabaseTableSpecNewPipelineSpec `json:"new_pipeline_spec,omitempty"`
-	PrimaryKeyColumns              []string                                                `json:"primary_key_columns,omitempty"`
-	SchedulingPolicy               string                                                  `json:"scheduling_policy,omitempty"`
-	SourceTableFullName            string                                                  `json:"source_table_full_name,omitempty"`
-	TimeseriesKey                  string                                                  `json:"timeseries_key,omitempty"`
-}
-
-type ResourceDatabaseSyncedDatabaseTable struct {
-	DataSynchronizationStatus     *ResourceDatabaseSyncedDatabaseTableDataSynchronizationStatus `json:"data_synchronization_status,omitempty"`
-	DatabaseInstanceName          string                                                        `json:"database_instance_name,omitempty"`
-	EffectiveDatabaseInstanceName string                                                        `json:"effective_database_instance_name,omitempty"`
-	EffectiveLogicalDatabaseName  string                                                        `json:"effective_logical_database_name,omitempty"`
-	LogicalDatabaseName           string                                                        `json:"logical_database_name,omitempty"`
-	Name                          string                                                        `json:"name"`
-	ProviderConfig                *ResourceDatabaseSyncedDatabaseTableProviderConfig            `json:"provider_config,omitempty"`
-	Spec                          *ResourceDatabaseSyncedDatabaseTableSpec                      `json:"spec,omitempty"`
-	UnityCatalogProvisioningState string                                                        `json:"unity_catalog_provisioning_state,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_dbfs_file.go b/bundle/internal/tf/schema/resource_dbfs_file.go
deleted file mode 100644
index 4af4f426a06..00000000000
--- a/bundle/internal/tf/schema/resource_dbfs_file.go
+++ /dev/null
@@ -1,18 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceDbfsFileProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceDbfsFile struct {
-	ContentBase64  string                          `json:"content_base64,omitempty"`
-	DbfsPath       string                          `json:"dbfs_path,omitempty"`
-	FileSize       int                             `json:"file_size,omitempty"`
-	Id             string                          `json:"id,omitempty"`
-	Md5            string                          `json:"md5,omitempty"`
-	Path           string                          `json:"path"`
-	Source         string                          `json:"source,omitempty"`
-	ProviderConfig *ResourceDbfsFileProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_default_namespace_setting.go b/bundle/internal/tf/schema/resource_default_namespace_setting.go
deleted file mode 100644
index 959cb9f3b18..00000000000
--- a/bundle/internal/tf/schema/resource_default_namespace_setting.go
+++ /dev/null
@@ -1,19 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceDefaultNamespaceSettingNamespace struct {
-	Value string `json:"value,omitempty"`
-}
-
-type ResourceDefaultNamespaceSettingProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceDefaultNamespaceSetting struct {
-	Etag           string                                         `json:"etag,omitempty"`
-	Id             string                                         `json:"id,omitempty"`
-	SettingName    string                                         `json:"setting_name,omitempty"`
-	Namespace      *ResourceDefaultNamespaceSettingNamespace      `json:"namespace,omitempty"`
-	ProviderConfig *ResourceDefaultNamespaceSettingProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_directory.go b/bundle/internal/tf/schema/resource_directory.go
deleted file mode 100644
index a7f5ece708c..00000000000
--- a/bundle/internal/tf/schema/resource_directory.go
+++ /dev/null
@@ -1,16 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceDirectoryProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceDirectory struct {
-	DeleteRecursive bool                             `json:"delete_recursive,omitempty"`
-	Id              string                           `json:"id,omitempty"`
-	ObjectId        int                              `json:"object_id,omitempty"`
-	Path            string                           `json:"path"`
-	WorkspacePath   string                           `json:"workspace_path,omitempty"`
-	ProviderConfig  *ResourceDirectoryProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_disable_legacy_access_setting.go b/bundle/internal/tf/schema/resource_disable_legacy_access_setting.go
deleted file mode 100644
index bd15f13b6fa..00000000000
--- a/bundle/internal/tf/schema/resource_disable_legacy_access_setting.go
+++ /dev/null
@@ -1,19 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceDisableLegacyAccessSettingDisableLegacyAccess struct {
-	Value bool `json:"value"`
-}
-
-type ResourceDisableLegacyAccessSettingProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceDisableLegacyAccessSetting struct {
-	Etag                string                                                 `json:"etag,omitempty"`
-	Id                  string                                                 `json:"id,omitempty"`
-	SettingName         string                                                 `json:"setting_name,omitempty"`
-	DisableLegacyAccess *ResourceDisableLegacyAccessSettingDisableLegacyAccess `json:"disable_legacy_access,omitempty"`
-	ProviderConfig      *ResourceDisableLegacyAccessSettingProviderConfig      `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_disable_legacy_dbfs_setting.go b/bundle/internal/tf/schema/resource_disable_legacy_dbfs_setting.go
deleted file mode 100644
index 810dc275640..00000000000
--- a/bundle/internal/tf/schema/resource_disable_legacy_dbfs_setting.go
+++ /dev/null
@@ -1,19 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceDisableLegacyDbfsSettingDisableLegacyDbfs struct {
-	Value bool `json:"value"`
-}
-
-type ResourceDisableLegacyDbfsSettingProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceDisableLegacyDbfsSetting struct {
-	Etag              string                                             `json:"etag,omitempty"`
-	Id                string                                             `json:"id,omitempty"`
-	SettingName       string                                             `json:"setting_name,omitempty"`
-	DisableLegacyDbfs *ResourceDisableLegacyDbfsSettingDisableLegacyDbfs `json:"disable_legacy_dbfs,omitempty"`
-	ProviderConfig    *ResourceDisableLegacyDbfsSettingProviderConfig    `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_disable_legacy_features_setting.go b/bundle/internal/tf/schema/resource_disable_legacy_features_setting.go
deleted file mode 100644
index fbd66beb8ee..00000000000
--- a/bundle/internal/tf/schema/resource_disable_legacy_features_setting.go
+++ /dev/null
@@ -1,19 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceDisableLegacyFeaturesSettingDisableLegacyFeatures struct {
-	Value bool `json:"value"`
-}
-
-type ResourceDisableLegacyFeaturesSettingProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceDisableLegacyFeaturesSetting struct {
-	Etag                  string                                                     `json:"etag,omitempty"`
-	Id                    string                                                     `json:"id,omitempty"`
-	SettingName           string                                                     `json:"setting_name,omitempty"`
-	DisableLegacyFeatures *ResourceDisableLegacyFeaturesSettingDisableLegacyFeatures `json:"disable_legacy_features,omitempty"`
-	ProviderConfig        *ResourceDisableLegacyFeaturesSettingProviderConfig        `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_endpoint.go b/bundle/internal/tf/schema/resource_endpoint.go
deleted file mode 100644
index 0b010ce55b0..00000000000
--- a/bundle/internal/tf/schema/resource_endpoint.go
+++ /dev/null
@@ -1,23 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceEndpointAzurePrivateEndpointInfo struct {
-	PrivateEndpointName         string `json:"private_endpoint_name"`
-	PrivateEndpointResourceGuid string `json:"private_endpoint_resource_guid"`
-	PrivateEndpointResourceId   string `json:"private_endpoint_resource_id,omitempty"`
-	PrivateLinkServiceId        string `json:"private_link_service_id,omitempty"`
-}
-
-type ResourceEndpoint struct {
-	AccountId                string                                    `json:"account_id,omitempty"`
-	AzurePrivateEndpointInfo *ResourceEndpointAzurePrivateEndpointInfo `json:"azure_private_endpoint_info,omitempty"`
-	CreateTime               string                                    `json:"create_time,omitempty"`
-	DisplayName              string                                    `json:"display_name"`
-	EndpointId               string                                    `json:"endpoint_id,omitempty"`
-	Name                     string                                    `json:"name,omitempty"`
-	Parent                   string                                    `json:"parent"`
-	Region                   string                                    `json:"region"`
-	State                    string                                    `json:"state,omitempty"`
-	UseCase                  string                                    `json:"use_case,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_enhanced_security_monitoring_workspace_setting.go b/bundle/internal/tf/schema/resource_enhanced_security_monitoring_workspace_setting.go
deleted file mode 100644
index d5add6fbb8a..00000000000
--- a/bundle/internal/tf/schema/resource_enhanced_security_monitoring_workspace_setting.go
+++ /dev/null
@@ -1,19 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceEnhancedSecurityMonitoringWorkspaceSettingEnhancedSecurityMonitoringWorkspace struct {
-	IsEnabled bool `json:"is_enabled"`
-}
-
-type ResourceEnhancedSecurityMonitoringWorkspaceSettingProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceEnhancedSecurityMonitoringWorkspaceSetting struct {
-	Etag                                string                                                                                 `json:"etag,omitempty"`
-	Id                                  string                                                                                 `json:"id,omitempty"`
-	SettingName                         string                                                                                 `json:"setting_name,omitempty"`
-	EnhancedSecurityMonitoringWorkspace *ResourceEnhancedSecurityMonitoringWorkspaceSettingEnhancedSecurityMonitoringWorkspace `json:"enhanced_security_monitoring_workspace,omitempty"`
-	ProviderConfig                      *ResourceEnhancedSecurityMonitoringWorkspaceSettingProviderConfig                      `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_entitlements.go b/bundle/internal/tf/schema/resource_entitlements.go
deleted file mode 100644
index b59277f725f..00000000000
--- a/bundle/internal/tf/schema/resource_entitlements.go
+++ /dev/null
@@ -1,20 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceEntitlementsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceEntitlements struct {
-	AllowClusterCreate      bool                                `json:"allow_cluster_create,omitempty"`
-	AllowInstancePoolCreate bool                                `json:"allow_instance_pool_create,omitempty"`
-	DatabricksSqlAccess     bool                                `json:"databricks_sql_access,omitempty"`
-	GroupId                 string                              `json:"group_id,omitempty"`
-	Id                      string                              `json:"id,omitempty"`
-	ServicePrincipalId      string                              `json:"service_principal_id,omitempty"`
-	UserId                  string                              `json:"user_id,omitempty"`
-	WorkspaceAccess         bool                                `json:"workspace_access,omitempty"`
-	WorkspaceConsume        bool                                `json:"workspace_consume,omitempty"`
-	ProviderConfig          *ResourceEntitlementsProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_entity_tag_assignment.go b/bundle/internal/tf/schema/resource_entity_tag_assignment.go
deleted file mode 100644
index 3b7da58ffec..00000000000
--- a/bundle/internal/tf/schema/resource_entity_tag_assignment.go
+++ /dev/null
@@ -1,18 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceEntityTagAssignmentProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceEntityTagAssignment struct {
-	EntityName     string                                     `json:"entity_name"`
-	EntityType     string                                     `json:"entity_type"`
-	ProviderConfig *ResourceEntityTagAssignmentProviderConfig `json:"provider_config,omitempty"`
-	SourceType     string                                     `json:"source_type,omitempty"`
-	TagKey         string                                     `json:"tag_key"`
-	TagValue       string                                     `json:"tag_value,omitempty"`
-	UpdateTime     string                                     `json:"update_time,omitempty"`
-	UpdatedBy      string                                     `json:"updated_by,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_environments_default_workspace_base_environment.go b/bundle/internal/tf/schema/resource_environments_default_workspace_base_environment.go
deleted file mode 100644
index 4ea78fddc95..00000000000
--- a/bundle/internal/tf/schema/resource_environments_default_workspace_base_environment.go
+++ /dev/null
@@ -1,14 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceEnvironmentsDefaultWorkspaceBaseEnvironmentProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceEnvironmentsDefaultWorkspaceBaseEnvironment struct {
-	CpuWorkspaceBaseEnvironment string                                                             `json:"cpu_workspace_base_environment,omitempty"`
-	GpuWorkspaceBaseEnvironment string                                                             `json:"gpu_workspace_base_environment,omitempty"`
-	Name                        string                                                             `json:"name,omitempty"`
-	ProviderConfig              *ResourceEnvironmentsDefaultWorkspaceBaseEnvironmentProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_environments_workspace_base_environment.go b/bundle/internal/tf/schema/resource_environments_workspace_base_environment.go
deleted file mode 100644
index 59b497b77ba..00000000000
--- a/bundle/internal/tf/schema/resource_environments_workspace_base_environment.go
+++ /dev/null
@@ -1,24 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceEnvironmentsWorkspaceBaseEnvironmentProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceEnvironmentsWorkspaceBaseEnvironment struct {
-	BaseEnvironmentType          string                                                      `json:"base_environment_type,omitempty"`
-	CreateTime                   string                                                      `json:"create_time,omitempty"`
-	CreatorUserId                string                                                      `json:"creator_user_id,omitempty"`
-	DisplayName                  string                                                      `json:"display_name"`
-	EffectiveBaseEnvironmentType string                                                      `json:"effective_base_environment_type,omitempty"`
-	Filepath                     string                                                      `json:"filepath,omitempty"`
-	IsDefault                    bool                                                        `json:"is_default,omitempty"`
-	LastUpdatedUserId            string                                                      `json:"last_updated_user_id,omitempty"`
-	Message                      string                                                      `json:"message,omitempty"`
-	Name                         string                                                      `json:"name,omitempty"`
-	ProviderConfig               *ResourceEnvironmentsWorkspaceBaseEnvironmentProviderConfig `json:"provider_config,omitempty"`
-	Status                       string                                                      `json:"status,omitempty"`
-	UpdateTime                   string                                                      `json:"update_time,omitempty"`
-	WorkspaceBaseEnvironmentId   string                                                      `json:"workspace_base_environment_id,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_external_location.go b/bundle/internal/tf/schema/resource_external_location.go
deleted file mode 100644
index ef4fb962aef..00000000000
--- a/bundle/internal/tf/schema/resource_external_location.go
+++ /dev/null
@@ -1,130 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceExternalLocationEffectiveFileEventQueueManagedAqs struct {
-	ManagedResourceId string `json:"managed_resource_id,omitempty"`
-	QueueUrl          string `json:"queue_url,omitempty"`
-	ResourceGroup     string `json:"resource_group,omitempty"`
-	SubscriptionId    string `json:"subscription_id,omitempty"`
-}
-
-type ResourceExternalLocationEffectiveFileEventQueueManagedPubsub struct {
-	ManagedResourceId string `json:"managed_resource_id,omitempty"`
-	SubscriptionName  string `json:"subscription_name,omitempty"`
-}
-
-type ResourceExternalLocationEffectiveFileEventQueueManagedSqs struct {
-	ManagedResourceId string `json:"managed_resource_id,omitempty"`
-	QueueUrl          string `json:"queue_url,omitempty"`
-}
-
-type ResourceExternalLocationEffectiveFileEventQueueProvidedAqs struct {
-	ManagedResourceId string `json:"managed_resource_id,omitempty"`
-	QueueUrl          string `json:"queue_url,omitempty"`
-	ResourceGroup     string `json:"resource_group,omitempty"`
-	SubscriptionId    string `json:"subscription_id,omitempty"`
-}
-
-type ResourceExternalLocationEffectiveFileEventQueueProvidedPubsub struct {
-	ManagedResourceId string `json:"managed_resource_id,omitempty"`
-	SubscriptionName  string `json:"subscription_name,omitempty"`
-}
-
-type ResourceExternalLocationEffectiveFileEventQueueProvidedSqs struct {
-	ManagedResourceId string `json:"managed_resource_id,omitempty"`
-	QueueUrl          string `json:"queue_url,omitempty"`
-}
-
-type ResourceExternalLocationEffectiveFileEventQueue struct {
-	ManagedAqs     *ResourceExternalLocationEffectiveFileEventQueueManagedAqs     `json:"managed_aqs,omitempty"`
-	ManagedPubsub  *ResourceExternalLocationEffectiveFileEventQueueManagedPubsub  `json:"managed_pubsub,omitempty"`
-	ManagedSqs     *ResourceExternalLocationEffectiveFileEventQueueManagedSqs     `json:"managed_sqs,omitempty"`
-	ProvidedAqs    *ResourceExternalLocationEffectiveFileEventQueueProvidedAqs    `json:"provided_aqs,omitempty"`
-	ProvidedPubsub *ResourceExternalLocationEffectiveFileEventQueueProvidedPubsub `json:"provided_pubsub,omitempty"`
-	ProvidedSqs    *ResourceExternalLocationEffectiveFileEventQueueProvidedSqs    `json:"provided_sqs,omitempty"`
-}
-
-type ResourceExternalLocationEncryptionDetailsSseEncryptionDetails struct {
-	Algorithm    string `json:"algorithm,omitempty"`
-	AwsKmsKeyArn string `json:"aws_kms_key_arn,omitempty"`
-}
-
-type ResourceExternalLocationEncryptionDetails struct {
-	SseEncryptionDetails *ResourceExternalLocationEncryptionDetailsSseEncryptionDetails `json:"sse_encryption_details,omitempty"`
-}
-
-type ResourceExternalLocationFileEventQueueManagedAqs struct {
-	ManagedResourceId string `json:"managed_resource_id,omitempty"`
-	QueueUrl          string `json:"queue_url,omitempty"`
-	ResourceGroup     string `json:"resource_group"`
-	SubscriptionId    string `json:"subscription_id"`
-}
-
-type ResourceExternalLocationFileEventQueueManagedPubsub struct {
-	ManagedResourceId string `json:"managed_resource_id,omitempty"`
-	SubscriptionName  string `json:"subscription_name,omitempty"`
-}
-
-type ResourceExternalLocationFileEventQueueManagedSqs struct {
-	ManagedResourceId string `json:"managed_resource_id,omitempty"`
-	QueueUrl          string `json:"queue_url,omitempty"`
-}
-
-type ResourceExternalLocationFileEventQueueProvidedAqs struct {
-	ManagedResourceId string `json:"managed_resource_id,omitempty"`
-	QueueUrl          string `json:"queue_url"`
-	ResourceGroup     string `json:"resource_group,omitempty"`
-	SubscriptionId    string `json:"subscription_id,omitempty"`
-}
-
-type ResourceExternalLocationFileEventQueueProvidedPubsub struct {
-	ManagedResourceId string `json:"managed_resource_id,omitempty"`
-	SubscriptionName  string `json:"subscription_name"`
-}
-
-type ResourceExternalLocationFileEventQueueProvidedSqs struct {
-	ManagedResourceId string `json:"managed_resource_id,omitempty"`
-	QueueUrl          string `json:"queue_url"`
-}
-
-type ResourceExternalLocationFileEventQueue struct {
-	ManagedAqs     *ResourceExternalLocationFileEventQueueManagedAqs     `json:"managed_aqs,omitempty"`
-	ManagedPubsub  *ResourceExternalLocationFileEventQueueManagedPubsub  `json:"managed_pubsub,omitempty"`
-	ManagedSqs     *ResourceExternalLocationFileEventQueueManagedSqs     `json:"managed_sqs,omitempty"`
-	ProvidedAqs    *ResourceExternalLocationFileEventQueueProvidedAqs    `json:"provided_aqs,omitempty"`
-	ProvidedPubsub *ResourceExternalLocationFileEventQueueProvidedPubsub `json:"provided_pubsub,omitempty"`
-	ProvidedSqs    *ResourceExternalLocationFileEventQueueProvidedSqs    `json:"provided_sqs,omitempty"`
-}
-
-type ResourceExternalLocationProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceExternalLocation struct {
-	BrowseOnly                bool                                             `json:"browse_only,omitempty"`
-	Comment                   string                                           `json:"comment,omitempty"`
-	CreatedAt                 int                                              `json:"created_at,omitempty"`
-	CreatedBy                 string                                           `json:"created_by,omitempty"`
-	CredentialId              string                                           `json:"credential_id,omitempty"`
-	CredentialName            string                                           `json:"credential_name"`
-	EffectiveEnableFileEvents bool                                             `json:"effective_enable_file_events,omitempty"`
-	EnableFileEvents          bool                                             `json:"enable_file_events,omitempty"`
-	Fallback                  bool                                             `json:"fallback,omitempty"`
-	ForceDestroy              bool                                             `json:"force_destroy,omitempty"`
-	ForceUpdate               bool                                             `json:"force_update,omitempty"`
-	Id                        string                                           `json:"id,omitempty"`
-	IsolationMode             string                                           `json:"isolation_mode,omitempty"`
-	MetastoreId               string                                           `json:"metastore_id,omitempty"`
-	Name                      string                                           `json:"name"`
-	Owner                     string                                           `json:"owner,omitempty"`
-	ReadOnly                  bool                                             `json:"read_only,omitempty"`
-	SkipValidation            bool                                             `json:"skip_validation,omitempty"`
-	UpdatedAt                 int                                              `json:"updated_at,omitempty"`
-	UpdatedBy                 string                                           `json:"updated_by,omitempty"`
-	Url                       string                                           `json:"url"`
-	EffectiveFileEventQueue   *ResourceExternalLocationEffectiveFileEventQueue `json:"effective_file_event_queue,omitempty"`
-	EncryptionDetails         *ResourceExternalLocationEncryptionDetails       `json:"encryption_details,omitempty"`
-	FileEventQueue            *ResourceExternalLocationFileEventQueue          `json:"file_event_queue,omitempty"`
-	ProviderConfig            *ResourceExternalLocationProviderConfig          `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_external_metadata.go b/bundle/internal/tf/schema/resource_external_metadata.go
deleted file mode 100644
index 99108f27158..00000000000
--- a/bundle/internal/tf/schema/resource_external_metadata.go
+++ /dev/null
@@ -1,25 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceExternalMetadataProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceExternalMetadata struct {
-	Columns        []string                                `json:"columns,omitempty"`
-	CreateTime     string                                  `json:"create_time,omitempty"`
-	CreatedBy      string                                  `json:"created_by,omitempty"`
-	Description    string                                  `json:"description,omitempty"`
-	EntityType     string                                  `json:"entity_type"`
-	Id             string                                  `json:"id,omitempty"`
-	MetastoreId    string                                  `json:"metastore_id,omitempty"`
-	Name           string                                  `json:"name"`
-	Owner          string                                  `json:"owner,omitempty"`
-	Properties     map[string]string                       `json:"properties,omitempty"`
-	ProviderConfig *ResourceExternalMetadataProviderConfig `json:"provider_config,omitempty"`
-	SystemType     string                                  `json:"system_type"`
-	UpdateTime     string                                  `json:"update_time,omitempty"`
-	UpdatedBy      string                                  `json:"updated_by,omitempty"`
-	Url            string                                  `json:"url,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_feature_engineering_feature.go b/bundle/internal/tf/schema/resource_feature_engineering_feature.go
deleted file mode 100644
index 1a99477f647..00000000000
--- a/bundle/internal/tf/schema/resource_feature_engineering_feature.go
+++ /dev/null
@@ -1,210 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceFeatureEngineeringFeatureEntities struct {
-	Name string `json:"name"`
-}
-
-type ResourceFeatureEngineeringFeatureFunctionAggregationFunctionApproxCountDistinct struct {
-	Input      string `json:"input"`
-	RelativeSd int    `json:"relative_sd,omitempty"`
-}
-
-type ResourceFeatureEngineeringFeatureFunctionAggregationFunctionApproxPercentile struct {
-	Accuracy   int    `json:"accuracy,omitempty"`
-	Input      string `json:"input"`
-	Percentile int    `json:"percentile"`
-}
-
-type ResourceFeatureEngineeringFeatureFunctionAggregationFunctionAvg struct {
-	Input string `json:"input"`
-}
-
-type ResourceFeatureEngineeringFeatureFunctionAggregationFunctionCountFunction struct {
-	Input string `json:"input"`
-}
-
-type ResourceFeatureEngineeringFeatureFunctionAggregationFunctionFirst struct {
-	Input string `json:"input"`
-}
-
-type ResourceFeatureEngineeringFeatureFunctionAggregationFunctionLast struct {
-	Input string `json:"input"`
-}
-
-type ResourceFeatureEngineeringFeatureFunctionAggregationFunctionMax struct {
-	Input string `json:"input"`
-}
-
-type ResourceFeatureEngineeringFeatureFunctionAggregationFunctionMin struct {
-	Input string `json:"input"`
-}
-
-type ResourceFeatureEngineeringFeatureFunctionAggregationFunctionStddevPop struct {
-	Input string `json:"input"`
-}
-
-type ResourceFeatureEngineeringFeatureFunctionAggregationFunctionStddevSamp struct {
-	Input string `json:"input"`
-}
-
-type ResourceFeatureEngineeringFeatureFunctionAggregationFunctionSum struct {
-	Input string `json:"input"`
-}
-
-type ResourceFeatureEngineeringFeatureFunctionAggregationFunctionTimeWindowContinuous struct {
-	Offset         string `json:"offset,omitempty"`
-	WindowDuration string `json:"window_duration"`
-}
-
-type ResourceFeatureEngineeringFeatureFunctionAggregationFunctionTimeWindowSliding struct {
-	SlideDuration  string `json:"slide_duration"`
-	WindowDuration string `json:"window_duration"`
-}
-
-type ResourceFeatureEngineeringFeatureFunctionAggregationFunctionTimeWindowTumbling struct {
-	WindowDuration string `json:"window_duration"`
-}
-
-type ResourceFeatureEngineeringFeatureFunctionAggregationFunctionTimeWindow struct {
-	Continuous *ResourceFeatureEngineeringFeatureFunctionAggregationFunctionTimeWindowContinuous `json:"continuous,omitempty"`
-	Sliding    *ResourceFeatureEngineeringFeatureFunctionAggregationFunctionTimeWindowSliding    `json:"sliding,omitempty"`
-	Tumbling   *ResourceFeatureEngineeringFeatureFunctionAggregationFunctionTimeWindowTumbling   `json:"tumbling,omitempty"`
-}
-
-type ResourceFeatureEngineeringFeatureFunctionAggregationFunctionVarPop struct {
-	Input string `json:"input"`
-}
-
-type ResourceFeatureEngineeringFeatureFunctionAggregationFunctionVarSamp struct {
-	Input string `json:"input"`
-}
-
-type ResourceFeatureEngineeringFeatureFunctionAggregationFunction struct {
-	ApproxCountDistinct *ResourceFeatureEngineeringFeatureFunctionAggregationFunctionApproxCountDistinct `json:"approx_count_distinct,omitempty"`
-	ApproxPercentile    *ResourceFeatureEngineeringFeatureFunctionAggregationFunctionApproxPercentile    `json:"approx_percentile,omitempty"`
-	Avg                 *ResourceFeatureEngineeringFeatureFunctionAggregationFunctionAvg                 `json:"avg,omitempty"`
-	CountFunction       *ResourceFeatureEngineeringFeatureFunctionAggregationFunctionCountFunction       `json:"count_function,omitempty"`
-	First               *ResourceFeatureEngineeringFeatureFunctionAggregationFunctionFirst               `json:"first,omitempty"`
-	Last                *ResourceFeatureEngineeringFeatureFunctionAggregationFunctionLast                `json:"last,omitempty"`
-	Max                 *ResourceFeatureEngineeringFeatureFunctionAggregationFunctionMax                 `json:"max,omitempty"`
-	Min                 *ResourceFeatureEngineeringFeatureFunctionAggregationFunctionMin                 `json:"min,omitempty"`
-	StddevPop           *ResourceFeatureEngineeringFeatureFunctionAggregationFunctionStddevPop           `json:"stddev_pop,omitempty"`
-	StddevSamp          *ResourceFeatureEngineeringFeatureFunctionAggregationFunctionStddevSamp          `json:"stddev_samp,omitempty"`
-	Sum                 *ResourceFeatureEngineeringFeatureFunctionAggregationFunctionSum                 `json:"sum,omitempty"`
-	TimeWindow          *ResourceFeatureEngineeringFeatureFunctionAggregationFunctionTimeWindow          `json:"time_window,omitempty"`
-	VarPop              *ResourceFeatureEngineeringFeatureFunctionAggregationFunctionVarPop              `json:"var_pop,omitempty"`
-	VarSamp             *ResourceFeatureEngineeringFeatureFunctionAggregationFunctionVarSamp             `json:"var_samp,omitempty"`
-}
-
-type ResourceFeatureEngineeringFeatureFunctionColumnSelection struct {
-	Column string `json:"column"`
-}
-
-type ResourceFeatureEngineeringFeatureFunctionExtraParameters struct {
-	Key   string `json:"key"`
-	Value string `json:"value"`
-}
-
-type ResourceFeatureEngineeringFeatureFunction struct {
-	AggregationFunction *ResourceFeatureEngineeringFeatureFunctionAggregationFunction `json:"aggregation_function,omitempty"`
-	ColumnSelection     *ResourceFeatureEngineeringFeatureFunctionColumnSelection     `json:"column_selection,omitempty"`
-	ExtraParameters     []ResourceFeatureEngineeringFeatureFunctionExtraParameters    `json:"extra_parameters,omitempty"`
-	FunctionType        string                                                        `json:"function_type,omitempty"`
-}
-
-type ResourceFeatureEngineeringFeatureLineageContextJobContext struct {
-	JobId    int `json:"job_id,omitempty"`
-	JobRunId int `json:"job_run_id,omitempty"`
-}
-
-type ResourceFeatureEngineeringFeatureLineageContext struct {
-	JobContext *ResourceFeatureEngineeringFeatureLineageContextJobContext `json:"job_context,omitempty"`
-	NotebookId int                                                        `json:"notebook_id,omitempty"`
-}
-
-type ResourceFeatureEngineeringFeatureProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceFeatureEngineeringFeatureSourceDeltaTableSource struct {
-	DataframeSchema   string   `json:"dataframe_schema,omitempty"`
-	EntityColumns     []string `json:"entity_columns,omitempty"`
-	FilterCondition   string   `json:"filter_condition,omitempty"`
-	FullName          string   `json:"full_name"`
-	TimeseriesColumn  string   `json:"timeseries_column,omitempty"`
-	TransformationSql string   `json:"transformation_sql,omitempty"`
-}
-
-type ResourceFeatureEngineeringFeatureSourceKafkaSourceEntityColumnIdentifiers struct {
-	VariantExprPath string `json:"variant_expr_path"`
-}
-
-type ResourceFeatureEngineeringFeatureSourceKafkaSourceTimeseriesColumnIdentifier struct {
-	VariantExprPath string `json:"variant_expr_path"`
-}
-
-type ResourceFeatureEngineeringFeatureSourceKafkaSource struct {
-	EntityColumnIdentifiers    []ResourceFeatureEngineeringFeatureSourceKafkaSourceEntityColumnIdentifiers   `json:"entity_column_identifiers,omitempty"`
-	FilterCondition            string                                                                        `json:"filter_condition,omitempty"`
-	Name                       string                                                                        `json:"name"`
-	TimeseriesColumnIdentifier *ResourceFeatureEngineeringFeatureSourceKafkaSourceTimeseriesColumnIdentifier `json:"timeseries_column_identifier,omitempty"`
-}
-
-type ResourceFeatureEngineeringFeatureSourceRequestSourceFlatSchemaFields struct {
-	DataType string `json:"data_type"`
-	Name     string `json:"name"`
-}
-
-type ResourceFeatureEngineeringFeatureSourceRequestSourceFlatSchema struct {
-	Fields []ResourceFeatureEngineeringFeatureSourceRequestSourceFlatSchemaFields `json:"fields,omitempty"`
-}
-
-type ResourceFeatureEngineeringFeatureSourceRequestSource struct {
-	FlatSchema *ResourceFeatureEngineeringFeatureSourceRequestSourceFlatSchema `json:"flat_schema,omitempty"`
-}
-
-type ResourceFeatureEngineeringFeatureSource struct {
-	DeltaTableSource *ResourceFeatureEngineeringFeatureSourceDeltaTableSource `json:"delta_table_source,omitempty"`
-	KafkaSource      *ResourceFeatureEngineeringFeatureSourceKafkaSource      `json:"kafka_source,omitempty"`
-	RequestSource    *ResourceFeatureEngineeringFeatureSourceRequestSource    `json:"request_source,omitempty"`
-}
-
-type ResourceFeatureEngineeringFeatureTimeWindowContinuous struct {
-	Offset         string `json:"offset,omitempty"`
-	WindowDuration string `json:"window_duration"`
-}
-
-type ResourceFeatureEngineeringFeatureTimeWindowSliding struct {
-	SlideDuration  string `json:"slide_duration"`
-	WindowDuration string `json:"window_duration"`
-}
-
-type ResourceFeatureEngineeringFeatureTimeWindowTumbling struct {
-	WindowDuration string `json:"window_duration"`
-}
-
-type ResourceFeatureEngineeringFeatureTimeWindow struct {
-	Continuous *ResourceFeatureEngineeringFeatureTimeWindowContinuous `json:"continuous,omitempty"`
-	Sliding    *ResourceFeatureEngineeringFeatureTimeWindowSliding    `json:"sliding,omitempty"`
-	Tumbling   *ResourceFeatureEngineeringFeatureTimeWindowTumbling   `json:"tumbling,omitempty"`
-}
-
-type ResourceFeatureEngineeringFeatureTimeseriesColumn struct {
-	Name string `json:"name"`
-}
-
-type ResourceFeatureEngineeringFeature struct {
-	Description      string                                             `json:"description,omitempty"`
-	Entities         []ResourceFeatureEngineeringFeatureEntities        `json:"entities,omitempty"`
-	FilterCondition  string                                             `json:"filter_condition,omitempty"`
-	FullName         string                                             `json:"full_name"`
-	Function         *ResourceFeatureEngineeringFeatureFunction         `json:"function,omitempty"`
-	Inputs           []string                                           `json:"inputs,omitempty"`
-	LineageContext   *ResourceFeatureEngineeringFeatureLineageContext   `json:"lineage_context,omitempty"`
-	ProviderConfig   *ResourceFeatureEngineeringFeatureProviderConfig   `json:"provider_config,omitempty"`
-	Source           *ResourceFeatureEngineeringFeatureSource           `json:"source,omitempty"`
-	TimeWindow       *ResourceFeatureEngineeringFeatureTimeWindow       `json:"time_window,omitempty"`
-	TimeseriesColumn *ResourceFeatureEngineeringFeatureTimeseriesColumn `json:"timeseries_column,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_feature_engineering_kafka_config.go b/bundle/internal/tf/schema/resource_feature_engineering_kafka_config.go
deleted file mode 100644
index 864741b6132..00000000000
--- a/bundle/internal/tf/schema/resource_feature_engineering_kafka_config.go
+++ /dev/null
@@ -1,50 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceFeatureEngineeringKafkaConfigAuthConfig struct {
-	UcServiceCredentialName string `json:"uc_service_credential_name,omitempty"`
-}
-
-type ResourceFeatureEngineeringKafkaConfigBackfillSourceDeltaTableSource struct {
-	DataframeSchema   string   `json:"dataframe_schema,omitempty"`
-	EntityColumns     []string `json:"entity_columns,omitempty"`
-	FilterCondition   string   `json:"filter_condition,omitempty"`
-	FullName          string   `json:"full_name"`
-	TimeseriesColumn  string   `json:"timeseries_column,omitempty"`
-	TransformationSql string   `json:"transformation_sql,omitempty"`
-}
-
-type ResourceFeatureEngineeringKafkaConfigBackfillSource struct {
-	DeltaTableSource *ResourceFeatureEngineeringKafkaConfigBackfillSourceDeltaTableSource `json:"delta_table_source,omitempty"`
-}
-
-type ResourceFeatureEngineeringKafkaConfigKeySchema struct {
-	JsonSchema string `json:"json_schema,omitempty"`
-}
-
-type ResourceFeatureEngineeringKafkaConfigProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceFeatureEngineeringKafkaConfigSubscriptionMode struct {
-	Assign           string `json:"assign,omitempty"`
-	Subscribe        string `json:"subscribe,omitempty"`
-	SubscribePattern string `json:"subscribe_pattern,omitempty"`
-}
-
-type ResourceFeatureEngineeringKafkaConfigValueSchema struct {
-	JsonSchema string `json:"json_schema,omitempty"`
-}
-
-type ResourceFeatureEngineeringKafkaConfig struct {
-	AuthConfig       *ResourceFeatureEngineeringKafkaConfigAuthConfig       `json:"auth_config,omitempty"`
-	BackfillSource   *ResourceFeatureEngineeringKafkaConfigBackfillSource   `json:"backfill_source,omitempty"`
-	BootstrapServers string                                                 `json:"bootstrap_servers"`
-	ExtraOptions     map[string]string                                      `json:"extra_options,omitempty"`
-	KeySchema        *ResourceFeatureEngineeringKafkaConfigKeySchema        `json:"key_schema,omitempty"`
-	Name             string                                                 `json:"name,omitempty"`
-	ProviderConfig   *ResourceFeatureEngineeringKafkaConfigProviderConfig   `json:"provider_config,omitempty"`
-	SubscriptionMode *ResourceFeatureEngineeringKafkaConfigSubscriptionMode `json:"subscription_mode,omitempty"`
-	ValueSchema      *ResourceFeatureEngineeringKafkaConfigValueSchema      `json:"value_schema,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_feature_engineering_materialized_feature.go b/bundle/internal/tf/schema/resource_feature_engineering_materialized_feature.go
deleted file mode 100644
index ddc305f0aa6..00000000000
--- a/bundle/internal/tf/schema/resource_feature_engineering_materialized_feature.go
+++ /dev/null
@@ -1,33 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceFeatureEngineeringMaterializedFeatureOfflineStoreConfig struct {
-	CatalogName     string `json:"catalog_name"`
-	SchemaName      string `json:"schema_name"`
-	TableNamePrefix string `json:"table_name_prefix"`
-}
-
-type ResourceFeatureEngineeringMaterializedFeatureOnlineStoreConfig struct {
-	CatalogName     string `json:"catalog_name"`
-	OnlineStoreName string `json:"online_store_name"`
-	SchemaName      string `json:"schema_name"`
-	TableNamePrefix string `json:"table_name_prefix"`
-}
-
-type ResourceFeatureEngineeringMaterializedFeatureProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceFeatureEngineeringMaterializedFeature struct {
-	CronSchedule            string                                                           `json:"cron_schedule,omitempty"`
-	FeatureName             string                                                           `json:"feature_name"`
-	IsOnline                bool                                                             `json:"is_online,omitempty"`
-	LastMaterializationTime string                                                           `json:"last_materialization_time,omitempty"`
-	MaterializedFeatureId   string                                                           `json:"materialized_feature_id,omitempty"`
-	OfflineStoreConfig      *ResourceFeatureEngineeringMaterializedFeatureOfflineStoreConfig `json:"offline_store_config,omitempty"`
-	OnlineStoreConfig       *ResourceFeatureEngineeringMaterializedFeatureOnlineStoreConfig  `json:"online_store_config,omitempty"`
-	PipelineScheduleState   string                                                           `json:"pipeline_schedule_state,omitempty"`
-	ProviderConfig          *ResourceFeatureEngineeringMaterializedFeatureProviderConfig     `json:"provider_config,omitempty"`
-	TableName               string                                                           `json:"table_name,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_file.go b/bundle/internal/tf/schema/resource_file.go
deleted file mode 100644
index 9d5e7708cb9..00000000000
--- a/bundle/internal/tf/schema/resource_file.go
+++ /dev/null
@@ -1,19 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceFileProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceFile struct {
-	ContentBase64      string                      `json:"content_base64,omitempty"`
-	FileSize           int                         `json:"file_size,omitempty"`
-	Id                 string                      `json:"id,omitempty"`
-	Md5                string                      `json:"md5,omitempty"`
-	ModificationTime   string                      `json:"modification_time,omitempty"`
-	Path               string                      `json:"path"`
-	RemoteFileModified bool                        `json:"remote_file_modified,omitempty"`
-	Source             string                      `json:"source,omitempty"`
-	ProviderConfig     *ResourceFileProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_git_credential.go b/bundle/internal/tf/schema/resource_git_credential.go
deleted file mode 100644
index 1384282b60b..00000000000
--- a/bundle/internal/tf/schema/resource_git_credential.go
+++ /dev/null
@@ -1,20 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceGitCredentialProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceGitCredential struct {
-	Force                bool                                 `json:"force,omitempty"`
-	GitEmail             string                               `json:"git_email,omitempty"`
-	GitProvider          string                               `json:"git_provider"`
-	GitUsername          string                               `json:"git_username,omitempty"`
-	Id                   string                               `json:"id,omitempty"`
-	IsDefaultForProvider bool                                 `json:"is_default_for_provider,omitempty"`
-	Name                 string                               `json:"name,omitempty"`
-	PersonalAccessToken  string                               `json:"personal_access_token,omitempty"`
-	PrincipalId          int                                  `json:"principal_id,omitempty"`
-	ProviderConfig       *ResourceGitCredentialProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_global_init_script.go b/bundle/internal/tf/schema/resource_global_init_script.go
deleted file mode 100644
index 0c28e4d62bb..00000000000
--- a/bundle/internal/tf/schema/resource_global_init_script.go
+++ /dev/null
@@ -1,18 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceGlobalInitScriptProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceGlobalInitScript struct {
-	ContentBase64  string                                  `json:"content_base64,omitempty"`
-	Enabled        bool                                    `json:"enabled,omitempty"`
-	Id             string                                  `json:"id,omitempty"`
-	Md5            string                                  `json:"md5,omitempty"`
-	Name           string                                  `json:"name"`
-	Position       int                                     `json:"position,omitempty"`
-	Source         string                                  `json:"source,omitempty"`
-	ProviderConfig *ResourceGlobalInitScriptProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_grant.go b/bundle/internal/tf/schema/resource_grant.go
deleted file mode 100644
index 0edc341139d..00000000000
--- a/bundle/internal/tf/schema/resource_grant.go
+++ /dev/null
@@ -1,28 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceGrantProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceGrant struct {
-	Catalog           string                       `json:"catalog,omitempty"`
-	Credential        string                       `json:"credential,omitempty"`
-	ExternalLocation  string                       `json:"external_location,omitempty"`
-	ForeignConnection string                       `json:"foreign_connection,omitempty"`
-	Function          string                       `json:"function,omitempty"`
-	Id                string                       `json:"id,omitempty"`
-	Metastore         string                       `json:"metastore,omitempty"`
-	Model             string                       `json:"model,omitempty"`
-	Pipeline          string                       `json:"pipeline,omitempty"`
-	Principal         string                       `json:"principal"`
-	Privileges        []string                     `json:"privileges"`
-	Recipient         string                       `json:"recipient,omitempty"`
-	Schema            string                       `json:"schema,omitempty"`
-	Share             string                       `json:"share,omitempty"`
-	StorageCredential string                       `json:"storage_credential,omitempty"`
-	Table             string                       `json:"table,omitempty"`
-	Volume            string                       `json:"volume,omitempty"`
-	ProviderConfig    *ResourceGrantProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_grants.go b/bundle/internal/tf/schema/resource_grants.go
deleted file mode 100644
index d28af8fa0a8..00000000000
--- a/bundle/internal/tf/schema/resource_grants.go
+++ /dev/null
@@ -1,32 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceGrantsGrant struct {
-	Principal  string   `json:"principal"`
-	Privileges []string `json:"privileges"`
-}
-
-type ResourceGrantsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceGrants struct {
-	Catalog           string                        `json:"catalog,omitempty"`
-	Credential        string                        `json:"credential,omitempty"`
-	ExternalLocation  string                        `json:"external_location,omitempty"`
-	ForeignConnection string                        `json:"foreign_connection,omitempty"`
-	Function          string                        `json:"function,omitempty"`
-	Id                string                        `json:"id,omitempty"`
-	Metastore         string                        `json:"metastore,omitempty"`
-	Model             string                        `json:"model,omitempty"`
-	Pipeline          string                        `json:"pipeline,omitempty"`
-	Recipient         string                        `json:"recipient,omitempty"`
-	Schema            string                        `json:"schema,omitempty"`
-	Share             string                        `json:"share,omitempty"`
-	StorageCredential string                        `json:"storage_credential,omitempty"`
-	Table             string                        `json:"table,omitempty"`
-	Volume            string                        `json:"volume,omitempty"`
-	Grant             []ResourceGrantsGrant         `json:"grant,omitempty"`
-	ProviderConfig    *ResourceGrantsProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_group.go b/bundle/internal/tf/schema/resource_group.go
deleted file mode 100644
index 4a9eb9285ce..00000000000
--- a/bundle/internal/tf/schema/resource_group.go
+++ /dev/null
@@ -1,23 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceGroupProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceGroup struct {
-	AclPrincipalId          string                       `json:"acl_principal_id,omitempty"`
-	AllowClusterCreate      bool                         `json:"allow_cluster_create,omitempty"`
-	AllowInstancePoolCreate bool                         `json:"allow_instance_pool_create,omitempty"`
-	Api                     string                       `json:"api,omitempty"`
-	DatabricksSqlAccess     bool                         `json:"databricks_sql_access,omitempty"`
-	DisplayName             string                       `json:"display_name"`
-	ExternalId              string                       `json:"external_id,omitempty"`
-	Force                   bool                         `json:"force,omitempty"`
-	Id                      string                       `json:"id,omitempty"`
-	Url                     string                       `json:"url,omitempty"`
-	WorkspaceAccess         bool                         `json:"workspace_access,omitempty"`
-	WorkspaceConsume        bool                         `json:"workspace_consume,omitempty"`
-	ProviderConfig          *ResourceGroupProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_group_instance_profile.go b/bundle/internal/tf/schema/resource_group_instance_profile.go
deleted file mode 100644
index 3ea5402c12b..00000000000
--- a/bundle/internal/tf/schema/resource_group_instance_profile.go
+++ /dev/null
@@ -1,15 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceGroupInstanceProfileProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceGroupInstanceProfile struct {
-	Api               string                                      `json:"api,omitempty"`
-	GroupId           string                                      `json:"group_id"`
-	Id                string                                      `json:"id,omitempty"`
-	InstanceProfileId string                                      `json:"instance_profile_id"`
-	ProviderConfig    *ResourceGroupInstanceProfileProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_group_member.go b/bundle/internal/tf/schema/resource_group_member.go
deleted file mode 100644
index d849082ee2d..00000000000
--- a/bundle/internal/tf/schema/resource_group_member.go
+++ /dev/null
@@ -1,15 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceGroupMemberProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceGroupMember struct {
-	Api            string                             `json:"api,omitempty"`
-	GroupId        string                             `json:"group_id"`
-	Id             string                             `json:"id,omitempty"`
-	MemberId       string                             `json:"member_id"`
-	ProviderConfig *ResourceGroupMemberProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_group_role.go b/bundle/internal/tf/schema/resource_group_role.go
deleted file mode 100644
index 9f2ec718685..00000000000
--- a/bundle/internal/tf/schema/resource_group_role.go
+++ /dev/null
@@ -1,15 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceGroupRoleProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceGroupRole struct {
-	Api            string                           `json:"api,omitempty"`
-	GroupId        string                           `json:"group_id"`
-	Id             string                           `json:"id,omitempty"`
-	Role           string                           `json:"role"`
-	ProviderConfig *ResourceGroupRoleProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_instance_pool.go b/bundle/internal/tf/schema/resource_instance_pool.go
deleted file mode 100644
index aed4cf775db..00000000000
--- a/bundle/internal/tf/schema/resource_instance_pool.go
+++ /dev/null
@@ -1,92 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceInstancePoolAwsAttributes struct {
-	Availability        string `json:"availability,omitempty"`
-	InstanceProfileArn  string `json:"instance_profile_arn,omitempty"`
-	SpotBidPricePercent int    `json:"spot_bid_price_percent,omitempty"`
-	ZoneId              string `json:"zone_id,omitempty"`
-}
-
-type ResourceInstancePoolAzureAttributes struct {
-	Availability    string `json:"availability,omitempty"`
-	SpotBidMaxPrice int    `json:"spot_bid_max_price,omitempty"`
-}
-
-type ResourceInstancePoolDiskSpecDiskType struct {
-	AzureDiskVolumeType string `json:"azure_disk_volume_type,omitempty"`
-	EbsVolumeType       string `json:"ebs_volume_type,omitempty"`
-}
-
-type ResourceInstancePoolDiskSpec struct {
-	DiskCount int                                   `json:"disk_count,omitempty"`
-	DiskSize  int                                   `json:"disk_size,omitempty"`
-	DiskType  *ResourceInstancePoolDiskSpecDiskType `json:"disk_type,omitempty"`
-}
-
-type ResourceInstancePoolGcpAttributes struct {
-	GcpAvailability string `json:"gcp_availability,omitempty"`
-	LocalSsdCount   int    `json:"local_ssd_count,omitempty"`
-	ZoneId          string `json:"zone_id,omitempty"`
-}
-
-type ResourceInstancePoolInstancePoolFleetAttributesFleetOnDemandOption struct {
-	AllocationStrategy      string `json:"allocation_strategy"`
-	InstancePoolsToUseCount int    `json:"instance_pools_to_use_count,omitempty"`
-}
-
-type ResourceInstancePoolInstancePoolFleetAttributesFleetSpotOption struct {
-	AllocationStrategy      string `json:"allocation_strategy"`
-	InstancePoolsToUseCount int    `json:"instance_pools_to_use_count,omitempty"`
-}
-
-type ResourceInstancePoolInstancePoolFleetAttributesLaunchTemplateOverride struct {
-	AvailabilityZone string `json:"availability_zone"`
-	InstanceType     string `json:"instance_type"`
-}
-
-type ResourceInstancePoolInstancePoolFleetAttributes struct {
-	FleetOnDemandOption    *ResourceInstancePoolInstancePoolFleetAttributesFleetOnDemandOption     `json:"fleet_on_demand_option,omitempty"`
-	FleetSpotOption        *ResourceInstancePoolInstancePoolFleetAttributesFleetSpotOption         `json:"fleet_spot_option,omitempty"`
-	LaunchTemplateOverride []ResourceInstancePoolInstancePoolFleetAttributesLaunchTemplateOverride `json:"launch_template_override,omitempty"`
-}
-
-type ResourceInstancePoolNodeTypeFlexibility struct {
-	AlternateNodeTypeIds []string `json:"alternate_node_type_ids"`
-}
-
-type ResourceInstancePoolPreloadedDockerImageBasicAuth struct {
-	Password string `json:"password"`
-	Username string `json:"username"`
-}
-
-type ResourceInstancePoolPreloadedDockerImage struct {
-	Url       string                                             `json:"url"`
-	BasicAuth *ResourceInstancePoolPreloadedDockerImageBasicAuth `json:"basic_auth,omitempty"`
-}
-
-type ResourceInstancePoolProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceInstancePool struct {
-	CustomTags                         map[string]string                                `json:"custom_tags,omitempty"`
-	EnableElasticDisk                  bool                                             `json:"enable_elastic_disk,omitempty"`
-	Id                                 string                                           `json:"id,omitempty"`
-	IdleInstanceAutoterminationMinutes int                                              `json:"idle_instance_autotermination_minutes"`
-	InstancePoolId                     string                                           `json:"instance_pool_id,omitempty"`
-	InstancePoolName                   string                                           `json:"instance_pool_name"`
-	MaxCapacity                        int                                              `json:"max_capacity,omitempty"`
-	MinIdleInstances                   int                                              `json:"min_idle_instances,omitempty"`
-	NodeTypeId                         string                                           `json:"node_type_id,omitempty"`
-	PreloadedSparkVersions             []string                                         `json:"preloaded_spark_versions,omitempty"`
-	AwsAttributes                      *ResourceInstancePoolAwsAttributes               `json:"aws_attributes,omitempty"`
-	AzureAttributes                    *ResourceInstancePoolAzureAttributes             `json:"azure_attributes,omitempty"`
-	DiskSpec                           *ResourceInstancePoolDiskSpec                    `json:"disk_spec,omitempty"`
-	GcpAttributes                      *ResourceInstancePoolGcpAttributes               `json:"gcp_attributes,omitempty"`
-	InstancePoolFleetAttributes        *ResourceInstancePoolInstancePoolFleetAttributes `json:"instance_pool_fleet_attributes,omitempty"`
-	NodeTypeFlexibility                *ResourceInstancePoolNodeTypeFlexibility         `json:"node_type_flexibility,omitempty"`
-	PreloadedDockerImage               []ResourceInstancePoolPreloadedDockerImage       `json:"preloaded_docker_image,omitempty"`
-	ProviderConfig                     *ResourceInstancePoolProviderConfig              `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_instance_profile.go b/bundle/internal/tf/schema/resource_instance_profile.go
deleted file mode 100644
index c80e0f11188..00000000000
--- a/bundle/internal/tf/schema/resource_instance_profile.go
+++ /dev/null
@@ -1,16 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceInstanceProfileProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceInstanceProfile struct {
-	IamRoleArn            string                                 `json:"iam_role_arn,omitempty"`
-	Id                    string                                 `json:"id,omitempty"`
-	InstanceProfileArn    string                                 `json:"instance_profile_arn"`
-	IsMetaInstanceProfile bool                                   `json:"is_meta_instance_profile,omitempty"`
-	SkipValidation        bool                                   `json:"skip_validation,omitempty"`
-	ProviderConfig        *ResourceInstanceProfileProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_ip_access_list.go b/bundle/internal/tf/schema/resource_ip_access_list.go
deleted file mode 100644
index 51c720aae72..00000000000
--- a/bundle/internal/tf/schema/resource_ip_access_list.go
+++ /dev/null
@@ -1,16 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceIpAccessListProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceIpAccessList struct {
-	Enabled        bool                                `json:"enabled,omitempty"`
-	Id             string                              `json:"id,omitempty"`
-	IpAddresses    []string                            `json:"ip_addresses"`
-	Label          string                              `json:"label"`
-	ListType       string                              `json:"list_type"`
-	ProviderConfig *ResourceIpAccessListProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_job.go b/bundle/internal/tf/schema/resource_job.go
deleted file mode 100644
index d6603c62fba..00000000000
--- a/bundle/internal/tf/schema/resource_job.go
+++ /dev/null
@@ -1,1852 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceJobContinuous struct {
-	PauseStatus   string `json:"pause_status,omitempty"`
-	TaskRetryMode string `json:"task_retry_mode,omitempty"`
-}
-
-type ResourceJobDbtTask struct {
-	Catalog           string   `json:"catalog,omitempty"`
-	Commands          []string `json:"commands"`
-	ProfilesDirectory string   `json:"profiles_directory,omitempty"`
-	ProjectDirectory  string   `json:"project_directory,omitempty"`
-	Schema            string   `json:"schema,omitempty"`
-	Source            string   `json:"source,omitempty"`
-	WarehouseId       string   `json:"warehouse_id,omitempty"`
-}
-
-type ResourceJobDeployment struct {
-	Kind             string `json:"kind"`
-	MetadataFilePath string `json:"metadata_file_path,omitempty"`
-}
-
-type ResourceJobEmailNotifications struct {
-	NoAlertForSkippedRuns              bool     `json:"no_alert_for_skipped_runs,omitempty"`
-	OnDurationWarningThresholdExceeded []string `json:"on_duration_warning_threshold_exceeded,omitempty"`
-	OnFailure                          []string `json:"on_failure,omitempty"`
-	OnStart                            []string `json:"on_start,omitempty"`
-	OnStreamingBacklogExceeded         []string `json:"on_streaming_backlog_exceeded,omitempty"`
-	OnSuccess                          []string `json:"on_success,omitempty"`
-}
-
-type ResourceJobEnvironmentSpec struct {
-	BaseEnvironment    string   `json:"base_environment,omitempty"`
-	Client             string   `json:"client,omitempty"`
-	Dependencies       []string `json:"dependencies,omitempty"`
-	EnvironmentVersion string   `json:"environment_version,omitempty"`
-	JavaDependencies   []string `json:"java_dependencies,omitempty"`
-}
-
-type ResourceJobEnvironment struct {
-	EnvironmentKey string                      `json:"environment_key"`
-	Spec           *ResourceJobEnvironmentSpec `json:"spec,omitempty"`
-}
-
-type ResourceJobGitSourceGitSnapshot struct {
-	UsedCommit string `json:"used_commit,omitempty"`
-}
-
-type ResourceJobGitSourceJobSource struct {
-	DirtyState          string `json:"dirty_state,omitempty"`
-	ImportFromGitBranch string `json:"import_from_git_branch"`
-	JobConfigPath       string `json:"job_config_path"`
-}
-
-type ResourceJobGitSourceSparseCheckout struct {
-	Patterns []string `json:"patterns,omitempty"`
-}
-
-type ResourceJobGitSource struct {
-	Branch         string                              `json:"branch,omitempty"`
-	Commit         string                              `json:"commit,omitempty"`
-	Provider       string                              `json:"provider,omitempty"`
-	Tag            string                              `json:"tag,omitempty"`
-	Url            string                              `json:"url"`
-	GitSnapshot    *ResourceJobGitSourceGitSnapshot    `json:"git_snapshot,omitempty"`
-	JobSource      *ResourceJobGitSourceJobSource      `json:"job_source,omitempty"`
-	SparseCheckout *ResourceJobGitSourceSparseCheckout `json:"sparse_checkout,omitempty"`
-}
-
-type ResourceJobHealthRules struct {
-	Metric string `json:"metric"`
-	Op     string `json:"op"`
-	Value  int    `json:"value"`
-}
-
-type ResourceJobHealth struct {
-	Rules []ResourceJobHealthRules `json:"rules,omitempty"`
-}
-
-type ResourceJobJobClusterNewClusterAutoscale struct {
-	MaxWorkers int `json:"max_workers,omitempty"`
-	MinWorkers int `json:"min_workers,omitempty"`
-}
-
-type ResourceJobJobClusterNewClusterAwsAttributes struct {
-	Availability        string `json:"availability,omitempty"`
-	EbsVolumeCount      int    `json:"ebs_volume_count,omitempty"`
-	EbsVolumeIops       int    `json:"ebs_volume_iops,omitempty"`
-	EbsVolumeSize       int    `json:"ebs_volume_size,omitempty"`
-	EbsVolumeThroughput int    `json:"ebs_volume_throughput,omitempty"`
-	EbsVolumeType       string `json:"ebs_volume_type,omitempty"`
-	FirstOnDemand       int    `json:"first_on_demand,omitempty"`
-	InstanceProfileArn  string `json:"instance_profile_arn,omitempty"`
-	SpotBidPricePercent int    `json:"spot_bid_price_percent,omitempty"`
-	ZoneId              string `json:"zone_id,omitempty"`
-}
-
-type ResourceJobJobClusterNewClusterAzureAttributesLogAnalyticsInfo struct {
-	LogAnalyticsPrimaryKey  string `json:"log_analytics_primary_key,omitempty"`
-	LogAnalyticsWorkspaceId string `json:"log_analytics_workspace_id,omitempty"`
-}
-
-type ResourceJobJobClusterNewClusterAzureAttributes struct {
-	Availability     string                                                          `json:"availability,omitempty"`
-	FirstOnDemand    int                                                             `json:"first_on_demand,omitempty"`
-	SpotBidMaxPrice  int                                                             `json:"spot_bid_max_price,omitempty"`
-	LogAnalyticsInfo *ResourceJobJobClusterNewClusterAzureAttributesLogAnalyticsInfo `json:"log_analytics_info,omitempty"`
-}
-
-type ResourceJobJobClusterNewClusterClusterLogConfDbfs struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceJobJobClusterNewClusterClusterLogConfS3 struct {
-	CannedAcl        string `json:"canned_acl,omitempty"`
-	Destination      string `json:"destination"`
-	EnableEncryption bool   `json:"enable_encryption,omitempty"`
-	EncryptionType   string `json:"encryption_type,omitempty"`
-	Endpoint         string `json:"endpoint,omitempty"`
-	KmsKey           string `json:"kms_key,omitempty"`
-	Region           string `json:"region,omitempty"`
-}
-
-type ResourceJobJobClusterNewClusterClusterLogConfVolumes struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceJobJobClusterNewClusterClusterLogConf struct {
-	Dbfs    *ResourceJobJobClusterNewClusterClusterLogConfDbfs    `json:"dbfs,omitempty"`
-	S3      *ResourceJobJobClusterNewClusterClusterLogConfS3      `json:"s3,omitempty"`
-	Volumes *ResourceJobJobClusterNewClusterClusterLogConfVolumes `json:"volumes,omitempty"`
-}
-
-type ResourceJobJobClusterNewClusterClusterMountInfoNetworkFilesystemInfo struct {
-	MountOptions  string `json:"mount_options,omitempty"`
-	ServerAddress string `json:"server_address"`
-}
-
-type ResourceJobJobClusterNewClusterClusterMountInfo struct {
-	LocalMountDirPath     string                                                                `json:"local_mount_dir_path"`
-	RemoteMountDirPath    string                                                                `json:"remote_mount_dir_path,omitempty"`
-	NetworkFilesystemInfo *ResourceJobJobClusterNewClusterClusterMountInfoNetworkFilesystemInfo `json:"network_filesystem_info,omitempty"`
-}
-
-type ResourceJobJobClusterNewClusterDockerImageBasicAuth struct {
-	Password string `json:"password"`
-	Username string `json:"username"`
-}
-
-type ResourceJobJobClusterNewClusterDockerImage struct {
-	Url       string                                               `json:"url"`
-	BasicAuth *ResourceJobJobClusterNewClusterDockerImageBasicAuth `json:"basic_auth,omitempty"`
-}
-
-type ResourceJobJobClusterNewClusterDriverNodeTypeFlexibility struct {
-	AlternateNodeTypeIds []string `json:"alternate_node_type_ids,omitempty"`
-}
-
-type ResourceJobJobClusterNewClusterGcpAttributes struct {
-	Availability            string `json:"availability,omitempty"`
-	BootDiskSize            int    `json:"boot_disk_size,omitempty"`
-	FirstOnDemand           int    `json:"first_on_demand,omitempty"`
-	GoogleServiceAccount    string `json:"google_service_account,omitempty"`
-	LocalSsdCount           int    `json:"local_ssd_count,omitempty"`
-	UsePreemptibleExecutors bool   `json:"use_preemptible_executors,omitempty"`
-	ZoneId                  string `json:"zone_id,omitempty"`
-}
-
-type ResourceJobJobClusterNewClusterInitScriptsAbfss struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceJobJobClusterNewClusterInitScriptsDbfs struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceJobJobClusterNewClusterInitScriptsFile struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceJobJobClusterNewClusterInitScriptsGcs struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceJobJobClusterNewClusterInitScriptsS3 struct {
-	CannedAcl        string `json:"canned_acl,omitempty"`
-	Destination      string `json:"destination"`
-	EnableEncryption bool   `json:"enable_encryption,omitempty"`
-	EncryptionType   string `json:"encryption_type,omitempty"`
-	Endpoint         string `json:"endpoint,omitempty"`
-	KmsKey           string `json:"kms_key,omitempty"`
-	Region           string `json:"region,omitempty"`
-}
-
-type ResourceJobJobClusterNewClusterInitScriptsVolumes struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceJobJobClusterNewClusterInitScriptsWorkspace struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceJobJobClusterNewClusterInitScripts struct {
-	Abfss     *ResourceJobJobClusterNewClusterInitScriptsAbfss     `json:"abfss,omitempty"`
-	Dbfs      *ResourceJobJobClusterNewClusterInitScriptsDbfs      `json:"dbfs,omitempty"`
-	File      *ResourceJobJobClusterNewClusterInitScriptsFile      `json:"file,omitempty"`
-	Gcs       *ResourceJobJobClusterNewClusterInitScriptsGcs       `json:"gcs,omitempty"`
-	S3        *ResourceJobJobClusterNewClusterInitScriptsS3        `json:"s3,omitempty"`
-	Volumes   *ResourceJobJobClusterNewClusterInitScriptsVolumes   `json:"volumes,omitempty"`
-	Workspace *ResourceJobJobClusterNewClusterInitScriptsWorkspace `json:"workspace,omitempty"`
-}
-
-type ResourceJobJobClusterNewClusterLibraryCran struct {
-	Package string `json:"package"`
-	Repo    string `json:"repo,omitempty"`
-}
-
-type ResourceJobJobClusterNewClusterLibraryMaven struct {
-	Coordinates string   `json:"coordinates"`
-	Exclusions  []string `json:"exclusions,omitempty"`
-	Repo        string   `json:"repo,omitempty"`
-}
-
-type ResourceJobJobClusterNewClusterLibraryProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceJobJobClusterNewClusterLibraryPypi struct {
-	Package string `json:"package"`
-	Repo    string `json:"repo,omitempty"`
-}
-
-type ResourceJobJobClusterNewClusterLibrary struct {
-	Egg            string                                                `json:"egg,omitempty"`
-	Jar            string                                                `json:"jar,omitempty"`
-	Requirements   string                                                `json:"requirements,omitempty"`
-	Whl            string                                                `json:"whl,omitempty"`
-	Cran           *ResourceJobJobClusterNewClusterLibraryCran           `json:"cran,omitempty"`
-	Maven          *ResourceJobJobClusterNewClusterLibraryMaven          `json:"maven,omitempty"`
-	ProviderConfig *ResourceJobJobClusterNewClusterLibraryProviderConfig `json:"provider_config,omitempty"`
-	Pypi           *ResourceJobJobClusterNewClusterLibraryPypi           `json:"pypi,omitempty"`
-}
-
-type ResourceJobJobClusterNewClusterProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceJobJobClusterNewClusterWorkerNodeTypeFlexibility struct {
-	AlternateNodeTypeIds []string `json:"alternate_node_type_ids,omitempty"`
-}
-
-type ResourceJobJobClusterNewClusterWorkloadTypeClients struct {
-	Jobs      bool `json:"jobs,omitempty"`
-	Notebooks bool `json:"notebooks,omitempty"`
-}
-
-type ResourceJobJobClusterNewClusterWorkloadType struct {
-	Clients *ResourceJobJobClusterNewClusterWorkloadTypeClients `json:"clients,omitempty"`
-}
-
-type ResourceJobJobClusterNewCluster struct {
-	ApplyPolicyDefaultValuesAllowList []string                                                  `json:"__apply_policy_default_values_allow_list,omitempty"`
-	ApplyPolicyDefaultValues          bool                                                      `json:"apply_policy_default_values,omitempty"`
-	ClusterId                         string                                                    `json:"cluster_id,omitempty"`
-	ClusterName                       string                                                    `json:"cluster_name,omitempty"`
-	CustomTags                        map[string]string                                         `json:"custom_tags,omitempty"`
-	DataSecurityMode                  string                                                    `json:"data_security_mode,omitempty"`
-	DriverInstancePoolId              string                                                    `json:"driver_instance_pool_id,omitempty"`
-	DriverNodeTypeId                  string                                                    `json:"driver_node_type_id,omitempty"`
-	EnableElasticDisk                 bool                                                      `json:"enable_elastic_disk,omitempty"`
-	EnableLocalDiskEncryption         bool                                                      `json:"enable_local_disk_encryption,omitempty"`
-	IdempotencyToken                  string                                                    `json:"idempotency_token,omitempty"`
-	InstancePoolId                    string                                                    `json:"instance_pool_id,omitempty"`
-	IsSingleNode                      bool                                                      `json:"is_single_node,omitempty"`
-	Kind                              string                                                    `json:"kind,omitempty"`
-	NodeTypeId                        string                                                    `json:"node_type_id,omitempty"`
-	NumWorkers                        int                                                       `json:"num_workers,omitempty"`
-	PolicyId                          string                                                    `json:"policy_id,omitempty"`
-	RemoteDiskThroughput              int                                                       `json:"remote_disk_throughput,omitempty"`
-	RuntimeEngine                     string                                                    `json:"runtime_engine,omitempty"`
-	SingleUserName                    string                                                    `json:"single_user_name,omitempty"`
-	SparkConf                         map[string]string                                         `json:"spark_conf,omitempty"`
-	SparkEnvVars                      map[string]string                                         `json:"spark_env_vars,omitempty"`
-	SparkVersion                      string                                                    `json:"spark_version,omitempty"`
-	SshPublicKeys                     []string                                                  `json:"ssh_public_keys,omitempty"`
-	TotalInitialRemoteDiskSize        int                                                       `json:"total_initial_remote_disk_size,omitempty"`
-	UseMlRuntime                      bool                                                      `json:"use_ml_runtime,omitempty"`
-	Autoscale                         *ResourceJobJobClusterNewClusterAutoscale                 `json:"autoscale,omitempty"`
-	AwsAttributes                     *ResourceJobJobClusterNewClusterAwsAttributes             `json:"aws_attributes,omitempty"`
-	AzureAttributes                   *ResourceJobJobClusterNewClusterAzureAttributes           `json:"azure_attributes,omitempty"`
-	ClusterLogConf                    *ResourceJobJobClusterNewClusterClusterLogConf            `json:"cluster_log_conf,omitempty"`
-	ClusterMountInfo                  []ResourceJobJobClusterNewClusterClusterMountInfo         `json:"cluster_mount_info,omitempty"`
-	DockerImage                       *ResourceJobJobClusterNewClusterDockerImage               `json:"docker_image,omitempty"`
-	DriverNodeTypeFlexibility         *ResourceJobJobClusterNewClusterDriverNodeTypeFlexibility `json:"driver_node_type_flexibility,omitempty"`
-	GcpAttributes                     *ResourceJobJobClusterNewClusterGcpAttributes             `json:"gcp_attributes,omitempty"`
-	InitScripts                       []ResourceJobJobClusterNewClusterInitScripts              `json:"init_scripts,omitempty"`
-	Library                           []ResourceJobJobClusterNewClusterLibrary                  `json:"library,omitempty"`
-	ProviderConfig                    *ResourceJobJobClusterNewClusterProviderConfig            `json:"provider_config,omitempty"`
-	WorkerNodeTypeFlexibility         *ResourceJobJobClusterNewClusterWorkerNodeTypeFlexibility `json:"worker_node_type_flexibility,omitempty"`
-	WorkloadType                      *ResourceJobJobClusterNewClusterWorkloadType              `json:"workload_type,omitempty"`
-}
-
-type ResourceJobJobCluster struct {
-	JobClusterKey string                           `json:"job_cluster_key"`
-	NewCluster    *ResourceJobJobClusterNewCluster `json:"new_cluster,omitempty"`
-}
-
-type ResourceJobLibraryCran struct {
-	Package string `json:"package"`
-	Repo    string `json:"repo,omitempty"`
-}
-
-type ResourceJobLibraryMaven struct {
-	Coordinates string   `json:"coordinates"`
-	Exclusions  []string `json:"exclusions,omitempty"`
-	Repo        string   `json:"repo,omitempty"`
-}
-
-type ResourceJobLibraryProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceJobLibraryPypi struct {
-	Package string `json:"package"`
-	Repo    string `json:"repo,omitempty"`
-}
-
-type ResourceJobLibrary struct {
-	Egg            string                            `json:"egg,omitempty"`
-	Jar            string                            `json:"jar,omitempty"`
-	Requirements   string                            `json:"requirements,omitempty"`
-	Whl            string                            `json:"whl,omitempty"`
-	Cran           *ResourceJobLibraryCran           `json:"cran,omitempty"`
-	Maven          *ResourceJobLibraryMaven          `json:"maven,omitempty"`
-	ProviderConfig *ResourceJobLibraryProviderConfig `json:"provider_config,omitempty"`
-	Pypi           *ResourceJobLibraryPypi           `json:"pypi,omitempty"`
-}
-
-type ResourceJobNewClusterAutoscale struct {
-	MaxWorkers int `json:"max_workers,omitempty"`
-	MinWorkers int `json:"min_workers,omitempty"`
-}
-
-type ResourceJobNewClusterAwsAttributes struct {
-	Availability        string `json:"availability,omitempty"`
-	EbsVolumeCount      int    `json:"ebs_volume_count,omitempty"`
-	EbsVolumeIops       int    `json:"ebs_volume_iops,omitempty"`
-	EbsVolumeSize       int    `json:"ebs_volume_size,omitempty"`
-	EbsVolumeThroughput int    `json:"ebs_volume_throughput,omitempty"`
-	EbsVolumeType       string `json:"ebs_volume_type,omitempty"`
-	FirstOnDemand       int    `json:"first_on_demand,omitempty"`
-	InstanceProfileArn  string `json:"instance_profile_arn,omitempty"`
-	SpotBidPricePercent int    `json:"spot_bid_price_percent,omitempty"`
-	ZoneId              string `json:"zone_id,omitempty"`
-}
-
-type ResourceJobNewClusterAzureAttributesLogAnalyticsInfo struct {
-	LogAnalyticsPrimaryKey  string `json:"log_analytics_primary_key,omitempty"`
-	LogAnalyticsWorkspaceId string `json:"log_analytics_workspace_id,omitempty"`
-}
-
-type ResourceJobNewClusterAzureAttributes struct {
-	Availability     string                                                `json:"availability,omitempty"`
-	FirstOnDemand    int                                                   `json:"first_on_demand,omitempty"`
-	SpotBidMaxPrice  int                                                   `json:"spot_bid_max_price,omitempty"`
-	LogAnalyticsInfo *ResourceJobNewClusterAzureAttributesLogAnalyticsInfo `json:"log_analytics_info,omitempty"`
-}
-
-type ResourceJobNewClusterClusterLogConfDbfs struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceJobNewClusterClusterLogConfS3 struct {
-	CannedAcl        string `json:"canned_acl,omitempty"`
-	Destination      string `json:"destination"`
-	EnableEncryption bool   `json:"enable_encryption,omitempty"`
-	EncryptionType   string `json:"encryption_type,omitempty"`
-	Endpoint         string `json:"endpoint,omitempty"`
-	KmsKey           string `json:"kms_key,omitempty"`
-	Region           string `json:"region,omitempty"`
-}
-
-type ResourceJobNewClusterClusterLogConfVolumes struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceJobNewClusterClusterLogConf struct {
-	Dbfs    *ResourceJobNewClusterClusterLogConfDbfs    `json:"dbfs,omitempty"`
-	S3      *ResourceJobNewClusterClusterLogConfS3      `json:"s3,omitempty"`
-	Volumes *ResourceJobNewClusterClusterLogConfVolumes `json:"volumes,omitempty"`
-}
-
-type ResourceJobNewClusterClusterMountInfoNetworkFilesystemInfo struct {
-	MountOptions  string `json:"mount_options,omitempty"`
-	ServerAddress string `json:"server_address"`
-}
-
-type ResourceJobNewClusterClusterMountInfo struct {
-	LocalMountDirPath     string                                                      `json:"local_mount_dir_path"`
-	RemoteMountDirPath    string                                                      `json:"remote_mount_dir_path,omitempty"`
-	NetworkFilesystemInfo *ResourceJobNewClusterClusterMountInfoNetworkFilesystemInfo `json:"network_filesystem_info,omitempty"`
-}
-
-type ResourceJobNewClusterDockerImageBasicAuth struct {
-	Password string `json:"password"`
-	Username string `json:"username"`
-}
-
-type ResourceJobNewClusterDockerImage struct {
-	Url       string                                     `json:"url"`
-	BasicAuth *ResourceJobNewClusterDockerImageBasicAuth `json:"basic_auth,omitempty"`
-}
-
-type ResourceJobNewClusterDriverNodeTypeFlexibility struct {
-	AlternateNodeTypeIds []string `json:"alternate_node_type_ids,omitempty"`
-}
-
-type ResourceJobNewClusterGcpAttributes struct {
-	Availability            string `json:"availability,omitempty"`
-	BootDiskSize            int    `json:"boot_disk_size,omitempty"`
-	FirstOnDemand           int    `json:"first_on_demand,omitempty"`
-	GoogleServiceAccount    string `json:"google_service_account,omitempty"`
-	LocalSsdCount           int    `json:"local_ssd_count,omitempty"`
-	UsePreemptibleExecutors bool   `json:"use_preemptible_executors,omitempty"`
-	ZoneId                  string `json:"zone_id,omitempty"`
-}
-
-type ResourceJobNewClusterInitScriptsAbfss struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceJobNewClusterInitScriptsDbfs struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceJobNewClusterInitScriptsFile struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceJobNewClusterInitScriptsGcs struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceJobNewClusterInitScriptsS3 struct {
-	CannedAcl        string `json:"canned_acl,omitempty"`
-	Destination      string `json:"destination"`
-	EnableEncryption bool   `json:"enable_encryption,omitempty"`
-	EncryptionType   string `json:"encryption_type,omitempty"`
-	Endpoint         string `json:"endpoint,omitempty"`
-	KmsKey           string `json:"kms_key,omitempty"`
-	Region           string `json:"region,omitempty"`
-}
-
-type ResourceJobNewClusterInitScriptsVolumes struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceJobNewClusterInitScriptsWorkspace struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceJobNewClusterInitScripts struct {
-	Abfss     *ResourceJobNewClusterInitScriptsAbfss     `json:"abfss,omitempty"`
-	Dbfs      *ResourceJobNewClusterInitScriptsDbfs      `json:"dbfs,omitempty"`
-	File      *ResourceJobNewClusterInitScriptsFile      `json:"file,omitempty"`
-	Gcs       *ResourceJobNewClusterInitScriptsGcs       `json:"gcs,omitempty"`
-	S3        *ResourceJobNewClusterInitScriptsS3        `json:"s3,omitempty"`
-	Volumes   *ResourceJobNewClusterInitScriptsVolumes   `json:"volumes,omitempty"`
-	Workspace *ResourceJobNewClusterInitScriptsWorkspace `json:"workspace,omitempty"`
-}
-
-type ResourceJobNewClusterLibraryCran struct {
-	Package string `json:"package"`
-	Repo    string `json:"repo,omitempty"`
-}
-
-type ResourceJobNewClusterLibraryMaven struct {
-	Coordinates string   `json:"coordinates"`
-	Exclusions  []string `json:"exclusions,omitempty"`
-	Repo        string   `json:"repo,omitempty"`
-}
-
-type ResourceJobNewClusterLibraryProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceJobNewClusterLibraryPypi struct {
-	Package string `json:"package"`
-	Repo    string `json:"repo,omitempty"`
-}
-
-type ResourceJobNewClusterLibrary struct {
-	Egg            string                                      `json:"egg,omitempty"`
-	Jar            string                                      `json:"jar,omitempty"`
-	Requirements   string                                      `json:"requirements,omitempty"`
-	Whl            string                                      `json:"whl,omitempty"`
-	Cran           *ResourceJobNewClusterLibraryCran           `json:"cran,omitempty"`
-	Maven          *ResourceJobNewClusterLibraryMaven          `json:"maven,omitempty"`
-	ProviderConfig *ResourceJobNewClusterLibraryProviderConfig `json:"provider_config,omitempty"`
-	Pypi           *ResourceJobNewClusterLibraryPypi           `json:"pypi,omitempty"`
-}
-
-type ResourceJobNewClusterProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceJobNewClusterWorkerNodeTypeFlexibility struct {
-	AlternateNodeTypeIds []string `json:"alternate_node_type_ids,omitempty"`
-}
-
-type ResourceJobNewClusterWorkloadTypeClients struct {
-	Jobs      bool `json:"jobs,omitempty"`
-	Notebooks bool `json:"notebooks,omitempty"`
-}
-
-type ResourceJobNewClusterWorkloadType struct {
-	Clients *ResourceJobNewClusterWorkloadTypeClients `json:"clients,omitempty"`
-}
-
-type ResourceJobNewCluster struct {
-	ApplyPolicyDefaultValues   bool                                            `json:"apply_policy_default_values,omitempty"`
-	ClusterId                  string                                          `json:"cluster_id,omitempty"`
-	ClusterName                string                                          `json:"cluster_name,omitempty"`
-	CustomTags                 map[string]string                               `json:"custom_tags,omitempty"`
-	DataSecurityMode           string                                          `json:"data_security_mode,omitempty"`
-	DriverInstancePoolId       string                                          `json:"driver_instance_pool_id,omitempty"`
-	DriverNodeTypeId           string                                          `json:"driver_node_type_id,omitempty"`
-	EnableElasticDisk          bool                                            `json:"enable_elastic_disk,omitempty"`
-	EnableLocalDiskEncryption  bool                                            `json:"enable_local_disk_encryption,omitempty"`
-	IdempotencyToken           string                                          `json:"idempotency_token,omitempty"`
-	InstancePoolId             string                                          `json:"instance_pool_id,omitempty"`
-	IsSingleNode               bool                                            `json:"is_single_node,omitempty"`
-	Kind                       string                                          `json:"kind,omitempty"`
-	NodeTypeId                 string                                          `json:"node_type_id,omitempty"`
-	NumWorkers                 int                                             `json:"num_workers,omitempty"`
-	PolicyId                   string                                          `json:"policy_id,omitempty"`
-	RemoteDiskThroughput       int                                             `json:"remote_disk_throughput,omitempty"`
-	RuntimeEngine              string                                          `json:"runtime_engine,omitempty"`
-	SingleUserName             string                                          `json:"single_user_name,omitempty"`
-	SparkConf                  map[string]string                               `json:"spark_conf,omitempty"`
-	SparkEnvVars               map[string]string                               `json:"spark_env_vars,omitempty"`
-	SparkVersion               string                                          `json:"spark_version,omitempty"`
-	SshPublicKeys              []string                                        `json:"ssh_public_keys,omitempty"`
-	TotalInitialRemoteDiskSize int                                             `json:"total_initial_remote_disk_size,omitempty"`
-	UseMlRuntime               bool                                            `json:"use_ml_runtime,omitempty"`
-	Autoscale                  *ResourceJobNewClusterAutoscale                 `json:"autoscale,omitempty"`
-	AwsAttributes              *ResourceJobNewClusterAwsAttributes             `json:"aws_attributes,omitempty"`
-	AzureAttributes            *ResourceJobNewClusterAzureAttributes           `json:"azure_attributes,omitempty"`
-	ClusterLogConf             *ResourceJobNewClusterClusterLogConf            `json:"cluster_log_conf,omitempty"`
-	ClusterMountInfo           []ResourceJobNewClusterClusterMountInfo         `json:"cluster_mount_info,omitempty"`
-	DockerImage                *ResourceJobNewClusterDockerImage               `json:"docker_image,omitempty"`
-	DriverNodeTypeFlexibility  *ResourceJobNewClusterDriverNodeTypeFlexibility `json:"driver_node_type_flexibility,omitempty"`
-	GcpAttributes              *ResourceJobNewClusterGcpAttributes             `json:"gcp_attributes,omitempty"`
-	InitScripts                []ResourceJobNewClusterInitScripts              `json:"init_scripts,omitempty"`
-	Library                    []ResourceJobNewClusterLibrary                  `json:"library,omitempty"`
-	ProviderConfig             *ResourceJobNewClusterProviderConfig            `json:"provider_config,omitempty"`
-	WorkerNodeTypeFlexibility  *ResourceJobNewClusterWorkerNodeTypeFlexibility `json:"worker_node_type_flexibility,omitempty"`
-	WorkloadType               *ResourceJobNewClusterWorkloadType              `json:"workload_type,omitempty"`
-}
-
-type ResourceJobNotebookTask struct {
-	BaseParameters map[string]string `json:"base_parameters,omitempty"`
-	NotebookPath   string            `json:"notebook_path"`
-	Source         string            `json:"source,omitempty"`
-	WarehouseId    string            `json:"warehouse_id,omitempty"`
-}
-
-type ResourceJobNotificationSettings struct {
-	NoAlertForCanceledRuns bool `json:"no_alert_for_canceled_runs,omitempty"`
-	NoAlertForSkippedRuns  bool `json:"no_alert_for_skipped_runs,omitempty"`
-}
-
-type ResourceJobParameter struct {
-	Default string `json:"default"`
-	Name    string `json:"name"`
-}
-
-type ResourceJobPipelineTask struct {
-	FullRefresh bool   `json:"full_refresh,omitempty"`
-	PipelineId  string `json:"pipeline_id"`
-}
-
-type ResourceJobProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceJobPythonWheelTask struct {
-	EntryPoint      string            `json:"entry_point,omitempty"`
-	NamedParameters map[string]string `json:"named_parameters,omitempty"`
-	PackageName     string            `json:"package_name,omitempty"`
-	Parameters      []string          `json:"parameters,omitempty"`
-}
-
-type ResourceJobQueue struct {
-	Enabled bool `json:"enabled"`
-}
-
-type ResourceJobRunAs struct {
-	GroupName            string `json:"group_name,omitempty"`
-	ServicePrincipalName string `json:"service_principal_name,omitempty"`
-	UserName             string `json:"user_name,omitempty"`
-}
-
-type ResourceJobRunJobTask struct {
-	JobId         int               `json:"job_id"`
-	JobParameters map[string]string `json:"job_parameters,omitempty"`
-}
-
-type ResourceJobSchedule struct {
-	PauseStatus          string `json:"pause_status,omitempty"`
-	QuartzCronExpression string `json:"quartz_cron_expression"`
-	TimezoneId           string `json:"timezone_id"`
-}
-
-type ResourceJobSparkJarTask struct {
-	JarUri        string   `json:"jar_uri,omitempty"`
-	MainClassName string   `json:"main_class_name,omitempty"`
-	Parameters    []string `json:"parameters,omitempty"`
-}
-
-type ResourceJobSparkPythonTask struct {
-	Parameters []string `json:"parameters,omitempty"`
-	PythonFile string   `json:"python_file"`
-	Source     string   `json:"source,omitempty"`
-}
-
-type ResourceJobSparkSubmitTask struct {
-	Parameters []string `json:"parameters,omitempty"`
-}
-
-type ResourceJobTaskAlertTaskSubscribers struct {
-	DestinationId string `json:"destination_id,omitempty"`
-	UserName      string `json:"user_name,omitempty"`
-}
-
-type ResourceJobTaskAlertTask struct {
-	AlertId       string                                `json:"alert_id,omitempty"`
-	WarehouseId   string                                `json:"warehouse_id,omitempty"`
-	WorkspacePath string                                `json:"workspace_path,omitempty"`
-	Subscribers   []ResourceJobTaskAlertTaskSubscribers `json:"subscribers,omitempty"`
-}
-
-type ResourceJobTaskCleanRoomsNotebookTask struct {
-	CleanRoomName          string            `json:"clean_room_name"`
-	Etag                   string            `json:"etag,omitempty"`
-	NotebookBaseParameters map[string]string `json:"notebook_base_parameters,omitempty"`
-	NotebookName           string            `json:"notebook_name"`
-}
-
-type ResourceJobTaskCompute struct {
-	HardwareAccelerator string `json:"hardware_accelerator,omitempty"`
-}
-
-type ResourceJobTaskConditionTask struct {
-	Left  string `json:"left"`
-	Op    string `json:"op"`
-	Right string `json:"right"`
-}
-
-type ResourceJobTaskDashboardTaskSubscriptionSubscribers struct {
-	DestinationId string `json:"destination_id,omitempty"`
-	UserName      string `json:"user_name,omitempty"`
-}
-
-type ResourceJobTaskDashboardTaskSubscription struct {
-	CustomSubject string                                                `json:"custom_subject,omitempty"`
-	Paused        bool                                                  `json:"paused,omitempty"`
-	Subscribers   []ResourceJobTaskDashboardTaskSubscriptionSubscribers `json:"subscribers,omitempty"`
-}
-
-type ResourceJobTaskDashboardTask struct {
-	DashboardId  string                                    `json:"dashboard_id,omitempty"`
-	Filters      map[string]string                         `json:"filters,omitempty"`
-	WarehouseId  string                                    `json:"warehouse_id,omitempty"`
-	Subscription *ResourceJobTaskDashboardTaskSubscription `json:"subscription,omitempty"`
-}
-
-type ResourceJobTaskDbtCloudTask struct {
-	ConnectionResourceName string `json:"connection_resource_name,omitempty"`
-	DbtCloudJobId          int    `json:"dbt_cloud_job_id,omitempty"`
-}
-
-type ResourceJobTaskDbtPlatformTask struct {
-	ConnectionResourceName string `json:"connection_resource_name,omitempty"`
-	DbtPlatformJobId       string `json:"dbt_platform_job_id,omitempty"`
-}
-
-type ResourceJobTaskDbtTask struct {
-	Catalog           string   `json:"catalog,omitempty"`
-	Commands          []string `json:"commands"`
-	ProfilesDirectory string   `json:"profiles_directory,omitempty"`
-	ProjectDirectory  string   `json:"project_directory,omitempty"`
-	Schema            string   `json:"schema,omitempty"`
-	Source            string   `json:"source,omitempty"`
-	WarehouseId       string   `json:"warehouse_id,omitempty"`
-}
-
-type ResourceJobTaskDependsOn struct {
-	Outcome string `json:"outcome,omitempty"`
-	TaskKey string `json:"task_key"`
-}
-
-type ResourceJobTaskEmailNotifications struct {
-	NoAlertForSkippedRuns              bool     `json:"no_alert_for_skipped_runs,omitempty"`
-	OnDurationWarningThresholdExceeded []string `json:"on_duration_warning_threshold_exceeded,omitempty"`
-	OnFailure                          []string `json:"on_failure,omitempty"`
-	OnStart                            []string `json:"on_start,omitempty"`
-	OnStreamingBacklogExceeded         []string `json:"on_streaming_backlog_exceeded,omitempty"`
-	OnSuccess                          []string `json:"on_success,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskAlertTaskSubscribers struct {
-	DestinationId string `json:"destination_id,omitempty"`
-	UserName      string `json:"user_name,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskAlertTask struct {
-	AlertId       string                                               `json:"alert_id,omitempty"`
-	WarehouseId   string                                               `json:"warehouse_id,omitempty"`
-	WorkspacePath string                                               `json:"workspace_path,omitempty"`
-	Subscribers   []ResourceJobTaskForEachTaskTaskAlertTaskSubscribers `json:"subscribers,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskCleanRoomsNotebookTask struct {
-	CleanRoomName          string            `json:"clean_room_name"`
-	Etag                   string            `json:"etag,omitempty"`
-	NotebookBaseParameters map[string]string `json:"notebook_base_parameters,omitempty"`
-	NotebookName           string            `json:"notebook_name"`
-}
-
-type ResourceJobTaskForEachTaskTaskCompute struct {
-	HardwareAccelerator string `json:"hardware_accelerator,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskConditionTask struct {
-	Left  string `json:"left"`
-	Op    string `json:"op"`
-	Right string `json:"right"`
-}
-
-type ResourceJobTaskForEachTaskTaskDashboardTaskSubscriptionSubscribers struct {
-	DestinationId string `json:"destination_id,omitempty"`
-	UserName      string `json:"user_name,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskDashboardTaskSubscription struct {
-	CustomSubject string                                                               `json:"custom_subject,omitempty"`
-	Paused        bool                                                                 `json:"paused,omitempty"`
-	Subscribers   []ResourceJobTaskForEachTaskTaskDashboardTaskSubscriptionSubscribers `json:"subscribers,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskDashboardTask struct {
-	DashboardId  string                                                   `json:"dashboard_id,omitempty"`
-	Filters      map[string]string                                        `json:"filters,omitempty"`
-	WarehouseId  string                                                   `json:"warehouse_id,omitempty"`
-	Subscription *ResourceJobTaskForEachTaskTaskDashboardTaskSubscription `json:"subscription,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskDbtCloudTask struct {
-	ConnectionResourceName string `json:"connection_resource_name,omitempty"`
-	DbtCloudJobId          int    `json:"dbt_cloud_job_id,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskDbtPlatformTask struct {
-	ConnectionResourceName string `json:"connection_resource_name,omitempty"`
-	DbtPlatformJobId       string `json:"dbt_platform_job_id,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskDbtTask struct {
-	Catalog           string   `json:"catalog,omitempty"`
-	Commands          []string `json:"commands"`
-	ProfilesDirectory string   `json:"profiles_directory,omitempty"`
-	ProjectDirectory  string   `json:"project_directory,omitempty"`
-	Schema            string   `json:"schema,omitempty"`
-	Source            string   `json:"source,omitempty"`
-	WarehouseId       string   `json:"warehouse_id,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskDependsOn struct {
-	Outcome string `json:"outcome,omitempty"`
-	TaskKey string `json:"task_key"`
-}
-
-type ResourceJobTaskForEachTaskTaskEmailNotifications struct {
-	NoAlertForSkippedRuns              bool     `json:"no_alert_for_skipped_runs,omitempty"`
-	OnDurationWarningThresholdExceeded []string `json:"on_duration_warning_threshold_exceeded,omitempty"`
-	OnFailure                          []string `json:"on_failure,omitempty"`
-	OnStart                            []string `json:"on_start,omitempty"`
-	OnStreamingBacklogExceeded         []string `json:"on_streaming_backlog_exceeded,omitempty"`
-	OnSuccess                          []string `json:"on_success,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskGenAiComputeTaskCompute struct {
-	GpuNodePoolId string `json:"gpu_node_pool_id,omitempty"`
-	GpuType       string `json:"gpu_type,omitempty"`
-	NumGpus       int    `json:"num_gpus"`
-}
-
-type ResourceJobTaskForEachTaskTaskGenAiComputeTask struct {
-	Command                string                                                 `json:"command,omitempty"`
-	DlRuntimeImage         string                                                 `json:"dl_runtime_image"`
-	MlflowExperimentName   string                                                 `json:"mlflow_experiment_name,omitempty"`
-	Source                 string                                                 `json:"source,omitempty"`
-	TrainingScriptPath     string                                                 `json:"training_script_path,omitempty"`
-	YamlParameters         string                                                 `json:"yaml_parameters,omitempty"`
-	YamlParametersFilePath string                                                 `json:"yaml_parameters_file_path,omitempty"`
-	Compute                *ResourceJobTaskForEachTaskTaskGenAiComputeTaskCompute `json:"compute,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskHealthRules struct {
-	Metric string `json:"metric"`
-	Op     string `json:"op"`
-	Value  int    `json:"value"`
-}
-
-type ResourceJobTaskForEachTaskTaskHealth struct {
-	Rules []ResourceJobTaskForEachTaskTaskHealthRules `json:"rules,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskLibraryCran struct {
-	Package string `json:"package"`
-	Repo    string `json:"repo,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskLibraryMaven struct {
-	Coordinates string   `json:"coordinates"`
-	Exclusions  []string `json:"exclusions,omitempty"`
-	Repo        string   `json:"repo,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskLibraryProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceJobTaskForEachTaskTaskLibraryPypi struct {
-	Package string `json:"package"`
-	Repo    string `json:"repo,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskLibrary struct {
-	Egg            string                                               `json:"egg,omitempty"`
-	Jar            string                                               `json:"jar,omitempty"`
-	Requirements   string                                               `json:"requirements,omitempty"`
-	Whl            string                                               `json:"whl,omitempty"`
-	Cran           *ResourceJobTaskForEachTaskTaskLibraryCran           `json:"cran,omitempty"`
-	Maven          *ResourceJobTaskForEachTaskTaskLibraryMaven          `json:"maven,omitempty"`
-	ProviderConfig *ResourceJobTaskForEachTaskTaskLibraryProviderConfig `json:"provider_config,omitempty"`
-	Pypi           *ResourceJobTaskForEachTaskTaskLibraryPypi           `json:"pypi,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskNewClusterAutoscale struct {
-	MaxWorkers int `json:"max_workers,omitempty"`
-	MinWorkers int `json:"min_workers,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskNewClusterAwsAttributes struct {
-	Availability        string `json:"availability,omitempty"`
-	EbsVolumeCount      int    `json:"ebs_volume_count,omitempty"`
-	EbsVolumeIops       int    `json:"ebs_volume_iops,omitempty"`
-	EbsVolumeSize       int    `json:"ebs_volume_size,omitempty"`
-	EbsVolumeThroughput int    `json:"ebs_volume_throughput,omitempty"`
-	EbsVolumeType       string `json:"ebs_volume_type,omitempty"`
-	FirstOnDemand       int    `json:"first_on_demand,omitempty"`
-	InstanceProfileArn  string `json:"instance_profile_arn,omitempty"`
-	SpotBidPricePercent int    `json:"spot_bid_price_percent,omitempty"`
-	ZoneId              string `json:"zone_id,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskNewClusterAzureAttributesLogAnalyticsInfo struct {
-	LogAnalyticsPrimaryKey  string `json:"log_analytics_primary_key,omitempty"`
-	LogAnalyticsWorkspaceId string `json:"log_analytics_workspace_id,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskNewClusterAzureAttributes struct {
-	Availability     string                                                                   `json:"availability,omitempty"`
-	FirstOnDemand    int                                                                      `json:"first_on_demand,omitempty"`
-	SpotBidMaxPrice  int                                                                      `json:"spot_bid_max_price,omitempty"`
-	LogAnalyticsInfo *ResourceJobTaskForEachTaskTaskNewClusterAzureAttributesLogAnalyticsInfo `json:"log_analytics_info,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskNewClusterClusterLogConfDbfs struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceJobTaskForEachTaskTaskNewClusterClusterLogConfS3 struct {
-	CannedAcl        string `json:"canned_acl,omitempty"`
-	Destination      string `json:"destination"`
-	EnableEncryption bool   `json:"enable_encryption,omitempty"`
-	EncryptionType   string `json:"encryption_type,omitempty"`
-	Endpoint         string `json:"endpoint,omitempty"`
-	KmsKey           string `json:"kms_key,omitempty"`
-	Region           string `json:"region,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskNewClusterClusterLogConfVolumes struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceJobTaskForEachTaskTaskNewClusterClusterLogConf struct {
-	Dbfs    *ResourceJobTaskForEachTaskTaskNewClusterClusterLogConfDbfs    `json:"dbfs,omitempty"`
-	S3      *ResourceJobTaskForEachTaskTaskNewClusterClusterLogConfS3      `json:"s3,omitempty"`
-	Volumes *ResourceJobTaskForEachTaskTaskNewClusterClusterLogConfVolumes `json:"volumes,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskNewClusterClusterMountInfoNetworkFilesystemInfo struct {
-	MountOptions  string `json:"mount_options,omitempty"`
-	ServerAddress string `json:"server_address"`
-}
-
-type ResourceJobTaskForEachTaskTaskNewClusterClusterMountInfo struct {
-	LocalMountDirPath     string                                                                         `json:"local_mount_dir_path"`
-	RemoteMountDirPath    string                                                                         `json:"remote_mount_dir_path,omitempty"`
-	NetworkFilesystemInfo *ResourceJobTaskForEachTaskTaskNewClusterClusterMountInfoNetworkFilesystemInfo `json:"network_filesystem_info,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskNewClusterDockerImageBasicAuth struct {
-	Password string `json:"password"`
-	Username string `json:"username"`
-}
-
-type ResourceJobTaskForEachTaskTaskNewClusterDockerImage struct {
-	Url       string                                                        `json:"url"`
-	BasicAuth *ResourceJobTaskForEachTaskTaskNewClusterDockerImageBasicAuth `json:"basic_auth,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskNewClusterDriverNodeTypeFlexibility struct {
-	AlternateNodeTypeIds []string `json:"alternate_node_type_ids,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskNewClusterGcpAttributes struct {
-	Availability            string `json:"availability,omitempty"`
-	BootDiskSize            int    `json:"boot_disk_size,omitempty"`
-	FirstOnDemand           int    `json:"first_on_demand,omitempty"`
-	GoogleServiceAccount    string `json:"google_service_account,omitempty"`
-	LocalSsdCount           int    `json:"local_ssd_count,omitempty"`
-	UsePreemptibleExecutors bool   `json:"use_preemptible_executors,omitempty"`
-	ZoneId                  string `json:"zone_id,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskNewClusterInitScriptsAbfss struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceJobTaskForEachTaskTaskNewClusterInitScriptsDbfs struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceJobTaskForEachTaskTaskNewClusterInitScriptsFile struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceJobTaskForEachTaskTaskNewClusterInitScriptsGcs struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceJobTaskForEachTaskTaskNewClusterInitScriptsS3 struct {
-	CannedAcl        string `json:"canned_acl,omitempty"`
-	Destination      string `json:"destination"`
-	EnableEncryption bool   `json:"enable_encryption,omitempty"`
-	EncryptionType   string `json:"encryption_type,omitempty"`
-	Endpoint         string `json:"endpoint,omitempty"`
-	KmsKey           string `json:"kms_key,omitempty"`
-	Region           string `json:"region,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskNewClusterInitScriptsVolumes struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceJobTaskForEachTaskTaskNewClusterInitScriptsWorkspace struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceJobTaskForEachTaskTaskNewClusterInitScripts struct {
-	Abfss     *ResourceJobTaskForEachTaskTaskNewClusterInitScriptsAbfss     `json:"abfss,omitempty"`
-	Dbfs      *ResourceJobTaskForEachTaskTaskNewClusterInitScriptsDbfs      `json:"dbfs,omitempty"`
-	File      *ResourceJobTaskForEachTaskTaskNewClusterInitScriptsFile      `json:"file,omitempty"`
-	Gcs       *ResourceJobTaskForEachTaskTaskNewClusterInitScriptsGcs       `json:"gcs,omitempty"`
-	S3        *ResourceJobTaskForEachTaskTaskNewClusterInitScriptsS3        `json:"s3,omitempty"`
-	Volumes   *ResourceJobTaskForEachTaskTaskNewClusterInitScriptsVolumes   `json:"volumes,omitempty"`
-	Workspace *ResourceJobTaskForEachTaskTaskNewClusterInitScriptsWorkspace `json:"workspace,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskNewClusterLibraryCran struct {
-	Package string `json:"package"`
-	Repo    string `json:"repo,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskNewClusterLibraryMaven struct {
-	Coordinates string   `json:"coordinates"`
-	Exclusions  []string `json:"exclusions,omitempty"`
-	Repo        string   `json:"repo,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskNewClusterLibraryProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceJobTaskForEachTaskTaskNewClusterLibraryPypi struct {
-	Package string `json:"package"`
-	Repo    string `json:"repo,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskNewClusterLibrary struct {
-	Egg            string                                                         `json:"egg,omitempty"`
-	Jar            string                                                         `json:"jar,omitempty"`
-	Requirements   string                                                         `json:"requirements,omitempty"`
-	Whl            string                                                         `json:"whl,omitempty"`
-	Cran           *ResourceJobTaskForEachTaskTaskNewClusterLibraryCran           `json:"cran,omitempty"`
-	Maven          *ResourceJobTaskForEachTaskTaskNewClusterLibraryMaven          `json:"maven,omitempty"`
-	ProviderConfig *ResourceJobTaskForEachTaskTaskNewClusterLibraryProviderConfig `json:"provider_config,omitempty"`
-	Pypi           *ResourceJobTaskForEachTaskTaskNewClusterLibraryPypi           `json:"pypi,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskNewClusterProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceJobTaskForEachTaskTaskNewClusterWorkerNodeTypeFlexibility struct {
-	AlternateNodeTypeIds []string `json:"alternate_node_type_ids,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskNewClusterWorkloadTypeClients struct {
-	Jobs      bool `json:"jobs,omitempty"`
-	Notebooks bool `json:"notebooks,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskNewClusterWorkloadType struct {
-	Clients *ResourceJobTaskForEachTaskTaskNewClusterWorkloadTypeClients `json:"clients,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskNewCluster struct {
-	ApplyPolicyDefaultValues   bool                                                               `json:"apply_policy_default_values,omitempty"`
-	ClusterId                  string                                                             `json:"cluster_id,omitempty"`
-	ClusterName                string                                                             `json:"cluster_name,omitempty"`
-	CustomTags                 map[string]string                                                  `json:"custom_tags,omitempty"`
-	DataSecurityMode           string                                                             `json:"data_security_mode,omitempty"`
-	DriverInstancePoolId       string                                                             `json:"driver_instance_pool_id,omitempty"`
-	DriverNodeTypeId           string                                                             `json:"driver_node_type_id,omitempty"`
-	EnableElasticDisk          bool                                                               `json:"enable_elastic_disk,omitempty"`
-	EnableLocalDiskEncryption  bool                                                               `json:"enable_local_disk_encryption,omitempty"`
-	IdempotencyToken           string                                                             `json:"idempotency_token,omitempty"`
-	InstancePoolId             string                                                             `json:"instance_pool_id,omitempty"`
-	IsSingleNode               bool                                                               `json:"is_single_node,omitempty"`
-	Kind                       string                                                             `json:"kind,omitempty"`
-	NodeTypeId                 string                                                             `json:"node_type_id,omitempty"`
-	NumWorkers                 int                                                                `json:"num_workers,omitempty"`
-	PolicyId                   string                                                             `json:"policy_id,omitempty"`
-	RemoteDiskThroughput       int                                                                `json:"remote_disk_throughput,omitempty"`
-	RuntimeEngine              string                                                             `json:"runtime_engine,omitempty"`
-	SingleUserName             string                                                             `json:"single_user_name,omitempty"`
-	SparkConf                  map[string]string                                                  `json:"spark_conf,omitempty"`
-	SparkEnvVars               map[string]string                                                  `json:"spark_env_vars,omitempty"`
-	SparkVersion               string                                                             `json:"spark_version,omitempty"`
-	SshPublicKeys              []string                                                           `json:"ssh_public_keys,omitempty"`
-	TotalInitialRemoteDiskSize int                                                                `json:"total_initial_remote_disk_size,omitempty"`
-	UseMlRuntime               bool                                                               `json:"use_ml_runtime,omitempty"`
-	Autoscale                  *ResourceJobTaskForEachTaskTaskNewClusterAutoscale                 `json:"autoscale,omitempty"`
-	AwsAttributes              *ResourceJobTaskForEachTaskTaskNewClusterAwsAttributes             `json:"aws_attributes,omitempty"`
-	AzureAttributes            *ResourceJobTaskForEachTaskTaskNewClusterAzureAttributes           `json:"azure_attributes,omitempty"`
-	ClusterLogConf             *ResourceJobTaskForEachTaskTaskNewClusterClusterLogConf            `json:"cluster_log_conf,omitempty"`
-	ClusterMountInfo           []ResourceJobTaskForEachTaskTaskNewClusterClusterMountInfo         `json:"cluster_mount_info,omitempty"`
-	DockerImage                *ResourceJobTaskForEachTaskTaskNewClusterDockerImage               `json:"docker_image,omitempty"`
-	DriverNodeTypeFlexibility  *ResourceJobTaskForEachTaskTaskNewClusterDriverNodeTypeFlexibility `json:"driver_node_type_flexibility,omitempty"`
-	GcpAttributes              *ResourceJobTaskForEachTaskTaskNewClusterGcpAttributes             `json:"gcp_attributes,omitempty"`
-	InitScripts                []ResourceJobTaskForEachTaskTaskNewClusterInitScripts              `json:"init_scripts,omitempty"`
-	Library                    []ResourceJobTaskForEachTaskTaskNewClusterLibrary                  `json:"library,omitempty"`
-	ProviderConfig             *ResourceJobTaskForEachTaskTaskNewClusterProviderConfig            `json:"provider_config,omitempty"`
-	WorkerNodeTypeFlexibility  *ResourceJobTaskForEachTaskTaskNewClusterWorkerNodeTypeFlexibility `json:"worker_node_type_flexibility,omitempty"`
-	WorkloadType               *ResourceJobTaskForEachTaskTaskNewClusterWorkloadType              `json:"workload_type,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskNotebookTask struct {
-	BaseParameters map[string]string `json:"base_parameters,omitempty"`
-	NotebookPath   string            `json:"notebook_path"`
-	Source         string            `json:"source,omitempty"`
-	WarehouseId    string            `json:"warehouse_id,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskNotificationSettings struct {
-	AlertOnLastAttempt     bool `json:"alert_on_last_attempt,omitempty"`
-	NoAlertForCanceledRuns bool `json:"no_alert_for_canceled_runs,omitempty"`
-	NoAlertForSkippedRuns  bool `json:"no_alert_for_skipped_runs,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskPipelineTask struct {
-	FullRefresh bool   `json:"full_refresh,omitempty"`
-	PipelineId  string `json:"pipeline_id"`
-}
-
-type ResourceJobTaskForEachTaskTaskPowerBiTaskPowerBiModel struct {
-	AuthenticationMethod string `json:"authentication_method,omitempty"`
-	ModelName            string `json:"model_name,omitempty"`
-	OverwriteExisting    bool   `json:"overwrite_existing,omitempty"`
-	StorageMode          string `json:"storage_mode,omitempty"`
-	WorkspaceName        string `json:"workspace_name,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskPowerBiTaskTables struct {
-	Catalog     string `json:"catalog,omitempty"`
-	Name        string `json:"name,omitempty"`
-	Schema      string `json:"schema,omitempty"`
-	StorageMode string `json:"storage_mode,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskPowerBiTask struct {
-	ConnectionResourceName string                                                 `json:"connection_resource_name,omitempty"`
-	RefreshAfterUpdate     bool                                                   `json:"refresh_after_update,omitempty"`
-	WarehouseId            string                                                 `json:"warehouse_id,omitempty"`
-	PowerBiModel           *ResourceJobTaskForEachTaskTaskPowerBiTaskPowerBiModel `json:"power_bi_model,omitempty"`
-	Tables                 []ResourceJobTaskForEachTaskTaskPowerBiTaskTables      `json:"tables,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskPythonWheelTask struct {
-	EntryPoint      string            `json:"entry_point,omitempty"`
-	NamedParameters map[string]string `json:"named_parameters,omitempty"`
-	PackageName     string            `json:"package_name,omitempty"`
-	Parameters      []string          `json:"parameters,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskRunJobTaskPipelineParams struct {
-	FullRefresh bool `json:"full_refresh,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskRunJobTask struct {
-	DbtCommands       []string                                                `json:"dbt_commands,omitempty"`
-	JarParams         []string                                                `json:"jar_params,omitempty"`
-	JobId             int                                                     `json:"job_id"`
-	JobParameters     map[string]string                                       `json:"job_parameters,omitempty"`
-	NotebookParams    map[string]string                                       `json:"notebook_params,omitempty"`
-	PythonNamedParams map[string]string                                       `json:"python_named_params,omitempty"`
-	PythonParams      []string                                                `json:"python_params,omitempty"`
-	SparkSubmitParams []string                                                `json:"spark_submit_params,omitempty"`
-	SqlParams         map[string]string                                       `json:"sql_params,omitempty"`
-	PipelineParams    *ResourceJobTaskForEachTaskTaskRunJobTaskPipelineParams `json:"pipeline_params,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskSparkJarTask struct {
-	JarUri        string   `json:"jar_uri,omitempty"`
-	MainClassName string   `json:"main_class_name,omitempty"`
-	Parameters    []string `json:"parameters,omitempty"`
-	RunAsRepl     bool     `json:"run_as_repl,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskSparkPythonTask struct {
-	Parameters []string `json:"parameters,omitempty"`
-	PythonFile string   `json:"python_file"`
-	Source     string   `json:"source,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskSparkSubmitTask struct {
-	Parameters []string `json:"parameters,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskSqlTaskAlertSubscriptions struct {
-	DestinationId string `json:"destination_id,omitempty"`
-	UserName      string `json:"user_name,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskSqlTaskAlert struct {
-	AlertId            string                                                    `json:"alert_id"`
-	PauseSubscriptions bool                                                      `json:"pause_subscriptions,omitempty"`
-	Subscriptions      []ResourceJobTaskForEachTaskTaskSqlTaskAlertSubscriptions `json:"subscriptions,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskSqlTaskDashboardSubscriptions struct {
-	DestinationId string `json:"destination_id,omitempty"`
-	UserName      string `json:"user_name,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskSqlTaskDashboard struct {
-	CustomSubject      string                                                        `json:"custom_subject,omitempty"`
-	DashboardId        string                                                        `json:"dashboard_id"`
-	PauseSubscriptions bool                                                          `json:"pause_subscriptions,omitempty"`
-	Subscriptions      []ResourceJobTaskForEachTaskTaskSqlTaskDashboardSubscriptions `json:"subscriptions,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskSqlTaskFile struct {
-	Path   string `json:"path"`
-	Source string `json:"source,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskSqlTaskQuery struct {
-	QueryId string `json:"query_id"`
-}
-
-type ResourceJobTaskForEachTaskTaskSqlTask struct {
-	Parameters  map[string]string                               `json:"parameters,omitempty"`
-	WarehouseId string                                          `json:"warehouse_id"`
-	Alert       *ResourceJobTaskForEachTaskTaskSqlTaskAlert     `json:"alert,omitempty"`
-	Dashboard   *ResourceJobTaskForEachTaskTaskSqlTaskDashboard `json:"dashboard,omitempty"`
-	File        *ResourceJobTaskForEachTaskTaskSqlTaskFile      `json:"file,omitempty"`
-	Query       *ResourceJobTaskForEachTaskTaskSqlTaskQuery     `json:"query,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTaskWebhookNotificationsOnDurationWarningThresholdExceeded struct {
-	Id string `json:"id"`
-}
-
-type ResourceJobTaskForEachTaskTaskWebhookNotificationsOnFailure struct {
-	Id string `json:"id"`
-}
-
-type ResourceJobTaskForEachTaskTaskWebhookNotificationsOnStart struct {
-	Id string `json:"id"`
-}
-
-type ResourceJobTaskForEachTaskTaskWebhookNotificationsOnStreamingBacklogExceeded struct {
-	Id string `json:"id"`
-}
-
-type ResourceJobTaskForEachTaskTaskWebhookNotificationsOnSuccess struct {
-	Id string `json:"id"`
-}
-
-type ResourceJobTaskForEachTaskTaskWebhookNotifications struct {
-	OnDurationWarningThresholdExceeded []ResourceJobTaskForEachTaskTaskWebhookNotificationsOnDurationWarningThresholdExceeded `json:"on_duration_warning_threshold_exceeded,omitempty"`
-	OnFailure                          []ResourceJobTaskForEachTaskTaskWebhookNotificationsOnFailure                          `json:"on_failure,omitempty"`
-	OnStart                            []ResourceJobTaskForEachTaskTaskWebhookNotificationsOnStart                            `json:"on_start,omitempty"`
-	OnStreamingBacklogExceeded         []ResourceJobTaskForEachTaskTaskWebhookNotificationsOnStreamingBacklogExceeded         `json:"on_streaming_backlog_exceeded,omitempty"`
-	OnSuccess                          []ResourceJobTaskForEachTaskTaskWebhookNotificationsOnSuccess                          `json:"on_success,omitempty"`
-}
-
-type ResourceJobTaskForEachTaskTask struct {
-	Description             string                                                `json:"description,omitempty"`
-	DisableAutoOptimization bool                                                  `json:"disable_auto_optimization,omitempty"`
-	Disabled                bool                                                  `json:"disabled,omitempty"`
-	EnvironmentKey          string                                                `json:"environment_key,omitempty"`
-	ExistingClusterId       string                                                `json:"existing_cluster_id,omitempty"`
-	JobClusterKey           string                                                `json:"job_cluster_key,omitempty"`
-	MaxRetries              int                                                   `json:"max_retries,omitempty"`
-	MinRetryIntervalMillis  int                                                   `json:"min_retry_interval_millis,omitempty"`
-	RetryOnTimeout          bool                                                  `json:"retry_on_timeout,omitempty"`
-	RunIf                   string                                                `json:"run_if,omitempty"`
-	TaskKey                 string                                                `json:"task_key"`
-	TimeoutSeconds          int                                                   `json:"timeout_seconds,omitempty"`
-	AlertTask               *ResourceJobTaskForEachTaskTaskAlertTask              `json:"alert_task,omitempty"`
-	CleanRoomsNotebookTask  *ResourceJobTaskForEachTaskTaskCleanRoomsNotebookTask `json:"clean_rooms_notebook_task,omitempty"`
-	Compute                 *ResourceJobTaskForEachTaskTaskCompute                `json:"compute,omitempty"`
-	ConditionTask           *ResourceJobTaskForEachTaskTaskConditionTask          `json:"condition_task,omitempty"`
-	DashboardTask           *ResourceJobTaskForEachTaskTaskDashboardTask          `json:"dashboard_task,omitempty"`
-	DbtCloudTask            *ResourceJobTaskForEachTaskTaskDbtCloudTask           `json:"dbt_cloud_task,omitempty"`
-	DbtPlatformTask         *ResourceJobTaskForEachTaskTaskDbtPlatformTask        `json:"dbt_platform_task,omitempty"`
-	DbtTask                 *ResourceJobTaskForEachTaskTaskDbtTask                `json:"dbt_task,omitempty"`
-	DependsOn               []ResourceJobTaskForEachTaskTaskDependsOn             `json:"depends_on,omitempty"`
-	EmailNotifications      *ResourceJobTaskForEachTaskTaskEmailNotifications     `json:"email_notifications,omitempty"`
-	GenAiComputeTask        *ResourceJobTaskForEachTaskTaskGenAiComputeTask       `json:"gen_ai_compute_task,omitempty"`
-	Health                  *ResourceJobTaskForEachTaskTaskHealth                 `json:"health,omitempty"`
-	Library                 []ResourceJobTaskForEachTaskTaskLibrary               `json:"library,omitempty"`
-	NewCluster              *ResourceJobTaskForEachTaskTaskNewCluster             `json:"new_cluster,omitempty"`
-	NotebookTask            *ResourceJobTaskForEachTaskTaskNotebookTask           `json:"notebook_task,omitempty"`
-	NotificationSettings    *ResourceJobTaskForEachTaskTaskNotificationSettings   `json:"notification_settings,omitempty"`
-	PipelineTask            *ResourceJobTaskForEachTaskTaskPipelineTask           `json:"pipeline_task,omitempty"`
-	PowerBiTask             *ResourceJobTaskForEachTaskTaskPowerBiTask            `json:"power_bi_task,omitempty"`
-	PythonWheelTask         *ResourceJobTaskForEachTaskTaskPythonWheelTask        `json:"python_wheel_task,omitempty"`
-	RunJobTask              *ResourceJobTaskForEachTaskTaskRunJobTask             `json:"run_job_task,omitempty"`
-	SparkJarTask            *ResourceJobTaskForEachTaskTaskSparkJarTask           `json:"spark_jar_task,omitempty"`
-	SparkPythonTask         *ResourceJobTaskForEachTaskTaskSparkPythonTask        `json:"spark_python_task,omitempty"`
-	SparkSubmitTask         *ResourceJobTaskForEachTaskTaskSparkSubmitTask        `json:"spark_submit_task,omitempty"`
-	SqlTask                 *ResourceJobTaskForEachTaskTaskSqlTask                `json:"sql_task,omitempty"`
-	WebhookNotifications    *ResourceJobTaskForEachTaskTaskWebhookNotifications   `json:"webhook_notifications,omitempty"`
-}
-
-type ResourceJobTaskForEachTask struct {
-	Concurrency int                             `json:"concurrency,omitempty"`
-	Inputs      string                          `json:"inputs"`
-	Task        *ResourceJobTaskForEachTaskTask `json:"task,omitempty"`
-}
-
-type ResourceJobTaskGenAiComputeTaskCompute struct {
-	GpuNodePoolId string `json:"gpu_node_pool_id,omitempty"`
-	GpuType       string `json:"gpu_type,omitempty"`
-	NumGpus       int    `json:"num_gpus"`
-}
-
-type ResourceJobTaskGenAiComputeTask struct {
-	Command                string                                  `json:"command,omitempty"`
-	DlRuntimeImage         string                                  `json:"dl_runtime_image"`
-	MlflowExperimentName   string                                  `json:"mlflow_experiment_name,omitempty"`
-	Source                 string                                  `json:"source,omitempty"`
-	TrainingScriptPath     string                                  `json:"training_script_path,omitempty"`
-	YamlParameters         string                                  `json:"yaml_parameters,omitempty"`
-	YamlParametersFilePath string                                  `json:"yaml_parameters_file_path,omitempty"`
-	Compute                *ResourceJobTaskGenAiComputeTaskCompute `json:"compute,omitempty"`
-}
-
-type ResourceJobTaskHealthRules struct {
-	Metric string `json:"metric"`
-	Op     string `json:"op"`
-	Value  int    `json:"value"`
-}
-
-type ResourceJobTaskHealth struct {
-	Rules []ResourceJobTaskHealthRules `json:"rules,omitempty"`
-}
-
-type ResourceJobTaskLibraryCran struct {
-	Package string `json:"package"`
-	Repo    string `json:"repo,omitempty"`
-}
-
-type ResourceJobTaskLibraryMaven struct {
-	Coordinates string   `json:"coordinates"`
-	Exclusions  []string `json:"exclusions,omitempty"`
-	Repo        string   `json:"repo,omitempty"`
-}
-
-type ResourceJobTaskLibraryProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceJobTaskLibraryPypi struct {
-	Package string `json:"package"`
-	Repo    string `json:"repo,omitempty"`
-}
-
-type ResourceJobTaskLibrary struct {
-	Egg            string                                `json:"egg,omitempty"`
-	Jar            string                                `json:"jar,omitempty"`
-	Requirements   string                                `json:"requirements,omitempty"`
-	Whl            string                                `json:"whl,omitempty"`
-	Cran           *ResourceJobTaskLibraryCran           `json:"cran,omitempty"`
-	Maven          *ResourceJobTaskLibraryMaven          `json:"maven,omitempty"`
-	ProviderConfig *ResourceJobTaskLibraryProviderConfig `json:"provider_config,omitempty"`
-	Pypi           *ResourceJobTaskLibraryPypi           `json:"pypi,omitempty"`
-}
-
-type ResourceJobTaskNewClusterAutoscale struct {
-	MaxWorkers int `json:"max_workers,omitempty"`
-	MinWorkers int `json:"min_workers,omitempty"`
-}
-
-type ResourceJobTaskNewClusterAwsAttributes struct {
-	Availability        string `json:"availability,omitempty"`
-	EbsVolumeCount      int    `json:"ebs_volume_count,omitempty"`
-	EbsVolumeIops       int    `json:"ebs_volume_iops,omitempty"`
-	EbsVolumeSize       int    `json:"ebs_volume_size,omitempty"`
-	EbsVolumeThroughput int    `json:"ebs_volume_throughput,omitempty"`
-	EbsVolumeType       string `json:"ebs_volume_type,omitempty"`
-	FirstOnDemand       int    `json:"first_on_demand,omitempty"`
-	InstanceProfileArn  string `json:"instance_profile_arn,omitempty"`
-	SpotBidPricePercent int    `json:"spot_bid_price_percent,omitempty"`
-	ZoneId              string `json:"zone_id,omitempty"`
-}
-
-type ResourceJobTaskNewClusterAzureAttributesLogAnalyticsInfo struct {
-	LogAnalyticsPrimaryKey  string `json:"log_analytics_primary_key,omitempty"`
-	LogAnalyticsWorkspaceId string `json:"log_analytics_workspace_id,omitempty"`
-}
-
-type ResourceJobTaskNewClusterAzureAttributes struct {
-	Availability     string                                                    `json:"availability,omitempty"`
-	FirstOnDemand    int                                                       `json:"first_on_demand,omitempty"`
-	SpotBidMaxPrice  int                                                       `json:"spot_bid_max_price,omitempty"`
-	LogAnalyticsInfo *ResourceJobTaskNewClusterAzureAttributesLogAnalyticsInfo `json:"log_analytics_info,omitempty"`
-}
-
-type ResourceJobTaskNewClusterClusterLogConfDbfs struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceJobTaskNewClusterClusterLogConfS3 struct {
-	CannedAcl        string `json:"canned_acl,omitempty"`
-	Destination      string `json:"destination"`
-	EnableEncryption bool   `json:"enable_encryption,omitempty"`
-	EncryptionType   string `json:"encryption_type,omitempty"`
-	Endpoint         string `json:"endpoint,omitempty"`
-	KmsKey           string `json:"kms_key,omitempty"`
-	Region           string `json:"region,omitempty"`
-}
-
-type ResourceJobTaskNewClusterClusterLogConfVolumes struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceJobTaskNewClusterClusterLogConf struct {
-	Dbfs    *ResourceJobTaskNewClusterClusterLogConfDbfs    `json:"dbfs,omitempty"`
-	S3      *ResourceJobTaskNewClusterClusterLogConfS3      `json:"s3,omitempty"`
-	Volumes *ResourceJobTaskNewClusterClusterLogConfVolumes `json:"volumes,omitempty"`
-}
-
-type ResourceJobTaskNewClusterClusterMountInfoNetworkFilesystemInfo struct {
-	MountOptions  string `json:"mount_options,omitempty"`
-	ServerAddress string `json:"server_address"`
-}
-
-type ResourceJobTaskNewClusterClusterMountInfo struct {
-	LocalMountDirPath     string                                                          `json:"local_mount_dir_path"`
-	RemoteMountDirPath    string                                                          `json:"remote_mount_dir_path,omitempty"`
-	NetworkFilesystemInfo *ResourceJobTaskNewClusterClusterMountInfoNetworkFilesystemInfo `json:"network_filesystem_info,omitempty"`
-}
-
-type ResourceJobTaskNewClusterDockerImageBasicAuth struct {
-	Password string `json:"password"`
-	Username string `json:"username"`
-}
-
-type ResourceJobTaskNewClusterDockerImage struct {
-	Url       string                                         `json:"url"`
-	BasicAuth *ResourceJobTaskNewClusterDockerImageBasicAuth `json:"basic_auth,omitempty"`
-}
-
-type ResourceJobTaskNewClusterDriverNodeTypeFlexibility struct {
-	AlternateNodeTypeIds []string `json:"alternate_node_type_ids,omitempty"`
-}
-
-type ResourceJobTaskNewClusterGcpAttributes struct {
-	Availability            string `json:"availability,omitempty"`
-	BootDiskSize            int    `json:"boot_disk_size,omitempty"`
-	FirstOnDemand           int    `json:"first_on_demand,omitempty"`
-	GoogleServiceAccount    string `json:"google_service_account,omitempty"`
-	LocalSsdCount           int    `json:"local_ssd_count,omitempty"`
-	UsePreemptibleExecutors bool   `json:"use_preemptible_executors,omitempty"`
-	ZoneId                  string `json:"zone_id,omitempty"`
-}
-
-type ResourceJobTaskNewClusterInitScriptsAbfss struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceJobTaskNewClusterInitScriptsDbfs struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceJobTaskNewClusterInitScriptsFile struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceJobTaskNewClusterInitScriptsGcs struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceJobTaskNewClusterInitScriptsS3 struct {
-	CannedAcl        string `json:"canned_acl,omitempty"`
-	Destination      string `json:"destination"`
-	EnableEncryption bool   `json:"enable_encryption,omitempty"`
-	EncryptionType   string `json:"encryption_type,omitempty"`
-	Endpoint         string `json:"endpoint,omitempty"`
-	KmsKey           string `json:"kms_key,omitempty"`
-	Region           string `json:"region,omitempty"`
-}
-
-type ResourceJobTaskNewClusterInitScriptsVolumes struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceJobTaskNewClusterInitScriptsWorkspace struct {
-	Destination string `json:"destination"`
-}
-
-type ResourceJobTaskNewClusterInitScripts struct {
-	Abfss     *ResourceJobTaskNewClusterInitScriptsAbfss     `json:"abfss,omitempty"`
-	Dbfs      *ResourceJobTaskNewClusterInitScriptsDbfs      `json:"dbfs,omitempty"`
-	File      *ResourceJobTaskNewClusterInitScriptsFile      `json:"file,omitempty"`
-	Gcs       *ResourceJobTaskNewClusterInitScriptsGcs       `json:"gcs,omitempty"`
-	S3        *ResourceJobTaskNewClusterInitScriptsS3        `json:"s3,omitempty"`
-	Volumes   *ResourceJobTaskNewClusterInitScriptsVolumes   `json:"volumes,omitempty"`
-	Workspace *ResourceJobTaskNewClusterInitScriptsWorkspace `json:"workspace,omitempty"`
-}
-
-type ResourceJobTaskNewClusterLibraryCran struct {
-	Package string `json:"package"`
-	Repo    string `json:"repo,omitempty"`
-}
-
-type ResourceJobTaskNewClusterLibraryMaven struct {
-	Coordinates string   `json:"coordinates"`
-	Exclusions  []string `json:"exclusions,omitempty"`
-	Repo        string   `json:"repo,omitempty"`
-}
-
-type ResourceJobTaskNewClusterLibraryProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceJobTaskNewClusterLibraryPypi struct {
-	Package string `json:"package"`
-	Repo    string `json:"repo,omitempty"`
-}
-
-type ResourceJobTaskNewClusterLibrary struct {
-	Egg            string                                          `json:"egg,omitempty"`
-	Jar            string                                          `json:"jar,omitempty"`
-	Requirements   string                                          `json:"requirements,omitempty"`
-	Whl            string                                          `json:"whl,omitempty"`
-	Cran           *ResourceJobTaskNewClusterLibraryCran           `json:"cran,omitempty"`
-	Maven          *ResourceJobTaskNewClusterLibraryMaven          `json:"maven,omitempty"`
-	ProviderConfig *ResourceJobTaskNewClusterLibraryProviderConfig `json:"provider_config,omitempty"`
-	Pypi           *ResourceJobTaskNewClusterLibraryPypi           `json:"pypi,omitempty"`
-}
-
-type ResourceJobTaskNewClusterProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceJobTaskNewClusterWorkerNodeTypeFlexibility struct {
-	AlternateNodeTypeIds []string `json:"alternate_node_type_ids,omitempty"`
-}
-
-type ResourceJobTaskNewClusterWorkloadTypeClients struct {
-	Jobs      bool `json:"jobs,omitempty"`
-	Notebooks bool `json:"notebooks,omitempty"`
-}
-
-type ResourceJobTaskNewClusterWorkloadType struct {
-	Clients *ResourceJobTaskNewClusterWorkloadTypeClients `json:"clients,omitempty"`
-}
-
-type ResourceJobTaskNewCluster struct {
-	ApplyPolicyDefaultValuesAllowList []string                                            `json:"__apply_policy_default_values_allow_list,omitempty"`
-	ApplyPolicyDefaultValues          bool                                                `json:"apply_policy_default_values,omitempty"`
-	ClusterId                         string                                              `json:"cluster_id,omitempty"`
-	ClusterName                       string                                              `json:"cluster_name,omitempty"`
-	CustomTags                        map[string]string                                   `json:"custom_tags,omitempty"`
-	DataSecurityMode                  string                                              `json:"data_security_mode,omitempty"`
-	DriverInstancePoolId              string                                              `json:"driver_instance_pool_id,omitempty"`
-	DriverNodeTypeId                  string                                              `json:"driver_node_type_id,omitempty"`
-	EnableElasticDisk                 bool                                                `json:"enable_elastic_disk,omitempty"`
-	EnableLocalDiskEncryption         bool                                                `json:"enable_local_disk_encryption,omitempty"`
-	IdempotencyToken                  string                                              `json:"idempotency_token,omitempty"`
-	InstancePoolId                    string                                              `json:"instance_pool_id,omitempty"`
-	IsSingleNode                      bool                                                `json:"is_single_node,omitempty"`
-	Kind                              string                                              `json:"kind,omitempty"`
-	NodeTypeId                        string                                              `json:"node_type_id,omitempty"`
-	NumWorkers                        int                                                 `json:"num_workers,omitempty"`
-	PolicyId                          string                                              `json:"policy_id,omitempty"`
-	RemoteDiskThroughput              int                                                 `json:"remote_disk_throughput,omitempty"`
-	RuntimeEngine                     string                                              `json:"runtime_engine,omitempty"`
-	SingleUserName                    string                                              `json:"single_user_name,omitempty"`
-	SparkConf                         map[string]string                                   `json:"spark_conf,omitempty"`
-	SparkEnvVars                      map[string]string                                   `json:"spark_env_vars,omitempty"`
-	SparkVersion                      string                                              `json:"spark_version,omitempty"`
-	SshPublicKeys                     []string                                            `json:"ssh_public_keys,omitempty"`
-	TotalInitialRemoteDiskSize        int                                                 `json:"total_initial_remote_disk_size,omitempty"`
-	UseMlRuntime                      bool                                                `json:"use_ml_runtime,omitempty"`
-	Autoscale                         *ResourceJobTaskNewClusterAutoscale                 `json:"autoscale,omitempty"`
-	AwsAttributes                     *ResourceJobTaskNewClusterAwsAttributes             `json:"aws_attributes,omitempty"`
-	AzureAttributes                   *ResourceJobTaskNewClusterAzureAttributes           `json:"azure_attributes,omitempty"`
-	ClusterLogConf                    *ResourceJobTaskNewClusterClusterLogConf            `json:"cluster_log_conf,omitempty"`
-	ClusterMountInfo                  []ResourceJobTaskNewClusterClusterMountInfo         `json:"cluster_mount_info,omitempty"`
-	DockerImage                       *ResourceJobTaskNewClusterDockerImage               `json:"docker_image,omitempty"`
-	DriverNodeTypeFlexibility         *ResourceJobTaskNewClusterDriverNodeTypeFlexibility `json:"driver_node_type_flexibility,omitempty"`
-	GcpAttributes                     *ResourceJobTaskNewClusterGcpAttributes             `json:"gcp_attributes,omitempty"`
-	InitScripts                       []ResourceJobTaskNewClusterInitScripts              `json:"init_scripts,omitempty"`
-	Library                           []ResourceJobTaskNewClusterLibrary                  `json:"library,omitempty"`
-	ProviderConfig                    *ResourceJobTaskNewClusterProviderConfig            `json:"provider_config,omitempty"`
-	WorkerNodeTypeFlexibility         *ResourceJobTaskNewClusterWorkerNodeTypeFlexibility `json:"worker_node_type_flexibility,omitempty"`
-	WorkloadType                      *ResourceJobTaskNewClusterWorkloadType              `json:"workload_type,omitempty"`
-}
-
-type ResourceJobTaskNotebookTask struct {
-	BaseParameters map[string]string `json:"base_parameters,omitempty"`
-	NotebookPath   string            `json:"notebook_path"`
-	Source         string            `json:"source,omitempty"`
-	WarehouseId    string            `json:"warehouse_id,omitempty"`
-}
-
-type ResourceJobTaskNotificationSettings struct {
-	AlertOnLastAttempt     bool `json:"alert_on_last_attempt,omitempty"`
-	NoAlertForCanceledRuns bool `json:"no_alert_for_canceled_runs,omitempty"`
-	NoAlertForSkippedRuns  bool `json:"no_alert_for_skipped_runs,omitempty"`
-}
-
-type ResourceJobTaskPipelineTask struct {
-	FullRefresh bool   `json:"full_refresh,omitempty"`
-	PipelineId  string `json:"pipeline_id"`
-}
-
-type ResourceJobTaskPowerBiTaskPowerBiModel struct {
-	AuthenticationMethod string `json:"authentication_method,omitempty"`
-	ModelName            string `json:"model_name,omitempty"`
-	OverwriteExisting    bool   `json:"overwrite_existing,omitempty"`
-	StorageMode          string `json:"storage_mode,omitempty"`
-	WorkspaceName        string `json:"workspace_name,omitempty"`
-}
-
-type ResourceJobTaskPowerBiTaskTables struct {
-	Catalog     string `json:"catalog,omitempty"`
-	Name        string `json:"name,omitempty"`
-	Schema      string `json:"schema,omitempty"`
-	StorageMode string `json:"storage_mode,omitempty"`
-}
-
-type ResourceJobTaskPowerBiTask struct {
-	ConnectionResourceName string                                  `json:"connection_resource_name,omitempty"`
-	RefreshAfterUpdate     bool                                    `json:"refresh_after_update,omitempty"`
-	WarehouseId            string                                  `json:"warehouse_id,omitempty"`
-	PowerBiModel           *ResourceJobTaskPowerBiTaskPowerBiModel `json:"power_bi_model,omitempty"`
-	Tables                 []ResourceJobTaskPowerBiTaskTables      `json:"tables,omitempty"`
-}
-
-type ResourceJobTaskPythonWheelTask struct {
-	EntryPoint      string            `json:"entry_point,omitempty"`
-	NamedParameters map[string]string `json:"named_parameters,omitempty"`
-	PackageName     string            `json:"package_name,omitempty"`
-	Parameters      []string          `json:"parameters,omitempty"`
-}
-
-type ResourceJobTaskRunJobTaskPipelineParams struct {
-	FullRefresh bool `json:"full_refresh,omitempty"`
-}
-
-type ResourceJobTaskRunJobTask struct {
-	DbtCommands       []string                                 `json:"dbt_commands,omitempty"`
-	JarParams         []string                                 `json:"jar_params,omitempty"`
-	JobId             int                                      `json:"job_id"`
-	JobParameters     map[string]string                        `json:"job_parameters,omitempty"`
-	NotebookParams    map[string]string                        `json:"notebook_params,omitempty"`
-	PythonNamedParams map[string]string                        `json:"python_named_params,omitempty"`
-	PythonParams      []string                                 `json:"python_params,omitempty"`
-	SparkSubmitParams []string                                 `json:"spark_submit_params,omitempty"`
-	SqlParams         map[string]string                        `json:"sql_params,omitempty"`
-	PipelineParams    *ResourceJobTaskRunJobTaskPipelineParams `json:"pipeline_params,omitempty"`
-}
-
-type ResourceJobTaskSparkJarTask struct {
-	JarUri        string   `json:"jar_uri,omitempty"`
-	MainClassName string   `json:"main_class_name,omitempty"`
-	Parameters    []string `json:"parameters,omitempty"`
-	RunAsRepl     bool     `json:"run_as_repl,omitempty"`
-}
-
-type ResourceJobTaskSparkPythonTask struct {
-	Parameters []string `json:"parameters,omitempty"`
-	PythonFile string   `json:"python_file"`
-	Source     string   `json:"source,omitempty"`
-}
-
-type ResourceJobTaskSparkSubmitTask struct {
-	Parameters []string `json:"parameters,omitempty"`
-}
-
-type ResourceJobTaskSqlTaskAlertSubscriptions struct {
-	DestinationId string `json:"destination_id,omitempty"`
-	UserName      string `json:"user_name,omitempty"`
-}
-
-type ResourceJobTaskSqlTaskAlert struct {
-	AlertId            string                                     `json:"alert_id"`
-	PauseSubscriptions bool                                       `json:"pause_subscriptions,omitempty"`
-	Subscriptions      []ResourceJobTaskSqlTaskAlertSubscriptions `json:"subscriptions,omitempty"`
-}
-
-type ResourceJobTaskSqlTaskDashboardSubscriptions struct {
-	DestinationId string `json:"destination_id,omitempty"`
-	UserName      string `json:"user_name,omitempty"`
-}
-
-type ResourceJobTaskSqlTaskDashboard struct {
-	CustomSubject      string                                         `json:"custom_subject,omitempty"`
-	DashboardId        string                                         `json:"dashboard_id"`
-	PauseSubscriptions bool                                           `json:"pause_subscriptions,omitempty"`
-	Subscriptions      []ResourceJobTaskSqlTaskDashboardSubscriptions `json:"subscriptions,omitempty"`
-}
-
-type ResourceJobTaskSqlTaskFile struct {
-	Path   string `json:"path"`
-	Source string `json:"source,omitempty"`
-}
-
-type ResourceJobTaskSqlTaskQuery struct {
-	QueryId string `json:"query_id"`
-}
-
-type ResourceJobTaskSqlTask struct {
-	Parameters  map[string]string                `json:"parameters,omitempty"`
-	WarehouseId string                           `json:"warehouse_id"`
-	Alert       *ResourceJobTaskSqlTaskAlert     `json:"alert,omitempty"`
-	Dashboard   *ResourceJobTaskSqlTaskDashboard `json:"dashboard,omitempty"`
-	File        *ResourceJobTaskSqlTaskFile      `json:"file,omitempty"`
-	Query       *ResourceJobTaskSqlTaskQuery     `json:"query,omitempty"`
-}
-
-type ResourceJobTaskWebhookNotificationsOnDurationWarningThresholdExceeded struct {
-	Id string `json:"id"`
-}
-
-type ResourceJobTaskWebhookNotificationsOnFailure struct {
-	Id string `json:"id"`
-}
-
-type ResourceJobTaskWebhookNotificationsOnStart struct {
-	Id string `json:"id"`
-}
-
-type ResourceJobTaskWebhookNotificationsOnStreamingBacklogExceeded struct {
-	Id string `json:"id"`
-}
-
-type ResourceJobTaskWebhookNotificationsOnSuccess struct {
-	Id string `json:"id"`
-}
-
-type ResourceJobTaskWebhookNotifications struct {
-	OnDurationWarningThresholdExceeded []ResourceJobTaskWebhookNotificationsOnDurationWarningThresholdExceeded `json:"on_duration_warning_threshold_exceeded,omitempty"`
-	OnFailure                          []ResourceJobTaskWebhookNotificationsOnFailure                          `json:"on_failure,omitempty"`
-	OnStart                            []ResourceJobTaskWebhookNotificationsOnStart                            `json:"on_start,omitempty"`
-	OnStreamingBacklogExceeded         []ResourceJobTaskWebhookNotificationsOnStreamingBacklogExceeded         `json:"on_streaming_backlog_exceeded,omitempty"`
-	OnSuccess                          []ResourceJobTaskWebhookNotificationsOnSuccess                          `json:"on_success,omitempty"`
-}
-
-type ResourceJobTask struct {
-	Description             string                                 `json:"description,omitempty"`
-	DisableAutoOptimization bool                                   `json:"disable_auto_optimization,omitempty"`
-	Disabled                bool                                   `json:"disabled,omitempty"`
-	EnvironmentKey          string                                 `json:"environment_key,omitempty"`
-	ExistingClusterId       string                                 `json:"existing_cluster_id,omitempty"`
-	JobClusterKey           string                                 `json:"job_cluster_key,omitempty"`
-	MaxRetries              int                                    `json:"max_retries,omitempty"`
-	MinRetryIntervalMillis  int                                    `json:"min_retry_interval_millis,omitempty"`
-	RetryOnTimeout          bool                                   `json:"retry_on_timeout,omitempty"`
-	RunIf                   string                                 `json:"run_if,omitempty"`
-	TaskKey                 string                                 `json:"task_key"`
-	TimeoutSeconds          int                                    `json:"timeout_seconds,omitempty"`
-	AlertTask               *ResourceJobTaskAlertTask              `json:"alert_task,omitempty"`
-	CleanRoomsNotebookTask  *ResourceJobTaskCleanRoomsNotebookTask `json:"clean_rooms_notebook_task,omitempty"`
-	Compute                 *ResourceJobTaskCompute                `json:"compute,omitempty"`
-	ConditionTask           *ResourceJobTaskConditionTask          `json:"condition_task,omitempty"`
-	DashboardTask           *ResourceJobTaskDashboardTask          `json:"dashboard_task,omitempty"`
-	DbtCloudTask            *ResourceJobTaskDbtCloudTask           `json:"dbt_cloud_task,omitempty"`
-	DbtPlatformTask         *ResourceJobTaskDbtPlatformTask        `json:"dbt_platform_task,omitempty"`
-	DbtTask                 *ResourceJobTaskDbtTask                `json:"dbt_task,omitempty"`
-	DependsOn               []ResourceJobTaskDependsOn             `json:"depends_on,omitempty"`
-	EmailNotifications      *ResourceJobTaskEmailNotifications     `json:"email_notifications,omitempty"`
-	ForEachTask             *ResourceJobTaskForEachTask            `json:"for_each_task,omitempty"`
-	GenAiComputeTask        *ResourceJobTaskGenAiComputeTask       `json:"gen_ai_compute_task,omitempty"`
-	Health                  *ResourceJobTaskHealth                 `json:"health,omitempty"`
-	Library                 []ResourceJobTaskLibrary               `json:"library,omitempty"`
-	NewCluster              *ResourceJobTaskNewCluster             `json:"new_cluster,omitempty"`
-	NotebookTask            *ResourceJobTaskNotebookTask           `json:"notebook_task,omitempty"`
-	NotificationSettings    *ResourceJobTaskNotificationSettings   `json:"notification_settings,omitempty"`
-	PipelineTask            *ResourceJobTaskPipelineTask           `json:"pipeline_task,omitempty"`
-	PowerBiTask             *ResourceJobTaskPowerBiTask            `json:"power_bi_task,omitempty"`
-	PythonWheelTask         *ResourceJobTaskPythonWheelTask        `json:"python_wheel_task,omitempty"`
-	RunJobTask              *ResourceJobTaskRunJobTask             `json:"run_job_task,omitempty"`
-	SparkJarTask            *ResourceJobTaskSparkJarTask           `json:"spark_jar_task,omitempty"`
-	SparkPythonTask         *ResourceJobTaskSparkPythonTask        `json:"spark_python_task,omitempty"`
-	SparkSubmitTask         *ResourceJobTaskSparkSubmitTask        `json:"spark_submit_task,omitempty"`
-	SqlTask                 *ResourceJobTaskSqlTask                `json:"sql_task,omitempty"`
-	WebhookNotifications    *ResourceJobTaskWebhookNotifications   `json:"webhook_notifications,omitempty"`
-}
-
-type ResourceJobTriggerFileArrival struct {
-	MinTimeBetweenTriggersSeconds int    `json:"min_time_between_triggers_seconds,omitempty"`
-	Url                           string `json:"url"`
-	WaitAfterLastChangeSeconds    int    `json:"wait_after_last_change_seconds,omitempty"`
-}
-
-type ResourceJobTriggerModel struct {
-	Aliases                       []string `json:"aliases,omitempty"`
-	Condition                     string   `json:"condition"`
-	MinTimeBetweenTriggersSeconds int      `json:"min_time_between_triggers_seconds,omitempty"`
-	SecurableName                 string   `json:"securable_name,omitempty"`
-	WaitAfterLastChangeSeconds    int      `json:"wait_after_last_change_seconds,omitempty"`
-}
-
-type ResourceJobTriggerPeriodic struct {
-	Interval int    `json:"interval"`
-	Unit     string `json:"unit"`
-}
-
-type ResourceJobTriggerTableUpdate struct {
-	Condition                     string   `json:"condition,omitempty"`
-	MinTimeBetweenTriggersSeconds int      `json:"min_time_between_triggers_seconds,omitempty"`
-	TableNames                    []string `json:"table_names"`
-	WaitAfterLastChangeSeconds    int      `json:"wait_after_last_change_seconds,omitempty"`
-}
-
-type ResourceJobTrigger struct {
-	PauseStatus string                         `json:"pause_status,omitempty"`
-	FileArrival *ResourceJobTriggerFileArrival `json:"file_arrival,omitempty"`
-	Model       *ResourceJobTriggerModel       `json:"model,omitempty"`
-	Periodic    *ResourceJobTriggerPeriodic    `json:"periodic,omitempty"`
-	TableUpdate *ResourceJobTriggerTableUpdate `json:"table_update,omitempty"`
-}
-
-type ResourceJobWebhookNotificationsOnDurationWarningThresholdExceeded struct {
-	Id string `json:"id"`
-}
-
-type ResourceJobWebhookNotificationsOnFailure struct {
-	Id string `json:"id"`
-}
-
-type ResourceJobWebhookNotificationsOnStart struct {
-	Id string `json:"id"`
-}
-
-type ResourceJobWebhookNotificationsOnStreamingBacklogExceeded struct {
-	Id string `json:"id"`
-}
-
-type ResourceJobWebhookNotificationsOnSuccess struct {
-	Id string `json:"id"`
-}
-
-type ResourceJobWebhookNotifications struct {
-	OnDurationWarningThresholdExceeded []ResourceJobWebhookNotificationsOnDurationWarningThresholdExceeded `json:"on_duration_warning_threshold_exceeded,omitempty"`
-	OnFailure                          []ResourceJobWebhookNotificationsOnFailure                          `json:"on_failure,omitempty"`
-	OnStart                            []ResourceJobWebhookNotificationsOnStart                            `json:"on_start,omitempty"`
-	OnStreamingBacklogExceeded         []ResourceJobWebhookNotificationsOnStreamingBacklogExceeded         `json:"on_streaming_backlog_exceeded,omitempty"`
-	OnSuccess                          []ResourceJobWebhookNotificationsOnSuccess                          `json:"on_success,omitempty"`
-}
-
-type ResourceJob struct {
-	AlwaysRunning          bool                             `json:"always_running,omitempty"`
-	BudgetPolicyId         string                           `json:"budget_policy_id,omitempty"`
-	ControlRunState        bool                             `json:"control_run_state,omitempty"`
-	Description            string                           `json:"description,omitempty"`
-	EditMode               string                           `json:"edit_mode,omitempty"`
-	ExistingClusterId      string                           `json:"existing_cluster_id,omitempty"`
-	Format                 string                           `json:"format,omitempty"`
-	Id                     string                           `json:"id,omitempty"`
-	MaxConcurrentRuns      int                              `json:"max_concurrent_runs,omitempty"`
-	MaxRetries             int                              `json:"max_retries,omitempty"`
-	MinRetryIntervalMillis int                              `json:"min_retry_interval_millis,omitempty"`
-	Name                   string                           `json:"name,omitempty"`
-	PerformanceTarget      string                           `json:"performance_target,omitempty"`
-	RetryOnTimeout         bool                             `json:"retry_on_timeout,omitempty"`
-	Tags                   map[string]string                `json:"tags,omitempty"`
-	TimeoutSeconds         int                              `json:"timeout_seconds,omitempty"`
-	Url                    string                           `json:"url,omitempty"`
-	UsagePolicyId          string                           `json:"usage_policy_id,omitempty"`
-	Continuous             *ResourceJobContinuous           `json:"continuous,omitempty"`
-	DbtTask                *ResourceJobDbtTask              `json:"dbt_task,omitempty"`
-	Deployment             *ResourceJobDeployment           `json:"deployment,omitempty"`
-	EmailNotifications     *ResourceJobEmailNotifications   `json:"email_notifications,omitempty"`
-	Environment            []ResourceJobEnvironment         `json:"environment,omitempty"`
-	GitSource              *ResourceJobGitSource            `json:"git_source,omitempty"`
-	Health                 *ResourceJobHealth               `json:"health,omitempty"`
-	JobCluster             []ResourceJobJobCluster          `json:"job_cluster,omitempty"`
-	Library                []ResourceJobLibrary             `json:"library,omitempty"`
-	NewCluster             *ResourceJobNewCluster           `json:"new_cluster,omitempty"`
-	NotebookTask           *ResourceJobNotebookTask         `json:"notebook_task,omitempty"`
-	NotificationSettings   *ResourceJobNotificationSettings `json:"notification_settings,omitempty"`
-	Parameter              []ResourceJobParameter           `json:"parameter,omitempty"`
-	PipelineTask           *ResourceJobPipelineTask         `json:"pipeline_task,omitempty"`
-	ProviderConfig         *ResourceJobProviderConfig       `json:"provider_config,omitempty"`
-	PythonWheelTask        *ResourceJobPythonWheelTask      `json:"python_wheel_task,omitempty"`
-	Queue                  *ResourceJobQueue                `json:"queue,omitempty"`
-	RunAs                  *ResourceJobRunAs                `json:"run_as,omitempty"`
-	RunJobTask             *ResourceJobRunJobTask           `json:"run_job_task,omitempty"`
-	Schedule               *ResourceJobSchedule             `json:"schedule,omitempty"`
-	SparkJarTask           *ResourceJobSparkJarTask         `json:"spark_jar_task,omitempty"`
-	SparkPythonTask        *ResourceJobSparkPythonTask      `json:"spark_python_task,omitempty"`
-	SparkSubmitTask        *ResourceJobSparkSubmitTask      `json:"spark_submit_task,omitempty"`
-	Task                   []ResourceJobTask                `json:"task,omitempty"`
-	Trigger                *ResourceJobTrigger              `json:"trigger,omitempty"`
-	WebhookNotifications   *ResourceJobWebhookNotifications `json:"webhook_notifications,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_knowledge_assistant.go b/bundle/internal/tf/schema/resource_knowledge_assistant.go
deleted file mode 100644
index 70da6ed0746..00000000000
--- a/bundle/internal/tf/schema/resource_knowledge_assistant.go
+++ /dev/null
@@ -1,22 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceKnowledgeAssistantProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceKnowledgeAssistant struct {
-	CreateTime     string                                    `json:"create_time,omitempty"`
-	Creator        string                                    `json:"creator,omitempty"`
-	Description    string                                    `json:"description"`
-	DisplayName    string                                    `json:"display_name"`
-	EndpointName   string                                    `json:"endpoint_name,omitempty"`
-	ErrorInfo      string                                    `json:"error_info,omitempty"`
-	ExperimentId   string                                    `json:"experiment_id,omitempty"`
-	Id             string                                    `json:"id,omitempty"`
-	Instructions   string                                    `json:"instructions,omitempty"`
-	Name           string                                    `json:"name,omitempty"`
-	ProviderConfig *ResourceKnowledgeAssistantProviderConfig `json:"provider_config,omitempty"`
-	State          string                                    `json:"state,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_knowledge_assistant_knowledge_source.go b/bundle/internal/tf/schema/resource_knowledge_assistant_knowledge_source.go
deleted file mode 100644
index e907554aa61..00000000000
--- a/bundle/internal/tf/schema/resource_knowledge_assistant_knowledge_source.go
+++ /dev/null
@@ -1,38 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceKnowledgeAssistantKnowledgeSourceFileTable struct {
-	FileCol   string `json:"file_col"`
-	TableName string `json:"table_name"`
-}
-
-type ResourceKnowledgeAssistantKnowledgeSourceFiles struct {
-	Path string `json:"path"`
-}
-
-type ResourceKnowledgeAssistantKnowledgeSourceIndex struct {
-	DocUriCol string `json:"doc_uri_col"`
-	IndexName string `json:"index_name"`
-	TextCol   string `json:"text_col"`
-}
-
-type ResourceKnowledgeAssistantKnowledgeSourceProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceKnowledgeAssistantKnowledgeSource struct {
-	CreateTime          string                                                   `json:"create_time,omitempty"`
-	Description         string                                                   `json:"description"`
-	DisplayName         string                                                   `json:"display_name"`
-	FileTable           *ResourceKnowledgeAssistantKnowledgeSourceFileTable      `json:"file_table,omitempty"`
-	Files               *ResourceKnowledgeAssistantKnowledgeSourceFiles          `json:"files,omitempty"`
-	Id                  string                                                   `json:"id,omitempty"`
-	Index               *ResourceKnowledgeAssistantKnowledgeSourceIndex          `json:"index,omitempty"`
-	KnowledgeCutoffTime string                                                   `json:"knowledge_cutoff_time,omitempty"`
-	Name                string                                                   `json:"name,omitempty"`
-	Parent              string                                                   `json:"parent"`
-	ProviderConfig      *ResourceKnowledgeAssistantKnowledgeSourceProviderConfig `json:"provider_config,omitempty"`
-	SourceType          string                                                   `json:"source_type"`
-	State               string                                                   `json:"state,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_lakehouse_monitor.go b/bundle/internal/tf/schema/resource_lakehouse_monitor.go
deleted file mode 100644
index 1c1c92edcdb..00000000000
--- a/bundle/internal/tf/schema/resource_lakehouse_monitor.go
+++ /dev/null
@@ -1,81 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceLakehouseMonitorCustomMetrics struct {
-	Definition     string   `json:"definition"`
-	InputColumns   []string `json:"input_columns"`
-	Name           string   `json:"name"`
-	OutputDataType string   `json:"output_data_type"`
-	Type           string   `json:"type"`
-}
-
-type ResourceLakehouseMonitorDataClassificationConfig struct {
-	Enabled bool `json:"enabled,omitempty"`
-}
-
-type ResourceLakehouseMonitorInferenceLog struct {
-	Granularities      []string `json:"granularities"`
-	LabelCol           string   `json:"label_col,omitempty"`
-	ModelIdCol         string   `json:"model_id_col"`
-	PredictionCol      string   `json:"prediction_col"`
-	PredictionProbaCol string   `json:"prediction_proba_col,omitempty"`
-	ProblemType        string   `json:"problem_type"`
-	TimestampCol       string   `json:"timestamp_col"`
-}
-
-type ResourceLakehouseMonitorNotificationsOnFailure struct {
-	EmailAddresses []string `json:"email_addresses,omitempty"`
-}
-
-type ResourceLakehouseMonitorNotificationsOnNewClassificationTagDetected struct {
-	EmailAddresses []string `json:"email_addresses,omitempty"`
-}
-
-type ResourceLakehouseMonitorNotifications struct {
-	OnFailure                      *ResourceLakehouseMonitorNotificationsOnFailure                      `json:"on_failure,omitempty"`
-	OnNewClassificationTagDetected *ResourceLakehouseMonitorNotificationsOnNewClassificationTagDetected `json:"on_new_classification_tag_detected,omitempty"`
-}
-
-type ResourceLakehouseMonitorProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceLakehouseMonitorSchedule struct {
-	PauseStatus          string `json:"pause_status,omitempty"`
-	QuartzCronExpression string `json:"quartz_cron_expression"`
-	TimezoneId           string `json:"timezone_id"`
-}
-
-type ResourceLakehouseMonitorSnapshot struct {
-}
-
-type ResourceLakehouseMonitorTimeSeries struct {
-	Granularities []string `json:"granularities"`
-	TimestampCol  string   `json:"timestamp_col"`
-}
-
-type ResourceLakehouseMonitor struct {
-	AssetsDir                string                                            `json:"assets_dir"`
-	BaselineTableName        string                                            `json:"baseline_table_name,omitempty"`
-	DashboardId              string                                            `json:"dashboard_id,omitempty"`
-	DriftMetricsTableName    string                                            `json:"drift_metrics_table_name,omitempty"`
-	Id                       string                                            `json:"id,omitempty"`
-	LatestMonitorFailureMsg  string                                            `json:"latest_monitor_failure_msg,omitempty"`
-	MonitorVersion           int                                               `json:"monitor_version,omitempty"`
-	OutputSchemaName         string                                            `json:"output_schema_name"`
-	ProfileMetricsTableName  string                                            `json:"profile_metrics_table_name,omitempty"`
-	SkipBuiltinDashboard     bool                                              `json:"skip_builtin_dashboard,omitempty"`
-	SlicingExprs             []string                                          `json:"slicing_exprs,omitempty"`
-	Status                   string                                            `json:"status,omitempty"`
-	TableName                string                                            `json:"table_name"`
-	WarehouseId              string                                            `json:"warehouse_id,omitempty"`
-	CustomMetrics            []ResourceLakehouseMonitorCustomMetrics           `json:"custom_metrics,omitempty"`
-	DataClassificationConfig *ResourceLakehouseMonitorDataClassificationConfig `json:"data_classification_config,omitempty"`
-	InferenceLog             *ResourceLakehouseMonitorInferenceLog             `json:"inference_log,omitempty"`
-	Notifications            *ResourceLakehouseMonitorNotifications            `json:"notifications,omitempty"`
-	ProviderConfig           *ResourceLakehouseMonitorProviderConfig           `json:"provider_config,omitempty"`
-	Schedule                 *ResourceLakehouseMonitorSchedule                 `json:"schedule,omitempty"`
-	Snapshot                 *ResourceLakehouseMonitorSnapshot                 `json:"snapshot,omitempty"`
-	TimeSeries               *ResourceLakehouseMonitorTimeSeries               `json:"time_series,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_library.go b/bundle/internal/tf/schema/resource_library.go
deleted file mode 100644
index 816718d3033..00000000000
--- a/bundle/internal/tf/schema/resource_library.go
+++ /dev/null
@@ -1,36 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceLibraryCran struct {
-	Package string `json:"package"`
-	Repo    string `json:"repo,omitempty"`
-}
-
-type ResourceLibraryMaven struct {
-	Coordinates string   `json:"coordinates"`
-	Exclusions  []string `json:"exclusions,omitempty"`
-	Repo        string   `json:"repo,omitempty"`
-}
-
-type ResourceLibraryProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceLibraryPypi struct {
-	Package string `json:"package"`
-	Repo    string `json:"repo,omitempty"`
-}
-
-type ResourceLibrary struct {
-	ClusterId      string                          `json:"cluster_id"`
-	Egg            string                          `json:"egg,omitempty"`
-	Id             string                          `json:"id,omitempty"`
-	Jar            string                          `json:"jar,omitempty"`
-	Requirements   string                          `json:"requirements,omitempty"`
-	Whl            string                          `json:"whl,omitempty"`
-	Cran           []ResourceLibraryCran           `json:"cran,omitempty"`
-	Maven          []ResourceLibraryMaven          `json:"maven,omitempty"`
-	ProviderConfig []ResourceLibraryProviderConfig `json:"provider_config,omitempty"`
-	Pypi           []ResourceLibraryPypi           `json:"pypi,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_materialized_features_feature_tag.go b/bundle/internal/tf/schema/resource_materialized_features_feature_tag.go
deleted file mode 100644
index 482fcdf0658..00000000000
--- a/bundle/internal/tf/schema/resource_materialized_features_feature_tag.go
+++ /dev/null
@@ -1,13 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceMaterializedFeaturesFeatureTagProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceMaterializedFeaturesFeatureTag struct {
-	Key            string                                                `json:"key"`
-	ProviderConfig *ResourceMaterializedFeaturesFeatureTagProviderConfig `json:"provider_config,omitempty"`
-	Value          string                                                `json:"value,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_metastore.go b/bundle/internal/tf/schema/resource_metastore.go
deleted file mode 100644
index 1fe6064fabe..00000000000
--- a/bundle/internal/tf/schema/resource_metastore.go
+++ /dev/null
@@ -1,33 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceMetastoreProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceMetastore struct {
-	Api                                         string                           `json:"api,omitempty"`
-	Cloud                                       string                           `json:"cloud,omitempty"`
-	CreatedAt                                   int                              `json:"created_at,omitempty"`
-	CreatedBy                                   string                           `json:"created_by,omitempty"`
-	DefaultDataAccessConfigId                   string                           `json:"default_data_access_config_id,omitempty"`
-	DeltaSharingOrganizationName                string                           `json:"delta_sharing_organization_name,omitempty"`
-	DeltaSharingRecipientTokenLifetimeInSeconds int                              `json:"delta_sharing_recipient_token_lifetime_in_seconds,omitempty"`
-	DeltaSharingScope                           string                           `json:"delta_sharing_scope,omitempty"`
-	ExternalAccessEnabled                       bool                             `json:"external_access_enabled,omitempty"`
-	ForceDestroy                                bool                             `json:"force_destroy,omitempty"`
-	GlobalMetastoreId                           string                           `json:"global_metastore_id,omitempty"`
-	Id                                          string                           `json:"id,omitempty"`
-	MetastoreId                                 string                           `json:"metastore_id,omitempty"`
-	Name                                        string                           `json:"name,omitempty"`
-	Owner                                       string                           `json:"owner,omitempty"`
-	PrivilegeModelVersion                       string                           `json:"privilege_model_version,omitempty"`
-	Region                                      string                           `json:"region,omitempty"`
-	StorageRoot                                 string                           `json:"storage_root,omitempty"`
-	StorageRootCredentialId                     string                           `json:"storage_root_credential_id,omitempty"`
-	StorageRootCredentialName                   string                           `json:"storage_root_credential_name,omitempty"`
-	UpdatedAt                                   int                              `json:"updated_at,omitempty"`
-	UpdatedBy                                   string                           `json:"updated_by,omitempty"`
-	ProviderConfig                              *ResourceMetastoreProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_metastore_assignment.go b/bundle/internal/tf/schema/resource_metastore_assignment.go
deleted file mode 100644
index 2127c1cec01..00000000000
--- a/bundle/internal/tf/schema/resource_metastore_assignment.go
+++ /dev/null
@@ -1,16 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceMetastoreAssignmentProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceMetastoreAssignment struct {
-	Api                string                                     `json:"api,omitempty"`
-	DefaultCatalogName string                                     `json:"default_catalog_name,omitempty"`
-	Id                 string                                     `json:"id,omitempty"`
-	MetastoreId        string                                     `json:"metastore_id"`
-	WorkspaceId        int                                        `json:"workspace_id"`
-	ProviderConfig     *ResourceMetastoreAssignmentProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_metastore_data_access.go b/bundle/internal/tf/schema/resource_metastore_data_access.go
deleted file mode 100644
index 7c79c665ef5..00000000000
--- a/bundle/internal/tf/schema/resource_metastore_data_access.go
+++ /dev/null
@@ -1,64 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceMetastoreDataAccessAwsIamRole struct {
-	ExternalId         string `json:"external_id,omitempty"`
-	RoleArn            string `json:"role_arn"`
-	UnityCatalogIamArn string `json:"unity_catalog_iam_arn,omitempty"`
-}
-
-type ResourceMetastoreDataAccessAzureManagedIdentity struct {
-	AccessConnectorId string `json:"access_connector_id"`
-	CredentialId      string `json:"credential_id,omitempty"`
-	ManagedIdentityId string `json:"managed_identity_id,omitempty"`
-}
-
-type ResourceMetastoreDataAccessAzureServicePrincipal struct {
-	ApplicationId string `json:"application_id"`
-	ClientSecret  string `json:"client_secret"`
-	DirectoryId   string `json:"directory_id"`
-}
-
-type ResourceMetastoreDataAccessCloudflareApiToken struct {
-	AccessKeyId     string `json:"access_key_id"`
-	AccountId       string `json:"account_id"`
-	SecretAccessKey string `json:"secret_access_key"`
-}
-
-type ResourceMetastoreDataAccessDatabricksGcpServiceAccount struct {
-	CredentialId string `json:"credential_id,omitempty"`
-	Email        string `json:"email,omitempty"`
-}
-
-type ResourceMetastoreDataAccessGcpServiceAccountKey struct {
-	Email        string `json:"email"`
-	PrivateKey   string `json:"private_key"`
-	PrivateKeyId string `json:"private_key_id"`
-}
-
-type ResourceMetastoreDataAccessProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceMetastoreDataAccess struct {
-	Api                         string                                                  `json:"api,omitempty"`
-	Comment                     string                                                  `json:"comment,omitempty"`
-	ForceDestroy                bool                                                    `json:"force_destroy,omitempty"`
-	ForceUpdate                 bool                                                    `json:"force_update,omitempty"`
-	Id                          string                                                  `json:"id,omitempty"`
-	IsDefault                   bool                                                    `json:"is_default,omitempty"`
-	IsolationMode               string                                                  `json:"isolation_mode,omitempty"`
-	MetastoreId                 string                                                  `json:"metastore_id,omitempty"`
-	Name                        string                                                  `json:"name"`
-	Owner                       string                                                  `json:"owner,omitempty"`
-	ReadOnly                    bool                                                    `json:"read_only,omitempty"`
-	SkipValidation              bool                                                    `json:"skip_validation,omitempty"`
-	AwsIamRole                  *ResourceMetastoreDataAccessAwsIamRole                  `json:"aws_iam_role,omitempty"`
-	AzureManagedIdentity        *ResourceMetastoreDataAccessAzureManagedIdentity        `json:"azure_managed_identity,omitempty"`
-	AzureServicePrincipal       *ResourceMetastoreDataAccessAzureServicePrincipal       `json:"azure_service_principal,omitempty"`
-	CloudflareApiToken          *ResourceMetastoreDataAccessCloudflareApiToken          `json:"cloudflare_api_token,omitempty"`
-	DatabricksGcpServiceAccount *ResourceMetastoreDataAccessDatabricksGcpServiceAccount `json:"databricks_gcp_service_account,omitempty"`
-	GcpServiceAccountKey        *ResourceMetastoreDataAccessGcpServiceAccountKey        `json:"gcp_service_account_key,omitempty"`
-	ProviderConfig              *ResourceMetastoreDataAccessProviderConfig              `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_mlflow_experiment.go b/bundle/internal/tf/schema/resource_mlflow_experiment.go
deleted file mode 100644
index b6a20dd7ad5..00000000000
--- a/bundle/internal/tf/schema/resource_mlflow_experiment.go
+++ /dev/null
@@ -1,25 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceMlflowExperimentProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceMlflowExperimentTags struct {
-	Key   string `json:"key,omitempty"`
-	Value string `json:"value,omitempty"`
-}
-
-type ResourceMlflowExperiment struct {
-	ArtifactLocation string                                  `json:"artifact_location,omitempty"`
-	CreationTime     int                                     `json:"creation_time,omitempty"`
-	Description      string                                  `json:"description,omitempty"`
-	ExperimentId     string                                  `json:"experiment_id,omitempty"`
-	Id               string                                  `json:"id,omitempty"`
-	LastUpdateTime   int                                     `json:"last_update_time,omitempty"`
-	LifecycleStage   string                                  `json:"lifecycle_stage,omitempty"`
-	Name             string                                  `json:"name"`
-	ProviderConfig   *ResourceMlflowExperimentProviderConfig `json:"provider_config,omitempty"`
-	Tags             []ResourceMlflowExperimentTags          `json:"tags,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_mlflow_model.go b/bundle/internal/tf/schema/resource_mlflow_model.go
deleted file mode 100644
index 44d9f557c2f..00000000000
--- a/bundle/internal/tf/schema/resource_mlflow_model.go
+++ /dev/null
@@ -1,21 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceMlflowModelProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceMlflowModelTags struct {
-	Key   string `json:"key,omitempty"`
-	Value string `json:"value,omitempty"`
-}
-
-type ResourceMlflowModel struct {
-	Description       string                             `json:"description,omitempty"`
-	Id                string                             `json:"id,omitempty"`
-	Name              string                             `json:"name"`
-	RegisteredModelId string                             `json:"registered_model_id,omitempty"`
-	ProviderConfig    *ResourceMlflowModelProviderConfig `json:"provider_config,omitempty"`
-	Tags              []ResourceMlflowModelTags          `json:"tags,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_mlflow_webhook.go b/bundle/internal/tf/schema/resource_mlflow_webhook.go
deleted file mode 100644
index bd69b1aba7a..00000000000
--- a/bundle/internal/tf/schema/resource_mlflow_webhook.go
+++ /dev/null
@@ -1,31 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceMlflowWebhookHttpUrlSpec struct {
-	Authorization         string `json:"authorization,omitempty"`
-	EnableSslVerification bool   `json:"enable_ssl_verification,omitempty"`
-	Secret                string `json:"secret,omitempty"`
-	Url                   string `json:"url"`
-}
-
-type ResourceMlflowWebhookJobSpec struct {
-	AccessToken  string `json:"access_token"`
-	JobId        string `json:"job_id"`
-	WorkspaceUrl string `json:"workspace_url,omitempty"`
-}
-
-type ResourceMlflowWebhookProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceMlflowWebhook struct {
-	Description    string                               `json:"description,omitempty"`
-	Events         []string                             `json:"events"`
-	Id             string                               `json:"id,omitempty"`
-	ModelName      string                               `json:"model_name,omitempty"`
-	Status         string                               `json:"status,omitempty"`
-	HttpUrlSpec    *ResourceMlflowWebhookHttpUrlSpec    `json:"http_url_spec,omitempty"`
-	JobSpec        *ResourceMlflowWebhookJobSpec        `json:"job_spec,omitempty"`
-	ProviderConfig *ResourceMlflowWebhookProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_model_serving.go b/bundle/internal/tf/schema/resource_model_serving.go
deleted file mode 100644
index 58ad4b0c977..00000000000
--- a/bundle/internal/tf/schema/resource_model_serving.go
+++ /dev/null
@@ -1,246 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceModelServingAiGatewayFallbackConfig struct {
-	Enabled bool `json:"enabled"`
-}
-
-type ResourceModelServingAiGatewayGuardrailsInputPii struct {
-	Behavior string `json:"behavior,omitempty"`
-}
-
-type ResourceModelServingAiGatewayGuardrailsInput struct {
-	InvalidKeywords []string                                         `json:"invalid_keywords,omitempty"`
-	Safety          bool                                             `json:"safety,omitempty"`
-	ValidTopics     []string                                         `json:"valid_topics,omitempty"`
-	Pii             *ResourceModelServingAiGatewayGuardrailsInputPii `json:"pii,omitempty"`
-}
-
-type ResourceModelServingAiGatewayGuardrailsOutputPii struct {
-	Behavior string `json:"behavior,omitempty"`
-}
-
-type ResourceModelServingAiGatewayGuardrailsOutput struct {
-	InvalidKeywords []string                                          `json:"invalid_keywords,omitempty"`
-	Safety          bool                                              `json:"safety,omitempty"`
-	ValidTopics     []string                                          `json:"valid_topics,omitempty"`
-	Pii             *ResourceModelServingAiGatewayGuardrailsOutputPii `json:"pii,omitempty"`
-}
-
-type ResourceModelServingAiGatewayGuardrails struct {
-	Input  *ResourceModelServingAiGatewayGuardrailsInput  `json:"input,omitempty"`
-	Output *ResourceModelServingAiGatewayGuardrailsOutput `json:"output,omitempty"`
-}
-
-type ResourceModelServingAiGatewayInferenceTableConfig struct {
-	CatalogName     string `json:"catalog_name,omitempty"`
-	Enabled         bool   `json:"enabled,omitempty"`
-	SchemaName      string `json:"schema_name,omitempty"`
-	TableNamePrefix string `json:"table_name_prefix,omitempty"`
-}
-
-type ResourceModelServingAiGatewayRateLimits struct {
-	Calls         int    `json:"calls,omitempty"`
-	Key           string `json:"key,omitempty"`
-	Principal     string `json:"principal,omitempty"`
-	RenewalPeriod string `json:"renewal_period"`
-	Tokens        int    `json:"tokens,omitempty"`
-}
-
-type ResourceModelServingAiGatewayUsageTrackingConfig struct {
-	Enabled bool `json:"enabled,omitempty"`
-}
-
-type ResourceModelServingAiGateway struct {
-	FallbackConfig       *ResourceModelServingAiGatewayFallbackConfig       `json:"fallback_config,omitempty"`
-	Guardrails           *ResourceModelServingAiGatewayGuardrails           `json:"guardrails,omitempty"`
-	InferenceTableConfig *ResourceModelServingAiGatewayInferenceTableConfig `json:"inference_table_config,omitempty"`
-	RateLimits           []ResourceModelServingAiGatewayRateLimits          `json:"rate_limits,omitempty"`
-	UsageTrackingConfig  *ResourceModelServingAiGatewayUsageTrackingConfig  `json:"usage_tracking_config,omitempty"`
-}
-
-type ResourceModelServingConfigAutoCaptureConfig struct {
-	CatalogName     string `json:"catalog_name,omitempty"`
-	Enabled         bool   `json:"enabled,omitempty"`
-	SchemaName      string `json:"schema_name,omitempty"`
-	TableNamePrefix string `json:"table_name_prefix,omitempty"`
-}
-
-type ResourceModelServingConfigServedEntitiesExternalModelAi21LabsConfig struct {
-	Ai21LabsApiKey          string `json:"ai21labs_api_key,omitempty"`
-	Ai21LabsApiKeyPlaintext string `json:"ai21labs_api_key_plaintext,omitempty"`
-}
-
-type ResourceModelServingConfigServedEntitiesExternalModelAmazonBedrockConfig struct {
-	AwsAccessKeyId              string `json:"aws_access_key_id,omitempty"`
-	AwsAccessKeyIdPlaintext     string `json:"aws_access_key_id_plaintext,omitempty"`
-	AwsRegion                   string `json:"aws_region"`
-	AwsSecretAccessKey          string `json:"aws_secret_access_key,omitempty"`
-	AwsSecretAccessKeyPlaintext string `json:"aws_secret_access_key_plaintext,omitempty"`
-	BedrockProvider             string `json:"bedrock_provider"`
-	InstanceProfileArn          string `json:"instance_profile_arn,omitempty"`
-}
-
-type ResourceModelServingConfigServedEntitiesExternalModelAnthropicConfig struct {
-	AnthropicApiKey          string `json:"anthropic_api_key,omitempty"`
-	AnthropicApiKeyPlaintext string `json:"anthropic_api_key_plaintext,omitempty"`
-}
-
-type ResourceModelServingConfigServedEntitiesExternalModelCohereConfig struct {
-	CohereApiBase         string `json:"cohere_api_base,omitempty"`
-	CohereApiKey          string `json:"cohere_api_key,omitempty"`
-	CohereApiKeyPlaintext string `json:"cohere_api_key_plaintext,omitempty"`
-}
-
-type ResourceModelServingConfigServedEntitiesExternalModelCustomProviderConfigApiKeyAuth struct {
-	Key            string `json:"key"`
-	Value          string `json:"value,omitempty"`
-	ValuePlaintext string `json:"value_plaintext,omitempty"`
-}
-
-type ResourceModelServingConfigServedEntitiesExternalModelCustomProviderConfigBearerTokenAuth struct {
-	Token          string `json:"token,omitempty"`
-	TokenPlaintext string `json:"token_plaintext,omitempty"`
-}
-
-type ResourceModelServingConfigServedEntitiesExternalModelCustomProviderConfig struct {
-	CustomProviderUrl string                                                                                    `json:"custom_provider_url"`
-	ApiKeyAuth        *ResourceModelServingConfigServedEntitiesExternalModelCustomProviderConfigApiKeyAuth      `json:"api_key_auth,omitempty"`
-	BearerTokenAuth   *ResourceModelServingConfigServedEntitiesExternalModelCustomProviderConfigBearerTokenAuth `json:"bearer_token_auth,omitempty"`
-}
-
-type ResourceModelServingConfigServedEntitiesExternalModelDatabricksModelServingConfig struct {
-	DatabricksApiToken          string `json:"databricks_api_token,omitempty"`
-	DatabricksApiTokenPlaintext string `json:"databricks_api_token_plaintext,omitempty"`
-	DatabricksWorkspaceUrl      string `json:"databricks_workspace_url"`
-}
-
-type ResourceModelServingConfigServedEntitiesExternalModelGoogleCloudVertexAiConfig struct {
-	PrivateKey          string `json:"private_key,omitempty"`
-	PrivateKeyPlaintext string `json:"private_key_plaintext,omitempty"`
-	ProjectId           string `json:"project_id"`
-	Region              string `json:"region"`
-}
-
-type ResourceModelServingConfigServedEntitiesExternalModelOpenaiConfig struct {
-	MicrosoftEntraClientId              string `json:"microsoft_entra_client_id,omitempty"`
-	MicrosoftEntraClientSecret          string `json:"microsoft_entra_client_secret,omitempty"`
-	MicrosoftEntraClientSecretPlaintext string `json:"microsoft_entra_client_secret_plaintext,omitempty"`
-	MicrosoftEntraTenantId              string `json:"microsoft_entra_tenant_id,omitempty"`
-	OpenaiApiBase                       string `json:"openai_api_base,omitempty"`
-	OpenaiApiKey                        string `json:"openai_api_key,omitempty"`
-	OpenaiApiKeyPlaintext               string `json:"openai_api_key_plaintext,omitempty"`
-	OpenaiApiType                       string `json:"openai_api_type,omitempty"`
-	OpenaiApiVersion                    string `json:"openai_api_version,omitempty"`
-	OpenaiDeploymentName                string `json:"openai_deployment_name,omitempty"`
-	OpenaiOrganization                  string `json:"openai_organization,omitempty"`
-}
-
-type ResourceModelServingConfigServedEntitiesExternalModelPalmConfig struct {
-	PalmApiKey          string `json:"palm_api_key,omitempty"`
-	PalmApiKeyPlaintext string `json:"palm_api_key_plaintext,omitempty"`
-}
-
-type ResourceModelServingConfigServedEntitiesExternalModel struct {
-	Name                         string                                                                             `json:"name"`
-	Provider                     string                                                                             `json:"provider"`
-	Task                         string                                                                             `json:"task"`
-	Ai21LabsConfig               *ResourceModelServingConfigServedEntitiesExternalModelAi21LabsConfig               `json:"ai21labs_config,omitempty"`
-	AmazonBedrockConfig          *ResourceModelServingConfigServedEntitiesExternalModelAmazonBedrockConfig          `json:"amazon_bedrock_config,omitempty"`
-	AnthropicConfig              *ResourceModelServingConfigServedEntitiesExternalModelAnthropicConfig              `json:"anthropic_config,omitempty"`
-	CohereConfig                 *ResourceModelServingConfigServedEntitiesExternalModelCohereConfig                 `json:"cohere_config,omitempty"`
-	CustomProviderConfig         *ResourceModelServingConfigServedEntitiesExternalModelCustomProviderConfig         `json:"custom_provider_config,omitempty"`
-	DatabricksModelServingConfig *ResourceModelServingConfigServedEntitiesExternalModelDatabricksModelServingConfig `json:"databricks_model_serving_config,omitempty"`
-	GoogleCloudVertexAiConfig    *ResourceModelServingConfigServedEntitiesExternalModelGoogleCloudVertexAiConfig    `json:"google_cloud_vertex_ai_config,omitempty"`
-	OpenaiConfig                 *ResourceModelServingConfigServedEntitiesExternalModelOpenaiConfig                 `json:"openai_config,omitempty"`
-	PalmConfig                   *ResourceModelServingConfigServedEntitiesExternalModelPalmConfig                   `json:"palm_config,omitempty"`
-}
-
-type ResourceModelServingConfigServedEntities struct {
-	BurstScalingEnabled       bool                                                   `json:"burst_scaling_enabled,omitempty"`
-	EntityName                string                                                 `json:"entity_name,omitempty"`
-	EntityVersion             string                                                 `json:"entity_version,omitempty"`
-	EnvironmentVars           map[string]string                                      `json:"environment_vars,omitempty"`
-	InstanceProfileArn        string                                                 `json:"instance_profile_arn,omitempty"`
-	MaxProvisionedConcurrency int                                                    `json:"max_provisioned_concurrency,omitempty"`
-	MaxProvisionedThroughput  int                                                    `json:"max_provisioned_throughput,omitempty"`
-	MinProvisionedConcurrency int                                                    `json:"min_provisioned_concurrency,omitempty"`
-	MinProvisionedThroughput  int                                                    `json:"min_provisioned_throughput,omitempty"`
-	Name                      string                                                 `json:"name,omitempty"`
-	ProvisionedModelUnits     int                                                    `json:"provisioned_model_units,omitempty"`
-	ScaleToZeroEnabled        bool                                                   `json:"scale_to_zero_enabled,omitempty"`
-	WorkloadSize              string                                                 `json:"workload_size,omitempty"`
-	WorkloadType              string                                                 `json:"workload_type,omitempty"`
-	ExternalModel             *ResourceModelServingConfigServedEntitiesExternalModel `json:"external_model,omitempty"`
-}
-
-type ResourceModelServingConfigServedModels struct {
-	BurstScalingEnabled       bool              `json:"burst_scaling_enabled,omitempty"`
-	EnvironmentVars           map[string]string `json:"environment_vars,omitempty"`
-	InstanceProfileArn        string            `json:"instance_profile_arn,omitempty"`
-	MaxProvisionedConcurrency int               `json:"max_provisioned_concurrency,omitempty"`
-	MaxProvisionedThroughput  int               `json:"max_provisioned_throughput,omitempty"`
-	MinProvisionedConcurrency int               `json:"min_provisioned_concurrency,omitempty"`
-	MinProvisionedThroughput  int               `json:"min_provisioned_throughput,omitempty"`
-	ModelName                 string            `json:"model_name"`
-	ModelVersion              string            `json:"model_version"`
-	Name                      string            `json:"name,omitempty"`
-	ProvisionedModelUnits     int               `json:"provisioned_model_units,omitempty"`
-	ScaleToZeroEnabled        bool              `json:"scale_to_zero_enabled,omitempty"`
-	WorkloadSize              string            `json:"workload_size,omitempty"`
-	WorkloadType              string            `json:"workload_type,omitempty"`
-}
-
-type ResourceModelServingConfigTrafficConfigRoutes struct {
-	ServedEntityName  string `json:"served_entity_name,omitempty"`
-	ServedModelName   string `json:"served_model_name,omitempty"`
-	TrafficPercentage int    `json:"traffic_percentage"`
-}
-
-type ResourceModelServingConfigTrafficConfig struct {
-	Routes []ResourceModelServingConfigTrafficConfigRoutes `json:"routes,omitempty"`
-}
-
-type ResourceModelServingConfig struct {
-	AutoCaptureConfig *ResourceModelServingConfigAutoCaptureConfig `json:"auto_capture_config,omitempty"`
-	ServedEntities    []ResourceModelServingConfigServedEntities   `json:"served_entities,omitempty"`
-	ServedModels      []ResourceModelServingConfigServedModels     `json:"served_models,omitempty"`
-	TrafficConfig     *ResourceModelServingConfigTrafficConfig     `json:"traffic_config,omitempty"`
-}
-
-type ResourceModelServingEmailNotifications struct {
-	OnUpdateFailure []string `json:"on_update_failure,omitempty"`
-	OnUpdateSuccess []string `json:"on_update_success,omitempty"`
-}
-
-type ResourceModelServingProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceModelServingRateLimits struct {
-	Calls         int    `json:"calls"`
-	Key           string `json:"key,omitempty"`
-	RenewalPeriod string `json:"renewal_period"`
-}
-
-type ResourceModelServingTags struct {
-	Key   string `json:"key"`
-	Value string `json:"value,omitempty"`
-}
-
-type ResourceModelServing struct {
-	BudgetPolicyId     string                                  `json:"budget_policy_id,omitempty"`
-	Description        string                                  `json:"description,omitempty"`
-	EndpointUrl        string                                  `json:"endpoint_url,omitempty"`
-	Id                 string                                  `json:"id,omitempty"`
-	Name               string                                  `json:"name"`
-	RouteOptimized     bool                                    `json:"route_optimized,omitempty"`
-	ServingEndpointId  string                                  `json:"serving_endpoint_id,omitempty"`
-	AiGateway          *ResourceModelServingAiGateway          `json:"ai_gateway,omitempty"`
-	Config             *ResourceModelServingConfig             `json:"config,omitempty"`
-	EmailNotifications *ResourceModelServingEmailNotifications `json:"email_notifications,omitempty"`
-	ProviderConfig     *ResourceModelServingProviderConfig     `json:"provider_config,omitempty"`
-	RateLimits         []ResourceModelServingRateLimits        `json:"rate_limits,omitempty"`
-	Tags               []ResourceModelServingTags              `json:"tags,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_model_serving_provisioned_throughput.go b/bundle/internal/tf/schema/resource_model_serving_provisioned_throughput.go
deleted file mode 100644
index 0b226efdd67..00000000000
--- a/bundle/internal/tf/schema/resource_model_serving_provisioned_throughput.go
+++ /dev/null
@@ -1,110 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceModelServingProvisionedThroughputAiGatewayFallbackConfig struct {
-	Enabled bool `json:"enabled"`
-}
-
-type ResourceModelServingProvisionedThroughputAiGatewayGuardrailsInputPii struct {
-	Behavior string `json:"behavior,omitempty"`
-}
-
-type ResourceModelServingProvisionedThroughputAiGatewayGuardrailsInput struct {
-	InvalidKeywords []string                                                              `json:"invalid_keywords,omitempty"`
-	Safety          bool                                                                  `json:"safety,omitempty"`
-	ValidTopics     []string                                                              `json:"valid_topics,omitempty"`
-	Pii             *ResourceModelServingProvisionedThroughputAiGatewayGuardrailsInputPii `json:"pii,omitempty"`
-}
-
-type ResourceModelServingProvisionedThroughputAiGatewayGuardrailsOutputPii struct {
-	Behavior string `json:"behavior,omitempty"`
-}
-
-type ResourceModelServingProvisionedThroughputAiGatewayGuardrailsOutput struct {
-	InvalidKeywords []string                                                               `json:"invalid_keywords,omitempty"`
-	Safety          bool                                                                   `json:"safety,omitempty"`
-	ValidTopics     []string                                                               `json:"valid_topics,omitempty"`
-	Pii             *ResourceModelServingProvisionedThroughputAiGatewayGuardrailsOutputPii `json:"pii,omitempty"`
-}
-
-type ResourceModelServingProvisionedThroughputAiGatewayGuardrails struct {
-	Input  *ResourceModelServingProvisionedThroughputAiGatewayGuardrailsInput  `json:"input,omitempty"`
-	Output *ResourceModelServingProvisionedThroughputAiGatewayGuardrailsOutput `json:"output,omitempty"`
-}
-
-type ResourceModelServingProvisionedThroughputAiGatewayInferenceTableConfig struct {
-	CatalogName     string `json:"catalog_name,omitempty"`
-	Enabled         bool   `json:"enabled,omitempty"`
-	SchemaName      string `json:"schema_name,omitempty"`
-	TableNamePrefix string `json:"table_name_prefix,omitempty"`
-}
-
-type ResourceModelServingProvisionedThroughputAiGatewayRateLimits struct {
-	Calls         int    `json:"calls,omitempty"`
-	Key           string `json:"key,omitempty"`
-	Principal     string `json:"principal,omitempty"`
-	RenewalPeriod string `json:"renewal_period"`
-	Tokens        int    `json:"tokens,omitempty"`
-}
-
-type ResourceModelServingProvisionedThroughputAiGatewayUsageTrackingConfig struct {
-	Enabled bool `json:"enabled,omitempty"`
-}
-
-type ResourceModelServingProvisionedThroughputAiGateway struct {
-	FallbackConfig       *ResourceModelServingProvisionedThroughputAiGatewayFallbackConfig       `json:"fallback_config,omitempty"`
-	Guardrails           *ResourceModelServingProvisionedThroughputAiGatewayGuardrails           `json:"guardrails,omitempty"`
-	InferenceTableConfig *ResourceModelServingProvisionedThroughputAiGatewayInferenceTableConfig `json:"inference_table_config,omitempty"`
-	RateLimits           []ResourceModelServingProvisionedThroughputAiGatewayRateLimits          `json:"rate_limits,omitempty"`
-	UsageTrackingConfig  *ResourceModelServingProvisionedThroughputAiGatewayUsageTrackingConfig  `json:"usage_tracking_config,omitempty"`
-}
-
-type ResourceModelServingProvisionedThroughputConfigServedEntities struct {
-	BurstScalingEnabled   bool   `json:"burst_scaling_enabled,omitempty"`
-	EntityName            string `json:"entity_name"`
-	EntityVersion         string `json:"entity_version"`
-	Name                  string `json:"name,omitempty"`
-	ProvisionedModelUnits int    `json:"provisioned_model_units"`
-}
-
-type ResourceModelServingProvisionedThroughputConfigTrafficConfigRoutes struct {
-	ServedEntityName  string `json:"served_entity_name,omitempty"`
-	ServedModelName   string `json:"served_model_name,omitempty"`
-	TrafficPercentage int    `json:"traffic_percentage"`
-}
-
-type ResourceModelServingProvisionedThroughputConfigTrafficConfig struct {
-	Routes []ResourceModelServingProvisionedThroughputConfigTrafficConfigRoutes `json:"routes,omitempty"`
-}
-
-type ResourceModelServingProvisionedThroughputConfig struct {
-	ServedEntities []ResourceModelServingProvisionedThroughputConfigServedEntities `json:"served_entities,omitempty"`
-	TrafficConfig  *ResourceModelServingProvisionedThroughputConfigTrafficConfig   `json:"traffic_config,omitempty"`
-}
-
-type ResourceModelServingProvisionedThroughputEmailNotifications struct {
-	OnUpdateFailure []string `json:"on_update_failure,omitempty"`
-	OnUpdateSuccess []string `json:"on_update_success,omitempty"`
-}
-
-type ResourceModelServingProvisionedThroughputProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceModelServingProvisionedThroughputTags struct {
-	Key   string `json:"key"`
-	Value string `json:"value,omitempty"`
-}
-
-type ResourceModelServingProvisionedThroughput struct {
-	BudgetPolicyId     string                                                       `json:"budget_policy_id,omitempty"`
-	Id                 string                                                       `json:"id,omitempty"`
-	Name               string                                                       `json:"name"`
-	ServingEndpointId  string                                                       `json:"serving_endpoint_id,omitempty"`
-	AiGateway          *ResourceModelServingProvisionedThroughputAiGateway          `json:"ai_gateway,omitempty"`
-	Config             *ResourceModelServingProvisionedThroughputConfig             `json:"config,omitempty"`
-	EmailNotifications *ResourceModelServingProvisionedThroughputEmailNotifications `json:"email_notifications,omitempty"`
-	ProviderConfig     *ResourceModelServingProvisionedThroughputProviderConfig     `json:"provider_config,omitempty"`
-	Tags               []ResourceModelServingProvisionedThroughputTags              `json:"tags,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_mount.go b/bundle/internal/tf/schema/resource_mount.go
deleted file mode 100644
index d1220b03b37..00000000000
--- a/bundle/internal/tf/schema/resource_mount.go
+++ /dev/null
@@ -1,64 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceMountAbfs struct {
-	ClientId             string `json:"client_id"`
-	ClientSecretKey      string `json:"client_secret_key"`
-	ClientSecretScope    string `json:"client_secret_scope"`
-	ContainerName        string `json:"container_name,omitempty"`
-	Directory            string `json:"directory,omitempty"`
-	InitializeFileSystem bool   `json:"initialize_file_system"`
-	StorageAccountName   string `json:"storage_account_name,omitempty"`
-	TenantId             string `json:"tenant_id,omitempty"`
-}
-
-type ResourceMountAdl struct {
-	ClientId            string `json:"client_id"`
-	ClientSecretKey     string `json:"client_secret_key"`
-	ClientSecretScope   string `json:"client_secret_scope"`
-	Directory           string `json:"directory,omitempty"`
-	SparkConfPrefix     string `json:"spark_conf_prefix,omitempty"`
-	StorageResourceName string `json:"storage_resource_name,omitempty"`
-	TenantId            string `json:"tenant_id,omitempty"`
-}
-
-type ResourceMountGs struct {
-	BucketName     string `json:"bucket_name"`
-	ServiceAccount string `json:"service_account,omitempty"`
-}
-
-type ResourceMountProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceMountS3 struct {
-	BucketName      string `json:"bucket_name"`
-	InstanceProfile string `json:"instance_profile,omitempty"`
-}
-
-type ResourceMountWasb struct {
-	AuthType           string `json:"auth_type"`
-	ContainerName      string `json:"container_name,omitempty"`
-	Directory          string `json:"directory,omitempty"`
-	StorageAccountName string `json:"storage_account_name,omitempty"`
-	TokenSecretKey     string `json:"token_secret_key"`
-	TokenSecretScope   string `json:"token_secret_scope"`
-}
-
-type ResourceMount struct {
-	ClusterId      string                       `json:"cluster_id,omitempty"`
-	EncryptionType string                       `json:"encryption_type,omitempty"`
-	ExtraConfigs   map[string]string            `json:"extra_configs,omitempty"`
-	Id             string                       `json:"id,omitempty"`
-	Name           string                       `json:"name,omitempty"`
-	ResourceId     string                       `json:"resource_id,omitempty"`
-	Source         string                       `json:"source,omitempty"`
-	Uri            string                       `json:"uri,omitempty"`
-	Abfs           *ResourceMountAbfs           `json:"abfs,omitempty"`
-	Adl            *ResourceMountAdl            `json:"adl,omitempty"`
-	Gs             *ResourceMountGs             `json:"gs,omitempty"`
-	ProviderConfig *ResourceMountProviderConfig `json:"provider_config,omitempty"`
-	S3             *ResourceMountS3             `json:"s3,omitempty"`
-	Wasb           *ResourceMountWasb           `json:"wasb,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_mws_credentials.go b/bundle/internal/tf/schema/resource_mws_credentials.go
deleted file mode 100644
index 859663ed363..00000000000
--- a/bundle/internal/tf/schema/resource_mws_credentials.go
+++ /dev/null
@@ -1,13 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceMwsCredentials struct {
-	AccountId       string `json:"account_id,omitempty"`
-	CreationTime    int    `json:"creation_time,omitempty"`
-	CredentialsId   string `json:"credentials_id,omitempty"`
-	CredentialsName string `json:"credentials_name"`
-	ExternalId      string `json:"external_id,omitempty"`
-	Id              string `json:"id,omitempty"`
-	RoleArn         string `json:"role_arn"`
-}
diff --git a/bundle/internal/tf/schema/resource_mws_customer_managed_keys.go b/bundle/internal/tf/schema/resource_mws_customer_managed_keys.go
deleted file mode 100644
index 411602b5346..00000000000
--- a/bundle/internal/tf/schema/resource_mws_customer_managed_keys.go
+++ /dev/null
@@ -1,23 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceMwsCustomerManagedKeysAwsKeyInfo struct {
-	KeyAlias  string `json:"key_alias,omitempty"`
-	KeyArn    string `json:"key_arn"`
-	KeyRegion string `json:"key_region,omitempty"`
-}
-
-type ResourceMwsCustomerManagedKeysGcpKeyInfo struct {
-	KmsKeyId string `json:"kms_key_id"`
-}
-
-type ResourceMwsCustomerManagedKeys struct {
-	AccountId            string                                    `json:"account_id"`
-	CreationTime         int                                       `json:"creation_time,omitempty"`
-	CustomerManagedKeyId string                                    `json:"customer_managed_key_id,omitempty"`
-	Id                   string                                    `json:"id,omitempty"`
-	UseCases             []string                                  `json:"use_cases"`
-	AwsKeyInfo           *ResourceMwsCustomerManagedKeysAwsKeyInfo `json:"aws_key_info,omitempty"`
-	GcpKeyInfo           *ResourceMwsCustomerManagedKeysGcpKeyInfo `json:"gcp_key_info,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_mws_log_delivery.go b/bundle/internal/tf/schema/resource_mws_log_delivery.go
deleted file mode 100644
index 80d0e680055..00000000000
--- a/bundle/internal/tf/schema/resource_mws_log_delivery.go
+++ /dev/null
@@ -1,18 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceMwsLogDelivery struct {
-	AccountId              string `json:"account_id"`
-	ConfigId               string `json:"config_id,omitempty"`
-	ConfigName             string `json:"config_name,omitempty"`
-	CredentialsId          string `json:"credentials_id"`
-	DeliveryPathPrefix     string `json:"delivery_path_prefix,omitempty"`
-	DeliveryStartTime      string `json:"delivery_start_time,omitempty"`
-	Id                     string `json:"id,omitempty"`
-	LogType                string `json:"log_type"`
-	OutputFormat           string `json:"output_format"`
-	Status                 string `json:"status,omitempty"`
-	StorageConfigurationId string `json:"storage_configuration_id"`
-	WorkspaceIdsFilter     []int  `json:"workspace_ids_filter,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_mws_ncc_binding.go b/bundle/internal/tf/schema/resource_mws_ncc_binding.go
deleted file mode 100644
index 8beafb6f543..00000000000
--- a/bundle/internal/tf/schema/resource_mws_ncc_binding.go
+++ /dev/null
@@ -1,9 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceMwsNccBinding struct {
-	Id                          string `json:"id,omitempty"`
-	NetworkConnectivityConfigId string `json:"network_connectivity_config_id"`
-	WorkspaceId                 int    `json:"workspace_id"`
-}
diff --git a/bundle/internal/tf/schema/resource_mws_ncc_private_endpoint_rule.go b/bundle/internal/tf/schema/resource_mws_ncc_private_endpoint_rule.go
deleted file mode 100644
index dd35f714b8b..00000000000
--- a/bundle/internal/tf/schema/resource_mws_ncc_private_endpoint_rule.go
+++ /dev/null
@@ -1,30 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceMwsNccPrivateEndpointRuleGcpEndpoint struct {
-	PscEndpointUri    string `json:"psc_endpoint_uri,omitempty"`
-	ServiceAttachment string `json:"service_attachment,omitempty"`
-}
-
-type ResourceMwsNccPrivateEndpointRule struct {
-	AccountId                   string                                        `json:"account_id,omitempty"`
-	ConnectionState             string                                        `json:"connection_state,omitempty"`
-	CreationTime                int                                           `json:"creation_time,omitempty"`
-	Deactivated                 bool                                          `json:"deactivated,omitempty"`
-	DeactivatedAt               int                                           `json:"deactivated_at,omitempty"`
-	DomainNames                 []string                                      `json:"domain_names,omitempty"`
-	Enabled                     bool                                          `json:"enabled,omitempty"`
-	EndpointName                string                                        `json:"endpoint_name,omitempty"`
-	EndpointService             string                                        `json:"endpoint_service,omitempty"`
-	ErrorMessage                string                                        `json:"error_message,omitempty"`
-	GroupId                     string                                        `json:"group_id,omitempty"`
-	Id                          string                                        `json:"id,omitempty"`
-	NetworkConnectivityConfigId string                                        `json:"network_connectivity_config_id"`
-	ResourceId                  string                                        `json:"resource_id,omitempty"`
-	ResourceNames               []string                                      `json:"resource_names,omitempty"`
-	RuleId                      string                                        `json:"rule_id,omitempty"`
-	UpdatedTime                 int                                           `json:"updated_time,omitempty"`
-	VpcEndpointId               string                                        `json:"vpc_endpoint_id,omitempty"`
-	GcpEndpoint                 *ResourceMwsNccPrivateEndpointRuleGcpEndpoint `json:"gcp_endpoint,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_mws_network_connectivity_config.go b/bundle/internal/tf/schema/resource_mws_network_connectivity_config.go
deleted file mode 100644
index e0f64acaf9c..00000000000
--- a/bundle/internal/tf/schema/resource_mws_network_connectivity_config.go
+++ /dev/null
@@ -1,71 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceMwsNetworkConnectivityConfigEgressConfigDefaultRulesAwsStableIpRule struct {
-	CidrBlocks []string `json:"cidr_blocks,omitempty"`
-}
-
-type ResourceMwsNetworkConnectivityConfigEgressConfigDefaultRulesAzureServiceEndpointRule struct {
-	Subnets        []string `json:"subnets,omitempty"`
-	TargetRegion   string   `json:"target_region,omitempty"`
-	TargetServices []string `json:"target_services,omitempty"`
-}
-
-type ResourceMwsNetworkConnectivityConfigEgressConfigDefaultRules struct {
-	AwsStableIpRule          *ResourceMwsNetworkConnectivityConfigEgressConfigDefaultRulesAwsStableIpRule          `json:"aws_stable_ip_rule,omitempty"`
-	AzureServiceEndpointRule *ResourceMwsNetworkConnectivityConfigEgressConfigDefaultRulesAzureServiceEndpointRule `json:"azure_service_endpoint_rule,omitempty"`
-}
-
-type ResourceMwsNetworkConnectivityConfigEgressConfigTargetRulesAwsPrivateEndpointRules struct {
-	AccountId                   string   `json:"account_id,omitempty"`
-	ConnectionState             string   `json:"connection_state,omitempty"`
-	CreationTime                int      `json:"creation_time,omitempty"`
-	Deactivated                 bool     `json:"deactivated,omitempty"`
-	DeactivatedAt               int      `json:"deactivated_at,omitempty"`
-	DomainNames                 []string `json:"domain_names,omitempty"`
-	Enabled                     bool     `json:"enabled,omitempty"`
-	EndpointService             string   `json:"endpoint_service,omitempty"`
-	ErrorMessage                string   `json:"error_message,omitempty"`
-	NetworkConnectivityConfigId string   `json:"network_connectivity_config_id,omitempty"`
-	ResourceNames               []string `json:"resource_names,omitempty"`
-	RuleId                      string   `json:"rule_id,omitempty"`
-	UpdatedTime                 int      `json:"updated_time,omitempty"`
-	VpcEndpointId               string   `json:"vpc_endpoint_id,omitempty"`
-}
-
-type ResourceMwsNetworkConnectivityConfigEgressConfigTargetRulesAzurePrivateEndpointRules struct {
-	ConnectionState             string   `json:"connection_state,omitempty"`
-	CreationTime                int      `json:"creation_time,omitempty"`
-	Deactivated                 bool     `json:"deactivated,omitempty"`
-	DeactivatedAt               int      `json:"deactivated_at,omitempty"`
-	DomainNames                 []string `json:"domain_names,omitempty"`
-	EndpointName                string   `json:"endpoint_name,omitempty"`
-	ErrorMessage                string   `json:"error_message,omitempty"`
-	GroupId                     string   `json:"group_id,omitempty"`
-	NetworkConnectivityConfigId string   `json:"network_connectivity_config_id,omitempty"`
-	ResourceId                  string   `json:"resource_id,omitempty"`
-	RuleId                      string   `json:"rule_id,omitempty"`
-	UpdatedTime                 int      `json:"updated_time,omitempty"`
-}
-
-type ResourceMwsNetworkConnectivityConfigEgressConfigTargetRules struct {
-	AwsPrivateEndpointRules   []ResourceMwsNetworkConnectivityConfigEgressConfigTargetRulesAwsPrivateEndpointRules   `json:"aws_private_endpoint_rules,omitempty"`
-	AzurePrivateEndpointRules []ResourceMwsNetworkConnectivityConfigEgressConfigTargetRulesAzurePrivateEndpointRules `json:"azure_private_endpoint_rules,omitempty"`
-}
-
-type ResourceMwsNetworkConnectivityConfigEgressConfig struct {
-	DefaultRules *ResourceMwsNetworkConnectivityConfigEgressConfigDefaultRules `json:"default_rules,omitempty"`
-	TargetRules  *ResourceMwsNetworkConnectivityConfigEgressConfigTargetRules  `json:"target_rules,omitempty"`
-}
-
-type ResourceMwsNetworkConnectivityConfig struct {
-	AccountId                   string                                            `json:"account_id,omitempty"`
-	CreationTime                int                                               `json:"creation_time,omitempty"`
-	Id                          string                                            `json:"id,omitempty"`
-	Name                        string                                            `json:"name"`
-	NetworkConnectivityConfigId string                                            `json:"network_connectivity_config_id,omitempty"`
-	Region                      string                                            `json:"region"`
-	UpdatedTime                 int                                               `json:"updated_time,omitempty"`
-	EgressConfig                *ResourceMwsNetworkConnectivityConfigEgressConfig `json:"egress_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_mws_networks.go b/bundle/internal/tf/schema/resource_mws_networks.go
deleted file mode 100644
index 3d02065068c..00000000000
--- a/bundle/internal/tf/schema/resource_mws_networks.go
+++ /dev/null
@@ -1,38 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceMwsNetworksErrorMessages struct {
-	ErrorMessage string `json:"error_message,omitempty"`
-	ErrorType    string `json:"error_type,omitempty"`
-}
-
-type ResourceMwsNetworksGcpNetworkInfo struct {
-	NetworkProjectId   string `json:"network_project_id"`
-	PodIpRangeName     string `json:"pod_ip_range_name,omitempty"`
-	ServiceIpRangeName string `json:"service_ip_range_name,omitempty"`
-	SubnetId           string `json:"subnet_id"`
-	SubnetRegion       string `json:"subnet_region"`
-	VpcId              string `json:"vpc_id"`
-}
-
-type ResourceMwsNetworksVpcEndpoints struct {
-	DataplaneRelay []string `json:"dataplane_relay"`
-	RestApi        []string `json:"rest_api"`
-}
-
-type ResourceMwsNetworks struct {
-	AccountId        string                             `json:"account_id"`
-	CreationTime     int                                `json:"creation_time,omitempty"`
-	Id               string                             `json:"id,omitempty"`
-	NetworkId        string                             `json:"network_id,omitempty"`
-	NetworkName      string                             `json:"network_name"`
-	SecurityGroupIds []string                           `json:"security_group_ids,omitempty"`
-	SubnetIds        []string                           `json:"subnet_ids,omitempty"`
-	VpcId            string                             `json:"vpc_id,omitempty"`
-	VpcStatus        string                             `json:"vpc_status,omitempty"`
-	WorkspaceId      int                                `json:"workspace_id,omitempty"`
-	ErrorMessages    []ResourceMwsNetworksErrorMessages `json:"error_messages,omitempty"`
-	GcpNetworkInfo   *ResourceMwsNetworksGcpNetworkInfo `json:"gcp_network_info,omitempty"`
-	VpcEndpoints     *ResourceMwsNetworksVpcEndpoints   `json:"vpc_endpoints,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_mws_permission_assignment.go b/bundle/internal/tf/schema/resource_mws_permission_assignment.go
deleted file mode 100644
index 66f8d57cc8b..00000000000
--- a/bundle/internal/tf/schema/resource_mws_permission_assignment.go
+++ /dev/null
@@ -1,10 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceMwsPermissionAssignment struct {
-	Id          string   `json:"id,omitempty"`
-	Permissions []string `json:"permissions"`
-	PrincipalId int      `json:"principal_id"`
-	WorkspaceId int      `json:"workspace_id"`
-}
diff --git a/bundle/internal/tf/schema/resource_mws_private_access_settings.go b/bundle/internal/tf/schema/resource_mws_private_access_settings.go
deleted file mode 100644
index c7c40aabfab..00000000000
--- a/bundle/internal/tf/schema/resource_mws_private_access_settings.go
+++ /dev/null
@@ -1,14 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceMwsPrivateAccessSettings struct {
-	AccountId                 string   `json:"account_id,omitempty"`
-	AllowedVpcEndpointIds     []string `json:"allowed_vpc_endpoint_ids,omitempty"`
-	Id                        string   `json:"id,omitempty"`
-	PrivateAccessLevel        string   `json:"private_access_level,omitempty"`
-	PrivateAccessSettingsId   string   `json:"private_access_settings_id,omitempty"`
-	PrivateAccessSettingsName string   `json:"private_access_settings_name"`
-	PublicAccessEnabled       bool     `json:"public_access_enabled,omitempty"`
-	Region                    string   `json:"region"`
-}
diff --git a/bundle/internal/tf/schema/resource_mws_storage_configurations.go b/bundle/internal/tf/schema/resource_mws_storage_configurations.go
deleted file mode 100644
index 80d17e3ca7d..00000000000
--- a/bundle/internal/tf/schema/resource_mws_storage_configurations.go
+++ /dev/null
@@ -1,13 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceMwsStorageConfigurations struct {
-	AccountId                string `json:"account_id"`
-	BucketName               string `json:"bucket_name"`
-	CreationTime             int    `json:"creation_time,omitempty"`
-	Id                       string `json:"id,omitempty"`
-	RoleArn                  string `json:"role_arn,omitempty"`
-	StorageConfigurationId   string `json:"storage_configuration_id,omitempty"`
-	StorageConfigurationName string `json:"storage_configuration_name"`
-}
diff --git a/bundle/internal/tf/schema/resource_mws_vpc_endpoint.go b/bundle/internal/tf/schema/resource_mws_vpc_endpoint.go
deleted file mode 100644
index 5e9d4111589..00000000000
--- a/bundle/internal/tf/schema/resource_mws_vpc_endpoint.go
+++ /dev/null
@@ -1,25 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceMwsVpcEndpointGcpVpcEndpointInfo struct {
-	EndpointRegion      string `json:"endpoint_region"`
-	ProjectId           string `json:"project_id"`
-	PscConnectionId     string `json:"psc_connection_id,omitempty"`
-	PscEndpointName     string `json:"psc_endpoint_name"`
-	ServiceAttachmentId string `json:"service_attachment_id,omitempty"`
-}
-
-type ResourceMwsVpcEndpoint struct {
-	AccountId            string                                    `json:"account_id,omitempty"`
-	AwsAccountId         string                                    `json:"aws_account_id,omitempty"`
-	AwsEndpointServiceId string                                    `json:"aws_endpoint_service_id,omitempty"`
-	AwsVpcEndpointId     string                                    `json:"aws_vpc_endpoint_id,omitempty"`
-	Id                   string                                    `json:"id,omitempty"`
-	Region               string                                    `json:"region,omitempty"`
-	State                string                                    `json:"state,omitempty"`
-	UseCase              string                                    `json:"use_case,omitempty"`
-	VpcEndpointId        string                                    `json:"vpc_endpoint_id,omitempty"`
-	VpcEndpointName      string                                    `json:"vpc_endpoint_name"`
-	GcpVpcEndpointInfo   *ResourceMwsVpcEndpointGcpVpcEndpointInfo `json:"gcp_vpc_endpoint_info,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_mws_workspaces.go b/bundle/internal/tf/schema/resource_mws_workspaces.go
deleted file mode 100644
index a9ae9be8a8e..00000000000
--- a/bundle/internal/tf/schema/resource_mws_workspaces.go
+++ /dev/null
@@ -1,70 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceMwsWorkspacesCloudResourceContainerGcp struct {
-	ProjectId string `json:"project_id"`
-}
-
-type ResourceMwsWorkspacesCloudResourceContainer struct {
-	Gcp *ResourceMwsWorkspacesCloudResourceContainerGcp `json:"gcp,omitempty"`
-}
-
-type ResourceMwsWorkspacesExternalCustomerInfo struct {
-	AuthoritativeUserEmail    string `json:"authoritative_user_email"`
-	AuthoritativeUserFullName string `json:"authoritative_user_full_name"`
-	CustomerName              string `json:"customer_name"`
-}
-
-type ResourceMwsWorkspacesGcpManagedNetworkConfig struct {
-	GkeClusterPodIpRange     string `json:"gke_cluster_pod_ip_range,omitempty"`
-	GkeClusterServiceIpRange string `json:"gke_cluster_service_ip_range,omitempty"`
-	SubnetCidr               string `json:"subnet_cidr"`
-}
-
-type ResourceMwsWorkspacesGkeConfig struct {
-	ConnectivityType string `json:"connectivity_type,omitempty"`
-	MasterIpRange    string `json:"master_ip_range,omitempty"`
-}
-
-type ResourceMwsWorkspacesToken struct {
-	Comment         string `json:"comment,omitempty"`
-	LifetimeSeconds int    `json:"lifetime_seconds,omitempty"`
-	TokenId         string `json:"token_id,omitempty"`
-	TokenValue      string `json:"token_value,omitempty"`
-}
-
-type ResourceMwsWorkspaces struct {
-	AccountId                           string                                        `json:"account_id"`
-	AwsRegion                           string                                        `json:"aws_region,omitempty"`
-	Cloud                               string                                        `json:"cloud,omitempty"`
-	ComputeMode                         string                                        `json:"compute_mode,omitempty"`
-	CreationTime                        int                                           `json:"creation_time,omitempty"`
-	CredentialsId                       string                                        `json:"credentials_id,omitempty"`
-	CustomTags                          map[string]string                             `json:"custom_tags,omitempty"`
-	CustomerManagedKeyId                string                                        `json:"customer_managed_key_id,omitempty"`
-	DeploymentName                      string                                        `json:"deployment_name,omitempty"`
-	EffectiveComputeMode                string                                        `json:"effective_compute_mode,omitempty"`
-	ExpectedWorkspaceStatus             string                                        `json:"expected_workspace_status,omitempty"`
-	GcpWorkspaceSa                      string                                        `json:"gcp_workspace_sa,omitempty"`
-	Id                                  string                                        `json:"id,omitempty"`
-	IsNoPublicIpEnabled                 bool                                          `json:"is_no_public_ip_enabled,omitempty"`
-	Location                            string                                        `json:"location,omitempty"`
-	ManagedServicesCustomerManagedKeyId string                                        `json:"managed_services_customer_managed_key_id,omitempty"`
-	NetworkConnectivityConfigId         string                                        `json:"network_connectivity_config_id,omitempty"`
-	NetworkId                           string                                        `json:"network_id,omitempty"`
-	PricingTier                         string                                        `json:"pricing_tier,omitempty"`
-	PrivateAccessSettingsId             string                                        `json:"private_access_settings_id,omitempty"`
-	StorageConfigurationId              string                                        `json:"storage_configuration_id,omitempty"`
-	StorageCustomerManagedKeyId         string                                        `json:"storage_customer_managed_key_id,omitempty"`
-	WorkspaceId                         int                                           `json:"workspace_id,omitempty"`
-	WorkspaceName                       string                                        `json:"workspace_name"`
-	WorkspaceStatus                     string                                        `json:"workspace_status,omitempty"`
-	WorkspaceStatusMessage              string                                        `json:"workspace_status_message,omitempty"`
-	WorkspaceUrl                        string                                        `json:"workspace_url,omitempty"`
-	CloudResourceContainer              *ResourceMwsWorkspacesCloudResourceContainer  `json:"cloud_resource_container,omitempty"`
-	ExternalCustomerInfo                *ResourceMwsWorkspacesExternalCustomerInfo    `json:"external_customer_info,omitempty"`
-	GcpManagedNetworkConfig             *ResourceMwsWorkspacesGcpManagedNetworkConfig `json:"gcp_managed_network_config,omitempty"`
-	GkeConfig                           *ResourceMwsWorkspacesGkeConfig               `json:"gke_config,omitempty"`
-	Token                               *ResourceMwsWorkspacesToken                   `json:"token,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_notebook.go b/bundle/internal/tf/schema/resource_notebook.go
deleted file mode 100644
index d7470f0a6a5..00000000000
--- a/bundle/internal/tf/schema/resource_notebook.go
+++ /dev/null
@@ -1,22 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceNotebookProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceNotebook struct {
-	ContentBase64  string                          `json:"content_base64,omitempty"`
-	Format         string                          `json:"format,omitempty"`
-	Id             string                          `json:"id,omitempty"`
-	Language       string                          `json:"language,omitempty"`
-	Md5            string                          `json:"md5,omitempty"`
-	ObjectId       int                             `json:"object_id,omitempty"`
-	ObjectType     string                          `json:"object_type,omitempty"`
-	Path           string                          `json:"path"`
-	Source         string                          `json:"source,omitempty"`
-	Url            string                          `json:"url,omitempty"`
-	WorkspacePath  string                          `json:"workspace_path,omitempty"`
-	ProviderConfig *ResourceNotebookProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_notification_destination.go b/bundle/internal/tf/schema/resource_notification_destination.go
deleted file mode 100644
index 541e1561df7..00000000000
--- a/bundle/internal/tf/schema/resource_notification_destination.go
+++ /dev/null
@@ -1,63 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceNotificationDestinationConfigEmail struct {
-	Addresses []string `json:"addresses,omitempty"`
-}
-
-type ResourceNotificationDestinationConfigGenericWebhook struct {
-	Password    string `json:"password,omitempty"`
-	PasswordSet bool   `json:"password_set,omitempty"`
-	Url         string `json:"url,omitempty"`
-	UrlSet      bool   `json:"url_set,omitempty"`
-	Username    string `json:"username,omitempty"`
-	UsernameSet bool   `json:"username_set,omitempty"`
-}
-
-type ResourceNotificationDestinationConfigMicrosoftTeams struct {
-	AppId         string `json:"app_id,omitempty"`
-	AppIdSet      bool   `json:"app_id_set,omitempty"`
-	AuthSecret    string `json:"auth_secret,omitempty"`
-	AuthSecretSet bool   `json:"auth_secret_set,omitempty"`
-	ChannelUrl    string `json:"channel_url,omitempty"`
-	ChannelUrlSet bool   `json:"channel_url_set,omitempty"`
-	TenantId      string `json:"tenant_id,omitempty"`
-	TenantIdSet   bool   `json:"tenant_id_set,omitempty"`
-	Url           string `json:"url,omitempty"`
-	UrlSet        bool   `json:"url_set,omitempty"`
-}
-
-type ResourceNotificationDestinationConfigPagerduty struct {
-	IntegrationKey    string `json:"integration_key,omitempty"`
-	IntegrationKeySet bool   `json:"integration_key_set,omitempty"`
-}
-
-type ResourceNotificationDestinationConfigSlack struct {
-	ChannelId     string `json:"channel_id,omitempty"`
-	ChannelIdSet  bool   `json:"channel_id_set,omitempty"`
-	OauthToken    string `json:"oauth_token,omitempty"`
-	OauthTokenSet bool   `json:"oauth_token_set,omitempty"`
-	Url           string `json:"url,omitempty"`
-	UrlSet        bool   `json:"url_set,omitempty"`
-}
-
-type ResourceNotificationDestinationConfig struct {
-	Email          *ResourceNotificationDestinationConfigEmail          `json:"email,omitempty"`
-	GenericWebhook *ResourceNotificationDestinationConfigGenericWebhook `json:"generic_webhook,omitempty"`
-	MicrosoftTeams *ResourceNotificationDestinationConfigMicrosoftTeams `json:"microsoft_teams,omitempty"`
-	Pagerduty      *ResourceNotificationDestinationConfigPagerduty      `json:"pagerduty,omitempty"`
-	Slack          *ResourceNotificationDestinationConfigSlack          `json:"slack,omitempty"`
-}
-
-type ResourceNotificationDestinationProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceNotificationDestination struct {
-	DestinationType string                                         `json:"destination_type,omitempty"`
-	DisplayName     string                                         `json:"display_name"`
-	Id              string                                         `json:"id,omitempty"`
-	Config          *ResourceNotificationDestinationConfig         `json:"config,omitempty"`
-	ProviderConfig  *ResourceNotificationDestinationProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_obo_token.go b/bundle/internal/tf/schema/resource_obo_token.go
deleted file mode 100644
index 5a603d2d7d4..00000000000
--- a/bundle/internal/tf/schema/resource_obo_token.go
+++ /dev/null
@@ -1,16 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceOboTokenProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceOboToken struct {
-	ApplicationId   string                          `json:"application_id"`
-	Comment         string                          `json:"comment,omitempty"`
-	Id              string                          `json:"id,omitempty"`
-	LifetimeSeconds int                             `json:"lifetime_seconds,omitempty"`
-	TokenValue      string                          `json:"token_value,omitempty"`
-	ProviderConfig  *ResourceOboTokenProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_online_store.go b/bundle/internal/tf/schema/resource_online_store.go
deleted file mode 100644
index 804ee9071f0..00000000000
--- a/bundle/internal/tf/schema/resource_online_store.go
+++ /dev/null
@@ -1,18 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceOnlineStoreProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceOnlineStore struct {
-	Capacity         string                             `json:"capacity"`
-	CreationTime     string                             `json:"creation_time,omitempty"`
-	Creator          string                             `json:"creator,omitempty"`
-	Name             string                             `json:"name"`
-	ProviderConfig   *ResourceOnlineStoreProviderConfig `json:"provider_config,omitempty"`
-	ReadReplicaCount int                                `json:"read_replica_count,omitempty"`
-	State            string                             `json:"state,omitempty"`
-	UsagePolicyId    string                             `json:"usage_policy_id,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_online_table.go b/bundle/internal/tf/schema/resource_online_table.go
deleted file mode 100644
index b3dc27d4a7a..00000000000
--- a/bundle/internal/tf/schema/resource_online_table.go
+++ /dev/null
@@ -1,33 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceOnlineTableProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceOnlineTableSpecRunContinuously struct {
-}
-
-type ResourceOnlineTableSpecRunTriggered struct {
-}
-
-type ResourceOnlineTableSpec struct {
-	PerformFullCopy     bool                                    `json:"perform_full_copy,omitempty"`
-	PipelineId          string                                  `json:"pipeline_id,omitempty"`
-	PrimaryKeyColumns   []string                                `json:"primary_key_columns,omitempty"`
-	SourceTableFullName string                                  `json:"source_table_full_name,omitempty"`
-	TimeseriesKey       string                                  `json:"timeseries_key,omitempty"`
-	RunContinuously     *ResourceOnlineTableSpecRunContinuously `json:"run_continuously,omitempty"`
-	RunTriggered        *ResourceOnlineTableSpecRunTriggered    `json:"run_triggered,omitempty"`
-}
-
-type ResourceOnlineTable struct {
-	Id                            string                             `json:"id,omitempty"`
-	Name                          string                             `json:"name"`
-	Status                        []any                              `json:"status,omitempty"`
-	TableServingUrl               string                             `json:"table_serving_url,omitempty"`
-	UnityCatalogProvisioningState string                             `json:"unity_catalog_provisioning_state,omitempty"`
-	ProviderConfig                *ResourceOnlineTableProviderConfig `json:"provider_config,omitempty"`
-	Spec                          *ResourceOnlineTableSpec           `json:"spec,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_permission_assignment.go b/bundle/internal/tf/schema/resource_permission_assignment.go
deleted file mode 100644
index beb9b16f742..00000000000
--- a/bundle/internal/tf/schema/resource_permission_assignment.go
+++ /dev/null
@@ -1,18 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourcePermissionAssignmentProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourcePermissionAssignment struct {
-	DisplayName          string                                      `json:"display_name,omitempty"`
-	GroupName            string                                      `json:"group_name,omitempty"`
-	Id                   string                                      `json:"id,omitempty"`
-	Permissions          []string                                    `json:"permissions"`
-	PrincipalId          int                                         `json:"principal_id,omitempty"`
-	ServicePrincipalName string                                      `json:"service_principal_name,omitempty"`
-	UserName             string                                      `json:"user_name,omitempty"`
-	ProviderConfig       *ResourcePermissionAssignmentProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_permissions.go b/bundle/internal/tf/schema/resource_permissions.go
deleted file mode 100644
index 1f9d8a38b84..00000000000
--- a/bundle/internal/tf/schema/resource_permissions.go
+++ /dev/null
@@ -1,48 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourcePermissionsAccessControl struct {
-	GroupName            string `json:"group_name,omitempty"`
-	PermissionLevel      string `json:"permission_level,omitempty"`
-	ServicePrincipalName string `json:"service_principal_name,omitempty"`
-	UserName             string `json:"user_name,omitempty"`
-}
-
-type ResourcePermissionsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourcePermissions struct {
-	AlertV2Id              string                             `json:"alert_v2_id,omitempty"`
-	AppName                string                             `json:"app_name,omitempty"`
-	Authorization          string                             `json:"authorization,omitempty"`
-	ClusterId              string                             `json:"cluster_id,omitempty"`
-	ClusterPolicyId        string                             `json:"cluster_policy_id,omitempty"`
-	DashboardId            string                             `json:"dashboard_id,omitempty"`
-	DatabaseInstanceName   string                             `json:"database_instance_name,omitempty"`
-	DatabaseProjectName    string                             `json:"database_project_name,omitempty"`
-	DirectoryId            string                             `json:"directory_id,omitempty"`
-	DirectoryPath          string                             `json:"directory_path,omitempty"`
-	ExperimentId           string                             `json:"experiment_id,omitempty"`
-	Id                     string                             `json:"id,omitempty"`
-	InstancePoolId         string                             `json:"instance_pool_id,omitempty"`
-	JobId                  string                             `json:"job_id,omitempty"`
-	NotebookId             string                             `json:"notebook_id,omitempty"`
-	NotebookPath           string                             `json:"notebook_path,omitempty"`
-	ObjectType             string                             `json:"object_type,omitempty"`
-	PipelineId             string                             `json:"pipeline_id,omitempty"`
-	RegisteredModelId      string                             `json:"registered_model_id,omitempty"`
-	RepoId                 string                             `json:"repo_id,omitempty"`
-	RepoPath               string                             `json:"repo_path,omitempty"`
-	ServingEndpointId      string                             `json:"serving_endpoint_id,omitempty"`
-	SqlAlertId             string                             `json:"sql_alert_id,omitempty"`
-	SqlDashboardId         string                             `json:"sql_dashboard_id,omitempty"`
-	SqlEndpointId          string                             `json:"sql_endpoint_id,omitempty"`
-	SqlQueryId             string                             `json:"sql_query_id,omitempty"`
-	VectorSearchEndpointId string                             `json:"vector_search_endpoint_id,omitempty"`
-	WorkspaceFileId        string                             `json:"workspace_file_id,omitempty"`
-	WorkspaceFilePath      string                             `json:"workspace_file_path,omitempty"`
-	AccessControl          []ResourcePermissionsAccessControl `json:"access_control,omitempty"`
-	ProviderConfig         *ResourcePermissionsProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_pipeline.go b/bundle/internal/tf/schema/resource_pipeline.go
deleted file mode 100644
index e7bf6bb91c9..00000000000
--- a/bundle/internal/tf/schema/resource_pipeline.go
+++ /dev/null
@@ -1,644 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourcePipelineClusterAutoscale struct {
-	MaxWorkers int    `json:"max_workers"`
-	MinWorkers int    `json:"min_workers"`
-	Mode       string `json:"mode,omitempty"`
-}
-
-type ResourcePipelineClusterAwsAttributes struct {
-	Availability        string `json:"availability,omitempty"`
-	EbsVolumeCount      int    `json:"ebs_volume_count,omitempty"`
-	EbsVolumeIops       int    `json:"ebs_volume_iops,omitempty"`
-	EbsVolumeSize       int    `json:"ebs_volume_size,omitempty"`
-	EbsVolumeThroughput int    `json:"ebs_volume_throughput,omitempty"`
-	EbsVolumeType       string `json:"ebs_volume_type,omitempty"`
-	FirstOnDemand       int    `json:"first_on_demand,omitempty"`
-	InstanceProfileArn  string `json:"instance_profile_arn,omitempty"`
-	SpotBidPricePercent int    `json:"spot_bid_price_percent,omitempty"`
-	ZoneId              string `json:"zone_id,omitempty"`
-}
-
-type ResourcePipelineClusterAzureAttributesLogAnalyticsInfo struct {
-	LogAnalyticsPrimaryKey  string `json:"log_analytics_primary_key,omitempty"`
-	LogAnalyticsWorkspaceId string `json:"log_analytics_workspace_id,omitempty"`
-}
-
-type ResourcePipelineClusterAzureAttributes struct {
-	Availability     string                                                  `json:"availability,omitempty"`
-	FirstOnDemand    int                                                     `json:"first_on_demand,omitempty"`
-	SpotBidMaxPrice  int                                                     `json:"spot_bid_max_price,omitempty"`
-	LogAnalyticsInfo *ResourcePipelineClusterAzureAttributesLogAnalyticsInfo `json:"log_analytics_info,omitempty"`
-}
-
-type ResourcePipelineClusterClusterLogConfDbfs struct {
-	Destination string `json:"destination"`
-}
-
-type ResourcePipelineClusterClusterLogConfS3 struct {
-	CannedAcl        string `json:"canned_acl,omitempty"`
-	Destination      string `json:"destination"`
-	EnableEncryption bool   `json:"enable_encryption,omitempty"`
-	EncryptionType   string `json:"encryption_type,omitempty"`
-	Endpoint         string `json:"endpoint,omitempty"`
-	KmsKey           string `json:"kms_key,omitempty"`
-	Region           string `json:"region,omitempty"`
-}
-
-type ResourcePipelineClusterClusterLogConfVolumes struct {
-	Destination string `json:"destination"`
-}
-
-type ResourcePipelineClusterClusterLogConf struct {
-	Dbfs    *ResourcePipelineClusterClusterLogConfDbfs    `json:"dbfs,omitempty"`
-	S3      *ResourcePipelineClusterClusterLogConfS3      `json:"s3,omitempty"`
-	Volumes *ResourcePipelineClusterClusterLogConfVolumes `json:"volumes,omitempty"`
-}
-
-type ResourcePipelineClusterGcpAttributes struct {
-	Availability         string `json:"availability,omitempty"`
-	FirstOnDemand        int    `json:"first_on_demand,omitempty"`
-	GoogleServiceAccount string `json:"google_service_account,omitempty"`
-	LocalSsdCount        int    `json:"local_ssd_count,omitempty"`
-	ZoneId               string `json:"zone_id,omitempty"`
-}
-
-type ResourcePipelineClusterInitScriptsAbfss struct {
-	Destination string `json:"destination"`
-}
-
-type ResourcePipelineClusterInitScriptsDbfs struct {
-	Destination string `json:"destination"`
-}
-
-type ResourcePipelineClusterInitScriptsFile struct {
-	Destination string `json:"destination"`
-}
-
-type ResourcePipelineClusterInitScriptsGcs struct {
-	Destination string `json:"destination"`
-}
-
-type ResourcePipelineClusterInitScriptsS3 struct {
-	CannedAcl        string `json:"canned_acl,omitempty"`
-	Destination      string `json:"destination"`
-	EnableEncryption bool   `json:"enable_encryption,omitempty"`
-	EncryptionType   string `json:"encryption_type,omitempty"`
-	Endpoint         string `json:"endpoint,omitempty"`
-	KmsKey           string `json:"kms_key,omitempty"`
-	Region           string `json:"region,omitempty"`
-}
-
-type ResourcePipelineClusterInitScriptsVolumes struct {
-	Destination string `json:"destination"`
-}
-
-type ResourcePipelineClusterInitScriptsWorkspace struct {
-	Destination string `json:"destination"`
-}
-
-type ResourcePipelineClusterInitScripts struct {
-	Abfss     *ResourcePipelineClusterInitScriptsAbfss     `json:"abfss,omitempty"`
-	Dbfs      *ResourcePipelineClusterInitScriptsDbfs      `json:"dbfs,omitempty"`
-	File      *ResourcePipelineClusterInitScriptsFile      `json:"file,omitempty"`
-	Gcs       *ResourcePipelineClusterInitScriptsGcs       `json:"gcs,omitempty"`
-	S3        *ResourcePipelineClusterInitScriptsS3        `json:"s3,omitempty"`
-	Volumes   *ResourcePipelineClusterInitScriptsVolumes   `json:"volumes,omitempty"`
-	Workspace *ResourcePipelineClusterInitScriptsWorkspace `json:"workspace,omitempty"`
-}
-
-type ResourcePipelineCluster struct {
-	ApplyPolicyDefaultValues  bool                                    `json:"apply_policy_default_values,omitempty"`
-	CustomTags                map[string]string                       `json:"custom_tags,omitempty"`
-	DriverInstancePoolId      string                                  `json:"driver_instance_pool_id,omitempty"`
-	DriverNodeTypeId          string                                  `json:"driver_node_type_id,omitempty"`
-	EnableLocalDiskEncryption bool                                    `json:"enable_local_disk_encryption,omitempty"`
-	InstancePoolId            string                                  `json:"instance_pool_id,omitempty"`
-	Label                     string                                  `json:"label,omitempty"`
-	NodeTypeId                string                                  `json:"node_type_id,omitempty"`
-	NumWorkers                int                                     `json:"num_workers,omitempty"`
-	PolicyId                  string                                  `json:"policy_id,omitempty"`
-	SparkConf                 map[string]string                       `json:"spark_conf,omitempty"`
-	SparkEnvVars              map[string]string                       `json:"spark_env_vars,omitempty"`
-	SshPublicKeys             []string                                `json:"ssh_public_keys,omitempty"`
-	Autoscale                 *ResourcePipelineClusterAutoscale       `json:"autoscale,omitempty"`
-	AwsAttributes             *ResourcePipelineClusterAwsAttributes   `json:"aws_attributes,omitempty"`
-	AzureAttributes           *ResourcePipelineClusterAzureAttributes `json:"azure_attributes,omitempty"`
-	ClusterLogConf            *ResourcePipelineClusterClusterLogConf  `json:"cluster_log_conf,omitempty"`
-	GcpAttributes             *ResourcePipelineClusterGcpAttributes   `json:"gcp_attributes,omitempty"`
-	InitScripts               []ResourcePipelineClusterInitScripts    `json:"init_scripts,omitempty"`
-}
-
-type ResourcePipelineDeployment struct {
-	Kind             string `json:"kind"`
-	MetadataFilePath string `json:"metadata_file_path,omitempty"`
-}
-
-type ResourcePipelineEnvironment struct {
-	Dependencies       []string `json:"dependencies,omitempty"`
-	EnvironmentVersion string   `json:"environment_version,omitempty"`
-}
-
-type ResourcePipelineEventLog struct {
-	Catalog string `json:"catalog,omitempty"`
-	Name    string `json:"name"`
-	Schema  string `json:"schema,omitempty"`
-}
-
-type ResourcePipelineFilters struct {
-	Exclude []string `json:"exclude,omitempty"`
-	Include []string `json:"include,omitempty"`
-}
-
-type ResourcePipelineGatewayDefinitionConnectionParameters struct {
-	SourceCatalog string `json:"source_catalog,omitempty"`
-}
-
-type ResourcePipelineGatewayDefinition struct {
-	ConnectionId          string                                                 `json:"connection_id,omitempty"`
-	ConnectionName        string                                                 `json:"connection_name"`
-	GatewayStorageCatalog string                                                 `json:"gateway_storage_catalog"`
-	GatewayStorageName    string                                                 `json:"gateway_storage_name,omitempty"`
-	GatewayStorageSchema  string                                                 `json:"gateway_storage_schema"`
-	ConnectionParameters  *ResourcePipelineGatewayDefinitionConnectionParameters `json:"connection_parameters,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionDataStagingOptions struct {
-	CatalogName string `json:"catalog_name"`
-	SchemaName  string `json:"schema_name"`
-	VolumeName  string `json:"volume_name,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionFullRefreshWindow struct {
-	DaysOfWeek []string `json:"days_of_week,omitempty"`
-	StartHour  int      `json:"start_hour"`
-	TimeZoneId string   `json:"time_zone_id,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionObjectsReportTableConfigurationAutoFullRefreshPolicy struct {
-	Enabled          bool `json:"enabled"`
-	MinIntervalHours int  `json:"min_interval_hours,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionObjectsReportTableConfigurationQueryBasedConnectorConfig struct {
-	CursorColumns                        []string `json:"cursor_columns,omitempty"`
-	DeletionCondition                    string   `json:"deletion_condition,omitempty"`
-	HardDeletionSyncMinIntervalInSeconds int      `json:"hard_deletion_sync_min_interval_in_seconds,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionObjectsReportTableConfigurationWorkdayReportParametersReportParameters struct {
-	Key   string `json:"key,omitempty"`
-	Value string `json:"value,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionObjectsReportTableConfigurationWorkdayReportParameters struct {
-	Incremental      bool                                                                                                        `json:"incremental,omitempty"`
-	Parameters       map[string]string                                                                                           `json:"parameters,omitempty"`
-	ReportParameters []ResourcePipelineIngestionDefinitionObjectsReportTableConfigurationWorkdayReportParametersReportParameters `json:"report_parameters,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionObjectsReportTableConfiguration struct {
-	ExcludeColumns                 []string                                                                                     `json:"exclude_columns,omitempty"`
-	IncludeColumns                 []string                                                                                     `json:"include_columns,omitempty"`
-	PrimaryKeys                    []string                                                                                     `json:"primary_keys,omitempty"`
-	RowFilter                      string                                                                                       `json:"row_filter,omitempty"`
-	SalesforceIncludeFormulaFields bool                                                                                         `json:"salesforce_include_formula_fields,omitempty"`
-	ScdType                        string                                                                                       `json:"scd_type,omitempty"`
-	SequenceBy                     []string                                                                                     `json:"sequence_by,omitempty"`
-	AutoFullRefreshPolicy          *ResourcePipelineIngestionDefinitionObjectsReportTableConfigurationAutoFullRefreshPolicy     `json:"auto_full_refresh_policy,omitempty"`
-	QueryBasedConnectorConfig      *ResourcePipelineIngestionDefinitionObjectsReportTableConfigurationQueryBasedConnectorConfig `json:"query_based_connector_config,omitempty"`
-	WorkdayReportParameters        *ResourcePipelineIngestionDefinitionObjectsReportTableConfigurationWorkdayReportParameters   `json:"workday_report_parameters,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionObjectsReport struct {
-	DestinationCatalog string                                                              `json:"destination_catalog"`
-	DestinationSchema  string                                                              `json:"destination_schema"`
-	DestinationTable   string                                                              `json:"destination_table,omitempty"`
-	SourceUrl          string                                                              `json:"source_url"`
-	TableConfiguration *ResourcePipelineIngestionDefinitionObjectsReportTableConfiguration `json:"table_configuration,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionObjectsSchemaConnectorOptionsGdriveOptionsFileIngestionOptionsFileFilters struct {
-	ModifiedAfter  string `json:"modified_after,omitempty"`
-	ModifiedBefore string `json:"modified_before,omitempty"`
-	PathFilter     string `json:"path_filter,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionObjectsSchemaConnectorOptionsGdriveOptionsFileIngestionOptions struct {
-	CorruptRecordColumn string                                                                                                         `json:"corrupt_record_column,omitempty"`
-	Format              string                                                                                                         `json:"format,omitempty"`
-	FormatOptions       map[string]string                                                                                              `json:"format_options,omitempty"`
-	IgnoreCorruptFiles  bool                                                                                                           `json:"ignore_corrupt_files,omitempty"`
-	InferColumnTypes    bool                                                                                                           `json:"infer_column_types,omitempty"`
-	ReaderCaseSensitive bool                                                                                                           `json:"reader_case_sensitive,omitempty"`
-	RescuedDataColumn   string                                                                                                         `json:"rescued_data_column,omitempty"`
-	SchemaEvolutionMode string                                                                                                         `json:"schema_evolution_mode,omitempty"`
-	SchemaHints         string                                                                                                         `json:"schema_hints,omitempty"`
-	SingleVariantColumn string                                                                                                         `json:"single_variant_column,omitempty"`
-	FileFilters         []ResourcePipelineIngestionDefinitionObjectsSchemaConnectorOptionsGdriveOptionsFileIngestionOptionsFileFilters `json:"file_filters,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionObjectsSchemaConnectorOptionsGdriveOptions struct {
-	EntityType           string                                                                                             `json:"entity_type,omitempty"`
-	Url                  string                                                                                             `json:"url,omitempty"`
-	FileIngestionOptions *ResourcePipelineIngestionDefinitionObjectsSchemaConnectorOptionsGdriveOptionsFileIngestionOptions `json:"file_ingestion_options,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionObjectsSchemaConnectorOptionsGoogleAdsOptions struct {
-	LookbackWindowDays int    `json:"lookback_window_days,omitempty"`
-	ManagerAccountId   string `json:"manager_account_id"`
-	SyncStartDate      string `json:"sync_start_date,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionObjectsSchemaConnectorOptionsSharepointOptionsFileIngestionOptionsFileFilters struct {
-	ModifiedAfter  string `json:"modified_after,omitempty"`
-	ModifiedBefore string `json:"modified_before,omitempty"`
-	PathFilter     string `json:"path_filter,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionObjectsSchemaConnectorOptionsSharepointOptionsFileIngestionOptions struct {
-	CorruptRecordColumn string                                                                                                             `json:"corrupt_record_column,omitempty"`
-	Format              string                                                                                                             `json:"format,omitempty"`
-	FormatOptions       map[string]string                                                                                                  `json:"format_options,omitempty"`
-	IgnoreCorruptFiles  bool                                                                                                               `json:"ignore_corrupt_files,omitempty"`
-	InferColumnTypes    bool                                                                                                               `json:"infer_column_types,omitempty"`
-	ReaderCaseSensitive bool                                                                                                               `json:"reader_case_sensitive,omitempty"`
-	RescuedDataColumn   string                                                                                                             `json:"rescued_data_column,omitempty"`
-	SchemaEvolutionMode string                                                                                                             `json:"schema_evolution_mode,omitempty"`
-	SchemaHints         string                                                                                                             `json:"schema_hints,omitempty"`
-	SingleVariantColumn string                                                                                                             `json:"single_variant_column,omitempty"`
-	FileFilters         []ResourcePipelineIngestionDefinitionObjectsSchemaConnectorOptionsSharepointOptionsFileIngestionOptionsFileFilters `json:"file_filters,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionObjectsSchemaConnectorOptionsSharepointOptions struct {
-	EntityType           string                                                                                                 `json:"entity_type,omitempty"`
-	Url                  string                                                                                                 `json:"url,omitempty"`
-	FileIngestionOptions *ResourcePipelineIngestionDefinitionObjectsSchemaConnectorOptionsSharepointOptionsFileIngestionOptions `json:"file_ingestion_options,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionObjectsSchemaConnectorOptionsTiktokAdsOptions struct {
-	DataLevel          string   `json:"data_level,omitempty"`
-	Dimensions         []string `json:"dimensions,omitempty"`
-	LookbackWindowDays int      `json:"lookback_window_days,omitempty"`
-	Metrics            []string `json:"metrics,omitempty"`
-	QueryLifetime      bool     `json:"query_lifetime,omitempty"`
-	ReportType         string   `json:"report_type,omitempty"`
-	SyncStartDate      string   `json:"sync_start_date,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionObjectsSchemaConnectorOptions struct {
-	GdriveOptions     *ResourcePipelineIngestionDefinitionObjectsSchemaConnectorOptionsGdriveOptions     `json:"gdrive_options,omitempty"`
-	GoogleAdsOptions  *ResourcePipelineIngestionDefinitionObjectsSchemaConnectorOptionsGoogleAdsOptions  `json:"google_ads_options,omitempty"`
-	SharepointOptions *ResourcePipelineIngestionDefinitionObjectsSchemaConnectorOptionsSharepointOptions `json:"sharepoint_options,omitempty"`
-	TiktokAdsOptions  *ResourcePipelineIngestionDefinitionObjectsSchemaConnectorOptionsTiktokAdsOptions  `json:"tiktok_ads_options,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionObjectsSchemaTableConfigurationAutoFullRefreshPolicy struct {
-	Enabled          bool `json:"enabled"`
-	MinIntervalHours int  `json:"min_interval_hours,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionObjectsSchemaTableConfigurationQueryBasedConnectorConfig struct {
-	CursorColumns                        []string `json:"cursor_columns,omitempty"`
-	DeletionCondition                    string   `json:"deletion_condition,omitempty"`
-	HardDeletionSyncMinIntervalInSeconds int      `json:"hard_deletion_sync_min_interval_in_seconds,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionObjectsSchemaTableConfigurationWorkdayReportParametersReportParameters struct {
-	Key   string `json:"key,omitempty"`
-	Value string `json:"value,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionObjectsSchemaTableConfigurationWorkdayReportParameters struct {
-	Incremental      bool                                                                                                        `json:"incremental,omitempty"`
-	Parameters       map[string]string                                                                                           `json:"parameters,omitempty"`
-	ReportParameters []ResourcePipelineIngestionDefinitionObjectsSchemaTableConfigurationWorkdayReportParametersReportParameters `json:"report_parameters,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionObjectsSchemaTableConfiguration struct {
-	ExcludeColumns                 []string                                                                                     `json:"exclude_columns,omitempty"`
-	IncludeColumns                 []string                                                                                     `json:"include_columns,omitempty"`
-	PrimaryKeys                    []string                                                                                     `json:"primary_keys,omitempty"`
-	RowFilter                      string                                                                                       `json:"row_filter,omitempty"`
-	SalesforceIncludeFormulaFields bool                                                                                         `json:"salesforce_include_formula_fields,omitempty"`
-	ScdType                        string                                                                                       `json:"scd_type,omitempty"`
-	SequenceBy                     []string                                                                                     `json:"sequence_by,omitempty"`
-	AutoFullRefreshPolicy          *ResourcePipelineIngestionDefinitionObjectsSchemaTableConfigurationAutoFullRefreshPolicy     `json:"auto_full_refresh_policy,omitempty"`
-	QueryBasedConnectorConfig      *ResourcePipelineIngestionDefinitionObjectsSchemaTableConfigurationQueryBasedConnectorConfig `json:"query_based_connector_config,omitempty"`
-	WorkdayReportParameters        *ResourcePipelineIngestionDefinitionObjectsSchemaTableConfigurationWorkdayReportParameters   `json:"workday_report_parameters,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionObjectsSchema struct {
-	DestinationCatalog string                                                              `json:"destination_catalog"`
-	DestinationSchema  string                                                              `json:"destination_schema"`
-	SourceCatalog      string                                                              `json:"source_catalog,omitempty"`
-	SourceSchema       string                                                              `json:"source_schema"`
-	ConnectorOptions   *ResourcePipelineIngestionDefinitionObjectsSchemaConnectorOptions   `json:"connector_options,omitempty"`
-	TableConfiguration *ResourcePipelineIngestionDefinitionObjectsSchemaTableConfiguration `json:"table_configuration,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionObjectsTableConnectorOptionsGdriveOptionsFileIngestionOptionsFileFilters struct {
-	ModifiedAfter  string `json:"modified_after,omitempty"`
-	ModifiedBefore string `json:"modified_before,omitempty"`
-	PathFilter     string `json:"path_filter,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionObjectsTableConnectorOptionsGdriveOptionsFileIngestionOptions struct {
-	CorruptRecordColumn string                                                                                                        `json:"corrupt_record_column,omitempty"`
-	Format              string                                                                                                        `json:"format,omitempty"`
-	FormatOptions       map[string]string                                                                                             `json:"format_options,omitempty"`
-	IgnoreCorruptFiles  bool                                                                                                          `json:"ignore_corrupt_files,omitempty"`
-	InferColumnTypes    bool                                                                                                          `json:"infer_column_types,omitempty"`
-	ReaderCaseSensitive bool                                                                                                          `json:"reader_case_sensitive,omitempty"`
-	RescuedDataColumn   string                                                                                                        `json:"rescued_data_column,omitempty"`
-	SchemaEvolutionMode string                                                                                                        `json:"schema_evolution_mode,omitempty"`
-	SchemaHints         string                                                                                                        `json:"schema_hints,omitempty"`
-	SingleVariantColumn string                                                                                                        `json:"single_variant_column,omitempty"`
-	FileFilters         []ResourcePipelineIngestionDefinitionObjectsTableConnectorOptionsGdriveOptionsFileIngestionOptionsFileFilters `json:"file_filters,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionObjectsTableConnectorOptionsGdriveOptions struct {
-	EntityType           string                                                                                            `json:"entity_type,omitempty"`
-	Url                  string                                                                                            `json:"url,omitempty"`
-	FileIngestionOptions *ResourcePipelineIngestionDefinitionObjectsTableConnectorOptionsGdriveOptionsFileIngestionOptions `json:"file_ingestion_options,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionObjectsTableConnectorOptionsGoogleAdsOptions struct {
-	LookbackWindowDays int    `json:"lookback_window_days,omitempty"`
-	ManagerAccountId   string `json:"manager_account_id"`
-	SyncStartDate      string `json:"sync_start_date,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionObjectsTableConnectorOptionsSharepointOptionsFileIngestionOptionsFileFilters struct {
-	ModifiedAfter  string `json:"modified_after,omitempty"`
-	ModifiedBefore string `json:"modified_before,omitempty"`
-	PathFilter     string `json:"path_filter,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionObjectsTableConnectorOptionsSharepointOptionsFileIngestionOptions struct {
-	CorruptRecordColumn string                                                                                                            `json:"corrupt_record_column,omitempty"`
-	Format              string                                                                                                            `json:"format,omitempty"`
-	FormatOptions       map[string]string                                                                                                 `json:"format_options,omitempty"`
-	IgnoreCorruptFiles  bool                                                                                                              `json:"ignore_corrupt_files,omitempty"`
-	InferColumnTypes    bool                                                                                                              `json:"infer_column_types,omitempty"`
-	ReaderCaseSensitive bool                                                                                                              `json:"reader_case_sensitive,omitempty"`
-	RescuedDataColumn   string                                                                                                            `json:"rescued_data_column,omitempty"`
-	SchemaEvolutionMode string                                                                                                            `json:"schema_evolution_mode,omitempty"`
-	SchemaHints         string                                                                                                            `json:"schema_hints,omitempty"`
-	SingleVariantColumn string                                                                                                            `json:"single_variant_column,omitempty"`
-	FileFilters         []ResourcePipelineIngestionDefinitionObjectsTableConnectorOptionsSharepointOptionsFileIngestionOptionsFileFilters `json:"file_filters,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionObjectsTableConnectorOptionsSharepointOptions struct {
-	EntityType           string                                                                                                `json:"entity_type,omitempty"`
-	Url                  string                                                                                                `json:"url,omitempty"`
-	FileIngestionOptions *ResourcePipelineIngestionDefinitionObjectsTableConnectorOptionsSharepointOptionsFileIngestionOptions `json:"file_ingestion_options,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionObjectsTableConnectorOptionsTiktokAdsOptions struct {
-	DataLevel          string   `json:"data_level,omitempty"`
-	Dimensions         []string `json:"dimensions,omitempty"`
-	LookbackWindowDays int      `json:"lookback_window_days,omitempty"`
-	Metrics            []string `json:"metrics,omitempty"`
-	QueryLifetime      bool     `json:"query_lifetime,omitempty"`
-	ReportType         string   `json:"report_type,omitempty"`
-	SyncStartDate      string   `json:"sync_start_date,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionObjectsTableConnectorOptions struct {
-	GdriveOptions     *ResourcePipelineIngestionDefinitionObjectsTableConnectorOptionsGdriveOptions     `json:"gdrive_options,omitempty"`
-	GoogleAdsOptions  *ResourcePipelineIngestionDefinitionObjectsTableConnectorOptionsGoogleAdsOptions  `json:"google_ads_options,omitempty"`
-	SharepointOptions *ResourcePipelineIngestionDefinitionObjectsTableConnectorOptionsSharepointOptions `json:"sharepoint_options,omitempty"`
-	TiktokAdsOptions  *ResourcePipelineIngestionDefinitionObjectsTableConnectorOptionsTiktokAdsOptions  `json:"tiktok_ads_options,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionObjectsTableTableConfigurationAutoFullRefreshPolicy struct {
-	Enabled          bool `json:"enabled"`
-	MinIntervalHours int  `json:"min_interval_hours,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionObjectsTableTableConfigurationQueryBasedConnectorConfig struct {
-	CursorColumns                        []string `json:"cursor_columns,omitempty"`
-	DeletionCondition                    string   `json:"deletion_condition,omitempty"`
-	HardDeletionSyncMinIntervalInSeconds int      `json:"hard_deletion_sync_min_interval_in_seconds,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionObjectsTableTableConfigurationWorkdayReportParametersReportParameters struct {
-	Key   string `json:"key,omitempty"`
-	Value string `json:"value,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionObjectsTableTableConfigurationWorkdayReportParameters struct {
-	Incremental      bool                                                                                                       `json:"incremental,omitempty"`
-	Parameters       map[string]string                                                                                          `json:"parameters,omitempty"`
-	ReportParameters []ResourcePipelineIngestionDefinitionObjectsTableTableConfigurationWorkdayReportParametersReportParameters `json:"report_parameters,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionObjectsTableTableConfiguration struct {
-	ExcludeColumns                 []string                                                                                    `json:"exclude_columns,omitempty"`
-	IncludeColumns                 []string                                                                                    `json:"include_columns,omitempty"`
-	PrimaryKeys                    []string                                                                                    `json:"primary_keys,omitempty"`
-	RowFilter                      string                                                                                      `json:"row_filter,omitempty"`
-	SalesforceIncludeFormulaFields bool                                                                                        `json:"salesforce_include_formula_fields,omitempty"`
-	ScdType                        string                                                                                      `json:"scd_type,omitempty"`
-	SequenceBy                     []string                                                                                    `json:"sequence_by,omitempty"`
-	AutoFullRefreshPolicy          *ResourcePipelineIngestionDefinitionObjectsTableTableConfigurationAutoFullRefreshPolicy     `json:"auto_full_refresh_policy,omitempty"`
-	QueryBasedConnectorConfig      *ResourcePipelineIngestionDefinitionObjectsTableTableConfigurationQueryBasedConnectorConfig `json:"query_based_connector_config,omitempty"`
-	WorkdayReportParameters        *ResourcePipelineIngestionDefinitionObjectsTableTableConfigurationWorkdayReportParameters   `json:"workday_report_parameters,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionObjectsTable struct {
-	DestinationCatalog string                                                             `json:"destination_catalog"`
-	DestinationSchema  string                                                             `json:"destination_schema"`
-	DestinationTable   string                                                             `json:"destination_table,omitempty"`
-	SourceCatalog      string                                                             `json:"source_catalog,omitempty"`
-	SourceSchema       string                                                             `json:"source_schema,omitempty"`
-	SourceTable        string                                                             `json:"source_table"`
-	ConnectorOptions   *ResourcePipelineIngestionDefinitionObjectsTableConnectorOptions   `json:"connector_options,omitempty"`
-	TableConfiguration *ResourcePipelineIngestionDefinitionObjectsTableTableConfiguration `json:"table_configuration,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionObjects struct {
-	Report *ResourcePipelineIngestionDefinitionObjectsReport `json:"report,omitempty"`
-	Schema *ResourcePipelineIngestionDefinitionObjectsSchema `json:"schema,omitempty"`
-	Table  *ResourcePipelineIngestionDefinitionObjectsTable  `json:"table,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionSourceConfigurationsCatalogPostgresSlotConfig struct {
-	PublicationName string `json:"publication_name,omitempty"`
-	SlotName        string `json:"slot_name,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionSourceConfigurationsCatalogPostgres struct {
-	SlotConfig *ResourcePipelineIngestionDefinitionSourceConfigurationsCatalogPostgresSlotConfig `json:"slot_config,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionSourceConfigurationsCatalog struct {
-	SourceCatalog string                                                                  `json:"source_catalog,omitempty"`
-	Postgres      *ResourcePipelineIngestionDefinitionSourceConfigurationsCatalogPostgres `json:"postgres,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionSourceConfigurations struct {
-	Catalog *ResourcePipelineIngestionDefinitionSourceConfigurationsCatalog `json:"catalog,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionTableConfigurationAutoFullRefreshPolicy struct {
-	Enabled          bool `json:"enabled"`
-	MinIntervalHours int  `json:"min_interval_hours,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionTableConfigurationQueryBasedConnectorConfig struct {
-	CursorColumns                        []string `json:"cursor_columns,omitempty"`
-	DeletionCondition                    string   `json:"deletion_condition,omitempty"`
-	HardDeletionSyncMinIntervalInSeconds int      `json:"hard_deletion_sync_min_interval_in_seconds,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionTableConfigurationWorkdayReportParametersReportParameters struct {
-	Key   string `json:"key,omitempty"`
-	Value string `json:"value,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionTableConfigurationWorkdayReportParameters struct {
-	Incremental      bool                                                                                           `json:"incremental,omitempty"`
-	Parameters       map[string]string                                                                              `json:"parameters,omitempty"`
-	ReportParameters []ResourcePipelineIngestionDefinitionTableConfigurationWorkdayReportParametersReportParameters `json:"report_parameters,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinitionTableConfiguration struct {
-	ExcludeColumns                 []string                                                                        `json:"exclude_columns,omitempty"`
-	IncludeColumns                 []string                                                                        `json:"include_columns,omitempty"`
-	PrimaryKeys                    []string                                                                        `json:"primary_keys,omitempty"`
-	RowFilter                      string                                                                          `json:"row_filter,omitempty"`
-	SalesforceIncludeFormulaFields bool                                                                            `json:"salesforce_include_formula_fields,omitempty"`
-	ScdType                        string                                                                          `json:"scd_type,omitempty"`
-	SequenceBy                     []string                                                                        `json:"sequence_by,omitempty"`
-	AutoFullRefreshPolicy          *ResourcePipelineIngestionDefinitionTableConfigurationAutoFullRefreshPolicy     `json:"auto_full_refresh_policy,omitempty"`
-	QueryBasedConnectorConfig      *ResourcePipelineIngestionDefinitionTableConfigurationQueryBasedConnectorConfig `json:"query_based_connector_config,omitempty"`
-	WorkdayReportParameters        *ResourcePipelineIngestionDefinitionTableConfigurationWorkdayReportParameters   `json:"workday_report_parameters,omitempty"`
-}
-
-type ResourcePipelineIngestionDefinition struct {
-	ConnectionName             string                                                    `json:"connection_name,omitempty"`
-	ConnectorType              string                                                    `json:"connector_type,omitempty"`
-	IngestFromUcForeignCatalog bool                                                      `json:"ingest_from_uc_foreign_catalog,omitempty"`
-	IngestionGatewayId         string                                                    `json:"ingestion_gateway_id,omitempty"`
-	NetsuiteJarPath            string                                                    `json:"netsuite_jar_path,omitempty"`
-	SourceType                 string                                                    `json:"source_type,omitempty"`
-	DataStagingOptions         *ResourcePipelineIngestionDefinitionDataStagingOptions    `json:"data_staging_options,omitempty"`
-	FullRefreshWindow          *ResourcePipelineIngestionDefinitionFullRefreshWindow     `json:"full_refresh_window,omitempty"`
-	Objects                    []ResourcePipelineIngestionDefinitionObjects              `json:"objects,omitempty"`
-	SourceConfigurations       []ResourcePipelineIngestionDefinitionSourceConfigurations `json:"source_configurations,omitempty"`
-	TableConfiguration         *ResourcePipelineIngestionDefinitionTableConfiguration    `json:"table_configuration,omitempty"`
-}
-
-type ResourcePipelineLatestUpdates struct {
-	CreationTime string `json:"creation_time,omitempty"`
-	State        string `json:"state,omitempty"`
-	UpdateId     string `json:"update_id,omitempty"`
-}
-
-type ResourcePipelineLibraryFile struct {
-	Path string `json:"path"`
-}
-
-type ResourcePipelineLibraryGlob struct {
-	Include string `json:"include"`
-}
-
-type ResourcePipelineLibraryMaven struct {
-	Coordinates string   `json:"coordinates"`
-	Exclusions  []string `json:"exclusions,omitempty"`
-	Repo        string   `json:"repo,omitempty"`
-}
-
-type ResourcePipelineLibraryNotebook struct {
-	Path string `json:"path"`
-}
-
-type ResourcePipelineLibrary struct {
-	Jar      string                           `json:"jar,omitempty"`
-	Whl      string                           `json:"whl,omitempty"`
-	File     *ResourcePipelineLibraryFile     `json:"file,omitempty"`
-	Glob     *ResourcePipelineLibraryGlob     `json:"glob,omitempty"`
-	Maven    *ResourcePipelineLibraryMaven    `json:"maven,omitempty"`
-	Notebook *ResourcePipelineLibraryNotebook `json:"notebook,omitempty"`
-}
-
-type ResourcePipelineNotification struct {
-	Alerts          []string `json:"alerts,omitempty"`
-	EmailRecipients []string `json:"email_recipients,omitempty"`
-}
-
-type ResourcePipelineProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourcePipelineRestartWindow struct {
-	DaysOfWeek []string `json:"days_of_week,omitempty"`
-	StartHour  int      `json:"start_hour"`
-	TimeZoneId string   `json:"time_zone_id,omitempty"`
-}
-
-type ResourcePipelineRunAs struct {
-	ServicePrincipalName string `json:"service_principal_name,omitempty"`
-	UserName             string `json:"user_name,omitempty"`
-}
-
-type ResourcePipelineTriggerCron struct {
-	QuartzCronSchedule string `json:"quartz_cron_schedule,omitempty"`
-	TimezoneId         string `json:"timezone_id,omitempty"`
-}
-
-type ResourcePipelineTriggerManual struct {
-}
-
-type ResourcePipelineTrigger struct {
-	Cron   *ResourcePipelineTriggerCron   `json:"cron,omitempty"`
-	Manual *ResourcePipelineTriggerManual `json:"manual,omitempty"`
-}
-
-type ResourcePipeline struct {
-	AllowDuplicateNames  bool                                 `json:"allow_duplicate_names,omitempty"`
-	BudgetPolicyId       string                               `json:"budget_policy_id,omitempty"`
-	Catalog              string                               `json:"catalog,omitempty"`
-	Cause                string                               `json:"cause,omitempty"`
-	Channel              string                               `json:"channel,omitempty"`
-	ClusterId            string                               `json:"cluster_id,omitempty"`
-	Configuration        map[string]string                    `json:"configuration,omitempty"`
-	Continuous           bool                                 `json:"continuous,omitempty"`
-	CreatorUserName      string                               `json:"creator_user_name,omitempty"`
-	Development          bool                                 `json:"development,omitempty"`
-	Edition              string                               `json:"edition,omitempty"`
-	ExpectedLastModified int                                  `json:"expected_last_modified,omitempty"`
-	Health               string                               `json:"health,omitempty"`
-	Id                   string                               `json:"id,omitempty"`
-	LastModified         int                                  `json:"last_modified,omitempty"`
-	Name                 string                               `json:"name,omitempty"`
-	Photon               bool                                 `json:"photon,omitempty"`
-	RootPath             string                               `json:"root_path,omitempty"`
-	RunAsUserName        string                               `json:"run_as_user_name,omitempty"`
-	Schema               string                               `json:"schema,omitempty"`
-	Serverless           bool                                 `json:"serverless,omitempty"`
-	State                string                               `json:"state,omitempty"`
-	Storage              string                               `json:"storage,omitempty"`
-	Tags                 map[string]string                    `json:"tags,omitempty"`
-	Target               string                               `json:"target,omitempty"`
-	Url                  string                               `json:"url,omitempty"`
-	UsagePolicyId        string                               `json:"usage_policy_id,omitempty"`
-	Cluster              []ResourcePipelineCluster            `json:"cluster,omitempty"`
-	Deployment           *ResourcePipelineDeployment          `json:"deployment,omitempty"`
-	Environment          *ResourcePipelineEnvironment         `json:"environment,omitempty"`
-	EventLog             *ResourcePipelineEventLog            `json:"event_log,omitempty"`
-	Filters              *ResourcePipelineFilters             `json:"filters,omitempty"`
-	GatewayDefinition    *ResourcePipelineGatewayDefinition   `json:"gateway_definition,omitempty"`
-	IngestionDefinition  *ResourcePipelineIngestionDefinition `json:"ingestion_definition,omitempty"`
-	LatestUpdates        []ResourcePipelineLatestUpdates      `json:"latest_updates,omitempty"`
-	Library              []ResourcePipelineLibrary            `json:"library,omitempty"`
-	Notification         []ResourcePipelineNotification       `json:"notification,omitempty"`
-	ProviderConfig       *ResourcePipelineProviderConfig      `json:"provider_config,omitempty"`
-	RestartWindow        *ResourcePipelineRestartWindow       `json:"restart_window,omitempty"`
-	RunAs                *ResourcePipelineRunAs               `json:"run_as,omitempty"`
-	Trigger              *ResourcePipelineTrigger             `json:"trigger,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_policy_info.go b/bundle/internal/tf/schema/resource_policy_info.go
deleted file mode 100644
index 27a6600e4a7..00000000000
--- a/bundle/internal/tf/schema/resource_policy_info.go
+++ /dev/null
@@ -1,54 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourcePolicyInfoColumnMaskUsing struct {
-	Alias    string `json:"alias,omitempty"`
-	Constant string `json:"constant,omitempty"`
-}
-
-type ResourcePolicyInfoColumnMask struct {
-	FunctionName string                              `json:"function_name"`
-	OnColumn     string                              `json:"on_column"`
-	Using        []ResourcePolicyInfoColumnMaskUsing `json:"using,omitempty"`
-}
-
-type ResourcePolicyInfoMatchColumns struct {
-	Alias     string `json:"alias,omitempty"`
-	Condition string `json:"condition,omitempty"`
-}
-
-type ResourcePolicyInfoProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourcePolicyInfoRowFilterUsing struct {
-	Alias    string `json:"alias,omitempty"`
-	Constant string `json:"constant,omitempty"`
-}
-
-type ResourcePolicyInfoRowFilter struct {
-	FunctionName string                             `json:"function_name"`
-	Using        []ResourcePolicyInfoRowFilterUsing `json:"using,omitempty"`
-}
-
-type ResourcePolicyInfo struct {
-	ColumnMask          *ResourcePolicyInfoColumnMask     `json:"column_mask,omitempty"`
-	Comment             string                            `json:"comment,omitempty"`
-	CreatedAt           int                               `json:"created_at,omitempty"`
-	CreatedBy           string                            `json:"created_by,omitempty"`
-	ExceptPrincipals    []string                          `json:"except_principals,omitempty"`
-	ForSecurableType    string                            `json:"for_securable_type"`
-	Id                  string                            `json:"id,omitempty"`
-	MatchColumns        []ResourcePolicyInfoMatchColumns  `json:"match_columns,omitempty"`
-	Name                string                            `json:"name,omitempty"`
-	OnSecurableFullname string                            `json:"on_securable_fullname,omitempty"`
-	OnSecurableType     string                            `json:"on_securable_type,omitempty"`
-	PolicyType          string                            `json:"policy_type"`
-	ProviderConfig      *ResourcePolicyInfoProviderConfig `json:"provider_config,omitempty"`
-	RowFilter           *ResourcePolicyInfoRowFilter      `json:"row_filter,omitempty"`
-	ToPrincipals        []string                          `json:"to_principals"`
-	UpdatedAt           int                               `json:"updated_at,omitempty"`
-	UpdatedBy           string                            `json:"updated_by,omitempty"`
-	WhenCondition       string                            `json:"when_condition,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_postgres_branch.go b/bundle/internal/tf/schema/resource_postgres_branch.go
deleted file mode 100644
index 1ccfaeb1818..00000000000
--- a/bundle/internal/tf/schema/resource_postgres_branch.go
+++ /dev/null
@@ -1,42 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourcePostgresBranchProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourcePostgresBranchSpec struct {
-	ExpireTime       string `json:"expire_time,omitempty"`
-	IsProtected      bool   `json:"is_protected,omitempty"`
-	NoExpiry         bool   `json:"no_expiry,omitempty"`
-	SourceBranch     string `json:"source_branch,omitempty"`
-	SourceBranchLsn  string `json:"source_branch_lsn,omitempty"`
-	SourceBranchTime string `json:"source_branch_time,omitempty"`
-	Ttl              string `json:"ttl,omitempty"`
-}
-
-type ResourcePostgresBranchStatus struct {
-	CurrentState     string `json:"current_state,omitempty"`
-	Default          bool   `json:"default,omitempty"`
-	ExpireTime       string `json:"expire_time,omitempty"`
-	IsProtected      bool   `json:"is_protected,omitempty"`
-	LogicalSizeBytes int    `json:"logical_size_bytes,omitempty"`
-	PendingState     string `json:"pending_state,omitempty"`
-	SourceBranch     string `json:"source_branch,omitempty"`
-	SourceBranchLsn  string `json:"source_branch_lsn,omitempty"`
-	SourceBranchTime string `json:"source_branch_time,omitempty"`
-	StateChangeTime  string `json:"state_change_time,omitempty"`
-}
-
-type ResourcePostgresBranch struct {
-	BranchId       string                                `json:"branch_id"`
-	CreateTime     string                                `json:"create_time,omitempty"`
-	Name           string                                `json:"name,omitempty"`
-	Parent         string                                `json:"parent"`
-	ProviderConfig *ResourcePostgresBranchProviderConfig `json:"provider_config,omitempty"`
-	Spec           *ResourcePostgresBranchSpec           `json:"spec,omitempty"`
-	Status         *ResourcePostgresBranchStatus         `json:"status,omitempty"`
-	Uid            string                                `json:"uid,omitempty"`
-	UpdateTime     string                                `json:"update_time,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_postgres_catalog.go b/bundle/internal/tf/schema/resource_postgres_catalog.go
deleted file mode 100644
index 637bdaad2c9..00000000000
--- a/bundle/internal/tf/schema/resource_postgres_catalog.go
+++ /dev/null
@@ -1,30 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourcePostgresCatalogProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourcePostgresCatalogSpec struct {
-	Branch                  string `json:"branch,omitempty"`
-	CreateDatabaseIfMissing bool   `json:"create_database_if_missing,omitempty"`
-	PostgresDatabase        string `json:"postgres_database"`
-}
-
-type ResourcePostgresCatalogStatus struct {
-	Branch           string `json:"branch,omitempty"`
-	PostgresDatabase string `json:"postgres_database,omitempty"`
-	Project          string `json:"project,omitempty"`
-}
-
-type ResourcePostgresCatalog struct {
-	CatalogId      string                                 `json:"catalog_id"`
-	CreateTime     string                                 `json:"create_time,omitempty"`
-	Name           string                                 `json:"name,omitempty"`
-	ProviderConfig *ResourcePostgresCatalogProviderConfig `json:"provider_config,omitempty"`
-	Spec           *ResourcePostgresCatalogSpec           `json:"spec,omitempty"`
-	Status         *ResourcePostgresCatalogStatus         `json:"status,omitempty"`
-	Uid            string                                 `json:"uid,omitempty"`
-	UpdateTime     string                                 `json:"update_time,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_postgres_database.go b/bundle/internal/tf/schema/resource_postgres_database.go
deleted file mode 100644
index a12086665d0..00000000000
--- a/bundle/internal/tf/schema/resource_postgres_database.go
+++ /dev/null
@@ -1,28 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourcePostgresDatabaseProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourcePostgresDatabaseSpec struct {
-	PostgresDatabase string `json:"postgres_database,omitempty"`
-	Role             string `json:"role,omitempty"`
-}
-
-type ResourcePostgresDatabaseStatus struct {
-	PostgresDatabase string `json:"postgres_database,omitempty"`
-	Role             string `json:"role,omitempty"`
-}
-
-type ResourcePostgresDatabase struct {
-	CreateTime     string                                  `json:"create_time,omitempty"`
-	DatabaseId     string                                  `json:"database_id,omitempty"`
-	Name           string                                  `json:"name,omitempty"`
-	Parent         string                                  `json:"parent"`
-	ProviderConfig *ResourcePostgresDatabaseProviderConfig `json:"provider_config,omitempty"`
-	Spec           *ResourcePostgresDatabaseSpec           `json:"spec,omitempty"`
-	Status         *ResourcePostgresDatabaseStatus         `json:"status,omitempty"`
-	UpdateTime     string                                  `json:"update_time,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_postgres_endpoint.go b/bundle/internal/tf/schema/resource_postgres_endpoint.go
deleted file mode 100644
index 8de10dd9787..00000000000
--- a/bundle/internal/tf/schema/resource_postgres_endpoint.go
+++ /dev/null
@@ -1,68 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourcePostgresEndpointProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourcePostgresEndpointSpecGroup struct {
-	EnableReadableSecondaries bool `json:"enable_readable_secondaries,omitempty"`
-	Max                       int  `json:"max"`
-	Min                       int  `json:"min"`
-}
-
-type ResourcePostgresEndpointSpecSettings struct {
-	PgSettings map[string]string `json:"pg_settings,omitempty"`
-}
-
-type ResourcePostgresEndpointSpec struct {
-	AutoscalingLimitMaxCu  float64                               `json:"autoscaling_limit_max_cu,omitempty"`
-	AutoscalingLimitMinCu  float64                               `json:"autoscaling_limit_min_cu,omitempty"`
-	Disabled               bool                                  `json:"disabled,omitempty"`
-	EndpointType           string                                `json:"endpoint_type"`
-	Group                  *ResourcePostgresEndpointSpecGroup    `json:"group,omitempty"`
-	NoSuspension           bool                                  `json:"no_suspension,omitempty"`
-	Settings               *ResourcePostgresEndpointSpecSettings `json:"settings,omitempty"`
-	SuspendTimeoutDuration string                                `json:"suspend_timeout_duration,omitempty"`
-}
-
-type ResourcePostgresEndpointStatusGroup struct {
-	EnableReadableSecondaries bool `json:"enable_readable_secondaries,omitempty"`
-	Max                       int  `json:"max"`
-	Min                       int  `json:"min"`
-}
-
-type ResourcePostgresEndpointStatusHosts struct {
-	Host         string `json:"host,omitempty"`
-	ReadOnlyHost string `json:"read_only_host,omitempty"`
-}
-
-type ResourcePostgresEndpointStatusSettings struct {
-	PgSettings map[string]string `json:"pg_settings,omitempty"`
-}
-
-type ResourcePostgresEndpointStatus struct {
-	AutoscalingLimitMaxCu  float64                                 `json:"autoscaling_limit_max_cu,omitempty"`
-	AutoscalingLimitMinCu  float64                                 `json:"autoscaling_limit_min_cu,omitempty"`
-	CurrentState           string                                  `json:"current_state,omitempty"`
-	Disabled               bool                                    `json:"disabled,omitempty"`
-	EndpointType           string                                  `json:"endpoint_type,omitempty"`
-	Group                  *ResourcePostgresEndpointStatusGroup    `json:"group,omitempty"`
-	Hosts                  *ResourcePostgresEndpointStatusHosts    `json:"hosts,omitempty"`
-	PendingState           string                                  `json:"pending_state,omitempty"`
-	Settings               *ResourcePostgresEndpointStatusSettings `json:"settings,omitempty"`
-	SuspendTimeoutDuration string                                  `json:"suspend_timeout_duration,omitempty"`
-}
-
-type ResourcePostgresEndpoint struct {
-	CreateTime     string                                  `json:"create_time,omitempty"`
-	EndpointId     string                                  `json:"endpoint_id"`
-	Name           string                                  `json:"name,omitempty"`
-	Parent         string                                  `json:"parent"`
-	ProviderConfig *ResourcePostgresEndpointProviderConfig `json:"provider_config,omitempty"`
-	Spec           *ResourcePostgresEndpointSpec           `json:"spec,omitempty"`
-	Status         *ResourcePostgresEndpointStatus         `json:"status,omitempty"`
-	Uid            string                                  `json:"uid,omitempty"`
-	UpdateTime     string                                  `json:"update_time,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_postgres_project.go b/bundle/internal/tf/schema/resource_postgres_project.go
deleted file mode 100644
index 1df7ebf5115..00000000000
--- a/bundle/internal/tf/schema/resource_postgres_project.go
+++ /dev/null
@@ -1,80 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourcePostgresProjectInitialEndpointSpecGroup struct {
-	EnableReadableSecondaries bool `json:"enable_readable_secondaries,omitempty"`
-	Max                       int  `json:"max"`
-	Min                       int  `json:"min"`
-}
-
-type ResourcePostgresProjectInitialEndpointSpec struct {
-	Group *ResourcePostgresProjectInitialEndpointSpecGroup `json:"group,omitempty"`
-}
-
-type ResourcePostgresProjectProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourcePostgresProjectSpecCustomTags struct {
-	Key   string `json:"key,omitempty"`
-	Value string `json:"value,omitempty"`
-}
-
-type ResourcePostgresProjectSpecDefaultEndpointSettings struct {
-	AutoscalingLimitMaxCu  float64           `json:"autoscaling_limit_max_cu,omitempty"`
-	AutoscalingLimitMinCu  float64           `json:"autoscaling_limit_min_cu,omitempty"`
-	NoSuspension           bool              `json:"no_suspension,omitempty"`
-	PgSettings             map[string]string `json:"pg_settings,omitempty"`
-	SuspendTimeoutDuration string            `json:"suspend_timeout_duration,omitempty"`
-}
-
-type ResourcePostgresProjectSpec struct {
-	BudgetPolicyId           string                                              `json:"budget_policy_id,omitempty"`
-	CustomTags               []ResourcePostgresProjectSpecCustomTags             `json:"custom_tags,omitempty"`
-	DefaultBranch            string                                              `json:"default_branch,omitempty"`
-	DefaultEndpointSettings  *ResourcePostgresProjectSpecDefaultEndpointSettings `json:"default_endpoint_settings,omitempty"`
-	DisplayName              string                                              `json:"display_name,omitempty"`
-	EnablePgNativeLogin      bool                                                `json:"enable_pg_native_login,omitempty"`
-	HistoryRetentionDuration string                                              `json:"history_retention_duration,omitempty"`
-	PgVersion                int                                                 `json:"pg_version,omitempty"`
-}
-
-type ResourcePostgresProjectStatusCustomTags struct {
-	Key   string `json:"key,omitempty"`
-	Value string `json:"value,omitempty"`
-}
-
-type ResourcePostgresProjectStatusDefaultEndpointSettings struct {
-	AutoscalingLimitMaxCu  float64           `json:"autoscaling_limit_max_cu,omitempty"`
-	AutoscalingLimitMinCu  float64           `json:"autoscaling_limit_min_cu,omitempty"`
-	NoSuspension           bool              `json:"no_suspension,omitempty"`
-	PgSettings             map[string]string `json:"pg_settings,omitempty"`
-	SuspendTimeoutDuration string            `json:"suspend_timeout_duration,omitempty"`
-}
-
-type ResourcePostgresProjectStatus struct {
-	BranchLogicalSizeLimitBytes int                                                   `json:"branch_logical_size_limit_bytes,omitempty"`
-	BudgetPolicyId              string                                                `json:"budget_policy_id,omitempty"`
-	CustomTags                  []ResourcePostgresProjectStatusCustomTags             `json:"custom_tags,omitempty"`
-	DefaultBranch               string                                                `json:"default_branch,omitempty"`
-	DefaultEndpointSettings     *ResourcePostgresProjectStatusDefaultEndpointSettings `json:"default_endpoint_settings,omitempty"`
-	DisplayName                 string                                                `json:"display_name,omitempty"`
-	EnablePgNativeLogin         bool                                                  `json:"enable_pg_native_login,omitempty"`
-	HistoryRetentionDuration    string                                                `json:"history_retention_duration,omitempty"`
-	Owner                       string                                                `json:"owner,omitempty"`
-	PgVersion                   int                                                   `json:"pg_version,omitempty"`
-	SyntheticStorageSizeBytes   int                                                   `json:"synthetic_storage_size_bytes,omitempty"`
-}
-
-type ResourcePostgresProject struct {
-	CreateTime          string                                      `json:"create_time,omitempty"`
-	InitialEndpointSpec *ResourcePostgresProjectInitialEndpointSpec `json:"initial_endpoint_spec,omitempty"`
-	Name                string                                      `json:"name,omitempty"`
-	ProjectId           string                                      `json:"project_id"`
-	ProviderConfig      *ResourcePostgresProjectProviderConfig      `json:"provider_config,omitempty"`
-	Spec                *ResourcePostgresProjectSpec                `json:"spec,omitempty"`
-	Status              *ResourcePostgresProjectStatus              `json:"status,omitempty"`
-	Uid                 string                                      `json:"uid,omitempty"`
-	UpdateTime          string                                      `json:"update_time,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_postgres_role.go b/bundle/internal/tf/schema/resource_postgres_role.go
deleted file mode 100644
index a7dce0a9bdc..00000000000
--- a/bundle/internal/tf/schema/resource_postgres_role.go
+++ /dev/null
@@ -1,46 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourcePostgresRoleProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourcePostgresRoleSpecAttributes struct {
-	Bypassrls  bool `json:"bypassrls,omitempty"`
-	Createdb   bool `json:"createdb,omitempty"`
-	Createrole bool `json:"createrole,omitempty"`
-}
-
-type ResourcePostgresRoleSpec struct {
-	Attributes      *ResourcePostgresRoleSpecAttributes `json:"attributes,omitempty"`
-	AuthMethod      string                              `json:"auth_method,omitempty"`
-	IdentityType    string                              `json:"identity_type,omitempty"`
-	MembershipRoles []string                            `json:"membership_roles,omitempty"`
-	PostgresRole    string                              `json:"postgres_role,omitempty"`
-}
-
-type ResourcePostgresRoleStatusAttributes struct {
-	Bypassrls  bool `json:"bypassrls,omitempty"`
-	Createdb   bool `json:"createdb,omitempty"`
-	Createrole bool `json:"createrole,omitempty"`
-}
-
-type ResourcePostgresRoleStatus struct {
-	Attributes      *ResourcePostgresRoleStatusAttributes `json:"attributes,omitempty"`
-	AuthMethod      string                                `json:"auth_method,omitempty"`
-	IdentityType    string                                `json:"identity_type,omitempty"`
-	MembershipRoles []string                              `json:"membership_roles,omitempty"`
-	PostgresRole    string                                `json:"postgres_role,omitempty"`
-}
-
-type ResourcePostgresRole struct {
-	CreateTime     string                              `json:"create_time,omitempty"`
-	Name           string                              `json:"name,omitempty"`
-	Parent         string                              `json:"parent"`
-	ProviderConfig *ResourcePostgresRoleProviderConfig `json:"provider_config,omitempty"`
-	RoleId         string                              `json:"role_id,omitempty"`
-	Spec           *ResourcePostgresRoleSpec           `json:"spec,omitempty"`
-	Status         *ResourcePostgresRoleStatus         `json:"status,omitempty"`
-	UpdateTime     string                              `json:"update_time,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_postgres_synced_table.go b/bundle/internal/tf/schema/resource_postgres_synced_table.go
deleted file mode 100644
index eed810c301a..00000000000
--- a/bundle/internal/tf/schema/resource_postgres_synced_table.go
+++ /dev/null
@@ -1,66 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourcePostgresSyncedTableProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourcePostgresSyncedTableSpecNewPipelineSpec struct {
-	BudgetPolicyId string `json:"budget_policy_id,omitempty"`
-	StorageCatalog string `json:"storage_catalog,omitempty"`
-	StorageSchema  string `json:"storage_schema,omitempty"`
-}
-
-type ResourcePostgresSyncedTableSpec struct {
-	Branch                         string                                          `json:"branch,omitempty"`
-	CreateDatabaseObjectsIfMissing bool                                            `json:"create_database_objects_if_missing,omitempty"`
-	ExistingPipelineId             string                                          `json:"existing_pipeline_id,omitempty"`
-	NewPipelineSpec                *ResourcePostgresSyncedTableSpecNewPipelineSpec `json:"new_pipeline_spec,omitempty"`
-	PostgresDatabase               string                                          `json:"postgres_database,omitempty"`
-	PrimaryKeyColumns              []string                                        `json:"primary_key_columns,omitempty"`
-	SchedulingPolicy               string                                          `json:"scheduling_policy,omitempty"`
-	SourceTableFullName            string                                          `json:"source_table_full_name,omitempty"`
-	TimeseriesKey                  string                                          `json:"timeseries_key,omitempty"`
-}
-
-type ResourcePostgresSyncedTableStatusLastSyncDeltaTableSyncInfo struct {
-	DeltaCommitTime    string `json:"delta_commit_time,omitempty"`
-	DeltaCommitVersion int    `json:"delta_commit_version,omitempty"`
-}
-
-type ResourcePostgresSyncedTableStatusLastSync struct {
-	DeltaTableSyncInfo *ResourcePostgresSyncedTableStatusLastSyncDeltaTableSyncInfo `json:"delta_table_sync_info,omitempty"`
-	SyncEndTime        string                                                       `json:"sync_end_time,omitempty"`
-	SyncStartTime      string                                                       `json:"sync_start_time,omitempty"`
-}
-
-type ResourcePostgresSyncedTableStatusOngoingSyncProgress struct {
-	EstimatedCompletionTimeSeconds   int `json:"estimated_completion_time_seconds,omitempty"`
-	LatestVersionCurrentlyProcessing int `json:"latest_version_currently_processing,omitempty"`
-	SyncProgressCompletion           int `json:"sync_progress_completion,omitempty"`
-	SyncedRowCount                   int `json:"synced_row_count,omitempty"`
-	TotalRowCount                    int `json:"total_row_count,omitempty"`
-}
-
-type ResourcePostgresSyncedTableStatus struct {
-	DetailedState                 string                                                `json:"detailed_state,omitempty"`
-	LastProcessedCommitVersion    int                                                   `json:"last_processed_commit_version,omitempty"`
-	LastSync                      *ResourcePostgresSyncedTableStatusLastSync            `json:"last_sync,omitempty"`
-	LastSyncTime                  string                                                `json:"last_sync_time,omitempty"`
-	Message                       string                                                `json:"message,omitempty"`
-	OngoingSyncProgress           *ResourcePostgresSyncedTableStatusOngoingSyncProgress `json:"ongoing_sync_progress,omitempty"`
-	PipelineId                    string                                                `json:"pipeline_id,omitempty"`
-	ProvisioningPhase             string                                                `json:"provisioning_phase,omitempty"`
-	UnityCatalogProvisioningState string                                                `json:"unity_catalog_provisioning_state,omitempty"`
-}
-
-type ResourcePostgresSyncedTable struct {
-	CreateTime     string                                     `json:"create_time,omitempty"`
-	Name           string                                     `json:"name,omitempty"`
-	ProviderConfig *ResourcePostgresSyncedTableProviderConfig `json:"provider_config,omitempty"`
-	Spec           *ResourcePostgresSyncedTableSpec           `json:"spec,omitempty"`
-	Status         *ResourcePostgresSyncedTableStatus         `json:"status,omitempty"`
-	SyncedTableId  string                                     `json:"synced_table_id"`
-	Uid            string                                     `json:"uid,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_provider.go b/bundle/internal/tf/schema/resource_provider.go
deleted file mode 100644
index 16934efa7f4..00000000000
--- a/bundle/internal/tf/schema/resource_provider.go
+++ /dev/null
@@ -1,16 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceProviderProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceProvider struct {
-	AuthenticationType  string                          `json:"authentication_type"`
-	Comment             string                          `json:"comment,omitempty"`
-	Id                  string                          `json:"id,omitempty"`
-	Name                string                          `json:"name"`
-	RecipientProfileStr string                          `json:"recipient_profile_str"`
-	ProviderConfig      *ResourceProviderProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_quality_monitor.go b/bundle/internal/tf/schema/resource_quality_monitor.go
deleted file mode 100644
index a83a33a6bdf..00000000000
--- a/bundle/internal/tf/schema/resource_quality_monitor.go
+++ /dev/null
@@ -1,75 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceQualityMonitorCustomMetrics struct {
-	Definition     string   `json:"definition"`
-	InputColumns   []string `json:"input_columns"`
-	Name           string   `json:"name"`
-	OutputDataType string   `json:"output_data_type"`
-	Type           string   `json:"type"`
-}
-
-type ResourceQualityMonitorDataClassificationConfig struct {
-	Enabled bool `json:"enabled,omitempty"`
-}
-
-type ResourceQualityMonitorInferenceLog struct {
-	Granularities      []string `json:"granularities"`
-	LabelCol           string   `json:"label_col,omitempty"`
-	ModelIdCol         string   `json:"model_id_col"`
-	PredictionCol      string   `json:"prediction_col"`
-	PredictionProbaCol string   `json:"prediction_proba_col,omitempty"`
-	ProblemType        string   `json:"problem_type"`
-	TimestampCol       string   `json:"timestamp_col"`
-}
-
-type ResourceQualityMonitorNotificationsOnFailure struct {
-	EmailAddresses []string `json:"email_addresses,omitempty"`
-}
-
-type ResourceQualityMonitorNotificationsOnNewClassificationTagDetected struct {
-	EmailAddresses []string `json:"email_addresses,omitempty"`
-}
-
-type ResourceQualityMonitorNotifications struct {
-	OnFailure                      *ResourceQualityMonitorNotificationsOnFailure                      `json:"on_failure,omitempty"`
-	OnNewClassificationTagDetected *ResourceQualityMonitorNotificationsOnNewClassificationTagDetected `json:"on_new_classification_tag_detected,omitempty"`
-}
-
-type ResourceQualityMonitorSchedule struct {
-	PauseStatus          string `json:"pause_status,omitempty"`
-	QuartzCronExpression string `json:"quartz_cron_expression"`
-	TimezoneId           string `json:"timezone_id"`
-}
-
-type ResourceQualityMonitorSnapshot struct{}
-
-type ResourceQualityMonitorTimeSeries struct {
-	Granularities []string `json:"granularities"`
-	TimestampCol  string   `json:"timestamp_col"`
-}
-
-type ResourceQualityMonitor struct {
-	AssetsDir                string                                          `json:"assets_dir"`
-	BaselineTableName        string                                          `json:"baseline_table_name,omitempty"`
-	DashboardId              string                                          `json:"dashboard_id,omitempty"`
-	DriftMetricsTableName    string                                          `json:"drift_metrics_table_name,omitempty"`
-	Id                       string                                          `json:"id,omitempty"`
-	LatestMonitorFailureMsg  string                                          `json:"latest_monitor_failure_msg,omitempty"`
-	MonitorVersion           int                                             `json:"monitor_version,omitempty"`
-	OutputSchemaName         string                                          `json:"output_schema_name"`
-	ProfileMetricsTableName  string                                          `json:"profile_metrics_table_name,omitempty"`
-	SkipBuiltinDashboard     bool                                            `json:"skip_builtin_dashboard,omitempty"`
-	SlicingExprs             []string                                        `json:"slicing_exprs,omitempty"`
-	Status                   string                                          `json:"status,omitempty"`
-	TableName                string                                          `json:"table_name"`
-	WarehouseId              string                                          `json:"warehouse_id,omitempty"`
-	CustomMetrics            []ResourceQualityMonitorCustomMetrics           `json:"custom_metrics,omitempty"`
-	DataClassificationConfig *ResourceQualityMonitorDataClassificationConfig `json:"data_classification_config,omitempty"`
-	InferenceLog             *ResourceQualityMonitorInferenceLog             `json:"inference_log,omitempty"`
-	Notifications            *ResourceQualityMonitorNotifications            `json:"notifications,omitempty"`
-	Schedule                 *ResourceQualityMonitorSchedule                 `json:"schedule,omitempty"`
-	Snapshot                 *ResourceQualityMonitorSnapshot                 `json:"snapshot,omitempty"`
-	TimeSeries               *ResourceQualityMonitorTimeSeries               `json:"time_series,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_quality_monitor_v2.go b/bundle/internal/tf/schema/resource_quality_monitor_v2.go
deleted file mode 100644
index 80e73326f4a..00000000000
--- a/bundle/internal/tf/schema/resource_quality_monitor_v2.go
+++ /dev/null
@@ -1,43 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceQualityMonitorV2AnomalyDetectionConfig struct {
-	ExcludedTableFullNames []string `json:"excluded_table_full_names,omitempty"`
-	LastRunId              string   `json:"last_run_id,omitempty"`
-	LatestRunStatus        string   `json:"latest_run_status,omitempty"`
-}
-
-type ResourceQualityMonitorV2ProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceQualityMonitorV2ValidityCheckConfigurationsPercentNullValidityCheck struct {
-	ColumnNames []string `json:"column_names,omitempty"`
-	UpperBound  int      `json:"upper_bound,omitempty"`
-}
-
-type ResourceQualityMonitorV2ValidityCheckConfigurationsRangeValidityCheck struct {
-	ColumnNames []string `json:"column_names,omitempty"`
-	LowerBound  int      `json:"lower_bound,omitempty"`
-	UpperBound  int      `json:"upper_bound,omitempty"`
-}
-
-type ResourceQualityMonitorV2ValidityCheckConfigurationsUniquenessValidityCheck struct {
-	ColumnNames []string `json:"column_names,omitempty"`
-}
-
-type ResourceQualityMonitorV2ValidityCheckConfigurations struct {
-	Name                     string                                                                       `json:"name,omitempty"`
-	PercentNullValidityCheck *ResourceQualityMonitorV2ValidityCheckConfigurationsPercentNullValidityCheck `json:"percent_null_validity_check,omitempty"`
-	RangeValidityCheck       *ResourceQualityMonitorV2ValidityCheckConfigurationsRangeValidityCheck       `json:"range_validity_check,omitempty"`
-	UniquenessValidityCheck  *ResourceQualityMonitorV2ValidityCheckConfigurationsUniquenessValidityCheck  `json:"uniqueness_validity_check,omitempty"`
-}
-
-type ResourceQualityMonitorV2 struct {
-	AnomalyDetectionConfig      *ResourceQualityMonitorV2AnomalyDetectionConfig       `json:"anomaly_detection_config,omitempty"`
-	ObjectId                    string                                                `json:"object_id"`
-	ObjectType                  string                                                `json:"object_type"`
-	ProviderConfig              *ResourceQualityMonitorV2ProviderConfig               `json:"provider_config,omitempty"`
-	ValidityCheckConfigurations []ResourceQualityMonitorV2ValidityCheckConfigurations `json:"validity_check_configurations,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_query.go b/bundle/internal/tf/schema/resource_query.go
deleted file mode 100644
index d5ccd6bb590..00000000000
--- a/bundle/internal/tf/schema/resource_query.go
+++ /dev/null
@@ -1,89 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceQueryParameterDateRangeValueDateRangeValue struct {
-	End   string `json:"end"`
-	Start string `json:"start"`
-}
-
-type ResourceQueryParameterDateRangeValue struct {
-	DynamicDateRangeValue string                                              `json:"dynamic_date_range_value,omitempty"`
-	Precision             string                                              `json:"precision,omitempty"`
-	StartDayOfWeek        int                                                 `json:"start_day_of_week,omitempty"`
-	DateRangeValue        *ResourceQueryParameterDateRangeValueDateRangeValue `json:"date_range_value,omitempty"`
-}
-
-type ResourceQueryParameterDateValue struct {
-	DateValue        string `json:"date_value,omitempty"`
-	DynamicDateValue string `json:"dynamic_date_value,omitempty"`
-	Precision        string `json:"precision,omitempty"`
-}
-
-type ResourceQueryParameterEnumValueMultiValuesOptions struct {
-	Prefix    string `json:"prefix,omitempty"`
-	Separator string `json:"separator,omitempty"`
-	Suffix    string `json:"suffix,omitempty"`
-}
-
-type ResourceQueryParameterEnumValue struct {
-	EnumOptions        string                                             `json:"enum_options,omitempty"`
-	Values             []string                                           `json:"values,omitempty"`
-	MultiValuesOptions *ResourceQueryParameterEnumValueMultiValuesOptions `json:"multi_values_options,omitempty"`
-}
-
-type ResourceQueryParameterNumericValue struct {
-	Value int `json:"value"`
-}
-
-type ResourceQueryParameterQueryBackedValueMultiValuesOptions struct {
-	Prefix    string `json:"prefix,omitempty"`
-	Separator string `json:"separator,omitempty"`
-	Suffix    string `json:"suffix,omitempty"`
-}
-
-type ResourceQueryParameterQueryBackedValue struct {
-	QueryId            string                                                    `json:"query_id"`
-	Values             []string                                                  `json:"values,omitempty"`
-	MultiValuesOptions *ResourceQueryParameterQueryBackedValueMultiValuesOptions `json:"multi_values_options,omitempty"`
-}
-
-type ResourceQueryParameterTextValue struct {
-	Value string `json:"value"`
-}
-
-type ResourceQueryParameter struct {
-	Name             string                                  `json:"name"`
-	Title            string                                  `json:"title,omitempty"`
-	DateRangeValue   *ResourceQueryParameterDateRangeValue   `json:"date_range_value,omitempty"`
-	DateValue        *ResourceQueryParameterDateValue        `json:"date_value,omitempty"`
-	EnumValue        *ResourceQueryParameterEnumValue        `json:"enum_value,omitempty"`
-	NumericValue     *ResourceQueryParameterNumericValue     `json:"numeric_value,omitempty"`
-	QueryBackedValue *ResourceQueryParameterQueryBackedValue `json:"query_backed_value,omitempty"`
-	TextValue        *ResourceQueryParameterTextValue        `json:"text_value,omitempty"`
-}
-
-type ResourceQueryProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceQuery struct {
-	ApplyAutoLimit       bool                         `json:"apply_auto_limit,omitempty"`
-	Catalog              string                       `json:"catalog,omitempty"`
-	CreateTime           string                       `json:"create_time,omitempty"`
-	Description          string                       `json:"description,omitempty"`
-	DisplayName          string                       `json:"display_name"`
-	Id                   string                       `json:"id,omitempty"`
-	LastModifierUserName string                       `json:"last_modifier_user_name,omitempty"`
-	LifecycleState       string                       `json:"lifecycle_state,omitempty"`
-	OwnerUserName        string                       `json:"owner_user_name,omitempty"`
-	ParentPath           string                       `json:"parent_path,omitempty"`
-	QueryText            string                       `json:"query_text"`
-	RunAsMode            string                       `json:"run_as_mode,omitempty"`
-	Schema               string                       `json:"schema,omitempty"`
-	Tags                 []string                     `json:"tags,omitempty"`
-	UpdateTime           string                       `json:"update_time,omitempty"`
-	WarehouseId          string                       `json:"warehouse_id"`
-	Parameter            []ResourceQueryParameter     `json:"parameter,omitempty"`
-	ProviderConfig       *ResourceQueryProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_recipient.go b/bundle/internal/tf/schema/resource_recipient.go
deleted file mode 100644
index 58dc1512653..00000000000
--- a/bundle/internal/tf/schema/resource_recipient.go
+++ /dev/null
@@ -1,49 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceRecipientIpAccessList struct {
-	AllowedIpAddresses []string `json:"allowed_ip_addresses,omitempty"`
-}
-
-type ResourceRecipientPropertiesKvpairs struct {
-	Properties map[string]string `json:"properties"`
-}
-
-type ResourceRecipientProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceRecipientTokens struct {
-	ActivationUrl  string `json:"activation_url,omitempty"`
-	CreatedAt      int    `json:"created_at,omitempty"`
-	CreatedBy      string `json:"created_by,omitempty"`
-	ExpirationTime int    `json:"expiration_time,omitempty"`
-	Id             string `json:"id,omitempty"`
-	UpdatedAt      int    `json:"updated_at,omitempty"`
-	UpdatedBy      string `json:"updated_by,omitempty"`
-}
-
-type ResourceRecipient struct {
-	Activated                      bool                                `json:"activated,omitempty"`
-	ActivationUrl                  string                              `json:"activation_url,omitempty"`
-	AuthenticationType             string                              `json:"authentication_type"`
-	Cloud                          string                              `json:"cloud,omitempty"`
-	Comment                        string                              `json:"comment,omitempty"`
-	CreatedAt                      int                                 `json:"created_at,omitempty"`
-	CreatedBy                      string                              `json:"created_by,omitempty"`
-	DataRecipientGlobalMetastoreId string                              `json:"data_recipient_global_metastore_id,omitempty"`
-	ExpirationTime                 int                                 `json:"expiration_time,omitempty"`
-	Id                             string                              `json:"id,omitempty"`
-	MetastoreId                    string                              `json:"metastore_id,omitempty"`
-	Name                           string                              `json:"name"`
-	Owner                          string                              `json:"owner,omitempty"`
-	Region                         string                              `json:"region,omitempty"`
-	SharingCode                    string                              `json:"sharing_code,omitempty"`
-	UpdatedAt                      int                                 `json:"updated_at,omitempty"`
-	UpdatedBy                      string                              `json:"updated_by,omitempty"`
-	IpAccessList                   *ResourceRecipientIpAccessList      `json:"ip_access_list,omitempty"`
-	PropertiesKvpairs              *ResourceRecipientPropertiesKvpairs `json:"properties_kvpairs,omitempty"`
-	ProviderConfig                 *ResourceRecipientProviderConfig    `json:"provider_config,omitempty"`
-	Tokens                         []ResourceRecipientTokens           `json:"tokens,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_recipient_federation_policy.go b/bundle/internal/tf/schema/resource_recipient_federation_policy.go
deleted file mode 100644
index 8fdfa9acbd7..00000000000
--- a/bundle/internal/tf/schema/resource_recipient_federation_policy.go
+++ /dev/null
@@ -1,19 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceRecipientFederationPolicyOidcPolicy struct {
-	Audiences    []string `json:"audiences,omitempty"`
-	Issuer       string   `json:"issuer"`
-	Subject      string   `json:"subject"`
-	SubjectClaim string   `json:"subject_claim"`
-}
-
-type ResourceRecipientFederationPolicy struct {
-	Comment    string                                       `json:"comment,omitempty"`
-	CreateTime string                                       `json:"create_time,omitempty"`
-	Id         string                                       `json:"id,omitempty"`
-	Name       string                                       `json:"name,omitempty"`
-	OidcPolicy *ResourceRecipientFederationPolicyOidcPolicy `json:"oidc_policy,omitempty"`
-	UpdateTime string                                       `json:"update_time,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_registered_model.go b/bundle/internal/tf/schema/resource_registered_model.go
deleted file mode 100644
index 542a1b0c585..00000000000
--- a/bundle/internal/tf/schema/resource_registered_model.go
+++ /dev/null
@@ -1,35 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceRegisteredModelAliases struct {
-	AliasName   string `json:"alias_name,omitempty"`
-	CatalogName string `json:"catalog_name,omitempty"`
-	Id          string `json:"id,omitempty"`
-	ModelName   string `json:"model_name,omitempty"`
-	SchemaName  string `json:"schema_name,omitempty"`
-	VersionNum  int    `json:"version_num,omitempty"`
-}
-
-type ResourceRegisteredModelProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceRegisteredModel struct {
-	BrowseOnly      bool                                   `json:"browse_only,omitempty"`
-	CatalogName     string                                 `json:"catalog_name,omitempty"`
-	Comment         string                                 `json:"comment,omitempty"`
-	CreatedAt       int                                    `json:"created_at,omitempty"`
-	CreatedBy       string                                 `json:"created_by,omitempty"`
-	FullName        string                                 `json:"full_name,omitempty"`
-	Id              string                                 `json:"id,omitempty"`
-	MetastoreId     string                                 `json:"metastore_id,omitempty"`
-	Name            string                                 `json:"name,omitempty"`
-	Owner           string                                 `json:"owner,omitempty"`
-	SchemaName      string                                 `json:"schema_name,omitempty"`
-	StorageLocation string                                 `json:"storage_location,omitempty"`
-	UpdatedAt       int                                    `json:"updated_at,omitempty"`
-	UpdatedBy       string                                 `json:"updated_by,omitempty"`
-	Aliases         []ResourceRegisteredModelAliases       `json:"aliases,omitempty"`
-	ProviderConfig  *ResourceRegisteredModelProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_repo.go b/bundle/internal/tf/schema/resource_repo.go
deleted file mode 100644
index e1a5ff8fef3..00000000000
--- a/bundle/internal/tf/schema/resource_repo.go
+++ /dev/null
@@ -1,24 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceRepoProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceRepoSparseCheckout struct {
-	Patterns []string `json:"patterns"`
-}
-
-type ResourceRepo struct {
-	Branch         string                      `json:"branch,omitempty"`
-	CommitHash     string                      `json:"commit_hash,omitempty"`
-	GitProvider    string                      `json:"git_provider,omitempty"`
-	Id             string                      `json:"id,omitempty"`
-	Path           string                      `json:"path,omitempty"`
-	Tag            string                      `json:"tag,omitempty"`
-	Url            string                      `json:"url"`
-	WorkspacePath  string                      `json:"workspace_path,omitempty"`
-	ProviderConfig *ResourceRepoProviderConfig `json:"provider_config,omitempty"`
-	SparseCheckout *ResourceRepoSparseCheckout `json:"sparse_checkout,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_restrict_workspace_admins_setting.go b/bundle/internal/tf/schema/resource_restrict_workspace_admins_setting.go
deleted file mode 100644
index b539201216e..00000000000
--- a/bundle/internal/tf/schema/resource_restrict_workspace_admins_setting.go
+++ /dev/null
@@ -1,20 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceRestrictWorkspaceAdminsSettingProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceRestrictWorkspaceAdminsSettingRestrictWorkspaceAdmins struct {
-	DisableGovTagCreation bool   `json:"disable_gov_tag_creation,omitempty"`
-	Status                string `json:"status"`
-}
-
-type ResourceRestrictWorkspaceAdminsSetting struct {
-	Etag                    string                                                         `json:"etag,omitempty"`
-	Id                      string                                                         `json:"id,omitempty"`
-	SettingName             string                                                         `json:"setting_name,omitempty"`
-	ProviderConfig          *ResourceRestrictWorkspaceAdminsSettingProviderConfig          `json:"provider_config,omitempty"`
-	RestrictWorkspaceAdmins *ResourceRestrictWorkspaceAdminsSettingRestrictWorkspaceAdmins `json:"restrict_workspace_admins,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_rfa_access_request_destinations.go b/bundle/internal/tf/schema/resource_rfa_access_request_destinations.go
deleted file mode 100644
index bafb8d49faf..00000000000
--- a/bundle/internal/tf/schema/resource_rfa_access_request_destinations.go
+++ /dev/null
@@ -1,35 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceRfaAccessRequestDestinationsDestinationSourceSecurable struct {
-	FullName      string `json:"full_name,omitempty"`
-	ProviderShare string `json:"provider_share,omitempty"`
-	Type          string `json:"type,omitempty"`
-}
-
-type ResourceRfaAccessRequestDestinationsDestinations struct {
-	DestinationId      string `json:"destination_id,omitempty"`
-	DestinationType    string `json:"destination_type,omitempty"`
-	SpecialDestination string `json:"special_destination,omitempty"`
-}
-
-type ResourceRfaAccessRequestDestinationsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceRfaAccessRequestDestinationsSecurable struct {
-	FullName      string `json:"full_name,omitempty"`
-	ProviderShare string `json:"provider_share,omitempty"`
-	Type          string `json:"type,omitempty"`
-}
-
-type ResourceRfaAccessRequestDestinations struct {
-	AreAnyDestinationsHidden   bool                                                            `json:"are_any_destinations_hidden,omitempty"`
-	DestinationSourceSecurable *ResourceRfaAccessRequestDestinationsDestinationSourceSecurable `json:"destination_source_securable,omitempty"`
-	Destinations               []ResourceRfaAccessRequestDestinationsDestinations              `json:"destinations,omitempty"`
-	FullName                   string                                                          `json:"full_name,omitempty"`
-	ProviderConfig             *ResourceRfaAccessRequestDestinationsProviderConfig             `json:"provider_config,omitempty"`
-	Securable                  *ResourceRfaAccessRequestDestinationsSecurable                  `json:"securable,omitempty"`
-	SecurableType              string                                                          `json:"securable_type,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_schema.go b/bundle/internal/tf/schema/resource_schema.go
deleted file mode 100644
index efb4c9bf44d..00000000000
--- a/bundle/internal/tf/schema/resource_schema.go
+++ /dev/null
@@ -1,22 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceSchemaProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceSchema struct {
-	CatalogName                  string                        `json:"catalog_name"`
-	Comment                      string                        `json:"comment,omitempty"`
-	EnablePredictiveOptimization string                        `json:"enable_predictive_optimization,omitempty"`
-	ForceDestroy                 bool                          `json:"force_destroy,omitempty"`
-	Id                           string                        `json:"id,omitempty"`
-	MetastoreId                  string                        `json:"metastore_id,omitempty"`
-	Name                         string                        `json:"name"`
-	Owner                        string                        `json:"owner,omitempty"`
-	Properties                   map[string]string             `json:"properties,omitempty"`
-	SchemaId                     string                        `json:"schema_id,omitempty"`
-	StorageRoot                  string                        `json:"storage_root,omitempty"`
-	ProviderConfig               *ResourceSchemaProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_secret.go b/bundle/internal/tf/schema/resource_secret.go
deleted file mode 100644
index 02dddfa232a..00000000000
--- a/bundle/internal/tf/schema/resource_secret.go
+++ /dev/null
@@ -1,17 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceSecretProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceSecret struct {
-	ConfigReference      string                        `json:"config_reference,omitempty"`
-	Id                   string                        `json:"id,omitempty"`
-	Key                  string                        `json:"key"`
-	LastUpdatedTimestamp int                           `json:"last_updated_timestamp,omitempty"`
-	Scope                string                        `json:"scope"`
-	StringValue          string                        `json:"string_value"`
-	ProviderConfig       *ResourceSecretProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_secret_acl.go b/bundle/internal/tf/schema/resource_secret_acl.go
deleted file mode 100644
index 873e82f5d11..00000000000
--- a/bundle/internal/tf/schema/resource_secret_acl.go
+++ /dev/null
@@ -1,15 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceSecretAclProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceSecretAcl struct {
-	Id             string                           `json:"id,omitempty"`
-	Permission     string                           `json:"permission"`
-	Principal      string                           `json:"principal"`
-	Scope          string                           `json:"scope"`
-	ProviderConfig *ResourceSecretAclProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_secret_scope.go b/bundle/internal/tf/schema/resource_secret_scope.go
deleted file mode 100644
index ca539d8d027..00000000000
--- a/bundle/internal/tf/schema/resource_secret_scope.go
+++ /dev/null
@@ -1,21 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceSecretScopeKeyvaultMetadata struct {
-	DnsName    string `json:"dns_name"`
-	ResourceId string `json:"resource_id"`
-}
-
-type ResourceSecretScopeProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceSecretScope struct {
-	BackendType            string                               `json:"backend_type,omitempty"`
-	Id                     string                               `json:"id,omitempty"`
-	InitialManagePrincipal string                               `json:"initial_manage_principal,omitempty"`
-	Name                   string                               `json:"name"`
-	KeyvaultMetadata       *ResourceSecretScopeKeyvaultMetadata `json:"keyvault_metadata,omitempty"`
-	ProviderConfig         *ResourceSecretScopeProviderConfig   `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_service_principal.go b/bundle/internal/tf/schema/resource_service_principal.go
deleted file mode 100644
index 231eccf3b15..00000000000
--- a/bundle/internal/tf/schema/resource_service_principal.go
+++ /dev/null
@@ -1,29 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceServicePrincipalProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceServicePrincipal struct {
-	AclPrincipalId          string                                  `json:"acl_principal_id,omitempty"`
-	Active                  bool                                    `json:"active,omitempty"`
-	AllowClusterCreate      bool                                    `json:"allow_cluster_create,omitempty"`
-	AllowInstancePoolCreate bool                                    `json:"allow_instance_pool_create,omitempty"`
-	Api                     string                                  `json:"api,omitempty"`
-	ApplicationId           string                                  `json:"application_id,omitempty"`
-	DatabricksSqlAccess     bool                                    `json:"databricks_sql_access,omitempty"`
-	DisableAsUserDeletion   bool                                    `json:"disable_as_user_deletion,omitempty"`
-	DisplayName             string                                  `json:"display_name,omitempty"`
-	ExternalId              string                                  `json:"external_id,omitempty"`
-	Force                   bool                                    `json:"force,omitempty"`
-	ForceDeleteHomeDir      bool                                    `json:"force_delete_home_dir,omitempty"`
-	ForceDeleteRepos        bool                                    `json:"force_delete_repos,omitempty"`
-	Home                    string                                  `json:"home,omitempty"`
-	Id                      string                                  `json:"id,omitempty"`
-	Repos                   string                                  `json:"repos,omitempty"`
-	WorkspaceAccess         bool                                    `json:"workspace_access,omitempty"`
-	WorkspaceConsume        bool                                    `json:"workspace_consume,omitempty"`
-	ProviderConfig          *ResourceServicePrincipalProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_service_principal_federation_policy.go b/bundle/internal/tf/schema/resource_service_principal_federation_policy.go
deleted file mode 100644
index d10a2957f6a..00000000000
--- a/bundle/internal/tf/schema/resource_service_principal_federation_policy.go
+++ /dev/null
@@ -1,23 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceServicePrincipalFederationPolicyOidcPolicy struct {
-	Audiences    []string `json:"audiences,omitempty"`
-	Issuer       string   `json:"issuer,omitempty"`
-	JwksJson     string   `json:"jwks_json,omitempty"`
-	JwksUri      string   `json:"jwks_uri,omitempty"`
-	Subject      string   `json:"subject,omitempty"`
-	SubjectClaim string   `json:"subject_claim,omitempty"`
-}
-
-type ResourceServicePrincipalFederationPolicy struct {
-	CreateTime         string                                              `json:"create_time,omitempty"`
-	Description        string                                              `json:"description,omitempty"`
-	Name               string                                              `json:"name,omitempty"`
-	OidcPolicy         *ResourceServicePrincipalFederationPolicyOidcPolicy `json:"oidc_policy,omitempty"`
-	PolicyId           string                                              `json:"policy_id,omitempty"`
-	ServicePrincipalId int                                                 `json:"service_principal_id,omitempty"`
-	Uid                string                                              `json:"uid,omitempty"`
-	UpdateTime         string                                              `json:"update_time,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_service_principal_role.go b/bundle/internal/tf/schema/resource_service_principal_role.go
deleted file mode 100644
index 3da75ea081e..00000000000
--- a/bundle/internal/tf/schema/resource_service_principal_role.go
+++ /dev/null
@@ -1,15 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceServicePrincipalRoleProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceServicePrincipalRole struct {
-	Api                string                                      `json:"api,omitempty"`
-	Id                 string                                      `json:"id,omitempty"`
-	Role               string                                      `json:"role"`
-	ServicePrincipalId string                                      `json:"service_principal_id"`
-	ProviderConfig     *ResourceServicePrincipalRoleProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_service_principal_secret.go b/bundle/internal/tf/schema/resource_service_principal_secret.go
deleted file mode 100644
index 7e6559cf908..00000000000
--- a/bundle/internal/tf/schema/resource_service_principal_secret.go
+++ /dev/null
@@ -1,22 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceServicePrincipalSecretProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceServicePrincipalSecret struct {
-	Api                string                                        `json:"api,omitempty"`
-	CreateTime         string                                        `json:"create_time,omitempty"`
-	ExpireTime         string                                        `json:"expire_time,omitempty"`
-	Id                 string                                        `json:"id,omitempty"`
-	Lifetime           string                                        `json:"lifetime,omitempty"`
-	Secret             string                                        `json:"secret,omitempty"`
-	SecretHash         string                                        `json:"secret_hash,omitempty"`
-	ServicePrincipalId string                                        `json:"service_principal_id"`
-	Status             string                                        `json:"status,omitempty"`
-	TimeRotating       string                                        `json:"time_rotating,omitempty"`
-	UpdateTime         string                                        `json:"update_time,omitempty"`
-	ProviderConfig     *ResourceServicePrincipalSecretProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_share.go b/bundle/internal/tf/schema/resource_share.go
deleted file mode 100644
index 65f18b34bad..00000000000
--- a/bundle/internal/tf/schema/resource_share.go
+++ /dev/null
@@ -1,55 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceShareObjectPartitionValue struct {
-	Name                 string `json:"name"`
-	Op                   string `json:"op"`
-	RecipientPropertyKey string `json:"recipient_property_key,omitempty"`
-	Value                string `json:"value,omitempty"`
-}
-
-type ResourceShareObjectPartition struct {
-	Value []ResourceShareObjectPartitionValue `json:"value,omitempty"`
-}
-
-type ResourceShareObject struct {
-	AddedAt                           int                            `json:"added_at,omitempty"`
-	AddedBy                           string                         `json:"added_by,omitempty"`
-	CdfEnabled                        bool                           `json:"cdf_enabled,omitempty"`
-	Comment                           string                         `json:"comment,omitempty"`
-	Content                           string                         `json:"content,omitempty"`
-	DataObjectType                    string                         `json:"data_object_type"`
-	EffectiveCdfEnabled               bool                           `json:"effective_cdf_enabled,omitempty"`
-	EffectiveHistoryDataSharingStatus string                         `json:"effective_history_data_sharing_status,omitempty"`
-	EffectiveSharedAs                 string                         `json:"effective_shared_as,omitempty"`
-	EffectiveStartVersion             int                            `json:"effective_start_version,omitempty"`
-	EffectiveStringSharedAs           string                         `json:"effective_string_shared_as,omitempty"`
-	HistoryDataSharingStatus          string                         `json:"history_data_sharing_status,omitempty"`
-	Name                              string                         `json:"name"`
-	SharedAs                          string                         `json:"shared_as,omitempty"`
-	StartVersion                      int                            `json:"start_version,omitempty"`
-	Status                            string                         `json:"status,omitempty"`
-	StringSharedAs                    string                         `json:"string_shared_as,omitempty"`
-	Partition                         []ResourceShareObjectPartition `json:"partition,omitempty"`
-}
-
-type ResourceShareProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceShare struct {
-	Comment         string                        `json:"comment,omitempty"`
-	CreatedAt       int                           `json:"created_at,omitempty"`
-	CreatedBy       string                        `json:"created_by,omitempty"`
-	EffectiveOwner  string                        `json:"effective_owner,omitempty"`
-	Id              string                        `json:"id,omitempty"`
-	Name            string                        `json:"name"`
-	Owner           string                        `json:"owner,omitempty"`
-	StorageLocation string                        `json:"storage_location,omitempty"`
-	StorageRoot     string                        `json:"storage_root,omitempty"`
-	UpdatedAt       int                           `json:"updated_at,omitempty"`
-	UpdatedBy       string                        `json:"updated_by,omitempty"`
-	Object          []ResourceShareObject         `json:"object,omitempty"`
-	ProviderConfig  []ResourceShareProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_sql_alert.go b/bundle/internal/tf/schema/resource_sql_alert.go
deleted file mode 100644
index 3871dc49377..00000000000
--- a/bundle/internal/tf/schema/resource_sql_alert.go
+++ /dev/null
@@ -1,29 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceSqlAlertOptions struct {
-	Column           string `json:"column"`
-	CustomBody       string `json:"custom_body,omitempty"`
-	CustomSubject    string `json:"custom_subject,omitempty"`
-	EmptyResultState string `json:"empty_result_state,omitempty"`
-	Muted            bool   `json:"muted,omitempty"`
-	Op               string `json:"op"`
-	Value            string `json:"value"`
-}
-
-type ResourceSqlAlertProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceSqlAlert struct {
-	CreatedAt      string                          `json:"created_at,omitempty"`
-	Id             string                          `json:"id,omitempty"`
-	Name           string                          `json:"name"`
-	Parent         string                          `json:"parent,omitempty"`
-	QueryId        string                          `json:"query_id"`
-	Rearm          int                             `json:"rearm,omitempty"`
-	UpdatedAt      string                          `json:"updated_at,omitempty"`
-	Options        *ResourceSqlAlertOptions        `json:"options,omitempty"`
-	ProviderConfig *ResourceSqlAlertProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_sql_dashboard.go b/bundle/internal/tf/schema/resource_sql_dashboard.go
deleted file mode 100644
index fc37c98d1d4..00000000000
--- a/bundle/internal/tf/schema/resource_sql_dashboard.go
+++ /dev/null
@@ -1,19 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceSqlDashboardProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceSqlDashboard struct {
-	CreatedAt               string                              `json:"created_at,omitempty"`
-	DashboardFiltersEnabled bool                                `json:"dashboard_filters_enabled,omitempty"`
-	Id                      string                              `json:"id,omitempty"`
-	Name                    string                              `json:"name"`
-	Parent                  string                              `json:"parent,omitempty"`
-	RunAsRole               string                              `json:"run_as_role,omitempty"`
-	Tags                    []string                            `json:"tags,omitempty"`
-	UpdatedAt               string                              `json:"updated_at,omitempty"`
-	ProviderConfig          *ResourceSqlDashboardProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_sql_endpoint.go b/bundle/internal/tf/schema/resource_sql_endpoint.go
deleted file mode 100644
index b8fe078261f..00000000000
--- a/bundle/internal/tf/schema/resource_sql_endpoint.go
+++ /dev/null
@@ -1,47 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceSqlEndpointChannel struct {
-	DbsqlVersion string `json:"dbsql_version,omitempty"`
-	Name         string `json:"name,omitempty"`
-}
-
-type ResourceSqlEndpointProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceSqlEndpointTagsCustomTags struct {
-	Key   string `json:"key"`
-	Value string `json:"value"`
-}
-
-type ResourceSqlEndpointTags struct {
-	CustomTags []ResourceSqlEndpointTagsCustomTags `json:"custom_tags,omitempty"`
-}
-
-type ResourceSqlEndpoint struct {
-	AutoStopMins            int                                `json:"auto_stop_mins,omitempty"`
-	ClusterSize             string                             `json:"cluster_size"`
-	CreatorName             string                             `json:"creator_name,omitempty"`
-	DataSourceId            string                             `json:"data_source_id,omitempty"`
-	EnablePhoton            bool                               `json:"enable_photon,omitempty"`
-	EnableServerlessCompute bool                               `json:"enable_serverless_compute,omitempty"`
-	Health                  []any                              `json:"health,omitempty"`
-	Id                      string                             `json:"id,omitempty"`
-	InstanceProfileArn      string                             `json:"instance_profile_arn,omitempty"`
-	JdbcUrl                 string                             `json:"jdbc_url,omitempty"`
-	MaxNumClusters          int                                `json:"max_num_clusters,omitempty"`
-	MinNumClusters          int                                `json:"min_num_clusters,omitempty"`
-	Name                    string                             `json:"name"`
-	NoWait                  bool                               `json:"no_wait,omitempty"`
-	NumActiveSessions       int                                `json:"num_active_sessions,omitempty"`
-	NumClusters             int                                `json:"num_clusters,omitempty"`
-	OdbcParams              []any                              `json:"odbc_params,omitempty"`
-	SpotInstancePolicy      string                             `json:"spot_instance_policy,omitempty"`
-	State                   string                             `json:"state,omitempty"`
-	WarehouseType           string                             `json:"warehouse_type,omitempty"`
-	Channel                 *ResourceSqlEndpointChannel        `json:"channel,omitempty"`
-	ProviderConfig          *ResourceSqlEndpointProviderConfig `json:"provider_config,omitempty"`
-	Tags                    *ResourceSqlEndpointTags           `json:"tags,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_sql_global_config.go b/bundle/internal/tf/schema/resource_sql_global_config.go
deleted file mode 100644
index b17c91275a1..00000000000
--- a/bundle/internal/tf/schema/resource_sql_global_config.go
+++ /dev/null
@@ -1,18 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceSqlGlobalConfigProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceSqlGlobalConfig struct {
-	DataAccessConfig        map[string]string                      `json:"data_access_config,omitempty"`
-	EnableServerlessCompute bool                                   `json:"enable_serverless_compute,omitempty"`
-	GoogleServiceAccount    string                                 `json:"google_service_account,omitempty"`
-	Id                      string                                 `json:"id,omitempty"`
-	InstanceProfileArn      string                                 `json:"instance_profile_arn,omitempty"`
-	SecurityPolicy          string                                 `json:"security_policy,omitempty"`
-	SqlConfigParams         map[string]string                      `json:"sql_config_params,omitempty"`
-	ProviderConfig          *ResourceSqlGlobalConfigProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_sql_permissions.go b/bundle/internal/tf/schema/resource_sql_permissions.go
deleted file mode 100644
index 8a931793806..00000000000
--- a/bundle/internal/tf/schema/resource_sql_permissions.go
+++ /dev/null
@@ -1,25 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceSqlPermissionsPrivilegeAssignments struct {
-	Principal  string   `json:"principal"`
-	Privileges []string `json:"privileges"`
-}
-
-type ResourceSqlPermissionsProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceSqlPermissions struct {
-	AnonymousFunction    bool                                         `json:"anonymous_function,omitempty"`
-	AnyFile              bool                                         `json:"any_file,omitempty"`
-	Catalog              bool                                         `json:"catalog,omitempty"`
-	ClusterId            string                                       `json:"cluster_id,omitempty"`
-	Database             string                                       `json:"database,omitempty"`
-	Id                   string                                       `json:"id,omitempty"`
-	Table                string                                       `json:"table,omitempty"`
-	View                 string                                       `json:"view,omitempty"`
-	PrivilegeAssignments []ResourceSqlPermissionsPrivilegeAssignments `json:"privilege_assignments,omitempty"`
-	ProviderConfig       *ResourceSqlPermissionsProviderConfig        `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_sql_query.go b/bundle/internal/tf/schema/resource_sql_query.go
deleted file mode 100644
index 445ec90aac5..00000000000
--- a/bundle/internal/tf/schema/resource_sql_query.go
+++ /dev/null
@@ -1,138 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceSqlQueryParameterDate struct {
-	Value string `json:"value"`
-}
-
-type ResourceSqlQueryParameterDateRangeRange struct {
-	End   string `json:"end"`
-	Start string `json:"start"`
-}
-
-type ResourceSqlQueryParameterDateRange struct {
-	Value string                                   `json:"value,omitempty"`
-	Range *ResourceSqlQueryParameterDateRangeRange `json:"range,omitempty"`
-}
-
-type ResourceSqlQueryParameterDatetime struct {
-	Value string `json:"value"`
-}
-
-type ResourceSqlQueryParameterDatetimeRangeRange struct {
-	End   string `json:"end"`
-	Start string `json:"start"`
-}
-
-type ResourceSqlQueryParameterDatetimeRange struct {
-	Value string                                       `json:"value,omitempty"`
-	Range *ResourceSqlQueryParameterDatetimeRangeRange `json:"range,omitempty"`
-}
-
-type ResourceSqlQueryParameterDatetimesec struct {
-	Value string `json:"value"`
-}
-
-type ResourceSqlQueryParameterDatetimesecRangeRange struct {
-	End   string `json:"end"`
-	Start string `json:"start"`
-}
-
-type ResourceSqlQueryParameterDatetimesecRange struct {
-	Value string                                          `json:"value,omitempty"`
-	Range *ResourceSqlQueryParameterDatetimesecRangeRange `json:"range,omitempty"`
-}
-
-type ResourceSqlQueryParameterEnumMultiple struct {
-	Prefix    string `json:"prefix,omitempty"`
-	Separator string `json:"separator"`
-	Suffix    string `json:"suffix,omitempty"`
-}
-
-type ResourceSqlQueryParameterEnum struct {
-	Options  []string                               `json:"options"`
-	Value    string                                 `json:"value,omitempty"`
-	Values   []string                               `json:"values,omitempty"`
-	Multiple *ResourceSqlQueryParameterEnumMultiple `json:"multiple,omitempty"`
-}
-
-type ResourceSqlQueryParameterNumber struct {
-	Value int `json:"value"`
-}
-
-type ResourceSqlQueryParameterQueryMultiple struct {
-	Prefix    string `json:"prefix,omitempty"`
-	Separator string `json:"separator"`
-	Suffix    string `json:"suffix,omitempty"`
-}
-
-type ResourceSqlQueryParameterQuery struct {
-	QueryId  string                                  `json:"query_id"`
-	Value    string                                  `json:"value,omitempty"`
-	Values   []string                                `json:"values,omitempty"`
-	Multiple *ResourceSqlQueryParameterQueryMultiple `json:"multiple,omitempty"`
-}
-
-type ResourceSqlQueryParameterText struct {
-	Value string `json:"value"`
-}
-
-type ResourceSqlQueryParameter struct {
-	Name             string                                     `json:"name"`
-	Title            string                                     `json:"title,omitempty"`
-	Date             *ResourceSqlQueryParameterDate             `json:"date,omitempty"`
-	DateRange        *ResourceSqlQueryParameterDateRange        `json:"date_range,omitempty"`
-	Datetime         *ResourceSqlQueryParameterDatetime         `json:"datetime,omitempty"`
-	DatetimeRange    *ResourceSqlQueryParameterDatetimeRange    `json:"datetime_range,omitempty"`
-	Datetimesec      *ResourceSqlQueryParameterDatetimesec      `json:"datetimesec,omitempty"`
-	DatetimesecRange *ResourceSqlQueryParameterDatetimesecRange `json:"datetimesec_range,omitempty"`
-	Enum             *ResourceSqlQueryParameterEnum             `json:"enum,omitempty"`
-	Number           *ResourceSqlQueryParameterNumber           `json:"number,omitempty"`
-	Query            *ResourceSqlQueryParameterQuery            `json:"query,omitempty"`
-	Text             *ResourceSqlQueryParameterText             `json:"text,omitempty"`
-}
-
-type ResourceSqlQueryProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceSqlQueryScheduleContinuous struct {
-	IntervalSeconds int    `json:"interval_seconds"`
-	UntilDate       string `json:"until_date,omitempty"`
-}
-
-type ResourceSqlQueryScheduleDaily struct {
-	IntervalDays int    `json:"interval_days"`
-	TimeOfDay    string `json:"time_of_day"`
-	UntilDate    string `json:"until_date,omitempty"`
-}
-
-type ResourceSqlQueryScheduleWeekly struct {
-	DayOfWeek     string `json:"day_of_week"`
-	IntervalWeeks int    `json:"interval_weeks"`
-	TimeOfDay     string `json:"time_of_day"`
-	UntilDate     string `json:"until_date,omitempty"`
-}
-
-type ResourceSqlQuerySchedule struct {
-	Continuous *ResourceSqlQueryScheduleContinuous `json:"continuous,omitempty"`
-	Daily      *ResourceSqlQueryScheduleDaily      `json:"daily,omitempty"`
-	Weekly     *ResourceSqlQueryScheduleWeekly     `json:"weekly,omitempty"`
-}
-
-type ResourceSqlQuery struct {
-	CreatedAt      string                          `json:"created_at,omitempty"`
-	DataSourceId   string                          `json:"data_source_id"`
-	Description    string                          `json:"description,omitempty"`
-	Id             string                          `json:"id,omitempty"`
-	Name           string                          `json:"name"`
-	Parent         string                          `json:"parent,omitempty"`
-	Query          string                          `json:"query"`
-	RunAsRole      string                          `json:"run_as_role,omitempty"`
-	Tags           []string                        `json:"tags,omitempty"`
-	UpdatedAt      string                          `json:"updated_at,omitempty"`
-	Parameter      []ResourceSqlQueryParameter     `json:"parameter,omitempty"`
-	ProviderConfig *ResourceSqlQueryProviderConfig `json:"provider_config,omitempty"`
-	Schedule       *ResourceSqlQuerySchedule       `json:"schedule,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_sql_table.go b/bundle/internal/tf/schema/resource_sql_table.go
deleted file mode 100644
index 1971e86f803..00000000000
--- a/bundle/internal/tf/schema/resource_sql_table.go
+++ /dev/null
@@ -1,40 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceSqlTableColumn struct {
-	Comment  string `json:"comment,omitempty"`
-	Identity string `json:"identity,omitempty"`
-	Name     string `json:"name"`
-	Nullable bool   `json:"nullable,omitempty"`
-	Type     string `json:"type,omitempty"`
-	TypeJson string `json:"type_json,omitempty"`
-}
-
-type ResourceSqlTableProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceSqlTable struct {
-	CatalogName           string                          `json:"catalog_name"`
-	ClusterId             string                          `json:"cluster_id,omitempty"`
-	ClusterKeys           []string                        `json:"cluster_keys,omitempty"`
-	Comment               string                          `json:"comment,omitempty"`
-	DataSourceFormat      string                          `json:"data_source_format,omitempty"`
-	EffectiveProperties   map[string]string               `json:"effective_properties,omitempty"`
-	Id                    string                          `json:"id,omitempty"`
-	Name                  string                          `json:"name"`
-	Options               map[string]string               `json:"options,omitempty"`
-	Owner                 string                          `json:"owner,omitempty"`
-	Partitions            []string                        `json:"partitions,omitempty"`
-	Properties            map[string]string               `json:"properties,omitempty"`
-	SchemaName            string                          `json:"schema_name"`
-	StorageCredentialName string                          `json:"storage_credential_name,omitempty"`
-	StorageLocation       string                          `json:"storage_location,omitempty"`
-	TableId               string                          `json:"table_id,omitempty"`
-	TableType             string                          `json:"table_type"`
-	ViewDefinition        string                          `json:"view_definition,omitempty"`
-	WarehouseId           string                          `json:"warehouse_id,omitempty"`
-	Column                []ResourceSqlTableColumn        `json:"column,omitempty"`
-	ProviderConfig        *ResourceSqlTableProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_sql_visualization.go b/bundle/internal/tf/schema/resource_sql_visualization.go
deleted file mode 100644
index 11f5e9060ce..00000000000
--- a/bundle/internal/tf/schema/resource_sql_visualization.go
+++ /dev/null
@@ -1,19 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceSqlVisualizationProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceSqlVisualization struct {
-	Description     string                                  `json:"description,omitempty"`
-	Id              string                                  `json:"id,omitempty"`
-	Name            string                                  `json:"name"`
-	Options         string                                  `json:"options"`
-	QueryId         string                                  `json:"query_id"`
-	QueryPlan       string                                  `json:"query_plan,omitempty"`
-	Type            string                                  `json:"type"`
-	VisualizationId string                                  `json:"visualization_id,omitempty"`
-	ProviderConfig  *ResourceSqlVisualizationProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_sql_widget.go b/bundle/internal/tf/schema/resource_sql_widget.go
deleted file mode 100644
index bb024d90245..00000000000
--- a/bundle/internal/tf/schema/resource_sql_widget.go
+++ /dev/null
@@ -1,37 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceSqlWidgetParameter struct {
-	MapTo  string   `json:"map_to,omitempty"`
-	Name   string   `json:"name"`
-	Title  string   `json:"title,omitempty"`
-	Type   string   `json:"type"`
-	Value  string   `json:"value,omitempty"`
-	Values []string `json:"values,omitempty"`
-}
-
-type ResourceSqlWidgetPosition struct {
-	AutoHeight bool `json:"auto_height,omitempty"`
-	PosX       int  `json:"pos_x,omitempty"`
-	PosY       int  `json:"pos_y,omitempty"`
-	SizeX      int  `json:"size_x"`
-	SizeY      int  `json:"size_y"`
-}
-
-type ResourceSqlWidgetProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceSqlWidget struct {
-	DashboardId     string                           `json:"dashboard_id"`
-	Description     string                           `json:"description,omitempty"`
-	Id              string                           `json:"id,omitempty"`
-	Text            string                           `json:"text,omitempty"`
-	Title           string                           `json:"title,omitempty"`
-	VisualizationId string                           `json:"visualization_id,omitempty"`
-	WidgetId        string                           `json:"widget_id,omitempty"`
-	Parameter       []ResourceSqlWidgetParameter     `json:"parameter,omitempty"`
-	Position        *ResourceSqlWidgetPosition       `json:"position,omitempty"`
-	ProviderConfig  *ResourceSqlWidgetProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_storage_credential.go b/bundle/internal/tf/schema/resource_storage_credential.go
deleted file mode 100644
index 5f0485eff04..00000000000
--- a/bundle/internal/tf/schema/resource_storage_credential.go
+++ /dev/null
@@ -1,64 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceStorageCredentialAwsIamRole struct {
-	ExternalId         string `json:"external_id,omitempty"`
-	RoleArn            string `json:"role_arn"`
-	UnityCatalogIamArn string `json:"unity_catalog_iam_arn,omitempty"`
-}
-
-type ResourceStorageCredentialAzureManagedIdentity struct {
-	AccessConnectorId string `json:"access_connector_id"`
-	CredentialId      string `json:"credential_id,omitempty"`
-	ManagedIdentityId string `json:"managed_identity_id,omitempty"`
-}
-
-type ResourceStorageCredentialAzureServicePrincipal struct {
-	ApplicationId string `json:"application_id"`
-	ClientSecret  string `json:"client_secret"`
-	DirectoryId   string `json:"directory_id"`
-}
-
-type ResourceStorageCredentialCloudflareApiToken struct {
-	AccessKeyId     string `json:"access_key_id"`
-	AccountId       string `json:"account_id"`
-	SecretAccessKey string `json:"secret_access_key"`
-}
-
-type ResourceStorageCredentialDatabricksGcpServiceAccount struct {
-	CredentialId string `json:"credential_id,omitempty"`
-	Email        string `json:"email,omitempty"`
-}
-
-type ResourceStorageCredentialGcpServiceAccountKey struct {
-	Email        string `json:"email"`
-	PrivateKey   string `json:"private_key"`
-	PrivateKeyId string `json:"private_key_id"`
-}
-
-type ResourceStorageCredentialProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceStorageCredential struct {
-	Api                         string                                                `json:"api,omitempty"`
-	Comment                     string                                                `json:"comment,omitempty"`
-	ForceDestroy                bool                                                  `json:"force_destroy,omitempty"`
-	ForceUpdate                 bool                                                  `json:"force_update,omitempty"`
-	Id                          string                                                `json:"id,omitempty"`
-	IsolationMode               string                                                `json:"isolation_mode,omitempty"`
-	MetastoreId                 string                                                `json:"metastore_id,omitempty"`
-	Name                        string                                                `json:"name"`
-	Owner                       string                                                `json:"owner,omitempty"`
-	ReadOnly                    bool                                                  `json:"read_only,omitempty"`
-	SkipValidation              bool                                                  `json:"skip_validation,omitempty"`
-	StorageCredentialId         string                                                `json:"storage_credential_id,omitempty"`
-	AwsIamRole                  *ResourceStorageCredentialAwsIamRole                  `json:"aws_iam_role,omitempty"`
-	AzureManagedIdentity        *ResourceStorageCredentialAzureManagedIdentity        `json:"azure_managed_identity,omitempty"`
-	AzureServicePrincipal       *ResourceStorageCredentialAzureServicePrincipal       `json:"azure_service_principal,omitempty"`
-	CloudflareApiToken          *ResourceStorageCredentialCloudflareApiToken          `json:"cloudflare_api_token,omitempty"`
-	DatabricksGcpServiceAccount *ResourceStorageCredentialDatabricksGcpServiceAccount `json:"databricks_gcp_service_account,omitempty"`
-	GcpServiceAccountKey        *ResourceStorageCredentialGcpServiceAccountKey        `json:"gcp_service_account_key,omitempty"`
-	ProviderConfig              *ResourceStorageCredentialProviderConfig              `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_system_schema.go b/bundle/internal/tf/schema/resource_system_schema.go
deleted file mode 100644
index cf5efdde522..00000000000
--- a/bundle/internal/tf/schema/resource_system_schema.go
+++ /dev/null
@@ -1,17 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceSystemSchemaProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceSystemSchema struct {
-	AutoEnabled    bool                                `json:"auto_enabled,omitempty"`
-	FullName       string                              `json:"full_name,omitempty"`
-	Id             string                              `json:"id,omitempty"`
-	MetastoreId    string                              `json:"metastore_id,omitempty"`
-	Schema         string                              `json:"schema"`
-	State          string                              `json:"state,omitempty"`
-	ProviderConfig *ResourceSystemSchemaProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_table.go b/bundle/internal/tf/schema/resource_table.go
deleted file mode 100644
index 9d3fba13418..00000000000
--- a/bundle/internal/tf/schema/resource_table.go
+++ /dev/null
@@ -1,38 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceTableColumn struct {
-	Comment          string `json:"comment,omitempty"`
-	Name             string `json:"name"`
-	Nullable         bool   `json:"nullable,omitempty"`
-	PartitionIndex   int    `json:"partition_index,omitempty"`
-	Position         int    `json:"position"`
-	TypeIntervalType string `json:"type_interval_type,omitempty"`
-	TypeJson         string `json:"type_json,omitempty"`
-	TypeName         string `json:"type_name"`
-	TypePrecision    int    `json:"type_precision,omitempty"`
-	TypeScale        int    `json:"type_scale,omitempty"`
-	TypeText         string `json:"type_text"`
-}
-
-type ResourceTableProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceTable struct {
-	CatalogName           string                       `json:"catalog_name"`
-	Comment               string                       `json:"comment,omitempty"`
-	DataSourceFormat      string                       `json:"data_source_format"`
-	Id                    string                       `json:"id,omitempty"`
-	Name                  string                       `json:"name"`
-	Owner                 string                       `json:"owner,omitempty"`
-	Properties            map[string]string            `json:"properties,omitempty"`
-	SchemaName            string                       `json:"schema_name"`
-	StorageCredentialName string                       `json:"storage_credential_name,omitempty"`
-	StorageLocation       string                       `json:"storage_location,omitempty"`
-	TableType             string                       `json:"table_type"`
-	ViewDefinition        string                       `json:"view_definition,omitempty"`
-	Column                []ResourceTableColumn        `json:"column,omitempty"`
-	ProviderConfig        *ResourceTableProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_tag_policy.go b/bundle/internal/tf/schema/resource_tag_policy.go
deleted file mode 100644
index 490b7020b55..00000000000
--- a/bundle/internal/tf/schema/resource_tag_policy.go
+++ /dev/null
@@ -1,21 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceTagPolicyProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceTagPolicyValues struct {
-	Name string `json:"name"`
-}
-
-type ResourceTagPolicy struct {
-	CreateTime     string                           `json:"create_time,omitempty"`
-	Description    string                           `json:"description,omitempty"`
-	Id             string                           `json:"id,omitempty"`
-	ProviderConfig *ResourceTagPolicyProviderConfig `json:"provider_config,omitempty"`
-	TagKey         string                           `json:"tag_key"`
-	UpdateTime     string                           `json:"update_time,omitempty"`
-	Values         []ResourceTagPolicyValues        `json:"values,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_token.go b/bundle/internal/tf/schema/resource_token.go
deleted file mode 100644
index 648cd6d3c82..00000000000
--- a/bundle/internal/tf/schema/resource_token.go
+++ /dev/null
@@ -1,18 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceTokenProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceToken struct {
-	Comment         string                       `json:"comment,omitempty"`
-	CreationTime    int                          `json:"creation_time,omitempty"`
-	ExpiryTime      int                          `json:"expiry_time,omitempty"`
-	Id              string                       `json:"id,omitempty"`
-	LifetimeSeconds int                          `json:"lifetime_seconds,omitempty"`
-	TokenId         string                       `json:"token_id,omitempty"`
-	TokenValue      string                       `json:"token_value,omitempty"`
-	ProviderConfig  *ResourceTokenProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_user.go b/bundle/internal/tf/schema/resource_user.go
deleted file mode 100644
index 0ad0aa5ca51..00000000000
--- a/bundle/internal/tf/schema/resource_user.go
+++ /dev/null
@@ -1,29 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceUserProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceUser struct {
-	AclPrincipalId          string                      `json:"acl_principal_id,omitempty"`
-	Active                  bool                        `json:"active,omitempty"`
-	AllowClusterCreate      bool                        `json:"allow_cluster_create,omitempty"`
-	AllowInstancePoolCreate bool                        `json:"allow_instance_pool_create,omitempty"`
-	Api                     string                      `json:"api,omitempty"`
-	DatabricksSqlAccess     bool                        `json:"databricks_sql_access,omitempty"`
-	DisableAsUserDeletion   bool                        `json:"disable_as_user_deletion,omitempty"`
-	DisplayName             string                      `json:"display_name,omitempty"`
-	ExternalId              string                      `json:"external_id,omitempty"`
-	Force                   bool                        `json:"force,omitempty"`
-	ForceDeleteHomeDir      bool                        `json:"force_delete_home_dir,omitempty"`
-	ForceDeleteRepos        bool                        `json:"force_delete_repos,omitempty"`
-	Home                    string                      `json:"home,omitempty"`
-	Id                      string                      `json:"id,omitempty"`
-	Repos                   string                      `json:"repos,omitempty"`
-	UserName                string                      `json:"user_name"`
-	WorkspaceAccess         bool                        `json:"workspace_access,omitempty"`
-	WorkspaceConsume        bool                        `json:"workspace_consume,omitempty"`
-	ProviderConfig          *ResourceUserProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_user_instance_profile.go b/bundle/internal/tf/schema/resource_user_instance_profile.go
deleted file mode 100644
index 59b27276fe5..00000000000
--- a/bundle/internal/tf/schema/resource_user_instance_profile.go
+++ /dev/null
@@ -1,15 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceUserInstanceProfileProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceUserInstanceProfile struct {
-	Api               string                                     `json:"api,omitempty"`
-	Id                string                                     `json:"id,omitempty"`
-	InstanceProfileId string                                     `json:"instance_profile_id"`
-	UserId            string                                     `json:"user_id"`
-	ProviderConfig    *ResourceUserInstanceProfileProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_user_role.go b/bundle/internal/tf/schema/resource_user_role.go
deleted file mode 100644
index 75b88ba1358..00000000000
--- a/bundle/internal/tf/schema/resource_user_role.go
+++ /dev/null
@@ -1,15 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceUserRoleProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceUserRole struct {
-	Api            string                          `json:"api,omitempty"`
-	Id             string                          `json:"id,omitempty"`
-	Role           string                          `json:"role"`
-	UserId         string                          `json:"user_id"`
-	ProviderConfig *ResourceUserRoleProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_vector_search_endpoint.go b/bundle/internal/tf/schema/resource_vector_search_endpoint.go
deleted file mode 100644
index 9d30aa82562..00000000000
--- a/bundle/internal/tf/schema/resource_vector_search_endpoint.go
+++ /dev/null
@@ -1,29 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceVectorSearchEndpointProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceVectorSearchEndpointScalingInfo struct {
-	RequestedMinQps int    `json:"requested_min_qps,omitempty"`
-	State           string `json:"state,omitempty"`
-}
-
-type ResourceVectorSearchEndpoint struct {
-	BudgetPolicyId          string                                      `json:"budget_policy_id,omitempty"`
-	CreationTimestamp       int                                         `json:"creation_timestamp,omitempty"`
-	Creator                 string                                      `json:"creator,omitempty"`
-	EffectiveBudgetPolicyId string                                      `json:"effective_budget_policy_id,omitempty"`
-	EndpointId              string                                      `json:"endpoint_id,omitempty"`
-	EndpointStatus          []any                                       `json:"endpoint_status,omitempty"`
-	EndpointType            string                                      `json:"endpoint_type"`
-	Id                      string                                      `json:"id,omitempty"`
-	LastUpdatedTimestamp    int                                         `json:"last_updated_timestamp,omitempty"`
-	LastUpdatedUser         string                                      `json:"last_updated_user,omitempty"`
-	Name                    string                                      `json:"name"`
-	NumIndexes              int                                         `json:"num_indexes,omitempty"`
-	ProviderConfig          *ResourceVectorSearchEndpointProviderConfig `json:"provider_config,omitempty"`
-	ScalingInfo             *ResourceVectorSearchEndpointScalingInfo    `json:"scaling_info,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_vector_search_index.go b/bundle/internal/tf/schema/resource_vector_search_index.go
deleted file mode 100644
index bd45fe44c07..00000000000
--- a/bundle/internal/tf/schema/resource_vector_search_index.go
+++ /dev/null
@@ -1,58 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceVectorSearchIndexDeltaSyncIndexSpecEmbeddingSourceColumns struct {
-	EmbeddingModelEndpointName string `json:"embedding_model_endpoint_name,omitempty"`
-	ModelEndpointNameForQuery  string `json:"model_endpoint_name_for_query,omitempty"`
-	Name                       string `json:"name,omitempty"`
-}
-
-type ResourceVectorSearchIndexDeltaSyncIndexSpecEmbeddingVectorColumns struct {
-	EmbeddingDimension int    `json:"embedding_dimension,omitempty"`
-	Name               string `json:"name,omitempty"`
-}
-
-type ResourceVectorSearchIndexDeltaSyncIndexSpec struct {
-	EmbeddingWritebackTable string                                                              `json:"embedding_writeback_table,omitempty"`
-	PipelineId              string                                                              `json:"pipeline_id,omitempty"`
-	PipelineType            string                                                              `json:"pipeline_type,omitempty"`
-	SourceTable             string                                                              `json:"source_table,omitempty"`
-	EmbeddingSourceColumns  []ResourceVectorSearchIndexDeltaSyncIndexSpecEmbeddingSourceColumns `json:"embedding_source_columns,omitempty"`
-	EmbeddingVectorColumns  []ResourceVectorSearchIndexDeltaSyncIndexSpecEmbeddingVectorColumns `json:"embedding_vector_columns,omitempty"`
-}
-
-type ResourceVectorSearchIndexDirectAccessIndexSpecEmbeddingSourceColumns struct {
-	EmbeddingModelEndpointName string `json:"embedding_model_endpoint_name,omitempty"`
-	ModelEndpointNameForQuery  string `json:"model_endpoint_name_for_query,omitempty"`
-	Name                       string `json:"name,omitempty"`
-}
-
-type ResourceVectorSearchIndexDirectAccessIndexSpecEmbeddingVectorColumns struct {
-	EmbeddingDimension int    `json:"embedding_dimension,omitempty"`
-	Name               string `json:"name,omitempty"`
-}
-
-type ResourceVectorSearchIndexDirectAccessIndexSpec struct {
-	SchemaJson             string                                                                 `json:"schema_json,omitempty"`
-	EmbeddingSourceColumns []ResourceVectorSearchIndexDirectAccessIndexSpecEmbeddingSourceColumns `json:"embedding_source_columns,omitempty"`
-	EmbeddingVectorColumns []ResourceVectorSearchIndexDirectAccessIndexSpecEmbeddingVectorColumns `json:"embedding_vector_columns,omitempty"`
-}
-
-type ResourceVectorSearchIndexProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceVectorSearchIndex struct {
-	Creator               string                                          `json:"creator,omitempty"`
-	EndpointName          string                                          `json:"endpoint_name"`
-	Id                    string                                          `json:"id,omitempty"`
-	IndexSubtype          string                                          `json:"index_subtype,omitempty"`
-	IndexType             string                                          `json:"index_type"`
-	Name                  string                                          `json:"name"`
-	PrimaryKey            string                                          `json:"primary_key"`
-	Status                []any                                           `json:"status,omitempty"`
-	DeltaSyncIndexSpec    *ResourceVectorSearchIndexDeltaSyncIndexSpec    `json:"delta_sync_index_spec,omitempty"`
-	DirectAccessIndexSpec *ResourceVectorSearchIndexDirectAccessIndexSpec `json:"direct_access_index_spec,omitempty"`
-	ProviderConfig        *ResourceVectorSearchIndexProviderConfig        `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_volume.go b/bundle/internal/tf/schema/resource_volume.go
deleted file mode 100644
index e540ef3b2cf..00000000000
--- a/bundle/internal/tf/schema/resource_volume.go
+++ /dev/null
@@ -1,20 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceVolumeProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceVolume struct {
-	CatalogName     string                        `json:"catalog_name"`
-	Comment         string                        `json:"comment,omitempty"`
-	Id              string                        `json:"id,omitempty"`
-	Name            string                        `json:"name"`
-	Owner           string                        `json:"owner,omitempty"`
-	SchemaName      string                        `json:"schema_name"`
-	StorageLocation string                        `json:"storage_location,omitempty"`
-	VolumePath      string                        `json:"volume_path,omitempty"`
-	VolumeType      string                        `json:"volume_type"`
-	ProviderConfig  *ResourceVolumeProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_warehouses_default_warehouse_override.go b/bundle/internal/tf/schema/resource_warehouses_default_warehouse_override.go
deleted file mode 100644
index 09433190733..00000000000
--- a/bundle/internal/tf/schema/resource_warehouses_default_warehouse_override.go
+++ /dev/null
@@ -1,15 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceWarehousesDefaultWarehouseOverrideProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceWarehousesDefaultWarehouseOverride struct {
-	DefaultWarehouseOverrideId string                                                    `json:"default_warehouse_override_id"`
-	Name                       string                                                    `json:"name,omitempty"`
-	ProviderConfig             *ResourceWarehousesDefaultWarehouseOverrideProviderConfig `json:"provider_config,omitempty"`
-	Type                       string                                                    `json:"type"`
-	WarehouseId                string                                                    `json:"warehouse_id,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_workspace_binding.go b/bundle/internal/tf/schema/resource_workspace_binding.go
deleted file mode 100644
index 1d0ebe980f4..00000000000
--- a/bundle/internal/tf/schema/resource_workspace_binding.go
+++ /dev/null
@@ -1,17 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceWorkspaceBindingProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceWorkspaceBinding struct {
-	BindingType    string                                  `json:"binding_type,omitempty"`
-	CatalogName    string                                  `json:"catalog_name,omitempty"`
-	Id             string                                  `json:"id,omitempty"`
-	SecurableName  string                                  `json:"securable_name,omitempty"`
-	SecurableType  string                                  `json:"securable_type,omitempty"`
-	WorkspaceId    int                                     `json:"workspace_id"`
-	ProviderConfig *ResourceWorkspaceBindingProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_workspace_conf.go b/bundle/internal/tf/schema/resource_workspace_conf.go
deleted file mode 100644
index 9c3a94c850b..00000000000
--- a/bundle/internal/tf/schema/resource_workspace_conf.go
+++ /dev/null
@@ -1,13 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceWorkspaceConfProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceWorkspaceConf struct {
-	CustomConfig   map[string]string                    `json:"custom_config,omitempty"`
-	Id             string                               `json:"id,omitempty"`
-	ProviderConfig *ResourceWorkspaceConfProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_workspace_entity_tag_assignment.go b/bundle/internal/tf/schema/resource_workspace_entity_tag_assignment.go
deleted file mode 100644
index a22d7d0d4fe..00000000000
--- a/bundle/internal/tf/schema/resource_workspace_entity_tag_assignment.go
+++ /dev/null
@@ -1,15 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceWorkspaceEntityTagAssignmentProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceWorkspaceEntityTagAssignment struct {
-	EntityId       string                                              `json:"entity_id"`
-	EntityType     string                                              `json:"entity_type"`
-	ProviderConfig *ResourceWorkspaceEntityTagAssignmentProviderConfig `json:"provider_config,omitempty"`
-	TagKey         string                                              `json:"tag_key"`
-	TagValue       string                                              `json:"tag_value,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_workspace_file.go b/bundle/internal/tf/schema/resource_workspace_file.go
deleted file mode 100644
index dfb1085271d..00000000000
--- a/bundle/internal/tf/schema/resource_workspace_file.go
+++ /dev/null
@@ -1,19 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceWorkspaceFileProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceWorkspaceFile struct {
-	ContentBase64  string                               `json:"content_base64,omitempty"`
-	Id             string                               `json:"id,omitempty"`
-	Md5            string                               `json:"md5,omitempty"`
-	ObjectId       int                                  `json:"object_id,omitempty"`
-	Path           string                               `json:"path"`
-	Source         string                               `json:"source,omitempty"`
-	Url            string                               `json:"url,omitempty"`
-	WorkspacePath  string                               `json:"workspace_path,omitempty"`
-	ProviderConfig *ResourceWorkspaceFileProviderConfig `json:"provider_config,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_workspace_network_option.go b/bundle/internal/tf/schema/resource_workspace_network_option.go
deleted file mode 100644
index ddfc4b15dd0..00000000000
--- a/bundle/internal/tf/schema/resource_workspace_network_option.go
+++ /dev/null
@@ -1,8 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceWorkspaceNetworkOption struct {
-	NetworkPolicyId string `json:"network_policy_id,omitempty"`
-	WorkspaceId     int    `json:"workspace_id,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resource_workspace_setting_v2.go b/bundle/internal/tf/schema/resource_workspace_setting_v2.go
deleted file mode 100644
index 6384c00ae46..00000000000
--- a/bundle/internal/tf/schema/resource_workspace_setting_v2.go
+++ /dev/null
@@ -1,144 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type ResourceWorkspaceSettingV2AibiDashboardEmbeddingAccessPolicy struct {
-	AccessPolicyType string `json:"access_policy_type"`
-}
-
-type ResourceWorkspaceSettingV2AibiDashboardEmbeddingApprovedDomains struct {
-	ApprovedDomains []string `json:"approved_domains,omitempty"`
-}
-
-type ResourceWorkspaceSettingV2AutomaticClusterUpdateWorkspaceEnablementDetails struct {
-	ForcedForComplianceMode           bool `json:"forced_for_compliance_mode,omitempty"`
-	UnavailableForDisabledEntitlement bool `json:"unavailable_for_disabled_entitlement,omitempty"`
-	UnavailableForNonEnterpriseTier   bool `json:"unavailable_for_non_enterprise_tier,omitempty"`
-}
-
-type ResourceWorkspaceSettingV2AutomaticClusterUpdateWorkspaceMaintenanceWindowWeekDayBasedScheduleWindowStartTime struct {
-	Hours   int `json:"hours,omitempty"`
-	Minutes int `json:"minutes,omitempty"`
-}
-
-type ResourceWorkspaceSettingV2AutomaticClusterUpdateWorkspaceMaintenanceWindowWeekDayBasedSchedule struct {
-	DayOfWeek       string                                                                                                         `json:"day_of_week,omitempty"`
-	Frequency       string                                                                                                         `json:"frequency,omitempty"`
-	WindowStartTime *ResourceWorkspaceSettingV2AutomaticClusterUpdateWorkspaceMaintenanceWindowWeekDayBasedScheduleWindowStartTime `json:"window_start_time,omitempty"`
-}
-
-type ResourceWorkspaceSettingV2AutomaticClusterUpdateWorkspaceMaintenanceWindow struct {
-	WeekDayBasedSchedule *ResourceWorkspaceSettingV2AutomaticClusterUpdateWorkspaceMaintenanceWindowWeekDayBasedSchedule `json:"week_day_based_schedule,omitempty"`
-}
-
-type ResourceWorkspaceSettingV2AutomaticClusterUpdateWorkspace struct {
-	CanToggle                       bool                                                                        `json:"can_toggle,omitempty"`
-	Enabled                         bool                                                                        `json:"enabled,omitempty"`
-	EnablementDetails               *ResourceWorkspaceSettingV2AutomaticClusterUpdateWorkspaceEnablementDetails `json:"enablement_details,omitempty"`
-	MaintenanceWindow               *ResourceWorkspaceSettingV2AutomaticClusterUpdateWorkspaceMaintenanceWindow `json:"maintenance_window,omitempty"`
-	RestartEvenIfNoUpdatesAvailable bool                                                                        `json:"restart_even_if_no_updates_available,omitempty"`
-}
-
-type ResourceWorkspaceSettingV2BooleanVal struct {
-	Value bool `json:"value,omitempty"`
-}
-
-type ResourceWorkspaceSettingV2EffectiveAibiDashboardEmbeddingAccessPolicy struct {
-	AccessPolicyType string `json:"access_policy_type"`
-}
-
-type ResourceWorkspaceSettingV2EffectiveAibiDashboardEmbeddingApprovedDomains struct {
-	ApprovedDomains []string `json:"approved_domains,omitempty"`
-}
-
-type ResourceWorkspaceSettingV2EffectiveAutomaticClusterUpdateWorkspaceEnablementDetails struct {
-	ForcedForComplianceMode           bool `json:"forced_for_compliance_mode,omitempty"`
-	UnavailableForDisabledEntitlement bool `json:"unavailable_for_disabled_entitlement,omitempty"`
-	UnavailableForNonEnterpriseTier   bool `json:"unavailable_for_non_enterprise_tier,omitempty"`
-}
-
-type ResourceWorkspaceSettingV2EffectiveAutomaticClusterUpdateWorkspaceMaintenanceWindowWeekDayBasedScheduleWindowStartTime struct {
-	Hours   int `json:"hours,omitempty"`
-	Minutes int `json:"minutes,omitempty"`
-}
-
-type ResourceWorkspaceSettingV2EffectiveAutomaticClusterUpdateWorkspaceMaintenanceWindowWeekDayBasedSchedule struct {
-	DayOfWeek       string                                                                                                                  `json:"day_of_week,omitempty"`
-	Frequency       string                                                                                                                  `json:"frequency,omitempty"`
-	WindowStartTime *ResourceWorkspaceSettingV2EffectiveAutomaticClusterUpdateWorkspaceMaintenanceWindowWeekDayBasedScheduleWindowStartTime `json:"window_start_time,omitempty"`
-}
-
-type ResourceWorkspaceSettingV2EffectiveAutomaticClusterUpdateWorkspaceMaintenanceWindow struct {
-	WeekDayBasedSchedule *ResourceWorkspaceSettingV2EffectiveAutomaticClusterUpdateWorkspaceMaintenanceWindowWeekDayBasedSchedule `json:"week_day_based_schedule,omitempty"`
-}
-
-type ResourceWorkspaceSettingV2EffectiveAutomaticClusterUpdateWorkspace struct {
-	CanToggle                       bool                                                                                 `json:"can_toggle,omitempty"`
-	Enabled                         bool                                                                                 `json:"enabled,omitempty"`
-	EnablementDetails               *ResourceWorkspaceSettingV2EffectiveAutomaticClusterUpdateWorkspaceEnablementDetails `json:"enablement_details,omitempty"`
-	MaintenanceWindow               *ResourceWorkspaceSettingV2EffectiveAutomaticClusterUpdateWorkspaceMaintenanceWindow `json:"maintenance_window,omitempty"`
-	RestartEvenIfNoUpdatesAvailable bool                                                                                 `json:"restart_even_if_no_updates_available,omitempty"`
-}
-
-type ResourceWorkspaceSettingV2EffectiveBooleanVal struct {
-	Value bool `json:"value,omitempty"`
-}
-
-type ResourceWorkspaceSettingV2EffectiveIntegerVal struct {
-	Value int `json:"value,omitempty"`
-}
-
-type ResourceWorkspaceSettingV2EffectivePersonalCompute struct {
-	Value string `json:"value,omitempty"`
-}
-
-type ResourceWorkspaceSettingV2EffectiveRestrictWorkspaceAdmins struct {
-	DisableGovTagCreation bool   `json:"disable_gov_tag_creation,omitempty"`
-	Status                string `json:"status"`
-}
-
-type ResourceWorkspaceSettingV2EffectiveStringVal struct {
-	Value string `json:"value,omitempty"`
-}
-
-type ResourceWorkspaceSettingV2IntegerVal struct {
-	Value int `json:"value,omitempty"`
-}
-
-type ResourceWorkspaceSettingV2PersonalCompute struct {
-	Value string `json:"value,omitempty"`
-}
-
-type ResourceWorkspaceSettingV2ProviderConfig struct {
-	WorkspaceId string `json:"workspace_id"`
-}
-
-type ResourceWorkspaceSettingV2RestrictWorkspaceAdmins struct {
-	DisableGovTagCreation bool   `json:"disable_gov_tag_creation,omitempty"`
-	Status                string `json:"status"`
-}
-
-type ResourceWorkspaceSettingV2StringVal struct {
-	Value string `json:"value,omitempty"`
-}
-
-type ResourceWorkspaceSettingV2 struct {
-	AibiDashboardEmbeddingAccessPolicy             *ResourceWorkspaceSettingV2AibiDashboardEmbeddingAccessPolicy             `json:"aibi_dashboard_embedding_access_policy,omitempty"`
-	AibiDashboardEmbeddingApprovedDomains          *ResourceWorkspaceSettingV2AibiDashboardEmbeddingApprovedDomains          `json:"aibi_dashboard_embedding_approved_domains,omitempty"`
-	AutomaticClusterUpdateWorkspace                *ResourceWorkspaceSettingV2AutomaticClusterUpdateWorkspace                `json:"automatic_cluster_update_workspace,omitempty"`
-	BooleanVal                                     *ResourceWorkspaceSettingV2BooleanVal                                     `json:"boolean_val,omitempty"`
-	EffectiveAibiDashboardEmbeddingAccessPolicy    *ResourceWorkspaceSettingV2EffectiveAibiDashboardEmbeddingAccessPolicy    `json:"effective_aibi_dashboard_embedding_access_policy,omitempty"`
-	EffectiveAibiDashboardEmbeddingApprovedDomains *ResourceWorkspaceSettingV2EffectiveAibiDashboardEmbeddingApprovedDomains `json:"effective_aibi_dashboard_embedding_approved_domains,omitempty"`
-	EffectiveAutomaticClusterUpdateWorkspace       *ResourceWorkspaceSettingV2EffectiveAutomaticClusterUpdateWorkspace       `json:"effective_automatic_cluster_update_workspace,omitempty"`
-	EffectiveBooleanVal                            *ResourceWorkspaceSettingV2EffectiveBooleanVal                            `json:"effective_boolean_val,omitempty"`
-	EffectiveIntegerVal                            *ResourceWorkspaceSettingV2EffectiveIntegerVal                            `json:"effective_integer_val,omitempty"`
-	EffectivePersonalCompute                       *ResourceWorkspaceSettingV2EffectivePersonalCompute                       `json:"effective_personal_compute,omitempty"`
-	EffectiveRestrictWorkspaceAdmins               *ResourceWorkspaceSettingV2EffectiveRestrictWorkspaceAdmins               `json:"effective_restrict_workspace_admins,omitempty"`
-	EffectiveStringVal                             *ResourceWorkspaceSettingV2EffectiveStringVal                             `json:"effective_string_val,omitempty"`
-	IntegerVal                                     *ResourceWorkspaceSettingV2IntegerVal                                     `json:"integer_val,omitempty"`
-	Name                                           string                                                                    `json:"name,omitempty"`
-	PersonalCompute                                *ResourceWorkspaceSettingV2PersonalCompute                                `json:"personal_compute,omitempty"`
-	ProviderConfig                                 *ResourceWorkspaceSettingV2ProviderConfig                                 `json:"provider_config,omitempty"`
-	RestrictWorkspaceAdmins                        *ResourceWorkspaceSettingV2RestrictWorkspaceAdmins                        `json:"restrict_workspace_admins,omitempty"`
-	StringVal                                      *ResourceWorkspaceSettingV2StringVal                                      `json:"string_val,omitempty"`
-}
diff --git a/bundle/internal/tf/schema/resources.go b/bundle/internal/tf/schema/resources.go
deleted file mode 100644
index a12b555092f..00000000000
--- a/bundle/internal/tf/schema/resources.go
+++ /dev/null
@@ -1,315 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-
-package schema
-
-type Resources struct {
-	AccessControlRuleSet                         map[string]any `json:"databricks_access_control_rule_set,omitempty"`
-	AccountFederationPolicy                      map[string]any `json:"databricks_account_federation_policy,omitempty"`
-	AccountNetworkPolicy                         map[string]any `json:"databricks_account_network_policy,omitempty"`
-	AccountSettingUserPreferenceV2               map[string]any `json:"databricks_account_setting_user_preference_v2,omitempty"`
-	AccountSettingV2                             map[string]any `json:"databricks_account_setting_v2,omitempty"`
-	AibiDashboardEmbeddingAccessPolicySetting    map[string]any `json:"databricks_aibi_dashboard_embedding_access_policy_setting,omitempty"`
-	AibiDashboardEmbeddingApprovedDomainsSetting map[string]any `json:"databricks_aibi_dashboard_embedding_approved_domains_setting,omitempty"`
-	Alert                                        map[string]any `json:"databricks_alert,omitempty"`
-	AlertV2                                      map[string]any `json:"databricks_alert_v2,omitempty"`
-	App                                          map[string]any `json:"databricks_app,omitempty"`
-	AppSpace                                     map[string]any `json:"databricks_app_space,omitempty"`
-	AppsSettingsCustomTemplate                   map[string]any `json:"databricks_apps_settings_custom_template,omitempty"`
-	ArtifactAllowlist                            map[string]any `json:"databricks_artifact_allowlist,omitempty"`
-	AutomaticClusterUpdateWorkspaceSetting       map[string]any `json:"databricks_automatic_cluster_update_workspace_setting,omitempty"`
-	AwsS3Mount                                   map[string]any `json:"databricks_aws_s3_mount,omitempty"`
-	AzureAdlsGen1Mount                           map[string]any `json:"databricks_azure_adls_gen1_mount,omitempty"`
-	AzureAdlsGen2Mount                           map[string]any `json:"databricks_azure_adls_gen2_mount,omitempty"`
-	AzureBlobMount                               map[string]any `json:"databricks_azure_blob_mount,omitempty"`
-	Budget                                       map[string]any `json:"databricks_budget,omitempty"`
-	BudgetPolicy                                 map[string]any `json:"databricks_budget_policy,omitempty"`
-	Catalog                                      map[string]any `json:"databricks_catalog,omitempty"`
-	CatalogWorkspaceBinding                      map[string]any `json:"databricks_catalog_workspace_binding,omitempty"`
-	Cluster                                      map[string]any `json:"databricks_cluster,omitempty"`
-	ClusterPolicy                                map[string]any `json:"databricks_cluster_policy,omitempty"`
-	ComplianceSecurityProfileWorkspaceSetting    map[string]any `json:"databricks_compliance_security_profile_workspace_setting,omitempty"`
-	Connection                                   map[string]any `json:"databricks_connection,omitempty"`
-	Credential                                   map[string]any `json:"databricks_credential,omitempty"`
-	CustomAppIntegration                         map[string]any `json:"databricks_custom_app_integration,omitempty"`
-	Dashboard                                    map[string]any `json:"databricks_dashboard,omitempty"`
-	DataClassificationCatalogConfig              map[string]any `json:"databricks_data_classification_catalog_config,omitempty"`
-	DataQualityMonitor                           map[string]any `json:"databricks_data_quality_monitor,omitempty"`
-	DataQualityRefresh                           map[string]any `json:"databricks_data_quality_refresh,omitempty"`
-	DatabaseDatabaseCatalog                      map[string]any `json:"databricks_database_database_catalog,omitempty"`
-	DatabaseInstance                             map[string]any `json:"databricks_database_instance,omitempty"`
-	DatabaseSyncedDatabaseTable                  map[string]any `json:"databricks_database_synced_database_table,omitempty"`
-	DbfsFile                                     map[string]any `json:"databricks_dbfs_file,omitempty"`
-	DefaultNamespaceSetting                      map[string]any `json:"databricks_default_namespace_setting,omitempty"`
-	Directory                                    map[string]any `json:"databricks_directory,omitempty"`
-	DisableLegacyAccessSetting                   map[string]any `json:"databricks_disable_legacy_access_setting,omitempty"`
-	DisableLegacyDbfsSetting                     map[string]any `json:"databricks_disable_legacy_dbfs_setting,omitempty"`
-	DisableLegacyFeaturesSetting                 map[string]any `json:"databricks_disable_legacy_features_setting,omitempty"`
-	Endpoint                                     map[string]any `json:"databricks_endpoint,omitempty"`
-	EnhancedSecurityMonitoringWorkspaceSetting   map[string]any `json:"databricks_enhanced_security_monitoring_workspace_setting,omitempty"`
-	Entitlements                                 map[string]any `json:"databricks_entitlements,omitempty"`
-	EntityTagAssignment                          map[string]any `json:"databricks_entity_tag_assignment,omitempty"`
-	EnvironmentsDefaultWorkspaceBaseEnvironment  map[string]any `json:"databricks_environments_default_workspace_base_environment,omitempty"`
-	EnvironmentsWorkspaceBaseEnvironment         map[string]any `json:"databricks_environments_workspace_base_environment,omitempty"`
-	ExternalLocation                             map[string]any `json:"databricks_external_location,omitempty"`
-	ExternalMetadata                             map[string]any `json:"databricks_external_metadata,omitempty"`
-	FeatureEngineeringFeature                    map[string]any `json:"databricks_feature_engineering_feature,omitempty"`
-	FeatureEngineeringKafkaConfig                map[string]any `json:"databricks_feature_engineering_kafka_config,omitempty"`
-	FeatureEngineeringMaterializedFeature        map[string]any `json:"databricks_feature_engineering_materialized_feature,omitempty"`
-	File                                         map[string]any `json:"databricks_file,omitempty"`
-	GitCredential                                map[string]any `json:"databricks_git_credential,omitempty"`
-	GlobalInitScript                             map[string]any `json:"databricks_global_init_script,omitempty"`
-	Grant                                        map[string]any `json:"databricks_grant,omitempty"`
-	Grants                                       map[string]any `json:"databricks_grants,omitempty"`
-	Group                                        map[string]any `json:"databricks_group,omitempty"`
-	GroupInstanceProfile                         map[string]any `json:"databricks_group_instance_profile,omitempty"`
-	GroupMember                                  map[string]any `json:"databricks_group_member,omitempty"`
-	GroupRole                                    map[string]any `json:"databricks_group_role,omitempty"`
-	InstancePool                                 map[string]any `json:"databricks_instance_pool,omitempty"`
-	InstanceProfile                              map[string]any `json:"databricks_instance_profile,omitempty"`
-	IpAccessList                                 map[string]any `json:"databricks_ip_access_list,omitempty"`
-	Job                                          map[string]any `json:"databricks_job,omitempty"`
-	KnowledgeAssistant                           map[string]any `json:"databricks_knowledge_assistant,omitempty"`
-	KnowledgeAssistantKnowledgeSource            map[string]any `json:"databricks_knowledge_assistant_knowledge_source,omitempty"`
-	LakehouseMonitor                             map[string]any `json:"databricks_lakehouse_monitor,omitempty"`
-	Library                                      map[string]any `json:"databricks_library,omitempty"`
-	MaterializedFeaturesFeatureTag               map[string]any `json:"databricks_materialized_features_feature_tag,omitempty"`
-	Metastore                                    map[string]any `json:"databricks_metastore,omitempty"`
-	MetastoreAssignment                          map[string]any `json:"databricks_metastore_assignment,omitempty"`
-	MetastoreDataAccess                          map[string]any `json:"databricks_metastore_data_access,omitempty"`
-	MlflowExperiment                             map[string]any `json:"databricks_mlflow_experiment,omitempty"`
-	MlflowModel                                  map[string]any `json:"databricks_mlflow_model,omitempty"`
-	MlflowWebhook                                map[string]any `json:"databricks_mlflow_webhook,omitempty"`
-	ModelServing                                 map[string]any `json:"databricks_model_serving,omitempty"`
-	ModelServingProvisionedThroughput            map[string]any `json:"databricks_model_serving_provisioned_throughput,omitempty"`
-	Mount                                        map[string]any `json:"databricks_mount,omitempty"`
-	MwsCredentials                               map[string]any `json:"databricks_mws_credentials,omitempty"`
-	MwsCustomerManagedKeys                       map[string]any `json:"databricks_mws_customer_managed_keys,omitempty"`
-	MwsLogDelivery                               map[string]any `json:"databricks_mws_log_delivery,omitempty"`
-	MwsNccBinding                                map[string]any `json:"databricks_mws_ncc_binding,omitempty"`
-	MwsNccPrivateEndpointRule                    map[string]any `json:"databricks_mws_ncc_private_endpoint_rule,omitempty"`
-	MwsNetworkConnectivityConfig                 map[string]any `json:"databricks_mws_network_connectivity_config,omitempty"`
-	MwsNetworks                                  map[string]any `json:"databricks_mws_networks,omitempty"`
-	MwsPermissionAssignment                      map[string]any `json:"databricks_mws_permission_assignment,omitempty"`
-	MwsPrivateAccessSettings                     map[string]any `json:"databricks_mws_private_access_settings,omitempty"`
-	MwsStorageConfigurations                     map[string]any `json:"databricks_mws_storage_configurations,omitempty"`
-	MwsVpcEndpoint                               map[string]any `json:"databricks_mws_vpc_endpoint,omitempty"`
-	MwsWorkspaces                                map[string]any `json:"databricks_mws_workspaces,omitempty"`
-	Notebook                                     map[string]any `json:"databricks_notebook,omitempty"`
-	NotificationDestination                      map[string]any `json:"databricks_notification_destination,omitempty"`
-	OboToken                                     map[string]any `json:"databricks_obo_token,omitempty"`
-	OnlineStore                                  map[string]any `json:"databricks_online_store,omitempty"`
-	OnlineTable                                  map[string]any `json:"databricks_online_table,omitempty"`
-	PermissionAssignment                         map[string]any `json:"databricks_permission_assignment,omitempty"`
-	Permissions                                  map[string]any `json:"databricks_permissions,omitempty"`
-	Pipeline                                     map[string]any `json:"databricks_pipeline,omitempty"`
-	PolicyInfo                                   map[string]any `json:"databricks_policy_info,omitempty"`
-	PostgresBranch                               map[string]any `json:"databricks_postgres_branch,omitempty"`
-	PostgresCatalog                              map[string]any `json:"databricks_postgres_catalog,omitempty"`
-	PostgresDatabase                             map[string]any `json:"databricks_postgres_database,omitempty"`
-	PostgresEndpoint                             map[string]any `json:"databricks_postgres_endpoint,omitempty"`
-	PostgresProject                              map[string]any `json:"databricks_postgres_project,omitempty"`
-	PostgresRole                                 map[string]any `json:"databricks_postgres_role,omitempty"`
-	PostgresSyncedTable                          map[string]any `json:"databricks_postgres_synced_table,omitempty"`
-	Provider                                     map[string]any `json:"databricks_provider,omitempty"`
-	QualityMonitor                               map[string]any `json:"databricks_quality_monitor,omitempty"`
-	QualityMonitorV2                             map[string]any `json:"databricks_quality_monitor_v2,omitempty"`
-	Query                                        map[string]any `json:"databricks_query,omitempty"`
-	Recipient                                    map[string]any `json:"databricks_recipient,omitempty"`
-	RegisteredModel                              map[string]any `json:"databricks_registered_model,omitempty"`
-	Repo                                         map[string]any `json:"databricks_repo,omitempty"`
-	RestrictWorkspaceAdminsSetting               map[string]any `json:"databricks_restrict_workspace_admins_setting,omitempty"`
-	RfaAccessRequestDestinations                 map[string]any `json:"databricks_rfa_access_request_destinations,omitempty"`
-	Schema                                       map[string]any `json:"databricks_schema,omitempty"`
-	Secret                                       map[string]any `json:"databricks_secret,omitempty"`
-	SecretAcl                                    map[string]any `json:"databricks_secret_acl,omitempty"`
-	SecretScope                                  map[string]any `json:"databricks_secret_scope,omitempty"`
-	ServicePrincipal                             map[string]any `json:"databricks_service_principal,omitempty"`
-	ServicePrincipalFederationPolicy             map[string]any `json:"databricks_service_principal_federation_policy,omitempty"`
-	ServicePrincipalRole                         map[string]any `json:"databricks_service_principal_role,omitempty"`
-	ServicePrincipalSecret                       map[string]any `json:"databricks_service_principal_secret,omitempty"`
-	Share                                        map[string]any `json:"databricks_share,omitempty"`
-	SqlAlert                                     map[string]any `json:"databricks_sql_alert,omitempty"`
-	SqlDashboard                                 map[string]any `json:"databricks_sql_dashboard,omitempty"`
-	SqlEndpoint                                  map[string]any `json:"databricks_sql_endpoint,omitempty"`
-	SqlGlobalConfig                              map[string]any `json:"databricks_sql_global_config,omitempty"`
-	SqlPermissions                               map[string]any `json:"databricks_sql_permissions,omitempty"`
-	SqlQuery                                     map[string]any `json:"databricks_sql_query,omitempty"`
-	SqlTable                                     map[string]any `json:"databricks_sql_table,omitempty"`
-	SqlVisualization                             map[string]any `json:"databricks_sql_visualization,omitempty"`
-	SqlWidget                                    map[string]any `json:"databricks_sql_widget,omitempty"`
-	StorageCredential                            map[string]any `json:"databricks_storage_credential,omitempty"`
-	SystemSchema                                 map[string]any `json:"databricks_system_schema,omitempty"`
-	Table                                        map[string]any `json:"databricks_table,omitempty"`
-	TagPolicy                                    map[string]any `json:"databricks_tag_policy,omitempty"`
-	Token                                        map[string]any `json:"databricks_token,omitempty"`
-	User                                         map[string]any `json:"databricks_user,omitempty"`
-	UserInstanceProfile                          map[string]any `json:"databricks_user_instance_profile,omitempty"`
-	UserRole                                     map[string]any `json:"databricks_user_role,omitempty"`
-	VectorSearchEndpoint                         map[string]any `json:"databricks_vector_search_endpoint,omitempty"`
-	VectorSearchIndex                            map[string]any `json:"databricks_vector_search_index,omitempty"`
-	Volume                                       map[string]any `json:"databricks_volume,omitempty"`
-	WarehousesDefaultWarehouseOverride           map[string]any `json:"databricks_warehouses_default_warehouse_override,omitempty"`
-	WorkspaceBinding                             map[string]any `json:"databricks_workspace_binding,omitempty"`
-	WorkspaceConf                                map[string]any `json:"databricks_workspace_conf,omitempty"`
-	WorkspaceEntityTagAssignment                 map[string]any `json:"databricks_workspace_entity_tag_assignment,omitempty"`
-	WorkspaceFile                                map[string]any `json:"databricks_workspace_file,omitempty"`
-	WorkspaceNetworkOption                       map[string]any `json:"databricks_workspace_network_option,omitempty"`
-	WorkspaceSettingV2                           map[string]any `json:"databricks_workspace_setting_v2,omitempty"`
-}
-
-func NewResources() *Resources {
-	return &Resources{
-		AccessControlRuleSet:                         make(map[string]any),
-		AccountFederationPolicy:                      make(map[string]any),
-		AccountNetworkPolicy:                         make(map[string]any),
-		AccountSettingUserPreferenceV2:               make(map[string]any),
-		AccountSettingV2:                             make(map[string]any),
-		AibiDashboardEmbeddingAccessPolicySetting:    make(map[string]any),
-		AibiDashboardEmbeddingApprovedDomainsSetting: make(map[string]any),
-		Alert:                                  make(map[string]any),
-		AlertV2:                                make(map[string]any),
-		App:                                    make(map[string]any),
-		AppSpace:                               make(map[string]any),
-		AppsSettingsCustomTemplate:             make(map[string]any),
-		ArtifactAllowlist:                      make(map[string]any),
-		AutomaticClusterUpdateWorkspaceSetting: make(map[string]any),
-		AwsS3Mount:                             make(map[string]any),
-		AzureAdlsGen1Mount:                     make(map[string]any),
-		AzureAdlsGen2Mount:                     make(map[string]any),
-		AzureBlobMount:                         make(map[string]any),
-		Budget:                                 make(map[string]any),
-		BudgetPolicy:                           make(map[string]any),
-		Catalog:                                make(map[string]any),
-		CatalogWorkspaceBinding:                make(map[string]any),
-		Cluster:                                make(map[string]any),
-		ClusterPolicy:                          make(map[string]any),
-		ComplianceSecurityProfileWorkspaceSetting: make(map[string]any),
-		Connection:                      make(map[string]any),
-		Credential:                      make(map[string]any),
-		CustomAppIntegration:            make(map[string]any),
-		Dashboard:                       make(map[string]any),
-		DataClassificationCatalogConfig: make(map[string]any),
-		DataQualityMonitor:              make(map[string]any),
-		DataQualityRefresh:              make(map[string]any),
-		DatabaseDatabaseCatalog:         make(map[string]any),
-		DatabaseInstance:                make(map[string]any),
-		DatabaseSyncedDatabaseTable:     make(map[string]any),
-		DbfsFile:                        make(map[string]any),
-		DefaultNamespaceSetting:         make(map[string]any),
-		Directory:                       make(map[string]any),
-		DisableLegacyAccessSetting:      make(map[string]any),
-		DisableLegacyDbfsSetting:        make(map[string]any),
-		DisableLegacyFeaturesSetting:    make(map[string]any),
-		Endpoint:                        make(map[string]any),
-		EnhancedSecurityMonitoringWorkspaceSetting: make(map[string]any),
-		Entitlements:        make(map[string]any),
-		EntityTagAssignment: make(map[string]any),
-		EnvironmentsDefaultWorkspaceBaseEnvironment: make(map[string]any),
-		EnvironmentsWorkspaceBaseEnvironment:        make(map[string]any),
-		ExternalLocation:                            make(map[string]any),
-		ExternalMetadata:                            make(map[string]any),
-		FeatureEngineeringFeature:                   make(map[string]any),
-		FeatureEngineeringKafkaConfig:               make(map[string]any),
-		FeatureEngineeringMaterializedFeature:       make(map[string]any),
-		File:                                        make(map[string]any),
-		GitCredential:                               make(map[string]any),
-		GlobalInitScript:                            make(map[string]any),
-		Grant:                                       make(map[string]any),
-		Grants:                                      make(map[string]any),
-		Group:                                       make(map[string]any),
-		GroupInstanceProfile:                        make(map[string]any),
-		GroupMember:                                 make(map[string]any),
-		GroupRole:                                   make(map[string]any),
-		InstancePool:                                make(map[string]any),
-		InstanceProfile:                             make(map[string]any),
-		IpAccessList:                                make(map[string]any),
-		Job:                                         make(map[string]any),
-		KnowledgeAssistant:                          make(map[string]any),
-		KnowledgeAssistantKnowledgeSource:           make(map[string]any),
-		LakehouseMonitor:                            make(map[string]any),
-		Library:                                     make(map[string]any),
-		MaterializedFeaturesFeatureTag:              make(map[string]any),
-		Metastore:                                   make(map[string]any),
-		MetastoreAssignment:                         make(map[string]any),
-		MetastoreDataAccess:                         make(map[string]any),
-		MlflowExperiment:                            make(map[string]any),
-		MlflowModel:                                 make(map[string]any),
-		MlflowWebhook:                               make(map[string]any),
-		ModelServing:                                make(map[string]any),
-		ModelServingProvisionedThroughput:           make(map[string]any),
-		Mount:                                       make(map[string]any),
-		MwsCredentials:                              make(map[string]any),
-		MwsCustomerManagedKeys:                      make(map[string]any),
-		MwsLogDelivery:                              make(map[string]any),
-		MwsNccBinding:                               make(map[string]any),
-		MwsNccPrivateEndpointRule:                   make(map[string]any),
-		MwsNetworkConnectivityConfig:                make(map[string]any),
-		MwsNetworks:                                 make(map[string]any),
-		MwsPermissionAssignment:                     make(map[string]any),
-		MwsPrivateAccessSettings:                    make(map[string]any),
-		MwsStorageConfigurations:                    make(map[string]any),
-		MwsVpcEndpoint:                              make(map[string]any),
-		MwsWorkspaces:                               make(map[string]any),
-		Notebook:                                    make(map[string]any),
-		NotificationDestination:                     make(map[string]any),
-		OboToken:                                    make(map[string]any),
-		OnlineStore:                                 make(map[string]any),
-		OnlineTable:                                 make(map[string]any),
-		PermissionAssignment:                        make(map[string]any),
-		Permissions:                                 make(map[string]any),
-		Pipeline:                                    make(map[string]any),
-		PolicyInfo:                                  make(map[string]any),
-		PostgresBranch:                              make(map[string]any),
-		PostgresCatalog:                             make(map[string]any),
-		PostgresDatabase:                            make(map[string]any),
-		PostgresEndpoint:                            make(map[string]any),
-		PostgresProject:                             make(map[string]any),
-		PostgresRole:                                make(map[string]any),
-		PostgresSyncedTable:                         make(map[string]any),
-		Provider:                                    make(map[string]any),
-		QualityMonitor:                              make(map[string]any),
-		QualityMonitorV2:                            make(map[string]any),
-		Query:                                       make(map[string]any),
-		Recipient:                                   make(map[string]any),
-		RegisteredModel:                             make(map[string]any),
-		Repo:                                        make(map[string]any),
-		RestrictWorkspaceAdminsSetting:              make(map[string]any),
-		RfaAccessRequestDestinations:                make(map[string]any),
-		Schema:                                      make(map[string]any),
-		Secret:                                      make(map[string]any),
-		SecretAcl:                                   make(map[string]any),
-		SecretScope:                                 make(map[string]any),
-		ServicePrincipal:                            make(map[string]any),
-		ServicePrincipalFederationPolicy:            make(map[string]any),
-		ServicePrincipalRole:                        make(map[string]any),
-		ServicePrincipalSecret:                      make(map[string]any),
-		Share:                                       make(map[string]any),
-		SqlAlert:                                    make(map[string]any),
-		SqlDashboard:                                make(map[string]any),
-		SqlEndpoint:                                 make(map[string]any),
-		SqlGlobalConfig:                             make(map[string]any),
-		SqlPermissions:                              make(map[string]any),
-		SqlQuery:                                    make(map[string]any),
-		SqlTable:                                    make(map[string]any),
-		SqlVisualization:                            make(map[string]any),
-		SqlWidget:                                   make(map[string]any),
-		StorageCredential:                           make(map[string]any),
-		SystemSchema:                                make(map[string]any),
-		Table:                                       make(map[string]any),
-		TagPolicy:                                   make(map[string]any),
-		Token:                                       make(map[string]any),
-		User:                                        make(map[string]any),
-		UserInstanceProfile:                         make(map[string]any),
-		UserRole:                                    make(map[string]any),
-		VectorSearchEndpoint:                        make(map[string]any),
-		VectorSearchIndex:                           make(map[string]any),
-		Volume:                                      make(map[string]any),
-		WarehousesDefaultWarehouseOverride:          make(map[string]any),
-		WorkspaceBinding:                            make(map[string]any),
-		WorkspaceConf:                               make(map[string]any),
-		WorkspaceEntityTagAssignment:                make(map[string]any),
-		WorkspaceFile:                               make(map[string]any),
-		WorkspaceNetworkOption:                      make(map[string]any),
-		WorkspaceSettingV2:                          make(map[string]any),
-	}
-}
diff --git a/bundle/internal/tf/schema/root.go b/bundle/internal/tf/schema/root.go
deleted file mode 100644
index c0d0ad067cc..00000000000
--- a/bundle/internal/tf/schema/root.go
+++ /dev/null
@@ -1,39 +0,0 @@
-// Generated from Databricks Terraform provider schema. DO NOT EDIT.
-package schema
-
-type Providers struct {
-	Databricks *Config `json:"databricks,omitempty"`
-}
-
-func NewProviders() *Providers {
-	return &Providers{
-		Databricks: &Config{},
-	}
-}
-
-type Root struct {
-	Terraform map[string]any `json:"terraform"`
-
-	Provider *Providers   `json:"provider,omitempty"`
-	Data     *DataSources `json:"data,omitempty"`
-	Resource *Resources   `json:"resource,omitempty"`
-}
-
-const ProviderHost = "registry.terraform.io"
-const ProviderSource = "databricks/databricks"
-const ProviderVersion = "1.113.0"
-const ProviderChecksumLinuxAmd64 = "4f5caaf7bea4c435ae97c28c45086c213e182b67d1fe9b13f4e91b9e0b6ad7be"
-const ProviderChecksumLinuxArm64 = "69693b0bcbab3a184deb2744e8b90d5a9d1f7e19cdc414bc54a87280e37d65a9"
-
-func NewRoot() *Root {
-	return &Root{
-		Terraform: map[string]any{
-			"required_providers": map[string]any{
-				"databricks": map[string]any{
-					"source":  ProviderSource,
-					"version": ProviderVersion,
-				},
-			},
-		},
-	}
-}
diff --git a/bundle/internal/validation/generated/enum_fields.go b/bundle/internal/validation/generated/enum_fields.go
index 33632c268f8..e811c87414b 100644
--- a/bundle/internal/validation/generated/enum_fields.go
+++ b/bundle/internal/validation/generated/enum_fields.go
@@ -6,10 +6,11 @@ package generated
 // EnumFields maps [dyn.Pattern] to valid enum values they should have.
 var EnumFields = map[string][]string{
 	"artifacts.*.executable": {"bash", "sh", "cmd"},
-	"artifacts.*.type":       {"whl", "jar"},
+	"artifacts.*.type":       {"whl", "jar", "tgz"},
 
 	"permissions[*].level": {"CAN_ATTACH_TO", "CAN_BIND", "CAN_CREATE", "CAN_CREATE_APP", "CAN_EDIT", "CAN_EDIT_METADATA", "CAN_MANAGE", "CAN_MANAGE_PRODUCTION_VERSIONS", "CAN_MANAGE_RUN", "CAN_MANAGE_STAGING_VERSIONS", "CAN_MONITOR", "CAN_MONITOR_ONLY", "CAN_QUERY", "CAN_READ", "CAN_RESTART", "CAN_RUN", "CAN_USE", "CAN_VIEW", "CAN_VIEW_METADATA", "IS_OWNER"},
 
+	"resources.alerts.*.custom_template_format":                  {"HTML", "MARKDOWN"},
 	"resources.alerts.*.evaluation.comparison_operator":          {"EQUAL", "GREATER_THAN", "GREATER_THAN_OR_EQUAL", "IS_NOT_NULL", "IS_NULL", "LESS_THAN", "LESS_THAN_OR_EQUAL", "NOT_EQUAL"},
 	"resources.alerts.*.evaluation.empty_result_state":           {"ERROR", "OK", "TRIGGERED", "UNKNOWN"},
 	"resources.alerts.*.evaluation.source.aggregation":           {"AVG", "COUNT", "COUNT_DISTINCT", "MAX", "MEDIAN", "MIN", "STDDEV", "SUM"},
@@ -22,7 +23,7 @@ var EnumFields = map[string][]string{
 	"resources.apps.*.active_deployment.mode":                   {"AUTO_SYNC", "SNAPSHOT"},
 	"resources.apps.*.active_deployment.status.state":           {"CANCELLED", "FAILED", "IN_PROGRESS", "SUCCEEDED"},
 	"resources.apps.*.app_status.state":                         {"CRASHED", "DEPLOYING", "RUNNING", "UNAVAILABLE"},
-	"resources.apps.*.compute_size":                             {"LARGE", "MEDIUM"},
+	"resources.apps.*.compute_size":                             {"LARGE", "MEDIUM", "XLARGE"},
 	"resources.apps.*.compute_status.state":                     {"ACTIVE", "DELETING", "ERROR", "STARTING", "STOPPED", "STOPPING", "UPDATING"},
 	"resources.apps.*.pending_deployment.mode":                  {"AUTO_SYNC", "SNAPSHOT"},
 	"resources.apps.*.pending_deployment.status.state":          {"CANCELLED", "FAILED", "IN_PROGRESS", "SUCCEEDED"},
@@ -37,18 +38,22 @@ var EnumFields = map[string][]string{
 	"resources.apps.*.resources[*].serving_endpoint.permission": {"CAN_MANAGE", "CAN_QUERY", "CAN_VIEW"},
 	"resources.apps.*.resources[*].sql_warehouse.permission":    {"CAN_MANAGE", "CAN_USE", "IS_OWNER"},
 	"resources.apps.*.resources[*].uc_securable.permission":     {"EXECUTE", "MODIFY", "READ_VOLUME", "SELECT", "USE_CONNECTION", "WRITE_VOLUME"},
-	"resources.apps.*.resources[*].uc_securable.securable_type": {"CONNECTION", "FUNCTION", "TABLE", "VOLUME"},
+	"resources.apps.*.resources[*].uc_securable.securable_type": {"CONNECTION", "FUNCTION", "MODEL_SERVICE", "TABLE", "VOLUME"},
 
-	"resources.catalogs.*.grants[*].privileges[*]": {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"},
+	"resources.catalogs.*.grants[*].privileges[*]": {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_LOCATION", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"},
 
-	"resources.clusters.*.aws_attributes.availability":    {"ON_DEMAND", "SPOT", "SPOT_WITH_FALLBACK"},
-	"resources.clusters.*.aws_attributes.ebs_volume_type": {"GENERAL_PURPOSE_SSD", "THROUGHPUT_OPTIMIZED_HDD"},
-	"resources.clusters.*.azure_attributes.availability":  {"ON_DEMAND_AZURE", "SPOT_AZURE", "SPOT_WITH_FALLBACK_AZURE"},
-	"resources.clusters.*.data_security_mode":             {"DATA_SECURITY_MODE_AUTO", "DATA_SECURITY_MODE_DEDICATED", "DATA_SECURITY_MODE_STANDARD", "LEGACY_PASSTHROUGH", "LEGACY_SINGLE_USER", "LEGACY_SINGLE_USER_STANDARD", "LEGACY_TABLE_ACL", "NONE", "SINGLE_USER", "USER_ISOLATION"},
-	"resources.clusters.*.gcp_attributes.availability":    {"ON_DEMAND_GCP", "PREEMPTIBLE_GCP", "PREEMPTIBLE_WITH_FALLBACK_GCP"},
-	"resources.clusters.*.kind":                           {"CLASSIC_PREVIEW"},
-	"resources.clusters.*.permissions[*].level":           {"CAN_ATTACH_TO", "CAN_MANAGE", "CAN_RESTART"},
-	"resources.clusters.*.runtime_engine":                 {"NULL", "PHOTON", "STANDARD"},
+	"resources.cluster_policies.*.permissions[*].level": {"CAN_USE"},
+
+	"resources.clusters.*.aws_attributes.availability":              {"ON_DEMAND", "SPOT", "SPOT_WITH_FALLBACK"},
+	"resources.clusters.*.aws_attributes.ebs_volume_type":           {"GENERAL_PURPOSE_SSD", "THROUGHPUT_OPTIMIZED_HDD"},
+	"resources.clusters.*.azure_attributes.availability":            {"ON_DEMAND_AZURE", "SPOT_AZURE", "SPOT_WITH_FALLBACK_AZURE"},
+	"resources.clusters.*.data_security_mode":                       {"DATA_SECURITY_MODE_AUTO", "DATA_SECURITY_MODE_DEDICATED", "DATA_SECURITY_MODE_STANDARD", "LEGACY_PASSTHROUGH", "LEGACY_SINGLE_USER", "LEGACY_SINGLE_USER_STANDARD", "LEGACY_TABLE_ACL", "NONE", "SINGLE_USER", "USER_ISOLATION"},
+	"resources.clusters.*.dependency_mode":                          {"DEPENDENCY_MODE_AUTO", "DEPENDENCY_MODE_CLUSTER_LIBRARIES", "DEPENDENCY_MODE_ENVIRONMENTS"},
+	"resources.clusters.*.gcp_attributes.availability":              {"ON_DEMAND_GCP", "PREEMPTIBLE_GCP", "PREEMPTIBLE_WITH_FALLBACK_GCP"},
+	"resources.clusters.*.gcp_attributes.confidential_compute_type": {"CONFIDENTIAL_COMPUTE_TYPE_NONE", "SEV_SNP"},
+	"resources.clusters.*.kind":                                     {"CLASSIC_PREVIEW"},
+	"resources.clusters.*.permissions[*].level":                     {"CAN_ATTACH_TO", "CAN_MANAGE", "CAN_RESTART"},
+	"resources.clusters.*.runtime_engine":                           {"NULL", "PHOTON", "STANDARD"},
 
 	"resources.dashboards.*.lifecycle_state":      {"ACTIVE", "TRASHED"},
 	"resources.dashboards.*.permissions[*].level": {"CAN_ATTACH_TO", "CAN_BIND", "CAN_CREATE", "CAN_CREATE_APP", "CAN_EDIT", "CAN_EDIT_METADATA", "CAN_MANAGE", "CAN_MANAGE_PRODUCTION_VERSIONS", "CAN_MANAGE_RUN", "CAN_MANAGE_STAGING_VERSIONS", "CAN_MONITOR", "CAN_MONITOR_ONLY", "CAN_QUERY", "CAN_READ", "CAN_RESTART", "CAN_RUN", "CAN_USE", "CAN_VIEW", "CAN_VIEW_METADATA", "IS_OWNER"},
@@ -59,71 +64,124 @@ var EnumFields = map[string][]string{
 	"resources.experiments.*.permissions[*].level": {"CAN_EDIT", "CAN_MANAGE", "CAN_READ"},
 
 	"resources.external_locations.*.encryption_details.sse_encryption_details.algorithm": {"AWS_SSE_KMS", "AWS_SSE_S3"},
-	"resources.external_locations.*.grants[*].privileges[*]":                             {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"},
-
-	"resources.jobs.*.continuous.pause_status":                                                        {"PAUSED", "UNPAUSED"},
-	"resources.jobs.*.continuous.task_retry_mode":                                                     {"NEVER", "ON_FAILURE"},
-	"resources.jobs.*.deployment.kind":                                                                {"BUNDLE", "SYSTEM_MANAGED"},
-	"resources.jobs.*.edit_mode":                                                                      {"EDITABLE", "UI_LOCKED"},
-	"resources.jobs.*.format":                                                                         {"MULTI_TASK", "SINGLE_TASK"},
-	"resources.jobs.*.git_source.git_provider":                                                        {"awsCodeCommit", "azureDevOpsServices", "bitbucketCloud", "bitbucketServer", "gitHub", "gitHubEnterprise", "gitLab", "gitLabEnterpriseEdition"},
-	"resources.jobs.*.git_source.job_source.dirty_state":                                              {"DISCONNECTED", "NOT_SYNCED"},
-	"resources.jobs.*.health.rules[*].metric":                                                         {"RUN_DURATION_SECONDS", "STREAMING_BACKLOG_BYTES", "STREAMING_BACKLOG_FILES", "STREAMING_BACKLOG_RECORDS", "STREAMING_BACKLOG_SECONDS"},
-	"resources.jobs.*.health.rules[*].op":                                                             {"GREATER_THAN"},
-	"resources.jobs.*.job_clusters[*].new_cluster.aws_attributes.availability":                        {"ON_DEMAND", "SPOT", "SPOT_WITH_FALLBACK"},
-	"resources.jobs.*.job_clusters[*].new_cluster.aws_attributes.ebs_volume_type":                     {"GENERAL_PURPOSE_SSD", "THROUGHPUT_OPTIMIZED_HDD"},
-	"resources.jobs.*.job_clusters[*].new_cluster.azure_attributes.availability":                      {"ON_DEMAND_AZURE", "SPOT_AZURE", "SPOT_WITH_FALLBACK_AZURE"},
-	"resources.jobs.*.job_clusters[*].new_cluster.data_security_mode":                                 {"DATA_SECURITY_MODE_AUTO", "DATA_SECURITY_MODE_DEDICATED", "DATA_SECURITY_MODE_STANDARD", "LEGACY_PASSTHROUGH", "LEGACY_SINGLE_USER", "LEGACY_SINGLE_USER_STANDARD", "LEGACY_TABLE_ACL", "NONE", "SINGLE_USER", "USER_ISOLATION"},
-	"resources.jobs.*.job_clusters[*].new_cluster.gcp_attributes.availability":                        {"ON_DEMAND_GCP", "PREEMPTIBLE_GCP", "PREEMPTIBLE_WITH_FALLBACK_GCP"},
-	"resources.jobs.*.job_clusters[*].new_cluster.kind":                                               {"CLASSIC_PREVIEW"},
-	"resources.jobs.*.job_clusters[*].new_cluster.runtime_engine":                                     {"NULL", "PHOTON", "STANDARD"},
-	"resources.jobs.*.performance_target":                                                             {"PERFORMANCE_OPTIMIZED", "STANDARD"},
-	"resources.jobs.*.permissions[*].level":                                                           {"CAN_MANAGE", "CAN_MANAGE_RUN", "CAN_VIEW", "IS_OWNER"},
-	"resources.jobs.*.schedule.pause_status":                                                          {"PAUSED", "UNPAUSED"},
-	"resources.jobs.*.tasks[*].compute.hardware_accelerator":                                          {"GPU_1xA10", "GPU_8xH100"},
-	"resources.jobs.*.tasks[*].condition_task.op":                                                     {"EQUAL_TO", "GREATER_THAN", "GREATER_THAN_OR_EQUAL", "LESS_THAN", "LESS_THAN_OR_EQUAL", "NOT_EQUAL"},
-	"resources.jobs.*.tasks[*].dbt_task.source":                                                       {"GIT", "WORKSPACE"},
-	"resources.jobs.*.tasks[*].for_each_task.task.compute.hardware_accelerator":                       {"GPU_1xA10", "GPU_8xH100"},
-	"resources.jobs.*.tasks[*].for_each_task.task.condition_task.op":                                  {"EQUAL_TO", "GREATER_THAN", "GREATER_THAN_OR_EQUAL", "LESS_THAN", "LESS_THAN_OR_EQUAL", "NOT_EQUAL"},
-	"resources.jobs.*.tasks[*].for_each_task.task.dbt_task.source":                                    {"GIT", "WORKSPACE"},
-	"resources.jobs.*.tasks[*].for_each_task.task.gen_ai_compute_task.source":                         {"GIT", "WORKSPACE"},
-	"resources.jobs.*.tasks[*].for_each_task.task.health.rules[*].metric":                             {"RUN_DURATION_SECONDS", "STREAMING_BACKLOG_BYTES", "STREAMING_BACKLOG_FILES", "STREAMING_BACKLOG_RECORDS", "STREAMING_BACKLOG_SECONDS"},
-	"resources.jobs.*.tasks[*].for_each_task.task.health.rules[*].op":                                 {"GREATER_THAN"},
-	"resources.jobs.*.tasks[*].for_each_task.task.new_cluster.aws_attributes.availability":            {"ON_DEMAND", "SPOT", "SPOT_WITH_FALLBACK"},
-	"resources.jobs.*.tasks[*].for_each_task.task.new_cluster.aws_attributes.ebs_volume_type":         {"GENERAL_PURPOSE_SSD", "THROUGHPUT_OPTIMIZED_HDD"},
-	"resources.jobs.*.tasks[*].for_each_task.task.new_cluster.azure_attributes.availability":          {"ON_DEMAND_AZURE", "SPOT_AZURE", "SPOT_WITH_FALLBACK_AZURE"},
-	"resources.jobs.*.tasks[*].for_each_task.task.new_cluster.data_security_mode":                     {"DATA_SECURITY_MODE_AUTO", "DATA_SECURITY_MODE_DEDICATED", "DATA_SECURITY_MODE_STANDARD", "LEGACY_PASSTHROUGH", "LEGACY_SINGLE_USER", "LEGACY_SINGLE_USER_STANDARD", "LEGACY_TABLE_ACL", "NONE", "SINGLE_USER", "USER_ISOLATION"},
-	"resources.jobs.*.tasks[*].for_each_task.task.new_cluster.gcp_attributes.availability":            {"ON_DEMAND_GCP", "PREEMPTIBLE_GCP", "PREEMPTIBLE_WITH_FALLBACK_GCP"},
-	"resources.jobs.*.tasks[*].for_each_task.task.new_cluster.kind":                                   {"CLASSIC_PREVIEW"},
-	"resources.jobs.*.tasks[*].for_each_task.task.new_cluster.runtime_engine":                         {"NULL", "PHOTON", "STANDARD"},
-	"resources.jobs.*.tasks[*].for_each_task.task.notebook_task.source":                               {"GIT", "WORKSPACE"},
-	"resources.jobs.*.tasks[*].for_each_task.task.power_bi_task.power_bi_model.authentication_method": {"OAUTH", "PAT"},
-	"resources.jobs.*.tasks[*].for_each_task.task.power_bi_task.power_bi_model.storage_mode":          {"DIRECT_QUERY", "DUAL", "IMPORT"},
-	"resources.jobs.*.tasks[*].for_each_task.task.power_bi_task.tables[*].storage_mode":               {"DIRECT_QUERY", "DUAL", "IMPORT"},
-	"resources.jobs.*.tasks[*].for_each_task.task.run_if":                                             {"ALL_DONE", "ALL_FAILED", "ALL_SUCCESS", "AT_LEAST_ONE_FAILED", "AT_LEAST_ONE_SUCCESS", "NONE_FAILED"},
-	"resources.jobs.*.tasks[*].for_each_task.task.spark_python_task.source":                           {"GIT", "WORKSPACE"},
-	"resources.jobs.*.tasks[*].for_each_task.task.sql_task.file.source":                               {"GIT", "WORKSPACE"},
-	"resources.jobs.*.tasks[*].gen_ai_compute_task.source":                                            {"GIT", "WORKSPACE"},
-	"resources.jobs.*.tasks[*].health.rules[*].metric":                                                {"RUN_DURATION_SECONDS", "STREAMING_BACKLOG_BYTES", "STREAMING_BACKLOG_FILES", "STREAMING_BACKLOG_RECORDS", "STREAMING_BACKLOG_SECONDS"},
-	"resources.jobs.*.tasks[*].health.rules[*].op":                                                    {"GREATER_THAN"},
-	"resources.jobs.*.tasks[*].new_cluster.aws_attributes.availability":                               {"ON_DEMAND", "SPOT", "SPOT_WITH_FALLBACK"},
-	"resources.jobs.*.tasks[*].new_cluster.aws_attributes.ebs_volume_type":                            {"GENERAL_PURPOSE_SSD", "THROUGHPUT_OPTIMIZED_HDD"},
-	"resources.jobs.*.tasks[*].new_cluster.azure_attributes.availability":                             {"ON_DEMAND_AZURE", "SPOT_AZURE", "SPOT_WITH_FALLBACK_AZURE"},
-	"resources.jobs.*.tasks[*].new_cluster.data_security_mode":                                        {"DATA_SECURITY_MODE_AUTO", "DATA_SECURITY_MODE_DEDICATED", "DATA_SECURITY_MODE_STANDARD", "LEGACY_PASSTHROUGH", "LEGACY_SINGLE_USER", "LEGACY_SINGLE_USER_STANDARD", "LEGACY_TABLE_ACL", "NONE", "SINGLE_USER", "USER_ISOLATION"},
-	"resources.jobs.*.tasks[*].new_cluster.gcp_attributes.availability":                               {"ON_DEMAND_GCP", "PREEMPTIBLE_GCP", "PREEMPTIBLE_WITH_FALLBACK_GCP"},
-	"resources.jobs.*.tasks[*].new_cluster.kind":                                                      {"CLASSIC_PREVIEW"},
-	"resources.jobs.*.tasks[*].new_cluster.runtime_engine":                                            {"NULL", "PHOTON", "STANDARD"},
-	"resources.jobs.*.tasks[*].notebook_task.source":                                                  {"GIT", "WORKSPACE"},
-	"resources.jobs.*.tasks[*].power_bi_task.power_bi_model.authentication_method":                    {"OAUTH", "PAT"},
-	"resources.jobs.*.tasks[*].power_bi_task.power_bi_model.storage_mode":                             {"DIRECT_QUERY", "DUAL", "IMPORT"},
-	"resources.jobs.*.tasks[*].power_bi_task.tables[*].storage_mode":                                  {"DIRECT_QUERY", "DUAL", "IMPORT"},
-	"resources.jobs.*.tasks[*].run_if":                                                                {"ALL_DONE", "ALL_FAILED", "ALL_SUCCESS", "AT_LEAST_ONE_FAILED", "AT_LEAST_ONE_SUCCESS", "NONE_FAILED"},
-	"resources.jobs.*.tasks[*].spark_python_task.source":                                              {"GIT", "WORKSPACE"},
-	"resources.jobs.*.tasks[*].sql_task.file.source":                                                  {"GIT", "WORKSPACE"},
-	"resources.jobs.*.trigger.model.condition":                                                        {"MODEL_ALIAS_SET", "MODEL_CREATED", "MODEL_VERSION_READY"},
-	"resources.jobs.*.trigger.pause_status":                                                           {"PAUSED", "UNPAUSED"},
-	"resources.jobs.*.trigger.periodic.unit":                                                          {"DAYS", "HOURS", "WEEKS"},
-	"resources.jobs.*.trigger.table_update.condition":                                                 {"ALL_UPDATED", "ANY_UPDATED"},
+	"resources.external_locations.*.grants[*].privileges[*]":                             {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_LOCATION", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"},
+
+	"resources.features.*.function.function_type":                                {"APPROX_COUNT_DISTINCT", "APPROX_PERCENTILE", "AVG", "COUNT", "FIRST", "FUNCTION_TYPE_UNSPECIFIED", "LAST", "MAX", "MIN", "STDDEV_POP", "STDDEV_SAMP", "SUM", "VAR_POP", "VAR_SAMP"},
+	"resources.features.*.source.request_source.flat_schema.fields[*].data_type": {"BINARY", "BOOLEAN", "DATE", "DECIMAL", "DOUBLE", "FLOAT", "INTEGER", "LONG", "SHORT", "STRING", "TIMESTAMP"},
+
+	"resources.genie_spaces.*.permissions[*].level": {"CAN_ATTACH_TO", "CAN_BIND", "CAN_CREATE", "CAN_CREATE_APP", "CAN_EDIT", "CAN_EDIT_METADATA", "CAN_MANAGE", "CAN_MANAGE_PRODUCTION_VERSIONS", "CAN_MANAGE_RUN", "CAN_MANAGE_STAGING_VERSIONS", "CAN_MONITOR", "CAN_MONITOR_ONLY", "CAN_QUERY", "CAN_READ", "CAN_RESTART", "CAN_RUN", "CAN_USE", "CAN_VIEW", "CAN_VIEW_METADATA", "IS_OWNER"},
+
+	"resources.instance_pools.*.aws_attributes.availability":                {"ON_DEMAND", "SPOT"},
+	"resources.instance_pools.*.azure_attributes.availability":              {"ON_DEMAND_AZURE", "SPOT_AZURE"},
+	"resources.instance_pools.*.disk_spec.disk_type.azure_disk_volume_type": {"PREMIUM_LRS", "STANDARD_LRS"},
+	"resources.instance_pools.*.disk_spec.disk_type.ebs_volume_type":        {"GENERAL_PURPOSE_SSD", "THROUGHPUT_OPTIMIZED_HDD"},
+	"resources.instance_pools.*.gcp_attributes.gcp_availability":            {"ON_DEMAND_GCP", "PREEMPTIBLE_GCP", "PREEMPTIBLE_WITH_FALLBACK_GCP"},
+	"resources.instance_pools.*.permissions[*].level":                       {"CAN_ATTACH_TO", "CAN_MANAGE"},
+
+	"resources.job_runs.*.performance_target": {"PERFORMANCE_OPTIMIZED", "STANDARD"},
+
+	"resources.jobs.*.continuous.maintenance_window.day_of_week":                                                         {"FRIDAY", "MONDAY", "SATURDAY", "SUNDAY", "THURSDAY", "TUESDAY", "WEDNESDAY"},
+	"resources.jobs.*.continuous.pause_status":                                                                           {"PAUSED", "UNPAUSED"},
+	"resources.jobs.*.continuous.task_retry_mode":                                                                        {"NEVER", "ON_FAILURE"},
+	"resources.jobs.*.deployment.kind":                                                                                   {"BUNDLE", "SYSTEM_MANAGED"},
+	"resources.jobs.*.edit_mode":                                                                                         {"EDITABLE", "UI_LOCKED"},
+	"resources.jobs.*.format":                                                                                            {"MULTI_TASK", "SINGLE_TASK"},
+	"resources.jobs.*.git_source.git_provider":                                                                           {"awsCodeCommit", "azureDevOpsServices", "bitbucketCloud", "bitbucketServer", "gitHub", "gitHubEnterprise", "gitLab", "gitLabEnterpriseEdition"},
+	"resources.jobs.*.git_source.job_source.dirty_state":                                                                 {"DISCONNECTED", "NOT_SYNCED"},
+	"resources.jobs.*.health.rules[*].metric":                                                                            {"RUN_DURATION_SECONDS", "STREAMING_BACKLOG_BYTES", "STREAMING_BACKLOG_FILES", "STREAMING_BACKLOG_RECORDS", "STREAMING_BACKLOG_SECONDS"},
+	"resources.jobs.*.health.rules[*].op":                                                                                {"GREATER_THAN"},
+	"resources.jobs.*.job_clusters[*].new_cluster.aws_attributes.availability":                                           {"ON_DEMAND", "SPOT", "SPOT_WITH_FALLBACK"},
+	"resources.jobs.*.job_clusters[*].new_cluster.aws_attributes.ebs_volume_type":                                        {"GENERAL_PURPOSE_SSD", "THROUGHPUT_OPTIMIZED_HDD"},
+	"resources.jobs.*.job_clusters[*].new_cluster.azure_attributes.availability":                                         {"ON_DEMAND_AZURE", "SPOT_AZURE", "SPOT_WITH_FALLBACK_AZURE"},
+	"resources.jobs.*.job_clusters[*].new_cluster.data_security_mode":                                                    {"DATA_SECURITY_MODE_AUTO", "DATA_SECURITY_MODE_DEDICATED", "DATA_SECURITY_MODE_STANDARD", "LEGACY_PASSTHROUGH", "LEGACY_SINGLE_USER", "LEGACY_SINGLE_USER_STANDARD", "LEGACY_TABLE_ACL", "NONE", "SINGLE_USER", "USER_ISOLATION"},
+	"resources.jobs.*.job_clusters[*].new_cluster.dependency_mode":                                                       {"DEPENDENCY_MODE_AUTO", "DEPENDENCY_MODE_CLUSTER_LIBRARIES", "DEPENDENCY_MODE_ENVIRONMENTS"},
+	"resources.jobs.*.job_clusters[*].new_cluster.gcp_attributes.availability":                                           {"ON_DEMAND_GCP", "PREEMPTIBLE_GCP", "PREEMPTIBLE_WITH_FALLBACK_GCP"},
+	"resources.jobs.*.job_clusters[*].new_cluster.gcp_attributes.confidential_compute_type":                              {"CONFIDENTIAL_COMPUTE_TYPE_NONE", "SEV_SNP"},
+	"resources.jobs.*.job_clusters[*].new_cluster.kind":                                                                  {"CLASSIC_PREVIEW"},
+	"resources.jobs.*.job_clusters[*].new_cluster.runtime_engine":                                                        {"NULL", "PHOTON", "STANDARD"},
+	"resources.jobs.*.performance_target":                                                                                {"PERFORMANCE_OPTIMIZED", "STANDARD"},
+	"resources.jobs.*.permissions[*].level":                                                                              {"CAN_MANAGE", "CAN_MANAGE_RUN", "CAN_VIEW", "IS_OWNER"},
+	"resources.jobs.*.schedule.pause_status":                                                                             {"PAUSED", "UNPAUSED"},
+	"resources.jobs.*.schedule.sql_condition.trigger_mode":                                                               {"QUERY_RETURNS_ROWS", "RESULT_VALUE_CHANGES"},
+	"resources.jobs.*.tasks[*].ai_runtime_task.deployments[*].compute.accelerator_type":                                  {"GPU_1xA10", "GPU_1xH100", "GPU_8xB300", "GPU_8xH100"},
+	"resources.jobs.*.tasks[*].ai_runtime_task.priority_class":                                                           {"BEST_EFFORT", "CRITICAL", "NORMAL"},
+	"resources.jobs.*.tasks[*].compute.hardware_accelerator":                                                             {"GPU_1xA10", "GPU_1xH100", "GPU_8xB300", "GPU_8xH100"},
+	"resources.jobs.*.tasks[*].condition_task.op":                                                                        {"EQUAL_TO", "GREATER_THAN", "GREATER_THAN_OR_EQUAL", "LESS_THAN", "LESS_THAN_OR_EQUAL", "NOT_EQUAL"},
+	"resources.jobs.*.tasks[*].dashboard_task.subscription.attachment.data_attachment.file_format":                       {"FILE_FORMAT_CSV", "FILE_FORMAT_EXCEL", "FILE_FORMAT_TSV"},
+	"resources.jobs.*.tasks[*].dashboard_task.subscription.attachment.page_attachment.page_selection":                    {"PAGE_SELECTION_ALL", "PAGE_SELECTION_SUBSET"},
+	"resources.jobs.*.tasks[*].dbt_task.source":                                                                          {"GIT", "WORKSPACE"},
+	"resources.jobs.*.tasks[*].for_each_task.task.ai_runtime_task.deployments[*].compute.accelerator_type":               {"GPU_1xA10", "GPU_1xH100", "GPU_8xB300", "GPU_8xH100"},
+	"resources.jobs.*.tasks[*].for_each_task.task.ai_runtime_task.priority_class":                                        {"BEST_EFFORT", "CRITICAL", "NORMAL"},
+	"resources.jobs.*.tasks[*].for_each_task.task.compute.hardware_accelerator":                                          {"GPU_1xA10", "GPU_1xH100", "GPU_8xB300", "GPU_8xH100"},
+	"resources.jobs.*.tasks[*].for_each_task.task.condition_task.op":                                                     {"EQUAL_TO", "GREATER_THAN", "GREATER_THAN_OR_EQUAL", "LESS_THAN", "LESS_THAN_OR_EQUAL", "NOT_EQUAL"},
+	"resources.jobs.*.tasks[*].for_each_task.task.dashboard_task.subscription.attachment.data_attachment.file_format":    {"FILE_FORMAT_CSV", "FILE_FORMAT_EXCEL", "FILE_FORMAT_TSV"},
+	"resources.jobs.*.tasks[*].for_each_task.task.dashboard_task.subscription.attachment.page_attachment.page_selection": {"PAGE_SELECTION_ALL", "PAGE_SELECTION_SUBSET"},
+	"resources.jobs.*.tasks[*].for_each_task.task.dbt_task.source":                                                       {"GIT", "WORKSPACE"},
+	"resources.jobs.*.tasks[*].for_each_task.task.gen_ai_compute_task.source":                                            {"GIT", "WORKSPACE"},
+	"resources.jobs.*.tasks[*].for_each_task.task.health.rules[*].metric":                                                {"RUN_DURATION_SECONDS", "STREAMING_BACKLOG_BYTES", "STREAMING_BACKLOG_FILES", "STREAMING_BACKLOG_RECORDS", "STREAMING_BACKLOG_SECONDS"},
+	"resources.jobs.*.tasks[*].for_each_task.task.health.rules[*].op":                                                    {"GREATER_THAN"},
+	"resources.jobs.*.tasks[*].for_each_task.task.new_cluster.aws_attributes.availability":                               {"ON_DEMAND", "SPOT", "SPOT_WITH_FALLBACK"},
+	"resources.jobs.*.tasks[*].for_each_task.task.new_cluster.aws_attributes.ebs_volume_type":                            {"GENERAL_PURPOSE_SSD", "THROUGHPUT_OPTIMIZED_HDD"},
+	"resources.jobs.*.tasks[*].for_each_task.task.new_cluster.azure_attributes.availability":                             {"ON_DEMAND_AZURE", "SPOT_AZURE", "SPOT_WITH_FALLBACK_AZURE"},
+	"resources.jobs.*.tasks[*].for_each_task.task.new_cluster.data_security_mode":                                        {"DATA_SECURITY_MODE_AUTO", "DATA_SECURITY_MODE_DEDICATED", "DATA_SECURITY_MODE_STANDARD", "LEGACY_PASSTHROUGH", "LEGACY_SINGLE_USER", "LEGACY_SINGLE_USER_STANDARD", "LEGACY_TABLE_ACL", "NONE", "SINGLE_USER", "USER_ISOLATION"},
+	"resources.jobs.*.tasks[*].for_each_task.task.new_cluster.dependency_mode":                                           {"DEPENDENCY_MODE_AUTO", "DEPENDENCY_MODE_CLUSTER_LIBRARIES", "DEPENDENCY_MODE_ENVIRONMENTS"},
+	"resources.jobs.*.tasks[*].for_each_task.task.new_cluster.gcp_attributes.availability":                               {"ON_DEMAND_GCP", "PREEMPTIBLE_GCP", "PREEMPTIBLE_WITH_FALLBACK_GCP"},
+	"resources.jobs.*.tasks[*].for_each_task.task.new_cluster.gcp_attributes.confidential_compute_type":                  {"CONFIDENTIAL_COMPUTE_TYPE_NONE", "SEV_SNP"},
+	"resources.jobs.*.tasks[*].for_each_task.task.new_cluster.kind":                                                      {"CLASSIC_PREVIEW"},
+	"resources.jobs.*.tasks[*].for_each_task.task.new_cluster.runtime_engine":                                            {"NULL", "PHOTON", "STANDARD"},
+	"resources.jobs.*.tasks[*].for_each_task.task.notebook_task.source":                                                  {"GIT", "WORKSPACE"},
+	"resources.jobs.*.tasks[*].for_each_task.task.power_bi_task.power_bi_model.authentication_method":                    {"OAUTH", "PAT"},
+	"resources.jobs.*.tasks[*].for_each_task.task.power_bi_task.power_bi_model.storage_mode":                             {"DIRECT_QUERY", "DUAL", "IMPORT"},
+	"resources.jobs.*.tasks[*].for_each_task.task.power_bi_task.tables[*].storage_mode":                                  {"DIRECT_QUERY", "DUAL", "IMPORT"},
+	"resources.jobs.*.tasks[*].for_each_task.task.run_if":                                                                {"ALL_DONE", "ALL_FAILED", "ALL_SUCCESS", "AT_LEAST_ONE_FAILED", "AT_LEAST_ONE_SUCCESS", "NONE_FAILED"},
+	"resources.jobs.*.tasks[*].for_each_task.task.spark_python_task.source":                                              {"GIT", "WORKSPACE"},
+	"resources.jobs.*.tasks[*].for_each_task.task.sql_task.file.source":                                                  {"GIT", "WORKSPACE"},
+	"resources.jobs.*.tasks[*].gen_ai_compute_task.source":                                                               {"GIT", "WORKSPACE"},
+	"resources.jobs.*.tasks[*].health.rules[*].metric":                                                                   {"RUN_DURATION_SECONDS", "STREAMING_BACKLOG_BYTES", "STREAMING_BACKLOG_FILES", "STREAMING_BACKLOG_RECORDS", "STREAMING_BACKLOG_SECONDS"},
+	"resources.jobs.*.tasks[*].health.rules[*].op":                                                                       {"GREATER_THAN"},
+	"resources.jobs.*.tasks[*].new_cluster.aws_attributes.availability":                                                  {"ON_DEMAND", "SPOT", "SPOT_WITH_FALLBACK"},
+	"resources.jobs.*.tasks[*].new_cluster.aws_attributes.ebs_volume_type":                                               {"GENERAL_PURPOSE_SSD", "THROUGHPUT_OPTIMIZED_HDD"},
+	"resources.jobs.*.tasks[*].new_cluster.azure_attributes.availability":                                                {"ON_DEMAND_AZURE", "SPOT_AZURE", "SPOT_WITH_FALLBACK_AZURE"},
+	"resources.jobs.*.tasks[*].new_cluster.data_security_mode":                                                           {"DATA_SECURITY_MODE_AUTO", "DATA_SECURITY_MODE_DEDICATED", "DATA_SECURITY_MODE_STANDARD", "LEGACY_PASSTHROUGH", "LEGACY_SINGLE_USER", "LEGACY_SINGLE_USER_STANDARD", "LEGACY_TABLE_ACL", "NONE", "SINGLE_USER", "USER_ISOLATION"},
+	"resources.jobs.*.tasks[*].new_cluster.dependency_mode":                                                              {"DEPENDENCY_MODE_AUTO", "DEPENDENCY_MODE_CLUSTER_LIBRARIES", "DEPENDENCY_MODE_ENVIRONMENTS"},
+	"resources.jobs.*.tasks[*].new_cluster.gcp_attributes.availability":                                                  {"ON_DEMAND_GCP", "PREEMPTIBLE_GCP", "PREEMPTIBLE_WITH_FALLBACK_GCP"},
+	"resources.jobs.*.tasks[*].new_cluster.gcp_attributes.confidential_compute_type":                                     {"CONFIDENTIAL_COMPUTE_TYPE_NONE", "SEV_SNP"},
+	"resources.jobs.*.tasks[*].new_cluster.kind":                                                                         {"CLASSIC_PREVIEW"},
+	"resources.jobs.*.tasks[*].new_cluster.runtime_engine":                                                               {"NULL", "PHOTON", "STANDARD"},
+	"resources.jobs.*.tasks[*].notebook_task.source":                                                                     {"GIT", "WORKSPACE"},
+	"resources.jobs.*.tasks[*].power_bi_task.power_bi_model.authentication_method":                                       {"OAUTH", "PAT"},
+	"resources.jobs.*.tasks[*].power_bi_task.power_bi_model.storage_mode":                                                {"DIRECT_QUERY", "DUAL", "IMPORT"},
+	"resources.jobs.*.tasks[*].power_bi_task.tables[*].storage_mode":                                                     {"DIRECT_QUERY", "DUAL", "IMPORT"},
+	"resources.jobs.*.tasks[*].run_if":                                                                                   {"ALL_DONE", "ALL_FAILED", "ALL_SUCCESS", "AT_LEAST_ONE_FAILED", "AT_LEAST_ONE_SUCCESS", "NONE_FAILED"},
+	"resources.jobs.*.tasks[*].spark_python_task.source":                                                                 {"GIT", "WORKSPACE"},
+	"resources.jobs.*.tasks[*].sql_task.file.source":                                                                     {"GIT", "WORKSPACE"},
+	"resources.jobs.*.trigger.model.condition":                                                                           {"MODEL_ALIAS_SET", "MODEL_CREATED", "MODEL_VERSION_READY"},
+	"resources.jobs.*.trigger.pause_status":                                                                              {"PAUSED", "UNPAUSED"},
+	"resources.jobs.*.trigger.periodic.unit":                                                                             {"DAYS", "HOURS", "MINUTES", "WEEKS"},
+	"resources.jobs.*.trigger.sql_condition.trigger_mode":                                                                {"QUERY_RETURNS_ROWS", "RESULT_VALUE_CHANGES"},
+	"resources.jobs.*.trigger.table_update.condition":                                                                    {"ALL_UPDATED", "ANY_UPDATED"},
+	"resources.jobs.*.triggers[*].continuous.maintenance_window.day_of_week":                                             {"FRIDAY", "MONDAY", "SATURDAY", "SUNDAY", "THURSDAY", "TUESDAY", "WEDNESDAY"},
+	"resources.jobs.*.triggers[*].continuous.task_retry_mode":                                                            {"NEVER", "ON_FAILURE"},
+	"resources.jobs.*.triggers[*].model.condition":                                                                       {"MODEL_ALIAS_SET", "MODEL_CREATED", "MODEL_VERSION_READY"},
+	"resources.jobs.*.triggers[*].pause_status":                                                                          {"PAUSED", "UNPAUSED"},
+	"resources.jobs.*.triggers[*].periodic.unit":                                                                         {"DAYS", "HOURS", "MINUTES", "WEEKS"},
+	"resources.jobs.*.triggers[*].sql_condition.trigger_mode":                                                            {"QUERY_RETURNS_ROWS", "RESULT_VALUE_CHANGES"},
+	"resources.jobs.*.triggers[*].table_update.condition":                                                                {"ALL_UPDATED", "ANY_UPDATED"},
+
+	"resources.mcp_services.*.config.rate_limits[*].key":            {"RATE_LIMIT_KEY_SERVICE", "RATE_LIMIT_KEY_SERVICE_PRINCIPAL", "RATE_LIMIT_KEY_USER", "RATE_LIMIT_KEY_USER_DEFAULT", "RATE_LIMIT_KEY_USER_GROUP"},
+	"resources.mcp_services.*.config.rate_limits[*].renewal_period": {"RATE_LIMIT_RENEWAL_PERIOD_HOUR", "RATE_LIMIT_RENEWAL_PERIOD_MINUTE"},
+	"resources.mcp_services.*.grants[*].privileges[*]":              {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_LOCATION", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"},
+
+	"resources.model_provider_services.*.config.provider_type":                 {"EXTERNAL_MODEL_PROVIDER_TYPE_AMAZON_BEDROCK", "EXTERNAL_MODEL_PROVIDER_TYPE_ANTHROPIC", "EXTERNAL_MODEL_PROVIDER_TYPE_AZURE_OPENAI", "EXTERNAL_MODEL_PROVIDER_TYPE_BEDROCK_MANTLE", "EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM", "EXTERNAL_MODEL_PROVIDER_TYPE_GEMINI_ENTERPRISE", "EXTERNAL_MODEL_PROVIDER_TYPE_MICROSOFT_FOUNDRY", "EXTERNAL_MODEL_PROVIDER_TYPE_OPENAI"},
+	"resources.model_provider_services.*.config.rate_limits[*].key":            {"RATE_LIMIT_KEY_SERVICE", "RATE_LIMIT_KEY_SERVICE_PRINCIPAL", "RATE_LIMIT_KEY_USER", "RATE_LIMIT_KEY_USER_DEFAULT", "RATE_LIMIT_KEY_USER_GROUP"},
+	"resources.model_provider_services.*.config.rate_limits[*].renewal_period": {"RATE_LIMIT_RENEWAL_PERIOD_HOUR", "RATE_LIMIT_RENEWAL_PERIOD_MINUTE"},
+	"resources.model_provider_services.*.grants[*].privileges[*]":              {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_LOCATION", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"},
+
+	"resources.model_services.*.config.rate_limits[*].key":                                {"RATE_LIMIT_KEY_SERVICE", "RATE_LIMIT_KEY_SERVICE_PRINCIPAL", "RATE_LIMIT_KEY_USER", "RATE_LIMIT_KEY_USER_DEFAULT", "RATE_LIMIT_KEY_USER_GROUP"},
+	"resources.model_services.*.config.rate_limits[*].renewal_period":                     {"RATE_LIMIT_RENEWAL_PERIOD_HOUR", "RATE_LIMIT_RENEWAL_PERIOD_MINUTE"},
+	"resources.model_services.*.config.routing.destinations[*].destination_type":          {"DESTINATION_TYPE_EXTERNAL_FOUNDATION_MODEL", "DESTINATION_TYPE_PAY_PER_TOKEN_FOUNDATION_MODEL", "DESTINATION_TYPE_PROVISIONED_THROUGHPUT_FOUNDATION_MODEL"},
+	"resources.model_services.*.config.routing.fallback.destinations[*].destination_type": {"DESTINATION_TYPE_EXTERNAL_FOUNDATION_MODEL", "DESTINATION_TYPE_PAY_PER_TOKEN_FOUNDATION_MODEL", "DESTINATION_TYPE_PROVISIONED_THROUGHPUT_FOUNDATION_MODEL"},
+	"resources.model_services.*.grants[*].privileges[*]":                                  {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_LOCATION", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"},
 
 	"resources.model_serving_endpoints.*.ai_gateway.guardrails.input.pii.behavior":                                        {"BLOCK", "MASK", "NONE"},
 	"resources.model_serving_endpoints.*.ai_gateway.guardrails.output.pii.behavior":                                       {"BLOCK", "MASK", "NONE"},
@@ -131,76 +189,132 @@ var EnumFields = map[string][]string{
 	"resources.model_serving_endpoints.*.ai_gateway.rate_limits[*].renewal_period":                                        {"minute"},
 	"resources.model_serving_endpoints.*.config.served_entities[*].external_model.amazon_bedrock_config.bedrock_provider": {"ai21labs", "amazon", "anthropic", "cohere"},
 	"resources.model_serving_endpoints.*.config.served_entities[*].external_model.provider":                               {"ai21labs", "amazon-bedrock", "anthropic", "cohere", "custom", "databricks-model-serving", "google-cloud-vertex-ai", "openai", "palm"},
-	"resources.model_serving_endpoints.*.config.served_entities[*].workload_type":                                         {"CPU", "GPU_LARGE", "GPU_MEDIUM", "GPU_SMALL", "MULTIGPU_MEDIUM"},
-	"resources.model_serving_endpoints.*.config.served_models[*].workload_type":                                           {"CPU", "GPU_LARGE", "GPU_MEDIUM", "GPU_SMALL", "MULTIGPU_MEDIUM"},
+	"resources.model_serving_endpoints.*.config.served_entities[*].workload_type":                                         {"CPU", "CPU_LARGE", "CPU_MEDIUM", "GPU_LARGE", "GPU_MEDIUM", "GPU_SMALL", "GPU_XLARGE", "GPU_XLARGE_8", "MULTIGPU_MEDIUM"},
+	"resources.model_serving_endpoints.*.config.served_models[*].workload_type":                                           {"CPU", "CPU_LARGE", "CPU_MEDIUM", "GPU_LARGE", "GPU_MEDIUM", "GPU_SMALL", "GPU_XLARGE", "GPU_XLARGE_8", "MULTIGPU_MEDIUM"},
 	"resources.model_serving_endpoints.*.permissions[*].level":                                                            {"CAN_MANAGE", "CAN_QUERY", "CAN_VIEW"},
 	"resources.model_serving_endpoints.*.rate_limits[*].key":                                                              {"endpoint", "user"},
 	"resources.model_serving_endpoints.*.rate_limits[*].renewal_period":                                                   {"minute"},
+	"resources.model_serving_endpoints.*.telemetry_config.enabled_telemetry_features[*]":                                  {"TELEMETRY_FEATURE_INFERENCE_TABLE", "TELEMETRY_FEATURE_LOGS", "TELEMETRY_FEATURE_METRICS", "TELEMETRY_FEATURE_TRACES"},
 
 	"resources.models.*.permissions[*].level": {"CAN_EDIT", "CAN_MANAGE", "CAN_MANAGE_PRODUCTION_VERSIONS", "CAN_MANAGE_STAGING_VERSIONS", "CAN_READ"},
 
-	"resources.pipelines.*.clusters[*].autoscale.mode":                                                                                               {"ENHANCED", "LEGACY"},
-	"resources.pipelines.*.clusters[*].aws_attributes.availability":                                                                                  {"ON_DEMAND", "SPOT", "SPOT_WITH_FALLBACK"},
-	"resources.pipelines.*.clusters[*].aws_attributes.ebs_volume_type":                                                                               {"GENERAL_PURPOSE_SSD", "THROUGHPUT_OPTIMIZED_HDD"},
-	"resources.pipelines.*.clusters[*].azure_attributes.availability":                                                                                {"ON_DEMAND_AZURE", "SPOT_AZURE", "SPOT_WITH_FALLBACK_AZURE"},
-	"resources.pipelines.*.clusters[*].gcp_attributes.availability":                                                                                  {"ON_DEMAND_GCP", "PREEMPTIBLE_GCP", "PREEMPTIBLE_WITH_FALLBACK_GCP"},
-	"resources.pipelines.*.deployment.kind":                                                                                                          {"BUNDLE"},
-	"resources.pipelines.*.ingestion_definition.connector_type":                                                                                      {"CDC", "QUERY_BASED"},
-	"resources.pipelines.*.ingestion_definition.full_refresh_window.days_of_week[*]":                                                                 {"FRIDAY", "MONDAY", "SATURDAY", "SUNDAY", "THURSDAY", "TUESDAY", "WEDNESDAY"},
-	"resources.pipelines.*.ingestion_definition.objects[*].report.table_configuration.scd_type":                                                      {"APPEND_ONLY", "SCD_TYPE_1", "SCD_TYPE_2"},
-	"resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.gdrive_options.entity_type":                                      {"FILE", "FILE_METADATA", "PERMISSION"},
-	"resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.gdrive_options.file_ingestion_options.format":                    {"AVRO", "BINARYFILE", "CSV", "EXCEL", "JSON", "ORC", "PARQUET", "XML"},
-	"resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.gdrive_options.file_ingestion_options.schema_evolution_mode":     {"ADD_NEW_COLUMNS", "ADD_NEW_COLUMNS_WITH_TYPE_WIDENING", "FAIL_ON_NEW_COLUMNS", "NONE", "RESCUE"},
-	"resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.sharepoint_options.entity_type":                                  {"FILE", "FILE_METADATA", "LIST", "PERMISSION"},
-	"resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.sharepoint_options.file_ingestion_options.format":                {"AVRO", "BINARYFILE", "CSV", "EXCEL", "JSON", "ORC", "PARQUET", "XML"},
-	"resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.sharepoint_options.file_ingestion_options.schema_evolution_mode": {"ADD_NEW_COLUMNS", "ADD_NEW_COLUMNS_WITH_TYPE_WIDENING", "FAIL_ON_NEW_COLUMNS", "NONE", "RESCUE"},
-	"resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.tiktok_ads_options.data_level":                                   {"AUCTION_AD", "AUCTION_ADGROUP", "AUCTION_ADVERTISER", "AUCTION_CAMPAIGN"},
-	"resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.tiktok_ads_options.report_type":                                  {"AUDIENCE", "BASIC", "BUSINESS_CENTER", "DSA", "GMV_MAX", "PLAYABLE_AD"},
-	"resources.pipelines.*.ingestion_definition.objects[*].schema.table_configuration.scd_type":                                                      {"APPEND_ONLY", "SCD_TYPE_1", "SCD_TYPE_2"},
-	"resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.gdrive_options.entity_type":                                       {"FILE", "FILE_METADATA", "PERMISSION"},
-	"resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.gdrive_options.file_ingestion_options.format":                     {"AVRO", "BINARYFILE", "CSV", "EXCEL", "JSON", "ORC", "PARQUET", "XML"},
-	"resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.gdrive_options.file_ingestion_options.schema_evolution_mode":      {"ADD_NEW_COLUMNS", "ADD_NEW_COLUMNS_WITH_TYPE_WIDENING", "FAIL_ON_NEW_COLUMNS", "NONE", "RESCUE"},
-	"resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.sharepoint_options.entity_type":                                   {"FILE", "FILE_METADATA", "LIST", "PERMISSION"},
-	"resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.sharepoint_options.file_ingestion_options.format":                 {"AVRO", "BINARYFILE", "CSV", "EXCEL", "JSON", "ORC", "PARQUET", "XML"},
-	"resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.sharepoint_options.file_ingestion_options.schema_evolution_mode":  {"ADD_NEW_COLUMNS", "ADD_NEW_COLUMNS_WITH_TYPE_WIDENING", "FAIL_ON_NEW_COLUMNS", "NONE", "RESCUE"},
-	"resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.tiktok_ads_options.data_level":                                    {"AUCTION_AD", "AUCTION_ADGROUP", "AUCTION_ADVERTISER", "AUCTION_CAMPAIGN"},
-	"resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.tiktok_ads_options.report_type":                                   {"AUDIENCE", "BASIC", "BUSINESS_CENTER", "DSA", "GMV_MAX", "PLAYABLE_AD"},
-	"resources.pipelines.*.ingestion_definition.objects[*].table.table_configuration.scd_type":                                                       {"APPEND_ONLY", "SCD_TYPE_1", "SCD_TYPE_2"},
-	"resources.pipelines.*.ingestion_definition.source_type":                                                                                         {"BIGQUERY", "DYNAMICS365", "FOREIGN_CATALOG", "GA4_RAW_DATA", "GOOGLE_DRIVE", "MANAGED_POSTGRESQL", "MYSQL", "NETSUITE", "ORACLE", "POSTGRESQL", "SALESFORCE", "SERVICENOW", "SHAREPOINT", "SQLSERVER", "TERADATA", "WORKDAY_RAAS"},
-	"resources.pipelines.*.ingestion_definition.table_configuration.scd_type":                                                                        {"APPEND_ONLY", "SCD_TYPE_1", "SCD_TYPE_2"},
-	"resources.pipelines.*.permissions[*].level":                                                                                                     {"CAN_MANAGE", "CAN_RUN", "CAN_VIEW", "IS_OWNER"},
-	"resources.pipelines.*.restart_window.days_of_week[*]":                                                                                           {"FRIDAY", "MONDAY", "SATURDAY", "SUNDAY", "THURSDAY", "TUESDAY", "WEDNESDAY"},
+	"resources.pipelines.*.clusters[*].autoscale.mode":                                                                                                  {"ENHANCED", "LEGACY"},
+	"resources.pipelines.*.clusters[*].aws_attributes.availability":                                                                                     {"ON_DEMAND", "SPOT", "SPOT_WITH_FALLBACK"},
+	"resources.pipelines.*.clusters[*].aws_attributes.ebs_volume_type":                                                                                  {"GENERAL_PURPOSE_SSD", "THROUGHPUT_OPTIMIZED_HDD"},
+	"resources.pipelines.*.clusters[*].azure_attributes.availability":                                                                                   {"ON_DEMAND_AZURE", "SPOT_AZURE", "SPOT_WITH_FALLBACK_AZURE"},
+	"resources.pipelines.*.clusters[*].gcp_attributes.availability":                                                                                     {"ON_DEMAND_GCP", "PREEMPTIBLE_GCP", "PREEMPTIBLE_WITH_FALLBACK_GCP"},
+	"resources.pipelines.*.clusters[*].gcp_attributes.confidential_compute_type":                                                                        {"CONFIDENTIAL_COMPUTE_TYPE_NONE", "SEV_SNP"},
+	"resources.pipelines.*.deployment.kind":                                                                                                             {"BUNDLE"},
+	"resources.pipelines.*.ingestion_definition.connector_type":                                                                                         {"CDC", "QUERY_BASED"},
+	"resources.pipelines.*.ingestion_definition.full_refresh_window.days_of_week[*]":                                                                    {"FRIDAY", "MONDAY", "SATURDAY", "SUNDAY", "THURSDAY", "TUESDAY", "WEDNESDAY"},
+	"resources.pipelines.*.ingestion_definition.objects[*].report.table_configuration.scd_type":                                                         {"APPEND_ONLY", "SCD_TYPE_1", "SCD_TYPE_2"},
+	"resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.gdrive_options.entity_type":                                         {"FILE", "FILE_METADATA", "PERMISSION"},
+	"resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.gdrive_options.file_ingestion_options.format":                       {"AVRO", "BINARYFILE", "CSV", "EXCEL", "JSON", "ORC", "PARQUET", "XML"},
+	"resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.gdrive_options.file_ingestion_options.schema_evolution_mode":        {"ADD_NEW_COLUMNS", "ADD_NEW_COLUMNS_WITH_TYPE_WIDENING", "FAIL_ON_NEW_COLUMNS", "NONE", "RESCUE"},
+	"resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.key_transformer.avro_options.parse_mode":              {"FAILFAST", "PERMISSIVE"},
+	"resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.key_transformer.format":                               {"AVRO", "JSON", "PROTOBUF", "STRING"},
+	"resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.key_transformer.json_options.schema_evolution_mode":   {"ADD_NEW_COLUMNS", "ADD_NEW_COLUMNS_WITH_TYPE_WIDENING", "FAIL_ON_NEW_COLUMNS", "NONE", "RESCUE"},
+	"resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.key_transformer.protobuf_options.parse_mode":          {"FAILFAST", "PERMISSIVE"},
+	"resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.value_transformer.avro_options.parse_mode":            {"FAILFAST", "PERMISSIVE"},
+	"resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.value_transformer.format":                             {"AVRO", "JSON", "PROTOBUF", "STRING"},
+	"resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.value_transformer.json_options.schema_evolution_mode": {"ADD_NEW_COLUMNS", "ADD_NEW_COLUMNS_WITH_TYPE_WIDENING", "FAIL_ON_NEW_COLUMNS", "NONE", "RESCUE"},
+	"resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.kafka_options.value_transformer.protobuf_options.parse_mode":        {"FAILFAST", "PERMISSIVE"},
+	"resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.linkedin_ads_options.custom_report_options.entity_granularity[*]":   {"CAMPAIGN", "CAMPAIGN_GROUP", "CREATIVE"},
+	"resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.linkedin_ads_options.custom_report_options.finder":                  {"ANALYTICS", "ATTRIBUTED_REVENUE_METRICS", "STATISTICS"},
+	"resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.linkedin_ads_options.custom_report_options.time_granularity":        {"ALL", "DAILY", "MONTHLY", "YEARLY"},
+	"resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.outlook_options.attachment_mode":                                    {"ALL", "INLINE_ONLY", "NONE", "NON_INLINE_ONLY"},
+	"resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.outlook_options.body_format":                                        {"TEXT_HTML", "TEXT_PLAIN"},
+	"resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.sharepoint_options.entity_type":                                     {"FILE", "FILE_METADATA", "LIST", "PERMISSION"},
+	"resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.sharepoint_options.file_ingestion_options.format":                   {"AVRO", "BINARYFILE", "CSV", "EXCEL", "JSON", "ORC", "PARQUET", "XML"},
+	"resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.sharepoint_options.file_ingestion_options.schema_evolution_mode":    {"ADD_NEW_COLUMNS", "ADD_NEW_COLUMNS_WITH_TYPE_WIDENING", "FAIL_ON_NEW_COLUMNS", "NONE", "RESCUE"},
+	"resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.tiktok_ads_options.custom_report_options.data_level":                {"AUCTION_AD", "AUCTION_ADGROUP", "AUCTION_ADVERTISER", "AUCTION_CAMPAIGN"},
+	"resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.tiktok_ads_options.custom_report_options.report_type":               {"AUDIENCE", "BASIC", "BUSINESS_CENTER", "DSA", "GMV_MAX", "PLAYABLE_AD"},
+	"resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.tiktok_ads_options.data_level":                                      {"AUCTION_AD", "AUCTION_ADGROUP", "AUCTION_ADVERTISER", "AUCTION_CAMPAIGN"},
+	"resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.tiktok_ads_options.report_type":                                     {"AUDIENCE", "BASIC", "BUSINESS_CENTER", "DSA", "GMV_MAX", "PLAYABLE_AD"},
+	"resources.pipelines.*.ingestion_definition.objects[*].schema.fanout_options.transforms[*].avro_options.parse_mode":                                 {"FAILFAST", "PERMISSIVE"},
+	"resources.pipelines.*.ingestion_definition.objects[*].schema.fanout_options.transforms[*].format":                                                  {"AVRO", "JSON", "PROTOBUF", "STRING"},
+	"resources.pipelines.*.ingestion_definition.objects[*].schema.fanout_options.transforms[*].json_options.schema_evolution_mode":                      {"ADD_NEW_COLUMNS", "ADD_NEW_COLUMNS_WITH_TYPE_WIDENING", "FAIL_ON_NEW_COLUMNS", "NONE", "RESCUE"},
+	"resources.pipelines.*.ingestion_definition.objects[*].schema.fanout_options.transforms[*].protobuf_options.parse_mode":                             {"FAILFAST", "PERMISSIVE"},
+	"resources.pipelines.*.ingestion_definition.objects[*].schema.table_configuration.scd_type":                                                         {"APPEND_ONLY", "SCD_TYPE_1", "SCD_TYPE_2"},
+	"resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.gdrive_options.entity_type":                                          {"FILE", "FILE_METADATA", "PERMISSION"},
+	"resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.gdrive_options.file_ingestion_options.format":                        {"AVRO", "BINARYFILE", "CSV", "EXCEL", "JSON", "ORC", "PARQUET", "XML"},
+	"resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.gdrive_options.file_ingestion_options.schema_evolution_mode":         {"ADD_NEW_COLUMNS", "ADD_NEW_COLUMNS_WITH_TYPE_WIDENING", "FAIL_ON_NEW_COLUMNS", "NONE", "RESCUE"},
+	"resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.key_transformer.avro_options.parse_mode":               {"FAILFAST", "PERMISSIVE"},
+	"resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.key_transformer.format":                                {"AVRO", "JSON", "PROTOBUF", "STRING"},
+	"resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.key_transformer.json_options.schema_evolution_mode":    {"ADD_NEW_COLUMNS", "ADD_NEW_COLUMNS_WITH_TYPE_WIDENING", "FAIL_ON_NEW_COLUMNS", "NONE", "RESCUE"},
+	"resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.key_transformer.protobuf_options.parse_mode":           {"FAILFAST", "PERMISSIVE"},
+	"resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.value_transformer.avro_options.parse_mode":             {"FAILFAST", "PERMISSIVE"},
+	"resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.value_transformer.format":                              {"AVRO", "JSON", "PROTOBUF", "STRING"},
+	"resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.value_transformer.json_options.schema_evolution_mode":  {"ADD_NEW_COLUMNS", "ADD_NEW_COLUMNS_WITH_TYPE_WIDENING", "FAIL_ON_NEW_COLUMNS", "NONE", "RESCUE"},
+	"resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.kafka_options.value_transformer.protobuf_options.parse_mode":         {"FAILFAST", "PERMISSIVE"},
+	"resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.linkedin_ads_options.custom_report_options.entity_granularity[*]":    {"CAMPAIGN", "CAMPAIGN_GROUP", "CREATIVE"},
+	"resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.linkedin_ads_options.custom_report_options.finder":                   {"ANALYTICS", "ATTRIBUTED_REVENUE_METRICS", "STATISTICS"},
+	"resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.linkedin_ads_options.custom_report_options.time_granularity":         {"ALL", "DAILY", "MONTHLY", "YEARLY"},
+	"resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.outlook_options.attachment_mode":                                     {"ALL", "INLINE_ONLY", "NONE", "NON_INLINE_ONLY"},
+	"resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.outlook_options.body_format":                                         {"TEXT_HTML", "TEXT_PLAIN"},
+	"resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.sharepoint_options.entity_type":                                      {"FILE", "FILE_METADATA", "LIST", "PERMISSION"},
+	"resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.sharepoint_options.file_ingestion_options.format":                    {"AVRO", "BINARYFILE", "CSV", "EXCEL", "JSON", "ORC", "PARQUET", "XML"},
+	"resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.sharepoint_options.file_ingestion_options.schema_evolution_mode":     {"ADD_NEW_COLUMNS", "ADD_NEW_COLUMNS_WITH_TYPE_WIDENING", "FAIL_ON_NEW_COLUMNS", "NONE", "RESCUE"},
+	"resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.tiktok_ads_options.custom_report_options.data_level":                 {"AUCTION_AD", "AUCTION_ADGROUP", "AUCTION_ADVERTISER", "AUCTION_CAMPAIGN"},
+	"resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.tiktok_ads_options.custom_report_options.report_type":                {"AUDIENCE", "BASIC", "BUSINESS_CENTER", "DSA", "GMV_MAX", "PLAYABLE_AD"},
+	"resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.tiktok_ads_options.data_level":                                       {"AUCTION_AD", "AUCTION_ADGROUP", "AUCTION_ADVERTISER", "AUCTION_CAMPAIGN"},
+	"resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.tiktok_ads_options.report_type":                                      {"AUDIENCE", "BASIC", "BUSINESS_CENTER", "DSA", "GMV_MAX", "PLAYABLE_AD"},
+	"resources.pipelines.*.ingestion_definition.objects[*].table.table_configuration.scd_type":                                                          {"APPEND_ONLY", "SCD_TYPE_1", "SCD_TYPE_2"},
+	"resources.pipelines.*.ingestion_definition.source_type":                                                                                            {"BIGQUERY", "CONFLUENCE", "DYNAMICS365", "FOREIGN_CATALOG", "GA4_RAW_DATA", "GOOGLE_DRIVE", "JIRA", "MANAGED_POSTGRESQL", "META_MARKETING", "MYSQL", "NETSUITE", "ORACLE", "POSTGRESQL", "RABBITMQ", "SALESFORCE", "SERVICENOW", "SHAREPOINT", "SMARTSHEET", "SQLSERVER", "TERADATA", "TIKTOK_ADS", "WORKDAY_RAAS", "ZENDESK"},
+	"resources.pipelines.*.ingestion_definition.table_configuration.scd_type":                                                                           {"APPEND_ONLY", "SCD_TYPE_1", "SCD_TYPE_2"},
+	"resources.pipelines.*.permissions[*].level":           {"CAN_MANAGE", "CAN_RUN", "CAN_VIEW", "IS_OWNER"},
+	"resources.pipelines.*.restart_window.days_of_week[*]": {"FRIDAY", "MONDAY", "SATURDAY", "SUNDAY", "THURSDAY", "TUESDAY", "WEDNESDAY"},
 
 	"resources.postgres_endpoints.*.endpoint_type": {"ENDPOINT_TYPE_READ_ONLY", "ENDPOINT_TYPE_READ_WRITE"},
 
 	"resources.postgres_projects.*.permissions[*].level": {"CAN_ATTACH_TO", "CAN_BIND", "CAN_CREATE", "CAN_CREATE_APP", "CAN_EDIT", "CAN_EDIT_METADATA", "CAN_MANAGE", "CAN_MANAGE_PRODUCTION_VERSIONS", "CAN_MANAGE_RUN", "CAN_MANAGE_STAGING_VERSIONS", "CAN_MONITOR", "CAN_MONITOR_ONLY", "CAN_QUERY", "CAN_READ", "CAN_RESTART", "CAN_RUN", "CAN_USE", "CAN_VIEW", "CAN_VIEW_METADATA", "IS_OWNER"},
 
+	"resources.postgres_roles.*.auth_method":         {"LAKEBASE_OAUTH_V1", "NO_LOGIN", "PG_PASSWORD_SCRAM_SHA_256"},
+	"resources.postgres_roles.*.identity_type":       {"GROUP", "SERVICE_PRINCIPAL", "USER"},
+	"resources.postgres_roles.*.membership_roles[*]": {"DATABRICKS_SUPERUSER"},
+
+	"resources.postgres_snapshot_schedules.*.schedule[*].weekly_schedule.day_of_week": {"FRIDAY", "MONDAY", "SATURDAY", "SUNDAY", "THURSDAY", "TUESDAY", "WEDNESDAY"},
+
+	"resources.postgres_synced_tables.*.extra_columns[*].maintenance":       {"STORED_GENERATED"},
+	"resources.postgres_synced_tables.*.new_pipeline_spec.pipeline_channel": {"CURRENT", "PREVIEW"},
+	"resources.postgres_synced_tables.*.scheduling_policy":                  {"CONTINUOUS", "SNAPSHOT", "TRIGGERED"},
+	"resources.postgres_synced_tables.*.type_overrides[*].pg_type":          {"PG_SPECIFIC_TYPE_HALFVEC", "PG_SPECIFIC_TYPE_VARCHAR", "PG_SPECIFIC_TYPE_VECTOR"},
+
 	"resources.quality_monitors.*.custom_metrics[*].type":     {"CUSTOM_METRIC_TYPE_AGGREGATE", "CUSTOM_METRIC_TYPE_DERIVED", "CUSTOM_METRIC_TYPE_DRIFT"},
 	"resources.quality_monitors.*.inference_log.problem_type": {"PROBLEM_TYPE_CLASSIFICATION", "PROBLEM_TYPE_REGRESSION"},
 	"resources.quality_monitors.*.schedule.pause_status":      {"PAUSED", "UNPAUSED", "UNSPECIFIED"},
 
-	"resources.registered_models.*.grants[*].privileges[*]": {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"},
+	"resources.registered_models.*.grants[*].privileges[*]": {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_LOCATION", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"},
+
+	"resources.schemas.*.grants[*].privileges[*]": {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_LOCATION", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"},
 
-	"resources.schemas.*.grants[*].privileges[*]": {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"},
+	"resources.secret_scopes.*.backend_type":         {"AZURE_KEYVAULT", "DATABRICKS"},
+	"resources.secret_scopes.*.permissions[*].level": {"READ", "WRITE", "MANAGE"},
 
-	"resources.secret_scopes.*.backend_type": {"AZURE_KEYVAULT", "DATABRICKS"},
+	"resources.secrets.*.grants[*].privileges[*]": {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_LOCATION", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"},
 
 	"resources.sql_warehouses.*.channel.name":         {"CHANNEL_NAME_CURRENT", "CHANNEL_NAME_CUSTOM", "CHANNEL_NAME_PREVIEW", "CHANNEL_NAME_PREVIOUS"},
 	"resources.sql_warehouses.*.permissions[*].level": {"CAN_MANAGE", "CAN_MONITOR", "CAN_USE", "CAN_VIEW", "IS_OWNER"},
 	"resources.sql_warehouses.*.spot_instance_policy": {"COST_OPTIMIZED", "POLICY_UNSPECIFIED", "RELIABILITY_OPTIMIZED"},
-	"resources.sql_warehouses.*.warehouse_type":       {"CLASSIC", "PRO", "TYPE_UNSPECIFIED"},
+	"resources.sql_warehouses.*.warehouse_type":       {"CLASSIC", "PRO", "REALTIME", "TYPE_UNSPECIFIED"},
 
 	"resources.synced_database_tables.*.data_synchronization_status.continuous_update_status.initial_pipeline_sync_progress.provisioning_phase": {"PROVISIONING_PHASE_INDEX_SCAN", "PROVISIONING_PHASE_INDEX_SORT", "PROVISIONING_PHASE_MAIN"},
 	"resources.synced_database_tables.*.data_synchronization_status.detailed_state":                                                             {"SYNCED_TABLED_OFFLINE", "SYNCED_TABLE_OFFLINE_FAILED", "SYNCED_TABLE_ONLINE", "SYNCED_TABLE_ONLINE_CONTINUOUS_UPDATE", "SYNCED_TABLE_ONLINE_NO_PENDING_UPDATE", "SYNCED_TABLE_ONLINE_PIPELINE_FAILED", "SYNCED_TABLE_ONLINE_TRIGGERED_UPDATE", "SYNCED_TABLE_ONLINE_UPDATING_PIPELINE_RESOURCES", "SYNCED_TABLE_PROVISIONING", "SYNCED_TABLE_PROVISIONING_INITIAL_SNAPSHOT", "SYNCED_TABLE_PROVISIONING_PIPELINE_RESOURCES"},
 	"resources.synced_database_tables.*.data_synchronization_status.provisioning_status.initial_pipeline_sync_progress.provisioning_phase":      {"PROVISIONING_PHASE_INDEX_SCAN", "PROVISIONING_PHASE_INDEX_SORT", "PROVISIONING_PHASE_MAIN"},
 	"resources.synced_database_tables.*.data_synchronization_status.triggered_update_status.triggered_update_progress.provisioning_phase":       {"PROVISIONING_PHASE_INDEX_SCAN", "PROVISIONING_PHASE_INDEX_SORT", "PROVISIONING_PHASE_MAIN"},
 	"resources.synced_database_tables.*.spec.scheduling_policy":                                                                                 {"CONTINUOUS", "SNAPSHOT", "TRIGGERED"},
+	"resources.synced_database_tables.*.spec.type_overrides[*].pg_type":                                                                         {"PG_SPECIFIC_TYPE_HALFVEC", "PG_SPECIFIC_TYPE_VARCHAR", "PG_SPECIFIC_TYPE_VECTOR"},
 	"resources.synced_database_tables.*.unity_catalog_provisioning_state":                                                                       {"ACTIVE", "DEGRADED", "DELETING", "FAILED", "PROVISIONING", "UPDATING"},
 
 	"resources.vector_search_endpoints.*.endpoint_type":        {"STANDARD", "STORAGE_OPTIMIZED"},
-	"resources.vector_search_endpoints.*.permissions[*].level": {"CAN_ATTACH_TO", "CAN_BIND", "CAN_CREATE", "CAN_CREATE_APP", "CAN_EDIT", "CAN_EDIT_METADATA", "CAN_MANAGE", "CAN_MANAGE_PRODUCTION_VERSIONS", "CAN_MANAGE_RUN", "CAN_MANAGE_STAGING_VERSIONS", "CAN_MONITOR", "CAN_MONITOR_ONLY", "CAN_QUERY", "CAN_READ", "CAN_RESTART", "CAN_RUN", "CAN_USE", "CAN_VIEW", "CAN_VIEW_METADATA", "IS_OWNER"},
+	"resources.vector_search_endpoints.*.permissions[*].level": {"CAN_CREATE", "CAN_MANAGE", "CAN_USE"},
+
+	"resources.vector_search_indexes.*.delta_sync_index_spec.pipeline_type": {"CONTINUOUS", "TRIGGERED"},
+	"resources.vector_search_indexes.*.grants[*].privileges[*]":             {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_LOCATION", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"},
+	"resources.vector_search_indexes.*.index_subtype":                       {"FULL_TEXT", "HYBRID", "VECTOR"},
+	"resources.vector_search_indexes.*.index_type":                          {"DELTA_SYNC", "DIRECT_ACCESS"},
 
-	"resources.volumes.*.grants[*].privileges[*]": {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"},
+	"resources.volumes.*.grants[*].privileges[*]": {"ACCESS", "ALL_PRIVILEGES", "APPLY_TAG", "BROWSE", "CREATE", "CREATE_CATALOG", "CREATE_CLEAN_ROOM", "CREATE_CONNECTION", "CREATE_EXTERNAL_LOCATION", "CREATE_EXTERNAL_TABLE", "CREATE_EXTERNAL_VOLUME", "CREATE_FOREIGN_CATALOG", "CREATE_FOREIGN_SECURABLE", "CREATE_FUNCTION", "CREATE_MANAGED_STORAGE", "CREATE_MATERIALIZED_VIEW", "CREATE_MODEL", "CREATE_PROVIDER", "CREATE_RECIPIENT", "CREATE_SCHEMA", "CREATE_SERVICE_CREDENTIAL", "CREATE_SHARE", "CREATE_STORAGE_CREDENTIAL", "CREATE_TABLE", "CREATE_VIEW", "CREATE_VOLUME", "EXECUTE", "EXECUTE_CLEAN_ROOM_TASK", "EXTERNAL_USE_LOCATION", "EXTERNAL_USE_SCHEMA", "MANAGE", "MANAGE_ALLOWLIST", "MODIFY", "MODIFY_CLEAN_ROOM", "READ_FILES", "READ_METADATA", "READ_PRIVATE_FILES", "READ_VOLUME", "REFRESH", "SELECT", "SET_SHARE_PERMISSION", "USAGE", "USE_CATALOG", "USE_CONNECTION", "USE_MARKETPLACE_ASSETS", "USE_PROVIDER", "USE_RECIPIENT", "USE_SCHEMA", "USE_SHARE", "WRITE_FILES", "WRITE_PRIVATE_FILES", "WRITE_VOLUME"},
 	"resources.volumes.*.volume_type":             {"EXTERNAL", "MANAGED"},
 
 	"variables.*.type": {"complex"},
diff --git a/bundle/internal/validation/generated/required_fields.go b/bundle/internal/validation/generated/required_fields.go
index db86398accb..f43a07dddce 100644
--- a/bundle/internal/validation/generated/required_fields.go
+++ b/bundle/internal/validation/generated/required_fields.go
@@ -15,12 +15,14 @@ var RequiredFields = map[string][]string{
 	"resources.alerts.*.evaluation":                  {"comparison_operator", "source"},
 	"resources.alerts.*.evaluation.source":           {"name"},
 	"resources.alerts.*.evaluation.threshold.column": {"name"},
+	"resources.alerts.*.parameters[*]":               {"name"},
 	"resources.alerts.*.permissions[*]":              {"level"},
 	"resources.alerts.*.schedule":                    {"quartz_cron_schedule", "timezone_id"},
 
 	"resources.apps.*": {"name"},
 	"resources.apps.*.active_deployment.git_source.git_repository":    {"provider", "url"},
 	"resources.apps.*.config.env[*]":                                  {"name"},
+	"resources.apps.*.default_git_source.git_repository":              {"provider", "url"},
 	"resources.apps.*.git_repository":                                 {"provider", "url"},
 	"resources.apps.*.git_source.git_repository":                      {"provider", "url"},
 	"resources.apps.*.pending_deployment.git_source.git_repository":   {"provider", "url"},
@@ -39,6 +41,11 @@ var RequiredFields = map[string][]string{
 	"resources.catalogs.*": {"name"},
 	"resources.catalogs.*.managed_encryption_settings.azure_encryption_settings": {"azure_tenant_id"},
 
+	"resources.cluster_policies.*.libraries[*].cran":  {"package"},
+	"resources.cluster_policies.*.libraries[*].maven": {"coordinates"},
+	"resources.cluster_policies.*.libraries[*].pypi":  {"package"},
+	"resources.cluster_policies.*.permissions[*]":     {"level"},
+
 	"resources.clusters.*.cluster_log_conf.dbfs":     {"destination"},
 	"resources.clusters.*.cluster_log_conf.s3":       {"destination"},
 	"resources.clusters.*.cluster_log_conf.volumes":  {"destination"},
@@ -49,6 +56,9 @@ var RequiredFields = map[string][]string{
 	"resources.clusters.*.init_scripts[*].s3":        {"destination"},
 	"resources.clusters.*.init_scripts[*].volumes":   {"destination"},
 	"resources.clusters.*.init_scripts[*].workspace": {"destination"},
+	"resources.clusters.*.libraries[*].cran":         {"package"},
+	"resources.clusters.*.libraries[*].maven":        {"coordinates"},
+	"resources.clusters.*.libraries[*].pypi":         {"package"},
 	"resources.clusters.*.permissions[*]":            {"level"},
 	"resources.clusters.*.workload_type":             {"clients"},
 
@@ -59,117 +69,231 @@ var RequiredFields = map[string][]string{
 	"resources.database_instances.*":                {"name"},
 	"resources.database_instances.*.permissions[*]": {"level"},
 
-	"resources.experiments.*":                {"name"},
-	"resources.experiments.*.permissions[*]": {"level"},
+	"resources.experiments.*":                                  {"name"},
+	"resources.experiments.*.permissions[*]":                   {"level"},
+	"resources.experiments.*.trace_location.uc_trace_location": {"catalog", "schema"},
 
 	"resources.external_locations.*": {"credential_name", "name", "url"},
 
-	"resources.jobs.*.deployment":                                                                                  {"kind"},
-	"resources.jobs.*.environments[*]":                                                                             {"environment_key"},
-	"resources.jobs.*.git_source":                                                                                  {"git_provider", "git_url"},
-	"resources.jobs.*.git_source.job_source":                                                                       {"import_from_git_branch", "job_config_path"},
-	"resources.jobs.*.health.rules[*]":                                                                             {"metric", "op", "value"},
-	"resources.jobs.*.job_clusters[*]":                                                                             {"job_cluster_key", "new_cluster"},
-	"resources.jobs.*.job_clusters[*].new_cluster.cluster_log_conf.dbfs":                                           {"destination"},
-	"resources.jobs.*.job_clusters[*].new_cluster.cluster_log_conf.s3":                                             {"destination"},
-	"resources.jobs.*.job_clusters[*].new_cluster.cluster_log_conf.volumes":                                        {"destination"},
-	"resources.jobs.*.job_clusters[*].new_cluster.init_scripts[*].abfss":                                           {"destination"},
-	"resources.jobs.*.job_clusters[*].new_cluster.init_scripts[*].dbfs":                                            {"destination"},
-	"resources.jobs.*.job_clusters[*].new_cluster.init_scripts[*].file":                                            {"destination"},
-	"resources.jobs.*.job_clusters[*].new_cluster.init_scripts[*].gcs":                                             {"destination"},
-	"resources.jobs.*.job_clusters[*].new_cluster.init_scripts[*].s3":                                              {"destination"},
-	"resources.jobs.*.job_clusters[*].new_cluster.init_scripts[*].volumes":                                         {"destination"},
-	"resources.jobs.*.job_clusters[*].new_cluster.init_scripts[*].workspace":                                       {"destination"},
-	"resources.jobs.*.job_clusters[*].new_cluster.workload_type":                                                   {"clients"},
-	"resources.jobs.*.parameters[*]":                                                                               {"default", "name"},
-	"resources.jobs.*.permissions[*]":                                                                              {"level"},
-	"resources.jobs.*.queue":                                                                                       {"enabled"},
-	"resources.jobs.*.schedule":                                                                                    {"quartz_cron_expression", "timezone_id"},
-	"resources.jobs.*.tasks[*]":                                                                                    {"task_key"},
-	"resources.jobs.*.tasks[*].clean_rooms_notebook_task":                                                          {"clean_room_name", "notebook_name"},
-	"resources.jobs.*.tasks[*].condition_task":                                                                     {"left", "op", "right"},
-	"resources.jobs.*.tasks[*].dbt_task":                                                                           {"commands"},
-	"resources.jobs.*.tasks[*].depends_on[*]":                                                                      {"task_key"},
-	"resources.jobs.*.tasks[*].for_each_task":                                                                      {"inputs", "task"},
-	"resources.jobs.*.tasks[*].for_each_task.task":                                                                 {"task_key"},
-	"resources.jobs.*.tasks[*].for_each_task.task.clean_rooms_notebook_task":                                       {"clean_room_name", "notebook_name"},
-	"resources.jobs.*.tasks[*].for_each_task.task.condition_task":                                                  {"left", "op", "right"},
-	"resources.jobs.*.tasks[*].for_each_task.task.dbt_task":                                                        {"commands"},
-	"resources.jobs.*.tasks[*].for_each_task.task.depends_on[*]":                                                   {"task_key"},
-	"resources.jobs.*.tasks[*].for_each_task.task.for_each_task":                                                   {"inputs", "task"},
-	"resources.jobs.*.tasks[*].for_each_task.task.gen_ai_compute_task":                                             {"dl_runtime_image"},
-	"resources.jobs.*.tasks[*].for_each_task.task.gen_ai_compute_task.compute":                                     {"num_gpus"},
-	"resources.jobs.*.tasks[*].for_each_task.task.health.rules[*]":                                                 {"metric", "op", "value"},
-	"resources.jobs.*.tasks[*].for_each_task.task.libraries[*].cran":                                               {"package"},
-	"resources.jobs.*.tasks[*].for_each_task.task.libraries[*].maven":                                              {"coordinates"},
-	"resources.jobs.*.tasks[*].for_each_task.task.libraries[*].pypi":                                               {"package"},
-	"resources.jobs.*.tasks[*].for_each_task.task.new_cluster.cluster_log_conf.dbfs":                               {"destination"},
-	"resources.jobs.*.tasks[*].for_each_task.task.new_cluster.cluster_log_conf.s3":                                 {"destination"},
-	"resources.jobs.*.tasks[*].for_each_task.task.new_cluster.cluster_log_conf.volumes":                            {"destination"},
-	"resources.jobs.*.tasks[*].for_each_task.task.new_cluster.init_scripts[*].abfss":                               {"destination"},
-	"resources.jobs.*.tasks[*].for_each_task.task.new_cluster.init_scripts[*].dbfs":                                {"destination"},
-	"resources.jobs.*.tasks[*].for_each_task.task.new_cluster.init_scripts[*].file":                                {"destination"},
-	"resources.jobs.*.tasks[*].for_each_task.task.new_cluster.init_scripts[*].gcs":                                 {"destination"},
-	"resources.jobs.*.tasks[*].for_each_task.task.new_cluster.init_scripts[*].s3":                                  {"destination"},
-	"resources.jobs.*.tasks[*].for_each_task.task.new_cluster.init_scripts[*].volumes":                             {"destination"},
-	"resources.jobs.*.tasks[*].for_each_task.task.new_cluster.init_scripts[*].workspace":                           {"destination"},
-	"resources.jobs.*.tasks[*].for_each_task.task.new_cluster.workload_type":                                       {"clients"},
-	"resources.jobs.*.tasks[*].for_each_task.task.notebook_task":                                                   {"notebook_path"},
-	"resources.jobs.*.tasks[*].for_each_task.task.pipeline_task":                                                   {"pipeline_id"},
-	"resources.jobs.*.tasks[*].for_each_task.task.python_wheel_task":                                               {"entry_point", "package_name"},
-	"resources.jobs.*.tasks[*].for_each_task.task.run_job_task":                                                    {"job_id"},
-	"resources.jobs.*.tasks[*].for_each_task.task.spark_python_task":                                               {"python_file"},
-	"resources.jobs.*.tasks[*].for_each_task.task.sql_task":                                                        {"warehouse_id"},
-	"resources.jobs.*.tasks[*].for_each_task.task.sql_task.alert":                                                  {"alert_id"},
-	"resources.jobs.*.tasks[*].for_each_task.task.sql_task.dashboard":                                              {"dashboard_id"},
-	"resources.jobs.*.tasks[*].for_each_task.task.sql_task.file":                                                   {"path"},
-	"resources.jobs.*.tasks[*].for_each_task.task.sql_task.query":                                                  {"query_id"},
-	"resources.jobs.*.tasks[*].for_each_task.task.webhook_notifications.on_duration_warning_threshold_exceeded[*]": {"id"},
-	"resources.jobs.*.tasks[*].for_each_task.task.webhook_notifications.on_failure[*]":                             {"id"},
-	"resources.jobs.*.tasks[*].for_each_task.task.webhook_notifications.on_start[*]":                               {"id"},
-	"resources.jobs.*.tasks[*].for_each_task.task.webhook_notifications.on_streaming_backlog_exceeded[*]":          {"id"},
-	"resources.jobs.*.tasks[*].for_each_task.task.webhook_notifications.on_success[*]":                             {"id"},
-	"resources.jobs.*.tasks[*].gen_ai_compute_task":                                                                {"dl_runtime_image"},
-	"resources.jobs.*.tasks[*].gen_ai_compute_task.compute":                                                        {"num_gpus"},
-	"resources.jobs.*.tasks[*].health.rules[*]":                                                                    {"metric", "op", "value"},
-	"resources.jobs.*.tasks[*].libraries[*].cran":                                                                  {"package"},
-	"resources.jobs.*.tasks[*].libraries[*].maven":                                                                 {"coordinates"},
-	"resources.jobs.*.tasks[*].libraries[*].pypi":                                                                  {"package"},
-	"resources.jobs.*.tasks[*].new_cluster.cluster_log_conf.dbfs":                                                  {"destination"},
-	"resources.jobs.*.tasks[*].new_cluster.cluster_log_conf.s3":                                                    {"destination"},
-	"resources.jobs.*.tasks[*].new_cluster.cluster_log_conf.volumes":                                               {"destination"},
-	"resources.jobs.*.tasks[*].new_cluster.init_scripts[*].abfss":                                                  {"destination"},
-	"resources.jobs.*.tasks[*].new_cluster.init_scripts[*].dbfs":                                                   {"destination"},
-	"resources.jobs.*.tasks[*].new_cluster.init_scripts[*].file":                                                   {"destination"},
-	"resources.jobs.*.tasks[*].new_cluster.init_scripts[*].gcs":                                                    {"destination"},
-	"resources.jobs.*.tasks[*].new_cluster.init_scripts[*].s3":                                                     {"destination"},
-	"resources.jobs.*.tasks[*].new_cluster.init_scripts[*].volumes":                                                {"destination"},
-	"resources.jobs.*.tasks[*].new_cluster.init_scripts[*].workspace":                                              {"destination"},
-	"resources.jobs.*.tasks[*].new_cluster.workload_type":                                                          {"clients"},
-	"resources.jobs.*.tasks[*].notebook_task":                                                                      {"notebook_path"},
-	"resources.jobs.*.tasks[*].pipeline_task":                                                                      {"pipeline_id"},
-	"resources.jobs.*.tasks[*].python_wheel_task":                                                                  {"entry_point", "package_name"},
-	"resources.jobs.*.tasks[*].run_job_task":                                                                       {"job_id"},
-	"resources.jobs.*.tasks[*].spark_python_task":                                                                  {"python_file"},
-	"resources.jobs.*.tasks[*].sql_task":                                                                           {"warehouse_id"},
-	"resources.jobs.*.tasks[*].sql_task.alert":                                                                     {"alert_id"},
-	"resources.jobs.*.tasks[*].sql_task.dashboard":                                                                 {"dashboard_id"},
-	"resources.jobs.*.tasks[*].sql_task.file":                                                                      {"path"},
-	"resources.jobs.*.tasks[*].sql_task.query":                                                                     {"query_id"},
-	"resources.jobs.*.tasks[*].webhook_notifications.on_duration_warning_threshold_exceeded[*]":                    {"id"},
-	"resources.jobs.*.tasks[*].webhook_notifications.on_failure[*]":                                                {"id"},
-	"resources.jobs.*.tasks[*].webhook_notifications.on_start[*]":                                                  {"id"},
-	"resources.jobs.*.tasks[*].webhook_notifications.on_streaming_backlog_exceeded[*]":                             {"id"},
-	"resources.jobs.*.tasks[*].webhook_notifications.on_success[*]":                                                {"id"},
-	"resources.jobs.*.trigger.file_arrival":                                                                        {"url"},
-	"resources.jobs.*.trigger.model":                                                                               {"condition"},
-	"resources.jobs.*.trigger.periodic":                                                                            {"interval", "unit"},
-	"resources.jobs.*.trigger.table_update":                                                                        {"table_names"},
-	"resources.jobs.*.webhook_notifications.on_duration_warning_threshold_exceeded[*]":                             {"id"},
-	"resources.jobs.*.webhook_notifications.on_failure[*]":                                                         {"id"},
-	"resources.jobs.*.webhook_notifications.on_start[*]":                                                           {"id"},
-	"resources.jobs.*.webhook_notifications.on_streaming_backlog_exceeded[*]":                                      {"id"},
-	"resources.jobs.*.webhook_notifications.on_success[*]":                                                         {"id"},
+	"resources.features.*":             {"full_name", "function", "source"},
+	"resources.features.*.entities[*]": {"name"},
+	"resources.features.*.function.aggregation_function.approx_count_distinct":  {"input"},
+	"resources.features.*.function.aggregation_function.approx_percentile":      {"input", "percentile"},
+	"resources.features.*.function.aggregation_function.avg":                    {"input"},
+	"resources.features.*.function.aggregation_function.count_function":         {"input"},
+	"resources.features.*.function.aggregation_function.first":                  {"input"},
+	"resources.features.*.function.aggregation_function.first_distinct":         {"input", "n"},
+	"resources.features.*.function.aggregation_function.first_n":                {"input", "n"},
+	"resources.features.*.function.aggregation_function.last":                   {"input"},
+	"resources.features.*.function.aggregation_function.last_distinct":          {"input", "n"},
+	"resources.features.*.function.aggregation_function.last_n":                 {"input", "n"},
+	"resources.features.*.function.aggregation_function.max":                    {"input"},
+	"resources.features.*.function.aggregation_function.min":                    {"input"},
+	"resources.features.*.function.aggregation_function.stddev_pop":             {"input"},
+	"resources.features.*.function.aggregation_function.stddev_samp":            {"input"},
+	"resources.features.*.function.aggregation_function.sum":                    {"input"},
+	"resources.features.*.function.aggregation_function.time_window.continuous": {"window_duration"},
+	"resources.features.*.function.aggregation_function.time_window.sliding":    {"slide_duration"},
+	"resources.features.*.function.aggregation_function.time_window.tumbling":   {"window_duration"},
+	"resources.features.*.function.aggregation_function.var_pop":                {"input"},
+	"resources.features.*.function.aggregation_function.var_samp":               {"input"},
+	"resources.features.*.function.column_selection":                            {"column"},
+	"resources.features.*.function.custom_udf":                                  {"function_path"},
+	"resources.features.*.function.custom_udf.input_bindings[*]":                {"column", "parameter"},
+	"resources.features.*.function.extra_parameters[*]":                         {"key", "value"},
+	"resources.features.*.source.delta_table_source":                            {"full_name"},
+	"resources.features.*.source.feature_view_source.feature_references[*]":     {"feature"},
+	"resources.features.*.source.kafka_source":                                  {"name"},
+	"resources.features.*.source.kafka_source.entity_column_identifiers[*]":     {"variant_expr_path"},
+	"resources.features.*.source.kafka_source.timeseries_column_identifier":     {"variant_expr_path"},
+	"resources.features.*.source.request_source.flat_schema":                    {"fields"},
+	"resources.features.*.source.request_source.flat_schema.fields[*]":          {"data_type", "name"},
+	"resources.features.*.source.stream_source":                                 {"full_name"},
+	"resources.features.*.time_window.continuous":                               {"window_duration"},
+	"resources.features.*.time_window.sliding":                                  {"slide_duration"},
+	"resources.features.*.time_window.tumbling":                                 {"window_duration"},
+	"resources.features.*.timeseries_column":                                    {"name"},
+
+	"resources.genie_spaces.*.permissions[*]": {"level"},
+
+	"resources.instance_pools.*":                {"instance_pool_name", "node_type_id"},
+	"resources.instance_pools.*.permissions[*]": {"level"},
+
+	"resources.job_runs.*":       {"job_id"},
+	"resources.job_runs.*.queue": {"enabled"},
+
+	"resources.jobs.*.continuous.maintenance_window":                                                                 {"day_of_week", "start_hour", "timezone_id"},
+	"resources.jobs.*.deployment":                                                                                    {"kind"},
+	"resources.jobs.*.environment_variables[*]":                                                                      {"environment_variables_key"},
+	"resources.jobs.*.environments[*]":                                                                               {"environment_key"},
+	"resources.jobs.*.git_source":                                                                                    {"git_provider", "git_url"},
+	"resources.jobs.*.git_source.job_source":                                                                         {"import_from_git_branch", "job_config_path"},
+	"resources.jobs.*.health.rules[*]":                                                                               {"metric", "op", "value"},
+	"resources.jobs.*.job_clusters[*]":                                                                               {"job_cluster_key"},
+	"resources.jobs.*.job_clusters[*].new_cluster.cluster_log_conf.dbfs":                                             {"destination"},
+	"resources.jobs.*.job_clusters[*].new_cluster.cluster_log_conf.s3":                                               {"destination"},
+	"resources.jobs.*.job_clusters[*].new_cluster.cluster_log_conf.volumes":                                          {"destination"},
+	"resources.jobs.*.job_clusters[*].new_cluster.init_scripts[*].abfss":                                             {"destination"},
+	"resources.jobs.*.job_clusters[*].new_cluster.init_scripts[*].dbfs":                                              {"destination"},
+	"resources.jobs.*.job_clusters[*].new_cluster.init_scripts[*].file":                                              {"destination"},
+	"resources.jobs.*.job_clusters[*].new_cluster.init_scripts[*].gcs":                                               {"destination"},
+	"resources.jobs.*.job_clusters[*].new_cluster.init_scripts[*].s3":                                                {"destination"},
+	"resources.jobs.*.job_clusters[*].new_cluster.init_scripts[*].volumes":                                           {"destination"},
+	"resources.jobs.*.job_clusters[*].new_cluster.init_scripts[*].workspace":                                         {"destination"},
+	"resources.jobs.*.job_clusters[*].new_cluster.workload_type":                                                     {"clients"},
+	"resources.jobs.*.parameters[*]":                                                                                 {"default", "name"},
+	"resources.jobs.*.permissions[*]":                                                                                {"level"},
+	"resources.jobs.*.queue":                                                                                         {"enabled"},
+	"resources.jobs.*.schedule":                                                                                      {"quartz_cron_expression", "timezone_id"},
+	"resources.jobs.*.schedule.sql_condition":                                                                        {"sql_query_id", "warehouse_id"},
+	"resources.jobs.*.tasks[*]":                                                                                      {"task_key"},
+	"resources.jobs.*.tasks[*].ai_runtime_task":                                                                      {"deployments", "experiment"},
+	"resources.jobs.*.tasks[*].ai_runtime_task.deployments[*]":                                                       {"compute"},
+	"resources.jobs.*.tasks[*].ai_runtime_task.deployments[*].compute":                                               {"accelerator_count", "accelerator_type"},
+	"resources.jobs.*.tasks[*].clean_rooms_notebook_task":                                                            {"clean_room_name", "notebook_name"},
+	"resources.jobs.*.tasks[*].condition_task":                                                                       {"left", "op", "right"},
+	"resources.jobs.*.tasks[*].dashboard_task.subscription.attachment.data_attachment":                               {"file_format", "widgets"},
+	"resources.jobs.*.tasks[*].dashboard_task.subscription.attachment.data_attachment.widgets[*]":                    {"page_id", "widget_id"},
+	"resources.jobs.*.tasks[*].dbt_task":                                                                             {"commands"},
+	"resources.jobs.*.tasks[*].depends_on[*]":                                                                        {"task_key"},
+	"resources.jobs.*.tasks[*].for_each_task":                                                                        {"inputs", "task"},
+	"resources.jobs.*.tasks[*].for_each_task.task":                                                                   {"task_key"},
+	"resources.jobs.*.tasks[*].for_each_task.task.ai_runtime_task":                                                   {"deployments", "experiment"},
+	"resources.jobs.*.tasks[*].for_each_task.task.ai_runtime_task.deployments[*]":                                    {"compute"},
+	"resources.jobs.*.tasks[*].for_each_task.task.ai_runtime_task.deployments[*].compute":                            {"accelerator_count", "accelerator_type"},
+	"resources.jobs.*.tasks[*].for_each_task.task.clean_rooms_notebook_task":                                         {"clean_room_name", "notebook_name"},
+	"resources.jobs.*.tasks[*].for_each_task.task.condition_task":                                                    {"left", "op", "right"},
+	"resources.jobs.*.tasks[*].for_each_task.task.dashboard_task.subscription.attachment.data_attachment":            {"file_format", "widgets"},
+	"resources.jobs.*.tasks[*].for_each_task.task.dashboard_task.subscription.attachment.data_attachment.widgets[*]": {"page_id", "widget_id"},
+	"resources.jobs.*.tasks[*].for_each_task.task.dbt_task":                                                          {"commands"},
+	"resources.jobs.*.tasks[*].for_each_task.task.depends_on[*]":                                                     {"task_key"},
+	"resources.jobs.*.tasks[*].for_each_task.task.for_each_task":                                                     {"inputs", "task"},
+	"resources.jobs.*.tasks[*].for_each_task.task.gen_ai_compute_task":                                               {"dl_runtime_image"},
+	"resources.jobs.*.tasks[*].for_each_task.task.gen_ai_compute_task.compute":                                       {"num_gpus"},
+	"resources.jobs.*.tasks[*].for_each_task.task.health.rules[*]":                                                   {"metric", "op", "value"},
+	"resources.jobs.*.tasks[*].for_each_task.task.libraries[*].cran":                                                 {"package"},
+	"resources.jobs.*.tasks[*].for_each_task.task.libraries[*].maven":                                                {"coordinates"},
+	"resources.jobs.*.tasks[*].for_each_task.task.libraries[*].pypi":                                                 {"package"},
+	"resources.jobs.*.tasks[*].for_each_task.task.new_cluster.cluster_log_conf.dbfs":                                 {"destination"},
+	"resources.jobs.*.tasks[*].for_each_task.task.new_cluster.cluster_log_conf.s3":                                   {"destination"},
+	"resources.jobs.*.tasks[*].for_each_task.task.new_cluster.cluster_log_conf.volumes":                              {"destination"},
+	"resources.jobs.*.tasks[*].for_each_task.task.new_cluster.init_scripts[*].abfss":                                 {"destination"},
+	"resources.jobs.*.tasks[*].for_each_task.task.new_cluster.init_scripts[*].dbfs":                                  {"destination"},
+	"resources.jobs.*.tasks[*].for_each_task.task.new_cluster.init_scripts[*].file":                                  {"destination"},
+	"resources.jobs.*.tasks[*].for_each_task.task.new_cluster.init_scripts[*].gcs":                                   {"destination"},
+	"resources.jobs.*.tasks[*].for_each_task.task.new_cluster.init_scripts[*].s3":                                    {"destination"},
+	"resources.jobs.*.tasks[*].for_each_task.task.new_cluster.init_scripts[*].volumes":                               {"destination"},
+	"resources.jobs.*.tasks[*].for_each_task.task.new_cluster.init_scripts[*].workspace":                             {"destination"},
+	"resources.jobs.*.tasks[*].for_each_task.task.new_cluster.workload_type":                                         {"clients"},
+	"resources.jobs.*.tasks[*].for_each_task.task.notebook_task":                                                     {"notebook_path"},
+	"resources.jobs.*.tasks[*].for_each_task.task.pipeline_task":                                                     {"pipeline_id"},
+	"resources.jobs.*.tasks[*].for_each_task.task.python_wheel_task":                                                 {"entry_point", "package_name"},
+	"resources.jobs.*.tasks[*].for_each_task.task.run_job_task":                                                      {"job_id"},
+	"resources.jobs.*.tasks[*].for_each_task.task.spark_python_task":                                                 {"python_file"},
+	"resources.jobs.*.tasks[*].for_each_task.task.sql_task":                                                          {"warehouse_id"},
+	"resources.jobs.*.tasks[*].for_each_task.task.sql_task.alert":                                                    {"alert_id"},
+	"resources.jobs.*.tasks[*].for_each_task.task.sql_task.dashboard":                                                {"dashboard_id"},
+	"resources.jobs.*.tasks[*].for_each_task.task.sql_task.file":                                                     {"path"},
+	"resources.jobs.*.tasks[*].for_each_task.task.sql_task.query":                                                    {"query_id"},
+	"resources.jobs.*.tasks[*].for_each_task.task.webhook_notifications.on_duration_warning_threshold_exceeded[*]":   {"id"},
+	"resources.jobs.*.tasks[*].for_each_task.task.webhook_notifications.on_failure[*]":                               {"id"},
+	"resources.jobs.*.tasks[*].for_each_task.task.webhook_notifications.on_maintenance_complete[*]":                  {"id"},
+	"resources.jobs.*.tasks[*].for_each_task.task.webhook_notifications.on_maintenance_start[*]":                     {"id"},
+	"resources.jobs.*.tasks[*].for_each_task.task.webhook_notifications.on_start[*]":                                 {"id"},
+	"resources.jobs.*.tasks[*].for_each_task.task.webhook_notifications.on_streaming_backlog_exceeded[*]":            {"id"},
+	"resources.jobs.*.tasks[*].for_each_task.task.webhook_notifications.on_success[*]":                               {"id"},
+	"resources.jobs.*.tasks[*].gen_ai_compute_task":                                                                  {"dl_runtime_image"},
+	"resources.jobs.*.tasks[*].gen_ai_compute_task.compute":                                                          {"num_gpus"},
+	"resources.jobs.*.tasks[*].health.rules[*]":                                                                      {"metric", "op", "value"},
+	"resources.jobs.*.tasks[*].libraries[*].cran":                                                                    {"package"},
+	"resources.jobs.*.tasks[*].libraries[*].maven":                                                                   {"coordinates"},
+	"resources.jobs.*.tasks[*].libraries[*].pypi":                                                                    {"package"},
+	"resources.jobs.*.tasks[*].new_cluster.cluster_log_conf.dbfs":                                                    {"destination"},
+	"resources.jobs.*.tasks[*].new_cluster.cluster_log_conf.s3":                                                      {"destination"},
+	"resources.jobs.*.tasks[*].new_cluster.cluster_log_conf.volumes":                                                 {"destination"},
+	"resources.jobs.*.tasks[*].new_cluster.init_scripts[*].abfss":                                                    {"destination"},
+	"resources.jobs.*.tasks[*].new_cluster.init_scripts[*].dbfs":                                                     {"destination"},
+	"resources.jobs.*.tasks[*].new_cluster.init_scripts[*].file":                                                     {"destination"},
+	"resources.jobs.*.tasks[*].new_cluster.init_scripts[*].gcs":                                                      {"destination"},
+	"resources.jobs.*.tasks[*].new_cluster.init_scripts[*].s3":                                                       {"destination"},
+	"resources.jobs.*.tasks[*].new_cluster.init_scripts[*].volumes":                                                  {"destination"},
+	"resources.jobs.*.tasks[*].new_cluster.init_scripts[*].workspace":                                                {"destination"},
+	"resources.jobs.*.tasks[*].new_cluster.workload_type":                                                            {"clients"},
+	"resources.jobs.*.tasks[*].notebook_task":                                                                        {"notebook_path"},
+	"resources.jobs.*.tasks[*].pipeline_task":                                                                        {"pipeline_id"},
+	"resources.jobs.*.tasks[*].python_wheel_task":                                                                    {"entry_point", "package_name"},
+	"resources.jobs.*.tasks[*].run_job_task":                                                                         {"job_id"},
+	"resources.jobs.*.tasks[*].spark_python_task":                                                                    {"python_file"},
+	"resources.jobs.*.tasks[*].sql_task":                                                                             {"warehouse_id"},
+	"resources.jobs.*.tasks[*].sql_task.alert":                                                                       {"alert_id"},
+	"resources.jobs.*.tasks[*].sql_task.dashboard":                                                                   {"dashboard_id"},
+	"resources.jobs.*.tasks[*].sql_task.file":                                                                        {"path"},
+	"resources.jobs.*.tasks[*].sql_task.query":                                                                       {"query_id"},
+	"resources.jobs.*.tasks[*].webhook_notifications.on_duration_warning_threshold_exceeded[*]":                      {"id"},
+	"resources.jobs.*.tasks[*].webhook_notifications.on_failure[*]":                                                  {"id"},
+	"resources.jobs.*.tasks[*].webhook_notifications.on_maintenance_complete[*]":                                     {"id"},
+	"resources.jobs.*.tasks[*].webhook_notifications.on_maintenance_start[*]":                                        {"id"},
+	"resources.jobs.*.tasks[*].webhook_notifications.on_start[*]":                                                    {"id"},
+	"resources.jobs.*.tasks[*].webhook_notifications.on_streaming_backlog_exceeded[*]":                               {"id"},
+	"resources.jobs.*.tasks[*].webhook_notifications.on_success[*]":                                                  {"id"},
+	"resources.jobs.*.trigger.file_arrival":                                                                          {"url"},
+	"resources.jobs.*.trigger.model":                                                                                 {"condition"},
+	"resources.jobs.*.trigger.periodic":                                                                              {"interval", "unit"},
+	"resources.jobs.*.trigger.sql_condition":                                                                         {"sql_query_id", "warehouse_id"},
+	"resources.jobs.*.trigger.table_update":                                                                          {"table_names"},
+	"resources.jobs.*.triggers[*].continuous.maintenance_window":                                                     {"day_of_week", "start_hour", "timezone_id"},
+	"resources.jobs.*.triggers[*].file_arrival":                                                                      {"url"},
+	"resources.jobs.*.triggers[*].model":                                                                             {"condition"},
+	"resources.jobs.*.triggers[*].periodic":                                                                          {"interval", "unit"},
+	"resources.jobs.*.triggers[*].schedule":                                                                          {"quartz_cron_expression", "timezone_id"},
+	"resources.jobs.*.triggers[*].sql_condition":                                                                     {"sql_query_id", "warehouse_id"},
+	"resources.jobs.*.triggers[*].table_update":                                                                      {"table_names"},
+	"resources.jobs.*.webhook_notifications.on_duration_warning_threshold_exceeded[*]":                               {"id"},
+	"resources.jobs.*.webhook_notifications.on_failure[*]":                                                           {"id"},
+	"resources.jobs.*.webhook_notifications.on_maintenance_complete[*]":                                              {"id"},
+	"resources.jobs.*.webhook_notifications.on_maintenance_start[*]":                                                 {"id"},
+	"resources.jobs.*.webhook_notifications.on_start[*]":                                                             {"id"},
+	"resources.jobs.*.webhook_notifications.on_streaming_backlog_exceeded[*]":                                        {"id"},
+	"resources.jobs.*.webhook_notifications.on_success[*]":                                                           {"id"},
+
+	"resources.mcp_services.*":                          {"parent", "mcp_service_id"},
+	"resources.mcp_services.*.config.rate_limits[*]":    {"key", "renewal_period"},
+	"resources.mcp_services.*.config.source_connection": {"name"},
+
+	"resources.model_provider_services.*": {"parent", "model_provider_service_id"},
+	"resources.model_provider_services.*.config.amazon_bedrock.direct.aws_access_key.secret_access_key.secret_reference":         {"name"},
+	"resources.model_provider_services.*.config.amazon_bedrock.direct.service_credential":                                        {"name"},
+	"resources.model_provider_services.*.config.anthropic.direct.api_key.secret_reference":                                       {"name"},
+	"resources.model_provider_services.*.config.azure_openai.direct.api_key.secret_reference":                                    {"name"},
+	"resources.model_provider_services.*.config.azure_openai.direct.entra_service_principal.client_secret.secret_reference":      {"name"},
+	"resources.model_provider_services.*.config.azure_openai.direct.service_credential":                                          {"name"},
+	"resources.model_provider_services.*.config.bedrock_mantle.direct.aws_access_key.secret_access_key.secret_reference":         {"name"},
+	"resources.model_provider_services.*.config.bedrock_mantle.direct.service_credential":                                        {"name"},
+	"resources.model_provider_services.*.config.custom.direct.api_key.secret_reference":                                          {"name"},
+	"resources.model_provider_services.*.config.custom.direct.header_auth.api_key_value.secret_reference":                        {"name"},
+	"resources.model_provider_services.*.config.gemini_enterprise.direct.api_key.secret_reference":                               {"name"},
+	"resources.model_provider_services.*.config.gemini_enterprise.direct.service_credential":                                     {"name"},
+	"resources.model_provider_services.*.config.inference_table":                                                                 {"parent"},
+	"resources.model_provider_services.*.config.microsoft_foundry.direct.api_key.secret_reference":                               {"name"},
+	"resources.model_provider_services.*.config.microsoft_foundry.direct.entra_service_principal.client_secret.secret_reference": {"name"},
+	"resources.model_provider_services.*.config.microsoft_foundry.direct.service_credential":                                     {"name"},
+	"resources.model_provider_services.*.config.openai.direct.api_key.secret_reference":                                          {"name"},
+	"resources.model_provider_services.*.config.rate_limits[*]":                                                                  {"key", "renewal_period"},
+	"resources.model_provider_services.*.config.targets[*]":                                                                      {"model"},
+
+	"resources.model_services.*":                                                                       {"parent", "model_service_id"},
+	"resources.model_services.*.config.inference_table":                                                {"parent"},
+	"resources.model_services.*.config.rate_limits[*]":                                                 {"key", "renewal_period"},
+	"resources.model_services.*.config.routing.destinations[*]":                                        {"destination_type", "name"},
+	"resources.model_services.*.config.routing.destinations[*].external_model_config":                  {"model_provider_service", "target"},
+	"resources.model_services.*.config.routing.destinations[*].external_model_config.target":           {"model"},
+	"resources.model_services.*.config.routing.destinations[*].pay_per_token_config":                   {"model"},
+	"resources.model_services.*.config.routing.destinations[*].provisioned_throughput_config":          {"model_serving_endpoint"},
+	"resources.model_services.*.config.routing.fallback.destinations[*]":                               {"destination_type", "name"},
+	"resources.model_services.*.config.routing.fallback.destinations[*].external_model_config":         {"model_provider_service", "target"},
+	"resources.model_services.*.config.routing.fallback.destinations[*].external_model_config.target":  {"model"},
+	"resources.model_services.*.config.routing.fallback.destinations[*].pay_per_token_config":          {"model"},
+	"resources.model_services.*.config.routing.fallback.destinations[*].provisioned_throughput_config": {"model_serving_endpoint"},
 
 	"resources.model_serving_endpoints.*":                                                                              {"name"},
 	"resources.model_serving_endpoints.*.ai_gateway.fallback_config":                                                   {"enabled"},
@@ -189,42 +313,63 @@ var RequiredFields = map[string][]string{
 	"resources.models.*":                {"name"},
 	"resources.models.*.permissions[*]": {"level"},
 
-	"resources.pipelines.*.clusters[*].autoscale":                                                               {"max_workers", "min_workers"},
-	"resources.pipelines.*.clusters[*].cluster_log_conf.dbfs":                                                   {"destination"},
-	"resources.pipelines.*.clusters[*].cluster_log_conf.s3":                                                     {"destination"},
-	"resources.pipelines.*.clusters[*].cluster_log_conf.volumes":                                                {"destination"},
-	"resources.pipelines.*.clusters[*].init_scripts[*].abfss":                                                   {"destination"},
-	"resources.pipelines.*.clusters[*].init_scripts[*].dbfs":                                                    {"destination"},
-	"resources.pipelines.*.clusters[*].init_scripts[*].file":                                                    {"destination"},
-	"resources.pipelines.*.clusters[*].init_scripts[*].gcs":                                                     {"destination"},
-	"resources.pipelines.*.clusters[*].init_scripts[*].s3":                                                      {"destination"},
-	"resources.pipelines.*.clusters[*].init_scripts[*].volumes":                                                 {"destination"},
-	"resources.pipelines.*.clusters[*].init_scripts[*].workspace":                                               {"destination"},
-	"resources.pipelines.*.deployment":                                                                          {"kind"},
-	"resources.pipelines.*.gateway_definition":                                                                  {"connection_name", "gateway_storage_catalog", "gateway_storage_schema"},
-	"resources.pipelines.*.ingestion_definition.data_staging_options":                                           {"catalog_name", "schema_name"},
-	"resources.pipelines.*.ingestion_definition.full_refresh_window":                                            {"start_hour"},
-	"resources.pipelines.*.ingestion_definition.objects[*].report":                                              {"destination_catalog", "destination_schema", "source_url"},
-	"resources.pipelines.*.ingestion_definition.objects[*].report.table_configuration.auto_full_refresh_policy": {"enabled"},
-	"resources.pipelines.*.ingestion_definition.objects[*].schema":                                              {"destination_catalog", "destination_schema", "source_schema"},
-	"resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.google_ads_options":         {"manager_account_id"},
-	"resources.pipelines.*.ingestion_definition.objects[*].schema.table_configuration.auto_full_refresh_policy": {"enabled"},
-	"resources.pipelines.*.ingestion_definition.objects[*].table":                                               {"destination_catalog", "destination_schema", "source_table"},
-	"resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.google_ads_options":          {"manager_account_id"},
-	"resources.pipelines.*.ingestion_definition.objects[*].table.table_configuration.auto_full_refresh_policy":  {"enabled"},
-	"resources.pipelines.*.ingestion_definition.table_configuration.auto_full_refresh_policy":                   {"enabled"},
-	"resources.pipelines.*.libraries[*].maven":                                                                  {"coordinates"},
-	"resources.pipelines.*.permissions[*]":                                                                      {"level"},
-	"resources.pipelines.*.restart_window":                                                                      {"start_hour"},
+	"resources.pipelines.*.clusters[*].autoscale":                                                                               {"max_workers", "min_workers"},
+	"resources.pipelines.*.clusters[*].cluster_log_conf.dbfs":                                                                   {"destination"},
+	"resources.pipelines.*.clusters[*].cluster_log_conf.s3":                                                                     {"destination"},
+	"resources.pipelines.*.clusters[*].cluster_log_conf.volumes":                                                                {"destination"},
+	"resources.pipelines.*.clusters[*].init_scripts[*].abfss":                                                                   {"destination"},
+	"resources.pipelines.*.clusters[*].init_scripts[*].dbfs":                                                                    {"destination"},
+	"resources.pipelines.*.clusters[*].init_scripts[*].file":                                                                    {"destination"},
+	"resources.pipelines.*.clusters[*].init_scripts[*].gcs":                                                                     {"destination"},
+	"resources.pipelines.*.clusters[*].init_scripts[*].s3":                                                                      {"destination"},
+	"resources.pipelines.*.clusters[*].init_scripts[*].volumes":                                                                 {"destination"},
+	"resources.pipelines.*.clusters[*].init_scripts[*].workspace":                                                               {"destination"},
+	"resources.pipelines.*.deployment":                                                                                          {"kind"},
+	"resources.pipelines.*.gateway_definition":                                                                                  {"connection_name", "gateway_storage_catalog", "gateway_storage_schema"},
+	"resources.pipelines.*.ingestion_definition.data_staging_options":                                                           {"catalog_name", "schema_name"},
+	"resources.pipelines.*.ingestion_definition.full_refresh_window":                                                            {"start_hour"},
+	"resources.pipelines.*.ingestion_definition.objects[*].report":                                                              {"destination_catalog", "destination_schema", "source_url"},
+	"resources.pipelines.*.ingestion_definition.objects[*].report.table_configuration.auto_full_refresh_policy":                 {"enabled"},
+	"resources.pipelines.*.ingestion_definition.objects[*].schema":                                                              {"destination_catalog", "destination_schema"},
+	"resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.google_ads_options":                         {"manager_account_id"},
+	"resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.google_ads_options.custom_report_options":   {"resource"},
+	"resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.linkedin_ads_options.custom_report_options": {"finder"},
+	"resources.pipelines.*.ingestion_definition.objects[*].schema.connector_options.rabbitmq_options":                           {"queue"},
+	"resources.pipelines.*.ingestion_definition.objects[*].schema.table_configuration.auto_full_refresh_policy":                 {"enabled"},
+	"resources.pipelines.*.ingestion_definition.objects[*].table":                                                               {"destination_catalog", "destination_schema"},
+	"resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.google_ads_options":                          {"manager_account_id"},
+	"resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.google_ads_options.custom_report_options":    {"resource"},
+	"resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.linkedin_ads_options.custom_report_options":  {"finder"},
+	"resources.pipelines.*.ingestion_definition.objects[*].table.connector_options.rabbitmq_options":                            {"queue"},
+	"resources.pipelines.*.ingestion_definition.objects[*].table.table_configuration.auto_full_refresh_policy":                  {"enabled"},
+	"resources.pipelines.*.ingestion_definition.table_configuration.auto_full_refresh_policy":                                   {"enabled"},
+	"resources.pipelines.*.libraries[*].maven":                                                                                  {"coordinates"},
+	"resources.pipelines.*.permissions[*]":                                                                                      {"level"},
+	"resources.pipelines.*.restart_window":                                                                                      {"start_hour"},
 
 	"resources.postgres_branches.*": {"branch_id", "parent"},
 
+	"resources.postgres_catalogs.*": {"postgres_database", "catalog_id"},
+
+	"resources.postgres_databases.*": {"role", "database_id", "parent"},
+
 	"resources.postgres_endpoints.*":       {"endpoint_type", "endpoint_id", "parent"},
 	"resources.postgres_endpoints.*.group": {"max", "min"},
 
 	"resources.postgres_projects.*":                {"project_id"},
 	"resources.postgres_projects.*.permissions[*]": {"level"},
 
+	"resources.postgres_roles.*": {"role_id", "parent"},
+
+	"resources.postgres_snapshot_schedules.*":                              {"branch"},
+	"resources.postgres_snapshot_schedules.*.schedule[*]":                  {"retention"},
+	"resources.postgres_snapshot_schedules.*.schedule[*].monthly_schedule": {"day"},
+	"resources.postgres_snapshot_schedules.*.schedule[*].weekly_schedule":  {"day_of_week"},
+
+	"resources.postgres_synced_tables.*":                   {"synced_table_id"},
+	"resources.postgres_synced_tables.*.extra_columns[*]":  {"column_name", "column_type"},
+	"resources.postgres_synced_tables.*.type_overrides[*]": {"column_name", "pg_type"},
+
 	"resources.quality_monitors.*":                   {"assets_dir", "output_schema_name", "table_name"},
 	"resources.quality_monitors.*.custom_metrics[*]": {"definition", "input_columns", "name", "output_data_type", "type"},
 	"resources.quality_monitors.*.inference_log":     {"granularities", "model_id_col", "prediction_col", "problem_type", "timestamp_col"},
@@ -237,13 +382,18 @@ var RequiredFields = map[string][]string{
 	"resources.secret_scopes.*.keyvault_metadata": {"dns_name", "resource_id"},
 	"resources.secret_scopes.*.permissions[*]":    {"level"},
 
+	"resources.secrets.*": {"catalog_name", "name", "schema_name", "value"},
+
 	"resources.sql_warehouses.*.permissions[*]": {"level"},
 
-	"resources.synced_database_tables.*": {"name"},
+	"resources.synced_database_tables.*":                        {"name"},
+	"resources.synced_database_tables.*.spec.type_overrides[*]": {"column_name", "pg_type"},
 
 	"resources.vector_search_endpoints.*":                {"endpoint_type", "name"},
 	"resources.vector_search_endpoints.*.permissions[*]": {"level"},
 
+	"resources.vector_search_indexes.*": {"endpoint_name", "index_type", "name", "primary_key"},
+
 	"resources.volumes.*": {"catalog_name", "name", "schema_name", "volume_type"},
 
 	"scripts.*": {"content"},
diff --git a/bundle/libraries/expand_glob_references.go b/bundle/libraries/expand_glob_references.go
index 903cc58f286..df089f880a7 100644
--- a/bundle/libraries/expand_glob_references.go
+++ b/bundle/libraries/expand_glob_references.go
@@ -14,12 +14,12 @@ import (
 
 type expand struct{}
 
-func matchError(p dyn.Path, l []dyn.Location, message string) diag.Diagnostic {
+func matchError(p dyn.Path, l []diag.Location, message string) diag.Diagnostic {
 	return diag.Diagnostic{
 		Severity:  diag.Error,
 		Summary:   message,
 		Locations: l,
-		Paths:     []dyn.Path{p},
+		Paths:     dyn.ToStructPaths(p),
 	}
 }
 
@@ -116,6 +116,9 @@ func expandEnvironmentDeps(ctx context.Context, b *bundle.Bundle, p dyn.Path, v
 			continue
 		}
 
+		// Strip extras before globbing so "[...]" isn't read as a glob class, then re-append.
+		path, extras := patchwheel.SplitWheelExtras(path)
+
 		matches, err := findMatches(ctx, b, path)
 		if err != nil {
 			diags = diags.Append(matchError(lp, dep.Locations(), err.Error()))
@@ -123,7 +126,7 @@ func expandEnvironmentDeps(ctx context.Context, b *bundle.Bundle, p dyn.Path, v
 		}
 
 		for _, match := range matches {
-			output = append(output, dyn.NewValue(match, dep.Locations()))
+			output = append(output, dyn.NewValue(match+extras, dep.Locations()))
 		}
 	}
 
@@ -155,6 +158,28 @@ var forEachTaskLibrariesPattern = dyn.NewPattern(
 	dyn.Key("libraries"),
 )
 
+var aiRuntimeCodeSourcePattern = dyn.NewPattern(
+	dyn.Key("resources"),
+	dyn.Key("jobs"),
+	dyn.AnyKey(),
+	dyn.Key("tasks"),
+	dyn.AnyIndex(),
+	dyn.Key("ai_runtime_task"),
+	dyn.Key("code_source_path"),
+)
+
+var forEachAiRuntimeCodeSourcePattern = dyn.NewPattern(
+	dyn.Key("resources"),
+	dyn.Key("jobs"),
+	dyn.AnyKey(),
+	dyn.Key("tasks"),
+	dyn.AnyIndex(),
+	dyn.Key("for_each_task"),
+	dyn.Key("task"),
+	dyn.Key("ai_runtime_task"),
+	dyn.Key("code_source_path"),
+)
+
 var envDepsPattern = dyn.NewPattern(
 	dyn.Key("resources"),
 	dyn.Key("jobs"),
@@ -173,6 +198,13 @@ var pipelineEnvDepsPattern = dyn.NewPattern(
 	dyn.Key("dependencies"),
 )
 
+var clusterLibrariesPattern = dyn.NewPattern(
+	dyn.Key("resources"),
+	dyn.Key("clusters"),
+	dyn.AnyKey(),
+	dyn.Key("libraries"),
+)
+
 func (e *expand) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
 	expanders := []expandPattern{
 		{
@@ -191,6 +223,10 @@ func (e *expand) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
 			pattern: pipelineEnvDepsPattern,
 			fn:      expandEnvironmentDeps,
 		},
+		{
+			pattern: clusterLibrariesPattern,
+			fn:      expandLibraries,
+		},
 	}
 
 	var diags diag.Diagnostics
diff --git a/bundle/libraries/expand_glob_references_test.go b/bundle/libraries/expand_glob_references_test.go
index 44ffe97a6eb..331fbf2e7cb 100644
--- a/bundle/libraries/expand_glob_references_test.go
+++ b/bundle/libraries/expand_glob_references_test.go
@@ -9,6 +9,7 @@ import (
 	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/cli/bundle/internal/bundletest"
 	"github.com/databricks/cli/internal/testutil"
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/databricks-sdk-go/service/compute"
 	"github.com/databricks/databricks-sdk-go/service/jobs"
@@ -63,7 +64,7 @@ func TestGlobReferencesExpandedForTaskLibraries(t *testing.T) {
 		},
 	}
 
-	bundletest.SetLocation(b, ".", []dyn.Location{{File: filepath.Join(dir, "resource.yml")}})
+	bundletest.SetLocation(b, ".", []diag.Location{{File: filepath.Join(dir, "resource.yml")}})
 
 	diags := bundle.Apply(t.Context(), b, ExpandGlobReferences())
 	require.Empty(t, diags)
@@ -148,7 +149,7 @@ func TestGlobReferencesExpandedForForeachTaskLibraries(t *testing.T) {
 		},
 	}
 
-	bundletest.SetLocation(b, ".", []dyn.Location{{File: filepath.Join(dir, "resource.yml")}})
+	bundletest.SetLocation(b, ".", []diag.Location{{File: filepath.Join(dir, "resource.yml")}})
 
 	diags := bundle.Apply(t.Context(), b, ExpandGlobReferences())
 	require.Empty(t, diags)
@@ -223,7 +224,7 @@ func TestGlobReferencesExpandedForEnvironmentsDeps(t *testing.T) {
 		},
 	}
 
-	bundletest.SetLocation(b, ".", []dyn.Location{{File: filepath.Join(dir, "resource.yml")}})
+	bundletest.SetLocation(b, ".", []diag.Location{{File: filepath.Join(dir, "resource.yml")}})
 
 	diags := bundle.Apply(t.Context(), b, ExpandGlobReferences())
 	require.Empty(t, diags)
@@ -276,8 +277,8 @@ func TestExpandGlobReferencesPreservesLocations(t *testing.T) {
 		},
 	}
 
-	loc := dyn.Location{File: filepath.Join(dir, "resource.yml"), Line: 10, Column: 5}
-	bundletest.SetLocation(b, ".", []dyn.Location{loc})
+	loc := diag.Location{File: filepath.Join(dir, "resource.yml"), Line: 10, Column: 5}
+	bundletest.SetLocation(b, ".", []diag.Location{loc})
 
 	diags := bundle.Apply(t.Context(), b, ExpandGlobReferences())
 	require.Empty(t, diags)
diff --git a/bundle/libraries/filer.go b/bundle/libraries/filer.go
index 762732262be..cac3193a38e 100644
--- a/bundle/libraries/filer.go
+++ b/bundle/libraries/filer.go
@@ -6,6 +6,7 @@ import (
 	"strings"
 
 	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/filer"
 )
@@ -24,8 +25,13 @@ func GetFilerForLibraries(ctx context.Context, b *bundle.Bundle) (filer.Filer, s
 		return nil, "", diag.Errorf("remote artifact path not configured")
 	}
 
-	uploadPath := path.Join(b.Config.Workspace.ArtifactPath, InternalDirName)
-	uploadPath = ensureWorkspaceOrVolumesPrefix(uploadPath)
+	var uploadPath string
+	if b.IsImmutableFolder() {
+		uploadPath = path.Join(resources.SnapshotFullPathRef, "artifacts", InternalDirName)
+	} else {
+		uploadPath = path.Join(b.Config.Workspace.ArtifactPath, InternalDirName)
+		uploadPath = ensureWorkspaceOrVolumesPrefix(uploadPath)
+	}
 
 	switch {
 	case IsVolumesPath(artifactPath):
@@ -37,6 +43,9 @@ func GetFilerForLibraries(ctx context.Context, b *bundle.Bundle) (filer.Filer, s
 }
 
 func GetFilerForLibrariesCleanup(ctx context.Context, b *bundle.Bundle) (filer.Filer, string, diag.Diagnostics) {
+	// No immutable-folder special case: immutable snapshots are never cleaned up
+	// remotely (they are immutable, and artifacts.CleanUp only runs for non-immutable
+	// deploys), so this only handles the regular artifact path.
 	artifactPath := b.Config.Workspace.ArtifactPath
 	if artifactPath == "" {
 		return nil, "", diag.Errorf("remote artifact path not configured")
diff --git a/bundle/libraries/filer_volume.go b/bundle/libraries/filer_volume.go
index f4b5f51f0c2..fdd6190e019 100644
--- a/bundle/libraries/filer_volume.go
+++ b/bundle/libraries/filer_volume.go
@@ -10,6 +10,6 @@ import (
 
 func filerForVolume(ctx context.Context, b *bundle.Bundle, uploadPath string) (filer.Filer, string, diag.Diagnostics) {
 	w := b.WorkspaceClient(ctx)
-	f, err := filer.NewFilesClient(w, uploadPath)
+	f, err := filer.NewFilesClient(ctx, w, uploadPath)
 	return f, uploadPath, diag.FromErr(err)
 }
diff --git a/bundle/libraries/helpers_test.go b/bundle/libraries/helpers_test.go
index 754aa8f953f..ac4993c6df1 100644
--- a/bundle/libraries/helpers_test.go
+++ b/bundle/libraries/helpers_test.go
@@ -27,10 +27,10 @@ func TestLibraryPath(t *testing.T) {
 	assert.NoError(t, err)
 
 	p, err = libraryPath(&compute.Library{})
-	assert.Equal(t, "", p)
+	assert.Empty(t, p)
 	assert.Error(t, err)
 
 	p, err = libraryPath(&compute.Library{Pypi: &compute.PythonPyPiLibrary{Package: "pypipackage"}})
-	assert.Equal(t, "", p)
+	assert.Empty(t, p)
 	assert.Error(t, err)
 }
diff --git a/bundle/libraries/local_path.go b/bundle/libraries/local_path.go
index 2f86481b162..33be070280b 100644
--- a/bundle/libraries/local_path.go
+++ b/bundle/libraries/local_path.go
@@ -110,10 +110,11 @@ const pep440Regex = `(?P<epoch>\d+!)?(?P<release>\d+(\.\d+)*)(?P<pre>[-_.]?(a|b|
 // ^[a-zA-Z0-9\-_]+: Matches the package name, allowing alphanumeric characters, dashes (-), and underscores (_).
 // \[.*\])?: Optionally matches any extras specified in square brackets, e.g., [security].
 // ((==|!=|<=|>=|~=|>|<)\s?pep440Regex): Optionally matches version specifiers, supporting various operators (==, !=, etc.) followed by a version number as per PEP440 spec.
+// (\.\*)?: Optionally matches a trailing ".*" wildcard for prefix matching, e.g. "numpy==2.5.*" (valid with == and != per PEP 440).
 // ,?: Optionally matches a comma (,) at the end of the specifier which is used to separate multiple specifiers.
 // There can be multiple version specifiers separated by commas or no specifiers.
 // Spec for package name and version specifier: https://pip.pypa.io/en/stable/reference/requirement-specifiers/
-var packageRegex = regexp.MustCompile(fmt.Sprintf(`^[a-zA-Z0-9\-_]+\s?(\[.*\])?\s?((==|!=|<=|>=|~=|==|>|<)\s?%s,?)*$`, pep440Regex))
+var packageRegex = regexp.MustCompile(fmt.Sprintf(`^[a-zA-Z0-9\-_]+\s?(\[.*\])?\s?((==|!=|<=|>=|~=|==|>|<)\s?%s(\.\*)?,?)*$`, pep440Regex))
 
 func isPackage(name string) bool {
 	if packageRegex.MatchString(name) {
diff --git a/bundle/libraries/local_path_test.go b/bundle/libraries/local_path_test.go
index 8083e162979..4e6216dd46b 100644
--- a/bundle/libraries/local_path_test.go
+++ b/bundle/libraries/local_path_test.go
@@ -94,6 +94,11 @@ func TestIsLibraryLocal(t *testing.T) {
 		{path: "beautifulsoup4==4.12.3+abc.5", expected: false},
 		{path: "beautifulsoup4==1!4.12.3", expected: false},
 
+		// Trailing ".*" wildcard for prefix matching (valid with == and != per PEP 440).
+		{path: "numpy==2.5.*", expected: false},
+		{path: "numpy!=2.5.*", expected: false},
+		{path: "numpy==2.*", expected: false},
+
 		{path: "beautifulsoup4 >= 4.12.3", expected: false},
 		{path: "beautifulsoup4 < 4.12.3", expected: false},
 		{path: "beautifulsoup4 ~= 4.12.3", expected: false},
diff --git a/bundle/libraries/remote_path.go b/bundle/libraries/remote_path.go
index 22784a63358..70e577a1a2a 100644
--- a/bundle/libraries/remote_path.go
+++ b/bundle/libraries/remote_path.go
@@ -7,12 +7,84 @@ import (
 	"path"
 	"path/filepath"
 	"slices"
+	"strings"
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/patchwheel"
 )
 
+// LocalLibraryPaths returns the local file paths of all libraries in the bundle
+// config that need to be uploaded. It expands any glob patterns that haven't
+// been resolved yet (ExpandGlobReferences only runs during Build, not when
+// applying a saved plan). For dynamic_version wheel artifacts it computes the
+// patched path from the source file's mtime, reusing the cached file that
+// "bundle plan" already created rather than re-patching.
+func LocalLibraryPaths(ctx context.Context, b *bundle.Bundle) ([]string, error) {
+	libs, err := collectLocalLibraries(b)
+	if err != nil {
+		return nil, err
+	}
+
+	// Expand any glob patterns in the collected paths. Job task library globs
+	// (e.g. "./dist/*.whl") are expanded by ExpandGlobReferences during Build but
+	// not when applying a saved plan, so they may still be present here.
+	expanded := make(map[string][]LocationToUpdate, len(libs))
+	for source, locs := range libs {
+		if strings.ContainsAny(source, "*?[") {
+			matches, _ := filepath.Glob(source)
+			for _, match := range matches {
+				expanded[match] = append(expanded[match], locs...)
+			}
+		} else {
+			expanded[source] = locs
+		}
+	}
+	libs = expanded
+
+	// For dynamic_version wheel artifacts, replace the original source path with
+	// the patched path. patchwheel.PatchWheel returns the already-cached result
+	// without rebuilding.
+	cacheDir, _ := b.LocalStateDir(ctx)
+	if cacheDir != "" {
+		patches := make(map[string]string) // original → patched
+		for artifactName, artifact := range b.Config.Artifacts {
+			if artifact == nil || artifact.Type != "whl" || !artifact.DynamicVersion {
+				continue
+			}
+			for _, f := range artifact.Files {
+				sources, _ := filepath.Glob(f.Source)
+				for _, source := range sources {
+					info, err := patchwheel.ParseWheelFilename(filepath.Base(source))
+					if err != nil {
+						continue
+					}
+					dir := filepath.Join(cacheDir, "patched_wheels", artifactName+"_"+info.Distribution)
+					patchedPath, _, err := patchwheel.PatchWheel(source, dir)
+					if err == nil {
+						patches[source] = patchedPath
+					}
+					break
+				}
+			}
+		}
+		if len(patches) > 0 {
+			patched := make(map[string][]LocationToUpdate, len(libs))
+			for k, v := range libs {
+				if p, ok := patches[k]; ok {
+					patched[p] = append(patched[p], v...)
+				} else {
+					patched[k] = v
+				}
+			}
+			libs = patched
+		}
+	}
+
+	return slices.Sorted(maps.Keys(libs)), nil
+}
+
 // ReplaceWithRemotePath updates all the libraries paths to point to the remote location
 // where the libraries will be uploaded later.
 func ReplaceWithRemotePath(ctx context.Context, b *bundle.Bundle) (map[string][]LocationToUpdate, diag.Diagnostics) {
@@ -35,9 +107,11 @@ func ReplaceWithRemotePath(ctx context.Context, b *bundle.Bundle) (map[string][]
 			remotePath := path.Join(uploadPath, filepath.Base(source))
 
 			for _, location := range locations {
-				v, err = dyn.SetByPath(v, location.configPath, dyn.NewValue(remotePath, []dyn.Location{location.location}))
+				// Re-append the extras suffix that was stripped before upload.
+				remotePathWithExtras := remotePath + location.extras
+				v, err = dyn.SetByPath(v, location.configPath, dyn.NewValue(remotePathWithExtras, []diag.Location{location.location}))
 				if err != nil {
-					return v, fmt.Errorf("internal error: failed to update path %#v to %#v: %w", source, remotePath, err)
+					return v, fmt.Errorf("internal error: failed to update path %#v to %#v: %w", source, remotePathWithExtras, err)
 				}
 			}
 		}
@@ -65,8 +139,15 @@ func collectLocalLibraries(b *bundle.Bundle) (map[string][]LocationToUpdate, err
 		taskLibrariesPattern.Append(dyn.AnyIndex(), dyn.Key("jar")),
 		forEachTaskLibrariesPattern.Append(dyn.AnyIndex(), dyn.Key("whl")),
 		forEachTaskLibrariesPattern.Append(dyn.AnyIndex(), dyn.Key("jar")),
+		clusterLibrariesPattern.Append(dyn.AnyIndex(), dyn.Key("whl")),
+		clusterLibrariesPattern.Append(dyn.AnyIndex(), dyn.Key("jar")),
 		envDepsPattern.Append(dyn.AnyIndex()),
 		pipelineEnvDepsPattern.Append(dyn.AnyIndex()),
+		// The AI Runtime task's code_source_path is a local archive (typically an
+		// artifact-built .tar.gz) that must be uploaded and referenced by its remote
+		// path, exactly like a wheel or jar library.
+		aiRuntimeCodeSourcePattern,
+		forEachAiRuntimeCodeSourcePattern,
 	}
 
 	for _, pattern := range patterns {
@@ -81,10 +162,15 @@ func collectLocalLibraries(b *bundle.Bundle) (map[string][]LocationToUpdate, err
 					return v, nil
 				}
 
+				// Split off any pip extras suffix so the upload targets the real
+				// file; the suffix is re-appended to the remote path afterwards.
+				source, extras := patchwheel.SplitWheelExtras(source)
+
 				source = filepath.Join(b.SyncRootPath, source)
 				libs[source] = append(libs[source], LocationToUpdate{
 					configPath: p,
 					location:   v.Location(),
+					extras:     extras,
 				})
 
 				return v, nil
diff --git a/bundle/libraries/same_name_libraries.go b/bundle/libraries/same_name_libraries.go
index 49776fbd8c9..722d42c7f64 100644
--- a/bundle/libraries/same_name_libraries.go
+++ b/bundle/libraries/same_name_libraries.go
@@ -8,6 +8,7 @@ import (
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/structs/structpath"
 )
 
 type checkForSameNameLibraries struct{}
@@ -17,14 +18,16 @@ var patterns = []dyn.Pattern{
 	taskLibrariesPattern.Append(dyn.AnyIndex(), dyn.Key("jar")),
 	forEachTaskLibrariesPattern.Append(dyn.AnyIndex(), dyn.Key("whl")),
 	forEachTaskLibrariesPattern.Append(dyn.AnyIndex(), dyn.Key("jar")),
+	clusterLibrariesPattern.Append(dyn.AnyIndex(), dyn.Key("whl")),
+	clusterLibrariesPattern.Append(dyn.AnyIndex(), dyn.Key("jar")),
 	envDepsPattern.Append(dyn.AnyIndex()),
 	pipelineEnvDepsPattern.Append(dyn.AnyIndex()),
 }
 
 type libData struct {
 	fullPath   string
-	locations  []dyn.Location
-	paths      []dyn.Path
+	locations  []diag.Location
+	paths      []*structpath.PathNode
 	otherPaths []string
 }
 
@@ -53,13 +56,13 @@ func (c checkForSameNameLibraries) Apply(ctx context.Context, b *bundle.Bundle)
 				if !ok {
 					libs[lib] = &libData{
 						fullPath:   libPath,
-						locations:  []dyn.Location{libraryValue.Location()},
-						paths:      []dyn.Path{p},
+						locations:  []diag.Location{libraryValue.Location()},
+						paths:      dyn.ToStructPaths(p),
 						otherPaths: []string{},
 					}
 				} else if lp.fullPath != libPath {
 					lp.locations = append(lp.locations, libraryValue.Location())
-					lp.paths = append(lp.paths, p)
+					lp.paths = append(lp.paths, dyn.ToStructPath(p))
 					lp.otherPaths = append(lp.otherPaths, libPath)
 				}
 
diff --git a/bundle/libraries/switch_to_patched_wheels.go b/bundle/libraries/switch_to_patched_wheels.go
index 0a9d1846041..3c5ff184a97 100644
--- a/bundle/libraries/switch_to_patched_wheels.go
+++ b/bundle/libraries/switch_to_patched_wheels.go
@@ -10,6 +10,7 @@ import (
 	"github.com/databricks/cli/bundle/config"
 	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/patchwheel"
 )
 
 type switchToPatchedWheels struct{}
@@ -63,10 +64,14 @@ func (c switchToPatchedWheels) Apply(ctx context.Context, b *bundle.Bundle) diag
 				continue
 			}
 			for depInd, dep := range specptr.Dependencies {
-				repl := replacements[dep]
+				// A dependency may carry a pip extras suffix (e.g. "foo.whl[train]");
+				// the patched-wheel replacements are keyed by the bare path, so strip
+				// it for the lookup and re-append it to the patched path.
+				base, extras := patchwheel.SplitWheelExtras(dep)
+				repl := replacements[base]
 				if repl != "" {
-					log.Debugf(ctx, "Updating resources.jobs.%s.environments[%d].spec.dependencies[%d] from %s to %s", jobName, envInd, depInd, dep, repl)
-					specptr.Dependencies[depInd] = repl
+					log.Debugf(ctx, "Updating resources.jobs.%s.environments[%d].spec.dependencies[%d] from %s to %s", jobName, envInd, depInd, dep, repl+extras)
+					specptr.Dependencies[depInd] = repl + extras
 				} else {
 					log.Debugf(ctx, "Not updating resources.jobs.%s.environments[%d].spec.dependencies[%d] from %s. Available replacements: %v", jobName, envInd, depInd, dep, slices.Sorted(maps.Keys(replacements)))
 				}
@@ -74,6 +79,22 @@ func (c switchToPatchedWheels) Apply(ctx context.Context, b *bundle.Bundle) diag
 		}
 	}
 
+	// Update resources.clusters.*.libraries[*].whl
+	for clusterName, clusterRef := range b.Config.Resources.Clusters {
+		if clusterRef == nil {
+			continue
+		}
+		for libInd, lib := range clusterRef.Libraries {
+			repl := replacements[lib.Whl]
+			if repl != "" {
+				log.Debugf(ctx, "Updating resources.clusters.%s.libraries[%d].whl from %s to %s", clusterName, libInd, lib.Whl, repl)
+				clusterRef.Libraries[libInd].Whl = repl
+			} else {
+				log.Debugf(ctx, "Not updating resources.clusters.%s.libraries[%d].whl from %s. Available replacements: %v", clusterName, libInd, lib.Whl, slices.Sorted(maps.Keys(replacements)))
+			}
+		}
+	}
+
 	return nil
 }
 
diff --git a/bundle/libraries/upload.go b/bundle/libraries/upload.go
index b292fe43b79..eeb71cfb9e8 100644
--- a/bundle/libraries/upload.go
+++ b/bundle/libraries/upload.go
@@ -15,6 +15,7 @@ import (
 	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/cli/libs/filer"
 	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/retry"
 
 	"golang.org/x/sync/errgroup"
 )
@@ -37,7 +38,10 @@ type upload struct {
 
 type LocationToUpdate struct {
 	configPath dyn.Path
-	location   dyn.Location
+	location   diag.Location
+	// extras is the pip extras suffix (e.g. "[train]") to re-append to the
+	// rewritten remote path. Empty for libraries that carry no extras.
+	extras string
 }
 
 func (u *upload) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
@@ -64,9 +68,9 @@ func (u *upload) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
 		} else {
 			relPath = filepath.ToSlash(relPath)
 		}
-		cmdio.LogString(ctx, fmt.Sprintf("Uploading %s...", relPath))
+		cmdio.LogProgress(ctx, fmt.Sprintf("Uploading %s...", relPath))
 		errs.Go(func() error {
-			return UploadFile(errCtx, source, u.client)
+			return UploadFile(errCtx, source, retry.Filer(u.client))
 		})
 	}
 
diff --git a/bundle/metrics/metrics.go b/bundle/metrics/metrics.go
index b564e2336b9..05d663f4244 100644
--- a/bundle/metrics/metrics.go
+++ b/bundle/metrics/metrics.go
@@ -6,4 +6,109 @@ const (
 	ArtifactBuildCommandIsSet           = "artifact_build_command_is_set"
 	ArtifactFilesIsSet                  = "artifact_files_is_set"
 	PresetsNamePrefixIsSet              = "presets_name_prefix_is_set"
+	AppLifecycleStarted                 = "app_lifecycle_started"
+	ClusterLifecycleStarted             = "cluster_lifecycle_started"
+	DeploymentHistoryEnabled            = "deployment_history_enabled"
+	SqlWarehouseLifecycleStarted        = "sql_warehouse_lifecycle_started"
+	SelectUsed                          = "select_used"
+
+	// Outcome of an automatic migration of terraform state to the direct engine.
+	//   - migrate_error:        state conversion itself errored.
+	//   - migrate_commit_error: the state was converted, but committing it
+	//                           (renaming files / pushing to workspace) failed.
+	//   - migrate_warnings:     the conversion emitted warnings (e.g. resources the direct engine can't represent).
+	DirectMigrateError       = "direct_migrate_error"
+	DirectMigrateCommitError = "direct_migrate_commit_error"
+	DirectMigrateWarnings    = "direct_migrate_warnings"
+	// True when the post-convert plan check failed; the migration was not committed.
+	DirectMigratePlanError = "direct_migrate_plan_error"
+	// True when the migrated state's first plan would recreate (destroy + create) an
+	// existing resource. The migration still commits; the recreate is a genuine pending
+	// change gated by the deploy's --auto-approve, and this only records how often it happens.
+	DirectMigrateRecreatePlanned = "direct_migrate_recreate_planned"
+
+	// Recorded when an automatic post-deploy migration to the direct engine
+	// actually ran (state was rewritten). Exactly one of the three keys is true;
+	// all are absent when auto-migration did not run. If both config and env
+	// set direct, bundle.engine wins per ValidateEngineSetting, so via_config
+	// covers the "durable opt-in" population and via_env covers the
+	// "env-var only" population.
+	//   - via_config:  bundle.engine = "direct" was set in the bundle config.
+	//   - via_env:     only DATABRICKS_BUNDLE_ENGINE=direct was set.
+	//   - via_default: neither was set, so the migration came from the default.
+	//                  This is the population that did not ask for anything.
+	DirectAutoMigrateViaConfig  = "direct_migrated_via_config"
+	DirectAutoMigrateViaEnv     = "direct_migrated_via_env"
+	DirectAutoMigrateViaDefault = "direct_migrated_via_default"
+
+	// Whether the (deprecated) terraform engine was explicitly opted into, and via
+	// which source. Independent: both can be present when config and env both
+	// request terraform. Emitted only when true; absence means "not opted in via
+	// this source", so the population still on terraform can be sliced by source.
+	//   - engine_terraform_config: bundle.engine = "terraform" in the bundle config.
+	//   - engine_terraform_env:    DATABRICKS_BUNDLE_ENGINE=terraform in the environment.
+	EngineTerraformConfig = "engine_terraform_config"
+	EngineTerraformEnv    = "engine_terraform_env"
+
+	// Whether workspace.state_path is under /Workspace/Shared.
+	StatePathIsShared = "state_path_is_shared"
+
+	// Whether this deploy is compatible with an automatic migration of the deployment
+	// state to a dedicated state storage service (DMS). Deploying a bundle requires
+	// write access (CAN_EDIT or higher) to the state folder; after migration that is
+	// governed by the permissions on the deployment object instead.
+	//
+	// When the bundle has no permissions section, the migration can mirror the state
+	// folder's ACLs onto the deployment (CAN_EDIT -> CAN_EDIT, CAN_MANAGE ->
+	// CAN_MANAGE), preserving everyone's access wherever the state lives. When a
+	// permissions section is set, the migration applies exactly those permissions, so
+	// anyone with write access to the state folder who is not declared with
+	// CAN_MANAGE would lose the ability to deploy.
+	//
+	// Exactly one of the three keys below is recorded per deploy:
+	//   - auto: no permissions section (folder ACLs are mirrored), or every principal
+	//           with write access to the state folder is declared.
+	//   - only_self_undeclared: a permissions section is set and the only principal
+	//           with undeclared write access is the deploying user. The migration
+	//           grants the deploying user CAN_MANAGE on the deployment object, so this
+	//           is auto-migratable if we choose to preserve that grant on future
+	//           deploys. Recorded separately to measure how common this case is.
+	//   - not:  a permissions section is set and the state folder has undeclared write
+	//           access from a principal other than the deploying user.
+	DMSCompatAuto               = "dms_compat_auto"
+	DMSCompatOnlySelfUndeclared = "dms_compat_only_self_undeclared"
+	DMSCompatNot                = "dms_compat_not"
+
+	// Breakdown dimensions recorded on every deploy alongside the verdict above, so the
+	// DMS auto-migration population can be sliced without inferring it from the verdict.
+	// Each is an independent boolean.
+
+	// Whether a top-level permissions section is set. The no-permissions case is always
+	// auto-migration compatible (folder ACLs are mirrored), so this separates the two
+	// populations that both land on dms_compat_auto.
+	PermissionsSectionSet = "permissions_section_set"
+
+	// Where the deployment state folder lives. Exactly one of StatePathIsShared,
+	// StatePathInDeployerHome, StatePathInOtherUserHome, and StatePathOther is true per
+	// deploy. StatePathOther is any other /Workspace folder (not a user home or shared).
+	StatePathInDeployerHome  = "state_path_in_deployer_home"
+	StatePathInOtherUserHome = "state_path_in_other_user_home"
+	StatePathOther           = "state_path_other"
+
+	// Which principal types have undeclared write access to the state folder — the
+	// access an auto-migration governed by the permissions section would drop. These can
+	// co-occur; all false when the deploy is auto-migration compatible.
+	DMSUndeclaredDeployingUser    = "dms_undeclared_deploying_user"
+	DMSUndeclaredOtherUser        = "dms_undeclared_other_user"
+	DMSUndeclaredServicePrincipal = "dms_undeclared_service_principal"
+	DMSUndeclaredGroup            = "dms_undeclared_group"
+
+	// Task-type usage is recorded generically at deploy as one "has_<task_type>" key
+	// per task type present in the bundle (e.g. has_notebook_task, has_ai_runtime_task);
+	// see collectTaskTypes in bundle/phases. The two keys below are extra
+	// ai_runtime_task-specific dimensions, emitted only when the bundle declares an
+	// ai_runtime_task, so a false value means "has an ai_runtime_task, but it is not
+	// scheduled / not multi-task". GPU type and count are intentionally not recorded here.
+	AiRuntimeTaskScheduled = "ai_runtime_task_scheduled"
+	AiRuntimeTaskMultitask = "ai_runtime_task_multitask"
 )
diff --git a/bundle/migrate/build_state.go b/bundle/migrate/build_state.go
new file mode 100644
index 00000000000..62d68905dc4
--- /dev/null
+++ b/bundle/migrate/build_state.go
@@ -0,0 +1,360 @@
+package migrate
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"maps"
+	"reflect"
+	"slices"
+	"strings"
+
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/deployplan"
+	"github.com/databricks/cli/bundle/direct"
+	"github.com/databricks/cli/bundle/direct/dresources"
+	"github.com/databricks/cli/bundle/direct/dstate"
+	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/dyn/dynvar"
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/structs/structaccess"
+	"github.com/databricks/cli/libs/structs/structpath"
+	"github.com/databricks/cli/libs/structs/structvar"
+)
+
+// SeedState records every terraform-state resource in stateDB, which must be open for write, so
+// the migrated state persists all deployed resources, including ones the current config no longer
+// declares. BuildStateFromTF then overwrites the config-declared entries with their full state (the
+// later WAL entry wins on replay); the rest keep this minimal entry, which is enough for the first
+// direct plan to delete them. Without this, a config that dropped every resource would record no
+// WAL entries at all and Finalize would persist no state file. An empty terraform state seeds
+// nothing, so its base file is written directly; the header-only Finalize leaves it intact.
+func SeedState(ctx context.Context, stateDB *dstate.DeploymentState, tfState *TFState) error {
+	if len(tfState.IDs) == 0 && len(tfState.Attrs) == 0 {
+		if err := stateDB.Persist(); err != nil {
+			return fmt.Errorf("persisting empty migrated state: %w", err)
+		}
+		return nil
+	}
+	for key, id := range tfState.IDs {
+		if err := stateDB.SaveState(ctx, key, id, json.RawMessage("{}"), nil); err != nil {
+			return fmt.Errorf("seeding migrated state for %s: %w", key, err)
+		}
+	}
+	return nil
+}
+
+// BuildStateFromTF iterates over bundle resources, resolves cross-resource
+// references using TF state attributes, and writes each resource's state entry.
+// configRoot should be an un-interpolated config (with ${resources.*} references).
+func BuildStateFromTF(
+	ctx context.Context,
+	configRoot *config.Root,
+	adapters map[string]*dresources.Adapter,
+	stateDB *dstate.DeploymentState,
+	tfAttrs TFStateAttrs,
+	tfIDs map[string]string,
+	warnPrefix string,
+) (bool, error) {
+	warningsSeen := false
+	// Collect all resource nodes (same patterns as makePlan).
+	var nodes []string
+	patterns := []dyn.Pattern{
+		dyn.NewPattern(dyn.Key("resources"), dyn.AnyKey(), dyn.AnyKey()),
+		dyn.NewPattern(dyn.Key("resources"), dyn.AnyKey(), dyn.AnyKey(), dyn.Key("permissions")),
+		dyn.NewPattern(dyn.Key("resources"), dyn.AnyKey(), dyn.AnyKey(), dyn.Key("grants")),
+	}
+	for _, pat := range patterns {
+		_, err := dyn.MapByPattern(
+			configRoot.Value(),
+			pat,
+			func(p dyn.Path, v dyn.Value) (dyn.Value, error) {
+				nodes = append(nodes, p.String())
+				return dyn.InvalidValue, nil
+			},
+		)
+		if err != nil {
+			return warningsSeen, err
+		}
+	}
+
+	for _, node := range nodes {
+		id, ok := tfIDs[node]
+		if !ok {
+			// Resource is in config but not in TF state (new resource); skip.
+			log.Infof(ctx, "%s: not found in terraform state, skipping", node)
+			continue
+		}
+
+		group := config.GetResourceTypeFromKey(node)
+		if group == "" {
+			return warningsSeen, fmt.Errorf("cannot determine resource type for %q", node)
+		}
+
+		adapter, ok := adapters[group]
+		if !ok {
+			warningsSeen = true
+			log.Warnf(ctx, warnPrefix+"unsupported resource type %q for %s, skipping", group, node)
+			continue
+		}
+
+		inputConfig, err := configRoot.GetResourceConfig(node)
+		if err != nil {
+			return warningsSeen, fmt.Errorf("%s: getting config: %w", node, err)
+		}
+
+		inputSV, err := adapter.PrepareInputConfig(inputConfig, node)
+		if err != nil {
+			return warningsSeen, fmt.Errorf("%s: PrepareInputConfig: %w", node, err)
+		}
+
+		newStateValue, err := adapter.PrepareState(inputSV.Value)
+		if err != nil {
+			return warningsSeen, fmt.Errorf("%s: PrepareState: %w", node, err)
+		}
+
+		refs, err := direct.ExtractReferences(configRoot.Value(), node, adapter.StateType())
+		if err != nil {
+			return warningsSeen, fmt.Errorf("%s: extracting references: %w", node, err)
+		}
+		maps.Copy(refs, inputSV.Refs)
+
+		sv := structvar.NewStructVar(newStateValue, refs)
+
+		// Compute depends_on from cross-resource references before resolving them
+		// (resolution deletes entries from the refs map).
+		// Same logic as makePlan in bundle/direct/bundle_plan.go.
+		var dependsOn []deployplan.DependsOnEntry //nolint:prealloc
+		for _, refTemplate := range refs {
+			ref, ok := dynvar.NewRef(dyn.V(refTemplate))
+			if !ok {
+				continue
+			}
+			for _, targetPath := range ref.References() {
+				targetPathParsed, err := dyn.NewPathFromString(targetPath)
+				if err != nil {
+					continue
+				}
+				targetNodeDP, _ := config.GetNodeAndType(targetPathParsed)
+				targetNode := targetNodeDP.String()
+				fullRef := "${" + targetPath + "}"
+				found := false
+				for _, dep := range dependsOn {
+					if dep.Node == targetNode && dep.Label == fullRef {
+						found = true
+						break
+					}
+				}
+				if !found {
+					dependsOn = append(dependsOn, deployplan.DependsOnEntry{
+						Node:  targetNode,
+						Label: fullRef,
+					})
+				}
+			}
+		}
+		slices.SortFunc(dependsOn, func(a, b deployplan.DependsOnEntry) int {
+			if a.Node != b.Node {
+				return strings.Compare(a.Node, b.Node)
+			}
+			return strings.Compare(a.Label, b.Label)
+		})
+
+		// For a .permissions node, id (tfIDs[node]) is the databricks_permissions resource's
+		// own ID, which is exactly the object_id (e.g. "/serving-endpoints/<id>"). Use it
+		// directly: re-deriving it from the parent's TF state fails for types whose id field
+		// is absent there (model_serving_endpoints, database_instances).
+		if _, ok := sv.Refs["object_id"]; ok {
+			if err := structaccess.Set(sv.Value, structpath.NewStringKey(nil, "object_id"), id); err != nil {
+				return warningsSeen, fmt.Errorf("%s: setting object_id: %w", node, err)
+			}
+			delete(sv.Refs, "object_id")
+		}
+
+		// Resolve each reference using TF state.
+		// node format: "resources.<group>.<name>" or "resources.<group>.<name>.permissions"
+		parts := strings.SplitN(node, ".", 4)
+		var srcGroup, srcName string
+		if len(parts) >= 3 {
+			srcGroup = parts[1]
+			srcName = parts[2]
+		}
+
+		// Collect all field paths that need resolution (avoid modifying map during iteration).
+		type refEntry struct {
+			fieldPathStr string
+			refTemplate  string
+		}
+		var pendingRefs []refEntry
+		for fieldPathStr, refTemplate := range sv.Refs {
+			pendingRefs = append(pendingRefs, refEntry{fieldPathStr, refTemplate})
+		}
+
+		for _, pending := range pendingRefs {
+			fieldPath, err := structpath.ParsePath(pending.fieldPathStr)
+			if err != nil {
+				return warningsSeen, fmt.Errorf("%s: parsing field path %q: %w", node, pending.fieldPathStr, err)
+			}
+
+			// The referenced resource was never deployed (new in config), so the deployed
+			// resource cannot have the field set either. Record it as unset: the first direct
+			// plan sees the difference and applies it once the referenced resource exists.
+			if referencesUndeployed(pending.refTemplate, tfIDs) {
+				current, err := structaccess.Get(sv.Value, fieldPath)
+				if err != nil {
+					return warningsSeen, fmt.Errorf("%s: reading field %q: %w", node, pending.fieldPathStr, err)
+				}
+				// A nil value means the field is already unset (e.g. an unresolved ref in a number).
+				if current != nil {
+					zero := reflect.Zero(reflect.TypeOf(current)).Interface()
+					if err := structaccess.Set(sv.Value, fieldPath, zero); err != nil {
+						return warningsSeen, fmt.Errorf("%s: cannot unset field %q: %w", node, pending.fieldPathStr, err)
+					}
+				}
+				delete(sv.Refs, pending.fieldPathStr)
+				continue
+			}
+
+			// ResolveFieldRef returns the fully resolved value for this field,
+			// using either Method A (TF state lookup) or Method B (template evaluation).
+			value, warned, err := ResolveFieldRef(ctx, tfAttrs, srcGroup, srcName, fieldPath, pending.refTemplate, warnPrefix)
+			if err != nil {
+				return warningsSeen, fmt.Errorf("%s: cannot resolve field %q (template %q): %w", node, pending.fieldPathStr, pending.refTemplate, err)
+			}
+			if warned {
+				warningsSeen = true
+			}
+
+			// Set the resolved value directly and remove the ref entry.
+			if err := structaccess.Set(sv.Value, fieldPath, value); err != nil {
+				return warningsSeen, fmt.Errorf("%s: cannot set resolved value for field %q: %w", node, pending.fieldPathStr, err)
+			}
+			delete(sv.Refs, pending.fieldPathStr)
+		}
+
+		if len(sv.Refs) > 0 {
+			return warningsSeen, fmt.Errorf("%s: unresolved references: %v", node, sv.Refs)
+		}
+
+		// Handle etag for dashboards: read it directly from TF state attributes.
+		// The "etag" field is a computed TF attribute not present in the bundle config,
+		// so it does not flow through PrepareState/ExtractReferences. Resources without
+		// an etag return an error from LookupTFField, which we treat as "no etag".
+		if v, err := LookupTFField(tfAttrs, group, srcName, structpath.NewStringKey(nil, "etag")); err == nil {
+			if etag, ok := v.(string); ok && etag != "" {
+				if err := structaccess.Set(sv.Value, structpath.NewStringKey(nil, "etag"), etag); err != nil {
+					return warningsSeen, fmt.Errorf("%s: cannot set etag: %w", node, err)
+				}
+			}
+		}
+
+		// Reconcile id-composing fields with the deployed terraform state so a pending id
+		// change surfaces in the plan instead of being snapshotted as already applied. A no-op
+		// for permissions/grants sub-nodes: their adapters declare no id fields.
+		if err := reconcileIDFields(ctx, adapter, srcGroup, srcName, sv.Value, tfAttrs, warnPrefix); err != nil {
+			return warningsSeen, fmt.Errorf("%s: reconciling id fields: %w", node, err)
+		}
+
+		// Compact hashed_fields fields so the migrated state stays small. Not needed for
+		// correctness — the first plan (CalculatePlan) compacts the saved state on read.
+		compacted, err := dresources.CompactState(adapter.ResourceConfig(), sv.Value)
+		if err != nil {
+			return warningsSeen, fmt.Errorf("%s: compacting state: %w", node, err)
+		}
+
+		if err := stateDB.SaveState(ctx, node, id, compacted, dependsOn); err != nil {
+			return warningsSeen, fmt.Errorf("%s: SaveState: %w", node, err)
+		}
+	}
+
+	return warningsSeen, nil
+}
+
+// referencesUndeployed reports whether refTemplate references a resource that is not in the terraform state.
+func referencesUndeployed(refTemplate string, tfIDs map[string]string) bool {
+	ref, ok := dynvar.NewRef(dyn.V(refTemplate))
+	if !ok {
+		return false
+	}
+	for _, targetPath := range ref.References() {
+		path, err := dyn.NewPathFromString(targetPath)
+		if err != nil {
+			continue
+		}
+		targetNode, _ := config.GetNodeAndType(path)
+		// Not a resource reference (e.g. ${var.x}).
+		if len(targetNode) == 0 {
+			continue
+		}
+		if _, ok := tfIDs[targetNode.String()]; !ok {
+			return true
+		}
+	}
+	return false
+}
+
+// reconcileIDFields aligns each id-composing field (provided_id_fields, updatable_id_fields)
+// in the migrated state with the deployed terraform state. The state is otherwise seeded from
+// config; for id fields, recording the current config would snapshot a pending change as
+// already applied and silently drift from the backend, so:
+//
+//   - When config and the deployed value differ only by backend normalization (identifier
+//     case, trailing slash), keep the config value: the difference is not a real change and
+//     recording either side converges.
+//   - Otherwise the user genuinely changed the id in config without deploying it. Record the
+//     deployed value so the migrated state matches what a direct deploy of the last-applied
+//     config would hold, and warn: the next plan surfaces the change as a recreate (provided-id
+//     fields) or a rename (updatable-id fields).
+func reconcileIDFields(ctx context.Context, adapter *dresources.Adapter, group, name string, stateValue any, tfAttrs TFStateAttrs, warnPrefix string) error {
+	cfg := adapter.ResourceConfig()
+	if cfg == nil {
+		return nil
+	}
+	// A provided-id change recreates the resource; an updatable-id change renames it in place.
+	for _, kind := range []struct {
+		rules  []dresources.FieldRule
+		action string
+	}{
+		{cfg.ProvidedIDFields, "recreated"},
+		{cfg.UpdatableIDFields, "renamed"},
+	} {
+		for _, rule := range kind.rules {
+			path, err := structpath.ParsePath(rule.Field.String())
+			if err != nil {
+				continue
+			}
+			configVal, err := structaccess.Get(stateValue, path)
+			if err != nil {
+				continue
+			}
+			deployedVal, err := LookupTFField(tfAttrs, group, name, path)
+			if err != nil {
+				continue
+			}
+
+			// Every id-composing field is a string (a name, catalog_name, storage path, ...).
+			configStr, ok1 := configVal.(string)
+			deployedStr, ok2 := deployedVal.(string)
+			if !ok1 || !ok2 {
+				return fmt.Errorf("id field %q: expected string values, got config %T and deployed %T", rule.Field.String(), configVal, deployedVal)
+			}
+
+			// UC identifier names are case-insensitive and UC strips trailing slashes from
+			// storage paths, so a config value that differs from the deployed one only by that
+			// normalization is not a real change: keep the config value (it converges).
+			if strings.EqualFold(strings.TrimRight(configStr, "/"), strings.TrimRight(deployedStr, "/")) {
+				continue
+			}
+
+			// A genuine change the user has not deployed yet. Record the deployed value so the
+			// migrated state matches the last-applied config, and warn so the recreate/rename in
+			// the plan that follows the migration is not a surprise.
+			log.Warnf(ctx, "%s%s.%s: %s differs between config (%q) and terraform state (%q); this resource will be %s.",
+				warnPrefix, group, name, rule.Field.String(), configStr, deployedStr, kind.action)
+			if err := structaccess.Set(stateValue, path, deployedVal); err != nil {
+				return fmt.Errorf("setting id field %q: %w", rule.Field.String(), err)
+			}
+		}
+	}
+	return nil
+}
diff --git a/bundle/migrate/build_state_test.go b/bundle/migrate/build_state_test.go
new file mode 100644
index 00000000000..108c0591968
--- /dev/null
+++ b/bundle/migrate/build_state_test.go
@@ -0,0 +1,361 @@
+package migrate_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/deployplan"
+	"github.com/databricks/cli/bundle/direct/dresources"
+	"github.com/databricks/cli/bundle/direct/dstate"
+	"github.com/databricks/cli/bundle/migrate"
+	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/dyn/convert"
+	"github.com/databricks/cli/libs/dyn/yamlloader"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// rootFromYAML builds a config.Root from a YAML snippet.
+// Template strings like "${resources.jobs.src.name}" are preserved in the
+// internal dyn.Value so BuildStateFromTF can find them via ExtractReferences.
+func rootFromYAML(t *testing.T, yaml string) config.Root {
+	t.Helper()
+	v, err := yamlloader.LoadYAML("test", bytes.NewBufferString(yaml))
+	require.NoError(t, err)
+	var root config.Root
+	require.NoError(t, convert.ToTyped(&root, v))
+	require.NoError(t, root.Mutate(func(_ dyn.Value) (dyn.Value, error) { return v, nil }))
+	return root
+}
+
+func runBuildStateFromTF(
+	t *testing.T,
+	yaml string,
+	tfAttrs migrate.TFStateAttrs,
+	tfIDs map[string]string,
+) map[string]dstate.ResourceEntry {
+	t.Helper()
+
+	root := rootFromYAML(t, yaml)
+	adapters, err := dresources.InitAll(nil)
+	require.NoError(t, err)
+
+	statePath := filepath.Join(t.TempDir(), "resources.json")
+
+	var db dstate.DeploymentState
+	db.OpenWithData(statePath, dstate.NewDatabase("lineage", 1))
+	require.NoError(t, db.UpgradeToWrite())
+
+	_, err = migrate.BuildStateFromTF(t.Context(), &root, adapters, &db, tfAttrs, tfIDs, "")
+	require.NoError(t, err)
+
+	_, err = db.Finalize(t.Context())
+	require.NoError(t, err)
+
+	raw, err := os.ReadFile(statePath)
+	require.NoError(t, err)
+	var data dstate.Database
+	require.NoError(t, json.Unmarshal(raw, &data))
+	return data.State
+}
+
+func TestBuildStateFromTF(t *testing.T) {
+	tests := []struct {
+		name         string
+		yaml         string
+		tfAttrs      migrate.TFStateAttrs
+		tfIDs        map[string]string
+		wantKey      string         // primary key to assert on
+		absentKey    string         // key that must NOT be in state
+		wantID       string         // expected entry.ID
+		wantState    map[string]any // expected fields in the state JSON (parsed via json.Unmarshal)
+		wantStateRaw string         // expected substring in raw state JSON bytes (use for large integers)
+		wantDeps     []deployplan.DependsOnEntry
+	}{
+		{
+			name: "basic job stored with ID",
+			yaml: `
+resources:
+  jobs:
+    my_job:
+      name: "hello"
+`,
+			tfAttrs: migrate.TFStateAttrs{
+				"databricks_job": {"my_job": json.RawMessage(`{"id": "123", "name": "hello"}`)},
+			},
+			tfIDs:   map[string]string{"resources.jobs.my_job": "123"},
+			wantKey: "resources.jobs.my_job",
+			wantID:  "123",
+		},
+		{
+			name: "resource not in TF state is skipped",
+			yaml: `
+resources:
+  jobs:
+    new_job:
+      name: "new"
+    existing_job:
+      name: "existing"
+`,
+			tfAttrs: migrate.TFStateAttrs{
+				"databricks_job": {"existing_job": json.RawMessage(`{"id": "456", "name": "existing"}`)},
+			},
+			tfIDs:     map[string]string{"resources.jobs.existing_job": "456"},
+			wantKey:   "resources.jobs.existing_job",
+			absentKey: "resources.jobs.new_job",
+			wantID:    "456",
+		},
+		{
+			name: "cross-resource ref: depends_on computed, field resolved",
+			yaml: `
+resources:
+  pipelines:
+    src:
+      name: "source-pipeline"
+  jobs:
+    dst:
+      name: "${resources.pipelines.src.name}"
+`,
+			tfAttrs: migrate.TFStateAttrs{
+				"databricks_pipeline": {"src": json.RawMessage(`{"id": "p1", "name": "source-pipeline"}`)},
+				"databricks_job":      {"dst": json.RawMessage(`{"id": "j1", "name": "source-pipeline"}`)},
+			},
+			tfIDs: map[string]string{
+				"resources.pipelines.src": "p1",
+				"resources.jobs.dst":      "j1",
+			},
+			wantKey:   "resources.jobs.dst",
+			wantID:    "j1",
+			wantState: map[string]any{"name": "source-pipeline"},
+			wantDeps: []deployplan.DependsOnEntry{
+				{Node: "resources.pipelines.src", Label: "${resources.pipelines.src.name}"},
+			},
+		},
+		{
+			name: "numeric field reference stored as number not string",
+			yaml: `
+resources:
+  jobs:
+    src_job:
+      name: "source"
+      max_concurrent_runs: 4
+    dst_job:
+      name: "dest"
+      max_concurrent_runs: "${resources.jobs.src_job.max_concurrent_runs}"
+`,
+			tfAttrs: migrate.TFStateAttrs{
+				"databricks_job": {
+					"src_job": json.RawMessage(`{"id": "111", "name": "source", "max_concurrent_runs": 4}`),
+					"dst_job": json.RawMessage(`{"id": "222", "name": "dest",   "max_concurrent_runs": 4}`),
+				},
+			},
+			tfIDs: map[string]string{
+				"resources.jobs.src_job": "111",
+				"resources.jobs.dst_job": "222",
+			},
+			wantKey:   "resources.jobs.dst_job",
+			wantID:    "222",
+			wantState: map[string]any{"max_concurrent_runs": float64(4)},
+			wantDeps:  []deployplan.DependsOnEntry{{Node: "resources.jobs.src_job"}},
+		},
+		{
+			// 2^53+1 = 9007199254740993 cannot be represented exactly as float64.
+			// json.Unmarshal into map[string]any would produce 9007199254740992 (off by one).
+			// UseNumber preserves the original decimal string, so the value is exact.
+			name: "large integer run_job_task.job_id preserved exactly",
+			yaml: `
+resources:
+  jobs:
+    trigger_job:
+      name: "trigger"
+    watcher_job:
+      name: "watcher"
+      tasks:
+        - task_key: run_trigger
+          run_job_task:
+            job_id: "${resources.jobs.trigger_job.id}"
+`,
+			tfAttrs: migrate.TFStateAttrs{
+				"databricks_job": {
+					"trigger_job": json.RawMessage(`{"id": "9007199254740993", "name": "trigger", "max_concurrent_runs": 1}`),
+					"watcher_job": json.RawMessage(`{"id": "100", "name": "watcher", "task": [{"task_key": "run_trigger", "run_job_task": [{"job_id": 9007199254740993}]}]}`),
+				},
+			},
+			tfIDs: map[string]string{
+				"resources.jobs.trigger_job": "9007199254740993",
+				"resources.jobs.watcher_job": "100",
+			},
+			wantKey: "resources.jobs.watcher_job",
+			wantID:  "100",
+			// job_id must be stored as 9007199254740993, not 9007199254740992 (float64 truncation).
+			// Check raw bytes because json.Unmarshal would silently re-truncate when reading back.
+			wantStateRaw: `"job_id": 9007199254740993`,
+		},
+		{
+			// model_serving_endpoints permissions reference object_id via the parent's
+			// "endpoint_id", which is absent from the parent's TF state attributes. The
+			// object_id must come from the permissions node's own TF state ID instead.
+			name: "model_serving_endpoints permissions object_id from node ID",
+			yaml: `
+resources:
+  model_serving_endpoints:
+    foo:
+      name: my-endpoint
+      permissions:
+        - level: CAN_VIEW
+          group_name: users
+`,
+			tfAttrs: migrate.TFStateAttrs{
+				"databricks_model_serving": {"foo": json.RawMessage(`{"id": "my-endpoint", "name": "my-endpoint"}`)},
+			},
+			tfIDs: map[string]string{
+				"resources.model_serving_endpoints.foo":             "my-endpoint",
+				"resources.model_serving_endpoints.foo.permissions": "/serving-endpoints/abc123",
+			},
+			wantKey:   "resources.model_serving_endpoints.foo.permissions",
+			wantID:    "/serving-endpoints/abc123",
+			wantState: map[string]any{"object_id": "/serving-endpoints/abc123"},
+			wantDeps:  []deployplan.DependsOnEntry{{Node: "resources.model_serving_endpoints.foo"}},
+		},
+		{
+			// database_instances permissions reference object_id via the parent's "id",
+			// which is absent from the parent's TF state attributes (it is stored under
+			// "name"). The object_id must come from the permissions node's own TF state ID.
+			name: "database_instances permissions object_id from node ID",
+			yaml: `
+resources:
+  database_instances:
+    foo:
+      name: my-db-instance
+      permissions:
+        - level: CAN_USE
+          group_name: users
+`,
+			tfAttrs: migrate.TFStateAttrs{
+				"databricks_database_instance": {"foo": json.RawMessage(`{"name": "my-db-instance"}`)},
+			},
+			tfIDs: map[string]string{
+				"resources.database_instances.foo":             "my-db-instance",
+				"resources.database_instances.foo.permissions": "/database-instances/my-db-instance",
+			},
+			wantKey:   "resources.database_instances.foo.permissions",
+			wantID:    "/database-instances/my-db-instance",
+			wantState: map[string]any{"object_id": "/database-instances/my-db-instance"},
+			wantDeps:  []deployplan.DependsOnEntry{{Node: "resources.database_instances.foo"}},
+		},
+		{
+			name: "dashboard etag stored from TF attributes",
+			yaml: `
+resources:
+  dashboards:
+    my_dash:
+      display_name: "My Dashboard"
+`,
+			tfAttrs: migrate.TFStateAttrs{
+				"databricks_dashboard": {
+					"my_dash": json.RawMessage(`{"id": "d1", "display_name": "My Dashboard", "etag": "etag-abc123"}`),
+				},
+			},
+			tfIDs:     map[string]string{"resources.dashboards.my_dash": "d1"},
+			wantKey:   "resources.dashboards.my_dash",
+			wantID:    "d1",
+			wantState: map[string]any{"etag": "etag-abc123"},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			state := runBuildStateFromTF(t, tc.yaml, tc.tfAttrs, tc.tfIDs)
+
+			if tc.absentKey != "" {
+				assert.NotContains(t, state, tc.absentKey)
+			}
+
+			entry, ok := state[tc.wantKey]
+			require.True(t, ok, "key %q not in state", tc.wantKey)
+			assert.Equal(t, tc.wantID, entry.ID)
+
+			if len(tc.wantState) > 0 {
+				var got map[string]any
+				require.NoError(t, json.Unmarshal(entry.State, &got))
+				for k, v := range tc.wantState {
+					assert.Equal(t, v, got[k], "state[%q]", k)
+				}
+			}
+
+			if tc.wantStateRaw != "" {
+				assert.Contains(t, string(entry.State), tc.wantStateRaw, "raw state JSON")
+			}
+
+			if tc.wantDeps != nil {
+				require.Len(t, entry.DependsOn, len(tc.wantDeps))
+				for i, want := range tc.wantDeps {
+					assert.Equal(t, want.Node, entry.DependsOn[i].Node)
+					if want.Label != "" {
+						assert.Equal(t, want.Label, entry.DependsOn[i].Label)
+					}
+				}
+			}
+		})
+	}
+}
+
+func TestBuildStateFromTFRefToUndeployedResourceIsUnset(t *testing.T) {
+	state := runBuildStateFromTF(t, `
+resources:
+  alerts:
+    new_alert:
+      display_name: "new"
+  jobs:
+    my_job:
+      name: "hello"
+      tasks:
+        - task_key: t
+          alert_task:
+            alert_id: "${resources.alerts.new_alert.id}"
+`,
+		migrate.TFStateAttrs{
+			"databricks_job": {"my_job": json.RawMessage(`{"id": "1", "name": "hello", "task": [{"task_key": "t"}]}`)},
+		},
+		map[string]string{"resources.jobs.my_job": "1"},
+	)
+
+	entry, ok := state["resources.jobs.my_job"]
+	require.True(t, ok)
+	assert.NotContains(t, string(entry.State), "new_alert")
+	assert.Contains(t, string(entry.State), `"alert_id": ""`)
+	assert.NotContains(t, state, "resources.alerts.new_alert")
+}
+
+func TestBuildStateFromTFRefToUndeployedResourceInNumberField(t *testing.T) {
+	state := runBuildStateFromTF(t, `
+resources:
+  jobs:
+    new_job:
+      name: "new"
+    my_job:
+      name: "hello"
+      timeout_seconds: "${resources.jobs.new_job.timeout_seconds}"
+`,
+		migrate.TFStateAttrs{"databricks_job": {"my_job": json.RawMessage(`{"id": "1", "name": "hello"}`)}},
+		map[string]string{"resources.jobs.my_job": "1"},
+	)
+	assert.Contains(t, state, "resources.jobs.my_job")
+}
+
+func TestBuildStateFromTFNonResourceRefIsNotUndeployed(t *testing.T) {
+	state := runBuildStateFromTF(t, `
+resources:
+  jobs:
+    my_job:
+      name: "${var.x}"
+`,
+		migrate.TFStateAttrs{"databricks_job": {"my_job": json.RawMessage(`{"id": "1", "name": "hello"}`)}},
+		map[string]string{"resources.jobs.my_job": "1"},
+	)
+	assert.Contains(t, string(state["resources.jobs.my_job"].State), `"name": "hello"`)
+}
diff --git a/bundle/migrate/resolve.go b/bundle/migrate/resolve.go
new file mode 100644
index 00000000000..23d0180e3c6
--- /dev/null
+++ b/bundle/migrate/resolve.go
@@ -0,0 +1,94 @@
+package migrate
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/dyn/dynvar"
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/structs/structpath"
+)
+
+// evaluateTemplate evaluates a template string like "${resources.pipelines.bar.cluster[0].label}"
+// by looking up each ${...} reference from TF state.
+func evaluateTemplate(state TFStateAttrs, template string) (string, error) {
+	ref, ok := dynvar.NewRef(dyn.V(template))
+	if !ok {
+		return template, nil
+	}
+
+	result := template
+	for _, pathString := range ref.References() {
+		path, err := structpath.ParsePath(pathString)
+		if err != nil {
+			return "", fmt.Errorf("cannot parse reference path %q: %w", pathString, err)
+		}
+		// Expect resources.<group>.<name>.<field...>
+		if path.Len() < 4 {
+			return "", fmt.Errorf("unexpected reference format (too short): %q", pathString)
+		}
+		// Check first component is "resources"
+		firstNode := path.Prefix(1)
+		if firstNode.String() != "resources" {
+			return "", fmt.Errorf("unexpected reference format (expected resources.*): %q", pathString)
+		}
+
+		group := path.SkipPrefix(1).Prefix(1).String()
+		name := path.SkipPrefix(2).Prefix(1).String()
+		fieldPath := path.SkipPrefix(3)
+
+		value, err := LookupTFField(state, group, name, fieldPath)
+		if err != nil {
+			return "", fmt.Errorf("cannot look up %q: %w", pathString, err)
+		}
+
+		result = strings.ReplaceAll(result, "${"+pathString+"}", fmt.Sprintf("%v", value))
+	}
+	return result, nil
+}
+
+// ResolveFieldRef resolves a single reference for a field in resource (srcGroup, srcName).
+// fieldPath is the path of the field within the source resource (in DABs naming, from sv.Refs key).
+// refTemplate is the template string for that field, e.g. "${resources.pipelines.bar.cluster[0].label}".
+//
+// Two methods are tried:
+//   - Method A: read the field from the source resource's own TF state.
+//   - Method B: evaluate the template by reading each referenced field from TF state.
+//
+// Returns the reconciled value or an error if both methods fail. The bool return
+// reports whether a warning was logged (methods disagreed); warnPrefix is
+// prepended to that warning so background callers (the post-deploy dry-run) can
+// attribute it.
+func ResolveFieldRef(ctx context.Context, state TFStateAttrs, srcGroup, srcName string, fieldPath *structpath.PathNode, refTemplate, warnPrefix string) (any, bool, error) {
+	// Method A: read field from source resource's TF state.
+	valueA, errA := LookupTFField(state, srcGroup, srcName, fieldPath)
+
+	// Method B: evaluate the template by looking up each reference.
+	valueB, errB := evaluateTemplate(state, refTemplate)
+
+	switch {
+	case errA == nil && errB == nil:
+		aStr := fmt.Sprintf("%v", valueA)
+		if aStr == valueB {
+			return valueA, false, nil
+		}
+		// Both succeeded but disagree: prefer longer string and warn.
+		if len(valueB) > len(aStr) {
+			log.Warnf(ctx, warnPrefix+"resource %s.%s field %s: method A value %q and method B value %q disagree; using longer (method B)",
+				srcGroup, srcName, fieldPath, aStr, valueB)
+			return valueB, true, nil
+		}
+		log.Warnf(ctx, warnPrefix+"resource %s.%s field %s: method A value %q and method B value %q disagree; using longer (method A)",
+			srcGroup, srcName, fieldPath, aStr, valueB)
+		return valueA, true, nil
+	case errA == nil:
+		return valueA, false, nil
+	case errB == nil:
+		return valueB, false, nil
+	default:
+		return nil, false, fmt.Errorf("%s.%s field %s: method A: %w; method B: %w",
+			srcGroup, srcName, fieldPath, errA, errB)
+	}
+}
diff --git a/bundle/migrate/resolve_test.go b/bundle/migrate/resolve_test.go
new file mode 100644
index 00000000000..1f6ee0d7533
--- /dev/null
+++ b/bundle/migrate/resolve_test.go
@@ -0,0 +1,76 @@
+package migrate_test
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/databricks/cli/bundle/migrate"
+	"github.com/databricks/cli/libs/structs/structaccess"
+	"github.com/databricks/cli/libs/structs/structpath"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// state with src job having int and bool fields set.
+func testState() migrate.TFStateAttrs {
+	return migrate.TFStateAttrs{
+		"databricks_job": {
+			"src": json.RawMessage(`{
+				"id": "111",
+				"max_concurrent_runs": 4,
+				"always_running": true
+			}`),
+			"dst": json.RawMessage(`{
+				"id": "222",
+				"max_concurrent_runs": 4,
+				"always_running": true
+			}`),
+		},
+	}
+}
+
+// TestResolveFieldRefInt proves that when Method B (template evaluation) wins for
+// an int field, the returned string value is still usable: structaccess.Set must
+// parse it back to int and not error.
+func TestResolveFieldRefInt(t *testing.T) {
+	state := testState()
+	// Remove dst from state so Method A fails and Method B must be used.
+	delete(state["databricks_job"], "dst")
+
+	fieldPath, err := structpath.ParsePath("max_concurrent_runs")
+	require.NoError(t, err)
+
+	value, _, err := migrate.ResolveFieldRef(t.Context(), state, "jobs", "dst", fieldPath,
+		"${resources.jobs.src.max_concurrent_runs}", "")
+	require.NoError(t, err)
+
+	// Method B succeeds: returns string "4". Verify Set converts it to int.
+	type target struct {
+		MaxConcurrentRuns int `json:"max_concurrent_runs"`
+	}
+	s := &target{}
+	err = structaccess.Set(s, fieldPath, value)
+	assert.NoError(t, err, "Set should parse string %q into int field", value)
+	assert.Equal(t, 4, s.MaxConcurrentRuns)
+}
+
+// TestResolveFieldRefBool is the same for a bool field.
+func TestResolveFieldRefBool(t *testing.T) {
+	state := testState()
+	delete(state["databricks_job"], "dst")
+
+	fieldPath, err := structpath.ParsePath("always_running")
+	require.NoError(t, err)
+
+	value, _, err := migrate.ResolveFieldRef(t.Context(), state, "jobs", "dst", fieldPath,
+		"${resources.jobs.src.always_running}", "")
+	require.NoError(t, err)
+
+	type target struct {
+		AlwaysRunning bool `json:"always_running"`
+	}
+	s := &target{}
+	err = structaccess.Set(s, fieldPath, value)
+	assert.NoError(t, err, "Set should parse string %q into bool field", value)
+	assert.True(t, s.AlwaysRunning)
+}
diff --git a/bundle/migrate/tf_state.go b/bundle/migrate/tf_state.go
new file mode 100644
index 00000000000..5ab11ec09c4
--- /dev/null
+++ b/bundle/migrate/tf_state.go
@@ -0,0 +1,174 @@
+package migrate
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+
+	"github.com/databricks/cli/bundle/deploy/terraform"
+	"github.com/databricks/cli/bundle/terraform_dabs_map"
+	"github.com/databricks/cli/libs/structs/structpath"
+)
+
+// TFStateAttrs maps (tfResourceType → resourceName → raw JSON attributes).
+type TFStateAttrs map[string]map[string]json.RawMessage
+
+// TFState holds everything parsed from a single terraform state file read.
+type TFState struct {
+	// Serial and Lineage are the top-level state metadata used to seed the direct state.
+	Serial  int
+	Lineage string
+
+	// Attrs maps (tfResourceType → resourceName → raw JSON attributes).
+	Attrs TFStateAttrs
+	// IDs maps bundle resource key → resource ID.
+	IDs map[string]string
+}
+
+// rawTFState is the on-disk terraform state format; it captures everything we need in one parse.
+type rawTFState struct {
+	Serial    int    `json:"serial"`
+	Lineage   string `json:"lineage"`
+	Resources []struct {
+		Type      string `json:"type"`
+		Name      string `json:"name"`
+		Mode      string `json:"mode"`
+		Instances []struct {
+			Attributes json.RawMessage `json:"attributes"`
+		} `json:"instances"`
+	} `json:"resources"`
+}
+
+// ParseTFStateFull reads the terraform state file once and returns all parsed data.
+// Returns nil without error when the file does not exist (first deploy with no resources).
+func ParseTFStateFull(ctx context.Context, path string) (*TFState, error) {
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			return nil, nil
+		}
+		return nil, err
+	}
+
+	// Parse once: lineage/serial live at the top level alongside the resources array,
+	// so a single unmarshal captures everything needed for both attrs and IDs.
+	var parsed rawTFState
+	if err := json.Unmarshal(raw, &parsed); err != nil {
+		return nil, err
+	}
+
+	attrs := parseTFStateAttrsFromRaw(&parsed)
+
+	exportedIDs, err := terraform.ParseResourcesStateFromBytes(ctx, raw)
+	if err != nil {
+		return nil, err
+	}
+	ids := make(map[string]string, len(exportedIDs))
+	for k, v := range exportedIDs {
+		ids[k] = v.ID
+	}
+	return &TFState{Attrs: attrs, IDs: ids, Lineage: parsed.Lineage, Serial: parsed.Serial}, nil
+}
+
+func parseTFStateAttrsFromRaw(s *rawTFState) TFStateAttrs {
+	result := make(TFStateAttrs)
+	for _, r := range s.Resources {
+		if r.Mode != terraform.ManagedResourceMode || len(r.Instances) == 0 {
+			continue
+		}
+		if result[r.Type] == nil {
+			result[r.Type] = make(map[string]json.RawMessage)
+		}
+		result[r.Type][r.Name] = r.Instances[0].Attributes
+	}
+	return result
+}
+
+// LookupTFField looks up a field from TF state attributes for a bundle resource.
+// group is the DABs group (e.g. "pipelines"), name is the resource name.
+// fieldPath is the path to the field (may be in DABs or TF naming; both handled by DABsPathToTerraform).
+func LookupTFField(state TFStateAttrs, group, name string, fieldPath *structpath.PathNode) (any, error) {
+	tfType, ok := terraform.GroupToTerraformName[group]
+	if !ok {
+		return nil, fmt.Errorf("unknown resource group %q", group)
+	}
+
+	// Translate field path to TF naming.
+	// DABsPathToTerraform handles both DABs names (renames) and TF names (pass-through for unknowns).
+	// Returns error for known DABs-only fields that have no TF equivalent.
+	tfFieldPath, err := terraform_dabs_map.DABsPathToTerraform(group, fieldPath)
+	if err != nil {
+		return nil, err
+	}
+
+	attrsJSON, ok := state[tfType][name]
+	if !ok {
+		return nil, fmt.Errorf("%s.%s not found in TF state", tfType, name)
+	}
+
+	// Unmarshal into map[string]any to handle TF list-blocks: in TF state, single-block
+	// fields are stored as single-element arrays [{"field": "value"}], not as plain objects.
+	// Navigating via map avoids the json.Unmarshal type mismatch between []T in JSON and
+	// struct-typed schema fields.
+	// UseNumber preserves large integers exactly; plain Unmarshal into interface{} uses
+	// float64 which loses precision for integers beyond 2^53.
+	var attrs map[string]any
+	dec := json.NewDecoder(bytes.NewReader(attrsJSON))
+	dec.UseNumber()
+	if err := dec.Decode(&attrs); err != nil {
+		return nil, fmt.Errorf("cannot parse TF state for %s.%s: %w", tfType, name, err)
+	}
+
+	return navigateTFState(attrs, tfFieldPath)
+}
+
+// navigateTFState walks the TF state map using the given path.
+// TF stores single-block fields as single-element arrays ([{…}]).  When a string-key
+// step encounters a []any, it auto-descends into element [0] so callers can use plain
+// paths like "continuous.pause_status" even though TF stores them as [{"pause_status":…}].
+func navigateTFState(data map[string]any, path *structpath.PathNode) (any, error) {
+	var current any = data
+	for _, node := range path.AsSlice() {
+		if current == nil {
+			return nil, nil
+		}
+
+		if key, ok := node.StringKey(); ok {
+			// Auto-unwrap TF list-blocks: if the current value is a single-element
+			// array and the next step wants a map key, descend into element 0.
+			if arr, isArr := current.([]any); isArr {
+				if len(arr) == 0 {
+					return nil, nil
+				}
+				current = arr[0]
+			}
+			m, ok := current.(map[string]any)
+			if !ok {
+				return nil, fmt.Errorf("expected map at %q, got %T", key, current)
+			}
+			val, ok := m[key]
+			if !ok {
+				return nil, fmt.Errorf("%q: key not found", key)
+			}
+			current = val
+		} else if idx, ok := node.Index(); ok {
+			switch v := current.(type) {
+			case []any:
+				if idx < 0 || idx >= len(v) {
+					return nil, fmt.Errorf("index %d out of range (len %d)", idx, len(v))
+				}
+				current = v[idx]
+			default:
+				// TF [0] on a non-slice (already unwrapped) is a no-op.
+				if idx == 0 {
+					continue
+				}
+				return nil, fmt.Errorf("index %d: not a slice (%T)", idx, current)
+			}
+		}
+	}
+	return current, nil
+}
diff --git a/bundle/mutator.go b/bundle/mutator.go
index 854d5703ac4..41ef8fda48c 100644
--- a/bundle/mutator.go
+++ b/bundle/mutator.go
@@ -32,7 +32,7 @@ func safeMutatorName(m Mutator) string {
 	t := reflect.TypeOf(m)
 
 	// Handle pointer types by getting the element type
-	if t.Kind() == reflect.Ptr {
+	if t.Kind() == reflect.Pointer {
 		t = t.Elem()
 	}
 
@@ -104,6 +104,34 @@ func ApplySeqContext(ctx context.Context, b *Bundle, mutators ...Mutator) {
 	}
 }
 
+// ApplySeqInScopeContext applies mutators without opening a mutator scope per mutator,
+// reusing the caller's scope instead.
+//
+// [ApplyContext] converts the whole configuration tree between its typed and dynamic
+// representations on entry and exit (see [config.Root.MarkMutatorEntry]). That cost is
+// proportional to the size of the accumulated configuration, so applying N mutators this
+// way is quadratic in N. For a bundle with thousands of included files that dominates
+// load time, hence this variant.
+//
+// Only use it for mutators that modify the configuration through [config.Root.Mutate]
+// (which keeps both representations in sync). A mutator that assigns to a typed field
+// directly relies on the scope entry to carry that value into the dynamic tree, and
+// would lose it here.
+func ApplySeqInScopeContext(ctx context.Context, b *Bundle, mutators ...Mutator) {
+	for _, m := range mutators {
+		mctx := log.NewContext(ctx, log.GetLogger(ctx).With("mutator", m.Name()))
+		log.Debugf(mctx, "Apply")
+
+		for _, d := range m.Apply(mctx, b) {
+			logdiag.LogDiag(mctx, d)
+		}
+
+		if logdiag.HasError(ctx) {
+			break
+		}
+	}
+}
+
 type funcMutator struct {
 	fn func(context.Context, *Bundle)
 }
diff --git a/bundle/mutator_test.go b/bundle/mutator_test.go
index e4504d657b0..45473634119 100644
--- a/bundle/mutator_test.go
+++ b/bundle/mutator_test.go
@@ -6,12 +6,16 @@ import (
 
 	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/logdiag"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 type testMutator struct {
 	applyCalled    int
 	nestedMutators []Mutator
+	// fn, if set, runs inside Apply after the call is counted.
+	fn func(ctx context.Context, b *Bundle) diag.Diagnostics
 }
 
 func (t *testMutator) Name() string {
@@ -20,6 +24,9 @@ func (t *testMutator) Name() string {
 
 func (t *testMutator) Apply(ctx context.Context, b *Bundle) diag.Diagnostics {
 	t.applyCalled++
+	if t.fn != nil {
+		return t.fn(ctx, b)
+	}
 	return ApplySeq(ctx, b, t.nestedMutators...)
 }
 
@@ -45,6 +52,79 @@ func TestMutator(t *testing.T) {
 	assert.Equal(t, 1, nested[1].applyCalled)
 }
 
+// ApplySeqInScopeContext applies each mutator once, in order.
+func TestApplySeqInScopeContext(t *testing.T) {
+	var order []string
+	makeMutator := func(name string) *testMutator {
+		return &testMutator{fn: func(ctx context.Context, b *Bundle) diag.Diagnostics {
+			order = append(order, name)
+			return nil
+		}}
+	}
+	first := makeMutator("first")
+	second := makeMutator("second")
+
+	b := &Bundle{}
+	ctx := logdiag.InitContext(t.Context())
+	logdiag.SetCollect(ctx, true)
+	ApplySeqInScopeContext(ctx, b, first, second)
+
+	assert.Equal(t, 1, first.applyCalled)
+	assert.Equal(t, 1, second.applyCalled)
+	assert.Equal(t, []string{"first", "second"}, order)
+	assert.Empty(t, logdiag.FlushCollected(ctx))
+}
+
+// ApplySeqInScopeContext collects the diagnostics returned by each mutator and
+// stops at the first one that logs an error, without applying later mutators.
+func TestApplySeqInScopeContextStopsOnError(t *testing.T) {
+	failing := &testMutator{fn: func(ctx context.Context, b *Bundle) diag.Diagnostics {
+		return diag.Diagnostics{diag.Diagnostic{Severity: diag.Error, Summary: "boom"}}
+	}}
+	later := &testMutator{}
+
+	b := &Bundle{}
+	ctx := logdiag.InitContext(t.Context())
+	logdiag.SetCollect(ctx, true)
+	ApplySeqInScopeContext(ctx, b, failing, later)
+
+	assert.Equal(t, 1, failing.applyCalled)
+	assert.Equal(t, 0, later.applyCalled, "mutator after an error must not run")
+
+	diags := logdiag.FlushCollected(ctx)
+	require.Len(t, diags, 1)
+	assert.Equal(t, "boom", diags[0].Summary)
+}
+
+// Unlike ApplySeqContext, ApplySeqInScopeContext does not open a mutator scope per
+// mutator, so it must be called from within one. Changes made through Root.Mutate
+// keep the typed and dynamic configuration in sync and survive without a per-mutator
+// scope. This is the property ProcessRootIncludes relies on.
+func TestApplySeqInScopeContextPreservesMutateChanges(t *testing.T) {
+	setHost := &testMutator{fn: func(ctx context.Context, b *Bundle) diag.Diagnostics {
+		err := b.Config.Mutate(func(v dyn.Value) (dyn.Value, error) {
+			return dyn.Set(v, "bundle", dyn.V(map[string]dyn.Value{"name": dyn.V("set-in-scope")}))
+		})
+		require.NoError(t, err)
+		return nil
+	}}
+
+	// Enclosing mutator that applies setHost in its own scope, mirroring how
+	// ProcessRootIncludes applies the per-file includes.
+	outer := &testMutator{fn: func(ctx context.Context, b *Bundle) diag.Diagnostics {
+		ApplySeqInScopeContext(ctx, b, setHost)
+		return nil
+	}}
+
+	b := &Bundle{}
+	diags := Apply(t.Context(), b, outer)
+	require.NoError(t, diags.Error())
+
+	// Visible in both representations once the enclosing scope exits.
+	assert.Equal(t, "set-in-scope", b.Config.Bundle.Name)
+	assert.Equal(t, "set-in-scope", b.Config.Value().Get("bundle").Get("name").MustString())
+}
+
 func TestSafeMutatorName(t *testing.T) {
 	tests := []struct {
 		name     string
diff --git a/bundle/paths/paths.go b/bundle/paths/paths.go
index 5206fda333e..54ffc0b5622 100644
--- a/bundle/paths/paths.go
+++ b/bundle/paths/paths.go
@@ -7,7 +7,15 @@ import (
 	"github.com/databricks/cli/bundle/libraries"
 )
 
-func CollectUniqueWorkspacePathPrefixes(workspace config.Workspace) []string {
+// WorkspacePaths holds the unique workspace folders that bundle permissions are applied
+// to. A logical bundle path (artifact, file, state, resource) nested under another is
+// represented only by its enclosing folder, so permissions are applied once and the
+// nested paths inherit them.
+type WorkspacePaths struct {
+	Paths []string
+}
+
+func CollectUniqueWorkspacePathPrefixes(workspace config.Workspace) WorkspacePaths {
 	rootPath := workspace.RootPath
 	var paths []string
 	if !libraries.IsVolumesPath(rootPath) {
@@ -24,6 +32,10 @@ func CollectUniqueWorkspacePathPrefixes(workspace config.Workspace) []string {
 		workspace.StatePath,
 		workspace.ResourcePath,
 	} {
+		if p == "" {
+			continue
+		}
+
 		if libraries.IsVolumesPath(p) {
 			continue
 		}
@@ -35,5 +47,20 @@ func CollectUniqueWorkspacePathPrefixes(workspace config.Workspace) []string {
 		paths = append(paths, p)
 	}
 
-	return paths
+	return WorkspacePaths{Paths: paths}
+}
+
+// Governing returns the path whose ACL governs the given path: the path itself when it
+// is one of the collected paths, or the enclosing path when it is nested under one (e.g.
+// the state path nested under the root path, which is deduplicated out of Paths).
+// Returns an empty string when no path governs it, e.g. a Volumes path that permissions
+// don't apply to. Paths are /Workspace-normalized by PrependWorkspacePrefix.
+func (w WorkspacePaths) Governing(path string) string {
+	for _, p := range w.Paths {
+		trimmed := strings.TrimSuffix(p, "/")
+		if path == trimmed || strings.HasPrefix(path, trimmed+"/") {
+			return p
+		}
+	}
+	return ""
 }
diff --git a/bundle/paths/paths_test.go b/bundle/paths/paths_test.go
new file mode 100644
index 00000000000..37709b3b20b
--- /dev/null
+++ b/bundle/paths/paths_test.go
@@ -0,0 +1,36 @@
+package paths
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/bundle/config"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestWorkspacePathsGoverning(t *testing.T) {
+	// All logical paths nested under root_path collapse to a single prefix, and the
+	// state path is governed by (inherits the ACL of) that root prefix.
+	nested := CollectUniqueWorkspacePathPrefixes(config.Workspace{
+		RootPath:     "/Workspace/u/bundle",
+		ArtifactPath: "/Workspace/u/bundle/artifacts",
+		FilePath:     "/Workspace/u/bundle/files",
+		StatePath:    "/Workspace/u/bundle/state",
+		ResourcePath: "/Workspace/u/bundle/resources",
+	})
+	assert.Equal(t, []string{"/Workspace/u/bundle"}, nested.Paths)
+	assert.Equal(t, "/Workspace/u/bundle", nested.Governing("/Workspace/u/bundle/state"))
+
+	// A state path outside root_path is its own prefix and governs itself.
+	separate := CollectUniqueWorkspacePathPrefixes(config.Workspace{
+		RootPath:     "/Workspace/u/bundle",
+		ArtifactPath: "/Workspace/u/bundle/artifacts",
+		FilePath:     "/Workspace/u/bundle/files",
+		StatePath:    "/Workspace/Shared/state",
+		ResourcePath: "/Workspace/u/bundle/resources",
+	})
+	assert.Equal(t, []string{"/Workspace/u/bundle", "/Workspace/Shared/state"}, separate.Paths)
+	assert.Equal(t, "/Workspace/Shared/state", separate.Governing("/Workspace/Shared/state"))
+
+	// A path governed by no prefix (a sibling) returns an empty string.
+	assert.Empty(t, nested.Governing("/Workspace/u/bundle-2/state"))
+}
diff --git a/bundle/permissions/folder_acl.go b/bundle/permissions/folder_acl.go
new file mode 100644
index 00000000000..6145608a694
--- /dev/null
+++ b/bundle/permissions/folder_acl.go
@@ -0,0 +1,177 @@
+package permissions
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"path"
+	"strconv"
+
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/service/iam"
+	"github.com/databricks/databricks-sdk-go/service/workspace"
+)
+
+// adminsGroup is the workspace admins group. Its members can write to any
+// workspace folder regardless of the folder ACL, so writability checks must not
+// conclude "cannot write" for an admin.
+const adminsGroup = "admins"
+
+// FolderACL is the resolved access-control state of a workspace folder: the
+// permissions that actually apply to it, resolved by walking up to the closest
+// existing ancestor when the folder itself does not exist yet.
+type FolderACL struct {
+	// RequestedPath is the folder the caller asked about.
+	RequestedPath string
+	// ResolvedPath is the existing object whose ACL was read. It equals
+	// RequestedPath when the folder exists, or the closest existing ancestor
+	// otherwise (a not-yet-created folder inherits its ancestor's ACL).
+	ResolvedPath string
+	// Permissions are the ACL entries that apply, keyed by principal.
+	Permissions *WorkspacePathPermissions
+}
+
+// ResolveFolderACL reads the ACL that applies to folderPath. When folderPath does
+// not exist, it walks up to the closest existing ancestor, since a folder created
+// under it will inherit that ancestor's permissions.
+func ResolveFolderACL(ctx context.Context, w workspace.WorkspaceInterface, folderPath string) (*FolderACL, error) {
+	obj, err := closestExistingObject(ctx, w, folderPath)
+	if err != nil {
+		return nil, err
+	}
+
+	objPermissions, err := w.GetPermissions(ctx, workspace.GetWorkspaceObjectPermissionsRequest{
+		WorkspaceObjectId:   strconv.FormatInt(obj.ObjectId, 10),
+		WorkspaceObjectType: "directories",
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	// Report against the requested path, not the resolved ancestor, so diagnostics
+	// name the folder the user configured.
+	return &FolderACL{
+		RequestedPath: folderPath,
+		ResolvedPath:  obj.Path,
+		Permissions:   ObjectAclToResourcePermissions(folderPath, objPermissions.AccessControlList),
+	}, nil
+}
+
+// Writability is the outcome of a folder writability check. It is three-valued
+// because the check cannot always reach a definite answer: reading a folder ACL
+// itself requires manage access, so the common "cannot write" case surfaces as a
+// permission error on the read rather than as a readable ACL that omits the user.
+type Writability int
+
+const (
+	// WritabilityUnknown means writability could not be determined (e.g. the
+	// folder does not exist and has no existing ancestor, or the ACL read failed
+	// for a reason other than permission denied). Callers should not warn.
+	WritabilityUnknown Writability = iota
+	// WritabilityWritable means the user has write access (directly, via a group,
+	// or as an admin), or it cannot be ruled out.
+	WritabilityWritable
+	// WritabilityNotWritable means the user definitely lacks write access: the
+	// permissions API denied the ACL read (which requires manage access), or the
+	// ACL was readable but grants the user no write-capable level.
+	WritabilityNotWritable
+)
+
+// CheckWritable reports whether user can write to folderPath, resolving the ACL
+// (walking up to the closest existing ancestor for a not-yet-created folder) and
+// interpreting a permission-denied error on the read as a definite "not writable".
+//
+// Reading a folder ACL requires CAN_MANAGE (managing permissions is exclusive to
+// CAN_MANAGE per the workspace ACL model; the permissions GET returns 403
+// "does not have Manage permissions" otherwise), so a 403 means the user cannot
+// manage, and therefore cannot write to, the folder.
+// See https://docs.databricks.com/aws/en/security/auth/access-control/
+func CheckWritable(ctx context.Context, w workspace.WorkspaceInterface, folderPath string, user *iam.User) Writability {
+	acl, err := ResolveFolderACL(ctx, w, folderPath)
+	if err != nil {
+		if errors.Is(err, apierr.ErrPermissionDenied) {
+			return WritabilityNotWritable
+		}
+		return WritabilityUnknown
+	}
+
+	if acl.CanWrite(user) {
+		return WritabilityWritable
+	}
+	return WritabilityNotWritable
+}
+
+// CanWrite reports whether user has write access (CAN_EDIT or higher) to the
+// folder, either directly or through one of their groups.
+//
+// It only inspects a readable ACL; prefer CheckWritable, which also interprets a
+// permission-denied error on the ACL read. It is deliberately conservative:
+// it assumes write access when the user is a workspace admin (admins bypass the
+// folder ACL) or when their group membership is not known here, because
+// concluding "cannot write" in those cases would be a false alarm.
+func (f *FolderACL) CanWrite(user *iam.User) bool {
+	groups := userGroupNames(user)
+	if groups[adminsGroup] {
+		return true
+	}
+
+	for _, p := range f.Permissions.Permissions {
+		if !isWriteLevel(string(p.Level)) {
+			continue
+		}
+		switch {
+		case p.UserName != "" && p.UserName == user.UserName:
+			return true
+		case p.ServicePrincipalName != "" && p.ServicePrincipalName == user.UserName:
+			return true
+		case p.GroupName != "" && groups[p.GroupName]:
+			return true
+		}
+	}
+
+	return false
+}
+
+// isWriteLevel reports whether an ACL level grants write access to a folder,
+// which is what deploying a bundle requires. CAN_EDIT is the lowest such level.
+func isWriteLevel(level string) bool {
+	return resources.GetLevelScore(level) >= resources.GetLevelScore(resources.CAN_EDIT)
+}
+
+// userGroupNames returns the set of group display names the user belongs to.
+func userGroupNames(user *iam.User) map[string]bool {
+	groups := make(map[string]bool, len(user.Groups))
+	for _, g := range user.Groups {
+		if g.Display != "" {
+			groups[g.Display] = true
+		}
+	}
+	return groups
+}
+
+// closestExistingObject returns the object at folderPath, or the closest existing
+// ancestor when folderPath does not exist. A not-yet-created folder inherits the
+// permissions of its closest existing ancestor.
+func closestExistingObject(ctx context.Context, w workspace.WorkspaceInterface, folderPath string) (*workspace.ObjectInfo, error) {
+	for {
+		obj, err := w.GetStatusByPath(ctx, folderPath)
+		if err == nil {
+			return obj, nil
+		}
+
+		if !apierr.IsMissing(err) {
+			return nil, err
+		}
+
+		parent := path.Dir(folderPath)
+		// If the parent is the same as the current folder, then we have reached the root
+		if folderPath == parent {
+			break
+		}
+
+		folderPath = parent
+	}
+
+	return nil, fmt.Errorf("folder %s and its parent folders do not exist", folderPath)
+}
diff --git a/bundle/permissions/folder_acl_test.go b/bundle/permissions/folder_acl_test.go
new file mode 100644
index 00000000000..45de01063ab
--- /dev/null
+++ b/bundle/permissions/folder_acl_test.go
@@ -0,0 +1,249 @@
+package permissions
+
+import (
+	"testing"
+
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/experimental/mocks"
+	"github.com/databricks/databricks-sdk-go/service/iam"
+	"github.com/databricks/databricks-sdk-go/service/workspace"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+)
+
+func user(name string, groups ...string) *iam.User {
+	u := &iam.User{UserName: name}
+	for _, g := range groups {
+		u.Groups = append(u.Groups, iam.ComplexValue{Display: g})
+	}
+	return u
+}
+
+func aclFor(t *testing.T, acl []workspace.WorkspaceObjectAccessControlResponse) *FolderACL {
+	t.Helper()
+	return &FolderACL{
+		RequestedPath: "/Workspace/f",
+		ResolvedPath:  "/Workspace/f",
+		Permissions:   ObjectAclToResourcePermissions("/Workspace/f", acl),
+	}
+}
+
+func TestFolderACLCanWrite(t *testing.T) {
+	editUser := []workspace.WorkspaceObjectAccessControlResponse{
+		{
+			UserName: "me@example.com",
+			AllPermissions: []workspace.WorkspaceObjectPermission{
+				{PermissionLevel: "CAN_EDIT"},
+			},
+		},
+	}
+	manageGroup := []workspace.WorkspaceObjectAccessControlResponse{
+		{
+			GroupName: "devs",
+			AllPermissions: []workspace.WorkspaceObjectPermission{
+				{PermissionLevel: "CAN_MANAGE"},
+			},
+		},
+	}
+	readOnlyUser := []workspace.WorkspaceObjectAccessControlResponse{
+		{
+			UserName: "me@example.com",
+			AllPermissions: []workspace.WorkspaceObjectPermission{
+				{PermissionLevel: "CAN_READ"},
+			},
+		},
+	}
+	sp := []workspace.WorkspaceObjectAccessControlResponse{
+		{
+			ServicePrincipalName: "sp-uuid",
+			AllPermissions: []workspace.WorkspaceObjectPermission{
+				{PermissionLevel: "CAN_MANAGE"},
+			},
+		},
+	}
+
+	tests := []struct {
+		name string
+		acl  []workspace.WorkspaceObjectAccessControlResponse
+		user *iam.User
+		want bool
+	}{
+		{"direct write", editUser, user("me@example.com"), true},
+		{"write via group", manageGroup, user("me@example.com", "devs"), true},
+		{"read-only is not writable", readOnlyUser, user("me@example.com"), false},
+		{"no matching entry", editUser, user("other@example.com"), false},
+		{"service principal write", sp, user("sp-uuid"), true},
+
+		// Conservative cases: assume writable when it cannot be ruled out.
+		{"admin bypasses folder ACL", readOnlyUser, user("me@example.com", "admins"), true},
+		{"write via group not in user's known groups", manageGroup, user("me@example.com"), false},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, aclFor(t, tc.acl).CanWrite(tc.user))
+		})
+	}
+}
+
+// These ACLs mirror the shape of real workspace folder permissions (verified
+// against live traffic): a home-style folder granting the owner CAN_MANAGE
+// directly plus inherited admin/service-principal entries, and a shared folder
+// granting CAN_MANAGE to a group the user belongs to rather than to the user
+// directly.
+
+// homeDirACL: owner has direct CAN_MANAGE (writable).
+var homeDirACL = []workspace.WorkspaceObjectAccessControlResponse{
+	{
+		UserName: "owner@example.com",
+		AllPermissions: []workspace.WorkspaceObjectPermission{
+			{PermissionLevel: "CAN_MANAGE"},
+		},
+	},
+	{
+		ServicePrincipalName: "00000000-0000-0000-0000-000000000000",
+		AllPermissions: []workspace.WorkspaceObjectPermission{
+			{PermissionLevel: "CAN_MANAGE", Inherited: true},
+		},
+	},
+	{
+		GroupName: "admins",
+		AllPermissions: []workspace.WorkspaceObjectPermission{
+			{PermissionLevel: "CAN_MANAGE", Inherited: true},
+		},
+	},
+}
+
+// sharedDirACL: CAN_MANAGE granted to the "users" group (write via group, not a
+// direct grant).
+var sharedDirACL = []workspace.WorkspaceObjectAccessControlResponse{
+	{
+		GroupName: "users",
+		AllPermissions: []workspace.WorkspaceObjectPermission{
+			{PermissionLevel: "CAN_MANAGE"},
+		},
+	},
+	{
+		GroupName: "admins",
+		AllPermissions: []workspace.WorkspaceObjectPermission{
+			{PermissionLevel: "CAN_MANAGE", Inherited: true},
+		},
+	},
+}
+
+func TestFolderACLCanWriteRealisticACLs(t *testing.T) {
+	me := user("owner@example.com", "engineering", "users")
+
+	assert.True(t, aclFor(t, homeDirACL).CanWrite(me), "own home dir: direct CAN_MANAGE")
+	assert.True(t, aclFor(t, sharedDirACL).CanWrite(me), "shared dir: CAN_MANAGE via users group")
+
+	// A different user without any of these grants cannot write.
+	other := user("someone.else@example.com")
+	assert.False(t, aclFor(t, homeDirACL).CanWrite(other))
+	assert.False(t, aclFor(t, sharedDirACL).CanWrite(other))
+}
+
+func TestCheckWritable(t *testing.T) {
+	const folder = "/Workspace/f"
+	me := user("me@example.com")
+
+	writableACL := &workspace.WorkspaceObjectPermissions{
+		AccessControlList: []workspace.WorkspaceObjectAccessControlResponse{
+			{
+				UserName: "me@example.com",
+				AllPermissions: []workspace.WorkspaceObjectPermission{
+					{PermissionLevel: "CAN_MANAGE"},
+				},
+			},
+		},
+	}
+	readOnlyACL := &workspace.WorkspaceObjectPermissions{
+		AccessControlList: []workspace.WorkspaceObjectAccessControlResponse{
+			{
+				UserName: "me@example.com",
+				AllPermissions: []workspace.WorkspaceObjectPermission{
+					{PermissionLevel: "CAN_READ"},
+				},
+			},
+		},
+	}
+
+	tests := []struct {
+		name     string
+		getPerms func() (*workspace.WorkspaceObjectPermissions, error)
+		want     Writability
+	}{
+		{
+			"writable",
+			func() (*workspace.WorkspaceObjectPermissions, error) { return writableACL, nil },
+			WritabilityWritable,
+		},
+		{
+			// Reading the ACL is denied because it requires manage access, so the
+			// user definitely cannot write. This is the common real-world case.
+			"permission denied on ACL read means not writable",
+			func() (*workspace.WorkspaceObjectPermissions, error) {
+				return nil, &apierr.APIError{StatusCode: 403, ErrorCode: "PERMISSION_DENIED"}
+			},
+			WritabilityNotWritable,
+		},
+		{
+			"readable ACL without a write grant means not writable",
+			func() (*workspace.WorkspaceObjectPermissions, error) { return readOnlyACL, nil },
+			WritabilityNotWritable,
+		},
+		{
+			"other errors are unknown",
+			func() (*workspace.WorkspaceObjectPermissions, error) {
+				return nil, &apierr.APIError{StatusCode: 500}
+			},
+			WritabilityUnknown,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			m := mocks.NewMockWorkspaceClient(t)
+			w := m.GetMockWorkspaceAPI()
+			w.EXPECT().GetStatusByPath(mock.Anything, folder).
+				Return(&workspace.ObjectInfo{ObjectId: 7, Path: folder}, nil)
+			w.EXPECT().GetPermissions(mock.Anything, mock.Anything).Return(tc.getPerms())
+
+			assert.Equal(t, tc.want, CheckWritable(t.Context(), w, folder, me))
+		})
+	}
+}
+
+func TestResolveFolderACLWalksUpToClosestExistingAncestor(t *testing.T) {
+	m := mocks.NewMockWorkspaceClient(t)
+	w := m.GetMockWorkspaceAPI()
+
+	// The requested folder does not exist yet; its parent does.
+	w.EXPECT().GetStatusByPath(mock.Anything, "/Workspace/root/files").
+		Return(nil, &apierr.APIError{StatusCode: 404})
+	w.EXPECT().GetStatusByPath(mock.Anything, "/Workspace/root").
+		Return(&workspace.ObjectInfo{ObjectId: 42, Path: "/Workspace/root"}, nil)
+	w.EXPECT().GetPermissions(mock.Anything, workspace.GetWorkspaceObjectPermissionsRequest{
+		WorkspaceObjectId:   "42",
+		WorkspaceObjectType: "directories",
+	}).Return(&workspace.WorkspaceObjectPermissions{
+		AccessControlList: []workspace.WorkspaceObjectAccessControlResponse{
+			{
+				UserName: "me@example.com",
+				AllPermissions: []workspace.WorkspaceObjectPermission{
+					{PermissionLevel: "CAN_MANAGE"},
+				},
+			},
+		},
+	}, nil)
+
+	acl, err := ResolveFolderACL(t.Context(), w, "/Workspace/root/files")
+	require.NoError(t, err)
+
+	// Resolved via the ancestor, but reported against the requested path.
+	assert.Equal(t, "/Workspace/root/files", acl.RequestedPath)
+	assert.Equal(t, "/Workspace/root", acl.ResolvedPath)
+	assert.Equal(t, "/Workspace/root/files", acl.Permissions.Path)
+	assert.True(t, acl.CanWrite(user("me@example.com")))
+}
diff --git a/bundle/permissions/permission_diagnostics.go b/bundle/permissions/permission_diagnostics.go
index e25ccd5e724..0e01f72a0f4 100644
--- a/bundle/permissions/permission_diagnostics.go
+++ b/bundle/permissions/permission_diagnostics.go
@@ -8,7 +8,6 @@ import (
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/libs/diag"
-	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/cli/libs/iamutil"
 	"github.com/databricks/cli/libs/set"
 )
@@ -59,7 +58,7 @@ func (m *permissionDiagnostics) Apply(ctx context.Context, b *bundle.Bundle) dia
 			identityType,
 			b.Config.Workspace.CurrentUser.UserName,
 		),
-		Locations: []dyn.Location{b.Config.GetLocation("permissions")},
+		Locations: []diag.Location{b.Config.GetLocation("permissions")},
 		ID:        diag.PermissionNotIncluded,
 	}}
 }
diff --git a/bundle/permissions/terraform_errors.go b/bundle/permissions/terraform_errors.go
deleted file mode 100644
index cc4c9f61424..00000000000
--- a/bundle/permissions/terraform_errors.go
+++ /dev/null
@@ -1,47 +0,0 @@
-package permissions
-
-import (
-	"context"
-	"fmt"
-	"regexp"
-	"strings"
-
-	"github.com/databricks/cli/bundle"
-	"github.com/databricks/cli/libs/diag"
-	"github.com/databricks/cli/libs/log"
-)
-
-func TryExtendTerraformPermissionError(ctx context.Context, b *bundle.Bundle, err error) diag.Diagnostics {
-	_, assistance := analyzeBundlePermissions(b)
-
-	// In a best-effort attempt to provide actionable error messages, we match
-	// against a few specific error messages that come from the Jobs and Pipelines API.
-	// For matching errors we provide a more specific error message that includes
-	// details on how to resolve the issue.
-	if !strings.Contains(err.Error(), "cannot update permissions") &&
-		!strings.Contains(err.Error(), "permissions on pipeline") &&
-		!strings.Contains(err.Error(), "cannot read permissions") &&
-		!strings.Contains(err.Error(), "cannot set run_as to user") {
-		return nil
-	}
-
-	log.Errorf(ctx, "Terraform error during deployment: %v", err.Error())
-
-	// Best-effort attempt to extract the resource name from the error message.
-	re := regexp.MustCompile(`databricks_(\w*)\.(\w*)`)
-	match := re.FindStringSubmatch(err.Error())
-	resource := "resource"
-	if len(match) > 1 {
-		resource = match[2]
-	}
-
-	return diag.Diagnostics{{
-		Summary: fmt.Sprintf("permission denied creating or updating %s.\n"+
-			"%s\n"+
-			"They can redeploy the project to apply the latest set of permissions.\n"+
-			"Please refer to https://docs.databricks.com/dev-tools/bundles/permissions.html for more on managing permissions.",
-			resource, assistance),
-		Severity: diag.Error,
-		ID:       diag.ResourcePermissionDenied,
-	}}
-}
diff --git a/bundle/permissions/terraform_errors_test.go b/bundle/permissions/terraform_errors_test.go
deleted file mode 100644
index 1ad008e251b..00000000000
--- a/bundle/permissions/terraform_errors_test.go
+++ /dev/null
@@ -1,96 +0,0 @@
-package permissions_test
-
-import (
-	"errors"
-	"testing"
-
-	"github.com/databricks/cli/bundle/config/resources"
-	"github.com/databricks/cli/bundle/permissions"
-	"github.com/databricks/databricks-sdk-go/service/jobs"
-	"github.com/stretchr/testify/require"
-)
-
-func TestTryExtendTerraformPermissionError1(t *testing.T) {
-	ctx := t.Context()
-	b := mockBundle([]resources.Permission{
-		{Level: "CAN_MANAGE", UserName: "alice@databricks.com"},
-	})
-	err := permissions.TryExtendTerraformPermissionError(ctx, b, errors.New("Error: terraform apply: exit status 1\n"+
-		"\n"+
-		"Error: cannot update permissions: ...\n"+
-		"\n"+
-		"	with databricks_pipeline.my_project_pipeline,\n"+
-		"	on bundle.tf.json line 39, in resource.databricks_pipeline.my_project_pipeline:\n"+
-		"	39:       }")).Error()
-
-	expected := "EPERM2: permission denied creating or updating my_project_pipeline.\n" +
-		"For assistance, users or groups with appropriate permissions may include: alice@databricks.com.\n" +
-		"They can redeploy the project to apply the latest set of permissions.\n" +
-		"Please refer to https://docs.databricks.com/dev-tools/bundles/permissions.html for more on managing permissions"
-
-	require.ErrorContains(t, err, expected)
-}
-
-func TestTryExtendTerraformPermissionError2(t *testing.T) {
-	ctx := t.Context()
-	b := mockBundle([]resources.Permission{
-		{Level: "CAN_MANAGE", UserName: "alice@databricks.com"},
-		{Level: "CAN_MANAGE", UserName: "bob@databricks.com"},
-	})
-	err := permissions.TryExtendTerraformPermissionError(ctx, b, errors.New("Error: terraform apply: exit status 1\n"+
-		"\n"+
-		"Error: cannot read pipeline: User xyz does not have View permissions on pipeline 4521dbb6-42aa-418c-b94d-b5f4859a3454.\n"+
-		"\n"+
-		"	with databricks_pipeline.my_project_pipeline,\n"+
-		"	on bundle.tf.json line 39, in resource.databricks_pipeline.my_project_pipeline:\n"+
-		"	39:       }")).Error()
-
-	expected := "EPERM2: permission denied creating or updating my_project_pipeline.\n" +
-		"For assistance, users or groups with appropriate permissions may include: alice@databricks.com, bob@databricks.com.\n" +
-		"They can redeploy the project to apply the latest set of permissions.\n" +
-		"Please refer to https://docs.databricks.com/dev-tools/bundles/permissions.html for more on managing permissions."
-	require.ErrorContains(t, err, expected)
-}
-
-func TestTryExtendTerraformPermissionError3(t *testing.T) {
-	ctx := t.Context()
-	b := mockBundle([]resources.Permission{
-		{Level: "CAN_MANAGE", UserName: "testuser@databricks.com"},
-	})
-	err := permissions.TryExtendTerraformPermissionError(ctx, b, errors.New("Error: terraform apply: exit status 1\n"+
-		"\n"+
-		"Error: cannot read permissions: 1706906c-c0a2-4c25-9f57-3a7aa3cb8b90 does not have Owner permissions on Job with ID: ElasticJobId(28263044278868). Please contact the owner or an administrator for access.\n"+
-		"\n"+
-		"	with databricks_pipeline.my_project_pipeline,\n"+
-		"	on bundle.tf.json line 39, in resource.databricks_pipeline.my_project_pipeline:\n"+
-		"	39:       }")).Error()
-
-	expected := "EPERM2: permission denied creating or updating my_project_pipeline.\n" +
-		"For assistance, contact the owners of this project.\n" +
-		"They can redeploy the project to apply the latest set of permissions.\n" +
-		"Please refer to https://docs.databricks.com/dev-tools/bundles/permissions.html for more on managing permissions."
-	require.ErrorContains(t, err, expected)
-}
-
-func TestTryExtendTerraformPermissionErrorNotOwner(t *testing.T) {
-	ctx := t.Context()
-	b := mockBundle([]resources.Permission{
-		{Level: "CAN_MANAGE", GroupName: "data_team@databricks.com"},
-	})
-	b.Config.RunAs = &jobs.JobRunAs{
-		UserName: "testuser@databricks.com",
-	}
-	err := permissions.TryExtendTerraformPermissionError(ctx, b, errors.New("Error: terraform apply: exit status 1\n"+
-		"\n"+
-		"Error: cannot read pipeline: User xyz does not have View permissions on pipeline 4521dbb6-42aa-418c-b94d-b5f4859a3454.\n"+
-		"\n"+
-		"	with databricks_pipeline.my_project_pipeline,\n"+
-		"	on bundle.tf.json line 39, in resource.databricks_pipeline.my_project_pipeline:\n"+
-		"	39:       }")).Error()
-
-	expected := "EPERM2: permission denied creating or updating my_project_pipeline.\n" +
-		"For assistance, users or groups with appropriate permissions may include: data_team@databricks.com.\n" +
-		"They can redeploy the project to apply the latest set of permissions.\n" +
-		"Please refer to https://docs.databricks.com/dev-tools/bundles/permissions.html for more on managing permissions."
-	require.ErrorContains(t, err, expected)
-}
diff --git a/bundle/permissions/workspace_path_permissions.go b/bundle/permissions/workspace_path_permissions.go
index 6ff1729196b..a577396597e 100644
--- a/bundle/permissions/workspace_path_permissions.go
+++ b/bundle/permissions/workspace_path_permissions.go
@@ -66,6 +66,22 @@ func (p WorkspacePathPermissions) Compare(perms []resources.Permission) diag.Dia
 	return diags
 }
 
+// UndeclaredWriters returns the principals with write access to the workspace folder
+// (CAN_EDIT or higher — the access needed to deploy the bundle) that are not declared
+// in perms with at least that level. In practice CAN_MANAGE is the only declarable
+// level that grants write access, so such principals must be declared with CAN_MANAGE.
+// Read-only folder access does not need to be declared.
+func (p WorkspacePathPermissions) UndeclaredWriters(perms []resources.Permission) []resources.Permission {
+	var writers []resources.Permission
+	for _, wp := range p.Permissions {
+		if resources.GetLevelScore(string(wp.Level)) >= resources.GetLevelScore(resources.CAN_EDIT) {
+			writers = append(writers, wp)
+		}
+	}
+	_, missing := containsAll(writers, perms)
+	return missing
+}
+
 // samePrincipal checks if two permissions refer to the same user/group/service principal.
 func samePrincipal(a, b resources.Permission) bool {
 	return a.UserName == b.UserName &&
diff --git a/bundle/permissions/workspace_path_permissions_test.go b/bundle/permissions/workspace_path_permissions_test.go
index 98e66089d34..fd8a592da01 100644
--- a/bundle/permissions/workspace_path_permissions_test.go
+++ b/bundle/permissions/workspace_path_permissions_test.go
@@ -217,3 +217,95 @@ func TestWorkspacePathPermissionsDeduplication(t *testing.T) {
 	require.Equal(t, iam.PermissionLevel(CAN_MANAGE), wp.Permissions[0].Level)
 	require.Equal(t, "foo@bar.test", wp.Permissions[0].UserName)
 }
+
+func TestWorkspacePathPermissionsUndeclaredWriters(t *testing.T) {
+	manage := func(p resources.Permission) resources.Permission {
+		p.Level = CAN_MANAGE
+		return p
+	}
+	user := resources.Permission{UserName: "foo@bar.test"}
+	group := resources.Permission{GroupName: "team"}
+	sp := resources.Permission{ServicePrincipalName: "00000000-0000-0000-0000-000000000001"}
+
+	testCases := []struct {
+		name     string
+		folder   []resources.Permission
+		declared []resources.Permission
+		expected []resources.Permission
+	}{
+		{
+			name:     "empty folder ACL",
+			expected: nil,
+		},
+		{
+			name:     "reader does not need to be declared",
+			folder:   []resources.Permission{{Level: CAN_VIEW, UserName: user.UserName}},
+			expected: nil,
+		},
+		{
+			name:     "runner does not need to be declared",
+			folder:   []resources.Permission{{Level: CAN_RUN, GroupName: group.GroupName}},
+			expected: nil,
+		},
+		{
+			name:     "manager declared",
+			folder:   []resources.Permission{manage(user)},
+			declared: []resources.Permission{manage(user)},
+			expected: nil,
+		},
+		{
+			name:     "manager not declared",
+			folder:   []resources.Permission{manage(user)},
+			expected: []resources.Permission{manage(user)},
+		},
+		{
+			name:     "manager declared with a lower level",
+			folder:   []resources.Permission{manage(user)},
+			declared: []resources.Permission{{Level: CAN_VIEW, UserName: user.UserName}},
+			expected: []resources.Permission{manage(user)},
+		},
+		{
+			name:     "editor must be declared with CAN_MANAGE",
+			folder:   []resources.Permission{{Level: resources.CAN_EDIT, GroupName: group.GroupName}},
+			declared: []resources.Permission{manage(group)},
+			expected: nil,
+		},
+		{
+			name:     "editor not declared",
+			folder:   []resources.Permission{{Level: resources.CAN_EDIT, GroupName: group.GroupName}},
+			declared: []resources.Permission{manage(user)},
+			expected: []resources.Permission{{Level: resources.CAN_EDIT, GroupName: group.GroupName}},
+		},
+		{
+			name:     "group writer requires the same group declared",
+			folder:   []resources.Permission{manage(group)},
+			declared: []resources.Permission{manage(user), manage(sp)},
+			expected: []resources.Permission{manage(group)},
+		},
+		{
+			name:     "service principal writer declared",
+			folder:   []resources.Permission{manage(sp)},
+			declared: []resources.Permission{manage(sp)},
+			expected: nil,
+		},
+		{
+			name:     "mixed: writers declared, reader not",
+			folder:   []resources.Permission{manage(user), manage(group), {Level: CAN_VIEW, ServicePrincipalName: sp.ServicePrincipalName}},
+			declared: []resources.Permission{manage(user), manage(group)},
+			expected: nil,
+		},
+		{
+			name:     "multiple undeclared writers are all returned",
+			folder:   []resources.Permission{manage(user), manage(group)},
+			declared: []resources.Permission{manage(sp)},
+			expected: []resources.Permission{manage(user), manage(group)},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			p := WorkspacePathPermissions{Path: "path", Permissions: tc.folder}
+			require.Equal(t, tc.expected, p.UndeclaredWriters(tc.declared))
+		})
+	}
+}
diff --git a/bundle/permissions/workspace_root.go b/bundle/permissions/workspace_root.go
index 78b9bfd704a..d4f3ee173c7 100644
--- a/bundle/permissions/workspace_root.go
+++ b/bundle/permissions/workspace_root.go
@@ -3,10 +3,15 @@ package permissions
 import (
 	"context"
 	"fmt"
+	"slices"
 	"strconv"
+	"strings"
 
 	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/cli/bundle/libraries"
+	"github.com/databricks/cli/bundle/metrics"
 	"github.com/databricks/cli/bundle/paths"
 	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/databricks-sdk-go/service/workspace"
@@ -25,21 +30,36 @@ func (*workspaceRootPermissions) Name() string {
 
 // Apply implements bundle.Mutator.
 func (*workspaceRootPermissions) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
-	err := giveAccessForWorkspaceRoot(ctx, b)
+	workspace := b.Config.Workspace
+	if b.IsImmutableFolder() {
+		// For immutable bundles, file_path and artifact_path point into content-addressed
+		// snapshot storage that is not a normal workspace folder. Clear them so that
+		// giveAccessForWorkspaceRoot only applies permissions to root_path (and the
+		// state_path / resource_path nested under it), which still need ACLs for
+		// shared deployments to work correctly.
+		workspace.FilePath = ""
+		workspace.ArtifactPath = ""
+	}
+
+	stateFolderPermissions, err := giveAccessForWorkspaceRoot(ctx, b, workspace)
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
+	recordPermissionMetrics(b, stateFolderPermissions)
 	return nil
 }
 
-func giveAccessForWorkspaceRoot(ctx context.Context, b *bundle.Bundle) error {
+// giveAccessForWorkspaceRoot applies the bundle's top-level permissions to the
+// workspace folders and returns the resulting permissions of the folder that holds
+// the deployment state. It returns nil only when no permissions are declared, in
+// which case no folders are synced.
+func giveAccessForWorkspaceRoot(ctx context.Context, b *bundle.Bundle, wsConfig config.Workspace) (*WorkspacePathPermissions, error) {
 	var permissions []workspace.WorkspaceObjectAccessControlRequest
-
 	for _, p := range b.Config.Permissions {
 		level, err := GetWorkspaceObjectPermissionLevel(string(p.Level))
 		if err != nil {
-			return err
+			return nil, err
 		}
 
 		permissions = append(permissions, workspace.WorkspaceObjectAccessControlRequest{
@@ -51,40 +71,68 @@ func giveAccessForWorkspaceRoot(ctx context.Context, b *bundle.Bundle) error {
 	}
 
 	if len(permissions) == 0 {
-		return nil
+		return nil, nil
 	}
 
 	w := b.WorkspaceClient(ctx).Workspace
-	bundlePaths := paths.CollectUniqueWorkspacePathPrefixes(b.Config.Workspace)
+	wsPaths := paths.CollectUniqueWorkspacePathPrefixes(wsConfig)
 
+	// Each goroutine writes the folder's resulting permissions into its own slot,
+	// so they are inspected after Wait rather than concurrently.
+	folderPermissions := make([]*WorkspacePathPermissions, len(wsPaths.Paths))
 	g, ctx := errgroup.WithContext(ctx)
-	for _, p := range bundlePaths {
+	for i, p := range wsPaths.Paths {
 		g.Go(func() error {
-			return setPermissions(ctx, w, p, permissions)
+			wp, err := setPermissions(ctx, w, p, permissions)
+			folderPermissions[i] = wp
+			return err
 		})
 	}
 
-	return g.Wait()
+	if err := g.Wait(); err != nil {
+		return nil, err
+	}
+
+	// Return the permissions of the folder governing the deployment state. When
+	// state_path is nested under root_path it is deduplicated out of the collected
+	// paths, so Governing resolves it to root_path, whose ACL it inherits.
+	stateFolder := wsPaths.Governing(wsConfig.StatePath)
+	i := slices.Index(wsPaths.Paths, stateFolder)
+	if i < 0 {
+		return nil, nil
+	}
+	return folderPermissions[i], nil
 }
 
-func setPermissions(ctx context.Context, w workspace.WorkspaceInterface, path string, permissions []workspace.WorkspaceObjectAccessControlRequest) error {
-	// If the folder is shared, then we don't need to set permissions since it's always set for all users and it's checked in mutators before.
+func setPermissions(ctx context.Context, w workspace.WorkspaceInterface, path string, permissions []workspace.WorkspaceObjectAccessControlRequest) (*WorkspacePathPermissions, error) {
+	// Shared folders are writable by all workspace users and the sync does not modify
+	// them. Return that ACL statically so callers need no special case for them.
 	if libraries.IsWorkspaceSharedPath(path) {
-		return nil
+		return &WorkspacePathPermissions{
+			Path:        path,
+			Permissions: []resources.Permission{{Level: CAN_MANAGE, GroupName: "users"}},
+		}, nil
 	}
 
-	obj, err := w.GetStatusByPath(ctx, path) //nolint:staticcheck // Deprecated in SDK v0.127.0. Migration to WorkspaceHierarchyService tracked separately.
+	obj, err := w.GetStatusByPath(ctx, path)
 	if err != nil {
-		return err
+		return nil, err
 	}
 
-	_, err = w.SetPermissions(ctx, workspace.WorkspaceObjectPermissionsRequest{
+	// Reusing the SetPermissions response (the folder's resulting ACL) lets us compare
+	// it against the declaration without an extra API call. The Set replaces the direct
+	// ACL with the declared permissions, so any principal still showing higher access is
+	// inherited from a parent folder.
+	resp, err := w.SetPermissions(ctx, workspace.WorkspaceObjectPermissionsRequest{
 		WorkspaceObjectId:   strconv.FormatInt(obj.ObjectId, 10),
 		WorkspaceObjectType: "directories",
 		AccessControlList:   permissions,
 	})
+	if err != nil {
+		return nil, err
+	}
 
-	return err
+	return ObjectAclToResourcePermissions(path, resp.AccessControlList), nil
 }
 
 func GetWorkspaceObjectPermissionLevel(bundlePermission string) (workspace.WorkspaceObjectPermissionLevel, error) {
@@ -99,3 +147,129 @@ func GetWorkspaceObjectPermissionLevel(bundlePermission string) (workspace.Works
 		return "", fmt.Errorf("unsupported bundle permission level %s", bundlePermission)
 	}
 }
+
+// recordPermissionMetrics records telemetry describing how the deployment state
+// folder's permissions relate to the bundle's declared permissions. stateFolderPerms
+// is the folder's resulting ACL, or nil when no permissions are declared (no folders
+// are synced in that case).
+//
+// Alongside the single auto-migration verdict it emits an independent boolean breakdown
+// (state folder location, whether a permissions section is set, and which principal
+// types have undeclared write access) so the population can be sliced directly.
+func recordPermissionMetrics(b *bundle.Bundle, stateFolderPerms *WorkspacePathPermissions) {
+	statePath := b.Config.Workspace.StatePath
+	deployer := deployingUserName(b)
+
+	isShared := libraries.IsWorkspaceSharedPath(statePath)
+	owner, underUserHome := userHomeOwner(statePath)
+
+	b.Metrics.SetBoolValue(metrics.StatePathIsShared, isShared)
+	b.Metrics.SetBoolValue(metrics.PermissionsSectionSet, len(b.Config.Permissions) > 0)
+
+	// userHomeOwner yields a non-empty owner whenever underUserHome is true, so the two
+	// home flags are exact complements: an unresolved deployer ("") never equals the
+	// owner and falls into the other-user bucket. StatePathOther covers any /Workspace
+	// folder that is neither shared nor a user home.
+	b.Metrics.SetBoolValue(metrics.StatePathInDeployerHome, underUserHome && owner == deployer)
+	b.Metrics.SetBoolValue(metrics.StatePathInOtherUserHome, underUserHome && owner != deployer)
+	b.Metrics.SetBoolValue(metrics.StatePathOther, !isShared && !underUserHome)
+
+	// stateFolderPerms is nil when no permissions are declared, in which case there are
+	// no undeclared writers (the migration mirrors the folder's ACLs).
+	var undeclared []resources.Permission
+	if stateFolderPerms != nil {
+		undeclared = stateFolderPerms.UndeclaredWriters(b.Config.Permissions)
+	}
+	self, otherUser, servicePrincipal, group := undeclaredWriterTypes(undeclared, deployer)
+	b.Metrics.SetBoolValue(metrics.DMSUndeclaredDeployingUser, self)
+	b.Metrics.SetBoolValue(metrics.DMSUndeclaredOtherUser, otherUser)
+	b.Metrics.SetBoolValue(metrics.DMSUndeclaredServicePrincipal, servicePrincipal)
+	b.Metrics.SetBoolValue(metrics.DMSUndeclaredGroup, group)
+
+	// Emit exactly one of the auto-migration verdict keys.
+	b.Metrics.SetBoolValue(autoMigrationVerdict(b, stateFolderPerms, undeclared), true)
+}
+
+// autoMigrationVerdict returns the metric key describing whether this deploy is
+// compatible with an automatic migration of the deployment state to a dedicated
+// state storage service. undeclared is the state folder's undeclared writers (empty
+// when no permissions are declared). See metrics.DMSCompatAuto.
+func autoMigrationVerdict(b *bundle.Bundle, stateFolderPerms *WorkspacePathPermissions, undeclared []resources.Permission) string {
+	// No permissions section: the migration mirrors the state folder's ACLs onto the
+	// deployment (CAN_EDIT -> CAN_EDIT, CAN_MANAGE -> CAN_MANAGE), preserving
+	// everyone's access wherever the state lives.
+	if len(b.Config.Permissions) == 0 {
+		return metrics.DMSCompatAuto
+	}
+
+	// A permissions section is set. The state folder is always one of the synced bundle
+	// folders (a /Volumes state_path is rejected earlier by ValidateVolumePath), so
+	// stateFolderPerms is non-nil here. Guard against nil regardless so a telemetry
+	// computation can never panic the deploy.
+	if stateFolderPerms == nil {
+		return metrics.DMSCompatNot
+	}
+
+	// The migration applies exactly the declared permissions to the deployment, so
+	// anyone with write access to the state folder who is not declared loses the
+	// ability to deploy.
+	switch {
+	case len(undeclared) == 0:
+		return metrics.DMSCompatAuto
+	case len(undeclared) == 1 && isDeployingUser(b, undeclared[0]):
+		// The deploying user is the only undeclared writer. The migration grants the
+		// deploying user CAN_MANAGE on the deployment object, so this deploy is
+		// auto-migratable if we choose to preserve that grant on future deploys.
+		return metrics.DMSCompatOnlySelfUndeclared
+	default:
+		return metrics.DMSCompatNot
+	}
+}
+
+// undeclaredWriterTypes classifies undeclared writers by principal type, distinguishing
+// the deploying user from other users.
+func undeclaredWriterTypes(undeclared []resources.Permission, deployer string) (self, otherUser, servicePrincipal, group bool) {
+	for _, p := range undeclared {
+		switch {
+		case p.UserName != "" && p.UserName == deployer:
+			self = true
+		case p.UserName != "":
+			otherUser = true
+		case p.ServicePrincipalName != "":
+			servicePrincipal = true
+		case p.GroupName != "":
+			group = true
+		}
+	}
+	return self, otherUser, servicePrincipal, group
+}
+
+// userHomeOwner returns the owner of the user home folder containing path, i.e. <owner>
+// for a path under /Workspace/Users/<owner>. ok is false when path is not under a user
+// home folder.
+//
+// Paths are always /Workspace-prefixed here: PrependWorkspacePrefix runs in the
+// initialize phase (before this deploy-phase mutator) and rewrites a bare /Users/...
+// to /Workspace/Users/..., so the /Workspace/Users/ check below is sufficient.
+func userHomeOwner(path string) (owner string, ok bool) {
+	const prefix = "/Workspace/Users/"
+	if !strings.HasPrefix(path, prefix) {
+		return "", false
+	}
+	owner, _, _ = strings.Cut(path[len(prefix):], "/")
+	return owner, owner != ""
+}
+
+// deployingUserName returns the user performing the deploy, or "" when not yet resolved.
+func deployingUserName(b *bundle.Bundle) string {
+	if b.Config.Workspace.CurrentUser == nil {
+		return ""
+	}
+	return b.Config.Workspace.CurrentUser.UserName
+}
+
+// isDeployingUser reports whether p is the user performing the deploy.
+func isDeployingUser(b *bundle.Bundle, p resources.Permission) bool {
+	deployer := deployingUserName(b)
+	return p.UserName != "" && p.UserName == deployer
+}
diff --git a/bundle/permissions/workspace_root_test.go b/bundle/permissions/workspace_root_test.go
index a3b5f5ac2d9..db4ea36fc8c 100644
--- a/bundle/permissions/workspace_root_test.go
+++ b/bundle/permissions/workspace_root_test.go
@@ -70,7 +70,7 @@ func TestApplyWorkspaceRootPermissions(t *testing.T) {
 		},
 		WorkspaceObjectId:   "1234",
 		WorkspaceObjectType: "directories",
-	}).Return(nil, nil)
+	}).Return(&workspace.WorkspaceObjectPermissions{}, nil)
 
 	diags := bundle.ApplySeq(t.Context(), b, ValidateSharedRootPermissions(), ApplyWorkspaceRootPermissions())
 	require.Empty(t, diags)
@@ -143,7 +143,7 @@ func TestApplyWorkspaceRootPermissionsForAllPaths(t *testing.T) {
 		},
 		WorkspaceObjectId:   "1",
 		WorkspaceObjectType: "directories",
-	}).Return(nil, nil)
+	}).Return(&workspace.WorkspaceObjectPermissions{}, nil)
 
 	workspaceApi.EXPECT().SetPermissions(mock.Anything, workspace.WorkspaceObjectPermissionsRequest{
 		AccessControlList: []workspace.WorkspaceObjectAccessControlRequest{
@@ -153,7 +153,7 @@ func TestApplyWorkspaceRootPermissionsForAllPaths(t *testing.T) {
 		},
 		WorkspaceObjectId:   "2",
 		WorkspaceObjectType: "directories",
-	}).Return(nil, nil)
+	}).Return(&workspace.WorkspaceObjectPermissions{}, nil)
 
 	workspaceApi.EXPECT().SetPermissions(mock.Anything, workspace.WorkspaceObjectPermissionsRequest{
 		AccessControlList: []workspace.WorkspaceObjectAccessControlRequest{
@@ -163,7 +163,7 @@ func TestApplyWorkspaceRootPermissionsForAllPaths(t *testing.T) {
 		},
 		WorkspaceObjectId:   "3",
 		WorkspaceObjectType: "directories",
-	}).Return(nil, nil)
+	}).Return(&workspace.WorkspaceObjectPermissions{}, nil)
 
 	workspaceApi.EXPECT().SetPermissions(mock.Anything, workspace.WorkspaceObjectPermissionsRequest{
 		AccessControlList: []workspace.WorkspaceObjectAccessControlRequest{
@@ -173,7 +173,7 @@ func TestApplyWorkspaceRootPermissionsForAllPaths(t *testing.T) {
 		},
 		WorkspaceObjectId:   "4",
 		WorkspaceObjectType: "directories",
-	}).Return(nil, nil)
+	}).Return(&workspace.WorkspaceObjectPermissions{}, nil)
 
 	workspaceApi.EXPECT().SetPermissions(mock.Anything, workspace.WorkspaceObjectPermissionsRequest{
 		AccessControlList: []workspace.WorkspaceObjectAccessControlRequest{
@@ -183,8 +183,57 @@ func TestApplyWorkspaceRootPermissionsForAllPaths(t *testing.T) {
 		},
 		WorkspaceObjectId:   "5",
 		WorkspaceObjectType: "directories",
-	}).Return(nil, nil)
+	}).Return(&workspace.WorkspaceObjectPermissions{}, nil)
 
 	diags := bundle.Apply(t.Context(), b, ApplyWorkspaceRootPermissions())
 	require.NoError(t, diags.Error())
 }
+
+func TestUndeclaredWriterTypes(t *testing.T) {
+	const deployer = "me@example.com"
+	self := resources.Permission{Level: CAN_MANAGE, UserName: deployer}
+	other := resources.Permission{Level: CAN_MANAGE, UserName: "other@example.com"}
+	sp := resources.Permission{Level: CAN_MANAGE, ServicePrincipalName: "sp-1"}
+	group := resources.Permission{Level: CAN_MANAGE, GroupName: "team"}
+
+	cases := []struct {
+		name                                   string
+		undeclared                             []resources.Permission
+		wantSelf, wantOther, wantSP, wantGroup bool
+	}{
+		{"empty", nil, false, false, false, false},
+		{"deploying user", []resources.Permission{self}, true, false, false, false},
+		{"other user", []resources.Permission{other}, false, true, false, false},
+		{"service principal", []resources.Permission{sp}, false, false, true, false},
+		{"group", []resources.Permission{group}, false, false, false, true},
+		{"all types", []resources.Permission{self, other, sp, group}, true, true, true, true},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			gotSelf, gotOther, gotSP, gotGroup := undeclaredWriterTypes(tc.undeclared, deployer)
+			require.Equal(t, tc.wantSelf, gotSelf)
+			require.Equal(t, tc.wantOther, gotOther)
+			require.Equal(t, tc.wantSP, gotSP)
+			require.Equal(t, tc.wantGroup, gotGroup)
+		})
+	}
+}
+
+func TestUserHomeOwner(t *testing.T) {
+	cases := []struct {
+		path  string
+		owner string
+		ok    bool
+	}{
+		{"/Workspace/Users/alice@example.com/.bundle/x/state", "alice@example.com", true},
+		{"/Workspace/Users/alice@example.com", "alice@example.com", true},
+		{"/Workspace/Shared/state", "", false},
+		{"/Workspace/team/state", "", false},
+		{"/Workspace/Users/", "", false},
+	}
+	for _, tc := range cases {
+		owner, ok := userHomeOwner(tc.path)
+		require.Equal(t, tc.ok, ok, tc.path)
+		require.Equal(t, tc.owner, owner, tc.path)
+	}
+}
diff --git a/bundle/phases/approval.go b/bundle/phases/approval.go
new file mode 100644
index 00000000000..fdbcd8ecea9
--- /dev/null
+++ b/bundle/phases/approval.go
@@ -0,0 +1,41 @@
+package phases
+
+import (
+	"context"
+
+	"github.com/databricks/cli/bundle/deployplan"
+	"github.com/databricks/cli/libs/cmdio"
+)
+
+// approvalGroup describes one resource type that needs explicit user consent
+// before a destructive action is applied.
+type approvalGroup struct {
+	group        string // matches config.GetResourceTypeFromKey, e.g. "schemas"
+	message      string // banner shown above the action list
+	skipChildren bool   // skip actions where IsChildResource() is true
+}
+
+// logApprovalGroups filters actions per group and prints non-empty groups.
+// If trailingNewline is true, an empty line is printed after each non-empty group.
+// Returns the total number of matched actions across all groups.
+func logApprovalGroups(ctx context.Context, actions []deployplan.Action, groups []approvalGroup, trailingNewline bool, types ...deployplan.ActionType) int {
+	total := 0
+	for _, g := range groups {
+		matched := filterGroup(actions, g.group, types...)
+		if len(matched) == 0 {
+			continue
+		}
+		total += len(matched)
+		cmdio.LogString(ctx, g.message)
+		for _, a := range matched {
+			if g.skipChildren && a.IsChildResource() {
+				continue
+			}
+			cmdio.Log(ctx, a)
+		}
+		if trailingNewline {
+			cmdio.LogString(ctx, "")
+		}
+	}
+	return total
+}
diff --git a/bundle/phases/bind.go b/bundle/phases/bind.go
index f0041e91838..d8ff6aeaf3e 100644
--- a/bundle/phases/bind.go
+++ b/bundle/phases/bind.go
@@ -11,18 +11,27 @@ import (
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/bundle/config/engine"
 	"github.com/databricks/cli/bundle/deploy/lock"
-	"github.com/databricks/cli/bundle/deploy/terraform"
 	"github.com/databricks/cli/bundle/deployplan"
 	"github.com/databricks/cli/bundle/statemgmt"
+	"github.com/databricks/cli/libs/agent"
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/log"
 	"github.com/databricks/cli/libs/logdiag"
 )
 
-func Bind(ctx context.Context, b *bundle.Bundle, opts *terraform.BindOptions, engine engine.EngineType) {
+type BindOptions struct {
+	AutoApprove bool
+	// Group is the bundle resource group, e.g. "jobs".
+	Group       string
+	ResourceKey string
+	ResourceId  string
+}
+
+func Bind(ctx context.Context, b *bundle.Bundle, opts *BindOptions, stateDesc *statemgmt.StateDesc) {
 	log.Info(ctx, "Phase: bind")
+	engine := stateDesc.Engine
 
-	bundle.ApplyContext(ctx, b, lock.Acquire())
+	bundle.ApplyContext(ctx, b, lock.Acquire(lock.GoalBind))
 	if logdiag.HasError(ctx) {
 		return
 	}
@@ -31,79 +40,74 @@ func Bind(ctx context.Context, b *bundle.Bundle, opts *terraform.BindOptions, en
 		bundle.ApplyContext(ctx, b, lock.Release(lock.GoalBind))
 	}()
 
-	if engine.IsDirect() {
-		// Direct engine: import into temp state, run plan, check for changes
-		// This follows the same pattern as terraform import
-		groupName, ok := terraform.TerraformToGroupName[opts.ResourceType]
-		if !ok {
-			groupName = opts.ResourceType
-		}
-		resourceKey := fmt.Sprintf("resources.%s.%s", groupName, opts.ResourceKey)
-		_, statePath := b.StateFilenameDirect(ctx)
+	// The terraform engine was removed in v1.20.0. bind does not migrate on its own, so a
+	// terraform state means the user must migrate first (via "bundle deploy").
+	if !engine.IsDirect() {
+		logdiag.LogError(ctx, errors.New(TerraformStateRemovedMessage))
+		return
+	}
 
-		result, err := b.DeploymentBundle.Bind(ctx, b.WorkspaceClient(ctx), &b.Config, statePath, resourceKey, opts.ResourceId)
-		if err != nil {
-			logdiag.LogError(ctx, err)
-			return
-		}
+	if stateDesc.IsDMS() {
+		logdiag.LogError(ctx, errors.New("bind is not supported for a bundle target that records deployment history"))
+		return
+	}
+
+	// Direct engine: import into temp state, run plan, check for changes.
+	resourceKey := fmt.Sprintf("resources.%s.%s", opts.Group, opts.ResourceKey)
+	_, statePath := b.StateFilenameDirect(ctx)
 
-		// If there are changes and auto-approve is not set, show plan and ask for confirmation
-		if result.HasChanges && !opts.AutoApprove {
-			// Display the planned changes for the bound resource
-			cmdio.LogString(ctx, fmt.Sprintf("Plan: %s %s", result.Action, resourceKey))
-
-			// Show details of what will change
-			if result.Plan != nil {
-				if entry, ok := result.Plan.Plan[resourceKey]; ok && entry != nil && len(entry.Changes) > 0 {
-					cmdio.LogString(ctx, "\nChanges detected:")
-					for _, field := range slices.Sorted(maps.Keys(entry.Changes)) {
-						change := entry.Changes[field]
-						if change.Action != deployplan.Skip {
-							cmdio.LogString(ctx, fmt.Sprintf("  ~ %s: %v -> %v", field, jsonDump(ctx, change.Remote, field), jsonDump(ctx, change.New, field)))
-						}
+	result, err := b.DeploymentBundle.Bind(ctx, b.WorkspaceClient(ctx), &b.Config, statePath, resourceKey, opts.ResourceId)
+	if err != nil {
+		logdiag.LogError(ctx, err)
+		return
+	}
+
+	// If there are changes and auto-approve is not set, show plan and ask for confirmation
+	if result.HasChanges && !opts.AutoApprove {
+		// Display the planned changes for the bound resource
+		cmdio.LogString(ctx, fmt.Sprintf("Plan: %s %s", result.Action, resourceKey))
+
+		// Show details of what will change
+		if result.Plan != nil {
+			if entry, ok := result.Plan.Plan[resourceKey]; ok && entry != nil && len(entry.Changes) > 0 {
+				cmdio.LogString(ctx, "\nChanges detected:")
+				for _, field := range slices.Sorted(maps.Keys(entry.Changes)) {
+					change := entry.Changes[field]
+					if change.Action != deployplan.Skip {
+						cmdio.LogString(ctx, fmt.Sprintf("  ~ %s: %v -> %v", field, jsonDump(ctx, change.Remote, field), jsonDump(ctx, change.New, field)))
 					}
-					cmdio.LogString(ctx, "")
 				}
+				cmdio.LogString(ctx, "")
 			}
+		}
 
-			if !cmdio.IsPromptSupported(ctx) {
-				result.Cancel()
-				logdiag.LogError(ctx, errors.New("This bind operation requires user confirmation, but the current console does not support prompting. Please specify --auto-approve if you would like to skip prompts and proceed.")) //nolint
-				return
-			}
-
-			ans, err := cmdio.AskYesOrNo(ctx, "Confirm import changes? Changes will be remotely applied only after running 'bundle deploy'.")
-			if err != nil {
-				result.Cancel()
-				logdiag.LogError(ctx, err)
-				return
-			}
-			if !ans {
-				result.Cancel()
-				logdiag.LogError(ctx, errors.New("import aborted"))
-				return
-			}
+		if !cmdio.IsPromptSupported(ctx) {
+			result.Cancel()
+			logdiag.LogError(ctx, fmt.Errorf("this bind operation requires user confirmation, but the current console does not support prompting.\nTo proceed, use --auto-approve after reviewing the plan above.%s", agent.AgentNotice()))
+			return
 		}
 
-		// Finalize: rename temp state to final location
-		err = result.Finalize()
+		ans, err := cmdio.AskYesOrNo(ctx, "Confirm import changes? Changes will be remotely applied only after running 'bundle deploy'.")
 		if err != nil {
+			result.Cancel()
 			logdiag.LogError(ctx, err)
 			return
 		}
-	} else {
-		// Terraform engine: use terraform import
-		bundle.ApplySeqContext(ctx, b,
-			terraform.Interpolate(),
-			terraform.Write(),
-			terraform.Import(opts),
-		)
-		if logdiag.HasError(ctx) {
+		if !ans {
+			result.Cancel()
+			logdiag.LogError(ctx, errors.New("import aborted"))
 			return
 		}
 	}
 
-	statemgmt.PushResourcesState(ctx, b, engine)
+	// Finalize: rename temp state to final location
+	err = result.Finalize()
+	if err != nil {
+		logdiag.LogError(ctx, err)
+		return
+	}
+
+	statemgmt.PushResourcesState(ctx, b)
 }
 
 func jsonDump(ctx context.Context, v any, field string) string {
@@ -115,10 +119,10 @@ func jsonDump(ctx context.Context, v any, field string) string {
 	return string(b)
 }
 
-func Unbind(ctx context.Context, b *bundle.Bundle, bundleType, tfResourceType, resourceKey string, engine engine.EngineType) {
+func Unbind(ctx context.Context, b *bundle.Bundle, group, resourceKey string, engine engine.EngineType) {
 	log.Info(ctx, "Phase: unbind")
 
-	bundle.ApplyContext(ctx, b, lock.Acquire())
+	bundle.ApplyContext(ctx, b, lock.Acquire(lock.GoalUnbind))
 	if logdiag.HasError(ctx) {
 		return
 	}
@@ -127,28 +131,20 @@ func Unbind(ctx context.Context, b *bundle.Bundle, bundleType, tfResourceType, r
 		bundle.ApplyContext(ctx, b, lock.Release(lock.GoalUnbind))
 	}()
 
-	if engine.IsDirect() {
-		groupName, ok := terraform.TerraformToGroupName[tfResourceType]
-		if !ok {
-			groupName = tfResourceType
-		}
-		fullResourceKey := fmt.Sprintf("resources.%s.%s", groupName, resourceKey)
-		_, statePath := b.StateFilenameDirect(ctx)
-		err := b.DeploymentBundle.Unbind(ctx, statePath, fullResourceKey)
-		if err != nil {
-			logdiag.LogError(ctx, err)
-			return
-		}
-	} else {
-		bundle.ApplySeqContext(ctx, b,
-			terraform.Interpolate(),
-			terraform.Write(),
-			terraform.Unbind(bundleType, tfResourceType, resourceKey),
-		)
-		if logdiag.HasError(ctx) {
-			return
-		}
+	// The terraform engine was removed in v1.20.0. unbind does not migrate on its own, so a
+	// terraform state means the user must migrate first (via "bundle deploy").
+	if !engine.IsDirect() {
+		logdiag.LogError(ctx, errors.New(TerraformStateRemovedMessage))
+		return
+	}
+
+	fullResourceKey := fmt.Sprintf("resources.%s.%s", group, resourceKey)
+	_, statePath := b.StateFilenameDirect(ctx)
+	err := b.DeploymentBundle.Unbind(ctx, statePath, fullResourceKey)
+	if err != nil {
+		logdiag.LogError(ctx, err)
+		return
 	}
 
-	statemgmt.PushResourcesState(ctx, b, engine)
+	statemgmt.PushResourcesState(ctx, b)
 }
diff --git a/bundle/phases/build.go b/bundle/phases/build.go
index 5a32435f8f1..442fb7420fd 100644
--- a/bundle/phases/build.go
+++ b/bundle/phases/build.go
@@ -14,16 +14,17 @@ import (
 	"github.com/databricks/cli/libs/logdiag"
 )
 
+// LibLocationMap maps artifact names to library locations that need uploading.
+// Computed by Build and consumed by Deploy to upload the right files.
 type LibLocationMap map[string][]libraries.LocationToUpdate
 
-// The build phase builds artifacts.
-func Build(ctx context.Context, b *bundle.Bundle) LibLocationMap {
-	log.Info(ctx, "Phase: build")
-
-	bundle.ApplySeqContext(ctx, b,
-		scripts.Execute(config.ScriptPreBuild),
-		artifacts.Build(),
-		scripts.Execute(config.ScriptPostBuild),
+// resolveLibraries runs variable resolution, glob expansion, path rewriting,
+// and wheel-task transformation to produce the local→remote upload map.
+// extra mutators are applied after CheckForSameNameLibraries and before
+// ReplaceWithRemotePath; Build passes SwitchToPatchedWheels() there.
+func resolveLibraries(ctx context.Context, b *bundle.Bundle, extra ...bundle.Mutator) LibLocationMap {
+	mutators := make([]bundle.Mutator, 0, 4+len(extra))
+	mutators = append(mutators,
 		mutator.ResolveVariableReferencesWithoutResources(
 			"artifacts",
 		),
@@ -37,20 +38,38 @@ func Build(ctx context.Context, b *bundle.Bundle) LibLocationMap {
 		// mutator is part of the deploy step rather than validate.
 		libraries.ExpandGlobReferences(),
 		libraries.CheckForSameNameLibraries(),
-		// SwitchToPatchedWheels must be run after ExpandGlobReferences and after build phase because it Artifact.Source and Artifact.Patched populated
-		libraries.SwitchToPatchedWheels(),
 	)
+	mutators = append(mutators, extra...)
+	bundle.ApplySeqContext(ctx, b, mutators...)
+
+	if logdiag.HasError(ctx) {
+		return nil
+	}
 
 	libs, diags := libraries.ReplaceWithRemotePath(ctx, b)
-	for _, diag := range diags {
-		logdiag.LogDiag(ctx, diag)
+	for _, d := range diags {
+		logdiag.LogDiag(ctx, d)
 	}
+	bundle.ApplyContext(ctx, b, trampoline.TransformWheelTask())
+	return libs
+}
 
-	bundle.ApplyContext(ctx, b,
-		// TransformWheelTask must be run after ReplaceWithRemotePath so we can use correct remote path in the
-		// transformed notebook
-		trampoline.TransformWheelTask(),
+// Build runs the build phase, which builds artifacts.
+func Build(ctx context.Context, b *bundle.Bundle) LibLocationMap {
+	log.Info(ctx, "Phase: build")
+
+	bundle.ApplySeqContext(ctx, b,
+		scripts.Execute(config.ScriptPreBuild),
+		artifacts.Build(),
+		scripts.Execute(config.ScriptPostBuild),
 	)
 
-	return libs
+	if logdiag.HasError(ctx) {
+		return nil
+	}
+
+	// SwitchToPatchedWheels must be passed to resolveLibraries so it runs after
+	// ExpandGlobReferences (which expands *.whl patterns in job library paths)
+	// and after the build phase (which populates Artifact.Source and Artifact.Patched).
+	return resolveLibraries(ctx, b, libraries.SwitchToPatchedWheels())
 }
diff --git a/bundle/phases/deploy.go b/bundle/phases/deploy.go
index 38389b9adb2..13c5121f569 100644
--- a/bundle/phases/deploy.go
+++ b/bundle/phases/deploy.go
@@ -3,179 +3,149 @@ package phases
 import (
 	"context"
 	"errors"
+	"fmt"
+	"slices"
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/bundle/artifacts"
 	"github.com/databricks/cli/bundle/config"
-	"github.com/databricks/cli/bundle/config/engine"
 	"github.com/databricks/cli/bundle/deploy"
 	"github.com/databricks/cli/bundle/deploy/files"
 	"github.com/databricks/cli/bundle/deploy/lock"
 	"github.com/databricks/cli/bundle/deploy/metadata"
-	"github.com/databricks/cli/bundle/deploy/terraform"
+	"github.com/databricks/cli/bundle/deploy/snapshot"
 	"github.com/databricks/cli/bundle/deployplan"
-	"github.com/databricks/cli/bundle/direct"
 	"github.com/databricks/cli/bundle/libraries"
 	"github.com/databricks/cli/bundle/metrics"
 	"github.com/databricks/cli/bundle/permissions"
 	"github.com/databricks/cli/bundle/scripts"
 	"github.com/databricks/cli/bundle/statemgmt"
+	"github.com/databricks/cli/libs/agent"
 	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/dms"
 	"github.com/databricks/cli/libs/log"
 	"github.com/databricks/cli/libs/logdiag"
 	"github.com/databricks/cli/libs/sync"
+	"github.com/databricks/databricks-sdk-go/service/bundledeployments"
 )
 
+var deployApprovalGroups = []approvalGroup{
+	{group: "schemas", message: deleteOrRecreateSchemaMessage, skipChildren: true},
+	{group: "pipelines", message: deleteOrRecreatePipelineMessage},
+	{group: "volumes", message: deleteOrRecreateVolumeMessage},
+	{group: "dashboards", message: deleteOrRecreateDashboardMessage},
+	{group: "database_instances", message: deleteOrRecreateDatabaseInstanceMessage},
+	{group: "synced_database_tables", message: deleteOrRecreateSyncedDatabaseTableMessage},
+	{group: "postgres_projects", message: deleteOrRecreatePostgresProjectMessage},
+	{group: "postgres_branches", message: deleteOrRecreatePostgresBranchMessage},
+	{group: "postgres_databases", message: deleteOrRecreatePostgresDatabaseMessage},
+	{group: "vector_search_indexes", message: deleteOrRecreateVectorSearchIndexMessage},
+	{group: "genie_spaces", message: deleteOrRecreateGenieSpaceMessage},
+}
+
 func approvalForDeploy(ctx context.Context, b *bundle.Bundle, plan *deployplan.Plan) (bool, error) {
 	actions := plan.GetActions()
 
+	// Deletes that only clean up the state (already gone remotely, or no delete
+	// operation) are not destructive and need no approval.
+	actions = slices.DeleteFunc(actions, func(a deployplan.Action) bool { return a.IsStateOnlyDelete() })
+
 	err := checkForPreventDestroy(b, actions)
 	if err != nil {
 		return false, err
 	}
 
-	types := []deployplan.ActionType{deployplan.Recreate, deployplan.Delete}
-	schemaActions := filterGroup(actions, "schemas", types...)
-	pipelineActions := filterGroup(actions, "pipelines", types...)
-	volumeActions := filterGroup(actions, "volumes", types...)
-	dashboardActions := filterGroup(actions, "dashboards", types...)
-	databaseInstanceActions := filterGroup(actions, "database_instances", types...)
-	syncedDatabaseTableActions := filterGroup(actions, "synced_database_tables", types...)
-	postgresProjectActions := filterGroup(actions, "postgres_projects", types...)
-	postgresBranchActions := filterGroup(actions, "postgres_branches", types...)
-
-	// We don't need to display any prompts in this case.
-	if len(schemaActions) == 0 && len(pipelineActions) == 0 && len(volumeActions) == 0 && len(dashboardActions) == 0 &&
-		len(databaseInstanceActions) == 0 && len(syncedDatabaseTableActions) == 0 &&
-		len(postgresProjectActions) == 0 && len(postgresBranchActions) == 0 {
+	total := logApprovalGroups(ctx, actions, deployApprovalGroups, false, deployplan.Recreate, deployplan.Delete)
+	if total == 0 {
+		// No destructive actions in any tracked group: skip the prompt.
 		return true, nil
 	}
 
-	// One or more UC schema resources will be deleted or recreated.
-	if len(schemaActions) != 0 {
-		cmdio.LogString(ctx, deleteOrRecreateSchemaMessage)
-		for _, action := range schemaActions {
-			if action.IsChildResource() {
-				continue
-			}
-			cmdio.Log(ctx, action)
-		}
-	}
-
-	// One or more pipelines is being recreated.
-	if len(pipelineActions) != 0 {
-		cmdio.LogString(ctx, deleteOrRecreatePipelineMessage)
-		for _, action := range pipelineActions {
-			cmdio.Log(ctx, action)
-		}
-	}
-
-	// One or more volumes is being recreated.
-	if len(volumeActions) != 0 {
-		cmdio.LogString(ctx, deleteOrRecreateVolumeMessage)
-		for _, action := range volumeActions {
-			cmdio.Log(ctx, action)
-		}
-	}
-
-	// One or more dashboards is being recreated.
-	if len(dashboardActions) != 0 {
-		cmdio.LogString(ctx, deleteOrRecreateDashboardMessage)
-		for _, action := range dashboardActions {
-			cmdio.Log(ctx, action)
-		}
-	}
-
-	// One or more database instances is being deleted or recreated.
-	if len(databaseInstanceActions) != 0 {
-		cmdio.LogString(ctx, deleteOrRecreateDatabaseInstanceMessage)
-		for _, action := range databaseInstanceActions {
-			cmdio.Log(ctx, action)
-		}
-	}
-
-	// One or more synced database tables is being deleted or recreated.
-	if len(syncedDatabaseTableActions) != 0 {
-		cmdio.LogString(ctx, deleteOrRecreateSyncedDatabaseTableMessage)
-		for _, action := range syncedDatabaseTableActions {
-			cmdio.Log(ctx, action)
-		}
-	}
-
-	// One or more Lakebase projects is being deleted or recreated.
-	if len(postgresProjectActions) != 0 {
-		cmdio.LogString(ctx, deleteOrRecreatePostgresProjectMessage)
-		for _, action := range postgresProjectActions {
-			cmdio.Log(ctx, action)
-		}
-	}
-
-	// One or more Lakebase branches is being deleted or recreated.
-	if len(postgresBranchActions) != 0 {
-		cmdio.LogString(ctx, deleteOrRecreatePostgresBranchMessage)
-		for _, action := range postgresBranchActions {
-			cmdio.Log(ctx, action)
-		}
-	}
-
 	if b.AutoApprove {
 		return true, nil
 	}
 
 	if !cmdio.IsPromptSupported(ctx) {
-		return false, errors.New("the deployment requires destructive actions, but current console does not support prompting. Please specify --auto-approve if you would like to skip prompts and proceed")
+		return false, errors.New("the deployment requires destructive actions, but the current console does not support prompting.\n" +
+			DataLossWarning + "\n" +
+			"To proceed, use --auto-approve after reviewing the plan above." + agent.AgentNotice())
 	}
 
 	cmdio.LogString(ctx, "")
-	approved, err := cmdio.AskYesOrNo(ctx, "Would you like to proceed?")
-	if err != nil {
-		return false, err
-	}
-
-	return approved, nil
+	return cmdio.AskYesOrNo(ctx, "Would you like to proceed?")
 }
 
-func deployCore(ctx context.Context, b *bundle.Bundle, plan *deployplan.Plan, targetEngine engine.EngineType) {
-	// Core mutators that CRUD resources and modify deployment state. These
-	// mutators need informed consent if they are potentially destructive.
-	cmdio.LogString(ctx, "Deploying resources...")
-
-	if targetEngine.IsDirect() {
-		b.DeploymentBundle.Apply(ctx, b.WorkspaceClient(ctx), plan, direct.MigrateMode(false))
-		// Finalize state: write to disk even if deploy failed, so partial progress is saved.
-		// Skip for empty plans to avoid creating a state file when nothing was deployed.
-		if len(plan.Plan) > 0 {
-			if err := b.DeploymentBundle.StateDB.Finalize(); err != nil {
-				logdiag.LogError(ctx, err)
-			}
-		}
-	} else {
-		bundle.ApplyContext(ctx, b, terraform.Apply())
+func deployCore(ctx context.Context, b *bundle.Bundle, plan *deployplan.Plan) {
+	// Apply resources and capture post-apply state. Finalize flushes the WAL to disk and
+	// returns the state; called even if Apply failed so partial progress is saved.
+	b.DeploymentBundle.Apply(ctx, b.WorkspaceClient(ctx), plan, reportPerResource(b))
+	state, err := b.DeploymentBundle.StateDB.Finalize(ctx)
+	// Capture the finalized state for deploy telemetry. It carries each
+	// resource's state-size in bytes (from the WAL replay Finalize just
+	// did), so telemetry needs no extra read or parse of the state file.
+	b.Metrics.ResourceState = state
+	if err != nil {
+		logdiag.LogError(ctx, err)
 	}
 
 	// Even if deployment failed, there might be updates in states that we need to upload
-	statemgmt.PushResourcesState(ctx, b, targetEngine)
+	statemgmt.PushResourcesState(ctx, b)
 	if logdiag.HasError(ctx) {
 		return
 	}
 
-	bundle.ApplySeqContext(ctx, b,
-		statemgmt.Load(targetEngine),
+	bundle.ApplySeqContext(
+		ctx, b,
+		statemgmt.Load(state),
 		metadata.Compute(),
 		metadata.Upload(),
-		statemgmt.UploadStateForYamlSync(targetEngine),
 	)
+}
 
-	if !logdiag.HasError(ctx) {
-		cmdio.LogString(ctx, "Deployment complete!")
+// reportPerResource reports whether the deploy should list resources individually
+// (-q and -qq drop those lines).
+func reportPerResource(b *bundle.Bundle) bool {
+	return b.Quiet < bundle.QuietSummary
+}
+
+// logFileSummary reports what the file sync did. Separate from the resource summary
+// because a deploy that only changes business logic (a .py or .sql file) leaves every
+// resource unchanged, so without this line its summary is all zeros and looks like a
+// no-op. Called on the failure paths too: the files were uploaded before whatever
+// failed afterwards, so the count is accurate even then.
+func logFileSummary(ctx context.Context, b *bundle.Bundle) {
+	if b.Quiet >= bundle.QuietAll {
+		return
 	}
+	cmdio.LogString(ctx, fmt.Sprintf("Files: %d uploaded, %d deleted", b.FileCounts.Uploaded, b.FileCounts.Deleted))
+}
+
+// logDeploySummary prints the resource summary line. -qq drops it too. The direct engine
+// prints each per-resource applied line itself as it goes, so there are none to report here.
+func logDeploySummary(ctx context.Context, b *bundle.Bundle, plan *deployplan.Plan) {
+	if b.Quiet >= bundle.QuietAll {
+		return
+	}
+
+	logFileSummary(ctx, b)
+
+	counts := plan.CountActions()
+	summary := fmt.Sprintf("Resources: %d created, %d changed, %d deleted, %d unchanged", counts.Create, counts.Change, counts.Delete, counts.Unchanged)
+	// Gate on the plan's own NotSelected (not b.Select) so the suffix survives a
+	// deploy from a --plan file, where --select was applied at plan time and
+	// b.Select is empty here. NotSelected is only ever set by FilterToSelected.
+	if plan.NotSelected > 0 {
+		summary += fmt.Sprintf(", %d not selected", plan.NotSelected)
+	}
+	cmdio.LogString(ctx, summary)
 }
 
 // uploadLibraries uploads libraries to the workspace.
 // It also cleans up the artifacts directory and transforms wheel tasks.
 // It is called by only "bundle deploy".
 func uploadLibraries(ctx context.Context, b *bundle.Bundle, libs map[string][]libraries.LocationToUpdate) {
-	bundle.ApplySeqContext(ctx, b,
+	bundle.ApplySeqContext(
+		ctx, b,
 		artifacts.CleanUp(),
 		libraries.Upload(libs),
 	)
@@ -183,33 +153,76 @@ func uploadLibraries(ctx context.Context, b *bundle.Bundle, libs map[string][]li
 
 // The deploy phase deploys artifacts and resources.
 // If readPlanPath is provided, the plan is loaded from that file instead of being calculated.
-func Deploy(ctx context.Context, b *bundle.Bundle, outputHandler sync.OutputHandler, engine engine.EngineType, libs map[string][]libraries.LocationToUpdate, plan *deployplan.Plan) {
+func Deploy(ctx context.Context, b *bundle.Bundle, outputHandler sync.OutputHandler, libs map[string][]libraries.LocationToUpdate, plan *deployplan.Plan, dmsDeployment *bundledeployments.Deployment) {
 	log.Info(ctx, "Phase: deploy")
 
 	// Core mutators that CRUD resources and modify deployment state. These
-	// mutators need informed consent if they are potentially destructive.
-	bundle.ApplySeqContext(ctx, b,
-		scripts.Execute(config.ScriptPreDeploy),
-		lock.Acquire(),
-	)
-
+	// mutators need informed consent if they are potentially destructive. The
+	// predeploy script ran in ProcessBundleRet, ahead of this phase.
+	bundle.ApplyContext(ctx, b, lock.Acquire(lock.GoalDeploy))
 	if logdiag.HasError(ctx) {
 		// lock is not acquired here
 		return
 	}
 
 	// lock is acquired here
+	//
+	// The version is created only after approval; CompleteVersion is deferred before
+	// lock.Release and no-ops until then.
 	defer func() {
+		if b.DeploymentBundle.StateDB.IsDeploymentMetadataService() {
+			if _, err := b.DeploymentBundle.StateDB.CompleteVersion(ctx, !logdiag.HasError(ctx)); err != nil {
+				logdiag.LogError(ctx, err)
+			}
+		}
 		bundle.ApplyContext(ctx, b, lock.Release(lock.GoalDeploy))
 	}()
 
-	uploadLibraries(ctx, b, libs)
-	if logdiag.HasError(ctx) {
-		return
+	immutable := b.IsImmutableFolder()
+
+	if !immutable {
+		if plan != nil {
+			// Applying a saved plan: upload the local artifact files the plan was
+			// computed against. LocalLibraryPaths expands any library globs that
+			// haven't been processed yet and computes patched paths for
+			// dynamic_version wheels from the cache left by "bundle plan".
+			planLocalPaths, err := libraries.LocalLibraryPaths(ctx, b)
+			if err != nil {
+				logdiag.LogError(ctx, err)
+				return
+			}
+			planLibs := make(map[string][]libraries.LocationToUpdate, len(planLocalPaths))
+			for _, p := range planLocalPaths {
+				planLibs[p] = nil
+			}
+			uploadLibraries(ctx, b, planLibs)
+		} else {
+			uploadLibraries(ctx, b, libs)
+		}
+		if logdiag.HasError(ctx) {
+			return
+		}
+
+		bundle.ApplySeqContext(ctx, b, files.Upload(outputHandler))
+		if logdiag.HasError(ctx) {
+			return
+		}
 	}
 
-	bundle.ApplySeqContext(ctx, b,
-		files.Upload(outputHandler),
+	// From here on the files are uploaded, so report them however the rest of the
+	// deploy turns out. Deferred rather than repeated at each of the returns below, so
+	// that a new early return cannot silently drop it. On success logDeploySummary
+	// prints this line itself, between the per-resource lines and the resource summary,
+	// and sets the flag so the defer does not print it twice.
+	filesReported := false
+	defer func() {
+		if !filesReported {
+			logFileSummary(ctx, b)
+		}
+	}()
+
+	bundle.ApplySeqContext(
+		ctx, b,
 		deploy.StateUpdate(),
 		deploy.StatePush(),
 		permissions.ApplyWorkspaceRootPermissions(),
@@ -221,83 +234,149 @@ func Deploy(ctx context.Context, b *bundle.Bundle, outputHandler sync.OutputHand
 		return
 	}
 
-	if plan != nil {
-		// Initialize DeploymentBundle for applying the loaded plan
-		err := b.DeploymentBundle.InitForApply(ctx, b.WorkspaceClient(ctx), plan)
-		if err != nil {
-			logdiag.LogError(ctx, err)
+	if immutable {
+		// Only discard previously staged zips when building a fresh plan. When applying
+		// a pre-existing plan (plan != nil), its zip_path points at a file staged when
+		// the plan was produced, so leave the snapshots folder intact.
+		bundle.ApplyContext(ctx, b, snapshot.PlanUpload(snapshot.PlanUploadOptions{Clean: plan == nil}))
+		if logdiag.HasError(ctx) {
 			return
 		}
-	} else {
-		plan = RunPlan(ctx, b, engine)
 	}
 
+	planFromFile := plan != nil
+
+	if plan == nil {
+		// State is already open for read by process.go (or by Migrate)
+		plan = RunPlan(ctx, b)
+	}
+
+	// Stop before opening the WAL for write if planning failed. UpgradeToWrite
+	// writes a WAL header that only deployCore's Finalize commits or discards;
+	// returning past it without finalizing leaves a header-only WAL behind.
 	if logdiag.HasError(ctx) {
 		return
 	}
 
 	haveApproval, err := approvalForDeploy(ctx, b, plan)
-	if err != nil {
-		logdiag.LogError(ctx, err)
+	if !haveApproval {
+		// No version was created, so the deferred CompleteVersion is a no-op and the version
+		// number is left for the next deploy. Both the user declining and a console that
+		// cannot prompt land here.
+		//
+		// A prepared terraform→direct migration lives only in memory (Migrate wrote nothing
+		// durable and CommitMigration below never ran), so a declined deploy just drops it and
+		// leaves the terraform state on disk untouched - nothing changes, and the next deploy
+		// migrates again.
+		if b.MigratingToDirect {
+			log.Warnf(ctx, "Migration not committed, keeping Terraform state")
+		}
+		if err != nil {
+			logdiag.LogError(ctx, err)
+			return
+		}
+		cmdio.LogString(ctx, "Deployment cancelled!")
 		return
 	}
-	if haveApproval {
-		deployCore(ctx, b, plan, engine)
-	} else {
-		cmdio.LogString(ctx, "Deployment cancelled!")
+
+	// Approved. Commit a prepared terraform→direct migration now, before the deploy applies
+	// anything: this is the migration's point of no return - it pushes the converted state at
+	// serial tf+1 and retires the terraform state, so from here the bundle is on direct. The
+	// deploy below then advances the state to tf+2. Committing here rather than after the deploy
+	// keeps the model clean (once approved, we are on direct) at the cost of one window: a deploy
+	// that then fails has still migrated. A failed migration errored out before this point (the
+	// terraform engine is gone, so there is nothing to fall back to), so reaching here with
+	// MigratingToDirect set means the in-memory migration is ready to commit.
+	if b.MigratingToDirect {
+		statemgmt.CommitMigration(ctx, b)
+		if logdiag.HasError(ctx) {
+			return
+		}
+	}
+
+	// Upgrade from read (opened by process.go, or by Migrate) to write mode. After approval
+	// and the migration commit above, so a declined deploy never opens a WAL it must discard,
+	// and the migration's tf+1 push lands before this advances the WAL header to tf+2.
+	if err := b.DeploymentBundle.StateDB.UpgradeToWrite(); err != nil {
+		logdiag.LogError(ctx, err)
 		return
 	}
 
+	if planFromFile {
+		// Initialize DeploymentBundle for applying the loaded plan
+		err := b.DeploymentBundle.InitForApply(ctx, b.WorkspaceClient(ctx), plan)
+		if err != nil {
+			logdiag.LogError(ctx, err)
+			return
+		}
+	}
+
+	// InitForApply receives ctx and could log a diagnostic without returning an error, so
+	// re-check before deploying.
 	if logdiag.HasError(ctx) {
 		return
 	}
 
-	bundle.ApplyContext(ctx, b, scripts.Execute(config.ScriptPostDeploy))
-}
+	// Create the deployment now that the plan is approved, so a declined deploy leaves none behind.
+	// A first deploy's id did not exist at plan time - the version and any existing id were stamped
+	// then - so stamp the one just created into the plan the apply reads.
+	if b.DeploymentBundle.StateDB.IsDeploymentMetadataService() {
+		firstDeploy := b.DeploymentBundle.StateDB.DeploymentID == ""
+		createOrUpdateDeployment(ctx, b, dmsDeployment)
+		if logdiag.HasError(ctx) {
+			return
+		}
+		if firstDeploy {
+			if err := b.DeploymentBundle.StampDeploymentIdForFirstVersion(b.DeploymentBundle.StateDB.DeploymentID); err != nil {
+				logdiag.LogError(ctx, err)
+				return
+			}
+		}
 
-func RunPlan(ctx context.Context, b *bundle.Bundle, engine engine.EngineType) *deployplan.Plan {
-	if engine.IsDirect() {
-		plan, err := b.DeploymentBundle.CalculatePlan(ctx, b.WorkspaceClient(ctx), &b.Config)
+		// Only create a version when the plan has at least one operation to record, so it moves
+		// with serial. Done after the prompt, so a declined deploy never claims a number.
+		staged, err := stagedOperations(plan)
 		if err != nil {
 			logdiag.LogError(ctx, err)
-			return nil
+			return
+		}
+		if len(staged) > 0 {
+			if err := startVersion(ctx, b, dms.VersionTypeDeploy, staged); err != nil {
+				logdiag.LogError(ctx, err)
+				return
+			}
+			logDeploymentVersion(ctx, b)
 		}
-		return plan
 	}
 
-	bundle.ApplySeqContext(ctx, b,
-		terraform.Interpolate(),
-		terraform.Write(),
-		terraform.Plan(terraform.PlanGoal("deploy")),
-	)
+	deployCore(ctx, b, plan)
 
 	if logdiag.HasError(ctx) {
-		return nil
+		return
 	}
 
-	tf := b.Terraform
-	if tf == nil {
-		logdiag.LogError(ctx, errors.New("terraform not initialized"))
-		return nil
-	}
+	// Report what was deployed, mirroring "bundle plan". Printed before the
+	// postdeploy script so the deploy's own report is not interleaved with
+	// post-deploy output: the script's lines and the migration's below both follow
+	// it, and neither reads as belonging to the deploy. The resources were applied
+	// above, so the counts are accurate however the script turns out, and its error
+	// still propagates. Earlier failures report the files only, since the plan
+	// counts would then describe what was intended rather than what was applied.
+	filesReported = true
+	logDeploySummary(ctx, b, plan)
 
-	plan, err := terraform.ShowPlanFile(ctx, tf, b.TerraformPlanPath)
+	bundle.ApplyContext(ctx, b, scripts.Execute(config.ScriptPostDeploy))
+}
+
+func RunPlan(ctx context.Context, b *bundle.Bundle) *deployplan.Plan {
+	plan, err := b.DeploymentBundle.CalculatePlan(ctx, b.WorkspaceClient(ctx), &b.Config)
 	if err != nil {
 		logdiag.LogError(ctx, err)
 		return nil
 	}
-
-	for _, group := range b.Config.Resources.AllResources() {
-		for rKey := range group.Resources {
-			resourceKey := "resources." + group.Description.PluralName + "." + rKey
-			if _, ok := plan.Plan[resourceKey]; !ok {
-				plan.Plan[resourceKey] = &deployplan.PlanEntry{
-					Action: deployplan.Skip,
-				}
-			}
-		}
+	if len(b.Select) > 0 {
+		plan.FilterToSelected(b.Select)
 	}
-
 	return plan
 }
 
diff --git a/bundle/phases/destroy.go b/bundle/phases/destroy.go
index 4abc6140e45..07bbbbca385 100644
--- a/bundle/phases/destroy.go
+++ b/bundle/phases/destroy.go
@@ -3,17 +3,20 @@ package phases
 import (
 	"context"
 	"errors"
+	"fmt"
+	"io/fs"
 	"net/http"
+	"os"
+	"path/filepath"
+	"slices"
 
 	"github.com/databricks/cli/bundle"
-	"github.com/databricks/cli/bundle/config/engine"
-	"github.com/databricks/cli/bundle/config/mutator"
 	"github.com/databricks/cli/bundle/deploy/files"
 	"github.com/databricks/cli/bundle/deploy/lock"
-	"github.com/databricks/cli/bundle/deploy/terraform"
 	"github.com/databricks/cli/bundle/deployplan"
-	"github.com/databricks/cli/bundle/direct"
 	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/diag"
+	"github.com/databricks/cli/libs/dms"
 	"github.com/databricks/cli/libs/log"
 	"github.com/databricks/cli/libs/logdiag"
 	"github.com/databricks/databricks-sdk-go/apierr"
@@ -21,10 +24,9 @@ import (
 
 func assertRootPathExists(ctx context.Context, b *bundle.Bundle) (bool, error) {
 	w := b.WorkspaceClient(ctx)
-	_, err := w.Workspace.GetStatusByPath(ctx, b.Config.Workspace.RootPath) //nolint:staticcheck // Deprecated in SDK v0.127.0. Migration to WorkspaceHierarchyService tracked separately.
+	_, err := w.Workspace.GetStatusByPath(ctx, b.Config.Workspace.RootPath)
 
-	var aerr *apierr.APIError
-	if errors.As(err, &aerr) && aerr.StatusCode == http.StatusNotFound {
+	if aerr, ok := errors.AsType[*apierr.APIError](err); ok && aerr.StatusCode == http.StatusNotFound {
 		log.Infof(ctx, "Root path does not exist: %s", b.Config.Workspace.RootPath)
 		return false, nil
 	}
@@ -32,15 +34,79 @@ func assertRootPathExists(ctx context.Context, b *bundle.Bundle) (bool, error) {
 	return true, err
 }
 
+var destroyApprovalGroups = []approvalGroup{
+	{group: "schemas", message: deleteSchemaMessage},
+	// Pipelines are handled separately in approvalForDestroy so the message reflects each
+	// pipeline's cascade_on_destroy setting; see logPipelineDeleteApproval.
+	{group: "volumes", message: deleteVolumeMessage},
+	{group: "database_instances", message: deleteDatabaseInstanceMessage},
+	{group: "synced_database_tables", message: deleteSyncedDatabaseTableMessage},
+	{group: "postgres_projects", message: deletePostgresProjectMessage},
+	{group: "postgres_branches", message: deletePostgresBranchMessage},
+	{group: "postgres_databases", message: deletePostgresDatabaseMessage},
+	{group: "vector_search_indexes", message: deleteVectorSearchIndexMessage},
+	{group: "genie_spaces", message: deleteGenieSpaceMessage},
+}
+
+// logPipelineDeleteApproval prints the pipeline deletions. If cascade_on_destroy is true, we will include
+// a note that datasets will be deleted as well.
+func logPipelineDeleteApproval(ctx context.Context, b *bundle.Bundle, actions []deployplan.Action, quiet bool) error {
+	pipelineDeletes := filterGroup(actions, "pipelines", deployplan.Delete)
+
+	var cascading, retaining []deployplan.Action
+	for _, a := range pipelineDeletes {
+		cascade, err := pipelineDeletionCascades(b, a)
+		if err != nil {
+			return err
+		}
+		if cascade {
+			cascading = append(cascading, a)
+		} else {
+			retaining = append(retaining, a)
+		}
+	}
+
+	for _, grp := range []struct {
+		message string
+		actions []deployplan.Action
+	}{
+		{deletePipelineWithCascadeMessage, cascading},
+		{deletePipelineNoCascadeMessage, retaining},
+	} {
+		if len(grp.actions) == 0 || quiet {
+			continue
+		}
+		cmdio.LogString(ctx, grp.message)
+		for _, a := range grp.actions {
+			cmdio.Log(ctx, a)
+		}
+		cmdio.LogString(ctx, "")
+	}
+	return nil
+}
+
 func approvalForDestroy(ctx context.Context, b *bundle.Bundle, plan *deployplan.Plan) (bool, error) {
 	deleteActions := plan.GetActions()
 
+	// Deletes that only clean up the state (already gone remotely, or no delete
+	// operation) are not destructive, so they are not listed as deletions and need no
+	// approval. In particular this makes prevent_destroy inert for state-only
+	// resources: nothing is destroyed.
+	deleteActions = slices.DeleteFunc(deleteActions, func(a deployplan.Action) bool { return a.IsStateOnlyDelete() })
+
 	err := checkForPreventDestroy(b, deleteActions)
 	if err != nil {
 		return false, err
 	}
 
-	if len(deleteActions) > 0 {
+	// With --auto-approve there is no prompt, so this listing is informational and -qq
+	// suppresses it. Without --auto-approve we are about to ask for consent and the user
+	// must see what they are consenting to, so it prints at any -q level. The approval
+	// helpers below still run either way: they also validate (e.g. pipeline cascade
+	// lookups can fail), so skipping them would skip that.
+	quiet := b.AutoApprove && b.Quiet >= bundle.QuietAll
+
+	if len(deleteActions) > 0 && !quiet {
 		cmdio.LogString(ctx, "The following resources will be deleted:")
 		for _, a := range deleteActions {
 			if a.IsChildResource() {
@@ -51,112 +117,160 @@ func approvalForDestroy(ctx context.Context, b *bundle.Bundle, plan *deployplan.
 		cmdio.LogString(ctx, "")
 	}
 
-	schemaActions := filterGroup(deleteActions, "schemas", deployplan.Delete)
-	pipelineActions := filterGroup(deleteActions, "pipelines", deployplan.Delete)
-	volumeActions := filterGroup(deleteActions, "volumes", deployplan.Delete)
-	databaseInstanceActions := filterGroup(deleteActions, "database_instances", deployplan.Delete)
-	syncedDatabaseTableActions := filterGroup(deleteActions, "synced_database_tables", deployplan.Delete)
-	postgresProjectActions := filterGroup(deleteActions, "postgres_projects", deployplan.Delete)
-	postgresBranchActions := filterGroup(deleteActions, "postgres_branches", deployplan.Delete)
+	if !quiet {
+		logApprovalGroups(ctx, deleteActions, destroyApprovalGroups, true, deployplan.Delete)
+	}
+	// Called even when quiet: the cascade lookup can fail, and that error must surface.
+	if err := logPipelineDeleteApproval(ctx, b, deleteActions, quiet); err != nil {
+		return false, err
+	}
 
-	if len(schemaActions) > 0 {
-		cmdio.LogString(ctx, deleteSchemaMessage)
-		for _, a := range schemaActions {
-			cmdio.Log(ctx, a)
-		}
+	if !quiet {
+		cmdio.LogString(ctx, "All files and directories at the following location will be deleted: "+b.Config.Workspace.RootPath)
 		cmdio.LogString(ctx, "")
 	}
 
-	if len(pipelineActions) > 0 {
-		cmdio.LogString(ctx, deletePipelineMessage)
-		for _, a := range pipelineActions {
-			cmdio.Log(ctx, a)
-		}
-		cmdio.LogString(ctx, "")
+	if b.AutoApprove {
+		return true, nil
 	}
 
-	if len(volumeActions) > 0 {
-		cmdio.LogString(ctx, deleteVolumeMessage)
-		for _, a := range volumeActions {
-			cmdio.Log(ctx, a)
+	return cmdio.AskYesOrNo(ctx, "Would you like to proceed?")
+}
+
+func destroyCore(ctx context.Context, b *bundle.Bundle, plan *deployplan.Plan) {
+	// Not reported per resource: destroy names them up front for consent and then
+	// reports only a count, so there is no per-resource output to report into.
+	b.DeploymentBundle.Apply(ctx, b.WorkspaceClient(ctx), plan, false)
+
+	// Flush WAL to local state file before deleting remote files.
+	// Warn instead of hard-error: resources are already deleted, so proceed
+	// with file cleanup regardless of whether state flush succeeds.
+	if _, err := b.DeploymentBundle.StateDB.Finalize(ctx); err != nil {
+		diags := diag.WarningFromErr(err)
+		if len(diags) > 0 {
+			logdiag.LogDiag(ctx, diags[0])
 		}
-		cmdio.LogString(ctx, "")
 	}
 
-	if len(databaseInstanceActions) > 0 {
-		cmdio.LogString(ctx, deleteDatabaseInstanceMessage)
-		for _, a := range databaseInstanceActions {
-			cmdio.Log(ctx, a)
-		}
-		cmdio.LogString(ctx, "")
+	if logdiag.HasError(ctx) {
+		return
 	}
 
-	if len(syncedDatabaseTableActions) > 0 {
-		cmdio.LogString(ctx, deleteSyncedDatabaseTableMessage)
-		for _, a := range syncedDatabaseTableActions {
-			cmdio.Log(ctx, a)
+	if b.DeploymentBundle.StateDB.IsDeploymentMetadataService() {
+		// Complete version before deleting remote files; the deployment node is under statePath.
+		completed, err := b.DeploymentBundle.StateDB.CompleteVersion(ctx, true)
+		if err != nil {
+			logdiag.LogError(ctx, err)
+			return
+		}
+		// A completed destroy's resources are gone, so its deployment record is deleted too.
+		if completed {
+			deploymentID := b.DeploymentBundle.StateDB.DeploymentID
+			w := b.WorkspaceClient(ctx)
+			if err := deleteDeployment(ctx, w, deploymentID); err != nil {
+				logdiag.LogError(ctx, fmt.Errorf("failed to delete deployment: %w", err))
+				return
+			}
 		}
-		cmdio.LogString(ctx, "")
 	}
 
-	if len(postgresProjectActions) > 0 {
-		cmdio.LogString(ctx, deletePostgresProjectMessage)
-		for _, a := range postgresProjectActions {
-			cmdio.Log(ctx, a)
+	bundle.ApplyContext(ctx, b, files.Delete())
+
+	// Print the summary even on error: resources that were deleted are still worth
+	// reporting (an accurate partial count is a follow-up).
+	if b.Quiet < bundle.QuietAll {
+		// Count top-level resources only, matching the approval list above (which
+		// skips children); this also keeps the count stable across engines. Gone
+		// resources are excluded to match that list: they were already deleted
+		// remotely, so applying their Delete only cleans up stale state and is not
+		// a destruction to report.
+		deleted := 0
+		for _, a := range plan.GetActions() {
+			if a.ActionType == deployplan.Delete && !a.IsChildResource() && !a.IsStateOnlyDelete() {
+				deleted++
+			}
 		}
-		cmdio.LogString(ctx, "")
+		cmdio.LogString(ctx, fmt.Sprintf("Destroy: %d deleted", deleted))
 	}
 
-	if len(postgresBranchActions) > 0 {
-		cmdio.LogString(ctx, deletePostgresBranchMessage)
-		for _, a := range postgresBranchActions {
-			cmdio.Log(ctx, a)
-		}
-		cmdio.LogString(ctx, "")
+	if logdiag.HasError(ctx) {
+		return
 	}
 
-	cmdio.LogString(ctx, "All files and directories at the following location will be deleted: "+b.Config.Workspace.RootPath)
-	cmdio.LogString(ctx, "")
+	// The deployment is gone, so remove all local state for this target: both engines' state files
+	// and any terraform.tfstate.backup left by a committed migration. A destroy tears everything
+	// down, so nothing here is worth keeping - in particular a coexisting terraform.tfstate is
+	// always superseded (a direct state only wins engine resolution by a higher serial, i.e. it is
+	// the newer, migrated-from version), so a later deploy has no reason to resurrect it. Remove the
+	// terraform state (and its backup) before the direct state so a crash between them never leaves a
+	// live terraform.tfstate with no direct state that the next deploy would pick up. Leaving any
+	// local state behind would also let a later fresh deploy (e.g. from another machine with no local
+	// state) mint a mismatched lineage. Log a removal failure but keep going; the destroy already
+	// succeeded and its summary is printed above.
+	_, localTerraformPath := b.StateFilenameTerraform(ctx)
+	_, localDirectPath := b.StateFilenameDirect(ctx)
+	for _, path := range []string{localTerraformPath, localTerraformPath + ".backup", localDirectPath} {
+		if err := os.Remove(path); err != nil && !errors.Is(err, fs.ErrNotExist) {
+			logdiag.LogError(ctx, err)
+		}
+	}
 
-	if b.AutoApprove {
-		return true, nil
+	// Destroy leaves empty scaffolding directories behind once their contents are
+	// gone (e.g. .internal/ and sync-snapshots/ after the state and sync files are
+	// removed), so prune them rather than littering empty directories. Pruning stays
+	// within the target's state dir, so a sibling engine's state (terraform/) or
+	// another target is untouched. Cosmetic cleanup: a failure here does not fail the
+	// destroy.
+	stateDir := b.GetLocalStateDir(ctx)
+	if _, err := removeEmptyDirs(stateDir, 0); err != nil && !errors.Is(err, fs.ErrNotExist) {
+		log.Debugf(ctx, "cannot prune empty state directories under %s: %v", stateDir, err)
 	}
+}
 
-	approved, err := cmdio.AskYesOrNo(ctx, "Would you like to proceed?")
+// maxStateDirDepth caps removeEmptyDirs recursion. The local state tree is only a
+// few levels deep (bundle/<target>/{.internal,sync-snapshots,terraform}); the cap is
+// a defensive guard against a pathologically deep tree, not a limit ever hit in
+// practice.
+const maxStateDirDepth = 100
+
+// removeEmptyDirs removes every empty directory in the subtree rooted at dir,
+// bottom-up, and reports whether dir itself was removed. Symlinked entries count as
+// content and are never traversed, so a symlinked provider mirror is left intact.
+// depth is the caller's recursion depth; recursion stops with an error once it passes
+// maxStateDirDepth.
+func removeEmptyDirs(dir string, depth int) (bool, error) {
+	if depth > maxStateDirDepth {
+		return false, fmt.Errorf("state directory nesting exceeds %d levels at %s", maxStateDirDepth, dir)
+	}
+	entries, err := os.ReadDir(dir)
 	if err != nil {
 		return false, err
 	}
-
-	return approved, nil
-}
-
-func destroyCore(ctx context.Context, b *bundle.Bundle, plan *deployplan.Plan, engine engine.EngineType) {
-	if engine.IsDirect() {
-		b.DeploymentBundle.Apply(ctx, b.WorkspaceClient(ctx), plan, direct.MigrateMode(false))
-		// Skip Finalize for empty plans to avoid creating a state file when nothing was destroyed.
-		if len(plan.Plan) > 0 {
-			if err := b.DeploymentBundle.StateDB.Finalize(); err != nil {
-				logdiag.LogError(ctx, err)
-			}
+	empty := true
+	for _, entry := range entries {
+		if !entry.IsDir() {
+			empty = false
+			continue
+		}
+		removed, err := removeEmptyDirs(filepath.Join(dir, entry.Name()), depth+1)
+		if err != nil {
+			return false, err
+		}
+		if !removed {
+			empty = false
 		}
-	} else {
-		// Core destructive mutators for destroy. These require informed user consent.
-		bundle.ApplyContext(ctx, b, terraform.Apply())
 	}
-
-	if logdiag.HasError(ctx) {
-		return
+	if !empty {
+		return false, nil
 	}
-
-	bundle.ApplyContext(ctx, b, files.Delete())
-
-	if !logdiag.HasError(ctx) {
-		cmdio.LogString(ctx, "Destroy complete!")
+	if err := os.Remove(dir); err != nil {
+		return false, err
 	}
+	return true, nil
 }
 
 // The destroy phase deletes artifacts and resources.
-func Destroy(ctx context.Context, b *bundle.Bundle, engine engine.EngineType) {
+func Destroy(ctx context.Context, b *bundle.Bundle) {
 	log.Info(ctx, "Phase: destroy")
 
 	ok, err := assertRootPathExists(ctx, b)
@@ -166,67 +280,99 @@ func Destroy(ctx context.Context, b *bundle.Bundle, engine engine.EngineType) {
 	}
 
 	if !ok {
-		cmdio.LogString(ctx, "No active deployment found to destroy!")
+		cmdio.LogProgress(ctx, "No active deployment found to destroy!")
 		return
 	}
 
-	bundle.ApplyContext(ctx, b, lock.Acquire())
+	bundle.ApplyContext(ctx, b, lock.Acquire(lock.GoalDestroy))
 	if logdiag.HasError(ctx) {
 		return
 	}
 
+	// DMS recording of this destroy: the version is created after approval, so a cancelled
+	// destroy records nothing. Deferred before lock.Release to hold the lock; a no-op once
+	// destroyCore has completed the version.
 	defer func() {
+		if b.DeploymentBundle.StateDB.IsDeploymentMetadataService() {
+			completed, err := b.DeploymentBundle.StateDB.CompleteVersion(ctx, !logdiag.HasError(ctx))
+			if err != nil {
+				logdiag.LogError(ctx, err)
+			} else if completed {
+				deploymentID := b.DeploymentBundle.StateDB.DeploymentID
+				w := b.WorkspaceClient(ctx)
+				if err := deleteDeployment(ctx, w, deploymentID); err != nil {
+					logdiag.LogError(ctx, fmt.Errorf("failed to delete deployment: %w", err))
+				}
+			}
+		}
 		bundle.ApplyContext(ctx, b, lock.Release(lock.GoalDestroy))
 	}()
 
-	if !engine.IsDirect() {
-		bundle.ApplySeqContext(ctx, b,
-			// We need to resolve artifact variable (how we do it in build phase)
-			// because some of the to-be-destroyed resource might use this variable.
-			// Not resolving might lead to terraform "Reference to undeclared resource" error
-			mutator.ResolveVariableReferencesWithoutResources("artifacts"),
-			mutator.ResolveVariableReferencesOnlyResources("artifacts"),
-
-			terraform.Interpolate(),
-			terraform.Write(),
-			terraform.Plan(terraform.PlanGoal("destroy")),
-		)
+	plan, err := b.DeploymentBundle.CalculatePlan(ctx, b.WorkspaceClient(ctx), nil)
+	if err != nil {
+		logdiag.LogError(ctx, err)
+		return
 	}
 
-	if logdiag.HasError(ctx) {
+	hasApproval, err := approvalForDestroy(ctx, b, plan)
+	if err != nil {
+		logdiag.LogError(ctx, err)
 		return
 	}
 
-	var plan *deployplan.Plan
-	if engine.IsDirect() {
-		plan, err = b.DeploymentBundle.CalculatePlan(ctx, b.WorkspaceClient(ctx), nil)
-		if err != nil {
-			logdiag.LogError(ctx, err)
-			return
-		}
-	} else {
-		tf := b.Terraform
-		if tf == nil {
-			logdiag.LogError(ctx, errors.New("terraform not initialized"))
-			return
+	if hasApproval {
+		// Approved. A destroy that migrated from terraform runs on the in-memory migrated (direct)
+		// state, destroyCore removes the local state files (both engines'), and files.Delete
+		// removes the remote one. There is no separate remote push as in deploy's CommitMigration
+		// - the resources are about to be deleted - and a destroy-only migration is not adoption
+		// worth recording.
+		migrating := b.MigratingToDirect
+		if migrating {
+			count := len(b.DeploymentBundle.StateDB.ExportState(ctx))
+			suffix := "s"
+			if count == 1 {
+				suffix = ""
+			}
+			cmdio.LogString(ctx, fmt.Sprintf("Migrated %d resource%s to direct deployment engine.", count, suffix))
+
+			// Persist the migrated base before UpgradeToWrite opens the WAL, mirroring deploy's
+			// CommitMigration. Otherwise a destroy interrupted between UpgradeToWrite and Finalize
+			// leaves an orphan WAL with no state file: the next run re-migrates (in memory) and
+			// trips UpgradeToWrite's O_EXCL on that WAL. With the base on disk the next run instead
+			// resolves to this committed direct state and its file-backed Open recovers the WAL.
+			if err := b.DeploymentBundle.StateDB.Persist(); err != nil {
+				logdiag.LogError(ctx, fmt.Errorf("persisting migrated direct state: %w", err))
+				return
+			}
 		}
 
-		plan, err = terraform.ShowPlanFile(ctx, tf, b.TerraformPlanPath)
-		if err != nil {
+		// Upgrade from read (opened by process.go, or by Migrate) to write mode
+		if err := b.DeploymentBundle.StateDB.UpgradeToWrite(); err != nil {
 			logdiag.LogError(ctx, err)
 			return
 		}
-	}
-
-	hasApproval, err := approvalForDestroy(ctx, b, plan)
-	if err != nil {
-		logdiag.LogError(ctx, err)
-		return
-	}
 
-	if hasApproval {
-		destroyCore(ctx, b, plan, engine)
+		// Start the version for this destroy, now that it is approved. Everything else recording
+		// does follows from the buffer this opens.
+		if b.DeploymentBundle.StateDB.IsDeploymentMetadataService() {
+			staged, err := stagedOperations(plan)
+			if err != nil {
+				logdiag.LogError(ctx, err)
+				return
+			}
+			if err := startVersion(ctx, b, dms.VersionTypeDestroy, staged); err != nil {
+				logdiag.LogError(ctx, err)
+				return
+			}
+		}
+		destroyCore(ctx, b, plan)
 	} else {
+		// A prepared terraform→direct migration lives only in memory (nothing durable was
+		// written), so a declined destroy just drops it and leaves the terraform state on
+		// disk untouched - nothing changes, and the next destroy migrates again.
+		if b.MigratingToDirect {
+			log.Warnf(ctx, "Migration not committed, keeping Terraform state")
+		}
 		cmdio.LogString(ctx, "Destroy cancelled!")
 	}
 }
diff --git a/bundle/phases/destroy_test.go b/bundle/phases/destroy_test.go
new file mode 100644
index 00000000000..c3294e5d878
--- /dev/null
+++ b/bundle/phases/destroy_test.go
@@ -0,0 +1,67 @@
+package phases
+
+import (
+	"bytes"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/deployplan"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// -qq hides the listing of resources about to be deleted only because --auto-approve
+// makes it informational. Without --auto-approve the user is about to consent to the
+// deletion and must see it, at any -q level. Prompting requires a TTY, which acceptance
+// tests do not have (destroy errors out before this point), so it is covered here; the
+// --auto-approve levels are covered by acceptance/bundle/deploy/quiet-levels.
+func TestApprovalForDestroyQuietWhilePrompting(t *testing.T) {
+	plan := &deployplan.Plan{
+		Plan: map[string]*deployplan.PlanEntry{
+			"resources.jobs.my_job": {ID: "1", Action: deployplan.Delete},
+		},
+	}
+
+	stderr := &bytes.Buffer{}
+	// "y" answers the prompt; cmdio panics reading from a nil stdin.
+	ctx := cmdio.InContext(t.Context(),
+		cmdio.NewIO(t.Context(), flags.OutputText, strings.NewReader("y\n"), io.Discard, stderr, "", ""))
+
+	b := &bundle.Bundle{Quiet: bundle.QuietAll}
+	b.Config.Workspace.RootPath = "/Workspace/Users/me/.bundle/x"
+
+	approved, err := approvalForDestroy(ctx, b, plan)
+	require.NoError(t, err)
+	assert.True(t, approved)
+
+	assert.Contains(t, stderr.String(), "The following resources will be deleted:")
+	assert.Contains(t, stderr.String(), "resources.jobs.my_job")
+	assert.Contains(t, stderr.String(), b.Config.Workspace.RootPath)
+}
+
+func TestRemoveEmptyDirs(t *testing.T) {
+	root := t.TempDir()
+	// empty/nested/ is pruned bottom-up; keep/ holds a file, so it and root survive.
+	require.NoError(t, os.MkdirAll(filepath.Join(root, "empty", "nested"), 0o700))
+	require.NoError(t, os.MkdirAll(filepath.Join(root, "keep"), 0o700))
+	require.NoError(t, os.WriteFile(filepath.Join(root, "keep", "state.json"), nil, 0o600))
+
+	removed, err := removeEmptyDirs(root, 0)
+	require.NoError(t, err)
+	assert.False(t, removed)
+
+	assert.NoDirExists(t, filepath.Join(root, "empty"))
+	assert.FileExists(t, filepath.Join(root, "keep", "state.json"))
+}
+
+func TestRemoveEmptyDirsDepthLimit(t *testing.T) {
+	// Entering past the cap trips the guard without building a pathological tree.
+	_, err := removeEmptyDirs(t.TempDir(), maxStateDirDepth+1)
+	assert.ErrorContains(t, err, "nesting exceeds")
+}
diff --git a/bundle/phases/dms.go b/bundle/phases/dms.go
new file mode 100644
index 00000000000..a2399c9e3a1
--- /dev/null
+++ b/bundle/phases/dms.go
@@ -0,0 +1,256 @@
+package phases
+
+import (
+	"context"
+	"fmt"
+	"net/url"
+	"path"
+	"strconv"
+	"strings"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/cli/bundle/deployplan"
+	"github.com/databricks/cli/internal/build"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/dms"
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/logdiag"
+	"github.com/databricks/cli/libs/retry"
+	"github.com/databricks/cli/libs/workspaceurls"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/common/types/fieldmask"
+	"github.com/databricks/databricks-sdk-go/service/bundledeployments"
+)
+
+// stagedOperations lists the resources the plan will touch, for CreateVersion to stage an
+// operation each. Skipped and undefined actions are left out: nothing is applied for them, so
+// their operations would stay pending and the service would hold no state for them.
+func stagedOperations(plan *deployplan.Plan) ([]bundledeployments.StagedOperation, error) {
+	actions := plan.GetActions()
+	staged := make([]bundledeployments.StagedOperation, 0, len(actions))
+	for _, action := range actions {
+		if action.ActionType == deployplan.Skip || action.ActionType == deployplan.Undefined {
+			continue
+		}
+		actionType, err := actionToSDK(action.ActionType)
+		if err != nil {
+			return nil, fmt.Errorf("%s: %w", action.ResourceKey, err)
+		}
+		staged = append(staged, bundledeployments.StagedOperation{
+			ResourceKey: strings.TrimPrefix(action.ResourceKey, dms.StatePrefix),
+			ActionType:  actionType,
+		})
+	}
+	return staged, nil
+}
+
+// actionToSDK maps a deployplan action to the DMS action type a staged operation records.
+// Only actions that mutate a resource are recordable; Skip and Undefined are rejected
+// rather than silently coerced.
+func actionToSDK(a deployplan.ActionType) (bundledeployments.OperationActionType, error) {
+	switch a {
+	case deployplan.Create:
+		return bundledeployments.OperationActionTypeOperationActionTypeCreate, nil
+	case deployplan.Update:
+		return bundledeployments.OperationActionTypeOperationActionTypeUpdate, nil
+	case deployplan.UpdateWithID:
+		return bundledeployments.OperationActionTypeOperationActionTypeUpdateWithId, nil
+	case deployplan.Recreate:
+		return bundledeployments.OperationActionTypeOperationActionTypeRecreate, nil
+	case deployplan.Resize:
+		return bundledeployments.OperationActionTypeOperationActionTypeResize, nil
+	case deployplan.Delete:
+		return bundledeployments.OperationActionTypeOperationActionTypeDelete, nil
+	default:
+		return "", fmt.Errorf("cannot record operation: unsupported action %q", a)
+	}
+}
+
+// createOrUpdateDeployment creates the deployment on a first deploy, or updates the metadata this
+// run changed. current is the record the service holds (nil before the first recorded deploy),
+// diffed to mask the update down to what changed. Runs after approval, so a declined deploy leaves
+// no deployment behind; a first deploy's new id is then stamped into the plan (StampDeploymentID).
+func createOrUpdateDeployment(ctx context.Context, b *bundle.Bundle, current *bundledeployments.Deployment) {
+	db := &b.DeploymentBundle
+	w := b.WorkspaceClient(ctx)
+	metadata, err := deploymentMetadata(b)
+	if err != nil {
+		logdiag.LogError(ctx, fmt.Errorf("failed to compute deployment metadata: %w", err))
+		return
+	}
+	deploymentID := db.StateDB.DeploymentID
+	if deploymentID == "" {
+		dep := metadata.Deployment()
+		dep.InitialParentPath = b.Config.Workspace.StatePath
+		created, err := w.BundleDeployments.CreateDeployment(ctx, bundledeployments.CreateDeploymentRequest{Deployment: dep})
+		if err != nil {
+			logdiag.LogError(ctx, fmt.Errorf("failed to create deployment: %w", err))
+			return
+		}
+		// The id is the workspace node the server makes under the parent path.
+		deploymentID, err = dms.DeploymentIDFromName(created.Name)
+		if err != nil {
+			logdiag.LogError(ctx, fmt.Errorf("failed to create deployment: %w", err))
+			return
+		}
+		db.StateDB.DeploymentID = deploymentID
+	} else if mask := metadata.StaleFields(current); mask != "" {
+		_, err := retry.With(ctx, retry.IsTransient, func() (*bundledeployments.Deployment, error) {
+			return w.BundleDeployments.UpdateDeployment(ctx, bundledeployments.UpdateDeploymentRequest{
+				Name:       dms.DeploymentName(deploymentID),
+				Deployment: dms.DeploymentUpdate(metadata, mask),
+				UpdateMask: fieldmask.FieldMask{Paths: strings.Split(mask, ",")},
+			})
+		})
+		if err != nil {
+			logdiag.LogError(ctx, fmt.Errorf("failed to update deployment: %w", err))
+			return
+		}
+	}
+
+	// A first deploy had no deployment to read at startup, so its id enters the history here.
+	bundle.ApplyFuncContext(ctx, b, func(_ context.Context, b *bundle.Bundle) {
+		b.Config.Bundle.Deployment.DeploymentID = deploymentID
+	})
+}
+
+// deleteDeployment deletes the deployment record. A retry that finds it missing succeeds: the
+// earlier attempt may have deleted it before its response was lost.
+func deleteDeployment(ctx context.Context, w *databricks.WorkspaceClient, deploymentID string) error {
+	retried := false
+	_, err := retry.With(ctx, retry.IsTransient, func() (struct{}, error) {
+		err := w.BundleDeployments.DeleteDeployment(ctx, bundledeployments.DeleteDeploymentRequest{Name: dms.DeploymentName(deploymentID)})
+		if retried && apierr.IsMissing(err) {
+			return struct{}{}, nil
+		}
+		retried = true
+		return struct{}{}, err
+	})
+	return err
+}
+
+// startVersion claims the version the run settled on and opens the buffer that records
+// each state write under it. Called after approval, so a declined deploy never claims a number.
+// A no-op when the bundle does not record deployment history.
+func startVersion(ctx context.Context, b *bundle.Bundle, versionType dms.VersionType, staged []bundledeployments.StagedOperation) error {
+	db := &b.DeploymentBundle
+	if !db.StateDB.IsDeploymentMetadataService() {
+		return nil
+	}
+	w := b.WorkspaceClient(ctx)
+	deploymentID := db.StateDB.DeploymentID
+	// This run's version follows the one the state is anchored to, which is empty for the first.
+	// InitializeOperationBuffer moves the anchor below, so callers afterwards read the created
+	// version straight off the state.
+	previous := db.StateDB.VersionID
+	versionID := previous + 1
+	previousVersionID := ""
+	if previous > 0 {
+		previousVersionID = strconv.Itoa(previous)
+	}
+
+	// The server rejects this unless the version number exceeds last_version_id and
+	// previous_version_id matches it, which is what makes claiming the number up front
+	// safe: a deploy that took it in the meantime is reported, not overwritten.
+	var gitInfo *bundledeployments.GitInfo
+	if git := b.Config.Bundle.Git; git.Branch != "" || git.Commit != "" || git.OriginURL != "" {
+		gitInfo = &bundledeployments.GitInfo{
+			Branch:    git.Branch,
+			Commit:    git.Commit,
+			OriginUrl: git.OriginURL,
+		}
+	}
+	version, err := w.BundleDeployments.CreateVersion(ctx, bundledeployments.CreateVersionRequest{
+		Parent:    dms.DeploymentName(deploymentID),
+		VersionId: strconv.Itoa(versionID),
+		Version: bundledeployments.Version{
+			CliVersion:        build.GetInfo().Version,
+			VersionType:       versionType,
+			PreviousVersionId: previousVersionID,
+			GitInfo:           gitInfo,
+			Operations:        staged,
+		},
+	})
+	if err != nil {
+		return fmt.Errorf("failed to create deployment version: %w", err)
+	}
+	log.Infof(ctx, "Created deployment version: deployment=%s version=%s", deploymentID, version.VersionId)
+
+	db.StateDB.InitializeOperationBuffer(ctx, deploymentID, versionID)
+	return nil
+}
+
+// logDeploymentVersion logs the deployment version URL. Workspace ID is omitted
+// so the page stays clickable in a terminal and redirects correctly without it.
+func logDeploymentVersion(ctx context.Context, b *bundle.Bundle) {
+	deploymentID := b.DeploymentBundle.StateDB.DeploymentID
+	version := b.DeploymentBundle.StateDB.VersionID
+	if version == 0 {
+		return
+	}
+
+	baseURL, err := url.Parse(b.WorkspaceClient(ctx).Config.CanonicalHostName())
+	if err != nil {
+		// Only the link is lost, so report the version without it rather than failing
+		// a deploy over it.
+		log.Debugf(ctx, "Not linking to the recorded deployment: %s", err)
+		cmdio.LogString(ctx, fmt.Sprintf("Current Deployment Version: %s version %d", deploymentID, version))
+		return
+	}
+
+	cmdio.LogString(ctx, "Current Deployment Version: "+workspaceurls.DeploymentURL(*baseURL, deploymentID, version))
+}
+
+// deploymentMetadata describes the bundle this deploy came from and where it
+// landed, mirroring what bundle/deploy/metadata computes for the metadata file.
+func deploymentMetadata(b *bundle.Bundle) (dms.Metadata, error) {
+	p := dms.Metadata{
+		DisplayName: b.Config.Bundle.Name,
+		TargetName:  b.Config.Bundle.Target,
+		Mode:        deploymentModeToSDK(b.Config.Bundle.Mode),
+	}
+
+	ws := &bundledeployments.WorkspaceInfo{
+		RootPath: b.Config.Workspace.RootPath,
+		FilePath: b.Config.Workspace.FilePath,
+	}
+	// With an immutable folder, file_path is a reference to the snapshot, which only
+	// resolves once the snapshot is uploaded. Its path is already known from the staged zip.
+	if b.IsImmutableFolder() {
+		snapshot, ok := b.Config.Resources.Snapshots[resources.SnapshotResourceKey]
+		if !ok {
+			return dms.Metadata{}, fmt.Errorf("no %s in the bundle", resources.SnapshotKey)
+		}
+		ws.FilePath = path.Join(snapshot.FullPath(), "files")
+	}
+	// In a source-linked deployment files are not copied, so resources read them
+	// from the sync root instead of file_path (see bundle/deploy/metadata.Compute).
+	if config.IsExplicitlyEnabled(b.Config.Presets.SourceLinkedDeployment) {
+		ws.FilePath = b.SyncRootPath
+		ws.SourceLinked = true
+	}
+	// Only a deploy from a Databricks Git folder has one; a local worktree does not.
+	// bundle_root_path is relative to it, so the service requires both or neither.
+	if b.WorktreeRoot != nil && strings.HasPrefix(b.WorktreeRoot.Native(), "/Workspace/") {
+		ws.GitFolderPath = b.WorktreeRoot.Native()
+		ws.BundleRootPath = b.Config.Bundle.Git.BundleRootPath
+	}
+	p.Workspace = ws
+	return p, nil
+}
+
+// deploymentModeToSDK maps the bundle target's mode to the DMS enum. An unset mode
+// maps to empty, which the service reads as "not reported".
+func deploymentModeToSDK(mode config.Mode) bundledeployments.DeploymentMode {
+	switch mode {
+	case config.Development:
+		return bundledeployments.DeploymentModeDeploymentModeDevelopment
+	case config.Production:
+		return bundledeployments.DeploymentModeDeploymentModeProduction
+	default:
+		return ""
+	}
+}
diff --git a/bundle/phases/dms_test.go b/bundle/phases/dms_test.go
new file mode 100644
index 00000000000..6b045f863ae
--- /dev/null
+++ b/bundle/phases/dms_test.go
@@ -0,0 +1,80 @@
+package phases
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/bundle/deployplan"
+	"github.com/databricks/databricks-sdk-go/service/bundledeployments"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestStagedOperationsCoversEveryTouchedResource(t *testing.T) {
+	// The version fixes its operation set, so anything the apply will write has to appear
+	// here. Keys go out in the service's form, without the CLI's "resources." prefix.
+	plan := &deployplan.Plan{Plan: map[string]*deployplan.PlanEntry{
+		"resources.jobs.foo":       {Action: deployplan.Create},
+		"resources.pipelines.bar":  {Action: deployplan.Recreate},
+		"resources.schemas.baz":    {Action: deployplan.Delete},
+		"resources.clusters.small": {Action: deployplan.Resize},
+	}}
+
+	staged, err := stagedOperations(plan)
+	require.NoError(t, err)
+
+	assert.ElementsMatch(t, []bundledeployments.StagedOperation{
+		{ResourceKey: "jobs.foo", ActionType: bundledeployments.OperationActionTypeOperationActionTypeCreate},
+		{ResourceKey: "pipelines.bar", ActionType: bundledeployments.OperationActionTypeOperationActionTypeRecreate},
+		{ResourceKey: "schemas.baz", ActionType: bundledeployments.OperationActionTypeOperationActionTypeDelete},
+		{ResourceKey: "clusters.small", ActionType: bundledeployments.OperationActionTypeOperationActionTypeResize},
+	}, staged)
+}
+
+func TestStagedOperationsLeavesOutUntouchedResources(t *testing.T) {
+	// A skipped resource is never applied, so staging it would leave an operation pending for
+	// the life of the version. Undefined is not a real action either.
+	plan := &deployplan.Plan{Plan: map[string]*deployplan.PlanEntry{
+		"resources.jobs.touched":   {Action: deployplan.Update},
+		"resources.jobs.unchanged": {Action: deployplan.Skip},
+		"resources.jobs.unknown":   {Action: deployplan.Undefined},
+	}}
+
+	staged, err := stagedOperations(plan)
+	require.NoError(t, err)
+
+	assert.Equal(t, []bundledeployments.StagedOperation{
+		{ResourceKey: "jobs.touched", ActionType: bundledeployments.OperationActionTypeOperationActionTypeUpdate},
+	}, staged)
+}
+
+func TestStagedOperationsEmptyPlan(t *testing.T) {
+	staged, err := stagedOperations(&deployplan.Plan{Plan: map[string]*deployplan.PlanEntry{}})
+	require.NoError(t, err)
+	assert.Empty(t, staged)
+}
+
+func TestActionToSDK(t *testing.T) {
+	cases := []struct {
+		action deployplan.ActionType
+		want   bundledeployments.OperationActionType
+	}{
+		{deployplan.Create, bundledeployments.OperationActionTypeOperationActionTypeCreate},
+		{deployplan.Update, bundledeployments.OperationActionTypeOperationActionTypeUpdate},
+		{deployplan.UpdateWithID, bundledeployments.OperationActionTypeOperationActionTypeUpdateWithId},
+		{deployplan.Recreate, bundledeployments.OperationActionTypeOperationActionTypeRecreate},
+		{deployplan.Resize, bundledeployments.OperationActionTypeOperationActionTypeResize},
+		{deployplan.Delete, bundledeployments.OperationActionTypeOperationActionTypeDelete},
+	}
+	for _, c := range cases {
+		got, err := actionToSDK(c.action)
+		require.NoError(t, err)
+		assert.Equal(t, c.want, got)
+	}
+
+	// Nothing is applied for these, so stagedOperations leaves them out rather than
+	// mapping them; the guard is here in case a new action type arrives without a mapping.
+	_, err := actionToSDK(deployplan.Skip)
+	assert.Error(t, err)
+	_, err = actionToSDK(deployplan.Undefined)
+	assert.Error(t, err)
+}
diff --git a/bundle/phases/initialize.go b/bundle/phases/initialize.go
index 25bb2f4bd1b..902a277b018 100644
--- a/bundle/phases/initialize.go
+++ b/bundle/phases/initialize.go
@@ -26,6 +26,10 @@ func Initialize(ctx context.Context, b *bundle.Bundle) {
 	log.Info(ctx, "Phase: initialize")
 
 	bundle.ApplySeqContext(ctx, b,
+		// Reads (dynamic): resources.internal_immutable_snapshots (and other internal keys)
+		// Warns and removes any internal resource fields set by the user.
+		mutator.RejectInternalResources(),
+
 		// Reads (dynamic): resource.*.*
 		// Checks that none of resources.<type>.<key> is nil. Raises error otherwise.
 		validate.AllResourcesHaveValues(),
@@ -33,6 +37,7 @@ func Initialize(ctx context.Context, b *bundle.Bundle) {
 		validate.NoInterpolationInBundleName(),
 		validate.ValidateEngine(),
 		validate.Scripts(),
+		mutator.ValidateSecretValueIsVariable(),
 
 		// Updates (dynamic): sync.{paths,include,exclude} (makes them relative to bundle root rather than to definition file)
 		// Rewrites sync paths to be relative to the bundle root instead of the file they were defined in.
@@ -70,6 +75,12 @@ func Initialize(ctx context.Context, b *bundle.Bundle) {
 		// because it affects how workspace variables are resolved.
 		mutator.ApplySourceLinkedDeploymentPreset(),
 
+		// Reads (env): __TEST_DATABRICKS_IMMUTABLE_FOLDER (non-empty value enables immutable folder mode)
+		// Updates (typed): b.Config.Experimental.ImmutableFolder (forces to true when env var is set)
+		// Allows running the full test suite against the immutable folder code path without
+		// modifying any databricks.yml files.
+		mutator.OverrideImmutableFolder(),
+
 		// Reads (typed): b.Config.Workspace.RootPath (checks if it's already set)
 		// Reads (typed): b.Config.Bundle.Name, b.Config.Bundle.Target (used to construct default path)
 		// Updates (typed): b.Config.Workspace.RootPath (sets to ~/.bundle/{name}/{target} if not set)
@@ -142,6 +153,34 @@ func Initialize(ctx context.Context, b *bundle.Bundle) {
 		// After PythonMutator, mutators must not change bundle resources, or such changes are not
 		// going to be visible in Python code.
 
+		// Warn when the deprecated pipeline-level development property is set by the user.
+		// Must run after PythonMutator to see development values set by Python mutators.
+		validate.PipelineDevelopmentDeprecated(),
+
+		// Compute resources.volumes.*.volume_path and resolve references to it. Must run after
+		// PythonMutator: volume_path is computed and read-only, not declared by the PyDABs Volume
+		// model, so exposing it to Python would fail resource loading (like "deployment" below).
+		mutator.InitializeVolumePaths(),
+		mutator.ResolveVolumePathReferencesOnlyResources(),
+
+		// Default the `source` field on job tasks (GIT for git_source jobs, else
+		// WORKSPACE). Runs after PythonMutator so it sees the final git_source/tasks
+		// and does not expose the injected default to Python code, while remaining
+		// visible in `bundle validate`/`summary`.
+		resourcemutator.ApplyDefaultTaskSource(),
+
+		// Drop empty-string values on omitempty resource fields so they are not
+		// force-sent to the backend. Runs after variable resolution (a variable may
+		// resolve to "") and after all resource mutations, before validation so that
+		// required fields (no omitempty) still error if empty.
+		mutator.DropEmptyStrings(),
+
+		// Resolve --select selectors against the materialized resources: normalize
+		// each to its "type.name" form and validate it exists. Runs after all resource
+		// mutations so that dynamically added resources are visible. This does not
+		// filter resources; the direct engine selects against the resolved keys later.
+		mutator.ResolveSelect(),
+
 		// Validate all required fields are set. This is run after variable interpolation and PyDABs mutators
 		// since they can also set and modify resources.
 		validate.Required(),
@@ -152,6 +191,24 @@ func Initialize(ctx context.Context, b *bundle.Bundle) {
 		// Validate that no dashboard etags are set. They are purely internal state and should not be set by the user.
 		validate.ValidateDashboardEtags(),
 
+		// Validate that no genie space etags are set. They are purely internal state and should not be set by the user.
+		validate.ValidateGenieSpaceEtags(),
+
+		// Validate that deployment_id / version_id are not set on jobs or pipelines.
+		// They are set by the CLI to track the bundle deployment and must not be set by the user.
+		validate.ValidateDeploymentFields(),
+
+		// Reject configured job_runs.idempotency_token; the CLI sets it on run-now.
+		validate.ValidateJobRunIdempotencyToken(),
+
+		// Reject invalid job_runs.lifecycle.triggers (empty, false, prevent_destroy).
+		mutator.ValidateJobRunTriggers(),
+
+		// Reads (dynamic): * (strings) (searches for ${resources.*} references)
+		// Errors when a cross-resource reference points to a Terraform-only field
+		// with no DABs equivalent.
+		validate.TFOnlyReferences(),
+
 		// Reads (typed): b.Config.Permissions (checks if current user or their groups have CAN_MANAGE permissions)
 		// Reads (typed): b.Config.Workspace.CurrentUser (gets current user information)
 		// Provides diagnostic recommendations if the current deployment identity isn't explicitly granted CAN_MANAGE permissions
diff --git a/bundle/phases/messages.go b/bundle/phases/messages.go
index 347df8ece43..03eba35d8cf 100644
--- a/bundle/phases/messages.go
+++ b/bundle/phases/messages.go
@@ -36,14 +36,42 @@ all their branches, databases, and endpoints. All data stored in them will be pe
 	deleteOrRecreatePostgresBranchMessage = `
 This action will result in the deletion or recreation of the following Lakebase branches.
 All data stored in them will be permanently lost:`
+
+	deleteOrRecreatePostgresDatabaseMessage = `
+This action will result in the deletion or recreation of the following Lakebase databases.
+All data stored in them will be permanently lost:`
+
+	deleteOrRecreateVectorSearchIndexMessage = `
+This action will result in the deletion or recreation of the following Vector Search indexes.
+Recreating a Delta Sync index re-runs the full embedding pipeline; recreating a Direct Access
+index drops all upserted vectors. Both can be expensive to rebuild:`
+
+	deleteOrRecreateGenieSpaceMessage = `
+This action will result in the deletion or recreation of the following Genie spaces.
+The conversation history attached to a deleted space is permanently lost:`
 )
 
+// DataLossWarning is the warning shown when a non-interactive command is about
+// to delete data-bearing resources.
+const DataLossWarning = "Deleting data assets such as schemas, pipelines, or volumes may cause permanent data loss and should be carefully reviewed."
+
+// TerraformStateRemovedMessage is the error text shown when a command that does not
+// migrate on its own (bind, unbind) finds an existing Terraform state. The Terraform
+// deployment engine was removed in v1.20.0; "bundle deploy" migrates the state to the
+// direct engine or the Terraform engine must be used by running an older CLI version.
+const TerraformStateRemovedMessage = `this deployment's state uses the Terraform engine, which has been removed in Databricks CLI v1.20.0
+
+Run "databricks bundle deploy" to migrate the state to the direct engine, or install Databricks CLI v1.19.x`
+
 // Messages for bundle destroy.
 const (
 	deleteSchemaMessage = `This action will result in the deletion of the following UC schemas. Any underlying data may be lost:`
 
-	deletePipelineMessage = `This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
-Streaming Tables (STs) and Materialized Views (MVs) managed by them:`
+	deletePipelineWithCascadeMessage = `This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines along with the
+Streaming Tables (STs) and Materialized Views (MVs) managed by them. Set 'cascade_on_destroy: false' on a pipeline to retain datasets on pipeline deletion:`
+
+	deletePipelineNoCascadeMessage = `This action will result in the deletion of the following Lakeflow Spark Declarative Pipelines.
+The Streaming Tables (STs) and Materialized Views (MVs) managed by them are retained, as 'cascade_on_destroy' is set to false:`
 
 	deleteVolumeMessage = `This action will result in the deletion of the following volumes.
 For managed volumes, the files stored in the volume are also deleted from your
@@ -61,4 +89,14 @@ all their branches, databases, and endpoints. All data stored in them will be pe
 
 	deletePostgresBranchMessage = `This action will result in the deletion of the following Lakebase branches.
 All data stored in them will be permanently lost:`
+
+	deletePostgresDatabaseMessage = `This action will result in the deletion of the following Lakebase databases.
+All data stored in them will be permanently lost:`
+
+	deleteVectorSearchIndexMessage = `This action will result in the deletion of the following Vector Search indexes.
+For Delta Sync indexes, the source Delta Table is preserved but the embedding pipeline is removed.
+For Direct Access indexes, all upserted vectors are permanently lost:`
+
+	deleteGenieSpaceMessage = `This action will result in the deletion of the following Genie spaces.
+The conversation history attached to them is permanently lost:`
 )
diff --git a/bundle/phases/plan.go b/bundle/phases/plan.go
index 0af9394f243..4be81a102d2 100644
--- a/bundle/phases/plan.go
+++ b/bundle/phases/plan.go
@@ -2,34 +2,53 @@ package phases
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/bundle"
-	"github.com/databricks/cli/bundle/config/engine"
 	"github.com/databricks/cli/bundle/config/mutator"
 	"github.com/databricks/cli/bundle/config/mutator/resourcemutator"
 	"github.com/databricks/cli/bundle/deploy"
-	"github.com/databricks/cli/bundle/deploy/terraform"
 	"github.com/databricks/cli/bundle/deployplan"
+	"github.com/databricks/cli/bundle/direct/dresources"
 	"github.com/databricks/cli/bundle/statemgmt"
 	"github.com/databricks/cli/libs/dyn"
 )
 
 // PreDeployChecks is common set of mutators between "bundle plan" and "bundle deploy".
 // Note, it is not run in "bundle migrate" so it must not modify the config
-func PreDeployChecks(ctx context.Context, b *bundle.Bundle, isPlan bool, engine engine.EngineType) {
+func PreDeployChecks(ctx context.Context, b *bundle.Bundle, isPlan bool) {
 	bundle.ApplySeqContext(ctx, b,
-		terraform.CheckDashboardsModifiedRemotely(isPlan, engine),
-		resourcemutator.SecretScopeFixups(engine),
+		deploy.CheckDashboardsModifiedRemotely(isPlan),
+		resourcemutator.SecretScopeFixups(),
 		deploy.StatePull(),
 		mutator.ValidateGitDetails(),
-		mutator.ValidateDirectOnlyResources(engine),
-		mutator.ValidateLifecycleStarted(engine),
-		statemgmt.CheckRunningResource(engine),
+		statemgmt.CheckRunningResource(),
 	)
 }
 
+// pipelineDeletionCascades reports whether deleting the pipeline referenced by a delete action
+// also deletes its datasets (MVs, STs, Views). This is the server default (cascade) unless
+// cascade_on_destroy is explicitly set to false.
+//
+// The value is read from the persisted state.
+func pipelineDeletionCascades(b *bundle.Bundle, action deployplan.Action) (bool, error) {
+	entry, ok := b.DeploymentBundle.StateDB.GetResourceEntry(action.ResourceKey)
+	if !ok || len(entry.State) == 0 {
+		return true, nil
+	}
+
+	var state dresources.PipelineState
+	if err := json.Unmarshal(entry.State, &state); err != nil {
+		return false, fmt.Errorf("parsing persisted state for %s: %w", action.ResourceKey, err)
+	}
+	if state.CascadeOnDestroy == nil {
+		return true, nil
+	}
+	return *state.CascadeOnDestroy, nil
+}
+
 // checkForPreventDestroy checks if the resource has lifecycle.prevent_destroy set, but the plan calls for this resource to be recreated or destroyed.
 // If it does, it returns an error.
 func checkForPreventDestroy(b *bundle.Bundle, actions []deployplan.Action) error {
diff --git a/bundle/phases/plan_test.go b/bundle/phases/plan_test.go
index 73249b4e13c..772f7401f9b 100644
--- a/bundle/phases/plan_test.go
+++ b/bundle/phases/plan_test.go
@@ -1,15 +1,80 @@
 package phases
 
 import (
+	"encoding/json"
+	"path/filepath"
 	"testing"
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/bundle/config"
 	"github.com/databricks/cli/bundle/deployplan"
+	"github.com/databricks/cli/bundle/direct/dstate"
 	"github.com/databricks/cli/libs/dyn"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
+func TestPipelineDeletionCascades(t *testing.T) {
+	// The value must be read from persisted state (what the delete uses), not config.
+	b := &bundle.Bundle{}
+	data := dstate.NewDatabase("lineage", 1)
+	data.State["resources.pipelines.cascade_true"] = dstate.ResourceEntry{ID: "1", State: json.RawMessage(`{"cascade_on_destroy": true}`)}
+	data.State["resources.pipelines.cascade_false"] = dstate.ResourceEntry{ID: "2", State: json.RawMessage(`{"cascade_on_destroy": false}`)}
+	data.State["resources.pipelines.cascade_unset"] = dstate.ResourceEntry{ID: "3", State: json.RawMessage(`{}`)}
+	data.State["resources.pipelines.cascade_empty"] = dstate.ResourceEntry{ID: "4"}
+	b.DeploymentBundle.StateDB.OpenWithData(filepath.Join(t.TempDir(), "resources.json"), data)
+
+	tests := []struct {
+		name        string
+		bundle      *bundle.Bundle
+		resourceKey string
+		want        bool
+	}{
+		{
+			name:        "cascade_on_destroy explicitly true",
+			bundle:      b,
+			resourceKey: "resources.pipelines.cascade_true",
+			want:        true,
+		},
+		{
+			name:        "cascade_on_destroy explicitly false",
+			bundle:      b,
+			resourceKey: "resources.pipelines.cascade_false",
+			want:        false,
+		},
+		{
+			name:        "cascade_on_destroy unset defaults to cascade",
+			bundle:      b,
+			resourceKey: "resources.pipelines.cascade_unset",
+			want:        true,
+		},
+		{
+			name:        "empty persisted state defaults to cascade",
+			bundle:      b,
+			resourceKey: "resources.pipelines.cascade_empty",
+			want:        true,
+		},
+		{
+			name:        "missing state entry defaults to cascade",
+			bundle:      b,
+			resourceKey: "resources.pipelines.does_not_exist",
+			want:        true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			action := deployplan.Action{
+				ResourceKey: tt.resourceKey,
+				ActionType:  deployplan.Delete,
+			}
+			cascade, err := pipelineDeletionCascades(tt.bundle, action)
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, cascade)
+		})
+	}
+}
+
 func TestCheckPreventDestroyForAllResources(t *testing.T) {
 	for resourceType := range config.SupportedResources() {
 		t.Run(resourceType, func(t *testing.T) {
diff --git a/bundle/phases/resources_metadata.go b/bundle/phases/resources_metadata.go
new file mode 100644
index 00000000000..61f282f7943
--- /dev/null
+++ b/bundle/phases/resources_metadata.go
@@ -0,0 +1,129 @@
+package phases
+
+import (
+	"context"
+	"os"
+	"slices"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/config/engine"
+	"github.com/databricks/cli/bundle/statemgmt/resourcestate"
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/telemetry/protos"
+)
+
+// collectResourcesMetadata builds a BundleResourcesMetadata for the deployment:
+// per-resource-type counts, plus state sizes for the types the engine measures.
+//
+// Counts come from the configuration rather than from state, so every type is
+// reported on every deploy whatever the engine, and a newly added resource type
+// needs no telemetry change (AllResources is exhaustive by construction, guarded
+// by TestResourcesAllResourcesCompleteness). That is what makes this message a
+// superset of the deprecated per-type resource_*_count fields.
+//
+// Sizes come from b.Metrics.ResourceState, whose entries already carry
+// StateSizeBytes from the WAL replay the direct deploy performed, so nothing is
+// marshalled, read, or parsed here. Terraform leaves those zero.
+//
+// Returns nil when the bundle declares no resources and none are in state.
+func collectResourcesMetadata(ctx context.Context, b *bundle.Bundle) *protos.BundleResourcesMetadata {
+	resources := resourceMetadata(&b.Config.Resources, b.Metrics.ResourceState)
+	if len(resources) == 0 {
+		return nil
+	}
+
+	md := &protos.BundleResourcesMetadata{
+		StateEngine: string(b.Metrics.StateEngine),
+		Resources:   resources,
+	}
+
+	// Only the direct engine keeps the whole deployment state in one local file.
+	// The terraform state file size is reported as terraform_state_size_bytes.
+	if b.Metrics.StateEngine == engine.EngineDirect {
+		md.StateFileSizeBytes = directStateFileSize(ctx, b)
+	}
+
+	return md
+}
+
+// resourceMetadata reports one entry per resource type, ordered by type name.
+// Counts come from the configuration; max/mean/median state sizes are filled in
+// for the types present in the deployment state.
+func resourceMetadata(r *config.Resources, state resourcestate.ExportedResourcesMap) []protos.ResourceMetadata {
+	counts := make(map[string]int64)
+	for _, group := range r.AllResources() {
+		if len(group.Resources) > 0 {
+			counts[group.Description.PluralName] = int64(len(group.Resources))
+		}
+	}
+
+	sizesByType := make(map[string][]int64)
+	for key, rs := range state {
+		t := config.GetResourceTypeFromKey(key)
+		if t == "" {
+			continue
+		}
+		sizesByType[t] = append(sizesByType[t], int64(rs.StateSizeBytes))
+	}
+
+	types := make([]string, 0, len(counts))
+	for t := range counts {
+		types = append(types, t)
+	}
+	for t, sizes := range sizesByType {
+		if _, ok := counts[t]; !ok {
+			// Sub-resources such as "jobs.permissions", and resources being removed
+			// from the bundle: the configuration declares none, so the state is the
+			// only available count.
+			counts[t] = int64(len(sizes))
+			types = append(types, t)
+		}
+	}
+	slices.Sort(types)
+
+	resources := make([]protos.ResourceMetadata, 0, len(types))
+	for _, t := range types {
+		m := protos.ResourceMetadata{
+			ResourceType: t,
+			Count:        counts[t],
+		}
+		if sizes := sizesByType[t]; len(sizes) > 0 {
+			slices.Sort(sizes)
+			m.StateSizeMaxBytes = statMax(sizes)
+			m.StateSizeMeanBytes = statMean(sizes)
+			m.StateSizeMedianBytes = statMedian(sizes)
+		}
+		resources = append(resources, m)
+	}
+	return resources
+}
+
+// statMax/statMean/statMedian operate on a slice already sorted ascending.
+func statMax(sortedSizes []int64) int64 {
+	return sortedSizes[len(sortedSizes)-1]
+}
+
+func statMean(sortedSizes []int64) int64 {
+	var total int64
+	for _, s := range sortedSizes {
+		total += s
+	}
+	return total / int64(len(sortedSizes))
+}
+
+func statMedian(sortedSizes []int64) int64 {
+	return sortedSizes[(len(sortedSizes)-1)/2]
+}
+
+// directStateFileSize returns the size in bytes of the direct engine's
+// resources.json via a single stat (no read/parse), or 0 if it can't be stat'd.
+func directStateFileSize(ctx context.Context, b *bundle.Bundle) int64 {
+	_, localPath := b.StateFilenameDirect(ctx)
+	info, err := os.Stat(localPath)
+	if err != nil {
+		log.Debugf(ctx, "resources-metadata telemetry: cannot stat direct state at %s: %s", localPath, err)
+		return 0
+	}
+	return info.Size()
+}
diff --git a/bundle/phases/resources_metadata_test.go b/bundle/phases/resources_metadata_test.go
new file mode 100644
index 00000000000..819724a5d7d
--- /dev/null
+++ b/bundle/phases/resources_metadata_test.go
@@ -0,0 +1,105 @@
+package phases
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/cli/bundle/statemgmt/resourcestate"
+	"github.com/databricks/cli/libs/telemetry/protos"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestResourceMetadata_CountsFromConfigSizesFromState(t *testing.T) {
+	r := &config.Resources{
+		Jobs: map[string]*resources.Job{
+			"foo": {},
+			"bar": {},
+		},
+		Pipelines: map[string]*resources.Pipeline{"qux": {}},
+		// Declared but never deployed, so it has no state and no sizes.
+		Volumes: map[string]*resources.Volume{"vol": {}},
+	}
+	state := resourcestate.ExportedResourcesMap{
+		"resources.jobs.foo":             {StateSizeBytes: 20},
+		"resources.jobs.bar":             {StateSizeBytes: 10},
+		"resources.jobs.foo.permissions": {StateSizeBytes: 2},
+		"resources.pipelines.qux":        {StateSizeBytes: 14},
+	}
+
+	got := resourceMetadata(r, state)
+
+	// Sorted by resource type. jobs median is the lower-middle of [10,20], so 10.
+	// jobs.permissions is not a configuration type, so its count comes from state.
+	assert.Equal(t, []protos.ResourceMetadata{
+		{ResourceType: "jobs", Count: 2, StateSizeMaxBytes: 20, StateSizeMeanBytes: 15, StateSizeMedianBytes: 10},
+		{ResourceType: "jobs.permissions", Count: 1, StateSizeMaxBytes: 2, StateSizeMeanBytes: 2, StateSizeMedianBytes: 2},
+		{ResourceType: "pipelines", Count: 1, StateSizeMaxBytes: 14, StateSizeMeanBytes: 14, StateSizeMedianBytes: 14},
+		{ResourceType: "volumes", Count: 1},
+	}, got)
+}
+
+// A terraform deploy has no per-resource state, so it reports counts only.
+func TestResourceMetadata_CountsWithoutState(t *testing.T) {
+	r := &config.Resources{
+		Jobs: map[string]*resources.Job{"foo": {}},
+	}
+
+	got := resourceMetadata(r, nil)
+
+	assert.Equal(t, []protos.ResourceMetadata{
+		{ResourceType: "jobs", Count: 1},
+	}, got)
+}
+
+func TestStatHelpers(t *testing.T) {
+	assert.Equal(t, int64(3), statMax([]int64{1, 2, 3}))
+	assert.Equal(t, int64(2), statMean([]int64{1, 2, 3}))
+	assert.Equal(t, int64(2), statMedian([]int64{1, 2, 3}))
+	// Lower-middle for even count: sorted [1,2,3,4] -> index (4-1)/2 = 1 -> 2.
+	assert.Equal(t, int64(2), statMedian([]int64{1, 2, 3, 4}))
+}
+
+func TestResourceMetadata_SkipsNonResourceStateKeys(t *testing.T) {
+	state := resourcestate.ExportedResourcesMap{
+		"resources.jobs.foo": {StateSizeBytes: 5},
+		"bogus":              {StateSizeBytes: 99},
+	}
+	got := resourceMetadata(&config.Resources{}, state)
+	assert.Equal(t, []protos.ResourceMetadata{
+		{ResourceType: "jobs", Count: 1, StateSizeMaxBytes: 5, StateSizeMeanBytes: 5, StateSizeMedianBytes: 5},
+	}, got)
+}
+
+func TestCollectResourcesMetadata_NilWhenNoResources(t *testing.T) {
+	b := &bundle.Bundle{}
+	assert.Nil(t, collectResourcesMetadata(t.Context(), b))
+}
+
+// A type missing from the report is indistinguishable from zero adoption on the
+// dashboard, so fill one resource of every type to catch a type that falls out of
+// AllResources.
+func TestResourceMetadataCoversAllResourceTypes(t *testing.T) {
+	var r config.Resources
+	rv := reflect.ValueOf(&r).Elem()
+	rt := rv.Type()
+
+	// Resource fields are all map[string]*T; TestCustomMarshallerIsImplemented in
+	// bundle/config enforces that shape.
+	for i := range rt.NumField() {
+		mapType := rt.Field(i).Type
+		m := reflect.MakeMap(mapType)
+		m.SetMapIndex(reflect.ValueOf("my_resource"), reflect.New(mapType.Elem().Elem()))
+		rv.Field(i).Set(m)
+	}
+
+	got := resourceMetadata(&r, nil)
+	require.Len(t, got, rt.NumField())
+
+	for _, m := range got {
+		assert.Equal(t, int64(1), m.Count, "resource type %q", m.ResourceType)
+	}
+}
diff --git a/bundle/phases/telemetry.go b/bundle/phases/telemetry.go
index bb9a7d7e6b7..99464f3ef24 100644
--- a/bundle/phases/telemetry.go
+++ b/bundle/phases/telemetry.go
@@ -3,15 +3,22 @@ package phases
 import (
 	"cmp"
 	"context"
+	"math"
+	"reflect"
 	"slices"
+	"strings"
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/config/engine"
+	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/cli/bundle/libraries"
+	"github.com/databricks/cli/bundle/metrics"
 	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/cli/libs/log"
 	"github.com/databricks/cli/libs/telemetry"
 	"github.com/databricks/cli/libs/telemetry/protos"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
 )
 
 func getExecutionTimes(b *bundle.Bundle) []protos.IntMapEntry {
@@ -33,16 +40,165 @@ func getExecutionTimes(b *bundle.Bundle) []protos.IntMapEntry {
 	return executionTimes
 }
 
-// Maximum length of the error message included in telemetry.
-const maxErrorMessageLength = 500
+// Exclusive upper bounds in bytes for the upload file-size histogram: entry i
+// counts files in [bounds[i-1], bounds[i]). The final bound is math.MaxInt64 so
+// every file maps to a bucket and the last entry is the >= 64 MiB tail.
+//
+// A power-of-2 ladder (each bound is 2x the previous) is used because file sizes
+// span many orders of magnitude; constant-ratio buckets keep useful resolution
+// across the whole range.
+//
+// The histogram is positional on the wire, so changing this list changes the
+// meaning of every entry. Treat the bounds as frozen once the metric has
+// adoption, and keep them in sync with the doc on
+// BundleDeployExperimental.UploadFileSizes.
+var uploadFileSizeBucketBounds = []int64{
+	256,           // 256 B
+	512,           // 512 B
+	1 << 10,       // 1 KiB
+	2 << 10,       // 2 KiB
+	4 << 10,       // 4 KiB
+	8 << 10,       // 8 KiB
+	16 << 10,      // 16 KiB
+	32 << 10,      // 32 KiB
+	64 << 10,      // 64 KiB
+	128 << 10,     // 128 KiB
+	256 << 10,     // 256 KiB
+	512 << 10,     // 512 KiB
+	1 << 20,       // 1 MiB
+	2 << 20,       // 2 MiB
+	4 << 20,       // 4 MiB
+	8 << 20,       // 8 MiB
+	16 << 20,      // 16 MiB
+	32 << 20,      // 32 MiB
+	64 << 20,      // 64 MiB
+	math.MaxInt64, // catch-all upper bound
+}
 
-// LogDeployTelemetry logs a telemetry event for a bundle deploy command.
-func LogDeployTelemetry(ctx context.Context, b *bundle.Bundle, errMsg string) {
-	errMsg = scrubForTelemetry(errMsg)
+// uploadFileSizeBucket returns the histogram bucket index for a file of the
+// given size in bytes. Bounds are exclusive upper bounds, so a size that equals
+// a bound belongs in the next bucket.
+func uploadFileSizeBucket(size int64) int {
+	i, found := slices.BinarySearch(uploadFileSizeBucketBounds, size)
+	if found {
+		i++
+	}
+	return i
+}
+
+// sizer is the subset of fileset.File that uploadFileSizeHistogram needs. Taking
+// an interface keeps the histogram unit-testable without constructing real files.
+type sizer interface {
+	Size() (int64, bool)
+}
 
-	if len(errMsg) > maxErrorMessageLength {
-		errMsg = errMsg[:maxErrorMessageLength]
+// uploadFileSizeHistogram counts the uploaded files into uploadFileSizeBucketBounds.
+// If any file's size cannot be determined the whole histogram is omitted (returns
+// nil) rather than emitting a partial, misleading distribution; upload_file_count
+// is reported independently. Also returns nil when no files were uploaded (e.g.
+// source-linked deployments).
+func uploadFileSizeHistogram(files []sizer) []int64 {
+	if len(files) == 0 {
+		return nil
+	}
+	hist := make([]int64, len(uploadFileSizeBucketBounds))
+	for _, f := range files {
+		size, ok := f.Size()
+		if !ok {
+			return nil
+		}
+		hist[uploadFileSizeBucket(size)]++
+	}
+	return hist
+}
+
+// addTaskTypeKeys records a "has_<task_type>" key in out for each task-type field
+// set on the task. A Jobs task carries its type as one of several optional pointer
+// fields (notebook_task, spark_python_task, ai_runtime_task, ...); we reflect over
+// the fields whose JSON name ends in "_task" so every task type is captured,
+// including ones added later, without changing this code.
+func addTaskTypeKeys(task jobs.Task, out map[string]bool) {
+	v := reflect.ValueOf(task)
+	t := v.Type()
+	for i := range t.NumField() {
+		field := v.Field(i)
+		if field.Kind() != reflect.Pointer || field.IsNil() {
+			continue
+		}
+		name, _, _ := strings.Cut(t.Field(i).Tag.Get("json"), ",")
+		if strings.HasSuffix(name, "_task") {
+			out["has_"+name] = true
+		}
+	}
+}
+
+// collectTaskTypes returns the sorted "has_<task_type>" telemetry keys for every
+// task type used across the bundle's jobs. A for_each_task is unwrapped so the
+// wrapped task's type is recorded too. Sorted for deterministic telemetry output.
+func collectTaskTypes(jobs map[string]*resources.Job) []string {
+	seen := map[string]bool{}
+	for _, job := range jobs {
+		if job == nil {
+			continue
+		}
+		for _, task := range job.Tasks {
+			addTaskTypeKeys(task, seen)
+			if task.ForEachTask != nil {
+				addTaskTypeKeys(task.ForEachTask.Task, seen)
+			}
+		}
+	}
+	keys := make([]string, 0, len(seen))
+	for k := range seen {
+		keys = append(keys, k)
+	}
+	slices.Sort(keys)
+	return keys
+}
+
+// aiRuntimeTaskMetrics computes the ai_runtime_task-specific deploy dimensions.
+// present is true when any job declares an ai_runtime_task (including one nested in
+// a for_each_task); scheduled and multitask describe those jobs and are meaningful
+// only when present is true. Task-type presence itself (has_ai_runtime_task and the
+// other has_*_task keys) is recorded generically by collectTaskTypes.
+//
+// code_source_path is deliberately not inspected: it is rewritten to its uploaded
+// remote path before this runs, so it would always read as remote. GPU type and
+// count are likewise not recorded here.
+func aiRuntimeTaskMetrics(jobs map[string]*resources.Job) (present, scheduled, multitask bool) {
+	for _, job := range jobs {
+		if job == nil {
+			continue
+		}
+		jobHasAiRuntimeTask := false
+		for _, task := range job.Tasks {
+			rt := task.AiRuntimeTask
+			if rt == nil && task.ForEachTask != nil {
+				rt = task.ForEachTask.Task.AiRuntimeTask
+			}
+			if rt != nil {
+				jobHasAiRuntimeTask = true
+				break
+			}
+		}
+		if !jobHasAiRuntimeTask {
+			continue
+		}
+		present = true
+		if job.Schedule != nil || job.Trigger != nil || job.Continuous != nil {
+			scheduled = true
+		}
+		if len(job.Tasks) > 1 {
+			multitask = true
+		}
 	}
+	return present, scheduled, multitask
+}
+
+// LogDeployTelemetry logs a telemetry event for a bundle deploy command.
+func LogDeployTelemetry(ctx context.Context, b *bundle.Bundle, errMsg string) {
+	errMsg = telemetry.ScrubErrorMessage(errMsg)
+	b.Metrics.SetBoolValue(metrics.DeploymentHistoryEnabled, b.DeploymentBundle.StateDB.IsDeploymentMetadataService())
 
 	resourcesCount := int64(0)
 	_, err := dyn.MapByPattern(b.Config.Value(), dyn.NewPattern(dyn.Key("resources"), dyn.AnyKey(), dyn.AnyKey()), func(p dyn.Path, v dyn.Value) (dyn.Value, error) {
@@ -113,6 +269,49 @@ func LogDeployTelemetry(ctx context.Context, b *bundle.Bundle, errMsg string) {
 	slices.Sort(clusterIds)
 	slices.Sort(dashboardIds)
 
+	for _, app := range b.Config.Resources.Apps {
+		if app != nil && app.Lifecycle != nil && app.Lifecycle.Started != nil {
+			b.Metrics.SetBoolValue(metrics.AppLifecycleStarted, *app.Lifecycle.Started)
+			break
+		}
+	}
+
+	for _, cluster := range b.Config.Resources.Clusters {
+		if cluster != nil && cluster.Lifecycle != nil && cluster.Lifecycle.Started != nil {
+			b.Metrics.SetBoolValue(metrics.ClusterLifecycleStarted, *cluster.Lifecycle.Started)
+			break
+		}
+	}
+
+	for _, warehouse := range b.Config.Resources.SqlWarehouses {
+		if warehouse != nil && warehouse.Lifecycle != nil && warehouse.Lifecycle.Started != nil {
+			b.Metrics.SetBoolValue(metrics.SqlWarehouseLifecycleStarted, *warehouse.Lifecycle.Started)
+			break
+		}
+	}
+
+	// Record which task types the bundle uses (has_<task_type> per type present),
+	// plus the ai_runtime_task-specific scheduling / multi-task dimensions.
+	for _, key := range collectTaskTypes(b.Config.Resources.Jobs) {
+		b.Metrics.SetBoolValue(key, true)
+	}
+	if airPresent, airScheduled, airMultitask := aiRuntimeTaskMetrics(b.Config.Resources.Jobs); airPresent {
+		b.Metrics.SetBoolValue(metrics.AiRuntimeTaskScheduled, airScheduled)
+		b.Metrics.SetBoolValue(metrics.AiRuntimeTaskMultitask, airMultitask)
+	}
+
+	// Record whether the removed terraform engine was still requested (the command
+	// then fails with the removal error), separately per source. Only emitted when
+	// true; absence means "not requested via this source". An invalid env value has
+	// already failed the command upstream via ValidateEngineSetting, so treating the
+	// FromEnv error as "not terraform" here cannot mask a real terraform request.
+	if b.Config.Bundle.Engine == engine.EngineTerraform {
+		b.Metrics.SetBoolValue(metrics.EngineTerraformConfig, true)
+	}
+	if envEngine, _ := engine.FromEnv(ctx); envEngine == engine.EngineTerraform {
+		b.Metrics.SetBoolValue(metrics.EngineTerraformEnv, true)
+	}
+
 	// If the bundle UUID is not set, we use a default 0 value.
 	bundleUuid := "00000000-0000-0000-0000-000000000000"
 	if b.Config.Bundle.Uuid != "" {
@@ -155,13 +354,18 @@ func LogDeployTelemetry(ctx context.Context, b *bundle.Bundle, errMsg string) {
 		experimentalConfig = &config.Experimental{}
 	}
 
+	uploadFileSizers := make([]sizer, len(b.Files))
+	for i, f := range b.Files {
+		uploadFileSizers[i] = f
+	}
+
 	telemetry.Log(ctx, protos.DatabricksCliLog{
 		BundleDeployEvent: &protos.BundleDeployEvent{
 			BundleUuid:   bundleUuid,
 			DeploymentId: b.Metrics.DeploymentId.String(),
 			ErrorMessage: errMsg,
 
-			ResourceCount:                     resourcesCount,
+			ResourceCount:                     resourcesCount, //nolint:staticcheck // SA1019: populated alongside ResourcesMetadata during the transition
 			ResourceJobCount:                  int64(len(b.Config.Resources.Jobs)),
 			ResourcePipelineCount:             int64(len(b.Config.Resources.Pipelines)),
 			ResourceModelCount:                int64(len(b.Config.Resources.Models)),
@@ -180,9 +384,13 @@ func LogDeployTelemetry(ctx context.Context, b *bundle.Bundle, errMsg string) {
 			ResourceClusterIDs:   clusterIds,
 			ResourceDashboardIDs: dashboardIds,
 
+			ResourcesMetadata: collectResourcesMetadata(ctx, b),
+
 			Experimental: &protos.BundleDeployExperimental{
 				BundleMode:                   mode,
 				ConfigurationFileCount:       b.Metrics.ConfigurationFileCount,
+				UploadFileCount:              int64(len(b.Files)),
+				UploadFileSizes:              uploadFileSizeHistogram(uploadFileSizers),
 				TargetCount:                  b.Metrics.TargetCount,
 				WorkspaceArtifactPathType:    artifactPathType,
 				BoolValues:                   b.Metrics.BoolValues,
diff --git a/bundle/phases/telemetry_scrub.go b/bundle/phases/telemetry_scrub.go
deleted file mode 100644
index 051c81bd75b..00000000000
--- a/bundle/phases/telemetry_scrub.go
+++ /dev/null
@@ -1,158 +0,0 @@
-package phases
-
-import (
-	"path"
-	"regexp"
-	"strings"
-)
-
-// Scrub sensitive information from error messages before sending to telemetry.
-// Inspired by VS Code's telemetry path scrubbing and Sentry's @userpath pattern.
-//
-// Path regexes use [\s:,"'] as boundary characters to delimit where a path
-// ends. While these characters are technically valid in file paths, in error
-// messages they act as delimiters (e.g. "error: /path/to/file: not found",
-// or "failed to read '/some/path', skipping"). This is a practical tradeoff:
-// paths containing colons, commas, or quotes are extremely rare, and without
-// these boundaries the regexes would over-match into surrounding message text.
-//
-// References:
-// - VS Code: https://github.com/microsoft/vscode/blob/main/src/vs/platform/telemetry/common/telemetryUtils.ts
-// - Sentry: https://github.com/getsentry/relay (PII rule: @userpath)
-var (
-	// Matches Windows absolute paths with backslashes and at least two components
-	// (e.g., C:\foo\bar, D:\Users\project).
-	windowsBackslashPathRegexp = regexp.MustCompile(`[A-Za-z]:\\[^\s:,"'/\\]+\\[^\s:,"']+`)
-
-	// Matches Windows absolute paths with forward slashes and at least two components
-	// (e.g., C:/foo/bar, D:/Users/project).
-	windowsFwdslashPathRegexp = regexp.MustCompile(`[A-Za-z]:/[^\s:,"'/\\]+/[^\s:,"']+`)
-
-	// Matches Databricks workspace paths (/Workspace/...).
-	workspacePathRegexp = regexp.MustCompile(`(^|[\s:,"'])(/Workspace/[^\s:,"']+)`)
-
-	// Matches absolute Unix paths with at least two components
-	// (e.g., /home/user/..., /tmp/foo, ~/.config/databricks).
-	absPathRegexp = regexp.MustCompile(`(^|[\s:,"'])(~?/[^\s:,"'/]+/[^\s:,"']+)`)
-
-	// Matches relative paths:
-	// - Explicit: ./foo, ../foo
-	// - Dot-prefixed directories: .databricks/bundle/..., .cache/foo
-	explicitRelPathRegexp = regexp.MustCompile(`(^|[\s:,"'])((?:\.\.?|\.[a-zA-Z][^\s:,"'/]*)/[^\s:,"']+)`)
-
-	// Matches implicit relative paths: at least two path components where
-	// the last component has a file extension (e.g., "resources/job.yml",
-	// "bundle/dev/state.json").
-	implicitRelPathRegexp = regexp.MustCompile(`(^|[\s:,"'])([a-zA-Z0-9_][^\s:,"']*/[^\s:,"']*\.[a-zA-Z][^\s:,"']*)`)
-
-	// Matches email addresses. Workspace paths in Databricks often contain
-	// emails (e.g., /Workspace/Users/user@example.com/.bundle/dev).
-	emailRegexp = regexp.MustCompile(`[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}`)
-)
-
-// Known file extensions that are safe to retain in redacted paths.
-// These help understand usage patterns without capturing sensitive information.
-var knownExtensions = map[string]bool{
-	// Configuration and data formats
-	".yml":        true,
-	".yaml":       true,
-	".json":       true,
-	".toml":       true,
-	".cfg":        true,
-	".ini":        true,
-	".env":        true,
-	".xml":        true,
-	".properties": true,
-	".conf":       true,
-
-	// Notebook and script languages
-	".py":    true,
-	".r":     true,
-	".scala": true,
-	".sql":   true,
-	".ipynb": true,
-	".sh":    true,
-
-	// Web / Apps
-	".js":   true,
-	".ts":   true,
-	".jsx":  true,
-	".tsx":  true,
-	".html": true,
-	".css":  true,
-
-	// Terraform
-	".tf":      true,
-	".hcl":     true,
-	".tfstate": true,
-	".tfvars":  true,
-
-	// Build artifacts and archives
-	".whl": true,
-	".jar": true,
-	".egg": true,
-	".zip": true,
-	".tar": true,
-	".gz":  true,
-	".tgz": true,
-	".dbc": true,
-
-	// Data formats
-	".txt":     true,
-	".csv":     true,
-	".md":      true,
-	".parquet": true,
-	".avro":    true,
-
-	// Logs and locks
-	".log":  true,
-	".lock": true,
-
-	// Certificates and keys
-	".pem": true,
-	".crt": true,
-}
-
-// scrubForTelemetry is a best-effort scrubber that removes sensitive path and
-// PII information from error messages before they are sent to telemetry.
-// The error message is treated as PII by the logging infrastructure but we
-// scrub to avoid collecting more information than necessary.
-func scrubForTelemetry(msg string) string {
-	// Redact absolute paths.
-	msg = replacePathRegexp(msg, windowsBackslashPathRegexp, "[REDACTED_WIN_PATH]", false)
-	msg = replacePathRegexp(msg, windowsFwdslashPathRegexp, "[REDACTED_WIN_FPATH]", false)
-	msg = replacePathRegexp(msg, workspacePathRegexp, "[REDACTED_WORKSPACE_PATH]", true)
-	msg = replacePathRegexp(msg, absPathRegexp, "[REDACTED_PATH]", true)
-
-	// Redact relative paths.
-	msg = replacePathRegexp(msg, explicitRelPathRegexp, "[REDACTED_REL_PATH]", true)
-	msg = replacePathRegexp(msg, implicitRelPathRegexp, "[REDACTED_REL_PATH]", true)
-
-	// Redact email addresses.
-	msg = emailRegexp.ReplaceAllString(msg, "[REDACTED_EMAIL]")
-
-	return msg
-}
-
-// replacePathRegexp replaces path matches with the given label, retaining
-// known file extensions. When hasDelimiterGroup is true, the first character
-// of the match is preserved as a delimiter prefix.
-func replacePathRegexp(msg string, re *regexp.Regexp, label string, hasDelimiterGroup bool) string {
-	return re.ReplaceAllStringFunc(msg, func(match string) string {
-		prefix := ""
-		p := match
-		if hasDelimiterGroup && len(match) > 0 {
-			first := match[0]
-			if strings.ContainsRune(" \t\n:,\"'", rune(first)) {
-				prefix = match[:1]
-				p = match[1:]
-			}
-		}
-
-		ext := path.Ext(p)
-		if knownExtensions[ext] {
-			return prefix + label + "(" + ext[1:] + ")"
-		}
-		return prefix + label
-	})
-}
diff --git a/bundle/phases/telemetry_scrub_test.go b/bundle/phases/telemetry_scrub_test.go
deleted file mode 100644
index 556b3783ed3..00000000000
--- a/bundle/phases/telemetry_scrub_test.go
+++ /dev/null
@@ -1,213 +0,0 @@
-package phases
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestScrubForTelemetry_AbsolutePaths(t *testing.T) {
-	tests := []struct {
-		name     string
-		msg      string
-		expected string
-	}{
-		{
-			name:     "tmp path with known extension",
-			msg:      "failed to write /tmp/bundle-xyz/state.json",
-			expected: "failed to write [REDACTED_PATH](json)",
-		},
-		{
-			name:     "var folders path without extension",
-			msg:      "error reading /var/folders/7t/n_tz6x9d4xj91h48pf8md5zh0000gp/T/test123/file",
-			expected: "error reading [REDACTED_PATH]",
-		},
-		{
-			name:     "etc path with known extension",
-			msg:      "config at /etc/databricks/config.json not found",
-			expected: "config at [REDACTED_PATH](json) not found",
-		},
-		{
-			name:     "macOS home path with known extension",
-			msg:      "failed to read /Users/otheruser/some-project/file.yml",
-			expected: "failed to read [REDACTED_PATH](yml)",
-		},
-		{
-			name:     "Linux home path with known extension",
-			msg:      "failed to read /home/runner/work/project/file.yml",
-			expected: "failed to read [REDACTED_PATH](yml)",
-		},
-		{
-			name:     "absolute path after colon delimiter",
-			msg:      "error: /Users/jane/project/a.yml: not found, try again",
-			expected: "error: [REDACTED_PATH](yml): not found, try again",
-		},
-		{
-			name:     "multiple absolute paths",
-			msg:      "path /home/user/project/a.yml and /home/user/project/b.yml",
-			expected: "path [REDACTED_PATH](yml) and [REDACTED_PATH](yml)",
-		},
-		{
-			name:     "Windows path with backslashes",
-			msg:      `error at C:\Users\shreyas\project\file.yml`,
-			expected: "error at [REDACTED_WIN_PATH](yml)",
-		},
-		{
-			name:     "Windows path with forward slashes",
-			msg:      "error at C:/Users/shreyas/project/file.yml",
-			expected: "error at [REDACTED_WIN_FPATH](yml)",
-		},
-		{
-			name:     "Windows path with lowercase drive letter",
-			msg:      `error at c:\Users\shreyas\project\file.yml`,
-			expected: "error at [REDACTED_WIN_PATH](yml)",
-		},
-		{
-			name:     "volume path with known extension",
-			msg:      "artifact at /Volumes/catalog/schema/volume/artifact.whl",
-			expected: "artifact at [REDACTED_PATH](whl)",
-		},
-		{
-			name:     "dbfs path with known extension",
-			msg:      "state at /dbfs/mnt/data/state.json",
-			expected: "state at [REDACTED_PATH](json)",
-		},
-		{
-			name:     "path with unknown extension",
-			msg:      "error at /home/user/project/file.xyz",
-			expected: "error at [REDACTED_PATH]",
-		},
-		{
-			name:     "tilde home path with known extension",
-			msg:      "reading ~/.databricks/config.json failed",
-			expected: "reading [REDACTED_PATH](json) failed",
-		},
-		{
-			name:     "single component path is not matched",
-			msg:      "POST /telemetry-ext failed",
-			expected: "POST /telemetry-ext failed",
-		},
-		{
-			name:     "empty message",
-			msg:      "",
-			expected: "",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.expected, scrubForTelemetry(tt.msg))
-		})
-	}
-}
-
-func TestScrubForTelemetry_WorkspacePaths(t *testing.T) {
-	tests := []struct {
-		name     string
-		msg      string
-		expected string
-	}{
-		{
-			name:     "workspace user path without extension",
-			msg:      "uploading to /Workspace/Users/dev/.bundle/files",
-			expected: "uploading to [REDACTED_WORKSPACE_PATH]",
-		},
-		{
-			name:     "workspace path with email",
-			msg:      "error at /Workspace/Users/user@example.com/.bundle/dev",
-			expected: "error at [REDACTED_WORKSPACE_PATH]",
-		},
-		{
-			name:     "workspace shared path without extension",
-			msg:      "cannot access /Workspace/Shared/project/notebook",
-			expected: "cannot access [REDACTED_WORKSPACE_PATH]",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.expected, scrubForTelemetry(tt.msg))
-		})
-	}
-}
-
-func TestScrubForTelemetry_RelativePaths(t *testing.T) {
-	tests := []struct {
-		name     string
-		msg      string
-		expected string
-	}{
-		{
-			name:     "explicit relative path with ./",
-			msg:      "failed to load ./resources/job.yml",
-			expected: "failed to load [REDACTED_REL_PATH](yml)",
-		},
-		{
-			name:     "explicit relative path with ../",
-			msg:      "path ../parent/file.yml not allowed",
-			expected: "path [REDACTED_REL_PATH](yml) not allowed",
-		},
-		{
-			name:     "implicit relative path with extension",
-			msg:      "failed to read resources/pipeline.yml: not found",
-			expected: "failed to read [REDACTED_REL_PATH](yml): not found",
-		},
-		{
-			name:     "dot-prefixed directory path with extension",
-			msg:      "error reading .databricks/bundle/dev/variable-overrides.json",
-			expected: "error reading [REDACTED_REL_PATH](json)",
-		},
-		{
-			name:     "single filename without path separator is preserved",
-			msg:      "failed to load databricks.yml",
-			expected: "failed to load databricks.yml",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.expected, scrubForTelemetry(tt.msg))
-		})
-	}
-}
-
-func TestScrubForTelemetry_Emails(t *testing.T) {
-	tests := []struct {
-		name     string
-		msg      string
-		expected string
-	}{
-		{
-			name:     "email in message",
-			msg:      "access denied for user@example.com in workspace",
-			expected: "access denied for [REDACTED_EMAIL] in workspace",
-		},
-		{
-			name:     "no email present",
-			msg:      "some error without emails",
-			expected: "some error without emails",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.expected, scrubForTelemetry(tt.msg))
-		})
-	}
-}
-
-func TestScrubForTelemetry_Combined(t *testing.T) {
-	msg := "failed to load /Users/shreyas/myproject/databricks.yml: " +
-		"workspace /Workspace/Users/shreyas@databricks.com/.bundle is invalid, " +
-		"also tried /home/other/fallback/config.yml, " +
-		"temp at /tmp/bundle-cache/state.json, " +
-		"see .databricks/bundle/dev/variable-overrides.json"
-
-	expected := "failed to load [REDACTED_PATH](yml): " +
-		"workspace [REDACTED_WORKSPACE_PATH] is invalid, " +
-		"also tried [REDACTED_PATH](yml), " +
-		"temp at [REDACTED_PATH](json), " +
-		"see [REDACTED_REL_PATH](json)"
-
-	assert.Equal(t, expected, scrubForTelemetry(msg))
-}
diff --git a/bundle/phases/telemetry_test.go b/bundle/phases/telemetry_test.go
new file mode 100644
index 00000000000..d6badfaa792
--- /dev/null
+++ b/bundle/phases/telemetry_test.go
@@ -0,0 +1,176 @@
+package phases
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestUploadFileSizeBucket(t *testing.T) {
+	tests := []struct {
+		size     int64
+		expected int
+	}{
+		{size: 0, expected: 0},
+		{size: 255, expected: 0},
+		// A size equal to a bound belongs in the next bucket (bounds are exclusive).
+		{size: 256, expected: 1},
+		{size: 511, expected: 1},
+		{size: 512, expected: 2},
+		{size: 1023, expected: 2},
+		{size: 1 << 10, expected: 3},
+		{size: 1440, expected: 3},
+		{size: 2<<10 - 1, expected: 3},
+		{size: 2 << 10, expected: 4},
+		{size: 256 << 10, expected: 11},
+		{size: 512 << 10, expected: 12},
+		{size: 1 << 20, expected: 13},
+		{size: 8 << 20, expected: 16},
+		{size: 64<<20 - 1, expected: 18},
+		// The final bucket captures everything at least as large as the last bound.
+		{size: 64 << 20, expected: 19},
+		{size: 1 << 40, expected: 19},
+	}
+
+	for _, tc := range tests {
+		assert.Equal(t, tc.expected, uploadFileSizeBucket(tc.size), "size=%d", tc.size)
+	}
+}
+
+type fakeSizer int64
+
+func (s fakeSizer) Size() (int64, bool) { return int64(s), true }
+
+// unknownSizer models a file whose size cannot be determined (stat failure).
+type unknownSizer struct{}
+
+func (unknownSizer) Size() (int64, bool) { return 0, false }
+
+func TestUploadFileSizeHistogram(t *testing.T) {
+	files := []sizer{
+		fakeSizer(0),        // bucket 0  (< 256 B)
+		fakeSizer(255),      // bucket 0
+		fakeSizer(256),      // bucket 1  (256 B is an exclusive bound -> next bucket)
+		fakeSizer(1440),     // bucket 3  (1-2 KiB)
+		fakeSizer(64 << 20), // bucket 19 (>= 64 MiB, final bucket)
+		fakeSizer(1 << 40),  // bucket 19
+	}
+
+	expected := make([]int64, len(uploadFileSizeBucketBounds))
+	expected[0] = 2
+	expected[1] = 1
+	expected[3] = 1
+	expected[19] = 2
+
+	assert.Equal(t, expected, uploadFileSizeHistogram(files))
+}
+
+// A single unmeasurable file omits the whole histogram, so we never emit a
+// partial (and therefore misleading) distribution.
+func TestUploadFileSizeHistogramUnknownSizeOmitsHistogram(t *testing.T) {
+	files := []sizer{fakeSizer(100), unknownSizer{}, fakeSizer(2000)}
+	assert.Nil(t, uploadFileSizeHistogram(files))
+}
+
+func TestUploadFileSizeHistogramEmpty(t *testing.T) {
+	assert.Nil(t, uploadFileSizeHistogram(nil))
+}
+
+func TestCollectTaskTypes(t *testing.T) {
+	jobs := map[string]*resources.Job{
+		"nil": nil,
+		"a": {JobSettings: jobs.JobSettings{Tasks: []jobs.Task{
+			{TaskKey: "nb", NotebookTask: &jobs.NotebookTask{NotebookPath: "/nb"}},
+			{TaskKey: "train", AiRuntimeTask: &jobs.AiRuntimeTask{Experiment: "exp"}},
+		}}},
+		"b": {JobSettings: jobs.JobSettings{Tasks: []jobs.Task{
+			// for_each wrapping a spark_python_task: both the wrapper and the
+			// nested task type should be recorded.
+			{TaskKey: "fan", ForEachTask: &jobs.ForEachTask{Task: jobs.Task{
+				SparkPythonTask: &jobs.SparkPythonTask{PythonFile: "main.py"},
+			}}},
+		}}},
+	}
+	assert.Equal(t, []string{
+		"has_ai_runtime_task",
+		"has_for_each_task",
+		"has_notebook_task",
+		"has_spark_python_task",
+	}, collectTaskTypes(jobs))
+
+	assert.Empty(t, collectTaskTypes(nil))
+}
+
+// aiRuntimeJob builds a job with a single ai_runtime_task, plus optionally an extra
+// no-op task to make it multi-task.
+func aiRuntimeJob(extraTask bool) *resources.Job {
+	tasks := []jobs.Task{{
+		TaskKey:       "train",
+		AiRuntimeTask: &jobs.AiRuntimeTask{Experiment: "exp"},
+	}}
+	if extraTask {
+		tasks = append(tasks, jobs.Task{TaskKey: "prep"})
+	}
+	return &resources.Job{Tasks: tasks}
+}
+
+func TestAiRuntimeTaskMetrics(t *testing.T) {
+	scheduledJob := aiRuntimeJob(false)
+	scheduledJob.Schedule = &jobs.CronSchedule{QuartzCronExpression: "0 0 * * * ?"}
+
+	forEachJob := &resources.Job{Tasks: []jobs.Task{{
+		TaskKey:     "fanout",
+		ForEachTask: &jobs.ForEachTask{Task: jobs.Task{AiRuntimeTask: &jobs.AiRuntimeTask{Experiment: "exp"}}},
+	}}}
+
+	tests := []struct {
+		name                          string
+		jobs                          map[string]*resources.Job
+		present, scheduled, multitask bool
+	}{
+		{
+			name: "no jobs",
+			jobs: nil,
+		},
+		{
+			name: "job without ai_runtime_task",
+			jobs: map[string]*resources.Job{"j": {JobSettings: jobs.JobSettings{Tasks: []jobs.Task{{TaskKey: "notebook"}}}}},
+		},
+		{
+			name:    "single task",
+			jobs:    map[string]*resources.Job{"j": aiRuntimeJob(false)},
+			present: true,
+		},
+		{
+			name:    "multi-task",
+			jobs:    map[string]*resources.Job{"j": aiRuntimeJob(true)},
+			present: true, multitask: true,
+		},
+		{
+			name:    "scheduled single task",
+			jobs:    map[string]*resources.Job{"j": scheduledJob},
+			present: true, scheduled: true,
+		},
+		{
+			name:    "for_each nested ai_runtime_task",
+			jobs:    map[string]*resources.Job{"j": forEachJob},
+			present: true,
+		},
+		{
+			name:    "nil job is skipped",
+			jobs:    map[string]*resources.Job{"j": nil, "k": aiRuntimeJob(false)},
+			present: true,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			present, scheduled, multitask := aiRuntimeTaskMetrics(tc.jobs)
+			assert.Equal(t, tc.present, present, "present")
+			assert.Equal(t, tc.scheduled, scheduled, "scheduled")
+			assert.Equal(t, tc.multitask, multitask, "multitask")
+		})
+	}
+}
diff --git a/bundle/render/render_text_output.go b/bundle/render/render_text_output.go
index b1f0c6442d1..27ae5b6f7c5 100644
--- a/bundle/render/render_text_output.go
+++ b/bundle/render/render_text_output.go
@@ -40,7 +40,9 @@ const resourcesTemplate = `Resources:
   {{- range .Resources }}
     {{ .Key | bold }}:
       Name: {{ .Name }}
+    {{- if .SupportsURL }}
       URL:  {{ if .URL }}{{ .URL | cyan }}{{ else }}{{ "(not deployed)" | cyan }}{{ end }}
+    {{- end }}
   {{- end }}
 {{- end }}
 `
@@ -51,9 +53,10 @@ type ResourceGroup struct {
 }
 
 type ResourceInfo struct {
-	Key  string
-	Name string
-	URL  string
+	Key         string
+	Name        string
+	URL         string
+	SupportsURL bool
 }
 
 func pluralize(n int, singular, plural string) string {
@@ -149,10 +152,12 @@ func RenderSummary(ctx context.Context, out io.Writer, b *bundle.Bundle) error {
 	for _, group := range b.Config.Resources.AllResources() {
 		resources := make([]ResourceInfo, 0, len(group.Resources))
 		for key, resource := range group.Resources {
+			url, supportsURL := resource.GetURL()
 			resources = append(resources, ResourceInfo{
-				Key:  key,
-				Name: resource.GetName(),
-				URL:  resource.GetURL(),
+				Key:         key,
+				Name:        resource.GetName(),
+				URL:         url,
+				SupportsURL: supportsURL,
 			})
 		}
 
diff --git a/bundle/render/render_text_output_test.go b/bundle/render/render_text_output_test.go
index 4a6b777c1c2..4c87fbb4eb9 100644
--- a/bundle/render/render_text_output_test.go
+++ b/bundle/render/render_text_output_test.go
@@ -11,8 +11,8 @@ import (
 	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/diag"
-	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/cli/libs/logdiag"
+	"github.com/databricks/cli/libs/structs/structpath"
 	"github.com/databricks/databricks-sdk-go/service/catalog"
 	"github.com/databricks/databricks-sdk-go/service/iam"
 	"github.com/databricks/databricks-sdk-go/service/jobs"
@@ -28,7 +28,7 @@ func TestRenderSummaryHeaderTemplate_nilBundle(t *testing.T) {
 	err := renderSummaryHeaderTemplate(cmdio.MockDiscard(t.Context()), writer, nil)
 	require.NoError(t, err)
 
-	assert.Equal(t, "", writer.String())
+	assert.Empty(t, writer.String())
 }
 
 func TestRenderDiagnosticsSummary(t *testing.T) {
@@ -159,7 +159,7 @@ func TestRenderDiagnostics(t *testing.T) {
 					Severity: diag.Error,
 					Summary:  "failed to load xxx",
 					Detail:   "'name' is required",
-					Locations: []dyn.Location{{
+					Locations: []diag.Location{{
 						File:   "foo.yaml",
 						Line:   1,
 						Column: 2,
@@ -177,7 +177,7 @@ func TestRenderDiagnostics(t *testing.T) {
 					Severity: diag.Error,
 					Summary:  "failed to load xxx",
 					Detail:   "'name' is required",
-					Locations: []dyn.Location{
+					Locations: []diag.Location{
 						{
 							File:   "foo.yaml",
 							Line:   1,
@@ -203,7 +203,7 @@ func TestRenderDiagnostics(t *testing.T) {
 					Severity: diag.Error,
 					Detail:   "'name' is required",
 					Summary:  "failed to load xxx",
-					Paths:    []dyn.Path{dyn.MustPathFromString("resources.jobs.xxx")},
+					Paths:    structpath.NewPathSlice("resources", "jobs", "xxx"),
 				},
 			},
 			expected: "Error: failed to load xxx\n" +
@@ -218,11 +218,11 @@ func TestRenderDiagnostics(t *testing.T) {
 					Severity: diag.Error,
 					Detail:   "'name' is required",
 					Summary:  "failed to load xxx",
-					Paths: []dyn.Path{
-						dyn.MustPathFromString("resources.jobs.xxx"),
-						dyn.MustPathFromString("resources.jobs.yyy"),
-						dyn.MustPathFromString("resources.jobs.zzz"),
-					},
+					Paths: structpath.MustParsePaths(
+						"resources.jobs.xxx",
+						"resources.jobs.yyy",
+						"resources.jobs.zzz",
+					),
 				},
 			},
 			expected: "Error: failed to load xxx\n" +
@@ -239,11 +239,11 @@ func TestRenderDiagnostics(t *testing.T) {
 					Severity: diag.Recommendation,
 					Summary:  "summary",
 					Detail:   "detail",
-					Paths: []dyn.Path{
-						dyn.MustPathFromString("resources.jobs.xxx"),
-						dyn.MustPathFromString("resources.jobs.yyy"),
-					},
-					Locations: []dyn.Location{
+					Paths: structpath.MustParsePaths(
+						"resources.jobs.xxx",
+						"resources.jobs.yyy",
+					),
+					Locations: []diag.Location{
 						{File: "foo.yaml", Line: 1, Column: 2},
 						{File: "bar.yaml", Line: 3, Column: 4},
 					},
@@ -299,28 +299,35 @@ func TestRenderSummary(t *testing.T) {
 			Resources: config.Resources{
 				Jobs: map[string]*resources.Job{
 					"job1": {
-						BaseResource: resources.BaseResource{ID: "1", URL: "https://url1"},
-						JobSettings:  jobs.JobSettings{Name: "job1-name"},
+						ID:           "1",
+						BaseResource: resources.BaseResource{URL: "https://url1"},
+
+						JobSettings: jobs.JobSettings{Name: "job1-name"},
 					},
 					"job2": {
-						BaseResource: resources.BaseResource{ID: "2", URL: "https://url2"},
-						JobSettings:  jobs.JobSettings{Name: "job2-name"},
+						ID:           "2",
+						BaseResource: resources.BaseResource{URL: "https://url2"},
+
+						JobSettings: jobs.JobSettings{Name: "job2-name"},
 					},
 				},
 				Pipelines: map[string]*resources.Pipeline{
 					"pipeline2": {
-						BaseResource: resources.BaseResource{ID: "4"},
+						ID: "4",
+
 						// no URL
 						CreatePipeline: pipelines.CreatePipeline{Name: "pipeline2-name"},
 					},
 					"pipeline1": {
-						BaseResource:   resources.BaseResource{ID: "3", URL: "https://url3"},
+						ID:           "3",
+						BaseResource: resources.BaseResource{URL: "https://url3"},
+
 						CreatePipeline: pipelines.CreatePipeline{Name: "pipeline1-name"},
 					},
 				},
 				Schemas: map[string]*resources.Schema{
 					"schema1": {
-						BaseResource: resources.BaseResource{ID: "catalog.schema"},
+						ID: "catalog.schema",
 						CreateSchema: catalog.CreateSchema{
 							Name: "schema",
 						},
@@ -329,12 +336,20 @@ func TestRenderSummary(t *testing.T) {
 				},
 				ModelServingEndpoints: map[string]*resources.ModelServingEndpoint{
 					"endpoint1": {
-						BaseResource: resources.BaseResource{ID: "7", URL: "https://url4"},
+						ID:           "7",
+						BaseResource: resources.BaseResource{URL: "https://url4"},
+
 						CreateServingEndpoint: serving.CreateServingEndpoint{
 							Name: "my_serving_endpoint",
 						},
 					},
 				},
+				SecretScopes: map[string]*resources.SecretScope{
+					// Secret scopes never have a URL, regardless of deployment.
+					"scope1": {
+						Name: "my_scope",
+					},
+				},
 			},
 		},
 	}
@@ -370,6 +385,9 @@ Resources:
     schema1:
       Name: schema
       URL:  (not deployed)
+  Secret Scopes:
+    scope1:
+      Name: my_scope
 `
 	assert.Equal(t, expectedSummary, writer.String())
 }
diff --git a/bundle/root.go b/bundle/root.go
index 9ea9a8c13fe..5f7317a5e99 100644
--- a/bundle/root.go
+++ b/bundle/root.go
@@ -8,14 +8,16 @@ import (
 
 	"github.com/databricks/cli/bundle/config"
 	"github.com/databricks/cli/bundle/env"
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/folders"
 )
 
 // getRootEnv returns the value of the bundle root environment variable
-// if it set and is a directory. If the environment variable is set but
-// is not a directory, it returns an error. If the environment variable is
-// not set, it returns an empty string.
-func getRootEnv(ctx context.Context) (string, error) {
+// if it is set and points to a directory that contains a bundle configuration
+// file. If the environment variable is set but does not point to such a
+// directory, it returns diagnostics. If the environment variable is not set,
+// it returns an empty string.
+func getRootEnv(ctx context.Context) (string, diag.Diagnostics) {
 	path, ok := env.Root(ctx)
 	if !ok {
 		return "", nil
@@ -24,18 +26,25 @@ func getRootEnv(ctx context.Context) (string, error) {
 	if err == nil && !stat.IsDir() {
 		err = errors.New("not a directory")
 	}
+	if err == nil {
+		_, err = config.FileNames.FindInPath(path)
+	}
 	if err != nil {
-		return "", fmt.Errorf(`invalid bundle root %s="%s": %w`, env.RootVariable, path, err)
+		return "", diag.Diagnostics{{
+			Severity: diag.Error,
+			Summary:  fmt.Sprintf(`Invalid bundle root %s="%s": %s`, env.RootVariable, path, err),
+			Detail:   fmt.Sprintf("The %s environment variable must point to an existing directory that contains a bundle configuration file.", env.RootVariable),
+		}}
 	}
 	return path, nil
 }
 
 // getRootWithTraversal returns the bundle root by traversing the filesystem
 // from the working directory to the root looking for a configuration file.
-func getRootWithTraversal() (string, error) {
+func getRootWithTraversal() (string, diag.Diagnostics) {
 	wd, err := os.Getwd()
 	if err != nil {
-		return "", err
+		return "", diag.FromErr(err)
 	}
 
 	for _, file := range config.FileNames {
@@ -45,24 +54,28 @@ func getRootWithTraversal() (string, error) {
 		}
 	}
 
-	return "", fmt.Errorf(`unable to locate bundle root: %s not found`, config.FileNames[0])
+	return "", diag.Diagnostics{{
+		Severity: diag.Error,
+		Summary:  fmt.Sprintf("Unable to locate the bundle root: %s not found.", config.FileNames[0]),
+		Detail:   fmt.Sprintf("Run this command from a directory that contains a bundle, or set the %s environment variable to the bundle root directory.\nAlternatively, create a new bundle with 'databricks bundle init'.", env.RootVariable),
+	}}
 }
 
-// mustGetRoot returns a bundle root or an error if one cannot be found.
-func mustGetRoot(ctx context.Context) (string, error) {
-	path, err := getRootEnv(ctx)
-	if path != "" || err != nil {
-		return path, err
+// mustGetRoot returns a bundle root or diagnostics if one cannot be found.
+func mustGetRoot(ctx context.Context) (string, diag.Diagnostics) {
+	path, diags := getRootEnv(ctx)
+	if path != "" || diags.HasError() {
+		return path, diags
 	}
 	return getRootWithTraversal()
 }
 
 // tryGetRoot returns a bundle root or an empty string if one cannot be found.
-func tryGetRoot(ctx context.Context) (string, error) {
+func tryGetRoot(ctx context.Context) (string, diag.Diagnostics) {
 	// Note: an invalid value in the environment variable is still an error.
-	path, err := getRootEnv(ctx)
-	if path != "" || err != nil {
-		return path, err
+	path, diags := getRootEnv(ctx)
+	if path != "" || diags.HasError() {
+		return path, diags
 	}
 	// Note: traversal failing means the bundle root cannot be found.
 	path, _ = getRootWithTraversal()
diff --git a/bundle/root_test.go b/bundle/root_test.go
index 07c9ed20a61..27109f2aeff 100644
--- a/bundle/root_test.go
+++ b/bundle/root_test.go
@@ -15,9 +15,14 @@ func TestRootFromEnv(t *testing.T) {
 	dir := t.TempDir()
 	t.Setenv(env.RootVariable, dir)
 
-	// It should pull the root from the environment variable.
-	root, err := mustGetRoot(ctx)
+	// The bundle root must contain a configuration file.
+	f, err := os.Create(filepath.Join(dir, config.FileNames[0]))
 	require.NoError(t, err)
+	f.Close()
+
+	// It should pull the root from the environment variable.
+	root, diags := mustGetRoot(ctx)
+	require.NoError(t, diags.Error())
 	require.Equal(t, root, dir)
 }
 
@@ -27,8 +32,9 @@ func TestRootFromEnvDoesntExist(t *testing.T) {
 	t.Setenv(env.RootVariable, filepath.Join(dir, "doesntexist"))
 
 	// It should pull the root from the environment variable.
-	_, err := mustGetRoot(ctx)
-	require.Errorf(t, err, "invalid bundle root")
+	_, diags := mustGetRoot(ctx)
+	require.True(t, diags.HasError())
+	require.Contains(t, diags[0].Summary, "Invalid bundle root")
 }
 
 func TestRootFromEnvIsFile(t *testing.T) {
@@ -40,8 +46,9 @@ func TestRootFromEnvIsFile(t *testing.T) {
 	t.Setenv(env.RootVariable, f.Name())
 
 	// It should pull the root from the environment variable.
-	_, err = mustGetRoot(ctx)
-	require.Errorf(t, err, "invalid bundle root")
+	_, diags := mustGetRoot(ctx)
+	require.True(t, diags.HasError())
+	require.Contains(t, diags[0].Summary, "Invalid bundle root")
 }
 
 func TestRootIfEnvIsEmpty(t *testing.T) {
@@ -50,8 +57,9 @@ func TestRootIfEnvIsEmpty(t *testing.T) {
 	t.Setenv(env.RootVariable, dir)
 
 	// It should pull the root from the environment variable.
-	_, err := mustGetRoot(ctx)
-	require.Errorf(t, err, "invalid bundle root")
+	_, diags := mustGetRoot(ctx)
+	require.True(t, diags.HasError())
+	require.Contains(t, diags[0].Summary, "Invalid bundle root")
 }
 
 func TestRootLookup(t *testing.T) {
@@ -82,8 +90,8 @@ func TestRootLookup(t *testing.T) {
 
 	// It should find the project root from $PWD.
 	t.Chdir("./a/b/c")
-	foundRoot, err := mustGetRoot(ctx)
-	require.NoError(t, err)
+	foundRoot, diags := mustGetRoot(ctx)
+	require.NoError(t, diags.Error())
 	foundRoot, err = filepath.EvalSymlinks(foundRoot)
 	require.NoError(t, err)
 	require.Equal(t, root, foundRoot)
@@ -98,6 +106,7 @@ func TestRootLookupError(t *testing.T) {
 
 	// It can't find a project root from a temporary directory.
 	t.Chdir(t.TempDir())
-	_, err := mustGetRoot(ctx)
-	require.ErrorContains(t, err, "unable to locate bundle root")
+	_, diags := mustGetRoot(ctx)
+	require.True(t, diags.HasError())
+	require.Contains(t, diags[0].Summary, "Unable to locate the bundle root")
 }
diff --git a/bundle/run/app.go b/bundle/run/app.go
index 8c0f135cc5d..f7b347710de 100644
--- a/bundle/run/app.go
+++ b/bundle/run/app.go
@@ -11,9 +11,6 @@ import (
 	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/cli/bundle/run/output"
 	"github.com/databricks/cli/libs/cmdio"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/convert"
-	"github.com/databricks/cli/libs/dyn/dynvar"
 	"github.com/databricks/databricks-sdk-go/service/apps"
 	"github.com/spf13/cobra"
 )
@@ -138,59 +135,13 @@ func (a *appRunner) start(ctx context.Context) error {
 
 func (a *appRunner) deploy(ctx context.Context) error {
 	w := a.bundle.WorkspaceClient(ctx)
-	config, err := a.resolvedConfig()
-	if err != nil {
-		return err
-	}
-	deployment := appdeploy.BuildDeployment(a.app.SourceCodePath, config, a.app.GitSource)
+	// source_code_path and config already have their ${resources.*} references resolved
+	// against the deployed state during run setup (see
+	// DeploymentBundle.ResolveConfigAgainstState), so they are usable as-is.
+	deployment := appdeploy.BuildDeployment(a.app.SourceCodePath, a.app.Config, a.app.GitSource)
 	return appdeploy.Deploy(ctx, w, a.app.Name, deployment)
 }
 
-// resolvedConfig returns the app config with any ${resources.*} variable references
-// resolved against the current bundle state. This is needed because the app runtime
-// configuration (env vars, command) can reference other bundle resources whose
-// properties are known only after the initialization phase.
-func (a *appRunner) resolvedConfig() (*resources.AppConfig, error) {
-	if a.app.Config == nil {
-		return nil, nil
-	}
-
-	root := a.bundle.Config.Value()
-
-	// Normalize the full config so that all typed fields are present, even those
-	// not explicitly set. This allows looking up resource properties by path.
-	normalized, _ := convert.Normalize(a.bundle.Config, root, convert.IncludeMissingFields)
-
-	// Get the app's config section as a dyn.Value to resolve references in it.
-	// The key is of the form "apps.<name>", so the full path is "resources.apps.<name>.config".
-	configPath := dyn.MustPathFromString("resources." + a.Key() + ".config")
-	configV, err := dyn.GetByPath(root, configPath)
-	if err != nil || !configV.IsValid() {
-		return a.app.Config, nil //nolint:nilerr // missing config path means use default config
-	}
-
-	resourcesPrefix := dyn.MustPathFromString("resources")
-
-	// Resolve ${resources.*} references in the app config against the full bundle config.
-	// Other variable types (bundle.*, workspace.*, variables.*) are already resolved
-	// during the initialization phase and are left in place if encountered here.
-	resolved, err := dynvar.Resolve(configV, func(path dyn.Path) (dyn.Value, error) {
-		if !path.HasPrefix(resourcesPrefix) {
-			return dyn.InvalidValue, dynvar.ErrSkipResolution
-		}
-		return dyn.GetByPath(normalized, path)
-	})
-	if err != nil {
-		return nil, err
-	}
-
-	var config resources.AppConfig
-	if err := convert.ToTyped(&config, resolved); err != nil {
-		return nil, err
-	}
-	return &config, nil
-}
-
 func (a *appRunner) Cancel(ctx context.Context) error {
 	// We should cancel the app by stopping it.
 	app := a.app
diff --git a/bundle/run/app_test.go b/bundle/run/app_test.go
index ca68d095ea6..76946938ebb 100644
--- a/bundle/run/app_test.go
+++ b/bundle/run/app_test.go
@@ -15,7 +15,7 @@ import (
 	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/cli/bundle/internal/bundletest"
 	"github.com/databricks/cli/libs/cmdio"
-	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/vfs"
 	"github.com/databricks/databricks-sdk-go/experimental/mocks"
 	"github.com/databricks/databricks-sdk-go/service/apps"
@@ -57,9 +57,9 @@ func setupBundle(t *testing.T) (context.Context, *bundle.Bundle, *mocks.MockWork
 				Apps: map[string]*resources.App{
 					"my_app": {
 						App: apps.App{
-							Name: "my_app",
+							Name:           "my_app",
+							SourceCodePath: "./my_app",
 						},
-						SourceCodePath: "./my_app",
 					},
 				},
 			},
@@ -68,7 +68,7 @@ func setupBundle(t *testing.T) (context.Context, *bundle.Bundle, *mocks.MockWork
 
 	mwc := mocks.NewMockWorkspaceClient(t)
 	b.SetWorkpaceClient(mwc.WorkspaceClient)
-	bundletest.SetLocation(b, "resources.apps.my_app", []dyn.Location{{File: filepath.Join(root, "./databricks.yml")}})
+	bundletest.SetLocation(b, "resources.apps.my_app", []diag.Location{{File: filepath.Join(root, "./databricks.yml")}})
 
 	ctx := cmdio.MockDiscard(t.Context())
 
@@ -308,11 +308,11 @@ func TestBuildAppDeploymentWithValueFrom(t *testing.T) {
 	// Regular env var with value
 	require.Equal(t, "REGULAR_VAR", deployment.EnvVars[0].Name)
 	require.Equal(t, "regular_value", deployment.EnvVars[0].Value)
-	require.Equal(t, "", deployment.EnvVars[0].ValueFrom)
+	require.Empty(t, deployment.EnvVars[0].ValueFrom)
 
 	// Env var with value_from
 	require.Equal(t, "SECRET_VAR", deployment.EnvVars[1].Name)
-	require.Equal(t, "", deployment.EnvVars[1].Value)
+	require.Empty(t, deployment.EnvVars[1].Value)
 	require.Equal(t, "secrets/my-secret", deployment.EnvVars[1].ValueFrom)
 
 	// Env var with both value and value_from
diff --git a/bundle/run/job.go b/bundle/run/job.go
index 04b357682fe..98f059e5784 100644
--- a/bundle/run/job.go
+++ b/bundle/run/job.go
@@ -14,6 +14,7 @@ import (
 	"github.com/databricks/cli/bundle/run/progress"
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/workspaceurls"
 	"github.com/databricks/databricks-sdk-go/service/jobs"
 	"github.com/spf13/cobra"
 	"golang.org/x/sync/errgroup"
@@ -96,8 +97,9 @@ func (m *jobRunMonitor) onProgress(info *jobs.Run) {
 
 	// First time we see this run.
 	if m.prevState == nil {
-		log.Infof(m.ctx, "Run available at %s", info.RunPageUrl)
-		cmdio.Log(m.ctx, progress.NewJobRunUrlEvent(info.RunPageUrl))
+		runURL := workspaceurls.ModernizeJobRunPageURL(info.RunPageUrl)
+		log.Infof(m.ctx, "Run available at %s", runURL)
+		cmdio.Log(m.ctx, progress.NewJobRunUrlEvent(runURL))
 	}
 
 	// No state change: do not log.
@@ -157,8 +159,11 @@ func (r *jobRunner) Run(ctx context.Context, opts *Options) (output.RunOutput, e
 		details, err := w.Jobs.GetRun(ctx, jobs.GetRunRequest{
 			RunId: waiter.RunId,
 		})
-		cmdio.Log(ctx, progress.NewJobRunUrlEvent(details.RunPageUrl))
-		return nil, err
+		if err != nil {
+			return nil, err
+		}
+		cmdio.Log(ctx, progress.NewJobRunUrlEvent(workspaceurls.ModernizeJobRunPageURL(details.RunPageUrl)))
+		return nil, nil
 	}
 
 	run, err := waiter.OnProgress(monitor.onProgress).GetWithTimeout(jobRunTimeout)
diff --git a/bundle/run/job_args_test.go b/bundle/run/job_args_test.go
index 41a3c29e23e..ad7433dbb7a 100644
--- a/bundle/run/job_args_test.go
+++ b/bundle/run/job_args_test.go
@@ -11,16 +11,14 @@ import (
 func TestJobParameterArgs(t *testing.T) {
 	a := jobParameterArgs{
 		&resources.Job{
-			JobSettings: jobs.JobSettings{
-				Parameters: []jobs.JobParameterDefinition{
-					{
-						Name:    "foo",
-						Default: "value",
-					},
-					{
-						Name:    "bar",
-						Default: "value",
-					},
+			Parameters: []jobs.JobParameterDefinition{
+				{
+					Name:    "foo",
+					Default: "value",
+				},
+				{
+					Name:    "bar",
+					Default: "value",
 				},
 			},
 		},
@@ -70,14 +68,12 @@ func TestJobParameterArgs(t *testing.T) {
 func TestJobTaskNotebookParamArgs(t *testing.T) {
 	a := jobTaskNotebookParamArgs{
 		&resources.Job{
-			JobSettings: jobs.JobSettings{
-				Tasks: []jobs.Task{
-					{
-						NotebookTask: &jobs.NotebookTask{
-							BaseParameters: map[string]string{
-								"foo": "value",
-								"bar": "value",
-							},
+			Tasks: []jobs.Task{
+				{
+					NotebookTask: &jobs.NotebookTask{
+						BaseParameters: map[string]string{
+							"foo": "value",
+							"bar": "value",
 						},
 					},
 				},
diff --git a/bundle/run/job_options.go b/bundle/run/job_options.go
index 8bbd52acab8..ce5e2004a9e 100644
--- a/bundle/run/job_options.go
+++ b/bundle/run/job_options.go
@@ -34,7 +34,7 @@ type JobOptions struct {
 
 func (o *JobOptions) DefineJobOptions(fs *flag.FlagSet) {
 	fs.StringToStringVar(&o.jobParams, "params", nil, "comma separated k=v pairs for job parameters")
-	fs.StringSliceVar(&o.only, "only", nil, "comma separated list of task keys to run")
+	fs.StringSliceVar(&o.only, "only", nil, "comma separated list of task keys to run. Prefix a key with + to also run its upstream tasks. Suffix with + to also run its downstream tasks")
 }
 
 func (o *JobOptions) DefineTaskOptions(fs *flag.FlagSet) {
diff --git a/bundle/run/job_options_test.go b/bundle/run/job_options_test.go
index f5ae401d1be..e54fdba7e32 100644
--- a/bundle/run/job_options_test.go
+++ b/bundle/run/job_options_test.go
@@ -188,12 +188,10 @@ func TestJobOptionsSqlParamsMultiple(t *testing.T) {
 
 func TestJobOptionsValidateIfJobHasJobParameters(t *testing.T) {
 	job := &resources.Job{
-		JobSettings: jobs.JobSettings{
-			Parameters: []jobs.JobParameterDefinition{
-				{
-					Name:    "param",
-					Default: "value",
-				},
+		Parameters: []jobs.JobParameterDefinition{
+			{
+				Name:    "param",
+				Default: "value",
 			},
 		},
 	}
@@ -219,9 +217,7 @@ func TestJobOptionsValidateIfJobHasJobParameters(t *testing.T) {
 
 func TestJobOptionsValidateIfJobHasNoJobParameters(t *testing.T) {
 	job := &resources.Job{
-		JobSettings: jobs.JobSettings{
-			Parameters: []jobs.JobParameterDefinition{},
-		},
+		Parameters: []jobs.JobParameterDefinition{},
 	}
 
 	{
diff --git a/bundle/run/job_test.go b/bundle/run/job_test.go
index 078b09a9620..0343b09e728 100644
--- a/bundle/run/job_test.go
+++ b/bundle/run/job_test.go
@@ -1,6 +1,7 @@
 package run
 
 import (
+	"errors"
 	"testing"
 	"time"
 
@@ -16,13 +17,11 @@ import (
 
 func TestConvertPythonParams(t *testing.T) {
 	job := &resources.Job{
-		JobSettings: jobs.JobSettings{
-			Tasks: []jobs.Task{
-				{PythonWheelTask: &jobs.PythonWheelTask{
-					PackageName: "my_test_code",
-					EntryPoint:  "run",
-				}},
-			},
+		Tasks: []jobs.Task{
+			{PythonWheelTask: &jobs.PythonWheelTask{
+				PackageName: "my_test_code",
+				EntryPoint:  "run",
+			}},
 		},
 	}
 	b := &bundle.Bundle{
@@ -56,7 +55,7 @@ func TestConvertPythonParams(t *testing.T) {
 
 func TestJobRunnerCancel(t *testing.T) {
 	job := &resources.Job{
-		BaseResource: resources.BaseResource{ID: "123"},
+		ID: "123",
 	}
 	b := &bundle.Bundle{
 		Config: config.Root{
@@ -100,7 +99,7 @@ func TestJobRunnerCancel(t *testing.T) {
 
 func TestJobRunnerCancelWithNoActiveRuns(t *testing.T) {
 	job := &resources.Job{
-		BaseResource: resources.BaseResource{ID: "123"},
+		ID: "123",
 	}
 	b := &bundle.Bundle{
 		Config: config.Root{
@@ -139,8 +138,8 @@ func TestJobRunnerRestart(t *testing.T) {
 		},
 	} {
 		job := &resources.Job{
-			BaseResource: resources.BaseResource{ID: "123"},
-			JobSettings:  jobSettings,
+			ID:          "123",
+			JobSettings: jobSettings,
 		}
 		b := &bundle.Bundle{
 			Config: config.Root{
@@ -203,15 +202,48 @@ func TestJobRunnerRestart(t *testing.T) {
 	}
 }
 
-func TestJobRunnerRestartForContinuousUnpausedJobs(t *testing.T) {
+func TestJobRunnerRunNoWaitGetRunFails(t *testing.T) {
 	job := &resources.Job{
-		BaseResource: resources.BaseResource{ID: "123"},
-		JobSettings: jobs.JobSettings{
-			Continuous: &jobs.Continuous{
-				PauseStatus: jobs.PauseStatusUnpaused,
+		ID: "123",
+	}
+	b := &bundle.Bundle{
+		Config: config.Root{
+			Resources: config.Resources{
+				Jobs: map[string]*resources.Job{
+					"test_job": job,
+				},
 			},
 		},
 	}
+
+	runner := jobRunner{key: "test", bundle: b, job: job}
+
+	m := mocks.NewMockWorkspaceClient(t)
+	b.SetWorkpaceClient(m.WorkspaceClient)
+
+	ctx := cmdio.MockDiscard(t.Context())
+
+	jobApi := m.GetMockJobsAPI()
+	jobApi.EXPECT().RunNow(mock.Anything, jobs.RunNow{
+		JobId: 123,
+	}).Return(&jobs.WaitGetRunJobTerminatedOrSkipped[jobs.RunNowResponse]{RunId: 456}, nil)
+
+	// Run must surface the error instead of dereferencing the nil run details.
+	jobApi.EXPECT().GetRun(mock.Anything, jobs.GetRunRequest{
+		RunId: 456,
+	}).Return(nil, errors.New("transient error"))
+
+	_, err := runner.Run(ctx, &Options{NoWait: true})
+	require.ErrorContains(t, err, "transient error")
+}
+
+func TestJobRunnerRestartForContinuousUnpausedJobs(t *testing.T) {
+	job := &resources.Job{
+		ID: "123",
+		Continuous: &jobs.Continuous{
+			PauseStatus: jobs.PauseStatusUnpaused,
+		},
+	}
 	b := &bundle.Bundle{
 		Config: config.Root{
 			Resources: config.Resources{
diff --git a/bundle/run/output/job_test.go b/bundle/run/output/job_test.go
index 80c52c3e1f7..9ecb7fc43e4 100644
--- a/bundle/run/output/job_test.go
+++ b/bundle/run/output/job_test.go
@@ -110,6 +110,23 @@ func TestNotebookOutputToRunOutput(t *testing.T) {
 	assert.Equal(t, expected, actual)
 }
 
+func TestNotebookOutputWithEmptyResultFallsBackToLogs(t *testing.T) {
+	jobOutput := &jobs.RunOutput{
+		NotebookOutput: &jobs.NotebookOutput{
+			Result: "",
+		},
+		Logs:          "hello :)",
+		LogsTruncated: true,
+	}
+	actual := toRunOutput(jobOutput)
+
+	expected := &LogsOutput{
+		Logs:          "hello :)",
+		LogsTruncated: true,
+	}
+	assert.Equal(t, expected, actual)
+}
+
 func TestDbtOutputToRunOutput(t *testing.T) {
 	jobOutput := &jobs.RunOutput{
 		DbtOutput: &jobs.DbtOutput{
diff --git a/bundle/run/output/task.go b/bundle/run/output/task.go
index 53b989e885f..d30370bb015 100644
--- a/bundle/run/output/task.go
+++ b/bundle/run/output/task.go
@@ -67,6 +67,13 @@ func (out *LogsOutput) String() (string, error) {
 func toRunOutput(output *jobs.RunOutput) RunOutput {
 	switch {
 	case output.NotebookOutput != nil:
+		if output.NotebookOutput.Result == "" && !output.NotebookOutput.Truncated && output.Logs != "" {
+			result := LogsOutput{
+				Logs:          output.Logs,
+				LogsTruncated: output.LogsTruncated,
+			}
+			return &result
+		}
 		result := NotebookOutput(*output.NotebookOutput)
 		return &result
 	case output.DbtOutput != nil:
diff --git a/bundle/run/pipeline.go b/bundle/run/pipeline.go
index 3e801ee2c3b..97b8144d28b 100644
--- a/bundle/run/pipeline.go
+++ b/bundle/run/pipeline.go
@@ -9,6 +9,7 @@ import (
 	"time"
 
 	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
 	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/cli/bundle/run/output"
 	"github.com/databricks/cli/bundle/run/progress"
@@ -94,7 +95,10 @@ func (r *pipelineRunner) Run(ctx context.Context, opts *Options) (output.RunOutp
 	ctx = log.NewContext(ctx, log.GetLogger(ctx).With("resource", r.Key()))
 	w := r.bundle.WorkspaceClient(ctx)
 
-	req, err := opts.Pipeline.toPayload(r.pipeline, pipelineID)
+	// The preset is defaulted to true by "mode: development" and honors an explicit opt-out.
+	development := config.IsExplicitlyEnabled(r.bundle.Config.Presets.PipelinesDevelopment)
+
+	req, err := opts.Pipeline.toPayload(r.pipeline, pipelineID, development)
 	if err != nil {
 		return nil, err
 	}
diff --git a/bundle/run/pipeline_options.go b/bundle/run/pipeline_options.go
index 23fcaa44296..63ff3e81289 100644
--- a/bundle/run/pipeline_options.go
+++ b/bundle/run/pipeline_options.go
@@ -58,7 +58,7 @@ func (o *PipelineOptions) Validate(pipeline *resources.Pipeline) error {
 	return nil
 }
 
-func (o *PipelineOptions) toPayload(pipeline *resources.Pipeline, pipelineID string) (*pipelines.StartUpdate, error) {
+func (o *PipelineOptions) toPayload(pipeline *resources.Pipeline, pipelineID string, development bool) (*pipelines.StartUpdate, error) {
 	if err := o.Validate(pipeline); err != nil {
 		return nil, err
 	}
@@ -70,6 +70,10 @@ func (o *PipelineOptions) toPayload(pipeline *resources.Pipeline, pipelineID str
 		FullRefresh:          o.FullRefreshAll,
 		FullRefreshSelection: o.FullRefresh,
 		ValidateOnly:         o.ValidateOnly,
+
+		// Only true is sent. When false the field is omitted, so the backend keeps
+		// using the pipeline-level development property while it is being deprecated.
+		Development: development,
 	}
 	return payload, nil
 }
diff --git a/bundle/run/pipeline_test.go b/bundle/run/pipeline_test.go
index 56457218468..354216ee490 100644
--- a/bundle/run/pipeline_test.go
+++ b/bundle/run/pipeline_test.go
@@ -17,7 +17,7 @@ import (
 
 func TestPipelineRunnerCancel(t *testing.T) {
 	pipeline := &resources.Pipeline{
-		BaseResource: resources.BaseResource{ID: "123"},
+		ID: "123",
 	}
 
 	b := &bundle.Bundle{
@@ -52,7 +52,7 @@ func TestPipelineRunnerCancel(t *testing.T) {
 
 func TestPipelineRunnerRestart(t *testing.T) {
 	pipeline := &resources.Pipeline{
-		BaseResource: resources.BaseResource{ID: "123"},
+		ID: "123",
 	}
 
 	b := &bundle.Bundle{
diff --git a/bundle/schema/embed_test.go b/bundle/schema/embed_test.go
index 03d2165e420..7f86e8bb697 100644
--- a/bundle/schema/embed_test.go
+++ b/bundle/schema/embed_test.go
@@ -2,6 +2,7 @@ package schema_test
 
 import (
 	"encoding/json"
+	"fmt"
 	"testing"
 
 	"github.com/databricks/cli/bundle/schema"
@@ -64,3 +65,44 @@ func TestJsonSchema(t *testing.T) {
 	assert.Contains(t, providers.OneOf[0].Enum, "gitHubEnterprise")
 	assert.Contains(t, providers.OneOf[0].Enum, "bitbucketServer")
 }
+
+// JSON Schema requires enum values to be unique; strict validators (e.g. OPA)
+// reject the whole schema otherwise. Duplicates slip in when an enum is
+// hand-authored in annotations.yml for a field cli.json also defines, since the
+// annotation merge concatenates the two sequences. Guard the whole schema.
+func TestJsonSchemaEnumsAreUnique(t *testing.T) {
+	var s any
+	err := json.Unmarshal(schema.Bytes, &s)
+	require.NoError(t, err)
+
+	assert.Empty(t, duplicateEnumPaths(s, ""))
+}
+
+func duplicateEnumPaths(v any, path string) []string {
+	var duplicates []string
+	switch v := v.(type) {
+	case map[string]any:
+		if enum, ok := v["enum"].([]any); ok {
+			seen := map[string]struct{}{}
+			for _, item := range enum {
+				key := fmt.Sprintf("%v", item)
+				if _, ok := seen[key]; ok {
+					duplicates = append(duplicates, path)
+					break
+				}
+				seen[key] = struct{}{}
+			}
+		}
+		for key, value := range v {
+			if path != "" {
+				key = path + "/" + key
+			}
+			duplicates = append(duplicates, duplicateEnumPaths(value, key)...)
+		}
+	case []any:
+		for i, value := range v {
+			duplicates = append(duplicates, duplicateEnumPaths(value, fmt.Sprintf("%s[%d]", path, i))...)
+		}
+	}
+	return duplicates
+}
diff --git a/bundle/schema/jsonschema.json b/bundle/schema/jsonschema.json
index ee105a6f821..90a5e8af5d4 100644
--- a/bundle/schema/jsonschema.json
+++ b/bundle/schema/jsonschema.json
@@ -7,23 +7,23 @@
         },
         {
           "type": "string",
-          "pattern": "\\$\\{(resources(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+          "pattern": "\\$\\{(resources(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
         },
         {
           "type": "string",
-          "pattern": "\\$\\{(bundle(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+          "pattern": "\\$\\{(bundle(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
         },
         {
           "type": "string",
-          "pattern": "\\$\\{(workspace(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+          "pattern": "\\$\\{(workspace(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
         },
         {
           "type": "string",
-          "pattern": "\\$\\{(artifacts(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+          "pattern": "\\$\\{(artifacts(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
         },
         {
           "type": "string",
-          "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+          "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
         }
       ]
     },
@@ -34,23 +34,23 @@
         },
         {
           "type": "string",
-          "pattern": "\\$\\{(resources(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+          "pattern": "\\$\\{(resources(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
         },
         {
           "type": "string",
-          "pattern": "\\$\\{(bundle(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+          "pattern": "\\$\\{(bundle(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
         },
         {
           "type": "string",
-          "pattern": "\\$\\{(workspace(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+          "pattern": "\\$\\{(workspace(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
         },
         {
           "type": "string",
-          "pattern": "\\$\\{(artifacts(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+          "pattern": "\\$\\{(artifacts(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
         },
         {
           "type": "string",
-          "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+          "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
         }
       ]
     },
@@ -64,13 +64,15 @@
                   {
                     "type": "string",
                     "enum": [
-                      "terraform",
                       "direct"
+                    ],
+                    "enumDescriptions": [
+                      "Deploy by calling the Databricks APIs directly. This is the default."
                     ]
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
@@ -80,45 +82,78 @@
                     "type": "object",
                     "properties": {
                       "custom_description": {
-                        "$ref": "#/$defs/string"
+                        "description": "Custom description for the alert. support mustache template.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "custom_summary": {
-                        "$ref": "#/$defs/string"
+                        "description": "Custom summary for the alert. support mustache template.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "custom_template_format": {
+                        "description": "[Private Preview] The format used to interpret the `custom_summary` and `custom_description` templates.\n\n`HTML` treats both templates as HTML with Mustache `{{VARIABLE_NAME}}` placeholders.\n`MARKDOWN` treats them as Markdown with allowlisted `@VARIABLE_NAME` placeholders and converts\nthem to the format each notification destination expects, so a single template renders\ncorrectly in email, Slack, and Microsoft Teams.\n\nWhen unset, the API applies no default. Responses omit the field unless a format is stored,\nand a template with no format is rendered as HTML.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.CustomTemplateFormat",
+                        "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                        "doNotSuggest": true
                       },
                       "display_name": {
-                        "$ref": "#/$defs/string"
+                        "description": "The display name of the alert.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "evaluation": {
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.AlertV2Evaluation"
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.AlertV2Evaluation",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "file_path": {
                         "$ref": "#/$defs/string"
                       },
                       "lifecycle": {
+                        "description": "Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.",
                         "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
                       },
+                      "parameters": {
+                        "description": "[Private Preview] A list of parameters to pass into the alert SQL query statement containing parameter markers. Static values only.\n\nReference a parameter in the query text as `:name`. Each parameter must have a unique, non-empty name.\nEach parameter consists of a name, a value, and optionally a type. To represent a NULL\nvalue, the `value` field may be omitted or set to `null` explicitly. If the `type` field\nis omitted, the value is interpreted as a string.\n\nIf the type is given, parameters will be checked for type correctness according\nto the given type. A value is correct if the provided string can be converted to\nthe requested type using the `cast` function. The exact semantics are described in\nthe section [`cast` function](https://docs.databricks.com/sql/language-manual/functions/cast.html) of the SQL language reference.",
+                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/sql.AlertStatementParameter",
+                        "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                        "doNotSuggest": true
+                      },
                       "parent_path": {
-                        "$ref": "#/$defs/string"
+                        "description": "The workspace path of the folder containing the alert. Can only be set on create, and cannot be updated.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "permissions": {
-                        "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.Permission"
+                        "description": "The permissions to apply to this resource.",
+                        "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.Permission",
+                        "markdownDescription": "A Sequence of permissions to apply to this resource, where each item grants a permission `level` to a single `user_name`, `group_name`, or `service_principal_name`. A principal cannot be set in both a resource's `permissions` and the top-level `permissions` mapping.\n\nSee [permissions](https://docs.databricks.com/dev-tools/bundles/settings.html#permissions) and [link](https://docs.databricks.com/dev-tools/bundles/permissions.html)."
                       },
                       "query_text": {
-                        "$ref": "#/$defs/string"
+                        "description": "Text of the query to be run.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "run_as": {
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.AlertV2RunAs"
+                        "description": "Specifies the identity that will be used to run the alert.\nThis field allows you to configure alerts to run as a specific user or service principal.\n- For user identity: Set `user_name` to the email of an active workspace user. Users can only set this to their own email.\n- For service principal: Set `service_principal_name` to the application ID. Requires the `servicePrincipal/user` role.\nIf not specified, the alert will run as the request user.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.AlertV2RunAs",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "run_as_user_name": {
+                        "description": "The run as username or application ID of service principal.\nOn Create and Update, this field can be set to application ID of an active service principal. Setting this field requires the servicePrincipal/user role.\nDeprecated: Use `run_as` field instead. This field will be removed in a future release.",
                         "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA",
                         "deprecationMessage": "This field is deprecated",
                         "deprecated": true
                       },
                       "schedule": {
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.CronSchedule"
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.CronSchedule",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "warehouse_id": {
-                        "$ref": "#/$defs/string"
+                        "description": "ID of the SQL warehouse attached to the alert.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
                       }
                     },
                     "additionalProperties": false,
@@ -132,7 +167,7 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
@@ -142,60 +177,90 @@
                     "type": "object",
                     "properties": {
                       "budget_policy_id": {
-                        "$ref": "#/$defs/string"
+                        "description": "[Public Preview]",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                      },
+                      "compute_max_instances": {
+                        "description": "Maximum number of app instances the app is configured to run. Must be set together with `compute_min_instances`.",
+                        "$ref": "#/$defs/int",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "compute_min_instances": {
+                        "description": "Minimum number of app instances the app is configured to run. Must be set together with `compute_max_instances`.",
+                        "$ref": "#/$defs/int",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "compute_size": {
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.ComputeSize"
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.ComputeSize",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "config": {
                         "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.AppConfig"
                       },
                       "description": {
                         "description": "The description of the app.",
-                        "$ref": "#/$defs/string"
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "forward_user_access_token": {
+                        "description": "[Private Preview] Forward the user's access token to the app. Requires stopping and starting app compute to take effect.",
+                        "$ref": "#/$defs/bool",
+                        "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                        "doNotSuggest": true
                       },
                       "git_repository": {
                         "description": "Git repository configuration for app deployments. When specified, deployments can\nreference code from this repository by providing only the git reference (branch, tag, or commit).",
                         "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.GitRepository",
-                        "x-databricks-preview": "PRIVATE",
-                        "doNotSuggest": true
+                        "x-databricks-launch-stage": "GA"
                       },
                       "git_source": {
                         "description": "Git source configuration for app deployments. Specifies which git reference (branch, tag, or commit)\nto use when deploying the app. Used in conjunction with git_repository to deploy code directly from git.\nThe source_code_path within git_source specifies the relative path to the app code within the repository.",
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.GitSource"
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.GitSource",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "lifecycle": {
-                        "description": "Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.",
+                        "description": "Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.",
                         "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.LifecycleWithStarted"
                       },
                       "name": {
                         "description": "The name of the app. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
-                        "$ref": "#/$defs/string"
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "permissions": {
-                        "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.AppPermission"
+                        "description": "The permissions to apply to this resource.",
+                        "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.AppPermission",
+                        "markdownDescription": "A Sequence of permissions to apply to this resource, where each item grants a permission `level` to a single `user_name`, `group_name`, or `service_principal_name`. A principal cannot be set in both a resource's `permissions` and the top-level `permissions` mapping.\n\nSee [permissions](https://docs.databricks.com/dev-tools/bundles/settings.html#permissions) and [link](https://docs.databricks.com/dev-tools/bundles/permissions.html)."
                       },
                       "resources": {
                         "description": "Resources for the app.",
-                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/apps.AppResource"
+                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/apps.AppResource",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "source_code_path": {
-                        "$ref": "#/$defs/string"
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "space": {
-                        "description": "Name of the space this app belongs to.",
+                        "description": "[Private Preview] Name of the space this app belongs to.",
                         "$ref": "#/$defs/string",
-                        "x-databricks-preview": "PRIVATE",
+                        "x-databricks-launch-stage": "PRIVATE_PREVIEW",
                         "doNotSuggest": true
                       },
                       "telemetry_export_destinations": {
-                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/apps.TelemetryExportDestination"
+                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/apps.TelemetryExportDestination",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "usage_policy_id": {
-                        "$ref": "#/$defs/string"
+                        "description": "[Public Preview]",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                       },
                       "user_api_scopes": {
-                        "$ref": "#/$defs/slice/string"
+                        "description": "[Public Preview]",
+                        "$ref": "#/$defs/slice/string",
+                        "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                       }
                     },
                     "additionalProperties": false,
@@ -205,7 +270,7 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
@@ -225,7 +290,7 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
@@ -251,7 +316,7 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
@@ -261,15 +326,19 @@
                     "type": "object",
                     "properties": {
                       "group_name": {
+                        "description": "The name of the group granted the permission level.",
                         "$ref": "#/$defs/string"
                       },
                       "level": {
+                        "description": "The permission level to apply. The allowed levels depend on the resource type.",
                         "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppPermissionLevel"
                       },
                       "service_principal_name": {
+                        "description": "The name of the service principal granted the permission level.",
                         "$ref": "#/$defs/string"
                       },
                       "user_name": {
+                        "description": "The name of the user granted the permission level.",
                         "$ref": "#/$defs/string"
                       }
                     },
@@ -280,7 +349,7 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
@@ -290,40 +359,63 @@
                     "type": "object",
                     "properties": {
                       "comment": {
-                        "$ref": "#/$defs/string"
+                        "description": "User-provided free-form text description.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "connection_name": {
-                        "$ref": "#/$defs/string"
+                        "description": "The name of the connection to an external data source.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "custom_max_retention_hours": {
+                        "description": "[Public Preview] Custom maximum retention period in hours for the catalog",
+                        "$ref": "#/$defs/int64",
+                        "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                       },
                       "grants": {
-                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/catalog.PrivilegeAssignment"
+                        "description": "The Unity Catalog privileges to grant to principals on this securable.",
+                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/catalog.PrivilegeAssignment",
+                        "markdownDescription": "A Sequence of Unity Catalog privilege grants on this securable, where each item grants a set of `privileges` to a `principal` (a user, group, or service principal).\n\nSee [link](https://docs.databricks.com/data-governance/unity-catalog/manage-privileges/index.html)."
                       },
                       "lifecycle": {
+                        "description": "Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.",
                         "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
                       },
                       "managed_encryption_settings": {
                         "description": "Control CMK encryption for managed catalog data",
                         "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.EncryptionSettings",
-                        "x-databricks-preview": "PRIVATE",
-                        "doNotSuggest": true
+                        "x-databricks-launch-stage": "GA"
                       },
                       "name": {
-                        "$ref": "#/$defs/string"
+                        "description": "Name of catalog.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "options": {
-                        "$ref": "#/$defs/map/string"
+                        "description": "A map of key-value properties attached to the securable.",
+                        "$ref": "#/$defs/map/string",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "properties": {
-                        "$ref": "#/$defs/map/string"
+                        "description": "A map of key-value properties attached to the securable.",
+                        "$ref": "#/$defs/map/string",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "provider_name": {
-                        "$ref": "#/$defs/string"
+                        "description": "The name of delta sharing provider.\n\nA Delta Sharing catalog is a catalog that is based on a Delta share on a remote sharing server.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "share_name": {
-                        "$ref": "#/$defs/string"
+                        "description": "The name of the share under the share provider.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "storage_root": {
-                        "$ref": "#/$defs/string"
+                        "description": "Storage root URL for managed tables within catalog.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
                       }
                     },
                     "additionalProperties": false,
@@ -333,7 +425,7 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
@@ -345,141 +437,191 @@
                     "properties": {
                       "apply_policy_default_values": {
                         "description": "When set to true, fixed and default values from the policy will be used for fields that are omitted. When set to false, only fixed values from the policy will be applied.",
-                        "$ref": "#/$defs/bool"
+                        "$ref": "#/$defs/bool",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "autoscale": {
                         "description": "Parameters needed in order to automatically scale clusters up and down based on load.\nNote: autoscaling works best with DB runtime versions 3.0 or later.",
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.AutoScale"
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.AutoScale",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "autotermination_minutes": {
                         "description": "Automatically terminates the cluster after it is inactive for this time in minutes. If not set,\nthis cluster will not be automatically terminated. If specified, the threshold must be between\n10 and 10000 minutes.\nUsers can also set this value to 0 to explicitly disable automatic termination.",
-                        "$ref": "#/$defs/int"
+                        "$ref": "#/$defs/int",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "aws_attributes": {
                         "description": "Attributes related to clusters running on Amazon Web Services.\nIf not specified at cluster creation, a set of default values will be used.",
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.AwsAttributes"
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.AwsAttributes",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "azure_attributes": {
                         "description": "Attributes related to clusters running on Microsoft Azure.\nIf not specified at cluster creation, a set of default values will be used.",
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.AzureAttributes"
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.AzureAttributes",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "cluster_log_conf": {
                         "description": "The configuration for delivering spark logs to a long-term storage destination.\nThree kinds of destinations (DBFS, S3 and Unity Catalog volumes) are supported. Only one destination can be specified\nfor one cluster. If the conf is given, the logs will be delivered to the destination every\n`5 mins`. The destination of driver logs is `$destination/$clusterId/driver`, while\nthe destination of executor logs is `$destination/$clusterId/executor`.",
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.ClusterLogConf"
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.ClusterLogConf",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "cluster_name": {
                         "description": "Cluster name requested by the user. This doesn't have to be unique.\nIf not specified at creation, the cluster name will be an empty string.\nFor job clusters, the cluster name is automatically set based on the job and job run IDs.",
-                        "$ref": "#/$defs/string"
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "custom_tags": {
                         "description": "Additional tags for cluster resources. Databricks will tag all cluster resources (e.g., AWS\ninstances and EBS volumes) with these tags in addition to `default_tags`. Notes:\n\n- Currently, Databricks allows at most 45 custom tags\n\n- Clusters can only reuse cloud resources if the resources' tags are a subset of the cluster tags",
-                        "$ref": "#/$defs/map/string"
+                        "$ref": "#/$defs/map/string",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "data_security_mode": {
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.DataSecurityMode"
+                        "description": "Data security mode decides what data governance model to use when accessing data\nfrom a cluster.\n\n* `DATA_SECURITY_MODE_AUTO`: Databricks will choose the most appropriate access mode depending on your compute configuration.\n* `DATA_SECURITY_MODE_STANDARD`: A secure cluster that can be shared by multiple users. Cluster users are fully isolated so that they cannot see each other’s data and credentials. Most data governance features are supported in this mode. But programming languages and cluster features might be limited.\n* `DATA_SECURITY_MODE_DEDICATED`: A secure cluster that can only be exclusively used by a single user specified in `single_user_name`. Most programming languages, cluster features and data governance features are available in this mode.\n\nThe following modes are legacy aliases for the above modes:\n\n* `USER_ISOLATION`: Legacy alias for `DATA_SECURITY_MODE_STANDARD`.\n* `SINGLE_USER`: Legacy alias for `DATA_SECURITY_MODE_DEDICATED`.\n\nThe following modes are deprecated starting with Databricks Runtime 15.0 and\nwill be removed for future Databricks Runtime versions:\n\n* `LEGACY_TABLE_ACL`: This mode is for users migrating from legacy Table ACL clusters.\n* `LEGACY_PASSTHROUGH`: This mode is for users migrating from legacy Passthrough on high concurrency clusters.\n* `LEGACY_SINGLE_USER`: This mode is for users migrating from legacy Passthrough on standard clusters.\n* `LEGACY_SINGLE_USER_STANDARD`: This mode provides a way that doesn’t have UC nor passthrough enabled.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.DataSecurityMode",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "dependency_mode": {
+                        "description": "[Beta] Controls dependency configuration for the cluster.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.DependencyMode",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
                       },
                       "docker_image": {
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.DockerImage"
+                        "description": "Custom docker image BYOC",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.DockerImage",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "driver_instance_pool_id": {
                         "description": "The optional ID of the instance pool for the driver of the cluster belongs.\nThe pool cluster uses the instance pool with id (instance_pool_id) if the driver pool is not\nassigned.",
-                        "$ref": "#/$defs/string"
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "driver_node_type_flexibility": {
                         "description": "Flexible node type configuration for the driver node.",
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.NodeTypeFlexibility"
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.NodeTypeFlexibility",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "driver_node_type_id": {
-                        "description": "The node type of the Spark driver.\nNote that this field is optional; if unset, the driver node type will be set as the same value\nas `node_type_id` defined above.\n\nThis field, along with node_type_id, should not be set if virtual_cluster_size is set.\nIf both driver_node_type_id, node_type_id, and virtual_cluster_size are specified, driver_node_type_id and node_type_id take precedence.",
-                        "$ref": "#/$defs/string"
+                        "description": "The node type of the Spark driver.\nNote that this field is optional; if unset, the driver node type will be set as the same value\nas `node_type_id` defined above.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "enable_elastic_disk": {
                         "description": "Autoscaling Local Storage: when enabled, this cluster will dynamically acquire additional disk\nspace when its Spark workers are running low on disk space.",
-                        "$ref": "#/$defs/bool"
+                        "$ref": "#/$defs/bool",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "enable_local_disk_encryption": {
                         "description": "Whether to enable LUKS on cluster VMs' local disks",
-                        "$ref": "#/$defs/bool"
+                        "$ref": "#/$defs/bool",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "gcp_attributes": {
                         "description": "Attributes related to clusters running on Google Cloud Platform.\nIf not specified at cluster creation, a set of default values will be used.",
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.GcpAttributes"
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.GcpAttributes",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "init_scripts": {
                         "description": "The configuration for storing init scripts. Any number of destinations can be specified.\nThe scripts are executed sequentially in the order provided.\nIf `cluster_log_conf` is specified, init script logs are sent to `\u003cdestination\u003e/\u003ccluster-ID\u003e/init_scripts`.",
-                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/compute.InitScriptInfo"
+                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/compute.InitScriptInfo",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "instance_pool_id": {
                         "description": "The optional ID of the instance pool to which the cluster belongs.",
-                        "$ref": "#/$defs/string"
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "is_single_node": {
                         "description": "This field can only be used when `kind = CLASSIC_PREVIEW`.\n\nWhen set to true, Databricks will automatically set single node related `custom_tags`, `spark_conf`, and `num_workers`",
-                        "$ref": "#/$defs/bool"
+                        "$ref": "#/$defs/bool",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "kind": {
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.Kind"
+                        "description": "The kind of compute described by this compute specification.\n\nDepending on `kind`, different validations and default values will be applied.\n\nClusters with `kind = CLASSIC_PREVIEW` support the following fields, whereas clusters with no specified `kind` do not.\n* [is_single_node](/api/workspace/clusters/create#is_single_node)\n* [use_ml_runtime](/api/workspace/clusters/create#use_ml_runtime)\n\nBy using the [simple form](https://docs.databricks.com/compute/simple-form.html), your clusters are automatically using `kind = CLASSIC_PREVIEW`.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.Kind",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "libraries": {
+                        "description": "A list of libraries to install on the cluster. Installed via the Libraries API after the cluster is created.",
+                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/compute.Library"
                       },
                       "lifecycle": {
-                        "description": "Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.",
-                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
+                        "description": "Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.",
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.LifecycleWithStarted"
                       },
                       "node_type_id": {
-                        "description": "This field encodes, through a single value, the resources available to each of\nthe Spark nodes in this cluster. For example, the Spark nodes can be provisioned\nand optimized for memory or compute intensive workloads. A list of available node\ntypes can be retrieved by using the :method:clusters/listNodeTypes API call.",
-                        "$ref": "#/$defs/string"
+                        "description": "This field encodes, through a single value, the resources available to each of\nthe Spark nodes in this cluster. For example, the Spark nodes can be provisioned\nand optimized for memory or compute intensive workloads. A list of available node\ntypes can be retrieved by using the [clusters/listNodeTypes](https://docs.databricks.com/api/workspace/clusters/listnodetypes) API call.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "num_workers": {
                         "description": "Number of worker nodes that this cluster should have. A cluster has one Spark Driver\nand `num_workers` Executors for a total of `num_workers` + 1 Spark nodes.\n\nNote: When reading the properties of a cluster, this field reflects the desired number\nof workers rather than the actual current number of workers. For instance, if a cluster\nis resized from 5 to 10 workers, this field will immediately be updated to reflect\nthe target size of 10 workers, whereas the workers listed in `spark_info` will gradually\nincrease from 5 to 10 as the new nodes are provisioned.",
-                        "$ref": "#/$defs/int"
+                        "$ref": "#/$defs/int",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "permissions": {
-                        "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.ClusterPermission"
+                        "description": "The permissions to apply to this resource.",
+                        "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.ClusterPermission",
+                        "markdownDescription": "A Sequence of permissions to apply to this resource, where each item grants a permission `level` to a single `user_name`, `group_name`, or `service_principal_name`. A principal cannot be set in both a resource's `permissions` and the top-level `permissions` mapping.\n\nSee [permissions](https://docs.databricks.com/dev-tools/bundles/settings.html#permissions) and [link](https://docs.databricks.com/dev-tools/bundles/permissions.html)."
                       },
                       "policy_id": {
                         "description": "The ID of the cluster policy used to create the cluster if applicable.",
-                        "$ref": "#/$defs/string"
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "remote_disk_throughput": {
                         "description": "If set, what the configurable throughput (in Mb/s) for the remote disk is. Currently only supported for GCP HYPERDISK_BALANCED disks.",
-                        "$ref": "#/$defs/int"
+                        "$ref": "#/$defs/int",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "runtime_engine": {
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.RuntimeEngine"
+                        "description": "Determines the cluster's runtime engine, either standard or Photon.\n\nThis field is not compatible with legacy `spark_version` values that contain `-photon-`.\nRemove `-photon-` from the `spark_version` and set `runtime_engine` to `PHOTON`.\n\nIf left unspecified, the runtime engine defaults to standard unless the spark_version\ncontains -photon-, in which case Photon will be used.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.RuntimeEngine",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "single_user_name": {
                         "description": "Single user name if data_security_mode is `SINGLE_USER`",
-                        "$ref": "#/$defs/string"
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "spark_conf": {
                         "description": "An object containing a set of optional, user-specified Spark configuration key-value pairs.\nUsers can also pass in a string of extra JVM options to the driver and the executors via\n`spark.driver.extraJavaOptions` and `spark.executor.extraJavaOptions` respectively.",
-                        "$ref": "#/$defs/map/string"
+                        "$ref": "#/$defs/map/string",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "spark_env_vars": {
                         "description": "An object containing a set of optional, user-specified environment variable key-value pairs.\nPlease note that key-value pair of the form (X,Y) will be exported as is (i.e.,\n`export X='Y'`) while launching the driver and workers.\n\nIn order to specify an additional set of `SPARK_DAEMON_JAVA_OPTS`, we recommend appending\nthem to `$SPARK_DAEMON_JAVA_OPTS` as shown in the example below. This ensures that all\ndefault databricks managed environmental variables are included as well.\n\nExample Spark environment variables:\n`{\"SPARK_WORKER_MEMORY\": \"28000m\", \"SPARK_LOCAL_DIRS\": \"/local_disk0\"}` or\n`{\"SPARK_DAEMON_JAVA_OPTS\": \"$SPARK_DAEMON_JAVA_OPTS -Dspark.shuffle.service.enabled=true\"}`",
-                        "$ref": "#/$defs/map/string"
+                        "$ref": "#/$defs/map/string",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "spark_version": {
-                        "description": "The Spark version of the cluster, e.g. `3.3.x-scala2.11`.\nA list of available Spark versions can be retrieved by using\nthe :method:clusters/sparkVersions API call.",
-                        "$ref": "#/$defs/string"
+                        "description": "The Spark version of the cluster, e.g. `3.3.x-scala2.11`.\nA list of available Spark versions can be retrieved by using\nthe [clusters/sparkVersions](https://docs.databricks.com/api/workspace/clusters/sparkversions) API call.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "ssh_public_keys": {
                         "description": "SSH public key contents that will be added to each Spark node in this cluster. The\ncorresponding private keys can be used to login with the user name `ubuntu` on port `2200`.\nUp to 10 keys can be specified.",
-                        "$ref": "#/$defs/slice/string"
+                        "$ref": "#/$defs/slice/string",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "total_initial_remote_disk_size": {
-                        "description": "If set, what the total initial volume size (in GB) of the remote disks should be. Currently only supported for GCP HYPERDISK_BALANCED disks.",
-                        "$ref": "#/$defs/int"
+                        "description": "If set, what the total initial volume size (in GB) of the remote disks should be. Supported for GCP.",
+                        "$ref": "#/$defs/int",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "use_ml_runtime": {
                         "description": "This field can only be used when `kind = CLASSIC_PREVIEW`.\n\n`effective_spark_version` is determined by `spark_version` (DBR release), this field `use_ml_runtime`, and whether `node_type_id` is gpu node or not.",
-                        "$ref": "#/$defs/bool"
+                        "$ref": "#/$defs/bool",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "worker_node_type_flexibility": {
                         "description": "Flexible node type configuration for worker nodes.",
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.NodeTypeFlexibility"
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.NodeTypeFlexibility",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "workload_type": {
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.WorkloadType"
+                        "description": "Cluster Attributes showing for clusters workload types.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.WorkloadType",
+                        "x-databricks-launch-stage": "GA"
                       }
                     },
                     "additionalProperties": false,
@@ -487,7 +629,7 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
@@ -497,15 +639,109 @@
                     "type": "object",
                     "properties": {
                       "group_name": {
+                        "description": "The name of the group granted the permission level.",
                         "$ref": "#/$defs/string"
                       },
                       "level": {
+                        "description": "The permission level to apply. The allowed levels depend on the resource type.",
                         "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.ClusterPermissionLevel"
                       },
                       "service_principal_name": {
+                        "description": "The name of the service principal granted the permission level.",
+                        "$ref": "#/$defs/string"
+                      },
+                      "user_name": {
+                        "description": "The name of the user granted the permission level.",
+                        "$ref": "#/$defs/string"
+                      }
+                    },
+                    "additionalProperties": false,
+                    "required": [
+                      "level"
+                    ]
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "resources.ClusterPolicy": {
+                "oneOf": [
+                  {
+                    "type": "object",
+                    "properties": {
+                      "definition": {
+                        "description": "Policy definition document expressed in [Databricks Cluster Policy Definition Language](https://docs.databricks.com/administration-guide/clusters/policy-definition.html).",
+                        "$ref": "#/$defs/interface",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "description": {
+                        "description": "Additional human-readable description of the cluster policy.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "libraries": {
+                        "description": "A list of libraries to be installed on the next cluster restart that uses this policy. The maximum number of libraries is 500.",
+                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/compute.Library",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "lifecycle": {
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
+                      },
+                      "max_clusters_per_user": {
+                        "description": "Max number of clusters per user that can be active using this policy. If not present, there is no max limit.",
+                        "$ref": "#/$defs/int64",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "name": {
+                        "description": "Cluster Policy name requested by the user. This has to be unique. Length must be between 1 and 100\ncharacters.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "permissions": {
+                        "description": "The permissions to apply to this resource.",
+                        "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.ClusterPolicyPermission",
+                        "markdownDescription": "A Sequence of permissions to apply to this resource, where each item grants a permission `level` to a single `user_name`, `group_name`, or `service_principal_name`. A principal cannot be set in both a resource's `permissions` and the top-level `permissions` mapping.\n\nSee [permissions](https://docs.databricks.com/dev-tools/bundles/settings.html#permissions) and [link](https://docs.databricks.com/dev-tools/bundles/permissions.html)."
+                      },
+                      "policy_family_definition_overrides": {
+                        "description": "Policy definition JSON document expressed in [Databricks Policy Definition Language](https://docs.databricks.com/administration-guide/clusters/policy-definition.html).\nThe JSON document must be passed as a string and cannot be embedded in the requests.\n\nYou can use this to customize the policy definition inherited from the policy family.\nPolicy rules specified here are merged into the inherited policy definition.",
+                        "$ref": "#/$defs/interface",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "policy_family_id": {
+                        "description": "ID of the policy family. The cluster policy's policy definition inherits the policy\nfamily's policy definition.\n\nCannot be used with `definition`. Use `policy_family_definition_overrides` instead to\ncustomize the policy definition.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      }
+                    },
+                    "additionalProperties": false
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "resources.ClusterPolicyPermission": {
+                "oneOf": [
+                  {
+                    "type": "object",
+                    "properties": {
+                      "group_name": {
+                        "description": "The name of the group granted the permission level.",
+                        "$ref": "#/$defs/string"
+                      },
+                      "level": {
+                        "description": "The permission level to apply. Cluster policies only support `CAN_USE`.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.ClusterPolicyPermissionLevel"
+                      },
+                      "service_principal_name": {
+                        "description": "The name of the service principal granted the permission level.",
                         "$ref": "#/$defs/string"
                       },
                       "user_name": {
+                        "description": "The name of the user granted the permission level.",
                         "$ref": "#/$defs/string"
                       }
                     },
@@ -516,7 +752,7 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
@@ -556,7 +792,7 @@
                         "$ref": "#/$defs/string"
                       },
                       "lifecycle": {
-                        "description": "Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.",
+                        "description": "Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.",
                         "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
                       },
                       "lifecycle_state": {
@@ -572,7 +808,9 @@
                         "$ref": "#/$defs/string"
                       },
                       "permissions": {
-                        "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.Permission"
+                        "description": "The permissions to apply to this resource.",
+                        "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.Permission",
+                        "markdownDescription": "A Sequence of permissions to apply to this resource, where each item grants a permission `level` to a single `user_name`, `group_name`, or `service_principal_name`. A principal cannot be set in both a resource's `permissions` and the top-level `permissions` mapping.\n\nSee [permissions](https://docs.databricks.com/dev-tools/bundles/settings.html#permissions) and [link](https://docs.databricks.com/dev-tools/bundles/permissions.html)."
                       },
                       "serialized_dashboard": {
                         "description": "The contents of the dashboard in serialized string form.\nThis field is excluded in List Dashboards responses.\nUse the [get dashboard API](https://docs.databricks.com/api/workspace/lakeview/get)\nto retrieve an example response, which includes the `serialized_dashboard` field.\nThis field provides the structure of the JSON string that represents the dashboard's\nlayout and components.",
@@ -592,7 +830,7 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
@@ -602,23 +840,28 @@
                     "type": "object",
                     "properties": {
                       "create_database_if_not_exists": {
-                        "$ref": "#/$defs/bool"
+                        "description": "[Public Preview]",
+                        "$ref": "#/$defs/bool",
+                        "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                       },
                       "database_instance_name": {
-                        "description": "The name of the DatabaseInstance housing the database.",
-                        "$ref": "#/$defs/string"
+                        "description": "[Public Preview] The name of the DatabaseInstance housing the database.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                       },
                       "database_name": {
-                        "description": "The name of the database (in a instance) associated with the catalog.",
-                        "$ref": "#/$defs/string"
+                        "description": "[Public Preview] The name of the database (in an instance) associated with the catalog.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                       },
                       "lifecycle": {
-                        "description": "Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.",
+                        "description": "Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.",
                         "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
                       },
                       "name": {
-                        "description": "The name of the catalog in UC.",
-                        "$ref": "#/$defs/string"
+                        "description": "[Public Preview] The name of the catalog in UC.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                       }
                     },
                     "additionalProperties": false,
@@ -630,7 +873,7 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
@@ -641,51 +884,63 @@
                     "description": "A DatabaseInstance represents a logical Postgres instance, comprised of both compute and storage.",
                     "properties": {
                       "capacity": {
-                        "description": "The sku of the instance. Valid values are \"CU_1\", \"CU_2\", \"CU_4\", \"CU_8\".",
-                        "$ref": "#/$defs/string"
+                        "description": "[Public Preview] The sku of the instance. Valid values are \"CU_1\", \"CU_2\", \"CU_4\", \"CU_8\".",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                       },
                       "custom_tags": {
-                        "description": "Custom tags associated with the instance. This field is only included on create and update responses.",
-                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/database.CustomTag"
+                        "description": "[Beta] Custom tags associated with the instance. This field is only included on create and update responses.",
+                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/database.CustomTag",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
                       },
                       "enable_pg_native_login": {
-                        "description": "Whether to enable PG native password login on the instance. Defaults to false.",
-                        "$ref": "#/$defs/bool"
+                        "description": "[Public Preview] Whether to enable PG native password login on the instance. Defaults to false.",
+                        "$ref": "#/$defs/bool",
+                        "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                       },
                       "enable_readable_secondaries": {
-                        "description": "Whether to enable secondaries to serve read-only traffic. Defaults to false.",
-                        "$ref": "#/$defs/bool"
+                        "description": "[Public Preview] Whether to enable secondaries to serve read-only traffic. Defaults to false.",
+                        "$ref": "#/$defs/bool",
+                        "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                       },
                       "lifecycle": {
-                        "description": "Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.",
+                        "description": "Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.",
                         "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
                       },
                       "name": {
-                        "description": "The name of the instance. This is the unique identifier for the instance.",
-                        "$ref": "#/$defs/string"
+                        "description": "[Public Preview] The name of the instance. This is the unique identifier for the instance.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                       },
                       "node_count": {
-                        "description": "The number of nodes in the instance, composed of 1 primary and 0 or more secondaries. Defaults to\n1 primary and 0 secondaries. This field is input only, see effective_node_count for the output.",
-                        "$ref": "#/$defs/int"
+                        "description": "[Public Preview] The number of nodes in the instance, composed of 1 primary and 0 or more secondaries. Defaults to\n1 primary and 0 secondaries. This field is input only, see effective_node_count for the output.",
+                        "$ref": "#/$defs/int",
+                        "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                       },
                       "parent_instance_ref": {
-                        "description": "The ref of the parent instance. This is only available if the instance is\nchild instance.\nInput: For specifying the parent instance to create a child instance. Optional.\nOutput: Only populated if provided as input to create a child instance.",
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/database.DatabaseInstanceRef"
+                        "description": "[Public Preview] The ref of the parent instance. This is only available if the instance is\nchild instance.\nInput: For specifying the parent instance to create a child instance. Optional.\nOutput: Only populated if provided as input to create a child instance.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/database.DatabaseInstanceRef",
+                        "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                       },
                       "permissions": {
-                        "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.Permission"
+                        "description": "The permissions to apply to this resource.",
+                        "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.Permission",
+                        "markdownDescription": "A Sequence of permissions to apply to this resource, where each item grants a permission `level` to a single `user_name`, `group_name`, or `service_principal_name`. A principal cannot be set in both a resource's `permissions` and the top-level `permissions` mapping.\n\nSee [permissions](https://docs.databricks.com/dev-tools/bundles/settings.html#permissions) and [link](https://docs.databricks.com/dev-tools/bundles/permissions.html)."
                       },
                       "retention_window_in_days": {
-                        "description": "The retention window for the instance. This is the time window in days\nfor which the historical data is retained. The default value is 7 days.\nValid values are 2 to 35 days.",
-                        "$ref": "#/$defs/int"
+                        "description": "[Public Preview] The retention window for the instance. This is the time window in days\nfor which the historical data is retained. The default value is 7 days.\nValid values are 2 to 35 days.",
+                        "$ref": "#/$defs/int",
+                        "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                       },
                       "stopped": {
-                        "description": "Whether to stop the instance. An input only param, see effective_stopped for the output.",
-                        "$ref": "#/$defs/bool"
+                        "description": "[Public Preview] Whether to stop the instance. An input only param, see effective_stopped for the output.",
+                        "$ref": "#/$defs/bool",
+                        "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                       },
                       "usage_policy_id": {
-                        "description": "The desired usage policy to associate with the instance.",
-                        "$ref": "#/$defs/string"
+                        "description": "[Beta] The desired usage policy to associate with the instance.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
                       }
                     },
                     "additionalProperties": false,
@@ -695,7 +950,7 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
@@ -705,40 +960,63 @@
                     "type": "object",
                     "properties": {
                       "comment": {
-                        "$ref": "#/$defs/string"
+                        "description": "User-provided free-form text description.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "credential_name": {
-                        "$ref": "#/$defs/string"
+                        "description": "Name of the storage credential used with this location.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "enable_file_events": {
-                        "$ref": "#/$defs/bool"
+                        "description": "Whether to enable file events on this external location. Default to `true`. Set to `false` to disable file events.\nThe actual applied value may differ due to server-side defaults; check `effective_enable_file_events` for the effective state.",
+                        "$ref": "#/$defs/bool",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "encryption_details": {
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.EncryptionDetails"
+                        "description": "Encryption options that apply to clients connecting to cloud storage.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.EncryptionDetails",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "fallback": {
-                        "$ref": "#/$defs/bool"
+                        "description": "Indicates whether fallback mode is enabled for this external location. When fallback mode is enabled, the access to the location falls back to cluster credentials if UC credentials are not sufficient.",
+                        "$ref": "#/$defs/bool",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "file_event_queue": {
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.FileEventQueue"
+                        "description": "File event queue settings. If `enable_file_events` is not `false`, must be defined and have exactly one of the documented properties.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.FileEventQueue",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "grants": {
-                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/catalog.PrivilegeAssignment"
+                        "description": "The Unity Catalog privileges to grant to principals on this securable.",
+                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/catalog.PrivilegeAssignment",
+                        "markdownDescription": "A Sequence of Unity Catalog privilege grants on this securable, where each item grants a set of `privileges` to a `principal` (a user, group, or service principal).\n\nSee [link](https://docs.databricks.com/data-governance/unity-catalog/manage-privileges/index.html)."
                       },
                       "lifecycle": {
+                        "description": "Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.",
                         "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
                       },
                       "name": {
-                        "$ref": "#/$defs/string"
+                        "description": "Name of the external location.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "read_only": {
-                        "$ref": "#/$defs/bool"
+                        "description": "Indicates whether the external location is read-only.",
+                        "$ref": "#/$defs/bool",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "skip_validation": {
-                        "$ref": "#/$defs/bool"
+                        "description": "Skips validation of the storage credential associated with the external location.",
+                        "$ref": "#/$defs/bool",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "url": {
-                        "$ref": "#/$defs/string"
+                        "description": "Path URL of the external location.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
                       }
                     },
                     "additionalProperties": false,
@@ -750,241 +1028,269 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "resources.Job": {
+              "resources.Feature": {
                 "oneOf": [
                   {
                     "type": "object",
                     "properties": {
-                      "budget_policy_id": {
-                        "description": "The id of the user specified budget policy to use for this job.\nIf not specified, a default budget policy may be applied when creating or modifying the job.\nSee `effective_budget_policy_id` for the budget policy used by this workload.",
-                        "$ref": "#/$defs/string"
-                      },
-                      "continuous": {
-                        "description": "An optional continuous property for this job. The continuous property will ensure that there is always one run executing. Only one of `schedule` and `continuous` can be used.",
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.Continuous"
-                      },
                       "description": {
-                        "description": "An optional description for the job. The maximum length is 27700 characters in UTF-8 encoding.",
-                        "$ref": "#/$defs/string"
+                        "description": "The description of the feature.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
                       },
-                      "email_notifications": {
-                        "description": "An optional set of email addresses that is notified when runs of this job begin or complete as well as when this job is deleted.",
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobEmailNotifications"
+                      "entities": {
+                        "description": "The entity columns for the feature, used as aggregation keys and for query-time lookup.\nOptional since entities are not set for RequestSource features or on-demand calculated features.",
+                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/ml.EntityColumn",
+                        "x-databricks-launch-stage": "GA"
                       },
-                      "environments": {
-                        "description": "A list of task execution environment specifications that can be referenced by serverless tasks of this job.\nFor serverless notebook tasks, if the environment_key is not specified, the notebook environment will be used if present. If a jobs environment is specified, it will override the notebook environment.\nFor other serverless tasks, the task environment is required to be specified using environment_key in the task settings.",
-                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.JobEnvironment"
+                      "filter_condition": {
+                        "description": "[Private Preview]",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                        "deprecationMessage": "This field is deprecated",
+                        "doNotSuggest": true,
+                        "deprecated": true
                       },
-                      "git_source": {
-                        "description": "An optional specification for a remote Git repository containing the source code used by tasks. Version-controlled source code is supported by notebook, dbt, Python script, and SQL File tasks.\n\nIf `git_source` is set, these tasks retrieve the file from the remote repository by default. However, this behavior can be overridden by setting `source` to `WORKSPACE` on the task.\n\nNote: dbt and SQL File tasks support only version-controlled sources. If dbt or SQL File tasks are used, `git_source` must be defined on the job.",
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.GitSource"
+                      "full_name": {
+                        "description": "The full three-part name (catalog, schema, name) of the feature.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
                       },
-                      "health": {
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobsHealthRules"
+                      "function": {
+                        "description": "The function by which the feature is computed.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.Function",
+                        "x-databricks-launch-stage": "GA"
                       },
-                      "job_clusters": {
-                        "description": "A list of job cluster specifications that can be shared and reused by tasks of this job. Libraries cannot be declared in a shared job cluster. You must declare dependent libraries in task settings.",
-                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.JobCluster"
+                      "inputs": {
+                        "description": "[Private Preview]",
+                        "$ref": "#/$defs/slice/string",
+                        "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                        "deprecationMessage": "This field is deprecated",
+                        "doNotSuggest": true,
+                        "deprecated": true
                       },
                       "lifecycle": {
-                        "description": "Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.",
                         "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
                       },
-                      "max_concurrent_runs": {
-                        "description": "An optional maximum allowed number of concurrent runs of the job.\nSet this value if you want to be able to execute multiple runs of the same job concurrently.\nThis is useful for example if you trigger your job on a frequent schedule and want to allow consecutive runs to overlap with each other, or if you want to trigger multiple runs which differ by their input parameters.\nThis setting affects only new runs. For example, suppose the job’s concurrency is 4 and there are 4 concurrent active runs. Then setting the concurrency to 3 won’t kill any of the active runs.\nHowever, from then on, new runs are skipped unless there are fewer than 3 active runs.\nThis value cannot exceed 1000. Setting this value to `0` causes all new runs to be skipped.",
-                        "$ref": "#/$defs/int"
-                      },
-                      "name": {
-                        "description": "An optional name for the job. The maximum length is 4096 bytes in UTF-8 encoding.",
-                        "$ref": "#/$defs/string"
-                      },
-                      "notification_settings": {
-                        "description": "Optional notification settings that are used when sending notifications to each of the `email_notifications` and `webhook_notifications` for this job.",
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobNotificationSettings"
-                      },
-                      "parameters": {
-                        "description": "Job-level parameter definitions",
-                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.JobParameterDefinition"
-                      },
-                      "performance_target": {
-                        "description": "The performance mode on a serverless job. This field determines the level of compute performance or cost-efficiency for the run.\nThe performance target does not apply to tasks that run on Serverless GPU compute.\n\n* `STANDARD`: Enables cost-efficient execution of serverless workloads.\n* `PERFORMANCE_OPTIMIZED`: Prioritizes fast startup and execution times through rapid scaling and optimized cluster performance.",
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PerformanceTarget"
-                      },
-                      "permissions": {
-                        "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.JobPermission"
-                      },
-                      "queue": {
-                        "description": "The queue settings of the job.",
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.QueueSettings"
-                      },
-                      "run_as": {
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobRunAs"
-                      },
-                      "schedule": {
-                        "description": "An optional periodic schedule for this job. The default behavior is that the job only runs when triggered by clicking “Run Now” in the Jobs UI or sending an API request to `runNow`.",
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.CronSchedule"
-                      },
-                      "tags": {
-                        "description": "A map of tags associated with the job. These are forwarded to the cluster as cluster tags for jobs clusters, and are subject to the same limitations as cluster tags. A maximum of 25 tags can be added to the job.",
-                        "$ref": "#/$defs/map/string"
-                      },
-                      "tasks": {
-                        "description": "A list of task specifications to be executed by this job.\nIt supports up to 1000 elements in write endpoints (:method:jobs/create, :method:jobs/reset, :method:jobs/update, :method:jobs/submit).\nRead endpoints return only 100 tasks. If more than 100 tasks are available, you can paginate through them using :method:jobs/get. Use the `next_page_token` field at the object root to determine if more results are available.",
-                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.Task"
-                      },
-                      "timeout_seconds": {
-                        "description": "An optional timeout applied to each run of this job. A value of `0` means no timeout.",
-                        "$ref": "#/$defs/int"
+                      "lineage_context": {
+                        "description": "[Private Preview] Lineage context information for this feature.\nWARNING: This field is primarily intended for internal use by Databricks systems and\nis automatically populated when features are created through Databricks notebooks or jobs.\nUsers should not manually set this field as incorrect values may lead to inaccurate lineage tracking or unexpected behavior.\nThis field will be set by feature-engineering client and should be left unset by SDK and terraform users.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.LineageContext",
+                        "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                        "doNotSuggest": true
                       },
-                      "trigger": {
-                        "description": "A configuration to trigger a run when certain conditions are met. The default behavior is that the job runs only when triggered by clicking “Run Now” in the Jobs UI or sending an API request to `runNow`.",
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.TriggerSettings"
+                      "source": {
+                        "description": "The data source of the feature.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.DataSource",
+                        "x-databricks-launch-stage": "GA"
                       },
-                      "usage_policy_id": {
-                        "description": "The id of the user specified usage policy to use for this job.\nIf not specified, a default usage policy may be applied when creating or modifying the job.\nSee `effective_usage_policy_id` for the usage policy used by this workload.",
-                        "$ref": "#/$defs/string",
-                        "x-databricks-preview": "PRIVATE",
-                        "doNotSuggest": true
+                      "time_window": {
+                        "description": "[Private Preview]",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.TimeWindow",
+                        "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                        "deprecationMessage": "This field is deprecated",
+                        "doNotSuggest": true,
+                        "deprecated": true
                       },
-                      "webhook_notifications": {
-                        "description": "A collection of system notification IDs to notify when runs of this job begin or complete.",
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.WebhookNotifications"
+                      "timeseries_column": {
+                        "description": "Column recording time, used for point-in-time joins, backfills, and aggregations.\nOptional since a timeseries column is not set for RequestSource features or on-demand\ncalculated features.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.TimeseriesColumn",
+                        "x-databricks-launch-stage": "GA"
                       }
                     },
                     "additionalProperties": false,
-                    "markdownDescription": "The job resource allows you to define [jobs and their corresponding tasks](https://docs.databricks.com/api/workspace/jobs/create) in your bundle. For information about jobs, see [link](https://docs.databricks.com/jobs/index.html). For a tutorial that uses a Declarative Automation Bundles template to create a job, see [link](https://docs.databricks.com/dev-tools/bundles/jobs-tutorial.html)."
+                    "required": [
+                      "full_name",
+                      "function",
+                      "source"
+                    ]
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "resources.JobPermission": {
+              "resources.GenieSpace": {
                 "oneOf": [
                   {
                     "type": "object",
                     "properties": {
-                      "group_name": {
+                      "description": {
+                        "description": "Description of the Genie space shown alongside the title in the Databricks UI.",
                         "$ref": "#/$defs/string"
                       },
-                      "level": {
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobPermissionLevel"
+                      "etag": {
+                        "$ref": "#/$defs/string"
                       },
-                      "service_principal_name": {
+                      "file_path": {
+                        "description": "Local path to a `.geniespace.json` file holding the serialized Genie space definition. The contents are inlined into `serialized_space` at deploy time. Mutually exclusive with an inline `serialized_space`.",
                         "$ref": "#/$defs/string"
                       },
-                      "user_name": {
+                      "lifecycle": {
+                        "description": "Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.",
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
+                      },
+                      "parent_path": {
+                        "description": "Workspace folder under which to create the Genie space. Immutable: changing this field recreates the resource.",
+                        "$ref": "#/$defs/string"
+                      },
+                      "permissions": {
+                        "description": "The permissions to apply to this resource.",
+                        "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.Permission",
+                        "markdownDescription": "A Sequence of permissions to apply to this resource, where each item grants a permission `level` to a single `user_name`, `group_name`, or `service_principal_name`. A principal cannot be set in both a resource's `permissions` and the top-level `permissions` mapping.\n\nSee [permissions](https://docs.databricks.com/dev-tools/bundles/settings.html#permissions) and [link](https://docs.databricks.com/dev-tools/bundles/permissions.html)."
+                      },
+                      "serialized_space": {
+                        "description": "Serialized Genie space body. May be provided inline as a JSON string (or YAML that will be marshalled to JSON) or referenced via `file_path`. To round-trip an existing space into a bundle, use `databricks bundle generate genie-space`.",
+                        "$ref": "#/$defs/interface"
+                      },
+                      "title": {
+                        "description": "Title of the Genie space shown in the Databricks UI.",
+                        "$ref": "#/$defs/string"
+                      },
+                      "warehouse_id": {
+                        "description": "ID of the SQL warehouse used to run queries for this Genie space.",
                         "$ref": "#/$defs/string"
                       }
                     },
-                    "additionalProperties": false,
-                    "required": [
-                      "level"
-                    ]
-                  },
-                  {
-                    "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
-                  }
-                ]
-              },
-              "resources.Lifecycle": {
-                "oneOf": [
-                  {
-                    "type": "object",
-                    "properties": {
-                      "prevent_destroy": {
-                        "description": "Lifecycle setting to prevent the resource from being destroyed.",
-                        "$ref": "#/$defs/bool"
-                      }
-                    },
                     "additionalProperties": false
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "resources.LifecycleWithStarted": {
+              "resources.InstancePool": {
                 "oneOf": [
                   {
                     "type": "object",
                     "properties": {
-                      "prevent_destroy": {
-                        "description": "Lifecycle setting to prevent the resource from being destroyed.",
-                        "$ref": "#/$defs/bool"
+                      "aws_attributes": {
+                        "description": "Attributes related to instance pools running on Amazon Web Services.\nIf not specified at pool creation, a set of default values will be used.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.InstancePoolAwsAttributes",
+                        "x-databricks-launch-stage": "GA"
                       },
-                      "started": {
-                        "description": "Lifecycle setting to deploy the resource in started mode. Only supported for apps, clusters, and sql_warehouses in direct deployment mode.",
-                        "$ref": "#/$defs/bool"
-                      }
-                    },
-                    "additionalProperties": false
-                  },
-                  {
-                    "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
-                  }
-                ]
-              },
-              "resources.MlflowExperiment": {
-                "oneOf": [
-                  {
-                    "type": "object",
-                    "properties": {
-                      "artifact_location": {
-                        "description": "Location where all artifacts for the experiment are stored.\nIf not provided, the remote server will select an appropriate default.",
-                        "$ref": "#/$defs/string"
+                      "azure_attributes": {
+                        "description": "Attributes related to instance pools running on Azure.\nIf not specified at pool creation, a set of default values will be used.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.InstancePoolAzureAttributes",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "custom_tags": {
+                        "description": "Additional tags for pool resources. Databricks will tag all pool resources (e.g., AWS\ninstances and EBS volumes) with these tags in addition to `default_tags`. Notes:\n\n- Currently, Databricks allows at most 45 custom tags",
+                        "$ref": "#/$defs/map/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "disk_spec": {
+                        "description": "Defines the specification of the disks that will be attached to all spark containers.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.DiskSpec",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "enable_elastic_disk": {
+                        "description": "Autoscaling Local Storage: when enabled, this instances in this pool will dynamically acquire\nadditional disk space when its Spark workers are running low on disk space. In AWS, this\nfeature requires specific AWS permissions to function correctly - refer to the User Guide for\nmore details.",
+                        "$ref": "#/$defs/bool",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "gcp_attributes": {
+                        "description": "Attributes related to instance pools running on Google Cloud Platform.\nIf not specified at pool creation, a set of default values will be used.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.InstancePoolGcpAttributes",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "idle_instance_autotermination_minutes": {
+                        "description": "Automatically terminates the extra instances in the pool cache after they are inactive for this\ntime in minutes if min_idle_instances requirement is already met. If not set, the extra pool\ninstances will be automatically terminated after a default timeout. If specified, the\nthreshold must be between 0 and 10000 minutes.\nUsers can also set this value to 0 to instantly remove idle instances from the cache if\nmin cache size could still hold.",
+                        "$ref": "#/$defs/int",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "instance_pool_name": {
+                        "description": "Pool name requested by the user. Pool name must be unique. Length must be between 1 and 100\ncharacters.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "lifecycle": {
-                        "description": "Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.",
+                        "description": "Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.",
                         "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
                       },
-                      "name": {
-                        "description": "Experiment name.",
-                        "$ref": "#/$defs/string"
+                      "max_capacity": {
+                        "description": "Maximum number of outstanding instances to keep in the pool, including both instances used by\nclusters and idle instances. Clusters that require further instance provisioning will fail during\nupsize requests.",
+                        "$ref": "#/$defs/int",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "min_idle_instances": {
+                        "description": "Minimum number of idle instances to keep in the instance pool",
+                        "$ref": "#/$defs/int",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "node_type_flexibility": {
+                        "description": "Flexible node type configuration for the pool.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.NodeTypeFlexibility",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "node_type_id": {
+                        "description": "This field encodes, through a single value, the resources available to each of\nthe Spark nodes in this cluster. For example, the Spark nodes can be provisioned\nand optimized for memory or compute intensive workloads. A list of available node\ntypes can be retrieved by using the [clusters/listNodeTypes](https://docs.databricks.com/api/workspace/clusters/listnodetypes) API call.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "permissions": {
-                        "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.MlflowExperimentPermission"
+                        "description": "The permissions to apply to this resource.",
+                        "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.InstancePoolPermission",
+                        "markdownDescription": "A Sequence of permissions to apply to this resource, where each item grants a permission `level` to a single `user_name`, `group_name`, or `service_principal_name`. A principal cannot be set in both a resource's `permissions` and the top-level `permissions` mapping.\n\nSee [permissions](https://docs.databricks.com/dev-tools/bundles/settings.html#permissions) and [link](https://docs.databricks.com/dev-tools/bundles/permissions.html)."
                       },
-                      "tags": {
-                        "description": "A collection of tags to set on the experiment. Maximum tag size and number of tags per request\ndepends on the storage backend. All storage backends are guaranteed to support tag keys up\nto 250 bytes in size and tag values up to 5000 bytes in size. All storage backends are also\nguaranteed to support up to 20 tags per request.",
-                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/ml.ExperimentTag"
+                      "preloaded_docker_images": {
+                        "description": "Custom Docker Image BYOC",
+                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/compute.DockerImage",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "preloaded_spark_versions": {
+                        "description": "A list containing at most one preloaded Spark image version for the pool. Pool-backed clusters started\nwith the preloaded Spark version will start faster. A list of available Spark versions\ncan be retrieved by using the [clusters/sparkVersions](https://docs.databricks.com/api/workspace/clusters/sparkversions) API call.",
+                        "$ref": "#/$defs/slice/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "remote_disk_throughput": {
+                        "description": "If set, what the configurable throughput (in Mb/s) for the remote disk is. Currently only supported for GCP HYPERDISK_BALANCED types.",
+                        "$ref": "#/$defs/int",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "total_initial_remote_disk_size": {
+                        "description": "If set, what the total initial volume size (in GB) of the remote disks should be. Currently only supported for GCP HYPERDISK_BALANCED types.",
+                        "$ref": "#/$defs/int",
+                        "x-databricks-launch-stage": "GA"
                       }
                     },
                     "additionalProperties": false,
                     "required": [
-                      "name"
+                      "instance_pool_name",
+                      "node_type_id"
                     ],
-                    "markdownDescription": "The experiment resource allows you to define [MLflow experiments](https://docs.databricks.com/api/workspace/experiments/createexperiment) in a bundle. For information about MLflow experiments, see [link](https://docs.databricks.com/mlflow/experiments.html)."
+                    "markdownDescription": "The instance pool resource defines an [instance pool](https://docs.databricks.com/api/workspace/instancepools/create), a set of idle, ready-to-use cloud instances that reduce cluster start and auto-scaling times."
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "resources.MlflowExperimentPermission": {
+              "resources.InstancePoolPermission": {
                 "oneOf": [
                   {
                     "type": "object",
                     "properties": {
                       "group_name": {
+                        "description": "The name of the group granted the permission level.",
                         "$ref": "#/$defs/string"
                       },
                       "level": {
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.ExperimentPermissionLevel"
+                        "description": "The permission level to apply. The allowed levels depend on the resource type.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.InstancePoolPermissionLevel"
                       },
                       "service_principal_name": {
+                        "description": "The name of the service principal granted the permission level.",
                         "$ref": "#/$defs/string"
                       },
                       "user_name": {
+                        "description": "The name of the user granted the permission level.",
                         "$ref": "#/$defs/string"
                       }
                     },
@@ -995,62 +1301,186 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "resources.MlflowModel": {
+              "resources.Job": {
                 "oneOf": [
                   {
                     "type": "object",
                     "properties": {
+                      "budget_policy_id": {
+                        "description": "[Public Preview] The id of the user specified budget policy to use for this job.\nIf not specified, a default budget policy may be applied when creating or modifying the job.\nSee `effective_budget_policy_id` for the budget policy used by this workload.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                      },
+                      "continuous": {
+                        "description": "An optional continuous property for this job. The continuous property will ensure that there is always one run executing. Only one of `schedule` and `continuous` can be used.\n\nPipelines started by a continuous job also run continuously, regardless of their own pipeline mode setting.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.Continuous",
+                        "x-databricks-launch-stage": "GA"
+                      },
                       "description": {
-                        "description": "Optional description for registered model.",
-                        "$ref": "#/$defs/string"
+                        "description": "An optional description for the job. The maximum length is 27700 characters in UTF-8 encoding.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "duration_target": {
+                        "description": "[Private Preview] The window the run aims to finish within, in hours, for a Cost-optimized serverless run.\nRequired only when `performance_target` is `COST_OPTIMIZED`. Must be one of the\nsupported values: `NO_FLEXIBILITY`, `4h`, `12h`, `24h`, `72h`. `NO_FLEXIBILITY` means the run\nuses the default cost-optimized performance level without additional cost-saving optimizations.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                        "doNotSuggest": true
+                      },
+                      "email_notifications": {
+                        "description": "An optional set of email addresses that is notified when runs of this job begin or complete as well as when this job is deleted.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobEmailNotifications",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "environment_variables": {
+                        "description": "[Beta] Named environment-variable entries that tasks can reference by key from\n`TaskSettings.environment_variables_key`. Each entry's `spec` holds inline\n`variables` and optional `.env` `files`. Maximum 10 entries per job. A task\ncan reference at most one entry from this list.",
+                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.JobEnvironmentVariables",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
+                      },
+                      "environments": {
+                        "description": "A list of task execution environment specifications that can be referenced by tasks that use serverless compute or a compute resource that uses Environments mode.\n\nFor notebook tasks that use serverless compute or a compute resource that uses Environments mode, if the environment_key is not specified, the notebook environment will be used if present. If a jobs environment is specified, it will override the notebook environment.\nFor other tasks that use serverless compute or a compute resource that uses Environments mode, the task environment is required to be specified using environment_key in the task settings.",
+                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.JobEnvironment",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "git_source": {
+                        "description": "An optional specification for a remote Git repository containing the source code used by tasks. Version-controlled source code is supported by notebook, dbt, Python script, and SQL File tasks.\n\nIf `git_source` is set, these tasks retrieve the file from the remote repository by default. However, this behavior can be overridden by setting `source` to `WORKSPACE` on the task.\n\nNote: dbt and SQL File tasks support only version-controlled sources. If dbt or SQL File tasks are used, `git_source` must be defined on the job.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.GitSource",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "health": {
+                        "description": "An optional set of health rules that can be defined for this job.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobsHealthRules",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "job_clusters": {
+                        "description": "A list of job cluster specifications that can be shared and reused by tasks of this job. Libraries cannot be declared in a shared job cluster. You must declare dependent libraries in task settings.",
+                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.JobCluster",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "lifecycle": {
-                        "description": "Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.",
+                        "description": "Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.",
                         "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
                       },
+                      "max_concurrent_runs": {
+                        "description": "An optional maximum allowed number of concurrent runs of the job.\nSet this value if you want to be able to execute multiple runs of the same job concurrently.\nThis is useful for example if you trigger your job on a frequent schedule and want to allow consecutive runs to overlap with each other, or if you want to trigger multiple runs which differ by their input parameters.\nThis setting affects only new runs. For example, suppose the job’s concurrency is 4 and there are 4 concurrent active runs. Then setting the concurrency to 3 won’t kill any of the active runs.\nHowever, from then on, new runs are skipped unless there are fewer than 3 active runs.\nThis value cannot exceed 1000. Setting this value to `0` causes all new runs to be skipped.",
+                        "$ref": "#/$defs/int",
+                        "x-databricks-launch-stage": "GA"
+                      },
                       "name": {
-                        "description": "Register models under this name",
-                        "$ref": "#/$defs/string"
+                        "description": "An optional name for the job. The maximum length is 4096 bytes in UTF-8 encoding.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "notification_settings": {
+                        "description": "Optional notification settings that are used when sending notifications to each of the `email_notifications` and `webhook_notifications` for this job.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobNotificationSettings",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "parameters": {
+                        "description": "Job-level parameter definitions",
+                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.JobParameterDefinition",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "parent_path": {
+                        "description": "[Private Preview] Path of the job parent folder in workspace file tree. If absent, the job doesn't have a workspace object.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                        "doNotSuggest": true
+                      },
+                      "performance_target": {
+                        "description": "The performance mode on a serverless job. This field determines the level of compute performance or cost-efficiency for the run.\nThe performance target does not apply to tasks that run on Serverless GPU compute.\n\n* `PERFORMANCE_OPTIMIZED`: Prioritizes fast startup and execution times through rapid scaling and optimized cluster performance.\n* `STANDARD`: Enables cost-efficient execution of serverless workloads.\n* `COST_OPTIMIZED`: Enables lower job costs by optimizing compute for your selected target duration time. Must provide a duration target.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PerformanceTarget",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "permissions": {
-                        "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.MlflowModelPermission"
+                        "description": "The permissions to apply to this resource.",
+                        "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.JobPermission",
+                        "markdownDescription": "A Sequence of permissions to apply to this resource, where each item grants a permission `level` to a single `user_name`, `group_name`, or `service_principal_name`. A principal cannot be set in both a resource's `permissions` and the top-level `permissions` mapping.\n\nSee [permissions](https://docs.databricks.com/dev-tools/bundles/settings.html#permissions) and [link](https://docs.databricks.com/dev-tools/bundles/permissions.html)."
+                      },
+                      "queue": {
+                        "description": "The queue settings of the job.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.QueueSettings",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "run_as": {
+                        "description": "The user or service principal that the job runs as, if specified in the request.\nThis field indicates the explicit configuration of `run_as` for the job.\nTo find the value in all cases, explicit or implicit, use `run_as_user_name`.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobRunAs",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "schedule": {
+                        "description": "An optional periodic schedule for this job. The default behavior is that the job only runs when triggered by clicking “Run Now” in the Jobs UI or sending an API request to `runNow`.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.CronSchedule",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "tags": {
-                        "description": "Additional metadata for registered model.",
-                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/ml.ModelTag"
+                        "description": "A map of tags associated with the job. These are forwarded to the cluster as cluster tags for jobs clusters, and are subject to the same limitations as cluster tags. A maximum of 25 tags can be added to the job.",
+                        "$ref": "#/$defs/map/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "tasks": {
+                        "description": "A list of task specifications to be executed by this job.\nIt supports up to 1000 elements in write endpoints (:method:jobs/create, :method:jobs/reset, :method:jobs/update, :method:jobs/submit).\nRead endpoints return only 100 tasks. If more than 100 tasks are available, you can paginate through them using :method:jobs/get. Use the `next_page_token` field at the object root to determine if more results are available.",
+                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.Task",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "timeout_seconds": {
+                        "description": "An optional timeout applied to each run of this job. A value of `0` means no timeout.",
+                        "$ref": "#/$defs/int",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "trigger": {
+                        "description": "A configuration to trigger a run when certain conditions are met. The default behavior is that the job runs only when triggered by clicking “Run Now” in the Jobs UI or sending an API request to `runNow`.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.TriggerSettings",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "triggers": {
+                        "description": "[Beta] List of triggers attached to this job. A run starts when any active trigger evaluates to true. Cannot be set in\nthe same request as the legacy `schedule`, `trigger`, or `continuous` fields. Gated behind the \"Multiple Triggers\" feature preview.",
+                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.TriggerConfiguration",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
+                      },
+                      "usage_policy_id": {
+                        "description": "[Private Preview] The id of the user specified usage policy to use for this job.\nIf not specified, a default usage policy may be applied when creating or modifying the job.\nSee `effective_usage_policy_id` for the usage policy used by this workload.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                        "doNotSuggest": true
+                      },
+                      "webhook_notifications": {
+                        "description": "A collection of system notification IDs to notify when runs of this job begin or complete.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.WebhookNotifications",
+                        "x-databricks-launch-stage": "GA"
                       }
                     },
                     "additionalProperties": false,
-                    "required": [
-                      "name"
-                    ],
-                    "markdownDescription": "The model resource allows you to define [legacy models](https://docs.databricks.com/api/workspace/modelregistry/createmodel) in bundles. Databricks recommends you use Unity Catalog [registered models](https://docs.databricks.com/dev-tools/bundles/reference.html#registered-model) instead."
+                    "markdownDescription": "The job resource allows you to define [jobs and their corresponding tasks](https://docs.databricks.com/api/workspace/jobs/create) in your bundle. For information about jobs, see [link](https://docs.databricks.com/jobs/index.html). For a tutorial that uses a Declarative Automation Bundles template to create a job, see [link](https://docs.databricks.com/dev-tools/bundles/jobs-tutorial.html)."
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "resources.MlflowModelPermission": {
+              "resources.JobPermission": {
                 "oneOf": [
                   {
                     "type": "object",
                     "properties": {
                       "group_name": {
+                        "description": "The name of the group granted the permission level.",
                         "$ref": "#/$defs/string"
                       },
                       "level": {
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.RegisteredModelPermissionLevel"
+                        "description": "The permission level to apply. The allowed levels depend on the resource type.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobPermissionLevel"
                       },
                       "service_principal_name": {
+                        "description": "The name of the service principal granted the permission level.",
                         "$ref": "#/$defs/string"
                       },
                       "user_name": {
+                        "description": "The name of the user granted the permission level.",
                         "$ref": "#/$defs/string"
                       }
                     },
@@ -1061,296 +1491,310 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "resources.ModelServingEndpoint": {
+              "resources.JobRun": {
                 "oneOf": [
                   {
                     "type": "object",
                     "properties": {
-                      "ai_gateway": {
-                        "description": "The AI Gateway configuration for the serving endpoint. NOTE: External model, provisioned throughput, and pay-per-token endpoints are fully supported; agent endpoints currently only support inference tables.",
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AiGatewayConfig"
+                      "dbt_commands": {
+                        "description": "[Private Preview] An array of commands to execute for jobs with the dbt task, for example `\"dbt_commands\": [\"dbt deps\", \"dbt seed\", \"dbt deps\", \"dbt seed\", \"dbt run\"]`\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.",
+                        "$ref": "#/$defs/slice/string",
+                        "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                        "deprecationMessage": "This field is deprecated",
+                        "doNotSuggest": true,
+                        "deprecated": true
                       },
-                      "budget_policy_id": {
-                        "description": "The budget policy to be applied to the serving endpoint.",
-                        "$ref": "#/$defs/string"
+                      "duration_target": {
+                        "description": "[Private Preview] The window the run aims to finish within, in hours, for a Cost-optimized serverless run.\nRequired only when `performance_target` is `COST_OPTIMIZED`. Must be one of the\nsupported values: `NO_FLEXIBILITY`, `4h`, `12h`, `24h`, `72h`. `NO_FLEXIBILITY` means the run\nuses the default cost-optimized performance level without additional cost-saving optimizations.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                        "doNotSuggest": true
                       },
-                      "config": {
-                        "description": "The core config of the serving endpoint.",
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.EndpointCoreConfigInput"
+                      "jar_params": {
+                        "description": "[Private Preview] A list of parameters for jobs with Spark JAR tasks, for example `\"jar_params\": [\"john doe\", \"35\"]`.\nThe parameters are used to invoke the main function of the main class specified in the Spark JAR task.\nIf not specified upon `run-now`, it defaults to an empty list.\njar_params cannot be specified in conjunction with notebook_params.\nThe JSON representation of this field (for example `{\"jar_params\":[\"john doe\",\"35\"]}`) cannot exceed 10,000 bytes.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.",
+                        "$ref": "#/$defs/slice/string",
+                        "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                        "deprecationMessage": "This field is deprecated",
+                        "doNotSuggest": true,
+                        "deprecated": true
                       },
-                      "description": {
-                        "$ref": "#/$defs/string"
+                      "job_id": {
+                        "description": "The ID of the job to be executed",
+                        "$ref": "#/$defs/int64",
+                        "x-databricks-launch-stage": "GA"
                       },
-                      "email_notifications": {
-                        "description": "Email notification settings.",
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.EmailNotifications"
+                      "job_parameters": {
+                        "description": "Job-level parameters used in the run. for example `\"param\": \"overriding_val\"`",
+                        "$ref": "#/$defs/map/string",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "lifecycle": {
-                        "description": "Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.",
-                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
+                        "description": "Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed and when the run re-fires.",
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.JobRunLifecycle"
                       },
-                      "name": {
-                        "description": "The name of the serving endpoint. This field is required and must be unique across a Databricks workspace.\nAn endpoint name can consist of alphanumeric characters, dashes, and underscores.",
-                        "$ref": "#/$defs/string"
+                      "notebook_params": {
+                        "description": "[Private Preview] A map from keys to values for jobs with notebook task, for example `\"notebook_params\": {\"name\": \"john doe\", \"age\": \"35\"}`.\nThe map is passed to the notebook and is accessible through the [dbutils.widgets.get](https://docs.databricks.com/dev-tools/databricks-utils.html) function.\n\nIf not specified upon `run-now`, the triggered run uses the job’s base parameters.\n\nnotebook_params cannot be specified in conjunction with jar_params.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.\n\nThe JSON representation of this field (for example `{\"notebook_params\":{\"name\":\"john doe\",\"age\":\"35\"}}`) cannot exceed 10,000 bytes.",
+                        "$ref": "#/$defs/map/string",
+                        "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                        "deprecationMessage": "This field is deprecated",
+                        "doNotSuggest": true,
+                        "deprecated": true
                       },
-                      "permissions": {
-                        "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.ModelServingEndpointPermission"
+                      "only": {
+                        "description": "A list of task keys to run inside of the job. If this field is not provided, all tasks in the job will be run.\n\nPrefix a task key with `+` to also run its upstream tasks, or suffix it with `+` to also run its downstream tasks.\nFor example, `+my_task` runs `my_task` and everything upstream of it, `my_task+` runs `my_task` and everything\ndownstream of it, and `+my_task+` runs both. A task key with no `+` runs only that task.",
+                        "$ref": "#/$defs/slice/string",
+                        "x-databricks-launch-stage": "GA"
                       },
-                      "rate_limits": {
-                        "description": "Rate limits to be applied to the serving endpoint. NOTE: this field is deprecated, please use AI Gateway to manage rate limits.",
-                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/serving.RateLimit",
+                      "performance_target": {
+                        "description": "The performance mode on a serverless job. The performance target determines the level of compute performance or cost-efficiency for the run. This field overrides the performance target defined on the job level.\n\n* `PERFORMANCE_OPTIMIZED`: Prioritizes fast startup and execution times through rapid scaling and optimized cluster performance.\n* `STANDARD`: Enables cost-efficient execution of serverless workloads.\n* `COST_OPTIMIZED`: Enables lower job costs by optimizing compute for your selected target duration time. Must provide a duration target.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PerformanceTarget",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "pipeline_params": {
+                        "description": "Controls whether the pipeline should perform a full refresh",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PipelineParams",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "python_named_params": {
+                        "description": "[Private Preview]",
+                        "$ref": "#/$defs/map/string",
+                        "x-databricks-launch-stage": "PRIVATE_PREVIEW",
                         "deprecationMessage": "This field is deprecated",
+                        "doNotSuggest": true,
                         "deprecated": true
                       },
-                      "route_optimized": {
-                        "description": "Enable route optimization for the serving endpoint.",
-                        "$ref": "#/$defs/bool"
+                      "python_params": {
+                        "description": "[Private Preview] A list of parameters for jobs with Python tasks, for example `\"python_params\": [\"john doe\", \"35\"]`.\nThe parameters are passed to Python file as command-line parameters. If specified upon `run-now`, it would overwrite\nthe parameters specified in job setting. The JSON representation of this field (for example `{\"python_params\":[\"john doe\",\"35\"]}`)\ncannot exceed 10,000 bytes.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.\n\nImportant\n\nThese parameters accept only Latin characters (ASCII character set). Using non-ASCII characters returns an error.\nExamples of invalid, non-ASCII characters are Chinese, Japanese kanjis, and emojis.",
+                        "$ref": "#/$defs/slice/string",
+                        "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                        "deprecationMessage": "This field is deprecated",
+                        "doNotSuggest": true,
+                        "deprecated": true
                       },
-                      "tags": {
-                        "description": "Tags to be attached to the serving endpoint and automatically propagated to billing logs.",
-                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/serving.EndpointTag"
+                      "queue": {
+                        "description": "The queue settings of the run.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.QueueSettings",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "spark_submit_params": {
+                        "description": "[Private Preview] A list of parameters for jobs with spark submit task, for example `\"spark_submit_params\": [\"--class\", \"org.apache.spark.examples.SparkPi\"]`.\nThe parameters are passed to spark-submit script as command-line parameters. If specified upon `run-now`, it would overwrite the\nparameters specified in job setting. The JSON representation of this field (for example `{\"python_params\":[\"john doe\",\"35\"]}`)\ncannot exceed 10,000 bytes.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.\n\nImportant\n\nThese parameters accept only Latin characters (ASCII character set). Using non-ASCII characters returns an error.\nExamples of invalid, non-ASCII characters are Chinese, Japanese kanjis, and emojis.",
+                        "$ref": "#/$defs/slice/string",
+                        "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                        "deprecationMessage": "This field is deprecated",
+                        "doNotSuggest": true,
+                        "deprecated": true
+                      },
+                      "sql_params": {
+                        "description": "[Private Preview] A map from keys to values for jobs with SQL task, for example `\"sql_params\": {\"name\": \"john doe\", \"age\": \"35\"}`. The SQL alert task does not support custom parameters.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.",
+                        "$ref": "#/$defs/map/string",
+                        "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                        "deprecationMessage": "This field is deprecated",
+                        "doNotSuggest": true,
+                        "deprecated": true
                       }
                     },
                     "additionalProperties": false,
                     "required": [
-                      "name"
-                    ],
-                    "markdownDescription": "The model_serving_endpoint resource allows you to define [model serving endpoints](https://docs.databricks.com/api/workspace/servingendpoints/create). See [link](https://docs.databricks.com/machine-learning/model-serving/manage-serving-endpoints.html)."
+                      "job_id"
+                    ]
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "resources.ModelServingEndpointPermission": {
+              "resources.JobRunLifecycle": {
                 "oneOf": [
                   {
                     "type": "object",
                     "properties": {
-                      "group_name": {
-                        "$ref": "#/$defs/string"
-                      },
-                      "level": {
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.ServingEndpointPermissionLevel"
-                      },
-                      "service_principal_name": {
-                        "$ref": "#/$defs/string"
+                      "prevent_destroy": {
+                        "description": "Lifecycle setting to prevent the resource from being destroyed.",
+                        "$ref": "#/$defs/bool"
                       },
-                      "user_name": {
-                        "$ref": "#/$defs/string"
+                      "triggers": {
+                        "description": "Conditions that re-fire this job run (in addition to configuration changes).",
+                        "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.JobRunTrigger"
                       }
                     },
-                    "additionalProperties": false,
-                    "required": [
-                      "level"
-                    ]
+                    "additionalProperties": false
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "resources.Permission": {
+              "resources.JobRunTrigger": {
                 "oneOf": [
                   {
                     "type": "object",
                     "properties": {
-                      "group_name": {
-                        "description": "The name of the group that has the permission set in level.",
-                        "$ref": "#/$defs/string"
-                      },
-                      "level": {
-                        "description": "The allowed permission for user, group, service principal defined for this permission.",
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/iam.PermissionLevel"
-                      },
-                      "service_principal_name": {
-                        "description": "The name of the service principal that has the permission set in level.",
-                        "$ref": "#/$defs/string"
+                      "on_bundle_deploy": {
+                        "description": "If true, re-fire the run on every bundle deploy.",
+                        "$ref": "#/$defs/bool"
                       },
-                      "user_name": {
-                        "description": "The name of the user that has the permission set in level.",
+                      "on_file_change": {
+                        "description": "Path or glob relative to the defining YAML file. It must resolve under the sync root. Re-fire the run when a matched file's content hash changes, or when the set of matches appears or disappears. Only files the bundle syncs are hashed, so .gitignore and sync.exclude apply. Use * to match a single directory level; ** is not supported.",
                         "$ref": "#/$defs/string"
                       }
                     },
-                    "additionalProperties": false,
-                    "required": [
-                      "level"
-                    ]
+                    "additionalProperties": false
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "resources.Pipeline": {
+              "resources.Lifecycle": {
                 "oneOf": [
                   {
                     "type": "object",
                     "properties": {
-                      "allow_duplicate_names": {
-                        "description": "If false, deployment will fail if name conflicts with that of another pipeline.",
+                      "prevent_destroy": {
+                        "description": "Lifecycle setting to prevent the resource from being destroyed.",
                         "$ref": "#/$defs/bool"
-                      },
-                      "budget_policy_id": {
-                        "description": "Budget policy of this pipeline.",
-                        "$ref": "#/$defs/string"
-                      },
-                      "catalog": {
-                        "description": "A catalog in Unity Catalog to publish data from this pipeline to. If `target` is specified, tables in this pipeline are published to a `target` schema inside `catalog` (for example, `catalog`.`target`.`table`). If `target` is not specified, no data is published to Unity Catalog.",
-                        "$ref": "#/$defs/string"
-                      },
-                      "channel": {
-                        "description": "DLT Release Channel that specifies which version to use.",
-                        "$ref": "#/$defs/string"
-                      },
-                      "clusters": {
-                        "description": "Cluster settings for this pipeline deployment.",
-                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/pipelines.PipelineCluster"
-                      },
-                      "configuration": {
-                        "description": "String-String configuration for this pipeline execution.",
-                        "$ref": "#/$defs/map/string"
-                      },
-                      "continuous": {
-                        "description": "Whether the pipeline is continuous or triggered. This replaces `trigger`.",
+                      }
+                    },
+                    "additionalProperties": false
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "resources.LifecycleWithStarted": {
+                "oneOf": [
+                  {
+                    "type": "object",
+                    "properties": {
+                      "prevent_destroy": {
+                        "description": "Lifecycle setting to prevent the resource from being destroyed.",
                         "$ref": "#/$defs/bool"
                       },
-                      "development": {
-                        "description": "Whether the pipeline is in Development mode. Defaults to false.",
+                      "started": {
+                        "description": "Lifecycle setting to deploy the resource in started mode. Only supported for apps, clusters, and sql_warehouses.",
                         "$ref": "#/$defs/bool"
-                      },
-                      "edition": {
-                        "description": "Pipeline product edition.",
+                      }
+                    },
+                    "additionalProperties": false
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "resources.McpService": {
+                "oneOf": [
+                  {
+                    "type": "object",
+                    "properties": {
+                      "comment": {
                         "$ref": "#/$defs/string"
                       },
-                      "environment": {
-                        "description": "Environment specification for this pipeline used to install dependencies.",
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.PipelinesEnvironment"
-                      },
-                      "event_log": {
-                        "description": "Event log configuration for this pipeline",
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.EventLogSpec"
+                      "config": {
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.McpServiceConfig"
                       },
-                      "filters": {
-                        "description": "Filters on which Pipeline packages to include in the deployed graph.",
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.Filters"
+                      "grants": {
+                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/catalog.PrivilegeAssignment"
                       },
-                      "gateway_definition": {
-                        "description": "The definition of a gateway pipeline to support change data capture.",
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.IngestionGatewayPipelineDefinition",
-                        "x-databricks-preview": "PRIVATE",
-                        "doNotSuggest": true
+                      "lifecycle": {
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
                       },
-                      "id": {
-                        "description": "Unique identifier for this pipeline.",
+                      "mcp_service_id": {
                         "$ref": "#/$defs/string"
                       },
-                      "ingestion_definition": {
-                        "description": "The configuration for a managed ingestion pipeline. These settings cannot be used with the 'libraries', 'schema', 'target', or 'catalog' settings.",
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.IngestionPipelineDefinition"
-                      },
-                      "libraries": {
-                        "description": "Libraries or code needed by this deployment.",
-                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/pipelines.PipelineLibrary"
+                      "parent": {
+                        "$ref": "#/$defs/string"
+                      }
+                    },
+                    "additionalProperties": false,
+                    "required": [
+                      "parent",
+                      "mcp_service_id"
+                    ]
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "resources.MlflowExperiment": {
+                "oneOf": [
+                  {
+                    "type": "object",
+                    "properties": {
+                      "artifact_location": {
+                        "description": "Location where all artifacts for the experiment are stored.\nIf not provided, the remote server will select an appropriate default.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "lifecycle": {
-                        "description": "Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.",
+                        "description": "Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.",
                         "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
                       },
                       "name": {
-                        "description": "Friendly identifier for this pipeline.",
-                        "$ref": "#/$defs/string"
-                      },
-                      "notifications": {
-                        "description": "List of notification settings for this pipeline.",
-                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/pipelines.Notifications"
+                        "description": "Experiment name.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "permissions": {
-                        "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.PipelinePermission"
-                      },
-                      "photon": {
-                        "description": "Whether Photon is enabled for this pipeline.",
-                        "$ref": "#/$defs/bool"
-                      },
-                      "restart_window": {
-                        "description": "Restart window of this pipeline.",
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.RestartWindow",
-                        "x-databricks-preview": "PRIVATE",
-                        "doNotSuggest": true
-                      },
-                      "root_path": {
-                        "description": "Root path for this pipeline.\nThis is used as the root directory when editing the pipeline in the Databricks user interface and it is\nadded to sys.path when executing Python sources during pipeline execution.",
-                        "$ref": "#/$defs/string"
-                      },
-                      "run_as": {
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.RunAs"
-                      },
-                      "schema": {
-                        "description": "The default schema (database) where tables are read from or published to.",
-                        "$ref": "#/$defs/string"
-                      },
-                      "serverless": {
-                        "description": "Whether serverless compute is enabled for this pipeline.",
-                        "$ref": "#/$defs/bool"
-                      },
-                      "storage": {
-                        "description": "DBFS root directory for storing checkpoints and tables.",
-                        "$ref": "#/$defs/string"
+                        "description": "The permissions to apply to this resource.",
+                        "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.MlflowExperimentPermission",
+                        "markdownDescription": "A Sequence of permissions to apply to this resource, where each item grants a permission `level` to a single `user_name`, `group_name`, or `service_principal_name`. A principal cannot be set in both a resource's `permissions` and the top-level `permissions` mapping.\n\nSee [permissions](https://docs.databricks.com/dev-tools/bundles/settings.html#permissions) and [link](https://docs.databricks.com/dev-tools/bundles/permissions.html)."
                       },
                       "tags": {
-                        "description": "A map of tags associated with the pipeline.\nThese are forwarded to the cluster as cluster tags, and are therefore subject to the same limitations.\nA maximum of 25 tags can be added to the pipeline.",
-                        "$ref": "#/$defs/map/string"
-                      },
-                      "target": {
-                        "description": "Target schema (database) to add tables in this pipeline to. Exactly one of `schema` or `target` must be specified. To publish to Unity Catalog, also specify `catalog`. This legacy field is deprecated for pipeline creation in favor of the `schema` field.",
-                        "$ref": "#/$defs/string",
-                        "deprecationMessage": "This field is deprecated",
-                        "deprecated": true
-                      },
-                      "trigger": {
-                        "description": "Which pipeline trigger to use. Deprecated: Use `continuous` instead.",
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.PipelineTrigger",
-                        "deprecationMessage": "Use continuous instead",
-                        "deprecated": true
+                        "description": "A collection of tags to set on the experiment. Maximum tag size and number of tags per request\ndepends on the storage backend. All storage backends are guaranteed to support tag keys up\nto 250 bytes in size and tag values up to 5000 bytes in size. All storage backends are also\nguaranteed to support up to 20 tags per request.",
+                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/ml.ExperimentTag",
+                        "x-databricks-launch-stage": "GA"
                       },
-                      "usage_policy_id": {
-                        "description": "Usage policy of this pipeline.",
-                        "$ref": "#/$defs/string",
-                        "x-databricks-preview": "PRIVATE",
+                      "trace_location": {
+                        "description": "[Private Preview] The location where the experiment's traces are stored. When set, the\nunderlying storage is provisioned and the experiment's traces are routed\nto it. When unset, traces are stored in the default MLflow backend. This\nfield cannot be updated after the experiment is created.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.ExperimentTraceLocation",
+                        "x-databricks-launch-stage": "PRIVATE_PREVIEW",
                         "doNotSuggest": true
                       }
                     },
                     "additionalProperties": false,
-                    "markdownDescription": "This resource allows you to create [pipelines](https://docs.databricks.com/api/workspace/pipelines/create). For information about pipelines, see [link](https://docs.databricks.com/dlt/index.html). For a tutorial that uses the Declarative Automation Bundles template to create a pipeline, see [link](https://docs.databricks.com/dev-tools/bundles/pipelines-tutorial.html)."
+                    "required": [
+                      "name"
+                    ],
+                    "markdownDescription": "The experiment resource allows you to define [MLflow experiments](https://docs.databricks.com/api/workspace/experiments/createexperiment) in a bundle. For information about MLflow experiments, see [link](https://docs.databricks.com/mlflow/experiments.html)."
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "resources.PipelinePermission": {
+              "resources.MlflowExperimentPermission": {
                 "oneOf": [
                   {
                     "type": "object",
                     "properties": {
                       "group_name": {
+                        "description": "The name of the group granted the permission level.",
                         "$ref": "#/$defs/string"
                       },
                       "level": {
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.PipelinePermissionLevel"
+                        "description": "The permission level to apply. The allowed levels depend on the resource type.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.ExperimentPermissionLevel"
                       },
                       "service_principal_name": {
+                        "description": "The name of the service principal granted the permission level.",
                         "$ref": "#/$defs/string"
                       },
                       "user_name": {
+                        "description": "The name of the user granted the permission level.",
                         "$ref": "#/$defs/string"
                       }
                     },
@@ -1361,414 +1805,287 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "resources.PostgresBranch": {
+              "resources.MlflowModel": {
                 "oneOf": [
                   {
                     "type": "object",
                     "properties": {
-                      "branch_id": {
-                        "$ref": "#/$defs/string"
-                      },
-                      "expire_time": {
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/common/types/time.Time"
-                      },
-                      "is_protected": {
-                        "$ref": "#/$defs/bool"
+                      "description": {
+                        "description": "Optional description for registered model.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "lifecycle": {
+                        "description": "Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.",
                         "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
                       },
-                      "no_expiry": {
-                        "$ref": "#/$defs/bool"
+                      "name": {
+                        "description": "Register models under this name",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
                       },
-                      "parent": {
-                        "$ref": "#/$defs/string"
+                      "permissions": {
+                        "description": "The permissions to apply to this resource.",
+                        "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.MlflowModelPermission",
+                        "markdownDescription": "A Sequence of permissions to apply to this resource, where each item grants a permission `level` to a single `user_name`, `group_name`, or `service_principal_name`. A principal cannot be set in both a resource's `permissions` and the top-level `permissions` mapping.\n\nSee [permissions](https://docs.databricks.com/dev-tools/bundles/settings.html#permissions) and [link](https://docs.databricks.com/dev-tools/bundles/permissions.html)."
                       },
-                      "source_branch": {
+                      "tags": {
+                        "description": "Additional metadata for registered model.",
+                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/ml.ModelTag",
+                        "x-databricks-launch-stage": "GA"
+                      }
+                    },
+                    "additionalProperties": false,
+                    "required": [
+                      "name"
+                    ],
+                    "markdownDescription": "The model resource allows you to define [legacy models](https://docs.databricks.com/api/workspace/modelregistry/createmodel) in bundles. Databricks recommends you use Unity Catalog [registered models](https://docs.databricks.com/dev-tools/bundles/reference.html#registered-model) instead."
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "resources.MlflowModelPermission": {
+                "oneOf": [
+                  {
+                    "type": "object",
+                    "properties": {
+                      "group_name": {
+                        "description": "The name of the group granted the permission level.",
                         "$ref": "#/$defs/string"
                       },
-                      "source_branch_lsn": {
-                        "$ref": "#/$defs/string"
+                      "level": {
+                        "description": "The permission level to apply. The allowed levels depend on the resource type.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.RegisteredModelPermissionLevel"
                       },
-                      "source_branch_time": {
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/common/types/time.Time"
+                      "service_principal_name": {
+                        "description": "The name of the service principal granted the permission level.",
+                        "$ref": "#/$defs/string"
                       },
-                      "ttl": {
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/common/types/duration.Duration"
+                      "user_name": {
+                        "description": "The name of the user granted the permission level.",
+                        "$ref": "#/$defs/string"
                       }
                     },
                     "additionalProperties": false,
                     "required": [
-                      "branch_id",
-                      "parent"
+                      "level"
                     ]
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "resources.PostgresEndpoint": {
+              "resources.ModelProviderService": {
                 "oneOf": [
                   {
                     "type": "object",
                     "properties": {
-                      "autoscaling_limit_max_cu": {
-                        "$ref": "#/$defs/float64"
-                      },
-                      "autoscaling_limit_min_cu": {
-                        "$ref": "#/$defs/float64"
-                      },
-                      "disabled": {
-                        "$ref": "#/$defs/bool"
-                      },
-                      "endpoint_id": {
+                      "comment": {
                         "$ref": "#/$defs/string"
                       },
-                      "endpoint_type": {
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/postgres.EndpointType"
+                      "config": {
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfig"
                       },
-                      "group": {
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/postgres.EndpointGroupSpec"
+                      "grants": {
+                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/catalog.PrivilegeAssignment"
                       },
                       "lifecycle": {
                         "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
                       },
-                      "no_suspension": {
-                        "$ref": "#/$defs/bool"
+                      "model_provider_service_id": {
+                        "$ref": "#/$defs/string"
                       },
                       "parent": {
                         "$ref": "#/$defs/string"
-                      },
-                      "settings": {
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/postgres.EndpointSettings"
-                      },
-                      "suspend_timeout_duration": {
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/common/types/duration.Duration"
                       }
                     },
                     "additionalProperties": false,
                     "required": [
-                      "endpoint_id",
                       "parent",
-                      "endpoint_type"
+                      "model_provider_service_id"
                     ]
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "resources.PostgresProject": {
+              "resources.ModelService": {
                 "oneOf": [
                   {
                     "type": "object",
                     "properties": {
-                      "budget_policy_id": {
-                        "$ref": "#/$defs/string"
-                      },
-                      "custom_tags": {
-                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/postgres.ProjectCustomTag"
-                      },
-                      "default_branch": {
-                        "$ref": "#/$defs/string"
-                      },
-                      "default_endpoint_settings": {
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/postgres.ProjectDefaultEndpointSettings"
-                      },
-                      "display_name": {
+                      "comment": {
                         "$ref": "#/$defs/string"
                       },
-                      "enable_pg_native_login": {
-                        "$ref": "#/$defs/bool"
+                      "config": {
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelServiceConfig"
                       },
-                      "history_retention_duration": {
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/common/types/duration.Duration"
+                      "grants": {
+                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/catalog.PrivilegeAssignment"
                       },
                       "lifecycle": {
                         "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
                       },
-                      "permissions": {
-                        "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.Permission"
-                      },
-                      "pg_version": {
-                        "$ref": "#/$defs/int"
+                      "model_service_id": {
+                        "$ref": "#/$defs/string"
                       },
-                      "project_id": {
+                      "parent": {
                         "$ref": "#/$defs/string"
                       }
                     },
                     "additionalProperties": false,
                     "required": [
-                      "project_id"
+                      "parent",
+                      "model_service_id"
                     ]
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "resources.QualityMonitor": {
+              "resources.ModelServingEndpoint": {
                 "oneOf": [
                   {
                     "type": "object",
                     "properties": {
-                      "assets_dir": {
-                        "description": "[Create:REQ Update:IGN] Field for specifying the absolute path to a custom directory to store data-monitoring\nassets. Normally prepopulated to a default user location via UI and Python APIs.",
-                        "$ref": "#/$defs/string"
-                      },
-                      "baseline_table_name": {
-                        "description": "[Create:OPT Update:OPT] Baseline table name.\nBaseline data is used to compute drift from the data in the monitored `table_name`.\nThe baseline table and the monitored table shall have the same schema.",
-                        "$ref": "#/$defs/string"
+                      "ai_gateway": {
+                        "description": "The AI Gateway configuration for the serving endpoint. NOTE: External model, provisioned throughput, and pay-per-token endpoints are fully supported; agent endpoints currently only support inference tables.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AiGatewayConfig",
+                        "x-databricks-launch-stage": "GA"
                       },
-                      "custom_metrics": {
-                        "description": "[Create:OPT Update:OPT] Custom metrics.",
-                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/catalog.MonitorMetric"
-                      },
-                      "data_classification_config": {
-                        "description": "[Create:OPT Update:OPT] Data classification related config.",
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.MonitorDataClassificationConfig",
-                        "x-databricks-preview": "PRIVATE",
-                        "doNotSuggest": true
-                      },
-                      "inference_log": {
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.MonitorInferenceLog"
-                      },
-                      "latest_monitor_failure_msg": {
-                        "description": "[Create:ERR Update:IGN] The latest error message for a monitor failure.",
-                        "$ref": "#/$defs/string"
-                      },
-                      "lifecycle": {
-                        "description": "Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.",
-                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
-                      },
-                      "notifications": {
-                        "description": "[Create:OPT Update:OPT] Field for specifying notification settings.",
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.MonitorNotifications"
-                      },
-                      "output_schema_name": {
-                        "description": "[Create:REQ Update:REQ] Schema where output tables are created. Needs to be in 2-level format {catalog}.{schema}",
-                        "$ref": "#/$defs/string"
-                      },
-                      "schedule": {
-                        "description": "[Create:OPT Update:OPT] The monitor schedule.",
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.MonitorCronSchedule"
-                      },
-                      "skip_builtin_dashboard": {
-                        "description": "Whether to skip creating a default dashboard summarizing data quality metrics.",
-                        "$ref": "#/$defs/bool"
-                      },
-                      "slicing_exprs": {
-                        "description": "[Create:OPT Update:OPT] List of column expressions to slice data with for targeted analysis. The data is grouped by\neach expression independently, resulting in a separate slice for each predicate and its\ncomplements. For example `slicing_exprs=[“col_1”, “col_2 \u003e 10”]` will generate the following\nslices: two slices for `col_2 \u003e 10` (True and False), and one slice per unique value in\n`col1`. For high-cardinality columns, only the top 100 unique values by frequency will\ngenerate slices.",
-                        "$ref": "#/$defs/slice/string"
-                      },
-                      "snapshot": {
-                        "description": "Configuration for monitoring snapshot tables.",
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.MonitorSnapshot"
-                      },
-                      "table_name": {
-                        "$ref": "#/$defs/string"
-                      },
-                      "time_series": {
-                        "description": "Configuration for monitoring time series tables.",
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.MonitorTimeSeries"
-                      },
-                      "warehouse_id": {
-                        "description": "Optional argument to specify the warehouse for dashboard creation. If not specified, the first running\nwarehouse will be used.",
-                        "$ref": "#/$defs/string"
-                      }
-                    },
-                    "additionalProperties": false,
-                    "required": [
-                      "table_name",
-                      "assets_dir",
-                      "output_schema_name"
-                    ],
-                    "markdownDescription": "The quality_monitor resource allows you to define a Unity Catalog [table monitor](https://docs.databricks.com/api/workspace/qualitymonitors/create). For information about monitors, see [link](https://docs.databricks.com/machine-learning/model-serving/monitor-diagnose-endpoints.html)."
-                  },
-                  {
-                    "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
-                  }
-                ]
-              },
-              "resources.RegisteredModel": {
-                "oneOf": [
-                  {
-                    "type": "object",
-                    "properties": {
-                      "aliases": {
-                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/catalog.RegisteredModelAlias"
-                      },
-                      "browse_only": {
-                        "$ref": "#/$defs/bool"
-                      },
-                      "catalog_name": {
-                        "description": "The name of the catalog where the schema and the registered model reside",
-                        "$ref": "#/$defs/string"
-                      },
-                      "comment": {
-                        "description": "The comment attached to the registered model",
-                        "$ref": "#/$defs/string"
-                      },
-                      "created_at": {
-                        "$ref": "#/$defs/int64"
+                      "budget_policy_id": {
+                        "description": "The budget policy to be applied to the serving endpoint.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
                       },
-                      "created_by": {
-                        "$ref": "#/$defs/string"
+                      "config": {
+                        "description": "The core config of the serving endpoint.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.EndpointCoreConfigInput",
+                        "x-databricks-launch-stage": "GA"
                       },
-                      "full_name": {
-                        "$ref": "#/$defs/string"
+                      "description": {
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
                       },
-                      "grants": {
-                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/catalog.PrivilegeAssignment"
+                      "email_notifications": {
+                        "description": "Email notification settings.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.EmailNotifications",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "lifecycle": {
-                        "description": "Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.",
+                        "description": "Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.",
                         "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
                       },
-                      "metastore_id": {
-                        "$ref": "#/$defs/string"
-                      },
                       "name": {
-                        "description": "The name of the registered model",
-                        "$ref": "#/$defs/string"
-                      },
-                      "owner": {
-                        "$ref": "#/$defs/string"
-                      },
-                      "schema_name": {
-                        "description": "The name of the schema where the registered model resides",
-                        "$ref": "#/$defs/string"
-                      },
-                      "storage_location": {
-                        "description": "The storage location on the cloud under which model version data files are stored",
-                        "$ref": "#/$defs/string"
-                      },
-                      "updated_at": {
-                        "$ref": "#/$defs/int64"
-                      },
-                      "updated_by": {
-                        "$ref": "#/$defs/string"
-                      }
-                    },
-                    "additionalProperties": false,
-                    "markdownDescription": "The registered model resource allows you to define models in Unity Catalog. For information about Unity Catalog [registered models](https://docs.databricks.com/api/workspace/registeredmodels/create), see [link](https://docs.databricks.com/machine-learning/manage-model-lifecycle/index.html)."
-                  },
-                  {
-                    "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
-                  }
-                ]
-              },
-              "resources.Schema": {
-                "oneOf": [
-                  {
-                    "type": "object",
-                    "properties": {
-                      "catalog_name": {
-                        "description": "Name of parent catalog.",
-                        "$ref": "#/$defs/string"
-                      },
-                      "comment": {
-                        "description": "User-provided free-form text description.",
-                        "$ref": "#/$defs/string"
+                        "description": "The name of the serving endpoint. This field is required and must be unique across a Databricks workspace.\nAn endpoint name can consist of alphanumeric characters, dashes, and underscores.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
                       },
-                      "grants": {
-                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/catalog.PrivilegeAssignment"
+                      "permissions": {
+                        "description": "The permissions to apply to this resource.",
+                        "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.ModelServingEndpointPermission",
+                        "markdownDescription": "A Sequence of permissions to apply to this resource, where each item grants a permission `level` to a single `user_name`, `group_name`, or `service_principal_name`. A principal cannot be set in both a resource's `permissions` and the top-level `permissions` mapping.\n\nSee [permissions](https://docs.databricks.com/dev-tools/bundles/settings.html#permissions) and [link](https://docs.databricks.com/dev-tools/bundles/permissions.html)."
                       },
-                      "lifecycle": {
-                        "description": "Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.",
-                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
+                      "rate_limits": {
+                        "description": "Rate limits to be applied to the serving endpoint. NOTE: this field is deprecated, please use AI Gateway to manage rate limits.",
+                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/serving.RateLimit",
+                        "x-databricks-launch-stage": "GA",
+                        "deprecationMessage": "This field is deprecated",
+                        "deprecated": true
                       },
-                      "name": {
-                        "description": "Name of schema, relative to parent catalog.",
-                        "$ref": "#/$defs/string"
+                      "route_optimized": {
+                        "description": "Enable route optimization for the serving endpoint.",
+                        "$ref": "#/$defs/bool",
+                        "x-databricks-launch-stage": "GA"
                       },
-                      "properties": {
-                        "$ref": "#/$defs/map/string"
+                      "tags": {
+                        "description": "Tags to be attached to the serving endpoint and automatically propagated to billing logs.",
+                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/serving.EndpointTag",
+                        "x-databricks-launch-stage": "GA"
                       },
-                      "storage_root": {
-                        "description": "Storage root URL for managed tables within schema.",
-                        "$ref": "#/$defs/string"
+                      "telemetry_config": {
+                        "description": "[Public Preview] Configuration for persisting endpoint telemetry (logs, traces, and metrics) to Unity Catalog tables.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.TelemetryConfig",
+                        "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                       }
                     },
                     "additionalProperties": false,
                     "required": [
-                      "catalog_name",
                       "name"
                     ],
-                    "markdownDescription": "The schema resource type allows you to define Unity Catalog [schemas](https://docs.databricks.com/api/workspace/schemas/create) for tables and other assets in your jobs and pipelines created as part of a bundle. A schema, different from other resource types, has the following limitations:\n\n- The owner of a schema resource is always the deployment user, and cannot be changed. If `run_as` is specified in the bundle, it will be ignored by operations on the schema.\n- Only fields supported by the corresponding [Schemas object create API](https://docs.databricks.com/api/workspace/schemas/create) are available for the schema resource. For example, `enable_predictive_optimization` is not supported as it is only available on the [update API](https://docs.databricks.com/api/workspace/schemas/update)."
+                    "markdownDescription": "The model_serving_endpoint resource allows you to define [model serving endpoints](https://docs.databricks.com/api/workspace/servingendpoints/create). See [link](https://docs.databricks.com/machine-learning/model-serving/manage-serving-endpoints.html)."
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "resources.SecretScope": {
+              "resources.ModelServingEndpointPermission": {
                 "oneOf": [
                   {
                     "type": "object",
                     "properties": {
-                      "backend_type": {
-                        "description": "The backend type the scope will be created with. If not specified, will default to `DATABRICKS`",
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/workspace.ScopeBackendType"
-                      },
-                      "keyvault_metadata": {
-                        "description": "The metadata for the secret scope if the `backend_type` is `AZURE_KEYVAULT`",
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/workspace.AzureKeyVaultSecretScopeMetadata"
+                      "group_name": {
+                        "description": "The name of the group granted the permission level.",
+                        "$ref": "#/$defs/string"
                       },
-                      "lifecycle": {
-                        "description": "Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.",
-                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
+                      "level": {
+                        "description": "The permission level to apply. The allowed levels depend on the resource type.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.ServingEndpointPermissionLevel"
                       },
-                      "name": {
-                        "description": "Scope name requested by the user. Scope names are unique.",
+                      "service_principal_name": {
+                        "description": "The name of the service principal granted the permission level.",
                         "$ref": "#/$defs/string"
                       },
-                      "permissions": {
-                        "description": "The permissions to apply to the secret scope. Permissions are managed via secret scope ACLs.",
-                        "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.SecretScopePermission"
+                      "user_name": {
+                        "description": "The name of the user granted the permission level.",
+                        "$ref": "#/$defs/string"
                       }
                     },
                     "additionalProperties": false,
                     "required": [
-                      "name"
+                      "level"
                     ]
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "resources.SecretScopePermission": {
+              "resources.Permission": {
                 "oneOf": [
                   {
                     "type": "object",
                     "properties": {
                       "group_name": {
-                        "description": "The name of the group that has the permission set in level. This field translates to a `principal` field in secret scope ACL.",
+                        "description": "The name of the group granted the permission level.",
                         "$ref": "#/$defs/string"
                       },
                       "level": {
-                        "description": "The allowed permission for user, group, service principal defined for this permission.",
-                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.SecretScopePermissionLevel"
+                        "description": "The permission level to apply. The allowed levels depend on the resource type.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/iam.PermissionLevel"
                       },
                       "service_principal_name": {
-                        "description": "The application ID of an active service principal. This field translates to a `principal` field in secret scope ACL.",
+                        "description": "The name of the service principal granted the permission level.",
                         "$ref": "#/$defs/string"
                       },
                       "user_name": {
-                        "description": "The name of the user that has the permission set in level. This field translates to a `principal` field in secret scope ACL.",
+                        "description": "The name of the user granted the permission level.",
                         "$ref": "#/$defs/string"
                       }
                     },
@@ -1779,115 +2096,230 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "resources.SecretScopePermissionLevel": {
-                "oneOf": [
-                  {
-                    "type": "string",
-                    "enum": [
-                      "READ",
-                      "WRITE",
-                      "MANAGE"
-                    ]
-                  },
-                  {
-                    "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
-                  }
-                ]
-              },
-              "resources.SqlWarehouse": {
+              "resources.Pipeline": {
                 "oneOf": [
                   {
                     "type": "object",
-                    "description": "Creates a new SQL warehouse.",
                     "properties": {
-                      "auto_stop_mins": {
-                        "description": "The amount of time in minutes that a SQL warehouse must be idle (i.e., no\nRUNNING queries) before it is automatically stopped.\n\nSupported values:\n- Must be == 0 or \u003e= 10 mins\n- 0 indicates no autostop.\n\nDefaults to 120 mins",
-                        "$ref": "#/$defs/int"
-                      },
-                      "channel": {
-                        "description": "Channel Details",
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.Channel"
-                      },
-                      "cluster_size": {
-                        "description": "Size of the clusters allocated for this warehouse.\nIncreasing the size of a spark cluster allows you to run larger queries on\nit. If you want to increase the number of concurrent queries, please tune\nmax_num_clusters.\n\nSupported values:\n- 2X-Small\n- X-Small\n- Small\n- Medium\n- Large\n- X-Large\n- 2X-Large\n- 3X-Large\n- 4X-Large\n- 5X-Large",
-                        "$ref": "#/$defs/string"
+                      "allow_duplicate_names": {
+                        "description": "If false, deployment will fail if name conflicts with that of another pipeline.",
+                        "$ref": "#/$defs/bool",
+                        "x-databricks-launch-stage": "GA"
                       },
-                      "creator_name": {
-                        "description": "warehouse creator name",
-                        "$ref": "#/$defs/string"
+                      "budget_policy_id": {
+                        "description": "[Public Preview] Budget policy of this pipeline.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                       },
-                      "enable_photon": {
-                        "description": "Configures whether the warehouse should use Photon optimized clusters.\n\nDefaults to true.",
+                      "cascade_on_destroy": {
+                        "description": "Whether destroying the pipeline also deletes its datasets (MVs, STs, Views). Defaults to true (the server default). Set to false to retain the datasets when the pipeline is deleted. Only affects the delete operation.",
                         "$ref": "#/$defs/bool"
                       },
-                      "enable_serverless_compute": {
-                        "description": "Configures whether the warehouse should use serverless compute",
-                        "$ref": "#/$defs/bool"
+                      "catalog": {
+                        "description": "A catalog in Unity Catalog to publish data from this pipeline to. If `target` is specified, tables in this pipeline are published to a `target` schema inside `catalog` (for example, `catalog`.`target`.`table`). If `target` is not specified, no data is published to Unity Catalog.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
                       },
-                      "instance_profile_arn": {
-                        "description": "Deprecated. Instance profile used to pass IAM role to the cluster",
+                      "channel": {
+                        "description": "SDP Release Channel that specifies which version to use.",
                         "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "clusters": {
+                        "description": "Cluster settings for this pipeline deployment. Applies to classic\n(non-serverless) pipelines. Omit this field when `serverless` is `true`.",
+                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/pipelines.PipelineCluster",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "configuration": {
+                        "description": "String-String configuration for this pipeline execution.",
+                        "$ref": "#/$defs/map/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "continuous": {
+                        "description": "Whether the pipeline is continuous or triggered. This replaces `trigger`.\n\nDeprecated: wrap the pipeline in a continuous job instead, which also lets you take advantage\nof job-level settings such as performance mode. When the pipeline is started by a continuous\njob, the job's setting takes precedence and this field is ignored.",
+                        "$ref": "#/$defs/bool",
+                        "x-databricks-launch-stage": "GA",
                         "deprecationMessage": "This field is deprecated",
                         "deprecated": true
                       },
-                      "lifecycle": {
-                        "description": "Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.",
-                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
+                      "development": {
+                        "description": "Whether the pipeline is in Development mode. Defaults to false.\n\nDeprecated: set development mode for each update instead.",
+                        "$ref": "#/$defs/bool",
+                        "x-databricks-launch-stage": "GA",
+                        "deprecationMessage": "This field is deprecated",
+                        "deprecated": true
                       },
-                      "max_num_clusters": {
-                        "description": "Maximum number of clusters that the autoscaler will create to handle\nconcurrent queries.\n\nSupported values:\n- Must be \u003e= min_num_clusters\n- Must be \u003c= 40.\n\nDefaults to min_clusters if unset.",
-                        "$ref": "#/$defs/int"
+                      "edition": {
+                        "description": "Pipeline product edition.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
                       },
-                      "min_num_clusters": {
-                        "description": "Minimum number of available clusters that will be maintained for this SQL\nwarehouse. Increasing this will ensure that a larger number of clusters are\nalways running and therefore may reduce the cold start time for new\nqueries. This is similar to reserved vs. revocable cores in a resource\nmanager.\n\nSupported values:\n- Must be \u003e 0\n- Must be \u003c= min(max_num_clusters, 30)\n\nDefaults to 1",
-                        "$ref": "#/$defs/int"
+                      "environment": {
+                        "description": "[Public Preview] Environment specification for this pipeline used to install dependencies.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.PipelinesEnvironment",
+                        "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                      },
+                      "event_log": {
+                        "description": "Event log configuration for this pipeline",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.EventLogSpec",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "filters": {
+                        "description": "Filters on which Pipeline packages to include in the deployed graph.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.Filters",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "gateway_definition": {
+                        "description": "[Private Preview] The definition of a gateway pipeline to support change data capture.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.IngestionGatewayPipelineDefinition",
+                        "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                        "doNotSuggest": true
+                      },
+                      "id": {
+                        "description": "Unique identifier for this pipeline.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "ingestion_definition": {
+                        "description": "[Public Preview] The configuration for a managed ingestion pipeline. These settings cannot be used with the 'libraries', 'schema', 'target', or 'catalog' settings.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.IngestionPipelineDefinition",
+                        "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                      },
+                      "libraries": {
+                        "description": "Libraries or code needed by this deployment.",
+                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/pipelines.PipelineLibrary",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "lifecycle": {
+                        "description": "Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.",
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
                       },
                       "name": {
-                        "description": "Logical name for the cluster.\n\nSupported values:\n- Must be unique within an org.\n- Must be less than 100 characters.",
-                        "$ref": "#/$defs/string"
+                        "description": "Friendly identifier for this pipeline.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "notifications": {
+                        "description": "List of notification settings for this pipeline.",
+                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/pipelines.Notifications",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "parameters": {
+                        "description": "[Beta] Key/value map of default parameters to use for pipeline execution.\nMaximum total size: 10k characters (JSON format)",
+                        "$ref": "#/$defs/map/string",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
+                      },
+                      "parent_path": {
+                        "description": "[Private Preview] Path of the pipeline parent folder in workspace file tree.\n\nIf absent, the pipeline doesn't have a workspace object.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                        "doNotSuggest": true
                       },
                       "permissions": {
-                        "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.SqlWarehousePermission"
+                        "description": "The permissions to apply to this resource.",
+                        "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.PipelinePermission",
+                        "markdownDescription": "A Sequence of permissions to apply to this resource, where each item grants a permission `level` to a single `user_name`, `group_name`, or `service_principal_name`. A principal cannot be set in both a resource's `permissions` and the top-level `permissions` mapping.\n\nSee [permissions](https://docs.databricks.com/dev-tools/bundles/settings.html#permissions) and [link](https://docs.databricks.com/dev-tools/bundles/permissions.html)."
                       },
-                      "spot_instance_policy": {
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.SpotInstancePolicy"
+                      "photon": {
+                        "description": "Whether Photon is enabled for this pipeline.",
+                        "$ref": "#/$defs/bool",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "restart_window": {
+                        "description": "[Private Preview] Restart window of this pipeline.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.RestartWindow",
+                        "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                        "doNotSuggest": true
+                      },
+                      "root_path": {
+                        "description": "[Public Preview] Root path for this pipeline.\nThis is used as the root directory when editing the pipeline in the Databricks user interface and it is\nadded to sys.path when executing Python sources during pipeline execution.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                      },
+                      "run_as": {
+                        "description": "Write-only setting, available only in Create/Update calls. Specifies the user or service principal that the pipeline runs as. If not specified, the pipeline runs as the user who created the pipeline.\n\nOnly `user_name` or `service_principal_name` can be specified. If both are specified, an error is thrown.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.RunAs",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "schema": {
+                        "description": "The default schema (database) where tables are read from or published to.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "serverless": {
+                        "description": "Whether serverless compute is enabled for this pipeline. Serverless is the\nrecommended compute for new pipelines; set this to `true` to run the pipeline\non serverless. For notebook/file pipelines, omitting this field uses classic\ncompute configured through the `clusters` field. When `true`, omit `clusters`;\nPhoton is always enabled.",
+                        "$ref": "#/$defs/bool",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "serverless_compute_id": {
+                        "description": "[Private Preview] Serverless compute ID specified by the user for serverless pipelines.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                        "doNotSuggest": true
+                      },
+                      "storage": {
+                        "description": "DBFS root directory for storing checkpoints and tables.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
                       },
                       "tags": {
-                        "description": "A set of key-value pairs that will be tagged on all resources (e.g., AWS instances and EBS volumes) associated\nwith this SQL warehouse.\n\nSupported values:\n- Number of tags \u003c 45.",
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.EndpointTags"
+                        "description": "A map of tags associated with the pipeline.\nThese are forwarded to the cluster as cluster tags, and are therefore subject to the same limitations.\nA maximum of 25 tags can be added to the pipeline.",
+                        "$ref": "#/$defs/map/string",
+                        "x-databricks-launch-stage": "GA"
                       },
-                      "warehouse_type": {
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.CreateWarehouseRequestWarehouseType"
+                      "target": {
+                        "description": "Target schema (database) to add tables in this pipeline to. Exactly one of `schema` or `target` must be specified. To publish to Unity Catalog, also specify `catalog`. This legacy field is deprecated for pipeline creation in favor of the `schema` field.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA",
+                        "deprecationMessage": "This field is deprecated",
+                        "deprecated": true
+                      },
+                      "trigger": {
+                        "description": "Which pipeline trigger to use. Deprecated: Use `continuous` instead.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.PipelineTrigger",
+                        "x-databricks-launch-stage": "GA",
+                        "deprecationMessage": "Use continuous instead",
+                        "deprecated": true
+                      },
+                      "usage_policy_id": {
+                        "description": "[Private Preview] Usage policy of this pipeline.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                        "doNotSuggest": true
                       }
                     },
-                    "additionalProperties": false
+                    "additionalProperties": false,
+                    "markdownDescription": "This resource allows you to create [pipelines](https://docs.databricks.com/api/workspace/pipelines/create). For information about pipelines, see [link](https://docs.databricks.com/dlt/index.html). For a tutorial that uses the Declarative Automation Bundles template to create a pipeline, see [link](https://docs.databricks.com/dev-tools/bundles/pipelines-tutorial.html)."
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "resources.SqlWarehousePermission": {
+              "resources.PipelinePermission": {
                 "oneOf": [
                   {
                     "type": "object",
                     "properties": {
                       "group_name": {
+                        "description": "The name of the group granted the permission level.",
                         "$ref": "#/$defs/string"
                       },
                       "level": {
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.WarehousePermissionLevel"
+                        "description": "The permission level to apply. The allowed levels depend on the resource type.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.PipelinePermissionLevel"
                       },
                       "service_principal_name": {
+                        "description": "The name of the service principal granted the permission level.",
                         "$ref": "#/$defs/string"
                       },
                       "user_name": {
+                        "description": "The name of the user granted the permission level.",
                         "$ref": "#/$defs/string"
                       }
                     },
@@ -1898,6031 +2330,13228 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "resources.SyncedDatabaseTable": {
+              "resources.PostgresBranch": {
                 "oneOf": [
                   {
                     "type": "object",
+                    "description": "[Beta]",
                     "properties": {
-                      "database_instance_name": {
+                      "branch_id": {
+                        "description": "The ID to use for the branch; becomes the final component of the branch's resource name. Must be 1-63 characters long, start with a lowercase letter, and contain only lowercase letters, numbers, and hyphens. For example, `development` becomes `projects/my-app/branches/development`.",
                         "$ref": "#/$defs/string"
                       },
+                      "expire_time": {
+                        "description": "[Beta] Absolute expiration timestamp. When set, the branch will expire at this time.\nMutually exclusive with `ttl` and `no_expiry`.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/common/types/time.Time",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
+                      },
+                      "is_protected": {
+                        "description": "[Beta] When set to true, protects the branch from deletion and reset. Associated compute endpoints and the project cannot be deleted while the branch is protected.",
+                        "$ref": "#/$defs/bool",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
+                      },
                       "lifecycle": {
+                        "description": "Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.",
                         "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
                       },
-                      "logical_database_name": {
-                        "$ref": "#/$defs/string"
+                      "no_expiry": {
+                        "description": "[Beta] Explicitly disable expiration. When set to true, the branch will not expire.\nIf set to false, the request is invalid; provide either ttl or expire_time instead.\nMutually exclusive with `expire_time` and `ttl`.",
+                        "$ref": "#/$defs/bool",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
                       },
-                      "name": {
+                      "parent": {
+                        "description": "The project containing this branch (API resource hierarchy). Format: projects/{project_id}\n\nThis field indicates where the branch exists in the resource hierarchy. For point-in-time branching from another branch, see `source_branch`.",
                         "$ref": "#/$defs/string"
                       },
-                      "spec": {
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/database.SyncedTableSpec"
+                      "purge_on_delete": {
+                        "description": "When true, permanently delete the branch when the bundle is destroyed. When false or unset, the branch is soft deleted and can be restored within its retention window.",
+                        "$ref": "#/$defs/bool"
+                      },
+                      "replace_existing": {
+                        "description": "When true, take over an existing branch with the same ID instead of failing with an ALREADY_EXISTS error. Use it to bring a branch that already exists on the project (for example, the production branch created with the project) under bundle management. Only takes effect when the branch is created.",
+                        "$ref": "#/$defs/bool"
+                      },
+                      "source_branch": {
+                        "description": "[Beta] The name of the source branch from which this branch was created (data lineage for point-in-time recovery).\nIf not specified, defaults to the project's default branch.\nFormat: projects/{project_id}/branches/{branch_id}",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
+                      },
+                      "source_branch_lsn": {
+                        "description": "[Beta] The Log Sequence Number (LSN) on the source branch from which this branch was created.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
+                      },
+                      "source_branch_time": {
+                        "description": "[Beta] The point in time on the source branch from which this branch was created.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/common/types/time.Time",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
+                      },
+                      "source_snapshot": {
+                        "description": "[Beta] The snapshot this branch was created from. When set, the branch's data\ncomes from the snapshot rather than a source branch, so source_branch,\nsource_branch_lsn, and source_branch_time must be empty. The snapshot must\nbe AVAILABLE and belong to this branch's project.\nFormat: projects/{project_id}/snapshots/{snapshot_id}",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
+                      },
+                      "ttl": {
+                        "description": "[Beta] Relative time-to-live duration. When set, the branch will expire at creation_time + ttl.\nMutually exclusive with `expire_time` and `no_expiry`.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/common/types/duration.Duration",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
                       }
                     },
                     "additionalProperties": false,
                     "required": [
-                      "name"
-                    ]
+                      "branch_id",
+                      "parent"
+                    ],
+                    "x-databricks-launch-stage": "PUBLIC_BETA"
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "resources.VectorSearchEndpoint": {
+              "resources.PostgresCatalog": {
                 "oneOf": [
                   {
                     "type": "object",
+                    "description": "[Beta] The desired state of the Catalog.",
                     "properties": {
-                      "budget_policy_id": {
+                      "branch": {
+                        "description": "[Beta] The resource path of the branch associated with the catalog.\n\nFormat: projects/{project_id}/branches/{branch_id}.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
+                      },
+                      "catalog_id": {
+                        "description": "The ID of the catalog in Unity Catalog; becomes the full resource name. For example, `my_catalog` becomes `catalogs/my_catalog`.",
                         "$ref": "#/$defs/string"
                       },
-                      "endpoint_type": {
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/vectorsearch.EndpointType"
+                      "create_database_if_missing": {
+                        "description": "[Beta] If set to true, the specified postgres_database is created on behalf of the calling user\nif it does not already exist. In this case, the calling user has a role created for\nthem in Postgres if they do not already have one.\n\nDefaults to false, meaning that the request fails if the specified postgres_database does not already exist.",
+                        "$ref": "#/$defs/bool",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
                       },
                       "lifecycle": {
+                        "description": "Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.",
                         "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
                       },
-                      "min_qps": {
-                        "$ref": "#/$defs/int64"
-                      },
-                      "name": {
-                        "$ref": "#/$defs/string"
-                      },
-                      "permissions": {
-                        "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.Permission"
-                      },
-                      "usage_policy_id": {
+                      "postgres_database": {
+                        "description": "[Beta] The name of the Postgres database inside the specified Lakebase project and branch to be associated with the UC catalog.\nThis database must already exist, unless create_database_if_missing is set to true on creation.\n\nA database can only be registered with one UC catalog at a time.\nTo re-register a database with a different catalog, the existing catalog must be deleted first.\n\nA child branch inherits the fact of parent's registration. This means the same-named database\nin a child branch cannot be registered with a second catalog\nwhile the parent's registration exists. To allow registering the database of a child branch,\ndrop and recreate the database on the child branch.\nThis removes the fact of parent's registration from this branch only.\n\nDoing Point In Time Restore (PITR) prior to the moment before the Postgres DB was registered\nin the Catalog drops the fact of registration of the database. So the user should avoid doing so.",
                         "$ref": "#/$defs/string",
-                        "x-databricks-preview": "PRIVATE",
-                        "doNotSuggest": true
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
                       }
                     },
                     "additionalProperties": false,
                     "required": [
-                      "endpoint_type",
-                      "name"
-                    ]
+                      "catalog_id",
+                      "postgres_database"
+                    ],
+                    "x-databricks-launch-stage": "PUBLIC_BETA"
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "resources.Volume": {
+              "resources.PostgresDatabase": {
                 "oneOf": [
                   {
                     "type": "object",
+                    "description": "[Beta]",
                     "properties": {
-                      "catalog_name": {
-                        "description": "The name of the catalog where the schema and the volume are",
-                        "$ref": "#/$defs/string"
-                      },
-                      "comment": {
-                        "description": "The comment attached to the volume",
+                      "database_id": {
+                        "description": "The ID to use for the database; becomes the final component of the database's resource name and the database name in Postgres. Must be 4-63 characters and use only characters available in DNS names, as defined by RFC 1123. If not specified, it is generated automatically.",
                         "$ref": "#/$defs/string"
                       },
-                      "grants": {
-                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/catalog.PrivilegeAssignment"
-                      },
                       "lifecycle": {
-                        "description": "Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.",
+                        "description": "Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.",
                         "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
                       },
-                      "name": {
-                        "description": "The name of the volume",
+                      "parent": {
+                        "description": "The branch containing this database. Format: projects/{project_id}/branches/{branch_id}",
                         "$ref": "#/$defs/string"
                       },
-                      "schema_name": {
-                        "description": "The name of the schema where the volume is",
-                        "$ref": "#/$defs/string"
+                      "postgres_database": {
+                        "description": "[Beta] The name of the Postgres database.\n\nThis expects a valid Postgres identifier as specified in the link below.\nhttps://www.postgresql.org/docs/current/sql-syntax-lexical.html#SQL-SYNTAX-IDENTIFIERS\nRequired when creating the Database.\n\nTo rename, pass a valid postgres identifier when updating the Database.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
                       },
-                      "storage_location": {
-                        "description": "The storage location on the cloud",
-                        "$ref": "#/$defs/string"
+                      "replace_existing": {
+                        "description": "When true, take over an existing database with the same ID instead of failing with an ALREADY_EXISTS error. Use it to bring a database that already exists on the branch under bundle management. Only takes effect when the database is created.",
+                        "$ref": "#/$defs/bool"
                       },
-                      "volume_type": {
-                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.VolumeType"
+                      "role": {
+                        "description": "[Beta] The name of the role that owns the database.\nFormat: projects/{project_id}/branches/{branch_id}/roles/{role_id}\n\nTo change the owner, pass valid existing Role name when updating the Database\n\nA database always has an owner.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
                       }
                     },
                     "additionalProperties": false,
                     "required": [
-                      "catalog_name",
-                      "name",
-                      "schema_name"
+                      "database_id",
+                      "parent",
+                      "role"
                     ],
-                    "markdownDescription": "The volume resource type allows you to define and create Unity Catalog [volumes](https://docs.databricks.com/api/workspace/volumes/create) as part of a bundle. When deploying a bundle with a volume defined, note that:\n\n- A volume cannot be referenced in the `artifact_path` for the bundle until it exists in the workspace. Hence, if you want to use Declarative Automation Bundles to create the volume, you must first define the volume in the bundle, deploy it to create the volume, then reference it in the `artifact_path` in subsequent deployments.\n\n- Volumes in the bundle are not prepended with the `dev_${workspace.current_user.short_name}` prefix when the deployment target has `mode: development` configured. However, you can manually configure this prefix. See [custom-presets](https://docs.databricks.com/dev-tools/bundles/deployment-modes.html#custom-presets)."
+                    "x-databricks-launch-stage": "PUBLIC_BETA"
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "variable.Lookup": {
+              "resources.PostgresEndpoint": {
                 "oneOf": [
                   {
                     "type": "object",
+                    "description": "[Beta]",
                     "properties": {
-                      "alert": {
-                        "description": "The name of the alert for which to retrieve an ID.",
-                        "$ref": "#/$defs/string"
+                      "autoscaling_limit_max_cu": {
+                        "description": "[Beta] The maximum number of Compute Units. The maximum value is 64.\nThe difference between the minimum and maximum Compute Units (max - min) must not exceed 16.",
+                        "$ref": "#/$defs/float64",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
                       },
-                      "cluster": {
-                        "description": "The name of the cluster for which to retrieve an ID.",
-                        "$ref": "#/$defs/string"
+                      "autoscaling_limit_min_cu": {
+                        "description": "[Beta] The minimum number of Compute Units. Minimum value is 0.5.",
+                        "$ref": "#/$defs/float64",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
                       },
-                      "cluster_policy": {
-                        "description": "The name of the cluster_policy for which to retrieve an ID.",
-                        "$ref": "#/$defs/string"
+                      "disabled": {
+                        "description": "[Beta] Whether to restrict connections to the compute endpoint.\nEnabling this option schedules a suspend compute operation.\nA disabled compute endpoint cannot be enabled by a connection or\nconsole action.",
+                        "$ref": "#/$defs/bool",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
                       },
-                      "dashboard": {
-                        "description": "The name of the dashboard for which to retrieve an ID.",
+                      "endpoint_id": {
+                        "description": "The ID to use for the endpoint; becomes the final component of the endpoint's resource name. Must be 1-63 characters long, start with a lowercase letter, and contain only lowercase letters, numbers, and hyphens. For example, `primary` becomes `projects/my-app/branches/development/endpoints/primary`.",
                         "$ref": "#/$defs/string"
                       },
-                      "instance_pool": {
-                        "description": "The name of the instance_pool for which to retrieve an ID.",
-                        "$ref": "#/$defs/string"
+                      "endpoint_type": {
+                        "description": "[Beta] The endpoint type. A branch can only have one READ_WRITE endpoint.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/postgres.EndpointType",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
                       },
-                      "job": {
-                        "description": "The name of the job for which to retrieve an ID.",
-                        "$ref": "#/$defs/string"
+                      "group": {
+                        "description": "[Beta] Settings for optional HA configuration of the endpoint. If unspecified, the endpoint defaults\nto non HA settings, with a single compute backing the endpoint (and no readable secondaries\nfor Read/Write endpoints).",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/postgres.EndpointGroupSpec",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
                       },
-                      "metastore": {
-                        "description": "The name of the metastore for which to retrieve an ID.",
-                        "$ref": "#/$defs/string"
+                      "lifecycle": {
+                        "description": "Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.",
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
                       },
-                      "notification_destination": {
-                        "description": "The name of the notification_destination for which to retrieve an ID.",
-                        "$ref": "#/$defs/string"
+                      "no_suspension": {
+                        "description": "[Beta] When set to true, explicitly disables automatic suspension (never suspend).\nShould be set to true when provided.\nMutually exclusive with `suspend_timeout_duration`.",
+                        "$ref": "#/$defs/bool",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
                       },
-                      "pipeline": {
-                        "description": "The name of the pipeline for which to retrieve an ID.",
+                      "parent": {
+                        "description": "The branch containing this endpoint (API resource hierarchy). Format: projects/{project_id}/branches/{branch_id}",
                         "$ref": "#/$defs/string"
                       },
-                      "query": {
-                        "description": "The name of the query for which to retrieve an ID.",
-                        "$ref": "#/$defs/string"
+                      "replace_existing": {
+                        "description": "When true, take over an existing endpoint with the same ID instead of failing with an ALREADY_EXISTS error. Use it to bring an endpoint that already exists on the branch (for example, the primary read-write endpoint created with the branch) under bundle management. Only takes effect when the endpoint is created.",
+                        "$ref": "#/$defs/bool"
                       },
-                      "service_principal": {
-                        "description": "The name of the service_principal for which to retrieve an ID.",
-                        "$ref": "#/$defs/string"
+                      "settings": {
+                        "description": "[Beta] A collection of settings for a compute endpoint.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/postgres.EndpointSettings",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
                       },
-                      "warehouse": {
-                        "description": "The name of the warehouse for which to retrieve an ID.",
-                        "$ref": "#/$defs/string"
+                      "suspend_timeout_duration": {
+                        "description": "[Beta] Duration of inactivity after which the compute endpoint is automatically suspended.\nIf specified should be between 60s and 604800s (1 minute to 1 week).\nMutually exclusive with `no_suspension`.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/common/types/duration.Duration",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
                       }
                     },
-                    "additionalProperties": false
+                    "additionalProperties": false,
+                    "required": [
+                      "endpoint_id",
+                      "parent",
+                      "endpoint_type"
+                    ],
+                    "x-databricks-launch-stage": "PUBLIC_BETA"
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "variable.TargetVariable": {
-                "anyOf": [
+              "resources.PostgresProject": {
+                "oneOf": [
                   {
                     "type": "object",
+                    "description": "[Beta]",
                     "properties": {
-                      "default": {
-                        "description": "The default value for the variable.",
-                        "$ref": "#/$defs/interface"
+                      "budget_policy_id": {
+                        "description": "[Beta] The desired budget policy to associate with the project.\nSee status.budget_policy_id for the policy that is actually applied to the project.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
                       },
-                      "description": {
-                        "description": "The description of the variable.",
-                        "$ref": "#/$defs/string"
+                      "custom_tags": {
+                        "description": "[Beta] Custom tags to associate with the project. Forwarded to LBM for billing and cost tracking.\nTo update tags, provide the new tag list and include \"spec.custom_tags\" in the update_mask.\nTo clear all tags, provide an empty list and include \"spec.custom_tags\" in the update_mask.\nTo preserve existing tags, omit this field from the update_mask (or use wildcard \"*\" which auto-excludes empty tags).",
+                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/postgres.ProjectCustomTag",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
                       },
-                      "lookup": {
-                        "description": "The name of the alert, cluster_policy, cluster, dashboard, instance_pool, job, metastore, pipeline, query, service_principal, or warehouse object for which to retrieve an ID.",
-                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/variable.Lookup"
+                      "default_branch": {
+                        "description": "[Beta] The full resource path for the default branch of the project\nFormat: projects/{project_id}/branches/{branch_id}",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
                       },
-                      "type": {
-                        "description": "The type of the variable.",
-                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/variable.VariableType"
-                      }
-                    },
-                    "additionalProperties": false
-                  },
-                  {}
-                ]
-              },
-              "variable.Variable": {
-                "type": "object",
-                "description": "Defines a custom variable for the bundle.",
-                "properties": {
-                  "default": {
-                    "description": "The default value for the variable.",
-                    "$ref": "#/$defs/interface"
+                      "default_endpoint_settings": {
+                        "description": "[Beta] A collection of settings for a compute endpoint.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/postgres.ProjectDefaultEndpointSettings",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
+                      },
+                      "display_name": {
+                        "description": "[Beta] Human-readable project name. Length should be between 1 and 256 characters.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
+                      },
+                      "enable_pg_native_login": {
+                        "description": "[Beta] Whether to enable PG native password login on all endpoints in this project. Defaults to false.",
+                        "$ref": "#/$defs/bool",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
+                      },
+                      "history_retention_duration": {
+                        "description": "[Beta] The number of seconds to retain the shared history for point in time recovery for all branches in this project. Value should be between 172800s (2 days) and 3024000s (35 days).",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/common/types/duration.Duration",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
+                      },
+                      "lifecycle": {
+                        "description": "Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.",
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
+                      },
+                      "permissions": {
+                        "description": "The permissions to apply to this resource.",
+                        "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.Permission",
+                        "markdownDescription": "A Sequence of permissions to apply to this resource, where each item grants a permission `level` to a single `user_name`, `group_name`, or `service_principal_name`. A principal cannot be set in both a resource's `permissions` and the top-level `permissions` mapping.\n\nSee [permissions](https://docs.databricks.com/dev-tools/bundles/settings.html#permissions) and [link](https://docs.databricks.com/dev-tools/bundles/permissions.html)."
+                      },
+                      "pg_version": {
+                        "description": "[Beta] The major Postgres version number. The set of supported versions may vary; consult the API documentation for currently accepted values.",
+                        "$ref": "#/$defs/int",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
+                      },
+                      "project_id": {
+                        "description": "The ID to use for the project; becomes the final component of the project's resource name. Must be 1-63 characters long, start with a lowercase letter, and contain only lowercase letters, numbers, and hyphens. For example, `my-app` becomes `projects/my-app`.",
+                        "$ref": "#/$defs/string"
+                      },
+                      "purge_on_delete": {
+                        "description": "When true, permanently delete the project when the bundle is destroyed. When false or unset, the project is soft deleted and can be restored within its retention window.",
+                        "$ref": "#/$defs/bool"
+                      }
+                    },
+                    "additionalProperties": false,
+                    "required": [
+                      "project_id"
+                    ],
+                    "x-databricks-launch-stage": "PUBLIC_BETA"
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "resources.PostgresRole": {
+                "oneOf": [
+                  {
+                    "type": "object",
+                    "description": "[Beta]",
+                    "properties": {
+                      "attributes": {
+                        "description": "[Beta] The desired API-exposed Postgres role attributes to associate with the role.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/postgres.RoleAttributes",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
+                      },
+                      "auth_method": {
+                        "description": "[Beta] How the role is authenticated when connecting to Postgres. If left unspecified, a meaningful authentication method is derived from the identity_type.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/postgres.RoleAuthMethod",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
+                      },
+                      "identity_type": {
+                        "description": "[Beta] The type of the Databricks managed identity that this Role represents. Leave empty to create a regular Postgres role not associated with a Databricks identity.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/postgres.RoleIdentityType",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
+                      },
+                      "lifecycle": {
+                        "description": "Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.",
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
+                      },
+                      "membership_roles": {
+                        "description": "[Beta] Standard roles that this role is a member of.",
+                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/postgres.RoleMembershipRole",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
+                      },
+                      "parent": {
+                        "description": "The branch where this role is created. Format projects/{project_id}/branches/{branch_id}.",
+                        "$ref": "#/$defs/string"
+                      },
+                      "postgres_role": {
+                        "description": "[Beta] The name of the Postgres role. Required when creating the role.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
+                      },
+                      "replace_existing": {
+                        "description": "When true, take over an existing role with the same ID instead of failing with an ALREADY_EXISTS error. Use it to bring a role that already exists on the branch (for example, one inherited from the parent branch) under bundle management. Only takes effect when the role is created.",
+                        "$ref": "#/$defs/bool"
+                      },
+                      "role_id": {
+                        "description": "The user-specified role ID; becomes the final component of the role's resource name. Must be 4-63 characters, lowercase letters, numbers, and hyphens (RFC 1123).",
+                        "$ref": "#/$defs/string"
+                      }
+                    },
+                    "additionalProperties": false,
+                    "required": [
+                      "role_id",
+                      "parent"
+                    ],
+                    "x-databricks-launch-stage": "PUBLIC_BETA"
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "resources.PostgresSnapshotSchedule": {
+                "oneOf": [
+                  {
+                    "type": "object",
+                    "description": "[Beta]",
+                    "properties": {
+                      "branch": {
+                        "description": "The branch whose automatic-snapshot schedule this manages. Format: projects/{project_id}/branches/{branch_id}",
+                        "$ref": "#/$defs/string"
+                      },
+                      "lifecycle": {
+                        "description": "Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.",
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
+                      },
+                      "schedule": {
+                        "description": "The cadences at which automatic snapshots are taken. An empty set disables automatic snapshots. When several cadences fire together, one snapshot is taken and retained for the longest of their retentions.",
+                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/postgres.ScheduleCadence"
+                      }
+                    },
+                    "additionalProperties": false,
+                    "required": [
+                      "branch"
+                    ],
+                    "x-databricks-launch-stage": "PUBLIC_BETA"
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "resources.PostgresSyncedTable": {
+                "oneOf": [
+                  {
+                    "type": "object",
+                    "description": "[Beta]",
+                    "properties": {
+                      "accelerated_sync": {
+                        "description": "[Private Preview] When true, enables accelerated sync mode for the initial data load.\nThis significantly improves performance for large tables.\nRequires workspace-level enablement through Lakebase Accelerated Sync preview.",
+                        "$ref": "#/$defs/bool",
+                        "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                        "doNotSuggest": true
+                      },
+                      "branch": {
+                        "description": "[Beta] The full resource name the branch associated with the table.\n\nFormat: \"projects/{project_id}/branches/{branch_id}\".",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
+                      },
+                      "create_database_objects_if_missing": {
+                        "description": "[Beta] If true, the synced table's logical database and schema resources in PG\nwill be created if they do not already exist.\nThe request will fail if this is false and the database/schema do not exist.\n\nDefaults to true if omitted.",
+                        "$ref": "#/$defs/bool",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
+                      },
+                      "existing_pipeline_id": {
+                        "description": "[Beta] ID of an existing pipeline to bin-pack this synced table into.\nAt most one of existing_pipeline_id and new_pipeline_spec should be defined.\n\nThe pipeline used for the synced table is returned via the top level pipeline_id attribute.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
+                      },
+                      "extra_columns": {
+                        "description": "[Private Preview] Extra PostgreSQL-only columns to add to the synced table.",
+                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/postgres.SyncedTableSyncedTableSpecExtraColumn",
+                        "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                        "doNotSuggest": true
+                      },
+                      "lifecycle": {
+                        "description": "Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.",
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
+                      },
+                      "new_pipeline_spec": {
+                        "description": "[Beta] Specification for creating a new pipeline.\nAt most one of existing_pipeline_id and new_pipeline_spec should be defined.\n\nThe pipeline used for the synced table is returned via the top level pipeline_id attribute.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/postgres.NewPipelineSpec",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
+                      },
+                      "postgres_database": {
+                        "description": "[Beta] The Postgres database name where the synced table will be created in.\n\nIf this synced table is created inside a Lakebase Catalog, this attribute can be omitted on creation and is inferred\nfrom the postgres_database associated with the Lakebase Catalog. If specified when inside a Lakebase Catalog, the value must match.\n\nA value must be specified when creating a synced table inside a Standard Catalog.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
+                      },
+                      "primary_key_columns": {
+                        "description": "[Beta] Primary Key columns to be used for data insert/update in the destination.",
+                        "$ref": "#/$defs/slice/string",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
+                      },
+                      "scheduling_policy": {
+                        "description": "[Beta] Scheduling policy of the underlying pipeline.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/postgres.SyncedTableSyncedTableSpecSyncedTableSchedulingPolicy",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
+                      },
+                      "source_table_full_name": {
+                        "description": "[Beta] Three-part (catalog, schema, table) name of the source Delta table.\n\nFor the corresponding destination table, use any of the two:\n\n* synced_table_id used at the creation of the SyncedTable\n* \"name\" consisting of \"synced_tables/\" prefix and the full name of the destination table.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
+                      },
+                      "synced_table_id": {
+                        "description": "The ID to use for the synced table; becomes the final component of the synced table's resource name. It is the synced table name, a `{catalog}.{schema}.{table}` tuple of Unity Catalog entity names.\n\nIt names both an online view in Unity Catalog, accessible through Lakehouse Federation, and a Postgres table named `{table}` in schema `{schema}` in the connected Postgres database.",
+                        "$ref": "#/$defs/string"
+                      },
+                      "timeseries_key": {
+                        "description": "[Beta] Time series key to deduplicate (tie-break) rows with the same primary key.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
+                      },
+                      "type_overrides": {
+                        "description": "[Beta] Override the default Delta-\u003ePG type mapping for specific columns.\nA TypeOverride with PG_SPECIFIC_TYPE_UNSPECIFIED is rejected; a valid pg_type must be set.",
+                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/postgres.SyncedTableSyncedTableSpecTypeOverride",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
+                      }
+                    },
+                    "additionalProperties": false,
+                    "required": [
+                      "synced_table_id"
+                    ],
+                    "x-databricks-launch-stage": "PUBLIC_BETA"
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "resources.QualityMonitor": {
+                "oneOf": [
+                  {
+                    "type": "object",
+                    "properties": {
+                      "assets_dir": {
+                        "description": "[Create:REQ Update:IGN] Field for specifying the absolute path to a custom directory to store data-monitoring\nassets. Normally prepopulated to a default user location via UI and Python APIs.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "baseline_table_name": {
+                        "description": "[Create:OPT Update:OPT] Baseline table name.\nBaseline data is used to compute drift from the data in the monitored `table_name`.\nThe baseline table and the monitored table shall have the same schema.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "custom_metrics": {
+                        "description": "[Create:OPT Update:OPT] Custom metrics.",
+                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/catalog.MonitorMetric",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "data_classification_config": {
+                        "description": "[Private Preview] [Create:OPT Update:OPT] Data classification related config.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.MonitorDataClassificationConfig",
+                        "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                        "doNotSuggest": true
+                      },
+                      "inference_log": {
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.MonitorInferenceLog",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "latest_monitor_failure_msg": {
+                        "description": "[Create:ERR Update:IGN] The latest error message for a monitor failure.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "lifecycle": {
+                        "description": "Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.",
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
+                      },
+                      "notifications": {
+                        "description": "[Create:OPT Update:OPT] Field for specifying notification settings.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.MonitorNotifications",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "output_schema_name": {
+                        "description": "[Create:REQ Update:REQ] Schema where output tables are created. Needs to be in 2-level format {catalog}.{schema}",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "schedule": {
+                        "description": "[Create:OPT Update:OPT] The monitor schedule.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.MonitorCronSchedule",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "skip_builtin_dashboard": {
+                        "description": "Whether to skip creating a default dashboard summarizing data quality metrics.",
+                        "$ref": "#/$defs/bool",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "slicing_exprs": {
+                        "description": "[Create:OPT Update:OPT] List of column expressions to slice data with for targeted analysis. The data is grouped by\neach expression independently, resulting in a separate slice for each predicate and its\ncomplements. For example `slicing_exprs=[“col_1”, “col_2 \u003e 10”]` will generate the following\nslices: two slices for `col_2 \u003e 10` (True and False), and one slice per unique value in\n`col1`. For high-cardinality columns, only the top 100 unique values by frequency will\ngenerate slices.",
+                        "$ref": "#/$defs/slice/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "snapshot": {
+                        "description": "Configuration for monitoring snapshot tables.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.MonitorSnapshot",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "table_name": {
+                        "$ref": "#/$defs/string"
+                      },
+                      "time_series": {
+                        "description": "Configuration for monitoring time series tables.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.MonitorTimeSeries",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "warehouse_id": {
+                        "description": "Optional argument to specify the warehouse for dashboard creation. If not specified, the first running\nwarehouse will be used.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      }
+                    },
+                    "additionalProperties": false,
+                    "required": [
+                      "table_name",
+                      "assets_dir",
+                      "output_schema_name"
+                    ],
+                    "markdownDescription": "The quality_monitor resource allows you to define a Unity Catalog [table monitor](https://docs.databricks.com/api/workspace/qualitymonitors/create). For information about monitors, see [link](https://docs.databricks.com/machine-learning/model-serving/monitor-diagnose-endpoints.html)."
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "resources.RegisteredModel": {
+                "oneOf": [
+                  {
+                    "type": "object",
+                    "properties": {
+                      "aliases": {
+                        "description": "List of aliases associated with the registered model",
+                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/catalog.RegisteredModelAlias",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "catalog_name": {
+                        "description": "The name of the catalog where the schema and the registered model reside",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "comment": {
+                        "description": "The comment attached to the registered model",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "created_at": {
+                        "description": "Creation timestamp of the registered model in milliseconds since the Unix epoch",
+                        "$ref": "#/$defs/int64",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "created_by": {
+                        "description": "The identifier of the user who created the registered model",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "full_name": {
+                        "description": "The three-level (fully qualified) name of the registered model",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "grants": {
+                        "description": "The Unity Catalog privileges to grant to principals on this securable.",
+                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/catalog.PrivilegeAssignment",
+                        "markdownDescription": "A Sequence of Unity Catalog privilege grants on this securable, where each item grants a set of `privileges` to a `principal` (a user, group, or service principal).\n\nSee [link](https://docs.databricks.com/data-governance/unity-catalog/manage-privileges/index.html)."
+                      },
+                      "lifecycle": {
+                        "description": "Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.",
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
+                      },
+                      "metastore_id": {
+                        "description": "The unique identifier of the metastore",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "name": {
+                        "description": "The name of the registered model",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "owner": {
+                        "description": "The identifier of the user who owns the registered model",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "schema_name": {
+                        "description": "The name of the schema where the registered model resides",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "storage_location": {
+                        "description": "The storage location on the cloud under which model version data files are stored",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "updated_at": {
+                        "description": "Last-update timestamp of the registered model in milliseconds since the Unix epoch",
+                        "$ref": "#/$defs/int64",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "updated_by": {
+                        "description": "The identifier of the user who updated the registered model last time",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      }
+                    },
+                    "additionalProperties": false,
+                    "markdownDescription": "The registered model resource allows you to define models in Unity Catalog. For information about Unity Catalog [registered models](https://docs.databricks.com/api/workspace/registeredmodels/create), see [link](https://docs.databricks.com/machine-learning/manage-model-lifecycle/index.html)."
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "resources.Schema": {
+                "oneOf": [
+                  {
+                    "type": "object",
+                    "properties": {
+                      "catalog_name": {
+                        "description": "Name of parent catalog.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "comment": {
+                        "description": "User-provided free-form text description.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "custom_max_retention_hours": {
+                        "description": "[Public Preview] Custom maximum retention period in hours for the schema.",
+                        "$ref": "#/$defs/int64",
+                        "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                      },
+                      "grants": {
+                        "description": "The Unity Catalog privileges to grant to principals on this securable.",
+                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/catalog.PrivilegeAssignment",
+                        "markdownDescription": "A Sequence of Unity Catalog privilege grants on this securable, where each item grants a set of `privileges` to a `principal` (a user, group, or service principal).\n\nSee [link](https://docs.databricks.com/data-governance/unity-catalog/manage-privileges/index.html)."
+                      },
+                      "lifecycle": {
+                        "description": "Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.",
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
+                      },
+                      "name": {
+                        "description": "Name of schema, relative to parent catalog.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "properties": {
+                        "description": "A map of key-value properties attached to the securable.",
+                        "$ref": "#/$defs/map/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "storage_root": {
+                        "description": "Storage root URL for managed tables within schema.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      }
+                    },
+                    "additionalProperties": false,
+                    "required": [
+                      "catalog_name",
+                      "name"
+                    ],
+                    "markdownDescription": "The schema resource type allows you to define Unity Catalog [schemas](https://docs.databricks.com/api/workspace/schemas/create) for tables and other assets in your jobs and pipelines created as part of a bundle. A schema, different from other resource types, has the following limitations:\n\n- The owner of a schema resource is always the deployment user, and cannot be changed. If `run_as` is specified in the bundle, it will be ignored by operations on the schema.\n- Only fields supported by the corresponding [Schemas object create API](https://docs.databricks.com/api/workspace/schemas/create) are available for the schema resource. For example, `enable_predictive_optimization` is not supported as it is only available on the [update API](https://docs.databricks.com/api/workspace/schemas/update)."
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "resources.Secret": {
+                "oneOf": [
+                  {
+                    "type": "object",
+                    "description": "A secret stored in Unity Catalog. Secrets are three-level namespace objects\n(catalog.schema.secret) that securely store sensitive credential data such as\npasswords, tokens, and keys.",
+                    "properties": {
+                      "catalog_name": {
+                        "description": "The name of the catalog where the schema and the secret reside.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "comment": {
+                        "description": "User-provided free-form text description of the secret.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "expire_time": {
+                        "description": "User-provided expiration time of the secret. Purely informational; does not trigger automatic actions.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/common/types/time.Time",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "grants": {
+                        "description": "The grants to apply on this secret.",
+                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/catalog.PrivilegeAssignment"
+                      },
+                      "lifecycle": {
+                        "description": "Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.",
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
+                      },
+                      "name": {
+                        "description": "The name of the secret, relative to its parent schema.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "owner": {
+                        "description": "The owner of the secret. Defaults to the creating principal on creation. Can be updated to\ntransfer ownership of the secret to another principal.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "schema_name": {
+                        "description": "The name of the schema where the secret resides.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "value": {
+                        "description": "The secret value to store. Must be a variable reference (e.g. ${var.my_secret}) to prevent plain-text secrets in configuration files.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      }
+                    },
+                    "additionalProperties": false,
+                    "required": [
+                      "catalog_name",
+                      "name",
+                      "schema_name",
+                      "value"
+                    ]
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "resources.SecretScope": {
+                "oneOf": [
+                  {
+                    "type": "object",
+                    "properties": {
+                      "backend_type": {
+                        "description": "The backend type the scope will be created with. If not specified, will default to `DATABRICKS`",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/workspace.ScopeBackendType"
+                      },
+                      "keyvault_metadata": {
+                        "description": "The metadata for the secret scope if the `backend_type` is `AZURE_KEYVAULT`",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/workspace.AzureKeyVaultSecretScopeMetadata"
+                      },
+                      "lifecycle": {
+                        "description": "Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.",
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
+                      },
+                      "name": {
+                        "description": "Scope name requested by the user. Scope names are unique.",
+                        "$ref": "#/$defs/string"
+                      },
+                      "permissions": {
+                        "description": "The permissions to apply to the secret scope. Permissions are managed via secret scope ACLs.",
+                        "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.SecretScopePermission"
+                      }
+                    },
+                    "additionalProperties": false,
+                    "required": [
+                      "name"
+                    ]
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "resources.SecretScopePermission": {
+                "oneOf": [
+                  {
+                    "type": "object",
+                    "properties": {
+                      "group_name": {
+                        "description": "The name of the group granted the permission level. This field translates to a `principal` field in secret scope ACL.",
+                        "$ref": "#/$defs/string"
+                      },
+                      "level": {
+                        "description": "The permission level to apply. The allowed levels depend on the resource type.",
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.SecretScopePermissionLevel"
+                      },
+                      "service_principal_name": {
+                        "description": "The application ID of an active service principal. This field translates to a `principal` field in secret scope ACL.",
+                        "$ref": "#/$defs/string"
+                      },
+                      "user_name": {
+                        "description": "The name of the user granted the permission level. This field translates to a `principal` field in secret scope ACL.",
+                        "$ref": "#/$defs/string"
+                      }
+                    },
+                    "additionalProperties": false,
+                    "required": [
+                      "level"
+                    ]
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "resources.SecretScopePermissionLevel": {
+                "oneOf": [
+                  {
+                    "type": "string",
+                    "enum": [
+                      "READ",
+                      "WRITE",
+                      "MANAGE"
+                    ]
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "resources.SqlWarehouse": {
+                "oneOf": [
+                  {
+                    "type": "object",
+                    "description": "Creates a new SQL warehouse.",
+                    "properties": {
+                      "auto_stop_mins": {
+                        "description": "The amount of time in minutes that a SQL warehouse must be idle (i.e., no\nRUNNING queries) before it is automatically stopped.\n\nSupported values:\n- Must be == 0 or \u003e= 10 mins\n- 0 indicates no autostop.\n\nDefaults to 120 mins",
+                        "$ref": "#/$defs/int",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "channel": {
+                        "description": "Channel Details",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.Channel",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "cluster_size": {
+                        "description": "Size of the clusters allocated for this warehouse.\nIncreasing the size of a spark cluster allows you to run larger queries on\nit. If you want to increase the number of concurrent queries, please tune\nmax_num_clusters.\n\nSupported values:\n- 2X-Small\n- X-Small\n- Small\n- Medium\n- Large\n- X-Large\n- 2X-Large\n- 3X-Large\n- 4X-Large\n- 5X-Large",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "creator_name": {
+                        "description": "warehouse creator name",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "enable_photon": {
+                        "description": "Configures whether the warehouse should use Photon optimized clusters.\n\nDefaults to true.",
+                        "$ref": "#/$defs/bool",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "enable_serverless_compute": {
+                        "description": "Configures whether the warehouse should use serverless compute",
+                        "$ref": "#/$defs/bool",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "instance_profile_arn": {
+                        "description": "Deprecated. Instance profile used to pass IAM role to the cluster",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA",
+                        "deprecationMessage": "This field is deprecated",
+                        "deprecated": true
+                      },
+                      "lifecycle": {
+                        "description": "Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.",
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.LifecycleWithStarted"
+                      },
+                      "max_num_clusters": {
+                        "description": "Maximum number of clusters that the autoscaler will create to handle\nconcurrent queries.\n\nSupported values:\n- Must be \u003e= min_num_clusters\n- Must be \u003c= 40.\n\nDefaults to min_clusters if unset.",
+                        "$ref": "#/$defs/int",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "min_num_clusters": {
+                        "description": "Minimum number of available clusters that will be maintained for this SQL\nwarehouse. Increasing this will ensure that a larger number of clusters are\nalways running and therefore may reduce the cold start time for new\nqueries. This is similar to reserved vs. revocable cores in a resource\nmanager.\n\nSupported values:\n- Must be \u003e 0\n- Must be \u003c= min(max_num_clusters, 30)\n\nDefaults to 1",
+                        "$ref": "#/$defs/int",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "name": {
+                        "description": "Logical name for the cluster.\n\nSupported values:\n- Must be unique within an org.\n- Must be less than 100 characters.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "permissions": {
+                        "description": "The permissions to apply to this resource.",
+                        "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.SqlWarehousePermission",
+                        "markdownDescription": "A Sequence of permissions to apply to this resource, where each item grants a permission `level` to a single `user_name`, `group_name`, or `service_principal_name`. A principal cannot be set in both a resource's `permissions` and the top-level `permissions` mapping.\n\nSee [permissions](https://docs.databricks.com/dev-tools/bundles/settings.html#permissions) and [link](https://docs.databricks.com/dev-tools/bundles/permissions.html)."
+                      },
+                      "spot_instance_policy": {
+                        "description": "Configurations whether the endpoint should use spot instances.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.SpotInstancePolicy",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "statement_timeout": {
+                        "description": "[Beta] Warehouse statement timeout in seconds.",
+                        "$ref": "#/$defs/int",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
+                      },
+                      "tags": {
+                        "description": "A set of key-value pairs that will be tagged on all resources (e.g., AWS instances and EBS volumes) associated\nwith this SQL warehouse.\n\nSupported values:\n- Number of tags \u003c 45.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.EndpointTags",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "warehouse_type": {
+                        "description": "Warehouse type: `PRO` or `CLASSIC`. If you want to use serverless compute,\nyou must set to `PRO` and also set the field `enable_serverless_compute` to `true`.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.CreateWarehouseRequestWarehouseType",
+                        "x-databricks-launch-stage": "GA"
+                      }
+                    },
+                    "additionalProperties": false
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "resources.SqlWarehousePermission": {
+                "oneOf": [
+                  {
+                    "type": "object",
+                    "properties": {
+                      "group_name": {
+                        "description": "The name of the group granted the permission level.",
+                        "$ref": "#/$defs/string"
+                      },
+                      "level": {
+                        "description": "The permission level to apply. The allowed levels depend on the resource type.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.WarehousePermissionLevel"
+                      },
+                      "service_principal_name": {
+                        "description": "The name of the service principal granted the permission level.",
+                        "$ref": "#/$defs/string"
+                      },
+                      "user_name": {
+                        "description": "The name of the user granted the permission level.",
+                        "$ref": "#/$defs/string"
+                      }
+                    },
+                    "additionalProperties": false,
+                    "required": [
+                      "level"
+                    ]
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "resources.SyncedDatabaseTable": {
+                "oneOf": [
+                  {
+                    "type": "object",
+                    "properties": {
+                      "database_instance_name": {
+                        "description": "[Public Preview] Name of the target database instance. This is required when creating synced database tables in standard catalogs.\nThis is optional when creating synced database tables in registered catalogs. If this field is specified\nwhen creating synced database tables in registered catalogs, the database instance name MUST\nmatch that of the registered catalog (or the request will be rejected).",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                      },
+                      "lifecycle": {
+                        "description": "Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.",
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
+                      },
+                      "logical_database_name": {
+                        "description": "[Public Preview] Target Postgres database object (logical database) name for this table.\n\nWhen creating a synced table in a registered Postgres catalog, the\ntarget Postgres database name is inferred to be that of the registered catalog.\nIf this field is specified in this scenario, the Postgres database name MUST\nmatch that of the registered catalog (or the request will be rejected).\n\nWhen creating a synced table in a standard catalog, this field is required.\nIn this scenario, specifying this field will allow targeting an arbitrary postgres database.\nNote that this has implications for the `create_database_objects_is_missing` field in `spec`.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                      },
+                      "name": {
+                        "description": "[Public Preview] Full three-part (catalog, schema, table) name of the table.",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                      },
+                      "spec": {
+                        "description": "[Public Preview] Specification of a synced database table.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/database.SyncedTableSpec",
+                        "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                      }
+                    },
+                    "additionalProperties": false,
+                    "required": [
+                      "name"
+                    ]
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "resources.VectorSearchEndpoint": {
+                "oneOf": [
+                  {
+                    "type": "object",
+                    "properties": {
+                      "budget_policy_id": {
+                        "description": "[Public Preview] The budget policy id to be applied",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                      },
+                      "endpoint_type": {
+                        "description": "Type of endpoint",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/vectorsearch.EndpointType",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "lifecycle": {
+                        "description": "Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.",
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
+                      },
+                      "name": {
+                        "description": "Name of the AI Search endpoint",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "permissions": {
+                        "description": "The permissions to apply to this resource.",
+                        "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.VectorSearchEndpointPermission",
+                        "markdownDescription": "A Sequence of permissions to apply to this resource, where each item grants a permission `level` to a single `user_name`, `group_name`, or `service_principal_name`. A principal cannot be set in both a resource's `permissions` and the top-level `permissions` mapping.\n\nSee [permissions](https://docs.databricks.com/dev-tools/bundles/settings.html#permissions) and [link](https://docs.databricks.com/dev-tools/bundles/permissions.html)."
+                      },
+                      "target_qps": {
+                        "description": "Target QPS for the endpoint. Mutually exclusive with num_replicas.\nThe actual replica count is calculated at index creation/sync time based on this value.\nBest-effort target; the system does not guarantee this QPS will be achieved.",
+                        "$ref": "#/$defs/int64",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "usage_policy_id": {
+                        "description": "[Private Preview] The usage policy id to be applied once we've migrated to usage policies",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                        "doNotSuggest": true
+                      }
+                    },
+                    "additionalProperties": false,
+                    "required": [
+                      "endpoint_type",
+                      "name"
+                    ]
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "resources.VectorSearchEndpointPermission": {
+                "oneOf": [
+                  {
+                    "type": "object",
+                    "properties": {
+                      "group_name": {
+                        "$ref": "#/$defs/string"
+                      },
+                      "level": {
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/vectorsearch.VectorSearchEndpointPermissionLevel"
+                      },
+                      "service_principal_name": {
+                        "$ref": "#/$defs/string"
+                      },
+                      "user_name": {
+                        "$ref": "#/$defs/string"
+                      }
+                    },
+                    "additionalProperties": false,
+                    "required": [
+                      "level"
+                    ]
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "resources.VectorSearchIndex": {
+                "oneOf": [
+                  {
+                    "type": "object",
+                    "properties": {
+                      "delta_sync_index_spec": {
+                        "description": "Specification for Delta Sync Index. Required if `index_type` is `DELTA_SYNC`.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/vectorsearch.DeltaSyncVectorIndexSpecRequest",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "direct_access_index_spec": {
+                        "description": "Specification for Direct Vector Access Index. Required if `index_type` is `DIRECT_ACCESS`.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/vectorsearch.DirectAccessVectorIndexSpec",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "endpoint_name": {
+                        "description": "Name of the endpoint to be used for serving the index",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "grants": {
+                        "description": "The Unity Catalog privileges to grant to principals on this securable.",
+                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/catalog.PrivilegeAssignment",
+                        "markdownDescription": "A Sequence of Unity Catalog privilege grants on this securable, where each item grants a set of `privileges` to a `principal` (a user, group, or service principal).\n\nSee [link](https://docs.databricks.com/data-governance/unity-catalog/manage-privileges/index.html)."
+                      },
+                      "index_subtype": {
+                        "description": "[Beta] The subtype of the index. Use `HYBRID` or `FULL_TEXT`. `VECTOR` is not supported.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/vectorsearch.IndexSubtype",
+                        "x-databricks-launch-stage": "PUBLIC_BETA"
+                      },
+                      "index_type": {
+                        "description": "There are 2 types of AI Search indexes:\n- `DELTA_SYNC`: An index that automatically syncs with a source Delta Table, automatically and incrementally updating the index as the underlying data in the Delta Table changes.\n- `DIRECT_ACCESS`: An index that supports direct read and write of vectors and metadata through our REST and SDK APIs. With this model, the user manages index updates.",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/vectorsearch.VectorIndexType",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "lifecycle": {
+                        "description": "Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.",
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
+                      },
+                      "name": {
+                        "description": "Name of the index",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "primary_key": {
+                        "description": "Primary key of the index",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      }
+                    },
+                    "additionalProperties": false,
+                    "required": [
+                      "endpoint_name",
+                      "index_type",
+                      "name",
+                      "primary_key"
+                    ]
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "resources.Volume": {
+                "oneOf": [
+                  {
+                    "type": "object",
+                    "properties": {
+                      "catalog_name": {
+                        "description": "The name of the catalog where the schema and the volume are",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "comment": {
+                        "description": "The comment attached to the volume",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "grants": {
+                        "description": "The Unity Catalog privileges to grant to principals on this securable.",
+                        "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/catalog.PrivilegeAssignment",
+                        "markdownDescription": "A Sequence of Unity Catalog privilege grants on this securable, where each item grants a set of `privileges` to a `principal` (a user, group, or service principal).\n\nSee [link](https://docs.databricks.com/data-governance/unity-catalog/manage-privileges/index.html)."
+                      },
+                      "lifecycle": {
+                        "description": "Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.",
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
+                      },
+                      "name": {
+                        "description": "The name of the volume",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "schema_name": {
+                        "description": "The name of the schema where the volume is",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "storage_location": {
+                        "description": "The storage location on the cloud",
+                        "$ref": "#/$defs/string",
+                        "x-databricks-launch-stage": "GA"
+                      },
+                      "volume_type": {
+                        "description": "The type of the volume. An external volume is located in the specified external location.\nA managed volume is located in the default location which is specified by the parent schema, or the parent catalog, or the Metastore.\n[Learn more](https://docs.databricks.com/aws/en/volumes/managed-vs-external)",
+                        "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.VolumeType",
+                        "x-databricks-launch-stage": "GA"
+                      }
+                    },
+                    "additionalProperties": false,
+                    "required": [
+                      "catalog_name",
+                      "name",
+                      "schema_name"
+                    ],
+                    "markdownDescription": "The volume resource type allows you to define and create Unity Catalog [volumes](https://docs.databricks.com/api/workspace/volumes/create) as part of a bundle. When deploying a bundle with a volume defined, note that:\n\n- A volume cannot be referenced in the `artifact_path` for the bundle until it exists in the workspace. Hence, if you want to use Declarative Automation Bundles to create the volume, you must first define the volume in the bundle, deploy it to create the volume, then reference it in the `artifact_path` in subsequent deployments.\n\n- Volumes in the bundle are not prepended with the `dev_${workspace.current_user.short_name}` prefix when the deployment target has `mode: development` configured. However, you can manually configure this prefix. See [custom-presets](https://docs.databricks.com/dev-tools/bundles/deployment-modes.html#custom-presets)."
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "variable.Lookup": {
+                "oneOf": [
+                  {
+                    "type": "object",
+                    "properties": {
+                      "alert": {
+                        "description": "The name of the alert for which to retrieve an ID.",
+                        "$ref": "#/$defs/string"
+                      },
+                      "cluster": {
+                        "description": "The name of the cluster for which to retrieve an ID.",
+                        "$ref": "#/$defs/string"
+                      },
+                      "cluster_policy": {
+                        "description": "The name of the cluster_policy for which to retrieve an ID.",
+                        "$ref": "#/$defs/string"
+                      },
+                      "dashboard": {
+                        "description": "The name of the dashboard for which to retrieve an ID.",
+                        "$ref": "#/$defs/string"
+                      },
+                      "instance_pool": {
+                        "description": "The name of the instance_pool for which to retrieve an ID.",
+                        "$ref": "#/$defs/string"
+                      },
+                      "job": {
+                        "description": "The name of the job for which to retrieve an ID.",
+                        "$ref": "#/$defs/string"
+                      },
+                      "metastore": {
+                        "description": "The name of the metastore for which to retrieve an ID.",
+                        "$ref": "#/$defs/string"
+                      },
+                      "notification_destination": {
+                        "description": "The name of the notification_destination for which to retrieve an ID.",
+                        "$ref": "#/$defs/string"
+                      },
+                      "pipeline": {
+                        "description": "The name of the pipeline for which to retrieve an ID.",
+                        "$ref": "#/$defs/string"
+                      },
+                      "query": {
+                        "description": "The name of the query for which to retrieve an ID.",
+                        "$ref": "#/$defs/string"
+                      },
+                      "service_principal": {
+                        "description": "The name of the service_principal for which to retrieve an ID.",
+                        "$ref": "#/$defs/string"
+                      },
+                      "warehouse": {
+                        "description": "The name of the warehouse for which to retrieve an ID.",
+                        "$ref": "#/$defs/string"
+                      }
+                    },
+                    "additionalProperties": false
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "variable.TargetVariable": {
+                "anyOf": [
+                  {
+                    "type": "object",
+                    "properties": {
+                      "default": {
+                        "description": "The default value for the variable.",
+                        "$ref": "#/$defs/interface"
+                      },
+                      "description": {
+                        "description": "The description of the variable.",
+                        "$ref": "#/$defs/string"
+                      },
+                      "lookup": {
+                        "description": "The name of the alert, cluster_policy, cluster, dashboard, instance_pool, job, metastore, pipeline, query, service_principal, or warehouse object for which to retrieve an ID.",
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/variable.Lookup"
+                      },
+                      "type": {
+                        "description": "The type of the variable.",
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/variable.VariableType"
+                      }
+                    },
+                    "additionalProperties": false
+                  },
+                  {}
+                ]
+              },
+              "variable.Variable": {
+                "type": "object",
+                "description": "Defines a custom variable for the bundle.",
+                "properties": {
+                  "default": {
+                    "description": "The default value for the variable.",
+                    "$ref": "#/$defs/interface"
+                  },
+                  "description": {
+                    "description": "The description of the variable",
+                    "$ref": "#/$defs/string"
+                  },
+                  "lookup": {
+                    "description": "The name of the alert, cluster_policy, cluster, dashboard, instance_pool, job, metastore, pipeline, query, service_principal, or warehouse object for which to retrieve an ID.",
+                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/variable.Lookup",
+                    "markdownDescription": "The name of the `alert`, `cluster_policy`, `cluster`, `dashboard`, `instance_pool`, `job`, `metastore`, `pipeline`, `query`, `service_principal`, or `warehouse` object for which to retrieve an ID."
+                  },
+                  "type": {
+                    "description": "The type of the variable.",
+                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/variable.VariableType"
+                  }
+                },
+                "additionalProperties": false,
+                "markdownDescription": "Defines a custom variable for the bundle. See [variables](https://docs.databricks.com/dev-tools/bundles/settings.html#variables)."
+              },
+              "variable.VariableType": {
+                "type": "string"
+              }
+            },
+            "config.Artifact": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "build": {
+                      "description": "An optional set of build commands to run locally before deployment.",
+                      "$ref": "#/$defs/string"
+                    },
+                    "dynamic_version": {
+                      "description": "Whether to patch the wheel version dynamically based on the timestamp of the whl file. If this is set to `true`, new code can be deployed without having to update the version in `setup.py` or `pyproject.toml`. This setting is only valid when `type` is set to `whl`. See [\\_](/dev-tools/bundles/settings.md#bundle-syntax-mappings-artifacts).",
+                      "$ref": "#/$defs/bool"
+                    },
+                    "executable": {
+                      "description": "The executable type. Valid values are `bash`, `sh`, and `cmd`.",
+                      "$ref": "#/$defs/github.com/databricks/cli/libs/exec.ExecutableType"
+                    },
+                    "files": {
+                      "description": "The relative or absolute path to the built artifact files.",
+                      "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config.ArtifactFile"
+                    },
+                    "git": {
+                      "description": "For a `tgz` artifact, snapshot this git ref instead of the working tree. Mutually exclusive with `build`.",
+                      "$ref": "#/$defs/github.com/databricks/cli/bundle/config.ArtifactGit"
+                    },
+                    "include": {
+                      "description": "For a `tgz` artifact, subpaths of `path` to pack, relative to it; empty packs the whole `path`. `.gitignore` is honored; the bundle-wide sync include/exclude do not apply. Archive entries are named relative to `path`. Mutually exclusive with `build`.",
+                      "$ref": "#/$defs/slice/string"
+                    },
+                    "path": {
+                      "description": "The local path of the directory for the artifact.",
+                      "$ref": "#/$defs/string"
+                    },
+                    "type": {
+                      "description": "The type of the artifact. Valid values are `whl`, `jar`, and `tgz`. Required if the artifact is a Python wheel.",
+                      "$ref": "#/$defs/github.com/databricks/cli/bundle/config.ArtifactType",
+                      "markdownDescription": "The type of the artifact. Valid values are `whl`, `jar`, and `tgz`. Required if the artifact is a Python wheel."
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "config.ArtifactFile": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "source": {
+                      "description": "Required. The artifact source file.",
+                      "$ref": "#/$defs/string"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "source"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "config.ArtifactGit": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "branch": {
+                      "description": "The git branch to snapshot.",
+                      "$ref": "#/$defs/string"
+                    },
+                    "commit": {
+                      "description": "The git commit to snapshot. Takes precedence over `branch` when both are set.",
+                      "$ref": "#/$defs/string"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "config.ArtifactType": {
+              "type": "string"
+            },
+            "config.Bundle": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "cluster_id": {
+                      "description": "The ID of a cluster to use to run the bundle.",
+                      "$ref": "#/$defs/string",
+                      "markdownDescription": "The ID of a cluster to use to run the bundle. See [cluster_id](https://docs.databricks.com/dev-tools/bundles/settings.html#cluster_id)."
+                    },
+                    "compute_id": {
+                      "description": "Deprecated. The ID of the compute to use to run the bundle.",
+                      "$ref": "#/$defs/string"
+                    },
+                    "databricks_cli_version": {
+                      "description": "The Databricks CLI version to use for the bundle.",
+                      "$ref": "#/$defs/string",
+                      "markdownDescription": "The Databricks CLI version to use for the bundle. See [databricks_cli_version](https://docs.databricks.com/dev-tools/bundles/settings.html#databricks_cli_version)."
+                    },
+                    "deployment": {
+                      "description": "The definition of the bundle deployment",
+                      "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Deployment",
+                      "markdownDescription": "The definition of the bundle deployment. For supported attributes see [link](https://docs.databricks.com/dev-tools/bundles/deployment-modes.html)."
+                    },
+                    "engine": {
+                      "description": "The deployment engine to use. Valid values are `direct`. Takes priority over `DATABRICKS_BUNDLE_ENGINE` environment variable. Default is \"direct\".",
+                      "$ref": "#/$defs/github.com/databricks/cli/bundle/config/engine.EngineType"
+                    },
+                    "git": {
+                      "description": "The Git version control details that are associated with your bundle.",
+                      "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Git",
+                      "markdownDescription": "The Git version control details that are associated with your bundle. For supported attributes see [git](https://docs.databricks.com/dev-tools/bundles/settings.html#git)."
+                    },
+                    "name": {
+                      "description": "The name of the bundle.",
+                      "$ref": "#/$defs/string"
+                    },
+                    "uuid": {
+                      "description": "Reserved. A Universally Unique Identifier (UUID) for the bundle that uniquely identifies the bundle in internal Databricks systems. This is generated when a bundle project is initialized using a Databricks template (using the `databricks bundle init` command).",
+                      "$ref": "#/$defs/string"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "name"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "config.Command": {
+              "type": "string"
+            },
+            "config.Deployment": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "deployment_id": {
+                      "description": "The ID the deployment metadata service assigned to this bundle's deployment. Output only.",
+                      "$ref": "#/$defs/string"
+                    },
+                    "fail_on_active_runs": {
+                      "description": "Whether to fail on active runs. If this is set to true a deployment that is running can be interrupted.",
+                      "$ref": "#/$defs/bool"
+                    },
+                    "latest_version_id": {
+                      "description": "The most recent version the deployment metadata service recorded for this deployment. Output only.",
+                      "$ref": "#/$defs/int"
+                    },
+                    "lock": {
+                      "description": "The deployment lock attributes.",
+                      "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Lock"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "config.Experimental": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "deployment_history": {
+                      "description": "Whether to record deployment history using the deployment metadata service (DMS), which tracks what changed across deployments.",
+                      "$ref": "#/$defs/bool"
+                    },
+                    "immutable_folder": {
+                      "description": "Whether to deploy bundle files and artifacts as a single immutable snapshot. When true, all files are packaged into a content-addressed archive and workspace.file_path and workspace.artifact_path are set to the resulting location.",
+                      "$ref": "#/$defs/bool"
+                    },
+                    "pydabs": {
+                      "description": "The PyDABs configuration.",
+                      "$ref": "#/$defs/github.com/databricks/cli/bundle/config.PyDABs",
+                      "deprecationMessage": "Deprecated: please use python instead",
+                      "deprecated": true
+                    },
+                    "python": {
+                      "description": "Configures loading of Python code defined with 'databricks-bundles' package.",
+                      "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Python"
+                    },
+                    "python_wheel_wrapper": {
+                      "description": "Whether to use a Python wheel wrapper.",
+                      "$ref": "#/$defs/bool"
+                    },
+                    "scripts": {
+                      "description": "The commands to run.",
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config.Command"
+                    },
+                    "skip_artifact_cleanup": {
+                      "description": "Determines whether to skip cleaning up the .internal folder",
+                      "$ref": "#/$defs/bool"
+                    },
+                    "skip_name_prefix_for_schema": {
+                      "description": "Skip adding the prefix that is either set in `presets.name_prefix` or computed when `mode: development`\nis set, to the names of UC schemas defined in the bundle.",
+                      "$ref": "#/$defs/bool"
+                    },
+                    "use_legacy_run_as": {
+                      "description": "Whether to use the legacy run_as behavior.",
+                      "$ref": "#/$defs/bool"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "config.Git": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "branch": {
+                      "description": "The Git branch name.",
+                      "$ref": "#/$defs/string",
+                      "markdownDescription": "The Git branch name. See [git](https://docs.databricks.com/dev-tools/bundles/settings.html#git)."
+                    },
+                    "origin_url": {
+                      "description": "The origin URL of the repository.",
+                      "$ref": "#/$defs/string",
+                      "markdownDescription": "The origin URL of the repository. See [git](https://docs.databricks.com/dev-tools/bundles/settings.html#git)."
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "config.Lock": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "enabled": {
+                      "description": "Whether this lock is enabled.",
+                      "$ref": "#/$defs/bool"
+                    },
+                    "force": {
+                      "description": "Whether to force this lock if it is enabled.",
+                      "$ref": "#/$defs/bool"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "config.Mode": {
+              "type": "string"
+            },
+            "config.Presets": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "artifacts_dynamic_version": {
+                      "description": "Whether to enable dynamic_version on all artifacts.",
+                      "$ref": "#/$defs/bool"
+                    },
+                    "jobs_max_concurrent_runs": {
+                      "description": "The maximum concurrent runs for a job.",
+                      "$ref": "#/$defs/int"
+                    },
+                    "name_prefix": {
+                      "description": "The prefix for job runs of the bundle.",
+                      "$ref": "#/$defs/string"
+                    },
+                    "pipelines_development": {
+                      "description": "Whether pipeline deployments should be locked in development mode.",
+                      "$ref": "#/$defs/bool"
+                    },
+                    "source_linked_deployment": {
+                      "description": "Whether to link the deployment to the bundle source.",
+                      "$ref": "#/$defs/bool"
+                    },
+                    "tags": {
+                      "description": "The tags for the bundle deployment.",
+                      "$ref": "#/$defs/map/string"
+                    },
+                    "trigger_pause_status": {
+                      "description": "A pause status to apply to all job triggers and schedules. Valid values are PAUSED or UNPAUSED.",
+                      "$ref": "#/$defs/string"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "config.PyDABs": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "enabled": {
+                      "description": "Whether or not PyDABs (Private Preview) is enabled",
+                      "$ref": "#/$defs/bool"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "config.Python": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "mutators": {
+                      "description": "Mutators contains a list of fully qualified function paths to mutator functions.\n\nExample: [\"my_project.mutators:add_default_cluster\"]",
+                      "$ref": "#/$defs/slice/string"
+                    },
+                    "resources": {
+                      "description": "Resources contains a list of fully qualified function paths to load resources\ndefined in Python code.\n\nExample: [\"my_project.resources:load_resources\"]",
+                      "$ref": "#/$defs/slice/string"
+                    },
+                    "venv_path": {
+                      "description": "VEnvPath is path to the virtual environment.\n\nIf enabled, Python code will execute within this environment. If disabled,\nit defaults to using the Python interpreter available in the current shell.",
+                      "$ref": "#/$defs/string"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "config.Resources": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "alerts": {
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.Alert"
+                    },
+                    "apps": {
+                      "description": "The app resource defines a Databricks app.",
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.App",
+                      "markdownDescription": "The app resource defines a [Databricks app](https://docs.databricks.com/api/workspace/apps/create). For information about Databricks Apps, see [link](https://docs.databricks.com/dev-tools/databricks-apps/index.html)."
+                    },
+                    "catalogs": {
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.Catalog"
+                    },
+                    "cluster_policies": {
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.ClusterPolicy"
+                    },
+                    "clusters": {
+                      "description": "The cluster definitions for the bundle, where each key is the name of a cluster.",
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.Cluster",
+                      "markdownDescription": "The cluster definitions for the bundle, where each key is the name of a cluster. See [clusters](https://docs.databricks.com/dev-tools/bundles/resources.html#clusters)."
+                    },
+                    "dashboards": {
+                      "description": "The dashboard definitions for the bundle, where each key is the name of the dashboard.",
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.Dashboard",
+                      "markdownDescription": "The dashboard definitions for the bundle, where each key is the name of the dashboard. See [dashboards](https://docs.databricks.com/dev-tools/bundles/resources.html#dashboards)."
+                    },
+                    "database_catalogs": {
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.DatabaseCatalog"
+                    },
+                    "database_instances": {
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.DatabaseInstance"
+                    },
+                    "experiments": {
+                      "description": "The experiment definitions for the bundle, where each key is the name of the experiment.",
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.MlflowExperiment",
+                      "markdownDescription": "The experiment definitions for the bundle, where each key is the name of the experiment. See [experiments](https://docs.databricks.com/dev-tools/bundles/resources.html#experiments)."
+                    },
+                    "external_locations": {
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.ExternalLocation"
+                    },
+                    "features": {
+                      "description": "The feature definitions for the bundle, where each key is the name of the feature.",
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.Feature",
+                      "markdownDescription": "The feature definitions for the bundle, where each key is the name of the feature."
+                    },
+                    "genie_spaces": {
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.GenieSpace"
+                    },
+                    "instance_pools": {
+                      "description": "The instance pool definitions for the bundle, where each key is the name of the instance pool.",
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.InstancePool",
+                      "markdownDescription": "The instance pool definitions for the bundle, where each key is the name of the instance pool. See [instance_pools](https://docs.databricks.com/dev-tools/bundles/resources.html#instance_pools)."
+                    },
+                    "job_runs": {
+                      "description": "The job run definitions for the bundle, where each key is the name of the job run. Each job run triggers a run of an existing job as part of bundle deployment.\n\nThe deployment waits for the run to finish and fails if it does not succeed, so other resources can reference the run's outcome, for example `${resources.job_runs.\u003cname\u003e.state.result_state}`. A run that did not succeed is run again on the next deployment.",
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.JobRun"
+                    },
+                    "jobs": {
+                      "description": "The job definitions for the bundle, where each key is the name of the job.",
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.Job",
+                      "markdownDescription": "The job definitions for the bundle, where each key is the name of the job. See [jobs](https://docs.databricks.com/dev-tools/bundles/resources.html#jobs)."
+                    },
+                    "mcp_services": {
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.McpService"
+                    },
+                    "model_provider_services": {
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.ModelProviderService"
+                    },
+                    "model_services": {
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.ModelService"
+                    },
+                    "model_serving_endpoints": {
+                      "description": "The model serving endpoint definitions for the bundle, where each key is the name of the model serving endpoint.",
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.ModelServingEndpoint",
+                      "markdownDescription": "The model serving endpoint definitions for the bundle, where each key is the name of the model serving endpoint. See [model_serving_endpoints](https://docs.databricks.com/dev-tools/bundles/resources.html#model_serving_endpoints)."
+                    },
+                    "models": {
+                      "description": "The model definitions for the bundle, where each key is the name of the model.",
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.MlflowModel",
+                      "markdownDescription": "The model definitions for the bundle, where each key is the name of the model. See [models](https://docs.databricks.com/dev-tools/bundles/resources.html#models)."
+                    },
+                    "pipelines": {
+                      "description": "The pipeline definitions for the bundle, where each key is the name of the pipeline.",
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.Pipeline",
+                      "markdownDescription": "The pipeline definitions for the bundle, where each key is the name of the pipeline. See [pipelines](https://docs.databricks.com/dev-tools/bundles/resources.html#pipelines)."
+                    },
+                    "postgres_branches": {
+                      "description": "The Postgres branch definitions for the bundle, where each key is the name of the branch. Each entry defines a branch of a Lakebase Autoscaling project, holding its own copy of the project's databases and roles.",
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.PostgresBranch"
+                    },
+                    "postgres_catalogs": {
+                      "description": "The Postgres catalog definitions for the bundle, where each key is the name of the catalog. Each entry binds a Unity Catalog catalog to a Postgres database on a Lakebase Autoscaling branch.",
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.PostgresCatalog"
+                    },
+                    "postgres_databases": {
+                      "description": "The Postgres database definitions for the bundle, where each key is the name of the database. Each entry defines a database on a Lakebase Autoscaling branch.",
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.PostgresDatabase"
+                    },
+                    "postgres_endpoints": {
+                      "description": "The Postgres endpoint definitions for the bundle, where each key is the name of the endpoint. Each entry defines a compute endpoint that serves queries for a Lakebase Autoscaling branch.",
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.PostgresEndpoint"
+                    },
+                    "postgres_projects": {
+                      "description": "The Postgres project definitions for the bundle, where each key is the name of the project. Each entry defines a Lakebase Autoscaling project, the top-level container for branches, endpoints, databases, and roles.",
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.PostgresProject"
+                    },
+                    "postgres_roles": {
+                      "description": "The Postgres role definitions for the bundle, where each key is the name of the role. Each entry defines a role on a Lakebase Autoscaling branch, optionally backed by a Databricks identity.",
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.PostgresRole"
+                    },
+                    "postgres_snapshot_schedules": {
+                      "description": "The Postgres snapshot schedule definitions for the bundle, where each key is the name of the snapshot schedule. Each entry configures the automatic-snapshot cadences for a branch of a Lakebase Autoscaling project.",
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.PostgresSnapshotSchedule"
+                    },
+                    "postgres_synced_tables": {
+                      "description": "The Postgres synced table definitions for the bundle, where each key is the name of the synced table. Each entry continuously replicates a Unity Catalog Delta source table into a Postgres table on a Lakebase Autoscaling instance.",
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.PostgresSyncedTable"
+                    },
+                    "quality_monitors": {
+                      "description": "The quality monitor definitions for the bundle, where each key is the name of the quality monitor.",
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.QualityMonitor",
+                      "markdownDescription": "The quality monitor definitions for the bundle, where each key is the name of the quality monitor. See [quality_monitors](https://docs.databricks.com/dev-tools/bundles/resources.html#quality_monitors)."
+                    },
+                    "registered_models": {
+                      "description": "The registered model definitions for the bundle, where each key is the name of the Unity Catalog registered model.",
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.RegisteredModel",
+                      "markdownDescription": "The registered model definitions for the bundle, where each key is the name of the Unity Catalog registered model. See [registered_models](https://docs.databricks.com/dev-tools/bundles/resources.html#registered_models)"
+                    },
+                    "schemas": {
+                      "description": "The schema definitions for the bundle, where each key is the name of the schema.",
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.Schema",
+                      "markdownDescription": "The schema definitions for the bundle, where each key is the name of the schema. See [schemas](https://docs.databricks.com/dev-tools/bundles/resources.html#schemas)."
+                    },
+                    "secret_scopes": {
+                      "description": "The secret scope definitions for the bundle, where each key is the name of the secret scope.",
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.SecretScope",
+                      "markdownDescription": "The secret scope definitions for the bundle, where each key is the name of the secret scope. See [secret_scopes](https://docs.databricks.com/dev-tools/bundles/resources.html#secret_scopes)."
+                    },
+                    "secrets": {
+                      "description": "The Unity Catalog secret definitions for the bundle, where each key is the name of the secret.",
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.Secret",
+                      "markdownDescription": "The Unity Catalog secret definitions for the bundle, where each key is the name of the secret. See [secrets](https://docs.databricks.com/dev-tools/bundles/resources.html#secrets)."
+                    },
+                    "sql_warehouses": {
+                      "description": "The SQL warehouse definitions for the bundle, where each key is the name of the warehouse.",
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.SqlWarehouse",
+                      "markdownDescription": "The SQL warehouse definitions for the bundle, where each key is the name of the warehouse. See [sql_warehouses](https://docs.databricks.com/dev-tools/bundles/resources.html#sql_warehouses)."
+                    },
+                    "synced_database_tables": {
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.SyncedDatabaseTable"
+                    },
+                    "vector_search_endpoints": {
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.VectorSearchEndpoint"
+                    },
+                    "vector_search_indexes": {
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.VectorSearchIndex"
+                    },
+                    "volumes": {
+                      "description": "The volume definitions for the bundle, where each key is the name of the volume.",
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.Volume",
+                      "markdownDescription": "The volume definitions for the bundle, where each key is the name of the volume. See [volumes](https://docs.databricks.com/dev-tools/bundles/resources.html#volumes)."
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "config.Script": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "content": {
+                      "$ref": "#/$defs/string"
+                    },
+                    "env": {
+                      "description": "A map of environment variables to export when running the script. Values may reference `${bundle.*}`, `${workspace.*}`, and `${var.*}` and are resolved before the script runs; reference them from `content` with `$NAME`.",
+                      "$ref": "#/$defs/map/string"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "content"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "config.Sync": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "exclude": {
+                      "description": "A list of files or folders to exclude from the bundle.",
+                      "$ref": "#/$defs/slice/string"
+                    },
+                    "include": {
+                      "description": "A list of files or folders to include in the bundle.",
+                      "$ref": "#/$defs/slice/string"
+                    },
+                    "paths": {
+                      "description": "The local folder paths, which can be outside the bundle root, to synchronize to the workspace when the bundle is deployed.",
+                      "$ref": "#/$defs/slice/string"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "config.Target": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "artifacts": {
+                      "description": "The artifacts to include in the target deployment.",
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config.Artifact"
+                    },
+                    "bundle": {
+                      "description": "The bundle attributes when deploying to this target.",
+                      "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Bundle"
+                    },
+                    "cluster_id": {
+                      "description": "The ID of the cluster to use for this target.",
+                      "$ref": "#/$defs/string"
+                    },
+                    "compute_id": {
+                      "description": "Deprecated. The ID of the compute to use for this target.",
+                      "$ref": "#/$defs/string",
+                      "deprecationMessage": "Deprecated: please use cluster_id instead",
+                      "deprecated": true
+                    },
+                    "default": {
+                      "description": "Whether this target is the default target.",
+                      "$ref": "#/$defs/bool"
+                    },
+                    "git": {
+                      "description": "The Git version control settings for the target.",
+                      "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Git"
+                    },
+                    "mode": {
+                      "description": "The deployment mode for the target.",
+                      "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Mode",
+                      "markdownDescription": "The deployment mode for the target. Valid values are `development` or `production`. See [link](https://docs.databricks.com/dev-tools/bundles/deployment-modes.html)."
+                    },
+                    "permissions": {
+                      "description": "The permissions for deploying and running the bundle in the target.",
+                      "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.Permission"
+                    },
+                    "presets": {
+                      "description": "The deployment presets for the target.",
+                      "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Presets"
+                    },
+                    "resources": {
+                      "description": "The resource definitions for the target.",
+                      "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Resources"
+                    },
+                    "run_as": {
+                      "description": "The identity to use to run the bundle.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobRunAs",
+                      "markdownDescription": "The identity to use to run the bundle, see [link](https://docs.databricks.com/dev-tools/bundles/run-as.html)."
+                    },
+                    "sync": {
+                      "description": "The local paths to sync to the target workspace when a bundle is run or deployed.",
+                      "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Sync"
+                    },
+                    "variables": {
+                      "description": "The custom variable definitions for the target.",
+                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/variable.TargetVariable"
+                    },
+                    "workspace": {
+                      "description": "The Databricks workspace for the target.",
+                      "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Workspace"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "config.Workspace": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "account_id": {
+                      "description": "The Databricks account ID.",
+                      "$ref": "#/$defs/string"
+                    },
+                    "artifact_path": {
+                      "description": "The artifact path to use within the workspace for both deployments and job runs",
+                      "$ref": "#/$defs/string"
+                    },
+                    "auth_type": {
+                      "description": "The authentication type.",
+                      "$ref": "#/$defs/string"
+                    },
+                    "azure_client_id": {
+                      "description": "The Azure client ID",
+                      "$ref": "#/$defs/string"
+                    },
+                    "azure_environment": {
+                      "description": "The Azure environment",
+                      "$ref": "#/$defs/string"
+                    },
+                    "azure_login_app_id": {
+                      "description": "The Azure login app ID",
+                      "$ref": "#/$defs/string"
+                    },
+                    "azure_tenant_id": {
+                      "description": "The Azure tenant ID",
+                      "$ref": "#/$defs/string"
+                    },
+                    "azure_use_msi": {
+                      "description": "Whether to use MSI for Azure",
+                      "$ref": "#/$defs/bool"
+                    },
+                    "azure_workspace_resource_id": {
+                      "description": "The Azure workspace resource ID",
+                      "$ref": "#/$defs/string"
+                    },
+                    "client_id": {
+                      "description": "The client ID for the workspace",
+                      "$ref": "#/$defs/string"
+                    },
+                    "experimental_is_unified_host": {
+                      "description": "Deprecated: no-op. Unified hosts are now detected automatically from /.well-known/databricks-config. Retained for schema compatibility with existing databricks.yml files.",
+                      "$ref": "#/$defs/bool"
+                    },
+                    "file_path": {
+                      "description": "The file path to use within the workspace for both deployments and job runs",
+                      "$ref": "#/$defs/string"
+                    },
+                    "google_service_account": {
+                      "description": "The Google service account name",
+                      "$ref": "#/$defs/string"
+                    },
+                    "host": {
+                      "description": "The Databricks workspace host URL",
+                      "$ref": "#/$defs/string"
+                    },
+                    "profile": {
+                      "description": "The Databricks workspace profile name",
+                      "$ref": "#/$defs/string"
+                    },
+                    "resource_path": {
+                      "description": "The workspace resource path",
+                      "$ref": "#/$defs/string"
+                    },
+                    "root_path": {
+                      "description": "The Databricks workspace root path",
+                      "$ref": "#/$defs/string"
+                    },
+                    "state_path": {
+                      "description": "The workspace state path",
+                      "$ref": "#/$defs/string"
+                    },
+                    "workspace_id": {
+                      "description": "The Databricks workspace ID",
+                      "$ref": "#/$defs/string"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            }
+          },
+          "libs": {
+            "exec.ExecutableType": {
+              "type": "string"
+            }
+          }
+        },
+        "databricks-sdk-go": {
+          "common": {
+            "types": {
+              "duration.Duration": {
+                "type": "string"
+              },
+              "time.Time": {
+                "oneOf": [
+                  {
+                    "type": "object",
+                    "additionalProperties": false
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              }
+            }
+          },
+          "service": {
+            "apps.AppDeployment": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "command": {
+                      "description": "The command with which to run the app. This will override the command specified in the app.yaml file.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "deployment_id": {
+                      "description": "The unique id of the deployment.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "env_vars": {
+                      "description": "The environment variables to set in the app runtime environment. This will override the environment variables specified in the app.yaml file.",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/apps.EnvVar",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "git_source": {
+                      "description": "Git repository to use as the source for the app deployment.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.GitSource",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "health_check": {
+                      "description": "[Private Preview] Deploy-time health check for the app. Verifies the app is responding to HTTP requests before considering the deployment successful.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppHealthCheck",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "mode": {
+                      "description": "The mode of which the deployment will manage the source code.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppDeploymentMode",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "source_code_path": {
+                      "description": "The workspace file system path of the source code used to create the app deployment. This is different from\n`deployment_artifacts.source_code_path`, which is the path used by the deployed app. The former refers\nto the original source code location of the app in the workspace during deployment creation, whereas\nthe latter provides a system generated stable snapshotted source code path used by the deployment.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "apps.AppDeploymentArtifacts": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "source_code_path": {
+                      "description": "The snapshotted workspace file system path of the source code loaded by the deployed app.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "apps.AppDeploymentMode": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "enum": [
+                    "SNAPSHOT",
+                    "AUTO_SYNC"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "apps.AppDeploymentState": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "enum": [
+                    "SUCCEEDED",
+                    "FAILED",
+                    "IN_PROGRESS",
+                    "CANCELLED"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "apps.AppDeploymentStatus": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "apps.AppHealthCheck": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Deploy-time HTTP health check configuration for an app deployment.",
+                  "properties": {
+                    "path": {
+                      "description": "[Private Preview] HTTP path to probe, e.g. \"/health\" or \"/api/status\".",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "timeout": {
+                      "description": "[Private Preview] Timeout to wait for the health check to pass before failing the deployment. If not set, a default timeout is used.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/common/types/duration.Duration",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "apps.AppPermissionLevel": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "description": "Permission level",
+                  "enum": [
+                    "CAN_MANAGE",
+                    "CAN_USE"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "apps.AppResource": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "app": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceApp",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "database": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceDatabase",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "description": {
+                      "description": "Description of the App Resource.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "experiment": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceExperiment",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "genie_space": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceGenieSpace",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "job": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceJob",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "name": {
+                      "description": "Name of the App Resource.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "postgres": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourcePostgres",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "secret": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceSecret",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "serving_endpoint": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceServingEndpoint",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "sql_warehouse": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceSqlWarehouse",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "uc_securable": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceUcSecurable",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "name"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "apps.AppResourceApp": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "permission": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceAppAppPermission",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "apps.AppResourceAppAppPermission": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "enum": [
+                    "CAN_USE"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "apps.AppResourceDatabase": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "database_name": {
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "instance_name": {
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "permission": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceDatabaseDatabasePermission",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "database_name",
+                    "instance_name",
+                    "permission"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "apps.AppResourceDatabaseDatabasePermission": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "enum": [
+                    "CAN_CONNECT_AND_CREATE"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "apps.AppResourceExperiment": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "experiment_id": {
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "permission": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceExperimentExperimentPermission",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "experiment_id",
+                    "permission"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "apps.AppResourceExperimentExperimentPermission": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "enum": [
+                    "CAN_MANAGE",
+                    "CAN_EDIT",
+                    "CAN_READ"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "apps.AppResourceGenieSpace": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "permission": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceGenieSpaceGenieSpacePermission",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "space_id": {
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "name",
+                    "permission",
+                    "space_id"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "apps.AppResourceGenieSpaceGenieSpacePermission": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "enum": [
+                    "CAN_MANAGE",
+                    "CAN_EDIT",
+                    "CAN_RUN",
+                    "CAN_VIEW"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "apps.AppResourceJob": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "id": {
+                      "description": "Id of the job to grant permission on.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "permission": {
+                      "description": "Permissions to grant on the Job. Supported permissions are: \"CAN_MANAGE\", \"IS_OWNER\", \"CAN_MANAGE_RUN\", \"CAN_VIEW\".",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceJobJobPermission",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "id",
+                    "permission"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "apps.AppResourceJobJobPermission": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "enum": [
+                    "CAN_MANAGE",
+                    "IS_OWNER",
+                    "CAN_MANAGE_RUN",
+                    "CAN_VIEW"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "apps.AppResourcePostgres": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "branch": {
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "database": {
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "permission": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourcePostgresPostgresPermission",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "apps.AppResourcePostgresPostgresPermission": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "enum": [
+                    "CAN_CONNECT_AND_CREATE"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "apps.AppResourceSecret": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "key": {
+                      "description": "Key of the secret to grant permission on.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "permission": {
+                      "description": "Permission to grant on the secret scope. For secrets, only one permission is allowed. Permission must be one of: \"READ\", \"WRITE\", \"MANAGE\".",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceSecretSecretPermission",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "scope": {
+                      "description": "Scope of the secret to grant permission on.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "key",
+                    "permission",
+                    "scope"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "apps.AppResourceSecretSecretPermission": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "description": "Permission to grant on the secret scope. Supported permissions are: \"READ\", \"WRITE\", \"MANAGE\".",
+                  "enum": [
+                    "READ",
+                    "WRITE",
+                    "MANAGE"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "apps.AppResourceServingEndpoint": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "description": "Name of the serving endpoint to grant permission on.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "permission": {
+                      "description": "Permission to grant on the serving endpoint. Supported permissions are: \"CAN_MANAGE\", \"CAN_QUERY\", \"CAN_VIEW\".",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceServingEndpointServingEndpointPermission",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "name",
+                    "permission"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "apps.AppResourceServingEndpointServingEndpointPermission": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "enum": [
+                    "CAN_MANAGE",
+                    "CAN_QUERY",
+                    "CAN_VIEW"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "apps.AppResourceSqlWarehouse": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "id": {
+                      "description": "Id of the SQL warehouse to grant permission on.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "permission": {
+                      "description": "Permission to grant on the SQL warehouse. Supported permissions are: \"CAN_MANAGE\", \"CAN_USE\", \"IS_OWNER\".",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceSqlWarehouseSqlWarehousePermission",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "id",
+                    "permission"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "apps.AppResourceSqlWarehouseSqlWarehousePermission": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "enum": [
+                    "CAN_MANAGE",
+                    "CAN_USE",
+                    "IS_OWNER"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "apps.AppResourceUcSecurable": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "permission": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceUcSecurableUcSecurablePermission",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "securable_full_name": {
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "securable_type": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceUcSecurableUcSecurableType",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "permission",
+                    "securable_full_name",
+                    "securable_type"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "apps.AppResourceUcSecurableUcSecurablePermission": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "enum": [
+                    "READ_VOLUME",
+                    "WRITE_VOLUME",
+                    "SELECT",
+                    "EXECUTE",
+                    "USE_CONNECTION",
+                    "MODIFY"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "apps.AppResourceUcSecurableUcSecurableType": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "enum": [
+                    "VOLUME",
+                    "TABLE",
+                    "FUNCTION",
+                    "CONNECTION",
+                    "MODEL_SERVICE"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "apps.ApplicationState": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "enum": [
+                    "DEPLOYING",
+                    "RUNNING",
+                    "CRASHED",
+                    "UNAVAILABLE"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "apps.ApplicationStatus": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "apps.ComputeSize": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "enum": [
+                    "MEDIUM",
+                    "LARGE",
+                    "XLARGE"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "apps.ComputeState": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "enum": [
+                    "ERROR",
+                    "DELETING",
+                    "STARTING",
+                    "STOPPING",
+                    "UPDATING",
+                    "STOPPED",
+                    "ACTIVE"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "apps.ComputeStatus": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "apps.EnvVar": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "description": "The name of the environment variable.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "value": {
+                      "description": "The value for the environment variable.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "value_from": {
+                      "description": "The name of an external Databricks resource that contains the value, such as a secret or a database table.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "apps.GitRepository": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Git repository configuration specifying the location of the repository.",
+                  "properties": {
+                    "auto_deploy": {
+                      "description": "When true, automatically deploys the app on push events to the branch configured in\nthe app's deployment_source.git_source.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "caller_credential_id": {
+                      "description": "ID of a personal access token Git credential owned by the caller, used to\ngrant the app's service principal access to this repository.",
+                      "$ref": "#/$defs/int64",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "provider": {
+                      "description": "Git provider. Case insensitive. Supported values: gitHub, gitHubEnterprise, bitbucketCloud,\nbitbucketServer, azureDevOpsServices, gitLab, gitLabEnterpriseEdition, awsCodeCommit.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "url": {
+                      "description": "URL of the Git repository.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "provider",
+                    "url"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "apps.GitSource": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Complete git source specification including repository location and reference.",
+                  "properties": {
+                    "branch": {
+                      "description": "Git branch to checkout.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "commit": {
+                      "description": "Git commit SHA to checkout.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "source_code_path": {
+                      "description": "Relative path to the app source code within the Git repository. If not specified, the root\nof the repository is used.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "tag": {
+                      "description": "Git tag to checkout.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "apps.TelemetryExportDestination": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "A single telemetry export destination with its configuration and status.",
+                  "properties": {
+                    "unity_catalog": {
+                      "description": "Unity Catalog Destinations for OTEL telemetry export.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.UnityCatalog",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "apps.UnityCatalog": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Unity Catalog Destinations for OTEL telemetry export.",
+                  "properties": {
+                    "logs_table": {
+                      "description": "Unity Catalog table for OTEL logs.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "metrics_table": {
+                      "description": "Unity Catalog table for OTEL metrics.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "traces_table": {
+                      "description": "Unity Catalog table for OTEL traces (spans).",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "logs_table",
+                    "metrics_table",
+                    "traces_table"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.AwsSqsQueue": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "queue_url": {
+                      "description": "The AQS queue url in the format https://sqs.{region}.amazonaws.com/{account id}/{queue name}.\nOnly required for provided_sqs.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.AzureEncryptionSettings": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "azure_cmk_access_connector_id": {
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "azure_cmk_managed_identity_id": {
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "azure_tenant_id": {
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "azure_tenant_id"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.AzureQueueStorage": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "queue_url": {
+                      "description": "The AQS queue url in the format https://{storage account}.queue.core.windows.net/{queue name}\nOnly required for provided_aqs.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "resource_group": {
+                      "description": "Optional resource group for the queue, event grid subscription, and external location storage\naccount.\nOnly required for locations with a service principal storage credential",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "subscription_id": {
+                      "description": "Optional subscription id for the queue, event grid subscription, and external location storage\naccount.\nRequired for locations with a service principal storage credential",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.EncryptionDetails": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Encryption options that apply to clients connecting to cloud storage.",
+                  "properties": {
+                    "sse_encryption_details": {
+                      "description": "Server-Side Encryption properties for clients communicating with AWS s3.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.SseEncryptionDetails",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.EncryptionSettings": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Encryption Settings are used to carry metadata for securable encryption at rest.\nCurrently used for catalogs, we can use the information supplied here to interact with a CMK.",
+                  "properties": {
+                    "azure_encryption_settings": {
+                      "description": "optional Azure settings - only required if an Azure CMK is used.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.AzureEncryptionSettings",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "azure_key_vault_key_id": {
+                      "description": "the AKV URL in Azure, null otherwise.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "customer_managed_key_id": {
+                      "description": "the CMK uuid in AWS and GCP, null otherwise.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.FileEventQueue": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "managed_aqs": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.AzureQueueStorage",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "managed_pubsub": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.GcpPubsub",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "managed_sqs": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.AwsSqsQueue",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "provided_aqs": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.AzureQueueStorage",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "provided_pubsub": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.GcpPubsub",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "provided_sqs": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.AwsSqsQueue",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.GcpPubsub": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "subscription_name": {
+                      "description": "The Pub/Sub subscription name in the format projects/{project}/subscriptions/{subscription name}.\nOnly required for provided_pubsub.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.InferenceTableConfig": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Configuration for logging request and response payloads to a Unity Catalog\ninference table. When this configuration is present, payload logging is\nenabled by default.",
+                  "properties": {
+                    "parent": {
+                      "description": "Parent Unity Catalog schema where the inference table is created, in the\nform `schemas/{catalog}.{schema}`. Required when configuring an inference\ntable. After the inference table is created, this field cannot be changed.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "table_name_prefix": {
+                      "description": "Prefix used to form the inference table's registered name. AI Gateway\nappends `_payload`; for example, `table_name_prefix = \"orders\"` creates\n`orders_payload`. If unset, the prefix defaults to the service name. Read\n`table` from the response for the resulting resource name. After the\ninference table is created, this field cannot be changed.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "parent"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.McpServiceConfig": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Operational configuration for an MCP service. Groups the source reference,\ntool selectors, and rate limits -- the fields that configure how the MCP\nservice behaves at invocation time.",
+                  "properties": {
+                    "include_tool_selectors": {
+                      "description": "Tool names or prefix patterns to expose from the MCP server. Use exact\ntool names or prefix patterns such as `read_*`. An empty list exposes all\ntools. At most 1,024 selectors are allowed, and each selector can contain\nat most 256 characters.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "rate_limits": {
+                      "description": "Rate limits for tool invocations. Supported scopes are user, group, service\nprincipal, the service as a whole, and each user by default. Request and\ntoken limits are supported. Empty when no rate limit is configured.",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/catalog.RateLimit",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "source_connection": {
+                      "description": "Unity Catalog connection referencing the MCP server. Required on Create.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.McpServiceConfigSourceConnection",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.McpServiceConfigSourceConnection": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Unity Catalog connection that points to the MCP server. On Create, provide\n`name` in the schema-scoped form\n`connections/{catalog}.{schema}.{connection}`. On read, the service\npopulates the resolved connection metadata. If the connection is deleted,\nits reference remains visible so you can identify the broken dependency.",
+                  "properties": {
+                    "name": {
+                      "description": "Resource name of the Unity Catalog connection used to access the MCP\nserver, in the form `connections/{catalog}.{schema}.{connection}`.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "name"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.ModelProviderServiceConfig": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Behavioral configuration for a ModelProviderService: provider authentication\nand provider-specific fields, the catalog of models this provider\nservice can route to, and the passthrough policy that governs how request\nheaders, query parameters, and unmanaged subpaths cross the trust boundary\nto the upstream provider.",
+                  "properties": {
+                    "allow_all_targets": {
+                      "description": "When true, accepts any model exposed by the upstream provider; `targets`\nis not required and does not restrict routability. When false, only\nmodels listed in `targets` are routable. Defaults to false.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "amazon_bedrock": {
+                      "description": "Amazon Bedrock provider configuration.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigAmazonBedrockProviderConfig",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "anthropic": {
+                      "description": "Anthropic provider configuration. Exactly one of `direct` or `relayed` must\nbe set on Create; the two are mutually exclusive.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigAnthropicProviderConfig",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "azure_openai": {
+                      "description": "Azure OpenAI provider configuration.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigAzureOpenAiProviderConfig",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "bedrock_mantle": {
+                      "description": "Amazon Bedrock provider configuration.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigAmazonBedrockProviderConfig",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "custom": {
+                      "description": "Custom OpenAI-compatible provider configuration with bearer-token\nauthentication.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigCustomProviderConfig",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "forward_headers": {
+                      "description": "Whether to forward incoming HTTP headers to the upstream provider. Defaults\nto false and is configured for the entire provider service, not per request.\nUpstream authentication is configured separately in the provider-specific\nconfiguration.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "forward_query_parameters": {
+                      "description": "Whether to forward incoming query parameters to the upstream provider.\nDefaults to false and is configured for the entire provider service, not\nper request.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "forward_unmanaged_paths": {
+                      "description": "Whether to proxy paths that AI Gateway does not recognize as configured\nprovider-native API types. Defaults to false. When true, these paths are\nforwarded unchanged to the upstream provider. When false, only\nrecognized API paths are served. Enabling this broadens the upstream API\nsurface exposed through the provider service. AI Gateway cannot evaluate\nService Policies on opaque unmanaged requests, so unmanaged requests are\nrejected whenever Service Policies are attached to this securable.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "gemini_enterprise": {
+                      "description": "Gemini Enterprise provider configuration.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigGeminiEnterpriseProviderConfig",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "inference_table": {
+                      "description": "Payload logging configuration for requests sent directly to this provider\nservice. Requests routed through a model service are captured by that model\nservice's inference table instead.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.InferenceTableConfig",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "microsoft_foundry": {
+                      "description": "Microsoft Foundry provider configuration.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigMicrosoftFoundryProviderConfig",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "openai": {
+                      "description": "OpenAI provider configuration.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigOpenAiProviderConfig",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "pricing": {
+                      "description": "Pricing configuration for this provider service. An explicitly empty\nconfiguration is retained on Create and Update and applies no adjustment.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigProviderPricingConfig",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "provider_type": {
+                      "description": "External model provider. Required on Create and immutable thereafter. Set\nthe matching provider-specific configuration, such as `openai`,\n`azure_openai`, or `amazon_bedrock`.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigExternalModelProviderType",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "rate_limits": {
+                      "description": "Rate limits for requests sent directly to this provider service. Requests\nrouted through a model service use that model service's rate limits instead.",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/catalog.RateLimit",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "targets": {
+                      "description": "Models and provider-native API types exposed by this provider service. Each\nentry must include at least one `native_api_types` value. When\n`allow_all_targets` is false, at least one entry is required and model\nservice destinations can reference only listed models. When\n`allow_all_targets` is true, any upstream model is routable; entries in\nthis list provide API-type metadata without restricting other models.",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigModelTargetConfig",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.ModelProviderServiceConfigAmazonBedrockProviderConfig": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Amazon Bedrock provider configuration.",
+                  "properties": {
+                    "direct": {
+                      "description": "Amazon Bedrock region and authentication configuration.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigAmazonBedrockProviderDirectConfig",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.ModelProviderServiceConfigAmazonBedrockProviderDirectConfig": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Direct form of Amazon Bedrock provider config.\n\nAuthentication is one of two mutually exclusive modes, exactly one of which\nmust be supplied on Create:\n- Access keys: set `aws_access_key`, leave `service_credential` unset.\n- Unity Catalog service credential: set `service_credential.name` to the\nresource name `credentials/{name}`, leave `aws_access_key` unset. The\ncredential value lives in Unity Catalog and is referenced by name, not\nheld on this message.\nSetting more than one mode is rejected.",
+                  "properties": {
+                    "aws_access_key": {
+                      "description": "AWS access-key-pair authentication. Set `access_key_id` and\n`secret_access_key.plaintext`. Mutually exclusive with\n`service_credential`.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigAwsAccessKey",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "region": {
+                      "description": "AWS region where the Bedrock endpoint is hosted (e.g., `us-east-1`).\nRequired on Create.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "service_credential": {
+                      "description": "Reference to a Unity Catalog service credential authorizing Bedrock\nrequests. On Create, supply `service_credential.name` in the form\n`credentials/{name}`. Required on Create when using service-credential\nauthentication; mutually exclusive with `aws_access_key`. The credential\nis referenced by name; its value is not carried here. Only\nsupported on AWS-hosted workspaces.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigServiceCredential",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.ModelProviderServiceConfigAnthropicProviderConfig": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Anthropic provider configuration. Exactly one of `direct` or `relayed` must\nbe set on Create; the two are mutually exclusive.",
+                  "properties": {
+                    "direct": {
+                      "description": "Direct authentication with an API key supplied in\n`direct.api_key.plaintext`. Required unless `relayed` is set.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigAnthropicProviderDirectConfig",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "relayed": {
+                      "description": "Relayed authentication. Each inference request supplies the caller's\nOAuth token, which is forwarded to Anthropic. No Anthropic credential is\nstored. Mutually exclusive with `direct`.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigAnthropicProviderRelayedConfig",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.ModelProviderServiceConfigAnthropicProviderDirectConfig": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Direct form of Anthropic provider config.",
+                  "properties": {
+                    "api_key": {
+                      "description": "Anthropic API key. Required when creating the service. Supply the value\nin `api_key.plaintext`.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigProviderSecret",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.ModelProviderServiceConfigAnthropicProviderRelayedConfig": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Relayed Anthropic provider configuration. Each inference request supplies\nthe caller's OAuth token, which is forwarded to Anthropic. No Anthropic\ncredential is stored.",
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.ModelProviderServiceConfigAwsAccessKey": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "AWS access-key-pair auth for Amazon Bedrock: a SigV4-signing key pair.",
+                  "properties": {
+                    "access_key_id": {
+                      "description": "AWS access key ID. Required on Create when using access-key auth. Treated as\nusername-equivalent (not a secret value): round-trips on reads and is\nscrubbed from audit logs.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "secret_access_key": {
+                      "description": "AWS secret access key paired with `access_key_id`. Required when creating\na service with access-key authentication. Supply the value in\n`secret_access_key.plaintext`.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigProviderSecret",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.ModelProviderServiceConfigAzureOpenAiProviderConfig": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Azure OpenAI provider configuration.",
+                  "properties": {
+                    "direct": {
+                      "description": "Azure OpenAI endpoint and authentication configuration.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigAzureOpenAiProviderDirectConfig",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.ModelProviderServiceConfigAzureOpenAiProviderDirectConfig": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Direct form of Azure OpenAI provider config. Exactly one of three\nmutually-exclusive auth modes must be supplied on Create:\n- API key: set `api_key`, leave `entra_service_principal` and\n`service_credential` unset.\n- Entra ID (service principal): set `entra_service_principal`, leave\n`api_key` and `service_credential` unset.\n- Unity Catalog service credential: set `service_credential.name` to the\nresource name `credentials/{name}`, leave `api_key` and\n`entra_service_principal` unset. The credential value lives in Unity\nCatalog and is referenced by name, not held on this message. Only\nsupported on Azure-hosted workspaces.\nSetting more than one mode is rejected.",
+                  "properties": {
+                    "api_key": {
+                      "description": "Azure OpenAI API key. Supply the value in `api_key.plaintext`. Mutually\nexclusive with Entra ID and Unity Catalog service credential\nauthentication.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigProviderSecret",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "base_url": {
+                      "description": "Full Azure OpenAI endpoint base URL, e.g.\n`https://myresource.openai.azure.com`. Required on Create.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "entra_service_principal": {
+                      "description": "Entra ID service-principal authentication. Set `tenant_id`, `client_id`,\nand `client_secret.plaintext`. Mutually exclusive with `api_key` and\n`service_credential`.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigEntraServicePrincipal",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "service_credential": {
+                      "description": "Reference to a Unity Catalog service credential authorizing Azure OpenAI\nrequests. On Create, supply `service_credential.name` in the form\n`credentials/{name}`. Required on Create when using service-credential\nauthentication; mutually exclusive with `api_key` and\n`entra_service_principal`. The credential is referenced by name; its value\nis not carried here. Only supported on Azure-hosted workspaces.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigServiceCredential",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.ModelProviderServiceConfigCustomProviderApiKeyHeaderAuth": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Header-based API-key authentication for a custom provider: the secret is\nforwarded on outbound requests under a caller-chosen HTTP header, as\n`\u003capi_key_name\u003e: \u003capi_key_value\u003e`.",
+                  "properties": {
+                    "api_key_name": {
+                      "description": "HTTP header name that carries the API key on outbound requests (e.g.,\n`Ocp-Apim-Subscription-Key`). The value forwarded under this header is\nsupplied via `api_key_value`.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "api_key_value": {
+                      "description": "Secret value forwarded under the `api_key_name` header on outbound\nrequests. Supplied as inline plaintext via `ProviderSecret.plaintext`.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigProviderSecret",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.ModelProviderServiceConfigCustomProviderConfig": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Custom OpenAI-compatible provider configuration with bearer-token\nauthentication.",
+                  "properties": {
+                    "direct": {
+                      "description": "Endpoint and authentication configuration for the custom provider.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigCustomProviderDirectConfig",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.ModelProviderServiceConfigCustomProviderDirectConfig": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Direct form of a custom provider configuration. Set `api_key` to send the\nsecret as an `Authorization` bearer token, or `header_auth` to forward it\nunder a caller-chosen HTTP header.",
+                  "properties": {
+                    "api_key": {
+                      "description": "Bearer token forwarded in the `Authorization` header. Supply the value\nin `api_key.plaintext`.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigProviderSecret",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "base_url": {
+                      "description": "Endpoint URL of the OpenAI-compatible service (e.g.,\n`https://api.example.com/v1`). Required on Create.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "header_auth": {
+                      "description": "Header-based API-key auth: the secret is forwarded on outbound requests\nunder a caller-chosen HTTP header rather than as an `Authorization`\nbearer token. Set this instead of `api_key` for header auth.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigCustomProviderApiKeyHeaderAuth",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.ModelProviderServiceConfigEntraServicePrincipal": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Entra ID (Azure AD) service-principal authentication. The `tenant_id` and\n`client_id` identify the service principal, and `client_secret` authenticates\nit. AI Gateway exchanges these credentials for an Entra bearer token for\nrequests to Azure OpenAI or Microsoft Foundry.",
+                  "properties": {
+                    "client_id": {
+                      "description": "Entra ID client (application) ID. Required on Create.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "client_secret": {
+                      "description": "Entra ID client secret. Supply the value in `client_secret.plaintext`.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigProviderSecret",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "tenant_id": {
+                      "description": "Entra ID (Azure AD) tenant ID. Required on Create.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.ModelProviderServiceConfigExternalModelProviderType": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "description": "External LLM provider for an EXTERNAL_FOUNDATION_MODEL destination.",
+                  "enum": [
+                    "EXTERNAL_MODEL_PROVIDER_TYPE_OPENAI",
+                    "EXTERNAL_MODEL_PROVIDER_TYPE_AZURE_OPENAI",
+                    "EXTERNAL_MODEL_PROVIDER_TYPE_ANTHROPIC",
+                    "EXTERNAL_MODEL_PROVIDER_TYPE_AMAZON_BEDROCK",
+                    "EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM",
+                    "EXTERNAL_MODEL_PROVIDER_TYPE_MICROSOFT_FOUNDRY",
+                    "EXTERNAL_MODEL_PROVIDER_TYPE_GEMINI_ENTERPRISE",
+                    "EXTERNAL_MODEL_PROVIDER_TYPE_BEDROCK_MANTLE"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.ModelProviderServiceConfigGeminiEnterpriseProviderConfig": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Gemini Enterprise provider configuration.",
+                  "properties": {
+                    "direct": {
+                      "description": "Gemini Enterprise project, region, and authentication configuration.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfig",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfig": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Direct Gemini Enterprise provider configuration. An API key is required\nwhen creating the service.",
+                  "properties": {
+                    "api_key": {
+                      "description": "Google Gemini Enterprise API key. Required when creating the service.\nSupply the value in `api_key.plaintext`.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigProviderSecret",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "project_id": {
+                      "description": "GCP project ID hosting the Gemini Enterprise endpoint. Required on Create.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "region": {
+                      "description": "GCP region of the Gemini Enterprise endpoint (e.g., `us-central1`).\nRequired on Create.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "service_credential": {
+                      "description": "Reference to a Unity Catalog service credential authorizing Gemini\nEnterprise requests. On Create, supply `service_credential.name` as\n`credentials/{name}`; required when using service-credential\nauthentication and mutually exclusive with `api_key`. The credential is\nreferenced by name; its value is not carried here. On read, the resolved\n`id` and `is_deleted` are also populated. Supported only on GCP-hosted\nworkspaces.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigServiceCredential",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.ModelProviderServiceConfigMicrosoftFoundryProviderConfig": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Microsoft Foundry provider configuration.",
+                  "properties": {
+                    "direct": {
+                      "description": "Microsoft Foundry endpoint and authentication configuration.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfig",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfig": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Direct form of Microsoft Foundry provider config.\n\nAuthentication is one of three mutually exclusive modes, exactly one of which\nmust be supplied on Create:\n- API key: set `api_key`, leave `entra_service_principal` and\n`service_credential` unset.\n- Entra ID (service principal): set `entra_service_principal`, leave\n`api_key` and `service_credential` unset. AI Gateway exchanges these for\nan Entra bearer token on outbound requests via the OAuth2\nclient-credentials grant.\n- Unity Catalog service credential: set `service_credential.name` to the\nresource name `credentials/{name}`, leave `api_key` and\n`entra_service_principal` unset. The credential value lives in Unity\nCatalog and is referenced by name, not held on this message. Only\nsupported on Azure-hosted workspaces.\nSetting more than one mode is rejected.",
+                  "properties": {
+                    "api_key": {
+                      "description": "Microsoft Foundry API key. Supply the value in `api_key.plaintext`.\nMutually exclusive with Entra ID and Unity Catalog service credential\nauthentication.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigProviderSecret",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "base_url": {
+                      "description": "Microsoft Foundry endpoint URL. Required on Create.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "entra_service_principal": {
+                      "description": "Entra ID service-principal authentication. Set `tenant_id`, `client_id`,\nand `client_secret.plaintext`. Mutually exclusive with `api_key` and\n`service_credential`.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigEntraServicePrincipal",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "service_credential": {
+                      "description": "Reference to a Unity Catalog service credential authorizing Microsoft\nFoundry requests. On Create, supply `service_credential.name` in the form\n`credentials/{name}`. Required on Create when using service-credential\nauthentication; mutually exclusive with `api_key` and\n`entra_service_principal`. The credential is referenced by name; its value\nis not carried here. Only supported on Azure-hosted workspaces.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigServiceCredential",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.ModelProviderServiceConfigModelTargetConfig": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Model target configuration shared by model provider service targets and\nexternal model destinations on model services.",
+                  "properties": {
+                    "endpoint_route": {
+                      "description": "Relative path appended to a custom provider's `base_url` for this model,\nsuch as `serve/openai/chat`. Nonempty values are only supported for\ncustom model provider service targets; other provider types reject them.\nModel service destinations do not support this field. Do not include\nURI templates, queries, or fragments. When empty, `base_url` is used unchanged.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "model": {
+                      "description": "Provider-side model identifier, such as `gpt-5` or `claude-opus-4-7`.\nThis identifies a model at the upstream provider; it is not a Unity\nCatalog model resource.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "native_api_types": {
+                      "description": "Provider-native API types supported by this model, such as\n`openai/v1/chat/completions`. A model provider service target requires at\nleast one value. A model service destination may omit the list to use the\nmatching provider service target's types when available. AI Gateway uses\nthe selected types for translation. At most 64 entries of 256 characters\neach are allowed.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "model"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.ModelProviderServiceConfigOpenAiProviderConfig": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "OpenAI provider configuration.",
+                  "properties": {
+                    "direct": {
+                      "description": "OpenAI configuration with an API key supplied in the request.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigOpenAiProviderDirectConfig",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.ModelProviderServiceConfigOpenAiProviderDirectConfig": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Direct (inline-credentials) form of the OpenAI provider config.",
+                  "properties": {
+                    "api_key": {
+                      "description": "OpenAI API key. Required when creating the service. Supply the value in\n`api_key.plaintext`.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigProviderSecret",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "base_url": {
+                      "description": "Optional custom base URL. Defaults to `https://api.openai.com/v1`. Use for\nOpenAI-API-compatible third-party endpoints or in-network proxies.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "organization": {
+                      "description": "Optional OpenAI organization ID. When set, the platform forwards it as\nthe `OpenAI-Organization` header.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.ModelProviderServiceConfigProviderPricingConfig": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Pricing adjustments applied to this provider service's external-model spend\nestimates.",
+                  "properties": {
+                    "default_discount_basis_points": {
+                      "description": "Provider-wide adjustment to external-model spend estimates in basis points:\n2000 = 20% off; -2000 = a 20% markup. Negative values have no lower bound\nbeyond the int32 range. Values cannot exceed 10000 (100% off). An omitted\nvalue or zero leaves the estimate unchanged.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.ModelProviderServiceConfigProviderSecret": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "A secret value supplied as part of an inline provider config. The caller\nsupplies the value as inline `plaintext` on writes; the platform stores it\nencrypted. The `plaintext` field is `INPUT_ONLY` and never round-trips on\nreads.",
+                  "properties": {
+                    "plaintext": {
+                      "description": "Inline plaintext credential. INPUT_ONLY: the value never round-trips on\nreads. Get and List responses omit `plaintext`; the enclosing secret\nobject remains present to indicate that a secret is configured.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "secret_reference": {
+                      "description": "Reference to a customer-owned UC Secret that carries this secret value.\nThe value is read at invoke time under the model provider service\nowner's access and is never copied onto the model provider service, so\nrotating the UC Secret takes effect with no change to the model provider\nservice. On Create, supply `secret_reference.name` as\n`secrets/{catalog}.{schema}.{secret}`.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigSecretReference",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.ModelProviderServiceConfigSecretReference": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Reference to a customer-owned UC Secret backing a secret-bearing provider\nfield, in the `ProviderSecret.secret_reference` arm.",
+                  "properties": {
+                    "name": {
+                      "description": "Resource name of the bound UC Secret, in the form\n`secrets/{catalog}.{schema}.{secret}`. On Create the caller supplies the\nname here. On read it reflects the secret's current name at read time.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "name"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.ModelProviderServiceConfigServiceCredential": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "The customer-owned Unity Catalog service credential a model provider service\nuses to authenticate to its provider, referenced by name.",
+                  "properties": {
+                    "name": {
+                      "description": "Resource name of the bound Unity Catalog service credential, in the form\n`credentials/{name}`. Supply this field when creating the service or\nrebinding its credential. On read, it reflects the credential's current\nname.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "name"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.ModelServiceConfig": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Operational configuration wrapped around the ModelService resource.",
+                  "properties": {
+                    "inference_table": {
+                      "description": "Inference table configuration for payload logging.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.InferenceTableConfig",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "rate_limits": {
+                      "description": "Rate limits applied to requests routed through this model service.",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/catalog.RateLimit",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "routing": {
+                      "description": "Routing configuration: destinations and fallback.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelServiceConfigRoutingConfig",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.ModelServiceConfigDestinationConfig": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "A destination the model service can route traffic to. Exactly one of the\nper-type configs inside `type_config` must be set, and it must match\n`destination_type`.",
+                  "properties": {
+                    "destination_type": {
+                      "description": "Backing-model category. Provide the matching type-specific configuration\nand leave the other type-specific configurations unset.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelServiceConfigDestinationConfigDestinationType",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "external_model_config": {
+                      "description": "Configuration for an external model reached through a model provider service.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelServiceConfigExternalModelConfig",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "name": {
+                      "description": "User-facing label for this destination, used in routing references.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "pay_per_token_config": {
+                      "description": "Configuration for a pay-per-token Databricks foundation model.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelServiceConfigPayPerTokenConfig",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "provisioned_throughput_config": {
+                      "description": "Configuration for a provisioned-throughput Databricks foundation model.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelServiceConfigProvisionedThroughputConfig",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "traffic_percentage": {
+                      "description": "Percentage of primary traffic sent to this destination, from 0 to 100.\nRequired when there is more than one primary destination, in which case the\nprimary percentages must sum to 100; a single primary destination receives\nall traffic. Fallback destinations are ordered and do not use this field.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "destination_type",
+                    "name"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.ModelServiceConfigDestinationConfigDestinationType": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "description": "Backing-model category for a model service destination.",
+                  "enum": [
+                    "DESTINATION_TYPE_PAY_PER_TOKEN_FOUNDATION_MODEL",
+                    "DESTINATION_TYPE_PROVISIONED_THROUGHPUT_FOUNDATION_MODEL",
+                    "DESTINATION_TYPE_EXTERNAL_FOUNDATION_MODEL"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.ModelServiceConfigExternalModelConfig": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Configuration for an external-foundation-model destination. Provider auth\nand provider-specific cloud configuration are owned by a separate, governed\nModelProviderService entity referenced via `model_provider_service`; the\nplatform resolves the provider at invocation time.",
+                  "properties": {
+                    "model_provider_service": {
+                      "description": "Resource name of the governed ModelProviderService that owns provider\nauth and provider-specific configuration. The referenced\nModelProviderService also carries the provider type, so this message\ndoes not surface it directly.\nFormat: `model-provider-services/{catalog}.{schema}.{model_provider_service}`.\nEach `{...}` component is capped at 255 characters individually.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "target": {
+                      "description": "Routing target for the destination: the provider-side model selected from\nthe referenced ModelProviderService's `targets` catalog, plus the unified\nAPI types the platform should translate to/from at request time.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigModelTargetConfig",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "model_provider_service",
+                    "target"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.ModelServiceConfigFallbackConfig": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Fallback routing applied after a primary destination fails. Fallback\ndestinations are tried in the listed order.",
+                  "properties": {
+                    "destinations": {
+                      "description": "Fallback destinations, tried in the listed order. At most 5 are allowed.",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/catalog.ModelServiceConfigDestinationConfig",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.ModelServiceConfigPayPerTokenConfig": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Configuration for a pay-per-token foundation-model destination. Identifies\nthe foundation model by its UC resource name; the platform resolves it to a\nModel Serving endpoint at request time.",
+                  "properties": {
+                    "model": {
+                      "description": "Resource name of the Unity Catalog model.\nFormat: `models/{catalog}.{schema}.{model}`.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "model"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.ModelServiceConfigProvisionedThroughputConfig": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Configuration for a provisioned-throughput foundation-model destination.\nReferences a pre-existing Model Serving endpoint that serves the model;\nsizing (provisioned throughput, burst scaling, model version) is owned by\nthe Model Serving endpoint itself, not by this message.",
+                  "properties": {
+                    "model_serving_endpoint": {
+                      "description": "Name of the backing Model Serving endpoint serving the provisioned-\nthroughput foundation model, in the form `serving-endpoints/{name}`. The\nsame Unity Catalog model can be served on multiple Model Serving endpoints\nwith different throughput, regions, or configurations. The caller selects\nthe endpoint to which this destination routes. The endpoint must exist at\ncreate time.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "model_serving_endpoint"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.ModelServiceConfigRoutingConfig": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Routing configuration for a model service, nesting destinations and\nfallback under a single sub-message.",
+                  "properties": {
+                    "destinations": {
+                      "description": "Primary routing destinations. At most 10 are allowed. At least one is\nrequired on Create. On Update, provide this list when replacing the full\n`config` or updating `config.routing.destinations`; other granular routing\nupdates do not require resending destinations. The intermediate\n`config.routing` mask path is not supported.",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/catalog.ModelServiceConfigDestinationConfig",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "fallback": {
+                      "description": "Fallback routing applied after a primary destination fails. Fallback\ndestinations are tried in the listed order.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelServiceConfigFallbackConfig",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.MonitorCronSchedule": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "pause_status": {
+                      "description": "Read only field that indicates whether a schedule is paused or not.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.MonitorCronSchedulePauseStatus",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "quartz_cron_expression": {
+                      "description": "The expression that determines when to run the monitor. See [examples](https://www.quartz-scheduler.org/documentation/quartz-2.3.0/tutorials/crontrigger.html).",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "timezone_id": {
+                      "description": "The timezone id (e.g., ``PST``) in which to evaluate the quartz expression.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "quartz_cron_expression",
+                    "timezone_id"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.MonitorCronSchedulePauseStatus": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "description": "Source link: https://src.dev.databricks.com/databricks/universe/-/blob/elastic-spark-common/api/messages/schedule.proto\nMonitoring workflow schedule pause status.",
+                  "enum": [
+                    "UNSPECIFIED",
+                    "UNPAUSED",
+                    "PAUSED"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.MonitorDataClassificationConfig": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Data classification related configuration.",
+                  "properties": {
+                    "enabled": {
+                      "description": "[Private Preview] Whether to enable data classification.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.MonitorDestination": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "email_addresses": {
+                      "description": "The list of email addresses to send the notification to. A maximum of 5 email addresses is supported.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.MonitorInferenceLog": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "granularities": {
+                      "description": "Granularities for aggregating data into time windows based on their timestamp. Valid values are 5 minutes, 30 minutes, 1 hour, 1 day, n weeks, 1 month, or 1 year.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "label_col": {
+                      "description": "Column for the label.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "model_id_col": {
+                      "description": "Column for the model identifier.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "prediction_col": {
+                      "description": "Column for the prediction.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "prediction_proba_col": {
+                      "description": "Column for prediction probabilities",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "problem_type": {
+                      "description": "Problem type the model aims to solve.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.MonitorInferenceLogProblemType",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "timestamp_col": {
+                      "description": "Column for the timestamp.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "granularities",
+                    "model_id_col",
+                    "prediction_col",
+                    "problem_type",
+                    "timestamp_col"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.MonitorInferenceLogProblemType": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "enum": [
+                    "PROBLEM_TYPE_CLASSIFICATION",
+                    "PROBLEM_TYPE_REGRESSION"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.MonitorMetric": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Custom metric definition.",
+                  "properties": {
+                    "definition": {
+                      "description": "Jinja template for a SQL expression that specifies how to compute the metric. See [create metric definition](https://docs.databricks.com/en/lakehouse-monitoring/custom-metrics.html#create-definition).",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "input_columns": {
+                      "description": "A list of column names in the input table the metric should be computed for.\nCan use ``\":table\"`` to indicate that the metric needs information from multiple columns.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "name": {
+                      "description": "Name of the metric in the output tables.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "output_data_type": {
+                      "description": "The output type of the custom metric.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "type": {
+                      "description": "Can only be one of ``\"CUSTOM_METRIC_TYPE_AGGREGATE\"``, ``\"CUSTOM_METRIC_TYPE_DERIVED\"``, or ``\"CUSTOM_METRIC_TYPE_DRIFT\"``.\nThe ``\"CUSTOM_METRIC_TYPE_AGGREGATE\"`` and ``\"CUSTOM_METRIC_TYPE_DERIVED\"`` metrics\nare computed on a single table, whereas the ``\"CUSTOM_METRIC_TYPE_DRIFT\"`` compare metrics across\nbaseline and input table, or across the two consecutive time windows.\n- CUSTOM_METRIC_TYPE_AGGREGATE: only depend on the existing columns in your table\n- CUSTOM_METRIC_TYPE_DERIVED: depend on previously computed aggregate metrics\n- CUSTOM_METRIC_TYPE_DRIFT:  depend on previously computed aggregate or derived metrics",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.MonitorMetricType",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "definition",
+                    "input_columns",
+                    "name",
+                    "output_data_type",
+                    "type"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.MonitorMetricType": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "description": "Can only be one of ``\\\"CUSTOM_METRIC_TYPE_AGGREGATE\\\"``, ``\\\"CUSTOM_METRIC_TYPE_DERIVED\\\"``, or ``\\\"CUSTOM_METRIC_TYPE_DRIFT\\\"``.\nThe ``\\\"CUSTOM_METRIC_TYPE_AGGREGATE\\\"`` and ``\\\"CUSTOM_METRIC_TYPE_DERIVED\\\"`` metrics\nare computed on a single table, whereas the ``\\\"CUSTOM_METRIC_TYPE_DRIFT\\\"`` compare metrics across\nbaseline and input table, or across the two consecutive time windows.\n- CUSTOM_METRIC_TYPE_AGGREGATE: only depend on the existing columns in your table\n- CUSTOM_METRIC_TYPE_DERIVED: depend on previously computed aggregate metrics\n- CUSTOM_METRIC_TYPE_DRIFT:  depend on previously computed aggregate or derived metrics",
+                  "enum": [
+                    "CUSTOM_METRIC_TYPE_AGGREGATE",
+                    "CUSTOM_METRIC_TYPE_DERIVED",
+                    "CUSTOM_METRIC_TYPE_DRIFT"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.MonitorNotifications": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "on_failure": {
+                      "description": "Destinations to send notifications on failure/timeout.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.MonitorDestination",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "on_new_classification_tag_detected": {
+                      "description": "[Private Preview] Destinations to send notifications on new classification tag detected.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.MonitorDestination",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.MonitorSnapshot": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Snapshot analysis configuration",
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.MonitorTimeSeries": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Time series analysis configuration.",
+                  "properties": {
+                    "granularities": {
+                      "description": "Granularities for aggregating data into time windows based on their timestamp. Valid values are 5 minutes, 30 minutes, 1 hour, 1 day, n weeks, 1 month, or 1 year.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "timestamp_col": {
+                      "description": "Column for the timestamp.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "granularities",
+                    "timestamp_col"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.Privilege": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "enum": [
+                    "SELECT",
+                    "READ_PRIVATE_FILES",
+                    "WRITE_PRIVATE_FILES",
+                    "CREATE",
+                    "USAGE",
+                    "USE_CATALOG",
+                    "USE_SCHEMA",
+                    "CREATE_SCHEMA",
+                    "CREATE_VIEW",
+                    "CREATE_EXTERNAL_TABLE",
+                    "CREATE_MATERIALIZED_VIEW",
+                    "CREATE_FUNCTION",
+                    "CREATE_MODEL",
+                    "CREATE_CATALOG",
+                    "CREATE_MANAGED_STORAGE",
+                    "CREATE_EXTERNAL_LOCATION",
+                    "CREATE_STORAGE_CREDENTIAL",
+                    "CREATE_SERVICE_CREDENTIAL",
+                    "ACCESS",
+                    "CREATE_SHARE",
+                    "CREATE_RECIPIENT",
+                    "CREATE_PROVIDER",
+                    "USE_SHARE",
+                    "USE_RECIPIENT",
+                    "USE_PROVIDER",
+                    "USE_MARKETPLACE_ASSETS",
+                    "SET_SHARE_PERMISSION",
+                    "MODIFY",
+                    "REFRESH",
+                    "EXECUTE",
+                    "READ_FILES",
+                    "WRITE_FILES",
+                    "CREATE_TABLE",
+                    "ALL_PRIVILEGES",
+                    "CREATE_CONNECTION",
+                    "USE_CONNECTION",
+                    "APPLY_TAG",
+                    "CREATE_FOREIGN_CATALOG",
+                    "CREATE_FOREIGN_SECURABLE",
+                    "MANAGE_ALLOWLIST",
+                    "CREATE_VOLUME",
+                    "CREATE_EXTERNAL_VOLUME",
+                    "READ_VOLUME",
+                    "WRITE_VOLUME",
+                    "MANAGE",
+                    "BROWSE",
+                    "CREATE_CLEAN_ROOM",
+                    "MODIFY_CLEAN_ROOM",
+                    "EXECUTE_CLEAN_ROOM_TASK",
+                    "EXTERNAL_USE_SCHEMA",
+                    "READ_METADATA",
+                    "EXTERNAL_USE_LOCATION"
+                  ],
+                  "enumDescriptions": [
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "[Public Preview]"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.PrivilegeAssignment": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "principal": {
+                      "description": "The principal (user email address or group name).\nFor deleted principals, `principal` is empty while `principal_id` is populated.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "privileges": {
+                      "description": "The privileges assigned to the principal.",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/catalog.Privilege",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.RateLimit": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "A rate limit applied to service requests. Leave `requests` or `tokens`\nunset to impose no limit on that dimension; set a value to cap that dimension\nwithin the renewal period.",
+                  "properties": {
+                    "key": {
+                      "description": "Scope of the rate limit. Depending on this value, the limit applies to a\nprincipal, the service as a whole, or each user by default.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.RateLimitRateLimitKey",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "principal": {
+                      "description": "Principal this limit applies to: user email, group name, or service\nprincipal application ID. Required when `key` applies to a user, group, or\nservice principal; otherwise it must be unset.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "renewal_period": {
+                      "description": "Renewal period.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.RateLimitRateLimitRenewalPeriod",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "requests": {
+                      "description": "Maximum requests allowed in one renewal period. Leave unset for no request\nlimit. Set to `0` to deny all requests.",
+                      "$ref": "#/$defs/int64",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "tokens": {
+                      "description": "Maximum tokens allowed in one renewal period. Leave unset for no token\nlimit. Set to `0` to deny all requests.",
+                      "$ref": "#/$defs/int64",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "key",
+                    "renewal_period"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.RateLimitRateLimitKey": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "description": "Scope key for a rate limit.",
+                  "enum": [
+                    "RATE_LIMIT_KEY_USER",
+                    "RATE_LIMIT_KEY_USER_GROUP",
+                    "RATE_LIMIT_KEY_SERVICE_PRINCIPAL",
+                    "RATE_LIMIT_KEY_SERVICE",
+                    "RATE_LIMIT_KEY_USER_DEFAULT"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.RateLimitRateLimitRenewalPeriod": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "description": "Renewal period for a rate limit.",
+                  "enum": [
+                    "RATE_LIMIT_RENEWAL_PERIOD_MINUTE",
+                    "RATE_LIMIT_RENEWAL_PERIOD_HOUR"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.RegisteredModelAlias": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "alias_name": {
+                      "description": "Name of the alias, e.g. 'champion' or 'latest_stable'",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "catalog_name": {
+                      "description": "The name of the catalog containing the model version",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "id": {
+                      "description": "The unique identifier of the alias",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "model_name": {
+                      "description": "The name of the parent registered model of the model version, relative to parent schema",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "schema_name": {
+                      "description": "The name of the schema containing the model version, relative to parent catalog",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "version_num": {
+                      "description": "Integer version number of the model version to which this alias points.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.SseEncryptionDetails": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Server-Side Encryption properties for clients communicating with AWS s3.",
+                  "properties": {
+                    "algorithm": {
+                      "description": "Sets the value of the 'x-amz-server-side-encryption' header in S3 request.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.SseEncryptionDetailsAlgorithm",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "aws_kms_key_arn": {
+                      "description": "Optional. The ARN of the SSE-KMS key used with the S3 location, when algorithm = \"SSE-KMS\".\nSets the value of the 'x-amz-server-side-encryption-aws-kms-key-id' header.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.SseEncryptionDetailsAlgorithm": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "description": "SSE algorithm to use for encrypting S3 objects",
+                  "enum": [
+                    "AWS_SSE_S3",
+                    "AWS_SSE_KMS"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "catalog.VolumeType": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "enum": [
+                    "MANAGED",
+                    "EXTERNAL"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "compute.Adlsgen2Info": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "A storage location in Adls Gen2",
+                  "properties": {
+                    "destination": {
+                      "description": "abfss destination, e.g. `abfss://\u003ccontainer-name\u003e@\u003cstorage-account-name\u003e.dfs.core.windows.net/\u003cdirectory-name\u003e`.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "destination"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "compute.AutoScale": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "max_workers": {
+                      "description": "The maximum number of workers to which the cluster can scale up when overloaded.\nNote that `max_workers` must be strictly greater than `min_workers`.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "min_workers": {
+                      "description": "The minimum number of workers to which the cluster can scale down when underutilized.\nIt is also the initial number of workers the cluster will have after creation.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "compute.AwsAttributes": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Attributes set during cluster creation which are related to Amazon Web Services.",
+                  "properties": {
+                    "availability": {
+                      "description": "Availability type used for all subsequent nodes past the `first_on_demand` ones.\n\nNote: If `first_on_demand` is zero, this availability type will be used for the entire cluster.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.AwsAvailability",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "ebs_volume_count": {
+                      "description": "The number of volumes launched for each instance. Users can choose up to 10 volumes.\nThis feature is only enabled for supported node types. Legacy node types cannot specify\ncustom EBS volumes.\nFor node types with no instance store, at least one EBS volume needs to be specified;\notherwise, cluster creation will fail.\n\nThese EBS volumes will be mounted at `/ebs0`, `/ebs1`, and etc.\nInstance store volumes will be mounted at `/local_disk0`, `/local_disk1`, and etc.\n\nIf EBS volumes are attached, Databricks will configure Spark to use only the EBS volumes for\nscratch storage because heterogenously sized scratch devices can lead to inefficient disk\nutilization. If no EBS volumes are attached, Databricks will configure Spark to use instance\nstore volumes.\n\nPlease note that if EBS volumes are specified, then the Spark configuration `spark.local.dir`\nwill be overridden.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "ebs_volume_iops": {
+                      "description": "If using gp3 volumes, what IOPS to use for the disk. If this is not set, the maximum performance of a gp2 volume with the same volume size will be used.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "ebs_volume_size": {
+                      "description": "The size of each EBS volume (in GiB) launched for each instance. For general purpose\nSSD, this value must be within the range 100 - 4096. For throughput optimized HDD,\nthis value must be within the range 500 - 4096.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "ebs_volume_throughput": {
+                      "description": "If using gp3 volumes, what throughput to use for the disk. If this is not set, the maximum performance of a gp2 volume with the same volume size will be used.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "ebs_volume_type": {
+                      "description": "The type of EBS volumes that will be launched with this cluster.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.EbsVolumeType",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "first_on_demand": {
+                      "description": "The first `first_on_demand` nodes of the cluster will be placed on on-demand instances.\nIf this value is greater than 0, the cluster driver node in particular will be placed on an\non-demand instance. If this value is greater than or equal to the current cluster size, all\nnodes will be placed on on-demand instances. If this value is less than the current cluster\nsize, `first_on_demand` nodes will be placed on on-demand instances and the remainder will\nbe placed on `availability` instances. Note that this value does not affect\ncluster size and cannot currently be mutated over the lifetime of a cluster.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "instance_profile_arn": {
+                      "description": "Nodes for this cluster will only be placed on AWS instances with this instance profile. If\nommitted, nodes will be placed on instances without an IAM instance profile. The instance\nprofile must have previously been added to the Databricks environment by an account\nadministrator.\n\nThis feature may only be available to certain customer plans.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "spot_bid_price_percent": {
+                      "description": "The bid price for AWS spot instances, as a percentage of the corresponding instance type's\non-demand price.\nFor example, if this field is set to 50, and the cluster needs a new `r3.xlarge` spot\ninstance, then the bid price is half of the price of\non-demand `r3.xlarge` instances. Similarly, if this field is set to 200, the bid price is twice\nthe price of on-demand `r3.xlarge` instances. If not specified, the default value is 100.\nWhen spot instances are requested for this cluster, only spot instances whose bid price\npercentage matches this field will be considered.\nNote that, for safety, we enforce this field to be no more than 10000.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "zone_id": {
+                      "description": "Identifier for the availability zone/datacenter in which the cluster resides.\nThis string will be of a form like \"us-west-2a\". The provided availability\nzone must be in the same region as the Databricks deployment. For example, \"us-west-2a\"\nis not a valid zone id if the Databricks deployment resides in the \"us-east-1\" region.\nThis is an optional field at cluster creation, and if not specified, the zone \"auto\" will be used.\nIf the zone specified is \"auto\", will try to place cluster in a zone with high availability,\nand will retry placement in a different AZ if there is not enough capacity.\n\nThe list of available zones as well as the default value can be found by using the\n`List Zones` method.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "compute.AwsAvailability": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "description": "Availability type used for all subsequent nodes past the `first_on_demand` ones.\n\nNote: If `first_on_demand` is zero, this availability type will be used for the entire cluster.",
+                  "enum": [
+                    "SPOT",
+                    "ON_DEMAND",
+                    "SPOT_WITH_FALLBACK"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "compute.AzureAttributes": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Attributes set during cluster creation which are related to Microsoft Azure.",
+                  "properties": {
+                    "availability": {
+                      "description": "Availability type used for all subsequent nodes past the `first_on_demand` ones.\nNote: If `first_on_demand` is zero, this availability\ntype will be used for the entire cluster.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.AzureAvailability",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "capacity_reservation_group": {
+                      "description": "The Azure capacity reservation group resource ID to use for launching VMs.\nWhen specified, VMs will be launched using the provided capacity reservation.\n\nCapacity reservations can only be specified when the workspace uses injected vnet (i.e. customer defined vnet not\nmanaged by databricks). Ensure the databricks-login-prod Enterprise Application is granted the following four permissions:\n1. Microsoft.Compute/capacityReservationGroups/read\n2. Microsoft.Compute/capacityReservationGroups/deploy/action\n3. Microsoft.Compute/capacityReservationGroups/capacityReservations/read\n4. Microsoft.Compute/capacityReservationGroups/capacityReservations/deploy/action\n\nFormat: `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/capacityReservationGroups/{capacityReservationGroupName}`",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "first_on_demand": {
+                      "description": "The first `first_on_demand` nodes of the cluster will be placed on on-demand instances.\nThis value should be greater than 0, to make sure the cluster driver node is placed on an\non-demand instance. If this value is greater than or equal to the current cluster size, all\nnodes will be placed on on-demand instances. If this value is less than the current cluster\nsize, `first_on_demand` nodes will be placed on on-demand instances and the remainder will\nbe placed on `availability` instances. Note that this value does not affect\ncluster size and cannot currently be mutated over the lifetime of a cluster.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "log_analytics_info": {
+                      "description": "Defines values necessary to configure and run Azure Log Analytics agent",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.LogAnalyticsInfo",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "spot_bid_max_price": {
+                      "description": "The max bid price to be used for Azure spot instances.\nThe Max price for the bid cannot be higher than the on-demand price of the instance.\nIf not specified, the default value is -1, which specifies that the instance cannot be evicted\non the basis of price, and only on the basis of availability. Further, the value should \u003e 0 or -1.",
+                      "$ref": "#/$defs/float64",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "compute.AzureAvailability": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "description": "Availability type used for all subsequent nodes past the `first_on_demand` ones.\nNote: If `first_on_demand` is zero, this availability type will be used for the entire cluster.",
+                  "enum": [
+                    "SPOT_AZURE",
+                    "ON_DEMAND_AZURE",
+                    "SPOT_WITH_FALLBACK_AZURE"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "compute.ClientsTypes": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "jobs": {
+                      "description": "With jobs set, the cluster can be used for jobs",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "notebooks": {
+                      "description": "With notebooks set, this cluster can be used for notebooks",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "compute.ClusterLogConf": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Cluster log delivery config",
+                  "properties": {
+                    "dbfs": {
+                      "description": "destination needs to be provided. e.g.\n`{ \"dbfs\" : { \"destination\" : \"dbfs:/home/cluster_log\" } }`",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.DbfsStorageInfo",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "s3": {
+                      "description": "destination and either the region or endpoint need to be provided. e.g.\n`{ \"s3\": { \"destination\" : \"s3://cluster_log_bucket/prefix\", \"region\" : \"us-west-2\" } }`\nCluster iam role is used to access s3, please make sure the cluster iam role in\n`instance_profile_arn` has permission to write data to the s3 destination.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.S3StorageInfo",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "volumes": {
+                      "description": "destination needs to be provided, e.g.\n`{ \"volumes\": { \"destination\": \"/Volumes/catalog/schema/volume/cluster_log\" } }`",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.VolumesStorageInfo",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "compute.ClusterPermissionLevel": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "description": "Permission level",
+                  "enum": [
+                    "CAN_MANAGE",
+                    "CAN_RESTART",
+                    "CAN_ATTACH_TO"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "compute.ClusterPolicyPermissionLevel": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "description": "Permission level",
+                  "enum": [
+                    "CAN_USE"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "compute.ClusterSpec": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Contains a snapshot of the latest user specified settings that were used to create/edit the cluster.",
+                  "properties": {
+                    "apply_policy_default_values": {
+                      "description": "When set to true, fixed and default values from the policy will be used for fields that are omitted. When set to false, only fixed values from the policy will be applied.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "autoscale": {
+                      "description": "Parameters needed in order to automatically scale clusters up and down based on load.\nNote: autoscaling works best with DB runtime versions 3.0 or later.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.AutoScale",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "autotermination_minutes": {
+                      "description": "Automatically terminates the cluster after it is inactive for this time in minutes. If not set,\nthis cluster will not be automatically terminated. If specified, the threshold must be between\n10 and 10000 minutes.\nUsers can also set this value to 0 to explicitly disable automatic termination.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "aws_attributes": {
+                      "description": "Attributes related to clusters running on Amazon Web Services.\nIf not specified at cluster creation, a set of default values will be used.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.AwsAttributes",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "azure_attributes": {
+                      "description": "Attributes related to clusters running on Microsoft Azure.\nIf not specified at cluster creation, a set of default values will be used.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.AzureAttributes",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "cluster_log_conf": {
+                      "description": "The configuration for delivering spark logs to a long-term storage destination.\nThree kinds of destinations (DBFS, S3 and Unity Catalog volumes) are supported. Only one destination can be specified\nfor one cluster. If the conf is given, the logs will be delivered to the destination every\n`5 mins`. The destination of driver logs is `$destination/$clusterId/driver`, while\nthe destination of executor logs is `$destination/$clusterId/executor`.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.ClusterLogConf",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "cluster_name": {
+                      "description": "Cluster name requested by the user. This doesn't have to be unique.\nIf not specified at creation, the cluster name will be an empty string.\nFor job clusters, the cluster name is automatically set based on the job and job run IDs.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "custom_tags": {
+                      "description": "Additional tags for cluster resources. Databricks will tag all cluster resources (e.g., AWS\ninstances and EBS volumes) with these tags in addition to `default_tags`. Notes:\n\n- Currently, Databricks allows at most 45 custom tags\n\n- Clusters can only reuse cloud resources if the resources' tags are a subset of the cluster tags",
+                      "$ref": "#/$defs/map/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "data_security_mode": {
+                      "description": "Data security mode decides what data governance model to use when accessing data\nfrom a cluster.\n\n* `DATA_SECURITY_MODE_AUTO`: Databricks will choose the most appropriate access mode depending on your compute configuration.\n* `DATA_SECURITY_MODE_STANDARD`: A secure cluster that can be shared by multiple users. Cluster users are fully isolated so that they cannot see each other’s data and credentials. Most data governance features are supported in this mode. But programming languages and cluster features might be limited.\n* `DATA_SECURITY_MODE_DEDICATED`: A secure cluster that can only be exclusively used by a single user specified in `single_user_name`. Most programming languages, cluster features and data governance features are available in this mode.\n\nThe following modes are legacy aliases for the above modes:\n\n* `USER_ISOLATION`: Legacy alias for `DATA_SECURITY_MODE_STANDARD`.\n* `SINGLE_USER`: Legacy alias for `DATA_SECURITY_MODE_DEDICATED`.\n\nThe following modes are deprecated starting with Databricks Runtime 15.0 and\nwill be removed for future Databricks Runtime versions:\n\n* `LEGACY_TABLE_ACL`: This mode is for users migrating from legacy Table ACL clusters.\n* `LEGACY_PASSTHROUGH`: This mode is for users migrating from legacy Passthrough on high concurrency clusters.\n* `LEGACY_SINGLE_USER`: This mode is for users migrating from legacy Passthrough on standard clusters.\n* `LEGACY_SINGLE_USER_STANDARD`: This mode provides a way that doesn’t have UC nor passthrough enabled.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.DataSecurityMode",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "dependency_mode": {
+                      "description": "[Beta] Controls dependency configuration for the cluster.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.DependencyMode",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
+                    },
+                    "docker_image": {
+                      "description": "Custom docker image BYOC",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.DockerImage",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "driver_instance_pool_id": {
+                      "description": "The optional ID of the instance pool for the driver of the cluster belongs.\nThe pool cluster uses the instance pool with id (instance_pool_id) if the driver pool is not\nassigned.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "driver_node_type_flexibility": {
+                      "description": "Flexible node type configuration for the driver node.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.NodeTypeFlexibility",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "driver_node_type_id": {
+                      "description": "The node type of the Spark driver.\nNote that this field is optional; if unset, the driver node type will be set as the same value\nas `node_type_id` defined above.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "enable_elastic_disk": {
+                      "description": "Autoscaling Local Storage: when enabled, this cluster will dynamically acquire additional disk\nspace when its Spark workers are running low on disk space.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "enable_local_disk_encryption": {
+                      "description": "Whether to enable LUKS on cluster VMs' local disks",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "gcp_attributes": {
+                      "description": "Attributes related to clusters running on Google Cloud Platform.\nIf not specified at cluster creation, a set of default values will be used.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.GcpAttributes",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "init_scripts": {
+                      "description": "The configuration for storing init scripts. Any number of destinations can be specified.\nThe scripts are executed sequentially in the order provided.\nIf `cluster_log_conf` is specified, init script logs are sent to `\u003cdestination\u003e/\u003ccluster-ID\u003e/init_scripts`.",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/compute.InitScriptInfo",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "instance_pool_id": {
+                      "description": "The optional ID of the instance pool to which the cluster belongs.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "is_single_node": {
+                      "description": "This field can only be used when `kind = CLASSIC_PREVIEW`.\n\nWhen set to true, Databricks will automatically set single node related `custom_tags`, `spark_conf`, and `num_workers`",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "kind": {
+                      "description": "The kind of compute described by this compute specification.\n\nDepending on `kind`, different validations and default values will be applied.\n\nClusters with `kind = CLASSIC_PREVIEW` support the following fields, whereas clusters with no specified `kind` do not.\n* [is_single_node](/api/workspace/clusters/create#is_single_node)\n* [use_ml_runtime](/api/workspace/clusters/create#use_ml_runtime)\n\nBy using the [simple form](https://docs.databricks.com/compute/simple-form.html), your clusters are automatically using `kind = CLASSIC_PREVIEW`.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.Kind",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "node_type_id": {
+                      "description": "This field encodes, through a single value, the resources available to each of\nthe Spark nodes in this cluster. For example, the Spark nodes can be provisioned\nand optimized for memory or compute intensive workloads. A list of available node\ntypes can be retrieved by using the [clusters/listNodeTypes](https://docs.databricks.com/api/workspace/clusters/listnodetypes) API call.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "num_workers": {
+                      "description": "Number of worker nodes that this cluster should have. A cluster has one Spark Driver\nand `num_workers` Executors for a total of `num_workers` + 1 Spark nodes.\n\nNote: When reading the properties of a cluster, this field reflects the desired number\nof workers rather than the actual current number of workers. For instance, if a cluster\nis resized from 5 to 10 workers, this field will immediately be updated to reflect\nthe target size of 10 workers, whereas the workers listed in `spark_info` will gradually\nincrease from 5 to 10 as the new nodes are provisioned.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "policy_id": {
+                      "description": "The ID of the cluster policy used to create the cluster if applicable.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "remote_disk_throughput": {
+                      "description": "If set, what the configurable throughput (in Mb/s) for the remote disk is. Currently only supported for GCP HYPERDISK_BALANCED disks.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "runtime_engine": {
+                      "description": "Determines the cluster's runtime engine, either standard or Photon.\n\nThis field is not compatible with legacy `spark_version` values that contain `-photon-`.\nRemove `-photon-` from the `spark_version` and set `runtime_engine` to `PHOTON`.\n\nIf left unspecified, the runtime engine defaults to standard unless the spark_version\ncontains -photon-, in which case Photon will be used.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.RuntimeEngine",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "single_user_name": {
+                      "description": "Single user name if data_security_mode is `SINGLE_USER`",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "spark_conf": {
+                      "description": "An object containing a set of optional, user-specified Spark configuration key-value pairs.\nUsers can also pass in a string of extra JVM options to the driver and the executors via\n`spark.driver.extraJavaOptions` and `spark.executor.extraJavaOptions` respectively.",
+                      "$ref": "#/$defs/map/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "spark_env_vars": {
+                      "description": "An object containing a set of optional, user-specified environment variable key-value pairs.\nPlease note that key-value pair of the form (X,Y) will be exported as is (i.e.,\n`export X='Y'`) while launching the driver and workers.\n\nIn order to specify an additional set of `SPARK_DAEMON_JAVA_OPTS`, we recommend appending\nthem to `$SPARK_DAEMON_JAVA_OPTS` as shown in the example below. This ensures that all\ndefault databricks managed environmental variables are included as well.\n\nExample Spark environment variables:\n`{\"SPARK_WORKER_MEMORY\": \"28000m\", \"SPARK_LOCAL_DIRS\": \"/local_disk0\"}` or\n`{\"SPARK_DAEMON_JAVA_OPTS\": \"$SPARK_DAEMON_JAVA_OPTS -Dspark.shuffle.service.enabled=true\"}`",
+                      "$ref": "#/$defs/map/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "spark_version": {
+                      "description": "The Spark version of the cluster, e.g. `3.3.x-scala2.11`.\nA list of available Spark versions can be retrieved by using\nthe [clusters/sparkVersions](https://docs.databricks.com/api/workspace/clusters/sparkversions) API call.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "ssh_public_keys": {
+                      "description": "SSH public key contents that will be added to each Spark node in this cluster. The\ncorresponding private keys can be used to login with the user name `ubuntu` on port `2200`.\nUp to 10 keys can be specified.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "total_initial_remote_disk_size": {
+                      "description": "If set, what the total initial volume size (in GB) of the remote disks should be. Supported for GCP.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "use_ml_runtime": {
+                      "description": "This field can only be used when `kind = CLASSIC_PREVIEW`.\n\n`effective_spark_version` is determined by `spark_version` (DBR release), this field `use_ml_runtime`, and whether `node_type_id` is gpu node or not.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "worker_node_type_flexibility": {
+                      "description": "Flexible node type configuration for worker nodes.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.NodeTypeFlexibility",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "workload_type": {
+                      "description": "Cluster Attributes showing for clusters workload types.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.WorkloadType",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "compute.ConfidentialComputeType": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "description": "Confidential computing technology for GCP instances.\nAligns with gcloud's --confidential-compute-type flag and the REST API's\nconfidentialInstanceConfig.confidentialInstanceType field.\nSee: https://cloud.google.com/confidential-computing/confidential-vm/docs/create-a-confidential-vm-instance",
+                  "enum": [
+                    "CONFIDENTIAL_COMPUTE_TYPE_NONE",
+                    "SEV_SNP"
+                  ],
+                  "enumDescriptions": [
+                    "[Private Preview]",
+                    "[Private Preview]"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "compute.DataSecurityMode": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "description": "Data security mode decides what data governance model to use when accessing data\nfrom a cluster.\n\n* `DATA_SECURITY_MODE_AUTO`: Databricks will choose the most appropriate access mode depending on your compute configuration.\n* `DATA_SECURITY_MODE_STANDARD`: A secure cluster that can be shared by multiple users. Cluster users are fully isolated so that they cannot see each other’s data and credentials. Most data governance features are supported in this mode. But programming languages and cluster features might be limited.\n* `DATA_SECURITY_MODE_DEDICATED`: A secure cluster that can only be exclusively used by a single user specified in `single_user_name`. Most programming languages, cluster features and data governance features are available in this mode.\n\nThe following modes are legacy aliases for the above modes:\n\n* `USER_ISOLATION`: Legacy alias for `DATA_SECURITY_MODE_STANDARD`.\n* `SINGLE_USER`: Legacy alias for `DATA_SECURITY_MODE_DEDICATED`.\n\nThe following modes are deprecated starting with Databricks Runtime 15.0 and\nwill be removed for future Databricks Runtime versions:\n\n* `LEGACY_TABLE_ACL`: This mode is for users migrating from legacy Table ACL clusters.\n* `LEGACY_PASSTHROUGH`: This mode is for users migrating from legacy Passthrough on high concurrency clusters.\n* `LEGACY_SINGLE_USER`: This mode is for users migrating from legacy Passthrough on standard clusters.\n* `LEGACY_SINGLE_USER_STANDARD`: This mode provides a way that doesn’t have UC nor passthrough enabled.",
+                  "enum": [
+                    "NONE",
+                    "SINGLE_USER",
+                    "USER_ISOLATION",
+                    "LEGACY_TABLE_ACL",
+                    "LEGACY_PASSTHROUGH",
+                    "LEGACY_SINGLE_USER",
+                    "LEGACY_SINGLE_USER_STANDARD",
+                    "DATA_SECURITY_MODE_STANDARD",
+                    "DATA_SECURITY_MODE_DEDICATED",
+                    "DATA_SECURITY_MODE_AUTO"
+                  ],
+                  "enumDescriptions": [
+                    "",
+                    "Legacy alias for `DATA_SECURITY_MODE_DEDICATED`.",
+                    "Legacy alias for `DATA_SECURITY_MODE_STANDARD`.",
+                    "This mode is for users migrating from legacy Table ACL clusters.",
+                    "This mode is for users migrating from legacy Passthrough on high concurrency clusters.",
+                    "This mode is for users migrating from legacy Passthrough on standard clusters.",
+                    "This mode provides a way that doesn’t have UC nor passthrough enabled.",
+                    "A secure cluster that can be shared by multiple users. Cluster users are fully isolated so that they cannot see each other’s data and credentials. Most data governance features are supported in this mode. But programming languages and cluster features might be limited.",
+                    "A secure cluster that can only be exclusively used by a single user specified in `single_user_name`. Most programming languages, cluster features and data governance features are available in this mode.",
+                    "\u003cDatabricks\u003e will choose the most appropriate access mode depending on your compute configuration."
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "compute.DbfsStorageInfo": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "A storage location in DBFS",
+                  "properties": {
+                    "destination": {
+                      "description": "dbfs destination, e.g. `dbfs:/my/path`",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "destination"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "compute.DependencyMode": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "description": "Controls dependency configuration for the cluster.\n\n* `DEPENDENCY_MODE_AUTO`: Databricks will choose the most appropriate dependency mode based on your compute configuration.\n* `DEPENDENCY_MODE_ENVIRONMENTS`: Enables a unified dependency management experience across classic and serverless, resulting in increased stability and performance. Supported only on DBR 19+ in Standard access mode.\n* `DEPENDENCY_MODE_CLUSTER_LIBRARIES`: Legacy mode: dependencies come from cluster libraries and init scripts.",
+                  "enum": [
+                    "DEPENDENCY_MODE_ENVIRONMENTS",
+                    "DEPENDENCY_MODE_CLUSTER_LIBRARIES",
+                    "DEPENDENCY_MODE_AUTO"
+                  ],
+                  "enumDescriptions": [
+                    "[Beta] Enables a unified dependency management experience across classic and serverless, resulting in increased stability and performance. Supported only on DBR 19+ in Standard access mode.",
+                    "[Beta] Legacy mode: dependencies come from cluster libraries and init scripts.",
+                    "[Beta] \u003cDatabricks\u003e will choose the most appropriate dependency mode based on your compute configuration."
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "compute.DiskSpec": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Describes the disks that are launched for each instance in the spark cluster.\nFor example, if the cluster has 3 instances, each instance is configured to launch\n2 disks, 100 GiB each, then Databricks will launch a total of 6 disks,\n100 GiB each, for this cluster.",
+                  "properties": {
+                    "disk_count": {
+                      "description": "The number of disks launched for each instance:\n- This feature is only enabled for supported node types.\n- Users can choose up to the limit of the disks supported by the node type.\n- For node types with no OS disk, at least one disk must be specified;\notherwise, cluster creation will fail.\n\nIf disks are attached, Databricks will configure Spark to use only the disks for\nscratch storage, because heterogenously sized scratch devices can lead to inefficient disk\nutilization. If no disks are attached, Databricks will configure Spark to use\ninstance store disks.\n\nNote: If disks are specified, then the Spark configuration\n`spark.local.dir` will be overridden.\n\nDisks will be mounted at:\n- For AWS: `/ebs0`, `/ebs1`, and etc.\n- For Azure: `/remote_volume0`, `/remote_volume1`, and etc.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "disk_iops": {
+                      "description": "The number of IOPS to provision for each attached disk.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "disk_size": {
+                      "description": "The size of each disk (in GiB) launched for each instance.\nValues must fall into the supported range for a particular instance type.\n\nFor AWS:\n- General Purpose SSD: 100 - 4096 GiB\n- Throughput Optimized HDD: 500 - 4096 GiB\n\nFor Azure:\n- Premium LRS (SSD): 1 - 1023 GiB\n- Standard LRS (HDD): 1- 1023 GiB",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "disk_throughput": {
+                      "description": "The disk throughput to provision for each attached disk, in MB per second.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "disk_type": {
+                      "description": "The type of disks that will be launched with this cluster.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.DiskType",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "compute.DiskType": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Describes the disk type.",
+                  "properties": {
+                    "azure_disk_volume_type": {
+                      "description": "All Azure Disk types that Databricks supports.\nSee https://docs.microsoft.com/en-us/azure/storage/storage-about-disks-and-vhds-linux#types-of-disks",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.DiskTypeAzureDiskVolumeType",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "ebs_volume_type": {
+                      "description": "All EBS volume types that Databricks supports.\nSee https://aws.amazon.com/ebs/details/ for details.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.DiskTypeEbsVolumeType",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "compute.DiskTypeAzureDiskVolumeType": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "description": "All Azure Disk types that Databricks supports.\nSee https://docs.microsoft.com/en-us/azure/storage/storage-about-disks-and-vhds-linux#types-of-disks",
+                  "enum": [
+                    "PREMIUM_LRS",
+                    "STANDARD_LRS"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "compute.DiskTypeEbsVolumeType": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "description": "All EBS volume types that Databricks supports.\nSee https://aws.amazon.com/ebs/details/ for details.",
+                  "enum": [
+                    "GENERAL_PURPOSE_SSD",
+                    "THROUGHPUT_OPTIMIZED_HDD"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "compute.DockerBasicAuth": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "password": {
+                      "description": "Password of the user",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "username": {
+                      "description": "Name of the user",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
                   },
-                  "description": {
-                    "description": "The description of the variable",
-                    "$ref": "#/$defs/string"
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "compute.DockerImage": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "basic_auth": {
+                      "description": "Basic auth with username and password",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.DockerBasicAuth",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "url": {
+                      "description": "URL of the docker image.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "compute.EbsVolumeType": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "description": "All EBS volume types that Databricks supports.\nSee https://aws.amazon.com/ebs/details/ for details.",
+                  "enum": [
+                    "GENERAL_PURPOSE_SSD",
+                    "THROUGHPUT_OPTIMIZED_HDD"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "compute.Environment": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "The environment entity used to preserve serverless environment side panel, jobs' environment for non-notebook task, and SDP's environment for classic and serverless pipelines.\nIn this minimal environment spec, only pip and java dependencies are supported.",
+                  "properties": {
+                    "base_environment": {
+                      "description": "The base environment this environment is built on top of. A base environment defines the environment version and a\nlist of dependencies for serverless compute. The value can be a file path to a custom `env.yaml` file\n(e.g., `/Workspace/path/to/env.yaml`). Support for a Databricks-provided base environment ID\n(e.g., `workspace-base-environments/databricks_ai_v4`) and workspace base environment ID\n(e.g., `workspace-base-environments/dbe_b849b66e-b31a-4cb5-b161-1f2b10877fb7`) is in Beta.\nEither `environment_version` or `base_environment` can be provided.\nFor more information about Databricks-provided base environments, see the\n[list workspace base environments](:method:Environments/ListWorkspaceBaseEnvironments) API.\nFor more information, see",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "client": {
+                      "description": "Use `environment_version` instead.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA",
+                      "deprecationMessage": "This field is deprecated",
+                      "deprecated": true
+                    },
+                    "dependencies": {
+                      "description": "List of pip dependencies, as supported by the version of pip in this environment.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "environment_version": {
+                      "description": "Either `environment_version` or `base_environment` needs to be provided. Environment version used by the environment.\nEach version comes with a specific Python version and a set of Python packages.\nThe version is a string, consisting of an integer.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "java_dependencies": {
+                      "description": "List of java dependencies. Each dependency is a string representing a java library path. For example: `/Volumes/path/to/test.jar`.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "project_environment": {
+                      "description": "[Beta] File path of pyproject.toml file that defines the project-scoped environment.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "compute.GcpAttributes": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Attributes set during cluster creation which are related to GCP.",
+                  "properties": {
+                    "availability": {
+                      "description": "This field determines whether the spark executors will be scheduled to run on preemptible\nVMs, on-demand VMs, or preemptible VMs with a fallback to on-demand VMs if the former is unavailable.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.GcpAvailability",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "boot_disk_size": {
+                      "description": "Boot disk size in GB",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "confidential_compute_type": {
+                      "description": "[Private Preview] The confidential computing technology for this cluster's instances.\nCurrently only SEV_SNP is supported, and only on N2D instance types.\nWhen not set, no confidential computing is applied.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.ConfidentialComputeType",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "first_on_demand": {
+                      "description": "The first `first_on_demand` nodes of the cluster will be placed on on-demand instances.\nThis value should be greater than 0, to make sure the cluster driver node is placed on an\non-demand instance. If this value is greater than or equal to the current cluster size, all\nnodes will be placed on on-demand instances. If this value is less than the current cluster\nsize, `first_on_demand` nodes will be placed on on-demand instances and the remainder will\nbe placed on `availability` instances. Note that this value does not affect\ncluster size and cannot currently be mutated over the lifetime of a cluster.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "google_service_account": {
+                      "description": "If provided, the cluster will impersonate the google service account when accessing\ngcloud services (like GCS). The google service account\nmust have previously been added to the Databricks environment by an account\nadministrator.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "local_ssd_count": {
+                      "description": "If provided, each node (workers and driver) in the cluster will have this number of local SSDs attached.\nEach local SSD is 375GB in size.\nRefer to [GCP documentation](https://cloud.google.com/compute/docs/disks/local-ssd#choose_number_local_ssds)\nfor the supported number of local SSDs for each instance type.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "use_preemptible_executors": {
+                      "description": "This field determines whether the spark executors will be scheduled to run on preemptible\nVMs (when set to true) versus standard compute engine VMs (when set to false; default).\nNote: Soon to be deprecated, use the 'availability' field instead.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA",
+                      "deprecationMessage": "This field is deprecated",
+                      "deprecated": true
+                    },
+                    "zone_id": {
+                      "description": "Identifier for the availability zone in which the cluster resides.\nThis can be one of the following:\n- \"HA\" =\u003e High availability, spread nodes across availability zones for a\nDatabricks deployment region [default].\n- \"AUTO\" =\u003e Databricks picks an availability zone to schedule the cluster on.\n- A GCP availability zone =\u003e Pick One of the available zones for (machine type + region) from\nhttps://cloud.google.com/compute/docs/regions-zones.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "compute.GcpAvailability": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "description": "This field determines whether the instance pool will contain preemptible\nVMs, on-demand VMs, or preemptible VMs with a fallback to on-demand VMs if the former is unavailable.",
+                  "enum": [
+                    "PREEMPTIBLE_GCP",
+                    "ON_DEMAND_GCP",
+                    "PREEMPTIBLE_WITH_FALLBACK_GCP"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "compute.GcsStorageInfo": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "A storage location in Google Cloud Platform's GCS",
+                  "properties": {
+                    "destination": {
+                      "description": "GCS destination/URI, e.g. `gs://my-bucket/some-prefix`",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "destination"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "compute.HardwareAcceleratorType": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "description": "HardwareAcceleratorType: The type of hardware accelerator to use for compute workloads.\nNOTE: This enum is referenced and is intended to be used by other Databricks services\nthat need to specify hardware accelerator requirements for AI compute workloads.",
+                  "enum": [
+                    "GPU_1xA10",
+                    "GPU_8xH100",
+                    "GPU_1xH100",
+                    "GPU_8xB300"
+                  ],
+                  "enumDescriptions": [
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "compute.InitScriptInfo": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Config for an individual init script",
+                  "properties": {
+                    "abfss": {
+                      "description": "Contains the Azure Data Lake Storage destination path",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.Adlsgen2Info",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "dbfs": {
+                      "description": "destination needs to be provided. e.g.\n`{ \"dbfs\": { \"destination\" : \"dbfs:/home/cluster_log\" } }`",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.DbfsStorageInfo",
+                      "x-databricks-launch-stage": "GA",
+                      "deprecationMessage": "This field is deprecated",
+                      "deprecated": true
+                    },
+                    "file": {
+                      "description": "destination needs to be provided, e.g.\n`{ \"file\": { \"destination\": \"file:/my/local/file.sh\" } }`",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.LocalFileInfo",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "gcs": {
+                      "description": "destination needs to be provided, e.g.\n`{ \"gcs\": { \"destination\": \"gs://my-bucket/file.sh\" } }`",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.GcsStorageInfo",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "s3": {
+                      "description": "destination and either the region or endpoint need to be provided. e.g.\n`{ \\\"s3\\\": { \\\"destination\\\": \\\"s3://cluster_log_bucket/prefix\\\", \\\"region\\\": \\\"us-west-2\\\" } }`\nCluster iam role is used to access s3, please make sure the cluster iam role in\n`instance_profile_arn` has permission to write data to the s3 destination.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.S3StorageInfo",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "volumes": {
+                      "description": "destination needs to be provided. e.g.\n`{ \\\"volumes\\\" : { \\\"destination\\\" : \\\"/Volumes/my-init.sh\\\" } }`",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.VolumesStorageInfo",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "workspace": {
+                      "description": "destination needs to be provided, e.g.\n`{ \"workspace\": { \"destination\": \"/cluster-init-scripts/setup-datadog.sh\" } }`",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.WorkspaceStorageInfo",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "compute.InstancePoolAwsAttributes": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Attributes set during instance pool creation which are related to Amazon Web Services.",
+                  "properties": {
+                    "availability": {
+                      "description": "Availability type used for the instances in the pool. Supports on-demand, spot, and\nspot-with-fallback (the pool acquires spot instances first, and falls back to on-demand\ninstances when spot capacity is unavailable).\n\nYou can change this value on an existing pool. New clusters use the updated availability, and\nexisting clusters keep the availability they launched with.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.InstancePoolAwsAttributesAvailability",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "instance_profile_arn": {
+                      "description": "[Beta] All AWS instances belonging to the instance pool will have this instance profile. If omitted, instances\nwill initially be launched with the workspace's default instance profile. If defined, clusters that use the\npool will inherit the instance profile, and must not specify their own instance profile on cluster creation or\nupdate. If the pool does not specify an instance profile, clusters using the pool may specify any instance profile.\nThe instance profile must have previously been added to the Databricks environment by an account administrator.\n\nThis feature may only be available to certain customer plans.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
+                    },
+                    "spot_bid_price_percent": {
+                      "description": "Calculates the bid price for AWS spot instances, as a percentage of the corresponding instance type's\non-demand price.\nFor example, if this field is set to 50, and the cluster needs a new `r3.xlarge` spot\ninstance, then the bid price is half of the price of\non-demand `r3.xlarge` instances. Similarly, if this field is set to 200, the bid price is twice\nthe price of on-demand `r3.xlarge` instances. If not specified, the default value is 100.\nWhen spot instances are requested for this cluster, only spot instances whose bid price\npercentage matches this field will be considered.\nNote that, for safety, we enforce this field to be no more than 10000.\n\nYou can change this value on an existing pool. New clusters use the updated bid price, and\nexisting clusters keep the bid price they launched with.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "zone_id": {
+                      "description": "Identifier for the availability zone/datacenter in which the cluster resides.\nThis string will be of a form like \"us-west-2a\". The provided availability\nzone must be in the same region as the Databricks deployment. For example, \"us-west-2a\"\nis not a valid zone id if the Databricks deployment resides in the \"us-east-1\" region.\nThis is an optional field at cluster creation, and if not specified, a default zone will be used.\nThe list of available zones as well as the default value can be found by using the\n`List Zones` method.\n\nSet this field to \"auto\" to enable Auto-AZ, in which case Databricks selects the availability\nzone for each cluster independently when the cluster launches, and retries another zone if the\ncluster can't be fulfilled because of insufficient capacity or quota. All nodes in a cluster\nland in the same zone, and different clusters backed by the pool can run in different zones.\n\nYou can change the zone on an existing pool. New clusters use the updated zone, and existing\nclusters keep the zone they launched with.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "compute.InstancePoolAwsAttributesAvailability": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "description": "The set of AWS availability types supported when setting up nodes for a cluster.",
+                  "enum": [
+                    "SPOT",
+                    "ON_DEMAND"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "compute.InstancePoolAzureAttributes": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Attributes set during instance pool creation which are related to Azure.",
+                  "properties": {
+                    "availability": {
+                      "description": "Availability type used for the instances in the pool. Supports on-demand, spot, and\nspot-with-fallback (the pool acquires spot instances first, and falls back to on-demand\ninstances when spot capacity is unavailable).\n\nYou can change this value on an existing pool. New clusters use the updated availability, and\nexisting clusters keep the availability they launched with.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.InstancePoolAzureAttributesAvailability",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "capacity_reservation_group": {
+                      "description": "The Azure capacity reservation group resource ID to use for launching VMs in this pool.\nWhen specified, VMs will be launched using the provided capacity reservation.\n\nNOTE: Omitting this field will clear any existing configured capacity reservation group on the pool.\n\nCapacity reservations can only be specified when the workspace uses injected vnet (i.e. customer defined vnet not\nmanaged by databricks). Ensure the databricks-login-prod Enterprise Application is granted the following four permissions:\n1. Microsoft.Compute/capacityReservationGroups/read\n2. Microsoft.Compute/capacityReservationGroups/deploy/action\n3. Microsoft.Compute/capacityReservationGroups/capacityReservations/read\n4. Microsoft.Compute/capacityReservationGroups/capacityReservations/deploy/action\n\nFormat: `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/capacityReservationGroups/{capacityReservationGroupName}`",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "spot_bid_max_price": {
+                      "description": "With variable pricing, you have option to set a max price, in US dollars (USD)\nFor example, the value 2 would be a max price of $2.00 USD per hour.\nIf you set the max price to be -1, the VM won't be evicted based on price.\nThe price for the VM will be the current price for spot or the price for a standard VM,\nwhich ever is less, as long as there is capacity and quota available.\n\nYou can change this value on an existing pool. New clusters use the updated max price, and\nexisting clusters keep the max price they launched with.",
+                      "$ref": "#/$defs/float64",
+                      "x-databricks-launch-stage": "GA"
+                    }
                   },
-                  "lookup": {
-                    "description": "The name of the alert, cluster_policy, cluster, dashboard, instance_pool, job, metastore, pipeline, query, service_principal, or warehouse object for which to retrieve an ID.",
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/variable.Lookup",
-                    "markdownDescription": "The name of the `alert`, `cluster_policy`, `cluster`, `dashboard`, `instance_pool`, `job`, `metastore`, `pipeline`, `query`, `service_principal`, or `warehouse` object for which to retrieve an ID."
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "compute.InstancePoolAzureAttributesAvailability": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "description": "The set of Azure availability types supported when setting up nodes for a cluster.",
+                  "enum": [
+                    "SPOT_AZURE",
+                    "ON_DEMAND_AZURE"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "compute.InstancePoolGcpAttributes": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Attributes set during instance pool creation which are related to GCP.",
+                  "properties": {
+                    "gcp_availability": {
+                      "description": "Availability type for the instances in the pool. One of:\n\n- `ON_DEMAND_GCP`: the pool uses on-demand instances only.\n- `PREEMPTIBLE_GCP`: the pool uses preemptible instances only.\n- `PREEMPTIBLE_WITH_FALLBACK_GCP`: the pool acquires preemptible instances first, and falls\nback to on-demand instances when preemptible capacity is unavailable.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.GcpAvailability",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "local_ssd_count": {
+                      "description": "If provided, each node in the instance pool will have this number of local SSDs attached.\nEach local SSD is 375GB in size. Refer to [GCP documentation](https://cloud.google.com/compute/docs/disks/local-ssd#choose_number_local_ssds)\nfor the supported number of local SSDs for each instance type.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "zone_id": {
+                      "description": "Identifier for the availability zone/datacenter in which the cluster resides.\nThis string will be of a form like \"us-west1-a\". The provided availability\nzone must be in the same region as the Databricks workspace. For example, \"us-west1-a\"\nis not a valid zone id if the Databricks workspace resides in the \"us-east1\" region.\nThis is an optional field at instance pool creation, and if not specified, a default zone will be used.\n\nThis field can be one of the following:\n- \"HA\" =\u003e High availability, spread nodes across availability zones for a Databricks deployment region\n- \"auto\" =\u003e Auto-AZ. Databricks selects the availability zone for each cluster independently when the cluster launches, and retries another zone if the cluster can't be fulfilled because of insufficient capacity or quota. All nodes in a cluster land in the same zone, and different clusters backed by the pool can run in different zones.\n- A GCP availability zone =\u003e Pick One of the available zones for (machine type + region) from https://cloud.google.com/compute/docs/regions-zones (e.g. \"us-west1-a\").\n\nIf empty, Databricks picks an availability zone to schedule the cluster on.\n\nYou can change the zone on an existing pool. New clusters use the updated zone, and existing\nclusters keep the zone they launched with.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
                   },
-                  "type": {
-                    "description": "The type of the variable.",
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/variable.VariableType"
-                  }
+                  "additionalProperties": false
                 },
-                "additionalProperties": false,
-                "markdownDescription": "Defines a custom variable for the bundle. See [variables](https://docs.databricks.com/dev-tools/bundles/settings.html#variables)."
-              },
-              "variable.VariableType": {
-                "type": "string"
-              }
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
             },
-            "config.Artifact": {
+            "compute.InstancePoolPermissionLevel": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "description": "Permission level",
+                  "enum": [
+                    "CAN_MANAGE",
+                    "CAN_ATTACH_TO"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "compute.Kind": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "description": "The kind of compute described by this compute specification.\n\nDepending on `kind`, different validations and default values will be applied.\n\nClusters with `kind = CLASSIC_PREVIEW` support the following fields, whereas clusters with no specified `kind` do not.\n* [is_single_node](/api/workspace/clusters/create#is_single_node)\n* [use_ml_runtime](/api/workspace/clusters/create#use_ml_runtime)\n\nBy using the [simple form](https://docs.databricks.com/compute/simple-form.html), your clusters are automatically using `kind = CLASSIC_PREVIEW`.",
+                  "enum": [
+                    "CLASSIC_PREVIEW"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "compute.Library": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "build": {
-                      "description": "An optional set of build commands to run locally before deployment.",
-                      "$ref": "#/$defs/string"
+                    "cran": {
+                      "description": "Specification of a CRAN library to be installed as part of the library",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.RCranLibrary",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "dynamic_version": {
-                      "description": "Whether to patch the wheel version dynamically based on the timestamp of the whl file. If this is set to `true`, new code can be deployed without having to update the version in `setup.py` or `pyproject.toml`. This setting is only valid when `type` is set to `whl`. See [\\_](/dev-tools/bundles/settings.md#bundle-syntax-mappings-artifacts).",
-                      "$ref": "#/$defs/bool"
+                    "egg": {
+                      "description": "Deprecated. URI of the egg library to install. Installing Python egg files is deprecated and is not supported in Databricks Runtime 14.0 and above.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA",
+                      "deprecationMessage": "This field is deprecated",
+                      "deprecated": true
                     },
-                    "executable": {
-                      "description": "The executable type. Valid values are `bash`, `sh`, and `cmd`.",
-                      "$ref": "#/$defs/github.com/databricks/cli/libs/exec.ExecutableType"
+                    "jar": {
+                      "description": "URI of the JAR library to install. Supported URIs include Workspace paths, Unity Catalog Volumes paths, and S3 URIs.\nFor example: `{ \"jar\": \"/Workspace/path/to/library.jar\" }`, `{ \"jar\" : \"/Volumes/path/to/library.jar\" }` or\n`{ \"jar\": \"s3://my-bucket/library.jar\" }`.\nIf S3 is used, please make sure the cluster has read access on the library. You may need to\nlaunch the cluster with an IAM role to access the S3 URI.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "files": {
-                      "description": "The relative or absolute path to the built artifact files.",
-                      "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config.ArtifactFile"
+                    "maven": {
+                      "description": "Specification of a maven library to be installed. For example:\n`{ \"coordinates\": \"org.jsoup:jsoup:1.7.2\" }`",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.MavenLibrary",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "path": {
-                      "description": "The local path of the directory for the artifact.",
-                      "$ref": "#/$defs/string"
+                    "pypi": {
+                      "description": "Specification of a PyPi library to be installed. For example:\n`{ \"package\": \"simplejson\" }`",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.PythonPyPiLibrary",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "type": {
-                      "description": "Required if the artifact is a Python wheel. The type of the artifact. Valid values are `whl` and `jar`.",
-                      "$ref": "#/$defs/github.com/databricks/cli/bundle/config.ArtifactType",
-                      "markdownDescription": "Required if the artifact is a Python wheel. The type of the artifact. Valid values are `whl` and `jar`."
+                    "requirements": {
+                      "description": "URI of the requirements.txt file to install. Only Workspace paths and Unity Catalog Volumes paths are supported.\nFor example: `{ \"requirements\": \"/Workspace/path/to/requirements.txt\" }` or `{ \"requirements\" : \"/Volumes/path/to/requirements.txt\" }`",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "whl": {
+                      "description": "URI of the wheel library to install. Supported URIs include Workspace paths, Unity Catalog Volumes paths, and S3 URIs.\nFor example: `{ \"whl\": \"/Workspace/path/to/library.whl\" }`, `{ \"whl\" : \"/Volumes/path/to/library.whl\" }` or\n`{ \"whl\": \"s3://my-bucket/library.whl\" }`.\nIf S3 is used, please make sure the cluster has read access on the library. You may need to\nlaunch the cluster with an IAM role to access the S3 URI.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "config.ArtifactFile": {
+            "compute.LocalFileInfo": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "source": {
-                      "description": "Required. The artifact source file.",
-                      "$ref": "#/$defs/string"
+                    "destination": {
+                      "description": "local file destination, e.g. `file:/my/local/file.sh`",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "source"
+                    "destination"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "config.ArtifactType": {
-              "type": "string"
-            },
-            "config.Bundle": {
+            "compute.LogAnalyticsInfo": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "cluster_id": {
-                      "description": "The ID of a cluster to use to run the bundle.",
+                    "log_analytics_primary_key": {
+                      "description": "The primary key for the Azure Log Analytics agent configuration",
                       "$ref": "#/$defs/string",
-                      "markdownDescription": "The ID of a cluster to use to run the bundle. See [cluster_id](https://docs.databricks.com/dev-tools/bundles/settings.html#cluster_id)."
-                    },
-                    "compute_id": {
-                      "description": "Deprecated. The ID of the compute to use to run the bundle.",
-                      "$ref": "#/$defs/string"
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "databricks_cli_version": {
-                      "description": "The Databricks CLI version to use for the bundle.",
+                    "log_analytics_workspace_id": {
+                      "description": "The workspace ID for the Azure Log Analytics agent configuration",
                       "$ref": "#/$defs/string",
-                      "markdownDescription": "The Databricks CLI version to use for the bundle. See [databricks_cli_version](https://docs.databricks.com/dev-tools/bundles/settings.html#databricks_cli_version)."
-                    },
-                    "deployment": {
-                      "description": "The definition of the bundle deployment",
-                      "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Deployment",
-                      "markdownDescription": "The definition of the bundle deployment. For supported attributes see [link](https://docs.databricks.com/dev-tools/bundles/deployment-modes.html)."
-                    },
-                    "engine": {
-                      "description": "The deployment engine to use. Valid values are `terraform` and `direct`. Takes priority over `DATABRICKS_BUNDLE_ENGINE` environment variable. Default is \"terraform\".",
-                      "$ref": "#/$defs/github.com/databricks/cli/bundle/config/engine.EngineType"
-                    },
-                    "git": {
-                      "description": "The Git version control details that are associated with your bundle.",
-                      "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Git",
-                      "markdownDescription": "The Git version control details that are associated with your bundle. For supported attributes see [git](https://docs.databricks.com/dev-tools/bundles/settings.html#git)."
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "compute.MavenLibrary": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "coordinates": {
+                      "description": "Gradle-style maven coordinates. For example: \"org.jsoup:jsoup:1.7.2\".",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "name": {
-                      "description": "The name of the bundle.",
-                      "$ref": "#/$defs/string"
+                    "exclusions": {
+                      "description": "List of dependences to exclude. For example: `[\"slf4j:slf4j\", \"*:hadoop-client\"]`.\n\nMaven dependency exclusions:\nhttps://maven.apache.org/guides/introduction/introduction-to-optional-and-excludes-dependencies.html.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "uuid": {
-                      "description": "Reserved. A Universally Unique Identifier (UUID) for the bundle that uniquely identifies the bundle in internal Databricks systems. This is generated when a bundle project is initialized using a Databricks template (using the `databricks bundle init` command).",
-                      "$ref": "#/$defs/string"
+                    "repo": {
+                      "description": "Maven repo to install the Maven package from. If omitted, both Maven Central Repository\nand Spark Packages are searched.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "name"
+                    "coordinates"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "config.Command": {
-              "type": "string"
-            },
-            "config.Deployment": {
+            "compute.NodeTypeFlexibility": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Configuration for flexible node types, allowing fallback to alternate node types during cluster launch and upscale.",
                   "properties": {
-                    "fail_on_active_runs": {
-                      "description": "Whether to fail on active runs. If this is set to true a deployment that is running can be interrupted.",
-                      "$ref": "#/$defs/bool"
+                    "alternate_node_type_ids": {
+                      "description": "A list of node type IDs to use as fallbacks when the primary node type is unavailable.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "lock": {
-                      "description": "The deployment lock attributes.",
-                      "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Lock"
+                    "aws_context_id": {
+                      "description": "The AWS Context ID for EC2 Fleet.\nWhen set (non-empty), the value is passed to AWS CreateFleet API to create the EC2 Fleet.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "config.Experimental": {
+            "compute.PythonPyPiLibrary": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "pydabs": {
-                      "description": "The PyDABs configuration.",
-                      "$ref": "#/$defs/github.com/databricks/cli/bundle/config.PyDABs",
-                      "deprecationMessage": "Deprecated: please use python instead",
-                      "deprecated": true
-                    },
-                    "python": {
-                      "description": "Configures loading of Python code defined with 'databricks-bundles' package.",
-                      "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Python"
-                    },
-                    "python_wheel_wrapper": {
-                      "description": "Whether to use a Python wheel wrapper.",
-                      "$ref": "#/$defs/bool"
-                    },
-                    "scripts": {
-                      "description": "The commands to run.",
-                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config.Command"
-                    },
-                    "skip_artifact_cleanup": {
-                      "description": "Determines whether to skip cleaning up the .internal folder",
-                      "$ref": "#/$defs/bool"
-                    },
-                    "skip_name_prefix_for_schema": {
-                      "description": "Skip adding the prefix that is either set in `presets.name_prefix` or computed when `mode: development`\nis set, to the names of UC schemas defined in the bundle.",
-                      "$ref": "#/$defs/bool"
+                    "package": {
+                      "description": "The name of the pypi package to install. An optional exact version specification is also\nsupported. Examples: \"simplejson\" and \"simplejson==3.8.0\".",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "use_legacy_run_as": {
-                      "description": "Whether to use the legacy run_as behavior.",
-                      "$ref": "#/$defs/bool"
+                    "repo": {
+                      "description": "The repository where the package can be found. If not specified, the default pip index is\nused.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
-                  "additionalProperties": false
+                  "additionalProperties": false,
+                  "required": [
+                    "package"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "config.Git": {
+            "compute.RCranLibrary": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "branch": {
-                      "description": "The Git branch name.",
+                    "package": {
+                      "description": "The name of the CRAN package to install.",
                       "$ref": "#/$defs/string",
-                      "markdownDescription": "The Git branch name. See [git](https://docs.databricks.com/dev-tools/bundles/settings.html#git)."
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "origin_url": {
-                      "description": "The origin URL of the repository.",
+                    "repo": {
+                      "description": "The repository where the package can be found. If not specified, the default CRAN repo is used.",
                       "$ref": "#/$defs/string",
-                      "markdownDescription": "The origin URL of the repository. See [git](https://docs.databricks.com/dev-tools/bundles/settings.html#git)."
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
-                  "additionalProperties": false
+                  "additionalProperties": false,
+                  "required": [
+                    "package"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "config.Lock": {
+            "compute.RuntimeEngine": {
               "oneOf": [
                 {
-                  "type": "object",
-                  "properties": {
-                    "enabled": {
-                      "description": "Whether this lock is enabled.",
-                      "$ref": "#/$defs/bool"
-                    },
-                    "force": {
-                      "description": "Whether to force this lock if it is enabled.",
-                      "$ref": "#/$defs/bool"
-                    }
-                  },
-                  "additionalProperties": false
+                  "type": "string",
+                  "enum": [
+                    "NULL",
+                    "STANDARD",
+                    "PHOTON"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "config.Mode": {
-              "type": "string"
-            },
-            "config.Presets": {
+            "compute.S3StorageInfo": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "A storage location in Amazon S3",
                   "properties": {
-                    "artifacts_dynamic_version": {
-                      "description": "Whether to enable dynamic_version on all artifacts.",
-                      "$ref": "#/$defs/bool"
+                    "canned_acl": {
+                      "description": "(Optional) Set canned access control list for the logs, e.g. `bucket-owner-full-control`.\nIf `canned_cal` is set, please make sure the cluster iam role has `s3:PutObjectAcl` permission on\nthe destination bucket and prefix. The full list of possible canned acl can be found at\nhttp://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl.\nPlease also note that by default only the object owner gets full controls. If you are using cross account\nrole for writing data, you may want to set `bucket-owner-full-control` to make bucket owner able to\nread the logs.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "jobs_max_concurrent_runs": {
-                      "description": "The maximum concurrent runs for a job.",
-                      "$ref": "#/$defs/int"
+                    "destination": {
+                      "description": "S3 destination, e.g. `s3://my-bucket/some-prefix` Note that logs will be delivered using\ncluster iam role, please make sure you set cluster iam role and the role has write access to the\ndestination. Please also note that you cannot use AWS keys to deliver logs.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "name_prefix": {
-                      "description": "The prefix for job runs of the bundle.",
-                      "$ref": "#/$defs/string"
+                    "enable_encryption": {
+                      "description": "(Optional) Flag to enable server side encryption, `false` by default.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "pipelines_development": {
-                      "description": "Whether pipeline deployments should be locked in development mode.",
-                      "$ref": "#/$defs/bool"
+                    "encryption_type": {
+                      "description": "(Optional) The encryption type, it could be `sse-s3` or `sse-kms`. It will be used only when\nencryption is enabled and the default type is `sse-s3`.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "source_linked_deployment": {
-                      "description": "Whether to link the deployment to the bundle source.",
-                      "$ref": "#/$defs/bool"
+                    "endpoint": {
+                      "description": "S3 endpoint, e.g. `https://s3-us-west-2.amazonaws.com`. Either region or endpoint needs to be set.\nIf both are set, endpoint will be used.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "tags": {
-                      "description": "The tags for the bundle deployment.",
-                      "$ref": "#/$defs/map/string"
+                    "kms_key": {
+                      "description": "(Optional) Kms key which will be used if encryption is enabled and encryption type is set to `sse-kms`.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "trigger_pause_status": {
-                      "description": "A pause status to apply to all job triggers and schedules. Valid values are PAUSED or UNPAUSED.",
-                      "$ref": "#/$defs/string"
+                    "region": {
+                      "description": "S3 region, e.g. `us-west-2`. Either region or endpoint needs to be set. If both are set,\nendpoint will be used.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
-                  "additionalProperties": false
+                  "additionalProperties": false,
+                  "required": [
+                    "destination"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "config.PyDABs": {
+            "compute.VolumesStorageInfo": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "A storage location back by UC Volumes.",
                   "properties": {
-                    "enabled": {
-                      "description": "Whether or not PyDABs (Private Preview) is enabled",
-                      "$ref": "#/$defs/bool"
+                    "destination": {
+                      "description": "UC Volumes destination, e.g. `/Volumes/catalog/schema/vol1/init-scripts/setup-datadog.sh`\nor `dbfs:/Volumes/catalog/schema/vol1/init-scripts/setup-datadog.sh`",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
-                  "additionalProperties": false
+                  "additionalProperties": false,
+                  "required": [
+                    "destination"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "config.Python": {
+            "compute.WorkloadType": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Cluster Attributes showing for clusters workload types.",
                   "properties": {
-                    "mutators": {
-                      "description": "Mutators contains a list of fully qualified function paths to mutator functions.\n\nExample: [\"my_project.mutators:add_default_cluster\"]",
-                      "$ref": "#/$defs/slice/string"
-                    },
-                    "resources": {
-                      "description": "Resources contains a list of fully qualified function paths to load resources\ndefined in Python code.\n\nExample: [\"my_project.resources:load_resources\"]",
-                      "$ref": "#/$defs/slice/string"
-                    },
-                    "venv_path": {
-                      "description": "VEnvPath is path to the virtual environment.\n\nIf enabled, Python code will execute within this environment. If disabled,\nit defaults to using the Python interpreter available in the current shell.",
-                      "$ref": "#/$defs/string"
+                    "clients": {
+                      "description": "defined what type of clients can use the cluster. E.g. Notebooks, Jobs",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.ClientsTypes",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
-                  "additionalProperties": false
+                  "additionalProperties": false,
+                  "required": [
+                    "clients"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "config.Resources": {
+            "compute.WorkspaceStorageInfo": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "A storage location in Workspace Filesystem (WSFS)",
                   "properties": {
-                    "alerts": {
-                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.Alert"
-                    },
-                    "apps": {
-                      "description": "The app resource defines a Databricks app.",
-                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.App",
-                      "markdownDescription": "The app resource defines a [Databricks app](https://docs.databricks.com/api/workspace/apps/create). For information about Databricks Apps, see [link](https://docs.databricks.com/dev-tools/databricks-apps/index.html)."
-                    },
-                    "catalogs": {
-                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.Catalog"
-                    },
-                    "clusters": {
-                      "description": "The cluster definitions for the bundle, where each key is the name of a cluster.",
-                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.Cluster",
-                      "markdownDescription": "The cluster definitions for the bundle, where each key is the name of a cluster. See [clusters](https://docs.databricks.com/dev-tools/bundles/resources.html#clusters)."
-                    },
-                    "dashboards": {
-                      "description": "The dashboard definitions for the bundle, where each key is the name of the dashboard.",
-                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.Dashboard",
-                      "markdownDescription": "The dashboard definitions for the bundle, where each key is the name of the dashboard. See [dashboards](https://docs.databricks.com/dev-tools/bundles/resources.html#dashboards)."
-                    },
-                    "database_catalogs": {
-                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.DatabaseCatalog"
-                    },
-                    "database_instances": {
-                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.DatabaseInstance"
-                    },
-                    "experiments": {
-                      "description": "The experiment definitions for the bundle, where each key is the name of the experiment.",
-                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.MlflowExperiment",
-                      "markdownDescription": "The experiment definitions for the bundle, where each key is the name of the experiment. See [experiments](https://docs.databricks.com/dev-tools/bundles/resources.html#experiments)."
-                    },
-                    "external_locations": {
-                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.ExternalLocation"
-                    },
-                    "jobs": {
-                      "description": "The job definitions for the bundle, where each key is the name of the job.",
-                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.Job",
-                      "markdownDescription": "The job definitions for the bundle, where each key is the name of the job. See [jobs](https://docs.databricks.com/dev-tools/bundles/resources.html#jobs)."
-                    },
-                    "model_serving_endpoints": {
-                      "description": "The model serving endpoint definitions for the bundle, where each key is the name of the model serving endpoint.",
-                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.ModelServingEndpoint",
-                      "markdownDescription": "The model serving endpoint definitions for the bundle, where each key is the name of the model serving endpoint. See [model_serving_endpoints](https://docs.databricks.com/dev-tools/bundles/resources.html#model_serving_endpoints)."
-                    },
-                    "models": {
-                      "description": "The model definitions for the bundle, where each key is the name of the model.",
-                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.MlflowModel",
-                      "markdownDescription": "The model definitions for the bundle, where each key is the name of the model. See [models](https://docs.databricks.com/dev-tools/bundles/resources.html#models)."
-                    },
-                    "pipelines": {
-                      "description": "The pipeline definitions for the bundle, where each key is the name of the pipeline.",
-                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.Pipeline",
-                      "markdownDescription": "The pipeline definitions for the bundle, where each key is the name of the pipeline. See [pipelines](https://docs.databricks.com/dev-tools/bundles/resources.html#pipelines)."
-                    },
-                    "postgres_branches": {
-                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.PostgresBranch"
-                    },
-                    "postgres_endpoints": {
-                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.PostgresEndpoint"
-                    },
-                    "postgres_projects": {
-                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.PostgresProject"
-                    },
-                    "quality_monitors": {
-                      "description": "The quality monitor definitions for the bundle, where each key is the name of the quality monitor.",
-                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.QualityMonitor",
-                      "markdownDescription": "The quality monitor definitions for the bundle, where each key is the name of the quality monitor. See [quality_monitors](https://docs.databricks.com/dev-tools/bundles/resources.html#quality_monitors)."
-                    },
-                    "registered_models": {
-                      "description": "The registered model definitions for the bundle, where each key is the name of the Unity Catalog registered model.",
-                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.RegisteredModel",
-                      "markdownDescription": "The registered model definitions for the bundle, where each key is the name of the Unity Catalog registered model. See [registered_models](https://docs.databricks.com/dev-tools/bundles/resources.html#registered_models)"
-                    },
-                    "schemas": {
-                      "description": "The schema definitions for the bundle, where each key is the name of the schema.",
-                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.Schema",
-                      "markdownDescription": "The schema definitions for the bundle, where each key is the name of the schema. See [schemas](https://docs.databricks.com/dev-tools/bundles/resources.html#schemas)."
-                    },
-                    "secret_scopes": {
-                      "description": "The secret scope definitions for the bundle, where each key is the name of the secret scope.",
-                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.SecretScope",
-                      "markdownDescription": "The secret scope definitions for the bundle, where each key is the name of the secret scope. See [secret_scopes](https://docs.databricks.com/dev-tools/bundles/resources.html#secret_scopes)."
-                    },
-                    "sql_warehouses": {
-                      "description": "The SQL warehouse definitions for the bundle, where each key is the name of the warehouse.",
-                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.SqlWarehouse",
-                      "markdownDescription": "The SQL warehouse definitions for the bundle, where each key is the name of the warehouse. See [sql_warehouses](https://docs.databricks.com/dev-tools/bundles/resources.html#sql_warehouses)."
-                    },
-                    "synced_database_tables": {
-                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.SyncedDatabaseTable"
-                    },
-                    "vector_search_endpoints": {
-                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.VectorSearchEndpoint"
-                    },
-                    "volumes": {
-                      "description": "The volume definitions for the bundle, where each key is the name of the volume.",
-                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.Volume",
-                      "markdownDescription": "The volume definitions for the bundle, where each key is the name of the volume. See [volumes](https://docs.databricks.com/dev-tools/bundles/resources.html#volumes)."
+                    "destination": {
+                      "description": "wsfs destination, e.g. `workspace:/cluster-init-scripts/setup-datadog.sh`",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
-                  "additionalProperties": false
+                  "additionalProperties": false,
+                  "required": [
+                    "destination"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "dashboards.LifecycleState": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "enum": [
+                    "ACTIVE",
+                    "TRASHED"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "config.Script": {
+            "database.CustomTag": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "content": {
-                      "$ref": "#/$defs/string"
+                    "key": {
+                      "description": "[Beta] The key of the custom tag.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
+                    },
+                    "value": {
+                      "description": "[Beta] The value of the custom tag.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     }
                   },
-                  "additionalProperties": false,
-                  "required": [
-                    "content"
-                  ]
+                  "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "config.Sync": {
+            "database.DatabaseInstanceRef": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "DatabaseInstanceRef is a reference to a database instance. It is used in the\nDatabaseInstance object to refer to the parent instance of an instance and\nto refer the child instances of an instance.\nTo specify as a parent instance during creation of an instance,\nthe lsn and branch_time fields are optional. If not specified, the child\ninstance will be created from the latest lsn of the parent.\nIf both lsn and branch_time are specified, the lsn will be used to create\nthe child instance.",
                   "properties": {
-                    "exclude": {
-                      "description": "A list of files or folders to exclude from the bundle.",
-                      "$ref": "#/$defs/slice/string"
+                    "branch_time": {
+                      "description": "[Public Preview] Branch time of the ref database instance.\nFor a parent ref instance, this is the point in time on the parent instance from which the\ninstance was created.\nFor a child ref instance, this is the point in time on the instance from which the child\ninstance was created.\nInput: For specifying the point in time to create a child instance. Optional.\nOutput: Only populated if provided as input to create a child instance.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "include": {
-                      "description": "A list of files or folders to include in the bundle.",
-                      "$ref": "#/$defs/slice/string"
+                    "lsn": {
+                      "description": "[Public Preview] User-specified WAL LSN of the ref database instance.\n\nInput: For specifying the WAL LSN to create a child instance. Optional.\nOutput: Only populated if provided as input to create a child instance.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "paths": {
-                      "description": "The local folder paths, which can be outside the bundle root, to synchronize to the workspace when the bundle is deployed.",
-                      "$ref": "#/$defs/slice/string"
+                    "name": {
+                      "description": "[Public Preview] Name of the ref database instance.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "config.Target": {
+            "database.DatabaseInstanceState": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "enum": [
+                    "STARTING",
+                    "AVAILABLE",
+                    "DELETING",
+                    "STOPPED",
+                    "UPDATING",
+                    "FAILING_OVER"
+                  ],
+                  "enumDescriptions": [
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "database.DeltaTableSyncInfo": {
               "oneOf": [
                 {
                   "type": "object",
-                  "properties": {
-                    "artifacts": {
-                      "description": "The artifacts to include in the target deployment.",
-                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config.Artifact"
-                    },
-                    "bundle": {
-                      "description": "The bundle attributes when deploying to this target.",
-                      "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Bundle"
-                    },
-                    "cluster_id": {
-                      "description": "The ID of the cluster to use for this target.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "compute_id": {
-                      "description": "Deprecated. The ID of the compute to use for this target.",
-                      "$ref": "#/$defs/string",
-                      "deprecationMessage": "Deprecated: please use cluster_id instead",
-                      "deprecated": true
-                    },
-                    "default": {
-                      "description": "Whether this target is the default target.",
-                      "$ref": "#/$defs/bool"
-                    },
-                    "git": {
-                      "description": "The Git version control settings for the target.",
-                      "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Git"
-                    },
-                    "mode": {
-                      "description": "The deployment mode for the target.",
-                      "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Mode",
-                      "markdownDescription": "The deployment mode for the target. Valid values are `development` or `production`. See [link](https://docs.databricks.com/dev-tools/bundles/deployment-modes.html)."
-                    },
-                    "permissions": {
-                      "description": "The permissions for deploying and running the bundle in the target.",
-                      "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.Permission"
-                    },
-                    "presets": {
-                      "description": "The deployment presets for the target.",
-                      "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Presets"
-                    },
-                    "resources": {
-                      "description": "The resource definitions for the target.",
-                      "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Resources"
-                    },
-                    "run_as": {
-                      "description": "The identity to use to run the bundle.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobRunAs",
-                      "markdownDescription": "The identity to use to run the bundle, see [link](https://docs.databricks.com/dev-tools/bundles/run-as.html)."
-                    },
-                    "sync": {
-                      "description": "The local paths to sync to the target workspace when a bundle is run or deployed.",
-                      "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Sync"
-                    },
-                    "variables": {
-                      "description": "The custom variable definitions for the target.",
-                      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/variable.TargetVariable"
-                    },
-                    "workspace": {
-                      "description": "The Databricks workspace for the target.",
-                      "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Workspace"
-                    }
-                  },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "config.Workspace": {
+            "database.NewPipelineSpec": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Custom fields that user can set for pipeline while creating SyncedDatabaseTable.\nNote that other fields of pipeline are still inferred by table def internally",
                   "properties": {
-                    "account_id": {
-                      "description": "The Databricks account ID.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "artifact_path": {
-                      "description": "The artifact path to use within the workspace for both deployments and job runs",
-                      "$ref": "#/$defs/string"
-                    },
-                    "auth_type": {
-                      "description": "The authentication type.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "azure_client_id": {
-                      "description": "The Azure client ID",
-                      "$ref": "#/$defs/string"
-                    },
-                    "azure_environment": {
-                      "description": "The Azure environment",
-                      "$ref": "#/$defs/string"
-                    },
-                    "azure_login_app_id": {
-                      "description": "The Azure login app ID",
-                      "$ref": "#/$defs/string"
-                    },
-                    "azure_tenant_id": {
-                      "description": "The Azure tenant ID",
-                      "$ref": "#/$defs/string"
-                    },
-                    "azure_use_msi": {
-                      "description": "Whether to use MSI for Azure",
-                      "$ref": "#/$defs/bool"
-                    },
-                    "azure_workspace_resource_id": {
-                      "description": "The Azure workspace resource ID",
-                      "$ref": "#/$defs/string"
-                    },
-                    "client_id": {
-                      "description": "The client ID for the workspace",
-                      "$ref": "#/$defs/string"
-                    },
-                    "experimental_is_unified_host": {
-                      "description": "Deprecated: no-op. Unified hosts are now detected automatically from /.well-known/databricks-config. Retained for schema compatibility with existing databricks.yml files.",
-                      "$ref": "#/$defs/bool"
-                    },
-                    "file_path": {
-                      "description": "The file path to use within the workspace for both deployments and job runs",
-                      "$ref": "#/$defs/string"
-                    },
-                    "google_service_account": {
-                      "description": "The Google service account name",
-                      "$ref": "#/$defs/string"
-                    },
-                    "host": {
-                      "description": "The Databricks workspace host URL",
-                      "$ref": "#/$defs/string"
-                    },
-                    "profile": {
-                      "description": "The Databricks workspace profile name",
-                      "$ref": "#/$defs/string"
-                    },
-                    "resource_path": {
-                      "description": "The workspace resource path",
-                      "$ref": "#/$defs/string"
-                    },
-                    "root_path": {
-                      "description": "The Databricks workspace root path",
-                      "$ref": "#/$defs/string"
+                    "budget_policy_id": {
+                      "description": "[Beta] Budget policy to set on the newly created pipeline.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     },
-                    "state_path": {
-                      "description": "The workspace state path",
-                      "$ref": "#/$defs/string"
+                    "storage_catalog": {
+                      "description": "[Public Preview] This field needs to be specified if the destination catalog is a managed postgres catalog.\n\nUC catalog for the pipeline to store intermediate files (checkpoints, event logs etc).\nThis needs to be a standard catalog where the user has permissions to create Delta tables.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "workspace_id": {
-                      "description": "The Databricks workspace ID",
-                      "$ref": "#/$defs/string"
+                    "storage_schema": {
+                      "description": "[Public Preview] This field needs to be specified if the destination catalog is a managed postgres catalog.\n\nUC schema for the pipeline to store intermediate files (checkpoints, event logs etc).\nThis needs to be in the standard catalog where the user has permissions to create Delta tables.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
-            }
-          },
-          "libs": {
-            "exec.ExecutableType": {
-              "type": "string"
-            }
-          }
-        },
-        "databricks-sdk-go": {
-          "common": {
-            "types": {
-              "duration.Duration": {
-                "type": "string"
-              },
-              "time.Time": {
-                "oneOf": [
-                  {
-                    "type": "object",
-                    "additionalProperties": false
-                  },
-                  {
-                    "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
-                  }
-                ]
-              }
-            }
-          },
-          "service": {
-            "apps.AppDeployment": {
+            },
+            "database.ProvisioningInfoState": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "enum": [
+                    "PROVISIONING",
+                    "ACTIVE",
+                    "FAILED",
+                    "DELETING",
+                    "UPDATING",
+                    "DEGRADED"
+                  ],
+                  "enumDescriptions": [
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "database.ProvisioningPhase": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "enum": [
+                    "PROVISIONING_PHASE_MAIN",
+                    "PROVISIONING_PHASE_INDEX_SCAN",
+                    "PROVISIONING_PHASE_INDEX_SORT"
+                  ],
+                  "enumDescriptions": [
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "database.SyncedTableContinuousUpdateStatus": {
               "oneOf": [
                 {
                   "type": "object",
-                  "properties": {
-                    "command": {
-                      "description": "The command with which to run the app. This will override the command specified in the app.yaml file.",
-                      "$ref": "#/$defs/slice/string"
-                    },
-                    "deployment_id": {
-                      "$ref": "#/$defs/string"
-                    },
-                    "env_vars": {
-                      "description": "The environment variables to set in the app runtime environment. This will override the environment variables specified in the app.yaml file.",
-                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/apps.EnvVar"
-                    },
-                    "git_source": {
-                      "description": "Git repository to use as the source for the app deployment.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.GitSource",
-                      "x-databricks-preview": "PRIVATE",
-                      "doNotSuggest": true
-                    },
-                    "mode": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppDeploymentMode"
-                    },
-                    "source_code_path": {
-                      "$ref": "#/$defs/string"
-                    }
-                  },
+                  "description": "Detailed status of a synced table. Shown if the synced table is in the SYNCED_CONTINUOUS_UPDATE\nor the SYNCED_UPDATING_PIPELINE_RESOURCES state.",
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "apps.AppDeploymentArtifacts": {
+            "database.SyncedTableFailedStatus": {
               "oneOf": [
                 {
                   "type": "object",
-                  "properties": {
-                    "source_code_path": {
-                      "$ref": "#/$defs/string"
-                    }
-                  },
+                  "description": "Detailed status of a synced table. Shown if the synced table is in the OFFLINE_FAILED or the\nSYNCED_PIPELINE_FAILED state.",
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "apps.AppDeploymentMode": {
+            "database.SyncedTablePipelineProgress": {
               "oneOf": [
                 {
-                  "type": "string",
-                  "enum": [
-                    "SNAPSHOT",
-                    "AUTO_SYNC"
-                  ]
+                  "type": "object",
+                  "description": "Progress information of the Synced Table data synchronization pipeline.",
+                  "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "apps.AppDeploymentState": {
+            "database.SyncedTablePosition": {
               "oneOf": [
                 {
-                  "type": "string",
-                  "enum": [
-                    "SUCCEEDED",
-                    "FAILED",
-                    "IN_PROGRESS",
-                    "CANCELLED"
-                  ]
+                  "type": "object",
+                  "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "apps.AppDeploymentStatus": {
+            "database.SyncedTableProvisioningStatus": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Detailed status of a synced table. Shown if the synced table is in the\nPROVISIONING_PIPELINE_RESOURCES or the PROVISIONING_INITIAL_SNAPSHOT state.",
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "apps.AppPermissionLevel": {
+            "database.SyncedTableSchedulingPolicy": {
               "oneOf": [
                 {
                   "type": "string",
-                  "description": "Permission level",
                   "enum": [
-                    "CAN_MANAGE",
-                    "CAN_USE"
+                    "CONTINUOUS",
+                    "TRIGGERED",
+                    "SNAPSHOT"
+                  ],
+                  "enumDescriptions": [
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "apps.AppResource": {
+            "database.SyncedTableSpec": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Specification of a synced database table.",
                   "properties": {
-                    "app": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceApp"
-                    },
-                    "database": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceDatabase"
-                    },
-                    "description": {
-                      "description": "Description of the App Resource.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "experiment": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceExperiment"
-                    },
-                    "genie_space": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceGenieSpace"
+                    "accelerated_sync": {
+                      "description": "[Private Preview] When true, enables accelerated sync mode for the initial data load.\nThis significantly improves performance for large tables.\nRequires workspace-level enablement.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "job": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceJob"
+                    "create_database_objects_if_missing": {
+                      "description": "[Public Preview] If true, the synced table's logical database and schema resources in PG\nwill be created if they do not already exist.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "name": {
-                      "description": "Name of the App Resource.",
-                      "$ref": "#/$defs/string"
+                    "existing_pipeline_id": {
+                      "description": "[Public Preview] At most one of existing_pipeline_id and new_pipeline_spec should be defined.\n\nIf existing_pipeline_id is defined, the synced table will be bin packed into the existing pipeline\nreferenced. This avoids creating a new pipeline and allows sharing existing compute.\nIn this case, the scheduling_policy of this synced table must match the scheduling policy of the existing pipeline.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "postgres": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourcePostgres"
+                    "new_pipeline_spec": {
+                      "description": "[Public Preview] At most one of existing_pipeline_id and new_pipeline_spec should be defined.\n\nIf new_pipeline_spec is defined, a new pipeline is created for this synced table. The location pointed to is used\nto store intermediate files (checkpoints, event logs etc). The caller must have write permissions to create Delta\ntables in the specified catalog and schema. Again, note this requires write permissions, whereas the source table\nonly requires read permissions.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/database.NewPipelineSpec",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "secret": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceSecret"
+                    "primary_key_columns": {
+                      "description": "[Public Preview] Primary Key columns to be used for data insert/update in the destination.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "serving_endpoint": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceServingEndpoint"
+                    "scheduling_policy": {
+                      "description": "[Public Preview] Scheduling policy of the underlying pipeline.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/database.SyncedTableSchedulingPolicy",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "sql_warehouse": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceSqlWarehouse"
+                    "source_table_full_name": {
+                      "description": "[Public Preview] Three-part (catalog, schema, table) name of the source Delta table.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "uc_securable": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceUcSecurable"
-                    }
-                  },
-                  "additionalProperties": false,
-                  "required": [
-                    "name"
-                  ]
-                },
-                {
-                  "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
-                }
-              ]
-            },
-            "apps.AppResourceApp": {
-              "oneOf": [
-                {
-                  "type": "object",
-                  "properties": {
-                    "name": {
-                      "$ref": "#/$defs/string"
+                    "timeseries_key": {
+                      "description": "[Public Preview] Time series key to deduplicate (tie-break) rows with the same primary key.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "permission": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceAppAppPermission"
+                    "type_overrides": {
+                      "description": "[Private Preview] Override the default Delta-\u003ePG type mapping for specific columns.\nA TypeOverride with PG_SPECIFIC_TYPE_UNSPECIFIED is rejected; a valid pg_type must be set.",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/database.SyncedTableSpecTypeOverride",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "apps.AppResourceAppAppPermission": {
+            "database.SyncedTableSpecPgSpecificType": {
               "oneOf": [
                 {
                   "type": "string",
+                  "description": "PostgreSQL-specific target types that can override the default Delta-to-PG mapping.",
                   "enum": [
-                    "CAN_USE"
+                    "PG_SPECIFIC_TYPE_VECTOR",
+                    "PG_SPECIFIC_TYPE_HALFVEC",
+                    "PG_SPECIFIC_TYPE_VARCHAR"
+                  ],
+                  "enumDescriptions": [
+                    "[Private Preview]",
+                    "[Private Preview]",
+                    "[Private Preview]"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "apps.AppResourceDatabase": {
+            "database.SyncedTableSpecTypeOverride": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Overrides the default Delta-to-PostgreSQL type mapping for a single column.",
                   "properties": {
-                    "database_name": {
-                      "$ref": "#/$defs/string"
+                    "column_name": {
+                      "description": "[Private Preview] Name of the source column whose target PostgreSQL type should be overridden.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "instance_name": {
-                      "$ref": "#/$defs/string"
+                    "pg_type": {
+                      "description": "[Private Preview] PostgreSQL-specific target type to use for the column.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/database.SyncedTableSpecPgSpecificType",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "permission": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceDatabaseDatabasePermission"
+                    "size": {
+                      "description": "[Private Preview] Size parameter for the target type, for types that take one (e.g. vector\ndimension, varchar length). Required when the chosen pg_type needs a size.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "database_name",
-                    "instance_name",
-                    "permission"
+                    "column_name",
+                    "pg_type"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "apps.AppResourceDatabaseDatabasePermission": {
+            "database.SyncedTableState": {
               "oneOf": [
                 {
                   "type": "string",
+                  "description": "The state of a synced table.",
                   "enum": [
-                    "CAN_CONNECT_AND_CREATE"
+                    "SYNCED_TABLE_PROVISIONING",
+                    "SYNCED_TABLE_PROVISIONING_PIPELINE_RESOURCES",
+                    "SYNCED_TABLE_PROVISIONING_INITIAL_SNAPSHOT",
+                    "SYNCED_TABLE_ONLINE",
+                    "SYNCED_TABLE_ONLINE_CONTINUOUS_UPDATE",
+                    "SYNCED_TABLE_ONLINE_TRIGGERED_UPDATE",
+                    "SYNCED_TABLE_ONLINE_NO_PENDING_UPDATE",
+                    "SYNCED_TABLED_OFFLINE",
+                    "SYNCED_TABLE_OFFLINE_FAILED",
+                    "SYNCED_TABLE_ONLINE_PIPELINE_FAILED",
+                    "SYNCED_TABLE_ONLINE_UPDATING_PIPELINE_RESOURCES"
+                  ],
+                  "enumDescriptions": [
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "apps.AppResourceExperiment": {
+            "database.SyncedTableStatus": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Status of a synced table.",
                   "properties": {
-                    "experiment_id": {
-                      "$ref": "#/$defs/string"
+                    "continuous_update_status": {
+                      "description": "[Public Preview] Detailed status of a synced table. Shown if the synced table is in the SYNCED_CONTINUOUS_UPDATE\nor the SYNCED_UPDATING_PIPELINE_RESOURCES state.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/database.SyncedTableContinuousUpdateStatus",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "permission": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceExperimentExperimentPermission"
+                    "failed_status": {
+                      "description": "[Public Preview] Detailed status of a synced table. Shown if the synced table is in the OFFLINE_FAILED or the\nSYNCED_PIPELINE_FAILED state.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/database.SyncedTableFailedStatus",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "provisioning_status": {
+                      "description": "[Public Preview] Detailed status of a synced table. Shown if the synced table is in the\nPROVISIONING_PIPELINE_RESOURCES or the PROVISIONING_INITIAL_SNAPSHOT state.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/database.SyncedTableProvisioningStatus",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "triggered_update_status": {
+                      "description": "[Public Preview] Detailed status of a synced table. Shown if the synced table is in the SYNCED_TRIGGERED_UPDATE\nor the SYNCED_NO_PENDING_UPDATE state.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/database.SyncedTableTriggeredUpdateStatus",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     }
                   },
-                  "additionalProperties": false,
-                  "required": [
-                    "experiment_id",
-                    "permission"
-                  ]
+                  "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "apps.AppResourceExperimentExperimentPermission": {
+            "database.SyncedTableTriggeredUpdateStatus": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Detailed status of a synced table. Shown if the synced table is in the SYNCED_TRIGGERED_UPDATE\nor the SYNCED_NO_PENDING_UPDATE state.",
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "iam.PermissionLevel": {
               "oneOf": [
                 {
                   "type": "string",
+                  "description": "Permission level",
                   "enum": [
                     "CAN_MANAGE",
+                    "CAN_RESTART",
+                    "CAN_ATTACH_TO",
+                    "IS_OWNER",
+                    "CAN_MANAGE_RUN",
+                    "CAN_VIEW",
+                    "CAN_READ",
+                    "CAN_RUN",
                     "CAN_EDIT",
-                    "CAN_READ"
+                    "CAN_USE",
+                    "CAN_MANAGE_STAGING_VERSIONS",
+                    "CAN_MANAGE_PRODUCTION_VERSIONS",
+                    "CAN_EDIT_METADATA",
+                    "CAN_VIEW_METADATA",
+                    "CAN_BIND",
+                    "CAN_QUERY",
+                    "CAN_MONITOR",
+                    "CAN_CREATE",
+                    "CAN_MONITOR_ONLY",
+                    "CAN_CREATE_APP"
+                  ],
+                  "enumDescriptions": [
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "[Private Preview]",
+                    "[Private Preview]"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "apps.AppResourceGenieSpace": {
+            "jobs.AiRuntimeTask": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "AiRuntimeTask: multi-node GPU compute task definition for Databricks AI\nRuntime workloads.\n\nJobs-framework-level concepts (retries, per-task timeout, idempotency\ntoken, usage/budget policy, permissions) live on the surrounding\nTaskSettings / run-submit request and are intentionally NOT duplicated\nhere. Users compose `ai_runtime_task` with the standard Jobs/DABs task\nwrapper to get those.",
                   "properties": {
-                    "name": {
-                      "$ref": "#/$defs/string"
+                    "code_source_path": {
+                      "description": "[Private Preview] Workspace or UC volume path of the code-source archive, unpacked on\neach node and exposed through `$CODE_SOURCE`. Set by first-party\ntooling; not for direct callers.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "permission": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceGenieSpaceGenieSpacePermission"
+                    "deployments": {
+                      "description": "[Public Preview] Deployment specs for this task. Exactly one deployment is currently\nsupported (a single entry where every node runs the same command); this\nis a current-Preview constraint. Role-split workloads (driver + worker,\nparameter server, separate eval node, etc.) with multiple entries are the\neventual intent but not yet supported.",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.DeploymentSpec",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "space_id": {
-                      "$ref": "#/$defs/string"
+                    "docker_image_url": {
+                      "description": "[Beta] Optional Docker image URL for a custom container image. When set,\nthe task runs on the specified container image instead of the default\nDatabricks client image. Format:\n`{organization}/{repository}:{tag}`",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
+                    },
+                    "experiment": {
+                      "description": "[Public Preview] MLflow experiment name for this run. If an experiment with this name\nalready exists under the calling user, the run is appended to it;\notherwise a new experiment is created. To target a specific MLflow\nstorage location (for example, when running as a service principal), set\n`mlflow_experiment_directory`.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "mlflow_artifact_location": {
+                      "description": "[Private Preview] Optional root location for MLflow artifacts logged by the run.\nIf this field isn't specified the default artifact location will be in dbfs\ni.e. `dbfs:/databricks/mlflow-tracking/\u003cexperiment_id\u003e/...`\nIf dbfs access is restricted or UC is preferred this can be a custom location in UC:\n`dbfs:/Volumes/\u003ccatalog\u003e/\u003cschema\u003e/\u003cvolume\u003e/...`\nThe location should be unique for each experiment.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "mlflow_experiment_directory": {
+                      "description": "[Public Preview] Optional workspace directory under which the MLflow experiment named in\n`experiment` is created. Must start with `/Workspace`. Set this when\nrunning as a service principal that has no default user directory; for\nregular users the experiment defaults to the user's home directory.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "mlflow_run": {
+                      "description": "[Public Preview] Optional display name for the MLflow run created under `experiment`. If\nomitted, MLflow generates a default name.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "priority_class": {
+                      "description": "[Private Preview] Scheduling priority class for the workload. May only be set together with\na pre-provisioned capacity reservation (a deployment's\n`compute.provisioned_capacity_id`); it is rejected on a workload that runs\non on-demand capacity.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.AiRuntimeTaskPriorityClass",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "unity_catalog_image_path": {
+                      "description": "[Private Preview] Optional Unity Catalog path for a custom container image. When set,\nthe task runs on the specified container image instead of the default\nDatabricks client image. Format:\n`{catalog}.{schema}.{image_name}:{tag}`",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "name",
-                    "permission",
-                    "space_id"
+                    "deployments",
+                    "experiment"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "apps.AppResourceGenieSpaceGenieSpacePermission": {
+            "jobs.AiRuntimeTaskPriorityClass": {
               "oneOf": [
                 {
                   "type": "string",
+                  "description": "Scheduling priority class for a workload — its priority and preemptability\nwhen the scheduler ranks pending work.",
                   "enum": [
-                    "CAN_MANAGE",
-                    "CAN_EDIT",
-                    "CAN_RUN",
-                    "CAN_VIEW"
+                    "BEST_EFFORT",
+                    "NORMAL",
+                    "CRITICAL"
+                  ],
+                  "enumDescriptions": [
+                    "[Private Preview]",
+                    "[Private Preview]",
+                    "[Private Preview]"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "jobs.AlertTask": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "alert_id": {
+                      "description": "[Public Preview] The alert_id is the canonical identifier of the alert.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "parameters": {
+                      "description": "[Private Preview] Per-run parameter overrides, keyed by parameter name, applied onto the alert's stored\nquery parameters before the query is executed. Only scalar values are supported. Values\nmay reference job parameters with `{{job.parameters.*}}`, which are resolved before the\ntask runs. An override whose key does not match a stored parameter fails the task run.\nLimited to 10000 characters when serialized as JSON; keys must be 1-100 characters and\ncontain only letters, digits, underscores, dashes, and periods.",
+                      "$ref": "#/$defs/map/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "subscribers": {
+                      "description": "[Public Preview] The subscribers receive alert evaluation result notifications after the alert task is completed.\nThe number of subscriptions is limited to 100.",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.AlertTaskSubscriber",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "warehouse_id": {
+                      "description": "[Public Preview] The warehouse_id identifies the warehouse settings used by the alert task.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "workspace_path": {
+                      "description": "[Public Preview] The workspace_path is the path to the alert file in the workspace. The path:\n* must start with \"/Workspace\"\n* must be a normalized path.\nUser has to select only one of alert_id or workspace_path to identify the alert.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "apps.AppResourceJob": {
+            "jobs.AlertTaskSubscriber": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Represents a subscriber that will receive alert notifications.\nA subscriber can be either a user (via email) or a notification destination (via destination_id).",
                   "properties": {
-                    "id": {
-                      "$ref": "#/$defs/string"
+                    "destination_id": {
+                      "description": "[Public Preview]",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "permission": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceJobJobPermission"
+                    "user_name": {
+                      "description": "[Public Preview] A valid workspace email address.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     }
                   },
-                  "additionalProperties": false,
-                  "required": [
-                    "id",
-                    "permission"
-                  ]
+                  "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "apps.AppResourceJobJobPermission": {
+            "jobs.AuthenticationMethod": {
               "oneOf": [
                 {
                   "type": "string",
                   "enum": [
-                    "CAN_MANAGE",
-                    "IS_OWNER",
-                    "CAN_MANAGE_RUN",
-                    "CAN_VIEW"
+                    "OAUTH",
+                    "PAT"
+                  ],
+                  "enumDescriptions": [
+                    "[Public Preview]",
+                    "[Public Preview]"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "apps.AppResourcePostgres": {
+            "jobs.CleanRoomsNotebookTask": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Clean Rooms notebook task for V1 Clean Room service (GA).\nReplaces the deprecated CleanRoomNotebookTask (defined above) which was for V0 service.",
                   "properties": {
-                    "branch": {
-                      "$ref": "#/$defs/string"
+                    "clean_room_name": {
+                      "description": "The clean room that the notebook belongs to.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "database": {
-                      "$ref": "#/$defs/string"
+                    "etag": {
+                      "description": "Checksum to validate the freshness of the notebook resource (i.e. the notebook being run is the latest version).\nIt can be fetched by calling the :method:cleanroomassets/get API.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "permission": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourcePostgresPostgresPermission"
+                    "notebook_base_parameters": {
+                      "description": "Base parameters to be used for the clean room notebook job.",
+                      "$ref": "#/$defs/map/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "notebook_name": {
+                      "description": "Name of the notebook being run.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
-                  "additionalProperties": false
+                  "additionalProperties": false,
+                  "required": [
+                    "clean_room_name",
+                    "notebook_name"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "apps.AppResourcePostgresPostgresPermission": {
+            "jobs.Compute": {
               "oneOf": [
                 {
-                  "type": "string",
-                  "enum": [
-                    "CAN_CONNECT_AND_CREATE"
-                  ]
+                  "type": "object",
+                  "properties": {
+                    "hardware_accelerator": {
+                      "description": "[Public Preview] Hardware accelerator configuration for Serverless GPU workloads.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.HardwareAcceleratorType",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    }
+                  },
+                  "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "apps.AppResourceSecret": {
+            "jobs.ComputeConfig": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "key": {
-                      "$ref": "#/$defs/string"
+                    "gpu_node_pool_id": {
+                      "description": "[Private Preview] IDof the GPU pool to use.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "permission": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceSecretSecretPermission"
+                    "gpu_type": {
+                      "description": "[Private Preview] GPU type.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "scope": {
-                      "$ref": "#/$defs/string"
+                    "num_gpus": {
+                      "description": "[Private Preview] Number of GPUs.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "key",
-                    "permission",
-                    "scope"
+                    "num_gpus"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "apps.AppResourceSecretSecretPermission": {
+            "jobs.ComputeSpec": {
               "oneOf": [
                 {
-                  "type": "string",
-                  "description": "Permission to grant on the secret scope. Supported permissions are: \"READ\", \"WRITE\", \"MANAGE\".",
-                  "enum": [
-                    "READ",
-                    "WRITE",
-                    "MANAGE"
+                  "type": "object",
+                  "description": "ComputeSpec: compute configuration — accelerator type and total\naccelerator count across all nodes.",
+                  "properties": {
+                    "accelerator_count": {
+                      "description": "[Public Preview] Total number of accelerators across all nodes. Must be a positive\nmultiple of the per-node accelerator count encoded in `accelerator_type`.\nFor example, `GPU_8xH100` with `accelerator_count: 16` allocates 2 nodes\n(8 GPUs per node).",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "accelerator_type": {
+                      "description": "[Public Preview] Hardware accelerator type (for example, `GPU_1xA10` or `GPU_8xH100`).\nThe number of accelerators per node is encoded in the enum value —\n`GPU_8xH100` means 8 H100 GPUs per node.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.ComputeSpecAcceleratorType",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "provisioned_capacity_id": {
+                      "description": "[Private Preview] Optional ID of a pre-provisioned accelerator capacity reservation to run\nthis AI Runtime workload on. When set, the workload is scheduled onto the\nreferenced reserved capacity instead of the on-demand capacity shared among\nall Databricks customers.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "accelerator_count",
+                    "accelerator_type"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "apps.AppResourceServingEndpoint": {
+            "jobs.ComputeSpecAcceleratorType": {
               "oneOf": [
                 {
-                  "type": "object",
-                  "properties": {
-                    "name": {
-                      "$ref": "#/$defs/string"
-                    },
-                    "permission": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceServingEndpointServingEndpointPermission"
-                    }
-                  },
-                  "additionalProperties": false,
-                  "required": [
-                    "name",
-                    "permission"
+                  "type": "string",
+                  "description": "Hardware accelerator type for the AiRuntime workload. Per-node\naccelerator count is encoded in the value name (e.g. `GPU_8xH100` means\n8 H100s per node).",
+                  "enum": [
+                    "GPU_1xA10",
+                    "GPU_1xH100",
+                    "GPU_8xH100",
+                    "GPU_8xB300"
+                  ],
+                  "enumDescriptions": [
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "apps.AppResourceServingEndpointServingEndpointPermission": {
+            "jobs.Condition": {
               "oneOf": [
                 {
                   "type": "string",
                   "enum": [
-                    "CAN_MANAGE",
-                    "CAN_QUERY",
-                    "CAN_VIEW"
+                    "ANY_UPDATED",
+                    "ALL_UPDATED"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "apps.AppResourceSqlWarehouse": {
+            "jobs.ConditionTask": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "id": {
-                      "$ref": "#/$defs/string"
+                    "left": {
+                      "description": "The left operand of the condition task. Can be either a string value or a job state or parameter reference.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "permission": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceSqlWarehouseSqlWarehousePermission"
+                    "op": {
+                      "description": "* `EQUAL_TO`, `NOT_EQUAL` operators perform string comparison of their operands. This means that `“12.0” == “12”` will evaluate to `false`.\n* `GREATER_THAN`, `GREATER_THAN_OR_EQUAL`, `LESS_THAN`, `LESS_THAN_OR_EQUAL` operators perform numeric comparison of their operands. `“12.0” \u003e= “12”` will evaluate to `true`, `“10.0” \u003e= “12”` will evaluate to `false`.\n\nThe boolean comparison to task values can be implemented with operators `EQUAL_TO`, `NOT_EQUAL`. If a task value was set to a boolean value, it will be serialized to `“true”` or `“false”` for the comparison.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.ConditionTaskOp",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "right": {
+                      "description": "The right operand of the condition task. Can be either a string value or a job state or parameter reference.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "id",
-                    "permission"
+                    "left",
+                    "op",
+                    "right"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "apps.AppResourceSqlWarehouseSqlWarehousePermission": {
+            "jobs.ConditionTaskOp": {
               "oneOf": [
                 {
                   "type": "string",
+                  "description": "* `EQUAL_TO`, `NOT_EQUAL` operators perform string comparison of their operands. This means that `“12.0” == “12”` will evaluate to `false`.\n* `GREATER_THAN`, `GREATER_THAN_OR_EQUAL`, `LESS_THAN`, `LESS_THAN_OR_EQUAL` operators perform numeric comparison of their operands. `“12.0” \u003e= “12”` will evaluate to `true`, `“10.0” \u003e= “12”` will evaluate to `false`.\n\nThe boolean comparison to task values can be implemented with operators `EQUAL_TO`, `NOT_EQUAL`. If a task value was set to a boolean value, it will be serialized to `“true”` or `“false”` for the comparison.",
                   "enum": [
-                    "CAN_MANAGE",
-                    "CAN_USE",
-                    "IS_OWNER"
+                    "EQUAL_TO",
+                    "GREATER_THAN",
+                    "GREATER_THAN_OR_EQUAL",
+                    "LESS_THAN",
+                    "LESS_THAN_OR_EQUAL",
+                    "NOT_EQUAL"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "apps.AppResourceUcSecurable": {
+            "jobs.Continuous": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "permission": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceUcSecurableUcSecurablePermission"
+                    "maintenance_window": {
+                      "description": "Defines when platform-initiated maintenance may run for this job. If unspecified, maintenance may run at any time.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.MaintenanceWindow",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "securable_full_name": {
-                      "$ref": "#/$defs/string"
+                    "pause_status": {
+                      "description": "Indicate whether the continuous execution of the job is paused or not. Defaults to UNPAUSED.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PauseStatus",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "securable_type": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceUcSecurableUcSecurableType"
+                    "task_retry_mode": {
+                      "description": "Indicate whether the continuous job is applying task level retries or not. Defaults to NEVER.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.TaskRetryMode",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
-                  "additionalProperties": false,
-                  "required": [
-                    "permission",
-                    "securable_full_name",
-                    "securable_type"
-                  ]
+                  "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "apps.AppResourceUcSecurableUcSecurablePermission": {
+            "jobs.ContinuousTriggerConfiguration": {
               "oneOf": [
                 {
-                  "type": "string",
-                  "enum": [
-                    "READ_VOLUME",
-                    "WRITE_VOLUME",
-                    "SELECT",
-                    "EXECUTE",
-                    "USE_CONNECTION",
-                    "MODIFY"
-                  ]
+                  "type": "object",
+                  "description": "Continuous trigger. Stripped-down counterpart to `ContinuousSettings`: `pause_status` is owned by the enclosing\n`TriggerConfiguration` and intentionally omitted here.",
+                  "properties": {
+                    "maintenance_window": {
+                      "description": "[Beta] Defines when platform-initiated maintenance may run for this trigger. If unspecified,\nmaintenance may run at any time.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.MaintenanceWindow",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
+                    },
+                    "task_retry_mode": {
+                      "description": "[Beta] Whether the continuous job applies task-level retries. Defaults to NEVER.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.TaskRetryMode",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
+                    }
+                  },
+                  "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "apps.AppResourceUcSecurableUcSecurableType": {
+            "jobs.CronSchedule": {
               "oneOf": [
                 {
-                  "type": "string",
-                  "enum": [
-                    "VOLUME",
-                    "TABLE",
-                    "FUNCTION",
-                    "CONNECTION"
+                  "type": "object",
+                  "properties": {
+                    "pause_status": {
+                      "description": "Indicate whether this schedule is paused or not.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PauseStatus",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "quartz_cron_expression": {
+                      "description": "A Cron expression using Quartz syntax that describes the schedule for a job. See [Cron Trigger](http://www.quartz-scheduler.org/documentation/quartz-2.3.0/tutorials/crontrigger.html) for details. This field is required.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "sql_condition": {
+                      "description": "[Private Preview] SQL condition that must be satisfied before a scheduled run is triggered. The condition is evaluated\nafter the cron expression fires and must return a truthy result for the run to proceed.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SqlConditionConfiguration",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "timezone_id": {
+                      "description": "A Java timezone ID. The schedule for a job is resolved with respect to this timezone. See [Java TimeZone](https://docs.oracle.com/javase/7/docs/api/java/util/TimeZone.html) for details. This field is required.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "quartz_cron_expression",
+                    "timezone_id"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "apps.ApplicationState": {
+            "jobs.CronTriggerConfiguration": {
               "oneOf": [
                 {
-                  "type": "string",
-                  "enum": [
-                    "DEPLOYING",
-                    "RUNNING",
-                    "CRASHED",
-                    "UNAVAILABLE"
+                  "type": "object",
+                  "description": "Cron schedule trigger. Stripped-down counterpart to `CronSchedule`: `pause_status` and `sql_condition` are owned\nby the enclosing `TriggerConfiguration` and intentionally omitted here.",
+                  "properties": {
+                    "quartz_cron_expression": {
+                      "description": "[Beta] A Cron expression using Quartz syntax that describes the schedule for this trigger. See\n[Cron Trigger](http://www.quartz-scheduler.org/documentation/quartz-2.3.0/tutorials/crontrigger.html) for details.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
+                    },
+                    "timezone_id": {
+                      "description": "[Beta] A Java timezone ID. The schedule is resolved with respect to this timezone. See\n[Java TimeZone](https://docs.oracle.com/javase/7/docs/api/java/util/TimeZone.html) for details.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "quartz_cron_expression",
+                    "timezone_id"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "apps.ApplicationStatus": {
+            "jobs.DashboardTask": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Configures the Lakeview Dashboard job task type.",
+                  "properties": {
+                    "dashboard_id": {
+                      "description": "The identifier of the dashboard to refresh.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "filters": {
+                      "description": "Dashboard task parameters. Used to apply dashboard filter values during dashboard task execution. Parameter values get applied to any dashboard filters that have a matching URL identifier as the parameter key.\nThe parameter value format is dependent on the filter type:\n- For text and single-select filters, provide a single value (e.g. `\"value\"`)\n- For date and datetime filters, provide the value in ISO 8601 format (e.g. `\"2000-01-01T00:00:00\"`)\n- For multi-select filters, provide a JSON array of values (e.g. `\"[\\\"value1\\\",\\\"value2\\\"]\"`)\n- For range and date range filters, provide a JSON object with `start` and `end` (e.g. `\"{\\\"start\\\":\\\"1\\\",\\\"end\\\":\\\"10\\\"}\"`)",
+                      "$ref": "#/$defs/map/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "subscription": {
+                      "description": "Optional: subscription configuration for sending the dashboard snapshot.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.Subscription",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "warehouse_id": {
+                      "description": "Optional: The warehouse id to execute the dashboard with for the schedule.\nIf not specified, the default warehouse of the dashboard will be used.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
-                }
-              ]
-            },
-            "apps.ComputeSize": {
-              "oneOf": [
-                {
-                  "type": "string",
-                  "enum": [
-                    "MEDIUM",
-                    "LARGE"
-                  ]
-                },
-                {
-                  "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "apps.ComputeState": {
+            "jobs.DayOfWeek": {
               "oneOf": [
                 {
                   "type": "string",
+                  "description": "Days of week that can be referenced by Jobs scheduling settings.",
                   "enum": [
-                    "ERROR",
-                    "DELETING",
-                    "STARTING",
-                    "STOPPING",
-                    "UPDATING",
-                    "STOPPED",
-                    "ACTIVE"
+                    "MONDAY",
+                    "TUESDAY",
+                    "WEDNESDAY",
+                    "THURSDAY",
+                    "FRIDAY",
+                    "SATURDAY",
+                    "SUNDAY"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "apps.ComputeStatus": {
+            "jobs.DbtCloudTask": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Deprecated in favor of DbtPlatformTask",
+                  "properties": {
+                    "connection_resource_name": {
+                      "description": "[Private Preview] The resource name of the UC connection that authenticates the dbt Cloud for this task",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "dbt_cloud_job_id": {
+                      "description": "[Private Preview] Id of the dbt Cloud job to be triggered",
+                      "$ref": "#/$defs/int64",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    }
+                  },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "apps.EnvVar": {
+            "jobs.DbtPlatformTask": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "name": {
-                      "description": "The name of the environment variable.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "value": {
-                      "description": "The value for the environment variable.",
-                      "$ref": "#/$defs/string"
+                    "connection_resource_name": {
+                      "description": "[Private Preview] The resource name of the UC connection that authenticates the dbt platform for this task",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "value_from": {
-                      "description": "The name of an external Databricks resource that contains the value, such as a secret or a database table.",
-                      "$ref": "#/$defs/string"
+                    "dbt_platform_job_id": {
+                      "description": "[Private Preview] Id of the dbt platform job to be triggered. Specified as a string for maximum compatibility with clients.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "apps.GitRepository": {
+            "jobs.DbtTask": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "Git repository configuration specifying the location of the repository.",
                   "properties": {
-                    "provider": {
-                      "description": "Git provider. Case insensitive. Supported values: gitHub, gitHubEnterprise, bitbucketCloud,\nbitbucketServer, azureDevOpsServices, gitLab, gitLabEnterpriseEdition, awsCodeCommit.",
-                      "$ref": "#/$defs/string"
+                    "catalog": {
+                      "description": "Optional name of the catalog to use. The value is the top level in the 3-level namespace of Unity Catalog (catalog / schema / relation). The catalog value can only be specified if a warehouse_id is specified. Requires dbt-databricks \u003e= 1.1.1.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "url": {
-                      "description": "URL of the Git repository.",
-                      "$ref": "#/$defs/string"
+                    "commands": {
+                      "description": "A list of dbt commands to execute. All commands must start with `dbt`. This parameter must not be empty. A maximum of up to 10 commands can be provided.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "profiles_directory": {
+                      "description": "Optional (relative) path to the profiles directory. Can only be specified if no warehouse_id is specified. If no warehouse_id is specified and this folder is unset, the root directory is used.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "project_directory": {
+                      "description": "Path to the project directory. Optional for Git sourced tasks, in which\ncase if no value is provided, the root of the Git repository is used.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "schema": {
+                      "description": "Optional schema to write to. This parameter is only used when a warehouse_id is also provided. If not provided, the `default` schema is used.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "source": {
+                      "description": "Optional location type of the project directory. When set to `WORKSPACE`, the project will be retrieved\nfrom the local Databricks workspace. When set to `GIT`, the project will be retrieved from a Git repository\ndefined in `git_source`. If the value is empty, the task will use `GIT` if `git_source` is defined and `WORKSPACE` otherwise.\n\n* `WORKSPACE`: Project is located in Databricks workspace.\n* `GIT`: Project is located in cloud Git provider.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.Source",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "warehouse_id": {
+                      "description": "ID of the SQL warehouse to connect to. If provided, we automatically generate and provide the profile and connection details to dbt. It can be overridden on a per-command basis by using the `--profiles-dir` command line argument.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "provider",
-                    "url"
+                    "commands"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "apps.GitSource": {
+            "jobs.DeploymentSpec": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "Complete git source specification including repository location and reference.",
+                  "description": "DeploymentSpec: configuration for one deployment within an AiRuntimeTask.\nEach entry in `AiRuntimeTask.deployments` describes a group of nodes that\nshare the same command and compute. Many single-program training\nalgorithms use a single entry where every node runs the same command;\nrole-split workloads (driver + worker, parameter server, separate eval\nnode, etc.) use multiple entries.",
                   "properties": {
-                    "branch": {
-                      "description": "Git branch to checkout.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "commit": {
-                      "description": "Git commit SHA to checkout.",
-                      "$ref": "#/$defs/string"
+                    "command_path": {
+                      "description": "[Public Preview] Workspace path of the script to run on each node in this deployment.\nUpload the script to this path and supply the path here. When the task\nruns, the file at this path is run on each node; if it fails, the task\nfails with its exit code.\n\nExample script contents:\n\n```bash\n# Plain Python:\npython train.py --epochs 10\n\n# Multi-GPU via accelerate:\naccelerate launch train.py --config config.yaml\n\n# Distributed via torchrun:\ntorchrun --nproc_per_node=8 train.py\n```",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "source_code_path": {
-                      "description": "Relative path to the app source code within the Git repository. If not specified, the root\nof the repository is used.",
-                      "$ref": "#/$defs/string"
+                    "compute": {
+                      "description": "[Public Preview] Compute resources allocated to each node in this deployment.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.ComputeSpec",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "tag": {
-                      "description": "Git tag to checkout.",
-                      "$ref": "#/$defs/string"
+                    "name": {
+                      "description": "[Public Preview] Optional human-readable name for this deployment (for example, `driver`,\n`worker`, `param_server`). Used for log and UI display. Distinct names\nare recommended so deployments can be told apart, but uniqueness is not\nenforced.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     }
                   },
-                  "additionalProperties": false
+                  "additionalProperties": false,
+                  "required": [
+                    "compute"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "apps.TelemetryExportDestination": {
+            "jobs.FileArrivalTriggerConfiguration": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "A single telemetry export destination with its configuration and status.",
                   "properties": {
-                    "unity_catalog": {
-                      "description": "Unity Catalog Destinations for OTEL telemetry export.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.UnityCatalog"
+                    "min_time_between_triggers_seconds": {
+                      "description": "If set, the trigger starts a run only after the specified amount of time passed since\nthe last time the trigger fired. The minimum allowed value is 60 seconds",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "url": {
+                      "description": "URL to be monitored for file arrivals. The path must point to the root or a subpath of the external location.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "wait_after_last_change_seconds": {
+                      "description": "If set, the trigger starts a run only after no file activity has occurred for the specified amount of time.\nThis makes it possible to wait for a batch of incoming files to arrive before triggering a run. The\nminimum allowed value is 60 seconds.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
-                  "additionalProperties": false
+                  "additionalProperties": false,
+                  "required": [
+                    "url"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "apps.UnityCatalog": {
+            "jobs.ForEachTask": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "Unity Catalog Destinations for OTEL telemetry export.",
                   "properties": {
-                    "logs_table": {
-                      "description": "Unity Catalog table for OTEL logs.",
-                      "$ref": "#/$defs/string"
+                    "concurrency": {
+                      "description": "An optional maximum allowed number of concurrent runs of the task.\nSet this value if you want to be able to execute multiple runs of the task concurrently.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "metrics_table": {
-                      "description": "Unity Catalog table for OTEL metrics.",
-                      "$ref": "#/$defs/string"
+                    "inputs": {
+                      "description": "Array for task to iterate on. This can be a JSON string or a reference to\nan array parameter.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "traces_table": {
-                      "description": "Unity Catalog table for OTEL traces (spans).",
-                      "$ref": "#/$defs/string"
+                    "task": {
+                      "description": "Configuration for the task that will be run for each element in the array",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.Task",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "logs_table",
-                    "metrics_table",
-                    "traces_table"
+                    "inputs",
+                    "task"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "catalog.AwsSqsQueue": {
+            "jobs.Format": {
               "oneOf": [
                 {
-                  "type": "object",
-                  "properties": {
-                    "queue_url": {
-                      "$ref": "#/$defs/string"
-                    }
-                  },
-                  "additionalProperties": false
+                  "type": "string",
+                  "enum": [
+                    "SINGLE_TASK",
+                    "MULTI_TASK"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "catalog.AzureEncryptionSettings": {
+            "jobs.GenAiComputeTask": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "DEPRECATED — use `AiRuntimeTask` for all new BYOT multi-node GPU\nworkloads (see ai_runtime_task.proto). `AiRuntimeTask` is the only\nsupported BYOT task type for new workloads; this proto is retained only\nfor AIR CLI (fka SGCLI) pywheel backwards compatibility and will be\nremoved once the pywheel → databricks-cli migration completes (post-\nPuPr).",
                   "properties": {
-                    "azure_cmk_access_connector_id": {
-                      "$ref": "#/$defs/string"
+                    "command": {
+                      "description": "[Private Preview] Command launcher to run the actual script, e.g. bash, python etc.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "azure_cmk_managed_identity_id": {
-                      "$ref": "#/$defs/string"
+                    "compute": {
+                      "description": "[Private Preview]",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.ComputeConfig",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "azure_tenant_id": {
-                      "$ref": "#/$defs/string"
+                    "dl_runtime_image": {
+                      "description": "[Private Preview] Runtime image",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "mlflow_experiment_name": {
+                      "description": "[Private Preview] Optional string containing the name of the MLflow experiment to log the run to. If name is not\nfound, backend will create the mlflow experiment using the name.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "source": {
+                      "description": "[Private Preview] Optional location type of the training script. When set to `WORKSPACE`, the script will be retrieved from the local Databricks workspace. When set to `GIT`, the script will be retrieved from a Git repository\ndefined in `git_source`. If the value is empty, the task will use `GIT` if `git_source` is defined and `WORKSPACE` otherwise.\n* `WORKSPACE`: Script is located in Databricks workspace.\n* `GIT`: Script is located in cloud Git provider.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.Source",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "training_script_path": {
+                      "description": "[Private Preview] The training script file path to be executed. Cloud file URIs (such as dbfs:/, s3:/, adls:/, gcs:/) and workspace paths are supported. For python files stored in the Databricks workspace, the path must be absolute and begin with `/`. For files stored in a remote repository, the path must be relative. This field is required.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "yaml_parameters": {
+                      "description": "[Private Preview] Optional string containing model parameters passed to the training script in yaml format.\nIf present, then the content in yaml_parameters_file_path will be ignored.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "yaml_parameters_file_path": {
+                      "description": "[Private Preview] Optional path to a YAML file containing model parameters passed to the training script.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "azure_tenant_id"
+                    "dl_runtime_image"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "catalog.AzureQueueStorage": {
+            "jobs.GitProvider": {
               "oneOf": [
-                {
-                  "type": "object",
-                  "properties": {
-                    "queue_url": {
-                      "$ref": "#/$defs/string"
-                    },
-                    "resource_group": {
-                      "$ref": "#/$defs/string"
-                    },
-                    "subscription_id": {
-                      "$ref": "#/$defs/string"
-                    }
-                  },
-                  "additionalProperties": false
-                },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
-                }
-              ]
-            },
-            "catalog.EncryptionDetails": {
-              "oneOf": [
-                {
-                  "type": "object",
-                  "description": "Encryption options that apply to clients connecting to cloud storage.",
-                  "properties": {
-                    "sse_encryption_details": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.SseEncryptionDetails"
-                    }
-                  },
-                  "additionalProperties": false
+                  "enum": [
+                    "gitHub",
+                    "bitbucketCloud",
+                    "azureDevOpsServices",
+                    "gitHubEnterprise",
+                    "bitbucketServer",
+                    "gitLab",
+                    "gitLabEnterpriseEdition",
+                    "awsCodeCommit"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "catalog.EncryptionSettings": {
+            "jobs.GitSnapshot": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "Encryption Settings are used to carry metadata for securable encryption at rest.\nCurrently used for catalogs, we can use the information supplied here to interact with a CMK.",
+                  "description": "Read-only state of the remote repository at the time the job was run. This field is only included on job runs.",
                   "properties": {
-                    "azure_encryption_settings": {
-                      "description": "optional Azure settings - only required if an Azure CMK is used.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.AzureEncryptionSettings"
-                    },
-                    "azure_key_vault_key_id": {
-                      "description": "the AKV URL in Azure, null otherwise.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "customer_managed_key_id": {
-                      "description": "the CMK uuid in AWS and GCP, null otherwise.",
-                      "$ref": "#/$defs/string"
+                    "used_commit": {
+                      "description": "Commit that was used to execute the run. If git_branch was specified, this points to the HEAD of the branch at the time of the run; if git_tag was specified, this points to the commit the tag points to.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "catalog.FileEventQueue": {
+            "jobs.GitSource": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "An optional specification for a remote Git repository containing the source code used by tasks. Version-controlled source code is supported by notebook, dbt, Python script, and SQL File tasks.\n\nIf `git_source` is set, these tasks retrieve the file from the remote repository by default. However, this behavior can be overridden by setting `source` to `WORKSPACE` on the task.\n\nNote: dbt and SQL File tasks support only version-controlled sources. If dbt or SQL File tasks are used, `git_source` must be defined on the job.",
                   "properties": {
-                    "managed_aqs": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.AzureQueueStorage"
+                    "git_branch": {
+                      "description": "Name of the branch to be checked out and used by this job. This field cannot be specified in conjunction with git_tag or git_commit.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "managed_pubsub": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.GcpPubsub"
+                    "git_commit": {
+                      "description": "Commit to be checked out and used by this job. This field cannot be specified in conjunction with git_branch or git_tag.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "managed_sqs": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.AwsSqsQueue"
+                    "git_provider": {
+                      "description": "Unique identifier of the service used to host the Git repository. The value is case insensitive.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.GitProvider",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "provided_aqs": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.AzureQueueStorage"
+                    "git_tag": {
+                      "description": "Name of the tag to be checked out and used by this job. This field cannot be specified in conjunction with git_branch or git_commit.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "provided_pubsub": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.GcpPubsub"
+                    "git_url": {
+                      "description": "URL of the repository to be cloned by this job.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "provided_sqs": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.AwsSqsQueue"
+                    "sparse_checkout": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SparseCheckout",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
-                  "additionalProperties": false
+                  "additionalProperties": false,
+                  "required": [
+                    "git_provider",
+                    "git_url"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "catalog.GcpPubsub": {
+            "jobs.JobCluster": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "subscription_name": {
-                      "$ref": "#/$defs/string"
+                    "job_cluster_key": {
+                      "description": "A unique name for the job cluster. This field is required and must be unique within the job.\n`JobTaskSettings` may refer to this field to determine which cluster to launch for the task execution.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "new_cluster": {
+                      "description": "If new_cluster, a description of a cluster that is created for each task.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.ClusterSpec",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "serverless_compute_id": {
+                      "description": "[Private Preview] The ID of the serverless compute object to bind this cluster to. At most one\nJobCluster per job may set this field; the rate limit defined on the referenced\nserverless compute applies across all tasks bound to this cluster.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
-                  "additionalProperties": false
+                  "additionalProperties": false,
+                  "required": [
+                    "job_cluster_key"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "catalog.MonitorCronSchedule": {
+            "jobs.JobDeployment": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "pause_status": {
-                      "description": "Read only field that indicates whether a schedule is paused or not.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.MonitorCronSchedulePauseStatus"
-                    },
-                    "quartz_cron_expression": {
-                      "description": "The expression that determines when to run the monitor. See [examples](https://www.quartz-scheduler.org/documentation/quartz-2.3.0/tutorials/crontrigger.html).",
-                      "$ref": "#/$defs/string"
+                    "kind": {
+                      "description": "The kind of deployment that manages the job.\n\n* `BUNDLE`: The job is managed by Databricks Asset Bundle.\n* `SYSTEM_MANAGED`: The job is managed by Databricks and is read-only.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobDeploymentKind",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "timezone_id": {
-                      "description": "The timezone id (e.g., ``PST``) in which to evaluate the quartz expression.",
-                      "$ref": "#/$defs/string"
+                    "metadata_file_path": {
+                      "description": "Path of the file that contains deployment metadata.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "quartz_cron_expression",
-                    "timezone_id"
+                    "kind"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "catalog.MonitorCronSchedulePauseStatus": {
+            "jobs.JobDeploymentKind": {
               "oneOf": [
                 {
                   "type": "string",
-                  "description": "Source link: https://src.dev.databricks.com/databricks/universe/-/blob/elastic-spark-common/api/messages/schedule.proto\nMonitoring workflow schedule pause status.",
+                  "description": "* `BUNDLE`: The job is managed by Databricks Asset Bundle.\n* `SYSTEM_MANAGED`: The job is managed by Databricks and is read-only.",
                   "enum": [
-                    "UNSPECIFIED",
-                    "UNPAUSED",
-                    "PAUSED"
+                    "BUNDLE",
+                    "SYSTEM_MANAGED"
+                  ],
+                  "enumDescriptions": [
+                    "The job is managed by Databricks Asset Bundle.",
+                    "[Beta] The job is managed by \u003cDatabricks\u003e and is read-only."
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "catalog.MonitorDataClassificationConfig": {
+            "jobs.JobEditMode": {
               "oneOf": [
                 {
-                  "type": "object",
-                  "description": "Data classification related configuration.",
-                  "properties": {
-                    "enabled": {
-                      "description": "Whether to enable data classification.",
-                      "$ref": "#/$defs/bool"
-                    }
-                  },
-                  "additionalProperties": false
+                  "type": "string",
+                  "description": "Edit mode of the job.\n\n* `UI_LOCKED`: The job is in a locked UI state and cannot be modified.\n* `EDITABLE`: The job is in an editable state and can be modified.",
+                  "enum": [
+                    "UI_LOCKED",
+                    "EDITABLE"
+                  ],
+                  "enumDescriptions": [
+                    "The job is in a locked UI state and cannot be modified.",
+                    "The job is in an editable state and can be modified."
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "catalog.MonitorDestination": {
+            "jobs.JobEmailNotifications": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "email_addresses": {
-                      "description": "The list of email addresses to send the notification to. A maximum of 5 email addresses is supported.",
-                      "$ref": "#/$defs/slice/string"
+                    "no_alert_for_skipped_runs": {
+                      "description": "If true, do not send email to recipients specified in `on_failure` if the run is skipped.\nThis field is `deprecated`. Please use the `notification_settings.no_alert_for_skipped_runs` field.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA",
+                      "deprecationMessage": "This field is deprecated",
+                      "deprecated": true
+                    },
+                    "on_duration_warning_threshold_exceeded": {
+                      "description": "A list of email addresses to be notified when the duration of a run exceeds the threshold specified for the `RUN_DURATION_SECONDS` metric in the `health` field. If no rule for the `RUN_DURATION_SECONDS` metric is specified in the `health` field for the job, notifications are not sent.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "on_failure": {
+                      "description": "A list of email addresses to be notified when a run unsuccessfully completes. A run is considered to have completed unsuccessfully if it ends with an `INTERNAL_ERROR` `life_cycle_state` or a `FAILED`, or `TIMED_OUT` result_state. If this is not specified on job creation, reset, or update the list is empty, and notifications are not sent.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "on_maintenance_complete": {
+                      "description": "A list of email addresses to notify when platform-initiated maintenance completes for a continuous job.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "on_maintenance_start": {
+                      "description": "A list of email addresses to notify when platform-initiated maintenance starts for a continuous job.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "on_start": {
+                      "description": "A list of email addresses to be notified when a run begins. If not specified on job creation, reset, or update, the list is empty, and notifications are not sent.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "on_streaming_backlog_exceeded": {
+                      "description": "[Public Preview] A list of email addresses to notify when any streaming backlog thresholds are exceeded for any stream.\nStreaming backlog thresholds can be set in the `health` field using the following metrics: `STREAMING_BACKLOG_BYTES`, `STREAMING_BACKLOG_RECORDS`, `STREAMING_BACKLOG_SECONDS`, or `STREAMING_BACKLOG_FILES`.\nAlerting is based on the 10-minute average of these metrics. If the issue persists, notifications are resent every 30 minutes.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "on_success": {
+                      "description": "A list of email addresses to be notified when a run successfully completes. A run is considered to have completed successfully if it ends with a `TERMINATED` `life_cycle_state` and a `SUCCESS` result_state. If not specified on job creation, reset, or update, the list is empty, and notifications are not sent.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "catalog.MonitorInferenceLog": {
+            "jobs.JobEnvironment": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "granularities": {
-                      "description": "Granularities for aggregating data into time windows based on their timestamp. Valid values are 5 minutes, 30 minutes, 1 hour, 1 day, n weeks, 1 month, or 1 year.",
-                      "$ref": "#/$defs/slice/string"
-                    },
-                    "label_col": {
-                      "description": "Column for the label.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "model_id_col": {
-                      "description": "Column for the model identifier.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "prediction_col": {
-                      "description": "Column for the prediction.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "prediction_proba_col": {
-                      "description": "Column for prediction probabilities",
-                      "$ref": "#/$defs/string"
-                    },
-                    "problem_type": {
-                      "description": "Problem type the model aims to solve.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.MonitorInferenceLogProblemType"
+                    "environment_key": {
+                      "description": "The key of an environment. It has to be unique within a job.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "timestamp_col": {
-                      "description": "Column for the timestamp.",
-                      "$ref": "#/$defs/string"
+                    "spec": {
+                      "description": "The environment entity used to preserve serverless environment side panel, jobs' environment for non-notebook task, and SDP's environment for classic and serverless pipelines.\nIn this minimal environment spec, only pip and java dependencies are supported.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.Environment",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "granularities",
-                    "model_id_col",
-                    "prediction_col",
-                    "problem_type",
-                    "timestamp_col"
-                  ]
-                },
-                {
-                  "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
-                }
-              ]
-            },
-            "catalog.MonitorInferenceLogProblemType": {
-              "oneOf": [
-                {
-                  "type": "string",
-                  "enum": [
-                    "PROBLEM_TYPE_CLASSIFICATION",
-                    "PROBLEM_TYPE_REGRESSION"
+                    "environment_key"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "catalog.MonitorMetric": {
+            "jobs.JobEnvironmentVariables": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "Custom metric definition.",
+                  "description": "A named environment-variable entry, defined once at the job level and\nreferenced by key from one or more tasks. Entries live on\n`JobSettings.environment_variables`, and tasks select one via\n`TaskSettings.environment_variables_key`.",
                   "properties": {
-                    "definition": {
-                      "description": "Jinja template for a SQL expression that specifies how to compute the metric. See [create metric definition](https://docs.databricks.com/en/lakehouse-monitoring/custom-metrics.html#create-definition).",
-                      "$ref": "#/$defs/string"
-                    },
-                    "input_columns": {
-                      "description": "A list of column names in the input table the metric should be computed for.\nCan use ``\":table\"`` to indicate that the metric needs information from multiple columns.",
-                      "$ref": "#/$defs/slice/string"
-                    },
-                    "name": {
-                      "description": "Name of the metric in the output tables.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "output_data_type": {
-                      "description": "The output type of the custom metric.",
-                      "$ref": "#/$defs/string"
+                    "environment_variables_key": {
+                      "description": "[Beta] Identifier for this entry. Must be unique within\n`JobSettings.environment_variables`. Tasks reference it from\n`TaskSettings.environment_variables_key`.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     },
-                    "type": {
-                      "description": "Can only be one of ``\"CUSTOM_METRIC_TYPE_AGGREGATE\"``, ``\"CUSTOM_METRIC_TYPE_DERIVED\"``, or ``\"CUSTOM_METRIC_TYPE_DRIFT\"``.\nThe ``\"CUSTOM_METRIC_TYPE_AGGREGATE\"`` and ``\"CUSTOM_METRIC_TYPE_DERIVED\"`` metrics\nare computed on a single table, whereas the ``\"CUSTOM_METRIC_TYPE_DRIFT\"`` compare metrics across\nbaseline and input table, or across the two consecutive time windows.\n- CUSTOM_METRIC_TYPE_AGGREGATE: only depend on the existing columns in your table\n- CUSTOM_METRIC_TYPE_DERIVED: depend on previously computed aggregate metrics\n- CUSTOM_METRIC_TYPE_DRIFT:  depend on previously computed aggregate or derived metrics",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.MonitorMetricType"
+                    "spec": {
+                      "description": "[Beta] The environment variable specification.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobEnvironmentVariablesSpec",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "definition",
-                    "input_columns",
-                    "name",
-                    "output_data_type",
-                    "type"
-                  ]
-                },
-                {
-                  "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
-                }
-              ]
-            },
-            "catalog.MonitorMetricType": {
-              "oneOf": [
-                {
-                  "type": "string",
-                  "description": "Can only be one of ``\\\"CUSTOM_METRIC_TYPE_AGGREGATE\\\"``, ``\\\"CUSTOM_METRIC_TYPE_DERIVED\\\"``, or ``\\\"CUSTOM_METRIC_TYPE_DRIFT\\\"``.\nThe ``\\\"CUSTOM_METRIC_TYPE_AGGREGATE\\\"`` and ``\\\"CUSTOM_METRIC_TYPE_DERIVED\\\"`` metrics\nare computed on a single table, whereas the ``\\\"CUSTOM_METRIC_TYPE_DRIFT\\\"`` compare metrics across\nbaseline and input table, or across the two consecutive time windows.\n- CUSTOM_METRIC_TYPE_AGGREGATE: only depend on the existing columns in your table\n- CUSTOM_METRIC_TYPE_DERIVED: depend on previously computed aggregate metrics\n- CUSTOM_METRIC_TYPE_DRIFT:  depend on previously computed aggregate or derived metrics",
-                  "enum": [
-                    "CUSTOM_METRIC_TYPE_AGGREGATE",
-                    "CUSTOM_METRIC_TYPE_DERIVED",
-                    "CUSTOM_METRIC_TYPE_DRIFT"
+                    "environment_variables_key"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "catalog.MonitorNotifications": {
+            "jobs.JobEnvironmentVariablesSpec": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "The environment variables and files associated with a job environment\nvariable entry. Runtime environment variables override inline `variables`,\nwhich override values from `files`, on duplicate keys.",
                   "properties": {
-                    "on_failure": {
-                      "description": "Destinations to send notifications on failure/timeout.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.MonitorDestination"
+                    "files": {
+                      "description": "[Beta] Workspace (`/Workspace/...`) or UC Volumes (`/Volumes/...`) paths to\n`.env` files. Maximum 5 files. Files are read, parsed, and merged at\ntask execution time, not at job creation or update API call time.\n\nFile format: each line containing a variable must be exactly `KEY=VALUE`.\nEmpty and whitespace-only lines, and lines beginning with `#`, are ignored.\nKeys must match the same regex as inlined variable names\n(`^[A-Za-z_][A-Za-z0-9_]*$`); the value continues to the end of the line.\nNo other syntax is supported — no inline comments, no quoted values, no\nescape sequences, no variable interpolation. Any other line that does not\nmatch the `KEY=VALUE` shape fails the run.\n\nSize limits: maximum 32,768 bytes (32 KiB) per file on disk;\nmaximum 1,024 bytes (1 KiB) per `KEY=VALUE` line combined.\nFiles or lines exceeding these limits fail the run.\n\nOn a duplicate key, the later file wins; `variables` override values\nfrom any file.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     },
-                    "on_new_classification_tag_detected": {
-                      "description": "Destinations to send notifications on new classification tag detected.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.MonitorDestination",
-                      "x-databricks-preview": "PRIVATE",
-                      "doNotSuggest": true
+                    "variables": {
+                      "description": "[Beta] Environment variables specified directly as key/value pairs. Maximum 20\nentries.\n\nEach key must be 1 to 256 characters and match\n`^[A-Za-z_][A-Za-z0-9_]*$`: it must start with an ASCII letter or\nunderscore and contain only ASCII letters, digits, and underscores. Each\nvalue can be any Unicode string of up to 512 characters, including an\nempty string.",
+                      "$ref": "#/$defs/map/string",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "catalog.MonitorSnapshot": {
+            "jobs.JobNotificationSettings": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "Snapshot analysis configuration",
+                  "properties": {
+                    "no_alert_for_canceled_runs": {
+                      "description": "If true, do not send notifications to recipients specified in `on_failure` if the run is canceled.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "no_alert_for_skipped_runs": {
+                      "description": "If true, do not send notifications to recipients specified in `on_failure` if the run is skipped.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "catalog.MonitorTimeSeries": {
+            "jobs.JobParameterDefinition": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "Time series analysis configuration.",
                   "properties": {
-                    "granularities": {
-                      "description": "Granularities for aggregating data into time windows based on their timestamp. Valid values are 5 minutes, 30 minutes, 1 hour, 1 day, n weeks, 1 month, or 1 year.",
-                      "$ref": "#/$defs/slice/string"
+                    "default": {
+                      "description": "Default value of the parameter.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "timestamp_col": {
-                      "description": "Column for the timestamp.",
-                      "$ref": "#/$defs/string"
+                    "name": {
+                      "description": "The name of the defined parameter. May only contain alphanumeric characters, `_`, `-`, and `.`",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "granularities",
-                    "timestamp_col"
+                    "default",
+                    "name"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "catalog.Privilege": {
+            "jobs.JobPermissionLevel": {
               "oneOf": [
                 {
                   "type": "string",
+                  "description": "Permission level",
                   "enum": [
-                    "SELECT",
-                    "READ_PRIVATE_FILES",
-                    "WRITE_PRIVATE_FILES",
-                    "CREATE",
-                    "USAGE",
-                    "USE_CATALOG",
-                    "USE_SCHEMA",
-                    "CREATE_SCHEMA",
-                    "CREATE_VIEW",
-                    "CREATE_EXTERNAL_TABLE",
-                    "CREATE_MATERIALIZED_VIEW",
-                    "CREATE_FUNCTION",
-                    "CREATE_MODEL",
-                    "CREATE_CATALOG",
-                    "CREATE_MANAGED_STORAGE",
-                    "CREATE_EXTERNAL_LOCATION",
-                    "CREATE_STORAGE_CREDENTIAL",
-                    "CREATE_SERVICE_CREDENTIAL",
-                    "ACCESS",
-                    "CREATE_SHARE",
-                    "CREATE_RECIPIENT",
-                    "CREATE_PROVIDER",
-                    "USE_SHARE",
-                    "USE_RECIPIENT",
-                    "USE_PROVIDER",
-                    "USE_MARKETPLACE_ASSETS",
-                    "SET_SHARE_PERMISSION",
-                    "MODIFY",
-                    "REFRESH",
-                    "EXECUTE",
-                    "READ_FILES",
-                    "WRITE_FILES",
-                    "CREATE_TABLE",
-                    "ALL_PRIVILEGES",
-                    "CREATE_CONNECTION",
-                    "USE_CONNECTION",
-                    "APPLY_TAG",
-                    "CREATE_FOREIGN_CATALOG",
-                    "CREATE_FOREIGN_SECURABLE",
-                    "MANAGE_ALLOWLIST",
-                    "CREATE_VOLUME",
-                    "CREATE_EXTERNAL_VOLUME",
-                    "READ_VOLUME",
-                    "WRITE_VOLUME",
-                    "MANAGE",
-                    "BROWSE",
-                    "CREATE_CLEAN_ROOM",
-                    "MODIFY_CLEAN_ROOM",
-                    "EXECUTE_CLEAN_ROOM_TASK",
-                    "EXTERNAL_USE_SCHEMA"
+                    "CAN_MANAGE",
+                    "IS_OWNER",
+                    "CAN_MANAGE_RUN",
+                    "CAN_VIEW"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "catalog.PrivilegeAssignment": {
+            "jobs.JobRunAs": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Write-only setting. Specifies the user, service principal, or group that the job runs as. If not specified, the job runs as the user who created the job.\n\nOne of `user_name`, `service_principal_name`, or `group_name` should be specified. If not, an error is thrown.",
                   "properties": {
-                    "principal": {
-                      "description": "The principal (user email address or group name).\nFor deleted principals, `principal` is empty while `principal_id` is populated.",
-                      "$ref": "#/$defs/string"
+                    "group_name": {
+                      "description": "Group name of an account group assigned to the workspace. When set, all tasks run as the group and the group's permissions are used for data access. Setting this field requires being a member of the group, or having the `Assume` permission on the group.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "privileges": {
-                      "description": "The privileges assigned to the principal.",
-                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/catalog.Privilege"
+                    "service_principal_name": {
+                      "description": "The application ID of an active service principal. Setting this field requires the `servicePrincipal/user` role.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "user_name": {
+                      "description": "The email of an active workspace user. Non-admin users can only set this field to their own email.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "catalog.RegisteredModelAlias": {
+            "jobs.JobSource": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "The source of the job specification in the remote repository when the job is source controlled.",
                   "properties": {
-                    "alias_name": {
-                      "description": "Name of the alias, e.g. 'champion' or 'latest_stable'",
-                      "$ref": "#/$defs/string"
-                    },
-                    "catalog_name": {
-                      "$ref": "#/$defs/string"
-                    },
-                    "id": {
-                      "$ref": "#/$defs/string"
-                    },
-                    "model_name": {
-                      "$ref": "#/$defs/string"
+                    "dirty_state": {
+                      "description": "[Private Preview] Dirty state indicates the job is not fully synced with the job specification in the remote repository.\n\nPossible values are:\n* `NOT_SYNCED`: The job is not yet synced with the remote job specification. Import the remote job specification from UI to make the job fully synced.\n* `DISCONNECTED`: The job is temporary disconnected from the remote job specification and is allowed for live edit. Import the remote job specification again from UI to make the job fully synced.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobSourceDirtyState",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "schema_name": {
-                      "$ref": "#/$defs/string"
+                    "import_from_git_branch": {
+                      "description": "[Private Preview] Name of the branch which the job is imported from.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "version_num": {
-                      "description": "Integer version number of the model version to which this alias points.",
-                      "$ref": "#/$defs/int"
+                    "job_config_path": {
+                      "description": "[Private Preview] Path of the job YAML file that contains the job specification.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
-                  "additionalProperties": false
+                  "additionalProperties": false,
+                  "required": [
+                    "import_from_git_branch",
+                    "job_config_path"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "catalog.SseEncryptionDetails": {
+            "jobs.JobSourceDirtyState": {
               "oneOf": [
                 {
-                  "type": "object",
-                  "description": "Server-Side Encryption properties for clients communicating with AWS s3.",
-                  "properties": {
-                    "algorithm": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.SseEncryptionDetailsAlgorithm"
-                    },
-                    "aws_kms_key_arn": {
-                      "$ref": "#/$defs/string"
-                    }
-                  },
-                  "additionalProperties": false
+                  "type": "string",
+                  "description": "Dirty state indicates the job is not fully synced with the job specification\nin the remote repository.\n\nPossible values are:\n* `NOT_SYNCED`: The job is not yet synced with the remote job specification. Import the remote job specification from UI to make the job fully synced.\n* `DISCONNECTED`: The job is temporary disconnected from the remote job specification and is allowed for live edit. Import the remote job specification again from UI to make the job fully synced.",
+                  "enum": [
+                    "NOT_SYNCED",
+                    "DISCONNECTED"
+                  ],
+                  "enumDescriptions": [
+                    "[Private Preview] The job is not yet synced with the remote job specification. Import the remote job specification from UI to make the job fully synced.",
+                    "[Private Preview] The job is temporary disconnected from the remote job specification and is allowed for live edit. Import the remote job specification again from UI to make the job fully synced."
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "catalog.SseEncryptionDetailsAlgorithm": {
+            "jobs.JobsHealthMetric": {
               "oneOf": [
                 {
                   "type": "string",
-                  "description": "SSE algorithm to use for encrypting S3 objects",
+                  "description": "Specifies the health metric that is being evaluated for a particular health rule.\n\n* `RUN_DURATION_SECONDS`: Expected total time for a run in seconds.\n* `STREAMING_BACKLOG_BYTES`: An estimate of the maximum bytes of data waiting to be consumed across all streams. This metric is in Public Preview.\n* `STREAMING_BACKLOG_RECORDS`: An estimate of the maximum offset lag across all streams. This metric is in Public Preview.\n* `STREAMING_BACKLOG_SECONDS`: An estimate of the maximum consumer delay across all streams. This metric is in Public Preview.\n* `STREAMING_BACKLOG_FILES`: An estimate of the maximum number of outstanding files across all streams. This metric is in Public Preview.",
                   "enum": [
-                    "AWS_SSE_S3",
-                    "AWS_SSE_KMS",
-                    "AWS_SSE_KMS",
-                    "AWS_SSE_S3"
+                    "RUN_DURATION_SECONDS",
+                    "STREAMING_BACKLOG_BYTES",
+                    "STREAMING_BACKLOG_RECORDS",
+                    "STREAMING_BACKLOG_SECONDS",
+                    "STREAMING_BACKLOG_FILES"
+                  ],
+                  "enumDescriptions": [
+                    "Expected total time for a run in seconds.",
+                    "An estimate of the maximum bytes of data waiting to be consumed across all streams. This metric is in Public Preview.",
+                    "An estimate of the maximum offset lag across all streams. This metric is in Public Preview.",
+                    "An estimate of the maximum consumer delay across all streams. This metric is in Public Preview.",
+                    "An estimate of the maximum number of outstanding files across all streams. This metric is in Public Preview."
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "catalog.VolumeType": {
+            "jobs.JobsHealthOperator": {
               "oneOf": [
                 {
                   "type": "string",
+                  "description": "Specifies the operator used to compare the health metric value with the specified threshold.",
                   "enum": [
-                    "MANAGED",
-                    "EXTERNAL"
+                    "GREATER_THAN"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "compute.Adlsgen2Info": {
+            "jobs.JobsHealthRule": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "A storage location in Adls Gen2",
                   "properties": {
-                    "destination": {
-                      "description": "abfss destination, e.g. `abfss://\u003ccontainer-name\u003e@\u003cstorage-account-name\u003e.dfs.core.windows.net/\u003cdirectory-name\u003e`.",
-                      "$ref": "#/$defs/string"
+                    "metric": {
+                      "description": "Specifies the health metric that is being evaluated for a particular health rule.\n\n* `RUN_DURATION_SECONDS`: Expected total time for a run in seconds.\n* `STREAMING_BACKLOG_BYTES`: An estimate of the maximum bytes of data waiting to be consumed across all streams. This metric is in Public Preview.\n* `STREAMING_BACKLOG_RECORDS`: An estimate of the maximum offset lag across all streams. This metric is in Public Preview.\n* `STREAMING_BACKLOG_SECONDS`: An estimate of the maximum consumer delay across all streams. This metric is in Public Preview.\n* `STREAMING_BACKLOG_FILES`: An estimate of the maximum number of outstanding files across all streams. This metric is in Public Preview.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobsHealthMetric",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "op": {
+                      "description": "Specifies the operator used to compare the health metric value with the specified threshold.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobsHealthOperator",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "value": {
+                      "description": "Specifies the threshold value that the health metric should obey to satisfy the health rule.",
+                      "$ref": "#/$defs/int64",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "destination"
+                    "metric",
+                    "op",
+                    "value"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "compute.AutoScale": {
+            "jobs.JobsHealthRules": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "An optional set of health rules that can be defined for this job.",
                   "properties": {
-                    "max_workers": {
-                      "description": "The maximum number of workers to which the cluster can scale up when overloaded.\nNote that `max_workers` must be strictly greater than `min_workers`.",
-                      "$ref": "#/$defs/int"
-                    },
-                    "min_workers": {
-                      "description": "The minimum number of workers to which the cluster can scale down when underutilized.\nIt is also the initial number of workers the cluster will have after creation.",
-                      "$ref": "#/$defs/int"
+                    "rules": {
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.JobsHealthRule",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "compute.AwsAttributes": {
+            "jobs.MaintenanceWindow": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "Attributes set during cluster creation which are related to Amazon Web Services.",
+                  "description": "A recurring weekly time window during which platform-initiated maintenance is\nallowed to run for a continuous job.",
                   "properties": {
-                    "availability": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.AwsAvailability"
-                    },
-                    "ebs_volume_count": {
-                      "description": "The number of volumes launched for each instance. Users can choose up to 10 volumes.\nThis feature is only enabled for supported node types. Legacy node types cannot specify\ncustom EBS volumes.\nFor node types with no instance store, at least one EBS volume needs to be specified;\notherwise, cluster creation will fail.\n\nThese EBS volumes will be mounted at `/ebs0`, `/ebs1`, and etc.\nInstance store volumes will be mounted at `/local_disk0`, `/local_disk1`, and etc.\n\nIf EBS volumes are attached, Databricks will configure Spark to use only the EBS volumes for\nscratch storage because heterogenously sized scratch devices can lead to inefficient disk\nutilization. If no EBS volumes are attached, Databricks will configure Spark to use instance\nstore volumes.\n\nPlease note that if EBS volumes are specified, then the Spark configuration `spark.local.dir`\nwill be overridden.",
-                      "$ref": "#/$defs/int"
-                    },
-                    "ebs_volume_iops": {
-                      "description": "If using gp3 volumes, what IOPS to use for the disk. If this is not set, the maximum performance of a gp2 volume with the same volume size will be used.",
-                      "$ref": "#/$defs/int"
-                    },
-                    "ebs_volume_size": {
-                      "description": "The size of each EBS volume (in GiB) launched for each instance. For general purpose\nSSD, this value must be within the range 100 - 4096. For throughput optimized HDD,\nthis value must be within the range 500 - 4096.",
-                      "$ref": "#/$defs/int"
+                    "day_of_week": {
+                      "description": "The day of week on which maintenance is allowed to happen. This field is required.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.DayOfWeek",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "ebs_volume_throughput": {
-                      "description": "If using gp3 volumes, what throughput to use for the disk. If this is not set, the maximum performance of a gp2 volume with the same volume size will be used.",
-                      "$ref": "#/$defs/int"
+                    "start_hour": {
+                      "description": "An integer between 0 and 23 denoting the start hour for the maintenance window in the 24-hour day.\nPlatform-initiated maintenance is triggered only within a one-hour window starting at this hour.\nThis field is required.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "ebs_volume_type": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.EbsVolumeType"
+                    "timezone_id": {
+                      "description": "A Java timezone ID. The maintenance window is resolved with respect to this timezone. See [Java TimeZone](https://docs.oracle.com/javase/7/docs/api/java/util/TimeZone.html) for details. This field is required.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "day_of_week",
+                    "start_hour",
+                    "timezone_id"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "jobs.ModelTriggerConfiguration": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "aliases": {
+                      "description": "[Private Preview] Aliases of the model versions to monitor. Can only be used in conjunction with condition MODEL_ALIAS_SET.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "first_on_demand": {
-                      "description": "The first `first_on_demand` nodes of the cluster will be placed on on-demand instances.\nIf this value is greater than 0, the cluster driver node in particular will be placed on an\non-demand instance. If this value is greater than or equal to the current cluster size, all\nnodes will be placed on on-demand instances. If this value is less than the current cluster\nsize, `first_on_demand` nodes will be placed on on-demand instances and the remainder will\nbe placed on `availability` instances. Note that this value does not affect\ncluster size and cannot currently be mutated over the lifetime of a cluster.",
-                      "$ref": "#/$defs/int"
+                    "condition": {
+                      "description": "[Private Preview] The condition based on which to trigger a job run.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.ModelTriggerConfigurationCondition",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "instance_profile_arn": {
-                      "description": "Nodes for this cluster will only be placed on AWS instances with this instance profile. If\nommitted, nodes will be placed on instances without an IAM instance profile. The instance\nprofile must have previously been added to the Databricks environment by an account\nadministrator.\n\nThis feature may only be available to certain customer plans.",
-                      "$ref": "#/$defs/string"
+                    "min_time_between_triggers_seconds": {
+                      "description": "[Private Preview] If set, the trigger starts a run only after the specified amount of time has passed since\nthe last time the trigger fired. The minimum allowed value is 60 seconds.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "spot_bid_price_percent": {
-                      "description": "The bid price for AWS spot instances, as a percentage of the corresponding instance type's\non-demand price.\nFor example, if this field is set to 50, and the cluster needs a new `r3.xlarge` spot\ninstance, then the bid price is half of the price of\non-demand `r3.xlarge` instances. Similarly, if this field is set to 200, the bid price is twice\nthe price of on-demand `r3.xlarge` instances. If not specified, the default value is 100.\nWhen spot instances are requested for this cluster, only spot instances whose bid price\npercentage matches this field will be considered.\nNote that, for safety, we enforce this field to be no more than 10000.",
-                      "$ref": "#/$defs/int"
+                    "securable_name": {
+                      "description": "[Private Preview] Name of the securable to monitor (\"mycatalog.myschema.mymodel\" in the case of model-level triggers,\n\"mycatalog.myschema\" in the case of schema-level triggers) or empty in the case of metastore-level triggers.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "zone_id": {
-                      "description": "Identifier for the availability zone/datacenter in which the cluster resides.\nThis string will be of a form like \"us-west-2a\". The provided availability\nzone must be in the same region as the Databricks deployment. For example, \"us-west-2a\"\nis not a valid zone id if the Databricks deployment resides in the \"us-east-1\" region.\nThis is an optional field at cluster creation, and if not specified, the zone \"auto\" will be used.\nIf the zone specified is \"auto\", will try to place cluster in a zone with high availability,\nand will retry placement in a different AZ if there is not enough capacity.\n\nThe list of available zones as well as the default value can be found by using the\n`List Zones` method.",
-                      "$ref": "#/$defs/string"
+                    "wait_after_last_change_seconds": {
+                      "description": "[Private Preview] If set, the trigger starts a run only after no model updates have occurred for the specified time\nand can be used to wait for a series of model updates before triggering a run. The\nminimum allowed value is 60 seconds.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
-                  "additionalProperties": false
+                  "additionalProperties": false,
+                  "required": [
+                    "condition"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "compute.AwsAvailability": {
+            "jobs.ModelTriggerConfigurationCondition": {
               "oneOf": [
                 {
                   "type": "string",
-                  "description": "Availability type used for all subsequent nodes past the `first_on_demand` ones.\n\nNote: If `first_on_demand` is zero, this availability type will be used for the entire cluster.",
                   "enum": [
-                    "SPOT",
-                    "ON_DEMAND",
-                    "SPOT_WITH_FALLBACK"
+                    "MODEL_CREATED",
+                    "MODEL_VERSION_READY",
+                    "MODEL_ALIAS_SET"
+                  ],
+                  "enumDescriptions": [
+                    "[Private Preview]",
+                    "[Private Preview]",
+                    "[Private Preview]"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "compute.AzureAttributes": {
+            "jobs.NotebookTask": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "Attributes set during cluster creation which are related to Microsoft Azure.",
                   "properties": {
-                    "availability": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.AzureAvailability"
+                    "base_parameters": {
+                      "description": "Base parameters to be used for each run of this job. If the run is initiated by a call to :method:jobs/run\nNow with parameters specified, the two parameters maps are merged. If the same key is specified in\n`base_parameters` and in `run-now`, the value from `run-now` is used.\nUse [Task parameter variables](https://docs.databricks.com/jobs.html#parameter-variables) to set parameters containing information about job runs.\n\nIf the notebook takes a parameter that is not specified in the job’s `base_parameters` or the `run-now` override parameters,\nthe default value from the notebook is used.\n\nRetrieve these parameters in a notebook using [dbutils.widgets.get](https://docs.databricks.com/dev-tools/databricks-utils.html#dbutils-widgets).\n\nThe JSON representation of this field cannot exceed 1MB.",
+                      "$ref": "#/$defs/map/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "first_on_demand": {
-                      "description": "The first `first_on_demand` nodes of the cluster will be placed on on-demand instances.\nThis value should be greater than 0, to make sure the cluster driver node is placed on an\non-demand instance. If this value is greater than or equal to the current cluster size, all\nnodes will be placed on on-demand instances. If this value is less than the current cluster\nsize, `first_on_demand` nodes will be placed on on-demand instances and the remainder will\nbe placed on `availability` instances. Note that this value does not affect\ncluster size and cannot currently be mutated over the lifetime of a cluster.",
-                      "$ref": "#/$defs/int"
+                    "notebook_path": {
+                      "description": "The path of the notebook to be run in the Databricks workspace or remote repository.\nFor notebooks stored in the Databricks workspace, the path must be absolute and begin with a slash.\nFor notebooks stored in a remote repository, the path must be relative. This field is required.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "log_analytics_info": {
-                      "description": "Defines values necessary to configure and run Azure Log Analytics agent",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.LogAnalyticsInfo"
+                    "source": {
+                      "description": "Optional location type of the notebook. When set to `WORKSPACE`, the notebook will be retrieved from the local Databricks workspace. When set to `GIT`, the notebook will be retrieved from a Git repository\ndefined in `git_source`. If the value is empty, the task will use `GIT` if `git_source` is defined and `WORKSPACE` otherwise.\n* `WORKSPACE`: Notebook is located in Databricks workspace.\n* `GIT`: Notebook is located in cloud Git provider.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.Source",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "spot_bid_max_price": {
-                      "description": "The max bid price to be used for Azure spot instances.\nThe Max price for the bid cannot be higher than the on-demand price of the instance.\nIf not specified, the default value is -1, which specifies that the instance cannot be evicted\non the basis of price, and only on the basis of availability. Further, the value should \u003e 0 or -1.",
-                      "$ref": "#/$defs/float64"
+                    "warehouse_id": {
+                      "description": "Optional `warehouse_id` to run the notebook on a SQL warehouse. Classic SQL warehouses are NOT supported, please use serverless or pro SQL warehouses.\n\nNote that SQL warehouses only support SQL cells; if the notebook contains non-SQL cells, the run will fail.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
-                  "additionalProperties": false
+                  "additionalProperties": false,
+                  "required": [
+                    "notebook_path"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "compute.AzureAvailability": {
+            "jobs.PauseStatus": {
               "oneOf": [
                 {
                   "type": "string",
-                  "description": "Availability type used for all subsequent nodes past the `first_on_demand` ones.\nNote: If `first_on_demand` is zero, this availability type will be used for the entire cluster.",
                   "enum": [
-                    "SPOT_AZURE",
-                    "ON_DEMAND_AZURE",
-                    "SPOT_WITH_FALLBACK_AZURE"
+                    "UNPAUSED",
+                    "PAUSED"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "compute.ClientsTypes": {
+            "jobs.PerformanceTarget": {
               "oneOf": [
                 {
-                  "type": "object",
-                  "properties": {
-                    "jobs": {
-                      "description": "With jobs set, the cluster can be used for jobs",
-                      "$ref": "#/$defs/bool"
-                    },
-                    "notebooks": {
-                      "description": "With notebooks set, this cluster can be used for notebooks",
-                      "$ref": "#/$defs/bool"
-                    }
-                  },
-                  "additionalProperties": false
+                  "type": "string",
+                  "description": "PerformanceTarget defines how performant (lower latency) or cost efficient the execution of run on serverless compute should be.\nThe performance mode on the job or pipeline should map to a performance setting that is passed to Cluster Manager\n(see cluster-common PerformanceTarget).",
+                  "enum": [
+                    "PERFORMANCE_OPTIMIZED",
+                    "STANDARD"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "compute.ClusterLogConf": {
+            "jobs.PeriodicTriggerConfiguration": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "Cluster log delivery config",
                   "properties": {
-                    "dbfs": {
-                      "description": "destination needs to be provided. e.g.\n`{ \"dbfs\" : { \"destination\" : \"dbfs:/home/cluster_log\" } }`",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.DbfsStorageInfo"
-                    },
-                    "s3": {
-                      "description": "destination and either the region or endpoint need to be provided. e.g.\n`{ \"s3\": { \"destination\" : \"s3://cluster_log_bucket/prefix\", \"region\" : \"us-west-2\" } }`\nCluster iam role is used to access s3, please make sure the cluster iam role in\n`instance_profile_arn` has permission to write data to the s3 destination.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.S3StorageInfo"
+                    "interval": {
+                      "description": "The interval at which the trigger should run.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "volumes": {
-                      "description": "destination needs to be provided, e.g.\n`{ \"volumes\": { \"destination\": \"/Volumes/catalog/schema/volume/cluster_log\" } }`",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.VolumesStorageInfo"
+                    "unit": {
+                      "description": "The unit of time for the interval.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PeriodicTriggerConfigurationTimeUnit",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
-                  "additionalProperties": false
+                  "additionalProperties": false,
+                  "required": [
+                    "interval",
+                    "unit"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "compute.ClusterPermissionLevel": {
+            "jobs.PeriodicTriggerConfigurationTimeUnit": {
               "oneOf": [
                 {
                   "type": "string",
-                  "description": "Permission level",
                   "enum": [
-                    "CAN_MANAGE",
-                    "CAN_RESTART",
-                    "CAN_ATTACH_TO"
+                    "HOURS",
+                    "DAYS",
+                    "WEEKS",
+                    "MINUTES"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "compute.ClusterSpec": {
+            "jobs.PipelineParams": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "Contains a snapshot of the latest user specified settings that were used to create/edit the cluster.",
                   "properties": {
-                    "apply_policy_default_values": {
-                      "description": "When set to true, fixed and default values from the policy will be used for fields that are omitted. When set to false, only fixed values from the policy will be applied.",
-                      "$ref": "#/$defs/bool"
-                    },
-                    "autoscale": {
-                      "description": "Parameters needed in order to automatically scale clusters up and down based on load.\nNote: autoscaling works best with DB runtime versions 3.0 or later.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.AutoScale"
-                    },
-                    "autotermination_minutes": {
-                      "description": "Automatically terminates the cluster after it is inactive for this time in minutes. If not set,\nthis cluster will not be automatically terminated. If specified, the threshold must be between\n10 and 10000 minutes.\nUsers can also set this value to 0 to explicitly disable automatic termination.",
-                      "$ref": "#/$defs/int"
-                    },
-                    "aws_attributes": {
-                      "description": "Attributes related to clusters running on Amazon Web Services.\nIf not specified at cluster creation, a set of default values will be used.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.AwsAttributes"
-                    },
-                    "azure_attributes": {
-                      "description": "Attributes related to clusters running on Microsoft Azure.\nIf not specified at cluster creation, a set of default values will be used.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.AzureAttributes"
-                    },
-                    "cluster_log_conf": {
-                      "description": "The configuration for delivering spark logs to a long-term storage destination.\nThree kinds of destinations (DBFS, S3 and Unity Catalog volumes) are supported. Only one destination can be specified\nfor one cluster. If the conf is given, the logs will be delivered to the destination every\n`5 mins`. The destination of driver logs is `$destination/$clusterId/driver`, while\nthe destination of executor logs is `$destination/$clusterId/executor`.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.ClusterLogConf"
-                    },
-                    "cluster_name": {
-                      "description": "Cluster name requested by the user. This doesn't have to be unique.\nIf not specified at creation, the cluster name will be an empty string.\nFor job clusters, the cluster name is automatically set based on the job and job run IDs.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "custom_tags": {
-                      "description": "Additional tags for cluster resources. Databricks will tag all cluster resources (e.g., AWS\ninstances and EBS volumes) with these tags in addition to `default_tags`. Notes:\n\n- Currently, Databricks allows at most 45 custom tags\n\n- Clusters can only reuse cloud resources if the resources' tags are a subset of the cluster tags",
-                      "$ref": "#/$defs/map/string"
-                    },
-                    "data_security_mode": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.DataSecurityMode"
-                    },
-                    "docker_image": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.DockerImage"
-                    },
-                    "driver_instance_pool_id": {
-                      "description": "The optional ID of the instance pool for the driver of the cluster belongs.\nThe pool cluster uses the instance pool with id (instance_pool_id) if the driver pool is not\nassigned.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "driver_node_type_flexibility": {
-                      "description": "Flexible node type configuration for the driver node.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.NodeTypeFlexibility"
-                    },
-                    "driver_node_type_id": {
-                      "description": "The node type of the Spark driver.\nNote that this field is optional; if unset, the driver node type will be set as the same value\nas `node_type_id` defined above.\n\nThis field, along with node_type_id, should not be set if virtual_cluster_size is set.\nIf both driver_node_type_id, node_type_id, and virtual_cluster_size are specified, driver_node_type_id and node_type_id take precedence.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "enable_elastic_disk": {
-                      "description": "Autoscaling Local Storage: when enabled, this cluster will dynamically acquire additional disk\nspace when its Spark workers are running low on disk space.",
-                      "$ref": "#/$defs/bool"
+                    "full_refresh": {
+                      "description": "If true, triggers a full refresh on the spark declarative pipeline.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "enable_local_disk_encryption": {
-                      "description": "Whether to enable LUKS on cluster VMs' local disks",
-                      "$ref": "#/$defs/bool"
+                    "full_refresh_selection": {
+                      "description": "A list of tables to update with fullRefresh.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "gcp_attributes": {
-                      "description": "Attributes related to clusters running on Google Cloud Platform.\nIf not specified at cluster creation, a set of default values will be used.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.GcpAttributes"
+                    "refresh_flow_selection": {
+                      "description": "Flow names to selectively refresh. These are unioned with other selective refresh\noptions (refresh_selection, full_refresh_selection) to determine the final set of flows to refresh.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "init_scripts": {
-                      "description": "The configuration for storing init scripts. Any number of destinations can be specified.\nThe scripts are executed sequentially in the order provided.\nIf `cluster_log_conf` is specified, init script logs are sent to `\u003cdestination\u003e/\u003ccluster-ID\u003e/init_scripts`.",
-                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/compute.InitScriptInfo"
+                    "refresh_selection": {
+                      "description": "A list of tables to update without fullRefresh.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "instance_pool_id": {
-                      "description": "The optional ID of the instance pool to which the cluster belongs.",
-                      "$ref": "#/$defs/string"
+                    "reset_checkpoint_selection": {
+                      "description": "A list of streaming flows to reset checkpoints without clearing data.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "jobs.PipelineTask": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "full_refresh": {
+                      "description": "If true, triggers a full refresh on the spark declarative pipeline.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "is_single_node": {
-                      "description": "This field can only be used when `kind = CLASSIC_PREVIEW`.\n\nWhen set to true, Databricks will automatically set single node related `custom_tags`, `spark_conf`, and `num_workers`",
-                      "$ref": "#/$defs/bool"
+                    "full_refresh_selection": {
+                      "description": "A list of tables to update with fullRefresh.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "kind": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.Kind"
+                    "parameters": {
+                      "description": "[Beta] Key/value-map of parameters passed to the pipeline execution.\nLimited to 10k characters in total.",
+                      "$ref": "#/$defs/map/string",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     },
-                    "node_type_id": {
-                      "description": "This field encodes, through a single value, the resources available to each of\nthe Spark nodes in this cluster. For example, the Spark nodes can be provisioned\nand optimized for memory or compute intensive workloads. A list of available node\ntypes can be retrieved by using the :method:clusters/listNodeTypes API call.",
-                      "$ref": "#/$defs/string"
+                    "pipeline_id": {
+                      "description": "The full name of the pipeline task to execute.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "num_workers": {
-                      "description": "Number of worker nodes that this cluster should have. A cluster has one Spark Driver\nand `num_workers` Executors for a total of `num_workers` + 1 Spark nodes.\n\nNote: When reading the properties of a cluster, this field reflects the desired number\nof workers rather than the actual current number of workers. For instance, if a cluster\nis resized from 5 to 10 workers, this field will immediately be updated to reflect\nthe target size of 10 workers, whereas the workers listed in `spark_info` will gradually\nincrease from 5 to 10 as the new nodes are provisioned.",
-                      "$ref": "#/$defs/int"
+                    "refresh_flow_selection": {
+                      "description": "Flow names to selectively refresh. These are unioned with other selective refresh\noptions (refresh_selection, full_refresh_selection) to determine the final set of flows to refresh.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "policy_id": {
-                      "description": "The ID of the cluster policy used to create the cluster if applicable.",
-                      "$ref": "#/$defs/string"
+                    "refresh_selection": {
+                      "description": "A list of tables to update without fullRefresh.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "remote_disk_throughput": {
-                      "description": "If set, what the configurable throughput (in Mb/s) for the remote disk is. Currently only supported for GCP HYPERDISK_BALANCED disks.",
-                      "$ref": "#/$defs/int"
+                    "reset_checkpoint_selection": {
+                      "description": "A list of streaming flows to reset checkpoints without clearing data.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "pipeline_id"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "jobs.PowerBiModel": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "authentication_method": {
+                      "description": "[Public Preview] How the published Power BI model authenticates to Databricks",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.AuthenticationMethod",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "runtime_engine": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.RuntimeEngine"
+                    "model_name": {
+                      "description": "[Public Preview] The name of the Power BI model",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "single_user_name": {
-                      "description": "Single user name if data_security_mode is `SINGLE_USER`",
-                      "$ref": "#/$defs/string"
+                    "overwrite_existing": {
+                      "description": "[Public Preview] Whether to overwrite existing Power BI models",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "spark_conf": {
-                      "description": "An object containing a set of optional, user-specified Spark configuration key-value pairs.\nUsers can also pass in a string of extra JVM options to the driver and the executors via\n`spark.driver.extraJavaOptions` and `spark.executor.extraJavaOptions` respectively.",
-                      "$ref": "#/$defs/map/string"
+                    "storage_mode": {
+                      "description": "[Public Preview] The default storage mode of the Power BI model",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.StorageMode",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "spark_env_vars": {
-                      "description": "An object containing a set of optional, user-specified environment variable key-value pairs.\nPlease note that key-value pair of the form (X,Y) will be exported as is (i.e.,\n`export X='Y'`) while launching the driver and workers.\n\nIn order to specify an additional set of `SPARK_DAEMON_JAVA_OPTS`, we recommend appending\nthem to `$SPARK_DAEMON_JAVA_OPTS` as shown in the example below. This ensures that all\ndefault databricks managed environmental variables are included as well.\n\nExample Spark environment variables:\n`{\"SPARK_WORKER_MEMORY\": \"28000m\", \"SPARK_LOCAL_DIRS\": \"/local_disk0\"}` or\n`{\"SPARK_DAEMON_JAVA_OPTS\": \"$SPARK_DAEMON_JAVA_OPTS -Dspark.shuffle.service.enabled=true\"}`",
-                      "$ref": "#/$defs/map/string"
+                    "workspace_name": {
+                      "description": "[Public Preview] The name of the Power BI workspace of the model",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "jobs.PowerBiTable": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "catalog": {
+                      "description": "[Public Preview] The catalog name in Databricks",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "spark_version": {
-                      "description": "The Spark version of the cluster, e.g. `3.3.x-scala2.11`.\nA list of available Spark versions can be retrieved by using\nthe :method:clusters/sparkVersions API call.",
-                      "$ref": "#/$defs/string"
+                    "name": {
+                      "description": "[Public Preview] The table name in Databricks",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "ssh_public_keys": {
-                      "description": "SSH public key contents that will be added to each Spark node in this cluster. The\ncorresponding private keys can be used to login with the user name `ubuntu` on port `2200`.\nUp to 10 keys can be specified.",
-                      "$ref": "#/$defs/slice/string"
+                    "schema": {
+                      "description": "[Public Preview] The schema name in Databricks",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "total_initial_remote_disk_size": {
-                      "description": "If set, what the total initial volume size (in GB) of the remote disks should be. Currently only supported for GCP HYPERDISK_BALANCED disks.",
-                      "$ref": "#/$defs/int"
+                    "storage_mode": {
+                      "description": "[Public Preview] The Power BI storage mode of the table",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.StorageMode",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "jobs.PowerBiTask": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "connection_resource_name": {
+                      "description": "[Public Preview] The resource name of the UC connection to authenticate from Databricks to Power BI",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "use_ml_runtime": {
-                      "description": "This field can only be used when `kind = CLASSIC_PREVIEW`.\n\n`effective_spark_version` is determined by `spark_version` (DBR release), this field `use_ml_runtime`, and whether `node_type_id` is gpu node or not.",
-                      "$ref": "#/$defs/bool"
+                    "power_bi_model": {
+                      "description": "[Public Preview] The semantic model to update",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PowerBiModel",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "worker_node_type_flexibility": {
-                      "description": "Flexible node type configuration for worker nodes.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.NodeTypeFlexibility"
+                    "refresh_after_update": {
+                      "description": "[Public Preview] Whether the model should be refreshed after the update",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "workload_type": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.WorkloadType"
+                    "tables": {
+                      "description": "[Public Preview] The tables to be exported to Power BI",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.PowerBiTable",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "warehouse_id": {
+                      "description": "[Public Preview] The SQL warehouse ID to use as the Power BI data source",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "compute.DataSecurityMode": {
+            "jobs.PythonOperatorTask": {
               "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "main": {
+                      "description": "[Private Preview] Fully qualified name of the main class or function.\nFor example, `my_project.my_function` or `my_project.MyOperator`.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "parameters": {
+                      "description": "[Private Preview] An ordered list of task parameters.\nTODO(JOBS-30885): Add limits for parameters.",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.PythonOperatorTaskParameter",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    }
+                  },
+                  "additionalProperties": false
+                },
                 {
                   "type": "string",
-                  "description": "Data security mode decides what data governance model to use when accessing data\nfrom a cluster.\n\nThe following modes can only be used when `kind = CLASSIC_PREVIEW`.\n* `DATA_SECURITY_MODE_AUTO`: Databricks will choose the most appropriate access mode depending on your compute configuration.\n* `DATA_SECURITY_MODE_STANDARD`: Alias for `USER_ISOLATION`.\n* `DATA_SECURITY_MODE_DEDICATED`: Alias for `SINGLE_USER`.\n\nThe following modes can be used regardless of `kind`.\n* `NONE`: No security isolation for multiple users sharing the cluster. Data governance features are not available in this mode.\n* `SINGLE_USER`: A secure cluster that can only be exclusively used by a single user specified in `single_user_name`. Most programming languages, cluster features and data governance features are available in this mode.\n* `USER_ISOLATION`: A secure cluster that can be shared by multiple users. Cluster users are fully isolated so that they cannot see each other's data and credentials. Most data governance features are supported in this mode. But programming languages and cluster features might be limited.\n\nThe following modes are deprecated starting with Databricks Runtime 15.0 and\nwill be removed for future Databricks Runtime versions:\n\n* `LEGACY_TABLE_ACL`: This mode is for users migrating from legacy Table ACL clusters.\n* `LEGACY_PASSTHROUGH`: This mode is for users migrating from legacy Passthrough on high concurrency clusters.\n* `LEGACY_SINGLE_USER`: This mode is for users migrating from legacy Passthrough on standard clusters.\n* `LEGACY_SINGLE_USER_STANDARD`: This mode provides a way that doesn’t have UC nor passthrough enabled.",
-                  "enum": [
-                    "NONE",
-                    "SINGLE_USER",
-                    "USER_ISOLATION",
-                    "LEGACY_TABLE_ACL",
-                    "LEGACY_PASSTHROUGH",
-                    "LEGACY_SINGLE_USER",
-                    "LEGACY_SINGLE_USER_STANDARD",
-                    "DATA_SECURITY_MODE_STANDARD",
-                    "DATA_SECURITY_MODE_DEDICATED",
-                    "DATA_SECURITY_MODE_AUTO"
-                  ]
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "jobs.PythonOperatorTaskParameter": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "description": "[Private Preview]",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "value": {
+                      "description": "[Private Preview]",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    }
+                  },
+                  "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "compute.DbfsStorageInfo": {
+            "jobs.PythonWheelTask": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "A storage location in DBFS",
                   "properties": {
-                    "destination": {
-                      "description": "dbfs destination, e.g. `dbfs:/my/path`",
-                      "$ref": "#/$defs/string"
+                    "entry_point": {
+                      "description": "Named entry point to use, if it does not exist in the metadata of the package it executes the function from the package directly using `$packageName.$entryPoint()`",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "named_parameters": {
+                      "description": "Command-line parameters passed to Python wheel task in the form of `[\"--name=task\", \"--data=dbfs:/path/to/data.json\"]`. Leave it empty if `parameters` is not null.",
+                      "$ref": "#/$defs/map/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "package_name": {
+                      "description": "Name of the package to execute",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "parameters": {
+                      "description": "Command-line parameters passed to Python wheel task. Leave it empty if `named_parameters` is not null.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "destination"
+                    "entry_point",
+                    "package_name"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "compute.DockerBasicAuth": {
+            "jobs.QueueSettings": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "password": {
-                      "description": "Password of the user",
-                      "$ref": "#/$defs/string"
-                    },
-                    "username": {
-                      "description": "Name of the user",
-                      "$ref": "#/$defs/string"
+                    "enabled": {
+                      "description": "If true, enable queueing for the job. This is a required field.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
-                  "additionalProperties": false
+                  "additionalProperties": false,
+                  "required": [
+                    "enabled"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "compute.DockerImage": {
+            "jobs.RunIf": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "description": "An optional value indicating the condition that determines whether the task should be run once its dependencies have been completed. When omitted, defaults to `ALL_SUCCESS`.\n\nPossible values are:\n* `ALL_SUCCESS`: All dependencies have executed and succeeded\n* `AT_LEAST_ONE_SUCCESS`: At least one dependency has succeeded\n* `NONE_FAILED`: None of the dependencies have failed and at least one was executed\n* `ALL_DONE`: All dependencies have been completed\n* `AT_LEAST_ONE_FAILED`: At least one dependency failed\n* `ALL_FAILED`: ALl dependencies have failed",
+                  "enum": [
+                    "ALL_SUCCESS",
+                    "ALL_DONE",
+                    "NONE_FAILED",
+                    "AT_LEAST_ONE_SUCCESS",
+                    "ALL_FAILED",
+                    "AT_LEAST_ONE_FAILED"
+                  ],
+                  "enumDescriptions": [
+                    "All dependencies have executed and succeeded",
+                    "All dependencies have been completed",
+                    "None of the dependencies have failed and at least one was executed",
+                    "At least one dependency has succeeded",
+                    "ALl dependencies have failed",
+                    "At least one dependency failed"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "jobs.RunJobTask": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "basic_auth": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.DockerBasicAuth"
+                    "dbt_commands": {
+                      "description": "[Private Preview] An array of commands to execute for jobs with the dbt task, for example `\"dbt_commands\": [\"dbt deps\", \"dbt seed\", \"dbt deps\", \"dbt seed\", \"dbt run\"]`\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "deprecationMessage": "This field is deprecated",
+                      "doNotSuggest": true,
+                      "deprecated": true
                     },
-                    "url": {
-                      "description": "URL of the docker image.",
-                      "$ref": "#/$defs/string"
+                    "jar_params": {
+                      "description": "[Private Preview] A list of parameters for jobs with Spark JAR tasks, for example `\"jar_params\": [\"john doe\", \"35\"]`.\nThe parameters are used to invoke the main function of the main class specified in the Spark JAR task.\nIf not specified upon `run-now`, it defaults to an empty list.\njar_params cannot be specified in conjunction with notebook_params.\nThe JSON representation of this field (for example `{\"jar_params\":[\"john doe\",\"35\"]}`) cannot exceed 10,000 bytes.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "deprecationMessage": "This field is deprecated",
+                      "doNotSuggest": true,
+                      "deprecated": true
+                    },
+                    "job_id": {
+                      "description": "ID of the job to trigger.",
+                      "$ref": "#/$defs/int64",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "job_parameters": {
+                      "description": "Job-level parameters used to trigger the job.",
+                      "$ref": "#/$defs/map/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "notebook_params": {
+                      "description": "[Private Preview] A map from keys to values for jobs with notebook task, for example `\"notebook_params\": {\"name\": \"john doe\", \"age\": \"35\"}`.\nThe map is passed to the notebook and is accessible through the [dbutils.widgets.get](https://docs.databricks.com/dev-tools/databricks-utils.html) function.\n\nIf not specified upon `run-now`, the triggered run uses the job’s base parameters.\n\nnotebook_params cannot be specified in conjunction with jar_params.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.\n\nThe JSON representation of this field (for example `{\"notebook_params\":{\"name\":\"john doe\",\"age\":\"35\"}}`) cannot exceed 10,000 bytes.",
+                      "$ref": "#/$defs/map/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "deprecationMessage": "This field is deprecated",
+                      "doNotSuggest": true,
+                      "deprecated": true
+                    },
+                    "pipeline_params": {
+                      "description": "Controls whether the pipeline should perform a full refresh",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PipelineParams",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "python_named_params": {
+                      "description": "[Private Preview]",
+                      "$ref": "#/$defs/map/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "deprecationMessage": "This field is deprecated",
+                      "doNotSuggest": true,
+                      "deprecated": true
+                    },
+                    "python_params": {
+                      "description": "[Private Preview] A list of parameters for jobs with Python tasks, for example `\"python_params\": [\"john doe\", \"35\"]`.\nThe parameters are passed to Python file as command-line parameters. If specified upon `run-now`, it would overwrite\nthe parameters specified in job setting. The JSON representation of this field (for example `{\"python_params\":[\"john doe\",\"35\"]}`)\ncannot exceed 10,000 bytes.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.\n\nImportant\n\nThese parameters accept only Latin characters (ASCII character set). Using non-ASCII characters returns an error.\nExamples of invalid, non-ASCII characters are Chinese, Japanese kanjis, and emojis.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "deprecationMessage": "This field is deprecated",
+                      "doNotSuggest": true,
+                      "deprecated": true
+                    },
+                    "spark_submit_params": {
+                      "description": "[Private Preview] A list of parameters for jobs with spark submit task, for example `\"spark_submit_params\": [\"--class\", \"org.apache.spark.examples.SparkPi\"]`.\nThe parameters are passed to spark-submit script as command-line parameters. If specified upon `run-now`, it would overwrite the\nparameters specified in job setting. The JSON representation of this field (for example `{\"python_params\":[\"john doe\",\"35\"]}`)\ncannot exceed 10,000 bytes.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.\n\nImportant\n\nThese parameters accept only Latin characters (ASCII character set). Using non-ASCII characters returns an error.\nExamples of invalid, non-ASCII characters are Chinese, Japanese kanjis, and emojis.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "deprecationMessage": "This field is deprecated",
+                      "doNotSuggest": true,
+                      "deprecated": true
+                    },
+                    "sql_params": {
+                      "description": "[Private Preview] A map from keys to values for jobs with SQL task, for example `\"sql_params\": {\"name\": \"john doe\", \"age\": \"35\"}`. The SQL alert task does not support custom parameters.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.",
+                      "$ref": "#/$defs/map/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "deprecationMessage": "This field is deprecated",
+                      "doNotSuggest": true,
+                      "deprecated": true
                     }
                   },
-                  "additionalProperties": false
+                  "additionalProperties": false,
+                  "required": [
+                    "job_id"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "compute.EbsVolumeType": {
+            "jobs.Source": {
               "oneOf": [
                 {
                   "type": "string",
-                  "description": "All EBS volume types that Databricks supports.\nSee https://aws.amazon.com/ebs/details/ for details.",
+                  "description": "Optional location type of the SQL file. When set to `WORKSPACE`, the SQL file will be retrieved\\\nfrom the local Databricks workspace. When set to `GIT`, the SQL file will be retrieved from a Git repository\ndefined in `git_source`. If the value is empty, the task will use `GIT` if `git_source` is defined and `WORKSPACE` otherwise.\n\n* `WORKSPACE`: SQL file is located in Databricks workspace.\n* `GIT`: SQL file is located in cloud Git provider.",
                   "enum": [
-                    "GENERAL_PURPOSE_SSD",
-                    "THROUGHPUT_OPTIMIZED_HDD"
+                    "WORKSPACE",
+                    "GIT"
+                  ],
+                  "enumDescriptions": [
+                    "SQL file is located in \u003cDatabricks\u003e workspace.",
+                    "SQL file is located in cloud Git provider."
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "compute.Environment": {
+            "jobs.SparkJarTask": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "The environment entity used to preserve serverless environment side panel, jobs' environment for non-notebook task, and DLT's environment for classic and serverless pipelines.\nIn this minimal environment spec, only pip and java dependencies are supported.",
                   "properties": {
-                    "base_environment": {
-                      "description": "The base environment this environment is built on top of. A base environment defines the environment version and a\nlist of dependencies for serverless compute. The value can be a file path to a custom `env.yaml` file\n(e.g., `/Workspace/path/to/env.yaml`). Support for a Databricks-provided base environment ID\n(e.g., `workspace-base-environments/databricks_ai_v4`) and workspace base environment ID\n(e.g., `workspace-base-environments/dbe_b849b66e-b31a-4cb5-b161-1f2b10877fb7`) is in Beta.\nEither `environment_version` or `base_environment` can be provided.  For more information, see",
-                      "$ref": "#/$defs/string"
-                    },
-                    "client": {
-                      "description": "Use `environment_version` instead.",
+                    "jar_uri": {
+                      "description": "Deprecated since 04/2016. For classic compute, provide a `jar` through the `libraries` field instead. For serverless compute, provide a `jar` though the `java_dependencies` field inside the `environments` list.\n\nSee the examples of classic and serverless compute usage at the top of the page.",
                       "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA",
                       "deprecationMessage": "This field is deprecated",
                       "deprecated": true
                     },
-                    "dependencies": {
-                      "description": "List of pip dependencies, as supported by the version of pip in this environment.",
-                      "$ref": "#/$defs/slice/string"
+                    "main_class_name": {
+                      "description": "The full name of the class containing the main method to be executed. This class must be contained in a JAR provided as a library.\n\nThe code must use `SparkContext.getOrCreate` to obtain a Spark context; otherwise, runs of the job fail.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "environment_version": {
-                      "description": "Either `environment_version` or `base_environment` needs to be provided. Environment version used by the environment.\nEach version comes with a specific Python version and a set of Python packages.\nThe version is a string, consisting of an integer.",
-                      "$ref": "#/$defs/string"
+                    "parameters": {
+                      "description": "Parameters passed to the main method.\n\nUse [Task parameter variables](https://docs.databricks.com/jobs.html#parameter-variables) to set parameters containing information about job runs.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "run_as_repl": {
+                      "description": "Deprecated. A value of `false` is no longer supported.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA",
+                      "deprecationMessage": "This field is deprecated",
+                      "deprecated": true
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "jobs.SparkPythonTask": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "parameters": {
+                      "description": "Command line parameters passed to the Python file.\n\nUse [Task parameter variables](https://docs.databricks.com/jobs.html#parameter-variables) to set parameters containing information about job runs.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "python_file": {
+                      "description": "The Python file to be executed. Cloud file URIs (such as dbfs:/, s3:/, adls:/, gcs:/) and workspace paths are supported. For python files stored in the Databricks workspace, the path must be absolute and begin with `/`. For files stored in a remote repository, the path must be relative. This field is required.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "java_dependencies": {
-                      "$ref": "#/$defs/slice/string"
+                    "source": {
+                      "description": "Optional location type of the Python file. When set to `WORKSPACE` or not specified, the file will be retrieved from the local\nDatabricks workspace or cloud location (if the `python_file` has a URI format). When set to `GIT`,\nthe Python file will be retrieved from a Git repository defined in `git_source`.\n\n* `WORKSPACE`: The Python file is located in a Databricks workspace or at a cloud filesystem URI.\n* `GIT`: The Python file is located in a remote Git repository.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.Source",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
-                  "additionalProperties": false
+                  "additionalProperties": false,
+                  "required": [
+                    "python_file"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "compute.GcpAttributes": {
+            "jobs.SparkSubmitTask": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "Attributes set during cluster creation which are related to GCP.",
                   "properties": {
-                    "availability": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.GcpAvailability"
-                    },
-                    "boot_disk_size": {
-                      "description": "Boot disk size in GB",
-                      "$ref": "#/$defs/int"
-                    },
-                    "first_on_demand": {
-                      "description": "The first `first_on_demand` nodes of the cluster will be placed on on-demand instances.\nThis value should be greater than 0, to make sure the cluster driver node is placed on an\non-demand instance. If this value is greater than or equal to the current cluster size, all\nnodes will be placed on on-demand instances. If this value is less than the current cluster\nsize, `first_on_demand` nodes will be placed on on-demand instances and the remainder will\nbe placed on `availability` instances. Note that this value does not affect\ncluster size and cannot currently be mutated over the lifetime of a cluster.",
-                      "$ref": "#/$defs/int"
-                    },
-                    "google_service_account": {
-                      "description": "If provided, the cluster will impersonate the google service account when accessing\ngcloud services (like GCS). The google service account\nmust have previously been added to the Databricks environment by an account\nadministrator.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "local_ssd_count": {
-                      "description": "If provided, each node (workers and driver) in the cluster will have this number of local SSDs attached.\nEach local SSD is 375GB in size.\nRefer to [GCP documentation](https://cloud.google.com/compute/docs/disks/local-ssd#choose_number_local_ssds)\nfor the supported number of local SSDs for each instance type.",
-                      "$ref": "#/$defs/int"
-                    },
-                    "use_preemptible_executors": {
-                      "description": "This field determines whether the spark executors will be scheduled to run on preemptible\nVMs (when set to true) versus standard compute engine VMs (when set to false; default).\nNote: Soon to be deprecated, use the 'availability' field instead.",
-                      "$ref": "#/$defs/bool",
-                      "deprecationMessage": "This field is deprecated",
-                      "deprecated": true
-                    },
-                    "zone_id": {
-                      "description": "Identifier for the availability zone in which the cluster resides.\nThis can be one of the following:\n- \"HA\" =\u003e High availability, spread nodes across availability zones for a Databricks deployment region [default].\n- \"AUTO\" =\u003e Databricks picks an availability zone to schedule the cluster on.\n- A GCP availability zone =\u003e Pick One of the available zones for (machine type + region) from\nhttps://cloud.google.com/compute/docs/regions-zones.",
-                      "$ref": "#/$defs/string"
+                    "parameters": {
+                      "description": "Command-line parameters passed to spark submit.\n\nUse [Task parameter variables](https://docs.databricks.com/jobs.html#parameter-variables) to set parameters containing information about job runs.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "compute.GcpAvailability": {
+            "jobs.SparseCheckout": {
               "oneOf": [
                 {
-                  "type": "string",
-                  "description": "This field determines whether the instance pool will contain preemptible\nVMs, on-demand VMs, or preemptible VMs with a fallback to on-demand VMs if the former is unavailable.",
-                  "enum": [
-                    "PREEMPTIBLE_GCP",
-                    "ON_DEMAND_GCP",
-                    "PREEMPTIBLE_WITH_FALLBACK_GCP"
-                  ]
+                  "type": "object",
+                  "properties": {
+                    "patterns": {
+                      "description": "List of patterns to include for sparse checkout.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "compute.GcsStorageInfo": {
+            "jobs.SqlConditionConfiguration": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "A storage location in Google Cloud Platform's GCS",
                   "properties": {
-                    "destination": {
-                      "description": "GCS destination/URI, e.g. `gs://my-bucket/some-prefix`",
-                      "$ref": "#/$defs/string"
+                    "sql_query_id": {
+                      "description": "[Private Preview] The ID of the SQL query to evaluate as the trigger condition.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "trigger_mode": {
+                      "description": "[Private Preview] Determines how the SQL query result is interpreted to decide whether the condition fires.\nMust be set to a recognized value when provided.\nWhen unset on an existing serialized configuration, the server preserves the original\nsemantics by interpreting it as `QUERY_RETURNS_ROWS`. New configurations should set this\nexplicitly — explicit `SQL_CONDITION_TRIGGER_MODE_UNSPECIFIED` is rejected at validation.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SqlConditionTriggerMode",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "warehouse_id": {
+                      "description": "[Private Preview] The canonical identifier of the SQL warehouse to run the condition query against.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "destination"
+                    "sql_query_id",
+                    "warehouse_id"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "compute.HardwareAcceleratorType": {
+            "jobs.SqlConditionTriggerMode": {
               "oneOf": [
                 {
                   "type": "string",
-                  "description": "HardwareAcceleratorType: The type of hardware accelerator to use for compute workloads.\nNOTE: This enum is referenced and is intended to be used by other Databricks services\nthat need to specify hardware accelerator requirements for AI compute workloads.",
+                  "description": "The strategy used to evaluate a SQL condition trigger against a query result set.\n\n* `SQL_CONDITION_TRIGGER_MODE_UNSPECIFIED`: Sentinel zero-value. Not a valid input — the\nvalidator rejects this when sent explicitly. Internally treated as `QUERY_RETURNS_ROWS`\nwhen reading legacy data that predates this field.\n* `QUERY_RETURNS_ROWS`: Fires whenever the result set has at least one row. Zero rows means\nthe condition is not met. This is the original SQL condition behavior.\n* `RESULT_VALUE_CHANGES`: Fires whenever the query's single result value differs from the\nprevious evaluation. The first evaluation always fires. Queries must return exactly one\ncell (one row, one column).",
                   "enum": [
-                    "GPU_1xA10",
-                    "GPU_8xH100"
+                    "QUERY_RETURNS_ROWS",
+                    "RESULT_VALUE_CHANGES"
+                  ],
+                  "enumDescriptions": [
+                    "[Private Preview] Fires whenever the result set has at least one row. Zero rows means",
+                    "[Private Preview] Fires whenever the query's single result value differs from the"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "compute.InitScriptInfo": {
+            "jobs.SqlTask": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "Config for an individual init script\nNext ID: 11",
                   "properties": {
-                    "abfss": {
-                      "description": "Contains the Azure Data Lake Storage destination path",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.Adlsgen2Info"
+                    "alert": {
+                      "description": "If alert, indicates that this job must refresh a SQL alert.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SqlTaskAlert",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "dbfs": {
-                      "description": "destination needs to be provided. e.g.\n`{ \"dbfs\": { \"destination\" : \"dbfs:/home/cluster_log\" } }`",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.DbfsStorageInfo",
-                      "deprecationMessage": "This field is deprecated",
-                      "deprecated": true
+                    "dashboard": {
+                      "description": "If dashboard, indicates that this job must refresh a SQL dashboard.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SqlTaskDashboard",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "file": {
-                      "description": "destination needs to be provided, e.g.\n`{ \"file\": { \"destination\": \"file:/my/local/file.sh\" } }`",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.LocalFileInfo"
-                    },
-                    "gcs": {
-                      "description": "destination needs to be provided, e.g.\n`{ \"gcs\": { \"destination\": \"gs://my-bucket/file.sh\" } }`",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.GcsStorageInfo"
+                      "description": "If file, indicates that this job runs a SQL file in a remote Git repository.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SqlTaskFile",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "s3": {
-                      "description": "destination and either the region or endpoint need to be provided. e.g.\n`{ \\\"s3\\\": { \\\"destination\\\": \\\"s3://cluster_log_bucket/prefix\\\", \\\"region\\\": \\\"us-west-2\\\" } }`\nCluster iam role is used to access s3, please make sure the cluster iam role in\n`instance_profile_arn` has permission to write data to the s3 destination.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.S3StorageInfo"
+                    "parameters": {
+                      "description": "Parameters to be used for each run of this job. The SQL alert task does not support custom parameters.",
+                      "$ref": "#/$defs/map/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "volumes": {
-                      "description": "destination needs to be provided. e.g.\n`{ \\\"volumes\\\" : { \\\"destination\\\" : \\\"/Volumes/my-init.sh\\\" } }`",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.VolumesStorageInfo"
+                    "query": {
+                      "description": "If query, indicates that this job must execute a SQL query.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SqlTaskQuery",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "workspace": {
-                      "description": "destination needs to be provided, e.g.\n`{ \"workspace\": { \"destination\": \"/cluster-init-scripts/setup-datadog.sh\" } }`",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.WorkspaceStorageInfo"
+                    "warehouse_id": {
+                      "description": "The canonical identifier of the SQL warehouse. Recommended to use with serverless or pro SQL warehouses. Classic SQL warehouses are only supported for SQL alert, dashboard and query tasks and are limited to scheduled single-task jobs.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
-                  "additionalProperties": false
+                  "additionalProperties": false,
+                  "required": [
+                    "warehouse_id"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "compute.Kind": {
+            "jobs.SqlTaskAlert": {
               "oneOf": [
                 {
-                  "type": "string",
-                  "enum": [
-                    "CLASSIC_PREVIEW"
+                  "type": "object",
+                  "properties": {
+                    "alert_id": {
+                      "description": "The canonical identifier of the SQL alert.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "pause_subscriptions": {
+                      "description": "If true, the alert notifications are not sent to subscribers.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "subscriptions": {
+                      "description": "If specified, alert notifications are sent to subscribers.",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.SqlTaskSubscription",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "alert_id"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "compute.Library": {
+            "jobs.SqlTaskDashboard": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "cran": {
-                      "description": "Specification of a CRAN library to be installed as part of the library",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.RCranLibrary"
-                    },
-                    "egg": {
-                      "description": "Deprecated. URI of the egg library to install. Installing Python egg files is deprecated and is not supported in Databricks Runtime 14.0 and above.",
+                    "custom_subject": {
+                      "description": "Subject of the email sent to subscribers of this task.",
                       "$ref": "#/$defs/string",
-                      "deprecationMessage": "This field is deprecated",
-                      "deprecated": true
-                    },
-                    "jar": {
-                      "description": "URI of the JAR library to install. Supported URIs include Workspace paths, Unity Catalog Volumes paths, and S3 URIs.\nFor example: `{ \"jar\": \"/Workspace/path/to/library.jar\" }`, `{ \"jar\" : \"/Volumes/path/to/library.jar\" }` or\n`{ \"jar\": \"s3://my-bucket/library.jar\" }`.\nIf S3 is used, please make sure the cluster has read access on the library. You may need to\nlaunch the cluster with an IAM role to access the S3 URI.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "maven": {
-                      "description": "Specification of a maven library to be installed. For example:\n`{ \"coordinates\": \"org.jsoup:jsoup:1.7.2\" }`",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.MavenLibrary"
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "pypi": {
-                      "description": "Specification of a PyPi library to be installed. For example:\n`{ \"package\": \"simplejson\" }`",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.PythonPyPiLibrary"
+                    "dashboard_id": {
+                      "description": "The canonical identifier of the SQL dashboard.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "requirements": {
-                      "description": "URI of the requirements.txt file to install. Only Workspace paths and Unity Catalog Volumes paths are supported.\nFor example: `{ \"requirements\": \"/Workspace/path/to/requirements.txt\" }` or `{ \"requirements\" : \"/Volumes/path/to/requirements.txt\" }`",
-                      "$ref": "#/$defs/string"
+                    "pause_subscriptions": {
+                      "description": "If true, the dashboard snapshot is not taken, and emails are not sent to subscribers.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "whl": {
-                      "description": "URI of the wheel library to install. Supported URIs include Workspace paths, Unity Catalog Volumes paths, and S3 URIs.\nFor example: `{ \"whl\": \"/Workspace/path/to/library.whl\" }`, `{ \"whl\" : \"/Volumes/path/to/library.whl\" }` or\n`{ \"whl\": \"s3://my-bucket/library.whl\" }`.\nIf S3 is used, please make sure the cluster has read access on the library. You may need to\nlaunch the cluster with an IAM role to access the S3 URI.",
-                      "$ref": "#/$defs/string"
+                    "subscriptions": {
+                      "description": "If specified, dashboard snapshots are sent to subscriptions.",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.SqlTaskSubscription",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
-                  "additionalProperties": false
+                  "additionalProperties": false,
+                  "required": [
+                    "dashboard_id"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "compute.LocalFileInfo": {
+            "jobs.SqlTaskFile": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "destination": {
-                      "description": "local file destination, e.g. `file:/my/local/file.sh`",
-                      "$ref": "#/$defs/string"
+                    "path": {
+                      "description": "Path of the SQL file. Must be relative if the source is a remote Git repository and absolute for workspace paths.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "source": {
+                      "description": "Optional location type of the SQL file. When set to `WORKSPACE`, the SQL file will be retrieved\nfrom the local Databricks workspace. When set to `GIT`, the SQL file will be retrieved from a Git repository\ndefined in `git_source`. If the value is empty, the task will use `GIT` if `git_source` is defined and `WORKSPACE` otherwise.\n\n* `WORKSPACE`: SQL file is located in Databricks workspace.\n* `GIT`: SQL file is located in cloud Git provider.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.Source",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "destination"
+                    "path"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "compute.LogAnalyticsInfo": {
+            "jobs.SqlTaskQuery": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "log_analytics_primary_key": {
-                      "description": "The primary key for the Azure Log Analytics agent configuration",
-                      "$ref": "#/$defs/string"
-                    },
-                    "log_analytics_workspace_id": {
-                      "description": "The workspace ID for the Azure Log Analytics agent configuration",
-                      "$ref": "#/$defs/string"
+                    "query_id": {
+                      "description": "The canonical identifier of the SQL query.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
-                  "additionalProperties": false
+                  "additionalProperties": false,
+                  "required": [
+                    "query_id"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "compute.MavenLibrary": {
+            "jobs.SqlTaskSubscription": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "coordinates": {
-                      "description": "Gradle-style maven coordinates. For example: \"org.jsoup:jsoup:1.7.2\".",
-                      "$ref": "#/$defs/string"
-                    },
-                    "exclusions": {
-                      "description": "List of dependences to exclude. For example: `[\"slf4j:slf4j\", \"*:hadoop-client\"]`.\n\nMaven dependency exclusions:\nhttps://maven.apache.org/guides/introduction/introduction-to-optional-and-excludes-dependencies.html.",
-                      "$ref": "#/$defs/slice/string"
+                    "destination_id": {
+                      "description": "The canonical identifier of the destination to receive email notification. This parameter is mutually exclusive with user_name. You cannot set both destination_id and user_name for subscription notifications.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "repo": {
-                      "description": "Maven repo to install the Maven package from. If omitted, both Maven Central Repository\nand Spark Packages are searched.",
-                      "$ref": "#/$defs/string"
+                    "user_name": {
+                      "description": "The user name to receive the subscription email. This parameter is mutually exclusive with destination_id. You cannot set both destination_id and user_name for subscription notifications.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
-                  "additionalProperties": false,
-                  "required": [
-                    "coordinates"
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "jobs.StorageMode": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "enum": [
+                    "DIRECT_QUERY",
+                    "IMPORT",
+                    "DUAL"
+                  ],
+                  "enumDescriptions": [
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "compute.NodeTypeFlexibility": {
+            "jobs.Subscription": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "Configuration for flexible node types, allowing fallback to alternate node types during cluster launch and upscale.",
                   "properties": {
-                    "alternate_node_type_ids": {
-                      "description": "A list of node type IDs to use as fallbacks when the primary node type is unavailable.",
-                      "$ref": "#/$defs/slice/string"
+                    "attachment": {
+                      "description": "[Private Preview] Optional: The configuration for the files attached to the dashboard snapshot notification. It\ncontrols the underlying data of dashboard widgets that is attached as data files and which\npages are included in the attached PDF. If not specified, the notification is sent with only\nthe default snapshot.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SubscriptionAttachment",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "custom_subject": {
+                      "description": "Optional: Allows users to specify a custom subject line on the email sent\nto subscribers.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "paused": {
+                      "description": "When true, the subscription will not send emails.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "subscribers": {
+                      "description": "The list of subscribers to send the snapshot of the dashboard to.",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.SubscriptionSubscriber",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "compute.PythonPyPiLibrary": {
+            "jobs.SubscriptionAttachment": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "The configuration for the files attached to the dashboard snapshot notification sent to\nsubscribers. `data_attachment` describes the underlying data of dashboard widgets attached\nas data files, and `page_attachment` describes which dashboard pages are included in the\nattached PDF.",
                   "properties": {
-                    "package": {
-                      "description": "The name of the pypi package to install. An optional exact version specification is also\nsupported. Examples: \"simplejson\" and \"simplejson==3.8.0\".",
-                      "$ref": "#/$defs/string"
+                    "data_attachment": {
+                      "description": "[Private Preview] Optional: The configuration for the underlying data of dashboard widgets attached as tabular\ndata files. If not specified, no tabular data is attached.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SubscriptionAttachmentDataAttachment",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "repo": {
-                      "description": "The repository where the package can be found. If not specified, the default pip index is\nused.",
-                      "$ref": "#/$defs/string"
+                    "page_attachment": {
+                      "description": "[Private Preview] Optional: The selection of dashboard pages included in the attached PDF. If not specified,\nonly the first page is included.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SubscriptionAttachmentPageAttachment",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
-                  "additionalProperties": false,
-                  "required": [
-                    "package"
-                  ]
+                  "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "compute.RCranLibrary": {
+            "jobs.SubscriptionAttachmentDataAttachment": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "The configuration for the tabular data files attached to the dashboard snapshot. `widgets`\nlists the widgets whose data is exported and `file_format` is the output format; each\nreferenced widget's data is exported as a separate file.",
                   "properties": {
-                    "package": {
-                      "description": "The name of the CRAN package to install.",
-                      "$ref": "#/$defs/string"
+                    "file_format": {
+                      "description": "[Private Preview] The file format of the exported tabular data files.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SubscriptionAttachmentDataAttachmentFileFormat",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "repo": {
-                      "description": "The repository where the package can be found. If not specified, the default CRAN repo is used.",
-                      "$ref": "#/$defs/string"
+                    "include_applied_filters": {
+                      "description": "[Private Preview] When true, the dashboard's applied filter values are included alongside the tabular data as\nan additional attached file.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "widgets": {
+                      "description": "[Private Preview] The widgets whose underlying data is exported. At least one widget must be referenced.",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.SubscriptionAttachmentDataAttachmentWidget",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "package"
+                    "file_format",
+                    "widgets"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "compute.RuntimeEngine": {
+            "jobs.SubscriptionAttachmentDataAttachmentFileFormat": {
               "oneOf": [
                 {
                   "type": "string",
+                  "description": "The output format of an exported tabular data file. Must be set to a value other than\n`FILE_FORMAT_UNSPECIFIED`.",
                   "enum": [
-                    "NULL",
-                    "STANDARD",
-                    "PHOTON"
+                    "FILE_FORMAT_CSV",
+                    "FILE_FORMAT_TSV",
+                    "FILE_FORMAT_EXCEL"
+                  ],
+                  "enumDescriptions": [
+                    "[Private Preview]",
+                    "[Private Preview]",
+                    "[Private Preview]"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "compute.S3StorageInfo": {
+            "jobs.SubscriptionAttachmentDataAttachmentWidget": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "A storage location in Amazon S3",
+                  "description": "Identifies a dashboard widget whose data to attach. `page_id` and `widget_id` are\nthe URL identifiers from the dashboard's serialized definition returned by the Get dashboard\nAPI (`serialized_dashboard`), and together they uniquely identify the widget.",
                   "properties": {
-                    "canned_acl": {
-                      "description": "(Optional) Set canned access control list for the logs, e.g. `bucket-owner-full-control`.\nIf `canned_cal` is set, please make sure the cluster iam role has `s3:PutObjectAcl` permission on\nthe destination bucket and prefix. The full list of possible canned acl can be found at\nhttp://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl.\nPlease also note that by default only the object owner gets full controls. If you are using cross account\nrole for writing data, you may want to set `bucket-owner-full-control` to make bucket owner able to\nread the logs.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "destination": {
-                      "description": "S3 destination, e.g. `s3://my-bucket/some-prefix` Note that logs will be delivered using\ncluster iam role, please make sure you set cluster iam role and the role has write access to the\ndestination. Please also note that you cannot use AWS keys to deliver logs.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "enable_encryption": {
-                      "description": "(Optional) Flag to enable server side encryption, `false` by default.",
-                      "$ref": "#/$defs/bool"
-                    },
-                    "encryption_type": {
-                      "description": "(Optional) The encryption type, it could be `sse-s3` or `sse-kms`. It will be used only when\nencryption is enabled and the default type is `sse-s3`.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "endpoint": {
-                      "description": "S3 endpoint, e.g. `https://s3-us-west-2.amazonaws.com`. Either region or endpoint needs to be set.\nIf both are set, endpoint will be used.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "kms_key": {
-                      "description": "(Optional) Kms key which will be used if encryption is enabled and encryption type is set to `sse-kms`.",
-                      "$ref": "#/$defs/string"
+                    "page_id": {
+                      "description": "[Private Preview] The URL identifier of the page containing the widget. This is the value of the `name`\nfield of the corresponding entry under `pages` in the serialized dashboard definition.\nFormat: alphanumeric, hyphen, and underscore characters allowed, max length 63.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "region": {
-                      "description": "S3 region, e.g. `us-west-2`. Either region or endpoint needs to be set. If both are set,\nendpoint will be used.",
-                      "$ref": "#/$defs/string"
+                    "widget_id": {
+                      "description": "[Private Preview] The URL identifier of the widget. This is the value of the `name` field of the\ncorresponding widget under that page's `layout` in the serialized dashboard definition.\nFormat: alphanumeric, hyphen, and underscore characters allowed, max length 63.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "destination"
+                    "page_id",
+                    "widget_id"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "compute.VolumesStorageInfo": {
+            "jobs.SubscriptionAttachmentPageAttachment": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "A storage location back by UC Volumes.",
+                  "description": "The selection of dashboard pages included in the attached PDF. `page_selection` chooses\nbetween all pages, the first page only, or an explicit subset listed in `page_ids`.",
                   "properties": {
-                    "destination": {
-                      "description": "UC Volumes destination, e.g. `/Volumes/catalog/schema/vol1/init-scripts/setup-datadog.sh`\nor `dbfs:/Volumes/catalog/schema/vol1/init-scripts/setup-datadog.sh`",
-                      "$ref": "#/$defs/string"
+                    "page_ids": {
+                      "description": "[Private Preview] The identifiers of the pages to include in the PDF. Only specified when `page_selection` is\n`PAGE_SELECTION_SUBSET`. Each value is the identifier of a page in the dashboard's\nserialized definition returned by the Get dashboard API (`serialized_dashboard`): the value\nof the `name` field of an entry under `pages`.\nFormat: alphanumeric, hyphen, and underscore characters allowed, max length 63.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "page_selection": {
+                      "description": "[Private Preview] How the attached pages are selected. When set to `PAGE_SELECTION_SUBSET`, the pages to\ninclude are listed in `page_ids`.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SubscriptionAttachmentPageAttachmentPageSelection",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
-                  "additionalProperties": false,
-                  "required": [
-                    "destination"
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "jobs.SubscriptionAttachmentPageAttachmentPageSelection": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "description": "Determines which dashboard pages are attached to the notification.",
+                  "enum": [
+                    "PAGE_SELECTION_ALL",
+                    "PAGE_SELECTION_SUBSET"
+                  ],
+                  "enumDescriptions": [
+                    "[Private Preview]",
+                    "[Private Preview]"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "compute.WorkloadType": {
+            "jobs.SubscriptionSubscriber": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "Cluster Attributes showing for clusters workload types.",
                   "properties": {
-                    "clients": {
-                      "description": "defined what type of clients can use the cluster. E.g. Notebooks, Jobs",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.ClientsTypes"
+                    "destination_id": {
+                      "description": "A snapshot of the dashboard will be sent to the destination when the `destination_id` field is present.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "user_name": {
+                      "description": "A snapshot of the dashboard will be sent to the user's email when the `user_name` field is present.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "jobs.TableUpdateTriggerConfiguration": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "condition": {
+                      "description": "The table(s) condition based on which to trigger a job run.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.Condition",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "min_time_between_triggers_seconds": {
+                      "description": "If set, the trigger starts a run only after the specified amount of time has passed since\nthe last time the trigger fired. The minimum allowed value is 60 seconds.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "table_names": {
+                      "description": "A list of tables to monitor for changes. The table name must be in the format `catalog_name.schema_name.table_name`.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "wait_after_last_change_seconds": {
+                      "description": "If set, the trigger starts a run only after no table updates have occurred for the specified time\nand can be used to wait for a series of table updates before triggering a run. The\nminimum allowed value is 60 seconds.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "clients"
+                    "table_names"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "compute.WorkspaceStorageInfo": {
+            "jobs.Task": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "A storage location in Workspace Filesystem (WSFS)",
                   "properties": {
-                    "destination": {
-                      "description": "wsfs destination, e.g. `workspace:/cluster-init-scripts/setup-datadog.sh`",
-                      "$ref": "#/$defs/string"
+                    "ai_runtime_task": {
+                      "description": "[Public Preview] The task runs a multi-gpu compute workload on Databricks AI Runtime. Specify\nthe accelerator type and count, the command to run, and where the workload's\ncode and MLflow output are stored.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.AiRuntimeTask",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "alert_task": {
+                      "description": "[Public Preview] The task evaluates a Databricks alert and sends notifications to subscribers\nwhen the `alert_task` field is present.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.AlertTask",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "clean_rooms_notebook_task": {
+                      "description": "The task runs a [clean rooms](https://docs.databricks.com/clean-rooms/index.html) notebook\nwhen the `clean_rooms_notebook_task` field is present.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.CleanRoomsNotebookTask",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "compute": {
+                      "description": "[Public Preview] Task level compute configuration.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.Compute",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "condition_task": {
+                      "description": "The task evaluates a condition that can be used to control the execution of other tasks when the `condition_task` field is present.\nThe condition task does not require a cluster to execute and does not support retries or notifications.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.ConditionTask",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "dashboard_task": {
+                      "description": "The task refreshes a dashboard and sends a snapshot to subscribers.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.DashboardTask",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "dbt_cloud_task": {
+                      "description": "[Private Preview] Task type for dbt cloud, deprecated in favor of the new name dbt_platform_task",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.DbtCloudTask",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "deprecationMessage": "This field is deprecated",
+                      "doNotSuggest": true,
+                      "deprecated": true
+                    },
+                    "dbt_platform_task": {
+                      "description": "[Private Preview]",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.DbtPlatformTask",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "dbt_task": {
+                      "description": "The task runs one or more dbt commands when the `dbt_task` field is present. The dbt task requires both Databricks SQL and the ability to use a serverless or a pro SQL warehouse.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.DbtTask",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "depends_on": {
+                      "description": "An optional array of objects specifying the dependency graph of the task. All tasks specified in this field must complete before executing this task. The task will run only if the `run_if` condition is true.\nThe key is `task_key`, and the value is the name assigned to the dependent task.",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.TaskDependency",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "description": {
+                      "description": "An optional description for this task.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "disable_auto_optimization": {
+                      "description": "An option to disable auto optimization in serverless",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "disabled": {
+                      "description": "An optional flag to disable the task. If set to true, the task will not run even if it is part of a job.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "email_notifications": {
+                      "description": "An optional set of email addresses that is notified when runs of this task begin or complete as well as when this task is deleted. The default behavior is to not send any emails.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.TaskEmailNotifications",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "environment_key": {
+                      "description": "The key that references an environment spec in a job. This field is required for Python script, Python wheel and dbt tasks when using serverless compute or a compute resource that uses Environments mode.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "environment_variables_key": {
+                      "description": "[Beta] Reference to a `JobEnvironmentVariables` entry defined in\n`JobSettings.environment_variables`. The selected entry's variables are\napplied to this task at execution time. This field supports serverless\ntasks using environment version 5 or later.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
+                    },
+                    "existing_cluster_id": {
+                      "description": "If existing_cluster_id, the ID of an existing cluster that is used for all runs.\nWhen running jobs or tasks on an existing cluster, you may need to manually restart\nthe cluster if it stops responding. We suggest running jobs and tasks on new clusters for\ngreater reliability",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "for_each_task": {
+                      "description": "The task executes a nested task for every input provided when the `for_each_task` field is present.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.ForEachTask",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "gen_ai_compute_task": {
+                      "description": "[Private Preview] DEPRECATED — use `AiRuntimeTask` for all new BYOT multi-node GPU\nworkloads (see ai_runtime_task.proto). `AiRuntimeTask` is the only\nsupported BYOT task type for new workloads; this proto is retained only\nfor AIR CLI (fka SGCLI) pywheel backwards compatibility and will be\nremoved once the pywheel → databricks-cli migration completes (post-\nPuPr).",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.GenAiComputeTask",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "health": {
+                      "description": "An optional set of health rules that can be defined for this job.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobsHealthRules",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "job_cluster_key": {
+                      "description": "If job_cluster_key, this task is executed reusing the cluster specified in `job.settings.job_clusters`.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "libraries": {
+                      "description": "An optional list of libraries to be installed on the cluster.\nThe default value is an empty list.",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/compute.Library",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "max_retries": {
+                      "description": "An optional maximum number of times to retry an unsuccessful run. A run is considered to be unsuccessful if it completes with the `FAILED` result_state or `INTERNAL_ERROR` `life_cycle_state`. The value `-1` means to retry indefinitely and the value `0` means to never retry.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "min_retry_interval_millis": {
+                      "description": "An optional minimal interval in milliseconds between the start of the failed run and the subsequent retry run. The default behavior is that unsuccessful runs are immediately retried.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "new_cluster": {
+                      "description": "If new_cluster, a description of a new cluster that is created for each run.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.ClusterSpec",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "notebook_task": {
+                      "description": "The task runs a notebook when the `notebook_task` field is present.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.NotebookTask",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "notification_settings": {
+                      "description": "Optional notification settings that are used when sending notifications to each of the `email_notifications` and `webhook_notifications` for this task.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.TaskNotificationSettings",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "pipeline_task": {
+                      "description": "The task triggers a pipeline update when the `pipeline_task` field is present. Only pipelines configured to use triggered more are supported.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PipelineTask",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "power_bi_task": {
+                      "description": "[Public Preview] The task triggers a Power BI semantic model update when the `power_bi_task` field is present.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PowerBiTask",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "python_operator_task": {
+                      "description": "[Private Preview] The task runs a Python operator task.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PythonOperatorTask",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "python_wheel_task": {
+                      "description": "The task runs a Python wheel when the `python_wheel_task` field is present.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PythonWheelTask",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "retry_on_timeout": {
+                      "description": "An optional policy to specify whether to retry a job when it times out. The default behavior\nis to not retry on timeout.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "run_if": {
+                      "description": "An optional value specifying the condition determining whether the task is run once its dependencies have been completed.\n\n* `ALL_SUCCESS`: All dependencies have executed and succeeded\n* `AT_LEAST_ONE_SUCCESS`: At least one dependency has succeeded\n* `NONE_FAILED`: None of the dependencies have failed and at least one was executed\n* `ALL_DONE`: All dependencies have been completed\n* `AT_LEAST_ONE_FAILED`: At least one dependency failed\n* `ALL_FAILED`: ALl dependencies have failed",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.RunIf",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "run_job_task": {
+                      "description": "The task triggers another job when the `run_job_task` field is present.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.RunJobTask",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "spark_jar_task": {
+                      "description": "The task runs a JAR when the `spark_jar_task` field is present.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SparkJarTask",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "spark_python_task": {
+                      "description": "The task runs a Python file when the `spark_python_task` field is present.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SparkPythonTask",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "spark_submit_task": {
+                      "description": "(Legacy) The task runs the spark-submit script when the spark_submit_task field is present. Databricks recommends using the spark_jar_task instead; see [Spark Submit task for jobs](/jobs/spark-submit).",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SparkSubmitTask",
+                      "x-databricks-launch-stage": "GA",
+                      "deprecationMessage": "This field is deprecated",
+                      "deprecated": true
+                    },
+                    "sql_task": {
+                      "description": "The task runs a SQL query or file, or it refreshes a SQL alert or a legacy SQL dashboard when the `sql_task` field is present.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SqlTask",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "task_key": {
+                      "description": "A unique name for the task. This field is used to refer to this task from other tasks.\nThis field is required and must be unique within its parent job.\nOn Update or Reset, this field is used to reference the tasks to be updated or reset.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "timeout_seconds": {
+                      "description": "An optional timeout applied to each run of this job task. A value of `0` means no timeout.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "webhook_notifications": {
+                      "description": "A collection of system notification IDs to notify when runs of this task begin or complete. The default behavior is to not send any system notifications.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.WebhookNotifications",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "destination"
-                  ]
-                },
-                {
-                  "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
-                }
-              ]
-            },
-            "dashboards.LifecycleState": {
-              "oneOf": [
-                {
-                  "type": "string",
-                  "enum": [
-                    "ACTIVE",
-                    "TRASHED"
+                    "task_key"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "database.CustomTag": {
+            "jobs.TaskDependency": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "key": {
-                      "description": "The key of the custom tag.",
-                      "$ref": "#/$defs/string"
+                    "outcome": {
+                      "description": "Can only be specified on condition task dependencies. The outcome of the dependent task that must be met for this task to run.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "value": {
-                      "description": "The value of the custom tag.",
-                      "$ref": "#/$defs/string"
+                    "task_key": {
+                      "description": "The name of the task this task depends on.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
-                  "additionalProperties": false
+                  "additionalProperties": false,
+                  "required": [
+                    "task_key"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "database.DatabaseInstanceRef": {
+            "jobs.TaskEmailNotifications": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "DatabaseInstanceRef is a reference to a database instance. It is used in the\nDatabaseInstance object to refer to the parent instance of an instance and\nto refer the child instances of an instance.\nTo specify as a parent instance during creation of an instance,\nthe lsn and branch_time fields are optional. If not specified, the child\ninstance will be created from the latest lsn of the parent.\nIf both lsn and branch_time are specified, the lsn will be used to create\nthe child instance.",
                   "properties": {
-                    "branch_time": {
-                      "description": "Branch time of the ref database instance.\nFor a parent ref instance, this is the point in time on the parent instance from which the\ninstance was created.\nFor a child ref instance, this is the point in time on the instance from which the child\ninstance was created.\nInput: For specifying the point in time to create a child instance. Optional.\nOutput: Only populated if provided as input to create a child instance.",
-                      "$ref": "#/$defs/string"
+                    "no_alert_for_skipped_runs": {
+                      "description": "If true, do not send email to recipients specified in `on_failure` if the run is skipped.\nThis field is `deprecated`. Please use the `notification_settings.no_alert_for_skipped_runs` field.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA",
+                      "deprecationMessage": "This field is deprecated",
+                      "deprecated": true
                     },
-                    "lsn": {
-                      "description": "User-specified WAL LSN of the ref database instance.\n\nInput: For specifying the WAL LSN to create a child instance. Optional.\nOutput: Only populated if provided as input to create a child instance.",
-                      "$ref": "#/$defs/string"
+                    "on_duration_warning_threshold_exceeded": {
+                      "description": "A list of email addresses to be notified when the duration of a run exceeds the threshold specified for the `RUN_DURATION_SECONDS` metric in the `health` field. If no rule for the `RUN_DURATION_SECONDS` metric is specified in the `health` field for the job, notifications are not sent.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "name": {
-                      "description": "Name of the ref database instance.",
-                      "$ref": "#/$defs/string"
+                    "on_failure": {
+                      "description": "A list of email addresses to be notified when a run unsuccessfully completes. A run is considered to have completed unsuccessfully if it ends with an `INTERNAL_ERROR` `life_cycle_state` or a `FAILED`, or `TIMED_OUT` result_state. If this is not specified on job creation, reset, or update the list is empty, and notifications are not sent.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "on_maintenance_complete": {
+                      "description": "A list of email addresses to notify when platform-initiated maintenance completes for a continuous job.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "on_maintenance_start": {
+                      "description": "A list of email addresses to notify when platform-initiated maintenance starts for a continuous job.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "on_start": {
+                      "description": "A list of email addresses to be notified when a run begins. If not specified on job creation, reset, or update, the list is empty, and notifications are not sent.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "on_streaming_backlog_exceeded": {
+                      "description": "[Public Preview] A list of email addresses to notify when any streaming backlog thresholds are exceeded for any stream.\nStreaming backlog thresholds can be set in the `health` field using the following metrics: `STREAMING_BACKLOG_BYTES`, `STREAMING_BACKLOG_RECORDS`, `STREAMING_BACKLOG_SECONDS`, or `STREAMING_BACKLOG_FILES`.\nAlerting is based on the 10-minute average of these metrics. If the issue persists, notifications are resent every 30 minutes.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "on_success": {
+                      "description": "A list of email addresses to be notified when a run successfully completes. A run is considered to have completed successfully if it ends with a `TERMINATED` `life_cycle_state` and a `SUCCESS` result_state. If not specified on job creation, reset, or update, the list is empty, and notifications are not sent.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
-                }
-              ]
-            },
-            "database.DatabaseInstanceState": {
-              "oneOf": [
-                {
-                  "type": "string",
-                  "enum": [
-                    "STARTING",
-                    "AVAILABLE",
-                    "DELETING",
-                    "STOPPED",
-                    "UPDATING",
-                    "FAILING_OVER"
-                  ]
-                },
-                {
-                  "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
-                }
-              ]
-            },
-            "database.DeltaTableSyncInfo": {
-              "oneOf": [
-                {
-                  "type": "object",
-                  "additionalProperties": false
-                },
-                {
-                  "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "database.NewPipelineSpec": {
+            "jobs.TaskNotificationSettings": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "Custom fields that user can set for pipeline while creating SyncedDatabaseTable.\nNote that other fields of pipeline are still inferred by table def internally",
                   "properties": {
-                    "budget_policy_id": {
-                      "description": "Budget policy to set on the newly created pipeline.",
-                      "$ref": "#/$defs/string"
+                    "alert_on_last_attempt": {
+                      "description": "If true, do not send notifications to recipients specified in `on_start` for the retried runs and do not send notifications to recipients specified in `on_failure` until the last retry of the run.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "storage_catalog": {
-                      "description": "This field needs to be specified if the destination catalog is a managed postgres catalog.\n\nUC catalog for the pipeline to store intermediate files (checkpoints, event logs etc).\nThis needs to be a standard catalog where the user has permissions to create Delta tables.",
-                      "$ref": "#/$defs/string"
+                    "no_alert_for_canceled_runs": {
+                      "description": "If true, do not send notifications to recipients specified in `on_failure` if the run is canceled.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "storage_schema": {
-                      "description": "This field needs to be specified if the destination catalog is a managed postgres catalog.\n\nUC schema for the pipeline to store intermediate files (checkpoints, event logs etc).\nThis needs to be in the standard catalog where the user has permissions to create Delta tables.",
-                      "$ref": "#/$defs/string"
+                    "no_alert_for_skipped_runs": {
+                      "description": "If true, do not send notifications to recipients specified in `on_failure` if the run is skipped.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
-                }
-              ]
-            },
-            "database.ProvisioningInfoState": {
-              "oneOf": [
-                {
-                  "type": "string",
-                  "enum": [
-                    "PROVISIONING",
-                    "ACTIVE",
-                    "FAILED",
-                    "DELETING",
-                    "UPDATING",
-                    "DEGRADED"
-                  ]
-                },
-                {
-                  "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "database.ProvisioningPhase": {
+            "jobs.TaskRetryMode": {
               "oneOf": [
                 {
                   "type": "string",
+                  "description": "task retry mode of the continuous job\n* NEVER: The failed task will not be retried.\n* ON_FAILURE: Retry a failed task if at least one other task in the job is still running its first attempt.\nWhen this condition is no longer met or the retry limit is reached, the job run is cancelled and a new run is started.",
                   "enum": [
-                    "PROVISIONING_PHASE_MAIN",
-                    "PROVISIONING_PHASE_INDEX_SCAN",
-                    "PROVISIONING_PHASE_INDEX_SORT"
+                    "NEVER",
+                    "ON_FAILURE"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
-                }
-              ]
-            },
-            "database.SyncedTableContinuousUpdateStatus": {
-              "oneOf": [
-                {
-                  "type": "object",
-                  "description": "Detailed status of a synced table. Shown if the synced table is in the SYNCED_CONTINUOUS_UPDATE\nor the SYNCED_UPDATING_PIPELINE_RESOURCES state.",
-                  "additionalProperties": false
-                },
-                {
-                  "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "database.SyncedTableFailedStatus": {
+            "jobs.TriggerConfiguration": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "Detailed status of a synced table. Shown if the synced table is in the OFFLINE_FAILED or the\nSYNCED_PIPELINE_FAILED state.",
+                  "description": "A single trigger attached to a job via `JobSettings.triggers`. Exactly one of the trigger-type fields\n(`periodic`, `schedule`, `continuous`, `file_arrival`, `table_update`, `model`, `job_completion`) must be set;\nmutual exclusivity is enforced in the API handler rather than via `oneof` so that codegen, validation, and JSON\nserialization across SDKs and Terraform behave consistently.",
+                  "properties": {
+                    "continuous": {
+                      "description": "[Beta] Continuous trigger configuration.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.ContinuousTriggerConfiguration",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
+                    },
+                    "file_arrival": {
+                      "description": "[Beta] File arrival trigger configuration.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.FileArrivalTriggerConfiguration",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
+                    },
+                    "model": {
+                      "description": "[Private Preview] Model trigger configuration.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.ModelTriggerConfiguration",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "pause_status": {
+                      "description": "[Beta] Whether this trigger is paused. Defaults to UNPAUSED when unset; the server always returns an explicit value on read.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PauseStatus",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
+                    },
+                    "periodic": {
+                      "description": "[Beta] Trigger type: exactly one must be set; mutual exclusivity is enforced in the API handler\nPeriodic trigger configuration.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PeriodicTriggerConfiguration",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
+                    },
+                    "schedule": {
+                      "description": "[Beta] Cron schedule trigger configuration.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.CronTriggerConfiguration",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
+                    },
+                    "sql_condition": {
+                      "description": "[Private Preview] Optional SQL condition that gates whether this trigger fires.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SqlConditionConfiguration",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "table_update": {
+                      "description": "[Beta] Table update trigger configuration.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.TableUpdateTriggerConfiguration",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
+                    }
+                  },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "database.SyncedTablePipelineProgress": {
+            "jobs.TriggerSettings": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "Progress information of the Synced Table data synchronization pipeline.",
+                  "properties": {
+                    "file_arrival": {
+                      "description": "File arrival trigger settings.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.FileArrivalTriggerConfiguration",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "model": {
+                      "description": "[Private Preview]",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.ModelTriggerConfiguration",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "pause_status": {
+                      "description": "Whether this trigger is paused or not.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PauseStatus",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "periodic": {
+                      "description": "Periodic trigger settings.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PeriodicTriggerConfiguration",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "sql_condition": {
+                      "description": "[Private Preview] SQL condition that must be satisfied for the trigger to fire. Can be used in combination with other trigger types and\nruns *after* other trigger types conditions are evaluated.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SqlConditionConfiguration",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "table_update": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.TableUpdateTriggerConfiguration",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "database.SyncedTablePosition": {
+            "jobs.Webhook": {
               "oneOf": [
                 {
                   "type": "object",
-                  "additionalProperties": false
+                  "properties": {
+                    "id": {
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "id"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "database.SyncedTableProvisioningStatus": {
+            "jobs.WebhookNotifications": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "Detailed status of a synced table. Shown if the synced table is in the\nPROVISIONING_PIPELINE_RESOURCES or the PROVISIONING_INITIAL_SNAPSHOT state.",
+                  "properties": {
+                    "on_duration_warning_threshold_exceeded": {
+                      "description": "An optional list of system notification IDs to call when the duration of a run exceeds the threshold specified for the `RUN_DURATION_SECONDS` metric in the `health` field. A maximum of 3 destinations can be specified for the `on_duration_warning_threshold_exceeded` property.",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.Webhook",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "on_failure": {
+                      "description": "An optional list of system notification IDs to call when the run fails. A maximum of 3 destinations can be specified for the `on_failure` property.",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.Webhook",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "on_maintenance_complete": {
+                      "description": "An optional list of system notification IDs to call when platform-initiated maintenance completes for a continuous job.\nA maximum of 3 destinations can be specified for the `on_maintenance_complete` property.",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.Webhook",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "on_maintenance_start": {
+                      "description": "An optional list of system notification IDs to call when platform-initiated maintenance starts for a continuous job.\nA maximum of 3 destinations can be specified for the `on_maintenance_start` property.",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.Webhook",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "on_start": {
+                      "description": "An optional list of system notification IDs to call when the run starts. A maximum of 3 destinations can be specified for the `on_start` property.",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.Webhook",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "on_streaming_backlog_exceeded": {
+                      "description": "[Public Preview] An optional list of system notification IDs to call when any streaming backlog thresholds are exceeded for any stream.\nStreaming backlog thresholds can be set in the `health` field using the following metrics: `STREAMING_BACKLOG_BYTES`, `STREAMING_BACKLOG_RECORDS`, `STREAMING_BACKLOG_SECONDS`, or `STREAMING_BACKLOG_FILES`.\nAlerting is based on the 10-minute average of these metrics. If the issue persists, notifications are resent every 30 minutes.\nA maximum of 3 destinations can be specified for the `on_streaming_backlog_exceeded` property.",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.Webhook",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "on_success": {
+                      "description": "An optional list of system notification IDs to call when the run completes successfully. A maximum of 3 destinations can be specified for the `on_success` property.",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.Webhook",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
-                }
-              ]
-            },
-            "database.SyncedTableSchedulingPolicy": {
-              "oneOf": [
-                {
-                  "type": "string",
-                  "enum": [
-                    "CONTINUOUS",
-                    "TRIGGERED",
-                    "SNAPSHOT"
-                  ]
-                },
-                {
-                  "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "database.SyncedTableSpec": {
+            "ml.AggregationFunction": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "Specification of a synced database table.",
+                  "description": "An aggregation function applied over a time window.",
                   "properties": {
-                    "create_database_objects_if_missing": {
-                      "description": "If true, the synced table's logical database and schema resources in PG\nwill be created if they do not already exist.",
-                      "$ref": "#/$defs/bool"
+                    "approx_count_distinct": {
+                      "description": "Computes the approximate count of distinct values.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.ApproxCountDistinctFunction",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "approx_percentile": {
+                      "description": "Computes the approximate percentile of values.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.ApproxPercentileFunction",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "avg": {
+                      "description": "Computes the average of values.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.AvgFunction",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "count_function": {
+                      "description": "Computes the count of values.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.CountFunction",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "first": {
+                      "description": "Returns the first value.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.FirstFunction",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "first_distinct": {
+                      "description": "[Private Preview] Returns the first N distinct values, ordered by the feature's timeseries column.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.FirstDistinctFunction",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "first_n": {
+                      "description": "[Private Preview] Returns the first N values, ordered by the feature's timeseries column.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.FirstNFunction",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "existing_pipeline_id": {
-                      "description": "At most one of existing_pipeline_id and new_pipeline_spec should be defined.\n\nIf existing_pipeline_id is defined, the synced table will be bin packed into the existing pipeline\nreferenced. This avoids creating a new pipeline and allows sharing existing compute.\nIn this case, the scheduling_policy of this synced table must match the scheduling policy of the existing pipeline.",
-                      "$ref": "#/$defs/string"
+                    "last": {
+                      "description": "Returns the last value.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.LastFunction",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "new_pipeline_spec": {
-                      "description": "At most one of existing_pipeline_id and new_pipeline_spec should be defined.\n\nIf new_pipeline_spec is defined, a new pipeline is created for this synced table. The location pointed to is used\nto store intermediate files (checkpoints, event logs etc). The caller must have write permissions to create Delta\ntables in the specified catalog and schema. Again, note this requires write permissions, whereas the source table\nonly requires read permissions.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/database.NewPipelineSpec"
+                    "last_distinct": {
+                      "description": "[Private Preview] Returns the last N distinct values, ordered by the feature's timeseries column.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.LastDistinctFunction",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "primary_key_columns": {
-                      "description": "Primary Key columns to be used for data insert/update in the destination.",
-                      "$ref": "#/$defs/slice/string"
+                    "last_n": {
+                      "description": "[Private Preview] Returns the last N values, ordered by the feature's timeseries column.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.LastNFunction",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "scheduling_policy": {
-                      "description": "Scheduling policy of the underlying pipeline.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/database.SyncedTableSchedulingPolicy"
+                    "max": {
+                      "description": "Computes the maximum value.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.MaxFunction",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "source_table_full_name": {
-                      "description": "Three-part (catalog, schema, table) name of the source Delta table.",
-                      "$ref": "#/$defs/string"
+                    "min": {
+                      "description": "Computes the minimum value.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.MinFunction",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "timeseries_key": {
-                      "description": "Time series key to deduplicate (tie-break) rows with the same primary key.",
-                      "$ref": "#/$defs/string"
+                    "stddev_pop": {
+                      "description": "Computes the population standard deviation.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.StddevPopFunction",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "stddev_samp": {
+                      "description": "Computes the sample standard deviation.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.StddevSampFunction",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "sum": {
+                      "description": "Computes the sum of values.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.SumFunction",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "time_window": {
+                      "description": "The time window over which the aggregation is computed.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.TimeWindow",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "var_pop": {
+                      "description": "Computes the population variance.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.VarPopFunction",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "var_samp": {
+                      "description": "Computes the sample variance.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.VarSampFunction",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "database.SyncedTableState": {
+            "ml.ApproxCountDistinctFunction": {
               "oneOf": [
                 {
-                  "type": "string",
-                  "description": "The state of a synced table.",
-                  "enum": [
-                    "SYNCED_TABLE_PROVISIONING",
-                    "SYNCED_TABLE_PROVISIONING_PIPELINE_RESOURCES",
-                    "SYNCED_TABLE_PROVISIONING_INITIAL_SNAPSHOT",
-                    "SYNCED_TABLE_ONLINE",
-                    "SYNCED_TABLE_ONLINE_CONTINUOUS_UPDATE",
-                    "SYNCED_TABLE_ONLINE_TRIGGERED_UPDATE",
-                    "SYNCED_TABLE_ONLINE_NO_PENDING_UPDATE",
-                    "SYNCED_TABLED_OFFLINE",
-                    "SYNCED_TABLE_OFFLINE_FAILED",
-                    "SYNCED_TABLE_ONLINE_PIPELINE_FAILED",
-                    "SYNCED_TABLE_ONLINE_UPDATING_PIPELINE_RESOURCES"
+                  "type": "object",
+                  "description": "Computes the approximate count of distinct values.",
+                  "properties": {
+                    "input": {
+                      "description": "The input column from which the approximate count of distinct values is computed.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "relative_sd": {
+                      "description": "The maximum relative standard deviation allowed (default defined by Spark).",
+                      "$ref": "#/$defs/float64",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "input"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "database.SyncedTableStatus": {
+            "ml.ApproxPercentileFunction": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "Status of a synced table.",
+                  "description": "Computes the approximate percentile of values.",
                   "properties": {
-                    "continuous_update_status": {
-                      "description": "Detailed status of a synced table. Shown if the synced table is in the SYNCED_CONTINUOUS_UPDATE\nor the SYNCED_UPDATING_PIPELINE_RESOURCES state.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/database.SyncedTableContinuousUpdateStatus"
-                    },
-                    "failed_status": {
-                      "description": "Detailed status of a synced table. Shown if the synced table is in the OFFLINE_FAILED or the\nSYNCED_PIPELINE_FAILED state.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/database.SyncedTableFailedStatus"
+                    "accuracy": {
+                      "description": "The accuracy parameter (higher is more accurate but slower).",
+                      "$ref": "#/$defs/int64",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "provisioning_status": {
-                      "description": "Detailed status of a synced table. Shown if the synced table is in the\nPROVISIONING_PIPELINE_RESOURCES or the PROVISIONING_INITIAL_SNAPSHOT state.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/database.SyncedTableProvisioningStatus"
+                    "input": {
+                      "description": "The input column from which the approximate percentile is computed.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "triggered_update_status": {
-                      "description": "Detailed status of a synced table. Shown if the synced table is in the SYNCED_TRIGGERED_UPDATE\nor the SYNCED_NO_PENDING_UPDATE state.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/database.SyncedTableTriggeredUpdateStatus"
+                    "percentile": {
+                      "description": "The percentile value to compute (between 0 and 1).",
+                      "$ref": "#/$defs/float64",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
-                  "additionalProperties": false
+                  "additionalProperties": false,
+                  "required": [
+                    "input",
+                    "percentile"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "database.SyncedTableTriggeredUpdateStatus": {
+            "ml.AvgFunction": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "Detailed status of a synced table. Shown if the synced table is in the SYNCED_TRIGGERED_UPDATE\nor the SYNCED_NO_PENDING_UPDATE state.",
-                  "additionalProperties": false
+                  "description": "Computes the average of values.",
+                  "properties": {
+                    "input": {
+                      "description": "The input column from which the average is computed. For Kafka sources, use dot-prefixed path\nnotation (e.g., \"value.amount\"). For nested fields, the leaf node name is used.\nColon-prefixed notation (e.g., \"value:amount\") is supported for backwards\ncompatibility but is deprecated; migrate to dot notation.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "input"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "iam.PermissionLevel": {
+            "ml.ColumnIdentifier": {
               "oneOf": [
                 {
-                  "type": "string",
-                  "description": "Permission level",
-                  "enum": [
-                    "CAN_MANAGE",
-                    "CAN_RESTART",
-                    "CAN_ATTACH_TO",
-                    "IS_OWNER",
-                    "CAN_MANAGE_RUN",
-                    "CAN_VIEW",
-                    "CAN_READ",
-                    "CAN_RUN",
-                    "CAN_EDIT",
-                    "CAN_USE",
-                    "CAN_MANAGE_STAGING_VERSIONS",
-                    "CAN_MANAGE_PRODUCTION_VERSIONS",
-                    "CAN_EDIT_METADATA",
-                    "CAN_VIEW_METADATA",
-                    "CAN_BIND",
-                    "CAN_QUERY",
-                    "CAN_MONITOR",
-                    "CAN_CREATE",
-                    "CAN_MONITOR_ONLY",
-                    "CAN_CREATE_APP"
+                  "type": "object",
+                  "properties": {
+                    "variant_expr_path": {
+                      "description": "[Private Preview] String representation of the column name using dot-prefixed path notation.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "variant_expr_path"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.AlertTask": {
+            "ml.ColumnSelection": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "A ColumnSelection function, equivalent to the LAST() record of an entity over a lifetime window",
                   "properties": {
-                    "alert_id": {
-                      "description": "The alert_id is the canonical identifier of the alert.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "subscribers": {
-                      "description": "The subscribers receive alert evaluation result notifications after the alert task is completed.\nThe number of subscriptions is limited to 100.",
-                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.AlertTaskSubscriber"
-                    },
-                    "warehouse_id": {
-                      "description": "The warehouse_id identifies the warehouse settings used by the alert task.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "workspace_path": {
-                      "description": "The workspace_path is the path to the alert file in the workspace. The path:\n* must start with \"/Workspace\"\n* must be a normalized path.\nUser has to select only one of alert_id or workspace_path to identify the alert.",
-                      "$ref": "#/$defs/string"
+                    "column": {
+                      "description": "Column name from source to select as the feature value.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
-                  "additionalProperties": false
+                  "additionalProperties": false,
+                  "required": [
+                    "column"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.AlertTaskSubscriber": {
+            "ml.ContinuousWindow": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "Represents a subscriber that will receive alert notifications.\nA subscriber can be either a user (via email) or a notification destination (via destination_id).",
                   "properties": {
-                    "destination_id": {
-                      "$ref": "#/$defs/string"
+                    "offset": {
+                      "description": "[Private Preview] The offset of the continuous window (must be non-positive).",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "user_name": {
-                      "description": "A valid workspace email address.",
-                      "$ref": "#/$defs/string"
+                    "window_duration": {
+                      "description": "[Private Preview] The duration of the continuous window (must be positive).",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
-                  "additionalProperties": false
+                  "additionalProperties": false,
+                  "required": [
+                    "window_duration"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.AuthenticationMethod": {
+            "ml.CountFunction": {
               "oneOf": [
                 {
-                  "type": "string",
-                  "enum": [
-                    "OAUTH",
-                    "PAT"
+                  "type": "object",
+                  "description": "Computes the count of values.",
+                  "properties": {
+                    "input": {
+                      "description": "The input column from which the count is computed. For Kafka sources, use dot-prefixed path\nnotation (e.g., \"value.amount\"). For nested fields, the leaf node name is used.\nColon-prefixed notation (e.g., \"value:amount\") is supported for backwards\ncompatibility but is deprecated; migrate to dot notation.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "input"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.CleanRoomsNotebookTask": {
+            "ml.CustomUdf": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "Clean Rooms notebook task for V1 Clean Room service (GA).\nReplaces the deprecated CleanRoomNotebookTask (defined above) which was for V0 service.",
+                  "description": "A CustomUdf function applies a registered Unity Catalog function row-wise to\nsource columns, producing a single output column per row.",
                   "properties": {
-                    "clean_room_name": {
-                      "description": "The clean room that the notebook belongs to.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "etag": {
-                      "description": "Checksum to validate the freshness of the notebook resource (i.e. the notebook being run is the latest version).\nIt can be fetched by calling the :method:cleanroomassets/get API.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "notebook_base_parameters": {
-                      "description": "Base parameters to be used for the clean room notebook job.",
-                      "$ref": "#/$defs/map/string"
+                    "function_path": {
+                      "description": "[Private Preview] Fully qualified 3-part Unity Catalog path of the function to apply.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "notebook_name": {
-                      "description": "Name of the notebook being run.",
-                      "$ref": "#/$defs/string"
+                    "input_bindings": {
+                      "description": "[Private Preview] Binds each UC function parameter to a source column.\nMay be empty for zero-argument functions (e.g. a timestamp generator).",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/ml.InputBinding",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "clean_room_name",
-                    "notebook_name"
+                    "function_path"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.Compute": {
+            "ml.DataSource": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Specifies the data source backing a feature. Exactly one source type must be set.",
                   "properties": {
-                    "hardware_accelerator": {
-                      "description": "Hardware accelerator configuration for Serverless GPU workloads.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.HardwareAcceleratorType"
+                    "delta_table_source": {
+                      "description": "A Delta table data source.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.DeltaTableSource",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "feature_view_source": {
+                      "description": "[Private Preview] A data source composed from registered upstream Features.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.FeatureViewSource",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "kafka_source": {
+                      "description": "A Kafka stream data source.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.KafkaSource",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "lateness": {
+                      "description": "[Private Preview] Completeness timing for this Feature's use of the source. This configuration is part of the\nFeature definition; it does not modify the underlying table or stream.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.SourceLateness",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "request_source": {
+                      "description": "A request-time data source.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.RequestSource",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "stream_source": {
+                      "description": "A Stream data source.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.StreamSource",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.ComputeConfig": {
+            "ml.DeltaTableSource": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "gpu_node_pool_id": {
-                      "description": "IDof the GPU pool to use.",
-                      "$ref": "#/$defs/string"
+                    "dataframe_schema": {
+                      "description": "Schema of the resulting dataframe after transformations, in Spark StructType JSON format (from df.schema.json()).\nRequired if transformation_sql is specified.\nExample: {\"type\":\"struct\",\"fields\":[{\"name\":\"col_a\",\"type\":\"integer\",\"nullable\":true,\"metadata\":{}},{\"name\":\"col_c\",\"type\":\"integer\",\"nullable\":true,\"metadata\":{}}]}",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "gpu_type": {
-                      "description": "GPU type.",
-                      "$ref": "#/$defs/string"
+                    "entity_columns": {
+                      "description": "[Private Preview]",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "deprecationMessage": "This field is deprecated",
+                      "doNotSuggest": true,
+                      "deprecated": true
                     },
-                    "num_gpus": {
-                      "description": "Number of GPUs.",
-                      "$ref": "#/$defs/int"
+                    "filter_condition": {
+                      "description": "Single WHERE clause to filter delta table before applying transformations. Will be row-wise evaluated, so should only include conditionals and projections.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "full_name": {
+                      "description": "The full three-part (catalog, schema, table) name of the Delta table.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "timeseries_column": {
+                      "description": "[Private Preview]",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "deprecationMessage": "This field is deprecated",
+                      "doNotSuggest": true,
+                      "deprecated": true
+                    },
+                    "transformation_sql": {
+                      "description": "A single SQL SELECT expression applied after filter_condition.\nShould contains all the columns needed (eg. \"SELECT *, col_a + col_b AS col_c FROM x.y.z WHERE col_a \u003e 0\" would have `transformation_sql` \"*, col_a + col_b AS col_c\")\nIf transformation_sql is not provided, all columns of the delta table are present in the DataSource dataframe.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "num_gpus"
-                  ]
-                },
-                {
-                  "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
-                }
-              ]
-            },
-            "jobs.Condition": {
-              "oneOf": [
-                {
-                  "type": "string",
-                  "enum": [
-                    "ANY_UPDATED",
-                    "ALL_UPDATED"
+                    "full_name"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.ConditionTask": {
+            "ml.EntityColumn": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "left": {
-                      "description": "The left operand of the condition task. Can be either a string value or a job state or parameter reference.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "op": {
-                      "description": "* `EQUAL_TO`, `NOT_EQUAL` operators perform string comparison of their operands. This means that `“12.0” == “12”` will evaluate to `false`.\n* `GREATER_THAN`, `GREATER_THAN_OR_EQUAL`, `LESS_THAN`, `LESS_THAN_OR_EQUAL` operators perform numeric comparison of their operands. `“12.0” \u003e= “12”` will evaluate to `true`, `“10.0” \u003e= “12”` will evaluate to `false`.\n\nThe boolean comparison to task values can be implemented with operators `EQUAL_TO`, `NOT_EQUAL`. If a task value was set to a boolean value, it will be serialized to `“true”` or `“false”` for the comparison.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.ConditionTaskOp"
-                    },
-                    "right": {
-                      "description": "The right operand of the condition task. Can be either a string value or a job state or parameter reference.",
-                      "$ref": "#/$defs/string"
+                    "name": {
+                      "description": "The name of the entity column. For Kafka sources, use dot-prefixed path notation to reference\nfields within the key or value schema (e.g., \"value.user_id\", \"key.partition_key\"). For nested\nfields, the leaf node name (e.g., \"user_id\" from \"value.trip_details.user_id\") is what will\nbe present in materialized tables and expected to match at query time.\nColon-prefixed notation (e.g., \"value:user_id\") is supported for backwards\ncompatibility but is deprecated; migrate to dot notation.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "left",
-                    "op",
-                    "right"
+                    "name"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.ConditionTaskOp": {
+            "ml.ExperimentPermissionLevel": {
               "oneOf": [
                 {
                   "type": "string",
-                  "description": "* `EQUAL_TO`, `NOT_EQUAL` operators perform string comparison of their operands. This means that `“12.0” == “12”` will evaluate to `false`.\n* `GREATER_THAN`, `GREATER_THAN_OR_EQUAL`, `LESS_THAN`, `LESS_THAN_OR_EQUAL` operators perform numeric comparison of their operands. `“12.0” \u003e= “12”` will evaluate to `true`, `“10.0” \u003e= “12”` will evaluate to `false`.\n\nThe boolean comparison to task values can be implemented with operators `EQUAL_TO`, `NOT_EQUAL`. If a task value was set to a boolean value, it will be serialized to `“true”` or `“false”` for the comparison.",
+                  "description": "Permission level",
                   "enum": [
-                    "EQUAL_TO",
-                    "GREATER_THAN",
-                    "GREATER_THAN_OR_EQUAL",
-                    "LESS_THAN",
-                    "LESS_THAN_OR_EQUAL",
-                    "NOT_EQUAL"
+                    "CAN_MANAGE",
+                    "CAN_EDIT",
+                    "CAN_READ"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "ml.ExperimentTag": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "A tag for an experiment.",
+                  "properties": {
+                    "key": {
+                      "description": "The tag key.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "value": {
+                      "description": "The tag value.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.Continuous": {
+            "ml.ExperimentTraceLocation": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "The storage location for an experiment's traces.",
                   "properties": {
-                    "pause_status": {
-                      "description": "Indicate whether the continuous execution of the job is paused or not. Defaults to UNPAUSED.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PauseStatus"
-                    },
-                    "task_retry_mode": {
-                      "description": "Indicate whether the continuous job is applying task level retries or not. Defaults to NEVER.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.TaskRetryMode"
+                    "uc_trace_location": {
+                      "description": "[Private Preview] A Unity Catalog schema where the experiment's traces are stored as\nDelta tables.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.UcTraceLocation",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.CronSchedule": {
+            "ml.FeatureReference": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "A reference to one registered upstream Feature. A message rather than a bare name so an\nupstream can later be pinned more precisely (e.g. by version) without a breaking type change.",
                   "properties": {
-                    "pause_status": {
-                      "description": "Indicate whether this schedule is paused or not.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PauseStatus"
-                    },
-                    "quartz_cron_expression": {
-                      "description": "A Cron expression using Quartz syntax that describes the schedule for a job. See [Cron Trigger](http://www.quartz-scheduler.org/documentation/quartz-2.3.0/tutorials/crontrigger.html) for details. This field is required.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "timezone_id": {
-                      "description": "A Java timezone ID. The schedule for a job is resolved with respect to this timezone. See [Java TimeZone](https://docs.oracle.com/javase/7/docs/api/java/util/TimeZone.html) for details. This field is required.",
-                      "$ref": "#/$defs/string"
+                    "feature": {
+                      "description": "[Private Preview] The three-part full name of the upstream Feature.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "quartz_cron_expression",
-                    "timezone_id"
+                    "feature"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.DashboardTask": {
+            "ml.FeatureViewSource": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "Configures the Lakeview Dashboard job task type.",
+                  "description": "A data source composed from registered upstream Features.",
                   "properties": {
-                    "dashboard_id": {
-                      "$ref": "#/$defs/string"
-                    },
-                    "filters": {
-                      "description": "Dashboard task parameters. Used to apply dashboard filter values during dashboard task execution. Parameter values get applied to any dashboard filters that have a matching URL identifier as the parameter key.\nThe parameter value format is dependent on the filter type:\n- For text and single-select filters, provide a single value (e.g. `\"value\"`)\n- For date and datetime filters, provide the value in ISO 8601 format (e.g. `\"2000-01-01T00:00:00\"`)\n- For multi-select filters, provide a JSON array of values (e.g. `\"[\\\"value1\\\",\\\"value2\\\"]\"`)\n- For range and date range filters, provide a JSON object with `start` and `end` (e.g. `\"{\\\"start\\\":\\\"1\\\",\\\"end\\\":\\\"10\\\"}\"`)",
-                      "$ref": "#/$defs/map/string",
-                      "x-databricks-preview": "PRIVATE",
+                    "feature_references": {
+                      "description": "[Private Preview] The upstream Features this source reads. Must include at least one feature.",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/ml.FeatureReference",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
                       "doNotSuggest": true
-                    },
-                    "subscription": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.Subscription"
-                    },
-                    "warehouse_id": {
-                      "description": "Optional: The warehouse id to execute the dashboard with for the schedule.\nIf not specified, the default warehouse of the dashboard will be used.",
-                      "$ref": "#/$defs/string"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.DbtCloudTask": {
+            "ml.FieldDefinition": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "Deprecated in favor of DbtPlatformTask",
+                  "description": "A single field definition within a FlatSchema, specifying the field name and its scalar data type.\nDoes not support nested or complex types (arrays, maps, structs).",
                   "properties": {
-                    "connection_resource_name": {
-                      "description": "The resource name of the UC connection that authenticates the dbt Cloud for this task",
-                      "$ref": "#/$defs/string"
+                    "data_type": {
+                      "description": "The scalar data type of the field.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.ScalarDataType",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "dbt_cloud_job_id": {
-                      "description": "Id of the dbt Cloud job to be triggered",
-                      "$ref": "#/$defs/int64"
+                    "name": {
+                      "description": "The name of the field.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
-                  "additionalProperties": false
+                  "additionalProperties": false,
+                  "required": [
+                    "data_type",
+                    "name"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.DbtPlatformTask": {
+            "ml.FirstDistinctFunction": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Returns the first N distinct values, ordered by the feature's timeseries column.",
                   "properties": {
-                    "connection_resource_name": {
-                      "description": "The resource name of the UC connection that authenticates the dbt platform for this task",
-                      "$ref": "#/$defs/string"
+                    "input": {
+                      "description": "[Private Preview] The input column from which the first N distinct values are returned.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "dbt_platform_job_id": {
-                      "description": "Id of the dbt platform job to be triggered. Specified as a string for maximum compatibility with clients.",
-                      "$ref": "#/$defs/string"
+                    "n": {
+                      "description": "[Private Preview] The number of distinct values to return.",
+                      "$ref": "#/$defs/int64",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
-                  "additionalProperties": false
+                  "additionalProperties": false,
+                  "required": [
+                    "input",
+                    "n"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.DbtTask": {
+            "ml.FirstFunction": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Returns the first value.",
                   "properties": {
-                    "catalog": {
-                      "description": "Optional name of the catalog to use. The value is the top level in the 3-level namespace of Unity Catalog (catalog / schema / relation). The catalog value can only be specified if a warehouse_id is specified. Requires dbt-databricks \u003e= 1.1.1.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "commands": {
-                      "description": "A list of dbt commands to execute. All commands must start with `dbt`. This parameter must not be empty. A maximum of up to 10 commands can be provided.",
-                      "$ref": "#/$defs/slice/string"
-                    },
-                    "profiles_directory": {
-                      "description": "Optional (relative) path to the profiles directory. Can only be specified if no warehouse_id is specified. If no warehouse_id is specified and this folder is unset, the root directory is used.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "project_directory": {
-                      "description": "Path to the project directory. Optional for Git sourced tasks, in which\ncase if no value is provided, the root of the Git repository is used.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "schema": {
-                      "description": "Optional schema to write to. This parameter is only used when a warehouse_id is also provided. If not provided, the `default` schema is used.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "source": {
-                      "description": "Optional location type of the project directory. When set to `WORKSPACE`, the project will be retrieved\nfrom the local Databricks workspace. When set to `GIT`, the project will be retrieved from a Git repository\ndefined in `git_source`. If the value is empty, the task will use `GIT` if `git_source` is defined and `WORKSPACE` otherwise.\n\n* `WORKSPACE`: Project is located in Databricks workspace.\n* `GIT`: Project is located in cloud Git provider.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.Source"
-                    },
-                    "warehouse_id": {
-                      "description": "ID of the SQL warehouse to connect to. If provided, we automatically generate and provide the profile and connection details to dbt. It can be overridden on a per-command basis by using the `--profiles-dir` command line argument.",
-                      "$ref": "#/$defs/string"
+                    "input": {
+                      "description": "The input column from which the first value is returned.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "commands"
+                    "input"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.FileArrivalTriggerConfiguration": {
+            "ml.FirstNFunction": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Returns the first N values, ordered by the feature's timeseries column.",
                   "properties": {
-                    "min_time_between_triggers_seconds": {
-                      "description": "If set, the trigger starts a run only after the specified amount of time passed since\nthe last time the trigger fired. The minimum allowed value is 60 seconds",
-                      "$ref": "#/$defs/int"
-                    },
-                    "url": {
-                      "description": "URL to be monitored for file arrivals. The path must point to the root or a subpath of the external location.",
-                      "$ref": "#/$defs/string"
+                    "input": {
+                      "description": "[Private Preview] The input column from which the first N values are returned.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "wait_after_last_change_seconds": {
-                      "description": "If set, the trigger starts a run only after no file activity has occurred for the specified amount of time.\nThis makes it possible to wait for a batch of incoming files to arrive before triggering a run. The\nminimum allowed value is 60 seconds.",
-                      "$ref": "#/$defs/int"
+                    "n": {
+                      "description": "[Private Preview] The number of values to return.",
+                      "$ref": "#/$defs/int64",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "url"
+                    "input",
+                    "n"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.ForEachTask": {
+            "ml.FlatSchema": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "A flat (non-nested) schema for request-time fields, defined as an ordered list of field definitions.\nThis schema only supports scalar types.",
                   "properties": {
-                    "concurrency": {
-                      "description": "An optional maximum allowed number of concurrent runs of the task.\nSet this value if you want to be able to execute multiple runs of the task concurrently.",
-                      "$ref": "#/$defs/int"
-                    },
-                    "inputs": {
-                      "description": "Array for task to iterate on. This can be a JSON string or a reference to\nan array parameter.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "task": {
-                      "description": "Configuration for the task that will be run for each element in the array",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.Task"
+                    "fields": {
+                      "description": "The list of fields in this schema.",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/ml.FieldDefinition",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "inputs",
-                    "task"
+                    "fields"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.Format": {
+            "ml.Function": {
               "oneOf": [
                 {
-                  "type": "string",
-                  "enum": [
-                    "SINGLE_TASK",
-                    "MULTI_TASK"
-                  ]
+                  "type": "object",
+                  "properties": {
+                    "aggregation_function": {
+                      "description": "An aggregation function applied over a time window.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.AggregationFunction",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "column_selection": {
+                      "description": "Selects the latest value of a single column in a data source",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.ColumnSelection",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "custom_udf": {
+                      "description": "[Private Preview] Applies a registered Unity Catalog function row-wise to source columns.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.CustomUdf",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "extra_parameters": {
+                      "description": "[Private Preview]",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/ml.FunctionExtraParameter",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "deprecationMessage": "This field is deprecated",
+                      "doNotSuggest": true,
+                      "deprecated": true
+                    },
+                    "function_type": {
+                      "description": "[Private Preview]",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.FunctionFunctionType",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "deprecationMessage": "This field is deprecated",
+                      "doNotSuggest": true,
+                      "deprecated": true
+                    }
+                  },
+                  "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.GenAiComputeTask": {
+            "ml.FunctionExtraParameter": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "command": {
-                      "description": "Command launcher to run the actual script, e.g. bash, python etc.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "compute": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.ComputeConfig"
-                    },
-                    "dl_runtime_image": {
-                      "description": "Runtime image",
-                      "$ref": "#/$defs/string"
-                    },
-                    "mlflow_experiment_name": {
-                      "description": "Optional string containing the name of the MLflow experiment to log the run to. If name is not\nfound, backend will create the mlflow experiment using the name.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "source": {
-                      "description": "Optional location type of the training script. When set to `WORKSPACE`, the script will be retrieved from the local Databricks workspace. When set to `GIT`, the script will be retrieved from a Git repository\ndefined in `git_source`. If the value is empty, the task will use `GIT` if `git_source` is defined and `WORKSPACE` otherwise.\n* `WORKSPACE`: Script is located in Databricks workspace.\n* `GIT`: Script is located in cloud Git provider.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.Source"
-                    },
-                    "training_script_path": {
-                      "description": "The training script file path to be executed. Cloud file URIs (such as dbfs:/, s3:/, adls:/, gcs:/) and workspace paths are supported. For python files stored in the Databricks workspace, the path must be absolute and begin with `/`. For files stored in a remote repository, the path must be relative. This field is required.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "yaml_parameters": {
-                      "description": "Optional string containing model parameters passed to the training script in yaml format.\nIf present, then the content in yaml_parameters_file_path will be ignored.",
-                      "$ref": "#/$defs/string"
+                    "key": {
+                      "description": "[Private Preview] The name of the parameter.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "yaml_parameters_file_path": {
-                      "description": "Optional path to a YAML file containing model parameters passed to the training script.",
-                      "$ref": "#/$defs/string"
+                    "value": {
+                      "description": "[Private Preview] The value of the parameter.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "dl_runtime_image"
+                    "key",
+                    "value"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.GitProvider": {
+            "ml.FunctionFunctionType": {
               "oneOf": [
                 {
                   "type": "string",
                   "enum": [
-                    "gitHub",
-                    "bitbucketCloud",
-                    "azureDevOpsServices",
-                    "gitHubEnterprise",
-                    "bitbucketServer",
-                    "gitLab",
-                    "gitLabEnterpriseEdition",
-                    "awsCodeCommit"
+                    "FUNCTION_TYPE_UNSPECIFIED",
+                    "AVG",
+                    "COUNT",
+                    "SUM",
+                    "MIN",
+                    "MAX",
+                    "FIRST",
+                    "LAST",
+                    "APPROX_COUNT_DISTINCT",
+                    "APPROX_PERCENTILE",
+                    "STDDEV_POP",
+                    "STDDEV_SAMP",
+                    "VAR_POP",
+                    "VAR_SAMP"
+                  ],
+                  "enumDescriptions": [
+                    "[Private Preview]",
+                    "[Private Preview]",
+                    "[Private Preview]",
+                    "[Private Preview]",
+                    "[Private Preview]",
+                    "[Private Preview]",
+                    "[Private Preview]",
+                    "[Private Preview]",
+                    "[Private Preview]",
+                    "[Private Preview]",
+                    "[Private Preview]",
+                    "[Private Preview]",
+                    "[Private Preview]",
+                    "[Private Preview]"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.GitSnapshot": {
+            "ml.InputBinding": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "Read-only state of the remote repository at the time the job was run. This field is only included on job runs.",
+                  "description": "Binds a single UC function parameter to a source column.",
                   "properties": {
-                    "used_commit": {
-                      "description": "Commit that was used to execute the run. If git_branch was specified, this points to the HEAD of the branch at the time of the run; if git_tag was specified, this points to the commit the tag points to.",
-                      "$ref": "#/$defs/string"
+                    "column": {
+                      "description": "[Private Preview] Source column whose value is passed for this parameter at execution time.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "parameter": {
+                      "description": "[Private Preview] Name of the UC function parameter.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
-                  "additionalProperties": false
+                  "additionalProperties": false,
+                  "required": [
+                    "column",
+                    "parameter"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.GitSource": {
+            "ml.JobContext": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "An optional specification for a remote Git repository containing the source code used by tasks. Version-controlled source code is supported by notebook, dbt, Python script, and SQL File tasks.\n\nIf `git_source` is set, these tasks retrieve the file from the remote repository by default. However, this behavior can be overridden by setting `source` to `WORKSPACE` on the task.\n\nNote: dbt and SQL File tasks support only version-controlled sources. If dbt or SQL File tasks are used, `git_source` must be defined on the job.",
                   "properties": {
-                    "git_branch": {
-                      "description": "Name of the branch to be checked out and used by this job. This field cannot be specified in conjunction with git_tag or git_commit.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "git_commit": {
-                      "description": "Commit to be checked out and used by this job. This field cannot be specified in conjunction with git_branch or git_tag.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "git_provider": {
-                      "description": "Unique identifier of the service used to host the Git repository. The value is case insensitive.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.GitProvider"
-                    },
-                    "git_tag": {
-                      "description": "Name of the tag to be checked out and used by this job. This field cannot be specified in conjunction with git_branch or git_commit.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "git_url": {
-                      "description": "URL of the repository to be cloned by this job.",
-                      "$ref": "#/$defs/string"
+                    "job_id": {
+                      "description": "[Private Preview] The job ID where this API invoked.",
+                      "$ref": "#/$defs/int64",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "sparse_checkout": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SparseCheckout"
+                    "job_run_id": {
+                      "description": "[Private Preview] The job run ID where this API was invoked.",
+                      "$ref": "#/$defs/int64",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
-                  "additionalProperties": false,
-                  "required": [
-                    "git_provider",
-                    "git_url"
-                  ]
+                  "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.JobCluster": {
+            "ml.KafkaSource": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "job_cluster_key": {
-                      "description": "A unique name for the job cluster. This field is required and must be unique within the job.\n`JobTaskSettings` may refer to this field to determine which cluster to launch for the task execution.",
-                      "$ref": "#/$defs/string"
+                    "entity_column_identifiers": {
+                      "description": "[Private Preview]",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/ml.ColumnIdentifier",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "deprecationMessage": "This field is deprecated",
+                      "doNotSuggest": true,
+                      "deprecated": true
                     },
-                    "new_cluster": {
-                      "description": "If new_cluster, a description of a cluster that is created for each task.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.ClusterSpec"
+                    "filter_condition": {
+                      "description": "The filter condition applied to the source data before aggregation.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "name": {
+                      "description": "Name of the Kafka source, used to identify it. This is used to look up the corresponding KafkaConfig object. Can be distinct from topic name.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "timeseries_column_identifier": {
+                      "description": "[Private Preview]",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.ColumnIdentifier",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "deprecationMessage": "This field is deprecated",
+                      "doNotSuggest": true,
+                      "deprecated": true
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "job_cluster_key",
-                    "new_cluster"
+                    "name"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.JobDeployment": {
+            "ml.LastDistinctFunction": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Returns the last N distinct values, ordered by the feature's timeseries column.",
                   "properties": {
-                    "kind": {
-                      "description": "The kind of deployment that manages the job.\n\n* `BUNDLE`: The job is managed by Databricks Asset Bundle.\n* `SYSTEM_MANAGED`: The job is managed by Databricks and is read-only.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobDeploymentKind"
+                    "input": {
+                      "description": "[Private Preview] The input column from which the last N distinct values are returned.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "metadata_file_path": {
-                      "description": "Path of the file that contains deployment metadata.",
-                      "$ref": "#/$defs/string"
+                    "n": {
+                      "description": "[Private Preview] The number of distinct values to return.",
+                      "$ref": "#/$defs/int64",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "kind"
+                    "input",
+                    "n"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.JobDeploymentKind": {
+            "ml.LastFunction": {
               "oneOf": [
                 {
-                  "type": "string",
-                  "description": "* `BUNDLE`: The job is managed by Databricks Asset Bundle.\n* `SYSTEM_MANAGED`: The job is managed by Databricks and is read-only.",
-                  "enum": [
-                    "BUNDLE",
-                    "SYSTEM_MANAGED"
+                  "type": "object",
+                  "description": "Returns the last value.",
+                  "properties": {
+                    "input": {
+                      "description": "The input column from which the last value is returned.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "input"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.JobEditMode": {
+            "ml.LastNFunction": {
               "oneOf": [
                 {
-                  "type": "string",
-                  "description": "Edit mode of the job.\n\n* `UI_LOCKED`: The job is in a locked UI state and cannot be modified.\n* `EDITABLE`: The job is in an editable state and can be modified.",
-                  "enum": [
-                    "UI_LOCKED",
-                    "EDITABLE"
+                  "type": "object",
+                  "description": "Returns the last N values, ordered by the feature's timeseries column.",
+                  "properties": {
+                    "input": {
+                      "description": "[Private Preview] The input column from which the last N values are returned.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "n": {
+                      "description": "[Private Preview] The number of values to return.",
+                      "$ref": "#/$defs/int64",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "input",
+                    "n"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.JobEmailNotifications": {
+            "ml.LineageContext": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Lineage context information for tracking where an API was invoked. This will allow us to track lineage, which currently uses caller entity information for use across the Lineage Client and Observability in Lumberjack.",
                   "properties": {
-                    "no_alert_for_skipped_runs": {
-                      "description": "If true, do not send email to recipients specified in `on_failure` if the run is skipped.\nThis field is `deprecated`. Please use the `notification_settings.no_alert_for_skipped_runs` field.",
-                      "$ref": "#/$defs/bool",
-                      "deprecationMessage": "This field is deprecated",
-                      "deprecated": true
-                    },
-                    "on_duration_warning_threshold_exceeded": {
-                      "description": "A list of email addresses to be notified when the duration of a run exceeds the threshold specified for the `RUN_DURATION_SECONDS` metric in the `health` field. If no rule for the `RUN_DURATION_SECONDS` metric is specified in the `health` field for the job, notifications are not sent.",
-                      "$ref": "#/$defs/slice/string"
-                    },
-                    "on_failure": {
-                      "description": "A list of email addresses to be notified when a run unsuccessfully completes. A run is considered to have completed unsuccessfully if it ends with an `INTERNAL_ERROR` `life_cycle_state` or a `FAILED`, or `TIMED_OUT` result_state. If this is not specified on job creation, reset, or update the list is empty, and notifications are not sent.",
-                      "$ref": "#/$defs/slice/string"
-                    },
-                    "on_start": {
-                      "description": "A list of email addresses to be notified when a run begins. If not specified on job creation, reset, or update, the list is empty, and notifications are not sent.",
-                      "$ref": "#/$defs/slice/string"
-                    },
-                    "on_streaming_backlog_exceeded": {
-                      "description": "A list of email addresses to notify when any streaming backlog thresholds are exceeded for any stream.\nStreaming backlog thresholds can be set in the `health` field using the following metrics: `STREAMING_BACKLOG_BYTES`, `STREAMING_BACKLOG_RECORDS`, `STREAMING_BACKLOG_SECONDS`, or `STREAMING_BACKLOG_FILES`.\nAlerting is based on the 10-minute average of these metrics. If the issue persists, notifications are resent every 30 minutes.",
-                      "$ref": "#/$defs/slice/string"
+                    "job_context": {
+                      "description": "[Private Preview] Job context information including job ID and run ID.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.JobContext",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "on_success": {
-                      "description": "A list of email addresses to be notified when a run successfully completes. A run is considered to have completed successfully if it ends with a `TERMINATED` `life_cycle_state` and a `SUCCESS` result_state. If not specified on job creation, reset, or update, the list is empty, and notifications are not sent.",
-                      "$ref": "#/$defs/slice/string"
+                    "notebook_id": {
+                      "description": "[Private Preview] The notebook ID where this API was invoked.",
+                      "$ref": "#/$defs/int64",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.JobEnvironment": {
+            "ml.MaxFunction": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Computes the maximum value.",
                   "properties": {
-                    "environment_key": {
-                      "description": "The key of an environment. It has to be unique within a job.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "spec": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.Environment"
+                    "input": {
+                      "description": "The input column from which the maximum is computed.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "environment_key"
+                    "input"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.JobNotificationSettings": {
+            "ml.MinFunction": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Computes the minimum value.",
                   "properties": {
-                    "no_alert_for_canceled_runs": {
-                      "description": "If true, do not send notifications to recipients specified in `on_failure` if the run is canceled.",
-                      "$ref": "#/$defs/bool"
-                    },
-                    "no_alert_for_skipped_runs": {
-                      "description": "If true, do not send notifications to recipients specified in `on_failure` if the run is skipped.",
-                      "$ref": "#/$defs/bool"
+                    "input": {
+                      "description": "The input column from which the minimum is computed.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
-                  "additionalProperties": false
+                  "additionalProperties": false,
+                  "required": [
+                    "input"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.JobParameterDefinition": {
+            "ml.ModelTag": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Tag for a registered model",
                   "properties": {
-                    "default": {
-                      "description": "Default value of the parameter.",
-                      "$ref": "#/$defs/string"
+                    "key": {
+                      "description": "The tag key.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "name": {
-                      "description": "The name of the defined parameter. May only contain alphanumeric characters, `_`, `-`, and `.`",
-                      "$ref": "#/$defs/string"
+                    "value": {
+                      "description": "The tag value.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
-                  "additionalProperties": false,
-                  "required": [
-                    "default",
-                    "name"
-                  ]
+                  "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.JobPermissionLevel": {
+            "ml.RegisteredModelPermissionLevel": {
               "oneOf": [
                 {
                   "type": "string",
                   "description": "Permission level",
                   "enum": [
                     "CAN_MANAGE",
-                    "IS_OWNER",
-                    "CAN_MANAGE_RUN",
-                    "CAN_VIEW"
+                    "CAN_MANAGE_PRODUCTION_VERSIONS",
+                    "CAN_MANAGE_STAGING_VERSIONS",
+                    "CAN_EDIT",
+                    "CAN_READ"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.JobRunAs": {
+            "ml.RequestSource": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "Write-only setting. Specifies the user or service principal that the job runs as. If not specified, the job runs as the user who created the job.\n\nEither `user_name` or `service_principal_name` should be specified. If not, an error is thrown.",
+                  "description": "A request-time data source whose value is provided at inference time: offline batch scoring or online serving endpoint",
                   "properties": {
-                    "group_name": {
-                      "description": "Group name of an account group assigned to the workspace. Setting this field requires being a member of the group.",
+                    "dataframe_schema": {
+                      "description": "[Private Preview] A schema containing scalar or nested fields, in Spark StructType JSON format\n(from df.schema.json()). This preserves field, array-element, and map-value nullability.",
                       "$ref": "#/$defs/string",
-                      "x-databricks-preview": "PRIVATE",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
                       "doNotSuggest": true
                     },
-                    "service_principal_name": {
-                      "description": "The application ID of an active service principal. Setting this field requires the `servicePrincipal/user` role.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "user_name": {
-                      "description": "The email of an active workspace user. Non-admin users can only set this field to their own email.",
-                      "$ref": "#/$defs/string"
+                    "flat_schema": {
+                      "description": "A flat schema with scalar-typed fields only.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.FlatSchema",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.JobSource": {
+            "ml.RollingWindow": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "The source of the job specification in the remote repository when the job is source controlled.",
+                  "description": "A rolling time window with an optional non-negative delay.",
                   "properties": {
-                    "dirty_state": {
-                      "description": "Dirty state indicates the job is not fully synced with the job specification in the remote repository.\n\nPossible values are:\n* `NOT_SYNCED`: The job is not yet synced with the remote job specification. Import the remote job specification from UI to make the job fully synced.\n* `DISCONNECTED`: The job is temporary disconnected from the remote job specification and is allowed for live edit. Import the remote job specification again from UI to make the job fully synced.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobSourceDirtyState"
+                    "delay": {
+                      "description": "Non-negative analytic lag that evaluates the window this far in the past. Use this for timing\nvariations unrelated to source lateness, such as a 30-day count as of one week ago. If unset,\nthe analytic lag is zero. It composes with source.lateness when both are set.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/common/types/duration.Duration",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "import_from_git_branch": {
-                      "description": "Name of the branch which the job is imported from.",
-                      "$ref": "#/$defs/string"
+                    "window_duration": {
+                      "description": "The duration of the rolling window. Must be positive when set; absent means lifetime\n(aggregate over the entity's entire history).",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/common/types/duration.Duration",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "ml.SawtoothWindow": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "A sawtooth window served via the hybrid batch + streaming path. The batch pipeline maintains\ndaily partial aggregates for the bulk of the window while the streaming pipeline maintains the\nmost recent day(s), and serving merges them on read. Same field shape as RollingWindow, but a\ndistinct type so the control plane can explicitly identify hybrid (sawtooth) features rather\nthan inferring hybrid behavior from window_duration.",
+                  "properties": {
+                    "delay": {
+                      "description": "[Private Preview] Delay is not currently supported for Sawtooth windows.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/common/types/duration.Duration",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "job_config_path": {
-                      "description": "Path of the job YAML file that contains the job specification.",
-                      "$ref": "#/$defs/string"
+                    "window_duration": {
+                      "description": "[Private Preview] The duration of the window. Must be positive and span more than two days when set, so that both\nthe batch (N-1 day) and stale-path (N-2 day) partial aggregates are well defined. The duration\nneed not be a whole number of days (e.g. 3 days 15 minutes is allowed). Absent means lifetime\n(aggregate over the entity's entire history).",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/common/types/duration.Duration",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
-                  "additionalProperties": false,
-                  "required": [
-                    "import_from_git_branch",
-                    "job_config_path"
-                  ]
+                  "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.JobSourceDirtyState": {
+            "ml.ScalarDataType": {
               "oneOf": [
                 {
                   "type": "string",
-                  "description": "Dirty state indicates the job is not fully synced with the job specification\nin the remote repository.\n\nPossible values are:\n* `NOT_SYNCED`: The job is not yet synced with the remote job specification. Import the remote job specification from UI to make the job fully synced.\n* `DISCONNECTED`: The job is temporary disconnected from the remote job specification and is allowed for live edit. Import the remote job specification again from UI to make the job fully synced.",
+                  "description": "Scalar data types for request-time field definitions.\nOnly flat (non-nested) types are supported.",
                   "enum": [
-                    "NOT_SYNCED",
-                    "DISCONNECTED"
+                    "INTEGER",
+                    "FLOAT",
+                    "BOOLEAN",
+                    "STRING",
+                    "DOUBLE",
+                    "LONG",
+                    "TIMESTAMP",
+                    "DATE",
+                    "SHORT",
+                    "BINARY",
+                    "DECIMAL"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.JobsHealthMetric": {
+            "ml.SlidingWindow": {
               "oneOf": [
                 {
-                  "type": "string",
-                  "description": "Specifies the health metric that is being evaluated for a particular health rule.\n\n* `RUN_DURATION_SECONDS`: Expected total time for a run in seconds.\n* `STREAMING_BACKLOG_BYTES`: An estimate of the maximum bytes of data waiting to be consumed across all streams. This metric is in Public Preview.\n* `STREAMING_BACKLOG_RECORDS`: An estimate of the maximum offset lag across all streams. This metric is in Public Preview.\n* `STREAMING_BACKLOG_SECONDS`: An estimate of the maximum consumer delay across all streams. This metric is in Public Preview.\n* `STREAMING_BACKLOG_FILES`: An estimate of the maximum number of outstanding files across all streams. This metric is in Public Preview.",
-                  "enum": [
-                    "RUN_DURATION_SECONDS",
-                    "STREAMING_BACKLOG_BYTES",
-                    "STREAMING_BACKLOG_RECORDS",
-                    "STREAMING_BACKLOG_SECONDS",
-                    "STREAMING_BACKLOG_FILES"
+                  "type": "object",
+                  "properties": {
+                    "delay": {
+                      "description": "[Private Preview] Non-negative analytic lag that evaluates the window this far in the past. Use this for timing\nvariations unrelated to source lateness, such as a 30-day count as of one week ago. If unset,\nthe analytic lag is zero. It composes with source.lateness when both are set.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/common/types/duration.Duration",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "offset": {
+                      "description": "[Private Preview] Non-negative phase shift from the default midnight UTC alignment. For example, offset=22h on\na 24h slide produces boundaries at 22:00 UTC (17:00 New York in standard time) instead of\nmidnight UTC. If unset, the offset is zero. Must be shorter than slide_duration (and therefore\nwindow_duration).",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/common/types/duration.Duration",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "slide_duration": {
+                      "description": "The slide duration (interval by which windows advance, must be positive and less than duration).",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "window_duration": {
+                      "description": "The duration of the sliding window. Must be positive when set; absent means lifetime\n(aggregate over the entity's entire history).",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "slide_duration"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.JobsHealthOperator": {
+            "ml.SourceLateness": {
               "oneOf": [
                 {
-                  "type": "string",
-                  "description": "Specifies the operator used to compare the health metric value with the specified threshold.",
-                  "enum": [
-                    "GREATER_THAN"
-                  ]
+                  "type": "object",
+                  "description": "Configures when event-time data from this source is considered complete for a Feature.",
+                  "properties": {
+                    "settling_delay": {
+                      "description": "[Private Preview] Non-negative time to wait after a window ends before treating its source data as complete.\nTraining shifts the eligible evaluation time backwards by this duration so it does not join\ndata that would still have been settling online. Materialization waits for the duration to\nelapse before publishing the window. If unset, source data is considered settled immediately.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/common/types/duration.Duration",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    }
+                  },
+                  "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.JobsHealthRule": {
+            "ml.StddevPopFunction": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Computes the population standard deviation.",
                   "properties": {
-                    "metric": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobsHealthMetric"
-                    },
-                    "op": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobsHealthOperator"
-                    },
-                    "value": {
-                      "description": "Specifies the threshold value that the health metric should obey to satisfy the health rule.",
-                      "$ref": "#/$defs/int64"
+                    "input": {
+                      "description": "The input column from which the population standard deviation is computed. For Kafka sources,\nuse dot-prefixed path notation (e.g., \"value.amount\"). For nested fields, the leaf node name is used.\nColon-prefixed notation (e.g., \"value:amount\") is supported for backwards\ncompatibility but is deprecated; migrate to dot notation.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "metric",
-                    "op",
-                    "value"
+                    "input"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.JobsHealthRules": {
+            "ml.StddevSampFunction": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "An optional set of health rules that can be defined for this job.",
+                  "description": "Computes the sample standard deviation.",
                   "properties": {
-                    "rules": {
-                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.JobsHealthRule"
+                    "input": {
+                      "description": "The input column from which the sample standard deviation is computed.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
-                  "additionalProperties": false
+                  "additionalProperties": false,
+                  "required": [
+                    "input"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.ModelTriggerConfiguration": {
+            "ml.StreamSource": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "A Stream entity used as a data source for a feature.",
                   "properties": {
-                    "aliases": {
-                      "description": "Aliases of the model versions to monitor. Can only be used in conjunction with condition MODEL_ALIAS_SET.",
-                      "$ref": "#/$defs/slice/string"
-                    },
-                    "condition": {
-                      "description": "The condition based on which to trigger a job run.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.ModelTriggerConfigurationCondition"
+                    "dataframe_schema": {
+                      "description": "[Private Preview] Schema of the resulting dataframe after transformations, in Spark StructType\nJSON format (from df.schema.json()).\nAny subsequent functions operate against this dataframe.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "min_time_between_triggers_seconds": {
-                      "description": "If set, the trigger starts a run only after the specified amount of time has passed since\nthe last time the trigger fired. The minimum allowed value is 60 seconds.",
-                      "$ref": "#/$defs/int"
+                    "filter_condition": {
+                      "description": "The filter condition applied to the source data before aggregation.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "securable_name": {
-                      "description": "Name of the securable to monitor (\"mycatalog.myschema.mymodel\" in the case of model-level triggers,\n\"mycatalog.myschema\" in the case of schema-level triggers) or empty in the case of metastore-level triggers.",
-                      "$ref": "#/$defs/string"
+                    "full_name": {
+                      "description": "Three-part full name of the Stream (catalog.schema.stream).",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "wait_after_last_change_seconds": {
-                      "description": "If set, the trigger starts a run only after no model updates have occurred for the specified time\nand can be used to wait for a series of model updates before triggering a run. The\nminimum allowed value is 60 seconds.",
-                      "$ref": "#/$defs/int"
+                    "transformation_sql": {
+                      "description": "[Private Preview] The pipeline runs these SQL statements immediately after conversion into\nthe schema specified on the Stream object.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "condition"
+                    "full_name"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.ModelTriggerConfigurationCondition": {
+            "ml.SumFunction": {
               "oneOf": [
                 {
-                  "type": "string",
-                  "enum": [
-                    "MODEL_CREATED",
-                    "MODEL_VERSION_READY",
-                    "MODEL_ALIAS_SET"
+                  "type": "object",
+                  "description": "Computes the sum of values.",
+                  "properties": {
+                    "input": {
+                      "description": "The input column from which the sum is computed. For Kafka sources, use dot-prefixed path\nnotation (e.g., \"value.amount\"). For nested fields, the leaf node name is used.\nColon-prefixed notation (e.g., \"value:amount\") is supported for backwards\ncompatibility but is deprecated; migrate to dot notation.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "input"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.NotebookTask": {
+            "ml.TimeWindow": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "base_parameters": {
-                      "description": "Base parameters to be used for each run of this job. If the run is initiated by a call to :method:jobs/run\nNow with parameters specified, the two parameters maps are merged. If the same key is specified in\n`base_parameters` and in `run-now`, the value from `run-now` is used.\nUse [Task parameter variables](https://docs.databricks.com/jobs.html#parameter-variables) to set parameters containing information about job runs.\n\nIf the notebook takes a parameter that is not specified in the job’s `base_parameters` or the `run-now` override parameters,\nthe default value from the notebook is used.\n\nRetrieve these parameters in a notebook using [dbutils.widgets.get](https://docs.databricks.com/dev-tools/databricks-utils.html#dbutils-widgets).\n\nThe JSON representation of this field cannot exceed 1MB.",
-                      "$ref": "#/$defs/map/string"
+                    "continuous": {
+                      "description": "[Private Preview]",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.ContinuousWindow",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "deprecationMessage": "This field is deprecated",
+                      "doNotSuggest": true,
+                      "deprecated": true
                     },
-                    "notebook_path": {
-                      "description": "The path of the notebook to be run in the Databricks workspace or remote repository.\nFor notebooks stored in the Databricks workspace, the path must be absolute and begin with a slash.\nFor notebooks stored in a remote repository, the path must be relative. This field is required.",
-                      "$ref": "#/$defs/string"
+                    "rolling": {
+                      "description": "A rolling time window with an optional non-negative delay.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.RollingWindow",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "source": {
-                      "description": "Optional location type of the notebook. When set to `WORKSPACE`, the notebook will be retrieved from the local Databricks workspace. When set to `GIT`, the notebook will be retrieved from a Git repository\ndefined in `git_source`. If the value is empty, the task will use `GIT` if `git_source` is defined and `WORKSPACE` otherwise.\n* `WORKSPACE`: Notebook is located in Databricks workspace.\n* `GIT`: Notebook is located in cloud Git provider.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.Source"
+                    "sawtooth": {
+                      "description": "[Private Preview] A sawtooth window served via the hybrid batch + streaming path.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.SawtoothWindow",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "warehouse_id": {
-                      "description": "Optional `warehouse_id` to run the notebook on a SQL warehouse. Classic SQL warehouses are NOT supported, please use serverless or pro SQL warehouses.\n\nNote that SQL warehouses only support SQL cells; if the notebook contains non-SQL cells, the run will fail.",
-                      "$ref": "#/$defs/string"
+                    "sliding": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.SlidingWindow",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "start_time": {
+                      "description": "[Private Preview] Earliest event-time boundary at which the Feature may emit an output. This gates outputs, not\nthe historical inputs read by a window. For example, a 365-day window with\nstart_time=2026-01-01 begins emitting partial-window values on that date instead of waiting\nfor 365 days of data; a lifetime window produces no output before start_time. If unset,\ntumbling and fixed-duration sliding windows first emit at an offset-aligned boundary after a\nfull window can be formed. If unset, lifetime sliding windows and rolling windows emit as soon as\neligible source data exists.\nNot currently supported for sawtooth windows or for Features with a stream source.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/common/types/time.Time",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "tumbling": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.TumblingWindow",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
-                  "additionalProperties": false,
-                  "required": [
-                    "notebook_path"
-                  ]
+                  "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.PauseStatus": {
+            "ml.TimeseriesColumn": {
               "oneOf": [
                 {
-                  "type": "string",
-                  "enum": [
-                    "UNPAUSED",
-                    "PAUSED"
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "description": "The name of the timeseries column. For Kafka sources, use dot-prefixed path notation to\nreference fields within the key or value schema (e.g., \"value.event_timestamp\"). For nested\nfields, the leaf node name (e.g., \"event_timestamp\" from \"value.event_details.event_timestamp\")\nis what will be present in materialized tables and expected to match at query time.\nColon-prefixed notation (e.g., \"value:event_timestamp\") is supported for\nbackwards compatibility but is deprecated; migrate to dot notation.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "name"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.PerformanceTarget": {
+            "ml.TumblingWindow": {
               "oneOf": [
                 {
-                  "type": "string",
-                  "description": "PerformanceTarget defines how performant (lower latency) or cost efficient the execution of run on serverless compute should be.\nThe performance mode on the job or pipeline should map to a performance setting that is passed to Cluster Manager\n(see cluster-common PerformanceTarget).",
-                  "enum": [
-                    "PERFORMANCE_OPTIMIZED",
-                    "STANDARD"
+                  "type": "object",
+                  "properties": {
+                    "delay": {
+                      "description": "[Private Preview] Non-negative analytic lag that evaluates the window this far in the past. Use this for timing\nvariations unrelated to source lateness, such as a 30-day count as of one week ago. If unset,\nthe analytic lag is zero. It composes with source.lateness when both are set.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/common/types/duration.Duration",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "offset": {
+                      "description": "[Private Preview] Non-negative phase shift from the default midnight UTC alignment. For example, offset=22h on\na 24h window produces boundaries at 22:00 UTC (17:00 New York in standard time) instead of\nmidnight UTC. If unset, the offset is zero. Must be shorter than window_duration.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/common/types/duration.Duration",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "window_duration": {
+                      "description": "The duration of each tumbling window (non-overlapping, fixed-duration windows).",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "window_duration"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.PeriodicTriggerConfiguration": {
+            "ml.UcTraceLocation": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "A Unity Catalog trace storage location. Traces are stored as Delta tables\nin the specified catalog and schema.",
                   "properties": {
-                    "interval": {
-                      "description": "The interval at which the trigger should run.",
-                      "$ref": "#/$defs/int"
+                    "catalog": {
+                      "description": "[Private Preview] The name of the Unity Catalog catalog.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "unit": {
-                      "description": "The unit of time for the interval.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PeriodicTriggerConfigurationTimeUnit"
+                    "schema": {
+                      "description": "[Private Preview] The name of the Unity Catalog schema within `catalog`.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "table_prefix": {
+                      "description": "[Private Preview] The prefix for the trace tables, which are named\n`{catalog}.{schema}.{table_prefix}_otel_*`. May only contain letters,\ndigits, and underscores, and may be at most 238 characters. When unset, a\nserver-generated prefix derived from the experiment ID is used and this\nfield stays empty on read; the resolved value is always available in\n`effective_table_prefix`.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "interval",
-                    "unit"
+                    "catalog",
+                    "schema"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.PeriodicTriggerConfigurationTimeUnit": {
+            "ml.VarPopFunction": {
               "oneOf": [
                 {
-                  "type": "string",
-                  "enum": [
-                    "HOURS",
-                    "DAYS",
-                    "WEEKS"
+                  "type": "object",
+                  "description": "Computes the population variance.",
+                  "properties": {
+                    "input": {
+                      "description": "The input column from which the population variance is computed.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "input"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.PipelineParams": {
+            "ml.VarSampFunction": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Computes the sample variance.",
                   "properties": {
-                    "full_refresh": {
-                      "description": "If true, triggers a full refresh on the delta live table.",
-                      "$ref": "#/$defs/bool"
+                    "input": {
+                      "description": "The input column from which the sample variance is computed.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
-                  "additionalProperties": false
+                  "additionalProperties": false,
+                  "required": [
+                    "input"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.PipelineTask": {
+            "pipelines.ApiSourceConnectorConfig": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Top-level configuration for API Source connectors with arbitrary configuration.",
                   "properties": {
-                    "full_refresh": {
-                      "description": "If true, triggers a full refresh on the delta live table.",
-                      "$ref": "#/$defs/bool"
-                    },
-                    "pipeline_id": {
-                      "description": "The full name of the pipeline task to execute.",
-                      "$ref": "#/$defs/string"
+                    "configs": {
+                      "description": "[Private Preview] Arbitrary key-value configuration values for the API Source connector.",
+                      "$ref": "#/$defs/map/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
-                  "additionalProperties": false,
-                  "required": [
-                    "pipeline_id"
-                  ]
+                  "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.PowerBiModel": {
+            "pipelines.ApiSourceConnectorOptions": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Options for API Source connectors with arbitrary configuration.",
                   "properties": {
-                    "authentication_method": {
-                      "description": "How the published Power BI model authenticates to Databricks",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.AuthenticationMethod"
-                    },
-                    "model_name": {
-                      "description": "The name of the Power BI model",
-                      "$ref": "#/$defs/string"
-                    },
-                    "overwrite_existing": {
-                      "description": "Whether to overwrite existing Power BI models",
-                      "$ref": "#/$defs/bool"
-                    },
-                    "storage_mode": {
-                      "description": "The default storage mode of the Power BI model",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.StorageMode"
-                    },
-                    "workspace_name": {
-                      "description": "The name of the Power BI workspace of the model",
-                      "$ref": "#/$defs/string"
+                    "options": {
+                      "description": "[Private Preview] Arbitrary key-value configuration options for the API Source connector.",
+                      "$ref": "#/$defs/map/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.PowerBiTable": {
+            "pipelines.AutoFullRefreshPolicy": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Policy for auto full refresh.",
                   "properties": {
-                    "catalog": {
-                      "description": "The catalog name in Databricks",
-                      "$ref": "#/$defs/string"
-                    },
-                    "name": {
-                      "description": "The table name in Databricks",
-                      "$ref": "#/$defs/string"
-                    },
-                    "schema": {
-                      "description": "The schema name in Databricks",
-                      "$ref": "#/$defs/string"
+                    "enabled": {
+                      "description": "[Public Preview] (Required, Mutable) Whether to enable auto full refresh or not.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "storage_mode": {
-                      "description": "The Power BI storage mode of the table",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.StorageMode"
+                    "min_interval_hours": {
+                      "description": "[Public Preview] (Optional, Mutable) Specify the minimum interval in hours between the timestamp\nat which a table was last full refreshed and the current timestamp for triggering auto full\nIf unspecified and autoFullRefresh is enabled then by default min_interval_hours is 24 hours.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     }
                   },
-                  "additionalProperties": false
+                  "additionalProperties": false,
+                  "required": [
+                    "enabled"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.PowerBiTask": {
+            "pipelines.AvroTransformerOptions": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "connection_resource_name": {
-                      "description": "The resource name of the UC connection to authenticate from Databricks to Power BI",
-                      "$ref": "#/$defs/string"
-                    },
-                    "power_bi_model": {
-                      "description": "The semantic model to update",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PowerBiModel"
+                    "parse_mode": {
+                      "description": "[Beta] (Optional) Parse mode for Avro data.\nValid values: FAILFAST, PERMISSIVE. Defaults to PERMISSIVE.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.ParseMode",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     },
-                    "refresh_after_update": {
-                      "description": "Whether the model should be refreshed after the update",
-                      "$ref": "#/$defs/bool"
+                    "schema": {
+                      "description": "[Beta] Inline Avro JSON schema string.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     },
-                    "tables": {
-                      "description": "The tables to be exported to Power BI",
-                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.PowerBiTable"
+                    "schema_file_path": {
+                      "description": "[Beta] Path to a schema file (.avsc).",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     },
-                    "warehouse_id": {
-                      "description": "The SQL warehouse ID to use as the Power BI data source",
-                      "$ref": "#/$defs/string"
+                    "schema_registry": {
+                      "description": "[Beta] (Optional) Schema registry to resolve the Avro schema at runtime instead of\nproviding it inline or via a file path.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.SchemaRegistryConfig",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.PythonWheelTask": {
+            "pipelines.ConfluenceConnectorOptions": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Confluence specific options for ingestion",
                   "properties": {
-                    "entry_point": {
-                      "description": "Named entry point to use, if it does not exist in the metadata of the package it executes the function from the package directly using `$packageName.$entryPoint()`",
-                      "$ref": "#/$defs/string"
-                    },
-                    "named_parameters": {
-                      "description": "Command-line parameters passed to Python wheel task in the form of `[\"--name=task\", \"--data=dbfs:/path/to/data.json\"]`. Leave it empty if `parameters` is not null.",
-                      "$ref": "#/$defs/map/string"
-                    },
-                    "package_name": {
-                      "description": "Name of the package to execute",
-                      "$ref": "#/$defs/string"
-                    },
-                    "parameters": {
-                      "description": "Command-line parameters passed to Python wheel task. Leave it empty if `named_parameters` is not null.",
-                      "$ref": "#/$defs/slice/string"
+                    "include_confluence_spaces": {
+                      "description": "[Public Preview] (Optional) Spaces to filter Confluence data on",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     }
                   },
-                  "additionalProperties": false,
-                  "required": [
-                    "entry_point",
-                    "package_name"
-                  ]
+                  "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.QueueSettings": {
+            "pipelines.ConfluentSchemaRegistryOptions": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "enabled": {
-                      "description": "If true, enable queueing for the job. This is a required field.",
-                      "$ref": "#/$defs/bool"
+                    "subject": {
+                      "description": "[Beta] Required: subject name to resolve in the registry.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     }
                   },
-                  "additionalProperties": false,
-                  "required": [
-                    "enabled"
-                  ]
+                  "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.RunIf": {
+            "pipelines.ConnectionParameters": {
               "oneOf": [
                 {
-                  "type": "string",
-                  "description": "An optional value indicating the condition that determines whether the task should be run once its dependencies have been completed. When omitted, defaults to `ALL_SUCCESS`.\n\nPossible values are:\n* `ALL_SUCCESS`: All dependencies have executed and succeeded\n* `AT_LEAST_ONE_SUCCESS`: At least one dependency has succeeded\n* `NONE_FAILED`: None of the dependencies have failed and at least one was executed\n* `ALL_DONE`: All dependencies have been completed\n* `AT_LEAST_ONE_FAILED`: At least one dependency failed\n* `ALL_FAILED`: ALl dependencies have failed",
-                  "enum": [
-                    "ALL_SUCCESS",
-                    "ALL_DONE",
-                    "NONE_FAILED",
-                    "AT_LEAST_ONE_SUCCESS",
-                    "ALL_FAILED",
-                    "AT_LEAST_ONE_FAILED"
-                  ]
+                  "type": "object",
+                  "properties": {
+                    "source_catalog": {
+                      "description": "[Private Preview] Source catalog for initial connection.\nThis is necessary for schema exploration in some database systems like Oracle, and optional but nice-to-have\nin some other database systems like Postgres.\nFor Oracle databases, this maps to a service name.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    }
+                  },
+                  "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.RunJobTask": {
+            "pipelines.ConnectorOptions": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Wrapper message for source-specific options to support multiple connector types",
                   "properties": {
-                    "dbt_commands": {
-                      "description": "An array of commands to execute for jobs with the dbt task, for example `\"dbt_commands\": [\"dbt deps\", \"dbt seed\", \"dbt deps\", \"dbt seed\", \"dbt run\"]`\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.",
-                      "$ref": "#/$defs/slice/string",
-                      "x-databricks-preview": "PRIVATE",
-                      "deprecationMessage": "This field is deprecated",
-                      "doNotSuggest": true,
-                      "deprecated": true
+                    "api_source_connector_options": {
+                      "description": "[Private Preview] Connector-specific options for API Source connectors.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.ApiSourceConnectorOptions",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "jar_params": {
-                      "description": "A list of parameters for jobs with Spark JAR tasks, for example `\"jar_params\": [\"john doe\", \"35\"]`.\nThe parameters are used to invoke the main function of the main class specified in the Spark JAR task.\nIf not specified upon `run-now`, it defaults to an empty list.\njar_params cannot be specified in conjunction with notebook_params.\nThe JSON representation of this field (for example `{\"jar_params\":[\"john doe\",\"35\"]}`) cannot exceed 10,000 bytes.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.",
-                      "$ref": "#/$defs/slice/string",
-                      "x-databricks-preview": "PRIVATE",
-                      "deprecationMessage": "This field is deprecated",
-                      "doNotSuggest": true,
-                      "deprecated": true
+                    "confluence_options": {
+                      "description": "[Public Preview] Confluence specific options for ingestion",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.ConfluenceConnectorOptions",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "job_id": {
-                      "description": "ID of the job to trigger.",
-                      "$ref": "#/$defs/int64"
+                    "gdrive_options": {
+                      "description": "[Private Preview]",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.GoogleDriveOptions",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "job_parameters": {
-                      "description": "Job-level parameters used to trigger the job.",
-                      "$ref": "#/$defs/map/string"
+                    "google_ads_options": {
+                      "description": "[Private Preview] Google Ads specific options for ingestion (object-level).\nWhen set, these values override the corresponding fields in GoogleAdsConfig\n(source_configurations).",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.GoogleAdsOptions",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "notebook_params": {
-                      "description": "A map from keys to values for jobs with notebook task, for example `\"notebook_params\": {\"name\": \"john doe\", \"age\": \"35\"}`.\nThe map is passed to the notebook and is accessible through the [dbutils.widgets.get](https://docs.databricks.com/dev-tools/databricks-utils.html) function.\n\nIf not specified upon `run-now`, the triggered run uses the job’s base parameters.\n\nnotebook_params cannot be specified in conjunction with jar_params.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.\n\nThe JSON representation of this field (for example `{\"notebook_params\":{\"name\":\"john doe\",\"age\":\"35\"}}`) cannot exceed 10,000 bytes.",
-                      "$ref": "#/$defs/map/string",
-                      "x-databricks-preview": "PRIVATE",
-                      "deprecationMessage": "This field is deprecated",
-                      "doNotSuggest": true,
-                      "deprecated": true
+                    "jira_options": {
+                      "description": "[Beta] Jira specific options for ingestion",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.JiraConnectorOptions",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     },
-                    "pipeline_params": {
-                      "description": "Controls whether the pipeline should perform a full refresh",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PipelineParams"
+                    "kafka_options": {
+                      "description": "[Beta]",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.KafkaOptions",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     },
-                    "python_named_params": {
-                      "$ref": "#/$defs/map/string",
-                      "x-databricks-preview": "PRIVATE",
-                      "deprecationMessage": "This field is deprecated",
-                      "doNotSuggest": true,
-                      "deprecated": true
+                    "linkedin_ads_options": {
+                      "description": "[Private Preview] LinkedIn Ads specific options for ingestion.\nsync_start_date and lookback_window_days apply to both the prebuilt analytics\ntables and custom reports. custom_report_options defines a custom (user-defined)\nadAnalytics report and is only valid on a table object.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.LinkedInAdsOptions",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "marketo_options": {
+                      "description": "[Private Preview] Marketo specific options for ingestion",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.MarketoOptions",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "meta_ads_options": {
+                      "description": "[Beta] Meta Marketing (Meta Ads) specific options for ingestion",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.MetaMarketingOptions",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
+                    },
+                    "outlook_options": {
+                      "description": "[Private Preview] Outlook specific options for ingestion",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.OutlookOptions",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "rabbitmq_options": {
+                      "description": "[Beta] RabbitMQ specific options for ingestion.\nPerformance tuning options (consumers_per_task, max_messages_per_fetch, etc.)\nare intentionally not exposed in the public API. The managed connector uses\nsensible defaults internally. These can be added later if user demand arises.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.RabbitmqOptions",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
+                    },
+                    "reddit_ads_options": {
+                      "description": "[Private Preview] Reddit Ads specific options for ingestion",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.RedditAdsOptions",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "sharepoint_options": {
+                      "description": "[Private Preview]",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.SharepointOptions",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "python_params": {
-                      "description": "A list of parameters for jobs with Python tasks, for example `\"python_params\": [\"john doe\", \"35\"]`.\nThe parameters are passed to Python file as command-line parameters. If specified upon `run-now`, it would overwrite\nthe parameters specified in job setting. The JSON representation of this field (for example `{\"python_params\":[\"john doe\",\"35\"]}`)\ncannot exceed 10,000 bytes.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.\n\nImportant\n\nThese parameters accept only Latin characters (ASCII character set). Using non-ASCII characters returns an error.\nExamples of invalid, non-ASCII characters are Chinese, Japanese kanjis, and emojis.",
-                      "$ref": "#/$defs/slice/string",
-                      "x-databricks-preview": "PRIVATE",
-                      "deprecationMessage": "This field is deprecated",
-                      "doNotSuggest": true,
-                      "deprecated": true
+                    "smartsheet_options": {
+                      "description": "[Public Preview] Smartsheet specific options for ingestion",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.SmartsheetOptions",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "spark_submit_params": {
-                      "description": "A list of parameters for jobs with spark submit task, for example `\"spark_submit_params\": [\"--class\", \"org.apache.spark.examples.SparkPi\"]`.\nThe parameters are passed to spark-submit script as command-line parameters. If specified upon `run-now`, it would overwrite the\nparameters specified in job setting. The JSON representation of this field (for example `{\"python_params\":[\"john doe\",\"35\"]}`)\ncannot exceed 10,000 bytes.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.\n\nImportant\n\nThese parameters accept only Latin characters (ASCII character set). Using non-ASCII characters returns an error.\nExamples of invalid, non-ASCII characters are Chinese, Japanese kanjis, and emojis.",
-                      "$ref": "#/$defs/slice/string",
-                      "x-databricks-preview": "PRIVATE",
-                      "deprecationMessage": "This field is deprecated",
-                      "doNotSuggest": true,
-                      "deprecated": true
+                    "tiktok_ads_options": {
+                      "description": "[Beta] TikTok Ads specific options for ingestion",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.TikTokAdsOptions",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     },
-                    "sql_params": {
-                      "description": "A map from keys to values for jobs with SQL task, for example `\"sql_params\": {\"name\": \"john doe\", \"age\": \"35\"}`. The SQL alert task does not support custom parameters.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.",
-                      "$ref": "#/$defs/map/string",
-                      "x-databricks-preview": "PRIVATE",
-                      "deprecationMessage": "This field is deprecated",
-                      "doNotSuggest": true,
-                      "deprecated": true
+                    "zendesk_support_options": {
+                      "description": "[Public Preview] Zendesk Support specific options for ingestion",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.ZendeskSupportOptions",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     }
                   },
-                  "additionalProperties": false,
-                  "required": [
-                    "job_id"
-                  ]
+                  "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.Source": {
+            "pipelines.ConnectorType": {
               "oneOf": [
                 {
                   "type": "string",
-                  "description": "Optional location type of the SQL file. When set to `WORKSPACE`, the SQL file will be retrieved\\\nfrom the local Databricks workspace. When set to `GIT`, the SQL file will be retrieved from a Git repository\ndefined in `git_source`. If the value is empty, the task will use `GIT` if `git_source` is defined and `WORKSPACE` otherwise.\n\n* `WORKSPACE`: SQL file is located in Databricks workspace.\n* `GIT`: SQL file is located in cloud Git provider.",
+                  "description": "For certain database sources LakeFlow Connect offers both query based and cdc\ningestion, ConnectorType can bse used to convey the type of ingestion.\nIf connection_name is provided for database sources, we default to Query Based ingestion",
                   "enum": [
-                    "WORKSPACE",
-                    "GIT"
+                    "CDC",
+                    "QUERY_BASED"
+                  ],
+                  "enumDescriptions": [
+                    "[Public Preview]",
+                    "[Public Preview]"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.SparkJarTask": {
+            "pipelines.CronTrigger": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "jar_uri": {
-                      "description": "Deprecated since 04/2016. For classic compute, provide a `jar` through the `libraries` field instead. For serverless compute, provide a `jar` though the `java_dependencies` field inside the `environments` list.\n\nSee the examples of classic and serverless compute usage at the top of the page.",
+                    "quartz_cron_schedule": {
                       "$ref": "#/$defs/string",
-                      "deprecationMessage": "This field is deprecated",
-                      "deprecated": true
-                    },
-                    "main_class_name": {
-                      "description": "The full name of the class containing the main method to be executed. This class must be contained in a JAR provided as a library.\n\nThe code must use `SparkContext.getOrCreate` to obtain a Spark context; otherwise, runs of the job fail.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "parameters": {
-                      "description": "Parameters passed to the main method.\n\nUse [Task parameter variables](https://docs.databricks.com/jobs.html#parameter-variables) to set parameters containing information about job runs.",
-                      "$ref": "#/$defs/slice/string"
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "run_as_repl": {
-                      "description": "Deprecated. A value of `false` is no longer supported.",
-                      "$ref": "#/$defs/bool",
-                      "deprecationMessage": "This field is deprecated",
-                      "deprecated": true
+                    "timezone_id": {
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.SparkPythonTask": {
+            "pipelines.DataStagingOptions": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Location of staged data storage",
                   "properties": {
-                    "parameters": {
-                      "description": "Command line parameters passed to the Python file.\n\nUse [Task parameter variables](https://docs.databricks.com/jobs.html#parameter-variables) to set parameters containing information about job runs.",
-                      "$ref": "#/$defs/slice/string"
+                    "catalog_name": {
+                      "description": "[Public Preview] (Required, Immutable) The name of the catalog for the connector's staging storage location.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "python_file": {
-                      "description": "The Python file to be executed. Cloud file URIs (such as dbfs:/, s3:/, adls:/, gcs:/) and workspace paths are supported. For python files stored in the Databricks workspace, the path must be absolute and begin with `/`. For files stored in a remote repository, the path must be relative. This field is required.",
-                      "$ref": "#/$defs/string"
+                    "schema_name": {
+                      "description": "[Public Preview] (Required, Immutable) The name of the schema for the connector's staging storage location.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "source": {
-                      "description": "Optional location type of the Python file. When set to `WORKSPACE` or not specified, the file will be retrieved from the local\nDatabricks workspace or cloud location (if the `python_file` has a URI format). When set to `GIT`,\nthe Python file will be retrieved from a Git repository defined in `git_source`.\n\n* `WORKSPACE`: The Python file is located in a Databricks workspace or at a cloud filesystem URI.\n* `GIT`: The Python file is located in a remote Git repository.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.Source"
+                    "volume_name": {
+                      "description": "[Public Preview] (Optional) The Unity Catalog-compatible name for the storage location.\nThis is the volume to use for the data that is extracted by the connector.\nSpark Declarative Pipelines system will automatically create the volume under the catalog and schema.\nFor Combined Cdc Managed Ingestion pipelines default name for the volume would be :\n__databricks_ingestion_gateway_staging_data-$pipelineId",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "python_file"
+                    "catalog_name",
+                    "schema_name"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.SparkSubmitTask": {
+            "pipelines.DayOfWeek": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "description": "Days of week in which the window is allowed to happen.\nIf not specified all days of the week will be used.",
+                  "enum": [
+                    "MONDAY",
+                    "TUESDAY",
+                    "WEDNESDAY",
+                    "THURSDAY",
+                    "FRIDAY",
+                    "SATURDAY",
+                    "SUNDAY"
+                  ],
+                  "enumDescriptions": [
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "pipelines.DeploymentKind": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "description": "The deployment method that manages the pipeline:\n- BUNDLE: The pipeline is managed by a Databricks Asset Bundle.",
+                  "enum": [
+                    "BUNDLE"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "pipelines.EventLogSpec": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Configurable event log parameters.",
                   "properties": {
-                    "parameters": {
-                      "description": "Command-line parameters passed to spark submit.\n\nUse [Task parameter variables](https://docs.databricks.com/jobs.html#parameter-variables) to set parameters containing information about job runs.",
-                      "$ref": "#/$defs/slice/string"
+                    "catalog": {
+                      "description": "The UC catalog the event log is published under.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "name": {
+                      "description": "The name the event log is published to in UC.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "schema": {
+                      "description": "The UC schema the event log is published under.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.SparseCheckout": {
+            "pipelines.FileFilter": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "patterns": {
-                      "description": "List of patterns to include for sparse checkout.",
-                      "$ref": "#/$defs/slice/string"
+                    "modified_after": {
+                      "description": "[Private Preview] Include files with modification times occurring after the specified time.\nTimestamp format: YYYY-MM-DDTHH:mm:ss (e.g. 2020-06-01T13:00:00)\nBased on https://spark.apache.org/docs/latest/sql-data-sources-generic-options.html#modification-time-path-filters",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "modified_before": {
+                      "description": "[Private Preview] Include files with modification times occurring before the specified time.\nTimestamp format: YYYY-MM-DDTHH:mm:ss (e.g. 2020-06-01T13:00:00)\nBased on https://spark.apache.org/docs/latest/sql-data-sources-generic-options.html#modification-time-path-filters",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "path_filter": {
+                      "description": "[Private Preview] Include files with file names matching the pattern\nBased on https://spark.apache.org/docs/latest/sql-data-sources-generic-options.html#path-glob-filter",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.SqlTask": {
+            "pipelines.FileIngestionOptions": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "alert": {
-                      "description": "If alert, indicates that this job must refresh a SQL alert.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SqlTaskAlert"
+                    "corrupt_record_column": {
+                      "description": "[Private Preview]",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "dashboard": {
-                      "description": "If dashboard, indicates that this job must refresh a SQL dashboard.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SqlTaskDashboard"
+                    "file_filters": {
+                      "description": "[Private Preview] Generic options",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/pipelines.FileFilter",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "file": {
-                      "description": "If file, indicates that this job runs a SQL file in a remote Git repository.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SqlTaskFile"
+                    "format": {
+                      "description": "[Private Preview] required for TableSpec",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.FileIngestionOptionsFileFormat",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "parameters": {
-                      "description": "Parameters to be used for each run of this job. The SQL alert task does not support custom parameters.",
-                      "$ref": "#/$defs/map/string"
+                    "format_options": {
+                      "description": "[Private Preview] Format-specific options\nBased on https://docs.databricks.com/aws/en/ingestion/cloud-object-storage/auto-loader/options#file-format-options",
+                      "$ref": "#/$defs/map/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "query": {
-                      "description": "If query, indicates that this job must execute a SQL query.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SqlTaskQuery"
+                    "ignore_corrupt_files": {
+                      "description": "[Private Preview]",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "warehouse_id": {
-                      "description": "The canonical identifier of the SQL warehouse. Recommended to use with serverless or pro SQL warehouses. Classic SQL warehouses are only supported for SQL alert, dashboard and query tasks and are limited to scheduled single-task jobs.",
-                      "$ref": "#/$defs/string"
+                    "infer_column_types": {
+                      "description": "[Private Preview]",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "reader_case_sensitive": {
+                      "description": "[Private Preview] Column name case sensitivity\nhttps://docs.databricks.com/aws/en/ingestion/cloud-object-storage/auto-loader/schema#change-case-sensitive-behavior",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "rescued_data_column": {
+                      "description": "[Private Preview]",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "schema_evolution_mode": {
+                      "description": "[Private Preview] Based on https://docs.databricks.com/aws/en/ingestion/cloud-object-storage/auto-loader/schema#how-does-auto-loader-schema-evolution-work",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.FileIngestionOptionsSchemaEvolutionMode",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "schema_hints": {
+                      "description": "[Private Preview] Override inferred schema of specific columns\nBased on https://docs.databricks.com/aws/en/ingestion/cloud-object-storage/auto-loader/schema#override-schema-inference-with-schema-hints",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "single_variant_column": {
+                      "description": "[Private Preview]",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
-                  "additionalProperties": false,
-                  "required": [
-                    "warehouse_id"
-                  ]
+                  "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.SqlTaskAlert": {
+            "pipelines.FileIngestionOptionsFileFormat": {
               "oneOf": [
                 {
-                  "type": "object",
-                  "properties": {
-                    "alert_id": {
-                      "description": "The canonical identifier of the SQL alert.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "pause_subscriptions": {
-                      "description": "If true, the alert notifications are not sent to subscribers.",
-                      "$ref": "#/$defs/bool"
-                    },
-                    "subscriptions": {
-                      "description": "If specified, alert notifications are sent to subscribers.",
-                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.SqlTaskSubscription"
-                    }
-                  },
-                  "additionalProperties": false,
-                  "required": [
-                    "alert_id"
+                  "type": "string",
+                  "enum": [
+                    "BINARYFILE",
+                    "JSON",
+                    "CSV",
+                    "XML",
+                    "EXCEL",
+                    "PARQUET",
+                    "AVRO",
+                    "ORC"
+                  ],
+                  "enumDescriptions": [
+                    "[Private Preview]",
+                    "[Private Preview]",
+                    "[Private Preview]",
+                    "[Private Preview]",
+                    "[Private Preview]",
+                    "[Private Preview]",
+                    "[Private Preview]",
+                    "[Private Preview]"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.SqlTaskDashboard": {
+            "pipelines.FileIngestionOptionsSchemaEvolutionMode": {
               "oneOf": [
                 {
-                  "type": "object",
-                  "properties": {
-                    "custom_subject": {
-                      "description": "Subject of the email sent to subscribers of this task.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "dashboard_id": {
-                      "description": "The canonical identifier of the SQL dashboard.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "pause_subscriptions": {
-                      "description": "If true, the dashboard snapshot is not taken, and emails are not sent to subscribers.",
-                      "$ref": "#/$defs/bool"
-                    },
-                    "subscriptions": {
-                      "description": "If specified, dashboard snapshots are sent to subscriptions.",
-                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.SqlTaskSubscription"
-                    }
-                  },
-                  "additionalProperties": false,
-                  "required": [
-                    "dashboard_id"
+                  "type": "string",
+                  "description": "Based on https://docs.databricks.com/aws/en/ingestion/cloud-object-storage/auto-loader/schema#how-does-auto-loader-schema-evolution-work",
+                  "enum": [
+                    "ADD_NEW_COLUMNS_WITH_TYPE_WIDENING",
+                    "ADD_NEW_COLUMNS",
+                    "RESCUE",
+                    "FAIL_ON_NEW_COLUMNS",
+                    "NONE"
+                  ],
+                  "enumDescriptions": [
+                    "[Beta]",
+                    "[Beta]",
+                    "[Beta]",
+                    "[Beta]",
+                    "[Beta]"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.SqlTaskFile": {
+            "pipelines.FileLibrary": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
                     "path": {
-                      "description": "Path of the SQL file. Must be relative if the source is a remote Git repository and absolute for workspace paths.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "source": {
-                      "description": "Optional location type of the SQL file. When set to `WORKSPACE`, the SQL file will be retrieved\nfrom the local Databricks workspace. When set to `GIT`, the SQL file will be retrieved from a Git repository\ndefined in `git_source`. If the value is empty, the task will use `GIT` if `git_source` is defined and `WORKSPACE` otherwise.\n\n* `WORKSPACE`: SQL file is located in Databricks workspace.\n* `GIT`: SQL file is located in cloud Git provider.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.Source"
+                      "description": "The absolute path of the source code.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
-                  "additionalProperties": false,
-                  "required": [
-                    "path"
-                  ]
+                  "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.SqlTaskQuery": {
+            "pipelines.Filters": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "query_id": {
-                      "description": "The canonical identifier of the SQL query.",
-                      "$ref": "#/$defs/string"
+                    "exclude": {
+                      "description": "Paths to exclude.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "include": {
+                      "description": "Paths to include.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
-                  "additionalProperties": false,
-                  "required": [
-                    "query_id"
-                  ]
+                  "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.SqlTaskSubscription": {
+            "pipelines.GoogleAdsConfig": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "destination_id": {
-                      "description": "The canonical identifier of the destination to receive email notification. This parameter is mutually exclusive with user_name. You cannot set both destination_id and user_name for subscription notifications.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "user_name": {
-                      "description": "The user name to receive the subscription email. This parameter is mutually exclusive with destination_id. You cannot set both destination_id and user_name for subscription notifications.",
-                      "$ref": "#/$defs/string"
+                    "manager_account_id": {
+                      "description": "[Private Preview] (Required) Manager Account ID (also called MCC Account ID) used to list and access\ncustomer accounts under this manager account. This is required for fetching the list\nof customer accounts during source selection.\nIf the same field is also set in the object-level GoogleAdsOptions (connector_options),\nthe object-level value takes precedence over this top-level config.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.StorageMode": {
+            "pipelines.GoogleAdsCustomReportOptions": {
               "oneOf": [
                 {
-                  "type": "string",
-                  "enum": [
-                    "DIRECT_QUERY",
-                    "IMPORT",
-                    "DUAL"
+                  "type": "object",
+                  "description": "User-defined custom report for the Google Ads connector. Mirrors the\nresource + fields + segments + metrics model that Google Ads GAQL exposes.\nThe customer account this report runs against is supplied by the source\nschema (namespace), not by this message. The whole message is gated by\nthe parent GoogleAdsOptions.custom_report_options stage; per-field stage\nannotations are intentionally omitted.\nOnly supported on table-type objects: a custom report requires a\ndestination table, so it cannot be specified at the schema/source level.",
+                  "properties": {
+                    "metrics": {
+                      "description": "[Private Preview] (Optional) Metric fields to select (e.g. \"metrics.clicks\",\n\"metrics.cost_micros\"). Multiple values are joined into the GAQL\nSELECT clause.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "resource": {
+                      "description": "[Private Preview] (Required) Google Ads resource to query (e.g. \"ad_group_ad\",\n\"keyword_view\", \"search_term_view\"). Must be a resource that has\nmetrics. Values are validated against Google Ads' field-service\ncatalog at pipeline plan time.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "resource_fields": {
+                      "description": "[Private Preview] (Optional) Resource fields to select, in fully-qualified GAQL form\n(e.g. \"ad_group_ad.ad.id\", \"ad_group_ad.status\"). Multiple values are\njoined into the GAQL SELECT clause.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "segments": {
+                      "description": "[Private Preview] (Optional) Segment fields to select (e.g. \"segments.date\",\n\"segments.device\"). Must include at least one of segments.date,\nsegments.week, or segments.month — that segment is used as the\nincremental cursor for the table.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "resource"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.Subscription": {
+            "pipelines.GoogleAdsOptions": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Google Ads specific options for ingestion (object-level).\nWhen set, these values override the corresponding fields in GoogleAdsConfig\n(source_configurations).",
                   "properties": {
-                    "custom_subject": {
-                      "description": "Optional: Allows users to specify a custom subject line on the email sent\nto subscribers.",
-                      "$ref": "#/$defs/string"
+                    "custom_report_options": {
+                      "description": "[Private Preview] (Optional) Custom report definition. When set, the table is treated as a\nuser-defined Google Ads custom report: the connector synthesizes a GAQL\nquery from the resource, fields, segments, and metrics specified here.\nWhen unset, the table must match one of the connector's prebuilt sources.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.GoogleAdsCustomReportOptions",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "paused": {
-                      "description": "When true, the subscription will not send emails.",
-                      "$ref": "#/$defs/bool"
+                    "lookback_window_days": {
+                      "description": "[Private Preview] (Optional) Number of days to look back for report tables to capture late-arriving data.\nIf not specified, defaults to 30 days.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "subscribers": {
-                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.SubscriptionSubscriber"
+                    "manager_account_id": {
+                      "description": "[Private Preview] (Optional at this level) Manager Account ID (also called MCC Account ID) used to list\nand access customer accounts under this manager account.\nOverrides GoogleAdsConfig.manager_account_id from source_configurations when set.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "sync_start_date": {
+                      "description": "[Private Preview] (Optional) Start date for the initial sync of report tables in YYYY-MM-DD format.\nThis determines the earliest date from which to sync historical data.\nIf not specified, defaults to 2 years of historical data.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
-                  "additionalProperties": false
+                  "additionalProperties": false,
+                  "required": [
+                    "manager_account_id"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.SubscriptionSubscriber": {
+            "pipelines.GoogleDriveOptions": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "destination_id": {
-                      "$ref": "#/$defs/string"
+                    "entity_type": {
+                      "description": "[Private Preview]",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.GoogleDriveOptionsGoogleDriveEntityType",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "user_name": {
-                      "$ref": "#/$defs/string"
+                    "file_ingestion_options": {
+                      "description": "[Private Preview]",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.FileIngestionOptions",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "url": {
+                      "description": "[Private Preview] Google Drive URL.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.TableUpdateTriggerConfiguration": {
+            "pipelines.GoogleDriveOptionsGoogleDriveEntityType": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "enum": [
+                    "FILE",
+                    "FILE_METADATA",
+                    "PERMISSION"
+                  ],
+                  "enumDescriptions": [
+                    "[Private Preview]",
+                    "[Private Preview]",
+                    "[Private Preview]"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "pipelines.IngestionConfig": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "condition": {
-                      "description": "The table(s) condition based on which to trigger a job run.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.Condition"
-                    },
-                    "min_time_between_triggers_seconds": {
-                      "description": "If set, the trigger starts a run only after the specified amount of time has passed since\nthe last time the trigger fired. The minimum allowed value is 60 seconds.",
-                      "$ref": "#/$defs/int"
+                    "report": {
+                      "description": "[Public Preview] Select a specific source report.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.ReportSpec",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "table_names": {
-                      "description": "A list of tables to monitor for changes. The table name must be in the format `catalog_name.schema_name.table_name`.",
-                      "$ref": "#/$defs/slice/string"
+                    "schema": {
+                      "description": "[Public Preview] Select all tables from a specific source schema.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.SchemaSpec",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "wait_after_last_change_seconds": {
-                      "description": "If set, the trigger starts a run only after no table updates have occurred for the specified time\nand can be used to wait for a series of table updates before triggering a run. The\nminimum allowed value is 60 seconds.",
-                      "$ref": "#/$defs/int"
+                    "table": {
+                      "description": "[Public Preview] Select a specific source table.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.TableSpec",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     }
                   },
-                  "additionalProperties": false,
-                  "required": [
-                    "table_names"
-                  ]
+                  "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.Task": {
+            "pipelines.IngestionGatewayPipelineDefinition": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "alert_task": {
-                      "description": "The task evaluates a Databricks alert and sends notifications to subscribers\nwhen the `alert_task` field is present.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.AlertTask"
-                    },
-                    "clean_rooms_notebook_task": {
-                      "description": "The task runs a [clean rooms](https://docs.databricks.com/clean-rooms/index.html) notebook\nwhen the `clean_rooms_notebook_task` field is present.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.CleanRoomsNotebookTask"
-                    },
-                    "compute": {
-                      "description": "Task level compute configuration.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.Compute"
-                    },
-                    "condition_task": {
-                      "description": "The task evaluates a condition that can be used to control the execution of other tasks when the `condition_task` field is present.\nThe condition task does not require a cluster to execute and does not support retries or notifications.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.ConditionTask"
-                    },
-                    "dashboard_task": {
-                      "description": "The task refreshes a dashboard and sends a snapshot to subscribers.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.DashboardTask"
-                    },
-                    "dbt_cloud_task": {
-                      "description": "Task type for dbt cloud, deprecated in favor of the new name dbt_platform_task",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.DbtCloudTask",
-                      "x-databricks-preview": "PRIVATE",
+                    "connection_id": {
+                      "description": "[Private Preview] [Deprecated, use connection_name instead] Immutable. The Unity Catalog connection that this gateway pipeline uses to communicate with the source.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
                       "deprecationMessage": "This field is deprecated",
                       "doNotSuggest": true,
                       "deprecated": true
                     },
-                    "dbt_platform_task": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.DbtPlatformTask",
-                      "x-databricks-preview": "PRIVATE",
+                    "connection_name": {
+                      "description": "[Private Preview] Immutable. The Unity Catalog connection that this gateway pipeline uses to communicate with the source.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
                       "doNotSuggest": true
                     },
-                    "dbt_task": {
-                      "description": "The task runs one or more dbt commands when the `dbt_task` field is present. The dbt task requires both Databricks SQL and the ability to use a serverless or a pro SQL warehouse.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.DbtTask"
-                    },
-                    "depends_on": {
-                      "description": "An optional array of objects specifying the dependency graph of the task. All tasks specified in this field must complete before executing this task. The task will run only if the `run_if` condition is true.\nThe key is `task_key`, and the value is the name assigned to the dependent task.",
-                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.TaskDependency"
-                    },
-                    "description": {
-                      "description": "An optional description for this task.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "disable_auto_optimization": {
-                      "description": "An option to disable auto optimization in serverless",
-                      "$ref": "#/$defs/bool"
-                    },
-                    "disabled": {
-                      "description": "An optional flag to disable the task. If set to true, the task will not run even if it is part of a job.",
-                      "$ref": "#/$defs/bool",
-                      "x-databricks-preview": "PRIVATE",
+                    "connection_parameters": {
+                      "description": "[Private Preview] Optional, Internal. Parameters required to establish an initial connection with the source.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.ConnectionParameters",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
                       "doNotSuggest": true
                     },
-                    "email_notifications": {
-                      "description": "An optional set of email addresses that is notified when runs of this task begin or complete as well as when this task is deleted. The default behavior is to not send any emails.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.TaskEmailNotifications"
-                    },
-                    "environment_key": {
-                      "description": "The key that references an environment spec in a job. This field is required for Python script, Python wheel and dbt tasks when using serverless compute.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "existing_cluster_id": {
-                      "description": "If existing_cluster_id, the ID of an existing cluster that is used for all runs.\nWhen running jobs or tasks on an existing cluster, you may need to manually restart\nthe cluster if it stops responding. We suggest running jobs and tasks on new clusters for\ngreater reliability",
-                      "$ref": "#/$defs/string"
-                    },
-                    "for_each_task": {
-                      "description": "The task executes a nested task for every input provided when the `for_each_task` field is present.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.ForEachTask"
-                    },
-                    "gen_ai_compute_task": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.GenAiComputeTask",
-                      "x-databricks-preview": "PRIVATE",
+                    "gateway_storage_catalog": {
+                      "description": "[Private Preview] Required, Immutable. The name of the catalog for the gateway pipeline's storage location.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
                       "doNotSuggest": true
                     },
-                    "health": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobsHealthRules"
-                    },
-                    "job_cluster_key": {
-                      "description": "If job_cluster_key, this task is executed reusing the cluster specified in `job.settings.job_clusters`.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "libraries": {
-                      "description": "An optional list of libraries to be installed on the cluster.\nThe default value is an empty list.",
-                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/compute.Library"
-                    },
-                    "max_retries": {
-                      "description": "An optional maximum number of times to retry an unsuccessful run. A run is considered to be unsuccessful if it completes with the `FAILED` result_state or `INTERNAL_ERROR` `life_cycle_state`. The value `-1` means to retry indefinitely and the value `0` means to never retry.",
-                      "$ref": "#/$defs/int"
-                    },
-                    "min_retry_interval_millis": {
-                      "description": "An optional minimal interval in milliseconds between the start of the failed run and the subsequent retry run. The default behavior is that unsuccessful runs are immediately retried.",
-                      "$ref": "#/$defs/int"
-                    },
-                    "new_cluster": {
-                      "description": "If new_cluster, a description of a new cluster that is created for each run.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.ClusterSpec"
-                    },
-                    "notebook_task": {
-                      "description": "The task runs a notebook when the `notebook_task` field is present.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.NotebookTask"
-                    },
-                    "notification_settings": {
-                      "description": "Optional notification settings that are used when sending notifications to each of the `email_notifications` and `webhook_notifications` for this task.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.TaskNotificationSettings"
-                    },
-                    "pipeline_task": {
-                      "description": "The task triggers a pipeline update when the `pipeline_task` field is present. Only pipelines configured to use triggered more are supported.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PipelineTask"
-                    },
-                    "power_bi_task": {
-                      "description": "The task triggers a Power BI semantic model update when the `power_bi_task` field is present.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PowerBiTask"
+                    "gateway_storage_name": {
+                      "description": "[Private Preview] Optional. The Unity Catalog-compatible name for the gateway storage location.\nThis is the destination to use for the data that is extracted by the gateway.\nSpark Declarative Pipelines system will automatically create the storage location under the catalog and schema.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "python_wheel_task": {
-                      "description": "The task runs a Python wheel when the `python_wheel_task` field is present.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PythonWheelTask"
+                    "gateway_storage_schema": {
+                      "description": "[Private Preview] Required, Immutable. The name of the schema for the gateway pipelines's storage location.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "connection_name",
+                    "gateway_storage_catalog",
+                    "gateway_storage_schema"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "pipelines.IngestionPipelineDefinition": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "connection_name": {
+                      "description": "[Public Preview] The Unity Catalog connection that this ingestion pipeline uses to communicate with the source. This is used with\nboth connectors for applications like Salesforce, Workday, and so on, and also database connectors like Oracle,\n(connector_type = QUERY_BASED OR connector_type = CDC).\nIf connection name corresponds to database connectors like Oracle, and connector_type is not provided then\nconnector_type defaults to QUERY_BASED. If connector_type is passed as CDC we use Combined Cdc Managed Ingestion\npipeline.\nUnder certain conditions, this can be replaced with ingestion_gateway_id to change the connector to Cdc Managed\nIngestion Pipeline with Gateway pipeline.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "retry_on_timeout": {
-                      "description": "An optional policy to specify whether to retry a job when it times out. The default behavior\nis to not retry on timeout.",
-                      "$ref": "#/$defs/bool"
+                    "connector_type": {
+                      "description": "[Public Preview] (Optional) Connector Type for sources. Ex: CDC, Query Based.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.ConnectorType",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "run_if": {
-                      "description": "An optional value specifying the condition determining whether the task is run once its dependencies have been completed.\n\n* `ALL_SUCCESS`: All dependencies have executed and succeeded\n* `AT_LEAST_ONE_SUCCESS`: At least one dependency has succeeded\n* `NONE_FAILED`: None of the dependencies have failed and at least one was executed\n* `ALL_DONE`: All dependencies have been completed\n* `AT_LEAST_ONE_FAILED`: At least one dependency failed\n* `ALL_FAILED`: ALl dependencies have failed",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.RunIf"
+                    "data_staging_options": {
+                      "description": "[Public Preview] (Optional) Location of staged data storage. This is required for migration from Cdc Managed Ingestion Pipeline\nwith Gateway pipeline to Combined Cdc Managed Ingestion Pipeline.\nIf not specified, the volume for staged data will be created in catalog and schema/target specified in the\ntop level pipeline definition.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.DataStagingOptions",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "run_job_task": {
-                      "description": "The task triggers another job when the `run_job_task` field is present.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.RunJobTask"
+                    "full_refresh_window": {
+                      "description": "[Public Preview] (Optional) A window that specifies a set of time ranges for snapshot queries in CDC.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.OperationTimeWindow",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "spark_jar_task": {
-                      "description": "The task runs a JAR when the `spark_jar_task` field is present.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SparkJarTask"
+                    "ingest_from_uc_foreign_catalog": {
+                      "description": "[Public Preview] Immutable. If set to true, the pipeline will ingest tables from the\nUC foreign catalogs directly without the need to specify a UC connection or ingestion gateway.\nThe `source_catalog` fields in objects of IngestionConfig are interpreted as\nthe UC foreign catalogs to ingest from.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "spark_python_task": {
-                      "description": "The task runs a Python file when the `spark_python_task` field is present.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SparkPythonTask"
+                    "ingestion_gateway_id": {
+                      "description": "[Public Preview] Identifier for the gateway that is used by this ingestion pipeline to communicate with the source database.\nThis is used with CDC connectors to databases like SQL Server using a gateway pipeline (connector_type = CDC).\nUnder certain conditions, this can be replaced with connection_name to change the connector to Combined Cdc\nManaged Ingestion Pipeline.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "spark_submit_task": {
-                      "description": "(Legacy) The task runs the spark-submit script when the spark_submit_task field is present. Databricks recommends using the spark_jar_task instead; see [Spark Submit task for jobs](/jobs/spark-submit).",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SparkSubmitTask",
-                      "deprecationMessage": "This field is deprecated",
-                      "deprecated": true
+                    "netsuite_jar_path": {
+                      "description": "[Private Preview] Netsuite only configuration. When the field is set for a netsuite connector,\nthe jar stored in the field will be validated and added to the classpath of\npipeline's cluster.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "sql_task": {
-                      "description": "The task runs a SQL query or file, or it refreshes a SQL alert or a legacy SQL dashboard when the `sql_task` field is present.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SqlTask"
+                    "objects": {
+                      "description": "[Public Preview] Required. Settings specifying tables to replicate and the destination for the replicated tables.",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/pipelines.IngestionConfig",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "task_key": {
-                      "description": "A unique name for the task. This field is used to refer to this task from other tasks.\nThis field is required and must be unique within its parent job.\nOn Update or Reset, this field is used to reference the tasks to be updated or reset.",
-                      "$ref": "#/$defs/string"
+                    "source_configurations": {
+                      "description": "[Public Preview] Top-level source configurations",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/pipelines.SourceConfig",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "timeout_seconds": {
-                      "description": "An optional timeout applied to each run of this job task. A value of `0` means no timeout.",
-                      "$ref": "#/$defs/int"
+                    "table_configuration": {
+                      "description": "[Public Preview] Configuration settings to control the ingestion of tables. These settings are applied to all tables in the pipeline.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.TableSpecificConfig",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "pipelines.IngestionPipelineDefinitionFanoutOptions": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Fanout configuration for multi-table routing from streaming sources.\nRoutes each input record to a destination table based on a routing\nkey derived from the record. The key value becomes the table name\nsuffix: {destination_catalog}.{destination_schema}.{key_value}.",
+                  "properties": {
+                    "fanout_by": {
+                      "description": "[Beta] Column path or SQL expression whose value determines the destination table.\nSupports dotted paths (e.g. \"value.event_name\") and expressions\n(e.g. \"value:event_name::string\").",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     },
-                    "webhook_notifications": {
-                      "description": "A collection of system notification IDs to notify when runs of this task begin or complete. The default behavior is to not send any system notifications.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.WebhookNotifications"
+                    "transforms": {
+                      "description": "[Beta] Optional transforms applied to each route's DataFrame before writing\nto the destination table.",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/pipelines.Transformer",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     }
                   },
-                  "additionalProperties": false,
-                  "required": [
-                    "task_key"
-                  ]
+                  "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.TaskDependency": {
+            "pipelines.IngestionPipelineDefinitionTableSpecificConfigQueryBasedConnectorConfig": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Configurations that are only applicable for query-based ingestion connectors.",
                   "properties": {
-                    "outcome": {
-                      "description": "Can only be specified on condition task dependencies. The outcome of the dependent task that must be met for this task to run.",
-                      "$ref": "#/$defs/string"
+                    "cursor_columns": {
+                      "description": "[Public Preview] The names of the monotonically increasing columns in the source table that are used to enable\nthe table to be read and ingested incrementally through structured streaming.\nThe columns are allowed to have repeated values but have to be non-decreasing.\nIf the source data is merged into the destination (e.g., using SCD Type 1 or Type 2), these\ncolumns will implicitly define the `sequence_by` behavior. You can still explicitly set\n`sequence_by` to override this default.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "task_key": {
-                      "description": "The name of the task this task depends on.",
-                      "$ref": "#/$defs/string"
+                    "deletion_condition": {
+                      "description": "[Public Preview] Specifies a SQL WHERE condition that specifies that the source row has been deleted.\nThis is sometimes referred to as \"soft-deletes\".\nFor example: \"Operation = 'DELETE'\" or \"is_deleted = true\".\nThis field is orthogonal to `hard_deletion_sync_interval_in_seconds`,\none for soft-deletes and the other for hard-deletes.\nSee also the hard_deletion_sync_min_interval_in_seconds field for\nhandling of \"hard deletes\" where the source rows are physically removed from the table.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "hard_deletion_sync_min_interval_in_seconds": {
+                      "description": "[Beta] Specifies the minimum interval (in seconds) between snapshots on primary keys\nfor detecting and synchronizing hard deletions—i.e., rows that have been\nphysically removed from the source table.\nThis interval acts as a lower bound. If ingestion runs less frequently than\nthis value, hard deletion synchronization will align with the actual ingestion\nfrequency instead of happening more often.\nIf not set, hard deletion synchronization via snapshots is disabled.\nThis field is mutable and can be updated without triggering a full snapshot.",
+                      "$ref": "#/$defs/int64",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     }
                   },
-                  "additionalProperties": false,
-                  "required": [
-                    "task_key"
-                  ]
+                  "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.TaskEmailNotifications": {
+            "pipelines.IngestionPipelineDefinitionWorkdayReportParameters": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "no_alert_for_skipped_runs": {
-                      "description": "If true, do not send email to recipients specified in `on_failure` if the run is skipped.\nThis field is `deprecated`. Please use the `notification_settings.no_alert_for_skipped_runs` field.",
+                    "incremental": {
+                      "description": "[Private Preview] (Optional) Marks the report as incremental.\nThis field is deprecated and should not be used. Use `parameters` instead. The incremental behavior is now\ncontrolled by the `parameters` field.",
                       "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
                       "deprecationMessage": "This field is deprecated",
+                      "doNotSuggest": true,
                       "deprecated": true
                     },
-                    "on_duration_warning_threshold_exceeded": {
-                      "description": "A list of email addresses to be notified when the duration of a run exceeds the threshold specified for the `RUN_DURATION_SECONDS` metric in the `health` field. If no rule for the `RUN_DURATION_SECONDS` metric is specified in the `health` field for the job, notifications are not sent.",
-                      "$ref": "#/$defs/slice/string"
-                    },
-                    "on_failure": {
-                      "description": "A list of email addresses to be notified when a run unsuccessfully completes. A run is considered to have completed unsuccessfully if it ends with an `INTERNAL_ERROR` `life_cycle_state` or a `FAILED`, or `TIMED_OUT` result_state. If this is not specified on job creation, reset, or update the list is empty, and notifications are not sent.",
-                      "$ref": "#/$defs/slice/string"
-                    },
-                    "on_start": {
-                      "description": "A list of email addresses to be notified when a run begins. If not specified on job creation, reset, or update, the list is empty, and notifications are not sent.",
-                      "$ref": "#/$defs/slice/string"
-                    },
-                    "on_streaming_backlog_exceeded": {
-                      "description": "A list of email addresses to notify when any streaming backlog thresholds are exceeded for any stream.\nStreaming backlog thresholds can be set in the `health` field using the following metrics: `STREAMING_BACKLOG_BYTES`, `STREAMING_BACKLOG_RECORDS`, `STREAMING_BACKLOG_SECONDS`, or `STREAMING_BACKLOG_FILES`.\nAlerting is based on the 10-minute average of these metrics. If the issue persists, notifications are resent every 30 minutes.",
-                      "$ref": "#/$defs/slice/string"
+                    "parameters": {
+                      "description": "[Private Preview] Parameters for the Workday report. Each key represents the parameter name (e.g., \"start_date\", \"end_date\"),\nand the corresponding value is a SQL-like expression used to compute the parameter value at runtime.\nExample:\n{\n\"start_date\": \"{ coalesce(current_offset(), date(\\\"2025-02-01\\\")) }\",\n\"end_date\": \"{ current_date() - INTERVAL 1 DAY }\"\n}",
+                      "$ref": "#/$defs/map/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "on_success": {
-                      "description": "A list of email addresses to be notified when a run successfully completes. A run is considered to have completed successfully if it ends with a `TERMINATED` `life_cycle_state` and a `SUCCESS` result_state. If not specified on job creation, reset, or update, the list is empty, and notifications are not sent.",
-                      "$ref": "#/$defs/slice/string"
+                    "report_parameters": {
+                      "description": "[Private Preview] (Optional) Additional custom parameters for Workday Report\nThis field is deprecated and should not be used. Use `parameters` instead.",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/pipelines.IngestionPipelineDefinitionWorkdayReportParametersQueryKeyValue",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "deprecationMessage": "This field is deprecated",
+                      "doNotSuggest": true,
+                      "deprecated": true
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.TaskNotificationSettings": {
+            "pipelines.IngestionPipelineDefinitionWorkdayReportParametersQueryKeyValue": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "alert_on_last_attempt": {
-                      "description": "If true, do not send notifications to recipients specified in `on_start` for the retried runs and do not send notifications to recipients specified in `on_failure` until the last retry of the run.",
-                      "$ref": "#/$defs/bool"
-                    },
-                    "no_alert_for_canceled_runs": {
-                      "description": "If true, do not send notifications to recipients specified in `on_failure` if the run is canceled.",
-                      "$ref": "#/$defs/bool"
+                    "key": {
+                      "description": "[Private Preview] Key for the report parameter, can be a column name or other metadata",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "no_alert_for_skipped_runs": {
-                      "description": "If true, do not send notifications to recipients specified in `on_failure` if the run is skipped.",
-                      "$ref": "#/$defs/bool"
+                    "value": {
+                      "description": "[Private Preview] Value for the report parameter.\nPossible values it can take are these sql functions:\n1. coalesce(current_offset(), date(\"YYYY-MM-DD\")) -\u003e if current_offset() is null, then the passed date, else current_offset()\n2. current_date()\n3. date_sub(current_date(), x) -\u003e subtract x (some non-negative integer) days from current date",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.TaskRetryMode": {
+            "pipelines.IngestionSourceType": {
               "oneOf": [
                 {
                   "type": "string",
-                  "description": "task retry mode of the continuous job\n* NEVER: The failed task will not be retried.\n* ON_FAILURE: Retry a failed task if at least one other task in the job is still running its first attempt.\nWhen this condition is no longer met or the retry limit is reached, the job run is cancelled and a new run is started.",
+                  "description": "Type of source system that a managed ingestion pipeline reads from.",
                   "enum": [
-                    "NEVER",
-                    "ON_FAILURE"
+                    "MYSQL",
+                    "POSTGRESQL",
+                    "SQLSERVER",
+                    "SALESFORCE",
+                    "BIGQUERY",
+                    "NETSUITE",
+                    "WORKDAY_RAAS",
+                    "GA4_RAW_DATA",
+                    "SERVICENOW",
+                    "MANAGED_POSTGRESQL",
+                    "ORACLE",
+                    "TERADATA",
+                    "SHAREPOINT",
+                    "DYNAMICS365",
+                    "GOOGLE_DRIVE",
+                    "JIRA",
+                    "CONFLUENCE",
+                    "META_MARKETING",
+                    "TIKTOK_ADS",
+                    "ZENDESK",
+                    "SMARTSHEET",
+                    "RABBITMQ",
+                    "FOREIGN_CATALOG"
+                  ],
+                  "enumDescriptions": [
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Private Preview]",
+                    "[Beta]",
+                    "[Public Preview]",
+                    "[Beta]",
+                    "[Beta]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Beta]",
+                    "[Private Preview]"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.TriggerSettings": {
+            "pipelines.JiraConnectorOptions": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Jira specific options for ingestion",
                   "properties": {
-                    "file_arrival": {
-                      "description": "File arrival trigger settings.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.FileArrivalTriggerConfiguration"
+                    "include_jira_spaces": {
+                      "description": "[Beta] (Optional) Projects to filter Jira data on",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "pipelines.JsonTransformerOptions": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "as_variant": {
+                      "description": "[Beta] Parse the entire value as a single Variant column.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     },
-                    "model": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.ModelTriggerConfiguration",
-                      "x-databricks-preview": "PRIVATE",
-                      "doNotSuggest": true
+                    "schema": {
+                      "description": "[Beta] Inline schema string for JSON parsing (Spark DDL format).",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     },
-                    "pause_status": {
-                      "description": "Whether this trigger is paused or not.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PauseStatus"
+                    "schema_evolution_mode": {
+                      "description": "[Beta] (Optional) Schema evolution mode for schema inference.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.FileIngestionOptionsSchemaEvolutionMode",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     },
-                    "periodic": {
-                      "description": "Periodic trigger settings.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PeriodicTriggerConfiguration"
+                    "schema_file_path": {
+                      "description": "[Beta] Path to a schema file (.ddl).",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     },
-                    "table_update": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.TableUpdateTriggerConfiguration"
+                    "schema_hints": {
+                      "description": "[Beta] (Optional) Schema hints as a comma-separated string of \"column_name type\" pairs.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.Webhook": {
+            "pipelines.KafkaOptions": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "id": {
-                      "$ref": "#/$defs/string"
+                    "client_config": {
+                      "description": "[Private Preview] Undocumented backdoor mechanism for overriding parameters\nto pass to the Kafka client.\nThis is not supported and may break at any time.",
+                      "$ref": "#/$defs/map/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "key_transformer": {
+                      "description": "[Beta] (Optional) Transformer for the message key.\nIf not specified, the key is left as raw bytes.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.Transformer",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
+                    },
+                    "max_offsets_per_trigger": {
+                      "description": "[Private Preview] Internal option to control the maximum number of offsets to process per trigger.",
+                      "$ref": "#/$defs/int64",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "starting_offset": {
+                      "description": "[Beta] (Optional) Where to begin reading when no checkpoint exists.\nValid values: \"latest\" and \"earliest\". Defaults to \"latest\".",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
+                    },
+                    "topic_pattern": {
+                      "description": "[Beta] Java regex pattern to subscribe to matching topics.\nOnly one of topics or topic_pattern must be specified.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
+                    },
+                    "topics": {
+                      "description": "[Beta] Topics to subscribe to.\nOnly one of topics or topic_pattern must be specified.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
+                    },
+                    "value_transformer": {
+                      "description": "[Beta] (Optional) Transformer for the message value.\nIf not specified, the value is left as raw bytes.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.Transformer",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     }
                   },
-                  "additionalProperties": false,
-                  "required": [
-                    "id"
-                  ]
+                  "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "jobs.WebhookNotifications": {
+            "pipelines.LinkedInAdsOptions": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "LinkedIn Ads specific options for ingestion.\nsync_start_date and lookback_window_days apply to both the prebuilt analytics\ntables and custom reports. custom_report_options defines a custom (user-defined)\nadAnalytics report and is only valid on a table object.",
                   "properties": {
-                    "on_duration_warning_threshold_exceeded": {
-                      "description": "An optional list of system notification IDs to call when the duration of a run exceeds the threshold specified for the `RUN_DURATION_SECONDS` metric in the `health` field. A maximum of 3 destinations can be specified for the `on_duration_warning_threshold_exceeded` property.",
-                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.Webhook"
-                    },
-                    "on_failure": {
-                      "description": "An optional list of system notification IDs to call when the run fails. A maximum of 3 destinations can be specified for the `on_failure` property.",
-                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.Webhook"
-                    },
-                    "on_start": {
-                      "description": "An optional list of system notification IDs to call when the run starts. A maximum of 3 destinations can be specified for the `on_start` property.",
-                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.Webhook"
+                    "custom_report_options": {
+                      "description": "[Private Preview] (Optional) Custom report definition. Only valid on a table object. When set,\nthe table is synthesized from /rest/adAnalytics using the finder, pivots,\ntime granularity and metrics here. When unset, the table must match one of\nthe connector's prebuilt sources.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.LinkedInAdsOptionsLinkedInAdsCustomReportOptions",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "on_streaming_backlog_exceeded": {
-                      "description": "An optional list of system notification IDs to call when any streaming backlog thresholds are exceeded for any stream.\nStreaming backlog thresholds can be set in the `health` field using the following metrics: `STREAMING_BACKLOG_BYTES`, `STREAMING_BACKLOG_RECORDS`, `STREAMING_BACKLOG_SECONDS`, or `STREAMING_BACKLOG_FILES`.\nAlerting is based on the 10-minute average of these metrics. If the issue persists, notifications are resent every 30 minutes.\nA maximum of 3 destinations can be specified for the `on_streaming_backlog_exceeded` property.",
-                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.Webhook"
+                    "lookback_window_days": {
+                      "description": "[Private Preview] (Optional) Days to look back during incremental sync for late-arriving data.\nIf not specified, defaults to 30 days.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "on_success": {
-                      "description": "An optional list of system notification IDs to call when the run completes successfully. A maximum of 3 destinations can be specified for the `on_success` property.",
-                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.Webhook"
+                    "sync_start_date": {
+                      "description": "[Private Preview] (Optional) Start date for the initial sync of report tables, YYYY-MM-DD.\nEarliest date from which to sync historical data; overrides the default\nwhen set. For finder attributedRevenueMetrics, this must be between 30 and\n366 days before today.\nIf not specified, defaults to 1 year of history.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "ml.ExperimentPermissionLevel": {
+            "pipelines.LinkedInAdsOptionsLinkedInAdsCustomReportOptions": {
               "oneOf": [
+                {
+                  "type": "object",
+                  "description": "User-defined custom report for the LinkedIn Ads connector. The destination\ntable name comes from the enclosing TableSpec.destination_table, the start\ndate from the enclosing LinkedInAdsOptions.sync_start_date, and the account\nit runs against from the source schema (namespace) -- none are repeated here.",
+                  "properties": {
+                    "entity_granularity": {
+                      "description": "[Private Preview] (Required) Entity pivots to group by; count/constraints depend on finder.",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/pipelines.LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsEntityGranularity",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "finder": {
+                      "description": "[Private Preview] (Required) adAnalytics finder. See LinkedInAdsFinder.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsFinder",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "metrics": {
+                      "description": "[Private Preview] (Optional) LinkedIn metric names for the report. Open vocabulary (not an\nenum): the valid set is large (~100) and evolves with the LinkedIn\nadAnalytics API, so values are passed through verbatim. If empty, a\npivot-safe default core set is ingested: impressions, clicks,\ncostInLocalCurrency, externalWebsiteConversions (valid for every pivot).\nIgnored for attributedRevenueMetrics (always returns the full\nRevenueAttributionMetrics struct).",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "time_granularity": {
+                      "description": "[Private Preview] (Optional) Time aggregation. Defaults to DAILY when unspecified. Used by\nanalytics/statistics; ignored for attributedRevenueMetrics.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsTimeGranularity",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "finder"
+                  ]
+                },
                 {
                   "type": "string",
-                  "description": "Permission level",
-                  "enum": [
-                    "CAN_MANAGE",
-                    "CAN_EDIT",
-                    "CAN_READ"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "pipelines.LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsEntityGranularity": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "description": "Entity pivot to group by.",
+                  "enum": [
+                    "CAMPAIGN",
+                    "CREATIVE",
+                    "CAMPAIGN_GROUP"
+                  ],
+                  "enumDescriptions": [
+                    "[Private Preview]",
+                    "[Private Preview]",
+                    "[Private Preview]"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "ml.ExperimentTag": {
+            "pipelines.LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsFinder": {
               "oneOf": [
                 {
-                  "type": "object",
-                  "description": "A tag for an experiment.",
-                  "properties": {
-                    "key": {
-                      "description": "The tag key.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "value": {
-                      "description": "The tag value.",
-                      "$ref": "#/$defs/string"
-                    }
-                  },
-                  "additionalProperties": false
+                  "type": "string",
+                  "description": "adAnalytics finder. Determines call shape, valid pivots, and metric\nrequirements.",
+                  "enum": [
+                    "ANALYTICS",
+                    "STATISTICS",
+                    "ATTRIBUTED_REVENUE_METRICS"
+                  ],
+                  "enumDescriptions": [
+                    "[Private Preview]",
+                    "[Private Preview]",
+                    "[Private Preview]"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "ml.ModelTag": {
+            "pipelines.LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsTimeGranularity": {
               "oneOf": [
                 {
-                  "type": "object",
-                  "description": "Tag for a registered model",
-                  "properties": {
-                    "key": {
-                      "description": "The tag key.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "value": {
-                      "description": "The tag value.",
-                      "$ref": "#/$defs/string"
-                    }
-                  },
-                  "additionalProperties": false
+                  "type": "string",
+                  "description": "Time aggregation. Used by analytics/statistics; ignored for\nattributedRevenueMetrics. Defaults to DAILY when unspecified.",
+                  "enum": [
+                    "ALL",
+                    "DAILY",
+                    "MONTHLY",
+                    "YEARLY"
+                  ],
+                  "enumDescriptions": [
+                    "[Private Preview]",
+                    "[Private Preview]",
+                    "[Private Preview]",
+                    "[Private Preview]"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "ml.RegisteredModelPermissionLevel": {
+            "pipelines.ManualTrigger": {
               "oneOf": [
                 {
-                  "type": "string",
-                  "description": "Permission level",
-                  "enum": [
-                    "CAN_MANAGE",
-                    "CAN_MANAGE_PRODUCTION_VERSIONS",
-                    "CAN_MANAGE_STAGING_VERSIONS",
-                    "CAN_EDIT",
-                    "CAN_READ"
-                  ]
+                  "type": "object",
+                  "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.AutoFullRefreshPolicy": {
+            "pipelines.MarketoOptions": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "Policy for auto full refresh.",
+                  "description": "Marketo specific options for ingestion",
                   "properties": {
-                    "enabled": {
-                      "description": "(Required, Mutable) Whether to enable auto full refresh or not.",
-                      "$ref": "#/$defs/bool"
-                    },
-                    "min_interval_hours": {
-                      "description": "(Optional, Mutable) Specify the minimum interval in hours between the timestamp\nat which a table was last full refreshed and the current timestamp for triggering auto full\nIf unspecified and autoFullRefresh is enabled then by default min_interval_hours is 24 hours.",
-                      "$ref": "#/$defs/int"
+                    "sync_start_date": {
+                      "description": "[Private Preview] (Optional) Start date for the initial sync in YYYY-MM-DD format.\nThis determines the earliest date from which to sync historical data.\nIf not specified, complete history is ingested.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
-                  "additionalProperties": false,
-                  "required": [
-                    "enabled"
-                  ]
+                  "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.ConnectionParameters": {
+            "pipelines.MetaMarketingOptions": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Meta Marketing (Meta Ads) specific options for ingestion",
                   "properties": {
-                    "source_catalog": {
-                      "description": "Source catalog for initial connection.\nThis is necessary for schema exploration in some database systems like Oracle, and optional but nice-to-have\nin some other database systems like Postgres.\nFor Oracle databases, this maps to a service name.",
+                    "action_attribution_windows": {
+                      "description": "[Beta] (Optional, DEPRECATED — use custom_report_options.action_attribution_windows) Action attribution\nwindows for insights reporting (e.g. \"28d_click\", \"1d_view\")",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PUBLIC_BETA",
+                      "deprecationMessage": "This field is deprecated",
+                      "deprecated": true
+                    },
+                    "action_breakdowns": {
+                      "description": "[Beta] (Optional, DEPRECATED — use custom_report_options.action_breakdowns) Action breakdowns",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PUBLIC_BETA",
+                      "deprecationMessage": "This field is deprecated",
+                      "deprecated": true
+                    },
+                    "action_report_time": {
+                      "description": "[Beta] (Optional, DEPRECATED — use custom_report_options.action_report_time) Timing used to report\naction statistics (impression, conversion, mixed, or lifetime)",
                       "$ref": "#/$defs/string",
-                      "x-databricks-preview": "PRIVATE",
+                      "x-databricks-launch-stage": "PUBLIC_BETA",
+                      "deprecationMessage": "This field is deprecated",
+                      "deprecated": true
+                    },
+                    "breakdowns": {
+                      "description": "[Beta] (Optional, DEPRECATED — use custom_report_options.breakdowns) Breakdowns to configure",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PUBLIC_BETA",
+                      "deprecationMessage": "This field is deprecated",
+                      "deprecated": true
+                    },
+                    "custom_insights_lookback_window": {
+                      "description": "[Beta] (Optional) Window in days to revisit data during sync to capture\nupdated conversion data from the API, shared by prebuilt and custom reports.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
+                    },
+                    "custom_report_options": {
+                      "description": "[Private Preview] (Optional) Per-table custom report definition. When set, defines the shape of the insights\ncall for this table (level/fields/breakdowns/action_breakdowns/etc.). Supersedes the deprecated\nflat report-shape fields above.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.MetaMarketingOptionsMetaMarketingCustomReportOptions",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
                       "doNotSuggest": true
+                    },
+                    "level": {
+                      "description": "[Beta] (Optional, DEPRECATED — use custom_report_options.level) Granularity of data to pull\n(account, ad, adset, campaign)",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_BETA",
+                      "deprecationMessage": "This field is deprecated",
+                      "deprecated": true
+                    },
+                    "start_date": {
+                      "description": "[Beta] (Optional) Start date in yyyy-MM-dd format (e.g. 2025-01-15). Data added\nafter this date will be ingested, shared by prebuilt and custom reports.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
+                    },
+                    "time_increment": {
+                      "description": "[Beta] (Optional, DEPRECATED — use custom_report_options.time_increment) Value in string by which to\naggregate statistics (can take all_days, monthly or number of days)",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_BETA",
+                      "deprecationMessage": "This field is deprecated",
+                      "deprecated": true
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.ConnectorOptions": {
+            "pipelines.MetaMarketingOptionsMetaMarketingCustomReportOptions": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "Wrapper message for source-specific options to support multiple connector types",
+                  "description": "Defines the shape of a single Meta Ads custom report (one /insights call shape).\nstart_date, custom_insights_lookback_window live on MetaMarketingOptions, not here.\nMetrics are not customer-selectable; the connector returns a fixed standard metric set.",
                   "properties": {
-                    "gdrive_options": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.GoogleDriveOptions",
-                      "x-databricks-preview": "PRIVATE",
+                    "action_attribution_windows": {
+                      "description": "[Private Preview] (Optional) Action attribution windows for insights reporting (e.g. \"28d_click\", \"1d_view\")",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
                       "doNotSuggest": true
                     },
-                    "google_ads_options": {
-                      "description": "Google Ads specific options for ingestion (object-level).\nWhen set, these values override the corresponding fields in GoogleAdsConfig\n(source_configurations).",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.GoogleAdsOptions",
-                      "x-databricks-preview": "PRIVATE",
+                    "action_breakdowns": {
+                      "description": "[Private Preview] (Optional) Action breakdowns to configure for data aggregation",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
                       "doNotSuggest": true
                     },
-                    "sharepoint_options": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.SharepointOptions",
-                      "x-databricks-preview": "PRIVATE",
+                    "action_report_time": {
+                      "description": "[Private Preview] (Optional) Timing used to report action statistics (impression, conversion, mixed, or lifetime)",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
                       "doNotSuggest": true
                     },
-                    "tiktok_ads_options": {
-                      "description": "TikTok Ads specific options for ingestion",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.TikTokAdsOptions",
-                      "x-databricks-preview": "PRIVATE",
+                    "breakdowns": {
+                      "description": "[Private Preview] (Optional) Breakdowns to configure for data aggregation",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "level": {
+                      "description": "[Private Preview] (Optional) Granularity of data to pull (account, ad, adset, campaign)",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "time_increment": {
+                      "description": "[Private Preview] (Optional) Value in string by which to aggregate statistics (all_days, monthly or number of days)",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
                       "doNotSuggest": true
                     }
                   },
@@ -7930,974 +15559,1304 @@
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.ConnectorType": {
+            "pipelines.NotebookLibrary": {
               "oneOf": [
                 {
-                  "type": "string",
-                  "description": "For certain database sources LakeFlow Connect offers both query based and cdc\ningestion, ConnectorType can bse used to convey the type of ingestion.\nIf connection_name is provided for database sources, we default to Query Based ingestion",
-                  "enum": [
-                    "CDC",
-                    "QUERY_BASED"
-                  ]
+                  "type": "object",
+                  "properties": {
+                    "path": {
+                      "description": "The absolute path of the source code.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.CronTrigger": {
+            "pipelines.Notifications": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "quartz_cron_schedule": {
-                      "$ref": "#/$defs/string"
+                    "alerts": {
+                      "description": "A list of alerts that trigger the sending of notifications to the configured\ndestinations. The supported alerts are:\n\n* `on-update-success`: A pipeline update completes successfully.\n* `on-update-failure`: Each time a pipeline update fails.\n* `on-update-fatal-failure`: A pipeline update fails with a non-retryable (fatal) error.\n* `on-flow-failure`: A single data flow fails.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "timezone_id": {
-                      "$ref": "#/$defs/string"
+                    "email_recipients": {
+                      "description": "A list of email addresses notified when a configured alert is triggered.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.DataStagingOptions": {
+            "pipelines.OperationTimeWindow": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "Location of staged data storage",
+                  "description": "Proto representing a window",
                   "properties": {
-                    "catalog_name": {
-                      "description": "(Required, Immutable) The name of the catalog for the connector's staging storage location.",
-                      "$ref": "#/$defs/string"
+                    "days_of_week": {
+                      "description": "[Public Preview] Days of week in which the window is allowed to happen\nIf not specified all days of the week will be used.",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/pipelines.DayOfWeek",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "schema_name": {
-                      "description": "(Required, Immutable) The name of the schema for the connector's staging storage location.",
-                      "$ref": "#/$defs/string"
+                    "start_hour": {
+                      "description": "[Public Preview] An integer between 0 and 23 denoting the start hour for the window in the 24-hour day.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "volume_name": {
-                      "description": "(Optional) The Unity Catalog-compatible name for the storage location.\nThis is the volume to use for the data that is extracted by the connector.\nSpark Declarative Pipelines system will automatically create the volume under the catalog and schema.\nFor Combined Cdc Managed Ingestion pipelines default name for the volume would be :\n__databricks_ingestion_gateway_staging_data-$pipelineId",
-                      "$ref": "#/$defs/string"
+                    "time_zone_id": {
+                      "description": "[Public Preview] Time zone id of window. See https://docs.databricks.com/sql/language-manual/sql-ref-syntax-aux-conf-mgmt-set-timezone.html for details.\nIf not specified, UTC will be used.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "catalog_name",
-                    "schema_name"
+                    "start_hour"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.DayOfWeek": {
+            "pipelines.OutlookAttachmentMode": {
               "oneOf": [
                 {
                   "type": "string",
-                  "description": "Days of week in which the window is allowed to happen.\nIf not specified all days of the week will be used.",
+                  "description": "Attachment behavior mode for Outlook ingestion",
                   "enum": [
-                    "MONDAY",
-                    "TUESDAY",
-                    "WEDNESDAY",
-                    "THURSDAY",
-                    "FRIDAY",
-                    "SATURDAY",
-                    "SUNDAY"
+                    "ALL",
+                    "NON_INLINE_ONLY",
+                    "INLINE_ONLY",
+                    "NONE"
+                  ],
+                  "enumDescriptions": [
+                    "[Private Preview]",
+                    "[Private Preview]",
+                    "[Private Preview]",
+                    "[Private Preview]"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.DeploymentKind": {
+            "pipelines.OutlookBodyFormat": {
               "oneOf": [
                 {
                   "type": "string",
-                  "description": "The deployment method that manages the pipeline:\n- BUNDLE: The pipeline is managed by a Databricks Asset Bundle.",
+                  "description": "Body format for Outlook email content",
                   "enum": [
-                    "BUNDLE"
+                    "TEXT_HTML",
+                    "TEXT_PLAIN"
+                  ],
+                  "enumDescriptions": [
+                    "[Private Preview]",
+                    "[Private Preview]"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.EventLogSpec": {
+            "pipelines.OutlookOptions": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "Configurable event log parameters.",
+                  "description": "Outlook specific options for ingestion",
                   "properties": {
-                    "catalog": {
-                      "description": "The UC catalog the event log is published under.",
-                      "$ref": "#/$defs/string"
+                    "attachment_mode": {
+                      "description": "[Private Preview] (Optional) Controls which attachments to ingest.\nIf not specified, defaults to ALL.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.OutlookAttachmentMode",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "name": {
-                      "description": "The name the event log is published to in UC.",
-                      "$ref": "#/$defs/string"
+                    "body_format": {
+                      "description": "[Private Preview] (Optional) Defines how the body_content column is populated.\nTEXT_HTML: Preserves full formatting, links, and styling.\nTEXT_PLAIN: Converts body to plain text. Recommended for AI/RAG pipelines to reduce token usage and noise.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.OutlookBodyFormat",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "schema": {
-                      "description": "The UC schema the event log is published under.",
-                      "$ref": "#/$defs/string"
+                    "folder_filter": {
+                      "description": "[Private Preview] Deprecated. Use include_folders instead.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "deprecationMessage": "This field is deprecated",
+                      "doNotSuggest": true,
+                      "deprecated": true
+                    },
+                    "include_folders": {
+                      "description": "[Private Preview] (Optional) Filter mail folders to include in the sync.\nIf not specified, all folders will be synced.\nExamples: Inbox, Sent Items, Custom_Folder\nFilter semantics: OR between different folders.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "include_mailboxes": {
+                      "description": "[Private Preview] (Optional) List of mailboxes to sync (e.g. mailbox email addresses or identifiers).\nIf not specified, all accessible mailboxes are ingested.\nFilter semantics: OR between different mailboxes.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "include_senders": {
+                      "description": "[Private Preview] (Optional) Filter emails by sender address. Uses exact email match.\nExamples: user@vendor.com, alerts@system.io, noreply@company.com\nIf not specified, emails from all senders will be synced.\nFilter semantics: OR between different senders.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "include_subjects": {
+                      "description": "[Private Preview] (Optional) Filter emails by subject line. Values ending with \"*\" use prefix match (subject starts with\nthe part before \"*\"); otherwise substring match (subject contains the value).\nExamples: \"Invoice\" (substring), \"Re:*\" (prefix), \"Support Ticket\", \"URGENT*\"\nIf not specified, emails with all subjects will be synced.\nFilter semantics: OR between different subjects.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "sender_filter": {
+                      "description": "[Private Preview] Deprecated. Use include_senders instead.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "deprecationMessage": "This field is deprecated",
+                      "doNotSuggest": true,
+                      "deprecated": true
+                    },
+                    "start_date": {
+                      "description": "[Private Preview] (Optional) Start date for the initial sync in YYYY-MM-DD format.\nFormat: YYYY-MM-DD (e.g., 2024-01-01)\nThis determines the earliest date from which to sync historical data.\nIf not specified, complete history is ingested.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "subject_filter": {
+                      "description": "[Private Preview] Deprecated. Use include_subjects instead.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "deprecationMessage": "This field is deprecated",
+                      "doNotSuggest": true,
+                      "deprecated": true
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.FileFilter": {
+            "pipelines.ParseMode": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "description": "Determines how errors encountered while deserializing records are handled.",
+                  "enum": [
+                    "FAILFAST",
+                    "PERMISSIVE"
+                  ],
+                  "enumDescriptions": [
+                    "[Beta]",
+                    "[Beta]"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "pipelines.PathPattern": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "modified_after": {
-                      "description": "Include files with modification times occurring after the specified time.\nTimestamp format: YYYY-MM-DDTHH:mm:ss (e.g. 2020-06-01T13:00:00)\nBased on https://spark.apache.org/docs/latest/sql-data-sources-generic-options.html#modification-time-path-filters",
-                      "$ref": "#/$defs/string"
-                    },
-                    "modified_before": {
-                      "description": "Include files with modification times occurring before the specified time.\nTimestamp format: YYYY-MM-DDTHH:mm:ss (e.g. 2020-06-01T13:00:00)\nBased on https://spark.apache.org/docs/latest/sql-data-sources-generic-options.html#modification-time-path-filters",
-                      "$ref": "#/$defs/string"
-                    },
-                    "path_filter": {
-                      "description": "Include files with file names matching the pattern\nBased on https://spark.apache.org/docs/latest/sql-data-sources-generic-options.html#path-glob-filter",
-                      "$ref": "#/$defs/string"
+                    "include": {
+                      "description": "[Public Preview] The source code to include for pipelines",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.FileIngestionOptions": {
+            "pipelines.PipelineCluster": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "corrupt_record_column": {
-                      "$ref": "#/$defs/string"
+                    "apply_policy_default_values": {
+                      "description": "Note: This field won't be persisted. Only API users will check this field.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "autoscale": {
+                      "description": "Parameters needed in order to automatically scale clusters up and down based on load.\nNote: autoscaling works best with DB runtime versions 3.0 or later.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.PipelineClusterAutoscale",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "aws_attributes": {
+                      "description": "Attributes related to clusters running on Amazon Web Services.\nIf not specified at cluster creation, a set of default values will be used.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.AwsAttributes",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "azure_attributes": {
+                      "description": "Attributes related to clusters running on Microsoft Azure.\nIf not specified at cluster creation, a set of default values will be used.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.AzureAttributes",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "cluster_log_conf": {
+                      "description": "The configuration for delivering spark logs to a long-term storage destination.\nOnly dbfs destinations are supported. Only one destination can be specified\nfor one cluster. If the conf is given, the logs will be delivered to the destination every\n`5 mins`. The destination of driver logs is `$destination/$clusterId/driver`, while\nthe destination of executor logs is `$destination/$clusterId/executor`.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.ClusterLogConf",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "custom_tags": {
+                      "description": "Additional tags for cluster resources. Databricks will tag all cluster resources (e.g., AWS\ninstances and EBS volumes) with these tags in addition to `default_tags`. Notes:\n\n- Currently, Databricks allows at most 45 custom tags\n\n- Clusters can only reuse cloud resources if the resources' tags are a subset of the cluster tags",
+                      "$ref": "#/$defs/map/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "file_filters": {
-                      "description": "Generic options",
-                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/pipelines.FileFilter"
+                    "driver_instance_pool_id": {
+                      "description": "The optional ID of the instance pool for the driver of the cluster belongs.\nThe pool cluster uses the instance pool with id (instance_pool_id) if the driver pool is not\nassigned.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "format": {
-                      "description": "required for TableSpec",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.FileIngestionOptionsFileFormat"
+                    "driver_node_type_id": {
+                      "description": "The node type of the Spark driver.\nNote that this field is optional; if unset, the driver node type will be set as the same value\nas `node_type_id` defined above.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "format_options": {
-                      "description": "Format-specific options\nBased on https://docs.databricks.com/aws/en/ingestion/cloud-object-storage/auto-loader/options#file-format-options",
-                      "$ref": "#/$defs/map/string"
+                    "enable_local_disk_encryption": {
+                      "description": "Whether to enable local disk encryption for the cluster.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "ignore_corrupt_files": {
-                      "$ref": "#/$defs/bool"
+                    "gcp_attributes": {
+                      "description": "Attributes related to clusters running on Google Cloud Platform.\nIf not specified at cluster creation, a set of default values will be used.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.GcpAttributes",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "infer_column_types": {
-                      "$ref": "#/$defs/bool"
+                    "init_scripts": {
+                      "description": "The configuration for storing init scripts. Any number of destinations can be specified. The scripts are executed sequentially in the order provided. If `cluster_log_conf` is specified, init script logs are sent to `\u003cdestination\u003e/\u003ccluster-ID\u003e/init_scripts`.",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/compute.InitScriptInfo",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "reader_case_sensitive": {
-                      "description": "Column name case sensitivity\nhttps://docs.databricks.com/aws/en/ingestion/cloud-object-storage/auto-loader/schema#change-case-sensitive-behavior",
-                      "$ref": "#/$defs/bool"
+                    "instance_pool_id": {
+                      "description": "The optional ID of the instance pool to which the cluster belongs.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "rescued_data_column": {
-                      "$ref": "#/$defs/string"
+                    "label": {
+                      "description": "A label for the cluster specification, either `default` to configure the default cluster settings applied to both the update and maintenance clusters, `updates` to configure the update cluster, or `maintenance` to configure the maintenance cluster. This field is optional. The default value is `default`.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "schema_evolution_mode": {
-                      "description": "Based on https://docs.databricks.com/aws/en/ingestion/cloud-object-storage/auto-loader/schema#how-does-auto-loader-schema-evolution-work",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.FileIngestionOptionsSchemaEvolutionMode"
+                    "node_type_id": {
+                      "description": "This field encodes, through a single value, the resources available to each of\nthe Spark nodes in this cluster. For example, the Spark nodes can be provisioned\nand optimized for memory or compute intensive workloads. A list of available node\ntypes can be retrieved by using the :method:clusters/listNodeTypes API call.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "schema_hints": {
-                      "description": "Override inferred schema of specific columns\nBased on https://docs.databricks.com/aws/en/ingestion/cloud-object-storage/auto-loader/schema#override-schema-inference-with-schema-hints",
-                      "$ref": "#/$defs/string"
+                    "num_workers": {
+                      "description": "Number of worker nodes that this cluster should have. A cluster has one Spark Driver\nand `num_workers` Executors for a total of `num_workers` + 1 Spark nodes.\n\nNote: When reading the properties of a cluster, this field reflects the desired number\nof workers rather than the actual current number of workers. For instance, if a cluster\nis resized from 5 to 10 workers, this field will immediately be updated to reflect\nthe target size of 10 workers, whereas the workers listed in `spark_info` will gradually\nincrease from 5 to 10 as the new nodes are provisioned.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "single_variant_column": {
-                      "$ref": "#/$defs/string"
+                    "policy_id": {
+                      "description": "The ID of the cluster policy used to create the cluster if applicable.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "spark_conf": {
+                      "description": "An object containing a set of optional, user-specified Spark configuration key-value pairs.\nSee :method:clusters/create for more details.",
+                      "$ref": "#/$defs/map/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "spark_env_vars": {
+                      "description": "An object containing a set of optional, user-specified environment variable key-value pairs.\nPlease note that key-value pair of the form (X,Y) will be exported as is (i.e.,\n`export X='Y'`) while launching the driver and workers.\n\nIn order to specify an additional set of `SPARK_DAEMON_JAVA_OPTS`, we recommend appending\nthem to `$SPARK_DAEMON_JAVA_OPTS` as shown in the example below. This ensures that all\ndefault databricks managed environmental variables are included as well.\n\nExample Spark environment variables:\n`{\"SPARK_WORKER_MEMORY\": \"28000m\", \"SPARK_LOCAL_DIRS\": \"/local_disk0\"}` or\n`{\"SPARK_DAEMON_JAVA_OPTS\": \"$SPARK_DAEMON_JAVA_OPTS -Dspark.shuffle.service.enabled=true\"}`",
+                      "$ref": "#/$defs/map/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "ssh_public_keys": {
+                      "description": "SSH public key contents that will be added to each Spark node in this cluster. The\ncorresponding private keys can be used to login with the user name `ubuntu` on port `2200`.\nUp to 10 keys can be specified.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.FileIngestionOptionsFileFormat": {
+            "pipelines.PipelineClusterAutoscale": {
               "oneOf": [
                 {
-                  "type": "string",
-                  "enum": [
-                    "BINARYFILE",
-                    "JSON",
-                    "CSV",
-                    "XML",
-                    "EXCEL",
-                    "PARQUET",
-                    "AVRO",
-                    "ORC"
+                  "type": "object",
+                  "properties": {
+                    "max_workers": {
+                      "description": "The maximum number of workers to which the cluster can scale up when overloaded. `max_workers` must be strictly greater than `min_workers`.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "min_workers": {
+                      "description": "The minimum number of workers the cluster can scale down to when underutilized.\nIt is also the initial number of workers the cluster will have after creation.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "mode": {
+                      "description": "Databricks Enhanced Autoscaling optimizes cluster utilization by automatically\nallocating cluster resources based on workload volume, with minimal impact to\nthe data processing latency of your pipelines. Enhanced Autoscaling is available\nfor `updates` clusters only. The legacy autoscaling feature is used for `maintenance`\nclusters.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.PipelineClusterAutoscaleMode",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "max_workers",
+                    "min_workers"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.FileIngestionOptionsSchemaEvolutionMode": {
+            "pipelines.PipelineClusterAutoscaleMode": {
               "oneOf": [
                 {
                   "type": "string",
-                  "description": "Based on https://docs.databricks.com/aws/en/ingestion/cloud-object-storage/auto-loader/schema#how-does-auto-loader-schema-evolution-work",
+                  "description": "Databricks Enhanced Autoscaling optimizes cluster utilization by automatically\nallocating cluster resources based on workload volume, with minimal impact to\nthe data processing latency of your pipelines. Enhanced Autoscaling is available\nfor `updates` clusters only. The legacy autoscaling feature is used for `maintenance`\nclusters.",
                   "enum": [
-                    "ADD_NEW_COLUMNS_WITH_TYPE_WIDENING",
-                    "ADD_NEW_COLUMNS",
-                    "RESCUE",
-                    "FAIL_ON_NEW_COLUMNS",
-                    "NONE"
+                    "ENHANCED",
+                    "LEGACY"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.FileLibrary": {
+            "pipelines.PipelineDeployment": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "path": {
-                      "description": "The absolute path of the source code.",
-                      "$ref": "#/$defs/string"
+                    "kind": {
+                      "description": "The deployment method that manages the pipeline.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.DeploymentKind",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "metadata_file_path": {
+                      "description": "The path to the file containing metadata about the deployment.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
-                  "additionalProperties": false
+                  "additionalProperties": false,
+                  "required": [
+                    "kind"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.Filters": {
+            "pipelines.PipelineLibrary": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "exclude": {
-                      "description": "Paths to exclude.",
-                      "$ref": "#/$defs/slice/string"
+                    "file": {
+                      "description": "The path to a file that defines a pipeline and is stored in the Databricks Repos.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.FileLibrary",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "include": {
-                      "description": "Paths to include.",
-                      "$ref": "#/$defs/slice/string"
+                    "glob": {
+                      "description": "[Public Preview] The unified field to include source codes.\nEach entry can be a notebook path, a file path, or a folder path that ends `/**`.\nThis field cannot be used together with `notebook` or `file`.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.PathPattern",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "jar": {
+                      "description": "[Private Preview] URI of the jar to be installed. Currently only DBFS is supported.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "maven": {
+                      "description": "[Private Preview] Specification of a maven library to be installed.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.MavenLibrary",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "notebook": {
+                      "description": "The path to a notebook that defines a pipeline and is stored in the Databricks workspace.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.NotebookLibrary",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "whl": {
+                      "description": "URI of the whl to be installed.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA",
+                      "deprecationMessage": "This field is deprecated",
+                      "deprecated": true
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.GoogleAdsOptions": {
+            "pipelines.PipelinePermissionLevel": {
               "oneOf": [
                 {
-                  "type": "object",
-                  "description": "Google Ads specific options for ingestion (object-level).\nWhen set, these values override the corresponding fields in GoogleAdsConfig\n(source_configurations).",
-                  "properties": {
-                    "lookback_window_days": {
-                      "description": "(Optional) Number of days to look back for report tables to capture late-arriving data.\nIf not specified, defaults to 30 days.",
-                      "$ref": "#/$defs/int"
-                    },
-                    "manager_account_id": {
-                      "description": "(Optional at this level) Manager Account ID (also called MCC Account ID) used to list\nand access customer accounts under this manager account.\nOverrides GoogleAdsConfig.manager_account_id from source_configurations when set.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "sync_start_date": {
-                      "description": "(Optional) Start date for the initial sync of report tables in YYYY-MM-DD format.\nThis determines the earliest date from which to sync historical data.\nIf not specified, defaults to 2 years of historical data.",
-                      "$ref": "#/$defs/string"
-                    }
-                  },
-                  "additionalProperties": false,
-                  "required": [
-                    "manager_account_id"
+                  "type": "string",
+                  "description": "Permission level",
+                  "enum": [
+                    "CAN_MANAGE",
+                    "IS_OWNER",
+                    "CAN_RUN",
+                    "CAN_VIEW"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.GoogleDriveOptions": {
+            "pipelines.PipelineTrigger": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "entity_type": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.GoogleDriveOptionsGoogleDriveEntityType"
-                    },
-                    "file_ingestion_options": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.FileIngestionOptions"
+                    "cron": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.CronTrigger",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "url": {
-                      "description": "Google Drive URL.",
-                      "$ref": "#/$defs/string"
+                    "manual": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.ManualTrigger",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.GoogleDriveOptionsGoogleDriveEntityType": {
+            "pipelines.PipelinesEnvironment": {
               "oneOf": [
                 {
-                  "type": "string",
-                  "enum": [
-                    "FILE",
-                    "FILE_METADATA",
-                    "PERMISSION"
-                  ]
+                  "type": "object",
+                  "description": "The environment entity used to preserve serverless environment side panel, jobs' environment for non-notebook task, and SDP's environment for classic and serverless pipelines.\nIn this minimal environment spec, only pip dependencies are supported.",
+                  "properties": {
+                    "dependencies": {
+                      "description": "[Public Preview] List of pip dependencies, as supported by the version of pip in this environment.\nEach dependency is a pip requirement file line https://pip.pypa.io/en/stable/reference/requirements-file-format/\nAllowed dependency could be \u003crequirement specifier\u003e, \u003carchive url/path\u003e, \u003clocal project path\u003e(WSFS or Volumes in Databricks), \u003cvcs project url\u003e",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "environment_version": {
+                      "description": "[Public Preview] The environment version of the serverless Python environment used to execute\ncustomer Python code. Each environment version includes a specific Python\nversion and a curated set of pre-installed libraries with defined versions,\nproviding a stable and reproducible execution environment.\n\nDatabricks supports a three-year lifecycle for each environment version.\nFor available versions and their included packages, see\nhttps://docs.databricks.com/aws/en/release-notes/serverless/environment-version/\n\nThe value should be a string representing the environment version number, for example: `\"4\"`.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    }
+                  },
+                  "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.IngestionConfig": {
+            "pipelines.PostgresCatalogConfig": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "PG-specific catalog-level configuration parameters",
                   "properties": {
-                    "report": {
-                      "description": "Select a specific source report.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.ReportSpec"
-                    },
-                    "schema": {
-                      "description": "Select all tables from a specific source schema.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.SchemaSpec"
-                    },
-                    "table": {
-                      "description": "Select a specific source table.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.TableSpec"
+                    "slot_config": {
+                      "description": "[Public Preview] Optional. The Postgres slot configuration to use for logical replication",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.PostgresSlotConfig",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.IngestionGatewayPipelineDefinition": {
+            "pipelines.PostgresSlotConfig": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "PostgresSlotConfig contains the configuration for a Postgres logical replication slot",
                   "properties": {
-                    "connection_id": {
-                      "description": "[Deprecated, use connection_name instead] Immutable. The Unity Catalog connection that this gateway pipeline uses to communicate with the source.",
+                    "publication_name": {
+                      "description": "[Public Preview] The name of the publication to use for the Postgres source",
                       "$ref": "#/$defs/string",
-                      "deprecationMessage": "This field is deprecated",
-                      "deprecated": true
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "connection_name": {
-                      "description": "Immutable. The Unity Catalog connection that this gateway pipeline uses to communicate with the source.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "connection_parameters": {
-                      "description": "Optional, Internal. Parameters required to establish an initial connection with the source.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.ConnectionParameters",
-                      "x-databricks-preview": "PRIVATE",
-                      "doNotSuggest": true
-                    },
-                    "gateway_storage_catalog": {
-                      "description": "Required, Immutable. The name of the catalog for the gateway pipeline's storage location.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "gateway_storage_name": {
-                      "description": "Optional. The Unity Catalog-compatible name for the gateway storage location.\nThis is the destination to use for the data that is extracted by the gateway.\nSpark Declarative Pipelines system will automatically create the storage location under the catalog and schema.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "gateway_storage_schema": {
-                      "description": "Required, Immutable. The name of the schema for the gateway pipelines's storage location.",
-                      "$ref": "#/$defs/string"
+                    "slot_name": {
+                      "description": "[Public Preview] The name of the logical replication slot to use for the Postgres source",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     }
                   },
-                  "additionalProperties": false,
-                  "required": [
-                    "connection_name",
-                    "gateway_storage_catalog",
-                    "gateway_storage_schema"
-                  ]
+                  "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.IngestionPipelineDefinition": {
-              "oneOf": [
-                {
-                  "type": "object",
-                  "properties": {
-                    "connection_name": {
-                      "description": "The Unity Catalog connection that this ingestion pipeline uses to communicate with the source. This is used with\nboth connectors for applications like Salesforce, Workday, and so on, and also database connectors like Oracle,\n(connector_type = QUERY_BASED OR connector_type = CDC).\nIf connection name corresponds to database connectors like Oracle, and connector_type is not provided then\nconnector_type defaults to QUERY_BASED. If connector_type is passed as CDC we use Combined Cdc Managed Ingestion\npipeline.\nUnder certain conditions, this can be replaced with ingestion_gateway_id to change the connector to Cdc Managed\nIngestion Pipeline with Gateway pipeline.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "connector_type": {
-                      "description": "(Optional) Connector Type for sources. Ex: CDC, Query Based.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.ConnectorType",
-                      "x-databricks-preview": "PRIVATE",
-                      "doNotSuggest": true
-                    },
-                    "data_staging_options": {
-                      "description": "(Optional) Location of staged data storage. This is required for migration from Cdc Managed Ingestion Pipeline\nwith Gateway pipeline to Combined Cdc Managed Ingestion Pipeline.\nIf not specified, the volume for staged data will be created in catalog and schema/target specified in the\ntop level pipeline definition.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.DataStagingOptions",
-                      "x-databricks-preview": "PRIVATE",
-                      "doNotSuggest": true
-                    },
-                    "full_refresh_window": {
-                      "description": "(Optional) A window that specifies a set of time ranges for snapshot queries in CDC.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.OperationTimeWindow"
-                    },
-                    "ingest_from_uc_foreign_catalog": {
-                      "description": "Immutable. If set to true, the pipeline will ingest tables from the\nUC foreign catalogs directly without the need to specify a UC connection or ingestion gateway.\nThe `source_catalog` fields in objects of IngestionConfig are interpreted as\nthe UC foreign catalogs to ingest from.",
-                      "$ref": "#/$defs/bool",
-                      "x-databricks-preview": "PRIVATE",
-                      "doNotSuggest": true
-                    },
-                    "ingestion_gateway_id": {
-                      "description": "Identifier for the gateway that is used by this ingestion pipeline to communicate with the source database.\nThis is used with CDC connectors to databases like SQL Server using a gateway pipeline (connector_type = CDC).\nUnder certain conditions, this can be replaced with connection_name to change the connector to Combined Cdc\nManaged Ingestion Pipeline.",
-                      "$ref": "#/$defs/string"
+            "pipelines.ProtobufTransformerOptions": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "desc_file_path": {
+                      "description": "[Beta] Required: path to the .desc file (dbfs:/... or /Volumes/...).",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     },
-                    "netsuite_jar_path": {
+                    "message_name": {
+                      "description": "[Beta] Required: fully-qualified message type name.",
                       "$ref": "#/$defs/string",
-                      "x-databricks-preview": "PRIVATE",
-                      "doNotSuggest": true
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     },
-                    "objects": {
-                      "description": "Required. Settings specifying tables to replicate and the destination for the replicated tables.",
-                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/pipelines.IngestionConfig"
+                    "parse_mode": {
+                      "description": "[Beta] (Optional) Parse mode for Protobuf data.\nValid values: FAILFAST, PERMISSIVE. Defaults to PERMISSIVE.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.ParseMode",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     },
-                    "source_configurations": {
-                      "description": "Top-level source configurations",
-                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/pipelines.SourceConfig"
+                    "recursive_fields_max_depth": {
+                      "description": "[Beta] (Optional) Maximum expansion depth for recursive protobuf fields.\nSpark SQL does not natively support recursive types, so recursive\nfields are expanded up to this depth and truncated beyond it.\nValid values: -1 (disallow recursive fields), 0 (drop), 1-10.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     },
-                    "table_configuration": {
-                      "description": "Configuration settings to control the ingestion of tables. These settings are applied to all tables in the pipeline.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.TableSpecificConfig"
+                    "schema_registry": {
+                      "description": "[Beta] (Optional) Schema registry to resolve the Protobuf schema at runtime instead\nof providing it via desc_file_path.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.SchemaRegistryConfig",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.IngestionPipelineDefinitionTableSpecificConfigQueryBasedConnectorConfig": {
+            "pipelines.RabbitmqOptions": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "Configurations that are only applicable for query-based ingestion connectors.",
+                  "description": "RabbitMQ specific options for ingestion.\nPerformance tuning options (consumers_per_task, max_messages_per_fetch, etc.)\nare intentionally not exposed in the public API. The managed connector uses\nsensible defaults internally. These can be added later if user demand arises.",
                   "properties": {
-                    "cursor_columns": {
-                      "description": "The names of the monotonically increasing columns in the source table that are used to enable\nthe table to be read and ingested incrementally through structured streaming.\nThe columns are allowed to have repeated values but have to be non-decreasing.\nIf the source data is merged into the destination (e.g., using SCD Type 1 or Type 2), these\ncolumns will implicitly define the `sequence_by` behavior. You can still explicitly set\n`sequence_by` to override this default.",
-                      "$ref": "#/$defs/slice/string",
-                      "x-databricks-preview": "PRIVATE",
-                      "doNotSuggest": true
-                    },
-                    "deletion_condition": {
-                      "description": "Specifies a SQL WHERE condition that specifies that the source row has been deleted.\nThis is sometimes referred to as \"soft-deletes\".\nFor example: \"Operation = 'DELETE'\" or \"is_deleted = true\".\nThis field is orthogonal to `hard_deletion_sync_interval_in_seconds`,\none for soft-deletes and the other for hard-deletes.\nSee also the hard_deletion_sync_min_interval_in_seconds field for\nhandling of \"hard deletes\" where the source rows are physically removed from the table.",
+                    "queue": {
+                      "description": "[Beta] (Required) RabbitMQ queue name to consume from.",
                       "$ref": "#/$defs/string",
-                      "x-databricks-preview": "PRIVATE",
-                      "doNotSuggest": true
-                    },
-                    "hard_deletion_sync_min_interval_in_seconds": {
-                      "description": "Specifies the minimum interval (in seconds) between snapshots on primary keys\nfor detecting and synchronizing hard deletions—i.e., rows that have been\nphysically removed from the source table.\nThis interval acts as a lower bound. If ingestion runs less frequently than\nthis value, hard deletion synchronization will align with the actual ingestion\nfrequency instead of happening more often.\nIf not set, hard deletion synchronization via snapshots is disabled.\nThis field is mutable and can be updated without triggering a full snapshot.",
-                      "$ref": "#/$defs/int64",
-                      "x-databricks-preview": "PRIVATE",
-                      "doNotSuggest": true
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     }
                   },
-                  "additionalProperties": false
+                  "additionalProperties": false,
+                  "required": [
+                    "queue"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.IngestionPipelineDefinitionWorkdayReportParameters": {
+            "pipelines.RedditAdsOptions": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Reddit Ads specific options for ingestion",
                   "properties": {
-                    "incremental": {
-                      "description": "(Optional) Marks the report as incremental.\nThis field is deprecated and should not be used. Use `parameters` instead. The incremental behavior is now\ncontrolled by the `parameters` field.",
-                      "$ref": "#/$defs/bool",
-                      "deprecationMessage": "This field is deprecated",
-                      "deprecated": true
+                    "custom_report_options": {
+                      "description": "[Private Preview] (Optional) Custom report definition. When set, the table is treated as a\nuser-defined Reddit Ads custom report. When unset, the table must match\none of the connector's prebuilt sources.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.RedditAdsOptionsRedditAdsCustomReportOptions",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "parameters": {
-                      "description": "Parameters for the Workday report. Each key represents the parameter name (e.g., \"start_date\", \"end_date\"),\nand the corresponding value is a SQL-like expression used to compute the parameter value at runtime.\nExample:\n{\n\"start_date\": \"{ coalesce(current_offset(), date(\\\"2025-02-01\\\")) }\",\n\"end_date\": \"{ current_date() - INTERVAL 1 DAY }\"\n}",
-                      "$ref": "#/$defs/map/string"
+                    "lookback_window_days": {
+                      "description": "[Private Preview] (Optional) Number of days to look back for report tables during incremental sync\nto capture late-arriving conversions and attribution data.\nIf not specified, defaults to 30 days.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "report_parameters": {
-                      "description": "(Optional) Additional custom parameters for Workday Report\nThis field is deprecated and should not be used. Use `parameters` instead.",
-                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/pipelines.IngestionPipelineDefinitionWorkdayReportParametersQueryKeyValue",
-                      "deprecationMessage": "This field is deprecated",
-                      "deprecated": true
+                    "sync_start_date": {
+                      "description": "[Private Preview] (Optional) Start date for the initial sync of report tables in YYYY-MM-DD format.\nThis determines the earliest date from which to sync historical data.\nIf not specified, defaults to 2 years ago.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.IngestionPipelineDefinitionWorkdayReportParametersQueryKeyValue": {
+            "pipelines.RedditAdsOptionsRedditAdsCustomReportOptions": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "User-defined custom report for the Reddit Ads connector.\nApplies only to the custom_report table — prebuilt tables ignore this.",
                   "properties": {
-                    "key": {
-                      "description": "Key for the report parameter, can be a column name or other metadata",
-                      "$ref": "#/$defs/string"
+                    "breakdowns": {
+                      "description": "[Private Preview] (Optional) Breakdown dimensions to group report data by.\nExamples: CAMPAIGN_ID, DATE, COUNTRY, REGION, AD_ID.\nMust include at least one time dimension (DATE or HOUR).",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "value": {
-                      "description": "Value for the report parameter.\nPossible values it can take are these sql functions:\n1. coalesce(current_offset(), date(\"YYYY-MM-DD\")) -\u003e if current_offset() is null, then the passed date, else current_offset()\n2. current_date()\n3. date_sub(current_date(), x) -\u003e subtract x (some non-negative integer) days from current date",
-                      "$ref": "#/$defs/string"
+                    "fields": {
+                      "description": "[Private Preview] (Optional) Fields to include in the report (maps to the Reddit Ads API `fields` parameter).\nExamples: IMPRESSIONS, CLICKS, SPEND, CPC, CTR.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.IngestionSourceType": {
+            "pipelines.ReportSpec": {
               "oneOf": [
                 {
-                  "type": "string",
-                  "enum": [
-                    "MYSQL",
-                    "POSTGRESQL",
-                    "SQLSERVER",
-                    "SALESFORCE",
-                    "BIGQUERY",
-                    "NETSUITE",
-                    "WORKDAY_RAAS",
-                    "GA4_RAW_DATA",
-                    "SERVICENOW",
-                    "MANAGED_POSTGRESQL",
-                    "ORACLE",
-                    "TERADATA",
-                    "SHAREPOINT",
-                    "DYNAMICS365",
-                    "GOOGLE_DRIVE",
-                    "FOREIGN_CATALOG"
+                  "type": "object",
+                  "properties": {
+                    "destination_catalog": {
+                      "description": "[Public Preview] Required. Destination catalog to store table.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "destination_schema": {
+                      "description": "[Public Preview] Required. Destination schema to store table.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "destination_table": {
+                      "description": "[Public Preview] Required. Destination table name. The pipeline fails if a table with that name already exists.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "source_url": {
+                      "description": "[Public Preview] Required. Report URL in the source system.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "table_configuration": {
+                      "description": "[Public Preview] Configuration settings to control the ingestion of tables. These settings override the table_configuration defined in the IngestionPipelineDefinition object.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.TableSpecificConfig",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "destination_catalog",
+                    "destination_schema",
+                    "source_url"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.ManualTrigger": {
+            "pipelines.RestartWindow": {
               "oneOf": [
                 {
                   "type": "object",
-                  "additionalProperties": false
+                  "properties": {
+                    "days_of_week": {
+                      "description": "[Private Preview] Days of week in which the restart is allowed to happen (within a five-hour window starting at start_hour).\nIf not specified all days of the week will be used.",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/pipelines.DayOfWeek",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "start_hour": {
+                      "description": "[Private Preview] An integer between 0 and 23 denoting the start hour for the restart window in the 24-hour day.\nContinuous pipeline restart is triggered only within a five-hour window starting at this hour.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "time_zone_id": {
+                      "description": "[Private Preview] Time zone id of restart window. See https://docs.databricks.com/sql/language-manual/sql-ref-syntax-aux-conf-mgmt-set-timezone.html for details.\nIf not specified, UTC will be used.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "start_hour"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.NotebookLibrary": {
+            "pipelines.RunAs": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Write-only setting, available only in Create/Update calls. Specifies the user or service principal that the pipeline runs as. If not specified, the pipeline runs as the user who created the pipeline.\n\nOnly `user_name` or `service_principal_name` can be specified. If both are specified, an error is thrown.",
                   "properties": {
-                    "path": {
-                      "description": "The absolute path of the source code.",
-                      "$ref": "#/$defs/string"
+                    "group_name": {
+                      "description": "[Private Preview] Group name of an account group assigned to the workspace. When set, the pipeline runs as the group and the group's permissions are used for data access. Setting this field requires being a member of the group, or having the `Assume` permission on the group.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "service_principal_name": {
+                      "description": "Application ID of an active service principal. Setting this field requires the `servicePrincipal/user` role.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "user_name": {
+                      "description": "The email of an active workspace user. Users can only set this field to their own email.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.Notifications": {
+            "pipelines.SchemaRegistryConfig": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "alerts": {
-                      "description": "A list of alerts that trigger the sending of notifications to the configured\ndestinations. The supported alerts are:\n\n* `on-update-success`: A pipeline update completes successfully.\n* `on-update-failure`: Each time a pipeline update fails.\n* `on-update-fatal-failure`: A pipeline update fails with a non-retryable (fatal) error.\n* `on-flow-failure`: A single data flow fails.",
-                      "$ref": "#/$defs/slice/string"
+                    "confluent_options": {
+                      "description": "[Beta] Required: Confluent-compatible schema registry options.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.ConfluentSchemaRegistryOptions",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     },
-                    "email_recipients": {
-                      "description": "A list of email addresses notified when a configured alert is triggered.",
-                      "$ref": "#/$defs/slice/string"
+                    "connection_name": {
+                      "description": "[Beta] (Optional) UC connection for registry authentication.\nSpecify if different from the top-level source connection.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
+                    },
+                    "protobuf_message_name": {
+                      "description": "[Beta] (Optional, Protobuf only) Selects a specific message from a schema that\ndefines multiple Protobuf messages. Simple (\"Location\") or fully-qualified\n(\"com.example.protos.Location\"). Defaults to the first message.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.OperationTimeWindow": {
+            "pipelines.SchemaSpec": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "Proto representing a window",
                   "properties": {
-                    "days_of_week": {
-                      "description": "Days of week in which the window is allowed to happen\nIf not specified all days of the week will be used.",
-                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/pipelines.DayOfWeek"
+                    "connector_options": {
+                      "description": "[Public Preview] (Optional) Source Specific Connector Options",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.ConnectorOptions",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "start_hour": {
-                      "description": "An integer between 0 and 23 denoting the start hour for the window in the 24-hour day.",
-                      "$ref": "#/$defs/int"
+                    "destination_catalog": {
+                      "description": "[Public Preview] Required. Destination catalog to store tables.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "time_zone_id": {
-                      "description": "Time zone id of window. See https://docs.databricks.com/sql/language-manual/sql-ref-syntax-aux-conf-mgmt-set-timezone.html for details.\nIf not specified, UTC will be used.",
-                      "$ref": "#/$defs/string"
+                    "destination_schema": {
+                      "description": "[Public Preview] Required. Destination schema to store tables in. Tables with the same name as the source tables are created in this destination schema. The pipeline fails If a table with the same name already exists.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "fanout_options": {
+                      "description": "[Beta] Fanout options for multi-table routing from streaming sources.\nWhen set, records are routed to destination tables based on a\nper-record routing key. The key value becomes the table name:\n{destination_catalog}.{destination_schema}.{key_value}.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.IngestionPipelineDefinitionFanoutOptions",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
+                    },
+                    "source_catalog": {
+                      "description": "[Public Preview] The source catalog name. Might be optional depending on the type of source.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "source_schema": {
+                      "description": "[Public Preview] Schema name in the source database. Optional: some source types (for example streaming or\nmessage-bus connectors) do not use it, so it may be absent from a pipeline's definition.\nClients that assume it is always present should handle its absence.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "table_configuration": {
+                      "description": "[Public Preview] Configuration settings to control the ingestion of tables. These settings are applied to all tables in this schema and override the table_configuration defined in the IngestionPipelineDefinition object.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.TableSpecificConfig",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "start_hour"
+                    "destination_catalog",
+                    "destination_schema"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.PathPattern": {
+            "pipelines.SharepointOptions": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "include": {
-                      "description": "The source code to include for pipelines",
-                      "$ref": "#/$defs/string"
+                    "entity_type": {
+                      "description": "[Private Preview] (Optional) The type of SharePoint entity to ingest.\nIf not specified, defaults to FILE.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.SharepointOptionsSharepointEntityType",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "file_ingestion_options": {
+                      "description": "[Private Preview] (Optional) File ingestion options for processing files.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.FileIngestionOptions",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "url": {
+                      "description": "[Private Preview] Required. The SharePoint URL.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.PipelineCluster": {
+            "pipelines.SharepointOptionsSharepointEntityType": {
               "oneOf": [
                 {
-                  "type": "object",
-                  "properties": {
-                    "apply_policy_default_values": {
-                      "description": "Note: This field won't be persisted. Only API users will check this field.",
-                      "$ref": "#/$defs/bool"
-                    },
-                    "autoscale": {
-                      "description": "Parameters needed in order to automatically scale clusters up and down based on load.\nNote: autoscaling works best with DB runtime versions 3.0 or later.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.PipelineClusterAutoscale"
-                    },
-                    "aws_attributes": {
-                      "description": "Attributes related to clusters running on Amazon Web Services.\nIf not specified at cluster creation, a set of default values will be used.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.AwsAttributes"
-                    },
-                    "azure_attributes": {
-                      "description": "Attributes related to clusters running on Microsoft Azure.\nIf not specified at cluster creation, a set of default values will be used.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.AzureAttributes"
-                    },
-                    "cluster_log_conf": {
-                      "description": "The configuration for delivering spark logs to a long-term storage destination.\nOnly dbfs destinations are supported. Only one destination can be specified\nfor one cluster. If the conf is given, the logs will be delivered to the destination every\n`5 mins`. The destination of driver logs is `$destination/$clusterId/driver`, while\nthe destination of executor logs is `$destination/$clusterId/executor`.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.ClusterLogConf"
-                    },
-                    "custom_tags": {
-                      "description": "Additional tags for cluster resources. Databricks will tag all cluster resources (e.g., AWS\ninstances and EBS volumes) with these tags in addition to `default_tags`. Notes:\n\n- Currently, Databricks allows at most 45 custom tags\n\n- Clusters can only reuse cloud resources if the resources' tags are a subset of the cluster tags",
-                      "$ref": "#/$defs/map/string"
-                    },
-                    "driver_instance_pool_id": {
-                      "description": "The optional ID of the instance pool for the driver of the cluster belongs.\nThe pool cluster uses the instance pool with id (instance_pool_id) if the driver pool is not\nassigned.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "driver_node_type_id": {
-                      "description": "The node type of the Spark driver.\nNote that this field is optional; if unset, the driver node type will be set as the same value\nas `node_type_id` defined above.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "enable_local_disk_encryption": {
-                      "description": "Whether to enable local disk encryption for the cluster.",
-                      "$ref": "#/$defs/bool"
-                    },
-                    "gcp_attributes": {
-                      "description": "Attributes related to clusters running on Google Cloud Platform.\nIf not specified at cluster creation, a set of default values will be used.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.GcpAttributes"
-                    },
-                    "init_scripts": {
-                      "description": "The configuration for storing init scripts. Any number of destinations can be specified. The scripts are executed sequentially in the order provided. If `cluster_log_conf` is specified, init script logs are sent to `\u003cdestination\u003e/\u003ccluster-ID\u003e/init_scripts`.",
-                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/compute.InitScriptInfo"
-                    },
-                    "instance_pool_id": {
-                      "description": "The optional ID of the instance pool to which the cluster belongs.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "label": {
-                      "description": "A label for the cluster specification, either `default` to configure the default cluster, or `maintenance` to configure the maintenance cluster. This field is optional. The default value is `default`.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "node_type_id": {
-                      "description": "This field encodes, through a single value, the resources available to each of\nthe Spark nodes in this cluster. For example, the Spark nodes can be provisioned\nand optimized for memory or compute intensive workloads. A list of available node\ntypes can be retrieved by using the :method:clusters/listNodeTypes API call.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "num_workers": {
-                      "description": "Number of worker nodes that this cluster should have. A cluster has one Spark Driver\nand `num_workers` Executors for a total of `num_workers` + 1 Spark nodes.\n\nNote: When reading the properties of a cluster, this field reflects the desired number\nof workers rather than the actual current number of workers. For instance, if a cluster\nis resized from 5 to 10 workers, this field will immediately be updated to reflect\nthe target size of 10 workers, whereas the workers listed in `spark_info` will gradually\nincrease from 5 to 10 as the new nodes are provisioned.",
-                      "$ref": "#/$defs/int"
-                    },
-                    "policy_id": {
-                      "description": "The ID of the cluster policy used to create the cluster if applicable.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "spark_conf": {
-                      "description": "An object containing a set of optional, user-specified Spark configuration key-value pairs.\nSee :method:clusters/create for more details.",
-                      "$ref": "#/$defs/map/string"
-                    },
-                    "spark_env_vars": {
-                      "description": "An object containing a set of optional, user-specified environment variable key-value pairs.\nPlease note that key-value pair of the form (X,Y) will be exported as is (i.e.,\n`export X='Y'`) while launching the driver and workers.\n\nIn order to specify an additional set of `SPARK_DAEMON_JAVA_OPTS`, we recommend appending\nthem to `$SPARK_DAEMON_JAVA_OPTS` as shown in the example below. This ensures that all\ndefault databricks managed environmental variables are included as well.\n\nExample Spark environment variables:\n`{\"SPARK_WORKER_MEMORY\": \"28000m\", \"SPARK_LOCAL_DIRS\": \"/local_disk0\"}` or\n`{\"SPARK_DAEMON_JAVA_OPTS\": \"$SPARK_DAEMON_JAVA_OPTS -Dspark.shuffle.service.enabled=true\"}`",
-                      "$ref": "#/$defs/map/string"
-                    },
-                    "ssh_public_keys": {
-                      "description": "SSH public key contents that will be added to each Spark node in this cluster. The\ncorresponding private keys can be used to login with the user name `ubuntu` on port `2200`.\nUp to 10 keys can be specified.",
-                      "$ref": "#/$defs/slice/string"
+                  "type": "string",
+                  "enum": [
+                    "FILE",
+                    "FILE_METADATA",
+                    "PERMISSION",
+                    "LIST"
+                  ],
+                  "enumDescriptions": [
+                    "[Private Preview]",
+                    "[Private Preview]",
+                    "[Private Preview]",
+                    "[Private Preview]"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "pipelines.SmartsheetOptions": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Smartsheet specific options for ingestion",
+                  "properties": {
+                    "enforce_schema": {
+                      "description": "[Public Preview] (Optional) When true, maps each column to its Smartsheet-declared type (Text/Number/Date/\nCheckbox/etc.). Cells that do not conform to the declared type are set to NULL.\nWhen false, all columns land as STRING. Use false for sheets with irregular data or columns\nthat frequently violate their own declared type.\nIf not specified, defaults to true.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.PipelineClusterAutoscale": {
+            "pipelines.SourceCatalogConfig": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "SourceCatalogConfig contains catalog-level custom configuration parameters for each source",
                   "properties": {
-                    "max_workers": {
-                      "description": "The maximum number of workers to which the cluster can scale up when overloaded. `max_workers` must be strictly greater than `min_workers`.",
-                      "$ref": "#/$defs/int"
-                    },
-                    "min_workers": {
-                      "description": "The minimum number of workers the cluster can scale down to when underutilized.\nIt is also the initial number of workers the cluster will have after creation.",
-                      "$ref": "#/$defs/int"
+                    "postgres": {
+                      "description": "[Public Preview] Postgres-specific catalog-level configuration parameters",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.PostgresCatalogConfig",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "mode": {
-                      "description": "Databricks Enhanced Autoscaling optimizes cluster utilization by automatically\nallocating cluster resources based on workload volume, with minimal impact to\nthe data processing latency of your pipelines. Enhanced Autoscaling is available\nfor `updates` clusters only. The legacy autoscaling feature is used for `maintenance`\nclusters.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.PipelineClusterAutoscaleMode"
+                    "source_catalog": {
+                      "description": "[Public Preview] Source catalog name",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     }
                   },
-                  "additionalProperties": false,
-                  "required": [
-                    "max_workers",
-                    "min_workers"
-                  ]
+                  "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.PipelineClusterAutoscaleMode": {
+            "pipelines.SourceConfig": {
               "oneOf": [
                 {
-                  "type": "string",
-                  "description": "Databricks Enhanced Autoscaling optimizes cluster utilization by automatically\nallocating cluster resources based on workload volume, with minimal impact to\nthe data processing latency of your pipelines. Enhanced Autoscaling is available\nfor `updates` clusters only. The legacy autoscaling feature is used for `maintenance`\nclusters.",
-                  "enum": [
-                    "ENHANCED",
-                    "LEGACY"
-                  ]
+                  "type": "object",
+                  "properties": {
+                    "api_source_connector_config": {
+                      "description": "[Private Preview] Connector-specific top-level configuration for API Source connectors.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.ApiSourceConnectorConfig",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "catalog": {
+                      "description": "[Public Preview] Catalog-level source configuration parameters",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.SourceCatalogConfig",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "google_ads_config": {
+                      "description": "[Private Preview]",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.GoogleAdsConfig",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    }
+                  },
+                  "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.PipelineDeployment": {
+            "pipelines.TableSpec": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "kind": {
-                      "description": "The deployment method that manages the pipeline.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.DeploymentKind"
+                    "connector_options": {
+                      "description": "[Public Preview] (Optional) Source Specific Connector Options",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.ConnectorOptions",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "metadata_file_path": {
-                      "description": "The path to the file containing metadata about the deployment.",
-                      "$ref": "#/$defs/string"
+                    "destination_catalog": {
+                      "description": "[Public Preview] Required. Destination catalog to store table.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "destination_schema": {
+                      "description": "[Public Preview] Required. Destination schema to store table.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "destination_table": {
+                      "description": "[Public Preview] Optional. Destination table name. The pipeline fails if a table with that name already exists. If not set, the source table name is used.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "source_catalog": {
+                      "description": "[Public Preview] Source catalog name. Might be optional depending on the type of source.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "source_schema": {
+                      "description": "[Public Preview] Schema name in the source database. Might be optional depending on the type of source.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "source_table": {
+                      "description": "[Public Preview] Table name in the source database. Optional: some source types (for example streaming or\nmessage-bus connectors) do not use it, so it may be absent from a pipeline's definition.\nClients that assume it is always present should handle its absence.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "table_configuration": {
+                      "description": "[Public Preview] Configuration settings to control the ingestion of tables. These settings override the table_configuration defined in the IngestionPipelineDefinition object and the SchemaSpec.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.TableSpecificConfig",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "kind"
+                    "destination_catalog",
+                    "destination_schema"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.PipelineLibrary": {
+            "pipelines.TableSpecificConfig": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "file": {
-                      "description": "The path to a file that defines a pipeline and is stored in the Databricks Repos.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.FileLibrary"
+                    "auto_full_refresh_policy": {
+                      "description": "[Public Preview] (Optional, Mutable) Policy for auto full refresh, if enabled pipeline will automatically try\nto fix issues by doing a full refresh on the table in the retry run. auto_full_refresh_policy\nin table configuration will override the above level auto_full_refresh_policy.\nFor example,\n{\n\"auto_full_refresh_policy\": {\n\"enabled\": true,\n\"min_interval_hours\": 23,\n}\n}\nIf unspecified, auto full refresh is disabled.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.AutoFullRefreshPolicy",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "glob": {
-                      "description": "The unified field to include source codes.\nEach entry can be a notebook path, a file path, or a folder path that ends `/**`.\nThis field cannot be used together with `notebook` or `file`.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.PathPattern"
+                    "clustering_columns": {
+                      "description": "[Beta] List of column names to use for clustering the destination table.\nWhen specified, the destination Delta table will be clustered by these columns.\nThis can improve query performance when filtering on these columns.\nNote: clustering_columns in table specific configuration will override the pipeline definition.\nNote: we can only provide enable_auto_clustering or clustering_columns,\nadded as separate fields as we cannot have repeated field in oneof.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     },
-                    "jar": {
-                      "description": "URI of the jar to be installed. Currently only DBFS is supported.",
+                    "enable_auto_clustering": {
+                      "description": "[Beta] Whether to enable auto clustering on the destination table.\nWhen enabled, Delta will automatically optimize the data layout\nbased on the clustering columns for improved query performance.\nNote: enable_auto_clustering in table specific configuration will override the pipeline definition.\nNote: we can only provide enable_auto_clustering or clustering_columns,\nadded as separate fields as we cannot have repeated field in oneof.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
+                    },
+                    "exclude_columns": {
+                      "description": "[Public Preview] A list of column names to be excluded for the ingestion.\nWhen not specified, include_columns fully controls what columns to be ingested.\nWhen specified, all other columns including future ones will be automatically included for ingestion.\nThis field in mutually exclusive with `include_columns`.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "include_columns": {
+                      "description": "[Public Preview] A list of column names to be included for the ingestion.\nWhen not specified, all columns except ones in exclude_columns will be included. Future\ncolumns will be automatically included.\nWhen specified, all other future columns will be automatically excluded from ingestion.\nThis field in mutually exclusive with `exclude_columns`.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "primary_keys": {
+                      "description": "[Public Preview] The primary key of the table used to apply changes.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "query_based_connector_config": {
+                      "description": "[Public Preview] Configurations that are only applicable for query-based ingestion connectors.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.IngestionPipelineDefinitionTableSpecificConfigQueryBasedConnectorConfig",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "row_filter": {
+                      "description": "[Public Preview] (Optional, Immutable) The row filter condition to be applied to the table.\nIt must not contain the WHERE keyword, only the actual filter condition.\nIt must be in DBSQL format.",
                       "$ref": "#/$defs/string",
-                      "x-databricks-preview": "PRIVATE",
-                      "doNotSuggest": true
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "maven": {
-                      "description": "Specification of a maven library to be installed.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.MavenLibrary",
-                      "x-databricks-preview": "PRIVATE",
+                    "salesforce_include_formula_fields": {
+                      "description": "[Private Preview] If true, formula fields defined in the table are included in the ingestion. This setting is only valid for the Salesforce connector",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
                       "doNotSuggest": true
                     },
-                    "notebook": {
-                      "description": "The path to a notebook that defines a pipeline and is stored in the Databricks workspace.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.NotebookLibrary"
+                    "scd_type": {
+                      "description": "[Public Preview] The SCD type to use to ingest the table.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.TableSpecificConfigScdType",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
-                    "whl": {
-                      "description": "URI of the whl to be installed.",
+                    "sequence_by": {
+                      "description": "[Public Preview] The column names specifying the logical order of events in the source data. Spark Declarative Pipelines uses this sequencing to handle change events that arrive out of order.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "source_metadata_column": {
+                      "description": "[Beta] (Optional) Name of the struct column added to each ingested record to hold per row source\nmetadata.",
                       "$ref": "#/$defs/string",
-                      "deprecationMessage": "This field is deprecated",
-                      "deprecated": true
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
+                    },
+                    "table_properties": {
+                      "description": "[Beta] Table properties to set on the destination table.\nThese are key-value pairs that configure various Delta table behaviors or any user defined properties.\nExample: {\"delta.feature.variantType\": \"supported\", \"delta.enableTypeWidening\": \"true\"}\nNote: table_properties in table specific configuration will override the table_properties of the pipeline definition.",
+                      "$ref": "#/$defs/map/string",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
+                    },
+                    "workday_report_parameters": {
+                      "description": "[Private Preview] (Optional) Additional custom parameters for Workday Report",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.IngestionPipelineDefinitionWorkdayReportParameters",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.PipelinePermissionLevel": {
+            "pipelines.TableSpecificConfigScdType": {
               "oneOf": [
                 {
                   "type": "string",
-                  "description": "Permission level",
+                  "description": "The SCD type to use to ingest the table.",
                   "enum": [
-                    "CAN_MANAGE",
-                    "IS_OWNER",
-                    "CAN_RUN",
-                    "CAN_VIEW"
+                    "SCD_TYPE_1",
+                    "SCD_TYPE_2",
+                    "APPEND_ONLY"
+                  ],
+                  "enumDescriptions": [
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.PipelineTrigger": {
+            "pipelines.TikTokAdsOptions": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "TikTok Ads specific options for ingestion",
                   "properties": {
-                    "cron": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.CronTrigger"
+                    "custom_report_options": {
+                      "description": "[Private Preview] (Optional) Custom report definition. When set, the table is treated as a\nuser-defined TikTok Ads custom report: the connector synthesizes a report\nrequest from the dimensions, metrics, report type, and data level specified\nhere. Supersedes the deprecated top-level dimensions/metrics/report_type/\ndata_level/query_lifetime fields above.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.TikTokAdsOptionsTikTokAdsCustomReportOptions",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "manual": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.ManualTrigger"
+                    "data_level": {
+                      "description": "[Beta] Deprecated. Use custom_report_options.data_level instead.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.TikTokAdsOptionsTikTokDataLevel",
+                      "x-databricks-launch-stage": "PUBLIC_BETA",
+                      "deprecationMessage": "This field is deprecated",
+                      "deprecated": true
+                    },
+                    "dimensions": {
+                      "description": "[Beta] Deprecated. Use custom_report_options.dimensions instead.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PUBLIC_BETA",
+                      "deprecationMessage": "This field is deprecated",
+                      "deprecated": true
+                    },
+                    "lookback_window_days": {
+                      "description": "[Beta] (Optional) Number of days to look back for report tables during incremental sync\nto capture late-arriving conversions and attribution data.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
+                    },
+                    "metrics": {
+                      "description": "[Beta] Deprecated. Use custom_report_options.metrics instead.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PUBLIC_BETA",
+                      "deprecationMessage": "This field is deprecated",
+                      "deprecated": true
+                    },
+                    "query_lifetime": {
+                      "description": "[Beta] Deprecated. Use custom_report_options.query_lifetime instead.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "PUBLIC_BETA",
+                      "deprecationMessage": "This field is deprecated",
+                      "deprecated": true
+                    },
+                    "report_type": {
+                      "description": "[Beta] Deprecated. Use custom_report_options.report_type instead.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.TikTokAdsOptionsTikTokReportType",
+                      "x-databricks-launch-stage": "PUBLIC_BETA",
+                      "deprecationMessage": "This field is deprecated",
+                      "deprecated": true
+                    },
+                    "sync_start_date": {
+                      "description": "[Beta] (Optional) Start date for the initial sync of report tables in YYYY-MM-DD format.\nThis determines the earliest date from which to sync historical data.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.PipelinesEnvironment": {
+            "pipelines.TikTokAdsOptionsTikTokAdsCustomReportOptions": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "The environment entity used to preserve serverless environment side panel, jobs' environment for non-notebook task, and DLT's environment for classic and serverless pipelines.\nIn this minimal environment spec, only pip dependencies are supported.",
+                  "description": "User-defined custom report for the TikTok Ads connector. Groups the\ndimensions + metrics + report type + data level that define a TikTok Ads\ncustom report request.",
                   "properties": {
-                    "dependencies": {
-                      "description": "List of pip dependencies, as supported by the version of pip in this environment.\nEach dependency is a pip requirement file line https://pip.pypa.io/en/stable/reference/requirements-file-format/\nAllowed dependency could be \u003crequirement specifier\u003e, \u003carchive url/path\u003e, \u003clocal project path\u003e(WSFS or Volumes in Databricks), \u003cvcs project url\u003e",
-                      "$ref": "#/$defs/slice/string"
+                    "data_level": {
+                      "description": "[Private Preview] (Optional) Data level for the report.\nIf not specified, defaults to AUCTION_CAMPAIGN.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.TikTokAdsOptionsTikTokDataLevel",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "environment_version": {
-                      "description": "The environment version of the serverless Python environment used to execute\ncustomer Python code. Each environment version includes a specific Python\nversion and a curated set of pre-installed libraries with defined versions,\nproviding a stable and reproducible execution environment.\n\nDatabricks supports a three-year lifecycle for each environment version.\nFor available versions and their included packages, see\nhttps://docs.databricks.com/aws/en/release-notes/serverless/environment-version/\n\nThe value should be a string representing the environment version number, for example: `\"4\"`.",
-                      "$ref": "#/$defs/string",
-                      "x-databricks-preview": "PRIVATE",
+                    "dimensions": {
+                      "description": "[Private Preview] (Optional) Dimensions to include in the report (e.g. \"campaign_id\",\n\"adgroup_id\", \"ad_id\", \"stat_time_day\", \"stat_time_hour\").",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "metrics": {
+                      "description": "[Private Preview] (Optional) Metrics to include in the report (e.g. \"spend\", \"impressions\",\n\"clicks\", \"conversion\", \"cpc\").",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "query_lifetime": {
+                      "description": "[Private Preview] (Optional) Whether to request lifetime metrics (all-time aggregated data).\nWhen true, the report returns all-time data.\nIf not specified, defaults to false.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "report_type": {
+                      "description": "[Private Preview] (Optional) Report type for the TikTok Ads API.\nIf not specified, defaults to BASIC.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.TikTokAdsOptionsTikTokReportType",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
                       "doNotSuggest": true
                     }
                   },
@@ -8905,605 +16864,689 @@
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.PostgresCatalogConfig": {
+            "pipelines.TikTokAdsOptionsTikTokDataLevel": {
               "oneOf": [
                 {
-                  "type": "object",
-                  "description": "PG-specific catalog-level configuration parameters",
-                  "properties": {
-                    "slot_config": {
-                      "description": "Optional. The Postgres slot configuration to use for logical replication",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.PostgresSlotConfig"
-                    }
-                  },
-                  "additionalProperties": false
+                  "type": "string",
+                  "description": "Data level for TikTok Ads report aggregation.",
+                  "enum": [
+                    "AUCTION_ADVERTISER",
+                    "AUCTION_CAMPAIGN",
+                    "AUCTION_ADGROUP",
+                    "AUCTION_AD"
+                  ],
+                  "enumDescriptions": [
+                    "[Beta]",
+                    "[Beta]",
+                    "[Beta]",
+                    "[Beta]"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.PostgresSlotConfig": {
+            "pipelines.TikTokAdsOptionsTikTokReportType": {
               "oneOf": [
                 {
-                  "type": "object",
-                  "description": "PostgresSlotConfig contains the configuration for a Postgres logical replication slot",
-                  "properties": {
-                    "publication_name": {
-                      "description": "The name of the publication to use for the Postgres source",
-                      "$ref": "#/$defs/string"
-                    },
-                    "slot_name": {
-                      "description": "The name of the logical replication slot to use for the Postgres source",
-                      "$ref": "#/$defs/string"
-                    }
-                  },
-                  "additionalProperties": false
+                  "type": "string",
+                  "description": "Report type for TikTok Ads API.",
+                  "enum": [
+                    "BASIC",
+                    "AUDIENCE",
+                    "PLAYABLE_AD",
+                    "DSA",
+                    "BUSINESS_CENTER",
+                    "GMV_MAX"
+                  ],
+                  "enumDescriptions": [
+                    "[Beta]",
+                    "[Beta]",
+                    "[Beta]",
+                    "[Beta]",
+                    "[Beta]",
+                    "[Beta]"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.ReportSpec": {
+            "pipelines.Transformer": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Specifies how to transform binary data into structured data.",
                   "properties": {
-                    "destination_catalog": {
-                      "description": "Required. Destination catalog to store table.",
-                      "$ref": "#/$defs/string"
+                    "avro_options": {
+                      "description": "[Beta]",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.AvroTransformerOptions",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     },
-                    "destination_schema": {
-                      "description": "Required. Destination schema to store table.",
-                      "$ref": "#/$defs/string"
+                    "format": {
+                      "description": "[Beta] Required: the wire format of the data.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.TransformerFormat",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     },
-                    "destination_table": {
-                      "description": "Required. Destination table name. The pipeline fails if a table with that name already exists.",
-                      "$ref": "#/$defs/string"
+                    "input_column": {
+                      "description": "[Private Preview] Optional input column to transform. When set, the transformer reads\nfrom this column instead of the default source column.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     },
-                    "source_url": {
-                      "description": "Required. Report URL in the source system.",
-                      "$ref": "#/$defs/string"
+                    "json_options": {
+                      "description": "[Beta]",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.JsonTransformerOptions",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     },
-                    "table_configuration": {
-                      "description": "Configuration settings to control the ingestion of tables. These settings override the table_configuration defined in the IngestionPipelineDefinition object.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.TableSpecificConfig"
+                    "output_column": {
+                      "description": "[Private Preview] Optional output column name. When set, the transformed result is\nwritten to this column instead of replacing the input column.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "protobuf_options": {
+                      "description": "[Beta]",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.ProtobufTransformerOptions",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     }
                   },
-                  "additionalProperties": false,
-                  "required": [
-                    "destination_catalog",
-                    "destination_schema",
-                    "source_url"
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "pipelines.TransformerFormat": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "enum": [
+                    "STRING",
+                    "JSON",
+                    "AVRO",
+                    "PROTOBUF"
+                  ],
+                  "enumDescriptions": [
+                    "[Beta]",
+                    "[Beta]",
+                    "[Beta]",
+                    "[Beta]"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.RestartWindow": {
+            "pipelines.ZendeskSupportOptions": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Zendesk Support specific options for ingestion",
                   "properties": {
-                    "days_of_week": {
-                      "description": "Days of week in which the restart is allowed to happen (within a five-hour window starting at start_hour).\nIf not specified all days of the week will be used.",
-                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/pipelines.DayOfWeek"
-                    },
-                    "start_hour": {
-                      "description": "An integer between 0 and 23 denoting the start hour for the restart window in the 24-hour day.\nContinuous pipeline restart is triggered only within a five-hour window starting at this hour.",
-                      "$ref": "#/$defs/int"
-                    },
-                    "time_zone_id": {
-                      "description": "Time zone id of restart window. See https://docs.databricks.com/sql/language-manual/sql-ref-syntax-aux-conf-mgmt-set-timezone.html for details.\nIf not specified, UTC will be used.",
-                      "$ref": "#/$defs/string"
+                    "start_date": {
+                      "description": "[Public Preview] (Optional) Start date in YYYY-MM-DD format for the initial sync.\nThis determines the earliest date from which to sync historical data.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     }
                   },
-                  "additionalProperties": false,
-                  "required": [
-                    "start_hour"
-                  ]
+                  "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.RunAs": {
+            "postgres.DailySchedule": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "Write-only setting, available only in Create/Update calls. Specifies the user or service principal that the pipeline runs as. If not specified, the pipeline runs as the user who created the pipeline.\n\nOnly `user_name` or `service_principal_name` can be specified. If both are specified, an error is thrown.",
+                  "description": "Take a snapshot once per day, at the configured hour.",
                   "properties": {
-                    "service_principal_name": {
-                      "description": "Application ID of an active service principal. Setting this field requires the `servicePrincipal/user` role.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "user_name": {
-                      "description": "The email of an active workspace user. Users can only set this field to their own email.",
-                      "$ref": "#/$defs/string"
+                    "hour": {
+                      "description": "[Beta] The hour of the day, in UTC, at which to take the snapshot, in [0, 23].",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.SchemaSpec": {
+            "postgres.DayOfWeek": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "description": "The day of the week on which a weekly snapshot is taken.",
+                  "enum": [
+                    "MONDAY",
+                    "TUESDAY",
+                    "WEDNESDAY",
+                    "THURSDAY",
+                    "FRIDAY",
+                    "SATURDAY",
+                    "SUNDAY"
+                  ],
+                  "enumDescriptions": [
+                    "[Beta]",
+                    "[Beta]",
+                    "[Beta]",
+                    "[Beta]",
+                    "[Beta]",
+                    "[Beta]",
+                    "[Beta]"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "postgres.EndpointGroupSpec": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "connector_options": {
-                      "description": "(Optional) Source Specific Connector Options",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.ConnectorOptions",
-                      "x-databricks-preview": "PRIVATE",
-                      "doNotSuggest": true
-                    },
-                    "destination_catalog": {
-                      "description": "Required. Destination catalog to store tables.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "destination_schema": {
-                      "description": "Required. Destination schema to store tables in. Tables with the same name as the source tables are created in this destination schema. The pipeline fails If a table with the same name already exists.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "source_catalog": {
-                      "description": "The source catalog name. Might be optional depending on the type of source.",
-                      "$ref": "#/$defs/string"
+                    "enable_readable_secondaries": {
+                      "description": "Whether to allow read-only connections to read-write endpoints. Only relevant for read-write endpoints where\nsize.max \u003e 1.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "source_schema": {
-                      "description": "Required. Schema name in the source database.",
-                      "$ref": "#/$defs/string"
+                    "max": {
+                      "description": "The maximum number of computes in the endpoint group. Currently, this must be equal to min. Set to 1 for single\ncompute endpoints, to disable HA. To manually suspend all computes in an endpoint group, set disabled to\ntrue on the EndpointSpec.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "table_configuration": {
-                      "description": "Configuration settings to control the ingestion of tables. These settings are applied to all tables in this schema and override the table_configuration defined in the IngestionPipelineDefinition object.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.TableSpecificConfig"
+                    "min": {
+                      "description": "The minimum number of computes in the endpoint group. Currently, this must be equal to max. This must be greater\nthan or equal to 1.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "destination_catalog",
-                    "destination_schema",
-                    "source_schema"
+                    "max",
+                    "min"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.SharepointOptions": {
+            "postgres.EndpointSettings": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "A collection of settings for a compute endpoint.",
                   "properties": {
-                    "entity_type": {
-                      "description": "(Optional) The type of SharePoint entity to ingest.\nIf not specified, defaults to FILE.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.SharepointOptionsSharepointEntityType"
-                    },
-                    "file_ingestion_options": {
-                      "description": "(Optional) File ingestion options for processing files.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.FileIngestionOptions"
-                    },
-                    "url": {
-                      "description": "Required. The SharePoint URL.",
-                      "$ref": "#/$defs/string"
+                    "pg_settings": {
+                      "description": "A raw representation of Postgres settings.",
+                      "$ref": "#/$defs/map/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.SharepointOptionsSharepointEntityType": {
+            "postgres.EndpointType": {
               "oneOf": [
                 {
                   "type": "string",
+                  "description": "The compute endpoint type. Either `read_write` or `read_only`.",
                   "enum": [
-                    "FILE",
-                    "FILE_METADATA",
-                    "PERMISSION",
-                    "LIST"
+                    "ENDPOINT_TYPE_READ_WRITE",
+                    "ENDPOINT_TYPE_READ_ONLY"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.SourceCatalogConfig": {
+            "postgres.MonthlySchedule": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "SourceCatalogConfig contains catalog-level custom configuration parameters for each source",
+                  "description": "Take a snapshot once per month, on the configured day at the configured hour.",
                   "properties": {
-                    "postgres": {
-                      "description": "Postgres-specific catalog-level configuration parameters",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.PostgresCatalogConfig"
+                    "day": {
+                      "description": "[Beta] The day of the month on which to take the snapshot, in [1, 31]. In shorter\nmonths the snapshot is taken on the last day instead (day 31 runs on Feb 28\nor 29, and on Apr 30), so every month gets exactly one snapshot.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     },
-                    "source_catalog": {
-                      "description": "Source catalog name",
-                      "$ref": "#/$defs/string"
+                    "hour": {
+                      "description": "[Beta] The hour of the day, in UTC, at which to take the snapshot, in [0, 23].",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     }
                   },
-                  "additionalProperties": false
+                  "additionalProperties": false,
+                  "required": [
+                    "day"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.SourceConfig": {
+            "postgres.NewPipelineSpec": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "catalog": {
-                      "description": "Catalog-level source configuration parameters",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.SourceCatalogConfig"
+                    "budget_policy_id": {
+                      "description": "Budget policy to set on the newly created pipeline.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "pipeline_channel": {
+                      "description": "[Private Preview] Release channel of the underlying pipeline's runtime.\nSome source table configurations (e.g., read-time CDF) require PREVIEW.\nDefaults to CURRENT if not specified.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/postgres.NewPipelineSpecPipelineChannel",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "storage_catalog": {
+                      "description": "UC catalog for the pipeline to store intermediate files (checkpoints, event logs etc).\nThis needs to be a standard catalog where the user has permissions to create Delta tables.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "storage_schema": {
+                      "description": "UC schema for the pipeline to store intermediate files (checkpoints, event logs etc).\nThis needs to be in the standard catalog where the user has permissions to create Delta tables.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.TableSpec": {
+            "postgres.NewPipelineSpecPipelineChannel": {
               "oneOf": [
                 {
-                  "type": "object",
-                  "properties": {
-                    "connector_options": {
-                      "description": "(Optional) Source Specific Connector Options",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.ConnectorOptions",
-                      "x-databricks-preview": "PRIVATE",
-                      "doNotSuggest": true
-                    },
-                    "destination_catalog": {
-                      "description": "Required. Destination catalog to store table.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "destination_schema": {
-                      "description": "Required. Destination schema to store table.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "destination_table": {
-                      "description": "Optional. Destination table name. The pipeline fails if a table with that name already exists. If not set, the source table name is used.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "source_catalog": {
-                      "description": "Source catalog name. Might be optional depending on the type of source.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "source_schema": {
-                      "description": "Schema name in the source database. Might be optional depending on the type of source.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "source_table": {
-                      "description": "Required. Table name in the source database.",
-                      "$ref": "#/$defs/string"
-                    },
-                    "table_configuration": {
-                      "description": "Configuration settings to control the ingestion of tables. These settings override the table_configuration defined in the IngestionPipelineDefinition object and the SchemaSpec.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.TableSpecificConfig"
-                    }
-                  },
-                  "additionalProperties": false,
-                  "required": [
-                    "destination_catalog",
-                    "destination_schema",
-                    "source_table"
+                  "type": "string",
+                  "description": "Release channel of the underlying pipeline's runtime.\nPREVIEW provides early access to the latest features but may be less stable.\nSome source table configurations (e.g., read-time CDF) require PREVIEW.\nDefaults to CURRENT if not specified.",
+                  "enum": [
+                    "CURRENT",
+                    "PREVIEW"
+                  ],
+                  "enumDescriptions": [
+                    "[Private Preview]",
+                    "[Private Preview]"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.TableSpecificConfig": {
+            "postgres.ProjectCustomTag": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "auto_full_refresh_policy": {
-                      "description": "(Optional, Mutable) Policy for auto full refresh, if enabled pipeline will automatically try\nto fix issues by doing a full refresh on the table in the retry run. auto_full_refresh_policy\nin table configuration will override the above level auto_full_refresh_policy.\nFor example,\n{\n\"auto_full_refresh_policy\": {\n\"enabled\": true,\n\"min_interval_hours\": 23,\n}\n}\nIf unspecified, auto full refresh is disabled.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.AutoFullRefreshPolicy"
-                    },
-                    "exclude_columns": {
-                      "description": "A list of column names to be excluded for the ingestion.\nWhen not specified, include_columns fully controls what columns to be ingested.\nWhen specified, all other columns including future ones will be automatically included for ingestion.\nThis field in mutually exclusive with `include_columns`.",
-                      "$ref": "#/$defs/slice/string"
-                    },
-                    "include_columns": {
-                      "description": "A list of column names to be included for the ingestion.\nWhen not specified, all columns except ones in exclude_columns will be included. Future\ncolumns will be automatically included.\nWhen specified, all other future columns will be automatically excluded from ingestion.\nThis field in mutually exclusive with `exclude_columns`.",
-                      "$ref": "#/$defs/slice/string"
-                    },
-                    "primary_keys": {
-                      "description": "The primary key of the table used to apply changes.",
-                      "$ref": "#/$defs/slice/string"
-                    },
-                    "query_based_connector_config": {
-                      "description": "Configurations that are only applicable for query-based ingestion connectors.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.IngestionPipelineDefinitionTableSpecificConfigQueryBasedConnectorConfig",
-                      "x-databricks-preview": "PRIVATE",
-                      "doNotSuggest": true
-                    },
-                    "row_filter": {
-                      "description": "(Optional, Immutable) The row filter condition to be applied to the table.\nIt must not contain the WHERE keyword, only the actual filter condition.\nIt must be in DBSQL format.",
+                    "key": {
+                      "description": "The key of the custom tag.",
                       "$ref": "#/$defs/string",
-                      "x-databricks-preview": "PRIVATE",
-                      "doNotSuggest": true
-                    },
-                    "salesforce_include_formula_fields": {
-                      "description": "If true, formula fields defined in the table are included in the ingestion. This setting is only valid for the Salesforce connector",
-                      "$ref": "#/$defs/bool",
-                      "x-databricks-preview": "PRIVATE",
-                      "doNotSuggest": true
-                    },
-                    "scd_type": {
-                      "description": "The SCD type to use to ingest the table.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.TableSpecificConfigScdType",
-                      "x-databricks-preview": "PRIVATE",
-                      "doNotSuggest": true
-                    },
-                    "sequence_by": {
-                      "description": "The column names specifying the logical order of events in the source data. Spark Declarative Pipelines uses this sequencing to handle change events that arrive out of order.",
-                      "$ref": "#/$defs/slice/string"
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "workday_report_parameters": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.IngestionPipelineDefinitionWorkdayReportParameters",
-                      "x-databricks-preview": "PRIVATE",
-                      "doNotSuggest": true
+                    "value": {
+                      "description": "The value of the custom tag.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.TableSpecificConfigScdType": {
+            "postgres.ProjectDefaultEndpointSettings": {
               "oneOf": [
                 {
-                  "type": "string",
-                  "description": "The SCD type to use to ingest the table.",
-                  "enum": [
-                    "SCD_TYPE_1",
-                    "SCD_TYPE_2",
-                    "APPEND_ONLY"
-                  ]
+                  "type": "object",
+                  "description": "A collection of settings for a compute endpoint.",
+                  "properties": {
+                    "autoscaling_limit_max_cu": {
+                      "description": "The maximum number of Compute Units. Minimum value is 0.5.",
+                      "$ref": "#/$defs/float64",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "autoscaling_limit_min_cu": {
+                      "description": "The minimum number of Compute Units. Minimum value is 0.5.",
+                      "$ref": "#/$defs/float64",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "no_suspension": {
+                      "description": "When set to true, explicitly disables automatic suspension (never suspend).\nShould be set to true when provided.\nMutually exclusive with `suspend_timeout_duration`.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "pg_settings": {
+                      "description": "A raw representation of Postgres settings.",
+                      "$ref": "#/$defs/map/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "suspend_timeout_duration": {
+                      "description": "Duration of inactivity after which the compute endpoint is automatically suspended.\nIf specified should be between 60s and 604800s (1 minute to 1 week).\nMutually exclusive with `no_suspension`.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/common/types/duration.Duration",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.TikTokAdsOptions": {
+            "postgres.RoleAttributes": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "TikTok Ads specific options for ingestion",
+                  "description": "Attributes that can be granted to a Postgres role. We are only implementing a subset for now, see xref:\nhttps://www.postgresql.org/docs/16/sql-createrole.html\nThe values follow Postgres keyword naming e.g. CREATEDB, BYPASSRLS, etc. which is why they don't include typical\nunderscores between words.",
                   "properties": {
-                    "data_level": {
-                      "description": "(Optional) Data level for the report.\nIf not specified, defaults to AUCTION_CAMPAIGN.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.TikTokAdsOptionsTikTokDataLevel"
-                    },
-                    "dimensions": {
-                      "description": "(Optional) Dimensions to include in the report.\nExamples: \"campaign_id\", \"adgroup_id\", \"ad_id\", \"stat_time_day\", \"stat_time_hour\"\nIf not specified, defaults to campaign_id.",
-                      "$ref": "#/$defs/slice/string"
-                    },
-                    "lookback_window_days": {
-                      "description": "(Optional) Number of days to look back for report tables during incremental sync\nto capture late-arriving conversions and attribution data.\nIf not specified, defaults to 7 days.",
-                      "$ref": "#/$defs/int"
-                    },
-                    "metrics": {
-                      "description": "(Optional) Metrics to include in the report.\nExamples: \"spend\", \"impressions\", \"clicks\", \"conversion\", \"cpc\"\nIf not specified, defaults to basic metrics (spend, impressions, clicks, etc.)",
-                      "$ref": "#/$defs/slice/string"
-                    },
-                    "query_lifetime": {
-                      "description": "(Optional) Whether to request lifetime metrics (all-time aggregated data).\nWhen true, the report returns all-time data.\nIf not specified, defaults to false.",
-                      "$ref": "#/$defs/bool"
+                    "bypassrls": {
+                      "description": "Grants the Postgres `BYPASSRLS` attribute, which lets the role bypass every row-level security policy.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "report_type": {
-                      "description": "(Optional) Report type for the TikTok Ads API.\nIf not specified, defaults to BASIC.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.TikTokAdsOptionsTikTokReportType"
+                    "createdb": {
+                      "description": "Grants the Postgres `CREATEDB` attribute, which lets the role create databases.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "sync_start_date": {
-                      "description": "(Optional) Start date for the initial sync of report tables in YYYY-MM-DD format.\nThis determines the earliest date from which to sync historical data.\nIf not specified, defaults to 1 year of historical data for daily reports\nand 30 days for hourly reports.",
-                      "$ref": "#/$defs/string"
+                    "createrole": {
+                      "description": "Grants the Postgres `CREATEROLE` attribute, which lets the role create, alter, and drop other roles.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.TikTokAdsOptionsTikTokDataLevel": {
+            "postgres.RoleAuthMethod": {
               "oneOf": [
                 {
                   "type": "string",
-                  "description": "Data level for TikTok Ads report aggregation.",
+                  "description": "How the role is authenticated when connecting to Postgres.",
                   "enum": [
-                    "AUCTION_ADVERTISER",
-                    "AUCTION_CAMPAIGN",
-                    "AUCTION_ADGROUP",
-                    "AUCTION_AD"
+                    "NO_LOGIN",
+                    "PG_PASSWORD_SCRAM_SHA_256",
+                    "LAKEBASE_OAUTH_V1"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "postgres.RoleIdentityType": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "description": "The type of the Databricks managed identity that this Role represents.\nLeave empty if you wish to create a regular Postgres role not associated with a Databricks identity.",
+                  "enum": [
+                    "USER",
+                    "SERVICE_PRINCIPAL",
+                    "GROUP"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "pipelines.TikTokAdsOptionsTikTokReportType": {
+            "postgres.RoleMembershipRole": {
               "oneOf": [
                 {
                   "type": "string",
-                  "description": "Report type for TikTok Ads API.",
+                  "description": "Roles that the DatabaseInstanceRole can be a member of.",
                   "enum": [
-                    "BASIC",
-                    "AUDIENCE",
-                    "PLAYABLE_AD",
-                    "DSA",
-                    "BUSINESS_CENTER",
-                    "GMV_MAX"
+                    "DATABRICKS_SUPERUSER"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "postgres.EndpointGroupSpec": {
+            "postgres.ScheduleCadence": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "One cadence at which automatic snapshots are taken.",
                   "properties": {
-                    "enable_readable_secondaries": {
-                      "description": "Whether to allow read-only connections to read-write endpoints. Only relevant for read-write endpoints where\nsize.max \u003e 1.",
-                      "$ref": "#/$defs/bool"
+                    "daily_schedule": {
+                      "description": "[Beta] Take a snapshot once per day.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/postgres.DailySchedule",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     },
-                    "max": {
-                      "description": "The maximum number of computes in the endpoint group. Currently, this must be equal to min. Set to 1 for single\ncompute endpoints, to disable HA. To manually suspend all computes in an endpoint group, set disabled to\ntrue on the EndpointSpec.",
-                      "$ref": "#/$defs/int"
+                    "monthly_schedule": {
+                      "description": "[Beta] Take a snapshot once per month.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/postgres.MonthlySchedule",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     },
-                    "min": {
-                      "description": "The minimum number of computes in the endpoint group. Currently, this must be equal to max. This must be greater\nthan or equal to 1.",
-                      "$ref": "#/$defs/int"
+                    "retention": {
+                      "description": "[Beta] How long snapshots from this cadence are kept before automatic deletion.\nMust be at least 1 hour. Applied when a snapshot is taken; not retroactive,\nso changing it affects only later snapshots.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/common/types/duration.Duration",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
+                    },
+                    "weekly_schedule": {
+                      "description": "[Beta] Take a snapshot once per week.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/postgres.WeeklySchedule",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     }
                   },
                   "additionalProperties": false,
                   "required": [
-                    "max",
-                    "min"
+                    "retention"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "postgres.EndpointSettings": {
+            "postgres.SyncedTableSyncedTableSpecExtraColumn": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "A collection of settings for a compute endpoint.",
+                  "description": "An extra PostgreSQL column to add to the synced table.",
                   "properties": {
-                    "pg_settings": {
-                      "description": "A raw representation of Postgres settings.",
-                      "$ref": "#/$defs/map/string"
+                    "column_name": {
+                      "description": "[Private Preview] Name of the column.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "column_type": {
+                      "description": "[Private Preview] PostgreSQL type of the column, for example \"tsvector\" or \"vector(1024)\".",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "compute": {
+                      "description": "[Private Preview] SQL expression used to compute the column's value, for example\n\"to_tsvector('english', content)\".",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "maintenance": {
+                      "description": "[Private Preview] How the column's value is populated and kept up to date.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/postgres.SyncedTableSyncedTableSpecExtraColumnMaintenance",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
                     }
                   },
-                  "additionalProperties": false
+                  "additionalProperties": false,
+                  "required": [
+                    "column_name",
+                    "column_type"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "postgres.EndpointType": {
+            "postgres.SyncedTableSyncedTableSpecExtraColumnMaintenance": {
               "oneOf": [
                 {
                   "type": "string",
-                  "description": "The compute endpoint type. Either `read_write` or `read_only`.",
+                  "description": "How the column's value is populated and kept up to date.",
                   "enum": [
-                    "ENDPOINT_TYPE_READ_WRITE",
-                    "ENDPOINT_TYPE_READ_ONLY"
+                    "STORED_GENERATED"
+                  ],
+                  "enumDescriptions": [
+                    "[Private Preview]"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "postgres.ProjectCustomTag": {
+            "postgres.SyncedTableSyncedTableSpecPgSpecificType": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "description": "PostgreSQL-specific target types that can override the default Delta-to-PG mapping.",
+                  "enum": [
+                    "PG_SPECIFIC_TYPE_VECTOR",
+                    "PG_SPECIFIC_TYPE_HALFVEC",
+                    "PG_SPECIFIC_TYPE_VARCHAR"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "postgres.SyncedTableSyncedTableSpecSyncedTableSchedulingPolicy": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "description": "Scheduling policy of the synced table's underlying pipeline.",
+                  "enum": [
+                    "CONTINUOUS",
+                    "TRIGGERED",
+                    "SNAPSHOT"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "postgres.SyncedTableSyncedTableSpecTypeOverride": {
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Overrides the default Delta-to-PostgreSQL type mapping for a single column.",
                   "properties": {
-                    "key": {
-                      "description": "The key of the custom tag.",
-                      "$ref": "#/$defs/string"
+                    "column_name": {
+                      "description": "Name of the source column whose target PostgreSQL type should be overridden.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "value": {
-                      "description": "The value of the custom tag.",
-                      "$ref": "#/$defs/string"
+                    "pg_type": {
+                      "description": "PostgreSQL-specific target type to use for the column.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/postgres.SyncedTableSyncedTableSpecPgSpecificType",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "size": {
+                      "description": "Size parameter for the target type, for types that take one (e.g. vector\ndimension, varchar length). Required when the chosen pg_type needs a size.",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
-                  "additionalProperties": false
+                  "additionalProperties": false,
+                  "required": [
+                    "column_name",
+                    "pg_type"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "postgres.ProjectDefaultEndpointSettings": {
+            "postgres.WeeklySchedule": {
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "A collection of settings for a compute endpoint.",
+                  "description": "Take a snapshot once per week, on the configured day at the configured hour.",
                   "properties": {
-                    "autoscaling_limit_max_cu": {
-                      "description": "The maximum number of Compute Units. Minimum value is 0.5.",
-                      "$ref": "#/$defs/float64"
-                    },
-                    "autoscaling_limit_min_cu": {
-                      "description": "The minimum number of Compute Units. Minimum value is 0.5.",
-                      "$ref": "#/$defs/float64"
-                    },
-                    "no_suspension": {
-                      "description": "When set to true, explicitly disables automatic suspension (never suspend).\nShould be set to true when provided.",
-                      "$ref": "#/$defs/bool"
+                    "day_of_week": {
+                      "description": "[Beta] The day of the week on which to take the snapshot.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/postgres.DayOfWeek",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     },
-                    "pg_settings": {
-                      "description": "A raw representation of Postgres settings.",
-                      "$ref": "#/$defs/map/string"
-                    },
-                    "suspend_timeout_duration": {
-                      "description": "Duration of inactivity after which the compute endpoint is automatically suspended.\nIf specified should be between 60s and 604800s (1 minute to 1 week).",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/common/types/duration.Duration"
+                    "hour": {
+                      "description": "[Beta] The hour of the day, in UTC, at which to take the snapshot, in [0, 23].",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "PUBLIC_BETA"
                     }
                   },
-                  "additionalProperties": false
+                  "additionalProperties": false,
+                  "required": [
+                    "day_of_week"
+                  ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -9514,18 +17557,20 @@
                   "properties": {
                     "ai21labs_api_key": {
                       "description": "The Databricks secret key reference for an AI21 Labs API key. If you\nprefer to paste your API key directly, see `ai21labs_api_key_plaintext`.\nYou must provide an API key using one of the following fields:\n`ai21labs_api_key` or `ai21labs_api_key_plaintext`.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "ai21labs_api_key_plaintext": {
                       "description": "An AI21 Labs API key provided as a plaintext string. If you prefer to\nreference your key using Databricks Secrets, see `ai21labs_api_key`. You\nmust provide an API key using one of the following fields:\n`ai21labs_api_key` or `ai21labs_api_key_plaintext`.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -9536,30 +17581,35 @@
                   "properties": {
                     "fallback_config": {
                       "description": "Configuration for traffic fallback which auto fallbacks to other served entities if the request to a served\nentity fails with certain error codes, to increase availability.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.FallbackConfig"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.FallbackConfig",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "guardrails": {
-                      "description": "Configuration for AI Guardrails to prevent unwanted data and unsafe data in requests and responses.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AiGatewayGuardrails"
+                      "description": "[Public Preview] Configuration for AI Guardrails to prevent unwanted data and unsafe data in requests and responses.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AiGatewayGuardrails",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
                     "inference_table_config": {
                       "description": "Configuration for payload logging using inference tables.\nUse these tables to monitor and audit data being sent to and received from model APIs and to improve model quality.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AiGatewayInferenceTableConfig"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AiGatewayInferenceTableConfig",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "rate_limits": {
                       "description": "Configuration for rate limits which can be set to limit endpoint traffic.",
-                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/serving.AiGatewayRateLimit"
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/serving.AiGatewayRateLimit",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "usage_tracking_config": {
                       "description": "Configuration to enable usage tracking using system tables.\nThese tables allow you to monitor operational usage on endpoints and their associated costs.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AiGatewayUsageTrackingConfig"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AiGatewayUsageTrackingConfig",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -9569,22 +17619,26 @@
                   "type": "object",
                   "properties": {
                     "invalid_keywords": {
-                      "description": "List of invalid keywords.\nAI guardrail uses keyword or string matching to decide if the keyword exists in the request or response content.",
+                      "description": "[Public Preview] List of invalid keywords.\nAI guardrail uses keyword or string matching to decide if the keyword exists in the request or response content.",
                       "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW",
                       "deprecationMessage": "This field is deprecated",
                       "deprecated": true
                     },
                     "pii": {
-                      "description": "Configuration for guardrail PII filter.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AiGatewayGuardrailPiiBehavior"
+                      "description": "[Public Preview] Configuration for guardrail PII filter.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AiGatewayGuardrailPiiBehavior",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
                     "safety": {
-                      "description": "Indicates whether the safety filter is enabled.",
-                      "$ref": "#/$defs/bool"
+                      "description": "[Public Preview] Indicates whether the safety filter is enabled.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
                     "valid_topics": {
-                      "description": "The list of allowed topics.\nGiven a chat request, this guardrail flags the request if its topic is not in the allowed topics.",
+                      "description": "[Public Preview] The list of allowed topics.\nGiven a chat request, this guardrail flags the request if its topic is not in the allowed topics.",
                       "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW",
                       "deprecationMessage": "This field is deprecated",
                       "deprecated": true
                     }
@@ -9593,7 +17647,7 @@
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -9603,15 +17657,16 @@
                   "type": "object",
                   "properties": {
                     "behavior": {
-                      "description": "Configuration for input guardrail filters.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AiGatewayGuardrailPiiBehaviorBehavior"
+                      "description": "[Public Preview] Configuration for input guardrail filters.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AiGatewayGuardrailPiiBehaviorBehavior",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -9623,11 +17678,16 @@
                     "NONE",
                     "BLOCK",
                     "MASK"
+                  ],
+                  "enumDescriptions": [
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -9637,19 +17697,21 @@
                   "type": "object",
                   "properties": {
                     "input": {
-                      "description": "Configuration for input guardrail filters.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AiGatewayGuardrailParameters"
+                      "description": "[Public Preview] Configuration for input guardrail filters.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AiGatewayGuardrailParameters",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
                     "output": {
-                      "description": "Configuration for output guardrail filters.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AiGatewayGuardrailParameters"
+                      "description": "[Public Preview] Configuration for output guardrail filters.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AiGatewayGuardrailParameters",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -9660,26 +17722,30 @@
                   "properties": {
                     "catalog_name": {
                       "description": "The name of the catalog in Unity Catalog. Required when enabling inference tables.\nNOTE: On update, you have to disable inference table first in order to change the catalog name.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "enabled": {
                       "description": "Indicates whether the inference table is enabled.",
-                      "$ref": "#/$defs/bool"
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "schema_name": {
                       "description": "The name of the schema in Unity Catalog. Required when enabling inference tables.\nNOTE: On update, you have to disable inference table first in order to change the schema name.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "table_name_prefix": {
                       "description": "The prefix of the table in Unity Catalog.\nNOTE: On update, you have to disable inference table first in order to change the prefix name.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -9690,23 +17756,28 @@
                   "properties": {
                     "calls": {
                       "description": "Used to specify how many calls are allowed for a key within the renewal_period.",
-                      "$ref": "#/$defs/int64"
+                      "$ref": "#/$defs/int64",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "key": {
                       "description": "Key field for a rate limit. Currently, 'user', 'user_group, 'service_principal', and 'endpoint' are supported,\nwith 'endpoint' being the default if not specified.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AiGatewayRateLimitKey"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AiGatewayRateLimitKey",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "principal": {
                       "description": "Principal field for a user, user group, or service principal to apply rate limiting to. Accepts a user email, group name, or service principal application ID.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "renewal_period": {
                       "description": "Renewal period field for a rate limit. Currently, only 'minute' is supported.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AiGatewayRateLimitRenewalPeriod"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AiGatewayRateLimitRenewalPeriod",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "tokens": {
                       "description": "Used to specify how many tokens are allowed for a key within the renewal_period.",
-                      "$ref": "#/$defs/int64"
+                      "$ref": "#/$defs/int64",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false,
@@ -9716,7 +17787,7 @@
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -9729,11 +17800,17 @@
                     "endpoint",
                     "user_group",
                     "service_principal"
+                  ],
+                  "enumDescriptions": [
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -9743,11 +17820,14 @@
                   "type": "string",
                   "enum": [
                     "minute"
+                  ],
+                  "enumDescriptions": [
+                    "[Public Preview]"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -9758,14 +17838,15 @@
                   "properties": {
                     "enabled": {
                       "description": "Whether to enable usage tracking.",
-                      "$ref": "#/$defs/bool"
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -9776,31 +17857,43 @@
                   "properties": {
                     "aws_access_key_id": {
                       "description": "The Databricks secret key reference for an AWS access key ID with\npermissions to interact with Bedrock services. If you prefer to paste\nyour API key directly, see `aws_access_key_id_plaintext`. You must provide an API\nkey using one of the following fields: `aws_access_key_id` or\n`aws_access_key_id_plaintext`.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "aws_access_key_id_plaintext": {
                       "description": "An AWS access key ID with permissions to interact with Bedrock services\nprovided as a plaintext string. If you prefer to reference your key using\nDatabricks Secrets, see `aws_access_key_id`. You must provide an API key\nusing one of the following fields: `aws_access_key_id` or\n`aws_access_key_id_plaintext`.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "aws_region": {
                       "description": "The AWS region to use. Bedrock has to be enabled there.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "aws_secret_access_key": {
                       "description": "The Databricks secret key reference for an AWS secret access key paired\nwith the access key ID, with permissions to interact with Bedrock\nservices. If you prefer to paste your API key directly, see\n`aws_secret_access_key_plaintext`. You must provide an API key using one\nof the following fields: `aws_secret_access_key` or\n`aws_secret_access_key_plaintext`.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "aws_secret_access_key_plaintext": {
                       "description": "An AWS secret access key paired with the access key ID, with permissions\nto interact with Bedrock services provided as a plaintext string. If you\nprefer to reference your key using Databricks Secrets, see\n`aws_secret_access_key`. You must provide an API key using one of the\nfollowing fields: `aws_secret_access_key` or\n`aws_secret_access_key_plaintext`.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "bedrock_provider": {
                       "description": "The underlying provider in Amazon Bedrock. Supported values (case\ninsensitive) include: Anthropic, Cohere, AI21Labs, Amazon.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AmazonBedrockConfigBedrockProvider"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AmazonBedrockConfigBedrockProvider",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "instance_profile_arn": {
                       "description": "ARN of the instance profile that the external model will use to access AWS resources.\nYou must authenticate using an instance profile or access keys.\nIf you prefer to authenticate using access keys, see `aws_access_key_id`,\n`aws_access_key_id_plaintext`, `aws_secret_access_key` and `aws_secret_access_key_plaintext`.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "uc_service_credential_name": {
+                      "description": "[Public Preview] The name of the Unity Catalog service credential that the external model uses to access AWS\nresources.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     }
                   },
                   "additionalProperties": false,
@@ -9811,7 +17904,7 @@
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -9824,11 +17917,17 @@
                     "cohere",
                     "ai21labs",
                     "amazon"
+                  ],
+                  "enumDescriptions": [
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -9839,18 +17938,20 @@
                   "properties": {
                     "anthropic_api_key": {
                       "description": "The Databricks secret key reference for an Anthropic API key. If you\nprefer to paste your API key directly, see `anthropic_api_key_plaintext`.\nYou must provide an API key using one of the following fields:\n`anthropic_api_key` or `anthropic_api_key_plaintext`.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "anthropic_api_key_plaintext": {
                       "description": "The Anthropic API key provided as a plaintext string. If you prefer to\nreference your key using Databricks Secrets, see `anthropic_api_key`. You\nmust provide an API key using one of the following fields:\n`anthropic_api_key` or `anthropic_api_key_plaintext`.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -9861,15 +17962,18 @@
                   "properties": {
                     "key": {
                       "description": "The name of the API key parameter used for authentication.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "value": {
                       "description": "The Databricks secret key reference for an API Key.\nIf you prefer to paste your token directly, see `value_plaintext`.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "value_plaintext": {
                       "description": "The API Key provided as a plaintext string. If you prefer to reference your\ntoken using Databricks Secrets, see `value`.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false,
@@ -9879,7 +17983,7 @@
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -9887,29 +17991,34 @@
               "oneOf": [
                 {
                   "type": "object",
+                  "description": "Deprecated: legacy inference table configuration. Please use AI Gateway inference tables instead.\nSee https://docs.databricks.com/aws/en/ai-gateway/inference-tables.",
                   "properties": {
                     "catalog_name": {
                       "description": "The name of the catalog in Unity Catalog. NOTE: On update, you cannot change the catalog name if the inference table is already enabled.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "enabled": {
                       "description": "Indicates whether the inference table is enabled.",
-                      "$ref": "#/$defs/bool"
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "schema_name": {
                       "description": "The name of the schema in Unity Catalog. NOTE: On update, you cannot change the schema name if the inference table is already enabled.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "table_name_prefix": {
                       "description": "The prefix of the table in Unity Catalog. NOTE: On update, you cannot change the prefix name if the inference table is already enabled.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -9920,18 +18029,20 @@
                   "properties": {
                     "token": {
                       "description": "The Databricks secret key reference for a token.\nIf you prefer to paste your token directly, see `token_plaintext`.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "token_plaintext": {
                       "description": "The token provided as a plaintext string. If you prefer to reference your\ntoken using Databricks Secrets, see `token`.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -9942,22 +18053,25 @@
                   "properties": {
                     "cohere_api_base": {
                       "description": "This is an optional field to provide a customized base URL for the Cohere\nAPI. If left unspecified, the standard Cohere base URL is used.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "cohere_api_key": {
                       "description": "The Databricks secret key reference for a Cohere API key. If you prefer\nto paste your API key directly, see `cohere_api_key_plaintext`. You must\nprovide an API key using one of the following fields: `cohere_api_key` or\n`cohere_api_key_plaintext`.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "cohere_api_key_plaintext": {
                       "description": "The Cohere API key provided as a plaintext string. If you prefer to\nreference your key using Databricks Secrets, see `cohere_api_key`. You\nmust provide an API key using one of the following fields:\n`cohere_api_key` or `cohere_api_key_plaintext`.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -9969,15 +18083,18 @@
                   "properties": {
                     "api_key_auth": {
                       "description": "This is a field to provide API key authentication for the custom provider API.\nYou can only specify one authentication method.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.ApiKeyAuth"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.ApiKeyAuth",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "bearer_token_auth": {
                       "description": "This is a field to provide bearer token authentication for the custom provider API.\nYou can only specify one authentication method.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.BearerTokenAuth"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.BearerTokenAuth",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "custom_provider_url": {
                       "description": "This is a field to provide the URL of the custom provider API.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false,
@@ -9987,7 +18104,7 @@
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -9998,15 +18115,18 @@
                   "properties": {
                     "databricks_api_token": {
                       "description": "The Databricks secret key reference for a Databricks API token that\ncorresponds to a user or service principal with Can Query access to the\nmodel serving endpoint pointed to by this external model. If you prefer\nto paste your API key directly, see `databricks_api_token_plaintext`. You\nmust provide an API key using one of the following fields:\n`databricks_api_token` or `databricks_api_token_plaintext`.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "databricks_api_token_plaintext": {
                       "description": "The Databricks API token that corresponds to a user or service principal\nwith Can Query access to the model serving endpoint pointed to by this\nexternal model provided as a plaintext string. If you prefer to reference\nyour key using Databricks Secrets, see `databricks_api_token`. You must\nprovide an API key using one of the following fields:\n`databricks_api_token` or `databricks_api_token_plaintext`.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "databricks_workspace_url": {
                       "description": "The URL of the Databricks workspace containing the model serving endpoint\npointed to by this external model.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false,
@@ -10016,7 +18136,7 @@
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -10027,18 +18147,20 @@
                   "properties": {
                     "on_update_failure": {
                       "description": "A list of email addresses to be notified when an endpoint fails to update its configuration or state.",
-                      "$ref": "#/$defs/slice/string"
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "on_update_success": {
                       "description": "A list of email addresses to be notified when an endpoint successfully updates its configuration or state.",
-                      "$ref": "#/$defs/slice/string"
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -10048,27 +18170,33 @@
                   "type": "object",
                   "properties": {
                     "auto_capture_config": {
-                      "description": "Configuration for Inference Tables which automatically logs requests and responses to Unity Catalog.\nNote: this field is deprecated for creating new provisioned throughput endpoints,\nor updating existing provisioned throughput endpoints that never have inference table configured;\nin these cases please use AI Gateway to manage inference tables.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AutoCaptureConfigInput"
+                      "description": "Configuration for legacy Inference Tables which automatically log requests and responses to Unity\nCatalog.\nDeprecated: please use AI Gateway inference tables instead. See\nhttps://docs.databricks.com/aws/en/ai-gateway/inference-tables.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AutoCaptureConfigInput",
+                      "x-databricks-launch-stage": "GA",
+                      "deprecationMessage": "This field is deprecated",
+                      "deprecated": true
                     },
                     "served_entities": {
                       "description": "The list of served entities under the serving endpoint config.",
-                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/serving.ServedEntityInput"
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/serving.ServedEntityInput",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "served_models": {
                       "description": "(Deprecated, use served_entities instead) The list of served models under the serving endpoint config.",
-                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/serving.ServedModelInput"
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/serving.ServedModelInput",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "traffic_config": {
                       "description": "The traffic configuration associated with the serving endpoint config.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.TrafficConfig"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.TrafficConfig",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -10079,11 +18207,13 @@
                   "properties": {
                     "key": {
                       "description": "Key field for a serving endpoint tag.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "value": {
                       "description": "Optional value field for a serving endpoint tag.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false,
@@ -10093,7 +18223,7 @@
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -10104,51 +18234,63 @@
                   "properties": {
                     "ai21labs_config": {
                       "description": "AI21Labs Config. Only required if the provider is 'ai21labs'.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.Ai21LabsConfig"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.Ai21LabsConfig",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "amazon_bedrock_config": {
                       "description": "Amazon Bedrock Config. Only required if the provider is 'amazon-bedrock'.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AmazonBedrockConfig"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AmazonBedrockConfig",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "anthropic_config": {
                       "description": "Anthropic Config. Only required if the provider is 'anthropic'.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AnthropicConfig"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AnthropicConfig",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "cohere_config": {
                       "description": "Cohere Config. Only required if the provider is 'cohere'.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.CohereConfig"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.CohereConfig",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "custom_provider_config": {
                       "description": "Custom Provider Config. Only required if the provider is 'custom'.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.CustomProviderConfig"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.CustomProviderConfig",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "databricks_model_serving_config": {
                       "description": "Databricks Model Serving Config. Only required if the provider is 'databricks-model-serving'.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.DatabricksModelServingConfig"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.DatabricksModelServingConfig",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "google_cloud_vertex_ai_config": {
                       "description": "Google Cloud Vertex AI Config. Only required if the provider is 'google-cloud-vertex-ai'.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.GoogleCloudVertexAiConfig"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.GoogleCloudVertexAiConfig",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "name": {
                       "description": "The name of the external model.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "openai_config": {
                       "description": "OpenAI Config. Only required if the provider is 'openai'.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.OpenAiConfig"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.OpenAiConfig",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "palm_config": {
                       "description": "PaLM Config. Only required if the provider is 'palm'.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.PaLmConfig"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.PaLmConfig",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "provider": {
                       "description": "The name of the provider for the external model. Currently, the supported providers are 'ai21labs', 'anthropic', 'amazon-bedrock', 'cohere', 'databricks-model-serving', 'google-cloud-vertex-ai', 'openai', 'palm', and 'custom'.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.ExternalModelProvider"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.ExternalModelProvider",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "task": {
                       "description": "The task type of the external model.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false,
@@ -10160,7 +18302,7 @@
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -10178,11 +18320,22 @@
                     "openai",
                     "palm",
                     "custom"
+                  ],
+                  "enumDescriptions": [
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -10193,7 +18346,8 @@
                   "properties": {
                     "enabled": {
                       "description": "Whether to enable traffic fallback. When a served entity in the serving endpoint returns specific error\ncodes (e.g. 500), the request will automatically be round-robin attempted with other served entities in the same\nendpoint, following the order of served entity list, until a successful response is returned.\nIf all attempts fail, return the last response with the error code.",
-                      "$ref": "#/$defs/bool"
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false,
@@ -10203,7 +18357,7 @@
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -10214,19 +18368,23 @@
                   "properties": {
                     "private_key": {
                       "description": "The Databricks secret key reference for a private key for the service\naccount which has access to the Google Cloud Vertex AI Service. See [Best\npractices for managing service account keys]. If you prefer to paste your\nAPI key directly, see `private_key_plaintext`. You must provide an API\nkey using one of the following fields: `private_key` or\n`private_key_plaintext`\n\n[Best practices for managing service account keys]: https://cloud.google.com/iam/docs/best-practices-for-managing-service-account-keys",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "private_key_plaintext": {
                       "description": "The private key for the service account which has access to the Google\nCloud Vertex AI Service provided as a plaintext secret. See [Best\npractices for managing service account keys]. If you prefer to reference\nyour key using Databricks Secrets, see `private_key`. You must provide an\nAPI key using one of the following fields: `private_key` or\n`private_key_plaintext`.\n\n[Best practices for managing service account keys]: https://cloud.google.com/iam/docs/best-practices-for-managing-service-account-keys",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "project_id": {
                       "description": "This is the Google Cloud project id that the service account is\nassociated with.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "region": {
                       "description": "This is the region for the Google Cloud Vertex AI Service. See [supported\nregions] for more details. Some models are only available in specific\nregions.\n\n[supported regions]: https://cloud.google.com/vertex-ai/docs/general/locations",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false,
@@ -10237,7 +18395,7 @@
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -10249,54 +18407,65 @@
                   "properties": {
                     "microsoft_entra_client_id": {
                       "description": "This field is only required for Azure AD OpenAI and is the Microsoft\nEntra Client ID.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "microsoft_entra_client_secret": {
                       "description": "The Databricks secret key reference for a client secret used for\nMicrosoft Entra ID authentication. If you prefer to paste your client\nsecret directly, see `microsoft_entra_client_secret_plaintext`. You must\nprovide an API key using one of the following fields:\n`microsoft_entra_client_secret` or\n`microsoft_entra_client_secret_plaintext`.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "microsoft_entra_client_secret_plaintext": {
                       "description": "The client secret used for Microsoft Entra ID authentication provided as\na plaintext string. If you prefer to reference your key using Databricks\nSecrets, see `microsoft_entra_client_secret`. You must provide an API key\nusing one of the following fields: `microsoft_entra_client_secret` or\n`microsoft_entra_client_secret_plaintext`.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "microsoft_entra_tenant_id": {
                       "description": "This field is only required for Azure AD OpenAI and is the Microsoft\nEntra Tenant ID.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "openai_api_base": {
                       "description": "This is a field to provide a customized base URl for the OpenAI API. For\nAzure OpenAI, this field is required, and is the base URL for the Azure\nOpenAI API service provided by Azure. For other OpenAI API types, this\nfield is optional, and if left unspecified, the standard OpenAI base URL\nis used.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "openai_api_key": {
                       "description": "The Databricks secret key reference for an OpenAI API key using the\nOpenAI or Azure service. If you prefer to paste your API key directly,\nsee `openai_api_key_plaintext`. You must provide an API key using one of\nthe following fields: `openai_api_key` or `openai_api_key_plaintext`.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "openai_api_key_plaintext": {
                       "description": "The OpenAI API key using the OpenAI or Azure service provided as a\nplaintext string. If you prefer to reference your key using Databricks\nSecrets, see `openai_api_key`. You must provide an API key using one of\nthe following fields: `openai_api_key` or `openai_api_key_plaintext`.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "openai_api_type": {
                       "description": "This is an optional field to specify the type of OpenAI API to use. For\nAzure OpenAI, this field is required, and adjust this parameter to\nrepresent the preferred security access validation protocol. For access\ntoken validation, use azure. For authentication using Azure Active\nDirectory (Azure AD) use, azuread.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "openai_api_version": {
                       "description": "This is an optional field to specify the OpenAI API version. For Azure\nOpenAI, this field is required, and is the version of the Azure OpenAI\nservice to utilize, specified by a date.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "openai_deployment_name": {
                       "description": "This field is only required for Azure OpenAI and is the name of the\ndeployment resource for the Azure OpenAI service.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "openai_organization": {
                       "description": "This is an optional field to specify the organization in OpenAI or Azure\nOpenAI.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -10307,18 +18476,20 @@
                   "properties": {
                     "palm_api_key": {
                       "description": "The Databricks secret key reference for a PaLM API key. If you prefer to\npaste your API key directly, see `palm_api_key_plaintext`. You must\nprovide an API key using one of the following fields: `palm_api_key` or\n`palm_api_key_plaintext`.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "palm_api_key_plaintext": {
                       "description": "The PaLM API key provided as a plaintext string. If you prefer to\nreference your key using Databricks Secrets, see `palm_api_key`. You must\nprovide an API key using one of the following fields: `palm_api_key` or\n`palm_api_key_plaintext`.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -10329,15 +18500,18 @@
                   "properties": {
                     "calls": {
                       "description": "Used to specify how many calls are allowed for a key within the renewal_period.",
-                      "$ref": "#/$defs/int64"
+                      "$ref": "#/$defs/int64",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "key": {
                       "description": "Key field for a serving endpoint rate limit. Currently, only 'user' and 'endpoint' are supported, with 'endpoint' being the default if not specified.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.RateLimitKey"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.RateLimitKey",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "renewal_period": {
                       "description": "Renewal period field for a serving endpoint rate limit. Currently, only 'minute' is supported.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.RateLimitRenewalPeriod"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.RateLimitRenewalPeriod",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false,
@@ -10348,7 +18522,7 @@
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -10359,11 +18533,15 @@
                   "enum": [
                     "user",
                     "endpoint"
+                  ],
+                  "enumDescriptions": [
+                    "[Public Preview]",
+                    "[Public Preview]"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -10373,11 +18551,14 @@
                   "type": "string",
                   "enum": [
                     "minute"
+                  ],
+                  "enumDescriptions": [
+                    "[Public Preview]"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -10387,15 +18568,18 @@
                   "type": "object",
                   "properties": {
                     "served_entity_name": {
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "served_model_name": {
                       "description": "The name of the served model this route configures traffic for.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "traffic_percentage": {
                       "description": "The percentage of endpoint traffic to send to this route. It must be an integer between 0 and 100 inclusive.",
-                      "$ref": "#/$defs/int"
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false,
@@ -10405,7 +18589,7 @@
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -10415,70 +18599,85 @@
                   "type": "object",
                   "properties": {
                     "burst_scaling_enabled": {
-                      "description": "Whether burst scaling is enabled. When enabled (default), the endpoint can automatically\nscale up beyond provisioned capacity to handle traffic spikes. When disabled, the endpoint\nmaintains fixed capacity at provisioned_model_units.",
-                      "$ref": "#/$defs/bool"
+                      "description": "[Public Preview] Whether burst scaling is enabled. When enabled (default), the endpoint can automatically\nscale up beyond provisioned capacity to handle traffic spikes. When disabled, the endpoint\nmaintains fixed capacity at provisioned_model_units.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
                     "entity_name": {
                       "description": "The name of the entity to be served. The entity may be a model in the Databricks Model Registry, a model in the Unity Catalog (UC), or a function of type FEATURE_SPEC in the UC. If it is a UC object, the full name of the object should be given in the form of **catalog_name.schema_name.model_name**.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "entity_version": {
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "environment_vars": {
                       "description": "An object containing a set of optional, user-specified environment variable key-value pairs used for serving this entity. Note: this is an experimental feature and subject to change. Example entity environment variables that refer to Databricks secrets: `{\"OPENAI_API_KEY\": \"{{secrets/my_scope/my_key}}\", \"DATABRICKS_TOKEN\": \"{{secrets/my_scope2/my_key2}}\"}`",
-                      "$ref": "#/$defs/map/string"
+                      "$ref": "#/$defs/map/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "external_model": {
                       "description": "The external model to be served. NOTE: Only one of external_model and (entity_name, entity_version, workload_size, workload_type, and scale_to_zero_enabled) can be specified with the latter set being used for custom model serving for a Databricks registered model. For an existing endpoint with external_model, it cannot be updated to an endpoint without external_model. If the endpoint is created without external_model, users cannot update it to add external_model later. The task type of all external models within an endpoint must be the same.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.ExternalModel"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.ExternalModel",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "instance_profile_arn": {
-                      "description": "ARN of the instance profile that the served entity uses to access AWS resources.",
-                      "$ref": "#/$defs/string"
+                      "description": "[Public Preview] ARN of the instance profile that the served entity uses to access AWS resources.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
                     "max_provisioned_concurrency": {
                       "description": "The maximum provisioned concurrency that the endpoint can scale up to. Do not use if workload_size is specified.",
-                      "$ref": "#/$defs/int"
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "max_provisioned_throughput": {
                       "description": "The maximum tokens per second that the endpoint can scale up to.",
-                      "$ref": "#/$defs/int"
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "min_provisioned_concurrency": {
                       "description": "The minimum provisioned concurrency that the endpoint can scale down to. Do not use if workload_size is specified.",
-                      "$ref": "#/$defs/int"
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "min_provisioned_throughput": {
                       "description": "The minimum tokens per second that the endpoint can scale down to.",
-                      "$ref": "#/$defs/int"
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "name": {
                       "description": "The name of a served entity. It must be unique across an endpoint. A served entity name can consist of alphanumeric characters, dashes, and underscores. If not specified for an external model, this field defaults to external_model.name, with '.' and ':' replaced with '-', and if not specified for other entities, it defaults to entity_name-entity_version.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "provisioned_model_units": {
-                      "description": "The number of model units provisioned.",
-                      "$ref": "#/$defs/int64"
+                      "description": "[Public Preview] The number of model units provisioned.",
+                      "$ref": "#/$defs/int64",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
                     "scale_to_zero_enabled": {
                       "description": "Whether the compute resources for the served entity should scale down to zero.",
-                      "$ref": "#/$defs/bool"
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "workload_size": {
                       "description": "The workload size of the served entity. The workload size corresponds to a range of provisioned concurrency that the compute autoscales between. A single unit of provisioned concurrency can process one request at a time. Valid workload sizes are \"Small\" (4 - 4 provisioned concurrency), \"Medium\" (8 - 16 provisioned concurrency), and \"Large\" (16 - 64 provisioned concurrency). Additional custom workload sizes can also be used when available in the workspace. If scale-to-zero is enabled, the lower bound of the provisioned concurrency for each workload size is 0. Do not use if min_provisioned_concurrency and max_provisioned_concurrency are specified.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "workload_type": {
                       "description": "The workload type of the served entity. The workload type selects which type of compute to use in the endpoint. The default value for this parameter is \"CPU\". For deep learning workloads, GPU acceleration is available by selecting workload types like GPU_SMALL and others. See the available [GPU types](https://docs.databricks.com/en/machine-learning/model-serving/create-manage-serving-endpoints.html#gpu-workload-types).",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.ServingModelWorkloadType"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.ServingModelWorkloadType",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -10488,58 +18687,72 @@
                   "type": "object",
                   "properties": {
                     "burst_scaling_enabled": {
-                      "description": "Whether burst scaling is enabled. When enabled (default), the endpoint can automatically\nscale up beyond provisioned capacity to handle traffic spikes. When disabled, the endpoint\nmaintains fixed capacity at provisioned_model_units.",
-                      "$ref": "#/$defs/bool"
+                      "description": "[Public Preview] Whether burst scaling is enabled. When enabled (default), the endpoint can automatically\nscale up beyond provisioned capacity to handle traffic spikes. When disabled, the endpoint\nmaintains fixed capacity at provisioned_model_units.",
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
                     "environment_vars": {
                       "description": "An object containing a set of optional, user-specified environment variable key-value pairs used for serving this entity. Note: this is an experimental feature and subject to change. Example entity environment variables that refer to Databricks secrets: `{\"OPENAI_API_KEY\": \"{{secrets/my_scope/my_key}}\", \"DATABRICKS_TOKEN\": \"{{secrets/my_scope2/my_key2}}\"}`",
-                      "$ref": "#/$defs/map/string"
+                      "$ref": "#/$defs/map/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "instance_profile_arn": {
-                      "description": "ARN of the instance profile that the served entity uses to access AWS resources.",
-                      "$ref": "#/$defs/string"
+                      "description": "[Public Preview] ARN of the instance profile that the served entity uses to access AWS resources.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
                     "max_provisioned_concurrency": {
                       "description": "The maximum provisioned concurrency that the endpoint can scale up to. Do not use if workload_size is specified.",
-                      "$ref": "#/$defs/int"
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "max_provisioned_throughput": {
                       "description": "The maximum tokens per second that the endpoint can scale up to.",
-                      "$ref": "#/$defs/int"
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "min_provisioned_concurrency": {
                       "description": "The minimum provisioned concurrency that the endpoint can scale down to. Do not use if workload_size is specified.",
-                      "$ref": "#/$defs/int"
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "min_provisioned_throughput": {
                       "description": "The minimum tokens per second that the endpoint can scale down to.",
-                      "$ref": "#/$defs/int"
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "model_name": {
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "model_version": {
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "name": {
                       "description": "The name of a served entity. It must be unique across an endpoint. A served entity name can consist of alphanumeric characters, dashes, and underscores. If not specified for an external model, this field defaults to external_model.name, with '.' and ':' replaced with '-', and if not specified for other entities, it defaults to entity_name-entity_version.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "provisioned_model_units": {
-                      "description": "The number of model units provisioned.",
-                      "$ref": "#/$defs/int64"
+                      "description": "[Public Preview] The number of model units provisioned.",
+                      "$ref": "#/$defs/int64",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     },
                     "scale_to_zero_enabled": {
                       "description": "Whether the compute resources for the served entity should scale down to zero.",
-                      "$ref": "#/$defs/bool"
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "workload_size": {
                       "description": "The workload size of the served entity. The workload size corresponds to a range of provisioned concurrency that the compute autoscales between. A single unit of provisioned concurrency can process one request at a time. Valid workload sizes are \"Small\" (4 - 4 provisioned concurrency), \"Medium\" (8 - 16 provisioned concurrency), and \"Large\" (16 - 64 provisioned concurrency). Additional custom workload sizes can also be used when available in the workspace. If scale-to-zero is enabled, the lower bound of the provisioned concurrency for each workload size is 0. Do not use if min_provisioned_concurrency and max_provisioned_concurrency are specified.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "workload_type": {
                       "description": "The workload type of the served entity. The workload type selects which type of compute to use in the endpoint. The default value for this parameter is \"CPU\". For deep learning workloads, GPU acceleration is available by selecting workload types like GPU_SMALL and others. See the available [GPU types](https://docs.databricks.com/en/machine-learning/model-serving/create-manage-serving-endpoints.html#gpu-workload-types).",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.ServedModelInputWorkloadType"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.ServedModelInputWorkloadType",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false,
@@ -10551,7 +18764,7 @@
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -10559,18 +18772,33 @@
               "oneOf": [
                 {
                   "type": "string",
-                  "description": "Please keep this in sync with with workload types in InferenceEndpointEntities.scala",
+                  "description": "Please keep this in sync with workload types in InferenceEndpointEntities.scala.",
                   "enum": [
                     "CPU",
                     "GPU_MEDIUM",
                     "GPU_SMALL",
                     "GPU_LARGE",
-                    "MULTIGPU_MEDIUM"
+                    "MULTIGPU_MEDIUM",
+                    "CPU_LARGE",
+                    "GPU_XLARGE_8",
+                    "GPU_XLARGE",
+                    "CPU_MEDIUM"
+                  ],
+                  "enumDescriptions": [
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "[Beta]",
+                    "[Beta]",
+                    "[Beta]",
+                    "[Beta]"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -10587,7 +18815,7 @@
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -10595,18 +18823,111 @@
               "oneOf": [
                 {
                   "type": "string",
-                  "description": "Please keep this in sync with with workload types in InferenceEndpointEntities.scala",
+                  "description": "Please keep this in sync with workload types in InferenceEndpointEntities.scala.",
                   "enum": [
                     "CPU",
                     "GPU_MEDIUM",
                     "GPU_SMALL",
                     "GPU_LARGE",
-                    "MULTIGPU_MEDIUM"
+                    "MULTIGPU_MEDIUM",
+                    "CPU_LARGE",
+                    "GPU_XLARGE_8",
+                    "GPU_XLARGE",
+                    "CPU_MEDIUM"
+                  ],
+                  "enumDescriptions": [
+                    "",
+                    "",
+                    "",
+                    "",
+                    "",
+                    "[Beta]",
+                    "[Beta]",
+                    "[Beta]",
+                    "[Beta]"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "serving.TelemetryConfig": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "enabled_telemetry_features": {
+                      "description": "[Public Preview] The telemetry signals to enable for this endpoint. If empty or omitted, all signals are\nenabled; otherwise only the listed signals are enabled.",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/serving.TelemetryFeature",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "inference_table_config": {
+                      "description": "[Public Preview] Configuration for inference table payload logging, including sampling.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.TelemetryInferenceTableConfig",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "table_names": {
+                      "description": "[Public Preview] The Unity Catalog tables to which endpoint telemetry (logs, traces, and metrics) is exported.\nProvide this to create a new telemetry profile for the endpoint from the given tables.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.UnityCatalogTableNames",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "telemetry_profile_id": {
+                      "description": "[Public Preview] The ID of an existing telemetry profile to apply to this endpoint. Provide this to reuse a\ntelemetry profile that has already been created, instead of specifying table_names.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "serving.TelemetryFeature": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "description": "A telemetry signal that a serving endpoint can export to Unity Catalog. Use these values to\nselect which signals the endpoint exports.",
+                  "enum": [
+                    "TELEMETRY_FEATURE_LOGS",
+                    "TELEMETRY_FEATURE_TRACES",
+                    "TELEMETRY_FEATURE_METRICS",
+                    "TELEMETRY_FEATURE_INFERENCE_TABLE"
+                  ],
+                  "enumDescriptions": [
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]",
+                    "[Public Preview]"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "serving.TelemetryInferenceTableConfig": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "Inference table payload logging configuration",
+                  "properties": {
+                    "sampling_fraction": {
+                      "description": "[Public Preview] Fraction of requests sampled for payload logging, in the range [0.0, 1.0], where 1.0 logs all requests.",
+                      "$ref": "#/$defs/float64",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -10617,14 +18938,49 @@
                   "properties": {
                     "routes": {
                       "description": "The list of routes that define traffic to each served entity.",
-                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/serving.Route"
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/serving.Route",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "serving.UnityCatalogTableNames": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "annotations_table": {
+                      "description": "[Public Preview] The full three-level Unity Catalog name (catalog.schema.table) of the table that receives\nexported annotations.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "logs_table": {
+                      "description": "[Public Preview] The full three-level Unity Catalog name (catalog.schema.table) of the table that receives\nexported logs.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "metrics_table": {
+                      "description": "[Public Preview] The full three-level Unity Catalog name (catalog.schema.table) of the table that receives\nexported metrics.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
+                    },
+                    "traces_table": {
+                      "description": "[Public Preview] The full three-level Unity Catalog name (catalog.schema.table) of the table that receives\nexported traces (spans).",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PUBLIC_PREVIEW"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -10645,7 +19001,7 @@
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -10663,7 +19019,7 @@
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -10678,7 +19034,43 @@
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "sql.AlertStatementParameter": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "description": "A named parameter bound to the alert query. Only flat, named scalar parameters are\nsupported; complex types such as ARRAY, MAP, and STRUCT are not.",
+                  "properties": {
+                    "name": {
+                      "description": "[Private Preview] The name of the parameter. Reference it in the query text as `:name`. Required, must be\nnon-empty, and must be unique across the alert's parameters.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "type": {
+                      "description": "[Private Preview] The SQL data type of the parameter, for example `STRING`, `INT`, or `DECIMAL(10, 2)`. If no type is given\nthe type is assumed to be `STRING`. Complex types such as `ARRAY`, `MAP`, and `STRUCT` are not supported.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    },
+                    "value": {
+                      "description": "[Private Preview] The value bound to the parameter, represented as a string. If omitted, the value is interpreted as NULL.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "PRIVATE_PREVIEW",
+                      "doNotSuggest": true
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "name"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -10689,23 +19081,28 @@
                   "properties": {
                     "comparison_operator": {
                       "description": "Operator used for comparison in alert evaluation.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.ComparisonOperator"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.ComparisonOperator",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "empty_result_state": {
                       "description": "Alert state if result is empty. Please avoid setting this field to be `UNKNOWN` because `UNKNOWN` state is planned to be deprecated.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.AlertEvaluationState"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.AlertEvaluationState",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "notification": {
                       "description": "User or Notification Destination to notify when alert is triggered.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.AlertV2Notification"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.AlertV2Notification",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "source": {
                       "description": "Source column from result to use to evaluate alert",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.AlertV2OperandColumn"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.AlertV2OperandColumn",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "threshold": {
                       "description": "Threshold to user for alert evaluation, can be a column or a value.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.AlertV2Operand"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.AlertV2Operand",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false,
@@ -10716,7 +19113,7 @@
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -10727,21 +19124,24 @@
                   "properties": {
                     "notify_on_ok": {
                       "description": "Whether to notify alert subscribers when alert returns back to normal.",
-                      "$ref": "#/$defs/bool"
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "retrigger_seconds": {
                       "description": "Number of seconds an alert waits after being triggered before it is allowed to send another notification.\nIf set to 0 or omitted, the alert will not send any further notifications after the first trigger\nSetting this value to 1 allows the alert to send a notification on every evaluation where the condition is met, effectively making it always retrigger for notification purposes.",
-                      "$ref": "#/$defs/int"
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "subscriptions": {
-                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/sql.AlertV2Subscription"
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/sql.AlertV2Subscription",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -10751,17 +19151,19 @@
                   "type": "object",
                   "properties": {
                     "column": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.AlertV2OperandColumn"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.AlertV2OperandColumn",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "value": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.AlertV2OperandValue"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.AlertV2OperandValue",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -10771,13 +19173,17 @@
                   "type": "object",
                   "properties": {
                     "aggregation": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.Aggregation"
+                      "description": "If not set, the behavior is equivalent to using `First row` in the UI.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.Aggregation",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "display": {
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "name": {
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false,
@@ -10787,7 +19193,7 @@
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -10797,20 +19203,23 @@
                   "type": "object",
                   "properties": {
                     "bool_value": {
-                      "$ref": "#/$defs/bool"
+                      "$ref": "#/$defs/bool",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "double_value": {
-                      "$ref": "#/$defs/float64"
+                      "$ref": "#/$defs/float64",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "string_value": {
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -10821,18 +19230,20 @@
                   "properties": {
                     "service_principal_name": {
                       "description": "Application ID of an active service principal. Setting this field requires the `servicePrincipal/user` role.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "user_name": {
                       "description": "The email of an active workspace user. Can only set this field to their own email.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -10842,17 +19253,19 @@
                   "type": "object",
                   "properties": {
                     "destination_id": {
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "user_email": {
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -10860,208 +19273,453 @@
               "oneOf": [
                 {
                   "type": "object",
-                  "description": "Configures the channel name and DBSQL version of the warehouse. CHANNEL_NAME_CUSTOM should be chosen only when `dbsql_version` is specified.",
+                  "description": "Configures the channel name and DBSQL version of the warehouse. CHANNEL_NAME_CUSTOM should be chosen only when `dbsql_version` is specified.",
+                  "properties": {
+                    "dbsql_version": {
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "name": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.ChannelName",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "sql.ChannelName": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "enum": [
+                    "CHANNEL_NAME_PREVIEW",
+                    "CHANNEL_NAME_CURRENT",
+                    "CHANNEL_NAME_PREVIOUS",
+                    "CHANNEL_NAME_CUSTOM"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "sql.ComparisonOperator": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "enum": [
+                    "LESS_THAN",
+                    "GREATER_THAN",
+                    "EQUAL",
+                    "NOT_EQUAL",
+                    "GREATER_THAN_OR_EQUAL",
+                    "LESS_THAN_OR_EQUAL",
+                    "IS_NULL",
+                    "IS_NOT_NULL"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "sql.CreateWarehouseRequestWarehouseType": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "enum": [
+                    "TYPE_UNSPECIFIED",
+                    "CLASSIC",
+                    "PRO",
+                    "REALTIME"
+                  ],
+                  "enumDescriptions": [
+                    "",
+                    "",
+                    "",
+                    "[Private Preview]"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "sql.CronSchedule": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "pause_status": {
+                      "description": "Indicate whether this schedule is paused or not.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.SchedulePauseStatus",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "quartz_cron_schedule": {
+                      "description": "A cron expression using quartz syntax that specifies the schedule for this pipeline.\nShould use the quartz format described here: http://www.quartz-scheduler.org/documentation/quartz-2.1.7/tutorials/tutorial-lesson-06.html",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "timezone_id": {
+                      "description": "A Java timezone id. The schedule will be resolved using this timezone.\nThis will be combined with the quartz_cron_schedule to determine the schedule.\nSee https://docs.databricks.com/sql/language-manual/sql-ref-syntax-aux-conf-mgmt-set-timezone.html for details.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false,
+                  "required": [
+                    "quartz_cron_schedule",
+                    "timezone_id"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "sql.CustomTemplateFormat": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "description": "Rendering format for the `custom_summary` and `custom_description` templates.",
+                  "enum": [
+                    "HTML",
+                    "MARKDOWN"
+                  ],
+                  "enumDescriptions": [
+                    "[Private Preview]",
+                    "[Private Preview]"
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "sql.EndpointTagPair": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "key": {
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "value": {
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "sql.EndpointTags": {
+              "oneOf": [
+                {
+                  "type": "object",
                   "properties": {
-                    "dbsql_version": {
-                      "$ref": "#/$defs/string"
-                    },
-                    "name": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.ChannelName"
+                    "custom_tags": {
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/sql.EndpointTagPair",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "sql.ChannelName": {
+            "sql.SchedulePauseStatus": {
               "oneOf": [
                 {
                   "type": "string",
                   "enum": [
-                    "CHANNEL_NAME_PREVIEW",
-                    "CHANNEL_NAME_CURRENT",
-                    "CHANNEL_NAME_PREVIOUS",
-                    "CHANNEL_NAME_CUSTOM"
+                    "UNPAUSED",
+                    "PAUSED"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "sql.ComparisonOperator": {
+            "sql.SpotInstancePolicy": {
               "oneOf": [
                 {
                   "type": "string",
+                  "description": "EndpointSpotInstancePolicy configures whether the endpoint should use spot\ninstances.\n\nThe breakdown of how the EndpointSpotInstancePolicy converts to per cloud\nconfigurations is:\n\n- AWS, COST_OPTIMIZED: On Demand Driver with Spot Executors.\n- AWS, RELIABILITY_OPTIMIZED: On Demand Driver and Executors.\n- AZURE, COST_OPTIMIZED: On Demand Driver and Executors.\n- AZURE, RELIABILITY_OPTIMIZED: On Demand Driver and Executors.",
                   "enum": [
-                    "LESS_THAN",
-                    "GREATER_THAN",
-                    "EQUAL",
-                    "NOT_EQUAL",
-                    "GREATER_THAN_OR_EQUAL",
-                    "LESS_THAN_OR_EQUAL",
-                    "IS_NULL",
-                    "IS_NOT_NULL"
+                    "POLICY_UNSPECIFIED",
+                    "COST_OPTIMIZED",
+                    "RELIABILITY_OPTIMIZED"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "sql.CreateWarehouseRequestWarehouseType": {
+            "sql.WarehousePermissionLevel": {
               "oneOf": [
                 {
                   "type": "string",
+                  "description": "Permission level",
                   "enum": [
-                    "TYPE_UNSPECIFIED",
-                    "CLASSIC",
-                    "PRO"
+                    "CAN_MANAGE",
+                    "IS_OWNER",
+                    "CAN_USE",
+                    "CAN_MONITOR",
+                    "CAN_VIEW"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "sql.CronSchedule": {
+            "vectorsearch.DeltaSyncVectorIndexSpecRequest": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "pause_status": {
-                      "description": "Indicate whether this schedule is paused or not.",
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.SchedulePauseStatus"
+                    "columns_to_index": {
+                      "description": "[Optional] Alias for columns_to_sync. Select the columns to include in the vector index.\nIf you leave this field blank, all columns from the source table are included.\nThe primary key column and embedding source column or embedding vector column are always included.\nOnly one of columns_to_sync or columns_to_index may be specified.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "quartz_cron_schedule": {
-                      "description": "A cron expression using quartz syntax that specifies the schedule for this pipeline.\nShould use the quartz format described here: http://www.quartz-scheduler.org/documentation/quartz-2.1.7/tutorials/tutorial-lesson-06.html",
-                      "$ref": "#/$defs/string"
+                    "columns_to_sync": {
+                      "description": "[Optional] Select the columns to sync with the vector index. If you leave this field blank, all columns\nfrom the source table are synced with the index. The primary key column and embedding source column or\nembedding vector column are always synced.",
+                      "$ref": "#/$defs/slice/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "timezone_id": {
-                      "description": "A Java timezone id. The schedule will be resolved using this timezone.\nThis will be combined with the quartz_cron_schedule to determine the schedule.\nSee https://docs.databricks.com/sql/language-manual/sql-ref-syntax-aux-conf-mgmt-set-timezone.html for details.",
-                      "$ref": "#/$defs/string"
+                    "embedding_source_columns": {
+                      "description": "The columns that contain the embedding source.",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/vectorsearch.EmbeddingSourceColumn",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "embedding_vector_columns": {
+                      "description": "The columns that contain the embedding vectors.",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/vectorsearch.EmbeddingVectorColumn",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "embedding_writeback_table": {
+                      "description": "[Optional] Name of the Delta table to sync the vector index contents and computed embeddings to.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "pipeline_type": {
+                      "description": "Pipeline execution mode.\n- `TRIGGERED`: If the pipeline uses the triggered execution mode, the system stops processing after successfully refreshing the source table in the pipeline once, ensuring the table is updated based on the data available when the update started.\n- `CONTINUOUS`: If the pipeline uses continuous execution, the pipeline processes new data as it arrives in the source table to keep vector index fresh.",
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/vectorsearch.PipelineType",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "source_table": {
+                      "description": "The name of the source table.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
-                  "additionalProperties": false,
-                  "required": [
-                    "quartz_cron_schedule",
-                    "timezone_id"
-                  ]
+                  "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "sql.EndpointTagPair": {
+            "vectorsearch.DirectAccessVectorIndexSpec": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "key": {
-                      "$ref": "#/$defs/string"
+                    "embedding_source_columns": {
+                      "description": "The columns that contain the embedding source. The format should be array[double].",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/vectorsearch.EmbeddingSourceColumn",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "embedding_vector_columns": {
+                      "description": "The columns that contain the embedding vectors. The format should be array[double].",
+                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/vectorsearch.EmbeddingVectorColumn",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "schema_json": {
+                      "description": "The schema of the index in JSON format.\nSupported types are `integer`, `long`, `float`, `double`, `boolean`, `string`, `date`, `timestamp`.\nSupported types for vector column: `array\u003cfloat\u003e`, `array\u003cdouble\u003e`,`.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    }
+                  },
+                  "additionalProperties": false
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "vectorsearch.EmbeddingSourceColumn": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "embedding_model_endpoint_name": {
+                      "description": "Name of the embedding model endpoint, used by default for both ingestion and querying.",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
-                    "value": {
-                      "$ref": "#/$defs/string"
+                    "model_endpoint_name_for_query": {
+                      "description": "Name of the embedding model endpoint which, if specified, is used for querying (not ingestion).",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "name": {
+                      "description": "Name of the column",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "sql.EndpointTags": {
+            "vectorsearch.EmbeddingVectorColumn": {
               "oneOf": [
                 {
                   "type": "object",
                   "properties": {
-                    "custom_tags": {
-                      "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/sql.EndpointTagPair"
+                    "embedding_dimension": {
+                      "description": "Dimension of the embedding vector",
+                      "$ref": "#/$defs/int",
+                      "x-databricks-launch-stage": "GA"
+                    },
+                    "name": {
+                      "description": "Name of the column",
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "sql.SchedulePauseStatus": {
+            "vectorsearch.EndpointType": {
               "oneOf": [
                 {
                   "type": "string",
+                  "description": "Type of endpoint.",
                   "enum": [
-                    "UNPAUSED",
-                    "PAUSED"
+                    "STORAGE_OPTIMIZED",
+                    "STANDARD"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "sql.SpotInstancePolicy": {
+            "vectorsearch.IndexSubtype": {
               "oneOf": [
                 {
                   "type": "string",
-                  "description": "EndpointSpotInstancePolicy configures whether the endpoint should use spot\ninstances.\n\nThe breakdown of how the EndpointSpotInstancePolicy converts to per cloud\nconfigurations is:\n\n+-------+--------------------------------------+--------------------------------+\n| Cloud |            COST_OPTIMIZED            |     RELIABILITY_OPTIMIZED |\n+-------+--------------------------------------+--------------------------------+\n| AWS   | On Demand Driver with Spot Executors | On Demand Driver and\nExecutors | | AZURE | On Demand Driver and Executors       | On Demand Driver\nand Executors |\n+-------+--------------------------------------+--------------------------------+\n\nWhile including \"spot\" in the enum name may limit the the future\nextensibility of this field because it limits this enum to denoting \"spot or\nnot\", this is the field that PM recommends after discussion with customers\nper SC-48783.",
+                  "description": "The subtype of the AI Search index, determining the indexing and retrieval strategy.\n- `VECTOR`: Not supported. Use `HYBRID` instead.\n- `FULL_TEXT`: An index that uses full-text search without vector embeddings.\n- `HYBRID`: An index that uses vector embeddings for similarity search and hybrid search.",
                   "enum": [
-                    "POLICY_UNSPECIFIED",
-                    "COST_OPTIMIZED",
-                    "RELIABILITY_OPTIMIZED"
+                    "VECTOR",
+                    "FULL_TEXT",
+                    "HYBRID"
+                  ],
+                  "enumDescriptions": [
+                    "[Beta] Not supported. Use `HYBRID` instead.",
+                    "[Beta] An index that uses full-text search without vector embeddings.",
+                    "[Beta] An index that uses vector embeddings for similarity search and hybrid search."
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "sql.WarehousePermissionLevel": {
+            "vectorsearch.PipelineType": {
               "oneOf": [
                 {
                   "type": "string",
-                  "description": "Permission level",
+                  "description": "Pipeline execution mode.\n- `TRIGGERED`: If the pipeline uses the triggered execution mode, the system stops processing after successfully refreshing the source table in the pipeline once, ensuring the table is updated based on the data available when the update started.\n- `CONTINUOUS`: If the pipeline uses continuous execution, the pipeline processes new data as it arrives in the source table to keep vector index fresh.",
                   "enum": [
-                    "CAN_MANAGE",
-                    "IS_OWNER",
-                    "CAN_USE",
-                    "CAN_MONITOR",
-                    "CAN_VIEW"
+                    "TRIGGERED",
+                    "CONTINUOUS"
+                  ],
+                  "enumDescriptions": [
+                    "If the pipeline uses the triggered execution mode, the system stops processing after successfully refreshing the source table in the pipeline once, ensuring the table is updated based on the data available when the update started.",
+                    "If the pipeline uses continuous execution, the pipeline processes new data as it arrives in the source table to keep vector index fresh."
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
-            "vectorsearch.EndpointType": {
+            "vectorsearch.VectorIndexType": {
               "oneOf": [
                 {
                   "type": "string",
-                  "description": "Type of endpoint.",
+                  "description": "There are 2 types of AI Search indexes:\n- `DELTA_SYNC`: An index that automatically syncs with a source Delta Table, automatically and incrementally updating the index as the underlying data in the Delta Table changes.\n- `DIRECT_ACCESS`: An index that supports direct read and write of vectors and metadata through our REST and SDK APIs. With this model, the user manages index updates.",
                   "enum": [
-                    "STORAGE_OPTIMIZED",
-                    "STANDARD"
+                    "DELTA_SYNC",
+                    "DIRECT_ACCESS"
+                  ],
+                  "enumDescriptions": [
+                    "An index that automatically syncs with a source Delta Table, automatically and incrementally updating the index as the underlying data in the Delta Table changes.",
+                    "An index that supports direct read and write of vectors and metadata through our REST and SDK APIs. With this model, the user manages index updates."
+                  ]
+                },
+                {
+                  "type": "string",
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                }
+              ]
+            },
+            "vectorsearch.VectorSearchEndpointPermissionLevel": {
+              "oneOf": [
+                {
+                  "type": "string",
+                  "description": "Permission level",
+                  "enum": [
+                    "CAN_CREATE",
+                    "CAN_MANAGE",
+                    "CAN_USE"
                   ]
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -11073,11 +19731,13 @@
                   "properties": {
                     "dns_name": {
                       "description": "The DNS of the KeyVault",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     },
                     "resource_id": {
                       "description": "The resource id of the azure KeyVault that user wants to associate the scope with.",
-                      "$ref": "#/$defs/string"
+                      "$ref": "#/$defs/string",
+                      "x-databricks-launch-stage": "GA"
                     }
                   },
                   "additionalProperties": false,
@@ -11088,7 +19748,7 @@
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             },
@@ -11104,7 +19764,7 @@
                 },
                 {
                   "type": "string",
-                  "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                  "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                 }
               ]
             }
@@ -11119,23 +19779,23 @@
         },
         {
           "type": "string",
-          "pattern": "\\$\\{(resources(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+          "pattern": "\\$\\{(resources(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
         },
         {
           "type": "string",
-          "pattern": "\\$\\{(bundle(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+          "pattern": "\\$\\{(bundle(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
         },
         {
           "type": "string",
-          "pattern": "\\$\\{(workspace(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+          "pattern": "\\$\\{(workspace(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
         },
         {
           "type": "string",
-          "pattern": "\\$\\{(artifacts(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+          "pattern": "\\$\\{(artifacts(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
         },
         {
           "type": "string",
-          "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+          "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
         }
       ]
     },
@@ -11146,23 +19806,23 @@
         },
         {
           "type": "string",
-          "pattern": "\\$\\{(resources(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+          "pattern": "\\$\\{(resources(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
         },
         {
           "type": "string",
-          "pattern": "\\$\\{(bundle(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+          "pattern": "\\$\\{(bundle(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
         },
         {
           "type": "string",
-          "pattern": "\\$\\{(workspace(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+          "pattern": "\\$\\{(workspace(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
         },
         {
           "type": "string",
-          "pattern": "\\$\\{(artifacts(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+          "pattern": "\\$\\{(artifacts(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
         },
         {
           "type": "string",
-          "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+          "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
         }
       ]
     },
@@ -11178,194 +19838,334 @@
                     {
                       "type": "object",
                       "additionalProperties": {
-                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Alert"
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Alert"
+                      }
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                    }
+                  ]
+                },
+                "resources.App": {
+                  "oneOf": [
+                    {
+                      "type": "object",
+                      "additionalProperties": {
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.App"
+                      }
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                    }
+                  ]
+                },
+                "resources.Catalog": {
+                  "oneOf": [
+                    {
+                      "type": "object",
+                      "additionalProperties": {
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Catalog"
+                      }
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                    }
+                  ]
+                },
+                "resources.Cluster": {
+                  "oneOf": [
+                    {
+                      "type": "object",
+                      "additionalProperties": {
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Cluster"
+                      }
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                    }
+                  ]
+                },
+                "resources.ClusterPolicy": {
+                  "oneOf": [
+                    {
+                      "type": "object",
+                      "additionalProperties": {
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.ClusterPolicy"
+                      }
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                    }
+                  ]
+                },
+                "resources.Dashboard": {
+                  "oneOf": [
+                    {
+                      "type": "object",
+                      "additionalProperties": {
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Dashboard"
+                      }
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                    }
+                  ]
+                },
+                "resources.DatabaseCatalog": {
+                  "oneOf": [
+                    {
+                      "type": "object",
+                      "additionalProperties": {
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.DatabaseCatalog"
+                      }
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                    }
+                  ]
+                },
+                "resources.DatabaseInstance": {
+                  "oneOf": [
+                    {
+                      "type": "object",
+                      "additionalProperties": {
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.DatabaseInstance"
+                      }
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                    }
+                  ]
+                },
+                "resources.ExternalLocation": {
+                  "oneOf": [
+                    {
+                      "type": "object",
+                      "additionalProperties": {
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.ExternalLocation"
+                      }
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                    }
+                  ]
+                },
+                "resources.Feature": {
+                  "oneOf": [
+                    {
+                      "type": "object",
+                      "additionalProperties": {
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Feature"
+                      }
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                    }
+                  ]
+                },
+                "resources.GenieSpace": {
+                  "oneOf": [
+                    {
+                      "type": "object",
+                      "additionalProperties": {
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.GenieSpace"
                       }
                     },
                     {
                       "type": "string",
-                      "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                     }
                   ]
                 },
-                "resources.App": {
+                "resources.InstancePool": {
                   "oneOf": [
                     {
                       "type": "object",
                       "additionalProperties": {
-                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.App"
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.InstancePool"
                       }
                     },
                     {
                       "type": "string",
-                      "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                     }
                   ]
                 },
-                "resources.Catalog": {
+                "resources.Job": {
                   "oneOf": [
                     {
                       "type": "object",
                       "additionalProperties": {
-                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Catalog"
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Job"
                       }
                     },
                     {
                       "type": "string",
-                      "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                     }
                   ]
                 },
-                "resources.Cluster": {
+                "resources.JobRun": {
                   "oneOf": [
                     {
                       "type": "object",
                       "additionalProperties": {
-                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Cluster"
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.JobRun"
                       }
                     },
                     {
                       "type": "string",
-                      "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                     }
                   ]
                 },
-                "resources.Dashboard": {
+                "resources.McpService": {
                   "oneOf": [
                     {
                       "type": "object",
                       "additionalProperties": {
-                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Dashboard"
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.McpService"
                       }
                     },
                     {
                       "type": "string",
-                      "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                     }
                   ]
                 },
-                "resources.DatabaseCatalog": {
+                "resources.MlflowExperiment": {
                   "oneOf": [
                     {
                       "type": "object",
                       "additionalProperties": {
-                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.DatabaseCatalog"
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.MlflowExperiment"
                       }
                     },
                     {
                       "type": "string",
-                      "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                     }
                   ]
                 },
-                "resources.DatabaseInstance": {
+                "resources.MlflowModel": {
                   "oneOf": [
                     {
                       "type": "object",
                       "additionalProperties": {
-                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.DatabaseInstance"
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.MlflowModel"
                       }
                     },
                     {
                       "type": "string",
-                      "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                     }
                   ]
                 },
-                "resources.ExternalLocation": {
+                "resources.ModelProviderService": {
                   "oneOf": [
                     {
                       "type": "object",
                       "additionalProperties": {
-                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.ExternalLocation"
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.ModelProviderService"
                       }
                     },
                     {
                       "type": "string",
-                      "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                     }
                   ]
                 },
-                "resources.Job": {
+                "resources.ModelService": {
                   "oneOf": [
                     {
                       "type": "object",
                       "additionalProperties": {
-                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Job"
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.ModelService"
                       }
                     },
                     {
                       "type": "string",
-                      "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                     }
                   ]
                 },
-                "resources.MlflowExperiment": {
+                "resources.ModelServingEndpoint": {
                   "oneOf": [
                     {
                       "type": "object",
                       "additionalProperties": {
-                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.MlflowExperiment"
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.ModelServingEndpoint"
                       }
                     },
                     {
                       "type": "string",
-                      "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                     }
                   ]
                 },
-                "resources.MlflowModel": {
+                "resources.Pipeline": {
                   "oneOf": [
                     {
                       "type": "object",
                       "additionalProperties": {
-                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.MlflowModel"
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Pipeline"
                       }
                     },
                     {
                       "type": "string",
-                      "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                     }
                   ]
                 },
-                "resources.ModelServingEndpoint": {
+                "resources.PostgresBranch": {
                   "oneOf": [
                     {
                       "type": "object",
                       "additionalProperties": {
-                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.ModelServingEndpoint"
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.PostgresBranch"
                       }
                     },
                     {
                       "type": "string",
-                      "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                     }
                   ]
                 },
-                "resources.Pipeline": {
+                "resources.PostgresCatalog": {
                   "oneOf": [
                     {
                       "type": "object",
                       "additionalProperties": {
-                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Pipeline"
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.PostgresCatalog"
                       }
                     },
                     {
                       "type": "string",
-                      "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                     }
                   ]
                 },
-                "resources.PostgresBranch": {
+                "resources.PostgresDatabase": {
                   "oneOf": [
                     {
                       "type": "object",
                       "additionalProperties": {
-                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.PostgresBranch"
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.PostgresDatabase"
                       }
                     },
                     {
                       "type": "string",
-                      "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                     }
                   ]
                 },
@@ -11379,7 +20179,7 @@
                     },
                     {
                       "type": "string",
-                      "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                     }
                   ]
                 },
@@ -11393,7 +20193,49 @@
                     },
                     {
                       "type": "string",
-                      "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                    }
+                  ]
+                },
+                "resources.PostgresRole": {
+                  "oneOf": [
+                    {
+                      "type": "object",
+                      "additionalProperties": {
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.PostgresRole"
+                      }
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                    }
+                  ]
+                },
+                "resources.PostgresSnapshotSchedule": {
+                  "oneOf": [
+                    {
+                      "type": "object",
+                      "additionalProperties": {
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.PostgresSnapshotSchedule"
+                      }
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                    }
+                  ]
+                },
+                "resources.PostgresSyncedTable": {
+                  "oneOf": [
+                    {
+                      "type": "object",
+                      "additionalProperties": {
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.PostgresSyncedTable"
+                      }
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                     }
                   ]
                 },
@@ -11407,7 +20249,7 @@
                     },
                     {
                       "type": "string",
-                      "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                     }
                   ]
                 },
@@ -11421,7 +20263,7 @@
                     },
                     {
                       "type": "string",
-                      "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                     }
                   ]
                 },
@@ -11435,7 +20277,21 @@
                     },
                     {
                       "type": "string",
-                      "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                    }
+                  ]
+                },
+                "resources.Secret": {
+                  "oneOf": [
+                    {
+                      "type": "object",
+                      "additionalProperties": {
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Secret"
+                      }
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                     }
                   ]
                 },
@@ -11449,7 +20305,7 @@
                     },
                     {
                       "type": "string",
-                      "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                     }
                   ]
                 },
@@ -11463,7 +20319,7 @@
                     },
                     {
                       "type": "string",
-                      "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                     }
                   ]
                 },
@@ -11477,7 +20333,7 @@
                     },
                     {
                       "type": "string",
-                      "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                     }
                   ]
                 },
@@ -11491,7 +20347,21 @@
                     },
                     {
                       "type": "string",
-                      "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                    }
+                  ]
+                },
+                "resources.VectorSearchIndex": {
+                  "oneOf": [
+                    {
+                      "type": "object",
+                      "additionalProperties": {
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.VectorSearchIndex"
+                      }
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                     }
                   ]
                 },
@@ -11505,7 +20375,7 @@
                     },
                     {
                       "type": "string",
-                      "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                     }
                   ]
                 },
@@ -11519,7 +20389,7 @@
                     },
                     {
                       "type": "string",
-                      "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                     }
                   ]
                 },
@@ -11533,7 +20403,7 @@
                     },
                     {
                       "type": "string",
-                      "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                     }
                   ]
                 }
@@ -11548,7 +20418,7 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
@@ -11562,7 +20432,7 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
@@ -11576,7 +20446,7 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
@@ -11590,7 +20460,7 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               }
@@ -11608,7 +20478,7 @@
           },
           {
             "type": "string",
-            "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+            "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
           }
         ]
       }
@@ -11629,7 +20499,7 @@
                     },
                     {
                       "type": "string",
-                      "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                     }
                   ]
                 },
@@ -11643,7 +20513,7 @@
                     },
                     {
                       "type": "string",
-                      "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                     }
                   ]
                 },
@@ -11657,7 +20527,35 @@
                     },
                     {
                       "type": "string",
-                      "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                    }
+                  ]
+                },
+                "resources.ClusterPolicyPermission": {
+                  "oneOf": [
+                    {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.ClusterPolicyPermission"
+                      }
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                    }
+                  ]
+                },
+                "resources.InstancePoolPermission": {
+                  "oneOf": [
+                    {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.InstancePoolPermission"
+                      }
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                     }
                   ]
                 },
@@ -11671,7 +20569,21 @@
                     },
                     {
                       "type": "string",
-                      "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                    }
+                  ]
+                },
+                "resources.JobRunTrigger": {
+                  "oneOf": [
+                    {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.JobRunTrigger"
+                      }
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                     }
                   ]
                 },
@@ -11685,7 +20597,7 @@
                     },
                     {
                       "type": "string",
-                      "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                     }
                   ]
                 },
@@ -11699,7 +20611,7 @@
                     },
                     {
                       "type": "string",
-                      "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                     }
                   ]
                 },
@@ -11713,7 +20625,7 @@
                     },
                     {
                       "type": "string",
-                      "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                     }
                   ]
                 },
@@ -11727,7 +20639,7 @@
                     },
                     {
                       "type": "string",
-                      "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                     }
                   ]
                 },
@@ -11741,7 +20653,7 @@
                     },
                     {
                       "type": "string",
-                      "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                     }
                   ]
                 },
@@ -11755,7 +20667,7 @@
                     },
                     {
                       "type": "string",
-                      "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                     }
                   ]
                 },
@@ -11769,278 +20681,418 @@
                     },
                     {
                       "type": "string",
-                      "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                    }
+                  ]
+                },
+                "resources.VectorSearchEndpointPermission": {
+                  "oneOf": [
+                    {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.VectorSearchEndpointPermission"
+                      }
+                    },
+                    {
+                      "type": "string",
+                      "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                     }
                   ]
                 }
               },
-              "config.ArtifactFile": {
+              "config.ArtifactFile": {
+                "oneOf": [
+                  {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/$defs/github.com/databricks/cli/bundle/config.ArtifactFile"
+                    }
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              }
+            }
+          },
+          "databricks-sdk-go": {
+            "service": {
+              "apps.AppResource": {
+                "oneOf": [
+                  {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResource"
+                    }
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "apps.EnvVar": {
+                "oneOf": [
+                  {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.EnvVar"
+                    }
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "apps.TelemetryExportDestination": {
+                "oneOf": [
+                  {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.TelemetryExportDestination"
+                    }
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "catalog.ModelProviderServiceConfigModelTargetConfig": {
+                "oneOf": [
+                  {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelProviderServiceConfigModelTargetConfig"
+                    }
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "catalog.ModelServiceConfigDestinationConfig": {
+                "oneOf": [
+                  {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.ModelServiceConfigDestinationConfig"
+                    }
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "catalog.MonitorMetric": {
+                "oneOf": [
+                  {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.MonitorMetric"
+                    }
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "catalog.Privilege": {
+                "oneOf": [
+                  {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.Privilege"
+                    }
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "catalog.PrivilegeAssignment": {
+                "oneOf": [
+                  {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.PrivilegeAssignment"
+                    }
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "catalog.RateLimit": {
                 "oneOf": [
                   {
                     "type": "array",
                     "items": {
-                      "$ref": "#/$defs/github.com/databricks/cli/bundle/config.ArtifactFile"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.RateLimit"
                     }
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
-              }
-            }
-          },
-          "databricks-sdk-go": {
-            "service": {
-              "apps.AppResource": {
+              },
+              "catalog.RegisteredModelAlias": {
                 "oneOf": [
                   {
                     "type": "array",
                     "items": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResource"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.RegisteredModelAlias"
                     }
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "apps.EnvVar": {
+              "compute.DockerImage": {
                 "oneOf": [
                   {
                     "type": "array",
                     "items": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.EnvVar"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.DockerImage"
                     }
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "apps.TelemetryExportDestination": {
+              "compute.InitScriptInfo": {
                 "oneOf": [
                   {
                     "type": "array",
                     "items": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.TelemetryExportDestination"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.InitScriptInfo"
                     }
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "catalog.MonitorMetric": {
+              "compute.Library": {
                 "oneOf": [
                   {
                     "type": "array",
                     "items": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.MonitorMetric"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.Library"
                     }
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "catalog.Privilege": {
+              "database.CustomTag": {
                 "oneOf": [
                   {
                     "type": "array",
                     "items": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.Privilege"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/database.CustomTag"
                     }
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "catalog.PrivilegeAssignment": {
+              "database.DatabaseInstanceRef": {
                 "oneOf": [
                   {
                     "type": "array",
                     "items": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.PrivilegeAssignment"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/database.DatabaseInstanceRef"
                     }
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "catalog.RegisteredModelAlias": {
+              "database.SyncedTableSpecTypeOverride": {
                 "oneOf": [
                   {
                     "type": "array",
                     "items": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.RegisteredModelAlias"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/database.SyncedTableSpecTypeOverride"
                     }
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "compute.InitScriptInfo": {
+              "jobs.AlertTaskSubscriber": {
                 "oneOf": [
                   {
                     "type": "array",
                     "items": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.InitScriptInfo"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.AlertTaskSubscriber"
                     }
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "compute.Library": {
+              "jobs.DeploymentSpec": {
                 "oneOf": [
                   {
                     "type": "array",
                     "items": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.Library"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.DeploymentSpec"
                     }
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "database.CustomTag": {
+              "jobs.JobCluster": {
                 "oneOf": [
                   {
                     "type": "array",
                     "items": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/database.CustomTag"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobCluster"
                     }
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "database.DatabaseInstanceRef": {
+              "jobs.JobEnvironment": {
                 "oneOf": [
                   {
                     "type": "array",
                     "items": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/database.DatabaseInstanceRef"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobEnvironment"
                     }
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "jobs.AlertTaskSubscriber": {
+              "jobs.JobEnvironmentVariables": {
                 "oneOf": [
                   {
                     "type": "array",
                     "items": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.AlertTaskSubscriber"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobEnvironmentVariables"
                     }
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "jobs.JobCluster": {
+              "jobs.JobParameterDefinition": {
                 "oneOf": [
                   {
                     "type": "array",
                     "items": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobCluster"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobParameterDefinition"
                     }
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "jobs.JobEnvironment": {
+              "jobs.JobsHealthRule": {
                 "oneOf": [
                   {
                     "type": "array",
                     "items": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobEnvironment"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobsHealthRule"
                     }
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "jobs.JobParameterDefinition": {
+              "jobs.PowerBiTable": {
                 "oneOf": [
                   {
                     "type": "array",
                     "items": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobParameterDefinition"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PowerBiTable"
                     }
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "jobs.JobsHealthRule": {
+              "jobs.PythonOperatorTaskParameter": {
                 "oneOf": [
                   {
                     "type": "array",
                     "items": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobsHealthRule"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PythonOperatorTaskParameter"
                     }
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "jobs.PowerBiTable": {
+              "jobs.SqlTaskSubscription": {
                 "oneOf": [
                   {
                     "type": "array",
                     "items": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PowerBiTable"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SqlTaskSubscription"
                     }
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
-              "jobs.SqlTaskSubscription": {
+              "jobs.SubscriptionAttachmentDataAttachmentWidget": {
                 "oneOf": [
                   {
                     "type": "array",
                     "items": {
-                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SqlTaskSubscription"
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SubscriptionAttachmentDataAttachmentWidget"
                     }
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
@@ -12054,7 +21106,7 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
@@ -12068,7 +21120,7 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
@@ -12082,7 +21134,21 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "jobs.TriggerConfiguration": {
+                "oneOf": [
+                  {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.TriggerConfiguration"
+                    }
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
@@ -12096,7 +21162,35 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "ml.ColumnIdentifier": {
+                "oneOf": [
+                  {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.ColumnIdentifier"
+                    }
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "ml.EntityColumn": {
+                "oneOf": [
+                  {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.EntityColumn"
+                    }
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
@@ -12110,7 +21204,63 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "ml.FeatureReference": {
+                "oneOf": [
+                  {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.FeatureReference"
+                    }
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "ml.FieldDefinition": {
+                "oneOf": [
+                  {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.FieldDefinition"
+                    }
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "ml.FunctionExtraParameter": {
+                "oneOf": [
+                  {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.FunctionExtraParameter"
+                    }
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "ml.InputBinding": {
+                "oneOf": [
+                  {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.InputBinding"
+                    }
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
@@ -12124,7 +21274,7 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
@@ -12138,7 +21288,7 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
@@ -12152,7 +21302,7 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
@@ -12166,7 +21316,7 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
@@ -12180,7 +21330,21 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "pipelines.LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsEntityGranularity": {
+                "oneOf": [
+                  {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsEntityGranularity"
+                    }
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
@@ -12194,7 +21358,7 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
@@ -12208,7 +21372,7 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
@@ -12222,7 +21386,7 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
@@ -12236,7 +21400,21 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "pipelines.Transformer": {
+                "oneOf": [
+                  {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.Transformer"
+                    }
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
@@ -12250,7 +21428,63 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "postgres.RoleMembershipRole": {
+                "oneOf": [
+                  {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/postgres.RoleMembershipRole"
+                    }
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "postgres.ScheduleCadence": {
+                "oneOf": [
+                  {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/postgres.ScheduleCadence"
+                    }
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "postgres.SyncedTableSyncedTableSpecExtraColumn": {
+                "oneOf": [
+                  {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/postgres.SyncedTableSyncedTableSpecExtraColumn"
+                    }
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "postgres.SyncedTableSyncedTableSpecTypeOverride": {
+                "oneOf": [
+                  {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/postgres.SyncedTableSyncedTableSpecTypeOverride"
+                    }
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
@@ -12264,7 +21498,7 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
@@ -12278,7 +21512,7 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
@@ -12292,7 +21526,7 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
@@ -12306,7 +21540,7 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
@@ -12320,7 +21554,7 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
@@ -12334,7 +21568,35 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "serving.TelemetryFeature": {
+                "oneOf": [
+                  {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.TelemetryFeature"
+                    }
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "sql.AlertStatementParameter": {
+                "oneOf": [
+                  {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.AlertStatementParameter"
+                    }
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
@@ -12348,7 +21610,7 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               },
@@ -12362,7 +21624,35 @@
                   },
                   {
                     "type": "string",
-                    "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "vectorsearch.EmbeddingSourceColumn": {
+                "oneOf": [
+                  {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/vectorsearch.EmbeddingSourceColumn"
+                    }
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
+                  }
+                ]
+              },
+              "vectorsearch.EmbeddingVectorColumn": {
+                "oneOf": [
+                  {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/vectorsearch.EmbeddingVectorColumn"
+                    }
+                  },
+                  {
+                    "type": "string",
+                    "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
                   }
                 ]
               }
@@ -12380,7 +21670,7 @@
           },
           {
             "type": "string",
-            "pattern": "\\$\\{(var(\\.[a-zA-Z]+([-_]?[a-zA-Z0-9]+)*(\\[[0-9]+\\])*)+)\\}"
+            "pattern": "\\$\\{(var(\\._*\\p{L}+([-_]*[\\p{L}\\p{N}]+)*(\\[[0-9]+\\])*)+)\\}"
           }
         ]
       }
diff --git a/bundle/schema/jsonschema_for_docs.json b/bundle/schema/jsonschema_for_docs.json
deleted file mode 100644
index 3c13ff8c134..00000000000
--- a/bundle/schema/jsonschema_for_docs.json
+++ /dev/null
@@ -1,9911 +0,0 @@
-{
-  "$defs": {
-    "bool": {
-      "type": "boolean"
-    },
-    "float64": {
-      "type": "number"
-    },
-    "github.com": {
-      "databricks": {
-        "cli": {
-          "bundle": {
-            "config": {
-              "engine.EngineType": {
-                "type": "string",
-                "enum": [
-                  "terraform",
-                  "direct"
-                ]
-              },
-              "resources.Alert": {
-                "type": "object",
-                "properties": {
-                  "custom_description": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.279.0"
-                  },
-                  "custom_summary": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.279.0"
-                  },
-                  "display_name": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.279.0"
-                  },
-                  "evaluation": {
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.AlertV2Evaluation",
-                    "x-since-version": "v0.279.0"
-                  },
-                  "file_path": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.282.0"
-                  },
-                  "lifecycle": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle",
-                    "x-since-version": "v0.279.0"
-                  },
-                  "parent_path": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.279.0"
-                  },
-                  "permissions": {
-                    "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.Permission",
-                    "x-since-version": "v0.279.0"
-                  },
-                  "query_text": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.279.0"
-                  },
-                  "run_as": {
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.AlertV2RunAs",
-                    "x-since-version": "v0.279.0"
-                  },
-                  "run_as_user_name": {
-                    "$ref": "#/$defs/string",
-                    "deprecationMessage": "This field is deprecated",
-                    "x-since-version": "v0.279.0",
-                    "deprecated": true
-                  },
-                  "schedule": {
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.CronSchedule",
-                    "x-since-version": "v0.279.0"
-                  },
-                  "warehouse_id": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.279.0"
-                  }
-                },
-                "additionalProperties": false,
-                "required": [
-                  "display_name",
-                  "evaluation",
-                  "query_text",
-                  "schedule",
-                  "warehouse_id"
-                ]
-              },
-              "resources.App": {
-                "type": "object",
-                "properties": {
-                  "budget_policy_id": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.243.0"
-                  },
-                  "compute_size": {
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.ComputeSize",
-                    "x-since-version": "v0.273.0"
-                  },
-                  "config": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.AppConfig",
-                    "x-since-version": "v0.239.0"
-                  },
-                  "description": {
-                    "description": "The description of the app.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.239.0"
-                  },
-                  "git_repository": {
-                    "description": "Git repository configuration for app deployments. When specified, deployments can\nreference code from this repository by providing only the git reference (branch, tag, or commit).",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.GitRepository",
-                    "x-databricks-preview": "PRIVATE",
-                    "doNotSuggest": true,
-                    "x-since-version": "v0.283.0"
-                  },
-                  "git_source": {
-                    "description": "Git source configuration for app deployments. Specifies which git reference (branch, tag, or commit)\nto use when deploying the app. Used in conjunction with git_repository to deploy code directly from git.\nThe source_code_path within git_source specifies the relative path to the app code within the repository.",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.GitSource",
-                    "x-since-version": "v0.290.0"
-                  },
-                  "lifecycle": {
-                    "description": "Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.",
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.LifecycleWithStarted",
-                    "x-since-version": "v0.268.0"
-                  },
-                  "name": {
-                    "description": "The name of the app. The name must contain only lowercase alphanumeric characters and hyphens.\nIt must be unique within the workspace.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.239.0"
-                  },
-                  "permissions": {
-                    "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.AppPermission",
-                    "x-since-version": "v0.239.0"
-                  },
-                  "resources": {
-                    "description": "Resources for the app.",
-                    "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/apps.AppResource",
-                    "x-since-version": "v0.239.0"
-                  },
-                  "source_code_path": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.239.0"
-                  },
-                  "space": {
-                    "description": "Name of the space this app belongs to.",
-                    "$ref": "#/$defs/string",
-                    "x-databricks-preview": "PRIVATE",
-                    "doNotSuggest": true,
-                    "x-since-version": "v0.290.0"
-                  },
-                  "telemetry_export_destinations": {
-                    "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/apps.TelemetryExportDestination",
-                    "x-since-version": "v0.294.0"
-                  },
-                  "usage_policy_id": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.283.0"
-                  },
-                  "user_api_scopes": {
-                    "$ref": "#/$defs/slice/string",
-                    "x-since-version": "v0.246.0"
-                  }
-                },
-                "additionalProperties": false,
-                "required": [
-                  "name"
-                ]
-              },
-              "resources.AppConfig": {
-                "type": "object",
-                "properties": {
-                  "command": {
-                    "$ref": "#/$defs/slice/string",
-                    "x-since-version": "v0.283.0"
-                  },
-                  "env": {
-                    "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.AppEnvVar",
-                    "x-since-version": "v0.283.0"
-                  }
-                },
-                "additionalProperties": false
-              },
-              "resources.AppEnvVar": {
-                "type": "object",
-                "properties": {
-                  "name": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.283.0"
-                  },
-                  "value": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.283.0"
-                  },
-                  "value_from": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.284.0"
-                  }
-                },
-                "additionalProperties": false,
-                "required": [
-                  "name"
-                ]
-              },
-              "resources.AppPermission": {
-                "type": "object",
-                "properties": {
-                  "group_name": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.247.0"
-                  },
-                  "level": {
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppPermissionLevel",
-                    "x-since-version": "v0.247.0"
-                  },
-                  "service_principal_name": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.247.0"
-                  },
-                  "user_name": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.247.0"
-                  }
-                },
-                "additionalProperties": false,
-                "required": [
-                  "level"
-                ]
-              },
-              "resources.Catalog": {
-                "type": "object",
-                "properties": {
-                  "comment": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.287.0"
-                  },
-                  "connection_name": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.287.0"
-                  },
-                  "grants": {
-                    "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/catalog.PrivilegeAssignment",
-                    "x-since-version": "v0.287.0"
-                  },
-                  "lifecycle": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle",
-                    "x-since-version": "v0.287.0"
-                  },
-                  "managed_encryption_settings": {
-                    "description": "Control CMK encryption for managed catalog data",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.EncryptionSettings",
-                    "x-databricks-preview": "PRIVATE",
-                    "doNotSuggest": true
-                  },
-                  "name": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.287.0"
-                  },
-                  "options": {
-                    "$ref": "#/$defs/map/string",
-                    "x-since-version": "v0.287.0"
-                  },
-                  "properties": {
-                    "$ref": "#/$defs/map/string",
-                    "x-since-version": "v0.287.0"
-                  },
-                  "provider_name": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.287.0"
-                  },
-                  "share_name": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.287.0"
-                  },
-                  "storage_root": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.287.0"
-                  }
-                },
-                "additionalProperties": false,
-                "required": [
-                  "name"
-                ]
-              },
-              "resources.Cluster": {
-                "type": "object",
-                "description": "Contains a snapshot of the latest user specified settings that were used to create/edit the cluster.",
-                "properties": {
-                  "apply_policy_default_values": {
-                    "description": "When set to true, fixed and default values from the policy will be used for fields that are omitted. When set to false, only fixed values from the policy will be applied.",
-                    "$ref": "#/$defs/bool",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "autoscale": {
-                    "description": "Parameters needed in order to automatically scale clusters up and down based on load.\nNote: autoscaling works best with DB runtime versions 3.0 or later.",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.AutoScale",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "autotermination_minutes": {
-                    "description": "Automatically terminates the cluster after it is inactive for this time in minutes. If not set,\nthis cluster will not be automatically terminated. If specified, the threshold must be between\n10 and 10000 minutes.\nUsers can also set this value to 0 to explicitly disable automatic termination.",
-                    "$ref": "#/$defs/int",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "aws_attributes": {
-                    "description": "Attributes related to clusters running on Amazon Web Services.\nIf not specified at cluster creation, a set of default values will be used.",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.AwsAttributes",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "azure_attributes": {
-                    "description": "Attributes related to clusters running on Microsoft Azure.\nIf not specified at cluster creation, a set of default values will be used.",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.AzureAttributes",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "cluster_log_conf": {
-                    "description": "The configuration for delivering spark logs to a long-term storage destination.\nThree kinds of destinations (DBFS, S3 and Unity Catalog volumes) are supported. Only one destination can be specified\nfor one cluster. If the conf is given, the logs will be delivered to the destination every\n`5 mins`. The destination of driver logs is `$destination/$clusterId/driver`, while\nthe destination of executor logs is `$destination/$clusterId/executor`.",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.ClusterLogConf",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "cluster_name": {
-                    "description": "Cluster name requested by the user. This doesn't have to be unique.\nIf not specified at creation, the cluster name will be an empty string.\nFor job clusters, the cluster name is automatically set based on the job and job run IDs.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "custom_tags": {
-                    "description": "Additional tags for cluster resources. Databricks will tag all cluster resources (e.g., AWS\ninstances and EBS volumes) with these tags in addition to `default_tags`. Notes:\n\n- Currently, Databricks allows at most 45 custom tags\n\n- Clusters can only reuse cloud resources if the resources' tags are a subset of the cluster tags",
-                    "$ref": "#/$defs/map/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "data_security_mode": {
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.DataSecurityMode",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "docker_image": {
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.DockerImage",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "driver_instance_pool_id": {
-                    "description": "The optional ID of the instance pool for the driver of the cluster belongs.\nThe pool cluster uses the instance pool with id (instance_pool_id) if the driver pool is not\nassigned.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "driver_node_type_flexibility": {
-                    "description": "Flexible node type configuration for the driver node.",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.NodeTypeFlexibility",
-                    "x-since-version": "v0.285.0"
-                  },
-                  "driver_node_type_id": {
-                    "description": "The node type of the Spark driver.\nNote that this field is optional; if unset, the driver node type will be set as the same value\nas `node_type_id` defined above.\n\nThis field, along with node_type_id, should not be set if virtual_cluster_size is set.\nIf both driver_node_type_id, node_type_id, and virtual_cluster_size are specified, driver_node_type_id and node_type_id take precedence.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "enable_elastic_disk": {
-                    "description": "Autoscaling Local Storage: when enabled, this cluster will dynamically acquire additional disk\nspace when its Spark workers are running low on disk space.",
-                    "$ref": "#/$defs/bool",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "enable_local_disk_encryption": {
-                    "description": "Whether to enable LUKS on cluster VMs' local disks",
-                    "$ref": "#/$defs/bool",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "gcp_attributes": {
-                    "description": "Attributes related to clusters running on Google Cloud Platform.\nIf not specified at cluster creation, a set of default values will be used.",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.GcpAttributes",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "init_scripts": {
-                    "description": "The configuration for storing init scripts. Any number of destinations can be specified.\nThe scripts are executed sequentially in the order provided.\nIf `cluster_log_conf` is specified, init script logs are sent to `\u003cdestination\u003e/\u003ccluster-ID\u003e/init_scripts`.",
-                    "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/compute.InitScriptInfo",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "instance_pool_id": {
-                    "description": "The optional ID of the instance pool to which the cluster belongs.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "is_single_node": {
-                    "description": "This field can only be used when `kind = CLASSIC_PREVIEW`.\n\nWhen set to true, Databricks will automatically set single node related `custom_tags`, `spark_conf`, and `num_workers`",
-                    "$ref": "#/$defs/bool",
-                    "x-since-version": "v0.237.0"
-                  },
-                  "kind": {
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.Kind",
-                    "x-since-version": "v0.237.0"
-                  },
-                  "lifecycle": {
-                    "description": "Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.",
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle",
-                    "x-since-version": "v0.268.0"
-                  },
-                  "node_type_id": {
-                    "description": "This field encodes, through a single value, the resources available to each of\nthe Spark nodes in this cluster. For example, the Spark nodes can be provisioned\nand optimized for memory or compute intensive workloads. A list of available node\ntypes can be retrieved by using the :method:clusters/listNodeTypes API call.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "num_workers": {
-                    "description": "Number of worker nodes that this cluster should have. A cluster has one Spark Driver\nand `num_workers` Executors for a total of `num_workers` + 1 Spark nodes.\n\nNote: When reading the properties of a cluster, this field reflects the desired number\nof workers rather than the actual current number of workers. For instance, if a cluster\nis resized from 5 to 10 workers, this field will immediately be updated to reflect\nthe target size of 10 workers, whereas the workers listed in `spark_info` will gradually\nincrease from 5 to 10 as the new nodes are provisioned.",
-                    "$ref": "#/$defs/int",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "permissions": {
-                    "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.ClusterPermission",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "policy_id": {
-                    "description": "The ID of the cluster policy used to create the cluster if applicable.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "remote_disk_throughput": {
-                    "description": "If set, what the configurable throughput (in Mb/s) for the remote disk is. Currently only supported for GCP HYPERDISK_BALANCED disks.",
-                    "$ref": "#/$defs/int",
-                    "x-since-version": "v0.257.0"
-                  },
-                  "runtime_engine": {
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.RuntimeEngine",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "single_user_name": {
-                    "description": "Single user name if data_security_mode is `SINGLE_USER`",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "spark_conf": {
-                    "description": "An object containing a set of optional, user-specified Spark configuration key-value pairs.\nUsers can also pass in a string of extra JVM options to the driver and the executors via\n`spark.driver.extraJavaOptions` and `spark.executor.extraJavaOptions` respectively.",
-                    "$ref": "#/$defs/map/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "spark_env_vars": {
-                    "description": "An object containing a set of optional, user-specified environment variable key-value pairs.\nPlease note that key-value pair of the form (X,Y) will be exported as is (i.e.,\n`export X='Y'`) while launching the driver and workers.\n\nIn order to specify an additional set of `SPARK_DAEMON_JAVA_OPTS`, we recommend appending\nthem to `$SPARK_DAEMON_JAVA_OPTS` as shown in the example below. This ensures that all\ndefault databricks managed environmental variables are included as well.\n\nExample Spark environment variables:\n`{\"SPARK_WORKER_MEMORY\": \"28000m\", \"SPARK_LOCAL_DIRS\": \"/local_disk0\"}` or\n`{\"SPARK_DAEMON_JAVA_OPTS\": \"$SPARK_DAEMON_JAVA_OPTS -Dspark.shuffle.service.enabled=true\"}`",
-                    "$ref": "#/$defs/map/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "spark_version": {
-                    "description": "The Spark version of the cluster, e.g. `3.3.x-scala2.11`.\nA list of available Spark versions can be retrieved by using\nthe :method:clusters/sparkVersions API call.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "ssh_public_keys": {
-                    "description": "SSH public key contents that will be added to each Spark node in this cluster. The\ncorresponding private keys can be used to login with the user name `ubuntu` on port `2200`.\nUp to 10 keys can be specified.",
-                    "$ref": "#/$defs/slice/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "total_initial_remote_disk_size": {
-                    "description": "If set, what the total initial volume size (in GB) of the remote disks should be. Currently only supported for GCP HYPERDISK_BALANCED disks.",
-                    "$ref": "#/$defs/int",
-                    "x-since-version": "v0.257.0"
-                  },
-                  "use_ml_runtime": {
-                    "description": "This field can only be used when `kind = CLASSIC_PREVIEW`.\n\n`effective_spark_version` is determined by `spark_version` (DBR release), this field `use_ml_runtime`, and whether `node_type_id` is gpu node or not.",
-                    "$ref": "#/$defs/bool",
-                    "x-since-version": "v0.237.0"
-                  },
-                  "worker_node_type_flexibility": {
-                    "description": "Flexible node type configuration for worker nodes.",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.NodeTypeFlexibility",
-                    "x-since-version": "v0.285.0"
-                  },
-                  "workload_type": {
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.WorkloadType",
-                    "x-since-version": "v0.229.0"
-                  }
-                },
-                "additionalProperties": false,
-                "markdownDescription": "The cluster resource defines an [all-purpose cluster](https://docs.databricks.com/api/workspace/clusters/create)."
-              },
-              "resources.ClusterPermission": {
-                "type": "object",
-                "properties": {
-                  "group_name": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.247.0"
-                  },
-                  "level": {
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.ClusterPermissionLevel",
-                    "x-since-version": "v0.247.0"
-                  },
-                  "service_principal_name": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.247.0"
-                  },
-                  "user_name": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.247.0"
-                  }
-                },
-                "additionalProperties": false,
-                "required": [
-                  "level"
-                ]
-              },
-              "resources.Dashboard": {
-                "type": "object",
-                "properties": {
-                  "create_time": {
-                    "description": "The timestamp of when the dashboard was created.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.234.0"
-                  },
-                  "dashboard_id": {
-                    "description": "UUID identifying the dashboard.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.234.0"
-                  },
-                  "dataset_catalog": {
-                    "description": "Sets the default catalog for all datasets in this dashboard. When set, this overrides the catalog specified in individual dataset definitions.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.281.0"
-                  },
-                  "dataset_schema": {
-                    "description": "Sets the default schema for all datasets in this dashboard. When set, this overrides the schema specified in individual dataset definitions.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.281.0"
-                  },
-                  "display_name": {
-                    "description": "The display name of the dashboard.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.232.0"
-                  },
-                  "embed_credentials": {
-                    "$ref": "#/$defs/bool",
-                    "x-since-version": "v0.232.0"
-                  },
-                  "etag": {
-                    "description": "The etag for the dashboard. Can be optionally provided on updates to ensure that the dashboard\nhas not been modified since the last read.\nThis field is excluded in List Dashboards responses.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.234.0"
-                  },
-                  "file_path": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.232.0"
-                  },
-                  "lifecycle": {
-                    "description": "Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.",
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle",
-                    "x-since-version": "v0.268.0"
-                  },
-                  "lifecycle_state": {
-                    "description": "The state of the dashboard resource. Used for tracking trashed status.",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/dashboards.LifecycleState",
-                    "x-since-version": "v0.234.0"
-                  },
-                  "parent_path": {
-                    "description": "The workspace path of the folder containing the dashboard. Includes leading slash and no\ntrailing slash.\nThis field is excluded in List Dashboards responses.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.232.0"
-                  },
-                  "path": {
-                    "description": "The workspace path of the dashboard asset, including the file name.\nExported dashboards always have the file extension `.lvdash.json`.\nThis field is excluded in List Dashboards responses.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.234.0"
-                  },
-                  "permissions": {
-                    "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.Permission",
-                    "x-since-version": "v0.232.0"
-                  },
-                  "serialized_dashboard": {
-                    "description": "The contents of the dashboard in serialized string form.\nThis field is excluded in List Dashboards responses.\nUse the [get dashboard API](https://docs.databricks.com/api/workspace/lakeview/get)\nto retrieve an example response, which includes the `serialized_dashboard` field.\nThis field provides the structure of the JSON string that represents the dashboard's\nlayout and components.",
-                    "$ref": "#/$defs/interface",
-                    "x-since-version": "v0.232.0"
-                  },
-                  "update_time": {
-                    "description": "The timestamp of when the dashboard was last updated by the user.\nThis field is excluded in List Dashboards responses.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.234.0"
-                  },
-                  "warehouse_id": {
-                    "description": "The warehouse ID used to run the dashboard.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.232.0"
-                  }
-                },
-                "additionalProperties": false,
-                "markdownDescription": "The dashboard resource allows you to manage [AI/BI dashboards](https://docs.databricks.com/api/workspace/lakeview/create) in a bundle. For information about AI/BI dashboards, see [link](https://docs.databricks.com/dashboards/index.html)."
-              },
-              "resources.DatabaseCatalog": {
-                "type": "object",
-                "properties": {
-                  "create_database_if_not_exists": {
-                    "$ref": "#/$defs/bool",
-                    "x-since-version": "v0.265.0"
-                  },
-                  "database_instance_name": {
-                    "description": "The name of the DatabaseInstance housing the database.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.265.0"
-                  },
-                  "database_name": {
-                    "description": "The name of the database (in a instance) associated with the catalog.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.265.0"
-                  },
-                  "lifecycle": {
-                    "description": "Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.",
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle",
-                    "x-since-version": "v0.268.0"
-                  },
-                  "name": {
-                    "description": "The name of the catalog in UC.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.265.0"
-                  }
-                },
-                "additionalProperties": false,
-                "required": [
-                  "database_instance_name",
-                  "database_name",
-                  "name"
-                ]
-              },
-              "resources.DatabaseInstance": {
-                "type": "object",
-                "description": "A DatabaseInstance represents a logical Postgres instance, comprised of both compute and storage.",
-                "properties": {
-                  "capacity": {
-                    "description": "The sku of the instance. Valid values are \"CU_1\", \"CU_2\", \"CU_4\", \"CU_8\".",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.265.0"
-                  },
-                  "custom_tags": {
-                    "description": "Custom tags associated with the instance. This field is only included on create and update responses.",
-                    "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/database.CustomTag",
-                    "x-since-version": "v0.273.0"
-                  },
-                  "enable_pg_native_login": {
-                    "description": "Whether to enable PG native password login on the instance. Defaults to false.",
-                    "$ref": "#/$defs/bool",
-                    "x-since-version": "v0.267.0"
-                  },
-                  "enable_readable_secondaries": {
-                    "description": "Whether to enable secondaries to serve read-only traffic. Defaults to false.",
-                    "$ref": "#/$defs/bool",
-                    "x-since-version": "v0.265.0"
-                  },
-                  "lifecycle": {
-                    "description": "Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.",
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle",
-                    "x-since-version": "v0.268.0"
-                  },
-                  "name": {
-                    "description": "The name of the instance. This is the unique identifier for the instance.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.265.0"
-                  },
-                  "node_count": {
-                    "description": "The number of nodes in the instance, composed of 1 primary and 0 or more secondaries. Defaults to\n1 primary and 0 secondaries. This field is input only, see effective_node_count for the output.",
-                    "$ref": "#/$defs/int",
-                    "x-since-version": "v0.265.0"
-                  },
-                  "parent_instance_ref": {
-                    "description": "The ref of the parent instance. This is only available if the instance is\nchild instance.\nInput: For specifying the parent instance to create a child instance. Optional.\nOutput: Only populated if provided as input to create a child instance.",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/database.DatabaseInstanceRef",
-                    "x-since-version": "v0.265.0"
-                  },
-                  "permissions": {
-                    "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.Permission",
-                    "x-since-version": "v0.265.0"
-                  },
-                  "retention_window_in_days": {
-                    "description": "The retention window for the instance. This is the time window in days\nfor which the historical data is retained. The default value is 7 days.\nValid values are 2 to 35 days.",
-                    "$ref": "#/$defs/int",
-                    "x-since-version": "v0.265.0"
-                  },
-                  "stopped": {
-                    "description": "Whether to stop the instance. An input only param, see effective_stopped for the output.",
-                    "$ref": "#/$defs/bool",
-                    "x-since-version": "v0.265.0"
-                  },
-                  "usage_policy_id": {
-                    "description": "The desired usage policy to associate with the instance.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.273.0"
-                  }
-                },
-                "additionalProperties": false,
-                "required": [
-                  "name"
-                ]
-              },
-              "resources.ExternalLocation": {
-                "type": "object",
-                "properties": {
-                  "comment": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.289.0"
-                  },
-                  "credential_name": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.289.0"
-                  },
-                  "enable_file_events": {
-                    "$ref": "#/$defs/bool",
-                    "x-since-version": "v0.289.0"
-                  },
-                  "encryption_details": {
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.EncryptionDetails",
-                    "x-since-version": "v0.289.0"
-                  },
-                  "fallback": {
-                    "$ref": "#/$defs/bool",
-                    "x-since-version": "v0.289.0"
-                  },
-                  "file_event_queue": {
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.FileEventQueue",
-                    "x-since-version": "v0.289.0"
-                  },
-                  "grants": {
-                    "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/catalog.PrivilegeAssignment",
-                    "x-since-version": "v0.289.0"
-                  },
-                  "lifecycle": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle",
-                    "x-since-version": "v0.289.0"
-                  },
-                  "name": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.289.0"
-                  },
-                  "read_only": {
-                    "$ref": "#/$defs/bool",
-                    "x-since-version": "v0.289.0"
-                  },
-                  "skip_validation": {
-                    "$ref": "#/$defs/bool",
-                    "x-since-version": "v0.289.0"
-                  },
-                  "url": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.289.0"
-                  }
-                },
-                "additionalProperties": false,
-                "required": [
-                  "credential_name",
-                  "name",
-                  "url"
-                ]
-              },
-              "resources.Job": {
-                "type": "object",
-                "properties": {
-                  "budget_policy_id": {
-                    "description": "The id of the user specified budget policy to use for this job.\nIf not specified, a default budget policy may be applied when creating or modifying the job.\nSee `effective_budget_policy_id` for the budget policy used by this workload.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.231.0"
-                  },
-                  "continuous": {
-                    "description": "An optional continuous property for this job. The continuous property will ensure that there is always one run executing. Only one of `schedule` and `continuous` can be used.",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.Continuous",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "description": {
-                    "description": "An optional description for the job. The maximum length is 27700 characters in UTF-8 encoding.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "email_notifications": {
-                    "description": "An optional set of email addresses that is notified when runs of this job begin or complete as well as when this job is deleted.",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobEmailNotifications",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "environments": {
-                    "description": "A list of task execution environment specifications that can be referenced by serverless tasks of this job.\nFor serverless notebook tasks, if the environment_key is not specified, the notebook environment will be used if present. If a jobs environment is specified, it will override the notebook environment.\nFor other serverless tasks, the task environment is required to be specified using environment_key in the task settings.",
-                    "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.JobEnvironment",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "git_source": {
-                    "description": "An optional specification for a remote Git repository containing the source code used by tasks. Version-controlled source code is supported by notebook, dbt, Python script, and SQL File tasks.\n\nIf `git_source` is set, these tasks retrieve the file from the remote repository by default. However, this behavior can be overridden by setting `source` to `WORKSPACE` on the task.\n\nNote: dbt and SQL File tasks support only version-controlled sources. If dbt or SQL File tasks are used, `git_source` must be defined on the job.",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.GitSource",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "health": {
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobsHealthRules",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "job_clusters": {
-                    "description": "A list of job cluster specifications that can be shared and reused by tasks of this job. Libraries cannot be declared in a shared job cluster. You must declare dependent libraries in task settings.",
-                    "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.JobCluster",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "lifecycle": {
-                    "description": "Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.",
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle",
-                    "x-since-version": "v0.268.0"
-                  },
-                  "max_concurrent_runs": {
-                    "description": "An optional maximum allowed number of concurrent runs of the job.\nSet this value if you want to be able to execute multiple runs of the same job concurrently.\nThis is useful for example if you trigger your job on a frequent schedule and want to allow consecutive runs to overlap with each other, or if you want to trigger multiple runs which differ by their input parameters.\nThis setting affects only new runs. For example, suppose the job’s concurrency is 4 and there are 4 concurrent active runs. Then setting the concurrency to 3 won’t kill any of the active runs.\nHowever, from then on, new runs are skipped unless there are fewer than 3 active runs.\nThis value cannot exceed 1000. Setting this value to `0` causes all new runs to be skipped.",
-                    "$ref": "#/$defs/int",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "name": {
-                    "description": "An optional name for the job. The maximum length is 4096 bytes in UTF-8 encoding.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "notification_settings": {
-                    "description": "Optional notification settings that are used when sending notifications to each of the `email_notifications` and `webhook_notifications` for this job.",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobNotificationSettings",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "parameters": {
-                    "description": "Job-level parameter definitions",
-                    "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.JobParameterDefinition",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "performance_target": {
-                    "description": "The performance mode on a serverless job. This field determines the level of compute performance or cost-efficiency for the run.\nThe performance target does not apply to tasks that run on Serverless GPU compute.\n\n* `STANDARD`: Enables cost-efficient execution of serverless workloads.\n* `PERFORMANCE_OPTIMIZED`: Prioritizes fast startup and execution times through rapid scaling and optimized cluster performance.",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PerformanceTarget",
-                    "x-since-version": "v0.241.0"
-                  },
-                  "permissions": {
-                    "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.JobPermission",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "queue": {
-                    "description": "The queue settings of the job.",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.QueueSettings",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "run_as": {
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobRunAs",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "schedule": {
-                    "description": "An optional periodic schedule for this job. The default behavior is that the job only runs when triggered by clicking “Run Now” in the Jobs UI or sending an API request to `runNow`.",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.CronSchedule",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "tags": {
-                    "description": "A map of tags associated with the job. These are forwarded to the cluster as cluster tags for jobs clusters, and are subject to the same limitations as cluster tags. A maximum of 25 tags can be added to the job.",
-                    "$ref": "#/$defs/map/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "tasks": {
-                    "description": "A list of task specifications to be executed by this job.\nIt supports up to 1000 elements in write endpoints (:method:jobs/create, :method:jobs/reset, :method:jobs/update, :method:jobs/submit).\nRead endpoints return only 100 tasks. If more than 100 tasks are available, you can paginate through them using :method:jobs/get. Use the `next_page_token` field at the object root to determine if more results are available.",
-                    "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.Task",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "timeout_seconds": {
-                    "description": "An optional timeout applied to each run of this job. A value of `0` means no timeout.",
-                    "$ref": "#/$defs/int",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "trigger": {
-                    "description": "A configuration to trigger a run when certain conditions are met. The default behavior is that the job runs only when triggered by clicking “Run Now” in the Jobs UI or sending an API request to `runNow`.",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.TriggerSettings",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "usage_policy_id": {
-                    "description": "The id of the user specified usage policy to use for this job.\nIf not specified, a default usage policy may be applied when creating or modifying the job.\nSee `effective_usage_policy_id` for the usage policy used by this workload.",
-                    "$ref": "#/$defs/string",
-                    "x-databricks-preview": "PRIVATE",
-                    "doNotSuggest": true,
-                    "x-since-version": "v0.265.0"
-                  },
-                  "webhook_notifications": {
-                    "description": "A collection of system notification IDs to notify when runs of this job begin or complete.",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.WebhookNotifications",
-                    "x-since-version": "v0.229.0"
-                  }
-                },
-                "additionalProperties": false,
-                "markdownDescription": "The job resource allows you to define [jobs and their corresponding tasks](https://docs.databricks.com/api/workspace/jobs/create) in your bundle. For information about jobs, see [link](https://docs.databricks.com/jobs/index.html). For a tutorial that uses a Declarative Automation Bundles template to create a job, see [link](https://docs.databricks.com/dev-tools/bundles/jobs-tutorial.html)."
-              },
-              "resources.JobPermission": {
-                "type": "object",
-                "properties": {
-                  "group_name": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.247.0"
-                  },
-                  "level": {
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobPermissionLevel",
-                    "x-since-version": "v0.247.0"
-                  },
-                  "service_principal_name": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.247.0"
-                  },
-                  "user_name": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.247.0"
-                  }
-                },
-                "additionalProperties": false,
-                "required": [
-                  "level"
-                ]
-              },
-              "resources.Lifecycle": {
-                "type": "object",
-                "properties": {
-                  "prevent_destroy": {
-                    "description": "Lifecycle setting to prevent the resource from being destroyed.",
-                    "$ref": "#/$defs/bool",
-                    "x-since-version": "v0.268.0"
-                  }
-                },
-                "additionalProperties": false
-              },
-              "resources.LifecycleWithStarted": {
-                "type": "object",
-                "properties": {
-                  "prevent_destroy": {
-                    "description": "Lifecycle setting to prevent the resource from being destroyed.",
-                    "$ref": "#/$defs/bool",
-                    "x-since-version": "v0.297.0"
-                  },
-                  "started": {
-                    "description": "Lifecycle setting to deploy the resource in started mode. Only supported for apps, clusters, and sql_warehouses in direct deployment mode.",
-                    "$ref": "#/$defs/bool",
-                    "x-since-version": "v0.297.0"
-                  }
-                },
-                "additionalProperties": false
-              },
-              "resources.MlflowExperiment": {
-                "type": "object",
-                "properties": {
-                  "artifact_location": {
-                    "description": "Location where all artifacts for the experiment are stored.\nIf not provided, the remote server will select an appropriate default.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "lifecycle": {
-                    "description": "Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.",
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle",
-                    "x-since-version": "v0.268.0"
-                  },
-                  "name": {
-                    "description": "Experiment name.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "permissions": {
-                    "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.MlflowExperimentPermission",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "tags": {
-                    "description": "A collection of tags to set on the experiment. Maximum tag size and number of tags per request\ndepends on the storage backend. All storage backends are guaranteed to support tag keys up\nto 250 bytes in size and tag values up to 5000 bytes in size. All storage backends are also\nguaranteed to support up to 20 tags per request.",
-                    "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/ml.ExperimentTag",
-                    "x-since-version": "v0.229.0"
-                  }
-                },
-                "additionalProperties": false,
-                "required": [
-                  "name"
-                ],
-                "markdownDescription": "The experiment resource allows you to define [MLflow experiments](https://docs.databricks.com/api/workspace/experiments/createexperiment) in a bundle. For information about MLflow experiments, see [link](https://docs.databricks.com/mlflow/experiments.html)."
-              },
-              "resources.MlflowExperimentPermission": {
-                "type": "object",
-                "properties": {
-                  "group_name": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.247.0"
-                  },
-                  "level": {
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.ExperimentPermissionLevel",
-                    "x-since-version": "v0.247.0"
-                  },
-                  "service_principal_name": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.247.0"
-                  },
-                  "user_name": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.247.0"
-                  }
-                },
-                "additionalProperties": false,
-                "required": [
-                  "level"
-                ]
-              },
-              "resources.MlflowModel": {
-                "type": "object",
-                "properties": {
-                  "description": {
-                    "description": "Optional description for registered model.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "lifecycle": {
-                    "description": "Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.",
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle",
-                    "x-since-version": "v0.268.0"
-                  },
-                  "name": {
-                    "description": "Register models under this name",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "permissions": {
-                    "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.MlflowModelPermission",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "tags": {
-                    "description": "Additional metadata for registered model.",
-                    "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/ml.ModelTag",
-                    "x-since-version": "v0.229.0"
-                  }
-                },
-                "additionalProperties": false,
-                "required": [
-                  "name"
-                ],
-                "markdownDescription": "The model resource allows you to define [legacy models](https://docs.databricks.com/api/workspace/modelregistry/createmodel) in bundles. Databricks recommends you use Unity Catalog [registered models](https://docs.databricks.com/dev-tools/bundles/reference.html#registered-model) instead."
-              },
-              "resources.MlflowModelPermission": {
-                "type": "object",
-                "properties": {
-                  "group_name": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.247.0"
-                  },
-                  "level": {
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.RegisteredModelPermissionLevel",
-                    "x-since-version": "v0.247.0"
-                  },
-                  "service_principal_name": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.247.0"
-                  },
-                  "user_name": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.247.0"
-                  }
-                },
-                "additionalProperties": false,
-                "required": [
-                  "level"
-                ]
-              },
-              "resources.ModelServingEndpoint": {
-                "type": "object",
-                "properties": {
-                  "ai_gateway": {
-                    "description": "The AI Gateway configuration for the serving endpoint. NOTE: External model, provisioned throughput, and pay-per-token endpoints are fully supported; agent endpoints currently only support inference tables.",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AiGatewayConfig",
-                    "x-since-version": "v0.230.0"
-                  },
-                  "budget_policy_id": {
-                    "description": "The budget policy to be applied to the serving endpoint.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.244.0"
-                  },
-                  "config": {
-                    "description": "The core config of the serving endpoint.",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.EndpointCoreConfigInput",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "description": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.260.0"
-                  },
-                  "email_notifications": {
-                    "description": "Email notification settings.",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.EmailNotifications",
-                    "x-since-version": "v0.264.0"
-                  },
-                  "lifecycle": {
-                    "description": "Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.",
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle",
-                    "x-since-version": "v0.268.0"
-                  },
-                  "name": {
-                    "description": "The name of the serving endpoint. This field is required and must be unique across a Databricks workspace.\nAn endpoint name can consist of alphanumeric characters, dashes, and underscores.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "permissions": {
-                    "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.ModelServingEndpointPermission",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "rate_limits": {
-                    "description": "Rate limits to be applied to the serving endpoint. NOTE: this field is deprecated, please use AI Gateway to manage rate limits.",
-                    "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/serving.RateLimit",
-                    "deprecationMessage": "This field is deprecated",
-                    "x-since-version": "v0.229.0",
-                    "deprecated": true
-                  },
-                  "route_optimized": {
-                    "description": "Enable route optimization for the serving endpoint.",
-                    "$ref": "#/$defs/bool",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "tags": {
-                    "description": "Tags to be attached to the serving endpoint and automatically propagated to billing logs.",
-                    "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/serving.EndpointTag",
-                    "x-since-version": "v0.229.0"
-                  }
-                },
-                "additionalProperties": false,
-                "required": [
-                  "name"
-                ],
-                "markdownDescription": "The model_serving_endpoint resource allows you to define [model serving endpoints](https://docs.databricks.com/api/workspace/servingendpoints/create). See [link](https://docs.databricks.com/machine-learning/model-serving/manage-serving-endpoints.html)."
-              },
-              "resources.ModelServingEndpointPermission": {
-                "type": "object",
-                "properties": {
-                  "group_name": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.247.0"
-                  },
-                  "level": {
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.ServingEndpointPermissionLevel",
-                    "x-since-version": "v0.247.0"
-                  },
-                  "service_principal_name": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.247.0"
-                  },
-                  "user_name": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.247.0"
-                  }
-                },
-                "additionalProperties": false,
-                "required": [
-                  "level"
-                ]
-              },
-              "resources.Permission": {
-                "type": "object",
-                "properties": {
-                  "group_name": {
-                    "description": "The name of the group that has the permission set in level.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "level": {
-                    "description": "The allowed permission for user, group, service principal defined for this permission.",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/iam.PermissionLevel",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "service_principal_name": {
-                    "description": "The name of the service principal that has the permission set in level.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "user_name": {
-                    "description": "The name of the user that has the permission set in level.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  }
-                },
-                "additionalProperties": false,
-                "required": [
-                  "level"
-                ]
-              },
-              "resources.Pipeline": {
-                "type": "object",
-                "properties": {
-                  "allow_duplicate_names": {
-                    "description": "If false, deployment will fail if name conflicts with that of another pipeline.",
-                    "$ref": "#/$defs/bool",
-                    "x-since-version": "v0.261.0"
-                  },
-                  "budget_policy_id": {
-                    "description": "Budget policy of this pipeline.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.230.0"
-                  },
-                  "catalog": {
-                    "description": "A catalog in Unity Catalog to publish data from this pipeline to. If `target` is specified, tables in this pipeline are published to a `target` schema inside `catalog` (for example, `catalog`.`target`.`table`). If `target` is not specified, no data is published to Unity Catalog.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "channel": {
-                    "description": "DLT Release Channel that specifies which version to use.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "clusters": {
-                    "description": "Cluster settings for this pipeline deployment.",
-                    "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/pipelines.PipelineCluster",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "configuration": {
-                    "description": "String-String configuration for this pipeline execution.",
-                    "$ref": "#/$defs/map/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "continuous": {
-                    "description": "Whether the pipeline is continuous or triggered. This replaces `trigger`.",
-                    "$ref": "#/$defs/bool",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "development": {
-                    "description": "Whether the pipeline is in Development mode. Defaults to false.",
-                    "$ref": "#/$defs/bool",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "edition": {
-                    "description": "Pipeline product edition.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "environment": {
-                    "description": "Environment specification for this pipeline used to install dependencies.",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.PipelinesEnvironment",
-                    "x-since-version": "v0.257.0"
-                  },
-                  "event_log": {
-                    "description": "Event log configuration for this pipeline",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.EventLogSpec",
-                    "x-since-version": "v0.246.0"
-                  },
-                  "filters": {
-                    "description": "Filters on which Pipeline packages to include in the deployed graph.",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.Filters",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "gateway_definition": {
-                    "description": "The definition of a gateway pipeline to support change data capture.",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.IngestionGatewayPipelineDefinition",
-                    "x-databricks-preview": "PRIVATE",
-                    "doNotSuggest": true,
-                    "x-since-version": "v0.229.0"
-                  },
-                  "id": {
-                    "description": "Unique identifier for this pipeline.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "ingestion_definition": {
-                    "description": "The configuration for a managed ingestion pipeline. These settings cannot be used with the 'libraries', 'schema', 'target', or 'catalog' settings.",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.IngestionPipelineDefinition",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "libraries": {
-                    "description": "Libraries or code needed by this deployment.",
-                    "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/pipelines.PipelineLibrary",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "lifecycle": {
-                    "description": "Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.",
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle",
-                    "x-since-version": "v0.268.0"
-                  },
-                  "name": {
-                    "description": "Friendly identifier for this pipeline.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "notifications": {
-                    "description": "List of notification settings for this pipeline.",
-                    "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/pipelines.Notifications",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "permissions": {
-                    "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.PipelinePermission",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "photon": {
-                    "description": "Whether Photon is enabled for this pipeline.",
-                    "$ref": "#/$defs/bool",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "restart_window": {
-                    "description": "Restart window of this pipeline.",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.RestartWindow",
-                    "x-databricks-preview": "PRIVATE",
-                    "doNotSuggest": true,
-                    "x-since-version": "v0.234.0"
-                  },
-                  "root_path": {
-                    "description": "Root path for this pipeline.\nThis is used as the root directory when editing the pipeline in the Databricks user interface and it is\nadded to sys.path when executing Python sources during pipeline execution.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.253.0"
-                  },
-                  "run_as": {
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.RunAs",
-                    "x-since-version": "v0.241.0"
-                  },
-                  "schema": {
-                    "description": "The default schema (database) where tables are read from or published to.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.230.0"
-                  },
-                  "serverless": {
-                    "description": "Whether serverless compute is enabled for this pipeline.",
-                    "$ref": "#/$defs/bool",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "storage": {
-                    "description": "DBFS root directory for storing checkpoints and tables.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "tags": {
-                    "description": "A map of tags associated with the pipeline.\nThese are forwarded to the cluster as cluster tags, and are therefore subject to the same limitations.\nA maximum of 25 tags can be added to the pipeline.",
-                    "$ref": "#/$defs/map/string",
-                    "x-since-version": "v0.256.0"
-                  },
-                  "target": {
-                    "description": "Target schema (database) to add tables in this pipeline to. Exactly one of `schema` or `target` must be specified. To publish to Unity Catalog, also specify `catalog`. This legacy field is deprecated for pipeline creation in favor of the `schema` field.",
-                    "$ref": "#/$defs/string",
-                    "deprecationMessage": "This field is deprecated",
-                    "x-since-version": "v0.229.0",
-                    "deprecated": true
-                  },
-                  "trigger": {
-                    "description": "Which pipeline trigger to use. Deprecated: Use `continuous` instead.",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.PipelineTrigger",
-                    "deprecationMessage": "Use continuous instead",
-                    "x-since-version": "v0.229.0",
-                    "deprecated": true
-                  },
-                  "usage_policy_id": {
-                    "description": "Usage policy of this pipeline.",
-                    "$ref": "#/$defs/string",
-                    "x-databricks-preview": "PRIVATE",
-                    "doNotSuggest": true,
-                    "x-since-version": "v0.276.0"
-                  }
-                },
-                "additionalProperties": false,
-                "markdownDescription": "This resource allows you to create [pipelines](https://docs.databricks.com/api/workspace/pipelines/create). For information about pipelines, see [link](https://docs.databricks.com/dlt/index.html). For a tutorial that uses the Declarative Automation Bundles template to create a pipeline, see [link](https://docs.databricks.com/dev-tools/bundles/pipelines-tutorial.html)."
-              },
-              "resources.PipelinePermission": {
-                "type": "object",
-                "properties": {
-                  "group_name": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.247.0"
-                  },
-                  "level": {
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.PipelinePermissionLevel",
-                    "x-since-version": "v0.247.0"
-                  },
-                  "service_principal_name": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.247.0"
-                  },
-                  "user_name": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.247.0"
-                  }
-                },
-                "additionalProperties": false,
-                "required": [
-                  "level"
-                ]
-              },
-              "resources.PostgresBranch": {
-                "type": "object",
-                "properties": {
-                  "branch_id": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.287.0"
-                  },
-                  "expire_time": {
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/common/types/time.Time",
-                    "x-since-version": "v0.287.0"
-                  },
-                  "is_protected": {
-                    "$ref": "#/$defs/bool",
-                    "x-since-version": "v0.287.0"
-                  },
-                  "lifecycle": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle",
-                    "x-since-version": "v0.287.0"
-                  },
-                  "no_expiry": {
-                    "$ref": "#/$defs/bool",
-                    "x-since-version": "v0.287.0"
-                  },
-                  "parent": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.287.0"
-                  },
-                  "source_branch": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.287.0"
-                  },
-                  "source_branch_lsn": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.287.0"
-                  },
-                  "source_branch_time": {
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/common/types/time.Time",
-                    "x-since-version": "v0.287.0"
-                  },
-                  "ttl": {
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/common/types/duration.Duration",
-                    "x-since-version": "v0.287.0"
-                  }
-                },
-                "additionalProperties": false,
-                "required": [
-                  "branch_id",
-                  "parent"
-                ]
-              },
-              "resources.PostgresEndpoint": {
-                "type": "object",
-                "properties": {
-                  "autoscaling_limit_max_cu": {
-                    "$ref": "#/$defs/float64",
-                    "x-since-version": "v0.287.0"
-                  },
-                  "autoscaling_limit_min_cu": {
-                    "$ref": "#/$defs/float64",
-                    "x-since-version": "v0.287.0"
-                  },
-                  "disabled": {
-                    "$ref": "#/$defs/bool",
-                    "x-since-version": "v0.287.0"
-                  },
-                  "endpoint_id": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.287.0"
-                  },
-                  "endpoint_type": {
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/postgres.EndpointType",
-                    "x-since-version": "v0.287.0"
-                  },
-                  "group": {
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/postgres.EndpointGroupSpec",
-                    "x-since-version": "v0.290.0"
-                  },
-                  "lifecycle": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle",
-                    "x-since-version": "v0.287.0"
-                  },
-                  "no_suspension": {
-                    "$ref": "#/$defs/bool",
-                    "x-since-version": "v0.287.0"
-                  },
-                  "parent": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.287.0"
-                  },
-                  "settings": {
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/postgres.EndpointSettings",
-                    "x-since-version": "v0.287.0"
-                  },
-                  "suspend_timeout_duration": {
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/common/types/duration.Duration",
-                    "x-since-version": "v0.287.0"
-                  }
-                },
-                "additionalProperties": false,
-                "required": [
-                  "endpoint_id",
-                  "parent",
-                  "endpoint_type"
-                ]
-              },
-              "resources.PostgresProject": {
-                "type": "object",
-                "properties": {
-                  "budget_policy_id": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.290.0"
-                  },
-                  "custom_tags": {
-                    "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/postgres.ProjectCustomTag",
-                    "x-since-version": "v0.290.0"
-                  },
-                  "default_branch": {
-                    "$ref": "#/$defs/string"
-                  },
-                  "default_endpoint_settings": {
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/postgres.ProjectDefaultEndpointSettings",
-                    "x-since-version": "v0.287.0"
-                  },
-                  "display_name": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.287.0"
-                  },
-                  "enable_pg_native_login": {
-                    "$ref": "#/$defs/bool",
-                    "x-since-version": "v0.294.0"
-                  },
-                  "history_retention_duration": {
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/common/types/duration.Duration",
-                    "x-since-version": "v0.287.0"
-                  },
-                  "lifecycle": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle",
-                    "x-since-version": "v0.287.0"
-                  },
-                  "permissions": {
-                    "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.Permission",
-                    "x-since-version": "v0.292.0"
-                  },
-                  "pg_version": {
-                    "$ref": "#/$defs/int",
-                    "x-since-version": "v0.287.0"
-                  },
-                  "project_id": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.287.0"
-                  }
-                },
-                "additionalProperties": false,
-                "required": [
-                  "project_id"
-                ]
-              },
-              "resources.QualityMonitor": {
-                "type": "object",
-                "properties": {
-                  "assets_dir": {
-                    "description": "[Create:REQ Update:IGN] Field for specifying the absolute path to a custom directory to store data-monitoring\nassets. Normally prepopulated to a default user location via UI and Python APIs.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "baseline_table_name": {
-                    "description": "[Create:OPT Update:OPT] Baseline table name.\nBaseline data is used to compute drift from the data in the monitored `table_name`.\nThe baseline table and the monitored table shall have the same schema.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "custom_metrics": {
-                    "description": "[Create:OPT Update:OPT] Custom metrics.",
-                    "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/catalog.MonitorMetric",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "data_classification_config": {
-                    "description": "[Create:OPT Update:OPT] Data classification related config.",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.MonitorDataClassificationConfig",
-                    "x-databricks-preview": "PRIVATE",
-                    "doNotSuggest": true,
-                    "x-since-version": "v0.229.0"
-                  },
-                  "inference_log": {
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.MonitorInferenceLog",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "latest_monitor_failure_msg": {
-                    "description": "[Create:ERR Update:IGN] The latest error message for a monitor failure.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.264.0"
-                  },
-                  "lifecycle": {
-                    "description": "Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.",
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle",
-                    "x-since-version": "v0.268.0"
-                  },
-                  "notifications": {
-                    "description": "[Create:OPT Update:OPT] Field for specifying notification settings.",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.MonitorNotifications",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "output_schema_name": {
-                    "description": "[Create:REQ Update:REQ] Schema where output tables are created. Needs to be in 2-level format {catalog}.{schema}",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "schedule": {
-                    "description": "[Create:OPT Update:OPT] The monitor schedule.",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.MonitorCronSchedule",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "skip_builtin_dashboard": {
-                    "description": "Whether to skip creating a default dashboard summarizing data quality metrics.",
-                    "$ref": "#/$defs/bool",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "slicing_exprs": {
-                    "description": "[Create:OPT Update:OPT] List of column expressions to slice data with for targeted analysis. The data is grouped by\neach expression independently, resulting in a separate slice for each predicate and its\ncomplements. For example `slicing_exprs=[“col_1”, “col_2 \u003e 10”]` will generate the following\nslices: two slices for `col_2 \u003e 10` (True and False), and one slice per unique value in\n`col1`. For high-cardinality columns, only the top 100 unique values by frequency will\ngenerate slices.",
-                    "$ref": "#/$defs/slice/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "snapshot": {
-                    "description": "Configuration for monitoring snapshot tables.",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.MonitorSnapshot",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "table_name": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.235.0"
-                  },
-                  "time_series": {
-                    "description": "Configuration for monitoring time series tables.",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.MonitorTimeSeries",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "warehouse_id": {
-                    "description": "Optional argument to specify the warehouse for dashboard creation. If not specified, the first running\nwarehouse will be used.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  }
-                },
-                "additionalProperties": false,
-                "required": [
-                  "table_name",
-                  "assets_dir",
-                  "output_schema_name"
-                ],
-                "markdownDescription": "The quality_monitor resource allows you to define a Unity Catalog [table monitor](https://docs.databricks.com/api/workspace/qualitymonitors/create). For information about monitors, see [link](https://docs.databricks.com/machine-learning/model-serving/monitor-diagnose-endpoints.html)."
-              },
-              "resources.RegisteredModel": {
-                "type": "object",
-                "properties": {
-                  "aliases": {
-                    "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/catalog.RegisteredModelAlias",
-                    "x-since-version": "v0.273.0"
-                  },
-                  "browse_only": {
-                    "$ref": "#/$defs/bool",
-                    "x-since-version": "v0.273.0"
-                  },
-                  "catalog_name": {
-                    "description": "The name of the catalog where the schema and the registered model reside",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "comment": {
-                    "description": "The comment attached to the registered model",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "created_at": {
-                    "$ref": "#/$defs/int64",
-                    "x-since-version": "v0.273.0"
-                  },
-                  "created_by": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.273.0"
-                  },
-                  "full_name": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.273.0"
-                  },
-                  "grants": {
-                    "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/catalog.PrivilegeAssignment",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "lifecycle": {
-                    "description": "Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.",
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle",
-                    "x-since-version": "v0.268.0"
-                  },
-                  "metastore_id": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.273.0"
-                  },
-                  "name": {
-                    "description": "The name of the registered model",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "owner": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.273.0"
-                  },
-                  "schema_name": {
-                    "description": "The name of the schema where the registered model resides",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "storage_location": {
-                    "description": "The storage location on the cloud under which model version data files are stored",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "updated_at": {
-                    "$ref": "#/$defs/int64",
-                    "x-since-version": "v0.273.0"
-                  },
-                  "updated_by": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.273.0"
-                  }
-                },
-                "additionalProperties": false,
-                "markdownDescription": "The registered model resource allows you to define models in Unity Catalog. For information about Unity Catalog [registered models](https://docs.databricks.com/api/workspace/registeredmodels/create), see [link](https://docs.databricks.com/machine-learning/manage-model-lifecycle/index.html)."
-              },
-              "resources.Schema": {
-                "type": "object",
-                "properties": {
-                  "catalog_name": {
-                    "description": "Name of parent catalog.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "comment": {
-                    "description": "User-provided free-form text description.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "grants": {
-                    "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/catalog.PrivilegeAssignment",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "lifecycle": {
-                    "description": "Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.",
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle",
-                    "x-since-version": "v0.268.0"
-                  },
-                  "name": {
-                    "description": "Name of schema, relative to parent catalog.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "properties": {
-                    "$ref": "#/$defs/map/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "storage_root": {
-                    "description": "Storage root URL for managed tables within schema.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  }
-                },
-                "additionalProperties": false,
-                "required": [
-                  "catalog_name",
-                  "name"
-                ],
-                "markdownDescription": "The schema resource type allows you to define Unity Catalog [schemas](https://docs.databricks.com/api/workspace/schemas/create) for tables and other assets in your jobs and pipelines created as part of a bundle. A schema, different from other resource types, has the following limitations:\n\n- The owner of a schema resource is always the deployment user, and cannot be changed. If `run_as` is specified in the bundle, it will be ignored by operations on the schema.\n- Only fields supported by the corresponding [Schemas object create API](https://docs.databricks.com/api/workspace/schemas/create) are available for the schema resource. For example, `enable_predictive_optimization` is not supported as it is only available on the [update API](https://docs.databricks.com/api/workspace/schemas/update)."
-              },
-              "resources.SecretScope": {
-                "type": "object",
-                "properties": {
-                  "backend_type": {
-                    "description": "The backend type the scope will be created with. If not specified, will default to `DATABRICKS`",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/workspace.ScopeBackendType",
-                    "x-since-version": "v0.252.0"
-                  },
-                  "keyvault_metadata": {
-                    "description": "The metadata for the secret scope if the `backend_type` is `AZURE_KEYVAULT`",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/workspace.AzureKeyVaultSecretScopeMetadata",
-                    "x-since-version": "v0.252.0"
-                  },
-                  "lifecycle": {
-                    "description": "Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.",
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle",
-                    "x-since-version": "v0.268.0"
-                  },
-                  "name": {
-                    "description": "Scope name requested by the user. Scope names are unique.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.252.0"
-                  },
-                  "permissions": {
-                    "description": "The permissions to apply to the secret scope. Permissions are managed via secret scope ACLs.",
-                    "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.SecretScopePermission",
-                    "x-since-version": "v0.252.0"
-                  }
-                },
-                "additionalProperties": false,
-                "required": [
-                  "name"
-                ]
-              },
-              "resources.SecretScopePermission": {
-                "type": "object",
-                "properties": {
-                  "group_name": {
-                    "description": "The name of the group that has the permission set in level. This field translates to a `principal` field in secret scope ACL.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.252.0"
-                  },
-                  "level": {
-                    "description": "The allowed permission for user, group, service principal defined for this permission.",
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.SecretScopePermissionLevel",
-                    "x-since-version": "v0.252.0"
-                  },
-                  "service_principal_name": {
-                    "description": "The application ID of an active service principal. This field translates to a `principal` field in secret scope ACL.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.252.0"
-                  },
-                  "user_name": {
-                    "description": "The name of the user that has the permission set in level. This field translates to a `principal` field in secret scope ACL.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.252.0"
-                  }
-                },
-                "additionalProperties": false,
-                "required": [
-                  "level"
-                ]
-              },
-              "resources.SecretScopePermissionLevel": {
-                "type": "string",
-                "enum": [
-                  "READ",
-                  "WRITE",
-                  "MANAGE"
-                ]
-              },
-              "resources.SqlWarehouse": {
-                "type": "object",
-                "description": "Creates a new SQL warehouse.",
-                "properties": {
-                  "auto_stop_mins": {
-                    "description": "The amount of time in minutes that a SQL warehouse must be idle (i.e., no\nRUNNING queries) before it is automatically stopped.\n\nSupported values:\n- Must be == 0 or \u003e= 10 mins\n- 0 indicates no autostop.\n\nDefaults to 120 mins",
-                    "$ref": "#/$defs/int",
-                    "x-since-version": "v0.260.0"
-                  },
-                  "channel": {
-                    "description": "Channel Details",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.Channel",
-                    "x-since-version": "v0.260.0"
-                  },
-                  "cluster_size": {
-                    "description": "Size of the clusters allocated for this warehouse.\nIncreasing the size of a spark cluster allows you to run larger queries on\nit. If you want to increase the number of concurrent queries, please tune\nmax_num_clusters.\n\nSupported values:\n- 2X-Small\n- X-Small\n- Small\n- Medium\n- Large\n- X-Large\n- 2X-Large\n- 3X-Large\n- 4X-Large\n- 5X-Large",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.260.0"
-                  },
-                  "creator_name": {
-                    "description": "warehouse creator name",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.260.0"
-                  },
-                  "enable_photon": {
-                    "description": "Configures whether the warehouse should use Photon optimized clusters.\n\nDefaults to true.",
-                    "$ref": "#/$defs/bool",
-                    "x-since-version": "v0.260.0"
-                  },
-                  "enable_serverless_compute": {
-                    "description": "Configures whether the warehouse should use serverless compute",
-                    "$ref": "#/$defs/bool",
-                    "x-since-version": "v0.260.0"
-                  },
-                  "instance_profile_arn": {
-                    "description": "Deprecated. Instance profile used to pass IAM role to the cluster",
-                    "$ref": "#/$defs/string",
-                    "deprecationMessage": "This field is deprecated",
-                    "x-since-version": "v0.260.0",
-                    "deprecated": true
-                  },
-                  "lifecycle": {
-                    "description": "Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.",
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle",
-                    "x-since-version": "v0.268.0"
-                  },
-                  "max_num_clusters": {
-                    "description": "Maximum number of clusters that the autoscaler will create to handle\nconcurrent queries.\n\nSupported values:\n- Must be \u003e= min_num_clusters\n- Must be \u003c= 40.\n\nDefaults to min_clusters if unset.",
-                    "$ref": "#/$defs/int",
-                    "x-since-version": "v0.260.0"
-                  },
-                  "min_num_clusters": {
-                    "description": "Minimum number of available clusters that will be maintained for this SQL\nwarehouse. Increasing this will ensure that a larger number of clusters are\nalways running and therefore may reduce the cold start time for new\nqueries. This is similar to reserved vs. revocable cores in a resource\nmanager.\n\nSupported values:\n- Must be \u003e 0\n- Must be \u003c= min(max_num_clusters, 30)\n\nDefaults to 1",
-                    "$ref": "#/$defs/int",
-                    "x-since-version": "v0.260.0"
-                  },
-                  "name": {
-                    "description": "Logical name for the cluster.\n\nSupported values:\n- Must be unique within an org.\n- Must be less than 100 characters.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.260.0"
-                  },
-                  "permissions": {
-                    "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.SqlWarehousePermission",
-                    "x-since-version": "v0.260.0"
-                  },
-                  "spot_instance_policy": {
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.SpotInstancePolicy",
-                    "x-since-version": "v0.260.0"
-                  },
-                  "tags": {
-                    "description": "A set of key-value pairs that will be tagged on all resources (e.g., AWS instances and EBS volumes) associated\nwith this SQL warehouse.\n\nSupported values:\n- Number of tags \u003c 45.",
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.EndpointTags",
-                    "x-since-version": "v0.260.0"
-                  },
-                  "warehouse_type": {
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.CreateWarehouseRequestWarehouseType",
-                    "x-since-version": "v0.260.0"
-                  }
-                },
-                "additionalProperties": false
-              },
-              "resources.SqlWarehousePermission": {
-                "type": "object",
-                "properties": {
-                  "group_name": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.260.0"
-                  },
-                  "level": {
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.WarehousePermissionLevel",
-                    "x-since-version": "v0.260.0"
-                  },
-                  "service_principal_name": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.260.0"
-                  },
-                  "user_name": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.260.0"
-                  }
-                },
-                "additionalProperties": false,
-                "required": [
-                  "level"
-                ]
-              },
-              "resources.SyncedDatabaseTable": {
-                "type": "object",
-                "properties": {
-                  "database_instance_name": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.266.0"
-                  },
-                  "lifecycle": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle",
-                    "x-since-version": "v0.268.0"
-                  },
-                  "logical_database_name": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.266.0"
-                  },
-                  "name": {
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.266.0"
-                  },
-                  "spec": {
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/database.SyncedTableSpec",
-                    "x-since-version": "v0.266.0"
-                  }
-                },
-                "additionalProperties": false,
-                "required": [
-                  "name"
-                ]
-              },
-              "resources.VectorSearchEndpoint": {
-                "type": "object",
-                "properties": {
-                  "budget_policy_id": {
-                    "$ref": "#/$defs/string"
-                  },
-                  "endpoint_type": {
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/vectorsearch.EndpointType"
-                  },
-                  "lifecycle": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle"
-                  },
-                  "min_qps": {
-                    "$ref": "#/$defs/int64"
-                  },
-                  "name": {
-                    "$ref": "#/$defs/string"
-                  },
-                  "permissions": {
-                    "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.Permission"
-                  },
-                  "usage_policy_id": {
-                    "$ref": "#/$defs/string",
-                    "x-databricks-preview": "PRIVATE",
-                    "doNotSuggest": true
-                  }
-                },
-                "additionalProperties": false,
-                "required": [
-                  "endpoint_type",
-                  "name"
-                ]
-              },
-              "resources.Volume": {
-                "type": "object",
-                "properties": {
-                  "catalog_name": {
-                    "description": "The name of the catalog where the schema and the volume are",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.236.0"
-                  },
-                  "comment": {
-                    "description": "The comment attached to the volume",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.236.0"
-                  },
-                  "grants": {
-                    "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/catalog.PrivilegeAssignment",
-                    "x-since-version": "v0.236.0"
-                  },
-                  "lifecycle": {
-                    "description": "Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.",
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Lifecycle",
-                    "x-since-version": "v0.268.0"
-                  },
-                  "name": {
-                    "description": "The name of the volume",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.236.0"
-                  },
-                  "schema_name": {
-                    "description": "The name of the schema where the volume is",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.236.0"
-                  },
-                  "storage_location": {
-                    "description": "The storage location on the cloud",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.236.0"
-                  },
-                  "volume_type": {
-                    "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.VolumeType",
-                    "x-since-version": "v0.236.0"
-                  }
-                },
-                "additionalProperties": false,
-                "required": [
-                  "catalog_name",
-                  "name",
-                  "schema_name"
-                ],
-                "markdownDescription": "The volume resource type allows you to define and create Unity Catalog [volumes](https://docs.databricks.com/api/workspace/volumes/create) as part of a bundle. When deploying a bundle with a volume defined, note that:\n\n- A volume cannot be referenced in the `artifact_path` for the bundle until it exists in the workspace. Hence, if you want to use Declarative Automation Bundles to create the volume, you must first define the volume in the bundle, deploy it to create the volume, then reference it in the `artifact_path` in subsequent deployments.\n\n- Volumes in the bundle are not prepended with the `dev_${workspace.current_user.short_name}` prefix when the deployment target has `mode: development` configured. However, you can manually configure this prefix. See [custom-presets](https://docs.databricks.com/dev-tools/bundles/deployment-modes.html#custom-presets)."
-              },
-              "variable.Lookup": {
-                "type": "object",
-                "properties": {
-                  "alert": {
-                    "description": "The name of the alert for which to retrieve an ID.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "cluster": {
-                    "description": "The name of the cluster for which to retrieve an ID.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "cluster_policy": {
-                    "description": "The name of the cluster_policy for which to retrieve an ID.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "dashboard": {
-                    "description": "The name of the dashboard for which to retrieve an ID.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "instance_pool": {
-                    "description": "The name of the instance_pool for which to retrieve an ID.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "job": {
-                    "description": "The name of the job for which to retrieve an ID.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "metastore": {
-                    "description": "The name of the metastore for which to retrieve an ID.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "notification_destination": {
-                    "description": "The name of the notification_destination for which to retrieve an ID.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.236.0"
-                  },
-                  "pipeline": {
-                    "description": "The name of the pipeline for which to retrieve an ID.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "query": {
-                    "description": "The name of the query for which to retrieve an ID.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "service_principal": {
-                    "description": "The name of the service_principal for which to retrieve an ID.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "warehouse": {
-                    "description": "The name of the warehouse for which to retrieve an ID.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  }
-                },
-                "additionalProperties": false
-              },
-              "variable.TargetVariable": {
-                "type": "object",
-                "properties": {
-                  "default": {
-                    "description": "The default value for the variable.",
-                    "$ref": "#/$defs/interface",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "description": {
-                    "description": "The description of the variable.",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "lookup": {
-                    "description": "The name of the alert, cluster_policy, cluster, dashboard, instance_pool, job, metastore, pipeline, query, service_principal, or warehouse object for which to retrieve an ID.",
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/variable.Lookup",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "type": {
-                    "description": "The type of the variable.",
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/variable.VariableType",
-                    "x-since-version": "v0.229.0"
-                  }
-                },
-                "additionalProperties": false
-              },
-              "variable.Variable": {
-                "type": "object",
-                "description": "Defines a custom variable for the bundle.",
-                "properties": {
-                  "default": {
-                    "description": "The default value for the variable.",
-                    "$ref": "#/$defs/interface",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "description": {
-                    "description": "The description of the variable",
-                    "$ref": "#/$defs/string",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "lookup": {
-                    "description": "The name of the alert, cluster_policy, cluster, dashboard, instance_pool, job, metastore, pipeline, query, service_principal, or warehouse object for which to retrieve an ID.",
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/variable.Lookup",
-                    "markdownDescription": "The name of the `alert`, `cluster_policy`, `cluster`, `dashboard`, `instance_pool`, `job`, `metastore`, `pipeline`, `query`, `service_principal`, or `warehouse` object for which to retrieve an ID.",
-                    "x-since-version": "v0.229.0"
-                  },
-                  "type": {
-                    "description": "The type of the variable.",
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/variable.VariableType",
-                    "x-since-version": "v0.229.0"
-                  }
-                },
-                "additionalProperties": false,
-                "markdownDescription": "Defines a custom variable for the bundle. See [variables](https://docs.databricks.com/dev-tools/bundles/settings.html#variables)."
-              },
-              "variable.VariableType": {
-                "type": "string"
-              }
-            },
-            "config.Artifact": {
-              "type": "object",
-              "properties": {
-                "build": {
-                  "description": "An optional set of build commands to run locally before deployment.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "dynamic_version": {
-                  "description": "Whether to patch the wheel version dynamically based on the timestamp of the whl file. If this is set to `true`, new code can be deployed without having to update the version in `setup.py` or `pyproject.toml`. This setting is only valid when `type` is set to `whl`. See [\\_](/dev-tools/bundles/settings.md#bundle-syntax-mappings-artifacts).",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.245.0"
-                },
-                "executable": {
-                  "description": "The executable type. Valid values are `bash`, `sh`, and `cmd`.",
-                  "$ref": "#/$defs/github.com/databricks/cli/libs/exec.ExecutableType",
-                  "x-since-version": "v0.229.0"
-                },
-                "files": {
-                  "description": "The relative or absolute path to the built artifact files.",
-                  "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config.ArtifactFile",
-                  "x-since-version": "v0.229.0"
-                },
-                "path": {
-                  "description": "The local path of the directory for the artifact.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "type": {
-                  "description": "Required if the artifact is a Python wheel. The type of the artifact. Valid values are `whl` and `jar`.",
-                  "$ref": "#/$defs/github.com/databricks/cli/bundle/config.ArtifactType",
-                  "markdownDescription": "Required if the artifact is a Python wheel. The type of the artifact. Valid values are `whl` and `jar`.",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "config.ArtifactFile": {
-              "type": "object",
-              "properties": {
-                "source": {
-                  "description": "Required. The artifact source file.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "source"
-              ]
-            },
-            "config.ArtifactType": {
-              "type": "string"
-            },
-            "config.Bundle": {
-              "type": "object",
-              "properties": {
-                "cluster_id": {
-                  "description": "The ID of a cluster to use to run the bundle.",
-                  "$ref": "#/$defs/string",
-                  "markdownDescription": "The ID of a cluster to use to run the bundle. See [cluster_id](https://docs.databricks.com/dev-tools/bundles/settings.html#cluster_id).",
-                  "x-since-version": "v0.229.0"
-                },
-                "compute_id": {
-                  "description": "Deprecated. The ID of the compute to use to run the bundle.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "databricks_cli_version": {
-                  "description": "The Databricks CLI version to use for the bundle.",
-                  "$ref": "#/$defs/string",
-                  "markdownDescription": "The Databricks CLI version to use for the bundle. See [databricks_cli_version](https://docs.databricks.com/dev-tools/bundles/settings.html#databricks_cli_version).",
-                  "x-since-version": "v0.229.0"
-                },
-                "deployment": {
-                  "description": "The definition of the bundle deployment",
-                  "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Deployment",
-                  "markdownDescription": "The definition of the bundle deployment. For supported attributes see [link](https://docs.databricks.com/dev-tools/bundles/deployment-modes.html).",
-                  "x-since-version": "v0.229.0"
-                },
-                "engine": {
-                  "description": "The deployment engine to use. Valid values are `terraform` and `direct`. Takes priority over `DATABRICKS_BUNDLE_ENGINE` environment variable. Default is \"terraform\".",
-                  "$ref": "#/$defs/github.com/databricks/cli/bundle/config/engine.EngineType",
-                  "x-since-version": "v0.295.0"
-                },
-                "git": {
-                  "description": "The Git version control details that are associated with your bundle.",
-                  "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Git",
-                  "markdownDescription": "The Git version control details that are associated with your bundle. For supported attributes see [git](https://docs.databricks.com/dev-tools/bundles/settings.html#git).",
-                  "x-since-version": "v0.229.0"
-                },
-                "name": {
-                  "description": "The name of the bundle.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "uuid": {
-                  "description": "Reserved. A Universally Unique Identifier (UUID) for the bundle that uniquely identifies the bundle in internal Databricks systems. This is generated when a bundle project is initialized using a Databricks template (using the `databricks bundle init` command).",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.236.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "name"
-              ]
-            },
-            "config.Command": {
-              "type": "string"
-            },
-            "config.Deployment": {
-              "type": "object",
-              "properties": {
-                "fail_on_active_runs": {
-                  "description": "Whether to fail on active runs. If this is set to true a deployment that is running can be interrupted.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.229.0"
-                },
-                "lock": {
-                  "description": "The deployment lock attributes.",
-                  "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Lock",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "config.Experimental": {
-              "type": "object",
-              "properties": {
-                "pydabs": {
-                  "description": "The PyDABs configuration.",
-                  "$ref": "#/$defs/github.com/databricks/cli/bundle/config.PyDABs",
-                  "deprecationMessage": "Deprecated: please use python instead",
-                  "x-since-version": "v0.229.0",
-                  "deprecated": true
-                },
-                "python": {
-                  "description": "Configures loading of Python code defined with 'databricks-bundles' package.",
-                  "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Python",
-                  "x-since-version": "v0.238.0"
-                },
-                "python_wheel_wrapper": {
-                  "description": "Whether to use a Python wheel wrapper.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.229.0"
-                },
-                "scripts": {
-                  "description": "The commands to run.",
-                  "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config.Command",
-                  "x-since-version": "v0.229.0"
-                },
-                "skip_artifact_cleanup": {
-                  "description": "Determines whether to skip cleaning up the .internal folder",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.254.0"
-                },
-                "skip_name_prefix_for_schema": {
-                  "description": "Skip adding the prefix that is either set in `presets.name_prefix` or computed when `mode: development`\nis set, to the names of UC schemas defined in the bundle.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.255.0"
-                },
-                "use_legacy_run_as": {
-                  "description": "Whether to use the legacy run_as behavior.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "config.Git": {
-              "type": "object",
-              "properties": {
-                "branch": {
-                  "description": "The Git branch name.",
-                  "$ref": "#/$defs/string",
-                  "markdownDescription": "The Git branch name. See [git](https://docs.databricks.com/dev-tools/bundles/settings.html#git).",
-                  "x-since-version": "v0.229.0"
-                },
-                "origin_url": {
-                  "description": "The origin URL of the repository.",
-                  "$ref": "#/$defs/string",
-                  "markdownDescription": "The origin URL of the repository. See [git](https://docs.databricks.com/dev-tools/bundles/settings.html#git).",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "config.Lock": {
-              "type": "object",
-              "properties": {
-                "enabled": {
-                  "description": "Whether this lock is enabled.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.229.0"
-                },
-                "force": {
-                  "description": "Whether to force this lock if it is enabled.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "config.Mode": {
-              "type": "string"
-            },
-            "config.Presets": {
-              "type": "object",
-              "properties": {
-                "artifacts_dynamic_version": {
-                  "description": "Whether to enable dynamic_version on all artifacts.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.256.0"
-                },
-                "jobs_max_concurrent_runs": {
-                  "description": "The maximum concurrent runs for a job.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.229.0"
-                },
-                "name_prefix": {
-                  "description": "The prefix for job runs of the bundle.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "pipelines_development": {
-                  "description": "Whether pipeline deployments should be locked in development mode.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.229.0"
-                },
-                "source_linked_deployment": {
-                  "description": "Whether to link the deployment to the bundle source.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.236.0"
-                },
-                "tags": {
-                  "description": "The tags for the bundle deployment.",
-                  "$ref": "#/$defs/map/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "trigger_pause_status": {
-                  "description": "A pause status to apply to all job triggers and schedules. Valid values are PAUSED or UNPAUSED.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "config.PyDABs": {
-              "type": "object",
-              "properties": {
-                "enabled": {
-                  "description": "Whether or not PyDABs (Private Preview) is enabled",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "config.Python": {
-              "type": "object",
-              "properties": {
-                "mutators": {
-                  "description": "Mutators contains a list of fully qualified function paths to mutator functions.\n\nExample: [\"my_project.mutators:add_default_cluster\"]",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.238.0"
-                },
-                "resources": {
-                  "description": "Resources contains a list of fully qualified function paths to load resources\ndefined in Python code.\n\nExample: [\"my_project.resources:load_resources\"]",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.238.0"
-                },
-                "venv_path": {
-                  "description": "VEnvPath is path to the virtual environment.\n\nIf enabled, Python code will execute within this environment. If disabled,\nit defaults to using the Python interpreter available in the current shell.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.238.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "config.Resources": {
-              "type": "object",
-              "properties": {
-                "alerts": {
-                  "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.Alert",
-                  "x-since-version": "v0.279.0"
-                },
-                "apps": {
-                  "description": "The app resource defines a Databricks app.",
-                  "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.App",
-                  "markdownDescription": "The app resource defines a [Databricks app](https://docs.databricks.com/api/workspace/apps/create). For information about Databricks Apps, see [link](https://docs.databricks.com/dev-tools/databricks-apps/index.html).",
-                  "x-since-version": "v0.239.0"
-                },
-                "catalogs": {
-                  "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.Catalog",
-                  "x-since-version": "v0.287.0"
-                },
-                "clusters": {
-                  "description": "The cluster definitions for the bundle, where each key is the name of a cluster.",
-                  "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.Cluster",
-                  "markdownDescription": "The cluster definitions for the bundle, where each key is the name of a cluster. See [clusters](https://docs.databricks.com/dev-tools/bundles/resources.html#clusters).",
-                  "x-since-version": "v0.229.0"
-                },
-                "dashboards": {
-                  "description": "The dashboard definitions for the bundle, where each key is the name of the dashboard.",
-                  "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.Dashboard",
-                  "markdownDescription": "The dashboard definitions for the bundle, where each key is the name of the dashboard. See [dashboards](https://docs.databricks.com/dev-tools/bundles/resources.html#dashboards).",
-                  "x-since-version": "v0.232.0"
-                },
-                "database_catalogs": {
-                  "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.DatabaseCatalog",
-                  "x-since-version": "v0.265.0"
-                },
-                "database_instances": {
-                  "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.DatabaseInstance",
-                  "x-since-version": "v0.265.0"
-                },
-                "experiments": {
-                  "description": "The experiment definitions for the bundle, where each key is the name of the experiment.",
-                  "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.MlflowExperiment",
-                  "markdownDescription": "The experiment definitions for the bundle, where each key is the name of the experiment. See [experiments](https://docs.databricks.com/dev-tools/bundles/resources.html#experiments).",
-                  "x-since-version": "v0.229.0"
-                },
-                "external_locations": {
-                  "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.ExternalLocation",
-                  "x-since-version": "v0.289.0"
-                },
-                "jobs": {
-                  "description": "The job definitions for the bundle, where each key is the name of the job.",
-                  "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.Job",
-                  "markdownDescription": "The job definitions for the bundle, where each key is the name of the job. See [jobs](https://docs.databricks.com/dev-tools/bundles/resources.html#jobs).",
-                  "x-since-version": "v0.229.0"
-                },
-                "model_serving_endpoints": {
-                  "description": "The model serving endpoint definitions for the bundle, where each key is the name of the model serving endpoint.",
-                  "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.ModelServingEndpoint",
-                  "markdownDescription": "The model serving endpoint definitions for the bundle, where each key is the name of the model serving endpoint. See [model_serving_endpoints](https://docs.databricks.com/dev-tools/bundles/resources.html#model_serving_endpoints).",
-                  "x-since-version": "v0.229.0"
-                },
-                "models": {
-                  "description": "The model definitions for the bundle, where each key is the name of the model.",
-                  "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.MlflowModel",
-                  "markdownDescription": "The model definitions for the bundle, where each key is the name of the model. See [models](https://docs.databricks.com/dev-tools/bundles/resources.html#models).",
-                  "x-since-version": "v0.229.0"
-                },
-                "pipelines": {
-                  "description": "The pipeline definitions for the bundle, where each key is the name of the pipeline.",
-                  "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.Pipeline",
-                  "markdownDescription": "The pipeline definitions for the bundle, where each key is the name of the pipeline. See [pipelines](https://docs.databricks.com/dev-tools/bundles/resources.html#pipelines).",
-                  "x-since-version": "v0.229.0"
-                },
-                "postgres_branches": {
-                  "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.PostgresBranch",
-                  "x-since-version": "v0.287.0"
-                },
-                "postgres_endpoints": {
-                  "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.PostgresEndpoint",
-                  "x-since-version": "v0.287.0"
-                },
-                "postgres_projects": {
-                  "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.PostgresProject",
-                  "x-since-version": "v0.287.0"
-                },
-                "quality_monitors": {
-                  "description": "The quality monitor definitions for the bundle, where each key is the name of the quality monitor.",
-                  "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.QualityMonitor",
-                  "markdownDescription": "The quality monitor definitions for the bundle, where each key is the name of the quality monitor. See [quality_monitors](https://docs.databricks.com/dev-tools/bundles/resources.html#quality_monitors).",
-                  "x-since-version": "v0.229.0"
-                },
-                "registered_models": {
-                  "description": "The registered model definitions for the bundle, where each key is the name of the Unity Catalog registered model.",
-                  "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.RegisteredModel",
-                  "markdownDescription": "The registered model definitions for the bundle, where each key is the name of the Unity Catalog registered model. See [registered_models](https://docs.databricks.com/dev-tools/bundles/resources.html#registered_models)",
-                  "x-since-version": "v0.229.0"
-                },
-                "schemas": {
-                  "description": "The schema definitions for the bundle, where each key is the name of the schema.",
-                  "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.Schema",
-                  "markdownDescription": "The schema definitions for the bundle, where each key is the name of the schema. See [schemas](https://docs.databricks.com/dev-tools/bundles/resources.html#schemas).",
-                  "x-since-version": "v0.229.0"
-                },
-                "secret_scopes": {
-                  "description": "The secret scope definitions for the bundle, where each key is the name of the secret scope.",
-                  "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.SecretScope",
-                  "markdownDescription": "The secret scope definitions for the bundle, where each key is the name of the secret scope. See [secret_scopes](https://docs.databricks.com/dev-tools/bundles/resources.html#secret_scopes).",
-                  "x-since-version": "v0.252.0"
-                },
-                "sql_warehouses": {
-                  "description": "The SQL warehouse definitions for the bundle, where each key is the name of the warehouse.",
-                  "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.SqlWarehouse",
-                  "markdownDescription": "The SQL warehouse definitions for the bundle, where each key is the name of the warehouse. See [sql_warehouses](https://docs.databricks.com/dev-tools/bundles/resources.html#sql_warehouses).",
-                  "x-since-version": "v0.260.0"
-                },
-                "synced_database_tables": {
-                  "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.SyncedDatabaseTable",
-                  "x-since-version": "v0.266.0"
-                },
-                "vector_search_endpoints": {
-                  "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.VectorSearchEndpoint"
-                },
-                "volumes": {
-                  "description": "The volume definitions for the bundle, where each key is the name of the volume.",
-                  "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/resources.Volume",
-                  "markdownDescription": "The volume definitions for the bundle, where each key is the name of the volume. See [volumes](https://docs.databricks.com/dev-tools/bundles/resources.html#volumes).",
-                  "x-since-version": "v0.236.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "config.Script": {
-              "type": "object",
-              "properties": {
-                "content": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.259.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "content"
-              ]
-            },
-            "config.Sync": {
-              "type": "object",
-              "properties": {
-                "exclude": {
-                  "description": "A list of files or folders to exclude from the bundle.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "include": {
-                  "description": "A list of files or folders to include in the bundle.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "paths": {
-                  "description": "The local folder paths, which can be outside the bundle root, to synchronize to the workspace when the bundle is deployed.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "config.Target": {
-              "type": "object",
-              "properties": {
-                "artifacts": {
-                  "description": "The artifacts to include in the target deployment.",
-                  "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config.Artifact",
-                  "x-since-version": "v0.229.0"
-                },
-                "bundle": {
-                  "description": "The bundle attributes when deploying to this target.",
-                  "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Bundle",
-                  "x-since-version": "v0.229.0"
-                },
-                "cluster_id": {
-                  "description": "The ID of the cluster to use for this target.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "compute_id": {
-                  "description": "Deprecated. The ID of the compute to use for this target.",
-                  "$ref": "#/$defs/string",
-                  "deprecationMessage": "Deprecated: please use cluster_id instead",
-                  "x-since-version": "v0.229.0",
-                  "deprecated": true
-                },
-                "default": {
-                  "description": "Whether this target is the default target.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.229.0"
-                },
-                "git": {
-                  "description": "The Git version control settings for the target.",
-                  "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Git",
-                  "x-since-version": "v0.229.0"
-                },
-                "mode": {
-                  "description": "The deployment mode for the target.",
-                  "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Mode",
-                  "markdownDescription": "The deployment mode for the target. Valid values are `development` or `production`. See [link](https://docs.databricks.com/dev-tools/bundles/deployment-modes.html).",
-                  "x-since-version": "v0.229.0"
-                },
-                "permissions": {
-                  "description": "The permissions for deploying and running the bundle in the target.",
-                  "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.Permission",
-                  "x-since-version": "v0.229.0"
-                },
-                "presets": {
-                  "description": "The deployment presets for the target.",
-                  "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Presets",
-                  "x-since-version": "v0.229.0"
-                },
-                "resources": {
-                  "description": "The resource definitions for the target.",
-                  "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Resources",
-                  "x-since-version": "v0.229.0"
-                },
-                "run_as": {
-                  "description": "The identity to use to run the bundle.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobRunAs",
-                  "markdownDescription": "The identity to use to run the bundle, see [link](https://docs.databricks.com/dev-tools/bundles/run-as.html).",
-                  "x-since-version": "v0.229.0"
-                },
-                "sync": {
-                  "description": "The local paths to sync to the target workspace when a bundle is run or deployed.",
-                  "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Sync",
-                  "x-since-version": "v0.229.0"
-                },
-                "variables": {
-                  "description": "The custom variable definitions for the target.",
-                  "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/variable.TargetVariable",
-                  "x-since-version": "v0.229.0"
-                },
-                "workspace": {
-                  "description": "The Databricks workspace for the target.",
-                  "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Workspace",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "config.Workspace": {
-              "type": "object",
-              "properties": {
-                "account_id": {
-                  "description": "The Databricks account ID.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.296.0"
-                },
-                "artifact_path": {
-                  "description": "The artifact path to use within the workspace for both deployments and job runs",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "auth_type": {
-                  "description": "The authentication type.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "azure_client_id": {
-                  "description": "The Azure client ID",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "azure_environment": {
-                  "description": "The Azure environment",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "azure_login_app_id": {
-                  "description": "The Azure login app ID",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "azure_tenant_id": {
-                  "description": "The Azure tenant ID",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "azure_use_msi": {
-                  "description": "Whether to use MSI for Azure",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.229.0"
-                },
-                "azure_workspace_resource_id": {
-                  "description": "The Azure workspace resource ID",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "client_id": {
-                  "description": "The client ID for the workspace",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "experimental_is_unified_host": {
-                  "description": "Experimental feature flag to indicate if the host is a unified host",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.285.0"
-                },
-                "file_path": {
-                  "description": "The file path to use within the workspace for both deployments and job runs",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "google_service_account": {
-                  "description": "The Google service account name",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "host": {
-                  "description": "The Databricks workspace host URL",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "profile": {
-                  "description": "The Databricks workspace profile name",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "resource_path": {
-                  "description": "The workspace resource path",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.230.0"
-                },
-                "root_path": {
-                  "description": "The Databricks workspace root path",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "state_path": {
-                  "description": "The workspace state path",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "workspace_id": {
-                  "description": "The Databricks workspace ID",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.285.0"
-                }
-              },
-              "additionalProperties": false
-            }
-          },
-          "libs": {
-            "exec.ExecutableType": {
-              "type": "string"
-            }
-          }
-        },
-        "databricks-sdk-go": {
-          "common": {
-            "types": {
-              "duration.Duration": {
-                "type": "string"
-              },
-              "time.Time": {
-                "type": "object",
-                "additionalProperties": false
-              }
-            }
-          },
-          "service": {
-            "apps.AppDeployment": {
-              "type": "object",
-              "properties": {
-                "command": {
-                  "description": "The command with which to run the app. This will override the command specified in the app.yaml file.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.283.0"
-                },
-                "deployment_id": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.239.0"
-                },
-                "env_vars": {
-                  "description": "The environment variables to set in the app runtime environment. This will override the environment variables specified in the app.yaml file.",
-                  "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/apps.EnvVar",
-                  "x-since-version": "v0.283.0"
-                },
-                "git_source": {
-                  "description": "Git repository to use as the source for the app deployment.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.GitSource",
-                  "x-databricks-preview": "PRIVATE",
-                  "doNotSuggest": true,
-                  "x-since-version": "v0.283.0"
-                },
-                "mode": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppDeploymentMode",
-                  "x-since-version": "v0.239.0"
-                },
-                "source_code_path": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.239.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "apps.AppDeploymentArtifacts": {
-              "type": "object",
-              "properties": {
-                "source_code_path": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.239.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "apps.AppDeploymentMode": {
-              "type": "string",
-              "enum": [
-                "SNAPSHOT",
-                "AUTO_SYNC"
-              ]
-            },
-            "apps.AppDeploymentState": {
-              "type": "string",
-              "enum": [
-                "SUCCEEDED",
-                "FAILED",
-                "IN_PROGRESS",
-                "CANCELLED"
-              ]
-            },
-            "apps.AppDeploymentStatus": {
-              "type": "object",
-              "additionalProperties": false
-            },
-            "apps.AppPermissionLevel": {
-              "type": "string",
-              "description": "Permission level",
-              "enum": [
-                "CAN_MANAGE",
-                "CAN_USE"
-              ]
-            },
-            "apps.AppResource": {
-              "type": "object",
-              "properties": {
-                "app": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceApp",
-                  "x-since-version": "v0.290.0"
-                },
-                "database": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceDatabase",
-                  "x-since-version": "v0.260.0"
-                },
-                "description": {
-                  "description": "Description of the App Resource.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.239.0"
-                },
-                "experiment": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceExperiment",
-                  "x-since-version": "v0.283.0"
-                },
-                "genie_space": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceGenieSpace",
-                  "x-since-version": "v0.273.0"
-                },
-                "job": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceJob",
-                  "x-since-version": "v0.239.0"
-                },
-                "name": {
-                  "description": "Name of the App Resource.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.239.0"
-                },
-                "postgres": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourcePostgres",
-                  "x-since-version": "v0.294.0"
-                },
-                "secret": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceSecret",
-                  "x-since-version": "v0.239.0"
-                },
-                "serving_endpoint": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceServingEndpoint",
-                  "x-since-version": "v0.239.0"
-                },
-                "sql_warehouse": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceSqlWarehouse",
-                  "x-since-version": "v0.239.0"
-                },
-                "uc_securable": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceUcSecurable",
-                  "x-since-version": "v0.253.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "name"
-              ]
-            },
-            "apps.AppResourceApp": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "$ref": "#/$defs/string"
-                },
-                "permission": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceAppAppPermission"
-                }
-              },
-              "additionalProperties": false
-            },
-            "apps.AppResourceAppAppPermission": {
-              "type": "string",
-              "enum": [
-                "CAN_USE"
-              ]
-            },
-            "apps.AppResourceDatabase": {
-              "type": "object",
-              "properties": {
-                "database_name": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.260.0"
-                },
-                "instance_name": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.260.0"
-                },
-                "permission": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceDatabaseDatabasePermission",
-                  "x-since-version": "v0.260.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "database_name",
-                "instance_name",
-                "permission"
-              ]
-            },
-            "apps.AppResourceDatabaseDatabasePermission": {
-              "type": "string",
-              "enum": [
-                "CAN_CONNECT_AND_CREATE"
-              ]
-            },
-            "apps.AppResourceExperiment": {
-              "type": "object",
-              "properties": {
-                "experiment_id": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.283.0"
-                },
-                "permission": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceExperimentExperimentPermission",
-                  "x-since-version": "v0.283.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "experiment_id",
-                "permission"
-              ]
-            },
-            "apps.AppResourceExperimentExperimentPermission": {
-              "type": "string",
-              "enum": [
-                "CAN_MANAGE",
-                "CAN_EDIT",
-                "CAN_READ"
-              ]
-            },
-            "apps.AppResourceGenieSpace": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.273.0"
-                },
-                "permission": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceGenieSpaceGenieSpacePermission",
-                  "x-since-version": "v0.273.0"
-                },
-                "space_id": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.273.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "name",
-                "permission",
-                "space_id"
-              ]
-            },
-            "apps.AppResourceGenieSpaceGenieSpacePermission": {
-              "type": "string",
-              "enum": [
-                "CAN_MANAGE",
-                "CAN_EDIT",
-                "CAN_RUN",
-                "CAN_VIEW"
-              ]
-            },
-            "apps.AppResourceJob": {
-              "type": "object",
-              "properties": {
-                "id": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.239.0"
-                },
-                "permission": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceJobJobPermission",
-                  "x-since-version": "v0.239.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "id",
-                "permission"
-              ]
-            },
-            "apps.AppResourceJobJobPermission": {
-              "type": "string",
-              "enum": [
-                "CAN_MANAGE",
-                "IS_OWNER",
-                "CAN_MANAGE_RUN",
-                "CAN_VIEW"
-              ]
-            },
-            "apps.AppResourcePostgres": {
-              "type": "object",
-              "properties": {
-                "branch": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.294.0"
-                },
-                "database": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.294.0"
-                },
-                "permission": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourcePostgresPostgresPermission",
-                  "x-since-version": "v0.294.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "apps.AppResourcePostgresPostgresPermission": {
-              "type": "string",
-              "enum": [
-                "CAN_CONNECT_AND_CREATE"
-              ]
-            },
-            "apps.AppResourceSecret": {
-              "type": "object",
-              "properties": {
-                "key": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.239.0"
-                },
-                "permission": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceSecretSecretPermission",
-                  "x-since-version": "v0.239.0"
-                },
-                "scope": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.239.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "key",
-                "permission",
-                "scope"
-              ]
-            },
-            "apps.AppResourceSecretSecretPermission": {
-              "type": "string",
-              "description": "Permission to grant on the secret scope. Supported permissions are: \"READ\", \"WRITE\", \"MANAGE\".",
-              "enum": [
-                "READ",
-                "WRITE",
-                "MANAGE"
-              ]
-            },
-            "apps.AppResourceServingEndpoint": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.239.0"
-                },
-                "permission": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceServingEndpointServingEndpointPermission",
-                  "x-since-version": "v0.239.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "name",
-                "permission"
-              ]
-            },
-            "apps.AppResourceServingEndpointServingEndpointPermission": {
-              "type": "string",
-              "enum": [
-                "CAN_MANAGE",
-                "CAN_QUERY",
-                "CAN_VIEW"
-              ]
-            },
-            "apps.AppResourceSqlWarehouse": {
-              "type": "object",
-              "properties": {
-                "id": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.239.0"
-                },
-                "permission": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceSqlWarehouseSqlWarehousePermission",
-                  "x-since-version": "v0.239.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "id",
-                "permission"
-              ]
-            },
-            "apps.AppResourceSqlWarehouseSqlWarehousePermission": {
-              "type": "string",
-              "enum": [
-                "CAN_MANAGE",
-                "CAN_USE",
-                "IS_OWNER"
-              ]
-            },
-            "apps.AppResourceUcSecurable": {
-              "type": "object",
-              "properties": {
-                "permission": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceUcSecurableUcSecurablePermission",
-                  "x-since-version": "v0.253.0"
-                },
-                "securable_full_name": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.253.0"
-                },
-                "securable_type": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResourceUcSecurableUcSecurableType",
-                  "x-since-version": "v0.253.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "permission",
-                "securable_full_name",
-                "securable_type"
-              ]
-            },
-            "apps.AppResourceUcSecurableUcSecurablePermission": {
-              "type": "string",
-              "enum": [
-                "READ_VOLUME",
-                "WRITE_VOLUME",
-                "SELECT",
-                "EXECUTE",
-                "USE_CONNECTION",
-                "MODIFY"
-              ]
-            },
-            "apps.AppResourceUcSecurableUcSecurableType": {
-              "type": "string",
-              "enum": [
-                "VOLUME",
-                "TABLE",
-                "FUNCTION",
-                "CONNECTION"
-              ]
-            },
-            "apps.ApplicationState": {
-              "type": "string",
-              "enum": [
-                "DEPLOYING",
-                "RUNNING",
-                "CRASHED",
-                "UNAVAILABLE"
-              ]
-            },
-            "apps.ApplicationStatus": {
-              "type": "object",
-              "additionalProperties": false
-            },
-            "apps.ComputeSize": {
-              "type": "string",
-              "enum": [
-                "MEDIUM",
-                "LARGE"
-              ]
-            },
-            "apps.ComputeState": {
-              "type": "string",
-              "enum": [
-                "ERROR",
-                "DELETING",
-                "STARTING",
-                "STOPPING",
-                "UPDATING",
-                "STOPPED",
-                "ACTIVE"
-              ]
-            },
-            "apps.ComputeStatus": {
-              "type": "object",
-              "additionalProperties": false
-            },
-            "apps.EnvVar": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "description": "The name of the environment variable.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.283.0"
-                },
-                "value": {
-                  "description": "The value for the environment variable.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.283.0"
-                },
-                "value_from": {
-                  "description": "The name of an external Databricks resource that contains the value, such as a secret or a database table.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.283.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "apps.GitRepository": {
-              "type": "object",
-              "description": "Git repository configuration specifying the location of the repository.",
-              "properties": {
-                "provider": {
-                  "description": "Git provider. Case insensitive. Supported values: gitHub, gitHubEnterprise, bitbucketCloud,\nbitbucketServer, azureDevOpsServices, gitLab, gitLabEnterpriseEdition, awsCodeCommit.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.283.0"
-                },
-                "url": {
-                  "description": "URL of the Git repository.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.283.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "provider",
-                "url"
-              ]
-            },
-            "apps.GitSource": {
-              "type": "object",
-              "description": "Complete git source specification including repository location and reference.",
-              "properties": {
-                "branch": {
-                  "description": "Git branch to checkout.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.283.0"
-                },
-                "commit": {
-                  "description": "Git commit SHA to checkout.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.283.0"
-                },
-                "source_code_path": {
-                  "description": "Relative path to the app source code within the Git repository. If not specified, the root\nof the repository is used.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.283.0"
-                },
-                "tag": {
-                  "description": "Git tag to checkout.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.283.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "apps.TelemetryExportDestination": {
-              "type": "object",
-              "description": "A single telemetry export destination with its configuration and status.",
-              "properties": {
-                "unity_catalog": {
-                  "description": "Unity Catalog Destinations for OTEL telemetry export.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.UnityCatalog",
-                  "x-since-version": "v0.294.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "apps.UnityCatalog": {
-              "type": "object",
-              "description": "Unity Catalog Destinations for OTEL telemetry export.",
-              "properties": {
-                "logs_table": {
-                  "description": "Unity Catalog table for OTEL logs.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.294.0"
-                },
-                "metrics_table": {
-                  "description": "Unity Catalog table for OTEL metrics.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.294.0"
-                },
-                "traces_table": {
-                  "description": "Unity Catalog table for OTEL traces (spans).",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.294.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "logs_table",
-                "metrics_table",
-                "traces_table"
-              ]
-            },
-            "catalog.AwsSqsQueue": {
-              "type": "object",
-              "properties": {
-                "queue_url": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.289.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "catalog.AzureEncryptionSettings": {
-              "type": "object",
-              "properties": {
-                "azure_cmk_access_connector_id": {
-                  "$ref": "#/$defs/string"
-                },
-                "azure_cmk_managed_identity_id": {
-                  "$ref": "#/$defs/string"
-                },
-                "azure_tenant_id": {
-                  "$ref": "#/$defs/string"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "azure_tenant_id"
-              ]
-            },
-            "catalog.AzureQueueStorage": {
-              "type": "object",
-              "properties": {
-                "queue_url": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.289.0"
-                },
-                "resource_group": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.289.0"
-                },
-                "subscription_id": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.289.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "catalog.EncryptionDetails": {
-              "type": "object",
-              "description": "Encryption options that apply to clients connecting to cloud storage.",
-              "properties": {
-                "sse_encryption_details": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.SseEncryptionDetails",
-                  "x-since-version": "v0.289.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "catalog.EncryptionSettings": {
-              "type": "object",
-              "description": "Encryption Settings are used to carry metadata for securable encryption at rest.\nCurrently used for catalogs, we can use the information supplied here to interact with a CMK.",
-              "properties": {
-                "azure_encryption_settings": {
-                  "description": "optional Azure settings - only required if an Azure CMK is used.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.AzureEncryptionSettings"
-                },
-                "azure_key_vault_key_id": {
-                  "description": "the AKV URL in Azure, null otherwise.",
-                  "$ref": "#/$defs/string"
-                },
-                "customer_managed_key_id": {
-                  "description": "the CMK uuid in AWS and GCP, null otherwise.",
-                  "$ref": "#/$defs/string"
-                }
-              },
-              "additionalProperties": false
-            },
-            "catalog.FileEventQueue": {
-              "type": "object",
-              "properties": {
-                "managed_aqs": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.AzureQueueStorage",
-                  "x-since-version": "v0.289.0"
-                },
-                "managed_pubsub": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.GcpPubsub",
-                  "x-since-version": "v0.289.0"
-                },
-                "managed_sqs": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.AwsSqsQueue",
-                  "x-since-version": "v0.289.0"
-                },
-                "provided_aqs": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.AzureQueueStorage",
-                  "x-since-version": "v0.289.0"
-                },
-                "provided_pubsub": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.GcpPubsub",
-                  "x-since-version": "v0.289.0"
-                },
-                "provided_sqs": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.AwsSqsQueue",
-                  "x-since-version": "v0.289.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "catalog.GcpPubsub": {
-              "type": "object",
-              "properties": {
-                "subscription_name": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.289.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "catalog.MonitorCronSchedule": {
-              "type": "object",
-              "properties": {
-                "pause_status": {
-                  "description": "Read only field that indicates whether a schedule is paused or not.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.MonitorCronSchedulePauseStatus",
-                  "x-since-version": "v0.229.0"
-                },
-                "quartz_cron_expression": {
-                  "description": "The expression that determines when to run the monitor. See [examples](https://www.quartz-scheduler.org/documentation/quartz-2.3.0/tutorials/crontrigger.html).",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "timezone_id": {
-                  "description": "The timezone id (e.g., ``PST``) in which to evaluate the quartz expression.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "quartz_cron_expression",
-                "timezone_id"
-              ]
-            },
-            "catalog.MonitorCronSchedulePauseStatus": {
-              "type": "string",
-              "description": "Source link: https://src.dev.databricks.com/databricks/universe/-/blob/elastic-spark-common/api/messages/schedule.proto\nMonitoring workflow schedule pause status.",
-              "enum": [
-                "UNSPECIFIED",
-                "UNPAUSED",
-                "PAUSED"
-              ]
-            },
-            "catalog.MonitorDataClassificationConfig": {
-              "type": "object",
-              "description": "Data classification related configuration.",
-              "properties": {
-                "enabled": {
-                  "description": "Whether to enable data classification.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "catalog.MonitorDestination": {
-              "type": "object",
-              "properties": {
-                "email_addresses": {
-                  "description": "The list of email addresses to send the notification to. A maximum of 5 email addresses is supported.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "catalog.MonitorInferenceLog": {
-              "type": "object",
-              "properties": {
-                "granularities": {
-                  "description": "Granularities for aggregating data into time windows based on their timestamp. Valid values are 5 minutes, 30 minutes, 1 hour, 1 day, n weeks, 1 month, or 1 year.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "label_col": {
-                  "description": "Column for the label.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "model_id_col": {
-                  "description": "Column for the model identifier.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "prediction_col": {
-                  "description": "Column for the prediction.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "prediction_proba_col": {
-                  "description": "Column for prediction probabilities",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "problem_type": {
-                  "description": "Problem type the model aims to solve.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.MonitorInferenceLogProblemType",
-                  "x-since-version": "v0.229.0"
-                },
-                "timestamp_col": {
-                  "description": "Column for the timestamp.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "granularities",
-                "model_id_col",
-                "prediction_col",
-                "problem_type",
-                "timestamp_col"
-              ]
-            },
-            "catalog.MonitorInferenceLogProblemType": {
-              "type": "string",
-              "enum": [
-                "PROBLEM_TYPE_CLASSIFICATION",
-                "PROBLEM_TYPE_REGRESSION"
-              ]
-            },
-            "catalog.MonitorMetric": {
-              "type": "object",
-              "description": "Custom metric definition.",
-              "properties": {
-                "definition": {
-                  "description": "Jinja template for a SQL expression that specifies how to compute the metric. See [create metric definition](https://docs.databricks.com/en/lakehouse-monitoring/custom-metrics.html#create-definition).",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "input_columns": {
-                  "description": "A list of column names in the input table the metric should be computed for.\nCan use ``\":table\"`` to indicate that the metric needs information from multiple columns.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "name": {
-                  "description": "Name of the metric in the output tables.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "output_data_type": {
-                  "description": "The output type of the custom metric.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "type": {
-                  "description": "Can only be one of ``\"CUSTOM_METRIC_TYPE_AGGREGATE\"``, ``\"CUSTOM_METRIC_TYPE_DERIVED\"``, or ``\"CUSTOM_METRIC_TYPE_DRIFT\"``.\nThe ``\"CUSTOM_METRIC_TYPE_AGGREGATE\"`` and ``\"CUSTOM_METRIC_TYPE_DERIVED\"`` metrics\nare computed on a single table, whereas the ``\"CUSTOM_METRIC_TYPE_DRIFT\"`` compare metrics across\nbaseline and input table, or across the two consecutive time windows.\n- CUSTOM_METRIC_TYPE_AGGREGATE: only depend on the existing columns in your table\n- CUSTOM_METRIC_TYPE_DERIVED: depend on previously computed aggregate metrics\n- CUSTOM_METRIC_TYPE_DRIFT:  depend on previously computed aggregate or derived metrics",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.MonitorMetricType",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "definition",
-                "input_columns",
-                "name",
-                "output_data_type",
-                "type"
-              ]
-            },
-            "catalog.MonitorMetricType": {
-              "type": "string",
-              "description": "Can only be one of ``\\\"CUSTOM_METRIC_TYPE_AGGREGATE\\\"``, ``\\\"CUSTOM_METRIC_TYPE_DERIVED\\\"``, or ``\\\"CUSTOM_METRIC_TYPE_DRIFT\\\"``.\nThe ``\\\"CUSTOM_METRIC_TYPE_AGGREGATE\\\"`` and ``\\\"CUSTOM_METRIC_TYPE_DERIVED\\\"`` metrics\nare computed on a single table, whereas the ``\\\"CUSTOM_METRIC_TYPE_DRIFT\\\"`` compare metrics across\nbaseline and input table, or across the two consecutive time windows.\n- CUSTOM_METRIC_TYPE_AGGREGATE: only depend on the existing columns in your table\n- CUSTOM_METRIC_TYPE_DERIVED: depend on previously computed aggregate metrics\n- CUSTOM_METRIC_TYPE_DRIFT:  depend on previously computed aggregate or derived metrics",
-              "enum": [
-                "CUSTOM_METRIC_TYPE_AGGREGATE",
-                "CUSTOM_METRIC_TYPE_DERIVED",
-                "CUSTOM_METRIC_TYPE_DRIFT"
-              ]
-            },
-            "catalog.MonitorNotifications": {
-              "type": "object",
-              "properties": {
-                "on_failure": {
-                  "description": "Destinations to send notifications on failure/timeout.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.MonitorDestination",
-                  "x-since-version": "v0.229.0"
-                },
-                "on_new_classification_tag_detected": {
-                  "description": "Destinations to send notifications on new classification tag detected.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.MonitorDestination",
-                  "x-databricks-preview": "PRIVATE",
-                  "doNotSuggest": true,
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "catalog.MonitorSnapshot": {
-              "type": "object",
-              "description": "Snapshot analysis configuration",
-              "additionalProperties": false
-            },
-            "catalog.MonitorTimeSeries": {
-              "type": "object",
-              "description": "Time series analysis configuration.",
-              "properties": {
-                "granularities": {
-                  "description": "Granularities for aggregating data into time windows based on their timestamp. Valid values are 5 minutes, 30 minutes, 1 hour, 1 day, n weeks, 1 month, or 1 year.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "timestamp_col": {
-                  "description": "Column for the timestamp.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "granularities",
-                "timestamp_col"
-              ]
-            },
-            "catalog.Privilege": {
-              "type": "string",
-              "enum": [
-                "SELECT",
-                "READ_PRIVATE_FILES",
-                "WRITE_PRIVATE_FILES",
-                "CREATE",
-                "USAGE",
-                "USE_CATALOG",
-                "USE_SCHEMA",
-                "CREATE_SCHEMA",
-                "CREATE_VIEW",
-                "CREATE_EXTERNAL_TABLE",
-                "CREATE_MATERIALIZED_VIEW",
-                "CREATE_FUNCTION",
-                "CREATE_MODEL",
-                "CREATE_CATALOG",
-                "CREATE_MANAGED_STORAGE",
-                "CREATE_EXTERNAL_LOCATION",
-                "CREATE_STORAGE_CREDENTIAL",
-                "CREATE_SERVICE_CREDENTIAL",
-                "ACCESS",
-                "CREATE_SHARE",
-                "CREATE_RECIPIENT",
-                "CREATE_PROVIDER",
-                "USE_SHARE",
-                "USE_RECIPIENT",
-                "USE_PROVIDER",
-                "USE_MARKETPLACE_ASSETS",
-                "SET_SHARE_PERMISSION",
-                "MODIFY",
-                "REFRESH",
-                "EXECUTE",
-                "READ_FILES",
-                "WRITE_FILES",
-                "CREATE_TABLE",
-                "ALL_PRIVILEGES",
-                "CREATE_CONNECTION",
-                "USE_CONNECTION",
-                "APPLY_TAG",
-                "CREATE_FOREIGN_CATALOG",
-                "CREATE_FOREIGN_SECURABLE",
-                "MANAGE_ALLOWLIST",
-                "CREATE_VOLUME",
-                "CREATE_EXTERNAL_VOLUME",
-                "READ_VOLUME",
-                "WRITE_VOLUME",
-                "MANAGE",
-                "BROWSE",
-                "CREATE_CLEAN_ROOM",
-                "MODIFY_CLEAN_ROOM",
-                "EXECUTE_CLEAN_ROOM_TASK",
-                "EXTERNAL_USE_SCHEMA"
-              ]
-            },
-            "catalog.PrivilegeAssignment": {
-              "type": "object",
-              "properties": {
-                "principal": {
-                  "description": "The principal (user email address or group name).\nFor deleted principals, `principal` is empty while `principal_id` is populated.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.294.0"
-                },
-                "privileges": {
-                  "description": "The privileges assigned to the principal.",
-                  "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/catalog.Privilege",
-                  "x-since-version": "v0.294.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "catalog.RegisteredModelAlias": {
-              "type": "object",
-              "properties": {
-                "alias_name": {
-                  "description": "Name of the alias, e.g. 'champion' or 'latest_stable'",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.273.0"
-                },
-                "catalog_name": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.273.0"
-                },
-                "id": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.273.0"
-                },
-                "model_name": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.273.0"
-                },
-                "schema_name": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.273.0"
-                },
-                "version_num": {
-                  "description": "Integer version number of the model version to which this alias points.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.273.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "catalog.SseEncryptionDetails": {
-              "type": "object",
-              "description": "Server-Side Encryption properties for clients communicating with AWS s3.",
-              "properties": {
-                "algorithm": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.SseEncryptionDetailsAlgorithm",
-                  "x-since-version": "v0.289.0"
-                },
-                "aws_kms_key_arn": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.289.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "catalog.SseEncryptionDetailsAlgorithm": {
-              "type": "string",
-              "description": "SSE algorithm to use for encrypting S3 objects",
-              "enum": [
-                "AWS_SSE_S3",
-                "AWS_SSE_KMS",
-                "AWS_SSE_KMS",
-                "AWS_SSE_S3"
-              ]
-            },
-            "catalog.VolumeType": {
-              "type": "string",
-              "enum": [
-                "MANAGED",
-                "EXTERNAL"
-              ]
-            },
-            "compute.Adlsgen2Info": {
-              "type": "object",
-              "description": "A storage location in Adls Gen2",
-              "properties": {
-                "destination": {
-                  "description": "abfss destination, e.g. `abfss://\u003ccontainer-name\u003e@\u003cstorage-account-name\u003e.dfs.core.windows.net/\u003cdirectory-name\u003e`.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "destination"
-              ]
-            },
-            "compute.AutoScale": {
-              "type": "object",
-              "properties": {
-                "max_workers": {
-                  "description": "The maximum number of workers to which the cluster can scale up when overloaded.\nNote that `max_workers` must be strictly greater than `min_workers`.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.229.0"
-                },
-                "min_workers": {
-                  "description": "The minimum number of workers to which the cluster can scale down when underutilized.\nIt is also the initial number of workers the cluster will have after creation.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "compute.AwsAttributes": {
-              "type": "object",
-              "description": "Attributes set during cluster creation which are related to Amazon Web Services.",
-              "properties": {
-                "availability": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.AwsAvailability",
-                  "x-since-version": "v0.229.0"
-                },
-                "ebs_volume_count": {
-                  "description": "The number of volumes launched for each instance. Users can choose up to 10 volumes.\nThis feature is only enabled for supported node types. Legacy node types cannot specify\ncustom EBS volumes.\nFor node types with no instance store, at least one EBS volume needs to be specified;\notherwise, cluster creation will fail.\n\nThese EBS volumes will be mounted at `/ebs0`, `/ebs1`, and etc.\nInstance store volumes will be mounted at `/local_disk0`, `/local_disk1`, and etc.\n\nIf EBS volumes are attached, Databricks will configure Spark to use only the EBS volumes for\nscratch storage because heterogenously sized scratch devices can lead to inefficient disk\nutilization. If no EBS volumes are attached, Databricks will configure Spark to use instance\nstore volumes.\n\nPlease note that if EBS volumes are specified, then the Spark configuration `spark.local.dir`\nwill be overridden.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.229.0"
-                },
-                "ebs_volume_iops": {
-                  "description": "If using gp3 volumes, what IOPS to use for the disk. If this is not set, the maximum performance of a gp2 volume with the same volume size will be used.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.229.0"
-                },
-                "ebs_volume_size": {
-                  "description": "The size of each EBS volume (in GiB) launched for each instance. For general purpose\nSSD, this value must be within the range 100 - 4096. For throughput optimized HDD,\nthis value must be within the range 500 - 4096.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.229.0"
-                },
-                "ebs_volume_throughput": {
-                  "description": "If using gp3 volumes, what throughput to use for the disk. If this is not set, the maximum performance of a gp2 volume with the same volume size will be used.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.229.0"
-                },
-                "ebs_volume_type": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.EbsVolumeType",
-                  "x-since-version": "v0.229.0"
-                },
-                "first_on_demand": {
-                  "description": "The first `first_on_demand` nodes of the cluster will be placed on on-demand instances.\nIf this value is greater than 0, the cluster driver node in particular will be placed on an\non-demand instance. If this value is greater than or equal to the current cluster size, all\nnodes will be placed on on-demand instances. If this value is less than the current cluster\nsize, `first_on_demand` nodes will be placed on on-demand instances and the remainder will\nbe placed on `availability` instances. Note that this value does not affect\ncluster size and cannot currently be mutated over the lifetime of a cluster.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.229.0"
-                },
-                "instance_profile_arn": {
-                  "description": "Nodes for this cluster will only be placed on AWS instances with this instance profile. If\nommitted, nodes will be placed on instances without an IAM instance profile. The instance\nprofile must have previously been added to the Databricks environment by an account\nadministrator.\n\nThis feature may only be available to certain customer plans.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "spot_bid_price_percent": {
-                  "description": "The bid price for AWS spot instances, as a percentage of the corresponding instance type's\non-demand price.\nFor example, if this field is set to 50, and the cluster needs a new `r3.xlarge` spot\ninstance, then the bid price is half of the price of\non-demand `r3.xlarge` instances. Similarly, if this field is set to 200, the bid price is twice\nthe price of on-demand `r3.xlarge` instances. If not specified, the default value is 100.\nWhen spot instances are requested for this cluster, only spot instances whose bid price\npercentage matches this field will be considered.\nNote that, for safety, we enforce this field to be no more than 10000.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.229.0"
-                },
-                "zone_id": {
-                  "description": "Identifier for the availability zone/datacenter in which the cluster resides.\nThis string will be of a form like \"us-west-2a\". The provided availability\nzone must be in the same region as the Databricks deployment. For example, \"us-west-2a\"\nis not a valid zone id if the Databricks deployment resides in the \"us-east-1\" region.\nThis is an optional field at cluster creation, and if not specified, the zone \"auto\" will be used.\nIf the zone specified is \"auto\", will try to place cluster in a zone with high availability,\nand will retry placement in a different AZ if there is not enough capacity.\n\nThe list of available zones as well as the default value can be found by using the\n`List Zones` method.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "compute.AwsAvailability": {
-              "type": "string",
-              "description": "Availability type used for all subsequent nodes past the `first_on_demand` ones.\n\nNote: If `first_on_demand` is zero, this availability type will be used for the entire cluster.",
-              "enum": [
-                "SPOT",
-                "ON_DEMAND",
-                "SPOT_WITH_FALLBACK"
-              ]
-            },
-            "compute.AzureAttributes": {
-              "type": "object",
-              "description": "Attributes set during cluster creation which are related to Microsoft Azure.",
-              "properties": {
-                "availability": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.AzureAvailability",
-                  "x-since-version": "v0.229.0"
-                },
-                "first_on_demand": {
-                  "description": "The first `first_on_demand` nodes of the cluster will be placed on on-demand instances.\nThis value should be greater than 0, to make sure the cluster driver node is placed on an\non-demand instance. If this value is greater than or equal to the current cluster size, all\nnodes will be placed on on-demand instances. If this value is less than the current cluster\nsize, `first_on_demand` nodes will be placed on on-demand instances and the remainder will\nbe placed on `availability` instances. Note that this value does not affect\ncluster size and cannot currently be mutated over the lifetime of a cluster.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.229.0"
-                },
-                "log_analytics_info": {
-                  "description": "Defines values necessary to configure and run Azure Log Analytics agent",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.LogAnalyticsInfo",
-                  "x-since-version": "v0.229.0"
-                },
-                "spot_bid_max_price": {
-                  "description": "The max bid price to be used for Azure spot instances.\nThe Max price for the bid cannot be higher than the on-demand price of the instance.\nIf not specified, the default value is -1, which specifies that the instance cannot be evicted\non the basis of price, and only on the basis of availability. Further, the value should \u003e 0 or -1.",
-                  "$ref": "#/$defs/float64",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "compute.AzureAvailability": {
-              "type": "string",
-              "description": "Availability type used for all subsequent nodes past the `first_on_demand` ones.\nNote: If `first_on_demand` is zero, this availability type will be used for the entire cluster.",
-              "enum": [
-                "SPOT_AZURE",
-                "ON_DEMAND_AZURE",
-                "SPOT_WITH_FALLBACK_AZURE"
-              ]
-            },
-            "compute.ClientsTypes": {
-              "type": "object",
-              "properties": {
-                "jobs": {
-                  "description": "With jobs set, the cluster can be used for jobs",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.229.0"
-                },
-                "notebooks": {
-                  "description": "With notebooks set, this cluster can be used for notebooks",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "compute.ClusterLogConf": {
-              "type": "object",
-              "description": "Cluster log delivery config",
-              "properties": {
-                "dbfs": {
-                  "description": "destination needs to be provided. e.g.\n`{ \"dbfs\" : { \"destination\" : \"dbfs:/home/cluster_log\" } }`",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.DbfsStorageInfo",
-                  "x-since-version": "v0.229.0"
-                },
-                "s3": {
-                  "description": "destination and either the region or endpoint need to be provided. e.g.\n`{ \"s3\": { \"destination\" : \"s3://cluster_log_bucket/prefix\", \"region\" : \"us-west-2\" } }`\nCluster iam role is used to access s3, please make sure the cluster iam role in\n`instance_profile_arn` has permission to write data to the s3 destination.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.S3StorageInfo",
-                  "x-since-version": "v0.229.0"
-                },
-                "volumes": {
-                  "description": "destination needs to be provided, e.g.\n`{ \"volumes\": { \"destination\": \"/Volumes/catalog/schema/volume/cluster_log\" } }`",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.VolumesStorageInfo",
-                  "x-since-version": "v0.242.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "compute.ClusterPermissionLevel": {
-              "type": "string",
-              "description": "Permission level",
-              "enum": [
-                "CAN_MANAGE",
-                "CAN_RESTART",
-                "CAN_ATTACH_TO"
-              ]
-            },
-            "compute.ClusterSpec": {
-              "type": "object",
-              "description": "Contains a snapshot of the latest user specified settings that were used to create/edit the cluster.",
-              "properties": {
-                "apply_policy_default_values": {
-                  "description": "When set to true, fixed and default values from the policy will be used for fields that are omitted. When set to false, only fixed values from the policy will be applied.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.229.0"
-                },
-                "autoscale": {
-                  "description": "Parameters needed in order to automatically scale clusters up and down based on load.\nNote: autoscaling works best with DB runtime versions 3.0 or later.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.AutoScale",
-                  "x-since-version": "v0.229.0"
-                },
-                "autotermination_minutes": {
-                  "description": "Automatically terminates the cluster after it is inactive for this time in minutes. If not set,\nthis cluster will not be automatically terminated. If specified, the threshold must be between\n10 and 10000 minutes.\nUsers can also set this value to 0 to explicitly disable automatic termination.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.229.0"
-                },
-                "aws_attributes": {
-                  "description": "Attributes related to clusters running on Amazon Web Services.\nIf not specified at cluster creation, a set of default values will be used.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.AwsAttributes",
-                  "x-since-version": "v0.229.0"
-                },
-                "azure_attributes": {
-                  "description": "Attributes related to clusters running on Microsoft Azure.\nIf not specified at cluster creation, a set of default values will be used.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.AzureAttributes",
-                  "x-since-version": "v0.229.0"
-                },
-                "cluster_log_conf": {
-                  "description": "The configuration for delivering spark logs to a long-term storage destination.\nThree kinds of destinations (DBFS, S3 and Unity Catalog volumes) are supported. Only one destination can be specified\nfor one cluster. If the conf is given, the logs will be delivered to the destination every\n`5 mins`. The destination of driver logs is `$destination/$clusterId/driver`, while\nthe destination of executor logs is `$destination/$clusterId/executor`.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.ClusterLogConf",
-                  "x-since-version": "v0.229.0"
-                },
-                "cluster_name": {
-                  "description": "Cluster name requested by the user. This doesn't have to be unique.\nIf not specified at creation, the cluster name will be an empty string.\nFor job clusters, the cluster name is automatically set based on the job and job run IDs.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "custom_tags": {
-                  "description": "Additional tags for cluster resources. Databricks will tag all cluster resources (e.g., AWS\ninstances and EBS volumes) with these tags in addition to `default_tags`. Notes:\n\n- Currently, Databricks allows at most 45 custom tags\n\n- Clusters can only reuse cloud resources if the resources' tags are a subset of the cluster tags",
-                  "$ref": "#/$defs/map/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "data_security_mode": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.DataSecurityMode",
-                  "x-since-version": "v0.229.0"
-                },
-                "docker_image": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.DockerImage",
-                  "x-since-version": "v0.229.0"
-                },
-                "driver_instance_pool_id": {
-                  "description": "The optional ID of the instance pool for the driver of the cluster belongs.\nThe pool cluster uses the instance pool with id (instance_pool_id) if the driver pool is not\nassigned.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "driver_node_type_flexibility": {
-                  "description": "Flexible node type configuration for the driver node.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.NodeTypeFlexibility",
-                  "x-since-version": "v0.285.0"
-                },
-                "driver_node_type_id": {
-                  "description": "The node type of the Spark driver.\nNote that this field is optional; if unset, the driver node type will be set as the same value\nas `node_type_id` defined above.\n\nThis field, along with node_type_id, should not be set if virtual_cluster_size is set.\nIf both driver_node_type_id, node_type_id, and virtual_cluster_size are specified, driver_node_type_id and node_type_id take precedence.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "enable_elastic_disk": {
-                  "description": "Autoscaling Local Storage: when enabled, this cluster will dynamically acquire additional disk\nspace when its Spark workers are running low on disk space.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.229.0"
-                },
-                "enable_local_disk_encryption": {
-                  "description": "Whether to enable LUKS on cluster VMs' local disks",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.229.0"
-                },
-                "gcp_attributes": {
-                  "description": "Attributes related to clusters running on Google Cloud Platform.\nIf not specified at cluster creation, a set of default values will be used.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.GcpAttributes",
-                  "x-since-version": "v0.229.0"
-                },
-                "init_scripts": {
-                  "description": "The configuration for storing init scripts. Any number of destinations can be specified.\nThe scripts are executed sequentially in the order provided.\nIf `cluster_log_conf` is specified, init script logs are sent to `\u003cdestination\u003e/\u003ccluster-ID\u003e/init_scripts`.",
-                  "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/compute.InitScriptInfo",
-                  "x-since-version": "v0.229.0"
-                },
-                "instance_pool_id": {
-                  "description": "The optional ID of the instance pool to which the cluster belongs.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "is_single_node": {
-                  "description": "This field can only be used when `kind = CLASSIC_PREVIEW`.\n\nWhen set to true, Databricks will automatically set single node related `custom_tags`, `spark_conf`, and `num_workers`",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.237.0"
-                },
-                "kind": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.Kind",
-                  "x-since-version": "v0.237.0"
-                },
-                "node_type_id": {
-                  "description": "This field encodes, through a single value, the resources available to each of\nthe Spark nodes in this cluster. For example, the Spark nodes can be provisioned\nand optimized for memory or compute intensive workloads. A list of available node\ntypes can be retrieved by using the :method:clusters/listNodeTypes API call.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "num_workers": {
-                  "description": "Number of worker nodes that this cluster should have. A cluster has one Spark Driver\nand `num_workers` Executors for a total of `num_workers` + 1 Spark nodes.\n\nNote: When reading the properties of a cluster, this field reflects the desired number\nof workers rather than the actual current number of workers. For instance, if a cluster\nis resized from 5 to 10 workers, this field will immediately be updated to reflect\nthe target size of 10 workers, whereas the workers listed in `spark_info` will gradually\nincrease from 5 to 10 as the new nodes are provisioned.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.229.0"
-                },
-                "policy_id": {
-                  "description": "The ID of the cluster policy used to create the cluster if applicable.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "remote_disk_throughput": {
-                  "description": "If set, what the configurable throughput (in Mb/s) for the remote disk is. Currently only supported for GCP HYPERDISK_BALANCED disks.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.257.0"
-                },
-                "runtime_engine": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.RuntimeEngine",
-                  "x-since-version": "v0.229.0"
-                },
-                "single_user_name": {
-                  "description": "Single user name if data_security_mode is `SINGLE_USER`",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "spark_conf": {
-                  "description": "An object containing a set of optional, user-specified Spark configuration key-value pairs.\nUsers can also pass in a string of extra JVM options to the driver and the executors via\n`spark.driver.extraJavaOptions` and `spark.executor.extraJavaOptions` respectively.",
-                  "$ref": "#/$defs/map/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "spark_env_vars": {
-                  "description": "An object containing a set of optional, user-specified environment variable key-value pairs.\nPlease note that key-value pair of the form (X,Y) will be exported as is (i.e.,\n`export X='Y'`) while launching the driver and workers.\n\nIn order to specify an additional set of `SPARK_DAEMON_JAVA_OPTS`, we recommend appending\nthem to `$SPARK_DAEMON_JAVA_OPTS` as shown in the example below. This ensures that all\ndefault databricks managed environmental variables are included as well.\n\nExample Spark environment variables:\n`{\"SPARK_WORKER_MEMORY\": \"28000m\", \"SPARK_LOCAL_DIRS\": \"/local_disk0\"}` or\n`{\"SPARK_DAEMON_JAVA_OPTS\": \"$SPARK_DAEMON_JAVA_OPTS -Dspark.shuffle.service.enabled=true\"}`",
-                  "$ref": "#/$defs/map/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "spark_version": {
-                  "description": "The Spark version of the cluster, e.g. `3.3.x-scala2.11`.\nA list of available Spark versions can be retrieved by using\nthe :method:clusters/sparkVersions API call.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "ssh_public_keys": {
-                  "description": "SSH public key contents that will be added to each Spark node in this cluster. The\ncorresponding private keys can be used to login with the user name `ubuntu` on port `2200`.\nUp to 10 keys can be specified.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "total_initial_remote_disk_size": {
-                  "description": "If set, what the total initial volume size (in GB) of the remote disks should be. Currently only supported for GCP HYPERDISK_BALANCED disks.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.257.0"
-                },
-                "use_ml_runtime": {
-                  "description": "This field can only be used when `kind = CLASSIC_PREVIEW`.\n\n`effective_spark_version` is determined by `spark_version` (DBR release), this field `use_ml_runtime`, and whether `node_type_id` is gpu node or not.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.237.0"
-                },
-                "worker_node_type_flexibility": {
-                  "description": "Flexible node type configuration for worker nodes.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.NodeTypeFlexibility",
-                  "x-since-version": "v0.285.0"
-                },
-                "workload_type": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.WorkloadType",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "compute.DataSecurityMode": {
-              "type": "string",
-              "description": "Data security mode decides what data governance model to use when accessing data\nfrom a cluster.\n\nThe following modes can only be used when `kind = CLASSIC_PREVIEW`.\n* `DATA_SECURITY_MODE_AUTO`: Databricks will choose the most appropriate access mode depending on your compute configuration.\n* `DATA_SECURITY_MODE_STANDARD`: Alias for `USER_ISOLATION`.\n* `DATA_SECURITY_MODE_DEDICATED`: Alias for `SINGLE_USER`.\n\nThe following modes can be used regardless of `kind`.\n* `NONE`: No security isolation for multiple users sharing the cluster. Data governance features are not available in this mode.\n* `SINGLE_USER`: A secure cluster that can only be exclusively used by a single user specified in `single_user_name`. Most programming languages, cluster features and data governance features are available in this mode.\n* `USER_ISOLATION`: A secure cluster that can be shared by multiple users. Cluster users are fully isolated so that they cannot see each other's data and credentials. Most data governance features are supported in this mode. But programming languages and cluster features might be limited.\n\nThe following modes are deprecated starting with Databricks Runtime 15.0 and\nwill be removed for future Databricks Runtime versions:\n\n* `LEGACY_TABLE_ACL`: This mode is for users migrating from legacy Table ACL clusters.\n* `LEGACY_PASSTHROUGH`: This mode is for users migrating from legacy Passthrough on high concurrency clusters.\n* `LEGACY_SINGLE_USER`: This mode is for users migrating from legacy Passthrough on standard clusters.\n* `LEGACY_SINGLE_USER_STANDARD`: This mode provides a way that doesn’t have UC nor passthrough enabled.",
-              "enum": [
-                "NONE",
-                "SINGLE_USER",
-                "USER_ISOLATION",
-                "LEGACY_TABLE_ACL",
-                "LEGACY_PASSTHROUGH",
-                "LEGACY_SINGLE_USER",
-                "LEGACY_SINGLE_USER_STANDARD",
-                "DATA_SECURITY_MODE_STANDARD",
-                "DATA_SECURITY_MODE_DEDICATED",
-                "DATA_SECURITY_MODE_AUTO"
-              ]
-            },
-            "compute.DbfsStorageInfo": {
-              "type": "object",
-              "description": "A storage location in DBFS",
-              "properties": {
-                "destination": {
-                  "description": "dbfs destination, e.g. `dbfs:/my/path`",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "destination"
-              ]
-            },
-            "compute.DockerBasicAuth": {
-              "type": "object",
-              "properties": {
-                "password": {
-                  "description": "Password of the user",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "username": {
-                  "description": "Name of the user",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "compute.DockerImage": {
-              "type": "object",
-              "properties": {
-                "basic_auth": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.DockerBasicAuth",
-                  "x-since-version": "v0.229.0"
-                },
-                "url": {
-                  "description": "URL of the docker image.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "compute.EbsVolumeType": {
-              "type": "string",
-              "description": "All EBS volume types that Databricks supports.\nSee https://aws.amazon.com/ebs/details/ for details.",
-              "enum": [
-                "GENERAL_PURPOSE_SSD",
-                "THROUGHPUT_OPTIMIZED_HDD"
-              ]
-            },
-            "compute.Environment": {
-              "type": "object",
-              "description": "The environment entity used to preserve serverless environment side panel, jobs' environment for non-notebook task, and DLT's environment for classic and serverless pipelines.\nIn this minimal environment spec, only pip and java dependencies are supported.",
-              "properties": {
-                "base_environment": {
-                  "description": "The base environment this environment is built on top of. A base environment defines the environment version and a\nlist of dependencies for serverless compute. The value can be a file path to a custom `env.yaml` file\n(e.g., `/Workspace/path/to/env.yaml`). Support for a Databricks-provided base environment ID\n(e.g., `workspace-base-environments/databricks_ai_v4`) and workspace base environment ID\n(e.g., `workspace-base-environments/dbe_b849b66e-b31a-4cb5-b161-1f2b10877fb7`) is in Beta.\nEither `environment_version` or `base_environment` can be provided.  For more information, see",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.289.0"
-                },
-                "client": {
-                  "description": "Use `environment_version` instead.",
-                  "$ref": "#/$defs/string",
-                  "deprecationMessage": "This field is deprecated",
-                  "x-since-version": "v0.229.0",
-                  "deprecated": true
-                },
-                "dependencies": {
-                  "description": "List of pip dependencies, as supported by the version of pip in this environment.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "environment_version": {
-                  "description": "Either `environment_version` or `base_environment` needs to be provided. Environment version used by the environment.\nEach version comes with a specific Python version and a set of Python packages.\nThe version is a string, consisting of an integer.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.252.0"
-                },
-                "java_dependencies": {
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.271.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "compute.GcpAttributes": {
-              "type": "object",
-              "description": "Attributes set during cluster creation which are related to GCP.",
-              "properties": {
-                "availability": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.GcpAvailability",
-                  "x-since-version": "v0.229.0"
-                },
-                "boot_disk_size": {
-                  "description": "Boot disk size in GB",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.229.0"
-                },
-                "first_on_demand": {
-                  "description": "The first `first_on_demand` nodes of the cluster will be placed on on-demand instances.\nThis value should be greater than 0, to make sure the cluster driver node is placed on an\non-demand instance. If this value is greater than or equal to the current cluster size, all\nnodes will be placed on on-demand instances. If this value is less than the current cluster\nsize, `first_on_demand` nodes will be placed on on-demand instances and the remainder will\nbe placed on `availability` instances. Note that this value does not affect\ncluster size and cannot currently be mutated over the lifetime of a cluster.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.265.0"
-                },
-                "google_service_account": {
-                  "description": "If provided, the cluster will impersonate the google service account when accessing\ngcloud services (like GCS). The google service account\nmust have previously been added to the Databricks environment by an account\nadministrator.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "local_ssd_count": {
-                  "description": "If provided, each node (workers and driver) in the cluster will have this number of local SSDs attached.\nEach local SSD is 375GB in size.\nRefer to [GCP documentation](https://cloud.google.com/compute/docs/disks/local-ssd#choose_number_local_ssds)\nfor the supported number of local SSDs for each instance type.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.229.0"
-                },
-                "use_preemptible_executors": {
-                  "description": "This field determines whether the spark executors will be scheduled to run on preemptible\nVMs (when set to true) versus standard compute engine VMs (when set to false; default).\nNote: Soon to be deprecated, use the 'availability' field instead.",
-                  "$ref": "#/$defs/bool",
-                  "deprecationMessage": "This field is deprecated",
-                  "x-since-version": "v0.229.0",
-                  "deprecated": true
-                },
-                "zone_id": {
-                  "description": "Identifier for the availability zone in which the cluster resides.\nThis can be one of the following:\n- \"HA\" =\u003e High availability, spread nodes across availability zones for a Databricks deployment region [default].\n- \"AUTO\" =\u003e Databricks picks an availability zone to schedule the cluster on.\n- A GCP availability zone =\u003e Pick One of the available zones for (machine type + region) from\nhttps://cloud.google.com/compute/docs/regions-zones.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "compute.GcpAvailability": {
-              "type": "string",
-              "description": "This field determines whether the instance pool will contain preemptible\nVMs, on-demand VMs, or preemptible VMs with a fallback to on-demand VMs if the former is unavailable.",
-              "enum": [
-                "PREEMPTIBLE_GCP",
-                "ON_DEMAND_GCP",
-                "PREEMPTIBLE_WITH_FALLBACK_GCP"
-              ]
-            },
-            "compute.GcsStorageInfo": {
-              "type": "object",
-              "description": "A storage location in Google Cloud Platform's GCS",
-              "properties": {
-                "destination": {
-                  "description": "GCS destination/URI, e.g. `gs://my-bucket/some-prefix`",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "destination"
-              ]
-            },
-            "compute.HardwareAcceleratorType": {
-              "type": "string",
-              "description": "HardwareAcceleratorType: The type of hardware accelerator to use for compute workloads.\nNOTE: This enum is referenced and is intended to be used by other Databricks services\nthat need to specify hardware accelerator requirements for AI compute workloads.",
-              "enum": [
-                "GPU_1xA10",
-                "GPU_8xH100"
-              ]
-            },
-            "compute.InitScriptInfo": {
-              "type": "object",
-              "description": "Config for an individual init script\nNext ID: 11",
-              "properties": {
-                "abfss": {
-                  "description": "Contains the Azure Data Lake Storage destination path",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.Adlsgen2Info",
-                  "x-since-version": "v0.229.0"
-                },
-                "dbfs": {
-                  "description": "destination needs to be provided. e.g.\n`{ \"dbfs\": { \"destination\" : \"dbfs:/home/cluster_log\" } }`",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.DbfsStorageInfo",
-                  "deprecationMessage": "This field is deprecated",
-                  "x-since-version": "v0.229.0",
-                  "deprecated": true
-                },
-                "file": {
-                  "description": "destination needs to be provided, e.g.\n`{ \"file\": { \"destination\": \"file:/my/local/file.sh\" } }`",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.LocalFileInfo",
-                  "x-since-version": "v0.229.0"
-                },
-                "gcs": {
-                  "description": "destination needs to be provided, e.g.\n`{ \"gcs\": { \"destination\": \"gs://my-bucket/file.sh\" } }`",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.GcsStorageInfo",
-                  "x-since-version": "v0.229.0"
-                },
-                "s3": {
-                  "description": "destination and either the region or endpoint need to be provided. e.g.\n`{ \\\"s3\\\": { \\\"destination\\\": \\\"s3://cluster_log_bucket/prefix\\\", \\\"region\\\": \\\"us-west-2\\\" } }`\nCluster iam role is used to access s3, please make sure the cluster iam role in\n`instance_profile_arn` has permission to write data to the s3 destination.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.S3StorageInfo",
-                  "x-since-version": "v0.229.0"
-                },
-                "volumes": {
-                  "description": "destination needs to be provided. e.g.\n`{ \\\"volumes\\\" : { \\\"destination\\\" : \\\"/Volumes/my-init.sh\\\" } }`",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.VolumesStorageInfo",
-                  "x-since-version": "v0.229.0"
-                },
-                "workspace": {
-                  "description": "destination needs to be provided, e.g.\n`{ \"workspace\": { \"destination\": \"/cluster-init-scripts/setup-datadog.sh\" } }`",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.WorkspaceStorageInfo",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "compute.Kind": {
-              "type": "string",
-              "enum": [
-                "CLASSIC_PREVIEW"
-              ]
-            },
-            "compute.Library": {
-              "type": "object",
-              "properties": {
-                "cran": {
-                  "description": "Specification of a CRAN library to be installed as part of the library",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.RCranLibrary",
-                  "x-since-version": "v0.229.0"
-                },
-                "egg": {
-                  "description": "Deprecated. URI of the egg library to install. Installing Python egg files is deprecated and is not supported in Databricks Runtime 14.0 and above.",
-                  "$ref": "#/$defs/string",
-                  "deprecationMessage": "This field is deprecated",
-                  "x-since-version": "v0.229.0",
-                  "deprecated": true
-                },
-                "jar": {
-                  "description": "URI of the JAR library to install. Supported URIs include Workspace paths, Unity Catalog Volumes paths, and S3 URIs.\nFor example: `{ \"jar\": \"/Workspace/path/to/library.jar\" }`, `{ \"jar\" : \"/Volumes/path/to/library.jar\" }` or\n`{ \"jar\": \"s3://my-bucket/library.jar\" }`.\nIf S3 is used, please make sure the cluster has read access on the library. You may need to\nlaunch the cluster with an IAM role to access the S3 URI.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "maven": {
-                  "description": "Specification of a maven library to be installed. For example:\n`{ \"coordinates\": \"org.jsoup:jsoup:1.7.2\" }`",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.MavenLibrary",
-                  "x-since-version": "v0.229.0"
-                },
-                "pypi": {
-                  "description": "Specification of a PyPi library to be installed. For example:\n`{ \"package\": \"simplejson\" }`",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.PythonPyPiLibrary",
-                  "x-since-version": "v0.229.0"
-                },
-                "requirements": {
-                  "description": "URI of the requirements.txt file to install. Only Workspace paths and Unity Catalog Volumes paths are supported.\nFor example: `{ \"requirements\": \"/Workspace/path/to/requirements.txt\" }` or `{ \"requirements\" : \"/Volumes/path/to/requirements.txt\" }`",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "whl": {
-                  "description": "URI of the wheel library to install. Supported URIs include Workspace paths, Unity Catalog Volumes paths, and S3 URIs.\nFor example: `{ \"whl\": \"/Workspace/path/to/library.whl\" }`, `{ \"whl\" : \"/Volumes/path/to/library.whl\" }` or\n`{ \"whl\": \"s3://my-bucket/library.whl\" }`.\nIf S3 is used, please make sure the cluster has read access on the library. You may need to\nlaunch the cluster with an IAM role to access the S3 URI.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "compute.LocalFileInfo": {
-              "type": "object",
-              "properties": {
-                "destination": {
-                  "description": "local file destination, e.g. `file:/my/local/file.sh`",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "destination"
-              ]
-            },
-            "compute.LogAnalyticsInfo": {
-              "type": "object",
-              "properties": {
-                "log_analytics_primary_key": {
-                  "description": "The primary key for the Azure Log Analytics agent configuration",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "log_analytics_workspace_id": {
-                  "description": "The workspace ID for the Azure Log Analytics agent configuration",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "compute.MavenLibrary": {
-              "type": "object",
-              "properties": {
-                "coordinates": {
-                  "description": "Gradle-style maven coordinates. For example: \"org.jsoup:jsoup:1.7.2\".",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "exclusions": {
-                  "description": "List of dependences to exclude. For example: `[\"slf4j:slf4j\", \"*:hadoop-client\"]`.\n\nMaven dependency exclusions:\nhttps://maven.apache.org/guides/introduction/introduction-to-optional-and-excludes-dependencies.html.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "repo": {
-                  "description": "Maven repo to install the Maven package from. If omitted, both Maven Central Repository\nand Spark Packages are searched.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "coordinates"
-              ]
-            },
-            "compute.NodeTypeFlexibility": {
-              "type": "object",
-              "description": "Configuration for flexible node types, allowing fallback to alternate node types during cluster launch and upscale.",
-              "properties": {
-                "alternate_node_type_ids": {
-                  "description": "A list of node type IDs to use as fallbacks when the primary node type is unavailable.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.285.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "compute.PythonPyPiLibrary": {
-              "type": "object",
-              "properties": {
-                "package": {
-                  "description": "The name of the pypi package to install. An optional exact version specification is also\nsupported. Examples: \"simplejson\" and \"simplejson==3.8.0\".",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "repo": {
-                  "description": "The repository where the package can be found. If not specified, the default pip index is\nused.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "package"
-              ]
-            },
-            "compute.RCranLibrary": {
-              "type": "object",
-              "properties": {
-                "package": {
-                  "description": "The name of the CRAN package to install.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "repo": {
-                  "description": "The repository where the package can be found. If not specified, the default CRAN repo is used.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "package"
-              ]
-            },
-            "compute.RuntimeEngine": {
-              "type": "string",
-              "enum": [
-                "NULL",
-                "STANDARD",
-                "PHOTON"
-              ]
-            },
-            "compute.S3StorageInfo": {
-              "type": "object",
-              "description": "A storage location in Amazon S3",
-              "properties": {
-                "canned_acl": {
-                  "description": "(Optional) Set canned access control list for the logs, e.g. `bucket-owner-full-control`.\nIf `canned_cal` is set, please make sure the cluster iam role has `s3:PutObjectAcl` permission on\nthe destination bucket and prefix. The full list of possible canned acl can be found at\nhttp://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl.\nPlease also note that by default only the object owner gets full controls. If you are using cross account\nrole for writing data, you may want to set `bucket-owner-full-control` to make bucket owner able to\nread the logs.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "destination": {
-                  "description": "S3 destination, e.g. `s3://my-bucket/some-prefix` Note that logs will be delivered using\ncluster iam role, please make sure you set cluster iam role and the role has write access to the\ndestination. Please also note that you cannot use AWS keys to deliver logs.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "enable_encryption": {
-                  "description": "(Optional) Flag to enable server side encryption, `false` by default.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.229.0"
-                },
-                "encryption_type": {
-                  "description": "(Optional) The encryption type, it could be `sse-s3` or `sse-kms`. It will be used only when\nencryption is enabled and the default type is `sse-s3`.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "endpoint": {
-                  "description": "S3 endpoint, e.g. `https://s3-us-west-2.amazonaws.com`. Either region or endpoint needs to be set.\nIf both are set, endpoint will be used.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "kms_key": {
-                  "description": "(Optional) Kms key which will be used if encryption is enabled and encryption type is set to `sse-kms`.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "region": {
-                  "description": "S3 region, e.g. `us-west-2`. Either region or endpoint needs to be set. If both are set,\nendpoint will be used.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "destination"
-              ]
-            },
-            "compute.VolumesStorageInfo": {
-              "type": "object",
-              "description": "A storage location back by UC Volumes.",
-              "properties": {
-                "destination": {
-                  "description": "UC Volumes destination, e.g. `/Volumes/catalog/schema/vol1/init-scripts/setup-datadog.sh`\nor `dbfs:/Volumes/catalog/schema/vol1/init-scripts/setup-datadog.sh`",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "destination"
-              ]
-            },
-            "compute.WorkloadType": {
-              "type": "object",
-              "description": "Cluster Attributes showing for clusters workload types.",
-              "properties": {
-                "clients": {
-                  "description": "defined what type of clients can use the cluster. E.g. Notebooks, Jobs",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.ClientsTypes",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "clients"
-              ]
-            },
-            "compute.WorkspaceStorageInfo": {
-              "type": "object",
-              "description": "A storage location in Workspace Filesystem (WSFS)",
-              "properties": {
-                "destination": {
-                  "description": "wsfs destination, e.g. `workspace:/cluster-init-scripts/setup-datadog.sh`",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "destination"
-              ]
-            },
-            "dashboards.LifecycleState": {
-              "type": "string",
-              "enum": [
-                "ACTIVE",
-                "TRASHED"
-              ]
-            },
-            "database.CustomTag": {
-              "type": "object",
-              "properties": {
-                "key": {
-                  "description": "The key of the custom tag.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.273.0"
-                },
-                "value": {
-                  "description": "The value of the custom tag.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.273.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "database.DatabaseInstanceRef": {
-              "type": "object",
-              "description": "DatabaseInstanceRef is a reference to a database instance. It is used in the\nDatabaseInstance object to refer to the parent instance of an instance and\nto refer the child instances of an instance.\nTo specify as a parent instance during creation of an instance,\nthe lsn and branch_time fields are optional. If not specified, the child\ninstance will be created from the latest lsn of the parent.\nIf both lsn and branch_time are specified, the lsn will be used to create\nthe child instance.",
-              "properties": {
-                "branch_time": {
-                  "description": "Branch time of the ref database instance.\nFor a parent ref instance, this is the point in time on the parent instance from which the\ninstance was created.\nFor a child ref instance, this is the point in time on the instance from which the child\ninstance was created.\nInput: For specifying the point in time to create a child instance. Optional.\nOutput: Only populated if provided as input to create a child instance.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.265.0"
-                },
-                "lsn": {
-                  "description": "User-specified WAL LSN of the ref database instance.\n\nInput: For specifying the WAL LSN to create a child instance. Optional.\nOutput: Only populated if provided as input to create a child instance.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.265.0"
-                },
-                "name": {
-                  "description": "Name of the ref database instance.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.265.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "database.DatabaseInstanceState": {
-              "type": "string",
-              "enum": [
-                "STARTING",
-                "AVAILABLE",
-                "DELETING",
-                "STOPPED",
-                "UPDATING",
-                "FAILING_OVER"
-              ]
-            },
-            "database.DeltaTableSyncInfo": {
-              "type": "object",
-              "additionalProperties": false
-            },
-            "database.NewPipelineSpec": {
-              "type": "object",
-              "description": "Custom fields that user can set for pipeline while creating SyncedDatabaseTable.\nNote that other fields of pipeline are still inferred by table def internally",
-              "properties": {
-                "budget_policy_id": {
-                  "description": "Budget policy to set on the newly created pipeline.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.279.0"
-                },
-                "storage_catalog": {
-                  "description": "This field needs to be specified if the destination catalog is a managed postgres catalog.\n\nUC catalog for the pipeline to store intermediate files (checkpoints, event logs etc).\nThis needs to be a standard catalog where the user has permissions to create Delta tables.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.266.0"
-                },
-                "storage_schema": {
-                  "description": "This field needs to be specified if the destination catalog is a managed postgres catalog.\n\nUC schema for the pipeline to store intermediate files (checkpoints, event logs etc).\nThis needs to be in the standard catalog where the user has permissions to create Delta tables.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.266.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "database.ProvisioningInfoState": {
-              "type": "string",
-              "enum": [
-                "PROVISIONING",
-                "ACTIVE",
-                "FAILED",
-                "DELETING",
-                "UPDATING",
-                "DEGRADED"
-              ]
-            },
-            "database.ProvisioningPhase": {
-              "type": "string",
-              "enum": [
-                "PROVISIONING_PHASE_MAIN",
-                "PROVISIONING_PHASE_INDEX_SCAN",
-                "PROVISIONING_PHASE_INDEX_SORT"
-              ]
-            },
-            "database.SyncedTableContinuousUpdateStatus": {
-              "type": "object",
-              "description": "Detailed status of a synced table. Shown if the synced table is in the SYNCED_CONTINUOUS_UPDATE\nor the SYNCED_UPDATING_PIPELINE_RESOURCES state.",
-              "additionalProperties": false
-            },
-            "database.SyncedTableFailedStatus": {
-              "type": "object",
-              "description": "Detailed status of a synced table. Shown if the synced table is in the OFFLINE_FAILED or the\nSYNCED_PIPELINE_FAILED state.",
-              "additionalProperties": false
-            },
-            "database.SyncedTablePipelineProgress": {
-              "type": "object",
-              "description": "Progress information of the Synced Table data synchronization pipeline.",
-              "additionalProperties": false
-            },
-            "database.SyncedTablePosition": {
-              "type": "object",
-              "additionalProperties": false
-            },
-            "database.SyncedTableProvisioningStatus": {
-              "type": "object",
-              "description": "Detailed status of a synced table. Shown if the synced table is in the\nPROVISIONING_PIPELINE_RESOURCES or the PROVISIONING_INITIAL_SNAPSHOT state.",
-              "additionalProperties": false
-            },
-            "database.SyncedTableSchedulingPolicy": {
-              "type": "string",
-              "enum": [
-                "CONTINUOUS",
-                "TRIGGERED",
-                "SNAPSHOT"
-              ]
-            },
-            "database.SyncedTableSpec": {
-              "type": "object",
-              "description": "Specification of a synced database table.",
-              "properties": {
-                "create_database_objects_if_missing": {
-                  "description": "If true, the synced table's logical database and schema resources in PG\nwill be created if they do not already exist.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.266.0"
-                },
-                "existing_pipeline_id": {
-                  "description": "At most one of existing_pipeline_id and new_pipeline_spec should be defined.\n\nIf existing_pipeline_id is defined, the synced table will be bin packed into the existing pipeline\nreferenced. This avoids creating a new pipeline and allows sharing existing compute.\nIn this case, the scheduling_policy of this synced table must match the scheduling policy of the existing pipeline.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.266.0"
-                },
-                "new_pipeline_spec": {
-                  "description": "At most one of existing_pipeline_id and new_pipeline_spec should be defined.\n\nIf new_pipeline_spec is defined, a new pipeline is created for this synced table. The location pointed to is used\nto store intermediate files (checkpoints, event logs etc). The caller must have write permissions to create Delta\ntables in the specified catalog and schema. Again, note this requires write permissions, whereas the source table\nonly requires read permissions.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/database.NewPipelineSpec",
-                  "x-since-version": "v0.266.0"
-                },
-                "primary_key_columns": {
-                  "description": "Primary Key columns to be used for data insert/update in the destination.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.266.0"
-                },
-                "scheduling_policy": {
-                  "description": "Scheduling policy of the underlying pipeline.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/database.SyncedTableSchedulingPolicy",
-                  "x-since-version": "v0.266.0"
-                },
-                "source_table_full_name": {
-                  "description": "Three-part (catalog, schema, table) name of the source Delta table.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.266.0"
-                },
-                "timeseries_key": {
-                  "description": "Time series key to deduplicate (tie-break) rows with the same primary key.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.266.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "database.SyncedTableState": {
-              "type": "string",
-              "description": "The state of a synced table.",
-              "enum": [
-                "SYNCED_TABLE_PROVISIONING",
-                "SYNCED_TABLE_PROVISIONING_PIPELINE_RESOURCES",
-                "SYNCED_TABLE_PROVISIONING_INITIAL_SNAPSHOT",
-                "SYNCED_TABLE_ONLINE",
-                "SYNCED_TABLE_ONLINE_CONTINUOUS_UPDATE",
-                "SYNCED_TABLE_ONLINE_TRIGGERED_UPDATE",
-                "SYNCED_TABLE_ONLINE_NO_PENDING_UPDATE",
-                "SYNCED_TABLED_OFFLINE",
-                "SYNCED_TABLE_OFFLINE_FAILED",
-                "SYNCED_TABLE_ONLINE_PIPELINE_FAILED",
-                "SYNCED_TABLE_ONLINE_UPDATING_PIPELINE_RESOURCES"
-              ]
-            },
-            "database.SyncedTableStatus": {
-              "type": "object",
-              "description": "Status of a synced table.",
-              "properties": {
-                "continuous_update_status": {
-                  "description": "Detailed status of a synced table. Shown if the synced table is in the SYNCED_CONTINUOUS_UPDATE\nor the SYNCED_UPDATING_PIPELINE_RESOURCES state.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/database.SyncedTableContinuousUpdateStatus",
-                  "x-since-version": "v0.266.0"
-                },
-                "failed_status": {
-                  "description": "Detailed status of a synced table. Shown if the synced table is in the OFFLINE_FAILED or the\nSYNCED_PIPELINE_FAILED state.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/database.SyncedTableFailedStatus",
-                  "x-since-version": "v0.266.0"
-                },
-                "provisioning_status": {
-                  "description": "Detailed status of a synced table. Shown if the synced table is in the\nPROVISIONING_PIPELINE_RESOURCES or the PROVISIONING_INITIAL_SNAPSHOT state.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/database.SyncedTableProvisioningStatus",
-                  "x-since-version": "v0.266.0"
-                },
-                "triggered_update_status": {
-                  "description": "Detailed status of a synced table. Shown if the synced table is in the SYNCED_TRIGGERED_UPDATE\nor the SYNCED_NO_PENDING_UPDATE state.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/database.SyncedTableTriggeredUpdateStatus",
-                  "x-since-version": "v0.266.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "database.SyncedTableTriggeredUpdateStatus": {
-              "type": "object",
-              "description": "Detailed status of a synced table. Shown if the synced table is in the SYNCED_TRIGGERED_UPDATE\nor the SYNCED_NO_PENDING_UPDATE state.",
-              "additionalProperties": false
-            },
-            "iam.PermissionLevel": {
-              "type": "string",
-              "description": "Permission level",
-              "enum": [
-                "CAN_MANAGE",
-                "CAN_RESTART",
-                "CAN_ATTACH_TO",
-                "IS_OWNER",
-                "CAN_MANAGE_RUN",
-                "CAN_VIEW",
-                "CAN_READ",
-                "CAN_RUN",
-                "CAN_EDIT",
-                "CAN_USE",
-                "CAN_MANAGE_STAGING_VERSIONS",
-                "CAN_MANAGE_PRODUCTION_VERSIONS",
-                "CAN_EDIT_METADATA",
-                "CAN_VIEW_METADATA",
-                "CAN_BIND",
-                "CAN_QUERY",
-                "CAN_MONITOR",
-                "CAN_CREATE",
-                "CAN_MONITOR_ONLY",
-                "CAN_CREATE_APP"
-              ]
-            },
-            "jobs.AlertTask": {
-              "type": "object",
-              "properties": {
-                "alert_id": {
-                  "description": "The alert_id is the canonical identifier of the alert.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.296.0"
-                },
-                "subscribers": {
-                  "description": "The subscribers receive alert evaluation result notifications after the alert task is completed.\nThe number of subscriptions is limited to 100.",
-                  "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.AlertTaskSubscriber",
-                  "x-since-version": "v0.296.0"
-                },
-                "warehouse_id": {
-                  "description": "The warehouse_id identifies the warehouse settings used by the alert task.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.296.0"
-                },
-                "workspace_path": {
-                  "description": "The workspace_path is the path to the alert file in the workspace. The path:\n* must start with \"/Workspace\"\n* must be a normalized path.\nUser has to select only one of alert_id or workspace_path to identify the alert.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.296.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "jobs.AlertTaskSubscriber": {
-              "type": "object",
-              "description": "Represents a subscriber that will receive alert notifications.\nA subscriber can be either a user (via email) or a notification destination (via destination_id).",
-              "properties": {
-                "destination_id": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.296.0"
-                },
-                "user_name": {
-                  "description": "A valid workspace email address.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.296.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "jobs.AuthenticationMethod": {
-              "type": "string",
-              "enum": [
-                "OAUTH",
-                "PAT"
-              ]
-            },
-            "jobs.CleanRoomsNotebookTask": {
-              "type": "object",
-              "description": "Clean Rooms notebook task for V1 Clean Room service (GA).\nReplaces the deprecated CleanRoomNotebookTask (defined above) which was for V0 service.",
-              "properties": {
-                "clean_room_name": {
-                  "description": "The clean room that the notebook belongs to.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.237.0"
-                },
-                "etag": {
-                  "description": "Checksum to validate the freshness of the notebook resource (i.e. the notebook being run is the latest version).\nIt can be fetched by calling the :method:cleanroomassets/get API.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.237.0"
-                },
-                "notebook_base_parameters": {
-                  "description": "Base parameters to be used for the clean room notebook job.",
-                  "$ref": "#/$defs/map/string",
-                  "x-since-version": "v0.237.0"
-                },
-                "notebook_name": {
-                  "description": "Name of the notebook being run.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.237.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "clean_room_name",
-                "notebook_name"
-              ]
-            },
-            "jobs.Compute": {
-              "type": "object",
-              "properties": {
-                "hardware_accelerator": {
-                  "description": "Hardware accelerator configuration for Serverless GPU workloads.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.HardwareAcceleratorType",
-                  "x-since-version": "v0.288.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "jobs.ComputeConfig": {
-              "type": "object",
-              "properties": {
-                "gpu_node_pool_id": {
-                  "description": "IDof the GPU pool to use.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.243.0"
-                },
-                "gpu_type": {
-                  "description": "GPU type.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.243.0"
-                },
-                "num_gpus": {
-                  "description": "Number of GPUs.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.243.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "num_gpus"
-              ]
-            },
-            "jobs.Condition": {
-              "type": "string",
-              "enum": [
-                "ANY_UPDATED",
-                "ALL_UPDATED"
-              ]
-            },
-            "jobs.ConditionTask": {
-              "type": "object",
-              "properties": {
-                "left": {
-                  "description": "The left operand of the condition task. Can be either a string value or a job state or parameter reference.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "op": {
-                  "description": "* `EQUAL_TO`, `NOT_EQUAL` operators perform string comparison of their operands. This means that `“12.0” == “12”` will evaluate to `false`.\n* `GREATER_THAN`, `GREATER_THAN_OR_EQUAL`, `LESS_THAN`, `LESS_THAN_OR_EQUAL` operators perform numeric comparison of their operands. `“12.0” \u003e= “12”` will evaluate to `true`, `“10.0” \u003e= “12”` will evaluate to `false`.\n\nThe boolean comparison to task values can be implemented with operators `EQUAL_TO`, `NOT_EQUAL`. If a task value was set to a boolean value, it will be serialized to `“true”` or `“false”` for the comparison.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.ConditionTaskOp",
-                  "x-since-version": "v0.229.0"
-                },
-                "right": {
-                  "description": "The right operand of the condition task. Can be either a string value or a job state or parameter reference.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "left",
-                "op",
-                "right"
-              ]
-            },
-            "jobs.ConditionTaskOp": {
-              "type": "string",
-              "description": "* `EQUAL_TO`, `NOT_EQUAL` operators perform string comparison of their operands. This means that `“12.0” == “12”` will evaluate to `false`.\n* `GREATER_THAN`, `GREATER_THAN_OR_EQUAL`, `LESS_THAN`, `LESS_THAN_OR_EQUAL` operators perform numeric comparison of their operands. `“12.0” \u003e= “12”` will evaluate to `true`, `“10.0” \u003e= “12”` will evaluate to `false`.\n\nThe boolean comparison to task values can be implemented with operators `EQUAL_TO`, `NOT_EQUAL`. If a task value was set to a boolean value, it will be serialized to `“true”` or `“false”` for the comparison.",
-              "enum": [
-                "EQUAL_TO",
-                "GREATER_THAN",
-                "GREATER_THAN_OR_EQUAL",
-                "LESS_THAN",
-                "LESS_THAN_OR_EQUAL",
-                "NOT_EQUAL"
-              ]
-            },
-            "jobs.Continuous": {
-              "type": "object",
-              "properties": {
-                "pause_status": {
-                  "description": "Indicate whether the continuous execution of the job is paused or not. Defaults to UNPAUSED.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PauseStatus",
-                  "x-since-version": "v0.229.0"
-                },
-                "task_retry_mode": {
-                  "description": "Indicate whether the continuous job is applying task level retries or not. Defaults to NEVER.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.TaskRetryMode",
-                  "x-since-version": "v0.267.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "jobs.CronSchedule": {
-              "type": "object",
-              "properties": {
-                "pause_status": {
-                  "description": "Indicate whether this schedule is paused or not.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PauseStatus",
-                  "x-since-version": "v0.229.0"
-                },
-                "quartz_cron_expression": {
-                  "description": "A Cron expression using Quartz syntax that describes the schedule for a job. See [Cron Trigger](http://www.quartz-scheduler.org/documentation/quartz-2.3.0/tutorials/crontrigger.html) for details. This field is required.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "timezone_id": {
-                  "description": "A Java timezone ID. The schedule for a job is resolved with respect to this timezone. See [Java TimeZone](https://docs.oracle.com/javase/7/docs/api/java/util/TimeZone.html) for details. This field is required.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "quartz_cron_expression",
-                "timezone_id"
-              ]
-            },
-            "jobs.DashboardTask": {
-              "type": "object",
-              "description": "Configures the Lakeview Dashboard job task type.",
-              "properties": {
-                "dashboard_id": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.248.0"
-                },
-                "filters": {
-                  "description": "Dashboard task parameters. Used to apply dashboard filter values during dashboard task execution. Parameter values get applied to any dashboard filters that have a matching URL identifier as the parameter key.\nThe parameter value format is dependent on the filter type:\n- For text and single-select filters, provide a single value (e.g. `\"value\"`)\n- For date and datetime filters, provide the value in ISO 8601 format (e.g. `\"2000-01-01T00:00:00\"`)\n- For multi-select filters, provide a JSON array of values (e.g. `\"[\\\"value1\\\",\\\"value2\\\"]\"`)\n- For range and date range filters, provide a JSON object with `start` and `end` (e.g. `\"{\\\"start\\\":\\\"1\\\",\\\"end\\\":\\\"10\\\"}\"`)",
-                  "$ref": "#/$defs/map/string",
-                  "x-databricks-preview": "PRIVATE",
-                  "doNotSuggest": true,
-                  "x-since-version": "v0.289.0"
-                },
-                "subscription": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.Subscription",
-                  "x-since-version": "v0.248.0"
-                },
-                "warehouse_id": {
-                  "description": "Optional: The warehouse id to execute the dashboard with for the schedule.\nIf not specified, the default warehouse of the dashboard will be used.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.248.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "jobs.DbtCloudTask": {
-              "type": "object",
-              "description": "Deprecated in favor of DbtPlatformTask",
-              "properties": {
-                "connection_resource_name": {
-                  "description": "The resource name of the UC connection that authenticates the dbt Cloud for this task",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.256.0"
-                },
-                "dbt_cloud_job_id": {
-                  "description": "Id of the dbt Cloud job to be triggered",
-                  "$ref": "#/$defs/int64",
-                  "x-since-version": "v0.256.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "jobs.DbtPlatformTask": {
-              "type": "object",
-              "properties": {
-                "connection_resource_name": {
-                  "description": "The resource name of the UC connection that authenticates the dbt platform for this task",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.257.0"
-                },
-                "dbt_platform_job_id": {
-                  "description": "Id of the dbt platform job to be triggered. Specified as a string for maximum compatibility with clients.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.257.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "jobs.DbtTask": {
-              "type": "object",
-              "properties": {
-                "catalog": {
-                  "description": "Optional name of the catalog to use. The value is the top level in the 3-level namespace of Unity Catalog (catalog / schema / relation). The catalog value can only be specified if a warehouse_id is specified. Requires dbt-databricks \u003e= 1.1.1.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "commands": {
-                  "description": "A list of dbt commands to execute. All commands must start with `dbt`. This parameter must not be empty. A maximum of up to 10 commands can be provided.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "profiles_directory": {
-                  "description": "Optional (relative) path to the profiles directory. Can only be specified if no warehouse_id is specified. If no warehouse_id is specified and this folder is unset, the root directory is used.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "project_directory": {
-                  "description": "Path to the project directory. Optional for Git sourced tasks, in which\ncase if no value is provided, the root of the Git repository is used.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "schema": {
-                  "description": "Optional schema to write to. This parameter is only used when a warehouse_id is also provided. If not provided, the `default` schema is used.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "source": {
-                  "description": "Optional location type of the project directory. When set to `WORKSPACE`, the project will be retrieved\nfrom the local Databricks workspace. When set to `GIT`, the project will be retrieved from a Git repository\ndefined in `git_source`. If the value is empty, the task will use `GIT` if `git_source` is defined and `WORKSPACE` otherwise.\n\n* `WORKSPACE`: Project is located in Databricks workspace.\n* `GIT`: Project is located in cloud Git provider.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.Source",
-                  "x-since-version": "v0.229.0"
-                },
-                "warehouse_id": {
-                  "description": "ID of the SQL warehouse to connect to. If provided, we automatically generate and provide the profile and connection details to dbt. It can be overridden on a per-command basis by using the `--profiles-dir` command line argument.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "commands"
-              ]
-            },
-            "jobs.FileArrivalTriggerConfiguration": {
-              "type": "object",
-              "properties": {
-                "min_time_between_triggers_seconds": {
-                  "description": "If set, the trigger starts a run only after the specified amount of time passed since\nthe last time the trigger fired. The minimum allowed value is 60 seconds",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.229.0"
-                },
-                "url": {
-                  "description": "URL to be monitored for file arrivals. The path must point to the root or a subpath of the external location.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "wait_after_last_change_seconds": {
-                  "description": "If set, the trigger starts a run only after no file activity has occurred for the specified amount of time.\nThis makes it possible to wait for a batch of incoming files to arrive before triggering a run. The\nminimum allowed value is 60 seconds.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "url"
-              ]
-            },
-            "jobs.ForEachTask": {
-              "type": "object",
-              "properties": {
-                "concurrency": {
-                  "description": "An optional maximum allowed number of concurrent runs of the task.\nSet this value if you want to be able to execute multiple runs of the task concurrently.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.229.0"
-                },
-                "inputs": {
-                  "description": "Array for task to iterate on. This can be a JSON string or a reference to\nan array parameter.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "task": {
-                  "description": "Configuration for the task that will be run for each element in the array",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.Task",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "inputs",
-                "task"
-              ]
-            },
-            "jobs.Format": {
-              "type": "string",
-              "enum": [
-                "SINGLE_TASK",
-                "MULTI_TASK"
-              ]
-            },
-            "jobs.GenAiComputeTask": {
-              "type": "object",
-              "properties": {
-                "command": {
-                  "description": "Command launcher to run the actual script, e.g. bash, python etc.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.243.0"
-                },
-                "compute": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.ComputeConfig",
-                  "x-since-version": "v0.243.0"
-                },
-                "dl_runtime_image": {
-                  "description": "Runtime image",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.243.0"
-                },
-                "mlflow_experiment_name": {
-                  "description": "Optional string containing the name of the MLflow experiment to log the run to. If name is not\nfound, backend will create the mlflow experiment using the name.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.243.0"
-                },
-                "source": {
-                  "description": "Optional location type of the training script. When set to `WORKSPACE`, the script will be retrieved from the local Databricks workspace. When set to `GIT`, the script will be retrieved from a Git repository\ndefined in `git_source`. If the value is empty, the task will use `GIT` if `git_source` is defined and `WORKSPACE` otherwise.\n* `WORKSPACE`: Script is located in Databricks workspace.\n* `GIT`: Script is located in cloud Git provider.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.Source",
-                  "x-since-version": "v0.243.0"
-                },
-                "training_script_path": {
-                  "description": "The training script file path to be executed. Cloud file URIs (such as dbfs:/, s3:/, adls:/, gcs:/) and workspace paths are supported. For python files stored in the Databricks workspace, the path must be absolute and begin with `/`. For files stored in a remote repository, the path must be relative. This field is required.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.243.0"
-                },
-                "yaml_parameters": {
-                  "description": "Optional string containing model parameters passed to the training script in yaml format.\nIf present, then the content in yaml_parameters_file_path will be ignored.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.243.0"
-                },
-                "yaml_parameters_file_path": {
-                  "description": "Optional path to a YAML file containing model parameters passed to the training script.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.243.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "dl_runtime_image"
-              ]
-            },
-            "jobs.GitProvider": {
-              "type": "string",
-              "enum": [
-                "gitHub",
-                "bitbucketCloud",
-                "azureDevOpsServices",
-                "gitHubEnterprise",
-                "bitbucketServer",
-                "gitLab",
-                "gitLabEnterpriseEdition",
-                "awsCodeCommit"
-              ]
-            },
-            "jobs.GitSnapshot": {
-              "type": "object",
-              "description": "Read-only state of the remote repository at the time the job was run. This field is only included on job runs.",
-              "properties": {
-                "used_commit": {
-                  "description": "Commit that was used to execute the run. If git_branch was specified, this points to the HEAD of the branch at the time of the run; if git_tag was specified, this points to the commit the tag points to.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "jobs.GitSource": {
-              "type": "object",
-              "description": "An optional specification for a remote Git repository containing the source code used by tasks. Version-controlled source code is supported by notebook, dbt, Python script, and SQL File tasks.\n\nIf `git_source` is set, these tasks retrieve the file from the remote repository by default. However, this behavior can be overridden by setting `source` to `WORKSPACE` on the task.\n\nNote: dbt and SQL File tasks support only version-controlled sources. If dbt or SQL File tasks are used, `git_source` must be defined on the job.",
-              "properties": {
-                "git_branch": {
-                  "description": "Name of the branch to be checked out and used by this job. This field cannot be specified in conjunction with git_tag or git_commit.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "git_commit": {
-                  "description": "Commit to be checked out and used by this job. This field cannot be specified in conjunction with git_branch or git_tag.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "git_provider": {
-                  "description": "Unique identifier of the service used to host the Git repository. The value is case insensitive.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.GitProvider",
-                  "x-since-version": "v0.229.0"
-                },
-                "git_tag": {
-                  "description": "Name of the tag to be checked out and used by this job. This field cannot be specified in conjunction with git_branch or git_commit.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "git_url": {
-                  "description": "URL of the repository to be cloned by this job.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "sparse_checkout": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SparseCheckout",
-                  "x-since-version": "v0.290.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "git_provider",
-                "git_url"
-              ]
-            },
-            "jobs.JobCluster": {
-              "type": "object",
-              "properties": {
-                "job_cluster_key": {
-                  "description": "A unique name for the job cluster. This field is required and must be unique within the job.\n`JobTaskSettings` may refer to this field to determine which cluster to launch for the task execution.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "new_cluster": {
-                  "description": "If new_cluster, a description of a cluster that is created for each task.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.ClusterSpec",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "job_cluster_key",
-                "new_cluster"
-              ]
-            },
-            "jobs.JobDeployment": {
-              "type": "object",
-              "properties": {
-                "kind": {
-                  "description": "The kind of deployment that manages the job.\n\n* `BUNDLE`: The job is managed by Databricks Asset Bundle.\n* `SYSTEM_MANAGED`: The job is managed by Databricks and is read-only.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobDeploymentKind",
-                  "x-since-version": "v0.229.0"
-                },
-                "metadata_file_path": {
-                  "description": "Path of the file that contains deployment metadata.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "kind"
-              ]
-            },
-            "jobs.JobDeploymentKind": {
-              "type": "string",
-              "description": "* `BUNDLE`: The job is managed by Databricks Asset Bundle.\n* `SYSTEM_MANAGED`: The job is managed by Databricks and is read-only.",
-              "enum": [
-                "BUNDLE",
-                "SYSTEM_MANAGED"
-              ]
-            },
-            "jobs.JobEditMode": {
-              "type": "string",
-              "description": "Edit mode of the job.\n\n* `UI_LOCKED`: The job is in a locked UI state and cannot be modified.\n* `EDITABLE`: The job is in an editable state and can be modified.",
-              "enum": [
-                "UI_LOCKED",
-                "EDITABLE"
-              ]
-            },
-            "jobs.JobEmailNotifications": {
-              "type": "object",
-              "properties": {
-                "no_alert_for_skipped_runs": {
-                  "description": "If true, do not send email to recipients specified in `on_failure` if the run is skipped.\nThis field is `deprecated`. Please use the `notification_settings.no_alert_for_skipped_runs` field.",
-                  "$ref": "#/$defs/bool",
-                  "deprecationMessage": "This field is deprecated",
-                  "x-since-version": "v0.229.0",
-                  "deprecated": true
-                },
-                "on_duration_warning_threshold_exceeded": {
-                  "description": "A list of email addresses to be notified when the duration of a run exceeds the threshold specified for the `RUN_DURATION_SECONDS` metric in the `health` field. If no rule for the `RUN_DURATION_SECONDS` metric is specified in the `health` field for the job, notifications are not sent.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "on_failure": {
-                  "description": "A list of email addresses to be notified when a run unsuccessfully completes. A run is considered to have completed unsuccessfully if it ends with an `INTERNAL_ERROR` `life_cycle_state` or a `FAILED`, or `TIMED_OUT` result_state. If this is not specified on job creation, reset, or update the list is empty, and notifications are not sent.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "on_start": {
-                  "description": "A list of email addresses to be notified when a run begins. If not specified on job creation, reset, or update, the list is empty, and notifications are not sent.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "on_streaming_backlog_exceeded": {
-                  "description": "A list of email addresses to notify when any streaming backlog thresholds are exceeded for any stream.\nStreaming backlog thresholds can be set in the `health` field using the following metrics: `STREAMING_BACKLOG_BYTES`, `STREAMING_BACKLOG_RECORDS`, `STREAMING_BACKLOG_SECONDS`, or `STREAMING_BACKLOG_FILES`.\nAlerting is based on the 10-minute average of these metrics. If the issue persists, notifications are resent every 30 minutes.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "on_success": {
-                  "description": "A list of email addresses to be notified when a run successfully completes. A run is considered to have completed successfully if it ends with a `TERMINATED` `life_cycle_state` and a `SUCCESS` result_state. If not specified on job creation, reset, or update, the list is empty, and notifications are not sent.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "jobs.JobEnvironment": {
-              "type": "object",
-              "properties": {
-                "environment_key": {
-                  "description": "The key of an environment. It has to be unique within a job.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "spec": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.Environment",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "environment_key"
-              ]
-            },
-            "jobs.JobNotificationSettings": {
-              "type": "object",
-              "properties": {
-                "no_alert_for_canceled_runs": {
-                  "description": "If true, do not send notifications to recipients specified in `on_failure` if the run is canceled.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.229.0"
-                },
-                "no_alert_for_skipped_runs": {
-                  "description": "If true, do not send notifications to recipients specified in `on_failure` if the run is skipped.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "jobs.JobParameterDefinition": {
-              "type": "object",
-              "properties": {
-                "default": {
-                  "description": "Default value of the parameter.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "name": {
-                  "description": "The name of the defined parameter. May only contain alphanumeric characters, `_`, `-`, and `.`",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "default",
-                "name"
-              ]
-            },
-            "jobs.JobPermissionLevel": {
-              "type": "string",
-              "description": "Permission level",
-              "enum": [
-                "CAN_MANAGE",
-                "IS_OWNER",
-                "CAN_MANAGE_RUN",
-                "CAN_VIEW"
-              ]
-            },
-            "jobs.JobRunAs": {
-              "type": "object",
-              "description": "Write-only setting. Specifies the user or service principal that the job runs as. If not specified, the job runs as the user who created the job.\n\nEither `user_name` or `service_principal_name` should be specified. If not, an error is thrown.",
-              "properties": {
-                "group_name": {
-                  "description": "Group name of an account group assigned to the workspace. Setting this field requires being a member of the group.",
-                  "$ref": "#/$defs/string",
-                  "x-databricks-preview": "PRIVATE",
-                  "doNotSuggest": true,
-                  "x-since-version": "v0.283.0"
-                },
-                "service_principal_name": {
-                  "description": "The application ID of an active service principal. Setting this field requires the `servicePrincipal/user` role.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "user_name": {
-                  "description": "The email of an active workspace user. Non-admin users can only set this field to their own email.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "jobs.JobSource": {
-              "type": "object",
-              "description": "The source of the job specification in the remote repository when the job is source controlled.",
-              "properties": {
-                "dirty_state": {
-                  "description": "Dirty state indicates the job is not fully synced with the job specification in the remote repository.\n\nPossible values are:\n* `NOT_SYNCED`: The job is not yet synced with the remote job specification. Import the remote job specification from UI to make the job fully synced.\n* `DISCONNECTED`: The job is temporary disconnected from the remote job specification and is allowed for live edit. Import the remote job specification again from UI to make the job fully synced.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobSourceDirtyState",
-                  "x-since-version": "v0.229.0"
-                },
-                "import_from_git_branch": {
-                  "description": "Name of the branch which the job is imported from.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "job_config_path": {
-                  "description": "Path of the job YAML file that contains the job specification.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "import_from_git_branch",
-                "job_config_path"
-              ]
-            },
-            "jobs.JobSourceDirtyState": {
-              "type": "string",
-              "description": "Dirty state indicates the job is not fully synced with the job specification\nin the remote repository.\n\nPossible values are:\n* `NOT_SYNCED`: The job is not yet synced with the remote job specification. Import the remote job specification from UI to make the job fully synced.\n* `DISCONNECTED`: The job is temporary disconnected from the remote job specification and is allowed for live edit. Import the remote job specification again from UI to make the job fully synced.",
-              "enum": [
-                "NOT_SYNCED",
-                "DISCONNECTED"
-              ]
-            },
-            "jobs.JobsHealthMetric": {
-              "type": "string",
-              "description": "Specifies the health metric that is being evaluated for a particular health rule.\n\n* `RUN_DURATION_SECONDS`: Expected total time for a run in seconds.\n* `STREAMING_BACKLOG_BYTES`: An estimate of the maximum bytes of data waiting to be consumed across all streams. This metric is in Public Preview.\n* `STREAMING_BACKLOG_RECORDS`: An estimate of the maximum offset lag across all streams. This metric is in Public Preview.\n* `STREAMING_BACKLOG_SECONDS`: An estimate of the maximum consumer delay across all streams. This metric is in Public Preview.\n* `STREAMING_BACKLOG_FILES`: An estimate of the maximum number of outstanding files across all streams. This metric is in Public Preview.",
-              "enum": [
-                "RUN_DURATION_SECONDS",
-                "STREAMING_BACKLOG_BYTES",
-                "STREAMING_BACKLOG_RECORDS",
-                "STREAMING_BACKLOG_SECONDS",
-                "STREAMING_BACKLOG_FILES"
-              ]
-            },
-            "jobs.JobsHealthOperator": {
-              "type": "string",
-              "description": "Specifies the operator used to compare the health metric value with the specified threshold.",
-              "enum": [
-                "GREATER_THAN"
-              ]
-            },
-            "jobs.JobsHealthRule": {
-              "type": "object",
-              "properties": {
-                "metric": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobsHealthMetric",
-                  "x-since-version": "v0.229.0"
-                },
-                "op": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobsHealthOperator",
-                  "x-since-version": "v0.229.0"
-                },
-                "value": {
-                  "description": "Specifies the threshold value that the health metric should obey to satisfy the health rule.",
-                  "$ref": "#/$defs/int64",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "metric",
-                "op",
-                "value"
-              ]
-            },
-            "jobs.JobsHealthRules": {
-              "type": "object",
-              "description": "An optional set of health rules that can be defined for this job.",
-              "properties": {
-                "rules": {
-                  "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.JobsHealthRule",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "jobs.ModelTriggerConfiguration": {
-              "type": "object",
-              "properties": {
-                "aliases": {
-                  "description": "Aliases of the model versions to monitor. Can only be used in conjunction with condition MODEL_ALIAS_SET.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.279.0"
-                },
-                "condition": {
-                  "description": "The condition based on which to trigger a job run.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.ModelTriggerConfigurationCondition",
-                  "x-since-version": "v0.279.0"
-                },
-                "min_time_between_triggers_seconds": {
-                  "description": "If set, the trigger starts a run only after the specified amount of time has passed since\nthe last time the trigger fired. The minimum allowed value is 60 seconds.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.279.0"
-                },
-                "securable_name": {
-                  "description": "Name of the securable to monitor (\"mycatalog.myschema.mymodel\" in the case of model-level triggers,\n\"mycatalog.myschema\" in the case of schema-level triggers) or empty in the case of metastore-level triggers.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.279.0"
-                },
-                "wait_after_last_change_seconds": {
-                  "description": "If set, the trigger starts a run only after no model updates have occurred for the specified time\nand can be used to wait for a series of model updates before triggering a run. The\nminimum allowed value is 60 seconds.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.279.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "condition"
-              ]
-            },
-            "jobs.ModelTriggerConfigurationCondition": {
-              "type": "string",
-              "enum": [
-                "MODEL_CREATED",
-                "MODEL_VERSION_READY",
-                "MODEL_ALIAS_SET"
-              ]
-            },
-            "jobs.NotebookTask": {
-              "type": "object",
-              "properties": {
-                "base_parameters": {
-                  "description": "Base parameters to be used for each run of this job. If the run is initiated by a call to :method:jobs/run\nNow with parameters specified, the two parameters maps are merged. If the same key is specified in\n`base_parameters` and in `run-now`, the value from `run-now` is used.\nUse [Task parameter variables](https://docs.databricks.com/jobs.html#parameter-variables) to set parameters containing information about job runs.\n\nIf the notebook takes a parameter that is not specified in the job’s `base_parameters` or the `run-now` override parameters,\nthe default value from the notebook is used.\n\nRetrieve these parameters in a notebook using [dbutils.widgets.get](https://docs.databricks.com/dev-tools/databricks-utils.html#dbutils-widgets).\n\nThe JSON representation of this field cannot exceed 1MB.",
-                  "$ref": "#/$defs/map/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "notebook_path": {
-                  "description": "The path of the notebook to be run in the Databricks workspace or remote repository.\nFor notebooks stored in the Databricks workspace, the path must be absolute and begin with a slash.\nFor notebooks stored in a remote repository, the path must be relative. This field is required.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "source": {
-                  "description": "Optional location type of the notebook. When set to `WORKSPACE`, the notebook will be retrieved from the local Databricks workspace. When set to `GIT`, the notebook will be retrieved from a Git repository\ndefined in `git_source`. If the value is empty, the task will use `GIT` if `git_source` is defined and `WORKSPACE` otherwise.\n* `WORKSPACE`: Notebook is located in Databricks workspace.\n* `GIT`: Notebook is located in cloud Git provider.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.Source",
-                  "x-since-version": "v0.229.0"
-                },
-                "warehouse_id": {
-                  "description": "Optional `warehouse_id` to run the notebook on a SQL warehouse. Classic SQL warehouses are NOT supported, please use serverless or pro SQL warehouses.\n\nNote that SQL warehouses only support SQL cells; if the notebook contains non-SQL cells, the run will fail.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "notebook_path"
-              ]
-            },
-            "jobs.PauseStatus": {
-              "type": "string",
-              "enum": [
-                "UNPAUSED",
-                "PAUSED"
-              ]
-            },
-            "jobs.PerformanceTarget": {
-              "type": "string",
-              "description": "PerformanceTarget defines how performant (lower latency) or cost efficient the execution of run on serverless compute should be.\nThe performance mode on the job or pipeline should map to a performance setting that is passed to Cluster Manager\n(see cluster-common PerformanceTarget).",
-              "enum": [
-                "PERFORMANCE_OPTIMIZED",
-                "STANDARD"
-              ]
-            },
-            "jobs.PeriodicTriggerConfiguration": {
-              "type": "object",
-              "properties": {
-                "interval": {
-                  "description": "The interval at which the trigger should run.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.229.0"
-                },
-                "unit": {
-                  "description": "The unit of time for the interval.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PeriodicTriggerConfigurationTimeUnit",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "interval",
-                "unit"
-              ]
-            },
-            "jobs.PeriodicTriggerConfigurationTimeUnit": {
-              "type": "string",
-              "enum": [
-                "HOURS",
-                "DAYS",
-                "WEEKS"
-              ]
-            },
-            "jobs.PipelineParams": {
-              "type": "object",
-              "properties": {
-                "full_refresh": {
-                  "description": "If true, triggers a full refresh on the delta live table.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "jobs.PipelineTask": {
-              "type": "object",
-              "properties": {
-                "full_refresh": {
-                  "description": "If true, triggers a full refresh on the delta live table.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.229.0"
-                },
-                "pipeline_id": {
-                  "description": "The full name of the pipeline task to execute.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "pipeline_id"
-              ]
-            },
-            "jobs.PowerBiModel": {
-              "type": "object",
-              "properties": {
-                "authentication_method": {
-                  "description": "How the published Power BI model authenticates to Databricks",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.AuthenticationMethod",
-                  "x-since-version": "v0.248.0"
-                },
-                "model_name": {
-                  "description": "The name of the Power BI model",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.248.0"
-                },
-                "overwrite_existing": {
-                  "description": "Whether to overwrite existing Power BI models",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.248.0"
-                },
-                "storage_mode": {
-                  "description": "The default storage mode of the Power BI model",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.StorageMode",
-                  "x-since-version": "v0.248.0"
-                },
-                "workspace_name": {
-                  "description": "The name of the Power BI workspace of the model",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.248.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "jobs.PowerBiTable": {
-              "type": "object",
-              "properties": {
-                "catalog": {
-                  "description": "The catalog name in Databricks",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.248.0"
-                },
-                "name": {
-                  "description": "The table name in Databricks",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.248.0"
-                },
-                "schema": {
-                  "description": "The schema name in Databricks",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.248.0"
-                },
-                "storage_mode": {
-                  "description": "The Power BI storage mode of the table",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.StorageMode",
-                  "x-since-version": "v0.248.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "jobs.PowerBiTask": {
-              "type": "object",
-              "properties": {
-                "connection_resource_name": {
-                  "description": "The resource name of the UC connection to authenticate from Databricks to Power BI",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.248.0"
-                },
-                "power_bi_model": {
-                  "description": "The semantic model to update",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PowerBiModel",
-                  "x-since-version": "v0.248.0"
-                },
-                "refresh_after_update": {
-                  "description": "Whether the model should be refreshed after the update",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.248.0"
-                },
-                "tables": {
-                  "description": "The tables to be exported to Power BI",
-                  "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.PowerBiTable",
-                  "x-since-version": "v0.248.0"
-                },
-                "warehouse_id": {
-                  "description": "The SQL warehouse ID to use as the Power BI data source",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.248.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "jobs.PythonWheelTask": {
-              "type": "object",
-              "properties": {
-                "entry_point": {
-                  "description": "Named entry point to use, if it does not exist in the metadata of the package it executes the function from the package directly using `$packageName.$entryPoint()`",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "named_parameters": {
-                  "description": "Command-line parameters passed to Python wheel task in the form of `[\"--name=task\", \"--data=dbfs:/path/to/data.json\"]`. Leave it empty if `parameters` is not null.",
-                  "$ref": "#/$defs/map/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "package_name": {
-                  "description": "Name of the package to execute",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "parameters": {
-                  "description": "Command-line parameters passed to Python wheel task. Leave it empty if `named_parameters` is not null.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "entry_point",
-                "package_name"
-              ]
-            },
-            "jobs.QueueSettings": {
-              "type": "object",
-              "properties": {
-                "enabled": {
-                  "description": "If true, enable queueing for the job. This is a required field.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "enabled"
-              ]
-            },
-            "jobs.RunIf": {
-              "type": "string",
-              "description": "An optional value indicating the condition that determines whether the task should be run once its dependencies have been completed. When omitted, defaults to `ALL_SUCCESS`.\n\nPossible values are:\n* `ALL_SUCCESS`: All dependencies have executed and succeeded\n* `AT_LEAST_ONE_SUCCESS`: At least one dependency has succeeded\n* `NONE_FAILED`: None of the dependencies have failed and at least one was executed\n* `ALL_DONE`: All dependencies have been completed\n* `AT_LEAST_ONE_FAILED`: At least one dependency failed\n* `ALL_FAILED`: ALl dependencies have failed",
-              "enum": [
-                "ALL_SUCCESS",
-                "ALL_DONE",
-                "NONE_FAILED",
-                "AT_LEAST_ONE_SUCCESS",
-                "ALL_FAILED",
-                "AT_LEAST_ONE_FAILED"
-              ]
-            },
-            "jobs.RunJobTask": {
-              "type": "object",
-              "properties": {
-                "dbt_commands": {
-                  "description": "An array of commands to execute for jobs with the dbt task, for example `\"dbt_commands\": [\"dbt deps\", \"dbt seed\", \"dbt deps\", \"dbt seed\", \"dbt run\"]`\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-databricks-preview": "PRIVATE",
-                  "deprecationMessage": "This field is deprecated",
-                  "doNotSuggest": true,
-                  "x-since-version": "v0.229.0",
-                  "deprecated": true
-                },
-                "jar_params": {
-                  "description": "A list of parameters for jobs with Spark JAR tasks, for example `\"jar_params\": [\"john doe\", \"35\"]`.\nThe parameters are used to invoke the main function of the main class specified in the Spark JAR task.\nIf not specified upon `run-now`, it defaults to an empty list.\njar_params cannot be specified in conjunction with notebook_params.\nThe JSON representation of this field (for example `{\"jar_params\":[\"john doe\",\"35\"]}`) cannot exceed 10,000 bytes.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-databricks-preview": "PRIVATE",
-                  "deprecationMessage": "This field is deprecated",
-                  "doNotSuggest": true,
-                  "x-since-version": "v0.229.0",
-                  "deprecated": true
-                },
-                "job_id": {
-                  "description": "ID of the job to trigger.",
-                  "$ref": "#/$defs/int64",
-                  "x-since-version": "v0.229.0"
-                },
-                "job_parameters": {
-                  "description": "Job-level parameters used to trigger the job.",
-                  "$ref": "#/$defs/map/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "notebook_params": {
-                  "description": "A map from keys to values for jobs with notebook task, for example `\"notebook_params\": {\"name\": \"john doe\", \"age\": \"35\"}`.\nThe map is passed to the notebook and is accessible through the [dbutils.widgets.get](https://docs.databricks.com/dev-tools/databricks-utils.html) function.\n\nIf not specified upon `run-now`, the triggered run uses the job’s base parameters.\n\nnotebook_params cannot be specified in conjunction with jar_params.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.\n\nThe JSON representation of this field (for example `{\"notebook_params\":{\"name\":\"john doe\",\"age\":\"35\"}}`) cannot exceed 10,000 bytes.",
-                  "$ref": "#/$defs/map/string",
-                  "x-databricks-preview": "PRIVATE",
-                  "deprecationMessage": "This field is deprecated",
-                  "doNotSuggest": true,
-                  "x-since-version": "v0.229.0",
-                  "deprecated": true
-                },
-                "pipeline_params": {
-                  "description": "Controls whether the pipeline should perform a full refresh",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PipelineParams",
-                  "x-since-version": "v0.229.0"
-                },
-                "python_named_params": {
-                  "$ref": "#/$defs/map/string",
-                  "x-databricks-preview": "PRIVATE",
-                  "deprecationMessage": "This field is deprecated",
-                  "doNotSuggest": true,
-                  "x-since-version": "v0.229.0",
-                  "deprecated": true
-                },
-                "python_params": {
-                  "description": "A list of parameters for jobs with Python tasks, for example `\"python_params\": [\"john doe\", \"35\"]`.\nThe parameters are passed to Python file as command-line parameters. If specified upon `run-now`, it would overwrite\nthe parameters specified in job setting. The JSON representation of this field (for example `{\"python_params\":[\"john doe\",\"35\"]}`)\ncannot exceed 10,000 bytes.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.\n\nImportant\n\nThese parameters accept only Latin characters (ASCII character set). Using non-ASCII characters returns an error.\nExamples of invalid, non-ASCII characters are Chinese, Japanese kanjis, and emojis.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-databricks-preview": "PRIVATE",
-                  "deprecationMessage": "This field is deprecated",
-                  "doNotSuggest": true,
-                  "x-since-version": "v0.229.0",
-                  "deprecated": true
-                },
-                "spark_submit_params": {
-                  "description": "A list of parameters for jobs with spark submit task, for example `\"spark_submit_params\": [\"--class\", \"org.apache.spark.examples.SparkPi\"]`.\nThe parameters are passed to spark-submit script as command-line parameters. If specified upon `run-now`, it would overwrite the\nparameters specified in job setting. The JSON representation of this field (for example `{\"python_params\":[\"john doe\",\"35\"]}`)\ncannot exceed 10,000 bytes.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.\n\nImportant\n\nThese parameters accept only Latin characters (ASCII character set). Using non-ASCII characters returns an error.\nExamples of invalid, non-ASCII characters are Chinese, Japanese kanjis, and emojis.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-databricks-preview": "PRIVATE",
-                  "deprecationMessage": "This field is deprecated",
-                  "doNotSuggest": true,
-                  "x-since-version": "v0.229.0",
-                  "deprecated": true
-                },
-                "sql_params": {
-                  "description": "A map from keys to values for jobs with SQL task, for example `\"sql_params\": {\"name\": \"john doe\", \"age\": \"35\"}`. The SQL alert task does not support custom parameters.\n\n⚠ **Deprecation note** Use [job parameters](https://docs.databricks.com/jobs/job-parameters.html#job-parameter-pushdown) to pass information down to tasks.",
-                  "$ref": "#/$defs/map/string",
-                  "x-databricks-preview": "PRIVATE",
-                  "deprecationMessage": "This field is deprecated",
-                  "doNotSuggest": true,
-                  "x-since-version": "v0.229.0",
-                  "deprecated": true
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "job_id"
-              ]
-            },
-            "jobs.Source": {
-              "type": "string",
-              "description": "Optional location type of the SQL file. When set to `WORKSPACE`, the SQL file will be retrieved\\\nfrom the local Databricks workspace. When set to `GIT`, the SQL file will be retrieved from a Git repository\ndefined in `git_source`. If the value is empty, the task will use `GIT` if `git_source` is defined and `WORKSPACE` otherwise.\n\n* `WORKSPACE`: SQL file is located in Databricks workspace.\n* `GIT`: SQL file is located in cloud Git provider.",
-              "enum": [
-                "WORKSPACE",
-                "GIT"
-              ]
-            },
-            "jobs.SparkJarTask": {
-              "type": "object",
-              "properties": {
-                "jar_uri": {
-                  "description": "Deprecated since 04/2016. For classic compute, provide a `jar` through the `libraries` field instead. For serverless compute, provide a `jar` though the `java_dependencies` field inside the `environments` list.\n\nSee the examples of classic and serverless compute usage at the top of the page.",
-                  "$ref": "#/$defs/string",
-                  "deprecationMessage": "This field is deprecated",
-                  "x-since-version": "v0.229.0",
-                  "deprecated": true
-                },
-                "main_class_name": {
-                  "description": "The full name of the class containing the main method to be executed. This class must be contained in a JAR provided as a library.\n\nThe code must use `SparkContext.getOrCreate` to obtain a Spark context; otherwise, runs of the job fail.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "parameters": {
-                  "description": "Parameters passed to the main method.\n\nUse [Task parameter variables](https://docs.databricks.com/jobs.html#parameter-variables) to set parameters containing information about job runs.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "run_as_repl": {
-                  "description": "Deprecated. A value of `false` is no longer supported.",
-                  "$ref": "#/$defs/bool",
-                  "deprecationMessage": "This field is deprecated",
-                  "x-since-version": "v0.240.0",
-                  "deprecated": true
-                }
-              },
-              "additionalProperties": false
-            },
-            "jobs.SparkPythonTask": {
-              "type": "object",
-              "properties": {
-                "parameters": {
-                  "description": "Command line parameters passed to the Python file.\n\nUse [Task parameter variables](https://docs.databricks.com/jobs.html#parameter-variables) to set parameters containing information about job runs.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "python_file": {
-                  "description": "The Python file to be executed. Cloud file URIs (such as dbfs:/, s3:/, adls:/, gcs:/) and workspace paths are supported. For python files stored in the Databricks workspace, the path must be absolute and begin with `/`. For files stored in a remote repository, the path must be relative. This field is required.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "source": {
-                  "description": "Optional location type of the Python file. When set to `WORKSPACE` or not specified, the file will be retrieved from the local\nDatabricks workspace or cloud location (if the `python_file` has a URI format). When set to `GIT`,\nthe Python file will be retrieved from a Git repository defined in `git_source`.\n\n* `WORKSPACE`: The Python file is located in a Databricks workspace or at a cloud filesystem URI.\n* `GIT`: The Python file is located in a remote Git repository.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.Source",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "python_file"
-              ]
-            },
-            "jobs.SparkSubmitTask": {
-              "type": "object",
-              "properties": {
-                "parameters": {
-                  "description": "Command-line parameters passed to spark submit.\n\nUse [Task parameter variables](https://docs.databricks.com/jobs.html#parameter-variables) to set parameters containing information about job runs.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "jobs.SparseCheckout": {
-              "type": "object",
-              "properties": {
-                "patterns": {
-                  "description": "List of patterns to include for sparse checkout.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.290.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "jobs.SqlTask": {
-              "type": "object",
-              "properties": {
-                "alert": {
-                  "description": "If alert, indicates that this job must refresh a SQL alert.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SqlTaskAlert",
-                  "x-since-version": "v0.229.0"
-                },
-                "dashboard": {
-                  "description": "If dashboard, indicates that this job must refresh a SQL dashboard.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SqlTaskDashboard",
-                  "x-since-version": "v0.229.0"
-                },
-                "file": {
-                  "description": "If file, indicates that this job runs a SQL file in a remote Git repository.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SqlTaskFile",
-                  "x-since-version": "v0.229.0"
-                },
-                "parameters": {
-                  "description": "Parameters to be used for each run of this job. The SQL alert task does not support custom parameters.",
-                  "$ref": "#/$defs/map/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "query": {
-                  "description": "If query, indicates that this job must execute a SQL query.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SqlTaskQuery",
-                  "x-since-version": "v0.229.0"
-                },
-                "warehouse_id": {
-                  "description": "The canonical identifier of the SQL warehouse. Recommended to use with serverless or pro SQL warehouses. Classic SQL warehouses are only supported for SQL alert, dashboard and query tasks and are limited to scheduled single-task jobs.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "warehouse_id"
-              ]
-            },
-            "jobs.SqlTaskAlert": {
-              "type": "object",
-              "properties": {
-                "alert_id": {
-                  "description": "The canonical identifier of the SQL alert.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "pause_subscriptions": {
-                  "description": "If true, the alert notifications are not sent to subscribers.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.229.0"
-                },
-                "subscriptions": {
-                  "description": "If specified, alert notifications are sent to subscribers.",
-                  "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.SqlTaskSubscription",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "alert_id"
-              ]
-            },
-            "jobs.SqlTaskDashboard": {
-              "type": "object",
-              "properties": {
-                "custom_subject": {
-                  "description": "Subject of the email sent to subscribers of this task.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "dashboard_id": {
-                  "description": "The canonical identifier of the SQL dashboard.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "pause_subscriptions": {
-                  "description": "If true, the dashboard snapshot is not taken, and emails are not sent to subscribers.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.229.0"
-                },
-                "subscriptions": {
-                  "description": "If specified, dashboard snapshots are sent to subscriptions.",
-                  "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.SqlTaskSubscription",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "dashboard_id"
-              ]
-            },
-            "jobs.SqlTaskFile": {
-              "type": "object",
-              "properties": {
-                "path": {
-                  "description": "Path of the SQL file. Must be relative if the source is a remote Git repository and absolute for workspace paths.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "source": {
-                  "description": "Optional location type of the SQL file. When set to `WORKSPACE`, the SQL file will be retrieved\nfrom the local Databricks workspace. When set to `GIT`, the SQL file will be retrieved from a Git repository\ndefined in `git_source`. If the value is empty, the task will use `GIT` if `git_source` is defined and `WORKSPACE` otherwise.\n\n* `WORKSPACE`: SQL file is located in Databricks workspace.\n* `GIT`: SQL file is located in cloud Git provider.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.Source",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "path"
-              ]
-            },
-            "jobs.SqlTaskQuery": {
-              "type": "object",
-              "properties": {
-                "query_id": {
-                  "description": "The canonical identifier of the SQL query.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "query_id"
-              ]
-            },
-            "jobs.SqlTaskSubscription": {
-              "type": "object",
-              "properties": {
-                "destination_id": {
-                  "description": "The canonical identifier of the destination to receive email notification. This parameter is mutually exclusive with user_name. You cannot set both destination_id and user_name for subscription notifications.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "user_name": {
-                  "description": "The user name to receive the subscription email. This parameter is mutually exclusive with destination_id. You cannot set both destination_id and user_name for subscription notifications.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "jobs.StorageMode": {
-              "type": "string",
-              "enum": [
-                "DIRECT_QUERY",
-                "IMPORT",
-                "DUAL"
-              ]
-            },
-            "jobs.Subscription": {
-              "type": "object",
-              "properties": {
-                "custom_subject": {
-                  "description": "Optional: Allows users to specify a custom subject line on the email sent\nto subscribers.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.248.0"
-                },
-                "paused": {
-                  "description": "When true, the subscription will not send emails.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.248.0"
-                },
-                "subscribers": {
-                  "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.SubscriptionSubscriber",
-                  "x-since-version": "v0.248.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "jobs.SubscriptionSubscriber": {
-              "type": "object",
-              "properties": {
-                "destination_id": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.248.0"
-                },
-                "user_name": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.248.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "jobs.TableUpdateTriggerConfiguration": {
-              "type": "object",
-              "properties": {
-                "condition": {
-                  "description": "The table(s) condition based on which to trigger a job run.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.Condition",
-                  "x-since-version": "v0.229.0"
-                },
-                "min_time_between_triggers_seconds": {
-                  "description": "If set, the trigger starts a run only after the specified amount of time has passed since\nthe last time the trigger fired. The minimum allowed value is 60 seconds.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.229.0"
-                },
-                "table_names": {
-                  "description": "A list of tables to monitor for changes. The table name must be in the format `catalog_name.schema_name.table_name`.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "wait_after_last_change_seconds": {
-                  "description": "If set, the trigger starts a run only after no table updates have occurred for the specified time\nand can be used to wait for a series of table updates before triggering a run. The\nminimum allowed value is 60 seconds.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "table_names"
-              ]
-            },
-            "jobs.Task": {
-              "type": "object",
-              "properties": {
-                "alert_task": {
-                  "description": "The task evaluates a Databricks alert and sends notifications to subscribers\nwhen the `alert_task` field is present.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.AlertTask",
-                  "x-since-version": "v0.296.0"
-                },
-                "clean_rooms_notebook_task": {
-                  "description": "The task runs a [clean rooms](https://docs.databricks.com/clean-rooms/index.html) notebook\nwhen the `clean_rooms_notebook_task` field is present.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.CleanRoomsNotebookTask",
-                  "x-since-version": "v0.237.0"
-                },
-                "compute": {
-                  "description": "Task level compute configuration.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.Compute",
-                  "x-since-version": "v0.288.0"
-                },
-                "condition_task": {
-                  "description": "The task evaluates a condition that can be used to control the execution of other tasks when the `condition_task` field is present.\nThe condition task does not require a cluster to execute and does not support retries or notifications.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.ConditionTask",
-                  "x-since-version": "v0.229.0"
-                },
-                "dashboard_task": {
-                  "description": "The task refreshes a dashboard and sends a snapshot to subscribers.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.DashboardTask",
-                  "x-since-version": "v0.248.0"
-                },
-                "dbt_cloud_task": {
-                  "description": "Task type for dbt cloud, deprecated in favor of the new name dbt_platform_task",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.DbtCloudTask",
-                  "x-databricks-preview": "PRIVATE",
-                  "deprecationMessage": "This field is deprecated",
-                  "doNotSuggest": true,
-                  "x-since-version": "v0.256.0",
-                  "deprecated": true
-                },
-                "dbt_platform_task": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.DbtPlatformTask",
-                  "x-databricks-preview": "PRIVATE",
-                  "doNotSuggest": true,
-                  "x-since-version": "v0.257.0"
-                },
-                "dbt_task": {
-                  "description": "The task runs one or more dbt commands when the `dbt_task` field is present. The dbt task requires both Databricks SQL and the ability to use a serverless or a pro SQL warehouse.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.DbtTask",
-                  "x-since-version": "v0.229.0"
-                },
-                "depends_on": {
-                  "description": "An optional array of objects specifying the dependency graph of the task. All tasks specified in this field must complete before executing this task. The task will run only if the `run_if` condition is true.\nThe key is `task_key`, and the value is the name assigned to the dependent task.",
-                  "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.TaskDependency",
-                  "x-since-version": "v0.229.0"
-                },
-                "description": {
-                  "description": "An optional description for this task.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "disable_auto_optimization": {
-                  "description": "An option to disable auto optimization in serverless",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.229.0"
-                },
-                "disabled": {
-                  "description": "An optional flag to disable the task. If set to true, the task will not run even if it is part of a job.",
-                  "$ref": "#/$defs/bool",
-                  "x-databricks-preview": "PRIVATE",
-                  "doNotSuggest": true,
-                  "x-since-version": "v0.271.0"
-                },
-                "email_notifications": {
-                  "description": "An optional set of email addresses that is notified when runs of this task begin or complete as well as when this task is deleted. The default behavior is to not send any emails.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.TaskEmailNotifications",
-                  "x-since-version": "v0.229.0"
-                },
-                "environment_key": {
-                  "description": "The key that references an environment spec in a job. This field is required for Python script, Python wheel and dbt tasks when using serverless compute.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "existing_cluster_id": {
-                  "description": "If existing_cluster_id, the ID of an existing cluster that is used for all runs.\nWhen running jobs or tasks on an existing cluster, you may need to manually restart\nthe cluster if it stops responding. We suggest running jobs and tasks on new clusters for\ngreater reliability",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "for_each_task": {
-                  "description": "The task executes a nested task for every input provided when the `for_each_task` field is present.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.ForEachTask",
-                  "x-since-version": "v0.229.0"
-                },
-                "gen_ai_compute_task": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.GenAiComputeTask",
-                  "x-databricks-preview": "PRIVATE",
-                  "doNotSuggest": true,
-                  "x-since-version": "v0.243.0"
-                },
-                "health": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobsHealthRules",
-                  "x-since-version": "v0.229.0"
-                },
-                "job_cluster_key": {
-                  "description": "If job_cluster_key, this task is executed reusing the cluster specified in `job.settings.job_clusters`.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "libraries": {
-                  "description": "An optional list of libraries to be installed on the cluster.\nThe default value is an empty list.",
-                  "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/compute.Library",
-                  "x-since-version": "v0.229.0"
-                },
-                "max_retries": {
-                  "description": "An optional maximum number of times to retry an unsuccessful run. A run is considered to be unsuccessful if it completes with the `FAILED` result_state or `INTERNAL_ERROR` `life_cycle_state`. The value `-1` means to retry indefinitely and the value `0` means to never retry.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.229.0"
-                },
-                "min_retry_interval_millis": {
-                  "description": "An optional minimal interval in milliseconds between the start of the failed run and the subsequent retry run. The default behavior is that unsuccessful runs are immediately retried.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.229.0"
-                },
-                "new_cluster": {
-                  "description": "If new_cluster, a description of a new cluster that is created for each run.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.ClusterSpec",
-                  "x-since-version": "v0.229.0"
-                },
-                "notebook_task": {
-                  "description": "The task runs a notebook when the `notebook_task` field is present.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.NotebookTask",
-                  "x-since-version": "v0.229.0"
-                },
-                "notification_settings": {
-                  "description": "Optional notification settings that are used when sending notifications to each of the `email_notifications` and `webhook_notifications` for this task.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.TaskNotificationSettings",
-                  "x-since-version": "v0.229.0"
-                },
-                "pipeline_task": {
-                  "description": "The task triggers a pipeline update when the `pipeline_task` field is present. Only pipelines configured to use triggered more are supported.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PipelineTask",
-                  "x-since-version": "v0.229.0"
-                },
-                "power_bi_task": {
-                  "description": "The task triggers a Power BI semantic model update when the `power_bi_task` field is present.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PowerBiTask",
-                  "x-since-version": "v0.248.0"
-                },
-                "python_wheel_task": {
-                  "description": "The task runs a Python wheel when the `python_wheel_task` field is present.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PythonWheelTask",
-                  "x-since-version": "v0.229.0"
-                },
-                "retry_on_timeout": {
-                  "description": "An optional policy to specify whether to retry a job when it times out. The default behavior\nis to not retry on timeout.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.229.0"
-                },
-                "run_if": {
-                  "description": "An optional value specifying the condition determining whether the task is run once its dependencies have been completed.\n\n* `ALL_SUCCESS`: All dependencies have executed and succeeded\n* `AT_LEAST_ONE_SUCCESS`: At least one dependency has succeeded\n* `NONE_FAILED`: None of the dependencies have failed and at least one was executed\n* `ALL_DONE`: All dependencies have been completed\n* `AT_LEAST_ONE_FAILED`: At least one dependency failed\n* `ALL_FAILED`: ALl dependencies have failed",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.RunIf",
-                  "x-since-version": "v0.229.0"
-                },
-                "run_job_task": {
-                  "description": "The task triggers another job when the `run_job_task` field is present.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.RunJobTask",
-                  "x-since-version": "v0.229.0"
-                },
-                "spark_jar_task": {
-                  "description": "The task runs a JAR when the `spark_jar_task` field is present.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SparkJarTask",
-                  "x-since-version": "v0.229.0"
-                },
-                "spark_python_task": {
-                  "description": "The task runs a Python file when the `spark_python_task` field is present.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SparkPythonTask",
-                  "x-since-version": "v0.229.0"
-                },
-                "spark_submit_task": {
-                  "description": "(Legacy) The task runs the spark-submit script when the spark_submit_task field is present. Databricks recommends using the spark_jar_task instead; see [Spark Submit task for jobs](/jobs/spark-submit).",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SparkSubmitTask",
-                  "deprecationMessage": "This field is deprecated",
-                  "x-since-version": "v0.229.0",
-                  "deprecated": true
-                },
-                "sql_task": {
-                  "description": "The task runs a SQL query or file, or it refreshes a SQL alert or a legacy SQL dashboard when the `sql_task` field is present.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SqlTask",
-                  "x-since-version": "v0.229.0"
-                },
-                "task_key": {
-                  "description": "A unique name for the task. This field is used to refer to this task from other tasks.\nThis field is required and must be unique within its parent job.\nOn Update or Reset, this field is used to reference the tasks to be updated or reset.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "timeout_seconds": {
-                  "description": "An optional timeout applied to each run of this job task. A value of `0` means no timeout.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.229.0"
-                },
-                "webhook_notifications": {
-                  "description": "A collection of system notification IDs to notify when runs of this task begin or complete. The default behavior is to not send any system notifications.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.WebhookNotifications",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "task_key"
-              ]
-            },
-            "jobs.TaskDependency": {
-              "type": "object",
-              "properties": {
-                "outcome": {
-                  "description": "Can only be specified on condition task dependencies. The outcome of the dependent task that must be met for this task to run.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "task_key": {
-                  "description": "The name of the task this task depends on.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "task_key"
-              ]
-            },
-            "jobs.TaskEmailNotifications": {
-              "type": "object",
-              "properties": {
-                "no_alert_for_skipped_runs": {
-                  "description": "If true, do not send email to recipients specified in `on_failure` if the run is skipped.\nThis field is `deprecated`. Please use the `notification_settings.no_alert_for_skipped_runs` field.",
-                  "$ref": "#/$defs/bool",
-                  "deprecationMessage": "This field is deprecated",
-                  "x-since-version": "v0.229.0",
-                  "deprecated": true
-                },
-                "on_duration_warning_threshold_exceeded": {
-                  "description": "A list of email addresses to be notified when the duration of a run exceeds the threshold specified for the `RUN_DURATION_SECONDS` metric in the `health` field. If no rule for the `RUN_DURATION_SECONDS` metric is specified in the `health` field for the job, notifications are not sent.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "on_failure": {
-                  "description": "A list of email addresses to be notified when a run unsuccessfully completes. A run is considered to have completed unsuccessfully if it ends with an `INTERNAL_ERROR` `life_cycle_state` or a `FAILED`, or `TIMED_OUT` result_state. If this is not specified on job creation, reset, or update the list is empty, and notifications are not sent.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "on_start": {
-                  "description": "A list of email addresses to be notified when a run begins. If not specified on job creation, reset, or update, the list is empty, and notifications are not sent.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "on_streaming_backlog_exceeded": {
-                  "description": "A list of email addresses to notify when any streaming backlog thresholds are exceeded for any stream.\nStreaming backlog thresholds can be set in the `health` field using the following metrics: `STREAMING_BACKLOG_BYTES`, `STREAMING_BACKLOG_RECORDS`, `STREAMING_BACKLOG_SECONDS`, or `STREAMING_BACKLOG_FILES`.\nAlerting is based on the 10-minute average of these metrics. If the issue persists, notifications are resent every 30 minutes.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "on_success": {
-                  "description": "A list of email addresses to be notified when a run successfully completes. A run is considered to have completed successfully if it ends with a `TERMINATED` `life_cycle_state` and a `SUCCESS` result_state. If not specified on job creation, reset, or update, the list is empty, and notifications are not sent.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "jobs.TaskNotificationSettings": {
-              "type": "object",
-              "properties": {
-                "alert_on_last_attempt": {
-                  "description": "If true, do not send notifications to recipients specified in `on_start` for the retried runs and do not send notifications to recipients specified in `on_failure` until the last retry of the run.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.229.0"
-                },
-                "no_alert_for_canceled_runs": {
-                  "description": "If true, do not send notifications to recipients specified in `on_failure` if the run is canceled.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.229.0"
-                },
-                "no_alert_for_skipped_runs": {
-                  "description": "If true, do not send notifications to recipients specified in `on_failure` if the run is skipped.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "jobs.TaskRetryMode": {
-              "type": "string",
-              "description": "task retry mode of the continuous job\n* NEVER: The failed task will not be retried.\n* ON_FAILURE: Retry a failed task if at least one other task in the job is still running its first attempt.\nWhen this condition is no longer met or the retry limit is reached, the job run is cancelled and a new run is started.",
-              "enum": [
-                "NEVER",
-                "ON_FAILURE"
-              ]
-            },
-            "jobs.TriggerSettings": {
-              "type": "object",
-              "properties": {
-                "file_arrival": {
-                  "description": "File arrival trigger settings.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.FileArrivalTriggerConfiguration",
-                  "x-since-version": "v0.229.0"
-                },
-                "model": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.ModelTriggerConfiguration",
-                  "x-databricks-preview": "PRIVATE",
-                  "doNotSuggest": true,
-                  "x-since-version": "v0.279.0"
-                },
-                "pause_status": {
-                  "description": "Whether this trigger is paused or not.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PauseStatus",
-                  "x-since-version": "v0.229.0"
-                },
-                "periodic": {
-                  "description": "Periodic trigger settings.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PeriodicTriggerConfiguration",
-                  "x-since-version": "v0.229.0"
-                },
-                "table_update": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.TableUpdateTriggerConfiguration",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "jobs.Webhook": {
-              "type": "object",
-              "properties": {
-                "id": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "id"
-              ]
-            },
-            "jobs.WebhookNotifications": {
-              "type": "object",
-              "properties": {
-                "on_duration_warning_threshold_exceeded": {
-                  "description": "An optional list of system notification IDs to call when the duration of a run exceeds the threshold specified for the `RUN_DURATION_SECONDS` metric in the `health` field. A maximum of 3 destinations can be specified for the `on_duration_warning_threshold_exceeded` property.",
-                  "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.Webhook",
-                  "x-since-version": "v0.229.0"
-                },
-                "on_failure": {
-                  "description": "An optional list of system notification IDs to call when the run fails. A maximum of 3 destinations can be specified for the `on_failure` property.",
-                  "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.Webhook",
-                  "x-since-version": "v0.229.0"
-                },
-                "on_start": {
-                  "description": "An optional list of system notification IDs to call when the run starts. A maximum of 3 destinations can be specified for the `on_start` property.",
-                  "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.Webhook",
-                  "x-since-version": "v0.229.0"
-                },
-                "on_streaming_backlog_exceeded": {
-                  "description": "An optional list of system notification IDs to call when any streaming backlog thresholds are exceeded for any stream.\nStreaming backlog thresholds can be set in the `health` field using the following metrics: `STREAMING_BACKLOG_BYTES`, `STREAMING_BACKLOG_RECORDS`, `STREAMING_BACKLOG_SECONDS`, or `STREAMING_BACKLOG_FILES`.\nAlerting is based on the 10-minute average of these metrics. If the issue persists, notifications are resent every 30 minutes.\nA maximum of 3 destinations can be specified for the `on_streaming_backlog_exceeded` property.",
-                  "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.Webhook",
-                  "x-since-version": "v0.229.0"
-                },
-                "on_success": {
-                  "description": "An optional list of system notification IDs to call when the run completes successfully. A maximum of 3 destinations can be specified for the `on_success` property.",
-                  "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/jobs.Webhook",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "ml.ExperimentPermissionLevel": {
-              "type": "string",
-              "description": "Permission level",
-              "enum": [
-                "CAN_MANAGE",
-                "CAN_EDIT",
-                "CAN_READ"
-              ]
-            },
-            "ml.ExperimentTag": {
-              "type": "object",
-              "description": "A tag for an experiment.",
-              "properties": {
-                "key": {
-                  "description": "The tag key.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "value": {
-                  "description": "The tag value.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "ml.ModelTag": {
-              "type": "object",
-              "description": "Tag for a registered model",
-              "properties": {
-                "key": {
-                  "description": "The tag key.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "value": {
-                  "description": "The tag value.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "ml.RegisteredModelPermissionLevel": {
-              "type": "string",
-              "description": "Permission level",
-              "enum": [
-                "CAN_MANAGE",
-                "CAN_MANAGE_PRODUCTION_VERSIONS",
-                "CAN_MANAGE_STAGING_VERSIONS",
-                "CAN_EDIT",
-                "CAN_READ"
-              ]
-            },
-            "pipelines.AutoFullRefreshPolicy": {
-              "type": "object",
-              "description": "Policy for auto full refresh.",
-              "properties": {
-                "enabled": {
-                  "description": "(Required, Mutable) Whether to enable auto full refresh or not.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.285.0"
-                },
-                "min_interval_hours": {
-                  "description": "(Optional, Mutable) Specify the minimum interval in hours between the timestamp\nat which a table was last full refreshed and the current timestamp for triggering auto full\nIf unspecified and autoFullRefresh is enabled then by default min_interval_hours is 24 hours.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.285.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "enabled"
-              ]
-            },
-            "pipelines.ConnectionParameters": {
-              "type": "object",
-              "properties": {
-                "source_catalog": {
-                  "description": "Source catalog for initial connection.\nThis is necessary for schema exploration in some database systems like Oracle, and optional but nice-to-have\nin some other database systems like Postgres.\nFor Oracle databases, this maps to a service name.",
-                  "$ref": "#/$defs/string",
-                  "x-databricks-preview": "PRIVATE",
-                  "doNotSuggest": true,
-                  "x-since-version": "v0.279.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "pipelines.ConnectorOptions": {
-              "type": "object",
-              "description": "Wrapper message for source-specific options to support multiple connector types",
-              "properties": {
-                "gdrive_options": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.GoogleDriveOptions",
-                  "x-databricks-preview": "PRIVATE",
-                  "doNotSuggest": true
-                },
-                "google_ads_options": {
-                  "description": "Google Ads specific options for ingestion (object-level).\nWhen set, these values override the corresponding fields in GoogleAdsConfig\n(source_configurations).",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.GoogleAdsOptions",
-                  "x-databricks-preview": "PRIVATE",
-                  "doNotSuggest": true
-                },
-                "sharepoint_options": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.SharepointOptions",
-                  "x-databricks-preview": "PRIVATE",
-                  "doNotSuggest": true
-                },
-                "tiktok_ads_options": {
-                  "description": "TikTok Ads specific options for ingestion",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.TikTokAdsOptions",
-                  "x-databricks-preview": "PRIVATE",
-                  "doNotSuggest": true
-                }
-              },
-              "additionalProperties": false
-            },
-            "pipelines.ConnectorType": {
-              "type": "string",
-              "description": "For certain database sources LakeFlow Connect offers both query based and cdc\ningestion, ConnectorType can bse used to convey the type of ingestion.\nIf connection_name is provided for database sources, we default to Query Based ingestion",
-              "enum": [
-                "CDC",
-                "QUERY_BASED"
-              ]
-            },
-            "pipelines.CronTrigger": {
-              "type": "object",
-              "properties": {
-                "quartz_cron_schedule": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "timezone_id": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "pipelines.DataStagingOptions": {
-              "type": "object",
-              "description": "Location of staged data storage",
-              "properties": {
-                "catalog_name": {
-                  "description": "(Required, Immutable) The name of the catalog for the connector's staging storage location.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.296.0"
-                },
-                "schema_name": {
-                  "description": "(Required, Immutable) The name of the schema for the connector's staging storage location.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.296.0"
-                },
-                "volume_name": {
-                  "description": "(Optional) The Unity Catalog-compatible name for the storage location.\nThis is the volume to use for the data that is extracted by the connector.\nSpark Declarative Pipelines system will automatically create the volume under the catalog and schema.\nFor Combined Cdc Managed Ingestion pipelines default name for the volume would be :\n__databricks_ingestion_gateway_staging_data-$pipelineId",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.296.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "catalog_name",
-                "schema_name"
-              ]
-            },
-            "pipelines.DayOfWeek": {
-              "type": "string",
-              "description": "Days of week in which the window is allowed to happen.\nIf not specified all days of the week will be used.",
-              "enum": [
-                "MONDAY",
-                "TUESDAY",
-                "WEDNESDAY",
-                "THURSDAY",
-                "FRIDAY",
-                "SATURDAY",
-                "SUNDAY"
-              ]
-            },
-            "pipelines.DeploymentKind": {
-              "type": "string",
-              "description": "The deployment method that manages the pipeline:\n- BUNDLE: The pipeline is managed by a Databricks Asset Bundle.",
-              "enum": [
-                "BUNDLE"
-              ]
-            },
-            "pipelines.EventLogSpec": {
-              "type": "object",
-              "description": "Configurable event log parameters.",
-              "properties": {
-                "catalog": {
-                  "description": "The UC catalog the event log is published under.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.246.0"
-                },
-                "name": {
-                  "description": "The name the event log is published to in UC.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.246.0"
-                },
-                "schema": {
-                  "description": "The UC schema the event log is published under.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.246.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "pipelines.FileFilter": {
-              "type": "object",
-              "properties": {
-                "modified_after": {
-                  "description": "Include files with modification times occurring after the specified time.\nTimestamp format: YYYY-MM-DDTHH:mm:ss (e.g. 2020-06-01T13:00:00)\nBased on https://spark.apache.org/docs/latest/sql-data-sources-generic-options.html#modification-time-path-filters",
-                  "$ref": "#/$defs/string"
-                },
-                "modified_before": {
-                  "description": "Include files with modification times occurring before the specified time.\nTimestamp format: YYYY-MM-DDTHH:mm:ss (e.g. 2020-06-01T13:00:00)\nBased on https://spark.apache.org/docs/latest/sql-data-sources-generic-options.html#modification-time-path-filters",
-                  "$ref": "#/$defs/string"
-                },
-                "path_filter": {
-                  "description": "Include files with file names matching the pattern\nBased on https://spark.apache.org/docs/latest/sql-data-sources-generic-options.html#path-glob-filter",
-                  "$ref": "#/$defs/string"
-                }
-              },
-              "additionalProperties": false
-            },
-            "pipelines.FileIngestionOptions": {
-              "type": "object",
-              "properties": {
-                "corrupt_record_column": {
-                  "$ref": "#/$defs/string"
-                },
-                "file_filters": {
-                  "description": "Generic options",
-                  "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/pipelines.FileFilter"
-                },
-                "format": {
-                  "description": "required for TableSpec",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.FileIngestionOptionsFileFormat"
-                },
-                "format_options": {
-                  "description": "Format-specific options\nBased on https://docs.databricks.com/aws/en/ingestion/cloud-object-storage/auto-loader/options#file-format-options",
-                  "$ref": "#/$defs/map/string"
-                },
-                "ignore_corrupt_files": {
-                  "$ref": "#/$defs/bool"
-                },
-                "infer_column_types": {
-                  "$ref": "#/$defs/bool"
-                },
-                "reader_case_sensitive": {
-                  "description": "Column name case sensitivity\nhttps://docs.databricks.com/aws/en/ingestion/cloud-object-storage/auto-loader/schema#change-case-sensitive-behavior",
-                  "$ref": "#/$defs/bool"
-                },
-                "rescued_data_column": {
-                  "$ref": "#/$defs/string"
-                },
-                "schema_evolution_mode": {
-                  "description": "Based on https://docs.databricks.com/aws/en/ingestion/cloud-object-storage/auto-loader/schema#how-does-auto-loader-schema-evolution-work",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.FileIngestionOptionsSchemaEvolutionMode"
-                },
-                "schema_hints": {
-                  "description": "Override inferred schema of specific columns\nBased on https://docs.databricks.com/aws/en/ingestion/cloud-object-storage/auto-loader/schema#override-schema-inference-with-schema-hints",
-                  "$ref": "#/$defs/string"
-                },
-                "single_variant_column": {
-                  "$ref": "#/$defs/string"
-                }
-              },
-              "additionalProperties": false
-            },
-            "pipelines.FileIngestionOptionsFileFormat": {
-              "type": "string",
-              "enum": [
-                "BINARYFILE",
-                "JSON",
-                "CSV",
-                "XML",
-                "EXCEL",
-                "PARQUET",
-                "AVRO",
-                "ORC"
-              ]
-            },
-            "pipelines.FileIngestionOptionsSchemaEvolutionMode": {
-              "type": "string",
-              "description": "Based on https://docs.databricks.com/aws/en/ingestion/cloud-object-storage/auto-loader/schema#how-does-auto-loader-schema-evolution-work",
-              "enum": [
-                "ADD_NEW_COLUMNS_WITH_TYPE_WIDENING",
-                "ADD_NEW_COLUMNS",
-                "RESCUE",
-                "FAIL_ON_NEW_COLUMNS",
-                "NONE"
-              ]
-            },
-            "pipelines.FileLibrary": {
-              "type": "object",
-              "properties": {
-                "path": {
-                  "description": "The absolute path of the source code.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "pipelines.Filters": {
-              "type": "object",
-              "properties": {
-                "exclude": {
-                  "description": "Paths to exclude.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "include": {
-                  "description": "Paths to include.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "pipelines.GoogleAdsOptions": {
-              "type": "object",
-              "description": "Google Ads specific options for ingestion (object-level).\nWhen set, these values override the corresponding fields in GoogleAdsConfig\n(source_configurations).",
-              "properties": {
-                "lookback_window_days": {
-                  "description": "(Optional) Number of days to look back for report tables to capture late-arriving data.\nIf not specified, defaults to 30 days.",
-                  "$ref": "#/$defs/int"
-                },
-                "manager_account_id": {
-                  "description": "(Optional at this level) Manager Account ID (also called MCC Account ID) used to list\nand access customer accounts under this manager account.\nOverrides GoogleAdsConfig.manager_account_id from source_configurations when set.",
-                  "$ref": "#/$defs/string"
-                },
-                "sync_start_date": {
-                  "description": "(Optional) Start date for the initial sync of report tables in YYYY-MM-DD format.\nThis determines the earliest date from which to sync historical data.\nIf not specified, defaults to 2 years of historical data.",
-                  "$ref": "#/$defs/string"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "manager_account_id"
-              ]
-            },
-            "pipelines.GoogleDriveOptions": {
-              "type": "object",
-              "properties": {
-                "entity_type": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.GoogleDriveOptionsGoogleDriveEntityType"
-                },
-                "file_ingestion_options": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.FileIngestionOptions"
-                },
-                "url": {
-                  "description": "Google Drive URL.",
-                  "$ref": "#/$defs/string"
-                }
-              },
-              "additionalProperties": false
-            },
-            "pipelines.GoogleDriveOptionsGoogleDriveEntityType": {
-              "type": "string",
-              "enum": [
-                "FILE",
-                "FILE_METADATA",
-                "PERMISSION"
-              ]
-            },
-            "pipelines.IngestionConfig": {
-              "type": "object",
-              "properties": {
-                "report": {
-                  "description": "Select a specific source report.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.ReportSpec",
-                  "x-since-version": "v0.231.0"
-                },
-                "schema": {
-                  "description": "Select all tables from a specific source schema.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.SchemaSpec",
-                  "x-since-version": "v0.229.0"
-                },
-                "table": {
-                  "description": "Select a specific source table.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.TableSpec",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "pipelines.IngestionGatewayPipelineDefinition": {
-              "type": "object",
-              "properties": {
-                "connection_id": {
-                  "description": "[Deprecated, use connection_name instead] Immutable. The Unity Catalog connection that this gateway pipeline uses to communicate with the source.",
-                  "$ref": "#/$defs/string",
-                  "deprecationMessage": "This field is deprecated",
-                  "x-since-version": "v0.229.0",
-                  "deprecated": true
-                },
-                "connection_name": {
-                  "description": "Immutable. The Unity Catalog connection that this gateway pipeline uses to communicate with the source.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.234.0"
-                },
-                "connection_parameters": {
-                  "description": "Optional, Internal. Parameters required to establish an initial connection with the source.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.ConnectionParameters",
-                  "x-databricks-preview": "PRIVATE",
-                  "doNotSuggest": true,
-                  "x-since-version": "v0.279.0"
-                },
-                "gateway_storage_catalog": {
-                  "description": "Required, Immutable. The name of the catalog for the gateway pipeline's storage location.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "gateway_storage_name": {
-                  "description": "Optional. The Unity Catalog-compatible name for the gateway storage location.\nThis is the destination to use for the data that is extracted by the gateway.\nSpark Declarative Pipelines system will automatically create the storage location under the catalog and schema.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "gateway_storage_schema": {
-                  "description": "Required, Immutable. The name of the schema for the gateway pipelines's storage location.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "connection_name",
-                "gateway_storage_catalog",
-                "gateway_storage_schema"
-              ]
-            },
-            "pipelines.IngestionPipelineDefinition": {
-              "type": "object",
-              "properties": {
-                "connection_name": {
-                  "description": "The Unity Catalog connection that this ingestion pipeline uses to communicate with the source. This is used with\nboth connectors for applications like Salesforce, Workday, and so on, and also database connectors like Oracle,\n(connector_type = QUERY_BASED OR connector_type = CDC).\nIf connection name corresponds to database connectors like Oracle, and connector_type is not provided then\nconnector_type defaults to QUERY_BASED. If connector_type is passed as CDC we use Combined Cdc Managed Ingestion\npipeline.\nUnder certain conditions, this can be replaced with ingestion_gateway_id to change the connector to Cdc Managed\nIngestion Pipeline with Gateway pipeline.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "connector_type": {
-                  "description": "(Optional) Connector Type for sources. Ex: CDC, Query Based.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.ConnectorType",
-                  "x-databricks-preview": "PRIVATE",
-                  "doNotSuggest": true,
-                  "x-since-version": "v0.296.0"
-                },
-                "data_staging_options": {
-                  "description": "(Optional) Location of staged data storage. This is required for migration from Cdc Managed Ingestion Pipeline\nwith Gateway pipeline to Combined Cdc Managed Ingestion Pipeline.\nIf not specified, the volume for staged data will be created in catalog and schema/target specified in the\ntop level pipeline definition.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.DataStagingOptions",
-                  "x-databricks-preview": "PRIVATE",
-                  "doNotSuggest": true,
-                  "x-since-version": "v0.296.0"
-                },
-                "full_refresh_window": {
-                  "description": "(Optional) A window that specifies a set of time ranges for snapshot queries in CDC.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.OperationTimeWindow",
-                  "x-since-version": "v0.285.0"
-                },
-                "ingest_from_uc_foreign_catalog": {
-                  "description": "Immutable. If set to true, the pipeline will ingest tables from the\nUC foreign catalogs directly without the need to specify a UC connection or ingestion gateway.\nThe `source_catalog` fields in objects of IngestionConfig are interpreted as\nthe UC foreign catalogs to ingest from.",
-                  "$ref": "#/$defs/bool",
-                  "x-databricks-preview": "PRIVATE",
-                  "doNotSuggest": true,
-                  "x-since-version": "v0.279.0"
-                },
-                "ingestion_gateway_id": {
-                  "description": "Identifier for the gateway that is used by this ingestion pipeline to communicate with the source database.\nThis is used with CDC connectors to databases like SQL Server using a gateway pipeline (connector_type = CDC).\nUnder certain conditions, this can be replaced with connection_name to change the connector to Combined Cdc\nManaged Ingestion Pipeline.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "netsuite_jar_path": {
-                  "$ref": "#/$defs/string",
-                  "x-databricks-preview": "PRIVATE",
-                  "doNotSuggest": true,
-                  "x-since-version": "v0.271.0"
-                },
-                "objects": {
-                  "description": "Required. Settings specifying tables to replicate and the destination for the replicated tables.",
-                  "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/pipelines.IngestionConfig",
-                  "x-since-version": "v0.229.0"
-                },
-                "source_configurations": {
-                  "description": "Top-level source configurations",
-                  "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/pipelines.SourceConfig",
-                  "x-since-version": "v0.267.0"
-                },
-                "table_configuration": {
-                  "description": "Configuration settings to control the ingestion of tables. These settings are applied to all tables in the pipeline.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.TableSpecificConfig",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "pipelines.IngestionPipelineDefinitionTableSpecificConfigQueryBasedConnectorConfig": {
-              "type": "object",
-              "description": "Configurations that are only applicable for query-based ingestion connectors.",
-              "properties": {
-                "cursor_columns": {
-                  "description": "The names of the monotonically increasing columns in the source table that are used to enable\nthe table to be read and ingested incrementally through structured streaming.\nThe columns are allowed to have repeated values but have to be non-decreasing.\nIf the source data is merged into the destination (e.g., using SCD Type 1 or Type 2), these\ncolumns will implicitly define the `sequence_by` behavior. You can still explicitly set\n`sequence_by` to override this default.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-databricks-preview": "PRIVATE",
-                  "doNotSuggest": true,
-                  "x-since-version": "v0.264.0"
-                },
-                "deletion_condition": {
-                  "description": "Specifies a SQL WHERE condition that specifies that the source row has been deleted.\nThis is sometimes referred to as \"soft-deletes\".\nFor example: \"Operation = 'DELETE'\" or \"is_deleted = true\".\nThis field is orthogonal to `hard_deletion_sync_interval_in_seconds`,\none for soft-deletes and the other for hard-deletes.\nSee also the hard_deletion_sync_min_interval_in_seconds field for\nhandling of \"hard deletes\" where the source rows are physically removed from the table.",
-                  "$ref": "#/$defs/string",
-                  "x-databricks-preview": "PRIVATE",
-                  "doNotSuggest": true,
-                  "x-since-version": "v0.264.0"
-                },
-                "hard_deletion_sync_min_interval_in_seconds": {
-                  "description": "Specifies the minimum interval (in seconds) between snapshots on primary keys\nfor detecting and synchronizing hard deletions—i.e., rows that have been\nphysically removed from the source table.\nThis interval acts as a lower bound. If ingestion runs less frequently than\nthis value, hard deletion synchronization will align with the actual ingestion\nfrequency instead of happening more often.\nIf not set, hard deletion synchronization via snapshots is disabled.\nThis field is mutable and can be updated without triggering a full snapshot.",
-                  "$ref": "#/$defs/int64",
-                  "x-databricks-preview": "PRIVATE",
-                  "doNotSuggest": true,
-                  "x-since-version": "v0.264.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "pipelines.IngestionPipelineDefinitionWorkdayReportParameters": {
-              "type": "object",
-              "properties": {
-                "incremental": {
-                  "description": "(Optional) Marks the report as incremental.\nThis field is deprecated and should not be used. Use `parameters` instead. The incremental behavior is now\ncontrolled by the `parameters` field.",
-                  "$ref": "#/$defs/bool",
-                  "deprecationMessage": "This field is deprecated",
-                  "x-since-version": "v0.271.0",
-                  "deprecated": true
-                },
-                "parameters": {
-                  "description": "Parameters for the Workday report. Each key represents the parameter name (e.g., \"start_date\", \"end_date\"),\nand the corresponding value is a SQL-like expression used to compute the parameter value at runtime.\nExample:\n{\n\"start_date\": \"{ coalesce(current_offset(), date(\\\"2025-02-01\\\")) }\",\n\"end_date\": \"{ current_date() - INTERVAL 1 DAY }\"\n}",
-                  "$ref": "#/$defs/map/string",
-                  "x-since-version": "v0.271.0"
-                },
-                "report_parameters": {
-                  "description": "(Optional) Additional custom parameters for Workday Report\nThis field is deprecated and should not be used. Use `parameters` instead.",
-                  "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/pipelines.IngestionPipelineDefinitionWorkdayReportParametersQueryKeyValue",
-                  "deprecationMessage": "This field is deprecated",
-                  "x-since-version": "v0.271.0",
-                  "deprecated": true
-                }
-              },
-              "additionalProperties": false
-            },
-            "pipelines.IngestionPipelineDefinitionWorkdayReportParametersQueryKeyValue": {
-              "type": "object",
-              "properties": {
-                "key": {
-                  "description": "Key for the report parameter, can be a column name or other metadata",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.271.0"
-                },
-                "value": {
-                  "description": "Value for the report parameter.\nPossible values it can take are these sql functions:\n1. coalesce(current_offset(), date(\"YYYY-MM-DD\")) -\u003e if current_offset() is null, then the passed date, else current_offset()\n2. current_date()\n3. date_sub(current_date(), x) -\u003e subtract x (some non-negative integer) days from current date",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.271.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "pipelines.IngestionSourceType": {
-              "type": "string",
-              "enum": [
-                "MYSQL",
-                "POSTGRESQL",
-                "SQLSERVER",
-                "SALESFORCE",
-                "BIGQUERY",
-                "NETSUITE",
-                "WORKDAY_RAAS",
-                "GA4_RAW_DATA",
-                "SERVICENOW",
-                "MANAGED_POSTGRESQL",
-                "ORACLE",
-                "TERADATA",
-                "SHAREPOINT",
-                "DYNAMICS365",
-                "GOOGLE_DRIVE",
-                "FOREIGN_CATALOG"
-              ]
-            },
-            "pipelines.ManualTrigger": {
-              "type": "object",
-              "additionalProperties": false
-            },
-            "pipelines.NotebookLibrary": {
-              "type": "object",
-              "properties": {
-                "path": {
-                  "description": "The absolute path of the source code.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "pipelines.Notifications": {
-              "type": "object",
-              "properties": {
-                "alerts": {
-                  "description": "A list of alerts that trigger the sending of notifications to the configured\ndestinations. The supported alerts are:\n\n* `on-update-success`: A pipeline update completes successfully.\n* `on-update-failure`: Each time a pipeline update fails.\n* `on-update-fatal-failure`: A pipeline update fails with a non-retryable (fatal) error.\n* `on-flow-failure`: A single data flow fails.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "email_recipients": {
-                  "description": "A list of email addresses notified when a configured alert is triggered.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "pipelines.OperationTimeWindow": {
-              "type": "object",
-              "description": "Proto representing a window",
-              "properties": {
-                "days_of_week": {
-                  "description": "Days of week in which the window is allowed to happen\nIf not specified all days of the week will be used.",
-                  "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/pipelines.DayOfWeek",
-                  "x-since-version": "v0.285.0"
-                },
-                "start_hour": {
-                  "description": "An integer between 0 and 23 denoting the start hour for the window in the 24-hour day.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.285.0"
-                },
-                "time_zone_id": {
-                  "description": "Time zone id of window. See https://docs.databricks.com/sql/language-manual/sql-ref-syntax-aux-conf-mgmt-set-timezone.html for details.\nIf not specified, UTC will be used.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.285.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "start_hour"
-              ]
-            },
-            "pipelines.PathPattern": {
-              "type": "object",
-              "properties": {
-                "include": {
-                  "description": "The source code to include for pipelines",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.252.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "pipelines.PipelineCluster": {
-              "type": "object",
-              "properties": {
-                "apply_policy_default_values": {
-                  "description": "Note: This field won't be persisted. Only API users will check this field.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.229.0"
-                },
-                "autoscale": {
-                  "description": "Parameters needed in order to automatically scale clusters up and down based on load.\nNote: autoscaling works best with DB runtime versions 3.0 or later.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.PipelineClusterAutoscale",
-                  "x-since-version": "v0.229.0"
-                },
-                "aws_attributes": {
-                  "description": "Attributes related to clusters running on Amazon Web Services.\nIf not specified at cluster creation, a set of default values will be used.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.AwsAttributes",
-                  "x-since-version": "v0.229.0"
-                },
-                "azure_attributes": {
-                  "description": "Attributes related to clusters running on Microsoft Azure.\nIf not specified at cluster creation, a set of default values will be used.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.AzureAttributes",
-                  "x-since-version": "v0.229.0"
-                },
-                "cluster_log_conf": {
-                  "description": "The configuration for delivering spark logs to a long-term storage destination.\nOnly dbfs destinations are supported. Only one destination can be specified\nfor one cluster. If the conf is given, the logs will be delivered to the destination every\n`5 mins`. The destination of driver logs is `$destination/$clusterId/driver`, while\nthe destination of executor logs is `$destination/$clusterId/executor`.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.ClusterLogConf",
-                  "x-since-version": "v0.229.0"
-                },
-                "custom_tags": {
-                  "description": "Additional tags for cluster resources. Databricks will tag all cluster resources (e.g., AWS\ninstances and EBS volumes) with these tags in addition to `default_tags`. Notes:\n\n- Currently, Databricks allows at most 45 custom tags\n\n- Clusters can only reuse cloud resources if the resources' tags are a subset of the cluster tags",
-                  "$ref": "#/$defs/map/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "driver_instance_pool_id": {
-                  "description": "The optional ID of the instance pool for the driver of the cluster belongs.\nThe pool cluster uses the instance pool with id (instance_pool_id) if the driver pool is not\nassigned.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "driver_node_type_id": {
-                  "description": "The node type of the Spark driver.\nNote that this field is optional; if unset, the driver node type will be set as the same value\nas `node_type_id` defined above.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "enable_local_disk_encryption": {
-                  "description": "Whether to enable local disk encryption for the cluster.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.229.0"
-                },
-                "gcp_attributes": {
-                  "description": "Attributes related to clusters running on Google Cloud Platform.\nIf not specified at cluster creation, a set of default values will be used.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.GcpAttributes",
-                  "x-since-version": "v0.229.0"
-                },
-                "init_scripts": {
-                  "description": "The configuration for storing init scripts. Any number of destinations can be specified. The scripts are executed sequentially in the order provided. If `cluster_log_conf` is specified, init script logs are sent to `\u003cdestination\u003e/\u003ccluster-ID\u003e/init_scripts`.",
-                  "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/compute.InitScriptInfo",
-                  "x-since-version": "v0.229.0"
-                },
-                "instance_pool_id": {
-                  "description": "The optional ID of the instance pool to which the cluster belongs.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "label": {
-                  "description": "A label for the cluster specification, either `default` to configure the default cluster, or `maintenance` to configure the maintenance cluster. This field is optional. The default value is `default`.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "node_type_id": {
-                  "description": "This field encodes, through a single value, the resources available to each of\nthe Spark nodes in this cluster. For example, the Spark nodes can be provisioned\nand optimized for memory or compute intensive workloads. A list of available node\ntypes can be retrieved by using the :method:clusters/listNodeTypes API call.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "num_workers": {
-                  "description": "Number of worker nodes that this cluster should have. A cluster has one Spark Driver\nand `num_workers` Executors for a total of `num_workers` + 1 Spark nodes.\n\nNote: When reading the properties of a cluster, this field reflects the desired number\nof workers rather than the actual current number of workers. For instance, if a cluster\nis resized from 5 to 10 workers, this field will immediately be updated to reflect\nthe target size of 10 workers, whereas the workers listed in `spark_info` will gradually\nincrease from 5 to 10 as the new nodes are provisioned.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.229.0"
-                },
-                "policy_id": {
-                  "description": "The ID of the cluster policy used to create the cluster if applicable.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "spark_conf": {
-                  "description": "An object containing a set of optional, user-specified Spark configuration key-value pairs.\nSee :method:clusters/create for more details.",
-                  "$ref": "#/$defs/map/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "spark_env_vars": {
-                  "description": "An object containing a set of optional, user-specified environment variable key-value pairs.\nPlease note that key-value pair of the form (X,Y) will be exported as is (i.e.,\n`export X='Y'`) while launching the driver and workers.\n\nIn order to specify an additional set of `SPARK_DAEMON_JAVA_OPTS`, we recommend appending\nthem to `$SPARK_DAEMON_JAVA_OPTS` as shown in the example below. This ensures that all\ndefault databricks managed environmental variables are included as well.\n\nExample Spark environment variables:\n`{\"SPARK_WORKER_MEMORY\": \"28000m\", \"SPARK_LOCAL_DIRS\": \"/local_disk0\"}` or\n`{\"SPARK_DAEMON_JAVA_OPTS\": \"$SPARK_DAEMON_JAVA_OPTS -Dspark.shuffle.service.enabled=true\"}`",
-                  "$ref": "#/$defs/map/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "ssh_public_keys": {
-                  "description": "SSH public key contents that will be added to each Spark node in this cluster. The\ncorresponding private keys can be used to login with the user name `ubuntu` on port `2200`.\nUp to 10 keys can be specified.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "pipelines.PipelineClusterAutoscale": {
-              "type": "object",
-              "properties": {
-                "max_workers": {
-                  "description": "The maximum number of workers to which the cluster can scale up when overloaded. `max_workers` must be strictly greater than `min_workers`.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.229.0"
-                },
-                "min_workers": {
-                  "description": "The minimum number of workers the cluster can scale down to when underutilized.\nIt is also the initial number of workers the cluster will have after creation.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.229.0"
-                },
-                "mode": {
-                  "description": "Databricks Enhanced Autoscaling optimizes cluster utilization by automatically\nallocating cluster resources based on workload volume, with minimal impact to\nthe data processing latency of your pipelines. Enhanced Autoscaling is available\nfor `updates` clusters only. The legacy autoscaling feature is used for `maintenance`\nclusters.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.PipelineClusterAutoscaleMode",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "max_workers",
-                "min_workers"
-              ]
-            },
-            "pipelines.PipelineClusterAutoscaleMode": {
-              "type": "string",
-              "description": "Databricks Enhanced Autoscaling optimizes cluster utilization by automatically\nallocating cluster resources based on workload volume, with minimal impact to\nthe data processing latency of your pipelines. Enhanced Autoscaling is available\nfor `updates` clusters only. The legacy autoscaling feature is used for `maintenance`\nclusters.",
-              "enum": [
-                "ENHANCED",
-                "LEGACY"
-              ]
-            },
-            "pipelines.PipelineDeployment": {
-              "type": "object",
-              "properties": {
-                "kind": {
-                  "description": "The deployment method that manages the pipeline.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.DeploymentKind",
-                  "x-since-version": "v0.229.0"
-                },
-                "metadata_file_path": {
-                  "description": "The path to the file containing metadata about the deployment.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "kind"
-              ]
-            },
-            "pipelines.PipelineLibrary": {
-              "type": "object",
-              "properties": {
-                "file": {
-                  "description": "The path to a file that defines a pipeline and is stored in the Databricks Repos.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.FileLibrary",
-                  "x-since-version": "v0.229.0"
-                },
-                "glob": {
-                  "description": "The unified field to include source codes.\nEach entry can be a notebook path, a file path, or a folder path that ends `/**`.\nThis field cannot be used together with `notebook` or `file`.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.PathPattern",
-                  "x-since-version": "v0.252.0"
-                },
-                "jar": {
-                  "description": "URI of the jar to be installed. Currently only DBFS is supported.",
-                  "$ref": "#/$defs/string",
-                  "x-databricks-preview": "PRIVATE",
-                  "doNotSuggest": true,
-                  "x-since-version": "v0.229.0"
-                },
-                "maven": {
-                  "description": "Specification of a maven library to be installed.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.MavenLibrary",
-                  "x-databricks-preview": "PRIVATE",
-                  "doNotSuggest": true,
-                  "x-since-version": "v0.229.0"
-                },
-                "notebook": {
-                  "description": "The path to a notebook that defines a pipeline and is stored in the Databricks workspace.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.NotebookLibrary",
-                  "x-since-version": "v0.229.0"
-                },
-                "whl": {
-                  "description": "URI of the whl to be installed.",
-                  "$ref": "#/$defs/string",
-                  "deprecationMessage": "This field is deprecated",
-                  "x-since-version": "v0.229.0",
-                  "deprecated": true
-                }
-              },
-              "additionalProperties": false
-            },
-            "pipelines.PipelinePermissionLevel": {
-              "type": "string",
-              "description": "Permission level",
-              "enum": [
-                "CAN_MANAGE",
-                "IS_OWNER",
-                "CAN_RUN",
-                "CAN_VIEW"
-              ]
-            },
-            "pipelines.PipelineTrigger": {
-              "type": "object",
-              "properties": {
-                "cron": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.CronTrigger",
-                  "x-since-version": "v0.229.0"
-                },
-                "manual": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.ManualTrigger",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "pipelines.PipelinesEnvironment": {
-              "type": "object",
-              "description": "The environment entity used to preserve serverless environment side panel, jobs' environment for non-notebook task, and DLT's environment for classic and serverless pipelines.\nIn this minimal environment spec, only pip dependencies are supported.",
-              "properties": {
-                "dependencies": {
-                  "description": "List of pip dependencies, as supported by the version of pip in this environment.\nEach dependency is a pip requirement file line https://pip.pypa.io/en/stable/reference/requirements-file-format/\nAllowed dependency could be \u003crequirement specifier\u003e, \u003carchive url/path\u003e, \u003clocal project path\u003e(WSFS or Volumes in Databricks), \u003cvcs project url\u003e",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.257.0"
-                },
-                "environment_version": {
-                  "description": "The environment version of the serverless Python environment used to execute\ncustomer Python code. Each environment version includes a specific Python\nversion and a curated set of pre-installed libraries with defined versions,\nproviding a stable and reproducible execution environment.\n\nDatabricks supports a three-year lifecycle for each environment version.\nFor available versions and their included packages, see\nhttps://docs.databricks.com/aws/en/release-notes/serverless/environment-version/\n\nThe value should be a string representing the environment version number, for example: `\"4\"`.",
-                  "$ref": "#/$defs/string",
-                  "x-databricks-preview": "PRIVATE",
-                  "doNotSuggest": true,
-                  "x-since-version": "v0.294.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "pipelines.PostgresCatalogConfig": {
-              "type": "object",
-              "description": "PG-specific catalog-level configuration parameters",
-              "properties": {
-                "slot_config": {
-                  "description": "Optional. The Postgres slot configuration to use for logical replication",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.PostgresSlotConfig",
-                  "x-since-version": "v0.267.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "pipelines.PostgresSlotConfig": {
-              "type": "object",
-              "description": "PostgresSlotConfig contains the configuration for a Postgres logical replication slot",
-              "properties": {
-                "publication_name": {
-                  "description": "The name of the publication to use for the Postgres source",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.267.0"
-                },
-                "slot_name": {
-                  "description": "The name of the logical replication slot to use for the Postgres source",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.267.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "pipelines.ReportSpec": {
-              "type": "object",
-              "properties": {
-                "destination_catalog": {
-                  "description": "Required. Destination catalog to store table.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.231.0"
-                },
-                "destination_schema": {
-                  "description": "Required. Destination schema to store table.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.231.0"
-                },
-                "destination_table": {
-                  "description": "Required. Destination table name. The pipeline fails if a table with that name already exists.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.231.0"
-                },
-                "source_url": {
-                  "description": "Required. Report URL in the source system.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.231.0"
-                },
-                "table_configuration": {
-                  "description": "Configuration settings to control the ingestion of tables. These settings override the table_configuration defined in the IngestionPipelineDefinition object.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.TableSpecificConfig",
-                  "x-since-version": "v0.231.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "destination_catalog",
-                "destination_schema",
-                "source_url"
-              ]
-            },
-            "pipelines.RestartWindow": {
-              "type": "object",
-              "properties": {
-                "days_of_week": {
-                  "description": "Days of week in which the restart is allowed to happen (within a five-hour window starting at start_hour).\nIf not specified all days of the week will be used.",
-                  "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/pipelines.DayOfWeek",
-                  "x-since-version": "v0.234.0"
-                },
-                "start_hour": {
-                  "description": "An integer between 0 and 23 denoting the start hour for the restart window in the 24-hour day.\nContinuous pipeline restart is triggered only within a five-hour window starting at this hour.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.234.0"
-                },
-                "time_zone_id": {
-                  "description": "Time zone id of restart window. See https://docs.databricks.com/sql/language-manual/sql-ref-syntax-aux-conf-mgmt-set-timezone.html for details.\nIf not specified, UTC will be used.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.234.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "start_hour"
-              ]
-            },
-            "pipelines.RunAs": {
-              "type": "object",
-              "description": "Write-only setting, available only in Create/Update calls. Specifies the user or service principal that the pipeline runs as. If not specified, the pipeline runs as the user who created the pipeline.\n\nOnly `user_name` or `service_principal_name` can be specified. If both are specified, an error is thrown.",
-              "properties": {
-                "service_principal_name": {
-                  "description": "Application ID of an active service principal. Setting this field requires the `servicePrincipal/user` role.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.241.0"
-                },
-                "user_name": {
-                  "description": "The email of an active workspace user. Users can only set this field to their own email.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.241.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "pipelines.SchemaSpec": {
-              "type": "object",
-              "properties": {
-                "connector_options": {
-                  "description": "(Optional) Source Specific Connector Options",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.ConnectorOptions",
-                  "x-databricks-preview": "PRIVATE",
-                  "doNotSuggest": true
-                },
-                "destination_catalog": {
-                  "description": "Required. Destination catalog to store tables.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "destination_schema": {
-                  "description": "Required. Destination schema to store tables in. Tables with the same name as the source tables are created in this destination schema. The pipeline fails If a table with the same name already exists.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "source_catalog": {
-                  "description": "The source catalog name. Might be optional depending on the type of source.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "source_schema": {
-                  "description": "Required. Schema name in the source database.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "table_configuration": {
-                  "description": "Configuration settings to control the ingestion of tables. These settings are applied to all tables in this schema and override the table_configuration defined in the IngestionPipelineDefinition object.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.TableSpecificConfig",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "destination_catalog",
-                "destination_schema",
-                "source_schema"
-              ]
-            },
-            "pipelines.SharepointOptions": {
-              "type": "object",
-              "properties": {
-                "entity_type": {
-                  "description": "(Optional) The type of SharePoint entity to ingest.\nIf not specified, defaults to FILE.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.SharepointOptionsSharepointEntityType"
-                },
-                "file_ingestion_options": {
-                  "description": "(Optional) File ingestion options for processing files.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.FileIngestionOptions"
-                },
-                "url": {
-                  "description": "Required. The SharePoint URL.",
-                  "$ref": "#/$defs/string"
-                }
-              },
-              "additionalProperties": false
-            },
-            "pipelines.SharepointOptionsSharepointEntityType": {
-              "type": "string",
-              "enum": [
-                "FILE",
-                "FILE_METADATA",
-                "PERMISSION",
-                "LIST"
-              ]
-            },
-            "pipelines.SourceCatalogConfig": {
-              "type": "object",
-              "description": "SourceCatalogConfig contains catalog-level custom configuration parameters for each source",
-              "properties": {
-                "postgres": {
-                  "description": "Postgres-specific catalog-level configuration parameters",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.PostgresCatalogConfig",
-                  "x-since-version": "v0.267.0"
-                },
-                "source_catalog": {
-                  "description": "Source catalog name",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.267.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "pipelines.SourceConfig": {
-              "type": "object",
-              "properties": {
-                "catalog": {
-                  "description": "Catalog-level source configuration parameters",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.SourceCatalogConfig",
-                  "x-since-version": "v0.267.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "pipelines.TableSpec": {
-              "type": "object",
-              "properties": {
-                "connector_options": {
-                  "description": "(Optional) Source Specific Connector Options",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.ConnectorOptions",
-                  "x-databricks-preview": "PRIVATE",
-                  "doNotSuggest": true
-                },
-                "destination_catalog": {
-                  "description": "Required. Destination catalog to store table.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "destination_schema": {
-                  "description": "Required. Destination schema to store table.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "destination_table": {
-                  "description": "Optional. Destination table name. The pipeline fails if a table with that name already exists. If not set, the source table name is used.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "source_catalog": {
-                  "description": "Source catalog name. Might be optional depending on the type of source.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "source_schema": {
-                  "description": "Schema name in the source database. Might be optional depending on the type of source.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "source_table": {
-                  "description": "Required. Table name in the source database.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "table_configuration": {
-                  "description": "Configuration settings to control the ingestion of tables. These settings override the table_configuration defined in the IngestionPipelineDefinition object and the SchemaSpec.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.TableSpecificConfig",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "destination_catalog",
-                "destination_schema",
-                "source_table"
-              ]
-            },
-            "pipelines.TableSpecificConfig": {
-              "type": "object",
-              "properties": {
-                "auto_full_refresh_policy": {
-                  "description": "(Optional, Mutable) Policy for auto full refresh, if enabled pipeline will automatically try\nto fix issues by doing a full refresh on the table in the retry run. auto_full_refresh_policy\nin table configuration will override the above level auto_full_refresh_policy.\nFor example,\n{\n\"auto_full_refresh_policy\": {\n\"enabled\": true,\n\"min_interval_hours\": 23,\n}\n}\nIf unspecified, auto full refresh is disabled.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.AutoFullRefreshPolicy",
-                  "x-since-version": "v0.285.0"
-                },
-                "exclude_columns": {
-                  "description": "A list of column names to be excluded for the ingestion.\nWhen not specified, include_columns fully controls what columns to be ingested.\nWhen specified, all other columns including future ones will be automatically included for ingestion.\nThis field in mutually exclusive with `include_columns`.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.251.0"
-                },
-                "include_columns": {
-                  "description": "A list of column names to be included for the ingestion.\nWhen not specified, all columns except ones in exclude_columns will be included. Future\ncolumns will be automatically included.\nWhen specified, all other future columns will be automatically excluded from ingestion.\nThis field in mutually exclusive with `exclude_columns`.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.251.0"
-                },
-                "primary_keys": {
-                  "description": "The primary key of the table used to apply changes.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "query_based_connector_config": {
-                  "description": "Configurations that are only applicable for query-based ingestion connectors.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.IngestionPipelineDefinitionTableSpecificConfigQueryBasedConnectorConfig",
-                  "x-databricks-preview": "PRIVATE",
-                  "doNotSuggest": true,
-                  "x-since-version": "v0.264.0"
-                },
-                "row_filter": {
-                  "description": "(Optional, Immutable) The row filter condition to be applied to the table.\nIt must not contain the WHERE keyword, only the actual filter condition.\nIt must be in DBSQL format.",
-                  "$ref": "#/$defs/string",
-                  "x-databricks-preview": "PRIVATE",
-                  "doNotSuggest": true,
-                  "x-since-version": "v0.283.0"
-                },
-                "salesforce_include_formula_fields": {
-                  "description": "If true, formula fields defined in the table are included in the ingestion. This setting is only valid for the Salesforce connector",
-                  "$ref": "#/$defs/bool",
-                  "x-databricks-preview": "PRIVATE",
-                  "doNotSuggest": true,
-                  "x-since-version": "v0.229.0"
-                },
-                "scd_type": {
-                  "description": "The SCD type to use to ingest the table.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.TableSpecificConfigScdType",
-                  "x-databricks-preview": "PRIVATE",
-                  "doNotSuggest": true,
-                  "x-since-version": "v0.229.0"
-                },
-                "sequence_by": {
-                  "description": "The column names specifying the logical order of events in the source data. Spark Declarative Pipelines uses this sequencing to handle change events that arrive out of order.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.231.0"
-                },
-                "workday_report_parameters": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.IngestionPipelineDefinitionWorkdayReportParameters",
-                  "x-databricks-preview": "PRIVATE",
-                  "doNotSuggest": true,
-                  "x-since-version": "v0.271.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "pipelines.TableSpecificConfigScdType": {
-              "type": "string",
-              "description": "The SCD type to use to ingest the table.",
-              "enum": [
-                "SCD_TYPE_1",
-                "SCD_TYPE_2",
-                "APPEND_ONLY"
-              ]
-            },
-            "pipelines.TikTokAdsOptions": {
-              "type": "object",
-              "description": "TikTok Ads specific options for ingestion",
-              "properties": {
-                "data_level": {
-                  "description": "(Optional) Data level for the report.\nIf not specified, defaults to AUCTION_CAMPAIGN.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.TikTokAdsOptionsTikTokDataLevel"
-                },
-                "dimensions": {
-                  "description": "(Optional) Dimensions to include in the report.\nExamples: \"campaign_id\", \"adgroup_id\", \"ad_id\", \"stat_time_day\", \"stat_time_hour\"\nIf not specified, defaults to campaign_id.",
-                  "$ref": "#/$defs/slice/string"
-                },
-                "lookback_window_days": {
-                  "description": "(Optional) Number of days to look back for report tables during incremental sync\nto capture late-arriving conversions and attribution data.\nIf not specified, defaults to 7 days.",
-                  "$ref": "#/$defs/int"
-                },
-                "metrics": {
-                  "description": "(Optional) Metrics to include in the report.\nExamples: \"spend\", \"impressions\", \"clicks\", \"conversion\", \"cpc\"\nIf not specified, defaults to basic metrics (spend, impressions, clicks, etc.)",
-                  "$ref": "#/$defs/slice/string"
-                },
-                "query_lifetime": {
-                  "description": "(Optional) Whether to request lifetime metrics (all-time aggregated data).\nWhen true, the report returns all-time data.\nIf not specified, defaults to false.",
-                  "$ref": "#/$defs/bool"
-                },
-                "report_type": {
-                  "description": "(Optional) Report type for the TikTok Ads API.\nIf not specified, defaults to BASIC.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.TikTokAdsOptionsTikTokReportType"
-                },
-                "sync_start_date": {
-                  "description": "(Optional) Start date for the initial sync of report tables in YYYY-MM-DD format.\nThis determines the earliest date from which to sync historical data.\nIf not specified, defaults to 1 year of historical data for daily reports\nand 30 days for hourly reports.",
-                  "$ref": "#/$defs/string"
-                }
-              },
-              "additionalProperties": false
-            },
-            "pipelines.TikTokAdsOptionsTikTokDataLevel": {
-              "type": "string",
-              "description": "Data level for TikTok Ads report aggregation.",
-              "enum": [
-                "AUCTION_ADVERTISER",
-                "AUCTION_CAMPAIGN",
-                "AUCTION_ADGROUP",
-                "AUCTION_AD"
-              ]
-            },
-            "pipelines.TikTokAdsOptionsTikTokReportType": {
-              "type": "string",
-              "description": "Report type for TikTok Ads API.",
-              "enum": [
-                "BASIC",
-                "AUDIENCE",
-                "PLAYABLE_AD",
-                "DSA",
-                "BUSINESS_CENTER",
-                "GMV_MAX"
-              ]
-            },
-            "postgres.EndpointGroupSpec": {
-              "type": "object",
-              "properties": {
-                "enable_readable_secondaries": {
-                  "description": "Whether to allow read-only connections to read-write endpoints. Only relevant for read-write endpoints where\nsize.max \u003e 1.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.290.0"
-                },
-                "max": {
-                  "description": "The maximum number of computes in the endpoint group. Currently, this must be equal to min. Set to 1 for single\ncompute endpoints, to disable HA. To manually suspend all computes in an endpoint group, set disabled to\ntrue on the EndpointSpec.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.290.0"
-                },
-                "min": {
-                  "description": "The minimum number of computes in the endpoint group. Currently, this must be equal to max. This must be greater\nthan or equal to 1.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.290.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "max",
-                "min"
-              ]
-            },
-            "postgres.EndpointSettings": {
-              "type": "object",
-              "description": "A collection of settings for a compute endpoint.",
-              "properties": {
-                "pg_settings": {
-                  "description": "A raw representation of Postgres settings.",
-                  "$ref": "#/$defs/map/string",
-                  "x-since-version": "v0.287.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "postgres.EndpointType": {
-              "type": "string",
-              "description": "The compute endpoint type. Either `read_write` or `read_only`.",
-              "enum": [
-                "ENDPOINT_TYPE_READ_WRITE",
-                "ENDPOINT_TYPE_READ_ONLY"
-              ]
-            },
-            "postgres.ProjectCustomTag": {
-              "type": "object",
-              "properties": {
-                "key": {
-                  "description": "The key of the custom tag.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.290.0"
-                },
-                "value": {
-                  "description": "The value of the custom tag.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.290.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "postgres.ProjectDefaultEndpointSettings": {
-              "type": "object",
-              "description": "A collection of settings for a compute endpoint.",
-              "properties": {
-                "autoscaling_limit_max_cu": {
-                  "description": "The maximum number of Compute Units. Minimum value is 0.5.",
-                  "$ref": "#/$defs/float64",
-                  "x-since-version": "v0.287.0"
-                },
-                "autoscaling_limit_min_cu": {
-                  "description": "The minimum number of Compute Units. Minimum value is 0.5.",
-                  "$ref": "#/$defs/float64",
-                  "x-since-version": "v0.287.0"
-                },
-                "no_suspension": {
-                  "description": "When set to true, explicitly disables automatic suspension (never suspend).\nShould be set to true when provided.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.287.0"
-                },
-                "pg_settings": {
-                  "description": "A raw representation of Postgres settings.",
-                  "$ref": "#/$defs/map/string",
-                  "x-since-version": "v0.287.0"
-                },
-                "suspend_timeout_duration": {
-                  "description": "Duration of inactivity after which the compute endpoint is automatically suspended.\nIf specified should be between 60s and 604800s (1 minute to 1 week).",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/common/types/duration.Duration",
-                  "x-since-version": "v0.287.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "serving.Ai21LabsConfig": {
-              "type": "object",
-              "properties": {
-                "ai21labs_api_key": {
-                  "description": "The Databricks secret key reference for an AI21 Labs API key. If you\nprefer to paste your API key directly, see `ai21labs_api_key_plaintext`.\nYou must provide an API key using one of the following fields:\n`ai21labs_api_key` or `ai21labs_api_key_plaintext`.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "ai21labs_api_key_plaintext": {
-                  "description": "An AI21 Labs API key provided as a plaintext string. If you prefer to\nreference your key using Databricks Secrets, see `ai21labs_api_key`. You\nmust provide an API key using one of the following fields:\n`ai21labs_api_key` or `ai21labs_api_key_plaintext`.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "serving.AiGatewayConfig": {
-              "type": "object",
-              "properties": {
-                "fallback_config": {
-                  "description": "Configuration for traffic fallback which auto fallbacks to other served entities if the request to a served\nentity fails with certain error codes, to increase availability.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.FallbackConfig",
-                  "x-since-version": "v0.246.0"
-                },
-                "guardrails": {
-                  "description": "Configuration for AI Guardrails to prevent unwanted data and unsafe data in requests and responses.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AiGatewayGuardrails",
-                  "x-since-version": "v0.230.0"
-                },
-                "inference_table_config": {
-                  "description": "Configuration for payload logging using inference tables.\nUse these tables to monitor and audit data being sent to and received from model APIs and to improve model quality.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AiGatewayInferenceTableConfig",
-                  "x-since-version": "v0.230.0"
-                },
-                "rate_limits": {
-                  "description": "Configuration for rate limits which can be set to limit endpoint traffic.",
-                  "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/serving.AiGatewayRateLimit",
-                  "x-since-version": "v0.230.0"
-                },
-                "usage_tracking_config": {
-                  "description": "Configuration to enable usage tracking using system tables.\nThese tables allow you to monitor operational usage on endpoints and their associated costs.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AiGatewayUsageTrackingConfig",
-                  "x-since-version": "v0.230.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "serving.AiGatewayGuardrailParameters": {
-              "type": "object",
-              "properties": {
-                "invalid_keywords": {
-                  "description": "List of invalid keywords.\nAI guardrail uses keyword or string matching to decide if the keyword exists in the request or response content.",
-                  "$ref": "#/$defs/slice/string",
-                  "deprecationMessage": "This field is deprecated",
-                  "x-since-version": "v0.230.0",
-                  "deprecated": true
-                },
-                "pii": {
-                  "description": "Configuration for guardrail PII filter.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AiGatewayGuardrailPiiBehavior",
-                  "x-since-version": "v0.230.0"
-                },
-                "safety": {
-                  "description": "Indicates whether the safety filter is enabled.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.230.0"
-                },
-                "valid_topics": {
-                  "description": "The list of allowed topics.\nGiven a chat request, this guardrail flags the request if its topic is not in the allowed topics.",
-                  "$ref": "#/$defs/slice/string",
-                  "deprecationMessage": "This field is deprecated",
-                  "x-since-version": "v0.230.0",
-                  "deprecated": true
-                }
-              },
-              "additionalProperties": false
-            },
-            "serving.AiGatewayGuardrailPiiBehavior": {
-              "type": "object",
-              "properties": {
-                "behavior": {
-                  "description": "Configuration for input guardrail filters.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AiGatewayGuardrailPiiBehaviorBehavior",
-                  "x-since-version": "v0.230.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "serving.AiGatewayGuardrailPiiBehaviorBehavior": {
-              "type": "string",
-              "enum": [
-                "NONE",
-                "BLOCK",
-                "MASK"
-              ]
-            },
-            "serving.AiGatewayGuardrails": {
-              "type": "object",
-              "properties": {
-                "input": {
-                  "description": "Configuration for input guardrail filters.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AiGatewayGuardrailParameters",
-                  "x-since-version": "v0.230.0"
-                },
-                "output": {
-                  "description": "Configuration for output guardrail filters.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AiGatewayGuardrailParameters",
-                  "x-since-version": "v0.230.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "serving.AiGatewayInferenceTableConfig": {
-              "type": "object",
-              "properties": {
-                "catalog_name": {
-                  "description": "The name of the catalog in Unity Catalog. Required when enabling inference tables.\nNOTE: On update, you have to disable inference table first in order to change the catalog name.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.230.0"
-                },
-                "enabled": {
-                  "description": "Indicates whether the inference table is enabled.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.230.0"
-                },
-                "schema_name": {
-                  "description": "The name of the schema in Unity Catalog. Required when enabling inference tables.\nNOTE: On update, you have to disable inference table first in order to change the schema name.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.230.0"
-                },
-                "table_name_prefix": {
-                  "description": "The prefix of the table in Unity Catalog.\nNOTE: On update, you have to disable inference table first in order to change the prefix name.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.230.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "serving.AiGatewayRateLimit": {
-              "type": "object",
-              "properties": {
-                "calls": {
-                  "description": "Used to specify how many calls are allowed for a key within the renewal_period.",
-                  "$ref": "#/$defs/int64",
-                  "x-since-version": "v0.230.0"
-                },
-                "key": {
-                  "description": "Key field for a rate limit. Currently, 'user', 'user_group, 'service_principal', and 'endpoint' are supported,\nwith 'endpoint' being the default if not specified.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AiGatewayRateLimitKey",
-                  "x-since-version": "v0.230.0"
-                },
-                "principal": {
-                  "description": "Principal field for a user, user group, or service principal to apply rate limiting to. Accepts a user email, group name, or service principal application ID.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.260.0"
-                },
-                "renewal_period": {
-                  "description": "Renewal period field for a rate limit. Currently, only 'minute' is supported.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AiGatewayRateLimitRenewalPeriod",
-                  "x-since-version": "v0.230.0"
-                },
-                "tokens": {
-                  "description": "Used to specify how many tokens are allowed for a key within the renewal_period.",
-                  "$ref": "#/$defs/int64",
-                  "x-since-version": "v0.265.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "renewal_period"
-              ]
-            },
-            "serving.AiGatewayRateLimitKey": {
-              "type": "string",
-              "enum": [
-                "user",
-                "endpoint",
-                "user_group",
-                "service_principal"
-              ]
-            },
-            "serving.AiGatewayRateLimitRenewalPeriod": {
-              "type": "string",
-              "enum": [
-                "minute"
-              ]
-            },
-            "serving.AiGatewayUsageTrackingConfig": {
-              "type": "object",
-              "properties": {
-                "enabled": {
-                  "description": "Whether to enable usage tracking.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.230.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "serving.AmazonBedrockConfig": {
-              "type": "object",
-              "properties": {
-                "aws_access_key_id": {
-                  "description": "The Databricks secret key reference for an AWS access key ID with\npermissions to interact with Bedrock services. If you prefer to paste\nyour API key directly, see `aws_access_key_id_plaintext`. You must provide an API\nkey using one of the following fields: `aws_access_key_id` or\n`aws_access_key_id_plaintext`.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "aws_access_key_id_plaintext": {
-                  "description": "An AWS access key ID with permissions to interact with Bedrock services\nprovided as a plaintext string. If you prefer to reference your key using\nDatabricks Secrets, see `aws_access_key_id`. You must provide an API key\nusing one of the following fields: `aws_access_key_id` or\n`aws_access_key_id_plaintext`.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "aws_region": {
-                  "description": "The AWS region to use. Bedrock has to be enabled there.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "aws_secret_access_key": {
-                  "description": "The Databricks secret key reference for an AWS secret access key paired\nwith the access key ID, with permissions to interact with Bedrock\nservices. If you prefer to paste your API key directly, see\n`aws_secret_access_key_plaintext`. You must provide an API key using one\nof the following fields: `aws_secret_access_key` or\n`aws_secret_access_key_plaintext`.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "aws_secret_access_key_plaintext": {
-                  "description": "An AWS secret access key paired with the access key ID, with permissions\nto interact with Bedrock services provided as a plaintext string. If you\nprefer to reference your key using Databricks Secrets, see\n`aws_secret_access_key`. You must provide an API key using one of the\nfollowing fields: `aws_secret_access_key` or\n`aws_secret_access_key_plaintext`.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "bedrock_provider": {
-                  "description": "The underlying provider in Amazon Bedrock. Supported values (case\ninsensitive) include: Anthropic, Cohere, AI21Labs, Amazon.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AmazonBedrockConfigBedrockProvider",
-                  "x-since-version": "v0.229.0"
-                },
-                "instance_profile_arn": {
-                  "description": "ARN of the instance profile that the external model will use to access AWS resources.\nYou must authenticate using an instance profile or access keys.\nIf you prefer to authenticate using access keys, see `aws_access_key_id`,\n`aws_access_key_id_plaintext`, `aws_secret_access_key` and `aws_secret_access_key_plaintext`.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.243.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "aws_region",
-                "bedrock_provider"
-              ]
-            },
-            "serving.AmazonBedrockConfigBedrockProvider": {
-              "type": "string",
-              "enum": [
-                "anthropic",
-                "cohere",
-                "ai21labs",
-                "amazon"
-              ]
-            },
-            "serving.AnthropicConfig": {
-              "type": "object",
-              "properties": {
-                "anthropic_api_key": {
-                  "description": "The Databricks secret key reference for an Anthropic API key. If you\nprefer to paste your API key directly, see `anthropic_api_key_plaintext`.\nYou must provide an API key using one of the following fields:\n`anthropic_api_key` or `anthropic_api_key_plaintext`.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "anthropic_api_key_plaintext": {
-                  "description": "The Anthropic API key provided as a plaintext string. If you prefer to\nreference your key using Databricks Secrets, see `anthropic_api_key`. You\nmust provide an API key using one of the following fields:\n`anthropic_api_key` or `anthropic_api_key_plaintext`.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "serving.ApiKeyAuth": {
-              "type": "object",
-              "properties": {
-                "key": {
-                  "description": "The name of the API key parameter used for authentication.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.246.0"
-                },
-                "value": {
-                  "description": "The Databricks secret key reference for an API Key.\nIf you prefer to paste your token directly, see `value_plaintext`.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.246.0"
-                },
-                "value_plaintext": {
-                  "description": "The API Key provided as a plaintext string. If you prefer to reference your\ntoken using Databricks Secrets, see `value`.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.246.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "key"
-              ]
-            },
-            "serving.AutoCaptureConfigInput": {
-              "type": "object",
-              "properties": {
-                "catalog_name": {
-                  "description": "The name of the catalog in Unity Catalog. NOTE: On update, you cannot change the catalog name if the inference table is already enabled.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "enabled": {
-                  "description": "Indicates whether the inference table is enabled.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.229.0"
-                },
-                "schema_name": {
-                  "description": "The name of the schema in Unity Catalog. NOTE: On update, you cannot change the schema name if the inference table is already enabled.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "table_name_prefix": {
-                  "description": "The prefix of the table in Unity Catalog. NOTE: On update, you cannot change the prefix name if the inference table is already enabled.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "serving.BearerTokenAuth": {
-              "type": "object",
-              "properties": {
-                "token": {
-                  "description": "The Databricks secret key reference for a token.\nIf you prefer to paste your token directly, see `token_plaintext`.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.246.0"
-                },
-                "token_plaintext": {
-                  "description": "The token provided as a plaintext string. If you prefer to reference your\ntoken using Databricks Secrets, see `token`.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.246.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "serving.CohereConfig": {
-              "type": "object",
-              "properties": {
-                "cohere_api_base": {
-                  "description": "This is an optional field to provide a customized base URL for the Cohere\nAPI. If left unspecified, the standard Cohere base URL is used.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "cohere_api_key": {
-                  "description": "The Databricks secret key reference for a Cohere API key. If you prefer\nto paste your API key directly, see `cohere_api_key_plaintext`. You must\nprovide an API key using one of the following fields: `cohere_api_key` or\n`cohere_api_key_plaintext`.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "cohere_api_key_plaintext": {
-                  "description": "The Cohere API key provided as a plaintext string. If you prefer to\nreference your key using Databricks Secrets, see `cohere_api_key`. You\nmust provide an API key using one of the following fields:\n`cohere_api_key` or `cohere_api_key_plaintext`.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "serving.CustomProviderConfig": {
-              "type": "object",
-              "description": "Configs needed to create a custom provider model route.",
-              "properties": {
-                "api_key_auth": {
-                  "description": "This is a field to provide API key authentication for the custom provider API.\nYou can only specify one authentication method.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.ApiKeyAuth",
-                  "x-since-version": "v0.246.0"
-                },
-                "bearer_token_auth": {
-                  "description": "This is a field to provide bearer token authentication for the custom provider API.\nYou can only specify one authentication method.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.BearerTokenAuth",
-                  "x-since-version": "v0.246.0"
-                },
-                "custom_provider_url": {
-                  "description": "This is a field to provide the URL of the custom provider API.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.246.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "custom_provider_url"
-              ]
-            },
-            "serving.DatabricksModelServingConfig": {
-              "type": "object",
-              "properties": {
-                "databricks_api_token": {
-                  "description": "The Databricks secret key reference for a Databricks API token that\ncorresponds to a user or service principal with Can Query access to the\nmodel serving endpoint pointed to by this external model. If you prefer\nto paste your API key directly, see `databricks_api_token_plaintext`. You\nmust provide an API key using one of the following fields:\n`databricks_api_token` or `databricks_api_token_plaintext`.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "databricks_api_token_plaintext": {
-                  "description": "The Databricks API token that corresponds to a user or service principal\nwith Can Query access to the model serving endpoint pointed to by this\nexternal model provided as a plaintext string. If you prefer to reference\nyour key using Databricks Secrets, see `databricks_api_token`. You must\nprovide an API key using one of the following fields:\n`databricks_api_token` or `databricks_api_token_plaintext`.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "databricks_workspace_url": {
-                  "description": "The URL of the Databricks workspace containing the model serving endpoint\npointed to by this external model.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "databricks_workspace_url"
-              ]
-            },
-            "serving.EmailNotifications": {
-              "type": "object",
-              "properties": {
-                "on_update_failure": {
-                  "description": "A list of email addresses to be notified when an endpoint fails to update its configuration or state.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.264.0"
-                },
-                "on_update_success": {
-                  "description": "A list of email addresses to be notified when an endpoint successfully updates its configuration or state.",
-                  "$ref": "#/$defs/slice/string",
-                  "x-since-version": "v0.264.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "serving.EndpointCoreConfigInput": {
-              "type": "object",
-              "properties": {
-                "auto_capture_config": {
-                  "description": "Configuration for Inference Tables which automatically logs requests and responses to Unity Catalog.\nNote: this field is deprecated for creating new provisioned throughput endpoints,\nor updating existing provisioned throughput endpoints that never have inference table configured;\nin these cases please use AI Gateway to manage inference tables.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AutoCaptureConfigInput",
-                  "x-since-version": "v0.229.0"
-                },
-                "served_entities": {
-                  "description": "The list of served entities under the serving endpoint config.",
-                  "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/serving.ServedEntityInput",
-                  "x-since-version": "v0.229.0"
-                },
-                "served_models": {
-                  "description": "(Deprecated, use served_entities instead) The list of served models under the serving endpoint config.",
-                  "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/serving.ServedModelInput",
-                  "x-since-version": "v0.229.0"
-                },
-                "traffic_config": {
-                  "description": "The traffic configuration associated with the serving endpoint config.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.TrafficConfig",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "serving.EndpointTag": {
-              "type": "object",
-              "properties": {
-                "key": {
-                  "description": "Key field for a serving endpoint tag.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "value": {
-                  "description": "Optional value field for a serving endpoint tag.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "key"
-              ]
-            },
-            "serving.ExternalModel": {
-              "type": "object",
-              "properties": {
-                "ai21labs_config": {
-                  "description": "AI21Labs Config. Only required if the provider is 'ai21labs'.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.Ai21LabsConfig",
-                  "x-since-version": "v0.229.0"
-                },
-                "amazon_bedrock_config": {
-                  "description": "Amazon Bedrock Config. Only required if the provider is 'amazon-bedrock'.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AmazonBedrockConfig",
-                  "x-since-version": "v0.229.0"
-                },
-                "anthropic_config": {
-                  "description": "Anthropic Config. Only required if the provider is 'anthropic'.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AnthropicConfig",
-                  "x-since-version": "v0.229.0"
-                },
-                "cohere_config": {
-                  "description": "Cohere Config. Only required if the provider is 'cohere'.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.CohereConfig",
-                  "x-since-version": "v0.229.0"
-                },
-                "custom_provider_config": {
-                  "description": "Custom Provider Config. Only required if the provider is 'custom'.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.CustomProviderConfig",
-                  "x-since-version": "v0.246.0"
-                },
-                "databricks_model_serving_config": {
-                  "description": "Databricks Model Serving Config. Only required if the provider is 'databricks-model-serving'.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.DatabricksModelServingConfig",
-                  "x-since-version": "v0.229.0"
-                },
-                "google_cloud_vertex_ai_config": {
-                  "description": "Google Cloud Vertex AI Config. Only required if the provider is 'google-cloud-vertex-ai'.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.GoogleCloudVertexAiConfig",
-                  "x-since-version": "v0.229.0"
-                },
-                "name": {
-                  "description": "The name of the external model.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "openai_config": {
-                  "description": "OpenAI Config. Only required if the provider is 'openai'.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.OpenAiConfig",
-                  "x-since-version": "v0.229.0"
-                },
-                "palm_config": {
-                  "description": "PaLM Config. Only required if the provider is 'palm'.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.PaLmConfig",
-                  "x-since-version": "v0.229.0"
-                },
-                "provider": {
-                  "description": "The name of the provider for the external model. Currently, the supported providers are 'ai21labs', 'anthropic', 'amazon-bedrock', 'cohere', 'databricks-model-serving', 'google-cloud-vertex-ai', 'openai', 'palm', and 'custom'.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.ExternalModelProvider",
-                  "x-since-version": "v0.229.0"
-                },
-                "task": {
-                  "description": "The task type of the external model.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "name",
-                "provider",
-                "task"
-              ]
-            },
-            "serving.ExternalModelProvider": {
-              "type": "string",
-              "enum": [
-                "ai21labs",
-                "anthropic",
-                "amazon-bedrock",
-                "cohere",
-                "databricks-model-serving",
-                "google-cloud-vertex-ai",
-                "openai",
-                "palm",
-                "custom"
-              ]
-            },
-            "serving.FallbackConfig": {
-              "type": "object",
-              "properties": {
-                "enabled": {
-                  "description": "Whether to enable traffic fallback. When a served entity in the serving endpoint returns specific error\ncodes (e.g. 500), the request will automatically be round-robin attempted with other served entities in the same\nendpoint, following the order of served entity list, until a successful response is returned.\nIf all attempts fail, return the last response with the error code.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.246.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "enabled"
-              ]
-            },
-            "serving.GoogleCloudVertexAiConfig": {
-              "type": "object",
-              "properties": {
-                "private_key": {
-                  "description": "The Databricks secret key reference for a private key for the service\naccount which has access to the Google Cloud Vertex AI Service. See [Best\npractices for managing service account keys]. If you prefer to paste your\nAPI key directly, see `private_key_plaintext`. You must provide an API\nkey using one of the following fields: `private_key` or\n`private_key_plaintext`\n\n[Best practices for managing service account keys]: https://cloud.google.com/iam/docs/best-practices-for-managing-service-account-keys",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "private_key_plaintext": {
-                  "description": "The private key for the service account which has access to the Google\nCloud Vertex AI Service provided as a plaintext secret. See [Best\npractices for managing service account keys]. If you prefer to reference\nyour key using Databricks Secrets, see `private_key`. You must provide an\nAPI key using one of the following fields: `private_key` or\n`private_key_plaintext`.\n\n[Best practices for managing service account keys]: https://cloud.google.com/iam/docs/best-practices-for-managing-service-account-keys",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "project_id": {
-                  "description": "This is the Google Cloud project id that the service account is\nassociated with.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "region": {
-                  "description": "This is the region for the Google Cloud Vertex AI Service. See [supported\nregions] for more details. Some models are only available in specific\nregions.\n\n[supported regions]: https://cloud.google.com/vertex-ai/docs/general/locations",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "project_id",
-                "region"
-              ]
-            },
-            "serving.OpenAiConfig": {
-              "type": "object",
-              "description": "Configs needed to create an OpenAI model route.",
-              "properties": {
-                "microsoft_entra_client_id": {
-                  "description": "This field is only required for Azure AD OpenAI and is the Microsoft\nEntra Client ID.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "microsoft_entra_client_secret": {
-                  "description": "The Databricks secret key reference for a client secret used for\nMicrosoft Entra ID authentication. If you prefer to paste your client\nsecret directly, see `microsoft_entra_client_secret_plaintext`. You must\nprovide an API key using one of the following fields:\n`microsoft_entra_client_secret` or\n`microsoft_entra_client_secret_plaintext`.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "microsoft_entra_client_secret_plaintext": {
-                  "description": "The client secret used for Microsoft Entra ID authentication provided as\na plaintext string. If you prefer to reference your key using Databricks\nSecrets, see `microsoft_entra_client_secret`. You must provide an API key\nusing one of the following fields: `microsoft_entra_client_secret` or\n`microsoft_entra_client_secret_plaintext`.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "microsoft_entra_tenant_id": {
-                  "description": "This field is only required for Azure AD OpenAI and is the Microsoft\nEntra Tenant ID.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "openai_api_base": {
-                  "description": "This is a field to provide a customized base URl for the OpenAI API. For\nAzure OpenAI, this field is required, and is the base URL for the Azure\nOpenAI API service provided by Azure. For other OpenAI API types, this\nfield is optional, and if left unspecified, the standard OpenAI base URL\nis used.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "openai_api_key": {
-                  "description": "The Databricks secret key reference for an OpenAI API key using the\nOpenAI or Azure service. If you prefer to paste your API key directly,\nsee `openai_api_key_plaintext`. You must provide an API key using one of\nthe following fields: `openai_api_key` or `openai_api_key_plaintext`.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "openai_api_key_plaintext": {
-                  "description": "The OpenAI API key using the OpenAI or Azure service provided as a\nplaintext string. If you prefer to reference your key using Databricks\nSecrets, see `openai_api_key`. You must provide an API key using one of\nthe following fields: `openai_api_key` or `openai_api_key_plaintext`.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "openai_api_type": {
-                  "description": "This is an optional field to specify the type of OpenAI API to use. For\nAzure OpenAI, this field is required, and adjust this parameter to\nrepresent the preferred security access validation protocol. For access\ntoken validation, use azure. For authentication using Azure Active\nDirectory (Azure AD) use, azuread.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "openai_api_version": {
-                  "description": "This is an optional field to specify the OpenAI API version. For Azure\nOpenAI, this field is required, and is the version of the Azure OpenAI\nservice to utilize, specified by a date.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "openai_deployment_name": {
-                  "description": "This field is only required for Azure OpenAI and is the name of the\ndeployment resource for the Azure OpenAI service.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "openai_organization": {
-                  "description": "This is an optional field to specify the organization in OpenAI or Azure\nOpenAI.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "serving.PaLmConfig": {
-              "type": "object",
-              "properties": {
-                "palm_api_key": {
-                  "description": "The Databricks secret key reference for a PaLM API key. If you prefer to\npaste your API key directly, see `palm_api_key_plaintext`. You must\nprovide an API key using one of the following fields: `palm_api_key` or\n`palm_api_key_plaintext`.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "palm_api_key_plaintext": {
-                  "description": "The PaLM API key provided as a plaintext string. If you prefer to\nreference your key using Databricks Secrets, see `palm_api_key`. You must\nprovide an API key using one of the following fields: `palm_api_key` or\n`palm_api_key_plaintext`.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "serving.RateLimit": {
-              "type": "object",
-              "properties": {
-                "calls": {
-                  "description": "Used to specify how many calls are allowed for a key within the renewal_period.",
-                  "$ref": "#/$defs/int64",
-                  "x-since-version": "v0.229.0"
-                },
-                "key": {
-                  "description": "Key field for a serving endpoint rate limit. Currently, only 'user' and 'endpoint' are supported, with 'endpoint' being the default if not specified.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.RateLimitKey",
-                  "x-since-version": "v0.229.0"
-                },
-                "renewal_period": {
-                  "description": "Renewal period field for a serving endpoint rate limit. Currently, only 'minute' is supported.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.RateLimitRenewalPeriod",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "calls",
-                "renewal_period"
-              ]
-            },
-            "serving.RateLimitKey": {
-              "type": "string",
-              "enum": [
-                "user",
-                "endpoint"
-              ]
-            },
-            "serving.RateLimitRenewalPeriod": {
-              "type": "string",
-              "enum": [
-                "minute"
-              ]
-            },
-            "serving.Route": {
-              "type": "object",
-              "properties": {
-                "served_entity_name": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.260.0"
-                },
-                "served_model_name": {
-                  "description": "The name of the served model this route configures traffic for.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "traffic_percentage": {
-                  "description": "The percentage of endpoint traffic to send to this route. It must be an integer between 0 and 100 inclusive.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "traffic_percentage"
-              ]
-            },
-            "serving.ServedEntityInput": {
-              "type": "object",
-              "properties": {
-                "burst_scaling_enabled": {
-                  "description": "Whether burst scaling is enabled. When enabled (default), the endpoint can automatically\nscale up beyond provisioned capacity to handle traffic spikes. When disabled, the endpoint\nmaintains fixed capacity at provisioned_model_units.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.288.0"
-                },
-                "entity_name": {
-                  "description": "The name of the entity to be served. The entity may be a model in the Databricks Model Registry, a model in the Unity Catalog (UC), or a function of type FEATURE_SPEC in the UC. If it is a UC object, the full name of the object should be given in the form of **catalog_name.schema_name.model_name**.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "entity_version": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "environment_vars": {
-                  "description": "An object containing a set of optional, user-specified environment variable key-value pairs used for serving this entity. Note: this is an experimental feature and subject to change. Example entity environment variables that refer to Databricks secrets: `{\"OPENAI_API_KEY\": \"{{secrets/my_scope/my_key}}\", \"DATABRICKS_TOKEN\": \"{{secrets/my_scope2/my_key2}}\"}`",
-                  "$ref": "#/$defs/map/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "external_model": {
-                  "description": "The external model to be served. NOTE: Only one of external_model and (entity_name, entity_version, workload_size, workload_type, and scale_to_zero_enabled) can be specified with the latter set being used for custom model serving for a Databricks registered model. For an existing endpoint with external_model, it cannot be updated to an endpoint without external_model. If the endpoint is created without external_model, users cannot update it to add external_model later. The task type of all external models within an endpoint must be the same.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.ExternalModel",
-                  "x-since-version": "v0.229.0"
-                },
-                "instance_profile_arn": {
-                  "description": "ARN of the instance profile that the served entity uses to access AWS resources.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "max_provisioned_concurrency": {
-                  "description": "The maximum provisioned concurrency that the endpoint can scale up to. Do not use if workload_size is specified.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.256.0"
-                },
-                "max_provisioned_throughput": {
-                  "description": "The maximum tokens per second that the endpoint can scale up to.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.229.0"
-                },
-                "min_provisioned_concurrency": {
-                  "description": "The minimum provisioned concurrency that the endpoint can scale down to. Do not use if workload_size is specified.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.256.0"
-                },
-                "min_provisioned_throughput": {
-                  "description": "The minimum tokens per second that the endpoint can scale down to.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.229.0"
-                },
-                "name": {
-                  "description": "The name of a served entity. It must be unique across an endpoint. A served entity name can consist of alphanumeric characters, dashes, and underscores. If not specified for an external model, this field defaults to external_model.name, with '.' and ':' replaced with '-', and if not specified for other entities, it defaults to entity_name-entity_version.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "provisioned_model_units": {
-                  "description": "The number of model units provisioned.",
-                  "$ref": "#/$defs/int64",
-                  "x-since-version": "v0.252.0"
-                },
-                "scale_to_zero_enabled": {
-                  "description": "Whether the compute resources for the served entity should scale down to zero.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.229.0"
-                },
-                "workload_size": {
-                  "description": "The workload size of the served entity. The workload size corresponds to a range of provisioned concurrency that the compute autoscales between. A single unit of provisioned concurrency can process one request at a time. Valid workload sizes are \"Small\" (4 - 4 provisioned concurrency), \"Medium\" (8 - 16 provisioned concurrency), and \"Large\" (16 - 64 provisioned concurrency). Additional custom workload sizes can also be used when available in the workspace. If scale-to-zero is enabled, the lower bound of the provisioned concurrency for each workload size is 0. Do not use if min_provisioned_concurrency and max_provisioned_concurrency are specified.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "workload_type": {
-                  "description": "The workload type of the served entity. The workload type selects which type of compute to use in the endpoint. The default value for this parameter is \"CPU\". For deep learning workloads, GPU acceleration is available by selecting workload types like GPU_SMALL and others. See the available [GPU types](https://docs.databricks.com/en/machine-learning/model-serving/create-manage-serving-endpoints.html#gpu-workload-types).",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.ServingModelWorkloadType",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "serving.ServedModelInput": {
-              "type": "object",
-              "properties": {
-                "burst_scaling_enabled": {
-                  "description": "Whether burst scaling is enabled. When enabled (default), the endpoint can automatically\nscale up beyond provisioned capacity to handle traffic spikes. When disabled, the endpoint\nmaintains fixed capacity at provisioned_model_units.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.288.0"
-                },
-                "environment_vars": {
-                  "description": "An object containing a set of optional, user-specified environment variable key-value pairs used for serving this entity. Note: this is an experimental feature and subject to change. Example entity environment variables that refer to Databricks secrets: `{\"OPENAI_API_KEY\": \"{{secrets/my_scope/my_key}}\", \"DATABRICKS_TOKEN\": \"{{secrets/my_scope2/my_key2}}\"}`",
-                  "$ref": "#/$defs/map/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "instance_profile_arn": {
-                  "description": "ARN of the instance profile that the served entity uses to access AWS resources.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "max_provisioned_concurrency": {
-                  "description": "The maximum provisioned concurrency that the endpoint can scale up to. Do not use if workload_size is specified.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.256.0"
-                },
-                "max_provisioned_throughput": {
-                  "description": "The maximum tokens per second that the endpoint can scale up to.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.229.0"
-                },
-                "min_provisioned_concurrency": {
-                  "description": "The minimum provisioned concurrency that the endpoint can scale down to. Do not use if workload_size is specified.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.256.0"
-                },
-                "min_provisioned_throughput": {
-                  "description": "The minimum tokens per second that the endpoint can scale down to.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.229.0"
-                },
-                "model_name": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "model_version": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "name": {
-                  "description": "The name of a served entity. It must be unique across an endpoint. A served entity name can consist of alphanumeric characters, dashes, and underscores. If not specified for an external model, this field defaults to external_model.name, with '.' and ':' replaced with '-', and if not specified for other entities, it defaults to entity_name-entity_version.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "provisioned_model_units": {
-                  "description": "The number of model units provisioned.",
-                  "$ref": "#/$defs/int64",
-                  "x-since-version": "v0.252.0"
-                },
-                "scale_to_zero_enabled": {
-                  "description": "Whether the compute resources for the served entity should scale down to zero.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.229.0"
-                },
-                "workload_size": {
-                  "description": "The workload size of the served entity. The workload size corresponds to a range of provisioned concurrency that the compute autoscales between. A single unit of provisioned concurrency can process one request at a time. Valid workload sizes are \"Small\" (4 - 4 provisioned concurrency), \"Medium\" (8 - 16 provisioned concurrency), and \"Large\" (16 - 64 provisioned concurrency). Additional custom workload sizes can also be used when available in the workspace. If scale-to-zero is enabled, the lower bound of the provisioned concurrency for each workload size is 0. Do not use if min_provisioned_concurrency and max_provisioned_concurrency are specified.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.229.0"
-                },
-                "workload_type": {
-                  "description": "The workload type of the served entity. The workload type selects which type of compute to use in the endpoint. The default value for this parameter is \"CPU\". For deep learning workloads, GPU acceleration is available by selecting workload types like GPU_SMALL and others. See the available [GPU types](https://docs.databricks.com/en/machine-learning/model-serving/create-manage-serving-endpoints.html#gpu-workload-types).",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.ServedModelInputWorkloadType",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "model_name",
-                "model_version",
-                "scale_to_zero_enabled"
-              ]
-            },
-            "serving.ServedModelInputWorkloadType": {
-              "type": "string",
-              "description": "Please keep this in sync with with workload types in InferenceEndpointEntities.scala",
-              "enum": [
-                "CPU",
-                "GPU_MEDIUM",
-                "GPU_SMALL",
-                "GPU_LARGE",
-                "MULTIGPU_MEDIUM"
-              ]
-            },
-            "serving.ServingEndpointPermissionLevel": {
-              "type": "string",
-              "description": "Permission level",
-              "enum": [
-                "CAN_MANAGE",
-                "CAN_QUERY",
-                "CAN_VIEW"
-              ]
-            },
-            "serving.ServingModelWorkloadType": {
-              "type": "string",
-              "description": "Please keep this in sync with with workload types in InferenceEndpointEntities.scala",
-              "enum": [
-                "CPU",
-                "GPU_MEDIUM",
-                "GPU_SMALL",
-                "GPU_LARGE",
-                "MULTIGPU_MEDIUM"
-              ]
-            },
-            "serving.TrafficConfig": {
-              "type": "object",
-              "properties": {
-                "routes": {
-                  "description": "The list of routes that define traffic to each served entity.",
-                  "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/serving.Route",
-                  "x-since-version": "v0.229.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "sql.Aggregation": {
-              "type": "string",
-              "enum": [
-                "SUM",
-                "COUNT",
-                "COUNT_DISTINCT",
-                "AVG",
-                "MEDIAN",
-                "MIN",
-                "MAX",
-                "STDDEV"
-              ]
-            },
-            "sql.AlertEvaluationState": {
-              "type": "string",
-              "description": "UNSPECIFIED - default unspecify value for proto enum, do not use it in the code\nUNKNOWN - alert not yet evaluated\nTRIGGERED - alert is triggered\nOK - alert is not triggered\nERROR - alert evaluation failed",
-              "enum": [
-                "UNKNOWN",
-                "TRIGGERED",
-                "OK",
-                "ERROR"
-              ]
-            },
-            "sql.AlertLifecycleState": {
-              "type": "string",
-              "enum": [
-                "ACTIVE",
-                "DELETED"
-              ]
-            },
-            "sql.AlertV2Evaluation": {
-              "type": "object",
-              "properties": {
-                "comparison_operator": {
-                  "description": "Operator used for comparison in alert evaluation.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.ComparisonOperator",
-                  "x-since-version": "v0.279.0"
-                },
-                "empty_result_state": {
-                  "description": "Alert state if result is empty. Please avoid setting this field to be `UNKNOWN` because `UNKNOWN` state is planned to be deprecated.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.AlertEvaluationState",
-                  "x-since-version": "v0.279.0"
-                },
-                "notification": {
-                  "description": "User or Notification Destination to notify when alert is triggered.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.AlertV2Notification",
-                  "x-since-version": "v0.279.0"
-                },
-                "source": {
-                  "description": "Source column from result to use to evaluate alert",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.AlertV2OperandColumn",
-                  "x-since-version": "v0.279.0"
-                },
-                "threshold": {
-                  "description": "Threshold to user for alert evaluation, can be a column or a value.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.AlertV2Operand",
-                  "x-since-version": "v0.279.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "comparison_operator",
-                "source"
-              ]
-            },
-            "sql.AlertV2Notification": {
-              "type": "object",
-              "properties": {
-                "notify_on_ok": {
-                  "description": "Whether to notify alert subscribers when alert returns back to normal.",
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.279.0"
-                },
-                "retrigger_seconds": {
-                  "description": "Number of seconds an alert waits after being triggered before it is allowed to send another notification.\nIf set to 0 or omitted, the alert will not send any further notifications after the first trigger\nSetting this value to 1 allows the alert to send a notification on every evaluation where the condition is met, effectively making it always retrigger for notification purposes.",
-                  "$ref": "#/$defs/int",
-                  "x-since-version": "v0.279.0"
-                },
-                "subscriptions": {
-                  "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/sql.AlertV2Subscription",
-                  "x-since-version": "v0.279.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "sql.AlertV2Operand": {
-              "type": "object",
-              "properties": {
-                "column": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.AlertV2OperandColumn",
-                  "x-since-version": "v0.279.0"
-                },
-                "value": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.AlertV2OperandValue",
-                  "x-since-version": "v0.279.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "sql.AlertV2OperandColumn": {
-              "type": "object",
-              "properties": {
-                "aggregation": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.Aggregation",
-                  "x-since-version": "v0.279.0"
-                },
-                "display": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.279.0"
-                },
-                "name": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.279.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "name"
-              ]
-            },
-            "sql.AlertV2OperandValue": {
-              "type": "object",
-              "properties": {
-                "bool_value": {
-                  "$ref": "#/$defs/bool",
-                  "x-since-version": "v0.279.0"
-                },
-                "double_value": {
-                  "$ref": "#/$defs/float64",
-                  "x-since-version": "v0.279.0"
-                },
-                "string_value": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.279.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "sql.AlertV2RunAs": {
-              "type": "object",
-              "properties": {
-                "service_principal_name": {
-                  "description": "Application ID of an active service principal. Setting this field requires the `servicePrincipal/user` role.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.279.0"
-                },
-                "user_name": {
-                  "description": "The email of an active workspace user. Can only set this field to their own email.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.279.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "sql.AlertV2Subscription": {
-              "type": "object",
-              "properties": {
-                "destination_id": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.279.0"
-                },
-                "user_email": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.279.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "sql.Channel": {
-              "type": "object",
-              "description": "Configures the channel name and DBSQL version of the warehouse. CHANNEL_NAME_CUSTOM should be chosen only when `dbsql_version` is specified.",
-              "properties": {
-                "dbsql_version": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.260.0"
-                },
-                "name": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.ChannelName",
-                  "x-since-version": "v0.260.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "sql.ChannelName": {
-              "type": "string",
-              "enum": [
-                "CHANNEL_NAME_PREVIEW",
-                "CHANNEL_NAME_CURRENT",
-                "CHANNEL_NAME_PREVIOUS",
-                "CHANNEL_NAME_CUSTOM"
-              ]
-            },
-            "sql.ComparisonOperator": {
-              "type": "string",
-              "enum": [
-                "LESS_THAN",
-                "GREATER_THAN",
-                "EQUAL",
-                "NOT_EQUAL",
-                "GREATER_THAN_OR_EQUAL",
-                "LESS_THAN_OR_EQUAL",
-                "IS_NULL",
-                "IS_NOT_NULL"
-              ]
-            },
-            "sql.CreateWarehouseRequestWarehouseType": {
-              "type": "string",
-              "enum": [
-                "TYPE_UNSPECIFIED",
-                "CLASSIC",
-                "PRO"
-              ]
-            },
-            "sql.CronSchedule": {
-              "type": "object",
-              "properties": {
-                "pause_status": {
-                  "description": "Indicate whether this schedule is paused or not.",
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.SchedulePauseStatus",
-                  "x-since-version": "v0.279.0"
-                },
-                "quartz_cron_schedule": {
-                  "description": "A cron expression using quartz syntax that specifies the schedule for this pipeline.\nShould use the quartz format described here: http://www.quartz-scheduler.org/documentation/quartz-2.1.7/tutorials/tutorial-lesson-06.html",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.279.0"
-                },
-                "timezone_id": {
-                  "description": "A Java timezone id. The schedule will be resolved using this timezone.\nThis will be combined with the quartz_cron_schedule to determine the schedule.\nSee https://docs.databricks.com/sql/language-manual/sql-ref-syntax-aux-conf-mgmt-set-timezone.html for details.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.279.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "quartz_cron_schedule",
-                "timezone_id"
-              ]
-            },
-            "sql.EndpointTagPair": {
-              "type": "object",
-              "properties": {
-                "key": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.260.0"
-                },
-                "value": {
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.260.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "sql.EndpointTags": {
-              "type": "object",
-              "properties": {
-                "custom_tags": {
-                  "$ref": "#/$defs/slice/github.com/databricks/databricks-sdk-go/service/sql.EndpointTagPair",
-                  "x-since-version": "v0.260.0"
-                }
-              },
-              "additionalProperties": false
-            },
-            "sql.SchedulePauseStatus": {
-              "type": "string",
-              "enum": [
-                "UNPAUSED",
-                "PAUSED"
-              ]
-            },
-            "sql.SpotInstancePolicy": {
-              "type": "string",
-              "description": "EndpointSpotInstancePolicy configures whether the endpoint should use spot\ninstances.\n\nThe breakdown of how the EndpointSpotInstancePolicy converts to per cloud\nconfigurations is:\n\n+-------+--------------------------------------+--------------------------------+\n| Cloud |            COST_OPTIMIZED            |     RELIABILITY_OPTIMIZED |\n+-------+--------------------------------------+--------------------------------+\n| AWS   | On Demand Driver with Spot Executors | On Demand Driver and\nExecutors | | AZURE | On Demand Driver and Executors       | On Demand Driver\nand Executors |\n+-------+--------------------------------------+--------------------------------+\n\nWhile including \"spot\" in the enum name may limit the the future\nextensibility of this field because it limits this enum to denoting \"spot or\nnot\", this is the field that PM recommends after discussion with customers\nper SC-48783.",
-              "enum": [
-                "POLICY_UNSPECIFIED",
-                "COST_OPTIMIZED",
-                "RELIABILITY_OPTIMIZED"
-              ]
-            },
-            "sql.WarehousePermissionLevel": {
-              "type": "string",
-              "description": "Permission level",
-              "enum": [
-                "CAN_MANAGE",
-                "IS_OWNER",
-                "CAN_USE",
-                "CAN_MONITOR",
-                "CAN_VIEW"
-              ]
-            },
-            "vectorsearch.EndpointType": {
-              "type": "string",
-              "description": "Type of endpoint.",
-              "enum": [
-                "STORAGE_OPTIMIZED",
-                "STANDARD"
-              ]
-            },
-            "workspace.AzureKeyVaultSecretScopeMetadata": {
-              "type": "object",
-              "description": "The metadata of the Azure KeyVault for a secret scope of type `AZURE_KEYVAULT`",
-              "properties": {
-                "dns_name": {
-                  "description": "The DNS of the KeyVault",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.252.0"
-                },
-                "resource_id": {
-                  "description": "The resource id of the azure KeyVault that user wants to associate the scope with.",
-                  "$ref": "#/$defs/string",
-                  "x-since-version": "v0.252.0"
-                }
-              },
-              "additionalProperties": false,
-              "required": [
-                "dns_name",
-                "resource_id"
-              ]
-            },
-            "workspace.ScopeBackendType": {
-              "type": "string",
-              "description": "The types of secret scope backends in the Secret Manager. Azure KeyVault backed secret scopes\nwill be supported in a later release.",
-              "enum": [
-                "DATABRICKS",
-                "AZURE_KEYVAULT"
-              ]
-            }
-          }
-        }
-      }
-    },
-    "int": {
-      "type": "integer"
-    },
-    "int64": {
-      "type": "integer"
-    },
-    "interface": {},
-    "map": {
-      "github.com": {
-        "databricks": {
-          "cli": {
-            "bundle": {
-              "config": {
-                "resources.Alert": {
-                  "type": "object",
-                  "additionalProperties": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Alert"
-                  }
-                },
-                "resources.App": {
-                  "type": "object",
-                  "additionalProperties": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.App"
-                  }
-                },
-                "resources.Catalog": {
-                  "type": "object",
-                  "additionalProperties": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Catalog"
-                  }
-                },
-                "resources.Cluster": {
-                  "type": "object",
-                  "additionalProperties": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Cluster"
-                  }
-                },
-                "resources.Dashboard": {
-                  "type": "object",
-                  "additionalProperties": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Dashboard"
-                  }
-                },
-                "resources.DatabaseCatalog": {
-                  "type": "object",
-                  "additionalProperties": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.DatabaseCatalog"
-                  }
-                },
-                "resources.DatabaseInstance": {
-                  "type": "object",
-                  "additionalProperties": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.DatabaseInstance"
-                  }
-                },
-                "resources.ExternalLocation": {
-                  "type": "object",
-                  "additionalProperties": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.ExternalLocation"
-                  }
-                },
-                "resources.Job": {
-                  "type": "object",
-                  "additionalProperties": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Job"
-                  }
-                },
-                "resources.MlflowExperiment": {
-                  "type": "object",
-                  "additionalProperties": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.MlflowExperiment"
-                  }
-                },
-                "resources.MlflowModel": {
-                  "type": "object",
-                  "additionalProperties": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.MlflowModel"
-                  }
-                },
-                "resources.ModelServingEndpoint": {
-                  "type": "object",
-                  "additionalProperties": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.ModelServingEndpoint"
-                  }
-                },
-                "resources.Pipeline": {
-                  "type": "object",
-                  "additionalProperties": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Pipeline"
-                  }
-                },
-                "resources.PostgresBranch": {
-                  "type": "object",
-                  "additionalProperties": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.PostgresBranch"
-                  }
-                },
-                "resources.PostgresEndpoint": {
-                  "type": "object",
-                  "additionalProperties": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.PostgresEndpoint"
-                  }
-                },
-                "resources.PostgresProject": {
-                  "type": "object",
-                  "additionalProperties": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.PostgresProject"
-                  }
-                },
-                "resources.QualityMonitor": {
-                  "type": "object",
-                  "additionalProperties": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.QualityMonitor"
-                  }
-                },
-                "resources.RegisteredModel": {
-                  "type": "object",
-                  "additionalProperties": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.RegisteredModel"
-                  }
-                },
-                "resources.Schema": {
-                  "type": "object",
-                  "additionalProperties": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Schema"
-                  }
-                },
-                "resources.SecretScope": {
-                  "type": "object",
-                  "additionalProperties": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.SecretScope"
-                  }
-                },
-                "resources.SqlWarehouse": {
-                  "type": "object",
-                  "additionalProperties": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.SqlWarehouse"
-                  }
-                },
-                "resources.SyncedDatabaseTable": {
-                  "type": "object",
-                  "additionalProperties": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.SyncedDatabaseTable"
-                  }
-                },
-                "resources.VectorSearchEndpoint": {
-                  "type": "object",
-                  "additionalProperties": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.VectorSearchEndpoint"
-                  }
-                },
-                "resources.Volume": {
-                  "type": "object",
-                  "additionalProperties": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Volume"
-                  }
-                },
-                "variable.TargetVariable": {
-                  "type": "object",
-                  "additionalProperties": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/variable.TargetVariable"
-                  }
-                },
-                "variable.Variable": {
-                  "type": "object",
-                  "additionalProperties": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/variable.Variable"
-                  }
-                }
-              },
-              "config.Artifact": {
-                "type": "object",
-                "additionalProperties": {
-                  "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Artifact"
-                }
-              },
-              "config.Command": {
-                "type": "object",
-                "additionalProperties": {
-                  "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Command"
-                }
-              },
-              "config.Script": {
-                "type": "object",
-                "additionalProperties": {
-                  "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Script"
-                }
-              },
-              "config.Target": {
-                "type": "object",
-                "additionalProperties": {
-                  "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Target"
-                }
-              }
-            }
-          }
-        }
-      },
-      "string": {
-        "type": "object",
-        "additionalProperties": {
-          "$ref": "#/$defs/string"
-        }
-      }
-    },
-    "slice": {
-      "github.com": {
-        "databricks": {
-          "cli": {
-            "bundle": {
-              "config": {
-                "resources.AppEnvVar": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.AppEnvVar"
-                  }
-                },
-                "resources.AppPermission": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.AppPermission"
-                  }
-                },
-                "resources.ClusterPermission": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.ClusterPermission"
-                  }
-                },
-                "resources.JobPermission": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.JobPermission"
-                  }
-                },
-                "resources.MlflowExperimentPermission": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.MlflowExperimentPermission"
-                  }
-                },
-                "resources.MlflowModelPermission": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.MlflowModelPermission"
-                  }
-                },
-                "resources.ModelServingEndpointPermission": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.ModelServingEndpointPermission"
-                  }
-                },
-                "resources.Permission": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.Permission"
-                  }
-                },
-                "resources.PipelinePermission": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.PipelinePermission"
-                  }
-                },
-                "resources.SecretScopePermission": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.SecretScopePermission"
-                  }
-                },
-                "resources.SqlWarehousePermission": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/$defs/github.com/databricks/cli/bundle/config/resources.SqlWarehousePermission"
-                  }
-                }
-              },
-              "config.ArtifactFile": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/cli/bundle/config.ArtifactFile"
-                }
-              }
-            }
-          },
-          "databricks-sdk-go": {
-            "service": {
-              "apps.AppResource": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.AppResource"
-                }
-              },
-              "apps.EnvVar": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.EnvVar"
-                }
-              },
-              "apps.TelemetryExportDestination": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/apps.TelemetryExportDestination"
-                }
-              },
-              "catalog.MonitorMetric": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.MonitorMetric"
-                }
-              },
-              "catalog.Privilege": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.Privilege"
-                }
-              },
-              "catalog.PrivilegeAssignment": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.PrivilegeAssignment"
-                }
-              },
-              "catalog.RegisteredModelAlias": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/catalog.RegisteredModelAlias"
-                }
-              },
-              "compute.InitScriptInfo": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.InitScriptInfo"
-                }
-              },
-              "compute.Library": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/compute.Library"
-                }
-              },
-              "database.CustomTag": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/database.CustomTag"
-                }
-              },
-              "database.DatabaseInstanceRef": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/database.DatabaseInstanceRef"
-                }
-              },
-              "jobs.AlertTaskSubscriber": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.AlertTaskSubscriber"
-                }
-              },
-              "jobs.JobCluster": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobCluster"
-                }
-              },
-              "jobs.JobEnvironment": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobEnvironment"
-                }
-              },
-              "jobs.JobParameterDefinition": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobParameterDefinition"
-                }
-              },
-              "jobs.JobsHealthRule": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobsHealthRule"
-                }
-              },
-              "jobs.PowerBiTable": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.PowerBiTable"
-                }
-              },
-              "jobs.SqlTaskSubscription": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SqlTaskSubscription"
-                }
-              },
-              "jobs.SubscriptionSubscriber": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.SubscriptionSubscriber"
-                }
-              },
-              "jobs.Task": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.Task"
-                }
-              },
-              "jobs.TaskDependency": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.TaskDependency"
-                }
-              },
-              "jobs.Webhook": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.Webhook"
-                }
-              },
-              "ml.ExperimentTag": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.ExperimentTag"
-                }
-              },
-              "ml.ModelTag": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/ml.ModelTag"
-                }
-              },
-              "pipelines.DayOfWeek": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.DayOfWeek"
-                }
-              },
-              "pipelines.FileFilter": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.FileFilter"
-                }
-              },
-              "pipelines.IngestionConfig": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.IngestionConfig"
-                }
-              },
-              "pipelines.IngestionPipelineDefinitionWorkdayReportParametersQueryKeyValue": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.IngestionPipelineDefinitionWorkdayReportParametersQueryKeyValue"
-                }
-              },
-              "pipelines.Notifications": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.Notifications"
-                }
-              },
-              "pipelines.PipelineCluster": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.PipelineCluster"
-                }
-              },
-              "pipelines.PipelineLibrary": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.PipelineLibrary"
-                }
-              },
-              "pipelines.SourceConfig": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/pipelines.SourceConfig"
-                }
-              },
-              "postgres.ProjectCustomTag": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/postgres.ProjectCustomTag"
-                }
-              },
-              "serving.AiGatewayRateLimit": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.AiGatewayRateLimit"
-                }
-              },
-              "serving.EndpointTag": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.EndpointTag"
-                }
-              },
-              "serving.RateLimit": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.RateLimit"
-                }
-              },
-              "serving.Route": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.Route"
-                }
-              },
-              "serving.ServedEntityInput": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.ServedEntityInput"
-                }
-              },
-              "serving.ServedModelInput": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/serving.ServedModelInput"
-                }
-              },
-              "sql.AlertV2Subscription": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.AlertV2Subscription"
-                }
-              },
-              "sql.EndpointTagPair": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/sql.EndpointTagPair"
-                }
-              }
-            }
-          }
-        }
-      },
-      "string": {
-        "type": "array",
-        "items": {
-          "$ref": "#/$defs/string"
-        }
-      }
-    },
-    "string": {
-      "type": "string"
-    }
-  },
-  "type": "object",
-  "properties": {
-    "artifacts": {
-      "description": "Defines the attributes to build an artifact",
-      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config.Artifact",
-      "markdownDescription": "Defines the attributes to build artifacts, where each key is the name of the artifact, and the value is a Map that defines the artifact build settings. For information about the `artifacts` mapping, see [artifacts](https://docs.databricks.com/dev-tools/bundles/settings.html#artifacts).\n\nArtifact settings defined in the top level of the bundle configuration can be overridden in the `targets` mapping. See [link](https://docs.databricks.com/dev-tools/bundles/artifact-overrides.html).",
-      "x-since-version": "v0.229.0"
-    },
-    "bundle": {
-      "description": "The bundle attributes when deploying to this target.",
-      "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Bundle",
-      "markdownDescription": "The bundle attributes when deploying to this target,",
-      "x-since-version": "v0.229.0"
-    },
-    "environments": {
-      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config.Target",
-      "deprecationMessage": "Deprecated: please use targets instead",
-      "x-since-version": "v0.243.0",
-      "deprecated": true
-    },
-    "experimental": {
-      "description": "Defines attributes for experimental features.",
-      "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Experimental",
-      "x-since-version": "v0.229.0"
-    },
-    "include": {
-      "description": "Specifies a list of path globs that contain configuration files to include within the bundle.",
-      "$ref": "#/$defs/slice/string",
-      "markdownDescription": "Specifies a list of path globs that contain configuration files to include within the bundle. See [include](https://docs.databricks.com/dev-tools/bundles/settings.html#include).",
-      "x-since-version": "v0.229.0"
-    },
-    "permissions": {
-      "description": "Defines a permission for a specific entity.",
-      "$ref": "#/$defs/slice/github.com/databricks/cli/bundle/config/resources.Permission",
-      "markdownDescription": "A Sequence that defines the permissions to apply to experiments, jobs, pipelines, and models defined in the bundle, where each item in the sequence is a permission for a specific entity.\n\nSee [permissions](https://docs.databricks.com/dev-tools/bundles/settings.html#permissions) and [link](https://docs.databricks.com/dev-tools/bundles/permissions.html).",
-      "x-since-version": "v0.229.0"
-    },
-    "presets": {
-      "description": "Defines bundle deployment presets.",
-      "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Presets",
-      "markdownDescription": "Defines bundle deployment presets. See [presets](https://docs.databricks.com/dev-tools/bundles/deployment-modes.html#presets).",
-      "x-since-version": "v0.229.0"
-    },
-    "python": {
-      "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Python",
-      "x-since-version": "v0.275.0"
-    },
-    "resources": {
-      "description": "A Map that defines the resources for the bundle, where each key is the name of the resource, and the value is a Map that defines the resource.",
-      "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Resources",
-      "markdownDescription": "A Map that defines the resources for the bundle, where each key is the name of the resource, and the value is a Map that defines the resource. For more information about Declarative Automation Bundles supported resources, and resource definition reference, see [link](https://docs.databricks.com/dev-tools/bundles/resources.html).\n\n```yaml\nresources:\n  \u003cresource-type\u003e:\n    \u003cresource-name\u003e:\n      \u003cresource-field-name\u003e: \u003cresource-field-value\u003e\n```",
-      "x-since-version": "v0.229.0"
-    },
-    "run_as": {
-      "description": "The identity to use when running Declarative Automation Bundles resources.",
-      "$ref": "#/$defs/github.com/databricks/databricks-sdk-go/service/jobs.JobRunAs",
-      "markdownDescription": "The identity to use when running Declarative Automation Bundles resources. See [link](https://docs.databricks.com/dev-tools/bundles/run-as.html).",
-      "x-since-version": "v0.229.0"
-    },
-    "scripts": {
-      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config.Script",
-      "x-since-version": "v0.259.0"
-    },
-    "sync": {
-      "description": "The files and file paths to include or exclude in the bundle.",
-      "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Sync",
-      "markdownDescription": "The files and file paths to include or exclude in the bundle. See [sync](https://docs.databricks.com/dev-tools/bundles/settings.html#sync).",
-      "x-since-version": "v0.229.0"
-    },
-    "targets": {
-      "description": "Defines deployment targets for the bundle.",
-      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config.Target",
-      "markdownDescription": "Defines deployment targets for the bundle. See [targets](https://docs.databricks.com/dev-tools/bundles/settings.html#targets)",
-      "x-since-version": "v0.229.0"
-    },
-    "variables": {
-      "description": "A Map that defines the custom variables for the bundle, where each key is the name of the variable, and the value is a Map that defines the variable.",
-      "$ref": "#/$defs/map/github.com/databricks/cli/bundle/config/variable.Variable",
-      "x-since-version": "v0.229.0"
-    },
-    "workspace": {
-      "description": "Defines the Databricks workspace for the bundle.",
-      "$ref": "#/$defs/github.com/databricks/cli/bundle/config.Workspace",
-      "markdownDescription": "Defines the Databricks workspace for the bundle. See [workspace](https://docs.databricks.com/dev-tools/bundles/settings.html#workspace).",
-      "x-since-version": "v0.229.0"
-    }
-  },
-  "additionalProperties": {}
-}
\ No newline at end of file
diff --git a/bundle/schema/validate_test.go b/bundle/schema/validate_test.go
index 92dfe44447c..36bafd0a1b8 100644
--- a/bundle/schema/validate_test.go
+++ b/bundle/schema/validate_test.go
@@ -178,20 +178,22 @@ func TestSchemaValidateFailCases(t *testing.T) {
 	// and the Google library discards per-branch errors on oneOf failure, so
 	// we can only assert on the schema path, not the specific failure reason.
 	tests := map[string]string{
-		"basic.yml":                           "config.Bundle",
-		"deprecated_job_field_format.yml":     "config.Resources",
-		"hidden_job_field_deployment.yml":     "config.Resources",
-		"hidden_job_field_edit_mode.yml":      "config.Target",
-		"incorrect_volume_type.yml":           "config.Resources",
-		"invalid_enum_value_in_job.yml":       "config.Resources",
-		"invalid_enum_value_in_model.yml":     "config.Resources",
-		"invalid_reference_in_job.yml":        "config.Resources",
-		"invalid_reference_in_model.yml":      "config.Resources",
-		"readonly_job_field_git_snapshot.yml": "config.Resources",
-		"readonly_job_field_job_source.yml":   "config.Resources",
-		"required_field_missing_in_job.yml":   "config.Resources",
-		"unknown_field_in_job.yml":            "config.Resources",
-		"unknown_field_in_model.yml":          "config.Resources",
+		"basic.yml":                              "config.Bundle",
+		"deprecated_job_field_format.yml":        "config.Resources",
+		"hidden_job_field_deployment.yml":        "config.Resources",
+		"hidden_job_field_edit_mode.yml":         "config.Target",
+		"incorrect_volume_type.yml":              "config.Resources",
+		"invalid_enum_value_in_job.yml":          "config.Resources",
+		"invalid_enum_value_in_model.yml":        "config.Resources",
+		"invalid_reference_in_job.yml":           "config.Resources",
+		"invalid_reference_in_model.yml":         "config.Resources",
+		"invalid_unicode_variable_reference.yml": "config.Resources",
+		"nfd_unicode_variable_reference.yml":     "config.Resources",
+		"readonly_job_field_git_snapshot.yml":    "config.Resources",
+		"readonly_job_field_job_source.yml":      "config.Resources",
+		"required_field_missing_in_job.yml":      "config.Resources",
+		"unknown_field_in_job.yml":               "config.Resources",
+		"unknown_field_in_model.yml":             "config.Resources",
 	}
 
 	files, err := filepath.Glob("../internal/schema/testdata/fail/*.yml")
diff --git a/bundle/scripts/scripts.go b/bundle/scripts/scripts.go
index cca380129af..cca108ec514 100644
--- a/bundle/scripts/scripts.go
+++ b/bundle/scripts/scripts.go
@@ -2,6 +2,7 @@ package scripts
 
 import (
 	"bufio"
+	"bytes"
 	"context"
 	"errors"
 	"fmt"
@@ -43,19 +44,26 @@ func (m *script) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
 		return diag.FromErr(err)
 	}
 
-	cmd, out, err := executeHook(ctx, executor, command)
+	cmd, err := executeHook(ctx, executor, command)
 	if err != nil {
 		return diag.FromErr(fmt.Errorf("failed to execute script: %w", err))
 	}
 
-	cmdio.LogString(ctx, fmt.Sprintf("Executing '%s' script", m.scriptHook))
+	cmdio.LogProgress(ctx, fmt.Sprintf("Executing '%s' script", m.scriptHook))
 
-	reader := bufio.NewReader(out)
-	line, err := reader.ReadString('\n')
-	for err == nil {
-		cmdio.LogString(ctx, strings.TrimSpace(line))
-		line, err = reader.ReadString('\n')
-	}
+	// Reading the pipes sequentially deadlocks once the script fills the ~64KiB
+	// stderr pipe buffer while stdout is still open, so drain stderr concurrently.
+	// Spooling it to memory preserves the stdout-then-stderr output order.
+	var stderr bytes.Buffer
+	stderrDone := make(chan struct{})
+	go func() {
+		defer close(stderrDone)
+		_, _ = io.Copy(&stderr, cmd.Stderr())
+	}()
+
+	logOutput(ctx, cmd.Stdout())
+	<-stderrDone
+	logOutput(ctx, &stderr)
 
 	err = cmd.Wait()
 	if err != nil {
@@ -65,18 +73,27 @@ func (m *script) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
 	return nil
 }
 
-func executeHook(ctx context.Context, executor *exec.Executor, command config.Command) (exec.Command, io.Reader, error) {
-	// Don't run any arbitrary code when restricted execution is enabled.
-	if _, ok := env.RestrictedExecution(ctx); ok {
-		return nil, nil, errors.New("running scripts is not allowed when DATABRICKS_BUNDLE_RESTRICTED_CODE_EXECUTION is set")
+// logOutput logs output line by line, including a final line without a trailing newline.
+func logOutput(ctx context.Context, out io.Reader) {
+	reader := bufio.NewReader(out)
+	for {
+		line, err := reader.ReadString('\n')
+		if line != "" {
+			cmdio.LogString(ctx, strings.TrimSpace(line))
+		}
+		if err != nil {
+			break
+		}
 	}
+}
 
-	cmd, err := executor.StartCommand(ctx, string(command))
-	if err != nil {
-		return nil, nil, err
+func executeHook(ctx context.Context, executor *exec.Executor, command config.Command) (exec.Command, error) {
+	// Don't run any arbitrary code when restricted execution is enabled.
+	if _, ok := env.RestrictedExecution(ctx); ok {
+		return nil, errors.New("running scripts is not allowed when DATABRICKS_BUNDLE_RESTRICTED_CODE_EXECUTION is set")
 	}
 
-	return cmd, io.MultiReader(cmd.Stdout(), cmd.Stderr()), nil
+	return executor.StartCommand(ctx, string(command))
 }
 
 func getCommand(b *bundle.Bundle, hook config.ScriptHook) config.Command {
diff --git a/bundle/scripts/scripts_test.go b/bundle/scripts/scripts_test.go
new file mode 100644
index 00000000000..39042fce021
--- /dev/null
+++ b/bundle/scripts/scripts_test.go
@@ -0,0 +1,77 @@
+package scripts_test
+
+import (
+	"context"
+	"runtime"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/scripts"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestExecuteOutputWithoutTrailingNewline(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("skipping on windows")
+	}
+
+	dir := t.TempDir()
+	b := &bundle.Bundle{
+		BundleRootPath: dir,
+		Config: config.Root{
+			Experimental: &config.Experimental{
+				Scripts: map[config.ScriptHook]config.Command{
+					config.ScriptPreInit: "printf 'line1\nline2\nlast line without newline'",
+				},
+			},
+		},
+	}
+
+	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
+	diags := bundle.Apply(ctx, b, scripts.Execute(config.ScriptPreInit))
+	require.NoError(t, diags.Error())
+
+	output := stderr.String()
+	assert.Contains(t, output, "line1")
+	assert.Contains(t, output, "line2")
+	assert.Contains(t, output, "last line without newline")
+}
+
+func TestExecuteLargeStderrOutputDoesNotDeadlock(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("skipping on windows")
+	}
+
+	dir := t.TempDir()
+	b := &bundle.Bundle{
+		BundleRootPath: dir,
+		Config: config.Root{
+			Experimental: &config.Experimental{
+				Scripts: map[config.ScriptHook]config.Command{
+					// Overflows the ~64KiB stderr pipe buffer before stdout
+					// closes, which deadlocked the old sequential draining.
+					config.ScriptPreInit: "seq 100000 | tr -d '\\n' >&2; echo stdout-after-stderr",
+				},
+			},
+		},
+	}
+
+	// A reintroduced deadlock fails fast: the context timeout kills the script.
+	ctx, cancel := context.WithTimeout(t.Context(), time.Minute)
+	defer cancel()
+
+	ctx, stderr := cmdio.NewTestContextWithStderr(ctx)
+	diags := bundle.Apply(ctx, b, scripts.Execute(config.ScriptPreInit))
+	require.NoError(t, diags.Error())
+
+	output := stderr.String()
+	assert.Contains(t, output, "99999100000")
+	assert.Contains(t, output, "stdout-after-stderr")
+	// The script writes stderr first, but spooling preserves the stdout-then-stderr order.
+	assert.Less(t, strings.Index(output, "stdout-after-stderr"), strings.Index(output, "99999100000"))
+}
diff --git a/bundle/statemgmt/check_running_resources.go b/bundle/statemgmt/check_running_resources.go
index 2ad5adf6da8..63681bd5eb9 100644
--- a/bundle/statemgmt/check_running_resources.go
+++ b/bundle/statemgmt/check_running_resources.go
@@ -7,8 +7,6 @@ import (
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/bundle/config"
-	"github.com/databricks/cli/bundle/config/engine"
-	"github.com/databricks/cli/bundle/deploy/terraform"
 	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/apierr"
@@ -26,9 +24,7 @@ func (e ErrResourceIsRunning) Error() string {
 	return fmt.Sprintf("%s %s is running", e.resourceType, e.resourceId)
 }
 
-type checkRunningResources struct {
-	engine engine.EngineType
-}
+type checkRunningResources struct{}
 
 func (l *checkRunningResources) Name() string {
 	return "check-running-resources"
@@ -39,28 +35,16 @@ func (l *checkRunningResources) Apply(ctx context.Context, b *bundle.Bundle) dia
 		return nil
 	}
 
-	var err error
-	var state ExportedResourcesMap
-
-	if l.engine.IsDirect() {
-		state = b.DeploymentBundle.ExportState(ctx)
-	} else {
-		state, err = terraform.ParseResourcesState(ctx, b)
-		if err != nil {
-			return diag.FromErr(err)
-		}
-	}
-
 	w := b.WorkspaceClient(ctx)
-	err = checkAnyResourceRunning(ctx, w, state)
+	err := checkAnyResourceRunning(ctx, w, b.DeploymentBundle.ExportState(ctx))
 	if err != nil {
 		return diag.FromErr(err)
 	}
 	return nil
 }
 
-func CheckRunningResource(engine engine.EngineType) bundle.Mutator {
-	return &checkRunningResources{engine: engine}
+func CheckRunningResource() bundle.Mutator {
+	return &checkRunningResources{}
 }
 
 func checkAnyResourceRunning(ctx context.Context, w *databricks.WorkspaceClient, state ExportedResourcesMap) error {
diff --git a/bundle/statemgmt/direct_migration.go b/bundle/statemgmt/direct_migration.go
new file mode 100644
index 00000000000..f3d632f138f
--- /dev/null
+++ b/bundle/statemgmt/direct_migration.go
@@ -0,0 +1,314 @@
+package statemgmt
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"slices"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/config/engine"
+	"github.com/databricks/cli/bundle/config/mutator/resourcemutator"
+	"github.com/databricks/cli/bundle/deployplan"
+	"github.com/databricks/cli/bundle/direct"
+	"github.com/databricks/cli/bundle/direct/dresources"
+	"github.com/databricks/cli/bundle/direct/dstate"
+	"github.com/databricks/cli/bundle/metrics"
+	"github.com/databricks/cli/bundle/migrate"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/env"
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/logdiag"
+)
+
+// warnPrefix labels warnings emitted while converting terraform state to the direct
+// engine, distinguishing them from the user-invoked "bundle deployment migrate".
+const warnPrefix = "migration to direct: "
+
+// migrationFailedHint is appended to the errors that abort an automatic terraform→direct
+// migration. The terraform engine was removed in v1.20.0, so there is no engine left to fall
+// back to: the command cannot proceed until the state migrates or the user downgrades.
+const migrationFailedHint = `
+
+The Terraform deployment engine was removed in Databricks CLI v1.20.0. Auto-migration of your bundle failed. Install Databricks CLI v1.19.x to deploy on Terraform, and please report this to dabs-feedback@databricks.com`
+
+// Migrate converts the bundle's terraform state to a direct-engine state and opens
+// b.DeploymentBundle.StateDB with it in memory. Returns false when there is no terraform state
+// to migrate (the caller then opens the direct state normally).
+//
+// Migrate is reversible: nothing is written to the local state file or the workspace, so a
+// command that does not commit - plan, run, or a declined deploy - just drops the in-memory
+// state. Callers that apply changes make the migration durable by calling CommitMigration once
+// the command is approved.
+//
+// The terraform engine was removed in v1.20.0, so any failure (parsing, conversion, the plan
+// check) is fatal: there is no engine to fall back to. An empty terraform state is not a failure -
+// the converter writes an empty base state file, so there is no special case here.
+func Migrate(ctx context.Context, b *bundle.Bundle) (bool, error) {
+	_, localTerraformPath := b.StateFilenameTerraform(ctx)
+	tfState, err := migrate.ParseTFStateFull(ctx, localTerraformPath)
+	if err != nil {
+		b.Metrics.SetBoolValue(metrics.DirectMigrateError, true)
+		return false, fmt.Errorf("parsing terraform state: %w%s", err, migrationFailedHint)
+	}
+	if tfState == nil {
+		return false, nil
+	}
+
+	_, localDirectPath := b.StateFilenameDirect(ctx)
+
+	tempStatePath, hasWarnings, cfg, err := convertTFStateToDirect(ctx, b, tfState)
+	if tempStatePath != "" {
+		// Always remove the temp state and its WAL. The converted state is loaded into memory
+		// below and never renamed into place, so these are the only on-disk copies to clean up.
+		defer func() {
+			_ = os.Remove(tempStatePath)
+			_ = os.Remove(tempStatePath + ".wal")
+		}()
+	}
+	if hasWarnings {
+		b.Metrics.SetBoolValue(metrics.DirectMigrateWarnings, true)
+	}
+	if err != nil {
+		b.Metrics.SetBoolValue(metrics.DirectMigrateError, true)
+		return false, fmt.Errorf("converting terraform state to the direct engine: %w%s", err, migrationFailedHint)
+	}
+
+	// Plan-check the converted state: validate it can be planned before committing to it, and
+	// record the recreate metric.
+	plan, err := checkPlanOnTempState(ctx, b, tempStatePath, cfg)
+	if err != nil {
+		b.Metrics.SetBoolValue(metrics.DirectMigratePlanError, true)
+		return false, fmt.Errorf("the migrated state failed its plan check: %w%s", err, migrationFailedHint)
+	}
+
+	// Record when the migrated state's first plan would recreate a resource, but still migrate:
+	// such a recreate is a genuine pending config change (the same one terraform would apply), and
+	// the command's approval flow gates it behind --auto-approve exactly like any other recreate.
+	if recreated := recreatedResources(plan); len(recreated) > 0 {
+		b.Metrics.SetBoolValue(metrics.DirectMigrateRecreatePlanned, true)
+		log.Infof(ctx, "migration to the direct engine will recreate %v; the command's approval gates this", recreated)
+	}
+
+	// Load the converted state into memory only (at a serial above the terraform state's - see
+	// convertTFStateToDirect). It was just written by this CLI, so it is at the current schema
+	// version and needs no migration. Nothing is persisted or pushed here; CommitMigration does
+	// that once the command is approved.
+	raw, err := os.ReadFile(tempStatePath)
+	if err != nil {
+		return false, fmt.Errorf("reading migrated state: %w", err)
+	}
+	var data dstate.Database
+	if err := json.Unmarshal(raw, &data); err != nil {
+		return false, fmt.Errorf("parsing migrated state: %w", err)
+	}
+	b.DeploymentBundle.StateDB.OpenWithData(localDirectPath, data)
+
+	// Announce the migration only once the conversion and plan check succeeded, so a run with no
+	// terraform state to migrate says nothing misleading.
+	cmdio.LogString(ctx, "Notice: migrating your bundle to direct deployment engine (https://github.com/databricks/cli/issues/6765).")
+	return true, nil
+}
+
+// CleanupTerraformStateAfterMigration backs up the now-superseded terraform state, remote and
+// local, best-effort. Called by CommitMigration once the migrated direct state is pushed, so a
+// later run does not pick up the stale terraform state (its resources are gone) instead of the
+// direct one. Destroy does not use this: it removes the local terraform state directly in
+// destroyCore and files.Delete removes the remote one.
+func CleanupTerraformStateAfterMigration(ctx context.Context, b *bundle.Bundle) {
+	BackupRemoteTerraformState(ctx, b)
+	_, localTerraformPath := b.StateFilenameTerraform(ctx)
+	if err := os.Rename(localTerraformPath, localTerraformPath+".backup"); err != nil && !errors.Is(err, fs.ErrNotExist) {
+		log.Warnf(ctx, "automatic migration to direct engine: could not back up local terraform state: %v", err)
+	}
+}
+
+// CommitMigration makes a prepared (in-memory) migration durable - the point of no return. It
+// persists the converted direct state locally (at a serial above the terraform state's), pushes it
+// to the workspace, retires the superseded terraform state (local rename + remote backup), and
+// records which source triggered the migration. Deploy calls it once the deploy is approved, before
+// applying its own changes (which advance the state once more). If the state push fails the terraform state is left
+// in place, so the migration is not committed and a retry can complete it. Destroy does not call
+// this: it commits the migration as part of its teardown (files.Delete owns the remote terraform
+// state, and a destroy that migrates only to tear down is not adoption worth recording).
+func CommitMigration(ctx context.Context, b *bundle.Bundle) {
+	count := len(b.DeploymentBundle.StateDB.ExportState(ctx))
+	if err := b.DeploymentBundle.StateDB.Persist(); err != nil {
+		logdiag.LogError(ctx, fmt.Errorf("persisting migrated direct state: %w", err))
+		return
+	}
+	PushResourcesState(ctx, b)
+	if logdiag.HasError(ctx) {
+		return
+	}
+	CleanupTerraformStateAfterMigration(ctx, b)
+	recordAutoMigrateSource(ctx, b)
+
+	suffix := "s"
+	if count == 1 {
+		suffix = ""
+	}
+	cmdio.LogString(ctx, fmt.Sprintf("Migrated %d resource%s to direct deployment engine.", count, suffix))
+}
+
+// recordAutoMigrateSource sets exactly one of the migrated-via-* telemetry keys, per how
+// the direct engine was selected: a durable opt-in in bundle.engine (via_config), an
+// env-var-only one (via_env), or nothing at all (via_default). The setting was already
+// validated, so a set value can only be "direct", and bundle.engine wins over the env var.
+func recordAutoMigrateSource(ctx context.Context, b *bundle.Bundle) {
+	switch {
+	case b.Config.Bundle.Engine != engine.EngineNotSet:
+		b.Metrics.SetBoolValue(metrics.DirectAutoMigrateViaConfig, true)
+	case env.Get(ctx, engine.EnvVar) != "":
+		b.Metrics.SetBoolValue(metrics.DirectAutoMigrateViaEnv, true)
+	default:
+		b.Metrics.SetBoolValue(metrics.DirectAutoMigrateViaDefault, true)
+	}
+}
+
+// checkPlanOnTempState opens the migrated state at tempStatePath in read mode,
+// runs a full plan against it, and returns the plan, or a non-nil error if the
+// plan fails (the caller fails the migration on it). Diagnostics collected while planning
+// are additionally logged as warnings with warnPrefix for visibility. The plan is run in an isolated
+// context so its diagnostics do not affect the deploy's own error state. The
+// returned plan lets the caller inspect the planned actions (e.g. reject a
+// migration that would recreate a resource).
+func checkPlanOnTempState(ctx context.Context, b *bundle.Bundle, tempStatePath string, cfg *config.Root) (*deployplan.Plan, error) {
+	planCtx := logdiag.IsolatedContext(ctx)
+	logdiag.SetCollect(planCtx, true)
+	defer func() {
+		for _, d := range logdiag.FlushCollected(planCtx) {
+			msg := d.Summary
+			if d.Detail != "" {
+				msg += ": " + d.Detail
+			}
+			log.Warnf(ctx, "%s%s", warnPrefix, msg)
+		}
+	}()
+
+	var planBundle direct.DeploymentBundle
+
+	// This plan is not created with the deployment history feature enabled,
+	// so we can safely pass false for withDeploymentHistory.
+	if err := planBundle.StateDB.Open(planCtx, tempStatePath, false, false, dstate.WithDeploymentHistory(false), dstate.OpenDmsArgs{}); err != nil {
+		return nil, fmt.Errorf("opening migrated state for plan check: %w", err)
+	}
+
+	return planBundle.CalculatePlan(planCtx, b.WorkspaceClient(ctx), cfg)
+}
+
+// recreatedResources returns the sorted keys of resources the plan would recreate
+// (destroy + create). Used only to record the direct_migrate_recreate_planned metric:
+// the migration proceeds regardless, and the deploy's approval flow gates the recreate
+// behind --auto-approve just like any other recreate.
+func recreatedResources(plan *deployplan.Plan) []string {
+	var keys []string
+	for key, entry := range plan.Plan {
+		if entry.Action == deployplan.Recreate {
+			keys = append(keys, key)
+		}
+	}
+	slices.Sort(keys)
+	return keys
+}
+
+// convertTFStateToDirect converts the given terraform state to a direct-engine state file,
+// returning the path to that file, whether any warnings were emitted, and the bundle config with
+// terraform interpolation reversed (needed by the caller to run a plan against the converted
+// state). Callers must ensure tfState is non-nil; an empty state (no resource IDs or attrs) yields
+// an empty base state file. The caller reads the file into memory and is responsible for removing
+// it (and its .wal) when done.
+func convertTFStateToDirect(ctx context.Context, b *bundle.Bundle, tfState *migrate.TFState) (string, bool, *config.Root, error) {
+	// Write the converted state to a deterministic sibling of the final resources.json path. The
+	// caller (Migrate) reads it into memory with OpenWithData and then removes it; nothing renames
+	// it into place. The state DB creates the file and its .wal itself, and UpgradeToWrite creates
+	// the parent directory, so no CreateTemp or MkdirAll is needed here.
+	_, localDirectPath := b.StateFilenameDirect(ctx)
+	tempStatePath := filepath.Join(filepath.Dir(localDirectPath), "resources.migrating.json")
+	// Clean up any leftovers from a crashed previous run so UpgradeToWrite
+	// (which opens the .wal with O_EXCL) succeeds.
+	_ = os.Remove(tempStatePath)
+	_ = os.Remove(tempStatePath + ".wal")
+
+	// SecretScopeFixups and the direct-engine state builder report failures via
+	// logdiag. Run them in an isolated + collecting context so their diagnostics
+	// neither affect the deploy's exit code (isolated) nor render as user-facing
+	// `Error:` lines (collected + re-logged as warnings below).
+	ctx = logdiag.IsolatedContext(ctx)
+	logdiag.SetCollect(ctx, true)
+	defer func() {
+		for _, d := range logdiag.FlushCollected(ctx) {
+			msg := d.Summary
+			if d.Detail != "" {
+				msg += ": " + d.Detail
+			}
+			log.Warnf(ctx, "%s%s", warnPrefix, msg)
+		}
+	}()
+
+	// The converted state starts one serial above the terraform state. A populated conversion then
+	// replays a WAL below (SaveState + BuildStateFromTF), which advances the serial once more - so a
+	// populated migration lands at tf+2 and an empty one (persisted directly below, no WAL entries)
+	// stays at tf+1. Either way it outranks the terraform state, which is all engine selection needs.
+	var stateDB dstate.DeploymentState
+	stateDB.OpenWithData(tempStatePath, dstate.NewDatabase(tfState.Lineage, tfState.Serial+1))
+
+	// Apply SecretScopeFixups so the config matches what the direct engine expects.
+	// This adds MANAGE ACL for the current user to all secret scopes, ensuring
+	// the migrated state and config agree on .permissions entries.
+	bundle.ApplyContext(ctx, b, resourcemutator.SecretScopeFixups())
+	if logdiag.HasError(ctx) {
+		return tempStatePath, false, nil, errors.New("failed to apply secret scope fixups")
+	}
+
+	// The config may use terraform-style references (${databricks_pipeline.x.id}).
+	// BuildStateFromTF expects ${resources.*} references, so rewrite them first.
+	uninterpolatedRoot, err := reverseInterpolate(b.Config.Value())
+	if err != nil {
+		return tempStatePath, false, nil, fmt.Errorf("failed to reverse interpolation: %w", err)
+	}
+
+	var uninterpolatedConfig config.Root
+	err = uninterpolatedConfig.Mutate(func(_ dyn.Value) (dyn.Value, error) {
+		return uninterpolatedRoot, nil
+	})
+	if err != nil {
+		return tempStatePath, false, nil, fmt.Errorf("failed to create uninterpolated config: %w", err)
+	}
+
+	adapters, err := dresources.InitAll(nil)
+	if err != nil {
+		return tempStatePath, false, nil, err
+	}
+
+	if err := stateDB.UpgradeToWrite(); err != nil {
+		return tempStatePath, false, nil, fmt.Errorf("upgrading state for apply: %w", err)
+	}
+
+	if err := migrate.SeedState(ctx, &stateDB, tfState); err != nil {
+		return tempStatePath, false, nil, err
+	}
+
+	// warnPrefix labels the conversion's warnings as coming from the background dry run.
+	hasWarnings, err := migrate.BuildStateFromTF(ctx, &uninterpolatedConfig, adapters, &stateDB, tfState.Attrs, tfState.IDs, warnPrefix)
+	if err != nil {
+		return tempStatePath, hasWarnings, nil, err
+	}
+
+	if _, err := stateDB.Finalize(ctx); err != nil {
+		return tempStatePath, hasWarnings, nil, err
+	}
+
+	// BuildStateFromTF reports some failures via logdiag instead of returning an error.
+	if logdiag.HasError(ctx) {
+		return tempStatePath, hasWarnings, nil, errors.New("state conversion failed")
+	}
+
+	return tempStatePath, hasWarnings, &uninterpolatedConfig, nil
+}
diff --git a/bundle/statemgmt/resourcestate/resourcestate.go b/bundle/statemgmt/resourcestate/resourcestate.go
index c0dbbf7d0c4..0742f59e3a9 100644
--- a/bundle/statemgmt/resourcestate/resourcestate.go
+++ b/bundle/statemgmt/resourcestate/resourcestate.go
@@ -7,6 +7,16 @@ type ResourceState struct {
 
 	// For dashboards
 	ETag string
+
+	// For job_runs: the resolved job_id the run was launched against. In config it
+	// is a ${resources.jobs.*.id} reference resolved only at deploy, so we carry
+	// the deployed value to restore it at load time.
+	JobID int64
+
+	// Size in bytes of the resource's serialized state blob. Populated by the
+	// direct engine (len of the JSON stored in resources.json) for deploy
+	// telemetry; left zero by the terraform path.
+	StateSizeBytes int
 }
 
 // ExportedResourcesMap stores relevant attributes from terraform/direct state for all resources
diff --git a/bundle/statemgmt/reverse_interpolate.go b/bundle/statemgmt/reverse_interpolate.go
new file mode 100644
index 00000000000..d133c0e0f7d
--- /dev/null
+++ b/bundle/statemgmt/reverse_interpolate.go
@@ -0,0 +1,36 @@
+package statemgmt
+
+import (
+	"fmt"
+
+	"github.com/databricks/cli/bundle/deploy/terraform"
+	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/dyn/dynvar"
+)
+
+// reverseInterpolate converts terraform-style resource references to bundle-style.
+// Example: ${databricks_pipeline.my_etl.id} → ${resources.pipelines.my_etl.id}
+func reverseInterpolate(root dyn.Value) (dyn.Value, error) {
+	return dynvar.Resolve(root, func(path dyn.Path) (dyn.Value, error) {
+		// Need at least 2 components: resource_type.resource_name
+		if len(path) < 2 {
+			return dyn.InvalidValue, dynvar.ErrSkipResolution
+		}
+
+		resourceType := path[0].Key()
+		isAlreadyBundleFormat := resourceType == "resources"
+		if isAlreadyBundleFormat {
+			return dyn.InvalidValue, dynvar.ErrSkipResolution
+		}
+
+		bundleGroup, ok := terraform.TerraformToGroupName[resourceType]
+		if !ok {
+			return dyn.InvalidValue, dynvar.ErrSkipResolution
+		}
+
+		// Reconstruct path in bundle format:
+		// databricks_pipeline.my_pipeline.id → resources.pipelines.my_pipeline.id
+		bundlePath := dyn.NewPath(dyn.Key("resources"), dyn.Key(bundleGroup)).Append(path[1:]...)
+		return dyn.V(fmt.Sprintf("${%s}", bundlePath.String())), nil
+	})
+}
diff --git a/bundle/statemgmt/upload_state_for_yaml_sync_test.go b/bundle/statemgmt/reverse_interpolate_test.go
similarity index 100%
rename from bundle/statemgmt/upload_state_for_yaml_sync_test.go
rename to bundle/statemgmt/reverse_interpolate_test.go
diff --git a/bundle/statemgmt/state_load.go b/bundle/statemgmt/state_load.go
index 3345792c295..3c6b7df07b4 100644
--- a/bundle/statemgmt/state_load.go
+++ b/bundle/statemgmt/state_load.go
@@ -9,9 +9,7 @@ import (
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/bundle/config"
-	"github.com/databricks/cli/bundle/config/engine"
 	"github.com/databricks/cli/bundle/config/resources"
-	"github.com/databricks/cli/bundle/deploy/terraform"
 	"github.com/databricks/cli/bundle/statemgmt/resourcestate"
 	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
@@ -26,8 +24,8 @@ type (
 const ErrorOnEmptyState LoadMode = 0
 
 type load struct {
-	modes  []LoadMode
-	engine engine.EngineType
+	state ExportedResourcesMap
+	modes []LoadMode
 }
 
 func (l *load) Name() string {
@@ -35,28 +33,37 @@ func (l *load) Name() string {
 }
 
 func (l *load) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
-	var err error
-	var state ExportedResourcesMap
+	return applyState(ctx, b, l.state, l.modes)
+}
 
-	if l.engine.IsDirect() {
-		state = b.DeploymentBundle.ExportState(ctx)
-	} else {
-		var err error
-		state, err = terraform.ParseResourcesState(ctx, b)
-		if err != nil {
-			return diag.FromErr(err)
-		}
+// applyState merges the exported resource state into the bundle configuration.
+func applyState(ctx context.Context, b *bundle.Bundle, state ExportedResourcesMap, modes []LoadMode) diag.Diagnostics {
+	if err := validateLoadedState(state, modes); err != nil {
+		return diag.FromErr(err)
 	}
 
-	err = l.validateState(state)
-	if err != nil {
+	if err := StateToBundle(ctx, state, &b.Config); err != nil {
 		return diag.FromErr(err)
 	}
 
-	// Merge state into configuration.
-	err = StateToBundle(ctx, state, &b.Config)
-	if err != nil {
-		return diag.FromErr(err)
+	// Load each run's resolved job_id into ResolvedJobID (for the URL only). We
+	// leave config's job_id ${resources.jobs.*.id} reference intact so it keeps
+	// its plan dependency. Typed-only write, like the dashboard etag below.
+	for resourceKey, rstate := range state {
+		if !strings.HasPrefix(resourceKey, "resources.job_runs.") || rstate.JobID == 0 {
+			continue
+		}
+		parts := strings.Split(resourceKey, ".")
+		if len(parts) != 3 {
+			continue
+		}
+
+		// A run in state but not config was deleted; skip it.
+		jrconfig, ok := b.Config.Resources.JobRuns[parts[2]]
+		if !ok {
+			continue
+		}
+		jrconfig.ResolvedJobID = rstate.JobID
 	}
 
 	// Merge dashboard etags into configuration.
@@ -92,7 +99,7 @@ func ensureMap(v dyn.Value, path dyn.Path) (dyn.Value, error) {
 		var err error
 		v, err = dyn.SetByPath(v, path, dyn.V(dyn.NewMapping()))
 		if err != nil {
-			return dyn.InvalidValue, fmt.Errorf("internal error: failed to create %s: %s", path, err)
+			return dyn.InvalidValue, fmt.Errorf("internal error: failed to create %s: %w", path, err)
 		}
 	}
 	return v, nil
@@ -160,14 +167,14 @@ func StateToBundle(ctx context.Context, state ExportedResourcesMap, config *conf
 	})
 }
 
-func (l *load) validateState(state ExportedResourcesMap) error {
-	if len(state) == 0 && slices.Contains(l.modes, ErrorOnEmptyState) {
+func validateLoadedState(state ExportedResourcesMap, modes []LoadMode) error {
+	if len(state) == 0 && slices.Contains(modes, ErrorOnEmptyState) {
 		return errors.New("resource not found or not yet deployed. Did you forget to run 'databricks bundle deploy'?")
 	}
-
 	return nil
 }
 
-func Load(engine engine.EngineType, modes ...LoadMode) bundle.Mutator {
-	return &load{modes: modes, engine: engine}
+// Load returns a mutator that merges the provided resource state into the bundle configuration.
+func Load(state ExportedResourcesMap, modes ...LoadMode) bundle.Mutator {
+	return &load{state: state, modes: modes}
 }
diff --git a/bundle/statemgmt/state_load_test.go b/bundle/statemgmt/state_load_test.go
index 34c4fa4f5aa..4ec77578d2b 100644
--- a/bundle/statemgmt/state_load_test.go
+++ b/bundle/statemgmt/state_load_test.go
@@ -26,30 +26,45 @@ func TestStateToBundleEmptyLocalResources(t *testing.T) {
 	}
 
 	state := ExportedResourcesMap{
-		"resources.jobs.test_job":                                       {ID: "1"},
-		"resources.pipelines.test_pipeline":                             {ID: "1"},
-		"resources.models.test_mlflow_model":                            {ID: "1"},
-		"resources.experiments.test_mlflow_experiment":                  {ID: "1"},
-		"resources.model_serving_endpoints.test_model_serving":          {ID: "1"},
-		"resources.registered_models.test_registered_model":             {ID: "1"},
-		"resources.quality_monitors.test_monitor":                       {ID: "1"},
-		"resources.catalogs.test_catalog":                               {ID: "1"},
-		"resources.schemas.test_schema":                                 {ID: "1"},
-		"resources.external_locations.test_external_location":           {ID: "1"},
-		"resources.volumes.test_volume":                                 {ID: "1"},
-		"resources.clusters.test_cluster":                               {ID: "1"},
-		"resources.dashboards.test_dashboard":                           {ID: "1"},
-		"resources.apps.test_app":                                       {ID: "app1"},
-		"resources.secret_scopes.test_secret_scope":                     {ID: "secret_scope1"},
-		"resources.sql_warehouses.test_sql_warehouse":                   {ID: "1"},
-		"resources.database_instances.test_database_instance":           {ID: "1"},
-		"resources.database_catalogs.test_database_catalog":             {ID: "1"},
-		"resources.synced_database_tables.test_synced_database_table":   {ID: "1"},
-		"resources.alerts.test_alert":                                   {ID: "1"},
-		"resources.postgres_projects.test_postgres_project":             {ID: "projects/test-project"},
-		"resources.postgres_branches.test_postgres_branch":              {ID: "projects/test-project/branches/main"},
-		"resources.postgres_endpoints.test_postgres_endpoint":           {ID: "projects/test-project/branches/main/endpoints/primary"},
-		"resources.vector_search_endpoints.test_vector_search_endpoint": {ID: "vs-endpoint-1"},
+		"resources.jobs.test_job":                                               {ID: "1"},
+		"resources.job_runs.test_job_run":                                       {ID: "1"},
+		"resources.pipelines.test_pipeline":                                     {ID: "1"},
+		"resources.models.test_mlflow_model":                                    {ID: "1"},
+		"resources.experiments.test_mlflow_experiment":                          {ID: "1"},
+		"resources.features.test_feature":                                       {ID: "main.default.test_feature"},
+		"resources.model_serving_endpoints.test_model_serving":                  {ID: "1"},
+		"resources.model_services.test_model_service":                           {ID: "main.default.test_model_service"},
+		"resources.mcp_services.test_mcp_service":                               {ID: "main.default.test_mcp_service"},
+		"resources.model_provider_services.test_model_provider_service":         {ID: "main.default.test_model_provider_service"},
+		"resources.registered_models.test_registered_model":                     {ID: "1"},
+		"resources.quality_monitors.test_monitor":                               {ID: "1"},
+		"resources.catalogs.test_catalog":                                       {ID: "1"},
+		"resources.schemas.test_schema":                                         {ID: "1"},
+		"resources.external_locations.test_external_location":                   {ID: "1"},
+		"resources.volumes.test_volume":                                         {ID: "1"},
+		"resources.clusters.test_cluster":                                       {ID: "1"},
+		"resources.dashboards.test_dashboard":                                   {ID: "1"},
+		"resources.genie_spaces.test_genie_space":                               {ID: "1"},
+		"resources.apps.test_app":                                               {ID: "app1"},
+		"resources.secret_scopes.test_secret_scope":                             {ID: "secret_scope1"},
+		"resources.sql_warehouses.test_sql_warehouse":                           {ID: "1"},
+		"resources.database_instances.test_database_instance":                   {ID: "1"},
+		"resources.database_catalogs.test_database_catalog":                     {ID: "1"},
+		"resources.synced_database_tables.test_synced_database_table":           {ID: "1"},
+		"resources.alerts.test_alert":                                           {ID: "1"},
+		"resources.postgres_projects.test_postgres_project":                     {ID: "projects/test-project"},
+		"resources.postgres_branches.test_postgres_branch":                      {ID: "projects/test-project/branches/main"},
+		"resources.postgres_endpoints.test_postgres_endpoint":                   {ID: "projects/test-project/branches/main/endpoints/primary"},
+		"resources.postgres_catalogs.test_postgres_catalog":                     {ID: "catalogs/test_catalog"},
+		"resources.postgres_databases.test_postgres_database":                   {ID: "projects/test-project/branches/main/databases/test-db"},
+		"resources.postgres_roles.test_postgres_role":                           {ID: "projects/test-project/branches/main/roles/test-role"},
+		"resources.postgres_synced_tables.test_postgres_synced_table":           {ID: "synced_tables/main.public.test_synced_table"},
+		"resources.postgres_snapshot_schedules.test_postgres_snapshot_schedule": {ID: "projects/test-project/branches/main/snapshot-schedule"},
+		"resources.vector_search_endpoints.test_vector_search_endpoint":         {ID: "vs-endpoint-1"},
+		"resources.vector_search_indexes.test_vector_search_index":              {ID: "vs-index-1"},
+		"resources.instance_pools.test_instance_pool":                           {ID: "1"},
+		"resources.secrets.test_secret":                                         {ID: "main.default.test_secret"},
+		"resources.cluster_policies.test_cluster_policy":                        {ID: "cp-1"},
 	}
 	err := StateToBundle(t.Context(), state, &config)
 	assert.NoError(t, err)
@@ -57,6 +72,9 @@ func TestStateToBundleEmptyLocalResources(t *testing.T) {
 	assert.Equal(t, "1", config.Resources.Jobs["test_job"].ID)
 	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.Jobs["test_job"].ModifiedStatus)
 
+	assert.Equal(t, "1", config.Resources.JobRuns["test_job_run"].ID)
+	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.JobRuns["test_job_run"].ModifiedStatus)
+
 	assert.Equal(t, "1", config.Resources.Pipelines["test_pipeline"].ID)
 	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.Pipelines["test_pipeline"].ModifiedStatus)
 
@@ -93,8 +111,11 @@ func TestStateToBundleEmptyLocalResources(t *testing.T) {
 	assert.Equal(t, "1", config.Resources.Dashboards["test_dashboard"].ID)
 	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.Dashboards["test_dashboard"].ModifiedStatus)
 
+	assert.Equal(t, "1", config.Resources.GenieSpaces["test_genie_space"].ID)
+	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.GenieSpaces["test_genie_space"].ModifiedStatus)
+
 	assert.Equal(t, "app1", config.Resources.Apps["test_app"].ID)
-	assert.Equal(t, "", config.Resources.Apps["test_app"].Name)
+	assert.Empty(t, config.Resources.Apps["test_app"].Name)
 	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.Apps["test_app"].ModifiedStatus)
 
 	assert.Equal(t, "secret_scope1", config.Resources.SecretScopes["test_secret_scope"].ID)
@@ -118,9 +139,44 @@ func TestStateToBundleEmptyLocalResources(t *testing.T) {
 	assert.Equal(t, "projects/test-project/branches/main/endpoints/primary", config.Resources.PostgresEndpoints["test_postgres_endpoint"].ID)
 	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.PostgresEndpoints["test_postgres_endpoint"].ModifiedStatus)
 
+	assert.Equal(t, "catalogs/test_catalog", config.Resources.PostgresCatalogs["test_postgres_catalog"].ID)
+	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.PostgresCatalogs["test_postgres_catalog"].ModifiedStatus)
+
+	assert.Equal(t, "projects/test-project/branches/main/databases/test-db", config.Resources.PostgresDatabases["test_postgres_database"].ID)
+	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.PostgresDatabases["test_postgres_database"].ModifiedStatus)
+
+	assert.Equal(t, "projects/test-project/branches/main/roles/test-role", config.Resources.PostgresRoles["test_postgres_role"].ID)
+	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.PostgresRoles["test_postgres_role"].ModifiedStatus)
+
+	assert.Equal(t, "synced_tables/main.public.test_synced_table", config.Resources.PostgresSyncedTables["test_postgres_synced_table"].ID)
+	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.PostgresSyncedTables["test_postgres_synced_table"].ModifiedStatus)
+
+	assert.Equal(t, "projects/test-project/branches/main/snapshot-schedule", config.Resources.PostgresSnapshotSchedules["test_postgres_snapshot_schedule"].ID)
+	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.PostgresSnapshotSchedules["test_postgres_snapshot_schedule"].ModifiedStatus)
+
 	assert.Equal(t, "vs-endpoint-1", config.Resources.VectorSearchEndpoints["test_vector_search_endpoint"].ID)
 	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.VectorSearchEndpoints["test_vector_search_endpoint"].ModifiedStatus)
 
+	assert.Equal(t, "vs-index-1", config.Resources.VectorSearchIndexes["test_vector_search_index"].ID)
+	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.VectorSearchIndexes["test_vector_search_index"].ModifiedStatus)
+
+	assert.Equal(t, "1", config.Resources.InstancePools["test_instance_pool"].ID)
+	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.InstancePools["test_instance_pool"].ModifiedStatus)
+
+	assert.Equal(t, "cp-1", config.Resources.ClusterPolicies["test_cluster_policy"].ID)
+	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.ClusterPolicies["test_cluster_policy"].ModifiedStatus)
+
+	assert.Equal(t, "main.default.test_secret", config.Resources.Secrets["test_secret"].ID)
+	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.Secrets["test_secret"].ModifiedStatus)
+
+	assert.Equal(t, "main.default.test_model_service", config.Resources.ModelServices["test_model_service"].ID)
+	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.ModelServices["test_model_service"].ModifiedStatus)
+
+	assert.Equal(t, "main.default.test_mcp_service", config.Resources.McpServices["test_mcp_service"].ID)
+	assert.Equal(t, "main.default.test_model_provider_service", config.Resources.ModelProviderServices["test_model_provider_service"].ID)
+	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.McpServices["test_mcp_service"].ModifiedStatus)
+	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.ModelProviderServices["test_model_provider_service"].ModifiedStatus)
+
 	AssertFullResourceCoverage(t, &config)
 }
 
@@ -134,6 +190,13 @@ func TestStateToBundleEmptyRemoteResources(t *testing.T) {
 					},
 				},
 			},
+			JobRuns: map[string]*resources.JobRun{
+				"test_job_run": {
+					RunNow: jobs.RunNow{
+						JobId: 1234,
+					},
+				},
+			},
 			Pipelines: map[string]*resources.Pipeline{
 				"test_pipeline": {
 					CreatePipeline: pipelines.CreatePipeline{
@@ -155,6 +218,13 @@ func TestStateToBundleEmptyRemoteResources(t *testing.T) {
 					},
 				},
 			},
+			Features: map[string]*resources.Feature{
+				"test_feature": {
+					Feature: ml.Feature{
+						FullName: "main.default.test_feature",
+					},
+				},
+			},
 			ModelServingEndpoints: map[string]*resources.ModelServingEndpoint{
 				"test_model_serving": {
 					CreateServingEndpoint: serving.CreateServingEndpoint{
@@ -219,6 +289,13 @@ func TestStateToBundleEmptyRemoteResources(t *testing.T) {
 					},
 				},
 			},
+			GenieSpaces: map[string]*resources.GenieSpace{
+				"test_genie_space": {
+					GenieSpaceConfig: resources.GenieSpaceConfig{
+						Title: "test_genie_space",
+					},
+				},
+			},
 			Apps: map[string]*resources.App{
 				"test_app": {
 					App: apps.App{
@@ -231,6 +308,15 @@ func TestStateToBundleEmptyRemoteResources(t *testing.T) {
 					Name: "test_secret_scope",
 				},
 			},
+			Secrets: map[string]*resources.Secret{
+				"test_secret": {
+					Secret: catalog.Secret{
+						CatalogName: "main",
+						SchemaName:  "default",
+						Name:        "test_secret",
+					},
+				},
+			},
 			SqlWarehouses: map[string]*resources.SqlWarehouse{
 				"test_sql_warehouse": {
 					CreateWarehouseRequest: sql.CreateWarehouseRequest{
@@ -292,6 +378,43 @@ func TestStateToBundleEmptyRemoteResources(t *testing.T) {
 					},
 				},
 			},
+			PostgresCatalogs: map[string]*resources.PostgresCatalog{
+				"test_postgres_catalog": {
+					PostgresCatalogConfig: resources.PostgresCatalogConfig{
+						CatalogId: "test_catalog",
+					},
+				},
+			},
+			PostgresDatabases: map[string]*resources.PostgresDatabase{
+				"test_postgres_database": {
+					PostgresDatabaseConfig: resources.PostgresDatabaseConfig{
+						DatabaseId: "test-db",
+						Parent:     "projects/test-project/branches/main",
+					},
+				},
+			},
+			PostgresRoles: map[string]*resources.PostgresRole{
+				"test_postgres_role": {
+					PostgresRoleConfig: resources.PostgresRoleConfig{
+						RoleId: "test-role",
+						Parent: "projects/test-project/branches/main",
+					},
+				},
+			},
+			PostgresSyncedTables: map[string]*resources.PostgresSyncedTable{
+				"test_postgres_synced_table": {
+					PostgresSyncedTableConfig: resources.PostgresSyncedTableConfig{
+						SyncedTableId: "main.public.test_synced_table",
+					},
+				},
+			},
+			PostgresSnapshotSchedules: map[string]*resources.PostgresSnapshotSchedule{
+				"test_postgres_snapshot_schedule": {
+					PostgresSnapshotScheduleConfig: resources.PostgresSnapshotScheduleConfig{
+						Branch: "projects/test-project/branches/main",
+					},
+				},
+			},
 			VectorSearchEndpoints: map[string]*resources.VectorSearchEndpoint{
 				"test_vector_search_endpoint": {
 					CreateEndpoint: vectorsearch.CreateEndpoint{
@@ -299,84 +422,170 @@ func TestStateToBundleEmptyRemoteResources(t *testing.T) {
 					},
 				},
 			},
+			VectorSearchIndexes: map[string]*resources.VectorSearchIndex{
+				"test_vector_search_index": {
+					CreateVectorIndexRequest: vectorsearch.CreateVectorIndexRequest{
+						Name: "test_vector_search_index",
+					},
+				},
+			},
+			InstancePools: map[string]*resources.InstancePool{
+				"test_instance_pool": {
+					CreateInstancePool: compute.CreateInstancePool{
+						InstancePoolName: "test_instance_pool",
+					},
+				},
+			},
+			ClusterPolicies: map[string]*resources.ClusterPolicy{
+				"test_cluster_policy": {
+					CreatePolicy: compute.CreatePolicy{
+						Name: "test_cluster_policy",
+					},
+				},
+			},
+			ModelServices: map[string]*resources.ModelService{
+				"test_model_service": {
+					ModelServiceConfig: resources.ModelServiceConfig{
+						Parent:         "schemas/main.default",
+						ModelServiceId: "test_model_service",
+					},
+				},
+			},
+			McpServices: map[string]*resources.McpService{
+				"test_mcp_service": {
+					McpServiceConfig: resources.McpServiceConfig{
+						Parent:       "schemas/main.default",
+						McpServiceId: "test_mcp_service",
+					},
+				},
+			},
+			ModelProviderServices: map[string]*resources.ModelProviderService{
+				"test_model_provider_service": {
+					ModelProviderServiceConfig: resources.ModelProviderServiceConfig{
+						Parent:                 "schemas/main.default",
+						ModelProviderServiceId: "test_model_provider_service",
+					},
+				},
+			},
 		},
 	}
 
 	err := StateToBundle(t.Context(), nil, &config)
 	assert.NoError(t, err)
 
-	assert.Equal(t, "", config.Resources.Jobs["test_job"].ID)
+	assert.Empty(t, config.Resources.Jobs["test_job"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.Jobs["test_job"].ModifiedStatus)
 
-	assert.Equal(t, "", config.Resources.Pipelines["test_pipeline"].ID)
+	assert.Empty(t, config.Resources.JobRuns["test_job_run"].ID)
+	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.JobRuns["test_job_run"].ModifiedStatus)
+
+	assert.Empty(t, config.Resources.Pipelines["test_pipeline"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.Pipelines["test_pipeline"].ModifiedStatus)
 
-	assert.Equal(t, "", config.Resources.Models["test_mlflow_model"].ID)
+	assert.Empty(t, config.Resources.Models["test_mlflow_model"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.Models["test_mlflow_model"].ModifiedStatus)
 
-	assert.Equal(t, "", config.Resources.Experiments["test_mlflow_experiment"].ID)
+	assert.Empty(t, config.Resources.Experiments["test_mlflow_experiment"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.Experiments["test_mlflow_experiment"].ModifiedStatus)
 
-	assert.Equal(t, "", config.Resources.ModelServingEndpoints["test_model_serving"].ID)
+	assert.Empty(t, config.Resources.ModelServingEndpoints["test_model_serving"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.ModelServingEndpoints["test_model_serving"].ModifiedStatus)
 
-	assert.Equal(t, "", config.Resources.RegisteredModels["test_registered_model"].ID)
+	assert.Empty(t, config.Resources.RegisteredModels["test_registered_model"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.RegisteredModels["test_registered_model"].ModifiedStatus)
 
-	assert.Equal(t, "", config.Resources.QualityMonitors["test_monitor"].ID)
+	assert.Empty(t, config.Resources.QualityMonitors["test_monitor"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.QualityMonitors["test_monitor"].ModifiedStatus)
 
-	assert.Equal(t, "", config.Resources.Catalogs["test_catalog"].ID)
+	assert.Empty(t, config.Resources.Catalogs["test_catalog"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.Catalogs["test_catalog"].ModifiedStatus)
 
-	assert.Equal(t, "", config.Resources.Schemas["test_schema"].ID)
+	assert.Empty(t, config.Resources.Schemas["test_schema"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.Schemas["test_schema"].ModifiedStatus)
 
-	assert.Equal(t, "", config.Resources.ExternalLocations["test_external_location"].ID)
+	assert.Empty(t, config.Resources.ExternalLocations["test_external_location"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.ExternalLocations["test_external_location"].ModifiedStatus)
 
-	assert.Equal(t, "", config.Resources.Volumes["test_volume"].ID)
+	assert.Empty(t, config.Resources.Volumes["test_volume"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.Volumes["test_volume"].ModifiedStatus)
 
-	assert.Equal(t, "", config.Resources.Clusters["test_cluster"].ID)
+	assert.Empty(t, config.Resources.Clusters["test_cluster"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.Clusters["test_cluster"].ModifiedStatus)
 
-	assert.Equal(t, "", config.Resources.Dashboards["test_dashboard"].ID)
+	assert.Empty(t, config.Resources.Dashboards["test_dashboard"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.Dashboards["test_dashboard"].ModifiedStatus)
 
-	assert.Equal(t, "", config.Resources.Apps["test_app"].Name)
+	assert.Empty(t, config.Resources.GenieSpaces["test_genie_space"].ID)
+	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.GenieSpaces["test_genie_space"].ModifiedStatus)
+
+	assert.Empty(t, config.Resources.Apps["test_app"].Name)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.Apps["test_app"].ModifiedStatus)
 
-	assert.Equal(t, "", config.Resources.SecretScopes["test_secret_scope"].ID)
+	assert.Empty(t, config.Resources.SecretScopes["test_secret_scope"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.SecretScopes["test_secret_scope"].ModifiedStatus)
 
-	assert.Equal(t, "", config.Resources.SqlWarehouses["test_sql_warehouse"].ID)
+	assert.Empty(t, config.Resources.Secrets["test_secret"].ID)
+	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.Secrets["test_secret"].ModifiedStatus)
+
+	assert.Empty(t, config.Resources.SqlWarehouses["test_sql_warehouse"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.SqlWarehouses["test_sql_warehouse"].ModifiedStatus)
 
-	assert.Equal(t, "", config.Resources.DatabaseInstances["test_database_instance"].ID)
+	assert.Empty(t, config.Resources.DatabaseInstances["test_database_instance"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.DatabaseInstances["test_database_instance"].ModifiedStatus)
 
-	assert.Equal(t, "", config.Resources.DatabaseCatalogs["test_database_catalog"].ID)
+	assert.Empty(t, config.Resources.DatabaseCatalogs["test_database_catalog"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.DatabaseCatalogs["test_database_catalog"].ModifiedStatus)
 
-	assert.Equal(t, "", config.Resources.SyncedDatabaseTables["test_synced_database_table"].ID)
+	assert.Empty(t, config.Resources.SyncedDatabaseTables["test_synced_database_table"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.SyncedDatabaseTables["test_synced_database_table"].ModifiedStatus)
 
-	assert.Equal(t, "", config.Resources.Alerts["test_alert"].ID)
+	assert.Empty(t, config.Resources.Alerts["test_alert"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.Alerts["test_alert"].ModifiedStatus)
 
-	assert.Equal(t, "", config.Resources.PostgresProjects["test_postgres_project"].ID)
+	assert.Empty(t, config.Resources.PostgresProjects["test_postgres_project"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.PostgresProjects["test_postgres_project"].ModifiedStatus)
 
-	assert.Equal(t, "", config.Resources.PostgresBranches["test_postgres_branch"].ID)
+	assert.Empty(t, config.Resources.PostgresBranches["test_postgres_branch"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.PostgresBranches["test_postgres_branch"].ModifiedStatus)
 
-	assert.Equal(t, "", config.Resources.PostgresEndpoints["test_postgres_endpoint"].ID)
+	assert.Empty(t, config.Resources.PostgresEndpoints["test_postgres_endpoint"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.PostgresEndpoints["test_postgres_endpoint"].ModifiedStatus)
 
-	assert.Equal(t, "", config.Resources.VectorSearchEndpoints["test_vector_search_endpoint"].ID)
+	assert.Empty(t, config.Resources.PostgresCatalogs["test_postgres_catalog"].ID)
+	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.PostgresCatalogs["test_postgres_catalog"].ModifiedStatus)
+
+	assert.Empty(t, config.Resources.PostgresDatabases["test_postgres_database"].ID)
+	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.PostgresDatabases["test_postgres_database"].ModifiedStatus)
+
+	assert.Empty(t, config.Resources.PostgresRoles["test_postgres_role"].ID)
+	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.PostgresRoles["test_postgres_role"].ModifiedStatus)
+
+	assert.Empty(t, config.Resources.PostgresSyncedTables["test_postgres_synced_table"].ID)
+	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.PostgresSyncedTables["test_postgres_synced_table"].ModifiedStatus)
+
+	assert.Empty(t, config.Resources.PostgresSnapshotSchedules["test_postgres_snapshot_schedule"].ID)
+	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.PostgresSnapshotSchedules["test_postgres_snapshot_schedule"].ModifiedStatus)
+
+	assert.Empty(t, config.Resources.VectorSearchEndpoints["test_vector_search_endpoint"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.VectorSearchEndpoints["test_vector_search_endpoint"].ModifiedStatus)
 
+	assert.Empty(t, config.Resources.VectorSearchIndexes["test_vector_search_index"].ID)
+	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.VectorSearchIndexes["test_vector_search_index"].ModifiedStatus)
+
+	assert.Empty(t, config.Resources.InstancePools["test_instance_pool"].ID)
+	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.InstancePools["test_instance_pool"].ModifiedStatus)
+
+	assert.Empty(t, config.Resources.ClusterPolicies["test_cluster_policy"].ID)
+	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.ClusterPolicies["test_cluster_policy"].ModifiedStatus)
+
+	assert.Empty(t, config.Resources.ModelServices["test_model_service"].ID)
+	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.ModelServices["test_model_service"].ModifiedStatus)
+
+	assert.Empty(t, config.Resources.McpServices["test_mcp_service"].ID)
+	assert.Empty(t, config.Resources.ModelProviderServices["test_model_provider_service"].ID)
+	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.McpServices["test_mcp_service"].ModifiedStatus)
+	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.ModelProviderServices["test_model_provider_service"].ModifiedStatus)
+
 	AssertFullResourceCoverage(t, &config)
 }
 
@@ -395,6 +604,18 @@ func TestStateToBundleModifiedResources(t *testing.T) {
 					},
 				},
 			},
+			JobRuns: map[string]*resources.JobRun{
+				"test_job_run": {
+					RunNow: jobs.RunNow{
+						JobId: 1234,
+					},
+				},
+				"test_job_run_new": {
+					RunNow: jobs.RunNow{
+						JobId: 5678,
+					},
+				},
+			},
 			Pipelines: map[string]*resources.Pipeline{
 				"test_pipeline": {
 					CreatePipeline: pipelines.CreatePipeline{
@@ -431,6 +652,18 @@ func TestStateToBundleModifiedResources(t *testing.T) {
 					},
 				},
 			},
+			Features: map[string]*resources.Feature{
+				"test_feature": {
+					Feature: ml.Feature{
+						FullName: "main.default.test_feature",
+					},
+				},
+				"test_feature_new": {
+					Feature: ml.Feature{
+						FullName: "main.default.test_feature_new",
+					},
+				},
+			},
 			ModelServingEndpoints: map[string]*resources.ModelServingEndpoint{
 				"test_model_serving": {
 					CreateServingEndpoint: serving.CreateServingEndpoint{
@@ -535,6 +768,18 @@ func TestStateToBundleModifiedResources(t *testing.T) {
 					},
 				},
 			},
+			GenieSpaces: map[string]*resources.GenieSpace{
+				"test_genie_space": {
+					GenieSpaceConfig: resources.GenieSpaceConfig{
+						Title: "test_genie_space",
+					},
+				},
+				"test_genie_space_new": {
+					GenieSpaceConfig: resources.GenieSpaceConfig{
+						Title: "test_genie_space_new",
+					},
+				},
+			},
 			Apps: map[string]*resources.App{
 				"test_app": {
 					App: apps.App{
@@ -555,6 +800,22 @@ func TestStateToBundleModifiedResources(t *testing.T) {
 					Name: "test_secret_scope_new",
 				},
 			},
+			Secrets: map[string]*resources.Secret{
+				"test_secret": {
+					Secret: catalog.Secret{
+						CatalogName: "main",
+						SchemaName:  "default",
+						Name:        "test_secret",
+					},
+				},
+				"test_secret_new": {
+					Secret: catalog.Secret{
+						CatalogName: "main",
+						SchemaName:  "default",
+						Name:        "test_secret_new",
+					},
+				},
+			},
 			SqlWarehouses: map[string]*resources.SqlWarehouse{
 				"test_sql_warehouse": {
 					CreateWarehouseRequest: sql.CreateWarehouseRequest{
@@ -661,6 +922,60 @@ func TestStateToBundleModifiedResources(t *testing.T) {
 					},
 				},
 			},
+			PostgresCatalogs: map[string]*resources.PostgresCatalog{
+				"test_postgres_catalog": {
+					PostgresCatalogConfig: resources.PostgresCatalogConfig{
+						CatalogId: "test_catalog",
+					},
+				},
+				"test_postgres_catalog_new": {
+					PostgresCatalogConfig: resources.PostgresCatalogConfig{
+						CatalogId: "test_catalog_new",
+					},
+				},
+			},
+			PostgresDatabases: map[string]*resources.PostgresDatabase{
+				"test_postgres_database": {
+					PostgresDatabaseConfig: resources.PostgresDatabaseConfig{
+						DatabaseId: "test-db",
+						Parent:     "projects/test-project/branches/main",
+					},
+				},
+				"test_postgres_database_new": {
+					PostgresDatabaseConfig: resources.PostgresDatabaseConfig{
+						DatabaseId: "new-db",
+						Parent:     "projects/test-project-new/branches/dev",
+					},
+				},
+			},
+			PostgresRoles: map[string]*resources.PostgresRole{
+				"test_postgres_role": {
+					PostgresRoleConfig: resources.PostgresRoleConfig{
+						RoleId: "primary",
+						Parent: "projects/test-project/branches/main",
+					},
+				},
+				"test_postgres_role_new": {
+					PostgresRoleConfig: resources.PostgresRoleConfig{
+						RoleId: "replica",
+						Parent: "projects/test-project-new/branches/dev",
+					},
+				},
+			},
+			PostgresSyncedTables: map[string]*resources.PostgresSyncedTable{
+				"test_postgres_synced_table": {
+					PostgresSyncedTableConfig: resources.PostgresSyncedTableConfig{
+						SyncedTableId: "main.public.test_synced_table",
+					},
+				},
+			},
+			PostgresSnapshotSchedules: map[string]*resources.PostgresSnapshotSchedule{
+				"test_postgres_snapshot_schedule": {
+					PostgresSnapshotScheduleConfig: resources.PostgresSnapshotScheduleConfig{
+						Branch: "projects/test-project/branches/main",
+					},
+				},
+			},
 			VectorSearchEndpoints: map[string]*resources.VectorSearchEndpoint{
 				"test_vector_search_endpoint": {
 					CreateEndpoint: vectorsearch.CreateEndpoint{
@@ -673,17 +988,99 @@ func TestStateToBundleModifiedResources(t *testing.T) {
 					},
 				},
 			},
+			VectorSearchIndexes: map[string]*resources.VectorSearchIndex{
+				"test_vector_search_index": {
+					CreateVectorIndexRequest: vectorsearch.CreateVectorIndexRequest{
+						Name: "test_vector_search_index",
+					},
+				},
+				"test_vector_search_index_new": {
+					CreateVectorIndexRequest: vectorsearch.CreateVectorIndexRequest{
+						Name: "test_vector_search_index_new",
+					},
+				},
+			},
+			InstancePools: map[string]*resources.InstancePool{
+				"test_instance_pool": {
+					CreateInstancePool: compute.CreateInstancePool{
+						InstancePoolName: "test_instance_pool",
+					},
+				},
+				"test_instance_pool_new": {
+					CreateInstancePool: compute.CreateInstancePool{
+						InstancePoolName: "test_instance_pool_new",
+					},
+				},
+			},
+			ClusterPolicies: map[string]*resources.ClusterPolicy{
+				"test_cluster_policy": {
+					CreatePolicy: compute.CreatePolicy{
+						Name: "test_cluster_policy",
+					},
+				},
+				"test_cluster_policy_new": {
+					CreatePolicy: compute.CreatePolicy{
+						Name: "test_cluster_policy_new",
+					},
+				},
+			},
+			ModelServices: map[string]*resources.ModelService{
+				"test_model_service": {
+					ModelServiceConfig: resources.ModelServiceConfig{
+						Parent:         "schemas/main.default",
+						ModelServiceId: "test_model_service",
+					},
+				},
+				"test_model_service_new": {
+					ModelServiceConfig: resources.ModelServiceConfig{
+						Parent:         "schemas/main.default",
+						ModelServiceId: "test_model_service_new",
+					},
+				},
+			},
+			McpServices: map[string]*resources.McpService{
+				"test_mcp_service": {
+					McpServiceConfig: resources.McpServiceConfig{
+						Parent:       "schemas/main.default",
+						McpServiceId: "test_mcp_service",
+					},
+				},
+				"test_mcp_service_new": {
+					McpServiceConfig: resources.McpServiceConfig{
+						Parent:       "schemas/main.default",
+						McpServiceId: "test_mcp_service_new",
+					},
+				},
+			},
+			ModelProviderServices: map[string]*resources.ModelProviderService{
+				"test_model_provider_service": {
+					ModelProviderServiceConfig: resources.ModelProviderServiceConfig{
+						Parent:                 "schemas/main.default",
+						ModelProviderServiceId: "test_model_provider_service",
+					},
+				},
+				"test_model_provider_service_new": {
+					ModelProviderServiceConfig: resources.ModelProviderServiceConfig{
+						Parent:                 "schemas/main.default",
+						ModelProviderServiceId: "test_model_provider_service_new",
+					},
+				},
+			},
 		},
 	}
 	state := ExportedResourcesMap{
 		"resources.jobs.test_job":                                           {ID: "1"},
 		"resources.jobs.test_job_old":                                       {ID: "2"},
+		"resources.job_runs.test_job_run":                                   {ID: "1"},
+		"resources.job_runs.test_job_run_old":                               {ID: "2"},
 		"resources.pipelines.test_pipeline":                                 {ID: "1"},
 		"resources.pipelines.test_pipeline_old":                             {ID: "2"},
 		"resources.models.test_mlflow_model":                                {ID: "1"},
 		"resources.models.test_mlflow_model_old":                            {ID: "2"},
 		"resources.experiments.test_mlflow_experiment":                      {ID: "1"},
 		"resources.experiments.test_mlflow_experiment_old":                  {ID: "2"},
+		"resources.features.test_feature":                                   {ID: "main.default.test_feature"},
+		"resources.features.test_feature_old":                               {ID: "main.default.test_feature_old"},
 		"resources.model_serving_endpoints.test_model_serving":              {ID: "1"},
 		"resources.model_serving_endpoints.test_model_serving_old":          {ID: "2"},
 		"resources.registered_models.test_registered_model":                 {ID: "1"},
@@ -700,6 +1097,8 @@ func TestStateToBundleModifiedResources(t *testing.T) {
 		"resources.clusters.test_cluster_old":                               {ID: "2"},
 		"resources.dashboards.test_dashboard":                               {ID: "1"},
 		"resources.dashboards.test_dashboard_old":                           {ID: "2"},
+		"resources.genie_spaces.test_genie_space":                           {ID: "1"},
+		"resources.genie_spaces.test_genie_space_old":                       {ID: "2"},
 		"resources.apps.test_app":                                           {ID: "test_app"},
 		"resources.apps.test_app_old":                                       {ID: "test_app_old"},
 		"resources.secret_scopes.test_secret_scope":                         {ID: "test_secret_scope"},
@@ -716,161 +1115,271 @@ func TestStateToBundleModifiedResources(t *testing.T) {
 		"resources.postgres_branches.test_postgres_branch_old":              {ID: "projects/test-project/branches/old"},
 		"resources.postgres_endpoints.test_postgres_endpoint":               {ID: "projects/test-project/branches/main/endpoints/primary"},
 		"resources.postgres_endpoints.test_postgres_endpoint_old":           {ID: "projects/test-project/branches/main/endpoints/old"},
+		"resources.postgres_catalogs.test_postgres_catalog":                 {ID: "catalogs/test_catalog"},
+		"resources.postgres_catalogs.test_postgres_catalog_old":             {ID: "catalogs/test_catalog_old"},
+		"resources.postgres_databases.test_postgres_database":               {ID: "projects/test-project/branches/main/databases/test-db"},
+		"resources.postgres_databases.test_postgres_database_old":           {ID: "projects/test-project/branches/main/databases/old-db"},
+		"resources.postgres_roles.test_postgres_role":                       {ID: "projects/test-project/branches/main/roles/primary"},
+		"resources.postgres_roles.test_postgres_role_old":                   {ID: "projects/test-project/branches/main/roles/old"},
 		"resources.vector_search_endpoints.test_vector_search_endpoint":     {ID: "vs-endpoint-1"},
 		"resources.vector_search_endpoints.test_vector_search_endpoint_old": {ID: "vs-endpoint-old"},
+		"resources.vector_search_indexes.test_vector_search_index":          {ID: "vs-index-1"},
+		"resources.vector_search_indexes.test_vector_search_index_old":      {ID: "vs-index-old"},
+		"resources.instance_pools.test_instance_pool":                       {ID: "1"},
+		"resources.instance_pools.test_instance_pool_old":                   {ID: "2"},
+		"resources.cluster_policies.test_cluster_policy":                    {ID: "cp-1"},
+		"resources.cluster_policies.test_cluster_policy_old":                {ID: "cp-2"},
+		"resources.model_services.test_model_service":                       {ID: "main.default.test_model_service"},
+		"resources.model_services.test_model_service_old":                   {ID: "main.default.test_model_service_old"},
+		"resources.mcp_services.test_mcp_service":                           {ID: "main.default.test_mcp_service"},
+		"resources.model_provider_services.test_model_provider_service":     {ID: "main.default.test_model_provider_service"},
+		"resources.mcp_services.test_mcp_service_old":                       {ID: "main.default.test_mcp_service_old"},
+		"resources.model_provider_services.test_model_provider_service_old": {ID: "main.default.test_model_provider_service_old"},
+		"resources.secrets.test_secret":                                     {ID: "main.default.test_secret"},
+		"resources.secrets.test_secret_old":                                 {ID: "main.default.test_secret_old"},
 	}
 	err := StateToBundle(t.Context(), state, &config)
 	assert.NoError(t, err)
 
 	assert.Equal(t, "1", config.Resources.Jobs["test_job"].ID)
-	assert.Equal(t, "", config.Resources.Jobs["test_job"].ModifiedStatus)
+	assert.Empty(t, config.Resources.Jobs["test_job"].ModifiedStatus)
 	assert.Equal(t, "2", config.Resources.Jobs["test_job_old"].ID)
 	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.Jobs["test_job_old"].ModifiedStatus)
-	assert.Equal(t, "", config.Resources.Jobs["test_job_new"].ID)
+	assert.Empty(t, config.Resources.Jobs["test_job_new"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.Jobs["test_job_new"].ModifiedStatus)
 
+	assert.Equal(t, "1", config.Resources.JobRuns["test_job_run"].ID)
+	assert.Empty(t, config.Resources.JobRuns["test_job_run"].ModifiedStatus)
+	assert.Equal(t, "2", config.Resources.JobRuns["test_job_run_old"].ID)
+	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.JobRuns["test_job_run_old"].ModifiedStatus)
+	assert.Empty(t, config.Resources.JobRuns["test_job_run_new"].ID)
+	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.JobRuns["test_job_run_new"].ModifiedStatus)
+
 	assert.Equal(t, "1", config.Resources.Pipelines["test_pipeline"].ID)
-	assert.Equal(t, "", config.Resources.Pipelines["test_pipeline"].ModifiedStatus)
+	assert.Empty(t, config.Resources.Pipelines["test_pipeline"].ModifiedStatus)
 	assert.Equal(t, "2", config.Resources.Pipelines["test_pipeline_old"].ID)
 	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.Pipelines["test_pipeline_old"].ModifiedStatus)
-	assert.Equal(t, "", config.Resources.Pipelines["test_pipeline_new"].ID)
+	assert.Empty(t, config.Resources.Pipelines["test_pipeline_new"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.Pipelines["test_pipeline_new"].ModifiedStatus)
 
 	assert.Equal(t, "1", config.Resources.Models["test_mlflow_model"].ID)
-	assert.Equal(t, "", config.Resources.Models["test_mlflow_model"].ModifiedStatus)
+	assert.Empty(t, config.Resources.Models["test_mlflow_model"].ModifiedStatus)
 	assert.Equal(t, "2", config.Resources.Models["test_mlflow_model_old"].ID)
 	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.Models["test_mlflow_model_old"].ModifiedStatus)
-	assert.Equal(t, "", config.Resources.Models["test_mlflow_model_new"].ID)
+	assert.Empty(t, config.Resources.Models["test_mlflow_model_new"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.Models["test_mlflow_model_new"].ModifiedStatus)
 
 	assert.Equal(t, "1", config.Resources.RegisteredModels["test_registered_model"].ID)
-	assert.Equal(t, "", config.Resources.RegisteredModels["test_registered_model"].ModifiedStatus)
+	assert.Empty(t, config.Resources.RegisteredModels["test_registered_model"].ModifiedStatus)
 	assert.Equal(t, "2", config.Resources.RegisteredModels["test_registered_model_old"].ID)
 	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.RegisteredModels["test_registered_model_old"].ModifiedStatus)
-	assert.Equal(t, "", config.Resources.RegisteredModels["test_registered_model_new"].ID)
+	assert.Empty(t, config.Resources.RegisteredModels["test_registered_model_new"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.RegisteredModels["test_registered_model_new"].ModifiedStatus)
 
 	assert.Equal(t, "1", config.Resources.Experiments["test_mlflow_experiment"].ID)
-	assert.Equal(t, "", config.Resources.Experiments["test_mlflow_experiment"].ModifiedStatus)
+	assert.Empty(t, config.Resources.Experiments["test_mlflow_experiment"].ModifiedStatus)
 	assert.Equal(t, "2", config.Resources.Experiments["test_mlflow_experiment_old"].ID)
 	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.Experiments["test_mlflow_experiment_old"].ModifiedStatus)
-	assert.Equal(t, "", config.Resources.Experiments["test_mlflow_experiment_new"].ID)
+	assert.Empty(t, config.Resources.Experiments["test_mlflow_experiment_new"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.Experiments["test_mlflow_experiment_new"].ModifiedStatus)
 
+	assert.Equal(t, "main.default.test_feature", config.Resources.Features["test_feature"].ID)
+	assert.Empty(t, config.Resources.Features["test_feature"].ModifiedStatus)
+	assert.Equal(t, "main.default.test_feature_old", config.Resources.Features["test_feature_old"].ID)
+	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.Features["test_feature_old"].ModifiedStatus)
+	assert.Empty(t, config.Resources.Features["test_feature_new"].ID)
+	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.Features["test_feature_new"].ModifiedStatus)
+
 	assert.Equal(t, "1", config.Resources.ModelServingEndpoints["test_model_serving"].ID)
-	assert.Equal(t, "", config.Resources.ModelServingEndpoints["test_model_serving"].ModifiedStatus)
+	assert.Empty(t, config.Resources.ModelServingEndpoints["test_model_serving"].ModifiedStatus)
 	assert.Equal(t, "2", config.Resources.ModelServingEndpoints["test_model_serving_old"].ID)
 	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.ModelServingEndpoints["test_model_serving_old"].ModifiedStatus)
-	assert.Equal(t, "", config.Resources.ModelServingEndpoints["test_model_serving_new"].ID)
+	assert.Empty(t, config.Resources.ModelServingEndpoints["test_model_serving_new"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.ModelServingEndpoints["test_model_serving_new"].ModifiedStatus)
 
 	assert.Equal(t, "test_monitor", config.Resources.QualityMonitors["test_monitor"].ID)
-	assert.Equal(t, "", config.Resources.QualityMonitors["test_monitor"].ModifiedStatus)
+	assert.Empty(t, config.Resources.QualityMonitors["test_monitor"].ModifiedStatus)
 	assert.Equal(t, "test_monitor_old", config.Resources.QualityMonitors["test_monitor_old"].ID)
 	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.QualityMonitors["test_monitor_old"].ModifiedStatus)
-	assert.Equal(t, "", config.Resources.QualityMonitors["test_monitor_new"].ID)
+	assert.Empty(t, config.Resources.QualityMonitors["test_monitor_new"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.QualityMonitors["test_monitor_new"].ModifiedStatus)
 
 	assert.Equal(t, "1", config.Resources.Catalogs["test_catalog"].ID)
-	assert.Equal(t, "", config.Resources.Catalogs["test_catalog"].ModifiedStatus)
+	assert.Empty(t, config.Resources.Catalogs["test_catalog"].ModifiedStatus)
 	assert.Equal(t, "2", config.Resources.Catalogs["test_catalog_old"].ID)
 	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.Catalogs["test_catalog_old"].ModifiedStatus)
-	assert.Equal(t, "", config.Resources.Catalogs["test_catalog_new"].ID)
+	assert.Empty(t, config.Resources.Catalogs["test_catalog_new"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.Catalogs["test_catalog_new"].ModifiedStatus)
 
 	assert.Equal(t, "1", config.Resources.Schemas["test_schema"].ID)
-	assert.Equal(t, "", config.Resources.Schemas["test_schema"].ModifiedStatus)
+	assert.Empty(t, config.Resources.Schemas["test_schema"].ModifiedStatus)
 	assert.Equal(t, "2", config.Resources.Schemas["test_schema_old"].ID)
 	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.Schemas["test_schema_old"].ModifiedStatus)
-	assert.Equal(t, "", config.Resources.Schemas["test_schema_new"].ID)
+	assert.Empty(t, config.Resources.Schemas["test_schema_new"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.Schemas["test_schema_new"].ModifiedStatus)
 
 	assert.Equal(t, "1", config.Resources.Volumes["test_volume"].ID)
-	assert.Equal(t, "", config.Resources.Volumes["test_volume"].ModifiedStatus)
+	assert.Empty(t, config.Resources.Volumes["test_volume"].ModifiedStatus)
 	assert.Equal(t, "2", config.Resources.Volumes["test_volume_old"].ID)
 	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.Volumes["test_volume_old"].ModifiedStatus)
-	assert.Equal(t, "", config.Resources.Volumes["test_volume_new"].ID)
+	assert.Empty(t, config.Resources.Volumes["test_volume_new"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.Volumes["test_volume_new"].ModifiedStatus)
 
 	assert.Equal(t, "1", config.Resources.Clusters["test_cluster"].ID)
-	assert.Equal(t, "", config.Resources.Clusters["test_cluster"].ModifiedStatus)
+	assert.Empty(t, config.Resources.Clusters["test_cluster"].ModifiedStatus)
 	assert.Equal(t, "2", config.Resources.Clusters["test_cluster_old"].ID)
 	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.Clusters["test_cluster_old"].ModifiedStatus)
-	assert.Equal(t, "", config.Resources.Clusters["test_cluster_new"].ID)
+	assert.Empty(t, config.Resources.Clusters["test_cluster_new"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.Clusters["test_cluster_new"].ModifiedStatus)
 
 	assert.Equal(t, "1", config.Resources.Dashboards["test_dashboard"].ID)
-	assert.Equal(t, "", config.Resources.Dashboards["test_dashboard"].ModifiedStatus)
+	assert.Empty(t, config.Resources.Dashboards["test_dashboard"].ModifiedStatus)
 	assert.Equal(t, "2", config.Resources.Dashboards["test_dashboard_old"].ID)
 	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.Dashboards["test_dashboard_old"].ModifiedStatus)
-	assert.Equal(t, "", config.Resources.Dashboards["test_dashboard_new"].ID)
+	assert.Empty(t, config.Resources.Dashboards["test_dashboard_new"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.Dashboards["test_dashboard_new"].ModifiedStatus)
 
+	assert.Equal(t, "1", config.Resources.GenieSpaces["test_genie_space"].ID)
+	assert.Empty(t, config.Resources.GenieSpaces["test_genie_space"].ModifiedStatus)
+	assert.Equal(t, "2", config.Resources.GenieSpaces["test_genie_space_old"].ID)
+	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.GenieSpaces["test_genie_space_old"].ModifiedStatus)
+	assert.Empty(t, config.Resources.GenieSpaces["test_genie_space_new"].ID)
+	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.GenieSpaces["test_genie_space_new"].ModifiedStatus)
+
 	assert.Equal(t, "test_app", config.Resources.Apps["test_app"].Name)
-	assert.Equal(t, "", config.Resources.Apps["test_app"].ModifiedStatus)
+	assert.Empty(t, config.Resources.Apps["test_app"].ModifiedStatus)
 	assert.Equal(t, "test_app_old", config.Resources.Apps["test_app_old"].ID)
-	assert.Equal(t, "", config.Resources.Apps["test_app_old"].Name)
+	assert.Empty(t, config.Resources.Apps["test_app_old"].Name)
 	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.Apps["test_app_old"].ModifiedStatus)
 	assert.Equal(t, "test_app_new", config.Resources.Apps["test_app_new"].Name)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.Apps["test_app_new"].ModifiedStatus)
 
 	assert.Equal(t, "test_secret_scope", config.Resources.SecretScopes["test_secret_scope"].Name)
-	assert.Equal(t, "", config.Resources.SecretScopes["test_secret_scope"].ModifiedStatus)
+	assert.Empty(t, config.Resources.SecretScopes["test_secret_scope"].ModifiedStatus)
 	assert.Equal(t, "test_secret_scope_old", config.Resources.SecretScopes["test_secret_scope_old"].ID)
-	assert.Equal(t, "", config.Resources.SecretScopes["test_secret_scope_old"].Name)
+	assert.Empty(t, config.Resources.SecretScopes["test_secret_scope_old"].Name)
 	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.SecretScopes["test_secret_scope_old"].ModifiedStatus)
 	assert.Equal(t, "test_secret_scope_new", config.Resources.SecretScopes["test_secret_scope_new"].Name)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.SecretScopes["test_secret_scope_new"].ModifiedStatus)
 
 	assert.Equal(t, "1", config.Resources.SqlWarehouses["test_sql_warehouse"].ID)
-	assert.Equal(t, "", config.Resources.SqlWarehouses["test_sql_warehouse"].ModifiedStatus)
+	assert.Empty(t, config.Resources.SqlWarehouses["test_sql_warehouse"].ModifiedStatus)
 	assert.Equal(t, "2", config.Resources.SqlWarehouses["test_sql_warehouse_old"].ID)
 	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.SqlWarehouses["test_sql_warehouse_old"].ModifiedStatus)
-	assert.Equal(t, "", config.Resources.SqlWarehouses["test_sql_warehouse_new"].ID)
+	assert.Empty(t, config.Resources.SqlWarehouses["test_sql_warehouse_new"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.SqlWarehouses["test_sql_warehouse_new"].ModifiedStatus)
 
 	assert.Equal(t, "1", config.Resources.DatabaseInstances["test_database_instance"].ID)
-	assert.Equal(t, "", config.Resources.DatabaseInstances["test_database_instance"].ModifiedStatus)
+	assert.Empty(t, config.Resources.DatabaseInstances["test_database_instance"].ModifiedStatus)
 	assert.Equal(t, "2", config.Resources.DatabaseInstances["test_database_instance_old"].ID)
 	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.DatabaseInstances["test_database_instance_old"].ModifiedStatus)
-	assert.Equal(t, "", config.Resources.DatabaseInstances["test_database_instance_new"].ID)
+	assert.Empty(t, config.Resources.DatabaseInstances["test_database_instance_new"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.DatabaseInstances["test_database_instance_new"].ModifiedStatus)
 
 	assert.Equal(t, "1", config.Resources.Alerts["test_alert"].ID)
-	assert.Equal(t, "", config.Resources.Alerts["test_alert"].ModifiedStatus)
+	assert.Empty(t, config.Resources.Alerts["test_alert"].ModifiedStatus)
 	assert.Equal(t, "2", config.Resources.Alerts["test_alert_old"].ID)
 	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.Alerts["test_alert_old"].ModifiedStatus)
-	assert.Equal(t, "", config.Resources.Alerts["test_alert_new"].ID)
+	assert.Empty(t, config.Resources.Alerts["test_alert_new"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.Alerts["test_alert_new"].ModifiedStatus)
 
 	assert.Equal(t, "projects/test-project", config.Resources.PostgresProjects["test_postgres_project"].ID)
-	assert.Equal(t, "", config.Resources.PostgresProjects["test_postgres_project"].ModifiedStatus)
+	assert.Empty(t, config.Resources.PostgresProjects["test_postgres_project"].ModifiedStatus)
 	assert.Equal(t, "projects/test-project-old", config.Resources.PostgresProjects["test_postgres_project_old"].ID)
 	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.PostgresProjects["test_postgres_project_old"].ModifiedStatus)
-	assert.Equal(t, "", config.Resources.PostgresProjects["test_postgres_project_new"].ID)
+	assert.Empty(t, config.Resources.PostgresProjects["test_postgres_project_new"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.PostgresProjects["test_postgres_project_new"].ModifiedStatus)
 
 	assert.Equal(t, "projects/test-project/branches/main", config.Resources.PostgresBranches["test_postgres_branch"].ID)
-	assert.Equal(t, "", config.Resources.PostgresBranches["test_postgres_branch"].ModifiedStatus)
+	assert.Empty(t, config.Resources.PostgresBranches["test_postgres_branch"].ModifiedStatus)
 	assert.Equal(t, "projects/test-project/branches/old", config.Resources.PostgresBranches["test_postgres_branch_old"].ID)
 	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.PostgresBranches["test_postgres_branch_old"].ModifiedStatus)
-	assert.Equal(t, "", config.Resources.PostgresBranches["test_postgres_branch_new"].ID)
+	assert.Empty(t, config.Resources.PostgresBranches["test_postgres_branch_new"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.PostgresBranches["test_postgres_branch_new"].ModifiedStatus)
 
 	assert.Equal(t, "projects/test-project/branches/main/endpoints/primary", config.Resources.PostgresEndpoints["test_postgres_endpoint"].ID)
-	assert.Equal(t, "", config.Resources.PostgresEndpoints["test_postgres_endpoint"].ModifiedStatus)
+	assert.Empty(t, config.Resources.PostgresEndpoints["test_postgres_endpoint"].ModifiedStatus)
 	assert.Equal(t, "projects/test-project/branches/main/endpoints/old", config.Resources.PostgresEndpoints["test_postgres_endpoint_old"].ID)
 	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.PostgresEndpoints["test_postgres_endpoint_old"].ModifiedStatus)
-	assert.Equal(t, "", config.Resources.PostgresEndpoints["test_postgres_endpoint_new"].ID)
+	assert.Empty(t, config.Resources.PostgresEndpoints["test_postgres_endpoint_new"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.PostgresEndpoints["test_postgres_endpoint_new"].ModifiedStatus)
 
+	assert.Equal(t, "catalogs/test_catalog", config.Resources.PostgresCatalogs["test_postgres_catalog"].ID)
+	assert.Empty(t, config.Resources.PostgresCatalogs["test_postgres_catalog"].ModifiedStatus)
+	assert.Equal(t, "catalogs/test_catalog_old", config.Resources.PostgresCatalogs["test_postgres_catalog_old"].ID)
+	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.PostgresCatalogs["test_postgres_catalog_old"].ModifiedStatus)
+	assert.Empty(t, config.Resources.PostgresCatalogs["test_postgres_catalog_new"].ID)
+	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.PostgresCatalogs["test_postgres_catalog_new"].ModifiedStatus)
+
+	assert.Equal(t, "projects/test-project/branches/main/databases/test-db", config.Resources.PostgresDatabases["test_postgres_database"].ID)
+	assert.Empty(t, config.Resources.PostgresDatabases["test_postgres_database"].ModifiedStatus)
+	assert.Equal(t, "projects/test-project/branches/main/databases/old-db", config.Resources.PostgresDatabases["test_postgres_database_old"].ID)
+	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.PostgresDatabases["test_postgres_database_old"].ModifiedStatus)
+	assert.Empty(t, config.Resources.PostgresDatabases["test_postgres_database_new"].ID)
+	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.PostgresDatabases["test_postgres_database_new"].ModifiedStatus)
+
+	assert.Equal(t, "projects/test-project/branches/main/roles/primary", config.Resources.PostgresRoles["test_postgres_role"].ID)
+	assert.Empty(t, config.Resources.PostgresRoles["test_postgres_role"].ModifiedStatus)
+	assert.Equal(t, "projects/test-project/branches/main/roles/old", config.Resources.PostgresRoles["test_postgres_role_old"].ID)
+	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.PostgresRoles["test_postgres_role_old"].ModifiedStatus)
+	assert.Empty(t, config.Resources.PostgresRoles["test_postgres_role_new"].ID)
+	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.PostgresRoles["test_postgres_role_new"].ModifiedStatus)
+
 	assert.Equal(t, "vs-endpoint-1", config.Resources.VectorSearchEndpoints["test_vector_search_endpoint"].ID)
-	assert.Equal(t, "", config.Resources.VectorSearchEndpoints["test_vector_search_endpoint"].ModifiedStatus)
+	assert.Empty(t, config.Resources.VectorSearchEndpoints["test_vector_search_endpoint"].ModifiedStatus)
 	assert.Equal(t, "vs-endpoint-old", config.Resources.VectorSearchEndpoints["test_vector_search_endpoint_old"].ID)
 	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.VectorSearchEndpoints["test_vector_search_endpoint_old"].ModifiedStatus)
-	assert.Equal(t, "", config.Resources.VectorSearchEndpoints["test_vector_search_endpoint_new"].ID)
+	assert.Empty(t, config.Resources.VectorSearchEndpoints["test_vector_search_endpoint_new"].ID)
 	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.VectorSearchEndpoints["test_vector_search_endpoint_new"].ModifiedStatus)
 
+	assert.Equal(t, "vs-index-1", config.Resources.VectorSearchIndexes["test_vector_search_index"].ID)
+	assert.Empty(t, config.Resources.VectorSearchIndexes["test_vector_search_index"].ModifiedStatus)
+	assert.Equal(t, "vs-index-old", config.Resources.VectorSearchIndexes["test_vector_search_index_old"].ID)
+	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.VectorSearchIndexes["test_vector_search_index_old"].ModifiedStatus)
+	assert.Empty(t, config.Resources.VectorSearchIndexes["test_vector_search_index_new"].ID)
+	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.VectorSearchIndexes["test_vector_search_index_new"].ModifiedStatus)
+
+	assert.Equal(t, "1", config.Resources.InstancePools["test_instance_pool"].ID)
+	assert.Empty(t, config.Resources.InstancePools["test_instance_pool"].ModifiedStatus)
+	assert.Equal(t, "2", config.Resources.InstancePools["test_instance_pool_old"].ID)
+	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.InstancePools["test_instance_pool_old"].ModifiedStatus)
+	assert.Empty(t, config.Resources.InstancePools["test_instance_pool_new"].ID)
+	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.InstancePools["test_instance_pool_new"].ModifiedStatus)
+
+	assert.Equal(t, "cp-1", config.Resources.ClusterPolicies["test_cluster_policy"].ID)
+	assert.Empty(t, config.Resources.ClusterPolicies["test_cluster_policy"].ModifiedStatus)
+	assert.Equal(t, "cp-2", config.Resources.ClusterPolicies["test_cluster_policy_old"].ID)
+	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.ClusterPolicies["test_cluster_policy_old"].ModifiedStatus)
+	assert.Empty(t, config.Resources.ClusterPolicies["test_cluster_policy_new"].ID)
+	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.ClusterPolicies["test_cluster_policy_new"].ModifiedStatus)
+
+	assert.Equal(t, "main.default.test_model_service", config.Resources.ModelServices["test_model_service"].ID)
+	assert.Empty(t, config.Resources.ModelServices["test_model_service"].ModifiedStatus)
+	assert.Equal(t, "main.default.test_model_service_old", config.Resources.ModelServices["test_model_service_old"].ID)
+	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.ModelServices["test_model_service_old"].ModifiedStatus)
+	assert.Empty(t, config.Resources.ModelServices["test_model_service_new"].ID)
+	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.ModelServices["test_model_service_new"].ModifiedStatus)
+
+	assert.Equal(t, "main.default.test_mcp_service", config.Resources.McpServices["test_mcp_service"].ID)
+	assert.Equal(t, "main.default.test_model_provider_service", config.Resources.ModelProviderServices["test_model_provider_service"].ID)
+	assert.Empty(t, config.Resources.McpServices["test_mcp_service"].ModifiedStatus)
+	assert.Empty(t, config.Resources.ModelProviderServices["test_model_provider_service"].ModifiedStatus)
+	assert.Equal(t, "main.default.test_mcp_service_old", config.Resources.McpServices["test_mcp_service_old"].ID)
+	assert.Equal(t, "main.default.test_model_provider_service_old", config.Resources.ModelProviderServices["test_model_provider_service_old"].ID)
+	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.McpServices["test_mcp_service_old"].ModifiedStatus)
+	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.ModelProviderServices["test_model_provider_service_old"].ModifiedStatus)
+	assert.Empty(t, config.Resources.McpServices["test_mcp_service_new"].ID)
+	assert.Empty(t, config.Resources.ModelProviderServices["test_model_provider_service_new"].ID)
+	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.McpServices["test_mcp_service_new"].ModifiedStatus)
+	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.ModelProviderServices["test_model_provider_service_new"].ModifiedStatus)
+
+	assert.Equal(t, "main.default.test_secret", config.Resources.Secrets["test_secret"].ID)
+	assert.Empty(t, config.Resources.Secrets["test_secret"].ModifiedStatus)
+	assert.Equal(t, "main.default.test_secret_old", config.Resources.Secrets["test_secret_old"].ID)
+	assert.Equal(t, resources.ModifiedStatusDeleted, config.Resources.Secrets["test_secret_old"].ModifiedStatus)
+	assert.Empty(t, config.Resources.Secrets["test_secret_new"].ID)
+	assert.Equal(t, resources.ModifiedStatusCreated, config.Resources.Secrets["test_secret_new"].ModifiedStatus)
+
 	AssertFullResourceCoverage(t, &config)
 }
 
@@ -878,6 +1387,14 @@ func AssertFullResourceCoverage(t *testing.T, config *config.Root) {
 	resources := reflect.ValueOf(config.Resources)
 	for i := range resources.NumField() {
 		field := resources.Field(i)
+		// Get Tag field from reflect.Value
+		tag := resources.Type().Field(i).Tag.Get("bundle")
+		// Internal resources (e.g. internal_immutable_snapshots) are created by the
+		// deploy pipeline, never declared in user config, so this fixture doesn't
+		// populate them and StateToBundle isn't expected to cover them.
+		if tag == "internal" {
+			continue
+		}
 		if field.Kind() == reflect.Map {
 			assert.True(
 				t,
diff --git a/bundle/statemgmt/state_pull.go b/bundle/statemgmt/state_pull.go
index 7e62bb84967..616cd8af197 100644
--- a/bundle/statemgmt/state_pull.go
+++ b/bundle/statemgmt/state_pull.go
@@ -1,6 +1,7 @@
 package statemgmt
 
 import (
+	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
@@ -16,18 +17,23 @@ import (
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/bundle/config/engine"
 	"github.com/databricks/cli/bundle/deploy"
+	"github.com/databricks/cli/libs/atomicfile"
 	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/filer"
 	"github.com/databricks/cli/libs/log"
 	"github.com/databricks/cli/libs/logdiag"
-	"github.com/databricks/databricks-sdk-go/useragent"
+	"github.com/databricks/cli/libs/shortid"
 )
 
 type AlwaysPull bool
 
+// zipMagic starts every ZIP archive; a state file is JSON and never does.
+var zipMagic = []byte("PK\x03\x04")
+
 type StateDesc struct {
-	Serial  int    `json:"serial"`
-	Lineage string `json:"lineage"`
+	Serial   int                 `json:"serial"`
+	Lineage  string              `json:"lineage"`
+	Features map[string]struct{} `json:"features,omitempty"`
 
 	// additional fields describing state:
 	SourcePath string
@@ -47,6 +53,15 @@ func (s *StateDesc) String() string {
 	return fmt.Sprintf("%s: %s %s state serial=%d lineage=%q", s.SourcePath, source, s.Engine, s.Serial, s.Lineage)
 }
 
+// LineageHash returns the lineage in the compact form reported in the user agent
+// and telemetry, or "" when the state has no lineage yet (nothing deployed).
+func (s *StateDesc) LineageHash() string {
+	if s.Lineage == "" {
+		return ""
+	}
+	return shortid.Hash(s.Lineage)
+}
+
 func (s *StateDesc) HasRemoteTerraformState() bool {
 	for _, s := range s.AllStates {
 		if !s.Engine.IsDirect() && !s.IsLocal {
@@ -56,6 +71,12 @@ func (s *StateDesc) HasRemoteTerraformState() bool {
 	return false
 }
 
+// IsDMS reports whether the state records deployment history in the deployment metadata service.
+func (s *StateDesc) IsDMS() bool {
+	_, ok := s.Features["deployment_history"]
+	return ok
+}
+
 func localRead(ctx context.Context, fullPath string, engine engine.EngineType) *StateDesc {
 	content, err := os.ReadFile(fullPath)
 	if err != nil {
@@ -96,6 +117,11 @@ func _filerRead(ctx context.Context, f filer.Filer, path string) (*StateDesc, er
 	state := &StateDesc{}
 	err = json.Unmarshal(content, state)
 	if err != nil {
+		// The workspace exports a directory as a ZIP archive rather than failing, so a directory
+		// at the state path reads fine and only shows up here.
+		if bytes.HasPrefix(content, zipMagic) {
+			return nil, errors.New("not a file: the workspace has a directory at this path")
+		}
 		return nil, fmt.Errorf("parsing state: %w", err)
 	}
 
@@ -118,27 +144,25 @@ func filerRead(ctx context.Context, f filer.Filer, path string, engine engine.En
 }
 
 // PullResourcesState determines correct state to use by reading all 4 states (terraform/direct, local/remote).
-// If state is present and the requested engine disagrees, a warning is issued and the state's engine is used.
-func PullResourcesState(ctx context.Context, b *bundle.Bundle, alwaysPull AlwaysPull, requiredEngine engine.EngineSetting) (context.Context, *StateDesc) {
+func PullResourcesState(ctx context.Context, b *bundle.Bundle, alwaysPull AlwaysPull) *StateDesc {
 	var err error
 
-	// We read all 4 possible states: terraform/direct X local/remote and then use env var to validate that correct one is used.
-	// However, states and env var cannot disagree.
+	// We read all 4 possible states: terraform/direct X local/remote and pick the most recent one.
 	_, localPathDirect := b.StateFilenameDirect(ctx)
 	_, localPathTerraform := b.StateFilenameTerraform(ctx)
 
 	states := readStates(ctx, b, alwaysPull)
 
 	if logdiag.HasError(ctx) {
-		return ctx, nil
+		return nil
 	}
 
 	var winner *StateDesc
 
 	if len(states) == 0 {
 		winner = &StateDesc{
-			// No state, go with user-provided or default
-			Engine:  requiredEngine.Type.ThisOrDefault(),
+			// No state: a new deployment uses the direct engine.
+			Engine:  engine.EngineDirect,
 			IsLocal: true,
 			// Lineage and Serial are empty
 		}
@@ -152,31 +176,16 @@ func PullResourcesState(ctx context.Context, b *bundle.Bundle, alwaysPull Always
 	err = validateStates(states)
 	if err != nil {
 		logStatesError(ctx, err.Error(), states)
-		return ctx, winner
-	}
-
-	if requiredEngine.Type != engine.EngineNotSet && requiredEngine.Type != winner.Engine {
-		msg := fmt.Sprintf("Deployment engine %q configured in %s does not match the existing state (engine %q). Using %q engine from the existing state.", requiredEngine.Type, requiredEngine.Source, winner.Engine, winner.Engine)
-		// Warn only when the config also disagrees with the state. If the env var overrides
-		// a config that matches the state, log at info level to avoid noise.
-		if requiredEngine.ConfigType != engine.EngineNotSet && requiredEngine.ConfigType != winner.Engine {
-			logStatesWarning(ctx, msg, states)
-		} else {
-			log.Infof(ctx, "%s", msg)
-		}
+		return winner
 	}
 
-	// Set the engine in the user agent
-	// XXX move this outside this function to bundle/config/engine
-	ctx = useragent.InContext(ctx, "engine", string(winner.Engine))
-
 	if len(states) == 0 {
-		return ctx, winner
+		return winner
 	}
 
 	if winner.IsLocal {
 		// local state is fresh, nothing to do
-		return ctx, winner
+		return winner
 	}
 
 	if !winner.IsLocal {
@@ -187,23 +196,14 @@ func PullResourcesState(ctx context.Context, b *bundle.Bundle, alwaysPull Always
 			localStatePath = localPathDirect
 		}
 
-		localStateDir := filepath.Dir(localStatePath)
-
-		err := os.MkdirAll(localStateDir, 0o700)
-		if err != nil {
-			logdiag.LogError(ctx, err)
-			return ctx, winner
-		}
-
-		// TODO: write + rename
-		err = os.WriteFile(localStatePath, winner.Content, 0o600)
+		err := atomicfile.Write(localStatePath, winner.Content, 0o600, atomicfile.MkDir(0o700))
 		if err != nil {
 			logdiag.LogError(ctx, err)
-			return ctx, winner
+			return winner
 		}
 	}
 
-	return ctx, winner
+	return winner
 }
 
 func readStates(ctx context.Context, b *bundle.Bundle, alwaysPull AlwaysPull) []*StateDesc {
@@ -290,10 +290,6 @@ func logStatesError(ctx context.Context, msg string, states []*StateDesc) {
 	logStatesDiag(ctx, diag.Error, msg, states)
 }
 
-func logStatesWarning(ctx context.Context, msg string, states []*StateDesc) {
-	logStatesDiag(ctx, diag.Warning, msg, states)
-}
-
 func logStatesDiag(ctx context.Context, severity diag.Severity, msg string, states []*StateDesc) {
 	var stateStrs []string
 	for _, state := range states {
diff --git a/bundle/statemgmt/state_push.go b/bundle/statemgmt/state_push.go
index f098e8a07cc..03036ba712d 100644
--- a/bundle/statemgmt/state_push.go
+++ b/bundle/statemgmt/state_push.go
@@ -7,34 +7,26 @@ import (
 	"os"
 
 	"github.com/databricks/cli/bundle"
-	"github.com/databricks/cli/bundle/config/engine"
 	"github.com/databricks/cli/bundle/deploy"
-	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/filer"
 	"github.com/databricks/cli/libs/log"
 	"github.com/databricks/cli/libs/logdiag"
 )
 
 // PushResourcesState uploads the local state file to the remote location.
-func PushResourcesState(ctx context.Context, b *bundle.Bundle, engine engine.EngineType) {
+func PushResourcesState(ctx context.Context, b *bundle.Bundle) {
 	f, err := deploy.StateFiler(ctx, b)
 	if err != nil {
 		logdiag.LogError(ctx, err)
 		return
 	}
 
-	var remotePath, localPath string
-
-	if engine.IsDirect() {
-		remotePath, localPath = b.StateFilenameDirect(ctx)
-	} else {
-		remotePath, localPath = b.StateFilenameTerraform(ctx)
-	}
+	remotePath, localPath := b.StateFilenameDirect(ctx)
 
 	local, err := os.Open(localPath)
 	if errors.Is(err, fs.ErrNotExist) {
-		// The state file can be absent if terraform apply is skipped because
-		// there are no changes to apply in the plan.
+		// The state file can be absent if the deploy made no changes
+		// that needed to be recorded.
 		log.Debugf(ctx, "Local state file does not exist: %s", localPath)
 		return
 	}
@@ -45,7 +37,6 @@ func PushResourcesState(ctx context.Context, b *bundle.Bundle, engine engine.Eng
 	defer local.Close()
 
 	// Upload state file from local cache directory to filer.
-	cmdio.LogString(ctx, "Updating deployment state...")
 	err = f.Write(ctx, remotePath, local, filer.CreateParentDirectories, filer.OverwriteIfExists)
 	if err != nil {
 		logdiag.LogError(ctx, err)
@@ -72,7 +63,7 @@ func BackupRemoteTerraformState(ctx context.Context, b *bundle.Bundle) {
 	}
 
 	backupPath := remotePath + ".backup"
-	err = f.Write(ctx, backupPath, reader)
+	err = f.Write(ctx, backupPath, reader, filer.OverwriteIfExists)
 	if err != nil {
 		log.Warnf(ctx, "backing up terraform state: could not write %s: %s", backupPath, err)
 		return
diff --git a/bundle/statemgmt/upload_state_for_yaml_sync.go b/bundle/statemgmt/upload_state_for_yaml_sync.go
deleted file mode 100644
index 74def3174f8..00000000000
--- a/bundle/statemgmt/upload_state_for_yaml_sync.go
+++ /dev/null
@@ -1,234 +0,0 @@
-package statemgmt
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io/fs"
-	"os"
-
-	"github.com/databricks/cli/bundle"
-	"github.com/databricks/cli/bundle/config"
-	"github.com/databricks/cli/bundle/config/engine"
-	"github.com/databricks/cli/bundle/config/mutator/resourcemutator"
-	"github.com/databricks/cli/bundle/deploy"
-	"github.com/databricks/cli/bundle/deploy/terraform"
-	"github.com/databricks/cli/bundle/deployplan"
-	"github.com/databricks/cli/bundle/direct"
-	"github.com/databricks/cli/bundle/direct/dstate"
-	"github.com/databricks/cli/bundle/env"
-	"github.com/databricks/cli/libs/diag"
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/dynvar"
-	"github.com/databricks/cli/libs/filer"
-	"github.com/databricks/cli/libs/log"
-	"github.com/databricks/cli/libs/logdiag"
-	"github.com/databricks/cli/libs/structs/structaccess"
-	"github.com/databricks/cli/libs/structs/structpath"
-)
-
-type uploadStateForYamlSync struct {
-	engine engine.EngineType
-}
-
-// UploadStateForYamlSync converts the state to the direct format for YAML sync and uploads it to the Workspace.
-// This is simplified version of the `bundle migrate` command.
-// State file is saved in the same format as the direct engine but to the different path to avoid any side effects.
-// This is temporary solution that needs to be removed once all bundles in DABs in the Workspace are migrated to the direct engine.
-func UploadStateForYamlSync(targetEngine engine.EngineType) bundle.Mutator {
-	return &uploadStateForYamlSync{engine: targetEngine}
-}
-
-func (m *uploadStateForYamlSync) Name() string {
-	return "statemgmt.UploadStateForYamlSync"
-}
-
-func (m *uploadStateForYamlSync) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
-	if m.engine.IsDirect() {
-		return nil
-	}
-
-	_, enabled := env.ExperimentalYamlSync(ctx)
-	if !enabled {
-		return nil
-	}
-
-	_, snapshotPath := b.StateFilenameConfigSnapshot(ctx)
-
-	created, err := m.convertState(ctx, b, snapshotPath)
-	if err != nil {
-		log.Warnf(ctx, "Failed to create config snapshot: %v", err)
-		return nil
-	}
-	if !created {
-		return nil
-	}
-
-	err = uploadState(ctx, b)
-	if err != nil {
-		log.Warnf(ctx, "Failed to upload config snapshot: %v", err)
-		return nil
-	}
-
-	log.Infof(ctx, "Config snapshot created at %s", snapshotPath)
-	return nil
-}
-
-func uploadState(ctx context.Context, b *bundle.Bundle) error {
-	f, err := deploy.StateFiler(ctx, b)
-	if err != nil {
-		return fmt.Errorf("failed to get state filer: %w", err)
-	}
-
-	remotePath, localPath := b.StateFilenameConfigSnapshot(ctx)
-	local, err := os.Open(localPath)
-	if errors.Is(err, fs.ErrNotExist) {
-		return fmt.Errorf("config snapshot file does not exist at %s", localPath)
-	}
-	if err != nil {
-		return fmt.Errorf("failed to open config snapshot for upload: %w", err)
-	}
-	defer local.Close()
-
-	err = f.Write(ctx, remotePath, local, filer.CreateParentDirectories, filer.OverwriteIfExists)
-	if err != nil {
-		return fmt.Errorf("failed to upload config snapshot to workspace: %w", err)
-	}
-
-	return nil
-}
-
-func (m *uploadStateForYamlSync) convertState(ctx context.Context, b *bundle.Bundle, snapshotPath string) (bool, error) {
-	terraformResources, err := terraform.ParseResourcesState(ctx, b)
-	if err != nil {
-		return false, fmt.Errorf("failed to parse terraform state: %w", err)
-	}
-
-	// ParseResourcesState returns nil when the terraform state file doesn't exist
-	// (e.g. first deploy with no resources).
-	if terraformResources == nil {
-		return false, nil
-	}
-
-	_, localTerraformPath := b.StateFilenameTerraform(ctx)
-	data, err := os.ReadFile(localTerraformPath)
-	if err != nil {
-		return false, fmt.Errorf("failed to read terraform state: %w", err)
-	}
-
-	state := make(map[string]dstate.ResourceEntry)
-	etags := map[string]string{}
-
-	for key, resourceEntry := range terraformResources {
-		state[key] = dstate.ResourceEntry{
-			ID:    resourceEntry.ID,
-			State: json.RawMessage("{}"),
-		}
-		if resourceEntry.ETag != "" {
-			etags[key] = resourceEntry.ETag
-		}
-	}
-
-	var tfState struct {
-		Lineage string `json:"lineage"`
-		Serial  int    `json:"serial"`
-	}
-	if err := json.Unmarshal(data, &tfState); err != nil {
-		return false, err
-	}
-
-	migratedDB := dstate.NewDatabase(tfState.Lineage, tfState.Serial+1)
-	migratedDB.State = state
-
-	deploymentBundle := &direct.DeploymentBundle{
-		StateDB: dstate.DeploymentState{
-			Path: snapshotPath,
-			Data: migratedDB,
-		},
-	}
-
-	// Apply SecretScopeFixups so the config matches what the direct engine expects.
-	// This adds MANAGE ACL for the current user to all secret scopes, ensuring
-	// the migrated state and config agree on .permissions entries.
-	bundle.ApplyContext(ctx, b, resourcemutator.SecretScopeFixups(engine.EngineDirect))
-	if logdiag.HasError(ctx) {
-		return false, errors.New("failed to apply secret scope fixups")
-	}
-
-	// Get the dynamic value from b.Config and reverse the interpolation.
-	// b.Config has been modified by terraform.Interpolate which converts bundle-style
-	// references (${resources.pipelines.x.id}) to terraform-style (${databricks_pipeline.x.id}).
-	interpolatedRoot := b.Config.Value()
-	uninterpolatedRoot, err := reverseInterpolate(interpolatedRoot)
-	if err != nil {
-		return false, fmt.Errorf("failed to reverse interpolation: %w", err)
-	}
-
-	var uninterpolatedConfig config.Root
-	err = uninterpolatedConfig.Mutate(func(_ dyn.Value) (dyn.Value, error) {
-		return uninterpolatedRoot, nil
-	})
-	if err != nil {
-		return false, fmt.Errorf("failed to create uninterpolated config: %w", err)
-	}
-
-	plan, err := deploymentBundle.CalculatePlan(ctx, b.WorkspaceClient(ctx), &uninterpolatedConfig)
-	if err != nil {
-		return false, err
-	}
-
-	for _, entry := range plan.Plan {
-		entry.Action = deployplan.Update
-	}
-
-	for key := range plan.Plan {
-		etag := etags[key]
-		if etag == "" {
-			continue
-		}
-		sv, ok := deploymentBundle.StateCache.Load(key)
-		if !ok {
-			continue
-		}
-		err := structaccess.Set(sv.Value, structpath.NewStringKey(nil, "etag"), etag)
-		if err != nil {
-			log.Warnf(ctx, "Failed to set etag on %q: %v", key, err)
-		}
-	}
-
-	deploymentBundle.Apply(ctx, b.WorkspaceClient(ctx), plan, direct.MigrateMode(true))
-	if err := deploymentBundle.StateDB.Finalize(); err != nil {
-		return false, err
-	}
-
-	return true, nil
-}
-
-// reverseInterpolate reverses the terraform.Interpolate transformation.
-// It converts terraform-style resource references back to bundle-style.
-// Example: ${databricks_pipeline.my_etl.id} → ${resources.pipelines.my_etl.id}
-func reverseInterpolate(root dyn.Value) (dyn.Value, error) {
-	return dynvar.Resolve(root, func(path dyn.Path) (dyn.Value, error) {
-		// Need at least 2 components: resource_type.resource_name
-		if len(path) < 2 {
-			return dyn.InvalidValue, dynvar.ErrSkipResolution
-		}
-
-		resourceType := path[0].Key()
-		isAlreadyBundleFormat := resourceType == "resources"
-		if isAlreadyBundleFormat {
-			return dyn.InvalidValue, dynvar.ErrSkipResolution
-		}
-
-		bundleGroup, ok := terraform.TerraformToGroupName[resourceType]
-		if !ok {
-			return dyn.InvalidValue, dynvar.ErrSkipResolution
-		}
-
-		// Reconstruct path in bundle format:
-		// databricks_pipeline.my_pipeline.id → resources.pipelines.my_pipeline.id
-		bundlePath := dyn.NewPath(dyn.Key("resources"), dyn.Key(bundleGroup)).Append(path[1:]...)
-		return dyn.V(fmt.Sprintf("${%s}", bundlePath.String())), nil
-	})
-}
diff --git a/bundle/terraform_dabs_map/generated.go b/bundle/terraform_dabs_map/generated.go
new file mode 100644
index 00000000000..30d61163258
--- /dev/null
+++ b/bundle/terraform_dabs_map/generated.go
@@ -0,0 +1,724 @@
+// Code generated from the Databricks Terraform provider 1.134.0 schema; DO NOT EDIT.
+//
+// The generator was removed together with the terraform engine. This snapshot
+// is frozen: it maps fields of existing terraform state for the state migration.
+
+package terraform_dabs_map
+
+// alerts / databricks_alert_v2: 1 dabs-only
+// alerts / databricks_alert_v2: 3 tf-only
+// apps / databricks_app: 6 dabs-only
+// apps / databricks_app: 1 tf-only
+// clusters / databricks_cluster: 1 renames
+// clusters / databricks_cluster: 11 tf-only
+// dashboards / databricks_dashboard: 2 tf-only
+// database_instances / databricks_database_instance: 1 tf-only
+// experiments / databricks_mlflow_experiment: 1 tf-only
+// jobs / databricks_job: 11 renames
+// jobs / databricks_job: 34 dabs-only
+// jobs / databricks_job: 261 tf-only
+// model_serving_endpoints / databricks_model_serving: 2 tf-only
+// models / databricks_mlflow_model: 1 renames
+// pipelines / databricks_pipeline: 3 renames
+// pipelines / databricks_pipeline: 6 dabs-only
+// pipelines / databricks_pipeline: 2 tf-only
+// postgres_branches / databricks_postgres_branch: 1 unwraps
+// postgres_catalogs / databricks_postgres_catalog: 1 unwraps
+// postgres_databases / databricks_postgres_database: 1 unwraps
+// postgres_endpoints / databricks_postgres_endpoint: 1 unwraps
+// postgres_projects / databricks_postgres_project: 2 tf-only
+// postgres_projects / databricks_postgres_project: 1 unwraps
+// postgres_roles / databricks_postgres_role: 1 unwraps
+// postgres_synced_tables / databricks_postgres_synced_table: 1 unwraps
+// schemas / databricks_schema: 1 dabs-only
+// schemas / databricks_schema: 1 tf-only
+// secret_scopes / databricks_secret_scope: 1 tf-only
+// sql_warehouses / databricks_sql_endpoint: 2 tf-only
+
+// TerraformToDABsFieldMap maps DABs group name → nested TF segments → DABs segment name.
+// Navigate using TF field name segments; DABs is the corresponding DABs name when it differs.
+var TerraformToDABsFieldMap = map[string]RenameTree{
+	"clusters": {
+		"library": {NewName: "libraries"},
+	},
+	"jobs": {
+		"environment": {NewName: "environments"},
+		"git_source": {Children: RenameTree{
+			"branch":   {NewName: "git_branch"},
+			"commit":   {NewName: "git_commit"},
+			"provider": {NewName: "git_provider"},
+			"tag":      {NewName: "git_tag"},
+			"url":      {NewName: "git_url"},
+		}},
+		"job_cluster": {NewName: "job_clusters"},
+		"parameter":   {NewName: "parameters"},
+		"task": {NewName: "tasks", Children: RenameTree{
+			"for_each_task": {Children: RenameTree{
+				"task": {Children: RenameTree{
+					"library": {NewName: "libraries"},
+				}},
+			}},
+			"library": {NewName: "libraries"},
+		}},
+	},
+	"models": {
+		"registered_model_id": {NewName: "model_id"},
+	},
+	"pipelines": {
+		"cluster":      {NewName: "clusters"},
+		"library":      {NewName: "libraries"},
+		"notification": {NewName: "notifications"},
+	},
+	"postgres_branches": {
+		"spec": {Unwrap: true},
+	},
+	"postgres_catalogs": {
+		"spec": {Unwrap: true},
+	},
+	"postgres_databases": {
+		"spec": {Unwrap: true},
+	},
+	"postgres_endpoints": {
+		"spec": {Unwrap: true},
+	},
+	"postgres_projects": {
+		"spec": {Unwrap: true},
+	},
+	"postgres_roles": {
+		"spec": {Unwrap: true},
+	},
+	"postgres_synced_tables": {
+		"spec": {Unwrap: true},
+	},
+}
+
+// DABsOnlyFields maps DABs group name → FieldSet of DABs fields with no TF equivalent.
+var DABsOnlyFields = map[string]FieldSet{
+	"alerts": {
+		"file_path": {},
+	},
+	"apps": {
+		"config": {
+			"command": {}, // apps.*.config.command
+			"env": {
+				"name":       {}, // apps.*.config.env.name
+				"value":      {}, // apps.*.config.env.value
+				"value_from": {}, // apps.*.config.env.value_from
+			},
+		},
+	},
+	"jobs": {
+		"email_notifications": {
+			"on_maintenance_complete": {}, // jobs.*.email_notifications.on_maintenance_complete
+			"on_maintenance_start":    {}, // jobs.*.email_notifications.on_maintenance_start
+		},
+		"environment_variables": {
+			"environment_variables_key": {}, // jobs.*.environment_variables.environment_variables_key
+			"spec": {
+				"files": {}, // jobs.*.environment_variables.spec.files
+				"variables": {
+					"*": {}, // jobs.*.environment_variables.spec.variables.*
+				},
+			},
+		},
+		"environments": {
+			"spec": {
+				"project_environment": {}, // jobs.*.environments.spec.project_environment
+			},
+		},
+		"job_clusters": {
+			"new_cluster": {
+				"autotermination_minutes": {}, // jobs.*.job_clusters.new_cluster.autotermination_minutes
+			},
+		},
+		"tasks": {
+			"email_notifications": {
+				"on_maintenance_complete": {}, // jobs.*.tasks.email_notifications.on_maintenance_complete
+				"on_maintenance_start":    {}, // jobs.*.tasks.email_notifications.on_maintenance_start
+			},
+			"environment_variables_key": {}, // jobs.*.tasks.environment_variables_key
+			"for_each_task": {
+				"task": {
+					"email_notifications": {
+						"on_maintenance_complete": {}, // jobs.*.tasks.for_each_task.task.email_notifications.on_maintenance_complete
+						"on_maintenance_start":    {}, // jobs.*.tasks.for_each_task.task.email_notifications.on_maintenance_start
+					},
+					"environment_variables_key": {}, // jobs.*.tasks.for_each_task.task.environment_variables_key
+					"for_each_task": {
+						"concurrency": {}, // jobs.*.tasks.for_each_task.task.for_each_task.concurrency
+						"inputs":      {}, // jobs.*.tasks.for_each_task.task.for_each_task.inputs
+						"task":        {}, // jobs.*.tasks.for_each_task.task.for_each_task.task
+					},
+					"new_cluster": {
+						"autotermination_minutes": {}, // jobs.*.tasks.for_each_task.task.new_cluster.autotermination_minutes
+					},
+					"webhook_notifications": {
+						"on_maintenance_complete": {
+							"id": {}, // jobs.*.tasks.for_each_task.task.webhook_notifications.on_maintenance_complete.id
+						},
+						"on_maintenance_start": {
+							"id": {}, // jobs.*.tasks.for_each_task.task.webhook_notifications.on_maintenance_start.id
+						},
+					},
+				},
+			},
+			"new_cluster": {
+				"autotermination_minutes": {}, // jobs.*.tasks.new_cluster.autotermination_minutes
+			},
+			"webhook_notifications": {
+				"on_maintenance_complete": {
+					"id": {}, // jobs.*.tasks.webhook_notifications.on_maintenance_complete.id
+				},
+				"on_maintenance_start": {
+					"id": {}, // jobs.*.tasks.webhook_notifications.on_maintenance_start.id
+				},
+			},
+		},
+		"webhook_notifications": {
+			"on_maintenance_complete": {
+				"id": {}, // jobs.*.webhook_notifications.on_maintenance_complete.id
+			},
+			"on_maintenance_start": {
+				"id": {}, // jobs.*.webhook_notifications.on_maintenance_start.id
+			},
+		},
+	},
+	"pipelines": {
+		"cascade_on_destroy": {},
+		"clusters": {
+			"gcp_attributes": {
+				"boot_disk_size":            {}, // pipelines.*.clusters.gcp_attributes.boot_disk_size
+				"use_preemptible_executors": {}, // pipelines.*.clusters.gcp_attributes.use_preemptible_executors
+			},
+		},
+		"dry_run": {},
+		"parameters": {
+			"*": {}, // pipelines.*.parameters.*
+		},
+	},
+	"schemas": {
+		"custom_max_retention_hours": {},
+	},
+}
+
+// TerraformOnlyFields maps DABs group name → FieldSet of TF fields with no DABs equivalent.
+var TerraformOnlyFields = map[string]FieldSet{
+	"alerts": {
+		"evaluation": {
+			"notification": {
+				"effective_notify_on_ok":      {}, // databricks_alert_v2.*.evaluation.notification.effective_notify_on_ok
+				"effective_retrigger_seconds": {}, // databricks_alert_v2.*.evaluation.notification.effective_retrigger_seconds
+			},
+		},
+		"purge_on_delete": {},
+	},
+	"apps": {
+		"no_compute": {},
+	},
+	"clusters": {
+		"clear_cloud_attributes_on_remove": {},
+		"cluster_mount_info": {
+			"local_mount_dir_path": {}, // databricks_cluster.*.cluster_mount_info.local_mount_dir_path
+			"network_filesystem_info": {
+				"mount_options":  {}, // databricks_cluster.*.cluster_mount_info.network_filesystem_info.mount_options
+				"server_address": {}, // databricks_cluster.*.cluster_mount_info.network_filesystem_info.server_address
+			},
+			"remote_mount_dir_path": {}, // databricks_cluster.*.cluster_mount_info.remote_mount_dir_path
+		},
+		"idempotency_token": {},
+		"is_pinned":         {},
+		"no_wait":           {},
+		"url":               {},
+	},
+	"dashboards": {
+		"dashboard_change_detected": {},
+		"md5":                       {},
+	},
+	"database_instances": {
+		"purge_on_delete": {},
+	},
+	"experiments": {
+		"description": {},
+	},
+	"jobs": {
+		"always_running":    {},
+		"control_run_state": {},
+		"dbt_task": {
+			"catalog":            {}, // databricks_job.*.dbt_task.catalog
+			"commands":           {}, // databricks_job.*.dbt_task.commands
+			"profiles_directory": {}, // databricks_job.*.dbt_task.profiles_directory
+			"project_directory":  {}, // databricks_job.*.dbt_task.project_directory
+			"schema":             {}, // databricks_job.*.dbt_task.schema
+			"source":             {}, // databricks_job.*.dbt_task.source
+			"warehouse_id":       {}, // databricks_job.*.dbt_task.warehouse_id
+		},
+		"existing_cluster_id": {},
+		"job_cluster": {
+			"new_cluster": {
+				"__apply_policy_default_values_allow_list": {}, // databricks_job.*.job_cluster.new_cluster.__apply_policy_default_values_allow_list
+				"cluster_id": {}, // databricks_job.*.job_cluster.new_cluster.cluster_id
+				"cluster_mount_info": {
+					"local_mount_dir_path": {}, // databricks_job.*.job_cluster.new_cluster.cluster_mount_info.local_mount_dir_path
+					"network_filesystem_info": {
+						"mount_options":  {}, // databricks_job.*.job_cluster.new_cluster.cluster_mount_info.network_filesystem_info.mount_options
+						"server_address": {}, // databricks_job.*.job_cluster.new_cluster.cluster_mount_info.network_filesystem_info.server_address
+					},
+					"remote_mount_dir_path": {}, // databricks_job.*.job_cluster.new_cluster.cluster_mount_info.remote_mount_dir_path
+				},
+				"idempotency_token": {}, // databricks_job.*.job_cluster.new_cluster.idempotency_token
+				"library": {
+					"cran": {
+						"package": {}, // databricks_job.*.job_cluster.new_cluster.library.cran.package
+						"repo":    {}, // databricks_job.*.job_cluster.new_cluster.library.cran.repo
+					},
+					"egg": {}, // databricks_job.*.job_cluster.new_cluster.library.egg
+					"jar": {}, // databricks_job.*.job_cluster.new_cluster.library.jar
+					"maven": {
+						"coordinates": {}, // databricks_job.*.job_cluster.new_cluster.library.maven.coordinates
+						"exclusions":  {}, // databricks_job.*.job_cluster.new_cluster.library.maven.exclusions
+						"repo":        {}, // databricks_job.*.job_cluster.new_cluster.library.maven.repo
+					},
+					"pypi": {
+						"package": {}, // databricks_job.*.job_cluster.new_cluster.library.pypi.package
+						"repo":    {}, // databricks_job.*.job_cluster.new_cluster.library.pypi.repo
+					},
+					"requirements": {}, // databricks_job.*.job_cluster.new_cluster.library.requirements
+					"whl":          {}, // databricks_job.*.job_cluster.new_cluster.library.whl
+				},
+			},
+		},
+		"library": {
+			"cran": {
+				"package": {}, // databricks_job.*.library.cran.package
+				"repo":    {}, // databricks_job.*.library.cran.repo
+			},
+			"egg": {}, // databricks_job.*.library.egg
+			"jar": {}, // databricks_job.*.library.jar
+			"maven": {
+				"coordinates": {}, // databricks_job.*.library.maven.coordinates
+				"exclusions":  {}, // databricks_job.*.library.maven.exclusions
+				"repo":        {}, // databricks_job.*.library.maven.repo
+			},
+			"pypi": {
+				"package": {}, // databricks_job.*.library.pypi.package
+				"repo":    {}, // databricks_job.*.library.pypi.repo
+			},
+			"requirements": {}, // databricks_job.*.library.requirements
+			"whl":          {}, // databricks_job.*.library.whl
+		},
+		"max_retries":               {},
+		"min_retry_interval_millis": {},
+		"new_cluster": {
+			"apply_policy_default_values": {}, // databricks_job.*.new_cluster.apply_policy_default_values
+			"autoscale": {
+				"max_workers": {}, // databricks_job.*.new_cluster.autoscale.max_workers
+				"min_workers": {}, // databricks_job.*.new_cluster.autoscale.min_workers
+			},
+			"aws_attributes": {
+				"availability":           {}, // databricks_job.*.new_cluster.aws_attributes.availability
+				"ebs_volume_count":       {}, // databricks_job.*.new_cluster.aws_attributes.ebs_volume_count
+				"ebs_volume_iops":        {}, // databricks_job.*.new_cluster.aws_attributes.ebs_volume_iops
+				"ebs_volume_size":        {}, // databricks_job.*.new_cluster.aws_attributes.ebs_volume_size
+				"ebs_volume_throughput":  {}, // databricks_job.*.new_cluster.aws_attributes.ebs_volume_throughput
+				"ebs_volume_type":        {}, // databricks_job.*.new_cluster.aws_attributes.ebs_volume_type
+				"first_on_demand":        {}, // databricks_job.*.new_cluster.aws_attributes.first_on_demand
+				"instance_profile_arn":   {}, // databricks_job.*.new_cluster.aws_attributes.instance_profile_arn
+				"spot_bid_price_percent": {}, // databricks_job.*.new_cluster.aws_attributes.spot_bid_price_percent
+				"zone_id":                {}, // databricks_job.*.new_cluster.aws_attributes.zone_id
+			},
+			"azure_attributes": {
+				"availability":               {}, // databricks_job.*.new_cluster.azure_attributes.availability
+				"capacity_reservation_group": {}, // databricks_job.*.new_cluster.azure_attributes.capacity_reservation_group
+				"first_on_demand":            {}, // databricks_job.*.new_cluster.azure_attributes.first_on_demand
+				"log_analytics_info": {
+					"log_analytics_primary_key":  {}, // databricks_job.*.new_cluster.azure_attributes.log_analytics_info.log_analytics_primary_key
+					"log_analytics_workspace_id": {}, // databricks_job.*.new_cluster.azure_attributes.log_analytics_info.log_analytics_workspace_id
+				},
+				"spot_bid_max_price": {}, // databricks_job.*.new_cluster.azure_attributes.spot_bid_max_price
+			},
+			"cluster_id": {}, // databricks_job.*.new_cluster.cluster_id
+			"cluster_log_conf": {
+				"dbfs": {
+					"destination": {}, // databricks_job.*.new_cluster.cluster_log_conf.dbfs.destination
+				},
+				"s3": {
+					"canned_acl":        {}, // databricks_job.*.new_cluster.cluster_log_conf.s3.canned_acl
+					"destination":       {}, // databricks_job.*.new_cluster.cluster_log_conf.s3.destination
+					"enable_encryption": {}, // databricks_job.*.new_cluster.cluster_log_conf.s3.enable_encryption
+					"encryption_type":   {}, // databricks_job.*.new_cluster.cluster_log_conf.s3.encryption_type
+					"endpoint":          {}, // databricks_job.*.new_cluster.cluster_log_conf.s3.endpoint
+					"kms_key":           {}, // databricks_job.*.new_cluster.cluster_log_conf.s3.kms_key
+					"region":            {}, // databricks_job.*.new_cluster.cluster_log_conf.s3.region
+				},
+				"volumes": {
+					"destination": {}, // databricks_job.*.new_cluster.cluster_log_conf.volumes.destination
+				},
+			},
+			"cluster_mount_info": {
+				"local_mount_dir_path": {}, // databricks_job.*.new_cluster.cluster_mount_info.local_mount_dir_path
+				"network_filesystem_info": {
+					"mount_options":  {}, // databricks_job.*.new_cluster.cluster_mount_info.network_filesystem_info.mount_options
+					"server_address": {}, // databricks_job.*.new_cluster.cluster_mount_info.network_filesystem_info.server_address
+				},
+				"remote_mount_dir_path": {}, // databricks_job.*.new_cluster.cluster_mount_info.remote_mount_dir_path
+			},
+			"cluster_name": {}, // databricks_job.*.new_cluster.cluster_name
+			"custom_tags": {
+				"*": {}, // databricks_job.*.new_cluster.custom_tags.*
+			},
+			"data_security_mode": {}, // databricks_job.*.new_cluster.data_security_mode
+			"dependency_mode":    {}, // databricks_job.*.new_cluster.dependency_mode
+			"docker_image": {
+				"basic_auth": {
+					"password": {}, // databricks_job.*.new_cluster.docker_image.basic_auth.password
+					"username": {}, // databricks_job.*.new_cluster.docker_image.basic_auth.username
+				},
+				"url": {}, // databricks_job.*.new_cluster.docker_image.url
+			},
+			"driver_instance_pool_id": {}, // databricks_job.*.new_cluster.driver_instance_pool_id
+			"driver_node_type_flexibility": {
+				"alternate_node_type_ids": {}, // databricks_job.*.new_cluster.driver_node_type_flexibility.alternate_node_type_ids
+				"aws_context_id":          {}, // databricks_job.*.new_cluster.driver_node_type_flexibility.aws_context_id
+			},
+			"driver_node_type_id":          {}, // databricks_job.*.new_cluster.driver_node_type_id
+			"enable_elastic_disk":          {}, // databricks_job.*.new_cluster.enable_elastic_disk
+			"enable_local_disk_encryption": {}, // databricks_job.*.new_cluster.enable_local_disk_encryption
+			"gcp_attributes": {
+				"availability":              {}, // databricks_job.*.new_cluster.gcp_attributes.availability
+				"boot_disk_size":            {}, // databricks_job.*.new_cluster.gcp_attributes.boot_disk_size
+				"confidential_compute_type": {}, // databricks_job.*.new_cluster.gcp_attributes.confidential_compute_type
+				"first_on_demand":           {}, // databricks_job.*.new_cluster.gcp_attributes.first_on_demand
+				"google_service_account":    {}, // databricks_job.*.new_cluster.gcp_attributes.google_service_account
+				"local_ssd_count":           {}, // databricks_job.*.new_cluster.gcp_attributes.local_ssd_count
+				"use_preemptible_executors": {}, // databricks_job.*.new_cluster.gcp_attributes.use_preemptible_executors
+				"zone_id":                   {}, // databricks_job.*.new_cluster.gcp_attributes.zone_id
+			},
+			"idempotency_token": {}, // databricks_job.*.new_cluster.idempotency_token
+			"init_scripts": {
+				"abfss": {
+					"destination": {}, // databricks_job.*.new_cluster.init_scripts.abfss.destination
+				},
+				"dbfs": {
+					"destination": {}, // databricks_job.*.new_cluster.init_scripts.dbfs.destination
+				},
+				"file": {
+					"destination": {}, // databricks_job.*.new_cluster.init_scripts.file.destination
+				},
+				"gcs": {
+					"destination": {}, // databricks_job.*.new_cluster.init_scripts.gcs.destination
+				},
+				"s3": {
+					"canned_acl":        {}, // databricks_job.*.new_cluster.init_scripts.s3.canned_acl
+					"destination":       {}, // databricks_job.*.new_cluster.init_scripts.s3.destination
+					"enable_encryption": {}, // databricks_job.*.new_cluster.init_scripts.s3.enable_encryption
+					"encryption_type":   {}, // databricks_job.*.new_cluster.init_scripts.s3.encryption_type
+					"endpoint":          {}, // databricks_job.*.new_cluster.init_scripts.s3.endpoint
+					"kms_key":           {}, // databricks_job.*.new_cluster.init_scripts.s3.kms_key
+					"region":            {}, // databricks_job.*.new_cluster.init_scripts.s3.region
+				},
+				"volumes": {
+					"destination": {}, // databricks_job.*.new_cluster.init_scripts.volumes.destination
+				},
+				"workspace": {
+					"destination": {}, // databricks_job.*.new_cluster.init_scripts.workspace.destination
+				},
+			},
+			"instance_pool_id": {}, // databricks_job.*.new_cluster.instance_pool_id
+			"is_single_node":   {}, // databricks_job.*.new_cluster.is_single_node
+			"kind":             {}, // databricks_job.*.new_cluster.kind
+			"library": {
+				"cran": {
+					"package": {}, // databricks_job.*.new_cluster.library.cran.package
+					"repo":    {}, // databricks_job.*.new_cluster.library.cran.repo
+				},
+				"egg": {}, // databricks_job.*.new_cluster.library.egg
+				"jar": {}, // databricks_job.*.new_cluster.library.jar
+				"maven": {
+					"coordinates": {}, // databricks_job.*.new_cluster.library.maven.coordinates
+					"exclusions":  {}, // databricks_job.*.new_cluster.library.maven.exclusions
+					"repo":        {}, // databricks_job.*.new_cluster.library.maven.repo
+				},
+				"pypi": {
+					"package": {}, // databricks_job.*.new_cluster.library.pypi.package
+					"repo":    {}, // databricks_job.*.new_cluster.library.pypi.repo
+				},
+				"requirements": {}, // databricks_job.*.new_cluster.library.requirements
+				"whl":          {}, // databricks_job.*.new_cluster.library.whl
+			},
+			"node_type_id":           {}, // databricks_job.*.new_cluster.node_type_id
+			"num_workers":            {}, // databricks_job.*.new_cluster.num_workers
+			"policy_id":              {}, // databricks_job.*.new_cluster.policy_id
+			"remote_disk_throughput": {}, // databricks_job.*.new_cluster.remote_disk_throughput
+			"runtime_engine":         {}, // databricks_job.*.new_cluster.runtime_engine
+			"single_user_name":       {}, // databricks_job.*.new_cluster.single_user_name
+			"spark_conf": {
+				"*": {}, // databricks_job.*.new_cluster.spark_conf.*
+			},
+			"spark_env_vars": {
+				"*": {}, // databricks_job.*.new_cluster.spark_env_vars.*
+			},
+			"spark_version":                  {}, // databricks_job.*.new_cluster.spark_version
+			"ssh_public_keys":                {}, // databricks_job.*.new_cluster.ssh_public_keys
+			"total_initial_remote_disk_size": {}, // databricks_job.*.new_cluster.total_initial_remote_disk_size
+			"use_ml_runtime":                 {}, // databricks_job.*.new_cluster.use_ml_runtime
+			"worker_node_type_flexibility": {
+				"alternate_node_type_ids": {}, // databricks_job.*.new_cluster.worker_node_type_flexibility.alternate_node_type_ids
+				"aws_context_id":          {}, // databricks_job.*.new_cluster.worker_node_type_flexibility.aws_context_id
+			},
+			"workload_type": {
+				"clients": {
+					"jobs":      {}, // databricks_job.*.new_cluster.workload_type.clients.jobs
+					"notebooks": {}, // databricks_job.*.new_cluster.workload_type.clients.notebooks
+				},
+			},
+		},
+		"notebook_task": {
+			"base_parameters": {
+				"*": {}, // databricks_job.*.notebook_task.base_parameters.*
+			},
+			"notebook_path": {}, // databricks_job.*.notebook_task.notebook_path
+			"source":        {}, // databricks_job.*.notebook_task.source
+			"warehouse_id":  {}, // databricks_job.*.notebook_task.warehouse_id
+		},
+		"pipeline_task": {
+			"full_refresh": {}, // databricks_job.*.pipeline_task.full_refresh
+			"pipeline_id":  {}, // databricks_job.*.pipeline_task.pipeline_id
+		},
+		"python_wheel_task": {
+			"entry_point": {}, // databricks_job.*.python_wheel_task.entry_point
+			"named_parameters": {
+				"*": {}, // databricks_job.*.python_wheel_task.named_parameters.*
+			},
+			"package_name": {}, // databricks_job.*.python_wheel_task.package_name
+			"parameters":   {}, // databricks_job.*.python_wheel_task.parameters
+		},
+		"retry_on_timeout": {},
+		"run_job_task": {
+			"job_id": {}, // databricks_job.*.run_job_task.job_id
+			"job_parameters": {
+				"*": {}, // databricks_job.*.run_job_task.job_parameters.*
+			},
+		},
+		"spark_jar_task": {
+			"jar_uri":         {}, // databricks_job.*.spark_jar_task.jar_uri
+			"main_class_name": {}, // databricks_job.*.spark_jar_task.main_class_name
+			"parameters":      {}, // databricks_job.*.spark_jar_task.parameters
+		},
+		"spark_python_task": {
+			"parameters":  {}, // databricks_job.*.spark_python_task.parameters
+			"python_file": {}, // databricks_job.*.spark_python_task.python_file
+			"source":      {}, // databricks_job.*.spark_python_task.source
+		},
+		"spark_submit_task": {
+			"parameters": {}, // databricks_job.*.spark_submit_task.parameters
+		},
+		"task": {
+			"for_each_task": {
+				"task": {
+					"new_cluster": {
+						"cluster_id": {}, // databricks_job.*.task.for_each_task.task.new_cluster.cluster_id
+						"cluster_mount_info": {
+							"local_mount_dir_path": {}, // databricks_job.*.task.for_each_task.task.new_cluster.cluster_mount_info.local_mount_dir_path
+							"network_filesystem_info": {
+								"mount_options":  {}, // databricks_job.*.task.for_each_task.task.new_cluster.cluster_mount_info.network_filesystem_info.mount_options
+								"server_address": {}, // databricks_job.*.task.for_each_task.task.new_cluster.cluster_mount_info.network_filesystem_info.server_address
+							},
+							"remote_mount_dir_path": {}, // databricks_job.*.task.for_each_task.task.new_cluster.cluster_mount_info.remote_mount_dir_path
+						},
+						"idempotency_token": {}, // databricks_job.*.task.for_each_task.task.new_cluster.idempotency_token
+						"library": {
+							"cran": {
+								"package": {}, // databricks_job.*.task.for_each_task.task.new_cluster.library.cran.package
+								"repo":    {}, // databricks_job.*.task.for_each_task.task.new_cluster.library.cran.repo
+							},
+							"egg": {}, // databricks_job.*.task.for_each_task.task.new_cluster.library.egg
+							"jar": {}, // databricks_job.*.task.for_each_task.task.new_cluster.library.jar
+							"maven": {
+								"coordinates": {}, // databricks_job.*.task.for_each_task.task.new_cluster.library.maven.coordinates
+								"exclusions":  {}, // databricks_job.*.task.for_each_task.task.new_cluster.library.maven.exclusions
+								"repo":        {}, // databricks_job.*.task.for_each_task.task.new_cluster.library.maven.repo
+							},
+							"pypi": {
+								"package": {}, // databricks_job.*.task.for_each_task.task.new_cluster.library.pypi.package
+								"repo":    {}, // databricks_job.*.task.for_each_task.task.new_cluster.library.pypi.repo
+							},
+							"requirements": {}, // databricks_job.*.task.for_each_task.task.new_cluster.library.requirements
+							"whl":          {}, // databricks_job.*.task.for_each_task.task.new_cluster.library.whl
+						},
+					},
+				},
+			},
+			"new_cluster": {
+				"__apply_policy_default_values_allow_list": {}, // databricks_job.*.task.new_cluster.__apply_policy_default_values_allow_list
+				"cluster_id": {}, // databricks_job.*.task.new_cluster.cluster_id
+				"cluster_mount_info": {
+					"local_mount_dir_path": {}, // databricks_job.*.task.new_cluster.cluster_mount_info.local_mount_dir_path
+					"network_filesystem_info": {
+						"mount_options":  {}, // databricks_job.*.task.new_cluster.cluster_mount_info.network_filesystem_info.mount_options
+						"server_address": {}, // databricks_job.*.task.new_cluster.cluster_mount_info.network_filesystem_info.server_address
+					},
+					"remote_mount_dir_path": {}, // databricks_job.*.task.new_cluster.cluster_mount_info.remote_mount_dir_path
+				},
+				"idempotency_token": {}, // databricks_job.*.task.new_cluster.idempotency_token
+				"library": {
+					"cran": {
+						"package": {}, // databricks_job.*.task.new_cluster.library.cran.package
+						"repo":    {}, // databricks_job.*.task.new_cluster.library.cran.repo
+					},
+					"egg": {}, // databricks_job.*.task.new_cluster.library.egg
+					"jar": {}, // databricks_job.*.task.new_cluster.library.jar
+					"maven": {
+						"coordinates": {}, // databricks_job.*.task.new_cluster.library.maven.coordinates
+						"exclusions":  {}, // databricks_job.*.task.new_cluster.library.maven.exclusions
+						"repo":        {}, // databricks_job.*.task.new_cluster.library.maven.repo
+					},
+					"pypi": {
+						"package": {}, // databricks_job.*.task.new_cluster.library.pypi.package
+						"repo":    {}, // databricks_job.*.task.new_cluster.library.pypi.repo
+					},
+					"requirements": {}, // databricks_job.*.task.new_cluster.library.requirements
+					"whl":          {}, // databricks_job.*.task.new_cluster.library.whl
+				},
+			},
+		},
+		"url": {},
+	},
+	"model_serving_endpoints": {
+		"endpoint_url":        {},
+		"serving_endpoint_id": {},
+	},
+	"pipelines": {
+		"expected_last_modified": {},
+		"url":                    {},
+	},
+	"postgres_projects": {
+		"initial_branch_spec": {
+			"is_protected": {}, // databricks_postgres_project.*.initial_branch_spec.is_protected
+		},
+	},
+	"schemas": {
+		"force_destroy": {},
+	},
+	"secret_scopes": {
+		"initial_manage_principal": {},
+	},
+	"sql_warehouses": {
+		"data_source_id": {},
+		"no_wait":        {},
+	},
+}
+
+// DABsToTerraformRenameMap maps DABs group name → nested DABs segments → TF segment name.
+// Navigate using DABs field name segments; NewName is the TF name when it differs.
+var DABsToTerraformRenameMap = map[string]RenameTree{
+	"clusters": {
+		"libraries": {NewName: "library"},
+	},
+	"jobs": {
+		"environments": {NewName: "environment"},
+		"git_source": {Children: RenameTree{
+			"git_branch":   {NewName: "branch"},
+			"git_commit":   {NewName: "commit"},
+			"git_provider": {NewName: "provider"},
+			"git_tag":      {NewName: "tag"},
+			"git_url":      {NewName: "url"},
+		}},
+		"job_clusters": {NewName: "job_cluster"},
+		"parameters":   {NewName: "parameter"},
+		"tasks": {NewName: "task", Children: RenameTree{
+			"for_each_task": {Children: RenameTree{
+				"task": {Children: RenameTree{
+					"libraries": {NewName: "library"},
+				}},
+			}},
+			"libraries": {NewName: "library"},
+		}},
+	},
+	"models": {
+		"model_id": {NewName: "registered_model_id"},
+	},
+	"pipelines": {
+		"clusters":      {NewName: "cluster"},
+		"libraries":     {NewName: "library"},
+		"notifications": {NewName: "notification"},
+	},
+}
+
+// DABsToTerraformWrappers maps DABs group name → the TF wrapper segment to prepend.
+// For groups using Unwrap in TerraformToDABsFieldMap, every DABs path must be prefixed
+// with this segment to obtain the corresponding TF path.
+var DABsToTerraformWrappers = map[string]string{
+	"postgres_branches":      "spec",
+	"postgres_catalogs":      "spec",
+	"postgres_databases":     "spec",
+	"postgres_endpoints":     "spec",
+	"postgres_projects":      "spec",
+	"postgres_roles":         "spec",
+	"postgres_synced_tables": "spec",
+}
+
+// DABsToTerraformWrapperFields maps DABs group name → first-level DABs field names that
+// live under the TF wrapper. For wrapper groups, a DABs path is prefixed with the wrapper
+// in DABsPathToTerraform only when its first segment appears here.
+var DABsToTerraformWrapperFields = map[string]FieldSet{
+	"postgres_branches": {
+		"expire_time":        {},
+		"is_protected":       {},
+		"no_expiry":          {},
+		"source_branch":      {},
+		"source_branch_lsn":  {},
+		"source_branch_time": {},
+		"source_snapshot":    {},
+		"ttl":                {},
+	},
+	"postgres_catalogs": {
+		"branch":                     {},
+		"create_database_if_missing": {},
+		"postgres_database":          {},
+	},
+	"postgres_databases": {
+		"postgres_database": {},
+		"role":              {},
+	},
+	"postgres_endpoints": {
+		"autoscaling_limit_max_cu": {},
+		"autoscaling_limit_min_cu": {},
+		"disabled":                 {},
+		"endpoint_type":            {},
+		"group":                    {},
+		"no_suspension":            {},
+		"settings":                 {},
+		"suspend_timeout_duration": {},
+	},
+	"postgres_projects": {
+		"budget_policy_id":           {},
+		"custom_tags":                {},
+		"default_branch":             {},
+		"default_endpoint_settings":  {},
+		"display_name":               {},
+		"enable_pg_native_login":     {},
+		"history_retention_duration": {},
+		"pg_version":                 {},
+	},
+	"postgres_roles": {
+		"attributes":       {},
+		"auth_method":      {},
+		"identity_type":    {},
+		"membership_roles": {},
+		"postgres_role":    {},
+	},
+	"postgres_synced_tables": {
+		"accelerated_sync":                   {},
+		"branch":                             {},
+		"create_database_objects_if_missing": {},
+		"existing_pipeline_id":               {},
+		"extra_columns":                      {},
+		"new_pipeline_spec":                  {},
+		"postgres_database":                  {},
+		"primary_key_columns":                {},
+		"scheduling_policy":                  {},
+		"source_table_full_name":             {},
+		"timeseries_key":                     {},
+		"type_overrides":                     {},
+	},
+}
diff --git a/bundle/terraform_dabs_map/translate.go b/bundle/terraform_dabs_map/translate.go
new file mode 100644
index 00000000000..5f725e7f4a0
--- /dev/null
+++ b/bundle/terraform_dabs_map/translate.go
@@ -0,0 +1,122 @@
+package terraform_dabs_map
+
+import (
+	"fmt"
+
+	"github.com/databricks/cli/libs/structs/structpath"
+)
+
+// DABsPathToTerraform translates a field path from DABs naming conventions
+// to Terraform naming conventions for the given resource group.
+//
+// It is the inverse of TerraformPathToDABs. For groups whose TF schema wraps config fields
+// under a structural prefix (e.g. "spec"), that prefix is prepended when the path's first
+// segment is listed in DABsToTerraformWrapperFields. Root-level fields and unrecognised
+// segments pass through without the wrapper. Each field name segment is looked up in the
+// DABsToTerraformRenameMap: when found the TF name is used and the tree descends for the
+// remainder of the path. Array indices pass through unchanged without advancing the tree
+// position. An unrecognised segment stops further renaming; remaining segments are kept
+// as-is. Returns nil when path is nil.
+// Returns an error when path is a known DABs-only field with no Terraform equivalent.
+//
+// The path must be relative to the resource root (e.g. "tasks", not
+// "resources.jobs.my_job.tasks").
+func DABsPathToTerraform(group string, path *structpath.PathNode) (*structpath.PathNode, error) {
+	if path == nil {
+		return nil, nil
+	}
+
+	if DABsOnlyFields[group].Contains(path) {
+		return nil, fmt.Errorf("%s: %q is a DABs-only field with no Terraform equivalent", group, path)
+	}
+
+	// For groups with a TF wrapper, prepend it only when the first segment is a known
+	// spec field. Unknown paths (root-level outputs, unrecognised segments) pass through unchanged.
+	var result *structpath.PathNode
+	if wrapper, ok := DABsToTerraformWrappers[group]; ok {
+		segs := path.AsSlice()
+		if len(segs) > 0 {
+			if firstKey, ok := segs[0].StringKey(); ok {
+				if _, isWrapped := DABsToTerraformWrapperFields[group][firstKey]; isWrapped {
+					result = structpath.NewDotString(nil, wrapper)
+				}
+			}
+		}
+	}
+
+	tree := DABsToTerraformRenameMap[group]
+	for _, n := range path.AsSlice() {
+		if key, ok := n.StringKey(); ok {
+			if rn, found := tree[key]; found {
+				if rn.NewName != "" {
+					key = rn.NewName
+				}
+				tree = rn.Children
+			} else {
+				tree = nil
+			}
+			if n.IsDotString() {
+				result = structpath.NewDotString(result, key)
+			} else {
+				result = structpath.NewBracketString(result, key)
+			}
+		} else if idx, ok := n.Index(); ok {
+			result = structpath.NewIndex(result, idx)
+		} else if k, v, ok := n.KeyValue(); ok {
+			result = structpath.NewKeyValue(result, k, v)
+		}
+	}
+	return result, nil
+}
+
+// TerraformPathToDABs translates a field path from Terraform naming conventions
+// to DABs naming conventions for the given resource group.
+//
+// Each field name segment is looked up in the rename tree: when found the DABs
+// name is used and the tree descends into the sub-tree for the remainder of the
+// path. Array indices pass through unchanged without advancing the tree position.
+// An unrecognised field name stops further renaming; remaining segments are kept
+// as-is. Returns nil when path is nil.
+// Returns an error when path is a known Terraform-only field with no DABs equivalent.
+//
+// The path must be relative to the resource root (e.g. "task.library", not
+// "resources.jobs.my_job.task.library").
+func TerraformPathToDABs(group string, path *structpath.PathNode) (*structpath.PathNode, error) {
+	if path == nil {
+		return nil, nil
+	}
+
+	if TerraformOnlyFields[group].Contains(path) {
+		return nil, fmt.Errorf("%s: %q is a Terraform-only field with no DABs equivalent", group, path)
+	}
+
+	tree := TerraformToDABsFieldMap[group]
+	var result *structpath.PathNode
+	for _, n := range path.AsSlice() {
+		if key, ok := n.StringKey(); ok {
+			if rn, found := tree[key]; found {
+				if rn.Unwrap {
+					// This TF segment is a structural wrapper with no DABs equivalent; skip it.
+					tree = rn.Children
+					continue
+				}
+				if rn.NewName != "" {
+					key = rn.NewName
+				}
+				tree = rn.Children
+			} else {
+				tree = nil
+			}
+			if n.IsDotString() {
+				result = structpath.NewDotString(result, key)
+			} else {
+				result = structpath.NewBracketString(result, key)
+			}
+		} else if idx, ok := n.Index(); ok {
+			result = structpath.NewIndex(result, idx)
+		} else if k, v, ok := n.KeyValue(); ok {
+			result = structpath.NewKeyValue(result, k, v)
+		}
+	}
+	return result, nil
+}
diff --git a/bundle/terraform_dabs_map/translate_test.go b/bundle/terraform_dabs_map/translate_test.go
new file mode 100644
index 00000000000..2f3ae5cd7ae
--- /dev/null
+++ b/bundle/terraform_dabs_map/translate_test.go
@@ -0,0 +1,268 @@
+package terraform_dabs_map_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/bundle/terraform_dabs_map"
+	"github.com/databricks/cli/libs/structs/structpath"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestTerraformPathToDABs(t *testing.T) {
+	tests := []struct {
+		group     string
+		terrPath  string
+		dabsPath  string
+		expectErr bool // if true, translation must return an error (Terraform-only field)
+	}{
+		// Top-level renames - jobs
+		{
+			group:    "jobs",
+			terrPath: "task",
+			dabsPath: "tasks",
+		},
+		{
+			group:    "jobs",
+			terrPath: "job_cluster",
+			dabsPath: "job_clusters",
+		},
+		{
+			group:    "jobs",
+			terrPath: "parameter",
+			dabsPath: "parameters",
+		},
+		{
+			group:    "jobs",
+			terrPath: "environment",
+			dabsPath: "environments",
+		},
+
+		// Nested renames - jobs
+		{
+			group:    "jobs",
+			terrPath: "task.library",
+			dabsPath: "tasks.libraries",
+		},
+		{
+			group:    "jobs",
+			terrPath: "task.for_each_task.task.library",
+			dabsPath: "tasks.for_each_task.task.libraries",
+		},
+
+		// git_source: segment itself unchanged, children renamed
+		{
+			group:    "jobs",
+			terrPath: "git_source.branch",
+			dabsPath: "git_source.git_branch",
+		},
+		{
+			group:    "jobs",
+			terrPath: "git_source.url",
+			dabsPath: "git_source.git_url",
+		},
+
+		// Unknown fields pass through unchanged
+		{
+			group:    "jobs",
+			terrPath: "name",
+			dabsPath: "name",
+		},
+		{
+			group:    "jobs",
+			terrPath: "format",
+			dabsPath: "format",
+		},
+
+		// After an unrecognised segment, remaining segments pass through as-is
+		{
+			group:    "jobs",
+			terrPath: "task.new_cluster.node_type_id",
+			dabsPath: "tasks.new_cluster.node_type_id",
+		},
+
+		// Array index passes through without advancing the rename tree
+		{
+			group:    "jobs",
+			terrPath: "task[0].library",
+			dabsPath: "tasks[0].libraries",
+		},
+
+		// Pipelines
+		{
+			group:    "pipelines",
+			terrPath: "cluster",
+			dabsPath: "clusters",
+		},
+		{
+			group:    "pipelines",
+			terrPath: "library",
+			dabsPath: "libraries",
+		},
+		{
+			group:    "pipelines",
+			terrPath: "notification",
+			dabsPath: "notifications",
+		},
+
+		// Unknown group: path unchanged
+		{
+			group:    "unknown_group",
+			terrPath: "task",
+			dabsPath: "task",
+		},
+
+		// postgres resources: spec wrapper is unwrapped
+		{
+			group:    "postgres_projects",
+			terrPath: "spec.display_name",
+			dabsPath: "display_name",
+		},
+		{
+			group:    "postgres_projects",
+			terrPath: "spec.default_endpoint_settings.no_suspension",
+			dabsPath: "default_endpoint_settings.no_suspension",
+		},
+		{
+			group:    "postgres_branches",
+			terrPath: "spec.expire_time",
+			dabsPath: "expire_time",
+		},
+		{
+			group:    "postgres_catalogs",
+			terrPath: "spec.postgres_database",
+			dabsPath: "postgres_database",
+		},
+		{
+			group:    "postgres_endpoints",
+			terrPath: "spec.endpoint_type",
+			dabsPath: "endpoint_type",
+		},
+
+		// TF root-level paths (status, timestamps, IDs) pass through unchanged and
+		// round-trip correctly: DABsPathToTerraform recognises them as root fields.
+		{
+			group:    "postgres_projects",
+			terrPath: "status.display_name",
+			dabsPath: "status.display_name",
+		},
+		{
+			group:    "postgres_projects",
+			terrPath: "create_time",
+			dabsPath: "create_time",
+		},
+		{
+			group:    "postgres_projects",
+			terrPath: "project_id",
+			dabsPath: "project_id",
+		},
+		{
+			group:    "postgres_projects",
+			terrPath: "name",
+			dabsPath: "name",
+		},
+
+		// Manual rename: registered_model_id is a state-computed field whose DABs name
+		// (model_id) is lexically unrelated, so it is wired up via manualRenames in codegen.
+		{
+			group:    "models",
+			terrPath: "registered_model_id",
+			dabsPath: "model_id",
+		},
+
+		// Terraform-only fields: must return an error
+		{
+			group:     "jobs",
+			terrPath:  "always_running",
+			expectErr: true,
+		},
+		{
+			group:     "jobs",
+			terrPath:  "new_cluster.node_type_id",
+			expectErr: true,
+		},
+		{
+			group:     "pipelines",
+			terrPath:  "url",
+			expectErr: true,
+		},
+		// Wildcard map fields: any key under a map-typed TF-only field is also TF-only
+		{
+			group:     "jobs",
+			terrPath:  "new_cluster.spark_conf.MY_KEY",
+			expectErr: true,
+		},
+		{
+			group:     "jobs",
+			terrPath:  "notebook_task.base_parameters.my_param",
+			expectErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.group+"/"+tt.terrPath, func(t *testing.T) {
+			path, err := structpath.ParsePath(tt.terrPath)
+			require.NoError(t, err)
+
+			result, err := terraform_dabs_map.TerraformPathToDABs(tt.group, path)
+			if tt.expectErr {
+				require.Error(t, err)
+				assert.Nil(t, result)
+				return
+			}
+			require.NoError(t, err)
+			require.NotNil(t, result)
+			assert.Equal(t, tt.dabsPath, result.String())
+
+			// Fixed-point: the DABs result is already in DABs format, so a second
+			// TerraformPathToDABs pass must leave it unchanged.
+			// DABsPathToTerraform does NOT have this property: spec fields like
+			// "display_name" map to "spec.display_name", and applying the function
+			// again would incorrectly prepend another "spec." prefix.
+			result2, err := terraform_dabs_map.TerraformPathToDABs(tt.group, result)
+			require.NoError(t, err)
+			require.NotNil(t, result2)
+			assert.Equal(t, result.String(), result2.String(), "TerraformPathToDABs(TerraformPathToDABs(terrPath)) == TerraformPathToDABs(terrPath)")
+
+			back, err := terraform_dabs_map.DABsPathToTerraform(tt.group, result)
+			require.NoError(t, err)
+			require.NotNil(t, back)
+			assert.Equal(t, tt.terrPath, back.String(), "roundtrip DABsPathToTerraform(TerraformPathToDABs(terrPath))")
+		})
+	}
+}
+
+func TestTerraformPathToDABsNilPath(t *testing.T) {
+	result, err := terraform_dabs_map.TerraformPathToDABs("jobs", nil)
+	assert.NoError(t, err)
+	assert.Nil(t, result)
+}
+
+func TestDABsPathToTerraformErrors(t *testing.T) {
+	// The non-error cases are already covered by the roundtrip check in
+	// TestTerraformPathToDABs.  This test covers only DABs-only fields, which
+	// have no TF equivalent and must return an error.
+	tests := []struct {
+		group    string
+		dabsPath string
+	}{
+		{"jobs", "tasks.new_cluster.autotermination_minutes"},
+		{"pipelines", "dry_run"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.group+"/"+tt.dabsPath, func(t *testing.T) {
+			path, err := structpath.ParsePath(tt.dabsPath)
+			require.NoError(t, err)
+			result, err := terraform_dabs_map.DABsPathToTerraform(tt.group, path)
+			require.Error(t, err)
+			assert.Nil(t, result)
+		})
+	}
+}
+
+func TestDABsPathToTerraformNilPath(t *testing.T) {
+	result, err := terraform_dabs_map.DABsPathToTerraform("jobs", nil)
+	assert.NoError(t, err)
+	assert.Nil(t, result)
+}
diff --git a/bundle/terraform_dabs_map/types.go b/bundle/terraform_dabs_map/types.go
new file mode 100644
index 00000000000..2d7eadd4991
--- /dev/null
+++ b/bundle/terraform_dabs_map/types.go
@@ -0,0 +1,49 @@
+// Package terraform_dabs_map provides a precomputed bidirectional mapping between
+// DABs resource fields and Terraform resource fields, frozen in generated.go (a snapshot, since the generator was removed with the Terraform engine).
+package terraform_dabs_map
+
+import "github.com/databricks/cli/libs/structs/structpath"
+
+// FieldSet is a nested set of field path segments. Each key is a single field name;
+// an empty child FieldSet marks a leaf (the full path from root is present in the set).
+type FieldSet map[string]FieldSet
+
+// Contains reports whether path is in the FieldSet.
+// Walking the path segment by segment, it returns true when a leaf node is
+// reached (covering all sub-paths) or when an exact match is found.
+// Array indices are ignored; "*" matches any key at that level.
+func (fs FieldSet) Contains(path *structpath.PathNode) bool {
+	current := fs
+	for _, n := range path.AsSlice() {
+		key, ok := n.StringKey()
+		if !ok {
+			continue // skip array indices and key=value nodes
+		}
+		child, found := current[key]
+		if !found {
+			child, found = current["*"]
+		}
+		if !found {
+			return false
+		}
+		if len(child) == 0 {
+			return true // leaf: this path and all sub-paths are covered
+		}
+		current = child
+	}
+	return false
+}
+
+// RenameNode is one node in a bidirectional rename tree. NewName is the counterpart segment
+// name in the other naming scheme when it differs from the key; Children holds renames for
+// deeper paths. Both may be set when the segment itself is renamed and sub-fields are renamed too.
+// Unwrap marks a structural wrapper in TerraformToDABsFieldMap: the TF segment has no DABs
+// equivalent and is consumed without emitting a segment. Unwrap and NewName are mutually exclusive.
+type RenameNode struct {
+	NewName  string
+	Unwrap   bool
+	Children RenameTree
+}
+
+// RenameTree maps single TF field name segments to their rename nodes.
+type RenameTree map[string]RenameNode
diff --git a/bundle/tests/environments_job_and_pipeline_test.go b/bundle/tests/environments_job_and_pipeline_test.go
index 423b14c0707..148b1ecaa4a 100644
--- a/bundle/tests/environments_job_and_pipeline_test.go
+++ b/bundle/tests/environments_job_and_pipeline_test.go
@@ -15,7 +15,7 @@ func TestJobAndPipelineDevelopmentWithEnvironment(t *testing.T) {
 
 	p := b.Config.Resources.Pipelines["nyc_taxi_pipeline"]
 	assert.Equal(t, config.Development, b.Config.Bundle.Mode)
-	assert.True(t, p.Development)
+	assert.True(t, p.Development) //nolint:staticcheck // SA1019: pipeline development is deprecated in the SDK but remains a supported bundle config field
 	require.Len(t, p.Libraries, 1)
 	assert.Equal(t, "./dlt/nyc_taxi_loader", p.Libraries[0].Notebook.Path)
 	assert.Equal(t, "nyc_taxi_development", p.Target)
@@ -27,7 +27,7 @@ func TestJobAndPipelineStagingWithEnvironment(t *testing.T) {
 	assert.Len(t, b.Config.Resources.Pipelines, 1)
 
 	p := b.Config.Resources.Pipelines["nyc_taxi_pipeline"]
-	assert.False(t, p.Development)
+	assert.False(t, p.Development) //nolint:staticcheck // SA1019: pipeline development is deprecated in the SDK but remains a supported bundle config field
 	require.Len(t, p.Libraries, 1)
 	assert.Equal(t, "./dlt/nyc_taxi_loader", p.Libraries[0].Notebook.Path)
 	assert.Equal(t, "nyc_taxi_staging", p.Target)
@@ -39,7 +39,7 @@ func TestJobAndPipelineProductionWithEnvironment(t *testing.T) {
 	assert.Len(t, b.Config.Resources.Pipelines, 1)
 
 	p := b.Config.Resources.Pipelines["nyc_taxi_pipeline"]
-	assert.False(t, p.Development)
+	assert.False(t, p.Development) //nolint:staticcheck // SA1019: pipeline development is deprecated in the SDK but remains a supported bundle config field
 	require.Len(t, p.Libraries, 1)
 	assert.Equal(t, "./dlt/nyc_taxi_loader", p.Libraries[0].Notebook.Path)
 	assert.Equal(t, "nyc_taxi_production", p.Target)
diff --git a/bundle/tests/job_and_pipeline_test.go b/bundle/tests/job_and_pipeline_test.go
index 408e3e3ef90..ceb200c8691 100644
--- a/bundle/tests/job_and_pipeline_test.go
+++ b/bundle/tests/job_and_pipeline_test.go
@@ -15,7 +15,7 @@ func TestJobAndPipelineDevelopment(t *testing.T) {
 
 	p := b.Config.Resources.Pipelines["nyc_taxi_pipeline"]
 	assert.Equal(t, config.Development, b.Config.Bundle.Mode)
-	assert.True(t, p.Development)
+	assert.True(t, p.Development) //nolint:staticcheck // SA1019: pipeline development is deprecated in the SDK but remains a supported bundle config field
 	require.Len(t, p.Libraries, 1)
 	assert.Equal(t, "./dlt/nyc_taxi_loader", p.Libraries[0].Notebook.Path)
 	assert.Equal(t, "nyc_taxi_development", p.Target)
@@ -27,7 +27,7 @@ func TestJobAndPipelineStaging(t *testing.T) {
 	assert.Len(t, b.Config.Resources.Pipelines, 1)
 
 	p := b.Config.Resources.Pipelines["nyc_taxi_pipeline"]
-	assert.False(t, p.Development)
+	assert.False(t, p.Development) //nolint:staticcheck // SA1019: pipeline development is deprecated in the SDK but remains a supported bundle config field
 	require.Len(t, p.Libraries, 1)
 	assert.Equal(t, "./dlt/nyc_taxi_loader", p.Libraries[0].Notebook.Path)
 	assert.Equal(t, "nyc_taxi_staging", p.Target)
@@ -39,7 +39,7 @@ func TestJobAndPipelineProduction(t *testing.T) {
 	assert.Len(t, b.Config.Resources.Pipelines, 1)
 
 	p := b.Config.Resources.Pipelines["nyc_taxi_pipeline"]
-	assert.False(t, p.Development)
+	assert.False(t, p.Development) //nolint:staticcheck // SA1019: pipeline development is deprecated in the SDK but remains a supported bundle config field
 	require.Len(t, p.Libraries, 1)
 	assert.Equal(t, "./dlt/nyc_taxi_loader", p.Libraries[0].Notebook.Path)
 	assert.Equal(t, "nyc_taxi_production", p.Target)
diff --git a/bundle/tests/validate_test.go b/bundle/tests/validate_test.go
index e10f240aaff..065dbf0652c 100644
--- a/bundle/tests/validate_test.go
+++ b/bundle/tests/validate_test.go
@@ -6,8 +6,8 @@ import (
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/bundle/phases"
 	"github.com/databricks/cli/libs/diag"
-	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/cli/libs/logdiag"
+	"github.com/databricks/cli/libs/structs/structpath"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -23,14 +23,14 @@ func TestValidateUniqueResourceIdentifiers(t *testing.T) {
 				{
 					Severity: diag.Error,
 					Summary:  "multiple resources or scripts have been defined with the same key: foo",
-					Locations: []dyn.Location{
+					Locations: []diag.Location{
 						{File: "validate/duplicate_resource_names_in_root_job_and_pipeline/databricks.yml", Line: 10, Column: 7},
 						{File: "validate/duplicate_resource_names_in_root_job_and_pipeline/databricks.yml", Line: 13, Column: 7},
 					},
-					Paths: []dyn.Path{
-						dyn.MustPathFromString("resources.jobs.foo"),
-						dyn.MustPathFromString("resources.pipelines.foo"),
-					},
+					Paths: structpath.MustParsePaths(
+						"resources.jobs.foo",
+						"resources.pipelines.foo",
+					),
 				},
 			},
 		},
@@ -40,14 +40,14 @@ func TestValidateUniqueResourceIdentifiers(t *testing.T) {
 				{
 					Severity: diag.Error,
 					Summary:  "multiple resources or scripts have been defined with the same key: foo",
-					Locations: []dyn.Location{
+					Locations: []diag.Location{
 						{File: "validate/duplicate_resource_names_in_root_job_and_experiment/databricks.yml", Line: 10, Column: 7},
 						{File: "validate/duplicate_resource_names_in_root_job_and_experiment/databricks.yml", Line: 18, Column: 7},
 					},
-					Paths: []dyn.Path{
-						dyn.MustPathFromString("resources.experiments.foo"),
-						dyn.MustPathFromString("resources.jobs.foo"),
-					},
+					Paths: structpath.MustParsePaths(
+						"resources.experiments.foo",
+						"resources.jobs.foo",
+					),
 				},
 			},
 		},
@@ -57,14 +57,14 @@ func TestValidateUniqueResourceIdentifiers(t *testing.T) {
 				{
 					Severity: diag.Error,
 					Summary:  "multiple resources or scripts have been defined with the same key: foo",
-					Locations: []dyn.Location{
+					Locations: []diag.Location{
 						{File: "validate/duplicate_resource_name_in_subconfiguration/databricks.yml", Line: 13, Column: 7},
 						{File: "validate/duplicate_resource_name_in_subconfiguration/resources.yml", Line: 4, Column: 7},
 					},
-					Paths: []dyn.Path{
-						dyn.MustPathFromString("resources.jobs.foo"),
-						dyn.MustPathFromString("resources.pipelines.foo"),
-					},
+					Paths: structpath.MustParsePaths(
+						"resources.jobs.foo",
+						"resources.pipelines.foo",
+					),
 				},
 			},
 		},
@@ -74,13 +74,11 @@ func TestValidateUniqueResourceIdentifiers(t *testing.T) {
 				{
 					Severity: diag.Error,
 					Summary:  "multiple resources or scripts have been defined with the same key: foo",
-					Locations: []dyn.Location{
+					Locations: []diag.Location{
 						{File: "validate/duplicate_resource_name_in_subconfiguration_job_and_job/databricks.yml", Line: 13, Column: 7},
 						{File: "validate/duplicate_resource_name_in_subconfiguration_job_and_job/resources.yml", Line: 4, Column: 7},
 					},
-					Paths: []dyn.Path{
-						dyn.MustPathFromString("resources.jobs.foo"),
-					},
+					Paths: structpath.NewPathSlice("resources", "jobs", "foo"),
 				},
 			},
 		},
@@ -90,14 +88,14 @@ func TestValidateUniqueResourceIdentifiers(t *testing.T) {
 				{
 					Severity: diag.Error,
 					Summary:  "multiple resources or scripts have been defined with the same key: foo",
-					Locations: []dyn.Location{
+					Locations: []diag.Location{
 						{File: "validate/duplicate_resource_names_in_different_subconfiguations/resources1.yml", Line: 4, Column: 7},
 						{File: "validate/duplicate_resource_names_in_different_subconfiguations/resources2.yml", Line: 4, Column: 7},
 					},
-					Paths: []dyn.Path{
-						dyn.MustPathFromString("resources.jobs.foo"),
-						dyn.MustPathFromString("resources.pipelines.foo"),
-					},
+					Paths: structpath.MustParsePaths(
+						"resources.jobs.foo",
+						"resources.pipelines.foo",
+					),
 				},
 			},
 		},
@@ -107,18 +105,18 @@ func TestValidateUniqueResourceIdentifiers(t *testing.T) {
 				{
 					Severity: diag.Error,
 					Summary:  "multiple resources or scripts have been defined with the same key: foo",
-					Locations: []dyn.Location{
+					Locations: []diag.Location{
 						{File: "validate/duplicate_resource_name_in_multiple_locations/databricks.yml", Line: 13, Column: 7},
 						{File: "validate/duplicate_resource_name_in_multiple_locations/resources1.yml", Line: 4, Column: 7},
 						{File: "validate/duplicate_resource_name_in_multiple_locations/resources1.yml", Line: 8, Column: 7},
 						{File: "validate/duplicate_resource_name_in_multiple_locations/resources2.yml", Line: 4, Column: 7},
 						{File: "validate/duplicate_resource_name_in_multiple_locations/resources2.yml", Line: 8, Column: 7},
 					},
-					Paths: []dyn.Path{
-						dyn.MustPathFromString("resources.experiments.foo"),
-						dyn.MustPathFromString("resources.jobs.foo"),
-						dyn.MustPathFromString("resources.pipelines.foo"),
-					},
+					Paths: structpath.MustParsePaths(
+						"resources.experiments.foo",
+						"resources.jobs.foo",
+						"resources.pipelines.foo",
+					),
 				},
 			},
 		},
diff --git a/bundle/trampoline/conditional_transform_test.go b/bundle/trampoline/conditional_transform_test.go
index 97cfa94df08..928ed578d17 100644
--- a/bundle/trampoline/conditional_transform_test.go
+++ b/bundle/trampoline/conditional_transform_test.go
@@ -108,7 +108,7 @@ func TestTransformWithExperimentalSettingSetToTrue(t *testing.T) {
 	task := b.Config.Resources.Jobs["job1"].Tasks[0]
 	require.Nil(t, task.PythonWheelTask)
 	require.NotNil(t, task.NotebookTask)
-	require.Equal(t, "/Workspace/files/my_bundle/.databricks/bundle/development/.internal/notebook_job1_key1", task.NotebookTask.NotebookPath)
+	require.Equal(t, "/Workspace/files/my_bundle/.databricks/bundle/development/.internal/notebook_4_job1_key1", task.NotebookTask.NotebookPath)
 
 	require.Len(t, task.Libraries, 1)
 	require.Equal(t, "/Workspace/Users/test@test.com/bundle/dist/test.jar", task.Libraries[0].Jar)
diff --git a/bundle/trampoline/python_dbr_warning_test.go b/bundle/trampoline/python_dbr_warning_test.go
index 1e990ed7bdf..3f5c35bf7c6 100644
--- a/bundle/trampoline/python_dbr_warning_test.go
+++ b/bundle/trampoline/python_dbr_warning_test.go
@@ -63,13 +63,13 @@ func TestIncompatibleWheelTasksWithJobClusterKey(t *testing.T) {
 							JobClusters: []jobs.JobCluster{
 								{
 									JobClusterKey: "cluster1",
-									NewCluster: compute.ClusterSpec{
+									NewCluster: &compute.ClusterSpec{
 										SparkVersion: "12.2.x-scala2.12",
 									},
 								},
 								{
 									JobClusterKey: "cluster2",
-									NewCluster: compute.ClusterSpec{
+									NewCluster: &compute.ClusterSpec{
 										SparkVersion: "13.1.x-scala2.12",
 									},
 								},
@@ -163,13 +163,13 @@ func TestNoIncompatibleWheelTasks(t *testing.T) {
 							JobClusters: []jobs.JobCluster{
 								{
 									JobClusterKey: "cluster1",
-									NewCluster: compute.ClusterSpec{
+									NewCluster: &compute.ClusterSpec{
 										SparkVersion: "12.2.x-scala2.12",
 									},
 								},
 								{
 									JobClusterKey: "cluster2",
-									NewCluster: compute.ClusterSpec{
+									NewCluster: &compute.ClusterSpec{
 										SparkVersion: "13.1.x-scala2.12",
 									},
 								},
@@ -269,7 +269,7 @@ func TestTasksWithPyPiPackageAreCompatible(t *testing.T) {
 							JobClusters: []jobs.JobCluster{
 								{
 									JobClusterKey: "cluster1",
-									NewCluster: compute.ClusterSpec{
+									NewCluster: &compute.ClusterSpec{
 										SparkVersion: "12.2.x-scala2.12",
 									},
 								},
diff --git a/bundle/trampoline/trampoline.go b/bundle/trampoline/trampoline.go
index 600ce3d9c64..b3683688fee 100644
--- a/bundle/trampoline/trampoline.go
+++ b/bundle/trampoline/trampoline.go
@@ -59,7 +59,9 @@ func (m *trampoline) generateNotebookWrapper(ctx context.Context, b *bundle.Bund
 		return err
 	}
 
-	notebookName := fmt.Sprintf("notebook_%s_%s", task.JobKey, task.Task.TaskKey)
+	// Keys may contain underscores, so joining with "_" alone is ambiguous ("a_b"+"c"
+	// vs "a"+"b_c"); the job key length prefix keeps the filename unique per task.
+	notebookName := fmt.Sprintf("notebook_%d_%s_%s", len(task.JobKey), task.JobKey, task.Task.TaskKey)
 	localNotebookPath := filepath.Join(internalDir, notebookName+".py")
 
 	err = os.MkdirAll(filepath.Dir(localNotebookPath), 0o755)
diff --git a/bundle/trampoline/trampoline_test.go b/bundle/trampoline/trampoline_test.go
index 53b1e3811a6..d4e46795619 100644
--- a/bundle/trampoline/trampoline_test.go
+++ b/bundle/trampoline/trampoline_test.go
@@ -17,11 +17,13 @@ type functions struct{}
 
 func (f *functions) GetTasks(b *bundle.Bundle) []TaskWithJobKey {
 	var tasks []TaskWithJobKey
-	for k := range b.Config.Resources.Jobs["test"].Tasks {
-		tasks = append(tasks, TaskWithJobKey{
-			JobKey: "test",
-			Task:   &b.Config.Resources.Jobs["test"].Tasks[k],
-		})
+	for k, job := range b.Config.Resources.Jobs {
+		for i := range job.Tasks {
+			tasks = append(tasks, TaskWithJobKey{
+				JobKey: k,
+				Task:   &job.Tasks[i],
+			})
+		}
 	}
 
 	return tasks
@@ -85,7 +87,7 @@ func TestGenerateTrampoline(t *testing.T) {
 
 	dir, err := b.InternalDir(ctx)
 	require.NoError(t, err)
-	filename := filepath.Join(dir, "notebook_test_to_trampoline.py")
+	filename := filepath.Join(dir, "notebook_4_test_to_trampoline.py")
 
 	bytes, err := os.ReadFile(filename)
 	require.NoError(t, err)
@@ -93,6 +95,64 @@ func TestGenerateTrampoline(t *testing.T) {
 	require.Equal(t, "Hello from Trampoline", string(bytes))
 
 	task := b.Config.Resources.Jobs["test"].Tasks[0]
-	require.Equal(t, "/Workspace/files/my_bundle/.databricks/bundle/development/.internal/notebook_test_to_trampoline", task.NotebookTask.NotebookPath)
+	require.Equal(t, "/Workspace/files/my_bundle/.databricks/bundle/development/.internal/notebook_4_test_to_trampoline", task.NotebookTask.NotebookPath)
 	require.Nil(t, task.PythonWheelTask)
 }
+
+func TestGenerateTrampolineWithCollidingKeys(t *testing.T) {
+	tmpDir := t.TempDir()
+
+	newJob := func(taskKey string) *resources.Job {
+		return &resources.Job{
+			Tasks: []jobs.Task{
+				{
+					TaskKey: taskKey,
+					PythonWheelTask: &jobs.PythonWheelTask{
+						PackageName: "test",
+						EntryPoint:  "run",
+					},
+				},
+			},
+		}
+	}
+
+	b := &bundle.Bundle{
+		BundleRootPath: filepath.Join(tmpDir, "parent", "my_bundle"),
+		SyncRootPath:   filepath.Join(tmpDir, "parent"),
+		Config: config.Root{
+			Workspace: config.Workspace{
+				FilePath: "/Workspace/files",
+			},
+			Bundle: config.Bundle{
+				Target: "development",
+			},
+			Resources: config.Resources{
+				Jobs: map[string]*resources.Job{
+					"a_b": newJob("c"),
+					"a":   newJob("b_c"),
+				},
+			},
+		},
+	}
+	ctx := t.Context()
+
+	funcs := functions{}
+	trampoline := NewTrampoline("test_trampoline", &funcs, "Hello from {{.MyName}}")
+	diags := bundle.Apply(ctx, b, trampoline)
+	require.NoError(t, diags.Error())
+
+	dir, err := b.InternalDir(ctx)
+	require.NoError(t, err)
+
+	for _, name := range []string{"notebook_3_a_b_c", "notebook_1_a_b_c"} {
+		_, err := os.Stat(filepath.Join(dir, name+".py"))
+		require.NoError(t, err)
+	}
+
+	require.Equal(t,
+		"/Workspace/files/my_bundle/.databricks/bundle/development/.internal/notebook_3_a_b_c",
+		b.Config.Resources.Jobs["a_b"].Tasks[0].NotebookTask.NotebookPath)
+	require.Equal(t,
+		"/Workspace/files/my_bundle/.databricks/bundle/development/.internal/notebook_1_a_b_c",
+		b.Config.Resources.Jobs["a"].Tasks[0].NotebookTask.NotebookPath)
+}
diff --git a/cmd/account/access-control/access-control.go b/cmd/account/access-control/access-control.go
old mode 100755
new mode 100644
index 2dab1d83a99..3be9b6579cb
--- a/cmd/account/access-control/access-control.go
+++ b/cmd/account/access-control/access-control.go
@@ -3,7 +3,7 @@
 package access_control
 
 import (
-	"fmt"
+	"errors"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
@@ -20,14 +20,20 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "access-control",
-		Short: `These APIs manage access rules on resources in an account.`,
-		Long: `These APIs manage access rules on resources in an account. Currently, only
+		Short: `*Public Preview* These APIs manage access rules on resources in an account.`,
+		Long: `This command is in Public Preview and may change without notice.
+
+These APIs manage access rules on resources in an account. Currently, only
   grant rules are supported. A grant rule specifies a role assigned to a set of
   principals. A list of rules attached to a resource is called a rule set.`,
 		GroupID: "iam",
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
 	// Add methods
 	cmd.AddCommand(newGetAssignableRolesForResource())
 	cmd.AddCommand(newGetRuleSet())
@@ -56,8 +62,10 @@ func newGetAssignableRolesForResource() *cobra.Command {
 	var getAssignableRolesForResourceReq iam.GetAssignableRolesForResourceRequest
 
 	cmd.Use = "get-assignable-roles-for-resource RESOURCE"
-	cmd.Short = `Get assignable roles for a resource.`
-	cmd.Long = `Get assignable roles for a resource.
+	cmd.Short = `*Public Preview* Get assignable roles for a resource.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get assignable roles for a resource.
 
   Gets all the roles that can be granted on an account level resource. A role is
   grantable if the rule set on the resource can contain an access rule of the
@@ -75,6 +83,8 @@ func newGetAssignableRolesForResource() *cobra.Command {
       name for the tag policy.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -123,8 +133,10 @@ func newGetRuleSet() *cobra.Command {
 	var getRuleSetReq iam.GetRuleSetRequest
 
 	cmd.Use = "get-rule-set NAME ETAG"
-	cmd.Short = `Get a rule set.`
-	cmd.Long = `Get a rule set.
+	cmd.Short = `*Public Preview* Get a rule set.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get a rule set.
 
   Get a rule set by its name. A rule set is always attached to a resource and
   contains a list of access rules on the said resource. Currently only a default
@@ -157,6 +169,8 @@ func newGetRuleSet() *cobra.Command {
       etag encoded a specific version of the rule set to get or to be updated.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -209,14 +223,18 @@ func newUpdateRuleSet() *cobra.Command {
 	cmd.Flags().Var(&updateRuleSetJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Use = "update-rule-set"
-	cmd.Short = `Update a rule set.`
-	cmd.Long = `Update a rule set.
+	cmd.Short = `*Public Preview* Update a rule set.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Update a rule set.
 
   Replace the rules of a rule set. First, use get to read the current version of
   the rule set before modifying it. This pattern helps prevent conflicts between
   concurrent updates.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustAccountClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -235,7 +253,7 @@ func newUpdateRuleSet() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := a.AccessControl.UpdateRuleSet(ctx, updateRuleSetReq)
diff --git a/cmd/account/billable-usage/billable-usage.go b/cmd/account/billable-usage/billable-usage.go
old mode 100755
new mode 100644
index d89b87e4440..b7d0365fb63
--- a/cmd/account/billable-usage/billable-usage.go
+++ b/cmd/account/billable-usage/billable-usage.go
@@ -24,6 +24,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newDownload())
 
@@ -56,9 +60,7 @@ func newDownload() *cobra.Command {
 	cmd.Long = `Return billable usage logs.
 
   Returns billable usage logs in CSV format for the specified account and date
-  range. For the data schema, see:
-
-  - AWS: [CSV file schema]. - GCP: [CSV file schema].
+  range.
 
   Note that this method might take multiple minutes to complete.
 
@@ -67,8 +69,6 @@ func newDownload() *cobra.Command {
   this API may hit a timeout after a few minutes. If you experience this, try to
   mitigate by calling the API with narrower date ranges.
 
-  [CSV file schema]: https://docs.gcp.databricks.com/administration-guide/account-settings/usage-analysis.html#csv-file-schema
-
   Arguments:
     START_MONTH: Format specification for month in the format YYYY-MM. This is used to
       specify billable usage start_month and end_month properties. **Note**:
@@ -77,6 +77,8 @@ func newDownload() *cobra.Command {
       field is required.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
diff --git a/cmd/account/budget-policy/budget-policy.go b/cmd/account/budget-policy/budget-policy.go
old mode 100755
new mode 100644
index 419168fd9ee..917f23548dc
--- a/cmd/account/budget-policy/budget-policy.go
+++ b/cmd/account/budget-policy/budget-policy.go
@@ -19,13 +19,19 @@ var cmdOverrides []func(*cobra.Command)
 
 func New() *cobra.Command {
 	cmd := &cobra.Command{
-		Use:     "budget-policy",
-		Short:   `A service serves REST API about Budget policies.`,
-		Long:    `A service serves REST API about Budget policies`,
+		Use:   "budget-policy",
+		Short: `*Public Preview* A service serves REST API about Budget policies.`,
+		Long: `This command is in Public Preview and may change without notice.
+
+A service serves REST API about Budget policies`,
 		GroupID: "billing",
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -62,12 +68,16 @@ func newCreate() *cobra.Command {
 	cmd.Flags().StringVar(&createReq.RequestId, "request-id", createReq.RequestId, `A unique identifier for this request.`)
 
 	cmd.Use = "create"
-	cmd.Short = `Create a budget policy.`
-	cmd.Long = `Create a budget policy.
+	cmd.Short = `*Public Preview* Create a budget policy.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Create a budget policy.
 
   Creates a new policy.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -127,8 +137,10 @@ func newDelete() *cobra.Command {
 	var deleteReq billing.DeleteBudgetPolicyRequest
 
 	cmd.Use = "delete POLICY_ID"
-	cmd.Short = `Delete a budget policy.`
-	cmd.Long = `Delete a budget policy.
+	cmd.Short = `*Public Preview* Delete a budget policy.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Delete a budget policy.
 
   Deletes a policy
 
@@ -136,6 +148,8 @@ func newDelete() *cobra.Command {
     POLICY_ID: The Id of the policy.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -183,8 +197,10 @@ func newGet() *cobra.Command {
 	var getReq billing.GetBudgetPolicyRequest
 
 	cmd.Use = "get POLICY_ID"
-	cmd.Short = `Get a budget policy.`
-	cmd.Long = `Get a budget policy.
+	cmd.Short = `*Public Preview* Get a budget policy.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get a budget policy.
 
   Retrieves a policy by it's ID.
 
@@ -192,6 +208,8 @@ func newGet() *cobra.Command {
     POLICY_ID: The Id of the policy.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -255,13 +273,17 @@ func newList() *cobra.Command {
 	cmd.Flags().Lookup("page-token").Hidden = true
 
 	cmd.Use = "list"
-	cmd.Short = `List policies.`
-	cmd.Long = `List policies.
+	cmd.Short = `*Public Preview* List policies.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+List policies.
 
   Lists all policies. Policies are returned in the alphabetically ascending
   order of their names.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -320,8 +342,10 @@ func newUpdate() *cobra.Command {
 	cmd.Flags().StringVar(&updateReq.Policy.PolicyName, "policy-name", updateReq.Policy.PolicyName, `The name of the policy.`)
 
 	cmd.Use = "update POLICY_ID"
-	cmd.Short = `Update a budget policy.`
-	cmd.Long = `Update a budget policy.
+	cmd.Short = `*Public Preview* Update a budget policy.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Update a budget policy.
 
   Updates a policy
 
@@ -330,6 +354,8 @@ func newUpdate() *cobra.Command {
       unique.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/account/budgets/budgets.go b/cmd/account/budgets/budgets.go
old mode 100755
new mode 100644
index b6dfed84376..723486a2e40
--- a/cmd/account/budgets/budgets.go
+++ b/cmd/account/budgets/budgets.go
@@ -3,6 +3,7 @@
 package budgets
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -20,8 +21,10 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "budgets",
-		Short: `These APIs manage budget configurations for this account.`,
-		Long: `These APIs manage budget configurations for this account. Budgets enable you
+		Short: `*Public Preview* These APIs manage budget configurations for this account.`,
+		Long: `This command is in Public Preview and may change without notice.
+
+These APIs manage budget configurations for this account. Budgets enable you
   to monitor usage across your account. You can set up budgets to either track
   account-wide spending, or apply filters to track the spending of specific
   teams, projects, or workspaces.`,
@@ -29,6 +32,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -62,13 +69,17 @@ func newCreate() *cobra.Command {
 	cmd.Flags().Var(&createJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Use = "create"
-	cmd.Short = `Create new budget.`
-	cmd.Long = `Create new budget.
+	cmd.Short = `*Public Preview* Create new budget.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Create new budget.
 
   Create a new budget configuration for an account. For full details, see
   https://docs.databricks.com/en/admin/account-settings/budgets.html.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustAccountClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -87,7 +98,7 @@ func newCreate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := a.Budgets.Create(ctx, createReq)
@@ -125,8 +136,10 @@ func newDelete() *cobra.Command {
 	var deleteReq billing.DeleteBudgetConfigurationRequest
 
 	cmd.Use = "delete BUDGET_ID"
-	cmd.Short = `Delete budget.`
-	cmd.Long = `Delete budget.
+	cmd.Short = `*Public Preview* Delete budget.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Delete budget.
 
   Deletes a budget configuration for an account. Both account and budget
   configuration are specified by ID. This cannot be undone.
@@ -135,6 +148,8 @@ func newDelete() *cobra.Command {
     BUDGET_ID: The Databricks budget configuration ID.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -182,8 +197,10 @@ func newGet() *cobra.Command {
 	var getReq billing.GetBudgetConfigurationRequest
 
 	cmd.Use = "get BUDGET_ID"
-	cmd.Short = `Get budget.`
-	cmd.Long = `Get budget.
+	cmd.Short = `*Public Preview* Get budget.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get budget.
 
   Gets a budget configuration for an account. Both account and budget
   configuration are specified by ID.
@@ -192,6 +209,8 @@ func newGet() *cobra.Command {
     BUDGET_ID: The budget configuration ID`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -251,12 +270,16 @@ func newList() *cobra.Command {
 	cmd.Flags().Lookup("page-token").Hidden = true
 
 	cmd.Use = "list"
-	cmd.Short = `Get all budgets.`
-	cmd.Long = `Get all budgets.
+	cmd.Short = `*Public Preview* Get all budgets.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get all budgets.
 
   Gets all budgets associated with this account.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -309,8 +332,10 @@ func newUpdate() *cobra.Command {
 	cmd.Flags().Var(&updateJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Use = "update BUDGET_ID"
-	cmd.Short = `Modify budget.`
-	cmd.Long = `Modify budget.
+	cmd.Short = `*Public Preview* Modify budget.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Modify budget.
 
   Updates a budget configuration for an account. Both account and budget
   configuration are specified by ID.
@@ -319,6 +344,8 @@ func newUpdate() *cobra.Command {
     BUDGET_ID: The Databricks budget configuration ID.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -342,7 +369,7 @@ func newUpdate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 		updateReq.BudgetId = args[0]
 
diff --git a/cmd/account/cmd.go b/cmd/account/cmd.go
index 22f8ba8c407..74709c06020 100644
--- a/cmd/account/cmd.go
+++ b/cmd/account/cmd.go
@@ -11,6 +11,7 @@ import (
 	budgets "github.com/databricks/cli/cmd/account/budgets"
 	credentials "github.com/databricks/cli/cmd/account/credentials"
 	custom_app_integration "github.com/databricks/cli/cmd/account/custom-app-integration"
+	disaster_recovery "github.com/databricks/cli/cmd/account/disaster-recovery"
 	encryption_keys "github.com/databricks/cli/cmd/account/encryption-keys"
 	endpoints "github.com/databricks/cli/cmd/account/endpoints"
 	account_federation_policy "github.com/databricks/cli/cmd/account/federation-policy"
@@ -25,6 +26,7 @@ import (
 	networks "github.com/databricks/cli/cmd/account/networks"
 	o_auth_published_apps "github.com/databricks/cli/cmd/account/o-auth-published-apps"
 	private_access "github.com/databricks/cli/cmd/account/private-access"
+	private_network_gateways "github.com/databricks/cli/cmd/account/private-network-gateways"
 	published_app_integration "github.com/databricks/cli/cmd/account/published-app-integration"
 	service_principal_federation_policy "github.com/databricks/cli/cmd/account/service-principal-federation-policy"
 	service_principal_secrets "github.com/databricks/cli/cmd/account/service-principal-secrets"
@@ -57,6 +59,7 @@ func New() *cobra.Command {
 	cmd.AddCommand(budgets.New())
 	cmd.AddCommand(credentials.New())
 	cmd.AddCommand(custom_app_integration.New())
+	cmd.AddCommand(disaster_recovery.New())
 	cmd.AddCommand(encryption_keys.New())
 	cmd.AddCommand(endpoints.New())
 	cmd.AddCommand(account_federation_policy.New())
@@ -71,6 +74,7 @@ func New() *cobra.Command {
 	cmd.AddCommand(networks.New())
 	cmd.AddCommand(o_auth_published_apps.New())
 	cmd.AddCommand(private_access.New())
+	cmd.AddCommand(private_network_gateways.New())
 	cmd.AddCommand(published_app_integration.New())
 	cmd.AddCommand(service_principal_federation_policy.New())
 	cmd.AddCommand(service_principal_secrets.New())
diff --git a/cmd/account/credentials/credentials.go b/cmd/account/credentials/credentials.go
old mode 100755
new mode 100644
index a940bf547d7..580a650e889
--- a/cmd/account/credentials/credentials.go
+++ b/cmd/account/credentials/credentials.go
@@ -3,7 +3,7 @@
 package credentials
 
 import (
-	"fmt"
+	"errors"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
@@ -30,6 +30,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -81,6 +85,8 @@ func newCreate() *cobra.Command {
   [Create a new workspace using the Account API]: http://docs.databricks.com/administration-guide/account-api/new-workspace.html`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustAccountClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -99,7 +105,7 @@ func newCreate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := a.Credentials.Create(ctx, createReq)
@@ -148,6 +154,8 @@ func newDelete() *cobra.Command {
     CREDENTIALS_ID: Databricks Account API credential configuration ID`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -206,6 +214,8 @@ func newGet() *cobra.Command {
     CREDENTIALS_ID: Credential configuration ID`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -258,6 +268,8 @@ func newList() *cobra.Command {
   ID.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustAccountClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
diff --git a/cmd/account/csp-enablement-account/csp-enablement-account.go b/cmd/account/csp-enablement-account/csp-enablement-account.go
old mode 100755
new mode 100644
index f4d5388981f..6e90bdae435
--- a/cmd/account/csp-enablement-account/csp-enablement-account.go
+++ b/cmd/account/csp-enablement-account/csp-enablement-account.go
@@ -3,7 +3,7 @@
 package csp_enablement_account
 
 import (
-	"fmt"
+	"errors"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
@@ -20,8 +20,10 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "csp-enablement-account",
-		Short: `The compliance security profile settings at the account level control whether to enable it for new workspaces.`,
-		Long: `The compliance security profile settings at the account level control whether
+		Short: `*Public Preview* The compliance security profile settings at the account level control whether to enable it for new workspaces.`,
+		Long: `This command is in Public Preview and may change without notice.
+
+The compliance security profile settings at the account level control whether
   to enable it for new workspaces. By default, this account-level setting is
   disabled for new workspaces. After workspace creation, account admins can
   enable the compliance security profile individually for each workspace.
@@ -31,6 +33,10 @@ func New() *cobra.Command {
 		RunE: root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
 	// Add methods
 	cmd.AddCommand(newGet())
 	cmd.AddCommand(newUpdate())
@@ -60,12 +66,16 @@ func newGet() *cobra.Command {
 	cmd.Flags().StringVar(&getReq.Etag, "etag", getReq.Etag, `etag used for versioning.`)
 
 	cmd.Use = "get"
-	cmd.Short = `Get the compliance security profile setting for new workspaces.`
-	cmd.Long = `Get the compliance security profile setting for new workspaces.
+	cmd.Short = `*Public Preview* Get the compliance security profile setting for new workspaces.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get the compliance security profile setting for new workspaces.
 
   Gets the compliance security profile setting for new workspaces.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -115,13 +125,17 @@ func newUpdate() *cobra.Command {
 	cmd.Flags().Var(&updateJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Use = "update"
-	cmd.Short = `Update the compliance security profile setting for new workspaces.`
-	cmd.Long = `Update the compliance security profile setting for new workspaces.
+	cmd.Short = `*Public Preview* Update the compliance security profile setting for new workspaces.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Update the compliance security profile setting for new workspaces.
 
   Updates the value of the compliance security profile setting for new
   workspaces.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustAccountClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -140,7 +154,7 @@ func newUpdate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := a.Settings.CspEnablementAccount().Update(ctx, updateReq)
diff --git a/cmd/account/custom-app-integration/custom-app-integration.go b/cmd/account/custom-app-integration/custom-app-integration.go
old mode 100755
new mode 100644
index 7e1f79bcef8..16882132e51
--- a/cmd/account/custom-app-integration/custom-app-integration.go
+++ b/cmd/account/custom-app-integration/custom-app-integration.go
@@ -28,6 +28,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -74,9 +78,13 @@ func newCreate() *cobra.Command {
   Create Custom OAuth App Integration.
 
   You can retrieve the custom OAuth app integration via
-  :method:CustomAppIntegration/get.`
+  [CustomAppIntegration/get].
+
+  [CustomAppIntegration/get]: https://docs.databricks.com/api/account/customappintegration/get`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -140,9 +148,13 @@ func newDelete() *cobra.Command {
 	cmd.Long = `Delete Custom OAuth App Integration.
 
   Delete an existing Custom OAuth App Integration. You can retrieve the custom
-  OAuth app integration via :method:CustomAppIntegration/get.`
+  OAuth app integration via [CustomAppIntegration/get].
+
+  [CustomAppIntegration/get]: https://docs.databricks.com/api/account/customappintegration/get`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -199,6 +211,8 @@ func newGet() *cobra.Command {
     INTEGRATION_ID: The OAuth app integration ID.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -268,6 +282,8 @@ func newList() *cobra.Command {
   account`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -329,9 +345,13 @@ func newUpdate() *cobra.Command {
 	cmd.Long = `Updates Custom OAuth App Integration.
 
   Updates an existing custom OAuth App Integration. You can retrieve the custom
-  OAuth app integration via :method:CustomAppIntegration/get.`
+  OAuth app integration via [CustomAppIntegration/get].
+
+  [CustomAppIntegration/get]: https://docs.databricks.com/api/account/customappintegration/get`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/account/disable-legacy-features/disable-legacy-features.go b/cmd/account/disable-legacy-features/disable-legacy-features.go
old mode 100755
new mode 100644
index 32d554869d2..7ded95ff0a3
--- a/cmd/account/disable-legacy-features/disable-legacy-features.go
+++ b/cmd/account/disable-legacy-features/disable-legacy-features.go
@@ -3,7 +3,7 @@
 package disable_legacy_features
 
 import (
-	"fmt"
+	"errors"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
@@ -29,6 +29,10 @@ func New() *cobra.Command {
 		RunE: root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newDelete())
 	cmd.AddCommand(newGet())
@@ -65,6 +69,8 @@ func newDelete() *cobra.Command {
   Deletes the disable legacy features setting.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -119,6 +125,8 @@ func newGet() *cobra.Command {
   Gets the value of the disable legacy features setting.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -174,6 +182,8 @@ func newUpdate() *cobra.Command {
   Updates the value of the disable legacy features setting.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustAccountClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -192,7 +202,7 @@ func newUpdate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := a.Settings.DisableLegacyFeatures().Update(ctx, updateReq)
diff --git a/cmd/account/disaster-recovery/disaster-recovery.go b/cmd/account/disaster-recovery/disaster-recovery.go
new file mode 100644
index 00000000000..5189b96118e
--- /dev/null
+++ b/cmd/account/disaster-recovery/disaster-recovery.go
@@ -0,0 +1,867 @@
+// Code generated from OpenAPI specs by Databricks SDK Generator. DO NOT EDIT.
+
+package disaster_recovery
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/databricks-sdk-go/common/types/fieldmask"
+	"github.com/databricks/databricks-sdk-go/service/disasterrecovery"
+	"github.com/spf13/cobra"
+)
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var cmdOverrides []func(*cobra.Command)
+
+func New() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:     "disaster-recovery",
+		Short:   `Manage disaster recovery configurations and execute failover operations.`,
+		Long:    `Manage disaster recovery configurations and execute failover operations.`,
+		GroupID: "disasterrecovery",
+		RunE:    root.ReportUnknownSubcommand,
+	}
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	// Add methods
+	cmd.AddCommand(newCreateFailoverGroup())
+	cmd.AddCommand(newCreateStableUrl())
+	cmd.AddCommand(newDeleteFailoverGroup())
+	cmd.AddCommand(newDeleteStableUrl())
+	cmd.AddCommand(newFailoverFailoverGroup())
+	cmd.AddCommand(newGetFailoverGroup())
+	cmd.AddCommand(newGetStableUrl())
+	cmd.AddCommand(newListFailoverGroups())
+	cmd.AddCommand(newListStableUrls())
+	cmd.AddCommand(newUpdateFailoverGroup())
+
+	// Apply optional overrides to this command.
+	for _, fn := range cmdOverrides {
+		fn(cmd)
+	}
+
+	return cmd
+}
+
+// start create-failover-group command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var createFailoverGroupOverrides []func(
+	*cobra.Command,
+	*disasterrecovery.CreateFailoverGroupRequest,
+)
+
+func newCreateFailoverGroup() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var createFailoverGroupReq disasterrecovery.CreateFailoverGroupRequest
+	createFailoverGroupReq.FailoverGroup = disasterrecovery.FailoverGroup{}
+	var createFailoverGroupJson flags.JsonFlag
+
+	cmd.Flags().Var(&createFailoverGroupJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().BoolVar(&createFailoverGroupReq.ValidateOnly, "validate-only", createFailoverGroupReq.ValidateOnly, `When true, validates the request without creating the failover group.`)
+	// TODO: complex arg: initial_replication_progress
+	cmd.Flags().StringVar(&createFailoverGroupReq.FailoverGroup.Name, "name", createFailoverGroupReq.FailoverGroup.Name, `Fully qualified resource name in the format accounts/{account_id}/failover-groups/{failover_group_id}.`)
+	// TODO: complex arg: unity_catalog_assets
+
+	cmd.Use = "create-failover-group PARENT FAILOVER_GROUP_ID REGIONS WORKSPACE_SETS INITIAL_PRIMARY_REGION"
+	cmd.Short = `Create a Failover Group.`
+	cmd.Long = `Create a Failover Group.
+
+  Create a new failover group.
+
+  Arguments:
+    PARENT: The parent resource. Format: accounts/{account_id}.
+    FAILOVER_GROUP_ID: Client-provided identifier for the failover group. Used to construct the
+      resource name as {parent}/failover-groups/{failover_group_id}.
+    REGIONS: List of all regions participating in this failover group.
+    WORKSPACE_SETS: Workspace sets, each containing workspaces that replicate to each other.
+    INITIAL_PRIMARY_REGION: Initial primary region. Used only in Create requests to set the starting
+      primary region. Not returned in responses.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(2)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only PARENT, FAILOVER_GROUP_ID as positional arguments. Provide 'regions', 'workspace_sets', 'initial_primary_region' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(5)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := createFailoverGroupJson.Unmarshal(&createFailoverGroupReq.FailoverGroup)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		createFailoverGroupReq.Parent = args[0]
+		createFailoverGroupReq.FailoverGroupId = args[1]
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[2], &createFailoverGroupReq.FailoverGroup.Regions)
+			if err != nil {
+				return fmt.Errorf("invalid REGIONS: %s", args[2])
+			}
+
+		}
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[3], &createFailoverGroupReq.FailoverGroup.WorkspaceSets)
+			if err != nil {
+				return fmt.Errorf("invalid WORKSPACE_SETS: %s", args[3])
+			}
+
+		}
+		if !cmd.Flags().Changed("json") {
+			createFailoverGroupReq.FailoverGroup.InitialPrimaryRegion = args[4]
+		}
+
+		response, err := a.DisasterRecovery.CreateFailoverGroup(ctx, createFailoverGroupReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range createFailoverGroupOverrides {
+		fn(cmd, &createFailoverGroupReq)
+	}
+
+	return cmd
+}
+
+// start create-stable-url command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var createStableUrlOverrides []func(
+	*cobra.Command,
+	*disasterrecovery.CreateStableUrlRequest,
+)
+
+func newCreateStableUrl() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var createStableUrlReq disasterrecovery.CreateStableUrlRequest
+	createStableUrlReq.StableUrl = disasterrecovery.StableUrl{}
+	var createStableUrlJson flags.JsonFlag
+
+	cmd.Flags().Var(&createStableUrlJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().BoolVar(&createStableUrlReq.ValidateOnly, "validate-only", createStableUrlReq.ValidateOnly, `When true, validates the request without creating the stable URL.`)
+	cmd.Flags().StringVar(&createStableUrlReq.StableUrl.Name, "name", createStableUrlReq.StableUrl.Name, `Fully qualified resource name.`)
+
+	cmd.Use = "create-stable-url PARENT STABLE_URL_ID INITIAL_WORKSPACE_ID"
+	cmd.Short = `Create a Stable URL.`
+	cmd.Long = `Create a Stable URL.
+
+  Create a new stable URL.
+
+  Arguments:
+    PARENT: The parent resource. Format: accounts/{account_id}.
+    STABLE_URL_ID: Client-provided identifier for the stable URL. Used to construct the
+      resource name as {parent}/stable-urls/{stable_url_id}.
+    INITIAL_WORKSPACE_ID: The workspace this stable URL is initially bound to. Used only in Create
+      requests to associate the stable URL with a workspace. Not returned in
+      responses.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(2)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only PARENT, STABLE_URL_ID as positional arguments. Provide 'initial_workspace_id' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(3)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := createStableUrlJson.Unmarshal(&createStableUrlReq.StableUrl)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		createStableUrlReq.Parent = args[0]
+		createStableUrlReq.StableUrlId = args[1]
+		if !cmd.Flags().Changed("json") {
+			createStableUrlReq.StableUrl.InitialWorkspaceId = args[2]
+		}
+
+		response, err := a.DisasterRecovery.CreateStableUrl(ctx, createStableUrlReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range createStableUrlOverrides {
+		fn(cmd, &createStableUrlReq)
+	}
+
+	return cmd
+}
+
+// start delete-failover-group command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteFailoverGroupOverrides []func(
+	*cobra.Command,
+	*disasterrecovery.DeleteFailoverGroupRequest,
+)
+
+func newDeleteFailoverGroup() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteFailoverGroupReq disasterrecovery.DeleteFailoverGroupRequest
+
+	cmd.Flags().StringVar(&deleteFailoverGroupReq.Etag, "etag", deleteFailoverGroupReq.Etag, `Opaque version string for optimistic locking.`)
+
+	cmd.Use = "delete-failover-group NAME"
+	cmd.Short = `Delete a Failover Group.`
+	cmd.Long = `Delete a Failover Group.
+
+  Delete a failover group.
+
+  Arguments:
+    NAME: The fully qualified resource name of the failover group to delete. Format:
+      accounts/{account_id}/failover-groups/{failover_group_id}.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		deleteFailoverGroupReq.Name = args[0]
+
+		err = a.DisasterRecovery.DeleteFailoverGroup(ctx, deleteFailoverGroupReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteFailoverGroupOverrides {
+		fn(cmd, &deleteFailoverGroupReq)
+	}
+
+	return cmd
+}
+
+// start delete-stable-url command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteStableUrlOverrides []func(
+	*cobra.Command,
+	*disasterrecovery.DeleteStableUrlRequest,
+)
+
+func newDeleteStableUrl() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteStableUrlReq disasterrecovery.DeleteStableUrlRequest
+
+	cmd.Use = "delete-stable-url NAME"
+	cmd.Short = `Delete a Stable URL.`
+	cmd.Long = `Delete a Stable URL.
+
+  Delete a stable URL.
+
+  Arguments:
+    NAME: The fully qualified resource name. Format:
+      accounts/{account_id}/stable-urls/{stable_url_id}.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		deleteStableUrlReq.Name = args[0]
+
+		err = a.DisasterRecovery.DeleteStableUrl(ctx, deleteStableUrlReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteStableUrlOverrides {
+		fn(cmd, &deleteStableUrlReq)
+	}
+
+	return cmd
+}
+
+// start failover-failover-group command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var failoverFailoverGroupOverrides []func(
+	*cobra.Command,
+	*disasterrecovery.FailoverFailoverGroupRequest,
+)
+
+func newFailoverFailoverGroup() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var failoverFailoverGroupReq disasterrecovery.FailoverFailoverGroupRequest
+	var failoverFailoverGroupJson flags.JsonFlag
+
+	cmd.Flags().Var(&failoverFailoverGroupJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&failoverFailoverGroupReq.Etag, "etag", failoverFailoverGroupReq.Etag, `Opaque version string for optimistic locking.`)
+
+	cmd.Use = "failover-failover-group NAME TARGET_PRIMARY_REGION FAILOVER_TYPE"
+	cmd.Short = `Failover a Failover Group to a new primary region.`
+	cmd.Long = `Failover a Failover Group to a new primary region.
+
+  Initiate a failover to a new primary region.
+
+  Arguments:
+    NAME: The fully qualified resource name of the failover group to failover.
+      Format: accounts/{account_id}/failover-groups/{failover_group_id}.
+    TARGET_PRIMARY_REGION: The target primary region. Must be one of the participating regions and
+      different from the current effective_primary_region. Serves as an
+      idempotency check.
+    FAILOVER_TYPE: The type of failover to perform.
+      Supported values: [FORCED]`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(1)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only NAME as positional arguments. Provide 'target_primary_region', 'failover_type' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(3)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := failoverFailoverGroupJson.Unmarshal(&failoverFailoverGroupReq)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		failoverFailoverGroupReq.Name = args[0]
+		if !cmd.Flags().Changed("json") {
+			failoverFailoverGroupReq.TargetPrimaryRegion = args[1]
+		}
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[2], &failoverFailoverGroupReq.FailoverType)
+			if err != nil {
+				return fmt.Errorf("invalid FAILOVER_TYPE: %s", args[2])
+			}
+
+		}
+
+		response, err := a.DisasterRecovery.FailoverFailoverGroup(ctx, failoverFailoverGroupReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range failoverFailoverGroupOverrides {
+		fn(cmd, &failoverFailoverGroupReq)
+	}
+
+	return cmd
+}
+
+// start get-failover-group command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getFailoverGroupOverrides []func(
+	*cobra.Command,
+	*disasterrecovery.GetFailoverGroupRequest,
+)
+
+func newGetFailoverGroup() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getFailoverGroupReq disasterrecovery.GetFailoverGroupRequest
+
+	cmd.Use = "get-failover-group NAME"
+	cmd.Short = `Get a Failover Group.`
+	cmd.Long = `Get a Failover Group.
+
+  Get a failover group.
+
+  Arguments:
+    NAME: The fully qualified resource name of the failover group. Format:
+      accounts/{account_id}/failover-groups/{failover_group_id}.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		getFailoverGroupReq.Name = args[0]
+
+		response, err := a.DisasterRecovery.GetFailoverGroup(ctx, getFailoverGroupReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getFailoverGroupOverrides {
+		fn(cmd, &getFailoverGroupReq)
+	}
+
+	return cmd
+}
+
+// start get-stable-url command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getStableUrlOverrides []func(
+	*cobra.Command,
+	*disasterrecovery.GetStableUrlRequest,
+)
+
+func newGetStableUrl() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getStableUrlReq disasterrecovery.GetStableUrlRequest
+
+	cmd.Use = "get-stable-url NAME"
+	cmd.Short = `Get a Stable URL.`
+	cmd.Long = `Get a Stable URL.
+
+  Get a stable URL.
+
+  Arguments:
+    NAME: The fully qualified resource name. Format:
+      accounts/{account_id}/stable-urls/{stable_url_id}.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		getStableUrlReq.Name = args[0]
+
+		response, err := a.DisasterRecovery.GetStableUrl(ctx, getStableUrlReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getStableUrlOverrides {
+		fn(cmd, &getStableUrlReq)
+	}
+
+	return cmd
+}
+
+// start list-failover-groups command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listFailoverGroupsOverrides []func(
+	*cobra.Command,
+	*disasterrecovery.ListFailoverGroupsRequest,
+)
+
+func newListFailoverGroups() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listFailoverGroupsReq disasterrecovery.ListFailoverGroupsRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listFailoverGroupsLimit int
+
+	cmd.Flags().IntVar(&listFailoverGroupsReq.PageSize, "page-size", listFailoverGroupsReq.PageSize, `Maximum number of failover groups to return per page: - when set to a value greater than 0, the page length is the minimum of this value and a server configured value; - when set to 0 or unset, the page length is set to a server configured value (recommended); - when set to a value less than 0, an invalid parameter error is returned.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listFailoverGroupsLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listFailoverGroupsReq.PageToken, "page-token", listFailoverGroupsReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-failover-groups PARENT"
+	cmd.Short = `List Failover Groups.`
+	cmd.Long = `List Failover Groups.
+
+  List failover groups.
+
+  List entries are abbreviated: state and replication_point are not
+  populated. Call GetFailoverGroup to retrieve the full resource.
+
+  Arguments:
+    PARENT: The parent resource. Format: accounts/{account_id}.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		listFailoverGroupsReq.Parent = args[0]
+
+		response := a.DisasterRecovery.ListFailoverGroups(ctx, listFailoverGroupsReq)
+		if listFailoverGroupsLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listFailoverGroupsLimit)
+		}
+		if listFailoverGroupsLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listFailoverGroupsLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listFailoverGroupsOverrides {
+		fn(cmd, &listFailoverGroupsReq)
+	}
+
+	return cmd
+}
+
+// start list-stable-urls command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listStableUrlsOverrides []func(
+	*cobra.Command,
+	*disasterrecovery.ListStableUrlsRequest,
+)
+
+func newListStableUrls() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listStableUrlsReq disasterrecovery.ListStableUrlsRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listStableUrlsLimit int
+
+	cmd.Flags().IntVar(&listStableUrlsReq.PageSize, "page-size", listStableUrlsReq.PageSize, `Maximum number of stable URLs to return per page: - when set to a value greater than 0, the page length is the minimum of this value and a server configured value; - when set to 0 or unset, the page length is set to a server configured value (recommended); - when set to a value less than 0, an invalid parameter error is returned.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listStableUrlsLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listStableUrlsReq.PageToken, "page-token", listStableUrlsReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-stable-urls PARENT"
+	cmd.Short = `List Stable URLs.`
+	cmd.Long = `List Stable URLs.
+
+  List stable URLs for an account.
+
+  Arguments:
+    PARENT: The parent resource. Format: accounts/{account_id}.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		listStableUrlsReq.Parent = args[0]
+
+		response := a.DisasterRecovery.ListStableUrls(ctx, listStableUrlsReq)
+		if listStableUrlsLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listStableUrlsLimit)
+		}
+		if listStableUrlsLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listStableUrlsLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listStableUrlsOverrides {
+		fn(cmd, &listStableUrlsReq)
+	}
+
+	return cmd
+}
+
+// start update-failover-group command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateFailoverGroupOverrides []func(
+	*cobra.Command,
+	*disasterrecovery.UpdateFailoverGroupRequest,
+)
+
+func newUpdateFailoverGroup() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateFailoverGroupReq disasterrecovery.UpdateFailoverGroupRequest
+	updateFailoverGroupReq.FailoverGroup = disasterrecovery.FailoverGroup{}
+	var updateFailoverGroupJson flags.JsonFlag
+
+	cmd.Flags().Var(&updateFailoverGroupJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&updateFailoverGroupReq.Etag, "etag", updateFailoverGroupReq.Etag, `Optional opaque version string for optimistic locking, obtained from a prior read of the failover group.`)
+	// TODO: complex arg: initial_replication_progress
+	cmd.Flags().StringVar(&updateFailoverGroupReq.FailoverGroup.Name, "name", updateFailoverGroupReq.FailoverGroup.Name, `Fully qualified resource name in the format accounts/{account_id}/failover-groups/{failover_group_id}.`)
+	// TODO: complex arg: unity_catalog_assets
+
+	cmd.Use = "update-failover-group NAME UPDATE_MASK REGIONS WORKSPACE_SETS INITIAL_PRIMARY_REGION"
+	cmd.Short = `Update a Failover Group.`
+	cmd.Long = `Update a Failover Group.
+
+  Update a failover group.
+
+  Arguments:
+    NAME: Fully qualified resource name in the format
+      accounts/{account_id}/failover-groups/{failover_group_id}.
+    UPDATE_MASK: Comma-separated list of fields to update.
+    REGIONS: List of all regions participating in this failover group.
+    WORKSPACE_SETS: Workspace sets, each containing workspaces that replicate to each other.
+    INITIAL_PRIMARY_REGION: Initial primary region. Used only in Create requests to set the starting
+      primary region. Not returned in responses.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(2)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only NAME, UPDATE_MASK as positional arguments. Provide 'regions', 'workspace_sets', 'initial_primary_region' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(5)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updateFailoverGroupJson.Unmarshal(&updateFailoverGroupReq.FailoverGroup)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		updateFailoverGroupReq.Name = args[0]
+		if args[1] != "" {
+			updateMaskArray := strings.Split(args[1], ",")
+			updateFailoverGroupReq.UpdateMask = *fieldmask.New(updateMaskArray)
+		}
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[2], &updateFailoverGroupReq.FailoverGroup.Regions)
+			if err != nil {
+				return fmt.Errorf("invalid REGIONS: %s", args[2])
+			}
+
+		}
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[3], &updateFailoverGroupReq.FailoverGroup.WorkspaceSets)
+			if err != nil {
+				return fmt.Errorf("invalid WORKSPACE_SETS: %s", args[3])
+			}
+
+		}
+		if !cmd.Flags().Changed("json") {
+			updateFailoverGroupReq.FailoverGroup.InitialPrimaryRegion = args[4]
+		}
+
+		response, err := a.DisasterRecovery.UpdateFailoverGroup(ctx, updateFailoverGroupReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateFailoverGroupOverrides {
+		fn(cmd, &updateFailoverGroupReq)
+	}
+
+	return cmd
+}
+
+// end service DisasterRecovery
diff --git a/cmd/account/enable-ip-access-lists/enable-ip-access-lists.go b/cmd/account/enable-ip-access-lists/enable-ip-access-lists.go
old mode 100755
new mode 100644
index f1329c9732c..e417dc92144
--- a/cmd/account/enable-ip-access-lists/enable-ip-access-lists.go
+++ b/cmd/account/enable-ip-access-lists/enable-ip-access-lists.go
@@ -3,7 +3,7 @@
 package enable_ip_access_lists
 
 import (
-	"fmt"
+	"errors"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
@@ -29,6 +29,10 @@ func New() *cobra.Command {
 		RunE:   root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
 	// Add methods
 	cmd.AddCommand(newDelete())
 	cmd.AddCommand(newGet())
@@ -65,6 +69,8 @@ func newDelete() *cobra.Command {
   Reverts the value of the account IP access toggle setting to default (ON)`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -119,6 +125,8 @@ func newGet() *cobra.Command {
   Gets the value of the account IP access toggle setting.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -174,6 +182,8 @@ func newUpdate() *cobra.Command {
   Updates the value of the account IP access toggle setting.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.PreRunE = root.MustAccountClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -192,7 +202,7 @@ func newUpdate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := a.Settings.EnableIpAccessLists().Update(ctx, updateReq)
diff --git a/cmd/account/encryption-keys/encryption-keys.go b/cmd/account/encryption-keys/encryption-keys.go
old mode 100755
new mode 100644
index dd0ee03b2c8..941fe953d43
--- a/cmd/account/encryption-keys/encryption-keys.go
+++ b/cmd/account/encryption-keys/encryption-keys.go
@@ -3,7 +3,7 @@
 package encryption_keys
 
 import (
-	"fmt"
+	"errors"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
@@ -41,6 +41,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -73,6 +77,7 @@ func newCreate() *cobra.Command {
 	cmd.Flags().Var(&createJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	// TODO: complex arg: aws_key_info
+	// TODO: complex arg: azure_key_info
 	// TODO: complex arg: gcp_key_info
 
 	cmd.Use = "create"
@@ -95,9 +100,21 @@ func newCreate() *cobra.Command {
 
   This operation is available only if your account is on the E2 version of the
   platform or on a select custom plan that allows multiple workspaces per
-  account.`
+  account.
+
+  **GCP only**: To create a customer-managed key on GCP, you must include the
+  X-Databricks-GCP-SA-Access-Token HTTP header in your request. This header
+  must contain a Google Cloud OAuth access token with the cloud-platform
+  scope. The Google identity associated with the token must also have the
+  setIamPermissions and getIamPermissions IAM permissions on the key
+  resource. For details on obtaining this token, see [Authenticate with Google
+  ID tokens].
+
+  [Authenticate with Google ID tokens]: https://docs.databricks.com/gcp/en/dev-tools/auth/authentication-google-id.html`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustAccountClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -116,7 +133,7 @@ func newCreate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := a.EncryptionKeys.Create(ctx, createReq)
@@ -164,6 +181,8 @@ func newDelete() *cobra.Command {
     CUSTOMER_MANAGED_KEY_ID: Databricks encryption key configuration ID.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -235,6 +254,8 @@ func newGet() *cobra.Command {
     CUSTOMER_MANAGED_KEY_ID: Databricks encryption key configuration ID.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -286,6 +307,8 @@ func newList() *cobra.Command {
   Lists Databricks customer-managed key configurations for an account.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustAccountClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
diff --git a/cmd/account/endpoints/endpoints.go b/cmd/account/endpoints/endpoints.go
old mode 100755
new mode 100644
index 3c8a78bbd1d..8cdb1b5c73f
--- a/cmd/account/endpoints/endpoints.go
+++ b/cmd/account/endpoints/endpoints.go
@@ -3,6 +3,7 @@
 package endpoints
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -26,6 +27,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreateEndpoint())
 	cmd.AddCommand(newDeleteEndpoint())
@@ -58,7 +63,9 @@ func newCreateEndpoint() *cobra.Command {
 
 	cmd.Flags().Var(&createEndpointJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
+	// TODO: complex arg: aws_vpc_endpoint_info
 	// TODO: complex arg: azure_private_endpoint_info
+	// TODO: complex arg: gcp_psc_endpoint_info
 
 	cmd.Use = "create-endpoint PARENT DISPLAY_NAME REGION"
 	cmd.Short = `Create a network endpoint.`
@@ -83,12 +90,14 @@ func newCreateEndpoint() *cobra.Command {
     REGION: The cloud provider region where this endpoint is located.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(1)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only PARENT as positional arguments. Provide 'display_name', 'region' in your JSON input")
+				return errors.New("when --json flag is specified, provide only PARENT as positional arguments. Provide 'display_name', 'region' in your JSON input")
 			}
 			return nil
 		}
@@ -164,6 +173,8 @@ func newDeleteEndpoint() *cobra.Command {
   delete corresponding network resources in your cloud provider account.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -217,6 +228,8 @@ func newGetEndpoint() *cobra.Command {
   Gets details of a specific network endpoint.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -288,6 +301,8 @@ func newListEndpoints() *cobra.Command {
       accounts/{account_id}.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/account/esm-enablement-account/esm-enablement-account.go b/cmd/account/esm-enablement-account/esm-enablement-account.go
old mode 100755
new mode 100644
index d7468cf8f68..75af94183a2
--- a/cmd/account/esm-enablement-account/esm-enablement-account.go
+++ b/cmd/account/esm-enablement-account/esm-enablement-account.go
@@ -3,7 +3,7 @@
 package esm_enablement_account
 
 import (
-	"fmt"
+	"errors"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
@@ -20,8 +20,10 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "esm-enablement-account",
-		Short: `The enhanced security monitoring setting at the account level controls whether to enable the feature on new workspaces.`,
-		Long: `The enhanced security monitoring setting at the account level controls whether
+		Short: `*Public Preview* The enhanced security monitoring setting at the account level controls whether to enable the feature on new workspaces.`,
+		Long: `This command is in Public Preview and may change without notice.
+
+The enhanced security monitoring setting at the account level controls whether
   to enable the feature on new workspaces. By default, this account-level
   setting is disabled for new workspaces. After workspace creation, account
   admins can enable enhanced security monitoring individually for each
@@ -29,6 +31,10 @@ func New() *cobra.Command {
 		RunE: root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
 	// Add methods
 	cmd.AddCommand(newGet())
 	cmd.AddCommand(newUpdate())
@@ -58,12 +64,16 @@ func newGet() *cobra.Command {
 	cmd.Flags().StringVar(&getReq.Etag, "etag", getReq.Etag, `etag used for versioning.`)
 
 	cmd.Use = "get"
-	cmd.Short = `Get the enhanced security monitoring setting for new workspaces.`
-	cmd.Long = `Get the enhanced security monitoring setting for new workspaces.
+	cmd.Short = `*Public Preview* Get the enhanced security monitoring setting for new workspaces.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get the enhanced security monitoring setting for new workspaces.
 
   Gets the enhanced security monitoring setting for new workspaces.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -113,13 +123,17 @@ func newUpdate() *cobra.Command {
 	cmd.Flags().Var(&updateJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Use = "update"
-	cmd.Short = `Update the enhanced security monitoring setting for new workspaces.`
-	cmd.Long = `Update the enhanced security monitoring setting for new workspaces.
+	cmd.Short = `*Public Preview* Update the enhanced security monitoring setting for new workspaces.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Update the enhanced security monitoring setting for new workspaces.
 
   Updates the value of the enhanced security monitoring setting for new
   workspaces.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustAccountClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -138,7 +152,7 @@ func newUpdate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := a.Settings.EsmEnablementAccount().Update(ctx, updateReq)
diff --git a/cmd/account/federation-policy/federation-policy.go b/cmd/account/federation-policy/federation-policy.go
old mode 100755
new mode 100644
index 64610ef39df..f9ccb47c442
--- a/cmd/account/federation-policy/federation-policy.go
+++ b/cmd/account/federation-policy/federation-policy.go
@@ -74,6 +74,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -116,6 +120,8 @@ func newCreate() *cobra.Command {
 	cmd.Long = `Create account federation policy.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -182,6 +188,8 @@ func newDelete() *cobra.Command {
     POLICY_ID: The identifier for the federation policy.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -236,6 +244,8 @@ func newGet() *cobra.Command {
     POLICY_ID: The identifier for the federation policy.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -301,6 +311,8 @@ func newList() *cobra.Command {
 	cmd.Long = `List account federation policies.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -365,6 +377,8 @@ func newUpdate() *cobra.Command {
     POLICY_ID: The identifier for the federation policy.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/account/groups-v2/groups-v2.go b/cmd/account/groups-v2/groups-v2.go
old mode 100755
new mode 100644
index 678a9f5bb84..63c47c53ee8
--- a/cmd/account/groups-v2/groups-v2.go
+++ b/cmd/account/groups-v2/groups-v2.go
@@ -32,6 +32,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -80,6 +84,8 @@ func newCreate() *cobra.Command {
   supplied group details.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -148,6 +154,8 @@ func newDelete() *cobra.Command {
     ID: Unique ID for a group in the Databricks account.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -204,6 +212,8 @@ func newGet() *cobra.Command {
     ID: Unique ID for a group in the Databricks account.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -281,6 +291,8 @@ func newList() *cobra.Command {
   receiving member data as before.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -345,6 +357,8 @@ func newPatch() *cobra.Command {
     ID: Unique ID in the Databricks workspace.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -422,6 +436,8 @@ func newUpdate() *cobra.Command {
     ID: Databricks group ID`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/account/groups.go b/cmd/account/groups.go
index 53dd7b8f02f..267aaa3b184 100644
--- a/cmd/account/groups.go
+++ b/cmd/account/groups.go
@@ -32,5 +32,9 @@ func Groups() []cobra.Group {
 			ID:    "oauth2",
 			Title: "OAuth",
 		},
+		{
+			ID:    "disasterrecovery",
+			Title: "Disaster Recovery",
+		},
 	}
 }
diff --git a/cmd/account/iam-v2/iam-v2.go b/cmd/account/iam-v2/iam-v2.go
old mode 100755
new mode 100644
index 028c48b47b9..b36643f1e3e
--- a/cmd/account/iam-v2/iam-v2.go
+++ b/cmd/account/iam-v2/iam-v2.go
@@ -3,12 +3,15 @@
 package iam_v2
 
 import (
+	"errors"
 	"fmt"
+	"strings"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/databricks-sdk-go/common/types/fieldmask"
 	"github.com/databricks/databricks-sdk-go/service/iamv2"
 	"github.com/spf13/cobra"
 )
@@ -20,18 +23,59 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "iam-v2",
-		Short: `These APIs are used to manage identities and the workspace access of these identities in <Databricks>.`,
+		Short: `These APIs are used to manage identities and the workspace access of these identities in Databricks.`,
 		Long: `These APIs are used to manage identities and the workspace access of these
-  identities in <Databricks>.`,
+  identities in Databricks.`,
 		GroupID: "iam",
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
+	cmd.AddCommand(newCreateDirectGroupMember())
+	cmd.AddCommand(newCreateGroup())
+	cmd.AddCommand(newCreateIdentityVisibilityFilter())
+	cmd.AddCommand(newCreateServicePrincipal())
+	cmd.AddCommand(newCreateUser())
+	cmd.AddCommand(newCreateWorkspaceAssignment())
+	cmd.AddCommand(newCreateWorkspaceAssignmentDetail())
+	cmd.AddCommand(newDeleteDirectGroupMember())
+	cmd.AddCommand(newDeleteGroup())
+	cmd.AddCommand(newDeleteIdentityVisibilityFilter())
+	cmd.AddCommand(newDeleteServicePrincipal())
+	cmd.AddCommand(newDeleteUser())
+	cmd.AddCommand(newDeleteWorkspaceAssignment())
+	cmd.AddCommand(newDeleteWorkspaceAssignmentDetail())
+	cmd.AddCommand(newGetDirectGroupMember())
+	cmd.AddCommand(newGetExternalGroup())
+	cmd.AddCommand(newGetExternalServicePrincipal())
+	cmd.AddCommand(newGetExternalUser())
+	cmd.AddCommand(newGetGroup())
+	cmd.AddCommand(newGetIdentityVisibilityFilter())
+	cmd.AddCommand(newGetServicePrincipal())
+	cmd.AddCommand(newGetUser())
 	cmd.AddCommand(newGetWorkspaceAccessDetail())
+	cmd.AddCommand(newGetWorkspaceAssignment())
+	cmd.AddCommand(newGetWorkspaceAssignmentDetail())
+	cmd.AddCommand(newListDirectGroupMembers())
+	cmd.AddCommand(newListGroups())
+	cmd.AddCommand(newListIdentityVisibilityFilters())
+	cmd.AddCommand(newListServicePrincipals())
+	cmd.AddCommand(newListTransitiveParentGroups())
+	cmd.AddCommand(newListUsers())
+	cmd.AddCommand(newListWorkspaceAssignmentDetails())
+	cmd.AddCommand(newListWorkspaceAssignments())
 	cmd.AddCommand(newResolveGroup())
 	cmd.AddCommand(newResolveServicePrincipal())
 	cmd.AddCommand(newResolveUser())
+	cmd.AddCommand(newUpdateGroup())
+	cmd.AddCommand(newUpdateServicePrincipal())
+	cmd.AddCommand(newUpdateUser())
+	cmd.AddCommand(newUpdateWorkspaceAssignment())
+	cmd.AddCommand(newUpdateWorkspaceAssignmentDetail())
 
 	// Apply optional overrides to this command.
 	for _, fn := range cmdOverrides {
@@ -41,42 +85,51 @@ func New() *cobra.Command {
 	return cmd
 }
 
-// start get-workspace-access-detail command
+// start create-direct-group-member command
 
 // Slice with functions to override default command behavior.
 // Functions can be added from the `init()` function in manually curated files in this directory.
-var getWorkspaceAccessDetailOverrides []func(
+var createDirectGroupMemberOverrides []func(
 	*cobra.Command,
-	*iamv2.GetWorkspaceAccessDetailRequest,
+	*iamv2.CreateDirectGroupMemberRequest,
 )
 
-func newGetWorkspaceAccessDetail() *cobra.Command {
+func newCreateDirectGroupMember() *cobra.Command {
 	cmd := &cobra.Command{}
 
-	var getWorkspaceAccessDetailReq iamv2.GetWorkspaceAccessDetailRequest
+	var createDirectGroupMemberReq iamv2.CreateDirectGroupMemberRequest
+	createDirectGroupMemberReq.DirectGroupMember = iamv2.DirectGroupMember{}
+	var createDirectGroupMemberJson flags.JsonFlag
 
-	cmd.Flags().Var(&getWorkspaceAccessDetailReq.View, "view", `Controls what fields are returned. Supported values: [BASIC, FULL]`)
+	cmd.Flags().Var(&createDirectGroupMemberJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
-	cmd.Use = "get-workspace-access-detail WORKSPACE_ID PRINCIPAL_ID"
-	cmd.Short = `Get workspace access details for a principal.`
-	cmd.Long = `Get workspace access details for a principal.
+	cmd.Use = "create-direct-group-member GROUP_ID PRINCIPAL_ID"
+	cmd.Short = `*Beta* Create a direct group membership.`
+	cmd.Long = `This command is in Beta and may change without notice.
 
-  Returns the access details for a principal in a workspace. Allows for checking
-  access details for any provisioned principal (user, service principal, or
-  group) in a workspace. * Provisioned principal here refers to one that has
-  been synced into Databricks from the customer's IdP or added explicitly to
-  Databricks via SCIM/UI. Allows for passing in a "view" parameter to control
-  what fields are returned (BASIC by default or FULL).
+Create a direct group membership.
+
+  Creates a group membership (assigns a principal to a group).
+
+  Authorization: the caller must be an account admin or a manager of the group
+  (holds the roles/group.manager role on it).
 
   Arguments:
-    WORKSPACE_ID: Required. The workspace ID for which the access details are being
-      requested.
-    PRINCIPAL_ID: Required. The internal ID of the principal (user/sp/group) for which the
-      access details are being requested.`
+    GROUP_ID: Required. Internal ID of the group in Databricks.
+    PRINCIPAL_ID: Internal ID of the principal in Databricks.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(1)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only GROUP_ID as positional arguments. Provide 'principal_id' in your JSON input")
+			}
+			return nil
+		}
 		check := root.ExactArgs(2)
 		return check(cmd, args)
 	}
@@ -86,17 +139,116 @@ func newGetWorkspaceAccessDetail() *cobra.Command {
 		ctx := cmd.Context()
 		a := cmdctx.AccountClient(ctx)
 
-		_, err = fmt.Sscan(args[0], &getWorkspaceAccessDetailReq.WorkspaceId)
+		if cmd.Flags().Changed("json") {
+			diags := createDirectGroupMemberJson.Unmarshal(&createDirectGroupMemberReq.DirectGroupMember)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		_, err = fmt.Sscan(args[0], &createDirectGroupMemberReq.GroupId)
 		if err != nil {
-			return fmt.Errorf("invalid WORKSPACE_ID: %s", args[0])
+			return fmt.Errorf("invalid GROUP_ID: %s", args[0])
 		}
 
-		_, err = fmt.Sscan(args[1], &getWorkspaceAccessDetailReq.PrincipalId)
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[1], &createDirectGroupMemberReq.DirectGroupMember.PrincipalId)
+			if err != nil {
+				return fmt.Errorf("invalid PRINCIPAL_ID: %s", args[1])
+			}
+
+		}
+
+		response, err := a.IamV2.CreateDirectGroupMember(ctx, createDirectGroupMemberReq)
 		if err != nil {
-			return fmt.Errorf("invalid PRINCIPAL_ID: %s", args[1])
+			return err
 		}
 
-		response, err := a.IamV2.GetWorkspaceAccessDetail(ctx, getWorkspaceAccessDetailReq)
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range createDirectGroupMemberOverrides {
+		fn(cmd, &createDirectGroupMemberReq)
+	}
+
+	return cmd
+}
+
+// start create-group command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var createGroupOverrides []func(
+	*cobra.Command,
+	*iamv2.CreateGroupRequest,
+)
+
+func newCreateGroup() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var createGroupReq iamv2.CreateGroupRequest
+	createGroupReq.Group = iamv2.Group{}
+	var createGroupJson flags.JsonFlag
+
+	cmd.Flags().Var(&createGroupJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&createGroupReq.Group.ExternalId, "external-id", createGroupReq.Group.ExternalId, `ExternalId of the group in the customer's IdP.`)
+	cmd.Flags().StringVar(&createGroupReq.Group.GroupName, "group-name", createGroupReq.Group.GroupName, `Display name of the group.`)
+
+	cmd.Use = "create-group"
+	cmd.Short = `*Beta* Create a group in the account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Create a group in the account.
+
+  Creates a local group in the Databricks account and returns the created group.
+  A local group is one that is not synced from the customer's identity provider,
+  and can be created whether or not Account Identity Management (AIM) is
+  enabled.
+
+  When AIM is enabled, supplying an external ID returns an error. To provision
+  the identity from your identity provider, resolve it by its external ID with
+  ResolveGroup; to read an existing external identity, use the ExternalGroup
+  resource.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(0)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := createGroupJson.Unmarshal(&createGroupReq.Group)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+
+		response, err := a.IamV2.CreateGroup(ctx, createGroupReq)
 		if err != nil {
 			return err
 		}
@@ -109,53 +261,65 @@ func newGetWorkspaceAccessDetail() *cobra.Command {
 	cmd.ValidArgsFunction = cobra.NoFileCompletions
 
 	// Apply optional overrides to this command.
-	for _, fn := range getWorkspaceAccessDetailOverrides {
-		fn(cmd, &getWorkspaceAccessDetailReq)
+	for _, fn := range createGroupOverrides {
+		fn(cmd, &createGroupReq)
 	}
 
 	return cmd
 }
 
-// start resolve-group command
+// start create-identity-visibility-filter command
 
 // Slice with functions to override default command behavior.
 // Functions can be added from the `init()` function in manually curated files in this directory.
-var resolveGroupOverrides []func(
+var createIdentityVisibilityFilterOverrides []func(
 	*cobra.Command,
-	*iamv2.ResolveGroupRequest,
+	*iamv2.CreateIdentityVisibilityFilterRequest,
 )
 
-func newResolveGroup() *cobra.Command {
+func newCreateIdentityVisibilityFilter() *cobra.Command {
 	cmd := &cobra.Command{}
 
-	var resolveGroupReq iamv2.ResolveGroupRequest
-	var resolveGroupJson flags.JsonFlag
+	var createIdentityVisibilityFilterReq iamv2.CreateIdentityVisibilityFilterRequest
+	createIdentityVisibilityFilterReq.IdentityVisibilityFilter = iamv2.IdentityVisibilityFilter{}
+	var createIdentityVisibilityFilterJson flags.JsonFlag
 
-	cmd.Flags().Var(&resolveGroupJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+	cmd.Flags().Var(&createIdentityVisibilityFilterJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
-	cmd.Use = "resolve-group EXTERNAL_ID"
-	cmd.Short = `Resolve an external group in the Databricks account.`
-	cmd.Long = `Resolve an external group in the Databricks account.
+	cmd.Flags().StringVar(&createIdentityVisibilityFilterReq.IdentityVisibilityFilterId, "identity-visibility-filter-id", createIdentityVisibilityFilterReq.IdentityVisibilityFilterId, `Optional.`)
+	// TODO: complex arg: exact
+	// TODO: complex arg: prefix
 
-  Resolves a group with the given external ID from the customer's IdP. If the
-  group does not exist, it will be created in the account. If the customer is
-  not onboarded onto Automatic Identity Management (AIM), this will return an
-  error.
+	cmd.Use = "create-identity-visibility-filter PARENT PRINCIPAL_TYPE"
+	cmd.Short = `Create an identity-visibility filter in the account.`
+	cmd.Long = `Create an identity-visibility filter in the account.
+
+  Creates a group visibility filter in the account. Requires account admin
+  privileges. Set principal_type to GROUP and specify exactly one of exact
+  (external ID) or prefix (display-name starts with). The filter applies
+  across all workspaces in the account. A duplicate filter ID or an existing
+  rule with the same type and match value returns ALREADY_EXISTS. Filters are
+  immutable; to change a rule, delete it and create a new one.
 
   Arguments:
-    EXTERNAL_ID: Required. The external ID of the group in the customer's IdP.`
+    PARENT: Required. The parent account. Format: accounts/{account_id}
+    PRINCIPAL_TYPE: The type of principal this rule applies to. Set to GROUP when creating a
+      filter. Other principal types are not supported for creation.
+      Supported values: [GROUP, SERVICE_PRINCIPAL, USER]`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
-			err := root.ExactArgs(0)(cmd, args)
+			err := root.ExactArgs(1)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'external_id' in your JSON input")
+				return errors.New("when --json flag is specified, provide only PARENT as positional arguments. Provide 'principal_type' in your JSON input")
 			}
 			return nil
 		}
-		check := root.ExactArgs(1)
+		check := root.ExactArgs(2)
 		return check(cmd, args)
 	}
 
@@ -165,7 +329,7 @@ func newResolveGroup() *cobra.Command {
 		a := cmdctx.AccountClient(ctx)
 
 		if cmd.Flags().Changed("json") {
-			diags := resolveGroupJson.Unmarshal(&resolveGroupReq)
+			diags := createIdentityVisibilityFilterJson.Unmarshal(&createIdentityVisibilityFilterReq.IdentityVisibilityFilter)
 			if diags.HasError() {
 				return diags.Error()
 			}
@@ -176,11 +340,16 @@ func newResolveGroup() *cobra.Command {
 				}
 			}
 		}
+		createIdentityVisibilityFilterReq.Parent = args[0]
 		if !cmd.Flags().Changed("json") {
-			resolveGroupReq.ExternalId = args[0]
+			_, err = fmt.Sscan(args[1], &createIdentityVisibilityFilterReq.IdentityVisibilityFilter.PrincipalType)
+			if err != nil {
+				return fmt.Errorf("invalid PRINCIPAL_TYPE: %s", args[1])
+			}
+
 		}
 
-		response, err := a.IamV2.ResolveGroup(ctx, resolveGroupReq)
+		response, err := a.IamV2.CreateIdentityVisibilityFilter(ctx, createIdentityVisibilityFilterReq)
 		if err != nil {
 			return err
 		}
@@ -193,52 +362,67 @@ func newResolveGroup() *cobra.Command {
 	cmd.ValidArgsFunction = cobra.NoFileCompletions
 
 	// Apply optional overrides to this command.
-	for _, fn := range resolveGroupOverrides {
-		fn(cmd, &resolveGroupReq)
+	for _, fn := range createIdentityVisibilityFilterOverrides {
+		fn(cmd, &createIdentityVisibilityFilterReq)
 	}
 
 	return cmd
 }
 
-// start resolve-service-principal command
+// start create-service-principal command
 
 // Slice with functions to override default command behavior.
 // Functions can be added from the `init()` function in manually curated files in this directory.
-var resolveServicePrincipalOverrides []func(
+var createServicePrincipalOverrides []func(
 	*cobra.Command,
-	*iamv2.ResolveServicePrincipalRequest,
+	*iamv2.CreateServicePrincipalRequest,
 )
 
-func newResolveServicePrincipal() *cobra.Command {
+func newCreateServicePrincipal() *cobra.Command {
 	cmd := &cobra.Command{}
 
-	var resolveServicePrincipalReq iamv2.ResolveServicePrincipalRequest
-	var resolveServicePrincipalJson flags.JsonFlag
+	var createServicePrincipalReq iamv2.CreateServicePrincipalRequest
+	createServicePrincipalReq.ServicePrincipal = iamv2.ServicePrincipal{}
+	var createServicePrincipalJson flags.JsonFlag
 
-	cmd.Flags().Var(&resolveServicePrincipalJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+	cmd.Flags().Var(&createServicePrincipalJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
-	cmd.Use = "resolve-service-principal EXTERNAL_ID"
-	cmd.Short = `Resolve an external service principal in the Databricks account.`
-	cmd.Long = `Resolve an external service principal in the Databricks account.
+	cmd.Flags().StringVar(&createServicePrincipalReq.ServicePrincipal.ExternalId, "external-id", createServicePrincipalReq.ServicePrincipal.ExternalId, `ExternalId of the service principal in the customer's IdP.`)
 
-  Resolves an SP with the given external ID from the customer's IdP. If the SP
-  does not exist, it will be created. If the customer is not onboarded onto
-  Automatic Identity Management (AIM), this will return an error.
+	cmd.Use = "create-service-principal DISPLAY_NAME ACCOUNT_SP_STATUS"
+	cmd.Short = `*Beta* Create a service principal in the account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Create a service principal in the account.
+
+  Creates a local service principal in the Databricks account and returns the
+  created service principal. A local service principal is one that is not synced
+  from the customer's identity provider, and can be created whether or not
+  Account Identity Management (AIM) is enabled.
+
+  When AIM is enabled, supplying an external ID returns an error. To provision
+  the identity from your identity provider, resolve it by its external ID with
+  ResolveServicePrincipal; to read an existing external identity, use the
+  ExternalServicePrincipal resource.
 
   Arguments:
-    EXTERNAL_ID: Required. The external ID of the service principal in the customer's IdP.`
+    DISPLAY_NAME: Display name of the service principal.
+    ACCOUNT_SP_STATUS: The activity status of a service principal in a Databricks account.
+      Supported values: [ACTIVE, INACTIVE]`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'external_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'display_name', 'account_sp_status' in your JSON input")
 			}
 			return nil
 		}
-		check := root.ExactArgs(1)
+		check := root.ExactArgs(2)
 		return check(cmd, args)
 	}
 
@@ -248,7 +432,7 @@ func newResolveServicePrincipal() *cobra.Command {
 		a := cmdctx.AccountClient(ctx)
 
 		if cmd.Flags().Changed("json") {
-			diags := resolveServicePrincipalJson.Unmarshal(&resolveServicePrincipalReq)
+			diags := createServicePrincipalJson.Unmarshal(&createServicePrincipalReq.ServicePrincipal)
 			if diags.HasError() {
 				return diags.Error()
 			}
@@ -260,10 +444,17 @@ func newResolveServicePrincipal() *cobra.Command {
 			}
 		}
 		if !cmd.Flags().Changed("json") {
-			resolveServicePrincipalReq.ExternalId = args[0]
+			createServicePrincipalReq.ServicePrincipal.DisplayName = args[0]
 		}
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[1], &createServicePrincipalReq.ServicePrincipal.AccountSpStatus)
+			if err != nil {
+				return fmt.Errorf("invalid ACCOUNT_SP_STATUS: %s", args[1])
+			}
 
-		response, err := a.IamV2.ResolveServicePrincipal(ctx, resolveServicePrincipalReq)
+		}
+
+		response, err := a.IamV2.CreateServicePrincipal(ctx, createServicePrincipalReq)
 		if err != nil {
 			return err
 		}
@@ -276,52 +467,68 @@ func newResolveServicePrincipal() *cobra.Command {
 	cmd.ValidArgsFunction = cobra.NoFileCompletions
 
 	// Apply optional overrides to this command.
-	for _, fn := range resolveServicePrincipalOverrides {
-		fn(cmd, &resolveServicePrincipalReq)
+	for _, fn := range createServicePrincipalOverrides {
+		fn(cmd, &createServicePrincipalReq)
 	}
 
 	return cmd
 }
 
-// start resolve-user command
+// start create-user command
 
 // Slice with functions to override default command behavior.
 // Functions can be added from the `init()` function in manually curated files in this directory.
-var resolveUserOverrides []func(
+var createUserOverrides []func(
 	*cobra.Command,
-	*iamv2.ResolveUserRequest,
+	*iamv2.CreateUserRequest,
 )
 
-func newResolveUser() *cobra.Command {
+func newCreateUser() *cobra.Command {
 	cmd := &cobra.Command{}
 
-	var resolveUserReq iamv2.ResolveUserRequest
-	var resolveUserJson flags.JsonFlag
+	var createUserReq iamv2.CreateUserRequest
+	createUserReq.User = iamv2.User{}
+	var createUserJson flags.JsonFlag
 
-	cmd.Flags().Var(&resolveUserJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+	cmd.Flags().Var(&createUserJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
-	cmd.Use = "resolve-user EXTERNAL_ID"
-	cmd.Short = `Resolve an external user in the Databricks account.`
-	cmd.Long = `Resolve an external user in the Databricks account.
+	cmd.Flags().StringVar(&createUserReq.User.ExternalId, "external-id", createUserReq.User.ExternalId, `ExternalId of the user in the customer's IdP.`)
 
-  Resolves a user with the given external ID from the customer's IdP. If the
-  user does not exist, it will be created. If the customer is not onboarded onto
-  Automatic Identity Management (AIM), this will return an error.
+	cmd.Use = "create-user USERNAME FULL_NAME ACCOUNT_USER_STATUS"
+	cmd.Short = `*Beta* Create a user in the account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Create a user in the account.
+
+  Creates a local user in the Databricks account and returns the created user. A
+  local user is one that is not synced from the customer's identity provider,
+  and can be created whether or not Account Identity Management (AIM) is
+  enabled.
+
+  When AIM is enabled, supplying an external ID returns an error. To provision
+  the identity from your identity provider, resolve it by its external ID with
+  ResolveUser; to read an existing external identity, use the ExternalUser
+  resource.
 
   Arguments:
-    EXTERNAL_ID: Required. The external ID of the user in the customer's IdP.`
+    USERNAME: Username/email of the user.
+    FULL_NAME:
+    ACCOUNT_USER_STATUS: The activity status of a user in a Databricks account.
+      Supported values: [ACTIVE, INACTIVE]`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'external_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'username', 'full_name', 'account_user_status' in your JSON input")
 			}
 			return nil
 		}
-		check := root.ExactArgs(1)
+		check := root.ExactArgs(3)
 		return check(cmd, args)
 	}
 
@@ -331,7 +538,7 @@ func newResolveUser() *cobra.Command {
 		a := cmdctx.AccountClient(ctx)
 
 		if cmd.Flags().Changed("json") {
-			diags := resolveUserJson.Unmarshal(&resolveUserReq)
+			diags := createUserJson.Unmarshal(&createUserReq.User)
 			if diags.HasError() {
 				return diags.Error()
 			}
@@ -343,10 +550,24 @@ func newResolveUser() *cobra.Command {
 			}
 		}
 		if !cmd.Flags().Changed("json") {
-			resolveUserReq.ExternalId = args[0]
+			createUserReq.User.Username = args[0]
 		}
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[1], &createUserReq.User.FullName)
+			if err != nil {
+				return fmt.Errorf("invalid FULL_NAME: %s", args[1])
+			}
 
-		response, err := a.IamV2.ResolveUser(ctx, resolveUserReq)
+		}
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[2], &createUserReq.User.AccountUserStatus)
+			if err != nil {
+				return fmt.Errorf("invalid ACCOUNT_USER_STATUS: %s", args[2])
+			}
+
+		}
+
+		response, err := a.IamV2.CreateUser(ctx, createUserReq)
 		if err != nil {
 			return err
 		}
@@ -359,8 +580,2836 @@ func newResolveUser() *cobra.Command {
 	cmd.ValidArgsFunction = cobra.NoFileCompletions
 
 	// Apply optional overrides to this command.
-	for _, fn := range resolveUserOverrides {
-		fn(cmd, &resolveUserReq)
+	for _, fn := range createUserOverrides {
+		fn(cmd, &createUserReq)
+	}
+
+	return cmd
+}
+
+// start create-workspace-assignment command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var createWorkspaceAssignmentOverrides []func(
+	*cobra.Command,
+	*iamv2.CreateWorkspaceAssignmentRequest,
+)
+
+func newCreateWorkspaceAssignment() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var createWorkspaceAssignmentReq iamv2.CreateWorkspaceAssignmentRequest
+	createWorkspaceAssignmentReq.WorkspaceAssignment = iamv2.WorkspaceAssignment{}
+	var createWorkspaceAssignmentJson flags.JsonFlag
+
+	cmd.Flags().Var(&createWorkspaceAssignmentJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: effective_entitlements
+	// TODO: array: entitlements
+
+	cmd.Use = "create-workspace-assignment WORKSPACE_ID PRINCIPAL_ID"
+	cmd.Short = `*Beta* Create a workspace assignment.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Create a workspace assignment.
+
+  Creates a workspace assignment for a principal. Entitlements are granted one
+  at a time rather than atomically. If the request fails partway through, the
+  principal stays assigned to the workspace with only some of the requested
+  entitlements. Get the assignment afterwards to confirm which entitlements were
+  granted.
+
+  Arguments:
+    WORKSPACE_ID: Required. The workspace ID for which the workspace assignment is being
+      created.
+    PRINCIPAL_ID: The internal ID of the principal (user/sp/group) in Databricks.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(1)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only WORKSPACE_ID as positional arguments. Provide 'principal_id' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := createWorkspaceAssignmentJson.Unmarshal(&createWorkspaceAssignmentReq.WorkspaceAssignment)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		_, err = fmt.Sscan(args[0], &createWorkspaceAssignmentReq.WorkspaceId)
+		if err != nil {
+			return fmt.Errorf("invalid WORKSPACE_ID: %s", args[0])
+		}
+
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[1], &createWorkspaceAssignmentReq.WorkspaceAssignment.PrincipalId)
+			if err != nil {
+				return fmt.Errorf("invalid PRINCIPAL_ID: %s", args[1])
+			}
+
+		}
+
+		response, err := a.IamV2.CreateWorkspaceAssignment(ctx, createWorkspaceAssignmentReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range createWorkspaceAssignmentOverrides {
+		fn(cmd, &createWorkspaceAssignmentReq)
+	}
+
+	return cmd
+}
+
+// start create-workspace-assignment-detail command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var createWorkspaceAssignmentDetailOverrides []func(
+	*cobra.Command,
+	*iamv2.CreateWorkspaceAssignmentDetailRequest,
+)
+
+func newCreateWorkspaceAssignmentDetail() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var createWorkspaceAssignmentDetailReq iamv2.CreateWorkspaceAssignmentDetailRequest
+	createWorkspaceAssignmentDetailReq.WorkspaceAssignmentDetail = iamv2.WorkspaceAssignmentDetail{}
+	var createWorkspaceAssignmentDetailJson flags.JsonFlag
+
+	cmd.Flags().Var(&createWorkspaceAssignmentDetailJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: effective_entitlements
+	// TODO: array: entitlements
+
+	cmd.Use = "create-workspace-assignment-detail WORKSPACE_ID PRINCIPAL_ID"
+	cmd.Short = `Create a workspace assignment detail.`
+	cmd.Long = `Create a workspace assignment detail.
+
+  Creates a workspace assignment detail for a principal.
+
+  Arguments:
+    WORKSPACE_ID: Required. The workspace ID for which the workspace assignment detail is
+      being created.
+    PRINCIPAL_ID: The internal ID of the principal (user/sp/group) in Databricks.`
+
+	// This command is being previewed; hide from help output.
+	cmd.Hidden = true
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(1)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only WORKSPACE_ID as positional arguments. Provide 'principal_id' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := createWorkspaceAssignmentDetailJson.Unmarshal(&createWorkspaceAssignmentDetailReq.WorkspaceAssignmentDetail)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		_, err = fmt.Sscan(args[0], &createWorkspaceAssignmentDetailReq.WorkspaceId)
+		if err != nil {
+			return fmt.Errorf("invalid WORKSPACE_ID: %s", args[0])
+		}
+
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[1], &createWorkspaceAssignmentDetailReq.WorkspaceAssignmentDetail.PrincipalId)
+			if err != nil {
+				return fmt.Errorf("invalid PRINCIPAL_ID: %s", args[1])
+			}
+
+		}
+
+		response, err := a.IamV2.CreateWorkspaceAssignmentDetail(ctx, createWorkspaceAssignmentDetailReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range createWorkspaceAssignmentDetailOverrides {
+		fn(cmd, &createWorkspaceAssignmentDetailReq)
+	}
+
+	return cmd
+}
+
+// start delete-direct-group-member command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteDirectGroupMemberOverrides []func(
+	*cobra.Command,
+	*iamv2.DeleteDirectGroupMemberRequest,
+)
+
+func newDeleteDirectGroupMember() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteDirectGroupMemberReq iamv2.DeleteDirectGroupMemberRequest
+
+	cmd.Use = "delete-direct-group-member GROUP_ID PRINCIPAL_ID"
+	cmd.Short = `*Beta* Delete a direct group membership.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Delete a direct group membership.
+
+  Deletes a group membership (unassigns a principal from a group).
+
+  Authorization: the caller must be an account admin or a manager of the group
+  (holds the roles/group.manager role on it).
+
+  Arguments:
+    GROUP_ID: Required. Internal ID of the group in Databricks.
+    PRINCIPAL_ID: Required. Internal ID of the principal to be unassigned from the group.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		_, err = fmt.Sscan(args[0], &deleteDirectGroupMemberReq.GroupId)
+		if err != nil {
+			return fmt.Errorf("invalid GROUP_ID: %s", args[0])
+		}
+
+		_, err = fmt.Sscan(args[1], &deleteDirectGroupMemberReq.PrincipalId)
+		if err != nil {
+			return fmt.Errorf("invalid PRINCIPAL_ID: %s", args[1])
+		}
+
+		err = a.IamV2.DeleteDirectGroupMember(ctx, deleteDirectGroupMemberReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteDirectGroupMemberOverrides {
+		fn(cmd, &deleteDirectGroupMemberReq)
+	}
+
+	return cmd
+}
+
+// start delete-group command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteGroupOverrides []func(
+	*cobra.Command,
+	*iamv2.DeleteGroupRequest,
+)
+
+func newDeleteGroup() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteGroupReq iamv2.DeleteGroupRequest
+
+	cmd.Use = "delete-group GROUP_ID"
+	cmd.Short = `*Beta* Delete a group in the account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Delete a group in the account.
+
+  Deletes a group from the Databricks account by its internal ID.
+
+  Authorization: the caller must be an account admin or a manager of the group
+  (holds the roles/group.manager role on it).
+
+  Arguments:
+    GROUP_ID: Required. Internal ID of the group in Databricks.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		deleteGroupReq.GroupId = args[0]
+
+		err = a.IamV2.DeleteGroup(ctx, deleteGroupReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteGroupOverrides {
+		fn(cmd, &deleteGroupReq)
+	}
+
+	return cmd
+}
+
+// start delete-identity-visibility-filter command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteIdentityVisibilityFilterOverrides []func(
+	*cobra.Command,
+	*iamv2.DeleteIdentityVisibilityFilterRequest,
+)
+
+func newDeleteIdentityVisibilityFilter() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteIdentityVisibilityFilterReq iamv2.DeleteIdentityVisibilityFilterRequest
+
+	cmd.Use = "delete-identity-visibility-filter NAME"
+	cmd.Short = `Delete an identity-visibility filter.`
+	cmd.Long = `Delete an identity-visibility filter.
+
+  Deletes a group visibility filter by its resource name. Requires account admin
+  privileges. Deleting a filter does not delete groups or revoke access. Groups
+  covered only by this rule stop being discoverable unless they or a transitive
+  parent are already provisioned in the account. If no group filters remain, all
+  groups become visible again. Deleting a filter that does not exist succeeds
+  without making any changes.
+
+  Arguments:
+    NAME: Required. The resource name of the filter. Format:
+      accounts/{account_id}/identity-visibility-filters/{identity_visibility_filter_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		deleteIdentityVisibilityFilterReq.Name = args[0]
+
+		err = a.IamV2.DeleteIdentityVisibilityFilter(ctx, deleteIdentityVisibilityFilterReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteIdentityVisibilityFilterOverrides {
+		fn(cmd, &deleteIdentityVisibilityFilterReq)
+	}
+
+	return cmd
+}
+
+// start delete-service-principal command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteServicePrincipalOverrides []func(
+	*cobra.Command,
+	*iamv2.DeleteServicePrincipalRequest,
+)
+
+func newDeleteServicePrincipal() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteServicePrincipalReq iamv2.DeleteServicePrincipalRequest
+
+	cmd.Use = "delete-service-principal SERVICE_PRINCIPAL_ID"
+	cmd.Short = `*Beta* Delete a service principal in the account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Delete a service principal in the account.
+
+  Deletes a service principal from the Databricks account by its internal ID.
+
+  Arguments:
+    SERVICE_PRINCIPAL_ID: Required. Internal ID of the service principal in Databricks.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		deleteServicePrincipalReq.ServicePrincipalId = args[0]
+
+		err = a.IamV2.DeleteServicePrincipal(ctx, deleteServicePrincipalReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteServicePrincipalOverrides {
+		fn(cmd, &deleteServicePrincipalReq)
+	}
+
+	return cmd
+}
+
+// start delete-user command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteUserOverrides []func(
+	*cobra.Command,
+	*iamv2.DeleteUserRequest,
+)
+
+func newDeleteUser() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteUserReq iamv2.DeleteUserRequest
+
+	cmd.Use = "delete-user USER_ID"
+	cmd.Short = `*Beta* Delete a user in the account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Delete a user in the account.
+
+  Deletes a user from the Databricks account by its internal ID.
+
+  Arguments:
+    USER_ID: Required. Internal ID of the user in Databricks.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		deleteUserReq.UserId = args[0]
+
+		err = a.IamV2.DeleteUser(ctx, deleteUserReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteUserOverrides {
+		fn(cmd, &deleteUserReq)
+	}
+
+	return cmd
+}
+
+// start delete-workspace-assignment command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteWorkspaceAssignmentOverrides []func(
+	*cobra.Command,
+	*iamv2.DeleteWorkspaceAssignmentRequest,
+)
+
+func newDeleteWorkspaceAssignment() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteWorkspaceAssignmentReq iamv2.DeleteWorkspaceAssignmentRequest
+
+	cmd.Use = "delete-workspace-assignment WORKSPACE_ID PRINCIPAL_ID"
+	cmd.Short = `*Beta* Delete a workspace assignment.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Delete a workspace assignment.
+
+  Deletes a workspace assignment for a principal, revoking all of its
+  entitlements. Entitlements are revoked one at a time rather than atomically.
+  If the request fails partway through, the principal stays assigned with some
+  of its original entitlements. Retrying is safe.
+
+  Arguments:
+    WORKSPACE_ID: The workspace ID where the principal has access.
+    PRINCIPAL_ID: Required. ID of the principal in Databricks to delete workspace assignment
+      for.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		_, err = fmt.Sscan(args[0], &deleteWorkspaceAssignmentReq.WorkspaceId)
+		if err != nil {
+			return fmt.Errorf("invalid WORKSPACE_ID: %s", args[0])
+		}
+
+		_, err = fmt.Sscan(args[1], &deleteWorkspaceAssignmentReq.PrincipalId)
+		if err != nil {
+			return fmt.Errorf("invalid PRINCIPAL_ID: %s", args[1])
+		}
+
+		err = a.IamV2.DeleteWorkspaceAssignment(ctx, deleteWorkspaceAssignmentReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteWorkspaceAssignmentOverrides {
+		fn(cmd, &deleteWorkspaceAssignmentReq)
+	}
+
+	return cmd
+}
+
+// start delete-workspace-assignment-detail command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteWorkspaceAssignmentDetailOverrides []func(
+	*cobra.Command,
+	*iamv2.DeleteWorkspaceAssignmentDetailRequest,
+)
+
+func newDeleteWorkspaceAssignmentDetail() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteWorkspaceAssignmentDetailReq iamv2.DeleteWorkspaceAssignmentDetailRequest
+
+	cmd.Use = "delete-workspace-assignment-detail WORKSPACE_ID PRINCIPAL_ID"
+	cmd.Short = `Delete a workspace assignment detail.`
+	cmd.Long = `Delete a workspace assignment detail.
+
+  Deletes a workspace assignment detail for a principal, revoking all of its
+  entitlements. Entitlements are revoked one at a time rather than atomically.
+  If the request fails partway through, the principal stays assigned with some
+  of its original entitlements. Retrying is safe.
+
+  Arguments:
+    WORKSPACE_ID: The workspace ID where the principal has access.
+    PRINCIPAL_ID: Required. ID of the principal in Databricks to delete workspace assignment
+      for.`
+
+	// This command is being previewed; hide from help output.
+	cmd.Hidden = true
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		_, err = fmt.Sscan(args[0], &deleteWorkspaceAssignmentDetailReq.WorkspaceId)
+		if err != nil {
+			return fmt.Errorf("invalid WORKSPACE_ID: %s", args[0])
+		}
+
+		_, err = fmt.Sscan(args[1], &deleteWorkspaceAssignmentDetailReq.PrincipalId)
+		if err != nil {
+			return fmt.Errorf("invalid PRINCIPAL_ID: %s", args[1])
+		}
+
+		err = a.IamV2.DeleteWorkspaceAssignmentDetail(ctx, deleteWorkspaceAssignmentDetailReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteWorkspaceAssignmentDetailOverrides {
+		fn(cmd, &deleteWorkspaceAssignmentDetailReq)
+	}
+
+	return cmd
+}
+
+// start get-direct-group-member command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getDirectGroupMemberOverrides []func(
+	*cobra.Command,
+	*iamv2.GetDirectGroupMemberRequest,
+)
+
+func newGetDirectGroupMember() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getDirectGroupMemberReq iamv2.GetDirectGroupMemberRequest
+
+	cmd.Use = "get-direct-group-member GROUP_ID PRINCIPAL_ID"
+	cmd.Short = `*Beta* Get a direct group member.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get a direct group member.
+
+  Gets a provisioned direct member of a group.
+
+  Arguments:
+    GROUP_ID: Required. Internal ID of the group in Databricks.
+    PRINCIPAL_ID: Required. Internal ID of the principal belonging to the group in
+      Databricks.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		_, err = fmt.Sscan(args[0], &getDirectGroupMemberReq.GroupId)
+		if err != nil {
+			return fmt.Errorf("invalid GROUP_ID: %s", args[0])
+		}
+
+		_, err = fmt.Sscan(args[1], &getDirectGroupMemberReq.PrincipalId)
+		if err != nil {
+			return fmt.Errorf("invalid PRINCIPAL_ID: %s", args[1])
+		}
+
+		response, err := a.IamV2.GetDirectGroupMember(ctx, getDirectGroupMemberReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getDirectGroupMemberOverrides {
+		fn(cmd, &getDirectGroupMemberReq)
+	}
+
+	return cmd
+}
+
+// start get-external-group command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getExternalGroupOverrides []func(
+	*cobra.Command,
+	*iamv2.GetExternalGroupRequest,
+)
+
+func newGetExternalGroup() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getExternalGroupReq iamv2.GetExternalGroupRequest
+
+	cmd.Use = "get-external-group NAME"
+	cmd.Short = `*Beta* Get an external group in the account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get an external group in the account.
+
+  Retrieves an external group with the given external ID from the customer's
+  IdP. If the group does not exist, it will be created in the account. If the
+  customer is not onboarded onto Automatic Identity Management (AIM), this will
+  return an error.
+
+  Arguments:
+    NAME: Required. The resource name of the external group. Format:
+      accounts/{account_id}/external-groups/{external_group_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		getExternalGroupReq.Name = args[0]
+
+		response, err := a.IamV2.GetExternalGroup(ctx, getExternalGroupReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getExternalGroupOverrides {
+		fn(cmd, &getExternalGroupReq)
+	}
+
+	return cmd
+}
+
+// start get-external-service-principal command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getExternalServicePrincipalOverrides []func(
+	*cobra.Command,
+	*iamv2.GetExternalServicePrincipalRequest,
+)
+
+func newGetExternalServicePrincipal() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getExternalServicePrincipalReq iamv2.GetExternalServicePrincipalRequest
+
+	cmd.Use = "get-external-service-principal NAME"
+	cmd.Short = `*Beta* Get an external service principal in the account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get an external service principal in the account.
+
+  Retrieves an external service principal with the given external ID from the
+  customer's IdP. If the service principal does not exist, it will be created.
+  If the customer is not onboarded onto Automatic Identity Management (AIM),
+  this will return an error.
+
+  Arguments:
+    NAME: Required. The resource name of the external service principal. Format:
+      accounts/{account_id}/external-service-principals/{external_service_principal_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		getExternalServicePrincipalReq.Name = args[0]
+
+		response, err := a.IamV2.GetExternalServicePrincipal(ctx, getExternalServicePrincipalReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getExternalServicePrincipalOverrides {
+		fn(cmd, &getExternalServicePrincipalReq)
+	}
+
+	return cmd
+}
+
+// start get-external-user command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getExternalUserOverrides []func(
+	*cobra.Command,
+	*iamv2.GetExternalUserRequest,
+)
+
+func newGetExternalUser() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getExternalUserReq iamv2.GetExternalUserRequest
+
+	cmd.Use = "get-external-user NAME"
+	cmd.Short = `*Beta* Get an external user in the account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get an external user in the account.
+
+  Retrieves an external user with the given external ID from the customer's IdP.
+  If the user does not exist, it will be created. If the customer is not
+  onboarded onto Automatic Identity Management (AIM), this will return an error.
+
+  Arguments:
+    NAME: Required. The resource name of the external user. Format:
+      accounts/{account_id}/external-users/{external_user_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		getExternalUserReq.Name = args[0]
+
+		response, err := a.IamV2.GetExternalUser(ctx, getExternalUserReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getExternalUserOverrides {
+		fn(cmd, &getExternalUserReq)
+	}
+
+	return cmd
+}
+
+// start get-group command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getGroupOverrides []func(
+	*cobra.Command,
+	*iamv2.GetGroupRequest,
+)
+
+func newGetGroup() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getGroupReq iamv2.GetGroupRequest
+
+	cmd.Use = "get-group GROUP_ID"
+	cmd.Short = `*Beta* Get a group in the account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get a group in the account.
+
+  Fetches a group from the Databricks account by its internal ID.
+
+  Arguments:
+    GROUP_ID: Required. Internal ID of the group in Databricks.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		getGroupReq.GroupId = args[0]
+
+		response, err := a.IamV2.GetGroup(ctx, getGroupReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getGroupOverrides {
+		fn(cmd, &getGroupReq)
+	}
+
+	return cmd
+}
+
+// start get-identity-visibility-filter command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getIdentityVisibilityFilterOverrides []func(
+	*cobra.Command,
+	*iamv2.GetIdentityVisibilityFilterRequest,
+)
+
+func newGetIdentityVisibilityFilter() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getIdentityVisibilityFilterReq iamv2.GetIdentityVisibilityFilterRequest
+
+	cmd.Use = "get-identity-visibility-filter NAME"
+	cmd.Short = `Get an identity-visibility filter.`
+	cmd.Long = `Get an identity-visibility filter.
+
+  Gets a group visibility filter by its resource name. Requires account admin
+  privileges. Returns the filter rule, not the groups matched by the rule.
+
+  Arguments:
+    NAME: Required. The resource name of the filter. Format:
+      accounts/{account_id}/identity-visibility-filters/{identity_visibility_filter_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		getIdentityVisibilityFilterReq.Name = args[0]
+
+		response, err := a.IamV2.GetIdentityVisibilityFilter(ctx, getIdentityVisibilityFilterReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getIdentityVisibilityFilterOverrides {
+		fn(cmd, &getIdentityVisibilityFilterReq)
+	}
+
+	return cmd
+}
+
+// start get-service-principal command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getServicePrincipalOverrides []func(
+	*cobra.Command,
+	*iamv2.GetServicePrincipalRequest,
+)
+
+func newGetServicePrincipal() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getServicePrincipalReq iamv2.GetServicePrincipalRequest
+
+	cmd.Use = "get-service-principal SERVICE_PRINCIPAL_ID"
+	cmd.Short = `*Beta* Get a service principal in the account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get a service principal in the account.
+
+  Fetches a service principal from the Databricks account by its internal ID.
+
+  Arguments:
+    SERVICE_PRINCIPAL_ID: Required. Internal ID of the service principal in Databricks.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		getServicePrincipalReq.ServicePrincipalId = args[0]
+
+		response, err := a.IamV2.GetServicePrincipal(ctx, getServicePrincipalReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getServicePrincipalOverrides {
+		fn(cmd, &getServicePrincipalReq)
+	}
+
+	return cmd
+}
+
+// start get-user command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getUserOverrides []func(
+	*cobra.Command,
+	*iamv2.GetUserRequest,
+)
+
+func newGetUser() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getUserReq iamv2.GetUserRequest
+
+	cmd.Use = "get-user USER_ID"
+	cmd.Short = `*Beta* Get a user in the account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get a user in the account.
+
+  Fetches a user from the Databricks account by its internal ID.
+
+  Arguments:
+    USER_ID: Required. Internal ID of the user in Databricks.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		getUserReq.UserId = args[0]
+
+		response, err := a.IamV2.GetUser(ctx, getUserReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getUserOverrides {
+		fn(cmd, &getUserReq)
+	}
+
+	return cmd
+}
+
+// start get-workspace-access-detail command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getWorkspaceAccessDetailOverrides []func(
+	*cobra.Command,
+	*iamv2.GetWorkspaceAccessDetailRequest,
+)
+
+func newGetWorkspaceAccessDetail() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getWorkspaceAccessDetailReq iamv2.GetWorkspaceAccessDetailRequest
+
+	cmd.Flags().Var(&getWorkspaceAccessDetailReq.View, "view", `Controls what fields are returned. Supported values: [BASIC, FULL]`)
+
+	cmd.Use = "get-workspace-access-detail WORKSPACE_ID PRINCIPAL_ID"
+	cmd.Short = `*Beta* Get workspace access details for a principal.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get workspace access details for a principal.
+
+  Returns the access details for a principal in a workspace. Allows for checking
+  access details for any provisioned principal (user, service principal, or
+  group) in a workspace. * Provisioned principal here refers to one that has
+  been synced into Databricks from the customer's IdP or added explicitly to
+  Databricks via SCIM/UI. Allows for passing in a "view" parameter to control
+  what fields are returned (BASIC by default or FULL).
+
+  Arguments:
+    WORKSPACE_ID: Required. The workspace ID for which the access details are being
+      requested.
+    PRINCIPAL_ID: Required. The internal ID of the principal (user/sp/group) for which the
+      access details are being requested.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		_, err = fmt.Sscan(args[0], &getWorkspaceAccessDetailReq.WorkspaceId)
+		if err != nil {
+			return fmt.Errorf("invalid WORKSPACE_ID: %s", args[0])
+		}
+
+		_, err = fmt.Sscan(args[1], &getWorkspaceAccessDetailReq.PrincipalId)
+		if err != nil {
+			return fmt.Errorf("invalid PRINCIPAL_ID: %s", args[1])
+		}
+
+		response, err := a.IamV2.GetWorkspaceAccessDetail(ctx, getWorkspaceAccessDetailReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getWorkspaceAccessDetailOverrides {
+		fn(cmd, &getWorkspaceAccessDetailReq)
+	}
+
+	return cmd
+}
+
+// start get-workspace-assignment command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getWorkspaceAssignmentOverrides []func(
+	*cobra.Command,
+	*iamv2.GetWorkspaceAssignmentRequest,
+)
+
+func newGetWorkspaceAssignment() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getWorkspaceAssignmentReq iamv2.GetWorkspaceAssignmentRequest
+
+	cmd.Use = "get-workspace-assignment WORKSPACE_ID PRINCIPAL_ID"
+	cmd.Short = `*Beta* Get a workspace assignment for a principal.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get a workspace assignment for a principal.
+
+  Returns the assignment for a principal in a workspace.
+
+  Arguments:
+    WORKSPACE_ID: Required. The workspace ID for which the assignment is being requested.
+    PRINCIPAL_ID: Required. The internal ID of the principal (user/sp/group) for which the
+      assignment is being requested.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		_, err = fmt.Sscan(args[0], &getWorkspaceAssignmentReq.WorkspaceId)
+		if err != nil {
+			return fmt.Errorf("invalid WORKSPACE_ID: %s", args[0])
+		}
+
+		_, err = fmt.Sscan(args[1], &getWorkspaceAssignmentReq.PrincipalId)
+		if err != nil {
+			return fmt.Errorf("invalid PRINCIPAL_ID: %s", args[1])
+		}
+
+		response, err := a.IamV2.GetWorkspaceAssignment(ctx, getWorkspaceAssignmentReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getWorkspaceAssignmentOverrides {
+		fn(cmd, &getWorkspaceAssignmentReq)
+	}
+
+	return cmd
+}
+
+// start get-workspace-assignment-detail command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getWorkspaceAssignmentDetailOverrides []func(
+	*cobra.Command,
+	*iamv2.GetWorkspaceAssignmentDetailRequest,
+)
+
+func newGetWorkspaceAssignmentDetail() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getWorkspaceAssignmentDetailReq iamv2.GetWorkspaceAssignmentDetailRequest
+
+	cmd.Use = "get-workspace-assignment-detail WORKSPACE_ID PRINCIPAL_ID"
+	cmd.Short = `Get workspace assignment details for a principal.`
+	cmd.Long = `Get workspace assignment details for a principal.
+
+  Returns the assignment details for a principal in a workspace.
+
+  Arguments:
+    WORKSPACE_ID: Required. The workspace ID for which the assignment details are being
+      requested.
+    PRINCIPAL_ID: Required. The internal ID of the principal (user/sp/group) for which the
+      assignment details are being requested.`
+
+	// This command is being previewed; hide from help output.
+	cmd.Hidden = true
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		_, err = fmt.Sscan(args[0], &getWorkspaceAssignmentDetailReq.WorkspaceId)
+		if err != nil {
+			return fmt.Errorf("invalid WORKSPACE_ID: %s", args[0])
+		}
+
+		_, err = fmt.Sscan(args[1], &getWorkspaceAssignmentDetailReq.PrincipalId)
+		if err != nil {
+			return fmt.Errorf("invalid PRINCIPAL_ID: %s", args[1])
+		}
+
+		response, err := a.IamV2.GetWorkspaceAssignmentDetail(ctx, getWorkspaceAssignmentDetailReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getWorkspaceAssignmentDetailOverrides {
+		fn(cmd, &getWorkspaceAssignmentDetailReq)
+	}
+
+	return cmd
+}
+
+// start list-direct-group-members command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listDirectGroupMembersOverrides []func(
+	*cobra.Command,
+	*iamv2.ListDirectGroupMembersRequest,
+)
+
+func newListDirectGroupMembers() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listDirectGroupMembersReq iamv2.ListDirectGroupMembersRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listDirectGroupMembersLimit int
+
+	cmd.Flags().IntVar(&listDirectGroupMembersReq.PageSize, "page-size", listDirectGroupMembersReq.PageSize, `The maximum number of members to return.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listDirectGroupMembersLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listDirectGroupMembersReq.PageToken, "page-token", listDirectGroupMembersReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-direct-group-members GROUP_ID"
+	cmd.Short = `*Beta* List direct group members.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+List direct group members.
+
+  Lists provisioned direct members of a group with their membership source
+  (internal or from identity provider).
+
+  Arguments:
+    GROUP_ID: Required. Internal ID of the group in Databricks whose direct members are
+      being listed.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		_, err = fmt.Sscan(args[0], &listDirectGroupMembersReq.GroupId)
+		if err != nil {
+			return fmt.Errorf("invalid GROUP_ID: %s", args[0])
+		}
+
+		response := a.IamV2.ListDirectGroupMembers(ctx, listDirectGroupMembersReq)
+		if listDirectGroupMembersLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listDirectGroupMembersLimit)
+		}
+		if listDirectGroupMembersLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listDirectGroupMembersLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listDirectGroupMembersOverrides {
+		fn(cmd, &listDirectGroupMembersReq)
+	}
+
+	return cmd
+}
+
+// start list-groups command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listGroupsOverrides []func(
+	*cobra.Command,
+	*iamv2.ListGroupsRequest,
+)
+
+func newListGroups() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listGroupsReq iamv2.ListGroupsRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listGroupsLimit int
+
+	cmd.Flags().StringVar(&listGroupsReq.Filter, "filter", listGroupsReq.Filter, `Optional.`)
+	cmd.Flags().IntVar(&listGroupsReq.PageSize, "page-size", listGroupsReq.PageSize, `The maximum number of groups to return.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listGroupsLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listGroupsReq.PageToken, "page-token", listGroupsReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-groups"
+	cmd.Short = `*Beta* List groups in the account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+List groups in the account.
+
+  Lists the groups in the Databricks account, returning one page per call.
+  Supports filtering by group name or external ID.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(0)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		response := a.IamV2.ListGroups(ctx, listGroupsReq)
+		if listGroupsLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listGroupsLimit)
+		}
+		if listGroupsLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listGroupsLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listGroupsOverrides {
+		fn(cmd, &listGroupsReq)
+	}
+
+	return cmd
+}
+
+// start list-identity-visibility-filters command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listIdentityVisibilityFiltersOverrides []func(
+	*cobra.Command,
+	*iamv2.ListIdentityVisibilityFiltersRequest,
+)
+
+func newListIdentityVisibilityFilters() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listIdentityVisibilityFiltersReq iamv2.ListIdentityVisibilityFiltersRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listIdentityVisibilityFiltersLimit int
+
+	cmd.Flags().IntVar(&listIdentityVisibilityFiltersReq.PageSize, "page-size", listIdentityVisibilityFiltersReq.PageSize, `The maximum number of filters to return.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listIdentityVisibilityFiltersLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listIdentityVisibilityFiltersReq.PageToken, "page-token", listIdentityVisibilityFiltersReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-identity-visibility-filters PARENT"
+	cmd.Short = `List the identity-visibility filters in the account.`
+	cmd.Long = `List the identity-visibility filters in the account.
+
+  Lists group visibility filters in the account, returning one page per call.
+  Requires account admin privileges. Returns filter rules, not the groups
+  matched by those rules. To retrieve the next page, pass the response's
+  next_page_token as page_token in the next request. If next_page_token is
+  omitted, there are no more pages.
+
+  Arguments:
+    PARENT: Required. The parent account. Format: accounts/{account_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		listIdentityVisibilityFiltersReq.Parent = args[0]
+
+		response := a.IamV2.ListIdentityVisibilityFilters(ctx, listIdentityVisibilityFiltersReq)
+		if listIdentityVisibilityFiltersLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listIdentityVisibilityFiltersLimit)
+		}
+		if listIdentityVisibilityFiltersLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listIdentityVisibilityFiltersLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listIdentityVisibilityFiltersOverrides {
+		fn(cmd, &listIdentityVisibilityFiltersReq)
+	}
+
+	return cmd
+}
+
+// start list-service-principals command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listServicePrincipalsOverrides []func(
+	*cobra.Command,
+	*iamv2.ListServicePrincipalsRequest,
+)
+
+func newListServicePrincipals() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listServicePrincipalsReq iamv2.ListServicePrincipalsRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listServicePrincipalsLimit int
+
+	cmd.Flags().StringVar(&listServicePrincipalsReq.Filter, "filter", listServicePrincipalsReq.Filter, `Optional.`)
+	cmd.Flags().IntVar(&listServicePrincipalsReq.PageSize, "page-size", listServicePrincipalsReq.PageSize, `The maximum number of service principals to return.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listServicePrincipalsLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listServicePrincipalsReq.PageToken, "page-token", listServicePrincipalsReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-service-principals"
+	cmd.Short = `*Beta* List service principals in the account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+List service principals in the account.
+
+  Lists the service principals in the Databricks account, returning one page per
+  call. Supports filtering by application ID or external ID.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(0)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		response := a.IamV2.ListServicePrincipals(ctx, listServicePrincipalsReq)
+		if listServicePrincipalsLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listServicePrincipalsLimit)
+		}
+		if listServicePrincipalsLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listServicePrincipalsLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listServicePrincipalsOverrides {
+		fn(cmd, &listServicePrincipalsReq)
+	}
+
+	return cmd
+}
+
+// start list-transitive-parent-groups command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listTransitiveParentGroupsOverrides []func(
+	*cobra.Command,
+	*iamv2.ListTransitiveParentGroupsRequest,
+)
+
+func newListTransitiveParentGroups() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listTransitiveParentGroupsReq iamv2.ListTransitiveParentGroupsRequest
+
+	cmd.Flags().IntVar(&listTransitiveParentGroupsReq.PageSize, "page-size", listTransitiveParentGroupsReq.PageSize, `The maximum number of parent groups to return.`)
+	cmd.Flags().StringVar(&listTransitiveParentGroupsReq.PageToken, "page-token", listTransitiveParentGroupsReq.PageToken, `A page token, received from a previous ListTransitiveParentGroups call.`)
+
+	cmd.Use = "list-transitive-parent-groups PRINCIPAL_ID"
+	cmd.Short = `*Beta* List all transitive parent groups of a principal.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+List all transitive parent groups of a principal.
+
+  Lists all transitive parent groups of a principal.
+
+  Arguments:
+    PRINCIPAL_ID: Required. Internal ID of the principal in Databricks whose transitive
+      parent groups are being listed.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		_, err = fmt.Sscan(args[0], &listTransitiveParentGroupsReq.PrincipalId)
+		if err != nil {
+			return fmt.Errorf("invalid PRINCIPAL_ID: %s", args[0])
+		}
+
+		response, err := a.IamV2.ListTransitiveParentGroups(ctx, listTransitiveParentGroupsReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listTransitiveParentGroupsOverrides {
+		fn(cmd, &listTransitiveParentGroupsReq)
+	}
+
+	return cmd
+}
+
+// start list-users command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listUsersOverrides []func(
+	*cobra.Command,
+	*iamv2.ListUsersRequest,
+)
+
+func newListUsers() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listUsersReq iamv2.ListUsersRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listUsersLimit int
+
+	cmd.Flags().StringVar(&listUsersReq.Filter, "filter", listUsersReq.Filter, `Optional.`)
+	cmd.Flags().IntVar(&listUsersReq.PageSize, "page-size", listUsersReq.PageSize, `The maximum number of users to return.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listUsersLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listUsersReq.PageToken, "page-token", listUsersReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-users"
+	cmd.Short = `*Beta* List users in the account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+List users in the account.
+
+  Lists the users in the Databricks account, returning one page per call.
+  Supports filtering by username or external ID.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(0)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		response := a.IamV2.ListUsers(ctx, listUsersReq)
+		if listUsersLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listUsersLimit)
+		}
+		if listUsersLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listUsersLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listUsersOverrides {
+		fn(cmd, &listUsersReq)
+	}
+
+	return cmd
+}
+
+// start list-workspace-assignment-details command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listWorkspaceAssignmentDetailsOverrides []func(
+	*cobra.Command,
+	*iamv2.ListWorkspaceAssignmentDetailsRequest,
+)
+
+func newListWorkspaceAssignmentDetails() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listWorkspaceAssignmentDetailsReq iamv2.ListWorkspaceAssignmentDetailsRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listWorkspaceAssignmentDetailsLimit int
+
+	cmd.Flags().IntVar(&listWorkspaceAssignmentDetailsReq.PageSize, "page-size", listWorkspaceAssignmentDetailsReq.PageSize, `The maximum number of workspace assignment details to return.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listWorkspaceAssignmentDetailsLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listWorkspaceAssignmentDetailsReq.PageToken, "page-token", listWorkspaceAssignmentDetailsReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-workspace-assignment-details WORKSPACE_ID"
+	cmd.Short = `List workspace assignment details for a workspace.`
+	cmd.Long = `List workspace assignment details for a workspace.
+
+  Lists workspace assignment details for a workspace. The response omits the
+  per-principal entitlement fields (entitlements and
+  effective_entitlements). To read the entitlements for a single principal,
+  get that principal's assignment detail.
+
+  Arguments:
+    WORKSPACE_ID: Required. The workspace ID for which the workspace assignment details are
+      being fetched.`
+
+	// This command is being previewed; hide from help output.
+	cmd.Hidden = true
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		_, err = fmt.Sscan(args[0], &listWorkspaceAssignmentDetailsReq.WorkspaceId)
+		if err != nil {
+			return fmt.Errorf("invalid WORKSPACE_ID: %s", args[0])
+		}
+
+		response := a.IamV2.ListWorkspaceAssignmentDetails(ctx, listWorkspaceAssignmentDetailsReq)
+		if listWorkspaceAssignmentDetailsLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listWorkspaceAssignmentDetailsLimit)
+		}
+		if listWorkspaceAssignmentDetailsLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listWorkspaceAssignmentDetailsLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listWorkspaceAssignmentDetailsOverrides {
+		fn(cmd, &listWorkspaceAssignmentDetailsReq)
+	}
+
+	return cmd
+}
+
+// start list-workspace-assignments command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listWorkspaceAssignmentsOverrides []func(
+	*cobra.Command,
+	*iamv2.ListWorkspaceAssignmentsRequest,
+)
+
+func newListWorkspaceAssignments() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listWorkspaceAssignmentsReq iamv2.ListWorkspaceAssignmentsRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listWorkspaceAssignmentsLimit int
+
+	cmd.Flags().IntVar(&listWorkspaceAssignmentsReq.PageSize, "page-size", listWorkspaceAssignmentsReq.PageSize, `The maximum number of workspace assignments to return.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listWorkspaceAssignmentsLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listWorkspaceAssignmentsReq.PageToken, "page-token", listWorkspaceAssignmentsReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-workspace-assignments WORKSPACE_ID"
+	cmd.Short = `*Beta* List workspace assignments for a workspace.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+List workspace assignments for a workspace.
+
+  Lists workspace assignments for a workspace. The response omits the
+  per-principal entitlement fields (entitlements and
+  effective_entitlements). To read the entitlements for a single principal,
+  get that principal's assignment.
+
+  Arguments:
+    WORKSPACE_ID: Required. The workspace ID for which the workspace assignments are being
+      fetched.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		_, err = fmt.Sscan(args[0], &listWorkspaceAssignmentsReq.WorkspaceId)
+		if err != nil {
+			return fmt.Errorf("invalid WORKSPACE_ID: %s", args[0])
+		}
+
+		response := a.IamV2.ListWorkspaceAssignments(ctx, listWorkspaceAssignmentsReq)
+		if listWorkspaceAssignmentsLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listWorkspaceAssignmentsLimit)
+		}
+		if listWorkspaceAssignmentsLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listWorkspaceAssignmentsLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listWorkspaceAssignmentsOverrides {
+		fn(cmd, &listWorkspaceAssignmentsReq)
+	}
+
+	return cmd
+}
+
+// start resolve-group command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var resolveGroupOverrides []func(
+	*cobra.Command,
+	*iamv2.ResolveGroupRequest,
+)
+
+func newResolveGroup() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var resolveGroupReq iamv2.ResolveGroupRequest
+	var resolveGroupJson flags.JsonFlag
+
+	cmd.Flags().Var(&resolveGroupJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Use = "resolve-group EXTERNAL_ID"
+	cmd.Short = `*Beta* Resolve an external group in the Databricks account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Resolve an external group in the Databricks account.
+
+  Resolves a group with the given external ID from the customer's IdP. If the
+  group does not exist, it will be created in the account. If the customer is
+  not onboarded onto Automatic Identity Management (AIM), this will return an
+  error.
+
+  Arguments:
+    EXTERNAL_ID: Required. The external ID of the group in the customer's IdP.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(0)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'external_id' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := resolveGroupJson.Unmarshal(&resolveGroupReq)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		if !cmd.Flags().Changed("json") {
+			resolveGroupReq.ExternalId = args[0]
+		}
+
+		response, err := a.IamV2.ResolveGroup(ctx, resolveGroupReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range resolveGroupOverrides {
+		fn(cmd, &resolveGroupReq)
+	}
+
+	return cmd
+}
+
+// start resolve-service-principal command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var resolveServicePrincipalOverrides []func(
+	*cobra.Command,
+	*iamv2.ResolveServicePrincipalRequest,
+)
+
+func newResolveServicePrincipal() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var resolveServicePrincipalReq iamv2.ResolveServicePrincipalRequest
+	var resolveServicePrincipalJson flags.JsonFlag
+
+	cmd.Flags().Var(&resolveServicePrincipalJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Use = "resolve-service-principal EXTERNAL_ID"
+	cmd.Short = `*Beta* Resolve an external service principal in the Databricks account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Resolve an external service principal in the Databricks account.
+
+  Resolves a service principal with the given external ID from the customer's
+  IdP. If the service principal does not exist, it will be created. If the
+  customer is not onboarded onto Automatic Identity Management (AIM), this will
+  return an error.
+
+  Arguments:
+    EXTERNAL_ID: Required. The external ID of the service principal in the customer's IdP.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(0)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'external_id' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := resolveServicePrincipalJson.Unmarshal(&resolveServicePrincipalReq)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		if !cmd.Flags().Changed("json") {
+			resolveServicePrincipalReq.ExternalId = args[0]
+		}
+
+		response, err := a.IamV2.ResolveServicePrincipal(ctx, resolveServicePrincipalReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range resolveServicePrincipalOverrides {
+		fn(cmd, &resolveServicePrincipalReq)
+	}
+
+	return cmd
+}
+
+// start resolve-user command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var resolveUserOverrides []func(
+	*cobra.Command,
+	*iamv2.ResolveUserRequest,
+)
+
+func newResolveUser() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var resolveUserReq iamv2.ResolveUserRequest
+	var resolveUserJson flags.JsonFlag
+
+	cmd.Flags().Var(&resolveUserJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Use = "resolve-user EXTERNAL_ID"
+	cmd.Short = `*Beta* Resolve an external user in the Databricks account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Resolve an external user in the Databricks account.
+
+  Resolves a user with the given external ID from the customer's IdP. If the
+  user does not exist, it will be created. If the customer is not onboarded onto
+  Automatic Identity Management (AIM), this will return an error.
+
+  Arguments:
+    EXTERNAL_ID: Required. The external ID of the user in the customer's IdP.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(0)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'external_id' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := resolveUserJson.Unmarshal(&resolveUserReq)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		if !cmd.Flags().Changed("json") {
+			resolveUserReq.ExternalId = args[0]
+		}
+
+		response, err := a.IamV2.ResolveUser(ctx, resolveUserReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range resolveUserOverrides {
+		fn(cmd, &resolveUserReq)
+	}
+
+	return cmd
+}
+
+// start update-group command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateGroupOverrides []func(
+	*cobra.Command,
+	*iamv2.UpdateGroupRequest,
+)
+
+func newUpdateGroup() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateGroupReq iamv2.UpdateGroupRequest
+	updateGroupReq.Group = iamv2.Group{}
+	var updateGroupJson flags.JsonFlag
+
+	cmd.Flags().Var(&updateGroupJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&updateGroupReq.Group.ExternalId, "external-id", updateGroupReq.Group.ExternalId, `ExternalId of the group in the customer's IdP.`)
+	cmd.Flags().StringVar(&updateGroupReq.Group.GroupName, "group-name", updateGroupReq.Group.GroupName, `Display name of the group.`)
+
+	cmd.Use = "update-group GROUP_ID UPDATE_MASK"
+	cmd.Short = `*Beta* Update a group in the account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Update a group in the account.
+
+  Updates an existing group in the Databricks account. Only the fields named in
+  the update mask are modified. Returns the updated Group resource.
+
+  When AIM is enabled and the group is an external identity (its external_id is
+  set), only external_id can be updated; its other fields are sourced from your
+  identity provider. With AIM and group visibility filters, a new nonempty
+  external_id must identify a visible group. Clearing external_id is allowed.
+
+  Authorization: the caller must be an account admin or a manager of the group
+  (holds the roles/group.manager role on it).
+
+  Arguments:
+    GROUP_ID: Required. Internal ID of the group in Databricks.
+    UPDATE_MASK: Optional. The list of fields to update.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updateGroupJson.Unmarshal(&updateGroupReq.Group)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		updateGroupReq.GroupId = args[0]
+		updateGroupReq.UpdateMask = args[1]
+
+		response, err := a.IamV2.UpdateGroup(ctx, updateGroupReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateGroupOverrides {
+		fn(cmd, &updateGroupReq)
+	}
+
+	return cmd
+}
+
+// start update-service-principal command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateServicePrincipalOverrides []func(
+	*cobra.Command,
+	*iamv2.UpdateServicePrincipalRequest,
+)
+
+func newUpdateServicePrincipal() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateServicePrincipalReq iamv2.UpdateServicePrincipalRequest
+	updateServicePrincipalReq.ServicePrincipal = iamv2.ServicePrincipal{}
+	var updateServicePrincipalJson flags.JsonFlag
+
+	cmd.Flags().Var(&updateServicePrincipalJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&updateServicePrincipalReq.ServicePrincipal.ExternalId, "external-id", updateServicePrincipalReq.ServicePrincipal.ExternalId, `ExternalId of the service principal in the customer's IdP.`)
+
+	cmd.Use = "update-service-principal SERVICE_PRINCIPAL_ID UPDATE_MASK DISPLAY_NAME ACCOUNT_SP_STATUS"
+	cmd.Short = `*Beta* Update a service principal in the account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Update a service principal in the account.
+
+  Updates an existing service principal in the Databricks account. Only the
+  fields named in the update mask are modified. Returns the updated
+  ServicePrincipal resource.
+
+  When AIM is enabled and the service principal is an external identity (its
+  external_id is set), only external_id can be updated; its other fields are
+  sourced from your identity provider.
+
+  Arguments:
+    SERVICE_PRINCIPAL_ID: Required. Internal ID of the service principal in Databricks.
+    UPDATE_MASK: Optional. The list of fields to update.
+    DISPLAY_NAME: Display name of the service principal.
+    ACCOUNT_SP_STATUS: The activity status of a service principal in a Databricks account.
+      Supported values: [ACTIVE, INACTIVE]`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(2)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only SERVICE_PRINCIPAL_ID, UPDATE_MASK as positional arguments. Provide 'display_name', 'account_sp_status' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(4)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updateServicePrincipalJson.Unmarshal(&updateServicePrincipalReq.ServicePrincipal)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		updateServicePrincipalReq.ServicePrincipalId = args[0]
+		updateServicePrincipalReq.UpdateMask = args[1]
+		if !cmd.Flags().Changed("json") {
+			updateServicePrincipalReq.ServicePrincipal.DisplayName = args[2]
+		}
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[3], &updateServicePrincipalReq.ServicePrincipal.AccountSpStatus)
+			if err != nil {
+				return fmt.Errorf("invalid ACCOUNT_SP_STATUS: %s", args[3])
+			}
+
+		}
+
+		response, err := a.IamV2.UpdateServicePrincipal(ctx, updateServicePrincipalReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateServicePrincipalOverrides {
+		fn(cmd, &updateServicePrincipalReq)
+	}
+
+	return cmd
+}
+
+// start update-user command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateUserOverrides []func(
+	*cobra.Command,
+	*iamv2.UpdateUserRequest,
+)
+
+func newUpdateUser() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateUserReq iamv2.UpdateUserRequest
+	updateUserReq.User = iamv2.User{}
+	var updateUserJson flags.JsonFlag
+
+	cmd.Flags().Var(&updateUserJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&updateUserReq.User.ExternalId, "external-id", updateUserReq.User.ExternalId, `ExternalId of the user in the customer's IdP.`)
+
+	cmd.Use = "update-user USER_ID UPDATE_MASK USERNAME FULL_NAME ACCOUNT_USER_STATUS"
+	cmd.Short = `*Beta* Update a user in the account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Update a user in the account.
+
+  Updates an existing user in the Databricks account and returns the updated
+  user. Only the fields named in the update mask are modified. The updatable
+  fields are fullName.givenName, fullName.familyName, status, and externalId.
+
+  When AIM is enabled and the user is an external identity (its external_id is
+  set), only external_id can be updated; its other fields are sourced from your
+  identity provider.
+
+  Arguments:
+    USER_ID: Required. Internal ID of the user in Databricks.
+    UPDATE_MASK: Optional. The list of fields to update.
+    USERNAME: Username/email of the user.
+    FULL_NAME:
+    ACCOUNT_USER_STATUS: The activity status of a user in a Databricks account.
+      Supported values: [ACTIVE, INACTIVE]`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(2)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only USER_ID, UPDATE_MASK as positional arguments. Provide 'username', 'full_name', 'account_user_status' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(5)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updateUserJson.Unmarshal(&updateUserReq.User)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		updateUserReq.UserId = args[0]
+		updateUserReq.UpdateMask = args[1]
+		if !cmd.Flags().Changed("json") {
+			updateUserReq.User.Username = args[2]
+		}
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[3], &updateUserReq.User.FullName)
+			if err != nil {
+				return fmt.Errorf("invalid FULL_NAME: %s", args[3])
+			}
+
+		}
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[4], &updateUserReq.User.AccountUserStatus)
+			if err != nil {
+				return fmt.Errorf("invalid ACCOUNT_USER_STATUS: %s", args[4])
+			}
+
+		}
+
+		response, err := a.IamV2.UpdateUser(ctx, updateUserReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateUserOverrides {
+		fn(cmd, &updateUserReq)
+	}
+
+	return cmd
+}
+
+// start update-workspace-assignment command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateWorkspaceAssignmentOverrides []func(
+	*cobra.Command,
+	*iamv2.UpdateWorkspaceAssignmentRequest,
+)
+
+func newUpdateWorkspaceAssignment() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateWorkspaceAssignmentReq iamv2.UpdateWorkspaceAssignmentRequest
+	updateWorkspaceAssignmentReq.WorkspaceAssignment = iamv2.WorkspaceAssignment{}
+	var updateWorkspaceAssignmentJson flags.JsonFlag
+
+	cmd.Flags().Var(&updateWorkspaceAssignmentJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: effective_entitlements
+	// TODO: array: entitlements
+
+	cmd.Use = "update-workspace-assignment WORKSPACE_ID PRINCIPAL_ID UPDATE_MASK PRINCIPAL_ID"
+	cmd.Short = `*Beta* Update a workspace assignment.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Update a workspace assignment.
+
+  Updates the entitlements of a directly assigned principal in a workspace.
+  Changes are applied one at a time rather than atomically. If the request fails
+  partway through, only some of the requested changes take effect. Get the
+  assignment afterwards to confirm the final state.
+
+  Arguments:
+    WORKSPACE_ID: Required. The workspace ID for which the workspace assignment is being
+      updated.
+    PRINCIPAL_ID: Required. ID of the principal in Databricks.
+    UPDATE_MASK: Required. The list of fields to update.
+    PRINCIPAL_ID: The internal ID of the principal (user/sp/group) in Databricks.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(3)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only WORKSPACE_ID, PRINCIPAL_ID, UPDATE_MASK as positional arguments. Provide 'principal_id' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(4)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updateWorkspaceAssignmentJson.Unmarshal(&updateWorkspaceAssignmentReq.WorkspaceAssignment)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		_, err = fmt.Sscan(args[0], &updateWorkspaceAssignmentReq.WorkspaceId)
+		if err != nil {
+			return fmt.Errorf("invalid WORKSPACE_ID: %s", args[0])
+		}
+
+		_, err = fmt.Sscan(args[1], &updateWorkspaceAssignmentReq.PrincipalId)
+		if err != nil {
+			return fmt.Errorf("invalid PRINCIPAL_ID: %s", args[1])
+		}
+
+		if args[2] != "" {
+			updateMaskArray := strings.Split(args[2], ",")
+			updateWorkspaceAssignmentReq.UpdateMask = *fieldmask.New(updateMaskArray)
+		}
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[3], &updateWorkspaceAssignmentReq.WorkspaceAssignment.PrincipalId)
+			if err != nil {
+				return fmt.Errorf("invalid PRINCIPAL_ID: %s", args[3])
+			}
+
+		}
+
+		response, err := a.IamV2.UpdateWorkspaceAssignment(ctx, updateWorkspaceAssignmentReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateWorkspaceAssignmentOverrides {
+		fn(cmd, &updateWorkspaceAssignmentReq)
+	}
+
+	return cmd
+}
+
+// start update-workspace-assignment-detail command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateWorkspaceAssignmentDetailOverrides []func(
+	*cobra.Command,
+	*iamv2.UpdateWorkspaceAssignmentDetailRequest,
+)
+
+func newUpdateWorkspaceAssignmentDetail() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateWorkspaceAssignmentDetailReq iamv2.UpdateWorkspaceAssignmentDetailRequest
+	updateWorkspaceAssignmentDetailReq.WorkspaceAssignmentDetail = iamv2.WorkspaceAssignmentDetail{}
+	var updateWorkspaceAssignmentDetailJson flags.JsonFlag
+
+	cmd.Flags().Var(&updateWorkspaceAssignmentDetailJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: effective_entitlements
+	// TODO: array: entitlements
+
+	cmd.Use = "update-workspace-assignment-detail WORKSPACE_ID PRINCIPAL_ID UPDATE_MASK PRINCIPAL_ID"
+	cmd.Short = `Update a workspace assignment detail.`
+	cmd.Long = `Update a workspace assignment detail.
+
+  Updates the entitlements of a directly assigned principal in a workspace.
+  Changes are applied one at a time rather than atomically. If the request fails
+  partway through, only some of the requested changes take effect. Get the
+  assignment detail afterwards to confirm the final state.
+
+  Arguments:
+    WORKSPACE_ID: Required. The workspace ID for which the workspace assignment detail is
+      being updated.
+    PRINCIPAL_ID: Required. ID of the principal in Databricks.
+    UPDATE_MASK: Required. The list of fields to update.
+    PRINCIPAL_ID: The internal ID of the principal (user/sp/group) in Databricks.`
+
+	// This command is being previewed; hide from help output.
+	cmd.Hidden = true
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(3)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only WORKSPACE_ID, PRINCIPAL_ID, UPDATE_MASK as positional arguments. Provide 'principal_id' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(4)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updateWorkspaceAssignmentDetailJson.Unmarshal(&updateWorkspaceAssignmentDetailReq.WorkspaceAssignmentDetail)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		_, err = fmt.Sscan(args[0], &updateWorkspaceAssignmentDetailReq.WorkspaceId)
+		if err != nil {
+			return fmt.Errorf("invalid WORKSPACE_ID: %s", args[0])
+		}
+
+		_, err = fmt.Sscan(args[1], &updateWorkspaceAssignmentDetailReq.PrincipalId)
+		if err != nil {
+			return fmt.Errorf("invalid PRINCIPAL_ID: %s", args[1])
+		}
+
+		if args[2] != "" {
+			updateMaskArray := strings.Split(args[2], ",")
+			updateWorkspaceAssignmentDetailReq.UpdateMask = *fieldmask.New(updateMaskArray)
+		}
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[3], &updateWorkspaceAssignmentDetailReq.WorkspaceAssignmentDetail.PrincipalId)
+			if err != nil {
+				return fmt.Errorf("invalid PRINCIPAL_ID: %s", args[3])
+			}
+
+		}
+
+		response, err := a.IamV2.UpdateWorkspaceAssignmentDetail(ctx, updateWorkspaceAssignmentDetailReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateWorkspaceAssignmentDetailOverrides {
+		fn(cmd, &updateWorkspaceAssignmentDetailReq)
 	}
 
 	return cmd
diff --git a/cmd/account/ip-access-lists/ip-access-lists.go b/cmd/account/ip-access-lists/ip-access-lists.go
old mode 100755
new mode 100644
index 187cce71305..7e9dab8b09b
--- a/cmd/account/ip-access-lists/ip-access-lists.go
+++ b/cmd/account/ip-access-lists/ip-access-lists.go
@@ -3,6 +3,7 @@
 package ip_access_lists
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -47,6 +48,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -107,12 +112,14 @@ func newCreate() *cobra.Command {
       Supported values: [ALLOW, BLOCK]`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'label', 'list_type' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'label', 'list_type' in your JSON input")
 			}
 			return nil
 		}
@@ -192,6 +199,8 @@ func newDelete() *cobra.Command {
     IP_ACCESS_LIST_ID: The ID for the corresponding IP access list`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustAccountClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -213,7 +222,7 @@ func newDelete() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the id for the corresponding ip access list")
+			return errors.New("expected to have the id for the corresponding ip access list")
 		}
 		deleteReq.IpAccessListId = args[0]
 
@@ -260,6 +269,8 @@ func newGet() *cobra.Command {
     IP_ACCESS_LIST_ID: The ID for the corresponding IP access list`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustAccountClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -281,7 +292,7 @@ func newGet() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the id for the corresponding ip access list")
+			return errors.New("expected to have the id for the corresponding ip access list")
 		}
 		getReq.IpAccessListId = args[0]
 
@@ -332,6 +343,8 @@ func newList() *cobra.Command {
   Gets all IP access lists for the specified account.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustAccountClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -402,12 +415,14 @@ func newReplace() *cobra.Command {
     ENABLED: Specifies whether this IP access list is enabled.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(1)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only IP_ACCESS_LIST_ID as positional arguments. Provide 'label', 'list_type', 'enabled' in your JSON input")
+				return errors.New("when --json flag is specified, provide only IP_ACCESS_LIST_ID as positional arguments. Provide 'label', 'list_type', 'enabled' in your JSON input")
 			}
 			return nil
 		}
@@ -515,6 +530,8 @@ func newUpdate() *cobra.Command {
     IP_ACCESS_LIST_ID: The ID for the corresponding IP access list`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustAccountClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -548,7 +565,7 @@ func newUpdate() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the id for the corresponding ip access list")
+			return errors.New("expected to have the id for the corresponding ip access list")
 		}
 		updateReq.IpAccessListId = args[0]
 
diff --git a/cmd/account/llm-proxy-partner-powered-account/llm-proxy-partner-powered-account.go b/cmd/account/llm-proxy-partner-powered-account/llm-proxy-partner-powered-account.go
old mode 100755
new mode 100644
index fa094ed844b..c81d65af84c
--- a/cmd/account/llm-proxy-partner-powered-account/llm-proxy-partner-powered-account.go
+++ b/cmd/account/llm-proxy-partner-powered-account/llm-proxy-partner-powered-account.go
@@ -3,7 +3,7 @@
 package llm_proxy_partner_powered_account
 
 import (
-	"fmt"
+	"errors"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
@@ -28,6 +28,10 @@ func New() *cobra.Command {
 		RunE:   root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
 	// Add methods
 	cmd.AddCommand(newGet())
 	cmd.AddCommand(newUpdate())
@@ -63,6 +67,8 @@ func newGet() *cobra.Command {
   Gets the enable partner powered AI features account setting.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -118,6 +124,8 @@ func newUpdate() *cobra.Command {
   Updates the enable partner powered AI features account setting.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.PreRunE = root.MustAccountClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -136,7 +144,7 @@ func newUpdate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := a.Settings.LlmProxyPartnerPoweredAccount().Update(ctx, updateReq)
diff --git a/cmd/account/llm-proxy-partner-powered-enforce/llm-proxy-partner-powered-enforce.go b/cmd/account/llm-proxy-partner-powered-enforce/llm-proxy-partner-powered-enforce.go
old mode 100755
new mode 100644
index 94428f62769..035b0a0accf
--- a/cmd/account/llm-proxy-partner-powered-enforce/llm-proxy-partner-powered-enforce.go
+++ b/cmd/account/llm-proxy-partner-powered-enforce/llm-proxy-partner-powered-enforce.go
@@ -3,7 +3,7 @@
 package llm_proxy_partner_powered_enforce
 
 import (
-	"fmt"
+	"errors"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
@@ -29,6 +29,10 @@ func New() *cobra.Command {
 		RunE:   root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
 	// Add methods
 	cmd.AddCommand(newGet())
 	cmd.AddCommand(newUpdate())
@@ -64,6 +68,8 @@ func newGet() *cobra.Command {
   Gets the enforcement status of partner powered AI features account setting.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -120,6 +126,8 @@ func newUpdate() *cobra.Command {
   setting.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.PreRunE = root.MustAccountClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -138,7 +146,7 @@ func newUpdate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := a.Settings.LlmProxyPartnerPoweredEnforce().Update(ctx, updateReq)
diff --git a/cmd/account/log-delivery/log-delivery.go b/cmd/account/log-delivery/log-delivery.go
old mode 100755
new mode 100644
index 348df018025..93310e7aad5
--- a/cmd/account/log-delivery/log-delivery.go
+++ b/cmd/account/log-delivery/log-delivery.go
@@ -3,6 +3,7 @@
 package log_delivery
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -91,6 +92,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newGet())
@@ -153,6 +158,8 @@ func newCreate() *cobra.Command {
   [Deliver and access billable usage logs]: https://docs.databricks.com/administration-guide/account-settings/billable-usage-delivery.html`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustAccountClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -171,7 +178,7 @@ func newCreate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := a.LogDelivery.Create(ctx, createReq)
@@ -219,6 +226,8 @@ func newGet() *cobra.Command {
     LOG_DELIVERY_CONFIGURATION_ID: The log delivery configuration id of customer`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustAccountClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -240,7 +249,7 @@ func newGet() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the log delivery configuration id of customer")
+			return errors.New("expected to have the log delivery configuration id of customer")
 		}
 		getReq.LogDeliveryConfigurationId = args[0]
 
@@ -301,6 +310,8 @@ func newList() *cobra.Command {
   specified by ID.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -372,12 +383,14 @@ func newPatchStatus() *cobra.Command {
       Supported values: [DISABLED, ENABLED]`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(1)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only LOG_DELIVERY_CONFIGURATION_ID as positional arguments. Provide 'status' in your JSON input")
+				return errors.New("when --json flag is specified, provide only LOG_DELIVERY_CONFIGURATION_ID as positional arguments. Provide 'status' in your JSON input")
 			}
 			return nil
 		}
diff --git a/cmd/account/metastore-assignments/metastore-assignments.go b/cmd/account/metastore-assignments/metastore-assignments.go
old mode 100755
new mode 100644
index 124d059cea1..622b56f75dd
--- a/cmd/account/metastore-assignments/metastore-assignments.go
+++ b/cmd/account/metastore-assignments/metastore-assignments.go
@@ -26,6 +26,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -71,6 +75,8 @@ func newCreate() *cobra.Command {
     METASTORE_ID: Unity Catalog metastore ID`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -147,6 +153,8 @@ func newDelete() *cobra.Command {
     METASTORE_ID: Unity Catalog metastore ID`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -212,6 +220,8 @@ func newGet() *cobra.Command {
     WORKSPACE_ID: Workspace ID.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -282,6 +292,8 @@ func newList() *cobra.Command {
     METASTORE_ID: Unity Catalog metastore ID`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -349,6 +361,8 @@ func newUpdate() *cobra.Command {
     METASTORE_ID: Unity Catalog metastore ID`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
diff --git a/cmd/account/metastores/metastores.go b/cmd/account/metastores/metastores.go
old mode 100755
new mode 100644
index 8d58352bc3b..7967101987f
--- a/cmd/account/metastores/metastores.go
+++ b/cmd/account/metastores/metastores.go
@@ -27,6 +27,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -68,6 +72,8 @@ func newCreate() *cobra.Command {
   Creates a Unity Catalog metastore.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -138,6 +144,8 @@ func newDelete() *cobra.Command {
     METASTORE_ID: Unity Catalog metastore ID`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -195,6 +203,8 @@ func newGet() *cobra.Command {
     METASTORE_ID: Unity Catalog metastore ID`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -255,6 +265,8 @@ func newList() *cobra.Command {
   Gets all Unity Catalog metastores associated with an account specified by ID.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustAccountClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -312,6 +324,8 @@ func newUpdate() *cobra.Command {
     METASTORE_ID: Unity Catalog metastore ID`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/account/network-connectivity/network-connectivity.go b/cmd/account/network-connectivity/network-connectivity.go
old mode 100755
new mode 100644
index 3f8c32ed001..3a1b00e18f6
--- a/cmd/account/network-connectivity/network-connectivity.go
+++ b/cmd/account/network-connectivity/network-connectivity.go
@@ -3,6 +3,7 @@
 package network_connectivity
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -34,6 +35,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreateNetworkConnectivityConfiguration())
 	cmd.AddCommand(newCreatePrivateEndpointRule())
@@ -98,12 +103,14 @@ func newCreateNetworkConnectivityConfiguration() *cobra.Command {
       the same region can be attached to the network connectivity configuration.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'region' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'region' in your JSON input")
 			}
 			return nil
 		}
@@ -200,6 +207,8 @@ func newCreatePrivateEndpointRule() *cobra.Command {
     NETWORK_CONNECTIVITY_CONFIG_ID: Your Network Connectivity Configuration ID.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -269,6 +278,8 @@ func newDeleteNetworkConnectivityConfiguration() *cobra.Command {
     NETWORK_CONNECTIVITY_CONFIG_ID: Your Network Connectivity Configuration ID.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -321,7 +332,7 @@ func newDeletePrivateEndpointRule() *cobra.Command {
 
   Initiates deleting a private endpoint rule. If the connection state is PENDING
   or EXPIRED, the private endpoint is immediately deleted. Otherwise, the
-  private endpoint is deactivated and will be deleted after seven days of
+  private endpoint is deactivated and will be deleted after one day of
   deactivation. When a private endpoint is deactivated, the deactivated field
   is set to true and the private endpoint is not available to your serverless
   compute resources.
@@ -331,6 +342,8 @@ func newDeletePrivateEndpointRule() *cobra.Command {
     PRIVATE_ENDPOINT_RULE_ID: Your private endpoint rule ID.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -389,6 +402,8 @@ func newGetNetworkConnectivityConfiguration() *cobra.Command {
     NETWORK_CONNECTIVITY_CONFIG_ID: Your Network Connectivity Configuration ID.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -447,6 +462,8 @@ func newGetPrivateEndpointRule() *cobra.Command {
     PRIVATE_ENDPOINT_RULE_ID: Your private endpoint rule ID.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -513,6 +530,8 @@ func newListNetworkConnectivityConfigurations() *cobra.Command {
   Gets an array of network connectivity configurations.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -582,6 +601,8 @@ func newListPrivateEndpointRules() *cobra.Command {
     NETWORK_CONNECTIVITY_CONFIG_ID: Your Network Connectvity Configuration ID.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -637,7 +658,7 @@ func newUpdatePrivateEndpointRule() *cobra.Command {
 	cmd.Flags().Var(&updatePrivateEndpointRuleJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	// TODO: array: domain_names
-	cmd.Flags().BoolVar(&updatePrivateEndpointRuleReq.PrivateEndpointRule.Enabled, "enabled", updatePrivateEndpointRuleReq.PrivateEndpointRule.Enabled, `Only used by private endpoints towards an AWS S3 service.`)
+	cmd.Flags().BoolVar(&updatePrivateEndpointRuleReq.PrivateEndpointRule.Enabled, "enabled", updatePrivateEndpointRuleReq.PrivateEndpointRule.Enabled, `Update this field to activate/deactivate this private endpoint to allow egress access from serverless compute resources.`)
 	cmd.Flags().StringVar(&updatePrivateEndpointRuleReq.PrivateEndpointRule.ErrorMessage, "error-message", updatePrivateEndpointRuleReq.PrivateEndpointRule.ErrorMessage, ``)
 	// TODO: complex arg: gcp_endpoint
 	// TODO: array: resource_names
@@ -661,6 +682,8 @@ func newUpdatePrivateEndpointRule() *cobra.Command {
       exactly match the resource field names.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(3)
diff --git a/cmd/account/network-policies/network-policies.go b/cmd/account/network-policies/network-policies.go
old mode 100755
new mode 100644
index 229012a888a..15cc31d5fa0
--- a/cmd/account/network-policies/network-policies.go
+++ b/cmd/account/network-policies/network-policies.go
@@ -32,6 +32,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreateNetworkPolicyRpc())
 	cmd.AddCommand(newDeleteNetworkPolicyRpc())
@@ -78,6 +82,8 @@ func newCreateNetworkPolicyRpc() *cobra.Command {
   accessed from the Databricks environment.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -146,6 +152,8 @@ func newDeleteNetworkPolicyRpc() *cobra.Command {
     NETWORK_POLICY_ID: The unique identifier of the network policy to delete.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -202,6 +210,8 @@ func newGetNetworkPolicyRpc() *cobra.Command {
     NETWORK_POLICY_ID: The unique identifier of the network policy to retrieve.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -267,6 +277,8 @@ func newListNetworkPoliciesRpc() *cobra.Command {
   Gets an array of network policies.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -335,6 +347,8 @@ func newUpdateNetworkPolicyRpc() *cobra.Command {
     NETWORK_POLICY_ID: The unique identifier for the network policy.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/account/networks/networks.go b/cmd/account/networks/networks.go
old mode 100755
new mode 100644
index 4845a1aa3b2..ae7318e76b9
--- a/cmd/account/networks/networks.go
+++ b/cmd/account/networks/networks.go
@@ -25,6 +25,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -72,6 +76,8 @@ func newCreate() *cobra.Command {
   pre-existing VPC and subnets.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -145,6 +151,8 @@ func newDelete() *cobra.Command {
     NETWORK_ID: Databricks Account API network configuration ID.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -203,6 +211,8 @@ func newGet() *cobra.Command {
     NETWORK_ID: Databricks Account API network configuration ID.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -254,6 +264,8 @@ func newList() *cobra.Command {
   Lists Databricks network configurations for an account.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustAccountClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
diff --git a/cmd/account/o-auth-published-apps/o-auth-published-apps.go b/cmd/account/o-auth-published-apps/o-auth-published-apps.go
old mode 100755
new mode 100644
index 2bade901da7..89b96f0fadb
--- a/cmd/account/o-auth-published-apps/o-auth-published-apps.go
+++ b/cmd/account/o-auth-published-apps/o-auth-published-apps.go
@@ -28,6 +28,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newList())
 
@@ -73,6 +77,8 @@ func newList() *cobra.Command {
   Get all the available published OAuth apps in Databricks.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
diff --git a/cmd/account/personal-compute/personal-compute.go b/cmd/account/personal-compute/personal-compute.go
old mode 100755
new mode 100644
index 1888fc237fe..1e6c3569975
--- a/cmd/account/personal-compute/personal-compute.go
+++ b/cmd/account/personal-compute/personal-compute.go
@@ -3,7 +3,7 @@
 package personal_compute
 
 import (
-	"fmt"
+	"errors"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
@@ -36,6 +36,10 @@ func New() *cobra.Command {
 		RunE:   root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
 	// Add methods
 	cmd.AddCommand(newDelete())
 	cmd.AddCommand(newGet())
@@ -72,6 +76,8 @@ func newDelete() *cobra.Command {
   Reverts back the Personal Compute setting value to default (ON)`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -126,6 +132,8 @@ func newGet() *cobra.Command {
   Gets the value of the Personal Compute setting.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -181,6 +189,8 @@ func newUpdate() *cobra.Command {
   Updates the value of the Personal Compute setting.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.PreRunE = root.MustAccountClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -199,7 +209,7 @@ func newUpdate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := a.Settings.PersonalCompute().Update(ctx, updateReq)
diff --git a/cmd/account/private-access/private-access.go b/cmd/account/private-access/private-access.go
old mode 100755
new mode 100644
index 2933414a449..779cad0cff7
--- a/cmd/account/private-access/private-access.go
+++ b/cmd/account/private-access/private-access.go
@@ -24,6 +24,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -72,6 +76,8 @@ func newCreate() *cobra.Command {
   private endpoints.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -138,6 +144,8 @@ func newDelete() *cobra.Command {
   ID.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -192,6 +200,8 @@ func newGet() *cobra.Command {
   Gets a Databricks private access settings configuration, both specified by ID.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -243,6 +253,8 @@ func newList() *cobra.Command {
   Lists Databricks private access settings for an account.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustAccountClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -314,6 +326,8 @@ func newReplace() *cobra.Command {
     PRIVATE_ACCESS_SETTINGS_ID: Databricks private access settings ID.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/account/private-network-gateways/private-network-gateways.go b/cmd/account/private-network-gateways/private-network-gateways.go
new file mode 100644
index 00000000000..aae82a8b651
--- /dev/null
+++ b/cmd/account/private-network-gateways/private-network-gateways.go
@@ -0,0 +1,559 @@
+// Code generated from OpenAPI specs by Databricks SDK Generator. DO NOT EDIT.
+
+package private_network_gateways
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/databricks-sdk-go/common/types/fieldmask"
+	"github.com/databricks/databricks-sdk-go/experimental/api"
+	"github.com/databricks/databricks-sdk-go/service/networking"
+	"github.com/spf13/cobra"
+)
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var cmdOverrides []func(*cobra.Command)
+
+func New() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "private-network-gateways",
+		Short: `These APIs manage private network gateways under network connectivity configurations.`,
+		Long: `These APIs manage private network gateways under network connectivity
+  configurations.`,
+		GroupID: "provisioning",
+
+		// This service is being previewed; hide from help output.
+		Hidden: true,
+		RunE:   root.ReportUnknownSubcommand,
+	}
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	// Add methods
+	cmd.AddCommand(newCreatePrivateNetworkGateway())
+	cmd.AddCommand(newDeletePrivateNetworkGateway())
+	cmd.AddCommand(newGetPrivateNetworkGateway())
+	cmd.AddCommand(newGetPrivateNetworkGatewayOperation())
+	cmd.AddCommand(newListPrivateNetworkGateways())
+	cmd.AddCommand(newUpdatePrivateNetworkGateway())
+
+	// Apply optional overrides to this command.
+	for _, fn := range cmdOverrides {
+		fn(cmd)
+	}
+
+	return cmd
+}
+
+// start create-private-network-gateway command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var createPrivateNetworkGatewayOverrides []func(
+	*cobra.Command,
+	*networking.CreatePrivateNetworkGatewayRequest,
+)
+
+func newCreatePrivateNetworkGateway() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var createPrivateNetworkGatewayReq networking.CreatePrivateNetworkGatewayRequest
+	createPrivateNetworkGatewayReq.PrivateNetworkGateway = networking.PrivateNetworkGateway{}
+	var createPrivateNetworkGatewayJson flags.JsonFlag
+
+	var createPrivateNetworkGatewaySkipWait bool
+	var createPrivateNetworkGatewayTimeout time.Duration
+
+	cmd.Flags().BoolVar(&createPrivateNetworkGatewaySkipWait, "no-wait", createPrivateNetworkGatewaySkipWait, `do not wait to reach DONE state`)
+	cmd.Flags().DurationVar(&createPrivateNetworkGatewayTimeout, "timeout", 0, `maximum amount of time to reach DONE state`)
+
+	cmd.Flags().Var(&createPrivateNetworkGatewayJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&createPrivateNetworkGatewayReq.RequestId, "request-id", createPrivateNetworkGatewayReq.RequestId, `A unique identifier for this request.`)
+	// TODO: complex arg: aws_cloud_connection
+	// TODO: complex arg: azure_cloud_connection
+	cmd.Flags().IntVar(&createPrivateNetworkGatewayReq.PrivateNetworkGateway.BandwidthTierGigabitsPerSecond, "bandwidth-tier-gigabits-per-second", createPrivateNetworkGatewayReq.PrivateNetworkGateway.BandwidthTierGigabitsPerSecond, `The provisioned bandwidth tier for an Azure gateway, in gigabits per second.`)
+	// TODO: array: destinations
+	cmd.Flags().StringVar(&createPrivateNetworkGatewayReq.PrivateNetworkGateway.Name, "name", createPrivateNetworkGatewayReq.PrivateNetworkGateway.Name, `The canonical resource name of the gateway, in the form accounts/{account_id}/network-connectivity-configs/{ncc_id}/private-network-gateways/{gateway_id}.`)
+	// TODO: array: private_dns_resolvers
+
+	cmd.Use = "create-private-network-gateway PARENT DISPLAY_NAME TRAFFIC_MODE"
+	cmd.Short = `Create a private network gateway.`
+	cmd.Long = `Create a private network gateway.
+
+  Creates a private network gateway.
+
+  This is a long-running operation. By default, the command waits for the
+  operation to complete. Use --no-wait to return immediately with the raw
+  operation details. The operation's 'name' field can then be used to poll for
+  completion using the get-private-network-gateway-operation command.
+
+  Arguments:
+    PARENT: The network connectivity configuration that will contain the gateway.
+    DISPLAY_NAME: The human-readable name of the gateway.
+    TRAFFIC_MODE: The traffic routed through this gateway.
+      Supported values: [ALL_TRAFFIC, SPECIFIC_DESTINATIONS]`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(1)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only PARENT as positional arguments. Provide 'display_name', 'traffic_mode' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(3)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := createPrivateNetworkGatewayJson.Unmarshal(&createPrivateNetworkGatewayReq.PrivateNetworkGateway)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		createPrivateNetworkGatewayReq.Parent = args[0]
+		if !cmd.Flags().Changed("json") {
+			createPrivateNetworkGatewayReq.PrivateNetworkGateway.DisplayName = args[1]
+		}
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[2], &createPrivateNetworkGatewayReq.PrivateNetworkGateway.TrafficMode)
+			if err != nil {
+				return fmt.Errorf("invalid TRAFFIC_MODE: %s", args[2])
+			}
+
+		}
+
+		// Determine which mode to execute based on flags.
+		switch {
+		case createPrivateNetworkGatewaySkipWait:
+			wait, err := a.PrivateNetworkGateways.CreatePrivateNetworkGateway(ctx, createPrivateNetworkGatewayReq)
+			if err != nil {
+				return err
+			}
+
+			// Return operation immediately without waiting.
+			operation, err := a.PrivateNetworkGateways.GetPrivateNetworkGatewayOperation(ctx, networking.GetOperationRequest{
+				Name: wait.Name(),
+			})
+			if err != nil {
+				return err
+			}
+			return cmdio.Render(ctx, operation)
+
+		default:
+			wait, err := a.PrivateNetworkGateways.CreatePrivateNetworkGateway(ctx, createPrivateNetworkGatewayReq)
+			if err != nil {
+				return err
+			}
+
+			// Show spinner while waiting for completion.
+			sp := cmdio.NewSpinner(ctx)
+			sp.Update("Waiting for create-private-network-gateway to complete...")
+
+			// Wait for completion.
+			opts := api.WithTimeout(createPrivateNetworkGatewayTimeout)
+			response, err := wait.Wait(ctx, opts)
+			if err != nil {
+				return err
+			}
+			sp.Close()
+			return cmdio.Render(ctx, response)
+		}
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range createPrivateNetworkGatewayOverrides {
+		fn(cmd, &createPrivateNetworkGatewayReq)
+	}
+
+	return cmd
+}
+
+// start delete-private-network-gateway command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deletePrivateNetworkGatewayOverrides []func(
+	*cobra.Command,
+	*networking.DeletePrivateNetworkGatewayRequest,
+)
+
+func newDeletePrivateNetworkGateway() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deletePrivateNetworkGatewayReq networking.DeletePrivateNetworkGatewayRequest
+
+	cmd.Use = "delete-private-network-gateway NAME"
+	cmd.Short = `Delete a private network gateway.`
+	cmd.Long = `Delete a private network gateway.
+
+  Permanently deletes a private network gateway.
+
+  Arguments:
+    NAME: The canonical resource name of the gateway.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		deletePrivateNetworkGatewayReq.Name = args[0]
+
+		err = a.PrivateNetworkGateways.DeletePrivateNetworkGateway(ctx, deletePrivateNetworkGatewayReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deletePrivateNetworkGatewayOverrides {
+		fn(cmd, &deletePrivateNetworkGatewayReq)
+	}
+
+	return cmd
+}
+
+// start get-private-network-gateway command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getPrivateNetworkGatewayOverrides []func(
+	*cobra.Command,
+	*networking.GetPrivateNetworkGatewayRequest,
+)
+
+func newGetPrivateNetworkGateway() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getPrivateNetworkGatewayReq networking.GetPrivateNetworkGatewayRequest
+
+	cmd.Use = "get-private-network-gateway NAME"
+	cmd.Short = `Get a private network gateway.`
+	cmd.Long = `Get a private network gateway.
+
+  Gets a private network gateway.
+
+  Arguments:
+    NAME: The canonical resource name of the gateway.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		getPrivateNetworkGatewayReq.Name = args[0]
+
+		response, err := a.PrivateNetworkGateways.GetPrivateNetworkGateway(ctx, getPrivateNetworkGatewayReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getPrivateNetworkGatewayOverrides {
+		fn(cmd, &getPrivateNetworkGatewayReq)
+	}
+
+	return cmd
+}
+
+// start get-private-network-gateway-operation command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getPrivateNetworkGatewayOperationOverrides []func(
+	*cobra.Command,
+	*networking.GetOperationRequest,
+)
+
+func newGetPrivateNetworkGatewayOperation() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getPrivateNetworkGatewayOperationReq networking.GetOperationRequest
+
+	cmd.Use = "get-private-network-gateway-operation NAME"
+	cmd.Short = `Get a private network gateway operation.`
+	cmd.Long = `Get a private network gateway operation.
+
+  Gets the status of a private network gateway create operation.
+
+  Arguments:
+    NAME: The name of the operation resource.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		getPrivateNetworkGatewayOperationReq.Name = args[0]
+
+		response, err := a.PrivateNetworkGateways.GetPrivateNetworkGatewayOperation(ctx, getPrivateNetworkGatewayOperationReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getPrivateNetworkGatewayOperationOverrides {
+		fn(cmd, &getPrivateNetworkGatewayOperationReq)
+	}
+
+	return cmd
+}
+
+// start list-private-network-gateways command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listPrivateNetworkGatewaysOverrides []func(
+	*cobra.Command,
+	*networking.ListPrivateNetworkGatewaysRequest,
+)
+
+func newListPrivateNetworkGateways() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listPrivateNetworkGatewaysReq networking.ListPrivateNetworkGatewaysRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listPrivateNetworkGatewaysLimit int
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listPrivateNetworkGatewaysLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listPrivateNetworkGatewaysReq.PageToken, "page-token", listPrivateNetworkGatewaysReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-private-network-gateways PARENT"
+	cmd.Short = `List private network gateways.`
+	cmd.Long = `List private network gateways.
+
+  Lists private network gateways under a network connectivity configuration.
+
+  Arguments:
+    PARENT: The network connectivity configuration containing the gateways.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		listPrivateNetworkGatewaysReq.Parent = args[0]
+
+		response := a.PrivateNetworkGateways.ListPrivateNetworkGateways(ctx, listPrivateNetworkGatewaysReq)
+		if listPrivateNetworkGatewaysLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listPrivateNetworkGatewaysLimit)
+		}
+		if listPrivateNetworkGatewaysLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listPrivateNetworkGatewaysLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listPrivateNetworkGatewaysOverrides {
+		fn(cmd, &listPrivateNetworkGatewaysReq)
+	}
+
+	return cmd
+}
+
+// start update-private-network-gateway command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updatePrivateNetworkGatewayOverrides []func(
+	*cobra.Command,
+	*networking.UpdatePrivateNetworkGatewayRequest,
+)
+
+func newUpdatePrivateNetworkGateway() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updatePrivateNetworkGatewayReq networking.UpdatePrivateNetworkGatewayRequest
+	updatePrivateNetworkGatewayReq.PrivateNetworkGateway = networking.PrivateNetworkGateway{}
+	var updatePrivateNetworkGatewayJson flags.JsonFlag
+
+	cmd.Flags().Var(&updatePrivateNetworkGatewayJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: complex arg: aws_cloud_connection
+	// TODO: complex arg: azure_cloud_connection
+	cmd.Flags().IntVar(&updatePrivateNetworkGatewayReq.PrivateNetworkGateway.BandwidthTierGigabitsPerSecond, "bandwidth-tier-gigabits-per-second", updatePrivateNetworkGatewayReq.PrivateNetworkGateway.BandwidthTierGigabitsPerSecond, `The provisioned bandwidth tier for an Azure gateway, in gigabits per second.`)
+	// TODO: array: destinations
+	cmd.Flags().StringVar(&updatePrivateNetworkGatewayReq.PrivateNetworkGateway.Name, "name", updatePrivateNetworkGatewayReq.PrivateNetworkGateway.Name, `The canonical resource name of the gateway, in the form accounts/{account_id}/network-connectivity-configs/{ncc_id}/private-network-gateways/{gateway_id}.`)
+	// TODO: array: private_dns_resolvers
+
+	cmd.Use = "update-private-network-gateway NAME UPDATE_MASK DISPLAY_NAME TRAFFIC_MODE"
+	cmd.Short = `Update a private network gateway.`
+	cmd.Long = `Update a private network gateway.
+
+  Updates a private network gateway.
+
+  Arguments:
+    NAME: The canonical resource name of the gateway, in the form
+      accounts/{account_id}/network-connectivity-configs/{ncc_id}/private-network-gateways/{gateway_id}.
+    UPDATE_MASK: The fields to update.
+    DISPLAY_NAME: The human-readable name of the gateway.
+    TRAFFIC_MODE: The traffic routed through this gateway.
+      Supported values: [ALL_TRAFFIC, SPECIFIC_DESTINATIONS]`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(2)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only NAME, UPDATE_MASK as positional arguments. Provide 'display_name', 'traffic_mode' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(4)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustAccountClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		a := cmdctx.AccountClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updatePrivateNetworkGatewayJson.Unmarshal(&updatePrivateNetworkGatewayReq.PrivateNetworkGateway)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		updatePrivateNetworkGatewayReq.Name = args[0]
+		if args[1] != "" {
+			updateMaskArray := strings.Split(args[1], ",")
+			updatePrivateNetworkGatewayReq.UpdateMask = *fieldmask.New(updateMaskArray)
+		}
+		if !cmd.Flags().Changed("json") {
+			updatePrivateNetworkGatewayReq.PrivateNetworkGateway.DisplayName = args[2]
+		}
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[3], &updatePrivateNetworkGatewayReq.PrivateNetworkGateway.TrafficMode)
+			if err != nil {
+				return fmt.Errorf("invalid TRAFFIC_MODE: %s", args[3])
+			}
+
+		}
+
+		response, err := a.PrivateNetworkGateways.UpdatePrivateNetworkGateway(ctx, updatePrivateNetworkGatewayReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updatePrivateNetworkGatewayOverrides {
+		fn(cmd, &updatePrivateNetworkGatewayReq)
+	}
+
+	return cmd
+}
+
+// end service PrivateNetworkGateways
diff --git a/cmd/account/published-app-integration/published-app-integration.go b/cmd/account/published-app-integration/published-app-integration.go
old mode 100755
new mode 100644
index 693767985a2..d49f9013eac
--- a/cmd/account/published-app-integration/published-app-integration.go
+++ b/cmd/account/published-app-integration/published-app-integration.go
@@ -28,6 +28,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -70,9 +74,13 @@ func newCreate() *cobra.Command {
   Create Published OAuth App Integration.
 
   You can retrieve the published OAuth app integration via
-  :method:PublishedAppIntegration/get.`
+  [PublishedAppIntegration/get].
+
+  [PublishedAppIntegration/get]: https://docs.databricks.com/api/account/publishedappintegration/get`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -136,9 +144,13 @@ func newDelete() *cobra.Command {
 	cmd.Long = `Delete Published OAuth App Integration.
 
   Delete an existing Published OAuth App Integration. You can retrieve the
-  published OAuth app integration via :method:PublishedAppIntegration/get.`
+  published OAuth app integration via [PublishedAppIntegration/get].
+
+  [PublishedAppIntegration/get]: https://docs.databricks.com/api/account/publishedappintegration/get`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -192,6 +204,8 @@ func newGet() *cobra.Command {
   Gets the Published OAuth App Integration for the given integration id.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -260,6 +274,8 @@ func newList() *cobra.Command {
   account`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -318,9 +334,13 @@ func newUpdate() *cobra.Command {
 	cmd.Long = `Updates Published OAuth App Integration.
 
   Updates an existing published OAuth App Integration. You can retrieve the
-  published OAuth app integration via :method:PublishedAppIntegration/get.`
+  published OAuth app integration via [PublishedAppIntegration/get].
+
+  [PublishedAppIntegration/get]: https://docs.databricks.com/api/account/publishedappintegration/get`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/account/service-principal-federation-policy/service-principal-federation-policy.go b/cmd/account/service-principal-federation-policy/service-principal-federation-policy.go
old mode 100755
new mode 100644
index 233c5e2e730..7a148865891
--- a/cmd/account/service-principal-federation-policy/service-principal-federation-policy.go
+++ b/cmd/account/service-principal-federation-policy/service-principal-federation-policy.go
@@ -79,6 +79,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -126,6 +130,8 @@ func newCreate() *cobra.Command {
     SERVICE_PRINCIPAL_ID: The service principal id for the federation policy.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -199,6 +205,8 @@ func newDelete() *cobra.Command {
     POLICY_ID: The identifier for the federation policy.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -261,6 +269,8 @@ func newGet() *cobra.Command {
     POLICY_ID: The identifier for the federation policy.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -336,6 +346,8 @@ func newList() *cobra.Command {
     SERVICE_PRINCIPAL_ID: The service principal id for the federation policy.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -408,6 +420,8 @@ func newUpdate() *cobra.Command {
     POLICY_ID: The identifier for the federation policy.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
diff --git a/cmd/account/service-principal-secrets/service-principal-secrets.go b/cmd/account/service-principal-secrets/service-principal-secrets.go
old mode 100755
new mode 100644
index cf17cb035f2..5616726b1c7
--- a/cmd/account/service-principal-secrets/service-principal-secrets.go
+++ b/cmd/account/service-principal-secrets/service-principal-secrets.go
@@ -38,6 +38,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -69,6 +73,7 @@ func newCreate() *cobra.Command {
 	cmd.Flags().Var(&createJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Flags().StringVar(&createReq.Lifetime, "lifetime", createReq.Lifetime, `The lifetime of the secret in seconds.`)
+	// TODO: array: scopes
 
 	cmd.Use = "create SERVICE_PRINCIPAL_ID"
 	cmd.Short = `Create service principal secret.`
@@ -80,6 +85,8 @@ func newCreate() *cobra.Command {
     SERVICE_PRINCIPAL_ID: The service principal ID.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -150,6 +157,8 @@ func newDelete() *cobra.Command {
     SECRET_ID: The secret ID.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -222,6 +231,8 @@ func newList() *cobra.Command {
     SERVICE_PRINCIPAL_ID: The service principal ID.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/account/service-principals-v2/service-principals-v2.go b/cmd/account/service-principals-v2/service-principals-v2.go
old mode 100755
new mode 100644
index 4604dfa3256..ba6aadb6cb6
--- a/cmd/account/service-principals-v2/service-principals-v2.go
+++ b/cmd/account/service-principals-v2/service-principals-v2.go
@@ -31,6 +31,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -78,6 +82,8 @@ func newCreate() *cobra.Command {
   Creates a new service principal in the Databricks account.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -146,6 +152,8 @@ func newDelete() *cobra.Command {
     ID: Unique ID for a service principal in the Databricks account.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -203,6 +211,8 @@ func newGet() *cobra.Command {
     ID: Unique ID for a service principal in the Databricks account.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -276,6 +286,8 @@ func newList() *cobra.Command {
   Gets the set of service principals associated with a Databricks account.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -341,6 +353,8 @@ func newPatch() *cobra.Command {
     ID: Unique ID in the Databricks workspace.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -420,6 +434,8 @@ func newUpdate() *cobra.Command {
     ID: Databricks service principal ID.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/account/settings-v2/settings-v2.go b/cmd/account/settings-v2/settings-v2.go
old mode 100755
new mode 100644
index f2d464d1804..b84f334b6c5
--- a/cmd/account/settings-v2/settings-v2.go
+++ b/cmd/account/settings-v2/settings-v2.go
@@ -26,6 +26,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newGetPublicAccountSetting())
 	cmd.AddCommand(newGetPublicAccountUserPreference())
@@ -65,6 +69,8 @@ func newGetPublicAccountSetting() *cobra.Command {
   via public APIs at account level.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -113,8 +119,10 @@ func newGetPublicAccountUserPreference() *cobra.Command {
 	var getPublicAccountUserPreferenceReq settingsv2.GetPublicAccountUserPreferenceRequest
 
 	cmd.Use = "get-public-account-user-preference USER_ID NAME"
-	cmd.Short = `Get a user preference.`
-	cmd.Long = `Get a user preference.
+	cmd.Short = `*Beta* Get a user preference.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get a user preference.
 
   Get a user preference for a specific user. User preferences are personal
   settings that allow individual customization without affecting other users.
@@ -126,6 +134,8 @@ func newGetPublicAccountUserPreference() *cobra.Command {
     NAME: User Setting name.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -196,6 +206,8 @@ func newListAccountSettingsMetadata() *cobra.Command {
   :method:settingsv2/patchpublicaccountsetting APIs`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -258,8 +270,10 @@ func newListAccountUserPreferencesMetadata() *cobra.Command {
 	cmd.Flags().Lookup("page-token").Hidden = true
 
 	cmd.Use = "list-account-user-preferences-metadata USER_ID"
-	cmd.Short = `List user preferences and their metadata.`
-	cmd.Long = `List user preferences and their metadata.
+	cmd.Short = `*Beta* List user preferences and their metadata.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+List user preferences and their metadata.
 
   List valid user preferences and their metadata for a specific user. User
   preferences are personal settings that allow individual customization without
@@ -271,6 +285,8 @@ func newListAccountUserPreferencesMetadata() *cobra.Command {
     USER_ID: User ID of the user whose settings metadata is being retrieved.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -327,21 +343,29 @@ func newPatchPublicAccountSetting() *cobra.Command {
 
 	// TODO: complex arg: aibi_dashboard_embedding_access_policy
 	// TODO: complex arg: aibi_dashboard_embedding_approved_domains
+	// TODO: complex arg: allowed_apps_user_api_scopes
 	// TODO: complex arg: automatic_cluster_update_workspace
 	// TODO: complex arg: boolean_val
+	// TODO: complex arg: collaboration_platform_connectivity
 	// TODO: complex arg: effective_aibi_dashboard_embedding_access_policy
 	// TODO: complex arg: effective_aibi_dashboard_embedding_approved_domains
+	// TODO: complex arg: effective_allowed_apps_user_api_scopes
 	// TODO: complex arg: effective_automatic_cluster_update_workspace
 	// TODO: complex arg: effective_boolean_val
+	// TODO: complex arg: effective_collaboration_platform_connectivity
 	// TODO: complex arg: effective_integer_val
+	// TODO: complex arg: effective_operational_email_custom_recipient
 	// TODO: complex arg: effective_personal_compute
 	// TODO: complex arg: effective_restrict_workspace_admins
 	// TODO: complex arg: effective_string_val
+	// TODO: complex arg: effective_workspace_label
 	// TODO: complex arg: integer_val
 	cmd.Flags().StringVar(&patchPublicAccountSettingReq.Setting.Name, "name", patchPublicAccountSettingReq.Setting.Name, `Name of the setting.`)
+	// TODO: complex arg: operational_email_custom_recipient
 	// TODO: complex arg: personal_compute
 	// TODO: complex arg: restrict_workspace_admins
 	// TODO: complex arg: string_val
+	// TODO: complex arg: workspace_label
 
 	cmd.Use = "patch-public-account-setting NAME"
 	cmd.Short = `Update an account setting.`
@@ -356,6 +380,8 @@ func newPatchPublicAccountSetting() *cobra.Command {
   Note: Page refresh is required for changes to take effect in UI.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -427,8 +453,10 @@ func newPatchPublicAccountUserPreference() *cobra.Command {
 	cmd.Flags().StringVar(&patchPublicAccountUserPreferenceReq.Setting.UserId, "user-id", patchPublicAccountUserPreferenceReq.Setting.UserId, `User ID of the user.`)
 
 	cmd.Use = "patch-public-account-user-preference USER_ID NAME"
-	cmd.Short = `Update a user preference.`
-	cmd.Long = `Update a user preference.
+	cmd.Short = `*Beta* Update a user preference.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Update a user preference.
 
   Update a user preference for a specific user. User preferences are personal
   settings that allow individual customization without affecting other users.
@@ -442,6 +470,8 @@ func newPatchPublicAccountUserPreference() *cobra.Command {
     NAME: `
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
diff --git a/cmd/account/settings/settings.go b/cmd/account/settings/settings.go
old mode 100755
new mode 100644
index 297e489de84..752e80d0660
--- a/cmd/account/settings/settings.go
+++ b/cmd/account/settings/settings.go
@@ -28,6 +28,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add subservices
 	cmd.AddCommand(csp_enablement_account.New())
 	cmd.AddCommand(disable_legacy_features.New())
diff --git a/cmd/account/storage-credentials/storage-credentials.go b/cmd/account/storage-credentials/storage-credentials.go
old mode 100755
new mode 100644
index 2eaee847d60..ba3f3ded1b6
--- a/cmd/account/storage-credentials/storage-credentials.go
+++ b/cmd/account/storage-credentials/storage-credentials.go
@@ -26,6 +26,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -76,6 +80,8 @@ func newCreate() *cobra.Command {
     METASTORE_ID: Unity Catalog metastore ID`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -149,6 +155,8 @@ func newDelete() *cobra.Command {
     STORAGE_CREDENTIAL_NAME: Name of the storage credential.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -210,6 +218,8 @@ func newGet() *cobra.Command {
     STORAGE_CREDENTIAL_NAME: Required. Name of the storage credential.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -278,6 +288,8 @@ func newList() *cobra.Command {
     METASTORE_ID: Unity Catalog metastore ID`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -347,6 +359,8 @@ func newUpdate() *cobra.Command {
     STORAGE_CREDENTIAL_NAME: Name of the storage credential.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
diff --git a/cmd/account/storage/storage.go b/cmd/account/storage/storage.go
old mode 100755
new mode 100644
index c852a05084f..116b58fc2ca
--- a/cmd/account/storage/storage.go
+++ b/cmd/account/storage/storage.go
@@ -3,7 +3,7 @@
 package storage
 
 import (
-	"fmt"
+	"errors"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
@@ -31,6 +31,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -71,6 +75,8 @@ func newCreate() *cobra.Command {
   Creates a Databricks storage configuration for an account.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustAccountClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -89,7 +95,7 @@ func newCreate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := a.Storage.Create(ctx, createReq)
@@ -134,6 +140,8 @@ func newDelete() *cobra.Command {
   configuration that is associated with any workspace.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -188,6 +196,8 @@ func newGet() *cobra.Command {
   Gets a Databricks storage configuration for an account, both specified by ID.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -239,6 +249,8 @@ func newList() *cobra.Command {
   Lists Databricks storage configurations for an account, specified by ID.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustAccountClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
diff --git a/cmd/account/usage-dashboards/usage-dashboards.go b/cmd/account/usage-dashboards/usage-dashboards.go
old mode 100755
new mode 100644
index 7e08d033845..05d5d15177c
--- a/cmd/account/usage-dashboards/usage-dashboards.go
+++ b/cmd/account/usage-dashboards/usage-dashboards.go
@@ -26,6 +26,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newGet())
@@ -67,6 +71,8 @@ func newCreate() *cobra.Command {
   type.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -135,6 +141,8 @@ func newGet() *cobra.Command {
   Get a usage dashboard specified by workspaceId, accountId, and dashboard type.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
diff --git a/cmd/account/users-v2/users-v2.go b/cmd/account/users-v2/users-v2.go
old mode 100755
new mode 100644
index 3a401ce16cd..5fff739b461
--- a/cmd/account/users-v2/users-v2.go
+++ b/cmd/account/users-v2/users-v2.go
@@ -36,6 +36,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -86,6 +90,8 @@ func newCreate() *cobra.Command {
   to the Databricks account.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -155,6 +161,8 @@ func newDelete() *cobra.Command {
     ID: Unique ID for a user in the Databricks account.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -219,6 +227,8 @@ func newGet() *cobra.Command {
     ID: Unique ID for a user in the Databricks account.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -292,6 +302,8 @@ func newList() *cobra.Command {
   Gets details for all the users associated with a Databricks account.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -351,12 +363,15 @@ func newPatch() *cobra.Command {
 	cmd.Long = `Update user details.
 
   Partially updates a user resource by applying the supplied operations on
-  specific user attributes.
+  specific user attributes. The userName and emails attributes cannot be
+  updated through this API; any supplied changes to them are ignored (no-op).
 
   Arguments:
     ID: Unique ID in the Databricks workspace.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -430,12 +445,16 @@ func newUpdate() *cobra.Command {
 	cmd.Short = `Replace a user.`
 	cmd.Long = `Replace a user.
 
-  Replaces a user's information with the data supplied in request.
+  Replaces a user's information with the data supplied in request. The
+  userName and emails attributes cannot be updated through this API; any
+  supplied changes to them are ignored (no-op).
 
   Arguments:
     ID: Databricks user ID.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/account/vpc-endpoints/vpc-endpoints.go b/cmd/account/vpc-endpoints/vpc-endpoints.go
old mode 100755
new mode 100644
index ee2bf1aa6a6..d05ae2fc063
--- a/cmd/account/vpc-endpoints/vpc-endpoints.go
+++ b/cmd/account/vpc-endpoints/vpc-endpoints.go
@@ -24,6 +24,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -79,6 +83,8 @@ func newCreate() *cobra.Command {
   [endpoint service]: https://docs.aws.amazon.com/vpc/latest/privatelink/privatelink-share-your-services.html`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -145,6 +151,8 @@ func newDelete() *cobra.Command {
   endpoint configuration that is associated with any workspace.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -206,6 +214,8 @@ func newGet() *cobra.Command {
     VPC_ENDPOINT_ID: Databricks VPC endpoint ID.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -257,6 +267,8 @@ func newList() *cobra.Command {
   Lists Databricks VPC endpoint configurations for an account.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustAccountClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
diff --git a/cmd/account/workspace-assignment/workspace-assignment.go b/cmd/account/workspace-assignment/workspace-assignment.go
old mode 100755
new mode 100644
index 43146462329..08895b11b96
--- a/cmd/account/workspace-assignment/workspace-assignment.go
+++ b/cmd/account/workspace-assignment/workspace-assignment.go
@@ -27,6 +27,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newDelete())
 	cmd.AddCommand(newGet())
@@ -67,6 +71,8 @@ func newDelete() *cobra.Command {
     PRINCIPAL_ID: The ID of the user, service principal, or group.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -131,6 +137,8 @@ func newGet() *cobra.Command {
     WORKSPACE_ID: The workspace ID.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -201,6 +209,8 @@ func newList() *cobra.Command {
     WORKSPACE_ID: The workspace ID for the account.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -271,6 +281,8 @@ func newUpdate() *cobra.Command {
     PRINCIPAL_ID: The ID of the user, service principal, or group.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
diff --git a/cmd/account/workspace-network-configuration/workspace-network-configuration.go b/cmd/account/workspace-network-configuration/workspace-network-configuration.go
old mode 100755
new mode 100644
index 4dd194c9462..58ef41e0119
--- a/cmd/account/workspace-network-configuration/workspace-network-configuration.go
+++ b/cmd/account/workspace-network-configuration/workspace-network-configuration.go
@@ -32,6 +32,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newGetWorkspaceNetworkOptionRpc())
 	cmd.AddCommand(newUpdateWorkspaceNetworkOptionRpc())
@@ -70,6 +74,8 @@ func newGetWorkspaceNetworkOptionRpc() *cobra.Command {
     WORKSPACE_ID: The workspace ID.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -139,6 +145,8 @@ func newUpdateWorkspaceNetworkOptionRpc() *cobra.Command {
     WORKSPACE_ID: The workspace ID.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/account/workspaces/workspaces.go b/cmd/account/workspaces/workspaces.go
old mode 100755
new mode 100644
index 4ee0ab08f52..1025f94e68b
--- a/cmd/account/workspaces/workspaces.go
+++ b/cmd/account/workspaces/workspaces.go
@@ -34,6 +34,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -140,6 +144,8 @@ func newCreate() *cobra.Command {
   [Create a new workspace using the Account API]: http://docs.databricks.com/administration-guide/account-api/new-workspace.html`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -216,6 +222,8 @@ func newDelete() *cobra.Command {
   Deletes a Databricks workspace, both specified by ID.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -281,6 +289,8 @@ func newGet() *cobra.Command {
   [Create a new workspace using the Account API]: http://docs.databricks.com/administration-guide/account-api/new-workspace.html`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -335,6 +345,8 @@ func newList() *cobra.Command {
   Lists Databricks workspaces for an account.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustAccountClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -422,6 +434,8 @@ func newUpdate() *cobra.Command {
     WORKSPACE_ID: A unique integer ID for the workspace`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/air/.gitkeep b/cmd/air/.gitkeep
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/cmd/air/air.go b/cmd/air/air.go
new file mode 100644
index 00000000000..dd8ff3a0e1d
--- /dev/null
+++ b/cmd/air/air.go
@@ -0,0 +1,58 @@
+package aircmd
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/spf13/cobra"
+)
+
+// New returns the root command for the AI Runtime CLI.
+func New() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:     "air",
+		Short:   "*Public Preview* Run and manage AI Runtime training workloads",
+		GroupID: "development",
+		Long: `Run and manage AI Runtime training workloads on Databricks serverless GPU compute.
+
+These commands are under active development.`,
+	}
+
+	runCommand := newRunCommand()
+	wrapRunErrorWithDebugTip(runCommand)
+	cmd.AddCommand(runCommand)
+	cmd.AddCommand(newGetCommand())
+	cmd.AddCommand(newListCommand())
+	cmd.AddCommand(newPoolsCommand())
+	cmd.AddCommand(newLogsCommand())
+	cmd.AddCommand(newCancelCommand())
+	cmd.AddCommand(newConvertToDabsCommand())
+	cmd.AddCommand(newImagesCommand())
+
+	return cmd
+}
+
+func wrapRunErrorWithDebugTip(cmd *cobra.Command) {
+	runE := cmd.RunE
+	cmd.RunE = func(cmd *cobra.Command, args []string) error {
+		return withDebugErrorTip(cmd, runE(cmd, args))
+	}
+}
+
+func withDebugErrorTip(cmd *cobra.Command, err error) error {
+	if err == nil {
+		return nil
+	}
+	debugFlag := cmd.Root().PersistentFlags().Lookup("debug")
+	if debugFlag != nil && debugFlag.Value.String() == "true" {
+		return err
+	}
+
+	commandPrefix := cmd.Root().CommandPath()
+	command := commandPrefix + " --debug" + strings.TrimPrefix(cmd.CommandPath(), commandPrefix)
+	return fmt.Errorf(
+		"%w\n\nTip: use the --debug flag to see more details and a trace of this error:\n  %s …",
+		err,
+		command,
+	)
+}
diff --git a/cmd/air/air_test.go b/cmd/air/air_test.go
new file mode 100644
index 00000000000..b7ba790980b
--- /dev/null
+++ b/cmd/air/air_test.go
@@ -0,0 +1,75 @@
+package aircmd
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/assert"
+)
+
+// TestNewRegistersAllSubcommands asserts the `air` command wires up every
+// expected subcommand, so none is accidentally dropped from New.
+func TestNewRegistersAllSubcommands(t *testing.T) {
+	registered := make(map[string]bool)
+	for _, c := range New().Commands() {
+		registered[c.Name()] = true
+	}
+
+	want := []string{"run", "get", "list", "pools", "logs", "cancel", "convert-to-dabs", "images"}
+	for _, name := range want {
+		assert.True(t, registered[name], "subcommand %q is not registered", name)
+	}
+	assert.Len(t, registered, len(want), "unexpected number of subcommands")
+}
+
+func TestNewHelpMetadata(t *testing.T) {
+	cmd := New()
+
+	assert.Equal(t, "development", cmd.GroupID)
+	assert.Contains(t, cmd.Short, "*Public Preview*")
+}
+
+func TestRunErrorIncludesDebugTip(t *testing.T) {
+	originalErr := errors.New("failed")
+	runCommand := &cobra.Command{
+		Use: "run [arg]",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			return originalErr
+		},
+	}
+	airCommand := &cobra.Command{Use: "air"}
+	airCommand.AddCommand(runCommand)
+	wrapRunErrorWithDebugTip(runCommand)
+	rootCommand := &cobra.Command{Use: "databricks"}
+	rootCommand.PersistentFlags().Bool("debug", false, "")
+	rootCommand.AddCommand(airCommand)
+
+	err := runCommand.RunE(runCommand, []string{"secret-value"})
+
+	assert.ErrorIs(t, err, originalErr)
+	assert.Contains(t, err.Error(), "use the --debug flag")
+	assert.Contains(t, err.Error(), "databricks --debug air run …")
+	assert.NotContains(t, err.Error(), "secret-value")
+}
+
+func TestRunErrorOmitsDebugTipWhenDebugEnabled(t *testing.T) {
+	originalErr := errors.New("failed")
+	runCommand := &cobra.Command{
+		Use: "run",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			return originalErr
+		},
+	}
+	airCommand := &cobra.Command{Use: "air"}
+	airCommand.AddCommand(runCommand)
+	wrapRunErrorWithDebugTip(runCommand)
+	rootCommand := &cobra.Command{Use: "databricks"}
+	rootCommand.PersistentFlags().Bool("debug", true, "")
+	rootCommand.AddCommand(airCommand)
+
+	err := runCommand.RunE(runCommand, nil)
+
+	assert.Same(t, originalErr, err)
+	assert.NotContains(t, err.Error(), "use the --debug flag")
+}
diff --git a/cmd/air/aitraining.go b/cmd/air/aitraining.go
new file mode 100644
index 00000000000..594489a5d74
--- /dev/null
+++ b/cmd/air/aitraining.go
@@ -0,0 +1,111 @@
+package aircmd
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"time"
+
+	"github.com/databricks/cli/libs/auth"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/client"
+)
+
+// aiTrainingWorkflowsPath is the AiTrainingService index of the caller's own AIR
+// runs. It returns cheap (job_run_id, submit_time) pairs, letting `air list`
+// order and page without scanning the Jobs runs/list firehose. This is called
+// with a raw client.Do because the SDK does not model the AiTrainingService.
+const aiTrainingWorkflowsPath = "/api/2.0/ai-training/workflows"
+
+// workflowRef is one run from the index: its Jobs run id and submission time.
+type workflowRef struct {
+	jobRunID     int64
+	submitTimeMs int64
+}
+
+type aiTrainingWorkflow struct {
+	// job_run_id is a Jobs run id; tolerate it arriving as a JSON number or string.
+	JobRunID json.Number `json:"job_run_id"`
+	// submit_time is a proto Timestamp, serialized over HTTP as either an RFC3339
+	// string or a {seconds, nanos} object.
+	SubmitTime json.RawMessage `json:"submit_time"`
+}
+
+type aiTrainingWorkflowsResponse struct {
+	TrainingWorkflows []aiTrainingWorkflow `json:"training_workflows"`
+	NextPageToken     string               `json:"next_page_token"`
+}
+
+// listAiTrainingWorkflows pages the index and returns every workflow ref the
+// caller owns. Pagination stops at the end or when a page token repeats, which
+// guards against a stuck or cycling cursor without an arbitrary page cap.
+func listAiTrainingWorkflows(ctx context.Context, w *databricks.WorkspaceClient, activeOnly bool) ([]workflowRef, error) {
+	apiClient, err := client.New(w.Config)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create API client: %w", err)
+	}
+
+	var refs []workflowRef
+	seenTokens := map[string]bool{}
+	// The index can return the same job_run_id on more than one page; dedupe so
+	// the newest-`limit` truncation counts unique runs, not repeats.
+	seenIDs := map[int64]bool{}
+	var pageToken string
+	for {
+		query := map[string]any{}
+		if activeOnly {
+			query["active_only"] = true
+		}
+		if pageToken != "" {
+			query["page_token"] = pageToken
+		}
+
+		var resp aiTrainingWorkflowsResponse
+		err = apiClient.Do(ctx, http.MethodGet, aiTrainingWorkflowsPath, auth.WorkspaceIDHeaders(w.Config), nil, query, &resp)
+		if err != nil {
+			return nil, fmt.Errorf("failed to list training workflows: %w", err)
+		}
+
+		for _, wf := range resp.TrainingWorkflows {
+			id, err := wf.JobRunID.Int64()
+			if err != nil || id == 0 || seenIDs[id] {
+				continue
+			}
+			seenIDs[id] = true
+			refs = append(refs, workflowRef{jobRunID: id, submitTimeMs: parseSubmitTimeMs(wf.SubmitTime)})
+		}
+
+		if resp.NextPageToken == "" || seenTokens[resp.NextPageToken] {
+			break
+		}
+		seenTokens[resp.NextPageToken] = true
+		pageToken = resp.NextPageToken
+	}
+	return refs, nil
+}
+
+// parseSubmitTimeMs converts a proto Timestamp (RFC3339 string or {seconds, nanos}
+// object) to epoch milliseconds, or 0 when absent or unparseable (so it sorts last).
+func parseSubmitTimeMs(raw json.RawMessage) int64 {
+	if len(raw) == 0 {
+		return 0
+	}
+
+	var s string
+	if json.Unmarshal(raw, &s) == nil {
+		if t, err := time.Parse(time.RFC3339, s); err == nil {
+			return t.UnixMilli()
+		}
+		return 0
+	}
+
+	var obj struct {
+		Seconds int64 `json:"seconds"`
+		Nanos   int64 `json:"nanos"`
+	}
+	if json.Unmarshal(raw, &obj) == nil {
+		return obj.Seconds*1000 + obj.Nanos/1_000_000
+	}
+	return 0
+}
diff --git a/cmd/air/aitraining_test.go b/cmd/air/aitraining_test.go
new file mode 100644
index 00000000000..4c44266d8cb
--- /dev/null
+++ b/cmd/air/aitraining_test.go
@@ -0,0 +1,92 @@
+package aircmd
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseSubmitTimeMs(t *testing.T) {
+	cases := []struct {
+		name string
+		raw  string
+		want int64
+	}{
+		{"rfc3339", `"2023-11-14T22:13:20Z"`, 1700000000000},
+		{"rfc3339 offset", `"2023-11-14T22:13:20+00:00"`, 1700000000000},
+		{"seconds and nanos", `{"seconds": 1700000000, "nanos": 500000000}`, 1700000000500},
+		{"seconds only", `{"seconds": 1700000000}`, 1700000000000},
+		{"empty", ``, 0},
+		{"garbage string", `"not-a-time"`, 0},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, parseSubmitTimeMs(json.RawMessage(tc.raw)))
+		})
+	}
+}
+
+// indexServer serves paginated AiTrainingService responses, one body per call,
+// tracking whether the index was hit.
+func indexServer(t *testing.T, hit *bool, bodies ...string) *httptest.Server {
+	t.Helper()
+	call := 0
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == aiTrainingWorkflowsPath {
+			*hit = true
+			body := bodies[min(call, len(bodies)-1)]
+			call++
+			_, _ = w.Write([]byte(body))
+			return
+		}
+		_, _ = w.Write([]byte(`{}`))
+	}))
+	t.Cleanup(srv.Close)
+	return srv
+}
+
+func TestListAiTrainingWorkflowsPaginates(t *testing.T) {
+	page1 := `{"training_workflows":[{"job_run_id":"1","submit_time":"2023-11-14T22:13:20Z"}],"next_page_token":"tok"}`
+	page2 := `{"training_workflows":[{"job_run_id":2,"submit_time":{"seconds":1700000100}}]}`
+	var hit bool
+	srv := indexServer(t, &hit, page1, page2)
+
+	refs, err := listAiTrainingWorkflows(t.Context(), newTestWorkspaceClient(t, srv.URL), false)
+	require.NoError(t, err)
+	require.Len(t, refs, 2)
+	assert.Equal(t, int64(1), refs[0].jobRunID)
+	assert.Equal(t, int64(1700000000000), refs[0].submitTimeMs)
+	assert.Equal(t, int64(2), refs[1].jobRunID)
+}
+
+func TestListAiTrainingWorkflowsStopsOnRepeatedToken(t *testing.T) {
+	// A cursor that always returns the same token must not loop forever. The
+	// repeated id is also deduped, so only one ref survives.
+	page := `{"training_workflows":[{"job_run_id":1,"submit_time":"2023-11-14T22:13:20Z"}],"next_page_token":"tok"}`
+	var hit bool
+	srv := indexServer(t, &hit, page)
+
+	refs, err := listAiTrainingWorkflows(t.Context(), newTestWorkspaceClient(t, srv.URL), false)
+	require.NoError(t, err)
+	require.Len(t, refs, 1)
+	assert.Equal(t, int64(1), refs[0].jobRunID)
+}
+
+func TestListAiTrainingWorkflowsDedupesIDs(t *testing.T) {
+	// The same job_run_id on multiple pages must be counted once, so the
+	// newest-limit truncation doesn't silently return fewer unique runs.
+	page1 := `{"training_workflows":[{"job_run_id":1,"submit_time":"2023-11-14T22:13:20Z"},{"job_run_id":2,"submit_time":"2023-11-14T22:13:21Z"}],"next_page_token":"tok"}`
+	page2 := `{"training_workflows":[{"job_run_id":2,"submit_time":"2023-11-14T22:13:21Z"},{"job_run_id":3,"submit_time":"2023-11-14T22:13:22Z"}]}`
+	var hit bool
+	srv := indexServer(t, &hit, page1, page2)
+
+	refs, err := listAiTrainingWorkflows(t.Context(), newTestWorkspaceClient(t, srv.URL), false)
+	require.NoError(t, err)
+	require.Len(t, refs, 3)
+	got := []int64{refs[0].jobRunID, refs[1].jobRunID, refs[2].jobRunID}
+	assert.ElementsMatch(t, []int64{1, 2, 3}, got)
+}
diff --git a/cmd/air/cancel.go b/cmd/air/cancel.go
new file mode 100644
index 00000000000..fe7e2cbdbff
--- /dev/null
+++ b/cmd/air/cancel.go
@@ -0,0 +1,225 @@
+package aircmd
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"strconv"
+	"strings"
+	"text/tabwriter"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/service/iam"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/spf13/cobra"
+)
+
+// cancelData is the JSON payload printed by `air cancel`. `all` is set only for
+// --all, `workspace` only when --all finds no active runs, and `failed` only
+// when a run could not be cancelled.
+type cancelData struct {
+	Cancelled []string        `json:"cancelled"`
+	All       bool            `json:"all,omitempty"`
+	Workspace string          `json:"workspace,omitempty"`
+	Failed    []cancelFailure `json:"failed,omitempty"`
+}
+
+type cancelFailure struct {
+	RunID string `json:"run_id"`
+	Error string `json:"error"`
+}
+
+func newCancelCommand() *cobra.Command {
+	var (
+		all bool
+		yes bool
+	)
+
+	cmd := &cobra.Command{
+		Use:   "cancel [JOB_RUN_ID...]",
+		Short: "Cancel one or more runs",
+		Long: `Cancel one or more runs by job run ID, or use --all to cancel
+all active runs submitted by the current user.
+
+--all prompts for confirmation. Use --yes to skip the prompt.`,
+	}
+
+	cmd.Flags().BoolVar(&all, "all", false, "Cancel all of your active runs")
+	cmd.Flags().BoolVarP(&yes, "yes", "y", false, "Skip the confirmation prompt")
+
+	// Require exactly one of: one or more JOB_RUN_IDs, or --all. Cobra parses flags
+	// before running this, so `all` reflects the user's input.
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		switch {
+		case all && len(args) > 0:
+			return &root.InvalidArgsError{Command: cmd, Message: "cannot combine JOB_RUN_ID arguments with --all"}
+		case !all && len(args) == 0:
+			return &root.InvalidArgsError{Command: cmd, Message: "provide at least one JOB_RUN_ID, or use --all"}
+		}
+		return nil
+	}
+
+	// In -o json mode an auth failure should be a JSON error envelope, not a bare
+	// error. ErrAlreadyPrinted passes through (already handled upstream).
+	cmd.PreRunE = func(cmd *cobra.Command, args []string) error {
+		err := root.MustWorkspaceClient(cmd, args)
+		if err == nil || errors.Is(err, root.ErrAlreadyPrinted) {
+			return err
+		}
+		return renderError(cmd.Context(), cmd, "INTERNAL_ERROR", "TRANSIENT", true, err)
+	}
+
+	cmd.RunE = func(cmd *cobra.Command, args []string) error {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+		jsonOut := root.OutputType(cmd) == flags.OutputJSON
+
+		runIDs := args
+		data := cancelData{Cancelled: []string{}}
+
+		if all {
+			data.All = true
+
+			me, err := w.CurrentUser.Me(ctx, iam.MeRequest{})
+			if err != nil {
+				return renderError(ctx, cmd, "INTERNAL_ERROR", "TRANSIENT", true,
+					fmt.Errorf("failed to resolve current user: %w", err))
+			}
+			host := strings.TrimRight(w.Config.Host, "/")
+
+			if !jsonOut {
+				cmdio.LogString(ctx, fmt.Sprintf("Searching active runs for %s in %s...", me.UserName, host))
+			}
+
+			// Fetch every active run (up to the scan bound) so --all cancels all
+			// of them, not just the first page.
+			fetcher := newRunFetcher(ctx, w, listQuery{activeOnly: true, userFilter: me.UserName})
+			rows, err := fetcher.next(maxListScan)
+			if err != nil {
+				return renderError(ctx, cmd, "INTERNAL_ERROR", "TRANSIENT", true,
+					fmt.Errorf("failed to list active runs: %w", err))
+			}
+
+			runIDs = make([]string, 0, len(rows))
+			for i := range rows {
+				if rows[i].RunID != "" {
+					runIDs = append(runIDs, rows[i].RunID)
+				}
+			}
+
+			if len(runIDs) == 0 {
+				if jsonOut {
+					data.Workspace = host
+					return renderEnvelope(ctx, data)
+				}
+				cmdio.LogString(ctx, "No active runs found.")
+				return nil
+			}
+
+			if !yes {
+				displayCancelPreview(ctx, rows, host)
+				confirmed, err := cmdio.AskYesOrNo(ctx, fmt.Sprintf("\nCancel %d run(s) in %s?", len(runIDs), host))
+				if err != nil {
+					return err
+				}
+				if !confirmed {
+					cmdio.LogString(ctx, "Cancellation aborted.")
+					return root.ErrAlreadyPrinted
+				}
+			}
+		}
+
+		for _, rid := range runIDs {
+			err := cancelRun(ctx, w, rid)
+			if err != nil {
+				data.Failed = append(data.Failed, cancelFailure{RunID: rid, Error: err.Error()})
+				if !jsonOut {
+					if runNotFound(err) {
+						cmdio.LogString(ctx, fmt.Sprintf("Run %s not found. Please check the run ID and ensure you're using a Job Run ID.", rid))
+					} else {
+						cmdio.LogString(ctx, fmt.Sprintf("Failed to cancel run %s: %s", rid, err))
+					}
+				}
+				continue
+			}
+			data.Cancelled = append(data.Cancelled, rid)
+			if !jsonOut {
+				cmdio.LogString(ctx, "Successfully requested cancellation for run "+rid)
+			}
+		}
+
+		if jsonOut {
+			if err := renderEnvelope(ctx, data); err != nil {
+				return err
+			}
+			// Print the envelope, but still exit non-zero on any failure.
+			if len(data.Failed) > 0 {
+				return root.ErrAlreadyPrinted
+			}
+			return nil
+		}
+
+		if len(data.Failed) > 0 {
+			cmdio.LogString(ctx, fmt.Sprintf("%d run(s) failed to cancel.", len(data.Failed)))
+			return root.ErrAlreadyPrinted
+		}
+		if all || len(data.Cancelled) > 1 {
+			cmdio.LogString(ctx, fmt.Sprintf("Successfully requested cancellation for %d run(s).", len(data.Cancelled)))
+		}
+		return nil
+	}
+
+	return cmd
+}
+
+// runNotFound reports whether err means the run does not exist. The cancel
+// endpoint returns 400 INVALID_PARAMETER_VALUE ("Run <id> does not exist") for
+// an unknown run, and the SDK only remaps that to ErrResourceDoesNotExist for
+// the runs/get path, not cancel — so we also detect the raw code here.
+func runNotFound(err error) bool {
+	if errors.Is(err, apierr.ErrResourceDoesNotExist) {
+		return true
+	}
+	if apiErr, ok := errors.AsType[*apierr.APIError](err); ok {
+		return apiErr.StatusCode == http.StatusBadRequest && apiErr.ErrorCode == "INVALID_PARAMETER_VALUE"
+	}
+	return false
+}
+
+// cancelRun requests cancellation of a single job run. The cancel is async, so
+// the returned waiter is ignored.
+func cancelRun(ctx context.Context, w *databricks.WorkspaceClient, rid string) error {
+	runID, err := strconv.ParseInt(rid, 10, 64)
+	if err != nil || runID <= 0 {
+		return fmt.Errorf("invalid run ID %q: must be a positive integer", rid)
+	}
+	_, err = w.Jobs.CancelRun(ctx, jobs.CancelRun{RunId: runID})
+	return err
+}
+
+// displayCancelPreview shows the runs that `cancel --all` is about to terminate.
+func displayCancelPreview(ctx context.Context, rows []listRow, host string) {
+	var sb strings.Builder
+	fmt.Fprintf(&sb, "\nWorkspace: %s\n", host)
+	fmt.Fprintf(&sb, "Found %d active run(s) to cancel:\n\n", len(rows))
+
+	tw := tabwriter.NewWriter(&sb, 0, 0, 2, ' ', 0)
+	fmt.Fprintln(tw, "Run ID\tExperiment\tStarted")
+	for i := range rows {
+		experiment := orNA(rows[i].Experiment)
+		started := na
+		if rows[i].StartedAt != nil {
+			started = *rows[i].StartedAt
+		}
+		fmt.Fprintf(tw, "%s\t%s\t%s\n", rows[i].RunID, experiment, started)
+	}
+	tw.Flush()
+
+	cmdio.LogString(ctx, strings.TrimRight(sb.String(), "\n"))
+}
diff --git a/cmd/air/cancel_test.go b/cmd/air/cancel_test.go
new file mode 100644
index 00000000000..5601a99f84a
--- /dev/null
+++ b/cmd/air/cancel_test.go
@@ -0,0 +1,289 @@
+package aircmd
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"testing/iotest"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/experimental/mocks"
+	"github.com/databricks/databricks-sdk-go/service/iam"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+)
+
+// runCancelAll runs `cancel --all` against w with the given output mode and
+// stdin, capturing output into buf.
+func runCancelAll(t *testing.T, w *databricks.WorkspaceClient, out flags.Output, in io.Reader, buf *bytes.Buffer) error {
+	t.Helper()
+	cmd := withOutput(newCancelCommand(), out)
+	require.NoError(t, cmd.Flags().Set("all", "true"))
+	ctx := cmdio.InContext(t.Context(), cmdio.NewIO(t.Context(), out, in, buf, buf, "", ""))
+	cmd.SetContext(cmdctx.SetWorkspaceClient(ctx, w))
+	return cmd.RunE(cmd, nil)
+}
+
+// cancelEnvelope decodes the air JSON envelope with the cancel payload.
+type cancelEnvelope struct {
+	V    int        `json:"v"`
+	Data cancelData `json:"data"`
+}
+
+// runCancel runs the cancel command against w with the given output mode and
+// stdin, capturing stdout/stderr into buf.
+func runCancel(t *testing.T, w *databricks.WorkspaceClient, out flags.Output, in string, buf *bytes.Buffer, args ...string) (*cobra.Command, error) {
+	t.Helper()
+	ctx := cmdio.InContext(t.Context(), cmdio.NewIO(t.Context(), out, strings.NewReader(in), buf, buf, "", ""))
+	ctx = cmdctx.SetWorkspaceClient(ctx, w)
+	cmd := withOutput(newCancelCommand(), out)
+	cmd.SetContext(ctx)
+	return cmd, cmd.RunE(cmd, args)
+}
+
+func TestCancelArgs(t *testing.T) {
+	tests := []struct {
+		name    string
+		all     bool
+		args    []string
+		wantErr string
+	}{
+		{name: "one id", args: []string{"123"}},
+		{name: "many ids", args: []string{"123", "456"}},
+		{name: "all", all: true},
+		{name: "no input", wantErr: "provide at least one JOB_RUN_ID, or use --all"},
+		{name: "ids with all", all: true, args: []string{"123"}, wantErr: "cannot combine JOB_RUN_ID arguments with --all"},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			cmd := newCancelCommand()
+			if tc.all {
+				require.NoError(t, cmd.Flags().Set("all", "true"))
+			}
+			err := cmd.Args(cmd, tc.args)
+			if tc.wantErr == "" {
+				assert.NoError(t, err)
+				return
+			}
+			require.Error(t, err)
+			assert.Contains(t, err.Error(), tc.wantErr)
+		})
+	}
+}
+
+func TestCancelRunInvalidID(t *testing.T) {
+	m := mocks.NewMockWorkspaceClient(t)
+	for _, id := range []string{"abc", "0", "-1"} {
+		err := cancelRun(t.Context(), m.WorkspaceClient, id)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "invalid run ID")
+	}
+}
+
+func TestCancelByIDSuccess(t *testing.T) {
+	m := mocks.NewMockWorkspaceClient(t)
+	m.GetMockJobsAPI().EXPECT().CancelRun(mock.Anything, jobs.CancelRun{RunId: 123}).Return(nil, nil)
+	m.GetMockJobsAPI().EXPECT().CancelRun(mock.Anything, jobs.CancelRun{RunId: 456}).Return(nil, nil)
+
+	var buf bytes.Buffer
+	_, err := runCancel(t, m.WorkspaceClient, flags.OutputText, "", &buf, "123", "456")
+	require.NoError(t, err)
+
+	out := buf.String()
+	assert.Contains(t, out, "Successfully requested cancellation for run 123")
+	assert.Contains(t, out, "Successfully requested cancellation for run 456")
+	// More than one run cancelled prints the count summary.
+	assert.Contains(t, out, "Successfully requested cancellation for 2 run(s).")
+}
+
+func TestCancelByIDNotFound(t *testing.T) {
+	m := mocks.NewMockWorkspaceClient(t)
+	m.GetMockJobsAPI().EXPECT().CancelRun(mock.Anything, jobs.CancelRun{RunId: 5}).Return(nil, apierr.ErrResourceDoesNotExist)
+
+	var buf bytes.Buffer
+	_, err := runCancel(t, m.WorkspaceClient, flags.OutputText, "", &buf, "5")
+	require.ErrorIs(t, err, root.ErrAlreadyPrinted)
+
+	out := buf.String()
+	assert.Contains(t, out, "Run 5 not found")
+	assert.Contains(t, out, "1 run(s) failed to cancel.")
+}
+
+func TestCancelByIDNotFoundInvalidParam(t *testing.T) {
+	// The cancel endpoint reports an unknown run as 400 INVALID_PARAMETER_VALUE,
+	// which the SDK does not remap to ErrResourceDoesNotExist for this path.
+	m := mocks.NewMockWorkspaceClient(t)
+	apiErr := &apierr.APIError{StatusCode: http.StatusBadRequest, ErrorCode: "INVALID_PARAMETER_VALUE", Message: "Run 5 does not exist."}
+	m.GetMockJobsAPI().EXPECT().CancelRun(mock.Anything, jobs.CancelRun{RunId: 5}).Return(nil, apiErr)
+
+	var buf bytes.Buffer
+	_, err := runCancel(t, m.WorkspaceClient, flags.OutputText, "", &buf, "5")
+	require.ErrorIs(t, err, root.ErrAlreadyPrinted)
+	assert.Contains(t, buf.String(), "Run 5 not found")
+}
+
+func TestCancelPartialFailureJSON(t *testing.T) {
+	m := mocks.NewMockWorkspaceClient(t)
+	m.GetMockJobsAPI().EXPECT().CancelRun(mock.Anything, jobs.CancelRun{RunId: 123}).Return(nil, nil)
+	m.GetMockJobsAPI().EXPECT().CancelRun(mock.Anything, jobs.CancelRun{RunId: 5}).Return(nil, apierr.ErrResourceDoesNotExist)
+
+	var buf bytes.Buffer
+	_, err := runCancel(t, m.WorkspaceClient, flags.OutputJSON, "", &buf, "123", "5")
+	// The envelope is printed, but a failure still exits non-zero.
+	require.ErrorIs(t, err, root.ErrAlreadyPrinted)
+
+	var got cancelEnvelope
+	require.NoError(t, json.Unmarshal(buf.Bytes(), &got))
+	assert.Equal(t, []string{"123"}, got.Data.Cancelled)
+	require.Len(t, got.Data.Failed, 1)
+	assert.Equal(t, "5", got.Data.Failed[0].RunID)
+	assert.False(t, got.Data.All)
+}
+
+func TestCancelByIDSuccessJSON(t *testing.T) {
+	m := mocks.NewMockWorkspaceClient(t)
+	m.GetMockJobsAPI().EXPECT().CancelRun(mock.Anything, jobs.CancelRun{RunId: 123}).Return(nil, nil)
+
+	var buf bytes.Buffer
+	_, err := runCancel(t, m.WorkspaceClient, flags.OutputJSON, "", &buf, "123")
+	require.NoError(t, err)
+
+	var got cancelEnvelope
+	require.NoError(t, json.Unmarshal(buf.Bytes(), &got))
+	assert.Equal(t, []string{"123"}, got.Data.Cancelled)
+	assert.Empty(t, got.Data.Failed)
+}
+
+func TestCancelByIDGenericFailure(t *testing.T) {
+	m := mocks.NewMockWorkspaceClient(t)
+	m.GetMockJobsAPI().EXPECT().CancelRun(mock.Anything, jobs.CancelRun{RunId: 7}).Return(nil, errors.New("boom"))
+
+	var buf bytes.Buffer
+	_, err := runCancel(t, m.WorkspaceClient, flags.OutputText, "", &buf, "7")
+	require.ErrorIs(t, err, root.ErrAlreadyPrinted)
+	assert.Contains(t, buf.String(), "Failed to cancel run 7: boom")
+}
+
+func TestCancelAllNoActiveRuns(t *testing.T) {
+	w := newTestWorkspaceClient(t, runsServer(t, runsListBody(t, "")).URL)
+	var buf bytes.Buffer
+	require.NoError(t, runCancelAll(t, w, flags.OutputText, nil, &buf))
+	assert.Contains(t, buf.String(), "No active runs found.")
+}
+
+func TestCancelAllNoActiveRunsJSON(t *testing.T) {
+	srv := runsServer(t, runsListBody(t, ""))
+	w := newTestWorkspaceClient(t, srv.URL)
+
+	var buf bytes.Buffer
+	require.NoError(t, runCancelAll(t, w, flags.OutputJSON, nil, &buf))
+
+	var got cancelEnvelope
+	require.NoError(t, json.Unmarshal(buf.Bytes(), &got))
+	assert.Empty(t, got.Data.Cancelled)
+	assert.True(t, got.Data.All)
+	assert.Equal(t, srv.URL, got.Data.Workspace)
+}
+
+func TestCancelAllConfirmYes(t *testing.T) {
+	srv := runsServer(t, runsListBody(t, "",
+		airBaseRun(111, "me@example.com", "GPU_1xA10", 1, "/Users/me@example.com/exp-a"),
+		airBaseRun(222, "me@example.com", "GPU_1xA10", 1, "/Users/me@example.com/exp-b"),
+	))
+	w := newTestWorkspaceClient(t, srv.URL)
+
+	var buf bytes.Buffer
+	require.NoError(t, runCancelAll(t, w, flags.OutputText, strings.NewReader("y\n"), &buf))
+	out := buf.String()
+	assert.Contains(t, out, "active run(s) to cancel")
+	assert.Contains(t, out, "Successfully requested cancellation for run 111")
+	assert.Contains(t, out, "Successfully requested cancellation for run 222")
+}
+
+func TestCancelAllAbort(t *testing.T) {
+	srv := runsServer(t, runsListBody(t, "",
+		airBaseRun(111, "me@example.com", "GPU_1xA10", 1, "/Users/me@example.com/exp-a"),
+	))
+	w := newTestWorkspaceClient(t, srv.URL)
+
+	var buf bytes.Buffer
+	err := runCancelAll(t, w, flags.OutputText, strings.NewReader("n\n"), &buf)
+	require.ErrorIs(t, err, root.ErrAlreadyPrinted)
+	assert.Contains(t, buf.String(), "Cancellation aborted.")
+}
+
+func TestCancelAllConfirmReadError(t *testing.T) {
+	srv := runsServer(t, runsListBody(t, "",
+		airBaseRun(111, "me@example.com", "GPU_1xA10", 1, "/Users/me@example.com/exp-a"),
+	))
+	w := newTestWorkspaceClient(t, srv.URL)
+
+	var buf bytes.Buffer
+	err := runCancelAll(t, w, flags.OutputText, iotest.ErrReader(errors.New("read failed")), &buf)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "read failed")
+}
+
+func TestCancelAllMeError(t *testing.T) {
+	m := mocks.NewMockWorkspaceClient(t)
+	m.GetMockCurrentUserAPI().EXPECT().Me(mock.Anything, iam.MeRequest{}).Return(nil, errors.New("nope"))
+
+	var buf bytes.Buffer
+	err := runCancelAll(t, m.WorkspaceClient, flags.OutputText, nil, &buf)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "failed to resolve current user")
+}
+
+func TestCancelAllListError(t *testing.T) {
+	// Me succeeds (default empty user), but listing active runs fails.
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/api/2.2/jobs/runs/list" {
+			w.WriteHeader(http.StatusInternalServerError)
+			_, _ = w.Write([]byte(`{"error_code":"INTERNAL","message":"boom"}`))
+			return
+		}
+		_, _ = w.Write([]byte(`{}`))
+	}))
+	t.Cleanup(srv.Close)
+	w := newTestWorkspaceClient(t, srv.URL)
+
+	var buf bytes.Buffer
+	err := runCancelAll(t, w, flags.OutputText, nil, &buf)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "failed to list active runs")
+}
+
+func TestDisplayCancelPreview(t *testing.T) {
+	var buf bytes.Buffer
+	ctx := cmdio.InContext(t.Context(), cmdio.NewIO(t.Context(), flags.OutputText, nil, &buf, &buf, "", ""))
+
+	started := "2026-06-05 17:32 UTC"
+	rows := []listRow{
+		{RunID: "111", Experiment: "exp-a", StartedAt: &started},
+		{RunID: "222"}, // no experiment or start time -> N/A
+	}
+	displayCancelPreview(ctx, rows, "https://my-workspace.cloud.databricks.test")
+
+	out := buf.String()
+	assert.Contains(t, out, "Workspace: https://my-workspace.cloud.databricks.test")
+	assert.Contains(t, out, "Found 2 active run(s) to cancel:")
+	assert.Contains(t, out, "Run ID")
+	assert.Contains(t, out, "111")
+	assert.Contains(t, out, "exp-a")
+	assert.Contains(t, out, "222")
+	assert.Contains(t, out, na)
+}
diff --git a/cmd/air/compute.go b/cmd/air/compute.go
new file mode 100644
index 00000000000..1977eb24441
--- /dev/null
+++ b/cmd/air/compute.go
@@ -0,0 +1,144 @@
+package aircmd
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+)
+
+// gpuType is a wire-facing accelerator type submitted to the training service.
+// The number in the name is the partition count (e.g. GPU_8xH100 is 8 GPUs).
+type gpuType string
+
+const (
+	gpuType1xA10  gpuType = "GPU_1xA10"
+	gpuType8xH100 gpuType = "GPU_8xH100"
+	gpuType1xH100 gpuType = "GPU_1xH100"
+	gpuType8xB300 gpuType = "GPU_8xB300"
+)
+
+// gpuTypes lists every accelerator type understood by this CLI.
+// Workspace availability is enforced by the server.
+var gpuTypes = []gpuType{gpuType1xA10, gpuType1xH100, gpuType8xH100, gpuType8xB300}
+
+func validGPUTypesHint() string {
+	names := make([]string, len(gpuTypes))
+	for i, g := range gpuTypes {
+		names[i] = string(g)
+	}
+	return "valid types are: " + strings.Join(names, ", ")
+}
+
+// parseGPUType resolves a YAML accelerator_type string to a gpuType. The match is
+// exact: the server's lookup is case-sensitive.
+func parseGPUType(value string) (gpuType, error) {
+	switch gpuType(value) {
+	case gpuType1xA10, gpuType8xH100, gpuType1xH100, gpuType8xB300:
+		return gpuType(value), nil
+	}
+	return "", fmt.Errorf("invalid GPU type %q: %s", value, validGPUTypesHint())
+}
+
+// priorityClass is the AI Runtime scheduling priority a run is given within its
+// reservation. The values match the AiRuntimeTask.PriorityClass proto enum and
+// AICM's PriorityClassValidator (the server-side contract).
+type priorityClass string
+
+const (
+	priorityClassBestEffort priorityClass = "BEST_EFFORT"
+	priorityClassNormal     priorityClass = "NORMAL"
+	priorityClassCritical   priorityClass = "CRITICAL"
+)
+
+// priorityClasses lists every valid value, low to high. Used for validation
+// error messages.
+var priorityClasses = []priorityClass{priorityClassBestEffort, priorityClassNormal, priorityClassCritical}
+
+func validPriorityClassesHint() string {
+	names := make([]string, len(priorityClasses))
+	for i, p := range priorityClasses {
+		names[i] = string(p)
+	}
+	return "valid values are: " + strings.Join(names, ", ")
+}
+
+// parsePriorityClass normalizes a YAML priority_class to the enum's contract
+// value. Unlike accelerator_type, the match is case-insensitive: the input is
+// trimmed and upper-cased, so `critical` and `CRITICAL` both resolve.
+func parsePriorityClass(value string) (priorityClass, error) {
+	switch p := priorityClass(strings.ToUpper(strings.TrimSpace(value))); p {
+	case priorityClassBestEffort, priorityClassNormal, priorityClassCritical:
+		return p, nil
+	}
+	return "", fmt.Errorf("invalid priority_class %q: %s", value, validPriorityClassesHint())
+}
+
+// gpusPerNode returns the per-node GPU count, which is the partition count from
+// the name (GPU_1xH100 -> 1, GPU_8xH100 -> 8). num_accelerators must be a
+// round multiple of this since accelerators are allocated in whole nodes.
+func gpusPerNode(g gpuType) (int, error) {
+	switch g {
+	case gpuType1xA10, gpuType1xH100:
+		return 1, nil
+	case gpuType8xH100, gpuType8xB300:
+		return 8, nil
+	}
+	// Unreachable: callers resolve g through parseGPUType first, which rejects
+	// unknown types. Kept as a defensive guard.
+	return 0, fmt.Errorf("invalid GPU type %q", string(g))
+}
+
+// computeConfig is the `compute` block of the run YAML: which accelerators to
+// use and how many.
+type computeConfig struct {
+	NumAccelerators int     `yaml:"num_accelerators" help:"Total number of GPUs to allocate. Must be a positive multiple of the accelerator type's per-node GPU count. See https://docs.databricks.com/aws/en/machine-learning/ai-runtime/cli/yaml-config#reference for supported GPU types."`
+	AcceleratorType string  `yaml:"accelerator_type" help:"Which accelerator to run on, e.g. GPU_1xA10. See https://docs.databricks.com/aws/en/machine-learning/ai-runtime/cli/yaml-config#reference for the current list of supported GPU types. Matched case-sensitively."`
+	PoolID          *string `yaml:"pool_id" help:"GPU pool to run on, by id. A GPU pool is a pre-provisioned accelerator reservation; contact your Databricks account team to provision one. Must be 1-255 characters. List available pools with 'air pools list'."`
+	PriorityClass   *string `yaml:"priority_class" help:"Scheduling priority within the pool: BEST_EFFORT (lowest, preemptable), NORMAL, or CRITICAL (highest). Requires pool_id."`
+}
+
+// validate checks the compute block against the backend's constraints.
+func (c *computeConfig) validate() error {
+	g, err := parseGPUType(c.AcceleratorType)
+	if err != nil {
+		return fmt.Errorf("compute.accelerator_type: %w", err)
+	}
+
+	if c.NumAccelerators <= 0 {
+		return fmt.Errorf("compute.num_accelerators must be positive, got %d", c.NumAccelerators)
+	}
+
+	perNode, err := gpusPerNode(g)
+	if err != nil {
+		return err
+	}
+	if c.NumAccelerators%perNode != 0 {
+		return fmt.Errorf("compute.num_accelerators for %s must be a multiple of %d, got %d", c.AcceleratorType, perNode, c.NumAccelerators)
+	}
+
+	if c.PoolID != nil {
+		v := strings.TrimSpace(*c.PoolID)
+		if v == "" {
+			return errors.New("compute.pool_id cannot be empty")
+		}
+		if len(v) > 255 {
+			return fmt.Errorf("compute.pool_id must be 255 characters or less, got %d", len(v))
+		}
+		*c.PoolID = v
+	}
+
+	if c.PriorityClass != nil {
+		p, err := parsePriorityClass(*c.PriorityClass)
+		if err != nil {
+			return fmt.Errorf("compute.priority_class: %w", err)
+		}
+		// A priority class only ranks pending work within a pool, so it requires
+		// one.
+		if c.PoolID == nil {
+			return errors.New("compute.priority_class requires compute.pool_id — priority applies only within a GPU pool")
+		}
+		*c.PriorityClass = string(p)
+	}
+
+	return nil
+}
diff --git a/cmd/air/compute_test.go b/cmd/air/compute_test.go
new file mode 100644
index 00000000000..5a099c5adf5
--- /dev/null
+++ b/cmd/air/compute_test.go
@@ -0,0 +1,127 @@
+package aircmd
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseGPUType(t *testing.T) {
+	tests := []struct {
+		in   string
+		want gpuType
+	}{
+		{"GPU_1xA10", gpuType1xA10},
+		{"GPU_8xH100", gpuType8xH100},
+		{"GPU_1xH100", gpuType1xH100},
+		{"GPU_8xB300", gpuType8xB300},
+	}
+	for _, tt := range tests {
+		t.Run(tt.in, func(t *testing.T) {
+			got, err := parseGPUType(tt.in)
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
+
+func TestParseGPUTypeInvalid(t *testing.T) {
+	// Wrong casing is rejected rather than fixed up; legacy types (h100_80gb, a10)
+	// can no longer be submitted; unknown types are rejected.
+	for _, in := range []string{"gpu_1xa10", "GPU_1XA10", "gpu_8xb300", "GPU_2xH100", "h100_80gb", "a10", "b200", ""} {
+		t.Run(in, func(t *testing.T) {
+			_, err := parseGPUType(in)
+			require.Error(t, err)
+			assert.Contains(t, err.Error(), "valid types are")
+		})
+	}
+}
+
+func TestGPUsPerNode(t *testing.T) {
+	tests := []struct {
+		in   gpuType
+		want int
+	}{
+		{gpuType1xA10, 1},
+		{gpuType1xH100, 1},
+		{gpuType8xH100, 8},
+		{gpuType8xB300, 8},
+	}
+	for _, tt := range tests {
+		t.Run(string(tt.in), func(t *testing.T) {
+			got, err := gpusPerNode(tt.in)
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+
+	_, err := gpusPerNode(gpuType("nonsense"))
+	require.Error(t, err)
+}
+
+func TestParsePriorityClass(t *testing.T) {
+	// Case-insensitive: mixed/lower case and surrounding whitespace normalize to
+	// the enum's contract value.
+	for _, in := range []string{"CRITICAL", "critical", "Critical", "  critical  "} {
+		got, err := parsePriorityClass(in)
+		require.NoError(t, err)
+		assert.Equal(t, priorityClassCritical, got)
+	}
+
+	for _, in := range []string{"urgent", "", "high"} {
+		_, err := parsePriorityClass(in)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "valid values are")
+	}
+}
+
+func TestComputeConfigValidateNormalizesPriorityClass(t *testing.T) {
+	// A lower-case value is upper-cased in place so the submitted payload carries
+	// the enum's contract value.
+	cfg := computeConfig{NumAccelerators: 1, AcceleratorType: "GPU_1xH100", PoolID: new("cap"), PriorityClass: new("critical")}
+	require.NoError(t, cfg.validate())
+	assert.Equal(t, "CRITICAL", *cfg.PriorityClass)
+}
+
+func TestComputeConfigValidate(t *testing.T) {
+	tests := []struct {
+		name    string
+		cfg     computeConfig
+		wantErr string // substring; empty means the config is valid
+	}{
+		{"single node", computeConfig{NumAccelerators: 8, AcceleratorType: "GPU_8xH100"}, ""},
+		{"multiple nodes", computeConfig{NumAccelerators: 16, AcceleratorType: "GPU_8xH100"}, ""},
+		{"single-gpu partitions", computeConfig{NumAccelerators: 3, AcceleratorType: "GPU_1xH100"}, ""},
+		{"pool id", computeConfig{NumAccelerators: 1, AcceleratorType: "GPU_1xH100", PoolID: new(" capacity ")}, ""},
+		{"empty pool id", computeConfig{NumAccelerators: 1, AcceleratorType: "GPU_1xH100", PoolID: new(" ")}, "cannot be empty"},
+		{"long pool id", computeConfig{NumAccelerators: 1, AcceleratorType: "GPU_1xH100", PoolID: new(strings.Repeat("a", 256))}, "255 characters or less"},
+		{"unknown type", computeConfig{NumAccelerators: 8, AcceleratorType: "b200"}, "accelerator_type"},
+		{"legacy type rejected", computeConfig{NumAccelerators: 8, AcceleratorType: "h100_80gb"}, "accelerator_type"},
+		{"non-positive count", computeConfig{NumAccelerators: 0, AcceleratorType: "GPU_1xH100"}, "must be positive"},
+		{"count not a multiple", computeConfig{NumAccelerators: 4, AcceleratorType: "GPU_8xH100"}, "multiple of 8"},
+		{"B300 single node", computeConfig{NumAccelerators: 8, AcceleratorType: "GPU_8xB300"}, ""},
+		{"B300 two nodes", computeConfig{NumAccelerators: 16, AcceleratorType: "GPU_8xB300"}, ""},
+		{"B300 three nodes", computeConfig{NumAccelerators: 24, AcceleratorType: "GPU_8xB300"}, ""},
+		{"B300 count one", computeConfig{NumAccelerators: 1, AcceleratorType: "GPU_8xB300"}, "multiple of 8"},
+		{"B300 count four", computeConfig{NumAccelerators: 4, AcceleratorType: "GPU_8xB300"}, "multiple of 8"},
+		{"B300 count twelve", computeConfig{NumAccelerators: 12, AcceleratorType: "GPU_8xB300"}, "multiple of 8"},
+		{"B300 zero", computeConfig{NumAccelerators: 0, AcceleratorType: "GPU_8xB300"}, "must be positive"},
+		{"B300 negative", computeConfig{NumAccelerators: -8, AcceleratorType: "GPU_8xB300"}, "must be positive"},
+		{"priority class", computeConfig{NumAccelerators: 1, AcceleratorType: "GPU_1xH100", PoolID: new("cap"), PriorityClass: new("critical")}, ""},
+		{"priority class requires reservation", computeConfig{NumAccelerators: 1, AcceleratorType: "GPU_1xH100", PriorityClass: new("NORMAL")}, "requires compute.pool_id"},
+		{"invalid priority class", computeConfig{NumAccelerators: 1, AcceleratorType: "GPU_1xH100", PoolID: new("cap"), PriorityClass: new("urgent")}, "invalid priority_class"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := tt.cfg.validate()
+			if tt.wantErr == "" {
+				require.NoError(t, err)
+				return
+			}
+			require.Error(t, err)
+			assert.Contains(t, err.Error(), tt.wantErr)
+		})
+	}
+}
diff --git a/cmd/air/convert_to_dabs.go b/cmd/air/convert_to_dabs.go
new file mode 100644
index 00000000000..02b29a4d02f
--- /dev/null
+++ b/cmd/air/convert_to_dabs.go
@@ -0,0 +1,662 @@
+package aircmd
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"path"
+	"path/filepath"
+	"strconv"
+	"strings"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/diag"
+	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/dyn/yamlsaver"
+	"github.com/spf13/cobra"
+)
+
+// convert_to_dabs turns an AIR CLI run YAML into a Databricks Asset Bundle so a
+// workload authored for `air run` can be deployed and managed as a bundle.
+//
+// It is a purely local, syntactic translation: it maps the run config onto a
+// schema-valid ai_runtime_task (the SDK jobs.AiRuntimeTask — experiment +
+// deployments[].{command_path,compute} + code_source_path, with framework fields
+// like retries/timeout on the surrounding task) and writes command.sh plus the
+// env_vars.json / secret_env_vars.json / hyperparameters.yaml sidecars into
+// generated_artifacts/. It does NOT package, snapshot, or upload anything.
+//
+// The code_source is emitted as a `tgz` artifact (the DABs artifact snapshotter):
+// DABs builds the tarball from the source directory at deploy and code_source_path
+// points at the built tarball — so convert never touches the code. A git ref or
+// include_paths just add `git` / a narrowed `include` to the same artifact.
+// Dependencies are folded into the job's environments[] spec, which the runtime
+// installs from directly; no requirements.yaml is emitted.
+
+// dabsTargetName is the single default target emitted; a development-mode target
+// is the conventional starting point for a generated bundle.
+const dabsTargetName = "dev"
+
+// generatedArtifactsDir holds command.sh and the env/secret/param sidecars, kept
+// apart from the user's tree so sync.paths can list it without the code directory.
+// The server derives the sidecar paths from command_path's parent, so they must
+// stay beside command.sh.
+const generatedArtifactsDir = "generated_artifacts"
+
+// codeSourceArtifactKey names the `tgz` artifact convert emits for a git/include
+// snapshot. codeSourceTgzArtifact is where DABs writes the built tarball — kept out of
+// sync.paths so it is uploaded once via the artifact path, not also synced.
+const (
+	codeSourceArtifactKey = "code_source"
+	codeSourceTgzArtifact = "dist/code_source.tgz"
+)
+
+func newConvertToDabsCommand() *cobra.Command {
+	var (
+		outputDir string
+		force     bool
+	)
+
+	cmd := &cobra.Command{
+		Use:   "convert-to-dabs <yaml_path>",
+		Args:  root.ExactArgs(1),
+		Short: "Convert an AIR run YAML into a Databricks Asset Bundle",
+		Long: `Convert an AIR CLI run YAML config into a Databricks Asset Bundle (DABs).
+
+The emitted bundle can be deployed with the standard DABs workflow:
+
+    databricks bundle validate
+    databricks bundle deploy
+
+bundle deploy uploads the code source and launch scripts for you, so no manual
+upload step is required. This command performs a purely local translation and
+does not contact the workspace.`,
+	}
+
+	cmd.Flags().StringVar(&outputDir, "output-dir", "", "Directory to write the bundle into (default: the input YAML's directory). Must contain the code_source. Accepts an absolute or relative path.")
+	cmd.Flags().BoolVar(&force, "force", false, "Overwrite the generated bundle files if they already exist.")
+
+	cmd.RunE = func(cmd *cobra.Command, args []string) error {
+		ctx := cmd.Context()
+		yamlPath := args[0]
+
+		cfg, err := loadRunConfig(yamlPath)
+		if err != nil {
+			return err
+		}
+
+		// Default the bundle to the input YAML's directory. The bundle's sync root
+		// must contain the code_source so the `tgz` artifact can package it, and
+		// root_path is resolved relative to the YAML, so the YAML's dir is the natural
+		// bundle root. An explicit --output-dir overrides.
+		dir := outputDir
+		if dir == "" {
+			dir = filepath.Dir(yamlPath)
+		}
+
+		written, err := writeBundle(ctx, cfg, yamlPath, dir, force)
+		if err != nil {
+			return err
+		}
+
+		printConvertNextSteps(ctx, dir, written, bundleResourceKey(cfg.ExperimentName))
+		return nil
+	}
+
+	return cmd
+}
+
+// convertToDabs builds the DABs bundle value and the loose launch artifacts for a
+// run config. It reads only what the run path's buildArtifacts reads, so the
+// mapping is unit-testable in isolation. Returns the bundle root as a
+// map[string]dyn.Value (ready for yamlsaver) and the loose artifacts (command.sh +
+// env/secret/param sidecars) to write under generated_artifacts/. It does not touch the
+// code_source; the emitted `tgz` artifact packages it at deploy.
+func convertToDabs(ctx context.Context, cfg *runConfig, configPath, bundleDir string) (map[string]dyn.Value, []uploadItem, error) {
+	// idempotency_token is intentionally not mapped: it dedups a single runs/submit
+	// call, which has no analogue for a persistent, repeatedly-runnable bundle job.
+	//
+	// usage_policy_name resolution is not ported (mirrors the submit path).
+	if cfg.UsagePolicyName != nil {
+		return nil, nil, errors.New("usage_policy_name is not yet supported by convert-to-dabs")
+	}
+	if len(cfg.Containers) > 0 {
+		return nil, nil, errors.New("containers are not yet supported by convert-to-dabs; run this config with 'databricks air run'")
+	}
+	if snap := codeSnapshot(cfg); snap != nil {
+		// remote_volume points the code archive at a specific UC Volume. The bundle's
+		// artifact location is set bundle-wide via workspace.artifact_path, not
+		// per-code-source, so a per-source Volume isn't representable here.
+		if snap.RemoteVolume != nil {
+			return nil, nil, errors.New("remote_volume in code_source is not supported by convert-to-dabs; set workspace.artifact_path in the bundle instead")
+		}
+	}
+
+	// The source dir relative to the bundle, used as the `tgz` artifact's `path`
+	// (see codeArtifactFor); code_source_path points at the tarball the artifact builds.
+	codeDirPath, err := bundleCodeSourcePath(ctx, cfg, configPath, bundleDir)
+	if err != nil {
+		return nil, nil, err
+	}
+	codeSourcePath := codeDirPath
+	art, err := codeArtifactFor(cfg, codeDirPath)
+	if err != nil {
+		return nil, nil, err
+	}
+	if art != nil {
+		// The artifact snapshotter builds the tarball; code_source_path points at it.
+		codeSourcePath = art.tgzPath
+	}
+
+	// buildArtifacts emits command.sh plus the training_config / hyperparameters /
+	// env / secret sidecars, all co-located so the Jobs run-output page can derive
+	// their paths from command_path. It no longer produces a requirements.yaml —
+	// file-form deps are folded into the environments[] spec — so there is nothing to
+	// filter out here.
+	artifacts, err := buildArtifacts(cfg)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	root := buildBundleValue(ctx, cfg, configPath, codeSourcePath, art)
+	return root, artifacts, nil
+}
+
+// runtimeCodeSourceRoot is where the launcher extracts an AI Runtime task's
+// code_source; the tarball's top-level dir lands directly under it, and the launcher
+// exports it (plus the component subdir) as $CODE_SOURCE_PATH. The user's command is
+// responsible for cd-ing there (every air command does), so convert copies the command
+// verbatim rather than injecting a cd.
+const runtimeCodeSourceRoot = "/databricks/code_source"
+
+// codeArtifact is the `tgz` artifact convert emits when a snapshot pins a git ref or
+// narrows to include_paths. path/include follow the artifact snapshotter's semantics
+// (entries relative to `path`); tgzPath is the built tarball code_source_path points at.
+type codeArtifact struct {
+	path      string // artifact `path`: the code dir's parent, relative to the bundle
+	include   []string
+	tgzPath   string
+	gitBranch *string
+	gitCommit *string
+}
+
+// codeArtifactFor returns the `tgz` artifact to emit for a code_source, or nil when
+// there is no code_source. Every code_source is packaged as a `tgz` artifact and built
+// and uploaded through the standard artifact path; a git ref / include_paths just add
+// `git` / narrowed `include` to the same artifact. It errors when the code dir resolves
+// to the bundle root (no basename to nest under). codeDirPath is the source dir relative
+// to the bundle ("./"-prefixed).
+//
+// The artifact snapshotter names entries relative to `path`, and the runtime extracts
+// to /databricks/code_source/<dir>, so the code dir's basename must be the top-level
+// entry. To get that, emit path = the code dir's parent and include = basename-prefixed
+// subpaths, so entries come out as "<basename>/..." — the layout the air CLI produced.
+func codeArtifactFor(cfg *runConfig, codeDirPath string) (*codeArtifact, error) {
+	snap := codeSnapshot(cfg)
+	if snap == nil {
+		return nil, nil
+	}
+	codeDirRel := strings.TrimPrefix(codeDirPath, "./")
+	// A code dir that resolves to the bundle root has no basename to nest under: the
+	// archive would sit directly at /databricks/code_source (no <dir>), and an include
+	// rooted at "." would also sweep the bundle's own generated files (databricks.yml,
+	// generated_artifacts/, the output tarball) into it. Reject rather than emit that;
+	// the user should point root_path at a subdirectory.
+	if codeDirRel == "." {
+		return nil, fmt.Errorf("code_source root_path %q resolves to the bundle root; convert-to-dabs cannot package code there (no code directory to nest under %s/<dir>). Point root_path at a subdirectory", snap.RootPath, runtimeCodeSourceRoot)
+	}
+	dirName := path.Base(codeDirRel)
+	art := &codeArtifact{
+		path:    path.Dir(codeDirRel),
+		tgzPath: localBundlePath(codeSourceTgzArtifact),
+	}
+	if len(snap.IncludePaths) > 0 {
+		for _, inc := range snap.IncludePaths {
+			art.include = append(art.include, path.Join(dirName, inc))
+		}
+	} else {
+		art.include = []string{dirName}
+	}
+	if snap.Git != nil {
+		art.gitBranch = snap.Git.Branch
+		art.gitCommit = snap.Git.Commit
+	}
+	return art, nil
+}
+
+// codeSnapshot returns the snapshot code source config, or nil if none.
+func codeSnapshot(cfg *runConfig) *snapshotSourceConfig {
+	if cfg.CodeSource == nil {
+		return nil
+	}
+	return cfg.CodeSource.Snapshot
+}
+
+// bundleCodeSourcePath resolves the code_source directory to a "./"-prefixed path
+// relative to the bundle dir, used as the `tgz` artifact's `path`. Returns "" when the
+// config has no code_source. The path must be inside the bundle (the artifact
+// snapshotter only packages in-bundle dirs).
+func bundleCodeSourcePath(ctx context.Context, cfg *runConfig, configPath, bundleDir string) (string, error) {
+	snap := codeSnapshot(cfg)
+	if snap == nil {
+		return "", nil
+	}
+	root, err := resolveRootPath(ctx, snap.RootPath, filepath.Dir(configPath))
+	if err != nil {
+		return "", err
+	}
+	bundleAbs, err := filepath.Abs(bundleDir)
+	if err != nil {
+		return "", err
+	}
+	rel, err := filepath.Rel(bundleAbs, root)
+	if err != nil || !filepath.IsLocal(rel) {
+		return "", fmt.Errorf("code_source root_path %q is not inside the bundle directory %q; bundle deploy can only upload files under the bundle's sync root. Move the code inside the bundle, or set sync.paths in databricks.yml to a directory that contains both (note that widens what gets synced)", snap.RootPath, bundleDir)
+	}
+	return localBundlePath(filepath.ToSlash(rel)), nil
+}
+
+// nv builds a dyn.Value at "position" n: yamlsaver orders a map's keys by their
+// Location line, so assigning ascending n values fixes the emitted key order.
+// It routes through dyn.V so nested Go maps/slices are converted recursively,
+// then stamps the ordering location.
+func nv(v any, n int) dyn.Value {
+	return dyn.V(v).WithLocations([]diag.Location{{Line: n}})
+}
+
+// localBundlePath renders a bundle-relative path with a leading "./" so bundle
+// deploy classifies it as a local artifact to upload (see IsLibraryLocal). It is
+// built from path.Join (forward slashes) so the emitted YAML is identical across
+// operating systems.
+func localBundlePath(p string) string {
+	return "./" + p
+}
+
+// buildBundleValue assembles the bundle root as an ordered map[string]dyn.Value.
+// codeSourcePath is the "./"-prefixed code_source dir relative to the bundle (empty
+// when the config has no code_source); command.sh is a bundle-local artifact.
+func buildBundleValue(ctx context.Context, cfg *runConfig, configPath, codeSourcePath string, art *codeArtifact) map[string]dyn.Value {
+	name := cfg.ExperimentName
+
+	// ai_runtime_task: experiment + one deployment (command_path + compute) +
+	// code_source_path and task-level runtime settings. Only the fields the strict
+	// schema allows.
+	//
+	// command_path is "./"-prefixed so bundle deploy treats it as LOCAL and uploads
+	// it: libraries.IsLibraryLocal classifies a bare, extensionless path as a PyPI
+	// package name, which would deploy a path the backend can't resolve.
+	compute := map[string]dyn.Value{
+		"accelerator_type":  nv(cfg.Compute.AcceleratorType, 1),
+		"accelerator_count": nv(cfg.Compute.NumAccelerators, 2),
+	}
+	if cfg.Compute.PoolID != nil {
+		compute["provisioned_capacity_id"] = nv(*cfg.Compute.PoolID, 3)
+	}
+	deployment := map[string]dyn.Value{
+		"command_path": nv(localBundlePath(path.Join(generatedArtifactsDir, commandScriptName)), 1),
+		"compute":      nv(compute, 2),
+	}
+
+	aiRuntimeTask := map[string]dyn.Value{
+		"experiment":  nv(name, 1),
+		"deployments": nv([]dyn.Value{dyn.V(deployment)}, 2),
+	}
+	line := 3
+	if codeSourcePath != "" {
+		// Points at the `tgz` artifact's built tarball; deploy uploads it and rewrites
+		// this to the uploaded workspace path.
+		aiRuntimeTask["code_source_path"] = nv(codeSourcePath, line)
+		line++
+	}
+	if cfg.MLflowRunName != nil {
+		aiRuntimeTask["mlflow_run"] = nv(*cfg.MLflowRunName, line)
+		line++
+	}
+	if cfg.MLflowExperimentDirectory != nil {
+		aiRuntimeTask["mlflow_experiment_directory"] = nv(*cfg.MLflowExperimentDirectory, line)
+		line++
+	}
+	if cfg.MLflowArtifactLocation != nil {
+		aiRuntimeTask["mlflow_artifact_location"] = nv(*cfg.MLflowArtifactLocation, line)
+		line++
+	}
+	if cfg.Compute.PriorityClass != nil {
+		aiRuntimeTask["priority_class"] = nv(*cfg.Compute.PriorityClass, line)
+		line++
+	}
+	if cfg.Environment != nil && cfg.Environment.UnityCatalogImage != "" {
+		aiRuntimeTask["unity_catalog_image_path"] = nv(cfg.Environment.UnityCatalogImage, line)
+	}
+
+	// Task wrapper: task_key + framework fields (retries/timeout) + env key +
+	// the ai_runtime_task. Framework fields live here per the schema, not inside
+	// ai_runtime_task.
+	task := map[string]dyn.Value{
+		"task_key":        nv(name, 1),
+		"environment_key": nv(aiRuntimeEnvironmentKey, 2),
+	}
+	taskLine := 3
+	maxRetries := cfg.maxRetries()
+	task["max_retries"] = nv(maxRetries, taskLine)
+	taskLine++
+	task["retry_on_timeout"] = nv(maxRetries > 0, taskLine)
+	taskLine++
+	if cfg.TimeoutMinutes != nil {
+		task["timeout_seconds"] = nv(cfg.timeoutSeconds(), taskLine)
+		taskLine++
+	}
+	task["ai_runtime_task"] = nv(aiRuntimeTask, taskLine)
+
+	// environments[]: version + the dependency set. The runtime installs deps from this
+	// spec directly, so the full dependency set (whether authored inline or in a
+	// requirements file) must live here — convert emits no requirements.yaml of its
+	// own. Resolve the version
+	// through the same path `air run` uses (config, else env override, else the
+	// default channel) so a config without an explicit version still pins the version
+	// the workload would have run with — not an empty spec.
+	envVersion, deps := bundleEnvironmentDeps(ctx, cfg)
+	envSpec := map[string]dyn.Value{}
+	if strings.HasPrefix(envVersion, databricksAIPrefix) {
+		envSpec["base_environment"] = nv("workspace-base-environments/"+envVersion, 1)
+	} else {
+		envSpec["environment_version"] = nv(envVersion, 1)
+	}
+	if len(deps) > 0 {
+		depVals := make([]dyn.Value, len(deps))
+		for i, d := range deps {
+			depVals[i] = dyn.V(d)
+		}
+		envSpec["dependencies"] = nv(depVals, 2)
+	}
+	environment := map[string]dyn.Value{
+		"environment_key": nv(aiRuntimeEnvironmentKey, 1),
+		"spec":            nv(envSpec, 2),
+	}
+
+	job := map[string]dyn.Value{
+		"name":         nv(name, 1),
+		"tasks":        nv([]dyn.Value{dyn.V(task)}, 2),
+		"environments": nv([]dyn.Value{dyn.V(environment)}, 3),
+	}
+	// usage_policy_id is an already-resolved budget policy id, so it maps directly
+	// to the job's budget_policy_id. (usage_policy_name needs server-side resolution
+	// and is rejected in convertToDabs.)
+	if cfg.UsagePolicyID != nil {
+		job["budget_policy_id"] = nv(*cfg.UsagePolicyID, 4)
+	}
+	if perms := buildPermissionsValue(cfg.Permissions); perms.Kind() != dyn.KindInvalid {
+		job["permissions"] = nv(perms.MustSequence(), 5)
+	}
+
+	rootValue := map[string]dyn.Value{
+		"bundle": nv(map[string]dyn.Value{
+			"name": nv(name, 1),
+		}, 1),
+		// sync.paths replaces the default of syncing the whole bundle root. The code
+		// directory is omitted deliberately: the `tgz` artifact packages it, so syncing
+		// it too would upload the tree twice.
+		"sync": nv(map[string]dyn.Value{
+			"paths": nv([]dyn.Value{nv(generatedArtifactsDir, 1)}, 1),
+		}, 2),
+		"targets": nv(map[string]dyn.Value{
+			dabsTargetName: nv(map[string]dyn.Value{
+				"mode":    nv("development", 1),
+				"default": nv(true, 2),
+			}, 1),
+		}, 4),
+		"resources": nv(map[string]dyn.Value{
+			"jobs": nv(map[string]dyn.Value{
+				bundleResourceKey(name): nv(job, 1),
+			}, 1),
+		}, 5),
+	}
+	// The `tgz` artifact that packages the code_source (nil only when there is none).
+	if art != nil {
+		rootValue["artifacts"] = nv(buildArtifactsValue(art), 3)
+	}
+	return rootValue
+}
+
+// buildArtifactsValue builds the `artifacts` block for the code_source: a
+// single `tgz` artifact whose `path` is the code-source root, carrying the git ref
+// and/or include subpaths, and whose `files` output is the tarball code_source_path
+// points at.
+func buildArtifactsValue(art *codeArtifact) map[string]dyn.Value {
+	a := map[string]dyn.Value{
+		"type": nv("tgz", 1),
+		"path": nv(art.path, 2),
+	}
+	fileLine := 3
+	if art.gitCommit != nil || art.gitBranch != nil {
+		g := map[string]dyn.Value{}
+		// commit wins over branch, matching the artifact builder.
+		if art.gitCommit != nil {
+			g["commit"] = nv(*art.gitCommit, 1)
+		} else {
+			g["branch"] = nv(*art.gitBranch, 1)
+		}
+		a["git"] = nv(g, fileLine)
+		fileLine++
+	}
+	// include is always set: the basename (whole dir) or basename-prefixed subpaths.
+	vals := make([]dyn.Value, len(art.include))
+	for i, p := range art.include {
+		vals[i] = dyn.V(p)
+	}
+	a["include"] = nv(vals, fileLine)
+	fileLine++
+	a["files"] = nv([]dyn.Value{
+		dyn.V(map[string]dyn.Value{"source": nv(art.tgzPath, 1)}),
+	}, fileLine)
+	return map[string]dyn.Value{codeSourceArtifactKey: nv(a, 1)}
+}
+
+// bundleEnvironmentDeps resolves the runtime version and the inline dependency
+// list to emit in the bundle's environments[] spec. The runtime installs deps from
+// that spec, so the whole set must be here. Dependencies are inline-only (a
+// requirements-file path is rejected at config load), so an unset list yields none.
+func bundleEnvironmentDeps(ctx context.Context, cfg *runConfig) (version string, deps []string) {
+	cfgVersion, _ := cfg.runtimeVersion()
+	version = dlRuntimeImage(ctx, cfgVersion)
+
+	if inline, ok := cfg.inlineDependencies(); ok {
+		return version, inline
+	}
+	return version, nil
+}
+
+// bundleResourceKey is the job resource key for an experiment name: the name
+// itself. quoteJobKey quotes it in the emitted YAML when it would otherwise load
+// as a non-string scalar.
+func bundleResourceKey(name string) string {
+	return name
+}
+
+// quoteJobKey rewrites the emitted job resource key as a quoted YAML key when the
+// name would otherwise load as a non-string scalar. yamlsaver emits map keys
+// unquoted, and the bundle loader rejects a key that types as something other than
+// a string ("12345" -> !!int, "true" -> !!bool) with "invalid key tag". Only the
+// job key needs this: every other key convert emits is a fixed schema field name.
+func quoteJobKey(bundlePath, key string) error {
+	if !yamlKeyNeedsQuoting(key) {
+		return nil
+	}
+	data, err := os.ReadFile(bundlePath)
+	if err != nil {
+		return err
+	}
+	// The key is emitted by buildBundleValue at a known depth under resources.jobs,
+	// so the indented "<key>:" line is unambiguous.
+	old := []byte("\n    " + key + ":\n")
+	updated := bytes.Replace(data, old, []byte("\n    \""+key+"\":\n"), 1)
+	if bytes.Equal(data, updated) {
+		return fmt.Errorf("could not quote job key %q in %s", key, bundlePath)
+	}
+	return os.WriteFile(bundlePath, updated, 0o600)
+}
+
+// yamlKeyNeedsQuoting reports whether an unquoted YAML key would load as a
+// non-string scalar. experiment_name allows only [alphanumeric, -, _], so the
+// cases are numbers and the bool/null words.
+func yamlKeyNeedsQuoting(key string) bool {
+	switch strings.ToLower(key) {
+	case "true", "false", "null", "yes", "no", "on", "off", "~":
+		return true
+	}
+	if _, err := strconv.ParseFloat(key, 64); err == nil {
+		return true
+	}
+	if _, err := strconv.ParseInt(key, 0, 64); err == nil {
+		return true
+	}
+	return false
+}
+
+// buildPermissionsValue maps run-config permissions to DABs job permissions
+// (level → principal). Returns an invalid value when there are none.
+func buildPermissionsValue(perms []permission) dyn.Value {
+	if len(perms) == 0 {
+		return dyn.InvalidValue
+	}
+	out := make([]dyn.Value, 0, len(perms))
+	for _, p := range perms {
+		m := map[string]dyn.Value{"level": nv(p.Level, 1)}
+		switch {
+		case p.UserName != nil:
+			m["user_name"] = nv(*p.UserName, 2)
+		case p.GroupName != nil:
+			m["group_name"] = nv(*p.GroupName, 2)
+		case p.ServicePrincipalName != nil:
+			m["service_principal_name"] = nv(*p.ServicePrincipalName, 2)
+		}
+		out = append(out, dyn.V(m))
+	}
+	return dyn.V(out)
+}
+
+// writeBundle writes the bundle into dir: databricks.yml plus the loose launch
+// artifacts (command.sh + env/secret/param sidecars). It does not touch the code
+// source — the emitted `tgz` artifact packages it at deploy. Unless force is set
+// it refuses to overwrite existing files, so a re-run can't silently clobber a
+// bundle the user has edited. Returns the relative paths written, for the
+// next-steps message.
+func writeBundle(ctx context.Context, cfg *runConfig, configPath, dir string, force bool) ([]string, error) {
+	root, artifacts, err := convertToDabs(ctx, cfg, configPath, dir)
+	if err != nil {
+		return nil, err
+	}
+
+	// Restrict perms: the bundle carries env_vars.json (literal env var values), so
+	// keep the dir owner-only rather than world-readable.
+	if err := os.MkdirAll(dir, 0o700); err != nil {
+		return nil, err
+	}
+
+	// Refuse to clobber an existing file, with one consistent message. A user
+	// re-running convert into the same dir gets a clear error rather than a silent
+	// overwrite of edits they may have made. The hint names --force rather than
+	// --output-dir: the code_source must live inside the bundle dir, so redirecting
+	// the output usually isn't a usable escape hatch for an in-place conversion.
+	artifactDir := filepath.Join(dir, generatedArtifactsDir)
+	if err := os.MkdirAll(artifactDir, 0o700); err != nil {
+		return nil, err
+	}
+	writeFile := func(name string, data []byte) error {
+		target := filepath.Join(artifactDir, name)
+		if !force {
+			if _, err := os.Stat(target); err == nil {
+				return fmt.Errorf("%s already exists in %s; pass --force to overwrite or remove it", name, artifactDir)
+			}
+		}
+		return os.WriteFile(target, data, 0o600)
+	}
+
+	bundlePath := filepath.Join(dir, "databricks.yml")
+	if !force {
+		if _, err := os.Stat(bundlePath); err == nil {
+			return nil, fmt.Errorf("databricks.yml already exists in %s; pass --force to overwrite or remove it", dir)
+		}
+	}
+	// SaveAsYAML's force arg is passed true unconditionally: the collision check
+	// above already decided whether overwriting is allowed.
+	if err := yamlsaver.NewSaver().SaveAsYAML(root, bundlePath, true); err != nil {
+		return nil, err
+	}
+	if err := quoteJobKey(bundlePath, bundleResourceKey(cfg.ExperimentName)); err != nil {
+		return nil, err
+	}
+	written := []string{"databricks.yml"}
+
+	// Launch artifacts (command.sh + sidecars) under generated_artifacts/.
+	for _, item := range artifacts {
+		if err := writeFile(item.name, item.data); err != nil {
+			return nil, fmt.Errorf("failed to write %s: %w", item.name, err)
+		}
+		written = append(written, path.Join(generatedArtifactsDir, item.name))
+	}
+
+	return written, nil
+}
+
+// printConvertNextSteps tells the user what was written and the exact deploy
+// sequence, since the value of the command is a one-command deploy afterwards.
+//
+// It also spells out cleanup. This matters specifically for AIR users: `air run`
+// submits an ephemeral runs/submit workload that the platform reaps on its own,
+// whereas `bundle deploy` creates a *persistent* job that lingers until explicitly
+// destroyed — DABs has no automatic GC. A user migrating from `air run` will not
+// expect a durable resource, so we call out `bundle destroy` explicitly.
+func printConvertNextSteps(ctx context.Context, dir string, written []string, jobKey string) {
+	cmdio.LogString(ctx, fmt.Sprintf("Wrote a Databricks Asset Bundle to %s:", dir))
+	for _, w := range written {
+		cmdio.LogString(ctx, "  "+w)
+	}
+
+	// Name this binary rather than a bare "databricks": ai_runtime_task is only
+	// understood by a CLI carrying it, and an older one on PATH drops the field with
+	// just a warning, deploying a job with no AI task at all.
+	self := cliInvocation()
+
+	// The bundle is written next to the input YAML by default, so a cd step is only
+	// worth printing when the user has to leave the current directory.
+	var steps []string
+	if dir != "." {
+		steps = append(steps, "cd "+dir)
+	}
+	steps = append(steps,
+		self+" bundle validate",
+		self+" bundle deploy",
+		self+" bundle run "+jobKey+" --no-wait",
+	)
+
+	cmdio.LogString(ctx, "")
+	cmdio.LogString(ctx, "To deploy and run this workload as a bundle:")
+	for i, s := range steps {
+		cmdio.LogString(ctx, fmt.Sprintf("  %d. %s", i+1, s))
+	}
+	cmdio.LogString(ctx, "")
+	cmdio.LogString(ctx, "bundle deploy uploads the code source and launch scripts automatically.")
+	cmdio.LogString(ctx, "To see what it deployed and where: "+self+" bundle summary")
+	cmdio.LogString(ctx, "")
+	cmdio.LogString(ctx, "Unlike `air run` (which submits an ephemeral run), bundle deploy creates a")
+	cmdio.LogString(ctx, "persistent job that is not garbage-collected. When you are done, remove the")
+	cmdio.LogString(ctx, "job and its uploaded files with:")
+	cmdio.LogString(ctx, "  "+self+" bundle destroy")
+}
+
+// cliInvocation is how the user should spell this binary in a follow-up command.
+// A path-qualified argv[0] (./dbcli, ../dbcli) is kept as typed so copy-paste works
+// from the same cwd; a bare name resolved via PATH is reported as "databricks".
+func cliInvocation() string {
+	arg0 := os.Args[0]
+	if arg0 == "" {
+		return "databricks"
+	}
+	if arg0 == filepath.Base(arg0) {
+		return "databricks"
+	}
+	return arg0
+}
diff --git a/cmd/air/convert_to_dabs_test.go b/cmd/air/convert_to_dabs_test.go
new file mode 100644
index 00000000000..cbffa6b224c
--- /dev/null
+++ b/cmd/air/convert_to_dabs_test.go
@@ -0,0 +1,664 @@
+package aircmd
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/databricks/cli/libs/dyn"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.yaml.in/yaml/v3"
+)
+
+// Re-running a conversion into a dir that already holds a generated bundle is
+// refused by default (the user may have edited it) and allowed with --force.
+func TestConvertToDabsForceOverwrite(t *testing.T) {
+	dir := t.TempDir()
+	require.NoError(t, os.MkdirAll(filepath.Join(dir, "src"), 0o700))
+	cfg := "experiment_name: overwrite\ncommand: python train.py\n" +
+		"compute: {accelerator_type: GPU_1xH100, num_accelerators: 1}\n" +
+		"code_source:\n  type: snapshot\n  snapshot:\n    root_path: ./src\n"
+	path := filepath.Join(dir, "run.yaml")
+	require.NoError(t, os.WriteFile(path, []byte(cfg), 0o600))
+	loaded, err := loadRunConfig(path)
+	require.NoError(t, err)
+
+	_, err = writeBundle(t.Context(), loaded, path, dir, false)
+	require.NoError(t, err)
+
+	// A hand edit must survive a refused re-run.
+	edited := []byte("# hand-edited\n")
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "databricks.yml"), edited, 0o600))
+
+	_, err = writeBundle(t.Context(), loaded, path, dir, false)
+	require.ErrorContains(t, err, "pass --force to overwrite")
+	kept, err := os.ReadFile(filepath.Join(dir, "databricks.yml"))
+	require.NoError(t, err)
+	assert.Equal(t, edited, kept)
+
+	// With --force the generated bundle replaces it.
+	_, err = writeBundle(t.Context(), loaded, path, dir, true)
+	require.NoError(t, err)
+	regenerated, err := os.ReadFile(filepath.Join(dir, "databricks.yml"))
+	require.NoError(t, err)
+	assert.NotEqual(t, edited, regenerated)
+	assert.Contains(t, string(regenerated), "ai_runtime_task")
+}
+
+// command.sh is the user's command copied verbatim — convert injects no cd. The
+// launcher exports $CODE_SOURCE_PATH and runs the command in the launch dir without
+// cd-ing, so (as under air run) the command owns its own cd; convert must not add one,
+// which would make it more lenient than air run.
+func TestConvertToDabsCommandVerbatim(t *testing.T) {
+	cfg := minimalConfig + `
+code_source:
+  type: snapshot
+  snapshot:
+    root_path: ./src
+`
+	path := writeConfigFile(t, "run.yaml", cfg)
+	require.NoError(t, os.MkdirAll(filepath.Join(filepath.Dir(path), "src"), 0o700))
+	loaded, err := loadRunConfig(path)
+	require.NoError(t, err)
+
+	_, artifacts, err := convertToDabs(t.Context(), loaded, path, filepath.Dir(path))
+	require.NoError(t, err)
+
+	var cmd string
+	for _, it := range artifacts {
+		if it.name == commandScriptName {
+			cmd = string(it.data)
+		}
+	}
+	assert.Equal(t, "python train.py", cmd, "command.sh must be the verbatim command, no injected cd")
+	assert.NotContains(t, cmd, "cd /databricks/code_source")
+}
+
+func TestConvertToDabsCommandShape(t *testing.T) {
+	cmd := newConvertToDabsCommand()
+	assert.Equal(t, "convert-to-dabs <yaml_path>", cmd.Use)
+	assert.Empty(t, cmd.Commands(), "convert-to-dabs must not register subcommands")
+	// Exactly one positional (the YAML path).
+	assert.NoError(t, cmd.Args(cmd, []string{"run.yaml"}))
+	assert.Error(t, cmd.Args(cmd, []string{}))
+	assert.Error(t, cmd.Args(cmd, []string{"a", "b"}))
+}
+
+// get is a small helper: read a dotted path out of the emitted bundle root.
+func get(t *testing.T, root map[string]dyn.Value, path string) dyn.Value {
+	t.Helper()
+	v, err := dyn.GetByPath(dyn.V(root), dyn.MustPathFromString(path))
+	require.NoError(t, err, "path %q should exist", path)
+	return v
+}
+
+func has(root map[string]dyn.Value, path string) bool {
+	_, err := dyn.GetByPath(dyn.V(root), dyn.MustPathFromString(path))
+	return err == nil
+}
+
+// A full config maps onto a schema-shaped bundle: bundle name, job/task keys, the
+// ai_runtime_task (experiment + single deployment + code_source_path), framework
+// fields on the task wrapper, and the environment spec.
+func TestConvertToDabsFullMapping(t *testing.T) {
+	cfg := `
+experiment_name: my-run
+command: python train.py
+compute:
+  accelerator_type: GPU_1xH100
+  num_accelerators: 1
+  pool_id: capacity-1
+max_retries: 2
+timeout_minutes: 30
+mlflow_run_name: run-42
+mlflow_artifact_location: dbfs:/Volumes/main/default/artifacts
+code_source:
+  type: snapshot
+  snapshot:
+    root_path: ./src
+environment:
+  version: 5
+  dependencies:
+    - numpy
+    - torch
+`
+	path := writeConfigFile(t, "run.yaml", cfg)
+	require.NoError(t, os.MkdirAll(filepath.Join(filepath.Dir(path), "src"), 0o700))
+	loaded, err := loadRunConfig(path)
+	require.NoError(t, err)
+
+	root, artifacts, err := convertToDabs(t.Context(), loaded, path, filepath.Dir(path))
+	require.NoError(t, err)
+
+	name := loaded.ExperimentName
+	assert.Equal(t, name, get(t, root, "bundle.name").MustString())
+	assert.Equal(t, "development", get(t, root, "targets.dev.mode").MustString())
+
+	jobPath := "resources.jobs." + name
+	assert.Equal(t, name, get(t, root, jobPath+".name").MustString())
+
+	task := jobPath + ".tasks[0]"
+	assert.Equal(t, name, get(t, root, task+".task_key").MustString())
+	// Framework fields live on the task wrapper, not in ai_runtime_task.
+	assert.Equal(t, int64(2), get(t, root, task+".max_retries").MustInt())
+	assert.True(t, get(t, root, task+".retry_on_timeout").MustBool())
+	assert.Equal(t, int64(1800), get(t, root, task+".timeout_seconds").MustInt())
+	assert.False(t, has(root, task+".ai_runtime_task.max_retries"), "retries must not be inside ai_runtime_task")
+
+	art := task + ".ai_runtime_task"
+	assert.Equal(t, name, get(t, root, art+".experiment").MustString())
+	assert.Equal(t, "run-42", get(t, root, art+".mlflow_run").MustString())
+	assert.Equal(t, "dbfs:/Volumes/main/default/artifacts", get(t, root, art+".mlflow_artifact_location").MustString())
+	// code_source is packaged as a `tgz` artifact; code_source_path points at the
+	// built tarball, and the artifact packs the code dir (path = its parent, include =
+	// its basename, so entries nest under "src/").
+	assert.Equal(t, "./dist/code_source.tgz", get(t, root, art+".code_source_path").MustString())
+	codeArt := "artifacts." + codeSourceArtifactKey
+	assert.Equal(t, "tgz", get(t, root, codeArt+".type").MustString())
+	assert.Equal(t, ".", get(t, root, codeArt+".path").MustString())
+	codeInc := get(t, root, codeArt+".include").MustSequence()
+	require.Len(t, codeInc, 1)
+	assert.Equal(t, "src", codeInc[0].MustString())
+	assert.Equal(t, "./dist/code_source.tgz", get(t, root, codeArt+".files[0].source").MustString())
+
+	dep := art + ".deployments[0]"
+	assert.Equal(t, "./"+generatedArtifactsDir+"/"+commandScriptName, get(t, root, dep+".command_path").MustString())
+	assert.Equal(t, "GPU_1xH100", get(t, root, dep+".compute.accelerator_type").MustString())
+	assert.Equal(t, int64(1), get(t, root, dep+".compute.accelerator_count").MustInt())
+	assert.Equal(t, "capacity-1", get(t, root, dep+".compute.provisioned_capacity_id").MustString())
+
+	env := jobPath + ".environments[0]"
+	assert.Equal(t, "default", get(t, root, env+".environment_key").MustString())
+	assert.Equal(t, "5", get(t, root, env+".spec.environment_version").MustString())
+	deps := get(t, root, env+".spec.dependencies").MustSequence()
+	require.Len(t, deps, 2)
+	assert.Equal(t, "numpy", deps[0].MustString())
+
+	// command.sh and training_config.yaml are always artifacts; the Jobs run-output
+	// page derives the latter's path from command_path. requirements.yaml is not
+	// emitted — deps ride on the environments[] spec asserted above.
+	assert.Contains(t, itemNames(artifacts), commandScriptName)
+	assert.Contains(t, itemNames(artifacts), trainingConfigName)
+	assert.NotContains(t, itemNames(artifacts), "requirements.yaml")
+}
+
+func TestConvertToDabsPreservesPoolPriorityAndUnityCatalogImage(t *testing.T) {
+	for _, tc := range []struct {
+		name          string
+		poolID        string
+		priorityClass string
+		imagePath     string
+	}{
+		{name: "unset"},
+		{name: "pool", poolID: "capacity-1"},
+		{name: "pool-priority", poolID: "capacity-1", priorityClass: "CRITICAL"},
+		{name: "image", imagePath: "main.air.training:prod"},
+		{name: "pool-image", poolID: "capacity-1", imagePath: "main.air.training:prod"},
+		{name: "pool-priority-image", poolID: "capacity-1", priorityClass: "CRITICAL", imagePath: "main.air.training:prod"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			cfg := minimalConfig
+			var computeOptions string
+			if tc.poolID != "" {
+				computeOptions += "  pool_id: " + tc.poolID + "\n"
+			}
+			if tc.priorityClass != "" {
+				computeOptions += "  priority_class: " + tc.priorityClass + "\n"
+			}
+			cfg = strings.Replace(cfg, "  num_accelerators: 1\n", "  num_accelerators: 1\n"+computeOptions, 1)
+			if tc.imagePath != "" {
+				cfg += "environment:\n  unity_catalog_image: " + tc.imagePath + "\n"
+			}
+			path := writeConfigFile(t, "run.yaml", cfg)
+			loaded, err := loadRunConfig(path)
+			require.NoError(t, err)
+
+			root, _, err := convertToDabs(t.Context(), loaded, path, filepath.Dir(path))
+			require.NoError(t, err)
+
+			aiRuntimeTask := "resources.jobs." + loaded.ExperimentName + ".tasks[0].ai_runtime_task"
+			compute := aiRuntimeTask + ".deployments[0].compute"
+			if tc.poolID == "" {
+				assert.False(t, has(root, compute+".provisioned_capacity_id"))
+			} else {
+				assert.Equal(t, tc.poolID, get(t, root, compute+".provisioned_capacity_id").MustString())
+			}
+			if tc.priorityClass == "" {
+				assert.False(t, has(root, aiRuntimeTask+".priority_class"))
+			} else {
+				assert.Equal(t, tc.priorityClass, get(t, root, aiRuntimeTask+".priority_class").MustString())
+			}
+			if tc.imagePath == "" {
+				assert.False(t, has(root, aiRuntimeTask+".unity_catalog_image_path"))
+			} else {
+				assert.Equal(t, tc.imagePath, get(t, root, aiRuntimeTask+".unity_catalog_image_path").MustString())
+			}
+		})
+	}
+}
+
+// Optional fields are omitted rather than emitted empty: no code_source means no
+// code_source_path, and an unset timeout means no timeout_seconds.
+// sync.paths lists only the generated-artifacts dir. The code directory must be
+// absent: the `tgz` artifact packages it, so syncing it as loose files too would
+// upload the whole tree a second time.
+func TestConvertToDabsSyncPathsExcludesCodeDir(t *testing.T) {
+	cfg := minimalConfig + `
+code_source:
+  type: snapshot
+  snapshot:
+    root_path: ./src
+`
+	path := writeConfigFile(t, "run.yaml", cfg)
+	require.NoError(t, os.MkdirAll(filepath.Join(filepath.Dir(path), "src"), 0o700))
+	loaded, err := loadRunConfig(path)
+	require.NoError(t, err)
+
+	root, _, err := convertToDabs(t.Context(), loaded, path, filepath.Dir(path))
+	require.NoError(t, err)
+
+	paths := get(t, root, "sync.paths").MustSequence()
+	require.Len(t, paths, 1)
+	assert.Equal(t, generatedArtifactsDir, paths[0].MustString())
+
+	// The task points at the built `tgz` artifact; the code dir is packaged through the
+	// artifact path, so the sync set omits it.
+	task := "resources.jobs." + loaded.ExperimentName + ".tasks[0].ai_runtime_task"
+	assert.Equal(t, "./dist/code_source.tgz", get(t, root, task+".code_source_path").MustString())
+}
+
+func TestConvertToDabsOmitsUnsetFields(t *testing.T) {
+	path := writeConfigFile(t, "run.yaml", minimalConfig)
+	loaded, err := loadRunConfig(path)
+	require.NoError(t, err)
+
+	root, _, err := convertToDabs(t.Context(), loaded, path, filepath.Dir(path))
+	require.NoError(t, err)
+
+	name := loaded.ExperimentName
+	task := "resources.jobs." + name + ".tasks[0]"
+	// max_retries is always emitted: `air run` fills its own default when unset, so
+	// omitting it would silently give the bundle the Jobs default instead.
+	assert.Equal(t, int64(defaultMaxRetries), get(t, root, task+".max_retries").MustInt())
+	assert.True(t, get(t, root, task+".retry_on_timeout").MustBool())
+	assert.False(t, has(root, task+".timeout_seconds"))
+	assert.False(t, has(root, task+".ai_runtime_task.code_source_path"))
+	assert.False(t, has(root, task+".ai_runtime_task.mlflow_run"))
+	// The command still needs a home even without code_source.
+	assert.Equal(t, "./"+generatedArtifactsDir+"/"+commandScriptName, get(t, root, task+".ai_runtime_task.deployments[0].command_path").MustString())
+
+	// Even with no environment block, the default runtime version is pinned (what
+	// `air run` would have used) rather than emitting an empty environment spec.
+	env := "resources.jobs." + name + ".environments[0]"
+	assert.Equal(t, "6", get(t, root, env+".spec.environment_version").MustString())
+	assert.False(t, has(root, env+".spec.dependencies"))
+}
+
+func TestConvertToDabsDisablesTimeoutRetriesWhenRetriesAreDisabled(t *testing.T) {
+	path := writeConfigFile(t, "run.yaml", minimalConfig+"max_retries: 0\n")
+	loaded, err := loadRunConfig(path)
+	require.NoError(t, err)
+
+	root, _, err := convertToDabs(t.Context(), loaded, path, filepath.Dir(path))
+	require.NoError(t, err)
+
+	task := "resources.jobs." + loaded.ExperimentName + ".tasks[0]"
+	assert.Equal(t, int64(0), get(t, root, task+".max_retries").MustInt())
+	assert.False(t, get(t, root, task+".retry_on_timeout").MustBool())
+}
+
+// A DATABRICKS_DL_RUNTIME_IMAGE env override flows through the same resolution
+// `air run` uses, so a converted bundle pins the same version.
+func TestConvertToDabsRuntimeVersionEnvOverride(t *testing.T) {
+	t.Setenv(dlRuntimeImageEnv, "CLIENT-GPU-7")
+	path := writeConfigFile(t, "run.yaml", minimalConfig)
+	loaded, err := loadRunConfig(path)
+	require.NoError(t, err)
+
+	root, _, err := convertToDabs(t.Context(), loaded, path, filepath.Dir(path))
+	require.NoError(t, err)
+
+	env := "resources.jobs." + loaded.ExperimentName + ".environments[0]"
+	assert.Equal(t, "7", get(t, root, env+".spec.environment_version").MustString())
+}
+
+func TestConvertToDabsSupportsB300(t *testing.T) {
+	path := writeConfigFile(t, "run.yaml", `
+experiment_name: b300
+command: python train.py
+compute:
+  accelerator_type: GPU_8xB300
+  num_accelerators: 16
+environment:
+  version: 6
+  dependencies: []
+`)
+	loaded, err := loadRunConfig(path)
+	require.NoError(t, err)
+
+	root, _, err := convertToDabs(t.Context(), loaded, path, filepath.Dir(path))
+	require.NoError(t, err)
+
+	deployment := "resources.jobs.b300.tasks[0].ai_runtime_task.deployments[0]"
+	assert.Equal(t, "GPU_8xB300", get(t, root, deployment+".compute.accelerator_type").MustString())
+	assert.Equal(t, int64(16), get(t, root, deployment+".compute.accelerator_count").MustInt())
+	assert.Equal(t, "6", get(t, root, "resources.jobs.b300.environments[0].spec.environment_version").MustString())
+}
+
+func TestConvertToDabsDatabricksAIEnvironment(t *testing.T) {
+	path := writeConfigFile(t, "run.yaml", minimalConfig+"\nenvironment:\n  version: databricks_ai_v5\n")
+	loaded, err := loadRunConfig(path)
+	require.NoError(t, err)
+
+	root, _, err := convertToDabs(t.Context(), loaded, path, filepath.Dir(path))
+	require.NoError(t, err)
+
+	spec := "resources.jobs." + loaded.ExperimentName + ".environments[0].spec."
+	assert.Equal(t, "workspace-base-environments/databricks_ai_v5", get(t, root, spec+"base_environment").MustString())
+	assert.False(t, has(root, spec+"environment_version"))
+}
+
+// remote_volume can't be honored by a converted bundle (bundle deploy owns the
+// artifact upload location), so it is rejected rather than silently ignored.
+func TestConvertToDabsRejectsRemoteVolume(t *testing.T) {
+	cfg := minimalConfig + `
+code_source:
+  type: snapshot
+  snapshot:
+    root_path: ./src
+    remote_volume: /Volumes/main/default/code
+`
+	path := writeConfigFile(t, "run.yaml", cfg)
+	loaded, err := loadRunConfig(path)
+	require.NoError(t, err)
+	_, _, err = convertToDabs(t.Context(), loaded, path, filepath.Dir(path))
+	require.ErrorContains(t, err, "remote_volume in code_source is not supported")
+}
+
+// env_variables / secrets / parameters ride as sidecar files (the ai_runtime_task
+// proto has no inline fields for them), matching the CLI's own launch layout.
+func TestConvertToDabsStagesEnvAndSecretSidecars(t *testing.T) {
+	cfg := minimalConfig + `
+env_variables:
+  FOO: bar
+secrets:
+  TOKEN: scope/key
+parameters:
+  lr: 0.1
+`
+	path := writeConfigFile(t, "run.yaml", cfg)
+	loaded, err := loadRunConfig(path)
+	require.NoError(t, err)
+
+	root, artifacts, err := convertToDabs(t.Context(), loaded, path, filepath.Dir(path))
+	require.NoError(t, err)
+
+	names := itemNames(artifacts)
+	assert.Contains(t, names, envVarsName)
+	assert.Contains(t, names, secretEnvVarsName)
+	assert.Contains(t, names, hyperparametersName)
+
+	// They are NOT smuggled into ai_runtime_task (which would fail bundle validate).
+	name := loaded.ExperimentName
+	art := "resources.jobs." + name + ".tasks[0].ai_runtime_task"
+	assert.False(t, has(root, art+".env_variables"))
+	assert.False(t, has(root, art+".secrets"))
+}
+
+// code_source_path points at the built `tgz` artifact and no code is copied — the
+// artifact snapshotter packages the source dir at deploy. writeBundle produces only
+// databricks.yml + launch artifacts, not a code_source copy.
+func TestConvertToDabsDoesNotCopyCode(t *testing.T) {
+	dir := t.TempDir()
+	require.NoError(t, os.MkdirAll(filepath.Join(dir, "src"), 0o700))
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "src", "train.py"), []byte("print()\n"), 0o600))
+
+	cfg := "experiment_name: wt\ncommand: cd \"$CODE_SOURCE_PATH\" && python train.py\n" +
+		"compute: {accelerator_type: GPU_1xH100, num_accelerators: 1}\n" +
+		"code_source:\n  type: snapshot\n  snapshot:\n    root_path: ./src\n"
+	path := filepath.Join(dir, "run.yaml")
+	require.NoError(t, os.WriteFile(path, []byte(cfg), 0o600))
+	loaded, err := loadRunConfig(path)
+	require.NoError(t, err)
+
+	written, err := writeBundle(t.Context(), loaded, path, dir, false)
+	require.NoError(t, err)
+
+	// code_source_path points at the built tarball; nothing is copied.
+	root, _, err := convertToDabs(t.Context(), loaded, path, dir)
+	require.NoError(t, err)
+	art := "resources.jobs." + loaded.ExperimentName + ".tasks[0].ai_runtime_task"
+	assert.Equal(t, "./dist/code_source.tgz", get(t, root, art+".code_source_path").MustString())
+	assert.NotContains(t, written, "code_source/")
+}
+
+// A code_source root_path outside the bundle directory is rejected: the mutator only
+// packages a directory inside the bundle sync root.
+func TestConvertToDabsRejectsCodeOutsideBundle(t *testing.T) {
+	outside := t.TempDir()
+	require.NoError(t, os.MkdirAll(filepath.Join(outside, "src"), 0o700))
+
+	cfg := "experiment_name: outside\ncommand: python train.py\n" +
+		"compute: {accelerator_type: GPU_1xH100, num_accelerators: 1}\n" +
+		"code_source:\n  type: snapshot\n  snapshot:\n    root_path: " + filepath.Join(outside, "src") + "\n"
+	path := writeConfigFile(t, "run.yaml", cfg)
+	loaded, err := loadRunConfig(path)
+	require.NoError(t, err)
+
+	// Bundle dir is the config's temp dir; the source is in a different tree.
+	_, _, err = convertToDabs(t.Context(), loaded, path, filepath.Dir(path))
+	require.ErrorContains(t, err, "not inside the bundle")
+}
+
+// A git-pinned code_source is emitted as a `tgz` artifact (the DABs artifact
+// snapshotter): DABs builds the tarball from the ref at deploy and code_source_path
+// points at it.
+func TestConvertToDabsGitPinEmitsArtifact(t *testing.T) {
+	dir := t.TempDir()
+	require.NoError(t, os.MkdirAll(filepath.Join(dir, "src"), 0o700))
+	cfg := "experiment_name: gitpin\ncommand: python train.py\n" +
+		"compute: {accelerator_type: GPU_1xH100, num_accelerators: 1}\n" +
+		"code_source:\n  type: snapshot\n  snapshot:\n    root_path: ./src\n    git:\n      commit: abc123\n"
+	path := filepath.Join(dir, "run.yaml")
+	require.NoError(t, os.WriteFile(path, []byte(cfg), 0o600))
+	loaded, err := loadRunConfig(path)
+	require.NoError(t, err)
+
+	root, _, err := convertToDabs(t.Context(), loaded, path, dir)
+	require.NoError(t, err)
+
+	a := "artifacts." + codeSourceArtifactKey
+	assert.Equal(t, "tgz", get(t, root, a+".type").MustString())
+	// path is the code dir's parent; include is the basename, so archive entries are
+	// "src/..." (the layout the runtime extracts to /databricks/code_source/src).
+	assert.Equal(t, ".", get(t, root, a+".path").MustString())
+	assert.Equal(t, "abc123", get(t, root, a+".git.commit").MustString())
+	inc := get(t, root, a+".include").MustSequence()
+	require.Len(t, inc, 1)
+	assert.Equal(t, "src", inc[0].MustString())
+	assert.Equal(t, "./dist/code_source.tgz", get(t, root, a+".files[0].source").MustString())
+
+	task := "resources.jobs." + loaded.ExperimentName + ".tasks[0].ai_runtime_task"
+	assert.Equal(t, "./dist/code_source.tgz", get(t, root, task+".code_source_path").MustString())
+}
+
+// A requirements-FILE dependency set (environment.dependencies is a path) is folded
+// into the environments[] spec, which the runtime installs deps from directly.
+// Convert emits no requirements.yaml artifact of its own.
+// usage_policy_id is a resolved budget policy id and maps to the job's
+// budget_policy_id (usage_policy_name, which needs resolution, is rejected).
+func TestConvertToDabsMapsUsagePolicyID(t *testing.T) {
+	cfg := minimalConfig + "usage_policy_id: 12345678-90ab-cdef-1234-567890abcdef\n"
+	path := writeConfigFile(t, "run.yaml", cfg)
+	loaded, err := loadRunConfig(path)
+	require.NoError(t, err)
+
+	root, _, err := convertToDabs(t.Context(), loaded, path, filepath.Dir(path))
+	require.NoError(t, err)
+	assert.Equal(t, "12345678-90ab-cdef-1234-567890abcdef", get(t, root, "resources.jobs."+loaded.ExperimentName+".budget_policy_id").MustString())
+}
+
+func TestConvertToDabsMapsPermissions(t *testing.T) {
+	cfg := minimalConfig + `
+permissions:
+  - user_name: alice@example.com
+    level: CAN_MANAGE
+  - group_name: eng
+    level: CAN_VIEW
+`
+	path := writeConfigFile(t, "run.yaml", cfg)
+	loaded, err := loadRunConfig(path)
+	require.NoError(t, err)
+
+	root, _, err := convertToDabs(t.Context(), loaded, path, filepath.Dir(path))
+	require.NoError(t, err)
+
+	perms := get(t, root, "resources.jobs."+loaded.ExperimentName+".permissions").MustSequence()
+	require.Len(t, perms, 2)
+	assert.Equal(t, "CAN_MANAGE", perms[0].Get("level").MustString())
+	assert.Equal(t, "alice@example.com", perms[0].Get("user_name").MustString())
+	assert.Equal(t, "eng", perms[1].Get("group_name").MustString())
+}
+
+// The job resource key is the experiment name as-is. A name that YAML would type
+// as a non-string scalar ("12345" -> !!int, "true" -> !!bool) must be emitted
+// quoted, or the bundle loader rejects the key with "invalid key tag".
+func TestConvertToDabsSafeJobKey(t *testing.T) {
+	for _, name := range []string{"12345", "1.5e3", "true", "null", "my-run_1"} {
+		assert.Equal(t, name, bundleResourceKey(name), "key for %q", name)
+	}
+
+	for _, name := range []string{"12345", "true", "my-run_1"} {
+		t.Run(name, func(t *testing.T) {
+			dir := t.TempDir()
+			cfg := "experiment_name: \"" + name + "\"\ncommand: python t.py\n" +
+				"compute: {accelerator_type: GPU_1xH100, num_accelerators: 1}\n"
+			path := filepath.Join(dir, "run.yaml")
+			require.NoError(t, os.WriteFile(path, []byte(cfg), 0o600))
+			loaded, err := loadRunConfig(path)
+			require.NoError(t, err)
+
+			root, _, err := convertToDabs(t.Context(), loaded, path, dir)
+			require.NoError(t, err)
+			// The key is the raw name; name/experiment keep the same value.
+			jobs, err := dyn.GetByPath(dyn.V(root), dyn.MustPathFromString("resources.jobs"))
+			require.NoError(t, err)
+			job := jobs.Get(name)
+			require.True(t, job.IsValid(), "job must be keyed by %q", name)
+			assert.Equal(t, name, job.Get("name").MustString())
+
+			// The emitted YAML must load back with the key still a string.
+			_, err = writeBundle(t.Context(), loaded, path, dir, true)
+			require.NoError(t, err)
+			emitted, err := os.ReadFile(filepath.Join(dir, "databricks.yml"))
+			require.NoError(t, err)
+			var doc struct {
+				Resources struct {
+					Jobs map[string]struct {
+						Name string `yaml:"name"`
+					} `yaml:"jobs"`
+				} `yaml:"resources"`
+			}
+			require.NoError(t, yaml.Unmarshal(emitted, &doc), "emitted YAML must parse:\n%s", emitted)
+			require.Contains(t, doc.Resources.Jobs, name, "job key must load as the string %q:\n%s", name, emitted)
+		})
+	}
+}
+
+// include_paths narrows the archive to a subset of root_path: emitted as the `tgz`
+// artifact's include (relative to the code-source root), matching air CLI semantics.
+func TestConvertToDabsIncludePathsEmitsArtifact(t *testing.T) {
+	dir := t.TempDir()
+	require.NoError(t, os.MkdirAll(filepath.Join(dir, "src"), 0o700))
+	cfg := "experiment_name: inc\ncommand: python train.py\n" +
+		"compute: {accelerator_type: GPU_1xH100, num_accelerators: 1}\n" +
+		"code_source:\n  type: snapshot\n  snapshot:\n    root_path: ./src\n" +
+		"    include_paths:\n      - keep\n"
+	path := filepath.Join(dir, "run.yaml")
+	require.NoError(t, os.WriteFile(path, []byte(cfg), 0o600))
+	loaded, err := loadRunConfig(path)
+	require.NoError(t, err)
+
+	root, _, err := convertToDabs(t.Context(), loaded, path, dir)
+	require.NoError(t, err)
+
+	a := "artifacts." + codeSourceArtifactKey
+	assert.Equal(t, "tgz", get(t, root, a+".type").MustString())
+	// path is the code dir's parent; include_paths are basename-prefixed, so the
+	// entry is "src/keep" (relative to the bundle root, path ".").
+	assert.Equal(t, ".", get(t, root, a+".path").MustString())
+	inc := get(t, root, a+".include").MustSequence()
+	require.Len(t, inc, 1)
+	assert.Equal(t, "src/keep", inc[0].MustString())
+
+	task := "resources.jobs." + loaded.ExperimentName + ".tasks[0].ai_runtime_task"
+	assert.Equal(t, "./dist/code_source.tgz", get(t, root, task+".code_source_path").MustString())
+}
+
+// include_paths pointing at directories (the primary use case, not single files):
+// each entry is basename-prefixed the same way, so a subdirectory `pkg` under a
+// `./src` root becomes `src/pkg`. Convert is a syntactic mapping — whether the entry
+// names a directory or a file is identical here; the tgz builder (#6428) walks a
+// directory entry recursively at deploy.
+func TestConvertToDabsIncludePathsDirectories(t *testing.T) {
+	dir := t.TempDir()
+	require.NoError(t, os.MkdirAll(filepath.Join(dir, "src", "pkg"), 0o700))
+	require.NoError(t, os.MkdirAll(filepath.Join(dir, "src", "config"), 0o700))
+	cfg := "experiment_name: incdir\ncommand: python train.py\n" +
+		"compute: {accelerator_type: GPU_1xH100, num_accelerators: 1}\n" +
+		"code_source:\n  type: snapshot\n  snapshot:\n    root_path: ./src\n" +
+		"    include_paths:\n      - pkg\n      - config\n"
+	path := filepath.Join(dir, "run.yaml")
+	require.NoError(t, os.WriteFile(path, []byte(cfg), 0o600))
+	loaded, err := loadRunConfig(path)
+	require.NoError(t, err)
+
+	root, _, err := convertToDabs(t.Context(), loaded, path, dir)
+	require.NoError(t, err)
+
+	a := "artifacts." + codeSourceArtifactKey
+	assert.Equal(t, ".", get(t, root, a+".path").MustString())
+	inc := get(t, root, a+".include").MustSequence()
+	require.Len(t, inc, 2)
+	assert.Equal(t, "src/pkg", inc[0].MustString())
+	assert.Equal(t, "src/config", inc[1].MustString())
+}
+
+// root_path "." (the code source is the whole bundle directory) has no basename to
+// nest the archive under, and an include rooted at "." would sweep the bundle's own
+// generated files into the tarball — so a git/include snapshot there is rejected with
+// a message pointing at a subdirectory. (A plain snapshot with root_path "." is not an
+// artifact case and is unaffected.)
+func TestConvertToDabsDotRootPathRejected(t *testing.T) {
+	for _, tc := range []struct{ name, snap string }{
+		{"git", "code_source:\n  type: snapshot\n  snapshot:\n    root_path: .\n    git:\n      commit: abc123\n"},
+		{"include", "code_source:\n  type: snapshot\n  snapshot:\n    root_path: .\n    include_paths:\n      - foo\n"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			dir := t.TempDir()
+			require.NoError(t, os.MkdirAll(filepath.Join(dir, "foo"), 0o700))
+			cfg := "experiment_name: dot\ncommand: python train.py\n" +
+				"compute: {accelerator_type: GPU_1xA10, num_accelerators: 1}\n" + tc.snap
+			path := filepath.Join(dir, "run.yaml")
+			require.NoError(t, os.WriteFile(path, []byte(cfg), 0o600))
+			loaded, err := loadRunConfig(path)
+			require.NoError(t, err)
+
+			_, _, err = convertToDabs(t.Context(), loaded, path, dir)
+			require.ErrorContains(t, err, "resolves to the bundle root")
+		})
+	}
+}
+
+func TestConvertToDabsRejectsUnsupported(t *testing.T) {
+	t.Run("usage_policy_name", func(t *testing.T) {
+		cfg := minimalConfig + "usage_policy_name: my-policy\n"
+		path := writeConfigFile(t, "run.yaml", cfg)
+		loaded, err := loadRunConfig(path)
+		require.NoError(t, err)
+		_, _, err = convertToDabs(t.Context(), loaded, path, filepath.Dir(path))
+		require.ErrorContains(t, err, "usage_policy_name is not yet supported")
+	})
+}
diff --git a/cmd/air/eta.go b/cmd/air/eta.go
new file mode 100644
index 00000000000..dab5b5df762
--- /dev/null
+++ b/cmd/air/eta.go
@@ -0,0 +1,239 @@
+package aircmd
+
+import (
+	"cmp"
+	"context"
+	"fmt"
+	"math"
+	"slices"
+	"strconv"
+	"strings"
+
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/service/ml"
+)
+
+// trainingETA is a best-effort estimate of how far a running training job has
+// progressed and how much wall-clock time remains.
+//
+// The interface is a plain MLflow logging contract, not a specific framework: a
+// run becomes estimable once it has logged, to its MLflow run,
+//   - a total — the `max_steps` param (> 0), or else the `num_train_epochs` param
+//     (> 0); and
+//   - progress over time — an `epoch` metric logged repeatedly, each point carrying
+//     the current global step as its MLflow `step` and the fractional epoch as its
+//     value.
+//
+// HuggingFace Trainer (report_to=["mlflow"]) emits exactly this automatically, but
+// nothing here is HF-specific: any logger — Composer, a manual training loop —
+// gets a Progress readout by logging the same keys. AIR itself logs only system
+// metrics, which are a heartbeat rather than training progress, so a run that logs
+// no total shows nothing rather than a misleading estimate.
+type trainingETA struct {
+	// RemainingSeconds is the projected time to completion.
+	RemainingSeconds int64
+	// PercentComplete is progress through the run, 0-99 (never 100 while running).
+	PercentComplete int
+}
+
+// etaProgressMetric is the MLflow metric that drives the estimate. Each point
+// carries the fractional epoch as its value and the global step as its MLflow
+// step, so a single metric history serves both the step- and epoch-based paths.
+const etaProgressMetric = "epoch"
+
+// etaWindowPoints bounds how many trailing history points feed the rate, so the
+// estimate tracks recent throughput rather than a warmup-skewed whole-run average.
+const etaWindowPoints = 10
+
+// minStepsForETA withholds an estimate until enough steps have elapsed that
+// throughput has settled; the first few steps (compile, dataloader warmup) are
+// not representative.
+const minStepsForETA = 10
+
+// detailed renders the Progress cell for the single-run view: "45% · ~2h 15m left".
+func (e *trainingETA) detailed() string {
+	return fmt.Sprintf("%d%% · ~%s left", e.PercentComplete, coarseDuration(e.RemainingSeconds))
+}
+
+// compact renders the Progress cell for the list table: "45% · ~2h 15m".
+func (e *trainingETA) compact() string {
+	return fmt.Sprintf("%d%% · ~%s", e.PercentComplete, coarseDuration(e.RemainingSeconds))
+}
+
+// coarseDuration renders seconds rounded to the nearest minute, dropping seconds:
+// 80 -> "1m", 8100 -> "2h 15m", under ~30s -> "<1m". A remaining-time estimate is
+// not precise to the second, so showing seconds would imply false precision.
+func coarseDuration(totalSeconds int64) string {
+	mins := int64(math.Round(float64(totalSeconds) / 60.0))
+	if mins <= 0 {
+		return "<1m"
+	}
+	hours, minutes := mins/60, mins%60
+	var parts []string
+	if hours > 0 {
+		parts = append(parts, fmt.Sprintf("%dh", hours))
+	}
+	if minutes > 0 {
+		parts = append(parts, fmt.Sprintf("%dm", minutes))
+	}
+	return strings.Join(parts, " ")
+}
+
+// estimateTrainingETA fetches a running run's MLflow params and progress-metric
+// history and projects progress + remaining time. It returns nil whenever an
+// estimate can't be made (no known total, too little history, still warming up, an
+// API error): Progress is a convenience, so any failure is logged and treated as
+// "no estimate" rather than failing the command.
+func estimateTrainingETA(ctx context.Context, w *databricks.WorkspaceClient, mlflowRunID string) *trainingETA {
+	if mlflowRunID == "" {
+		return nil
+	}
+
+	resp, err := w.Experiments.GetRun(ctx, ml.GetRunRequest{RunId: mlflowRunID})
+	if err != nil {
+		log.Debugf(ctx, "air: could not fetch MLflow run for progress estimate: %v", err)
+		return nil
+	}
+	if resp.Run == nil || resp.Run.Data == nil {
+		return nil
+	}
+
+	// The total is only present once the contract is met; skip the metric-history
+	// fetch entirely when it is absent, so a run we can't estimate costs one call.
+	params := paramMap(resp.Run.Data.Params)
+	if _, hasSteps := positiveInt(params["max_steps"]); !hasSteps {
+		if _, hasEpochs := positiveFloat(params["num_train_epochs"]); !hasEpochs {
+			return nil
+		}
+	}
+
+	history, err := w.Experiments.GetHistoryAll(ctx, ml.GetHistoryRequest{
+		RunId:     mlflowRunID,
+		MetricKey: etaProgressMetric,
+	})
+	if err != nil {
+		log.Debugf(ctx, "air: could not fetch %q metric history for progress estimate: %v", etaProgressMetric, err)
+		return nil
+	}
+	return computeETA(params, history)
+}
+
+// computeETA is the pure projection: given a run's params and the ascending
+// history of the progress metric, it returns the progress estimate, or nil when
+// it can't be computed. Split from estimateTrainingETA so it can be tested without
+// an API client.
+//
+// When max_steps is set (> 0) the run trains by step and it wins over
+// num_train_epochs, matching HuggingFace Trainer's own precedence.
+func computeETA(params map[string]string, history []ml.Metric) *trainingETA {
+	if len(history) < 2 {
+		return nil
+	}
+
+	// History should already be ordered by step; sort by timestamp defensively so
+	// the rate is measured over increasing wall-clock time.
+	points := append([]ml.Metric(nil), history...)
+	slices.SortStableFunc(points, func(a, b ml.Metric) int { return cmp.Compare(a.Timestamp, b.Timestamp) })
+	if len(points) > etaWindowPoints {
+		points = points[len(points)-etaWindowPoints:]
+	}
+	first, last := points[0], points[len(points)-1]
+
+	// Withhold an estimate during the first few steps while throughput settles.
+	if last.Step < minStepsForETA {
+		return nil
+	}
+
+	elapsedSec := float64(last.Timestamp-first.Timestamp) / 1000.0
+	if elapsedSec <= 0 {
+		return nil
+	}
+
+	if maxSteps, ok := positiveInt(params["max_steps"]); ok {
+		return stepETA(first, last, elapsedSec, maxSteps)
+	}
+	if totalEpochs, ok := positiveFloat(params["num_train_epochs"]); ok {
+		return epochETA(first, last, elapsedSec, totalEpochs)
+	}
+	return nil
+}
+
+// stepETA projects from the global step (the metric's MLflow step) against a known
+// max_steps.
+func stepETA(first, last ml.Metric, elapsedSec float64, maxSteps int64) *trainingETA {
+	current := last.Step
+	if current <= 0 || current >= maxSteps {
+		return nil
+	}
+	done := last.Step - first.Step
+	if done <= 0 {
+		return nil
+	}
+	perSec := float64(done) / elapsedSec
+	remaining := float64(maxSteps-current) / perSec
+	return &trainingETA{
+		RemainingSeconds: int64(math.Round(remaining)),
+		PercentComplete:  percentComplete(float64(current), float64(maxSteps)),
+	}
+}
+
+// epochETA projects from the fractional epoch (the metric's value) against a known
+// num_train_epochs.
+func epochETA(first, last ml.Metric, elapsedSec, totalEpochs float64) *trainingETA {
+	current := last.Value
+	if current <= 0 || current >= totalEpochs {
+		return nil
+	}
+	done := last.Value - first.Value
+	if done <= 0 {
+		return nil
+	}
+	perSec := done / elapsedSec
+	remaining := (totalEpochs - current) / perSec
+	return &trainingETA{
+		RemainingSeconds: int64(math.Round(remaining)),
+		PercentComplete:  percentComplete(current, totalEpochs),
+	}
+}
+
+// percentComplete is current/total as a whole percent, clamped to 0-99: a running
+// run is never shown as 100% complete.
+func percentComplete(current, total float64) int {
+	p := int(math.Round(current / total * 100))
+	if p < 0 {
+		return 0
+	}
+	if p > 99 {
+		return 99
+	}
+	return p
+}
+
+// paramMap indexes MLflow params by key.
+func paramMap(params []ml.Param) map[string]string {
+	m := make(map[string]string, len(params))
+	for _, p := range params {
+		m[p.Key] = p.Value
+	}
+	return m
+}
+
+// positiveInt parses s as an integer and reports it only when it is > 0. HF
+// Trainer logs max_steps=-1 when training by epochs, which this rejects.
+func positiveInt(s string) (int64, bool) {
+	n, err := strconv.ParseInt(s, 10, 64)
+	if err != nil || n <= 0 {
+		return 0, false
+	}
+	return n, true
+}
+
+// positiveFloat parses s as a float and reports it only when it is > 0.
+func positiveFloat(s string) (float64, bool) {
+	f, err := strconv.ParseFloat(s, 64)
+	if err != nil || f <= 0 {
+		return 0, false
+	}
+	return f, true
+}
diff --git a/cmd/air/eta_test.go b/cmd/air/eta_test.go
new file mode 100644
index 00000000000..061761cb975
--- /dev/null
+++ b/cmd/air/eta_test.go
@@ -0,0 +1,117 @@
+package aircmd
+
+import (
+	"testing"
+
+	"github.com/databricks/databricks-sdk-go/service/ml"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// metric builds one epoch-metric history point: fractional epoch as the value,
+// global step as the MLflow step, wall-clock as the timestamp (ms).
+func metric(tsMillis, step int64, epoch float64) ml.Metric {
+	return ml.Metric{Key: "epoch", Timestamp: tsMillis, Step: step, Value: epoch}
+}
+
+func TestComputeETA_StepMode(t *testing.T) {
+	// max_steps wins over num_train_epochs. 4000 steps in 100s => 40 steps/s;
+	// 5000 steps remain => 125s; 5000/10000 => 50%.
+	eta := computeETA(
+		map[string]string{"max_steps": "10000", "num_train_epochs": "3"},
+		[]ml.Metric{metric(0, 1000, 0.3), metric(100_000, 5000, 1.5)},
+	)
+	require.NotNil(t, eta)
+	assert.Equal(t, int64(125), eta.RemainingSeconds)
+	assert.Equal(t, 50, eta.PercentComplete)
+	assert.Equal(t, "50% · ~2m left", eta.detailed())
+	assert.Equal(t, "50% · ~2m", eta.compact())
+}
+
+func TestComputeETA_EpochMode(t *testing.T) {
+	// No usable max_steps (Trainer logs -1 when training by epochs), so the
+	// fractional epoch drives it: 1.0 epoch in 90s => 1.5 remain of 3 => 135s;
+	// 1.5/3 => 50%.
+	eta := computeETA(
+		map[string]string{"max_steps": "-1", "num_train_epochs": "3"},
+		[]ml.Metric{metric(0, 100, 0.5), metric(90_000, 900, 1.5)},
+	)
+	require.NotNil(t, eta)
+	assert.Equal(t, int64(135), eta.RemainingSeconds)
+	assert.Equal(t, 50, eta.PercentComplete)
+	assert.Equal(t, "50% · ~2m left", eta.detailed())
+}
+
+func TestComputeETA_UsesTrailingWindow(t *testing.T) {
+	// Early points are slow, recent points fast; the window should reflect the
+	// recent rate, not the whole-run average. Build 12 points; only the last
+	// etaWindowPoints (10) count.
+	var pts []ml.Metric
+	pts = append(pts, metric(0, 0, 0), metric(100_000, 10, 0.1))
+	for i := int64(1); i <= 10; i++ {
+		pts = append(pts, metric(100_000+i*10_000, 10+i*100, 0.1+float64(i)*0.1))
+	}
+	eta := computeETA(map[string]string{"max_steps": "2000"}, pts)
+	require.NotNil(t, eta)
+	// Windowed rate is 10 steps/s; current step 1010, so 990 remain => 99s.
+	assert.Equal(t, int64(99), eta.RemainingSeconds)
+	assert.Equal(t, 51, eta.PercentComplete) // 1010/2000 = 50.5 -> 51
+}
+
+func TestComputeETA_NoEstimate(t *testing.T) {
+	base := []ml.Metric{metric(0, 100, 0.3), metric(100_000, 5000, 1.5)}
+	cases := []struct {
+		name    string
+		params  map[string]string
+		history []ml.Metric
+	}{
+		{"no total param", map[string]string{}, base},
+		{"max_steps not positive", map[string]string{"max_steps": "-1"}, base},
+		{"num_train_epochs zero", map[string]string{"num_train_epochs": "0"}, base},
+		{"total param unparseable", map[string]string{"max_steps": "lots"}, base},
+		{"too few points", map[string]string{"max_steps": "10000"}, base[:1]},
+		{"still warming up", map[string]string{"max_steps": "10000"}, []ml.Metric{metric(0, 2, 0.01), metric(30_000, 8, 0.02)}},
+		{"no elapsed time", map[string]string{"max_steps": "10000"}, []ml.Metric{metric(500, 100, 0.3), metric(500, 5000, 1.5)}},
+		{"already at max steps", map[string]string{"max_steps": "5000"}, base},
+		{"epoch already complete", map[string]string{"num_train_epochs": "1.5"}, base},
+		{"step not advancing", map[string]string{"max_steps": "10000"}, []ml.Metric{metric(0, 5000, 1.5), metric(100_000, 5000, 1.5)}},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Nil(t, computeETA(tc.params, tc.history))
+		})
+	}
+}
+
+func TestComputeETA_PercentClampedBelow100(t *testing.T) {
+	// A run one step from done is still "running", so it never shows 100%.
+	eta := computeETA(
+		map[string]string{"max_steps": "1000"},
+		[]ml.Metric{metric(0, 900, 0.9), metric(10_000, 999, 0.999)},
+	)
+	require.NotNil(t, eta)
+	assert.Equal(t, 99, eta.PercentComplete)
+}
+
+func TestTrainingETADisplay(t *testing.T) {
+	eta := &trainingETA{RemainingSeconds: 2900, PercentComplete: 81}
+	assert.Equal(t, "81% · ~48m left", eta.detailed())
+	assert.Equal(t, "81% · ~48m", eta.compact())
+}
+
+func TestCoarseDuration(t *testing.T) {
+	cases := []struct {
+		seconds int64
+		want    string
+	}{
+		{0, "<1m"},
+		{20, "<1m"},
+		{80, "1m"},
+		{125, "2m"},
+		{3600, "1h"},
+		{8100, "2h 15m"},
+	}
+	for _, tc := range cases {
+		assert.Equal(t, tc.want, coarseDuration(tc.seconds))
+	}
+}
diff --git a/cmd/air/examples/multi-image-example.yaml b/cmd/air/examples/multi-image-example.yaml
new file mode 100644
index 00000000000..703fbe4390c
--- /dev/null
+++ b/cmd/air/examples/multi-image-example.yaml
@@ -0,0 +1,140 @@
+# Two-image end-to-end GRPO: TRL trains on rank 1 and uses TRL's vLLM server
+# on rank 0 for generations and model-weight synchronization. Build the images
+# from the two Dockerfiles in this directory, publish them to Unity Catalog,
+# and replace both image placeholders below before submitting this file.
+experiment_name: qwen_grpo_multi_image
+compute:
+  accelerator_type: GPU_1xA10
+  num_accelerators: 2
+max_retries: 0
+containers:
+  - name: inference
+    ranks: [0]
+    unity_catalog_image: your_catalog.your_schema.vllm_trl:0.24.0
+    environment_variables:
+      variables:
+        MODEL_ID: Qwen/Qwen2.5-0.5B-Instruct
+        HF_HOME: /local_disk0/huggingface
+    command: |
+      set -euo pipefail
+      unset MASTER_ADDR MASTER_PORT WORLD_SIZE RANK LOCAL_RANK LOCAL_WORLD_SIZE
+      unset NODE_RANK GROUP_RANK ROLE_RANK ROLE_WORLD_SIZE ROLE_NAME TORCHELASTIC_RUN_ID
+      trl vllm-serve --model "$MODEL_ID" --host 0.0.0.0 --port 8000 \
+        --tensor-parallel-size 1 --gpu-memory-utilization 0.6 --max-model-len 1024 \
+        --log-level warning &
+      SERVER_PID=$!
+      export SERVER_PID
+      python3 - <<'PY' &
+      import os
+      import signal
+      from http.server import BaseHTTPRequestHandler, HTTPServer
+      pid = int(os.environ["SERVER_PID"])
+      class Handler(BaseHTTPRequestHandler):
+          def do_POST(self):
+              if self.path != "/shutdown":
+                  self.send_error(404)
+                  return
+              os.kill(pid, signal.SIGTERM)
+              self.send_response(200)
+              self.end_headers()
+          def log_message(self, *_):
+              pass
+      HTTPServer(("0.0.0.0", 9000), Handler).serve_forever()
+      PY
+      SUPERVISOR_PID=$!
+      status=0
+      wait "$SERVER_PID" || status=$?
+      kill "$SUPERVISOR_PID" 2>/dev/null || true
+      if [ "$status" -ne 0 ] && [ "$status" -ne 143 ]; then exit "$status"; fi
+
+  - name: trainer
+    ranks: [1]
+    unity_catalog_image: your_catalog.your_schema.trl_vllm:0.24.0
+    environment_variables:
+      variables:
+        MODEL_ID: Qwen/Qwen2.5-0.5B-Instruct
+        HF_HOME: /local_disk0/huggingface
+    command: |-
+      set -euo pipefail
+      export VLLM_HOST="$MASTER_ADDR"
+      cleanup() {
+        python - <<'PY' || true
+      import os
+      import urllib.request
+      url = f'http://{os.environ["VLLM_HOST"]}:9000/shutdown'
+      urllib.request.urlopen(urllib.request.Request(url, method="POST"), timeout=10)
+      PY
+      }
+      trap cleanup EXIT
+
+      python - <<'PY'
+      import os
+      import time
+      import urllib.request
+      base = f'http://{os.environ["VLLM_HOST"]}:8000'
+      for attempt in range(120):
+          try:
+              with urllib.request.urlopen(base + "/health/", timeout=5) as response:
+                  if response.status == 200:
+                      break
+          except Exception:
+              time.sleep(5)
+      else:
+          raise RuntimeError("TRL vLLM server did not become ready within 10 minutes")
+      print("TRL vLLM server is reachable from trainer rank", flush=True)
+      PY
+
+      # Rank 0 serves generations. Only rank 1 participates in training.
+      unset MASTER_ADDR MASTER_PORT WORLD_SIZE RANK LOCAL_RANK LOCAL_WORLD_SIZE
+      unset NODE_RANK GROUP_RANK ROLE_RANK ROLE_WORLD_SIZE ROLE_NAME TORCHELASTIC_RUN_ID
+
+      python - <<'PY'
+      import os
+      import re
+      import trl
+      from datasets import Dataset
+      from trl import GRPOConfig, GRPOTrainer
+
+      problems = [(a, b) for a in range(11, 19) for b in (3, 7, 9, 13)]
+      dataset = Dataset.from_dict({
+          "prompt": [f"What is {a} + {b}? Reply with only the integer." for a, b in problems],
+          "answer": [str(a + b) for a, b in problems],
+      })
+      def arithmetic_reward(completions, answer, **_):
+          scores = []
+          for text, expected in zip(completions, answer):
+              numbers = re.findall(r"-?\d+", text)
+              if numbers:
+                  error = abs(int(numbers[-1]) - int(expected))
+                  scores.append(1.0 if error == 0 else 0.5 / (1.0 + error))
+              else:
+                  scores.append(0.0)
+          return scores
+
+      print(f"TRL {trl.__version__}; 32 examples; 5 epochs; vLLM server mode", flush=True)
+      args = GRPOConfig(
+          output_dir="/local_disk0/qwen-grpo-e2e-five-epochs",
+          num_train_epochs=5,
+          per_device_train_batch_size=2,
+          gradient_accumulation_steps=2,
+          learning_rate=5e-6,
+          num_generations=2,
+          max_prompt_length=64,
+          max_completion_length=32,
+          bf16=True,
+          gradient_checkpointing=False,
+          logging_steps=1,
+          save_strategy="no",
+          report_to="none",
+          use_vllm=True,
+          vllm_mode="server",
+          vllm_server_host=os.environ["VLLM_HOST"],
+          vllm_server_port=8000,
+          vllm_server_timeout=600.0,
+      )
+      trainer = GRPOTrainer(model=os.environ["MODEL_ID"], args=args,
+                            reward_funcs=arithmetic_reward, train_dataset=dataset)
+      trainer.train()
+      trainer.save_model()
+      print("End-to-end GRPO completed: 5 epochs, 32 arithmetic prompts", flush=True)
+      PY
diff --git a/cmd/air/examples/multi-image-inference.Dockerfile b/cmd/air/examples/multi-image-inference.Dockerfile
new file mode 100644
index 00000000000..f273f6ae5cd
--- /dev/null
+++ b/cmd/air/examples/multi-image-inference.Dockerfile
@@ -0,0 +1,7 @@
+FROM vllm/vllm-openai:v0.10.2
+
+ARG PIP_INDEX_URL
+
+RUN python3 -m pip install --no-cache-dir \
+      'trl==0.24.0' 'datasets==4.2.0' && \
+    python3 -c 'import trl, datasets, vllm; assert (trl.__version__, datasets.__version__, vllm.__version__) == ("0.24.0", "4.2.0", "0.10.2")'
diff --git a/cmd/air/examples/multi-image-trainer.Dockerfile b/cmd/air/examples/multi-image-trainer.Dockerfile
new file mode 100644
index 00000000000..f5934e5b1a4
--- /dev/null
+++ b/cmd/air/examples/multi-image-trainer.Dockerfile
@@ -0,0 +1,7 @@
+FROM huggingface/trl:0.23.1
+
+ARG PIP_INDEX_URL
+
+RUN python -m pip install --no-cache-dir \
+      'trl==0.24.0' 'vllm==0.10.2' && \
+    python -c 'import trl, vllm; assert (trl.__version__, vllm.__version__) == ("0.24.0", "0.10.2")'
diff --git a/cmd/air/format.go b/cmd/air/format.go
new file mode 100644
index 00000000000..1271f89b4ae
--- /dev/null
+++ b/cmd/air/format.go
@@ -0,0 +1,367 @@
+package aircmd
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"math"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/muesli/termenv"
+	"go.yaml.in/yaml/v3"
+)
+
+// na is the placeholder shown for an empty text-table cell, matching the Python CLI.
+const na = "N/A"
+
+// orNA returns s, or "N/A" when s is empty, for text-table cells.
+func orNA(s string) string {
+	if s == "" {
+		return na
+	}
+	return s
+}
+
+// hyperlink renders label as a terminal hyperlink to url when out is a rich
+// terminal, otherwise it returns label unchanged. This mirrors the Python CLI's
+// Rich link markup, which drops the URL on non-terminals (so piped or captured
+// output stays plain text).
+func hyperlink(ctx context.Context, out io.Writer, label, url string) string {
+	if url == "" || !cmdio.SupportsColor(ctx, out) {
+		return label
+	}
+	return termenv.Hyperlink(url, label)
+}
+
+// reformatYAMLForDisplay re-renders a training-config YAML so multi-line strings
+// (notably the `command:` field) appear as `|` block literals instead of the
+// quoted "\n"-escaped single line they are stored as, which is unreadable. It
+// mirrors Python's _reformat_yaml_for_display (cli_display.py); we skip the
+// Rich syntax-highlighted panel and only fix the whitespace. On any parse or
+// re-encode failure it returns the original content unchanged.
+func reformatYAMLForDisplay(content []byte) string {
+	var node yaml.Node
+	if err := yaml.Unmarshal(content, &node); err != nil {
+		return string(content)
+	}
+	forceLiteralBlockStrings(&node)
+
+	var buf bytes.Buffer
+	enc := yaml.NewEncoder(&buf)
+	enc.SetIndent(2)
+	if err := enc.Encode(&node); err != nil {
+		return string(content)
+	}
+	enc.Close()
+	return buf.String()
+}
+
+// forceLiteralBlockStrings walks a YAML node tree and marks every multi-line
+// string scalar for `|` block-literal rendering. The encoder automatically
+// falls back to a quoted style when a value can't be represented as a block
+// literal (e.g. lines with trailing whitespace), so no explicit guard is needed.
+func forceLiteralBlockStrings(node *yaml.Node) {
+	if node.Kind == yaml.ScalarNode && node.Tag == "!!str" && strings.Contains(node.Value, "\n") {
+		node.Style = yaml.LiteralStyle
+	}
+	for _, child := range node.Content {
+		forceLiteralBlockStrings(child)
+	}
+}
+
+// gpuDisplayNames maps the GPU identifiers returned by the backend to the short
+// names we show to users. Unknown identifiers are shown unchanged.
+var gpuDisplayNames = map[string]string{
+	"h100_80gb":  "H100",
+	"a10":        "A10",
+	"GPU_1xA10":  "A10",
+	"GPU_8xH100": "H100",
+	"GPU_1xH100": "H100",
+	"GPU_8xB300": "B300",
+}
+
+// isRunning reports whether a run is currently executing (lifecycle RUNNING), as
+// opposed to pending, terminal, or state-unknown. Only a running run has a
+// meaningful remaining-time estimate.
+func isRunning(run *jobs.Run) bool {
+	return run.State != nil && run.State.LifeCycleState == jobs.RunLifeCycleStateRunning
+}
+
+// runStatus returns the single status word to show for a run. The backend
+// reports two values: a lifecycle state (e.g. PENDING, RUNNING) and, once the
+// run has finished, a result state (e.g. SUCCESS, FAILED). The result state is
+// the more meaningful one, so we prefer it when it is set.
+func runStatus(state *jobs.RunState) string {
+	if state == nil {
+		return "UNKNOWN"
+	}
+	return statusWord(string(state.LifeCycleState), string(state.ResultState))
+}
+
+func displayRunStatus(run *jobs.Run) string {
+	status := runStatus(run.State)
+	if runWaitingForCompute(run) {
+		return "PENDING"
+	}
+	return status
+}
+
+func runWaitingForCompute(run *jobs.Run) bool {
+	if run.State == nil || run.State.ResultState != "" {
+		return false
+	}
+	if run.State.LifeCycleState == jobs.RunLifeCycleStatePending {
+		return true
+	}
+	if run.State.LifeCycleState != jobs.RunLifeCycleStateRunning || len(run.Tasks) == 0 || run.Tasks[0].State == nil {
+		return false
+	}
+	switch run.Tasks[0].State.LifeCycleState {
+	case jobs.RunLifeCycleStatePending, jobs.RunLifeCycleStateQueued,
+		jobs.RunLifeCycleStateWaitingForRetry, jobs.RunLifeCycleStateBlocked:
+		return true
+	default:
+		return false
+	}
+}
+
+func detailedDisplayRunStatus(run *jobs.Run, statusMessage string) string {
+	if run.State != nil && run.State.ResultState == "" && statusMessage != "" {
+		return statusMessage
+	}
+	if runWaitingForCompute(run) {
+		return waitingForComputeStatus
+	}
+	return displayRunStatus(run)
+}
+
+func terminationReason(run *jobs.Run) *string {
+	status := runStatus(run.State)
+	if status != "FAILED" && status != "TIMEDOUT" && status != "INTERNAL_ERROR" {
+		return nil
+	}
+	if run.Status != nil && run.Status.TerminationDetails != nil {
+		if message := strings.TrimSpace(run.Status.TerminationDetails.Message); message != "" {
+			return &message
+		}
+	}
+	if run.State != nil {
+		if message := strings.TrimSpace(run.State.StateMessage); message != "" {
+			return &message
+		}
+	}
+	if len(run.Tasks) > 0 && run.Tasks[0].State != nil {
+		if message := strings.TrimSpace(run.Tasks[0].State.StateMessage); message != "" {
+			return &message
+		}
+	}
+	return nil
+}
+
+// statusWord picks the status word to show from a run's lifecycle and result
+// states: the result state is the more meaningful one, so it wins when set.
+func statusWord(lifeCycle, result string) string {
+	if result != "" {
+		return result
+	}
+	if lifeCycle != "" {
+		return lifeCycle
+	}
+	return "UNKNOWN"
+}
+
+// reportedTiming returns the run's start and end times (epoch milliseconds),
+// preferring the last task's window over the run-level times so a retried run
+// reports its latest attempt. Mirrors Python's _reported_attempt_timing
+// (cli_display.py:78-87).
+func reportedTiming(run *jobs.Run) (startMillis, endMillis int64) {
+	startMillis, endMillis = run.StartTime, run.EndTime
+	if n := len(run.Tasks); n > 0 {
+		last := run.Tasks[n-1]
+		if last.StartTime > 0 {
+			startMillis = last.StartTime
+		}
+		if last.EndTime > 0 {
+			endMillis = last.EndTime
+		}
+	}
+	return startMillis, endMillis
+}
+
+// startedAt returns the run's start time as a Python-isoformat string ("+00:00",
+// not "Z"; microseconds only when non-zero, cli_entrypoint.py:1899), or nil if it
+// hasn't started.
+func startedAt(run *jobs.Run) *string {
+	startMillis, _ := reportedTiming(run)
+	if startMillis == 0 {
+		return nil
+	}
+	s := isoFormat(time.UnixMilli(startMillis))
+	return &s
+}
+
+// isoFormat renders a time as a Python-style isoformat string in UTC ("+00:00",
+// not "Z"; microseconds only when the sub-second part is non-zero), matching
+// cli_entrypoint.py:1899.
+func isoFormat(t time.Time) string {
+	t = t.UTC()
+	layout := "2006-01-02T15:04:05-07:00"
+	if t.Nanosecond() != 0 {
+		layout = "2006-01-02T15:04:05.000000-07:00"
+	}
+	return t.Format(layout)
+}
+
+// submittedDisplay formats the run's start time for the text table as
+// "2006-01-02 15:04 UTC", or "N/A" if it hasn't started. Mirrors Python's
+// _format_timestamp (cli_display.py); we render in UTC for stable output rather
+// than the local zone Python uses.
+func submittedDisplay(run *jobs.Run) string {
+	startMillis, _ := reportedTiming(run)
+	if startMillis == 0 {
+		return na
+	}
+	return time.UnixMilli(startMillis).UTC().Format("2006-01-02 15:04 MST")
+}
+
+// durationSeconds returns how long the run has taken, in whole seconds, or nil
+// if it has not started. For a finished run this is the elapsed time of the
+// reported attempt; for a still-running run it is the time since it started.
+func durationSeconds(run *jobs.Run) *int64 {
+	startMillis, endMillis := reportedTiming(run)
+	if startMillis == 0 {
+		return nil
+	}
+	if endMillis == 0 {
+		// Still running: measure against the current time.
+		endMillis = time.Now().UnixMilli()
+	}
+	d := roundMillisToSeconds(endMillis - startMillis)
+	return &d
+}
+
+// roundMillisToSeconds rounds milliseconds to whole seconds, half to even, to
+// match Python's round() (cli_entrypoint.py:1903).
+func roundMillisToSeconds(ms int64) int64 {
+	return int64(math.RoundToEven(float64(ms) / 1000))
+}
+
+// dashboardURL builds {host}/jobs/runs/{id}?o={workspace_id}, matching Python
+// (cli_entrypoint.py:1911). The ?o= workspace id deep-links to the right
+// workspace on multi-workspace accounts.
+func dashboardURL(host string, runID, workspaceID int64) string {
+	return fmt.Sprintf("%s/jobs/runs/%d?o=%d", strings.TrimRight(host, "/"), runID, workspaceID)
+}
+
+// formatDuration turns a number of seconds into a compact human string such as
+// "1h 2m 3s". Trailing zero units are dropped, but a lone "0s" is kept so the
+// result is never empty.
+func formatDuration(totalSeconds int64) string {
+	hours := totalSeconds / 3600
+	minutes := (totalSeconds % 3600) / 60
+	seconds := totalSeconds % 60
+
+	var parts []string
+	if hours > 0 {
+		parts = append(parts, fmt.Sprintf("%dh", hours))
+	}
+	if minutes > 0 {
+		parts = append(parts, fmt.Sprintf("%dm", minutes))
+	}
+	if seconds > 0 || len(parts) == 0 {
+		parts = append(parts, fmt.Sprintf("%ds", seconds))
+	}
+	return strings.Join(parts, " ")
+}
+
+// latestAttemptNumber returns the retry count of the run's most recent task.
+// Tasks start at attempt 0, so a value of 0 means the run has not been retried.
+func latestAttemptNumber(run *jobs.Run) int {
+	if len(run.Tasks) == 0 {
+		return 0
+	}
+	return run.Tasks[len(run.Tasks)-1].AttemptNumber
+}
+
+// experimentName returns the MLflow experiment name for the run, or nil if there
+// isn't one. Experiment names are often stored under a user's home folder (e.g.
+// "/Users/me@example.com/my-experiment"); we strip that prefix so users see just
+// the experiment name they chose.
+func experimentName(run *jobs.Run) *string {
+	if len(run.Tasks) == 0 {
+		return nil
+	}
+	task := run.Tasks[0].GenAiComputeTask
+	if task == nil || task.MlflowExperimentName == "" {
+		return nil
+	}
+	name := stripExperimentUserPrefix(task.MlflowExperimentName)
+	return &name
+}
+
+// stripExperimentUserPrefix removes a leading "/Users/<user>/" from an
+// experiment name, leaving the remainder. Names without that prefix are returned
+// unchanged.
+func stripExperimentUserPrefix(name string) string {
+	if !strings.HasPrefix(name, "/Users/") {
+		return name
+	}
+	// Split into ["", "Users", "<user>", "<rest>"]; keep "<rest>".
+	parts := strings.SplitN(name, "/", 4)
+	if len(parts) == 4 {
+		return parts[3]
+	}
+	return name
+}
+
+// accelerators returns a short description of the GPUs the run uses, such as
+// "8x H100", or an empty string if the run has no GPU compute attached.
+func accelerators(run *jobs.Run) string {
+	if len(run.Tasks) == 0 {
+		return ""
+	}
+	task := run.Tasks[0].GenAiComputeTask
+	if task == nil || task.Compute == nil {
+		return ""
+	}
+	return acceleratorLabel(task.Compute.GpuType, task.Compute.NumGpus)
+}
+
+// acceleratorLabel renders a GPU count and type as "8x H100", "" for none, or
+// the count alone ("8x") when the type is unrecognized.
+func acceleratorLabel(gpuType string, count int) string {
+	if count == 0 {
+		return ""
+	}
+	if name := gpuDisplayName(gpuType); name != "" {
+		return fmt.Sprintf("%dx %s", count, name)
+	}
+	return fmt.Sprintf("%dx", count)
+}
+
+// gpuDisplayName returns the friendly name for a GPU identifier, falling back to
+// the identifier itself when it is not one we recognize.
+func gpuDisplayName(gpuType string) string {
+	if name, ok := gpuDisplayNames[gpuType]; ok {
+		return name
+	}
+	return gpuType
+}
+
+// maxRetries returns the configured retry limit for the run's latest task as a
+// display string: "unlimited" for the backend's -1, otherwise the count.
+func maxRetries(run *jobs.Run) string {
+	if len(run.Tasks) == 0 {
+		return "0"
+	}
+	n := run.Tasks[len(run.Tasks)-1].MaxRetries
+	if n < 0 {
+		return "unlimited"
+	}
+	return strconv.Itoa(n)
+}
diff --git a/cmd/air/format_test.go b/cmd/air/format_test.go
new file mode 100644
index 00000000000..842806e6113
--- /dev/null
+++ b/cmd/air/format_test.go
@@ -0,0 +1,305 @@
+package aircmd
+
+import (
+	"io"
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestOrNA(t *testing.T) {
+	assert.Equal(t, "x", orNA("x"))
+	assert.Equal(t, "N/A", orNA(""))
+}
+
+func TestSubmittedDisplay(t *testing.T) {
+	assert.Equal(t, "N/A", submittedDisplay(&jobs.Run{}))
+	// 1700000000000 ms == 2023-11-14 22:13:20 UTC.
+	assert.Equal(t, "2023-11-14 22:13 UTC", submittedDisplay(&jobs.Run{StartTime: 1700000000000}))
+}
+
+func TestHyperlink(t *testing.T) {
+	// On a non-terminal (no color), the URL is dropped and only the label shows.
+	ctx := cmdio.MockDiscard(t.Context())
+	assert.Equal(t, "label", hyperlink(ctx, io.Discard, "label", "https://h.test/x"))
+	// An empty URL is always rendered as the bare label.
+	assert.Equal(t, "label", hyperlink(ctx, io.Discard, "label", ""))
+}
+
+func TestFormatDuration(t *testing.T) {
+	cases := []struct {
+		seconds int64
+		want    string
+	}{
+		{0, "0s"},
+		{45, "45s"},
+		{60, "1m"},
+		{63, "1m 3s"},
+		{3600, "1h"},
+		{3723, "1h 2m 3s"},
+		{7260, "2h 1m"},
+	}
+	for _, c := range cases {
+		assert.Equal(t, c.want, formatDuration(c.seconds))
+	}
+}
+
+func TestStripExperimentUserPrefix(t *testing.T) {
+	cases := []struct {
+		name string
+		want string
+	}{
+		{"/Users/me@example.com/my-experiment", "my-experiment"},
+		{"/Users/me@example.com/nested/path", "nested/path"},
+		{"my-experiment", "my-experiment"},
+		{"/Shared/team-experiment", "/Shared/team-experiment"},
+		{"/Users/me@example.com", "/Users/me@example.com"},
+	}
+	for _, c := range cases {
+		assert.Equal(t, c.want, stripExperimentUserPrefix(c.name))
+	}
+}
+
+func TestGpuDisplayName(t *testing.T) {
+	assert.Equal(t, "H100", gpuDisplayName("h100_80gb"))
+	assert.Equal(t, "A10", gpuDisplayName("GPU_1xA10"))
+	assert.Equal(t, "A10", gpuDisplayName("a10"))
+	assert.Equal(t, "H100", gpuDisplayName("GPU_8xH100"))
+	assert.Equal(t, "H100", gpuDisplayName("GPU_1xH100"))
+	assert.Equal(t, "B300", gpuDisplayName("GPU_8xB300"))
+	// Unknown identifiers pass through unchanged.
+	assert.Equal(t, "b200", gpuDisplayName("b200"))
+	assert.Empty(t, gpuDisplayName(""))
+}
+
+func TestRunStatusPrefersResultState(t *testing.T) {
+	// Result state wins once the run has finished.
+	assert.Equal(t, "SUCCESS", runStatus(&jobs.RunState{
+		LifeCycleState: jobs.RunLifeCycleStateTerminated,
+		ResultState:    jobs.RunResultStateSuccess,
+	}))
+	// Before completion only the lifecycle state is set.
+	assert.Equal(t, "RUNNING", runStatus(&jobs.RunState{
+		LifeCycleState: jobs.RunLifeCycleStateRunning,
+	}))
+	// Non-nil state with neither field set, and nil state.
+	assert.Equal(t, "UNKNOWN", runStatus(&jobs.RunState{}))
+	assert.Equal(t, "UNKNOWN", runStatus(nil))
+}
+
+func TestReportedTiming(t *testing.T) {
+	// No tasks: run-level times are used.
+	start, end := reportedTiming(&jobs.Run{StartTime: 100, EndTime: 200})
+	assert.Equal(t, int64(100), start)
+	assert.Equal(t, int64(200), end)
+
+	// The last task's window is preferred over the run-level window, so a
+	// retried run reports its most recent attempt.
+	start, end = reportedTiming(&jobs.Run{
+		StartTime: 100, EndTime: 200,
+		Tasks: []jobs.RunTask{
+			{StartTime: 100, EndTime: 150},
+			{StartTime: 300, EndTime: 450},
+		},
+	})
+	assert.Equal(t, int64(300), start)
+	assert.Equal(t, int64(450), end)
+
+	// A task missing a field falls back to the run-level value for that field.
+	start, end = reportedTiming(&jobs.Run{
+		StartTime: 100, EndTime: 200,
+		Tasks: []jobs.RunTask{{StartTime: 300}},
+	})
+	assert.Equal(t, int64(300), start)
+	assert.Equal(t, int64(200), end)
+}
+
+func TestStartedAt(t *testing.T) {
+	// Not started yet.
+	assert.Nil(t, startedAt(&jobs.Run{}))
+	// 1700000000000 ms == 2023-11-14T22:13:20+00:00 (Python isoformat, not "Z").
+	got := startedAt(&jobs.Run{StartTime: 1700000000000})
+	require.NotNil(t, got)
+	assert.Equal(t, "2023-11-14T22:13:20+00:00", *got)
+	// A sub-second start time carries microsecond precision.
+	got = startedAt(&jobs.Run{StartTime: 1700000000500})
+	require.NotNil(t, got)
+	assert.Equal(t, "2023-11-14T22:13:20.500000+00:00", *got)
+	// The last attempt's start time is reported. 1700000060000 ms == 22:14:20.
+	got = startedAt(&jobs.Run{
+		StartTime: 1700000000000,
+		Tasks:     []jobs.RunTask{{StartTime: 1700000060000}},
+	})
+	require.NotNil(t, got)
+	assert.Equal(t, "2023-11-14T22:14:20+00:00", *got)
+}
+
+func TestDurationSeconds(t *testing.T) {
+	// Not started yet.
+	assert.Nil(t, durationSeconds(&jobs.Run{}))
+
+	// Finished run: reported end - start.
+	d := durationSeconds(&jobs.Run{StartTime: 1700000000000, EndTime: 1700000012000})
+	require.NotNil(t, d)
+	assert.Equal(t, int64(12), *d)
+
+	// Sub-second remainders round to the nearest second, matching Python: an
+	// 11,500 ms run reports 12s, not 11s.
+	d = durationSeconds(&jobs.Run{StartTime: 1700000000000, EndTime: 1700000011500})
+	require.NotNil(t, d)
+	assert.Equal(t, int64(12), *d)
+
+	// The last attempt's window drives the duration for a retried run.
+	d = durationSeconds(&jobs.Run{
+		StartTime: 1700000000000, EndTime: 1700000012000,
+		Tasks: []jobs.RunTask{{StartTime: 1700000000000, EndTime: 1700000005000}},
+	})
+	require.NotNil(t, d)
+	assert.Equal(t, int64(5), *d)
+
+	// Still running: measured against the current time, so positive.
+	d = durationSeconds(&jobs.Run{StartTime: 1700000000000})
+	require.NotNil(t, d)
+	assert.Positive(t, *d)
+}
+
+func TestDashboardURL(t *testing.T) {
+	// The ?o= workspace id and a trailing-slash-trimmed host, matching Python.
+	assert.Equal(t, "https://example.test/jobs/runs/123?o=42", dashboardURL("https://example.test/", 123, 42))
+}
+
+func TestLatestAttemptNumber(t *testing.T) {
+	assert.Equal(t, 0, latestAttemptNumber(&jobs.Run{}))
+	run := &jobs.Run{Tasks: []jobs.RunTask{{AttemptNumber: 0}, {AttemptNumber: 2}}}
+	assert.Equal(t, 2, latestAttemptNumber(run))
+}
+
+func TestExperimentName(t *testing.T) {
+	assert.Nil(t, experimentName(&jobs.Run{}))
+	assert.Nil(t, experimentName(&jobs.Run{Tasks: []jobs.RunTask{{}}}))
+	assert.Nil(t, experimentName(&jobs.Run{Tasks: []jobs.RunTask{{
+		GenAiComputeTask: &jobs.GenAiComputeTask{MlflowExperimentName: ""},
+	}}}))
+	got := experimentName(&jobs.Run{Tasks: []jobs.RunTask{{
+		GenAiComputeTask: &jobs.GenAiComputeTask{MlflowExperimentName: "/Users/me@example.com/exp"},
+	}}})
+	require.NotNil(t, got)
+	assert.Equal(t, "exp", *got)
+}
+
+func TestReformatYAMLForDisplay(t *testing.T) {
+	// A multi-line command stored as a quoted "\n"-escaped string is re-rendered
+	// as a `|` block literal, while key order is preserved.
+	in := "experiment_name: foo\ncommand: \"set -e\\npython train.py --epochs 3\\n\"\nmax_retries: 2\n"
+	want := "experiment_name: foo\ncommand: |\n  set -e\n  python train.py --epochs 3\nmax_retries: 2\n"
+	assert.Equal(t, want, reformatYAMLForDisplay([]byte(in)))
+
+	// A single-line command is left as a plain scalar.
+	assert.Equal(t, "command: bash train.sh\n", reformatYAMLForDisplay([]byte("command: bash train.sh\n")))
+
+	// A multi-line value with trailing whitespace can't be a block literal, so the
+	// encoder falls back to a quoted style rather than emitting invalid YAML.
+	got := reformatYAMLForDisplay([]byte("command: \"trailing space \\nsecond\"\n"))
+	assert.Equal(t, "command: \"trailing space \\nsecond\"\n", got)
+
+	// Unparseable content is returned unchanged.
+	assert.Equal(t, "\tnot: valid: yaml:", reformatYAMLForDisplay([]byte("\tnot: valid: yaml:")))
+}
+
+func TestAccelerators(t *testing.T) {
+	assert.Empty(t, accelerators(&jobs.Run{}))
+	assert.Empty(t, accelerators(&jobs.Run{Tasks: []jobs.RunTask{{}}}))
+	assert.Empty(t, accelerators(&jobs.Run{Tasks: []jobs.RunTask{{
+		GenAiComputeTask: &jobs.GenAiComputeTask{},
+	}}}))
+	assert.Empty(t, accelerators(&jobs.Run{Tasks: []jobs.RunTask{{
+		GenAiComputeTask: &jobs.GenAiComputeTask{Compute: &jobs.ComputeConfig{NumGpus: 0}},
+	}}}))
+	assert.Equal(t, "8x H100", accelerators(&jobs.Run{Tasks: []jobs.RunTask{{
+		GenAiComputeTask: &jobs.GenAiComputeTask{Compute: &jobs.ComputeConfig{NumGpus: 8, GpuType: "GPU_8xH100"}},
+	}}}))
+}
+
+func TestAcceleratorLabel(t *testing.T) {
+	assert.Empty(t, acceleratorLabel("GPU_8xH100", 0))
+	assert.Equal(t, "8x H100", acceleratorLabel("GPU_8xH100", 8))
+	assert.Equal(t, "1x A10", acceleratorLabel("GPU_1xA10", 1))
+	assert.Equal(t, "16x B300", acceleratorLabel("GPU_8xB300", 16))
+	// The RPC may report a count without a recognized type.
+	assert.Equal(t, "8x", acceleratorLabel("", 8))
+}
+
+func TestStatusWord(t *testing.T) {
+	assert.Equal(t, "SUCCESS", statusWord("TERMINATED", "SUCCESS")) // result wins
+	assert.Equal(t, "RUNNING", statusWord("RUNNING", ""))           // falls back to lifecycle
+	assert.Equal(t, "UNKNOWN", statusWord("", ""))
+}
+
+func TestDisplayRunStatus(t *testing.T) {
+	pendingStates := []jobs.RunLifeCycleState{
+		jobs.RunLifeCycleStatePending,
+		jobs.RunLifeCycleStateQueued,
+		jobs.RunLifeCycleStateWaitingForRetry,
+		jobs.RunLifeCycleStateBlocked,
+	}
+	for _, state := range pendingStates {
+		run := &jobs.Run{
+			State: &jobs.RunState{LifeCycleState: jobs.RunLifeCycleStateRunning},
+			Tasks: []jobs.RunTask{{State: &jobs.RunState{LifeCycleState: state}}},
+		}
+		assert.Equal(t, "PENDING", displayRunStatus(run))
+	}
+
+	assert.Equal(t, "RUNNING", displayRunStatus(&jobs.Run{
+		State: &jobs.RunState{LifeCycleState: jobs.RunLifeCycleStateRunning},
+		Tasks: []jobs.RunTask{{State: &jobs.RunState{LifeCycleState: jobs.RunLifeCycleStateRunning}}},
+	}))
+	assert.Equal(t, "RUNNING", displayRunStatus(&jobs.Run{State: &jobs.RunState{LifeCycleState: jobs.RunLifeCycleStateRunning}}))
+	assert.Equal(t, "FAILED", displayRunStatus(&jobs.Run{
+		State: &jobs.RunState{LifeCycleState: jobs.RunLifeCycleStateTerminated, ResultState: jobs.RunResultStateFailed},
+		Tasks: []jobs.RunTask{{State: &jobs.RunState{LifeCycleState: jobs.RunLifeCycleStatePending}}},
+	}))
+}
+
+func TestDetailedDisplayRunStatus(t *testing.T) {
+	waiting := &jobs.Run{
+		State: &jobs.RunState{LifeCycleState: jobs.RunLifeCycleStateRunning},
+		Tasks: []jobs.RunTask{{State: &jobs.RunState{LifeCycleState: jobs.RunLifeCycleStateQueued}}},
+	}
+	assert.Equal(t, "Waiting for GPU capacity...", detailedDisplayRunStatus(waiting, "Waiting for GPU capacity..."))
+	assert.Equal(t, waitingForComputeStatus, detailedDisplayRunStatus(waiting, ""))
+
+	started := &jobs.Run{
+		State: &jobs.RunState{LifeCycleState: jobs.RunLifeCycleStateRunning},
+		Tasks: []jobs.RunTask{{State: &jobs.RunState{LifeCycleState: jobs.RunLifeCycleStateRunning}}},
+	}
+	assert.Equal(t, "RUNNING", detailedDisplayRunStatus(started, ""))
+
+	failed := &jobs.Run{
+		State: &jobs.RunState{LifeCycleState: jobs.RunLifeCycleStateTerminated, ResultState: jobs.RunResultStateFailed},
+		Tasks: []jobs.RunTask{{State: &jobs.RunState{LifeCycleState: jobs.RunLifeCycleStatePending}}},
+	}
+	assert.Equal(t, "FAILED", detailedDisplayRunStatus(failed, "stale status..."))
+}
+
+func TestTerminationReason(t *testing.T) {
+	reason := terminationReason(&jobs.Run{
+		State:  &jobs.RunState{ResultState: jobs.RunResultStateFailed, StateMessage: "parent reason"},
+		Status: &jobs.RunStatus{TerminationDetails: &jobs.TerminationDetails{Message: " detailed reason "}},
+	})
+	require.NotNil(t, reason)
+	assert.Equal(t, "detailed reason", *reason)
+
+	reason = terminationReason(&jobs.Run{
+		State: &jobs.RunState{ResultState: jobs.RunResultStateTimedout},
+		Tasks: []jobs.RunTask{{State: &jobs.RunState{StateMessage: "task timed out"}}},
+	})
+	require.NotNil(t, reason)
+	assert.Equal(t, "task timed out", *reason)
+
+	assert.Nil(t, terminationReason(&jobs.Run{State: &jobs.RunState{ResultState: jobs.RunResultStateSuccess, StateMessage: "done"}}))
+	assert.Nil(t, terminationReason(&jobs.Run{State: &jobs.RunState{ResultState: jobs.RunResultStateCanceled, StateMessage: "cancelled"}}))
+}
diff --git a/cmd/air/get.go b/cmd/air/get.go
new file mode 100644
index 00000000000..9f55f0f60e8
--- /dev/null
+++ b/cmd/air/get.go
@@ -0,0 +1,277 @@
+package aircmd
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"path"
+	"strconv"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/config"
+	"github.com/databricks/databricks-sdk-go/service/iam"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/spf13/cobra"
+)
+
+// getData is the payload printed by `air get`. The json-tagged fields form
+// the machine-readable output; fields tagged `json:"-"` are shown only in the
+// human-readable text view.
+type getData struct {
+	RunID             string  `json:"run_id"`
+	Status            string  `json:"status"`
+	StartedAt         *string `json:"started_at"`
+	DurationSeconds   *int64  `json:"duration_seconds"`
+	AttemptNumber     int     `json:"attempt_number"`
+	ExperimentName    *string `json:"experiment_name"`
+	DashboardURL      string  `json:"dashboard_url"`
+	MLflowURL         *string `json:"mlflow_url"`
+	TerminationReason *string `json:"termination_reason,omitempty"`
+	// ESTRemainingSeconds and ESTPercentComplete are a best-effort progress
+	// estimate for a running run, or null when one can't be made (see
+	// estimateTrainingETA).
+	ESTRemainingSeconds *int64 `json:"est_remaining_seconds"`
+	ESTPercentComplete  *int   `json:"est_percent_complete"`
+
+	// The fields below are pre-rendered text-view cells, excluded from JSON
+	// (matching `air get --json`). Each shows "N/A" when its value is
+	// missing. The styled single-run renderer (render.go) consumes them; the
+	// Run ID, Status, and MLflow Run cells it draws are styled and hyperlinked
+	// there rather than stored here.
+	SubmittedDisplay    string `json:"-"`
+	DurationDisplay     string `json:"-"`
+	ExperimentDisplay   string `json:"-"`
+	UserDisplay         string `json:"-"`
+	AcceleratorsDisplay string `json:"-"`
+	EnvironmentDisplay  string `json:"-"`
+	MaxRetriesDisplay   string `json:"-"`
+	// ProgressDisplay is the pre-rendered "Progress" cell ("45% · ~2h 15m left"),
+	// set only for a running run with an estimable remaining time.
+	ProgressDisplay string `json:"-"`
+	DisplayStatus   string `json:"-"`
+	// TrainingConfigPath is the run's config file, downloaded for the config box.
+	TrainingConfigPath string `json:"-"`
+	// Sweep replaces the single-run view for foreach runs.
+	Sweep *sweepInfo `json:"-"`
+}
+
+// getTemplate is the text-mode layout for a sweep (foreach) run. Single runs are
+// drawn by the styled renderer in render.go and never reach this template; it is
+// used only when .Data.Sweep is set. It reads from the JSON envelope, so every
+// field is reached through ".Data".
+const getTemplate = `Sweep Run ID: {{.Data.RunID}}
+Status:       {{if .Data.DisplayStatus}}{{.Data.DisplayStatus}}{{else}}{{.Data.Status}}{{end}}
+Total:        {{.Data.Sweep.Total}}
+Completed:    {{.Data.Sweep.Completed}}
+Succeeded:    {{.Data.Sweep.Succeeded}}
+Failed:       {{.Data.Sweep.Failed}}
+Active:       {{.Data.Sweep.Active}}
+{{- if .Data.Sweep.Tasks}}
+
+Sweep Tasks:
+{{printf "  %-24s %-14s %-12s %s" "TASK" "RUN ID" "STATUS" "EXPERIMENT"}}
+{{- range .Data.Sweep.Tasks}}
+{{printf "  %-24s %-14s %-12s %s" .TaskKey .RunID .Status .Experiment}}
+{{- end}}
+{{- end}}
+`
+
+// errNoProfile is the actionable message shown when no credentials are
+// configured: no default profile, no --profile (-p), and no auth environment.
+var errNoProfile = errors.New("no default profile is set: pass --profile (-p) or configure a default profile in your .databrickscfg")
+
+// authError classifies a workspace-client or Me() probe failure. Only genuinely
+// auth-shaped errors surface as UNAUTHENTICATED/PERMANENT: missing profile,
+// SDK auth wrappers, or an API 401/403. Anything else (network blip, 429, 5xx)
+// is transient and reported as INTERNAL_ERROR/TRANSIENT so the caller can retry.
+func authError(ctx context.Context, cmd *cobra.Command, err error) error {
+	if errors.Is(err, config.ErrCannotConfigureDefault) {
+		return renderError(ctx, cmd, "UNAUTHENTICATED", "PERMANENT", false, errNoProfile)
+	}
+	if errors.Is(err, apierr.ErrUnauthenticated) || errors.Is(err, apierr.ErrPermissionDenied) {
+		return renderError(ctx, cmd, "UNAUTHENTICATED", "PERMANENT", false,
+			fmt.Errorf("authentication was not successful: %w", err))
+	}
+	return renderError(ctx, cmd, "INTERNAL_ERROR", "TRANSIENT", true,
+		fmt.Errorf("failed to verify authentication: %w", err))
+}
+
+// newGetCommand returns the `air get JOB_RUN_ID` command, which shows status,
+// configuration, and timing details for a specific run.
+func newGetCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "get JOB_RUN_ID",
+		Args:  root.ExactArgs(1),
+		Short: "Show status, configuration, and timing details for a specified run",
+		Long: `Show status, configuration, and timing details for a specified run.
+
+JOB_RUN_ID is the job run ID returned by "air run".`,
+		Annotations: map[string]string{
+			"template": getTemplate,
+		},
+	}
+
+	// Resolve and authenticate the workspace client up front so an auth failure
+	// fails fast here, before any run status or config is fetched or printed.
+	// ErrAlreadyPrinted passes through (it was handled upstream); other failures
+	// become an actionable auth error (JSON envelope in -o json mode).
+	cmd.PreRunE = func(cmd *cobra.Command, args []string) error {
+		err := root.MustWorkspaceClient(cmd, args)
+		if err == nil || errors.Is(err, root.ErrAlreadyPrinted) {
+			return err
+		}
+		return authError(cmd.Context(), cmd, err)
+	}
+
+	cmd.RunE = func(cmd *cobra.Command, args []string) error {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		runID, err := strconv.ParseInt(args[0], 10, 64)
+		if err != nil || runID <= 0 {
+			return renderError(ctx, cmd, "INVALID_ARGS", "PERMANENT", false,
+				fmt.Errorf("invalid JOB_RUN_ID %q: must be a positive integer", args[0]))
+		}
+
+		// Validate authentication against the workspace before fetching or
+		// rendering anything. MustWorkspaceClient's Config.Authenticate only
+		// attaches credentials (e.g. it does not check a PAT server-side), so
+		// without this a bad credential would surface as a confusing failure
+		// mid-render instead of a clear "not authenticated" error here.
+		if _, err := w.CurrentUser.Me(ctx, iam.MeRequest{}); err != nil {
+			return authError(ctx, cmd, err)
+		}
+
+		run, err := w.Jobs.GetRun(ctx, jobs.GetRunRequest{RunId: runID})
+		if err != nil {
+			// The backend returns this when the run ID is unknown to the user.
+			if errors.Is(err, apierr.ErrResourceDoesNotExist) {
+				return renderError(ctx, cmd, "NOT_FOUND", "NOT_FOUND", false,
+					fmt.Errorf("run %d not found: check the run ID and that it is a job run ID", runID))
+			}
+			return renderError(ctx, cmd, "INTERNAL_ERROR", "TRANSIENT", true,
+				fmt.Errorf("failed to get status for run %d: %w", runID, err))
+		}
+
+		workspaceID, err := w.CurrentWorkspaceID(ctx)
+		if err != nil {
+			return renderError(ctx, cmd, "INTERNAL_ERROR", "TRANSIENT", true,
+				fmt.Errorf("failed to get workspace id for run %d: %w", runID, err))
+		}
+
+		data := buildGetData(run)
+		data.DashboardURL = dashboardURL(w.Config.Host, runID, workspaceID)
+		taskOutput := aiRuntimeTaskOutput(ctx, w, run)
+		ids := mlflowIDsFromOutput(taskOutput)
+		if ids != nil {
+			url := mlflowLogsURL(w.Config.Host, ids)
+			data.MLflowURL = &url
+			// A remaining-time estimate only makes sense while the run is still
+			// training; a terminal run is either done or stopped mid-progress.
+			if isRunning(run) {
+				if eta := estimateTrainingETA(ctx, w, ids.RunID); eta != nil {
+					secs := eta.RemainingSeconds
+					pct := eta.PercentComplete
+					data.ESTRemainingSeconds = &secs
+					data.ESTPercentComplete = &pct
+					data.ProgressDisplay = eta.detailed()
+				}
+			}
+		}
+		if task := findForEachTask(run); task != nil {
+			data.Sweep = buildSweepInfo(ctx, w, task)
+		} else if genAIComputeTask(run) == nil {
+			enrichFromAiRuntimeTask(run, &data)
+		}
+
+		if root.OutputType(cmd) != flags.OutputText {
+			return renderEnvelope(ctx, data)
+		}
+
+		out := cmd.OutOrStdout()
+		if data.Sweep != nil {
+			// A sweep has no single status, config, or timing, so lead with the
+			// job run link and render the foreach summary table (getTemplate).
+			fmt.Fprintf(out, "Job Link: %s\n\n", hyperlink(ctx, out, data.DashboardURL, data.DashboardURL))
+			return renderEnvelope(ctx, data)
+		}
+		statusMessage := ""
+		if taskOutput != nil {
+			statusMessage = normalizeStatusMessage(taskOutput.StatusMessage)
+		}
+		data.DisplayStatus = detailedDisplayRunStatus(run, statusMessage)
+
+		renderRunText(ctx, out, w, run, &data, ids)
+		return nil
+	}
+
+	return cmd
+}
+
+// enrichFromAiRuntimeTask fills the config path, experiment, and accelerators
+// from the run's ai_runtime_task. Best-effort: empty fields leave the existing
+// "N/A" fallbacks in place.
+func enrichFromAiRuntimeTask(run *jobs.Run, data *getData) {
+	task := aiRuntimeTaskOf(run)
+	if task == nil {
+		return
+	}
+	if len(task.Deployments) > 0 {
+		d := task.Deployments[0]
+		if d.CommandPath != "" {
+			data.TrainingConfigPath = path.Join(path.Dir(d.CommandPath), trainingConfigName)
+		}
+		if a := acceleratorLabel(string(d.Compute.AcceleratorType), d.Compute.AcceleratorCount); a != "" {
+			data.AcceleratorsDisplay = a
+		}
+	}
+	if task.Experiment != "" {
+		exp := stripExperimentUserPrefix(task.Experiment)
+		data.ExperimentName = &exp
+		data.ExperimentDisplay = exp
+	}
+}
+
+// aiRuntimeTaskOf returns the run's first ai_runtime_task, or nil.
+func aiRuntimeTaskOf(run *jobs.Run) *jobs.AiRuntimeTask {
+	if len(run.Tasks) == 0 {
+		return nil
+	}
+	return run.Tasks[0].AiRuntimeTask
+}
+
+// buildGetData extracts the fields we display from a run. The text-view cells
+// are pre-rendered here with their "N/A" fallbacks; the styled renderer adds the
+// hyperlinks and colors once the dashboard and MLflow identifiers are known.
+func buildGetData(run *jobs.Run) getData {
+	data := getData{
+		RunID:             strconv.FormatInt(run.RunId, 10),
+		Status:            runStatus(run.State),
+		DisplayStatus:     displayRunStatus(run),
+		TerminationReason: terminationReason(run),
+		StartedAt:         startedAt(run),
+		DurationSeconds:   durationSeconds(run),
+		AttemptNumber:     latestAttemptNumber(run),
+		ExperimentName:    experimentName(run),
+	}
+	data.SubmittedDisplay = submittedDisplay(run)
+	data.DurationDisplay = na
+	if data.DurationSeconds != nil {
+		data.DurationDisplay = formatDuration(*data.DurationSeconds)
+	}
+	data.ExperimentDisplay = na
+	if data.ExperimentName != nil {
+		data.ExperimentDisplay = *data.ExperimentName
+	}
+	data.UserDisplay = orNA(run.CreatorUserName)
+	data.AcceleratorsDisplay = orNA(accelerators(run))
+	// EnvironmentDisplay is resolved at render time: the serverless environment
+	// version needs a raw GetRun read (the typed SDK Run drops it), so it is not
+	// filled here alongside the fields read straight off the run.
+	data.EnvironmentDisplay = na
+	data.MaxRetriesDisplay = maxRetries(run)
+	return data
+}
diff --git a/cmd/air/get_test.go b/cmd/air/get_test.go
new file mode 100644
index 00000000000..7df2cf5e613
--- /dev/null
+++ b/cmd/air/get_test.go
@@ -0,0 +1,294 @@
+package aircmd
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"text/template"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/config"
+	"github.com/databricks/databricks-sdk-go/experimental/mocks"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+)
+
+// renderGet renders the get template against the JSON envelope, exactly as the
+// command does for a sweep run, so the test covers the real template branches.
+func renderGet(t *testing.T, data getData) string {
+	t.Helper()
+	tmpl, err := template.New("get").Parse(getTemplate)
+	require.NoError(t, err)
+	var buf bytes.Buffer
+	require.NoError(t, tmpl.Execute(&buf, envelope{V: envelopeVersion, Data: data}))
+	return buf.String()
+}
+
+// TestGetCommandShape locks in that `get` takes the run id directly as
+// `air get JOB_RUN_ID` (there is no `run` subcommand — it was collapsed back
+// into `get`). The acceptance test exercises the happy path end to end.
+func TestGetCommandShape(t *testing.T) {
+	cmd := newGetCommand()
+	assert.Equal(t, "get JOB_RUN_ID", cmd.Use)
+	assert.Empty(t, cmd.Commands())
+	// ExactArgs(1): exactly one run id is required.
+	assert.NoError(t, cmd.Args(cmd, []string{"123"}))
+	assert.Error(t, cmd.Args(cmd, []string{}))
+	assert.Error(t, cmd.Args(cmd, []string{"1", "2"}))
+}
+
+func TestGetRunInvalidID(t *testing.T) {
+	m := mocks.NewMockWorkspaceClient(t)
+	ctx := cmdctx.SetWorkspaceClient(cmdio.MockDiscard(t.Context()), m.WorkspaceClient)
+	cmd := withOutput(newGetCommand(), flags.OutputText)
+	cmd.SetContext(ctx)
+
+	err := cmd.RunE(cmd, []string{"abc"})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "invalid JOB_RUN_ID")
+}
+
+// notFoundGetServer serves the auth probe plus a runs/get that reports the run
+// as missing (400 INVALID_PARAMETER_VALUE, which the SDK maps to
+// ErrResourceDoesNotExist for this path).
+func notFoundGetServer(t *testing.T) *httptest.Server {
+	t.Helper()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/api/2.2/jobs/runs/get" {
+			w.WriteHeader(http.StatusBadRequest)
+			_, _ = w.Write([]byte(`{"error_code":"INVALID_PARAMETER_VALUE","message":"Run 5 does not exist."}`))
+			return
+		}
+		// Me() probe and any other config discovery.
+		_, _ = w.Write([]byte(`{"userName":"u@example.com"}`))
+	}))
+	t.Cleanup(srv.Close)
+	return srv
+}
+
+func TestGetRunNotFound(t *testing.T) {
+	srv := notFoundGetServer(t)
+	ctx := cmdctx.SetWorkspaceClient(cmdio.MockDiscard(t.Context()), newTestWorkspaceClient(t, srv.URL))
+	cmd := withOutput(newGetCommand(), flags.OutputText)
+	cmd.SetContext(ctx)
+
+	err := cmd.RunE(cmd, []string{"5"})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "run 5 not found")
+}
+
+func TestGetRunAuthFailed(t *testing.T) {
+	m := mocks.NewMockWorkspaceClient(t)
+	// A genuine auth failure (permission denied) is validated before the run is
+	// fetched, so GetRun is never reached and nothing is rendered.
+	m.GetMockCurrentUserAPI().EXPECT().Me(mock.Anything, mock.Anything).Return(nil, apierr.ErrPermissionDenied)
+	ctx := cmdctx.SetWorkspaceClient(cmdio.MockDiscard(t.Context()), m.WorkspaceClient)
+	cmd := withOutput(newGetCommand(), flags.OutputText)
+	cmd.SetContext(ctx)
+
+	err := cmd.RunE(cmd, []string{"5"})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "authentication was not successful")
+}
+
+func TestGetRunAuthTransient(t *testing.T) {
+	m := mocks.NewMockWorkspaceClient(t)
+	// A transient failure at the auth probe must not be misreported as an auth
+	// error; it surfaces as a retryable internal error instead.
+	m.GetMockCurrentUserAPI().EXPECT().Me(mock.Anything, mock.Anything).Return(nil, errors.New("connection reset"))
+	ctx := cmdctx.SetWorkspaceClient(cmdio.MockDiscard(t.Context()), m.WorkspaceClient)
+	cmd := withOutput(newGetCommand(), flags.OutputText)
+	cmd.SetContext(ctx)
+
+	err := cmd.RunE(cmd, []string{"5"})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "failed to verify authentication")
+	assert.NotContains(t, err.Error(), "authentication was not successful")
+}
+
+func TestAuthError(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	cmd := withOutput(newGetCommand(), flags.OutputText)
+
+	// No configurable credentials maps to the missing-profile hint.
+	noProfile := authError(ctx, cmd, config.ErrCannotConfigureDefault)
+	require.Error(t, noProfile)
+	assert.Contains(t, noProfile.Error(), "no default profile is set")
+
+	// A 401 / 403 (via the SDK sentinels) is a real auth failure.
+	unauth := authError(ctx, cmd, apierr.ErrUnauthenticated)
+	require.Error(t, unauth)
+	assert.Contains(t, unauth.Error(), "authentication was not successful")
+
+	denied := authError(ctx, cmd, apierr.ErrPermissionDenied)
+	require.Error(t, denied)
+	assert.Contains(t, denied.Error(), "authentication was not successful")
+
+	transient := authError(ctx, cmd, errors.New("connection reset"))
+	require.Error(t, transient)
+	assert.Contains(t, transient.Error(), "failed to verify authentication")
+	assert.Contains(t, transient.Error(), "connection reset")
+}
+
+func TestGetRunNotFoundJSON(t *testing.T) {
+	var buf bytes.Buffer
+	srv := notFoundGetServer(t)
+	ctx := cmdctx.SetWorkspaceClient(t.Context(), newTestWorkspaceClient(t, srv.URL))
+	ctx = cmdio.InContext(ctx, cmdio.NewIO(ctx, flags.OutputJSON, nil, &buf, &buf, "", ""))
+	cmd := withOutput(newGetCommand(), flags.OutputJSON)
+	cmd.SetContext(ctx)
+
+	// In JSON mode the not-found error is a structured envelope, not a bare error.
+	err := cmd.RunE(cmd, []string{"5"})
+	require.ErrorIs(t, err, root.ErrAlreadyPrinted)
+
+	var got errorEnvelope
+	require.NoError(t, json.Unmarshal(buf.Bytes(), &got))
+	assert.Equal(t, jsonError{Code: "NOT_FOUND", Kind: "NOT_FOUND", Message: "run 5 not found: check the run ID and that it is a job run ID"}, got.Error)
+}
+
+func TestGetTemplateSweep(t *testing.T) {
+	out := renderGet(t, getData{
+		RunID:  "456",
+		Status: "RUNNING",
+		Sweep: &sweepInfo{
+			Total: 4, Completed: 2, Succeeded: 1, Failed: 1, Active: 2,
+			Tasks: []sweepTask{
+				{TaskKey: "iter_0", RunID: "789", Status: "SUCCESS", Experiment: "my-exp"},
+				{TaskKey: "iter_1", RunID: "790", Status: "FAILED", Experiment: "my-exp"},
+			},
+		},
+	})
+	assert.Contains(t, out, "Sweep Run ID: 456")
+	assert.Contains(t, out, "Total:        4")
+	assert.Contains(t, out, "Sweep Tasks:")
+	assert.Contains(t, out, "iter_0")
+	assert.Contains(t, out, "iter_1")
+	assert.Contains(t, out, "FAILED")
+	assert.Contains(t, out, "my-exp")
+}
+
+func TestGetTemplateSweepNoTasks(t *testing.T) {
+	// A sweep whose iterations haven't materialized yet: counts show, but the
+	// task table header is hidden.
+	out := renderGet(t, getData{
+		RunID:  "456",
+		Status: "RUNNING",
+		Sweep:  &sweepInfo{Total: 4, Active: 4},
+	})
+	assert.Contains(t, out, "Sweep Run ID: 456")
+	assert.Contains(t, out, "Total:        4")
+	assert.NotContains(t, out, "Sweep Tasks:")
+}
+
+func TestBuildGetData(t *testing.T) {
+	run := &jobs.Run{
+		RunId:           123,
+		CreatorUserName: "me@example.com",
+		StartTime:       1700000000000,
+		EndTime:         1700000012000,
+		State:           &jobs.RunState{ResultState: jobs.RunResultStateSuccess},
+		Tasks: []jobs.RunTask{{
+			AttemptNumber: 1,
+			GenAiComputeTask: &jobs.GenAiComputeTask{
+				MlflowExperimentName: "/Users/me@example.com/exp",
+				Compute:              &jobs.ComputeConfig{NumGpus: 8, GpuType: "GPU_8xH100"},
+			},
+		}},
+	}
+	d := buildGetData(run)
+	assert.Equal(t, "123", d.RunID)
+	assert.Equal(t, "SUCCESS", d.Status)
+	assert.Equal(t, 1, d.AttemptNumber)
+	assert.Equal(t, "2023-11-14 22:13 UTC", d.SubmittedDisplay)
+	assert.Equal(t, "me@example.com", d.UserDisplay)
+	assert.Equal(t, "8x H100", d.AcceleratorsDisplay)
+	assert.Equal(t, "12s", d.DurationDisplay)
+	assert.Equal(t, "exp", d.ExperimentDisplay)
+	require.NotNil(t, d.ExperimentName)
+	assert.Equal(t, "exp", *d.ExperimentName)
+	require.NotNil(t, d.DurationSeconds)
+	assert.Equal(t, int64(12), *d.DurationSeconds)
+}
+
+func TestBuildGetDataTerminationReasonJSON(t *testing.T) {
+	failed := buildGetData(&jobs.Run{
+		RunId: 5,
+		State: &jobs.RunState{ResultState: jobs.RunResultStateFailed},
+		Status: &jobs.RunStatus{TerminationDetails: &jobs.TerminationDetails{
+			Message: "out of memory",
+		}},
+	})
+	body, err := json.Marshal(failed)
+	require.NoError(t, err)
+	assert.JSONEq(t, `{
+		"run_id":"5","status":"FAILED","started_at":null,"duration_seconds":null,
+		"attempt_number":0,"experiment_name":null,"dashboard_url":"","mlflow_url":null,
+		"termination_reason":"out of memory","est_remaining_seconds":null,"est_percent_complete":null
+	}`, string(body))
+
+	canceled := buildGetData(&jobs.Run{RunId: 6, State: &jobs.RunState{ResultState: jobs.RunResultStateCanceled, StateMessage: "user canceled"}})
+	body, err = json.Marshal(canceled)
+	require.NoError(t, err)
+	assert.NotContains(t, string(body), "termination_reason")
+}
+
+func TestGetTemplateUsesDisplayStatus(t *testing.T) {
+	out := renderGet(t, getData{
+		RunID:         "456",
+		Status:        "RUNNING",
+		DisplayStatus: "PENDING",
+		Sweep:         &sweepInfo{Total: 1, Active: 1},
+	})
+	assert.Contains(t, out, "Status:       PENDING")
+}
+
+func TestEnrichFromAiRuntimeTask(t *testing.T) {
+	t.Run("fills config path, experiment, and accelerators", func(t *testing.T) {
+		run := &jobs.Run{RunId: 5, Tasks: []jobs.RunTask{{
+			AiRuntimeTask: &jobs.AiRuntimeTask{
+				Experiment: "/Users/me@example.com/my-exp",
+				Deployments: []jobs.DeploymentSpec{{
+					CommandPath: "/Workspace/run/command.sh",
+					Compute:     jobs.ComputeSpec{AcceleratorType: jobs.ComputeSpecAcceleratorTypeGpu1xA10, AcceleratorCount: 1},
+				}},
+			},
+		}}}
+		data := &getData{ExperimentDisplay: na, AcceleratorsDisplay: na}
+		enrichFromAiRuntimeTask(run, data)
+		assert.Equal(t, "/Workspace/run/training_config.yaml", data.TrainingConfigPath)
+		assert.Equal(t, "my-exp", data.ExperimentDisplay)
+		require.NotNil(t, data.ExperimentName)
+		assert.Equal(t, "my-exp", *data.ExperimentName)
+		assert.Equal(t, "1x A10", data.AcceleratorsDisplay)
+	})
+
+	t.Run("leaves fallbacks when the run has no ai_runtime_task", func(t *testing.T) {
+		run := &jobs.Run{RunId: 5, Tasks: []jobs.RunTask{{}}}
+		data := &getData{ExperimentDisplay: na, AcceleratorsDisplay: na}
+		enrichFromAiRuntimeTask(run, data)
+		assert.Empty(t, data.TrainingConfigPath)
+		assert.Equal(t, na, data.ExperimentDisplay)
+		assert.Equal(t, na, data.AcceleratorsDisplay)
+	})
+}
+
+func TestBuildGetDataEmpty(t *testing.T) {
+	// A run with no tasks, creator, or timing renders every text cell as "N/A".
+	d := buildGetData(&jobs.Run{RunId: 7})
+	assert.Equal(t, "7", d.RunID)
+	assert.Equal(t, na, d.SubmittedDisplay)
+	assert.Equal(t, na, d.DurationDisplay)
+	assert.Equal(t, na, d.ExperimentDisplay)
+	assert.Equal(t, na, d.UserDisplay)
+	assert.Equal(t, na, d.AcceleratorsDisplay)
+}
diff --git a/cmd/air/image.go b/cmd/air/image.go
new file mode 100644
index 00000000000..ccf40bb5db5
--- /dev/null
+++ b/cmd/air/image.go
@@ -0,0 +1,371 @@
+package aircmd
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"regexp"
+	"strings"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/spf13/cobra"
+)
+
+const (
+	maxImageRepositoryLength = 255
+	maxImageTagLength        = 128
+	airImagePlatform         = "linux/amd64"
+)
+
+var (
+	// DAR uses the OCI repository-component grammar without dots or slashes,
+	// which are forbidden in Unity Catalog names.
+	artifactNamePattern = regexp.MustCompile(`^[a-z0-9]+((_|__|-+)[a-z0-9]+)*$`)
+	imageTagPattern     = regexp.MustCompile(`^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$`)
+)
+
+type imagePushOptions struct {
+	source   string
+	catalog  string
+	schema   string
+	artifact string
+	pull     bool
+}
+
+type resolvedImagePushOptions struct {
+	source   string
+	catalog  string
+	schema   string
+	artifact string
+	tag      string
+}
+
+type imagePushDeps struct {
+	configureDocker func(context.Context, string) (string, error)
+	lookPath        func(string) (string, error)
+	runCommand      func(context.Context, io.Reader, io.Writer, io.Writer, string, ...string) error
+}
+
+// defaultImagePushDeps connects image-push operations to the real CLI and Docker executables.
+func defaultImagePushDeps() imagePushDeps {
+	return imagePushDeps{
+		configureDocker: configureImageDocker,
+		lookPath:        exec.LookPath,
+		runCommand:      runImageCommand,
+	}
+}
+
+// configureImageDocker configures authentication through the CLI and returns the resolved registry host.
+func configureImageDocker(ctx context.Context, profile string) (string, error) {
+	executable, err := os.Executable()
+	if err != nil {
+		return "", fmt.Errorf("locate databricks executable: %w", err)
+	}
+
+	var output bytes.Buffer
+	cmd := exec.CommandContext(ctx, executable, "auth", "docker", "configure", profile)
+	cmd.Stdout = &output
+	cmd.Stderr = &output
+	if err := cmd.Run(); err != nil {
+		if details := strings.TrimSpace(output.String()); details != "" {
+			return "", fmt.Errorf("run auth docker configure: %w: %s", err, details)
+		}
+		return "", fmt.Errorf("run auth docker configure: %w", err)
+	}
+
+	registryHost, err := registryHostFromDockerConfigureOutput(output.String())
+	if err != nil {
+		return "", err
+	}
+	if message := strings.TrimSuffix(output.String(), "\n"); message != "" {
+		cmdio.LogString(ctx, message)
+	}
+	return registryHost, nil
+}
+
+// registryHostFromDockerConfigureOutput extracts the DAR host printed by auth docker configure.
+func registryHostFromDockerConfigureOutput(output string) (string, error) {
+	const prefix = "Configured Docker credential helper for "
+	for line := range strings.Lines(output) {
+		if registryHost, found := strings.CutPrefix(strings.TrimSpace(line), prefix); found && strings.Contains(registryHost, ".container.") {
+			return registryHost, nil
+		}
+	}
+	return "", errors.New("auth docker configure did not report an Artifact Registry host")
+}
+
+// newImagesCommand creates the AIR images command group and registers its subcommands.
+func newImagesCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "images",
+		Short: "Manage container images for AI Runtime",
+		RunE:  root.ReportUnknownSubcommand,
+	}
+	cmd.AddCommand(newImagePushCommand())
+	return cmd
+}
+
+// newImagePushCommand creates the push command with production dependencies.
+func newImagePushCommand() *cobra.Command {
+	return newImagePushCommandWithDeps(defaultImagePushDeps())
+}
+
+// newImagePushCommandWithDeps defines push flags and handlers with injectable dependencies.
+func newImagePushCommandWithDeps(deps imagePushDeps) *cobra.Command {
+	var opts imagePushOptions
+	cmd := &cobra.Command{
+		Use:   "push",
+		Short: "Push a container image to Databricks Artifact Registry",
+		Long: `Push a container image to Databricks Artifact Registry under the specified Unity Catalog catalog and schema.
+
+The command configures Docker's Databricks credential helper, automatically detects
+the registry region, and pushes the source image to catalog.schema.artifact:tag.
+Omitted image details are prompted for when the terminal is interactive.
+
+AIR requires linux/amd64 images. A compatible local image is reused; missing images
+are pulled for linux/amd64. Use --pull to refresh an existing local image.
+The destination --artifact ARTIFACT[:TAG] defaults to the source image name and tag.`,
+		Args:    root.NoArgs,
+		PreRunE: root.MustWorkspaceClient,
+		RunE: func(cmd *cobra.Command, _ []string) error {
+			return runImagePush(cmd, &opts, deps)
+		},
+	}
+
+	cmd.Flags().StringVarP(&opts.source, "source", "s", "", "Source container image to push (NAME[:TAG] or NAME@DIGEST)")
+	cmd.Flags().StringVar(&opts.catalog, "catalog", "", "Destination Unity Catalog catalog; use lowercase letters and digits separated by one or two underscores or one or more hyphens")
+	cmd.Flags().StringVar(&opts.schema, "schema", "", "Destination Unity Catalog schema; use lowercase letters and digits separated by one or two underscores or one or more hyphens")
+	cmd.Flags().StringVar(&opts.artifact, "artifact", "", "Destination ARTIFACT[:TAG]; defaults to the source image name and tag (latest if untagged); maximum 255 characters for catalog.schema.artifact and 128 for the tag")
+	cmd.Flags().BoolVar(&opts.pull, "pull", false, "Pull the source image even when it is already available locally")
+	return cmd
+}
+
+// runImagePush validates inputs, prepares a compatible source image, and pushes it to DAR.
+func runImagePush(cmd *cobra.Command, opts *imagePushOptions, deps imagePushDeps) error {
+	ctx := cmd.Context()
+	cmdio.LogString(ctx, "Warning: This feature is in Preview. APIs may change, and the workspace must enable the Preview features.")
+	w := cmdctx.WorkspaceClient(ctx)
+
+	resolved, err := resolveImagePushOptions(ctx, opts)
+	if err != nil {
+		return err
+	}
+	if w.Config.Profile == "" {
+		return errors.New("air images push requires a workspace profile so Docker can refresh credentials; authenticate with 'databricks auth login' and pass --profile")
+	}
+	dockerPath, err := deps.lookPath("docker")
+	if err != nil {
+		return fmt.Errorf("find Docker on PATH: %w", err)
+	}
+
+	unityCatalogReference := fmt.Sprintf("%s.%s.%s:%s", resolved.catalog, resolved.schema, resolved.artifact, resolved.tag)
+	cmdio.LogString(ctx, fmt.Sprintf("Pushing %s as %s using profile %s", resolved.source, unityCatalogReference, w.Config.Profile))
+
+	registryHost, err := deps.configureDocker(ctx, w.Config.Profile)
+	if err != nil {
+		return fmt.Errorf("configure Docker authentication: %w", err)
+	}
+	target := fmt.Sprintf("%s/%s", registryHost, unityCatalogReference)
+
+	pull := opts.pull
+	if !pull {
+		exists, err := imageExistsLocally(ctx, deps.runCommand, dockerPath, resolved.source, cmd.ErrOrStderr())
+		if err != nil {
+			return err
+		}
+		pull = !exists
+	}
+	if pull {
+		cmdio.LogProgress(ctx, "Pulling source image "+resolved.source+" for "+airImagePlatform)
+		if err := deps.runCommand(ctx, cmd.InOrStdin(), cmd.ErrOrStderr(), cmd.ErrOrStderr(), dockerPath, "pull", "--platform", airImagePlatform, resolved.source); err != nil {
+			return fmt.Errorf("pull source image %s: %w", resolved.source, err)
+		}
+	} else {
+		cmdio.LogString(ctx, "Using local source image "+resolved.source)
+	}
+
+	var platform bytes.Buffer
+	if err := deps.runCommand(ctx, nil, &platform, cmd.ErrOrStderr(), dockerPath, "image", "inspect", "--format", "{{.Os}}/{{.Architecture}}", resolved.source); err != nil {
+		return fmt.Errorf("inspect source image %s: %w", resolved.source, err)
+	}
+	if got := strings.TrimSpace(platform.String()); got != airImagePlatform {
+		return fmt.Errorf("source image %s has platform %q; AIR requires %s: use --pull to fetch a compatible image, or rebuild the source for %s", resolved.source, got, airImagePlatform, airImagePlatform)
+	}
+
+	cmdio.LogProgress(ctx, "Tagging image as "+target)
+	if err := deps.runCommand(ctx, cmd.InOrStdin(), cmd.ErrOrStderr(), cmd.ErrOrStderr(), dockerPath, "tag", resolved.source, target); err != nil {
+		return fmt.Errorf("tag source image %s: %w", resolved.source, err)
+	}
+	cmdio.LogProgress(ctx, "Pushing image to "+target)
+	if err := deps.runCommand(ctx, cmd.InOrStdin(), cmd.ErrOrStderr(), cmd.ErrOrStderr(), dockerPath, "push", target); err != nil {
+		return fmt.Errorf("push image %s: %w", target, err)
+	}
+
+	cmdio.LogString(ctx, "Pushed image.")
+	if root.OutputType(cmd) == flags.OutputJSON {
+		return renderEnvelope(ctx, struct {
+			UnityCatalogImage string `json:"unity_catalog_image"`
+			RegistryImage     string `json:"registry_image"`
+		}{UnityCatalogImage: unityCatalogReference, RegistryImage: target})
+	}
+	_, err = fmt.Fprintf(
+		cmd.OutOrStdout(),
+		"Now you can set `environment.unity_catalog_image = %s` in your YAML config and create a workload with `databricks air run -f config.yaml`.\n",
+		unityCatalogReference,
+	)
+	return err
+}
+
+// resolveImagePushOptions fills in missing inputs and validates the full Unity Catalog destination.
+func resolveImagePushOptions(
+	ctx context.Context,
+	opts *imagePushOptions,
+) (resolvedImagePushOptions, error) {
+	source, err := promptImagePushValue(ctx, opts.source, "Source image", "", "--source")
+	if err != nil {
+		return resolvedImagePushOptions{}, err
+	}
+	catalog, err := promptImagePushValue(ctx, opts.catalog, "Unity Catalog catalog", "", "--catalog")
+	if err != nil {
+		return resolvedImagePushOptions{}, err
+	}
+	if !artifactNamePattern.MatchString(catalog) {
+		return resolvedImagePushOptions{}, fmt.Errorf("invalid catalog %q: use lowercase letters and digits separated by one or two underscores or one or more hyphens", catalog)
+	}
+	schema, err := promptImagePushValue(ctx, opts.schema, "Unity Catalog schema", "", "--schema")
+	if err != nil {
+		return resolvedImagePushOptions{}, err
+	}
+	if !artifactNamePattern.MatchString(schema) {
+		return resolvedImagePushOptions{}, fmt.Errorf("invalid schema %q: use lowercase letters and digits separated by one or two underscores or one or more hyphens", schema)
+	}
+
+	defaultArtifact, defaultTag := sourceImageDefaults(source)
+	artifact, tag, err := resolveArtifactAndTag(ctx, opts.artifact, defaultArtifact, defaultTag)
+	if err != nil {
+		return resolvedImagePushOptions{}, err
+	}
+	// Docker limits the repository path, including both dots but excluding the registry and tag.
+	if len(catalog)+len(schema)+len(artifact)+2 > maxImageRepositoryLength {
+		return resolvedImagePushOptions{}, fmt.Errorf("invalid image repository name: catalog.schema.artifact must be %d characters or less", maxImageRepositoryLength)
+	}
+
+	return resolvedImagePushOptions{
+		source:   source,
+		catalog:  catalog,
+		schema:   schema,
+		artifact: artifact,
+		tag:      tag,
+	}, nil
+}
+
+// promptImagePushValue prompts for a missing value or uses its default when prompting is unavailable.
+func promptImagePushValue(ctx context.Context, value, label, defaultValue, flag string) (string, error) {
+	if value != "" {
+		return value, nil
+	}
+	if !cmdio.IsPromptSupported(ctx) {
+		if defaultValue != "" {
+			return defaultValue, nil
+		}
+		return "", fmt.Errorf("%s is required when prompting is unavailable", flag)
+	}
+	value, err := cmdio.Ask(ctx, label, defaultValue)
+	if err != nil {
+		return "", err
+	}
+	if value == "" {
+		return "", fmt.Errorf("%s is required", flag)
+	}
+	return value, nil
+}
+
+// resolveArtifactAndTag resolves the destination artifact and tag, then validates their naming rules.
+func resolveArtifactAndTag(ctx context.Context, image, defaultArtifact, defaultTag string) (string, string, error) {
+	artifact := image
+	tag := defaultTag
+	if image == "" {
+		var err error
+		artifact, err = promptImagePushValue(ctx, "", "Artifact name", defaultArtifact, "--artifact")
+		if err != nil {
+			return "", "", err
+		}
+		if cmdio.IsPromptSupported(ctx) {
+			tag, err = cmdio.Ask(ctx, "Tag", defaultTag)
+			if err != nil {
+				return "", "", err
+			}
+		}
+	} else if before, after, found := strings.Cut(image, ":"); found {
+		artifact = before
+		tag = after
+	}
+
+	if !artifactNamePattern.MatchString(artifact) {
+		return "", "", fmt.Errorf("invalid artifact name %q: use lowercase letters and digits separated by one or two underscores or one or more hyphens", artifact)
+	}
+	if tag == "" {
+		tag = "latest"
+	}
+	if len(tag) > maxImageTagLength {
+		return "", "", fmt.Errorf("invalid image tag: must be %d characters or less", maxImageTagLength)
+	}
+	if !imageTagPattern.MatchString(tag) {
+		return "", "", fmt.Errorf("invalid image tag %q", tag)
+	}
+	return artifact, tag, nil
+}
+
+// sourceImageDefaults extracts artifact/tag defaults, leaving the artifact empty when its name is invalid.
+func sourceImageDefaults(source string) (string, string) {
+	source, _, _ = strings.Cut(source, "@")
+	repository := source
+	tag := "latest"
+	lastSlash := strings.LastIndex(source, "/")
+	if lastColon := strings.LastIndex(source, ":"); lastColon > lastSlash {
+		repository = source[:lastColon]
+		tag = source[lastColon+1:]
+	}
+	artifact := repository[strings.LastIndex(repository, "/")+1:]
+	if !artifactNamePattern.MatchString(artifact) {
+		artifact = ""
+	}
+	return artifact, tag
+}
+
+// imageExistsLocally checks Docker's local image list and propagates operational failures.
+func imageExistsLocally(
+	ctx context.Context,
+	runCommand func(context.Context, io.Reader, io.Writer, io.Writer, string, ...string) error,
+	dockerPath, source string,
+	errOut io.Writer,
+) (bool, error) {
+	// Listing succeeds with empty output for a missing image, but fails for
+	// operational errors such as an unavailable daemon. Inspect cannot distinguish them.
+	// https://docs.docker.com/reference/cli/docker/image/ls/
+	// Match Docker's implicit latest tag rather than listing every tag of a repository.
+	if !strings.Contains(source, "@") && !strings.Contains(source[strings.LastIndex(source, "/")+1:], ":") {
+		source += ":latest"
+	}
+	var output bytes.Buffer
+	if err := runCommand(ctx, nil, &output, errOut, dockerPath, "image", "ls", "--quiet", source); err != nil {
+		return false, fmt.Errorf("check local source image %s (ensure Docker is running and accessible): %w", source, err)
+	}
+	return strings.TrimSpace(output.String()) != "", nil
+}
+
+// runImageCommand runs a subprocess with the supplied context and I/O streams.
+func runImageCommand(ctx context.Context, in io.Reader, out, errOut io.Writer, executable string, args ...string) error {
+	cmd := exec.CommandContext(ctx, executable, args...)
+	cmd.Stdin = in
+	cmd.Stdout = out
+	cmd.Stderr = errOut
+	return cmd.Run()
+}
diff --git a/cmd/air/image_test.go b/cmd/air/image_test.go
new file mode 100644
index 00000000000..12e72c1f0cc
--- /dev/null
+++ b/cmd/air/image_test.go
@@ -0,0 +1,330 @@
+package aircmd
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"io"
+	"strings"
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/config"
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type recordedImageCommand struct {
+	executable string
+	args       []string
+}
+
+func newImagePushTestCommand(t *testing.T, profile string) (*cobra.Command, *bytes.Buffer, *bytes.Buffer) {
+	t.Helper()
+	stdout := &bytes.Buffer{}
+	stderr := &bytes.Buffer{}
+	ctx := cmdio.InContext(t.Context(), cmdio.NewIO(t.Context(), flags.OutputText, strings.NewReader(""), stdout, stderr, "", ""))
+	ctx = cmdctx.SetWorkspaceClient(ctx, &databricks.WorkspaceClient{Config: &config.Config{Profile: profile}})
+	cmd := &cobra.Command{Use: "push"}
+	cmd.SetContext(ctx)
+	cmd.SetIn(strings.NewReader(""))
+	cmd.SetOut(stdout)
+	cmd.SetErr(stderr)
+	return withOutput(cmd, flags.OutputText), stdout, stderr
+}
+
+func TestRunImagePushTagsAndPushesLocalImage(t *testing.T) {
+	cmd, stdout, stderr := newImagePushTestCommand(t, "workspace")
+	var commands []recordedImageCommand
+	deps := imagePushDeps{
+		configureDocker: func(_ context.Context, profile string) (string, error) {
+			assert.Equal(t, "workspace", profile)
+			return "123.container.us-west-2.cloud.databricks.test", nil
+		},
+		lookPath: func(name string) (string, error) {
+			assert.Equal(t, "docker", name)
+			return "/usr/bin/docker", nil
+		},
+		runCommand: func(_ context.Context, _ io.Reader, out, _ io.Writer, executable string, args ...string) error {
+			commands = append(commands, recordedImageCommand{executable: executable, args: args})
+			switch strings.Join(args[:2], " ") {
+			case "image ls":
+				_, err := io.WriteString(out, "image-id\n")
+				return err
+			case "image inspect":
+				_, err := io.WriteString(out, "linux/amd64\n")
+				return err
+			}
+			return nil
+		},
+	}
+
+	err := runImagePush(cmd, &imagePushOptions{
+		source:   "nvidia/cuda:13.4.1",
+		catalog:  "main",
+		schema:   "training",
+		artifact: "cuda",
+	}, deps)
+	require.NoError(t, err)
+
+	target := "123.container.us-west-2.cloud.databricks.test/main.training.cuda:13.4.1"
+	assert.Equal(t, []recordedImageCommand{
+		{executable: "/usr/bin/docker", args: []string{"image", "ls", "--quiet", "nvidia/cuda:13.4.1"}},
+		{executable: "/usr/bin/docker", args: []string{"image", "inspect", "--format", "{{.Os}}/{{.Architecture}}", "nvidia/cuda:13.4.1"}},
+		{executable: "/usr/bin/docker", args: []string{"tag", "nvidia/cuda:13.4.1", target}},
+		{executable: "/usr/bin/docker", args: []string{"push", target}},
+	}, commands)
+	assert.Equal(t,
+		"Now you can set `environment.unity_catalog_image = main.training.cuda:13.4.1` in your YAML config and create a workload with `databricks air run -f config.yaml`.\n",
+		stdout.String(),
+	)
+	stderrLines := strings.Split(stderr.String(), "\n")
+	assert.Equal(t, "Warning: This feature is in Preview. APIs may change, and the workspace must enable the Preview features.", stderrLines[0])
+	assert.Contains(t, stderr.String(), "Pushed image")
+}
+
+func TestRegistryHostFromDockerConfigureOutput(t *testing.T) {
+	output := `Configured Docker credential helper for 123.container.us-west-2.cloud.databricks.test
+Updated Docker config: /tmp/docker/config.json
+Installed Docker credential helper: /tmp/bin/docker-credential-databricks`
+
+	host, err := registryHostFromDockerConfigureOutput(output)
+	require.NoError(t, err)
+	assert.Equal(t, "123.container.us-west-2.cloud.databricks.test", host)
+
+	_, err = registryHostFromDockerConfigureOutput("Docker authentication configured")
+	assert.ErrorContains(t, err, "did not report an Artifact Registry host")
+}
+
+func TestRunImagePushPullsMissingImage(t *testing.T) {
+	cmd, _, _ := newImagePushTestCommand(t, "workspace")
+	var commands []recordedImageCommand
+	deps := imagePushDeps{
+		configureDocker: func(context.Context, string) (string, error) {
+			return "123.container.us-west-2.cloud.databricks.test", nil
+		},
+		lookPath: func(string) (string, error) { return "docker", nil },
+		runCommand: func(_ context.Context, _ io.Reader, out, _ io.Writer, executable string, args ...string) error {
+			commands = append(commands, recordedImageCommand{executable: executable, args: args})
+			if args[0] == "image" && args[1] == "inspect" {
+				_, err := io.WriteString(out, "linux/amd64\n")
+				return err
+			}
+			return nil
+		},
+	}
+
+	err := runImagePush(cmd, &imagePushOptions{
+		source:   "example/image:v1",
+		catalog:  "main",
+		schema:   "training",
+		artifact: "artifact:v2",
+	}, deps)
+	require.NoError(t, err)
+
+	require.Len(t, commands, 5)
+	assert.Equal(t, []string{"pull", "--platform", "linux/amd64", "example/image:v1"}, commands[1].args)
+}
+
+func TestRunImagePushRequiresWorkspaceProfile(t *testing.T) {
+	cmd, _, _ := newImagePushTestCommand(t, "")
+	deps := imagePushDeps{}
+
+	err := runImagePush(cmd, &imagePushOptions{
+		source:   "example/image:v1",
+		catalog:  "main",
+		schema:   "training",
+		artifact: "artifact:v1",
+	}, deps)
+	assert.ErrorContains(t, err, "air images push requires a workspace profile")
+}
+
+func TestResolveImagePushOptionsRequiresFlagsWithoutPrompt(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	_, err := resolveImagePushOptions(ctx, &imagePushOptions{})
+	assert.ErrorContains(t, err, "--source is required when prompting is unavailable")
+}
+
+func TestResolveImagePushOptionsValidatesCatalogAndSchema(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	tests := []struct {
+		name    string
+		catalog string
+		schema  string
+		want    string
+	}{
+		{name: "hyphens", catalog: "my-catalog", schema: "my-schema"},
+		{name: "double underscores", catalog: "my__catalog", schema: "my__schema"},
+		{name: "repeated hyphens", catalog: "my---catalog", schema: "my---schema"},
+		{name: "uppercase catalog", catalog: "Main", schema: "training", want: "invalid catalog"},
+		{name: "leading hyphen", catalog: "-catalog", schema: "training", want: "invalid catalog"},
+		{name: "mixed separators", catalog: "main", schema: "team_-training", want: "invalid schema"},
+		{name: "triple underscore", catalog: "main", schema: "team___training", want: "invalid schema"},
+		{name: "uppercase schema", catalog: "main", schema: "Training", want: "invalid schema"},
+		{name: "dotted schema", catalog: "main", schema: "team.training", want: "invalid schema"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, err := resolveImagePushOptions(ctx, &imagePushOptions{
+				source:   "example/image:v1",
+				catalog:  tt.catalog,
+				schema:   tt.schema,
+				artifact: "artifact:v1",
+			})
+			if tt.want == "" {
+				require.NoError(t, err)
+				return
+			}
+			assert.ErrorContains(t, err, tt.want)
+		})
+	}
+}
+
+func TestResolveImagePushOptionsRepositoryLength(t *testing.T) {
+	for _, tt := range []struct {
+		name      string
+		catalog   string
+		schema    string
+		artifact  string
+		wantError bool
+	}{
+		{name: "255 character repository", catalog: "main", schema: "training", artifact: strings.Repeat("a", 241)},
+		{name: "256 character repository", catalog: "main", schema: "training", artifact: strings.Repeat("a", 242), wantError: true},
+		{name: "255 character artifact exceeds repository limit", catalog: "main", schema: "training", artifact: strings.Repeat("a", 255), wantError: true},
+		{name: "catalog counts toward limit", catalog: strings.Repeat("c", 255), schema: "s", artifact: "a", wantError: true},
+		{name: "schema counts toward limit", catalog: "c", schema: strings.Repeat("s", 255), artifact: "a", wantError: true},
+		{name: "tag excluded from repository length", catalog: "main", schema: "training", artifact: strings.Repeat("a", 241) + ":" + strings.Repeat("t", 128)},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			_, err := resolveImagePushOptions(cmdio.MockDiscard(t.Context()), &imagePushOptions{
+				source:   "example/image:v1",
+				catalog:  tt.catalog,
+				schema:   tt.schema,
+				artifact: tt.artifact,
+			})
+			if tt.wantError {
+				require.ErrorContains(t, err, "catalog.schema.artifact must be 255 characters or less")
+				return
+			}
+			require.NoError(t, err)
+		})
+	}
+}
+
+func TestResolveArtifactAndTagValidation(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	tests := []struct {
+		name  string
+		image string
+		want  string
+	}{
+		{name: "slash", image: "team/artifact:v1", want: "invalid artifact name"},
+		{name: "dot", image: "artifact.name:v1", want: "invalid artifact name"},
+		{name: "uppercase artifact", image: "Artifact:v1", want: "invalid artifact name"},
+		{name: "leading separator", image: "_artifact:v1", want: "invalid artifact name"},
+		{name: "trailing separator", image: "artifact-:v1", want: "invalid artifact name"},
+		{name: "three underscores", image: "artifact___name:v1", want: "invalid artifact name"},
+		{name: "space", image: "artifact:bad tag", want: "invalid image tag"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, _, err := resolveArtifactAndTag(ctx, tt.image, "", "latest")
+			assert.ErrorContains(t, err, tt.want)
+		})
+	}
+}
+
+func TestResolveArtifactAndTagLength(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	tests := []struct {
+		name      string
+		image     string
+		wantError string
+	}{
+		{name: "128 character tag", image: "artifact:" + strings.Repeat("a", 128)},
+		{name: "129 character tag", image: "artifact:" + strings.Repeat("a", 129), wantError: "invalid image tag: must be 128 characters or less"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, _, err := resolveArtifactAndTag(ctx, tt.image, "", "latest")
+			if tt.wantError == "" {
+				require.NoError(t, err)
+				return
+			}
+			assert.ErrorContains(t, err, tt.wantError)
+		})
+	}
+}
+
+func TestSourceImageDefaults(t *testing.T) {
+	tests := []struct {
+		source       string
+		wantArtifact string
+		wantTag      string
+	}{
+		{source: "nvidia/cuda:13.4.1", wantArtifact: "cuda", wantTag: "13.4.1"},
+		{source: "registry.example.test:5000/team/image", wantArtifact: "image", wantTag: "latest"},
+		{source: "team/image.with-dot:v1", wantArtifact: "", wantTag: "v1"},
+		{source: "team/image@sha256:abc123", wantArtifact: "image", wantTag: "latest"},
+		{source: "team/image:v1@sha256:abc123", wantArtifact: "image", wantTag: "v1"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.source, func(t *testing.T) {
+			artifact, tag := sourceImageDefaults(tt.source)
+			assert.Equal(t, tt.wantArtifact, artifact)
+			assert.Equal(t, tt.wantTag, tag)
+		})
+	}
+}
+
+func TestResolveArtifactAndTagAcceptsSupportedSeparators(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	for _, artifact := range []string{"artifact_name", "artifact__name", "artifact---name"} {
+		t.Run(artifact, func(t *testing.T) {
+			gotArtifact, gotTag, err := resolveArtifactAndTag(ctx, artifact+":Tag_1.2-rc", "", "latest")
+			require.NoError(t, err)
+			assert.Equal(t, artifact, gotArtifact)
+			assert.Equal(t, "Tag_1.2-rc", gotTag)
+		})
+	}
+}
+
+func TestImageExistsLocally(t *testing.T) {
+	for _, tt := range []struct {
+		name      string
+		source    string
+		wantQuery string
+		output    string
+		err       error
+		want      bool
+	}{
+		{name: "missing", source: "team/image:v1", wantQuery: "team/image:v1"},
+		{name: "present", source: "team/image:v1", wantQuery: "team/image:v1", output: "image-id\n", want: true},
+		{name: "implicit latest", source: "team/image", wantQuery: "team/image:latest"},
+		{name: "registry port", source: "registry.example.test:5000/team/image", wantQuery: "registry.example.test:5000/team/image:latest"},
+		{name: "digest", source: "team/image@sha256:abc123", wantQuery: "team/image@sha256:abc123"},
+		{name: "daemon error", source: "team/image:v1", wantQuery: "team/image:v1", err: errors.New("daemon unavailable")},
+		{name: "canceled", source: "team/image:v1", wantQuery: "team/image:v1", err: context.Canceled},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			run := func(_ context.Context, _ io.Reader, out, _ io.Writer, executable string, args ...string) error {
+				assert.Equal(t, "docker", executable)
+				assert.Equal(t, []string{"image", "ls", "--quiet", tt.wantQuery}, args)
+				_, err := io.WriteString(out, tt.output)
+				require.NoError(t, err)
+				return tt.err
+			}
+			got, err := imageExistsLocally(t.Context(), run, "docker", tt.source, io.Discard)
+			if tt.err != nil {
+				require.ErrorIs(t, err, tt.err)
+			} else {
+				require.NoError(t, err)
+			}
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
diff --git a/cmd/air/joblist.go b/cmd/air/joblist.go
new file mode 100644
index 00000000000..dd786d8b496
--- /dev/null
+++ b/cmd/air/joblist.go
@@ -0,0 +1,180 @@
+package aircmd
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"golang.org/x/sync/errgroup"
+)
+
+// hydrateConcurrency bounds the parallel runs/get calls when hydrating a batch
+// of run ids from the AiTrainingService index.
+const hydrateConcurrency = 16
+
+// firstTask returns the run's first task, unwrapping a foreach sweep to the
+// iterated task, or nil when the run has no tasks.
+func firstTask(r *jobs.Run) *jobs.RunTask {
+	if len(r.Tasks) == 0 {
+		return nil
+	}
+	t := &r.Tasks[0]
+	if t.AiRuntimeTask != nil || t.GenAiComputeTask != nil {
+		return t
+	}
+	if t.ForEachTask != nil {
+		// The foreach inner task is a jobs.Task; expose the AI fields via a
+		// synthetic RunTask so callers can treat both shapes uniformly.
+		return &jobs.RunTask{
+			AiRuntimeTask:    t.ForEachTask.Task.AiRuntimeTask,
+			GenAiComputeTask: t.ForEachTask.Task.GenAiComputeTask,
+		}
+	}
+	return t
+}
+
+// isAirRun reports whether a run is an AI runtime workload: an ai_runtime_task,
+// or a legacy gen_ai_compute_task with a training script.
+func isAirRun(r *jobs.Run) bool {
+	t := firstTask(r)
+	if t == nil {
+		return false
+	}
+	return t.AiRuntimeTask != nil ||
+		(t.GenAiComputeTask != nil && t.GenAiComputeTask.TrainingScriptPath != "")
+}
+
+// isSweep reports whether the run's first task fans out into iterations.
+func isSweep(r *jobs.Run) bool {
+	return len(r.Tasks) > 0 && r.Tasks[0].ForEachTask != nil
+}
+
+// taskRunID returns the run id of the AIR task, used to fetch its MLflow output.
+func taskRunID(r *jobs.Run) int64 {
+	if len(r.Tasks) == 0 {
+		return 0
+	}
+	return r.Tasks[0].RunId
+}
+
+// jobExperiment returns the run's MLflow experiment name (user-folder prefix
+// stripped), or "" when there is none.
+func jobExperiment(r *jobs.Run) string {
+	t := firstTask(r)
+	switch {
+	case t == nil:
+		return ""
+	case t.AiRuntimeTask != nil && t.AiRuntimeTask.Experiment != "":
+		return stripExperimentUserPrefix(t.AiRuntimeTask.Experiment)
+	case t.GenAiComputeTask != nil && t.GenAiComputeTask.MlflowExperimentName != "":
+		return stripExperimentUserPrefix(t.GenAiComputeTask.MlflowExperimentName)
+	}
+	return ""
+}
+
+// jobCompute returns the run's accelerator type and count, or ("", 0) when it
+// has none.
+func jobCompute(r *jobs.Run) (string, int) {
+	t := firstTask(r)
+	switch {
+	case t == nil:
+		return "", 0
+	case t.AiRuntimeTask != nil && len(t.AiRuntimeTask.Deployments) > 0:
+		c := t.AiRuntimeTask.Deployments[0].Compute
+		return string(c.AcceleratorType), c.AcceleratorCount
+	case t.GenAiComputeTask != nil && t.GenAiComputeTask.Compute != nil:
+		c := t.GenAiComputeTask.Compute
+		return c.GpuType, c.NumGpus
+	}
+	return "", 0
+}
+
+// jobTiming returns the run's start and end times (epoch ms), preferring the
+// first task's window so a run reports its task attempt rather than the wrapper.
+func jobTiming(r *jobs.Run) (startMillis, endMillis int64) {
+	startMillis, endMillis = r.StartTime, r.EndTime
+	if len(r.Tasks) > 0 {
+		if t := r.Tasks[0]; t.StartTime > 0 {
+			startMillis = t.StartTime
+			endMillis = t.EndTime
+		}
+	}
+	return startMillis, endMillis
+}
+
+// isTerminal reports whether a run has finished and its details are immutable,
+// so its row is safe to cache.
+func isTerminal(r *jobs.Run) bool {
+	if r.State == nil {
+		return false
+	}
+	switch r.State.LifeCycleState {
+	case jobs.RunLifeCycleStateTerminated, jobs.RunLifeCycleStateInternalError, jobs.RunLifeCycleStateSkipped:
+		return true
+	default:
+		return false
+	}
+}
+
+// baseRunToRun converts a runs/list BaseRun into a Run so the display helpers
+// operate on a single type. The two share every field the list path reads.
+func baseRunToRun(b jobs.BaseRun) *jobs.Run {
+	return &jobs.Run{
+		RunId:           b.RunId,
+		RunName:         b.RunName,
+		CreatorUserName: b.CreatorUserName,
+		StartTime:       b.StartTime,
+		EndTime:         b.EndTime,
+		State:           b.State,
+		Tasks:           b.Tasks,
+	}
+}
+
+// fetchJobRun fetches a single run via runs/get; expand_tasks is implied by the
+// typed SDK, which returns the ai_runtime_task in the response.
+func fetchJobRun(ctx context.Context, w *databricks.WorkspaceClient, runID int64) (*jobs.Run, error) {
+	run, err := w.Jobs.GetRun(ctx, jobs.GetRunRequest{RunId: runID})
+	if err != nil {
+		return nil, fmt.Errorf("failed to get run %d: %w", runID, err)
+	}
+	return run, nil
+}
+
+// hydrateJobRuns fetches the given run ids concurrently via runs/get, preserving
+// input order. runs/get enforces per-run view ACLs, so an id the caller can't
+// view (403) or that has been purged (404) is dropped; any other error is
+// systemic and fails the whole batch.
+func hydrateJobRuns(ctx context.Context, w *databricks.WorkspaceClient, ids []int64) ([]*jobs.Run, error) {
+	runs := make([]*jobs.Run, len(ids))
+	g, gctx := errgroup.WithContext(ctx)
+	g.SetLimit(hydrateConcurrency)
+	for i, id := range ids {
+		g.Go(func() error {
+			run, err := fetchJobRun(gctx, w, id)
+			if err != nil {
+				if apiErr, ok := errors.AsType[*apierr.APIError](err); ok &&
+					(apiErr.StatusCode == http.StatusForbidden || apiErr.StatusCode == http.StatusNotFound) {
+					return nil // not viewable or purged: drop this id
+				}
+				return fmt.Errorf("failed to get run %d: %w", id, err)
+			}
+			runs[i] = run
+			return nil
+		})
+	}
+	if err := g.Wait(); err != nil {
+		return nil, err
+	}
+
+	hydrated := make([]*jobs.Run, 0, len(runs))
+	for _, run := range runs {
+		if run != nil {
+			hydrated = append(hydrated, run)
+		}
+	}
+	return hydrated, nil
+}
diff --git a/cmd/air/joblist_test.go b/cmd/air/joblist_test.go
new file mode 100644
index 00000000000..11e5efac8e9
--- /dev/null
+++ b/cmd/air/joblist_test.go
@@ -0,0 +1,47 @@
+package aircmd
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// runGetServer serves one runs/get body and a stub for the SDK config probe.
+func runGetServer(t *testing.T, body string) *httptest.Server {
+	t.Helper()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/api/2.2/jobs/runs/get" {
+			_, _ = w.Write([]byte(body))
+			return
+		}
+		_, _ = w.Write([]byte(`{}`))
+	}))
+	t.Cleanup(srv.Close)
+	return srv
+}
+
+func TestFetchJobRunParsesAiRuntimeTask(t *testing.T) {
+	body := `{
+		"run_id": 5,
+		"tasks": [{
+			"ai_runtime_task": {
+				"experiment": "my-exp",
+				"deployments": [{
+					"command_path": "/Workspace/Users/me/.air/cli_launch/my-exp/my-exp_abc/command.sh",
+					"compute": {"accelerator_count": 1, "accelerator_type": "GPU_1xA10"}
+				}]
+			}
+		}]
+	}`
+	srv := runGetServer(t, body)
+
+	run, err := fetchJobRun(t.Context(), newTestWorkspaceClient(t, srv.URL), 5)
+	require.NoError(t, err)
+	assert.Equal(t, "my-exp", jobExperiment(run))
+	gpuType, count := jobCompute(run)
+	assert.Equal(t, "GPU_1xA10", gpuType)
+	assert.Equal(t, 1, count)
+}
diff --git a/cmd/air/list.go b/cmd/air/list.go
new file mode 100644
index 00000000000..4b5c623eccc
--- /dev/null
+++ b/cmd/air/list.go
@@ -0,0 +1,366 @@
+package aircmd
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/listing"
+	"github.com/databricks/databricks-sdk-go/service/iam"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/spf13/cobra"
+	"golang.org/x/sync/errgroup"
+)
+
+// maxListScan bounds how many runs `air list` inspects while looking for AIR runs
+// that match the filters. runs/list returns runs of every kind, so this caps the
+// work on a workspace with a large run history.
+const maxListScan = 2000
+
+// jobsPageLimit is the per-request page size for runs/list; enrichConcurrency
+// bounds the parallel MLflow lookups.
+const (
+	jobsPageLimit     = 25
+	enrichConcurrency = 8
+)
+
+// listData is the payload printed by `air list`.
+type listData struct {
+	Rows []listRow `json:"runs"`
+}
+
+// listRow is one run in the list. The json-tagged fields form the
+// machine-readable output; fields tagged `json:"-"` are shown only in the
+// human-readable table.
+type listRow struct {
+	RunID         string  `json:"run_id"`
+	RunName       string  `json:"run_name"`
+	User          string  `json:"user"`
+	Status        string  `json:"status"`
+	DisplayStatus string  `json:"-"`
+	StartedAt     *string `json:"started_at"`
+	IsSweep       bool    `json:"is_sweep"`
+
+	// Experiment, Duration, Progress, MLflowURL and Accelerators are table-only
+	// columns, omitted from JSON to match `air list --json`.
+	Experiment string `json:"-"`
+	Duration   string `json:"-"`
+	// Progress is a best-effort estimate ("45% · ~2h 15m"), set only for a running
+	// run we could estimate; empty renders as "-".
+	Progress      string `json:"-"`
+	MLflowURL     string `json:"-"`
+	MLflowLabel   string `json:"-"`
+	RunURL        string `json:"-"`
+	ExperimentURL string `json:"-"`
+	Accelerators  string `json:"-"`
+}
+
+// listedRun pairs a row with its parent and task run ids, so the MLflow link can
+// be fetched after the run has been filtered in and cached afterward.
+type listedRun struct {
+	row       listRow
+	runID     int64
+	taskRunID int64
+}
+
+// listQuery holds the resolved inputs to a runFetcher.
+type listQuery struct {
+	activeOnly  bool
+	allUsers    bool
+	userFilter  string
+	currentUser string
+	filters     listFilters
+	fetchMLflow bool
+	limit       int
+	workspaceID int64
+}
+
+func newListCommand() *cobra.Command {
+	var (
+		limit     int
+		allStatus bool
+		allUsers  bool
+		filters   []string
+	)
+
+	cmd := &cobra.Command{
+		Use:   "list",
+		Args:  root.NoArgs,
+		Short: "List active runs for the current user",
+		Long: `List active runs for the current user.
+
+Filters:
+  Use --filter KEY=VALUE per condition. A run must match every condition.
+
+  accelerator_type  Accelerator type, such as A10 or H100.
+  experiment        Case-insensitive glob matched against the experiment name.
+  num_accelerators  Total GPU count.
+  user              Run creator identifier.`,
+		Example: `  databricks air list --filter accelerator_type=H100
+
+  databricks air list --all-status \
+    --filter 'experiment=qwen*' \
+    --filter num_accelerators=8 \
+    --filter user=person@example.com`,
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+
+	cmd.Flags().IntVar(&limit, "limit", 20, "Maximum number of runs to show")
+	cmd.Flags().BoolVar(&allStatus, "all-status", false, "Show runs in all states (default: active only)")
+	cmd.Flags().BoolVar(&allUsers, "all-users", false, "Show runs from all users")
+	cmd.Flags().StringArrayVar(&filters, "filter", nil, "Filter runs by KEY=VALUE (repeatable)")
+
+	cmd.RunE = func(cmd *cobra.Command, args []string) error {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if limit <= 0 {
+			return fmt.Errorf("invalid --limit %d: must be a positive integer", limit)
+		}
+
+		f, err := parseListFilters(filters)
+		if err != nil {
+			return err
+		}
+
+		// An explicit user= filter wins; otherwise default to the current user
+		// unless --all-users is set. runs/list has no creator param, so the
+		// creator is matched while scanning.
+		userFilter := f.User
+		var currentUser string
+		if userFilter == "" && !allUsers {
+			me, err := w.CurrentUser.Me(ctx, iam.MeRequest{})
+			if err != nil {
+				return fmt.Errorf("failed to resolve current user: %w", err)
+			}
+			currentUser = me.UserName
+			userFilter = currentUser
+		}
+
+		// Fetch workspace ID once for dashboard links; proceed with 0 on error.
+		var workspaceID int64
+		wsID, err := w.CurrentWorkspaceID(ctx)
+		if err != nil {
+			log.Debugf(ctx, "air list: could not fetch workspace ID for dashboard links: %v", err)
+		} else {
+			workspaceID = wsID
+		}
+
+		fetcher := newRunFetcher(ctx, w, listQuery{
+			activeOnly:  !allStatus,
+			allUsers:    allUsers,
+			userFilter:  userFilter,
+			currentUser: currentUser,
+			filters:     f,
+			fetchMLflow: root.OutputType(cmd) == flags.OutputText,
+			limit:       limit,
+			workspaceID: workspaceID,
+		})
+
+		// JSON prints the newest `limit` runs once. Text renders the table:
+		// navigable in a terminal (paging in older runs on demand), printed once
+		// when piped.
+		if root.OutputType(cmd) == flags.OutputJSON {
+			rows, err := fetcher.next(limit)
+			if err != nil {
+				return err
+			}
+			warnIfTruncated(ctx, fetcher)
+			return renderEnvelope(ctx, listData{Rows: rows})
+		}
+		return renderListText(cmd, fetcher, limit)
+	}
+
+	return cmd
+}
+
+// listStrategy is a source of matching runs, pulled in batches. Two implement it:
+// jobsScanStrategy pages runs/list; indexStrategy hydrates the AiTrainingService
+// index. The fetcher wraps whichever is chosen.
+type listStrategy interface {
+	// next returns up to want more matching runs (already row-built + task id).
+	next(want int) ([]listedRun, error)
+	// done reports whether the source has no more runs to yield.
+	done() bool
+	// truncated reports whether a safety cap stopped the scan short of the end.
+	truncated() bool
+}
+
+// runFetcher yields matching rows in batches, driving both one-shot output and
+// the interactive table's lazy paging. It wraps a listStrategy and adds the
+// shared tail: MLflow enrichment (text only) and row projection.
+type runFetcher struct {
+	ctx         context.Context
+	w           *databricks.WorkspaceClient
+	fetchMLflow bool
+	strategy    listStrategy
+	workspaceID int64
+
+	exhausted bool
+}
+
+func newRunFetcher(ctx context.Context, w *databricks.WorkspaceClient, q listQuery) *runFetcher {
+	return &runFetcher{
+		ctx:         ctx,
+		w:           w,
+		fetchMLflow: q.fetchMLflow,
+		strategy:    newListStrategy(ctx, w, q),
+		workspaceID: q.workspaceID,
+	}
+}
+
+// newListStrategy picks the fetch source. The AiTrainingService index serves only
+// the caller's own runs, so it's used for an all-status self-scoped list; if the
+// index load fails (e.g. endpoint unavailable in this workspace), we fall back to
+// the Jobs scan so the command still returns. Everything else — the default
+// active list, --all-users, and --all-status for another user — uses the scan.
+func newListStrategy(ctx context.Context, w *databricks.WorkspaceClient, q listQuery) listStrategy {
+	useIndex := !q.activeOnly && !q.allUsers && (q.userFilter == "" || q.userFilter == q.currentUser)
+	if !useIndex {
+		return newJobsScanStrategy(ctx, w, q)
+	}
+	idx := newIndexStrategy(ctx, w, q, q.limit)
+	if err := idx.load(); err != nil {
+		log.Debugf(ctx, "air list: AiTrainingService index unavailable, falling back to Jobs scan: %v", err)
+		return newJobsScanStrategy(ctx, w, q)
+	}
+	return idx
+}
+
+// next pulls the next batch from the strategy, enriches it with MLflow links for
+// text output, and projects it to rows. It sets exhausted once the strategy is
+// drained so the interactive table knows to stop paging.
+func (f *runFetcher) next(want int) ([]listRow, error) {
+	entries, err := f.strategy.next(want)
+	if err != nil {
+		return nil, err
+	}
+	f.exhausted = f.strategy.done()
+
+	// MLflow links appear only in the text table, so the per-run get-output
+	// lookups are skipped for JSON output (which omits the column anyway).
+	if f.fetchMLflow {
+		setMLflowLinks(f.ctx, f.w, f.w.Config.Host, entries)
+		if s, ok := f.strategy.(*indexStrategy); ok {
+			s.cacheMLflowLinks(entries)
+		}
+	}
+
+	rows := make([]listRow, len(entries))
+	for i, e := range entries {
+		rows[i] = e.row
+	}
+	return rows, nil
+}
+
+// jobsScanStrategy pages Jobs runs/list, keeping the AIR runs that match the user
+// and filters. It buffers a page's leftover runs so successive next() calls
+// resume where the last stopped.
+type jobsScanStrategy struct {
+	ctx         context.Context
+	w           *databricks.WorkspaceClient
+	iter        listing.Iterator[jobs.BaseRun]
+	userFilter  string
+	filters     listFilters
+	host        string
+	workspaceID int64
+
+	scanned int
+}
+
+func newJobsScanStrategy(ctx context.Context, w *databricks.WorkspaceClient, q listQuery) *jobsScanStrategy {
+	req := jobs.ListRunsRequest{
+		RunType:     jobs.RunTypeSubmitRun,
+		ExpandTasks: true,
+		Limit:       jobsPageLimit,
+		ActiveOnly:  q.activeOnly,
+	}
+	return &jobsScanStrategy{
+		ctx:         ctx,
+		w:           w,
+		iter:        w.Jobs.ListRuns(ctx, req),
+		userFilter:  q.userFilter,
+		filters:     q.filters,
+		host:        w.Config.Host,
+		workspaceID: q.workspaceID,
+	}
+}
+
+func (s *jobsScanStrategy) next(want int) ([]listedRun, error) {
+	var entries []listedRun
+	for len(entries) < want && s.scanned < maxListScan && s.iter.HasNext(s.ctx) {
+		base, err := s.iter.Next(s.ctx)
+		if err != nil {
+			return nil, fmt.Errorf("failed to list runs: %w", err)
+		}
+		s.scanned++
+
+		run := baseRunToRun(base)
+		if !isAirRun(run) {
+			continue
+		}
+		if s.userFilter != "" && run.CreatorUserName != s.userFilter {
+			continue
+		}
+		if !s.filters.matches(run) {
+			continue
+		}
+		entries = append(entries, listedRun{row: buildListRow(run, s.host, s.workspaceID), runID: run.RunId, taskRunID: taskRunID(run)})
+	}
+	return entries, nil
+}
+
+func (s *jobsScanStrategy) done() bool {
+	return s.scanned >= maxListScan || !s.iter.HasNext(s.ctx)
+}
+
+func (s *jobsScanStrategy) truncated() bool {
+	return s.scanned >= maxListScan
+}
+
+// warnIfTruncated logs when a scan hit its safety cap, so one-shot output signals
+// its results may be incomplete.
+func warnIfTruncated(ctx context.Context, f *runFetcher) {
+	if f.strategy.truncated() {
+		log.Warnf(ctx, "air list: stopped after scanning %d runs; results may be incomplete", maxListScan)
+	}
+}
+
+// setMLflowLinks fills in each row's MLflow link, label, and experiment URL -
+// and, for a running run, its ETA - in parallel, best-effort: a row whose IDs
+// can't be resolved keeps its "-" placeholder, and a run we can't estimate has
+// no ETA.
+func setMLflowLinks(ctx context.Context, w *databricks.WorkspaceClient, host string, entries []listedRun) {
+	var g errgroup.Group
+	g.SetLimit(enrichConcurrency)
+	for i := range entries {
+		g.Go(func() error {
+			if entries[i].row.MLflowURL != "" && entries[i].row.MLflowURL != "-" {
+				return nil
+			}
+			ids := mlflowIDsForTask(ctx, w, entries[i].taskRunID)
+			if ids == nil {
+				return nil
+			}
+			entries[i].row.MLflowURL = mlflowLogsURL(host, ids)
+			name := fetchMLflowRunName(ctx, w, ids.RunID)
+			entries[i].row.MLflowLabel = mlflowRunLabel(name, ids.RunID)
+			entries[i].row.ExperimentURL = mlflowExperimentURL(host, ids)
+			// The ETA needs a progress-metric history fetch, so it's computed only
+			// for running rows (the only ones that can have one).
+			if entries[i].row.Status == string(jobs.RunLifeCycleStateRunning) {
+				if eta := estimateTrainingETA(ctx, w, ids.RunID); eta != nil {
+					entries[i].row.Progress = eta.compact()
+				}
+			}
+			return nil
+		})
+	}
+	// mlflowIDsForTask never returns an error (it logs and yields nil), so Wait can't fail.
+	_ = g.Wait()
+}
diff --git a/cmd/air/list_cache.go b/cmd/air/list_cache.go
new file mode 100644
index 00000000000..a4d4d81ca06
--- /dev/null
+++ b/cmd/air/list_cache.go
@@ -0,0 +1,97 @@
+package aircmd
+
+import (
+	"context"
+	"time"
+
+	"github.com/databricks/cli/libs/cache"
+)
+
+// The AiTrainingService index path caches hydrated terminal runs on disk:
+// terminal runs are immutable, so once we've paid for runs/get + get-output +
+// MLflow we persist the finished row and skip those round-trips next time. The
+// TTL matches AICM's ~60-day retention, after which the run drops out of the
+// index anyway.
+const (
+	listCacheComponent = "air-list-runs"
+	listCacheTTL       = 60 * 24 * time.Hour
+)
+
+// listCacheKey fingerprints a cached run. Host isolates workspaces (a Jobs run
+// id is unique only within one), matching how libs/cache namespaces entries.
+type listCacheKey struct {
+	Host  string `json:"host"`
+	RunID int64  `json:"run_id"`
+}
+
+// cachedRun is the persisted value: every listRow field (including the
+// table-only columns, which listRow tags json:"-" and so wouldn't survive a
+// direct marshal), the filter inputs, and the submit time.
+type cachedRun struct {
+	RunID         string       `json:"run_id"`
+	RunName       string       `json:"run_name"`
+	User          string       `json:"user"`
+	Status        string       `json:"status"`
+	StartedAt     *string      `json:"started_at"`
+	IsSweep       bool         `json:"is_sweep"`
+	Experiment    string       `json:"experiment"`
+	Duration      string       `json:"duration"`
+	MLflowURL     string       `json:"mlflow_url"`
+	MLflowLabel   string       `json:"mlflow_label"`
+	RunURL        string       `json:"run_url"`
+	ExperimentURL string       `json:"experiment_url"`
+	Accelerators  string       `json:"accelerators"`
+	TaskRunID     int64        `json:"task_run_id"`
+	Fields        filterFields `json:"filter_fields"`
+	SubmitTimeMs  int64        `json:"submit_time_ms"`
+}
+
+func (c cachedRun) toRow() listRow {
+	return listRow{
+		RunID: c.RunID, RunName: c.RunName, User: c.User, Status: c.Status,
+		StartedAt: c.StartedAt, IsSweep: c.IsSweep, Experiment: c.Experiment,
+		Duration: c.Duration, MLflowURL: c.MLflowURL, MLflowLabel: c.MLflowLabel,
+		RunURL: c.RunURL, ExperimentURL: c.ExperimentURL, Accelerators: c.Accelerators,
+	}
+}
+
+func cachedRunFromRow(r listRow, taskRunID int64, fields filterFields, submitTimeMs int64) cachedRun {
+	return cachedRun{
+		RunID: r.RunID, RunName: r.RunName, User: r.User, Status: r.Status,
+		StartedAt: r.StartedAt, IsSweep: r.IsSweep, Experiment: r.Experiment,
+		Duration: r.Duration, MLflowURL: r.MLflowURL, MLflowLabel: r.MLflowLabel,
+		RunURL: r.RunURL, ExperimentURL: r.ExperimentURL, Accelerators: r.Accelerators,
+		TaskRunID: taskRunID, Fields: fields, SubmitTimeMs: submitTimeMs,
+	}
+}
+
+// newListCache builds the cache for the index path. It fails open, so a nil
+// return (or any cache error) just means every run is hydrated from the API.
+func newListCache(ctx context.Context) *cache.Cache {
+	return cache.NewCache(ctx, listCacheComponent, listCacheTTL, nil)
+}
+
+// cachedRow returns the cached row, filter fields, and task run id for a run.
+// Entries written before task ids were cached are treated as misses.
+func cachedRow(ctx context.Context, c *cache.Cache, host string, runID int64) (listRow, filterFields, int64, bool) {
+	entry, ok := cache.Get[cachedRun](ctx, c, listCacheKey{Host: host, RunID: runID})
+	if !ok || entry.TaskRunID == 0 {
+		return listRow{}, filterFields{}, 0, false
+	}
+	return entry.toRow(), entry.Fields, entry.TaskRunID, true
+}
+
+// putRow caches a terminal run's base row and filter fields under its submit time.
+func putRow(ctx context.Context, c *cache.Cache, host string, runID, taskRunID, submitTimeMs int64, row listRow, fields filterFields) {
+	cache.Put(ctx, c, listCacheKey{Host: host, RunID: runID}, cachedRunFromRow(row, taskRunID, fields, submitTimeMs))
+}
+
+// updateCachedRow replaces the display row while preserving cache metadata.
+func updateCachedRow(ctx context.Context, c *cache.Cache, host string, runID int64, row listRow) {
+	key := listCacheKey{Host: host, RunID: runID}
+	entry, ok := cache.Get[cachedRun](ctx, c, key)
+	if !ok {
+		return
+	}
+	cache.Put(ctx, c, key, cachedRunFromRow(row, entry.TaskRunID, entry.Fields, entry.SubmitTimeMs))
+}
diff --git a/cmd/air/list_cache_test.go b/cmd/air/list_cache_test.go
new file mode 100644
index 00000000000..820b7d1718f
--- /dev/null
+++ b/cmd/air/list_cache_test.go
@@ -0,0 +1,170 @@
+package aircmd
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestListCacheRoundTrip(t *testing.T) {
+	t.Setenv("DATABRICKS_CACHE_DIR", t.TempDir())
+	ctx := t.Context()
+	c := newListCache(ctx)
+
+	_, _, _, ok := cachedRow(ctx, c, "https://host.test", 42)
+	require.False(t, ok, "miss before write")
+
+	row := listRow{RunID: "42", Experiment: "exp", Status: "SUCCESS"}
+	fields := filterFields{Experiment: "exp", GPUType: "GPU_1xA10", GPUCount: 1}
+	putRow(ctx, c, "https://host.test", 42, 420, 1700000000000, row, fields)
+
+	got, gotFields, taskRunID, ok := cachedRow(ctx, c, "https://host.test", 42)
+	require.True(t, ok, "hit after write")
+	assert.Equal(t, row, got)
+	assert.Equal(t, fields, gotFields)
+	assert.Equal(t, int64(420), taskRunID)
+
+	// Different host is a different key.
+	_, _, _, ok = cachedRow(ctx, c, "https://other.test", 42)
+	assert.False(t, ok)
+
+	// Entries from the previous cache format have no task run id and must be refreshed.
+	putRow(ctx, c, "https://host.test", 43, 0, 1700000000000, listRow{RunID: "43"}, filterFields{})
+	_, _, _, ok = cachedRow(ctx, c, "https://host.test", 43)
+	assert.False(t, ok)
+}
+
+func TestIndexStrategyServesCachedRowWithoutFetch(t *testing.T) {
+	t.Setenv("DATABRICKS_CACHE_DIR", t.TempDir())
+
+	refs := []workflowRef{{jobRunID: 7, submitTimeMs: 1000_000}}
+	srv, hits := indexAndGetServer(t, refs, map[int64]jobs.Run{7: indexRun(7, 1000_000)}, nil, nil)
+	host := srv.URL
+
+	// Pre-seed the cache for run 7 so hydration should skip runs/get entirely.
+	ctx := t.Context()
+	putRow(ctx, newListCache(ctx), host, 7, 70, 1000_000, listRow{RunID: "7", Status: "SUCCESS"}, filterFields{})
+
+	f := newRunFetcher(ctx, newTestWorkspaceClient(t, host), listQuery{
+		userFilter: "me@example.com", currentUser: "me@example.com", limit: 10,
+	})
+	rows, err := f.next(10)
+	require.NoError(t, err)
+	require.Len(t, rows, 1)
+	assert.Equal(t, "7", rows[0].RunID)
+	assert.Equal(t, 0, hits.get, "cached run must not hit runs/get")
+}
+
+func TestIndexStrategyFiltersCachedRow(t *testing.T) {
+	t.Setenv("DATABRICKS_CACHE_DIR", t.TempDir())
+
+	refs := []workflowRef{{jobRunID: 7, submitTimeMs: 1000_000}}
+	srv, hits := indexAndGetServer(t, refs, map[int64]jobs.Run{7: indexRun(7, 1000_000)}, nil, nil)
+	host := srv.URL
+
+	// Cache hit under experiment "bar" must be filtered out by an experiment=foo query.
+	ctx := t.Context()
+	putRow(ctx, newListCache(ctx), host, 7, 70, 1000_000,
+		listRow{RunID: "7", Status: "SUCCESS", Experiment: "bar"},
+		filterFields{Experiment: "bar"})
+
+	f := newRunFetcher(ctx, newTestWorkspaceClient(t, host), listQuery{
+		userFilter: "me@example.com", currentUser: "me@example.com", limit: 10,
+		filters: listFilters{Experiment: "foo"},
+	})
+	rows, err := f.next(10)
+	require.NoError(t, err)
+	assert.Empty(t, rows, "cached row not matching the filter must be dropped")
+	assert.Equal(t, 0, hits.get, "non-matching cached row must not hit runs/get")
+}
+
+func TestIndexStrategyServesMatchingCachedRow(t *testing.T) {
+	t.Setenv("DATABRICKS_CACHE_DIR", t.TempDir())
+
+	refs := []workflowRef{{jobRunID: 7, submitTimeMs: 1000_000}}
+	srv, hits := indexAndGetServer(t, refs, map[int64]jobs.Run{7: indexRun(7, 1000_000)}, nil, nil)
+	host := srv.URL
+
+	ctx := t.Context()
+	putRow(ctx, newListCache(ctx), host, 7, 70, 1000_000,
+		listRow{RunID: "7", Status: "SUCCESS", Experiment: "foo"},
+		filterFields{Experiment: "foo"})
+
+	f := newRunFetcher(ctx, newTestWorkspaceClient(t, host), listQuery{
+		userFilter: "me@example.com", currentUser: "me@example.com", limit: 10,
+		filters: listFilters{Experiment: "foo"},
+	})
+	rows, err := f.next(10)
+	require.NoError(t, err)
+	require.Len(t, rows, 1)
+	assert.Equal(t, "7", rows[0].RunID)
+	assert.Equal(t, 0, hits.get, "matching cached row must not hit runs/get")
+}
+
+func TestIndexStrategyCachesMLflowEnrichment(t *testing.T) {
+	t.Setenv("DATABRICKS_CACHE_DIR", t.TempDir())
+
+	run := indexRun(7, 1000_000)
+	run.Tasks[0].RunId = 70
+	var getHits, outputHits, mlflowHits int
+	var outputRunIDs []string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case aiTrainingWorkflowsPath:
+			_ = json.NewEncoder(w).Encode(map[string]any{"training_workflows": []map[string]any{{
+				"job_run_id": "7", "submit_time": map[string]any{"seconds": 1000},
+			}}})
+		case "/api/2.2/jobs/runs/get":
+			getHits++
+			_ = json.NewEncoder(w).Encode(run)
+		case "/api/2.2/jobs/runs/get-output":
+			outputHits++
+			outputRunIDs = append(outputRunIDs, r.URL.Query().Get("run_id"))
+			if r.URL.Query().Get("run_id") != "70" {
+				w.WriteHeader(http.StatusBadRequest)
+				_, _ = w.Write([]byte(`{"message":"get-output requires a task run id"}`))
+				return
+			}
+			_, _ = w.Write([]byte(`{"ai_runtime_task_output":{"mlflow_experiment_id":"exp1","mlflow_run_id":"mlflow1"}}`))
+		case "/api/2.0/mlflow/runs/get":
+			mlflowHits++
+			_, _ = w.Write([]byte(`{"run":{"info":{"run_name":"training-run"}}}`))
+		default:
+			_, _ = w.Write([]byte(`{}`))
+		}
+	}))
+	t.Cleanup(srv.Close)
+
+	query := listQuery{
+		userFilter: "me@example.com", currentUser: "me@example.com", limit: 10,
+	}
+	rows, err := newRunFetcher(t.Context(), newTestWorkspaceClient(t, srv.URL), query).next(10)
+	require.NoError(t, err)
+	require.Len(t, rows, 1)
+	assert.Equal(t, "-", rows[0].MLflowLabel)
+
+	query.fetchMLflow = true
+	for range 2 {
+		rows, err = newRunFetcher(t.Context(), newTestWorkspaceClient(t, srv.URL), query).next(10)
+		require.NoError(t, err)
+		require.Len(t, rows, 1)
+		assert.Equal(t, "training-run", rows[0].MLflowLabel)
+	}
+
+	assert.Equal(t, 1, getHits, "warm cache must skip runs/get")
+	assert.Equal(t, 1, outputHits, "warm cache must skip get-output")
+	assert.Equal(t, 1, mlflowHits, "warm cache must skip the MLflow lookup")
+	assert.Equal(t, []string{"70"}, outputRunIDs, "get-output must use the task run id")
+}
+
+func TestIsTerminal(t *testing.T) {
+	assert.True(t, isTerminal(&jobs.Run{State: &jobs.RunState{LifeCycleState: jobs.RunLifeCycleStateTerminated}}))
+	assert.True(t, isTerminal(&jobs.Run{State: &jobs.RunState{LifeCycleState: jobs.RunLifeCycleStateInternalError}}))
+	assert.False(t, isTerminal(&jobs.Run{State: &jobs.RunState{LifeCycleState: jobs.RunLifeCycleStateRunning}}))
+	assert.False(t, isTerminal(&jobs.Run{State: &jobs.RunState{LifeCycleState: jobs.RunLifeCycleStatePending}}))
+}
diff --git a/cmd/air/list_detail.go b/cmd/air/list_detail.go
new file mode 100644
index 00000000000..c0eca25b13f
--- /dev/null
+++ b/cmd/air/list_detail.go
@@ -0,0 +1,64 @@
+package aircmd
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+)
+
+// runDetailText fetches a run and renders the same styled view as `air get` into
+// a string, for the list picker's detail pane.
+func runDetailText(ctx context.Context, w *databricks.WorkspaceClient, runID int64) (string, error) {
+	run, err := w.Jobs.GetRun(ctx, jobs.GetRunRequest{RunId: runID})
+	if err != nil {
+		if errors.Is(err, apierr.ErrResourceDoesNotExist) {
+			return "", fmt.Errorf("run %d not found", runID)
+		}
+		return "", fmt.Errorf("failed to fetch run: %w", err)
+	}
+
+	// A missing workspace id only drops the ?o= org hint from the dashboard link.
+	workspaceID, _ := w.CurrentWorkspaceID(ctx)
+
+	data := buildGetData(run)
+	data.DashboardURL = dashboardURL(w.Config.Host, runID, workspaceID)
+	ids := mlflowIDs(ctx, w, run)
+	if ids != nil {
+		url := mlflowLogsURL(w.Config.Host, ids)
+		data.MLflowURL = &url
+	}
+
+	var buf bytes.Buffer
+	renderRunText(ctx, &buf, w, run, &data, ids)
+	return buf.String(), nil
+}
+
+// runLogsSnapshot fetches a one-shot tail of a run's logs into a string, for the
+// list picker's detail pane.
+func runLogsSnapshot(ctx context.Context, w *databricks.WorkspaceClient, runID int64) (string, error) {
+	status, err := resolveRunStatus(ctx, w, runID)
+	if err != nil {
+		if errors.Is(err, apierr.ErrResourceDoesNotExist) {
+			return "", fmt.Errorf("run %d not found", runID)
+		}
+		return "", fmt.Errorf("failed to fetch run status: %w", err)
+	}
+
+	req := logRequest{
+		runID:      runID,
+		attempt:    -1,   // latest attempt
+		tailLines:  1000, // one-shot tail, not a live follow
+		staticView: true,
+	}
+
+	var buf bytes.Buffer
+	if _, err := fetchLogs(ctx, w, &buf, req, status); err != nil {
+		return "", fmt.Errorf("failed to fetch logs: %w", err)
+	}
+	return buf.String(), nil
+}
diff --git a/cmd/air/list_filter.go b/cmd/air/list_filter.go
new file mode 100644
index 00000000000..bd2bf8dff6e
--- /dev/null
+++ b/cmd/air/list_filter.go
@@ -0,0 +1,108 @@
+package aircmd
+
+import (
+	"fmt"
+	"path"
+	"strconv"
+	"strings"
+
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+)
+
+// supportedFilterKeys are the keys accepted by `air list --filter KEY=VALUE`.
+var supportedFilterKeys = []string{"accelerator_type", "experiment", "num_accelerators", "user"}
+
+// hasTaskFilter reports whether any filter is applied to a run's task fields
+// (experiment or accelerators), i.e. matched after a run is fetched rather than
+// while scanning. The index path uses this to skip its newest-N truncation, so a
+// dropped match doesn't shrink the result below --limit.
+func (f listFilters) hasTaskFilter() bool {
+	return f.Experiment != "" || f.AcceleratorType != "" || f.NumAccelerators != nil
+}
+
+// listFilters holds the parsed `--filter` values for `air list`.
+type listFilters struct {
+	// User is an exact creator-email match
+	User string
+	// Experiment is a case-insensitive glob
+	Experiment string
+	// AcceleratorType is a case-insensitive substring matched against the
+	// display GPU name (e.g. "H100").
+	AcceleratorType string
+	// NumAccelerators is an exact match against the GPU count.
+	NumAccelerators *int
+}
+
+func parseListFilters(raw []string) (listFilters, error) {
+	var f listFilters
+	for _, item := range raw {
+		key, value, ok := strings.Cut(item, "=")
+		if !ok || key == "" {
+			return listFilters{}, fmt.Errorf("invalid --filter %q: expected KEY=VALUE", item)
+		}
+		switch key {
+		case "user":
+			f.User = value
+		case "experiment":
+			f.Experiment = value
+		case "accelerator_type":
+			f.AcceleratorType = value
+		case "num_accelerators":
+			n, err := strconv.Atoi(value)
+			if err != nil || n <= 0 {
+				return listFilters{}, fmt.Errorf("invalid --filter num_accelerators=%q: must be a positive integer", value)
+			}
+			f.NumAccelerators = &n
+		default:
+			return listFilters{}, fmt.Errorf("unsupported --filter key %q: supported keys are %s", key, strings.Join(supportedFilterKeys, ", "))
+		}
+	}
+	return f, nil
+}
+
+// filterFields are the task-filter inputs, cached alongside the row so a cache
+// hit can be re-filtered without re-fetching the run.
+type filterFields struct {
+	Experiment string `json:"experiment"`
+	GPUType    string `json:"gpu_type"`
+	GPUCount   int    `json:"gpu_count"`
+}
+
+func filterFieldsFromRun(run *jobs.Run) filterFields {
+	gpuType, count := jobCompute(run)
+	return filterFields{
+		Experiment: jobExperiment(run),
+		GPUType:    gpuType,
+		GPUCount:   count,
+	}
+}
+
+// matches reports whether a run satisfies the experiment, accelerator-type and
+// accelerator-count filters. The user filter is applied separately while
+// scanning, since it maps onto the run's creator rather than its task.
+func (f listFilters) matches(run *jobs.Run) bool {
+	return f.matchesFields(filterFieldsFromRun(run))
+}
+
+// matchesFields is the shared comparator for live runs and cached rows, so the
+// two paths can't drift.
+func (f listFilters) matchesFields(fields filterFields) bool {
+	if f.Experiment != "" {
+		matched, err := path.Match(strings.ToLower(f.Experiment), strings.ToLower(fields.Experiment))
+		if err != nil || !matched {
+			return false
+		}
+	}
+
+	if f.AcceleratorType != "" {
+		display := strings.ToLower(gpuDisplayName(fields.GPUType))
+		if !strings.Contains(display, strings.ToLower(f.AcceleratorType)) {
+			return false
+		}
+	}
+	if f.NumAccelerators != nil && fields.GPUCount != *f.NumAccelerators {
+		return false
+	}
+
+	return true
+}
diff --git a/cmd/air/list_filter_test.go b/cmd/air/list_filter_test.go
new file mode 100644
index 00000000000..381f5e3a62d
--- /dev/null
+++ b/cmd/air/list_filter_test.go
@@ -0,0 +1,74 @@
+package aircmd
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseListFilters(t *testing.T) {
+	t.Run("valid", func(t *testing.T) {
+		f, err := parseListFilters([]string{
+			"user=me@example.com",
+			"experiment=qwen*",
+			"accelerator_type=H100",
+			"num_accelerators=8",
+		})
+		require.NoError(t, err)
+		assert.Equal(t, "me@example.com", f.User)
+		assert.Equal(t, "qwen*", f.Experiment)
+		assert.Equal(t, "H100", f.AcceleratorType)
+		require.NotNil(t, f.NumAccelerators)
+		assert.Equal(t, 8, *f.NumAccelerators)
+	})
+
+	t.Run("unknown key", func(t *testing.T) {
+		_, err := parseListFilters([]string{"region=us"})
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "unsupported --filter key")
+	})
+
+	t.Run("malformed pair", func(t *testing.T) {
+		_, err := parseListFilters([]string{"experiment"})
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "expected KEY=VALUE")
+	})
+
+	t.Run("bad num_accelerators", func(t *testing.T) {
+		_, err := parseListFilters([]string{"num_accelerators=lots"})
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "num_accelerators")
+	})
+
+	t.Run("non-positive num_accelerators", func(t *testing.T) {
+		_, err := parseListFilters([]string{"num_accelerators=0"})
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "positive integer")
+	})
+}
+
+func TestListFiltersMatches(t *testing.T) {
+	run := airRun(1, "me@example.com", "GPU_8xH100", 8, "/Users/me@example.com/qwen-eval")
+
+	cases := []struct {
+		name string
+		f    listFilters
+		want bool
+	}{
+		{"no filters", listFilters{}, true},
+		{"experiment prefix glob", listFilters{Experiment: "qwen*"}, true},
+		{"experiment suffix glob", listFilters{Experiment: "*-eval"}, true},
+		{"experiment case-insensitive", listFilters{Experiment: "QWEN*"}, true},
+		{"experiment no match", listFilters{Experiment: "llama*"}, false},
+		{"accelerator type substring", listFilters{AcceleratorType: "h100"}, true},
+		{"accelerator type no match", listFilters{AcceleratorType: "a10"}, false},
+		{"num accelerators match", listFilters{NumAccelerators: new(8)}, true},
+		{"num accelerators no match", listFilters{NumAccelerators: new(4)}, false},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			assert.Equal(t, c.want, c.f.matches(&run))
+		})
+	}
+}
diff --git a/cmd/air/list_format.go b/cmd/air/list_format.go
new file mode 100644
index 00000000000..81c22fbbea9
--- /dev/null
+++ b/cmd/air/list_format.go
@@ -0,0 +1,51 @@
+package aircmd
+
+import (
+	"strconv"
+	"time"
+
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+)
+
+// buildListRow extracts the columns shown for one run. Optional cells fall back
+// to "-"; MLflowURL starts as "-" and setMLflowLinks fills it in for text output.
+// host and workspaceID are used for building dashboard URLs.
+func buildListRow(run *jobs.Run, host string, workspaceID int64) listRow {
+	experiment := "-"
+	if e := jobExperiment(run); e != "" {
+		experiment = e
+	}
+
+	var startedAt *string
+	duration := "-"
+	if start, end := jobTiming(run); start > 0 {
+		s := isoFormat(time.UnixMilli(start))
+		startedAt = &s
+		if end == 0 {
+			// Still running: measure against the current time.
+			end = time.Now().UnixMilli()
+		}
+		duration = formatDuration(roundMillisToSeconds(end - start))
+	}
+
+	accel := "-"
+	if a := acceleratorLabel(jobCompute(run)); a != "" {
+		accel = a
+	}
+
+	return listRow{
+		RunID:         strconv.FormatInt(run.RunId, 10),
+		RunName:       run.RunName,
+		User:          run.CreatorUserName,
+		Status:        displayRunStatus(run),
+		DisplayStatus: displayRunStatus(run),
+		StartedAt:     startedAt,
+		IsSweep:       isSweep(run),
+		Experiment:    experiment,
+		Duration:      duration,
+		MLflowURL:     "-",
+		MLflowLabel:   "-",
+		RunURL:        dashboardURL(host, run.RunId, workspaceID),
+		Accelerators:  accel,
+	}
+}
diff --git a/cmd/air/list_index.go b/cmd/air/list_index.go
new file mode 100644
index 00000000000..52a70173a97
--- /dev/null
+++ b/cmd/air/list_index.go
@@ -0,0 +1,161 @@
+package aircmd
+
+import (
+	"cmp"
+	"context"
+	"slices"
+
+	"github.com/databricks/cli/libs/cache"
+	"github.com/databricks/databricks-sdk-go"
+)
+
+// indexStrategy serves the caller's own runs from the AiTrainingService index:
+// it fetches every run id up front (cheap id+timestamp pairs), orders them
+// newest-first, keeps the newest `limit`, then hydrates them into full rows in
+// want-sized batches via Jobs runs/get. Terminal rows are cached so repeat calls
+// skip the network. Unlike the Jobs scan it can't lazy-page (it must sort the
+// whole id set first), but it still yields in batches so the table paints early.
+type indexStrategy struct {
+	ctx         context.Context
+	w           *databricks.WorkspaceClient
+	activeOnly  bool
+	filters     listFilters
+	limit       int
+	cache       *cache.Cache
+	host        string
+	workspaceID int64
+
+	ids    []int64 // newest-first run ids to hydrate, resolved on first next()
+	pos    int
+	loaded bool
+}
+
+func newIndexStrategy(ctx context.Context, w *databricks.WorkspaceClient, q listQuery, limit int) *indexStrategy {
+	return &indexStrategy{
+		ctx:         ctx,
+		w:           w,
+		activeOnly:  q.activeOnly,
+		filters:     q.filters,
+		limit:       limit,
+		cache:       newListCache(ctx),
+		host:        w.Config.Host,
+		workspaceID: q.workspaceID,
+	}
+}
+
+// load fetches and orders the index once. It returns an error only when the
+// index endpoint itself fails, letting the caller fall back to the Jobs scan.
+func (s *indexStrategy) load() error {
+	refs, err := listAiTrainingWorkflows(s.ctx, s.w, s.activeOnly)
+	if err != nil {
+		return err
+	}
+	slices.SortFunc(refs, func(a, b workflowRef) int { return cmp.Compare(b.submitTimeMs, a.submitTimeMs) })
+	// Keep only the newest `limit` ids so hydration is bounded — but skip that when
+	// a task filter is active, since it drops matches post-hydration and we'd
+	// otherwise return fewer than `limit`. The caller stops pulling at `limit`.
+	if s.limit > 0 && len(refs) > s.limit && !s.filters.hasTaskFilter() {
+		refs = refs[:s.limit]
+	}
+	s.ids = make([]int64, len(refs))
+	for i, r := range refs {
+		s.ids[i] = r.jobRunID
+	}
+	s.loaded = true
+	return nil
+}
+
+func (s *indexStrategy) next(want int) ([]listedRun, error) {
+	if !s.loaded {
+		if err := s.load(); err != nil {
+			return nil, err
+		}
+	}
+
+	var entries []listedRun
+	for len(entries) < want && s.pos < len(s.ids) {
+		end := min(s.pos+want-len(entries), len(s.ids))
+		batch := s.ids[s.pos:end]
+		s.pos = end
+
+		rows, err := s.hydrate(batch)
+		if err != nil {
+			return nil, err
+		}
+		entries = append(entries, rows...)
+	}
+	return entries, nil
+}
+
+func (s *indexStrategy) done() bool {
+	return s.loaded && s.pos >= len(s.ids)
+}
+
+// truncated is always false: the index path is bounded by limit, not a scan cap.
+func (s *indexStrategy) truncated() bool { return false }
+
+// hydrate turns a batch of run ids into rows, serving cached terminal rows
+// without a network call and fetching the rest via runs/get. Freshly hydrated
+// terminal runs are cached. Results keep the input (newest-first) order, then
+// the batch is re-sorted by start time since concurrent hydration reorders it.
+func (s *indexStrategy) hydrate(ids []int64) ([]listedRun, error) {
+	host := s.w.Config.Host
+
+	rows := make([]listedRun, 0, len(ids))
+	var toFetch []int64
+	// The cache key excludes the filter, so a cached row is still run through the
+	// active filter; a non-matching hit is dropped, not re-fetched.
+	for _, id := range ids {
+		if row, fields, taskRunID, ok := cachedRow(s.ctx, s.cache, host, id); ok {
+			if s.filters.matchesFields(fields) {
+				rows = append(rows, listedRun{row: row, runID: id, taskRunID: taskRunID})
+			}
+			continue
+		}
+		toFetch = append(toFetch, id)
+	}
+
+	runs, err := hydrateJobRuns(s.ctx, s.w, toFetch)
+	if err != nil {
+		return nil, err
+	}
+	for _, run := range runs {
+		fields := filterFieldsFromRun(run)
+		if !s.filters.matchesFields(fields) {
+			continue
+		}
+		row := buildListRow(run, s.host, s.workspaceID)
+		taskRunID := taskRunID(run)
+		rows = append(rows, listedRun{row: row, runID: run.RunId, taskRunID: taskRunID})
+		if isTerminal(run) {
+			start, _ := jobTiming(run)
+			putRow(s.ctx, s.cache, host, run.RunId, taskRunID, start, row, fields)
+		}
+	}
+
+	// Concurrent hydration reorders runs, so re-sort the batch newest-first. The
+	// ISO start timestamp sorts lexicographically; a missing time ("") sorts last.
+	slices.SortStableFunc(rows, func(a, b listedRun) int {
+		return cmp.Compare(rowStartKey(b.row), rowStartKey(a.row))
+	})
+	return rows, nil
+}
+
+// cacheMLflowLinks writes successful MLflow enrichment back to terminal rows
+// already in the cache. Active rows are absent from the cache and are ignored.
+func (s *indexStrategy) cacheMLflowLinks(entries []listedRun) {
+	for _, entry := range entries {
+		if entry.row.MLflowURL != "" && entry.row.MLflowURL != "-" {
+			updateCachedRow(s.ctx, s.cache, s.host, entry.runID, entry.row)
+		}
+	}
+}
+
+// rowStartKey returns a row's ISO start timestamp for ordering, or "" when the
+// run hasn't started (which sorts last under descending comparison).
+func rowStartKey(r listRow) string {
+	if r.StartedAt == nil {
+		return ""
+	}
+	return *r.StartedAt
+}
diff --git a/cmd/air/list_index_test.go b/cmd/air/list_index_test.go
new file mode 100644
index 00000000000..f9f6151aae4
--- /dev/null
+++ b/cmd/air/list_index_test.go
@@ -0,0 +1,213 @@
+package aircmd
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"testing"
+
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// indexRun is a terminal AIR run with a start time, for index-path hydration.
+func indexRun(id, startMillis int64) jobs.Run {
+	r := airRun(id, "me@example.com", "GPU_1xH100", 1, "/Users/me@example.com/exp")
+	r.State = &jobs.RunState{LifeCycleState: jobs.RunLifeCycleStateTerminated, ResultState: jobs.RunResultStateSuccess}
+	r.Tasks[0].StartTime = startMillis
+	r.Tasks[0].EndTime = startMillis + 1000
+	return r
+}
+
+// indexAndGetServer serves the AiTrainingService index (a single page of the
+// given refs) and runs/get for each id, recording hit counts per endpoint. A
+// runID in forbidden returns 403; in missing returns 404.
+type indexHits struct{ index, get int }
+
+func indexAndGetServer(t *testing.T, refs []workflowRef, runs map[int64]jobs.Run, forbidden, missing map[int64]bool) (*httptest.Server, *indexHits) {
+	t.Helper()
+	hits := &indexHits{}
+	wfs := make([]map[string]any, len(refs))
+	for i, r := range refs {
+		wfs[i] = map[string]any{"job_run_id": strconv.FormatInt(r.jobRunID, 10), "submit_time": map[string]any{"seconds": r.submitTimeMs / 1000}}
+	}
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case aiTrainingWorkflowsPath:
+			hits.index++
+			_ = json.NewEncoder(w).Encode(map[string]any{"training_workflows": wfs})
+		case "/api/2.2/jobs/runs/get":
+			hits.get++
+			id, _ := strconv.ParseInt(r.URL.Query().Get("run_id"), 10, 64)
+			if forbidden[id] {
+				w.WriteHeader(http.StatusForbidden)
+				_, _ = w.Write([]byte(`{"message":"forbidden"}`))
+				return
+			}
+			if missing[id] {
+				w.WriteHeader(http.StatusNotFound)
+				_, _ = w.Write([]byte(`{"message":"not found"}`))
+				return
+			}
+			run := runs[id]
+			_ = json.NewEncoder(w).Encode(run)
+		default:
+			_, _ = w.Write([]byte(`{}`))
+		}
+	}))
+	t.Cleanup(srv.Close)
+	return srv, hits
+}
+
+func TestIndexStrategyOrdersAndLimits(t *testing.T) {
+	// Three runs, out of submit-time order; newest two should win, newest-first.
+	refs := []workflowRef{
+		{jobRunID: 1, submitTimeMs: 1000_000},
+		{jobRunID: 2, submitTimeMs: 3000_000},
+		{jobRunID: 3, submitTimeMs: 2000_000},
+	}
+	runs := map[int64]jobs.Run{
+		1: indexRun(1, 1000_000),
+		2: indexRun(2, 3000_000),
+		3: indexRun(3, 2000_000),
+	}
+	srv, _ := indexAndGetServer(t, refs, runs, nil, nil)
+	t.Setenv("DATABRICKS_CACHE_ENABLED", "false")
+
+	f := newRunFetcher(t.Context(), newTestWorkspaceClient(t, srv.URL), listQuery{
+		userFilter: "me@example.com", currentUser: "me@example.com", limit: 2,
+	})
+	rows, err := f.next(10)
+	require.NoError(t, err)
+	require.Len(t, rows, 2)
+	assert.Equal(t, "2", rows[0].RunID) // submit 3000
+	assert.Equal(t, "3", rows[1].RunID) // submit 2000
+	assert.True(t, f.exhausted)
+}
+
+func TestIndexStrategyOverFetchesWithTaskFilter(t *testing.T) {
+	// With a task filter and limit 1, the newest run doesn't match; the strategy
+	// must keep hydrating past `limit` to find the match rather than truncating.
+	refs := []workflowRef{
+		{jobRunID: 1, submitTimeMs: 3000_000},
+		{jobRunID: 2, submitTimeMs: 2000_000},
+	}
+	run1 := indexRun(1, 3000_000)
+	run1.Tasks[0].AiRuntimeTask.Experiment = "/Users/me@example.com/llama"
+	run2 := indexRun(2, 2000_000)
+	run2.Tasks[0].AiRuntimeTask.Experiment = "/Users/me@example.com/qwen"
+	srv, _ := indexAndGetServer(t, refs, map[int64]jobs.Run{1: run1, 2: run2}, nil, nil)
+	t.Setenv("DATABRICKS_CACHE_ENABLED", "false")
+
+	f := newRunFetcher(t.Context(), newTestWorkspaceClient(t, srv.URL), listQuery{
+		userFilter: "me@example.com", currentUser: "me@example.com", limit: 1,
+		filters: listFilters{Experiment: "qwen"},
+	})
+	rows, err := f.next(1)
+	require.NoError(t, err)
+	require.Len(t, rows, 1)
+	assert.Equal(t, "2", rows[0].RunID) // found despite being the older, second id
+}
+
+func TestIndexStrategyDropsForbiddenAndMissing(t *testing.T) {
+	refs := []workflowRef{
+		{jobRunID: 1, submitTimeMs: 3000_000},
+		{jobRunID: 2, submitTimeMs: 2000_000},
+		{jobRunID: 3, submitTimeMs: 1000_000},
+	}
+	runs := map[int64]jobs.Run{1: indexRun(1, 3000_000), 3: indexRun(3, 1000_000)}
+	srv, _ := indexAndGetServer(t, refs, runs, map[int64]bool{2: true}, nil)
+	t.Setenv("DATABRICKS_CACHE_ENABLED", "false")
+
+	f := newRunFetcher(t.Context(), newTestWorkspaceClient(t, srv.URL), listQuery{
+		userFilter: "me@example.com", currentUser: "me@example.com", limit: 10,
+	})
+	rows, err := f.next(10)
+	require.NoError(t, err)
+	require.Len(t, rows, 2) // run 2 (403) dropped
+	assert.Equal(t, "1", rows[0].RunID)
+	assert.Equal(t, "3", rows[1].RunID)
+}
+
+func TestIndexStrategyPropagatesServerError(t *testing.T) {
+	refs := []workflowRef{{jobRunID: 1, submitTimeMs: 1000_000}}
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case aiTrainingWorkflowsPath:
+			wfs := []map[string]any{{"job_run_id": "1", "submit_time": map[string]any{"seconds": int64(1000)}}}
+			_ = json.NewEncoder(w).Encode(map[string]any{"training_workflows": wfs})
+		case "/api/2.2/jobs/runs/get":
+			w.WriteHeader(http.StatusInternalServerError)
+			_, _ = w.Write([]byte(`{"message":"boom"}`))
+		default:
+			_, _ = w.Write([]byte(`{}`))
+		}
+	}))
+	t.Cleanup(srv.Close)
+	_ = refs
+	t.Setenv("DATABRICKS_CACHE_ENABLED", "false")
+
+	f := newRunFetcher(t.Context(), newTestWorkspaceClient(t, srv.URL), listQuery{
+		userFilter: "me@example.com", currentUser: "me@example.com", limit: 10,
+	})
+	_, err := f.next(10)
+	require.Error(t, err) // 500 is systemic, not an ACL drop
+}
+
+func TestNewListStrategyGate(t *testing.T) {
+	// --all-users and other-user filters must NOT touch the index endpoint.
+	cases := []struct {
+		name      string
+		q         listQuery
+		wantIndex bool
+	}{
+		{"active default → scan", listQuery{activeOnly: true, userFilter: "me@example.com", currentUser: "me@example.com"}, false},
+		{"all-status self → index", listQuery{userFilter: "me@example.com", currentUser: "me@example.com", limit: 5}, true},
+		{"all-status all-users → scan", listQuery{allUsers: true}, false},
+		{"all-status other user → scan", listQuery{userFilter: "other@example.com", currentUser: "me@example.com"}, false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			var indexHit bool
+			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if r.URL.Path == aiTrainingWorkflowsPath {
+					indexHit = true
+				}
+				_, _ = w.Write([]byte(`{}`))
+			}))
+			t.Cleanup(srv.Close)
+			t.Setenv("DATABRICKS_CACHE_ENABLED", "false")
+
+			newListStrategy(t.Context(), newTestWorkspaceClient(t, srv.URL), tc.q)
+			assert.Equal(t, tc.wantIndex, indexHit)
+		})
+	}
+}
+
+func TestNewListStrategyFallsBackWhenIndexFails(t *testing.T) {
+	// Index 500 must silently fall back to the Jobs scan, not fail the command.
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == aiTrainingWorkflowsPath {
+			w.WriteHeader(http.StatusInternalServerError)
+			_, _ = w.Write([]byte(`{"message":"boom"}`))
+			return
+		}
+		if r.URL.Path == "/api/2.2/jobs/runs/list" {
+			_, _ = fmt.Fprint(w, runsListBody(t, "", airBaseRun(1, "me@example.com", "GPU_1xH100", 1, "exp")))
+			return
+		}
+		_, _ = w.Write([]byte(`{}`))
+	}))
+	t.Cleanup(srv.Close)
+	t.Setenv("DATABRICKS_CACHE_ENABLED", "false")
+
+	f := newRunFetcher(t.Context(), newTestWorkspaceClient(t, srv.URL), listQuery{
+		userFilter: "me@example.com", currentUser: "me@example.com", limit: 10,
+	})
+	rows, err := f.next(10)
+	require.NoError(t, err)
+	require.Len(t, rows, 1) // served by the Jobs scan fallback
+}
diff --git a/cmd/air/list_test.go b/cmd/air/list_test.go
new file mode 100644
index 00000000000..a7700d162f0
--- /dev/null
+++ b/cmd/air/list_test.go
@@ -0,0 +1,254 @@
+package aircmd
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/databricks-sdk-go/experimental/mocks"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// airBaseRun builds a single-task AIR run (ai_runtime_task), as runs/list
+// returns it with expand_tasks.
+func airBaseRun(id int64, user, accelType string, count int, experiment string) jobs.BaseRun {
+	return jobs.BaseRun{
+		RunId:           id,
+		RunName:         "run-" + strconv.FormatInt(id, 10),
+		CreatorUserName: user,
+		State:           &jobs.RunState{LifeCycleState: jobs.RunLifeCycleStateRunning},
+		Tasks: []jobs.RunTask{{AiRuntimeTask: &jobs.AiRuntimeTask{
+			Experiment: experiment,
+			Deployments: []jobs.DeploymentSpec{{
+				Compute: jobs.ComputeSpec{AcceleratorType: jobs.ComputeSpecAcceleratorType(accelType), AcceleratorCount: count},
+			}},
+		}}},
+	}
+}
+
+// airRun is the runs/get equivalent of airBaseRun, for the helpers that operate
+// on a *jobs.Run.
+func airRun(id int64, user, accelType string, count int, experiment string) jobs.Run {
+	return *baseRunToRun(airBaseRun(id, user, accelType, count, experiment))
+}
+
+// runsListBody marshals one runs/list response page.
+func runsListBody(t *testing.T, nextToken string, runs ...jobs.BaseRun) string {
+	t.Helper()
+	b, err := json.Marshal(jobs.ListRunsResponse{Runs: runs, NextPageToken: nextToken, HasMore: nextToken != ""})
+	require.NoError(t, err)
+	return string(b)
+}
+
+// runsServer serves one runs/list response body per call, repeating the last
+// once exhausted, and a stub for any other request (the SDK config probe).
+func runsServer(t *testing.T, bodies ...string) *httptest.Server {
+	t.Helper()
+	call := 0
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/api/2.2/jobs/runs/list" {
+			body := bodies[min(call, len(bodies)-1)]
+			call++
+			_, _ = w.Write([]byte(body))
+			return
+		}
+		_, _ = w.Write([]byte(`{}`))
+	}))
+	t.Cleanup(srv.Close)
+	return srv
+}
+
+func TestListAirRunsFiltersUserAndType(t *testing.T) {
+	runs := []jobs.BaseRun{
+		airBaseRun(1, "me@example.com", "GPU_8xH100", 8, "/Users/me@example.com/exp-a"),
+		{RunId: 2, CreatorUserName: "me@example.com", Tasks: []jobs.RunTask{{}}}, // not an AIR run
+		airBaseRun(3, "other@example.com", "GPU_1xA10", 1, "/Users/other/exp-b"), // wrong user
+		airBaseRun(5, "me@example.com", "GPU_1xH100", 1, "/Users/me@example.com/exp-c"),
+	}
+	srv := runsServer(t, runsListBody(t, "", runs...))
+
+	rows, err := newRunFetcher(t.Context(), newTestWorkspaceClient(t, srv.URL), listQuery{
+		activeOnly: true,
+		userFilter: "me@example.com",
+	}).next(10)
+	require.NoError(t, err)
+	require.Len(t, rows, 2)
+	assert.Equal(t, "1", rows[0].RunID)
+	assert.Equal(t, "5", rows[1].RunID)
+}
+
+func TestListAirRunsExperimentFilter(t *testing.T) {
+	runs := []jobs.BaseRun{
+		airBaseRun(1, "me@example.com", "GPU_1xH100", 1, "/Users/me@example.com/qwen-train"),
+		airBaseRun(2, "me@example.com", "GPU_1xH100", 1, "/Users/me@example.com/llama-train"),
+	}
+	srv := runsServer(t, runsListBody(t, "", runs...))
+
+	rows, err := newRunFetcher(t.Context(), newTestWorkspaceClient(t, srv.URL), listQuery{
+		activeOnly: true,
+		filters:    listFilters{Experiment: "qwen*"},
+	}).next(10)
+	require.NoError(t, err)
+	require.Len(t, rows, 1)
+	assert.Equal(t, "1", rows[0].RunID)
+}
+
+func TestListAirRunsLimitTruncates(t *testing.T) {
+	runs := []jobs.BaseRun{
+		airBaseRun(1, "me@example.com", "GPU_1xH100", 1, "exp-a"),
+		airBaseRun(2, "me@example.com", "GPU_1xH100", 1, "exp-b"),
+		airBaseRun(3, "me@example.com", "GPU_1xH100", 1, "exp-c"),
+	}
+	srv := runsServer(t, runsListBody(t, "", runs...))
+
+	rows, err := newRunFetcher(t.Context(), newTestWorkspaceClient(t, srv.URL), listQuery{activeOnly: true}).next(2)
+	require.NoError(t, err)
+	require.Len(t, rows, 2)
+	assert.Equal(t, "1", rows[0].RunID)
+	assert.Equal(t, "2", rows[1].RunID)
+}
+
+func TestListAirRunsPaginates(t *testing.T) {
+	page1 := runsListBody(t, "tok", airBaseRun(1, "me@example.com", "GPU_1xH100", 1, "exp-a"))
+	page2 := runsListBody(t, "", airBaseRun(2, "me@example.com", "GPU_1xH100", 1, "exp-b"))
+	srv := runsServer(t, page1, page2)
+
+	rows, err := newRunFetcher(t.Context(), newTestWorkspaceClient(t, srv.URL), listQuery{activeOnly: true}).next(10)
+	require.NoError(t, err)
+	require.Len(t, rows, 2)
+	assert.Equal(t, "1", rows[0].RunID)
+	assert.Equal(t, "2", rows[1].RunID)
+}
+
+// TestRunFetcherResumesAcrossCalls covers the lazy paging the interactive table
+// relies on: a next() that stops mid-page must resume on the following call, then
+// report exhaustion.
+func TestRunFetcherResumesAcrossCalls(t *testing.T) {
+	runs := []jobs.BaseRun{
+		airBaseRun(1, "me@example.com", "GPU_1xH100", 1, "exp-a"),
+		airBaseRun(2, "me@example.com", "GPU_1xH100", 1, "exp-b"),
+		airBaseRun(3, "me@example.com", "GPU_1xH100", 1, "exp-c"),
+	}
+	srv := runsServer(t, runsListBody(t, "", runs...))
+	f := newRunFetcher(t.Context(), newTestWorkspaceClient(t, srv.URL), listQuery{activeOnly: true})
+
+	first, err := f.next(2)
+	require.NoError(t, err)
+	require.Len(t, first, 2)
+	assert.Equal(t, "1", first[0].RunID)
+	assert.Equal(t, "2", first[1].RunID)
+
+	second, err := f.next(2)
+	require.NoError(t, err)
+	require.Len(t, second, 1) // only the leftover remains
+	assert.Equal(t, "3", second[0].RunID)
+	assert.True(t, f.exhausted)
+
+	third, err := f.next(2)
+	require.NoError(t, err)
+	assert.Empty(t, third)
+}
+
+func TestBuildListRowFromRun(t *testing.T) {
+	run := airRun(842552489592352, "me@example.com", "GPU_1xA10", 1, "my-first-air-run")
+	run.StartTime = 1700000000000
+	run.EndTime = 1700000012000
+	run.State = &jobs.RunState{LifeCycleState: jobs.RunLifeCycleStateTerminated, ResultState: jobs.RunResultStateSuccess}
+
+	assert.True(t, isAirRun(&run))
+	assert.Equal(t, "my-first-air-run", jobExperiment(&run))
+	gpu, count := jobCompute(&run)
+	assert.Equal(t, "GPU_1xA10", gpu)
+	assert.Equal(t, 1, count)
+
+	row := buildListRow(&run, "https://example.test", 0)
+	assert.Equal(t, "842552489592352", row.RunID)
+	assert.Equal(t, "SUCCESS", row.Status)
+	assert.Equal(t, "my-first-air-run", row.Experiment)
+	assert.Equal(t, "1x A10", row.Accelerators)
+	assert.Equal(t, "12s", row.Duration)
+}
+
+func TestBuildListRow(t *testing.T) {
+	run := airRun(123, "me@example.com", "GPU_8xH100", 8, "/Users/me@example.com/exp")
+	run.StartTime = 1700000000000
+	run.EndTime = 1700000012000
+	run.State = &jobs.RunState{ResultState: jobs.RunResultStateSuccess}
+
+	row := buildListRow(&run, "https://example.test", 0)
+	assert.Equal(t, "123", row.RunID)
+	assert.Equal(t, "me@example.com", row.User)
+	assert.Equal(t, "SUCCESS", row.Status)
+	assert.Equal(t, "exp", row.Experiment)
+	assert.Equal(t, "12s", row.Duration)
+	assert.Equal(t, "8x H100", row.Accelerators)
+	assert.Equal(t, "-", row.MLflowURL)
+	assert.False(t, row.IsSweep)
+	require.NotNil(t, row.StartedAt)
+}
+
+func TestBuildListRowWaitingForComputeStatus(t *testing.T) {
+	run := airRun(123, "me@example.com", "GPU_8xH100", 8, "exp")
+	run.State = &jobs.RunState{LifeCycleState: jobs.RunLifeCycleStateRunning}
+	run.Tasks[0].State = &jobs.RunState{LifeCycleState: jobs.RunLifeCycleStatePending}
+
+	row := buildListRow(&run, "https://example.test", 0)
+	body, err := json.Marshal(row)
+	require.NoError(t, err)
+
+	assert.Equal(t, "PENDING", row.Status)
+	assert.Equal(t, listRowStatus(row), row.Status)
+	assert.JSONEq(t, `{
+		"run_id":"123","run_name":"run-123","user":"me@example.com","status":"PENDING",
+		"started_at":null,"is_sweep":false
+	}`, string(body))
+}
+
+func TestBuildListRowDashFallbacks(t *testing.T) {
+	// A run with no task, compute, or start time falls back to dashes and UNKNOWN.
+	row := buildListRow(&jobs.Run{RunId: 7}, "https://example.test", 0)
+	assert.Equal(t, "-", row.Experiment)
+	assert.Equal(t, "-", row.Duration)
+	assert.Equal(t, "-", row.Accelerators)
+	assert.Equal(t, "-", row.MLflowURL)
+	assert.Equal(t, "UNKNOWN", row.Status)
+	assert.Nil(t, row.StartedAt)
+}
+
+func TestBuildListRowSweep(t *testing.T) {
+	run := jobs.Run{RunId: 9, Tasks: []jobs.RunTask{{
+		ForEachTask: &jobs.RunForEachTask{Task: jobs.Task{AiRuntimeTask: &jobs.AiRuntimeTask{Experiment: "sweep"}}},
+	}}}
+	assert.True(t, buildListRow(&run, "https://example.test", 0).IsSweep)
+	assert.Equal(t, "sweep", buildListRow(&run, "https://example.test", 0).Experiment)
+}
+
+func TestListInvalidLimit(t *testing.T) {
+	m := mocks.NewMockWorkspaceClient(t)
+	ctx := cmdctx.SetWorkspaceClient(cmdio.MockDiscard(t.Context()), m.WorkspaceClient)
+	cmd := newListCommand()
+	cmd.SetContext(ctx)
+	require.NoError(t, cmd.Flags().Set("limit", "0"))
+
+	err := cmd.RunE(cmd, nil)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "invalid --limit")
+}
+
+func TestListInvalidFilter(t *testing.T) {
+	m := mocks.NewMockWorkspaceClient(t)
+	ctx := cmdctx.SetWorkspaceClient(cmdio.MockDiscard(t.Context()), m.WorkspaceClient)
+	cmd := newListCommand()
+	cmd.SetContext(ctx)
+	require.NoError(t, cmd.Flags().Set("filter", "bogus=1"))
+
+	err := cmd.RunE(cmd, nil)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "unsupported --filter key")
+}
diff --git a/cmd/air/list_tui.go b/cmd/air/list_tui.go
new file mode 100644
index 00000000000..636836a84a0
--- /dev/null
+++ b/cmd/air/list_tui.go
@@ -0,0 +1,374 @@
+package aircmd
+
+import (
+	"fmt"
+	"io"
+	"strconv"
+	"strings"
+
+	"github.com/charmbracelet/bubbles/viewport"
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/charmbracelet/lipgloss"
+	"github.com/databricks/cli/libs/browser"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/spf13/cobra"
+)
+
+// renderListText renders the table for text output: an inline navigable table in
+// a terminal (paging in older runs on demand), otherwise printed once. JSON is
+// handled by the caller.
+func renderListText(cmd *cobra.Command, f *runFetcher, limit int) error {
+	ctx := cmd.Context()
+	out := cmd.OutOrStdout()
+
+	r, color := cmdio.NewRenderer(ctx, out)
+
+	// Navigate only with a full color TTY and no explicit --limit (which means
+	// "just print these N"). Everything else — piped, NO_COLOR, --limit — prints
+	// once.
+	interactive := color &&
+		cmdio.IsPagerSupported(ctx) &&
+		!cmd.Flags().Changed("limit")
+
+	if interactive {
+		first, err := f.next(listPageRows)
+		if err != nil {
+			return err
+		}
+		if len(first) == 0 {
+			_, err := io.WriteString(out, "No runs found.\n")
+			return err
+		}
+		_, err = tea.NewProgram(
+			newListModel(r, f, first, color),
+			tea.WithContext(ctx),
+			tea.WithInput(cmd.InOrStdin()),
+			tea.WithOutput(out),
+		).Run()
+		return err
+	}
+
+	rows, err := f.next(limit)
+	if err != nil {
+		return err
+	}
+	warnIfTruncated(ctx, f)
+	_, err = io.WriteString(out, staticListTable(r, rows, color))
+	return err
+}
+
+// staticListTable renders the whole table once, with no selection — used when
+// piped or non-interactive.
+func staticListTable(r *lipgloss.Renderer, rows []listRow, links bool) string {
+	if len(rows) == 0 {
+		return "No runs found.\n"
+	}
+	styles := newListStyles(r)
+	cols := computeListCols(rows)
+	var b strings.Builder
+	b.WriteString(styles.renderHeader(cols))
+	b.WriteByte('\n')
+	for _, row := range rows {
+		b.WriteString(styles.renderRow(cols, row, false, links))
+		b.WriteByte('\n')
+	}
+	return b.String()
+}
+
+// Mode constants for the TUI.
+const (
+	modeList   = 0
+	modeDetail = 1
+)
+
+// detailMsg carries fetched run details or error.
+type detailMsg struct {
+	title string
+	body  string
+	err   error
+}
+
+// listModel is the inline, navigable runs table. It lazily pages older runs from
+// the fetcher as the cursor nears the end of the loaded rows. fetcher is nil for
+// a fixed, non-paging table (e.g. in tests).
+type listModel struct {
+	rows    []listRow
+	styles  listStyles
+	cols    listCols
+	links   bool
+	fetcher *runFetcher
+	loading bool
+	loadErr error
+
+	cursor int
+	offset int // index of the first visible row
+	height int // terminal height, for windowing
+
+	mode          int            // modeList or modeDetail
+	viewport      viewport.Model // for detail pane
+	detailTitle   string         // title of detail pane
+	detailLoading bool           // loading detail
+	detailContent string         // rendered detail content
+}
+
+func newListModel(r *lipgloss.Renderer, f *runFetcher, rows []listRow, links bool) listModel {
+	return listModel{
+		rows:     rows,
+		styles:   newListStyles(r),
+		cols:     computeListCols(rows),
+		links:    links,
+		fetcher:  f,
+		mode:     modeList,
+		viewport: viewport.New(0, 0),
+	}
+}
+
+func (m listModel) Init() tea.Cmd { return nil }
+
+// moreRowsMsg carries a lazily fetched batch of rows, or the error that ended paging.
+type moreRowsMsg struct {
+	rows []listRow
+	err  error
+}
+
+// fetchCmd pulls the next batch of rows in the background; sets loading so only
+// one runs at a time, and returns the updated model with the fetch command.
+func (m listModel) fetchCmd() (listModel, tea.Cmd) {
+	m.loading = true
+	f := m.fetcher
+	return m, func() tea.Msg {
+		rows, err := f.next(listPageRows)
+		return moreRowsMsg{rows: rows, err: err}
+	}
+}
+
+// maybeFetch starts a fetch when the cursor nears the end of the loaded rows and
+// more runs may still exist.
+func (m listModel) maybeFetch() (listModel, tea.Cmd) {
+	if m.fetcher == nil || m.loading || m.loadErr != nil || m.fetcher.exhausted {
+		return m, nil
+	}
+	if m.cursor < len(m.rows)-m.visibleCount() {
+		return m, nil
+	}
+	return m.fetchCmd()
+}
+
+// listPageRows is the most rows shown per page.
+const listPageRows = 20
+
+// visibleCount is how many rows a page shows: at most listPageRows, and never
+// more than fits below the header and hint.
+func (m listModel) visibleCount() int {
+	n := min(listPageRows, len(m.rows))
+	if m.height > 0 {
+		n = min(n, m.height-3)
+	}
+	return max(1, n)
+}
+
+func (m listModel) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
+	switch msg := msg.(type) {
+	case tea.WindowSizeMsg:
+		m.height = msg.Height
+		m.viewport.Width = msg.Width
+		m.viewport.Height = max(msg.Height-3, 1)
+		m.offset = m.clampedOffset()
+		return m.maybeFetch()
+
+	case moreRowsMsg:
+		m.loading = false
+		if msg.err != nil {
+			m.loadErr = msg.err
+			return m, nil
+		}
+		m.rows = append(m.rows, msg.rows...)
+		m.cols = computeListCols(m.rows)
+		m.offset = m.clampedOffset()
+		// A page with no matches but more to scan: keep paging so the cursor isn't
+		// stuck at the end of the loaded rows.
+		if len(msg.rows) == 0 && !m.fetcher.exhausted {
+			return m.fetchCmd()
+		}
+		return m, nil
+
+	case detailMsg:
+		// The fetch is async: if the user pressed esc back to the list before it
+		// resolved, drop the late result rather than snapping them into a pane
+		// they already dismissed.
+		if m.mode != modeDetail {
+			return m, nil
+		}
+		m.detailLoading = false
+		if msg.err != nil {
+			m.detailContent = fmt.Sprintf("Error: %v", msg.err)
+		} else {
+			m.detailContent = msg.body
+		}
+		m.detailTitle = msg.title
+		m.viewport.SetContent(m.detailContent)
+		m.viewport.GotoTop()
+		return m, nil
+
+	case tea.KeyMsg:
+		// Detail pane key handling.
+		if m.mode == modeDetail {
+			switch msg.String() {
+			case "esc", "q":
+				m.mode = modeList
+				return m, nil
+			case "ctrl+c":
+				return m, tea.Quit
+			default:
+				// Delegate scrolling keys to the viewport.
+				var cmd tea.Cmd
+				m.viewport, cmd = m.viewport.Update(msg)
+				return m, cmd
+			}
+		}
+
+		// List pane key handling.
+		switch msg.String() {
+		case "q", "ctrl+c":
+			return m, tea.Quit
+		case "esc":
+			return m, tea.Quit
+		case "up", "k":
+			if m.cursor > 0 {
+				m.cursor--
+			}
+		case "down", "j":
+			if m.cursor < len(m.rows)-1 {
+				m.cursor++
+			}
+		case "right":
+			m.cursor = min(m.cursor+m.visibleCount(), len(m.rows)-1)
+		case "left":
+			m.cursor = max(m.cursor-m.visibleCount(), 0)
+		case "home", "g":
+			m.cursor = 0
+		case "end", "G":
+			m.cursor = len(m.rows) - 1
+		case "enter":
+			// Open the selected run's MLflow page in the browser.
+			if m.fetcher != nil && len(m.rows) > 0 {
+				if url := m.rows[m.cursor].MLflowURL; url != "" && url != "-" {
+					return m, m.openURL(url)
+				}
+			}
+		case "i":
+			// Open the run details pane; the fetch fills it in.
+			if m.fetcher != nil && len(m.rows) > 0 {
+				m.mode = modeDetail
+				m.detailLoading = true
+				m.detailTitle = "Run Details"
+				runID, _ := parseRunID(m.rows[m.cursor].RunID)
+				return m, m.fetchRunDetail(runID)
+			}
+		case "L", "l":
+			// Open the logs snapshot pane; the fetch fills it in.
+			if m.fetcher != nil && len(m.rows) > 0 {
+				m.mode = modeDetail
+				m.detailLoading = true
+				m.detailTitle = "Logs Snapshot"
+				runID, _ := parseRunID(m.rows[m.cursor].RunID)
+				return m, m.fetchRunLogs(runID)
+			}
+		}
+		m.offset = m.clampedOffset()
+		return m.maybeFetch()
+	}
+	return m, nil
+}
+
+// clampedOffset returns the scroll offset that keeps the cursor visible.
+func (m listModel) clampedOffset() int {
+	visible := m.visibleCount()
+	offset := min(m.offset, m.cursor)
+	if m.cursor >= offset+visible {
+		offset = m.cursor - visible + 1
+	}
+	return max(offset, 0)
+}
+
+func (m listModel) View() string {
+	if m.mode == modeDetail {
+		faint := m.styles.r.NewStyle().Foreground(colN7)
+		lines := []string{m.detailTitle}
+		if m.detailLoading {
+			lines = append(lines, "Loading…")
+		} else {
+			lines = append(lines, m.viewport.View())
+		}
+		footer := faint.Render("↑/↓ scroll · esc back · q quit")
+		lines = append(lines, footer)
+		return strings.Join(lines, "\n")
+	}
+
+	if len(m.rows) == 0 {
+		return m.styles.r.NewStyle().Foreground(colN9).Render("No runs found.") + "\n"
+	}
+
+	visible := m.visibleCount()
+	lines := []string{m.styles.renderHeader(m.cols)}
+	for i := m.offset; i < m.offset+visible && i < len(m.rows); i++ {
+		lines = append(lines, m.styles.renderRow(m.cols, m.rows[i], i == m.cursor, m.links))
+	}
+	lines = append(lines, m.renderHint())
+	return strings.Join(lines, "\n") + "\n"
+}
+
+// renderHint is the faint one-line key legend, with the cursor position and the
+// paging state (loading / load failed).
+func (m listModel) renderHint() string {
+	faint := m.styles.r.NewStyle().Foreground(colN7)
+	hint := fmt.Sprintf("↑/↓ navigate · ←/→ page · ↵ mlflow · i info · L logs · q quit  ·  row %d/%d", m.cursor+1, len(m.rows))
+	switch {
+	case m.loadErr != nil:
+		hint += " (load failed)"
+	case m.loading:
+		hint += " (loading…)"
+	}
+	return faint.Render(hint)
+}
+
+// fetchRunDetail returns a tea.Cmd that fetches run details in the background.
+func (m listModel) fetchRunDetail(runID int64) tea.Cmd {
+	ctx := m.fetcher.ctx
+	w := m.fetcher.w
+	return func() tea.Msg {
+		body, err := runDetailText(ctx, w, runID)
+		if err != nil {
+			return detailMsg{title: "Run Details", err: err}
+		}
+		return detailMsg{title: "Run Details", body: body}
+	}
+}
+
+// fetchRunLogs returns a tea.Cmd that fetches a log snapshot in the background.
+func (m listModel) fetchRunLogs(runID int64) tea.Cmd {
+	ctx := m.fetcher.ctx
+	w := m.fetcher.w
+	return func() tea.Msg {
+		body, err := runLogsSnapshot(ctx, w, runID)
+		if err != nil {
+			return detailMsg{title: "Logs Snapshot", err: err}
+		}
+		return detailMsg{title: "Logs Snapshot", body: body}
+	}
+}
+
+// openURL opens a URL in the user's default browser, best-effort.
+func (m listModel) openURL(url string) tea.Cmd {
+	ctx := m.fetcher.ctx
+	return func() tea.Msg {
+		_ = browser.Open(ctx, url)
+		return nil
+	}
+}
+
+// parseRunID parses a run id string to int64. Rows carry a formatted int64, so
+// this only fails on an unexpectedly malformed value.
+func parseRunID(runIDStr string) (int64, error) {
+	return strconv.ParseInt(runIDStr, 10, 64)
+}
diff --git a/cmd/air/list_tui_render.go b/cmd/air/list_tui_render.go
new file mode 100644
index 00000000000..3f23535a8e2
--- /dev/null
+++ b/cmd/air/list_tui_render.go
@@ -0,0 +1,251 @@
+package aircmd
+
+import (
+	"strings"
+
+	"github.com/charmbracelet/lipgloss"
+	"github.com/muesli/termenv"
+)
+
+// DuBois dark-first palette. Neutrals (n7..n12) carry structure; the state
+// colors are reserved for the Status column.
+const (
+	colN7      = lipgloss.Color("#69696B") // gutter / dim
+	colN9      = lipgloss.Color("#ABABAE") // secondary values
+	colN11     = lipgloss.Color("#E0E0E3") // body
+	colN12     = lipgloss.Color("#F1F1F4") // selected text
+	colOverlay = lipgloss.Color("#1F1F23") // selected-row fill
+	colRunID   = lipgloss.Color("#B7A8E8") // run id
+	colGreen   = lipgloss.Color("#4CD964") // success
+	colAmber   = lipgloss.Color("#E8B84A") // running / pending
+	colRed     = lipgloss.Color("#EB6B6B") // failed
+	colBlue    = lipgloss.Color("#6CA8F0") // MLflow link
+)
+
+const mlflowColWidth = 22
+
+// listStyles renders the runs table. The renderer carries the color profile, so
+// styles render plain under --no-color / non-tty.
+type listStyles struct {
+	r *lipgloss.Renderer
+}
+
+func newListStyles(r *lipgloss.Renderer) listStyles {
+	return listStyles{r: r}
+}
+
+// listCols holds the computed width of each variable-width column. MLflow is
+// fixed (a short link) and the gutter is one cell.
+type listCols struct {
+	runID, experiment, status, started, duration, progress, user, accel int
+}
+
+// columnCap bounds the widest free-text columns so one long value can't dominate
+// the row.
+const columnCap = 36
+
+func computeListCols(rows []listRow) listCols {
+	c := listCols{
+		runID:      len("Run ID"),
+		experiment: len("Experiment"),
+		status:     len("Status"),
+		started:    len("Started"),
+		duration:   len("Duration"),
+		progress:   len("Progress"),
+		user:       len("User"),
+		accel:      len("Accelerators"),
+	}
+	for _, r := range rows {
+		c.runID = max(c.runID, lipgloss.Width(r.RunID))
+		c.experiment = min(columnCap, max(c.experiment, lipgloss.Width(r.Experiment)))
+		c.status = max(c.status, lipgloss.Width("● "+listRowStatus(r)))
+		c.started = max(c.started, lipgloss.Width(startedDisplay(r)))
+		c.duration = max(c.duration, lipgloss.Width(r.Duration))
+		c.progress = max(c.progress, lipgloss.Width(progressDisplay(r)))
+		c.user = min(columnCap, max(c.user, lipgloss.Width(r.User)))
+		c.accel = max(c.accel, lipgloss.Width(r.Accelerators))
+	}
+	return c
+}
+
+// renderHeader renders the muted column-title row.
+func (s listStyles) renderHeader(cols listCols) string {
+	h := func(text string, width int, right bool) string {
+		return s.r.NewStyle().Foreground(colN9).Render(pad(text, width, right))
+	}
+	cells := []string{
+		pad(" ", 1, false),
+		h("Run ID", cols.runID, false),
+		h("Experiment", cols.experiment, false),
+		h("Status", cols.status, false),
+		h("Started", cols.started, false),
+		h("Duration", cols.duration, true),
+		h("Progress", cols.progress, true),
+		h("MLflow", mlflowColWidth, false),
+		h("User", cols.user, false),
+		h("Accelerators", cols.accel, false),
+	}
+	// Trim trailing pad on the final column so rows carry no trailing whitespace.
+	return strings.TrimRight(strings.Join(cells, "  "), " ")
+}
+
+// renderRow renders one run. The selected row uses a subtle overlay fill + n12
+// text (not full inversion, not per-state color).
+func (s listStyles) renderRow(cols listCols, r listRow, selected, links bool) string {
+	base := s.r.NewStyle()
+	if selected {
+		base = base.Background(colOverlay)
+	}
+	fg := func(c lipgloss.Color) lipgloss.Color {
+		if selected {
+			return colN12
+		}
+		return c
+	}
+
+	gutter := " "
+	if selected {
+		gutter = "▸"
+	}
+
+	runIDLink := ""
+	if links {
+		runIDLink = r.RunURL
+	}
+	experimentLink := ""
+	if links {
+		experimentLink = r.ExperimentURL
+	}
+
+	// Underline only cells that actually carry a link, so unlinked text isn't
+	// styled as clickable.
+	cells := []string{
+		s.cell(base, gutter, 1, fg(colN7), false, false, ""),
+		s.cell(base, r.RunID, cols.runID, fg(colRunID), false, runIDLink != "", runIDLink),
+		s.cell(base, r.Experiment, cols.experiment, fg(colN11), false, experimentLink != "", experimentLink),
+		s.cell(base, "● "+listRowStatus(r), cols.status, fg(statusColor(listRowStatus(r))), false, false, ""),
+		s.cell(base, startedDisplay(r), cols.started, fg(colN9), false, false, ""),
+		s.cell(base, r.Duration, cols.duration, fg(colN9), true, false, ""),
+		s.cell(base, progressDisplay(r), cols.progress, fg(colAmber), true, false, ""),
+		s.mlflowCell(base, r, selected, links),
+		s.cell(base, r.User, cols.user, fg(colN9), false, false, ""),
+		s.cell(base, r.Accelerators, cols.accel, fg(colN9), false, false, ""),
+	}
+	// Trim the final column's trailing pad so rows carry no trailing whitespace.
+	return strings.TrimRight(strings.Join(cells, base.Render("  ")), " ")
+}
+
+func listRowStatus(r listRow) string {
+	if r.DisplayStatus != "" {
+		return r.DisplayStatus
+	}
+	return r.Status
+}
+
+// cell renders one padded, colored cell. The text is truncated to width, then
+// padded with (background-only) spaces so columns align even when the text is
+// styled or hyperlinked.
+func (s listStyles) cell(base lipgloss.Style, text string, width int, fg lipgloss.Color, right, underline bool, link string) string {
+	text = truncate(text, width)
+	style := base.Foreground(fg)
+	if underline {
+		style = style.Underline(true)
+	}
+	rendered := style.Render(text)
+	if link != "" {
+		rendered = termenv.Hyperlink(link, rendered)
+	}
+	gap := max(width-lipgloss.Width(text), 0)
+	padStr := base.Render(strings.Repeat(" ", gap))
+	if right {
+		return padStr + rendered
+	}
+	return rendered + padStr
+}
+
+// mlflowCell renders the fixed-width MLflow column: a short, blue, underlined
+// OSC 8 hyperlink (when links are enabled), or "-" when the run has no link.
+func (s listStyles) mlflowCell(base lipgloss.Style, r listRow, selected, links bool) string {
+	if r.MLflowURL == "" || r.MLflowURL == "-" {
+		fg := colN9
+		if selected {
+			fg = colN12
+		}
+		return s.cell(base, "-", mlflowColWidth, fg, false, false, "")
+	}
+	fg := colBlue
+	if selected {
+		fg = colN12
+	}
+	link := ""
+	if links {
+		link = r.MLflowURL
+	}
+	label := r.MLflowLabel
+	if label == "" || label == "-" {
+		label = "-"
+	}
+	return s.cell(base, label, mlflowColWidth, fg, false, true, link)
+}
+
+// statusColor maps an air run status word to its data color.
+func statusColor(status string) lipgloss.Color {
+	switch status {
+	case "SUCCESS":
+		return colGreen
+	case "RUNNING", "PENDING", "TERMINATING":
+		return colAmber
+	case "FAILED":
+		return colRed
+	default: // CANCELED / UNKNOWN
+		return colN7
+	}
+}
+
+// progressDisplay is the row's progress estimate, or "-" when there is none
+// (a finished run, or a run we couldn't estimate).
+func progressDisplay(r listRow) string {
+	if r.Progress == "" {
+		return "-"
+	}
+	return r.Progress
+}
+
+// startedDisplay trims the row's ISO start timestamp to second precision
+// ("2006-01-02T15:04:05"), or "-" when the run hasn't started.
+func startedDisplay(r listRow) string {
+	if r.StartedAt == nil {
+		return "-"
+	}
+	s := *r.StartedAt
+	if len(s) >= 19 {
+		return s[:19]
+	}
+	return s
+}
+
+// pad pads (or truncates) s to a visible width of n, right-aligned when right is
+// set. It measures visible width, so it is safe on styled strings.
+func pad(s string, n int, right bool) string {
+	s = truncate(s, n)
+	gap := max(n-lipgloss.Width(s), 0)
+	if gap == 0 {
+		return s
+	}
+	fill := strings.Repeat(" ", gap)
+	if right {
+		return fill + s
+	}
+	return s + fill
+}
+
+// truncate shortens s to a visible width of n, appending "…" on overflow.
+func truncate(s string, n int) string {
+	if lipgloss.Width(s) <= n {
+		return s
+	}
+	if n <= 1 {
+		return "…"
+	}
+	return string([]rune(s)[:n-1]) + "…"
+}
diff --git a/cmd/air/list_tui_test.go b/cmd/air/list_tui_test.go
new file mode 100644
index 00000000000..50dfa7706f1
--- /dev/null
+++ b/cmd/air/list_tui_test.go
@@ -0,0 +1,287 @@
+package aircmd
+
+import (
+	"io"
+	"strconv"
+	"testing"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// testListRows is a small fixture covering each status color, a present and an
+// absent MLflow link, and a still-running (no end) row.
+func testListRows() []listRow {
+	return []listRow{
+		{RunID: "1", Experiment: "qwen-train", User: "me@example.com", Status: "SUCCESS", StartedAt: new("2026-06-05T17:32:39.000000+00:00"), Duration: "1m 14s", MLflowURL: "https://h/ml/experiments/E/runs/04c41514fbb0/artifacts/logs/node_0", MLflowLabel: "qwen-run-001", Accelerators: "8x H100"},
+		{RunID: "2", Experiment: "llama-train", User: "me@example.com", Status: "RUNNING", StartedAt: new("2026-06-05T18:43:24.000000+00:00"), Duration: "3m 32s", Progress: "81% · ~48m", MLflowURL: "-", MLflowLabel: "-", Accelerators: "1x A10"},
+		{RunID: "3", Experiment: "mixtral", User: "me@example.com", Status: "FAILED", StartedAt: nil, Duration: "-", MLflowURL: "-", MLflowLabel: "-", Accelerators: "-"},
+	}
+}
+
+func testListModel(t *testing.T) listModel {
+	r, _ := cmdio.NewRenderer(cmdio.MockDiscard(t.Context()), io.Discard)
+	return newListModel(r, nil, testListRows(), false)
+}
+
+func key(t *testing.T, m listModel, s string) listModel {
+	t.Helper()
+	next, _ := m.Update(tea.KeyMsg{Type: tea.KeyRunes, Runes: []rune(s)})
+	return next.(listModel)
+}
+
+func TestListModelNavigation(t *testing.T) {
+	m := testListModel(t)
+	require.Equal(t, 0, m.cursor)
+
+	m = key(t, m, "j")
+	assert.Equal(t, 1, m.cursor)
+	m = key(t, key(t, m, "k"), "k") // clamp at top
+	assert.Equal(t, 0, m.cursor)
+
+	for range len(m.rows) + 2 { // clamp at bottom
+		m = key(t, m, "j")
+	}
+	assert.Equal(t, len(m.rows)-1, m.cursor)
+}
+
+func TestListModelWindowScrolls(t *testing.T) {
+	m := testListModel(t)
+	// Height 5 leaves room for ~2 rows (header + hint reserved).
+	next, _ := m.Update(tea.WindowSizeMsg{Width: 200, Height: 5})
+	m = next.(listModel)
+	require.Equal(t, 2, m.visibleCount())
+	require.Equal(t, 0, m.offset)
+
+	m = key(t, key(t, m, "j"), "j") // move to row index 2, past the window
+	assert.Equal(t, 2, m.cursor)
+	assert.Equal(t, 1, m.offset, "window scrolled to keep the cursor visible")
+}
+
+func TestListModelPageCap(t *testing.T) {
+	rows := make([]listRow, 50)
+	for i := range rows {
+		rows[i] = listRow{RunID: strconv.Itoa(i)}
+	}
+	r, _ := cmdio.NewRenderer(cmdio.MockDiscard(t.Context()), io.Discard)
+	m := newListModel(r, nil, rows, false)
+
+	// A tall terminal still shows at most listPageRows per page.
+	next, _ := m.Update(tea.WindowSizeMsg{Width: 80, Height: 100})
+	assert.Equal(t, listPageRows, next.(listModel).visibleCount())
+}
+
+func TestListModelPaging(t *testing.T) {
+	rows := make([]listRow, 10)
+	for i := range rows {
+		rows[i] = listRow{RunID: strconv.Itoa(i)}
+	}
+	r, _ := cmdio.NewRenderer(cmdio.MockDiscard(t.Context()), io.Discard)
+	m := newListModel(r, nil, rows, false)
+
+	// Height 7 leaves a 4-row window (header + hint reserved).
+	next, _ := m.Update(tea.WindowSizeMsg{Width: 80, Height: 7})
+	m = next.(listModel)
+	require.Equal(t, 4, m.visibleCount())
+
+	page := func(k tea.KeyType) {
+		n, _ := m.Update(tea.KeyMsg{Type: k})
+		m = n.(listModel)
+	}
+	page(tea.KeyRight)
+	assert.Equal(t, 4, m.cursor)
+	page(tea.KeyEnd)
+	assert.Equal(t, 9, m.cursor)
+	page(tea.KeyLeft)
+	assert.Equal(t, 5, m.cursor)
+	page(tea.KeyHome)
+	assert.Equal(t, 0, m.cursor)
+}
+
+func TestListModelMoreRows(t *testing.T) {
+	m := testListModel(t)
+	m.loading = true
+	before := len(m.rows)
+
+	next, cmd := m.Update(moreRowsMsg{rows: []listRow{{RunID: "4"}, {RunID: "5"}}})
+	m = next.(listModel)
+
+	assert.False(t, m.loading, "loading cleared after a batch arrives")
+	assert.NoError(t, m.loadErr)
+	require.Len(t, m.rows, before+2)
+	assert.Equal(t, "5", m.rows[len(m.rows)-1].RunID, "new rows appended")
+	assert.Nil(t, cmd)
+}
+
+func TestListModelMoreRowsError(t *testing.T) {
+	m := testListModel(t)
+	m.loading = true
+	before := len(m.rows)
+
+	next, cmd := m.Update(moreRowsMsg{err: io.ErrUnexpectedEOF})
+	m = next.(listModel)
+
+	assert.False(t, m.loading)
+	assert.ErrorIs(t, m.loadErr, io.ErrUnexpectedEOF)
+	assert.Len(t, m.rows, before, "rows unchanged on error")
+	assert.Nil(t, cmd)
+}
+
+func TestListModelMoreRowsEmptyKeepsPaging(t *testing.T) {
+	r, _ := cmdio.NewRenderer(cmdio.MockDiscard(t.Context()), io.Discard)
+
+	// An empty page while more runs remain re-fetches; once exhausted it stops.
+	m := newListModel(r, &runFetcher{}, testListRows(), false)
+	m.loading = true
+	next, cmd := m.Update(moreRowsMsg{})
+	m = next.(listModel)
+	assert.NotNil(t, cmd, "empty page with more to scan keeps paging")
+
+	m.fetcher.exhausted = true
+	m.loading = true
+	_, cmd = m.Update(moreRowsMsg{})
+	assert.Nil(t, cmd, "empty page stops once the fetcher is exhausted")
+}
+
+func TestListModelQuit(t *testing.T) {
+	m := testListModel(t)
+	_, cmd := m.Update(tea.KeyMsg{Type: tea.KeyRunes, Runes: []rune("q")})
+	require.NotNil(t, cmd)
+	assert.Equal(t, tea.QuitMsg{}, cmd())
+}
+
+func TestListModelView(t *testing.T) {
+	next, _ := testListModel(t).Update(tea.WindowSizeMsg{Width: 200, Height: 24})
+	out := next.(listModel).View()
+
+	assert.NotContains(t, out, "\x1b", "Ascii profile + no links should produce no escapes")
+	for _, want := range []string{
+		"Run ID", "Experiment", "Status", "Started", "Duration", "Progress", "MLflow", "User", "Accelerators",
+		"qwen-train", "● SUCCESS", "● RUNNING", "● FAILED",
+		"81% · ~48m",          // progress on the running row
+		"qwen-run-001",        // MLflow run label
+		"2026-06-05T17:32:39", // started trimmed to seconds
+		"▸",                   // selection gutter on the first row
+		"↑/↓ navigate",        // hint line
+	} {
+		assert.Contains(t, out, want)
+	}
+}
+
+func TestStaticListTable(t *testing.T) {
+	r, _ := cmdio.NewRenderer(cmdio.MockDiscard(t.Context()), io.Discard)
+	out := staticListTable(r, testListRows(), false)
+
+	assert.NotContains(t, out, "\x1b")
+	assert.NotContains(t, out, "▸", "static table has no selection")
+	for _, want := range []string{"Run ID", "1", "qwen-train", "qwen-run-001", "Accelerators"} {
+		assert.Contains(t, out, want)
+	}
+
+	assert.Equal(t, "No runs found.\n", staticListTable(r, nil, false))
+}
+
+func TestStatusColor(t *testing.T) {
+	assert.Equal(t, colGreen, statusColor("SUCCESS"))
+	assert.Equal(t, colAmber, statusColor("RUNNING"))
+	assert.Equal(t, colAmber, statusColor("PENDING"))
+	assert.Equal(t, colRed, statusColor("FAILED"))
+	assert.Equal(t, colN7, statusColor("CANCELED"))
+	assert.Equal(t, colN7, statusColor("UNKNOWN"))
+}
+
+func TestStartedDisplay(t *testing.T) {
+	assert.Equal(t, "-", startedDisplay(listRow{}))
+	assert.Equal(t, "2026-06-05T17:32:39", startedDisplay(listRow{StartedAt: new("2026-06-05T17:32:39.000000+00:00")}))
+}
+
+func TestRenderRowHyperlinks(t *testing.T) {
+	r, _ := cmdio.NewRenderer(cmdio.MockDiscard(t.Context()), io.Discard)
+	styles := newListStyles(r)
+	row := listRow{
+		RunID: "1", Experiment: "exp", Status: "SUCCESS", Duration: "-", Accelerators: "-",
+		RunURL: "https://h/jobs/runs/1?o=2", ExperimentURL: "https://h/ml/experiments/E?o=2",
+		MLflowURL: "https://h/ml/experiments/E/runs/rid", MLflowLabel: "my-run",
+	}
+	cols := computeListCols([]listRow{row})
+
+	linked := styles.renderRow(cols, row, false, true)
+	assert.Contains(t, linked, "\x1b]8;;https://h/jobs/runs/1?o=2", "run id links to the dashboard")
+	assert.Contains(t, linked, "\x1b]8;;https://h/ml/experiments/E?o=2", "experiment links to the experiment page")
+
+	plain := styles.renderRow(cols, row, false, false)
+	assert.NotContains(t, plain, "\x1b]8;;", "no links when links are disabled")
+}
+
+func TestListModelInfoKeyOpensDetail(t *testing.T) {
+	r, _ := cmdio.NewRenderer(cmdio.MockDiscard(t.Context()), io.Discard)
+	f := &runFetcher{ctx: t.Context(), w: newTestWorkspaceClient(t, "https://x.test")}
+	m := newListModel(r, f, testListRows(), false)
+
+	// `i` opens the detail pane in a loading state and dispatches a fetch (not run here).
+	next, cmd := m.Update(tea.KeyMsg{Type: tea.KeyRunes, Runes: []rune("i")})
+	m = next.(listModel)
+	assert.Equal(t, modeDetail, m.mode)
+	assert.True(t, m.detailLoading)
+	assert.NotNil(t, cmd)
+}
+
+// detailLoadingModel returns a sized model in the detail-loading state, as if
+// the user just pressed `i` and the fetch is still in flight.
+func detailLoadingModel(t *testing.T) listModel {
+	t.Helper()
+	r, _ := cmdio.NewRenderer(cmdio.MockDiscard(t.Context()), io.Discard)
+	f := &runFetcher{ctx: t.Context(), w: newTestWorkspaceClient(t, "https://x.test")}
+	m := newListModel(r, f, testListRows(), false)
+	next, _ := m.Update(tea.WindowSizeMsg{Width: 80, Height: 24})
+	m = next.(listModel)
+	next, _ = m.Update(tea.KeyMsg{Type: tea.KeyRunes, Runes: []rune("i")})
+	m = next.(listModel)
+	require.Equal(t, modeDetail, m.mode)
+	require.True(t, m.detailLoading)
+	return m
+}
+
+func TestListModelDetailPaneAndBack(t *testing.T) {
+	m := detailLoadingModel(t)
+
+	// A resolved detailMsg fills the pane.
+	next, _ := m.Update(detailMsg{title: "Run Details", body: "hello from the detail pane"})
+	m = next.(listModel)
+	require.Equal(t, modeDetail, m.mode)
+	assert.False(t, m.detailLoading)
+	view := m.View()
+	assert.Contains(t, view, "Run Details")
+	assert.Contains(t, view, "hello from the detail pane")
+	assert.Contains(t, view, "esc back")
+
+	// esc returns to the list.
+	next, _ = m.Update(tea.KeyMsg{Type: tea.KeyEsc})
+	m = next.(listModel)
+	assert.Equal(t, modeList, m.mode)
+	assert.Contains(t, m.View(), "Run ID")
+}
+
+func TestListModelDetailLateMsgDropped(t *testing.T) {
+	m := detailLoadingModel(t)
+
+	// User escapes back to the list before the fetch resolves.
+	next, _ := m.Update(tea.KeyMsg{Type: tea.KeyEsc})
+	m = next.(listModel)
+	require.Equal(t, modeList, m.mode)
+
+	// The late result must be dropped, not snap the user back into the pane.
+	next, _ = m.Update(detailMsg{title: "Run Details", body: "late result"})
+	m = next.(listModel)
+	assert.Equal(t, modeList, m.mode)
+	assert.NotContains(t, m.View(), "late result")
+}
+
+func TestPadAndTruncate(t *testing.T) {
+	assert.Equal(t, "ab   ", pad("ab", 5, false))
+	assert.Equal(t, "   ab", pad("ab", 5, true))
+	assert.Equal(t, "abcd…", truncate("abcdefgh", 5))
+	assert.Equal(t, "abc", truncate("abc", 5))
+}
diff --git a/cmd/air/logbricklens.go b/cmd/air/logbricklens.go
new file mode 100644
index 00000000000..ca3b8170130
--- /dev/null
+++ b/cmd/air/logbricklens.go
@@ -0,0 +1,88 @@
+package aircmd
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strconv"
+
+	"github.com/databricks/databricks-sdk-go/client"
+)
+
+// bricklensLogsPathFmt is the log endpoint, keyed by Jobs run id. Called with a
+// raw client.Do because the SDK does not model the AiTrainingService.
+const bricklensLogsPathFmt = "/api/2.0/ai-training/workflows/by-run-id/%d/logs"
+
+// logRecord is one log line from Bricklens.
+type logRecord struct {
+	// TimeUnixNano may arrive as a JSON number or string.
+	TimeUnixNano json.Number `json:"time_unix_nano"`
+	RecordID     string      `json:"record_id"`
+	Body         string      `json:"body"`
+	NodeIndex    int         `json:"node_index"`
+}
+
+// nano returns time_unix_nano as an int64, or 0 when absent or unparseable.
+func (r logRecord) nano() int64 {
+	n, err := r.TimeUnixNano.Int64()
+	if err != nil {
+		return 0
+	}
+	return n
+}
+
+type bricklensLogsResponse struct {
+	LogRecords    []logRecord `json:"log_records"`
+	NextPageToken string      `json:"next_page_token"`
+}
+
+// bricklensLogsQuery is the request-field surface of the log endpoint.
+type bricklensLogsQuery struct {
+	// fromSeconds and toSeconds bound the query window in Unix epoch seconds.
+	fromSeconds int64
+	toSeconds   int64
+	pageToken   string
+	pageSize    int
+	// attemptNumber selects a retry attempt (0-indexed); -1 means latest.
+	attemptNumber int
+	nodeIndex     int
+	// ascending returns oldest-first. The endpoint defaults to ascending when
+	// absent, so the tail fetch must send an explicit false for newest-first.
+	ascending bool
+}
+
+// getBricklensLogs fetches one page of logs. The API client is built once by the
+// caller and reused across the poll loop. It returns the raw error so the caller
+// can classify it via classifyLogError.
+func getBricklensLogs(ctx context.Context, apiClient *client.DatabricksClient, headers map[string]string, runID int64, q bricklensLogsQuery) (*bricklensLogsResponse, error) {
+	query := map[string]any{
+		// Always sent: the tail path relies on an explicit false for newest-first.
+		"ascending": strconv.FormatBool(q.ascending),
+	}
+	if q.fromSeconds > 0 {
+		query["from"] = q.fromSeconds
+	}
+	if q.toSeconds > 0 {
+		query["to"] = q.toSeconds
+	}
+	if q.pageToken != "" {
+		query["page_token"] = q.pageToken
+	}
+	if q.pageSize > 0 {
+		query["page_size"] = q.pageSize
+	}
+	if q.attemptNumber >= 0 {
+		query["ref.attempt_number"] = q.attemptNumber
+	}
+	if q.nodeIndex >= 0 {
+		query["filter.node_index"] = q.nodeIndex
+	}
+
+	var resp bricklensLogsResponse
+	path := fmt.Sprintf(bricklensLogsPathFmt, runID)
+	if err := apiClient.Do(ctx, http.MethodGet, path, headers, nil, query, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
diff --git a/cmd/air/logbricklens_test.go b/cmd/air/logbricklens_test.go
new file mode 100644
index 00000000000..b9ef527a4f5
--- /dev/null
+++ b/cmd/air/logbricklens_test.go
@@ -0,0 +1,83 @@
+package aircmd
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+
+	"github.com/databricks/databricks-sdk-go/client"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetBricklensLogsQuerySerialization(t *testing.T) {
+	var got url.Values
+	var gotPath string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/oidc/.well-known/oauth-authorization-server" {
+			gotPath = r.URL.Path
+			got = r.URL.Query()
+		}
+		_, _ = w.Write([]byte(`{"log_records": [], "next_page_token": ""}`))
+	}))
+	t.Cleanup(srv.Close)
+
+	w := newTestWorkspaceClient(t, srv.URL)
+	apiClient, err := client.New(w.Config)
+	require.NoError(t, err)
+	_, err = getBricklensLogs(t.Context(), apiClient, nil, 42, bricklensLogsQuery{
+		fromSeconds:   100,
+		toSeconds:     200,
+		pageToken:     "tok",
+		pageSize:      500,
+		attemptNumber: 1,
+		nodeIndex:     3,
+		ascending:     true,
+	})
+	require.NoError(t, err)
+
+	assert.Equal(t, "/api/2.0/ai-training/workflows/by-run-id/42/logs", gotPath)
+	assert.Equal(t, "100", got.Get("from"))
+	assert.Equal(t, "200", got.Get("to"))
+	assert.Equal(t, "tok", got.Get("page_token"))
+	assert.Equal(t, "500", got.Get("page_size"))
+	assert.Equal(t, "1", got.Get("ref.attempt_number"))
+	assert.Equal(t, "3", got.Get("filter.node_index"))
+	assert.Equal(t, "true", got.Get("ascending"))
+}
+
+func TestGetBricklensLogsOmitsOptionals(t *testing.T) {
+	var got url.Values
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/oidc/.well-known/oauth-authorization-server" {
+			got = r.URL.Query()
+		}
+		_, _ = w.Write([]byte(`{"log_records": []}`))
+	}))
+	t.Cleanup(srv.Close)
+
+	w := newTestWorkspaceClient(t, srv.URL)
+	apiClient, err := client.New(w.Config)
+	require.NoError(t, err)
+	// attempt -1 (latest) and node 0 are the default request; from/to/page unset.
+	_, err = getBricklensLogs(t.Context(), apiClient, nil, 7, bricklensLogsQuery{attemptNumber: -1, nodeIndex: 0})
+	require.NoError(t, err)
+
+	assert.False(t, got.Has("from"))
+	assert.False(t, got.Has("to"))
+	assert.False(t, got.Has("page_token"))
+	assert.False(t, got.Has("page_size"))
+	// -1 attempt means "latest" — the field is omitted so the endpoint defaults.
+	assert.False(t, got.Has("ref.attempt_number"))
+	// node 0 is a real filter value and must be sent.
+	assert.Equal(t, "0", got.Get("filter.node_index"))
+	// ascending is always sent so the tail path can force newest-first.
+	assert.Equal(t, "false", got.Get("ascending"))
+}
+
+func TestLogRecordNano(t *testing.T) {
+	assert.Equal(t, int64(123), logRecord{TimeUnixNano: "123"}.nano())
+	assert.Equal(t, int64(0), logRecord{TimeUnixNano: ""}.nano())
+	assert.Equal(t, int64(0), logRecord{TimeUnixNano: "notanumber"}.nano())
+}
diff --git a/cmd/air/logdetect.go b/cmd/air/logdetect.go
new file mode 100644
index 00000000000..f804f4d5812
--- /dev/null
+++ b/cmd/air/logdetect.go
@@ -0,0 +1,53 @@
+package aircmd
+
+import "regexp"
+
+// fatalPatterns match log lines that signal a run-ending failure (OOM, NCCL
+// timeouts, CUDA errors, segfaults, etc.). In --json mode a matching line emits
+// an ALERT event alongside its LOG event, giving an agent an immediate signal.
+var fatalPatterns = []*regexp.Regexp{
+	// OOM
+	regexp.MustCompile(`(?i)CUDA out of memory`),
+	regexp.MustCompile(`(?i)Out of memory: Kill(ed)? process`),
+	// Signals
+	regexp.MustCompile(`(?i)signal\s+(9|SIGKILL|SIGTERM)`),
+	// NCCL / collective
+	regexp.MustCompile(`Watchdog caught collective operation timeout`),
+	regexp.MustCompile(`(?i)NCCL WARN .*(Conn|Net|IB|timeout|unhandled)`),
+	regexp.MustCompile(`Got async error event`),
+	regexp.MustCompile(`transport/net_ib\.cc:\d+.*WARN`),
+	// CUDA
+	regexp.MustCompile(`(?i)CUDA(?: runtime)? error`),
+	regexp.MustCompile(`(?i)an illegal memory access was encountered`),
+	regexp.MustCompile(`CUDA kernel errors might be asynchronously reported`),
+	// Segfault
+	regexp.MustCompile(`(?i)segmentation fault`),
+	// Composer / llmfoundry specific
+	regexp.MustCompile(`composer\.utils\..*Error`),
+	regexp.MustCompile(`(?i)composer.*OutOfMemory`),
+	// torch.distributed
+	regexp.MustCompile(`torch\.distributed\..*(?:Error|Exception)`),
+	regexp.MustCompile(`(?i)(?:TCPStore|Store).*timed?\s*out`),
+	// GPU hardware (Xid from dmesg / driver)
+	regexp.MustCompile(`Xid.*\b(48|63|64|79|94|95)\b`),
+	// Streaming dataset
+	regexp.MustCompile(`streaming\.base\..*(?:Error|Exception)`),
+	// Bare "Killed" on its own line means OOM-killer or similar
+	regexp.MustCompile(`^\s*Killed\s*$`),
+	// MLflow stall — training has stopped logging metrics
+	regexp.MustCompile(`\[MLflow Logger\]\[Warning\] No new logs have been emitted`),
+	// The launch script prints this when the user's command fails; [1-9]\d* skips exit code 0.
+	regexp.MustCompile(`ERROR: Script failed with exit code [1-9]\d* after \d+s`),
+	// Missing command (exit 127), e.g. a typo.
+	regexp.MustCompile(`(?i)command not found`),
+}
+
+// matchFatalPattern reports whether a log line matches a fatal-failure pattern.
+func matchFatalPattern(line string) bool {
+	for _, p := range fatalPatterns {
+		if p.MatchString(line) {
+			return true
+		}
+	}
+	return false
+}
diff --git a/cmd/air/logdownload.go b/cmd/air/logdownload.go
new file mode 100644
index 00000000000..a0eeea33a05
--- /dev/null
+++ b/cmd/air/logdownload.go
@@ -0,0 +1,276 @@
+package aircmd
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path"
+	"path/filepath"
+	"slices"
+	"sync"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"golang.org/x/sync/errgroup"
+)
+
+// downloadConcurrency caps how many nodes download at once, to avoid hammering
+// the artifact store on a wide run.
+const downloadConcurrency = 8
+
+// errNodeOutOfRange marks --node naming a node the run doesn't have. It is user
+// input, so the caller reports it as an invalid argument rather than a failure.
+var errNodeOutOfRange = errors.New("invalid --node")
+
+// resolveNodeCount returns how many nodes a run used.
+func resolveNodeCount(run *jobs.Run) (int, error) {
+	accelType, count := jobCompute(run)
+	if accelType == "" {
+		return 0, fmt.Errorf("run %d has no AI runtime compute config", run.RunId)
+	}
+	if count <= 0 {
+		return 0, fmt.Errorf("run %d reports %d accelerators", run.RunId, count)
+	}
+	g, err := parseGPUType(accelType)
+	if err != nil {
+		return 0, err
+	}
+	perNode, err := gpusPerNode(g)
+	if err != nil {
+		return 0, err
+	}
+	// Accelerators come in whole nodes, so a remainder means we can't map the
+	// count onto node indices.
+	if count%perNode != 0 {
+		return 0, fmt.Errorf("run %d reports %d %s accelerators, which is not a multiple of %d per node", run.RunId, count, accelType, perNode)
+	}
+	return count / perNode, nil
+}
+
+// downloadLogs writes each node's logs to <downloadTo>/logs/node_<n>.log and
+// prints a summary. An explicit --node downloads only that node; otherwise all of
+// them. Logs come from MLflow artifacts, since Bricklens only streams. The
+// returned bool is the run's outcome, so the exit code matches the streaming path.
+func downloadLogs(ctx context.Context, w *databricks.WorkspaceClient, out io.Writer, req logRequest, status logRunStatus) (bool, error) {
+	run, err := w.Jobs.GetRun(ctx, jobs.GetRunRequest{RunId: req.runID})
+	if err != nil {
+		return false, err
+	}
+
+	numNodes, err := resolveNodeCount(run)
+	if err != nil {
+		return false, err
+	}
+
+	nodes := make([]int, 0, numNodes)
+	if req.nodeSet {
+		if req.node >= numNodes {
+			return false, fmt.Errorf("%w %d: run has %d node(s), indexed 0 to %d", errNodeOutOfRange, req.node, numNodes, numNodes-1)
+		}
+		nodes = append(nodes, req.node)
+	} else {
+		for n := range numNodes {
+			nodes = append(nodes, n)
+		}
+	}
+
+	// A run with no logs is reported the same way as on the streaming path, so
+	// the message and exit code agree between them.
+	attempt, taskRunID, err := resolveLogAttempt(run, req.attempt)
+	if err != nil {
+		return false, err
+	}
+	ids := mlflowIDsForTask(ctx, w, taskRunID)
+	if ids == nil || ids.RunID == "" {
+		emitNoLogs(out, req, status)
+		return status.downloadOutcome(), nil
+	}
+
+	dir, err := filepath.Abs(req.downloadTo)
+	if err != nil {
+		return false, err
+	}
+	// Created up front so a bad --download-to fails with a clear message before
+	// any download work happens.
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		return false, fmt.Errorf("failed to create %s: %w", dir, err)
+	}
+
+	nodeLogs, failures, err := downloadAllNodeLogs(ctx, w, ids.RunID, dir, nodes, attempt)
+	if err != nil {
+		return false, err
+	}
+	for _, node := range sortedNodeKeys(failures) {
+		cmdio.LogString(ctx, fmt.Sprintf("warning: node %d: %s", node, failures[node]))
+	}
+
+	if len(nodeLogs) == 0 {
+		// "No logs available" would be a lie when the logs exist but couldn't be
+		// fetched. The warnings above go to stderr, which a -o json consumer reading
+		// stdout never sees, so fail instead of reporting an empty run.
+		if len(failures) > 0 {
+			return false, fmt.Errorf("failed to download logs from any of %d node(s): %s",
+				len(nodes), failures[sortedNodeKeys(failures)[0]])
+		}
+		emitNoLogs(out, req, status)
+		return status.downloadOutcome(), nil
+	}
+
+	cmdio.LogString(ctx, fmt.Sprintf("Downloaded logs from %d of %d node(s) to %s", len(nodeLogs), len(nodes), dir))
+	for _, node := range sortedNodeKeys(nodeLogs) {
+		// Flag it on the file's own line, not just in the warning above.
+		suffix := ""
+		if _, truncated := failures[node]; truncated {
+			suffix = " (incomplete)"
+		}
+		cmdio.LogString(ctx, fmt.Sprintf("  node %d: %s%s", node, nodeLogs[node], suffix))
+	}
+	return status.downloadOutcome(), nil
+}
+
+// downloadAllNodeLogs downloads the nodes' logs in parallel. It returns a
+// node->path map for the nodes that had logs and a node->reason map for those
+// that failed; a truncated node appears in both. The log-dir layout is run-wide,
+// so it is probed once here rather than by every worker.
+func downloadAllNodeLogs(ctx context.Context, w *databricks.WorkspaceClient, mlflowRunID, dir string, nodes []int, attempt int) (map[int]string, map[int]string, error) {
+	// -1 (latest) maps to attempt 0's directory, as on the streaming path.
+	attemptDir := max(attempt, 0)
+	withAttempt, err := discoverAttemptPrefix(ctx, w, mlflowRunID, attemptDir)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	paths := make([]string, len(nodes))
+	reasons := make([]string, len(nodes))
+	g, gctx := errgroup.WithContext(ctx)
+	g.SetLimit(downloadConcurrency)
+	for i, node := range nodes {
+		g.Go(func() error {
+			path, err := downloadNodeLog(gctx, w, mlflowRunID, node, attemptDir, withAttempt, dir)
+			switch {
+			case errors.Is(err, context.Canceled), errors.Is(err, context.DeadlineExceeded):
+				// Interrupting the command must not look like a node with no logs.
+				return err
+			case err != nil:
+				// One bad node shouldn't abort the rest. A truncated node
+				// returns a path as well as an error, so keep both.
+				reasons[i] = err.Error()
+				paths[i] = path
+			default:
+				paths[i] = path
+			}
+			return nil
+		})
+	}
+	if err := g.Wait(); err != nil {
+		return nil, nil, err
+	}
+
+	nodeLogs := map[int]string{}
+	failures := map[int]string{}
+	for i, node := range nodes {
+		if paths[i] != "" {
+			nodeLogs[node] = paths[i]
+		}
+		if reasons[i] != "" {
+			failures[node] = reasons[i]
+		}
+	}
+	return nodeLogs, failures, nil
+}
+
+// downloadNodeLog streams a node's chunks in order into dir/logs/node_<n>.log,
+// returning the path, or "" if the node logged nothing. A failed chunk is skipped
+// rather than ending the walk, so a partial download returns both a path and an
+// error naming the gaps. The bytes are copied verbatim: a download should
+// reproduce the log exactly, so it must not round-trip through lines (which would
+// rewrite line endings and cap long lines).
+func downloadNodeLog(ctx context.Context, w *databricks.WorkspaceClient, mlflowRunID string, node, attempt int, withAttempt bool, dir string) (string, error) {
+	logDir := constructLogPath(node, attempt, withAttempt)
+	chunks, err := listLogChunks(ctx, w, mlflowRunID, logDir)
+	if err != nil {
+		return "", err
+	}
+	if len(chunks) == 0 {
+		// The listing can lag behind the sidecar, so fall back to chunk 0 as the
+		// streaming path does.
+		chunks = []logChunk{{index: 0, path: path.Join(logDir, chunkFileName(0))}}
+	}
+
+	outPath := filepath.Join(dir, "logs", fmt.Sprintf("node_%d.log", node))
+	if err := os.MkdirAll(filepath.Dir(outPath), 0o755); err != nil {
+		return "", err
+	}
+	f, err := os.Create(outPath)
+	if err != nil {
+		return "", err
+	}
+	// Idempotent so the deferred cleanup and the explicit close before os.Remove
+	// (Windows can't remove an open file) don't double-close.
+	closeFile := sync.OnceFunc(func() { _ = f.Close() })
+	defer closeFile()
+
+	// Skip a failed chunk and keep going: the tail usually holds the failure
+	// signature, so losing it to an early bad chunk is worse than a gap. Cancellation
+	// still aborts, since every remaining chunk would fail too.
+	var written int64
+	var missing []int
+	for _, chunk := range chunks {
+		n, err := copyArtifactTo(ctx, w, mlflowRunID, chunk.path, f)
+		switch {
+		case errors.Is(err, context.Canceled), errors.Is(err, context.DeadlineExceeded):
+			closeFile()
+			os.Remove(outPath)
+			return "", err
+		case err != nil:
+			log.Debugf(ctx, "air logs: node %d chunk %d failed: %v", node, chunk.index, err)
+			missing = append(missing, chunk.index)
+		default:
+			written += n
+		}
+	}
+	if written == 0 {
+		closeFile()
+		os.Remove(outPath)
+		if len(missing) > 0 {
+			return "", fmt.Errorf("every chunk failed to download (%d total)", len(missing))
+		}
+		return "", nil
+	}
+	if len(missing) > 0 {
+		return outPath, fmt.Errorf("incomplete: chunk(s) %v failed to download", missing)
+	}
+	return outPath, nil
+}
+
+// copyArtifactTo streams one artifact's bytes into dst and returns how many were
+// written.
+func copyArtifactTo(ctx context.Context, w *databricks.WorkspaceClient, mlflowRunID, artifactPath string, dst io.Writer) (int64, error) {
+	local, err := downloadArtifact(ctx, w, mlflowRunID, artifactPath)
+	if err != nil {
+		return 0, err
+	}
+	defer os.Remove(local)
+
+	src, err := os.Open(local)
+	if err != nil {
+		return 0, err
+	}
+	defer src.Close()
+	return io.Copy(dst, src)
+}
+
+// sortedNodeKeys returns the map's node ids in ascending order, so the summary
+// prints deterministically.
+func sortedNodeKeys(m map[int]string) []int {
+	keys := make([]int, 0, len(m))
+	for k := range m {
+		keys = append(keys, k)
+	}
+	slices.Sort(keys)
+	return keys
+}
diff --git a/cmd/air/logdownload_test.go b/cmd/air/logdownload_test.go
new file mode 100644
index 00000000000..57b6982bddf
--- /dev/null
+++ b/cmd/air/logdownload_test.go
@@ -0,0 +1,555 @@
+package aircmd
+
+import (
+	"bytes"
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// airRunWithCompute builds a run reporting the given accelerator type and count.
+func airRunWithCompute(accelType string, count int) *jobs.Run {
+	return &jobs.Run{
+		RunId: 123,
+		Tasks: []jobs.RunTask{{
+			RunId: 456,
+			AiRuntimeTask: &jobs.AiRuntimeTask{
+				Deployments: []jobs.DeploymentSpec{{
+					Compute: jobs.ComputeSpec{
+						AcceleratorType:  jobs.ComputeSpecAcceleratorType(accelType),
+						AcceleratorCount: count,
+					},
+				}},
+			},
+		}},
+	}
+}
+
+func TestResolveNodeCount(t *testing.T) {
+	tests := []struct {
+		accelType string
+		count     int
+		want      int
+	}{
+		{"GPU_1xA10", 2, 2},
+		{"GPU_1xH100", 4, 4},
+		{"GPU_8xH100", 16, 2},
+		{"GPU_8xB300", 16, 2},
+	}
+	for _, tt := range tests {
+		n, err := resolveNodeCount(airRunWithCompute(tt.accelType, tt.count))
+		require.NoError(t, err)
+		assert.Equal(t, tt.want, n)
+	}
+
+	// A run with no AI runtime compute errors.
+	_, err := resolveNodeCount(&jobs.Run{RunId: 1})
+	require.Error(t, err)
+
+	// A count that isn't a whole number of nodes can't be mapped to node indices,
+	// so it errors rather than truncating to 0.
+	_, err = resolveNodeCount(airRunWithCompute("GPU_8xH100", 4))
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "not a multiple of 8")
+
+	// A zero count is reported as such, not as a missing config.
+	_, err = resolveNodeCount(airRunWithCompute("GPU_1xA10", 0))
+	require.Error(t, err)
+}
+
+// downloadServer serves the MLflow artifact chain: the artifact listing, a
+// pre-signed URL pointing back at itself, and the chunk bytes.
+func downloadServer(t *testing.T) *httptest.Server {
+	t.Helper()
+	var base string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/api/2.0/mlflow/artifacts/list":
+			if r.URL.Query().Get("path") == "logs" {
+				_, _ = w.Write([]byte(`{"files": [{"path": "logs/node_0", "is_dir": true}, {"path": "logs/node_1", "is_dir": true}]}`))
+			} else {
+				_, _ = w.Write([]byte(`{"files": [{"path": "` + r.URL.Query().Get("path") + `/logs-0.chunk.txt", "file_size": 12}]}`))
+			}
+		case "/api/2.0/mlflow/artifacts/credentials-for-read":
+			_, _ = w.Write([]byte(`{"credential_infos": [{"signed_uri": "` + base + `/presigned"}]}`))
+		case "/presigned":
+			_, _ = w.Write([]byte("line one\nline two\n"))
+		default:
+			_, _ = w.Write([]byte(`{}`))
+		}
+	}))
+	base = srv.URL
+	t.Cleanup(srv.Close)
+	return srv
+}
+
+func TestDownloadNodeLogWritesConcatenatedChunks(t *testing.T) {
+	w := newTestWorkspaceClient(t, downloadServer(t).URL)
+	dir := t.TempDir()
+
+	path, err := downloadNodeLog(t.Context(), w, "run1", 0, 0, false, dir)
+	require.NoError(t, err)
+	require.NotEmpty(t, path)
+
+	got, err := os.ReadFile(path)
+	require.NoError(t, err)
+	assert.Equal(t, "line one\nline two\n", string(got))
+	assert.Equal(t, filepath.Join(dir, "logs", "node_0.log"), path)
+}
+
+func TestDownloadAllNodeLogs(t *testing.T) {
+	w := newTestWorkspaceClient(t, downloadServer(t).URL)
+	dir := t.TempDir()
+
+	nodeLogs, failures, err := downloadAllNodeLogs(t.Context(), w, "run1", dir, []int{0, 1}, -1)
+	require.NoError(t, err)
+	require.Empty(t, failures)
+	require.Len(t, nodeLogs, 2)
+	assert.FileExists(t, nodeLogs[0])
+	assert.FileExists(t, nodeLogs[1])
+}
+
+// fullDownloadServer also serves the run and its output, so downloadLogs can run
+// end to end against a 2-node run.
+func fullDownloadServer(t *testing.T) *httptest.Server {
+	t.Helper()
+	var base string
+	runGet := `{
+		"run_id": 123,
+		"state": {"life_cycle_state": "TERMINATED", "result_state": "SUCCESS"},
+		"tasks": [{"run_id": 456, "ai_runtime_task": {"deployments": [{"compute": {"accelerator_type": "GPU_1xA10", "accelerator_count": 2}}]}}]
+	}`
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/api/2.2/jobs/runs/get":
+			_, _ = w.Write([]byte(runGet))
+		case "/api/2.2/jobs/runs/get-output":
+			_, _ = w.Write([]byte(`{"ai_runtime_task_output": {"mlflow_experiment_id": "exp1", "mlflow_run_id": "run1"}}`))
+		case "/api/2.0/mlflow/artifacts/list":
+			if r.URL.Query().Get("path") == "logs" {
+				_, _ = w.Write([]byte(`{"files": [{"path": "logs/node_0", "is_dir": true}, {"path": "logs/node_1", "is_dir": true}]}`))
+				return
+			}
+			_, _ = w.Write([]byte(`{"files": [{"path": "` + r.URL.Query().Get("path") + `/logs-0.chunk.txt", "file_size": 6}]}`))
+		case "/api/2.0/mlflow/artifacts/credentials-for-read":
+			_, _ = w.Write([]byte(`{"credential_infos": [{"signed_uri": "` + base + `/presigned"}]}`))
+		case "/presigned":
+			_, _ = w.Write([]byte("hello\n"))
+		default:
+			_, _ = w.Write([]byte(`{"userName": "u@example.com", "workspace_id": 1}`))
+		}
+	}))
+	base = srv.URL
+	t.Cleanup(srv.Close)
+	return srv
+}
+
+func TestDownloadLogsAllNodes(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	w := newTestWorkspaceClient(t, fullDownloadServer(t).URL)
+	dir := t.TempDir()
+
+	success, err := downloadLogs(ctx, w, &bytes.Buffer{}, logRequest{runID: 123, attempt: -1, downloadTo: dir}, logRunStatus{resultState: "SUCCESS"})
+	require.NoError(t, err)
+	assert.True(t, success)
+	assert.FileExists(t, filepath.Join(dir, "logs", "node_0.log"))
+	assert.FileExists(t, filepath.Join(dir, "logs", "node_1.log"))
+}
+
+func TestDownloadLogsSingleNode(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	w := newTestWorkspaceClient(t, fullDownloadServer(t).URL)
+	dir := t.TempDir()
+
+	success, err := downloadLogs(ctx, w, &bytes.Buffer{}, logRequest{runID: 123, node: 1, nodeSet: true, attempt: -1, downloadTo: dir}, logRunStatus{resultState: "SUCCESS"})
+	require.NoError(t, err)
+	assert.True(t, success)
+	assert.FileExists(t, filepath.Join(dir, "logs", "node_1.log"))
+	assert.NoFileExists(t, filepath.Join(dir, "logs", "node_0.log"))
+}
+
+func TestDownloadLogsOutOfRangeNode(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	w := newTestWorkspaceClient(t, fullDownloadServer(t).URL)
+	dir := t.TempDir()
+
+	_, err := downloadLogs(ctx, w, &bytes.Buffer{}, logRequest{runID: 123, node: 5, nodeSet: true, attempt: -1, downloadTo: dir}, logRunStatus{resultState: "SUCCESS"})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "invalid --node 5")
+}
+
+func TestDownloadLogsExplicitNodeZero(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	w := newTestWorkspaceClient(t, fullDownloadServer(t).URL)
+	dir := t.TempDir()
+
+	// An explicit --node 0 must download only node 0, unlike the default which
+	// downloads every node.
+	_, err := downloadLogs(ctx, w, &bytes.Buffer{}, logRequest{runID: 123, node: 0, nodeSet: true, attempt: -1, downloadTo: dir}, logRunStatus{resultState: "SUCCESS"})
+	require.NoError(t, err)
+	assert.FileExists(t, filepath.Join(dir, "logs", "node_0.log"))
+	assert.NoFileExists(t, filepath.Join(dir, "logs", "node_1.log"))
+}
+
+func TestDownloadLogsOutOfRangeNodeIsInvalidArgs(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	w := newTestWorkspaceClient(t, fullDownloadServer(t).URL)
+
+	// The sentinel lets the caller classify this as bad input rather than a
+	// transient, retryable failure.
+	_, err := downloadLogs(ctx, w, &bytes.Buffer{}, logRequest{runID: 123, node: 5, nodeSet: true, attempt: -1, downloadTo: t.TempDir()}, logRunStatus{resultState: "SUCCESS"})
+	require.ErrorIs(t, err, errNodeOutOfRange)
+}
+
+// noLogsDownloadServer serves a run with no resolvable MLflow run, so there is
+// nothing to download.
+func noLogsDownloadServer(t *testing.T) *httptest.Server {
+	t.Helper()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/api/2.2/jobs/runs/get":
+			_, _ = w.Write([]byte(`{
+				"run_id": 123,
+				"state": {"life_cycle_state": "TERMINATED", "result_state": "SUCCESS"},
+				"tasks": [{"run_id": 456, "ai_runtime_task": {"deployments": [{"compute": {"accelerator_type": "GPU_1xA10", "accelerator_count": 2}}]}}]
+			}`))
+		default:
+			_, _ = w.Write([]byte(`{}`))
+		}
+	}))
+	t.Cleanup(srv.Close)
+	return srv
+}
+
+func TestDownloadLogsNoLogsMatchesStreamingPath(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	w := newTestWorkspaceClient(t, noLogsDownloadServer(t).URL)
+
+	// A SUCCESS run with no logs reports it and still succeeds, exactly as the
+	// streaming path does — no error, no non-zero exit.
+	var buf bytes.Buffer
+	success, err := downloadLogs(ctx, w, &buf, logRequest{runID: 123, attempt: -1, downloadTo: t.TempDir()}, logRunStatus{lifeCycleState: "TERMINATED", resultState: "SUCCESS"})
+	require.NoError(t, err)
+	assert.True(t, success)
+	assert.Contains(t, buf.String(), "No logs available for run 123")
+}
+
+// partialFailureServer fails node 1's chunk listing so one node succeeds and the
+// other doesn't.
+func partialFailureServer(t *testing.T) *httptest.Server {
+	t.Helper()
+	var base string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/api/2.0/mlflow/artifacts/list":
+			p := r.URL.Query().Get("path")
+			switch p {
+			case "logs":
+				_, _ = w.Write([]byte(`{"files": [{"path": "logs/node_0", "is_dir": true}, {"path": "logs/node_1", "is_dir": true}]}`))
+			case "logs/node_1":
+				w.WriteHeader(http.StatusInternalServerError)
+				_, _ = w.Write([]byte(`{"error_code": "INTERNAL", "message": "boom"}`))
+			default:
+				_, _ = w.Write([]byte(`{"files": [{"path": "` + p + `/logs-0.chunk.txt"}]}`))
+			}
+		case "/api/2.0/mlflow/artifacts/credentials-for-read":
+			_, _ = w.Write([]byte(`{"credential_infos": [{"signed_uri": "` + base + `/presigned"}]}`))
+		case "/presigned":
+			_, _ = w.Write([]byte("ok\n"))
+		default:
+			_, _ = w.Write([]byte(`{}`))
+		}
+	}))
+	base = srv.URL
+	t.Cleanup(srv.Close)
+	return srv
+}
+
+func TestDownloadAllNodeLogsReportsPartialFailure(t *testing.T) {
+	w := newTestWorkspaceClient(t, partialFailureServer(t).URL)
+	dir := t.TempDir()
+
+	// Node 1 fails, but node 0 still downloads and the failure is reported rather
+	// than silently dropped.
+	nodeLogs, failures, err := downloadAllNodeLogs(t.Context(), w, "run1", dir, []int{0, 1}, -1)
+	require.NoError(t, err)
+	require.Len(t, nodeLogs, 1)
+	assert.FileExists(t, nodeLogs[0])
+	require.Contains(t, failures, 1)
+	assert.NotEmpty(t, failures[1])
+}
+
+func TestDownloadAllNodeLogsPropagatesCancellation(t *testing.T) {
+	w := newTestWorkspaceClient(t, downloadServer(t).URL)
+	ctx, cancel := context.WithCancel(t.Context())
+	cancel()
+
+	// A cancelled command must surface the cancellation, not look like a run with
+	// no logs.
+	_, _, err := downloadAllNodeLogs(ctx, w, "run1", t.TempDir(), []int{0, 1}, -1)
+	require.Error(t, err)
+	assert.ErrorIs(t, err, context.Canceled)
+}
+
+// attemptPrefixServer serves the attempt-prefixed layout (logs/attempt_N/node_M).
+func attemptPrefixServer(t *testing.T) *httptest.Server {
+	t.Helper()
+	var base string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/api/2.0/mlflow/artifacts/list":
+			p := r.URL.Query().Get("path")
+			if p == "logs" {
+				_, _ = w.Write([]byte(`{"files": [{"path": "logs/attempt_0", "is_dir": true}]}`))
+				return
+			}
+			_, _ = w.Write([]byte(`{"files": [{"path": "` + p + `/logs-0.chunk.txt"}]}`))
+		case "/api/2.0/mlflow/artifacts/credentials-for-read":
+			// Echo the path so the test can prove the attempt-prefixed dir was used.
+			_, _ = w.Write([]byte(`{"credential_infos": [{"signed_uri": "` + base + `/presigned?p=` + r.URL.Query().Get("path") + `"}]}`))
+		case "/presigned":
+			_, _ = w.Write([]byte(r.URL.Query().Get("p") + "\n"))
+		default:
+			_, _ = w.Write([]byte(`{}`))
+		}
+	}))
+	base = srv.URL
+	t.Cleanup(srv.Close)
+	return srv
+}
+
+func TestDownloadAllNodeLogsAttemptPrefixedLayout(t *testing.T) {
+	w := newTestWorkspaceClient(t, attemptPrefixServer(t).URL)
+	dir := t.TempDir()
+
+	nodeLogs, _, err := downloadAllNodeLogs(t.Context(), w, "run1", dir, []int{0}, -1)
+	require.NoError(t, err)
+	require.Len(t, nodeLogs, 1)
+
+	body, err := os.ReadFile(nodeLogs[0])
+	require.NoError(t, err)
+	assert.Contains(t, string(body), "logs/attempt_0/node_0")
+}
+
+// truncatingServer lists two chunks for node 0 but fails the second one's
+// credential request, so the node downloads partially.
+func truncatingServer(t *testing.T) *httptest.Server {
+	t.Helper()
+	var base string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/api/2.0/mlflow/artifacts/list":
+			p := r.URL.Query().Get("path")
+			if p == "logs" {
+				_, _ = w.Write([]byte(`{"files": [{"path": "logs/node_0", "is_dir": true}]}`))
+				return
+			}
+			_, _ = w.Write([]byte(`{"files": [
+				{"path": "` + p + `/logs-0.chunk.txt"},
+				{"path": "` + p + `/logs-1.chunk.txt"}
+			]}`))
+		case "/api/2.0/mlflow/artifacts/credentials-for-read":
+			if strings.HasSuffix(r.URL.Query().Get("path"), "logs-1.chunk.txt") {
+				w.WriteHeader(http.StatusInternalServerError)
+				_, _ = w.Write([]byte(`{"error_code": "INTERNAL", "message": "boom"}`))
+				return
+			}
+			_, _ = w.Write([]byte(`{"credential_infos": [{"signed_uri": "` + base + `/presigned"}]}`))
+		case "/presigned":
+			_, _ = w.Write([]byte("first chunk\n"))
+		default:
+			_, _ = w.Write([]byte(`{}`))
+		}
+	}))
+	base = srv.URL
+	t.Cleanup(srv.Close)
+	return srv
+}
+
+func TestDownloadNodeLogReportsFailedChunk(t *testing.T) {
+	w := newTestWorkspaceClient(t, truncatingServer(t).URL)
+	dir := t.TempDir()
+
+	// Chunk 0 succeeded and chunk 1 failed: keep the bytes, but return an error
+	// so the gap isn't silent.
+	path, err := downloadNodeLog(t.Context(), w, "run1", 0, 0, false, dir)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "chunk(s) [1]")
+	require.NotEmpty(t, path)
+
+	got, err := os.ReadFile(path)
+	require.NoError(t, err)
+	assert.Equal(t, "first chunk\n", string(got))
+}
+
+// middleGapServer serves three chunks for node 0 and fails only the middle one,
+// so the walk has to continue past a gap to reach the last chunk.
+func middleGapServer(t *testing.T) *httptest.Server {
+	t.Helper()
+	var base string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/api/2.0/mlflow/artifacts/list":
+			p := r.URL.Query().Get("path")
+			if p == "logs" {
+				_, _ = w.Write([]byte(`{"files": [{"path": "logs/node_0", "is_dir": true}]}`))
+				return
+			}
+			_, _ = w.Write([]byte(`{"files": [
+				{"path": "` + p + `/logs-0.chunk.txt"},
+				{"path": "` + p + `/logs-1.chunk.txt"},
+				{"path": "` + p + `/logs-2.chunk.txt"}
+			]}`))
+		case "/api/2.0/mlflow/artifacts/credentials-for-read":
+			p := r.URL.Query().Get("path")
+			if strings.HasSuffix(p, "logs-1.chunk.txt") {
+				w.WriteHeader(http.StatusInternalServerError)
+				_, _ = w.Write([]byte(`{"error_code": "INTERNAL", "message": "boom"}`))
+				return
+			}
+			_, _ = w.Write([]byte(`{"credential_infos": [{"signed_uri": "` + base + `/presigned?p=` + p + `"}]}`))
+		case "/presigned":
+			_, _ = w.Write([]byte(path.Base(r.URL.Query().Get("p")) + "\n"))
+		default:
+			_, _ = w.Write([]byte(`{}`))
+		}
+	}))
+	base = srv.URL
+	t.Cleanup(srv.Close)
+	return srv
+}
+
+func TestDownloadNodeLogSkipsGapAndKeepsTail(t *testing.T) {
+	w := newTestWorkspaceClient(t, middleGapServer(t).URL)
+	dir := t.TempDir()
+
+	// The tail usually carries the failure signature, so a bad middle chunk must
+	// not cost us the last one.
+	p, err := downloadNodeLog(t.Context(), w, "run1", 0, 0, false, dir)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "chunk(s) [1]")
+
+	got, err := os.ReadFile(p)
+	require.NoError(t, err)
+	assert.Equal(t, "logs-0.chunk.txt\nlogs-2.chunk.txt\n", string(got))
+}
+
+func TestDownloadNodeLogErrorsWhenEveryChunkFails(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/api/2.0/mlflow/artifacts/list":
+			p := r.URL.Query().Get("path")
+			if p == "logs" {
+				_, _ = w.Write([]byte(`{"files": [{"path": "logs/node_0", "is_dir": true}]}`))
+				return
+			}
+			_, _ = w.Write([]byte(`{"files": [{"path": "` + p + `/logs-0.chunk.txt"}]}`))
+		case "/api/2.0/mlflow/artifacts/credentials-for-read":
+			w.WriteHeader(http.StatusInternalServerError)
+			_, _ = w.Write([]byte(`{"error_code": "INTERNAL", "message": "boom"}`))
+		default:
+			_, _ = w.Write([]byte(`{}`))
+		}
+	}))
+	t.Cleanup(srv.Close)
+
+	// Nothing downloaded because of failures, not because the node was silent:
+	// report it rather than returning an empty "no logs" result.
+	p, err := downloadNodeLog(t.Context(), newTestWorkspaceClient(t, srv.URL), "run1", 0, 0, false, t.TempDir())
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "every chunk failed")
+	assert.Empty(t, p)
+}
+
+func TestDownloadAllNodeLogsKeepsTruncatedNode(t *testing.T) {
+	w := newTestWorkspaceClient(t, truncatingServer(t).URL)
+
+	// A truncated node lands in both maps, so it is still listed as downloaded
+	// while being reported as incomplete.
+	nodeLogs, failures, err := downloadAllNodeLogs(t.Context(), w, "run1", t.TempDir(), []int{0}, -1)
+	require.NoError(t, err)
+	require.Contains(t, nodeLogs, 0)
+	assert.FileExists(t, nodeLogs[0])
+	require.Contains(t, failures, 0)
+	assert.Contains(t, failures[0], "chunk(s) [1]")
+}
+
+func TestDownloadOutcomeTreatsActiveRunAsSuccess(t *testing.T) {
+	// An active run has no result state yet. Fetching its logs succeeded, so the
+	// command must exit 0 rather than report the run as failed.
+	for _, lc := range []string{"RUNNING", "PENDING", "QUEUED", "BLOCKED"} {
+		assert.True(t, logRunStatus{lifeCycleState: lc}.downloadOutcome(), lc)
+	}
+
+	// A terminal run still decides the exit code by its outcome.
+	assert.True(t, logRunStatus{lifeCycleState: "TERMINATED", resultState: "SUCCESS"}.downloadOutcome())
+	assert.False(t, logRunStatus{lifeCycleState: "TERMINATED", resultState: "FAILED"}.downloadOutcome())
+	assert.False(t, logRunStatus{lifeCycleState: "TERMINATED", resultState: "CANCELED"}.downloadOutcome())
+	assert.False(t, logRunStatus{lifeCycleState: "INTERNAL_ERROR"}.downloadOutcome())
+}
+
+func TestDownloadLogsActiveRunExitsZero(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	w := newTestWorkspaceClient(t, fullDownloadServer(t).URL)
+
+	// Downloading a still-running run's logs is not a failure.
+	success, err := downloadLogs(ctx, w, &bytes.Buffer{},
+		logRequest{runID: 123, attempt: -1, downloadTo: t.TempDir()},
+		logRunStatus{lifeCycleState: "RUNNING"})
+	require.NoError(t, err)
+	assert.True(t, success)
+}
+
+// allNodesFailServer serves a FAILED 2-node run whose chunk credentials all 404,
+// so every node's download fails.
+func allNodesFailServer(t *testing.T) *httptest.Server {
+	t.Helper()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/api/2.2/jobs/runs/get":
+			_, _ = w.Write([]byte(`{"run_id": 123, "state": {"life_cycle_state": "TERMINATED", "result_state": "FAILED"},
+				"tasks": [{"run_id": 456, "ai_runtime_task": {"deployments": [{"compute": {"accelerator_type": "GPU_1xA10", "accelerator_count": 2}}]}}]}`))
+		case "/api/2.2/jobs/runs/get-output":
+			_, _ = w.Write([]byte(`{"ai_runtime_task_output": {"mlflow_experiment_id": "exp1", "mlflow_run_id": "run1"}}`))
+		case "/api/2.0/mlflow/artifacts/list":
+			p := r.URL.Query().Get("path")
+			if p == "logs" {
+				_, _ = w.Write([]byte(`{"files": [{"path": "logs/node_0", "is_dir": true}, {"path": "logs/node_1", "is_dir": true}]}`))
+				return
+			}
+			_, _ = w.Write([]byte(`{"files": [{"path": "` + p + `/logs-0.chunk.txt"}]}`))
+		case "/api/2.0/mlflow/artifacts/credentials-for-read":
+			w.WriteHeader(http.StatusNotFound)
+			_, _ = w.Write([]byte(`{"error_code": "NOT_FOUND", "message": "gone"}`))
+		default:
+			_, _ = w.Write([]byte(`{"userName": "u@example.com"}`))
+		}
+	}))
+	t.Cleanup(srv.Close)
+	return srv
+}
+
+func TestDownloadLogsAllNodesFailedIsNotReportedAsNoLogs(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	w := newTestWorkspaceClient(t, allNodesFailServer(t).URL)
+	var stdout bytes.Buffer
+
+	// The logs exist but couldn't be fetched. Reporting "No logs available" would
+	// tell a caller the run produced nothing, so this fails instead.
+	_, err := downloadLogs(ctx, w, &stdout,
+		logRequest{runID: 123, attempt: -1, downloadTo: t.TempDir(), jsonOutput: true},
+		logRunStatus{lifeCycleState: "TERMINATED", resultState: "FAILED"})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "failed to download logs from any of 2 node(s)")
+	assert.NotContains(t, stdout.String(), "No logs available")
+}
diff --git a/cmd/air/logmlflow.go b/cmd/air/logmlflow.go
new file mode 100644
index 00000000000..90c5c0bd5c8
--- /dev/null
+++ b/cmd/air/logmlflow.go
@@ -0,0 +1,515 @@
+package aircmd
+
+import (
+	"bufio"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"os"
+	"path"
+	"regexp"
+	"slices"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/databricks/cli/libs/auth"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/filer"
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/client"
+	"github.com/databricks/databricks-sdk-go/listing"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/databricks/databricks-sdk-go/service/ml"
+)
+
+var mlflowArtifactRoots sync.Map
+
+func mlflowArtifactRoot(ctx context.Context, w *databricks.WorkspaceClient, mlflowRunID string) (string, error) {
+	key := strings.TrimRight(w.Config.Host, "/") + "\x00" + mlflowRunID
+	if cached, ok := mlflowArtifactRoots.Load(key); ok {
+		return cached.(string), nil
+	}
+	response, err := w.Experiments.GetRun(ctx, ml.GetRunRequest{RunId: mlflowRunID})
+	if err != nil {
+		log.Debugf(ctx, "air logs: could not resolve MLflow artifact URI for %s: %v", mlflowRunID, err)
+		return "", nil
+	}
+	if response.Run == nil || response.Run.Info == nil {
+		return "", nil
+	}
+	root := strings.TrimRight(response.Run.Info.ArtifactUri, "/")
+	mlflowArtifactRoots.Store(key, root)
+	return root, nil
+}
+
+func volumeArtifactRoot(root string) (string, bool) {
+	if strings.HasPrefix(root, "dbfs:/Volumes/") {
+		return strings.TrimPrefix(root, "dbfs:"), true
+	}
+	return "", false
+}
+
+// chunkFilePattern matches a log chunk file (logs-<index>.chunk.txt); group 1 is
+// the chunk index. The sidecar splits stdout into 4MB chunks, index ascending.
+var chunkFilePattern = regexp.MustCompile(`^logs-(\d+)\.chunk\.txt$`)
+
+// oldFormatNodeDir matches a bare per-node log dir (logs/node_<n>). The
+// attempt-prefixed layout nests these under logs/attempt_<n>/, so a bare
+// logs/node_<n> only appears in the old layout.
+var oldFormatNodeDir = regexp.MustCompile(`^logs/node_\d+$`)
+
+// artifactDownloadClient fetches pre-signed artifact URLs with connect and
+// response-header timeouts, so a stalled storage backend can't hang the command.
+// Mirrors the Python CLI's (10s connect, 60s read) bounds.
+var artifactDownloadClient = &http.Client{
+	Transport: &http.Transport{
+		DialContext:           (&net.Dialer{Timeout: 10 * time.Second}).DialContext,
+		ResponseHeaderTimeout: 60 * time.Second,
+	},
+}
+
+// mlflowLogFallback prints a run's logs from MLflow artifacts, the fallback when
+// Bricklens can't serve them. It resolves the MLflow run id, discovers the
+// per-node log directory, lists the chunk files, and walks them newest-first
+// until it has the requested tail, then prints oldest-first.
+//
+// The tail length is --tail, else the default cap. MLflow chunks are not
+// time-indexed, so --minutes cannot restrict the window here.
+func mlflowLogFallback(ctx context.Context, w *databricks.WorkspaceClient, out io.Writer, req logRequest, status logRunStatus) (bool, error) {
+	if req.windowMinutes > 0 {
+		cmdio.LogString(ctx, "Warning: --minutes is ignored when logs are served from MLflow artifacts.")
+	}
+
+	if !status.terminal() && !req.staticView {
+		return streamMLflowLogs(ctx, w, out, req, status)
+	}
+	return fetchMLflowLogTail(ctx, w, out, req, status)
+}
+
+func fetchMLflowLogTail(ctx context.Context, w *databricks.WorkspaceClient, out io.Writer, req logRequest, status logRunStatus) (bool, error) {
+	mlflowRunID, logDir, err := resolveMLflowLogPath(ctx, w, req)
+	if err != nil {
+		return false, err
+	}
+	if mlflowRunID == "" || logDir == "" {
+		emitNoLogs(out, req, status)
+		return status.downloadOutcome(), nil
+	}
+
+	chunks, err := listLogChunks(ctx, w, mlflowRunID, logDir)
+	if err != nil {
+		return false, err
+	}
+	if len(chunks) == 0 {
+		// Nothing listed yet: assume the single chunk 0.
+		chunks = []logChunk{{index: 0, path: path.Join(logDir, chunkFileName(0))}}
+	}
+
+	target := req.tailTarget()
+	if target <= 0 {
+		return status.downloadOutcome(), nil
+	}
+
+	lines, err := tailChunks(ctx, w, mlflowRunID, chunks, target)
+	if err != nil {
+		return false, err
+	}
+	if len(lines) == 0 {
+		emitNoLogs(out, req, status)
+		return status.downloadOutcome(), nil
+	}
+
+	if len(lines) > target {
+		lines = lines[len(lines)-target:]
+	}
+	for _, line := range lines {
+		emitLogLine(out, req, line)
+	}
+	return status.downloadOutcome(), nil
+}
+
+func mlflowLogsExist(ctx context.Context, w *databricks.WorkspaceClient, req logRequest) bool {
+	mlflowRunID, logDir, err := resolveMLflowLogPath(ctx, w, req)
+	if err != nil || mlflowRunID == "" || logDir == "" {
+		if err != nil {
+			log.Debugf(ctx, "air logs: MLflow log-existence probe failed for run %d: %v", req.runID, err)
+		}
+		return false
+	}
+	chunks, err := listLogChunks(ctx, w, mlflowRunID, logDir)
+	if err != nil {
+		log.Debugf(ctx, "air logs: MLflow log-existence probe failed for run %d: %v", req.runID, err)
+		return false
+	}
+	return len(chunks) > 0
+}
+
+func streamMLflowLogs(ctx context.Context, w *databricks.WorkspaceClient, out io.Writer, req logRequest, status logRunStatus) (bool, error) {
+	lineOffsets := make(map[string]int)
+	currentRunID := ""
+	printed := false
+	previousState := ""
+
+	for {
+		if req.onStatusChange != nil {
+			current := status.displayState()
+			if current != previousState {
+				req.onStatusChange(current, previousState)
+				previousState = current
+			}
+		}
+		req.reportRetry(ctx, out, status, nil)
+
+		mlflowRunID, logDir, err := resolveMLflowLogPath(ctx, w, req)
+		if err != nil {
+			if status.terminal() {
+				return false, err
+			}
+			log.Debugf(ctx, "air logs: failed to resolve MLflow log path: %v", err)
+		} else if mlflowRunID != "" && logDir != "" {
+			if currentRunID != mlflowRunID {
+				currentRunID = mlflowRunID
+				lineOffsets = make(map[string]int)
+			}
+			chunks, listErr := listLogChunks(ctx, w, mlflowRunID, logDir)
+			if listErr != nil {
+				if status.terminal() {
+					return false, listErr
+				}
+				log.Debugf(ctx, "air logs: failed to list MLflow log chunks: %v", listErr)
+			} else {
+				for _, chunk := range chunks {
+					content, downloadErr := downloadChunk(ctx, w, mlflowRunID, chunk.path)
+					if downloadErr != nil {
+						if status.terminal() {
+							return false, downloadErr
+						}
+						log.Debugf(ctx, "air logs: failed to read MLflow log chunk %s: %v", chunk.path, downloadErr)
+						break
+					}
+					lines := content.lines
+					if !status.terminal() && content.hasTrailingPartial {
+						lines = lines[:len(lines)-1]
+					}
+					offset := lineOffsets[chunk.path]
+					if offset > len(lines) {
+						offset = 0
+					}
+					for _, line := range lines[offset:] {
+						emitLogLine(out, req, line)
+						printed = true
+					}
+					lineOffsets[chunk.path] = len(lines)
+				}
+			}
+		}
+
+		if status.terminal() {
+			if !printed {
+				emitNoLogs(out, req, status)
+			}
+			return status.succeeded(), nil
+		}
+		if err := sleepOrCancel(ctx, retryCheckInterval); err != nil {
+			return false, err
+		}
+		refreshed, err := resolveRunStatus(ctx, w, req.runID)
+		if err != nil {
+			if errors.Is(err, apierr.ErrResourceDoesNotExist) || ctx.Err() != nil {
+				return false, err
+			}
+			log.Debugf(ctx, "air logs: failed to refresh run status on MLflow fallback: %v", err)
+			continue
+		}
+		status = refreshed
+	}
+}
+
+// resolveMLflowLogPath returns the run's MLflow run id and per-node log directory.
+func resolveMLflowLogPath(ctx context.Context, w *databricks.WorkspaceClient, req logRequest) (string, string, error) {
+	run, err := w.Jobs.GetRun(ctx, jobs.GetRunRequest{RunId: req.runID})
+	if err != nil {
+		return "", "", err
+	}
+	attempt, taskRunID, err := resolveLogAttempt(run, req.attempt)
+	if err != nil {
+		return "", "", err
+	}
+	ids := mlflowIDsForTask(ctx, w, taskRunID)
+	if ids == nil || ids.RunID == "" {
+		return "", "", nil
+	}
+
+	withAttempt, err := discoverAttemptPrefix(ctx, w, ids.RunID, attempt)
+	if err != nil {
+		return "", "", err
+	}
+	return ids.RunID, constructLogPath(req.node, attempt, withAttempt), nil
+}
+
+// discoverAttemptPrefix probes the logs/ dir once to decide whether the layout is
+// attempt-prefixed (logs/attempt_X/node_Y) or old (logs/node_Y). A bare
+// logs/node_<n> means old; a logs/attempt_<attempt> entry means prefixed.
+// Defaults to old when nothing is listed.
+func discoverAttemptPrefix(ctx context.Context, w *databricks.WorkspaceClient, mlflowRunID string, attempt int) (bool, error) {
+	files, err := listArtifacts(ctx, w, mlflowRunID, "logs")
+	if err != nil {
+		// Not fatal: default to the old layout; the chunk listing finds it empty if wrong.
+		log.Debugf(ctx, "air logs: could not list logs dir for format discovery: %v", err)
+		return false, nil
+	}
+
+	attemptDir := fmt.Sprintf("logs/attempt_%d", attempt)
+	for _, f := range files {
+		if oldFormatNodeDir.MatchString(f.Path) {
+			return false, nil
+		}
+		if f.Path == attemptDir {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+// constructLogPath builds the per-node log directory for a node and attempt.
+func constructLogPath(node, attempt int, withAttempt bool) string {
+	if withAttempt {
+		return fmt.Sprintf("logs/attempt_%d/node_%d", attempt, node)
+	}
+	return fmt.Sprintf("logs/node_%d", node)
+}
+
+// chunkFileName is the artifact filename for a chunk index.
+func chunkFileName(index int) string {
+	return fmt.Sprintf("logs-%d.chunk.txt", index)
+}
+
+// logChunk is one listed chunk: its index and full artifact path.
+type logChunk struct {
+	index int
+	path  string
+}
+
+// listLogChunks lists the chunk files under a log dir, sorted ascending by index.
+func listLogChunks(ctx context.Context, w *databricks.WorkspaceClient, mlflowRunID, logDir string) ([]logChunk, error) {
+	files, err := listArtifacts(ctx, w, mlflowRunID, logDir)
+	if err != nil {
+		return nil, err
+	}
+
+	var chunks []logChunk
+	for _, f := range files {
+		base := path.Base(f.Path)
+		m := chunkFilePattern.FindStringSubmatch(base)
+		if m == nil {
+			continue
+		}
+		idx, err := strconv.Atoi(m[1])
+		if err != nil {
+			continue
+		}
+		chunks = append(chunks, logChunk{index: idx, path: f.Path})
+	}
+	slices.SortFunc(chunks, func(a, b logChunk) int { return a.index - b.index })
+	return chunks, nil
+}
+
+// tailChunks walks chunks newest-first, prepending each chunk's lines, until it
+// has `target` lines or runs out. A mid-walk download failure stops the walk
+// rather than splice non-adjacent chunks.
+func tailChunks(ctx context.Context, w *databricks.WorkspaceClient, mlflowRunID string, chunks []logChunk, target int) ([]string, error) {
+	var accumulated []string
+	for _, chunk := range slices.Backward(chunks) {
+		lines, err := downloadChunkLines(ctx, w, mlflowRunID, chunk.path)
+		if err != nil {
+			log.Debugf(ctx, "air logs: failed to download chunk %d; showing only logs after it: %v", chunk.index, err)
+			break
+		}
+		accumulated = append(lines, accumulated...)
+		if len(accumulated) >= target {
+			break
+		}
+	}
+	return accumulated, nil
+}
+
+type downloadedChunk struct {
+	lines              []string
+	hasTrailingPartial bool
+}
+
+// downloadChunkLines fetches one chunk artifact and returns its lines.
+func downloadChunkLines(ctx context.Context, w *databricks.WorkspaceClient, mlflowRunID, artifactPath string) ([]string, error) {
+	content, err := downloadChunk(ctx, w, mlflowRunID, artifactPath)
+	return content.lines, err
+}
+
+func downloadChunk(ctx context.Context, w *databricks.WorkspaceClient, mlflowRunID, artifactPath string) (downloadedChunk, error) {
+	f, err := downloadArtifact(ctx, w, mlflowRunID, artifactPath)
+	if err != nil {
+		return downloadedChunk{}, err
+	}
+	defer os.Remove(f)
+
+	data, err := os.ReadFile(f)
+	if err != nil {
+		return downloadedChunk{}, err
+	}
+
+	var lines []string
+	scanner := bufio.NewScanner(strings.NewReader(string(data)))
+	scanner.Buffer(make([]byte, 0, 64*1024), 4*1024*1024)
+	for scanner.Scan() {
+		lines = append(lines, scanner.Text())
+	}
+	if err := scanner.Err(); err != nil {
+		return downloadedChunk{}, err
+	}
+	return downloadedChunk{
+		lines:              lines,
+		hasTrailingPartial: len(data) > 0 && data[len(data)-1] != '\n',
+	}, nil
+}
+
+// listArtifacts lists a run's artifacts under a path.
+func listArtifacts(ctx context.Context, w *databricks.WorkspaceClient, mlflowRunID, artifactPath string) ([]ml.FileInfo, error) {
+	root, err := mlflowArtifactRoot(ctx, w, mlflowRunID)
+	if err != nil {
+		return nil, err
+	}
+	if volumeRoot, ok := volumeArtifactRoot(root); ok {
+		fc, err := filer.NewFilesClient(ctx, w, volumeRoot)
+		if err != nil {
+			return nil, err
+		}
+		entries, err := fc.ReadDir(ctx, artifactPath)
+		if err != nil {
+			return nil, err
+		}
+		files := make([]ml.FileInfo, 0, len(entries))
+		for _, entry := range entries {
+			info := ml.FileInfo{Path: path.Join(artifactPath, entry.Name()), IsDir: entry.IsDir()}
+			if !entry.IsDir() {
+				stat, err := entry.Info()
+				if err != nil {
+					return nil, err
+				}
+				info.FileSize = stat.Size()
+			}
+			files = append(files, info)
+		}
+		return files, nil
+	}
+	it := w.Experiments.ListArtifacts(ctx, ml.ListArtifactsRequest{RunId: mlflowRunID, Path: artifactPath})
+	return listing.ToSlice(ctx, it)
+}
+
+// credentialInfo is one credentials-for-read entry: a pre-signed URL plus any
+// backend-required request headers.
+type credentialInfo struct {
+	SignedURI string `json:"signed_uri"`
+	Headers   []struct {
+		Name  string `json:"name"`
+		Value string `json:"value"`
+	} `json:"headers"`
+}
+
+type credentialsForReadResponse struct {
+	CredentialInfos []credentialInfo `json:"credential_infos"`
+}
+
+// downloadArtifact downloads one run artifact to a temp file and returns its
+// path. credentials-for-read returns a pre-signed URL, which we stream to disk;
+// that endpoint is not modeled by the SDK, so it is called via a raw client.Do.
+func downloadArtifact(ctx context.Context, w *databricks.WorkspaceClient, mlflowRunID, artifactPath string) (string, error) {
+	root, err := mlflowArtifactRoot(ctx, w, mlflowRunID)
+	if err != nil {
+		return "", err
+	}
+	if volumeRoot, ok := volumeArtifactRoot(root); ok {
+		fc, err := filer.NewFilesClient(ctx, w, volumeRoot)
+		if err != nil {
+			return "", err
+		}
+		reader, err := fc.Read(ctx, artifactPath)
+		if err != nil {
+			return "", err
+		}
+		defer reader.Close()
+		tmp, err := os.CreateTemp("", "air-log-chunk-*")
+		if err != nil {
+			return "", err
+		}
+		if _, err := io.Copy(tmp, reader); err != nil {
+			tmp.Close()
+			os.Remove(tmp.Name())
+			return "", err
+		}
+		if err := tmp.Close(); err != nil {
+			os.Remove(tmp.Name())
+			return "", err
+		}
+		return tmp.Name(), nil
+	}
+	apiClient, err := client.New(w.Config)
+	if err != nil {
+		return "", fmt.Errorf("failed to create API client: %w", err)
+	}
+
+	var resp credentialsForReadResponse
+	// A map query is serialized per value with %v, so a []string becomes the
+	// literal "[path]". The backend signs that bogus path and still returns 200,
+	// surfacing only as a 404 on the download.
+	query := map[string]any{
+		"run_id": mlflowRunID,
+		"path":   artifactPath,
+	}
+	err = apiClient.Do(ctx, http.MethodGet, "/api/2.0/mlflow/artifacts/credentials-for-read", auth.WorkspaceIDHeaders(w.Config), nil, query, &resp)
+	if err != nil {
+		return "", fmt.Errorf("failed to get read credentials for %s: %w", artifactPath, err)
+	}
+	if len(resp.CredentialInfos) == 0 || resp.CredentialInfos[0].SignedURI == "" {
+		return "", fmt.Errorf("no download credentials returned for %s", artifactPath)
+	}
+	cred := resp.CredentialInfos[0]
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, cred.SignedURI, nil)
+	if err != nil {
+		return "", err
+	}
+	// Azure SAS / some GCS URIs require backend-supplied headers; AWS returns none.
+	for _, h := range cred.Headers {
+		req.Header.Set(h.Name, h.Value)
+	}
+
+	httpResp, err := artifactDownloadClient.Do(req)
+	if err != nil {
+		return "", err
+	}
+	defer httpResp.Body.Close()
+	if httpResp.StatusCode >= 400 {
+		return "", fmt.Errorf("artifact download failed: HTTP %d", httpResp.StatusCode)
+	}
+
+	tmp, err := os.CreateTemp("", "air-log-chunk-*")
+	if err != nil {
+		return "", err
+	}
+	if _, err := io.Copy(tmp, httpResp.Body); err != nil {
+		tmp.Close()
+		os.Remove(tmp.Name())
+		return "", err
+	}
+	if err := tmp.Close(); err != nil {
+		os.Remove(tmp.Name())
+		return "", err
+	}
+	return tmp.Name(), nil
+}
diff --git a/cmd/air/logmlflow_test.go b/cmd/air/logmlflow_test.go
new file mode 100644
index 00000000000..0acb74dd592
--- /dev/null
+++ b/cmd/air/logmlflow_test.go
@@ -0,0 +1,351 @@
+package aircmd
+
+import (
+	"bytes"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/filer"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/cli/libs/testserver"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestResolveLogAttempt(t *testing.T) {
+	run := &jobs.Run{RunId: 5, Tasks: []jobs.RunTask{
+		{RunId: 100, AttemptNumber: 0},
+		{RunId: 101, AttemptNumber: 1},
+		{RunId: 102, AttemptNumber: 2},
+	}}
+
+	attempt, taskRunID, err := resolveLogAttempt(run, -1)
+	require.NoError(t, err)
+	assert.Equal(t, 2, attempt)
+	assert.Equal(t, int64(102), taskRunID)
+
+	attempt, taskRunID, err = resolveLogAttempt(run, 1)
+	require.NoError(t, err)
+	assert.Equal(t, 1, attempt)
+	assert.Equal(t, int64(101), taskRunID)
+
+	_, _, err = resolveLogAttempt(run, 3)
+	require.ErrorContains(t, err, "available retries are 0 to 2")
+	_, _, err = resolveLogAttempt(run, -2)
+	require.ErrorContains(t, err, "must be -1 or greater")
+}
+
+func TestConstructLogPath(t *testing.T) {
+	assert.Equal(t, "logs/node_0", constructLogPath(0, 0, false))
+	assert.Equal(t, "logs/node_3", constructLogPath(3, 2, false))
+	assert.Equal(t, "logs/attempt_2/node_3", constructLogPath(3, 2, true))
+}
+
+func TestChunkFileName(t *testing.T) {
+	assert.Equal(t, "logs-0.chunk.txt", chunkFileName(0))
+	assert.Equal(t, "logs-7.chunk.txt", chunkFileName(7))
+}
+
+func TestChunkFilePattern(t *testing.T) {
+	m := chunkFilePattern.FindStringSubmatch("logs-12.chunk.txt")
+	require.NotNil(t, m)
+	assert.Equal(t, "12", m[1])
+
+	assert.Nil(t, chunkFilePattern.FindStringSubmatch("logs-12.chunk.txt.bak"))
+	assert.Nil(t, chunkFilePattern.FindStringSubmatch("node_0"))
+}
+
+// artifactListServer serves a fixed artifacts/list response for any path.
+func artifactListServer(t *testing.T, body string) *httptest.Server {
+	t.Helper()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/api/2.0/mlflow/artifacts/list" {
+			_, _ = w.Write([]byte(body))
+			return
+		}
+		_, _ = w.Write([]byte(`{}`))
+	}))
+	t.Cleanup(srv.Close)
+	return srv
+}
+
+func TestListLogChunksSortsAndFiltersByIndex(t *testing.T) {
+	// Out-of-order chunks plus a non-chunk file; result is ascending, chunk-only.
+	srv := artifactListServer(t, `{"files": [
+		{"path": "logs/node_0/logs-2.chunk.txt"},
+		{"path": "logs/node_0/other.txt"},
+		{"path": "logs/node_0/logs-0.chunk.txt"},
+		{"path": "logs/node_0/logs-1.chunk.txt"}
+	]}`)
+	w := newTestWorkspaceClient(t, srv.URL)
+
+	chunks, err := listLogChunks(t.Context(), w, "run1", "logs/node_0")
+	require.NoError(t, err)
+	require.Len(t, chunks, 3)
+	assert.Equal(t, 0, chunks[0].index)
+	assert.Equal(t, 1, chunks[1].index)
+	assert.Equal(t, 2, chunks[2].index)
+	assert.Equal(t, "logs/node_0/logs-0.chunk.txt", chunks[0].path)
+}
+
+func TestDiscoverAttemptPrefix(t *testing.T) {
+	// Old format: a bare logs/node_N dir means no attempt prefix.
+	old := artifactListServer(t, `{"files": [{"path": "logs/node_0", "is_dir": true}]}`)
+	got, err := discoverAttemptPrefix(t.Context(), newTestWorkspaceClient(t, old.URL), "run1", 0)
+	require.NoError(t, err)
+	assert.False(t, got)
+
+	// New format: a logs/attempt_N entry and no bare node dir.
+	newFmt := artifactListServer(t, `{"files": [{"path": "logs/attempt_0", "is_dir": true}]}`)
+	got, err = discoverAttemptPrefix(t.Context(), newTestWorkspaceClient(t, newFmt.URL), "run1", 0)
+	require.NoError(t, err)
+	assert.True(t, got)
+}
+
+// noMLflowServer serves a run with no resolvable MLflow run id, so the fallback
+// finds no logs.
+func noMLflowServer(t *testing.T) *httptest.Server {
+	t.Helper()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/api/2.2/jobs/runs/get":
+			_, _ = w.Write([]byte(`{"run_id": 5, "state": {"life_cycle_state": "TERMINATED", "result_state": "SUCCESS"}, "tasks": [{"run_id": 456}]}`))
+		case "/api/2.2/jobs/runs/get-output":
+			_, _ = w.Write([]byte(`{}`))
+		default:
+			_, _ = w.Write([]byte(`{}`))
+		}
+	}))
+	t.Cleanup(srv.Close)
+	return srv
+}
+
+func TestMLflowFallbackNoLogsReflectsRunOutcome(t *testing.T) {
+	srv := noMLflowServer(t)
+	w := newTestWorkspaceClient(t, srv.URL)
+
+	// A SUCCESS run with no logs still reports success (exit 0), matching the
+	// Bricklens path, rather than failing just because no logs exist.
+	success, err := mlflowLogFallback(t.Context(), w, &bytes.Buffer{},
+		logRequest{runID: 5}, logRunStatus{lifeCycleState: "TERMINATED", resultState: "SUCCESS"})
+	require.NoError(t, err)
+	assert.True(t, success)
+
+	// A FAILED run with no logs reports failure (exit 1).
+	success, err = mlflowLogFallback(t.Context(), w, &bytes.Buffer{},
+		logRequest{runID: 5}, logRunStatus{lifeCycleState: "TERMINATED", resultState: "FAILED"})
+	require.NoError(t, err)
+	assert.False(t, success)
+}
+
+func TestMLflowFallbackWarnsWhenMinutesIgnored(t *testing.T) {
+	srv := noMLflowServer(t)
+	w := newTestWorkspaceClient(t, srv.URL)
+	var stdout, stderr bytes.Buffer
+	ctx := cmdio.InContext(t.Context(), cmdio.NewIO(t.Context(), flags.OutputText, nil, &stdout, &stderr, "", ""))
+
+	_, err := mlflowLogFallback(ctx, w, &stdout,
+		logRequest{runID: 5, windowMinutes: 10},
+		logRunStatus{lifeCycleState: "TERMINATED", resultState: "SUCCESS"})
+	require.NoError(t, err)
+	assert.Contains(t, stderr.String(), "Warning: --minutes is ignored when logs are served from MLflow artifacts.")
+}
+
+func TestStreamMLflowLogsFollowsGrowingPartialLineWithoutDuplicates(t *testing.T) {
+	oldInterval := retryCheckInterval
+	retryCheckInterval = time.Millisecond
+	t.Cleanup(func() { retryCheckInterval = oldInterval })
+
+	var getRunCalls atomic.Int32
+	var artifactReads atomic.Int32
+	var base string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/api/2.2/jobs/runs/get":
+			state := `{"life_cycle_state":"RUNNING"}`
+			if getRunCalls.Add(1) >= 4 {
+				state = `{"life_cycle_state":"TERMINATED","result_state":"SUCCESS"}`
+			}
+			_, _ = fmt.Fprintf(w, `{"run_id":5,"state":%s,"tasks":[{"run_id":101,"attempt_number":1}]}`, state)
+		case "/api/2.2/jobs/runs/get-output":
+			_, _ = w.Write([]byte(`{"ai_runtime_task_output":{"mlflow_experiment_id":"exp","mlflow_run_id":"mlrun"}}`))
+		case "/api/2.0/mlflow/runs/get":
+			_, _ = w.Write([]byte(`{}`))
+		case "/api/2.0/mlflow/artifacts/list":
+			if r.URL.Query().Get("path") == "logs" {
+				_, _ = w.Write([]byte(`{"files":[{"path":"logs/attempt_1","is_dir":true}]}`))
+			} else {
+				_, _ = w.Write([]byte(`{"files":[{"path":"logs/attempt_1/node_0/logs-0.chunk.txt"}]}`))
+			}
+		case "/api/2.0/mlflow/artifacts/credentials-for-read":
+			_, _ = fmt.Fprintf(w, `{"credential_infos":[{"signed_uri":%q}]}`, base+"/artifact")
+		case "/artifact":
+			if artifactReads.Add(1) == 1 {
+				_, _ = w.Write([]byte("one\npart"))
+			} else {
+				_, _ = w.Write([]byte("one\npartial\ntwo\n"))
+			}
+		default:
+			_, _ = w.Write([]byte(`{}`))
+		}
+	}))
+	base = srv.URL
+	t.Cleanup(srv.Close)
+
+	var out bytes.Buffer
+	success, err := streamMLflowLogs(t.Context(), newTestWorkspaceClient(t, srv.URL), &out,
+		logRequest{runID: 5, attempt: -1, tailLines: -1}, logRunStatus{lifeCycleState: "RUNNING", latestAttempt: 1})
+	require.NoError(t, err)
+	assert.True(t, success)
+	assert.Equal(t, "one\npartial\ntwo\n", out.String())
+}
+
+func TestStreamMLflowLogsRetriesEarlierChunkBeforePrintingLaterChunk(t *testing.T) {
+	oldInterval := retryCheckInterval
+	retryCheckInterval = time.Millisecond
+	t.Cleanup(func() { retryCheckInterval = oldInterval })
+
+	var getRunCalls atomic.Int32
+	var firstChunkReads atomic.Int32
+	var secondChunkReads atomic.Int32
+	var base string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/api/2.2/jobs/runs/get":
+			state := `{"life_cycle_state":"RUNNING"}`
+			if getRunCalls.Add(1) >= 2 {
+				state = `{"life_cycle_state":"TERMINATED","result_state":"SUCCESS"}`
+			}
+			_, _ = fmt.Fprintf(w, `{"run_id":5,"state":%s,"tasks":[{"run_id":101,"attempt_number":1}]}`, state)
+		case "/api/2.2/jobs/runs/get-output":
+			_, _ = w.Write([]byte(`{"ai_runtime_task_output":{"mlflow_experiment_id":"exp","mlflow_run_id":"mlrun"}}`))
+		case "/api/2.0/mlflow/runs/get":
+			_, _ = w.Write([]byte(`{}`))
+		case "/api/2.0/mlflow/artifacts/list":
+			if r.URL.Query().Get("path") == "logs" {
+				_, _ = w.Write([]byte(`{"files":[{"path":"logs/attempt_1","is_dir":true}]}`))
+			} else {
+				_, _ = w.Write([]byte(`{"files":[{"path":"logs/attempt_1/node_0/logs-0.chunk.txt"},{"path":"logs/attempt_1/node_0/logs-1.chunk.txt"}]}`))
+			}
+		case "/api/2.0/mlflow/artifacts/credentials-for-read":
+			signedURI := base + "/artifact?path=" + url.QueryEscape(r.URL.Query().Get("path"))
+			_, _ = fmt.Fprintf(w, `{"credential_infos":[{"signed_uri":%q}]}`, signedURI)
+		case "/artifact":
+			if strings.HasSuffix(r.URL.Query().Get("path"), "logs-0.chunk.txt") {
+				if firstChunkReads.Add(1) == 1 {
+					w.WriteHeader(http.StatusInternalServerError)
+					return
+				}
+				_, _ = w.Write([]byte("zero\n"))
+				return
+			}
+			secondChunkReads.Add(1)
+			_, _ = w.Write([]byte("one\n"))
+		default:
+			_, _ = w.Write([]byte(`{}`))
+		}
+	}))
+	base = srv.URL
+	t.Cleanup(srv.Close)
+
+	var out bytes.Buffer
+	success, err := streamMLflowLogs(t.Context(), newTestWorkspaceClient(t, srv.URL), &out,
+		logRequest{runID: 5, attempt: -1, tailLines: -1}, logRunStatus{lifeCycleState: "RUNNING", latestAttempt: 1})
+	require.NoError(t, err)
+	assert.True(t, success)
+	assert.Equal(t, "zero\none\n", out.String())
+	assert.Equal(t, int32(2), firstChunkReads.Load())
+	assert.Equal(t, int32(1), secondChunkReads.Load())
+}
+
+func TestVolumeArtifactListAndDownload(t *testing.T) {
+	server := testserver.New(t)
+	t.Cleanup(server.Close)
+	server.Handle("GET", "/api/2.0/mlflow/runs/get", func(req testserver.Request) any {
+		return map[string]any{"run": map[string]any{"info": map[string]any{
+			"run_id": "volume-run", "artifact_uri": "dbfs:/Volumes/main/default/logs/root",
+		}}}
+	})
+	testserver.AddDefaultHandlers(server)
+
+	w, err := databricks.NewWorkspaceClient(&databricks.Config{Host: server.URL, Token: "token"})
+	require.NoError(t, err)
+	fc, err := filer.NewFilesClient(t.Context(), w, "/Volumes/main/default/logs/root")
+	require.NoError(t, err)
+	require.NoError(t, fc.Mkdir(t.Context(), "logs/node_0"))
+	require.NoError(t, fc.Write(t.Context(), "logs/node_0/logs-0.chunk.txt", strings.NewReader("volume line\n")))
+
+	chunks, err := listLogChunks(t.Context(), w, "volume-run", "logs/node_0")
+	require.NoError(t, err)
+	require.Len(t, chunks, 1)
+	assert.Equal(t, "logs/node_0/logs-0.chunk.txt", chunks[0].path)
+
+	lines, err := downloadChunkLines(t.Context(), w, "volume-run", chunks[0].path)
+	require.NoError(t, err)
+	assert.Equal(t, []string{"volume line"}, lines)
+}
+
+func TestMLflowArtifactRootCachesSuccessButNotFailure(t *testing.T) {
+	var calls atomic.Int32
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/api/2.0/mlflow/runs/get" {
+			_, _ = w.Write([]byte(`{}`))
+			return
+		}
+		if calls.Add(1) == 1 {
+			w.WriteHeader(http.StatusInternalServerError)
+			_, _ = w.Write([]byte(`{"error_code":"INTERNAL_ERROR","message":"retry"}`))
+			return
+		}
+		_, _ = w.Write([]byte(`{"run":{"info":{"run_id":"cache-run","artifact_uri":"dbfs:/Volumes/main/default/v"}}}`))
+	}))
+	t.Cleanup(srv.Close)
+	w := newTestWorkspaceClient(t, srv.URL)
+
+	root, err := mlflowArtifactRoot(t.Context(), w, "cache-run")
+	require.NoError(t, err)
+	assert.Empty(t, root)
+	root, err = mlflowArtifactRoot(t.Context(), w, "cache-run")
+	require.NoError(t, err)
+	assert.Equal(t, "dbfs:/Volumes/main/default/v", root)
+	root, err = mlflowArtifactRoot(t.Context(), w, "cache-run")
+	require.NoError(t, err)
+	assert.Equal(t, "dbfs:/Volumes/main/default/v", root)
+	assert.Equal(t, int32(2), calls.Load())
+}
+
+func TestDownloadArtifactSendsUnbracketedPath(t *testing.T) {
+	var gotPath string
+	var base string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/api/2.0/mlflow/artifacts/credentials-for-read":
+			gotPath = r.URL.Query().Get("path")
+			_, _ = w.Write([]byte(`{"credential_infos": [{"signed_uri": "` + base + `/presigned"}]}`))
+		case "/presigned":
+			_, _ = w.Write([]byte("bytes\n"))
+		default:
+			_, _ = w.Write([]byte(`{}`))
+		}
+	}))
+	base = srv.URL
+	t.Cleanup(srv.Close)
+
+	local, err := downloadArtifact(t.Context(), newTestWorkspaceClient(t, srv.URL), "run1", "logs/node_0/logs-0.chunk.txt")
+	require.NoError(t, err)
+	t.Cleanup(func() { os.Remove(local) })
+
+	// The backend signs whatever path it is given and returns 200 even for a
+	// bracketed one, so only the download 404s. Assert on the path sent.
+	assert.Equal(t, "logs/node_0/logs-0.chunk.txt", gotPath)
+}
diff --git a/cmd/air/logs.go b/cmd/air/logs.go
new file mode 100644
index 00000000000..9689e1e8a4a
--- /dev/null
+++ b/cmd/air/logs.go
@@ -0,0 +1,244 @@
+package aircmd
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"slices"
+	"strconv"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/service/iam"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/spf13/cobra"
+)
+
+func newLogsCommand() *cobra.Command {
+	var (
+		node       int
+		tail       int
+		minutes    int
+		retry      int
+		downloadTo string
+		review     bool
+	)
+
+	cmd := &cobra.Command{
+		Use:   "logs JOB_RUN_ID",
+		Args:  root.ExactArgs(1),
+		Short: "Stream or fetch logs for a run",
+		Long: `Stream logs from an active run until it completes, or fetch logs from a
+completed run.
+
+JOB_RUN_ID is the job run ID returned by "air run".`,
+		Example: `  databricks air logs 123456789
+  databricks air logs 123456789 --node 1 --retry 0
+  databricks air logs 123456789 --download-to ./logs`,
+	}
+
+	cmd.Flags().IntVar(&node, "node", 0, "Fetch logs from this node")
+	cmd.Flags().IntVar(&tail, "tail", 0, "Print the last N existing lines before following, or from a completed run (default 10000)")
+	cmd.Flags().IntVar(&minutes, "minutes", 0, "Fetch only logs from the last N minutes")
+	cmd.Flags().IntVar(&retry, "retry", -1, "View logs from a specific retry attempt; -1 means latest")
+	cmd.Flags().StringVar(&downloadTo, "download-to", "", "Download all logs to this directory instead of printing")
+	cmd.Flags().BoolVar(&review, "review", false, "Download logs from all nodes and filter for error signatures")
+	cmd.Flags().MarkHidden("review")
+
+	// In -o json mode an auth failure should be a JSON error envelope, not a bare
+	// error. ErrAlreadyPrinted passes through.
+	cmd.PreRunE = func(cmd *cobra.Command, args []string) error {
+		err := root.MustWorkspaceClient(cmd, args)
+		if err == nil || errors.Is(err, root.ErrAlreadyPrinted) {
+			return err
+		}
+		return authError(cmd.Context(), cmd, err)
+	}
+
+	cmd.RunE = func(cmd *cobra.Command, args []string) error {
+		ctx := cmd.Context()
+
+		// --review is not yet implemented; reject rather than silently ignore.
+		if review {
+			return renderError(ctx, cmd, "INVALID_ARGS", "PERMANENT", false,
+				errors.New("--review is not implemented yet"))
+		}
+
+		// A download always writes the full log, so a tail or time window would be
+		// silently dropped.
+		if downloadTo != "" && (cmd.Flags().Changed("tail") || minutes > 0) {
+			return renderError(ctx, cmd, "INVALID_ARGS", "PERMANENT", false,
+				errors.New("--download-to writes complete logs, so it cannot be combined with --tail or --minutes"))
+		}
+
+		// --tail (line tail) and --minutes (time window) answer the same question
+		// two ways, so reject both together rather than silently honoring one.
+		if tail > 0 && minutes > 0 {
+			return renderError(ctx, cmd, "INVALID_ARGS", "PERMANENT", false,
+				errors.New("cannot combine --tail with --minutes: --tail selects by line count, --minutes by time window"))
+		}
+		if cmd.Flags().Changed("tail") && tail <= 0 {
+			return renderError(ctx, cmd, "INVALID_ARGS", "PERMANENT", false,
+				fmt.Errorf("invalid --tail %d: must be positive", tail))
+		}
+		if minutes < 0 {
+			return renderError(ctx, cmd, "INVALID_ARGS", "PERMANENT", false,
+				fmt.Errorf("invalid --minutes %d: must be positive", minutes))
+		}
+		if node < 0 {
+			return renderError(ctx, cmd, "INVALID_ARGS", "PERMANENT", false,
+				fmt.Errorf("invalid --node %d: must not be negative", node))
+		}
+		if retry < -1 {
+			return renderError(ctx, cmd, "INVALID_ARGS", "PERMANENT", false,
+				fmt.Errorf("invalid --retry %d: must be -1 or greater", retry))
+		}
+
+		runID, err := strconv.ParseInt(args[0], 10, 64)
+		if err != nil || runID <= 0 {
+			return renderError(ctx, cmd, "INVALID_ARGS", "PERMANENT", false,
+				fmt.Errorf("invalid JOB_RUN_ID %q: must be a positive integer", args[0]))
+		}
+
+		// -1 signals "unset" (use the default cap).
+		tailLines := -1
+		if cmd.Flags().Changed("tail") {
+			tailLines = tail
+		}
+
+		// Only the streaming path prints resume guidance, so only it catches the
+		// interrupt: without this a Ctrl-C kills the process before
+		// handleWatchResult runs. Download and JSON keep the default handling.
+		streamCtx := ctx
+		if downloadTo == "" && root.OutputType(cmd) != flags.OutputJSON {
+			var stop context.CancelFunc
+			streamCtx, stop = notifyInterrupt(ctx)
+			defer stop()
+		}
+
+		err = runLogs(streamCtx, cmd, logRequest{
+			runID:            runID,
+			node:             node,
+			nodeSet:          cmd.Flags().Changed("node"),
+			attempt:          retry,
+			windowMinutes:    minutes,
+			tailLines:        tailLines,
+			boundInitialLogs: minutes == 0,
+			downloadTo:       downloadTo,
+			jsonOutput:       root.OutputType(cmd) == flags.OutputJSON,
+		})
+		if downloadTo != "" || root.OutputType(cmd) == flags.OutputJSON {
+			return err
+		}
+		return handleWatchResult(cmd.OutOrStdout(), cmdctx.WorkspaceClient(ctx).Config.Profile, args[0], err)
+	}
+
+	return cmd
+}
+
+// runLogs resolves the run, validates --retry, and fetches logs. It handles error
+// reporting; the backend selection lives in fetchLogs.
+func runLogs(ctx context.Context, cmd *cobra.Command, req logRequest) error {
+	w := cmdctx.WorkspaceClient(ctx)
+
+	// Validate credentials server-side before fetching (MustWorkspaceClient only
+	// attaches them), so a bad token fails clearly here.
+	if _, err := w.CurrentUser.Me(ctx, iam.MeRequest{}); err != nil {
+		return authError(ctx, cmd, err)
+	}
+
+	status, err := resolveRunStatus(ctx, w, req.runID)
+	if err != nil {
+		if errors.Is(err, apierr.ErrResourceDoesNotExist) {
+			return renderError(ctx, cmd, "NOT_FOUND", "NOT_FOUND", false,
+				fmt.Errorf("run %d not found: check the run ID and that it is a job run ID", req.runID))
+		}
+		return renderError(ctx, cmd, "INTERNAL_ERROR", "TRANSIENT", true,
+			fmt.Errorf("failed to get status for run %d: %w", req.runID, err))
+	}
+
+	// -1 (default) means latest; reject an attempt past the newest.
+	if req.attempt >= 0 && req.attempt > status.latestAttempt {
+		return renderError(ctx, cmd, "INVALID_ARGS", "PERMANENT", false,
+			fmt.Errorf("invalid retry %d: available retries are 0 to %d", req.attempt, status.latestAttempt))
+	}
+
+	// --download-to writes each node's logs to disk instead of streaming.
+	if req.downloadTo != "" {
+		success, err := downloadLogs(ctx, w, cmd.OutOrStdout(), req, status)
+		if errors.Is(err, errNodeOutOfRange) {
+			return renderError(ctx, cmd, "INVALID_ARGS", "PERMANENT", false, err)
+		}
+		if err != nil {
+			return renderError(ctx, cmd, "INTERNAL_ERROR", "TRANSIENT", true,
+				fmt.Errorf("failed to download logs for run %d: %w", req.runID, err))
+		}
+		if !success {
+			return root.ErrAlreadyPrinted
+		}
+		return nil
+	}
+
+	// A past retry of an active run has immutable logs: render once, don't follow.
+	if req.attempt >= 0 && req.attempt < status.latestAttempt && !status.terminal() {
+		req.staticView = true
+	}
+
+	out := cmd.OutOrStdout()
+	success, err := fetchLogs(ctx, w, out, req, status)
+	if err != nil {
+		if errors.Is(err, apierr.ErrResourceDoesNotExist) {
+			return renderError(ctx, cmd, "NOT_FOUND", "NOT_FOUND", false,
+				fmt.Errorf("run %d not found: check the run ID and that it is a job run ID", req.runID))
+		}
+		return renderError(ctx, cmd, "INTERNAL_ERROR", "TRANSIENT", true,
+			fmt.Errorf("failed to fetch logs for run %d: %w", req.runID, err))
+	}
+
+	// A run that finished unsuccessfully exits non-zero; output was already
+	// written, so don't reprint via Cobra.
+	if !success {
+		return root.ErrAlreadyPrinted
+	}
+	return nil
+}
+
+func resolveLogAttempt(run *jobs.Run, requested int) (int, int64, error) {
+	if requested < -1 {
+		return 0, 0, fmt.Errorf("invalid retry %d: must be -1 or greater", requested)
+	}
+	if len(run.Tasks) == 0 {
+		return 0, 0, nil
+	}
+	latest := latestAttemptNumber(run)
+	attempt := requested
+	if attempt < 0 {
+		attempt = latest
+	}
+	if attempt > latest {
+		return 0, 0, fmt.Errorf("invalid retry %d: available retries are 0 to %d", requested, latest)
+	}
+	for _, v := range slices.Backward(run.Tasks) {
+		if v.AttemptNumber == attempt {
+			return attempt, v.RunId, nil
+		}
+	}
+	return 0, 0, fmt.Errorf("run %d has no task for retry %d", run.RunId, attempt)
+}
+
+// fetchLogs serves logs from Bricklens, falling back to MLflow when Bricklens
+// returns errBricklensFeatureDisabled.
+func fetchLogs(ctx context.Context, w *databricks.WorkspaceClient, out io.Writer, req logRequest, status logRunStatus) (bool, error) {
+	if req.attempt < 0 && !status.terminal() && req.retryTracker == nil {
+		req.retryTracker = newRetryTracker(status)
+	}
+	success, err := streamBricklensLogs(ctx, w, out, req, status)
+	if errors.Is(err, errBricklensFeatureDisabled) {
+		return mlflowLogFallback(ctx, w, out, req, status)
+	}
+	return success, err
+}
diff --git a/cmd/air/logs_test.go b/cmd/air/logs_test.go
new file mode 100644
index 00000000000..857339360f8
--- /dev/null
+++ b/cmd/air/logs_test.go
@@ -0,0 +1,342 @@
+package aircmd
+
+import (
+	"bytes"
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/databricks-sdk-go/experimental/mocks"
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestLogsCommandShape(t *testing.T) {
+	cmd := newLogsCommand()
+	assert.Equal(t, "logs JOB_RUN_ID", cmd.Use)
+	assert.Empty(t, cmd.Commands(), "logs must not register subcommands")
+	assert.NoError(t, cmd.Args(cmd, []string{"123"}))
+	assert.Error(t, cmd.Args(cmd, []string{}))
+	assert.Error(t, cmd.Args(cmd, []string{"1", "2"}))
+
+	// --review is hidden.
+	review := cmd.Flags().Lookup("review")
+	require.NotNil(t, review)
+	assert.True(t, review.Hidden)
+	assert.NotNil(t, cmd.Flags().Lookup("tail"))
+	assert.Nil(t, cmd.Flags().Lookup("lines"))
+}
+
+// runLogsCmd invokes the logs command's RunE with the given flags against a mock
+// (no-HTTP) workspace client. Used for input validation that fails before any
+// API call.
+func runLogsCmd(t *testing.T, args []string, flagsToSet map[string]string) error {
+	t.Helper()
+	m := mocks.NewMockWorkspaceClient(t)
+	ctx := cmdctx.SetWorkspaceClient(cmdio.MockDiscard(t.Context()), m.WorkspaceClient)
+	cmd := withOutput(newLogsCommand(), flags.OutputText)
+	for k, v := range flagsToSet {
+		require.NoError(t, cmd.Flags().Set(k, v))
+	}
+	cmd.SetContext(ctx)
+	return cmd.RunE(cmd, args)
+}
+
+func TestLogsFlagValidation(t *testing.T) {
+	tests := []struct {
+		name    string
+		args    []string
+		flags   map[string]string
+		wantMsg string
+	}{
+		{
+			name:    "tail and minutes are mutually exclusive",
+			args:    []string{"5"},
+			flags:   map[string]string{"tail": "100", "minutes": "10"},
+			wantMsg: "cannot combine --tail with --minutes",
+		},
+		{
+			name:    "negative tail rejected",
+			args:    []string{"5"},
+			flags:   map[string]string{"tail": "-1"},
+			wantMsg: "invalid --tail",
+		},
+		{
+			name:    "zero tail rejected",
+			args:    []string{"5"},
+			flags:   map[string]string{"tail": "0"},
+			wantMsg: "invalid --tail",
+		},
+		{
+			name:    "negative minutes rejected",
+			args:    []string{"5"},
+			flags:   map[string]string{"minutes": "-1"},
+			wantMsg: "invalid --minutes",
+		},
+		{
+			name:    "review not implemented",
+			args:    []string{"5"},
+			flags:   map[string]string{"review": "true"},
+			wantMsg: "--review is not implemented yet",
+		},
+		{
+			name:    "invalid run id",
+			args:    []string{"abc"},
+			wantMsg: "invalid JOB_RUN_ID",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := runLogsCmd(t, tt.args, tt.flags)
+			require.Error(t, err)
+			assert.Contains(t, err.Error(), tt.wantMsg)
+		})
+	}
+}
+
+// completedRunLogsServer serves the auth probe, a terminal runs/get, and a
+// single page of Bricklens logs (newest-first, as the tail fetch requests).
+func completedRunLogsServer(t *testing.T) *httptest.Server {
+	t.Helper()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case r.URL.Path == "/api/2.2/jobs/runs/get":
+			_, _ = w.Write([]byte(`{
+				"run_id": 5,
+				"start_time": 1000,
+				"end_time": 2000,
+				"state": {"life_cycle_state": "TERMINATED", "result_state": "SUCCESS"},
+				"tasks": [{"attempt_number": 0}]
+			}`))
+		case strings.HasPrefix(r.URL.Path, "/api/2.0/ai-training/workflows/by-run-id/"):
+			// Newest-first, as drainTail requests; reversed to oldest-first on print.
+			_, _ = w.Write([]byte(`{"log_records": [
+				{"time_unix_nano": 2000000000, "body": "line two", "node_index": 0},
+				{"time_unix_nano": 1000000000, "body": "line one", "node_index": 0}
+			]}`))
+		default:
+			// Me() probe and SDK config discovery.
+			_, _ = w.Write([]byte(`{"userName":"u@example.com"}`))
+		}
+	}))
+	t.Cleanup(srv.Close)
+	return srv
+}
+
+func TestLogsCompletedRunTail(t *testing.T) {
+	srv := completedRunLogsServer(t)
+	var buf bytes.Buffer
+	ctx := cmdctx.SetWorkspaceClient(cmdio.MockDiscard(t.Context()), newTestWorkspaceClient(t, srv.URL))
+	cmd := withOutput(&cobra.Command{}, flags.OutputText)
+	cmd.SetContext(ctx)
+	cmd.SetOut(&buf)
+
+	// Drive runLogs directly (bypassing PreRunE auth wiring) with a resolved request.
+	err := runLogs(ctx, cmd, logRequest{runID: 5, node: 0, attempt: -1, tailLines: -1})
+	require.NoError(t, err)
+
+	// Records print oldest-first regardless of the newest-first fetch order.
+	assert.Equal(t, "line one\nline two\n", buf.String())
+}
+
+// mlflowFallbackServer serves a terminal run whose Bricklens endpoint is gated
+// off (FEATURE_DISABLED), plus the full MLflow artifact path the fallback walks:
+// runs/get-output (MLflow ids), artifacts/list (logs dir + chunk file),
+// credentials-for-read (pre-signed URL), and the pre-signed chunk bytes itself.
+func mlflowFallbackServer(t *testing.T) *httptest.Server {
+	t.Helper()
+	var base string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case r.URL.Path == "/api/2.2/jobs/runs/get":
+			_, _ = w.Write([]byte(`{
+				"run_id": 5,
+				"state": {"life_cycle_state": "TERMINATED", "result_state": "SUCCESS"},
+				"tasks": [{"run_id": 456, "attempt_number": 0}]
+			}`))
+		case strings.HasPrefix(r.URL.Path, "/api/2.0/ai-training/workflows/by-run-id/"):
+			w.WriteHeader(http.StatusForbidden)
+			_, _ = w.Write([]byte(`{"error_code": "FEATURE_DISABLED", "message": "bricklens logs gated off"}`))
+		case r.URL.Path == "/api/2.2/jobs/runs/get-output":
+			_, _ = w.Write([]byte(`{"ai_runtime_task_output": {"mlflow_experiment_id": "exp1", "mlflow_run_id": "run1"}}`))
+		case r.URL.Path == "/api/2.0/mlflow/artifacts/list":
+			// The logs dir probe (format discovery) and the per-node chunk listing
+			// both hit this; return the old-format node dir and one chunk file.
+			if r.URL.Query().Get("path") == "logs" {
+				_, _ = w.Write([]byte(`{"files": [{"path": "logs/node_0", "is_dir": true}]}`))
+				return
+			}
+			_, _ = w.Write([]byte(`{"files": [{"path": "logs/node_0/logs-0.chunk.txt", "file_size": 12}]}`))
+		case r.URL.Path == "/api/2.0/mlflow/artifacts/credentials-for-read":
+			_, _ = w.Write([]byte(`{"credential_infos": [{"signed_uri": "` + base + `/presigned"}]}`))
+		case r.URL.Path == "/presigned":
+			_, _ = w.Write([]byte("line one\nline two\n"))
+		default:
+			_, _ = w.Write([]byte(`{"userName":"u@example.com"}`))
+		}
+	}))
+	base = srv.URL
+	t.Cleanup(srv.Close)
+	return srv
+}
+
+func TestLogsFallsBackToMLflow(t *testing.T) {
+	srv := mlflowFallbackServer(t)
+	var buf bytes.Buffer
+	ctx := cmdctx.SetWorkspaceClient(cmdio.MockDiscard(t.Context()), newTestWorkspaceClient(t, srv.URL))
+	cmd := withOutput(&cobra.Command{}, flags.OutputText)
+	cmd.SetContext(ctx)
+	cmd.SetOut(&buf)
+
+	// Bricklens is gated off, so fetchLogs routes to the MLflow fallback, which
+	// resolves the MLflow run, lists the chunk, downloads it via the pre-signed
+	// URL, and prints its lines.
+	err := runLogs(ctx, cmd, logRequest{runID: 5, node: 0, attempt: -1, tailLines: -1})
+	require.NoError(t, err)
+	assert.Equal(t, "line one\nline two\n", buf.String())
+}
+
+func TestFetchLogsRetryNotificationDeduplicatedAcrossFallback(t *testing.T) {
+	oldRetryInterval := retryCheckInterval
+	retryCheckInterval = time.Millisecond
+	t.Cleanup(func() { retryCheckInterval = oldRetryInterval })
+
+	var base string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case r.URL.Path == "/api/2.2/jobs/runs/get":
+			_, _ = w.Write([]byte(`{"run_id":5,"state":{"life_cycle_state":"TERMINATED","result_state":"SUCCESS"},"tasks":[{"run_id":101,"attempt_number":1}]}`))
+		case strings.HasPrefix(r.URL.Path, "/api/2.0/ai-training/workflows/by-run-id/"):
+			w.WriteHeader(http.StatusForbidden)
+			_, _ = w.Write([]byte(`{"error_code":"FEATURE_DISABLED","message":"gated off"}`))
+		case r.URL.Path == "/api/2.2/jobs/runs/get-output":
+			_, _ = w.Write([]byte(`{"ai_runtime_task_output":{"mlflow_experiment_id":"exp","mlflow_run_id":"run"}}`))
+		case r.URL.Path == "/api/2.0/mlflow/artifacts/list":
+			if r.URL.Query().Get("path") == "logs" {
+				_, _ = w.Write([]byte(`{"files":[{"path":"logs/attempt_1","is_dir":true}]}`))
+				return
+			}
+			_, _ = w.Write([]byte(`{"files":[{"path":"logs/attempt_1/node_0/logs-0.chunk.txt"}]}`))
+		case r.URL.Path == "/api/2.0/mlflow/artifacts/credentials-for-read":
+			_, _ = w.Write([]byte(`{"credential_infos":[{"signed_uri":"` + base + `/artifact"}]}`))
+		case r.URL.Path == "/artifact":
+			_, _ = w.Write([]byte("retry log\n"))
+		default:
+			_, _ = w.Write([]byte(`{}`))
+		}
+	}))
+	base = srv.URL
+	t.Cleanup(srv.Close)
+
+	initial := logRunStatus{
+		lifeCycleState:           "RUNNING",
+		latestAttempt:            1,
+		latestTaskLifeCycleState: "WAITING_FOR_RETRY",
+	}
+	maxRetries := 3
+	var out bytes.Buffer
+	success, err := fetchLogs(t.Context(), newTestWorkspaceClient(t, srv.URL), &out, logRequest{
+		runID:        5,
+		attempt:      -1,
+		tailLines:    -1,
+		jsonOutput:   true,
+		maxRetries:   &maxRetries,
+		retryTracker: newRetryTracker(logRunStatus{}),
+	}, initial)
+	require.NoError(t, err)
+	assert.True(t, success)
+	assert.Equal(t, 1, strings.Count(out.String(), `"type":"RETRY"`))
+	assert.Contains(t, out.String(), `"retry":1`)
+	assert.Contains(t, out.String(), `"max_retries":3`)
+	assert.Contains(t, out.String(), `"line":"retry log"`)
+}
+
+func TestLogsCommandPrintsGuidanceWhenStreamingIsInterrupted(t *testing.T) {
+	ctx, cancel := context.WithCancel(t.Context())
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case r.URL.Path == "/api/2.2/jobs/runs/get":
+			_, _ = w.Write([]byte(`{"run_id":5,"state":{"life_cycle_state":"RUNNING"},"tasks":[{"run_id":456}]}`))
+		case strings.HasSuffix(r.URL.Path, "/logs"):
+			cancel()
+			_, _ = w.Write([]byte(`{"log_records":[]}`))
+		default:
+			_, _ = w.Write([]byte(`{"userName":"u@example.com"}`))
+		}
+	}))
+	t.Cleanup(srv.Close)
+
+	var buf bytes.Buffer
+	client := newTestWorkspaceClient(t, srv.URL)
+	client.Config.Profile = "team profile"
+	ctx = cmdio.InContext(ctx, cmdio.NewIO(ctx, flags.OutputText, nil, &buf, &buf, "", ""))
+	ctx = cmdctx.SetWorkspaceClient(ctx, client)
+	cmd := withOutput(newLogsCommand(), flags.OutputText)
+	cmd.SetContext(ctx)
+	cmd.SetOut(&buf)
+
+	err := cmd.RunE(cmd, []string{"5"})
+	require.ErrorIs(t, err, root.ErrAlreadyPrinted)
+	assert.Contains(t, buf.String(), "Streaming logs interrupted.")
+	assert.Contains(t, buf.String(), "To check status:\ndatabricks air get 5 -p 'team profile'")
+	assert.Contains(t, buf.String(), "To resume streaming logs:\ndatabricks air logs 5 -p 'team profile'")
+}
+
+// activeRunPastRetryServer serves a still-RUNNING run with two attempts and a
+// single page of Bricklens logs. runs/get always returns RUNNING; a test that
+// follows the run would poll forever, so it also asserts the static path never
+// loops.
+func activeRunPastRetryServer(t *testing.T, getRunHits *int) *httptest.Server {
+	t.Helper()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case r.URL.Path == "/api/2.2/jobs/runs/get":
+			*getRunHits++
+			_, _ = w.Write([]byte(`{
+				"run_id": 9,
+				"start_time": 1700000000000,
+				"state": {"life_cycle_state": "RUNNING"},
+				"tasks": [{"attempt_number": 0}, {"attempt_number": 1}]
+			}`))
+		case strings.HasPrefix(r.URL.Path, "/api/2.0/ai-training/workflows/by-run-id/"):
+			_, _ = w.Write([]byte(`{"log_records": [
+				{"time_unix_nano": 1700000001000000000, "body": "retry 0 log", "node_index": 0}
+			]}`))
+		default:
+			_, _ = w.Write([]byte(`{"userName":"u@example.com"}`))
+		}
+	}))
+	t.Cleanup(srv.Close)
+	return srv
+}
+
+func TestLogsPastRetryOfActiveRunIsStatic(t *testing.T) {
+	var getRunHits int
+	srv := activeRunPastRetryServer(t, &getRunHits)
+	var buf bytes.Buffer
+	ctx := cmdctx.SetWorkspaceClient(cmdio.MockDiscard(t.Context()), newTestWorkspaceClient(t, srv.URL))
+	cmd := withOutput(&cobra.Command{}, flags.OutputText)
+	cmd.SetContext(ctx)
+	cmd.SetOut(&buf)
+
+	// --retry 0 on a RUNNING run whose latest attempt is 1: the past attempt's
+	// logs render once instead of following the run (which would never terminate).
+	// The run is still active, so there is no failure to report — printing the
+	// logs succeeded, and the command exits 0.
+	err := runLogs(ctx, cmd, logRequest{runID: 9, node: 0, attempt: 0, tailLines: -1})
+	require.NoError(t, err)
+	assert.Equal(t, "retry 0 log\n", buf.String())
+
+	// Exactly one runs/get: the initial status resolve in runLogs. The static
+	// streamer must not re-poll (that is the loop this test guards against).
+	assert.Equal(t, 1, getRunHits)
+}
diff --git a/cmd/air/logstream.go b/cmd/air/logstream.go
new file mode 100644
index 00000000000..11c03d86d47
--- /dev/null
+++ b/cmd/air/logstream.go
@@ -0,0 +1,723 @@
+package aircmd
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"slices"
+	"strings"
+	"time"
+
+	"github.com/databricks/cli/libs/auth"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/client"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+)
+
+const (
+	// maxTransientFailures is how many consecutive Bricklens failures to tolerate
+	// before falling back to MLflow.
+	maxTransientFailures = 5
+	// defaultCompletedRunTailLines caps a completed run's output when neither
+	// --tail nor --minutes is set.
+	defaultCompletedRunTailLines = 10000
+	// seenRecordsCap bounds the dedup set, evicting oldest-inserted entries first.
+	seenRecordsCap = 100000
+	// statusMessageRefreshEveryNPolls throttles the status_message fetch so the
+	// waiting spinner doesn't issue a get-output on every poll tick.
+	statusMessageRefreshEveryNPolls = 5
+	// bricklensEmptyMLflowProbeEveryNPolls throttles the active-run MLflow
+	// existence probe while Bricklens has returned no records.
+	bricklensEmptyMLflowProbeEveryNPolls = 10
+	// Event time and ingestion order can differ, so live polls overlap.
+	bricklensLogLookback = 30 * time.Second
+	// A terminal job can have records that are not searchable yet.
+	bricklensTerminalEmptyPolls = 3
+)
+
+// statusMessageType tags a client-facing message packed into
+// ai_runtime_task_output.status_message as "<TYPE>:<payload>"; only STATUS-typed
+// messages are surfaced.
+const statusMessageType = "STATUS"
+
+// waitingForComputeStatus is the fallback shown while a PENDING run waits for
+// accelerator compute.
+const waitingForComputeStatus = "Waiting for accelerator compute capacity to become available..."
+
+// normalizeStatusMessage returns the payload of a "STATUS:<payload>" message,
+// normalized for display (trailing "." stripped, "..." suffix added), or "" for
+// any other type or an empty/absent message.
+func normalizeStatusMessage(raw string) string {
+	messageType, payload, ok := strings.Cut(raw, ":")
+	if !ok || !strings.EqualFold(strings.TrimSpace(messageType), statusMessageType) {
+		return ""
+	}
+	payload = strings.TrimSpace(payload)
+	payload = strings.TrimRight(payload, ".")
+	payload = strings.TrimSpace(payload)
+	if payload == "" {
+		return ""
+	}
+	if strings.EqualFold(payload, "Waiting for GPU compute capacity to become available") {
+		return waitingForComputeStatus
+	}
+	return payload + "..."
+}
+
+// retryCheckInterval is the wait between status/log polls. A var so tests can
+// shrink it.
+var retryCheckInterval = 3 * time.Second
+
+// bricklensPollInterval is independent of slower retry and discovery backoffs.
+var bricklensPollInterval = time.Second
+
+// errBricklensFeatureDisabled signals the caller to fall back to MLflow: Bricklens
+// is gated off (FEATURE_DISABLED), not deployed (ENDPOINT_NOT_FOUND / 404),
+// persistently failing, or served every request successfully but never returned a
+// record for a run whose logs may still be in MLflow. The flag is evaluated
+// server-side.
+var errBricklensFeatureDisabled = errors.New("bricklens logs unavailable; falling back to mlflow")
+
+// logRequest describes what to fetch, shared by both backends so they honor the
+// same flags. windowMinutes and tailLines are mutually exclusive.
+type logRequest struct {
+	runID int64
+	// node is the node index to fetch; node 0 always exists.
+	node int
+	// nodeSet distinguishes an explicit --node 0 from the default, so a download
+	// knows whether to fetch one node or all of them.
+	nodeSet bool
+	// attempt is the retry attempt to read; -1 means latest.
+	attempt int
+	// windowMinutes, when > 0, restricts the fetch to the last N minutes.
+	windowMinutes int
+	// tailLines caps a completed run's output to the last N lines. Negative means
+	// --tail was unset (use the default cap); 0 prints no log lines.
+	tailLines int
+	// downloadTo, when set, writes logs to that directory instead of stdout.
+	downloadTo string
+	// staticView renders a one-shot tail instead of following the run. Set for a
+	// past retry of an active run: that attempt's logs are immutable, so streaming
+	// would poll forever waiting for the run (not the attempt) to finish.
+	staticView bool
+	// boundInitialLogs limits existing output before following an active run.
+	boundInitialLogs bool
+	jsonOutput       bool
+	maxRetries       *int
+	// onStatusChange, when set, is called on each lifecycle transition while
+	// following the run (current, previous display states). Used by
+	// `air run --watch -o json` to emit STATUS events.
+	onStatusChange func(current, previous string)
+	retryTracker   *retryTracker
+}
+
+// logRunStatus is the subset of a run's state the log path needs, resolved once
+// and reused.
+type logRunStatus struct {
+	lifeCycleState           string
+	latestTaskLifeCycleState string
+	resultState              string
+	stateMessage             string
+	startTimeMs              int64
+	endTimeMs                int64
+	// latestAttempt is the highest attempt_number across the run's tasks.
+	latestAttempt int
+}
+
+// retryTracker reports each retry once across either Jobs transition:
+//
+//  1. Attempt N enters WAITING_FOR_RETRY: report retry N+1.
+//  2. Attempt N+1 appears: report retry N+1 only if transition 1 was missed.
+type retryTracker struct {
+	lastReportedRetry           int
+	lastObservedAttempt         int
+	lastObservedWaitingForRetry bool
+}
+
+func newRetryTracker(status logRunStatus) *retryTracker {
+	return &retryTracker{
+		lastReportedRetry:           status.latestAttempt,
+		lastObservedAttempt:         status.latestAttempt,
+		lastObservedWaitingForRetry: status.latestTaskLifeCycleState == string(jobs.RunLifeCycleStateWaitingForRetry),
+	}
+}
+
+func (t *retryTracker) observe(status logRunStatus) (int, bool) {
+	waitingForRetry := status.latestTaskLifeCycleState == string(jobs.RunLifeCycleStateWaitingForRetry)
+	retry := 0
+	if status.latestAttempt > t.lastObservedAttempt {
+		t.lastObservedAttempt = status.latestAttempt
+		t.lastObservedWaitingForRetry = waitingForRetry
+		retry = status.latestAttempt
+	} else if status.latestAttempt == t.lastObservedAttempt {
+		if waitingForRetry && !t.lastObservedWaitingForRetry {
+			retry = status.latestAttempt + 1
+		}
+		t.lastObservedWaitingForRetry = waitingForRetry
+	}
+	if retry <= t.lastReportedRetry || retry <= 0 {
+		return 0, false
+	}
+	t.lastReportedRetry = retry
+	return retry, true
+}
+
+func (req logRequest) reportRetry(ctx context.Context, out io.Writer, status logRunStatus, before func()) {
+	if req.retryTracker == nil {
+		return
+	}
+	retry, ok := req.retryTracker.observe(status)
+	if !ok {
+		return
+	}
+	if before != nil {
+		before()
+	}
+	if req.jsonOutput {
+		printRetryEvent(out, retry, req.maxRetries)
+	} else if req.maxRetries != nil {
+		cmdio.LogString(ctx, fmt.Sprintf("\nRetrying (%d of %d)...\n", retry, *req.maxRetries))
+	} else {
+		cmdio.LogString(ctx, fmt.Sprintf("\nRetrying (%d)...\n", retry))
+	}
+}
+
+// A run is terminal when its lifecycle state is terminal, or a result state is
+// set (result states only appear on terminal runs).
+var (
+	terminalLifeCycleStates = map[string]bool{"TERMINATED": true, "SKIPPED": true, "INTERNAL_ERROR": true}
+	terminalResultStates    = map[string]bool{"SUCCESS": true, "FAILED": true, "TIMEDOUT": true, "CANCELED": true}
+)
+
+func (s logRunStatus) terminal() bool {
+	return terminalLifeCycleStates[s.lifeCycleState] || terminalResultStates[s.resultState]
+}
+
+func (s logRunStatus) succeeded() bool {
+	return s.resultState == "SUCCESS"
+}
+
+func (s logRunStatus) waitingForCompute() bool {
+	if s.resultState != "" {
+		return false
+	}
+	if s.lifeCycleState == string(jobs.RunLifeCycleStatePending) {
+		return true
+	}
+	if s.lifeCycleState != string(jobs.RunLifeCycleStateRunning) {
+		return false
+	}
+	switch jobs.RunLifeCycleState(s.latestTaskLifeCycleState) {
+	case jobs.RunLifeCycleStatePending, jobs.RunLifeCycleStateQueued,
+		jobs.RunLifeCycleStateWaitingForRetry, jobs.RunLifeCycleStateBlocked:
+		return true
+	default:
+		return false
+	}
+}
+
+// downloadOutcome is the exit status for a one-shot fetch, which unlike streaming
+// can run against an active run. An active run has no result state yet, and
+// not-yet-finished is not a failure, so only a terminal run decides the exit code.
+func (s logRunStatus) downloadOutcome() bool {
+	return !s.terminal() || s.succeeded()
+}
+
+// resolveRunStatus fetches a run's state and projects it onto logRunStatus. An
+// unknown run id surfaces as apierr.ErrResourceDoesNotExist.
+func resolveRunStatus(ctx context.Context, w *databricks.WorkspaceClient, runID int64) (logRunStatus, error) {
+	run, err := w.Jobs.GetRun(ctx, jobs.GetRunRequest{RunId: runID})
+	if err != nil {
+		return logRunStatus{}, err
+	}
+	return projectRunStatus(run), nil
+}
+
+// projectRunStatus extracts logRunStatus from a run. Split out so it can be
+// tested without an API client.
+func projectRunStatus(run *jobs.Run) logRunStatus {
+	s := logRunStatus{
+		startTimeMs: run.StartTime,
+		endTimeMs:   run.EndTime,
+	}
+	if run.State != nil {
+		s.lifeCycleState = string(run.State.LifeCycleState)
+		s.resultState = string(run.State.ResultState)
+		s.stateMessage = run.State.StateMessage
+	}
+	for i := range run.Tasks {
+		task := &run.Tasks[i]
+		if i > 0 && task.AttemptNumber <= s.latestAttempt {
+			continue
+		}
+		s.latestAttempt = task.AttemptNumber
+		s.latestTaskLifeCycleState = ""
+		if task.State != nil {
+			s.latestTaskLifeCycleState = string(task.State.LifeCycleState)
+		}
+	}
+	return s
+}
+
+// classifyLogError maps a Bricklens failure to one of:
+//   - errBricklensFeatureDisabled: fall back to MLflow (gated off, endpoint
+//     absent, or 404).
+//   - the original error: a genuine not-found, surfaced as-is.
+//   - nil: a transient failure the caller should retry.
+func classifyLogError(err error) error {
+	if apiErr, ok := errors.AsType[*apierr.APIError](err); ok {
+		switch apiErr.ErrorCode {
+		case "FEATURE_DISABLED", "ENDPOINT_NOT_FOUND":
+			return errBricklensFeatureDisabled
+		}
+		if apiErr.StatusCode == http.StatusNotFound {
+			return errBricklensFeatureDisabled
+		}
+	}
+	if errors.Is(err, apierr.ErrResourceDoesNotExist) {
+		return err
+	}
+	return nil
+}
+
+// fromSeconds computes the `from` bound. With --minutes set it is now-N*60;
+// otherwise the run's start second (0 before the run starts, which the endpoint
+// reads as "everything stored").
+func (req logRequest) fromSeconds(status logRunStatus, now time.Time) int64 {
+	if req.windowMinutes > 0 {
+		return now.Add(-time.Duration(req.windowMinutes) * time.Minute).Unix()
+	}
+	if status.startTimeMs > 0 {
+		return status.startTimeMs / 1000
+	}
+	return 0
+}
+
+// toSeconds computes the `to` bound. A terminal run caps at its end second (ceil
+// of the millisecond time, so the final partial second is kept); otherwise 0 lets
+// the endpoint default to now.
+func (req logRequest) toSeconds(status logRunStatus) int64 {
+	if status.terminal() && status.endTimeMs > 0 {
+		return (status.endTimeMs + 999) / 1000
+	}
+	return 0
+}
+
+// streamBricklensLogs fetches and prints a run's logs: a bounded tail for a
+// completed run, or a poll-and-drain loop that follows an active run to
+// completion. It returns whether the run finished with SUCCESS;
+// errBricklensFeatureDisabled means the caller should fall back to MLflow.
+func streamBricklensLogs(ctx context.Context, w *databricks.WorkspaceClient, out io.Writer, req logRequest, status logRunStatus) (bool, error) {
+	// Build the API client once and reuse it for every page fetch in the loop.
+	apiClient, err := client.New(w.Config)
+	if err != nil {
+		return false, fmt.Errorf("failed to create API client: %w", err)
+	}
+	st := &bricklensStreamer{
+		ctx:       ctx,
+		w:         w,
+		apiClient: apiClient,
+		headers:   auth.WorkspaceIDHeaders(w.Config),
+		out:       out,
+		req:       req,
+		status:    status,
+		seen:      newSeenSet(seenRecordsCap),
+	}
+	return st.run()
+}
+
+// bricklensStreamer holds the poll-loop state: the from-second cursor, the
+// highest emitted timestamp, and the dedup set.
+type bricklensStreamer struct {
+	ctx       context.Context
+	w         *databricks.WorkspaceClient
+	apiClient *client.DatabricksClient
+	headers   map[string]string
+	out       io.Writer
+	req       logRequest
+	status    logRunStatus
+
+	fromSec        int64
+	streamStartSec int64
+	lastNano       int64
+	firstLogSeen   bool
+	seen           *seenSet
+	// previousState is the last display state reported to onStatusChange.
+	previousState string
+	// onFirstLog, when set, is called once just before the first log line is
+	// emitted — used to stop the "waiting for run to start" spinner before any
+	// log byte reaches stdout.
+	onFirstLog func()
+	// updateSpinner, when set, refreshes the waiting-spinner text each poll.
+	updateSpinner func(string)
+}
+
+// waitingSpinnerText returns the waiting-spinner text: the server-set STATUS
+// message if present, else the compute-capacity message for a PENDING run, else
+// the default "waiting for run to start".
+func (st *bricklensStreamer) waitingSpinnerText() string {
+	if msg := st.serverStatusMessage(); msg != "" {
+		return msg
+	}
+	if st.status.waitingForCompute() {
+		return waitingForComputeStatus
+	}
+	return fmt.Sprintf("Waiting for run to start (node %d)...", st.req.node)
+}
+
+// serverStatusMessage returns the run's server-set STATUS message (normalized for
+// display), or "" if unavailable. The message lives on the latest task run's
+// output, re-resolved each call so a retry's new task run is picked up.
+// Best-effort: any fetch failure logs at debug and returns "".
+func (st *bricklensStreamer) serverStatusMessage() string {
+	run, err := st.w.Jobs.GetRun(st.ctx, jobs.GetRunRequest{RunId: st.req.runID})
+	if err != nil || len(run.Tasks) == 0 {
+		return ""
+	}
+	taskRunID := run.Tasks[len(run.Tasks)-1].RunId
+	out, err := st.w.Jobs.GetRunOutputByRunId(st.ctx, taskRunID)
+	if err != nil {
+		log.Debugf(st.ctx, "air logs: status_message fetch failed for run %d: %v", st.req.runID, err)
+		return ""
+	}
+	if out.AiRuntimeTaskOutput == nil {
+		return ""
+	}
+	return normalizeStatusMessage(out.AiRuntimeTaskOutput.StatusMessage)
+}
+
+// reportStatusChange fires onStatusChange when the run's display state differs
+// from the last reported one.
+func (st *bricklensStreamer) reportStatusChange() {
+	if st.req.onStatusChange == nil {
+		return
+	}
+	current := st.status.displayState()
+	if current == st.previousState {
+		return
+	}
+	st.req.onStatusChange(current, st.previousState)
+	st.previousState = current
+}
+
+func (st *bricklensStreamer) run() (bool, error) {
+	now := time.Now()
+	st.fromSec = st.req.fromSeconds(st.status, now)
+	st.streamStartSec = st.fromSec
+
+	// A past retry's logs are immutable: render a one-shot tail rather than
+	// following the still-active run, which would poll forever.
+	if st.req.staticView {
+		return st.drainStatic(st.req.toSeconds(st.status))
+	}
+
+	// Show a "waiting for run to start" spinner on stderr while the run has not
+	// yet produced logs, so a provisioning run doesn't look hung. Suppressed in
+	// --json mode and auto-degraded to nothing on a non-interactive terminal.
+	// The first emitted log line stops it via onFirstLog (before any stdout write).
+	if !st.req.jsonOutput {
+		sp := cmdio.NewSpinner(st.ctx)
+		defer sp.Close()
+		st.onFirstLog = sp.Close
+		st.updateSpinner = sp.Update
+	}
+
+	firstIteration := true
+	// Throttled refresh of the waiting-spinner text: statusRefreshCounter gates the
+	// server status_message fetch to every Nth poll, and lastSpinnerText avoids
+	// redundant spinner updates.
+	statusRefreshCounter := 0
+	emptyStreamPolls := 0
+	terminalEmptyPolls := 0
+	lastSpinnerText := ""
+	for {
+		pollStarted := time.Now()
+		if !firstIteration {
+			status, err := resolveRunStatus(st.ctx, st.w, st.req.runID)
+			if err != nil {
+				if errors.Is(err, apierr.ErrResourceDoesNotExist) {
+					return false, err
+				}
+				// A cancelled context (Ctrl-C) is not a transient blip: stop
+				// promptly instead of retrying forever.
+				if st.ctx.Err() != nil {
+					return false, st.ctx.Err()
+				}
+				// A transient status blip should not abort a live stream.
+				log.Debugf(st.ctx, "air logs: failed to refresh run status: %v", err)
+				if err := sleepOrCancel(st.ctx, retryCheckInterval); err != nil {
+					return false, err
+				}
+				continue
+			}
+			st.status = status
+		}
+
+		st.reportStatusChange()
+		st.req.reportRetry(st.ctx, st.out, st.status, st.onFirstLog)
+
+		terminal := st.status.terminal()
+		toSec := st.req.toSeconds(st.status)
+
+		// While waiting on a still-active run with no logs yet, refresh the spinner
+		// with the server-set status (throttled), so a run stuck waiting for compute
+		// shows why rather than a generic "waiting" message.
+		if !terminal && !st.firstLogSeen && st.updateSpinner != nil {
+			if statusRefreshCounter%statusMessageRefreshEveryNPolls == 0 {
+				if desired := st.waitingSpinnerText(); desired != lastSpinnerText {
+					st.updateSpinner(desired)
+					lastSpinnerText = desired
+				}
+			}
+			statusRefreshCounter++
+		}
+
+		// `air logs` starts an active attachment with a bounded tail; subsequent
+		// polls follow live with dedup so the overlap does not re-print it.
+		var emitted int
+		var err error
+		if firstIteration && (terminal || st.req.boundInitialLogs) {
+			err = st.drainTail(toSec, !terminal)
+			if err == nil && !terminal {
+				// Baseline omitted history without suppressing newer records.
+				_, err = st.drainPages(toSec, true)
+			}
+		} else {
+			emitted, err = st.drainPages(toSec, false)
+		}
+		if err != nil {
+			return false, err
+		}
+
+		if terminal {
+			if !firstIteration {
+				if emitted == 0 {
+					terminalEmptyPolls++
+				} else {
+					terminalEmptyPolls = 0
+				}
+				if terminalEmptyPolls < bricklensTerminalEmptyPolls {
+					if err := waitForNextBricklensPoll(st.ctx, pollStarted); err != nil {
+						return false, err
+					}
+					firstIteration = false
+					continue
+				}
+			}
+			if !st.firstLogSeen {
+				// A successful but empty Bricklens stream isn't proof the run has no
+				// logs; they may be in MLflow (as --download-to reads). Fall back
+				// there, which owns the real no-logs report and the same exit code.
+				return false, errBricklensFeatureDisabled
+			}
+			log.Infof(st.ctx, "air logs: run %d finished in state %s", st.req.runID, st.status.displayState())
+			return st.status.succeeded(), nil
+		}
+		if !st.firstLogSeen {
+			emptyStreamPolls++
+			if emptyStreamPolls%bricklensEmptyMLflowProbeEveryNPolls == 0 && mlflowLogsExist(st.ctx, st.w, st.req) {
+				log.Debugf(st.ctx, "air logs: MLflow artifacts exist for run %d; falling back to MLflow log stream", st.req.runID)
+				return false, errBricklensFeatureDisabled
+			}
+		}
+
+		firstIteration = false
+		if err := waitForNextBricklensPoll(st.ctx, pollStarted); err != nil {
+			return false, err
+		}
+	}
+}
+
+func waitForNextBricklensPoll(ctx context.Context, pollStarted time.Time) error {
+	return sleepOrCancel(ctx, max(time.Duration(0), bricklensPollInterval-time.Since(pollStarted)))
+}
+
+// sleepOrCancel waits for d, or returns early with the context error if the
+// context is cancelled (e.g. Ctrl-C) so the poll loop exits promptly.
+func sleepOrCancel(ctx context.Context, d time.Duration) error {
+	timer := time.NewTimer(d)
+	defer timer.Stop()
+	select {
+	case <-ctx.Done():
+		return ctx.Err()
+	case <-timer.C:
+		return nil
+	}
+}
+
+// drainStatic renders a single tail pass without following the run. Success
+// reflects the run's current result state (empty while active).
+func (st *bricklensStreamer) drainStatic(toSec int64) (bool, error) {
+	if err := st.drainTail(toSec, false); err != nil {
+		return false, err
+	}
+	if !st.firstLogSeen {
+		// An empty Bricklens tail doesn't mean the attempt has no logs; fall back to
+		// MLflow, which holds the immutable per-attempt artifacts. See the terminal
+		// branch in run.
+		return false, errBricklensFeatureDisabled
+	}
+	return st.status.downloadOutcome(), nil
+}
+
+// tailTarget is the number of lines a tail keeps. A negative tailLines means
+// --tail was unset, so use the default cap; 0 or more is taken literally (an
+// explicit --tail 0 prints no log lines).
+func (req logRequest) tailTarget() int {
+	if req.tailLines < 0 {
+		return defaultCompletedRunTailLines
+	}
+	return req.tailLines
+}
+
+// drainTail emits the most-recent `target` records oldest-first. Bricklens
+// returns records newest-first, so it pages until it has `target`, keeps the
+// newest `target`, and reverses to chronological order.
+func (st *bricklensStreamer) drainTail(toSec int64, remember bool) error {
+	target := st.req.tailTarget()
+	if target <= 0 {
+		return nil
+	}
+
+	var collected []logRecord
+	var pageToken string
+	for len(collected) < target {
+		resp, err := st.requestPage(pageToken, toSec, target, false)
+		if err != nil {
+			return err
+		}
+		collected = append(collected, resp.LogRecords...)
+		pageToken = resp.NextPageToken
+		if pageToken == "" {
+			break
+		}
+	}
+
+	// Keep the newest `target`, then reverse to print oldest -> newest.
+	if len(collected) > target {
+		collected = collected[:target]
+	}
+	for _, c := range slices.Backward(collected) {
+		st.emit(c.Body)
+		if remember {
+			st.seen.add(c)
+			st.lastNano = max(st.lastNano, c.nano())
+		}
+	}
+	if remember && st.lastNano != 0 {
+		st.fromSec = max(st.streamStartSec, st.lastNano/1_000_000_000-int64(bricklensLogLookback/time.Second))
+	}
+	return nil
+}
+
+// drainPages exhausts all pages from the current from-second in ascending order.
+// Live polls retain a bounded overlap so late records remain visible. The
+// initial baseline suppresses omitted history through the tail's watermark.
+func (st *bricklensStreamer) drainPages(toSec int64, suppressInitialHistory bool) (int, error) {
+	emitted := 0
+	initialTailNano := st.lastNano
+	var maximumEvictedNano int64
+	var pageToken string
+	for {
+		resp, err := st.requestPage(pageToken, toSec, 0, true)
+		if err != nil {
+			return 0, err
+		}
+
+		for _, rec := range resp.LogRecords {
+			nano := rec.nano()
+			if st.seen.has(rec) {
+				continue
+			}
+			if !suppressInitialHistory || (nano != 0 && nano > initialTailNano) {
+				st.emit(rec.Body)
+				emitted++
+			}
+			maximumEvictedNano = max(maximumEvictedNano, st.seen.add(rec))
+			if nano != 0 {
+				st.lastNano = max(st.lastNano, nano)
+			}
+		}
+
+		pageToken = resp.NextPageToken
+		if pageToken == "" {
+			break
+		}
+	}
+
+	if st.lastNano != 0 {
+		st.fromSec = max(st.streamStartSec, st.lastNano/1_000_000_000-int64(bricklensLogLookback/time.Second))
+		st.seen.removeBefore(st.fromSec * 1_000_000_000)
+		if maximumEvictedNano != 0 {
+			st.fromSec = max(st.fromSec, maximumEvictedNano/1_000_000_000+1)
+		}
+	}
+	return emitted, nil
+}
+
+// requestPage fetches one page, retrying transient failures up to
+// maxTransientFailures before falling back to MLflow. A feature-gated response or
+// genuine not-found returns immediately.
+func (st *bricklensStreamer) requestPage(pageToken string, toSec int64, pageSize int, ascending bool) (*bricklensLogsResponse, error) {
+	q := bricklensLogsQuery{
+		fromSeconds:   st.fromSec,
+		toSeconds:     toSec,
+		pageToken:     pageToken,
+		pageSize:      pageSize,
+		attemptNumber: st.req.attempt,
+		nodeIndex:     st.req.node,
+		ascending:     ascending,
+	}
+
+	transientFailures := 0
+	for {
+		resp, err := getBricklensLogs(st.ctx, st.apiClient, st.headers, st.req.runID, q)
+		if err == nil {
+			return resp, nil
+		}
+
+		switch classified := classifyLogError(err); {
+		case errors.Is(classified, errBricklensFeatureDisabled):
+			return nil, errBricklensFeatureDisabled
+		case classified != nil:
+			return nil, classified
+		}
+
+		transientFailures++
+		if transientFailures >= maxTransientFailures {
+			log.Debugf(st.ctx, "air logs: bricklens failed %d times; falling back to mlflow", maxTransientFailures)
+			return nil, errBricklensFeatureDisabled
+		}
+		log.Debugf(st.ctx, "air logs: bricklens transient failure (%d/%d): %v", transientFailures, maxTransientFailures, err)
+		if err := sleepOrCancel(st.ctx, retryCheckInterval); err != nil {
+			return nil, err
+		}
+	}
+}
+
+// emit writes one log line and latches firstLogSeen so an empty terminal run can
+// report "no logs". The first line stops the waiting spinner before any byte
+// reaches stdout.
+func (st *bricklensStreamer) emit(body string) {
+	if !st.firstLogSeen && st.onFirstLog != nil {
+		st.onFirstLog()
+	}
+	st.firstLogSeen = true
+	emitLogLine(st.out, st.req, body)
+}
+
+// displayState is the result state, else the lifecycle state, else "UNKNOWN".
+func (s logRunStatus) displayState() string {
+	if s.resultState != "" {
+		return s.resultState
+	}
+	if s.lifeCycleState != "" {
+		return s.lifeCycleState
+	}
+	return "UNKNOWN"
+}
diff --git a/cmd/air/logstream_support.go b/cmd/air/logstream_support.go
new file mode 100644
index 00000000000..69896f71c3c
--- /dev/null
+++ b/cmd/air/logstream_support.go
@@ -0,0 +1,242 @@
+package aircmd
+
+import (
+	"container/list"
+	"encoding/json"
+	"fmt"
+	"io"
+	"strings"
+	"time"
+)
+
+// seenRecord keys the dedup set. Older responses without record IDs fall back
+// to timestamp and body, since distinct lines can share a timestamp.
+type seenRecord struct {
+	recordID string
+	nano     int64
+	body     string
+}
+
+type seenEntry struct {
+	key  seenRecord
+	nano int64
+}
+
+// seenSet is an insertion-ordered set bounded to a capacity, evicting the
+// oldest-inserted entry first.
+type seenSet struct {
+	cap   int
+	items map[seenRecord]*list.Element
+	order *list.List
+}
+
+func newSeenSet(capacity int) *seenSet {
+	return &seenSet{
+		cap:   capacity,
+		items: make(map[seenRecord]*list.Element),
+		order: list.New(),
+	}
+}
+
+func seenRecordKey(record logRecord) seenRecord {
+	if record.RecordID != "" {
+		return seenRecord{recordID: record.RecordID}
+	}
+	return seenRecord{nano: record.nano(), body: record.Body}
+}
+
+func (s *seenSet) has(record logRecord) bool {
+	_, ok := s.items[seenRecordKey(record)]
+	return ok
+}
+
+func (s *seenSet) add(record logRecord) int64 {
+	key := seenRecordKey(record)
+	if _, ok := s.items[key]; ok {
+		return 0
+	}
+	s.items[key] = s.order.PushBack(seenEntry{key: key, nano: record.nano()})
+	if s.order.Len() > s.cap {
+		oldest := s.order.Front()
+		s.order.Remove(oldest)
+		evicted := oldest.Value.(seenEntry)
+		delete(s.items, evicted.key)
+		return evicted.nano
+	}
+	return 0
+}
+
+func (s *seenSet) removeBefore(nano int64) {
+	for element := s.order.Front(); element != nil; {
+		next := element.Next()
+		entry := element.Value.(seenEntry)
+		if entry.nano != 0 && entry.nano < nano {
+			s.order.Remove(element)
+			delete(s.items, entry.key)
+		}
+		element = next
+	}
+}
+
+// logEvent is one JSONL streaming event.
+type logEvent struct {
+	Type string `json:"type"`
+	TS   string `json:"ts"`
+	Node int    `json:"node"`
+	Line string `json:"line"`
+}
+
+// printLogEvent writes a single JSONL event line for --json streaming output.
+func printLogEvent(out io.Writer, eventType string, node int, line string) {
+	b, err := json.Marshal(logEvent{
+		Type: eventType,
+		TS:   time.Now().UTC().Format(time.RFC3339),
+		Node: node,
+		Line: line,
+	})
+	if err != nil {
+		return
+	}
+	fmt.Fprintln(out, string(b))
+}
+
+type retryEvent struct {
+	Type       string `json:"type"`
+	TS         string `json:"ts"`
+	Retry      int    `json:"retry"`
+	MaxRetries *int   `json:"max_retries,omitempty"`
+}
+
+func printRetryEvent(out io.Writer, retry int, maxRetries *int) {
+	b, err := json.Marshal(retryEvent{
+		Type:       "RETRY",
+		TS:         time.Now().UTC().Format(time.RFC3339),
+		Retry:      retry,
+		MaxRetries: maxRetries,
+	})
+	if err != nil {
+		return
+	}
+	fmt.Fprintln(out, string(b))
+}
+
+// submittedEvent is the JSONL event `air run --watch -o json` emits before the
+// streamed log events, so a consumer sees the run id immediately.
+type submittedEvent struct {
+	Type         string `json:"type"`
+	TS           string `json:"ts"`
+	RunID        string `json:"run_id"`
+	DashboardURL string `json:"dashboard_url"`
+}
+
+// printSubmittedEvent writes the SUBMITTED JSONL event.
+func printSubmittedEvent(out io.Writer, runID, dashboardURL string) {
+	b, err := json.Marshal(submittedEvent{
+		Type:         "SUBMITTED",
+		TS:           time.Now().UTC().Format(time.RFC3339),
+		RunID:        runID,
+		DashboardURL: dashboardURL,
+	})
+	if err != nil {
+		return
+	}
+	fmt.Fprintln(out, string(b))
+}
+
+// statusEvent is a JSONL event emitted on each lifecycle transition while
+// following a run with --watch.
+type statusEvent struct {
+	Type     string `json:"type"`
+	TS       string `json:"ts"`
+	Status   string `json:"status"`
+	Previous string `json:"previous_status,omitempty"`
+}
+
+// printStatusEvent writes a STATUS JSONL event for a lifecycle transition.
+func printStatusEvent(out io.Writer, current, previous string) {
+	b, err := json.Marshal(statusEvent{
+		Type:     "STATUS",
+		TS:       time.Now().UTC().Format(time.RFC3339),
+		Status:   current,
+		Previous: previous,
+	})
+	if err != nil {
+		return
+	}
+	fmt.Fprintln(out, string(b))
+}
+
+// terminalEvent is the closing envelope `air run --watch -o json` emits after
+// streaming, carrying the run's terminal status.
+type terminalEvent struct {
+	V    int       `json:"v"`
+	TS   string    `json:"ts"`
+	Data runResult `json:"data"`
+}
+
+// printTerminalEvent writes the closing terminal-status envelope, matching the
+// shape of renderEnvelope(runResult).
+func printTerminalEvent(out io.Writer, runID, status, dashboardURL string) {
+	b, err := json.Marshal(terminalEvent{
+		V:  envelopeVersion,
+		TS: time.Now().UTC().Format(time.RFC3339),
+		Data: runResult{
+			Status:       status,
+			RunID:        runID,
+			DashboardURL: dashboardURL,
+		},
+	})
+	if err != nil {
+		return
+	}
+	fmt.Fprintln(out, string(b))
+}
+
+const (
+	missingRequirementsNoticePrefix = "No co-located requirements.yaml at "
+	missingRequirementsNoticeSuffix = "; skipping requirements.yaml install."
+)
+
+// suppressLogLine reports whether a backend log line should be omitted.
+func suppressLogLine(body string) bool {
+	// This backend-derived notice is non-actionable noise because requirements.yaml
+	// is not supported by Databricks Air and is rejected earlier.
+	return strings.HasPrefix(body, missingRequirementsNoticePrefix) &&
+		strings.HasSuffix(body, missingRequirementsNoticeSuffix)
+}
+
+// emitLogLine writes one relevant log line.
+func emitLogLine(out io.Writer, req logRequest, body string) {
+	if suppressLogLine(body) {
+		return
+	}
+	if !req.jsonOutput {
+		fmt.Fprintln(out, body)
+		return
+	}
+	if matchFatalPattern(body) {
+		printLogEvent(out, "ALERT", req.node, body)
+	}
+	printLogEvent(out, "LOG", req.node, body)
+}
+
+// emitNoLogs reports that a run produced no logs. A terminal run gets its
+// termination reason; a still-active run is reported as having no logs yet,
+// since the MLflow fallback is a one-shot that does not follow it to completion.
+// Under --json it is a JSONL ERROR, so a consumer never sees an empty stream.
+func emitNoLogs(out io.Writer, req logRequest, status logRunStatus) {
+	var msg string
+	if status.terminal() {
+		msg = fmt.Sprintf("No logs available for run %d. Run terminated in state %s", req.runID, status.displayState())
+	} else {
+		msg = fmt.Sprintf("No logs available yet for run %d, which is still in state %s", req.runID, status.displayState())
+	}
+	if status.stateMessage != "" {
+		msg = fmt.Sprintf("%s: %s", msg, status.stateMessage)
+	}
+	if req.jsonOutput {
+		printLogEvent(out, "ERROR", req.node, msg)
+		return
+	}
+	fmt.Fprintln(out, msg)
+}
diff --git a/cmd/air/logstream_test.go b/cmd/air/logstream_test.go
new file mode 100644
index 00000000000..fe0756d3862
--- /dev/null
+++ b/cmd/air/logstream_test.go
@@ -0,0 +1,806 @@
+package aircmd
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/client"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestClassifyLogError(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want error // errBricklensFeatureDisabled, the input error, or nil
+	}{
+		{
+			name: "feature disabled falls back",
+			err:  &apierr.APIError{ErrorCode: "FEATURE_DISABLED", StatusCode: http.StatusForbidden},
+			want: errBricklensFeatureDisabled,
+		},
+		{
+			name: "endpoint not found falls back",
+			err:  &apierr.APIError{ErrorCode: "ENDPOINT_NOT_FOUND", StatusCode: http.StatusNotFound},
+			want: errBricklensFeatureDisabled,
+		},
+		{
+			name: "bare 404 falls back",
+			err:  &apierr.APIError{ErrorCode: "SOMETHING", StatusCode: http.StatusNotFound},
+			want: errBricklensFeatureDisabled,
+		},
+		{
+			name: "genuine resource-does-not-exist surfaces",
+			err:  apierr.ErrResourceDoesNotExist,
+			want: apierr.ErrResourceDoesNotExist,
+		},
+		{
+			name: "transient 500 is retried",
+			err:  &apierr.APIError{ErrorCode: "INTERNAL", StatusCode: http.StatusInternalServerError},
+			want: nil,
+		},
+		{
+			name: "plain error is retried",
+			err:  errors.New("connection reset"),
+			want: nil,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := classifyLogError(tt.err)
+			switch {
+			case errors.Is(tt.want, errBricklensFeatureDisabled):
+				assert.ErrorIs(t, got, errBricklensFeatureDisabled)
+			case tt.want == nil:
+				assert.NoError(t, got)
+			default:
+				assert.ErrorIs(t, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestProjectRunStatus(t *testing.T) {
+	run := &jobs.Run{
+		StartTime: 1000,
+		EndTime:   2000,
+		State: &jobs.RunState{
+			LifeCycleState: jobs.RunLifeCycleStateTerminated,
+			ResultState:    jobs.RunResultStateSuccess,
+			StateMessage:   "done",
+		},
+		Tasks: []jobs.RunTask{
+			{AttemptNumber: 0, State: &jobs.RunState{LifeCycleState: jobs.RunLifeCycleStateQueued}},
+			{AttemptNumber: 2, State: &jobs.RunState{LifeCycleState: jobs.RunLifeCycleStateWaitingForRetry}},
+			{AttemptNumber: 1},
+		},
+	}
+
+	s := projectRunStatus(run)
+	assert.Equal(t, "TERMINATED", s.lifeCycleState)
+	assert.Equal(t, "SUCCESS", s.resultState)
+	assert.Equal(t, "done", s.stateMessage)
+	assert.Equal(t, "WAITING_FOR_RETRY", s.latestTaskLifeCycleState)
+	assert.Equal(t, int64(1000), s.startTimeMs)
+	assert.Equal(t, int64(2000), s.endTimeMs)
+	assert.Equal(t, 2, s.latestAttempt)
+	assert.True(t, s.terminal())
+	assert.True(t, s.succeeded())
+	assert.Equal(t, "SUCCESS", s.displayState())
+}
+
+func TestRetryTrackerDeduplicatesWaitingAndAttemptIncrease(t *testing.T) {
+	tracker := newRetryTracker(logRunStatus{latestAttempt: 0})
+
+	retry, ok := tracker.observe(logRunStatus{
+		latestAttempt:            0,
+		latestTaskLifeCycleState: string(jobs.RunLifeCycleStateWaitingForRetry),
+	})
+	assert.True(t, ok)
+	assert.Equal(t, 1, retry)
+
+	_, ok = tracker.observe(logRunStatus{
+		latestAttempt:            1,
+		latestTaskLifeCycleState: string(jobs.RunLifeCycleStateWaitingForRetry),
+	})
+	assert.False(t, ok)
+}
+
+func TestRetryTrackerDetectsAttemptCreatedInWaitingState(t *testing.T) {
+	tracker := newRetryTracker(logRunStatus{latestAttempt: 0})
+	waiting := logRunStatus{
+		latestAttempt:            1,
+		latestTaskLifeCycleState: string(jobs.RunLifeCycleStateWaitingForRetry),
+	}
+
+	retry, ok := tracker.observe(waiting)
+	assert.True(t, ok)
+	assert.Equal(t, 1, retry)
+
+	_, ok = tracker.observe(waiting)
+	assert.False(t, ok)
+}
+
+func TestRetryTrackerDetectsMissedWaitingState(t *testing.T) {
+	tracker := newRetryTracker(logRunStatus{latestAttempt: 0})
+
+	retry, ok := tracker.observe(logRunStatus{latestAttempt: 1})
+	assert.True(t, ok)
+	assert.Equal(t, 1, retry)
+}
+
+func TestReportRetryText(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	ctx := cmdio.InContext(t.Context(), cmdio.NewIO(t.Context(), flags.OutputText, nil, &stdout, &stderr, "", ""))
+	maxRetries := 3
+	req := logRequest{retryTracker: newRetryTracker(logRunStatus{latestAttempt: 0}), maxRetries: &maxRetries}
+	stopped := false
+
+	req.reportRetry(ctx, &stdout, logRunStatus{
+		latestAttempt:            0,
+		latestTaskLifeCycleState: string(jobs.RunLifeCycleStateWaitingForRetry),
+	}, func() { stopped = true })
+
+	assert.True(t, stopped)
+	assert.Empty(t, stdout.String())
+	assert.Equal(t, "\nRetrying (1 of 3)...\n\n", stderr.String())
+}
+
+func TestLogRunStatusTerminal(t *testing.T) {
+	tests := []struct {
+		name         string
+		lifeCycle    string
+		resultState  string
+		wantTerminal bool
+	}{
+		{"running", "RUNNING", "", false},
+		{"pending", "PENDING", "", false},
+		{"terminated lifecycle", "TERMINATED", "", true},
+		{"internal error lifecycle", "INTERNAL_ERROR", "", true},
+		{"failed result", "TERMINATING", "FAILED", true},
+		{"timed out result", "RUNNING", "TIMEDOUT", true},
+		{"canceled result", "RUNNING", "CANCELED", true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			s := logRunStatus{lifeCycleState: tt.lifeCycle, resultState: tt.resultState}
+			assert.Equal(t, tt.wantTerminal, s.terminal())
+		})
+	}
+}
+
+func TestLogRequestFromSeconds(t *testing.T) {
+	now := time.Unix(10_000, 0)
+
+	// --minutes narrows the window to now - N*60.
+	req := logRequest{windowMinutes: 5}
+	assert.Equal(t, int64(10_000-300), req.fromSeconds(logRunStatus{startTimeMs: 1_000_000}, now))
+
+	// No window: from the run's start second.
+	req = logRequest{}
+	assert.Equal(t, int64(1000), req.fromSeconds(logRunStatus{startTimeMs: 1_000_000}, now))
+
+	// No window, run not started: everything stored (0).
+	assert.Equal(t, int64(0), req.fromSeconds(logRunStatus{}, now))
+}
+
+func TestLogRequestToSeconds(t *testing.T) {
+	req := logRequest{}
+
+	// Active run: 0 lets the endpoint default to now.
+	assert.Equal(t, int64(0), req.toSeconds(logRunStatus{lifeCycleState: "RUNNING"}))
+
+	// Terminal run: ceil of the end millisecond so the final partial second is kept.
+	terminal := logRunStatus{lifeCycleState: "TERMINATED", resultState: "SUCCESS", endTimeMs: 2001}
+	assert.Equal(t, int64(3), req.toSeconds(terminal))
+}
+
+func TestLogRequestTailTarget(t *testing.T) {
+	// Negative (unset) uses the default cap; explicit values are literal.
+	assert.Equal(t, defaultCompletedRunTailLines, logRequest{tailLines: -1}.tailTarget())
+	assert.Equal(t, 42, logRequest{tailLines: 42}.tailTarget())
+	assert.Equal(t, 0, logRequest{tailLines: 0}.tailTarget())
+}
+
+func TestDrainPagesDedupAndOrdering(t *testing.T) {
+	// Two pages: page 1 has two ascending records; page 2 repeats the last record
+	// of page 1 (boundary re-query — must dedup), a late record, and a newer one.
+	var page int
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Query().Get("page_token") == "" {
+			page = 1
+			_, _ = w.Write([]byte(`{"log_records": [
+				{"time_unix_nano": 1000, "body": "a", "node_index": 0},
+				{"time_unix_nano": 2000, "body": "b", "node_index": 0}
+			], "next_page_token": "p2"}`))
+			return
+		}
+		page = 2
+		_, _ = w.Write([]byte(`{"log_records": [
+			{"time_unix_nano": 2000, "body": "b", "node_index": 0},
+			{"time_unix_nano": 1500, "body": "stale", "node_index": 0},
+			{"time_unix_nano": 3000, "body": "c", "node_index": 0}
+		]}`))
+	}))
+	t.Cleanup(srv.Close)
+
+	var buf bytes.Buffer
+	w := newTestWorkspaceClient(t, srv.URL)
+	apiClient, err := client.New(w.Config)
+	require.NoError(t, err)
+	st := &bricklensStreamer{
+		ctx:       t.Context(),
+		w:         w,
+		apiClient: apiClient,
+		out:       &buf,
+		req:       logRequest{runID: 1, node: 0, attempt: -1},
+		seen:      newSeenSet(seenRecordsCap),
+	}
+	_, err = st.drainPages(0, false)
+	require.NoError(t, err)
+	require.Equal(t, 2, page)
+
+	// "b" prints once while the late record remains visible.
+	assert.Equal(t, "a\nb\nstale\nc\n", buf.String())
+	assert.Equal(t, int64(3000), st.lastNano)
+}
+
+func TestDrainPagesEmitsLateRecordsWithinLookback(t *testing.T) {
+	var requests int
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if !strings.HasSuffix(r.URL.Path, "/logs") {
+			_, _ = w.Write([]byte(`{}`))
+			return
+		}
+		requests++
+		if requests == 1 {
+			assert.Equal(t, "10", r.URL.Query().Get("from"))
+			_, _ = w.Write([]byte(`{"log_records":[
+				{"record_id":"first","time_unix_nano":50000000000,"body":"same"},
+				{"record_id":"second","time_unix_nano":50000000000,"body":"same"},
+				{"record_id":"untimed","body":"untimed"}
+			]}`))
+			return
+		}
+		assert.Equal(t, "20", r.URL.Query().Get("from"))
+		_, _ = w.Write([]byte(`{"log_records":[
+			{"record_id":"late","time_unix_nano":30000000000,"body":"late"},
+			{"record_id":"first","time_unix_nano":51000000000,"body":"same"},
+			{"record_id":"second","time_unix_nano":51000000000,"body":"same"},
+			{"record_id":"untimed","body":"untimed"}
+		]}`))
+	}))
+	t.Cleanup(srv.Close)
+
+	var buf bytes.Buffer
+	w := newTestWorkspaceClient(t, srv.URL)
+	apiClient, err := client.New(w.Config)
+	require.NoError(t, err)
+	st := &bricklensStreamer{
+		ctx:            t.Context(),
+		w:              w,
+		apiClient:      apiClient,
+		out:            &buf,
+		req:            logRequest{runID: 1, node: 0, attempt: -1},
+		fromSec:        10,
+		streamStartSec: 10,
+		seen:           newSeenSet(seenRecordsCap),
+	}
+
+	_, err = st.drainPages(0, false)
+	require.NoError(t, err)
+	_, err = st.drainPages(0, false)
+	require.NoError(t, err)
+	assert.Equal(t, "same\nsame\nuntimed\nlate\n", buf.String()) //nolint:dupword
+}
+
+func TestStreamBricklensWaitsForLateTerminalRecords(t *testing.T) {
+	original := bricklensPollInterval
+	bricklensPollInterval = time.Millisecond
+	t.Cleanup(func() { bricklensPollInterval = original })
+
+	var logRequests int
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case strings.HasSuffix(r.URL.Path, "/logs"):
+			logRequests++
+			switch logRequests {
+			case 1:
+				assert.Equal(t, "2", r.URL.Query().Get("page_size"))
+				assert.Equal(t, "false", r.URL.Query().Get("ascending"))
+				_, _ = w.Write([]byte(`{"log_records":[
+					{"record_id":"third","time_unix_nano":50000000000,"body":"third"},
+					{"record_id":"second","time_unix_nano":40000000000,"body":"second"}
+				]}`))
+			case 2:
+				_, _ = w.Write([]byte(`{"log_records":[
+					{"record_id":"first","time_unix_nano":30000000000,"body":"first"},
+					{"record_id":"second","time_unix_nano":40000000000,"body":"second"},
+					{"record_id":"third","time_unix_nano":50000000000,"body":"third"},
+					{"record_id":"fourth","time_unix_nano":60000000000,"body":"fourth"}
+				]}`))
+			case 3:
+				_, _ = w.Write([]byte(`{"log_records":[
+					{"record_id":"late","time_unix_nano":30000000000,"body":"late"},
+					{"record_id":"second","time_unix_nano":40000000000,"body":"second"},
+					{"record_id":"third","time_unix_nano":50000000000,"body":"third"}
+				]}`))
+			default:
+				_, _ = w.Write([]byte(`{"log_records":[]}`))
+			}
+		case r.URL.Path == "/api/2.2/jobs/runs/get":
+			_, _ = w.Write([]byte(`{"run_id":1,"start_time":10000,"state":{"life_cycle_state":"TERMINATED","result_state":"SUCCESS"}}`))
+		default:
+			_, _ = w.Write([]byte(`{}`))
+		}
+	}))
+	t.Cleanup(srv.Close)
+
+	var buf bytes.Buffer
+	ok, err := streamBricklensLogs(t.Context(), newTestWorkspaceClient(t, srv.URL), &buf,
+		logRequest{runID: 1, node: 0, attempt: -1, tailLines: 2, boundInitialLogs: true, jsonOutput: true},
+		logRunStatus{lifeCycleState: "RUNNING", startTimeMs: 10_000})
+	require.NoError(t, err)
+	assert.True(t, ok)
+	assert.Equal(t, bricklensTerminalEmptyPolls+3, logRequests)
+	assert.Contains(t, buf.String(), `"line":"second"`)
+	assert.Contains(t, buf.String(), `"line":"third"`)
+	assert.Contains(t, buf.String(), `"line":"late"`)
+	assert.Contains(t, buf.String(), `"line":"fourth"`)
+	assert.NotContains(t, buf.String(), `"line":"first"`)
+}
+
+func TestDisplayState(t *testing.T) {
+	assert.Equal(t, "SUCCESS", logRunStatus{lifeCycleState: "TERMINATED", resultState: "SUCCESS"}.displayState())
+	assert.Equal(t, "RUNNING", logRunStatus{lifeCycleState: "RUNNING"}.displayState())
+	assert.Equal(t, "UNKNOWN", logRunStatus{}.displayState())
+}
+
+func TestNormalizeStatusMessage(t *testing.T) {
+	tests := []struct {
+		raw  string
+		want string
+	}{
+		{"STATUS: Waiting for GPU capacity.", "Waiting for GPU capacity..."},
+		{"STATUS:Waiting for GPU capacity", "Waiting for GPU capacity..."},
+		{"STATUS: Waiting for GPU compute capacity to become available", waitingForComputeStatus},
+		{"status: provisioning", "provisioning..."}, // type match is case-insensitive
+		{"STATUS: done...", "done..."},              // trailing dots collapse to one "..."
+		{"INFO: not a status", ""},                  // other type ignored
+		{"no type prefix", ""},
+		{"STATUS:", ""},    // empty payload
+		{"STATUS:   ", ""}, // whitespace-only payload
+		{"", ""},
+	}
+	for _, tt := range tests {
+		assert.Equal(t, tt.want, normalizeStatusMessage(tt.raw), "raw=%q", tt.raw)
+	}
+}
+
+func TestWaitingSpinnerText(t *testing.T) {
+	// A server that returns the run (with a task) and a STATUS-typed status_message.
+	newStreamer := func(t *testing.T, statusMessage, lifeCycle, latestTaskLifeCycle string) *bricklensStreamer {
+		t.Helper()
+		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			switch r.URL.Path {
+			case "/api/2.2/jobs/runs/get":
+				_, _ = w.Write([]byte(`{"run_id": 1, "tasks": [{"run_id": 2}]}`))
+			case "/api/2.2/jobs/runs/get-output":
+				_, _ = w.Write([]byte(`{"ai_runtime_task_output": {"status_message": ` + strconv.Quote(statusMessage) + `}}`))
+			default:
+				_, _ = w.Write([]byte(`{}`))
+			}
+		}))
+		t.Cleanup(srv.Close)
+		return &bricklensStreamer{
+			ctx:    t.Context(),
+			w:      newTestWorkspaceClient(t, srv.URL),
+			req:    logRequest{runID: 1, node: 0},
+			status: logRunStatus{lifeCycleState: lifeCycle, latestTaskLifeCycleState: latestTaskLifeCycle},
+		}
+	}
+
+	// Server STATUS message wins.
+	assert.Equal(t, "Waiting for GPU capacity...",
+		newStreamer(t, "STATUS: Waiting for GPU capacity", "PENDING", "").waitingSpinnerText())
+
+	// No status message + PENDING -> compute-capacity fallback.
+	assert.Equal(t, waitingForComputeStatus,
+		newStreamer(t, "", "PENDING", "").waitingSpinnerText())
+
+	for _, state := range []string{"PENDING", "QUEUED", "WAITING_FOR_RETRY", "BLOCKED"} {
+		assert.Equal(t, waitingForComputeStatus,
+			newStreamer(t, "", "RUNNING", state).waitingSpinnerText(), state)
+	}
+
+	// No status message + non-PENDING -> default "waiting for run to start".
+	assert.Equal(t, "Waiting for run to start (node 0)...",
+		newStreamer(t, "", "RUNNING", "RUNNING").waitingSpinnerText())
+	assert.Equal(t, "Waiting for run to start (node 0)...",
+		newStreamer(t, "", "RUNNING", "").waitingSpinnerText())
+	assert.Equal(t, "Waiting for run to start (node 0)...",
+		newStreamer(t, "", "TERMINATED", "PENDING").waitingSpinnerText())
+}
+
+func TestEmitLogLineJSON(t *testing.T) {
+	var buf bytes.Buffer
+	emitLogLine(&buf, logRequest{node: 2, jsonOutput: true}, "hello")
+
+	var ev logEvent
+	require.NoError(t, json.Unmarshal(buf.Bytes(), &ev))
+	assert.Equal(t, "LOG", ev.Type)
+	assert.Equal(t, 2, ev.Node)
+	assert.Equal(t, "hello", ev.Line)
+	assert.NotEmpty(t, ev.TS)
+}
+
+func TestPrintRetryEvent(t *testing.T) {
+	var buf bytes.Buffer
+	maxRetries := 3
+	printRetryEvent(&buf, 1, &maxRetries)
+
+	var ev retryEvent
+	require.NoError(t, json.Unmarshal(buf.Bytes(), &ev))
+	assert.Equal(t, "RETRY", ev.Type)
+	assert.Equal(t, 1, ev.Retry)
+	require.NotNil(t, ev.MaxRetries)
+	assert.Equal(t, 3, *ev.MaxRetries)
+	assert.NotEmpty(t, ev.TS)
+}
+
+func TestEmitLogLineText(t *testing.T) {
+	var buf bytes.Buffer
+	emitLogLine(&buf, logRequest{node: 0}, "hello")
+	assert.Equal(t, "hello\n", buf.String())
+}
+
+func TestEmitLogLineSuppressesMissingRequirementsNotice(t *testing.T) {
+	body := "No co-located requirements.yaml at /Workspace/Users/user/.air/cli_launch/run/requirements.yaml; skipping requirements.yaml install."
+
+	for _, req := range []logRequest{{node: 0}, {node: 0, jsonOutput: true}} {
+		var buf bytes.Buffer
+		emitLogLine(&buf, req, body)
+		assert.Empty(t, buf.String())
+	}
+}
+
+func TestSuppressLogLineKeepsRequirementsErrors(t *testing.T) {
+	assert.False(t, suppressLogLine("ERROR: requirements.yaml not found"))
+	assert.False(t, suppressLogLine("ERROR: Failed to process requirements.yaml"))
+}
+
+func TestEmitLogLineJSONFatalEmitsAlert(t *testing.T) {
+	var buf bytes.Buffer
+	emitLogLine(&buf, logRequest{node: 1, jsonOutput: true}, "CUDA out of memory")
+
+	// A fatal line emits an ALERT event before its LOG event.
+	lines := strings.Split(strings.TrimSpace(buf.String()), "\n")
+	require.Len(t, lines, 2)
+
+	var alert, logEv logEvent
+	require.NoError(t, json.Unmarshal([]byte(lines[0]), &alert))
+	require.NoError(t, json.Unmarshal([]byte(lines[1]), &logEv))
+	assert.Equal(t, "ALERT", alert.Type)
+	assert.Equal(t, "LOG", logEv.Type)
+	assert.Equal(t, "CUDA out of memory", alert.Line)
+
+	// Text mode never emits ALERT events.
+	var text bytes.Buffer
+	emitLogLine(&text, logRequest{node: 1}, "CUDA out of memory")
+	assert.Equal(t, "CUDA out of memory\n", text.String())
+}
+
+func TestMatchFatalPattern(t *testing.T) {
+	fatal := []string{
+		"CUDA out of memory",
+		"cuda OUT OF memory",
+		"Watchdog caught collective operation timeout",
+		"Killed",
+		"ERROR: Script failed with exit code 1 after 42s",
+		"bash: foo: command not found",
+	}
+	for _, l := range fatal {
+		assert.True(t, matchFatalPattern(l), l)
+	}
+
+	notFatal := []string{
+		"epoch 3 loss 0.5",
+		"ERROR: Script failed with exit code 0 after 42s",
+		"just a normal line",
+	}
+	for _, l := range notFatal {
+		assert.False(t, matchFatalPattern(l), l)
+	}
+}
+
+func TestEmitNoLogs(t *testing.T) {
+	tests := []struct {
+		name   string
+		status logRunStatus
+		want   string
+	}{
+		{
+			name:   "terminal",
+			status: logRunStatus{lifeCycleState: "TERMINATED", resultState: "FAILED", stateMessage: "boom"},
+			want:   "No logs available for run 7. Run terminated in state FAILED: boom\n",
+		},
+		{
+			name:   "running",
+			status: logRunStatus{lifeCycleState: "RUNNING"},
+			want:   "No logs available yet for run 7, which is still in state RUNNING\n",
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			var text bytes.Buffer
+			emitNoLogs(&text, logRequest{runID: 7}, tc.status)
+			assert.Equal(t, tc.want, text.String())
+
+			var jsonBuf bytes.Buffer
+			emitNoLogs(&jsonBuf, logRequest{runID: 7, node: 1, jsonOutput: true}, tc.status)
+			var ev logEvent
+			require.NoError(t, json.Unmarshal(jsonBuf.Bytes(), &ev))
+			assert.Equal(t, "ERROR", ev.Type)
+			assert.Equal(t, 1, ev.Node)
+			assert.Equal(t, strings.TrimRight(tc.want, "\n"), ev.Line)
+		})
+	}
+}
+
+func TestRequestPageRetriesThenFallsBack(t *testing.T) {
+	// Shrink the retry wait so the transient-failure loop runs fast.
+	orig := retryCheckInterval
+	retryCheckInterval = time.Millisecond
+	t.Cleanup(func() { retryCheckInterval = orig })
+
+	var calls int
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if !strings.Contains(r.URL.Path, "/logs") {
+			// Ignore SDK host/config probes so `calls` counts only log requests.
+			_, _ = w.Write([]byte(`{}`))
+			return
+		}
+		calls++
+		w.WriteHeader(http.StatusInternalServerError)
+		_, _ = w.Write([]byte(`{"error_code": "INTERNAL_ERROR", "message": "transient"}`))
+	}))
+	t.Cleanup(srv.Close)
+
+	w := newTestWorkspaceClient(t, srv.URL)
+	apiClient, err := client.New(w.Config)
+	require.NoError(t, err)
+	st := &bricklensStreamer{
+		ctx:       t.Context(),
+		w:         w,
+		apiClient: apiClient,
+		req:       logRequest{runID: 1, node: 0, attempt: -1},
+		seen:      newSeenSet(seenRecordsCap),
+	}
+	_, err = st.requestPage("", 0, 0, true)
+	// Persistent transient failures fall back to MLflow after the retry budget.
+	require.ErrorIs(t, err, errBricklensFeatureDisabled)
+	assert.Equal(t, maxTransientFailures, calls)
+}
+
+func TestRequestPageRetriesThenSucceeds(t *testing.T) {
+	orig := retryCheckInterval
+	retryCheckInterval = time.Millisecond
+	t.Cleanup(func() { retryCheckInterval = orig })
+
+	var calls int
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if !strings.Contains(r.URL.Path, "/logs") {
+			_, _ = w.Write([]byte(`{}`))
+			return
+		}
+		calls++
+		if calls < 3 {
+			w.WriteHeader(http.StatusInternalServerError)
+			_, _ = w.Write([]byte(`{"error_code": "INTERNAL_ERROR", "message": "transient"}`))
+			return
+		}
+		_, _ = w.Write([]byte(`{"log_records": [{"time_unix_nano": 1, "body": "ok", "node_index": 0}]}`))
+	}))
+	t.Cleanup(srv.Close)
+
+	wc := newTestWorkspaceClient(t, srv.URL)
+	apiClient, err := client.New(wc.Config)
+	require.NoError(t, err)
+	st := &bricklensStreamer{
+		ctx:       t.Context(),
+		w:         wc,
+		apiClient: apiClient,
+		req:       logRequest{runID: 1, node: 0, attempt: -1},
+		seen:      newSeenSet(seenRecordsCap),
+	}
+	resp, err := st.requestPage("", 0, 0, true)
+	require.NoError(t, err)
+	require.Len(t, resp.LogRecords, 1)
+	assert.Equal(t, "ok", resp.LogRecords[0].Body)
+	assert.Equal(t, 3, calls)
+}
+
+// emptyLogsServer serves an empty Bricklens log response for any /logs request
+// and a stub for everything else (SDK config probes, etc.).
+func emptyLogsServer(t *testing.T) *httptest.Server {
+	t.Helper()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if strings.HasSuffix(r.URL.Path, "/logs") {
+			_, _ = w.Write([]byte(`{"log_records": []}`))
+			return
+		}
+		_, _ = w.Write([]byte(`{}`))
+	}))
+	t.Cleanup(srv.Close)
+	return srv
+}
+
+func TestStreamBricklensEmptyFallsBackToMLflow(t *testing.T) {
+	// Bricklens served every request but returned no record. That is not proof the
+	// run has no logs (they may be in MLflow), so the streamer must hand off via
+	// errBricklensFeatureDisabled and emit nothing itself, rather than reporting
+	// "No logs available" (the reported bug: the print path did, --download-to did not).
+	tests := []struct {
+		name   string
+		req    logRequest
+		status logRunStatus
+	}{
+		{
+			name:   "terminal run",
+			req:    logRequest{runID: 123, node: 0, attempt: -1, tailLines: -1, jsonOutput: true},
+			status: logRunStatus{lifeCycleState: "TERMINATED", resultState: "SUCCESS", endTimeMs: 1700000012000},
+		},
+		{
+			name:   "static view of a past retry",
+			req:    logRequest{runID: 123, node: 0, attempt: 0, tailLines: -1, staticView: true, jsonOutput: true},
+			status: logRunStatus{lifeCycleState: "RUNNING"},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var buf bytes.Buffer
+			w := newTestWorkspaceClient(t, emptyLogsServer(t).URL)
+			_, err := streamBricklensLogs(t.Context(), w, &buf, tt.req, tt.status)
+			require.ErrorIs(t, err, errBricklensFeatureDisabled)
+			assert.Empty(t, buf.String(), "nothing should be emitted before the hand-off")
+		})
+	}
+}
+
+func TestStreamBricklensTerminalWithRecordsDoesNotFallBack(t *testing.T) {
+	// A terminal run whose Bricklens stream has records prints them and reports the
+	// run's outcome, without triggering the empty-result fallback.
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if strings.HasSuffix(r.URL.Path, "/logs") {
+			_, _ = w.Write([]byte(`{"log_records": [{"time_unix_nano": 1700000001000000000, "body": "hello", "node_index": 0}]}`))
+			return
+		}
+		_, _ = w.Write([]byte(`{}`))
+	}))
+	t.Cleanup(srv.Close)
+
+	var buf bytes.Buffer
+	w := newTestWorkspaceClient(t, srv.URL)
+	status := logRunStatus{lifeCycleState: "TERMINATED", resultState: "SUCCESS", endTimeMs: 1700000012000}
+	ok, err := streamBricklensLogs(t.Context(), w, &buf, logRequest{runID: 123, node: 0, attempt: -1, tailLines: -1, jsonOutput: true}, status)
+	require.NoError(t, err)
+	assert.True(t, ok)
+	assert.Contains(t, buf.String(), `"line":"hello"`)
+}
+
+func TestStreamBricklensActiveEmptyProbesMLflow(t *testing.T) {
+	oldInterval := retryCheckInterval
+	retryCheckInterval = time.Millisecond
+	t.Cleanup(func() { retryCheckInterval = oldInterval })
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case strings.HasSuffix(r.URL.Path, "/logs"):
+			_, _ = w.Write([]byte(`{"log_records":[]}`))
+		case r.URL.Path == "/api/2.2/jobs/runs/get":
+			_, _ = w.Write([]byte(`{"run_id":123,"state":{"life_cycle_state":"RUNNING"},"tasks":[{"run_id":456,"attempt_number":0}]}`))
+		case r.URL.Path == "/api/2.2/jobs/runs/get-output":
+			_, _ = w.Write([]byte(`{"ai_runtime_task_output":{"mlflow_experiment_id":"E1","mlflow_run_id":"R1"}}`))
+		case r.URL.Path == "/api/2.0/mlflow/runs/get":
+			_, _ = w.Write([]byte(`{}`))
+		case r.URL.Path == "/api/2.0/mlflow/artifacts/list":
+			if r.URL.Query().Get("path") == "logs" {
+				_, _ = w.Write([]byte(`{"files":[{"path":"logs/node_0","is_dir":true}]}`))
+			} else {
+				_, _ = w.Write([]byte(`{"files":[{"path":"logs/node_0/logs-0.chunk.txt"}]}`))
+			}
+		default:
+			_, _ = w.Write([]byte(`{}`))
+		}
+	}))
+	t.Cleanup(srv.Close)
+
+	var out bytes.Buffer
+	_, err := streamBricklensLogs(t.Context(), newTestWorkspaceClient(t, srv.URL), &out,
+		logRequest{runID: 123, attempt: -1, tailLines: -1, jsonOutput: true},
+		logRunStatus{lifeCycleState: "RUNNING"})
+	require.ErrorIs(t, err, errBricklensFeatureDisabled)
+	assert.Empty(t, out.String())
+}
+
+func TestFetchLogsFallsBackToMLflowWhenBricklensEmpty(t *testing.T) {
+	// End-to-end repro: a terminal SUCCESS run whose Bricklens stream is empty but
+	// whose logs are in MLflow. The print path must fall back to MLflow and print
+	// them, exactly as --download-to already does.
+	var base string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case strings.HasSuffix(r.URL.Path, "/logs"):
+			_, _ = w.Write([]byte(`{"log_records": []}`))
+		case r.URL.Path == "/api/2.2/jobs/runs/get":
+			_, _ = w.Write([]byte(`{"run_id": 123, "state": {"life_cycle_state": "TERMINATED", "result_state": "SUCCESS"}, "tasks": [{"run_id": 456}]}`))
+		case r.URL.Path == "/api/2.2/jobs/runs/get-output":
+			_, _ = w.Write([]byte(`{"ai_runtime_task_output": {"mlflow_experiment_id": "E1", "mlflow_run_id": "R1"}}`))
+		case r.URL.Path == "/api/2.0/mlflow/artifacts/list":
+			_, _ = w.Write([]byte(`{"files": [{"path": "logs/node_0"}, {"path": "logs/node_0/logs-0.chunk.txt"}]}`))
+		case r.URL.Path == "/api/2.0/mlflow/artifacts/credentials-for-read":
+			_, _ = w.Write([]byte(`{"credential_infos": [{"signed_uri": "` + base + `/presigned"}]}`))
+		case r.URL.Path == "/presigned":
+			_, _ = w.Write([]byte("line 1\nline 2\n"))
+		default:
+			_, _ = w.Write([]byte(`{}`))
+		}
+	}))
+	base = srv.URL
+	t.Cleanup(srv.Close)
+
+	var buf bytes.Buffer
+	w := newTestWorkspaceClient(t, srv.URL)
+	status := logRunStatus{lifeCycleState: "TERMINATED", resultState: "SUCCESS", endTimeMs: 1700000012000}
+	ok, err := fetchLogs(t.Context(), w, &buf, logRequest{runID: 123, node: 0, attempt: -1, tailLines: -1, jsonOutput: true}, status)
+	require.NoError(t, err)
+	assert.True(t, ok)
+	assert.Contains(t, buf.String(), `"line":"line 1"`)
+	assert.Contains(t, buf.String(), `"line":"line 2"`)
+}
+
+func TestSeenSetEviction(t *testing.T) {
+	s := newSeenSet(2)
+	a := logRecord{TimeUnixNano: "1", Body: "a"}
+	b := logRecord{TimeUnixNano: "2", Body: "b"}
+	c := logRecord{TimeUnixNano: "3", Body: "c"}
+	s.add(a)
+	s.add(b)
+	assert.True(t, s.has(a))
+	assert.True(t, s.has(b))
+
+	// Adding a third evicts the oldest-inserted (1,"a").
+	assert.Equal(t, int64(1), s.add(c))
+	assert.False(t, s.has(a))
+	assert.True(t, s.has(b))
+	assert.True(t, s.has(c))
+
+	// Same (nano, body) shares one entry; distinct body under the same nano does not.
+	s.add(c)
+	assert.True(t, s.has(c))
+	assert.False(t, s.has(logRecord{TimeUnixNano: "3", Body: "d"}))
+}
+
+func TestSleepOrCancel(t *testing.T) {
+	// Returns nil once the duration elapses.
+	require.NoError(t, sleepOrCancel(t.Context(), time.Millisecond))
+
+	// Returns the context error promptly when cancelled.
+	ctx, cancel := context.WithCancel(t.Context())
+	cancel()
+	require.ErrorIs(t, sleepOrCancel(ctx, time.Hour), context.Canceled)
+}
diff --git a/cmd/air/mlflow.go b/cmd/air/mlflow.go
new file mode 100644
index 00000000000..5434142a3c8
--- /dev/null
+++ b/cmd/air/mlflow.go
@@ -0,0 +1,108 @@
+package aircmd
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/databricks/databricks-sdk-go/service/ml"
+)
+
+// mlflowIdentifiers are the experiment and run IDs MLflow assigns to a run.
+type mlflowIdentifiers struct {
+	ExperimentID string
+	RunID        string
+}
+
+// mlflowIDs fetches the MLflow IDs for a run via its latest task. Returns nil if
+// they can't be obtained.
+func mlflowIDs(ctx context.Context, w *databricks.WorkspaceClient, run *jobs.Run) *mlflowIdentifiers {
+	return mlflowIDsFromOutput(aiRuntimeTaskOutput(ctx, w, run))
+}
+
+func aiRuntimeTaskOutput(ctx context.Context, w *databricks.WorkspaceClient, run *jobs.Run) *jobs.AiRuntimeTaskOutput {
+	if len(run.Tasks) == 0 {
+		return nil
+	}
+	return aiRuntimeTaskOutputForTask(ctx, w, run.Tasks[len(run.Tasks)-1].RunId)
+}
+
+// mlflowIDsForTask fetches a task run's MLflow experiment and run IDs from
+// runs/get-output, or nil if they can't be obtained. They drive a convenience
+// link, so any failure (endpoint error, run not yet started, no MLflow output)
+// is logged and treated as "no link" rather than failing the command.
+func mlflowIDsForTask(ctx context.Context, w *databricks.WorkspaceClient, taskRunID int64) *mlflowIdentifiers {
+	return mlflowIDsFromOutput(aiRuntimeTaskOutputForTask(ctx, w, taskRunID))
+}
+
+func aiRuntimeTaskOutputForTask(ctx context.Context, w *databricks.WorkspaceClient, taskRunID int64) *jobs.AiRuntimeTaskOutput {
+	if taskRunID == 0 {
+		return nil
+	}
+
+	out, err := w.Jobs.GetRunOutputByRunId(ctx, taskRunID)
+	if err != nil {
+		log.Debugf(ctx, "air: could not fetch run output for MLflow link: %v", err)
+		return nil
+	}
+
+	return out.AiRuntimeTaskOutput
+}
+
+func mlflowIDsFromOutput(output *jobs.AiRuntimeTaskOutput) *mlflowIdentifiers {
+	if output == nil || output.MlflowExperimentId == "" || output.MlflowRunId == "" {
+		return nil
+	}
+	return &mlflowIdentifiers{ExperimentID: output.MlflowExperimentId, RunID: output.MlflowRunId}
+}
+
+// mlflowLogsURL is the deep link to a run's node-0 logs. It is the value of the
+// JSON `mlflow_url` field, matching the Python CLI.
+func mlflowLogsURL(host string, ids *mlflowIdentifiers) string {
+	return fmt.Sprintf("%s/ml/experiments/%s/runs/%s/artifacts/logs/node_0",
+		strings.TrimRight(host, "/"), ids.ExperimentID, ids.RunID)
+}
+
+// mlflowRunURL links to the MLflow run page; it backs the MLflow Run hyperlink
+// in the single-run view.
+func mlflowRunURL(host string, ids *mlflowIdentifiers) string {
+	return fmt.Sprintf("%s/ml/experiments/%s/runs/%s",
+		strings.TrimRight(host, "/"), ids.ExperimentID, ids.RunID)
+}
+
+// mlflowExperimentURL links to the MLflow experiment page. Omits the ?o= query
+// for consistency with mlflowRunURL and the run-submit dashboard URL.
+func mlflowExperimentURL(host string, ids *mlflowIdentifiers) string {
+	return fmt.Sprintf("%s/ml/experiments/%s", strings.TrimRight(host, "/"), ids.ExperimentID)
+}
+
+// fetchMLflowRunName fetches a run's MLflow run_name via the MLflow REST API,
+// returning "" if it can't be obtained. Best-effort, like the rest of the MLflow
+// enrichment.
+func fetchMLflowRunName(ctx context.Context, w *databricks.WorkspaceClient, mlflowRunID string) string {
+	resp, err := w.Experiments.GetRun(ctx, ml.GetRunRequest{RunId: mlflowRunID})
+	if err != nil {
+		log.Debugf(ctx, "air get: could not fetch MLflow run name: %v", err)
+		return ""
+	}
+	if resp.Run == nil || resp.Run.Info == nil {
+		return ""
+	}
+	return resp.Run.Info.RunName
+}
+
+// mlflowRunLabel is the text shown for the MLflow Run cell: the run's name, or
+// "...{last 8 of run id}" when the name is unknown. Mirrors Python's
+// _get_mlflow_run_name (cli_display.py).
+func mlflowRunLabel(name, mlflowRunID string) string {
+	if name != "" {
+		return name
+	}
+	if len(mlflowRunID) > 8 {
+		return "..." + mlflowRunID[len(mlflowRunID)-8:]
+	}
+	return "..." + mlflowRunID
+}
diff --git a/cmd/air/mlflow_test.go b/cmd/air/mlflow_test.go
new file mode 100644
index 00000000000..a3dd5376298
--- /dev/null
+++ b/cmd/air/mlflow_test.go
@@ -0,0 +1,150 @@
+package aircmd
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// newTestWorkspaceClient builds a WorkspaceClient pointed at a mock HTTP server,
+// so the SDK calls these tests exercise are served locally.
+func newTestWorkspaceClient(t *testing.T, host string) *databricks.WorkspaceClient {
+	t.Helper()
+	w, err := databricks.NewWorkspaceClient(&databricks.Config{Host: host, Token: "token"})
+	require.NoError(t, err)
+	return w
+}
+
+// runOutputServer serves the given runs/get-output body and a stub for the SDK's
+// well-known config discovery request. *hit is set when get-output is called.
+func runOutputServer(t *testing.T, body string, hit *bool) *httptest.Server {
+	t.Helper()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/api/2.2/jobs/runs/get-output" {
+			*hit = true
+			_, _ = w.Write([]byte(body))
+			return
+		}
+		_, _ = w.Write([]byte(`{}`))
+	}))
+	t.Cleanup(srv.Close)
+	return srv
+}
+
+func TestMLflowIDs(t *testing.T) {
+	ctx := t.Context()
+	run := &jobs.Run{Tasks: []jobs.RunTask{{RunId: 99}}}
+
+	t.Run("returns the identifiers on success", func(t *testing.T) {
+		var hit bool
+		srv := runOutputServer(t, `{"ai_runtime_task_output":{"mlflow_experiment_id":"E1","mlflow_run_id":"R1"}}`, &hit)
+
+		got := mlflowIDs(ctx, newTestWorkspaceClient(t, srv.URL), run)
+		require.NotNil(t, got)
+		assert.True(t, hit, "runs/get-output should have been called")
+		assert.Equal(t, &mlflowIdentifiers{ExperimentID: "E1", RunID: "R1"}, got)
+	})
+
+	t.Run("nil when the run has no MLflow info", func(t *testing.T) {
+		var hit bool
+		srv := runOutputServer(t, `{}`, &hit)
+		assert.Nil(t, mlflowIDs(ctx, newTestWorkspaceClient(t, srv.URL), run))
+	})
+
+	t.Run("nil when the run has no tasks", func(t *testing.T) {
+		// Returns before any HTTP call, so the host is never contacted.
+		assert.Nil(t, mlflowIDs(ctx, newTestWorkspaceClient(t, "https://unused.invalid"), &jobs.Run{}))
+	})
+
+	t.Run("uses the latest attempt's task run", func(t *testing.T) {
+		// A retried run must link to the last task, not the stale first attempt.
+		var gotRunID string
+		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			if r.URL.Path == "/api/2.2/jobs/runs/get-output" {
+				gotRunID = r.URL.Query().Get("run_id")
+			}
+			_, _ = w.Write([]byte(`{}`))
+		}))
+		t.Cleanup(srv.Close)
+
+		retried := &jobs.Run{Tasks: []jobs.RunTask{{RunId: 99}, {RunId: 100}}}
+		mlflowIDs(ctx, newTestWorkspaceClient(t, srv.URL), retried)
+		assert.Equal(t, "100", gotRunID)
+	})
+}
+
+func TestAiRuntimeTaskOutput(t *testing.T) {
+	var hit bool
+	srv := runOutputServer(t, `{"ai_runtime_task_output":{"status_message":"STATUS: Waiting for GPU capacity"}}`, &hit)
+	run := &jobs.Run{Tasks: []jobs.RunTask{{RunId: 99}}}
+
+	got := aiRuntimeTaskOutput(t.Context(), newTestWorkspaceClient(t, srv.URL), run)
+	require.NotNil(t, got)
+	assert.True(t, hit)
+	assert.Equal(t, "STATUS: Waiting for GPU capacity", got.StatusMessage)
+}
+
+func TestMLflowIDsForTask(t *testing.T) {
+	ctx := t.Context()
+
+	t.Run("parses ai_runtime_task_output", func(t *testing.T) {
+		var hit bool
+		srv := runOutputServer(t, `{"ai_runtime_task_output":{"mlflow_experiment_id":"E1","mlflow_run_id":"R1"}}`, &hit)
+		got := mlflowIDsForTask(ctx, newTestWorkspaceClient(t, srv.URL), 99)
+		require.NotNil(t, got)
+		assert.True(t, hit)
+		assert.Equal(t, &mlflowIdentifiers{ExperimentID: "E1", RunID: "R1"}, got)
+	})
+
+	t.Run("nil when no task run id", func(t *testing.T) {
+		// Returns before any HTTP call, so the host is never contacted.
+		assert.Nil(t, mlflowIDsForTask(ctx, newTestWorkspaceClient(t, "https://unused.invalid"), 0))
+	})
+}
+
+func TestMLflowURLs(t *testing.T) {
+	ids := &mlflowIdentifiers{ExperimentID: "E1", RunID: "R1"}
+	// A trailing slash on the host must not produce a double slash in the link.
+	assert.Equal(t, "https://h.test/ml/experiments/E1/runs/R1/artifacts/logs/node_0", mlflowLogsURL("https://h.test/", ids))
+	assert.Equal(t, "https://h.test/ml/experiments/E1/runs/R1", mlflowRunURL("https://h.test", ids))
+}
+
+func TestMLflowRunLabel(t *testing.T) {
+	// Uses the run name when it is known.
+	assert.Equal(t, "sunny-cat-42", mlflowRunLabel("sunny-cat-42", "0123456789abcdef"))
+	// Falls back to the last 8 characters of a long run id.
+	assert.Equal(t, "...9abcdef0", mlflowRunLabel("", "0123456789abcdef0"))
+	// A short run id is shown in full behind the ellipsis.
+	assert.Equal(t, "...short", mlflowRunLabel("", "short"))
+}
+
+func TestFetchMLflowRunName(t *testing.T) {
+	ctx := t.Context()
+
+	mlflowServer := func(body string) *httptest.Server {
+		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			if r.URL.Path == "/api/2.0/mlflow/runs/get" {
+				_, _ = w.Write([]byte(body))
+				return
+			}
+			_, _ = w.Write([]byte(`{}`))
+		}))
+		t.Cleanup(srv.Close)
+		return srv
+	}
+
+	t.Run("returns the run name", func(t *testing.T) {
+		srv := mlflowServer(`{"run":{"info":{"run_name":"sunny-cat-42"}}}`)
+		assert.Equal(t, "sunny-cat-42", fetchMLflowRunName(ctx, newTestWorkspaceClient(t, srv.URL), "run1"))
+	})
+
+	t.Run("empty when the run cannot be fetched", func(t *testing.T) {
+		srv := mlflowServer(`{}`)
+		assert.Empty(t, fetchMLflowRunName(ctx, newTestWorkspaceClient(t, srv.URL), "run1"))
+	})
+}
diff --git a/cmd/air/output.go b/cmd/air/output.go
new file mode 100644
index 00000000000..c00d870e386
--- /dev/null
+++ b/cmd/air/output.go
@@ -0,0 +1,82 @@
+package aircmd
+
+import (
+	"context"
+	"time"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/spf13/cobra"
+)
+
+// envelopeVersion is the envelope's format-version marker. The Python `air` CLI
+// hardcodes it to 1; it lets consumers detect a future incompatible change to
+// the envelope shape.
+const envelopeVersion = 1
+
+// envelope is the JSON shape that the AI runtime CLI prints:
+//
+//	{ "v": 1, "ts": "2024-01-15T14:30:45Z", "data": { ... } }
+//
+// It mirrors the envelope used by the original Python `air` CLI so existing
+// consumers keep working after the port to Go.
+type envelope struct {
+	// V is the envelope format-version marker (always 1).
+	V int `json:"v"`
+	// TS is the wall-clock time the response was produced, in RFC 3339 UTC.
+	// It is an absolute timestamp, not an elapsed duration.
+	TS string `json:"ts"`
+	// Data is the command-specific payload.
+	Data any `json:"data"`
+}
+
+// renderEnvelope wraps data in the JSON envelope and prints it.
+// Fields that should appear only in text output are tagged `json:"-"` on the payload struct.
+func renderEnvelope(ctx context.Context, data any) error {
+	return cmdio.Render(ctx, envelope{
+		V:    envelopeVersion,
+		TS:   time.Now().UTC().Format(time.RFC3339),
+		Data: data,
+	})
+}
+
+// jsonError is the error payload, matching the Python `air` CLI's shape (cli/json_output.py).
+type jsonError struct {
+	Code      string `json:"code"`
+	Kind      string `json:"kind"`
+	Message   string `json:"message"`
+	Retryable bool   `json:"retryable"`
+}
+
+// errorEnvelope is what a failed command prints in JSON mode:
+//
+//	{ "v": 1, "ts": "...", "error": { "code": ..., "kind": ..., "message": ..., "retryable": ... } }
+type errorEnvelope struct {
+	V     int       `json:"v"`
+	TS    string    `json:"ts"`
+	Error jsonError `json:"error"`
+}
+
+// renderError prints err as a JSON error envelope when output is JSON, returning
+// root.ErrAlreadyPrinted so the command exits non-zero without Cobra reprinting
+// it; in text mode it returns err unchanged. code/kind/retryable match the
+// Python CLI's call site.
+func renderError(ctx context.Context, cmd *cobra.Command, code, kind string, retryable bool, err error) error {
+	if root.OutputType(cmd) != flags.OutputJSON {
+		return err
+	}
+	if rerr := cmdio.Render(ctx, errorEnvelope{
+		V:  envelopeVersion,
+		TS: time.Now().UTC().Format(time.RFC3339),
+		Error: jsonError{
+			Code:      code,
+			Kind:      kind,
+			Message:   err.Error(),
+			Retryable: retryable,
+		},
+	}); rerr != nil {
+		return rerr
+	}
+	return root.ErrAlreadyPrinted
+}
diff --git a/cmd/air/output_test.go b/cmd/air/output_test.go
new file mode 100644
index 00000000000..3c35dc60a67
--- /dev/null
+++ b/cmd/air/output_test.go
@@ -0,0 +1,52 @@
+package aircmd
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"testing"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestRenderEnvelope(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	require.NoError(t, renderEnvelope(ctx, getData{RunID: "1", Status: "RUNNING"}))
+}
+
+// withOutput registers the --output flag on cmd and sets it, mirroring how the
+// root command wires output mode in production. Subcommand unit tests need it
+// because they invoke RunE without going through the root command.
+func withOutput(cmd *cobra.Command, output flags.Output) *cobra.Command {
+	cmd.Flags().Var(&output, "output", "")
+	return cmd
+}
+
+func TestRenderErrorJSON(t *testing.T) {
+	var buf bytes.Buffer
+	ctx := cmdio.InContext(t.Context(), cmdio.NewIO(t.Context(), flags.OutputJSON, nil, &buf, &buf, "", ""))
+	cmd := withOutput(&cobra.Command{}, flags.OutputJSON)
+
+	err := renderError(ctx, cmd, "NOT_FOUND", "NOT_FOUND", false, errors.New("run 1 not found"))
+	// JSON mode prints the envelope, so Cobra must stay silent but still exit non-zero.
+	require.ErrorIs(t, err, root.ErrAlreadyPrinted)
+
+	// The envelope must match the Python air CLI's print_json_error shape exactly.
+	var got errorEnvelope
+	require.NoError(t, json.Unmarshal(buf.Bytes(), &got))
+	assert.Equal(t, 1, got.V)
+	assert.NotEmpty(t, got.TS)
+	assert.Equal(t, jsonError{Code: "NOT_FOUND", Kind: "NOT_FOUND", Message: "run 1 not found"}, got.Error)
+}
+
+func TestRenderErrorText(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	cmd := withOutput(&cobra.Command{}, flags.OutputText)
+	want := errors.New("run 1 not found")
+	require.Equal(t, want, renderError(ctx, cmd, "NOT_FOUND", "NOT_FOUND", false, want))
+}
diff --git a/cmd/air/pools.go b/cmd/air/pools.go
new file mode 100644
index 00000000000..c6bf6c7d9cb
--- /dev/null
+++ b/cmd/air/pools.go
@@ -0,0 +1,371 @@
+package aircmd
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strconv"
+	"strings"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/auth"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/client"
+	"github.com/spf13/cobra"
+)
+
+// A "GPU pool" is a pre-provisioned AI Runtime accelerator reservation — the
+// same reservation a run targets via compute.provisioned_capacity_id. "GPU
+// pool" (or "pool") is the product-facing name used across the Compute page and
+// this CLI. The backend still models and serves these as AiWorkflowService
+// ProvisionedCapacity resources, so the endpoint path and the wire structs
+// below keep the API's name; only the user-facing surface says "pool".
+const poolsAPIPath = "/api/2.0/ai-training/provisioned-capacities"
+
+// resourceNamePrefix is the AIP resource-name prefix on ProvisionedCapacity.name
+// ("provisioned-capacities/{id}"). The CLI shows and accepts the bare id.
+const resourceNamePrefix = "provisioned-capacities/"
+
+// poolListPageSize is the per-request page size for the list endpoint. A
+// workspace holds very few pools, so this is effectively a single page.
+const poolListPageSize = 100
+
+// poolListMaxPages caps pagination so a misbehaving next_page_token can't loop
+// forever.
+const poolListMaxPages = 50
+
+// apiInt64 decodes an int64 that the REST gateway may send either as a JSON
+// number or, per proto3 JSON, as a quoted string.
+type apiInt64 int64
+
+func (n *apiInt64) UnmarshalJSON(b []byte) error {
+	s := strings.Trim(string(b), `"`)
+	if s == "" || s == "null" {
+		return nil
+	}
+	v, err := strconv.ParseInt(s, 10, 64)
+	if err != nil {
+		return err
+	}
+	*n = apiInt64(v)
+	return nil
+}
+
+// The wire structs below mirror the ProvisionedCapacity proto's JSON (the
+// backend name for a GPU pool).
+type provisionedCapacity struct {
+	Name   string                     `json:"name"`
+	Spec   *provisionedCapacitySpec   `json:"spec"`
+	Status *provisionedCapacityStatus `json:"status"`
+}
+
+type provisionedCapacitySpec struct {
+	AcceleratorType  string   `json:"accelerator_type"`
+	AcceleratorCount apiInt64 `json:"accelerator_count"`
+}
+
+type provisionedCapacityStatus struct {
+	Usage *provisionedCapacityUsage `json:"usage"`
+}
+
+type provisionedCapacityUsage struct {
+	UsedAcceleratorCount apiInt64 `json:"used_accelerator_count"`
+	IdleAcceleratorCount apiInt64 `json:"idle_accelerator_count"`
+}
+
+type listProvisionedCapacitiesResponse struct {
+	ProvisionedCapacities []provisionedCapacity `json:"provisioned_capacities"`
+	NextPageToken         string                `json:"next_page_token"`
+}
+
+// poolListData is the `air pools list` payload. Usage counts are intentionally
+// absent: the list endpoint does not populate them (they come from `air pools get`).
+type poolListData struct {
+	Rows []poolRow `json:"pools"`
+}
+
+type poolRow struct {
+	ID                   string `json:"pool_id"`
+	AcceleratorType      string `json:"accelerator_type"`
+	ReservedAccelerators int64  `json:"reserved_accelerators"`
+}
+
+// poolDetailData is the `air pools get` payload. Usage is a pointer because it is
+// populated only when the pool reports it.
+type poolDetailData struct {
+	ID                   string `json:"pool_id"`
+	AcceleratorType      string `json:"accelerator_type"`
+	ReservedAccelerators int64  `json:"reserved_accelerators"`
+	UsedAccelerators     *int64 `json:"used_accelerators"`
+	IdleAccelerators     *int64 `json:"idle_accelerators"`
+}
+
+// poolID strips the AIP resource-name prefix, returning the bare id. Input may
+// already be the bare id (from a user argument) or the full resource name (from
+// a response's name field).
+func poolID(name string) string {
+	return strings.TrimPrefix(name, resourceNamePrefix)
+}
+
+// poolAPIError classifies a pools call failure into the CLI's error envelope,
+// matching how `air get` classifies run lookups.
+func poolAPIError(ctx context.Context, cmd *cobra.Command, action string, err error) error {
+	// The handler gates the API behind a SAFE flag and reports FEATURE_DISABLED
+	// where it is not yet rolled out. That is a permanent state for the
+	// workspace, not a retryable failure — and its explicit error code is more
+	// specific than the generic 403 it may arrive as, so check it first.
+	if apiErr, ok := errors.AsType[*apierr.APIError](err); ok && apiErr.ErrorCode == "FEATURE_DISABLED" {
+		return renderError(ctx, cmd, "FEATURE_DISABLED", "PERMANENT", false,
+			errors.New("the GPU pools API is not enabled for this workspace"))
+	}
+	if errors.Is(err, apierr.ErrUnauthenticated) || errors.Is(err, apierr.ErrPermissionDenied) {
+		return authError(ctx, cmd, err)
+	}
+	return renderError(ctx, cmd, "INTERNAL_ERROR", "TRANSIENT", true,
+		fmt.Errorf("failed to %s: %w", action, err))
+}
+
+// listPools pages the list endpoint fully.
+func listPools(ctx context.Context, w *databricks.WorkspaceClient) ([]provisionedCapacity, error) {
+	apiClient, err := client.New(w.Config)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create API client: %w", err)
+	}
+
+	var out []provisionedCapacity
+	pageToken := ""
+	for range poolListMaxPages {
+		// GET query params ride the request arg (the SDK serializes them for a
+		// GET), matching the sibling workflows call.
+		query := map[string]any{"page_size": poolListPageSize}
+		if pageToken != "" {
+			query["page_token"] = pageToken
+		}
+		var resp listProvisionedCapacitiesResponse
+		// WorkspaceIDHeaders is required so unified hosts route the call to the
+		// caller's workspace rather than relying on Config.WorkspaceID alone.
+		if err := apiClient.Do(ctx, http.MethodGet, poolsAPIPath, auth.WorkspaceIDHeaders(w.Config), nil, query, &resp); err != nil {
+			return nil, err
+		}
+		out = append(out, resp.ProvisionedCapacities...)
+		if resp.NextPageToken == "" {
+			break
+		}
+		pageToken = resp.NextPageToken
+	}
+	return out, nil
+}
+
+// getPool fetches one pool, including its usage summary.
+func getPool(ctx context.Context, w *databricks.WorkspaceClient, id string) (*provisionedCapacity, error) {
+	apiClient, err := client.New(w.Config)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create API client: %w", err)
+	}
+	var pc provisionedCapacity
+	// PathEscape the id: it is user-supplied, so a stray "/" or "?" would
+	// otherwise be parsed as extra path segments or a query string rather than
+	// staying part of the resource id.
+	//
+	// WorkspaceIDHeaders is required so unified hosts route the call to the
+	// caller's workspace rather than relying on Config.WorkspaceID alone.
+	if err := apiClient.Do(ctx, http.MethodGet, poolsAPIPath+"/"+url.PathEscape(id), auth.WorkspaceIDHeaders(w.Config), nil, nil, &pc); err != nil {
+		return nil, err
+	}
+	return &pc, nil
+}
+
+func newPoolsCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "pools",
+		Short: "View provisioned GPU pools",
+		RunE:  root.ReportUnknownSubcommand,
+	}
+
+	cmd.AddCommand(newGetPoolCommand())
+	cmd.AddCommand(newListPoolsCommand())
+
+	return cmd
+}
+
+func newListPoolsCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "list",
+		Args:  root.NoArgs,
+		Short: "List the GPU pools available to the current workspace",
+	}
+
+	cmd.PreRunE = func(cmd *cobra.Command, args []string) error {
+		err := root.MustWorkspaceClient(cmd, args)
+		if err == nil || errors.Is(err, root.ErrAlreadyPrinted) {
+			return err
+		}
+		return authError(cmd.Context(), cmd, err)
+	}
+
+	cmd.RunE = func(cmd *cobra.Command, args []string) error {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		pools, err := listPools(ctx, w)
+		if err != nil {
+			return poolAPIError(ctx, cmd, "list GPU pools", err)
+		}
+
+		data := poolListData{Rows: make([]poolRow, 0, len(pools))}
+		for _, p := range pools {
+			data.Rows = append(data.Rows, poolRowFrom(p))
+		}
+
+		if root.OutputType(cmd) != flags.OutputText {
+			return renderEnvelope(ctx, data)
+		}
+		renderPoolTable(cmd.OutOrStdout(), data.Rows)
+		return nil
+	}
+
+	return cmd
+}
+
+func newGetPoolCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "get [POOL_ID]",
+		Args:  root.MaximumNArgs(1),
+		Short: "Show a GPU pool, including its accelerator usage (POOL_ID may be omitted when the workspace has exactly one pool)",
+	}
+
+	cmd.PreRunE = func(cmd *cobra.Command, args []string) error {
+		err := root.MustWorkspaceClient(cmd, args)
+		if err == nil || errors.Is(err, root.ErrAlreadyPrinted) {
+			return err
+		}
+		return authError(cmd.Context(), cmd, err)
+	}
+
+	cmd.RunE = func(cmd *cobra.Command, args []string) error {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		var id string
+		if len(args) == 1 {
+			// Accept either the bare id or the full resource name.
+			id = poolID(strings.TrimSpace(args[0]))
+			if id == "" {
+				return renderError(ctx, cmd, "INVALID_ARGS", "PERMANENT", false,
+					errors.New("pool_id cannot be empty"))
+			}
+		} else {
+			// No id given: resolve it only when the workspace has exactly one pool.
+			resolved, err := resolveSolePoolID(ctx, cmd, w)
+			if err != nil {
+				return err
+			}
+			id = resolved
+		}
+
+		pool, err := getPool(ctx, w, id)
+		if err != nil {
+			// ErrNotFound covers a plain 404 as well as RESOURCE_DOES_NOT_EXIST.
+			if errors.Is(err, apierr.ErrNotFound) {
+				return renderError(ctx, cmd, "NOT_FOUND", "NOT_FOUND", false,
+					fmt.Errorf("GPU pool %q not found: check the id with `air pools list`", id))
+			}
+			return poolAPIError(ctx, cmd, fmt.Sprintf("get GPU pool %q", id), err)
+		}
+
+		data := poolDetailFrom(*pool)
+		if root.OutputType(cmd) != flags.OutputText {
+			return renderEnvelope(ctx, data)
+		}
+		renderPoolDetail(cmd.OutOrStdout(), data)
+		return nil
+	}
+
+	return cmd
+}
+
+// resolveSolePoolID returns the id of the workspace's only pool, for `air pools
+// get` with no argument. It errors (with the ids to choose from) when there is
+// not exactly one, so the convenience never silently picks among several.
+func resolveSolePoolID(ctx context.Context, cmd *cobra.Command, w *databricks.WorkspaceClient) (string, error) {
+	pools, err := listPools(ctx, w)
+	if err != nil {
+		return "", poolAPIError(ctx, cmd, "list GPU pools", err)
+	}
+	switch len(pools) {
+	case 1:
+		return poolID(pools[0].Name), nil
+	case 0:
+		return "", renderError(ctx, cmd, "NOT_FOUND", "NOT_FOUND", false,
+			errors.New("no GPU pools found in this workspace"))
+	default:
+		ids := make([]string, len(pools))
+		for i, p := range pools {
+			ids[i] = poolID(p.Name)
+		}
+		return "", renderError(ctx, cmd, "INVALID_ARGS", "PERMANENT", false,
+			fmt.Errorf("workspace has %d GPU pools; specify one of: %s", len(pools), strings.Join(ids, ", ")))
+	}
+}
+
+// poolRowFrom projects a wire ProvisionedCapacity to a list row.
+func poolRowFrom(p provisionedCapacity) poolRow {
+	row := poolRow{ID: poolID(p.Name)}
+	if p.Spec != nil {
+		row.AcceleratorType = p.Spec.AcceleratorType
+		row.ReservedAccelerators = int64(p.Spec.AcceleratorCount)
+	}
+	return row
+}
+
+// poolDetailFrom projects a wire ProvisionedCapacity to the detail payload.
+func poolDetailFrom(p provisionedCapacity) poolDetailData {
+	data := poolDetailData{ID: poolID(p.Name)}
+	if p.Spec != nil {
+		data.AcceleratorType = p.Spec.AcceleratorType
+		data.ReservedAccelerators = int64(p.Spec.AcceleratorCount)
+	}
+	if p.Status != nil && p.Status.Usage != nil {
+		used, idle := int64(p.Status.Usage.UsedAcceleratorCount), int64(p.Status.Usage.IdleAcceleratorCount)
+		data.UsedAccelerators = &used
+		data.IdleAccelerators = &idle
+	}
+	return data
+}
+
+// renderPoolTable prints the list as an aligned text table.
+func renderPoolTable(out io.Writer, rows []poolRow) {
+	if len(rows) == 0 {
+		fmt.Fprintln(out, "No GPU pools found.")
+		return
+	}
+	fmt.Fprintf(out, "%-40s %-14s %s\n", "ID", "ACCELERATOR", "RESERVED")
+	for _, r := range rows {
+		fmt.Fprintf(out, "%-40s %-14s %d\n", orNA(r.ID), orNA(r.AcceleratorType), r.ReservedAccelerators)
+	}
+}
+
+// renderPoolDetail prints the get view as aligned label/value lines.
+func renderPoolDetail(out io.Writer, d poolDetailData) {
+	line := func(label, value string) { fmt.Fprintf(out, "%-24s %s\n", label+":", value) }
+	line("Pool ID", orNA(d.ID))
+	line("Accelerator Type", orNA(d.AcceleratorType))
+	line("Reserved Accelerators", strconv.FormatInt(d.ReservedAccelerators, 10))
+	line("Used Accelerators", acceleratorCell(d.UsedAccelerators))
+	line("Idle Accelerators", acceleratorCell(d.IdleAccelerators))
+}
+
+// acceleratorCell renders an optional count, showing N/A when the pool did not
+// report usage.
+func acceleratorCell(v *int64) string {
+	if v == nil {
+		return na
+	}
+	return strconv.FormatInt(*v, 10)
+}
diff --git a/cmd/air/pools_test.go b/cmd/air/pools_test.go
new file mode 100644
index 00000000000..0062c48f61a
--- /dev/null
+++ b/cmd/air/pools_test.go
@@ -0,0 +1,361 @@
+package aircmd
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const poolsBasePath = "/api/2.0/ai-training/provisioned-capacities"
+
+func TestPoolsCommandShape(t *testing.T) {
+	pools := newPoolsCommand()
+	assert.Equal(t, "pools", pools.Use)
+	assert.True(t, hasSubcommand(pools, "get"))
+	assert.True(t, hasSubcommand(pools, "list"))
+
+	list := newListPoolsCommand()
+	assert.Equal(t, "list", list.Use)
+	assert.NoError(t, list.Args(list, []string{}))
+	assert.Error(t, list.Args(list, []string{"x"}))
+
+	get := newGetPoolCommand()
+	assert.Equal(t, "get [POOL_ID]", get.Use)
+	assert.NoError(t, get.Args(get, []string{"pool-1"}))
+	assert.NoError(t, get.Args(get, []string{})) // id optional: resolved when there's one pool
+	assert.Error(t, get.Args(get, []string{"a", "b"}))
+
+	assert.True(t, hasSubcommand(New(), "pools"))
+	assert.False(t, hasSubcommand(newListCommand(), "pools"))
+	assert.False(t, hasSubcommand(newGetCommand(), "pool"))
+}
+
+func hasSubcommand(parent *cobra.Command, name string) bool {
+	for _, c := range parent.Commands() {
+		if c.Name() == name {
+			return true
+		}
+	}
+	return false
+}
+
+func TestAPIInt64Unmarshal(t *testing.T) {
+	var s struct {
+		N apiInt64 `json:"n"`
+	}
+	require.NoError(t, json.Unmarshal([]byte(`{"n": 42}`), &s))
+	assert.EqualValues(t, 42, s.N)
+
+	// proto3 JSON encodes int64 as a string; accept it too.
+	require.NoError(t, json.Unmarshal([]byte(`{"n": "64"}`), &s))
+	assert.EqualValues(t, 64, s.N)
+
+	// A null (or absent) field leaves the zero value in place: encoding/json
+	// treats UnmarshalJSON("null") as a no-op, so a fresh struct stays 0.
+	var fresh struct {
+		N apiInt64 `json:"n"`
+	}
+	require.NoError(t, json.Unmarshal([]byte(`{"n": null}`), &fresh))
+	assert.EqualValues(t, 0, fresh.N)
+}
+
+func TestPoolID(t *testing.T) {
+	// The full resource name is reduced to the bare id; a bare id is unchanged.
+	assert.Equal(t, "pool-a", poolID("provisioned-capacities/pool-a"))
+	assert.Equal(t, "pool-a", poolID("pool-a"))
+}
+
+// poolsServer serves the list and get endpoints from the given bodies. The list
+// body is returned for the collection path; getByID maps a bare id to its body
+// (missing ids return 404 RESOURCE_DOES_NOT_EXIST).
+func poolsServer(t *testing.T, listPages []string, getByID map[string]string) *httptest.Server {
+	t.Helper()
+	call := 0
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case r.URL.Path == poolsBasePath:
+			body := listPages[min(call, len(listPages)-1)]
+			call++
+			_, _ = w.Write([]byte(body))
+		case strings.HasPrefix(r.URL.Path, poolsBasePath+"/"):
+			id := strings.TrimPrefix(r.URL.Path, poolsBasePath+"/")
+			body, ok := getByID[id]
+			if !ok {
+				w.WriteHeader(http.StatusNotFound)
+				_, _ = w.Write([]byte(`{"error_code":"RESOURCE_DOES_NOT_EXIST","message":"not found"}`))
+				return
+			}
+			_, _ = w.Write([]byte(body))
+		default:
+			_, _ = w.Write([]byte(`{}`))
+		}
+	}))
+	t.Cleanup(srv.Close)
+	return srv
+}
+
+func TestListPoolsJSON(t *testing.T) {
+	// Two pages exercise the pagination loop; usage is absent on list, as the
+	// real endpoint leaves it. name arrives as the full resource name.
+	page1 := `{"provisioned_capacities":[{"name":"provisioned-capacities/pool-a","spec":{"accelerator_type":"GPU_8xH100","accelerator_count":64}}],"next_page_token":"tok2"}`
+	page2 := `{"provisioned_capacities":[{"name":"provisioned-capacities/pool-b","spec":{"accelerator_type":"GPU_1xH100","accelerator_count":"8"}}]}`
+	srv := poolsServer(t, []string{page1, page2}, nil)
+
+	var buf bytes.Buffer
+	ctx := cmdctx.SetWorkspaceClient(t.Context(), newTestWorkspaceClient(t, srv.URL))
+	ctx = cmdio.InContext(ctx, cmdio.NewIO(ctx, flags.OutputJSON, nil, &buf, &buf, "", ""))
+	cmd := withOutput(newListPoolsCommand(), flags.OutputJSON)
+	cmd.SetContext(ctx)
+
+	require.NoError(t, cmd.RunE(cmd, nil))
+
+	var got struct {
+		Data poolListData `json:"data"`
+	}
+	require.NoError(t, json.Unmarshal(buf.Bytes(), &got))
+	require.Len(t, got.Data.Rows, 2)
+	assert.Equal(t, poolRow{ID: "pool-a", AcceleratorType: "GPU_8xH100", ReservedAccelerators: 64}, got.Data.Rows[0])
+	// The second row's accelerator_count arrived as a JSON string, and the id is
+	// stripped from the resource name.
+	assert.Equal(t, "pool-b", got.Data.Rows[1].ID)
+	assert.Equal(t, int64(8), got.Data.Rows[1].ReservedAccelerators)
+}
+
+func TestListPoolsText(t *testing.T) {
+	page := `{"provisioned_capacities":[{"name":"provisioned-capacities/pool-a","spec":{"accelerator_type":"GPU_8xH100","accelerator_count":64}}]}`
+	srv := poolsServer(t, []string{page}, nil)
+
+	var buf bytes.Buffer
+	ctx := cmdctx.SetWorkspaceClient(cmdio.MockDiscard(t.Context()), newTestWorkspaceClient(t, srv.URL))
+	cmd := withOutput(newListPoolsCommand(), flags.OutputText)
+	cmd.SetContext(ctx)
+	cmd.SetOut(&buf)
+
+	require.NoError(t, cmd.RunE(cmd, nil))
+	out := buf.String()
+	assert.Contains(t, out, "ACCELERATOR")
+	assert.Contains(t, out, "pool-a")
+	assert.Contains(t, out, "GPU_8xH100")
+	assert.Contains(t, out, "64")
+}
+
+func TestListPoolsTextEmpty(t *testing.T) {
+	srv := poolsServer(t, []string{`{"provisioned_capacities":[]}`}, nil)
+
+	var buf bytes.Buffer
+	ctx := cmdctx.SetWorkspaceClient(cmdio.MockDiscard(t.Context()), newTestWorkspaceClient(t, srv.URL))
+	cmd := withOutput(newListPoolsCommand(), flags.OutputText)
+	cmd.SetContext(ctx)
+	cmd.SetOut(&buf)
+
+	require.NoError(t, cmd.RunE(cmd, nil))
+	assert.Contains(t, buf.String(), "No GPU pools found.")
+}
+
+func TestGetPoolJSON(t *testing.T) {
+	body := `{"name":"provisioned-capacities/pool-a","spec":{"accelerator_type":"GPU_8xH100","accelerator_count":64},"status":{"usage":{"used_accelerator_count":40,"idle_accelerator_count":24}}}`
+	srv := poolsServer(t, nil, map[string]string{"pool-a": body})
+
+	var buf bytes.Buffer
+	ctx := cmdctx.SetWorkspaceClient(t.Context(), newTestWorkspaceClient(t, srv.URL))
+	ctx = cmdio.InContext(ctx, cmdio.NewIO(ctx, flags.OutputJSON, nil, &buf, &buf, "", ""))
+	cmd := withOutput(newGetPoolCommand(), flags.OutputJSON)
+	cmd.SetContext(ctx)
+
+	require.NoError(t, cmd.RunE(cmd, []string{"pool-a"}))
+
+	var got struct {
+		Data poolDetailData `json:"data"`
+	}
+	require.NoError(t, json.Unmarshal(buf.Bytes(), &got))
+	assert.Equal(t, "pool-a", got.Data.ID)
+	assert.Equal(t, "GPU_8xH100", got.Data.AcceleratorType)
+	assert.Equal(t, int64(64), got.Data.ReservedAccelerators)
+	require.NotNil(t, got.Data.UsedAccelerators)
+	assert.Equal(t, int64(40), *got.Data.UsedAccelerators)
+	require.NotNil(t, got.Data.IdleAccelerators)
+	assert.Equal(t, int64(24), *got.Data.IdleAccelerators)
+}
+
+func TestGetPoolAcceptsResourceName(t *testing.T) {
+	// A full resource name argument resolves to the same GET path as the bare id.
+	body := `{"name":"provisioned-capacities/pool-a","spec":{"accelerator_type":"GPU_8xH100","accelerator_count":64},"status":{"usage":{"used_accelerator_count":1,"idle_accelerator_count":63}}}`
+	srv := poolsServer(t, nil, map[string]string{"pool-a": body})
+
+	ctx := cmdctx.SetWorkspaceClient(cmdio.MockDiscard(t.Context()), newTestWorkspaceClient(t, srv.URL))
+	cmd := withOutput(newGetPoolCommand(), flags.OutputText)
+	cmd.SetContext(ctx)
+	cmd.SetOut(&bytes.Buffer{})
+
+	require.NoError(t, cmd.RunE(cmd, []string{"provisioned-capacities/pool-a"}))
+}
+
+func TestGetPoolEscapesID(t *testing.T) {
+	// A stray "?" in the id must be PathEscaped so it stays part of the resource
+	// path rather than being parsed as a query string (which would truncate the
+	// path to "pool" and 404). The httptest server decodes %3F back to "?" in
+	// r.URL.Path, so a hit on the "pool?x" key proves the id survived intact.
+	body := `{"name":"provisioned-capacities/pool?x","spec":{"accelerator_type":"GPU_1xH100","accelerator_count":8}}`
+	srv := poolsServer(t, nil, map[string]string{"pool?x": body})
+
+	ctx := cmdctx.SetWorkspaceClient(cmdio.MockDiscard(t.Context()), newTestWorkspaceClient(t, srv.URL))
+	cmd := withOutput(newGetPoolCommand(), flags.OutputText)
+	cmd.SetContext(ctx)
+	cmd.SetOut(&bytes.Buffer{})
+
+	require.NoError(t, cmd.RunE(cmd, []string{"pool?x"}))
+}
+
+func TestGetPoolText(t *testing.T) {
+	// A pool whose usage block is absent shows N/A for the usage cells rather
+	// than a misleading zero.
+	body := `{"name":"provisioned-capacities/pool-a","spec":{"accelerator_type":"GPU_8xH100","accelerator_count":64}}`
+	srv := poolsServer(t, nil, map[string]string{"pool-a": body})
+
+	var buf bytes.Buffer
+	ctx := cmdctx.SetWorkspaceClient(cmdio.MockDiscard(t.Context()), newTestWorkspaceClient(t, srv.URL))
+	cmd := withOutput(newGetPoolCommand(), flags.OutputText)
+	cmd.SetContext(ctx)
+	cmd.SetOut(&buf)
+
+	require.NoError(t, cmd.RunE(cmd, []string{"pool-a"}))
+	out := buf.String()
+	assert.Contains(t, out, "Pool ID:                 pool-a")
+	assert.Contains(t, out, "Reserved Accelerators:   64")
+	assert.Contains(t, out, "Used Accelerators:       N/A")
+}
+
+func TestGetPoolOmitIDResolvesSolePool(t *testing.T) {
+	// With exactly one pool, `air pools get` (no id) resolves it and shows usage.
+	list := `{"provisioned_capacities":[{"name":"provisioned-capacities/pool-only","spec":{"accelerator_type":"GPU_8xH100","accelerator_count":64}}]}`
+	detail := `{"name":"provisioned-capacities/pool-only","spec":{"accelerator_type":"GPU_8xH100","accelerator_count":64},"status":{"usage":{"used_accelerator_count":40,"idle_accelerator_count":24}}}`
+	srv := poolsServer(t, []string{list}, map[string]string{"pool-only": detail})
+
+	var buf bytes.Buffer
+	ctx := cmdctx.SetWorkspaceClient(cmdio.MockDiscard(t.Context()), newTestWorkspaceClient(t, srv.URL))
+	cmd := withOutput(newGetPoolCommand(), flags.OutputText)
+	cmd.SetContext(ctx)
+	cmd.SetOut(&buf)
+
+	require.NoError(t, cmd.RunE(cmd, nil))
+	out := buf.String()
+	assert.Contains(t, out, "Pool ID:                 pool-only")
+	assert.Contains(t, out, "Used Accelerators:       40")
+}
+
+func TestGetPoolOmitIDNoPools(t *testing.T) {
+	srv := poolsServer(t, []string{`{"provisioned_capacities":[]}`}, nil)
+
+	ctx := cmdctx.SetWorkspaceClient(cmdio.MockDiscard(t.Context()), newTestWorkspaceClient(t, srv.URL))
+	cmd := withOutput(newGetPoolCommand(), flags.OutputText)
+	cmd.SetContext(ctx)
+	cmd.SetOut(&bytes.Buffer{})
+
+	err := cmd.RunE(cmd, nil)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "no GPU pools found")
+}
+
+func TestGetPoolOmitIDMultipleErrors(t *testing.T) {
+	// More than one pool: the id can't be inferred, so the error lists the ids.
+	list := `{"provisioned_capacities":[` +
+		`{"name":"provisioned-capacities/pool-a","spec":{"accelerator_type":"GPU_8xH100","accelerator_count":64}},` +
+		`{"name":"provisioned-capacities/pool-b","spec":{"accelerator_type":"GPU_1xH100","accelerator_count":8}}]}`
+	srv := poolsServer(t, []string{list}, nil)
+
+	ctx := cmdctx.SetWorkspaceClient(cmdio.MockDiscard(t.Context()), newTestWorkspaceClient(t, srv.URL))
+	cmd := withOutput(newGetPoolCommand(), flags.OutputText)
+	cmd.SetContext(ctx)
+	cmd.SetOut(&bytes.Buffer{})
+
+	err := cmd.RunE(cmd, nil)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "specify one of: pool-a, pool-b")
+}
+
+func TestGetPoolEmptyID(t *testing.T) {
+	ctx := cmdctx.SetWorkspaceClient(cmdio.MockDiscard(t.Context()), newTestWorkspaceClient(t, "https://example.com"))
+	cmd := withOutput(newGetPoolCommand(), flags.OutputText)
+	cmd.SetContext(ctx)
+
+	err := cmd.RunE(cmd, []string{"   "})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "cannot be empty")
+}
+
+func TestListPoolsFeatureDisabledJSON(t *testing.T) {
+	// The SAFE-gated handler reports FEATURE_DISABLED before rollout; it must be
+	// a permanent, non-retryable error, not a transient one.
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusForbidden)
+		_, _ = w.Write([]byte(`{"error_code":"FEATURE_DISABLED","message":"The provisioned capacity API is not yet enabled."}`))
+	}))
+	t.Cleanup(srv.Close)
+
+	var buf bytes.Buffer
+	ctx := cmdctx.SetWorkspaceClient(t.Context(), newTestWorkspaceClient(t, srv.URL))
+	ctx = cmdio.InContext(ctx, cmdio.NewIO(ctx, flags.OutputJSON, nil, &buf, &buf, "", ""))
+	cmd := withOutput(newListPoolsCommand(), flags.OutputJSON)
+	cmd.SetContext(ctx)
+
+	err := cmd.RunE(cmd, nil)
+	require.ErrorIs(t, err, root.ErrAlreadyPrinted)
+
+	var got errorEnvelope
+	require.NoError(t, json.Unmarshal(buf.Bytes(), &got))
+	assert.Equal(t, "FEATURE_DISABLED", got.Error.Code)
+	assert.False(t, got.Error.Retryable)
+	assert.Contains(t, got.Error.Message, "not enabled for this workspace")
+}
+
+func TestGetPoolNotFoundJSON(t *testing.T) {
+	srv := poolsServer(t, nil, map[string]string{})
+
+	var buf bytes.Buffer
+	ctx := cmdctx.SetWorkspaceClient(t.Context(), newTestWorkspaceClient(t, srv.URL))
+	ctx = cmdio.InContext(ctx, cmdio.NewIO(ctx, flags.OutputJSON, nil, &buf, &buf, "", ""))
+	cmd := withOutput(newGetPoolCommand(), flags.OutputJSON)
+	cmd.SetContext(ctx)
+
+	err := cmd.RunE(cmd, []string{"missing"})
+	require.ErrorIs(t, err, root.ErrAlreadyPrinted)
+
+	var got errorEnvelope
+	require.NoError(t, json.Unmarshal(buf.Bytes(), &got))
+	assert.Equal(t, "NOT_FOUND", got.Error.Code)
+	assert.Contains(t, got.Error.Message, `GPU pool "missing" not found`)
+}
+
+func TestGetPoolPlain404(t *testing.T) {
+	// A bare HTTP 404 (no RESOURCE_DOES_NOT_EXIST error code) must still map to
+	// NOT_FOUND, since apierr.ErrNotFound covers any 404.
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusNotFound)
+		_, _ = w.Write([]byte(`{"message":"no such thing"}`))
+	}))
+	t.Cleanup(srv.Close)
+
+	var buf bytes.Buffer
+	ctx := cmdctx.SetWorkspaceClient(t.Context(), newTestWorkspaceClient(t, srv.URL))
+	ctx = cmdio.InContext(ctx, cmdio.NewIO(ctx, flags.OutputJSON, nil, &buf, &buf, "", ""))
+	cmd := withOutput(newGetPoolCommand(), flags.OutputJSON)
+	cmd.SetContext(ctx)
+
+	err := cmd.RunE(cmd, []string{"pool-x"})
+	require.ErrorIs(t, err, root.ErrAlreadyPrinted)
+
+	var got errorEnvelope
+	require.NoError(t, json.Unmarshal(buf.Bytes(), &got))
+	assert.Equal(t, "NOT_FOUND", got.Error.Code)
+}
diff --git a/cmd/air/profile.go b/cmd/air/profile.go
new file mode 100644
index 00000000000..19d19904202
--- /dev/null
+++ b/cmd/air/profile.go
@@ -0,0 +1,36 @@
+package aircmd
+
+import (
+	"errors"
+	"io/fs"
+
+	"github.com/databricks/cli/libs/databrickscfg"
+	"github.com/databricks/databricks-sdk-go/config"
+)
+
+// profileValue returns a property from the selected configuration profile. An
+// empty profile name uses the configured default-profile resolution order.
+func profileValue(cfg *config.Config, key string) (string, error) {
+	file, err := config.LoadFile(cfg.ConfigFile)
+	if err != nil {
+		if errors.Is(err, fs.ErrNotExist) {
+			return "", nil
+		}
+		return "", err
+	}
+	profile := cfg.Profile
+	if profile == "" {
+		profile = databrickscfg.GetDefaultProfileFrom(file)
+	}
+	if profile == "" {
+		return "", nil
+	}
+	if !file.HasSection(profile) {
+		return "", nil
+	}
+	section := file.Section(profile)
+	if !section.HasKey(key) {
+		return "", nil
+	}
+	return section.Key(key).Value(), nil
+}
diff --git a/cmd/air/profile_test.go b/cmd/air/profile_test.go
new file mode 100644
index 00000000000..4d1d7de79a5
--- /dev/null
+++ b/cmd/air/profile_test.go
@@ -0,0 +1,56 @@
+package aircmd
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/databricks/databricks-sdk-go/config"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestProfileValue(t *testing.T) {
+	path := filepath.Join(t.TempDir(), ".databrickscfg")
+	require.NoError(t, os.WriteFile(path, []byte(`
+[__settings__]
+default_profile = second
+
+[first]
+host = https://first.test
+databricks_internal_user_workspace_dir = /Workspace/first
+
+[second]
+host = https://second.test
+databricks_internal_user_workspace_dir = /Workspace/second
+`), 0o600))
+
+	value, err := profileValue(&config.Config{ConfigFile: path, Profile: "first"}, "databricks_internal_user_workspace_dir")
+	require.NoError(t, err)
+	assert.Equal(t, "/Workspace/first", value)
+
+	value, err = profileValue(&config.Config{ConfigFile: path}, "databricks_internal_user_workspace_dir")
+	require.NoError(t, err)
+	assert.Equal(t, "/Workspace/second", value)
+
+	value, err = profileValue(&config.Config{ConfigFile: path, Profile: "missing"}, "databricks_internal_user_workspace_dir")
+	require.NoError(t, err)
+	assert.Empty(t, value)
+
+	value, err = profileValue(&config.Config{ConfigFile: path, Profile: "first"}, "missing")
+	require.NoError(t, err)
+	assert.Empty(t, value)
+}
+
+func TestProfileValueSingleProfileDefault(t *testing.T) {
+	path := filepath.Join(t.TempDir(), ".databrickscfg")
+	require.NoError(t, os.WriteFile(path, []byte(`
+[only]
+host = https://only.test
+databricks_internal_user_workspace_dir = /Workspace/only
+`), 0o600))
+
+	value, err := profileValue(&config.Config{ConfigFile: path}, "databricks_internal_user_workspace_dir")
+	require.NoError(t, err)
+	assert.Equal(t, "/Workspace/only", value)
+}
diff --git a/cmd/air/render.go b/cmd/air/render.go
new file mode 100644
index 00000000000..f7a96f27b26
--- /dev/null
+++ b/cmd/air/render.go
@@ -0,0 +1,449 @@
+package aircmd
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net/http"
+	"strconv"
+	"strings"
+
+	"github.com/charmbracelet/lipgloss"
+	"github.com/databricks/cli/libs/auth"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/client"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/muesli/termenv"
+	"go.yaml.in/yaml/v3"
+)
+
+// Box titles, rendered into the top border of each box.
+const (
+	configBoxTitle   = "Configuration"
+	metadataBoxTitle = "Metadata"
+)
+
+// jobsRunsGetPath is the Jobs GetRun endpoint, called with a raw request to read
+// the run's environments[] block, which the typed SDK Run does not expose.
+const jobsRunsGetPath = "/api/2.2/jobs/runs/get"
+
+// minBoxInnerWidth keeps all boxes a uniform, comfortable width; boxHPad and
+// boxVPad are the horizontal and vertical padding inside each box.
+const (
+	minBoxInnerWidth = 60
+	boxHPad          = 2
+	boxVPad          = 1
+)
+
+// palette holds the lipgloss styles for the single-run view. Two layers: a
+// neutral ramp for chrome and text, and an accent palette for syntax and data.
+// All styles come from one renderer, so they honor its color profile (Ascii
+// under --no-color / non-TTY, which strips every escape).
+type palette struct {
+	n7  lipgloss.Style // dim: block indicator, empty progress, command-block "|"
+	n8  lipgloss.Style // muted: field labels
+	n12 lipgloss.Style // content: config and metadata values, percent
+
+	border lipgloss.Style // box borders and titles
+
+	blue  lipgloss.Style // yaml keys and hyperlinks
+	green lipgloss.Style // success status and progress fill
+	amber lipgloss.Style // in-progress status
+	red   lipgloss.Style // failed status
+}
+
+func newPalette(r *lipgloss.Renderer) palette {
+	fg := func(hex string) lipgloss.Style { return r.NewStyle().Foreground(lipgloss.Color(hex)) }
+	return palette{
+		n7:     fg("#6E6E70"),
+		n8:     fg("#8C8A86"),
+		n12:    fg("#F9F7F4"), // Oat Light
+		border: fg("#B7A8E8"), // light purple (box borders and titles)
+		blue:   fg("#8FB3DC"),
+		green:  fg("#74C39A"),
+		amber:  fg("#DCAA5C"),
+		red:    fg("#D9756B"),
+	}
+}
+
+// runView is the resolved, display-ready data the renderer draws. It is built
+// from getData plus the MLflow enrichment, so the renderer itself does no API
+// calls or formatting decisions.
+type runView struct {
+	runID        string
+	dashboardURL string
+	status       string
+	submitted    string
+	retries      int
+	maxRetries   string
+	duration     string
+	progress     string
+	experiment   string
+	mlflowLabel  string
+	mlflowURL    string
+	user         string
+	accelerators string
+	environment  string
+}
+
+// renderRunText writes the styled single-run view: a training-config box, a
+// completed progress bar, and a field list, separated by blank lines. It is a
+// one-shot renderer — it builds the full string and writes it once, with no
+// streaming, spinner, or redraw.
+func renderRunText(ctx context.Context, out io.Writer, w *databricks.WorkspaceClient, run *jobs.Run, data *getData, ids *mlflowIdentifiers) {
+	// cmdio.NewRenderer sets the Ascii color profile when color is off, which
+	// emits no SGR codes; combined with the link fallback below this gives clean,
+	// un-escaped output under --no-color / NO_COLOR / piped stdout.
+	renderer, colorOn := cmdio.NewRenderer(ctx, out)
+	p := newPalette(renderer)
+
+	// The serverless environment version lives on the run's environments[].spec,
+	// which the typed SDK Run drops, so read it with a raw request. Empty (a run
+	// with no serverless environment) stays "N/A".
+	data.EnvironmentDisplay = orNA(aiRuntimeEnvironmentVersion(ctx, w, run.RunId))
+
+	view := runView{
+		runID:        data.RunID,
+		dashboardURL: data.DashboardURL,
+		status:       data.Status,
+		submitted:    data.SubmittedDisplay,
+		retries:      data.AttemptNumber,
+		maxRetries:   data.MaxRetriesDisplay,
+		duration:     data.DurationDisplay,
+		progress:     data.ProgressDisplay,
+		experiment:   data.ExperimentDisplay,
+		mlflowLabel:  na,
+		user:         data.UserDisplay,
+		accelerators: data.AcceleratorsDisplay,
+		environment:  data.EnvironmentDisplay,
+	}
+	if data.DisplayStatus != "" {
+		view.status = data.DisplayStatus
+	}
+
+	if ids != nil {
+		view.mlflowLabel = mlflowRunLabel(fetchMLflowRunName(ctx, w, ids.RunID), ids.RunID)
+		view.mlflowURL = mlflowRunURL(w.Config.Host, ids)
+	}
+
+	var sections []string
+	if body := colorizeConfig(p, resolveConfigYAML(ctx, w, run, data)); body != "" {
+		sections = append(sections, renderBox(p, configBoxTitle, body))
+	}
+	sections = append(sections, renderBox(p, metadataBoxTitle, renderFields(p, colorOn, view)))
+	if data.TerminationReason != nil {
+		sections = append(sections, p.red.Render("Failure reason: ")+p.n12.Render(*data.TerminationReason))
+	}
+
+	// A single write: a blank line before the first box and after the last, and
+	// one between each box.
+	fmt.Fprintf(out, "\n%s\n\n", strings.Join(sections, "\n\n"))
+
+	// Bare-URL footer so the job run / MLflow links remain reachable when
+	// stdout is not a hyperlink-capable terminal (piped, redirected, NO_COLOR).
+	// In that case the OSC 8 hyperlinks on the Run ID / MLflow Run cells
+	// degrade to plain labels and the URLs would otherwise disappear from text
+	// output, breaking workflows like `air get X > out.txt` or
+	// `NO_COLOR=1 air get X` that the previous `Job Link:` line supported.
+	if view.dashboardURL != "" {
+		fmt.Fprintf(out, "Run URL:    %s\n", view.dashboardURL)
+	}
+	if view.mlflowURL != "" {
+		fmt.Fprintf(out, "MLflow URL: %s\n", view.mlflowURL)
+	}
+}
+
+// genAIComputeTask returns the run's first GenAI-compute task, or nil.
+func genAIComputeTask(run *jobs.Run) *jobs.GenAiComputeTask {
+	if len(run.Tasks) == 0 {
+		return nil
+	}
+	return run.Tasks[0].GenAiComputeTask
+}
+
+// aiRuntimeEnvironmentVersion returns the serverless environment version an
+// ai_runtime run used (e.g. "4"), read from the Jobs GetRun response's
+// environments[] entry keyed by aiRuntimeEnvironmentKey. The typed SDK Run has
+// no environments field, so the value is fetched with a raw request. Best-effort:
+// returns "" (logged) on any error or when the run declares no environment.
+func aiRuntimeEnvironmentVersion(ctx context.Context, w *databricks.WorkspaceClient, runID int64) string {
+	apiClient, err := client.New(w.Config)
+	if err != nil {
+		log.Warnf(ctx, "air get: could not create client to read environment: %v", err)
+		return ""
+	}
+	var resp struct {
+		Environments []struct {
+			EnvironmentKey string `json:"environment_key"`
+			Spec           struct {
+				EnvironmentVersion string `json:"environment_version"`
+			} `json:"spec"`
+		} `json:"environments"`
+	}
+	// For a GET the SDK serializes the request value into query parameters, so
+	// run_id is passed as the request, mirroring the other raw calls in this package.
+	query := map[string]any{"run_id": runID}
+	if err := apiClient.Do(ctx, http.MethodGet, jobsRunsGetPath, auth.WorkspaceIDHeaders(w.Config), nil, query, &resp); err != nil {
+		log.Warnf(ctx, "air get: could not read environment for run %d: %v", runID, err)
+		return ""
+	}
+	for _, e := range resp.Environments {
+		if e.EnvironmentKey == aiRuntimeEnvironmentKey {
+			return e.Spec.EnvironmentVersion
+		}
+	}
+	return ""
+}
+
+// resolveConfigYAML returns the config box body: from the downloaded config file
+// when we have its path, else from the legacy task.
+func resolveConfigYAML(ctx context.Context, w *databricks.WorkspaceClient, run *jobs.Run, data *getData) string {
+	if data.TrainingConfigPath != "" {
+		if raw := downloadConfig(ctx, w, data.TrainingConfigPath); len(raw) > 0 {
+			return strings.TrimRight(reformatYAMLForDisplay(raw), "\n")
+		}
+	}
+	if task := genAIComputeTask(run); task != nil {
+		return configYAML(ctx, w, task)
+	}
+	return ""
+}
+
+// configYAML returns the run's resolved training config as YAML for the box. The
+// full config (including the command/script) lives in the run's parameters, not
+// the structured task fields, so we prefer the inline parameters, then the
+// parameters file, and only synthesize a minimal config as a last resort.
+func configYAML(ctx context.Context, w *databricks.WorkspaceClient, task *jobs.GenAiComputeTask) string {
+	if task.YamlParameters != "" {
+		return strings.TrimRight(reformatYAMLForDisplay([]byte(task.YamlParameters)), "\n")
+	}
+	if task.YamlParametersFilePath != "" {
+		if raw := downloadConfig(ctx, w, task.YamlParametersFilePath); len(raw) > 0 {
+			return strings.TrimRight(reformatYAMLForDisplay(raw), "\n")
+		}
+	}
+	return synthConfigYAML(task)
+}
+
+// downloadConfig fetches the run's training-config file, returning nil on
+// failure (logged as a warning). Best-effort, like the rest of the enrichment.
+func downloadConfig(ctx context.Context, w *databricks.WorkspaceClient, path string) []byte {
+	r, err := w.Workspace.Download(ctx, path)
+	if err != nil {
+		log.Warnf(ctx, "air get: could not download training config %s: %v", path, err)
+		return nil
+	}
+	defer r.Close()
+	content, err := io.ReadAll(r)
+	if err != nil {
+		log.Warnf(ctx, "air get: could not read training config %s: %v", path, err)
+		return nil
+	}
+	return content
+}
+
+// configBox describes the synthesized config we marshal when the run exposes no
+// parameters, in the order the fields are shown.
+type configBox struct {
+	ExperimentName string         `yaml:"experiment_name,omitempty"`
+	Compute        *configCompute `yaml:"compute,omitempty"`
+}
+
+type configCompute struct {
+	AcceleratorType string `yaml:"accelerator_type,omitempty"`
+	NumAccelerators int    `yaml:"num_accelerators,omitempty"`
+}
+
+// synthConfigYAML builds a minimal config from the structured task fields. It
+// omits the command, which is only available in the run parameters.
+func synthConfigYAML(task *jobs.GenAiComputeTask) string {
+	cfg := configBox{}
+	if task.MlflowExperimentName != "" {
+		cfg.ExperimentName = stripExperimentUserPrefix(task.MlflowExperimentName)
+	}
+	if task.Compute != nil && task.Compute.NumGpus > 0 {
+		cfg.Compute = &configCompute{
+			AcceleratorType: task.Compute.GpuType,
+			NumAccelerators: task.Compute.NumGpus,
+		}
+	}
+	if cfg.ExperimentName == "" && cfg.Compute == nil {
+		return ""
+	}
+	b, err := yaml.Marshal(cfg)
+	if err != nil {
+		return ""
+	}
+	return strings.TrimRight(reformatYAMLForDisplay(b), "\n")
+}
+
+// colorizeConfig styles a YAML config block line by line.
+func colorizeConfig(p palette, body string) string {
+	if body == "" {
+		return ""
+	}
+	lines := strings.Split(body, "\n")
+	for i, line := range lines {
+		lines[i] = colorizeConfigLine(p, line)
+	}
+	return strings.Join(lines, "\n")
+}
+
+// colorizeConfigLine colors one YAML line: keys blue, the `|` block indicator
+// dim, and every value (and the command body that isn't a `key:` pair) in the
+// neutral content color.
+func colorizeConfigLine(p palette, line string) string {
+	indent := line[:len(line)-len(strings.TrimLeft(line, " "))]
+	trimmed := strings.TrimLeft(line, " ")
+
+	if i := strings.IndexByte(trimmed, ':'); i > 0 && isConfigKey(trimmed[:i]) {
+		key := trimmed[:i]
+		value := strings.TrimSpace(trimmed[i+1:])
+		styled := indent + p.blue.Render(key+":")
+		switch value {
+		case "":
+			// A mapping parent such as "compute:" has no value of its own.
+		case "|":
+			styled += " " + p.n7.Render(value)
+		default:
+			styled += " " + p.n12.Render(value)
+		}
+		return styled
+	}
+	return indent + p.n12.Render(trimmed)
+}
+
+// isConfigKey reports whether s is a bare YAML key (lowercase, digits, and
+// underscores). It guards against treating a colon inside a command body as a
+// key/value separator.
+func isConfigKey(s string) bool {
+	if s == "" {
+		return false
+	}
+	for _, r := range s {
+		if r != '_' && (r < 'a' || r > 'z') && (r < '0' || r > '9') {
+			return false
+		}
+	}
+	return true
+}
+
+// renderBox draws a rounded-border box around body, with title rendered into the
+// top border in the border color. body lines are padded to the widest one (or
+// minBoxInnerWidth), with boxHPad columns and boxVPad rows of padding inside.
+func renderBox(p palette, title, body string) string {
+	border := lipgloss.RoundedBorder()
+	lines := strings.Split(body, "\n")
+	pad := strings.Repeat(" ", boxHPad)
+
+	titleWidth := lipgloss.Width(title)
+	inner := max(minBoxInnerWidth, titleWidth+2)
+	for _, line := range lines {
+		inner = max(inner, lipgloss.Width(line))
+	}
+
+	left := p.border.Render(border.Left)
+	right := p.border.Render(border.Right)
+	blank := left + strings.Repeat(" ", inner+2*boxHPad) + right
+
+	var b strings.Builder
+	// Top: ╭─ <title> ──…──╮. The dash count makes the row width match the body,
+	// accounting for the boxHPad columns on each side.
+	trailing := inner + 2*boxHPad - titleWidth - 3
+	b.WriteString(p.border.Render(border.TopLeft + border.Top))
+	b.WriteString(" " + p.border.Render(title) + " ")
+	b.WriteString(p.border.Render(strings.Repeat(border.Top, trailing) + border.TopRight))
+	b.WriteByte('\n')
+
+	for range boxVPad {
+		b.WriteString(blank + "\n")
+	}
+	for _, line := range lines {
+		fill := strings.Repeat(" ", inner-lipgloss.Width(line))
+		b.WriteString(left + pad + line + fill + pad + right)
+		b.WriteByte('\n')
+	}
+	for range boxVPad {
+		b.WriteString(blank + "\n")
+	}
+
+	b.WriteString(p.border.Render(border.BottomLeft + strings.Repeat(border.Bottom, inner+2*boxHPad) + border.BottomRight))
+	return b.String()
+}
+
+// renderFields draws the two-column summary: muted labels right-padded to the
+// longest one, neutral values, a status-colored Status, and blue Run ID / MLflow
+// Run hyperlinks.
+func renderFields(p palette, colorOn bool, v runView) string {
+	status := statusStyle(p, v.status).Render("● " + v.status)
+	rows := []string{
+		field(p, "Run ID", link(colorOn, p.blue, v.runID, v.dashboardURL)),
+		field(p, "Status", status),
+		field(p, "Submitted", p.n12.Render(v.submitted)),
+		field(p, "Retries", p.n12.Render(strconv.Itoa(v.retries))),
+		field(p, "Max Retries", p.n12.Render(v.maxRetries)),
+		field(p, "Duration", p.n12.Render(v.duration)),
+	}
+	// Progress is shown only for a running run we could estimate; amber marks it
+	// as live, in-progress information.
+	if v.progress != "" {
+		rows = append(rows, field(p, "Progress", p.amber.Render(v.progress)))
+	}
+	rows = append(rows,
+		field(p, "Experiment", p.n12.Render(v.experiment)),
+		field(p, "MLflow Run", link(colorOn, p.blue, v.mlflowLabel, v.mlflowURL)),
+		field(p, "User", p.n12.Render(v.user)),
+		field(p, "Accelerators", p.n12.Render(v.accelerators)),
+		field(p, "Environment", p.n12.Render(v.environment)),
+	)
+	return strings.Join(rows, "\n")
+}
+
+// fieldLabelWidth is the width of the longest label ("Accelerators"), so values
+// line up in a single column.
+const fieldLabelWidth = len("Accelerators")
+
+func field(p palette, label, value string) string {
+	return p.n8.Render(label+strings.Repeat(" ", fieldLabelWidth-len(label))) + "  " + value
+}
+
+// link renders label as an OSC 8 terminal hyperlink to url in the given style
+// (underlined). With color off (or no url) it is just the styled label so the
+// box stays aligned; the URLs remain available in JSON output.
+func link(colorOn bool, style lipgloss.Style, label, url string) string {
+	if !colorOn || url == "" {
+		return style.Render(label)
+	}
+	// Wrap the already-styled label in the hyperlink. Passing the OSC 8 escape
+	// through lipgloss.Render instead corrupts it: lipgloss re-styles each rune
+	// and splits the "\x1b]8;;" introducer, so the terminal can't parse the
+	// sequence and prints it literally.
+	return termenv.Hyperlink(url, style.Underline(true).Render(label))
+}
+
+// statusStyle maps a run status to its accent color: green for success, red for
+// terminal failures, amber for everything still in flight.
+func statusStyle(p palette, status string) lipgloss.Style {
+	switch {
+	case isSuccessStatus(status):
+		return p.green
+	case isFailedStatus(status):
+		return p.red
+	default:
+		return p.amber
+	}
+}
+
+func isSuccessStatus(status string) bool {
+	return status == "SUCCESS"
+}
+
+func isFailedStatus(status string) bool {
+	switch status {
+	case "FAILED", "TIMEDOUT", "CANCELED", "INTERNAL_ERROR", "UPSTREAM_FAILED", "UPSTREAM_CANCELED":
+		return true
+	}
+	return false
+}
diff --git a/cmd/air/render_test.go b/cmd/air/render_test.go
new file mode 100644
index 00000000000..66e5b09deb7
--- /dev/null
+++ b/cmd/air/render_test.go
@@ -0,0 +1,189 @@
+package aircmd
+
+import (
+	"io"
+	"strings"
+	"testing"
+
+	"github.com/charmbracelet/lipgloss"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/databricks-sdk-go/experimental/mocks"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/muesli/termenv"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+)
+
+// asciiPalette returns a palette whose styles emit no escape codes, so render
+// output is plain text and assertions stay readable.
+func asciiPalette(t *testing.T) palette {
+	r, _ := cmdio.NewRenderer(cmdio.MockDiscard(t.Context()), io.Discard)
+	return newPalette(r)
+}
+
+func TestConfigYAML(t *testing.T) {
+	ctx := t.Context()
+
+	t.Run("inline parameters include the command as a block literal", func(t *testing.T) {
+		task := &jobs.GenAiComputeTask{
+			YamlParameters: "experiment_name: my-exp\ncompute:\n  accelerator_type: a10\n  num_accelerators: 1\ncommand: \"for i in $(seq 1 3); do echo $i; done\\n\"\n",
+		}
+		got := configYAML(ctx, mocks.NewMockWorkspaceClient(t).WorkspaceClient, task)
+		assert.Contains(t, got, "experiment_name: my-exp")
+		assert.Contains(t, got, "accelerator_type: a10")
+		assert.Contains(t, got, "command: |")
+		assert.Contains(t, got, "  for i in $(seq 1 3); do echo $i; done")
+	})
+
+	t.Run("downloads the parameters file when there are no inline parameters", func(t *testing.T) {
+		m := mocks.NewMockWorkspaceClient(t)
+		m.GetMockWorkspaceAPI().EXPECT().
+			Download(mock.Anything, "/Workspace/cfg.yaml").
+			Return(io.NopCloser(strings.NewReader("experiment_name: from-file\n")), nil)
+		task := &jobs.GenAiComputeTask{YamlParametersFilePath: "/Workspace/cfg.yaml"}
+		assert.Equal(t, "experiment_name: from-file", configYAML(ctx, m.WorkspaceClient, task))
+	})
+
+	t.Run("falls back to a synthesized config", func(t *testing.T) {
+		task := &jobs.GenAiComputeTask{
+			MlflowExperimentName: "/Users/me@example.com/exp",
+			Compute:              &jobs.ComputeConfig{GpuType: "a10", NumGpus: 1},
+		}
+		got := configYAML(ctx, mocks.NewMockWorkspaceClient(t).WorkspaceClient, task)
+		assert.Contains(t, got, "experiment_name: exp")
+		assert.NotContains(t, got, "command")
+	})
+}
+
+func TestResolveConfigYAML(t *testing.T) {
+	ctx := t.Context()
+
+	t.Run("downloads the training config path for new runs", func(t *testing.T) {
+		m := mocks.NewMockWorkspaceClient(t)
+		m.GetMockWorkspaceAPI().EXPECT().
+			Download(mock.Anything, "/Workspace/run/training_config.yaml").
+			Return(io.NopCloser(strings.NewReader("experiment_name: from-air\n")), nil)
+		run := &jobs.Run{Tasks: []jobs.RunTask{{}}}
+		data := &getData{TrainingConfigPath: "/Workspace/run/training_config.yaml"}
+		assert.Equal(t, "experiment_name: from-air", resolveConfigYAML(ctx, m.WorkspaceClient, run, data))
+	})
+
+	t.Run("falls back to the legacy task when no path is set", func(t *testing.T) {
+		run := &jobs.Run{Tasks: []jobs.RunTask{{GenAiComputeTask: &jobs.GenAiComputeTask{
+			MlflowExperimentName: "/Users/me@example.com/exp",
+		}}}}
+		got := resolveConfigYAML(ctx, mocks.NewMockWorkspaceClient(t).WorkspaceClient, run, &getData{})
+		assert.Contains(t, got, "experiment_name: exp")
+	})
+
+	t.Run("empty when neither source is present", func(t *testing.T) {
+		run := &jobs.Run{Tasks: []jobs.RunTask{{}}}
+		assert.Empty(t, resolveConfigYAML(ctx, mocks.NewMockWorkspaceClient(t).WorkspaceClient, run, &getData{}))
+	})
+}
+
+func TestSynthConfigYAML(t *testing.T) {
+	task := &jobs.GenAiComputeTask{
+		MlflowExperimentName: "/Users/me@example.com/stream-latency-test",
+		Compute:              &jobs.ComputeConfig{GpuType: "a10", NumGpus: 1},
+	}
+	// The accelerator_type uses the raw GPU type; the command is omitted because
+	// it lives only in the run parameters.
+	want := "experiment_name: stream-latency-test\n" +
+		"compute:\n" +
+		"  accelerator_type: a10\n" +
+		"  num_accelerators: 1"
+	assert.Equal(t, want, synthConfigYAML(task))
+	assert.Empty(t, synthConfigYAML(&jobs.GenAiComputeTask{}))
+}
+
+func TestColorizeConfigLine(t *testing.T) {
+	p := asciiPalette(t)
+	// Under the Ascii profile colorization adds no escapes, so each line is
+	// preserved verbatim (indentation included) regardless of its role.
+	for _, line := range []string{
+		"experiment_name: stream-latency-test",
+		"compute:",
+		"  accelerator_type: a10",
+		"  num_accelerators: 1",
+		"command: |",
+		`  for i in $(seq 1 10); do echo "step $i"; done`,
+	} {
+		assert.Equal(t, line, colorizeConfigLine(p, line))
+	}
+}
+
+func TestIsConfigKey(t *testing.T) {
+	assert.True(t, isConfigKey("experiment_name"))
+	assert.True(t, isConfigKey("num_accelerators"))
+	assert.False(t, isConfigKey(""))
+	assert.False(t, isConfigKey("for i in $(seq 1 10); do echo "))
+	assert.False(t, isConfigKey("Command"))
+}
+
+func TestRenderBox(t *testing.T) {
+	p := asciiPalette(t)
+	out := renderBox(p, configBoxTitle, "experiment_name: stream-latency-test\ncompute:")
+	lines := strings.Split(out, "\n")
+
+	// Title sits in the top border; corners are rounded; every row is the same width.
+	assert.Contains(t, lines[0], "╭─ "+configBoxTitle+" ")
+	assert.True(t, strings.HasSuffix(lines[0], "╮"))
+	assert.True(t, strings.HasPrefix(lines[len(lines)-1], "╰"))
+	assert.Contains(t, out, "│  experiment_name: stream-latency-test")
+
+	width := lipgloss.Width(lines[0])
+	for _, l := range lines {
+		assert.Equal(t, width, lipgloss.Width(l))
+	}
+}
+
+func TestRenderFields(t *testing.T) {
+	p := asciiPalette(t)
+	out := renderFields(p, false, runView{
+		runID:        "836121283738861",
+		dashboardURL: "https://h.test/jobs/runs/836121283738861",
+		status:       "SUCCESS",
+		submitted:    "2026-06-03 04:17 UTC",
+		retries:      0,
+		maxRetries:   "3",
+		duration:     "1m 13s",
+		experiment:   "stream-latency-test",
+		mlflowLabel:  "stream-latency-test",
+		mlflowURL:    "https://h.test/ml/experiments/E1/runs/R1",
+		user:         "user@example.com",
+		accelerators: "1x A10",
+		environment:  "4",
+	})
+
+	// Labels are padded to the longest ("Accelerators"), so values align.
+	assert.Contains(t, out, "Run ID        ")
+	assert.Contains(t, out, "Accelerators  1x A10")
+	// Max retries and environment show alongside the other fields.
+	assert.Contains(t, out, "Max Retries   3")
+	assert.Contains(t, out, "Environment   4")
+	// The status carries its dot prefix.
+	assert.Contains(t, out, "● SUCCESS")
+	// Off a terminal, links render as the bare label (URLs live in JSON output).
+	assert.Contains(t, out, "Run ID        836121283738861")
+	assert.NotContains(t, out, "https://h.test")
+	// The field list is a tight block: no blank lines.
+	assert.NotContains(t, out, "\n\n")
+}
+
+func TestLink(t *testing.T) {
+	p := asciiPalette(t)
+	// Color off: the bare label, no URL.
+	assert.Equal(t, "label", link(false, p.blue, "label", "https://h.test"))
+	assert.Equal(t, "label", link(false, p.blue, "label", ""))
+	// With color on, the label is wrapped in an OSC 8 hyperlink to the url.
+	assert.Contains(t, link(true, p.blue, "label", "https://h.test"), termenv.Hyperlink("https://h.test", "label"))
+}
+
+func TestStatusStyleSelectors(t *testing.T) {
+	assert.True(t, isSuccessStatus("SUCCESS"))
+	assert.False(t, isSuccessStatus("RUNNING"))
+	assert.True(t, isFailedStatus("FAILED"))
+	assert.True(t, isFailedStatus("TIMEDOUT"))
+	assert.False(t, isFailedStatus("RUNNING"))
+}
diff --git a/cmd/air/run.go b/cmd/air/run.go
new file mode 100644
index 00000000000..c8027b09e9a
--- /dev/null
+++ b/cmd/air/run.go
@@ -0,0 +1,371 @@
+package aircmd
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/signal"
+	"strconv"
+	"strings"
+	"time"
+	"unicode/utf8"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/cli/libs/shellquote"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/spf13/cobra"
+)
+
+// dryRunValidationTimeout bounds only the config:validate request.
+const dryRunValidationTimeout = 15 * time.Second
+
+// runResult is the JSON payload for `air run`.
+type runResult struct {
+	Status       string `json:"status"`
+	DryRun       bool   `json:"dry_run,omitempty"`
+	RunID        string `json:"run_id,omitempty"`
+	DashboardURL string `json:"dashboard_url,omitempty"`
+}
+
+const experimentalContainersWarning = `+--------------------------------------------------------------------+
+| WARNING: EXPERIMENTAL FEATURE                                      |
+|                                                                    |
+| This feature is experimental and may change without notice,        |
+| including changes that could break existing workflows.             |
+| Use it only if you accept these risks.                             |
++--------------------------------------------------------------------+`
+
+func warnExperimentalContainers(ctx context.Context, cfg *runConfig) {
+	if len(cfg.Containers) > 0 {
+		cmdio.LogString(ctx, experimentalContainersWarning)
+	}
+}
+
+// validateDryRunInWorkspace keeps caller errors distinct from service failures.
+func validateDryRunInWorkspace(ctx context.Context, cmd *cobra.Command, args []string, cfg *runConfig, idempotencyToken string, timeout time.Duration) (context.Context, error) {
+	if !cmdctx.HasWorkspaceClient(ctx) {
+		if err := root.MustWorkspaceClient(cmd, args); err != nil {
+			return ctx, err
+		}
+		ctx = cmd.Context()
+	}
+
+	w := cmdctx.WorkspaceClient(ctx)
+	_, funcDir, commandPath, err := prospectiveLaunchPaths(ctx, w, cfg)
+	if err != nil {
+		unavailable, retryable := classifyValidationFailure(err)
+		if !unavailable {
+			return ctx, err
+		}
+		return ctx, asValidationUnavailable(err, retryable)
+	}
+
+	return ctx, validateDryRunConfig(ctx, w, cfg, commandPath, submittedContainers(cfg, funcDir), idempotencyToken, timeout)
+}
+
+func newRunCommand() *cobra.Command {
+	return newRunCommandWithValidationTimeout(dryRunValidationTimeout)
+}
+
+func newRunCommandWithValidationTimeout(validationTimeout time.Duration) *cobra.Command {
+	var (
+		file           string
+		watch          bool
+		overrides      []string
+		dryRun         bool
+		idempotencyKey string
+	)
+
+	cmd := &cobra.Command{
+		Use:   "run",
+		Args:  root.NoArgs,
+		Short: "Submit a training workload from a YAML config",
+		Long: `Submit a training workload to Databricks serverless GPU compute.
+
+The workload is described by a YAML config file (see --file).
+
+To look up a config field, pass its path to -h:
+
+  databricks air run -h config
+  databricks air run -h config.compute
+  databricks air run -h config.compute.accelerator_type
+
+The path must be a separate argument: cobra reserves -h as a boolean, so
+-h=config.compute and -hconfig.compute are not accepted.`,
+	}
+
+	// cobra passes -h's positional args to the help func before Args/required-flag
+	// validation, so a config path documents a field without needing -f.
+	cmd.SetHelpFunc(func(c *cobra.Command, args []string) {
+		fields := c.Flags().Args()
+		if len(fields) == 0 {
+			// Parent() is nil for a detached command (unit tests).
+			if parent := c.Parent(); parent != nil {
+				parent.HelpFunc()(c, args)
+				return
+			}
+			_ = c.Usage()
+			return
+		}
+		if err := writeConfigFieldHelp(c.OutOrStdout(), fields[0]); err != nil {
+			c.PrintErrln("Error:", err)
+		}
+	})
+
+	cmd.Flags().StringVarP(&file, "file", "f", "", "Path to the workload YAML config")
+	cmd.Flags().BoolVar(&watch, "watch", false, "Stream logs until the run completes")
+	cmd.Flags().StringArrayVar(&overrides, "override", nil, "Override a YAML field, e.g. compute.num_accelerators=8 (repeatable)")
+	cmd.Flags().BoolVar(&dryRun, "dry-run", false, "Validate the config against the workspace without submitting a run")
+	cmd.Flags().StringVar(&idempotencyKey, "idempotency-key", "", "Return the existing run if this key was already used")
+	_ = cmd.MarkFlagRequired("file")
+
+	// --dry-run authenticates after local parsing and validation so syntax, unknown
+	// fields, and invalid overrides remain actionable without valid credentials.
+	cmd.PreRunE = func(cmd *cobra.Command, args []string) error {
+		if dryRun {
+			return nil
+		}
+		return root.MustWorkspaceClient(cmd, args)
+	}
+
+	cmd.RunE = func(cmd *cobra.Command, args []string) error {
+		ctx := cmd.Context()
+
+		cfg, err := loadRunConfigWithOverrides(ctx, file, overrides)
+		if err != nil {
+			return err
+		}
+
+		if dryRun {
+			idempotencyToken := effectiveIdempotencyToken(idempotencyKey, cfg)
+			ctx, validationErr := validateDryRunInWorkspace(ctx, cmd, args, cfg, idempotencyToken, validationTimeout)
+			if err := validateIdempotencyToken(idempotencyToken); err != nil {
+				return err
+			}
+			if validationErr != nil {
+				unavailable, ok := validationUnavailable(validationErr)
+				if !ok {
+					return validationErr
+				}
+				kind := "PERMANENT"
+				if unavailable.retryable {
+					kind = "TRANSIENT"
+				}
+				return renderError(ctx, cmd, "VALIDATION_UNAVAILABLE", kind, unavailable.retryable, validationErr)
+			}
+			if root.OutputType(cmd) == flags.OutputText {
+				cmdio.LogString(ctx, fmt.Sprintf("Dry run: configuration for %q is valid; not submitting.", cfg.ExperimentName))
+				return nil
+			}
+			return renderEnvelope(ctx, runResult{Status: "DRY_RUN_OK", DryRun: true})
+		}
+
+		warnExperimentalContainers(ctx, cfg)
+
+		jsonOut := root.OutputType(cmd) == flags.OutputJSON
+
+		// Announce the experiment before uploading; skipped in JSON mode to keep
+		// stdout a clean envelope stream.
+		if !jsonOut {
+			cmdio.LogString(ctx, "Submitting experiment: "+cfg.ExperimentName)
+		}
+
+		w := cmdctx.WorkspaceClient(ctx)
+		runID, dashboardURL, err := submitWorkload(ctx, w, cfg, file, idempotencyKey, !jsonOut)
+		if err != nil {
+			return err
+		}
+
+		runIDStr := strconv.FormatInt(runID, 10)
+
+		if !watch {
+			if !jsonOut {
+				out := cmd.OutOrStdout()
+				printSubmitResult(ctx, out, runIDStr, dashboardURL)
+				printPostSubmitGuidance(out, w.Config.Profile, runIDStr)
+				grantSubmittedPermissions(ctx, w, runID, cfg.Permissions, true)
+				return nil
+			}
+			// PENDING is the submit status, distinct from the --watch JSONL
+			// SUBMITTED event type below.
+			if err := renderEnvelope(ctx, runResult{Status: "PENDING", RunID: runIDStr, DashboardURL: dashboardURL}); err != nil {
+				return err
+			}
+			grantSubmittedPermissions(ctx, w, runID, cfg.Permissions, false)
+			return nil
+		}
+
+		// --watch: stream the submitted run's logs until it reaches a terminal
+		// state, then exit with the run's outcome. This is the same pipeline as
+		// `air logs <run>` (Bricklens with MLflow fallback).
+		maxRetries := cfg.maxRetries()
+		req := logRequest{
+			runID:        runID,
+			attempt:      -1,
+			tailLines:    -1,
+			jsonOutput:   jsonOut,
+			maxRetries:   &maxRetries,
+			retryTracker: newRetryTracker(logRunStatus{}),
+		}
+
+		watchCtx, stop := notifyInterrupt(ctx)
+		defer stop()
+
+		if !jsonOut {
+			out := cmd.OutOrStdout()
+			perNode, err := gpusPerNode(gpuType(cfg.Compute.AcceleratorType))
+			if err != nil {
+				return err
+			}
+			monitoringMessage := "Monitoring run and streaming logs..."
+			if cfg.Compute.NumAccelerators > perNode {
+				monitoringMessage = fmt.Sprintf("Monitoring run and streaming logs from node 0 of %d...", cfg.Compute.NumAccelerators/perNode)
+			}
+			// The MLflow links stream in via the logs below, so don't poll here.
+			printSubmitResult(ctx, out, runIDStr, dashboardURL)
+			grantSubmittedPermissions(ctx, w, runID, cfg.Permissions, true)
+			// Separate the submit summary from the streamed logs.
+			fmt.Fprintln(out)
+			fmt.Fprintln(out, monitoringMessage)
+			if maxRetries > 0 {
+				unit := "times"
+				if maxRetries == 1 {
+					unit = "time"
+				}
+				fmt.Fprintf(out, "Failed attempts will be retried up to %d %s.\n", maxRetries, unit)
+			}
+			printLogsDivider(ctx, out)
+			return handleWatchResult(out, w.Config.Profile, runIDStr, runLogs(watchCtx, cmd, req))
+		}
+
+		// --json: emit SUBMITTED first (so a consumer sees the run id immediately),
+		// STATUS events on each lifecycle transition, and a closing terminal-status
+		// envelope after streaming.
+		out := cmd.OutOrStdout()
+		printSubmittedEvent(out, runIDStr, dashboardURL)
+		grantSubmittedPermissions(ctx, w, runID, cfg.Permissions, false)
+		req.onStatusChange = func(current, previous string) {
+			printStatusEvent(out, current, previous)
+		}
+		err = runLogs(watchCtx, cmd, req)
+
+		// Re-resolve the run for the closing envelope. STATUS events only fire on
+		// the Bricklens path, so the terminal status must come from the run's
+		// actual state — correct whether Bricklens or the MLflow fallback served
+		// the logs.
+		printTerminalEvent(out, runIDStr, watchTerminalStatus(ctx, w, runID), dashboardURL)
+		return err
+	}
+
+	return cmd
+}
+
+func airLogsCommand(profile, runID string) string {
+	args := []string{"databricks", "air", "logs", shellquote.BashArg(runID)}
+	if profile != "" {
+		args = append(args, "-p", shellquote.BashArg(profile))
+	}
+	return strings.Join(args, " ")
+}
+
+func airGetCommand(profile, runID string) string {
+	args := []string{"databricks", "air", "get", shellquote.BashArg(runID)}
+	if profile != "" {
+		args = append(args, "-p", shellquote.BashArg(profile))
+	}
+	return strings.Join(args, " ")
+}
+
+func printPostSubmitGuidance(out io.Writer, profile, runID string) {
+	fmt.Fprintln(out)
+	fmt.Fprintln(out, "Tip: use --watch when submitting a run to stream logs to your terminal.")
+	fmt.Fprintln(out, "Stream logs after submission using:")
+	fmt.Fprintln(out, "  "+airLogsCommand(profile, runID))
+}
+
+// notifyInterrupt returns a context cancelled on the first interrupt (Ctrl-C),
+// which lets the log stream unwind and print resume guidance via
+// handleWatchResult; the CLI root installs no signal handler of its own. The
+// caller must defer the returned stop.
+//
+// signal.Notify disables the default SIGINT disposition process-wide for as long
+// as the channel stays registered, so a second Ctrl-C would merely be buffered
+// and dropped, leaving no way to abort a hung teardown. Calling signal.Stop
+// before cancel restores SIG_DFL first, so the cancellation is only observable
+// once a second signal is guaranteed to terminate the process.
+func notifyInterrupt(parent context.Context) (context.Context, context.CancelFunc) {
+	ctx, cancel := context.WithCancel(parent)
+	sigCh := make(chan os.Signal, 1)
+	signal.Notify(sigCh, os.Interrupt)
+	go func() {
+		// Selecting on ctx.Done() too lets the goroutine exit on the normal (no
+		// signal) path rather than parking on sigCh for the life of the process.
+		select {
+		case <-sigCh:
+			signal.Stop(sigCh)
+			cancel()
+		case <-ctx.Done():
+			signal.Stop(sigCh)
+		}
+	}()
+	return ctx, cancel
+}
+
+func handleWatchResult(out io.Writer, profile, runID string, err error) error {
+	if !errors.Is(err, context.Canceled) {
+		return err
+	}
+
+	fmt.Fprintln(out)
+	fmt.Fprintln(out, "Streaming logs interrupted.")
+	fmt.Fprintln(out)
+	fmt.Fprintln(out, "To check status:")
+	fmt.Fprintln(out, airGetCommand(profile, runID))
+	fmt.Fprintln(out)
+	fmt.Fprintln(out, "To resume streaming logs:")
+	fmt.Fprintln(out, airLogsCommand(profile, runID))
+	return root.ErrAlreadyPrinted
+}
+
+// printSubmitResult writes the green success line and Job Run link. The link is
+// styled (blue, underlined) and clickable, matching the `air get` view, and
+// degrades to plain text on non-rich terminals.
+func printSubmitResult(ctx context.Context, out io.Writer, runIDStr, dashboardURL string) {
+	renderer, colorOn := cmdio.NewRenderer(ctx, out)
+	p := newPalette(renderer)
+
+	fmt.Fprintln(out, p.green.Render("Submitted workload with Job Run ID: "+runIDStr))
+	fmt.Fprintln(out, "View job run at: "+link(colorOn, p.blue, dashboardURL, dashboardURL))
+}
+
+// logsDividerWidth is the total display width of the --watch logs divider.
+const logsDividerWidth = 60
+
+// printLogsDivider prints a centered "Logs" rule marking where the streamed
+// --watch logs begin, separating them from the submit summary. The dim color is
+// dropped on non-rich terminals; the rule characters are always printed.
+func printLogsDivider(ctx context.Context, out io.Writer) {
+	renderer, _ := cmdio.NewRenderer(ctx, out)
+	p := newPalette(renderer)
+
+	const label = " Logs "
+	side := max((logsDividerWidth-utf8.RuneCountInString(label))/2, 0)
+	rule := strings.Repeat("─", side) + label + strings.Repeat("─", side)
+	fmt.Fprintln(out, p.n7.Render(rule))
+}
+
+// watchTerminalStatus resolves a watched run's final display state for the
+// closing --watch envelope. The run is terminal once streaming returns; if the
+// status can't be re-fetched, "UNKNOWN" is reported rather than guessing.
+func watchTerminalStatus(ctx context.Context, w *databricks.WorkspaceClient, runID int64) string {
+	status, err := resolveRunStatus(ctx, w, runID)
+	if err != nil {
+		return "UNKNOWN"
+	}
+	return status.displayState()
+}
diff --git a/cmd/air/run_signal_test.go b/cmd/air/run_signal_test.go
new file mode 100644
index 00000000000..ca243ca0a06
--- /dev/null
+++ b/cmd/air/run_signal_test.go
@@ -0,0 +1,101 @@
+//go:build unix
+
+// The second-signal escape hatch is a Unix signal-delivery behavior: the test
+// re-execs itself and sends SIGINT, which os/signal cannot deliver to self on
+// Windows (notifyInterrupt only watches os.Interrupt there anyway).
+package aircmd
+
+import (
+	"bufio"
+	"context"
+	"os"
+	"os/exec"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// notifyInterrupt flips signal dispositions process-wide, so the second-signal
+// behavior can only be observed in a real child process where the test binary's
+// own handlers don't mask it. Go resets dispositions to SIG_DFL across exec.
+const signalChildEnv = "TEST_AIR_SIGNAL_CHILD"
+
+// TestMain runs notifyInterrupt under test when re-executed as the child.
+func TestMain(m *testing.M) {
+	if os.Getenv(signalChildEnv) == "" {
+		os.Exit(m.Run())
+	}
+
+	// TestMain has no *testing.T, so t.Context() is unavailable here.
+	//nolint:gocritic
+	ctx, stop := notifyInterrupt(context.Background())
+	defer stop()
+
+	// Stand in for a log stream still draining after the first Ctrl-C; the user
+	// needs the escape hatch during this window.
+	os.Stdout.WriteString("READY\n")
+	<-ctx.Done()
+	os.Stdout.WriteString("CANCELLED\n")
+	time.Sleep(30 * time.Second)
+	os.Stdout.WriteString("SURVIVED\n")
+	os.Exit(0)
+}
+
+// TestNotifyInterruptSecondSignalStillKills is the regression test for the
+// escape hatch: signal.NotifyContext disables the default SIGINT disposition
+// process-wide, so relaying only the first signal would leave the user unable to
+// abort. The first Ctrl-C must cancel the context (so handleWatchResult prints
+// resume guidance), and the second must terminate the process outright.
+func TestNotifyInterruptSecondSignalStillKills(t *testing.T) {
+	cmd := exec.Command(os.Args[0], "-test.run=TestNotifyInterruptSecondSignalStillKills")
+	cmd.Env = append(os.Environ(), signalChildEnv+"=1")
+	stdout, err := cmd.StdoutPipe()
+	require.NoError(t, err)
+	require.NoError(t, cmd.Start())
+	t.Cleanup(func() { _ = cmd.Process.Kill() })
+
+	lines := make(chan string, 8)
+	go func() {
+		sc := bufio.NewScanner(stdout)
+		for sc.Scan() {
+			lines <- sc.Text()
+		}
+		close(lines)
+	}()
+	await := func(want string) bool {
+		deadline := time.After(30 * time.Second)
+		for {
+			select {
+			case l, ok := <-lines:
+				if !ok {
+					return false
+				}
+				if strings.Contains(l, want) {
+					return true
+				}
+			case <-deadline:
+				return false
+			}
+		}
+	}
+
+	require.True(t, await("READY"), "child never started")
+	require.NoError(t, cmd.Process.Signal(os.Interrupt))
+	require.True(t, await("CANCELLED"), "first interrupt did not cancel the context")
+
+	// The second interrupt must reach the default disposition and kill the child
+	// rather than being buffered and dropped by the handler.
+	require.NoError(t, cmd.Process.Signal(os.Interrupt))
+	waitErr := make(chan error, 1)
+	go func() { waitErr <- cmd.Wait() }()
+	select {
+	case err := <-waitErr:
+		// Killed by the signal, so a non-nil (non-exit-zero) error.
+		assert.Error(t, err, "child should die by signal, not exit cleanly")
+	case <-time.After(15 * time.Second):
+		t.Fatal("second interrupt was swallowed: the user has no way to abort a hung stream")
+	}
+}
diff --git a/cmd/air/run_test.go b/cmd/air/run_test.go
new file mode 100644
index 00000000000..1e48b05a734
--- /dev/null
+++ b/cmd/air/run_test.go
@@ -0,0 +1,286 @@
+package aircmd
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/cli/libs/testserver"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type submitRequestCounts struct {
+	runGet       atomic.Int32
+	runGetOutput atomic.Int32
+}
+
+// submitServer serves a non-watch `air run` submit. It records any post-submit
+// run lookups so tests can assert that the command returns without MLflow polling.
+// Everything except runs/submit gets a permissive stub.
+func submitServer(t *testing.T) (*httptest.Server, *submitRequestCounts) {
+	t.Helper()
+	counts := &submitRequestCounts{}
+	runGet := `{"run_id": 555, "tasks": [{"run_id": 556, "attempt_number": 0}]}`
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case strings.HasSuffix(r.URL.Path, "/jobs/runs/submit"):
+			_, _ = w.Write([]byte(`{"run_id": 555}`))
+		case r.URL.Path == "/api/2.2/jobs/runs/get":
+			counts.runGet.Add(1)
+			_, _ = w.Write([]byte(runGet))
+		case r.URL.Path == "/api/2.2/jobs/runs/get-output":
+			counts.runGetOutput.Add(1)
+			_, _ = w.Write([]byte(`{"ai_runtime_task_output": {"mlflow_experiment_id": "exp1", "mlflow_run_id": "run1"}}`))
+		default:
+			_, _ = w.Write([]byte(`{"userName": "u@example.com", "workspace_id": 1}`))
+		}
+	}))
+	t.Cleanup(srv.Close)
+	return srv, counts
+}
+
+func runSubmitCmd(t *testing.T, out flags.Output, buf *bytes.Buffer, srvURL string) error {
+	return runSubmitCmdWithProfile(t, out, buf, srvURL, "")
+}
+
+func runSubmitCmdWithProfile(t *testing.T, out flags.Output, buf *bytes.Buffer, srvURL, profile string) error {
+	t.Helper()
+	cfgPath := writeConfigFile(t, "run.yaml", minimalConfig)
+	cmd := withOutput(newRunCommand(), out)
+	require.NoError(t, cmd.Flags().Set("file", cfgPath))
+
+	ctx := cmdio.InContext(t.Context(), cmdio.NewIO(t.Context(), out, nil, buf, buf, "", ""))
+	w := newTestWorkspaceClient(t, srvURL)
+	w.Config.Profile = profile
+	ctx = cmdctx.SetWorkspaceClient(ctx, w)
+	cmd.SetContext(ctx)
+	cmd.SetOut(buf)
+	return cmd.RunE(cmd, nil)
+}
+
+func TestRunSubmitTextOutput(t *testing.T) {
+	var buf bytes.Buffer
+	srv, counts := submitServer(t)
+	err := runSubmitCmd(t, flags.OutputText, &buf, srv.URL)
+	require.NoError(t, err)
+
+	out := buf.String()
+	assert.Contains(t, out, "Submitting experiment: my-run")
+	assert.Contains(t, out, "Submitted workload with Job Run ID: 555")
+	assert.Contains(t, out, "View job run at: ")
+	assert.Contains(t, out, "/jobs/runs/555")
+	assert.Contains(t, out, "Tip: use --watch when submitting a run to stream logs to your terminal.")
+	assert.Contains(t, out, "Stream logs after submission using:")
+	assert.Contains(t, out, "databricks air logs 555")
+	assert.NotContains(t, out, "View MLflow run at:")
+	assert.Zero(t, counts.runGet.Load(), "bare submission must not poll runs/get")
+	assert.Zero(t, counts.runGetOutput.Load(), "bare submission must not poll runs/get-output")
+}
+
+func TestWarnExperimentalContainers(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	ctx := cmdio.InContext(t.Context(), cmdio.NewIO(t.Context(), flags.OutputText, nil, &stdout, &stderr, "", ""))
+
+	warnExperimentalContainers(ctx, &runConfig{})
+	assert.Empty(t, stderr.String())
+
+	warnExperimentalContainers(ctx, &runConfig{Containers: []containerConfig{{Name: "inference"}}})
+	assert.Equal(t, experimentalContainersWarning+"\n", stderr.String())
+}
+
+func TestRunSubmitTextOutputIncludesProfileInLogsCommand(t *testing.T) {
+	var buf bytes.Buffer
+	srv, _ := submitServer(t)
+	err := runSubmitCmdWithProfile(t, flags.OutputText, &buf, srv.URL, "team profile")
+	require.NoError(t, err)
+
+	assert.Contains(t, buf.String(), "databricks air logs 555 -p 'team profile'")
+}
+
+func TestAirLogsCommand(t *testing.T) {
+	assert.Equal(t, "databricks air logs 123", airLogsCommand("", "123"))
+	assert.Equal(t, "databricks air logs 123 -p profile-name", airLogsCommand("profile-name", "123"))
+	assert.Equal(t, "databricks air logs 123 -p 'team profile'", airLogsCommand("team profile", "123"))
+}
+
+func TestAirGetCommand(t *testing.T) {
+	assert.Equal(t, "databricks air get 123", airGetCommand("", "123"))
+	assert.Equal(t, "databricks air get 123 -p profile-name", airGetCommand("profile-name", "123"))
+	assert.Equal(t, "databricks air get 123 -p 'team profile'", airGetCommand("team profile", "123"))
+}
+
+func TestRunSubmitJSONStatusPending(t *testing.T) {
+	var buf bytes.Buffer
+	srv, _ := submitServer(t)
+	err := runSubmitCmd(t, flags.OutputJSON, &buf, srv.URL)
+	require.NoError(t, err)
+
+	out := buf.String()
+	assert.Contains(t, out, `"status": "PENDING"`)
+	assert.Contains(t, out, `"run_id": "555"`)
+	// JSON stdout stays a clean envelope stream — no human-readable submit lines.
+	assert.NotContains(t, out, "Submitting experiment")
+}
+
+type dryRunRequest struct {
+	method string
+	path   string
+	body   map[string]any
+}
+
+func dryRunServer(t *testing.T, response any, requests *[]dryRunRequest) *testserver.Server {
+	t.Helper()
+	server := testserver.New(t)
+	if requests != nil {
+		server.RequestCallback = func(req *testserver.Request) {
+			request := dryRunRequest{method: req.Method, path: req.URL.Path}
+			if req.URL.Path == validateConfigPath {
+				require.NoError(t, json.Unmarshal(req.Body, &request.body))
+			}
+			*requests = append(*requests, request)
+		}
+	}
+	server.Handle("POST", validateConfigPath, func(_ testserver.Request) any { return response })
+	testserver.AddDefaultHandlers(server)
+	t.Cleanup(server.Close)
+	return server
+}
+
+type dryRunResult struct {
+	stdout string
+	stderr string
+	err    error
+}
+
+func runDryRunCmd(t *testing.T, timeout time.Duration, output flags.Output, srvURL, config string, flagArgs ...string) dryRunResult {
+	t.Helper()
+	cfgPath := writeConfigFile(t, "run.yaml", config)
+	cmd := withOutput(newRunCommandWithValidationTimeout(timeout), output)
+	args := append([]string{"--file", cfgPath}, flagArgs...)
+	require.NoError(t, cmd.ParseFlags(args))
+
+	var stdout, stderr bytes.Buffer
+	ctx := cmdio.InContext(t.Context(), cmdio.NewIO(t.Context(), output, nil, &stdout, &stderr, "", ""))
+	w := newTestWorkspaceClient(t, srvURL)
+	w.Config.RetryTimeoutSeconds = 5
+	ctx = cmdctx.SetWorkspaceClient(ctx, w)
+	cmd.SetContext(ctx)
+	cmd.SetOut(&stdout)
+	err := cmd.RunE(cmd, nil)
+	return dryRunResult{stdout: stdout.String(), stderr: stderr.String(), err: err}
+}
+
+func TestRunDryRunValidatesBackendWithoutMutation(t *testing.T) {
+	var requests []dryRunRequest
+	srv := dryRunServer(t, validateConfigResponse{}, &requests)
+
+	result := runDryRunCmd(t, dryRunValidationTimeout, flags.OutputText, srv.URL, minimalConfig, "--dry-run", "--idempotency-key", "flag-token")
+	require.NoError(t, result.err)
+	assert.Contains(t, result.stderr, `Dry run: configuration for "my-run" is valid; not submitting.`)
+
+	var validations []dryRunRequest
+	for _, request := range requests {
+		if request.path == validateConfigPath {
+			validations = append(validations, request)
+		}
+		assert.Contains(t, []string{"/.well-known/databricks-config", "/api/2.0/preview/scim/v2/Me", validateConfigPath}, request.path,
+			"dry-run must not make requests beyond authentication, user lookup, and validation")
+		assert.True(t, request.method == http.MethodGet || request.path == validateConfigPath,
+			"dry-run made unexpected %s request to %s", request.method, request.path)
+	}
+	require.Len(t, validations, 1)
+	assert.Equal(t, http.MethodPost, validations[0].method)
+	assert.Len(t, validations[0].body, 3)
+	assert.Contains(t, validations[0].body, "task")
+	assert.Contains(t, validations[0].body, "run_options")
+	assert.Equal(t, map[string]any{"environment_version": "6"}, validations[0].body["environment"])
+	task := validations[0].body["task"].(map[string]any)
+	commandPath := task["deployments"].([]any)[0].(map[string]any)["command_path"].(string)
+	assert.True(t, strings.HasPrefix(commandPath, "/Workspace/Users/tester@databricks.com/.air/cli_launch/my-run/my-run_"))
+	assert.True(t, strings.HasSuffix(commandPath, "/command.sh"))
+	runOptions := validations[0].body["run_options"].(map[string]any)
+	assert.Equal(t, "flag-token", runOptions["idempotency_token"])
+}
+
+func TestRunDryRunConfigValidationHasDeadline(t *testing.T) {
+	requestCanceled := make(chan struct{}, 1)
+	srv := testserver.New(t)
+	srv.Handle("POST", validateConfigPath, func(req testserver.Request) any {
+		<-req.Context.Done()
+		requestCanceled <- struct{}{}
+		return nil
+	})
+	testserver.AddDefaultHandlers(srv)
+	t.Cleanup(srv.Close)
+
+	result := runDryRunCmd(t, 100*time.Millisecond, flags.OutputText, srv.URL, minimalConfig, "--dry-run")
+	require.Error(t, result.err)
+	assert.Contains(t, result.err.Error(), "config validation unavailable: failed to validate config:")
+	assert.Contains(t, result.err.Error(), "context deadline exceeded")
+	assert.NotContains(t, result.stderr, "Dry run: configuration")
+	select {
+	case <-requestCanceled:
+	case <-time.After(time.Second):
+		require.Fail(t, "dry-run validation request context was not canceled")
+	}
+}
+
+func TestRunDryRunRetriesUnavailableResponseOnce(t *testing.T) {
+	for _, status := range []int{http.StatusTooManyRequests, http.StatusServiceUnavailable} {
+		t.Run(http.StatusText(status), func(t *testing.T) {
+			var requests []dryRunRequest
+			srv := dryRunServer(t, testserver.Response{
+				StatusCode: status,
+				Body:       map[string]string{"error_code": "TEMPORARILY_UNAVAILABLE", "message": "try again"},
+			}, &requests)
+
+			result := runDryRunCmd(t, dryRunValidationTimeout, flags.OutputJSON, srv.URL, minimalConfig, "--dry-run")
+			require.ErrorIs(t, result.err, root.ErrAlreadyPrinted)
+			var got errorEnvelope
+			require.NoError(t, json.Unmarshal([]byte(result.stdout), &got))
+			assert.Equal(t, "VALIDATION_UNAVAILABLE", got.Error.Code)
+			assert.Equal(t, "TRANSIENT", got.Error.Kind)
+			assert.True(t, got.Error.Retryable)
+			assert.Contains(t, got.Error.Message, "config validation unavailable")
+			assert.NotContains(t, result.stdout, "DRY_RUN_OK")
+			assert.Empty(t, result.stderr)
+
+			validationRequests := 0
+			for _, request := range requests {
+				if request.path == validateConfigPath {
+					validationRequests++
+				}
+			}
+			assert.Equal(t, dryRunValidationMaxAttempts, validationRequests)
+		})
+	}
+}
+
+func TestRunDryRunValidatesIdempotencyTokenAfterWorkspaceValidation(t *testing.T) {
+	var requests []dryRunRequest
+	srv := dryRunServer(t, validateConfigResponse{}, &requests)
+	tooLong := strings.Repeat("x", 65)
+
+	result := runDryRunCmd(t, dryRunValidationTimeout, flags.OutputText, srv.URL, minimalConfig, "--dry-run", "--idempotency-key", tooLong)
+	require.EqualError(t, result.err, "idempotency token must be 64 characters or less, got 65")
+
+	var validations []dryRunRequest
+	for _, request := range requests {
+		if request.path == validateConfigPath {
+			validations = append(validations, request)
+		}
+	}
+	require.Len(t, validations, 1)
+	runOptions := validations[0].body["run_options"].(map[string]any)
+	assert.Equal(t, tooLong, runOptions["idempotency_token"])
+}
diff --git a/cmd/air/run_watch_test.go b/cmd/air/run_watch_test.go
new file mode 100644
index 00000000000..e1843e78ed1
--- /dev/null
+++ b/cmd/air/run_watch_test.go
@@ -0,0 +1,257 @@
+package aircmd
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// watchServer serves submit, the auth probe, a terminal runs/get, and a single
+// page of Bricklens logs — everything `air run --watch` touches after submit.
+// resultState is the terminal result the run reports (e.g. SUCCESS, FAILED).
+func watchServer(t *testing.T, resultState string) *httptest.Server {
+	t.Helper()
+	runGet := `{
+		"run_id": 777,
+		"start_time": 1700000000000,
+		"end_time": 1700000012000,
+		"state": {"life_cycle_state": "TERMINATED", "result_state": "` + resultState + `"},
+		"tasks": [{"run_id": 778, "attempt_number": 0}]
+	}`
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case strings.HasSuffix(r.URL.Path, "/jobs/runs/submit"):
+			_, _ = w.Write([]byte(`{"run_id": 777}`))
+		case r.URL.Path == "/api/2.2/jobs/runs/get":
+			_, _ = w.Write([]byte(runGet))
+		case strings.HasPrefix(r.URL.Path, "/api/2.0/ai-training/workflows/by-run-id/"):
+			_, _ = w.Write([]byte(`{"log_records": [
+				{"time_unix_nano": 1700000002000000000, "body": "step 2", "node_index": 0},
+				{"time_unix_nano": 1700000001000000000, "body": "step 1", "node_index": 0}
+			]}`))
+		default:
+			// Me() probe, workspace-id, SDK config discovery.
+			_, _ = w.Write([]byte(`{"userName": "u@example.com", "workspace_id": 1}`))
+		}
+	}))
+	t.Cleanup(srv.Close)
+	return srv
+}
+
+// watchServerMLflow serves a run whose Bricklens endpoint is gated off
+// (FEATURE_DISABLED), forcing the MLflow fallback, plus the MLflow artifact
+// chain (get-output, artifacts/list, credentials-for-read, the pre-signed bytes).
+// STATUS events never fire on this path, so it guards the closing terminal
+// envelope against relying on onStatusChange.
+func watchServerMLflow(t *testing.T, resultState string) *httptest.Server {
+	t.Helper()
+	var base string
+	runGet := `{
+		"run_id": 777,
+		"state": {"life_cycle_state": "TERMINATED", "result_state": "` + resultState + `"},
+		"tasks": [{"run_id": 778, "attempt_number": 0}]
+	}`
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case strings.HasSuffix(r.URL.Path, "/jobs/runs/submit"):
+			_, _ = w.Write([]byte(`{"run_id": 777}`))
+		case r.URL.Path == "/api/2.2/jobs/runs/get":
+			_, _ = w.Write([]byte(runGet))
+		case strings.HasPrefix(r.URL.Path, "/api/2.0/ai-training/workflows/by-run-id/"):
+			w.WriteHeader(http.StatusForbidden)
+			_, _ = w.Write([]byte(`{"error_code": "FEATURE_DISABLED", "message": "gated off"}`))
+		case r.URL.Path == "/api/2.2/jobs/runs/get-output":
+			_, _ = w.Write([]byte(`{"ai_runtime_task_output": {"mlflow_experiment_id": "exp1", "mlflow_run_id": "run1"}}`))
+		case r.URL.Path == "/api/2.0/mlflow/artifacts/list":
+			if r.URL.Query().Get("path") == "logs" {
+				_, _ = w.Write([]byte(`{"files": [{"path": "logs/node_0", "is_dir": true}]}`))
+				return
+			}
+			_, _ = w.Write([]byte(`{"files": [{"path": "logs/node_0/logs-0.chunk.txt", "file_size": 12}]}`))
+		case r.URL.Path == "/api/2.0/mlflow/artifacts/credentials-for-read":
+			_, _ = w.Write([]byte(`{"credential_infos": [{"signed_uri": "` + base + `/presigned"}]}`))
+		case r.URL.Path == "/presigned":
+			_, _ = w.Write([]byte("step 1\nstep 2\n"))
+		default:
+			_, _ = w.Write([]byte(`{"userName": "u@example.com", "workspace_id": 1}`))
+		}
+	}))
+	base = srv.URL
+	t.Cleanup(srv.Close)
+	return srv
+}
+
+func runWatchCmdWithConfig(t *testing.T, out flags.Output, buf *bytes.Buffer, srvURL, config string) error {
+	t.Helper()
+	cfgPath := writeConfigFile(t, "run.yaml", config)
+	cmd := withOutput(newRunCommand(), out)
+	require.NoError(t, cmd.Flags().Set("file", cfgPath))
+	require.NoError(t, cmd.Flags().Set("watch", "true"))
+
+	ctx := cmdio.InContext(t.Context(), cmdio.NewIO(t.Context(), out, nil, buf, buf, "", ""))
+	ctx = cmdctx.SetWorkspaceClient(ctx, newTestWorkspaceClient(t, srvURL))
+	cmd.SetContext(ctx)
+	cmd.SetOut(buf)
+	return cmd.RunE(cmd, nil)
+}
+
+func runWatchCmd(t *testing.T, out flags.Output, buf *bytes.Buffer, srvURL string) error {
+	t.Helper()
+	return runWatchCmdWithConfig(t, out, buf, srvURL, minimalConfig)
+}
+
+const multinodeWatchConfig = `
+experiment_name: my-run
+command: python train.py
+compute:
+  accelerator_type: GPU_8xH100
+  num_accelerators: 16
+`
+
+func TestRunWatchStreamsLogs(t *testing.T) {
+	var buf bytes.Buffer
+	err := runWatchCmd(t, flags.OutputText, &buf, watchServer(t, "SUCCESS").URL)
+	require.NoError(t, err)
+
+	out := buf.String()
+	assert.Contains(t, out, "Submitted workload with Job Run ID: 777")
+	assert.Contains(t, out, "View job run at: ")
+	assert.Contains(t, out, "Monitoring run and streaming logs...")
+	assert.Contains(t, out, "Failed attempts will be retried up to 3 times.")
+	assert.NotContains(t, out, "from node 0")
+	// A "Logs" divider separates the submit summary from the streamed logs.
+	assert.Contains(t, out, "Logs")
+	assert.Contains(t, out, "───")
+	// The submitted run's logs stream through, oldest-first.
+	assert.Contains(t, out, "step 1\nstep 2")
+}
+
+func TestRunWatchMultinodeIdentifiesStreamedNode(t *testing.T) {
+	var buf bytes.Buffer
+	err := runWatchCmdWithConfig(t, flags.OutputText, &buf, watchServer(t, "SUCCESS").URL, multinodeWatchConfig)
+	require.NoError(t, err)
+
+	assert.Contains(t, buf.String(), "Monitoring run and streaming logs from node 0 of 2...")
+}
+
+func TestRunWatchJSONEmitsSubmittedThenLogs(t *testing.T) {
+	var buf bytes.Buffer
+	err := runWatchCmdWithConfig(t, flags.OutputJSON, &buf, watchServer(t, "SUCCESS").URL, multinodeWatchConfig)
+	require.NoError(t, err)
+
+	all := buf.String()
+	lines := strings.Split(strings.TrimSpace(all), "\n")
+	require.GreaterOrEqual(t, len(lines), 3)
+	// First event is SUBMITTED with the run id; then STATUS + streamed LOG events.
+	assert.Contains(t, lines[0], `"type":"SUBMITTED"`)
+	assert.Contains(t, lines[0], `"run_id":"777"`)
+	assert.Contains(t, all, `"type":"STATUS"`)
+	assert.Contains(t, all, `"type":"LOG"`)
+	assert.Contains(t, all, `"line":"step 1"`)
+	assert.NotContains(t, all, "Monitoring run and streaming logs")
+	// The last line is the closing terminal-status envelope carrying SUCCESS.
+	assert.Contains(t, lines[len(lines)-1], `"status":"SUCCESS"`)
+	assert.Contains(t, lines[len(lines)-1], `"run_id":"777"`)
+}
+
+func TestRunWatchJSONFailedRunTerminalEnvelope(t *testing.T) {
+	var buf bytes.Buffer
+	err := runWatchCmd(t, flags.OutputJSON, &buf, watchServer(t, "FAILED").URL)
+	// Non-zero exit is surfaced as ErrAlreadyPrinted, but the closing envelope
+	// still carries the terminal status.
+	require.ErrorIs(t, err, root.ErrAlreadyPrinted)
+	lines := strings.Split(strings.TrimSpace(buf.String()), "\n")
+	assert.Contains(t, lines[len(lines)-1], `"status":"FAILED"`)
+}
+
+func TestRunWatchFailedRunExitsNonZero(t *testing.T) {
+	var buf bytes.Buffer
+	// A run that ends FAILED streams its logs but exits non-zero, surfaced as
+	// ErrAlreadyPrinted (the output was already written).
+	err := runWatchCmd(t, flags.OutputText, &buf, watchServer(t, "FAILED").URL)
+	require.ErrorIs(t, err, root.ErrAlreadyPrinted)
+	assert.Contains(t, buf.String(), "step 1\nstep 2")
+}
+
+func TestHandleWatchResultPrintsProfileAwareResumeCommand(t *testing.T) {
+	var buf bytes.Buffer
+	err := handleWatchResult(&buf, "team profile", "777", fmt.Errorf("stream logs: %w", context.Canceled))
+	require.ErrorIs(t, err, root.ErrAlreadyPrinted)
+
+	out := buf.String()
+	assert.Contains(t, out, "Streaming logs interrupted.")
+	assert.Contains(t, out, "To check status:\ndatabricks air get 777 -p 'team profile'")
+	assert.Contains(t, out, "To resume streaming logs:\ndatabricks air logs 777 -p 'team profile'")
+	assert.NotContains(t, out, "The workload was not canceled")
+}
+
+func TestHandleWatchResultPassesThroughOtherErrors(t *testing.T) {
+	want := errors.New("stream failed")
+	var buf bytes.Buffer
+
+	assert.ErrorIs(t, handleWatchResult(&buf, "profile", "777", want), want)
+	assert.Empty(t, buf.String())
+}
+
+func TestRunWatchDryRunSkipsSubmit(t *testing.T) {
+	// --dry-run takes precedence over --watch: nothing is submitted or streamed.
+	var got []string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		got = append(got, r.URL.Path)
+		_, _ = w.Write([]byte(`{}`))
+	}))
+	t.Cleanup(srv.Close)
+
+	cfgPath := writeConfigFile(t, "run.yaml", minimalConfig)
+	cmd := withOutput(newRunCommand(), flags.OutputText)
+	require.NoError(t, cmd.Flags().Set("file", cfgPath))
+	require.NoError(t, cmd.Flags().Set("watch", "true"))
+	require.NoError(t, cmd.Flags().Set("dry-run", "true"))
+	var buf bytes.Buffer
+	ctx := cmdio.InContext(t.Context(), cmdio.NewIO(t.Context(), flags.OutputText, nil, &buf, &buf, "", ""))
+	ctx = cmdctx.SetWorkspaceClient(ctx, newTestWorkspaceClient(t, srv.URL))
+	cmd.SetContext(ctx)
+	cmd.SetOut(&buf)
+
+	require.NoError(t, cmd.RunE(cmd, nil))
+	assert.Contains(t, buf.String(), "Dry run")
+	for _, p := range got {
+		assert.NotContains(t, p, "/jobs/runs/submit", "dry-run must not submit")
+		assert.NotContains(t, p, "/logs", "dry-run must not stream logs")
+	}
+}
+
+func TestRunWatchJSONMLflowFallbackTerminalEnvelope(t *testing.T) {
+	// Regression: through the MLflow fallback the terminal status must come from
+	// the run's actual state, not the onStatusChange callback (which is
+	// Bricklens-only), so a SUCCESS run isn't mislabeled FAILED in the envelope.
+	var buf bytes.Buffer
+	err := runWatchCmd(t, flags.OutputJSON, &buf, watchServerMLflow(t, "SUCCESS").URL)
+	require.NoError(t, err)
+
+	lines := strings.Split(strings.TrimSpace(buf.String()), "\n")
+	assert.Contains(t, lines[0], `"type":"SUBMITTED"`)
+	// Logs stream through the fallback, and the closing envelope reflects the
+	// real terminal status.
+	assert.Contains(t, buf.String(), `"line":"step 1"`)
+	assert.Contains(t, lines[len(lines)-1], `"status":"SUCCESS"`)
+}
+
+func TestRunWatchFlagRegistered(t *testing.T) {
+	cmd := newRunCommand()
+	f := cmd.Flags().Lookup("watch")
+	require.NotNil(t, f)
+	assert.Equal(t, "false", f.DefValue)
+}
diff --git a/cmd/air/runconfig.go b/cmd/air/runconfig.go
new file mode 100644
index 00000000000..b53031e9a33
--- /dev/null
+++ b/cmd/air/runconfig.go
@@ -0,0 +1,924 @@
+package aircmd
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"maps"
+	"reflect"
+	"regexp"
+	"slices"
+	"strings"
+
+	"go.yaml.in/yaml/v3"
+)
+
+// This file ports the run YAML schema and its structural validation from the
+// Python CLI's sdk/config.py. "Structural" means types, required fields, and
+// format/cross-field rules that need no workspace access. Online checks (e.g.
+// GPU availability) and git/filesystem checks run at launch time and are
+// intentionally not ported here.
+//
+// Divergences from the Python schema: compute.node_pool_id / compute.pool_name
+// (see compute.go) and the top-level `priority` field are dropped because AIR
+// does not support node-pool placement. priority is a pool-queue-ordering knob,
+// so it goes with the pool fields.
+
+// REGEX_TASK_KEY_CHARS: ASCII alphanumeric, hyphen, underscore only (no periods).
+// Explicit ASCII class, not \w: \w matches Unicode letters that the ASCII-only
+// Jobs API task_key rejects.
+var taskKeyRe = regexp.MustCompile(`^[A-Za-z0-9_-]+$`)
+
+// gitRefRe guards the branch name against command injection (it flows into git
+// exec args). Only safe ref characters are allowed.
+var gitRefRe = regexp.MustCompile(`^[\w./-]+$`)
+
+// Canonical UUID (8-4-4-4-12 hex). Usage policy ids are server-generated UUIDs,
+// so an obviously-wrong value (e.g. a policy name pasted into usage_policy_id)
+// is rejected up front with a hint pointing at usage_policy_name.
+var uuidRe = regexp.MustCompile(`^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$`)
+
+// Unity Catalog image paths are submitted as <catalog>.<schema>.<image>:<tag>.
+// Keep validation structural only here: object existence and permissions are
+// workspace checks performed by the backend.
+var unityCatalogImageRe = regexp.MustCompile(`^[^.:\s]+\.[^.:\s]+\.[^.:\s]+:[^:\s]+$`)
+
+var containerNameRe = regexp.MustCompile(`^[a-z]([-a-z0-9]{0,30}[a-z0-9])?$`)
+
+var secretTemplateRe = regexp.MustCompile(`^\{\{secrets/([^/{}]+)/([^/{}]+)\}\}$`)
+
+// runConfig is the top-level run YAML schema: experiment_name + compute /
+// environment / code_source plus the command and run options.
+type runConfig struct {
+	ExperimentName string             `yaml:"experiment_name" help:"Name of the experiment. Becomes the Jobs API task key: max 100 characters, alphanumerics, hyphens, and underscores only." required:"yes"`
+	Compute        *computeConfig     `yaml:"compute" help:"Which accelerators to run on and how many." required:"yes"`
+	Environment    *environmentConfig `yaml:"environment" help:"Python dependencies, runtime version, or a Unity Catalog image for a single-command run."`
+	Command        *string            `yaml:"command" help:"Shell command that starts the workload. Mutually exclusive with containers. Max 1000 lines; move longer logic into a script under code_source."`
+	Containers     []containerConfig  `yaml:"containers" help:"Rank-partitioned containers for heterogeneous workloads. Mutually exclusive with command."`
+	EnvVariables   map[string]string  `yaml:"env_variables" help:"Plain environment variables, as NAME: value. A name here cannot also appear in secrets."`
+	Secrets        map[string]string  `yaml:"secrets" help:"Environment variables sourced from secrets, as NAME: scope/key."`
+	CodeSource     *codeSourceConfig  `yaml:"code_source" help:"Local code to upload and make available to the run."`
+	// MaxRetries defaults to 3 when unset; default-filling is a normalization
+	// concern handled at launch, so a nil pointer is left as-is here.
+	MaxRetries                *int           `yaml:"max_retries" help:"How many times to retry a failed run. Must be >= 0. Defaults to 3 when unset."`
+	TimeoutMinutes            *int           `yaml:"timeout_minutes" help:"Wall-clock limit for the run in minutes. Must be >= 1."`
+	IdempotencyToken          *string        `yaml:"idempotency_token" help:"Reuse token: a repeat submission with the same token returns the existing run instead of starting another. Max 64 characters."`
+	Parameters                map[string]any `yaml:"parameters" help:"Free-form values passed through to the workload. Any nested structure is allowed."`
+	MLflowRunName             *string        `yaml:"mlflow_run_name" help:"Name for the MLflow run. Max 100 characters, alphanumerics, hyphens, and underscores only."`
+	MLflowExperimentDirectory *string        `yaml:"mlflow_experiment_directory" help:"Workspace directory holding the MLflow experiment. Must start with /Workspace."`
+	MLflowArtifactLocation    *string        `yaml:"mlflow_artifact_location" help:"DBFS location where MLflow artifacts are written. A /Volumes path is normalized to dbfs:/Volumes/... ."`
+	Permissions               []permission   `yaml:"permissions" help:"Who may view or manage the run, as a list of principal plus level grants."`
+	UsagePolicyName           *string        `yaml:"usage_policy_name" help:"Usage policy to bill the run to, by name. Max 127 characters. Mutually exclusive with usage_policy_id."`
+	UsagePolicyID             *string        `yaml:"usage_policy_id" help:"Usage policy to bill the run to, by id. Mutually exclusive with usage_policy_name."`
+
+	// artifactYAML is the source-derived config serialized for upload after overrides.
+	artifactYAML []byte
+}
+
+// validate runs structural validation over the whole config, returning the first
+// failure. Fields are checked in declaration order to keep error output stable.
+func (c *runConfig) validate() error {
+	if err := validateExperimentName(c.ExperimentName); err != nil {
+		return err
+	}
+
+	if c.Compute == nil {
+		return errors.New("compute: section is required")
+	}
+	if err := c.Compute.validate(); err != nil {
+		return err
+	}
+
+	if c.Environment != nil {
+		if err := c.Environment.validate(); err != nil {
+			return err
+		}
+	}
+
+	if c.Command == nil && len(c.Containers) == 0 {
+		return errors.New("command is required when containers is not set")
+	}
+	if c.Command != nil && len(c.Containers) > 0 {
+		return errors.New("command and containers are mutually exclusive; set only one")
+	}
+	if c.Command != nil {
+		if err := validateCommand(*c.Command); err != nil {
+			return err
+		}
+	}
+	if len(c.Containers) > 0 {
+		if c.Environment != nil && c.Environment.UnityCatalogImage != "" {
+			return errors.New("environment.unity_catalog_image cannot be used with containers; set unity_catalog_image on every container")
+		}
+		if err := c.validateContainers(); err != nil {
+			return err
+		}
+	}
+
+	if err := validateSecretRefs(c.Secrets); err != nil {
+		return err
+	}
+
+	// A name can't be both a plain env var and a secret: the precedence would be
+	// ambiguous and could leak the secret. Sorted for a stable error.
+	for _, name := range slices.Sorted(maps.Keys(c.EnvVariables)) {
+		if _, ok := c.Secrets[name]; ok {
+			return fmt.Errorf("%q is set in both env_variables and secrets; remove it from one", name)
+		}
+	}
+
+	if c.CodeSource != nil {
+		if err := c.CodeSource.validate(); err != nil {
+			return err
+		}
+	}
+
+	if c.MaxRetries != nil && *c.MaxRetries < 0 {
+		return fmt.Errorf("max_retries must be >= 0, got %d", *c.MaxRetries)
+	}
+
+	if c.TimeoutMinutes != nil && *c.TimeoutMinutes < 1 {
+		return fmt.Errorf("timeout_minutes must be >= 1, got %d", *c.TimeoutMinutes)
+	}
+
+	if c.IdempotencyToken != nil {
+		v := strings.TrimSpace(*c.IdempotencyToken)
+		if v == "" {
+			return errors.New("idempotency_token cannot be empty")
+		}
+		if len(v) > 64 {
+			return errors.New("idempotency_token must be 64 characters or less")
+		}
+	}
+
+	if c.MLflowRunName != nil {
+		v := strings.TrimSpace(*c.MLflowRunName)
+		if v == "" {
+			return errors.New("mlflow_run_name cannot be empty")
+		}
+		if len(v) > 100 {
+			return fmt.Errorf("mlflow_run_name must be 100 characters or less (got %d)", len(v))
+		}
+		if !taskKeyRe.MatchString(v) {
+			return fmt.Errorf("invalid mlflow_run_name %q: only alphanumeric characters, hyphens, and underscores are allowed", v)
+		}
+	}
+
+	if c.MLflowExperimentDirectory != nil {
+		v := strings.TrimSpace(*c.MLflowExperimentDirectory)
+		if v == "" {
+			return errors.New("mlflow_experiment_directory cannot be empty")
+		}
+		// MLflow experiments live under the workspace tree.
+		if !strings.HasPrefix(v, "/Workspace") {
+			return fmt.Errorf("mlflow_experiment_directory must start with '/Workspace', got: %s", v)
+		}
+	}
+
+	if c.MLflowArtifactLocation != nil {
+		v := strings.TrimSpace(*c.MLflowArtifactLocation)
+		if v == "" {
+			return errors.New("mlflow_artifact_location cannot be empty")
+		}
+		if strings.HasPrefix(v, "/Volumes/") {
+			v = "dbfs:" + v
+		}
+		if !strings.HasPrefix(v, "dbfs:/") {
+			return fmt.Errorf("mlflow_artifact_location must be a dbfs: URI, got: %s", v)
+		}
+		*c.MLflowArtifactLocation = v
+	}
+
+	for i := range c.Permissions {
+		if err := c.Permissions[i].validate(); err != nil {
+			return err
+		}
+	}
+
+	// A usage policy is given by name or id, never both; the name resolves to an
+	// id at launch.
+	if c.UsagePolicyName != nil && c.UsagePolicyID != nil {
+		return errors.New("usage_policy_name and usage_policy_id are mutually exclusive; set only one")
+	}
+	if c.UsagePolicyName != nil {
+		v := strings.TrimSpace(*c.UsagePolicyName)
+		if v == "" {
+			return errors.New("usage_policy_name must not be empty")
+		}
+		// 127 matches the server-side max_length on the policy name filter.
+		if len(v) > 127 {
+			return fmt.Errorf("usage_policy_name must be at most 127 characters, got %d", len(v))
+		}
+	}
+	if c.UsagePolicyID != nil {
+		v := strings.TrimSpace(*c.UsagePolicyID)
+		if v == "" {
+			return errors.New("usage_policy_id must not be empty")
+		}
+		if !uuidRe.MatchString(v) {
+			return fmt.Errorf("usage_policy_id must be a UUID (for example, '12345678-90ab-cdef-1234-567890abcdef'), got: %s. To assign a policy by name instead, use usage_policy_name", v)
+		}
+	}
+
+	return nil
+}
+
+// containerConfig is one rank-partitioned ContainerSpec. command is uploaded
+// as command.sh and submitted as command_path; environment_variables are
+// staged beside it because PuPr workspaces cannot consume the DEVELOPMENT API
+// field yet.
+type containerConfig struct {
+	Name                 string                               `yaml:"name" help:"Unique container name: 1–32 lowercase letters, digits, or hyphens; start with a letter and end with a letter or digit." required:"yes"`
+	Command              *string                              `yaml:"command" help:"Shell command run on every rank assigned to this container." required:"yes"`
+	Ranks                []int                                `yaml:"ranks" help:"Zero-based node ranks assigned to this container." required:"yes"`
+	UnityCatalogImage    string                               `yaml:"unity_catalog_image" help:"Unity Catalog image as <catalog>.<schema>.<image>:<tag>." required:"yes"`
+	EnvironmentVariables *containerEnvironmentVariablesConfig `yaml:"environment_variables" help:"Environment variables scoped to this container."`
+}
+
+type containerEnvironmentVariablesConfig struct {
+	Variables map[string]string `yaml:"variables" help:"Inline environment variables. Secret values use {{secrets/<scope>/<key>}}."`
+	Files     []string          `yaml:"files" help:"Environment files. Not yet supported for containers by the CLI sidecar path."`
+}
+
+func (c *runConfig) validateContainers() error {
+	g, err := parseGPUType(c.Compute.AcceleratorType)
+	if err != nil {
+		return err
+	}
+	perNode, err := gpusPerNode(g)
+	if err != nil {
+		return err
+	}
+	nodeCount := c.Compute.NumAccelerators / perNode
+	owners := make([]string, nodeCount)
+	names := map[string]struct{}{}
+
+	for i := range c.Containers {
+		container := &c.Containers[i]
+		prefix := fmt.Sprintf("containers[%d]", i)
+		if !containerNameRe.MatchString(container.Name) {
+			return fmt.Errorf("%s.name must start with a lowercase letter, contain only lowercase letters, digits, or '-', end with a letter or digit, and be at most 32 characters, got %q", prefix, container.Name)
+		}
+		if _, exists := names[container.Name]; exists {
+			return fmt.Errorf("%s.name %q is duplicated; container names must be unique", prefix, container.Name)
+		}
+		names[container.Name] = struct{}{}
+		if container.Command == nil {
+			return fmt.Errorf("%s.command is required", prefix)
+		}
+		if err := validateCommand(*container.Command); err != nil {
+			return fmt.Errorf("%s.command: %w", prefix, err)
+		}
+		if len(container.Ranks) == 0 {
+			return fmt.Errorf("%s.ranks must contain at least one rank", prefix)
+		}
+		if !unityCatalogImageRe.MatchString(container.UnityCatalogImage) {
+			return fmt.Errorf("%s.unity_catalog_image must be in the format '<catalog>.<schema>.<image>:<tag>', got %q", prefix, container.UnityCatalogImage)
+		}
+		if container.EnvironmentVariables != nil {
+			if len(container.EnvironmentVariables.Files) > 0 {
+				return fmt.Errorf("%s.environment_variables.files is not supported while container environment variables use workspace sidecars; use environment_variables.variables", prefix)
+			}
+			for name, value := range container.EnvironmentVariables.Variables {
+				if strings.HasPrefix(value, "{{secrets/") && !secretTemplateRe.MatchString(value) {
+					return fmt.Errorf("%s.environment_variables.variables.%s has an invalid secret reference %q; expected {{secrets/<scope>/<key>}}", prefix, name, value)
+				}
+			}
+		}
+		for _, rank := range container.Ranks {
+			if rank < 0 || rank >= nodeCount {
+				return fmt.Errorf("%s.ranks contains %d, but valid ranks for this compute are 0 through %d", prefix, rank, nodeCount-1)
+			}
+			if owners[rank] != "" {
+				return fmt.Errorf("rank %d is assigned to both containers %q and %q", rank, owners[rank], container.Name)
+			}
+			owners[rank] = container.Name
+		}
+	}
+	for rank, owner := range owners {
+		if owner == "" {
+			return fmt.Errorf("rank %d is not assigned to a container; containers.ranks must partition ranks 0 through %d exactly once", rank, nodeCount-1)
+		}
+	}
+	return nil
+}
+
+// validateExperimentName enforces the Databricks Jobs API task_key constraints:
+// the experiment_name becomes a task key, which caps at 100 characters and allows
+// only alphanumerics, hyphens, and underscores.
+func validateExperimentName(v string) error {
+	if v == "" {
+		return errors.New("experiment_name cannot be empty")
+	}
+	if len(v) > 100 {
+		return fmt.Errorf("experiment_name must be 100 characters or less (got %d); this is the Jobs API task_key length limit", len(v))
+	}
+	if !taskKeyRe.MatchString(v) {
+		return fmt.Errorf("invalid experiment_name %q: only alphanumeric characters, hyphens (-), and underscores (_) are allowed", v)
+	}
+	return nil
+}
+
+// validateCommand enforces command is non-empty and within the line-count cap.
+func validateCommand(v string) error {
+	if strings.TrimSpace(v) == "" {
+		return errors.New("command cannot be empty")
+	}
+	lineCount := strings.Count(v, "\n") + 1
+	if lineCount > 1000 {
+		return fmt.Errorf("command is too long (%d lines); maximum is 1000 lines — move complex logic into a script in your code_source", lineCount)
+	}
+	return nil
+}
+
+// validateSecretRefs checks that secret references use the "scope/key" format.
+func validateSecretRefs(secrets map[string]string) error {
+	for varName, ref := range secrets {
+		parts := strings.Split(ref, "/")
+		if len(parts) != 2 {
+			return fmt.Errorf("invalid secret reference %q for variable %q: expected format 'scope/key' (e.g., my_scope/hf_token)", ref, varName)
+		}
+		if parts[0] == "" || parts[1] == "" {
+			return fmt.Errorf("invalid secret reference %q for variable %q: scope and key cannot be empty", ref, varName)
+		}
+	}
+	return nil
+}
+
+// environmentConfig is the `environment` block: dependencies and runtime image
+// settings.
+type environmentConfig struct {
+	Dependencies      dependencies `yaml:"dependencies" help:"Inline list of packages to install. Not allowed alongside unity_catalog_image."`
+	Version           stringOrInt  `yaml:"version" help:"Client image version to pin (default: 6). See environment version release notes: https://docs.databricks.com/aws/en/release-notes/serverless/environment-version/"`
+	UnityCatalogImage string       `yaml:"unity_catalog_image" help:"Unity Catalog custom image to run the workload on, as <catalog>.<schema>.<image>:<tag>. Not allowed alongside dependencies or version."`
+}
+
+func (e *environmentConfig) validate() error {
+	unityCatalogImage := e.UnityCatalogImage
+	if unityCatalogImage != "" && !unityCatalogImageRe.MatchString(unityCatalogImage) {
+		return fmt.Errorf("environment.unity_catalog_image must be in the format '<catalog>.<schema>.<image>:<tag>', got %q", e.UnityCatalogImage)
+	}
+
+	// unity_catalog_image is exclusive with dependencies/version: the image already
+	// pins the full runtime.
+	if unityCatalogImage != "" {
+		var conflicting []string
+		if e.Dependencies.set {
+			conflicting = append(conflicting, "dependencies")
+		}
+		if e.Version.set {
+			conflicting = append(conflicting, "version")
+		}
+		if len(conflicting) > 0 {
+			return fmt.Errorf("when 'unity_catalog_image' is specified under 'environment', these fields are not allowed: %s", strings.Join(conflicting, ", "))
+		}
+		return nil
+	}
+
+	if e.Version.set {
+		version, err := validateRuntimeVersion(e.Version.raw, "environment.version")
+		if err != nil {
+			return err
+		}
+		e.Version.raw = version
+	}
+
+	return nil
+}
+
+// dependencies is environment.dependencies: an inline list of packages. A scalar
+// (e.g. a path to a requirements file) is rejected — the list may itself reference
+// a requirements.txt, but dependencies must be given as a list.
+type dependencies struct {
+	set  bool
+	list []string
+}
+
+func (d *dependencies) UnmarshalYAML(node *yaml.Node) error {
+	if node.Kind != yaml.SequenceNode {
+		return errors.New("environment.dependencies must be a list of packages or reference a requirements.txt (see https://docs.databricks.com/aws/en/machine-learning/ai-runtime/cli/yaml-config#reference). A direct file reference is not supported")
+	}
+	d.set = true
+	return node.Decode(&d.list)
+}
+
+// stringOrInt holds a scalar that may be a string or an integer in YAML
+// (environment.version). The raw text is kept; integer-format validation is a
+// launch-time concern.
+type stringOrInt struct {
+	set bool
+	raw string
+}
+
+func (s *stringOrInt) UnmarshalYAML(node *yaml.Node) error {
+	if node.Kind != yaml.ScalarNode {
+		return errors.New("environment.version must be a string or integer")
+	}
+	s.set = true
+	s.raw = node.Value
+	return nil
+}
+
+// codeSourceConfig is the `code_source` block. Only the "snapshot" type exists.
+type codeSourceConfig struct {
+	Type           *string               `yaml:"type,omitempty" hidden:"yes"`
+	Snapshot       *snapshotSourceConfig `yaml:",inline"`
+	LegacySnapshot *snapshotSourceConfig `yaml:"snapshot,omitempty" hidden:"yes"`
+}
+
+func (c *codeSourceConfig) validate() error {
+	if c.Type != nil && strings.TrimSpace(*c.Type) == "" {
+		return errors.New("code_source.type cannot be empty; omit it to use snapshot")
+	}
+	if c.Type != nil && *c.Type != "snapshot" {
+		return fmt.Errorf("code_source.type must be 'snapshot', got %q", *c.Type)
+	}
+	if c.Snapshot != nil && c.LegacySnapshot != nil {
+		return errors.New("code_source cannot combine the nested 'snapshot' block with direct fields; remove the 'snapshot' wrapper and place all fields directly under code_source")
+	}
+
+	snapshot := c.Snapshot
+	prefix := "code_source"
+	if snapshot == nil {
+		snapshot = c.LegacySnapshot
+		prefix = "code_source.snapshot"
+	}
+	if snapshot == nil {
+		return errors.New("code_source requires snapshot configuration with root_path")
+	}
+	if err := snapshot.validate(prefix); err != nil {
+		return err
+	}
+
+	c.Snapshot = snapshot
+	c.LegacySnapshot = nil
+	return nil
+}
+
+// snapshotSourceConfig describes a local directory to tar and upload.
+type snapshotSourceConfig struct {
+	RootPath     string   `yaml:"root_path" help:"Root of the code source to archive. A git-pinned subdirectory packages only that subtree." required:"when code_source is set"`
+	RemoteVolume *string  `yaml:"remote_volume" help:"Volume to upload the archive to. Must start with /Volumes/."`
+	Git          *gitRef  `yaml:"git" help:"Pin the snapshot to a specific git revision."`
+	IncludePaths []string `yaml:"include_paths" help:"Restrict the archive to these paths, relative to root_path and without \"..\". Omit to include everything."`
+}
+
+func (s *snapshotSourceConfig) validate(prefix string) error {
+	if strings.TrimSpace(s.RootPath) == "" {
+		return fmt.Errorf("%s.root_path cannot be empty", prefix)
+	}
+
+	if s.RemoteVolume != nil && !strings.HasPrefix(*s.RemoteVolume, "/Volumes/") {
+		return fmt.Errorf("%s.remote_volume must start with '/Volumes/'", prefix)
+	}
+
+	// A non-nil but empty include_paths is an explicit mistake (omit it instead).
+	if s.IncludePaths != nil && len(s.IncludePaths) == 0 {
+		return fmt.Errorf("%s.include_paths cannot be an empty list; either omit it or provide paths", prefix)
+	}
+	for _, p := range s.IncludePaths {
+		p = strings.TrimSpace(p)
+		if p == "" {
+			return fmt.Errorf("%s.include_paths entry cannot be empty", prefix)
+		}
+		if strings.HasPrefix(p, "/") {
+			return fmt.Errorf("%s.include_paths must be relative paths, got: %s", prefix, p)
+		}
+		// No parent traversal: snapshots must stay within root_path.
+		if slices.Contains(strings.Split(p, "/"), "..") {
+			return fmt.Errorf("%s.include_paths cannot contain '..' traversal, got: %s", prefix, p)
+		}
+	}
+
+	if s.Git != nil {
+		return s.Git.validate()
+	}
+	return nil
+}
+
+// gitRef pins a snapshot to a specific git ref. branch and commit are mutually
+// exclusive; remote is only meaningful with branch.
+type gitRef struct {
+	Branch *string   `yaml:"branch" help:"Branch to pin to, resolved to its local HEAD. Mutually exclusive with commit." required:"one of branch or commit"`
+	Commit *string   `yaml:"commit" help:"Commit to pin to. Mutually exclusive with branch." required:"one of branch or commit"`
+	Remote gitRemote `yaml:"remote" help:"No longer supported: the snapshot archives your local copy. Only false is accepted; use commit to pin a revision."`
+}
+
+func (g *gitRef) validate() error {
+	if g.Branch != nil && !gitRefRe.MatchString(*g.Branch) {
+		return fmt.Errorf("invalid git.branch format %q: only alphanumeric characters, hyphens, dots, slashes, and underscores are allowed", *g.Branch)
+	}
+
+	// The remote-fetch path (fetching a branch's remote HEAD) is deprecated: the
+	// snapshot archives the local copy only. A truthy git.remote (a name or `true`)
+	// is rejected; `remote: false` is the default (local HEAD) and stays valid.
+	if g.Remote.truthy() {
+		return errors.New("git.remote is no longer supported: the snapshot archives your local copy, so a branch resolves to its local HEAD. To deploy a specific committed revision, use git.commit")
+	}
+
+	if g.Branch == nil && g.Commit == nil {
+		return errors.New("git: must specify either 'branch' or 'commit'")
+	}
+	if g.Branch != nil && g.Commit != nil {
+		return errors.New("git: 'branch' and 'commit' are mutually exclusive — specify only one")
+	}
+	return nil
+}
+
+// gitRemote is git.remote: false (default, use local HEAD), true (auto-detect the
+// remote), or a remote name string.
+type gitRemote struct {
+	set      bool
+	isString bool
+	name     string
+	enabled  bool
+}
+
+func (r *gitRemote) UnmarshalYAML(node *yaml.Node) error {
+	if node.Kind != yaml.ScalarNode {
+		return errors.New("git.remote must be a boolean or a remote name string")
+	}
+	r.set = true
+	if node.Tag == "!!bool" {
+		return node.Decode(&r.enabled)
+	}
+	r.isString = true
+	r.name = node.Value
+	return nil
+}
+
+// truthy reports whether remote requests a remote fetch (mirrors Python's
+// truthiness of the bool|str union).
+func (r *gitRemote) truthy() bool {
+	if r.isString {
+		return r.name != ""
+	}
+	return r.enabled
+}
+
+// permission is a DABs-compatible permission grant: exactly one principal plus a
+// level.
+type permission struct {
+	UserName             *string `yaml:"user_name" help:"Grant to this user, by email. Exactly one principal field per grant." required:"one principal per grant"`
+	GroupName            *string `yaml:"group_name" help:"Grant to this group, by name. Exactly one principal field per grant." required:"one principal per grant"`
+	ServicePrincipalName *string `yaml:"service_principal_name" help:"Grant to this service principal, by name. Exactly one principal field per grant." required:"one principal per grant"`
+	// Level is a databricks PermissionLevel (e.g. CAN_VIEW, CAN_MANAGE). Enum
+	// membership is validated server-side; here we only require it to be set.
+	Level string `yaml:"level" help:"Permission level to grant, e.g. CAN_VIEW or CAN_MANAGE. Validated server-side." required:"when a grant is listed"`
+}
+
+func (p *permission) validate() error {
+	principals := map[string]*string{
+		"user_name":              p.UserName,
+		"group_name":             p.GroupName,
+		"service_principal_name": p.ServicePrincipalName,
+	}
+	var set []string
+	for name, val := range principals {
+		if val != nil {
+			set = append(set, name)
+		}
+	}
+	switch len(set) {
+	case 0:
+		return errors.New("permissions: one of 'user_name', 'group_name', or 'service_principal_name' must be specified")
+	case 1:
+		name := set[0]
+		if strings.TrimSpace(*principals[name]) == "" {
+			return fmt.Errorf("permissions: '%s' cannot be empty", name)
+		}
+	default:
+		return errors.New("permissions: only one of 'user_name', 'group_name', or 'service_principal_name' can be specified")
+	}
+
+	if strings.TrimSpace(p.Level) == "" {
+		return errors.New("permissions: 'level' is required")
+	}
+	return nil
+}
+
+// Below: `air run -h config.<field>`, which documents the schema above from its
+// yaml/help/required struct tags.
+
+// configHelpRoot is the optional leading segment of a help path (`config.compute`
+// or bare `compute`).
+const configHelpRoot = "config"
+
+// writeConfigFieldHelp resolves a dotted config path and writes its docs.
+func writeConfigFieldHelp(w io.Writer, path string) error {
+	field, err := resolveConfigField(path)
+	if err != nil {
+		return err
+	}
+	renderConfigField(w, field)
+	return nil
+}
+
+// freeFormConfigFields hold free-form maps, so path resolution stops at them:
+// their keys are chosen by the user, not the schema.
+var freeFormConfigFields = map[string]bool{
+	"parameters":    true,
+	"env_variables": true,
+	"secrets":       true,
+}
+
+// configTypeNames labels the polymorphic unions, whose YAML shape reflection
+// can't see (unexported fields filled by a custom UnmarshalYAML).
+var configTypeNames = map[reflect.Type]string{
+	reflect.TypeFor[dependencies](): "list of strings",
+	reflect.TypeFor[stringOrInt]():  "string or int",
+	reflect.TypeFor[gitRemote]():    "bool or string",
+}
+
+// configField is one resolved node of the run config schema.
+type configField struct {
+	path     string
+	typeName string
+	required string
+	help     string
+	hidden   bool
+	// freeForm marks a user-keyed map (parameters/secrets/env_variables): no
+	// children, yet any sub-path into it is valid.
+	freeForm bool
+	children []configField // nil for a leaf
+}
+
+// configSchema is the single reflection walk over runConfig; both
+// `-h config.<field>` and --override path validation resolve against it.
+func configSchema() configField {
+	return configField{
+		path: configHelpRoot,
+		help: "The run YAML schema. Pass a field path for details, e.g. " + configHelpRoot + `.compute.accelerator_type.
+
+  AI coding agents can use the databricks-ai-runtime skill to write workload
+  YAML, submit runs, and monitor progress.
+
+  Install the skill locally for your coding agent:
+
+    databricks aitools install --skills-only --skills databricks-ai-runtime --experimental
+
+  Follow the prompts to choose your coding agent and installation scope.
+  Use --scope project to install into the current project.
+  See: https://github.com/databricks/databricks-agent-skills/tree/main/experimental/databricks-ai-runtime`,
+		children: describeStruct(reflect.TypeFor[runConfig](), configHelpRoot),
+	}
+}
+
+// resolveConfigField resolves a dotted YAML path against the run config schema.
+// The leading "config." is optional; an empty path describes the whole schema.
+func resolveConfigField(path string) (configField, error) {
+	trimmed := strings.TrimPrefix(strings.TrimPrefix(path, configHelpRoot), ".")
+	root := configSchema()
+	if trimmed == "" {
+		return root, nil
+	}
+
+	current := root
+	for i, part := range strings.Split(trimmed, ".") {
+		if current.freeForm {
+			// Keys are user-defined, so the map is the most specific node.
+			return configField{}, fmt.Errorf("%q holds user-defined keys, so %q is not part of the schema; see %q instead", current.path, part, current.path)
+		}
+		if len(current.children) == 0 {
+			return configField{}, fmt.Errorf("%q is not an object, so it has no field %q", current.path, part)
+		}
+		child, ok := findConfigChild(current.children, part)
+		if !ok || child.hidden {
+			return configField{}, unknownConfigFieldError(current, part, strings.Split(trimmed, ".")[:i+1])
+		}
+		current = child
+	}
+	return current, nil
+}
+
+// findConfigChild looks up an immediate child by its YAML name.
+func findConfigChild(children []configField, name string) (configField, bool) {
+	for _, c := range children {
+		if configLeafName(c.path) == name {
+			return c, true
+		}
+	}
+	return configField{}, false
+}
+
+// configLeafName returns the last segment of a dotted path.
+func configLeafName(path string) string {
+	_, leaf, found := cutLast(path, ".")
+	if !found {
+		return path
+	}
+	return leaf
+}
+
+// cutLast splits s around the final instance of sep.
+func cutLast(s, sep string) (before, after string, found bool) {
+	before, after, ok := strings.CutLast(s, sep)
+	if !ok {
+		return s, "", false
+	}
+	return before, after, true
+}
+
+// unknownConfigFieldError reports an unresolvable segment, naming the valid
+// siblings and, when one is close enough, a suggestion.
+func unknownConfigFieldError(parent configField, part string, matched []string) error {
+	names := make([]string, 0, len(parent.children))
+	for _, c := range parent.children {
+		if c.hidden {
+			continue
+		}
+		names = append(names, configLeafName(c.path))
+	}
+	slices.Sort(names)
+
+	msg := fmt.Sprintf("unknown config field %q", configHelpRoot+"."+strings.Join(matched, "."))
+	if suggestion, ok := closestConfigField(part, names); ok {
+		msg += fmt.Sprintf("; did you mean %q?", suggestion)
+	}
+	return fmt.Errorf("%s\n\nfields under %q are: %s", msg, parent.path, strings.Join(names, ", "))
+}
+
+// closestConfigField returns the nearest candidate by edit distance, if one is
+// close enough to be worth suggesting.
+func closestConfigField(name string, candidates []string) (string, bool) {
+	best, bestDist := "", 0
+	for _, c := range candidates {
+		d := configEditDistance(name, c)
+		// Allow roughly a third of the name to differ, and always accept a
+		// single edit so short names still get a suggestion.
+		limit := max(len(c)/3, 1)
+		if d <= limit && (best == "" || d < bestDist) {
+			best, bestDist = c, d
+		}
+	}
+	return best, best != ""
+}
+
+// configEditDistance computes the Levenshtein distance between two strings.
+func configEditDistance(a, b string) int {
+	prev := make([]int, len(b)+1)
+	curr := make([]int, len(b)+1)
+	for j := range prev {
+		prev[j] = j
+	}
+	for i := 1; i <= len(a); i++ {
+		curr[0] = i
+		for j := 1; j <= len(b); j++ {
+			cost := 1
+			if a[i-1] == b[j-1] {
+				cost = 0
+			}
+			curr[j] = min(min(curr[j-1]+1, prev[j]+1), prev[j-1]+cost)
+		}
+		prev, curr = curr, prev
+	}
+	return prev[len(b)]
+}
+
+// describeStruct reads a struct's yaml/help/required tags into configFields,
+// recursing into nested objects. Declaration order matches validate()'s errors.
+func describeStruct(t reflect.Type, prefix string) []configField {
+	var out []configField
+	for f := range t.Fields() {
+		tag := f.Tag.Get("yaml")
+		if tag == "" || tag == "-" {
+			continue
+		}
+		name, options, _ := strings.Cut(tag, ",")
+		if slices.Contains(strings.Split(options, ","), "inline") {
+			if nested := underlyingConfigStruct(f.Type); nested != nil {
+				out = append(out, describeStruct(nested, prefix)...)
+			}
+			continue
+		}
+		if name == "" || name == "-" {
+			continue
+		}
+
+		field := configField{
+			path:     prefix + "." + name,
+			typeName: configTypeName(f.Type),
+			required: f.Tag.Get("required"),
+			help:     f.Tag.Get("help"),
+			hidden:   f.Tag.Get("hidden") == "yes",
+			freeForm: freeFormConfigFields[name],
+		}
+		if nested := underlyingConfigStruct(f.Type); nested != nil && !field.freeForm {
+			field.children = describeStruct(nested, field.path)
+		}
+		out = append(out, field)
+	}
+	return out
+}
+
+// configTypeName renders a field's YAML-facing type.
+func configTypeName(t reflect.Type) string {
+	if name, ok := configTypeNames[t]; ok {
+		return name
+	}
+	for t.Kind() == reflect.Pointer {
+		t = t.Elem()
+	}
+	switch t.Kind() {
+	case reflect.String:
+		return "string"
+	case reflect.Int:
+		return "int"
+	case reflect.Bool:
+		return "bool"
+	case reflect.Slice:
+		return "list of " + configTypeName(t.Elem())
+	case reflect.Map:
+		return fmt.Sprintf("map of %s to %s", configTypeName(t.Key()), configTypeName(t.Elem()))
+	case reflect.Struct:
+		return "object"
+	case reflect.Interface:
+		return "any"
+	default:
+		return t.Kind().String()
+	}
+}
+
+// underlyingConfigStruct unwraps pointer/slice indirection and returns the struct
+// type a field decodes into, or nil if it is not a struct. The polymorphic unions
+// are excluded: they are structs, but their YAML shape is scalar or list.
+func underlyingConfigStruct(t reflect.Type) reflect.Type {
+	if _, ok := configTypeNames[t]; ok {
+		return nil
+	}
+	for t.Kind() == reflect.Pointer || t.Kind() == reflect.Slice {
+		t = t.Elem()
+	}
+	if t.Kind() == reflect.Struct {
+		return t
+	}
+	return nil
+}
+
+// renderConfigField writes a resolved field's documentation. An object lists its
+// immediate children; a leaf gets its type, required-ness, and description.
+func renderConfigField(w io.Writer, f configField) {
+	fmt.Fprintf(w, "%s\n", f.path)
+	if f.help != "" {
+		fmt.Fprintf(w, "  %s\n", f.help)
+	}
+
+	if len(f.children) == 0 {
+		fmt.Fprintf(w, "\n  Type:     %s\n", f.typeName)
+		required := f.required
+		if required == "" {
+			required = "no"
+		}
+		fmt.Fprintf(w, "  Required: %s\n", required)
+		return
+	}
+
+	width := 0
+	for _, c := range f.children {
+		if c.hidden {
+			continue
+		}
+		width = max(width, len(configLeafName(c.path)))
+	}
+	fmt.Fprintf(w, "\n  Fields:\n")
+	for _, c := range f.children {
+		if c.hidden {
+			continue
+		}
+		fmt.Fprintf(w, "    %-*s  %s\n", width, configLeafName(c.path), configFieldSummary(c))
+	}
+	fmt.Fprintf(w, "\nUse \"-h %s.<field>\" for details on a field.\n", f.path)
+}
+
+// configFieldSummary is the one-line description used in a field listing: the
+// first sentence of the help text, annotated when the field is required.
+func configFieldSummary(f configField) string {
+	summary := firstSentence(f.help)
+	if f.required == "yes" {
+		summary = "(required) " + summary
+	}
+	return summary
+}
+
+// sentenceAbbreviations end in a period that does not close a sentence, so
+// firstSentence must not break on them.
+var sentenceAbbreviations = []string{"e.g.", "i.e.", "etc.", "vs.", "cf."}
+
+// firstSentence returns s up to and including the first sentence-ending period,
+// i.e. the first ". " boundary not immediately preceded by a known abbreviation.
+// Returns s unchanged when it holds a single sentence.
+func firstSentence(s string) string {
+	for i := 0; i+1 < len(s); i++ {
+		if s[i] != '.' || s[i+1] != ' ' {
+			continue
+		}
+		candidate := s[:i+1]
+		if slices.ContainsFunc(sentenceAbbreviations, func(a string) bool {
+			return strings.HasSuffix(candidate, a)
+		}) {
+			continue
+		}
+		return candidate
+	}
+	return s
+}
diff --git a/cmd/air/runconfig_launch.go b/cmd/air/runconfig_launch.go
new file mode 100644
index 00000000000..ef7f471b5a5
--- /dev/null
+++ b/cmd/air/runconfig_launch.go
@@ -0,0 +1,56 @@
+package aircmd
+
+// This file flattens the validated runConfig schema into the derived values the
+// launch path consumes, replacing the Python CLI's _convert_to_run_config step.
+// There is no separate internal config type: handle_run reads runConfig directly,
+// using these accessors for the values that need computing rather than a plain
+// field read.
+
+const defaultMaxRetries = 3
+
+// timeoutSeconds converts timeout_minutes to seconds. Zero means the user set no
+// timeout and the backend default applies.
+func (c *runConfig) timeoutSeconds() int {
+	if c.TimeoutMinutes == nil {
+		return 0
+	}
+	return *c.TimeoutMinutes * 60
+}
+
+// maxRetries returns the retry count, applying the schema default when unset.
+func (c *runConfig) maxRetries() int {
+	if c.MaxRetries == nil {
+		return defaultMaxRetries
+	}
+	return *c.MaxRetries
+}
+
+// unityCatalogImagePath returns the configured Unity Catalog image reference,
+// or "" when none is set.
+func (c *runConfig) unityCatalogImagePath() string {
+	if c.Environment == nil {
+		return ""
+	}
+	return c.Environment.UnityCatalogImage
+}
+
+// inlineDependencies returns the inline package list from
+// environment.dependencies, and whether it was set.
+func (c *runConfig) inlineDependencies() ([]string, bool) {
+	if c.Environment == nil || !c.Environment.Dependencies.set {
+		return nil, false
+	}
+	return c.Environment.Dependencies.list, true
+}
+
+// runtimeVersion returns the client image version from environment.version when
+// set.
+func (c *runConfig) runtimeVersion() (string, bool) {
+	if c.Environment == nil {
+		return "", false
+	}
+	if !c.Environment.Version.set {
+		return "", false
+	}
+	return c.Environment.Version.raw, true
+}
diff --git a/cmd/air/runconfig_launch_test.go b/cmd/air/runconfig_launch_test.go
new file mode 100644
index 00000000000..96bfae4799b
--- /dev/null
+++ b/cmd/air/runconfig_launch_test.go
@@ -0,0 +1,65 @@
+package aircmd
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestRunConfigTimeoutSeconds(t *testing.T) {
+	c := &runConfig{}
+	assert.Equal(t, 0, c.timeoutSeconds())
+
+	c.TimeoutMinutes = new(2)
+	assert.Equal(t, 120, c.timeoutSeconds())
+}
+
+func TestRunConfigMaxRetries(t *testing.T) {
+	c := &runConfig{}
+	assert.Equal(t, defaultMaxRetries, c.maxRetries())
+
+	c.MaxRetries = new(0)
+	assert.Equal(t, 0, c.maxRetries())
+
+	c.MaxRetries = new(7)
+	assert.Equal(t, 7, c.maxRetries())
+}
+
+func TestRunConfigUnityCatalogImagePath(t *testing.T) {
+	c := &runConfig{}
+	assert.Empty(t, c.unityCatalogImagePath())
+
+	c.Environment = &environmentConfig{}
+	assert.Empty(t, c.unityCatalogImagePath())
+
+	c.Environment.UnityCatalogImage = "main.air.training:prod"
+	assert.Equal(t, "main.air.training:prod", c.unityCatalogImagePath())
+}
+
+func TestRunConfigDependencies(t *testing.T) {
+	t.Run("unset", func(t *testing.T) {
+		c := &runConfig{}
+		_, ok := c.inlineDependencies()
+		assert.False(t, ok)
+	})
+
+	t.Run("inline list", func(t *testing.T) {
+		c := &runConfig{Environment: &environmentConfig{
+			Dependencies: dependencies{set: true, list: []string{"torch", "numpy"}},
+		}}
+		list, ok := c.inlineDependencies()
+		assert.True(t, ok)
+		assert.Equal(t, []string{"torch", "numpy"}, list)
+	})
+}
+
+func TestRunConfigRuntimeVersion(t *testing.T) {
+	c := &runConfig{}
+	_, ok := c.runtimeVersion()
+	assert.False(t, ok)
+
+	c.Environment = &environmentConfig{Version: stringOrInt{set: true, raw: "5"}}
+	v, ok := c.runtimeVersion()
+	assert.True(t, ok)
+	assert.Equal(t, "5", v)
+}
diff --git a/cmd/air/runconfig_load.go b/cmd/air/runconfig_load.go
new file mode 100644
index 00000000000..ad7610436a2
--- /dev/null
+++ b/cmd/air/runconfig_load.go
@@ -0,0 +1,170 @@
+package aircmd
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"regexp"
+	"strconv"
+	"strings"
+
+	"go.yaml.in/yaml/v3"
+)
+
+// decodeRunConfigReader decodes and unknown-key-checks a run YAML from r. path is
+// used only for error messages.
+func decodeRunConfigReader(r io.Reader, path string) (*runConfig, error) {
+	dec := yaml.NewDecoder(r)
+	dec.KnownFields(true)
+
+	var cfg runConfig
+	if err := dec.Decode(&cfg); err != nil {
+		if errors.Is(err, io.EOF) {
+			return nil, fmt.Errorf("config %s is empty", path)
+		}
+		return nil, fmt.Errorf("invalid config %s: %w", path, err)
+	}
+	return &cfg, nil
+}
+
+// validateRunConfig runs structural validation over a decoded config.
+func validateRunConfig(cfg *runConfig) error {
+	return cfg.validate()
+}
+
+// loadRunConfig decodes and structurally validates a run YAML config file.
+// The `_bases_` composition feature is not yet supported and is rejected as an
+// unknown field.
+func loadRunConfig(path string) (*runConfig, error) {
+	document, raw, err := readRunConfigDocument(path)
+	if err != nil {
+		return nil, err
+	}
+	if len(document.Content) == 0 {
+		return nil, fmt.Errorf("config %s is empty", path)
+	}
+	return finishRunConfigLoad(path, document, raw)
+}
+
+// loadRunConfigWithOverrides decodes a run YAML config, applies any --override
+// KEY=VALUE entries to its ordered YAML tree, then re-decodes (with unknown keys
+// rejected) and structurally validates the result. The serialized tree is kept
+// for training_config.yaml, while validation may normalize the typed config used
+// to submit the workload. ctx is used only to log applied overrides.
+func loadRunConfigWithOverrides(ctx context.Context, path string, overrides []string) (*runConfig, error) {
+	if len(overrides) == 0 {
+		return loadRunConfig(path)
+	}
+
+	entries, err := parseOverrides(overrides)
+	if err != nil {
+		return nil, err
+	}
+	if err := validateOverridePaths(entries); err != nil {
+		return nil, err
+	}
+	document, _, err := readRunConfigDocument(path)
+	if err != nil {
+		return nil, err
+	}
+	if len(document.Content) == 0 {
+		document.Kind = yaml.DocumentNode
+		document.Content = []*yaml.Node{newMappingNode()}
+	}
+	if err := applyOverrides(ctx, document, entries); err != nil {
+		return nil, err
+	}
+	validationYAML, err := yaml.Marshal(document)
+	if err != nil {
+		return nil, fmt.Errorf("failed to serialize config %s: %w", path, err)
+	}
+	return finishRunConfigLoad(path, document, validationYAML)
+}
+
+func readRunConfigDocument(path string) (*yaml.Node, []byte, error) {
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		return nil, nil, err
+	}
+	var document yaml.Node
+	if err := yaml.Unmarshal(raw, &document); err != nil {
+		return nil, nil, fmt.Errorf("invalid config %s: %w", path, err)
+	}
+	return &document, raw, nil
+}
+
+func finishRunConfigLoad(path string, document *yaml.Node, validationYAML []byte) (*runConfig, error) {
+	// Validate before stripping comments so YAML errors retain source line numbers.
+	cfg, err := decodeRunConfigReader(bytes.NewReader(validationYAML), path)
+	if err != nil {
+		return nil, err
+	}
+	// YAML decodes omitted and null pointers alike. Preserve explicit nulls so validation rejects them.
+	if cfg.CodeSource != nil {
+		if cfg.CodeSource.Type == nil && codeSourceFieldPresent(document, "type") {
+			cfg.CodeSource.Type = new(string)
+		}
+		if cfg.CodeSource.LegacySnapshot == nil && codeSourceFieldPresent(document, "snapshot") {
+			cfg.CodeSource.LegacySnapshot = &snapshotSourceConfig{}
+		}
+	}
+	if err := validateRunConfig(cfg); err != nil {
+		return nil, err
+	}
+
+	stripYAMLComments(document)
+	artifactYAML, err := yaml.Marshal(document)
+	if err != nil {
+		return nil, fmt.Errorf("failed to serialize config %s: %w", path, err)
+	}
+	cfg.artifactYAML = artifactYAML
+	return cfg, nil
+}
+
+func codeSourceFieldPresent(document *yaml.Node, field string) bool {
+	codeSource, _ := mappingValue(document.Content[0], "code_source")
+	if codeSource == nil || codeSource.Kind != yaml.MappingNode {
+		return false
+	}
+	fieldNode, _ := mappingValue(codeSource, field)
+	return fieldNode != nil
+}
+
+func stripYAMLComments(node *yaml.Node) {
+	node.HeadComment = ""
+	node.LineComment = ""
+	node.FootComment = ""
+	for _, child := range node.Content {
+		stripYAMLComments(child)
+	}
+}
+
+var runtimeVersionRe = regexp.MustCompile(`^[0-9]+$`)
+
+const databricksAIPrefix = "databricks_ai_v"
+
+func validateRuntimeVersion(version, source string) (string, error) {
+	normalized := strings.ToLower(version)
+	numeric := normalized
+	usesDatabricksAI := strings.HasPrefix(normalized, databricksAIPrefix)
+	if usesDatabricksAI {
+		numeric = strings.TrimPrefix(normalized, databricksAIPrefix)
+	}
+	if !runtimeVersionRe.MatchString(numeric) {
+		return "", fmt.Errorf("unsupported client image version %q in %s: version must be an integer, optionally prefixed with databricks_ai_v", version, source)
+	}
+	if !usesDatabricksAI {
+		return numeric, nil
+	}
+	major, err := strconv.Atoi(numeric)
+	if err != nil {
+		return "", fmt.Errorf("failed to parse client image version %q in %s: %w", version, source, err)
+	}
+	if major < 5 {
+		return "", fmt.Errorf("databricks_ai_v in %s requires AI Runtime version 5 or higher, got %q", source, version)
+	}
+	return databricksAIPrefix + numeric, nil
+}
diff --git a/cmd/air/runconfig_override.go b/cmd/air/runconfig_override.go
new file mode 100644
index 00000000000..3fbccd076cb
--- /dev/null
+++ b/cmd/air/runconfig_override.go
@@ -0,0 +1,189 @@
+package aircmd
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"slices"
+	"strings"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"go.yaml.in/yaml/v3"
+)
+
+// This file implements the `--override KEY=VALUE` flag. Overrides are applied to
+// the parsed YAML tree (not the typed runConfig) before re-decode, so one pipeline
+// covers path existence, type coercion, and the semantic validate() rules while
+// preserving source key order for training_config.yaml.
+
+// parseOverrides parses --override KEY=VALUE arguments, preserving order.
+func parseOverrides(overrides []string) ([]overrideEntry, error) {
+	entries := make([]overrideEntry, 0, len(overrides))
+	for _, item := range overrides {
+		key, value, found := strings.Cut(item, "=")
+		if !found {
+			// --override is repeatable, so a config path meant for -f can be
+			// swallowed here; point at the real fix.
+			hint := ""
+			if strings.HasSuffix(item, ".yaml") || strings.HasSuffix(item, ".yml") {
+				hint = fmt.Sprintf("; %q looks like a config file — pass it with -f/--file", item)
+			}
+			return nil, fmt.Errorf("invalid --override %q: expected KEY=VALUE (e.g. compute.num_accelerators=32)%s", item, hint)
+		}
+		key = strings.TrimSpace(key)
+		if key == "" {
+			return nil, fmt.Errorf("invalid --override %q: empty key", item)
+		}
+		entries = append(entries, overrideEntry{path: key, raw: value})
+	}
+	return entries, nil
+}
+
+// overrideEntry is one parsed --override: its dotted path and the raw RHS string.
+type overrideEntry struct {
+	path string
+	raw  string
+}
+
+// validateOverridePaths checks every dotted path against the runConfig schema
+// before mutation, so an error names the exact --override key rather than the
+// re-decode's Go-type language.
+func validateOverridePaths(entries []overrideEntry) error {
+	schema := configSchema()
+	for _, e := range entries {
+		if err := checkOverridePath(strings.Split(e.path, "."), schema, e.path); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// checkOverridePath validates one dotted path against a resolved schema node.
+// It shares configSchema()'s reflection walk with `-h config.<field>` but keeps
+// the --override error voice, which names the offending flag.
+func checkOverridePath(parts []string, node configField, fullPath string) error {
+	name := parts[0]
+	child, ok := findConfigChild(node.children, name)
+	if !ok {
+		names := make([]string, 0, len(node.children))
+		for _, c := range node.children {
+			if c.hidden {
+				continue
+			}
+			names = append(names, configLeafName(c.path))
+		}
+		slices.Sort(names)
+		return fmt.Errorf("invalid --override %q: %q is not a known field; available fields are: %s",
+			fullPath, name, strings.Join(names, ", "))
+	}
+	if len(parts) == 1 {
+		return nil
+	}
+	// A free-form map's keys are user-defined, so any sub-path into it is valid.
+	if child.freeForm {
+		return nil
+	}
+	if len(child.children) == 0 {
+		return fmt.Errorf("invalid --override %q: %q is not a nested object; cannot address sub-field %q",
+			fullPath, name, strings.Join(parts[1:], "."))
+	}
+	return checkOverridePath(parts[1:], child, fullPath)
+}
+
+// applyOverrides walks each dotted path into the parsed YAML tree and sets the
+// leaf to the RHS parsed as YAML. Intermediate maps are auto-created so
+// an override can add a field the YAML omits; the later re-decode rejects paths
+// absent from the schema. Changes are logged to stderr to keep JSON stdout clean.
+func applyOverrides(ctx context.Context, document *yaml.Node, entries []overrideEntry) error {
+	root := document
+	if document.Kind == yaml.DocumentNode {
+		root = document.Content[0]
+	}
+	if root.Kind != yaml.MappingNode {
+		return errors.New("run config must be a YAML mapping")
+	}
+
+	for _, e := range entries {
+		value, err := parseOverrideNode(e.raw)
+		if err != nil {
+			return fmt.Errorf("invalid --override %q: cannot parse value %q: %w", e.path, e.raw, err)
+		}
+
+		parts := strings.Split(e.path, ".")
+		current := root
+		for _, part := range parts[:len(parts)-1] {
+			next, index := mappingValue(current, part)
+			if next == nil {
+				next = newMappingNode()
+				current.Content = append(current.Content, newStringNode(part), next)
+			} else if next.Kind != yaml.MappingNode {
+				next = newMappingNode()
+				current.Content[index] = next
+			}
+			current = next
+		}
+
+		leaf := parts[len(parts)-1]
+		oldNode, index := mappingValue(current, leaf)
+		newValue, err := decodeYAMLNode(value)
+		if err != nil {
+			return fmt.Errorf("invalid --override %q: cannot decode value %q: %w", e.path, e.raw, err)
+		}
+		if oldNode != nil {
+			oldValue, err := decodeYAMLNode(oldNode)
+			if err != nil {
+				return fmt.Errorf("invalid value at override path %q: %w", e.path, err)
+			}
+			current.Content[index] = value
+			logOverride(ctx, fmt.Sprintf("Override: changing %s from %v to %v", e.path, oldValue, newValue))
+		} else {
+			current.Content = append(current.Content, newStringNode(leaf), value)
+			logOverride(ctx, fmt.Sprintf("Override: setting %s to %v", e.path, newValue))
+		}
+	}
+	return nil
+}
+
+func parseOverrideNode(raw string) (*yaml.Node, error) {
+	var document yaml.Node
+	if err := yaml.Unmarshal([]byte(raw), &document); err != nil {
+		return nil, err
+	}
+	if len(document.Content) == 0 {
+		return &yaml.Node{Kind: yaml.ScalarNode, Tag: "!!null", Value: "null"}, nil
+	}
+	return document.Content[0], nil
+}
+
+func mappingValue(mapping *yaml.Node, key string) (*yaml.Node, int) {
+	for i := 0; i < len(mapping.Content); i += 2 {
+		if mapping.Content[i].Value == key {
+			return mapping.Content[i+1], i + 1
+		}
+	}
+	return nil, -1
+}
+
+func newMappingNode() *yaml.Node {
+	return &yaml.Node{Kind: yaml.MappingNode, Tag: "!!map"}
+}
+
+func newStringNode(value string) *yaml.Node {
+	return &yaml.Node{Kind: yaml.ScalarNode, Tag: "!!str", Value: value}
+}
+
+func decodeYAMLNode(node *yaml.Node) (any, error) {
+	var value any
+	if err := node.Decode(&value); err != nil {
+		return nil, err
+	}
+	return value, nil
+}
+
+// logOverride writes to stderr only when a cmdIO is present; cmdio.LogString
+// panics without one, as in non-command callers such as unit tests.
+func logOverride(ctx context.Context, msg string) {
+	if cmdio.HasIO(ctx) {
+		cmdio.LogString(ctx, msg)
+	}
+}
diff --git a/cmd/air/runconfig_override_test.go b/cmd/air/runconfig_override_test.go
new file mode 100644
index 00000000000..c0dc4937138
--- /dev/null
+++ b/cmd/air/runconfig_override_test.go
@@ -0,0 +1,178 @@
+package aircmd
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseOverrides(t *testing.T) {
+	tests := []struct {
+		name    string
+		in      []string
+		want    []overrideEntry
+		wantErr string
+	}{
+		{
+			name: "key=value pairs preserve order",
+			in:   []string{"compute.num_accelerators=8", "timeout_minutes=45"},
+			want: []overrideEntry{
+				{path: "compute.num_accelerators", raw: "8"},
+				{path: "timeout_minutes", raw: "45"},
+			},
+		},
+		{
+			name: "value may contain =",
+			in:   []string{"env_variables.EXPR=a=b"},
+			want: []overrideEntry{{path: "env_variables.EXPR", raw: "a=b"}},
+		},
+		{
+			name: "key is trimmed",
+			in:   []string{"  timeout_minutes = 45"},
+			want: []overrideEntry{{path: "timeout_minutes", raw: " 45"}},
+		},
+		{
+			name:    "missing = is rejected",
+			in:      []string{"compute.num_accelerators"},
+			wantErr: `expected KEY=VALUE`,
+		},
+		{
+			name:    "a .yaml token hints at -f",
+			in:      []string{"train.yaml"},
+			wantErr: `looks like a config file`,
+		},
+		{
+			name:    "empty key is rejected",
+			in:      []string{"=5"},
+			wantErr: `empty key`,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := parseOverrides(tt.in)
+			if tt.wantErr != "" {
+				require.ErrorContains(t, err, tt.wantErr)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
+
+func TestValidateOverridePaths(t *testing.T) {
+	tests := []struct {
+		name    string
+		path    string
+		wantErr string
+	}{
+		{name: "known top-level field", path: "experiment_name"},
+		{name: "known nested field", path: "compute.num_accelerators"},
+		{name: "new unity catalog image field", path: "environment.unity_catalog_image"},
+		{name: "free-form sub-path", path: "env_variables.MY_VAR"},
+		{name: "deep free-form sub-path", path: "parameters.model.layers"},
+		{
+			name:    "unknown top-level field",
+			path:    "bogus",
+			wantErr: `"bogus" is not a known field`,
+		},
+		{
+			name:    "unknown nested field",
+			path:    "compute.bogus",
+			wantErr: `"bogus" is not a known field`,
+		},
+		{
+			name:    "sub-field of a scalar",
+			path:    "command.sub",
+			wantErr: `"command" is not a nested object`,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := validateOverridePaths([]overrideEntry{{path: tt.path, raw: "x"}})
+			if tt.wantErr != "" {
+				require.ErrorContains(t, err, tt.wantErr)
+				return
+			}
+			require.NoError(t, err)
+		})
+	}
+}
+
+// overrideBaseConfig is a valid 8-GPU config the override tests mutate.
+const overrideBaseConfig = `experiment_name: smoke
+command: python train.py
+compute:
+  accelerator_type: GPU_8xH100
+  num_accelerators: 8
+env_variables:
+  EXISTING: hello
+`
+
+func TestLoadRunConfigWithOverrides(t *testing.T) {
+	t.Run("no overrides matches loadRunConfig", func(t *testing.T) {
+		cfg, err := loadRunConfigWithOverrides(t.Context(), writeConfig(t, overrideBaseConfig), nil)
+		require.NoError(t, err)
+		assert.Equal(t, 8, cfg.Compute.NumAccelerators)
+	})
+
+	t.Run("typed scalar override is coerced", func(t *testing.T) {
+		cfg, err := loadRunConfigWithOverrides(t.Context(), writeConfig(t, overrideBaseConfig), []string{"compute.num_accelerators=16"})
+		require.NoError(t, err)
+		assert.Equal(t, 16, cfg.Compute.NumAccelerators)
+	})
+
+	t.Run("multiple overrides all apply", func(t *testing.T) {
+		cfg, err := loadRunConfigWithOverrides(t.Context(), writeConfig(t, overrideBaseConfig), []string{"compute.num_accelerators=16", "timeout_minutes=45"})
+		require.NoError(t, err)
+		assert.Equal(t, 16, cfg.Compute.NumAccelerators)
+		require.NotNil(t, cfg.TimeoutMinutes)
+		assert.Equal(t, 45, *cfg.TimeoutMinutes)
+	})
+
+	t.Run("free-form env var adds a key as a string", func(t *testing.T) {
+		cfg, err := loadRunConfigWithOverrides(t.Context(), writeConfig(t, overrideBaseConfig), []string{"env_variables.RANK=0"})
+		require.NoError(t, err)
+		// A numeric-looking value stays a string because env_variables is map[string]string.
+		assert.Equal(t, "0", cfg.EnvVariables["RANK"])
+	})
+
+	for _, path := range []string{"code_source.root_path", "code_source.snapshot.root_path"} {
+		t.Run(path+" override", func(t *testing.T) {
+			cfg, err := loadRunConfigWithOverrides(t.Context(), writeConfig(t, overrideBaseConfig), []string{path + "=/Workspace/x"})
+			require.NoError(t, err)
+			require.NotNil(t, cfg.CodeSource)
+			require.NotNil(t, cfg.CodeSource.Snapshot)
+			assert.Equal(t, "/Workspace/x", cfg.CodeSource.Snapshot.RootPath)
+		})
+	}
+
+	t.Run("unity catalog image override applies", func(t *testing.T) {
+		cfg, err := loadRunConfigWithOverrides(t.Context(), writeConfig(t, overrideBaseConfig), []string{"environment.unity_catalog_image=main.air.training:prod"})
+		require.NoError(t, err)
+		require.NotNil(t, cfg.Environment)
+		assert.Equal(t, "main.air.training:prod", cfg.Environment.UnityCatalogImage)
+	})
+
+	t.Run("unknown path errors before mutation", func(t *testing.T) {
+		_, err := loadRunConfigWithOverrides(t.Context(), writeConfig(t, overrideBaseConfig), []string{"bogus=1"})
+		require.ErrorContains(t, err, `"bogus" is not a known field`)
+	})
+
+	t.Run("semantic validation runs after override", func(t *testing.T) {
+		// 3 is a known field with a valid type, so only validate() can reject it.
+		_, err := loadRunConfigWithOverrides(t.Context(), writeConfig(t, overrideBaseConfig), []string{"compute.num_accelerators=3"})
+		require.ErrorContains(t, err, "must be a multiple of 8")
+	})
+
+	t.Run("type mismatch is rejected on re-decode", func(t *testing.T) {
+		_, err := loadRunConfigWithOverrides(t.Context(), writeConfig(t, overrideBaseConfig), []string{"compute.num_accelerators=abc"})
+		require.Error(t, err)
+	})
+
+	t.Run("malformed override is rejected", func(t *testing.T) {
+		_, err := loadRunConfigWithOverrides(t.Context(), writeConfig(t, overrideBaseConfig), []string{"compute.num_accelerators"})
+		require.ErrorContains(t, err, "expected KEY=VALUE")
+	})
+}
diff --git a/cmd/air/runconfig_test.go b/cmd/air/runconfig_test.go
new file mode 100644
index 00000000000..6a9f39a2e42
--- /dev/null
+++ b/cmd/air/runconfig_test.go
@@ -0,0 +1,908 @@
+package aircmd
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// writeConfig writes content to a temp YAML file and returns its path.
+func writeConfig(t *testing.T, content string) string {
+	t.Helper()
+	dir := t.TempDir()
+	path := filepath.Join(dir, "config.yaml")
+	require.NoError(t, os.WriteFile(path, []byte(content), 0o600))
+	return path
+}
+
+// minimalConfig is the smallest valid config: the three required pieces.
+const minimalConfig = `
+experiment_name: my-run
+command: python train.py
+compute:
+  accelerator_type: GPU_1xH100
+  num_accelerators: 1
+`
+
+func TestLoadRunConfig_Minimal(t *testing.T) {
+	cfg, err := loadRunConfig(writeConfig(t, minimalConfig))
+	require.NoError(t, err)
+	assert.Equal(t, "my-run", cfg.ExperimentName)
+	require.NotNil(t, cfg.Command)
+	assert.Equal(t, "python train.py", *cfg.Command)
+	require.NotNil(t, cfg.Compute)
+	assert.Equal(t, "GPU_1xH100", cfg.Compute.AcceleratorType)
+	assert.Equal(t, 1, cfg.Compute.NumAccelerators)
+}
+
+func TestLoadRunConfig_FullFeatured(t *testing.T) {
+	cfg, err := loadRunConfig(writeConfig(t, `
+experiment_name: full_run
+command: |
+  python train.py
+  echo done
+compute:
+  accelerator_type: GPU_8xH100
+  num_accelerators: 16
+environment:
+  dependencies:
+    - torch==2.3.0
+    - numpy
+  version: 5
+env_variables:
+  FOO: bar
+secrets:
+  HF_TOKEN: my_scope/hf_token
+code_source:
+  type: snapshot
+  snapshot:
+    root_path: project_root/src
+    remote_volume: /Volumes/main/default/code
+    git:
+      branch: main
+    include_paths:
+      - src
+      - configs/train.yaml
+max_retries: 5
+timeout_minutes: 120
+idempotency_token: abc-123
+mlflow_run_name: full_run_v2
+mlflow_experiment_directory: /Workspace/Users/me/exp
+usage_policy_name: my-policy
+permissions:
+  - group_name: users
+    level: CAN_VIEW
+  - user_name: alice@example.com
+    level: CAN_MANAGE
+`))
+	require.NoError(t, err)
+	assert.Equal(t, gpuType8xH100, gpuType(cfg.Compute.AcceleratorType))
+	require.NotNil(t, cfg.Environment)
+	assert.True(t, cfg.Environment.Dependencies.set)
+	assert.Equal(t, []string{"torch==2.3.0", "numpy"}, cfg.Environment.Dependencies.list)
+	assert.True(t, cfg.Environment.Version.set)
+	assert.Equal(t, "5", cfg.Environment.Version.raw)
+	require.NotNil(t, cfg.CodeSource)
+	require.NotNil(t, cfg.CodeSource.Snapshot)
+	require.NotNil(t, cfg.CodeSource.Snapshot.Git)
+	require.NotNil(t, cfg.CodeSource.Snapshot.Git.Branch)
+	assert.Equal(t, "main", *cfg.CodeSource.Snapshot.Git.Branch)
+	assert.Len(t, cfg.Permissions, 2)
+}
+
+func TestLoadRunConfig_CodeSourceShapes(t *testing.T) {
+	tests := []struct {
+		name string
+		yaml string
+	}{
+		{"flattened", "code_source:\n  root_path: src\n"},
+		{"flattened with type", "code_source:\n  type: snapshot\n  root_path: src\n"},
+		{"nested", "code_source:\n  snapshot:\n    root_path: src\n"},
+		{"nested with type", "code_source:\n  type: snapshot\n  snapshot:\n    root_path: src\n"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cfg, err := loadRunConfig(writeConfig(t, minimalConfig+tt.yaml))
+			require.NoError(t, err)
+			require.NotNil(t, cfg.CodeSource.Snapshot)
+			assert.Equal(t, "src", cfg.CodeSource.Snapshot.RootPath)
+			assert.Nil(t, cfg.CodeSource.LegacySnapshot)
+		})
+	}
+}
+
+func TestLoadRunConfig_CodeSourceErrors(t *testing.T) {
+	tests := []struct {
+		name    string
+		yaml    string
+		errFrag string
+	}{
+		{"empty", "code_source: {}\n", "requires snapshot configuration"},
+		{"type only", "code_source:\n  type: snapshot\n", "requires snapshot configuration"},
+		{"empty type", "code_source:\n  type: \"\"\n  root_path: src\n", "cannot be empty; omit it to use snapshot"},
+		{"null type", "code_source:\n  type: null\n  root_path: src\n", "cannot be empty; omit it to use snapshot"},
+		{"unsupported type", "code_source:\n  type: git\n  root_path: src\n", "must be 'snapshot'"},
+		{"mixed shapes", "code_source:\n  root_path: src\n  snapshot:\n    root_path: src\n", "remove the 'snapshot' wrapper and place all fields directly under code_source"},
+		{"mixed with null snapshot", "code_source:\n  root_path: src\n  snapshot: null\n", "remove the 'snapshot' wrapper and place all fields directly under code_source"},
+		{"flattened error path", "code_source:\n  root_path: \"\"\n", "code_source.root_path cannot be empty"},
+		{"nested error path", "code_source:\n  snapshot:\n    root_path: \"\"\n", "code_source.snapshot.root_path cannot be empty"},
+		{"null snapshot", "code_source:\n  snapshot: null\n", "code_source.snapshot.root_path cannot be empty"},
+		{"unknown flattened field", "code_source:\n  root_path: src\n  bogus: true\n", "field bogus not found"},
+		{"unknown nested field", "code_source:\n  snapshot:\n    root_path: src\n    bogus: true\n", "field bogus not found"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, err := loadRunConfig(writeConfig(t, minimalConfig+tt.yaml))
+			require.ErrorContains(t, err, tt.errFrag)
+		})
+	}
+}
+
+// TestLoadRunConfigUnityCatalogImage covers parsing environment.unity_catalog_image,
+// which is mutually exclusive with dependencies/version.
+func TestLoadRunConfigUnityCatalogImage(t *testing.T) {
+	cfg, err := loadRunConfig(writeConfig(t, minimalConfig+`
+environment:
+  unity_catalog_image: main.air.training:prod
+`))
+	require.NoError(t, err)
+	require.NotNil(t, cfg.Environment)
+	assert.Equal(t, "main.air.training:prod", cfg.Environment.UnityCatalogImage)
+}
+
+func TestLoadRunConfigContainers(t *testing.T) {
+	cfg, err := loadRunConfig(writeConfig(t, `
+experiment_name: roles
+compute:
+  accelerator_type: GPU_1xH100
+  num_accelerators: 4
+containers:
+  - name: inference
+    command: python infer.py
+    ranks: [0, 1]
+    unity_catalog_image: main.ml.inference:v1
+    environment_variables:
+      variables:
+        MODEL_NAME: llama
+        HF_TOKEN: '{{secrets/research/hf_token}}'
+  - name: dataproc
+    command: python dataproc.py
+    ranks: [2, 3]
+    unity_catalog_image: main.ml.dataproc:v2
+`))
+	require.NoError(t, err)
+	require.Nil(t, cfg.Command)
+	require.Len(t, cfg.Containers, 2)
+	assert.Equal(t, []int{0, 1}, cfg.Containers[0].Ranks)
+	assert.Equal(t, "llama", cfg.Containers[0].EnvironmentVariables.Variables["MODEL_NAME"])
+}
+
+func TestMultiImageExample(t *testing.T) {
+	cfg, err := loadRunConfig("examples/multi-image-example.yaml")
+	require.NoError(t, err)
+	assert.Equal(t, "qwen_grpo_multi_image", cfg.ExperimentName)
+	assert.Len(t, cfg.Containers, 2)
+}
+
+func TestLoadRunConfigContainerNames(t *testing.T) {
+	for _, tc := range []struct {
+		name  string
+		valid bool
+	}{
+		{"a", true},
+		{"trainer1", true},
+		{"data-proc", true},
+		{"a--b", true},
+		{strings.Repeat("a", 17), true},
+		{strings.Repeat("a", 32), true},
+		{"", false},
+		{"Trainer", false},
+		{"data_proc", false},
+		{"_trainer", false},
+		{"1trainer", false},
+		{"-trainer", false},
+		{"trainer-", false},
+		{"data.proc", false},
+		{"data proc", false},
+		{strings.Repeat("a", 33), false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			cfg, err := loadRunConfig(writeConfig(t, fmt.Sprintf(`
+experiment_name: roles
+compute:
+  accelerator_type: GPU_1xH100
+  num_accelerators: 1
+containers:
+  - name: %q
+    command: echo train
+    ranks: [0]
+    unity_catalog_image: main.ml.trainer:v1
+`, tc.name)))
+			if tc.valid {
+				require.NoError(t, err)
+				assert.Equal(t, tc.name, cfg.Containers[0].Name)
+			} else {
+				require.ErrorContains(t, err, "containers[0].name must start with a lowercase letter")
+			}
+		})
+	}
+}
+
+func TestLoadRunConfigContainerValidation(t *testing.T) {
+	base := `
+experiment_name: roles
+compute:
+  accelerator_type: GPU_1xH100
+  num_accelerators: 2
+containers:
+  - name: first
+    command: echo first
+    ranks: [0]
+    unity_catalog_image: main.ml.first:v1
+  - name: second
+    command: echo second
+    ranks: [%s]
+    unity_catalog_image: main.ml.second:v1
+`
+	for _, tc := range []struct {
+		name    string
+		rank    string
+		wantErr string
+	}{
+		{"overlap", "0", "rank 0 is assigned to both"},
+		{"out of range", "2", "valid ranks for this compute are 0 through 1"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			_, err := loadRunConfig(writeConfig(t, fmt.Sprintf(base, tc.rank)))
+			require.ErrorContains(t, err, tc.wantErr)
+		})
+	}
+
+	_, err := loadRunConfig(writeConfig(t, strings.Replace(base, "ranks: [%s]", "ranks: []", 1)))
+	require.ErrorContains(t, err, "ranks must contain at least one rank")
+}
+
+// TestLoadRunConfig_PolymorphicFields exercises the str|int and bool|str unions
+// decoded by custom UnmarshalYAML.
+func TestLoadRunConfig_PolymorphicFields(t *testing.T) {
+	t.Run("git remote as bool true is rejected", func(t *testing.T) {
+		_, err := loadRunConfig(writeConfig(t, minimalConfig+`
+code_source:
+  type: snapshot
+  snapshot:
+    root_path: .
+    git:
+      branch: main
+      remote: true
+`))
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "git.remote is no longer supported")
+	})
+
+	t.Run("git remote defaults to false when unset", func(t *testing.T) {
+		cfg, err := loadRunConfig(writeConfig(t, minimalConfig+`
+code_source:
+  type: snapshot
+  snapshot:
+    root_path: .
+    git:
+      commit: deadbeef
+`))
+		require.NoError(t, err)
+		assert.False(t, cfg.CodeSource.Snapshot.Git.Remote.truthy())
+	})
+}
+
+func TestLoadRunConfig_UnknownFieldRejected(t *testing.T) {
+	tests := []struct {
+		name    string
+		extra   string
+		errFrag string
+	}{
+		{"top-level typo", "extra_field: nope\n", "extra_field"},
+		// priority was intentionally dropped from the schema (pool-only concept).
+		{"dropped priority field", "priority: 100\n", "priority"},
+		// _bases_ composition is not yet ported, so it surfaces as unknown.
+		{"unported _bases_", "_bases_: [base.yaml]\n", "_bases_"},
+		{"nested typo", "environment:\n  bogus: 1\n", "bogus"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, err := loadRunConfig(writeConfig(t, minimalConfig+tt.extra))
+			require.Error(t, err)
+			assert.Contains(t, err.Error(), tt.errFrag)
+		})
+	}
+}
+
+func TestLoadRunConfig_ErrorLineNumbersUseSource(t *testing.T) {
+	path := writeConfig(t, `# first comment
+# second comment
+experiment_name: smoke
+command: echo hi
+compute:
+  accelerator_type: GPU_1xH100
+  num_accelerators: 1
+unknown_field: true
+`)
+
+	t.Run("without overrides", func(t *testing.T) {
+		_, err := loadRunConfig(path)
+		require.ErrorContains(t, err, "line 8: field unknown_field")
+	})
+
+	t.Run("with overrides", func(t *testing.T) {
+		_, err := loadRunConfigWithOverrides(t.Context(), path, []string{"compute.num_accelerators=2"})
+		require.ErrorContains(t, err, "line 8: field unknown_field")
+	})
+}
+
+func TestLoadRunConfig_Errors(t *testing.T) {
+	tests := []struct {
+		name    string
+		yaml    string
+		errFrag string
+	}{
+		{
+			"missing experiment_name",
+			"command: x\ncompute:\n  accelerator_type: GPU_1xH100\n  num_accelerators: 1\n",
+			"experiment_name cannot be empty",
+		},
+		{
+			"experiment_name bad chars",
+			"experiment_name: my.run\ncommand: x\ncompute:\n  accelerator_type: GPU_1xH100\n  num_accelerators: 1\n",
+			"invalid experiment_name",
+		},
+		{
+			"missing compute",
+			"experiment_name: r\ncommand: x\n",
+			"compute: section is required",
+		},
+		{
+			"missing command",
+			"experiment_name: r\ncompute:\n  accelerator_type: GPU_1xH100\n  num_accelerators: 1\n",
+			"command is required",
+		},
+		{
+			"bad gpu type",
+			"experiment_name: r\ncommand: x\ncompute:\n  accelerator_type: a100\n  num_accelerators: 1\n",
+			"invalid GPU type",
+		},
+		{
+			"num_accelerators not a multiple",
+			"experiment_name: r\ncommand: x\ncompute:\n  accelerator_type: GPU_8xH100\n  num_accelerators: 3\n",
+			"must be a multiple of 8",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, err := loadRunConfig(writeConfig(t, tt.yaml))
+			require.Error(t, err)
+			assert.Contains(t, err.Error(), tt.errFrag)
+		})
+	}
+}
+
+// TestRunConfigValidate_FieldRules unit-tests validation rules directly, away
+// from YAML decoding, to keep each rule's failure mode explicit.
+func TestRunConfigValidate_FieldRules(t *testing.T) {
+	str := func(s string) *string { return &s }
+	intp := func(i int) *int { return &i }
+	base := func() *runConfig {
+		return &runConfig{
+			ExperimentName: "r",
+			Command:        str("x"),
+			Compute:        &computeConfig{AcceleratorType: "GPU_1xH100", NumAccelerators: 1},
+		}
+	}
+
+	tests := []struct {
+		name    string
+		mutate  func(c *runConfig)
+		errFrag string
+	}{
+		{"ok baseline", func(c *runConfig) {}, ""},
+		{"empty command", func(c *runConfig) { c.Command = str("   ") }, "command cannot be empty"},
+		{"negative max_retries", func(c *runConfig) { c.MaxRetries = intp(-1) }, "max_retries must be >= 0"},
+		{"zero timeout", func(c *runConfig) { c.TimeoutMinutes = intp(0) }, "timeout_minutes must be >= 1"},
+		{"empty idempotency", func(c *runConfig) { c.IdempotencyToken = str("  ") }, "idempotency_token cannot be empty"},
+		{"long idempotency", func(c *runConfig) { c.IdempotencyToken = str(string(make([]byte, 65))) }, "64 characters or less"},
+		{"bad mlflow_run_name", func(c *runConfig) { c.MLflowRunName = str("bad name") }, "invalid mlflow_run_name"},
+		{"bad experiment dir", func(c *runConfig) { c.MLflowExperimentDirectory = str("/Users/me") }, "must start with '/Workspace'"},
+		{"artifact volume path normalizes", func(c *runConfig) { c.MLflowArtifactLocation = str(" /Volumes/main/default/artifacts ") }, ""},
+		{"empty artifact location", func(c *runConfig) { c.MLflowArtifactLocation = str(" ") }, "mlflow_artifact_location cannot be empty"},
+		{"non-dbfs artifact location", func(c *runConfig) { c.MLflowArtifactLocation = str("s3://bucket/path") }, "must be a dbfs: URI"},
+		{"empty usage policy", func(c *runConfig) { c.UsagePolicyName = str(" ") }, "usage_policy_name must not be empty"},
+		{"bad secret ref", func(c *runConfig) { c.Secrets = map[string]string{"T": "noslash"} }, "expected format 'scope/key'"},
+		{"empty secret scope", func(c *runConfig) { c.Secrets = map[string]string{"T": "/key"} }, "scope and key cannot be empty"},
+		{"env var and secret collide", func(c *runConfig) {
+			c.EnvVariables = map[string]string{"TOK": "v"}
+			c.Secrets = map[string]string{"TOK": "scope/key"}
+		}, `"TOK" is set in both env_variables and secrets`},
+		{"long mlflow_run_name", func(c *runConfig) { c.MLflowRunName = str(strings.Repeat("a", 101)) }, "100 characters or less"},
+		{"usage policy name and id", func(c *runConfig) {
+			c.UsagePolicyName = str("p")
+			c.UsagePolicyID = str("id")
+		}, "mutually exclusive"},
+		{"empty usage_policy_id", func(c *runConfig) { c.UsagePolicyID = str("  ") }, "usage_policy_id must not be empty"},
+		{"non-uuid usage_policy_id", func(c *runConfig) { c.UsagePolicyID = str("policy-uuid") }, "usage_policy_id must be a UUID"},
+		// A name pasted into the id field gets pointed at the right field.
+		{"policy name in usage_policy_id", func(c *runConfig) { c.UsagePolicyID = str("team-a") }, "use usage_policy_name"},
+		{"uuid usage_policy_id alone is ok", func(c *runConfig) { c.UsagePolicyID = str("12345678-90ab-cdef-1234-567890abcdef") }, ""},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			c := base()
+			tt.mutate(c)
+			err := c.validate()
+			if tt.errFrag == "" {
+				assert.NoError(t, err)
+				if tt.name == "artifact volume path normalizes" {
+					assert.Equal(t, "dbfs:/Volumes/main/default/artifacts", *c.MLflowArtifactLocation)
+				}
+				return
+			}
+			require.Error(t, err)
+			assert.Contains(t, err.Error(), tt.errFrag)
+		})
+	}
+}
+
+func TestEnvironmentConfigValidate(t *testing.T) {
+	tests := []struct {
+		name    string
+		env     environmentConfig
+		errFrag string
+	}{
+		{
+			"unity catalog image alone ok",
+			environmentConfig{UnityCatalogImage: "main.air.training:prod"},
+			"",
+		},
+		{
+			"unity catalog image bad format",
+			environmentConfig{UnityCatalogImage: "main.air.training"},
+			"environment.unity_catalog_image must be in the format",
+		},
+		{
+			"unity catalog image rejects surrounding whitespace",
+			environmentConfig{UnityCatalogImage: " main.air.training:prod "},
+			"environment.unity_catalog_image must be in the format",
+		},
+		{
+			"unity catalog image with deps conflicts",
+			environmentConfig{
+				UnityCatalogImage: "main.air.training:prod",
+				Dependencies:      dependencies{set: true, list: []string{"torch"}},
+			},
+			"not allowed: dependencies",
+		},
+		{
+			"unity catalog image with version conflicts",
+			environmentConfig{
+				UnityCatalogImage: "main.air.training:prod",
+				Version:           stringOrInt{set: true, raw: "5"},
+			},
+			"not allowed: version",
+		},
+		{
+			"version without deps",
+			environmentConfig{Version: stringOrInt{set: true, raw: "5"}},
+			"",
+		},
+		{
+			"version with empty deps",
+			environmentConfig{
+				Version:      stringOrInt{set: true, raw: "5"},
+				Dependencies: dependencies{set: true, list: []string{}},
+			},
+			"",
+		},
+		{
+			"version with inline deps ok",
+			environmentConfig{
+				Version:      stringOrInt{set: true, raw: "5"},
+				Dependencies: dependencies{set: true, list: []string{"torch"}},
+			},
+			"",
+		},
+		{
+			"version prefix normalizes",
+			environmentConfig{
+				Version:      stringOrInt{set: true, raw: "DATABRICKS_AI_V5"},
+				Dependencies: dependencies{set: true, list: []string{"torch"}},
+			},
+			"",
+		},
+		{
+			"old databricks ai version rejected",
+			environmentConfig{
+				Version:      stringOrInt{set: true, raw: "databricks_ai_v4"},
+				Dependencies: dependencies{set: true, list: []string{"torch"}},
+			},
+			"requires AI Runtime version 5 or higher",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := tt.env.validate()
+			if tt.errFrag == "" {
+				assert.NoError(t, err)
+				if tt.name == "version prefix normalizes" {
+					assert.Equal(t, "databricks_ai_v5", tt.env.Version.raw)
+				}
+				return
+			}
+			require.Error(t, err)
+			assert.Contains(t, err.Error(), tt.errFrag)
+		})
+	}
+}
+
+func TestGitRefValidate(t *testing.T) {
+	str := func(s string) *string { return &s }
+	tests := []struct {
+		name    string
+		ref     gitRef
+		errFrag string
+	}{
+		{"branch only ok", gitRef{Branch: str("main")}, ""},
+		{"commit only ok", gitRef{Commit: str("abc123")}, ""},
+		{"remote false is ok", gitRef{Branch: str("main"), Remote: gitRemote{set: true, enabled: false}}, ""},
+		{"neither branch nor commit", gitRef{}, "must specify either 'branch' or 'commit'"},
+		{"both branch and commit", gitRef{Branch: str("main"), Commit: str("abc")}, "mutually exclusive"},
+		{"remote true rejected", gitRef{Branch: str("main"), Remote: gitRemote{set: true, enabled: true}}, "git.remote is no longer supported"},
+		{"remote name rejected", gitRef{Branch: str("main"), Remote: gitRemote{set: true, isString: true, name: "origin"}}, "git.remote is no longer supported"},
+		{"bad branch chars", gitRef{Branch: str("bad branch")}, "invalid git.branch"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := tt.ref.validate()
+			if tt.errFrag == "" {
+				assert.NoError(t, err)
+				return
+			}
+			require.Error(t, err)
+			assert.Contains(t, err.Error(), tt.errFrag)
+		})
+	}
+}
+
+func TestSnapshotSourceConfigValidate(t *testing.T) {
+	tests := []struct {
+		name    string
+		snap    snapshotSourceConfig
+		errFrag string
+	}{
+		{"ok", snapshotSourceConfig{RootPath: "src"}, ""},
+		{"empty root_path", snapshotSourceConfig{RootPath: "  "}, "root_path cannot be empty"},
+		{"bad volume", snapshotSourceConfig{RootPath: "src", RemoteVolume: new("/mnt/x")}, "must start with '/Volumes/'"},
+		{"empty include list", snapshotSourceConfig{RootPath: "src", IncludePaths: []string{}}, "cannot be an empty list"},
+		{"absolute include", snapshotSourceConfig{RootPath: "src", IncludePaths: []string{"/etc"}}, "must be relative"},
+		{"traversal include", snapshotSourceConfig{RootPath: "src", IncludePaths: []string{"../x"}}, "'..' traversal"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := tt.snap.validate("code_source")
+			if tt.errFrag == "" {
+				assert.NoError(t, err)
+				return
+			}
+			require.Error(t, err)
+			assert.Contains(t, err.Error(), tt.errFrag)
+		})
+	}
+}
+
+func TestPermissionValidate(t *testing.T) {
+	str := func(s string) *string { return &s }
+	tests := []struct {
+		name    string
+		perm    permission
+		errFrag string
+	}{
+		{"ok user", permission{UserName: str("alice@example.com"), Level: "CAN_VIEW"}, ""},
+		{"no principal", permission{Level: "CAN_VIEW"}, "must be specified"},
+		{"two principals", permission{UserName: str("a"), GroupName: str("g"), Level: "CAN_VIEW"}, "only one of"},
+		{"empty principal", permission{UserName: str("  "), Level: "CAN_VIEW"}, "cannot be empty"},
+		{"missing level", permission{GroupName: str("users")}, "'level' is required"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := tt.perm.validate()
+			if tt.errFrag == "" {
+				assert.NoError(t, err)
+				return
+			}
+			require.Error(t, err)
+			assert.Contains(t, err.Error(), tt.errFrag)
+		})
+	}
+}
+
+func TestLoadRunConfig_FileErrors(t *testing.T) {
+	t.Run("missing file", func(t *testing.T) {
+		_, err := loadRunConfig(filepath.Join(t.TempDir(), "nope.yaml"))
+		assert.Error(t, err)
+	})
+	t.Run("empty file", func(t *testing.T) {
+		_, err := loadRunConfig(writeConfig(t, ""))
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "is empty")
+	})
+}
+
+func TestResolveConfigField(t *testing.T) {
+	tests := []struct {
+		name         string
+		path         string
+		wantPath     string
+		wantType     string
+		wantRequired string
+	}{
+		{"leaf", "config.compute.accelerator_type", "config.compute.accelerator_type", "string", ""},
+		{"bare path", "compute.accelerator_type", "config.compute.accelerator_type", "string", ""},
+		{"top-level required", "config.experiment_name", "config.experiment_name", "string", "yes"},
+		{"int leaf", "config.max_retries", "config.max_retries", "int", ""},
+		{"through a slice", "config.permissions.level", "config.permissions.level", "string", "when a grant is listed"},
+		{"free-form map", "config.parameters", "config.parameters", "map of string to any", ""},
+		{"flattened snapshot", "config.code_source.root_path", "config.code_source.root_path", "string", "when code_source is set"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			field, err := resolveConfigField(tt.path)
+			require.NoError(t, err)
+			assert.Equal(t, tt.wantPath, field.path)
+			assert.Equal(t, tt.wantType, field.typeName)
+			assert.Equal(t, tt.wantRequired, field.required)
+			assert.NotEmpty(t, field.help)
+			assert.Empty(t, field.children)
+		})
+	}
+}
+
+// The union types are structs of unexported fields, so their type label comes
+// from configTypeNames rather than reflection, and they must not be walked into.
+func TestResolveConfigField_PolymorphicTypes(t *testing.T) {
+	tests := []struct{ path, wantType string }{
+		{"config.environment.dependencies", "list of strings"},
+		{"config.environment.version", "string or int"},
+		{"config.code_source.git.remote", "bool or string"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.path, func(t *testing.T) {
+			field, err := resolveConfigField(tt.path)
+			require.NoError(t, err)
+			assert.Equal(t, tt.wantType, field.typeName)
+			// A union must not be walked into as an object: its fields are unexported.
+			assert.Empty(t, field.children)
+		})
+	}
+}
+
+func TestResolveConfigField_Containers(t *testing.T) {
+	root, err := resolveConfigField("config")
+	require.NoError(t, err)
+	assert.Equal(t, "config", root.path)
+	// Children are listed in declaration order, matching the schema.
+	assert.Equal(t, "experiment_name", configLeafName(root.children[0].path))
+	assert.Equal(t, "compute", configLeafName(root.children[1].path))
+
+	// An empty path describes the whole schema, so `-h config` and a bare
+	// prefix agree.
+	bare, err := resolveConfigField("")
+	require.NoError(t, err)
+	assert.Equal(t, root.children, bare.children)
+
+	compute, err := resolveConfigField("config.compute")
+	require.NoError(t, err)
+	assert.Equal(t, "object", compute.typeName)
+	require.Len(t, compute.children, 4)
+}
+
+func TestResolveConfigField_Errors(t *testing.T) {
+	tests := []struct {
+		name      string
+		path      string
+		wantParts []string
+	}{
+		{
+			name:      "typo suggests the near match",
+			path:      "config.compute.acclerator_type",
+			wantParts: []string{`unknown config field "config.compute.acclerator_type"`, `did you mean "accelerator_type"?`, "accelerator_type, num_accelerators"},
+		},
+		{
+			name:      "unknown top-level field lists siblings",
+			path:      "config.bogus",
+			wantParts: []string{`unknown config field "config.bogus"`, "experiment_name"},
+		},
+		{
+			name:      "no suggestion when nothing is close",
+			path:      "config.zzzzzzzzzzzz",
+			wantParts: []string{`unknown config field "config.zzzzzzzzzzzz"`},
+		},
+		{
+			name:      "free-form keys are not schema fields",
+			path:      "config.parameters.learning_rate",
+			wantParts: []string{`"config.parameters" holds user-defined keys`, `"learning_rate" is not part of the schema`},
+		},
+		{
+			name:      "scalar has no sub-fields",
+			path:      "config.command.foo",
+			wantParts: []string{`"config.command" is not an object`, `no field "foo"`},
+		},
+		{
+			name:      "nested typo reports the resolved prefix",
+			path:      "config.code_source.rootpath",
+			wantParts: []string{`unknown config field "config.code_source.rootpath"`, `did you mean "root_path"?`},
+		},
+		{
+			name:      "legacy fields are hidden",
+			path:      "config.code_source.snapshot",
+			wantParts: []string{`unknown config field "config.code_source.snapshot"`},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, err := resolveConfigField(tt.path)
+			require.Error(t, err)
+			for _, part := range tt.wantParts {
+				assert.Contains(t, err.Error(), part)
+			}
+		})
+	}
+
+	// A distant name must not attract a suggestion.
+	_, err := resolveConfigField("config.zzzzzzzzzzzz")
+	require.Error(t, err)
+	assert.NotContains(t, err.Error(), "did you mean")
+}
+
+func TestWriteConfigFieldHelp(t *testing.T) {
+	var leaf strings.Builder
+	require.NoError(t, writeConfigFieldHelp(&leaf, "config.compute.num_accelerators"))
+	assert.Contains(t, leaf.String(), "config.compute.num_accelerators")
+	assert.Contains(t, leaf.String(), "Type:     int")
+	assert.Contains(t, leaf.String(), "Required: no")
+
+	var container strings.Builder
+	require.NoError(t, writeConfigFieldHelp(&container, "config.compute"))
+	assert.Contains(t, container.String(), "Fields:")
+	assert.Contains(t, container.String(), "num_accelerators")
+	// A container lists its fields rather than printing a type/required pair.
+	assert.NotContains(t, container.String(), "Required:")
+	assert.Contains(t, container.String(), `Use "-h config.compute.<field>" for details`)
+
+	var environment strings.Builder
+	require.NoError(t, writeConfigFieldHelp(&environment, "config.environment"))
+	assert.Contains(t, environment.String(), "version              Client image version to pin (default: 6).")
+
+	var environmentVersion strings.Builder
+	require.NoError(t, writeConfigFieldHelp(&environmentVersion, "config.environment.version"))
+	assert.Contains(t, environmentVersion.String(), "Client image version to pin (default: 6).")
+	assert.Contains(t, environmentVersion.String(), "https://docs.databricks.com/aws/en/release-notes/serverless/environment-version/")
+
+	// Required top-level fields are flagged in a listing.
+	var root strings.Builder
+	require.NoError(t, writeConfigFieldHelp(&root, "config"))
+	assert.Contains(t, root.String(), "(required) Which accelerators to run on")
+
+	require.Error(t, writeConfigFieldHelp(&strings.Builder{}, "config.nope"))
+}
+
+// Guards against adding a schema field without a help: tag.
+func TestConfigFieldsAllDocumented(t *testing.T) {
+	root, err := resolveConfigField("config")
+	require.NoError(t, err)
+
+	var walk func(fields []configField)
+	walk = func(fields []configField) {
+		for _, f := range fields {
+			if f.hidden {
+				continue
+			}
+			assert.NotEmpty(t, f.help, "%s is missing a help: struct tag", f.path)
+			assert.NotEmpty(t, f.typeName, "%s has no type name", f.path)
+			walk(f.children)
+		}
+	}
+	walk(root.children)
+}
+
+func TestFirstSentence(t *testing.T) {
+	tests := []struct{ in, want string }{
+		{"One sentence with no period", "One sentence with no period"},
+		{"First. Second.", "First."},
+		{"Which accelerator, e.g. GPU_1xA10. See the docs.", "Which accelerator, e.g. GPU_1xA10."},
+		{"Use numpy, torch, etc. Then run.", "Use numpy, torch, etc. Then run."},
+		{"Prod i.e. production. Details.", "Prod i.e. production."},
+		{"Ends with abbreviation etc.", "Ends with abbreviation etc."},
+	}
+	for _, tt := range tests {
+		assert.Equal(t, tt.want, firstSentence(tt.in))
+	}
+}
+
+// Plain -h must fall back to command help. A detached command has no parent to
+// inherit a help function from, so this also covers that nil case.
+func TestRunCommandHelp_NoConfigPath(t *testing.T) {
+	var out strings.Builder
+	cmd := newRunCommand()
+	cmd.SetOut(&out)
+	cmd.SetArgs([]string{"-h"})
+	require.NoError(t, cmd.Execute())
+	assert.Contains(t, out.String(), "Usage:")
+	assert.NotContains(t, out.String(), "Fields:")
+}
+
+// -h with a config path documents the field instead of the command, and does so
+// without the otherwise-required --file.
+func TestRunCommandHelp_ConfigPath(t *testing.T) {
+	var out strings.Builder
+	cmd := newRunCommand()
+	cmd.SetOut(&out)
+	cmd.SetArgs([]string{"-h", "config.compute.accelerator_type"})
+	require.NoError(t, cmd.Execute())
+	assert.Contains(t, out.String(), "config.compute.accelerator_type")
+	assert.Contains(t, out.String(), "Type:     string")
+	assert.NotContains(t, out.String(), "Usage:")
+}
+
+// An unresolvable path reports to stderr and still exits cleanly, matching how
+// cobra treats the help path.
+func TestRunCommandHelp_UnknownConfigPath(t *testing.T) {
+	var out, errOut strings.Builder
+	cmd := newRunCommand()
+	cmd.SetOut(&out)
+	cmd.SetErr(&errOut)
+	cmd.SetArgs([]string{"-h", "config.nope"})
+	require.NoError(t, cmd.Execute())
+	assert.Contains(t, errOut.String(), `unknown config field "config.nope"`)
+	assert.Empty(t, out.String())
+}
+
+// Both `-h config.<field>` and --override path validation must resolve against
+// the one configSchema() walk, so a field valid for one is valid for the other.
+// This guards against the two features drifting apart again.
+func TestConfigSchemaSharedByHelpAndOverride(t *testing.T) {
+	paths := []string{
+		"compute.num_accelerators",
+		"environment.unity_catalog_image",
+		"code_source.root_path",
+		"env_variables.MY_VAR", // free-form sub-path
+	}
+
+	for _, p := range []string{"code_source.type", "code_source.snapshot.root_path"} {
+		t.Run(p+" compatibility override", func(t *testing.T) {
+			require.NoError(t, validateOverridePaths([]overrideEntry{{path: p, raw: "x"}}))
+			_, err := resolveConfigField(p)
+			require.Error(t, err)
+		})
+	}
+	for _, p := range paths {
+		t.Run(p, func(t *testing.T) {
+			require.NoError(t, validateOverridePaths([]overrideEntry{{path: p, raw: "x"}}))
+			// The help path accepts the same field (free-form sub-paths resolve to
+			// the map itself, which is the schema's most specific node).
+			_, err := resolveConfigField(p)
+			if !strings.Contains(p, "env_variables") {
+				require.NoError(t, err)
+			}
+		})
+	}
+
+	// A field unknown to one is unknown to the other.
+	require.Error(t, validateOverridePaths([]overrideEntry{{path: "compute.bogus", raw: "x"}}))
+	_, err := resolveConfigField("compute.bogus")
+	require.Error(t, err)
+}
diff --git a/cmd/air/runlaunch.go b/cmd/air/runlaunch.go
new file mode 100644
index 00000000000..a888d80d85d
--- /dev/null
+++ b/cmd/air/runlaunch.go
@@ -0,0 +1,96 @@
+package aircmd
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"path"
+	"strings"
+	"uuid"
+
+	"github.com/databricks/cli/libs/env"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/service/iam"
+	"github.com/databricks/databricks-sdk-go/service/workspace"
+)
+
+// userWorkspaceDirEnv overrides the per-user workspace directory; mirrors the
+// Python CLI's DATABRICKS_INTERNAL_USER_WORKSPACE_DIR escape hatch.
+const userWorkspaceDirEnv = "DATABRICKS_INTERNAL_USER_WORKSPACE_DIR"
+
+// currentUserEmail returns the authenticated user's email (works for any domain).
+func currentUserEmail(ctx context.Context, w *databricks.WorkspaceClient) (string, error) {
+	// Only userName is needed; the full response also resolves groups and entitlements.
+	me, err := w.CurrentUser.Me(ctx, iam.MeRequest{Attributes: "userName"})
+	if err != nil {
+		return "", fmt.Errorf("failed to resolve current user: %w", err)
+	}
+	return me.UserName, nil
+}
+
+// userWorkspaceDir returns the user's workspace home, honoring the env override.
+func userWorkspaceDir(ctx context.Context, w *databricks.WorkspaceClient) (string, error) {
+	if override := env.Get(ctx, userWorkspaceDirEnv); override != "" {
+		return override, nil
+	}
+	override, err := profileValue(w.Config, "databricks_internal_user_workspace_dir")
+	if err != nil {
+		return "", fmt.Errorf("failed to read selected profile: %w", err)
+	}
+	if override != "" {
+		return override, nil
+	}
+	email, err := currentUserEmail(ctx, w)
+	if err != nil {
+		return "", err
+	}
+	return "/Workspace/Users/" + email, nil
+}
+
+// cliLaunchDir returns a unique workspace directory for a run's launch artifacts:
+// <base>/.air/cli_launch/<experiment>/<run>_<uuid>. run defaults to experiment.
+func cliLaunchDir(base, experiment, run string) string {
+	if run == "" {
+		run = experiment
+	}
+	unique := strings.ReplaceAll(uuid.New().String(), "-", "")[:16]
+	return path.Join(base, ".air", "cli_launch", experiment, run+"_"+unique)
+}
+
+// prospectiveLaunchPaths returns the workspace paths a submission would use
+// without creating directories or uploading artifacts.
+func prospectiveLaunchPaths(ctx context.Context, w *databricks.WorkspaceClient, cfg *runConfig) (string, string, string, error) {
+	base, err := userWorkspaceDir(ctx, w)
+	if err != nil {
+		return "", "", "", err
+	}
+	runName := ""
+	if cfg.MLflowRunName != nil {
+		runName = *cfg.MLflowRunName
+	}
+	launchDir := cliLaunchDir(base, cfg.ExperimentName, runName)
+	return base, launchDir, path.Join(launchDir, commandScriptName), nil
+}
+
+// ensureExperimentDirectory creates experimentDir if it is missing, matching the
+// CLI's convention for its other artifact directories. Without this, a missing
+// parent surfaces only as a server-side INTERNAL_ERROR after the run is wasted.
+// An empty dir means the default (/Users/<user>/...), which always exists.
+func ensureExperimentDirectory(ctx context.Context, w *databricks.WorkspaceClient, experimentDir string) error {
+	if experimentDir == "" {
+		return nil
+	}
+
+	info, err := w.Workspace.GetStatusByPath(ctx, experimentDir)
+	if errors.Is(err, apierr.ErrNotFound) {
+		return w.Workspace.MkdirsByPath(ctx, experimentDir)
+	}
+	if err != nil {
+		return fmt.Errorf("failed to check experiment_directory %q: %w", experimentDir, err)
+	}
+	if info.ObjectType != workspace.ObjectTypeDirectory {
+		return fmt.Errorf("experiment_directory %q is not a directory (object_type=%s)", experimentDir, info.ObjectType)
+	}
+	return nil
+}
diff --git a/cmd/air/runlaunch_test.go b/cmd/air/runlaunch_test.go
new file mode 100644
index 00000000000..edb4803ba65
--- /dev/null
+++ b/cmd/air/runlaunch_test.go
@@ -0,0 +1,134 @@
+package aircmd
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/databricks/cli/libs/filer"
+	"github.com/databricks/cli/libs/testserver"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/service/iam"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestCliLaunchDir(t *testing.T) {
+	dir := cliLaunchDir("/Workspace/Users/me@example.com", "my-exp", "")
+	assert.True(t, strings.HasPrefix(dir, "/Workspace/Users/me@example.com/.air/cli_launch/my-exp/my-exp_"), dir)
+	// run name overrides the leaf; the unique suffix keeps successive dirs distinct.
+	withRun := cliLaunchDir("/base", "exp", "run1")
+	assert.True(t, strings.HasPrefix(withRun, "/base/.air/cli_launch/exp/run1_"), withRun)
+	assert.NotEqual(t, dir, cliLaunchDir("/Workspace/Users/me@example.com", "my-exp", ""))
+}
+
+func newFakeWorkspaceClient(t *testing.T) *databricks.WorkspaceClient {
+	server := testserver.New(t)
+	t.Cleanup(server.Close)
+	testserver.AddDefaultHandlers(server)
+	w, err := databricks.NewWorkspaceClient(&databricks.Config{Host: server.URL, Token: "token"})
+	require.NoError(t, err)
+	return w
+}
+
+func TestUserWorkspaceDir(t *testing.T) {
+	w := newFakeWorkspaceClient(t)
+	t.Setenv(userWorkspaceDirEnv, "")
+	dir, err := userWorkspaceDir(t.Context(), w)
+	require.NoError(t, err)
+	assert.True(t, strings.HasPrefix(dir, "/Workspace/Users/"), dir)
+
+	// The env override wins without an API call.
+	t.Setenv(userWorkspaceDirEnv, "/Workspace/custom")
+	dir, err = userWorkspaceDir(t.Context(), w)
+	require.NoError(t, err)
+	assert.Equal(t, "/Workspace/custom", dir)
+}
+
+func TestUserWorkspaceDirRequestsOnlyUserName(t *testing.T) {
+	server := testserver.New(t)
+	t.Cleanup(server.Close)
+	var attributes []string
+	server.Handle("GET", "/api/2.0/preview/scim/v2/Me", func(req testserver.Request) any {
+		attributes = append(attributes, req.URL.Query().Get("attributes"))
+		return iam.User{UserName: "me@example.com"}
+	})
+	testserver.AddDefaultHandlers(server)
+	w, err := databricks.NewWorkspaceClient(&databricks.Config{Host: server.URL, Token: "token"})
+	require.NoError(t, err)
+	t.Setenv(userWorkspaceDirEnv, "")
+
+	dir, err := userWorkspaceDir(t.Context(), w)
+	require.NoError(t, err)
+	assert.Equal(t, "/Workspace/Users/me@example.com", dir)
+	assert.Equal(t, []string{"userName"}, attributes)
+}
+
+func TestUserWorkspaceDirProfilePrecedence(t *testing.T) {
+	configPath := filepath.Join(t.TempDir(), ".databrickscfg")
+	require.NoError(t, os.WriteFile(configPath, []byte(`
+[__settings__]
+default_profile = second
+
+[first]
+host = https://first.test
+databricks_internal_user_workspace_dir = /Workspace/first
+
+[second]
+host = https://second.test
+databricks_internal_user_workspace_dir = /Workspace/second
+`), 0o600))
+
+	t.Run("explicit profile", func(t *testing.T) {
+		w := newFakeWorkspaceClient(t)
+		w.Config.ConfigFile = configPath
+		w.Config.Profile = "first"
+		t.Setenv(userWorkspaceDirEnv, "")
+		dir, err := userWorkspaceDir(t.Context(), w)
+		require.NoError(t, err)
+		assert.Equal(t, "/Workspace/first", dir)
+	})
+
+	t.Run("default profile", func(t *testing.T) {
+		w := newFakeWorkspaceClient(t)
+		w.Config.ConfigFile = configPath
+		w.Config.Profile = ""
+		t.Setenv(userWorkspaceDirEnv, "")
+		dir, err := userWorkspaceDir(t.Context(), w)
+		require.NoError(t, err)
+		assert.Equal(t, "/Workspace/second", dir)
+	})
+
+	t.Run("environment wins", func(t *testing.T) {
+		w := newFakeWorkspaceClient(t)
+		w.Config.ConfigFile = configPath
+		w.Config.Profile = "first"
+		t.Setenv(userWorkspaceDirEnv, "/Workspace/env")
+		dir, err := userWorkspaceDir(t.Context(), w)
+		require.NoError(t, err)
+		assert.Equal(t, "/Workspace/env", dir)
+	})
+}
+
+func TestEnsureExperimentDirectory(t *testing.T) {
+	ctx := t.Context()
+	w := newFakeWorkspaceClient(t)
+
+	// Empty means default (always exists) — no API call, no error.
+	require.NoError(t, ensureExperimentDirectory(ctx, w, ""))
+
+	// A missing path is created.
+	require.NoError(t, ensureExperimentDirectory(ctx, w, "/Workspace/Users/me/exp"))
+
+	// An existing directory is accepted as-is.
+	require.NoError(t, w.Workspace.MkdirsByPath(ctx, "/Workspace/Users/me/existing"))
+	require.NoError(t, ensureExperimentDirectory(ctx, w, "/Workspace/Users/me/existing"))
+
+	// A path that exists but is a file is rejected.
+	fc, err := filer.NewWorkspaceFilesClient(w, "/Workspace/Users/me")
+	require.NoError(t, err)
+	require.NoError(t, fc.Write(ctx, "afile", strings.NewReader("x")))
+	err = ensureExperimentDirectory(ctx, w, "/Workspace/Users/me/afile")
+	require.ErrorContains(t, err, "is not a directory")
+}
diff --git a/cmd/air/runpermissions.go b/cmd/air/runpermissions.go
new file mode 100644
index 00000000000..b26ff33df43
--- /dev/null
+++ b/cmd/air/runpermissions.go
@@ -0,0 +1,196 @@
+package aircmd
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strconv"
+	"time"
+
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/service/iam"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/databricks/databricks-sdk-go/service/ml"
+)
+
+const (
+	// mlflowPermissionTimeout bounds the best-effort experiment permission grant.
+	// The run's MLflow experiment id comes from runs/get-output, which may lag the
+	// submit by a moment; this caps how long we wait for it and keeps a
+	// not-yet-populated output from stalling submit.
+	mlflowPermissionTimeout = 2 * time.Second
+	// mlflowPermissionPollInterval is how often runs/get-output is retried while
+	// waiting for the experiment id to appear.
+	mlflowPermissionPollInterval = 100 * time.Millisecond
+)
+
+// permissionAccessControl builds an ACL entry for a validated permission grant.
+func permissionAccessControl(p permission) iam.AccessControlRequest {
+	acl := iam.AccessControlRequest{PermissionLevel: iam.PermissionLevel(p.Level)}
+	switch {
+	case p.UserName != nil:
+		acl.UserName = *p.UserName
+	case p.GroupName != nil:
+		acl.GroupName = *p.GroupName
+	case p.ServicePrincipalName != nil:
+		acl.ServicePrincipalName = *p.ServicePrincipalName
+	}
+	return acl
+}
+
+// grantJobPermissions adds the configured ACLs to a job.
+func grantJobPermissions(ctx context.Context, w *databricks.WorkspaceClient, jobID string, permissions []permission) error {
+	if len(permissions) == 0 {
+		return nil
+	}
+
+	jobACL := make([]iam.AccessControlRequest, 0, len(permissions))
+	for _, p := range permissions {
+		jobACL = append(jobACL, permissionAccessControl(p))
+	}
+
+	_, err := w.Permissions.Update(ctx, iam.UpdateObjectPermissions{
+		RequestObjectType: "jobs",
+		RequestObjectId:   jobID,
+		AccessControlList: jobACL,
+	})
+	if err != nil {
+		return fmt.Errorf("failed to grant job permissions: %w", err)
+	}
+	return nil
+}
+
+// experimentPermissionLevel maps a job permission level onto the nearest MLflow
+// experiment permission level. Experiments only support CAN_READ/CAN_EDIT/
+// CAN_MANAGE, so the job-oriented levels fold onto those. ok is false when the
+// level has no experiment equivalent and the grant should be skipped.
+func experimentPermissionLevel(level string) (ml.ExperimentPermissionLevel, bool) {
+	switch iam.PermissionLevel(level) {
+	case iam.PermissionLevelCanView:
+		return ml.ExperimentPermissionLevelCanRead, true
+	case iam.PermissionLevelCanManageRun:
+		return ml.ExperimentPermissionLevelCanEdit, true
+	case iam.PermissionLevelCanManage, iam.PermissionLevelIsOwner:
+		return ml.ExperimentPermissionLevelCanManage, true
+	default:
+		return "", false
+	}
+}
+
+// experimentAccessControl builds an experiment ACL entry from a validated grant.
+// ok is false when the grant's level has no experiment equivalent.
+func experimentAccessControl(p permission) (ml.ExperimentAccessControlRequest, bool) {
+	level, ok := experimentPermissionLevel(p.Level)
+	if !ok {
+		return ml.ExperimentAccessControlRequest{}, false
+	}
+	acl := ml.ExperimentAccessControlRequest{PermissionLevel: level}
+	switch {
+	case p.UserName != nil:
+		acl.UserName = *p.UserName
+	case p.GroupName != nil:
+		acl.GroupName = *p.GroupName
+	case p.ServicePrincipalName != nil:
+		acl.ServicePrincipalName = *p.ServicePrincipalName
+	}
+	return acl, true
+}
+
+// resolveSubmittedExperimentID polls runs/get-output for the run's MLflow
+// experiment id until it appears or ctx expires. The id is the run's own
+// experiment, so granting on it can never touch a different user's experiment —
+// unlike resolving a bare experiment name, which would have to guess the owning
+// directory (and has no default for a service principal). Returns "" if the id
+// doesn't become available in time.
+func resolveSubmittedExperimentID(ctx context.Context, w *databricks.WorkspaceClient, run *jobs.Run) string {
+	ticker := time.NewTicker(mlflowPermissionPollInterval)
+	defer ticker.Stop()
+	for {
+		if out := aiRuntimeTaskOutput(ctx, w, run); out != nil && out.MlflowExperimentId != "" {
+			return out.MlflowExperimentId
+		}
+
+		select {
+		case <-ctx.Done():
+			return ""
+		case <-ticker.C:
+		}
+	}
+}
+
+// grantExperimentPermissions resolves the run's MLflow experiment and adds the
+// configured ACLs to it. Unlike jobs, whose permissions are set remotely, the
+// experiment is created by the AI Runtime backend so its ACLs must be set here
+// from the client.
+func grantExperimentPermissions(ctx context.Context, w *databricks.WorkspaceClient, run *jobs.Run, permissions []permission) error {
+	experimentACL := make([]ml.ExperimentAccessControlRequest, 0, len(permissions))
+	for _, p := range permissions {
+		if acl, ok := experimentAccessControl(p); ok {
+			experimentACL = append(experimentACL, acl)
+		}
+	}
+	if len(experimentACL) == 0 {
+		return nil
+	}
+
+	// Bound only the resolution: a not-yet-populated output must never stall the
+	// grant indefinitely, but the UpdatePermissions call below runs on the
+	// caller's context.
+	resolveCtx, cancel := context.WithTimeout(ctx, mlflowPermissionTimeout)
+	defer cancel()
+	experimentID := resolveSubmittedExperimentID(resolveCtx, w, run)
+	if experimentID == "" {
+		return errors.New("could not resolve the run's MLflow experiment")
+	}
+
+	_, err := w.Experiments.UpdatePermissions(ctx, ml.ExperimentPermissionsRequest{
+		ExperimentId:      experimentID,
+		AccessControlList: experimentACL,
+	})
+	if err != nil {
+		return fmt.Errorf("failed to grant experiment permissions: %w", err)
+	}
+	return nil
+}
+
+// grantSubmittedPermissions applies the run's configured ACLs after the submit
+// result has been shown, wrapping the bounded best-effort grant in a spinner so
+// it never silently delays the success line. showProgress gates the spinner
+// (text mode only).
+func grantSubmittedPermissions(ctx context.Context, w *databricks.WorkspaceClient, runID int64, permissions []permission, showProgress bool) {
+	if len(permissions) == 0 {
+		return
+	}
+	_ = withSpinner(ctx, showProgress, "Granting permissions…", func() error {
+		applySubmittedPermissions(ctx, w, runID, permissions)
+		return nil
+	})
+}
+
+// applySubmittedPermissions resolves the submitted run and grants its configured
+// ACLs on both the job (remotely) and the MLflow experiment (client-side).
+func applySubmittedPermissions(ctx context.Context, w *databricks.WorkspaceClient, runID int64, permissions []permission) {
+	if len(permissions) == 0 {
+		return
+	}
+
+	run, err := w.Jobs.GetRun(ctx, jobs.GetRunRequest{RunId: runID})
+	if err != nil {
+		log.Warnf(ctx, "failed to grant permissions on workload: %v", err)
+		log.Warnf(ctx, "job was created successfully, but permissions could not be granted")
+		return
+	}
+
+	if err := grantJobPermissions(ctx, w, strconv.FormatInt(run.JobId, 10), permissions); err != nil {
+		log.Warnf(ctx, "failed to grant permissions on workload: %v", err)
+		log.Warnf(ctx, "job was created successfully, but permissions could not be granted")
+	}
+
+	// Best-effort: a missing experiment must never fail an otherwise-successful
+	// submit.
+	if err := grantExperimentPermissions(ctx, w, run, permissions); err != nil {
+		log.Warnf(ctx, "failed to grant experiment permissions: %v", err)
+		log.Warnf(ctx, "job was created successfully, but experiment permissions could not be granted")
+	}
+}
diff --git a/cmd/air/runpermissions_test.go b/cmd/air/runpermissions_test.go
new file mode 100644
index 00000000000..891b830c9ca
--- /dev/null
+++ b/cmd/air/runpermissions_test.go
@@ -0,0 +1,156 @@
+package aircmd
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/databricks/cli/libs/testserver"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/databricks/databricks-sdk-go/service/ml"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGrantJobPermissions(t *testing.T) {
+	server := testserver.New(t)
+	t.Cleanup(server.Close)
+
+	var requestBody string
+	server.Handle("PATCH", "/api/2.0/permissions/jobs/123", func(req testserver.Request) any {
+		requestBody = string(req.Body)
+		return map[string]any{}
+	})
+
+	w, err := databricks.NewWorkspaceClient(&databricks.Config{Host: server.URL, Token: "token"})
+	require.NoError(t, err)
+	err = grantJobPermissions(t.Context(), w, "123", []permission{
+		{UserName: new("alice@example.com"), Level: "CAN_MANAGE"},
+		{GroupName: new("data-team"), Level: "CAN_VIEW"},
+		{ServicePrincipalName: new("training-sp"), Level: "CAN_MANAGE_RUN"},
+	})
+	require.NoError(t, err)
+
+	assert.JSONEq(t, `{
+		"access_control_list": [
+			{"user_name": "alice@example.com", "permission_level": "CAN_MANAGE"},
+			{"group_name": "data-team", "permission_level": "CAN_VIEW"},
+			{"service_principal_name": "training-sp", "permission_level": "CAN_MANAGE_RUN"}
+		]
+	}`, requestBody)
+}
+
+func TestExperimentPermissionLevel(t *testing.T) {
+	cases := []struct {
+		job  string
+		want ml.ExperimentPermissionLevel
+		ok   bool
+	}{
+		{"CAN_VIEW", ml.ExperimentPermissionLevelCanRead, true},
+		{"CAN_MANAGE_RUN", ml.ExperimentPermissionLevelCanEdit, true},
+		{"CAN_MANAGE", ml.ExperimentPermissionLevelCanManage, true},
+		{"IS_OWNER", ml.ExperimentPermissionLevelCanManage, true},
+		{"CAN_ATTACH_TO", "", false},
+	}
+	for _, tc := range cases {
+		got, ok := experimentPermissionLevel(tc.job)
+		assert.Equal(t, tc.ok, ok, tc.job)
+		assert.Equal(t, tc.want, got, tc.job)
+	}
+}
+
+func TestGrantExperimentPermissions(t *testing.T) {
+	server := testserver.New(t)
+	t.Cleanup(server.Close)
+
+	// The experiment id is the run's own, resolved from runs/get-output keyed by
+	// the task run id.
+	server.Handle("GET", "/api/2.2/jobs/runs/get-output", func(req testserver.Request) any {
+		assert.Equal(t, "456", req.URL.Query().Get("run_id"))
+		return map[string]any{"ai_runtime_task_output": map[string]any{"mlflow_experiment_id": "42"}}
+	})
+	var requestBody string
+	server.Handle("PATCH", "/api/2.0/permissions/experiments/42", func(req testserver.Request) any {
+		requestBody = string(req.Body)
+		return map[string]any{}
+	})
+
+	w, err := databricks.NewWorkspaceClient(&databricks.Config{Host: server.URL, Token: "token"})
+	require.NoError(t, err)
+	run := &jobs.Run{Tasks: []jobs.RunTask{{RunId: 456, AiRuntimeTask: &jobs.AiRuntimeTask{Experiment: "submit-smoke"}}}}
+	err = grantExperimentPermissions(t.Context(), w, run, []permission{
+		{UserName: new("alice@example.com"), Level: "CAN_MANAGE"},
+		{GroupName: new("data-team"), Level: "CAN_VIEW"},
+		{ServicePrincipalName: new("training-sp"), Level: "CAN_MANAGE_RUN"},
+	})
+	require.NoError(t, err)
+
+	// Job levels are mapped onto their nearest experiment equivalents.
+	assert.JSONEq(t, `{
+		"access_control_list": [
+			{"user_name": "alice@example.com", "permission_level": "CAN_MANAGE"},
+			{"group_name": "data-team", "permission_level": "CAN_READ"},
+			{"service_principal_name": "training-sp", "permission_level": "CAN_EDIT"}
+		]
+	}`, requestBody)
+}
+
+func TestResolveSubmittedExperimentIDTimesOut(t *testing.T) {
+	server := testserver.New(t)
+	t.Cleanup(server.Close)
+
+	// get-output has no experiment id yet.
+	server.Handle("GET", "/api/2.2/jobs/runs/get-output", func(req testserver.Request) any {
+		return map[string]any{}
+	})
+
+	w, err := databricks.NewWorkspaceClient(&databricks.Config{Host: server.URL, Token: "token"})
+	require.NoError(t, err)
+
+	// An already-expired context gives up on the first miss without polling.
+	ctx, cancel := context.WithTimeout(t.Context(), time.Nanosecond)
+	defer cancel()
+	run := &jobs.Run{Tasks: []jobs.RunTask{{RunId: 456}}}
+	assert.Empty(t, resolveSubmittedExperimentID(ctx, w, run))
+}
+
+// TestApplySubmittedPermissionsAiRuntimeTask covers the real submit path: the run
+// reports an ai_runtime_task (not a gen_ai_compute_task), so the experiment id
+// comes from runs/get-output and both job and experiment permissions are granted.
+func TestApplySubmittedPermissionsAiRuntimeTask(t *testing.T) {
+	server := testserver.New(t)
+	t.Cleanup(server.Close)
+
+	server.Handle("GET", "/api/2.2/jobs/runs/get", func(req testserver.Request) any {
+		return map[string]any{
+			"run_id": 555,
+			"job_id": 123,
+			"tasks": []map[string]any{{
+				"run_id":          456,
+				"ai_runtime_task": map[string]any{"experiment": "submit-smoke"},
+			}},
+		}
+	})
+	server.Handle("GET", "/api/2.2/jobs/runs/get-output", func(req testserver.Request) any {
+		return map[string]any{"ai_runtime_task_output": map[string]any{"mlflow_experiment_id": "42"}}
+	})
+	var jobBody, experimentBody string
+	server.Handle("PATCH", "/api/2.0/permissions/jobs/123", func(req testserver.Request) any {
+		jobBody = string(req.Body)
+		return map[string]any{}
+	})
+	server.Handle("PATCH", "/api/2.0/permissions/experiments/42", func(req testserver.Request) any {
+		experimentBody = string(req.Body)
+		return map[string]any{}
+	})
+
+	w, err := databricks.NewWorkspaceClient(&databricks.Config{Host: server.URL, Token: "token"})
+	require.NoError(t, err)
+	applySubmittedPermissions(t.Context(), w, 555, []permission{
+		{UserName: new("alice@example.com"), Level: "CAN_MANAGE"},
+	})
+
+	assert.JSONEq(t, `{"access_control_list":[{"user_name":"alice@example.com","permission_level":"CAN_MANAGE"}]}`, jobBody)
+	assert.JSONEq(t, `{"access_control_list":[{"user_name":"alice@example.com","permission_level":"CAN_MANAGE"}]}`, experimentBody)
+}
diff --git a/cmd/air/runsubmit.go b/cmd/air/runsubmit.go
new file mode 100644
index 00000000000..d1e94e068dc
--- /dev/null
+++ b/cmd/air/runsubmit.go
@@ -0,0 +1,452 @@
+package aircmd
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"path"
+	"strconv"
+	"strings"
+	"time"
+	"uuid"
+
+	"github.com/databricks/cli/libs/auth"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/env"
+	"github.com/databricks/cli/libs/filer"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/client"
+	"github.com/databricks/databricks-sdk-go/service/compute"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"golang.org/x/sync/errgroup"
+)
+
+// dlRuntimeImageEnv overrides the default deep-learning runtime image.
+const dlRuntimeImageEnv = "DATABRICKS_DL_RUNTIME_IMAGE"
+
+const defaultDlRuntimeImage = "CLIENT-GPU-6"
+
+// aiRuntimeEnvironmentKey ties the task to the serverless environment that
+// carries the runtime channel.
+const aiRuntimeEnvironmentKey = "default"
+
+// dlRuntimeImage resolves the bare runtime channel (config version, else env,
+// else default), always stripping the CLIENT-GPU- prefix.
+func dlRuntimeImage(ctx context.Context, runtimeVersion string) string {
+	img := runtimeVersion
+	if img == "" {
+		img = env.Get(ctx, dlRuntimeImageEnv)
+	}
+	if img == "" {
+		img = defaultDlRuntimeImage
+	}
+	return strings.TrimPrefix(img, "CLIENT-GPU-")
+}
+
+func buildRunEnvironment(dlImage string, deps []string) *compute.Environment {
+	environment := &compute.Environment{}
+	if strings.HasPrefix(dlImage, databricksAIPrefix) {
+		environment.BaseEnvironment = "workspace-base-environments/" + dlImage
+	} else {
+		environment.EnvironmentVersion = dlImage
+	}
+	if len(deps) > 0 {
+		environment.Dependencies = deps
+	}
+	return environment
+}
+
+// buildSubmitPayload assembles the runs/submit payload. commandPath is the
+// workspace path of the uploaded command.sh; dlImage is the runtime channel;
+// usagePolicyID is the already-resolved policy id ("" when the run has none);
+// deps is the user's declared dependencies (nil when none are declared).
+//
+// max_retries is always sent (including 0) so the user's YAML value is honored:
+// setting it to 0 explicitly disables retries rather than falling back to the
+// server default. retry_on_timeout is sent only when retries are allowed, and is
+// omitempty so the wire form matches the Python CLI (which never emits a bare
+// "false"). Jobs performs the retries — each attempt is a fresh AI Runtime
+// workload.
+func buildSubmitPayload(cfg *runConfig, commandPath, dlImage, usagePolicyID string, snap snapshotResult, deps []string) jobs.SubmitRun {
+	deployment := jobs.DeploymentSpec{
+		Compute: jobs.ComputeSpec{
+			AcceleratorType:  jobs.ComputeSpecAcceleratorType(cfg.Compute.AcceleratorType),
+			AcceleratorCount: cfg.Compute.NumAccelerators,
+		},
+	}
+	if len(cfg.Containers) == 0 {
+		deployment.CommandPath = commandPath
+	}
+	task := jobs.AiRuntimeTask{
+		Experiment:     cfg.ExperimentName,
+		Deployments:    []jobs.DeploymentSpec{deployment},
+		CodeSourcePath: snap.CodeSourcePath,
+	}
+	if cfg.MLflowRunName != nil {
+		task.MlflowRun = *cfg.MLflowRunName
+	}
+	if cfg.MLflowExperimentDirectory != nil {
+		task.MlflowExperimentDirectory = *cfg.MLflowExperimentDirectory
+	}
+	if cfg.MLflowArtifactLocation != nil {
+		task.MlflowArtifactLocation = *cfg.MLflowArtifactLocation
+	}
+
+	maxRetries := cfg.maxRetries()
+	st := jobs.SubmitTask{
+		TaskKey:        cfg.ExperimentName,
+		RunIf:          jobs.RunIfAllSuccess,
+		AiRuntimeTask:  &task,
+		EnvironmentKey: aiRuntimeEnvironmentKey,
+		MaxRetries:     maxRetries,
+		// retry_on_timeout only makes sense when retries are allowed; otherwise
+		// omit it (matches Python's native path, which sets retry_on_timeout only
+		// under the same > 0 gate).
+		RetryOnTimeout:  maxRetries > 0,
+		ForceSendFields: []string{"MaxRetries"},
+	}
+
+	// Carry the user's declared deps inline on spec.dependencies; the AI Runtime
+	// backend installs them via --deps-config. The SDK marshaler drops nil and empty
+	// slices, so a no-deps run omits the key.
+	envSpec := buildRunEnvironment(dlImage, deps)
+
+	return jobs.SubmitRun{
+		RunName: cfg.ExperimentName,
+		// budget_policy_id matches what the Python CLI and `ssh connect` send;
+		// usage_policy_id is the newer alias for the same thing on SubmitRun.
+		BudgetPolicyId: usagePolicyID,
+		TimeoutSeconds: cfg.timeoutSeconds(),
+		Tasks:          []jobs.SubmitTask{st},
+		Environments: []jobs.JobEnvironment{{
+			EnvironmentKey: aiRuntimeEnvironmentKey,
+			Spec:           envSpec,
+		}},
+	}
+}
+
+type submittedContainer struct {
+	Name                  string
+	CommandPath           string
+	Ranks                 []int
+	UnityCatalogImagePath string
+}
+
+func submitRun(ctx context.Context, w *databricks.WorkspaceClient, payload jobs.SubmitRun, poolID, priorityClass, unityCatalogImagePath string, containers []submittedContainer) (int64, error) {
+	// None of these fields are modeled by the SDK's AiRuntimeTask, so a run that
+	// sets any of them has to go through the raw /api/2.2 body. priority_class only
+	// ever appears alongside a pool (validation enforces it), but route on
+	// all of them so none can be silently dropped.
+	if poolID == "" && priorityClass == "" && unityCatalogImagePath == "" && len(containers) == 0 {
+		wait, err := w.Jobs.Submit(ctx, payload)
+		if err != nil {
+			return 0, err
+		}
+		return wait.RunId, nil
+	}
+
+	raw, err := json.Marshal(payload)
+	if err != nil {
+		return 0, fmt.Errorf("failed to marshal AIR submit payload: %w", err)
+	}
+	var body map[string]any
+	decoder := json.NewDecoder(bytes.NewReader(raw))
+	decoder.UseNumber()
+	if err := decoder.Decode(&body); err != nil {
+		return 0, fmt.Errorf("failed to decode AIR submit payload: %w", err)
+	}
+	if err := injectPoolFields(body, poolID, priorityClass); err != nil {
+		return 0, err
+	}
+	if unityCatalogImagePath != "" {
+		aiRuntimeTask, err := aiRuntimeTaskFromSubmitBody(body)
+		if err != nil {
+			return 0, err
+		}
+		aiRuntimeTask["unity_catalog_image_path"] = unityCatalogImagePath
+	}
+	if len(containers) > 0 {
+		if err := injectContainers(body, containers); err != nil {
+			return 0, err
+		}
+	}
+
+	apiClient, err := client.New(w.Config)
+	if err != nil {
+		return 0, fmt.Errorf("failed to create API client: %w", err)
+	}
+	var response jobs.SubmitRunResponse
+	err = apiClient.Do(ctx, http.MethodPost, "/api/2.2/jobs/runs/submit", auth.WorkspaceIDHeaders(w.Config), nil, body, &response)
+	if err != nil {
+		return 0, err
+	}
+	return response.RunId, nil
+}
+
+func injectContainers(body map[string]any, containers []submittedContainer) error {
+	aiRuntimeTask, err := aiRuntimeTaskFromSubmitBody(body)
+	if err != nil {
+		return err
+	}
+	deployments, ok := aiRuntimeTask["deployments"].([]any)
+	if !ok || len(deployments) != 1 {
+		return errors.New("AIR submit payload must contain exactly one deployment")
+	}
+	deployment, ok := deployments[0].(map[string]any)
+	if !ok {
+		return errors.New("AIR submit payload deployment has an invalid shape")
+	}
+	// The SDK's DeploymentSpec marshals its required command_path even when
+	// empty. Container runs have their own commands, so omit that wire field.
+	delete(deployment, "command_path")
+	raw := make([]any, 0, len(containers))
+	for _, container := range containers {
+		ranks := make([]any, len(container.Ranks))
+		for i, rank := range container.Ranks {
+			ranks[i] = rank
+		}
+		raw = append(raw, map[string]any{
+			"name":                     container.Name,
+			"command_path":             container.CommandPath,
+			"ranks":                    ranks,
+			"unity_catalog_image_path": container.UnityCatalogImagePath,
+		})
+	}
+	deployment["containers"] = raw
+	return nil
+}
+
+// injectPoolFields sets the pool-only fields the SDK does not model onto the
+// decoded submit body: priority_class rides directly on the ai_runtime_task,
+// while provisioned_capacity_id (the wire name for the pool) rides on the
+// deployment's compute spec. Each is set only when non-empty.
+func injectPoolFields(body map[string]any, poolID, priorityClass string) error {
+	aiRuntimeTask, err := aiRuntimeTaskFromSubmitBody(body)
+	if err != nil {
+		return err
+	}
+	if priorityClass != "" {
+		aiRuntimeTask["priority_class"] = priorityClass
+	}
+	if poolID != "" {
+		deployments, ok := aiRuntimeTask["deployments"].([]any)
+		if !ok || len(deployments) != 1 {
+			return errors.New("AIR submit payload must contain exactly one deployment")
+		}
+		deployment, ok := deployments[0].(map[string]any)
+		if !ok {
+			return errors.New("AIR submit payload deployment has an invalid shape")
+		}
+		computeSpec, ok := deployment["compute"].(map[string]any)
+		if !ok {
+			return errors.New("AIR submit payload is missing deployment compute")
+		}
+		computeSpec["provisioned_capacity_id"] = poolID
+	}
+	return nil
+}
+
+// aiRuntimeTaskFromSubmitBody navigates a decoded runs/submit body to its single
+// ai_runtime_task map, erroring if the payload isn't the expected single-task shape.
+func aiRuntimeTaskFromSubmitBody(body map[string]any) (map[string]any, error) {
+	tasks, ok := body["tasks"].([]any)
+	if !ok || len(tasks) != 1 {
+		return nil, errors.New("AIR submit payload must contain exactly one task")
+	}
+	task, ok := tasks[0].(map[string]any)
+	if !ok {
+		return nil, errors.New("AIR submit payload task has an invalid shape")
+	}
+	aiRuntimeTask, ok := task["ai_runtime_task"].(map[string]any)
+	if !ok {
+		return nil, errors.New("AIR submit payload is missing ai_runtime_task")
+	}
+	return aiRuntimeTask, nil
+}
+
+// effectiveIdempotencyToken resolves the token sent to validation and submit:
+// the --idempotency-key flag wins, then the config's token, else a generated one.
+func effectiveIdempotencyToken(flag string, cfg *runConfig) string {
+	token := flag
+	if token == "" && cfg.IdempotencyToken != nil {
+		token = *cfg.IdempotencyToken
+	}
+	if token == "" {
+		token = uuid.New().String()
+	}
+	return token
+}
+
+// validateIdempotencyToken keeps the CLI's submission guard as a fallback when
+// backend validation is unavailable or does not yet enforce the same rule.
+func validateIdempotencyToken(token string) error {
+	if len(token) > 64 {
+		return fmt.Errorf("idempotency token must be 64 characters or less, got %d", len(token))
+	}
+	return nil
+}
+
+// withSpinner runs fn, showing an stderr spinner labeled msg when show is true.
+// The spinner auto-degrades to nothing on a non-interactive terminal; show is
+// false in JSON mode so the stdout envelope stream stays clean.
+func withSpinner(ctx context.Context, show bool, msg string, fn func() error) error {
+	if !show {
+		return fn()
+	}
+	sp := cmdio.NewSpinner(ctx)
+	sp.Update(msg)
+	defer sp.Close()
+	return fn()
+}
+
+// stageRunArtifacts uploads the launch files and optional code snapshot in
+// parallel. It returns only after both branches complete, so callers can safely
+// build and submit a payload that references their remote paths. Snapshot
+// sidecar writes must keep CreateParentDirectories because launch-directory
+// creation is concurrent, not ordered before snapshot staging.
+func stageRunArtifacts(ctx context.Context, launchWriter fileWriter, items []uploadItem, stageSnapshot func(context.Context) (snapshotResult, error)) (snapshotResult, error) {
+	group, groupCtx := errgroup.WithContext(ctx)
+	group.Go(func() error {
+		return uploadArtifacts(groupCtx, launchWriter, items)
+	})
+
+	var snap snapshotResult
+	if stageSnapshot != nil {
+		group.Go(func() error {
+			var err error
+			snap, err = stageSnapshot(groupCtx)
+			return err
+		})
+	}
+
+	err := group.Wait()
+	// Preserve measurements from attempted snapshot phases even if staging fails.
+	return snap, err
+}
+
+// submitWorkload runs the submit happy path: ensure the experiment directory,
+// upload the launch artifacts, assemble the Jobs payload, and submit it. It
+// returns the new run_id and its dashboard URL. showProgress enables the stderr
+// staging spinner (text mode only).
+func submitWorkload(ctx context.Context, w *databricks.WorkspaceClient, cfg *runConfig, configPath, idempotencyKey string, showProgress bool) (runID int64, dashboardURL string, err error) {
+	start := time.Now()
+	var snap snapshotResult
+	defer func() { logRunEvent(ctx, cfg, snap, runID, time.Since(start), err) }()
+
+	// Compute and validate the actual submission path before creating artifacts.
+	base, funcDir, commandPath, err := prospectiveLaunchPaths(ctx, w, cfg)
+	if err != nil {
+		return 0, "", err
+	}
+	containers := submittedContainers(cfg, funcDir)
+	token := effectiveIdempotencyToken(idempotencyKey, cfg)
+
+	// Validate server-side before uploading, so invalid configs leave no artifacts.
+	if err := preflightValidate(ctx, w, cfg, commandPath, containers, token); err != nil {
+		return 0, "", err
+	}
+
+	// Retain the local guard after backend validation so an unavailable endpoint
+	// cannot let a bad key reach upload or submission.
+	if err := validateIdempotencyToken(token); err != nil {
+		return 0, "", err
+	}
+
+	// Resolve the usage policy to its id next, so a bad name fails fast with a
+	// clear (caller-fixable) message before we upload any artifacts. Validation
+	// guarantees name and id are mutually exclusive: a literal id is used as-is, a
+	// name is resolved against the workspace.
+	usagePolicyID := ""
+	if cfg.UsagePolicyID != nil {
+		usagePolicyID = strings.TrimSpace(*cfg.UsagePolicyID)
+	}
+	if cfg.UsagePolicyName != nil {
+		usagePolicyID, err = resolveUsagePolicyIDByName(ctx, w, *cfg.UsagePolicyName)
+		if err != nil {
+			return 0, "", err
+		}
+	}
+
+	deps, _ := cfg.inlineDependencies()
+
+	experimentDir := ""
+	if cfg.MLflowExperimentDirectory != nil {
+		experimentDir = *cfg.MLflowExperimentDirectory
+	}
+	if err := ensureExperimentDirectory(ctx, w, experimentDir); err != nil {
+		return 0, "", err
+	}
+
+	fc, err := filer.NewWorkspaceFilesClient(w, funcDir)
+	if err != nil {
+		return 0, "", err
+	}
+	items, err := buildArtifacts(cfg)
+	if err != nil {
+		return 0, "", err
+	}
+
+	// Package and upload the code snapshot, if any; the remote code_source_path
+	// rides the ai_runtime_task. A run with no code_source leaves it empty.
+	// Snapshot is the only code_source type.
+	var stageSnapshot func(context.Context) (snapshotResult, error)
+	if cfg.CodeSource != nil && cfg.CodeSource.Snapshot != nil {
+		// Default snapshot tarballs land in the user's shared repo_snapshots dir;
+		// uploadSnapshot replaces this when remote_volume is configured.
+		snapshotArtifactPath := path.Join(base, ".air", "repo_snapshots")
+		stageSnapshot = func(ctx context.Context) (snapshotResult, error) {
+			// Sidecars land in the run's launch dir (funcDir) via fc, next to command.sh.
+			return uploadSnapshot(ctx, w, cfg.CodeSource.Snapshot, configPath, snapshotArtifactPath, fc, funcDir)
+		}
+	}
+
+	err = withSpinner(ctx, showProgress, "Staging run artifacts…", func() error {
+		var stageErr error
+		snap, stageErr = stageRunArtifacts(ctx, fc, items, stageSnapshot)
+		return stageErr
+	})
+	if err != nil {
+		return 0, "", err
+	}
+
+	runtimeVersion, _ := cfg.runtimeVersion()
+	payload := buildSubmitPayload(cfg, commandPath, dlRuntimeImage(ctx, runtimeVersion), usagePolicyID, snap, deps)
+	payload.IdempotencyToken = token
+
+	// The pool id is sent on the wire as provisioned_capacity_id (the backend's
+	// name for a GPU pool); only the user-facing YAML field is pool_id.
+	poolID := ""
+	if cfg.Compute.PoolID != nil {
+		poolID = *cfg.Compute.PoolID
+	}
+	priorityClass := ""
+	if cfg.Compute.PriorityClass != nil {
+		priorityClass = *cfg.Compute.PriorityClass
+	}
+	// Submit returns as soon as the run is created; we don't wait for it to finish.
+	// Permissions are granted by the caller, after the submit result is shown, so
+	// the best-effort grant never delays the success line.
+	runID, err = submitRun(ctx, w, payload, poolID, priorityClass, cfg.unityCatalogImagePath(), containers)
+	if err != nil {
+		return 0, "", err
+	}
+
+	dashboardURL = strings.TrimRight(w.Config.Host, "/") + "/jobs/runs/" + strconv.FormatInt(runID, 10)
+	return runID, dashboardURL, nil
+}
+
+func submittedContainers(cfg *runConfig, funcDir string) []submittedContainer {
+	containers := make([]submittedContainer, 0, len(cfg.Containers))
+	for _, container := range cfg.Containers {
+		containers = append(containers, submittedContainer{
+			Name:                  container.Name,
+			CommandPath:           path.Join(funcDir, "containers", container.Name, commandScriptName),
+			Ranks:                 container.Ranks,
+			UnityCatalogImagePath: container.UnityCatalogImage,
+		})
+	}
+	return containers
+}
diff --git a/cmd/air/runsubmit_test.go b/cmd/air/runsubmit_test.go
new file mode 100644
index 00000000000..5c5a2e7f23a
--- /dev/null
+++ b/cmd/air/runsubmit_test.go
@@ -0,0 +1,1037 @@
+package aircmd
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"io/fs"
+	"path"
+	"path/filepath"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/filer"
+	"github.com/databricks/cli/libs/testserver"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// stubValidateConfig registers an OK ValidateConfig response so submitWorkload's
+// pre-flight passes. Register before AddDefaultHandlers (the router is first-wins).
+func stubValidateConfig(server *testserver.Server) {
+	server.Handle("POST", "/api/2.0/ai-training/config:validate", func(req testserver.Request) any {
+		return validateConfigResponse{}
+	})
+}
+
+func TestEffectiveIdempotencyToken(t *testing.T) {
+	cfg := &runConfig{IdempotencyToken: new("from-config")}
+	assert.Equal(t, "from-flag", effectiveIdempotencyToken("from-flag", cfg))
+	assert.Equal(t, "from-config", effectiveIdempotencyToken("", cfg))
+	assert.NotEmpty(t, effectiveIdempotencyToken("", &runConfig{}))
+}
+
+func TestDlRuntimeImage(t *testing.T) {
+	ctx := t.Context()
+	// A config runtime version wins and is used bare.
+	assert.Equal(t, "5", dlRuntimeImage(ctx, "5"))
+	// The CLIENT-GPU- prefix is always stripped, even from the config version.
+	assert.Equal(t, "5", dlRuntimeImage(ctx, "CLIENT-GPU-5"))
+	// Default, with the prefix stripped.
+	assert.Equal(t, "6", dlRuntimeImage(ctx, ""))
+	// Env override, prefix stripped.
+	t.Setenv(dlRuntimeImageEnv, "CLIENT-GPU-7")
+	assert.Equal(t, "7", dlRuntimeImage(ctx, ""))
+}
+
+func TestBuildSubmitPayload(t *testing.T) {
+	cfg := &runConfig{
+		ExperimentName:            "exp",
+		Command:                   new("python train.py"),
+		Compute:                   &computeConfig{AcceleratorType: "GPU_8xH100", NumAccelerators: 16},
+		MaxRetries:                new(2),
+		TimeoutMinutes:            new(30),
+		MLflowRunName:             new("run-v2"),
+		MLflowExperimentDirectory: new("/Workspace/Users/me/exp"),
+		MLflowArtifactLocation:    new("dbfs:/Volumes/main/default/artifacts"),
+	}
+
+	p := buildSubmitPayload(cfg, "/d/command.sh", "5", "", snapshotResult{}, nil)
+
+	assert.Equal(t, "exp", p.RunName)
+	assert.Equal(t, 1800, p.TimeoutSeconds)
+	// No policy configured: the field stays empty and is omitted from the wire form.
+	assert.Empty(t, p.BudgetPolicyId)
+	require.Len(t, p.Environments, 1)
+	assert.Equal(t, aiRuntimeEnvironmentKey, p.Environments[0].EnvironmentKey)
+	require.NotNil(t, p.Environments[0].Spec)
+	assert.Equal(t, "5", p.Environments[0].Spec.EnvironmentVersion)
+	environmentJSON, err := json.Marshal(p.Environments[0].Spec)
+	require.NoError(t, err)
+	assert.JSONEq(t, `{"environment_version":"5"}`, string(environmentJSON))
+
+	require.Len(t, p.Tasks, 1)
+	task := p.Tasks[0]
+	assert.Equal(t, "exp", task.TaskKey)
+	assert.Equal(t, jobs.RunIfAllSuccess, task.RunIf)
+	assert.Equal(t, aiRuntimeEnvironmentKey, task.EnvironmentKey)
+	assert.Equal(t, 2, task.MaxRetries)
+	assert.True(t, task.RetryOnTimeout)
+
+	at := task.AiRuntimeTask
+	require.NotNil(t, at)
+	assert.Equal(t, "exp", at.Experiment)
+	assert.Equal(t, "run-v2", at.MlflowRun)
+	assert.Equal(t, "/Workspace/Users/me/exp", at.MlflowExperimentDirectory)
+	assert.Equal(t, "dbfs:/Volumes/main/default/artifacts", at.MlflowArtifactLocation)
+	require.Len(t, at.Deployments, 1)
+	assert.Equal(t, "/d/command.sh", at.Deployments[0].CommandPath)
+	assert.Equal(t, jobs.ComputeSpec{AcceleratorType: jobs.ComputeSpecAcceleratorTypeGpu8xH100, AcceleratorCount: 16}, at.Deployments[0].Compute)
+}
+
+func TestBuildSubmitPayloadB300(t *testing.T) {
+	cfg := &runConfig{
+		ExperimentName: "b300",
+		Command:        new("nvidia-smi"),
+		Compute:        &computeConfig{AcceleratorType: "GPU_8xB300", NumAccelerators: 8},
+	}
+
+	p := buildSubmitPayload(cfg, "/d/command.sh", "databricks_ai_v6", "", snapshotResult{}, nil)
+	require.Len(t, p.Environments, 1)
+	require.NotNil(t, p.Environments[0].Spec)
+	assert.Equal(t, "workspace-base-environments/databricks_ai_v6", p.Environments[0].Spec.BaseEnvironment)
+	assert.Empty(t, p.Environments[0].Spec.EnvironmentVersion)
+	require.Len(t, p.Tasks, 1)
+	require.NotNil(t, p.Tasks[0].AiRuntimeTask)
+	require.Len(t, p.Tasks[0].AiRuntimeTask.Deployments, 1)
+	assert.Equal(t, jobs.ComputeSpec{AcceleratorType: jobs.ComputeSpecAcceleratorType("GPU_8xB300"), AcceleratorCount: 8}, p.Tasks[0].AiRuntimeTask.Deployments[0].Compute)
+}
+
+func TestSubmitRun(t *testing.T) {
+	for _, tc := range []struct {
+		name                  string
+		poolID                string
+		priorityClass         string
+		unityCatalogImagePath string
+	}{
+		{name: "on-demand"},
+		{name: "pool", poolID: "capacity-1"},
+		{name: "pool-critical", poolID: "capacity-1", priorityClass: "CRITICAL"},
+		{name: "pool-normal", poolID: "capacity-1", priorityClass: "NORMAL"},
+		{name: "pool-best-effort", poolID: "capacity-1", priorityClass: "BEST_EFFORT"},
+		{name: "image", unityCatalogImagePath: "main.air.training:prod"},
+		{name: "pool-image", poolID: "capacity-1", unityCatalogImagePath: "main.air.training:prod"},
+		{name: "pool-priority-image", poolID: "capacity-1", priorityClass: "CRITICAL", unityCatalogImagePath: "main.air.training:prod"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			server := testserver.New(t)
+			t.Cleanup(server.Close)
+			server.Handle("POST", "/api/2.2/jobs/runs/submit", func(req testserver.Request) any {
+				assert.Equal(t, "123", req.Headers.Get("X-Databricks-Workspace-Id"))
+				var body map[string]any
+				require.NoError(t, json.Unmarshal(req.Body, &body))
+				assert.Equal(t, "idem-key", body["idempotency_token"])
+				tasks := body["tasks"].([]any)
+				require.Len(t, tasks, 1)
+				task := tasks[0].(map[string]any)
+				assert.EqualValues(t, 0, task["max_retries"])
+				airTask := task["ai_runtime_task"].(map[string]any)
+				// priority_class rides directly on the ai_runtime_task, next to
+				// provisioned_capacity_id on the deployment compute.
+				if tc.priorityClass == "" {
+					assert.NotContains(t, airTask, "priority_class")
+				} else {
+					assert.Equal(t, tc.priorityClass, airTask["priority_class"])
+				}
+				if tc.unityCatalogImagePath == "" {
+					assert.NotContains(t, airTask, "unity_catalog_image_path")
+				} else {
+					assert.Equal(t, tc.unityCatalogImagePath, airTask["unity_catalog_image_path"])
+				}
+				deployments := airTask["deployments"].([]any)
+				require.Len(t, deployments, 1)
+				deployment := deployments[0].(map[string]any)
+				compute := deployment["compute"].(map[string]any)
+				if tc.poolID == "" {
+					assert.NotContains(t, compute, "provisioned_capacity_id")
+				} else {
+					assert.Equal(t, tc.poolID, compute["provisioned_capacity_id"])
+				}
+				return jobs.SubmitRunResponse{RunId: 42}
+			})
+
+			w, err := databricks.NewWorkspaceClient(&databricks.Config{Host: server.URL, Token: "token", WorkspaceID: "123"})
+			require.NoError(t, err)
+			payload := buildSubmitPayload(&runConfig{
+				ExperimentName: "exp",
+				Command:        new("x"),
+				Compute:        &computeConfig{AcceleratorType: "GPU_1xH100", NumAccelerators: 1},
+				MaxRetries:     new(0),
+			}, "/command.sh", "4", "", snapshotResult{}, nil)
+			payload.IdempotencyToken = "idem-key"
+
+			runID, err := submitRun(t.Context(), w, payload, tc.poolID, tc.priorityClass, tc.unityCatalogImagePath, nil)
+			require.NoError(t, err)
+			assert.Equal(t, int64(42), runID)
+		})
+	}
+}
+
+func TestBuildSubmitPayloadDefaultRetries(t *testing.T) {
+	// max_retries unset defaults to 3 (matching the Python native path), so both
+	// retry fields are sent.
+	cfg := &runConfig{
+		ExperimentName: "exp",
+		Command:        new("x"),
+		Compute:        &computeConfig{AcceleratorType: "GPU_1xH100", NumAccelerators: 1},
+	}
+	task := buildSubmitPayload(cfg, "/d/command.sh", "4", "", snapshotResult{}, nil).Tasks[0]
+	assert.Equal(t, defaultMaxRetries, task.MaxRetries)
+	assert.True(t, task.RetryOnTimeout)
+}
+
+func TestBuildSubmitPayloadNoRetries(t *testing.T) {
+	// max_retries: 0 must be sent explicitly so Jobs honors "no retries" instead
+	// of applying the server default. retry_on_timeout is omitted when retries
+	// aren't allowed.
+	cfg := &runConfig{
+		ExperimentName: "exp",
+		Command:        new("x"),
+		Compute:        &computeConfig{AcceleratorType: "GPU_1xH100", NumAccelerators: 1},
+		MaxRetries:     new(0),
+	}
+	task := buildSubmitPayload(cfg, "/d/command.sh", "4", "", snapshotResult{}, nil).Tasks[0]
+	assert.Equal(t, 0, task.MaxRetries)
+	assert.False(t, task.RetryOnTimeout)
+
+	b, err := json.Marshal(task)
+	require.NoError(t, err)
+	assert.Contains(t, string(b), `"max_retries":0`)
+	assert.NotContains(t, string(b), "retry_on_timeout")
+}
+
+// TestBuildSubmitPayloadInlineDependencies covers how deps land on the environment
+// spec: a non-empty list is set alongside the runtime channel; empty and nil omit
+// the key so the payload is unchanged.
+func TestBuildSubmitPayloadInlineDependencies(t *testing.T) {
+	cfg := &runConfig{
+		ExperimentName: "exp",
+		Command:        new("x"),
+		Compute:        &computeConfig{AcceleratorType: "GPU_8xH100", NumAccelerators: 8},
+	}
+
+	deps := []string{"torch==2.3.0", "--extra-index-url https://internal/pypi", "numpy"}
+	spec := buildSubmitPayload(cfg, "/d/command.sh", "5", "", snapshotResult{}, deps).Environments[0].Spec
+	assert.Equal(t, deps, spec.Dependencies)
+	assert.Equal(t, "5", spec.EnvironmentVersion)
+
+	// The SDK marshaler drops empty/nil slices, so no "dependencies" key is emitted.
+	for _, empty := range [][]string{{}, nil} {
+		spec = buildSubmitPayload(cfg, "/d/command.sh", "5", "", snapshotResult{}, empty).Environments[0].Spec
+		b, err := json.Marshal(spec)
+		require.NoError(t, err)
+		assert.NotContains(t, string(b), "dependencies")
+	}
+}
+
+func TestBuildSubmitPayloadDatabricksAIEnvironment(t *testing.T) {
+	cfg := &runConfig{
+		ExperimentName: "exp",
+		Command:        new("x"),
+		Compute:        &computeConfig{AcceleratorType: "GPU_1xA10", NumAccelerators: 1},
+	}
+
+	spec := buildSubmitPayload(cfg, "/d/command.sh", "databricks_ai_v5", "", snapshotResult{}, []string{"accelerate"}).Environments[0].Spec
+	b, err := json.Marshal(spec)
+	require.NoError(t, err)
+	assert.JSONEq(t, `{
+		"base_environment": "workspace-base-environments/databricks_ai_v5",
+		"dependencies": ["accelerate"]
+	}`, string(b))
+}
+
+type blockingLaunchWriter struct {
+	started       chan struct{}
+	release       chan struct{}
+	finished      chan struct{}
+	signalStarted func()
+}
+
+func (w *blockingLaunchWriter) Mkdir(ctx context.Context, name string) error { return nil }
+
+func (w *blockingLaunchWriter) Write(ctx context.Context, name string, reader io.Reader, mode ...filer.WriteMode) error {
+	w.signalStarted()
+	select {
+	case <-w.release:
+		close(w.finished)
+		return nil
+	case <-ctx.Done():
+		return ctx.Err()
+	}
+}
+
+func TestStageRunArtifactsOverlapsLaunchAndSnapshot(t *testing.T) {
+	ctx, cancel := context.WithTimeout(t.Context(), 5*time.Second)
+	defer cancel()
+
+	launch := &blockingLaunchWriter{
+		started:  make(chan struct{}),
+		release:  make(chan struct{}),
+		finished: make(chan struct{}),
+	}
+	launch.signalStarted = sync.OnceFunc(func() { close(launch.started) })
+	snapshotStarted := make(chan struct{})
+	snapshotRelease := make(chan struct{})
+	done := make(chan struct {
+		snap snapshotResult
+		err  error
+	}, 1)
+
+	go func() {
+		snap, err := stageRunArtifacts(ctx, launch, []uploadItem{{commandScriptName, []byte("cmd")}}, func(ctx context.Context) (snapshotResult, error) {
+			close(snapshotStarted)
+			select {
+			case <-snapshotRelease:
+				return snapshotResult{CodeSourcePath: "/snapshot.tar.gz"}, nil
+			case <-ctx.Done():
+				return snapshotResult{}, ctx.Err()
+			}
+		})
+		done <- struct {
+			snap snapshotResult
+			err  error
+		}{snap: snap, err: err}
+	}()
+
+	// Both branches must start before either is released, proving they overlap.
+	select {
+	case <-launch.started:
+	case <-ctx.Done():
+		t.Fatal("launch staging did not start")
+	}
+	select {
+	case <-snapshotStarted:
+	case <-ctx.Done():
+		t.Fatal("snapshot staging did not overlap the launch upload")
+	}
+	close(launch.release)
+	<-launch.finished
+	select {
+	case <-done:
+		t.Fatal("staging returned before the snapshot completed")
+	default:
+	}
+	close(snapshotRelease)
+
+	result := <-done
+	require.NoError(t, result.err)
+	assert.Equal(t, "/snapshot.tar.gz", result.snap.CodeSourcePath)
+}
+
+func TestSubmitWorkload(t *testing.T) {
+	server := testserver.New(t)
+	t.Cleanup(server.Close)
+
+	// Register before AddDefaultHandlers: the router is first-wins, so this must claim the route ahead of the default handler.
+	var got jobs.SubmitRun
+	server.Handle("POST", "/api/2.2/jobs/runs/submit", func(req testserver.Request) any {
+		require.NoError(t, json.Unmarshal(req.Body, &got))
+		return jobs.SubmitRunResponse{RunId: 777}
+	})
+	var validatedToken string
+	server.Handle("POST", validateConfigPath, func(req testserver.Request) any {
+		var body map[string]any
+		require.NoError(t, json.Unmarshal(req.Body, &body))
+		runOptions := body["run_options"].(map[string]any)
+		validatedToken = runOptions["idempotency_token"].(string)
+		return validateConfigResponse{}
+	})
+	testserver.AddDefaultHandlers(server)
+
+	w, err := databricks.NewWorkspaceClient(&databricks.Config{Host: server.URL, Token: "token"})
+	require.NoError(t, err)
+
+	cfgPath := writeConfigFile(t, "run.yaml", minimalConfig)
+	cfg, err := loadRunConfig(cfgPath)
+	require.NoError(t, err)
+
+	runID, dashboardURL, err := submitWorkload(t.Context(), w, cfg, cfgPath, "idem-key", false)
+	require.NoError(t, err)
+	assert.Equal(t, int64(777), runID)
+	assert.Contains(t, dashboardURL, "/jobs/runs/777")
+	assert.Equal(t, "idem-key", validatedToken)
+
+	// The submitted payload is a native ai_runtime_task pointing at the uploaded
+	// command.sh under the run's launch directory.
+	assert.Equal(t, "my-run", got.RunName)
+	assert.Equal(t, "idem-key", got.IdempotencyToken)
+	require.Len(t, got.Environments, 1)
+	require.Len(t, got.Tasks, 1)
+	at := got.Tasks[0].AiRuntimeTask
+	require.NotNil(t, at)
+	require.Len(t, at.Deployments, 1)
+	d := at.Deployments[0]
+	assert.True(t, strings.HasSuffix(d.CommandPath, "/"+commandScriptName), d.CommandPath)
+	assert.Contains(t, d.CommandPath, "/.air/cli_launch/")
+	assert.Equal(t, jobs.ComputeSpecAcceleratorTypeGpu1xH100, d.Compute.AcceleratorType)
+	assert.Equal(t, 1, d.Compute.AcceleratorCount)
+	assert.Empty(t, d.Compute.ProvisionedCapacityId)
+}
+
+func TestSubmitWorkloadValidationOutcome(t *testing.T) {
+	tests := []struct {
+		name       string
+		response   any
+		wantError  string
+		wantSubmit bool
+	}{
+		{
+			name: "field error",
+			response: validateConfigResponse{Errors: []configFieldError{{
+				Path: "task.deployments[0].compute.accelerator_count", Message: "must be positive", Code: "INVALID_COUNT",
+			}}},
+			wantError: "accelerator_count: must be positive",
+		},
+		{
+			name:       "service unavailable",
+			response:   testserver.Response{StatusCode: 503, Body: map[string]string{"error_code": "TEMPORARILY_UNAVAILABLE", "message": "try again"}},
+			wantSubmit: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			server := testserver.New(t)
+			t.Cleanup(server.Close)
+			var uploads, submissions atomic.Int32
+			server.Handle("POST", validateConfigPath, func(req testserver.Request) any { return tt.response })
+			server.Handle("POST", "/api/2.0/workspace/import", func(req testserver.Request) any {
+				uploads.Add(1)
+				form, err := testserver.ParseImportForm(req)
+				assert.NoError(t, err)
+				return req.Workspace.WorkspaceFilesImportFile(form.Path, form.Content, true)
+			})
+			server.Handle("POST", "/api/2.2/jobs/runs/submit", func(req testserver.Request) any {
+				submissions.Add(1)
+				return jobs.SubmitRunResponse{RunId: 777}
+			})
+			testserver.AddDefaultHandlers(server)
+
+			w, err := databricks.NewWorkspaceClient(&databricks.Config{Host: server.URL, Token: "token", RetryTimeoutSeconds: 1})
+			require.NoError(t, err)
+			cfgPath := writeConfigFile(t, "run.yaml", minimalConfig)
+			cfg, err := loadRunConfig(cfgPath)
+			require.NoError(t, err)
+
+			_, _, err = submitWorkload(t.Context(), w, cfg, cfgPath, "idem-key", false)
+			if tt.wantError != "" {
+				require.ErrorContains(t, err, tt.wantError)
+			} else {
+				require.NoError(t, err)
+			}
+			if tt.wantSubmit {
+				assert.Positive(t, uploads.Load())
+				assert.Equal(t, int32(1), submissions.Load())
+			} else {
+				assert.Zero(t, uploads.Load())
+				assert.Zero(t, submissions.Load())
+			}
+		})
+	}
+}
+
+func TestSubmitWorkloadStagingErrorPreventsSubmit(t *testing.T) {
+	server := testserver.New(t)
+	t.Cleanup(server.Close)
+
+	var submitCalls atomic.Int32
+	server.Handle("POST", "/api/2.2/jobs/runs/submit", func(req testserver.Request) any {
+		submitCalls.Add(1)
+		return jobs.SubmitRunResponse{RunId: 777}
+	})
+	server.Handle("POST", "/api/2.0/workspace/mkdirs", func(req testserver.Request) any {
+		return testserver.Response{StatusCode: 500, Body: map[string]string{"message": "mkdir failed"}}
+	})
+	stubValidateConfig(server)
+	testserver.AddDefaultHandlers(server)
+
+	w, err := databricks.NewWorkspaceClient(&databricks.Config{Host: server.URL, Token: "token"})
+	require.NoError(t, err)
+	cfgPath := writeConfigFile(t, "run.yaml", minimalConfig)
+	cfg, err := loadRunConfig(cfgPath)
+	require.NoError(t, err)
+
+	_, _, err = submitWorkload(t.Context(), w, cfg, cfgPath, "idem-key", false)
+	require.Error(t, err)
+	assert.ErrorContains(t, err, "failed to create launch directory")
+	assert.Zero(t, submitCalls.Load())
+}
+
+// TestSubmitWorkloadHonorsOverride proves a --override reaches the actual
+// runs/submit payload on a real submit, not just dry-run validation: the config
+// pins num_accelerators=1, the override bumps it to 4, and the recorded request
+// body must carry 4.
+func TestSubmitWorkloadHonorsOverride(t *testing.T) {
+	server := testserver.New(t)
+	t.Cleanup(server.Close)
+
+	// Register before AddDefaultHandlers: the router is first-wins, so this must
+	// claim the route ahead of the default jobs/runs/submit handler.
+	var got jobs.SubmitRun
+	server.Handle("POST", "/api/2.2/jobs/runs/submit", func(req testserver.Request) any {
+		require.NoError(t, json.Unmarshal(req.Body, &got))
+		return jobs.SubmitRunResponse{RunId: 777}
+	})
+	stubValidateConfig(server)
+	testserver.AddDefaultHandlers(server)
+	w, err := databricks.NewWorkspaceClient(&databricks.Config{Host: server.URL, Token: "token"})
+	require.NoError(t, err)
+
+	cfgPath := writeConfigFile(t, "run.yaml", minimalConfig)
+	cfg, err := loadRunConfigWithOverrides(t.Context(), cfgPath, []string{"compute.num_accelerators=4"})
+	require.NoError(t, err)
+
+	_, _, err = submitWorkload(t.Context(), w, cfg, cfgPath, "idem-key", false)
+	require.NoError(t, err)
+
+	require.Len(t, got.Tasks, 1)
+	at := got.Tasks[0].AiRuntimeTask
+	require.NotNil(t, at)
+	require.Len(t, at.Deployments, 1)
+	assert.Equal(t, 4, at.Deployments[0].Compute.AcceleratorCount)
+}
+
+func TestSubmitWorkloadSendsUnityCatalogImagePath(t *testing.T) {
+	server := testserver.New(t)
+	t.Cleanup(server.Close)
+
+	var got map[string]any
+	server.Handle("POST", "/api/2.2/jobs/runs/submit", func(req testserver.Request) any {
+		require.NoError(t, json.Unmarshal(req.Body, &got))
+		return jobs.SubmitRunResponse{RunId: 777}
+	})
+	stubValidateConfig(server)
+	testserver.AddDefaultHandlers(server)
+	w, err := databricks.NewWorkspaceClient(&databricks.Config{Host: server.URL, Token: "token"})
+	require.NoError(t, err)
+
+	cfgPath := writeConfigFile(t, "run.yaml", minimalConfig+`
+environment:
+  unity_catalog_image: main.air.training:prod
+`)
+	cfg, err := loadRunConfig(cfgPath)
+	require.NoError(t, err)
+
+	_, _, err = submitWorkload(t.Context(), w, cfg, cfgPath, "idem-key", false)
+	require.NoError(t, err)
+
+	tasks, ok := got["tasks"].([]any)
+	require.True(t, ok)
+	require.Len(t, tasks, 1)
+	task, ok := tasks[0].(map[string]any)
+	require.True(t, ok)
+	aiRuntimeTask, ok := task["ai_runtime_task"].(map[string]any)
+	require.True(t, ok)
+	assert.Equal(t, "main.air.training:prod", aiRuntimeTask["unity_catalog_image_path"])
+}
+
+func TestInjectContainers(t *testing.T) {
+	cfg := baseRunConfig()
+	cfg.Containers = []containerConfig{{Name: "inference", Ranks: []int{0, 1}, UnityCatalogImage: "main.ml.inference:v1"}}
+	payload := buildSubmitPayload(cfg, "/Workspace/run/command.sh", "6", "", snapshotResult{}, nil)
+	assert.Empty(t, payload.Tasks[0].AiRuntimeTask.Deployments[0].CommandPath)
+	raw, err := json.Marshal(payload)
+	require.NoError(t, err)
+	var body map[string]any
+	require.NoError(t, json.Unmarshal(raw, &body))
+
+	err = injectContainers(body, []submittedContainer{
+		{Name: "inference", CommandPath: "/Workspace/run/containers/inference/command.sh", Ranks: []int{0, 1}, UnityCatalogImagePath: "main.ml.inference:v1"},
+		{Name: "dataproc", CommandPath: "/Workspace/run/containers/dataproc/command.sh", Ranks: []int{2}, UnityCatalogImagePath: "main.ml.dataproc:v1"},
+	})
+	require.NoError(t, err)
+
+	task, err := aiRuntimeTaskFromSubmitBody(body)
+	require.NoError(t, err)
+	deployment := task["deployments"].([]any)[0].(map[string]any)
+	assert.NotContains(t, deployment, "command_path")
+	containers := deployment["containers"].([]any)
+	require.Len(t, containers, 2)
+	first := containers[0].(map[string]any)
+	assert.Equal(t, "inference", first["name"])
+	assert.Equal(t, "/Workspace/run/containers/inference/command.sh", first["command_path"])
+	assert.Equal(t, "main.ml.inference:v1", first["unity_catalog_image_path"])
+	assert.Equal(t, []any{0, 1}, first["ranks"])
+	assert.NotContains(t, first, "environment_variables")
+}
+
+func TestSubmitWorkloadSendsContainerCommandsWithoutDeploymentCommand(t *testing.T) {
+	server := testserver.New(t)
+	t.Cleanup(server.Close)
+
+	var got map[string]any
+	server.Handle("POST", "/api/2.2/jobs/runs/submit", func(req testserver.Request) any {
+		require.NoError(t, json.Unmarshal(req.Body, &got))
+		return jobs.SubmitRunResponse{RunId: 777}
+	})
+	stubValidateConfig(server)
+	testserver.AddDefaultHandlers(server)
+	w, err := databricks.NewWorkspaceClient(&databricks.Config{Host: server.URL, Token: "token"})
+	require.NoError(t, err)
+
+	cfgPath := writeConfigFile(t, "run.yaml", `experiment_name: container-run
+compute:
+  accelerator_type: GPU_1xA10
+  num_accelerators: 2
+containers:
+  - name: inference
+    ranks: [0]
+    unity_catalog_image: main.ml.inference:v1
+    command: python infer.py
+  - name: trainer
+    ranks: [1]
+    unity_catalog_image: main.ml.trainer:v1
+    command: python train.py
+`)
+	cfg, err := loadRunConfig(cfgPath)
+	require.NoError(t, err)
+	_, _, err = submitWorkload(t.Context(), w, cfg, cfgPath, "idem-key", false)
+	require.NoError(t, err)
+
+	aiRuntimeTask, err := aiRuntimeTaskFromSubmitBody(got)
+	require.NoError(t, err)
+	deployments := aiRuntimeTask["deployments"].([]any)
+	require.Len(t, deployments, 1)
+	deployment := deployments[0].(map[string]any)
+	assert.NotContains(t, deployment, "command_path")
+	containers := deployment["containers"].([]any)
+	require.Len(t, containers, 2)
+	for i, name := range []string{"inference", "trainer"} {
+		container := containers[i].(map[string]any)
+		assert.Equal(t, name, container["name"])
+		assert.True(t, strings.HasSuffix(container["command_path"].(string), "/containers/"+name+"/command.sh"))
+	}
+}
+
+// A working-tree code_source is packaged into a tarball, uploaded via libs/filer,
+// and its remote code_source_path attached to the submitted task.
+func TestSubmitWorkloadWithCodeSource(t *testing.T) {
+	server := testserver.New(t)
+	t.Cleanup(server.Close)
+
+	// Register before AddDefaultHandlers: the router is first-wins, so this must claim the route ahead of the default handler.
+	var got jobs.SubmitRun
+	server.Handle("POST", "/api/2.2/jobs/runs/submit", func(req testserver.Request) any {
+		require.NoError(t, json.Unmarshal(req.Body, &got))
+		return jobs.SubmitRunResponse{RunId: 555}
+	})
+	var meCalls atomic.Int32
+	server.Handle("GET", "/api/2.0/preview/scim/v2/Me", func(req testserver.Request) any {
+		meCalls.Add(1)
+		return req.Workspace.MeUser(req.Token)
+	})
+	stubValidateConfig(server)
+	testserver.AddDefaultHandlers(server)
+	w, err := databricks.NewWorkspaceClient(&databricks.Config{Host: server.URL, Token: "token"})
+	require.NoError(t, err)
+
+	// A plain working-tree directory: packaging is plain-tar.
+	repo := filepath.Join(t.TempDir(), "src")
+	writeRepoFile(t, repo, "train.py", "print()")
+
+	cfg := minimalConfig + `
+code_source:
+  type: snapshot
+  snapshot:
+    root_path: ` + repo + `
+`
+	cfgPath := writeConfigFile(t, "run.yaml", cfg)
+	loaded, err := loadRunConfig(cfgPath)
+	require.NoError(t, err)
+
+	// The upload path logs via cmdio; the real `air run` context carries it.
+	ctx := cmdio.MockDiscard(t.Context())
+	_, _, err = submitWorkload(ctx, w, loaded, cfgPath, "idem", false)
+	require.NoError(t, err)
+
+	at := got.Tasks[0].AiRuntimeTask
+	// The tarball is uploaded to the artifact .internal dir and code_source_path
+	// rewritten to it.
+	assert.Contains(t, at.CodeSourcePath, "/.air/repo_snapshots/.internal/")
+	assert.True(t, strings.HasSuffix(at.CodeSourcePath, ".tar.gz"), at.CodeSourcePath)
+	assert.Equal(t, int32(1), meCalls.Load(), "code-source submission should resolve the workspace base once")
+}
+
+// A git-pinned code_source is git-archived at the commit, uploaded via libs/filer,
+// and its remote code_source_path attached to the submitted task.
+func TestSubmitWorkloadWithGitPinnedCodeSource(t *testing.T) {
+	server := testserver.New(t)
+	t.Cleanup(server.Close)
+
+	var got jobs.SubmitRun
+	server.Handle("POST", "/api/2.2/jobs/runs/submit", func(req testserver.Request) any {
+		require.NoError(t, json.Unmarshal(req.Body, &got))
+		return jobs.SubmitRunResponse{RunId: 555}
+	})
+	stubValidateConfig(server)
+	testserver.AddDefaultHandlers(server)
+	w, err := databricks.NewWorkspaceClient(&databricks.Config{Host: server.URL, Token: "token"})
+	require.NoError(t, err)
+
+	// A git repo committed at HEAD, referenced by commit so packaging is git_archive.
+	repo := newTestRepo(t)
+	writeRepoFile(t, repo, "train.py", "print()")
+	sha := commitAll(t, repo, "init")
+
+	cfg := minimalConfig + `
+code_source:
+  type: snapshot
+  snapshot:
+    root_path: ` + repo + `
+    git:
+      commit: ` + sha + `
+`
+	cfgPath := writeConfigFile(t, "run.yaml", cfg)
+	loaded, err := loadRunConfig(cfgPath)
+	require.NoError(t, err)
+
+	ctx := cmdio.MockDiscard(t.Context())
+	_, _, err = submitWorkload(ctx, w, loaded, cfgPath, "idem", false)
+	require.NoError(t, err)
+
+	at := got.Tasks[0].AiRuntimeTask
+	assert.Contains(t, at.CodeSourcePath, "/.air/repo_snapshots/.internal/")
+	assert.True(t, strings.HasSuffix(at.CodeSourcePath, ".tar.gz"), at.CodeSourcePath)
+}
+
+// testSidecarStore builds a workspace filer + base path standing in for the run's
+// launch dir, where uploadSnapshot writes git provenance sidecars.
+func testSidecarStore(t *testing.T, w *databricks.WorkspaceClient) (filer.Filer, string) {
+	t.Helper()
+	base := "/Workspace/Users/tester@databricks.com/.air/cli_launch/test"
+	f, err := filer.NewWorkspaceFilesClient(w, base)
+	require.NoError(t, err)
+	return f, base
+}
+
+const testSnapshotArtifactPath = "/Workspace/Users/tester@databricks.com/.air/repo_snapshots"
+
+// A plain-tar (working-tree) snapshot is content-addressed by its file fingerprint
+// (working-tree metadata): submitting the same unchanged tree twice reuses the already-uploaded
+// tarball and skips the second upload, resolving to the identical remote path.
+func TestSubmitWorkloadPlainTarContentAddressed(t *testing.T) {
+	server := testserver.New(t)
+	t.Cleanup(server.Close)
+
+	server.Handle("POST", "/api/2.2/jobs/runs/submit", func(req testserver.Request) any {
+		return jobs.SubmitRunResponse{RunId: 555}
+	})
+	// Count snapshot import calls, preserving fake-workspace persistence so the
+	// second submit's existence Stat sees the first upload. A count (not a set keyed by
+	// path) is what proves the skip: both submits resolve to the same content-addressed
+	// name, so a set could not tell a skipped second submit from one that re-uploaded to
+	// that same path.
+	snapshotUploads := 0
+	server.Handle("POST", "/api/2.0/workspace/import", func(req testserver.Request) any {
+		form, err := testserver.ParseImportForm(req)
+		assert.NoError(t, err)
+		if strings.Contains(form.Path, "/.air/repo_snapshots/") {
+			snapshotUploads++
+		}
+		return req.Workspace.WorkspaceFilesImportFile(form.Path, form.Content, form.Overwrite)
+	})
+	stubValidateConfig(server)
+	testserver.AddDefaultHandlers(server)
+	w, err := databricks.NewWorkspaceClient(&databricks.Config{Host: server.URL, Token: "token"})
+	require.NoError(t, err)
+
+	// A plain working-tree directory named "src": the old code named the tarball
+	// after the dir alone (src.tar.gz), so any two submissions collided.
+	repo := filepath.Join(t.TempDir(), "src")
+	writeRepoFile(t, repo, "train.py", "print()")
+
+	cfg := minimalConfig + `
+code_source:
+  type: snapshot
+  snapshot:
+    root_path: ` + repo + `
+`
+	cfgPath := writeConfigFile(t, "run.yaml", cfg)
+	loaded, err := loadRunConfig(cfgPath)
+	require.NoError(t, err)
+
+	ctx := cmdio.MockDiscard(t.Context())
+	sidecarStore, sidecarBase := testSidecarStore(t, w)
+	first, err := uploadSnapshot(ctx, w, loaded.CodeSource.Snapshot, cfgPath, testSnapshotArtifactPath, sidecarStore, sidecarBase)
+	require.NoError(t, err)
+	require.NotZero(t, snapshotUploads, "first submit should upload the tarball")
+	afterFirst := snapshotUploads
+	second, err := uploadSnapshot(ctx, w, loaded.CodeSource.Snapshot, cfgPath, testSnapshotArtifactPath, sidecarStore, sidecarBase)
+	require.NoError(t, err)
+
+	// Content-addressed name: not the bare dir, but a 16-hex-char fingerprint.
+	base := path.Base(first.CodeSourcePath)
+	assert.NotEqual(t, "src.tar.gz", base, "plain-tar name must be content-addressed, not the bare dir name")
+	assert.Regexp(t, `^src_[0-9a-f]{16}\.tar\.gz$`, base)
+
+	// Same unchanged tree → identical remote path, and the second submit moved no bytes:
+	// zero new import calls (a real skip), not a re-upload to the same name.
+	assert.Equal(t, first.CodeSourcePath, second.CodeSourcePath)
+	assert.Equal(t, afterFirst, snapshotUploads, "unchanged plain_tar should skip the second upload")
+	require.NotNil(t, first.SizeBytes)
+	assert.Positive(t, *first.SizeBytes)
+	assert.Nil(t, second.SizeBytes)
+	assert.Equal(t, new(false), second.UsesGit)
+	assert.Equal(t, new(modePlainTar), first.PackagingMode)
+	assert.Equal(t, first.PackagingMode, second.PackagingMode)
+	assert.NotNil(t, first.PackagingDurationMs)
+	assert.NotNil(t, first.UploadDurationMs)
+	assert.Equal(t, new(int64(0)), second.PackagingDurationMs)
+	assert.Equal(t, new(int64(0)), second.UploadDurationMs)
+}
+
+// A git_archive snapshot is content-addressed by (commit, include_paths): submitting
+// the same commit twice reuses the already-uploaded tarball and skips the second
+// upload (cache hit), while resolving to the identical remote path.
+func TestSubmitWorkloadGitArchiveCaching(t *testing.T) {
+	server := testserver.New(t)
+	t.Cleanup(server.Close)
+
+	server.Handle("POST", "/api/2.2/jobs/runs/submit", func(req testserver.Request) any {
+		return jobs.SubmitRunResponse{RunId: 555}
+	})
+	// Track which snapshot tarballs get uploaded, preserving fake-workspace
+	// persistence so the second submit's cache-existence Stat sees the first upload.
+	// Dedupe by path: the filer mkdirs-and-retries the import on a missing
+	// parent dir, so one logical upload can hit this route more than once.
+	uploaded := map[string]bool{}
+	server.Handle("POST", "/api/2.0/workspace/import", func(req testserver.Request) any {
+		form, err := testserver.ParseImportForm(req)
+		assert.NoError(t, err)
+		if strings.Contains(form.Path, "/.air/repo_snapshots/") {
+			uploaded[form.Path] = true
+		}
+		return req.Workspace.WorkspaceFilesImportFile(form.Path, form.Content, form.Overwrite)
+	})
+	stubValidateConfig(server)
+	testserver.AddDefaultHandlers(server)
+	w, err := databricks.NewWorkspaceClient(&databricks.Config{Host: server.URL, Token: "token"})
+	require.NoError(t, err)
+
+	repo := newTestRepo(t)
+	writeRepoFile(t, repo, "train.py", "print()")
+	sha := commitAll(t, repo, "init")
+
+	cfg := minimalConfig + `
+code_source:
+  type: snapshot
+  snapshot:
+    root_path: ` + repo + `
+    git:
+      commit: ` + sha + `
+`
+	cfgPath := writeConfigFile(t, "run.yaml", cfg)
+	loaded, err := loadRunConfig(cfgPath)
+	require.NoError(t, err)
+
+	ctx := cmdio.MockDiscard(t.Context())
+	sidecarStore, sidecarBase := testSidecarStore(t, w)
+	first, err := uploadSnapshot(ctx, w, loaded.CodeSource.Snapshot, cfgPath, testSnapshotArtifactPath, sidecarStore, sidecarBase)
+	require.NoError(t, err)
+	second, err := uploadSnapshot(ctx, w, loaded.CodeSource.Snapshot, cfgPath, testSnapshotArtifactPath, sidecarStore, sidecarBase)
+	require.NoError(t, err)
+
+	// Same pinned commit → identical content-addressed remote path, uploaded once
+	// (the second submit is a cache hit and moves no bytes).
+	assert.Equal(t, first.CodeSourcePath, second.CodeSourcePath)
+	assert.Len(t, uploaded, 1, "git_archive cache hit should skip the second upload")
+	require.NotNil(t, first.SizeBytes)
+	assert.Positive(t, *first.SizeBytes)
+	assert.Nil(t, second.SizeBytes)
+	assert.Equal(t, new(true), second.UsesGit)
+	assert.Equal(t, new(modeGitArchive), first.PackagingMode)
+	assert.Equal(t, first.PackagingMode, second.PackagingMode)
+	assert.NotNil(t, first.PackagingDurationMs)
+	assert.NotNil(t, first.UploadDurationMs)
+	assert.Equal(t, new(int64(0)), second.PackagingDurationMs)
+	assert.Equal(t, new(int64(0)), second.UploadDurationMs)
+}
+
+// When enabled, a code source uploads provenance sidecars (git_state.json and
+// git_diff.patch when the tree is dirty) next to the run's launch directory.
+// This path is paused to avoid dirty-state query and WSFS write latency.
+func TestSubmitWorkloadSkipsProvenanceSidecars(t *testing.T) {
+	server := testserver.New(t)
+	t.Cleanup(server.Close)
+
+	server.Handle("POST", "/api/2.2/jobs/runs/submit", func(req testserver.Request) any {
+		return jobs.SubmitRunResponse{RunId: 555}
+	})
+	stubValidateConfig(server)
+	testserver.AddDefaultHandlers(server)
+	w, err := databricks.NewWorkspaceClient(&databricks.Config{Host: server.URL, Token: "token"})
+	require.NoError(t, err)
+
+	// Commit, then dirty the tree to cover the previously active sidecar path.
+	repo := newTestRepo(t)
+	writeRepoFile(t, repo, "train.py", "print()")
+	commitAll(t, repo, "init")
+	writeRepoFile(t, repo, "train.py", "print('dirty')")
+
+	cfg := minimalConfig + `
+code_source:
+  type: snapshot
+  snapshot:
+    root_path: ` + repo + `
+`
+	cfgPath := writeConfigFile(t, "run.yaml", cfg)
+	loaded, err := loadRunConfig(cfgPath)
+	require.NoError(t, err)
+
+	ctx := cmdio.MockDiscard(t.Context())
+	sidecarStore, sidecarBase := testSidecarStore(t, w)
+	snap, err := uploadSnapshot(ctx, w, loaded.CodeSource.Snapshot, cfgPath, testSnapshotArtifactPath, sidecarStore, sidecarBase)
+	require.NoError(t, err)
+
+	assert.Empty(t, snap.GitStatePath)
+	assert.Empty(t, snap.GitDiffPath)
+	assert.Equal(t, new(true), snap.UsesGit)
+	assert.Equal(t, new(modePlainTar), snap.PackagingMode)
+
+	_, err = sidecarStore.Read(ctx, gitStateName)
+	assert.ErrorIs(t, err, fs.ErrNotExist)
+	_, err = sidecarStore.Read(ctx, gitDiffName)
+	assert.ErrorIs(t, err, fs.ErrNotExist)
+}
+
+// remote_volume uploads the snapshot to a UC Volume: snapshotUploadFiler routes
+// /Volumes destinations to a Files API filer, so code_source_path lands under the Volume path.
+func TestSubmitWorkloadWithRemoteVolumeCodeSource(t *testing.T) {
+	server := testserver.New(t)
+	t.Cleanup(server.Close)
+
+	var got jobs.SubmitRun
+	server.Handle("POST", "/api/2.2/jobs/runs/submit", func(req testserver.Request) any {
+		require.NoError(t, json.Unmarshal(req.Body, &got))
+		return jobs.SubmitRunResponse{RunId: 555}
+	})
+	// Stub the UC Volume file write: the fake server's default handler 404s when the
+	// parent dir is absent (no auto-mkdir), so accept the PUT to exercise the Volume
+	// upload route. This asserts we route to /api/2.0/fs/files/Volumes/... at all.
+	server.Handle("PUT", "/api/2.0/fs/files/Volumes/{path...}", func(req testserver.Request) any {
+		return testserver.Response{StatusCode: 204}
+	})
+	stubValidateConfig(server)
+	testserver.AddDefaultHandlers(server)
+	w, err := databricks.NewWorkspaceClient(&databricks.Config{Host: server.URL, Token: "token"})
+	require.NoError(t, err)
+
+	repo := filepath.Join(t.TempDir(), "src")
+	writeRepoFile(t, repo, "train.py", "print()")
+
+	cfg := minimalConfig + `
+code_source:
+  type: snapshot
+  snapshot:
+    root_path: ` + repo + `
+    remote_volume: /Volumes/main/default/code
+`
+	cfgPath := writeConfigFile(t, "run.yaml", cfg)
+	loaded, err := loadRunConfig(cfgPath)
+	require.NoError(t, err)
+
+	ctx := cmdio.MockDiscard(t.Context())
+	_, _, err = submitWorkload(ctx, w, loaded, cfgPath, "idem", false)
+	require.NoError(t, err)
+
+	at := got.Tasks[0].AiRuntimeTask
+	assert.Contains(t, at.CodeSourcePath, "/Volumes/main/default/code/.internal/")
+	assert.True(t, strings.HasSuffix(at.CodeSourcePath, ".tar.gz"), at.CodeSourcePath)
+}
+
+func TestSubmitWorkloadGuards(t *testing.T) {
+	cfgPath := writeConfigFile(t, "run.yaml", minimalConfig)
+	base, err := loadRunConfig(cfgPath)
+	require.NoError(t, err)
+
+	t.Run("unresolvable usage_policy_name fails before upload", func(t *testing.T) {
+		// An empty policy list makes the name unresolvable. Record every path the
+		// server sees so the "fails before any upload" ordering is asserted, not just
+		// asserted-by-comment: no import/mkdirs request may be made.
+		server := testserver.New(t)
+		t.Cleanup(server.Close)
+		var paths []string
+		server.Handle("GET", "/api/2.0/serverless-policies", func(req testserver.Request) any {
+			paths = append(paths, req.URL.Path)
+			return usagePoliciesResponse{}
+		})
+		server.Handle("POST", "/api/2.0/workspace/{path...}", func(req testserver.Request) any {
+			paths = append(paths, req.URL.Path)
+			return testserver.Response{StatusCode: 200}
+		})
+		stubValidateConfig(server)
+		testserver.AddDefaultHandlers(server)
+		pw, err := databricks.NewWorkspaceClient(&databricks.Config{Host: server.URL, Token: "token"})
+		require.NoError(t, err)
+
+		cfg := *base
+		cfg.UsagePolicyName = new("nope")
+		_, _, err = submitWorkload(t.Context(), pw, &cfg, cfgPath, "", false)
+		require.ErrorContains(t, err, `no usage policy named "nope"`)
+		for _, p := range paths {
+			assert.NotContains(t, p, "/workspace/", "no workspace write may precede policy resolution")
+		}
+	})
+}
+
+// The resolved policy id must reach the submit payload, by literal id and by name.
+func TestSubmitWorkloadSendsUsagePolicy(t *testing.T) {
+	const policyID = "12345678-90ab-cdef-1234-567890abcdef"
+
+	setup := func(t *testing.T) (*databricks.WorkspaceClient, *jobs.SubmitRun) {
+		server := testserver.New(t)
+		t.Cleanup(server.Close)
+
+		got := &jobs.SubmitRun{}
+		server.Handle("POST", "/api/2.2/jobs/runs/submit", func(req testserver.Request) any {
+			require.NoError(t, json.Unmarshal(req.Body, got))
+			return jobs.SubmitRunResponse{RunId: 1}
+		})
+		server.Handle("GET", "/api/2.0/serverless-policies", func(req testserver.Request) any {
+			return usagePoliciesResponse{Policies: []usagePolicy{{PolicyID: policyID, PolicyName: "team-a"}}}
+		})
+		stubValidateConfig(server)
+		testserver.AddDefaultHandlers(server)
+		w, err := databricks.NewWorkspaceClient(&databricks.Config{Host: server.URL, Token: "token"})
+		require.NoError(t, err)
+		return w, got
+	}
+
+	t.Run("literal id", func(t *testing.T) {
+		w, got := setup(t)
+		cfgPath := writeConfigFile(t, "run.yaml", minimalConfig+"usage_policy_id: "+policyID+"\n")
+		cfg, err := loadRunConfig(cfgPath)
+		require.NoError(t, err)
+
+		_, _, err = submitWorkload(cmdio.MockDiscard(t.Context()), w, cfg, cfgPath, "idem", false)
+		require.NoError(t, err)
+		assert.Equal(t, policyID, got.BudgetPolicyId)
+	})
+
+	t.Run("resolved from name", func(t *testing.T) {
+		w, got := setup(t)
+		cfgPath := writeConfigFile(t, "run.yaml", minimalConfig+"usage_policy_name: team-a\n")
+		cfg, err := loadRunConfig(cfgPath)
+		require.NoError(t, err)
+
+		_, _, err = submitWorkload(cmdio.MockDiscard(t.Context()), w, cfg, cfgPath, "idem", false)
+		require.NoError(t, err)
+		assert.Equal(t, policyID, got.BudgetPolicyId)
+	})
+}
diff --git a/cmd/air/runupload.go b/cmd/air/runupload.go
new file mode 100644
index 00000000000..ae567e9178e
--- /dev/null
+++ b/cmd/air/runupload.go
@@ -0,0 +1,214 @@
+package aircmd
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"maps"
+	"path"
+	"slices"
+	"strings"
+
+	"github.com/databricks/cli/libs/filer"
+	"go.yaml.in/yaml/v3"
+	"golang.org/x/sync/errgroup"
+)
+
+// Launch artifact basenames, uploaded into the run's cli_launch directory. The
+// server-side launcher derives requirements.yaml / hyperparameters.yaml from the
+// same directory, so these names are part of the contract.
+const (
+	trainingConfigName  = "training_config.yaml"
+	commandScriptName   = "command.sh"
+	hyperparametersName = "hyperparameters.yaml"
+	envVarsName         = "env_vars.json"
+	secretEnvVarsName   = "secret_env_vars.json"
+)
+
+// maxConfigYAMLBytes caps training_config.yaml. It is referenced by the Jobs
+// payload and rendered on the run page, so an oversized parameters/command block
+// is rejected here; full parameters still ship in hyperparameters.yaml.
+const maxConfigYAMLBytes = 1024 * 1024
+
+// uploadItem is a single artifact to write into the launch directory.
+type uploadItem struct {
+	name string
+	data []byte
+}
+
+// fileWriter is the subset of filer.Filer the upload path needs; a narrow
+// interface keeps buildArtifacts/upload testable without a live workspace.
+type fileWriter interface {
+	Mkdir(ctx context.Context, name string) error
+	Write(ctx context.Context, name string, reader io.Reader, mode ...filer.WriteMode) error
+}
+
+// buildArtifacts assembles the files to upload for a run: the final config, the
+// inline command as a script, and hyperparameters.
+//
+// Dependencies are not uploaded here; they ride inline on the serverless
+// environment's spec.dependencies (see buildSubmitPayload).
+func buildArtifacts(cfg *runConfig) ([]uploadItem, error) {
+	configData := cfg.artifactYAML
+	if len(configData) == 0 {
+		return nil, errors.New("serialized config YAML is unavailable")
+	}
+	if len(configData) > maxConfigYAMLBytes {
+		return nil, fmt.Errorf("config YAML is %.2f MB, over the %d MB limit; reduce 'parameters' or 'command'",
+			float64(len(configData))/(1024*1024), maxConfigYAMLBytes/(1024*1024))
+	}
+
+	items := []uploadItem{
+		{trainingConfigName, configData},
+	}
+	if cfg.Command != nil {
+		items = append(items, uploadItem{commandScriptName, []byte(*cfg.Command)})
+	}
+
+	var hyperparameters []byte
+	if len(cfg.Parameters) > 0 {
+		data, err := yaml.Marshal(cfg.Parameters)
+		if err != nil {
+			return nil, fmt.Errorf("failed to serialize parameters: %w", err)
+		}
+		hyperparameters = data
+		items = append(items, uploadItem{hyperparametersName, hyperparameters})
+	}
+
+	// The ai_runtime_task proto carries no inline env vars or secrets; stage them
+	// as JSON files co-located with command.sh for the server-side launcher.
+	if len(cfg.EnvVariables) > 0 {
+		data, err := json.Marshal(envVarEntries(cfg.EnvVariables))
+		if err != nil {
+			return nil, fmt.Errorf("failed to serialize env_variables: %w", err)
+		}
+		items = append(items, uploadItem{envVarsName, data})
+	}
+	if len(cfg.Secrets) > 0 {
+		data, err := json.Marshal(secretEnvVarEntries(cfg.Secrets))
+		if err != nil {
+			return nil, fmt.Errorf("failed to serialize secrets: %w", err)
+		}
+		items = append(items, uploadItem{secretEnvVarsName, data})
+	}
+
+	for _, container := range cfg.Containers {
+		dir := path.Join("containers", container.Name)
+		items = append(items, uploadItem{path.Join(dir, commandScriptName), []byte(*container.Command)})
+		if len(hyperparameters) > 0 {
+			items = append(items, uploadItem{path.Join(dir, hyperparametersName), hyperparameters})
+		}
+		plain, secrets := containerEnvironmentEntries(cfg, container)
+		if len(plain) > 0 {
+			data, err := json.Marshal(envVarEntries(plain))
+			if err != nil {
+				return nil, fmt.Errorf("failed to serialize environment variables for container %q: %w", container.Name, err)
+			}
+			items = append(items, uploadItem{path.Join(dir, envVarsName), data})
+		}
+		if len(secrets) > 0 {
+			data, err := json.Marshal(secretEnvVarEntries(secrets))
+			if err != nil {
+				return nil, fmt.Errorf("failed to serialize secret environment variables for container %q: %w", container.Name, err)
+			}
+			items = append(items, uploadItem{path.Join(dir, secretEnvVarsName), data})
+		}
+	}
+
+	return items, nil
+}
+
+func containerEnvironmentEntries(cfg *runConfig, container containerConfig) (map[string]string, map[string]string) {
+	plain := maps.Clone(cfg.EnvVariables)
+	secrets := maps.Clone(cfg.Secrets)
+	if plain == nil {
+		plain = map[string]string{}
+	}
+	if secrets == nil {
+		secrets = map[string]string{}
+	}
+	if container.EnvironmentVariables == nil {
+		return plain, secrets
+	}
+	for name, value := range container.EnvironmentVariables.Variables {
+		delete(plain, name)
+		delete(secrets, name)
+		match := secretTemplateRe.FindStringSubmatch(value)
+		if match != nil {
+			secrets[name] = match[1] + "/" + match[2]
+		} else {
+			plain[name] = value
+		}
+	}
+	return plain, secrets
+}
+
+// envVarEntry is one entry in env_vars.json.
+type envVarEntry struct {
+	Name  string `json:"name"`
+	Value string `json:"value"`
+}
+
+// secretEnvVarEntry is one entry in secret_env_vars.json. The YAML side is
+// {ENV_VAR: "scope/key"}; the launcher wants the split form.
+type secretEnvVarEntry struct {
+	Name        string `json:"name"`
+	SecretScope string `json:"secret_scope"`
+	SecretKey   string `json:"secret_key"`
+}
+
+// envVarEntries renders env_variables sorted by name for deterministic output.
+func envVarEntries(vars map[string]string) []envVarEntry {
+	out := make([]envVarEntry, 0, len(vars))
+	for _, name := range slices.Sorted(maps.Keys(vars)) {
+		out = append(out, envVarEntry{Name: name, Value: vars[name]})
+	}
+	return out
+}
+
+// secretEnvVarEntries renders secrets sorted by name for deterministic output.
+func secretEnvVarEntries(secrets map[string]string) []secretEnvVarEntry {
+	out := make([]secretEnvVarEntry, 0, len(secrets))
+	for _, name := range slices.Sorted(maps.Keys(secrets)) {
+		scope, key, _ := strings.Cut(secrets[name], "/")
+		out = append(out, secretEnvVarEntry{Name: name, SecretScope: scope, SecretKey: key})
+	}
+	return out
+}
+
+// uploadArtifacts creates the launch directory once, then writes all artifacts
+// concurrently. Each write overwrites an existing file but does not repeat parent
+// directory creation.
+//
+// TODO(DABs): this client-side upload could move onto libs/sync / a bundle deploy
+// so the CLI reuses DABs' file-staging machinery instead of writing files itself.
+func uploadArtifacts(ctx context.Context, w fileWriter, items []uploadItem) error {
+	if err := w.Mkdir(ctx, "."); err != nil {
+		return fmt.Errorf("failed to create launch directory: %w", err)
+	}
+	directories := map[string]struct{}{}
+	for _, item := range items {
+		if dir := path.Dir(item.name); dir != "." {
+			directories[dir] = struct{}{}
+		}
+	}
+	for _, dir := range slices.Sorted(maps.Keys(directories)) {
+		if err := w.Mkdir(ctx, dir); err != nil {
+			return fmt.Errorf("failed to create launch directory %s: %w", dir, err)
+		}
+	}
+
+	group, groupCtx := errgroup.WithContext(ctx)
+	for _, item := range items {
+		group.Go(func() error {
+			if err := w.Write(groupCtx, item.name, bytes.NewReader(item.data), filer.OverwriteIfExists); err != nil {
+				return fmt.Errorf("failed to upload %s: %w", item.name, err)
+			}
+			return nil
+		})
+	}
+	return group.Wait()
+}
diff --git a/cmd/air/runupload_test.go b/cmd/air/runupload_test.go
new file mode 100644
index 00000000000..60436a5e504
--- /dev/null
+++ b/cmd/air/runupload_test.go
@@ -0,0 +1,345 @@
+package aircmd
+
+import (
+	"context"
+	"errors"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/databricks/cli/libs/filer"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// fakeWriter records artifact writes in place of a workspace filer.
+type fakeWriter struct {
+	mu         sync.Mutex
+	written    map[string]string
+	modes      map[string][]filer.WriteMode
+	mkdirPaths []string
+}
+
+func (f *fakeWriter) Mkdir(ctx context.Context, name string) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.mkdirPaths = append(f.mkdirPaths, name)
+	return nil
+}
+
+func (f *fakeWriter) Write(ctx context.Context, name string, reader io.Reader, mode ...filer.WriteMode) error {
+	data, err := io.ReadAll(reader)
+	if err != nil {
+		return err
+	}
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if len(f.mkdirPaths) == 0 {
+		return errors.New("write called before mkdir")
+	}
+	if f.written == nil {
+		f.written = map[string]string{}
+		f.modes = map[string][]filer.WriteMode{}
+	}
+	f.written[name] = string(data)
+	f.modes[name] = append([]filer.WriteMode(nil), mode...)
+	return nil
+}
+
+func writeConfigFile(t *testing.T, name, content string) string {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), name)
+	require.NoError(t, os.WriteFile(path, []byte(content), 0o600))
+	return path
+}
+
+func itemNames(items []uploadItem) []string {
+	names := make([]string, len(items))
+	for i, it := range items {
+		names[i] = it.name
+	}
+	return names
+}
+
+func itemData(t *testing.T, items []uploadItem, name string) []byte {
+	t.Helper()
+	for _, item := range items {
+		if item.name == name {
+			return item.data
+		}
+	}
+	require.FailNow(t, "artifact not found", name)
+	return nil
+}
+
+func TestBuildArtifacts_CommandAndConfig(t *testing.T) {
+	cfg, err := loadRunConfig(writeConfigFile(t, "run.yaml", minimalConfig))
+	require.NoError(t, err)
+
+	items, err := buildArtifacts(cfg)
+	require.NoError(t, err)
+	assert.Equal(t, []string{trainingConfigName, commandScriptName}, itemNames(items))
+	assert.YAMLEq(t, minimalConfig, string(items[0].data))
+	assert.Equal(t, "python train.py", string(items[1].data))
+}
+
+func TestBuildArtifacts_ParametersButNoRequirements(t *testing.T) {
+	cfg, err := loadRunConfig(writeConfigFile(t, "run.yaml", `
+experiment_name: test
+compute:
+  num_accelerators: 1
+  accelerator_type: GPU_1xH100
+environment:
+  dependencies:
+    - torch
+    - numpy
+  version: 5
+command: echo hi
+parameters:
+  lr: 0.1
+`))
+	require.NoError(t, err)
+
+	// Inline deps are not uploaded, so the artifacts are config, command, and params.
+	items, err := buildArtifacts(cfg)
+	require.NoError(t, err)
+	assert.Equal(t, []string{trainingConfigName, commandScriptName, hyperparametersName}, itemNames(items))
+	assert.YAMLEq(t, `
+experiment_name: test
+compute:
+  num_accelerators: 1
+  accelerator_type: GPU_1xH100
+environment:
+  dependencies:
+    - torch
+    - numpy
+  version: 5
+command: echo hi
+parameters:
+  lr: 0.1
+`, string(itemData(t, items, trainingConfigName)))
+}
+
+func TestBuildArtifacts_EnvVarsAndSecrets(t *testing.T) {
+	cfg, err := loadRunConfig(writeConfigFile(t, "run.yaml", `
+experiment_name: test
+compute:
+  accelerator_type: GPU_1xH100
+  num_accelerators: 1
+command: echo hi
+env_variables:
+  WANDB: demo
+secrets:
+  HF_TOKEN: myscope/hf
+`))
+	require.NoError(t, err)
+
+	items, err := buildArtifacts(cfg)
+	require.NoError(t, err)
+	assert.Subset(t, itemNames(items), []string{envVarsName, secretEnvVarsName})
+
+	byName := map[string][]byte{}
+	for _, it := range items {
+		byName[it.name] = it.data
+	}
+	assert.JSONEq(t, `[{"name":"WANDB","value":"demo"}]`, string(byName[envVarsName]))
+	assert.JSONEq(t, `[{"name":"HF_TOKEN","secret_scope":"myscope","secret_key":"hf"}]`, string(byName[secretEnvVarsName]))
+}
+
+func TestBuildArtifacts_ContainerSidecars(t *testing.T) {
+	cfg, err := loadRunConfig(writeConfigFile(t, "run.yaml", `
+experiment_name: roles
+compute:
+  accelerator_type: GPU_1xH100
+  num_accelerators: 2
+env_variables:
+  SHARED: top
+  OVERRIDE: top
+secrets:
+  SHARED_SECRET: scope/shared
+parameters:
+  learning_rate: 0.001
+  epochs: 5
+containers:
+  - name: inference
+    command: python infer.py
+    ranks: [0]
+    unity_catalog_image: main.ml.inference:v1
+    environment_variables:
+      variables:
+        OVERRIDE: inference
+        TOKEN: '{{secrets/research/hf_token}}'
+  - name: dataproc
+    command: python dataproc.py
+    ranks: [1]
+    unity_catalog_image: main.ml.dataproc:v1
+`))
+	require.NoError(t, err)
+
+	items, err := buildArtifacts(cfg)
+	require.NoError(t, err)
+	assert.Equal(t, "python infer.py", string(itemData(t, items, "containers/inference/command.sh")))
+	hyperparameters := itemData(t, items, hyperparametersName)
+	assert.YAMLEq(t, "learning_rate: 0.001\nepochs: 5\n", string(hyperparameters))
+	assert.Equal(t, hyperparameters, itemData(t, items, "containers/inference/hyperparameters.yaml"))
+	assert.Equal(t, hyperparameters, itemData(t, items, "containers/dataproc/hyperparameters.yaml"))
+	assert.JSONEq(t, `[{"name":"OVERRIDE","value":"inference"},{"name":"SHARED","value":"top"}]`, string(itemData(t, items, "containers/inference/env_vars.json")))
+	assert.JSONEq(t, `[{"name":"SHARED_SECRET","secret_scope":"scope","secret_key":"shared"},{"name":"TOKEN","secret_scope":"research","secret_key":"hf_token"}]`, string(itemData(t, items, "containers/inference/secret_env_vars.json")))
+	assert.JSONEq(t, `[{"name":"OVERRIDE","value":"top"},{"name":"SHARED","value":"top"}]`, string(itemData(t, items, "containers/dataproc/env_vars.json")))
+
+	w := &fakeWriter{}
+	require.NoError(t, uploadArtifacts(t.Context(), w, items))
+	assert.Equal(t, []string{".", "containers/dataproc", "containers/inference"}, w.mkdirPaths)
+	assert.Equal(t, string(hyperparameters), w.written["containers/inference/hyperparameters.yaml"])
+	assert.Equal(t, string(hyperparameters), w.written["containers/dataproc/hyperparameters.yaml"])
+}
+
+func TestBuildArtifacts_SourceOrderedConfigWithNestedOverrides(t *testing.T) {
+	path := writeConfigFile(t, "run.yaml", `
+# This comment is intentionally not retained.
+experiment_name: artifact-test
+command: python train.py
+compute:
+  accelerator_type: GPU_1xH100
+  num_accelerators: 1
+parameters:
+  model:
+    hidden_size: 1024
+  optimizer:
+    name: adamw
+  empty_map: {}
+  empty_list: []
+  empty_value: null
+mlflow_artifact_location: /Volumes/main/default/artifacts
+`)
+	cfg, err := loadRunConfigWithOverrides(t.Context(), path, []string{
+		"compute.num_accelerators=4",
+		"parameters.model.hidden_size=2048",
+		"parameters.optimizer.learning_rate=0.001",
+	})
+	require.NoError(t, err)
+	require.NotNil(t, cfg.MLflowArtifactLocation)
+	assert.Equal(t, "dbfs:/Volumes/main/default/artifacts", *cfg.MLflowArtifactLocation)
+
+	items, err := buildArtifacts(cfg)
+	require.NoError(t, err)
+
+	assert.Equal(t, `experiment_name: artifact-test
+command: python train.py
+compute:
+    accelerator_type: GPU_1xH100
+    num_accelerators: 4
+parameters:
+    model:
+        hidden_size: 2048
+    optimizer:
+        name: adamw
+        learning_rate: 0.001
+    empty_map: {}
+    empty_list: []
+    empty_value: null
+mlflow_artifact_location: /Volumes/main/default/artifacts
+`, string(itemData(t, items, trainingConfigName)))
+}
+
+func TestBuildArtifacts_OversizeConfigRejected(t *testing.T) {
+	_, err := buildArtifacts(&runConfig{
+		artifactYAML: []byte(strings.Repeat("a", maxConfigYAMLBytes+1)),
+	})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "over the 1 MB limit")
+}
+
+func TestUploadArtifacts(t *testing.T) {
+	w := &fakeWriter{}
+	items := []uploadItem{{trainingConfigName, []byte("cfg")}, {commandScriptName, []byte("cmd")}}
+	require.NoError(t, uploadArtifacts(t.Context(), w, items))
+	assert.Equal(t, []string{"."}, w.mkdirPaths)
+	assert.Equal(t, "cfg", w.written[trainingConfigName])
+	assert.Equal(t, "cmd", w.written[commandScriptName])
+	assert.Equal(t, []filer.WriteMode{filer.OverwriteIfExists}, w.modes[trainingConfigName])
+	assert.Equal(t, []filer.WriteMode{filer.OverwriteIfExists}, w.modes[commandScriptName])
+}
+
+// errWriter fails every Write, exercising the upload error path.
+type errWriter struct{}
+
+func (errWriter) Mkdir(ctx context.Context, name string) error { return nil }
+
+func (errWriter) Write(ctx context.Context, name string, reader io.Reader, mode ...filer.WriteMode) error {
+	return errors.New("boom")
+}
+
+func TestUploadArtifacts_WriteError(t *testing.T) {
+	err := uploadArtifacts(t.Context(), errWriter{}, []uploadItem{{trainingConfigName, []byte("x")}})
+	require.ErrorContains(t, err, "failed to upload "+trainingConfigName)
+}
+
+type mkdirErrWriter struct{}
+
+func (mkdirErrWriter) Mkdir(ctx context.Context, name string) error {
+	return errors.New("boom")
+}
+
+func (mkdirErrWriter) Write(ctx context.Context, name string, reader io.Reader, mode ...filer.WriteMode) error {
+	return errors.New("write should not be called")
+}
+
+func TestUploadArtifacts_MkdirError(t *testing.T) {
+	err := uploadArtifacts(t.Context(), mkdirErrWriter{}, []uploadItem{{trainingConfigName, []byte("x")}})
+	require.ErrorContains(t, err, "failed to create launch directory")
+}
+
+// overlappingWriter blocks each write until two writes are in flight. A
+// sequential uploader cannot satisfy the barrier.
+type overlappingWriter struct {
+	mu          sync.Mutex
+	active      int
+	bothStarted chan struct{}
+	release     chan struct{}
+}
+
+func (w *overlappingWriter) Mkdir(ctx context.Context, name string) error { return nil }
+
+func (w *overlappingWriter) Write(ctx context.Context, name string, reader io.Reader, mode ...filer.WriteMode) error {
+	w.mu.Lock()
+	w.active++
+	if w.active == 2 {
+		close(w.bothStarted)
+	}
+	w.mu.Unlock()
+
+	select {
+	case <-w.release:
+		return nil
+	case <-ctx.Done():
+		return ctx.Err()
+	}
+}
+
+func TestUploadArtifacts_WritesConcurrently(t *testing.T) {
+	ctx, cancel := context.WithTimeout(t.Context(), 5*time.Second)
+	defer cancel()
+
+	w := &overlappingWriter{bothStarted: make(chan struct{}), release: make(chan struct{})}
+	done := make(chan error, 1)
+	go func() {
+		done <- uploadArtifacts(ctx, w, []uploadItem{
+			{trainingConfigName, []byte("cfg")},
+			{commandScriptName, []byte("cmd")},
+		})
+	}()
+
+	select {
+	case <-w.bothStarted:
+		close(w.release)
+	case <-ctx.Done():
+		close(w.release)
+		t.Fatal("artifact writes did not overlap")
+	}
+	require.NoError(t, <-done)
+}
diff --git a/cmd/air/snapshot.go b/cmd/air/snapshot.go
new file mode 100644
index 00000000000..fcf439ebb24
--- /dev/null
+++ b/cmd/air/snapshot.go
@@ -0,0 +1,64 @@
+package aircmd
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/databricks/cli/libs/env"
+)
+
+// snapshotResult holds artifact paths and snapshot measurements. Measurements
+// survive staging failures; CodeSourcePath is set only after upload or a cache hit.
+type snapshotResult struct {
+	CodeSourcePath      string
+	GitStatePath        string
+	GitDiffPath         string
+	SizeBytes           *int64
+	UsesGit             *bool
+	PackagingMode       *snapshotMode
+	PackagingDurationMs *int64
+	UploadDurationMs    *int64
+}
+
+// resolveRootPath resolves a code_source snapshot root_path: expand environment
+// variables and ~, strip a leading "project_root/" (meaning "relative to the YAML
+// file"), and resolve the rest against the config's directory. It then confirms the
+// path exists and is a directory.
+func resolveRootPath(ctx context.Context, rawPath, configDir string) (string, error) {
+	expanded := os.ExpandEnv(rawPath)
+	if home, err := env.UserHomeDir(ctx); err == nil {
+		if expanded == "~" {
+			expanded = home
+		} else if rest, ok := strings.CutPrefix(expanded, "~/"); ok {
+			expanded = filepath.Join(home, rest)
+		}
+	}
+
+	var resolved string
+	switch {
+	case strings.HasPrefix(expanded, "project_root/"):
+		resolved = filepath.Join(configDir, strings.TrimPrefix(expanded, "project_root/"))
+	case filepath.IsAbs(expanded):
+		resolved = expanded
+	default:
+		resolved = filepath.Join(configDir, expanded)
+	}
+
+	abs, err := filepath.Abs(resolved)
+	if err != nil {
+		return "", fmt.Errorf("failed to resolve root_path %s: %w", resolved, err)
+	}
+	resolved = abs
+
+	info, err := os.Stat(resolved)
+	if err != nil {
+		return "", fmt.Errorf("root_path does not exist: %s", resolved)
+	}
+	if !info.IsDir() {
+		return "", fmt.Errorf("root_path must be a directory: %s", resolved)
+	}
+	return resolved, nil
+}
diff --git a/cmd/air/snapshot_cachekey.go b/cmd/air/snapshot_cachekey.go
new file mode 100644
index 00000000000..5c2cf3f7b1d
--- /dev/null
+++ b/cmd/air/snapshot_cachekey.go
@@ -0,0 +1,68 @@
+package aircmd
+
+// This file packages a local code directory into a tarball, uploads it to the
+// workspace (or a Volume), and records git provenance sidecars for cache
+// invalidation — the Go port of the Python CLI's code_source snapshot path.
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"path/filepath"
+	"slices"
+	"strings"
+)
+
+// snapshotPackagingVersion is bumped when packaging logic changes in a way that invalidates existing caches
+const snapshotPackagingVersion = "v1"
+
+// plainTarKeyVersion namespaces the plain_tar working-tree key (so it can never collide
+// with a git_archive key) and lets us invalidate it if the fingerprint scheme changes.
+// computePlainTarKey also folds in the shared snapshotPackagingVersion, so a
+// packaging-logic bump invalidates both modes' keys.
+const plainTarKeyVersion = "plaintar-v2"
+
+// computePlainTarKey returns a content-addressed key for a working-tree snapshot: the
+// SHA-256 over every file's path, size, mtime, mode, and symlink target (sorted for
+// stability). An unchanged
+// tree yields the same key, so an already-uploaded tarball can be reused instead of
+// re-packaged and re-uploaded. Regular-file content detection is size+mtime, not
+// content — the same trade-off DABs file-sync makes — so an edit preserving both is
+// not seen.
+func computePlainTarKey(files []snapshotFile) string {
+	sorted := slices.Clone(files)
+	slices.SortFunc(sorted, func(a, b snapshotFile) int {
+		return strings.Compare(a.rel, b.rel)
+	})
+
+	h := sha256.New()
+	for _, f := range sorted {
+		fmt.Fprintf(h, "%s\x00%d\x00%d\x00%d\x00%s\n",
+			filepath.ToSlash(f.rel), f.size, f.modTime, f.mode, f.linkTarget)
+	}
+	fmt.Fprintf(h, "%s\x00%s", plainTarKeyVersion, snapshotPackagingVersion)
+	return hex.EncodeToString(h.Sum(nil))
+}
+
+// computeSnapshotCacheKey returns a stable cache key for a snapshot tarball: the
+// SHA-256 digest of (commitSHA, normalized includePaths, snapshotPackagingVersion,
+// subtreePrefix). Changing any input yields a different entry. An empty subtree
+// prefix keeps repository-root keys byte-identical to prior versions.
+func computeSnapshotCacheKey(commitSHA string, includePaths []string, subtreePrefix string) string {
+	var normalizedPaths string
+	if len(includePaths) > 0 {
+		trimmed := make([]string, len(includePaths))
+		for i, p := range includePaths {
+			trimmed[i] = strings.TrimSpace(p)
+		}
+		slices.Sort(trimmed)
+		normalizedPaths = strings.Join(trimmed, "\n")
+	}
+
+	keyMaterial := commitSHA + "\n" + normalizedPaths + "\n" + snapshotPackagingVersion
+	if subtreePrefix != "" {
+		keyMaterial += "\n" + subtreePrefix
+	}
+	sum := sha256.Sum256([]byte(keyMaterial))
+	return hex.EncodeToString(sum[:])
+}
diff --git a/cmd/air/snapshot_cachekey_test.go b/cmd/air/snapshot_cachekey_test.go
new file mode 100644
index 00000000000..8ed183008f6
--- /dev/null
+++ b/cmd/air/snapshot_cachekey_test.go
@@ -0,0 +1,99 @@
+package aircmd
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type goldenCase struct {
+	Name         string   `json:"name"`
+	CommitSHA    string   `json:"commit_sha"`
+	IncludePaths []string `json:"include_paths"`
+	CacheKey     string   `json:"cache_key"`
+}
+
+// TestComputeSnapshotCacheKeyGolden asserts byte-for-byte parity with golden
+// fixtures across the local-only matrix (commit + include_paths permutations).
+func TestComputeSnapshotCacheKeyGolden(t *testing.T) {
+	data, err := os.ReadFile(filepath.Join("testdata", "cache_keys.json"))
+	require.NoError(t, err)
+
+	var cases []goldenCase
+	require.NoError(t, json.Unmarshal(data, &cases))
+	require.NotEmpty(t, cases)
+
+	for _, tc := range cases {
+		t.Run(tc.Name, func(t *testing.T) {
+			assert.Equal(t, tc.CacheKey, computeSnapshotCacheKey(tc.CommitSHA, tc.IncludePaths, ""))
+		})
+	}
+}
+
+// TestComputeSnapshotCacheKeyProperties pins the normalization behavior the golden cases
+// encode, so a regression is legible without decoding hashes.
+func TestComputeSnapshotCacheKeyProperties(t *testing.T) {
+	sha := "a3492b801c0ffee00000000000000000000dead"
+
+	// Order-independent: sorting means unsorted input yields the sorted key.
+	assert.Equal(t,
+		computeSnapshotCacheKey(sha, []string{"a", "b", "c"}, ""),
+		computeSnapshotCacheKey(sha, []string{"c", "a", "b"}, ""),
+	)
+
+	// nil and empty include_paths are equivalent (both contribute an empty line).
+	assert.Equal(t, computeSnapshotCacheKey(sha, nil, ""), computeSnapshotCacheKey(sha, []string{}, ""))
+
+	// Paths are trimmed before hashing.
+	assert.Equal(t,
+		computeSnapshotCacheKey(sha, []string{"research", "data"}, ""),
+		computeSnapshotCacheKey(sha, []string{"  research  ", "  data "}, ""),
+	)
+
+	// Duplicates are NOT collapsed — they are sorted and kept, matching Python.
+	assert.NotEqual(t, computeSnapshotCacheKey(sha, []string{"x", "y"}, ""), computeSnapshotCacheKey(sha, []string{"x", "x", "y"}, ""))
+
+	// A subtree gets a distinct key while an empty prefix preserves repository-root
+	// keys. Different subtrees at one commit cannot collide, even if their root
+	// directories have the same base name.
+	rootKey := computeSnapshotCacheKey(sha, nil, "")
+	assert.NotEqual(t, rootKey, computeSnapshotCacheKey(sha, nil, "team_a/src"))
+	assert.NotEqual(t,
+		computeSnapshotCacheKey(sha, nil, "team_a/src"),
+		computeSnapshotCacheKey(sha, nil, "team_b/src"),
+	)
+
+	// The version constant participates: a different version is a different key.
+	assert.NotEqual(t, snapshotPackagingVersion, "")
+}
+
+// TestComputePlainTarKeyProperties pins the working-tree fingerprint behavior: it is
+// order-independent and reacts to any change in a file's metadata identity.
+func TestComputePlainTarKeyProperties(t *testing.T) {
+	base := []snapshotFile{
+		{rel: "a.txt", size: 10, modTime: 100},
+		{rel: "src/b.py", size: 20, modTime: 200},
+		{rel: "model", size: 6, modTime: 300, mode: uint32(os.ModeSymlink | 0o777), linkTarget: "v1.bin"},
+	}
+
+	// Order-independent: the files are sorted by path before hashing.
+	assert.Equal(t,
+		computePlainTarKey(base),
+		computePlainTarKey([]snapshotFile{base[2], base[1], base[0]}),
+	)
+
+	// A changed size, mtime, path, mode, or symlink target each yields a different key.
+	assert.NotEqual(t, computePlainTarKey(base), computePlainTarKey([]snapshotFile{{rel: "a.txt", size: 11, modTime: 100}, base[1], base[2]}))
+	assert.NotEqual(t, computePlainTarKey(base), computePlainTarKey([]snapshotFile{{rel: "a.txt", size: 10, modTime: 101}, base[1], base[2]}))
+	assert.NotEqual(t, computePlainTarKey(base), computePlainTarKey([]snapshotFile{{rel: "renamed.txt", size: 10, modTime: 100}, base[1], base[2]}))
+	assert.NotEqual(t, computePlainTarKey(base), computePlainTarKey([]snapshotFile{{rel: "a.txt", size: 10, modTime: 100, mode: 0o755}, base[1], base[2]}))
+	assert.NotEqual(t, computePlainTarKey(base), computePlainTarKey([]snapshotFile{{rel: "a.txt", size: 10, modTime: 100, mode: uint32(os.ModeSymlink | 0o777), linkTarget: "target"}, base[1], base[2]}))
+	assert.NotEqual(t, computePlainTarKey(base), computePlainTarKey([]snapshotFile{base[0], base[1], {rel: "model", size: 6, modTime: 300, mode: uint32(os.ModeSymlink | 0o777), linkTarget: "v2.bin"}}))
+
+	// Adding or dropping a file changes the key.
+	assert.NotEqual(t, computePlainTarKey(base), computePlainTarKey(base[:1]))
+}
diff --git a/cmd/air/snapshot_git.go b/cmd/air/snapshot_git.go
new file mode 100644
index 00000000000..6172ccec9c6
--- /dev/null
+++ b/cmd/air/snapshot_git.go
@@ -0,0 +1,355 @@
+package aircmd
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os/exec"
+	"strings"
+	"time"
+)
+
+// Local, no-network git introspection and the git-state provenance sidecar, ported
+// from the Python CLI's cli/utils/git_state.py. The remote-fetch helpers
+// (fetch_branch_sha, remote detection, partial clone) are deliberately not ported:
+// the snapshot archives the local copy only, so a ref must resolve to a local commit.
+
+// gitRepo runs git subcommands scoped to one repository via `git -C`. Arguments are
+// passed as a slice, never a shell string, so branch/commit values can't inject.
+type gitRepo struct {
+	path string
+}
+
+func newGitRepo(path string) gitRepo {
+	return gitRepo{path: path}
+}
+
+// run executes `git <args...>` and returns stdout; a non-zero exit wraps stderr.
+func (g gitRepo) run(ctx context.Context, args ...string) (string, error) {
+	out, err := g.runBytes(ctx, args...)
+	return string(out), err
+}
+
+// runBytes is run returning raw stdout bytes, for the dirty-diff capture which needs
+// exact bytes and a size measurement.
+func (g gitRepo) runBytes(ctx context.Context, args ...string) ([]byte, error) {
+	full := append([]string{"-C", g.path}, args...)
+	cmd := exec.CommandContext(ctx, "git", full...)
+
+	var stdout, stderr bytes.Buffer
+	cmd.Stdout = &stdout
+	cmd.Stderr = &stderr
+	if err := cmd.Run(); err != nil {
+		msg := strings.TrimSpace(stderr.String())
+		if msg == "" {
+			return nil, fmt.Errorf("git %s: %w", strings.Join(args, " "), err)
+		}
+		return nil, fmt.Errorf("git %s: %w: %s", strings.Join(args, " "), err, msg)
+	}
+	return stdout.Bytes(), nil
+}
+
+// isRepository reports whether the path is inside a git work tree. Using
+// `rev-parse --is-inside-work-tree` (not a .git lookup) means a subdirectory of a
+// repo counts — the common case when root_path is a subfolder of a monorepo.
+func (g gitRepo) isRepository(ctx context.Context) bool {
+	out, err := g.run(ctx, "rev-parse", "--is-inside-work-tree")
+	if err != nil {
+		return false
+	}
+	return strings.TrimSpace(out) == "true"
+}
+
+// repoRelativePrefix returns the path from the repository root to g.path. Git
+// emits a trailing slash for subdirectories and an empty string at the root.
+func (g gitRepo) repoRelativePrefix(ctx context.Context) (string, error) {
+	out, err := g.run(ctx, "rev-parse", "--show-prefix")
+	if err != nil {
+		return "", fmt.Errorf("failed to resolve repository-relative path for %s: %w", g.path, err)
+	}
+	out = strings.TrimSuffix(out, "\n")
+	out = strings.TrimSuffix(out, "\r")
+	return strings.TrimSuffix(out, "/"), nil
+}
+
+// repositoryRoot returns the top-level directory of the work tree containing
+// g.path.
+func (g gitRepo) repositoryRoot(ctx context.Context) (string, error) {
+	out, err := g.run(ctx, "rev-parse", "--show-toplevel")
+	if err != nil {
+		return "", fmt.Errorf("failed to resolve repository root for %s: %w", g.path, err)
+	}
+	return strings.TrimSpace(out), nil
+}
+
+// headSHA returns the current HEAD commit SHA.
+func (g gitRepo) headSHA(ctx context.Context) (string, error) {
+	out, err := g.run(ctx, "rev-parse", "HEAD")
+	if err != nil {
+		return "", err
+	}
+	return strings.TrimSpace(out), nil
+}
+
+// hasUncommittedChanges reports whether there are staged or unstaged changes under
+// the repo subtree. The `-- .` pathspec scopes the check so a subfolder snapshot
+// considers only changes that could land in it.
+func (g gitRepo) hasUncommittedChanges(ctx context.Context) (bool, error) {
+	out, err := g.run(ctx, "status", "--porcelain", "--", ".")
+	if err != nil {
+		return false, err
+	}
+	return strings.TrimSpace(out) != "", nil
+}
+
+// hasUncommittedChangesInPaths reports whether there are uncommitted changes within
+// the include paths (empty includePaths yields false).
+//
+// The pathspecs limit `git status` to those subtrees (it is O(working tree), slow on
+// a large monorepo) and already scope the output to what could land in the snapshot.
+// Unlike the Python source we don't re-parse the entries to filter by name: git
+// reports a rename as `R <new>\x00<old>`, so a name-based re-filter keys off the old
+// path and could miss a rename into an include path. The only caller needs the bool.
+func (g gitRepo) hasUncommittedChangesInPaths(ctx context.Context, includePaths []string) (bool, error) {
+	var pathspecs []string
+	for _, p := range includePaths {
+		if s := strings.TrimRight(p, "/"); s != "" {
+			pathspecs = append(pathspecs, s)
+		}
+	}
+	if len(pathspecs) == 0 {
+		return false, nil
+	}
+
+	args := append([]string{"status", "--porcelain", "--"}, pathspecs...)
+	out, err := g.run(ctx, args...)
+	if err != nil {
+		return false, err
+	}
+	return strings.TrimSpace(out) != "", nil
+}
+
+// resolveLocalBranchSHA resolves a branch to its local-HEAD commit. No remote is
+// contacted; the branch must exist locally.
+func (g gitRepo) resolveLocalBranchSHA(ctx context.Context, branch string) (string, error) {
+	out, err := g.run(ctx, "rev-parse", "refs/heads/"+branch)
+	if err != nil {
+		return "", fmt.Errorf("failed to resolve local branch %q; ensure the branch exists locally and root_path is correct: %w", branch, err)
+	}
+	return strings.TrimSpace(out), nil
+}
+
+// commitExistsLocally reports whether commitSHA is in the local object store, without
+// triggering a promisor/lazy fetch.
+func (g gitRepo) commitExistsLocally(ctx context.Context, commitSHA string) bool {
+	_, err := g.run(ctx, "cat-file", "-e", commitSHA)
+	return err == nil
+}
+
+// currentBranch returns the branch name, or "" for a detached HEAD or on error.
+func (g gitRepo) currentBranch(ctx context.Context) string {
+	out, err := g.run(ctx, "rev-parse", "--abbrev-ref", "HEAD")
+	if err != nil {
+		return ""
+	}
+	branch := strings.TrimSpace(out)
+	if branch == "HEAD" {
+		return ""
+	}
+	return branch
+}
+
+// remoteURL returns the URL of the named remote, or "" if it has none.
+func (g gitRepo) remoteURL(ctx context.Context, remoteName string) string {
+	out, err := g.run(ctx, "remote", "get-url", remoteName)
+	if err != nil {
+		return ""
+	}
+	return strings.TrimSpace(out)
+}
+
+// mergeBaseWithUpstream resolves the merge-base of HEAD and a likely upstream ref,
+// trying <remote>/HEAD, /main, then /master. It reads only local remote-tracking
+// refs (no fetch), returning "" if none resolve.
+func (g gitRepo) mergeBaseWithUpstream(ctx context.Context, remoteName string) string {
+	for _, ref := range []string{remoteName + "/HEAD", remoteName + "/main", remoteName + "/master"} {
+		out, err := g.run(ctx, "merge-base", "HEAD", ref)
+		if err != nil {
+			continue
+		}
+		if base := strings.TrimSpace(out); base != "" {
+			return base
+		}
+	}
+	return ""
+}
+
+// validateSubtreeExists checks that subtreePrefix is a directory at commitSHA.
+func (g gitRepo) validateSubtreeExists(ctx context.Context, commitSHA, subtreePrefix string) error {
+	if subtreePrefix == "" {
+		return nil
+	}
+
+	treeish := commitSHA + ":" + subtreePrefix
+	out, err := g.run(ctx, "cat-file", "-t", treeish)
+	if err != nil {
+		return fmt.Errorf("root_path %q does not exist at commit %s: %w", subtreePrefix, shortSHA(commitSHA), err)
+	}
+	if strings.TrimSpace(out) != "tree" {
+		return fmt.Errorf("root_path %q is not a directory at commit %s", subtreePrefix, shortSHA(commitSHA))
+	}
+	return nil
+}
+
+// validateIncludePathsExist checks that every include path exists at commitSHA.
+// `git ls-tree` (without -d, so both blobs and trees count) reports an entry when the
+// path exists; empty output means missing.
+func (g gitRepo) validateIncludePathsExist(ctx context.Context, commitSHA string, includePaths []string) error {
+	var missing []string
+	for _, p := range includePaths {
+		out, err := g.run(ctx, "ls-tree", commitSHA, p)
+		if err != nil {
+			return err
+		}
+		if strings.TrimSpace(out) == "" {
+			missing = append(missing, p)
+		}
+	}
+	if len(missing) > 0 {
+		return fmt.Errorf("include_paths do not exist at commit %s: %s", shortSHA(commitSHA), strings.Join(missing, ", "))
+	}
+	return nil
+}
+
+// shortSHA abbreviates a commit SHA to 8 chars for log/error messages, tolerating
+// user-supplied abbreviations shorter than that.
+func shortSHA(sha string) string {
+	return sha[:min(len(sha), 8)]
+}
+
+// --- git-state provenance sidecar (git_state.json + git_diff.patch) ---
+//
+// The backend reads git_state.json next to the tarball to tag the MLflow run with
+// base/tip/dirty provenance, and logs git_diff.patch when the tree was dirty.
+// Producing the sidecar is best-effort: callers warn and continue, never fail submit.
+
+// snapshotStateSchemaVersion is the git_state.json schema version. Bump only in
+// coordination with the backend reader.
+const snapshotStateSchemaVersion = 1
+
+// gitStateName and gitDiffName are the git provenance sidecar basenames, uploaded
+// next to the code snapshot for human/agent inspection of what was submitted.
+const (
+	gitStateName = "git_state.json"
+	gitDiffName  = "git_diff.patch"
+)
+
+// defaultRemoteName is the remote consulted for merge-base and repo URL (local refs
+// only — the remote-fetch path is gone).
+const defaultRemoteName = "origin"
+
+// dirtyDiffSizeCapBytes caps the git_diff.patch sidecar; a larger diff records
+// size_exceeded and is skipped to keep the upload small.
+const dirtyDiffSizeCapBytes = 1024 * 1024
+
+// dirtyDiffTimeout bounds `git diff HEAD` so provenance never delays submission.
+const dirtyDiffTimeout = 5 * time.Second
+
+// packaging_mode values: how the uploaded tarball was produced.
+const (
+	packagingModeGitArchive = "git_archive"
+	packagingModePlainTar   = "plain_tar"
+)
+
+// diff_status values recorded in the sidecar.
+const (
+	diffStatusClean        = "clean"
+	diffStatusCaptured     = "captured"
+	diffStatusSizeExceeded = "size_exceeded"
+	diffStatusTimeout      = "timeout"
+)
+
+// gitStateSidecar is the git_state.json record. Field names and the null-for-absent
+// encoding match the Python source, so nullable fields are *string (absent → null).
+type gitStateSidecar struct {
+	SchemaVersion  int     `json:"schema_version"`
+	PackagingMode  string  `json:"packaging_mode"`
+	BaseCommit     *string `json:"base_commit"`
+	TipCommit      *string `json:"tip_commit"`
+	Branch         *string `json:"branch"`
+	RepoURL        *string `json:"repo_url"`
+	Dirty          bool    `json:"dirty"`
+	DiffStatus     string  `json:"diff_status"`
+	DiffPath       *string `json:"diff_path"`
+	GeneratedAtUTC string  `json:"generated_at_utc"`
+}
+
+// nilIfEmpty maps "" to nil so an absent value serializes as JSON null.
+func nilIfEmpty(s string) *string {
+	if s == "" {
+		return nil
+	}
+	return &s
+}
+
+// buildGitStateSidecar gathers git provenance. pinnedTip overrides the HEAD-derived
+// tip for git_archive (the tarball reflects that commit, not HEAD); pass "" for
+// plain_tar. Metadata is best-effort — unavailable fields become null.
+func buildGitStateSidecar(ctx context.Context, git gitRepo, packagingMode, pinnedTip string, dirty bool, now time.Time) (gitStateSidecar, error) {
+	tip := pinnedTip
+	if tip == "" {
+		head, err := git.headSHA(ctx)
+		if err != nil {
+			return gitStateSidecar{}, err
+		}
+		tip = head
+	}
+
+	return gitStateSidecar{
+		SchemaVersion:  snapshotStateSchemaVersion,
+		PackagingMode:  packagingMode,
+		BaseCommit:     nilIfEmpty(git.mergeBaseWithUpstream(ctx, defaultRemoteName)),
+		TipCommit:      nilIfEmpty(tip),
+		Branch:         nilIfEmpty(git.currentBranch(ctx)),
+		RepoURL:        nilIfEmpty(git.remoteURL(ctx, defaultRemoteName)),
+		Dirty:          dirty,
+		DiffStatus:     diffStatusClean,
+		DiffPath:       nil,
+		GeneratedAtUTC: now.UTC().Format("2006-01-02T15:04:05.000000") + "Z",
+	}, nil
+}
+
+// marshal renders the sidecar as indented JSON (matching Python's json.dump indent=2).
+func (s gitStateSidecar) marshal() ([]byte, error) {
+	return json.MarshalIndent(s, "", "  ")
+}
+
+// captureDirtyDiff runs `git diff HEAD` over the repo subtree, returning a diff_status
+// and the diff bytes (non-nil only when captured): clean (no changes or diff failed),
+// captured (under the cap), size_exceeded, or timeout.
+func captureDirtyDiff(ctx context.Context, git gitRepo, includePaths []string, sizeCapBytes int, timeout time.Duration) (string, []byte) {
+	diffCtx, cancel := context.WithTimeout(ctx, timeout)
+	defer cancel()
+
+	pathspecs := includePaths
+	if len(pathspecs) == 0 {
+		pathspecs = []string{"."}
+	}
+	args := append([]string{"diff", "HEAD", "--"}, pathspecs...)
+	out, err := git.runBytes(diffCtx, args...)
+	if err != nil {
+		if errors.Is(diffCtx.Err(), context.DeadlineExceeded) {
+			return diffStatusTimeout, nil
+		}
+		return diffStatusClean, nil
+	}
+	if len(out) == 0 {
+		return diffStatusClean, nil
+	}
+	if len(out) > sizeCapBytes {
+		return diffStatusSizeExceeded, nil
+	}
+	return diffStatusCaptured, out
+}
diff --git a/cmd/air/snapshot_git_test.go b/cmd/air/snapshot_git_test.go
new file mode 100644
index 00000000000..a208b4ef83f
--- /dev/null
+++ b/cmd/air/snapshot_git_test.go
@@ -0,0 +1,363 @@
+package aircmd
+
+import (
+	"encoding/json"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// newTestRepo initializes a git repo in a temp dir with a deterministic identity
+// and returns its path. Tests build up real commits/branches/dirty states on top,
+// mirroring the Python git_state tests (which drive real repos, not a fake).
+func newTestRepo(t *testing.T) string {
+	t.Helper()
+	dir := t.TempDir()
+	runGit(t, dir, "init", "-q", "-b", "main")
+	// Deterministic identity so commits succeed in a bare CI environment.
+	runGit(t, dir, "config", "user.email", "test@example.test")
+	runGit(t, dir, "config", "user.name", "Test")
+	return dir
+}
+
+// runGit runs a git command in dir and fails the test on error.
+func runGit(t *testing.T, dir string, args ...string) {
+	t.Helper()
+	cmd := exec.Command("git", append([]string{"-C", dir}, args...)...)
+	out, err := cmd.CombinedOutput()
+	require.NoError(t, err, "git %v: %s", args, out)
+}
+
+// writeRepoFile writes a file at a repo-relative path, creating parent dirs.
+func writeRepoFile(t *testing.T, repo, rel, content string) {
+	t.Helper()
+	full := filepath.Join(repo, rel)
+	require.NoError(t, os.MkdirAll(filepath.Dir(full), 0o755))
+	require.NoError(t, os.WriteFile(full, []byte(content), 0o600))
+}
+
+// commitAll stages everything and commits, returning the new HEAD SHA.
+func commitAll(t *testing.T, repo, msg string) string {
+	t.Helper()
+	runGit(t, repo, "add", "-A")
+	runGit(t, repo, "commit", "-q", "-m", msg)
+	sha, err := newGitRepo(repo).headSHA(t.Context())
+	require.NoError(t, err)
+	return sha
+}
+
+func TestGitRepo_IsRepository(t *testing.T) {
+	ctx := t.Context()
+
+	repo := newTestRepo(t)
+	assert.True(t, newGitRepo(repo).isRepository(ctx))
+
+	// A subdirectory of a repo is still inside the work tree.
+	writeRepoFile(t, repo, "sub/x.txt", "hi")
+	assert.True(t, newGitRepo(filepath.Join(repo, "sub")).isRepository(ctx))
+
+	// A plain temp dir with no repo is not.
+	assert.False(t, newGitRepo(t.TempDir()).isRepository(ctx))
+}
+
+func TestGitRepo_RepositoryLayout(t *testing.T) {
+	ctx := t.Context()
+	repo := newTestRepo(t)
+	writeRepoFile(t, repo, "a/b/train.py", "print()")
+
+	prefix, err := newGitRepo(repo).repoRelativePrefix(ctx)
+	require.NoError(t, err)
+	assert.Empty(t, prefix)
+
+	subdir := filepath.Join(repo, "a", "b")
+	g := newGitRepo(subdir)
+	prefix, err = g.repoRelativePrefix(ctx)
+	require.NoError(t, err)
+	assert.Equal(t, "a/b", prefix)
+
+	root, err := g.repositoryRoot(ctx)
+	require.NoError(t, err)
+	expected, err := os.Stat(repo)
+	require.NoError(t, err)
+	actual, err := os.Stat(root)
+	require.NoError(t, err)
+	assert.True(t, os.SameFile(expected, actual))
+
+	writeRepoFile(t, repo, " leading-space/train.py", "print()")
+	prefix, err = newGitRepo(filepath.Join(repo, " leading-space")).repoRelativePrefix(ctx)
+	require.NoError(t, err)
+	assert.Equal(t, " leading-space", prefix)
+}
+
+func TestGitRepo_RepoRelativePrefixFailure(t *testing.T) {
+	_, err := newGitRepo(t.TempDir()).repoRelativePrefix(t.Context())
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "failed to resolve repository-relative path")
+}
+
+func TestGitRepo_HeadSHA(t *testing.T) {
+	ctx := t.Context()
+	repo := newTestRepo(t)
+	writeRepoFile(t, repo, "a.txt", "1")
+	sha := commitAll(t, repo, "init")
+
+	got, err := newGitRepo(repo).headSHA(ctx)
+	require.NoError(t, err)
+	assert.Equal(t, sha, got)
+	assert.Len(t, got, 40)
+}
+
+func TestGitRepo_HasUncommittedChanges(t *testing.T) {
+	ctx := t.Context()
+	repo := newTestRepo(t)
+	writeRepoFile(t, repo, "a.txt", "1")
+	commitAll(t, repo, "init")
+
+	// Clean tree.
+	dirty, err := newGitRepo(repo).hasUncommittedChanges(ctx)
+	require.NoError(t, err)
+	assert.False(t, dirty)
+
+	// Unstaged modification.
+	writeRepoFile(t, repo, "a.txt", "2")
+	dirty, err = newGitRepo(repo).hasUncommittedChanges(ctx)
+	require.NoError(t, err)
+	assert.True(t, dirty)
+}
+
+func TestGitRepo_HasUncommittedChangesInPaths(t *testing.T) {
+	ctx := t.Context()
+
+	repo := newTestRepo(t)
+	writeRepoFile(t, repo, "src/model.py", "1")
+	writeRepoFile(t, repo, "other/x.py", "1")
+	commitAll(t, repo, "init")
+	g := newGitRepo(repo)
+
+	// No paths: no changes, and git is never consulted.
+	dirty, err := g.hasUncommittedChangesInPaths(ctx, nil)
+	require.NoError(t, err)
+	assert.False(t, dirty)
+
+	// A change outside the included paths is ignored.
+	writeRepoFile(t, repo, "other/x.py", "2")
+	dirty, err = g.hasUncommittedChangesInPaths(ctx, []string{"src", "configs"})
+	require.NoError(t, err)
+	assert.False(t, dirty)
+
+	// A change inside an included path is reported.
+	writeRepoFile(t, repo, "src/model.py", "2")
+	dirty, err = g.hasUncommittedChangesInPaths(ctx, []string{"src", "configs"})
+	require.NoError(t, err)
+	assert.True(t, dirty)
+
+	// Trailing slashes on include paths are trimmed for the pathspec.
+	dirty, err = g.hasUncommittedChangesInPaths(ctx, []string{"other/"})
+	require.NoError(t, err)
+	assert.True(t, dirty)
+}
+
+func TestGitRepo_HasUncommittedChangesInPaths_Rename(t *testing.T) {
+	ctx := t.Context()
+	repo := newTestRepo(t)
+	writeRepoFile(t, repo, "src/old.py", "content")
+	commitAll(t, repo, "init")
+
+	// A rename within an included path counts as a change, however git classifies
+	// it (rename vs delete+add); we only assert the boolean.
+	runGit(t, repo, "mv", "src/old.py", "src/new.py")
+	dirty, err := newGitRepo(repo).hasUncommittedChangesInPaths(ctx, []string{"src"})
+	require.NoError(t, err)
+	assert.True(t, dirty)
+}
+
+func TestGitRepo_ResolveLocalBranchSHA(t *testing.T) {
+	ctx := t.Context()
+	repo := newTestRepo(t)
+	writeRepoFile(t, repo, "a.txt", "1")
+	mainSHA := commitAll(t, repo, "init")
+
+	// A second branch at its own commit.
+	runGit(t, repo, "checkout", "-q", "-b", "feature")
+	writeRepoFile(t, repo, "b.txt", "2")
+	featSHA := commitAll(t, repo, "feature work")
+	g := newGitRepo(repo)
+
+	got, err := g.resolveLocalBranchSHA(ctx, "main")
+	require.NoError(t, err)
+	assert.Equal(t, mainSHA, got)
+
+	got, err = g.resolveLocalBranchSHA(ctx, "feature")
+	require.NoError(t, err)
+	assert.Equal(t, featSHA, got)
+
+	// A branch that does not exist locally errors (no remote is contacted).
+	_, err = g.resolveLocalBranchSHA(ctx, "nope")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "resolve local branch")
+}
+
+func TestGitRepo_CommitExistsLocally(t *testing.T) {
+	ctx := t.Context()
+	repo := newTestRepo(t)
+	writeRepoFile(t, repo, "a.txt", "1")
+	sha := commitAll(t, repo, "init")
+	g := newGitRepo(repo)
+
+	assert.True(t, g.commitExistsLocally(ctx, sha))
+	assert.False(t, g.commitExistsLocally(ctx, "deadbeefdeadbeefdeadbeefdeadbeefdeadbeef"))
+}
+
+func TestGitRepo_ValidateIncludePathsExist(t *testing.T) {
+	ctx := t.Context()
+	repo := newTestRepo(t)
+	writeRepoFile(t, repo, "src/model.py", "1")
+	writeRepoFile(t, repo, "configs/train.yaml", "x")
+	writeRepoFile(t, repo, "train.py", "print()")
+	sha := commitAll(t, repo, "init")
+	g := newGitRepo(repo)
+
+	// Both directory and file include_paths are accepted (ls-tree without -d).
+	require.NoError(t, g.validateIncludePathsExist(ctx, sha, []string{"src", "configs", "train.py"}))
+
+	err := g.validateIncludePathsExist(ctx, sha, []string{"src", "missing"})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "missing")
+	assert.Contains(t, err.Error(), sha[:8])
+}
+
+func TestGitRepo_ValidateSubtreeExists(t *testing.T) {
+	ctx := t.Context()
+	repo := newTestRepo(t)
+	writeRepoFile(t, repo, "subpkg/train.py", "print()")
+	sha := commitAll(t, repo, "init")
+	g := newGitRepo(filepath.Join(repo, "subpkg"))
+
+	require.NoError(t, g.validateSubtreeExists(ctx, sha, "subpkg"))
+	require.NoError(t, g.validateSubtreeExists(ctx, sha, ""))
+
+	err := g.validateSubtreeExists(ctx, sha, "missing")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), `root_path "missing" does not exist`)
+	assert.Contains(t, err.Error(), sha[:8])
+}
+
+func TestBuildGitStateSidecar_PlainTarClean(t *testing.T) {
+	ctx := t.Context()
+	repo := newTestRepo(t)
+	writeRepoFile(t, repo, "a.txt", "1")
+	head := commitAll(t, repo, "init")
+
+	sc, err := buildGitStateSidecar(ctx, newGitRepo(repo), packagingModePlainTar, "", false, fixedNow)
+	require.NoError(t, err)
+	assert.Equal(t, snapshotStateSchemaVersion, sc.SchemaVersion)
+	assert.Equal(t, packagingModePlainTar, sc.PackagingMode)
+	require.NotNil(t, sc.TipCommit)
+	assert.Equal(t, head, *sc.TipCommit)
+	assert.False(t, sc.Dirty)
+	assert.Equal(t, diffStatusClean, sc.DiffStatus)
+	assert.Nil(t, sc.DiffPath)
+	// No remote in a bare test repo → base_commit and repo_url are null.
+	assert.Nil(t, sc.BaseCommit)
+	assert.Nil(t, sc.RepoURL)
+	require.NotNil(t, sc.Branch)
+	assert.Equal(t, "main", *sc.Branch)
+	assert.Equal(t, "2026-07-10T12:00:00.000000Z", sc.GeneratedAtUTC)
+}
+
+func TestBuildGitStateSidecar_GitArchivePinsTip(t *testing.T) {
+	ctx := t.Context()
+	repo := newTestRepo(t)
+	writeRepoFile(t, repo, "a.txt", "1")
+	first := commitAll(t, repo, "init")
+	// Advance HEAD; the pinned tip must win over HEAD.
+	writeRepoFile(t, repo, "b.txt", "2")
+	commitAll(t, repo, "second")
+
+	sc, err := buildGitStateSidecar(ctx, newGitRepo(repo), packagingModeGitArchive, first, false, fixedNow)
+	require.NoError(t, err)
+	require.NotNil(t, sc.TipCommit)
+	assert.Equal(t, first, *sc.TipCommit)
+	assert.Equal(t, packagingModeGitArchive, sc.PackagingMode)
+}
+
+func TestBuildGitStateSidecar_Dirty(t *testing.T) {
+	ctx := t.Context()
+	repo := newTestRepo(t)
+	writeRepoFile(t, repo, "a.txt", "1")
+	commitAll(t, repo, "init")
+	writeRepoFile(t, repo, "a.txt", "2") // uncommitted
+
+	sc, err := buildGitStateSidecar(ctx, newGitRepo(repo), packagingModePlainTar, "", true, fixedNow)
+	require.NoError(t, err)
+	assert.True(t, sc.Dirty)
+}
+
+func TestGitStateSidecar_MarshalNullsAbsentFields(t *testing.T) {
+	ctx := t.Context()
+	repo := newTestRepo(t)
+	writeRepoFile(t, repo, "a.txt", "1")
+	commitAll(t, repo, "init")
+
+	sc, err := buildGitStateSidecar(ctx, newGitRepo(repo), packagingModePlainTar, "", false, fixedNow)
+	require.NoError(t, err)
+	data, err := sc.marshal()
+	require.NoError(t, err)
+
+	// Absent fields serialize as JSON null (not "" or omitted), matching Python.
+	var raw map[string]any
+	require.NoError(t, json.Unmarshal(data, &raw))
+	require.Contains(t, raw, "base_commit")
+	assert.Nil(t, raw["base_commit"])
+	require.Contains(t, raw, "repo_url")
+	assert.Nil(t, raw["repo_url"])
+	require.Contains(t, raw, "diff_path")
+	assert.Nil(t, raw["diff_path"])
+	assert.EqualValues(t, 1, raw["schema_version"])
+}
+
+func TestCaptureDirtyDiff(t *testing.T) {
+	ctx := t.Context()
+	repo := newTestRepo(t)
+	writeRepoFile(t, repo, "a.txt", "one\n")
+	commitAll(t, repo, "init")
+
+	// Clean tree → no diff.
+	status, diff := captureDirtyDiff(ctx, newGitRepo(repo), nil, dirtyDiffSizeCapBytes, dirtyDiffTimeout)
+	assert.Equal(t, diffStatusClean, status)
+	assert.Nil(t, diff)
+
+	// Dirty tree → captured, and the diff mentions the changed file.
+	writeRepoFile(t, repo, "a.txt", "two\n")
+	status, diff = captureDirtyDiff(ctx, newGitRepo(repo), nil, dirtyDiffSizeCapBytes, dirtyDiffTimeout)
+	assert.Equal(t, diffStatusCaptured, status)
+	assert.Contains(t, string(diff), "a.txt")
+
+	// A tiny size cap forces size_exceeded and drops the bytes.
+	status, diff = captureDirtyDiff(ctx, newGitRepo(repo), nil, 1, dirtyDiffTimeout)
+	assert.Equal(t, diffStatusSizeExceeded, status)
+	assert.Nil(t, diff)
+}
+
+func TestCaptureDirtyDiff_IncludePaths(t *testing.T) {
+	ctx := t.Context()
+	repo := newTestRepo(t)
+	writeRepoFile(t, repo, "included/a.txt", "one\n")
+	writeRepoFile(t, repo, "excluded/b.txt", "one\n")
+	commitAll(t, repo, "init")
+	writeRepoFile(t, repo, "included/a.txt", "two\n")
+	writeRepoFile(t, repo, "excluded/b.txt", "two\n")
+
+	status, diff := captureDirtyDiff(ctx, newGitRepo(repo), []string{"included"}, dirtyDiffSizeCapBytes, dirtyDiffTimeout)
+
+	assert.Equal(t, diffStatusCaptured, status)
+	assert.Contains(t, string(diff), "included/a.txt")
+	assert.NotContains(t, string(diff), "excluded/b.txt")
+}
+
+var fixedNow = time.Date(2026, 7, 10, 12, 0, 0, 0, time.UTC)
diff --git a/cmd/air/snapshot_package.go b/cmd/air/snapshot_package.go
new file mode 100644
index 00000000000..e4027083335
--- /dev/null
+++ b/cmd/air/snapshot_package.go
@@ -0,0 +1,161 @@
+package aircmd
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+
+	"github.com/databricks/cli/libs/tarpack"
+	"github.com/klauspost/pgzip"
+)
+
+// Tar builders ported from cli/utils/snapshot.py. The git-ref path snapshots a commit
+// with `git archive`; the plain path enumerates the working tree with `git ls-files`
+// (honoring .gitignore) and writes the tar in Go. The tarball's top-level dir name is
+// load-bearing — the remote entry_script extracts to /databricks/code_source/<dir> — so
+// both forms prefix every entry with it.
+
+// createGitArchiveSnapshot writes a gzipped tar of commitSHA to outputTarball via
+// `git archive`, with every entry prefixed by directoryName/. When subtreePrefix is
+// set, only that repository subtree is archived and includePaths are relative to it.
+func createGitArchiveSnapshot(ctx context.Context, git gitRepo, commitSHA, outputTarball, directoryName string, includePaths []string, subtreePrefix string) error {
+	treeish := commitSHA
+	archiveGit := git
+	if subtreePrefix != "" {
+		repoRoot, err := git.repositoryRoot(ctx)
+		if err != nil {
+			return err
+		}
+		archiveGit = newGitRepo(repoRoot)
+		treeish = commitSHA + ":" + subtreePrefix
+	}
+
+	args := []string{
+		"archive",
+		"--format=tar.gz",
+		"--prefix=" + directoryName + "/",
+		"-o", outputTarball,
+		treeish,
+	}
+	args = append(args, includePaths...)
+	if _, err := archiveGit.run(ctx, args...); err != nil {
+		return fmt.Errorf("failed to create git archive: %w", err)
+	}
+	return nil
+}
+
+// createPlainTarball writes a gzipped tar of the given working-tree files to
+// outputTarball. The archive preserves repoPath's directory name as the top-level
+// entry. files come pre-resolved from snapshotFiles (.gitignore honored, .git and
+// macOS AppleDouble excluded), so the caller can reuse the same listing to
+// content-address the upload.
+func createPlainTarball(ctx context.Context, repoPath, outputTarball string, files []snapshotFile) error {
+	dirName := filepath.Base(repoPath)
+
+	entries := make([]tarpack.Entry, len(files))
+	for i, file := range files {
+		entries[i] = tarpack.Entry{
+			Name: filepath.ToSlash(filepath.Join(dirName, file.rel)),
+			Path: filepath.Join(repoPath, file.rel),
+		}
+	}
+
+	out, err := os.Create(outputTarball)
+	if err != nil {
+		return fmt.Errorf("failed to create tarball: %w", err)
+	}
+
+	// Gzip in parallel with klauspost/pgzip rather than a single-threaded writer:
+	// compression dominates packaging time on a large tree, and pgzip spreads it
+	// across cores. tarpack writes the tar in Go, so there is no `tar` subprocess
+	// (and no Windows colon-in-path issue a `tar -f` argument would hit).
+	gz, err := pgzip.NewWriterLevel(out, pgzip.DefaultCompression)
+	if err != nil {
+		out.Close()
+		return err
+	}
+	if err := tarpack.Write(gz, entries); err != nil {
+		gz.Close()
+		out.Close()
+		return fmt.Errorf("failed to create plain tarball: %w", err)
+	}
+	if err := gz.Close(); err != nil {
+		out.Close()
+		return fmt.Errorf("failed to finalize gzip: %w", err)
+	}
+	return out.Close()
+}
+
+// snapshotFile is a file selected for the snapshot: its repo-relative path (native
+// separators) plus the metadata used to content-address the plain_tar upload.
+type snapshotFile struct {
+	rel        string
+	size       int64
+	modTime    int64 // Unix nanoseconds
+	mode       uint32
+	linkTarget string
+}
+
+func snapshotFiles(ctx context.Context, repoPath string, includePaths []string, isGitRepo bool) ([]snapshotFile, error) {
+	args := []string{"-C", repoPath, "ls-files", "-z", "--cached", "--others", "--exclude-standard"}
+	if !isGitRepo {
+		gitDir, err := os.MkdirTemp("", "air-snapshot-git-")
+		if err != nil {
+			return nil, fmt.Errorf("failed to create temporary git metadata: %w", err)
+		}
+		defer os.RemoveAll(gitDir)
+		cmd := exec.CommandContext(ctx, "git", "--git-dir", gitDir, "--work-tree", repoPath, "init", "--quiet")
+		if output, err := cmd.CombinedOutput(); err != nil {
+			return nil, fmt.Errorf("failed to initialize temporary git metadata: %w: %s", err, strings.TrimSpace(string(output)))
+		}
+		args = []string{"--git-dir", gitDir, "--work-tree", repoPath, "ls-files", "-z", "--cached", "--others", "--exclude-standard"}
+	}
+
+	if len(includePaths) > 0 {
+		args = append(args, "--")
+		args = append(args, includePaths...)
+	}
+	output, err := exec.CommandContext(ctx, "git", args...).Output()
+	if err != nil {
+		return nil, fmt.Errorf("failed to evaluate git ignore rules: %w", err)
+	}
+
+	var files []snapshotFile
+	for raw := range bytes.SplitSeq(output, []byte{0}) {
+		if len(raw) == 0 {
+			continue
+		}
+		name := filepath.ToSlash(string(raw))
+		base := filepath.Base(name)
+		if name == ".git" || strings.HasPrefix(name, ".git/") || strings.HasPrefix(base, "._") {
+			continue
+		}
+		info, err := os.Lstat(filepath.Join(repoPath, filepath.FromSlash(name)))
+		if errors.Is(err, os.ErrNotExist) {
+			continue
+		}
+		if err != nil {
+			return nil, fmt.Errorf("failed to inspect snapshot path %q: %w", name, err)
+		}
+		linkTarget := ""
+		if info.Mode()&os.ModeSymlink != 0 {
+			linkTarget, err = os.Readlink(filepath.Join(repoPath, filepath.FromSlash(name)))
+			if err != nil {
+				return nil, fmt.Errorf("failed to inspect snapshot symlink %q: %w", name, err)
+			}
+		}
+		files = append(files, snapshotFile{
+			rel:        filepath.FromSlash(name),
+			size:       info.Size(),
+			modTime:    info.ModTime().UnixNano(),
+			mode:       uint32(info.Mode()),
+			linkTarget: linkTarget,
+		})
+	}
+	return files, nil
+}
diff --git a/cmd/air/snapshot_package_test.go b/cmd/air/snapshot_package_test.go
new file mode 100644
index 00000000000..24249021a4f
--- /dev/null
+++ b/cmd/air/snapshot_package_test.go
@@ -0,0 +1,251 @@
+package aircmd
+
+import (
+	"archive/tar"
+	"compress/gzip"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// tarballEntries returns the sorted list of entry names in a .tar.gz.
+func tarballEntries(t *testing.T, path string) []string {
+	t.Helper()
+	f, err := os.Open(path)
+	require.NoError(t, err)
+	defer f.Close()
+
+	gz, err := gzip.NewReader(f)
+	require.NoError(t, err)
+	defer gz.Close()
+
+	var names []string
+	tr := tar.NewReader(gz)
+	for {
+		hdr, err := tr.Next()
+		if err != nil {
+			break
+		}
+		names = append(names, hdr.Name)
+	}
+	slices.Sort(names)
+	return names
+}
+
+func TestCreateGitArchiveSnapshot(t *testing.T) {
+	ctx := t.Context()
+	repo := newTestRepo(t)
+	writeRepoFile(t, repo, "a.txt", "1")
+	writeRepoFile(t, repo, "src/model.py", "print()")
+	sha := commitAll(t, repo, "init")
+
+	out := filepath.Join(t.TempDir(), "snap.tar.gz")
+	dirName := filepath.Base(repo)
+	require.NoError(t, createGitArchiveSnapshot(ctx, newGitRepo(repo), sha, out, dirName, nil, ""))
+
+	entries := tarballEntries(t, out)
+	// Every real entry is prefixed with the directory name. git archive also emits a
+	// `pax_global_header` pseudo-entry (no prefix) that tar ignores on extraction.
+	assert.Contains(t, entries, dirName+"/a.txt")
+	assert.Contains(t, entries, dirName+"/src/model.py")
+	for _, e := range entries {
+		if e == "pax_global_header" {
+			continue
+		}
+		assert.True(t, strings.HasPrefix(e, dirName+"/"), "entry %q lacks prefix", e)
+	}
+}
+
+func TestCreateGitArchiveSnapshot_IncludePaths(t *testing.T) {
+	ctx := t.Context()
+	repo := newTestRepo(t)
+	writeRepoFile(t, repo, "a.txt", "1")
+	writeRepoFile(t, repo, "src/model.py", "print()")
+	sha := commitAll(t, repo, "init")
+
+	out := filepath.Join(t.TempDir(), "snap.tar.gz")
+	dirName := filepath.Base(repo)
+	require.NoError(t, createGitArchiveSnapshot(ctx, newGitRepo(repo), sha, out, dirName, []string{"src"}, ""))
+
+	entries := tarballEntries(t, out)
+	assert.Contains(t, entries, dirName+"/src/model.py")
+	assert.NotContains(t, entries, dirName+"/a.txt")
+}
+
+func TestCreateGitArchiveSnapshot_SubdirectoryRootPath(t *testing.T) {
+	ctx := t.Context()
+	repo := newTestRepo(t)
+	writeRepoFile(t, repo, "README.md", "repo root")
+	writeRepoFile(t, repo, "subpkg/train.py", "print()")
+	writeRepoFile(t, repo, "subpkg/nested/util.py", "pass")
+	sha := commitAll(t, repo, "init")
+
+	rootPath := filepath.Join(repo, "subpkg")
+	prefix, err := newGitRepo(rootPath).repoRelativePrefix(ctx)
+	require.NoError(t, err)
+
+	out := filepath.Join(t.TempDir(), "snap.tar.gz")
+	require.NoError(t, createGitArchiveSnapshot(ctx, newGitRepo(rootPath), sha, out, "subpkg", nil, prefix))
+
+	entries := tarballEntries(t, out)
+	assert.Contains(t, entries, "subpkg/train.py")
+	assert.Contains(t, entries, "subpkg/nested/util.py")
+	assert.NotContains(t, entries, "subpkg/README.md")
+	for _, entry := range entries {
+		assert.False(t, strings.HasPrefix(entry, "subpkg/subpkg/"), "entry %q is double nested", entry)
+	}
+}
+
+func TestCreateGitArchiveSnapshot_SubdirectoryRootPathWithIncludePaths(t *testing.T) {
+	ctx := t.Context()
+	repo := newTestRepo(t)
+	writeRepoFile(t, repo, "subpkg/train.py", "print()")
+	writeRepoFile(t, repo, "subpkg/src/model.py", "pass")
+	writeRepoFile(t, repo, "subpkg/configs/train.yaml", "x")
+	sha := commitAll(t, repo, "init")
+
+	rootPath := filepath.Join(repo, "subpkg")
+	prefix, err := newGitRepo(rootPath).repoRelativePrefix(ctx)
+	require.NoError(t, err)
+
+	out := filepath.Join(t.TempDir(), "snap.tar.gz")
+	require.NoError(t, createGitArchiveSnapshot(ctx, newGitRepo(rootPath), sha, out, "subpkg", []string{"src"}, prefix))
+
+	entries := tarballEntries(t, out)
+	assert.Contains(t, entries, "subpkg/src/model.py")
+	assert.NotContains(t, entries, "subpkg/train.py")
+	assert.NotContains(t, entries, "subpkg/configs/train.yaml")
+}
+
+func TestCreatePlainTarball(t *testing.T) {
+	ctx := t.Context()
+	repo := t.TempDir()
+	writeRepoFile(t, repo, "a.txt", "1")
+	writeRepoFile(t, repo, "src/model.py", "print()")
+	writeRepoFile(t, repo, "dirty.txt", "wip")
+	// A .git dir must never be shipped.
+	writeRepoFile(t, repo, ".git/config", "x")
+
+	out := filepath.Join(t.TempDir(), "snap.tar.gz")
+	files, err := snapshotFiles(ctx, repo, nil, false)
+	require.NoError(t, err)
+	require.NoError(t, createPlainTarball(ctx, repo, out, files))
+
+	dirName := filepath.Base(repo)
+	entries := tarballEntries(t, out)
+	assert.Contains(t, entries, dirName+"/a.txt")
+	assert.Contains(t, entries, dirName+"/dirty.txt")
+	// .git is never shipped.
+	for _, e := range entries {
+		assert.NotContains(t, e, "/.git/")
+	}
+}
+
+func TestCreatePlainTarball_HonorsGitignore(t *testing.T) {
+	ctx := t.Context()
+	repo := t.TempDir()
+	writeRepoFile(t, repo, "keep.txt", "1")
+	writeRepoFile(t, repo, "junk.log", "noise")
+	writeRepoFile(t, repo, ".gitignore", "*.log\n")
+
+	out := filepath.Join(t.TempDir(), "snap.tar.gz")
+	files, err := snapshotFiles(ctx, repo, nil, false)
+	require.NoError(t, err)
+	require.NoError(t, createPlainTarball(ctx, repo, out, files))
+
+	dirName := filepath.Base(repo)
+	entries := tarballEntries(t, out)
+	assert.Contains(t, entries, dirName+"/keep.txt")
+	assert.NotContains(t, entries, dirName+"/junk.log")
+}
+
+func TestCreatePlainTarball_IncludePaths(t *testing.T) {
+	ctx := t.Context()
+	repo := t.TempDir()
+	writeRepoFile(t, repo, "a.txt", "1")
+	writeRepoFile(t, repo, "src/model.py", "print()")
+
+	out := filepath.Join(t.TempDir(), "snap.tar.gz")
+	files, err := snapshotFiles(ctx, repo, []string{"src"}, false)
+	require.NoError(t, err)
+	require.NoError(t, createPlainTarball(ctx, repo, out, files))
+
+	dirName := filepath.Base(repo)
+	entries := tarballEntries(t, out)
+	assert.Contains(t, entries, dirName+"/src/model.py")
+	assert.NotContains(t, entries, dirName+"/a.txt")
+}
+
+func TestCreatePlainTarball_HonorsNestedGitignoreAndNegation(t *testing.T) {
+	repo := t.TempDir()
+	writeRepoFile(t, repo, ".gitignore", "*.log\n!keep.log\n/root-only.txt\n")
+	writeRepoFile(t, repo, "drop.log", "drop")
+	writeRepoFile(t, repo, "keep.log", "keep")
+	writeRepoFile(t, repo, "root-only.txt", "drop")
+	writeRepoFile(t, repo, "nested/root-only.txt", "keep")
+	writeRepoFile(t, repo, "nested/.gitignore", "*.tmp\n!keep.tmp\n")
+	writeRepoFile(t, repo, "nested/drop.tmp", "drop")
+	writeRepoFile(t, repo, "nested/keep.tmp", "keep")
+
+	out := filepath.Join(t.TempDir(), "snap.tar.gz")
+	files, err := snapshotFiles(t.Context(), repo, nil, false)
+	require.NoError(t, err)
+	require.NoError(t, createPlainTarball(t.Context(), repo, out, files))
+
+	dirName := filepath.Base(repo)
+	entries := tarballEntries(t, out)
+	assert.NotContains(t, entries, dirName+"/drop.log")
+	assert.Contains(t, entries, dirName+"/keep.log")
+	assert.NotContains(t, entries, dirName+"/root-only.txt")
+	assert.Contains(t, entries, dirName+"/nested/root-only.txt")
+	assert.NotContains(t, entries, dirName+"/nested/drop.tmp")
+	assert.Contains(t, entries, dirName+"/nested/keep.tmp")
+}
+
+func TestCreatePlainTarball_SkipsDeletedTrackedFiles(t *testing.T) {
+	repo := newTestRepo(t)
+	writeRepoFile(t, repo, "keep.txt", "keep")
+	writeRepoFile(t, repo, "deleted.txt", "deleted")
+	commitAll(t, repo, "init")
+	require.NoError(t, os.Remove(filepath.Join(repo, "deleted.txt")))
+
+	out := filepath.Join(t.TempDir(), "snap.tar.gz")
+	files, err := snapshotFiles(t.Context(), repo, nil, true)
+	require.NoError(t, err)
+	require.NoError(t, createPlainTarball(t.Context(), repo, out, files))
+
+	dirName := filepath.Base(repo)
+	entries := tarballEntries(t, out)
+	assert.Contains(t, entries, dirName+"/keep.txt")
+	assert.NotContains(t, entries, dirName+"/deleted.txt")
+}
+
+func TestSnapshotFilesCapturesModeTypeAndSymlinkTarget(t *testing.T) {
+	repo := t.TempDir()
+	writeRepoFile(t, repo, "run.sh", "#!/bin/sh\n")
+	require.NoError(t, os.Chmod(filepath.Join(repo, "run.sh"), 0o755))
+	require.NoError(t, os.Symlink("run.sh", filepath.Join(repo, "current")))
+
+	files, err := snapshotFiles(t.Context(), repo, nil, false)
+	require.NoError(t, err)
+	byName := make(map[string]snapshotFile, len(files))
+	for _, file := range files {
+		byName[filepath.ToSlash(file.rel)] = file
+	}
+
+	runInfo, err := os.Lstat(filepath.Join(repo, "run.sh"))
+	require.NoError(t, err)
+	assert.Equal(t, uint32(runInfo.Mode()), byName["run.sh"].mode)
+	assert.Empty(t, byName["run.sh"].linkTarget)
+
+	linkInfo, err := os.Lstat(filepath.Join(repo, "current"))
+	require.NoError(t, err)
+	assert.Equal(t, uint32(linkInfo.Mode()), byName["current"].mode)
+	assert.NotZero(t, os.FileMode(byName["current"].mode)&os.ModeSymlink)
+	assert.Equal(t, "run.sh", byName["current"].linkTarget)
+}
diff --git a/cmd/air/snapshot_resolve.go b/cmd/air/snapshot_resolve.go
new file mode 100644
index 00000000000..cec431796a6
--- /dev/null
+++ b/cmd/air/snapshot_resolve.go
@@ -0,0 +1,138 @@
+package aircmd
+
+import (
+	"context"
+	"errors"
+	"fmt"
+)
+
+// This file ports the mode/ref resolution from the Python CLI's cli_entrypoint
+// snapshot block (the if/elif at lines ~1541–1722), local-only. The remote-fetch
+// branches are dropped: a git ref must resolve to a commit already present
+// locally (git.remote is rejected at validation — see gitRef.validate).
+
+// snapshotMode is how the snapshot tarball is produced.
+type snapshotMode int
+
+const (
+	// modeGitArchive packages a pinned commit via `git archive`. The commit is
+	// deterministic, so the tarball is cacheable by (commit, include_paths,
+	// root_path subtree).
+	modeGitArchive snapshotMode = iota
+	// modePlainTar packages the working tree (including uncommitted changes) via
+	// `tar`. Content-addressed by the working-tree metadata fingerprint, so an unchanged
+	// tree reuses the uploaded tarball; a same-size, same-mtime regular-file edit is missed.
+	modePlainTar
+)
+
+// snapshotPlan is the outcome of resolving how to package a snapshot: the mode,
+// the commit SHA to archive (git_archive only; empty for plain_tar), and whether
+// the working tree under the snapshot root has uncommitted changes when the dirty
+// state is needed for branch safety or provenance.
+type snapshotPlan struct {
+	mode          snapshotMode
+	commitSHA     string
+	hasUncommit   bool
+	isGitRepo     bool
+	includePaths  []string
+	subtreePrefix string
+}
+
+// resolveSnapshotPlan decides how to package the snapshot (local-only):
+//   - git.commit  → pin the SHA (must exist locally) → git_archive.
+//   - git.branch  → the branch's local HEAD SHA → git_archive.
+//   - no ref / non-git dir → the working tree → plain_tar (no caching).
+//
+// The dirty check runs only when git.branch needs to guard against omitted local
+// changes, or when provenance sidecars need to record the state. It runs at most
+// once (git status is O(working tree)) and is threaded into the plan. Dirty +
+// git.branch is an error: the committed HEAD wouldn't include the uncommitted changes.
+func resolveSnapshotPlan(ctx context.Context, git gitRepo, ref *gitRef, includePaths []string) (snapshotPlan, error) {
+	plan := snapshotPlan{includePaths: includePaths}
+	plan.isGitRepo = git.isRepository(ctx)
+
+	// Plain-tar snapshots include working-tree changes, and commit-pinned snapshots
+	// intentionally exclude them, so neither needs a git status unless provenance
+	// sidecars are enabled. Branch snapshots always need it to avoid silently omitting
+	// local changes. When include_paths is set, only changes
+	// under those paths can land in the snapshot, so scope the check to them —
+	// both more correct and cheaper than scanning the whole repo.
+	needsDirtyState := uploadProvenanceSidecars || (ref != nil && ref.Branch != nil)
+	if plan.isGitRepo && needsDirtyState {
+		var err error
+		if len(includePaths) > 0 {
+			plan.hasUncommit, err = git.hasUncommittedChangesInPaths(ctx, includePaths)
+		} else {
+			plan.hasUncommit, err = git.hasUncommittedChanges(ctx)
+		}
+		if err != nil {
+			return snapshotPlan{}, err
+		}
+	}
+
+	// Non-git directory: plain tar, no ref allowed. gitRef.validate already rejects
+	// git.* on a non-git dir at load time, but guard here too since this function
+	// is the single decision point.
+	if !plan.isGitRepo {
+		if ref != nil {
+			return snapshotPlan{}, fmt.Errorf("git.* is set but %s is not a git repository", git.path)
+		}
+		plan.mode = modePlainTar
+		return plan, nil
+	}
+
+	// git repo, no ref: package the working tree as plain tar (uncommitted changes
+	// included). Provenance is captured separately via the git_state sidecar.
+	if ref == nil {
+		plan.mode = modePlainTar
+		return plan, nil
+	}
+
+	switch {
+	case ref.Commit != nil:
+		// git.commit pins a committed SHA; local uncommitted changes are irrelevant
+		// and won't be included. The commit must exist locally — no remote fetch.
+		commit := *ref.Commit
+		if !git.commitExistsLocally(ctx, commit) {
+			return snapshotPlan{}, fmt.Errorf("commit %q does not exist locally; fetch it (e.g. `git fetch`) before submitting — the snapshot archives your local copy and does not fetch from a remote", commit)
+		}
+		plan.mode = modeGitArchive
+		plan.commitSHA = commit
+
+	case ref.Branch != nil:
+		// git.branch deploys the branch's local HEAD. A dirty tree here is an error:
+		// the committed HEAD wouldn't include the uncommitted changes.
+		if plan.hasUncommit {
+			return snapshotPlan{}, fmt.Errorf("uncommitted changes under %s would not be included: git.branch deploys the committed HEAD of %q. Commit your changes, or use git.commit to pin a specific revision", git.path, *ref.Branch)
+		}
+		sha, err := git.resolveLocalBranchSHA(ctx, *ref.Branch)
+		if err != nil {
+			return snapshotPlan{}, err
+		}
+		plan.mode = modeGitArchive
+		plan.commitSHA = sha
+
+	default:
+		// gitRef.validate guarantees exactly one of branch/commit is set.
+		return snapshotPlan{}, errors.New("git: must specify either 'branch' or 'commit'")
+	}
+
+	subtreePrefix, err := git.repoRelativePrefix(ctx)
+	if err != nil {
+		return snapshotPlan{}, err
+	}
+	plan.subtreePrefix = subtreePrefix
+	if err := git.validateSubtreeExists(ctx, plan.commitSHA, subtreePrefix); err != nil {
+		return snapshotPlan{}, err
+	}
+
+	// For git_archive with include_paths, verify each path exists at the resolved
+	// commit so a typo fails fast rather than producing an empty subtree.
+	if len(includePaths) > 0 {
+		if err := git.validateIncludePathsExist(ctx, plan.commitSHA, includePaths); err != nil {
+			return snapshotPlan{}, err
+		}
+	}
+
+	return plan, nil
+}
diff --git a/cmd/air/snapshot_resolve_test.go b/cmd/air/snapshot_resolve_test.go
new file mode 100644
index 00000000000..e903a2232de
--- /dev/null
+++ b/cmd/air/snapshot_resolve_test.go
@@ -0,0 +1,143 @@
+package aircmd
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestResolveSnapshotPlan_Commit(t *testing.T) {
+	ctx := t.Context()
+	repo := newTestRepo(t)
+	writeRepoFile(t, repo, "a.txt", "1")
+	sha := commitAll(t, repo, "init")
+
+	plan, err := resolveSnapshotPlan(ctx, newGitRepo(repo), &gitRef{Commit: new(sha)}, nil)
+	require.NoError(t, err)
+	assert.Equal(t, modeGitArchive, plan.mode)
+	assert.Equal(t, sha, plan.commitSHA)
+	assert.True(t, plan.isGitRepo)
+
+	// A commit pin is valid even with a dirty tree: local changes are irrelevant, so
+	// resolving the plan does not inspect them while provenance sidecars are disabled.
+	writeRepoFile(t, repo, "a.txt", "2")
+	plan, err = resolveSnapshotPlan(ctx, newGitRepo(repo), &gitRef{Commit: new(sha)}, nil)
+	require.NoError(t, err)
+	assert.Equal(t, modeGitArchive, plan.mode)
+	assert.False(t, plan.hasUncommit)
+}
+
+func TestResolveSnapshotPlan_CommitNotLocal(t *testing.T) {
+	ctx := t.Context()
+	repo := newTestRepo(t)
+	writeRepoFile(t, repo, "a.txt", "1")
+	commitAll(t, repo, "init")
+
+	absent := "deadbeefdeadbeefdeadbeefdeadbeefdeadbeef"
+	_, err := resolveSnapshotPlan(ctx, newGitRepo(repo), &gitRef{Commit: new(absent)}, nil)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "does not exist locally")
+}
+
+func TestResolveSnapshotPlan_BranchLocalHead(t *testing.T) {
+	ctx := t.Context()
+	repo := newTestRepo(t)
+	writeRepoFile(t, repo, "a.txt", "1")
+	mainSHA := commitAll(t, repo, "init")
+
+	plan, err := resolveSnapshotPlan(ctx, newGitRepo(repo), &gitRef{Branch: new("main")}, nil)
+	require.NoError(t, err)
+	assert.Equal(t, modeGitArchive, plan.mode)
+	assert.Equal(t, mainSHA, plan.commitSHA)
+}
+
+func TestResolveSnapshotPlan_BranchDirtyIsError(t *testing.T) {
+	ctx := t.Context()
+	repo := newTestRepo(t)
+	writeRepoFile(t, repo, "a.txt", "1")
+	commitAll(t, repo, "init")
+	writeRepoFile(t, repo, "a.txt", "2") // uncommitted
+
+	_, err := resolveSnapshotPlan(ctx, newGitRepo(repo), &gitRef{Branch: new("main")}, nil)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "uncommitted changes")
+	assert.Contains(t, err.Error(), "git.commit")
+}
+
+func TestResolveSnapshotPlan_NoRefPlainTar(t *testing.T) {
+	ctx := t.Context()
+	repo := newTestRepo(t)
+	writeRepoFile(t, repo, "a.txt", "1")
+	commitAll(t, repo, "init")
+	writeRepoFile(t, repo, "a.txt", "2") // dirty tree is fine for plain tar
+
+	plan, err := resolveSnapshotPlan(ctx, newGitRepo(repo), nil, nil)
+	require.NoError(t, err)
+	assert.Equal(t, modePlainTar, plan.mode)
+	assert.Empty(t, plan.commitSHA)
+	assert.True(t, plan.isGitRepo)
+	assert.False(t, plan.hasUncommit)
+}
+
+func TestResolveSnapshotPlan_NonGitDir(t *testing.T) {
+	ctx := t.Context()
+	dir := t.TempDir()
+
+	plan, err := resolveSnapshotPlan(ctx, newGitRepo(dir), nil, nil)
+	require.NoError(t, err)
+	assert.Equal(t, modePlainTar, plan.mode)
+	assert.False(t, plan.isGitRepo)
+
+	// A git ref on a non-git directory is an error.
+	_, err = resolveSnapshotPlan(ctx, newGitRepo(dir), &gitRef{Branch: new("main")}, nil)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "not a git repository")
+}
+
+func TestResolveSnapshotPlan_IncludePaths(t *testing.T) {
+	ctx := t.Context()
+	repo := newTestRepo(t)
+	writeRepoFile(t, repo, "src/model.py", "1")
+	writeRepoFile(t, repo, "configs/train.yaml", "x")
+	sha := commitAll(t, repo, "init")
+
+	// All include paths exist at the commit.
+	plan, err := resolveSnapshotPlan(ctx, newGitRepo(repo), &gitRef{Commit: new(sha)}, []string{"src", "configs"})
+	require.NoError(t, err)
+	assert.Equal(t, modeGitArchive, plan.mode)
+	assert.Equal(t, []string{"src", "configs"}, plan.includePaths)
+
+	// A missing include path fails fast.
+	_, err = resolveSnapshotPlan(ctx, newGitRepo(repo), &gitRef{Commit: new(sha)}, []string{"src", "missing"})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "missing")
+}
+
+func TestResolveSnapshotPlan_SubdirectoryRootPath(t *testing.T) {
+	ctx := t.Context()
+	repo := newTestRepo(t)
+	writeRepoFile(t, repo, "subpkg/src/model.py", "1")
+	sha := commitAll(t, repo, "init")
+
+	rootPath := filepath.Join(repo, "subpkg")
+	plan, err := resolveSnapshotPlan(ctx, newGitRepo(rootPath), &gitRef{Commit: new(sha)}, []string{"src"})
+	require.NoError(t, err)
+	assert.Equal(t, modeGitArchive, plan.mode)
+	assert.Equal(t, "subpkg", plan.subtreePrefix)
+}
+
+func TestResolveSnapshotPlan_SubdirectoryMissingAtCommit(t *testing.T) {
+	ctx := t.Context()
+	repo := newTestRepo(t)
+	writeRepoFile(t, repo, "README.md", "root")
+	sha := commitAll(t, repo, "before subpkg")
+	writeRepoFile(t, repo, "subpkg/train.py", "print()")
+
+	rootPath := filepath.Join(repo, "subpkg")
+	_, err := resolveSnapshotPlan(ctx, newGitRepo(rootPath), &gitRef{Commit: new(sha)}, nil)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), `root_path "subpkg" does not exist`)
+	assert.Contains(t, err.Error(), sha[:8])
+}
diff --git a/cmd/air/snapshot_upload.go b/cmd/air/snapshot_upload.go
new file mode 100644
index 00000000000..1d4e9a533b8
--- /dev/null
+++ b/cmd/air/snapshot_upload.go
@@ -0,0 +1,257 @@
+package aircmd
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/filer"
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/databricks-sdk-go"
+)
+
+// uploadProvenanceSidecars controls collection and upload of git_state.json
+// and git_diff.patch during submission. Keep the implementation available, but
+// turn it off for now because the additional local queries and WSFS writes add
+// latency to AIR submissions.
+const uploadProvenanceSidecars = false
+
+// uploadSnapshot packages the code_source into a tarball and uploads it to the
+// artifact store's .internal directory, returning the remote path to attach to the
+// ai_runtime_task. Uploading reuses libs/filer for the workspace/volume write without
+// depending on the bundle package (see uploadSnapshotTarball / snapshotUploadFiler).
+func uploadSnapshot(ctx context.Context, w *databricks.WorkspaceClient, snap *snapshotSourceConfig, configPath, snapshotArtifactPath string, sidecarStore filer.Filer, sidecarBase string) (snapshotResult, error) {
+	repoPath, err := resolveRootPath(ctx, snap.RootPath, filepath.Dir(configPath))
+	if err != nil {
+		return snapshotResult{}, err
+	}
+
+	// Resolve how to package before touching the tarball: git_archive (pinned commit) vs
+	// plain_tar (working tree). Both are content-addressed, so an unchanged input reuses
+	// the already-uploaded tarball instead of re-packaging and re-uploading.
+	plan, err := resolveSnapshotPlan(ctx, newGitRepo(repoPath), snap.Git, snap.IncludePaths)
+	if err != nil {
+		return snapshotResult{}, err
+	}
+
+	// remote_volume, when set, is a UC Volume path; snapshotUploadFiler routes
+	// /Volumes destinations to a Files API filer.
+	if snap.RemoteVolume != nil {
+		snapshotArtifactPath = *snap.RemoteVolume
+	}
+	result, err := uploadSnapshotTarball(ctx, w, repoPath, plan, snapshotArtifactPath)
+	if err != nil {
+		return result, err
+	}
+
+	// Upload git provenance sidecars (git_state.json / git_diff.patch) next to the
+	// run's launch dir so the submitted commit + working-tree diff are inspectable.
+	// Best-effort and git-only: any failure logs and leaves the paths empty rather
+	// than failing an otherwise-valid submission.
+	//
+	// The sidecars are deliberately NOT bundled into the code tarball. The git_archive
+	// tarball is content-addressed and cached by (commit, include_paths, root_path
+	// subtree), so a second identical snapshot reuses it; but the sidecars vary per
+	// run (git_state's timestamp, and git_diff captures the working tree at submit
+	// time). Folding them in would force a distinct tarball per run (defeating the
+	// cache) or serve a prior run's stale provenance on a cache hit. They also live in
+	// the per-run launch dir,
+	// not the shared artifact dir, so they don't accumulate. Keep them out of the tar.
+	if uploadProvenanceSidecars && plan.isGitRepo {
+		result.GitStatePath, result.GitDiffPath = uploadSnapshotSidecars(ctx, sidecarStore, sidecarBase, newGitRepo(repoPath), plan)
+	}
+	return result, nil
+}
+
+// uploadSnapshotSidecars writes the git_state.json provenance record — and, when the
+// working tree is dirty, a captured git_diff.patch — into the run's launch dir via
+// sidecarStore (rooted at sidecarBase, used only to report absolute paths). It is
+// best-effort: every failure logs a warning and yields an empty path, never an error,
+// so provenance capture cannot fail a submission.
+func uploadSnapshotSidecars(ctx context.Context, sidecarStore filer.Filer, sidecarBase string, git gitRepo, plan snapshotPlan) (statePath, diffPath string) {
+	mode := packagingModePlainTar
+	pinnedTip := ""
+	if plan.mode == modeGitArchive {
+		mode = packagingModeGitArchive
+		pinnedTip = plan.commitSHA
+	}
+
+	sidecar, err := buildGitStateSidecar(ctx, git, mode, pinnedTip, plan.hasUncommit, time.Now())
+	if err != nil {
+		log.Warnf(ctx, "skipping git provenance sidecar: %v", err)
+		return "", ""
+	}
+
+	// Capture the dirty diff first so its status/path land in git_state.json.
+	if sidecar.Dirty {
+		status, diff := captureDirtyDiff(ctx, git, plan.includePaths, dirtyDiffSizeCapBytes, dirtyDiffTimeout)
+		sidecar.DiffStatus = status
+		if status == diffStatusCaptured {
+			if err := sidecarStore.Write(ctx, gitDiffName, bytes.NewReader(diff), filer.OverwriteIfExists, filer.CreateParentDirectories); err != nil {
+				log.Warnf(ctx, "failed to upload git diff sidecar: %v", err)
+				sidecar.DiffStatus = diffStatusClean
+			} else {
+				diffPath = path.Join(sidecarBase, gitDiffName)
+				sidecar.DiffPath = &diffPath
+			}
+		}
+	}
+
+	data, err := sidecar.marshal()
+	if err != nil {
+		log.Warnf(ctx, "failed to encode git state sidecar: %v", err)
+		return "", diffPath
+	}
+	if err := sidecarStore.Write(ctx, gitStateName, bytes.NewReader(data), filer.OverwriteIfExists, filer.CreateParentDirectories); err != nil {
+		log.Warnf(ctx, "failed to upload git state sidecar: %v", err)
+		return "", diffPath
+	}
+	return path.Join(sidecarBase, gitStateName), diffPath
+}
+
+// snapshotTarName resolves the content-addressed upload filename for the snapshot and,
+// for plain_tar, the working-tree file listing used to build both the key and the tarball
+// (nil for git_archive, which lists nothing locally). The name is <dirName>_<key>.tar.gz,
+// keyed on (commit, include_paths, root_path subtree) for git_archive and on the
+// working-tree metadata fingerprint for plain_tar, so an identical input
+// reuses the same remote object (see the skip in uploadSnapshotTarball).
+func snapshotTarName(ctx context.Context, repoPath string, plan snapshotPlan) (string, []snapshotFile, error) {
+	dirName := filepath.Base(repoPath)
+	if plan.mode == modeGitArchive {
+		key := computeSnapshotCacheKey(plan.commitSHA, plan.includePaths, plan.subtreePrefix)
+		return fmt.Sprintf("%s_%s.tar.gz", dirName, key[:16]), nil, nil
+	}
+	files, err := snapshotFiles(ctx, repoPath, plan.includePaths, plan.isGitRepo)
+	if err != nil {
+		return "", nil, err
+	}
+	return fmt.Sprintf("%s_%s.tar.gz", dirName, computePlainTarKey(files)[:16]), files, nil
+}
+
+// packageSnapshot writes the snapshot to tarball per the resolved plan: `git archive`
+// of the pinned commit for git_archive, else a plain tar of the pre-listed working-tree
+// files (nil for git_archive).
+func packageSnapshot(ctx context.Context, repoPath string, plan snapshotPlan, files []snapshotFile, tarball string) error {
+	if plan.mode == modeGitArchive {
+		return createGitArchiveSnapshot(ctx, newGitRepo(repoPath), plan.commitSHA, tarball, filepath.Base(repoPath), plan.includePaths, plan.subtreePrefix)
+	}
+	return createPlainTarball(ctx, repoPath, tarball, files)
+}
+
+// airArtifactInternalDir mirrors bundle/libraries.InternalDirName: CLI-uploaded
+// artifacts live in a ".internal" subdirectory of the configured artifact path.
+const airArtifactInternalDir = ".internal"
+
+// uploadSnapshotTarball uploads the packaged snapshot to <artifactPath>/.internal and returns
+// the remote code_source_path to attach to the ai_runtime_task. artifactPath is either
+// the user's repo_snapshots directory or a configured UC Volume.
+//
+// The tarball name is content-addressed — by (commit, include_paths, root_path subtree)
+// for git_archive and by the working-tree metadata fingerprint for plain_tar — so if
+// the identical object already exists we skip packaging and upload entirely and reuse it.
+func uploadSnapshotTarball(ctx context.Context, w *databricks.WorkspaceClient, repoPath string, plan snapshotPlan, artifactPath string) (snapshotResult, error) {
+	result := snapshotResult{UsesGit: &plan.isGitRepo, PackagingMode: &plan.mode}
+	f, uploadPath, err := snapshotUploadFiler(ctx, w, artifactPath)
+	if err != nil {
+		return result, err
+	}
+
+	tarName, files, err := snapshotTarName(ctx, repoPath, plan)
+	if err != nil {
+		return result, err
+	}
+	// code_source_path is content-addressed by tarName, so it is the same whether we
+	// upload the bytes now or reuse an object already in the store.
+	remote := path.Join(uploadPath, tarName)
+
+	exists, err := snapshotExists(ctx, f, tarName)
+	if err != nil {
+		return result, err
+	}
+	if exists {
+		log.Debugf(ctx, "snapshot upload skipped; reusing %s", remote)
+		result.CodeSourcePath = remote
+		result.PackagingDurationMs = new(int64(0))
+		result.UploadDurationMs = new(int64(0))
+		return result, nil
+	}
+
+	tmp, err := os.MkdirTemp("", "air-snapshot-*")
+	if err != nil {
+		return result, err
+	}
+	defer os.RemoveAll(tmp)
+
+	tarball := filepath.Join(tmp, tarName)
+	packagingStart := time.Now()
+	err = packageSnapshot(ctx, repoPath, plan, files, tarball)
+	result.PackagingDurationMs = new(time.Since(packagingStart).Milliseconds())
+	if err != nil {
+		return result, err
+	}
+
+	file, err := os.Open(tarball)
+	if err != nil {
+		return result, err
+	}
+	defer file.Close()
+	// Size collection is best-effort and must not prevent a valid upload.
+	if info, err := file.Stat(); err == nil {
+		size := info.Size()
+		result.SizeBytes = &size
+	} else {
+		log.Debugf(ctx, "failed to measure code snapshot: %v", err)
+	}
+	cmdio.LogProgress(ctx, fmt.Sprintf("Uploading %s...", tarName))
+	uploadStart := time.Now()
+	err = f.Write(ctx, tarName, file, filer.OverwriteIfExists, filer.CreateParentDirectories)
+	result.UploadDurationMs = new(time.Since(uploadStart).Milliseconds())
+	if err != nil {
+		return result, fmt.Errorf("failed to upload snapshot %s: %w", tarName, err)
+	}
+	result.CodeSourcePath = remote
+	return result, nil
+}
+
+// snapshotUploadFiler returns a filer rooted at <artifactPath>/.internal plus that
+// upload path. It routes /Volumes paths to a Files API filer and everything else to a
+// workspace files filer, matching bundle artifact-upload resolution without depending
+// on the bundle package.
+func snapshotUploadFiler(ctx context.Context, w *databricks.WorkspaceClient, artifactPath string) (filer.Filer, string, error) {
+	if artifactPath == "" {
+		return nil, "", errors.New("remote artifact path not configured")
+	}
+	uploadPath := path.Join(artifactPath, airArtifactInternalDir)
+	// A bare workspace path (e.g. /Users/...) is served under /Workspace by the backend.
+	if !strings.HasPrefix(uploadPath, "/Workspace") && !strings.HasPrefix(uploadPath, "/Volumes") {
+		uploadPath = "/Workspace" + uploadPath
+	}
+	if strings.HasPrefix(artifactPath, "/Volumes/") {
+		f, err := filer.NewFilesClient(ctx, w, uploadPath)
+		return f, uploadPath, err
+	}
+	f, err := filer.NewWorkspaceFilesClient(w, uploadPath)
+	return f, uploadPath, err
+}
+
+// snapshotExists reports whether name already exists in the artifact store, used to
+// short-circuit a content-addressed upload (either mode). A not-found is a clean miss
+// (false, nil); any other error is surfaced.
+func snapshotExists(ctx context.Context, store filer.Filer, name string) (bool, error) {
+	_, err := store.Stat(ctx, name)
+	if err == nil {
+		return true, nil
+	}
+	if errors.Is(err, fs.ErrNotExist) {
+		return false, nil
+	}
+	return false, fmt.Errorf("failed to check snapshot cache: %w", err)
+}
diff --git a/cmd/air/sweep.go b/cmd/air/sweep.go
new file mode 100644
index 00000000000..b346f43f1b6
--- /dev/null
+++ b/cmd/air/sweep.go
@@ -0,0 +1,76 @@
+package aircmd
+
+import (
+	"context"
+	"strconv"
+
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+)
+
+// sweepInfo summarizes a "foreach" run, which fans a single config out into many
+// iterations (a hyperparameter sweep). It is shown only in text output.
+type sweepInfo struct {
+	Total     int
+	Succeeded int
+	Failed    int
+	Active    int
+	Completed int
+	Tasks     []sweepTask
+}
+
+// sweepTask is one iteration of a sweep.
+type sweepTask struct {
+	TaskKey    string
+	RunID      string
+	Status     string
+	Experiment string
+}
+
+// findForEachTask returns the run's foreach task if it has one, or nil. A run is
+// a sweep when one of its tasks fans out into iterations.
+func findForEachTask(run *jobs.Run) *jobs.RunTask {
+	for i := range run.Tasks {
+		if run.Tasks[i].ForEachTask != nil {
+			return &run.Tasks[i]
+		}
+	}
+	return nil
+}
+
+// buildSweepInfo gathers the iteration counts and per-iteration rows for a
+// sweep. The counts come from the task we already have; the individual
+// iterations require a second lookup. If that lookup fails we still return the
+// counts (logging the failure) so the user sees the summary.
+func buildSweepInfo(ctx context.Context, w *databricks.WorkspaceClient, task *jobs.RunTask) *sweepInfo {
+	info := &sweepInfo{}
+	if task.ForEachTask.Stats != nil && task.ForEachTask.Stats.TaskRunStats != nil {
+		stats := task.ForEachTask.Stats.TaskRunStats
+		info.Total = stats.TotalIterations
+		info.Succeeded = stats.SucceededIterations
+		info.Failed = stats.FailedIterations
+		info.Active = stats.ActiveIterations
+		info.Completed = stats.CompletedIterations
+	}
+
+	// The iterations are returned as part of a run lookup on the foreach task.
+	iterated, err := w.Jobs.GetRun(ctx, jobs.GetRunRequest{RunId: task.RunId})
+	if err != nil {
+		log.Debugf(ctx, "air get: could not fetch sweep iterations: %v", err)
+		return info
+	}
+
+	for _, it := range iterated.Iterations {
+		row := sweepTask{
+			TaskKey: it.TaskKey,
+			RunID:   strconv.FormatInt(it.RunId, 10),
+			Status:  runStatus(it.State),
+		}
+		if it.GenAiComputeTask != nil && it.GenAiComputeTask.MlflowExperimentName != "" {
+			row.Experiment = stripExperimentUserPrefix(it.GenAiComputeTask.MlflowExperimentName)
+		}
+		info.Tasks = append(info.Tasks, row)
+	}
+	return info
+}
diff --git a/cmd/air/sweep_test.go b/cmd/air/sweep_test.go
new file mode 100644
index 00000000000..10134c0df42
--- /dev/null
+++ b/cmd/air/sweep_test.go
@@ -0,0 +1,81 @@
+package aircmd
+
+import (
+	"testing"
+
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/experimental/mocks"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+)
+
+func TestFindForEachTask(t *testing.T) {
+	// No tasks at all.
+	assert.Nil(t, findForEachTask(&jobs.Run{}))
+
+	// A task that is not a foreach.
+	assert.Nil(t, findForEachTask(&jobs.Run{Tasks: []jobs.RunTask{{TaskKey: "a"}}}))
+
+	// The foreach task is found even when it isn't first.
+	run := &jobs.Run{Tasks: []jobs.RunTask{
+		{TaskKey: "a"},
+		{TaskKey: "sweep", ForEachTask: &jobs.RunForEachTask{}},
+	}}
+	got := findForEachTask(run)
+	require.NotNil(t, got)
+	assert.Equal(t, "sweep", got.TaskKey)
+}
+
+func sweepTaskFixture() *jobs.RunTask {
+	return &jobs.RunTask{
+		RunId: 99,
+		ForEachTask: &jobs.RunForEachTask{
+			Stats: &jobs.ForEachStats{TaskRunStats: &jobs.ForEachTaskTaskRunStats{
+				TotalIterations:     4,
+				SucceededIterations: 1,
+				FailedIterations:    1,
+				ActiveIterations:    2,
+				CompletedIterations: 2,
+			}},
+		},
+	}
+}
+
+func TestBuildSweepInfo(t *testing.T) {
+	ctx := t.Context()
+
+	t.Run("counts and iteration rows", func(t *testing.T) {
+		m := mocks.NewMockWorkspaceClient(t)
+		m.GetMockJobsAPI().EXPECT().GetRun(mock.Anything, jobs.GetRunRequest{RunId: 99}).Return(
+			&jobs.Run{Iterations: []jobs.RunTask{{
+				TaskKey:          "iter_0",
+				RunId:            100,
+				State:            &jobs.RunState{ResultState: jobs.RunResultStateSuccess},
+				GenAiComputeTask: &jobs.GenAiComputeTask{MlflowExperimentName: "/Users/me@example.com/exp"},
+			}}}, nil)
+
+		info := buildSweepInfo(ctx, m.WorkspaceClient, sweepTaskFixture())
+		assert.Equal(t, 4, info.Total)
+		assert.Equal(t, 2, info.Completed)
+		assert.Equal(t, 1, info.Succeeded)
+		assert.Equal(t, 1, info.Failed)
+		assert.Equal(t, 2, info.Active)
+		require.Len(t, info.Tasks, 1)
+		assert.Equal(t, "iter_0", info.Tasks[0].TaskKey)
+		assert.Equal(t, "100", info.Tasks[0].RunID)
+		assert.Equal(t, "SUCCESS", info.Tasks[0].Status)
+		assert.Equal(t, "exp", info.Tasks[0].Experiment)
+	})
+
+	t.Run("iteration lookup failure still returns counts", func(t *testing.T) {
+		m := mocks.NewMockWorkspaceClient(t)
+		m.GetMockJobsAPI().EXPECT().GetRun(mock.Anything, jobs.GetRunRequest{RunId: 99}).Return(
+			nil, apierr.ErrResourceDoesNotExist)
+
+		info := buildSweepInfo(ctx, m.WorkspaceClient, sweepTaskFixture())
+		assert.Equal(t, 4, info.Total)
+		assert.Empty(t, info.Tasks)
+	})
+}
diff --git a/cmd/air/telemetry.go b/cmd/air/telemetry.go
new file mode 100644
index 00000000000..0b016c357eb
--- /dev/null
+++ b/cmd/air/telemetry.go
@@ -0,0 +1,46 @@
+package aircmd
+
+import (
+	"context"
+	"strconv"
+	"time"
+
+	"github.com/databricks/cli/libs/telemetry"
+	"github.com/databricks/cli/libs/telemetry/protos"
+)
+
+// logRunEvent records the submission outcome independently of a later --watch
+// outcome. cfg has already passed local validation before submission starts.
+func logRunEvent(ctx context.Context, cfg *runConfig, snap snapshotResult, runID int64, elapsed time.Duration, err error) {
+	perNode, _ := gpusPerNode(gpuType(cfg.Compute.AcceleratorType))
+	_, hasDependencies := cfg.inlineDependencies()
+	event := &protos.AirRunEvent{
+		GPUType:                       cfg.Compute.AcceleratorType,
+		NumGPUs:                       cfg.Compute.NumAccelerators,
+		NumNodes:                      cfg.Compute.NumAccelerators / perNode,
+		HasDockerImage:                cfg.unityCatalogImagePath() != "" || len(cfg.Containers) > 0, // every container sets its own image
+		HasCodeSnapshot:               cfg.CodeSource != nil && cfg.CodeSource.Snapshot != nil,
+		HasRequirements:               hasDependencies,
+		HasParameters:                 len(cfg.Parameters) > 0,
+		MaxRetries:                    cfg.maxRetries(),
+		HasTimeout:                    cfg.TimeoutMinutes != nil,
+		SubmittedSuccessfully:         err == nil,
+		SubmitLatencyMs:               elapsed.Milliseconds(),
+		CodeSourceUsesGit:             snap.UsesGit,
+		CodeSourceSizeBytes:           snap.SizeBytes,
+		CodeSourcePackagingDurationMs: snap.PackagingDurationMs,
+		CodeSourceUploadDurationMs:    snap.UploadDurationMs,
+	}
+	if snap.PackagingMode != nil {
+		switch *snap.PackagingMode {
+		case modeGitArchive:
+			event.CodeSourcePackagingMode = protos.AirPackagingModeGitArchive
+		case modePlainTar:
+			event.CodeSourcePackagingMode = protos.AirPackagingModePlainTar
+		}
+	}
+	if err == nil {
+		event.JobRunID = strconv.FormatInt(runID, 10)
+	}
+	telemetry.Log(ctx, protos.DatabricksCliLog{AirRunEvent: event})
+}
diff --git a/cmd/air/telemetry_test.go b/cmd/air/telemetry_test.go
new file mode 100644
index 00000000000..49760d24ad9
--- /dev/null
+++ b/cmd/air/telemetry_test.go
@@ -0,0 +1,208 @@
+package aircmd
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/telemetry"
+	"github.com/databricks/cli/libs/telemetry/protos"
+	"github.com/databricks/cli/libs/testserver"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func captureAirTelemetry(t *testing.T, server *testserver.Server, w *databricks.WorkspaceClient) (context.Context, *[]protos.FrontendLog) {
+	t.Helper()
+	var events []protos.FrontendLog
+	server.Handle("POST", "/telemetry-ext", func(req testserver.Request) any {
+		var body telemetry.RequestBody
+		require.NoError(t, json.Unmarshal(req.Body, &body))
+		for _, raw := range body.ProtoLogs {
+			var event protos.FrontendLog
+			require.NoError(t, json.Unmarshal([]byte(raw), &event))
+			events = append(events, event)
+		}
+		return telemetry.ResponseBody{NumProtoSuccess: int64(len(body.ProtoLogs))}
+	})
+	ctx := telemetry.WithNewLogger(cmdio.MockDiscard(t.Context()))
+	return cmdctx.SetConfigUsed(ctx, w.Config), &events
+}
+
+func TestAirRunTelemetry(t *testing.T) {
+	for _, tc := range []struct {
+		name       string
+		snapshot   bool
+		fail       bool
+		failUpload bool
+	}{
+		{name: "without snapshot"},
+		{name: "uploaded snapshot", snapshot: true},
+		{name: "failed submit", snapshot: true, fail: true},
+		{name: "failed upload", snapshot: true, failUpload: true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			server := testserver.New(t)
+			t.Cleanup(server.Close)
+			server.Handle("POST", "/api/2.2/jobs/runs/submit", func(req testserver.Request) any {
+				if tc.fail {
+					return testserver.Response{StatusCode: http.StatusBadRequest, Body: map[string]string{
+						"error_code": "INVALID_PARAMETER_VALUE", "message": "submission rejected",
+					}}
+				}
+				return jobs.SubmitRunResponse{RunId: 555}
+			})
+			var uploadedSize int64
+			server.Handle("POST", "/api/2.0/workspace/import", func(req testserver.Request) any {
+				form, err := testserver.ParseImportForm(req)
+				assert.NoError(t, err)
+				if strings.HasSuffix(form.Path, ".tar.gz") {
+					uploadedSize = int64(len(form.Content))
+					time.Sleep(20 * time.Millisecond)
+					if tc.failUpload {
+						return testserver.Response{StatusCode: http.StatusForbidden, Body: map[string]string{
+							"error_code": "PERMISSION_DENIED", "message": "upload rejected",
+						}}
+					}
+				}
+				return req.Workspace.WorkspaceFilesImportFile(form.Path, form.Content, form.Overwrite)
+			})
+			stubValidateConfig(server)
+			w, err := databricks.NewWorkspaceClient(&databricks.Config{Host: server.URL, Token: "token"})
+			require.NoError(t, err)
+			ctx, events := captureAirTelemetry(t, server, w)
+			testserver.AddDefaultHandlers(server)
+
+			configYAML := minimalConfig
+			if tc.snapshot {
+				repo := filepath.Join(t.TempDir(), "src")
+				writeRepoFile(t, repo, "train.py", "print('private source')")
+				configYAML += "\ncode_source:\n  type: snapshot\n  snapshot:\n    root_path: " + filepath.ToSlash(repo) + "\n"
+			}
+			cfgPath := writeConfigFile(t, "run.yaml", configYAML)
+			cfg, err := loadRunConfig(cfgPath)
+			require.NoError(t, err)
+			_, _, err = submitWorkload(ctx, w, cfg, cfgPath, "idem", false)
+			if tc.fail || tc.failUpload {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+			}
+			require.NoError(t, telemetry.Upload(ctx, protos.ExecutionContext{Command: "air_run"}))
+			require.Len(t, *events, 1)
+			event := (*events)[0].Entry.DatabricksCliLog.AirRunEvent
+			require.NotNil(t, event)
+			assert.Equal(t, !tc.fail && !tc.failUpload, event.SubmittedSuccessfully)
+			assert.Equal(t, tc.snapshot, event.HasCodeSnapshot)
+			assert.Equal(t, string(gpuType1xH100), event.GPUType)
+			assert.Equal(t, 1, event.NumGPUs)
+			assert.Equal(t, 1, event.NumNodes)
+			assert.GreaterOrEqual(t, event.SubmitLatencyMs, int64(0))
+			if tc.fail || tc.failUpload {
+				assert.Empty(t, event.JobRunID)
+			} else {
+				assert.Equal(t, "555", event.JobRunID)
+			}
+			if tc.snapshot {
+				require.NotNil(t, event.CodeSourceSizeBytes)
+				assert.Positive(t, uploadedSize)
+				assert.Equal(t, uploadedSize, *event.CodeSourceSizeBytes)
+				require.NotNil(t, event.CodeSourceUsesGit)
+				assert.False(t, *event.CodeSourceUsesGit)
+				assert.Equal(t, protos.AirPackagingModePlainTar, event.CodeSourcePackagingMode)
+				require.NotNil(t, event.CodeSourcePackagingDurationMs)
+				assert.GreaterOrEqual(t, *event.CodeSourcePackagingDurationMs, int64(0))
+				require.NotNil(t, event.CodeSourceUploadDurationMs)
+				assert.GreaterOrEqual(t, *event.CodeSourceUploadDurationMs, int64(20))
+			} else {
+				assert.Nil(t, event.CodeSourceSizeBytes)
+				assert.Nil(t, event.CodeSourceUsesGit)
+				assert.Empty(t, event.CodeSourcePackagingMode)
+				assert.Nil(t, event.CodeSourcePackagingDurationMs)
+				assert.Nil(t, event.CodeSourceUploadDurationMs)
+			}
+			raw, err := json.Marshal(event)
+			require.NoError(t, err)
+			assert.NotContains(t, string(raw), cfg.ExperimentName)
+			assert.NotContains(t, string(raw), "private source")
+			assert.NotContains(t, string(raw), "root_path")
+		})
+	}
+}
+
+func TestAirRunTelemetryConfig(t *testing.T) {
+	server := testserver.New(t)
+	t.Cleanup(server.Close)
+	w, err := databricks.NewWorkspaceClient(&databricks.Config{Host: server.URL, Token: "token"})
+	require.NoError(t, err)
+	ctx, events := captureAirTelemetry(t, server, w)
+	cfgPath := writeConfigFile(t, "run.yaml", minimalConfig)
+	cfg, err := loadRunConfig(cfgPath)
+	require.NoError(t, err)
+	cfg.Compute.AcceleratorType = string(gpuType8xH100)
+	cfg.Compute.NumAccelerators = 16
+	cfg.MaxRetries = new(0)
+	cfg.TimeoutMinutes = new(5)
+	cfg.Parameters = map[string]any{"private-parameter": "private-value"}
+	cfg.Environment = &environmentConfig{UnityCatalogImage: "private.schema.image:tag"}
+	logRunEvent(ctx, cfg, snapshotResult{
+		PackagingMode:       new(modeGitArchive),
+		PackagingDurationMs: new(int64(12)),
+		UploadDurationMs:    new(int64(23)),
+	}, 123, 42*time.Millisecond, nil)
+	require.NoError(t, telemetry.Upload(ctx, protos.ExecutionContext{}))
+	require.Len(t, *events, 1)
+	event := (*events)[0].Entry.DatabricksCliLog.AirRunEvent
+	assert.Equal(t, 2, event.NumNodes)
+	assert.Equal(t, 0, event.MaxRetries)
+	assert.True(t, event.HasDockerImage)
+	assert.True(t, event.HasParameters)
+	assert.True(t, event.HasTimeout)
+	assert.Equal(t, int64(42), event.SubmitLatencyMs)
+	assert.Equal(t, protos.AirPackagingModeGitArchive, event.CodeSourcePackagingMode)
+	assert.Equal(t, new(int64(12)), event.CodeSourcePackagingDurationMs)
+	assert.Equal(t, new(int64(23)), event.CodeSourceUploadDurationMs)
+}
+
+func TestSnapshotPackagingFailureMeasurements(t *testing.T) {
+	server := testserver.New(t)
+	t.Cleanup(server.Close)
+	testserver.AddDefaultHandlers(server)
+	w, err := databricks.NewWorkspaceClient(&databricks.Config{Host: server.URL, Token: "token"})
+	require.NoError(t, err)
+	// The commit is no longer available when git archive attempts to package it.
+	result, err := uploadSnapshotTarball(t.Context(), w, newTestRepo(t), snapshotPlan{
+		mode: modeGitArchive, commitSHA: "missing-commit", isGitRepo: true,
+	}, testSnapshotArtifactPath)
+	require.Error(t, err)
+	assert.Equal(t, new(modeGitArchive), result.PackagingMode)
+	require.NotNil(t, result.PackagingDurationMs)
+	assert.GreaterOrEqual(t, *result.PackagingDurationMs, int64(0))
+	assert.Nil(t, result.UploadDurationMs)
+	assert.Nil(t, result.SizeBytes)
+	assert.Empty(t, result.CodeSourcePath)
+}
+
+func TestAirRunTelemetryContainersHaveDockerImage(t *testing.T) {
+	server := testserver.New(t)
+	t.Cleanup(server.Close)
+	w, err := databricks.NewWorkspaceClient(&databricks.Config{Host: server.URL, Token: "token"})
+	require.NoError(t, err)
+	ctx, events := captureAirTelemetry(t, server, w)
+	cfg, err := loadRunConfig(writeConfigFile(t, "run.yaml", minimalConfig))
+	require.NoError(t, err)
+	cfg.Command = nil
+	cfg.Containers = []containerConfig{{Name: "trainer", UnityCatalogImage: "private.schema.image:tag"}}
+	logRunEvent(ctx, cfg, snapshotResult{}, 123, time.Millisecond, nil)
+	require.NoError(t, telemetry.Upload(ctx, protos.ExecutionContext{}))
+	require.Len(t, *events, 1)
+	assert.True(t, (*events)[0].Entry.DatabricksCliLog.AirRunEvent.HasDockerImage)
+}
diff --git a/cmd/air/testdata/cache_keys.json b/cmd/air/testdata/cache_keys.json
new file mode 100644
index 00000000000..06673499109
--- /dev/null
+++ b/cmd/air/testdata/cache_keys.json
@@ -0,0 +1,77 @@
+[
+  {
+    "name": "commit_no_paths",
+    "commit_sha": "a3492b801c0ffee00000000000000000000dead",
+    "include_paths": null,
+    "cache_key": "8d7bc445ac83dfe432a353718ae8b1ae40eb00c860352662e6df96b7fdf862a5"
+  },
+  {
+    "name": "commit_empty_paths_none",
+    "commit_sha": "0000000000000000000000000000000000000000",
+    "include_paths": null,
+    "cache_key": "a07e0fa4d38f3c2d08c3ff6bbff0158cea01796aaaf5368b0d0e247cebd27c80"
+  },
+  {
+    "name": "single_path",
+    "commit_sha": "a3492b801c0ffee00000000000000000000dead",
+    "include_paths": [
+      "research"
+    ],
+    "cache_key": "97bd562ad591af23b9a05651d88c01abbbcc24632e9a8f2534230a61492b9e0a"
+  },
+  {
+    "name": "multi_path_sorted",
+    "commit_sha": "a3492b801c0ffee00000000000000000000dead",
+    "include_paths": [
+      "a",
+      "b",
+      "c"
+    ],
+    "cache_key": "17d021577e3615e9a603a2f701f918d74ad16218efc4b2950ee20f6a18b1a174"
+  },
+  {
+    "name": "multi_path_unsorted",
+    "commit_sha": "a3492b801c0ffee00000000000000000000dead",
+    "include_paths": [
+      "c",
+      "a",
+      "b"
+    ],
+    "cache_key": "17d021577e3615e9a603a2f701f918d74ad16218efc4b2950ee20f6a18b1a174"
+  },
+  {
+    "name": "path_whitespace",
+    "commit_sha": "a3492b801c0ffee00000000000000000000dead",
+    "include_paths": [
+      "  research  ",
+      "  data "
+    ],
+    "cache_key": "c6a6fa1d866ac90a5f371610ee08efa8aeb061a43b8a4acae30765db21f4155b"
+  },
+  {
+    "name": "nested_paths",
+    "commit_sha": "deadbeefdeadbeefdeadbeefdeadbeefdeadbeef",
+    "include_paths": [
+      "src/models",
+      "src/data",
+      "README.md"
+    ],
+    "cache_key": "2b18452b1019186a8e5b34af540a0545f96f24bc61771f58fa71fc218cb0275c"
+  },
+  {
+    "name": "short_sha",
+    "commit_sha": "a3492b8",
+    "include_paths": null,
+    "cache_key": "16be4d7d83ecd01b8d3d274dafb07b3bccc72cf7f7299578e634cd01e1825345"
+  },
+  {
+    "name": "dup_paths",
+    "commit_sha": "a3492b801c0ffee00000000000000000000dead",
+    "include_paths": [
+      "x",
+      "x",
+      "y"
+    ],
+    "cache_key": "407a5d8c3a0e9438d5abf653c4d3a43928c300b5630e2f83f435661b9fbd599e"
+  }
+]
diff --git a/cmd/air/usagepolicy.go b/cmd/air/usagepolicy.go
new file mode 100644
index 00000000000..c014065e943
--- /dev/null
+++ b/cmd/air/usagepolicy.go
@@ -0,0 +1,179 @@
+package aircmd
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"slices"
+	"strings"
+
+	"github.com/databricks/cli/libs/auth"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/client"
+)
+
+// serverlessPoliciesPath is the workspace-scoped ListBudgetPolicies endpoint on
+// the serverless-policy service. This is called with a raw client.Do because the
+// SDK only models the account-scoped /api/2.1/accounts/{id}/budget-policies
+// service, which is a different (and unusable here) endpoint.
+const serverlessPoliciesPath = "/api/2.0/serverless-policies"
+
+// maxPolicyPageSize is the server's cap: anything larger is coerced down to it.
+// Request the max so the common case (a workspace with a handful of policies) is
+// a single round-trip.
+const maxPolicyPageSize = 1000
+
+// maxPolicySuggestions bounds the candidate names surfaced in a "no exact match"
+// error: enough to spot a typo or casing mistake without dumping a huge list.
+const maxPolicySuggestions = 10
+
+// usagePolicy models only the two fields resolution needs. The API also returns
+// display_name, which is deliberately not read: policy_name is the unique key
+// (unique among active policies) and the only field filter_by can match on. The
+// two are identical for user-created policies and diverge only for the system
+// defaults, whose display_name is fixed to "Default Policy".
+type usagePolicy struct {
+	PolicyID   string `json:"policy_id"`
+	PolicyName string `json:"policy_name"`
+}
+
+type usagePoliciesResponse struct {
+	Policies      []usagePolicy `json:"policies"`
+	NextPageToken string        `json:"next_page_token"`
+}
+
+// listUsagePolicies pages the serverless-policy index for policies matching
+// policyName, which is sent as filter_by.policy_name: a partial,
+// case-insensitive server-side filter. Callers must pass a non-empty name.
+//
+// The filter key is spelled with its dotted proto path rather than as a nested
+// map: the SDK only flattens nesting for struct-typed query values, and would
+// format a nested map with %v into a useless "map[...]" literal.
+func listUsagePolicies(ctx context.Context, w *databricks.WorkspaceClient, policyName string) ([]usagePolicy, error) {
+	apiClient, err := client.New(w.Config)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create API client: %w", err)
+	}
+
+	var out []usagePolicy
+	// The index can return the same policy on more than one page, and a stuck or
+	// cycling cursor can repeat a whole page; dedupe both so an unambiguous name
+	// never looks like an ambiguous match downstream.
+	seenIDs := map[string]bool{}
+	seenTokens := map[string]bool{}
+	var pageToken string
+	for {
+		query := map[string]any{
+			"page_size":             maxPolicyPageSize,
+			"filter_by.policy_name": policyName,
+		}
+		if pageToken != "" {
+			query["page_token"] = pageToken
+		}
+
+		var resp usagePoliciesResponse
+		err = apiClient.Do(ctx, http.MethodGet, serverlessPoliciesPath, auth.WorkspaceIDHeaders(w.Config), nil, query, &resp)
+		if err != nil {
+			return nil, fmt.Errorf("failed to list usage policies: %w", err)
+		}
+
+		for _, p := range resp.Policies {
+			if seenIDs[p.PolicyID] {
+				continue
+			}
+			seenIDs[p.PolicyID] = true
+			out = append(out, p)
+		}
+
+		if resp.NextPageToken == "" || seenTokens[resp.NextPageToken] {
+			return out, nil
+		}
+		seenTokens[resp.NextPageToken] = true
+		pageToken = resp.NextPageToken
+	}
+}
+
+// resolveUsagePolicyIDByName resolves a usage policy name to its UUID policy id.
+//
+// The server-side filter is a partial match, so the exact (but case-insensitive)
+// match is re-applied locally; policy names are unique among active policies.
+//
+// name is matched against policy_name, not the policy's display_name. For a
+// user-created policy the two are the same, so the distinction only surfaces for
+// the system defaults; a user who supplies a display name that isn't a
+// policy_name gets the not-found error with the real names as candidates.
+func resolveUsagePolicyIDByName(ctx context.Context, w *databricks.WorkspaceClient, name string) (string, error) {
+	target := strings.TrimSpace(name)
+	// Guard the contract independently of the YAML validator: an empty filter would
+	// otherwise list (then reject against) every policy in the workspace.
+	if target == "" {
+		return "", errors.New("a usage policy name must be a non-empty string")
+	}
+
+	policies, err := listUsagePolicies(ctx, w, target)
+	if err != nil {
+		return "", err
+	}
+
+	var matches []usagePolicy
+	for _, p := range policies {
+		if strings.EqualFold(strings.TrimSpace(p.PolicyName), target) {
+			matches = append(matches, p)
+		}
+	}
+
+	switch len(matches) {
+	case 1:
+		if matches[0].PolicyID == "" {
+			return "", fmt.Errorf("policy %q has no policy_id in the API response", target)
+		}
+		return matches[0].PolicyID, nil
+
+	case 0:
+		// policies holds the partial-match candidates the server returned for this
+		// name; surface a few to help the user fix a typo or casing. These are
+		// policy_name values, which is also what a user who typed a policy's UI
+		// display name needs to see: the two differ only for the system default
+		// policies, so listing the real names points them at the right one.
+		return "", fmt.Errorf("no usage policy named %q was found in this workspace%s", target, suggestionHint(policies))
+
+	default:
+		// Multiple exact (case-insensitive) matches should not happen given name
+		// uniqueness, but guard so we never silently pick the wrong policy.
+		ids := make([]string, 0, len(matches))
+		for _, p := range matches {
+			ids = append(ids, fmt.Sprintf("%q", p.PolicyID))
+		}
+		return "", fmt.Errorf("multiple usage policies match the name %q (ids: %s); please disambiguate with your workspace admin",
+			target, strings.Join(ids, ", "))
+	}
+}
+
+// suggestionHint renders a deduplicated, sorted "did you mean" clause for the
+// candidates the partial filter returned, or "" when there are none.
+func suggestionHint(candidates []usagePolicy) string {
+	names := make([]string, 0, len(candidates))
+	for _, p := range candidates {
+		if p.PolicyName != "" {
+			names = append(names, p.PolicyName)
+		}
+	}
+	slices.Sort(names)
+	names = slices.Compact(names)
+	if len(names) == 0 {
+		return ""
+	}
+
+	shown := names
+	suffix := ""
+	if len(names) > maxPolicySuggestions {
+		shown = names[:maxPolicySuggestions]
+		suffix = ", ..."
+	}
+	quoted := make([]string, 0, len(shown))
+	for _, n := range shown {
+		quoted = append(quoted, fmt.Sprintf("%q", n))
+	}
+	return fmt.Sprintf(". Did you mean one of: %s%s?", strings.Join(quoted, ", "), suffix)
+}
diff --git a/cmd/air/usagepolicy_test.go b/cmd/air/usagepolicy_test.go
new file mode 100644
index 00000000000..441657bdb83
--- /dev/null
+++ b/cmd/air/usagepolicy_test.go
@@ -0,0 +1,227 @@
+package aircmd
+
+import (
+	"net/url"
+	"strconv"
+	"testing"
+
+	"github.com/databricks/cli/libs/testserver"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// policyServer serves /api/2.0/serverless-policies from the given pages,
+// returning one page per request and recording each request's query.
+func policyServer(t *testing.T, pages ...usagePoliciesResponse) (*databricks.WorkspaceClient, *[]url.Values) {
+	server := testserver.New(t)
+	t.Cleanup(server.Close)
+
+	var queries []url.Values
+	var n int
+	server.Handle("GET", "/api/2.0/serverless-policies", func(req testserver.Request) any {
+		queries = append(queries, req.URL.Query())
+		page := pages[min(n, len(pages)-1)]
+		n++
+		return page
+	})
+	testserver.AddDefaultHandlers(server)
+	w, err := databricks.NewWorkspaceClient(&databricks.Config{Host: server.URL, Token: "token"})
+	require.NoError(t, err)
+	return w, &queries
+}
+
+func TestListUsagePoliciesSendsFilterAndPageSize(t *testing.T) {
+	w, queries := policyServer(t, usagePoliciesResponse{
+		Policies: []usagePolicy{{PolicyID: "id-1", PolicyName: "alpha"}},
+	})
+
+	policies, err := listUsagePolicies(t.Context(), w, "alpha")
+	require.NoError(t, err)
+	assert.Equal(t, []usagePolicy{{PolicyID: "id-1", PolicyName: "alpha"}}, policies)
+
+	require.Len(t, *queries, 1)
+	q := (*queries)[0]
+	// The filter must arrive under its flattened proto path, not as a nested map.
+	assert.Equal(t, "alpha", q.Get("filter_by.policy_name"))
+	assert.Equal(t, strconv.Itoa(maxPolicyPageSize), q.Get("page_size"))
+}
+
+func TestListUsagePoliciesPaginates(t *testing.T) {
+	w, queries := policyServer(t,
+		usagePoliciesResponse{Policies: []usagePolicy{{PolicyID: "id-1", PolicyName: "a"}}, NextPageToken: "tok"},
+		usagePoliciesResponse{Policies: []usagePolicy{{PolicyID: "id-2", PolicyName: "b"}}},
+	)
+
+	policies, err := listUsagePolicies(t.Context(), w, "a")
+	require.NoError(t, err)
+	assert.Equal(t, []usagePolicy{
+		{PolicyID: "id-1", PolicyName: "a"},
+		{PolicyID: "id-2", PolicyName: "b"},
+	}, policies)
+
+	require.Len(t, *queries, 2)
+	assert.Equal(t, "tok", (*queries)[1].Get("page_token"))
+}
+
+// A page token that repeats itself must not spin forever, and the repeated page
+// must not be counted twice: a duplicated policy would otherwise look like an
+// ambiguous name to resolveUsagePolicyIDByName.
+func TestListUsagePoliciesStopsOnRepeatedToken(t *testing.T) {
+	w, _ := policyServer(t, usagePoliciesResponse{
+		Policies:      []usagePolicy{{PolicyID: "id-1", PolicyName: "a"}},
+		NextPageToken: "same",
+	})
+
+	policies, err := listUsagePolicies(t.Context(), w, "a")
+	require.NoError(t, err)
+	assert.Equal(t, []usagePolicy{{PolicyID: "id-1", PolicyName: "a"}}, policies)
+}
+
+// An A->B->A token cycle also terminates, rather than only a self-repeat.
+func TestListUsagePoliciesStopsOnTokenCycle(t *testing.T) {
+	w, _ := policyServer(t,
+		usagePoliciesResponse{Policies: []usagePolicy{{PolicyID: "id-1", PolicyName: "a"}}, NextPageToken: "b"},
+		usagePoliciesResponse{Policies: []usagePolicy{{PolicyID: "id-2", PolicyName: "b"}}, NextPageToken: "a"},
+		usagePoliciesResponse{Policies: []usagePolicy{{PolicyID: "id-3", PolicyName: "c"}}, NextPageToken: "b"},
+	)
+
+	policies, err := listUsagePolicies(t.Context(), w, "a")
+	require.NoError(t, err)
+	assert.Len(t, policies, 3)
+}
+
+// The same policy arriving on two pages is returned once.
+func TestListUsagePoliciesDedupesAcrossPages(t *testing.T) {
+	w, _ := policyServer(t,
+		usagePoliciesResponse{Policies: []usagePolicy{{PolicyID: "id-1", PolicyName: "team-a"}}, NextPageToken: "tok"},
+		usagePoliciesResponse{Policies: []usagePolicy{{PolicyID: "id-1", PolicyName: "team-a"}}},
+	)
+
+	policies, err := listUsagePolicies(t.Context(), w, "team-a")
+	require.NoError(t, err)
+	assert.Equal(t, []usagePolicy{{PolicyID: "id-1", PolicyName: "team-a"}}, policies)
+
+	// A repeat must not read as an ambiguous match.
+	w2, _ := policyServer(t,
+		usagePoliciesResponse{Policies: []usagePolicy{{PolicyID: "id-1", PolicyName: "team-a"}}, NextPageToken: "tok"},
+		usagePoliciesResponse{Policies: []usagePolicy{{PolicyID: "id-1", PolicyName: "team-a"}}},
+	)
+	got, err := resolveUsagePolicyIDByName(t.Context(), w2, "team-a")
+	require.NoError(t, err)
+	assert.Equal(t, "id-1", got)
+}
+
+func TestResolveUsagePolicyIDByName(t *testing.T) {
+	const id = "12345678-90ab-cdef-1234-567890abcdef"
+
+	t.Run("exact match", func(t *testing.T) {
+		w, _ := policyServer(t, usagePoliciesResponse{
+			Policies: []usagePolicy{{PolicyID: id, PolicyName: "team-a"}},
+		})
+		got, err := resolveUsagePolicyIDByName(t.Context(), w, "team-a")
+		require.NoError(t, err)
+		assert.Equal(t, id, got)
+	})
+
+	// The server filter is partial; only the exact name (case-insensitively) wins.
+	t.Run("case-insensitive exact match wins over partial", func(t *testing.T) {
+		w, _ := policyServer(t, usagePoliciesResponse{
+			Policies: []usagePolicy{
+				{PolicyID: "other", PolicyName: "team-a-staging"},
+				{PolicyID: id, PolicyName: "Team-A"},
+			},
+		})
+		got, err := resolveUsagePolicyIDByName(t.Context(), w, "team-a")
+		require.NoError(t, err)
+		assert.Equal(t, id, got)
+	})
+
+	t.Run("no match suggests candidates", func(t *testing.T) {
+		w, _ := policyServer(t, usagePoliciesResponse{
+			Policies: []usagePolicy{{PolicyID: "x", PolicyName: "team-a-staging"}},
+		})
+		_, err := resolveUsagePolicyIDByName(t.Context(), w, "team-a")
+		require.ErrorContains(t, err, `no usage policy named "team-a"`)
+		require.ErrorContains(t, err, `Did you mean one of: "team-a-staging"?`)
+	})
+
+	t.Run("no match and no candidates omits the hint", func(t *testing.T) {
+		w, _ := policyServer(t, usagePoliciesResponse{})
+		_, err := resolveUsagePolicyIDByName(t.Context(), w, "team-a")
+		require.ErrorContains(t, err, `no usage policy named "team-a"`)
+		assert.NotContains(t, err.Error(), "Did you mean")
+	})
+
+	t.Run("suggestions are capped", func(t *testing.T) {
+		var policies []usagePolicy
+		for i := range maxPolicySuggestions + 5 {
+			// Zero-padded so lexical order matches numeric order.
+			policies = append(policies, usagePolicy{PolicyID: strconv.Itoa(i), PolicyName: "team-a-" + strconv.Itoa(100+i)})
+		}
+		w, _ := policyServer(t, usagePoliciesResponse{Policies: policies})
+		_, err := resolveUsagePolicyIDByName(t.Context(), w, "team-a")
+		require.ErrorContains(t, err, `"team-a-109", ...?`)
+		assert.NotContains(t, err.Error(), "team-a-110")
+	})
+
+	t.Run("ambiguous match refuses to guess", func(t *testing.T) {
+		w, _ := policyServer(t, usagePoliciesResponse{
+			Policies: []usagePolicy{
+				{PolicyID: "id-1", PolicyName: "team-a"},
+				{PolicyID: "id-2", PolicyName: "TEAM-A"},
+			},
+		})
+		_, err := resolveUsagePolicyIDByName(t.Context(), w, "team-a")
+		require.ErrorContains(t, err, "multiple usage policies match")
+		require.ErrorContains(t, err, `"id-1", "id-2"`)
+	})
+
+	t.Run("match without an id is an error", func(t *testing.T) {
+		w, _ := policyServer(t, usagePoliciesResponse{
+			Policies: []usagePolicy{{PolicyName: "team-a"}},
+		})
+		_, err := resolveUsagePolicyIDByName(t.Context(), w, "team-a")
+		require.ErrorContains(t, err, "has no policy_id")
+	})
+
+	// An empty filter would list every policy in the workspace, so a blank name is
+	// rejected without a round-trip.
+	t.Run("blank name is rejected", func(t *testing.T) {
+		w, queries := policyServer(t, usagePoliciesResponse{})
+		_, err := resolveUsagePolicyIDByName(t.Context(), w, "   ")
+		require.ErrorContains(t, err, "must be a non-empty string")
+		assert.Empty(t, *queries)
+	})
+
+	// A failed lookup must surface, never fall through to an empty (= no policy) id.
+	t.Run("api error surfaces", func(t *testing.T) {
+		server := testserver.New(t)
+		t.Cleanup(server.Close)
+		server.Handle("GET", "/api/2.0/serverless-policies", func(req testserver.Request) any {
+			return testserver.Response{StatusCode: 403, Body: `{"error_code":"PERMISSION_DENIED","message":"nope"}`}
+		})
+		testserver.AddDefaultHandlers(server)
+		w, err := databricks.NewWorkspaceClient(&databricks.Config{Host: server.URL, Token: "token"})
+		require.NoError(t, err)
+
+		_, err = resolveUsagePolicyIDByName(t.Context(), w, "team-a")
+		require.ErrorContains(t, err, "failed to list usage policies")
+	})
+}
+
+// The --override path re-decodes and re-validates the config, so the policy rules
+// must hold there too and not just for fields set in the YAML file.
+func TestOverrideUsagePolicyValidation(t *testing.T) {
+	t.Run("override trips mutual exclusion", func(t *testing.T) {
+		cfgPath := writeConfigFile(t, "run.yaml", minimalConfig+"usage_policy_id: 12345678-90ab-cdef-1234-567890abcdef\n")
+		_, err := loadRunConfigWithOverrides(t.Context(), cfgPath, []string{"usage_policy_name=team-a"})
+		require.ErrorContains(t, err, "mutually exclusive")
+	})
+
+	t.Run("override id is UUID-checked", func(t *testing.T) {
+		cfgPath := writeConfigFile(t, "run.yaml", minimalConfig)
+		_, err := loadRunConfigWithOverrides(t.Context(), cfgPath, []string{"usage_policy_id=team-a"})
+		require.ErrorContains(t, err, "must be a UUID")
+	})
+}
diff --git a/cmd/air/validateconfig.go b/cmd/air/validateconfig.go
new file mode 100644
index 00000000000..62dad63f8ab
--- /dev/null
+++ b/cmd/air/validateconfig.go
@@ -0,0 +1,371 @@
+package aircmd
+
+import (
+	"context"
+	"crypto/tls"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/databricks/cli/libs/auth"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/client"
+	"github.com/databricks/databricks-sdk-go/common"
+	"github.com/databricks/databricks-sdk-go/config"
+	"github.com/databricks/databricks-sdk-go/httpclient"
+	"github.com/databricks/databricks-sdk-go/httpclient/traceparent"
+	"github.com/databricks/databricks-sdk-go/useragent"
+)
+
+// validateConfigPath is AiTrainingService's pre-flight: it checks a training
+// config server-side and returns the problems, without submitting. Called with a
+// raw client.Do because the SDK does not model AiTrainingService.
+const validateConfigPath = "/api/2.0/ai-training/config:validate"
+
+const dryRunValidationMaxAttempts = 2
+
+const submissionValidationTimeout = 5 * time.Second
+
+type dryRunValidationAttemptBudgetKey struct{}
+
+func armDryRunValidationAttemptBudget(ctx context.Context) context.Context {
+	return context.WithValue(ctx, dryRunValidationAttemptBudgetKey{}, new(int))
+}
+
+func allowDryRunValidationRetry(ctx context.Context) bool {
+	attempts, ok := ctx.Value(dryRunValidationAttemptBudgetKey{}).(*int)
+	if !ok {
+		return false
+	}
+	*attempts++
+	return *attempts < dryRunValidationMaxAttempts
+}
+
+// configFieldError is one problem the server found, addressed to the config
+// field that caused it. Mirrors the proto FieldError.
+type configFieldError struct {
+	Path    string `json:"path"`
+	Message string `json:"message"`
+	Code    string `json:"code"`
+}
+
+type validateConfigResponse struct {
+	Errors []configFieldError `json:"errors"`
+}
+
+type validationAuthenticationError struct {
+	err error
+}
+
+func (e *validationAuthenticationError) Error() string { return e.err.Error() }
+func (e *validationAuthenticationError) Unwrap() error { return e.err }
+
+// validationUnavailableError means the backend check could not finish.
+type validationUnavailableError struct {
+	err       error
+	retryable bool
+}
+
+func (e *validationUnavailableError) Error() string { return e.err.Error() }
+func (e *validationUnavailableError) Unwrap() error { return e.err }
+
+func asValidationUnavailable(err error, retryable bool) error {
+	return &validationUnavailableError{
+		err:       fmt.Errorf("config validation unavailable: %w", err),
+		retryable: retryable,
+	}
+}
+
+func validationUnavailable(err error) (*validationUnavailableError, bool) {
+	return errors.AsType[*validationUnavailableError](err)
+}
+
+// preflightValidate checks the config against the backend before any upload, so
+// a bad config fails fast with the server's own field-level errors.
+//
+// Availability failures fail open, while caller failures and field errors block.
+func preflightValidate(ctx context.Context, w *databricks.WorkspaceClient, cfg *runConfig, commandPath string, containers []submittedContainer, idempotencyToken string) error {
+	validationCtx, cancel := context.WithTimeout(ctx, submissionValidationTimeout)
+	defer cancel()
+
+	err := validateConfigOnce(validationCtx, w, cfg, commandPath, containers, idempotencyToken)
+	if unavailable, _ := classifyValidationFailure(err); unavailable {
+		if cmdio.HasIO(ctx) {
+			cmdio.LogString(ctx, "Warning: server-side config validation was unavailable; continuing with submission.")
+		}
+		return nil
+	}
+	return err
+}
+
+func validateConfigOnce(ctx context.Context, w *databricks.WorkspaceClient, cfg *runConfig, commandPath string, containers []submittedContainer, idempotencyToken string) error {
+	clientCfg, err := config.HTTPClientConfigFromConfig(w.Config)
+	if err != nil {
+		return fmt.Errorf("failed to create API client: %w", err)
+	}
+
+	requestBody, err := common.NewRequestBody(validateConfigRequest(ctx, cfg, commandPath, containers, idempotencyToken))
+	if err != nil {
+		return fmt.Errorf("failed to validate config: %w", err)
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, validateConfigPath, requestBody.Reader)
+	if err != nil {
+		return fmt.Errorf("failed to validate config: %w", err)
+	}
+	req.Header.Set("Accept", "application/json")
+	req.Header.Set("Content-Type", requestBody.ContentType)
+	if clientCfg.AuthVisitor != nil {
+		// Some SDK OAuth visitors refresh with context.Background(). For those
+		// providers, acquire the token with the preflight context first.
+		switch w.Config.AuthType {
+		case auth.AuthTypePat, auth.AuthTypeBasic, "noop", auth.AuthTypeAzureCli, auth.AuthTypeAzureMSI, auth.AuthTypeAzureSecret, auth.AuthTypeGoogleCreds, auth.AuthTypeGoogleID:
+		default:
+			token, err := w.Config.GetTokenSource().Token(req.Context())
+			if err != nil {
+				return &validationAuthenticationError{fmt.Errorf("failed to validate config: %w", err)}
+			}
+			token.SetAuthHeader(req)
+		}
+		if err := clientCfg.AuthVisitor(req); err != nil {
+			return &validationAuthenticationError{fmt.Errorf("failed to validate config: %w", err)}
+		}
+	}
+	for _, visitor := range clientCfg.Visitors {
+		if err := visitor(req); err != nil {
+			return fmt.Errorf("failed to validate config: %w", err)
+		}
+	}
+	for key, value := range auth.WorkspaceIDHeaders(w.Config) {
+		req.Header.Set(key, value)
+	}
+	req.Header.Set("User-Agent", useragent.FromContext(req.Context()))
+	traceparent.AddTraceparent(req)
+
+	transport := clientCfg.Transport
+	if transport == nil {
+		defaultTransport := http.DefaultTransport.(*http.Transport).Clone()
+		if clientCfg.InsecureSkipVerify {
+			defaultTransport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
+		}
+		transport = defaultTransport
+	}
+	resp, err := (&http.Client{Transport: transport}).Do(req)
+	if err != nil {
+		return fmt.Errorf("failed to validate config: %w", err)
+	}
+	defer resp.Body.Close()
+	responseBody, err := common.NewResponseWrapper(resp, requestBody)
+	if err != nil {
+		err = fmt.Errorf("failed to validate config: %w", err)
+		if errors.Is(err, context.Canceled) {
+			return err
+		}
+		if resp.StatusCode >= 400 {
+			return &apierr.APIError{
+				StatusCode: resp.StatusCode,
+				Message:    err.Error(),
+			}
+		}
+		return asValidationUnavailable(err, true)
+	}
+	if err := apierr.GetAPIError(ctx, responseBody); err != nil {
+		return fmt.Errorf("failed to validate config: %w", err)
+	}
+
+	var result validateConfigResponse
+	if err := json.Unmarshal(responseBody.DebugBytes, &result); err != nil {
+		return asValidationUnavailable(fmt.Errorf("failed to validate config: %w", err), true)
+	}
+	if len(result.Errors) == 0 {
+		return nil
+	}
+	return errors.New(formatConfigErrors(result.Errors))
+}
+
+func newDryRunValidationClient(w *databricks.WorkspaceClient) (*client.DatabricksClient, error) {
+	clientCfg, err := config.HTTPClientConfigFromConfig(w.Config)
+	if err != nil {
+		return nil, err
+	}
+	clientCfg.TransientErrors = nil
+	clientCfg.ErrorRetriable = func(ctx context.Context, err error) bool {
+		apiErr, ok := errors.AsType[*apierr.APIError](err)
+		if !ok {
+			return false
+		}
+		if apiErr.StatusCode != http.StatusTooManyRequests && apiErr.StatusCode != http.StatusServiceUnavailable {
+			return false
+		}
+		return allowDryRunValidationRetry(ctx)
+	}
+	return client.NewWithClient(w.Config, httpclient.NewApiClient(clientCfg))
+}
+
+func validateDryRunConfig(ctx context.Context, w *databricks.WorkspaceClient, cfg *runConfig, commandPath string, containers []submittedContainer, idempotencyToken string, timeout time.Duration) error {
+	apiClient, err := newDryRunValidationClient(w)
+	if err != nil {
+		return fmt.Errorf("failed to create API client: %w", err)
+	}
+
+	validationCtx, cancel := context.WithTimeout(ctx, timeout)
+	defer cancel()
+	validationCtx = armDryRunValidationAttemptBudget(validationCtx)
+
+	err = validateConfig(validationCtx, apiClient, cfg, commandPath, containers, idempotencyToken)
+	if unavailable, retryable := classifyValidationFailure(err); unavailable {
+		return asValidationUnavailable(err, retryable)
+	}
+	return err
+}
+
+// validateConfig performs the current backend validation without client-side
+// availability fallbacks. The legacy response reports field errors only; it
+// cannot yet distinguish complete success from skipped backend dependencies.
+func validateConfig(ctx context.Context, apiClient *client.DatabricksClient, cfg *runConfig, commandPath string, containers []submittedContainer, idempotencyToken string) error {
+	var resp validateConfigResponse
+	err := apiClient.Do(ctx, http.MethodPost, validateConfigPath, auth.WorkspaceIDHeaders(apiClient.Config), nil, validateConfigRequest(ctx, cfg, commandPath, containers, idempotencyToken), &resp)
+	if err != nil {
+		return fmt.Errorf("failed to validate config: %w", err)
+	}
+	if len(resp.Errors) == 0 {
+		return nil
+	}
+	return errors.New(formatConfigErrors(resp.Errors))
+}
+
+// classifyValidationFailure separates service failures from caller errors and
+// reports whether retrying the same request may succeed.
+func classifyValidationFailure(err error) (unavailable, retryable bool) {
+	if errors.Is(err, context.Canceled) {
+		return false, false
+	}
+	if unavailable, ok := validationUnavailable(err); ok {
+		return true, unavailable.retryable
+	}
+	if errors.Is(err, context.DeadlineExceeded) {
+		return true, true
+	}
+	if _, ok := errors.AsType[*validationAuthenticationError](err); ok {
+		return false, false
+	}
+	if _, ok := errors.AsType[*url.Error](err); ok {
+		if _, ok := errors.AsType[*apierr.APIError](err); !ok {
+			return true, true
+		}
+	}
+	apiErr, ok := errors.AsType[*apierr.APIError](err)
+	if !ok {
+		return false, false
+	}
+	if apiErr.ErrorCode == "FEATURE_DISABLED" ||
+		apiErr.StatusCode == http.StatusNotFound ||
+		apiErr.StatusCode == http.StatusNotImplemented {
+		return true, false
+	}
+	if apiErr.StatusCode == http.StatusRequestTimeout ||
+		apiErr.StatusCode == http.StatusTooManyRequests ||
+		apiErr.StatusCode >= 500 {
+		return true, true
+	}
+	return false, false
+}
+
+// validateConfigRequest builds the {task, run_options, environment} body from the user's config. commandPath is
+// the workspace path where the command script will be uploaded; the caller computes it before this
+// call so the server can validate the real path. `parameters` is intentionally omitted: it is
+// free-form nested hyperparameters uploaded as a YAML file at submit, not the proto's string map.
+func validateConfigRequest(ctx context.Context, cfg *runConfig, commandPath string, containers []submittedContainer, idempotencyToken string) map[string]any {
+	compute := map[string]any{}
+	if cfg.Compute != nil {
+		compute["accelerator_type"] = cfg.Compute.AcceleratorType
+		compute["accelerator_count"] = cfg.Compute.NumAccelerators
+		// Wire field stays provisioned_capacity_id (the backend name); the YAML
+		// field is pool_id.
+		putOpt(compute, "provisioned_capacity_id", cfg.Compute.PoolID)
+	}
+	deployment := map[string]any{"compute": compute}
+	if len(containers) == 0 {
+		deployment["command_path"] = commandPath
+	} else {
+		raw := make([]any, 0, len(containers))
+		for _, container := range containers {
+			raw = append(raw, map[string]any{
+				"name":                     container.Name,
+				"command_path":             container.CommandPath,
+				"ranks":                    container.Ranks,
+				"unity_catalog_image_path": container.UnityCatalogImagePath,
+			})
+		}
+		deployment["containers"] = raw
+	}
+	task := map[string]any{
+		"experiment":  cfg.ExperimentName,
+		"deployments": []any{deployment},
+	}
+	if cfg.Compute != nil {
+		// priority_class rides on the ai_runtime_task (task-level), not the deployment
+		// compute where provisioned_capacity_id lives.
+		putOpt(task, "priority_class", cfg.Compute.PriorityClass)
+	}
+	putOpt(task, "mlflow_run", cfg.MLflowRunName)
+	putOpt(task, "mlflow_experiment_directory", cfg.MLflowExperimentDirectory)
+	putOpt(task, "mlflow_artifact_location", cfg.MLflowArtifactLocation)
+	if image := cfg.unityCatalogImagePath(); image != "" {
+		task["unity_catalog_image_path"] = image
+	}
+	runtimeVersion, _ := cfg.runtimeVersion()
+	dependencies, _ := cfg.inlineDependencies()
+
+	return map[string]any{
+		"task":        task,
+		"run_options": validateConfigRunOptions(cfg, idempotencyToken),
+		"environment": buildRunEnvironment(dlRuntimeImage(ctx, runtimeVersion), dependencies),
+	}
+}
+
+// validateConfigRunOptions includes the effective idempotency token and any
+// run-level fields the user set.
+func validateConfigRunOptions(cfg *runConfig, idempotencyToken string) map[string]any {
+	runOptions := map[string]any{"idempotency_token": idempotencyToken}
+	putOpt(runOptions, "max_retries", cfg.MaxRetries)
+	putOpt(runOptions, "timeout_minutes", cfg.TimeoutMinutes)
+	putOpt(runOptions, "usage_policy_name", cfg.UsagePolicyName)
+	putOpt(runOptions, "usage_policy_id", cfg.UsagePolicyID)
+	if len(cfg.EnvVariables) > 0 {
+		runOptions["env_variables"] = cfg.EnvVariables
+	}
+	if len(cfg.Secrets) > 0 {
+		runOptions["secrets"] = cfg.Secrets
+	}
+	return runOptions
+}
+
+// putOpt sets key to the pointer's value only when it is non-nil, so an unset
+// config field is left out of the request rather than sent as a zero value.
+func putOpt[T any](m map[string]any, key string, value *T) {
+	if value != nil {
+		m[key] = *value
+	}
+}
+
+// formatConfigErrors renders the field errors as one message, one problem per
+// line, each pointing at the config field the user wrote.
+func formatConfigErrors(fieldErrors []configFieldError) string {
+	var b strings.Builder
+	b.WriteString("config validation failed:")
+	for _, e := range fieldErrors {
+		b.WriteString("\n  ")
+		if e.Path != "" {
+			b.WriteString(e.Path)
+			b.WriteString(": ")
+		}
+		b.WriteString(e.Message)
+	}
+	return b.String()
+}
diff --git a/cmd/air/validateconfig_test.go b/cmd/air/validateconfig_test.go
new file mode 100644
index 00000000000..f0a0f3e38c8
--- /dev/null
+++ b/cmd/air/validateconfig_test.go
@@ -0,0 +1,473 @@
+package aircmd
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	sdkconfig "github.com/databricks/databricks-sdk-go/config"
+	"github.com/databricks/databricks-sdk-go/config/credentials"
+	sdkauth "github.com/databricks/databricks-sdk-go/config/experimental/auth"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/oauth2"
+)
+
+func baseRunConfig() *runConfig {
+	return &runConfig{
+		ExperimentName: "llama-fine-tune",
+		Compute:        &computeConfig{NumAccelerators: 16, AcceleratorType: "GPU_8xH100"},
+	}
+}
+
+// validateServer serves one ValidateConfig response with the given status and
+// body, and records the request body it received.
+func validateServer(t *testing.T, status int, body string, gotReq *map[string]any) *httptest.Server {
+	t.Helper()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == validateConfigPath {
+			if gotReq != nil {
+				_ = json.NewDecoder(r.Body).Decode(gotReq)
+			}
+			w.WriteHeader(status)
+			_, _ = w.Write([]byte(body))
+			return
+		}
+		_, _ = w.Write([]byte(`{}`))
+	}))
+	t.Cleanup(srv.Close)
+	return srv
+}
+
+func validationTestWorkspaceClient(t *testing.T, host string) *databricks.WorkspaceClient {
+	t.Helper()
+	w := newTestWorkspaceClient(t, host)
+	w.Config.RetryTimeoutSeconds = 1
+	return w
+}
+
+func validationTestWorkspaceClientWithTransport(t *testing.T, transport validationRoundTripFunc) *databricks.WorkspaceClient {
+	t.Helper()
+	w, err := databricks.NewWorkspaceClient(&databricks.Config{
+		Host:          "https://example.test",
+		Token:         "token",
+		HTTPTransport: transport,
+	})
+	require.NoError(t, err)
+	return w
+}
+
+type validationRoundTripFunc func(*http.Request) (*http.Response, error)
+
+func (fn validationRoundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) {
+	return fn(req)
+}
+
+type validationOAuthCredentials struct {
+	tokenSource sdkauth.TokenSource
+}
+
+func (validationOAuthCredentials) Name() string { return "oauth-m2m" }
+
+func (c validationOAuthCredentials) Configure(context.Context, *sdkconfig.Config) (credentials.CredentialsProvider, error) {
+	return credentials.NewOAuthCredentialsProviderFromTokenSource(c.tokenSource), nil
+}
+
+type validationErrorReadCloser struct{}
+
+func (validationErrorReadCloser) Read([]byte) (int, error) { return 0, errors.New("body read failed") }
+func (validationErrorReadCloser) Close() error             { return nil }
+
+type validationContextReadCloser struct {
+	ctx context.Context
+}
+
+func (r validationContextReadCloser) Read([]byte) (int, error) {
+	<-r.ctx.Done()
+	return 0, r.ctx.Err()
+}
+func (validationContextReadCloser) Close() error { return nil }
+
+func TestPreflightValidateFailsOpenWhenBackendUnavailable(t *testing.T) {
+	tests := []struct {
+		name   string
+		status int
+		body   string
+	}{
+		{"disabled", http.StatusBadRequest, `{"error_code":"FEATURE_DISABLED","message":"not enabled"}`},
+		{"server error", http.StatusInternalServerError, `{"error_code":"INTERNAL_ERROR","message":"backend failed"}`},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			srv := validateServer(t, tt.status, tt.body, nil)
+			err := preflightValidate(t.Context(), validationTestWorkspaceClient(t, srv.URL), baseRunConfig(), "/Workspace/Users/me/cmd.sh", nil, "token")
+			assert.NoError(t, err)
+		})
+	}
+}
+
+func TestPreflightValidationUnavailableWarnsWithoutRetry(t *testing.T) {
+	var requests atomic.Int32
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == validateConfigPath {
+			requests.Add(1)
+			w.WriteHeader(http.StatusServiceUnavailable)
+			_, _ = w.Write([]byte(`{"error_code":"TEMPORARILY_UNAVAILABLE","message":"try again"}`))
+			return
+		}
+		_, _ = w.Write([]byte(`{}`))
+	}))
+	t.Cleanup(srv.Close)
+	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
+
+	err := preflightValidate(ctx, validationTestWorkspaceClient(t, srv.URL), baseRunConfig(), "/Workspace/Users/me/cmd.sh", nil, "token")
+	require.NoError(t, err)
+	assert.Equal(t, int32(1), requests.Load())
+	assert.Equal(t, "Warning: server-side config validation was unavailable; continuing with submission.\n", stderr.String())
+}
+
+func TestPreflightValidationDoesNotRetryTransportFailure(t *testing.T) {
+	var requests atomic.Int32
+	w := validationTestWorkspaceClientWithTransport(t, func(req *http.Request) (*http.Response, error) {
+		if req.URL.Path == validateConfigPath {
+			requests.Add(1)
+		}
+		return nil, errors.New("connection failed")
+	})
+
+	err := preflightValidate(t.Context(), w, baseRunConfig(), "/Workspace/Users/me/cmd.sh", nil, "token")
+	require.NoError(t, err)
+	assert.Equal(t, int32(1), requests.Load())
+}
+
+func TestPreflightValidationFailsOpenOnInvalidSuccessResponse(t *testing.T) {
+	tests := []struct {
+		name string
+		body func() io.ReadCloser
+	}{
+		{"body read failure", func() io.ReadCloser { return validationErrorReadCloser{} }},
+		{"malformed JSON", func() io.ReadCloser { return io.NopCloser(strings.NewReader("{")) }},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var requests atomic.Int32
+			w := validationTestWorkspaceClientWithTransport(t, func(req *http.Request) (*http.Response, error) {
+				body := io.NopCloser(strings.NewReader(`{}`))
+				if req.URL.Path == validateConfigPath {
+					requests.Add(1)
+					body = tt.body()
+				}
+				return &http.Response{
+					StatusCode: http.StatusOK,
+					Header:     http.Header{"Content-Type": []string{"application/json"}},
+					Body:       body,
+					Request:    req,
+				}, nil
+			})
+
+			err := preflightValidate(t.Context(), w, baseRunConfig(), "/Workspace/Users/me/cmd.sh", nil, "token")
+			require.NoError(t, err)
+			assert.Equal(t, int32(1), requests.Load())
+		})
+	}
+}
+
+func TestPreflightValidationBodyReadFailureOnCallerErrorBlocks(t *testing.T) {
+	w := validationTestWorkspaceClientWithTransport(t, func(req *http.Request) (*http.Response, error) {
+		body := io.NopCloser(strings.NewReader(`{}`))
+		status := http.StatusOK
+		if req.URL.Path == validateConfigPath {
+			body = validationContextReadCloser{ctx: req.Context()}
+			status = http.StatusUnauthorized
+		}
+		return &http.Response{
+			StatusCode: status,
+			Header:     http.Header{"Content-Type": []string{"application/json"}},
+			Body:       body,
+			Request:    req,
+		}, nil
+	})
+
+	ctx, cancel := context.WithTimeout(t.Context(), 50*time.Millisecond)
+	defer cancel()
+	err := preflightValidate(ctx, w, baseRunConfig(), "/Workspace/Users/me/cmd.sh", nil, "token")
+	require.Error(t, err)
+	apiErr, ok := errors.AsType[*apierr.APIError](err)
+	require.True(t, ok)
+	assert.Equal(t, http.StatusUnauthorized, apiErr.StatusCode)
+}
+
+func TestPreflightValidationOAuthRefreshUsesDeadline(t *testing.T) {
+	refreshStarted := make(chan struct{})
+	tokenSource := sdkauth.NewCachedTokenSource(
+		sdkauth.TokenSourceFn(func(ctx context.Context) (*oauth2.Token, error) {
+			close(refreshStarted)
+			<-ctx.Done()
+			return nil, ctx.Err()
+		}),
+		sdkauth.WithCachedToken(&oauth2.Token{
+			AccessToken: "expired",
+			Expiry:      time.Now().Add(-time.Hour),
+		}),
+	)
+	w, err := databricks.NewWorkspaceClient(&databricks.Config{
+		Host:        "https://example.test",
+		Credentials: validationOAuthCredentials{tokenSource: tokenSource},
+		HTTPTransport: validationRoundTripFunc(func(*http.Request) (*http.Response, error) {
+			t.Fatal("validation request should not be sent")
+			return nil, nil
+		}),
+		HostMetadataResolver: func(context.Context, string) (*sdkconfig.HostMetadata, error) {
+			return &sdkconfig.HostMetadata{}, nil
+		},
+	})
+	require.NoError(t, err)
+
+	ctx, cancel := context.WithTimeout(t.Context(), 50*time.Millisecond)
+	defer cancel()
+	started := time.Now()
+	err = preflightValidate(ctx, w, baseRunConfig(), "/Workspace/Users/me/cmd.sh", nil, "token")
+
+	require.NoError(t, err)
+	assert.Less(t, time.Since(started), time.Second)
+	select {
+	case <-refreshStarted:
+	default:
+		t.Fatal("OAuth token refresh did not start")
+	}
+}
+
+func TestPreflightValidationM2MOAuthRejectionBlocks(t *testing.T) {
+	tests := []struct {
+		status  int
+		wantErr error
+	}{
+		{http.StatusBadRequest, apierr.ErrBadRequest},
+		{http.StatusUnauthorized, apierr.ErrUnauthenticated},
+		{http.StatusForbidden, apierr.ErrPermissionDenied},
+	}
+
+	for _, tt := range tests {
+		t.Run(http.StatusText(tt.status), func(t *testing.T) {
+			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				switch r.URL.Path {
+				case "/oidc/.well-known/oauth-authorization-server":
+					_ = json.NewEncoder(w).Encode(map[string]string{"token_endpoint": "http://" + r.Host + "/token"})
+				case "/token":
+					w.WriteHeader(tt.status)
+					_, _ = w.Write([]byte(`{"error":"invalid_client"}`))
+				}
+			}))
+			t.Cleanup(srv.Close)
+
+			w, err := databricks.NewWorkspaceClient(&databricks.Config{
+				Host:         srv.URL,
+				ClientID:     "client-id",
+				ClientSecret: "client-secret",
+				AuthType:     "oauth-m2m",
+				DiscoveryURL: srv.URL + "/oidc/.well-known/oauth-authorization-server",
+				HostMetadataResolver: func(context.Context, string) (*sdkconfig.HostMetadata, error) {
+					return &sdkconfig.HostMetadata{}, nil
+				},
+			})
+			require.NoError(t, err)
+
+			err = preflightValidate(t.Context(), w, baseRunConfig(), "/Workspace/Users/me/cmd.sh", nil, "token")
+			require.ErrorIs(t, err, tt.wantErr)
+		})
+	}
+}
+
+func TestPreflightValidationTimeoutFailsOpen(t *testing.T) {
+	releaseRequest := make(chan struct{})
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == validateConfigPath {
+			<-releaseRequest
+			return
+		}
+		_, _ = w.Write([]byte(`{}`))
+	}))
+	t.Cleanup(srv.Close)
+
+	ctx, cancel := context.WithTimeout(t.Context(), 50*time.Millisecond)
+	defer cancel()
+	started := time.Now()
+	err := preflightValidate(ctx, validationTestWorkspaceClient(t, srv.URL), baseRunConfig(), "/Workspace/Users/me/cmd.sh", nil, "token")
+	close(releaseRequest)
+	require.NoError(t, err)
+	assert.Less(t, time.Since(started), time.Second)
+}
+
+func TestPreflightValidationPropagatesCancellation(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == validateConfigPath {
+			<-r.Context().Done()
+			return
+		}
+		_, _ = w.Write([]byte(`{}`))
+	}))
+	t.Cleanup(srv.Close)
+
+	ctx, cancel := context.WithCancel(t.Context())
+	cancel()
+	err := preflightValidate(ctx, validationTestWorkspaceClient(t, srv.URL), baseRunConfig(), "/Workspace/Users/me/cmd.sh", nil, "token")
+	require.ErrorIs(t, err, context.Canceled)
+}
+
+func TestPreflightValidationPropagatesCancellationWhileReadingErrorResponse(t *testing.T) {
+	validationStarted := make(chan struct{})
+	w := validationTestWorkspaceClientWithTransport(t, func(req *http.Request) (*http.Response, error) {
+		body := io.NopCloser(strings.NewReader(`{}`))
+		if req.URL.Path == validateConfigPath {
+			close(validationStarted)
+			body = validationContextReadCloser{ctx: req.Context()}
+		}
+		return &http.Response{
+			StatusCode: http.StatusServiceUnavailable,
+			Header:     http.Header{"Content-Type": []string{"application/json"}},
+			Body:       body,
+			Request:    req,
+		}, nil
+	})
+
+	ctx, cancel := context.WithCancel(t.Context())
+	go func() {
+		<-validationStarted
+		cancel()
+	}()
+	err := preflightValidate(ctx, w, baseRunConfig(), "/Workspace/Users/me/cmd.sh", nil, "token")
+	require.ErrorIs(t, err, context.Canceled)
+}
+
+func TestPreflightValidateBlocksOnCallerError(t *testing.T) {
+	for _, status := range []int{http.StatusBadRequest, http.StatusUnauthorized, http.StatusForbidden} {
+		t.Run(http.StatusText(status), func(t *testing.T) {
+			srv := validateServer(t, status, `{"error_code":"INVALID_PARAMETER_VALUE","message":"request rejected"}`, nil)
+			err := preflightValidate(t.Context(), validationTestWorkspaceClient(t, srv.URL), baseRunConfig(), "/Workspace/Users/me/cmd.sh", nil, "token")
+			require.Error(t, err)
+		})
+	}
+}
+
+func TestPreflightValidateBlocksOnRequestVisitorError(t *testing.T) {
+	srv := validateServer(t, http.StatusOK, `{}`, nil)
+	w := validationTestWorkspaceClient(t, srv.URL)
+	w.Config.Headers = func(*http.Request) error {
+		return errors.New("failed to add request headers")
+	}
+
+	err := preflightValidate(t.Context(), w, baseRunConfig(), "/Workspace/Users/me/cmd.sh", nil, "token")
+	require.ErrorContains(t, err, "failed to add request headers")
+}
+
+func TestClassifyValidationFailure(t *testing.T) {
+	tests := []struct {
+		name            string
+		err             error
+		wantUnavailable bool
+		wantRetryable   bool
+	}{
+		{"canceled", context.Canceled, false, false},
+		{"deadline", context.DeadlineExceeded, true, true},
+		{"transport", &url.Error{Op: "Post", URL: "https://example.test", Err: errors.New("connection failed")}, true, true},
+		{"unknown", errors.New("authentication visitor failed"), false, false},
+		{"bad request", &apierr.APIError{StatusCode: http.StatusBadRequest}, false, false},
+		{"disabled", &apierr.APIError{StatusCode: http.StatusBadRequest, ErrorCode: "FEATURE_DISABLED"}, true, false},
+		{"unauthenticated", &apierr.APIError{StatusCode: http.StatusUnauthorized}, false, false},
+		{"forbidden", &apierr.APIError{StatusCode: http.StatusForbidden}, false, false},
+		{"not found", &apierr.APIError{StatusCode: http.StatusNotFound}, true, false},
+		{"not implemented", &apierr.APIError{StatusCode: http.StatusNotImplemented}, true, false},
+		{"request timeout", &apierr.APIError{StatusCode: http.StatusRequestTimeout}, true, true},
+		{"rate limited", &apierr.APIError{StatusCode: http.StatusTooManyRequests}, true, true},
+		{"server error", &apierr.APIError{StatusCode: http.StatusInternalServerError}, true, true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			unavailable, retryable := classifyValidationFailure(tt.err)
+			assert.Equal(t, tt.wantUnavailable, unavailable)
+			assert.Equal(t, tt.wantRetryable, retryable)
+		})
+	}
+}
+
+func TestValidateConfigRequestShape(t *testing.T) {
+	var gotReq map[string]any
+	srv := validateServer(t, http.StatusOK, `{}`, &gotReq)
+
+	cfg := baseRunConfig()
+	cfg.MaxRetries = new(3)
+	cfg.EnvVariables = map[string]string{"HF_HOME": "/tmp/hf"}
+	cfg.Environment = &environmentConfig{UnityCatalogImage: "main.air.training:v1"}
+	err := preflightValidate(t.Context(), validationTestWorkspaceClient(t, srv.URL), cfg, "/Workspace/Users/me/cmd.sh", nil, "token")
+	require.NoError(t, err)
+
+	task := gotReq["task"].(map[string]any)
+	assert.Equal(t, "llama-fine-tune", task["experiment"])
+	deployment := task["deployments"].([]any)[0].(map[string]any)
+	compute := deployment["compute"].(map[string]any)
+	assert.Equal(t, "GPU_8xH100", compute["accelerator_type"])
+	assert.EqualValues(t, 16, compute["accelerator_count"])
+	assert.Equal(t, "main.air.training:v1", task["unity_catalog_image_path"])
+
+	runOptions := gotReq["run_options"].(map[string]any)
+	assert.Equal(t, "token", runOptions["idempotency_token"])
+	assert.EqualValues(t, 3, runOptions["max_retries"])
+	assert.Equal(t, map[string]any{"HF_HOME": "/tmp/hf"}, runOptions["env_variables"])
+}
+
+func TestValidateConfigRequestCarriesPriorityClass(t *testing.T) {
+	var gotReq map[string]any
+	srv := validateServer(t, http.StatusOK, `{}`, &gotReq)
+
+	cfg := baseRunConfig()
+	cfg.Compute.PoolID = new("cap-8xh100-res")
+	cfg.Compute.PriorityClass = new("CRITICAL")
+	err := preflightValidate(t.Context(), validationTestWorkspaceClient(t, srv.URL), cfg, "/Workspace/Users/me/cmd.sh", nil, "token")
+	require.NoError(t, err)
+
+	task := gotReq["task"].(map[string]any)
+	// priority_class is task-level; provisioned_capacity_id stays on the compute spec.
+	assert.Equal(t, "CRITICAL", task["priority_class"])
+	compute := task["deployments"].([]any)[0].(map[string]any)["compute"].(map[string]any)
+	assert.Equal(t, "cap-8xh100-res", compute["provisioned_capacity_id"])
+}
+
+func TestValidateConfigRequestOmitsUnsetOptions(t *testing.T) {
+	var gotReq map[string]any
+	srv := validateServer(t, http.StatusOK, `{}`, &gotReq)
+
+	err := preflightValidate(t.Context(), validationTestWorkspaceClient(t, srv.URL), baseRunConfig(), "/Workspace/Users/me/cmd.sh", nil, "token")
+	require.NoError(t, err)
+
+	assert.Equal(t, map[string]any{"idempotency_token": "token"}, gotReq["run_options"])
+	task := gotReq["task"].(map[string]any)
+	_, hasMlflowRun := task["mlflow_run"]
+	assert.False(t, hasMlflowRun)
+}
+
+func TestValidateConfigRequestCarriesEnvironment(t *testing.T) {
+	cfg := baseRunConfig()
+	cfg.Environment = &environmentConfig{
+		Version:      stringOrInt{set: true, raw: "databricks_ai_v6"},
+		Dependencies: dependencies{set: true, list: []string{"torch==2.3.0", "numpy"}},
+	}
+
+	request := validateConfigRequest(t.Context(), cfg, "/Workspace/Users/me/cmd.sh", nil, "token")
+	raw, err := json.Marshal(request["environment"])
+	require.NoError(t, err)
+	assert.JSONEq(t, `{"base_environment":"workspace-base-environments/databricks_ai_v6","dependencies":["torch==2.3.0","numpy"]}`, string(raw))
+}
diff --git a/cmd/aitools/aitools.go b/cmd/aitools/aitools.go
new file mode 100644
index 00000000000..451e8cee523
--- /dev/null
+++ b/cmd/aitools/aitools.go
@@ -0,0 +1,30 @@
+package aitools
+
+import (
+	"strings"
+
+	"github.com/databricks/cli/libs/aitools/agents"
+	"github.com/spf13/cobra"
+)
+
+func NewAitoolsCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "aitools",
+		Short: "Databricks skills and plugins for coding agents",
+		Long: `Install Databricks skills and plugins into your coding agent so it can work
+effectively with Databricks resources (bundles, jobs, SQL, and more).
+
+Supported agents: ` + strings.Join(agents.SupportedNames(), ", ") + `.
+
+Skills and plugins are sourced from
+https://github.com/databricks/databricks-agent-skills`,
+	}
+
+	cmd.AddCommand(NewInstallCmd())
+	cmd.AddCommand(NewUpdateCmd())
+	cmd.AddCommand(NewUninstallCmd())
+	cmd.AddCommand(NewListCmd())
+	cmd.AddCommand(NewVersionCmd())
+
+	return cmd
+}
diff --git a/cmd/aitools/categorize.go b/cmd/aitools/categorize.go
new file mode 100644
index 00000000000..b4ed1265f7a
--- /dev/null
+++ b/cmd/aitools/categorize.go
@@ -0,0 +1,46 @@
+package aitools
+
+import (
+	"errors"
+
+	"github.com/databricks/cli/libs/aitools/installer"
+	"github.com/databricks/cli/libs/telemetry/protos"
+)
+
+func classifyInstallError(err error) protos.AitoolsErrorCategory {
+	if err == nil {
+		return protos.AitoolsErrorCategoryUnspecified
+	}
+
+	if blocked, ok := errors.AsType[*installer.BlockedError](err); ok {
+		return blockedErrorCategory(blocked)
+	}
+	if skill, ok := errors.AsType[*installer.SkillError](err); ok {
+		return skillErrorCategory(skill)
+	}
+	return protos.AitoolsErrorCategoryUncategorized
+}
+
+func skillErrorCategory(e *installer.SkillError) protos.AitoolsErrorCategory {
+	switch e.Reason {
+	case installer.ReasonSkillNotFound:
+		return protos.AitoolsErrorCategorySkillNotFound
+	case installer.ReasonVersionIncompatible:
+		return protos.AitoolsErrorCategoryVersionIncompatible
+	case installer.ReasonExperimentalSkill:
+		return protos.AitoolsErrorCategoryExperimentalSkill
+	default:
+		return protos.AitoolsErrorCategoryUncategorized
+	}
+}
+
+func blockedErrorCategory(e *installer.BlockedError) protos.AitoolsErrorCategory {
+	switch e.Reason {
+	case installer.ReasonCLINotOnPath:
+		return protos.AitoolsErrorCategoryCLINotOnPath
+	case installer.ReasonInstallFailed:
+		return protos.AitoolsErrorCategoryPluginInstallFailed
+	default:
+		return protos.AitoolsErrorCategoryUncategorized
+	}
+}
diff --git a/cmd/aitools/categorize_test.go b/cmd/aitools/categorize_test.go
new file mode 100644
index 00000000000..03e6a94904b
--- /dev/null
+++ b/cmd/aitools/categorize_test.go
@@ -0,0 +1,75 @@
+package aitools
+
+import (
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/databricks/cli/libs/aitools/installer"
+	"github.com/databricks/cli/libs/telemetry/protos"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestClassifyInstallError(t *testing.T) {
+	cases := []struct {
+		name string
+		err  error
+		want protos.AitoolsErrorCategory
+	}{
+		{
+			name: "nil is success",
+			err:  nil,
+			want: protos.AitoolsErrorCategoryUnspecified,
+		},
+		{
+			name: "blocked cli not on path",
+			err:  &installer.BlockedError{Agent: "claude-code", Reason: installer.ReasonCLINotOnPath},
+			want: protos.AitoolsErrorCategoryCLINotOnPath,
+		},
+		{
+			name: "blocked install failed",
+			err:  &installer.BlockedError{Agent: "codex", Reason: installer.ReasonInstallFailed},
+			want: protos.AitoolsErrorCategoryPluginInstallFailed,
+		},
+		{
+			name: "blocked error with unknown reason is uncategorized",
+			err:  &installer.BlockedError{Agent: "codex", Reason: "some-future-reason"},
+			want: protos.AitoolsErrorCategoryUncategorized,
+		},
+		{
+			name: "wrapped skill not found",
+			err:  fmt.Errorf("resolve failed: %w", &installer.SkillError{Skill: "databricks", Reason: installer.ReasonSkillNotFound, Detail: "not found"}),
+			want: protos.AitoolsErrorCategorySkillNotFound,
+		},
+		{
+			name: "version incompatible",
+			err:  &installer.SkillError{Skill: "databricks", Reason: installer.ReasonVersionIncompatible, Detail: "requires CLI version 0.5 (running 0.4)"},
+			want: protos.AitoolsErrorCategoryVersionIncompatible,
+		},
+		{
+			name: "experimental skill",
+			err:  &installer.SkillError{Skill: "test-exp", Reason: installer.ReasonExperimentalSkill, Detail: "is experimental; use --experimental to install"},
+			want: protos.AitoolsErrorCategoryExperimentalSkill,
+		},
+		{
+			name: "skill error with unknown reason is uncategorized",
+			err:  &installer.SkillError{Skill: "databricks", Reason: "some-future-reason"},
+			want: protos.AitoolsErrorCategoryUncategorized,
+		},
+		{
+			name: "blocked error joined with another error is still classified",
+			err:  errors.Join(&installer.BlockedError{Agent: "codex", Reason: installer.ReasonInstallFailed}, errors.New("other")),
+			want: protos.AitoolsErrorCategoryPluginInstallFailed,
+		},
+		{
+			name: "unrecognized error is uncategorized",
+			err:  errors.New("boom"),
+			want: protos.AitoolsErrorCategoryUncategorized,
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, classifyInstallError(tc.err))
+		})
+	}
+}
diff --git a/experimental/aitools/cmd/flags.go b/cmd/aitools/flags.go
similarity index 100%
rename from experimental/aitools/cmd/flags.go
rename to cmd/aitools/flags.go
diff --git a/experimental/aitools/cmd/flags_test.go b/cmd/aitools/flags_test.go
similarity index 100%
rename from experimental/aitools/cmd/flags_test.go
rename to cmd/aitools/flags_test.go
diff --git a/cmd/aitools/install.go b/cmd/aitools/install.go
new file mode 100644
index 00000000000..695e58108c9
--- /dev/null
+++ b/cmd/aitools/install.go
@@ -0,0 +1,689 @@
+package aitools
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+
+	"github.com/charmbracelet/huh"
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/aitools/agents"
+	"github.com/databricks/cli/libs/aitools/installer"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/telemetry/protos"
+	"github.com/spf13/cobra"
+)
+
+// Package-level seams for testability. Tests override these via helpers in
+// install_test.go.
+var (
+	promptAgentSelection     = defaultPromptAgentSelection
+	promptProceed            = defaultPromptProceed
+	installSkillsForAgentsFn = installer.InstallSkillsForAgents
+	installPluginForAgentFn  = installer.InstallPluginForAgent
+	recordPluginInstallsFn   = installer.RecordPluginInstalls
+	cleanupLegacyFn          = installer.RemoveLegacyRawSkills
+)
+
+// delivery is how the databricks tools are delivered to one agent.
+type delivery int
+
+const (
+	// deliveryPlugin installs the databricks plugin through the agent's own CLI.
+	deliveryPlugin delivery = iota
+	// deliverySkills copies raw skill files (agents with no headless plugin
+	// install: OpenCode, Antigravity, Cursor; or any agent under --skills-only).
+	deliverySkills
+	// deliverySkip does nothing for the agent and explains why.
+	deliverySkip
+)
+
+// String returns the delivery name used in `list --output json`, so the install
+// plan and the list output name the same thing the same way.
+func (d delivery) String() string {
+	switch d {
+	case deliveryPlugin:
+		return "plugin"
+	case deliverySkills:
+		return "skills"
+	case deliverySkip:
+		return "skip"
+	default:
+		return "unknown"
+	}
+}
+
+// agentPlanItem is the resolved plan for one agent: what we'll do and why.
+type agentPlanItem struct {
+	agent             *agents.Agent
+	delivery          delivery
+	scope             string                      // agent-native plugin scope (deliveryPlugin only)
+	reason            string                      // why the agent is skipped (deliverySkip only)
+	skipErrorCategory protos.AitoolsErrorCategory // error category for the skip (deliverySkip only)
+	explicit          bool                        // named via --agents (blocking it is an error)
+}
+
+// agentChoice is one row in the interactive agent picker.
+type agentChoice struct {
+	agent     *agents.Agent
+	label     string
+	preselect bool
+}
+
+func NewInstallCmd() *cobra.Command {
+	var skillsFlag, agentsFlag, scopeFlag, pathFlag string
+	var includeExperimental, skillsOnly bool
+	var projectFlag, globalFlag bool
+
+	cmd := &cobra.Command{
+		Use: "install",
+		// Resolve auth best-effort so telemetry can upload; see tryConfigureAuth.
+		PreRunE: tryConfigureAuth,
+		Short:   "Install Databricks skills and plugins for coding agents",
+		Long: `Install Databricks skills and plugins for detected coding agents.
+
+By default this installs the databricks plugin through each agent's own CLI
+(Claude Code, Codex, GitHub Copilot). Agents without a headless plugin install
+(` + strings.Join(agents.SkillsOnlyNames(), ", ") + `) get raw skill files.
+
+Escape hatches:
+  --skills-only          Force raw skill files for every agent (no plugin).
+  --skills name1,name2   Install only the named skills (with --skills-only/--path).
+  --path <dir>           Write resolved skill files to a directory (no agents, no state).
+
+Agent selection:
+  --agents <name>[,...]  Act only on the named agents (works for undetected ones).
+  (unset, interactive)   A picker over all known agents, detected ones pre-checked.
+  (unset, non-interactive) Act on every detected agent.
+
+Output:
+  --output json          Emit a structured result instead of text. Requires --scope
+                         and --agents so the command runs without interactive prompts.
+
+Supported agents: ` + strings.Join(agents.SupportedNames(), ", "),
+		Args: cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			ctx := cmd.Context()
+			jsonMode := installOutputIsJSON(cmd)
+			if jsonMode {
+				// JSON mode emits only the structured result on stdout; silence all
+				// human-readable progress (via cmdio.LogProgress) so nothing but the
+				// JSON document is written.
+				ctx = cmdio.WithQuiet(ctx)
+			}
+
+			if skillsOnly && pathFlag != "" {
+				return errors.New("cannot use --skills-only with --path; --path always writes raw skill files")
+			}
+
+			// --path is a plain file dump with no agents or install state, so there
+			// is no per-agent result to report. Reject --output json here rather than
+			// letting the dump run and silently emit no JSON.
+			if jsonMode && pathFlag != "" {
+				return errors.New("cannot use --output json with --path; --path writes raw skill files and produces no JSON result")
+			}
+
+			opts := installer.InstallOptions{
+				IncludeExperimental: includeExperimental,
+				SpecificSkills:      splitAndTrim(skillsFlag),
+			}
+
+			// --skills cherry-picks individual skill files, which only applies to
+			// raw-skills delivery. The plugin is installed in full, so reject
+			// --skills unless raw skills were requested via --skills-only or --path.
+			if len(opts.SpecificSkills) > 0 && !skillsOnly && pathFlag == "" {
+				return errors.New("--skills requires --skills-only or --path; the databricks plugin is installed in full")
+			}
+
+			src := &installer.GitHubManifestSource{}
+
+			// --path is a dumb dump: no agents, no scope, no state.
+			if pathFlag != "" {
+				_, err := installer.DumpSkillsToPath(ctx, src, pathFlag, opts)
+				return err
+			}
+
+			projectFlag, globalFlag, err := parseScopeFlag(scopeFlag, projectFlag, globalFlag, false)
+			if err != nil {
+				return err
+			}
+
+			// JSON output must be fully non-interactive: every choice has to come
+			// from flags so no scope prompt, agent picker, or confirm is shown.
+			// Require the flags those prompts would otherwise resolve, and fail
+			// fast naming them.
+			if jsonMode {
+				var missing []string
+				if !projectFlag && !globalFlag {
+					missing = append(missing, "--scope")
+				}
+				if agentsFlag == "" {
+					missing = append(missing, "--agents")
+				}
+				if len(missing) > 0 {
+					return fmt.Errorf("--output json requires %s so the command runs without interactive prompts", strings.Join(missing, " and "))
+				}
+			}
+
+			scope, err := resolveScopeWithPrompt(ctx, projectFlag, globalFlag)
+			if err != nil {
+				return err
+			}
+			opts.Scope = scope
+
+			// Resolve the agents to act on.
+			var targetAgents []*agents.Agent
+			explicit := agentsFlag != ""
+			if explicit {
+				targetAgents, err = resolveAgentNames(ctx, agentsFlag)
+				if err != nil {
+					return err
+				}
+			} else {
+				targetAgents, err = selectAgents(ctx, scope, skillsOnly)
+				if err != nil {
+					return err
+				}
+				if len(targetAgents) == 0 {
+					printNoAgentsMessage(ctx)
+					return nil
+				}
+			}
+
+			plan := buildPlan(targetAgents, scope, skillsOnly, explicit)
+
+			// In the interactive picker path, show a plan summary and confirm.
+			if !explicit && cmdio.IsPromptSupported(ctx) {
+				printPlanSummary(ctx, plan, scope)
+				proceed, err := promptProceed()
+				if err != nil {
+					return err
+				}
+				if !proceed {
+					cmdio.LogString(ctx, "Cancelled.")
+					return nil
+				}
+			}
+
+			var outcomes []agentOutcome
+			var runErr error
+			defer func() {
+				logInstallEvent(ctx, plan, installOpts{
+					Scope:        opts.Scope,
+					Experimental: opts.IncludeExperimental,
+				}, classifyInstallError(topLevelFailure(runErr)), outcomes)
+			}()
+
+			outcomes, runErr = executePlan(ctx, src, plan, opts, jsonMode)
+
+			if jsonMode {
+				if jerr := renderJSON(cmd.OutOrStdout(), buildInstallOutput(opts.Scope, outcomes, runErr)); jerr != nil {
+					// Rendering failed, so the JSON the caller parses is broken.
+					// Report the render error unless the run already failed for
+					// another reason.
+					if runErr == nil {
+						runErr = jerr
+					}
+					return runErr
+				}
+				// The JSON payload is the only thing on stdout and already reports
+				// the outcome. On failure, exit non-zero without root printing a
+				// duplicate "Error: ..." line to stderr; root prints errors itself
+				// (see cmd/root/root.go), so ErrAlreadyPrinted is how a command
+				// opts out of that
+				if runErr != nil {
+					return root.ErrAlreadyPrinted
+				}
+				return nil
+			}
+			return runErr
+		},
+	}
+
+	cmd.Flags().StringVar(&skillsFlag, "skills", "", "Specific skills to install (comma-separated)")
+	cmd.Flags().StringVar(&agentsFlag, "agents", "", "Agents to install for (comma-separated, e.g. claude-code,cursor)")
+	cmd.Flags().BoolVar(&includeExperimental, "experimental", false, "Include experimental skills")
+	cmd.Flags().BoolVar(&skillsOnly, "skills-only", false, "Force raw skill files for every agent instead of the plugin")
+	cmd.Flags().StringVar(&pathFlag, "path", "", "Write resolved skill files to this directory (no agents, no state)")
+	cmd.Flags().StringVar(&scopeFlag, "scope", "", "Install scope: project or global (default: global, or prompt when interactive)")
+	cmd.Flags().BoolVar(&projectFlag, "project", false, "Install to project directory (cwd)")
+	cmd.Flags().BoolVar(&globalFlag, "global", false, "Install globally (default)")
+	markScopeBoolsDeprecated(cmd)
+	return cmd
+}
+
+// installOutputIsJSON reports whether --output json was requested. Unlike list,
+// install can run detached from root: the legacy `skills install` alias builds a
+// NewInstallCmd and executes it directly (see newLegacySkillsInstallCmd), so the
+// root-supplied --output flag may be absent. Treat a missing flag as text rather
+// than panicking the way root.OutputType would.
+func installOutputIsJSON(cmd *cobra.Command) bool {
+	f := cmd.Flag("output")
+	if f == nil {
+		return false
+	}
+	out, ok := f.Value.(*flags.Output)
+	return ok && *out == flags.OutputJSON
+}
+
+// selectAgents returns the agents to act on when --agents is not given. The
+// interactive path shows a picker over all known agents; the non-interactive
+// path acts on detected agents, matching today's default. Skills delivery only
+// needs a config dir, so in --skills-only mode an agent is "detected" by its
+// config dir (PATH-independent); plugin delivery additionally detects agents by
+// their CLI binary on PATH, which fixes the Codex/Copilot config-dir miss.
+func selectAgents(ctx context.Context, scope string, skillsOnly bool) ([]*agents.Agent, error) {
+	// Interactive: the picker decides; a prompt error or empty selection is a real
+	// error, not a "nothing detected" no-op.
+	if cmdio.IsPromptSupported(ctx) {
+		choices := agentChoices(ctx, scope, skillsOnly)
+		if len(choices) == 0 {
+			// Agents were detected but none can be acted on in this scope; the
+			// caller prints the no-agents message rather than showing an empty picker.
+			return nil, nil
+		}
+		return promptAgentSelection(ctx, choices)
+	}
+
+	var selected []*agents.Agent
+	for _, a := range agents.Registry {
+		detected := a.Detected(ctx)
+		if !skillsOnly {
+			detected = detected || a.HasBinary(ctx)
+		}
+		if detected {
+			selected = append(selected, a)
+		}
+	}
+	return selected, nil
+}
+
+// agentChoices builds the interactive picker rows. Every detected agent is shown
+// in the detection list with its state, but only agents that can actually be
+// acted on in the chosen scope (plugin or skills delivery) become selectable
+// options. Agents that would be skipped (e.g. a files-only agent under project
+// scope) are listed with their reason but are not checkboxes, so the picker never
+// offers an option that does nothing.
+func agentChoices(ctx context.Context, scope string, skillsOnly bool) []agentChoice {
+	cmdio.LogString(ctx, "Detecting coding agents...")
+	var choices []agentChoice
+	for _, a := range agents.Registry {
+		item := planItemFor(a, scope, skillsOnly, false)
+		label := agentChoiceLabel(ctx, a, item)
+		cmdio.LogString(ctx, fmt.Sprintf("  %-16s %s", a.DisplayName, label))
+		if item.delivery == deliverySkip {
+			continue
+		}
+		choices = append(choices, agentChoice{
+			agent:     a,
+			label:     a.DisplayName + "  " + label,
+			preselect: a.IsPreselected(ctx),
+		})
+	}
+	return choices
+}
+
+// agentChoiceLabel is the picker label: the detection state, plus the skip
+// reason when the agent can't be acted on in the chosen scope.
+func agentChoiceLabel(ctx context.Context, a *agents.Agent, item agentPlanItem) string {
+	label := agentStateLabel(a.DisplayState(ctx))
+	if item.delivery == deliverySkip {
+		return label + " · " + item.reason
+	}
+	return label
+}
+
+// agentStateLabel is the short human label for a detection state.
+func agentStateLabel(s agents.DisplayState) string {
+	switch s {
+	case agents.StateAvailable:
+		return "plugin"
+	case agents.StateInstalledCLIMissing:
+		return "plugin · CLI not found"
+	case agents.StateFilesOnly:
+		return "skills"
+	default:
+		return "not found"
+	}
+}
+
+func defaultPromptProceed() (bool, error) {
+	proceed := true
+	err := huh.NewConfirm().
+		Title("Proceed?").
+		Value(&proceed).
+		Run()
+	if err != nil {
+		return false, err
+	}
+	return proceed, nil
+}
+
+func defaultPromptAgentSelection(_ context.Context, choices []agentChoice) ([]*agents.Agent, error) {
+	options := make([]huh.Option[string], 0, len(choices))
+	byName := make(map[string]*agents.Agent, len(choices))
+	for _, c := range choices {
+		options = append(options, huh.NewOption(c.label, c.agent.Name).Selected(c.preselect))
+		byName[c.agent.Name] = c.agent
+	}
+
+	var selected []string
+	err := huh.NewMultiSelect[string]().
+		Title("Select agents to set up").
+		Description("space to toggle, enter to confirm").
+		Options(options...).
+		Value(&selected).
+		Run()
+	if err != nil {
+		return nil, err
+	}
+	if len(selected) == 0 {
+		return nil, errors.New("at least one agent must be selected")
+	}
+
+	result := make([]*agents.Agent, 0, len(selected))
+	for _, name := range selected {
+		result = append(result, byName[name])
+	}
+	return result, nil
+}
+
+// buildPlan resolves the per-agent delivery and scope. Plugin-first: an agent
+// with a headless plugin install gets the plugin; --skills-only forces skills
+// everywhere; agents with no plugin always get skills.
+func buildPlan(targetAgents []*agents.Agent, scope string, skillsOnly, explicit bool) []agentPlanItem {
+	plan := make([]agentPlanItem, 0, len(targetAgents))
+	for _, a := range targetAgents {
+		plan = append(plan, planItemFor(a, scope, skillsOnly, explicit))
+	}
+	return plan
+}
+
+// planItemFor resolves the delivery and scope for a single agent in the given
+// install scope. It is shared by buildPlan and the interactive picker so the
+// picker and the plan agree on what an agent will (or won't) do.
+func planItemFor(a *agents.Agent, scope string, skillsOnly, explicit bool) agentPlanItem {
+	item := agentPlanItem{agent: a, explicit: explicit}
+	switch {
+	case skillsOnly || a.Plugin == nil:
+		// Raw-skills delivery (no-plugin agents, or --skills-only). Only some agents
+		// support project-scoped skills, so skip the rest up front instead of
+		// offering an option that fails at install time.
+		if scope == installer.ScopeProject && !a.SupportsProjectScope {
+			item.delivery = deliverySkip
+			item.reason = "does not support project-scoped skills"
+			item.skipErrorCategory = protos.AitoolsErrorCategoryUnsupportedScope
+		} else {
+			item.delivery = deliverySkills
+		}
+	default:
+		nativeScope, ok, reason := mapAgentScope(a, scope)
+		if !ok {
+			item.delivery = deliverySkip
+			item.reason = reason
+			item.skipErrorCategory = protos.AitoolsErrorCategoryUnsupportedScope
+		} else {
+			item.delivery = deliveryPlugin
+			item.scope = nativeScope
+		}
+	}
+	return item
+}
+
+// printPlanSummary renders the interactive plan summary before the confirm.
+func printPlanSummary(ctx context.Context, plan []agentPlanItem, scope string) {
+	cmdio.LogString(ctx, "")
+	cmdio.LogString(ctx, "Plan ("+scope+" scope):")
+	for _, it := range plan {
+		switch it.delivery {
+		case deliveryPlugin:
+			cmdio.LogString(ctx, "  "+it.agent.DisplayName+"  install the databricks plugin")
+		case deliverySkills:
+			cmdio.LogString(ctx, "  "+it.agent.DisplayName+"  install skills")
+		case deliverySkip:
+			cmdio.LogString(ctx, "  "+it.agent.DisplayName+"  skip ("+it.reason+")")
+		}
+	}
+	cmdio.LogString(ctx, "")
+}
+
+// agentOutcome is one agent's result after executePlan: how the databricks
+// tools were delivered (or attempted), and, when the agent did not succeed, the
+// failure category and a human-readable message for --output json. The category
+// is what telemetry records; the message is local-only and never sent.
+type agentOutcome struct {
+	agent         *agents.Agent
+	delivery      delivery
+	status        outcomeStatus
+	errorCategory protos.AitoolsErrorCategory // Unspecified when status == outcomeInstalled
+	message       string                      // set when skipped or failed
+}
+
+type outcomeStatus string
+
+const (
+	outcomeInstalled outcomeStatus = "installed"
+	outcomeSkipped   outcomeStatus = "skipped"
+	outcomeFailed    outcomeStatus = "failed"
+)
+
+// agentErrors wraps the failures of explicitly named agents, which are already
+// reported in their per-agent outcomes. Wrapping lets the JSON and telemetry
+// layers tell a per-agent failure apart from a top-level failure that has no
+// per-agent entry, so each is surfaced exactly once.
+type agentErrors struct{ err error }
+
+func (e *agentErrors) Error() string { return e.err.Error() }
+func (e *agentErrors) Unwrap() error { return e.err }
+
+// topLevelFailure returns the run error when it has no per-agent entry, or nil
+// when the failure is already reported per agent — so a per-agent failure is not
+// duplicated in the top-level error/errorCategory fields.
+func topLevelFailure(runErr error) error {
+	if _, ok := errors.AsType[*agentErrors](runErr); ok {
+		return nil
+	}
+	return runErr
+}
+
+// executePlan carries out the plan and returns each agent's outcome. Skills
+// installs go through the existing skills path. Plugin installs are reported but
+// never silently fall back to skills: a blocked install is a warning (exit 0),
+// unless the agent was explicitly named via --agents, which is an error.
+func executePlan(ctx context.Context, src installer.ManifestSource, plan []agentPlanItem, opts installer.InstallOptions, quiet bool) ([]agentOutcome, error) {
+	var skillsAgents []*agents.Agent
+	var pluginItems, skipItems []agentPlanItem
+	for _, it := range plan {
+		switch it.delivery {
+		case deliverySkills:
+			skillsAgents = append(skillsAgents, it.agent)
+		case deliveryPlugin:
+			pluginItems = append(pluginItems, it)
+		case deliverySkip:
+			skipItems = append(skipItems, it)
+		}
+	}
+
+	var outcomes []agentOutcome
+	var explicitErrs []error
+
+	if len(skillsAgents) > 0 {
+		if !quiet {
+			installer.PrintInstallingFor(ctx, skillsAgents)
+		}
+		// A skills install runs as a group; on failure the whole command fails and
+		// the top-level error category classifies it.
+		if err := installSkillsForAgentsFn(ctx, src, skillsAgents, opts); err != nil {
+			return outcomes, err
+		}
+		for _, a := range skillsAgents {
+			outcomes = append(outcomes, agentOutcome{agent: a, delivery: deliverySkills, status: outcomeInstalled})
+		}
+	}
+
+	pluginCount := 0
+	if len(pluginItems) > 0 {
+		ref, _, err := installer.GetSkillsRef(ctx)
+		if err != nil {
+			return outcomes, err
+		}
+		records := map[string]installer.PluginRecord{}
+		for _, it := range pluginItems {
+			if !quiet {
+				cmdio.LogString(ctx, fmt.Sprintf("Installing databricks plugin for %s...", it.agent.DisplayName))
+			}
+			rec, err := installPluginForAgentFn(ctx, it.agent, it.scope, ref)
+			if err != nil {
+				if !quiet {
+					cmdio.LogString(ctx, cmdio.Yellow(ctx, fmt.Sprintf("Skipped %s: %v", it.agent.DisplayName, err)))
+				}
+				outcomes = append(outcomes, agentOutcome{
+					agent:         it.agent,
+					delivery:      deliveryPlugin,
+					status:        outcomeFailed,
+					errorCategory: classifyInstallError(err),
+					message:       err.Error(),
+				})
+				if it.explicit {
+					explicitErrs = append(explicitErrs, err)
+				}
+				continue
+			}
+			records[it.agent.Name] = rec
+			pluginCount++
+			outcomes = append(outcomes, agentOutcome{agent: it.agent, delivery: deliveryPlugin, status: outcomeInstalled})
+			// Remove any raw skills we previously dropped on this agent so the
+			// plugin and leftover files don't surface the same skills twice.
+			if err := cleanupLegacyFn(ctx, it.agent, opts.Scope); err != nil {
+				log.Debugf(ctx, "Legacy skill cleanup for %s failed: %v", it.agent.DisplayName, err)
+			}
+			if !quiet {
+				cmdio.LogString(ctx, fmt.Sprintf("  %s  databricks plugin %s", it.agent.DisplayName, versionToken(rec.Version)))
+			}
+		}
+		if len(records) > 0 {
+			if err := recordPluginInstallsFn(ctx, opts.Scope, records, ref); err != nil {
+				return outcomes, err
+			}
+		}
+	}
+
+	for _, it := range skipItems {
+		if !quiet {
+			cmdio.LogString(ctx, cmdio.Yellow(ctx, "Skipped "+it.agent.DisplayName+": "+it.reason))
+		}
+		outcomes = append(outcomes, agentOutcome{
+			agent:         it.agent,
+			delivery:      deliverySkip,
+			status:        outcomeSkipped,
+			errorCategory: it.skipErrorCategory,
+			message:       it.reason,
+		})
+		if it.explicit {
+			explicitErrs = append(explicitErrs, fmt.Errorf("%s: %s", it.agent.DisplayName, it.reason))
+		}
+	}
+
+	if pluginCount > 0 && !quiet {
+		noun := "agent"
+		if pluginCount != 1 {
+			noun = "agents"
+		}
+		cmdio.LogString(ctx, fmt.Sprintf("Installed the plugin for %d %s.", pluginCount, noun))
+	}
+
+	if len(explicitErrs) > 0 {
+		return outcomes, &agentErrors{err: errors.Join(explicitErrs...)}
+	}
+	return outcomes, nil
+}
+
+type installOutput struct {
+	Scope  string            `json:"scope"`
+	Agents []agentResultJSON `json:"agents"`
+
+	// Error and ErrorCategory describe a top-level failure with no per-agent
+	// entry (e.g. a skills-group install failure); both empty on success. Error
+	// is the local-only message; ErrorCategory is the classification telemetry
+	// also records.
+	Error         string `json:"error,omitempty"`
+	ErrorCategory string `json:"error_category,omitempty"`
+}
+
+type agentResultJSON struct {
+	Name          string `json:"name"`
+	Delivery      string `json:"delivery"`
+	Status        string `json:"status"`
+	ErrorCategory string `json:"error_category,omitempty"`
+	Message       string `json:"message,omitempty"`
+}
+
+func buildInstallOutput(scope string, outcomes []agentOutcome, runErr error) installOutput {
+	out := installOutput{Scope: scope, Agents: make([]agentResultJSON, 0, len(outcomes))}
+	for _, o := range outcomes {
+		entry := agentResultJSON{
+			Name:     o.agent.Name,
+			Delivery: o.delivery.String(),
+			Status:   string(o.status),
+			Message:  o.message,
+		}
+		// Only non-successful outcomes carry a category, keyed on status to match
+		// agentResultsField in telemetry.go so the JSON and telemetry views of the
+		// same slice never disagree.
+		if o.status != outcomeInstalled {
+			entry.ErrorCategory = string(o.errorCategory)
+		}
+		out.Agents = append(out.Agents, entry)
+	}
+	// A top-level failure (skills-group install, ref lookup, plugin recording)
+	// has no per-agent entry, so surface it here too; otherwise the consumer sees
+	// a non-zero exit with an empty agents array and no reason. Per-agent failures
+	// stay in the agents entries above and are not repeated here.
+	if e := topLevelFailure(runErr); e != nil {
+		out.Error = e.Error()
+		out.ErrorCategory = string(classifyInstallError(e))
+	}
+	return out
+}
+
+// resolveAgentNames parses a comma-separated list of agent names and validates
+// them against the registry. Returns an error for unrecognized names.
+func resolveAgentNames(_ context.Context, names string) ([]*agents.Agent, error) {
+	available := make(map[string]*agents.Agent, len(agents.Registry))
+	var availableNames []string
+	for _, a := range agents.Registry {
+		available[a.Name] = a
+		availableNames = append(availableNames, a.Name)
+	}
+
+	var result []*agents.Agent
+	seen := make(map[string]bool)
+	for name := range strings.SplitSeq(names, ",") {
+		name = strings.TrimSpace(name)
+		if name == "" || seen[name] {
+			continue
+		}
+		seen[name] = true
+		agent, ok := available[name]
+		if !ok {
+			return nil, fmt.Errorf("unknown agent %q. Available agents: %s", name, strings.Join(availableNames, ", "))
+		}
+		result = append(result, agent)
+	}
+
+	if len(result) == 0 {
+		return nil, errors.New("no agents specified")
+	}
+	return result, nil
+}
+
+// printNoAgentsMessage prints the "no agents detected" message.
+func printNoAgentsMessage(ctx context.Context) {
+	cmdio.LogString(ctx, cmdio.Yellow(ctx, "No supported coding agents found on PATH."))
+	cmdio.LogString(ctx, "")
+	cmdio.LogString(ctx, "Supported: "+strings.Join(agents.SupportedNames(), ", ")+".")
+	cmdio.LogString(ctx, "Install one, then re-run 'databricks aitools install'.")
+}
diff --git a/cmd/aitools/install_test.go b/cmd/aitools/install_test.go
new file mode 100644
index 00000000000..deb25154472
--- /dev/null
+++ b/cmd/aitools/install_test.go
@@ -0,0 +1,862 @@
+package aitools
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"os"
+	"path/filepath"
+	"runtime"
+	"testing"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/aitools/agents"
+	"github.com/databricks/cli/libs/aitools/installer"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/cli/libs/telemetry"
+	"github.com/databricks/cli/libs/telemetry/protos"
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func drainReader(r *bufio.Reader) {
+	buf := make([]byte, 4096)
+	for {
+		if _, err := r.Read(buf); err != nil {
+			return
+		}
+	}
+}
+
+// --- Test helpers ---
+
+// newTestInstallCmd builds the install command with the pieces the root command
+// supplies in production: the persistent --output flag (so cobra can parse
+// `--output` on this detached command; install reads it via installOutputIsJSON)
+// and silenced cobra error/usage output (root sets SilenceErrors and prints
+// errors itself). Without the latter, a detached command prints cobra's own
+// "Error:"/usage to the captured buffers.
+func newTestInstallCmd() *cobra.Command {
+	cmd := NewInstallCmd()
+	output := flags.OutputText
+	cmd.PersistentFlags().VarP(&output, "output", "o", "output type: text or json")
+	cmd.SilenceErrors = true
+	cmd.SilenceUsage = true
+	return cmd
+}
+
+type installCall struct {
+	agents []string
+	opts   installer.InstallOptions
+}
+
+func setupInstallMock(t *testing.T) *[]installCall {
+	t.Helper()
+	orig := installSkillsForAgentsFn
+	t.Cleanup(func() { installSkillsForAgentsFn = orig })
+
+	var calls []installCall
+	installSkillsForAgentsFn = func(_ context.Context, _ installer.ManifestSource, targetAgents []*agents.Agent, opts installer.InstallOptions) error {
+		names := make([]string, len(targetAgents))
+		for i, a := range targetAgents {
+			names[i] = a.Name
+		}
+		calls = append(calls, installCall{agents: names, opts: opts})
+		return nil
+	}
+	return &calls
+}
+
+type pluginCall struct {
+	agent string
+	scope string
+}
+
+func setupPluginMock(t *testing.T) *[]pluginCall {
+	t.Helper()
+	origInstall := installPluginForAgentFn
+	origRecord := recordPluginInstallsFn
+	t.Cleanup(func() {
+		installPluginForAgentFn = origInstall
+		recordPluginInstallsFn = origRecord
+	})
+
+	var calls []pluginCall
+	installPluginForAgentFn = func(_ context.Context, a *agents.Agent, scope, ref string) (installer.PluginRecord, error) {
+		calls = append(calls, pluginCall{agent: a.Name, scope: scope})
+		return installer.PluginRecord{Marketplace: "databricks-agent-skills", Plugin: "databricks", Scope: scope, Version: "0.2.6"}, nil
+	}
+	recordPluginInstallsFn = func(context.Context, string, map[string]installer.PluginRecord, string) error { return nil }
+	return &calls
+}
+
+func setupScopeMock(t *testing.T, scope string) *bool {
+	t.Helper()
+	orig := promptScopeSelection
+	t.Cleanup(func() { promptScopeSelection = orig })
+
+	called := false
+	promptScopeSelection = func(_ context.Context) (string, error) {
+		called = true
+		return scope, nil
+	}
+	return &called
+}
+
+// setupTestAgents creates config dirs for Claude and Cursor under a temp HOME.
+// XDG_CONFIG_HOME must be neutralized too: OpenCode resolves its config dir
+// from it, so a developer machine with a real ~/.config/opencode (or an XDG
+// override pointing at one) would otherwise detect OpenCode as a third agent.
+func setupTestAgents(t *testing.T) string {
+	t.Helper()
+	tmp := t.TempDir()
+	t.Setenv("HOME", tmp)
+	t.Setenv("USERPROFILE", tmp)
+	t.Setenv("XDG_CONFIG_HOME", filepath.Join(tmp, ".config"))
+	require.NoError(t, os.MkdirAll(filepath.Join(tmp, ".claude"), 0o755))
+	require.NoError(t, os.MkdirAll(filepath.Join(tmp, ".cursor"), 0o755))
+	return tmp
+}
+
+// fakeBinsOnPath replaces PATH with a temp dir holding stub executables for the
+// named agent binaries, so HasBinary detects exactly those agents.
+func fakeBinsOnPath(t *testing.T, binaries ...string) {
+	t.Helper()
+	dir := t.TempDir()
+	for _, name := range binaries {
+		p := filepath.Join(dir, name)
+		if runtime.GOOS == "windows" {
+			p += ".exe"
+		}
+		require.NoError(t, os.WriteFile(p, []byte("#!/bin/sh\n"), 0o755))
+	}
+	t.Setenv("PATH", dir)
+}
+
+func testPluginAgent(name, display, binary string) *agents.Agent {
+	spec := &agents.PluginSpec{Marketplace: "databricks-agent-skills", ID: "databricks", Source: "databricks/databricks-agent-skills"}
+	a := &agents.Agent{Name: name, DisplayName: display, Binary: binary, Plugin: spec}
+	if name == agents.NameClaudeCode {
+		a.SupportsProjectScope = true
+	}
+	return a
+}
+
+// --- buildPlan / mapAgentScope / executePlan unit tests (no detection) ---
+
+func TestBuildPlanDeliveries(t *testing.T) {
+	claude := testPluginAgent(agents.NameClaudeCode, "Claude Code", "claude")
+	// Cursor is a skills-only agent (no headless plugin install).
+	cursor := &agents.Agent{Name: agents.NameCursor, DisplayName: "Cursor", Binary: "cursor-agent", SupportsProjectScope: true}
+	opencode := &agents.Agent{Name: agents.NameOpenCode, DisplayName: "OpenCode", Binary: "opencode"}
+	targets := []*agents.Agent{claude, cursor, opencode}
+
+	plan := buildPlan(targets, installer.ScopeGlobal, false, false)
+	assert.Equal(t, deliveryPlugin, plan[0].delivery)
+	assert.Equal(t, agentScopeUser, plan[0].scope)
+	assert.Equal(t, deliverySkills, plan[1].delivery) // Cursor -> skills
+	assert.Equal(t, deliverySkills, plan[2].delivery)
+
+	// --skills-only forces skills for every agent.
+	skillsPlan := buildPlan(targets, installer.ScopeGlobal, true, false)
+	for _, it := range skillsPlan {
+		assert.Equal(t, deliverySkills, it.delivery)
+	}
+}
+
+func TestAgentChoicesOnlyOffersActionableAgents(t *testing.T) {
+	setupTestAgents(t)
+	fakeBinsOnPath(t, "claude")
+	ctx := cmdio.MockDiscard(t.Context())
+
+	// Project scope: agents that support project-scoped skills are offered (Claude
+	// via plugin; Pi/Gemini/Goose via skills). User-only plugin agents and
+	// global-only files agents are not.
+	choices := agentChoices(ctx, installer.ScopeProject, false)
+	var names []string
+	for _, c := range choices {
+		names = append(names, c.agent.Name)
+	}
+	assert.Contains(t, names, agents.NameClaudeCode)
+	assert.Contains(t, names, agents.NamePi)
+	assert.Contains(t, names, agents.NameGemini)
+	assert.Contains(t, names, agents.NameGoose)
+	assert.Contains(t, names, agents.NameKiro)
+	assert.NotContains(t, names, agents.NameCursor)
+	assert.NotContains(t, names, agents.NameCodex)
+	assert.NotContains(t, names, agents.NameOpenCode)
+	assert.NotContains(t, names, agents.NameCopilot)
+	assert.NotContains(t, names, agents.NameAntigravity)
+}
+
+func TestBuildPlanProjectScopeSkipsUserOnlyAgent(t *testing.T) {
+	claude := testPluginAgent(agents.NameClaudeCode, "Claude Code", "claude")
+	codex := testPluginAgent(agents.NameCodex, "Codex CLI", "codex")
+
+	plan := buildPlan([]*agents.Agent{claude, codex}, installer.ScopeProject, false, false)
+	assert.Equal(t, deliveryPlugin, plan[0].delivery)
+	assert.Equal(t, agentScopeProject, plan[0].scope)
+	assert.Equal(t, deliverySkip, plan[1].delivery)
+	assert.Contains(t, plan[1].reason, "user-only")
+}
+
+func TestBuildPlanProjectScopeSkipsFilesOnlyAgent(t *testing.T) {
+	// A files-only agent that does not support project scope is skipped up front,
+	// so the picker never offers an option that fails at install time.
+	opencode := &agents.Agent{Name: agents.NameOpenCode, DisplayName: "OpenCode", Binary: "opencode"}
+	projectSkills := &agents.Agent{Name: "proj-skills", DisplayName: "Proj", Binary: "proj", SupportsProjectScope: true}
+
+	plan := buildPlan([]*agents.Agent{opencode, projectSkills}, installer.ScopeProject, false, false)
+	assert.Equal(t, deliverySkip, plan[0].delivery)
+	assert.Contains(t, plan[0].reason, "project-scoped skills")
+	assert.Equal(t, deliverySkills, plan[1].delivery)
+
+	// --skills-only does not rescue a project-incompatible agent.
+	skillsOnly := buildPlan([]*agents.Agent{opencode}, installer.ScopeProject, true, false)
+	assert.Equal(t, deliverySkip, skillsOnly[0].delivery)
+
+	// Under global scope the same agent gets skills.
+	globalPlan := buildPlan([]*agents.Agent{opencode}, installer.ScopeGlobal, false, false)
+	assert.Equal(t, deliverySkills, globalPlan[0].delivery)
+}
+
+func TestMapAgentScope(t *testing.T) {
+	claude := testPluginAgent(agents.NameClaudeCode, "Claude Code", "claude")
+	codex := testPluginAgent(agents.NameCodex, "Codex CLI", "codex")
+
+	scope, ok, _ := mapAgentScope(claude, installer.ScopeGlobal)
+	assert.True(t, ok)
+	assert.Equal(t, agentScopeUser, scope)
+
+	scope, ok, _ = mapAgentScope(claude, installer.ScopeProject)
+	assert.True(t, ok)
+	assert.Equal(t, agentScopeProject, scope)
+
+	_, ok, reason := mapAgentScope(codex, installer.ScopeProject)
+	assert.False(t, ok)
+	assert.Contains(t, reason, "user-only")
+}
+
+func TestExecutePlanSkipBlockedPluginExit0(t *testing.T) {
+	t.Setenv("DATABRICKS_SKILLS_REF", "v0.2.6")
+	orig := installPluginForAgentFn
+	origRec := recordPluginInstallsFn
+	t.Cleanup(func() { installPluginForAgentFn = orig; recordPluginInstallsFn = origRec })
+	installPluginForAgentFn = func(_ context.Context, a *agents.Agent, _, _ string) (installer.PluginRecord, error) {
+		return installer.PluginRecord{}, &installer.BlockedError{Agent: a.Name, Reason: installer.ReasonCLINotOnPath}
+	}
+	recordPluginInstallsFn = func(context.Context, string, map[string]installer.PluginRecord, string) error { return nil }
+
+	claude := testPluginAgent(agents.NameClaudeCode, "Claude Code", "claude")
+	ctx := cmdio.MockDiscard(t.Context())
+
+	// Non-explicit blocked install is a warning, not an error, but the agent's
+	// failure is still recorded in its outcome.
+	plan := buildPlan([]*agents.Agent{claude}, installer.ScopeGlobal, false, false)
+	outcomes, err := executePlan(ctx, nil, plan, installer.InstallOptions{Scope: installer.ScopeGlobal}, false)
+	require.NoError(t, err)
+	require.Len(t, outcomes, 1)
+	assert.Equal(t, outcomeFailed, outcomes[0].status)
+	assert.Equal(t, protos.AitoolsErrorCategoryCLINotOnPath, outcomes[0].errorCategory)
+
+	// Explicit (--agents) blocked install is an error.
+	planExplicit := buildPlan([]*agents.Agent{claude}, installer.ScopeGlobal, false, true)
+	_, err = executePlan(ctx, nil, planExplicit, installer.InstallOptions{Scope: installer.ScopeGlobal}, false)
+	require.Error(t, err)
+}
+
+// --- RunE: skills-only path (config-dir detection, no plugin) ---
+
+func TestInstallSkillsOnlyAllAgents(t *testing.T) {
+	setupTestAgents(t)
+	calls := setupInstallMock(t)
+
+	ctx := telemetry.WithNewLogger(cmdio.MockDiscard(t.Context()))
+	cmd := newTestInstallCmd()
+	cmd.SetContext(ctx)
+	cmd.SetArgs([]string{"--skills-only"})
+
+	require.NoError(t, cmd.Execute())
+	require.Len(t, *calls, 1)
+	assert.Len(t, (*calls)[0].agents, 2)
+	assert.Nil(t, (*calls)[0].opts.SpecificSkills)
+}
+
+func TestInstallSkillsOnlySpecificSkills(t *testing.T) {
+	setupTestAgents(t)
+	calls := setupInstallMock(t)
+
+	ctx := telemetry.WithNewLogger(cmdio.MockDiscard(t.Context()))
+	cmd := newTestInstallCmd()
+	cmd.SetContext(ctx)
+	cmd.SetArgs([]string{"--skills-only", "--skills", "databricks,databricks-apps"})
+
+	require.NoError(t, cmd.Execute())
+	require.Len(t, *calls, 1)
+	assert.Equal(t, []string{"databricks", "databricks-apps"}, (*calls)[0].opts.SpecificSkills)
+}
+
+func TestInstallSkillsOnlyExperimental(t *testing.T) {
+	setupTestAgents(t)
+	calls := setupInstallMock(t)
+
+	ctx := telemetry.WithNewLogger(cmdio.MockDiscard(t.Context()))
+	cmd := newTestInstallCmd()
+	cmd.SetContext(ctx)
+	cmd.SetArgs([]string{"--skills-only", "--experimental"})
+
+	require.NoError(t, cmd.Execute())
+	require.Len(t, *calls, 1)
+	assert.True(t, (*calls)[0].opts.IncludeExperimental)
+}
+
+// --- RunE: plugin-first default path ---
+
+func TestInstallPluginFirstDefault(t *testing.T) {
+	setupTestAgents(t) // ~/.claude exists
+	fakeBinsOnPath(t, "claude")
+	t.Setenv("DATABRICKS_SKILLS_REF", "v0.2.6")
+	plugins := setupPluginMock(t)
+	skills := setupInstallMock(t)
+
+	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
+	cmd := newTestInstallCmd()
+	cmd.SetContext(telemetry.WithNewLogger(ctx))
+
+	require.NoError(t, cmd.Execute())
+	require.Len(t, *plugins, 1)
+	assert.Equal(t, agents.NameClaudeCode, (*plugins)[0].agent)
+	assert.Equal(t, agentScopeUser, (*plugins)[0].scope)
+	// Claude (a real plugin agent) must not get raw skills, but Cursor (manual-only
+	// plugin) does, plus a plugin recommendation.
+	require.Len(t, *skills, 1)
+	assert.Equal(t, []string{agents.NameCursor}, (*skills)[0].agents)
+	assert.Contains(t, stderr.String(), "Installing databricks plugin for Claude Code...")
+}
+
+func TestInstallInteractivePickerAndConfirm(t *testing.T) {
+	setupTestAgents(t)
+	fakeBinsOnPath(t, "claude")
+	t.Setenv("DATABRICKS_SKILLS_REF", "v0.2.6")
+	plugins := setupPluginMock(t)
+	setupScopeMock(t, installer.ScopeGlobal)
+
+	origPrompt := promptAgentSelection
+	t.Cleanup(func() { promptAgentSelection = origPrompt })
+	pickerCalled := false
+	promptAgentSelection = func(_ context.Context, choices []agentChoice) ([]*agents.Agent, error) {
+		pickerCalled = true
+		for _, c := range choices {
+			if c.agent.Name == agents.NameClaudeCode {
+				return []*agents.Agent{c.agent}, nil
+			}
+		}
+		return nil, nil
+	}
+
+	// The confirm is a huh widget that reads the real terminal, so drive it via
+	// the override rather than piped stdin; assert it was consulted.
+	origProceed := promptProceed
+	t.Cleanup(func() { promptProceed = origProceed })
+	proceedCalled := false
+	promptProceed = func() (bool, error) {
+		proceedCalled = true
+		return true, nil
+	}
+
+	ctx, test := cmdio.SetupTest(t.Context(), cmdio.TestOptions{PromptSupported: true})
+	defer test.Done()
+	go drainReader(test.Stdout)
+	go drainReader(test.Stderr)
+
+	cmd := newTestInstallCmd()
+	cmd.SetContext(telemetry.WithNewLogger(ctx))
+
+	require.NoError(t, cmd.RunE(cmd, nil))
+	assert.True(t, pickerCalled)
+	assert.True(t, proceedCalled)
+	require.Len(t, *plugins, 1)
+	assert.Equal(t, agents.NameClaudeCode, (*plugins)[0].agent)
+}
+
+func TestInstallExplicitAgentWorksUndetected(t *testing.T) {
+	tmp := t.TempDir()
+	t.Setenv("HOME", tmp)
+	t.Setenv("USERPROFILE", tmp)
+	fakeBinsOnPath(t, "codex")
+	t.Setenv("DATABRICKS_SKILLS_REF", "v0.2.6")
+	plugins := setupPluginMock(t)
+
+	ctx := telemetry.WithNewLogger(cmdio.MockDiscard(t.Context()))
+	cmd := newTestInstallCmd()
+	cmd.SetContext(ctx)
+	cmd.SetArgs([]string{"--agents", "codex"})
+
+	require.NoError(t, cmd.Execute())
+	require.Len(t, *plugins, 1)
+	assert.Equal(t, agents.NameCodex, (*plugins)[0].agent)
+}
+
+func TestInstallOutputJSONReportsErrorCategories(t *testing.T) {
+	tmp := t.TempDir()
+	t.Setenv("HOME", tmp)
+	t.Setenv("USERPROFILE", tmp)
+	fakeBinsOnPath(t, "codex")
+	t.Setenv("DATABRICKS_SKILLS_REF", "v0.2.6")
+
+	origInstall := installPluginForAgentFn
+	origRecord := recordPluginInstallsFn
+	t.Cleanup(func() { installPluginForAgentFn = origInstall; recordPluginInstallsFn = origRecord })
+	installPluginForAgentFn = func(_ context.Context, a *agents.Agent, _, _ string) (installer.PluginRecord, error) {
+		return installer.PluginRecord{}, &installer.BlockedError{Agent: a.Name, Reason: installer.ReasonInstallFailed, Detail: "boom"}
+	}
+	recordPluginInstallsFn = func(context.Context, string, map[string]installer.PluginRecord, string) error { return nil }
+
+	var out bytes.Buffer
+	ctx := telemetry.WithNewLogger(cmdio.MockDiscard(t.Context()))
+	cmd := newTestInstallCmd()
+	cmd.SetContext(ctx)
+	cmd.SetOut(&out)
+	cmd.SetArgs([]string{"--agents", "codex", "--scope", "global", "--output", "json"})
+
+	// Explicit --agents makes a blocked install a hard error, but the JSON result
+	// is still emitted for the extension to consume. The command returns
+	// ErrAlreadyPrinted so root exits non-zero without printing a duplicate
+	// "Error:" line over the JSON (exercised end-to-end in
+	// TestInstallOutputJSONThroughRoot).
+	err := cmd.Execute()
+	require.ErrorIs(t, err, root.ErrAlreadyPrinted)
+
+	var got installOutput
+	require.NoError(t, json.Unmarshal(out.Bytes(), &got))
+	require.Len(t, got.Agents, 1)
+	assert.Equal(t, agents.NameCodex, got.Agents[0].Name)
+	assert.Equal(t, deliveryPlugin.String(), got.Agents[0].Delivery)
+	assert.Equal(t, string(outcomeFailed), got.Agents[0].Status)
+	assert.Equal(t, string(protos.AitoolsErrorCategoryPluginInstallFailed), got.Agents[0].ErrorCategory)
+	// A per-agent failure stays in the agent entry; it is not repeated in the
+	// top-level error fields.
+	assert.Empty(t, got.Error)
+	assert.Empty(t, got.ErrorCategory)
+}
+
+// TestInstallOutputJSONThroughRoot runs a failing `install --output json` through
+// the real root command, where the "Error:" line is actually printed (root does
+// it, not cobra). It guards the contract that a failed JSON run writes only the
+// JSON to stdout and no text error to stderr.
+func TestInstallOutputJSONThroughRoot(t *testing.T) {
+	tmp := t.TempDir()
+	t.Setenv("HOME", tmp)
+	t.Setenv("USERPROFILE", tmp)
+	fakeBinsOnPath(t, "codex")
+	t.Setenv("DATABRICKS_SKILLS_REF", "v0.2.6")
+
+	origInstall := installPluginForAgentFn
+	origRecord := recordPluginInstallsFn
+	t.Cleanup(func() { installPluginForAgentFn = origInstall; recordPluginInstallsFn = origRecord })
+	installPluginForAgentFn = func(_ context.Context, a *agents.Agent, _, _ string) (installer.PluginRecord, error) {
+		return installer.PluginRecord{}, &installer.BlockedError{Agent: a.Name, Reason: installer.ReasonInstallFailed, Detail: "boom"}
+	}
+	recordPluginInstallsFn = func(context.Context, string, map[string]installer.PluginRecord, string) error { return nil }
+
+	ctx := telemetry.WithNewLogger(cmdio.MockDiscard(t.Context()))
+	cli := root.New(ctx)
+	cli.AddCommand(NewInstallCmd())
+	var out, errOut bytes.Buffer
+	cli.SetOut(&out)
+	cli.SetErr(&errOut)
+	cli.SetArgs([]string{"install", "--agents", "codex", "--scope", "global", "--output", "json"})
+
+	err := root.Execute(ctx, cli)
+	require.ErrorIs(t, err, root.ErrAlreadyPrinted)
+	assert.NotContains(t, errOut.String(), "Error:")
+
+	var got installOutput
+	require.NoError(t, json.Unmarshal(out.Bytes(), &got))
+	require.Len(t, got.Agents, 1)
+	assert.Equal(t, string(outcomeFailed), got.Agents[0].Status)
+}
+
+func TestInstallOutputJSONTopLevelFailure(t *testing.T) {
+	tmp := t.TempDir()
+	t.Setenv("HOME", tmp)
+	t.Setenv("USERPROFILE", tmp)
+
+	orig := installSkillsForAgentsFn
+	t.Cleanup(func() { installSkillsForAgentsFn = orig })
+	installSkillsForAgentsFn = func(context.Context, installer.ManifestSource, []*agents.Agent, installer.InstallOptions) error {
+		return &installer.SkillError{Skill: "databricks", Reason: installer.ReasonSkillNotFound, Detail: "not found"}
+	}
+
+	var out bytes.Buffer
+	ctx := telemetry.WithNewLogger(cmdio.MockDiscard(t.Context()))
+	cmd := newTestInstallCmd()
+	cmd.SetContext(ctx)
+	cmd.SetOut(&out)
+	// Cursor is skills-only, so this fails in the skills-group path, which returns
+	// before appending any per-agent outcome.
+	cmd.SetArgs([]string{"--agents", "cursor", "--scope", "global", "--output", "json"})
+
+	// A top-level failure has no per-agent entry, so it must still be represented
+	// in the JSON (not just a bare non-zero exit with an empty agents array).
+	err := cmd.Execute()
+	require.ErrorIs(t, err, root.ErrAlreadyPrinted)
+
+	var got installOutput
+	require.NoError(t, json.Unmarshal(out.Bytes(), &got))
+	assert.Empty(t, got.Agents)
+	assert.Contains(t, got.Error, "databricks")
+	assert.Equal(t, string(protos.AitoolsErrorCategorySkillNotFound), got.ErrorCategory)
+}
+
+func TestInstallOutputJSONRequiresNonInteractiveFlags(t *testing.T) {
+	setupTestAgents(t)
+
+	cases := []struct {
+		name string
+		args []string
+		want []string // substrings the error must name
+	}{
+		{
+			name: "no scope or agents",
+			args: []string{"--output", "json"},
+			want: []string{"--scope", "--agents"},
+		},
+		{
+			name: "agents without scope",
+			args: []string{"--agents", "claude-code", "--output", "json"},
+			want: []string{"--scope"},
+		},
+		{
+			name: "scope without agents",
+			args: []string{"--scope", "global", "--output", "json"},
+			want: []string{"--agents"},
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			var out bytes.Buffer
+			ctx := telemetry.WithNewLogger(cmdio.MockDiscard(t.Context()))
+			cmd := newTestInstallCmd()
+			cmd.SetContext(ctx)
+			cmd.SetOut(&out)
+			cmd.SilenceErrors = true
+			cmd.SilenceUsage = true
+			cmd.SetArgs(tc.args)
+
+			err := cmd.Execute()
+			require.Error(t, err)
+			for _, w := range tc.want {
+				assert.Contains(t, err.Error(), w)
+			}
+			// The command errors before rendering, so no JSON is emitted.
+			assert.Empty(t, out.String())
+		})
+	}
+}
+
+func TestInstallUnknownAgentErrors(t *testing.T) {
+	setupTestAgents(t)
+	ctx := cmdio.MockDiscard(t.Context())
+	cmd := newTestInstallCmd()
+	cmd.SetContext(ctx)
+	cmd.SetArgs([]string{"--agents", "invalid-agent"})
+	cmd.SilenceErrors = true
+	cmd.SilenceUsage = true
+
+	err := cmd.Execute()
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "unknown agent")
+	assert.Contains(t, err.Error(), "Available agents:")
+}
+
+func TestInstallNoAgentsDetected(t *testing.T) {
+	tmp := t.TempDir()
+	t.Setenv("HOME", tmp)
+	t.Setenv("USERPROFILE", tmp)
+	// Neutralize XDG_CONFIG_HOME so a real opencode config on the dev machine
+	// is not picked up through it.
+	t.Setenv("XDG_CONFIG_HOME", filepath.Join(tmp, ".config"))
+	fakeBinsOnPath(t) // no agent binaries
+	plugins := setupPluginMock(t)
+	skills := setupInstallMock(t)
+
+	ctx := cmdio.MockDiscard(t.Context())
+	cmd := newTestInstallCmd()
+	cmd.SetContext(ctx)
+
+	require.NoError(t, cmd.Execute())
+	assert.Empty(t, *plugins)
+	assert.Empty(t, *skills)
+}
+
+func TestInstallSkillsRequiresSkillsOnlyOrPath(t *testing.T) {
+	setupTestAgents(t)
+	ctx := cmdio.MockDiscard(t.Context())
+	cmd := newTestInstallCmd()
+	cmd.SetContext(ctx)
+	cmd.SetArgs([]string{"--skills", "databricks"})
+	cmd.SilenceErrors = true
+	cmd.SilenceUsage = true
+
+	err := cmd.Execute()
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "--skills requires --skills-only or --path")
+}
+
+func TestInstallInteractivePickerErrorPropagates(t *testing.T) {
+	setupTestAgents(t)
+	setupScopeMock(t, installer.ScopeGlobal)
+
+	origPrompt := promptAgentSelection
+	t.Cleanup(func() { promptAgentSelection = origPrompt })
+	promptAgentSelection = func(_ context.Context, _ []agentChoice) ([]*agents.Agent, error) {
+		return nil, errors.New("at least one agent must be selected")
+	}
+
+	ctx, test := cmdio.SetupTest(t.Context(), cmdio.TestOptions{PromptSupported: true})
+	defer test.Done()
+	go drainReader(test.Stdout)
+	go drainReader(test.Stderr)
+
+	cmd := newTestInstallCmd()
+	cmd.SetContext(ctx)
+
+	err := cmd.RunE(cmd, nil)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "at least one agent")
+}
+
+func TestInstallPathConflictsWithSkillsOnly(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	cmd := newTestInstallCmd()
+	cmd.SetContext(ctx)
+	cmd.SetArgs([]string{"--skills-only", "--path", "./out"})
+	cmd.SilenceErrors = true
+	cmd.SilenceUsage = true
+
+	err := cmd.Execute()
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "cannot use --skills-only with --path")
+}
+
+func TestInstallOutputJSONConflictsWithPath(t *testing.T) {
+	var out bytes.Buffer
+	ctx := cmdio.MockDiscard(t.Context())
+	cmd := newTestInstallCmd()
+	cmd.SetContext(ctx)
+	cmd.SetOut(&out)
+	cmd.SetArgs([]string{"--path", "./out", "--output", "json"})
+	cmd.SilenceErrors = true
+	cmd.SilenceUsage = true
+
+	err := cmd.Execute()
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "cannot use --output json with --path")
+	// The command errors before dumping, so nothing is emitted.
+	assert.Empty(t, out.String())
+}
+
+// --- Scope flag parsing (exercised via the skills path so opts.Scope is observable) ---
+
+func TestInstallScopeFlag(t *testing.T) {
+	tests := []struct {
+		name      string
+		args      []string
+		wantScope string
+		wantErr   string
+	}{
+		{name: "scope project", args: []string{"--skills-only", "--scope", "project"}, wantScope: installer.ScopeProject},
+		{name: "scope global", args: []string{"--skills-only", "--scope", "global"}, wantScope: installer.ScopeGlobal},
+		{name: "scope both rejected", args: []string{"--scope", "both"}, wantErr: "--scope=both is not supported"},
+		{name: "scope invalid value", args: []string{"--scope", "all"}, wantErr: `invalid --scope "all"`},
+		{name: "scope conflicts with legacy", args: []string{"--scope", "global", "--project"}, wantErr: "cannot use --scope with --project or --global"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			setupTestAgents(t)
+			calls := setupInstallMock(t)
+
+			ctx := telemetry.WithNewLogger(cmdio.MockDiscard(t.Context()))
+			cmd := newTestInstallCmd()
+			cmd.SetContext(ctx)
+			cmd.SetArgs(tt.args)
+			cmd.SilenceErrors = true
+			cmd.SilenceUsage = true
+
+			err := cmd.Execute()
+			if tt.wantErr != "" {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), tt.wantErr)
+				return
+			}
+			require.NoError(t, err)
+			require.Len(t, *calls, 1)
+			assert.Equal(t, tt.wantScope, (*calls)[0].opts.Scope)
+		})
+	}
+}
+
+func TestInstallGlobalAndProjectErrors(t *testing.T) {
+	setupTestAgents(t)
+	setupInstallMock(t)
+
+	ctx := cmdio.MockDiscard(t.Context())
+	cmd := newTestInstallCmd()
+	cmd.SetContext(ctx)
+	cmd.SetArgs([]string{"--global", "--project"})
+	cmd.SilenceErrors = true
+	cmd.SilenceUsage = true
+
+	err := cmd.Execute()
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "cannot use --global and --project together")
+}
+
+func TestInstallNoFlagNonInteractiveUsesGlobal(t *testing.T) {
+	setupTestAgents(t)
+	calls := setupInstallMock(t)
+
+	ctx := telemetry.WithNewLogger(cmdio.MockDiscard(t.Context()))
+	cmd := newTestInstallCmd()
+	cmd.SetContext(ctx)
+	cmd.SetArgs([]string{"--skills-only"})
+
+	require.NoError(t, cmd.Execute())
+	require.Len(t, *calls, 1)
+	assert.Equal(t, installer.ScopeGlobal, (*calls)[0].opts.Scope)
+}
+
+// --- Positional-arg rejections ---
+
+func TestInstallRejectsPositionalArgs(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	cmd := newTestInstallCmd()
+	cmd.SetContext(ctx)
+	cmd.SetArgs([]string{"databricks-jobs"})
+	cmd.SilenceErrors = true
+	cmd.SilenceUsage = true
+
+	err := cmd.Execute()
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "unknown command")
+}
+
+func TestUpdateRejectsPositionalArgs(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	cmd := NewUpdateCmd()
+	cmd.SetContext(ctx)
+	cmd.SetArgs([]string{"databricks"})
+	cmd.SilenceErrors = true
+	cmd.SilenceUsage = true
+
+	err := cmd.Execute()
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "unknown command")
+}
+
+func TestUninstallRejectsPositionalArgs(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	cmd := NewUninstallCmd()
+	cmd.SetContext(ctx)
+	cmd.SetArgs([]string{"databricks"})
+	cmd.SilenceErrors = true
+	cmd.SilenceUsage = true
+
+	err := cmd.Execute()
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "unknown command")
+}
+
+func TestListRejectsPositionalArgs(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	cmd := NewListCmd()
+	cmd.SetContext(ctx)
+	cmd.SetArgs([]string{"databricks"})
+	cmd.SilenceErrors = true
+	cmd.SilenceUsage = true
+
+	err := cmd.Execute()
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "unknown command")
+}
+
+func TestVersionRejectsPositionalArgs(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	cmd := NewVersionCmd()
+	cmd.SetContext(ctx)
+	cmd.SetArgs([]string{"databricks"})
+	cmd.SilenceErrors = true
+	cmd.SilenceUsage = true
+
+	err := cmd.Execute()
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "unknown command")
+}
+
+// --- resolveAgentNames ---
+
+func TestResolveAgentNamesValid(t *testing.T) {
+	ctx := t.Context()
+	result, err := resolveAgentNames(ctx, "claude-code,cursor")
+	require.NoError(t, err)
+	assert.Len(t, result, 2)
+	assert.Equal(t, "claude-code", result[0].Name)
+	assert.Equal(t, "cursor", result[1].Name)
+}
+
+func TestResolveAgentNamesUnknown(t *testing.T) {
+	ctx := t.Context()
+	_, err := resolveAgentNames(ctx, "claude-code,invalid-agent")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "unknown agent")
+	assert.Contains(t, err.Error(), "invalid-agent")
+}
+
+func TestResolveAgentNamesEmpty(t *testing.T) {
+	ctx := t.Context()
+	_, err := resolveAgentNames(ctx, "")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "no agents specified")
+}
+
+func TestResolveAgentNamesDuplicatesDeduplicates(t *testing.T) {
+	ctx := t.Context()
+	result, err := resolveAgentNames(ctx, "claude-code,claude-code")
+	require.NoError(t, err)
+	assert.Len(t, result, 1, "duplicate agent names should be deduplicated")
+	assert.Equal(t, "claude-code", result[0].Name)
+}
+
+func TestResolveScopeValidation(t *testing.T) {
+	tests := []struct {
+		name    string
+		project bool
+		global  bool
+		want    string
+		wantErr string
+	}{
+		{name: "neither", want: installer.ScopeGlobal},
+		{name: "global only", global: true, want: installer.ScopeGlobal},
+		{name: "project only", project: true, want: installer.ScopeProject},
+		{name: "both", project: true, global: true, wantErr: "cannot use --global and --project together"},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got, err := resolveScope(tc.project, tc.global)
+			if tc.wantErr != "" {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), tc.wantErr)
+			} else {
+				require.NoError(t, err)
+				assert.Equal(t, tc.want, got)
+			}
+		})
+	}
+}
diff --git a/cmd/aitools/json.go b/cmd/aitools/json.go
new file mode 100644
index 00000000000..15f4080ee2c
--- /dev/null
+++ b/cmd/aitools/json.go
@@ -0,0 +1,14 @@
+package aitools
+
+import (
+	"encoding/json"
+	"io"
+)
+
+// renderJSON writes v as indented JSON. Shared by the install and list commands
+// so their --output json payloads are formatted identically.
+func renderJSON(w io.Writer, v any) error {
+	enc := json.NewEncoder(w)
+	enc.SetIndent("", "  ")
+	return enc.Encode(v)
+}
diff --git a/cmd/aitools/legacy_skills.go b/cmd/aitools/legacy_skills.go
new file mode 100644
index 00000000000..a4084179179
--- /dev/null
+++ b/cmd/aitools/legacy_skills.go
@@ -0,0 +1,64 @@
+package aitools
+
+import (
+	"github.com/spf13/cobra"
+)
+
+// NewLegacySkillsCmd returns the deprecated `skills` subgroup used under
+// `databricks experimental aitools`. It is only mounted there for backward
+// compatibility; new code should call the top-level install/list commands.
+func NewLegacySkillsCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:        "skills",
+		Hidden:     true,
+		Short:      "Manage Databricks skills for coding agents",
+		Long:       `Manage Databricks skills that extend coding agents with Databricks-specific capabilities.`,
+		Deprecated: `use "databricks aitools" instead.`,
+	}
+
+	cmd.AddCommand(newLegacySkillsListCmd())
+	cmd.AddCommand(newLegacySkillsInstallCmd())
+
+	return cmd
+}
+
+func newLegacySkillsListCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:        "list",
+		Short:      "List available skills",
+		Deprecated: `use "databricks aitools list" instead.`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			return listSkillsFn(cmd, "")
+		},
+	}
+}
+
+func newLegacySkillsInstallCmd() *cobra.Command {
+	var includeExperimental bool
+
+	cmd := &cobra.Command{
+		Use:        "install [skill-name]",
+		Short:      "Install Databricks skills for detected coding agents",
+		Deprecated: `use "databricks aitools install --skills <name>" instead.`,
+		Args:       cobra.MaximumNArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			installCmd := NewInstallCmd()
+			installCmd.SetContext(cmd.Context())
+
+			// This legacy alias predates the plugin-first default, so it stays on
+			// raw skill files to preserve its behavior.
+			delegateArgs := []string{"--skills-only"}
+			if len(args) > 0 {
+				delegateArgs = append(delegateArgs, "--skills", args[0])
+			}
+			if includeExperimental {
+				delegateArgs = append(delegateArgs, "--experimental")
+			}
+			installCmd.SetArgs(delegateArgs)
+			return installCmd.Execute()
+		},
+	}
+
+	cmd.Flags().BoolVar(&includeExperimental, "experimental", false, "Include experimental skills")
+	return cmd
+}
diff --git a/cmd/aitools/legacy_skills_test.go b/cmd/aitools/legacy_skills_test.go
new file mode 100644
index 00000000000..3f6098f5e90
--- /dev/null
+++ b/cmd/aitools/legacy_skills_test.go
@@ -0,0 +1,122 @@
+package aitools
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/telemetry"
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestLegacySkillsInstallDelegatesToInstall(t *testing.T) {
+	setupTestAgents(t)
+	calls := setupInstallMock(t)
+
+	ctx := telemetry.WithNewLogger(cmdio.MockDiscard(t.Context()))
+	cmd := newLegacySkillsInstallCmd()
+	cmd.SetContext(ctx)
+
+	err := cmd.RunE(cmd, nil)
+	require.NoError(t, err)
+
+	require.Len(t, *calls, 1)
+	assert.Len(t, (*calls)[0].agents, 2)
+}
+
+func TestLegacySkillsInstallForwardsSkillName(t *testing.T) {
+	setupTestAgents(t)
+	calls := setupInstallMock(t)
+
+	ctx := telemetry.WithNewLogger(cmdio.MockDiscard(t.Context()))
+	cmd := newLegacySkillsInstallCmd()
+	cmd.SetContext(ctx)
+
+	err := cmd.RunE(cmd, []string{"databricks"})
+	require.NoError(t, err)
+
+	require.Len(t, *calls, 1)
+	assert.Equal(t, []string{"databricks"}, (*calls)[0].opts.SpecificSkills)
+}
+
+func TestLegacySkillsInstallExecuteNoArgs(t *testing.T) {
+	setupTestAgents(t)
+	calls := setupInstallMock(t)
+
+	ctx := telemetry.WithNewLogger(cmdio.MockDiscard(t.Context()))
+	cmd := newLegacySkillsInstallCmd()
+	cmd.SetContext(ctx)
+	cmd.SetArgs([]string{})
+
+	err := cmd.Execute()
+	require.NoError(t, err)
+
+	require.Len(t, *calls, 1)
+	assert.Len(t, (*calls)[0].agents, 2)
+	assert.Nil(t, (*calls)[0].opts.SpecificSkills)
+}
+
+func TestLegacySkillsInstallExecuteWithSkillName(t *testing.T) {
+	setupTestAgents(t)
+	calls := setupInstallMock(t)
+
+	ctx := telemetry.WithNewLogger(cmdio.MockDiscard(t.Context()))
+	cmd := newLegacySkillsInstallCmd()
+	cmd.SetContext(ctx)
+	cmd.SetArgs([]string{"databricks"})
+
+	err := cmd.Execute()
+	require.NoError(t, err)
+
+	require.Len(t, *calls, 1)
+	assert.Equal(t, []string{"databricks"}, (*calls)[0].opts.SpecificSkills)
+}
+
+func TestLegacySkillsInstallForwardsExperimental(t *testing.T) {
+	setupTestAgents(t)
+	calls := setupInstallMock(t)
+
+	ctx := telemetry.WithNewLogger(cmdio.MockDiscard(t.Context()))
+	cmd := newLegacySkillsInstallCmd()
+	cmd.SetContext(ctx)
+	cmd.SetArgs([]string{"--experimental"})
+
+	err := cmd.Execute()
+	require.NoError(t, err)
+
+	require.Len(t, *calls, 1)
+	assert.True(t, (*calls)[0].opts.IncludeExperimental, "--experimental should be forwarded")
+}
+
+func TestLegacySkillsInstallExecuteRejectsTwoArgs(t *testing.T) {
+	ctx := telemetry.WithNewLogger(cmdio.MockDiscard(t.Context()))
+	cmd := newLegacySkillsInstallCmd()
+	cmd.SetContext(ctx)
+	cmd.SetArgs([]string{"a", "b"})
+	cmd.SilenceErrors = true
+	cmd.SilenceUsage = true
+
+	err := cmd.Execute()
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "accepts at most 1 arg")
+}
+
+func TestLegacySkillsListDelegatesToListFn(t *testing.T) {
+	orig := listSkillsFn
+	t.Cleanup(func() { listSkillsFn = orig })
+
+	called := false
+	listSkillsFn = func(cmd *cobra.Command, scope string) error {
+		called = true
+		return nil
+	}
+
+	ctx := telemetry.WithNewLogger(cmdio.MockDiscard(t.Context()))
+	cmd := newLegacySkillsListCmd()
+	cmd.SetContext(ctx)
+
+	err := cmd.RunE(cmd, nil)
+	require.NoError(t, err)
+	assert.True(t, called)
+}
diff --git a/cmd/aitools/list.go b/cmd/aitools/list.go
new file mode 100644
index 00000000000..e6decb6a120
--- /dev/null
+++ b/cmd/aitools/list.go
@@ -0,0 +1,462 @@
+package aitools
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"maps"
+	"os"
+	"slices"
+	"strings"
+	"text/tabwriter"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/aitools/agents"
+	"github.com/databricks/cli/libs/aitools/installer"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/cli/libs/log"
+	"github.com/spf13/cobra"
+)
+
+// listSkillsFn is the function used to render the skills list.
+// It is a package-level var so tests can replace the data-fetching layer.
+var listSkillsFn = defaultListSkills
+
+func NewListCmd() *cobra.Command {
+	var scopeFlag string
+	var projectFlag, globalFlag bool
+
+	cmd := &cobra.Command{
+		Use:   "list",
+		Short: "List installed skills and plugins",
+		Args:  cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			// Reject the legacy --project --global combination here so it
+			// doesn't silently degrade to --scope=both. Users who want both
+			// scopes should use --scope=both (the new explicit spelling).
+			if projectFlag && globalFlag && scopeFlag == "" {
+				return errors.New("cannot use --global and --project together")
+			}
+
+			projectFlag, globalFlag, err := parseScopeFlag(scopeFlag, projectFlag, globalFlag, true)
+			if err != nil {
+				return err
+			}
+
+			// list: empty scope = show both. --scope=both also lands here.
+			var scope string
+			switch {
+			case projectFlag && !globalFlag:
+				scope = installer.ScopeProject
+			case globalFlag && !projectFlag:
+				scope = installer.ScopeGlobal
+			}
+			return listSkillsFn(cmd, scope)
+		},
+	}
+
+	cmd.Flags().StringVar(&scopeFlag, "scope", "", "Scope to show: project, global, or both (default: both)")
+	cmd.Flags().BoolVar(&projectFlag, "project", false, "Show only project-scoped skills")
+	cmd.Flags().BoolVar(&globalFlag, "global", false, "Show only globally-scoped skills")
+	markScopeBoolsDeprecated(cmd)
+	return cmd
+}
+
+// listOutput is the structured representation of `aitools list` used by both
+// text rendering and `--output json` consumers. The JSON shape is part of
+// the public CLI contract; do not break field names or types. The agents field
+// is additive (omitempty) and does not affect the existing skills/summary shape.
+type listOutput struct {
+	Release string                  `json:"release"`
+	Skills  []skillEntry            `json:"skills"`
+	Summary map[string]scopeSummary `json:"summary"`
+	Agents  []agentEntry            `json:"agents,omitempty"`
+}
+
+// agentEntry is one agent in `list --output json`. The JSON carries an entry for
+// every registry agent so the extension sees the full set; the text view still
+// lists only agents with a plugin install, so these fields are additive.
+type agentEntry struct {
+	Name        string `json:"name"`
+	DisplayName string `json:"display_name"`
+	// Managed is whether the CLI can install and track a databricks plugin for it.
+	Managed bool `json:"managed"`
+	// Detected is the CLI's presence verdict (Agent.IsPreselected), so consumers get
+	// the same answer the CLI would act on.
+	Detected bool `json:"detected"`
+	// SupportsProjectScope mirrors agents.Agent.SupportsProjectScope so consumers can
+	// offer a project-scoped install without hardcoding which agents allow it.
+	SupportsProjectScope bool `json:"supports_project_scope"`
+	// Installed maps CLI scope -> the install found there; always present, empty
+	// when nothing is installed, matching the skills shape.
+	Installed map[string]installInfo `json:"installed"`
+}
+
+// hasPluginInstall reports whether any scope holds a databricks plugin install
+// (as opposed to raw skill files).
+func (a agentEntry) hasPluginInstall() bool {
+	for _, info := range a.Installed {
+		if info.Delivery == deliveryPlugin.String() {
+			return true
+		}
+	}
+	return false
+}
+
+// installInfo is one agent's install in one CLI scope: how the databricks tools
+// were delivered there, and the version recorded for that delivery.
+type installInfo struct {
+	// Delivery is deliveryPlugin ("plugin") when the CLI installed the databricks
+	// plugin through the agent's own CLI, or deliverySkills ("skills") when raw
+	// skill files were installed instead.
+	Delivery    string `json:"delivery"`
+	Version     string `json:"version,omitempty"`
+	NativeScope string `json:"native_scope,omitempty"`
+}
+
+type skillEntry struct {
+	Name          string            `json:"name"`
+	LatestVersion string            `json:"latest_version"`
+	Experimental  bool              `json:"experimental"`
+	Installed     map[string]string `json:"installed"`
+}
+
+type scopeSummary struct {
+	Installed int `json:"installed"`
+	Total     int `json:"total"`
+
+	// loaded preserves text rendering semantics without changing the JSON contract.
+	loaded bool
+}
+
+func defaultListSkills(cmd *cobra.Command, scope string) error {
+	ctx := cmd.Context()
+
+	out, err := buildListOutput(ctx, scope)
+	if err != nil {
+		return err
+	}
+
+	switch root.OutputType(cmd) {
+	case flags.OutputJSON:
+		return renderJSON(cmd.OutOrStdout(), out)
+	default:
+		renderListText(ctx, out, scope)
+		return nil
+	}
+}
+
+// buildListOutput fetches the manifest and per-scope install state and
+// returns the structured listOutput. scope=="" loads both scopes; "global"
+// or "project" loads only that scope.
+func buildListOutput(ctx context.Context, scope string) (listOutput, error) {
+	ref, explicit, err := installer.GetSkillsRef(ctx)
+	if err != nil {
+		return listOutput{}, err
+	}
+
+	src := &installer.GitHubManifestSource{}
+	manifest, ref, err := installer.FetchSkillsManifestWithFallback(ctx, src, ref, !explicit)
+	if err != nil {
+		return listOutput{}, fmt.Errorf("failed to fetch manifest: %w", err)
+	}
+
+	globalState := loadStateForScope(ctx, scope, installer.ScopeProject, installer.GlobalSkillsDir, "global")
+	projectState := loadStateForScope(ctx, scope, installer.ScopeGlobal, installer.ProjectSkillsDir, "project")
+
+	names := slices.Sorted(maps.Keys(manifest.Skills))
+
+	out := listOutput{
+		Release: installer.DisplaySkillsVersion(ref),
+		Skills:  make([]skillEntry, 0, len(names)),
+		Summary: map[string]scopeSummary{},
+	}
+
+	globalCount, projectCount := 0, 0
+	for _, name := range names {
+		meta := manifest.Skills[name]
+		entry := skillEntry{
+			Name:          name,
+			LatestVersion: meta.Version,
+			Experimental:  meta.IsExperimental(),
+			Installed:     map[string]string{},
+		}
+		if globalState != nil {
+			if v, ok := globalState.Skills[name]; ok {
+				entry.Installed[installer.ScopeGlobal] = v
+				globalCount++
+			}
+		}
+		if projectState != nil {
+			if v, ok := projectState.Skills[name]; ok {
+				entry.Installed[installer.ScopeProject] = v
+				projectCount++
+			}
+		}
+		out.Skills = append(out.Skills, entry)
+	}
+
+	// Include a summary entry for every scope that was queried, even when the
+	// install state is missing — agents should see "0/N" rather than guess
+	// from the absence of a key.
+	if scope != installer.ScopeProject {
+		out.Summary[installer.ScopeGlobal] = scopeSummary{Installed: globalCount, Total: len(names), loaded: globalState != nil}
+	}
+	if scope != installer.ScopeGlobal {
+		out.Summary[installer.ScopeProject] = scopeSummary{Installed: projectCount, Total: len(names), loaded: projectState != nil}
+	}
+
+	// Filter unloaded scopes here so buildAgentEntries can assume every state
+	// it receives is non-nil.
+	states := map[string]*installer.InstallState{}
+	if globalState != nil {
+		states[installer.ScopeGlobal] = globalState
+	}
+	if projectState != nil {
+		states[installer.ScopeProject] = projectState
+	}
+	out.Agents = buildAgentEntries(ctx, states)
+
+	return out, nil
+}
+
+// buildAgentEntries reports state for every supported agent in the registry:
+// detection (binary on PATH and config dir on disk), whether the CLI can manage
+// a databricks plugin for it, and the per-scope install found for it.
+// states maps CLI scope -> install state and must contain only non-nil states;
+// the caller filters scopes it did not load. Status across scopes is left for
+// the renderer (and JSON consumers) to derive from the per-scope versions, so no
+// cross-scope record is merged away here.
+func buildAgentEntries(ctx context.Context, states map[string]*installer.InstallState) []agentEntry {
+	entries := make([]agentEntry, 0, len(agents.Registry))
+	for _, a := range agents.Registry {
+		entry := agentEntry{
+			Name:                 a.Name,
+			DisplayName:          a.DisplayName,
+			Managed:              a.Plugin != nil,
+			Detected:             a.IsPreselected(ctx),
+			SupportsProjectScope: a.SupportsProjectScope,
+		}
+
+		// Always emit an installed map, empty when nothing is installed, so the
+		// JSON shape matches skillEntry ("installed": {}) rather than omitting it.
+		entry.Installed = map[string]installInfo{}
+		for scope, st := range states {
+			if rec, ok := st.Plugins[a.Name]; ok {
+				entry.Installed[scope] = installInfo{
+					Delivery:    deliveryPlugin.String(),
+					Version:     rec.Version,
+					NativeScope: rec.Scope,
+				}
+				continue
+			}
+			// A skills install produces no plugin record, so fall back to the
+			// agent's own skills dir on disk. This covers both skills-only agents
+			// (Plugin == nil) and plugin-capable agents installed with
+			// --skills-only, which are otherwise indistinguishable here.
+			if agentHasSkillsInScope(ctx, a, scope) {
+				entry.Installed[scope] = installInfo{
+					Delivery: deliverySkills.String(),
+					Version:  installer.DisplaySkillsVersion(st.Release),
+				}
+			}
+		}
+
+		entries = append(entries, entry)
+	}
+	return entries
+}
+
+// agentHasSkillsInScope reports whether databricks skills are present in the
+// agent's own skills directory for the given CLI scope. It is the on-disk
+// install signal for skills installs, which have no plugin record to consult.
+func agentHasSkillsInScope(ctx context.Context, a *agents.Agent, scope string) bool {
+	if scope == installer.ScopeProject {
+		if !a.SupportsProjectScope {
+			return false
+		}
+		cwd, err := os.Getwd()
+		if err != nil {
+			return false
+		}
+		return agents.HasDatabricksSkillsIn(a.ProjectSkillsDir(cwd))
+	}
+	dir, err := a.SkillsDir(ctx)
+	if err != nil {
+		return false
+	}
+	return agents.HasDatabricksSkillsIn(dir)
+}
+
+// loadStateForScope returns the install state for the named scope when the
+// scope filter allows it. excludeScope is the scope value that means "skip
+// loading this one" (so passing ScopeProject to the global loader skips
+// global when --scope=project).
+func loadStateForScope(ctx context.Context, scopeFilter, excludeScope string, dirFn func(context.Context) (string, error), label string) *installer.InstallState {
+	if scopeFilter == excludeScope {
+		return nil
+	}
+	dir, err := dirFn(ctx)
+	if err != nil {
+		return nil
+	}
+	state, err := installer.LoadState(dir)
+	if err != nil {
+		log.Debugf(ctx, "Could not load %s install state: %v", label, err)
+		return nil
+	}
+	return state
+}
+
+func renderListText(ctx context.Context, out listOutput, scope string) {
+	bothScopes := scope == "" &&
+		out.Summary[installer.ScopeGlobal].loaded &&
+		out.Summary[installer.ScopeProject].loaded
+
+	// Split experimental skills into their own group so they are clearly
+	// separated from the stable set rather than interleaved alphabetically.
+	var stable, experimental []skillEntry
+	for _, s := range out.Skills {
+		if s.Experimental {
+			experimental = append(experimental, s)
+		} else {
+			stable = append(stable, s)
+		}
+	}
+
+	// The text view keeps its original "Plugin installs:" section: only agents with
+	// a recorded plugin install are shown here, so an agent whose only install is
+	// raw skills isn't labelled as a plugin (its skills show in the table below).
+	// The richer per-agent detection state (every registry agent, skills installs
+	// included) is JSON-only, for the extension.
+	var pluginInstalls []agentEntry
+	for _, a := range out.Agents {
+		if a.hasPluginInstall() {
+			pluginInstalls = append(pluginInstalls, a)
+		}
+	}
+
+	if len(pluginInstalls) > 0 {
+		cmdio.LogString(ctx, "Plugin installs:")
+		cmdio.LogString(ctx, "")
+		var ab strings.Builder
+		atw := tabwriter.NewWriter(&ab, 0, 4, 2, ' ', 0)
+		fmt.Fprintln(atw, "  AGENT\tSTATUS")
+		for _, a := range pluginInstalls {
+			fmt.Fprintf(atw, "  %s\t%s\n", agentDisplayName(a.Name), agentStatusLabel(a, out.Release))
+		}
+		atw.Flush()
+		cmdio.LogString(ctx, ab.String())
+		cmdio.LogString(ctx, "")
+	}
+
+	cmdio.LogString(ctx, "Available raw skill directories ("+versionToken(out.Release)+"):")
+	cmdio.LogString(ctx, "")
+	cmdio.LogString(ctx, renderSkillTable(stable, bothScopes))
+
+	if len(experimental) > 0 {
+		cmdio.LogString(ctx, "Experimental skills:")
+		cmdio.LogString(ctx, "")
+		cmdio.LogString(ctx, renderSkillTable(experimental, bothScopes))
+	}
+
+	cmdio.LogString(ctx, summaryLine(out, scope))
+}
+
+// renderSkillTable formats a NAME/VERSION/INSTALLED table for a group of skills.
+func renderSkillTable(skills []skillEntry, bothScopes bool) string {
+	var buf strings.Builder
+	tw := tabwriter.NewWriter(&buf, 0, 4, 2, ' ', 0)
+	fmt.Fprintln(tw, "  NAME\tVERSION\tINSTALLED")
+	for _, s := range skills {
+		fmt.Fprintf(tw, "  %s\tv%s\t%s\n", s.Name, s.LatestVersion, installedStatusFromEntry(s, bothScopes))
+	}
+	tw.Flush()
+	return buf.String()
+}
+
+// agentStatusLabel renders the text-view status for an agent, collapsing the
+// per-scope plugin records into a single line. A stale scope (version !=
+// release) is surfaced over an up-to-date one so an outdated install is never
+// hidden; project is preferred when every scope matches release. Skills installs
+// are skipped: this line reports the plugin, and their versions would otherwise
+// decide the status of an agent that also has a plugin in another scope.
+func agentStatusLabel(a agentEntry, release string) string {
+	version, upToDate := "", true
+	for _, scope := range []string{installer.ScopeProject, installer.ScopeGlobal} {
+		info, ok := a.Installed[scope]
+		if !ok || info.Delivery != deliveryPlugin.String() {
+			continue
+		}
+		stale := info.Version != release
+		if version == "" || (upToDate && stale) {
+			version = info.Version
+		}
+		if stale {
+			upToDate = false
+		}
+	}
+
+	if upToDate {
+		return "databricks plugin · " + versionToken(version) + " · up to date"
+	}
+	return "databricks plugin · " + versionToken(version) + " · update available"
+}
+
+func installedStatusFromEntry(s skillEntry, bothScopes bool) string {
+	globalVer := s.Installed[installer.ScopeGlobal]
+	projectVer := s.Installed[installer.ScopeProject]
+
+	if globalVer == "" && projectVer == "" {
+		return "not installed"
+	}
+
+	if bothScopes && globalVer != "" && projectVer != "" {
+		return versionLabel(projectVer, s.LatestVersion) + " (project, global)"
+	}
+
+	if projectVer != "" {
+		label := versionLabel(projectVer, s.LatestVersion)
+		if bothScopes {
+			return label + " (project)"
+		}
+		return label
+	}
+
+	label := versionLabel(globalVer, s.LatestVersion)
+	if bothScopes {
+		return label + " (global)"
+	}
+	return label
+}
+
+// versionLabel formats version with update status.
+func versionLabel(installed, latest string) string {
+	if installed == latest {
+		return "v" + installed + " (up to date)"
+	}
+	return "v" + installed + " (update available)"
+}
+
+func summaryLine(out listOutput, scope string) string {
+	g, gOK := out.Summary[installer.ScopeGlobal]
+	p, pOK := out.Summary[installer.ScopeProject]
+
+	switch {
+	case gOK && pOK:
+		// Mirror prior behavior: only print the dual-scope line when both
+		// scopes have a state file; otherwise only mention the one that does.
+		if g.loaded && p.loaded {
+			return fmt.Sprintf("%d/%d raw skill directories installed (global), %d/%d (project)", g.Installed, g.Total, p.Installed, p.Total)
+		}
+		if p.loaded {
+			return fmt.Sprintf("%d/%d raw skill directories installed (project)", p.Installed, p.Total)
+		}
+		return fmt.Sprintf("%d/%d raw skill directories installed (global)", g.Installed, g.Total)
+	case pOK:
+		return fmt.Sprintf("%d/%d raw skill directories installed (project)", p.Installed, p.Total)
+	default:
+		return fmt.Sprintf("%d/%d raw skill directories installed (global)", g.Installed, g.Total)
+	}
+}
diff --git a/cmd/aitools/list_test.go b/cmd/aitools/list_test.go
new file mode 100644
index 00000000000..72e236933b4
--- /dev/null
+++ b/cmd/aitools/list_test.go
@@ -0,0 +1,614 @@
+package aitools
+
+import (
+	"bytes"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+
+	"github.com/databricks/cli/libs/aitools/installer"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/env"
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestListCommandExists(t *testing.T) {
+	cmd := NewListCmd()
+	assert.Equal(t, "list", cmd.Use)
+}
+
+func TestListCommandCallsListFn(t *testing.T) {
+	orig := listSkillsFn
+	t.Cleanup(func() { listSkillsFn = orig })
+
+	called := false
+	listSkillsFn = func(cmd *cobra.Command, scope string) error {
+		called = true
+		return nil
+	}
+
+	ctx := cmdio.MockDiscard(t.Context())
+	cmd := NewListCmd()
+	cmd.SetContext(ctx)
+
+	err := cmd.RunE(cmd, nil)
+	require.NoError(t, err)
+	assert.True(t, called)
+}
+
+func TestListCommandHasScopeFlags(t *testing.T) {
+	cmd := NewListCmd()
+	f := cmd.Flags().Lookup("project")
+	require.NotNil(t, f, "--project flag should exist (deprecated alias)")
+	assert.NotEmpty(t, f.Deprecated, "--project should be marked deprecated")
+	f = cmd.Flags().Lookup("global")
+	require.NotNil(t, f, "--global flag should exist (deprecated alias)")
+	assert.NotEmpty(t, f.Deprecated, "--global should be marked deprecated")
+	f = cmd.Flags().Lookup("scope")
+	require.NotNil(t, f, "--scope flag should exist")
+}
+
+func TestRenderListJSON(t *testing.T) {
+	out := listOutput{
+		Release: "0.1.0",
+		Skills: []skillEntry{
+			{
+				Name:          "databricks-jobs",
+				LatestVersion: "1.0.0",
+				Experimental:  false,
+				Installed: map[string]string{
+					installer.ScopeGlobal:  "1.0.0",
+					installer.ScopeProject: "0.9.0",
+				},
+			},
+			{
+				Name:          "experimental-thing",
+				LatestVersion: "0.1.0",
+				Experimental:  true,
+				Installed:     map[string]string{},
+			},
+		},
+		Summary: map[string]scopeSummary{
+			installer.ScopeGlobal:  {Installed: 1, Total: 2},
+			installer.ScopeProject: {Installed: 1, Total: 2},
+		},
+	}
+
+	var buf bytes.Buffer
+	require.NoError(t, renderJSON(&buf, out))
+
+	var got listOutput
+	require.NoError(t, json.Unmarshal(buf.Bytes(), &got))
+	assert.Equal(t, out, got)
+
+	var raw map[string]any
+	require.NoError(t, json.Unmarshal(buf.Bytes(), &raw))
+	assert.Contains(t, raw, "release")
+	assert.Contains(t, raw, "skills")
+	assert.Contains(t, raw, "summary")
+
+	skills := raw["skills"].([]any)
+	first := skills[0].(map[string]any)
+	assert.Equal(t, "databricks-jobs", first["name"])
+	assert.Equal(t, "1.0.0", first["latest_version"])
+	assert.Equal(t, false, first["experimental"])
+
+	installed := first["installed"].(map[string]any)
+	assert.Equal(t, "1.0.0", installed["global"])
+	assert.Equal(t, "0.9.0", installed["project"])
+
+	second := skills[1].(map[string]any)
+	assert.Equal(t, true, second["experimental"])
+	assert.Empty(t, second["installed"])
+}
+
+func TestRenderListJSONWithAgents(t *testing.T) {
+	out := listOutput{
+		Release: "0.2.6",
+		Skills:  []skillEntry{},
+		Summary: map[string]scopeSummary{installer.ScopeGlobal: {Installed: 0, Total: 0}},
+		Agents: []agentEntry{
+			{
+				Name:                 "claude-code",
+				DisplayName:          "Claude Code",
+				Managed:              true,
+				Detected:             true,
+				SupportsProjectScope: true,
+				Installed:            map[string]installInfo{installer.ScopeGlobal: {Delivery: "plugin", Version: "0.2.6"}},
+			},
+			{
+				Name:        "cursor",
+				DisplayName: "Cursor",
+				Managed:     false,
+				Installed:   map[string]installInfo{},
+			},
+		},
+	}
+
+	var buf bytes.Buffer
+	require.NoError(t, renderJSON(&buf, out))
+
+	var raw map[string]any
+	require.NoError(t, json.Unmarshal(buf.Bytes(), &raw))
+	// Existing contract keys remain.
+	assert.Contains(t, raw, "release")
+	assert.Contains(t, raw, "skills")
+	assert.Contains(t, raw, "summary")
+
+	agentsRaw := raw["agents"].([]any)
+	require.Len(t, agentsRaw, 2)
+	first := agentsRaw[0].(map[string]any)
+	assert.Equal(t, "claude-code", first["name"])
+	assert.Equal(t, "Claude Code", first["display_name"])
+	assert.Equal(t, true, first["managed"])
+	assert.Equal(t, true, first["detected"])
+	assert.Equal(t, true, first["supports_project_scope"])
+	installed := first["installed"].(map[string]any)
+	global := installed["global"].(map[string]any)
+	assert.Equal(t, "0.2.6", global["version"])
+	assert.Equal(t, "plugin", global["delivery"])
+
+	// A not-installed agent emits "installed": {} rather than omitting the key,
+	// matching the skills shape.
+	second := agentsRaw[1].(map[string]any)
+	assert.Contains(t, second, "installed")
+	assert.Empty(t, second["installed"])
+	assert.Equal(t, false, second["supports_project_scope"])
+}
+
+func TestBuildAgentEntries(t *testing.T) {
+	// Isolate HOME so the skills-only on-disk detection doesn't pick up the
+	// developer's real agent skills dirs.
+	ctx := env.WithUserHomeDir(t.Context(), t.TempDir())
+	globalState := &installer.InstallState{
+		Plugins: map[string]installer.PluginRecord{
+			"claude-code": {Plugin: "databricks", Version: "0.2.6"},
+			"codex":       {Plugin: "databricks", Version: "0.2.5"},
+		},
+	}
+
+	entries := buildAgentEntries(ctx, map[string]*installer.InstallState{
+		installer.ScopeGlobal: globalState,
+	})
+	byName := map[string]agentEntry{}
+	for _, e := range entries {
+		byName[e.Name] = e
+	}
+
+	require.Contains(t, byName, "claude-code")
+	assert.True(t, byName["claude-code"].Managed)
+	assert.Equal(t, "Claude Code", byName["claude-code"].DisplayName)
+	assert.Equal(t, "0.2.6", byName["claude-code"].Installed[installer.ScopeGlobal].Version)
+	assert.Equal(t, "databricks plugin · v0.2.6 · up to date", agentStatusLabel(byName["claude-code"], "0.2.6"))
+	// SupportsProjectScope is wired straight from the registry: claude-code allows
+	// project scope, whereas the managed/skills-only global-only agents below do not.
+	assert.True(t, byName["claude-code"].SupportsProjectScope)
+
+	require.Contains(t, byName, "codex")
+	assert.True(t, byName["codex"].Managed)
+	assert.Equal(t, "0.2.5", byName["codex"].Installed[installer.ScopeGlobal].Version)
+	assert.Equal(t, "databricks plugin · v0.2.5 · update available", agentStatusLabel(byName["codex"], "0.2.6"))
+	assert.False(t, byName["codex"].SupportsProjectScope)
+
+	// The JSON output carries an entry for every registry agent, including
+	// skills-only agents like Cursor and managed agents with no recorded install.
+	require.Contains(t, byName, "cursor")
+	assert.False(t, byName["cursor"].Managed)
+	assert.Empty(t, byName["cursor"].Installed)
+	assert.False(t, byName["cursor"].SupportsProjectScope)
+
+	require.Contains(t, byName, "copilot")
+	assert.True(t, byName["copilot"].Managed)
+	assert.Empty(t, byName["copilot"].Installed)
+}
+
+func TestBuildAgentEntriesReportsSkillsOnlyAgentFromDisk(t *testing.T) {
+	// Skills-only agents (Plugin == nil) never get a plugin record; their skills
+	// are symlinked into the agent's own skills dir. The install must still be
+	// reported from disk, versioned by the scope's recorded release.
+	home := t.TempDir()
+	ctx := env.WithUserHomeDir(t.Context(), home)
+
+	// On Windows, openCodeConfigDir checks APPDATA first; on other platforms,
+	// it checks XDG_CONFIG_HOME. Override the platform-specific setting to route
+	// config discovery to a temp directory so the test controls where the function
+	// looks for skills, regardless of system defaults.
+	configDir := filepath.Join(home, ".config")
+	if runtime.GOOS == "windows" {
+		ctx = env.Set(ctx, "APPDATA", configDir)
+	} else {
+		ctx = env.Set(ctx, "XDG_CONFIG_HOME", configDir)
+	}
+
+	// OpenCode is skills-only; its global skills dir is configDir/opencode/skills.
+	// The CLI installs skills there as symlinks to the canonical store, so build
+	// the symlink to exercise the real on-disk shape.
+	canonical := filepath.Join(home, ".databricks", "aitools", "skills", "databricks-jobs")
+	require.NoError(t, os.MkdirAll(canonical, 0o755))
+	skillsDir := filepath.Join(configDir, "opencode", "skills")
+	require.NoError(t, os.MkdirAll(skillsDir, 0o755))
+	require.NoError(t, os.Symlink(canonical, filepath.Join(skillsDir, "databricks-jobs")))
+
+	globalState := &installer.InstallState{Release: "0.2.6"}
+	entries := buildAgentEntries(ctx, map[string]*installer.InstallState{
+		installer.ScopeGlobal: globalState,
+	})
+	byName := map[string]agentEntry{}
+	for _, e := range entries {
+		byName[e.Name] = e
+	}
+
+	require.Contains(t, byName, "opencode")
+	opencode := byName["opencode"]
+	assert.False(t, opencode.Managed)
+	assert.Equal(t, "0.2.6", opencode.Installed[installer.ScopeGlobal].Version)
+	assert.Equal(t, "skills", opencode.Installed[installer.ScopeGlobal].Delivery)
+
+	// A skills-only agent with nothing on disk stays empty.
+	require.Contains(t, byName, "cursor")
+	assert.Empty(t, byName["cursor"].Installed)
+}
+
+func TestBuildAgentEntriesReportsSkillsOnlyInstallForPluginAgent(t *testing.T) {
+	// `install --skills-only` gives a plugin-capable agent skills on disk and no
+	// plugin record, so the on-disk fallback must fire for it too rather than
+	// reporting it as not installed.
+	home := t.TempDir()
+	ctx := env.WithUserHomeDir(t.Context(), home)
+
+	canonical := filepath.Join(home, ".databricks", "aitools", "skills", "databricks-jobs")
+	require.NoError(t, os.MkdirAll(canonical, 0o755))
+	skillsDir := filepath.Join(home, ".claude", "skills")
+	require.NoError(t, os.MkdirAll(skillsDir, 0o755))
+	require.NoError(t, os.Symlink(canonical, filepath.Join(skillsDir, "databricks-jobs")))
+
+	entries := buildAgentEntries(ctx, map[string]*installer.InstallState{
+		installer.ScopeGlobal: {Release: "0.2.6"},
+	})
+	byName := map[string]agentEntry{}
+	for _, e := range entries {
+		byName[e.Name] = e
+	}
+
+	require.Contains(t, byName, "claude-code")
+	cc := byName["claude-code"]
+	assert.True(t, cc.Managed)
+	assert.Equal(t, "skills", cc.Installed[installer.ScopeGlobal].Delivery)
+	assert.Equal(t, "0.2.6", cc.Installed[installer.ScopeGlobal].Version)
+
+	// A skills install is not a plugin install, so the text view's "Plugin
+	// installs:" section must not claim one.
+	assert.False(t, cc.hasPluginInstall())
+}
+
+func TestBuildAgentEntriesPrefersPluginRecordOverSkillsOnDisk(t *testing.T) {
+	// An agent can have both a plugin record and leftover skills on disk (e.g. a
+	// --skills-only install later replaced by the plugin). The recorded plugin is
+	// authoritative for the scope.
+	home := t.TempDir()
+	ctx := env.WithUserHomeDir(t.Context(), home)
+
+	canonical := filepath.Join(home, ".databricks", "aitools", "skills", "databricks-jobs")
+	require.NoError(t, os.MkdirAll(canonical, 0o755))
+	skillsDir := filepath.Join(home, ".claude", "skills")
+	require.NoError(t, os.MkdirAll(skillsDir, 0o755))
+	require.NoError(t, os.Symlink(canonical, filepath.Join(skillsDir, "databricks-jobs")))
+
+	entries := buildAgentEntries(ctx, map[string]*installer.InstallState{
+		installer.ScopeGlobal: {
+			Release: "0.2.6",
+			Plugins: map[string]installer.PluginRecord{
+				"claude-code": {Plugin: "databricks", Version: "0.2.5", Scope: "user"},
+			},
+		},
+	})
+	byName := map[string]agentEntry{}
+	for _, e := range entries {
+		byName[e.Name] = e
+	}
+
+	cc := byName["claude-code"]
+	assert.Equal(t, "plugin", cc.Installed[installer.ScopeGlobal].Delivery)
+	assert.Equal(t, "0.2.5", cc.Installed[installer.ScopeGlobal].Version)
+	assert.Equal(t, "user", cc.Installed[installer.ScopeGlobal].NativeScope)
+}
+
+func TestBuildAgentEntriesRecordsPerScopeVersions(t *testing.T) {
+	// Same agent recorded in both scopes: global current, project stale. Both
+	// versions are recorded; no scope is merged away.
+	globalState := &installer.InstallState{Plugins: map[string]installer.PluginRecord{
+		"claude-code": {Plugin: "databricks", Version: "0.2.6"},
+	}}
+	projectState := &installer.InstallState{Plugins: map[string]installer.PluginRecord{
+		"claude-code": {Plugin: "databricks", Version: "0.2.5"},
+	}}
+
+	entries := buildAgentEntries(t.Context(), map[string]*installer.InstallState{
+		installer.ScopeGlobal:  globalState,
+		installer.ScopeProject: projectState,
+	})
+	byName := map[string]agentEntry{}
+	for _, e := range entries {
+		byName[e.Name] = e
+	}
+
+	require.Contains(t, byName, "claude-code")
+	cc := byName["claude-code"]
+	assert.True(t, cc.Managed)
+	assert.Equal(t, "0.2.6", cc.Installed[installer.ScopeGlobal].Version)
+	assert.Equal(t, "0.2.5", cc.Installed[installer.ScopeProject].Version)
+
+	// The renderer collapses the scopes and surfaces the stale one, rather than
+	// hiding it behind the up-to-date scope.
+	assert.Equal(t, "databricks plugin · v0.2.5 · update available", agentStatusLabel(cc, "0.2.6"))
+}
+
+func TestRenderListJSONScopeFiltersSummary(t *testing.T) {
+	out := listOutput{
+		Release: "0.1.0",
+		Skills:  []skillEntry{},
+		Summary: map[string]scopeSummary{
+			installer.ScopeGlobal: {Installed: 0, Total: 5},
+		},
+	}
+
+	var buf bytes.Buffer
+	require.NoError(t, renderJSON(&buf, out))
+
+	var raw map[string]any
+	require.NoError(t, json.Unmarshal(buf.Bytes(), &raw))
+	summary := raw["summary"].(map[string]any)
+	assert.Contains(t, summary, "global")
+	assert.NotContains(t, summary, "project")
+}
+
+func TestInstalledStatusFromEntry(t *testing.T) {
+	tests := []struct {
+		name       string
+		entry      skillEntry
+		bothScopes bool
+		want       string
+	}{
+		{
+			name:  "not installed",
+			entry: skillEntry{LatestVersion: "1.0.0", Installed: map[string]string{}},
+			want:  "not installed",
+		},
+		{
+			name: "global up to date",
+			entry: skillEntry{
+				LatestVersion: "1.0.0",
+				Installed:     map[string]string{installer.ScopeGlobal: "1.0.0"},
+			},
+			want: "v1.0.0 (up to date)",
+		},
+		{
+			name: "project update available",
+			entry: skillEntry{
+				LatestVersion: "1.0.0",
+				Installed:     map[string]string{installer.ScopeProject: "0.9.0"},
+			},
+			want: "v0.9.0 (update available)",
+		},
+		{
+			name: "both scopes installed",
+			entry: skillEntry{
+				LatestVersion: "1.0.0",
+				Installed: map[string]string{
+					installer.ScopeGlobal:  "1.0.0",
+					installer.ScopeProject: "0.9.0",
+				},
+			},
+			bothScopes: true,
+			want:       "v0.9.0 (update available) (project, global)",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, installedStatusFromEntry(tt.entry, tt.bothScopes))
+		})
+	}
+}
+
+func TestSummaryLinePreservesStatePresence(t *testing.T) {
+	tests := []struct {
+		name string
+		out  listOutput
+		want string
+	}{
+		{
+			name: "both state files loaded even with no installs",
+			out: listOutput{
+				Skills: []skillEntry{
+					{Name: "databricks-jobs", LatestVersion: "1.0.0", Installed: map[string]string{}},
+				},
+				Summary: map[string]scopeSummary{
+					installer.ScopeGlobal:  {Installed: 0, Total: 1, loaded: true},
+					installer.ScopeProject: {Installed: 0, Total: 1, loaded: true},
+				},
+			},
+			want: "0/1 raw skill directories installed (global), 0/1 (project)",
+		},
+		{
+			name: "only project state loaded",
+			out: listOutput{
+				Skills: []skillEntry{
+					{Name: "databricks-jobs", LatestVersion: "1.0.0", Installed: map[string]string{}},
+				},
+				Summary: map[string]scopeSummary{
+					installer.ScopeGlobal:  {Installed: 0, Total: 1},
+					installer.ScopeProject: {Installed: 0, Total: 1, loaded: true},
+				},
+			},
+			want: "0/1 raw skill directories installed (project)",
+		},
+		{
+			name: "only global state loaded",
+			out: listOutput{
+				Skills: []skillEntry{
+					{Name: "databricks-jobs", LatestVersion: "1.0.0", Installed: map[string]string{}},
+				},
+				Summary: map[string]scopeSummary{
+					installer.ScopeGlobal:  {Installed: 0, Total: 1, loaded: true},
+					installer.ScopeProject: {Installed: 0, Total: 1},
+				},
+			},
+			want: "0/1 raw skill directories installed (global)",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, summaryLine(tt.out, ""))
+		})
+	}
+}
+
+func TestRenderListTextUsesLoadedStateForScopeLabels(t *testing.T) {
+	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
+	out := listOutput{
+		Release: "0.1.0",
+		Skills: []skillEntry{
+			{
+				Name:          "databricks-jobs",
+				LatestVersion: "1.0.0",
+				Installed: map[string]string{
+					installer.ScopeGlobal: "1.0.0",
+				},
+			},
+		},
+		Summary: map[string]scopeSummary{
+			installer.ScopeGlobal:  {Installed: 1, Total: 1, loaded: true},
+			installer.ScopeProject: {Installed: 0, Total: 1, loaded: true},
+		},
+	}
+
+	renderListText(ctx, out, "")
+
+	got := stderr.String()
+	assert.Contains(t, got, "v1.0.0 (up to date) (global)")
+	assert.Contains(t, got, "1/1 raw skill directories installed (global), 0/1 (project)")
+}
+
+func TestRenderListTextGroupsExperimental(t *testing.T) {
+	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
+	out := listOutput{
+		Release: "latest",
+		Skills: []skillEntry{
+			{Name: "databricks-jobs", LatestVersion: "1.0.0", Installed: map[string]string{}},
+			{Name: "experimental-thing", LatestVersion: "0.1.0", Experimental: true, Installed: map[string]string{}},
+		},
+		Summary: map[string]scopeSummary{
+			installer.ScopeGlobal: {Installed: 0, Total: 2, loaded: true},
+		},
+	}
+
+	renderListText(ctx, out, installer.ScopeGlobal)
+
+	got := stderr.String()
+	availIdx := strings.Index(got, "Available raw skill directories")
+	expIdx := strings.Index(got, "Experimental skills:")
+	require.GreaterOrEqual(t, availIdx, 0, "available group header present")
+	require.GreaterOrEqual(t, expIdx, 0, "experimental group header present")
+	assert.Less(t, availIdx, expIdx, "available group comes before experimental group")
+	// Stable skill sits in the first group; experimental skill sits under its own header.
+	assert.Less(t, strings.Index(got, "databricks-jobs"), expIdx)
+	assert.Less(t, expIdx, strings.Index(got, "experimental-thing"))
+	// No inline tag now that they are grouped.
+	assert.NotContains(t, got, "[experimental]")
+}
+
+func TestRenderListTextShowsPluginInstallsBeforeRawSkills(t *testing.T) {
+	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
+	out := listOutput{
+		Release: "0.2.6",
+		Skills: []skillEntry{
+			{Name: "databricks-jobs", LatestVersion: "1.0.0", Installed: map[string]string{}},
+		},
+		Summary: map[string]scopeSummary{
+			installer.ScopeGlobal: {Installed: 0, Total: 1, loaded: true},
+		},
+		Agents: []agentEntry{
+			{
+				Name:        "claude-code",
+				DisplayName: "Claude Code",
+				Managed:     true,
+				Detected:    true,
+				Installed:   map[string]installInfo{installer.ScopeGlobal: {Delivery: "plugin", Version: "0.2.6", NativeScope: "user"}},
+			},
+			{
+				Name:        "cursor",
+				DisplayName: "Cursor",
+				Managed:     false,
+			},
+		},
+	}
+
+	renderListText(ctx, out, installer.ScopeGlobal)
+
+	got := stderr.String()
+	pluginIdx := strings.Index(got, "Plugin installs:")
+	rawIdx := strings.Index(got, "Available raw skill directories")
+	require.GreaterOrEqual(t, pluginIdx, 0)
+	require.GreaterOrEqual(t, rawIdx, 0)
+	assert.Less(t, pluginIdx, rawIdx)
+	assert.Contains(t, got, "Claude Code")
+	assert.Contains(t, got, "databricks plugin · v0.2.6 · up to date")
+	// Skills-only agents (and any without a recorded install) are JSON-only and
+	// must not appear in the text "Plugin installs:" section.
+	assert.NotContains(t, got, "Cursor")
+	assert.Contains(t, got, "0/1 raw skill directories installed (global)")
+}
+
+func TestListScopeFlag(t *testing.T) {
+	tests := []struct {
+		name      string
+		args      []string
+		wantScope string
+		wantErr   string
+	}{
+		{name: "scope project", args: []string{"--scope", "project"}, wantScope: installer.ScopeProject},
+		{name: "scope global", args: []string{"--scope", "global"}, wantScope: installer.ScopeGlobal},
+		{name: "scope both shows both", args: []string{"--scope", "both"}, wantScope: ""},
+		{name: "scope invalid", args: []string{"--scope", "all"}, wantErr: `invalid --scope "all"`},
+		{name: "legacy both flags together rejected", args: []string{"--project", "--global"}, wantErr: "cannot use --global and --project together"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			orig := listSkillsFn
+			t.Cleanup(func() { listSkillsFn = orig })
+
+			var gotScope string
+			called := false
+			listSkillsFn = func(_ *cobra.Command, scope string) error {
+				called = true
+				gotScope = scope
+				return nil
+			}
+
+			ctx := cmdio.MockDiscard(t.Context())
+			cmd := NewListCmd()
+			cmd.SetContext(ctx)
+			cmd.SetArgs(tt.args)
+			cmd.SilenceErrors = true
+			cmd.SilenceUsage = true
+
+			err := cmd.Execute()
+			if tt.wantErr != "" {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), tt.wantErr)
+				return
+			}
+			require.NoError(t, err)
+			assert.True(t, called)
+			assert.Equal(t, tt.wantScope, gotScope)
+		})
+	}
+}
diff --git a/cmd/aitools/scope.go b/cmd/aitools/scope.go
new file mode 100644
index 00000000000..71c9b5f24f9
--- /dev/null
+++ b/cmd/aitools/scope.go
@@ -0,0 +1,398 @@
+package aitools
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"github.com/charmbracelet/huh"
+	"github.com/databricks/cli/libs/aitools/agents"
+	"github.com/databricks/cli/libs/aitools/installer"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/env"
+	"github.com/spf13/cobra"
+)
+
+// Agent-native plugin scopes. These are distinct from installer.ScopeGlobal /
+// installer.ScopeProject, which name the on-disk skills directories; these name
+// the scope token an agent's plugin CLI understands.
+const (
+	agentScopeUser    = "user"
+	agentScopeProject = "project"
+)
+
+// mapAgentScope maps the CLI scope (global/project) to an agent's own plugin
+// scope. CLI global maps to the agent's user scope. CLI project maps to the
+// agent's project scope only when the agent supports it (Claude today); other
+// agents are skipped with a reason rather than silently falling back to user
+// scope (goals Decision #1; Copilot is user-only for v1, Codex is user-only).
+func mapAgentScope(a *agents.Agent, cliScope string) (scope string, ok bool, reason string) {
+	if cliScope == installer.ScopeProject {
+		if a.SupportsProjectScope {
+			return agentScopeProject, true, ""
+		}
+		return "", false, a.DisplayName + " is user-only; project scope is not supported"
+	}
+	return agentScopeUser, true, ""
+}
+
+// promptScopeSelection is a package-level var so tests can replace it with a mock.
+var promptScopeSelection = defaultPromptScopeSelection
+
+// promptUpdateScopeSelection is a package-level var for the update scope prompt (3 options: global/project/both).
+var promptUpdateScopeSelection = defaultPromptUpdateScopeSelection
+
+// promptUninstallScopeSelection is a package-level var for the uninstall scope prompt (2 options: global/project).
+var promptUninstallScopeSelection = defaultPromptUninstallScopeSelection
+
+// resolveScope validates --project and --global flags and returns the scope.
+func resolveScope(project, global bool) (string, error) {
+	if project && global {
+		return "", errors.New("cannot use --global and --project together")
+	}
+	if project {
+		return installer.ScopeProject, nil
+	}
+	return installer.ScopeGlobal, nil
+}
+
+// resolveScopeWithPrompt resolves scope with optional interactive prompt.
+// When neither flag is set: interactive mode shows a prompt (default: global),
+// non-interactive mode uses global.
+func resolveScopeWithPrompt(ctx context.Context, project, global bool) (string, error) {
+	if project || global {
+		return resolveScope(project, global)
+	}
+
+	// No flag: prompt if interactive, default to global otherwise.
+	if cmdio.IsPromptSupported(ctx) {
+		return promptScopeSelection(ctx)
+	}
+	return installer.ScopeGlobal, nil
+}
+
+func defaultPromptScopeSelection(ctx context.Context) (string, error) {
+	homeDir, err := env.UserHomeDir(ctx)
+	if err != nil {
+		return "", err
+	}
+	globalPath := filepath.Join(homeDir, ".databricks", "aitools", "skills")
+
+	cwd, err := os.Getwd()
+	if err != nil {
+		return "", err
+	}
+	projectPath := filepath.Join(cwd, ".databricks", "aitools", "skills")
+
+	globalLabel := "User global (" + globalPath + "/)\n    Available to you across all projects."
+	projectLabel := "Project (" + projectPath + "/)\n    Checked into the repo, shared with everyone on the project."
+
+	var scope string
+	err = huh.NewSelect[string]().
+		Title("Where should skills be installed?").
+		Options(
+			huh.NewOption(globalLabel, installer.ScopeGlobal),
+			huh.NewOption(projectLabel, installer.ScopeProject),
+		).
+		Value(&scope).
+		Run()
+	if err != nil {
+		return "", err
+	}
+
+	return scope, nil
+}
+
+const scopeBoth = "both"
+
+// markScopeBoolsDeprecated hides --project and --global from help and emits a
+// stderr warning pointing at --scope when they're used. The booleans are kept
+// so existing scripts and the experimental backward-compat aliases keep
+// working through the next release.
+func markScopeBoolsDeprecated(cmd *cobra.Command) {
+	cmd.Flags().Lookup("project").Deprecated = "use --scope=project"
+	cmd.Flags().Lookup("project").Hidden = true
+	cmd.Flags().Lookup("global").Deprecated = "use --scope=global"
+	cmd.Flags().Lookup("global").Hidden = true
+}
+
+// parseScopeFlag translates --scope into the equivalent --project/--global bool pair.
+// Returns (projectFlag, globalFlag, nil) unchanged when --scope is empty so the
+// deprecated booleans can keep flowing through the existing resolveScope* helpers
+// (including update's supported `--project --global` "both scopes" path). Errors
+// if --scope is combined with --project or --global. When allowBoth is false,
+// --scope=both is rejected up front so install and uninstall don't have to
+// special-case it.
+//
+// Note: install/list/uninstall reject the legacy `--project --global` combination
+// at their own RunE / resolveScope layer; update intentionally accepts it as the
+// "both scopes" path until those flags are removed.
+func parseScopeFlag(scopeFlag string, projectFlag, globalFlag, allowBoth bool) (proj, glob bool, err error) {
+	if scopeFlag == "" {
+		return projectFlag, globalFlag, nil
+	}
+	if projectFlag || globalFlag {
+		return false, false, errors.New("cannot use --scope with --project or --global; --project and --global are deprecated aliases for --scope")
+	}
+	switch scopeFlag {
+	case installer.ScopeProject:
+		return true, false, nil
+	case installer.ScopeGlobal:
+		return false, true, nil
+	case scopeBoth:
+		if !allowBoth {
+			return false, false, errors.New("--scope=both is not supported for this command; use 'project' or 'global'")
+		}
+		return true, true, nil
+	default:
+		if allowBoth {
+			return false, false, fmt.Errorf("invalid --scope %q: must be one of project, global, both", scopeFlag)
+		}
+		return false, false, fmt.Errorf("invalid --scope %q: must be one of project, global", scopeFlag)
+	}
+}
+
+// detectInstalledScopes checks which scopes have a .state.json file present.
+func detectInstalledScopes(globalDir, projectDir string) (global, project bool, err error) {
+	globalState, err := installer.LoadState(globalDir)
+	if err != nil {
+		return false, false, err
+	}
+
+	projectState, err := installer.LoadState(projectDir)
+	if err != nil {
+		return false, false, err
+	}
+
+	return globalState != nil, projectState != nil, nil
+}
+
+// resolveScopeForUpdate resolves scopes for the update command.
+// Returns one or more scopes to update. When both flags are set, global always passes through
+// (for legacy install detection) and project is checked via state.
+func resolveScopeForUpdate(ctx context.Context, projectFlag, globalFlag bool, globalDir, projectDir string) ([]string, error) {
+	hasGlobal, hasProject, err := detectInstalledScopes(globalDir, projectDir)
+	if err != nil {
+		return nil, err
+	}
+
+	if projectFlag && globalFlag {
+		var scopes []string
+		if hasGlobal {
+			scopes = append(scopes, installer.ScopeGlobal)
+		}
+		if hasProject {
+			scopes = append(scopes, installer.ScopeProject)
+		}
+		if len(scopes) == 0 {
+			// Neither installed. Fall through to global for legacy detection.
+			return []string{installer.ScopeGlobal}, nil
+		}
+		return scopes, nil
+	}
+	if projectFlag {
+		return withExplicitScopeCheck(projectDir, installer.ScopeProject, "update", projectDir, hasGlobal, hasProject)
+	}
+	if globalFlag {
+		// Always pass through to the installer layer, which handles legacy installs.
+		return []string{installer.ScopeGlobal}, nil
+	}
+
+	// No flags: auto-detect.
+	switch {
+	case hasGlobal && hasProject:
+		if !cmdio.IsPromptSupported(ctx) {
+			return nil, errors.New("skills are installed in both global and project scopes; use --scope=global, --scope=project, or --scope=both to specify which to update")
+		}
+		scopes, err := promptUpdateScopeSelection(ctx)
+		if err != nil {
+			return nil, err
+		}
+		return scopes, nil
+
+	case hasGlobal:
+		return []string{installer.ScopeGlobal}, nil
+
+	case hasProject:
+		return []string{installer.ScopeProject}, nil
+
+	default:
+		// Fall through to global scope so the installer layer can detect
+		// legacy installs (skills on disk without .state.json) and provide
+		// appropriate migration guidance.
+		return []string{installer.ScopeGlobal}, nil
+	}
+}
+
+// resolveScopeForUninstall resolves the scope for the uninstall command.
+// Unlike update, uninstall never allows "both" scopes at once.
+func resolveScopeForUninstall(ctx context.Context, projectFlag, globalFlag bool, globalDir, projectDir string) (string, error) {
+	if projectFlag && globalFlag {
+		return "", errors.New("cannot uninstall both scopes at once; run uninstall separately with --scope=global and --scope=project")
+	}
+
+	hasGlobal, hasProject, err := detectInstalledScopes(globalDir, projectDir)
+	if err != nil {
+		return "", err
+	}
+
+	if projectFlag {
+		scopes, err := withExplicitScopeCheck(projectDir, installer.ScopeProject, "uninstall", projectDir, hasGlobal, hasProject)
+		if err != nil {
+			return "", err
+		}
+		return scopes[0], nil
+	}
+	if globalFlag {
+		// Always pass through to the installer layer, which handles legacy installs.
+		return installer.ScopeGlobal, nil
+	}
+
+	// No flags: auto-detect.
+	switch {
+	case hasGlobal && hasProject:
+		if !cmdio.IsPromptSupported(ctx) {
+			return "", errors.New("skills are installed in both global and project scopes; use --scope=global or --scope=project to specify which to uninstall")
+		}
+		scope, err := promptUninstallScopeSelection(ctx)
+		if err != nil {
+			return "", err
+		}
+		return scope, nil
+
+	case hasGlobal:
+		return installer.ScopeGlobal, nil
+
+	case hasProject:
+		return installer.ScopeProject, nil
+
+	default:
+		// Fall through to global scope so the installer layer can detect
+		// legacy installs (skills on disk without .state.json) and provide
+		// appropriate migration guidance.
+		return installer.ScopeGlobal, nil
+	}
+}
+
+// withExplicitScopeCheck validates that the explicitly requested scope has an installation.
+// Returns a helpful error with CWD guidance for project scope and cross-scope hints.
+// The verb parameter (e.g. "update", "uninstall") is used in cross-scope hint messages.
+func withExplicitScopeCheck(dir, scope, verb, projectDir string, hasGlobal, hasProject bool) ([]string, error) {
+	state, err := installer.LoadState(dir)
+	if err != nil {
+		return nil, err
+	}
+	if state == nil {
+		return nil, scopeNotInstalledError(scope, verb, projectDir, hasGlobal, hasProject)
+	}
+
+	return []string{scope}, nil
+}
+
+// scopeNotInstalledError builds a detailed error for when the requested scope has no installation.
+// Includes cross-scope hints when the other scope is installed.
+// The verb parameter (e.g. "update", "uninstall") is used in cross-scope hint messages.
+func scopeNotInstalledError(scope, verb, projectDir string, hasGlobal, hasProject bool) error {
+	var msg string
+	if scope == installer.ScopeProject {
+		expectedPath := filepath.ToSlash(projectDir)
+		msg = fmt.Sprintf(
+			"no project-scoped skills found in the current directory.\n\n"+
+				"Project-scoped skills are detected based on your working directory.\n"+
+				"Make sure you are in the project root where you originally ran\n"+
+				"'databricks aitools install --scope=project'.\n\n"+
+				"Expected location: %s/", expectedPath)
+	} else {
+		msg = "no globally-scoped skills installed. Run 'databricks aitools install --scope=global' to install"
+	}
+
+	hint := crossScopeHint(scope, verb, hasGlobal, hasProject)
+	if hint != "" {
+		msg += "\n\n" + hint
+	}
+
+	return errors.New(msg)
+}
+
+// crossScopeHint returns a hint string if the opposite scope has an installation.
+// The verb parameter (e.g. "update", "uninstall") controls the action in the hint message.
+func crossScopeHint(requestedScope, verb string, hasGlobal, hasProject bool) string {
+	if requestedScope == installer.ScopeProject && hasGlobal {
+		return fmt.Sprintf("Global skills are installed. Run with --scope=global to %s those.", verb)
+	}
+	if requestedScope == installer.ScopeGlobal && hasProject {
+		return fmt.Sprintf("Project-scoped skills are installed. Run with --scope=project to %s those.", verb)
+	}
+	return ""
+}
+
+func defaultPromptUpdateScopeSelection(ctx context.Context) ([]string, error) {
+	homeDir, err := env.UserHomeDir(ctx)
+	if err != nil {
+		return nil, err
+	}
+	globalPath := filepath.Join(homeDir, ".databricks", "aitools", "skills")
+
+	cwd, err := os.Getwd()
+	if err != nil {
+		return nil, err
+	}
+	projectPath := filepath.Join(cwd, ".databricks", "aitools", "skills")
+
+	globalLabel := "Global (" + globalPath + "/)"
+	projectLabel := "Project (" + projectPath + "/)"
+	bothLabel := "Both global and project"
+
+	var scope string
+	err = huh.NewSelect[string]().
+		Title("Which installation should be updated?").
+		Options(
+			huh.NewOption(globalLabel, installer.ScopeGlobal),
+			huh.NewOption(projectLabel, installer.ScopeProject),
+			huh.NewOption(bothLabel, scopeBoth),
+		).
+		Value(&scope).
+		Run()
+	if err != nil {
+		return nil, err
+	}
+
+	if scope == scopeBoth {
+		return []string{installer.ScopeGlobal, installer.ScopeProject}, nil
+	}
+	return []string{scope}, nil
+}
+
+func defaultPromptUninstallScopeSelection(ctx context.Context) (string, error) {
+	homeDir, err := env.UserHomeDir(ctx)
+	if err != nil {
+		return "", err
+	}
+	globalPath := filepath.Join(homeDir, ".databricks", "aitools", "skills")
+
+	cwd, err := os.Getwd()
+	if err != nil {
+		return "", err
+	}
+	projectPath := filepath.Join(cwd, ".databricks", "aitools", "skills")
+
+	globalLabel := "Global (" + globalPath + "/)"
+	projectLabel := "Project (" + projectPath + "/)"
+
+	var scope string
+	err = huh.NewSelect[string]().
+		Title("Which installation should be uninstalled?").
+		Options(
+			huh.NewOption(globalLabel, installer.ScopeGlobal),
+			huh.NewOption(projectLabel, installer.ScopeProject),
+		).
+		Value(&scope).
+		Run()
+	if err != nil {
+		return "", err
+	}
+
+	return scope, nil
+}
diff --git a/experimental/aitools/cmd/scope_test.go b/cmd/aitools/scope_test.go
similarity index 85%
rename from experimental/aitools/cmd/scope_test.go
rename to cmd/aitools/scope_test.go
index ecda25faade..da941dbb316 100644
--- a/experimental/aitools/cmd/scope_test.go
+++ b/cmd/aitools/scope_test.go
@@ -7,7 +7,7 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/databricks/cli/experimental/aitools/lib/installer"
+	"github.com/databricks/cli/libs/aitools/installer"
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -67,6 +67,57 @@ func interactiveCtx(t *testing.T) (context.Context, func()) {
 	return ctx, test.Done
 }
 
+// --- parseScopeFlag tests ---
+
+func TestParseScopeFlag(t *testing.T) {
+	tests := []struct {
+		name      string
+		scope     string
+		project   bool
+		global    bool
+		allowBoth bool
+		wantProj  bool
+		wantGlob  bool
+		wantErr   string
+	}{
+		{name: "unset", scope: ""},
+		{name: "legacy project only", project: true, wantProj: true},
+		{name: "legacy global only", global: true, wantGlob: true},
+		{name: "legacy both passthrough", project: true, global: true, wantProj: true, wantGlob: true},
+		{name: "scope project", scope: "project", wantProj: true},
+		{name: "scope global", scope: "global", wantGlob: true},
+		{name: "scope both allowed", scope: "both", allowBoth: true, wantProj: true, wantGlob: true},
+		{name: "scope both disallowed", scope: "both", wantErr: "--scope=both is not supported"},
+		{name: "scope invalid value with allowBoth", scope: "all", allowBoth: true, wantErr: `invalid --scope "all": must be one of project, global, both`},
+		{name: "scope invalid value without allowBoth omits both from error", scope: "all", wantErr: `invalid --scope "all": must be one of project, global`},
+		{name: "scope conflicts with project", scope: "project", project: true, wantErr: "cannot use --scope with --project or --global"},
+		{name: "scope conflicts with global", scope: "global", global: true, wantErr: "cannot use --scope with --project or --global"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			proj, glob, err := parseScopeFlag(tt.scope, tt.project, tt.global, tt.allowBoth)
+			if tt.wantErr != "" {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), tt.wantErr)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tt.wantProj, proj)
+			assert.Equal(t, tt.wantGlob, glob)
+		})
+	}
+
+	// Stronger check that the without-allowBoth invalid-value branch omits
+	// "both" from the error message (the table assertion uses Contains which
+	// can't distinguish a substring shared with the allowBoth variant).
+	t.Run("invalid scope error message without allowBoth does not mention both", func(t *testing.T) {
+		_, _, err := parseScopeFlag("all", false, false, false)
+		require.Error(t, err)
+		assert.NotContains(t, err.Error(), "both")
+	})
+}
+
 // --- detectInstalledScopes tests (table-driven) ---
 
 func TestDetectInstalledScopes(t *testing.T) {
@@ -184,21 +235,21 @@ func TestCrossScopeHint(t *testing.T) {
 			scope:     installer.ScopeProject,
 			verb:      "update",
 			hasGlobal: true,
-			wantHint:  "without --project to update those",
+			wantHint:  "with --scope=global to update those",
 		},
 		{
 			name:      "ProjectMissingHintsGlobalUninstall",
 			scope:     installer.ScopeProject,
 			verb:      "uninstall",
 			hasGlobal: true,
-			wantHint:  "without --project to uninstall those",
+			wantHint:  "with --scope=global to uninstall those",
 		},
 		{
 			name:     "GlobalMissingHintsProject",
 			scope:    installer.ScopeGlobal,
 			verb:     "update",
 			hasProj:  true,
-			wantHint: "without --global to update those",
+			wantHint: "with --scope=project to update those",
 		},
 		{
 			name:  "NeitherInstalledNoHint",
@@ -225,7 +276,7 @@ func TestScopeNotInstalledErrorProjectIncludesPath(t *testing.T) {
 	projectDir := "/some/project/.databricks/aitools/skills"
 	err := scopeNotInstalledError(installer.ScopeProject, "update", projectDir, false, false)
 	assert.Contains(t, err.Error(), "no project-scoped skills found")
-	assert.Contains(t, err.Error(), "install --project")
+	assert.Contains(t, err.Error(), "install --scope=project")
 	assert.Contains(t, err.Error(), "Expected location:")
 	assert.Contains(t, err.Error(), "/some/project/.databricks/aitools/skills/")
 }
@@ -233,7 +284,7 @@ func TestScopeNotInstalledErrorProjectIncludesPath(t *testing.T) {
 func TestScopeNotInstalledErrorGlobal(t *testing.T) {
 	err := scopeNotInstalledError(installer.ScopeGlobal, "update", "/irrelevant", false, false)
 	assert.Contains(t, err.Error(), "no globally-scoped skills installed")
-	assert.Contains(t, err.Error(), "install --global")
+	assert.Contains(t, err.Error(), "install --scope=global")
 }
 
 // --- resolveScopeForUpdate tests ---
@@ -307,7 +358,7 @@ func TestResolveScopeForUpdateProjectFlagNoInstall(t *testing.T) {
 	_, err := resolveScopeForUpdate(ctx, true, false, globalDir, projectDir)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "no project-scoped skills found")
-	assert.Contains(t, err.Error(), "install --project")
+	assert.Contains(t, err.Error(), "install --scope=project")
 	assert.Contains(t, err.Error(), "Expected location:")
 	assert.Contains(t, err.Error(), ".databricks/aitools/skills/")
 }
@@ -351,8 +402,8 @@ func TestResolveScopeForUpdateNoFlagsBothNonInteractive(t *testing.T) {
 	_, err := resolveScopeForUpdate(ctx, false, false, globalDir, projectDir)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "skills are installed in both global and project scopes")
-	assert.Contains(t, err.Error(), "--global")
-	assert.Contains(t, err.Error(), "--project")
+	assert.Contains(t, err.Error(), "--scope=global")
+	assert.Contains(t, err.Error(), "--scope=project")
 }
 
 func TestResolveScopeForUpdateNoFlagsBothInteractive(t *testing.T) {
@@ -425,7 +476,7 @@ func TestResolveScopeForUninstallProjectFlagNoInstall(t *testing.T) {
 	_, err := resolveScopeForUninstall(ctx, true, false, globalDir, projectDir)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "no project-scoped skills found")
-	assert.Contains(t, err.Error(), "install --project")
+	assert.Contains(t, err.Error(), "install --scope=project")
 	assert.Contains(t, err.Error(), "Expected location:")
 }
 
@@ -468,8 +519,8 @@ func TestResolveScopeForUninstallNoFlagsBothNonInteractive(t *testing.T) {
 	_, err := resolveScopeForUninstall(ctx, false, false, globalDir, projectDir)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "skills are installed in both global and project scopes")
-	assert.Contains(t, err.Error(), "--global")
-	assert.Contains(t, err.Error(), "--project")
+	assert.Contains(t, err.Error(), "--scope=global")
+	assert.Contains(t, err.Error(), "--scope=project")
 }
 
 func TestResolveScopeForUninstallNoFlagsBothInteractive(t *testing.T) {
@@ -556,7 +607,7 @@ func TestResolveScopeForUninstallProjectFlagHintsUninstall(t *testing.T) {
 	// Project flag with no project state should hint about global using "uninstall" verb.
 	_, err := resolveScopeForUninstall(ctx, true, false, globalDir, projectDir)
 	require.Error(t, err)
-	assert.Contains(t, err.Error(), "without --project to uninstall those")
+	assert.Contains(t, err.Error(), "with --scope=global to uninstall those")
 }
 
 func TestResolveScopeForUpdateProjectFlagHintsUpdate(t *testing.T) {
@@ -567,5 +618,5 @@ func TestResolveScopeForUpdateProjectFlagHintsUpdate(t *testing.T) {
 	// Project flag with no project state should hint about global using "update" verb.
 	_, err := resolveScopeForUpdate(ctx, true, false, globalDir, projectDir)
 	require.Error(t, err)
-	assert.Contains(t, err.Error(), "without --project to update those")
+	assert.Contains(t, err.Error(), "with --scope=global to update those")
 }
diff --git a/cmd/aitools/telemetry.go b/cmd/aitools/telemetry.go
new file mode 100644
index 00000000000..8ecf0c46542
--- /dev/null
+++ b/cmd/aitools/telemetry.go
@@ -0,0 +1,137 @@
+package aitools
+
+import (
+	"cmp"
+	"context"
+	"slices"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/aitools/agents"
+	"github.com/databricks/cli/libs/aitools/installer"
+	"github.com/databricks/cli/libs/telemetry"
+	"github.com/databricks/cli/libs/telemetry/protos"
+	"github.com/spf13/cobra"
+)
+
+// tryConfigureAuth resolves auth config onto the context so telemetry can
+// upload at command exit. It does not fail if auth is not configured.
+func tryConfigureAuth(cmd *cobra.Command, args []string) error {
+	ctx := root.SkipPrompt(cmd.Context())
+	ctx = root.SkipLoadBundle(ctx)
+	cmd.SetContext(ctx)
+	_, _ = root.MustAnyClient(cmd, args)
+	return nil
+}
+
+// installOpts is the subset of install options telemetry records, kept narrow
+// so every field that leaves the machine is visible here.
+type installOpts struct {
+	Scope        string
+	Experimental bool
+}
+
+// logInstallEvent buffers an install event; cmd/root uploads it at exit.
+// errCategory is the top-level command outcome (Unspecified on success or when
+// the failure is reported per agent), and outcomes carries the per-agent results
+// so a skipped-with-warning failure is still recorded even when the command
+// exits 0.
+func logInstallEvent(ctx context.Context, plan []agentPlanItem, opts installOpts, errCategory protos.AitoolsErrorCategory, outcomes []agentOutcome) {
+	telemetry.Log(ctx, protos.DatabricksCliLog{
+		AitoolsInstallEvent: &protos.AitoolsInstallEvent{
+			Agents:        agentsField(plan),
+			Scope:         scopeType(opts.Scope),
+			Experimental:  opts.Experimental,
+			ErrorCategory: errCategory,
+			AgentResults:  agentResultsField(outcomes),
+		},
+	})
+}
+
+// agentResultsField returns the per-agent failure/skip categories, one entry per
+// non-successful agent, sorted by agent enum for stable output. Successful
+// agents produce no entry.
+func agentResultsField(outcomes []agentOutcome) []protos.AitoolsAgentResult {
+	var out []protos.AitoolsAgentResult
+	for _, o := range outcomes {
+		// Successful agents produce no entry; only failed/skipped outcomes carry a
+		// category. Keying on status (rather than errorCategory == "") avoids a trap
+		// where a future Unspecified category on a success would emit a bogus entry.
+		if o.status == outcomeInstalled {
+			continue
+		}
+		out = append(out, protos.AitoolsAgentResult{
+			Agent:         agentType(o.agent.Name),
+			ErrorCategory: o.errorCategory,
+		})
+	}
+	slices.SortFunc(out, func(a, b protos.AitoolsAgentResult) int {
+		return cmp.Compare(a.Agent, b.Agent)
+	})
+	return out
+}
+
+// agentsField returns the deduped agent enums from the plan, sorted so the
+// same set of agents always produces the same array on the analytics side.
+func agentsField(plan []agentPlanItem) []protos.AitoolsAgentType {
+	if len(plan) == 0 {
+		return nil
+	}
+	out := make([]protos.AitoolsAgentType, 0, len(plan))
+	seen := make(map[protos.AitoolsAgentType]struct{}, len(plan))
+	for _, it := range plan {
+		if it.agent == nil {
+			continue
+		}
+		t := agentType(it.agent.Name)
+		if _, ok := seen[t]; ok {
+			continue
+		}
+		seen[t] = struct{}{}
+		out = append(out, t)
+	}
+	slices.Sort(out)
+	return out
+}
+
+// agentType maps a CLI agent registry name to its telemetry enum. Every agent
+// in agents.Registry must have a case here; TestAgentTypeCoversRegistry fails
+// if one is missing. The default maps genuinely unknown names to Unspecified
+// so an older proto never drops an install.
+func agentType(name string) protos.AitoolsAgentType {
+	switch name {
+	case agents.NameClaudeCode:
+		return protos.AitoolsAgentTypeClaudeCode
+	case agents.NameCursor:
+		return protos.AitoolsAgentTypeCursor
+	case agents.NameCodex:
+		return protos.AitoolsAgentTypeCodex
+	case agents.NameOpenCode:
+		return protos.AitoolsAgentTypeOpenCode
+	case agents.NameCopilot:
+		return protos.AitoolsAgentTypeCopilot
+	case agents.NameAntigravity:
+		return protos.AitoolsAgentTypeAntigravity
+	case agents.NamePi:
+		return protos.AitoolsAgentTypePi
+	case agents.NameGemini:
+		return protos.AitoolsAgentTypeGemini
+	case agents.NameGoose:
+		return protos.AitoolsAgentTypeGoose
+	case agents.NameKiro:
+		return protos.AitoolsAgentTypeKiro
+	default:
+		return protos.AitoolsAgentTypeUnspecified
+	}
+}
+
+// scopeType maps a resolved install scope to its telemetry enum.
+func scopeType(scope string) protos.AitoolsInstallScope {
+	switch scope {
+	case installer.ScopeGlobal:
+		return protos.AitoolsInstallScopeGlobal
+	case installer.ScopeProject:
+		return protos.AitoolsInstallScopeProject
+	default:
+		return protos.AitoolsInstallScopeUnspecified
+	}
+}
diff --git a/cmd/aitools/telemetry_test.go b/cmd/aitools/telemetry_test.go
new file mode 100644
index 00000000000..160bb4fe98e
--- /dev/null
+++ b/cmd/aitools/telemetry_test.go
@@ -0,0 +1,108 @@
+package aitools
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/aitools/agents"
+	"github.com/databricks/cli/libs/aitools/installer"
+	"github.com/databricks/cli/libs/telemetry/protos"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestAgentsField(t *testing.T) {
+	cases := []struct {
+		name string
+		plan []agentPlanItem
+		want []protos.AitoolsAgentType
+	}{
+		{
+			name: "empty plan",
+			plan: nil,
+			want: nil,
+		},
+		{
+			name: "single agent",
+			plan: []agentPlanItem{{agent: &agents.Agent{Name: agents.NameClaudeCode}}},
+			want: []protos.AitoolsAgentType{protos.AitoolsAgentTypeClaudeCode},
+		},
+		{
+			name: "multiple agents are sorted",
+			plan: []agentPlanItem{
+				{agent: &agents.Agent{Name: agents.NameCursor}},
+				{agent: &agents.Agent{Name: agents.NameClaudeCode}},
+				{agent: &agents.Agent{Name: agents.NameCodex}},
+			},
+			want: []protos.AitoolsAgentType{
+				protos.AitoolsAgentTypeClaudeCode,
+				protos.AitoolsAgentTypeCodex,
+				protos.AitoolsAgentTypeCursor,
+			},
+		},
+		{
+			name: "duplicates are deduplicated",
+			plan: []agentPlanItem{
+				{agent: &agents.Agent{Name: agents.NameClaudeCode}},
+				{agent: &agents.Agent{Name: agents.NameClaudeCode}},
+			},
+			want: []protos.AitoolsAgentType{protos.AitoolsAgentTypeClaudeCode},
+		},
+		{
+			name: "nil agent entries are skipped",
+			plan: []agentPlanItem{
+				{agent: nil},
+				{agent: &agents.Agent{Name: agents.NameCursor}},
+			},
+			want: []protos.AitoolsAgentType{protos.AitoolsAgentTypeCursor},
+		},
+		{
+			name: "unknown agent maps to unspecified",
+			plan: []agentPlanItem{{agent: &agents.Agent{Name: "future-agent"}}},
+			want: []protos.AitoolsAgentType{protos.AitoolsAgentTypeUnspecified},
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := agentsField(tc.plan)
+			assert.Equal(t, tc.want, got)
+		})
+	}
+}
+
+// TestAgentTypeCoversRegistry fails when an agent is added to agents.Registry
+// without a matching telemetry enum in agentType. This is the guard against
+// silently logging a new agent as UNSPECIFIED.
+func TestAgentTypeCoversRegistry(t *testing.T) {
+	for _, a := range agents.Registry {
+		assert.NotEqualf(t, protos.AitoolsAgentTypeUnspecified, agentType(a.Name),
+			"agent %q has no telemetry enum: add a case to agentType and a value to "+
+				"AitoolsAgentType in enum.proto (Universe) + aitools_install.go (CLI)", a.Name)
+	}
+}
+
+func TestScopeType(t *testing.T) {
+	assert.Equal(t, protos.AitoolsInstallScopeGlobal, scopeType(installer.ScopeGlobal))
+	assert.Equal(t, protos.AitoolsInstallScopeProject, scopeType(installer.ScopeProject))
+	assert.Equal(t, protos.AitoolsInstallScopeUnspecified, scopeType(""))
+}
+
+func TestAgentResultsField(t *testing.T) {
+	claude := &agents.Agent{Name: agents.NameClaudeCode}
+	codex := &agents.Agent{Name: agents.NameCodex}
+	cursor := &agents.Agent{Name: agents.NameCursor}
+
+	outcomes := []agentOutcome{
+		// Successful agents produce no entry; production leaves errorCategory unset.
+		{agent: cursor, status: outcomeInstalled},
+		{agent: codex, status: outcomeFailed, errorCategory: protos.AitoolsErrorCategoryPluginInstallFailed},
+		{agent: claude, status: outcomeSkipped, errorCategory: protos.AitoolsErrorCategoryUnsupportedScope},
+	}
+
+	// Sorted by agent enum, only non-successful agents included.
+	want := []protos.AitoolsAgentResult{
+		{Agent: protos.AitoolsAgentTypeClaudeCode, ErrorCategory: protos.AitoolsErrorCategoryUnsupportedScope},
+		{Agent: protos.AitoolsAgentTypeCodex, ErrorCategory: protos.AitoolsErrorCategoryPluginInstallFailed},
+	}
+	assert.Equal(t, want, agentResultsField(outcomes))
+
+	assert.Nil(t, agentResultsField(nil))
+}
diff --git a/cmd/aitools/uninstall.go b/cmd/aitools/uninstall.go
new file mode 100644
index 00000000000..3336f92e6d8
--- /dev/null
+++ b/cmd/aitools/uninstall.go
@@ -0,0 +1,148 @@
+package aitools
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"github.com/databricks/cli/libs/aitools/installer"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/spf13/cobra"
+)
+
+// Package-level for testability. Tests override via uninstall_test.go.
+var uninstallSkillsFn = func(ctx context.Context, opts installer.UninstallOptions) error {
+	return installer.UninstallSkillsOpts(ctx, opts)
+}
+
+func NewUninstallCmd() *cobra.Command {
+	var skillsFlag, agentsFlag, scopeFlag string
+	var projectFlag, globalFlag, keepMarketplace bool
+
+	cmd := &cobra.Command{
+		Use:   "uninstall",
+		Short: "Uninstall Databricks skills and plugins",
+		Long: `Remove installed Databricks skills and plugins from all coding agents.
+
+By default, removes all skills. Use --skills to remove specific skills only.`,
+		Args: cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			ctx := cmd.Context()
+
+			projectFlag, globalFlag, err := parseScopeFlag(scopeFlag, projectFlag, globalFlag, false)
+			if err != nil {
+				return err
+			}
+
+			globalDir, err := installer.GlobalSkillsDir(ctx)
+			if err != nil {
+				return err
+			}
+			projectDir, err := installer.ProjectSkillsDir(ctx)
+			if err != nil {
+				return err
+			}
+
+			scope, err := resolveScopeForUninstall(ctx, projectFlag, globalFlag, globalDir, projectDir)
+			if err != nil {
+				return err
+			}
+
+			opts := installer.UninstallOptions{
+				Scope:           scope,
+				KeepMarketplace: keepMarketplace,
+			}
+			opts.Skills = splitAndTrim(skillsFlag)
+			if agentsFlag != "" {
+				targetAgents, err := resolveAgentNames(ctx, agentsFlag)
+				if err != nil {
+					return err
+				}
+				opts.Agents = make([]string, 0, len(targetAgents))
+				for _, agent := range targetAgents {
+					opts.Agents = append(opts.Agents, agent.Name)
+				}
+			}
+
+			// Uninstall is destructive, so confirm interactively before doing
+			// anything. Non-interactive runs (no TTY) proceed unprompted so
+			// automation is unaffected, matching how install only prompts on a TTY.
+			if cmdio.IsPromptSupported(ctx) {
+				dir := globalDir
+				if scope == installer.ScopeProject {
+					dir = projectDir
+				}
+				proceed, err := confirmUninstall(ctx, dir, opts)
+				if err != nil {
+					return err
+				}
+				if !proceed {
+					cmdio.LogString(ctx, "Cancelled.")
+					return nil
+				}
+			}
+
+			return uninstallSkillsFn(ctx, opts)
+		},
+	}
+
+	cmd.Flags().StringVar(&skillsFlag, "skills", "", "Specific skills to uninstall (comma-separated)")
+	cmd.Flags().StringVar(&agentsFlag, "agents", "", "Agents to uninstall from (comma-separated, e.g. claude-code,cursor)")
+	cmd.Flags().BoolVar(&keepMarketplace, "keep-marketplace", false, "Keep the marketplace registration when removing a plugin")
+	cmd.Flags().StringVar(&scopeFlag, "scope", "", "Uninstall scope: project or global")
+	cmd.Flags().BoolVar(&projectFlag, "project", false, "Uninstall project-scoped skills")
+	cmd.Flags().BoolVar(&globalFlag, "global", false, "Uninstall globally-scoped skills")
+	markScopeBoolsDeprecated(cmd)
+	return cmd
+}
+
+// confirmUninstall asks the user to confirm a destructive uninstall, summarizing
+// what will be removed. It returns true without prompting when nothing is
+// recorded in the scope, so the installer can surface its own "nothing installed"
+// or legacy guidance instead.
+func confirmUninstall(ctx context.Context, dir string, opts installer.UninstallOptions) (bool, error) {
+	state, err := installer.LoadState(dir)
+	if err != nil {
+		return false, err
+	}
+	msg, ask := uninstallConfirmMessage(state, opts)
+	if !ask {
+		return true, nil
+	}
+	cmdio.LogString(ctx, msg)
+	return cmdio.AskYesOrNo(ctx, "Proceed?")
+}
+
+// uninstallConfirmMessage builds the human summary of what an uninstall will
+// remove. ask is false when there is nothing recorded to confirm.
+func uninstallConfirmMessage(state *installer.InstallState, opts installer.UninstallOptions) (msg string, ask bool) {
+	if state == nil {
+		return "", false
+	}
+	target := "all agents"
+	if len(opts.Agents) > 0 {
+		target = strings.Join(opts.Agents, ", ")
+	}
+	if len(opts.Skills) > 0 {
+		return fmt.Sprintf("This will remove %s %s from %s (%s scope).", plural(len(opts.Skills), "skill"), strings.Join(opts.Skills, ", "), target, opts.Scope), true
+	}
+	var parts []string
+	if n := len(state.Skills); n > 0 {
+		parts = append(parts, fmt.Sprintf("%d %s", n, plural(n, "skill")))
+	}
+	if n := len(state.Plugins); n > 0 {
+		parts = append(parts, fmt.Sprintf("the databricks plugin from %d %s", n, plural(n, "agent")))
+	}
+	if len(parts) == 0 {
+		return "", false
+	}
+	return fmt.Sprintf("This will remove %s from %s (%s scope).", strings.Join(parts, " and "), target, opts.Scope), true
+}
+
+// plural returns noun for n == 1 and noun+"s" otherwise.
+func plural(n int, noun string) string {
+	if n == 1 {
+		return noun
+	}
+	return noun + "s"
+}
diff --git a/cmd/aitools/uninstall_test.go b/cmd/aitools/uninstall_test.go
new file mode 100644
index 00000000000..04c70393c3e
--- /dev/null
+++ b/cmd/aitools/uninstall_test.go
@@ -0,0 +1,132 @@
+package aitools
+
+import (
+	"context"
+	"testing"
+
+	"github.com/databricks/cli/libs/aitools/installer"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func setupUninstallMock(t *testing.T) *[]installer.UninstallOptions {
+	t.Helper()
+	orig := uninstallSkillsFn
+	t.Cleanup(func() { uninstallSkillsFn = orig })
+
+	var calls []installer.UninstallOptions
+	uninstallSkillsFn = func(_ context.Context, opts installer.UninstallOptions) error {
+		calls = append(calls, opts)
+		return nil
+	}
+	return &calls
+}
+
+func TestUninstallScopeFlag(t *testing.T) {
+	tests := []struct {
+		name      string
+		args      []string
+		wantScope string
+		wantErr   string
+	}{
+		// scope=project requires installed project state and is covered via TestParseScopeFlag
+		// and TestResolveScopeForUninstallProjectFlagWithState. Here we cover the no-state paths
+		// and the failure modes specific to the Cobra wiring.
+		{name: "scope global", args: []string{"--scope", "global"}, wantScope: installer.ScopeGlobal},
+		{name: "scope both rejected", args: []string{"--scope", "both"}, wantErr: "--scope=both is not supported"},
+		{name: "scope invalid value", args: []string{"--scope", "all"}, wantErr: `invalid --scope "all"`},
+		{name: "scope conflicts with legacy project", args: []string{"--scope", "global", "--project"}, wantErr: "cannot use --scope with --project or --global"},
+		{name: "legacy both flags together rejected", args: []string{"--project", "--global"}, wantErr: "cannot uninstall both scopes at once"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			setupTestAgents(t)
+			calls := setupUninstallMock(t)
+
+			ctx := cmdio.MockDiscard(t.Context())
+			cmd := NewUninstallCmd()
+			cmd.SetContext(ctx)
+			cmd.SetArgs(tt.args)
+			cmd.SilenceErrors = true
+			cmd.SilenceUsage = true
+
+			err := cmd.Execute()
+			if tt.wantErr != "" {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), tt.wantErr)
+				return
+			}
+			require.NoError(t, err)
+			require.Len(t, *calls, 1)
+			assert.Equal(t, tt.wantScope, (*calls)[0].Scope)
+		})
+	}
+}
+
+func TestUninstallAgentsFlag(t *testing.T) {
+	setupTestAgents(t)
+	calls := setupUninstallMock(t)
+
+	ctx := cmdio.MockDiscard(t.Context())
+	cmd := NewUninstallCmd()
+	cmd.SetContext(ctx)
+	cmd.SetArgs([]string{"--scope", "global", "--agents", "cursor,claude-code", "--skills", "databricks-sql"})
+
+	require.NoError(t, cmd.Execute())
+	require.Len(t, *calls, 1)
+	assert.Equal(t, []string{"cursor", "claude-code"}, (*calls)[0].Agents)
+	assert.Equal(t, []string{"databricks-sql"}, (*calls)[0].Skills)
+}
+
+func TestUninstallUnknownAgentErrors(t *testing.T) {
+	setupTestAgents(t)
+	setupUninstallMock(t)
+
+	ctx := cmdio.MockDiscard(t.Context())
+	cmd := NewUninstallCmd()
+	cmd.SetContext(ctx)
+	cmd.SetArgs([]string{"--scope", "global", "--agents", "invalid-agent"})
+	cmd.SilenceErrors = true
+	cmd.SilenceUsage = true
+
+	err := cmd.Execute()
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "unknown agent")
+}
+
+func TestUninstallConfirmMessage(t *testing.T) {
+	// Nothing recorded: no prompt (installer surfaces its own guidance).
+	_, ask := uninstallConfirmMessage(nil, installer.UninstallOptions{Scope: installer.ScopeGlobal})
+	assert.False(t, ask)
+
+	_, askEmpty := uninstallConfirmMessage(&installer.InstallState{}, installer.UninstallOptions{Scope: installer.ScopeGlobal})
+	assert.False(t, askEmpty)
+
+	st := &installer.InstallState{
+		Skills:  map[string]string{"a": "1", "b": "2"},
+		Plugins: map[string]installer.PluginRecord{"claude-code": {}},
+	}
+
+	msg, ask := uninstallConfirmMessage(st, installer.UninstallOptions{Scope: installer.ScopeGlobal})
+	require.True(t, ask)
+	assert.Contains(t, msg, "2 skills")
+	assert.Contains(t, msg, "the databricks plugin from 1 agent")
+	assert.Contains(t, msg, "(global scope)")
+
+	// --skills filter names the requested skills.
+	filtered := installer.UninstallOptions{Scope: installer.ScopeProject}
+	filtered.Skills = []string{"alpha"}
+	msg2, ask2 := uninstallConfirmMessage(st, filtered)
+	require.True(t, ask2)
+	assert.Contains(t, msg2, "skill alpha")
+	assert.Contains(t, msg2, "from all agents")
+	assert.Contains(t, msg2, "(project scope)")
+
+	targeted := installer.UninstallOptions{Scope: installer.ScopeGlobal, Agents: []string{"cursor"}}
+	targeted.Skills = []string{"alpha"}
+	msg3, ask3 := uninstallConfirmMessage(st, targeted)
+	require.True(t, ask3)
+	assert.Contains(t, msg3, "from cursor")
+}
diff --git a/cmd/aitools/update.go b/cmd/aitools/update.go
new file mode 100644
index 00000000000..977ad25ff13
--- /dev/null
+++ b/cmd/aitools/update.go
@@ -0,0 +1,293 @@
+package aitools
+
+import (
+	"context"
+	"fmt"
+	"maps"
+	"os"
+	"slices"
+
+	"github.com/databricks/cli/libs/aitools/agents"
+	"github.com/databricks/cli/libs/aitools/installer"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/log"
+	"github.com/spf13/cobra"
+)
+
+// Package-level for testability. Tests override via update_test.go.
+var updateSkillsFn = func(ctx context.Context, src installer.ManifestSource, installed []*agents.Agent, opts installer.UpdateOptions) (*installer.UpdateResult, error) {
+	return installer.UpdateSkills(ctx, src, installed, opts)
+}
+
+var (
+	updatePluginsFn               = installer.UpdateInstalledPlugins
+	updateInstallPluginForAgentFn = installer.InstallPluginForAgent
+	updateRecordPluginInstallsFn  = installer.RecordPluginInstalls
+	updateCleanupLegacyFn         = installer.RemoveLegacyRawSkills
+	hasManagedRawSkillsForAgentFn = installer.HasManagedRawSkillsForAgent
+)
+
+type pluginMigrationCandidate struct {
+	agent       *agents.Agent
+	nativeScope string
+}
+
+type pluginMigrationResult struct {
+	agent  *agents.Agent
+	record installer.PluginRecord
+}
+
+func NewUpdateCmd() *cobra.Command {
+	var check, force, noNew, noPrune bool
+	var skillsFlag, scopeFlag string
+	var projectFlag, globalFlag bool
+
+	cmd := &cobra.Command{
+		Use:   "update",
+		Short: "Update installed skills and plugins",
+		Long: `Update installed Databricks skills and plugins to the latest release.
+
+By default, updates all installed skills and auto-installs new skills
+from the manifest. Use --no-new to skip new skills, or --check to
+preview what would change without downloading.`,
+		Args: cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			ctx := cmd.Context()
+
+			globalDir, err := installer.GlobalSkillsDir(ctx)
+			if err != nil {
+				return err
+			}
+			projectDir, err := installer.ProjectSkillsDir(ctx)
+			if err != nil {
+				return err
+			}
+
+			projectFlag, globalFlag, err := parseScopeFlag(scopeFlag, projectFlag, globalFlag, true)
+			if err != nil {
+				return err
+			}
+
+			scopes, err := resolveScopeForUpdate(ctx, projectFlag, globalFlag, globalDir, projectDir)
+			if err != nil {
+				return err
+			}
+
+			installed := agents.DetectInstalled(ctx)
+			src := &installer.GitHubManifestSource{}
+			skills := splitAndTrim(skillsFlag)
+
+			// The plugin version recorded on update tracks the skills release.
+			// Tolerate a resolution error (skip plugin updates, still do skills).
+			ref, _, refErr := installer.GetSkillsRef(ctx)
+
+			for _, scope := range scopes {
+				if len(scopes) > 1 {
+					cmdio.LogString(ctx, fmt.Sprintf("Updating %s skills...", scope))
+				}
+
+				dir := globalDir
+				if scope == installer.ScopeProject {
+					dir = projectDir
+				}
+				state, err := installer.LoadState(dir)
+				if err != nil {
+					return err
+				}
+
+				if check && refErr == nil && state != nil && len(state.Plugins) > 0 {
+					printPluginCheckResults(ctx, state, installer.DisplaySkillsVersion(ref))
+				}
+
+				migrationCandidates, err := pluginMigrationCandidatesForScope(ctx, scope, state)
+				if err != nil {
+					return err
+				}
+				if check {
+					printPluginMigrationCheckResults(ctx, migrationCandidates)
+				}
+
+				// Update plugin agents through their own CLI (check mode skips this).
+				if !check && refErr == nil {
+					pluginUpdates, err := updatePluginsFn(ctx, scope, ref)
+					if err != nil {
+						return err
+					}
+					for _, pu := range pluginUpdates {
+						cmdio.LogString(ctx, fmt.Sprintf("  %s  databricks plugin %s", pu.Agent, versionToken(pu.Version)))
+					}
+
+					migrated, err := migrateLegacyRawSkillsToPlugins(ctx, scope, ref, migrationCandidates)
+					if err != nil {
+						return err
+					}
+					if migrated {
+						state, err = installer.LoadState(dir)
+						if err != nil {
+							return err
+						}
+					}
+				}
+
+				// Reconcile file skills for non-plugin agents. Skip entirely for a
+				// pure-plugin install (no file skills to maintain); keep calling for
+				// no-state installs so the "no skills or plugins installed" guidance still fires.
+				if state == nil || len(state.Skills) > 0 {
+					opts := installer.UpdateOptions{
+						Check:   check,
+						Force:   force,
+						NoNew:   noNew,
+						NoPrune: noPrune,
+						Scope:   scope,
+					}
+					opts.Skills = skills
+
+					targetAgents := installed
+					if scope == installer.ScopeProject {
+						cwd, err := os.Getwd()
+						if err != nil {
+							return err
+						}
+						targetAgents = mergeAgents(installed, agents.DetectProjectInstalled(cwd))
+					}
+
+					result, err := updateSkillsFn(ctx, src, excludePluginAgents(targetAgents, state), opts)
+					if err != nil {
+						return err
+					}
+					if result != nil && (check || len(result.Updated) > 0 || len(result.Added) > 0 || len(result.Removed) > 0) {
+						text := installer.FormatUpdateResult(result, check)
+						if text != "No changes." || len(migrationCandidates) == 0 {
+							cmdio.LogString(ctx, text)
+						}
+					}
+				}
+			}
+			return nil
+		},
+	}
+
+	cmd.Flags().BoolVar(&check, "check", false, "Show what would be updated without downloading")
+	cmd.Flags().BoolVar(&force, "force", false, "Re-download even if versions match")
+	cmd.Flags().BoolVar(&noNew, "no-new", false, "Don't auto-install new skills from manifest")
+	cmd.Flags().BoolVar(&noPrune, "no-prune", false, "Keep skills that vanished from the manifest instead of removing them")
+	cmd.Flags().StringVar(&skillsFlag, "skills", "", "Specific skills to update (comma-separated)")
+	cmd.Flags().StringVar(&scopeFlag, "scope", "", "Update scope: project, global, or both")
+	cmd.Flags().BoolVar(&projectFlag, "project", false, "Update project-scoped skills")
+	cmd.Flags().BoolVar(&globalFlag, "global", false, "Update globally-scoped skills")
+	markScopeBoolsDeprecated(cmd)
+	return cmd
+}
+
+func pluginMigrationCandidatesForScope(ctx context.Context, scope string, state *installer.InstallState) ([]pluginMigrationCandidate, error) {
+	var candidates []pluginMigrationCandidate
+	for _, agent := range agents.Registry {
+		if agent.Plugin == nil {
+			continue
+		}
+		if state != nil {
+			if _, alreadyPlugin := state.Plugins[agent.Name]; alreadyPlugin {
+				continue
+			}
+		}
+		nativeScope, ok, _ := mapAgentScope(agent, scope)
+		if !ok {
+			continue
+		}
+		// Match install's non-interactive behavior: a raw install for a plugin
+		// agent should attempt migration and report a skip if its CLI is missing,
+		// rather than silently staying on raw skills forever.
+		hasRawSkills, err := hasManagedRawSkillsForAgentFn(ctx, agent, scope)
+		if err != nil {
+			return nil, err
+		}
+		if !hasRawSkills {
+			continue
+		}
+		candidates = append(candidates, pluginMigrationCandidate{agent: agent, nativeScope: nativeScope})
+	}
+	return candidates, nil
+}
+
+func printPluginMigrationCheckResults(ctx context.Context, candidates []pluginMigrationCandidate) {
+	for _, candidate := range candidates {
+		cmdio.LogString(ctx, fmt.Sprintf("  %s  would migrate raw skills to databricks plugin", candidate.agent.DisplayName))
+	}
+}
+
+func migrateLegacyRawSkillsToPlugins(ctx context.Context, scope, ref string, candidates []pluginMigrationCandidate) (bool, error) {
+	if len(candidates) == 0 {
+		return false, nil
+	}
+
+	records := map[string]installer.PluginRecord{}
+	migrated := make([]pluginMigrationResult, 0, len(candidates))
+	for _, candidate := range candidates {
+		agent := candidate.agent
+		cmdio.LogString(ctx, fmt.Sprintf("Installing databricks plugin for %s...", agent.DisplayName))
+		rec, err := updateInstallPluginForAgentFn(ctx, agent, candidate.nativeScope, ref)
+		if err != nil {
+			cmdio.LogString(ctx, cmdio.Yellow(ctx, fmt.Sprintf("Skipped %s: %v", agent.DisplayName, err)))
+			continue
+		}
+		records[agent.Name] = rec
+		migrated = append(migrated, pluginMigrationResult{agent: agent, record: rec})
+	}
+	if len(records) == 0 {
+		return false, nil
+	}
+	if err := updateRecordPluginInstallsFn(ctx, scope, records, ref); err != nil {
+		return false, err
+	}
+	for _, result := range migrated {
+		if err := updateCleanupLegacyFn(ctx, result.agent, scope); err != nil {
+			log.Debugf(ctx, "Legacy skill cleanup for %s failed: %v", result.agent.DisplayName, err)
+		}
+		cmdio.LogString(ctx, fmt.Sprintf("  %s  databricks plugin %s", result.agent.DisplayName, versionToken(result.record.Version)))
+	}
+	return true, nil
+}
+
+func printPluginCheckResults(ctx context.Context, state *installer.InstallState, latest string) {
+	for _, name := range slices.Sorted(maps.Keys(state.Plugins)) {
+		rec := state.Plugins[name]
+		status := "up to date"
+		if rec.Version == "" {
+			status = "version unknown"
+		} else if rec.Version != latest {
+			status = "update available"
+		}
+		cmdio.LogString(ctx, fmt.Sprintf("  %s  databricks plugin %s (%s)", agentDisplayName(name), versionToken(rec.Version), status))
+	}
+}
+
+// mergeAgents concatenates two agent lists, skipping duplicate names.
+func mergeAgents(installed, project []*agents.Agent) []*agents.Agent {
+	seen := make(map[string]bool, len(installed))
+	merged := make([]*agents.Agent, 0, len(installed)+len(project))
+	for _, a := range installed {
+		seen[a.Name] = true
+		merged = append(merged, a)
+	}
+	for _, a := range project {
+		if !seen[a.Name] {
+			merged = append(merged, a)
+		}
+	}
+	return merged
+}
+
+// excludePluginAgents drops agents that are managed as plugins in this scope, so
+// the file-skills reconcile never drops duplicate skill files onto a plugin agent.
+func excludePluginAgents(installed []*agents.Agent, state *installer.InstallState) []*agents.Agent {
+	if state == nil || len(state.Plugins) == 0 {
+		return installed
+	}
+	out := make([]*agents.Agent, 0, len(installed))
+	for _, a := range installed {
+		if _, isPlugin := state.Plugins[a.Name]; !isPlugin {
+			out = append(out, a)
+		}
+	}
+	return out
+}
diff --git a/cmd/aitools/update_test.go b/cmd/aitools/update_test.go
new file mode 100644
index 00000000000..183cbc0205a
--- /dev/null
+++ b/cmd/aitools/update_test.go
@@ -0,0 +1,438 @@
+package aitools
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/databricks/cli/libs/aitools/agents"
+	"github.com/databricks/cli/libs/aitools/installer"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func setupUpdateMock(t *testing.T) *[]installer.UpdateOptions {
+	t.Helper()
+	orig := updateSkillsFn
+	t.Cleanup(func() { updateSkillsFn = orig })
+
+	var calls []installer.UpdateOptions
+	updateSkillsFn = func(_ context.Context, _ installer.ManifestSource, _ []*agents.Agent, opts installer.UpdateOptions) (*installer.UpdateResult, error) {
+		calls = append(calls, opts)
+		return &installer.UpdateResult{}, nil
+	}
+	return &calls
+}
+
+func resetUpdatePluginSeams(t *testing.T) {
+	t.Helper()
+	origUpdatePlugins := updatePluginsFn
+	origInstallPlugin := updateInstallPluginForAgentFn
+	origRecordPlugins := updateRecordPluginInstallsFn
+	origCleanupLegacy := updateCleanupLegacyFn
+	origHasManagedRawSkills := hasManagedRawSkillsForAgentFn
+	t.Cleanup(func() {
+		updatePluginsFn = origUpdatePlugins
+		updateInstallPluginForAgentFn = origInstallPlugin
+		updateRecordPluginInstallsFn = origRecordPlugins
+		updateCleanupLegacyFn = origCleanupLegacy
+		hasManagedRawSkillsForAgentFn = origHasManagedRawSkills
+	})
+}
+
+func TestUpdateCheckPrintsNoChanges(t *testing.T) {
+	setupTestAgents(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", "v0.2.6")
+	setupUpdateMock(t)
+
+	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
+	cmd := NewUpdateCmd()
+	cmd.SetContext(ctx)
+	cmd.SetArgs([]string{"--scope", "global", "--check"})
+
+	require.NoError(t, cmd.Execute())
+	assert.Contains(t, stderr.String(), "No changes.")
+}
+
+func TestUpdateCheckPrintsPluginState(t *testing.T) {
+	setupTestAgents(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", "v0.2.6")
+
+	origUpdateSkills := updateSkillsFn
+	origUpdatePlugins := updatePluginsFn
+	t.Cleanup(func() {
+		updateSkillsFn = origUpdateSkills
+		updatePluginsFn = origUpdatePlugins
+	})
+	updateSkillsFn = func(context.Context, installer.ManifestSource, []*agents.Agent, installer.UpdateOptions) (*installer.UpdateResult, error) {
+		require.Fail(t, "pure plugin check should not update raw skills")
+		return nil, nil
+	}
+	updatePluginsFn = func(context.Context, string, string) ([]installer.PluginUpdate, error) {
+		require.Fail(t, "check mode must not run plugin update commands")
+		return nil, nil
+	}
+
+	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
+	dir, err := installer.GlobalSkillsDir(ctx)
+	require.NoError(t, err)
+	require.NoError(t, installer.SaveState(dir, &installer.InstallState{
+		SchemaVersion: 2,
+		Release:       "v0.2.6",
+		Plugins: map[string]installer.PluginRecord{
+			agents.NameClaudeCode: {Marketplace: "claude-plugins-official", Plugin: "databricks", Version: "0.2.6"},
+		},
+	}))
+
+	cmd := NewUpdateCmd()
+	cmd.SetContext(ctx)
+	cmd.SetArgs([]string{"--scope", "global", "--check"})
+
+	require.NoError(t, cmd.Execute())
+	assert.Contains(t, stderr.String(), "Claude Code  databricks plugin v0.2.6 (up to date)")
+}
+
+func TestUpdateMigratesManagedRawSkillsToPlugins(t *testing.T) {
+	setupTestAgents(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", "v0.2.6")
+	resetUpdatePluginSeams(t)
+
+	var rawUpdateAgents []string
+	origUpdateSkills := updateSkillsFn
+	t.Cleanup(func() { updateSkillsFn = origUpdateSkills })
+	updateSkillsFn = func(_ context.Context, _ installer.ManifestSource, targetAgents []*agents.Agent, _ installer.UpdateOptions) (*installer.UpdateResult, error) {
+		for _, a := range targetAgents {
+			rawUpdateAgents = append(rawUpdateAgents, a.Name)
+		}
+		return &installer.UpdateResult{}, nil
+	}
+	updatePluginsFn = func(context.Context, string, string) ([]installer.PluginUpdate, error) {
+		return nil, nil
+	}
+
+	var installed []pluginCall
+	updateInstallPluginForAgentFn = func(_ context.Context, a *agents.Agent, scope, ref string) (installer.PluginRecord, error) {
+		installed = append(installed, pluginCall{agent: a.Name, scope: scope})
+		return installer.PluginRecord{
+			Marketplace: a.Plugin.Marketplace,
+			Plugin:      a.Plugin.ID,
+			Scope:       scope,
+			Version:     installer.DisplaySkillsVersion(ref),
+		}, nil
+	}
+
+	var cleaned []string
+	updateCleanupLegacyFn = func(_ context.Context, a *agents.Agent, _ string) error {
+		cleaned = append(cleaned, a.Name)
+		return nil
+	}
+	updateRecordPluginInstallsFn = func(ctx context.Context, scope string, records map[string]installer.PluginRecord, ref string) error {
+		return installer.RecordPluginInstalls(ctx, scope, records, ref)
+	}
+	hasManagedRawSkillsForAgentFn = func(_ context.Context, a *agents.Agent, _ string) (bool, error) {
+		return a.Plugin != nil, nil
+	}
+
+	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
+	dir, err := installer.GlobalSkillsDir(ctx)
+	require.NoError(t, err)
+	require.NoError(t, installer.SaveState(dir, &installer.InstallState{
+		SchemaVersion: 2,
+		Release:       "v0.2.5",
+		Skills:        map[string]string{"databricks": "0.2.5"},
+	}))
+
+	cmd := NewUpdateCmd()
+	cmd.SetContext(ctx)
+	cmd.SetArgs([]string{"--scope", "global"})
+
+	require.NoError(t, cmd.Execute())
+
+	assert.Equal(t, []pluginCall{
+		{agent: agents.NameClaudeCode, scope: agentScopeUser},
+		{agent: agents.NameCodex, scope: agentScopeUser},
+		{agent: agents.NameCopilot, scope: agentScopeUser},
+	}, installed)
+	assert.Equal(t, []string{agents.NameClaudeCode, agents.NameCodex, agents.NameCopilot}, cleaned)
+	assert.Equal(t, []string{agents.NameCursor}, rawUpdateAgents)
+	assert.Contains(t, stderr.String(), "Installing databricks plugin for Claude Code...")
+	assert.Contains(t, stderr.String(), "GitHub Copilot  databricks plugin v0.2.6")
+
+	state, err := installer.LoadState(dir)
+	require.NoError(t, err)
+	require.NotNil(t, state)
+	assert.Contains(t, state.Plugins, agents.NameClaudeCode)
+	assert.Contains(t, state.Plugins, agents.NameCodex)
+	assert.Contains(t, state.Plugins, agents.NameCopilot)
+}
+
+func TestUpdateKeepsRawSkillsWhenPluginMigrationStateWriteFails(t *testing.T) {
+	setupTestAgents(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", "v0.2.6")
+	resetUpdatePluginSeams(t)
+
+	origUpdateSkills := updateSkillsFn
+	t.Cleanup(func() { updateSkillsFn = origUpdateSkills })
+	updateSkillsFn = func(context.Context, installer.ManifestSource, []*agents.Agent, installer.UpdateOptions) (*installer.UpdateResult, error) {
+		require.Fail(t, "raw skill update should not continue after migration state write fails")
+		return nil, nil
+	}
+	updatePluginsFn = func(context.Context, string, string) ([]installer.PluginUpdate, error) {
+		return nil, nil
+	}
+
+	var installed []string
+	updateInstallPluginForAgentFn = func(_ context.Context, a *agents.Agent, scope, ref string) (installer.PluginRecord, error) {
+		installed = append(installed, a.Name)
+		return installer.PluginRecord{
+			Marketplace: a.Plugin.Marketplace,
+			Plugin:      a.Plugin.ID,
+			Scope:       scope,
+			Version:     installer.DisplaySkillsVersion(ref),
+		}, nil
+	}
+
+	var cleaned []string
+	updateCleanupLegacyFn = func(_ context.Context, a *agents.Agent, _ string) error {
+		cleaned = append(cleaned, a.Name)
+		return nil
+	}
+	updateRecordPluginInstallsFn = func(context.Context, string, map[string]installer.PluginRecord, string) error {
+		return errors.New("state write failed")
+	}
+	hasManagedRawSkillsForAgentFn = func(_ context.Context, a *agents.Agent, _ string) (bool, error) {
+		return a.Plugin != nil, nil
+	}
+
+	ctx := cmdio.MockDiscard(t.Context())
+	dir, err := installer.GlobalSkillsDir(ctx)
+	require.NoError(t, err)
+	require.NoError(t, installer.SaveState(dir, &installer.InstallState{
+		SchemaVersion: 2,
+		Release:       "v0.2.5",
+		Skills:        map[string]string{"databricks": "0.2.5"},
+	}))
+
+	cmd := NewUpdateCmd()
+	cmd.SetContext(ctx)
+	cmd.SetArgs([]string{"--scope", "global"})
+
+	err = cmd.Execute()
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "state write failed")
+	assert.Equal(t, []string{agents.NameClaudeCode, agents.NameCodex, agents.NameCopilot}, installed)
+	assert.Empty(t, cleaned)
+
+	state, err := installer.LoadState(dir)
+	require.NoError(t, err)
+	require.NotNil(t, state)
+	assert.Empty(t, state.Plugins)
+	assert.Equal(t, map[string]string{"databricks": "0.2.5"}, state.Skills)
+}
+
+func TestUpdateCheckPrintsPluginMigrationPlan(t *testing.T) {
+	setupTestAgents(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", "v0.2.6")
+	resetUpdatePluginSeams(t)
+	setupUpdateMock(t)
+
+	updatePluginsFn = func(context.Context, string, string) ([]installer.PluginUpdate, error) {
+		require.Fail(t, "check mode must not run plugin update commands")
+		return nil, nil
+	}
+	updateInstallPluginForAgentFn = func(context.Context, *agents.Agent, string, string) (installer.PluginRecord, error) {
+		require.Fail(t, "check mode must not install plugins")
+		return installer.PluginRecord{}, nil
+	}
+	updateRecordPluginInstallsFn = func(context.Context, string, map[string]installer.PluginRecord, string) error {
+		require.Fail(t, "check mode must not record plugin installs")
+		return nil
+	}
+	updateCleanupLegacyFn = func(context.Context, *agents.Agent, string) error {
+		require.Fail(t, "check mode must not clean up legacy skills")
+		return nil
+	}
+	hasManagedRawSkillsForAgentFn = func(_ context.Context, a *agents.Agent, _ string) (bool, error) {
+		return a.Plugin != nil, nil
+	}
+
+	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
+	dir, err := installer.GlobalSkillsDir(ctx)
+	require.NoError(t, err)
+	require.NoError(t, installer.SaveState(dir, &installer.InstallState{
+		SchemaVersion: 2,
+		Release:       "v0.2.5",
+		Skills:        map[string]string{"databricks": "0.2.5"},
+	}))
+
+	cmd := NewUpdateCmd()
+	cmd.SetContext(ctx)
+	cmd.SetArgs([]string{"--scope", "global", "--check"})
+
+	require.NoError(t, cmd.Execute())
+	assert.Contains(t, stderr.String(), "Claude Code  would migrate raw skills to databricks plugin")
+	assert.Contains(t, stderr.String(), "Codex CLI  would migrate raw skills to databricks plugin")
+	assert.Contains(t, stderr.String(), "GitHub Copilot  would migrate raw skills to databricks plugin")
+	assert.NotContains(t, stderr.String(), "No changes.")
+}
+
+func TestUpdateDoesNotMigratePluginAgentWithoutManagedRawSkills(t *testing.T) {
+	setupTestAgents(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", "v0.2.6")
+	resetUpdatePluginSeams(t)
+
+	var rawUpdateAgents []string
+	origUpdateSkills := updateSkillsFn
+	t.Cleanup(func() { updateSkillsFn = origUpdateSkills })
+	updateSkillsFn = func(_ context.Context, _ installer.ManifestSource, targetAgents []*agents.Agent, _ installer.UpdateOptions) (*installer.UpdateResult, error) {
+		for _, a := range targetAgents {
+			rawUpdateAgents = append(rawUpdateAgents, a.Name)
+		}
+		return &installer.UpdateResult{}, nil
+	}
+	updatePluginsFn = func(context.Context, string, string) ([]installer.PluginUpdate, error) {
+		return nil, nil
+	}
+	updateInstallPluginForAgentFn = func(context.Context, *agents.Agent, string, string) (installer.PluginRecord, error) {
+		require.Fail(t, "must not migrate without managed raw skills")
+		return installer.PluginRecord{}, nil
+	}
+	updateRecordPluginInstallsFn = func(context.Context, string, map[string]installer.PluginRecord, string) error {
+		require.Fail(t, "must not record plugin installs without migration")
+		return nil
+	}
+	updateCleanupLegacyFn = func(context.Context, *agents.Agent, string) error {
+		require.Fail(t, "must not clean up without migration")
+		return nil
+	}
+	hasManagedRawSkillsForAgentFn = func(context.Context, *agents.Agent, string) (bool, error) {
+		return false, nil
+	}
+
+	ctx := cmdio.MockDiscard(t.Context())
+	dir, err := installer.GlobalSkillsDir(ctx)
+	require.NoError(t, err)
+	require.NoError(t, installer.SaveState(dir, &installer.InstallState{
+		SchemaVersion: 2,
+		Release:       "v0.2.5",
+		Skills:        map[string]string{"databricks": "0.2.5"},
+	}))
+
+	cmd := NewUpdateCmd()
+	cmd.SetContext(ctx)
+	cmd.SetArgs([]string{"--scope", "global"})
+
+	require.NoError(t, cmd.Execute())
+	assert.Equal(t, []string{agents.NameClaudeCode, agents.NameCursor}, rawUpdateAgents)
+}
+
+func TestUpdateNoPruneFlag(t *testing.T) {
+	setupTestAgents(t)
+	calls := setupUpdateMock(t)
+
+	ctx := cmdio.MockDiscard(t.Context())
+	cmd := NewUpdateCmd()
+	cmd.SetContext(ctx)
+	cmd.SetArgs([]string{"--scope", "global", "--no-prune"})
+
+	require.NoError(t, cmd.Execute())
+	require.Len(t, *calls, 1)
+	assert.True(t, (*calls)[0].NoPrune)
+}
+
+func TestUpdateScopeFlag(t *testing.T) {
+	tests := []struct {
+		name       string
+		args       []string
+		wantScopes []string
+		wantErr    string
+	}{
+		// scope=project requires installed project state and is covered via TestParseScopeFlag
+		// (cmd/aitools/scope_test.go) and TestResolveScopeForUpdateProjectFlagWithState. Here
+		// we cover the no-state paths and the failure modes specific to the Cobra wiring.
+		{name: "scope global", args: []string{"--scope", "global"}, wantScopes: []string{installer.ScopeGlobal}},
+		{name: "scope both with no installs falls through to global", args: []string{"--scope", "both"}, wantScopes: []string{installer.ScopeGlobal}},
+		{name: "scope invalid value", args: []string{"--scope", "all"}, wantErr: `invalid --scope "all"`},
+		{name: "scope conflicts with legacy project", args: []string{"--scope", "global", "--project"}, wantErr: "cannot use --scope with --project or --global"},
+		// Legacy `--project --global` is the supported "update both scopes" path
+		// (preserved until the deprecated flags are removed). Without state, it
+		// falls through to global per TestResolveScopeForUpdateBothFlagsNeitherInstalled.
+		{name: "legacy both flags fall through to global without state", args: []string{"--project", "--global"}, wantScopes: []string{installer.ScopeGlobal}},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			setupTestAgents(t)
+			calls := setupUpdateMock(t)
+
+			ctx := cmdio.MockDiscard(t.Context())
+			cmd := NewUpdateCmd()
+			cmd.SetContext(ctx)
+			cmd.SetArgs(tt.args)
+			cmd.SilenceErrors = true
+			cmd.SilenceUsage = true
+
+			err := cmd.Execute()
+			if tt.wantErr != "" {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), tt.wantErr)
+				return
+			}
+			require.NoError(t, err)
+			require.Len(t, *calls, len(tt.wantScopes))
+			for i, scope := range tt.wantScopes {
+				assert.Equal(t, scope, (*calls)[i].Scope)
+			}
+		})
+	}
+}
+
+func TestUpdateProjectIncludesProjectSkillAgents(t *testing.T) {
+	setupTestAgents(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", "v0.2.6")
+	projectRoot := t.TempDir()
+	t.Chdir(projectRoot)
+	// Skills-only agents read project skills from their project config dirs; a
+	// home-based detection would miss these, so update must use DetectProjectInstalled.
+	require.NoError(t, os.MkdirAll(filepath.Join(projectRoot, ".pi", "skills", "databricks-core"), 0o755))
+	require.NoError(t, os.MkdirAll(filepath.Join(projectRoot, ".gemini", "skills", "databricks-core"), 0o755))
+	require.NoError(t, os.MkdirAll(filepath.Join(projectRoot, ".goose", "skills", "databricks-core"), 0o755))
+	require.NoError(t, os.MkdirAll(filepath.Join(projectRoot, ".kiro", "skills", "databricks-core"), 0o755))
+
+	ctx := cmdio.MockDiscard(t.Context())
+	dir, err := installer.ProjectSkillsDir(ctx)
+	require.NoError(t, err)
+	require.NoError(t, installer.SaveState(dir, &installer.InstallState{
+		SchemaVersion: 2,
+		Release:       "v0.2.5",
+		Scope:         installer.ScopeProject,
+		Skills:        map[string]string{"databricks-core": "0.2.5"},
+	}))
+
+	origUpdateSkills := updateSkillsFn
+	origUpdatePlugins := updatePluginsFn
+	t.Cleanup(func() {
+		updateSkillsFn = origUpdateSkills
+		updatePluginsFn = origUpdatePlugins
+	})
+	var names []string
+	updateSkillsFn = func(_ context.Context, _ installer.ManifestSource, targetAgents []*agents.Agent, _ installer.UpdateOptions) (*installer.UpdateResult, error) {
+		for _, agent := range targetAgents {
+			names = append(names, agent.Name)
+		}
+		return &installer.UpdateResult{}, nil
+	}
+	updatePluginsFn = func(context.Context, string, string) ([]installer.PluginUpdate, error) { return nil, nil }
+
+	cmd := NewUpdateCmd()
+	cmd.SetContext(ctx)
+	cmd.SetArgs([]string{"--scope", "project"})
+	require.NoError(t, cmd.Execute())
+	assert.Contains(t, names, agents.NamePi)
+	assert.Contains(t, names, agents.NameGemini)
+	assert.Contains(t, names, agents.NameGoose)
+	assert.Contains(t, names, agents.NameKiro)
+}
diff --git a/cmd/aitools/version.go b/cmd/aitools/version.go
new file mode 100644
index 00000000000..739174a1864
--- /dev/null
+++ b/cmd/aitools/version.go
@@ -0,0 +1,142 @@
+package aitools
+
+import (
+	"context"
+	"fmt"
+	"maps"
+	"slices"
+
+	"github.com/databricks/cli/libs/aitools/agents"
+	"github.com/databricks/cli/libs/aitools/installer"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/log"
+	"github.com/spf13/cobra"
+	"golang.org/x/mod/semver"
+)
+
+func NewVersionCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "version",
+		Short: "Show installed skills and plugins version",
+		Args:  cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			ctx := cmd.Context()
+
+			globalDir, err := installer.GlobalSkillsDir(ctx)
+			if err != nil {
+				return err
+			}
+			globalState, err := installer.LoadState(globalDir)
+			if err != nil {
+				return fmt.Errorf("failed to load global install state: %w", err)
+			}
+
+			// Try loading project state (may fail if not in a project, that's ok).
+			var projectState *installer.InstallState
+			projectDir, projErr := installer.ProjectSkillsDir(ctx)
+			if projErr == nil {
+				projectState, err = installer.LoadState(projectDir)
+				if err != nil {
+					return fmt.Errorf("failed to load project install state: %w", err)
+				}
+			}
+
+			if globalState == nil && projectState == nil {
+				cmdio.LogString(ctx, "No Databricks skills or plugins installed.")
+				cmdio.LogString(ctx, "")
+				cmdio.LogString(ctx, "Run 'databricks aitools install' to get started.")
+				return nil
+			}
+
+			latestRef, _, err := installer.GetSkillsRef(ctx)
+			if err != nil {
+				log.Debugf(ctx, "could not resolve skills version: %v", err)
+			}
+			cmdio.LogString(ctx, "Databricks skills and plugins:")
+
+			// Always label the scope (global / project) for both skills and
+			// plugins so it is unambiguous where each thing is installed.
+			if globalState != nil {
+				if len(globalState.Skills) > 0 {
+					printVersionLine(ctx, "Skills (global)", globalState, latestRef)
+				}
+				printPluginLines(ctx, globalState, "global")
+			}
+
+			if projectState != nil {
+				if len(projectState.Skills) > 0 {
+					printVersionLine(ctx, "Skills (project)", projectState, latestRef)
+				}
+				printPluginLines(ctx, projectState, "project")
+			}
+
+			return nil
+		},
+	}
+
+	return cmd
+}
+
+// printPluginLines prints one line per plugin recorded in the scope's state,
+// labeled with the scope so it is clear where the plugin is installed.
+func printPluginLines(ctx context.Context, state *installer.InstallState, scope string) {
+	for _, name := range slices.Sorted(maps.Keys(state.Plugins)) {
+		rec := state.Plugins[name]
+		scopeLabel := scope
+		if rec.Scope != "" {
+			scopeLabel += ", " + rec.Scope + " scope"
+		}
+		cmdio.LogString(ctx, fmt.Sprintf("  Plugin (%s, %s): %s", agentDisplayName(name), scopeLabel, versionToken(rec.Version)))
+	}
+}
+
+// versionToken renders a skills/plugin version for output: the "latest"
+// sentinel is explicit about tracking main; a concrete version gets a leading "v".
+func versionToken(v string) string {
+	if v == "" {
+		return "version unknown"
+	}
+	if v == "latest" {
+		return "latest (tracking main)"
+	}
+	if !semver.IsValid("v" + v) {
+		return v
+	}
+	return "v" + v
+}
+
+// agentDisplayName returns the agent's display name, falling back to its
+// registry name when it isn't a known agent.
+func agentDisplayName(name string) string {
+	if agent := agents.ByName(name); agent != nil {
+		return agent.DisplayName
+	}
+	return name
+}
+
+// printVersionLine prints a single version line for a scope.
+func printVersionLine(ctx context.Context, label string, state *installer.InstallState, latestRef string) {
+	version := versionToken(installer.DisplaySkillsVersion(state.Release))
+	skillNoun := "skills"
+	if len(state.Skills) == 1 {
+		skillNoun = "skill"
+	}
+
+	if latestRef == "" {
+		cmdio.LogString(ctx, fmt.Sprintf("  %s: %s (%d %s)", label, version, len(state.Skills), skillNoun))
+		cmdio.LogString(ctx, "  Last updated: "+state.LastUpdated.Format("2006-01-02"))
+		return
+	}
+
+	if latestRef == state.Release {
+		cmdio.LogString(ctx, fmt.Sprintf("  %s: %s (%d %s, up to date)", label, version, len(state.Skills), skillNoun))
+		cmdio.LogString(ctx, "  Last updated: "+state.LastUpdated.Format("2006-01-02"))
+	} else {
+		latestVersion := versionToken(installer.DisplaySkillsVersion(latestRef))
+		cmdio.LogString(ctx, fmt.Sprintf("  %s: %s (%d %s)", label, version, len(state.Skills), skillNoun))
+		cmdio.LogString(ctx, "  Update available: "+latestVersion)
+		cmdio.LogString(ctx, "  Last updated: "+state.LastUpdated.Format("2006-01-02"))
+		cmdio.LogString(ctx, "")
+		cmdio.LogString(ctx, "Run 'databricks aitools update' to update.")
+	}
+}
diff --git a/cmd/aitools/version_test.go b/cmd/aitools/version_test.go
new file mode 100644
index 00000000000..cf4a6516e0a
--- /dev/null
+++ b/cmd/aitools/version_test.go
@@ -0,0 +1,159 @@
+package aitools
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/databricks/cli/libs/aitools/installer"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestVersionShowsPlugin(t *testing.T) {
+	tmp := t.TempDir()
+	t.Setenv("HOME", tmp)
+	t.Setenv("USERPROFILE", tmp)
+	t.Setenv("DATABRICKS_SKILLS_REF", "v0.2.6")
+	t.Chdir(tmp)
+
+	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
+	require.NoError(t, installer.SaveState(globalDir, &installer.InstallState{
+		SchemaVersion: 2,
+		Release:       "v0.2.6",
+		LastUpdated:   time.Date(2026, 6, 24, 0, 0, 0, 0, time.UTC),
+		Plugins: map[string]installer.PluginRecord{
+			"claude-code": {Marketplace: "databricks-agent-skills", Plugin: "databricks", Scope: "user", Version: "0.2.6"},
+		},
+	}))
+
+	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
+	cmd := NewVersionCmd()
+	cmd.SetContext(ctx)
+	require.NoError(t, cmd.RunE(cmd, nil))
+
+	assert.Contains(t, stderr.String(), "Plugin (Claude Code, global, user scope): v0.2.6")
+}
+
+func TestVersionClarifiesLatest(t *testing.T) {
+	tmp := t.TempDir()
+	t.Setenv("HOME", tmp)
+	t.Setenv("USERPROFILE", tmp)
+	t.Setenv("DATABRICKS_SKILLS_REF", "main")
+	t.Chdir(tmp)
+
+	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
+	require.NoError(t, installer.SaveState(globalDir, &installer.InstallState{
+		SchemaVersion: 2,
+		Release:       "main",
+		LastUpdated:   time.Date(2026, 6, 24, 0, 0, 0, 0, time.UTC),
+		Skills:        map[string]string{"databricks-sql": "0.1.0"},
+		Plugins: map[string]installer.PluginRecord{
+			"claude-code": {Marketplace: "claude-plugins-official", Plugin: "databricks", Scope: "user", Version: "latest"},
+		},
+	}))
+
+	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
+	cmd := NewVersionCmd()
+	cmd.SetContext(ctx)
+	require.NoError(t, cmd.RunE(cmd, nil))
+
+	output := stderr.String()
+	assert.Contains(t, output, "Skills (global): main")
+	assert.Contains(t, output, "Plugin (Claude Code, global, user scope): latest (tracking main)")
+}
+
+func TestVersionShowsBothScopes(t *testing.T) {
+	tmp := t.TempDir()
+	t.Setenv("HOME", tmp)
+	t.Setenv("USERPROFILE", tmp)
+	t.Setenv("DATABRICKS_SKILLS_REF", "v0.1.0")
+
+	// Create global state.
+	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
+	globalState := &installer.InstallState{
+		SchemaVersion: 1,
+		Release:       "v0.1.1",
+		LastUpdated:   time.Date(2026, 3, 22, 10, 0, 0, 0, time.UTC),
+		Skills: map[string]string{
+			"databricks-sql":  "0.1.0",
+			"databricks-jobs": "0.1.0",
+		},
+		Scope: installer.ScopeGlobal,
+	}
+	require.NoError(t, installer.SaveState(globalDir, globalState))
+
+	// Create project state in a temp project dir and chdir to it.
+	projectDir := filepath.Join(tmp, "myproject")
+	require.NoError(t, os.MkdirAll(projectDir, 0o755))
+	t.Chdir(projectDir)
+
+	projectSkillsDir := filepath.Join(projectDir, ".databricks", "aitools", "skills")
+	projectState := &installer.InstallState{
+		SchemaVersion: 1,
+		Release:       "v0.2.0",
+		LastUpdated:   time.Date(2026, 3, 22, 11, 0, 0, 0, time.UTC),
+		Skills: map[string]string{
+			"databricks-sql":       "0.2.0",
+			"databricks-jobs":      "0.2.0",
+			"databricks-notebooks": "0.1.0",
+		},
+		Scope: installer.ScopeProject,
+	}
+	require.NoError(t, installer.SaveState(projectSkillsDir, projectState))
+
+	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
+	cmd := NewVersionCmd()
+	cmd.SetContext(ctx)
+
+	err := cmd.RunE(cmd, nil)
+	require.NoError(t, err)
+
+	output := stderr.String()
+	assert.Contains(t, output, "Skills (global)")
+	assert.Contains(t, output, "Skills (project)")
+	assert.Contains(t, output, "v0.1.1")
+	assert.Contains(t, output, "v0.2.0")
+	assert.Contains(t, output, "2 skills")
+	assert.Contains(t, output, "3 skills")
+	assert.Contains(t, output, "Last updated: 2026-03-22")
+}
+
+func TestVersionAlwaysLabelsScope(t *testing.T) {
+	tmp := t.TempDir()
+	t.Setenv("HOME", tmp)
+	t.Setenv("USERPROFILE", tmp)
+	t.Setenv("DATABRICKS_SKILLS_REF", "v0.1.0")
+
+	// Create only global state.
+	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
+	globalState := &installer.InstallState{
+		SchemaVersion: 1,
+		Release:       "v0.1.0",
+		LastUpdated:   time.Date(2026, 3, 22, 10, 0, 0, 0, time.UTC),
+		Skills: map[string]string{
+			"databricks-sql": "0.1.0",
+		},
+	}
+	require.NoError(t, installer.SaveState(globalDir, globalState))
+
+	// Chdir to a project without skills.
+	projectDir := filepath.Join(tmp, "myproject")
+	require.NoError(t, os.MkdirAll(projectDir, 0o755))
+	t.Chdir(projectDir)
+
+	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
+	cmd := NewVersionCmd()
+	cmd.SetContext(ctx)
+
+	err := cmd.RunE(cmd, nil)
+	require.NoError(t, err)
+
+	output := stderr.String()
+	// The scope is always labeled, even when only one scope is installed, so it
+	// is unambiguous where skills/plugins live.
+	assert.Contains(t, output, "Skills (global): v0.1.0")
+	assert.NotContains(t, output, "Skills (project)")
+}
diff --git a/cmd/api/api.go b/cmd/api/api.go
index 823a6a4b663..e6bd47b8ec2 100644
--- a/cmd/api/api.go
+++ b/cmd/api/api.go
@@ -1,6 +1,9 @@
 package api
 
 import (
+	"bytes"
+	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"net/http"
@@ -11,6 +14,9 @@ import (
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/auth"
 	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/databrickscfg"
+	"github.com/databricks/cli/libs/databrickscfg/profile"
+	"github.com/databricks/cli/libs/env"
 	"github.com/databricks/cli/libs/flags"
 	"github.com/databricks/databricks-sdk-go/client"
 	"github.com/databricks/databricks-sdk-go/config"
@@ -18,17 +24,18 @@ import (
 )
 
 const (
-	// orgIDHeader is the workspace routing identifier sent on workspace-scope
-	// requests against unified hosts. Generated SDK service methods set this
-	// per-call when cfg.WorkspaceID is populated; we mirror the same idiom.
-	orgIDHeader = "X-Databricks-Org-Id"
-
-	// orgIDQueryParam is the SPOG (single-page-of-glass) URL convention used
-	// by the Databricks UI: "?o=<workspace-id>" identifies the workspace a URL
-	// targets. When present on the path, we treat it as a per-call override
-	// for the workspace routing identifier so that pasted SPOG URLs route
-	// correctly without requiring --workspace-id.
-	orgIDQueryParam = "o"
+	// orgIDQueryParam and workspaceIDQueryParam are the SPOG
+	// (single-page-of-glass) URL convention used by the Databricks UI:
+	// "?o=<workspace-id>" or "?w=<workspace-id>" identifies the workspace a
+	// URL targets. When present on the path, we treat it as a per-call
+	// override for the workspace routing identifier so that pasted SPOG URLs
+	// route correctly without requiring --workspace-id. "w" is the new
+	// spelling that matches the X-Databricks-Workspace-Id header; "o" stays
+	// accepted for URLs already pasted from older UI builds, shell history,
+	// or committed databricks.yml files. "o" takes precedence when both are
+	// present to preserve the meaning of existing URLs.
+	orgIDQueryParam       = "o"
+	workspaceIDQueryParam = "w"
 )
 
 // accountSegmentRe matches a non-empty segment immediately after "accounts/",
@@ -69,19 +76,34 @@ func makeCommand(method string) *cobra.Command {
 		RunE: func(cmd *cobra.Command, args []string) error {
 			path := args[0]
 
-			var request any
-			diags := payload.Unmarshal(&request)
-			if diags.HasError() {
-				return diags.Error()
+			request, err := buildRequestBody(method, &payload)
+			if err != nil {
+				return err
 			}
 
 			cfg := &config.Config{}
 
-			// command-line flag can specify the profile in use
+			// Profile precedence, mirroring MustWorkspaceClient: --profile flag,
+			// then DATABRICKS_CONFIG_PROFILE (set here so our error messages name
+			// the same profile the SDK loads), then the default profile below.
 			profileFlag := cmd.Flag("profile")
-			if profileFlag != nil {
+			hasProfileFlag := profileFlag != nil && profileFlag.Value.String() != ""
+			if hasProfileFlag {
 				cfg.Profile = profileFlag.Value.String()
 			}
+			if cfg.Profile == "" {
+				cfg.Profile = env.Get(cmd.Context(), "DATABRICKS_CONFIG_PROFILE")
+			}
+
+			if hasProfileFlag {
+				// An explicit --profile wins over auth env vars; its host makes env
+				// host normalization moot (#5096).
+				cfg.Loaders = databrickscfg.ProfileAuthLoaders
+			} else {
+				auth.NormalizeDatabricksConfigFromEnv(cmd.Context(), cfg)
+			}
+			// Skips the default profile when DATABRICKS_HOST is set (#5616).
+			root.ResolveDefaultProfile(cmd.Context(), cfg)
 
 			api, err := client.New(cfg)
 			if err != nil {
@@ -101,15 +123,19 @@ func makeCommand(method string) *cobra.Command {
 
 			headers := map[string]string{"Content-Type": "application/json"}
 			if orgID != "" {
-				headers[orgIDHeader] = orgID
+				headers[auth.WorkspaceIDHeader] = orgID
 			}
 
-			var response any
+			// A *json.RawMessage target copies the response bytes verbatim
+			// (exact integers, key order, unescaped characters) while keeping
+			// the SDK's JSON handling: it sends Accept: application/json and
+			// maps an HTML or non-JSON body to an actionable error.
+			var response json.RawMessage
 			err = api.Do(cmd.Context(), method, path, headers, nil, request, &response)
 			if err != nil {
 				return err
 			}
-			return cmdio.Render(cmd.Context(), response)
+			return renderResponse(cmd.Context(), response)
 		},
 	}
 
@@ -121,6 +147,58 @@ func makeCommand(method string) *cobra.Command {
 	return command
 }
 
+// buildRequestBody turns the --json flag into the value passed to the SDK's
+// Do. Integers must keep their exact value in both shapes: Go's default JSON
+// decoding degrades any integer above 2^53 to a float64, and the query-string
+// path additionally renders large float64s in exponent form.
+//
+// POST/PUT/PATCH send the body verbatim as raw bytes. GET/DELETE/HEAD serialize
+// the payload into the query string, which the SDK builds from a decoded value
+// rather than raw bytes (see databricks-sdk-go/httpclient/request.go,
+// makeRequestBody), so those decode with UseNumber: json.Number keeps the exact
+// digits when makeQueryString formats it with %v.
+func buildRequestBody(method string, payload *flags.JsonFlag) (any, error) {
+	raw := payload.Raw()
+	if raw == nil {
+		return nil, nil
+	}
+	// Reject malformed input client-side with a positioned error (and the @file
+	// source), matching the decoding path this replaced.
+	if err := payload.Validate(); err != nil {
+		return nil, err
+	}
+	switch method {
+	case http.MethodGet, http.MethodDelete, http.MethodHead:
+		var request any
+		dec := json.NewDecoder(bytes.NewReader(raw))
+		dec.UseNumber()
+		if err := dec.Decode(&request); err != nil {
+			return nil, err
+		}
+		return request, nil
+	default:
+		// A literal `null` body decodes to no body on the SDK side; match that
+		// rather than sending the four bytes "null".
+		if bytes.Equal(bytes.TrimSpace(raw), []byte("null")) {
+			return nil, nil
+		}
+		return raw, nil
+	}
+}
+
+// renderResponse writes the API response as JSON, preserving it byte-for-byte
+// (integer literals beyond float64 precision and object key order included).
+// raw is already validated JSON or empty: the SDK rejects a non-JSON body
+// before Do returns.
+func renderResponse(ctx context.Context, raw json.RawMessage) error {
+	if len(raw) == 0 {
+		// Empty body (204, HEAD, or an empty 200). Render `null`, as the
+		// decode-into-any path did.
+		return cmdio.Render(ctx, nil)
+	}
+	return cmdio.RenderJSONBytes(ctx, raw)
+}
+
 // normalizeWorkspaceID strips the CLI-only WorkspaceIDNone sentinel so the
 // SDK's idiomatic "if cfg.WorkspaceID != \"\"" check produces the right call
 // shape. The CLI persists "none" in .databrickscfg to mark profiles where the
@@ -128,7 +206,7 @@ func makeCommand(method string) *cobra.Command {
 // this sentinel and would otherwise send the literal "none" as a routing
 // identifier.
 func normalizeWorkspaceID(workspaceID string) string {
-	if workspaceID == auth.WorkspaceIDNone {
+	if workspaceID == profile.WorkspaceIDNone {
 		return ""
 	}
 	return workspaceID
@@ -150,14 +228,19 @@ func hasAccountSegment(rawPath string) (bool, error) {
 	return accountSegmentRe.MatchString(p), nil
 }
 
-// extractOrgIDFromQuery returns the value of the "o" query parameter on path
-// (the SPOG URL convention), or "" if absent or empty.
-func extractOrgIDFromQuery(rawPath string) (string, error) {
+// extractWorkspaceIDFromQuery returns the workspace ID encoded in the path's
+// query string (the SPOG URL convention). It checks "o" first, then "w";
+// returns "" if neither is present or non-empty.
+func extractWorkspaceIDFromQuery(rawPath string) (string, error) {
 	u, err := url.Parse(rawPath)
 	if err != nil {
 		return "", fmt.Errorf("parse path: %w", err)
 	}
-	return u.Query().Get(orgIDQueryParam), nil
+	q := u.Query()
+	if v := q.Get(orgIDQueryParam); v != "" {
+		return v, nil
+	}
+	return q.Get(workspaceIDQueryParam), nil
 }
 
 // resolveOrgID picks the value (if any) for the workspace routing identifier
@@ -182,12 +265,12 @@ func resolveOrgID(
 		}
 		return workspaceIDFlag, nil
 	}
-	orgIDFromQuery, err := extractOrgIDFromQuery(path)
+	workspaceIDFromQuery, err := extractWorkspaceIDFromQuery(path)
 	if err != nil {
 		return "", err
 	}
-	if orgIDFromQuery != "" {
-		return orgIDFromQuery, nil
+	if workspaceIDFromQuery != "" {
+		return workspaceIDFromQuery, nil
 	}
 	isAccount, err := hasAccountSegment(path)
 	if err != nil {
diff --git a/cmd/api/api_test.go b/cmd/api/api_test.go
index 69cd28fe5fe..d12eb64f8c8 100644
--- a/cmd/api/api_test.go
+++ b/cmd/api/api_test.go
@@ -1,9 +1,13 @@
 package api
 
 import (
+	"encoding/json"
+	"net/http"
 	"testing"
 
-	"github.com/databricks/cli/libs/auth"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/databrickscfg/profile"
+	"github.com/databricks/cli/libs/flags"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -46,7 +50,7 @@ func TestHasAccountSegment(t *testing.T) {
 	}
 }
 
-func TestExtractOrgIDFromQuery(t *testing.T) {
+func TestExtractWorkspaceIDFromQuery(t *testing.T) {
 	cases := []struct {
 		name string
 		path string
@@ -60,10 +64,15 @@ func TestExtractOrgIDFromQuery(t *testing.T) {
 		{"unrelated o-prefixed param ignored", "/api/2.0/clusters/list?other=1", ""},
 		{"absolute URL", "https://example.com/api/2.0/clusters/list?o=42", "42"},
 		{"first value wins on duplicate", "/api/2.0/clusters/list?o=1&o=2", "1"},
+		{"w param present", "/api/2.2/jobs/list?w=7474644166319138", "7474644166319138"},
+		{"w param empty", "/api/2.0/clusters/list?w=", ""},
+		{"w among other params", "/api/2.0/clusters/list?foo=bar&w=123", "123"},
+		{"o wins over w when both present", "/api/2.0/clusters/list?o=111&w=222", "111"},
+		{"w used when o is empty", "/api/2.0/clusters/list?o=&w=222", "222"},
 	}
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
-			got, err := extractOrgIDFromQuery(c.path)
+			got, err := extractWorkspaceIDFromQuery(c.path)
 			require.NoError(t, err)
 			assert.Equal(t, c.want, got)
 		})
@@ -76,6 +85,7 @@ func TestResolveOrgID(t *testing.T) {
 		accountPath     = "/api/2.0/accounts/abc-123/network-policies"
 		proxyPath       = "/api/2.0/preview/accounts/access-control/rule-sets"
 		spogPath        = "/api/2.2/jobs/list?o=7474644166319138"
+		spogPathW       = "/api/2.2/jobs/list?w=7474644166319138"
 		spogAccountPath = "/api/2.0/accounts/abc-123/network-policies?o=7474644166319138"
 		spogWorkspaceID = "7474644166319138"
 		resolvedWSID    = "900800700600"
@@ -189,6 +199,26 @@ func TestResolveOrgID(t *testing.T) {
 			path:           spogAccountPath,
 			want:           spogWorkspaceID,
 		},
+		{
+			name:           "?w=<id> sets identifier when no flag and no profile WorkspaceID",
+			cfgWorkspaceID: "",
+			path:           spogPathW,
+			want:           spogWorkspaceID,
+		},
+		{
+			name:           "?w=<id> overrides profile WorkspaceID",
+			cfgWorkspaceID: resolvedWSID,
+			path:           spogPathW,
+			want:           spogWorkspaceID,
+		},
+		{
+			name:            "--workspace-id wins over ?w=",
+			workspaceIDFlag: flagWSID,
+			flagSet:         true,
+			cfgWorkspaceID:  resolvedWSID,
+			path:            spogPathW,
+			want:            flagWSID,
+		},
 	}
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
@@ -204,6 +234,83 @@ func TestResolveOrgID(t *testing.T) {
 	}
 }
 
+// TestBuildRequestBody covers how --json is turned into the value passed to
+// the SDK: verbatim bytes for body methods (so large integers survive), a
+// UseNumber decode for query-string methods (so they survive there too), and
+// client-side rejection of malformed JSON with a positioned error.
+func TestBuildRequestBody(t *testing.T) {
+	// A >2^53 integer whose low digits a float64 round-trip would drop.
+	const bigJSON = `{"job_id": 18000000000000000123}`
+
+	t.Run("no --json -> nil body", func(t *testing.T) {
+		var p flags.JsonFlag
+		got, err := buildRequestBody(http.MethodPost, &p)
+		require.NoError(t, err)
+		assert.Nil(t, got)
+	})
+
+	// Body methods send the bytes verbatim, unchanged from the flag.
+	for _, method := range []string{http.MethodPost, http.MethodPut, http.MethodPatch} {
+		t.Run(method+" sends verbatim bytes", func(t *testing.T) {
+			var p flags.JsonFlag
+			require.NoError(t, p.Set(bigJSON))
+			got, err := buildRequestBody(method, &p)
+			require.NoError(t, err)
+			assert.Equal(t, []byte(bigJSON), got)
+		})
+	}
+
+	// A literal `null` maps to no body, not the four bytes "null".
+	t.Run("body method maps null to no body", func(t *testing.T) {
+		var p flags.JsonFlag
+		require.NoError(t, p.Set(`null`))
+		got, err := buildRequestBody(http.MethodPost, &p)
+		require.NoError(t, err)
+		assert.Nil(t, got)
+	})
+
+	// Query-string methods decode with UseNumber, so a large integer stays an
+	// exact json.Number (not a float64 that makeQueryString would render as
+	// 1.8e+19).
+	for _, method := range []string{http.MethodGet, http.MethodDelete, http.MethodHead} {
+		t.Run(method+" decodes with UseNumber", func(t *testing.T) {
+			var p flags.JsonFlag
+			require.NoError(t, p.Set(bigJSON))
+			got, err := buildRequestBody(method, &p)
+			require.NoError(t, err)
+			assert.Equal(t, map[string]any{"job_id": json.Number("18000000000000000123")}, got)
+		})
+	}
+
+	// Malformed JSON is rejected client-side with the positioned error, on
+	// both branches.
+	for _, method := range []string{http.MethodPost, http.MethodGet} {
+		t.Run(method+" rejects malformed JSON with a positioned error", func(t *testing.T) {
+			var p flags.JsonFlag
+			require.NoError(t, p.Set(`{"a": 1,}`))
+			_, err := buildRequestBody(method, &p)
+			assert.ErrorContains(t, err, "error decoding JSON at (inline):1:8")
+		})
+	}
+}
+
+// TestRenderResponse covers the two paths of the response renderer: an empty
+// body renders `null` (as the decode-into-any path did), and a non-empty body
+// is re-indented with its integer literals intact.
+func TestRenderResponse(t *testing.T) {
+	t.Run("empty body renders null", func(t *testing.T) {
+		ctx, out := cmdio.NewTestContextWithStdout(t.Context())
+		require.NoError(t, renderResponse(ctx, nil))
+		assert.Equal(t, "null\n", out.String())
+	})
+
+	t.Run("large integer preserved and indented", func(t *testing.T) {
+		ctx, out := cmdio.NewTestContextWithStdout(t.Context())
+		require.NoError(t, renderResponse(ctx, json.RawMessage(`{"job_id":18000000000000000123}`)))
+		assert.Equal(t, "{\n  \"job_id\": 18000000000000000123\n}\n", out.String())
+	})
+}
+
 // TestNormalizeWorkspaceID covers the helper that strips the CLI-only
 // WorkspaceIDNone sentinel. RunE calls this directly before resolveOrgID, so
 // a regression here would surface as the literal "none" being sent on the
@@ -214,7 +321,7 @@ func TestNormalizeWorkspaceID(t *testing.T) {
 		in   string
 		want string
 	}{
-		{"sentinel stripped to empty", auth.WorkspaceIDNone, ""},
+		{"sentinel stripped to empty", profile.WorkspaceIDNone, ""},
 		{"empty passes through", "", ""},
 		{"normal value passes through", "900800700600", "900800700600"},
 	}
diff --git a/cmd/apps/bundle_helpers.go b/cmd/apps/bundle_helpers.go
index 6b1712de563..d1e587bebca 100644
--- a/cmd/apps/bundle_helpers.go
+++ b/cmd/apps/bundle_helpers.go
@@ -4,6 +4,8 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"os"
+	"path/filepath"
 	"strings"
 	"time"
 
@@ -27,12 +29,71 @@ func makeArgsOptionalWithBundle(cmd *cobra.Command, usage string) {
 			return fmt.Errorf("accepts at most 1 arg(s), received %d", len(args))
 		}
 		if !hasBundleConfig() && len(args) != 1 {
-			return fmt.Errorf("accepts 1 arg(s), received %d", len(args))
+			return missingAppNameError(cmd)
 		}
 		return nil
 	}
 }
 
+// missingAppNameError returns an error message that explains what the positional
+// argument should be, and attempts to infer a suggestion from the local environment.
+// The full subcommand path (e.g. "databricks apps start") is rendered from cmd so
+// the usage line and "Did you mean?" hint match the verb the user actually ran.
+func missingAppNameError(cmd *cobra.Command) error {
+	hint := inferAppNameHint()
+	commandPath := "databricks apps <command>"
+	argName := "APP_NAME"
+	if cmd != nil {
+		if p := cmd.CommandPath(); p != "" {
+			commandPath = p
+		}
+		if name := positionalArgName(cmd.Use); name != "" {
+			argName = name
+		}
+	}
+	msg := fmt.Sprintf(`missing required argument: %s
+
+Usage: %s %s
+
+%s is the name of the Databricks app to operate on.
+Alternatively, run this command from a project directory containing
+databricks.yml to auto-detect the app name.`, argName, commandPath, argName, argName)
+
+	if hint != "" {
+		msg += fmt.Sprintf("\n\nDid you mean?\n  %s %s", commandPath, hint)
+	}
+
+	return errors.New(msg)
+}
+
+func positionalArgName(use string) string {
+	start := strings.Index(use, "[")
+	end := strings.Index(use, "]")
+	if start < 0 || end <= start {
+		return ""
+	}
+	return use[start+1 : end]
+}
+
+// inferAppNameHint tries to suggest an app name from the local environment.
+// Only returns a hint if the current directory looks like a Databricks app
+// (contains app.yml or app.yaml), using the directory name as the suggestion.
+func inferAppNameHint() string {
+	wd, err := os.Getwd()
+	if err != nil {
+		return ""
+	}
+
+	for _, filename := range []string{"app.yml", "app.yaml"} {
+		info, err := os.Stat(filepath.Join(wd, filename))
+		if err == nil && info.Mode().IsRegular() {
+			return filepath.Base(wd)
+		}
+	}
+
+	return ""
+}
+
 // getAppNameFromArgs returns the app name from args or detects it from the bundle.
 // Returns (appName, fromBundle, error).
 func getAppNameFromArgs(cmd *cobra.Command, args []string) (string, bool, error) {
diff --git a/cmd/apps/bundle_helpers_test.go b/cmd/apps/bundle_helpers_test.go
index f772d4f545e..3aade05a582 100644
--- a/cmd/apps/bundle_helpers_test.go
+++ b/cmd/apps/bundle_helpers_test.go
@@ -2,6 +2,8 @@ package apps
 
 import (
 	"errors"
+	"os"
+	"path/filepath"
 	"testing"
 
 	"github.com/databricks/databricks-sdk-go/service/apps"
@@ -105,6 +107,112 @@ func TestFormatAppStatusMessage(t *testing.T) {
 	})
 }
 
+func TestInferAppNameHint(t *testing.T) {
+	t.Run("returns empty when no app config exists", func(t *testing.T) {
+		t.Chdir(t.TempDir())
+
+		assert.Empty(t, inferAppNameHint())
+	})
+
+	t.Run("returns dir name when app.yml exists", func(t *testing.T) {
+		dir := t.TempDir()
+		t.Chdir(dir)
+		err := os.WriteFile(filepath.Join(dir, "app.yml"), []byte("command: [\"python\"]"), 0o644)
+		assert.NoError(t, err)
+
+		assert.Equal(t, filepath.Base(dir), inferAppNameHint())
+	})
+
+	t.Run("returns dir name when app.yaml exists", func(t *testing.T) {
+		dir := t.TempDir()
+		t.Chdir(dir)
+		err := os.WriteFile(filepath.Join(dir, "app.yaml"), []byte("command: [\"python\"]"), 0o644)
+		assert.NoError(t, err)
+
+		assert.Equal(t, filepath.Base(dir), inferAppNameHint())
+	})
+
+	t.Run("returns empty when cwd has been deleted", func(t *testing.T) {
+		dir := t.TempDir()
+		t.Chdir(dir)
+		os.Remove(dir)
+
+		assert.Empty(t, inferAppNameHint())
+	})
+}
+
+func TestMissingAppNameError(t *testing.T) {
+	t.Run("includes APP_NAME and usage info", func(t *testing.T) {
+		t.Chdir(t.TempDir())
+
+		err := missingAppNameError(nil)
+		assert.Contains(t, err.Error(), "APP_NAME")
+		assert.Contains(t, err.Error(), "databricks.yml")
+		assert.NotContains(t, err.Error(), "Did you mean")
+	})
+
+	t.Run("includes hint when app.yml exists", func(t *testing.T) {
+		dir := t.TempDir()
+		t.Chdir(dir)
+		writeErr := os.WriteFile(filepath.Join(dir, "app.yml"), []byte("command: [\"python\"]"), 0o644)
+		assert.NoError(t, writeErr)
+
+		err := missingAppNameError(nil)
+		assert.Contains(t, err.Error(), "Did you mean")
+		assert.Contains(t, err.Error(), filepath.Base(dir))
+	})
+
+	t.Run("gracefully handles deleted cwd", func(t *testing.T) {
+		dir := t.TempDir()
+		t.Chdir(dir)
+		os.Remove(dir)
+
+		err := missingAppNameError(nil)
+		assert.Contains(t, err.Error(), "APP_NAME")
+		assert.NotContains(t, err.Error(), "Did you mean")
+	})
+
+	t.Run("renders usage and hint from cmd path per verb", func(t *testing.T) {
+		dir := t.TempDir()
+		t.Chdir(dir)
+		writeErr := os.WriteFile(filepath.Join(dir, "app.yml"), []byte("command: [\"python\"]"), 0o644)
+		assert.NoError(t, writeErr)
+
+		for _, tc := range []struct {
+			verb string
+			use  string
+			arg  string
+		}{
+			{"deploy", "deploy [APP_NAME]", "APP_NAME"},
+			{"start", "start [NAME]", "NAME"},
+			{"stop", "stop [NAME]", "NAME"},
+			{"delete", "delete [NAME]", "NAME"},
+		} {
+			t.Run(tc.verb, func(t *testing.T) {
+				root := &cobra.Command{Use: "databricks"}
+				apps := &cobra.Command{Use: "apps"}
+				sub := &cobra.Command{Use: tc.use}
+				root.AddCommand(apps)
+				apps.AddCommand(sub)
+
+				err := missingAppNameError(sub)
+				assert.Contains(t, err.Error(), "missing required argument: "+tc.arg)
+				assert.Contains(t, err.Error(), "Usage: databricks apps "+tc.verb+" "+tc.arg)
+				assert.Contains(t, err.Error(), "databricks apps "+tc.verb+" "+filepath.Base(dir))
+			})
+		}
+	})
+
+	t.Run("ignores non-regular app.yml entries", func(t *testing.T) {
+		dir := t.TempDir()
+		t.Chdir(dir)
+		assert.NoError(t, os.Mkdir(filepath.Join(dir, "app.yml"), 0o755))
+
+		err := missingAppNameError(nil)
+		assert.NotContains(t, err.Error(), "Did you mean")
+	})
+}
+
 func TestMakeArgsOptionalWithBundle(t *testing.T) {
 	t.Run("updates command usage", func(t *testing.T) {
 		cmd := &cobra.Command{}
@@ -117,6 +225,17 @@ func TestMakeArgsOptionalWithBundle(t *testing.T) {
 		makeArgsOptionalWithBundle(cmd, "test [NAME]")
 		assert.NotNil(t, cmd.Args)
 	})
+
+	t.Run("returns missing app name error when no bundle config exists", func(t *testing.T) {
+		t.Chdir(t.TempDir())
+
+		cmd := &cobra.Command{}
+		makeArgsOptionalWithBundle(cmd, "test [NAME]")
+
+		err := cmd.Args(cmd, nil)
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "missing required argument: NAME")
+	})
 }
 
 func TestGetAppNameFromArgs(t *testing.T) {
diff --git a/cmd/apps/delete_bundle.go b/cmd/apps/delete_bundle.go
index b4c0e72f87c..c57df36a2ea 100644
--- a/cmd/apps/delete_bundle.go
+++ b/cmd/apps/delete_bundle.go
@@ -1,7 +1,7 @@
 package apps
 
 import (
-	"github.com/databricks/cli/cmd/bundle"
+	"github.com/databricks/cli/cmd/bundle/utils"
 	"github.com/databricks/databricks-sdk-go/service/apps"
 	"github.com/spf13/cobra"
 )
@@ -23,7 +23,7 @@ func BundleDeleteOverrideWithWrapper(wrapError ErrorWrapper) func(*cobra.Command
 		originalRunE := deleteCmd.RunE
 		deleteCmd.RunE = func(cmd *cobra.Command, args []string) error {
 			if len(args) == 0 && hasBundleConfig() {
-				return bundle.CommandBundleDestroy(cmd, args, autoApprove, forceDestroy)
+				return utils.CommandBundleDestroy(cmd, args, autoApprove, forceDestroy)
 			}
 
 			err := originalRunE(cmd, args)
diff --git a/cmd/apps/deploy_bundle.go b/cmd/apps/deploy_bundle.go
index 7a893e23263..b390f45e132 100644
--- a/cmd/apps/deploy_bundle.go
+++ b/cmd/apps/deploy_bundle.go
@@ -50,7 +50,7 @@ type bundleDeployOptions struct {
 // Flags that override bundle YAML are only applied when explicitly set by the user.
 func applyDeployFlags(cmd *cobra.Command, b *bundle.Bundle, opts bundleDeployOptions) {
 	b.Config.Bundle.Force = opts.force
-	b.Config.Bundle.Deployment.Lock.Force = opts.forceLock
+	utils.SetForceLock(cmd, b, opts.forceLock)
 	b.AutoApprove = opts.autoApprove
 
 	if cmd.Flag("compute-id").Changed {
@@ -78,7 +78,7 @@ func BundleDeployOverrideWithWrapper(wrapError ErrorWrapper) func(*cobra.Command
 		deployCmd.Flags().BoolVar(&opts.autoApprove, "auto-approve", false, "Skip interactive approvals that might be required for deployment.")
 		deployCmd.Flags().MarkDeprecated("compute-id", "use --cluster-id instead")
 		deployCmd.Flags().BoolVar(&opts.verbose, "verbose", false, "Enable verbose output.")
-		deployCmd.Flags().StringVar(&opts.readPlanPath, "plan", "", "Path to a JSON plan file to apply instead of planning (direct engine only).")
+		deployCmd.Flags().StringVar(&opts.readPlanPath, "plan", "", "Path to a JSON plan file to apply instead of planning.")
 		// Verbose flag currently only affects file sync output, it's used by the vscode extension
 		deployCmd.Flags().MarkHidden("verbose")
 		deployCmd.Flags().BoolVar(&opts.skipValidation, "skip-validation", false, "Skip project validation (build, typecheck, lint)")
diff --git a/cmd/apps/deploy_bundle_test.go b/cmd/apps/deploy_bundle_test.go
index 5c9096afe0e..86f0535d99c 100644
--- a/cmd/apps/deploy_bundle_test.go
+++ b/cmd/apps/deploy_bundle_test.go
@@ -122,20 +122,45 @@ func TestApplyDeployFlags(t *testing.T) {
 	noopWrapper := func(cmd *cobra.Command, appName string, err error) error { return err }
 
 	tests := []struct {
-		name      string
-		args      []string
-		opts      bundleDeployOptions
+		name string
+		args []string
+		opts bundleDeployOptions
+		// configure seeds the bundle config as if it had been loaded from
+		// databricks.yml, so a test can assert a flag does not clobber it.
+		configure func(*bundle.Bundle)
 		assertion func(*testing.T, *bundle.Bundle)
 	}{
 		{
-			name: "force, forceLock, autoApprove always apply",
-			opts: bundleDeployOptions{force: true, forceLock: true, autoApprove: true},
+			name: "force and autoApprove always apply",
+			opts: bundleDeployOptions{force: true, autoApprove: true},
 			assertion: func(t *testing.T, b *bundle.Bundle) {
 				assert.True(t, b.Config.Bundle.Force)
-				assert.True(t, b.Config.Bundle.Deployment.Lock.Force)
 				assert.True(t, b.AutoApprove)
 			},
 		},
+		{
+			name: "forceLock ignored when force-lock flag unchanged",
+			opts: bundleDeployOptions{forceLock: true},
+			assertion: func(t *testing.T, b *bundle.Bundle) {
+				assert.False(t, b.Config.Bundle.Deployment.Lock.Force)
+			},
+		},
+		{
+			name:      "lock.force from databricks.yml survives an unset force-lock flag",
+			opts:      bundleDeployOptions{},
+			configure: func(b *bundle.Bundle) { b.Config.Bundle.Deployment.Lock.Force = true },
+			assertion: func(t *testing.T, b *bundle.Bundle) {
+				assert.True(t, b.Config.Bundle.Deployment.Lock.Force)
+			},
+		},
+		{
+			name: "forceLock applies when --force-lock is set",
+			args: []string{"--force-lock"},
+			opts: bundleDeployOptions{forceLock: true},
+			assertion: func(t *testing.T, b *bundle.Bundle) {
+				assert.True(t, b.Config.Bundle.Deployment.Lock.Force)
+			},
+		},
 		{
 			name: "clusterId ignored when cluster-id flag unchanged",
 			opts: bundleDeployOptions{clusterId: "should-not-leak"},
@@ -181,6 +206,9 @@ func TestApplyDeployFlags(t *testing.T) {
 			require.NoError(t, cmd.ParseFlags(tc.args))
 
 			b := &bundle.Bundle{}
+			if tc.configure != nil {
+				tc.configure(b)
+			}
 			applyDeployFlags(cmd, b, tc.opts)
 
 			tc.assertion(t, b)
diff --git a/cmd/apps/dev.go b/cmd/apps/dev.go
index 59d000ef79c..db9adee6252 100644
--- a/cmd/apps/dev.go
+++ b/cmd/apps/dev.go
@@ -12,7 +12,6 @@ import (
 	"os/exec"
 	"os/signal"
 	"strconv"
-	"strings"
 	"syscall"
 	"time"
 
@@ -22,6 +21,7 @@ import (
 	"github.com/databricks/cli/libs/apps/vite"
 	"github.com/databricks/cli/libs/cmdctx"
 	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/databricks-sdk-go/apierr"
 	"github.com/spf13/cobra"
 )
 
@@ -120,9 +120,8 @@ func newDevRemoteCmd() *cobra.Command {
 	)
 
 	cmd := &cobra.Command{
-		Use:    "dev-remote",
-		Short:  "Run AppKit app locally with WebSocket bridge to remote server",
-		Hidden: true,
+		Use:   "dev-remote",
+		Short: "Run AppKit app locally with WebSocket bridge to remote server",
 		Long: `Run AppKit app locally with WebSocket bridge to remote server.
 
 Starts a local Vite development server and establishes a WebSocket bridge
@@ -185,7 +184,8 @@ Examples:
 				return domainErr
 			})
 			if err != nil {
-				if strings.Contains(err.Error(), "does not exist") || strings.Contains(err.Error(), "is deleted") {
+				// The Apps API reports both a never-created and a deleted app with a 404.
+				if errors.Is(err, apierr.ErrNotFound) {
 					return fmt.Errorf("application '%s' has not been deployed yet. Run `databricks apps deploy` to deploy and then try again", appName)
 				}
 				return fmt.Errorf("failed to get app domain: %w", err)
diff --git a/cmd/apps/import.go b/cmd/apps/import.go
index 67cf4ae9d9e..f552c3182ce 100644
--- a/cmd/apps/import.go
+++ b/cmd/apps/import.go
@@ -15,7 +15,6 @@ import (
 	"go.yaml.in/yaml/v3"
 
 	"github.com/databricks/cli/bundle"
-	"github.com/databricks/cli/bundle/deploy/terraform"
 	"github.com/databricks/cli/bundle/generate"
 	"github.com/databricks/cli/bundle/phases"
 	"github.com/databricks/cli/bundle/resources"
@@ -26,6 +25,7 @@ import (
 	"github.com/databricks/cli/libs/apps/prompt"
 	"github.com/databricks/cli/libs/cmdctx"
 	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/cli/libs/dyn/convert"
 	"github.com/databricks/cli/libs/dyn/yamlsaver"
@@ -34,6 +34,7 @@ import (
 	"github.com/databricks/cli/libs/textutil"
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/service/apps"
+	"github.com/databricks/databricks-sdk-go/service/iam"
 	"github.com/databricks/databricks-sdk-go/service/workspace"
 	"github.com/spf13/cobra"
 )
@@ -51,8 +52,8 @@ func newImportCommand() *cobra.Command {
 		Long: `(Experimental) Import an existing Databricks app and convert it to a bundle configuration.
 
 This command creates a new bundle directory with the app configuration, downloads
-the app source code, binds the bundle to the existing app, and deploys it using
-direct deployment mode. This allows you to manage the app as code going forward.
+the app source code, binds the bundle to the existing app, and deploys it. This
+allows you to manage the app as code going forward.
 
 The command will:
 1. Create an empty bundle folder with databricks.yml
@@ -89,7 +90,7 @@ Examples:
 			w := cmdctx.WorkspaceClient(ctx)
 
 			// Get current user to filter apps
-			me, err := w.CurrentUser.Me(ctx)
+			me, err := w.CurrentUser.Me(ctx, iam.MeRequest{})
 			if err != nil {
 				return fmt.Errorf("failed to get current user: %w", err)
 			}
@@ -196,7 +197,7 @@ Examples:
 					cmdio.LogString(ctx, "Cleaning up previous app folder")
 				}
 
-				err = w.Workspace.Delete(ctx, workspace.Delete{ //nolint:staticcheck // Deprecated in SDK v0.127.0. Migration to WorkspaceHierarchyService tracked separately.
+				err = w.Workspace.Delete(ctx, workspace.Delete{
 					Path:      oldSourceCodePath,
 					Recursive: true,
 				})
@@ -315,7 +316,7 @@ func runImport(ctx context.Context, w *databricks.WorkspaceClient, appName, outp
 		}
 
 		// Find the app resource
-		resource, err := b.Config.Resources.FindResourceByConfigKey(appKey)
+		resource, _, err := b.Config.Resources.ResolveKey(appKey)
 		if err != nil {
 			return fmt.Errorf("failed to find resource: %w", err)
 		}
@@ -330,16 +331,12 @@ func runImport(ctx context.Context, w *databricks.WorkspaceClient, appName, outp
 		}
 
 		// Bind the resource
-		tfName, ok := terraform.GroupToTerraformName[resource.ResourceDescription().PluralName]
-		if !ok {
-			tfName = resource.ResourceDescription().PluralName
-		}
-		phases.Bind(ctx, b, &terraform.BindOptions{
-			AutoApprove:  true,
-			ResourceType: tfName,
-			ResourceKey:  appKey,
-			ResourceId:   app.Name,
-		}, stateDesc.Engine)
+		phases.Bind(ctx, b, &phases.BindOptions{
+			AutoApprove: true,
+			Group:       resource.ResourceDescription().PluralName,
+			ResourceKey: appKey,
+			ResourceId:  app.Name,
+		}, stateDesc)
 		if logdiag.HasError(ctx) {
 			return errors.New("failed to bind resource")
 		}
@@ -464,16 +461,16 @@ func generateAppBundle(ctx context.Context, w *databricks.WorkspaceClient, app *
 	bundleName := textutil.NormalizeString(app.Name)
 	bundleConfig := map[string]dyn.Value{
 		"bundle": dyn.NewValue(map[string]dyn.Value{
-			"name": dyn.NewValue(bundleName, []dyn.Location{{Line: 1}}),
-		}, []dyn.Location{{Line: 1}}),
+			"name": dyn.NewValue(bundleName, []diag.Location{{Line: 1}}),
+		}, []diag.Location{{Line: 1}}),
 		"workspace": dyn.NewValue(map[string]dyn.Value{
-			"host": dyn.NewValue(w.Config.Host, []dyn.Location{{Line: 2}}),
-		}, []dyn.Location{{Line: 10}}),
+			"host": dyn.NewValue(w.Config.Host, []diag.Location{{Line: 2}}),
+		}, []diag.Location{{Line: 10}}),
 		"resources": dyn.NewValue(map[string]dyn.Value{
 			"apps": dyn.V(map[string]dyn.Value{
 				appKey: v,
 			}),
-		}, []dyn.Location{{Line: 20}}),
+		}, []diag.Location{{Line: 20}}),
 	}
 
 	// Download the app source files
diff --git a/cmd/apps/init.go b/cmd/apps/init.go
index 2f1da99bb71..7ba36f79999 100644
--- a/cmd/apps/init.go
+++ b/cmd/apps/init.go
@@ -17,12 +17,14 @@ import (
 
 	"github.com/charmbracelet/huh"
 	"github.com/databricks/cli/cmd/root"
-	"github.com/databricks/cli/experimental/aitools/lib/agents"
-	"github.com/databricks/cli/experimental/aitools/lib/installer"
+	"github.com/databricks/cli/libs/aitools/agents"
+	"github.com/databricks/cli/libs/aitools/installer"
 	"github.com/databricks/cli/libs/apps/generator"
 	"github.com/databricks/cli/libs/apps/initializer"
 	"github.com/databricks/cli/libs/apps/manifest"
+	"github.com/databricks/cli/libs/apps/pkgmanager"
 	"github.com/databricks/cli/libs/apps/prompt"
+	"github.com/databricks/cli/libs/clicompat"
 	"github.com/databricks/cli/libs/cmdctx"
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/env"
@@ -30,6 +32,7 @@ import (
 	"github.com/databricks/cli/libs/log"
 	ignore "github.com/sabhiram/go-gitignore"
 	"github.com/spf13/cobra"
+	"go.yaml.in/yaml/v3"
 )
 
 const (
@@ -38,8 +41,23 @@ const (
 	appkitTemplateDir    = "template"
 	appkitDefaultBranch  = "main"
 	appkitTemplateTagPfx = "template-v"
-	appkitDefaultVersion = "template-v0.24.0"
 	defaultProfile       = "DEFAULT"
+
+	// projectNamePlaceholder is the Go template variable used in template
+	// directory names to stand in for the user-provided project name.
+	projectNamePlaceholder = "{{.project_name}}"
+
+	// bundleConfigFile is the standard bundle configuration filename.
+	bundleConfigFile = "databricks.yml"
+
+	// agenticModeEnvVar controls the agentic app creation flow where resources
+	// are not provided upfront. When set to "true", --set requirement and
+	// resource validation are skipped.
+	agenticModeEnvVar = "DATABRICKS_APPS_AGENTIC_MODE"
+
+	// authModeField is the reserved --set field that selects a resource's auth mode
+	// (e.g., --set analytics.sql-warehouse.authMode=obo).
+	authModeField = "authMode"
 )
 
 // normalizeVersion converts a version string to the template tag format "template-vX.X.X".
@@ -66,24 +84,26 @@ func normalizeVersion(version string) string {
 
 func newInitCmd() *cobra.Command {
 	var (
-		templatePath string
-		branch       string
-		version      string
-		name         string
-		warehouseID  string
-		description  string
-		outputDir    string
-		pluginsFlag  []string
-		deploy       bool
-		run          string
-		setValues    []string
-		autoApprove  bool
+		templatePath   string
+		branch         string
+		version        string
+		name           string
+		warehouseID    string
+		description    string
+		outputDir      string
+		pluginsFlag    []string
+		deploy         bool
+		run            string
+		setValues      []string
+		autoApprove    bool
+		skipInstall    bool
+		packageManager string
+		authMode       string
 	)
 
 	cmd := &cobra.Command{
-		Use:    "init",
-		Short:  "Initialize a new AppKit application from a template",
-		Hidden: true,
+		Use:   "init",
+		Short: "Initialize a new AppKit application from a template",
 		Long: `Initialize a new AppKit application from a template.
 
 When run without arguments, uses the default AppKit template and an interactive prompt
@@ -120,6 +140,11 @@ Examples:
     --set analytics.sql-warehouse.id=wh1 \
     --set reporting.sql-warehouse.id=wh2
 
+  # Access resources on behalf of the user, except the job
+  databricks apps init --name my-app --features=analytics,jobs --auth-mode obo \
+    --set jobs.job.authMode=sp \
+    --set analytics.sql-warehouse.id=abc123 --set jobs.job.id=42
+
   # Create, deploy, and run with dev-remote
   databricks apps init --name my-app --deploy --run=dev-remote
 
@@ -133,6 +158,8 @@ Resource configuration (--set):
   Set resource values using --set plugin.resourceKey.field=value
   Keys are defined in the template's appkit.plugins.json manifest.
   Multi-field resources (e.g., database, secret) require all fields to be set together.
+  Use --set plugin.resourceKey.authMode=obo|sp|both to choose how the app accesses a resource:
+  on behalf of the user (obo), as the app's service principal (sp), or both.
 
 Environment variables:
   DATABRICKS_APPKIT_TEMPLATE_PATH  Override the default template source`,
@@ -147,29 +174,33 @@ Environment variables:
 			}
 
 			return runCreate(ctx, createOptions{
-				templatePath:   templatePath,
-				branch:         branch,
-				version:        version,
-				name:           name,
-				nameProvided:   cmd.Flags().Changed("name"),
-				warehouseID:    warehouseID,
-				description:    description,
-				outputDir:      outputDir,
-				plugins:        pluginsFlag,
-				deploy:         deploy,
-				deployChanged:  cmd.Flags().Changed("deploy"),
-				run:            run,
-				runChanged:     cmd.Flags().Changed("run"),
-				pluginsChanged: cmd.Flags().Changed("features") || cmd.Flags().Changed("plugins"),
-				setValues:      setValues,
-				autoApprove:    autoApprove,
+				templatePath:          templatePath,
+				branch:                branch,
+				version:               version,
+				name:                  name,
+				nameProvided:          cmd.Flags().Changed("name"),
+				warehouseID:           warehouseID,
+				description:           description,
+				outputDir:             outputDir,
+				plugins:               pluginsFlag,
+				deploy:                deploy,
+				deployChanged:         cmd.Flags().Changed("deploy"),
+				run:                   run,
+				runChanged:            cmd.Flags().Changed("run"),
+				pluginsChanged:        cmd.Flags().Changed("features") || cmd.Flags().Changed("plugins"),
+				setValues:             setValues,
+				autoApprove:           autoApprove,
+				skipInstall:           skipInstall,
+				packageManager:        packageManager,
+				packageManagerChanged: cmd.Flags().Changed("package-manager"),
+				authMode:              authMode,
 			})
 		},
 	}
 
 	cmd.Flags().StringVar(&templatePath, "template", "", "Template path (local directory or GitHub URL)")
 	cmd.Flags().StringVar(&branch, "branch", "", "Git branch or tag (for GitHub templates, mutually exclusive with --version)")
-	cmd.Flags().StringVar(&version, "version", "", fmt.Sprintf("AppKit version to use (default: %s, use 'latest' for main branch)", appkitDefaultVersion))
+	cmd.Flags().StringVar(&version, "version", "", "AppKit version to use (default: auto-detected, use 'latest' for main branch)")
 	cmd.Flags().StringVar(&name, "name", "", "Project name (prompts if not provided)")
 	cmd.Flags().StringVar(&warehouseID, "warehouse-id", "", "SQL warehouse ID")
 	_ = cmd.Flags().MarkDeprecated("warehouse-id", "use --set <plugin>.sql-warehouse.id=<value> instead")
@@ -182,27 +213,39 @@ Environment variables:
 	cmd.Flags().BoolVar(&deploy, "deploy", false, "Deploy the app after creation")
 	cmd.Flags().StringVar(&run, "run", "", "Run the app after creation (none, dev, dev-remote)")
 	cmd.Flags().BoolVar(&autoApprove, "auto-approve", false, "Skip confirmation prompts for optional resources. Optional resources are only configured when their values are provided via --set.")
+	cmd.Flags().StringVar(&authMode, "auth-mode", "", "Default resource auth mode: obo (on behalf of the user) or sp (service principal). With obo, resources that cannot be accessed on behalf of the user use sp. Prompts if not provided in interactive mode, otherwise sp.")
+	cmd.Flags().BoolVar(&skipInstall, "skip-install", false, "Skip installing project dependencies (e.g. npm install / uv sync). Cannot be combined with --run.")
+	cmd.Flags().StringVar(&packageManager, "package-manager", "", "Node.js package manager (pnpm, npm; default: inferred from template)")
 
 	return cmd
 }
 
+// NewInitCommand creates the AppKit initializer for use by other CLI commands.
+func NewInitCommand() *cobra.Command {
+	return newInitCmd()
+}
+
 type createOptions struct {
-	templatePath   string
-	branch         string
-	version        string
-	name           string
-	nameProvided   bool // true if --name flag was explicitly set (enables "flags mode")
-	warehouseID    string
-	description    string
-	outputDir      string
-	plugins        []string
-	deploy         bool
-	deployChanged  bool // true if --deploy flag was explicitly set
-	run            string
-	runChanged     bool     // true if --run flag was explicitly set
-	pluginsChanged bool     // true if --plugins flag was explicitly set
-	setValues      []string // --set plugin.resourceKey.field=value pairs
-	autoApprove    bool
+	templatePath          string
+	branch                string
+	version               string
+	name                  string
+	nameProvided          bool // true if --name flag was explicitly set (enables "flags mode")
+	warehouseID           string
+	description           string
+	outputDir             string
+	plugins               []string
+	deploy                bool
+	deployChanged         bool // true if --deploy flag was explicitly set
+	run                   string
+	runChanged            bool     // true if --run flag was explicitly set
+	pluginsChanged        bool     // true if --plugins flag was explicitly set
+	setValues             []string // --set plugin.resourceKey.field=value pairs
+	autoApprove           bool
+	skipInstall           bool
+	packageManager        string
+	packageManagerChanged bool
+	authMode              string // --auth-mode default for all resources
 }
 
 // parseSetValues parses --set key=value pairs into the resourceValues map.
@@ -220,6 +263,9 @@ func parseSetValues(setValues []string, m *manifest.Manifest) (map[string]string
 			return nil, fmt.Errorf("invalid --set key %q, expected plugin.resourceKey.field", key)
 		}
 		pluginName, resourceKey, fieldName := parts[0], parts[1], parts[2]
+		if fieldName == authModeField {
+			continue
+		}
 
 		plugin := m.GetPluginByName(pluginName)
 		if plugin == nil {
@@ -270,18 +316,160 @@ func parseSetValues(setValues []string, m *manifest.Manifest) (map[string]string
 	return rv, nil
 }
 
-// pluginHasResourceField checks whether a plugin declares a resource with the given key and field name.
+// parseSetAuthModes parses --set plugin.resourceKey.authMode=value pairs into a map of resource key to auth mode.
+// Other --set pairs are ignored (see parseSetValues).
+func parseSetAuthModes(setValues []string, m *manifest.Manifest) (map[string]string, error) {
+	modes := make(map[string]string)
+	for _, sv := range setValues {
+		key, value, _ := strings.Cut(sv, "=")
+		parts := strings.SplitN(key, ".", 3)
+		if len(parts) != 3 || parts[2] != authModeField {
+			continue
+		}
+		pluginName, resourceKey := parts[0], parts[1]
+
+		plugin := m.GetPluginByName(pluginName)
+		if plugin == nil {
+			return nil, fmt.Errorf("unknown plugin %q in --set %q; available: %v", pluginName, sv, m.GetPluginNames())
+		}
+		all := append(plugin.Resources.Required, plugin.Resources.Optional...)
+		idx := slices.IndexFunc(all, func(r manifest.Resource) bool { return r.Key() == resourceKey })
+		if idx < 0 {
+			return nil, fmt.Errorf("plugin %q has no resource with key %q", pluginName, resourceKey)
+		}
+		r := all[idx]
+
+		switch value {
+		case generator.AuthModeSP, generator.AuthModeOBO, generator.AuthModeBoth:
+		default:
+			return nil, fmt.Errorf("invalid auth mode %q in --set %q (must be obo, sp, or both)", value, sv)
+		}
+		if r.AppOnly {
+			return nil, fmt.Errorf("resource %q of plugin %q is always accessed by the app's service principal; remove --set %s", resourceKey, pluginName, sv)
+		}
+		if value != generator.AuthModeSP && r.Scope == "" {
+			return nil, fmt.Errorf("resource %q of plugin %q cannot be accessed on behalf of the user; use %s.%s.%s=sp", resourceKey, pluginName, pluginName, resourceKey, authModeField)
+		}
+		modes[r.AuthKey()] = value
+	}
+	return modes, nil
+}
+
+// resolveAuthModes returns the auth mode of each resource. Precedence, highest first:
+// --set authMode, the prompted choice, the --auth-mode default, then sp.
+// setModes and promptedModes only hold modes their resources support. The --auth-mode
+// default applies only to resources that can be accessed on behalf of the user; the keys
+// of the other resources it does not apply to are returned as keptSP.
+func resolveAuthModes(resources []manifest.Resource, setModes, promptedModes map[string]string, defaultMode string) (modes map[string]string, keptSP []string) {
+	modes = make(map[string]string)
+	for _, r := range resources {
+		mode, ok := setModes[r.AuthKey()]
+		if !ok {
+			mode, ok = promptedModes[r.AuthKey()]
+		}
+		if !ok && defaultMode == generator.AuthModeOBO {
+			if r.AppOnly || r.Scope == "" {
+				keptSP = append(keptSP, r.Key())
+				continue
+			}
+			mode = defaultMode
+		}
+		if mode == generator.AuthModeOBO || mode == generator.AuthModeBoth {
+			modes[r.AuthKey()] = mode
+		}
+	}
+	return modes, keptSP
+}
+
+// resourceConfigured reports whether any of the resource's field values are set.
+// Resource values are keyed "resourceKey.fieldName" (see parseSetValues).
+func resourceConfigured(r manifest.Resource, values map[string]string) bool {
+	for _, fieldName := range r.FieldNames() {
+		if values[r.Key()+"."+fieldName] != "" {
+			return true
+		}
+	}
+	return false
+}
+
+// pluginHasResourceField checks whether a plugin has a resource with the given key whose
+// fields, or the fields its databricks.yml binding references, include fieldName.
 func pluginHasResourceField(p *manifest.Plugin, resourceKey, fieldName string) bool {
 	for _, r := range append(p.Resources.Required, p.Resources.Optional...) {
 		if r.Key() == resourceKey {
 			if _, ok := r.Fields[fieldName]; ok {
 				return true
 			}
+			if _, fields, ok := generator.BindingVarFields(r); ok && slices.Contains(fields, fieldName) {
+				return true
+			}
 		}
 	}
 	return false
 }
 
+// missingBindingValue is a field referenced by a resource's databricks.yml binding that has no value.
+type missingBindingValue struct {
+	resource manifest.Resource
+	yamlKey  string
+	field    string
+}
+
+// setKey returns the --set key for the missing value (plugin.resourceKey.field).
+func (mv missingBindingValue) setKey() string {
+	return mv.resource.PluginName + "." + mv.resource.Key() + "." + mv.field
+}
+
+func (mv missingBindingValue) Error() string {
+	return fmt.Sprintf("missing value for %s (needed by the %s binding); use --set %s=value", mv.setKey(), mv.yamlKey, mv.setKey())
+}
+
+// findMissingBindingValues returns the binding fields without a value for configured resources
+// that are bound to the service principal (auth mode sp or both). Resources accessed only on
+// behalf of the user have no binding, and resources without any value are left to
+// validateRequiredResources.
+func findMissingBindingValues(resources []manifest.Resource, values, authModes map[string]string) []missingBindingValue {
+	var missing []missingBindingValue
+	for _, r := range resources {
+		if authModes[r.AuthKey()] == generator.AuthModeOBO || !resourceConfigured(r, values) {
+			continue
+		}
+		yamlKey, fields, ok := generator.BindingVarFields(r)
+		if !ok {
+			continue
+		}
+		for _, f := range fields {
+			if values[r.Key()+"."+f] == "" {
+				missing = append(missing, missingBindingValue{resource: r, yamlKey: yamlKey, field: f})
+			}
+		}
+	}
+	return missing
+}
+
+// promptForBindingValue asks for a value of a binding field and stores it in values.
+func promptForBindingValue(ctx context.Context, mv missingBindingValue, values map[string]string) error {
+	var value string
+	err := huh.NewInput().
+		Title(fmt.Sprintf("%s %s", mv.resource.Alias, mv.field)).
+		Description(fmt.Sprintf("Needed by the %s binding in databricks.yml", mv.yamlKey)).
+		Value(&value).
+		Validate(func(s string) error {
+			if s == "" {
+				return errors.New("this field is required")
+			}
+			return nil
+		}).
+		WithTheme(prompt.AppkitTheme()).
+		Run()
+	if err != nil {
+		return err
+	}
+	prompt.PrintAnswered(ctx, fmt.Sprintf("%s %s", mv.resource.Alias, mv.field), value)
+	values[mv.resource.Key()+"."+mv.field] = value
+	return nil
+}
+
 // validateRequiredResources checks that all required resources have at least one
 // value in resourceValues. Returns an error with a --set hint if any are missing.
 func validateRequiredResources(resources []manifest.Resource, resourceValues map[string]string) error {
@@ -309,6 +497,7 @@ type tmplBundle struct {
 	Variables       string
 	Resources       string
 	TargetVariables string
+	UserAPIScopes   string
 }
 
 // dotEnvVars holds the generated .env file content.
@@ -337,6 +526,7 @@ type templateVars struct {
 	Bundle         tmplBundle
 	DotEnv         dotEnvVars
 	AppEnv         string
+	PackageManager string
 	// Plugins maps plugin name to its metadata
 	// Missing keys return nil, enabling {{if .plugins.analytics}} conditionals.
 	Plugins map[string]*pluginVar
@@ -366,7 +556,8 @@ func parseDeployAndRunFlags(deploy bool, run string) (bool, prompt.RunMode, erro
 
 // promptForPluginsAndDeps prompts for plugins and their resource dependencies using the manifest.
 // skipDeployRunPrompt indicates whether to skip prompting for deploy/run (because flags were provided).
-func promptForPluginsAndDeps(ctx context.Context, m *manifest.Manifest, preSelectedPlugins []string, skipDeployRunPrompt, autoApprove bool) (*prompt.CreateProjectConfig, error) {
+// promptAuthMode indicates whether to prompt for how the app accesses resources (--auth-mode was not provided).
+func promptForPluginsAndDeps(ctx context.Context, m *manifest.Manifest, preSelectedPlugins []string, skipDeployRunPrompt, autoApprove, promptAuthMode bool) (*prompt.CreateProjectConfig, error) {
 	config := &prompt.CreateProjectConfig{
 		Dependencies: make(map[string]string),
 		Features:     preSelectedPlugins, // Reuse Features field for plugin names
@@ -439,6 +630,24 @@ func promptForPluginsAndDeps(ctx context.Context, m *manifest.Manifest, preSelec
 		}
 	}
 
+	// Step 3b: Auth mode for resources that can be accessed on behalf of the user.
+	if promptAuthMode {
+		var configured []manifest.Resource
+		for _, r := range append(resources, optionalResources...) {
+			for k := range config.Dependencies {
+				if strings.HasPrefix(k, r.Key()+".") {
+					configured = append(configured, r)
+					break
+				}
+			}
+		}
+		modes, err := promptForAuthModes(ctx, configured, theme)
+		if err != nil {
+			return nil, err
+		}
+		config.AuthModes = modes
+	}
+
 	// Step 4: Description
 	config.Description = prompt.DefaultAppDescription
 	err := huh.NewInput().
@@ -466,6 +675,79 @@ func promptForPluginsAndDeps(ctx context.Context, m *manifest.Manifest, preSelec
 	return config, nil
 }
 
+// promptForAuthModes asks once how the app accesses its resources and, for "Mixed",
+// asks per resource that can be accessed on behalf of the user.
+// Resources that cannot are listed as info and resolve to sp.
+// Returns a map of resource key to auth mode, or nil if nothing needs to be asked.
+func promptForAuthModes(ctx context.Context, resources []manifest.Resource, theme *huh.Theme) (map[string]string, error) {
+	var capable []manifest.Resource
+	for _, r := range resources {
+		if r.Scope != "" && !r.AppOnly {
+			capable = append(capable, r)
+		}
+	}
+	if len(capable) == 0 {
+		return nil, nil
+	}
+
+	const mixed = "mixed"
+	appMode := generator.AuthModeSP
+	err := huh.NewSelect[string]().
+		Title("How should the app access resources?").
+		Options(
+			huh.NewOption("Service principal", generator.AuthModeSP),
+			huh.NewOption("On behalf of user", generator.AuthModeOBO),
+			huh.NewOption("Mixed (choose per resource)", mixed),
+		).
+		Value(&appMode).
+		WithTheme(theme).
+		Run()
+	if err != nil {
+		return nil, err
+	}
+
+	modes := make(map[string]string, len(capable))
+	for _, r := range capable {
+		mode := appMode
+		if appMode == mixed {
+			mode = generator.AuthModeSP
+			err := huh.NewSelect[string]().
+				Title(fmt.Sprintf("How should the app access %s?", r.Alias)).
+				Options(
+					huh.NewOption("On behalf of user", generator.AuthModeOBO),
+					huh.NewOption("Service principal", generator.AuthModeSP),
+					huh.NewOption("Both", generator.AuthModeBoth),
+				).
+				Value(&mode).
+				WithTheme(theme).
+				Run()
+			if err != nil {
+				return nil, err
+			}
+		}
+		modes[r.AuthKey()] = mode
+		prompt.PrintAnswered(ctx, r.Alias, authModeLabel(mode))
+	}
+	for _, r := range resources {
+		if r.Scope == "" || r.AppOnly {
+			prompt.PrintAnswered(ctx, r.Alias, authModeLabel(generator.AuthModeSP)+" (only option)")
+		}
+	}
+	return modes, nil
+}
+
+// authModeLabel returns a user-facing label for an auth mode.
+func authModeLabel(mode string) string {
+	switch mode {
+	case generator.AuthModeOBO:
+		return "on behalf of user"
+	case generator.AuthModeBoth:
+		return "service principal and on behalf of user"
+	default:
+		return "service principal"
+	}
+}
+
 // promptForResource prompts the user for a resource value.
 // Returns a map of value keys to values. For single-field resources the key is "resource_key.field".
 // For multi-field resources, keys use "resource_key.field_name".
@@ -548,7 +830,7 @@ func cloneRepo(ctx context.Context, repoURL, branch string) (string, error) {
 // Used by commands that don't benefit from background cloning (e.g., manifest).
 func resolveTemplate(ctx context.Context, templatePath, branch, subdir string) (string, func(), error) {
 	ch := resolveTemplateAsync(ctx, templatePath, branch, subdir)
-	return awaitTemplate(ctx, ch)
+	return awaitTemplate(ctx, ch, "")
 }
 
 // templateResult holds the outcome of a background template resolution.
@@ -599,18 +881,24 @@ func resolveTemplateAsync(ctx context.Context, templatePath, branch, subdir stri
 // awaitTemplate waits for the background clone to finish.
 // If the result is already available it returns immediately with a
 // checkmark; otherwise it shows a spinner while waiting.
-func awaitTemplate(ctx context.Context, ch <-chan templateResult) (string, func(), error) {
+// refLabel, if non-empty (e.g. "version 0.24.0" or "branch feature-x"),
+// is appended to spinner and done messages.
+func awaitTemplate(ctx context.Context, ch <-chan templateResult, refLabel string) (string, func(), error) {
+	suffix := ""
+	if refLabel != "" {
+		suffix = " (" + refLabel + ")"
+	}
 	select {
 	case res := <-ch:
 		// Clone finished while the user was typing — print completion.
 		if res.err == nil && res.cleanup != nil {
-			prompt.PrintDone(ctx, "Template cloned")
+			prompt.PrintDone(ctx, "Template cloned"+suffix)
 		}
 		return res.path, res.cleanup, res.err
 	default:
 		// Still cloning — show a spinner for the remaining wait.
 		var res templateResult
-		err := prompt.RunWithSpinnerCtx(ctx, "Cloning template...", func() error {
+		err := prompt.RunWithSpinnerCtx(ctx, "Cloning template"+suffix+"...", func() error {
 			res = <-ch
 			return res.err
 		})
@@ -618,6 +906,180 @@ func awaitTemplate(ctx context.Context, ch <-chan templateResult) (string, func(
 	}
 }
 
+// commitInPlace derives the app name from the cwd basename and verifies that
+// the cwd is suitable for in-place scaffolding (empty modulo .git).
+// Returns the derived app name on success.
+func commitInPlace() (string, error) {
+	appName, err := prompt.DeriveInPlaceAppName(".")
+	if err != nil {
+		return "", err
+	}
+	if err := prompt.CheckInPlaceDirectory("."); err != nil {
+		return "", err
+	}
+	return appName, nil
+}
+
+// shouldSkipPluginSelection returns true when the template is a pre-rendered
+// appkit template: it has a plugin manifest, no {{.project_name}} subdirectory,
+// and a plain databricks.yml file. The full appkit template only has
+// databricks.yml.tmpl (no plain databricks.yml), so it is not matched here.
+func shouldSkipPluginSelection(ctx context.Context, templateDir string) bool {
+	if !manifest.HasManifest(templateDir) {
+		return false
+	}
+	// Pre-rendered templates ship a plain databricks.yml as a static reference.
+	// The full appkit template only has databricks.yml.tmpl.
+	if _, err := os.Stat(filepath.Join(templateDir, bundleConfigFile)); err != nil {
+		return false
+	}
+	entries, err := os.ReadDir(templateDir)
+	if err != nil {
+		log.Debugf(ctx, "Could not read template directory %s: %v", templateDir, err)
+		return false
+	}
+	for _, e := range entries {
+		if e.IsDir() && strings.Contains(e.Name(), projectNamePlaceholder) {
+			return false
+		}
+	}
+	return true
+}
+
+// rewritePackageJSON applies project naming and package-manager selection to a
+// Node template, independently of its bundle configuration or plugin selection.
+func rewritePackageJSON(destDir, newName string, selectedManager pkgmanager.Manager) error {
+	pkgPath := filepath.Join(destDir, "package.json")
+	data, err := os.ReadFile(pkgPath)
+	if errors.Is(err, fs.ErrNotExist) {
+		return nil
+	}
+	if err != nil {
+		return fmt.Errorf("read package.json: %w", err)
+	}
+	out, err := pkgmanager.RewriteJSON(data, newName, selectedManager)
+	if err != nil {
+		return err
+	}
+	return safeWriteFile(pkgPath, out)
+}
+
+// replaceProjectName updates the project name in key files after copying a
+// pre-rendered template. It sets bundle.name and the first resources.apps.*.name
+// in databricks.yml, the name field in package.json, and applies package-manager-specific
+// transformations (packageManager field and script normalization).
+func replaceProjectName(destDir, newName string, selectedManager pkgmanager.Manager) error {
+	if err := rewritePackageJSON(destDir, newName, selectedManager); err != nil {
+		return err
+	}
+
+	// Update databricks.yml using yaml.Node to preserve comments and formatting.
+	ymlPath := filepath.Join(destDir, bundleConfigFile)
+	data, err := os.ReadFile(ymlPath)
+	if err != nil {
+		return fmt.Errorf("read %s: %w", bundleConfigFile, err)
+	}
+
+	var doc yaml.Node
+	if err := yaml.Unmarshal(data, &doc); err != nil {
+		return fmt.Errorf("parse %s: %w", bundleConfigFile, err)
+	}
+
+	if err := setYAMLValue(&doc, []string{"bundle", "name"}, newName); err != nil {
+		return fmt.Errorf("set bundle.name in %s: %w", bundleConfigFile, err)
+	}
+	if err := setFirstAppName(&doc, newName); err != nil {
+		return fmt.Errorf("set app name in %s: %w", bundleConfigFile, err)
+	}
+
+	var buf bytes.Buffer
+	enc := yaml.NewEncoder(&buf)
+	enc.SetIndent(2)
+	if err := enc.Encode(&doc); err != nil {
+		return fmt.Errorf("encode %s: %w", bundleConfigFile, err)
+	}
+	if err := enc.Close(); err != nil {
+		return fmt.Errorf("encode %s: %w", bundleConfigFile, err)
+	}
+
+	return safeWriteFile(ymlPath, buf.Bytes())
+}
+
+// safeWriteFile writes data to a file while preserving the original file mode
+// and refusing to follow symlinks.
+func safeWriteFile(path string, data []byte) error {
+	info, err := os.Lstat(path)
+	if err != nil {
+		return fmt.Errorf("stat %s: %w", filepath.Base(path), err)
+	}
+	if info.Mode()&os.ModeSymlink != 0 {
+		return fmt.Errorf("refusing to write through symlink: %s", filepath.Base(path))
+	}
+	return os.WriteFile(path, data, info.Mode().Perm())
+}
+
+// setYAMLValue walks a yaml.Node tree following the given key path and
+// replaces the leaf scalar value. Returns an error if the key path is not
+// found or the target node is not a scalar.
+func setYAMLValue(node *yaml.Node, keys []string, value string) error {
+	if node.Kind == yaml.DocumentNode && len(node.Content) > 0 {
+		return setYAMLValue(node.Content[0], keys, value)
+	}
+	if node.Kind != yaml.MappingNode || len(keys) == 0 {
+		return fmt.Errorf("key path %v not found", keys)
+	}
+	for i := 0; i < len(node.Content)-1; i += 2 {
+		if node.Content[i].Value == keys[0] {
+			if len(keys) == 1 {
+				leaf := node.Content[i+1]
+				if leaf.Kind != yaml.ScalarNode {
+					return fmt.Errorf("expected scalar at %q, got kind %d", keys[0], leaf.Kind)
+				}
+				leaf.Value = value
+				// Clear any explicit style so the encoder picks the
+				// simplest representation for the new value.
+				leaf.Style = 0
+				return nil
+			}
+			return setYAMLValue(node.Content[i+1], keys[1:], value)
+		}
+	}
+	return fmt.Errorf("key %q not found", keys[0])
+}
+
+// setFirstAppName sets the name field of the first app entry under
+// resources.apps in a yaml.Node tree. Returns nil if resources.apps
+// is not present (not all templates have it).
+func setFirstAppName(node *yaml.Node, name string) error {
+	if node.Kind == yaml.DocumentNode && len(node.Content) > 0 {
+		return setFirstAppName(node.Content[0], name)
+	}
+	if node.Kind != yaml.MappingNode {
+		return nil
+	}
+	// Find resources → apps → first entry → name.
+	appsNode := yamlMapLookup(yamlMapLookup(node, "resources"), "apps")
+	if appsNode == nil || appsNode.Kind != yaml.MappingNode || len(appsNode.Content) < 2 {
+		// No resources.apps section — not an error, some templates lack it.
+		return nil
+	}
+	// First app entry is at Content[1] (Content[0] is the key).
+	return setYAMLValue(appsNode.Content[1], []string{"name"}, name)
+}
+
+// yamlMapLookup returns the value node for a key in a mapping node, or nil.
+func yamlMapLookup(node *yaml.Node, key string) *yaml.Node {
+	if node == nil || node.Kind != yaml.MappingNode {
+		return nil
+	}
+	for i := 0; i < len(node.Content)-1; i += 2 {
+		if node.Content[i].Value == key {
+			return node.Content[i+1]
+		}
+	}
+	return nil
+}
+
 // findProjectSrcDir locates the actual source directory inside a template.
 // Templates may nest their content inside a {{.project_name}} directory.
 func findProjectSrcDir(templateDir string) string {
@@ -626,34 +1088,34 @@ func findProjectSrcDir(templateDir string) string {
 		return templateDir
 	}
 	for _, e := range entries {
-		if e.IsDir() && strings.Contains(e.Name(), "{{.project_name}}") {
+		if e.IsDir() && strings.Contains(e.Name(), projectNamePlaceholder) {
 			return filepath.Join(templateDir, e.Name())
 		}
 	}
 	return templateDir
 }
 
-// startBackgroundNpmInstall copies the package files from the template into
-// destDir and launches `npm ci` in the background. The caller should await
+// startBackgroundInstall copies the package files from the template into
+// destDir and launches the package manager install in the background. The caller should await
 // the returned channel BEFORE writing other files to destDir to prevent
 // concurrent writes. Returns nil if the template is not a Node.js project
-// or npm is not available.
+// or the package manager is not available.
 //
 // IMPORTANT: All reads from srcProjectDir happen synchronously before the
 // goroutine launches. The template directory may be cleaned up after this
 // function returns, so file reads must not be deferred to the goroutine.
-func startBackgroundNpmInstall(ctx context.Context, srcProjectDir, destDir, projectName string) <-chan error {
-	lockFile := filepath.Join(srcProjectDir, "package-lock.json")
-	if _, err := os.Stat(lockFile); err != nil {
+func startBackgroundInstall(ctx context.Context, srcProjectDir, destDir, projectName string, m pkgmanager.Manager) <-chan error {
+	lockfileName, err := m.FindLockfile(srcProjectDir)
+	if err != nil || lockfileName == "" {
 		return nil
 	}
 
-	if _, err := exec.LookPath("npm"); err != nil {
+	if _, err := exec.LookPath(m.Name); err != nil {
 		return nil
 	}
 
 	if err := os.MkdirAll(destDir, 0o755); err != nil {
-		log.Warnf(ctx, "Failed to create %s: %v, skipping background npm install", destDir, err)
+		log.Warnf(ctx, "Failed to create %s: %v, skipping background install", destDir, err)
 		return nil
 	}
 
@@ -669,6 +1131,7 @@ func startBackgroundNpmInstall(ctx context.Context, srcProjectDir, destDir, proj
 		minVars := templateData(templateVars{
 			ProjectName:    projectName,
 			AppDescription: prompt.DefaultAppDescription,
+			PackageManager: m.Name,
 			Plugins:        make(map[string]*pluginVar),
 		})
 		tmpl, err := template.New(name).Option("missingkey=zero").Parse(string(content))
@@ -686,7 +1149,11 @@ func startBackgroundNpmInstall(ctx context.Context, srcProjectDir, destDir, proj
 	}
 
 	if !pkgWritten {
-		log.Warnf(ctx, "Failed to write package.json to %s, skipping background npm install", destDir)
+		log.Warnf(ctx, "Failed to write package.json to %s, skipping background install", destDir)
+		return nil
+	}
+	if err := rewritePackageJSON(destDir, projectName, m); err != nil {
+		log.Warnf(ctx, "Failed to prepare package.json: %v, skipping background install", err)
 		return nil
 	}
 
@@ -698,27 +1165,39 @@ func startBackgroundNpmInstall(ctx context.Context, srcProjectDir, destDir, proj
 		copyFileDeps(ctx, pkgData, srcProjectDir, destDir)
 	}
 
-	// Copy package-lock.json raw (never has template vars).
-	lockData, err := os.ReadFile(lockFile)
-	if err != nil {
-		log.Warnf(ctx, "Failed to read package-lock.json: %v, skipping background npm install", err)
-		return nil
-	}
-	if err := os.WriteFile(filepath.Join(destDir, "package-lock.json"), lockData, 0o644); err != nil {
-		log.Warnf(ctx, "Failed to write package-lock.json: %v, skipping background npm install", err)
-		return nil
+	// Frozen installs must see the same overrides and build permissions as the
+	// finished project. _npmrc follows the same rename/overwrite order as copyTemplate.
+	for _, name := range []string{lockfileName, m.WorkspaceConfigName, ".npmrc", "_npmrc"} {
+		if name == "" {
+			continue
+		}
+		data, err := os.ReadFile(filepath.Join(srcProjectDir, name))
+		if errors.Is(err, fs.ErrNotExist) && name != lockfileName {
+			continue
+		}
+		if err != nil {
+			log.Warnf(ctx, "Failed to read %s: %v, skipping background install", name, err)
+			return nil
+		}
+		if renamed, ok := renameFiles[name]; ok {
+			name = renamed
+		}
+		if err := os.WriteFile(filepath.Join(destDir, name), data, 0o644); err != nil {
+			log.Warnf(ctx, "Failed to write %s: %v, skipping background install", name, err)
+			return nil
+		}
 	}
 
 	ch := make(chan error, 1)
 	go func() {
-		cmd := exec.CommandContext(ctx, "npm", "ci", "--no-audit", "--no-fund", "--prefer-offline")
+		cmd := exec.CommandContext(ctx, m.Name, m.InstallArgs...)
 		cmd.Dir = destDir
 		cmd.Stdout = nil
 		cmd.Stderr = nil
 		ch <- cmd.Run()
 	}()
 
-	log.Debugf(ctx, "Started background npm install in %s", destDir)
+	log.Debugf(ctx, "Started background install in %s", destDir)
 	return ch
 }
 
@@ -757,9 +1236,9 @@ func copyFileDeps(ctx context.Context, pkgJSON []byte, srcDir, destDir string) {
 	}
 }
 
-// awaitBackgroundNpmInstall waits for the background npm install to complete.
+// awaitBackgroundInstall waits for the background install to complete.
 // Shows an instant checkmark if already done, or a spinner for the remainder.
-func awaitBackgroundNpmInstall(ctx context.Context, ch <-chan error) error {
+func awaitBackgroundInstall(ctx context.Context, ch <-chan error) error {
 	select {
 	case err := <-ch:
 		if err == nil {
@@ -776,9 +1255,32 @@ func awaitBackgroundNpmInstall(ctx context.Context, ch <-chan error) error {
 	}
 }
 
-func runCreate(ctx context.Context, opts createOptions) error {
+func runCreate(ctx context.Context, opts createOptions) (runErr error) {
+	// Validate package manager early to provide clear feedback.
+	if opts.packageManagerChanged && opts.packageManager == "" {
+		return errors.New("--package-manager must be npm or pnpm")
+	}
+	selectedManager, err := pkgmanager.Resolve(opts.packageManager)
+	if err != nil {
+		return err
+	}
+
+	// --skip-install leaves the project without installed dependencies, so
+	// downstream `--run dev` / `--run dev-remote` would immediately fail.
+	// Reject the combination up front rather than after the scaffold runs.
+	if opts.skipInstall && opts.run != "" && opts.run != "none" {
+		return errors.New("--skip-install cannot be combined with --run (dev/dev-remote require dependencies to be installed)")
+	}
+
+	switch opts.authMode {
+	case "", generator.AuthModeSP, generator.AuthModeOBO:
+	default:
+		return fmt.Errorf("invalid --auth-mode value: %q (must be obo or sp; use --set <plugin>.<resourceKey>.authMode=both for a single resource)", opts.authMode)
+	}
+
 	var selectedPlugins []string
 	var resourceValues map[string]string
+	var promptedAuthModes map[string]string
 	var shouldDeploy bool
 	var runMode prompt.RunMode
 	isInteractive := cmdio.IsPromptSupported(ctx)
@@ -794,21 +1296,36 @@ func runCreate(ctx context.Context, opts createOptions) error {
 		templateSrc = env.Get(ctx, templatePathEnvVar)
 	}
 
-	// Resolve the git reference (branch/tag) to use for default appkit template
+	// Resolve the git reference (branch/tag) to use for default appkit template.
+	// refLabel is a human-readable description of the ref we're cloning
+	// (e.g. "version 0.24.0", "branch feature-x"). It's surfaced in the
+	// interactive header and the clone spinner so the user can cancel before
+	// naming the project. Empty when there's nothing meaningful to show
+	// (e.g. a custom --template URL with no explicit branch).
 	gitRef := opts.branch
+	var refLabel string
 	usingDefaultTemplate := templateSrc == ""
 	if usingDefaultTemplate {
 		// Using default appkit template - resolve version
 		switch {
 		case opts.branch != "":
 			// --branch takes precedence (already set in gitRef)
+			refLabel = "branch " + opts.branch
 		case opts.version != "":
 			gitRef = normalizeVersion(opts.version)
+			refLabel = "version " + opts.version
 		default:
-			// Default: use pinned version
-			gitRef = appkitDefaultVersion
+			resolved, err := clicompat.ResolveAppKitVersion(ctx)
+			if err != nil {
+				return fmt.Errorf("could not resolve AppKit template version: %w; use --version to specify a version manually", err)
+			}
+			gitRef = normalizeVersion(resolved)
+			refLabel = "version " + resolved
 		}
 		templateSrc = appkitRepoURL
+	} else if opts.branch != "" {
+		// Custom template with an explicit branch — show it for traceability.
+		refLabel = "branch " + opts.branch
 	}
 
 	// Start cloning in the background so it runs while the user types the name.
@@ -830,35 +1347,107 @@ func runCreate(ctx context.Context, opts createOptions) error {
 	}()
 
 	// Step 1: Get project name (clone runs in parallel for remote templates)
-	destDir := opts.name
-	if opts.outputDir != "" {
-		destDir = filepath.Join(opts.outputDir, opts.name)
+	if opts.name == prompt.InPlaceName && opts.outputDir != "" {
+		return prompt.ErrNameDotWithOutputDir
 	}
 
-	if opts.name == "" {
-		if !isInteractive {
-			return errors.New("--name is required in non-interactive mode")
-		}
-		name, err := prompt.PromptForProjectName(ctx, opts.outputDir)
+	var (
+		destDir string
+		inPlace bool
+	)
+	switch {
+	case opts.name == prompt.InPlaceName:
+		appName, err := commitInPlace()
 		if err != nil {
 			return err
 		}
-		opts.name = name
+		opts.name = appName
+		destDir = "."
+		inPlace = true
+	case opts.name != "":
+		if err := prompt.ValidateProjectName(opts.name); err != nil {
+			return err
+		}
 		destDir = opts.name
 		if opts.outputDir != "" {
 			destDir = filepath.Join(opts.outputDir, opts.name)
 		}
-	} else {
-		if err := prompt.ValidateProjectName(opts.name); err != nil {
-			return err
-		}
 		if _, err := os.Stat(destDir); err == nil {
 			return fmt.Errorf("directory %s already exists", destDir)
 		}
+	default:
+		if !isInteractive {
+			return errors.New("--name is required in non-interactive mode")
+		}
+		// Print the AppKit header once so it covers both the in-place
+		// scaffold-location prompt below and the project-name prompt that
+		// may follow, and so the resolved template ref is visible before
+		// the user commits to either path.
+		prompt.PrintHeader(ctx, refLabel)
+		// Offer in-place scaffolding when the current directory is empty
+		// (modulo .git) and its basename is a valid app name. Skipped when
+		// --output-dir was set, since in-place targets cwd and would silently
+		// drop the flag — same reasoning as the --name . / --output-dir mutex
+		// above.
+		if opts.outputDir == "" {
+			if basename, ok := prompt.ShouldOfferInPlace("."); ok {
+				useCurrent, err := prompt.PromptScaffoldLocation(ctx, basename)
+				if err != nil {
+					return err
+				}
+				if useCurrent {
+					// Re-check immediately before committing — the directory may
+					// have changed between offer and answer.
+					if err := prompt.CheckInPlaceDirectory("."); err != nil {
+						return err
+					}
+					opts.name = basename
+					destDir = "."
+					inPlace = true
+				}
+			}
+		}
+		if !inPlace {
+			name, err := prompt.PromptForProjectName(ctx, opts.outputDir)
+			if err != nil {
+				return err
+			}
+			if name == prompt.InPlaceName {
+				appName, err := commitInPlace()
+				if err != nil {
+					return err
+				}
+				opts.name = appName
+				destDir = "."
+				inPlace = true
+			} else {
+				opts.name = name
+				destDir = name
+				if opts.outputDir != "" {
+					destDir = filepath.Join(opts.outputDir, name)
+				}
+			}
+		}
 	}
 
 	// Step 2: Wait for template (may already be done if the user took time typing the name)
-	resolvedPath, cleanup, err := awaitTemplate(ctx, templateCh)
+	resolvedPath, cleanup, err := awaitTemplate(ctx, templateCh, refLabel)
+	// Only fall back to the embedded version when the version was auto-resolved
+	// from the manifest, not when the user explicitly passed --version or --branch.
+	versionAutoResolved := opts.version == "" && opts.branch == ""
+	if err != nil && usingDefaultTemplate && versionAutoResolved && clicompat.IsNotFoundError(err) {
+		fallbackVersion, fbErr := clicompat.ResolveEmbeddedAppKitVersion()
+		if fbErr == nil && fallbackVersion != "" && normalizeVersion(fallbackVersion) != branchForClone {
+			log.Warnf(ctx, "Template version not found, falling back to embedded version %s", fallbackVersion)
+			fallbackRef := normalizeVersion(fallbackVersion)
+			gitRef = fallbackRef
+			templateCh = resolveTemplateAsync(ctx, templateSrc, fallbackRef, appkitTemplateDir)
+			refLabel = "version " + fallbackVersion
+			resolvedPath, cleanup, err = awaitTemplate(ctx, templateCh, refLabel)
+		} else if fbErr != nil {
+			log.Warnf(ctx, "Could not resolve embedded AppKit version: %v", fbErr)
+		}
+	}
 	if err != nil {
 		return err
 	}
@@ -876,10 +1465,92 @@ func runCreate(ctx context.Context, opts createOptions) error {
 		}
 	}
 
-	// Start npm install in the background so it runs while the user answers prompts.
-	// This is a Node.js-only optimisation — non-Node templates skip this.
+	// Check whether plugin selection should be skipped (pre-baked plugins
+	// in a pre-rendered template with a manifest but no {{.project_name}} dir).
+	skipPluginSelection := shouldSkipPluginSelection(ctx, templateDir)
+	if skipPluginSelection {
+		log.Debugf(ctx, "Skipping plugin selection for pre-rendered template at %s", templateDir)
+	}
+
+	// Agentic mode: resources are not provided upfront, skip --set
+	// requirement and validation.
+	agenticMode := env.Get(ctx, agenticModeEnvVar) == "true"
+	if agenticMode {
+		cmdio.LogString(ctx, "Note: agentic mode active — resource validation skipped.")
+	}
+
 	srcProjectDir := findProjectSrcDir(templateDir)
-	npmInstallCh := startBackgroundNpmInstall(ctx, srcProjectDir, destDir, opts.name)
+	isNode, err := pkgmanager.IsNodeTemplate(srcProjectDir)
+	if err != nil {
+		return err
+	}
+	if opts.packageManagerChanged && !isNode {
+		return errors.New("--package-manager is only supported for Node.js templates; remove the flag for this template")
+	}
+	if isNode {
+		if !opts.packageManagerChanged {
+			selectedManager, err = pkgmanager.Detect(srcProjectDir)
+			if err != nil {
+				return err
+			}
+		}
+		// Apply version-based package manager constraints: pnpm is only supported
+		// from a specific AppKit version onwards. If the resolved version is below the
+		// threshold, downgrade pnpm requests to npm (with a warning).
+		if usingDefaultTemplate {
+			effective, downgraded := pkgmanager.EffectiveManager(selectedManager, gitRef)
+			if downgraded && opts.packageManagerChanged {
+				log.Warnf(ctx, "Package manager %q is not supported for AppKit %s, using npm instead",
+					selectedManager.Name, refLabel)
+			}
+			selectedManager = effective
+		}
+
+		if err := selectedManager.ValidateTemplate(srcProjectDir, opts.skipInstall); err != nil {
+			return err
+		}
+		if !opts.skipInstall {
+			if err := selectedManager.ValidateExecutable(); err != nil {
+				return err
+			}
+			selectedManager, err = selectedManager.ResolvePin(ctx, srcProjectDir)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	var installCh <-chan error
+	var projectStarted, projectComplete bool
+	installCtx, cancelInstall := context.WithCancel(ctx)
+	defer func() {
+		cancelInstall()
+		if installCh != nil {
+			// Stop the installer before removing files it may still be writing.
+			<-installCh
+		}
+		if runErr == nil || !projectStarted || projectComplete {
+			return
+		}
+		if inPlace {
+			// destDir is "." here; a wholesale RemoveAll would wipe the
+			// user's current directory (including any pre-existing .git).
+			// Leave the partial scaffold and tell the user to clean up.
+			log.Warnf(ctx, "scaffold failed in current directory; review and clean up generated files manually (e.g. with git status / git clean -fd)")
+			return
+		}
+		if err := os.RemoveAll(destDir); err != nil {
+			log.Warnf(ctx, "Failed to clean up %s: %v", filepath.ToSlash(destDir), err)
+		}
+	}()
+
+	// Start install in the background so it runs while the user answers prompts.
+	// This is a Node.js-only optimisation — non-Node templates skip this.
+	// Honour --skip-install by not kicking off the background install at all.
+	if isNode && !opts.skipInstall {
+		projectStarted = true
+		installCh = startBackgroundInstall(installCtx, srcProjectDir, destDir, opts.name, selectedManager)
+	}
 
 	// Step 3: Load manifest from template (optional — templates without it skip plugin/resource logic)
 	var m *manifest.Manifest
@@ -905,14 +1576,25 @@ func runCreate(ctx context.Context, opts createOptions) error {
 	// Skip deploy/run prompts if in flags mode or if deploy/run flags were explicitly set
 	skipDeployRunPrompt := flagsMode || opts.deployChanged || opts.runChanged
 
-	if isInteractive && !opts.pluginsChanged && !flagsMode {
+	if skipPluginSelection {
+		// Pre-rendered templates already have their plugins configured in code.
+		// Skip plugin/resource prompting entirely — just use mandatory plugins.
+		if isInteractive && !skipDeployRunPrompt {
+			var err error
+			shouldDeploy, runMode, err = prompt.PromptForDeployAndRun(ctx)
+			if err != nil {
+				return err
+			}
+		}
+	} else if isInteractive && !opts.pluginsChanged && !flagsMode {
 		// Interactive mode without --plugins flag: prompt for plugins, dependencies, description
-		config, err := promptForPluginsAndDeps(ctx, m, selectedPlugins, skipDeployRunPrompt, opts.autoApprove)
+		config, err := promptForPluginsAndDeps(ctx, m, selectedPlugins, skipDeployRunPrompt, opts.autoApprove, opts.authMode == "")
 		if err != nil {
 			return err
 		}
 		selectedPlugins = config.Features // Features field holds plugin names
 		resourceValues = config.Dependencies
+		promptedAuthModes = config.AuthModes
 		if config.Description != "" {
 			opts.description = config.Description
 		}
@@ -960,11 +1642,47 @@ func runCreate(ctx context.Context, opts createOptions) error {
 		maps.Copy(resourceValues, setVals)
 	}
 
+	setAuthModes, err := parseSetAuthModes(opts.setValues, m)
+	if err != nil {
+		return err
+	}
+
 	// Always include mandatory plugins regardless of user selection or flags.
 	selectedPlugins = appendUnique(selectedPlugins, m.GetMandatoryPluginNames()...)
 
+	// Only optional resources that were actually configured end up in the project,
+	// so unconfigured ones must not be resolved or listed in the keptSP note.
+	authResources := m.CollectResources(selectedPlugins)
+	for _, r := range m.CollectOptionalResources(selectedPlugins) {
+		if resourceConfigured(r, resourceValues) {
+			authResources = append(authResources, r)
+		}
+	}
+	authModes, keptSP := resolveAuthModes(authResources, setAuthModes, promptedAuthModes, opts.authMode)
+	if len(keptSP) > 0 {
+		cmdio.LogString(ctx, "Note: these resources cannot be accessed on behalf of the user and use the service principal: "+strings.Join(keptSP, ", "))
+	}
+
+	// Warn when --features adds plugins that the pre-rendered template
+	// cannot inject (its server.ts and app.yaml are already finalised).
+	if skipPluginSelection && opts.pluginsChanged {
+		mandatoryNames := m.GetMandatoryPluginNames()
+		mandatory := make(map[string]bool, len(mandatoryNames))
+		for _, n := range mandatoryNames {
+			mandatory[n] = true
+		}
+		for _, p := range opts.plugins {
+			if !mandatory[p] {
+				log.Warnf(ctx, "Adding feature %q to a pre-rendered template is not currently supported.\n"+
+					"To add it manually, register the plugin in server/server.ts and run `npx @databricks/appkit plugin sync --write`.\n"+
+					"To use all features dynamically, run `databricks apps init` without --template.", p)
+			}
+		}
+	}
+
 	// In flags/non-interactive mode, resolve derived values and validate resources.
-	if flagsMode || !isInteractive {
+	// Agentic mode skips validation — resources are filled in later.
+	if !agenticMode && (flagsMode || !isInteractive) {
 		resources := m.CollectResources(selectedPlugins)
 
 		// Resolve derived values for resources that support it.
@@ -994,6 +1712,27 @@ func runCreate(ctx context.Context, opts createOptions) error {
 		}
 	}
 
+	// A resource bound to the service principal needs a value for every field its binding
+	// references, including fields the manifest does not declare. Prompt on a terminal
+	// (outside flags mode), otherwise fail before any project files are written.
+	if !agenticMode {
+		missing := findMissingBindingValues(authResources, resourceValues, authModes)
+		if len(missing) > 0 && isInteractive && !flagsMode {
+			if resourceValues == nil {
+				resourceValues = make(map[string]string)
+			}
+			for _, mv := range missing {
+				if err := promptForBindingValue(ctx, mv, resourceValues); err != nil {
+					return err
+				}
+			}
+			missing = nil
+		}
+		if len(missing) > 0 {
+			return missing[0]
+		}
+	}
+
 	// Apply flag values for deploy/run when in flags mode, flags were explicitly set, or non-interactive
 	if skipDeployRunPrompt || !isInteractive {
 		var err error
@@ -1003,16 +1742,6 @@ func runCreate(ctx context.Context, opts createOptions) error {
 		}
 	}
 
-	// Track whether we started creating the project for cleanup on failure.
-	// The background npm install may have created destDir early.
-	var projectCreated bool
-	var runErr error
-	defer func() {
-		if runErr != nil && (projectCreated || npmInstallCh != nil) {
-			os.RemoveAll(destDir)
-		}
-	}()
-
 	// Set description default
 	if opts.description == "" {
 		opts.description = prompt.DefaultAppDescription
@@ -1026,8 +1755,8 @@ func runCreate(ctx context.Context, opts createOptions) error {
 		profile = w.Config.Profile
 	}
 
-	// Get selected plugins for generation
-	selectedPluginList := generator.GetSelectedPlugins(m, selectedPlugins)
+	// Get selected plugins for generation, deduping resources shared by multiple features.
+	selectedPluginList := generator.DedupeResources(generator.GetSelectedPlugins(m, selectedPlugins))
 
 	log.Debugf(ctx, "Selected plugins: %v", selectedPlugins)
 	log.Debugf(ctx, "Selected plugin list count: %d", len(selectedPluginList))
@@ -1039,6 +1768,7 @@ func runCreate(ctx context.Context, opts createOptions) error {
 		WorkspaceHost:  workspaceHost,
 		Profile:        profile,
 		ResourceValues: resourceValues,
+		AuthModes:      authModes,
 	}
 
 	// Generate configurations from selected plugins
@@ -1069,28 +1799,33 @@ func runCreate(ctx context.Context, opts createOptions) error {
 			Variables:       bundleVars,
 			Resources:       bundleRes,
 			TargetVariables: targetVars,
+			UserAPIScopes:   generator.GenerateUserAPIScopes(selectedPluginList, genConfig),
 		},
 		DotEnv: dotEnvVars{
 			Content: generator.GenerateDotEnv(selectedPluginList, genConfig),
 			Example: generator.GenerateDotEnvExample(selectedPluginList),
 		},
-		AppEnv:  generator.GenerateAppEnv(selectedPluginList, genConfig),
-		Plugins: plugins,
+		AppEnv:         generator.GenerateAppEnv(selectedPluginList, genConfig),
+		PackageManager: selectedManager.Name,
+		Plugins:        plugins,
 	}
 
-	// Await background npm install BEFORE copying the template so there are
-	// no concurrent writes to destDir. npm ci ran with the raw lock file; the
-	// dependency tree is determined entirely by package-lock.json which has no
+	// Await background install BEFORE copying the template so there are
+	// no concurrent writes to destDir. The install ran with the raw lock file; the
+	// dependency tree is determined entirely by the lockfile which has no
 	// template variables, so the installed node_modules is valid.
-	if npmInstallCh != nil {
-		if err := awaitBackgroundNpmInstall(ctx, npmInstallCh); err != nil {
-			log.Warnf(ctx, "Background npm install failed: %v, will retry during project initialization", err)
+	if installCh != nil {
+		err := awaitBackgroundInstall(ctx, installCh)
+		installCh = nil
+		if err != nil {
+			log.Warnf(ctx, "Background install failed: %v, will retry during project initialization", err)
 			os.RemoveAll(filepath.Join(destDir, "node_modules"))
 		}
 	}
 
 	// Copy template with variable substitution
 	var fileCount int
+	projectStarted = true
 	runErr = prompt.RunWithSpinnerCtx(ctx, "Creating project...", func() error {
 		var copyErr error
 		fileCount, copyErr = copyTemplate(ctx, templateDir, destDir, vars)
@@ -1099,7 +1834,23 @@ func runCreate(ctx context.Context, opts createOptions) error {
 	if runErr != nil {
 		return runErr
 	}
-	projectCreated = true // From here on, cleanup on failure
+
+	// Prune non-selected package manager artifacts.
+	if isNode {
+		if err := selectedManager.Prune(destDir); err != nil {
+			return fmt.Errorf("prune package manager artifacts: %w", err)
+		}
+	}
+
+	// For pre-rendered templates, update package.json name (not a .tmpl file)
+	// and serve as a safety net for the agentic flow.
+	if skipPluginSelection {
+		if err := replaceProjectName(destDir, opts.name, selectedManager); err != nil {
+			return fmt.Errorf("update project name: %w", err)
+		}
+	} else if err := rewritePackageJSON(destDir, opts.name, selectedManager); err != nil {
+		return fmt.Errorf("update package.json: %w", err)
+	}
 
 	// Get absolute path
 	absOutputDir, err := filepath.Abs(destDir)
@@ -1110,17 +1861,23 @@ func runCreate(ctx context.Context, opts createOptions) error {
 	// Initialize project based on type (Node.js, Python, etc.).
 	// For Node.js, if the background install succeeded node_modules exists
 	// and the initializer skips the redundant install step.
+	// With --skip-install we bypass Initialize entirely and instead prepend
+	// the install command to NextSteps so the user knows to install first.
 	var nextStepsCmd string
-	projectInitializer := initializer.GetProjectInitializer(absOutputDir)
+	projectInitializer := initializer.GetProjectInitializer(absOutputDir, selectedManager)
 	if projectInitializer != nil {
-		result := projectInitializer.Initialize(ctx, absOutputDir)
-		if !result.Success {
-			if result.Error != nil {
-				return fmt.Errorf("%s: %w", result.Message, result.Error)
+		if opts.skipInstall {
+			nextStepsCmd = prependInstall(projectInitializer.InstallCommand(), projectInitializer.NextSteps())
+		} else {
+			result := projectInitializer.Initialize(ctx, absOutputDir)
+			if !result.Success {
+				if result.Error != nil {
+					return fmt.Errorf("%s: %w", result.Message, result.Error)
+				}
+				return errors.New(result.Message)
 			}
-			return errors.New(result.Message)
+			nextStepsCmd = projectInitializer.NextSteps()
 		}
-		nextStepsCmd = projectInitializer.NextSteps()
 	}
 
 	// Validate dev-remote is only supported for appkit projects
@@ -1130,12 +1887,14 @@ func runCreate(ctx context.Context, opts createOptions) error {
 		}
 	}
 
+	projectComplete = true
+
 	// Show next steps only if user didn't choose to deploy or run
 	showNextSteps := !shouldDeploy && runMode == prompt.RunModeNone
 	if showNextSteps {
-		prompt.PrintSuccess(ctx, opts.name, absOutputDir, fileCount, nextStepsCmd)
+		prompt.PrintSuccess(ctx, opts.name, absOutputDir, fileCount, nextStepsCmd, inPlace)
 	} else {
-		prompt.PrintSuccess(ctx, opts.name, absOutputDir, fileCount, "")
+		prompt.PrintSuccess(ctx, opts.name, absOutputDir, fileCount, "", inPlace)
 	}
 
 	// Print any onSetupMessage declared by selected plugins in the template manifest.
@@ -1155,7 +1914,7 @@ func runCreate(ctx context.Context, opts createOptions) error {
 	// In flags mode, only print a hint — never prompt interactively.
 	if flagsMode {
 		if !agents.HasDatabricksSkillsInstalled(ctx) {
-			cmdio.LogString(ctx, "Tip: coding agents detected without Databricks skills. Run 'databricks experimental aitools skills install' to install them.")
+			cmdio.LogString(ctx, "Tip: coding agents detected without Databricks skills. Run 'databricks aitools install' to install them.")
 		}
 	} else if err := agents.RecommendSkillsInstall(ctx, installer.InstallAllSkills); err != nil {
 		log.Warnf(ctx, "Skills recommendation failed: %v", err)
@@ -1242,6 +2001,18 @@ func runPostCreateDev(ctx context.Context, mode prompt.RunMode, projectInit init
 	}
 }
 
+// prependInstall composes the install command and the project's NextSteps
+// suggestion into a single shell snippet, dropping either side if empty.
+func prependInstall(installCmd, nextStepsCmd string) string {
+	if installCmd == "" {
+		return nextStepsCmd
+	}
+	if nextStepsCmd == "" {
+		return installCmd
+	}
+	return installCmd + " && " + nextStepsCmd
+}
+
 // appendUnique appends values to a slice, skipping duplicates.
 func appendUnique(base []string, values ...string) []string {
 	seen := make(map[string]bool, len(base))
@@ -1300,7 +2071,7 @@ func copyTemplate(ctx context.Context, src, dest string, vars templateVars) (int
 		return 0, err
 	}
 	for _, e := range entries {
-		if e.IsDir() && strings.Contains(e.Name(), "{{.project_name}}") {
+		if e.IsDir() && strings.Contains(e.Name(), projectNamePlaceholder) {
 			srcProjectDir = filepath.Join(src, e.Name())
 			break
 		}
@@ -1382,7 +2153,9 @@ func copyTemplate(ctx context.Context, src, dest string, vars templateVars) (int
 			return err
 		}
 
-		// Handle .tmpl extension - strip it
+		// Handle .tmpl extension — strip it. When a template ships both
+		// foo and foo.tmpl, filepath.Walk's lexical order processes foo first
+		// and foo.tmpl second, so the rendered .tmpl overwrites the static file.
 		relPath = strings.TrimSuffix(relPath, ".tmpl")
 
 		// Apply file renames (e.g., _gitignore -> .gitignore)
@@ -1456,12 +2229,19 @@ func copyTemplate(ctx context.Context, src, dest string, vars templateVars) (int
 // removeEmptyDirs removes empty directories under root, deepest-first.
 // It is used to clean up directories that were created eagerly but ended up
 // with no files after conditional template rendering skipped their contents.
+//
+// .git is skipped so in-place scaffolding (root == ".") never walks into a
+// pre-existing repo and deletes its empty subdirectories (refs/heads,
+// refs/tags, objects/info, objects/pack are all empty after `git init`).
 func removeEmptyDirs(root string) error {
 	var dirs []string
 	err := filepath.WalkDir(root, func(path string, d fs.DirEntry, err error) error {
 		if err != nil {
 			return err
 		}
+		if d.IsDir() && d.Name() == ".git" && path != root {
+			return filepath.SkipDir
+		}
 		if d.IsDir() && path != root {
 			dirs = append(dirs, path)
 		}
@@ -1490,10 +2270,12 @@ func templateData(vars templateVars) map[string]any {
 		"projectName":    vars.ProjectName,
 		"appDescription": vars.AppDescription,
 		"workspaceHost":  vars.WorkspaceHost,
+		"packageManager": vars.PackageManager,
 		"bundle": map[string]any{
 			"variables":       vars.Bundle.Variables,
 			"resources":       vars.Bundle.Resources,
 			"targetVariables": vars.Bundle.TargetVariables,
+			"userApiScopes":   vars.Bundle.UserAPIScopes,
 		},
 		"dotEnv": map[string]any{
 			"content": vars.DotEnv.Content,
diff --git a/cmd/apps/init_test.go b/cmd/apps/init_test.go
index 81e71eed3fb..013e3a9253a 100644
--- a/cmd/apps/init_test.go
+++ b/cmd/apps/init_test.go
@@ -2,7 +2,9 @@ package apps
 
 import (
 	"bytes"
+	"encoding/json"
 	"errors"
+	"flag"
 	"io"
 	"io/fs"
 	"os"
@@ -12,11 +14,15 @@ import (
 	"testing"
 
 	"github.com/databricks/cli/libs/apps/manifest"
+	"github.com/databricks/cli/libs/apps/pkgmanager"
 	"github.com/databricks/cli/libs/apps/prompt"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/env"
 	"github.com/spf13/cobra"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.yaml.in/yaml/v3"
 )
 
 func TestIsTextFile(t *testing.T) {
@@ -88,8 +94,9 @@ func testVars() templateVars {
 			Content: "WH_ID=abc123",
 			Example: "WH_ID=your_sql_warehouse_id",
 		},
-		AppEnv:  "- name: SQL_WAREHOUSE_ID\n  valueFrom: sql_warehouse",
-		Plugins: map[string]*pluginVar{"analytics": {}},
+		AppEnv:         "- name: SQL_WAREHOUSE_ID\n  valueFrom: sql_warehouse",
+		PackageManager: "pnpm",
+		Plugins:        map[string]*pluginVar{"analytics": {}},
 	}
 }
 
@@ -243,6 +250,29 @@ func TestExecuteTemplateNewKeys(t *testing.T) {
 	}
 }
 
+func TestPackageManagerTemplateVariable(t *testing.T) {
+	ctx := t.Context()
+	tests := []struct {
+		name           string
+		packageManager string
+	}{
+		{"pnpm", "pnpm"},
+		{"npm", "npm"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			vars := testVars()
+			vars.PackageManager = tt.packageManager
+			input := "['{{.packageManager}}', 'run', 'start']"
+			result, err := executeTemplate(ctx, "test.yaml", []byte(input), vars)
+			require.NoError(t, err)
+			expected := "['" + tt.packageManager + "', 'run', 'start']"
+			assert.Equal(t, expected, string(result))
+		})
+	}
+}
+
 func TestExecuteTemplateInvalidSyntaxReturnsOriginal(t *testing.T) {
 	ctx := t.Context()
 	vars := templateVars{ProjectName: "my-app"}
@@ -443,7 +473,7 @@ func TestNormalizeVersion(t *testing.T) {
 		{"", ""},
 		{"main", "main"},
 		{"feat/something", "feat/something"},
-		{appkitDefaultVersion, appkitDefaultVersion},
+		{"template-v0.24.0", "template-v0.24.0"},
 	}
 
 	for _, tt := range tests {
@@ -977,29 +1007,31 @@ func skipIfNoNpm(t *testing.T) {
 	}
 }
 
-func TestStartBackgroundNpmInstall_NoLockFile(t *testing.T) {
+func TestStartBackgroundInstall_NoLockFile(t *testing.T) {
 	srcDir := t.TempDir()
 	destDir := t.TempDir()
 
 	// Only package.json, no lock file
 	require.NoError(t, os.WriteFile(filepath.Join(srcDir, "package.json"), []byte(`{"name":"test"}`), 0o644))
 
-	ch := startBackgroundNpmInstall(t.Context(), srcDir, destDir, "test-app")
+	m := pkgmanager.Manager{Name: "npm", LockfileNames: []string{"package-lock.json"}}
+	ch := startBackgroundInstall(t.Context(), srcDir, destDir, "test-app", m)
 	assert.Nil(t, ch)
 }
 
-func TestStartBackgroundNpmInstall_NoPackageJSON(t *testing.T) {
+func TestStartBackgroundInstall_NoPackageJSON(t *testing.T) {
 	srcDir := t.TempDir()
 	destDir := t.TempDir()
 
 	// Only lock file, no package.json
 	require.NoError(t, os.WriteFile(filepath.Join(srcDir, "package-lock.json"), []byte(`{}`), 0o644))
 
-	ch := startBackgroundNpmInstall(t.Context(), srcDir, destDir, "test-app")
+	m := pkgmanager.Manager{Name: "npm", LockfileNames: []string{"package-lock.json"}}
+	ch := startBackgroundInstall(t.Context(), srcDir, destDir, "test-app", m)
 	assert.Nil(t, ch)
 }
 
-func TestStartBackgroundNpmInstall_CopiesFiles(t *testing.T) {
+func TestStartBackgroundInstall_CopiesFiles(t *testing.T) {
 	skipIfNoNpm(t)
 
 	srcDir := t.TempDir()
@@ -1010,7 +1042,8 @@ func TestStartBackgroundNpmInstall_CopiesFiles(t *testing.T) {
 	require.NoError(t, os.WriteFile(filepath.Join(srcDir, "package.json"), pkgJSON, 0o644))
 	require.NoError(t, os.WriteFile(filepath.Join(srcDir, "package-lock.json"), lockJSON, 0o644))
 
-	ch := startBackgroundNpmInstall(t.Context(), srcDir, destDir, "my-app")
+	m := pkgmanager.Manager{Name: "npm", LockfileNames: []string{"package-lock.json"}}
+	ch := startBackgroundInstall(t.Context(), srcDir, destDir, "my-app", m)
 	require.NotNil(t, ch)
 
 	// Drain the channel to avoid goroutine leak (npm ci will fail on fake data)
@@ -1028,7 +1061,7 @@ func TestStartBackgroundNpmInstall_CopiesFiles(t *testing.T) {
 	assert.Equal(t, lockJSON, gotLock)
 }
 
-func TestStartBackgroundNpmInstall_CopiesFileDeps(t *testing.T) {
+func TestStartBackgroundInstall_CopiesFileDeps(t *testing.T) {
 	skipIfNoNpm(t)
 
 	srcDir := t.TempDir()
@@ -1042,7 +1075,8 @@ func TestStartBackgroundNpmInstall_CopiesFileDeps(t *testing.T) {
 	require.NoError(t, os.WriteFile(filepath.Join(srcDir, "package.json"), pkgJSON, 0o644))
 	require.NoError(t, os.WriteFile(filepath.Join(srcDir, "package-lock.json"), lockJSON, 0o644))
 
-	ch := startBackgroundNpmInstall(t.Context(), srcDir, destDir, "test-app")
+	m := pkgmanager.Manager{Name: "npm", LockfileNames: []string{"package-lock.json"}}
+	ch := startBackgroundInstall(t.Context(), srcDir, destDir, "test-app", m)
 	require.NotNil(t, ch)
 	<-ch
 
@@ -1052,7 +1086,7 @@ func TestStartBackgroundNpmInstall_CopiesFileDeps(t *testing.T) {
 	assert.Equal(t, tgzContent, copied)
 }
 
-func TestStartBackgroundNpmInstall_TemplateSubstitution(t *testing.T) {
+func TestStartBackgroundInstall_TemplateSubstitution(t *testing.T) {
 	skipIfNoNpm(t)
 
 	srcDir := t.TempDir()
@@ -1063,7 +1097,8 @@ func TestStartBackgroundNpmInstall_TemplateSubstitution(t *testing.T) {
 	require.NoError(t, os.WriteFile(filepath.Join(srcDir, "package.json"), pkgJSON, 0o644))
 	require.NoError(t, os.WriteFile(filepath.Join(srcDir, "package-lock.json"), lockJSON, 0o644))
 
-	ch := startBackgroundNpmInstall(t.Context(), srcDir, destDir, "cool-project")
+	m := pkgmanager.Manager{Name: "npm", LockfileNames: []string{"package-lock.json"}}
+	ch := startBackgroundInstall(t.Context(), srcDir, destDir, "cool-project", m)
 	require.NotNil(t, ch)
 	<-ch
 
@@ -1072,3 +1107,706 @@ func TestStartBackgroundNpmInstall_TemplateSubstitution(t *testing.T) {
 	assert.Contains(t, string(got), `"cool-project"`)
 	assert.NotContains(t, string(got), "{{.projectName}}")
 }
+
+const (
+	backgroundInstallHelperEnv   = "CLI_TEST_BACKGROUND_INSTALL_MANAGER"
+	backgroundInstallPinEnv      = "CLI_TEST_BACKGROUND_INSTALL_PIN"
+	backgroundInstallLockfileEnv = "CLI_TEST_BACKGROUND_INSTALL_LOCKFILE"
+	backgroundInstallNpmrc       = "enable-pre-post-scripts=true\n"
+	backgroundInstallWorkspace   = "packages:\n  - '.'\noverrides:\n  lodash: 4.17.21\nallowBuilds:\n  esbuild: true\n"
+)
+
+func TestStartBackgroundInstall_PreparesSelectedManager(t *testing.T) {
+	for _, tt := range []struct {
+		manager   string
+		lockfiles []string
+	}{
+		{"npm", []string{"package-lock.json"}},
+		{"npm", []string{"npm-shrinkwrap.json"}},
+		{"npm", []string{"npm-shrinkwrap.json", "package-lock.json"}},
+		{"pnpm", []string{"pnpm-lock.yaml"}},
+	} {
+		for _, configName := range []string{".npmrc", "_npmrc"} {
+			t.Run(tt.manager+"/"+strings.Join(tt.lockfiles, "+")+"/"+configName, func(t *testing.T) {
+				t.Setenv(backgroundInstallHelperEnv, tt.manager)
+				t.Setenv(backgroundInstallLockfileEnv, tt.lockfiles[0])
+				srcDir, destDir := t.TempDir(), t.TempDir()
+				m, err := pkgmanager.Resolve(tt.manager)
+				require.NoError(t, err)
+				if tt.manager == "npm" {
+					m.Pin = "npm@11.4.1"
+				}
+				t.Setenv(backgroundInstallPinEnv, m.Pin)
+				require.NoError(t, os.WriteFile(filepath.Join(srcDir, "package.json"), []byte(`{"name":"{{.projectName}}","packageManager":"yarn@1.22.22"}`), 0o644))
+				for _, name := range tt.lockfiles {
+					require.NoError(t, os.WriteFile(filepath.Join(srcDir, name), []byte("lockfile"), 0o644))
+				}
+				require.NoError(t, os.WriteFile(filepath.Join(srcDir, "pnpm-workspace.yaml"), []byte(backgroundInstallWorkspace), 0o644))
+				require.NoError(t, os.WriteFile(filepath.Join(srcDir, configName), []byte(backgroundInstallNpmrc), 0o644))
+				m.Name, err = os.Executable()
+				require.NoError(t, err)
+				m.InstallArgs = append([]string{"-test.run=^TestBackgroundInstallHelper$", "--"}, m.InstallArgs...)
+
+				ch := startBackgroundInstall(t.Context(), srcDir, destDir, "test-app", m)
+				require.NotNil(t, ch)
+				require.NoError(t, <-ch)
+			})
+		}
+	}
+}
+
+// TestBackgroundInstallHelper checks the files visible to the installer process,
+// so the test does not depend on a locally installed package manager or shell.
+func TestBackgroundInstallHelper(t *testing.T) {
+	manager := os.Getenv(backgroundInstallHelperEnv)
+	if manager == "" {
+		return
+	}
+	m, err := pkgmanager.Resolve(manager)
+	require.NoError(t, err)
+	assert.Equal(t, m.InstallArgs, flag.Args())
+	data, err := os.ReadFile("package.json")
+	require.NoError(t, err)
+	var pkg map[string]any
+	require.NoError(t, json.Unmarshal(data, &pkg))
+	assert.Equal(t, "test-app", pkg["name"])
+	assert.Equal(t, os.Getenv(backgroundInstallPinEnv), pkg["packageManager"])
+	lockfile, err := m.FindLockfile(".")
+	require.NoError(t, err)
+	assert.Equal(t, os.Getenv(backgroundInstallLockfileEnv), lockfile)
+	data, err = os.ReadFile(lockfile)
+	require.NoError(t, err)
+	assert.Equal(t, "lockfile", string(data))
+	data, err = os.ReadFile(".npmrc")
+	require.NoError(t, err)
+	assert.Equal(t, backgroundInstallNpmrc, string(data))
+	if m.WorkspaceConfigName != "" {
+		data, err = os.ReadFile(m.WorkspaceConfigName)
+		require.NoError(t, err)
+		assert.Equal(t, backgroundInstallWorkspace, string(data))
+	} else {
+		assert.NoFileExists(t, "pnpm-workspace.yaml")
+	}
+}
+
+// makeChildDir creates and returns an empty subdirectory of t.TempDir() with
+// the requested name. Used to control filepath.Base(cwd) for in-place tests.
+func makeChildDir(t *testing.T, name string) string {
+	t.Helper()
+	dir := filepath.Join(t.TempDir(), name)
+	require.NoError(t, os.MkdirAll(dir, 0o755))
+	return dir
+}
+
+func TestCommitInPlace_Success(t *testing.T) {
+	dir := makeChildDir(t, "my-app")
+	t.Chdir(dir)
+
+	name, err := commitInPlace()
+	require.NoError(t, err)
+	assert.Equal(t, "my-app", name)
+}
+
+func TestCommitInPlace_AllowsDotGit(t *testing.T) {
+	dir := makeChildDir(t, "my-app")
+	require.NoError(t, os.MkdirAll(filepath.Join(dir, ".git"), 0o755))
+	t.Chdir(dir)
+
+	name, err := commitInPlace()
+	require.NoError(t, err)
+	assert.Equal(t, "my-app", name)
+}
+
+func TestCommitInPlace_RejectsPreExistingGitignore(t *testing.T) {
+	// The template ships _gitignore that renames to .gitignore on copy.
+	// Allowing a pre-existing .gitignore would silently destroy the user's
+	// file via os.WriteFile, so we refuse the directory up front.
+	dir := makeChildDir(t, "my-app")
+	require.NoError(t, os.MkdirAll(filepath.Join(dir, ".git"), 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(dir, ".gitignore"), []byte("node_modules\n"), 0o644))
+	t.Chdir(dir)
+
+	_, err := commitInPlace()
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "not empty")
+}
+
+func TestCommitInPlace_RejectsStrayFiles(t *testing.T) {
+	dir := makeChildDir(t, "my-app")
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "README.md"), []byte("hi"), 0o644))
+	t.Chdir(dir)
+
+	_, err := commitInPlace()
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "not empty")
+}
+
+func TestCommitInPlace_RejectsInvalidBasename(t *testing.T) {
+	dir := makeChildDir(t, "My_App")
+	t.Chdir(dir)
+
+	_, err := commitInPlace()
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "My_App")
+}
+
+func TestRunCreate_NameDotAndOutputDirAreMutuallyExclusive(t *testing.T) {
+	dir := makeChildDir(t, "my-app")
+	t.Chdir(dir)
+
+	ctx := cmdio.MockDiscard(t.Context())
+	err := runCreate(ctx, createOptions{
+		name:           prompt.InPlaceName,
+		nameProvided:   true,
+		outputDir:      "elsewhere",
+		packageManager: "pnpm",
+	})
+	require.Error(t, err)
+	assert.ErrorIs(t, err, prompt.ErrNameDotWithOutputDir)
+}
+
+func TestRunCreate_SkipInstallRejectsRun(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	for _, runMode := range []string{"dev", "dev-remote"} {
+		t.Run(runMode, func(t *testing.T) {
+			err := runCreate(ctx, createOptions{
+				name:           "my-app",
+				nameProvided:   true,
+				skipInstall:    true,
+				run:            runMode,
+				packageManager: "pnpm",
+			})
+			require.Error(t, err)
+			assert.Contains(t, err.Error(), "--skip-install cannot be combined with --run")
+		})
+	}
+}
+
+func TestRunCreateCleansUpPartialScaffold(t *testing.T) {
+	for _, tt := range []struct {
+		name    string
+		files   map[string]string
+		manager string
+		wantErr string
+	}{
+		{
+			name:    "copy",
+			files:   map[string]string{"a.txt": "copied first", "z/child.txt": "directory", "z.tmpl": "conflicts with directory"},
+			wantErr: "open ",
+		},
+		{
+			name:    "prune",
+			files:   map[string]string{"package.json": `{}`, "package-lock.json": `{}`, "pnpm-lock.yaml/child.txt": "cannot remove nonempty directory"},
+			manager: "npm",
+			wantErr: "prune package manager artifacts",
+		},
+		{
+			name:    "package JSON",
+			files:   map[string]string{"package.json": `null`},
+			wantErr: "update package.json",
+		},
+		{
+			name:    "bundle YAML",
+			files:   map[string]string{"appkit.plugins.json": `{"plugins":{}}`, "databricks.yml": "bundle: ["},
+			wantErr: "update project name",
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			src, output := t.TempDir(), t.TempDir()
+			for name, content := range tt.files {
+				path := filepath.Join(src, filepath.FromSlash(name))
+				require.NoError(t, os.MkdirAll(filepath.Dir(path), 0o755))
+				require.NoError(t, os.WriteFile(path, []byte(content), 0o644))
+			}
+			ctx := cmdctx.SetWorkspaceClient(cmdio.MockDiscard(t.Context()), nil)
+			err := runCreate(ctx, createOptions{
+				templatePath:          src,
+				name:                  "test-app",
+				nameProvided:          true,
+				outputDir:             output,
+				skipInstall:           true,
+				packageManager:        tt.manager,
+				packageManagerChanged: tt.manager != "",
+			})
+			require.ErrorContains(t, err, tt.wantErr)
+			assert.NoDirExists(t, filepath.Join(output, "test-app"))
+			assert.DirExists(t, src)
+		})
+	}
+}
+
+func TestInitCmd_SkipInstallFlagRegistered(t *testing.T) {
+	cmd := newInitCmd()
+	flag := cmd.Flags().Lookup("skip-install")
+	require.NotNil(t, flag)
+	assert.Equal(t, "false", flag.DefValue)
+}
+
+func TestPrependInstall(t *testing.T) {
+	tests := []struct {
+		name      string
+		install   string
+		nextSteps string
+		want      string
+	}{
+		{"both set", "npm ci", "npm run dev", "npm ci && npm run dev"},
+		{"empty install", "", "npm run dev", "npm run dev"},
+		{"empty next steps", "npm ci", "", "npm ci"},
+		{"both empty", "", "", ""},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, prependInstall(tt.install, tt.nextSteps))
+		})
+	}
+}
+
+func TestShouldSkipPluginSelection(t *testing.T) {
+	tests := []struct {
+		name     string
+		setup    func(dir string)
+		expected bool
+	}{
+		{
+			name: "pre-rendered: manifest + databricks.yml + no project_name dir",
+			setup: func(dir string) {
+				require.NoError(t, os.WriteFile(filepath.Join(dir, manifest.ManifestFileName), []byte(`{"plugins":{}}`), 0o644))
+				require.NoError(t, os.WriteFile(filepath.Join(dir, bundleConfigFile), []byte("bundle:\n  name: myapp\n"), 0o644))
+			},
+			expected: true,
+		},
+		{
+			name: "full appkit template: manifest + no databricks.yml",
+			setup: func(dir string) {
+				require.NoError(t, os.WriteFile(filepath.Join(dir, manifest.ManifestFileName), []byte(`{"plugins":{}}`), 0o644))
+				require.NoError(t, os.WriteFile(filepath.Join(dir, "databricks.yml.tmpl"), []byte("bundle:\n  name: {{.projectName}}\n"), 0o644))
+			},
+			expected: false,
+		},
+		{
+			name: "manifest present, project_name dir present",
+			setup: func(dir string) {
+				require.NoError(t, os.WriteFile(filepath.Join(dir, manifest.ManifestFileName), []byte(`{"plugins":{}}`), 0o644))
+				require.NoError(t, os.WriteFile(filepath.Join(dir, bundleConfigFile), []byte("bundle:\n  name: myapp\n"), 0o644))
+				require.NoError(t, os.MkdirAll(filepath.Join(dir, "{{.project_name}}"), 0o755))
+			},
+			expected: false,
+		},
+		{
+			name: "no manifest",
+			setup: func(dir string) {
+				require.NoError(t, os.WriteFile(filepath.Join(dir, "README.md"), []byte("hello"), 0o644))
+			},
+			expected: false,
+		},
+		{
+			name:     "unreadable directory",
+			setup:    func(_ string) {},
+			expected: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			dir := t.TempDir()
+			if tt.name == "unreadable directory" {
+				dir = filepath.Join(dir, "nonexistent")
+			} else {
+				tt.setup(dir)
+			}
+			assert.Equal(t, tt.expected, shouldSkipPluginSelection(t.Context(), dir))
+		})
+	}
+}
+
+func TestReplaceProjectName(t *testing.T) {
+	tests := []struct {
+		name           string
+		yml            string
+		pkgJSON        string // empty means no package.json
+		newName        string
+		wantBundleName string
+		wantAppName    string
+		wantPkgName    string
+		wantErr        bool
+	}{
+		{
+			name:           "bundle and app name replaced",
+			yml:            "bundle:\n  name: old-app\nresources:\n  apps:\n    old-app:\n      name: \"old-app\"\n",
+			newName:        "new-app",
+			wantBundleName: "new-app",
+			wantAppName:    "new-app",
+		},
+		{
+			name:           "bundle name only, no resources",
+			yml:            "bundle:\n  name: old-app\n",
+			newName:        "new-app",
+			wantBundleName: "new-app",
+		},
+		{
+			name:    "no bundle.name, only app name",
+			yml:     "resources:\n  apps:\n    myapp:\n      name: \"myapp\"\n",
+			newName: "new-app",
+			wantErr: true,
+		},
+		{
+			name:           "package.json round-trip",
+			yml:            "bundle:\n  name: old-app\n",
+			pkgJSON:        `{"name":"old-app","version":"1.0.0"}`,
+			newName:        "new-app",
+			wantBundleName: "new-app",
+			wantPkgName:    "new-app",
+		},
+		{
+			name:           "no package.json",
+			yml:            "bundle:\n  name: old-app\n",
+			newName:        "new-app",
+			wantBundleName: "new-app",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			dir := t.TempDir()
+
+			require.NoError(t, os.WriteFile(filepath.Join(dir, bundleConfigFile), []byte(tt.yml), 0o644))
+
+			if tt.pkgJSON != "" {
+				require.NoError(t, os.WriteFile(filepath.Join(dir, "package.json"), []byte(tt.pkgJSON), 0o644))
+			}
+
+			err := replaceProjectName(dir, tt.newName, pkgmanager.Default())
+			if tt.wantErr {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+
+			// Verify databricks.yml via yaml.Node to avoid format sensitivity.
+			ymlData, err := os.ReadFile(filepath.Join(dir, bundleConfigFile))
+			require.NoError(t, err)
+
+			var doc yaml.Node
+			require.NoError(t, yaml.Unmarshal(ymlData, &doc))
+
+			if tt.wantBundleName != "" {
+				bundleName := yamlMapLookup(yamlMapLookup(doc.Content[0], "bundle"), "name")
+				require.NotNil(t, bundleName, "bundle.name not found in output")
+				assert.Equal(t, tt.wantBundleName, bundleName.Value)
+			}
+
+			if tt.wantAppName != "" {
+				appsNode := yamlMapLookup(yamlMapLookup(doc.Content[0], "resources"), "apps")
+				require.NotNil(t, appsNode)
+				require.True(t, appsNode.Kind == yaml.MappingNode && len(appsNode.Content) >= 2)
+				appName := yamlMapLookup(appsNode.Content[1], "name")
+				require.NotNil(t, appName, "resources.apps.*.name not found in output")
+				assert.Equal(t, tt.wantAppName, appName.Value)
+			}
+
+			if tt.wantPkgName != "" {
+				pkgData, err := os.ReadFile(filepath.Join(dir, "package.json"))
+				require.NoError(t, err)
+				var pkg map[string]any
+				require.NoError(t, json.Unmarshal(pkgData, &pkg))
+				assert.Equal(t, tt.wantPkgName, pkg["name"])
+			}
+		})
+	}
+}
+
+func TestReplaceProjectNameNoDatabricksYml(t *testing.T) {
+	dir := t.TempDir()
+	err := replaceProjectName(dir, "new-app", pkgmanager.Default())
+	require.Error(t, err)
+}
+
+func TestReplaceProjectNameMalformedYAML(t *testing.T) {
+	dir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(dir, bundleConfigFile), []byte("{{invalid yaml"), 0o644))
+	err := replaceProjectName(dir, "new-app", pkgmanager.Default())
+	assert.ErrorContains(t, err, "parse")
+}
+
+func TestReplaceProjectNameMalformedPackageJSON(t *testing.T) {
+	dir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(dir, bundleConfigFile), []byte("bundle:\n  name: old\n"), 0o644))
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "package.json"), []byte("{invalid json}"), 0o644))
+	err := replaceProjectName(dir, "new-app", pkgmanager.Default())
+	assert.ErrorContains(t, err, "parse package.json")
+}
+
+func TestReplaceProjectNameSymlinkRefused(t *testing.T) {
+	dir := t.TempDir()
+
+	// Create a real file and a symlink to it named databricks.yml.
+	realFile := filepath.Join(dir, "real.yml")
+	require.NoError(t, os.WriteFile(realFile, []byte("bundle:\n  name: old\n"), 0o644))
+	require.NoError(t, os.Symlink(realFile, filepath.Join(dir, bundleConfigFile)))
+
+	err := replaceProjectName(dir, "new-app", pkgmanager.Default())
+	assert.ErrorContains(t, err, "symlink")
+}
+
+func TestSetYAMLValue(t *testing.T) {
+	input := "top:\n  nested:\n    leaf: old\n"
+	var doc yaml.Node
+	require.NoError(t, yaml.Unmarshal([]byte(input), &doc))
+
+	require.NoError(t, setYAMLValue(&doc, []string{"top", "nested", "leaf"}, "new"))
+
+	val := yamlMapLookup(yamlMapLookup(yamlMapLookup(doc.Content[0], "top"), "nested"), "leaf")
+	require.NotNil(t, val)
+	assert.Equal(t, "new", val.Value)
+}
+
+func TestSetYAMLValueMissingKey(t *testing.T) {
+	input := "top:\n  nested:\n    leaf: old\n"
+	var doc yaml.Node
+	require.NoError(t, yaml.Unmarshal([]byte(input), &doc))
+
+	err := setYAMLValue(&doc, []string{"top", "nonexistent", "leaf"}, "new")
+	assert.Error(t, err)
+
+	val := yamlMapLookup(yamlMapLookup(yamlMapLookup(doc.Content[0], "top"), "nested"), "leaf")
+	require.NotNil(t, val)
+	assert.Equal(t, "old", val.Value)
+}
+
+func TestSetYAMLValueNonScalarLeaf(t *testing.T) {
+	input := "bundle:\n  name:\n    nested: value\n"
+	var doc yaml.Node
+	require.NoError(t, yaml.Unmarshal([]byte(input), &doc))
+
+	err := setYAMLValue(&doc, []string{"bundle", "name"}, "new-name")
+	assert.ErrorContains(t, err, "expected scalar")
+}
+
+func TestYamlMapLookup(t *testing.T) {
+	input := "a: 1\nb: 2\n"
+	var doc yaml.Node
+	require.NoError(t, yaml.Unmarshal([]byte(input), &doc))
+
+	root := doc.Content[0]
+	assert.NotNil(t, yamlMapLookup(root, "a"))
+	assert.Equal(t, "1", yamlMapLookup(root, "a").Value)
+	assert.Nil(t, yamlMapLookup(root, "missing"))
+	assert.Nil(t, yamlMapLookup(nil, "a"))
+}
+
+func TestSetFirstAppName(t *testing.T) {
+	input := "resources:\n  apps:\n    myapp:\n      name: \"old-name\"\n      description: keep\n"
+	var doc yaml.Node
+	require.NoError(t, yaml.Unmarshal([]byte(input), &doc))
+
+	require.NoError(t, setFirstAppName(&doc, "new-name"))
+
+	appsNode := yamlMapLookup(yamlMapLookup(doc.Content[0], "resources"), "apps")
+	require.NotNil(t, appsNode)
+	appName := yamlMapLookup(appsNode.Content[1], "name")
+	require.NotNil(t, appName)
+	assert.Equal(t, "new-name", appName.Value)
+
+	// Verify description is untouched.
+	desc := yamlMapLookup(appsNode.Content[1], "description")
+	require.NotNil(t, desc)
+	assert.Equal(t, "keep", desc.Value)
+}
+
+func TestSetFirstAppNameNoResources(t *testing.T) {
+	input := "bundle:\n  name: myapp\n"
+	var doc yaml.Node
+	require.NoError(t, yaml.Unmarshal([]byte(input), &doc))
+
+	// No error when resources.apps is absent.
+	require.NoError(t, setFirstAppName(&doc, "new-name"))
+
+	bundleName := yamlMapLookup(yamlMapLookup(doc.Content[0], "bundle"), "name")
+	require.NotNil(t, bundleName)
+	assert.Equal(t, "myapp", bundleName.Value)
+}
+
+func authModeManifest() *manifest.Manifest {
+	return &manifest.Manifest{
+		Plugins: map[string]manifest.Plugin{
+			"analytics": {
+				Name: "analytics",
+				Resources: manifest.Resources{
+					Required: []manifest.Resource{
+						{Type: "sql_warehouse", ResourceKey: "sql-warehouse", Scope: "sql", PluginName: "analytics", Fields: map[string]manifest.ResourceField{"id": {}}},
+						{Type: "secret", ResourceKey: "secret", AppOnly: true, PluginName: "analytics", Fields: map[string]manifest.ResourceField{"scope": {}, "key": {}}},
+					},
+				},
+			},
+			"jobs": {
+				Name: "jobs",
+				Resources: manifest.Resources{
+					Required: []manifest.Resource{
+						{Type: "job", ResourceKey: "job", PluginName: "jobs", Fields: map[string]manifest.ResourceField{"id": {}}},
+					},
+				},
+			},
+		},
+	}
+}
+
+func TestParseSetAuthModes(t *testing.T) {
+	m := authModeManifest()
+	tests := []struct {
+		name      string
+		setValues []string
+		want      map[string]string
+		wantErr   string
+	}{
+		{name: "values ignored", setValues: []string{"analytics.sql-warehouse.id=wh"}, want: map[string]string{}},
+		{name: "obo", setValues: []string{"analytics.sql-warehouse.authMode=obo"}, want: map[string]string{"sql_warehouse:sql-warehouse": "obo"}},
+		{name: "both", setValues: []string{"analytics.sql-warehouse.authMode=both"}, want: map[string]string{"sql_warehouse:sql-warehouse": "both"}},
+		{name: "sp without scope", setValues: []string{"jobs.job.authMode=sp"}, want: map[string]string{"job:job": "sp"}},
+		{name: "invalid value", setValues: []string{"analytics.sql-warehouse.authMode=user"}, wantErr: "invalid auth mode"},
+		{name: "unknown resource", setValues: []string{"analytics.nope.authMode=obo"}, wantErr: "no resource with key"},
+		{name: "app only", setValues: []string{"analytics.secret.authMode=sp"}, wantErr: "always accessed by the app's service principal"},
+		{name: "obo without scope", setValues: []string{"jobs.job.authMode=obo"}, wantErr: "cannot be accessed on behalf of the user"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := parseSetAuthModes(tt.setValues, m)
+			if tt.wantErr != "" {
+				assert.ErrorContains(t, err, tt.wantErr)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+
+	// parseSetValues must accept and skip the authMode pseudo-field.
+	rv, err := parseSetValues([]string{"analytics.sql-warehouse.authMode=obo", "analytics.sql-warehouse.id=wh"}, m)
+	require.NoError(t, err)
+	assert.Equal(t, map[string]string{"sql-warehouse.id": "wh"}, rv)
+}
+
+func TestResolveAuthModes(t *testing.T) {
+	m := authModeManifest()
+	resources := m.CollectResources([]string{"analytics", "jobs"})
+
+	got, keptSP := resolveAuthModes(resources, nil, nil, "")
+	assert.Empty(t, got)
+	assert.Empty(t, keptSP)
+
+	// The --auth-mode obo default skips resources without a scope and app-only resources.
+	got, keptSP = resolveAuthModes(resources, nil, nil, "obo")
+	assert.Equal(t, map[string]string{"sql_warehouse:sql-warehouse": "obo"}, got)
+	assert.Equal(t, []string{"secret", "job"}, keptSP)
+
+	// An explicit --set wins and is not reported as kept on sp.
+	got, keptSP = resolveAuthModes(resources, map[string]string{"job:job": "sp", "sql_warehouse:sql-warehouse": "sp"}, nil, "obo")
+	assert.Empty(t, got)
+	assert.Equal(t, []string{"secret"}, keptSP)
+
+	got, _ = resolveAuthModes(resources, map[string]string{"sql_warehouse:sql-warehouse": "both"}, map[string]string{"sql_warehouse:sql-warehouse": "obo"}, "")
+	assert.Equal(t, map[string]string{"sql_warehouse:sql-warehouse": "both"}, got)
+
+	got, _ = resolveAuthModes(resources, nil, map[string]string{"sql_warehouse:sql-warehouse": "obo"}, "")
+	assert.Equal(t, map[string]string{"sql_warehouse:sql-warehouse": "obo"}, got)
+}
+
+func TestResourceConfigured(t *testing.T) {
+	r := manifest.Resource{ResourceKey: "wh", Fields: map[string]manifest.ResourceField{"id": {}}}
+	assert.False(t, resourceConfigured(r, nil))
+	assert.False(t, resourceConfigured(r, map[string]string{"other.id": "x"}))
+	assert.True(t, resourceConfigured(r, map[string]string{"wh.id": "x"}))
+}
+
+func TestFindMissingBindingValues(t *testing.T) {
+	genieIDOnly := manifest.Resource{Type: "genie_space", ResourceKey: "genie-space", PluginName: "genie", Scope: "genie", Fields: map[string]manifest.ResourceField{"id": {}}}
+	warehouse := manifest.Resource{Type: "sql_warehouse", ResourceKey: "sql-warehouse", PluginName: "analytics", Scope: "sql", Fields: map[string]manifest.ResourceField{"id": {}}}
+	resources := []manifest.Resource{warehouse, genieIDOnly}
+	values := map[string]string{"sql-warehouse.id": "wh", "genie-space.id": "g123"}
+
+	tests := []struct {
+		name    string
+		modes   map[string]string
+		values  map[string]string
+		wantErr []string
+	}{
+		{
+			name:    "sp: undeclared binding field without a value",
+			values:  values,
+			wantErr: []string{"missing value for genie.genie-space.name (needed by the genie_space binding); use --set genie.genie-space.name=value"},
+		},
+		{
+			name:    "both: still bound",
+			modes:   map[string]string{genieIDOnly.AuthKey(): "both"},
+			values:  values,
+			wantErr: []string{"missing value for genie.genie-space.name (needed by the genie_space binding); use --set genie.genie-space.name=value"},
+		},
+		{
+			name:   "sp with the value set",
+			values: map[string]string{"sql-warehouse.id": "wh", "genie-space.id": "g123", "genie-space.name": "space"},
+		},
+		{
+			name:   "obo: no binding",
+			modes:  map[string]string{genieIDOnly.AuthKey(): "obo", warehouse.AuthKey(): "obo"},
+			values: values,
+		},
+		{
+			name:   "mixed: only the sp resource is checked",
+			modes:  map[string]string{genieIDOnly.AuthKey(): "obo"},
+			values: values,
+		},
+		{
+			name:   "resources without any value are left to validateRequiredResources",
+			values: map[string]string{},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var got []string
+			for _, mv := range findMissingBindingValues(resources, tt.values, tt.modes) {
+				got = append(got, mv.Error())
+			}
+			assert.Equal(t, tt.wantErr, got)
+		})
+	}
+}
+
+func TestParseSetValuesAcceptsBindingField(t *testing.T) {
+	m := &manifest.Manifest{Plugins: map[string]manifest.Plugin{
+		"genie": {Name: "genie", Resources: manifest.Resources{Required: []manifest.Resource{
+			{Type: "genie_space", ResourceKey: "genie-space", Fields: map[string]manifest.ResourceField{"id": {}}},
+		}}},
+	}}
+	rv, err := parseSetValues([]string{"genie.genie-space.id=g123", "genie.genie-space.name=space"}, m)
+	require.NoError(t, err)
+	assert.Equal(t, map[string]string{"genie-space.id": "g123", "genie-space.name": "space"}, rv)
+
+	_, err = parseSetValues([]string{"genie.genie-space.other=x"}, m)
+	assert.ErrorContains(t, err, `no resource with key "genie-space" and field "other"`)
+}
+
+func TestPackageManagerValidation(t *testing.T) {
+	tests := []struct {
+		name           string
+		packageManager string
+		shouldError    bool
+		errorMsg       string
+	}{
+		{"pnpm valid", "pnpm", false, ""},
+		{"npm valid", "npm", false, ""},
+		{"unknown invalid", "unknown", true, "unknown package manager"},
+		{"empty defaults to pnpm", "", false, ""},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Test the package manager resolver directly
+			_, err := pkgmanager.Resolve(tt.packageManager)
+			if tt.shouldError {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), tt.errorMsg)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
diff --git a/cmd/apps/logs.go b/cmd/apps/logs.go
index c6cab936521..777a9f3621b 100644
--- a/cmd/apps/logs.go
+++ b/cmd/apps/logs.go
@@ -46,7 +46,6 @@ func newLogsCommand() *cobra.Command {
 	)
 
 	cmd := &cobra.Command{
-		Use:   "logs [NAME]",
 		Short: "Show Databricks app logs",
 		Long: `Show Databricks app logs.
 
@@ -78,15 +77,6 @@ Examples:
 
   # Mirror streamed logs to a local file while following for up to 5 minutes
   databricks apps logs my-app --follow --timeout 5m --output-file /tmp/my-app.log`,
-		Args: func(cmd *cobra.Command, args []string) error {
-			if len(args) > 1 {
-				return fmt.Errorf("accepts at most 1 arg(s), received %d", len(args))
-			}
-			if !hasBundleConfig() && len(args) != 1 {
-				return fmt.Errorf("accepts 1 arg(s), received %d", len(args))
-			}
-			return nil
-		},
 		PreRunE: root.MustWorkspaceClient,
 		RunE: func(cmd *cobra.Command, args []string) error {
 			appName, fromBundle, err := getAppNameFromArgs(cmd, args)
@@ -207,6 +197,7 @@ Examples:
 			})
 		},
 	}
+	makeArgsOptionalWithBundle(cmd, "logs [NAME]")
 
 	streamGroup := cmdgroup.NewFlagGroup("Streaming")
 	streamGroup.FlagSet().IntVar(&tailLines, "tail-lines", defaultTailLines, "Number of recent log lines to show before streaming. Set to 0 to show everything.")
diff --git a/cmd/apps/logs_test.go b/cmd/apps/logs_test.go
index ca7ea5e7ef9..1060e201536 100644
--- a/cmd/apps/logs_test.go
+++ b/cmd/apps/logs_test.go
@@ -64,11 +64,22 @@ func TestBuildLogsURLRejectsUnknownScheme(t *testing.T) {
 	require.Error(t, err)
 }
 
+func TestLogsMissingNameError(t *testing.T) {
+	t.Chdir(t.TempDir())
+
+	cmd := newLogsCommand()
+	err := cmd.Args(cmd, nil)
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "missing required argument: NAME")
+	assert.Contains(t, err.Error(), "Usage: logs NAME")
+}
+
 func TestNormalizeOrigin(t *testing.T) {
 	assert.Equal(t, "https://example.com", normalizeOrigin("https://example.com/foo"))
 	assert.Equal(t, "http://example.com", normalizeOrigin("ws://example.com/foo"))
 	assert.Equal(t, "https://example.com", normalizeOrigin("wss://example.com/foo"))
-	assert.Equal(t, "", normalizeOrigin("://invalid"))
+	assert.Empty(t, normalizeOrigin("://invalid"))
 }
 
 func TestBuildSourceFilter(t *testing.T) {
diff --git a/cmd/apps/manifest.go b/cmd/apps/manifest.go
index 38df201acc0..0191700fbc7 100644
--- a/cmd/apps/manifest.go
+++ b/cmd/apps/manifest.go
@@ -9,7 +9,9 @@ import (
 	"path/filepath"
 
 	"github.com/databricks/cli/libs/apps/manifest"
+	"github.com/databricks/cli/libs/clicompat"
 	"github.com/databricks/cli/libs/env"
+	"github.com/databricks/cli/libs/log"
 	"github.com/spf13/cobra"
 )
 
@@ -27,7 +29,11 @@ func runManifestOnly(ctx context.Context, templatePath, branch, version string)
 		case version != "":
 			gitRef = normalizeVersion(version)
 		default:
-			gitRef = appkitDefaultVersion
+			appkitVersion, err := clicompat.ResolveAppKitVersion(ctx)
+			if err != nil {
+				return fmt.Errorf("could not resolve AppKit template version: %w; use --version to specify a version manually", err)
+			}
+			gitRef = normalizeVersion(appkitVersion)
 		}
 		templateSrc = appkitRepoURL
 	}
@@ -39,6 +45,17 @@ func runManifestOnly(ctx context.Context, templatePath, branch, version string)
 		subdirForClone = appkitTemplateDir
 	}
 	resolvedPath, cleanup, err := resolveTemplate(ctx, templateSrc, branchForClone, subdirForClone)
+	versionAutoResolved := version == "" && branch == ""
+	if err != nil && usingDefaultTemplate && versionAutoResolved && clicompat.IsNotFoundError(err) {
+		fallbackVersion, fbErr := clicompat.ResolveEmbeddedAppKitVersion()
+		if fbErr == nil && fallbackVersion != "" && normalizeVersion(fallbackVersion) != gitRef {
+			log.Warnf(ctx, "Template version not found, falling back to embedded version %s", fallbackVersion)
+			fallbackRef := normalizeVersion(fallbackVersion)
+			resolvedPath, cleanup, err = resolveTemplate(ctx, templateSrc, fallbackRef, appkitTemplateDir)
+		} else if fbErr != nil {
+			log.Warnf(ctx, "Could not resolve embedded AppKit version: %v", fbErr)
+		}
+	}
 	if err != nil {
 		return err
 	}
@@ -79,9 +96,8 @@ func newManifestCmd() *cobra.Command {
 	)
 
 	cmd := &cobra.Command{
-		Use:    "manifest",
-		Short:  "Print template manifest with available plugins and required resources",
-		Hidden: true,
+		Use:   "manifest",
+		Short: "Print template manifest with available plugins and required resources",
 		Long: `Resolves a template (default AppKit repo or --template URL), locates appkit.plugins.json,
 and prints its raw contents to stdout. No workspace authentication is required.
 
diff --git a/cmd/apps/run_local.go b/cmd/apps/run_local.go
index d4bc546ab7c..d9671276f0f 100644
--- a/cmd/apps/run_local.go
+++ b/cmd/apps/run_local.go
@@ -18,6 +18,7 @@ import (
 	"github.com/databricks/cli/libs/cmdctx"
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/service/iam"
 	"github.com/spf13/cobra"
 )
 
@@ -28,7 +29,7 @@ const SHUTDOWN_TIMEOUT = 15 * time.Second
 func setupWorkspaceAndConfig(cmd *cobra.Command, entryPoint string, appPort int) (*runlocal.Config, *runlocal.AppSpec, error) {
 	ctx := cmd.Context()
 	w := cmdctx.WorkspaceClient(ctx)
-	workspaceID, err := w.CurrentWorkspaceID(ctx)
+	workspaceID, err := auth.ResolveWorkspaceID(ctx, w)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -116,7 +117,7 @@ func setupProxy(ctx context.Context, cmd *cobra.Command, config *runlocal.Config
 		return err
 	}
 
-	me, err := w.CurrentUser.Me(ctx)
+	me, err := w.CurrentUser.Me(ctx, iam.MeRequest{})
 	if err != nil {
 		return err
 	}
@@ -126,9 +127,15 @@ func setupProxy(ctx context.Context, cmd *cobra.Command, config *runlocal.Config
 	}
 
 	proxyAddr := fmt.Sprintf("localhost:%d", port)
+	// Bind synchronously so a taken port fails the command instead of only printing an error from the goroutine.
+	ln, err := proxy.Listen(proxyAddr)
+	if err != nil {
+		return fmt.Errorf("failed to start app proxy: %w", err)
+	}
+
+	cmdio.LogString(ctx, "To access your app go to http://"+proxyAddr)
 	go func() {
-		cmdio.LogString(ctx, "To access your app go to http://"+proxyAddr)
-		err := proxy.ListenAndServe(proxyAddr)
+		err := proxy.Serve(ln)
 		if err != nil {
 			cmd.PrintErrln(err)
 		}
@@ -141,6 +148,12 @@ func setupProxy(ctx context.Context, cmd *cobra.Command, config *runlocal.Config
 	return nil
 }
 
+func killAppProcess(appCmd *exec.Cmd) {
+	_ = appCmd.Process.Kill()
+	// Reap the process so it doesn't linger as a zombie until the CLI exits.
+	_ = appCmd.Wait()
+}
+
 // SIGTERM (not supported on Windows) and SIGINT (Ctrl+C, supported cross-platform)
 // are caught to enable graceful shutdown of the app process.
 func handleGracefulShutdown(appCmd *exec.Cmd) error {
@@ -225,6 +238,7 @@ func newRunLocal() *cobra.Command {
 
 		err = setupProxy(ctx, cmd, config, w, port, debug)
 		if err != nil {
+			killAppProcess(appCmd)
 			return err
 		}
 
diff --git a/cmd/apps/run_local_test.go b/cmd/apps/run_local_test.go
new file mode 100644
index 00000000000..94a0b56ec70
--- /dev/null
+++ b/cmd/apps/run_local_test.go
@@ -0,0 +1,51 @@
+package apps
+
+import (
+	"net"
+	"os"
+	"os/exec"
+	"testing"
+	"time"
+
+	"github.com/databricks/cli/libs/apps/runlocal"
+	"github.com/databricks/databricks-sdk-go/experimental/mocks"
+	"github.com/databricks/databricks-sdk-go/service/iam"
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSetupProxyPortInUse(t *testing.T) {
+	ln, err := net.Listen("tcp", "localhost:0")
+	require.NoError(t, err)
+	defer ln.Close()
+	port := ln.Addr().(*net.TCPAddr).Port
+
+	m := mocks.NewMockWorkspaceClient(t)
+	m.GetMockCurrentUserAPI().EXPECT().Me(mock.Anything, mock.Anything).Return(&iam.User{UserName: "test-user"}, nil)
+
+	config := runlocal.NewConfig("https://workspace.databricks.test", "123", t.TempDir(), runlocal.DEFAULT_HOST, runlocal.DEFAULT_PORT)
+	err = setupProxy(t.Context(), &cobra.Command{}, config, m.WorkspaceClient, port, false)
+	require.ErrorContains(t, err, "failed to start app proxy")
+}
+
+// TestAppHelperProcess is not a real test: TestKillAppProcess re-invokes the
+// test binary with -test.run targeting it to get a long-running child process.
+func TestAppHelperProcess(t *testing.T) {
+	if os.Getenv("APPS_TEST_HELPER_PROCESS") != "1" {
+		t.Skip("helper process for TestKillAppProcess")
+	}
+	time.Sleep(time.Minute)
+}
+
+func TestKillAppProcess(t *testing.T) {
+	appCmd := exec.Command(os.Args[0], "-test.run=^TestAppHelperProcess$")
+	appCmd.Env = append(os.Environ(), "APPS_TEST_HELPER_PROCESS=1")
+	require.NoError(t, appCmd.Start())
+
+	killAppProcess(appCmd)
+
+	// A non-nil ProcessState proves the process was reaped; a non-success exit proves it was killed.
+	require.NotNil(t, appCmd.ProcessState)
+	require.False(t, appCmd.ProcessState.Success())
+}
diff --git a/cmd/apps/validate.go b/cmd/apps/validate.go
index f6490d03acf..2bcef5237e0 100644
--- a/cmd/apps/validate.go
+++ b/cmd/apps/validate.go
@@ -12,13 +12,32 @@ import (
 
 func newValidateCmd() *cobra.Command {
 	cmd := &cobra.Command{
-		Use:    "validate",
-		Short:  "Validate a Databricks App project",
-		Hidden: true,
+		Use:   "validate",
+		Short: "Validate a Databricks App project",
 		Long: `Validate a Databricks App project by running build, typecheck, and lint checks.
 
 This command detects the project type and runs the appropriate validation:
-- Node.js projects (package.json): runs npm install, build, typecheck, lint, and tests
+- Node.js projects (package.json): installs dependencies and runs typegen,
+  lint:ast-grep, typecheck, build, and test scripts when present
+
+An npm or pnpm packageManager declaration in package.json takes precedence over
+lockfiles in the project directory. Conflicting lockfiles produce a warning.
+Without a supported declaration, the package manager is detected from lockfiles:
+- package-lock.json or npm-shrinkwrap.json: npm
+- pnpm-lock.yaml: pnpm
+
+Only npm and pnpm are supported. Unsupported packageManager declarations and
+Yarn/Bun lockfiles produce a warning and are ignored. Without a supported
+declaration, projects with both npm and pnpm lockfiles warn and use npm;
+projects without a supported lockfile also use npm.
+The selected package manager must be on PATH in the project directory.
+Dependencies are installed when node_modules is absent.
+
+Scripts use the package manager's normal workspace behavior. For pnpm workspaces,
+define root scripts that run the checks for the packages you want to validate.
+
+For AppKit projects (appkit.plugins.json), it first checks that resources accessed on
+behalf of the user are not app-only and that their scopes are in user_api_scopes.
 
 Examples:
   # Validate the current directory
@@ -59,6 +78,10 @@ func runValidate(cmd *cobra.Command) error {
 		SkipTests: skipTests,
 	}
 
+	if err := validation.ValidateAuthModes(projectPath); err != nil {
+		return err
+	}
+
 	// Get validator for project type
 	validator := validation.GetProjectValidator(projectPath)
 	if validator == nil {
diff --git a/cmd/auth/auth.go b/cmd/auth/auth.go
index 28aa1269df4..6bbee3730b3 100644
--- a/cmd/auth/auth.go
+++ b/cmd/auth/auth.go
@@ -35,6 +35,7 @@ GCP: https://docs.gcp.databricks.com/dev-tools/auth/index.html`,
 	cmd.AddCommand(newLogoutCommand())
 	cmd.AddCommand(newProfilesCommand())
 	cmd.AddCommand(newTokenCommand(&authArguments))
+	cmd.AddCommand(newDockerCommand())
 	cmd.AddCommand(newDescribeCommand())
 	cmd.AddCommand(newSwitchCommand())
 	return cmd
@@ -45,8 +46,13 @@ func promptForHost(ctx context.Context) (string, error) {
 		return "", errors.New("the command is being run in a non-interactive environment, please specify a host using --host")
 	}
 
+	// The hint is printed separately so the prompt label stays short.
+	// promptui's screenbuf does not account for terminal line wrapping, and a
+	// long "label + value" line that wraps causes each keystroke to leave a
+	// stale render on screen instead of overwriting the previous one.
+	cmdio.LogString(ctx, "Example: https://<databricks-instance>.cloud.databricks.com")
 	return cmdio.RunPrompt(ctx, cmdio.PromptOptions{
-		Label: "Databricks host (e.g. https://<databricks-instance>.cloud.databricks.com)",
+		Label: "Databricks host",
 	})
 }
 
diff --git a/cmd/auth/auth_test.go b/cmd/auth/auth_test.go
index fc7e5d533d4..9dbf04fc664 100644
--- a/cmd/auth/auth_test.go
+++ b/cmd/auth/auth_test.go
@@ -1,6 +1,8 @@
 package auth
 
 import (
+	"os"
+	"path/filepath"
 	"testing"
 
 	"github.com/databricks/cli/cmd/root"
@@ -113,7 +115,14 @@ func TestProfileHostConflictTokenViaCobra(t *testing.T) {
 // pass the conflict check (the command will fail later for other reasons, but
 // NOT with a conflict error).
 func TestProfileHostCompatibleViaCobra(t *testing.T) {
-	t.Setenv("DATABRICKS_CONFIG_FILE", "./testdata/.databrickscfg")
+	// Copy the fixture into a temp directory so the auth login flow's writes
+	// (e.g. silent plaintext-fallback persistence on CI runners without a
+	// usable keyring) cannot dirty the checked-in fixture.
+	configPath := filepath.Join(t.TempDir(), ".databrickscfg")
+	fixture, err := os.ReadFile("./testdata/.databrickscfg")
+	require.NoError(t, err)
+	require.NoError(t, os.WriteFile(configPath, fixture, 0o600))
+	t.Setenv("DATABRICKS_CONFIG_FILE", configPath)
 
 	ctx := cmdctx.GenerateExecId(t.Context())
 	cli := root.New(ctx)
@@ -125,7 +134,7 @@ func TestProfileHostCompatibleViaCobra(t *testing.T) {
 		"--host", "https://www.host1.test",
 	})
 
-	_, err := cli.ExecuteContextC(ctx)
+	_, err = cli.ExecuteContextC(ctx)
 	// The command may fail for other reasons (no browser, non-interactive, etc.)
 	// but it should NOT fail with a conflict error.
 	if err != nil {
diff --git a/cmd/auth/describe.go b/cmd/auth/describe.go
index 9199aac9e6e..a58e964de27 100644
--- a/cmd/auth/describe.go
+++ b/cmd/auth/describe.go
@@ -4,12 +4,19 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"path/filepath"
 
 	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/auth/storage"
 	"github.com/databricks/cli/libs/cmdctx"
 	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/databrickscfg/profile"
+	"github.com/databricks/cli/libs/env"
 	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/config"
+	"github.com/databricks/databricks-sdk-go/service/iam"
 	"github.com/spf13/cobra"
 )
 
@@ -21,10 +28,16 @@ var authTemplate = `{{"Host:" | bold}} {{.Status.Details.Host}}
 {{"User:" | bold}} {{.Status.Username}}
 {{- end}}
 {{"Authenticated with:" | bold}} {{.Status.Details.AuthType}}
+{{- if .Status.TokenStorage}}
+{{"Token storage:" | bold}} {{.Status.TokenStorage.Mode}}, {{.Status.TokenStorage.Location}} {{ printf "(from %s)" .Status.TokenStorage.Source | italic}}
+{{- end}}
 -----
 ` + configurationTemplate
 
 var errorTemplate = `Unable to authenticate: {{.Status.Error}}
+{{- if .Status.TokenStorage}}
+{{"Token storage:" | bold}} {{.Status.TokenStorage.Mode}}, {{.Status.TokenStorage.Location}} {{ printf "(from %s)" .Status.TokenStorage.Source | italic}}
+{{- end}}
 -----
 ` + configurationTemplate
 
@@ -54,6 +67,9 @@ func newDescribeCommand() *cobra.Command {
 
 	cmd.RunE = func(cmd *cobra.Command, args []string) error {
 		ctx := cmd.Context()
+		if err := resolveProfileFromHostFlag(cmd, profile.DefaultProfiler); err != nil {
+			return err
+		}
 		var status *authStatus
 		var err error
 		status, err = getAuthStatus(cmd, args, showSensitive, func(cmd *cobra.Command, args []string) (*config.Config, bool, error) {
@@ -74,17 +90,40 @@ func newDescribeCommand() *cobra.Command {
 	return cmd
 }
 
+// resolveProfileFromHostFlag translates an explicit --host into a --profile
+// for `auth describe`. Without this, the downstream profile resolver ignores
+// --host and either falls back to [__settings__].default_profile (silently
+// describing a different host than the one the user named) or errors with the
+// SDK's default-credentials message even though a host-matching profile
+// exists. DATABRICKS_CONFIG_PROFILE is left alone — it's an explicit signal
+// the user already made.
+func resolveProfileFromHostFlag(cmd *cobra.Command, profiler profile.Profiler) error {
+	hostFlag := cmd.Flag("host")
+	profileFlag := cmd.Flag("profile")
+	if hostFlag == nil || profileFlag == nil {
+		return nil
+	}
+	if !hostFlag.Changed || profileFlag.Changed {
+		return nil
+	}
+	ctx := cmd.Context()
+	if env.Get(ctx, "DATABRICKS_CONFIG_PROFILE") != "" {
+		return nil
+	}
+	profileName, err := resolveHostToProfile(ctx, hostFlag.Value.String(), profiler)
+	if err != nil {
+		return err
+	}
+	return profileFlag.Value.Set(profileName)
+}
+
 type tryAuth func(cmd *cobra.Command, args []string) (*config.Config, bool, error)
 
 func getAuthStatus(cmd *cobra.Command, args []string, showSensitive bool, fn tryAuth) (*authStatus, error) {
 	cfg, isAccount, err := fn(cmd, args)
 	ctx := cmd.Context()
 	if err != nil {
-		return &authStatus{ //nolint:nilerr // error is returned in the authStatus struct
-			Status:  "error",
-			Error:   err,
-			Details: getAuthDetails(cmd, cfg, showSensitive),
-		}, nil
+		return errorAuthStatus(ctx, cmd, cfg, showSensitive, err), nil //nolint:nilerr // error is returned in the authStatus struct
 	}
 
 	if isAccount {
@@ -92,41 +131,88 @@ func getAuthStatus(cmd *cobra.Command, args []string, showSensitive bool, fn try
 
 		// Doing a simple API call to check if the auth is valid
 		_, err := a.Workspaces.List(ctx)
-		if err != nil {
-			return &authStatus{ //nolint:nilerr // error is returned in the authStatus struct
-				Status:  "error",
-				Error:   err,
-				Details: getAuthDetails(cmd, cfg, showSensitive),
-			}, nil
+		if err == nil {
+			return successAuthStatus(ctx, cmd, a.Config, showSensitive, a.Config.Username, a.Config.AccountID), nil
 		}
 
-		status := authStatus{
-			Status:    "success",
-			Details:   getAuthDetails(cmd, a.Config, showSensitive),
-			AccountID: a.Config.AccountID,
-			Username:  a.Config.Username,
+		// Workspaces.List can fail for reasons other than bad credentials
+		// (e.g. it requires account admin), so verify against the workspace
+		// endpoint with the same resolved config before reporting failure.
+		me, meErr := verifyWorkspaceAuth(ctx, a.Config)
+		if meErr == nil {
+			return successAuthStatus(ctx, cmd, a.Config, showSensitive, me.UserName, ""), nil
 		}
-
-		return &status, nil
+		return errorAuthStatus(ctx, cmd, cfg, showSensitive, err), nil
 	}
 
 	w := cmdctx.WorkspaceClient(ctx)
-	me, err := w.CurrentUser.Me(ctx)
+	me, err := w.CurrentUser.Me(ctx, iam.MeRequest{})
+	if err == nil {
+		return successAuthStatus(ctx, cmd, w.Config, showSensitive, me.UserName, ""), nil
+	}
+
+	// Account console profiles that also carry a workspace_id resolve to a
+	// workspace client even though the host only serves account APIs, so the
+	// call above fails despite valid credentials (see
+	// https://github.com/databricks/cli/issues/5479). Verify against the
+	// account endpoint before reporting failure. Account clients require an
+	// account ID, so skip the second check when none is configured.
+	if w.Config.AccountID != "" {
+		if listErr := verifyAccountAuth(ctx, w.Config); listErr == nil {
+			return successAuthStatus(ctx, cmd, w.Config, showSensitive, w.Config.Username, w.Config.AccountID), nil
+		}
+	}
+	return errorAuthStatus(ctx, cmd, cfg, showSensitive, err), nil
+}
+
+// verifyWorkspaceAuth checks whether cfg's credentials are accepted by the
+// workspace endpoint. The client is built over the same resolved config
+// pointer (config.Config must not be copied by value), without any profile
+// prompting.
+func verifyWorkspaceAuth(ctx context.Context, cfg *config.Config) (*iam.User, error) {
+	w, err := databricks.NewWorkspaceClient((*databricks.Config)(cfg))
+	if err != nil {
+		return nil, err
+	}
+	return w.CurrentUser.Me(ctx, iam.MeRequest{})
+}
+
+// verifyAccountAuth checks whether cfg's credentials are accepted by the
+// account endpoint. cfg.AccountID must be non-empty. The client is built over
+// the same resolved config pointer (config.Config must not be copied by
+// value), without any profile prompting.
+func verifyAccountAuth(ctx context.Context, cfg *config.Config) error {
+	a, err := databricks.NewAccountClient((*databricks.Config)(cfg))
 	if err != nil {
-		return &authStatus{ //nolint:nilerr // error is returned in the authStatus struct
-			Status:  "error",
-			Error:   err,
-			Details: getAuthDetails(cmd, cfg, showSensitive),
-		}, nil
+		return err
 	}
+	_, err = a.Workspaces.List(ctx)
+	return err
+}
 
-	status := authStatus{
-		Status:   "success",
-		Details:  getAuthDetails(cmd, w.Config, showSensitive),
-		Username: me.UserName,
+// successAuthStatus reports verified credentials, with details derived from cfg.
+func successAuthStatus(ctx context.Context, cmd *cobra.Command, cfg *config.Config, showSensitive bool, username, accountID string) *authStatus {
+	details := getAuthDetails(cmd, cfg, showSensitive)
+	return &authStatus{
+		Status:       "success",
+		Details:      details,
+		Username:     username,
+		AccountID:    accountID,
+		TokenStorage: resolveTokenStorageInfo(ctx, details.AuthType),
 	}
+}
 
-	return &status, nil
+// errorAuthStatus reports a failed credential check. The error is carried in
+// the status rather than returned so describe still renders the resolved
+// configuration alongside the failure.
+func errorAuthStatus(ctx context.Context, cmd *cobra.Command, cfg *config.Config, showSensitive bool, err error) *authStatus {
+	details := getAuthDetails(cmd, cfg, showSensitive)
+	return &authStatus{
+		Status:       "error",
+		Error:        err,
+		Details:      details,
+		TokenStorage: resolveTokenStorageInfo(ctx, details.AuthType),
+	}
 }
 
 func render(ctx context.Context, cmd *cobra.Command, status *authStatus, template string) error {
@@ -153,11 +239,85 @@ func render(ctx context.Context, cmd *cobra.Command, status *authStatus, templat
 }
 
 type authStatus struct {
-	Status    string             `json:"status"`
-	Error     error              `json:"error,omitempty"`
-	Username  string             `json:"username,omitempty"`
-	AccountID string             `json:"account_id,omitempty"`
-	Details   config.AuthDetails `json:"details"`
+	Status       string             `json:"status"`
+	Error        error              `json:"error,omitempty"`
+	Username     string             `json:"username,omitempty"`
+	AccountID    string             `json:"account_id,omitempty"`
+	Details      config.AuthDetails `json:"details"`
+	TokenStorage *tokenStorageInfo  `json:"token_storage,omitempty"`
+}
+
+// tokenStorageInfo describes where the U2M (databricks-cli) token cache lives
+// and which precedence level produced that choice. Populated only when the
+// active auth type is "databricks-cli"; other auth types do not use the
+// CLI's U2M token cache and the field is omitted.
+type tokenStorageInfo struct {
+	Mode     string `json:"mode"`
+	Location string `json:"location"`
+	Source   string `json:"source"`
+}
+
+const (
+	plaintextLocation = "~/.databricks/token-cache.json"
+	secureLocation    = "OS keyring (service: databricks-cli)"
+)
+
+// resolveTokenStorageInfo returns storage info for the U2M token cache, or
+// nil if the active auth type does not use the cache. Resolver errors are
+// logged at debug level and treated as "no info available" rather than
+// failing describe; the user-visible auth status is more important than
+// secondary metadata about where a token would have been stored.
+func resolveTokenStorageInfo(ctx context.Context, authType string) *tokenStorageInfo {
+	if authType != authTypeDatabricksCLI {
+		return nil
+	}
+	mode, source, err := storage.ResolveStorageModeWithSource(ctx, "")
+	if err != nil {
+		log.Debugf(ctx, "auth describe: resolve storage mode: %v", err)
+		return nil
+	}
+	info := &tokenStorageInfo{
+		Mode:   string(mode),
+		Source: storageSourceLabel(ctx, source),
+	}
+	switch mode {
+	case storage.StorageModePlaintext:
+		info.Location = plaintextLocation
+	case storage.StorageModeSecure:
+		info.Location = secureLocation
+	default:
+		return nil
+	}
+	return info
+}
+
+// storageSourceLabel returns a user-facing label for source. For
+// StorageSourceConfig, it appends the resolved config file path
+// (DATABRICKS_CONFIG_FILE or <home>/.databrickscfg) so the output matches
+// the SDK's config.Source style ("from <path> config file") rather than
+// hardcoding ".databrickscfg" when a custom path is in use.
+func storageSourceLabel(ctx context.Context, source storage.StorageSource) string {
+	if source != storage.StorageSourceConfig {
+		return source.String()
+	}
+	return "auth_storage in [__settings__] section of " + resolvedConfigPath(ctx)
+}
+
+// resolvedConfigPath returns the path the storage-mode resolver loaded from
+// for [__settings__].auth_storage: DATABRICKS_CONFIG_FILE if set, otherwise
+// <home>/.databrickscfg. Falls back to "~/.databrickscfg" only when the home
+// directory cannot be determined (rare; describe should not crash on this
+// secondary metadata path).
+func resolvedConfigPath(ctx context.Context) string {
+	if path := env.Get(ctx, "DATABRICKS_CONFIG_FILE"); path != "" {
+		return path
+	}
+	home, err := env.UserHomeDir(ctx)
+	if err != nil {
+		log.Debugf(ctx, "auth describe: resolve home dir: %v", err)
+		return "~/.databrickscfg"
+	}
+	return filepath.ToSlash(filepath.Join(home, ".databrickscfg"))
 }
 
 func getAuthDetails(cmd *cobra.Command, cfg *config.Config, showSensitive bool) config.AuthDetails {
@@ -167,9 +327,21 @@ func getAuthDetails(cmd *cobra.Command, cfg *config.Config, showSensitive bool)
 	}
 	details := cfg.GetAuthDetails(opts...)
 
+	ctx := cmd.Context()
 	for k, v := range details.Configuration {
-		if k == "profile" && cmd.Flag("profile").Changed {
-			v.Source = config.Source{Type: config.SourceType("flag"), Name: "--profile"}
+		if k == "profile" {
+			// Profile-source precedence mirrors cmd/root/bundle.go:getProfile:
+			// an explicit --profile flag wins, then DATABRICKS_CONFIG_PROFILE.
+			// Inside a bundle root the resolved config labels every attribute
+			// "bundle" (bundle/config/workspace.go), which misattributes a
+			// profile that actually came from the environment (#2303). The
+			// value guard relabels only when the env var is the profile that
+			// won, so a profile set in databricks.yml still reads "bundle".
+			if cmd.Flag("profile").Changed {
+				v.Source = config.Source{Type: config.SourceType("flag"), Name: "--profile"}
+			} else if envProfile := env.Get(ctx, "DATABRICKS_CONFIG_PROFILE"); envProfile != "" && envProfile == v.Value {
+				v.Source = config.Source{Type: config.SourceEnv, Name: "DATABRICKS_CONFIG_PROFILE"}
+			}
 		}
 
 		if k == "host" && cmd.Flag("host").Changed {
diff --git a/cmd/auth/describe_test.go b/cmd/auth/describe_test.go
index ef654aae3d2..3d7bd62a0a1 100644
--- a/cmd/auth/describe_test.go
+++ b/cmd/auth/describe_test.go
@@ -1,18 +1,88 @@
 package auth
 
 import (
+	"encoding/json"
 	"errors"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
 	"testing"
 
+	"github.com/databricks/cli/libs/auth/storage"
 	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/databrickscfg/profile"
+	"github.com/databricks/databricks-sdk-go/apierr"
 	"github.com/databricks/databricks-sdk-go/config"
 	"github.com/databricks/databricks-sdk-go/experimental/mocks"
 	"github.com/databricks/databricks-sdk-go/service/iam"
 	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
 )
 
+func newHostProfileCmd(t *testing.T) *cobra.Command {
+	t.Helper()
+	cmd := &cobra.Command{}
+	cmd.Flags().String("host", "", "")
+	cmd.Flags().String("profile", "", "")
+	cmd.SetContext(t.Context())
+	return cmd
+}
+
+func TestResolveProfileFromHostFlag(t *testing.T) {
+	cfgPath := filepath.Join(t.TempDir(), ".databrickscfg")
+	require.NoError(t, os.WriteFile(cfgPath, []byte(""), 0o600))
+	t.Setenv("DATABRICKS_CONFIG_FILE", cfgPath)
+
+	profiler := profile.InMemoryProfiler{
+		Profiles: profile.Profiles{
+			{Name: "dev", Host: "https://dev.cloud.databricks.com", AuthType: "databricks-cli"},
+		},
+	}
+
+	t.Run("no flags set is a no-op", func(t *testing.T) {
+		cmd := newHostProfileCmd(t)
+		require.NoError(t, resolveProfileFromHostFlag(cmd, profiler))
+		assert.Empty(t, cmd.Flag("profile").Value.String())
+	})
+
+	t.Run("--profile already set wins; --host is ignored", func(t *testing.T) {
+		cmd := newHostProfileCmd(t)
+		require.NoError(t, cmd.Flags().Set("host", "https://dev.cloud.databricks.com"))
+		require.NoError(t, cmd.Flags().Set("profile", "explicit"))
+		require.NoError(t, resolveProfileFromHostFlag(cmd, profiler))
+		assert.Equal(t, "explicit", cmd.Flag("profile").Value.String())
+	})
+
+	t.Run("--host with a single match wires --profile", func(t *testing.T) {
+		cmd := newHostProfileCmd(t)
+		require.NoError(t, cmd.Flags().Set("host", "https://dev.cloud.databricks.com"))
+		require.NoError(t, resolveProfileFromHostFlag(cmd, profiler))
+		assert.Equal(t, "dev", cmd.Flag("profile").Value.String())
+	})
+
+	t.Run("--host with no match surfaces a clear error", func(t *testing.T) {
+		cmd := newHostProfileCmd(t)
+		require.NoError(t, cmd.Flags().Set("host", "https://nope.cloud.databricks.com"))
+		err := resolveProfileFromHostFlag(cmd, profiler)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "no profile found matching host")
+		assert.Empty(t, cmd.Flag("profile").Value.String())
+	})
+
+	t.Run("DATABRICKS_CONFIG_PROFILE is left alone", func(t *testing.T) {
+		t.Setenv("DATABRICKS_CONFIG_PROFILE", "from-env")
+		cmd := newHostProfileCmd(t)
+		require.NoError(t, cmd.Flags().Set("host", "https://dev.cloud.databricks.com"))
+		require.NoError(t, resolveProfileFromHostFlag(cmd, profiler))
+		// We don't overwrite --profile when the user signalled an explicit
+		// choice via the env var.
+		assert.Empty(t, cmd.Flag("profile").Value.String())
+	})
+}
+
 func TestGetWorkspaceAuthStatus(t *testing.T) {
 	ctx := t.Context()
 	m := mocks.NewMockWorkspaceClient(t)
@@ -24,7 +94,7 @@ func TestGetWorkspaceAuthStatus(t *testing.T) {
 	showSensitive := false
 
 	currentUserApi := m.GetMockCurrentUserAPI()
-	currentUserApi.EXPECT().Me(mock.Anything).Return(&iam.User{
+	currentUserApi.EXPECT().Me(mock.Anything, mock.Anything).Return(&iam.User{
 		UserName: "test-user",
 	}, nil)
 
@@ -223,3 +293,301 @@ func TestGetAccountAuthStatus(t *testing.T) {
 	require.Equal(t, "--profile flag", status.Details.Configuration["profile"].Source.String())
 	require.False(t, status.Details.Configuration["profile"].AuthTypeMismatch)
 }
+
+func TestResolveTokenStorageInfo(t *testing.T) {
+	cases := []struct {
+		name     string
+		authType string
+		envValue string
+		want     *tokenStorageInfo
+	}{
+		{
+			name:     "non-databricks-cli auth has no token storage",
+			authType: "pat",
+			want:     nil,
+		},
+		{
+			name:     "databricks-cli with default secure",
+			authType: authTypeDatabricksCLI,
+			want: &tokenStorageInfo{
+				Mode:     "secure",
+				Location: secureLocation,
+				Source:   "default",
+			},
+		},
+		{
+			name:     "databricks-cli with plaintext from env",
+			authType: authTypeDatabricksCLI,
+			envValue: "plaintext",
+			want: &tokenStorageInfo{
+				Mode:     "plaintext",
+				Location: plaintextLocation,
+				Source:   "DATABRICKS_AUTH_STORAGE environment variable",
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Setenv(storage.EnvVar, tc.envValue)
+			t.Setenv("DATABRICKS_CONFIG_FILE", t.TempDir()+"/.databrickscfg")
+
+			got := resolveTokenStorageInfo(t.Context(), tc.authType)
+			assert.Equal(t, tc.want, got)
+		})
+	}
+}
+
+func TestStorageSourceLabel_ConfigUsesResolvedPath(t *testing.T) {
+	ctx := t.Context()
+	t.Setenv("DATABRICKS_CONFIG_FILE", "/custom/path/.databrickscfg")
+	got := storageSourceLabel(ctx, storage.StorageSourceConfig)
+	assert.Equal(t, "auth_storage in [__settings__] section of /custom/path/.databrickscfg", got)
+}
+
+func TestStorageSourceLabel_ConfigDefaultsToHome(t *testing.T) {
+	ctx := t.Context()
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
+	t.Setenv("DATABRICKS_CONFIG_FILE", "")
+	got := storageSourceLabel(ctx, storage.StorageSourceConfig)
+	expected := "auth_storage in [__settings__] section of " + filepath.ToSlash(filepath.Join(home, ".databrickscfg"))
+	assert.Equal(t, expected, got)
+}
+
+func TestStorageSourceLabel_NonConfigDelegatesToSource(t *testing.T) {
+	ctx := t.Context()
+	t.Setenv("DATABRICKS_CONFIG_FILE", "/should/not/appear")
+	assert.Equal(t, "default", storageSourceLabel(ctx, storage.StorageSourceDefault))
+	assert.Equal(t, "DATABRICKS_AUTH_STORAGE environment variable", storageSourceLabel(ctx, storage.StorageSourceEnvVar))
+	assert.Equal(t, "command-line override", storageSourceLabel(ctx, storage.StorageSourceOverride))
+}
+
+func TestGetWorkspaceAuthStatus_U2M_PopulatesTokenStorage(t *testing.T) {
+	ctx := t.Context()
+	m := mocks.NewMockWorkspaceClient(t)
+	ctx = cmdctx.SetWorkspaceClient(ctx, m.WorkspaceClient)
+
+	cmd := &cobra.Command{}
+	cmd.SetContext(ctx)
+
+	currentUserApi := m.GetMockCurrentUserAPI()
+	currentUserApi.EXPECT().Me(mock.Anything, mock.Anything).Return(&iam.User{UserName: "u2m-user"}, nil)
+
+	cmd.Flags().String("host", "", "")
+	cmd.Flags().String("profile", "", "")
+	require.NoError(t, cmd.Flag("profile").Value.Set("u2m-profile"))
+	cmd.Flag("profile").Changed = true
+
+	cfg := &config.Config{Profile: "u2m-profile"}
+	m.WorkspaceClient.Config = cfg
+	t.Setenv(storage.EnvVar, "secure")
+	t.Setenv("DATABRICKS_CONFIG_FILE", t.TempDir()+"/.databrickscfg")
+	require.NoError(t, config.ConfigAttributes.Configure(cfg))
+
+	status, err := getAuthStatus(cmd, []string{}, false, func(cmd *cobra.Command, args []string) (*config.Config, bool, error) {
+		require.NoError(t, config.ConfigAttributes.ResolveFromStringMap(cfg, map[string]string{
+			"host":      "https://test.test",
+			"auth_type": authTypeDatabricksCLI,
+		}))
+		return cfg, false, nil
+	})
+	require.NoError(t, err)
+	require.NotNil(t, status)
+	require.NotNil(t, status.TokenStorage)
+	assert.Equal(t, "secure", status.TokenStorage.Mode)
+	assert.Equal(t, secureLocation, status.TokenStorage.Location)
+	assert.Equal(t, "DATABRICKS_AUTH_STORAGE environment variable", status.TokenStorage.Source)
+}
+
+// describeVerifyServer simulates the host that describe's secondary
+// verification calls hit: CurrentUser.Me and account Workspaces.List.
+// Statuses other than 200 return an error body with that status code; a zero
+// status marks an endpoint that must not be called at all.
+func describeVerifyServer(t *testing.T, accountID string, meStatus, listStatus int) *httptest.Server {
+	t.Helper()
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		respond := func(status int, okBody any) {
+			if status == 0 {
+				t.Errorf("unexpected request to %s", r.URL.Path)
+				status = http.StatusNotFound
+			}
+			w.Header().Set("Content-Type", "application/json")
+			if status != http.StatusOK {
+				w.WriteHeader(status)
+				okBody = map[string]any{"error_code": "TEST_ERROR", "message": "secondary check failed"}
+			}
+			require.NoError(t, json.NewEncoder(w).Encode(okBody))
+		}
+		switch r.URL.Path {
+		case "/api/2.0/preview/scim/v2/Me":
+			respond(meStatus, map[string]any{"userName": "fallback-user"})
+		case "/api/2.0/accounts/" + accountID + "/workspaces":
+			respond(listStatus, []map[string]any{})
+		default:
+			w.WriteHeader(http.StatusNotFound)
+		}
+	}))
+	t.Cleanup(server.Close)
+	return server
+}
+
+// newDescribeWorkspaceCmd wires a mocked workspace client whose Me call fails
+// with meErr, with cfg as its resolved configuration.
+func newDescribeWorkspaceCmd(t *testing.T, cfg *config.Config, meErr error) *cobra.Command {
+	t.Helper()
+	m := mocks.NewMockWorkspaceClient(t)
+	m.WorkspaceClient.Config = cfg
+	m.GetMockCurrentUserAPI().EXPECT().Me(mock.Anything, mock.Anything).Return(nil, meErr)
+	cmd := newHostProfileCmd(t)
+	cmd.SetContext(cmdctx.SetWorkspaceClient(t.Context(), m.WorkspaceClient))
+	t.Setenv("DATABRICKS_CONFIG_FILE", filepath.Join(t.TempDir(), ".databrickscfg"))
+	return cmd
+}
+
+// newDescribeAccountCmd wires a mocked account client whose Workspaces.List
+// call fails with listErr, with cfg as its resolved configuration.
+func newDescribeAccountCmd(t *testing.T, cfg *config.Config, listErr error) *cobra.Command {
+	t.Helper()
+	m := mocks.NewMockAccountClient(t)
+	m.AccountClient.Config = cfg
+	m.GetMockWorkspacesAPI().EXPECT().List(mock.Anything).Return(nil, listErr)
+	cmd := newHostProfileCmd(t)
+	cmd.SetContext(cmdctx.SetAccountClient(t.Context(), m.AccountClient))
+	t.Setenv("DATABRICKS_CONFIG_FILE", filepath.Join(t.TempDir(), ".databrickscfg"))
+	return cmd
+}
+
+// resolveCfg returns a tryAuth that resolves cfg from attrs and reports the
+// given client type, mirroring what root.MustAnyClient leaves behind.
+func resolveCfg(t *testing.T, cfg *config.Config, attrs map[string]string, isAccount bool) tryAuth {
+	t.Helper()
+	return func(cmd *cobra.Command, args []string) (*config.Config, bool, error) {
+		require.NoError(t, config.ConfigAttributes.ResolveFromStringMap(cfg, attrs))
+		return cfg, isAccount, nil
+	}
+}
+
+// TestGetAuthStatusVerificationFallback covers the fallback when the primary
+// verification call (mocked client) fails: describe tries the other endpoint
+// over HTTP against describeVerifyServer, and only when both fail does it
+// report the primary error. Error rows leave wantUsername/wantAccountID empty
+// because errorAuthStatus never sets them.
+func TestGetAuthStatusVerificationFallback(t *testing.T) {
+	tests := []struct {
+		name          string
+		isAccount     bool
+		primaryErr    *apierr.APIError
+		meStatus      int
+		listStatus    int
+		accountID     string
+		wantStatus    string
+		wantUsername  string
+		wantAccountID string
+	}{
+		{
+			name:          "workspace check fails, account check succeeds",
+			primaryErr:    &apierr.APIError{StatusCode: http.StatusBadRequest, Message: "Unable to load OAuth Config"},
+			meStatus:      http.StatusNotFound,
+			listStatus:    http.StatusOK,
+			accountID:     "test-acct",
+			wantStatus:    "success",
+			wantAccountID: "test-acct",
+		},
+		{
+			name:       "no second call without an account id",
+			primaryErr: &apierr.APIError{StatusCode: http.StatusBadRequest, Message: "Unable to load OAuth Config"},
+			wantStatus: "error",
+		},
+		{
+			name:         "account check fails, workspace check succeeds",
+			isAccount:    true,
+			primaryErr:   &apierr.APIError{StatusCode: http.StatusForbidden, Message: "This API is disabled for users without account admin status"},
+			meStatus:     http.StatusOK,
+			listStatus:   http.StatusNotFound,
+			accountID:    "test-acct",
+			wantStatus:   "success",
+			wantUsername: "fallback-user",
+		},
+		{
+			name:       "workspace branch, both checks fail",
+			primaryErr: &apierr.APIError{StatusCode: http.StatusBadRequest, Message: "Unable to load OAuth Config"},
+			meStatus:   http.StatusNotFound,
+			listStatus: http.StatusUnauthorized,
+			accountID:  "test-acct",
+			wantStatus: "error",
+		},
+		{
+			name:       "account branch, both checks fail",
+			isAccount:  true,
+			primaryErr: &apierr.APIError{StatusCode: http.StatusUnauthorized, Message: "credentials expired"},
+			meStatus:   http.StatusUnauthorized,
+			listStatus: http.StatusNotFound,
+			accountID:  "test-acct",
+			wantStatus: "error",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Setenv("DATABRICKS_ACCOUNT_ID", "")
+			server := describeVerifyServer(t, tc.accountID, tc.meStatus, tc.listStatus)
+			cfg := &config.Config{}
+			var cmd *cobra.Command
+			if tc.isAccount {
+				cmd = newDescribeAccountCmd(t, cfg, tc.primaryErr)
+			} else {
+				cmd = newDescribeWorkspaceCmd(t, cfg, tc.primaryErr)
+			}
+			attrs := map[string]string{
+				"host":      server.URL,
+				"token":     "test-token",
+				"auth_type": "pat",
+			}
+			if tc.accountID != "" {
+				attrs["account_id"] = tc.accountID
+			}
+
+			status, err := getAuthStatus(cmd, []string{}, false, resolveCfg(t, cfg, attrs, tc.isAccount))
+			require.NoError(t, err)
+			require.Equal(t, tc.wantStatus, status.Status)
+			assert.Equal(t, tc.wantUsername, status.Username)
+			assert.Equal(t, tc.wantAccountID, status.AccountID)
+			if tc.wantStatus == "error" {
+				assert.ErrorIs(t, status.Error, tc.primaryErr)
+			}
+		})
+	}
+}
+
+func TestGetWorkspaceAuthStatus_NonU2M_OmitsTokenStorage(t *testing.T) {
+	ctx := t.Context()
+	m := mocks.NewMockWorkspaceClient(t)
+	ctx = cmdctx.SetWorkspaceClient(ctx, m.WorkspaceClient)
+
+	cmd := &cobra.Command{}
+	cmd.SetContext(ctx)
+
+	currentUserApi := m.GetMockCurrentUserAPI()
+	currentUserApi.EXPECT().Me(mock.Anything, mock.Anything).Return(&iam.User{UserName: "pat-user"}, nil)
+
+	cmd.Flags().String("host", "", "")
+	cmd.Flags().String("profile", "", "")
+
+	cfg := &config.Config{}
+	m.WorkspaceClient.Config = cfg
+	require.NoError(t, config.ConfigAttributes.Configure(cfg))
+
+	status, err := getAuthStatus(cmd, []string{}, false, func(cmd *cobra.Command, args []string) (*config.Config, bool, error) {
+		require.NoError(t, config.ConfigAttributes.ResolveFromStringMap(cfg, map[string]string{
+			"host":      "https://test.test",
+			"token":     "pat-token",
+			"auth_type": "pat",
+		}))
+		return cfg, false, nil
+	})
+	require.NoError(t, err)
+	require.NotNil(t, status)
+	assert.Nil(t, status.TokenStorage)
+}
diff --git a/cmd/auth/docker.go b/cmd/auth/docker.go
new file mode 100644
index 00000000000..37f80d1a9d1
--- /dev/null
+++ b/cmd/auth/docker.go
@@ -0,0 +1,36 @@
+package auth
+
+import (
+	"context"
+
+	authdocker "github.com/databricks/cli/cmd/auth/docker"
+	"github.com/databricks/cli/libs/auth"
+	"github.com/databricks/cli/libs/auth/storage"
+	"github.com/databricks/cli/libs/databrickscfg/profile"
+	"github.com/spf13/cobra"
+	"golang.org/x/oauth2"
+)
+
+func newDockerCommand() *cobra.Command {
+	return authdocker.New(loadDockerToken)
+}
+
+func loadDockerToken(ctx context.Context, req authdocker.TokenRequest) (*oauth2.Token, error) {
+	tokenStore, mode, err := storage.ResolveStore(ctx, storage.StorageModeUnknown)
+	if err != nil {
+		return nil, err
+	}
+	return loadToken(ctx, loadTokenArgs{
+		authArguments: &auth.AuthArguments{
+			Host:        req.Profile.Host,
+			AccountID:   req.Profile.AccountID,
+			WorkspaceID: req.Profile.WorkspaceID,
+		},
+		profileName:  req.Profile.Name,
+		tokenTimeout: req.Timeout,
+		forceRefresh: req.ForceRefresh,
+		profiler:     profile.DefaultProfiler,
+		tokenStore:   tokenStore,
+		mode:         mode,
+	})
+}
diff --git a/cmd/auth/docker/docker.go b/cmd/auth/docker/docker.go
new file mode 100644
index 00000000000..cecf2ac8b63
--- /dev/null
+++ b/cmd/auth/docker/docker.go
@@ -0,0 +1,21 @@
+package docker
+
+import (
+	"time"
+
+	"github.com/spf13/cobra"
+)
+
+const defaultTokenTimeout = time.Hour
+
+// New returns the Docker authentication command.
+func New(load TokenLoader) *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "docker",
+		Short: "(Experimental) Manage Docker authentication for Databricks Artifact Registry",
+	}
+	cmd.AddCommand(newDockerTokenCommand(load))
+	cmd.AddCommand(newDockerConfigureCommand())
+	cmd.AddCommand(newDockerHostCommand())
+	return cmd
+}
diff --git a/cmd/auth/docker/docker_configure.go b/cmd/auth/docker/docker_configure.go
new file mode 100644
index 00000000000..22e6a4dce2a
--- /dev/null
+++ b/cmd/auth/docker/docker_configure.go
@@ -0,0 +1,149 @@
+package docker
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"path/filepath"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/databrickscfg"
+	"github.com/databricks/cli/libs/databrickscfg/profile"
+	"github.com/databricks/cli/libs/dockercredentials"
+	"github.com/databricks/cli/libs/env"
+	"github.com/databricks/databricks-sdk-go/config"
+	"github.com/spf13/cobra"
+)
+
+func newDockerConfigureCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "configure [PROFILE]",
+		Short: "(Experimental) Configure Docker authentication for Databricks Artifact Registry",
+		Long: `(Experimental) Configure Docker authentication for Databricks Artifact Registry.
+
+This command installs docker-credential-databricks and configures Docker to use
+it for the selected workspace's Artifact Registry host. If the selected profile
+does not already include a workspace_id, the command resolves and saves it so
+the Docker helper can map the registry host back to the profile. The registry
+region is inferred from the workspace's metastore. Select the workspace with
+[PROFILE] or --profile; --host, --account-id, and --workspace-id are not
+supported. The deprecated --region flag is retained for compatibility; omit it
+because it will be fully removed in the next release.`,
+		Args: cobra.MaximumNArgs(1),
+		PreRunE: func(cmd *cobra.Command, _ []string) error {
+			return errorOnUnsupportedDockerFlags(cmd, "[PROFILE] or --profile")
+		},
+	}
+	var region string
+	cmd.Flags().StringVar(&region, "region", "", "Artifact Registry region; we recommend omitting this flag because the region is inferred automatically")
+	cmd.Flags().Lookup("region").Deprecated = "--region will be fully removed in the next release"
+	cmd.RunE = func(cmd *cobra.Command, args []string) error {
+		target, err := configureDockerTarget(cmd, args, region)
+		if err != nil {
+			return err
+		}
+		result, err := target.configure(cmd.Context())
+		if err != nil {
+			return err
+		}
+		target.logConfigured(cmd.Context(), result)
+		return nil
+	}
+	return cmd
+}
+
+func configureDockerTarget(cmd *cobra.Command, args []string, region string) (*dockerTarget, error) {
+	ctx := cmd.Context()
+	name, err := configureDockerProfileName(ctx, cmd, args, profile.DefaultProfiler)
+	if err != nil {
+		return nil, err
+	}
+	var explicitRegion *string
+	if cmd.Flags().Changed("region") {
+		explicitRegion = &region
+	}
+	w, err := loadDockerWorkspace(ctx, name, explicitRegion)
+	if err != nil {
+		return nil, err
+	}
+	if err := dockercredentials.EnsureUniqueProfile(ctx, profile.DefaultProfiler, w.profile, w.id); err != nil {
+		return nil, err
+	}
+	return w.target(ctx, explicitRegion)
+}
+
+func (t *dockerTarget) configure(ctx context.Context) (dockercredentials.Configuration, error) {
+	if t.profile.WorkspaceID == "" || t.profile.WorkspaceID == profile.WorkspaceIDNone {
+		err := databrickscfg.SaveToProfile(ctx, &config.Config{
+			ConfigFile:  env.Get(ctx, "DATABRICKS_CONFIG_FILE"),
+			Profile:     t.profile.Name,
+			WorkspaceID: t.workspaceID,
+		})
+		if err != nil {
+			return dockercredentials.Configuration{}, fmt.Errorf("save workspace ID to profile %q: %w", t.profile.Name, err)
+		}
+	}
+	return dockercredentials.Configure(ctx, t.executable, t.registryHost)
+}
+
+func (t *dockerTarget) logConfigured(ctx context.Context, result dockercredentials.Configuration) {
+	cmdio.LogString(ctx, "Configured Docker credential helper for "+t.registryHost)
+	cmdio.LogString(ctx, "Updated Docker config: "+filepath.ToSlash(result.ConfigPath))
+	cmdio.LogString(ctx, "Installed Docker credential helper: "+filepath.ToSlash(result.Shim.Path))
+	if !result.Shim.OnPath {
+		installDir := filepath.ToSlash(filepath.Dir(result.Shim.Path))
+		cmdio.LogString(ctx, fmt.Sprintf("Warning: ensure %s is on PATH before any other docker-credential-databricks helper, and that .CMD is in PATHEXT on Windows", installDir))
+	}
+}
+
+func errorOnUnsupportedDockerFlags(cmd *cobra.Command, selection string) error {
+	for _, name := range []string{"host", "account-id", "workspace-id"} {
+		flag := cmd.Flag(name)
+		if flag != nil && flag.Changed {
+			return fmt.Errorf("--%s is not supported for auth docker %s. Select the workspace with %s instead", name, cmd.Name(), selection)
+		}
+	}
+	return nil
+}
+
+// configureDockerProfileName resolves profile selectors from highest to lowest precedence, prompting only as a last resort.
+func configureDockerProfileName(ctx context.Context, cmd *cobra.Command, args []string, profiler profile.Profiler) (string, error) {
+	profileFlag := cmd.Flag("profile")
+	profileName := ""
+	if profileFlag != nil {
+		profileName = profileFlag.Value.String()
+	}
+	if len(args) == 1 {
+		if profileName != "" {
+			return "", fmt.Errorf("argument %q cannot be combined with --profile. Use --profile instead", args[0])
+		}
+		return args[0], nil
+	}
+	if profileName != "" {
+		return profileName, nil
+	}
+	if profileName = env.Get(ctx, "DATABRICKS_CONFIG_PROFILE"); profileName != "" {
+		return profileName, nil
+	}
+	if profileName = databrickscfg.ResolveDefaultProfile(ctx); profileName != "" {
+		return profileName, nil
+	}
+	if !cmdio.IsPromptSupported(ctx) {
+		return "", errors.New("no profile specified. Use --profile <name> to specify which profile to use")
+	}
+
+	profiles, err := profiler.LoadProfiles(ctx, profile.MatchWorkspaceProfiles)
+	if err != nil {
+		return "", err
+	}
+	currentDefault, _ := databrickscfg.GetDefaultProfile(ctx, env.Get(ctx, "DATABRICKS_CONFIG_FILE"))
+	return profile.SelectProfile(ctx, profile.SelectConfig{
+		Label:             "Select a workspace profile",
+		Profiles:          profiles,
+		StartInSearchMode: true,
+		Default:           currentDefault,
+		ActiveTemplate:    `▸ {{.Name | bold}}{{if .IsDefault}} {{ "[default]" | green }}{{end}}{{if .AccountID}} (account: {{.AccountID|faint}}){{else if .Host}} ({{.Host|faint}}){{end}}`,
+		InactiveTemplate:  `  {{.Name}}{{if .IsDefault}} [default]{{end}}{{if .AccountID}} (account: {{.AccountID|faint}}){{else if .Host}} ({{.Host|faint}}){{end}}`,
+		SelectedTemplate:  `{{ "Using profile" | faint }}: {{ .Name | bold }}`,
+	})
+}
diff --git a/cmd/auth/docker/docker_host.go b/cmd/auth/docker/docker_host.go
new file mode 100644
index 00000000000..e26bd1f14f1
--- /dev/null
+++ b/cmd/auth/docker/docker_host.go
@@ -0,0 +1,52 @@
+package docker
+
+import (
+	"errors"
+	"strings"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/dockercredentials"
+	"github.com/spf13/cobra"
+)
+
+func newDockerHostCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "host",
+		Short: "(Experimental) Show the registry host and credential helper status for a profile",
+		Long: `(Experimental) Show the Databricks Artifact Registry host and Docker credential helper status for a profile.
+
+The --profile flag is required.`,
+		Example: "  databricks auth docker host --profile DEFAULT",
+		Args:    cobra.NoArgs,
+		Annotations: map[string]string{
+			"template": "Registry host: {{.Host}}\nCredential helper configured: {{bool .Configured}}\n",
+		},
+		PreRunE: func(cmd *cobra.Command, _ []string) error {
+			return errorOnUnsupportedDockerFlags(cmd, "--profile")
+		},
+	}
+	cmd.RunE = func(cmd *cobra.Command, _ []string) error {
+		target, err := dockerHostTarget(cmd)
+		if err != nil {
+			return err
+		}
+		status, err := dockercredentials.Inspect(cmd.Context(), target.registryHost)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(cmd.Context(), status)
+	}
+	return cmd
+}
+
+func dockerHostTarget(cmd *cobra.Command) (*dockerTarget, error) {
+	name := strings.TrimSpace(cmd.Flag("profile").Value.String())
+	if name == "" {
+		return nil, errors.New("--profile is required for auth docker host")
+	}
+	w, err := loadDockerWorkspace(cmd.Context(), name, nil)
+	if err != nil {
+		return nil, err
+	}
+	return w.target(cmd.Context(), nil)
+}
diff --git a/cmd/auth/docker/docker_profile.go b/cmd/auth/docker/docker_profile.go
new file mode 100644
index 00000000000..c616157cf33
--- /dev/null
+++ b/cmd/auth/docker/docker_profile.go
@@ -0,0 +1,109 @@
+package docker
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/databricks/cli/libs/databrickscfg"
+	"github.com/databricks/cli/libs/databrickscfg/profile"
+	"github.com/databricks/cli/libs/dockercredentials"
+	"github.com/databricks/cli/libs/env"
+	"github.com/databricks/databricks-sdk-go"
+)
+
+// dockerWorkspace holds the selected profile and its resolved workspace ID.
+type dockerWorkspace struct {
+	profile    profile.Profile
+	id         string
+	executable string
+	client     *databricks.WorkspaceClient
+}
+
+type dockerTarget struct {
+	profile      profile.Profile
+	workspaceID  string
+	registryHost string
+	executable   string
+}
+
+type dockerProfileHostError struct {
+	profileName string
+	cause       error
+}
+
+func (e *dockerProfileHostError) Error() string {
+	return fmt.Sprintf("profile %q does not target a supported Databricks workspace host. Select a workspace profile, or create one with databricks auth login --host <workspace-url> --profile <name>", e.profileName)
+}
+
+func (e *dockerProfileHostError) Unwrap() error {
+	return e.cause
+}
+
+// loadDockerWorkspace validates inputs before loading credentials or making requests.
+// A nil region means inference; an explicitly empty region remains an error.
+func loadDockerWorkspace(ctx context.Context, name string, region *string) (*dockerWorkspace, error) {
+	p, err := dockercredentials.LoadProfile(ctx, profile.DefaultProfiler, name)
+	if err != nil {
+		return nil, err
+	}
+	if err := dockercredentials.ValidateWorkspaceHost(p.Host); err != nil {
+		return nil, &dockerProfileHostError{profileName: p.Name, cause: err}
+	}
+	if region != nil {
+		if err := dockercredentials.ValidateRegion(*region); err != nil {
+			return nil, err
+		}
+	}
+	executable, err := os.Executable()
+	if err != nil {
+		return nil, fmt.Errorf("locate databricks executable: %w", err)
+	}
+	var client *databricks.WorkspaceClient
+	if region == nil || p.WorkspaceID == "" || p.WorkspaceID == profile.WorkspaceIDNone {
+		client, err = databricks.NewWorkspaceClient(&databricks.Config{
+			Profile:           p.Name,
+			Host:              p.Host,
+			AccountID:         p.AccountID,
+			AuthType:          p.AuthType,
+			ConfigFile:        env.Get(ctx, "DATABRICKS_CONFIG_FILE"),
+			Loaders:           databrickscfg.ProfileAuthLoaders,
+			DatabricksCliPath: executable,
+		})
+		if err != nil {
+			err = fmt.Errorf("load workspace profile %q: %w. Run databricks auth login --host <workspace-url> and retry with that profile", p.Name, err)
+			return nil, dockercredentials.RewriteProfileError(ctx, p, err)
+		}
+	}
+	id, err := dockercredentials.WorkspaceID(ctx, p, client)
+	if err != nil {
+		return nil, err
+	}
+	return &dockerWorkspace{profile: p, id: id, executable: executable, client: client}, nil
+}
+
+// target resolves the registry after any command-specific checks on the workspace ID.
+func (w *dockerWorkspace) target(ctx context.Context, explicitRegion *string) (*dockerTarget, error) {
+	var region string
+	if explicitRegion != nil {
+		region = strings.TrimSpace(*explicitRegion)
+	} else {
+		w.client.Config.WorkspaceID = w.id
+		var err error
+		region, err = dockercredentials.WorkspaceRegion(ctx, w.profile, w.client.Metastores)
+		if err != nil {
+			return nil, err
+		}
+	}
+	host, err := dockercredentials.RegistryHost(w.id, region, w.profile.Host)
+	if err != nil {
+		return nil, err
+	}
+	return &dockerTarget{
+		profile:      w.profile,
+		workspaceID:  w.id,
+		registryHost: host,
+		executable:   w.executable,
+	}, nil
+}
diff --git a/cmd/auth/docker/docker_token.go b/cmd/auth/docker/docker_token.go
new file mode 100644
index 00000000000..db82f58b3ef
--- /dev/null
+++ b/cmd/auth/docker/docker_token.go
@@ -0,0 +1,88 @@
+package docker
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"time"
+
+	"github.com/databricks/cli/libs/databrickscfg/profile"
+	"github.com/databricks/cli/libs/dockercredentials"
+	"github.com/spf13/cobra"
+	"golang.org/x/oauth2"
+)
+
+// TokenRequest contains the resolved profile and token acquisition options.
+type TokenRequest struct {
+	Profile      profile.Profile
+	Timeout      time.Duration
+	ForceRefresh bool
+}
+
+// TokenLoader acquires an OAuth token for a Docker credential request.
+type TokenLoader func(context.Context, TokenRequest) (*oauth2.Token, error)
+
+type dockerGetResponse struct {
+	Username string `json:"Username"`
+	Secret   string `json:"Secret"`
+}
+
+func newDockerTokenCommand(load TokenLoader) *cobra.Command {
+	cmd := &cobra.Command{
+		Use:     "token",
+		Short:   "(Experimental) Generate a Docker credential",
+		PreRunE: validateDockerTokenRequest,
+	}
+	var tokenTimeout time.Duration
+	cmd.Flags().DurationVar(&tokenTimeout, "timeout", defaultTokenTimeout, "Timeout for acquiring a token.")
+	var noForceRefresh bool
+	cmd.Flags().BoolVar(&noForceRefresh, "no-force-refresh", false, "Use a valid cached token instead of forcing a refresh.")
+
+	cmd.RunE = func(cmd *cobra.Command, _ []string) error {
+		p, err := dockerTokenProfile(cmd.Context(), cmd.InOrStdin())
+		if err != nil {
+			return err
+		}
+		token, err := load(cmd.Context(), TokenRequest{
+			Profile: p,
+			Timeout: tokenTimeout,
+			// Docker may reuse one credential for a long upload, so maximize its lifetime.
+			ForceRefresh: !noForceRefresh,
+		})
+		if err != nil {
+			return err
+		}
+		return json.NewEncoder(cmd.OutOrStdout()).Encode(dockerGetResponse{
+			Username: dockercredentials.OAuthTokenUsername,
+			Secret:   token.AccessToken,
+		})
+	}
+	return cmd
+}
+
+func dockerTokenProfile(ctx context.Context, input io.Reader) (profile.Profile, error) {
+	raw, err := io.ReadAll(input)
+	if err != nil {
+		return profile.Profile{}, fmt.Errorf("read Docker credential request: %w", err)
+	}
+	registry, err := dockercredentials.ParseRegistryHost(string(raw))
+	if err != nil {
+		return profile.Profile{}, err
+	}
+	return dockercredentials.ProfileForRegistry(ctx, profile.DefaultProfiler, registry)
+}
+
+func validateDockerTokenRequest(cmd *cobra.Command, args []string) error {
+	if len(args) > 0 {
+		return errors.New("auth docker token does not accept positional arguments")
+	}
+	for _, name := range []string{"profile", "host", "account-id", "workspace-id"} {
+		flag := cmd.Flag(name)
+		if flag != nil && flag.Changed {
+			return fmt.Errorf("auth docker token does not support --%s", name)
+		}
+	}
+	return nil
+}
diff --git a/cmd/auth/env.go b/cmd/auth/env.go
index 9861d491e42..4f94beb67ce 100644
--- a/cmd/auth/env.go
+++ b/cmd/auth/env.go
@@ -79,7 +79,7 @@ func loadFromDatabricksCfg(ctx context.Context, cfg *config.Config) error {
 		return err
 	}
 	profile, err := resolveSection(cfg, iniFile)
-	if err == ErrNoMatchingProfiles {
+	if errors.Is(err, ErrNoMatchingProfiles) {
 		// it's also fine for Azure CLI or Databricks CLI, which
 		// are resolved by unified auth handling in the Go SDK.
 		return nil
diff --git a/cmd/auth/export_test.go b/cmd/auth/export_test.go
new file mode 100644
index 00000000000..ad363a491ac
--- /dev/null
+++ b/cmd/auth/export_test.go
@@ -0,0 +1,6 @@
+package auth
+
+var (
+	NewWorkspaceSearcher        = newWorkspaceSearcher
+	PromptForWorkspaceSelection = promptForWorkspaceSelection
+)
diff --git a/cmd/auth/in_memory_test.go b/cmd/auth/in_memory_test.go
index aea197a3c5d..3c11a40e4fb 100644
--- a/cmd/auth/in_memory_test.go
+++ b/cmd/auth/in_memory_test.go
@@ -1,39 +1,40 @@
 package auth
 
 import (
-	"github.com/databricks/databricks-sdk-go/credentials/u2m/cache"
+	"github.com/databricks/cli/libs/auth/storage"
 	"golang.org/x/oauth2"
 )
 
-type inMemoryTokenCache struct {
+type inMemoryStore struct {
 	Tokens map[string]*oauth2.Token
 }
 
-// Lookup implements TokenCache.
-// Returns a copy to match real (file-backed) cache behavior, where each
-// Lookup deserializes a fresh struct. Without the copy, callers that
+// Lookup returns a copy to match real (file-backed) cache behavior, where
+// each lookup deserializes a fresh struct. Without the copy, callers that
 // mutate the returned token (e.g. clearing RefreshToken) would corrupt
 // entries shared across test cases.
-func (i *inMemoryTokenCache) Lookup(key string) (*oauth2.Token, error) {
+func (i *inMemoryStore) Lookup(key string) (storage.Entry, error) {
 	token, ok := i.Tokens[key]
 	if !ok {
-		return nil, cache.ErrNotFound
+		return storage.Entry{}, storage.ErrNotFound
 	}
 	cp := *token
-	return &cp, nil
+	return storage.Entry{Token: &cp}, nil
 }
 
-// Store implements TokenCache.
-// Stores a copy to prevent callers from mutating cached entries after Store
-// returns (mirrors file-backed cache semantics).
-func (i *inMemoryTokenCache) Store(key string, t *oauth2.Token) error {
-	if t == nil {
-		delete(i.Tokens, key)
-	} else {
-		cp := *t
-		i.Tokens[key] = &cp
-	}
+// Put stores a copy to prevent callers from mutating cached entries after
+// put returns (mirrors file-backed cache semantics).
+func (i *inMemoryStore) Put(key string, e storage.Entry) error {
+	cp := *e.Token
+	i.Tokens[key] = &cp
+	return nil
+}
+
+// Delete deletes the entry under key. Deleting a missing entry is not
+// an error.
+func (i *inMemoryStore) Delete(key string) error {
+	delete(i.Tokens, key)
 	return nil
 }
 
-var _ cache.TokenCache = (*inMemoryTokenCache)(nil)
+var _ storage.Store = (*inMemoryStore)(nil)
diff --git a/cmd/auth/login.go b/cmd/auth/login.go
index cd4d81ad255..6019e8b90a0 100644
--- a/cmd/auth/login.go
+++ b/cmd/auth/login.go
@@ -11,6 +11,7 @@ import (
 
 	"github.com/databricks/cli/libs/auth"
 	"github.com/databricks/cli/libs/auth/storage"
+	"github.com/databricks/cli/libs/auth/u2m"
 	"github.com/databricks/cli/libs/browser"
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/databrickscfg"
@@ -21,8 +22,6 @@ import (
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/config"
 	"github.com/databricks/databricks-sdk-go/config/experimental/auth/authconv"
-	"github.com/databricks/databricks-sdk-go/credentials/u2m"
-	"github.com/databricks/databricks-sdk-go/credentials/u2m/cache"
 	"github.com/spf13/cobra"
 	"golang.org/x/oauth2"
 )
@@ -36,8 +35,6 @@ func promptForProfile(ctx context.Context, defaultValue string) (string, error)
 		Label: "Databricks profile name [" + defaultValue + "]",
 	})
 	if result == "" {
-		// Manually return the default value. We could use the prompt.Default
-		// field, but be inconsistent with other prompts in the CLI.
 		return defaultValue, err
 	}
 	return result, err
@@ -48,6 +45,10 @@ const (
 	defaultTimeout          = 1 * time.Hour
 	authTypeDatabricksCLI   = "databricks-cli"
 	discoveryFallbackTip    = "\n\nTip: you can specify a workspace directly with: databricks auth login --host <url>"
+	// discoveryHostEnvVar overrides the default https://login.databricks.com
+	// host used by the discovery login flow. Intended for testing and
+	// development against non-production environments.
+	discoveryHostEnvVar = "DATABRICKS_DISCOVERY_HOST"
 )
 
 // discoveryErr wraps an error (or creates a new one) and appends the
@@ -60,8 +61,7 @@ func discoveryErr(msg string, err error) error {
 }
 
 type discoveryPersistentAuth interface {
-	Challenge() error
-	Token() (*oauth2.Token, error)
+	Challenge() (*oauth2.Token, error)
 	Close() error
 }
 
@@ -87,6 +87,24 @@ func (d *defaultDiscoveryClient) IntrospectToken(ctx context.Context, host, acce
 	return auth.IntrospectToken(ctx, host, accessToken, nil)
 }
 
+// storeLoginToken persists a token after login has finished any optional
+// profile update.
+func storeLoginToken(ctx context.Context, tokenStore storage.Store, mode storage.StorageMode, arg u2m.OAuthArgument, token *oauth2.Token) error {
+	tokenStore = storage.WrapForOAuthArgument(ctx, tokenStore, mode, arg)
+	key := arg.GetCacheKey()
+	if err := tokenStore.Put(key, storage.Entry{Token: token}); err != nil {
+		storeErr := fmt.Errorf("store token: %w", err)
+		// The profile is already saved, but the old token may still be present.
+		// Delete it so later commands cannot use it with the updated profile.
+		if deleteErr := tokenStore.Delete(key); deleteErr != nil {
+			return errors.Join(storeErr, fmt.Errorf("delete stale token: %w", deleteErr))
+		}
+		return storeErr
+	}
+	storage.PinSecureMode(ctx, mode, storage.StorageModeUnknown)
+	return nil
+}
+
 func newLoginCommand(authArguments *auth.AuthArguments) *cobra.Command {
 	defaultConfigPath := "~/.databrickscfg"
 	if runtime.GOOS == "windows" {
@@ -115,9 +133,11 @@ use the flags directly to specify both.
 
 The host URL may include query parameters to set the workspace and account ID:
 
-  databricks auth login --host "https://<host>?o=<workspace_id>&account_id=<id>"
+  databricks auth login --host "https://<host>?w=<workspace_id>&account_id=<id>"
 
-Note: URLs containing "?" must be quoted to prevent shell interpretation.
+The workspace ID may be passed as ?w= (preferred), ?o= (legacy), or
+?workspace_id=. Note: URLs containing "?" must be quoted to prevent shell
+interpretation.
 
 If a profile with the given name already exists, it is updated. Otherwise
 a new profile is created.
@@ -129,6 +149,8 @@ a new profile is created.
 	var configureServerless bool
 	var skipWorkspace bool
 	var scopes string
+	var clientID string
+	var resources []string
 	cmd.Flags().DurationVar(&loginTimeout, "timeout", defaultTimeout,
 		"Timeout for completing login challenge in the browser")
 	cmd.Flags().BoolVar(&configureCluster, "configure-cluster", false,
@@ -139,6 +161,10 @@ a new profile is created.
 		"Skip workspace selection for account-level access")
 	cmd.Flags().StringVar(&scopes, "scopes", "",
 		"Comma-separated list of OAuth scopes to request (defaults to 'all-apis')")
+	cmd.Flags().StringVar(&clientID, "client-id", "",
+		"OAuth client ID to use for U2M authentication")
+	cmd.Flags().StringArrayVar(&resources, "resource", nil,
+		"RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.")
 
 	cmd.PreRunE = profileHostConflictCheck
 
@@ -146,11 +172,6 @@ a new profile is created.
 		ctx := cmd.Context()
 		profileName := cmd.Flag("profile").Value.String()
 
-		tokenCache, mode, err := storage.ResolveCache(ctx, "")
-		if err != nil {
-			return err
-		}
-
 		// Cluster and Serverless are mutually exclusive.
 		if configureCluster && configureServerless {
 			return errors.New("please either configure serverless or cluster, not both")
@@ -176,6 +197,70 @@ a new profile is created.
 			}
 		}
 
+		// Resolve the cache before the browser step so an unavailable
+		// keyring surfaces here rather than after OAuth. The probe also
+		// triggers the OS unlock prompt, which the user can answer during
+		// OAuth. Run after input validation so trivially-invalid commands
+		// fail without probing.
+		tokenStore, mode, err := storage.ResolveStoreForLogin(ctx, "")
+		if err != nil {
+			return err
+		}
+
+		// When interactive and nothing was specified, show a picker that lets
+		// the user re-login to an existing profile, create a new one, or enter
+		// a host URL. With no profiles configured the picker still shows the
+		// two action entries so the user can choose between web-based discovery
+		// (Create a new profile) and a manual host URL.
+		if profileName == "" && authArguments.Host == "" && len(args) == 0 && cmdio.IsPromptSupported(ctx) {
+			allProfiles, err := profile.DefaultProfiler.LoadProfiles(ctx, profile.MatchAllProfiles)
+			if err != nil && !errors.Is(err, profile.ErrNoConfiguration) {
+				return err
+			}
+			label := "Select a profile"
+			if len(allProfiles) == 0 {
+				label = "How would you like to log in?"
+			}
+			currentDefault, _ := databrickscfg.GetDefaultProfile(ctx, env.Get(ctx, "DATABRICKS_CONFIG_FILE"))
+			result, selected, err := pickAuthProfile(ctx, allProfiles, profilePickerOptions{
+				Label:         label,
+				Default:       currentDefault,
+				IncludeExtras: true,
+			})
+			if err != nil {
+				return err
+			}
+			switch result {
+			case profilePickerProfile:
+				profileName = selected
+			case profilePickerEnterHost:
+				host, err := promptForHost(ctx)
+				if err != nil {
+					return err
+				}
+				authArguments.Host = host
+			case profilePickerCreateNew:
+				// Fall through to the profile name prompt below.
+			}
+		}
+
+		// If --skip-workspace is set and we already know the host, eagerly run
+		// URL-param extraction and host discovery so getProfileName can suggest
+		// ACCOUNT-<account-id> as the default name. Without this, AccountID is
+		// only populated by setHostAndAccountId further down, which runs after
+		// the profile-name prompt.
+		if skipWorkspace && profileName == "" && authArguments.Host != "" && authArguments.AccountID == "" {
+			params := auth.ExtractHostQueryParams(authArguments.Host)
+			authArguments.Host = params.Host
+			if authArguments.AccountID == "" {
+				authArguments.AccountID = params.AccountID
+			}
+			if authArguments.WorkspaceID == "" {
+				authArguments.WorkspaceID = params.WorkspaceID
+			}
+			runHostDiscovery(ctx, authArguments)
+		}
+
 		// If the user has not specified a profile name, prompt for one.
 		if profileName == "" {
 			var err error
@@ -194,6 +279,12 @@ a new profile is created.
 		if err != nil {
 			return err
 		}
+		if clientID == "" {
+			clientID = u2mClientIDFromProfile(existingProfile)
+		}
+		if len(resources) == 0 {
+			resources = u2mResourcesFromProfile(existingProfile)
+		}
 
 		// If no host is available from any source, use the discovery flow
 		// via login.databricks.com.
@@ -206,9 +297,10 @@ a new profile is created.
 				profileName:     profileName,
 				timeout:         loginTimeout,
 				scopes:          scopes,
+				clientID:        clientID,
 				existingProfile: existingProfile,
 				browserFunc:     getBrowserFunc(cmd),
-				tokenCache:      tokenCache,
+				tokenStore:      tokenStore,
 				mode:            mode,
 			})
 		}
@@ -238,50 +330,49 @@ a new profile is created.
 		persistentAuthOpts := []u2m.PersistentAuthOption{
 			u2m.WithOAuthArgument(oauthArgument),
 			u2m.WithBrowser(getBrowserFunc(cmd)),
-			u2m.WithTokenCache(storage.WrapForOAuthArgument(tokenCache, mode, oauthArgument)),
+		}
+		if clientID != "" {
+			persistentAuthOpts = append(persistentAuthOpts, u2m.WithClientID(clientID))
 		}
 		if len(scopesList) > 0 {
 			persistentAuthOpts = append(persistentAuthOpts, u2m.WithScopes(scopesList))
 		}
+		if len(resources) > 0 {
+			persistentAuthOpts = append(persistentAuthOpts, u2m.WithResources(resources))
+		}
+		// Apply timeout before creating PersistentAuth so Challenge() respects it.
+		ctx, cancel := context.WithTimeout(ctx, loginTimeout)
+		defer cancel()
+
 		persistentAuth, err := u2m.NewPersistentAuth(ctx, persistentAuthOpts...)
 		if err != nil {
 			return err
 		}
 		defer persistentAuth.Close()
 
-		ctx, cancel := context.WithTimeout(ctx, loginTimeout)
-		defer cancel()
-
-		if err = persistentAuth.Challenge(); err != nil {
+		token, err := persistentAuth.Challenge()
+		if err != nil {
 			return err
 		}
-		// At this point, an OAuth token has been successfully minted and stored
-		// in the CLI cache. The rest of the command focuses on:
+		tokenSource := oauth2.StaticTokenSource(token)
+
+		// At this point, an OAuth token has been successfully minted. The rest of
+		// the command focuses on:
 		// 1. Workspace selection for SPOG hosts (best-effort);
 		// 2. Configuring cluster and serverless;
 		// 3. Saving the profile.
 
-		// If discovery gave us an account_id but we still have no workspace_id,
-		// prompt the user to select a workspace. This applies to any host where
-		// .well-known/databricks-config returned an account_id.
-		shouldPromptWorkspace := authArguments.AccountID != "" &&
-			authArguments.WorkspaceID == "" &&
-			!skipWorkspace
-
-		if skipWorkspace && authArguments.WorkspaceID == "" {
-			authArguments.WorkspaceID = auth.WorkspaceIDNone
-		}
-
-		if shouldPromptWorkspace {
-			wsID, wsErr := promptForWorkspaceSelection(ctx, authArguments, persistentAuth)
+		if shouldPromptWorkspace(authArguments, existingProfile, skipWorkspace) {
+			wsID, wsErr := promptForWorkspaceSelection(ctx, authArguments, tokenSource)
 			if wsErr != nil {
 				log.Warnf(ctx, "Workspace selection failed: %v", wsErr)
-			} else if wsID == "" {
-				// User selected "Skip" from the prompt.
-				authArguments.WorkspaceID = auth.WorkspaceIDNone
-			} else {
+			} else if wsID != "" {
 				authArguments.WorkspaceID = wsID
 			}
+			// If wsID is empty, the user picked "Skip" — leave WorkspaceID empty.
+			// SaveToProfile omits the workspace_id key entirely for account-level
+			// profiles; MatchAccountProfiles treats absent workspace_id the same
+			// as the legacy "none" sentinel.
 		}
 
 		var clusterID, serverlessComputeID string
@@ -302,7 +393,7 @@ a new profile is created.
 				Host:        authArguments.Host,
 				AccountID:   authArguments.AccountID,
 				WorkspaceID: authArguments.WorkspaceID,
-				Credentials: config.NewTokenSourceStrategy("login-token", authconv.AuthTokenSource(persistentAuth)),
+				Credentials: config.NewTokenSourceStrategy("login-token", authconv.AuthTokenSource(tokenSource)),
 			})
 			if err != nil {
 				return err
@@ -336,11 +427,23 @@ a new profile is created.
 				ConfigFile:          env.Get(ctx, "DATABRICKS_CONFIG_FILE"),
 				ServerlessComputeID: serverlessComputeID,
 				Scopes:              scopesList,
+				ClientID:            clientID,
 			}, clearKeys...)
 			if err != nil {
 				return err
 			}
+			// TODO: resources is not supported in the SDK yet. This function is
+			// a short-cut to add the property to the profile until it is supported
+			// in the SDK.
+			if err := databrickscfg.SaveResourcesToProfile(ctx, profileName, env.Get(ctx, "DATABRICKS_CONFIG_FILE"), resources); err != nil {
+				return err
+			}
+		}
 
+		if err := storeLoginToken(ctx, tokenStore, mode, oauthArgument, token); err != nil {
+			return err
+		}
+		if profileName != "" {
 			cmdio.LogString(ctx, fmt.Sprintf("Profile %s was successfully saved", profileName))
 		}
 
@@ -350,6 +453,33 @@ a new profile is created.
 	return cmd
 }
 
+// shouldPromptWorkspace reports whether the login flow should ask the user to
+// pick a workspace. We prompt when we have an account_id but no workspace_id
+// and the user did not pass --skip-workspace, with two exceptions:
+//   - Classic account console hosts (accounts.*) serve only account-level
+//     APIs, so a selected workspace_id would be unusable against that host
+//     and only misleads later commands.
+//   - Re-login into an existing profile that's already account-only for the
+//     SAME account (account_id matches and workspace_id is absent or the
+//     legacy "none" sentinel) honors the user's prior "skip" choice instead
+//     of re-prompting on every login. We require the account_id to match so
+//     reusing a profile name against a different account still gets the
+//     workspace prompt.
+func shouldPromptWorkspace(authArguments *auth.AuthArguments, existingProfile *profile.Profile, skipWorkspace bool) bool {
+	if authArguments.AccountID == "" || authArguments.WorkspaceID != "" || skipWorkspace {
+		return false
+	}
+	if auth.IsClassicAccountHost((&config.Config{Host: authArguments.Host}).CanonicalHostName()) {
+		return false
+	}
+	if existingProfile != nil &&
+		existingProfile.AccountID == authArguments.AccountID &&
+		(existingProfile.WorkspaceID == "" || existingProfile.WorkspaceID == profile.WorkspaceIDNone) {
+		return false
+	}
+	return true
+}
+
 // Sets the host in the persistentAuth object based on the provided arguments and flags.
 // Follows the following precedence:
 // 1. [HOST] (first positional argument) or --host flag. Error if both are specified.
@@ -529,6 +659,10 @@ var discoveryIncompatibleFlags = []string{
 	"workspace-id",
 	"configure-cluster",
 	"configure-serverless",
+	// A resource indicator scopes the login to a protected resource on a
+	// specific workspace's /oidc, which the login.databricks.com discovery
+	// flow does not target.
+	"resource",
 }
 
 // validateDiscoveryFlagCompatibility returns an error if any flags that require
@@ -550,9 +684,10 @@ type discoveryLoginInputs struct {
 	profileName     string
 	timeout         time.Duration
 	scopes          string
+	clientID        string
 	existingProfile *profile.Profile
 	browserFunc     func(string) error
-	tokenCache      cache.TokenCache
+	tokenStore      storage.Store
 	mode            storage.StorageMode
 }
 
@@ -574,11 +709,17 @@ func discoveryLogin(ctx context.Context, in discoveryLoginInputs) error {
 		u2m.WithOAuthArgument(arg),
 		u2m.WithBrowser(in.browserFunc),
 		u2m.WithDiscoveryLogin(),
-		u2m.WithTokenCache(storage.WrapForOAuthArgument(in.tokenCache, in.mode, arg)),
+	}
+	if in.clientID != "" {
+		opts = append(opts, u2m.WithClientID(in.clientID))
 	}
 	if len(scopesList) > 0 {
 		opts = append(opts, u2m.WithScopes(scopesList))
 	}
+	discoveryHost := env.Get(ctx, discoveryHostEnvVar)
+	if discoveryHost != "" {
+		opts = append(opts, u2m.WithDiscoveryHost(discoveryHost))
+	}
 
 	// Apply timeout before creating PersistentAuth so Challenge() respects it.
 	ctx, cancel := context.WithTimeout(ctx, in.timeout)
@@ -590,8 +731,13 @@ func discoveryLogin(ctx context.Context, in discoveryLoginInputs) error {
 	}
 	defer persistentAuth.Close()
 
-	cmdio.LogString(ctx, "Opening login.databricks.com in your browser...")
-	if err := persistentAuth.Challenge(); err != nil {
+	displayHost := "login.databricks.com"
+	if discoveryHost != "" {
+		displayHost = discoveryHost
+	}
+	cmdio.LogString(ctx, fmt.Sprintf("Opening %s in your browser...", displayHost))
+	tok, err := persistentAuth.Challenge()
+	if err != nil {
 		return discoveryErr("login via login.databricks.com failed", err)
 	}
 
@@ -611,11 +757,6 @@ func discoveryLogin(ctx context.Context, in discoveryLoginInputs) error {
 
 	// Best-effort introspection as a fallback for workspace_id when host
 	// metadata discovery didn't return it (e.g. classic workspace hosts).
-	tok, err := persistentAuth.Token()
-	if err != nil {
-		return fmt.Errorf("retrieving token after login: %w", err)
-	}
-
 	introspection, err := in.dc.IntrospectToken(ctx, discoveredHost, tok.AccessToken)
 	if err != nil {
 		log.Debugf(ctx, "token introspection failed (non-fatal): %v", err)
@@ -641,7 +782,8 @@ func discoveryLogin(ctx context.Context, in discoveryLoginInputs) error {
 	// cluster_id, serverless_compute_id) from a prior login to a different host
 	// type must be cleared so they don't leak into the new profile. account_id
 	// and workspace_id are re-added from discovery/introspection results.
-	clearKeys = append(clearKeys,
+	clearKeys = append(
+		clearKeys,
 		"account_id",
 		"workspace_id",
 		databrickscfg.ExperimentalIsUnifiedHostKey,
@@ -656,6 +798,7 @@ func discoveryLogin(ctx context.Context, in discoveryLoginInputs) error {
 		WorkspaceID: workspaceID,
 		Scopes:      scopesList,
 		ConfigFile:  configFile,
+		ClientID:    in.clientID,
 	}, clearKeys...)
 	if err != nil {
 		if configFile != "" {
@@ -663,6 +806,9 @@ func discoveryLogin(ctx context.Context, in discoveryLoginInputs) error {
 		}
 		return fmt.Errorf("saving profile %q: %w", in.profileName, err)
 	}
+	if err := storeLoginToken(ctx, in.tokenStore, in.mode, arg, tok); err != nil {
+		return err
+	}
 
 	cmdio.LogString(ctx, fmt.Sprintf("Profile %s was successfully saved", in.profileName))
 	return nil
@@ -691,11 +837,28 @@ func oauthLoginClearKeys() []string {
 	return databrickscfg.AuthCredentialKeys()
 }
 
+// u2mClientIDFromProfile excludes client IDs belonging to other auth types.
+func u2mClientIDFromProfile(p *profile.Profile) string {
+	if p == nil || p.AuthType != authTypeDatabricksCLI {
+		return ""
+	}
+	return p.ClientID
+}
+
+// u2mResourcesFromProfile returns the RFC 8707 resource indicators saved on a
+// databricks-cli-auth profile, so `login`/`auth token` re-request the same ones.
+func u2mResourcesFromProfile(p *profile.Profile) []string {
+	if p == nil || p.AuthType != authTypeDatabricksCLI {
+		return nil
+	}
+	return splitScopes(p.Resources)
+}
+
 // promptForWorkspaceSelection lists workspaces for a SPOG account and lets the
 // user pick one. Returns the selected workspace ID or empty string if skipped.
 // This is best-effort: errors are returned to the caller for logging, not shown
 // to the user.
-func promptForWorkspaceSelection(ctx context.Context, authArguments *auth.AuthArguments, persistentAuth *u2m.PersistentAuth) (string, error) {
+func promptForWorkspaceSelection(ctx context.Context, authArguments *auth.AuthArguments, tokenSource oauth2.TokenSource) (string, error) {
 	if !cmdio.IsPromptSupported(ctx) {
 		cmdio.LogString(ctx, "To use workspace commands, set workspace_id in your profile or pass --workspace-id.")
 		return "", nil
@@ -704,7 +867,7 @@ func promptForWorkspaceSelection(ctx context.Context, authArguments *auth.AuthAr
 	a, err := databricks.NewAccountClient(&databricks.Config{
 		Host:        authArguments.Host,
 		AccountID:   authArguments.AccountID,
-		Credentials: config.NewTokenSourceStrategy("login-token", authconv.AuthTokenSource(persistentAuth)),
+		Credentials: config.NewTokenSourceStrategy("login-token", authconv.AuthTokenSource(tokenSource)),
 	})
 	if err != nil {
 		return "", err
@@ -720,12 +883,6 @@ func promptForWorkspaceSelection(ctx context.Context, authArguments *auth.AuthAr
 		return "", nil
 	}
 
-	const maxWorkspaces = 50
-	if len(workspaces) > maxWorkspaces {
-		cmdio.LogString(ctx, fmt.Sprintf("Account has %d workspaces. Showing first %d. Use --workspace-id to specify directly.", len(workspaces), maxWorkspaces))
-		workspaces = workspaces[:maxWorkspaces]
-	}
-
 	if len(workspaces) == 1 {
 		wsID := strconv.FormatInt(workspaces[0].WorkspaceId, 10)
 		cmdio.LogString(ctx, fmt.Sprintf("Auto-selected workspace %q (%s)", workspaces[0].WorkspaceName, wsID))
@@ -745,11 +902,38 @@ func promptForWorkspaceSelection(ctx context.Context, authArguments *auth.AuthAr
 		Id:   "",
 	})
 
-	selected, err := cmdio.SelectOrdered(ctx, items, "Select a workspace")
+	idx, err := cmdio.RunSelect(ctx, cmdio.SelectOptions{
+		Label:             "Select a workspace (search by name or ID)",
+		Items:             items,
+		HideSelected:      true,
+		StartInSearchMode: true,
+		Searcher:          newWorkspaceSearcher(items),
+		Active:            `▸ {{if .Name}}{{.Name | bold}}{{if .Id}} ({{.Id | faint}}){{end}}{{else}}{{.Id | bold}}{{end}}`,
+		Inactive:          `  {{if .Name}}{{.Name}}{{if .Id}} ({{.Id | faint}}){{end}}{{else}}{{.Id}}{{end}}`,
+	})
 	if err != nil {
 		return "", err
 	}
-	return selected, nil
+	return items[idx].Id, nil
+}
+
+// newWorkspaceSearcher gives exact workspace IDs precedence over substring matches.
+func newWorkspaceSearcher(items []cmdio.Tuple) func(string, int) bool {
+	ids := make(map[string]struct{}, len(items))
+	names := make([]string, len(items))
+	for idx, item := range items {
+		names[idx] = strings.ToLower(item.Name)
+		if item.Id != "" {
+			ids[item.Id] = struct{}{}
+		}
+	}
+	return func(input string, idx int) bool {
+		input = strings.TrimSpace(input)
+		if _, exact := ids[input]; exact {
+			return items[idx].Id == input
+		}
+		return strings.Contains(names[idx], strings.ToLower(input)) || strings.Contains(items[idx].Id, input)
+	}
 }
 
 // promptForWorkspaceID asks the user to manually enter a workspace ID.
diff --git a/cmd/auth/login_test.go b/cmd/auth/login_test.go
index d209c511154..026a002a158 100644
--- a/cmd/auth/login_test.go
+++ b/cmd/auth/login_test.go
@@ -15,22 +15,59 @@ import (
 	"time"
 
 	"github.com/databricks/cli/libs/auth"
+	"github.com/databricks/cli/libs/auth/storage"
+	"github.com/databricks/cli/libs/auth/u2m"
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/databrickscfg/profile"
 	"github.com/databricks/cli/libs/env"
 	"github.com/databricks/cli/libs/log"
-	"github.com/databricks/databricks-sdk-go/credentials/u2m"
-	"github.com/databricks/databricks-sdk-go/credentials/u2m/cache"
 	"github.com/spf13/cobra"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/oauth2"
 )
 
-// newTestTokenCache returns an in-memory token cache for tests so that
+// newTestStore returns an in-memory token cache for tests so that
 // discoveryLogin and other login helpers don't touch ~/.databricks/token-cache.json.
-func newTestTokenCache() cache.TokenCache {
-	return &inMemoryTokenCache{Tokens: map[string]*oauth2.Token{}}
+func newTestStore() storage.Store {
+	return &inMemoryStore{Tokens: map[string]*oauth2.Token{}}
+}
+
+type putErrorStore struct {
+	storage.Store
+	err error
+}
+
+func (s *putErrorStore) Put(string, storage.Entry) error {
+	return s.err
+}
+
+type countingStore struct {
+	storage.Store
+	putCalls int
+}
+
+func (s *countingStore) Put(key string, entry storage.Entry) error {
+	s.putCalls++
+	return s.Store.Put(key, entry)
+}
+
+func TestStoreLoginTokenDeletesStaleTokenOnFailure(t *testing.T) {
+	const profileName = "TEST"
+	inner := storage.NewMemoryStore()
+	require.NoError(t, inner.Put(profileName, storage.Entry{
+		Token: &oauth2.Token{AccessToken: "old-token"},
+	}))
+	storeErr := errors.New("put failed")
+	store := &putErrorStore{Store: inner, err: storeErr}
+	arg, err := u2m.NewProfileWorkspaceOAuthArgument("https://workspace.example.test", profileName)
+	require.NoError(t, err)
+
+	err = storeLoginToken(t.Context(), store, storage.StorageModeSecure, arg, &oauth2.Token{AccessToken: "new-token"})
+
+	assert.ErrorIs(t, err, storeErr)
+	_, err = inner.Lookup(profileName)
+	assert.ErrorIs(t, err, storage.ErrNotFound)
 }
 
 // logBuffer is a thread-safe bytes.Buffer for capturing log output in tests.
@@ -61,18 +98,10 @@ func loadTestProfile(t *testing.T, ctx context.Context, profileName string) *pro
 type fakeDiscoveryPersistentAuth struct {
 	token        *oauth2.Token
 	challengeErr error
-	tokenErr     error
 }
 
-func (f *fakeDiscoveryPersistentAuth) Challenge() error {
-	return f.challengeErr
-}
-
-func (f *fakeDiscoveryPersistentAuth) Token() (*oauth2.Token, error) {
-	if f.tokenErr != nil {
-		return nil, f.tokenErr
-	}
-	return f.token, nil
+func (f *fakeDiscoveryPersistentAuth) Challenge() (*oauth2.Token, error) {
+	return f.token, f.challengeErr
 }
 
 func (f *fakeDiscoveryPersistentAuth) Close() error {
@@ -248,7 +277,7 @@ func TestSetWorkspaceIDForUnifiedHost(t *testing.T) {
 	assert.NoError(t, err)
 	assert.Equal(t, "https://unified.databricks.com", authArguments.Host)
 	assert.Equal(t, "test-unified-account", authArguments.AccountID)
-	assert.Equal(t, "", authArguments.WorkspaceID) // Empty is valid for account-level access
+	assert.Empty(t, authArguments.WorkspaceID) // Empty is valid for account-level access
 
 	// Test workspace_id is optional - should default to empty when no profile exists
 	authArguments = auth.AuthArguments{
@@ -259,7 +288,7 @@ func TestSetWorkspaceIDForUnifiedHost(t *testing.T) {
 	assert.NoError(t, err)
 	assert.Equal(t, "https://unified.databricks.com", authArguments.Host)
 	assert.Equal(t, "test-unified-account", authArguments.AccountID)
-	assert.Equal(t, "", authArguments.WorkspaceID) // Empty is valid for account-level access
+	assert.Empty(t, authArguments.WorkspaceID) // Empty is valid for account-level access
 }
 
 func TestLoadProfileByNameAndClusterID(t *testing.T) {
@@ -458,12 +487,75 @@ func TestSplitScopes(t *testing.T) {
 	}
 }
 
+func TestU2MClientIDFromProfile(t *testing.T) {
+	tests := []struct {
+		name    string
+		profile *profile.Profile
+		want    string
+	}{
+		{name: "no profile"},
+		{
+			name:    "implicit auth type",
+			profile: &profile.Profile{ClientID: "custom-client-id"},
+		},
+		{
+			name:    "M2M auth type",
+			profile: &profile.Profile{AuthType: "oauth-m2m", ClientID: "custom-client-id"},
+		},
+		{
+			name:    "U2M auth type",
+			profile: &profile.Profile{AuthType: authTypeDatabricksCLI, ClientID: "custom-client-id"},
+			want:    "custom-client-id",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, u2mClientIDFromProfile(tt.profile))
+		})
+	}
+}
+
+func TestU2MResourcesFromProfile(t *testing.T) {
+	tests := []struct {
+		name    string
+		profile *profile.Profile
+		want    []string
+	}{
+		{name: "no profile"},
+		{
+			name:    "implicit auth type",
+			profile: &profile.Profile{Resources: "https://workspace.test/ai-gateway/mcp/system.ai.github"},
+		},
+		{
+			name:    "M2M auth type",
+			profile: &profile.Profile{AuthType: "oauth-m2m", Resources: "https://workspace.test/ai-gateway/mcp/system.ai.github"},
+		},
+		{
+			name:    "U2M auth type single resource",
+			profile: &profile.Profile{AuthType: authTypeDatabricksCLI, Resources: "https://workspace.test/ai-gateway/mcp/system.ai.github"},
+			want:    []string{"https://workspace.test/ai-gateway/mcp/system.ai.github"},
+		},
+		{
+			name:    "U2M auth type multiple resources",
+			profile: &profile.Profile{AuthType: authTypeDatabricksCLI, Resources: "https://workspace.test/ai-gateway/mcp/system.ai.github, https://workspace.test/ai-gateway/mcp/system.ai.slack"},
+			want:    []string{"https://workspace.test/ai-gateway/mcp/system.ai.github", "https://workspace.test/ai-gateway/mcp/system.ai.slack"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, u2mResourcesFromProfile(tt.profile))
+		})
+	}
+}
+
 func TestRunHostDiscovery_NoHost(t *testing.T) {
 	ctx := t.Context()
 	args := &auth.AuthArguments{}
 	runHostDiscovery(ctx, args)
-	assert.Equal(t, "", args.AccountID)
-	assert.Equal(t, "", args.WorkspaceID)
+	assert.Empty(t, args.AccountID)
+	assert.Empty(t, args.WorkspaceID)
 }
 
 func TestRunHostDiscovery_ExplicitFieldsNotOverridden(t *testing.T) {
@@ -525,7 +617,7 @@ func TestRunHostDiscovery_ClassicWorkspaceDoesNotSetAccountID(t *testing.T) {
 	runHostDiscovery(ctx, args)
 
 	// Only workspace_id is set; account_id stays empty since discovery didn't return it.
-	assert.Equal(t, "", args.AccountID)
+	assert.Empty(t, args.AccountID)
 	assert.Equal(t, "12345", args.WorkspaceID)
 }
 
@@ -543,7 +635,101 @@ func TestSetHostAndAccountId_WorkspaceIDNoneSentinelInherited(t *testing.T) {
 	}
 	err := setHostAndAccountId(ctx, skipProfile, &args, []string{})
 	assert.NoError(t, err)
-	assert.Equal(t, auth.WorkspaceIDNone, args.WorkspaceID)
+	assert.Equal(t, profile.WorkspaceIDNone, args.WorkspaceID)
+}
+
+func TestShouldPromptWorkspace(t *testing.T) {
+	t.Setenv("DATABRICKS_CONFIG_FILE", "./testdata/.databrickscfg")
+	ctx, _ := cmdio.SetupTest(t.Context(), cmdio.TestOptions{})
+
+	legacyAccountProfile := loadTestProfile(t, ctx, "spog-skip-workspace")
+	newAccountProfile := loadTestProfile(t, ctx, "spog-skip-workspace-new")
+	workspaceProfile := loadTestProfile(t, ctx, "unified-workspace")
+
+	tests := []struct {
+		name            string
+		authArguments   auth.AuthArguments
+		existingProfile *profile.Profile
+		skipWorkspace   bool
+		want            bool
+	}{
+		{
+			name:          "no profile, account_id set, no workspace_id",
+			authArguments: auth.AuthArguments{AccountID: "acc"},
+			want:          true,
+		},
+		{
+			name:          "classic account console host never prompts",
+			authArguments: auth.AuthArguments{Host: "https://accounts.test", AccountID: "acc"},
+			want:          false,
+		},
+		{
+			name:          "classic account console host without scheme never prompts",
+			authArguments: auth.AuthArguments{Host: "accounts.test", AccountID: "acc"},
+			want:          false,
+		},
+		{
+			name:          "accounts-dod host never prompts",
+			authArguments: auth.AuthArguments{Host: "https://accounts-dod.test", AccountID: "acc"},
+			want:          false,
+		},
+		{
+			name:          "workspace host with account_id prompts",
+			authArguments: auth.AuthArguments{Host: "https://myworkspace.test", AccountID: "acc"},
+			want:          true,
+		},
+		{
+			name:          "classic account console host with workspace_id set never prompts",
+			authArguments: auth.AuthArguments{Host: "https://accounts.test", AccountID: "acc", WorkspaceID: "12345"},
+			want:          false,
+		},
+		{
+			name:            "re-login into legacy account-only profile (workspace_id = none)",
+			authArguments:   auth.AuthArguments{AccountID: "spog-account"},
+			existingProfile: legacyAccountProfile,
+			want:            false,
+		},
+		{
+			name:            "re-login into new account-only profile (no workspace_id key)",
+			authArguments:   auth.AuthArguments{AccountID: "spog-account"},
+			existingProfile: newAccountProfile,
+			want:            false,
+		},
+		{
+			name:            "re-login into workspace profile prompts when workspace_id missing from args",
+			authArguments:   auth.AuthArguments{AccountID: "test-unified-account"},
+			existingProfile: workspaceProfile,
+			want:            true,
+		},
+		{
+			name:            "account-only profile for a different account still prompts",
+			authArguments:   auth.AuthArguments{AccountID: "different-account"},
+			existingProfile: legacyAccountProfile,
+			want:            true,
+		},
+		{
+			name:          "skipWorkspace suppresses the prompt",
+			authArguments: auth.AuthArguments{AccountID: "acc"},
+			skipWorkspace: true,
+			want:          false,
+		},
+		{
+			name:          "no account_id means no prompt",
+			authArguments: auth.AuthArguments{},
+			want:          false,
+		},
+		{
+			name:          "workspace_id already known means no prompt",
+			authArguments: auth.AuthArguments{AccountID: "acc", WorkspaceID: "12345"},
+			want:          false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := shouldPromptWorkspace(&tt.authArguments, tt.existingProfile, tt.skipWorkspace)
+			assert.Equal(t, tt.want, got)
+		})
+	}
 }
 
 func TestSetHostAndAccountId_URLParamsOverrideProfile(t *testing.T) {
@@ -564,6 +750,55 @@ func TestSetHostAndAccountId_URLParamsOverrideProfile(t *testing.T) {
 	assert.Equal(t, "99999", args.WorkspaceID)
 }
 
+func TestGetProfileName(t *testing.T) {
+	tests := []struct {
+		name string
+		args *auth.AuthArguments
+		want string
+	}{
+		{
+			name: "account id set",
+			args: &auth.AuthArguments{Host: "https://db-deco-test.databricks.com", AccountID: "abc-123"},
+			want: "ACCOUNT-abc-123",
+		},
+		{
+			name: "no account id falls back to host",
+			args: &auth.AuthArguments{Host: "https://db-deco-test.databricks.com"},
+			want: "db-deco-test",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, getProfileName(tt.args))
+		})
+	}
+}
+
+// TestSkipWorkspaceProfileNameUsesDiscoveredAccountID verifies that the
+// pre-naming discovery block populates AccountID from .well-known so the
+// profile-name prompt suggests ACCOUNT-<account-id> instead of the host-based
+// default.
+func TestSkipWorkspaceProfileNameUsesDiscoveredAccountID(t *testing.T) {
+	server := newDiscoveryServer(t, map[string]any{
+		"account_id":    "abc-123",
+		"oidc_endpoint": "https://spog.example.com/oidc/accounts/abc-123",
+	})
+
+	ctx := t.Context()
+	args := &auth.AuthArguments{Host: server.URL}
+
+	// Mirrors the pre-naming block in newLoginCommand's RunE for --skip-workspace.
+	params := auth.ExtractHostQueryParams(args.Host)
+	args.Host = params.Host
+	if args.AccountID == "" {
+		args.AccountID = params.AccountID
+	}
+	runHostDiscovery(ctx, args)
+
+	assert.Equal(t, "abc-123", args.AccountID)
+	assert.Equal(t, "ACCOUNT-abc-123", getProfileName(args))
+}
+
 func TestValidateDiscoveryFlagCompatibility(t *testing.T) {
 	tests := []struct {
 		name    string
@@ -595,6 +830,12 @@ func TestValidateDiscoveryFlagCompatibility(t *testing.T) {
 			flagVal: "true",
 			wantErr: "--configure-serverless requires --host to be specified",
 		},
+		{
+			name:    "resource is incompatible",
+			setFlag: "resource",
+			flagVal: "https://workspace.test/ai-gateway/mcp-services/system.ai.github",
+			wantErr: "--resource requires --host to be specified",
+		},
 		{
 			name: "no flags set is ok",
 		},
@@ -606,6 +847,7 @@ func TestValidateDiscoveryFlagCompatibility(t *testing.T) {
 			cmd.Flags().String("workspace-id", "", "")
 			cmd.Flags().Bool("configure-cluster", false, "")
 			cmd.Flags().Bool("configure-serverless", false, "")
+			cmd.Flags().StringArray("resource", nil, "")
 
 			if tt.setFlag != "" {
 				require.NoError(t, cmd.Flags().Set(tt.setFlag, tt.flagVal))
@@ -647,7 +889,7 @@ func TestDiscoveryLogin_IntrospectionFailureStillSavesProfile(t *testing.T) {
 		timeout:     time.Second,
 		scopes:      "all-apis, ,sql,",
 		browserFunc: func(string) error { return nil },
-		tokenCache:  newTestTokenCache(),
+		tokenStore:  newTestStore(),
 	})
 	require.NoError(t, err)
 
@@ -663,6 +905,38 @@ func TestDiscoveryLogin_IntrospectionFailureStillSavesProfile(t *testing.T) {
 	assert.Empty(t, savedProfile.WorkspaceID)
 }
 
+func TestDiscoveryLogin_ProfileSaveFailureDoesNotStoreToken(t *testing.T) {
+	tmpDir := t.TempDir()
+	parentFile := filepath.Join(tmpDir, "not-a-directory")
+	require.NoError(t, os.WriteFile(parentFile, nil, 0o600))
+	t.Setenv("DATABRICKS_CONFIG_FILE", filepath.Join(parentFile, ".databrickscfg"))
+
+	oauthArg, err := u2m.NewBasicDiscoveryOAuthArgument("DISCOVERY")
+	require.NoError(t, err)
+	oauthArg.SetDiscoveredHost("https://workspace.example.test")
+
+	dc := &fakeDiscoveryClient{
+		oauthArg: oauthArg,
+		persistentAuth: &fakeDiscoveryPersistentAuth{
+			token: &oauth2.Token{AccessToken: "test-token"},
+		},
+		introspectionErr: errors.New("introspection failed"),
+	}
+	store := &countingStore{Store: storage.NewMemoryStore()}
+
+	ctx, _ := cmdio.NewTestContextWithStdout(t.Context())
+	err = discoveryLogin(ctx, discoveryLoginInputs{
+		dc:          dc,
+		profileName: "DISCOVERY",
+		timeout:     time.Second,
+		browserFunc: func(string) error { return nil },
+		tokenStore:  store,
+	})
+
+	require.ErrorContains(t, err, "saving profile")
+	assert.Zero(t, store.putCalls)
+}
+
 func TestDiscoveryLogin_AccountIDMismatchWarning(t *testing.T) {
 	tmpDir := t.TempDir()
 	configPath := filepath.Join(tmpDir, ".databrickscfg")
@@ -702,7 +976,7 @@ func TestDiscoveryLogin_AccountIDMismatchWarning(t *testing.T) {
 		timeout:         time.Second,
 		existingProfile: existingProfile,
 		browserFunc:     func(string) error { return nil },
-		tokenCache:      newTestTokenCache(),
+		tokenStore:      newTestStore(),
 	})
 	require.NoError(t, err)
 
@@ -757,7 +1031,7 @@ func TestDiscoveryLogin_NoWarningWhenAccountIDsMatch(t *testing.T) {
 		timeout:         time.Second,
 		existingProfile: existingProfile,
 		browserFunc:     func(string) error { return nil },
-		tokenCache:      newTestTokenCache(),
+		tokenStore:      newTestStore(),
 	})
 	require.NoError(t, err)
 
@@ -783,7 +1057,7 @@ func TestDiscoveryLogin_EmptyDiscoveredHostReturnsError(t *testing.T) {
 		profileName: "DISCOVERY",
 		timeout:     time.Second,
 		browserFunc: func(string) error { return nil },
-		tokenCache:  newTestTokenCache(),
+		tokenStore:  newTestStore(),
 	})
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "no workspace host was discovered")
@@ -809,9 +1083,11 @@ func TestDiscoveryLogin_ReloginPreservesExistingProfileScopes(t *testing.T) {
 	}
 
 	existingProfile := &profile.Profile{
-		Name:   "DISCOVERY",
-		Host:   "https://old-workspace.example.com",
-		Scopes: "sql,clusters",
+		Name:     "DISCOVERY",
+		Host:     "https://old-workspace.example.com",
+		Scopes:   "sql,clusters",
+		AuthType: authTypeDatabricksCLI,
+		ClientID: "custom-client-id",
 	}
 
 	// No --scopes flag (empty string), should fall back to existing profile scopes.
@@ -820,9 +1096,10 @@ func TestDiscoveryLogin_ReloginPreservesExistingProfileScopes(t *testing.T) {
 		dc:              dc,
 		profileName:     "DISCOVERY",
 		timeout:         time.Second,
+		clientID:        existingProfile.ClientID,
 		existingProfile: existingProfile,
 		browserFunc:     func(string) error { return nil },
-		tokenCache:      newTestTokenCache(),
+		tokenStore:      newTestStore(),
 	})
 	require.NoError(t, err)
 
@@ -831,6 +1108,51 @@ func TestDiscoveryLogin_ReloginPreservesExistingProfileScopes(t *testing.T) {
 	require.NotNil(t, savedProfile)
 	assert.Equal(t, "https://workspace.example.com", savedProfile.Host)
 	assert.Equal(t, "sql,clusters", savedProfile.Scopes)
+	assert.Equal(t, "custom-client-id", savedProfile.ClientID)
+}
+
+func TestDiscoveryLogin_ExplicitClientIDOverridesExistingProfile(t *testing.T) {
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, ".databrickscfg")
+	err := os.WriteFile(configPath, []byte(""), 0o600)
+	require.NoError(t, err)
+	t.Setenv("DATABRICKS_CONFIG_FILE", configPath)
+
+	oauthArg, err := u2m.NewBasicDiscoveryOAuthArgument("DISCOVERY")
+	require.NoError(t, err)
+	oauthArg.SetDiscoveredHost("https://workspace.example.com")
+
+	dc := &fakeDiscoveryClient{
+		oauthArg: oauthArg,
+		persistentAuth: &fakeDiscoveryPersistentAuth{
+			token: &oauth2.Token{AccessToken: "test-token"},
+		},
+		introspectionErr: errors.New("introspection failed"),
+	}
+
+	existingProfile := &profile.Profile{
+		Name:     "DISCOVERY",
+		Host:     "https://old-workspace.example.com",
+		AuthType: authTypeDatabricksCLI,
+		ClientID: "profile-client-id",
+	}
+
+	ctx, _ := cmdio.NewTestContextWithStdout(t.Context())
+	err = discoveryLogin(ctx, discoveryLoginInputs{
+		dc:              dc,
+		profileName:     "DISCOVERY",
+		timeout:         time.Second,
+		clientID:        "flag-client-id",
+		existingProfile: existingProfile,
+		browserFunc:     func(string) error { return nil },
+		tokenStore:      newTestStore(),
+	})
+	require.NoError(t, err)
+
+	savedProfile, err := loadProfileByName(ctx, "DISCOVERY", profile.DefaultProfiler)
+	require.NoError(t, err)
+	require.NotNil(t, savedProfile)
+	assert.Equal(t, "flag-client-id", savedProfile.ClientID)
 }
 
 func TestDiscoveryLogin_ExplicitScopesOverrideExistingProfile(t *testing.T) {
@@ -867,7 +1189,7 @@ func TestDiscoveryLogin_ExplicitScopesOverrideExistingProfile(t *testing.T) {
 		scopes:          "all-apis",
 		existingProfile: existingProfile,
 		browserFunc:     func(string) error { return nil },
-		tokenCache:      newTestTokenCache(),
+		tokenStore:      newTestStore(),
 	})
 	require.NoError(t, err)
 
@@ -913,7 +1235,7 @@ func TestDiscoveryLogin_SPOGHostPopulatesAccountIDFromDiscovery(t *testing.T) {
 		profileName: "DISCOVERY",
 		timeout:     time.Second,
 		browserFunc: func(string) error { return nil },
-		tokenCache:  newTestTokenCache(),
+		tokenStore:  newTestStore(),
 	})
 	require.NoError(t, err)
 
@@ -954,7 +1276,7 @@ func TestDiscoveryLogin_IntrospectionFallsBackWhenDiscoveryFails(t *testing.T) {
 		profileName: "DISCOVERY",
 		timeout:     time.Second,
 		browserFunc: func(string) error { return nil },
-		tokenCache:  newTestTokenCache(),
+		tokenStore:  newTestStore(),
 	})
 	require.NoError(t, err)
 
@@ -1009,7 +1331,7 @@ auth_type = databricks-cli
 		timeout:         time.Second,
 		existingProfile: existingProfile,
 		browserFunc:     func(string) error { return nil },
-		tokenCache:      newTestTokenCache(),
+		tokenStore:      newTestStore(),
 	})
 	require.NoError(t, err)
 
@@ -1070,7 +1392,7 @@ auth_type = databricks-cli
 		timeout:         time.Second,
 		existingProfile: existingProfile,
 		browserFunc:     func(string) error { return nil },
-		tokenCache:      newTestTokenCache(),
+		tokenStore:      newTestStore(),
 	})
 	require.NoError(t, err)
 
@@ -1082,6 +1404,40 @@ auth_type = databricks-cli
 	assert.Equal(t, "222222", savedProfile.WorkspaceID, "workspace_id should be updated to fresh introspection value")
 }
 
+func TestDiscoveryLogin_OverridesHostFromEnv(t *testing.T) {
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, ".databrickscfg")
+	err := os.WriteFile(configPath, []byte(""), 0o600)
+	require.NoError(t, err)
+	t.Setenv("DATABRICKS_CONFIG_FILE", configPath)
+
+	oauthArg, err := u2m.NewBasicDiscoveryOAuthArgument("DISCOVERY")
+	require.NoError(t, err)
+	oauthArg.SetDiscoveredHost("https://workspace.example.com")
+
+	dc := &fakeDiscoveryClient{
+		oauthArg: oauthArg,
+		persistentAuth: &fakeDiscoveryPersistentAuth{
+			token: &oauth2.Token{AccessToken: "test-token"},
+		},
+		introspectionErr: errors.New("introspection failed"),
+	}
+
+	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
+	ctx = env.Set(ctx, "DATABRICKS_DISCOVERY_HOST", "https://login.staging.test")
+	err = discoveryLogin(ctx, discoveryLoginInputs{
+		dc:          dc,
+		profileName: "DISCOVERY",
+		timeout:     time.Second,
+		browserFunc: func(string) error { return nil },
+		tokenStore:  newTestStore(),
+	})
+	require.NoError(t, err)
+
+	assert.Contains(t, stderr.String(), "Opening https://login.staging.test in your browser...")
+	assert.NotContains(t, stderr.String(), "Opening login.databricks.com in your browser...")
+}
+
 func TestLoginRejectsPositionalArgWithHostFlag(t *testing.T) {
 	ctx := cmdio.MockDiscard(t.Context())
 	authArgs := &auth.AuthArguments{Host: "https://example.com"}
diff --git a/cmd/auth/login_workspace_test.go b/cmd/auth/login_workspace_test.go
new file mode 100644
index 00000000000..b3b83ce1d19
--- /dev/null
+++ b/cmd/auth/login_workspace_test.go
@@ -0,0 +1,264 @@
+package auth_test
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	authcmd "github.com/databricks/cli/cmd/auth"
+	"github.com/databricks/cli/libs/auth"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/databricks/databricks-sdk-go/service/provisioning"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/oauth2"
+)
+
+const (
+	workspaceTestAccountID = "test-account"
+	workspaceTestToken     = "test-token"
+	workspaceSkipLabel     = "Skip (account-level access only)"
+	workspacePickerLabel   = "Select a workspace"
+	workspaceIDPrompt      = "Enter workspace ID (empty to skip)"
+)
+
+func TestWorkspaceSearcher(t *testing.T) {
+	items := []cmdio.Tuple{
+		{Name: "Analytics", Id: "1234"},
+		{Name: "Report 123", Id: "99"},
+		{Name: "Production", Id: "123"},
+		{Name: "Shared", Id: "887766"},
+		{Name: "Shared", Id: "778899"},
+		{Name: "", Id: "40"},
+		{Name: "\u00c5ngstr\u00f6m", Id: "9007199254740993"},
+		{Name: "Skip Analytics", Id: "0"},
+		{Name: workspaceSkipLabel, Id: ""},
+	}
+	search := authcmd.NewWorkspaceSearcher(items)
+	for _, tc := range []struct {
+		name  string
+		query string
+		want  []int
+	}{
+		{name: "empty", want: []int{0, 1, 2, 3, 4, 5, 6, 7, 8}},
+		{name: "whitespace", query: " \t ", want: []int{0, 1, 2, 3, 4, 5, 6, 7, 8}},
+		{name: "name", query: "aNaLyT", want: []int{0, 7}},
+		{name: "trim name", query: "  Production  ", want: []int{2}},
+		{name: "partial id", query: "887", want: []int{3}},
+		{name: "partial name or id", query: "12", want: []int{0, 1, 2}},
+		{name: "exact id beats longer id and numeric name", query: "123", want: []int{2}},
+		{name: "trim exact id", query: "\t123 ", want: []int{2}},
+		{name: "duplicate names", query: "shared", want: []int{3, 4}},
+		{name: "duplicate name by id", query: "778899", want: []int{4}},
+		{name: "empty name", query: "40", want: []int{5}},
+		{name: "non ascii name", query: "\u00e5NGSTR\u00d6M", want: []int{6}},
+		{name: "large id", query: "9007199254740993", want: []int{6}},
+		{name: "zero id is not skip", query: "0", want: []int{7}},
+		{name: "skip stays last", query: "sKiP", want: []int{7, 8}},
+		{name: "skip by label", query: "account-level", want: []int{8}},
+		{name: "missing name", query: "not-a-workspace"},
+		{name: "missing id", query: "555555"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var matches []int
+			for i := range items {
+				if search(tc.query, i) {
+					matches = append(matches, i)
+				}
+			}
+			assert.Equal(t, tc.want, matches)
+		})
+	}
+}
+
+func TestPromptForWorkspaceSelection(t *testing.T) {
+	workspaces := make([]provisioning.Workspace, 60)
+	for i := range workspaces {
+		workspaces[i] = provisioning.Workspace{
+			WorkspaceId:   int64(1000 + i),
+			WorkspaceName: fmt.Sprintf("Workspace %c%c", 'A'+i/26, 'A'+i%26),
+		}
+	}
+	workspaces[59] = provisioning.Workspace{WorkspaceId: 9007199254740993, WorkspaceName: "Target Workspace"}
+
+	for _, tc := range []struct {
+		name       string
+		workspaces []provisioning.Workspace
+		input      string
+		want       string
+	}{
+		{name: "id beyond first fifty", workspaces: workspaces, input: "9007199254740993", want: "9007199254740993"},
+		{name: "name beyond first fifty", workspaces: workspaces, input: "tArGeT", want: "9007199254740993"},
+		{
+			name: "exact id precedence",
+			workspaces: []provisioning.Workspace{
+				{WorkspaceId: 1234, WorkspaceName: "Longer ID"},
+				{WorkspaceId: 99, WorkspaceName: "Report 123"},
+				{WorkspaceId: 123, WorkspaceName: "Exact ID"},
+			},
+			input: " 123 ", want: "123",
+		},
+		{
+			name: "duplicate names",
+			workspaces: []provisioning.Workspace{
+				{WorkspaceId: 111, WorkspaceName: "Shared"},
+				{WorkspaceId: 222, WorkspaceName: "Shared"},
+			},
+			input: "222", want: "222",
+		},
+		{
+			name: "empty name",
+			workspaces: []provisioning.Workspace{
+				{WorkspaceId: 111, WorkspaceName: "Named"},
+				{WorkspaceId: 222},
+			},
+			input: "222", want: "222",
+		},
+		{
+			name: "workspace before skip",
+			workspaces: []provisioning.Workspace{
+				{WorkspaceId: 111, WorkspaceName: "Named"},
+				{WorkspaceId: 222, WorkspaceName: "Skip Analytics"},
+			},
+			input: "skip", want: "222",
+		},
+		{name: "skip", workspaces: workspaces, input: "skip", want: ""},
+		{name: "whitespace preserves API order", workspaces: workspaces, input: "  ", want: "1000"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			args, requests := newWorkspaceListServer(t, http.StatusOK, tc.workspaces)
+			tm := termtest.Run(t, func(ctx context.Context) (string, error) {
+				return authcmd.PromptForWorkspaceSelection(ctx, args, oauth2.StaticTokenSource(&oauth2.Token{AccessToken: workspaceTestToken}))
+			})
+			tm.WaitFor(workspacePickerLabel)
+			tm.Type(tc.input + termtest.KeyEnter)
+			id, err := tm.Result()
+			require.NoError(t, err)
+			assert.Equal(t, tc.want, id)
+			assert.EqualValues(t, 1, requests.Load())
+			assert.NotContains(t, tm.Raw(), workspaceIDPrompt)
+			assert.NotContains(t, tm.Raw(), "Showing first")
+		})
+	}
+}
+
+func TestPromptForWorkspaceSelectionNoResults(t *testing.T) {
+	args, requests := newWorkspaceListServer(t, http.StatusOK, []provisioning.Workspace{
+		{WorkspaceId: 111, WorkspaceName: "Alpha"},
+		{WorkspaceId: 222, WorkspaceName: "Beta"},
+		{WorkspaceId: 333},
+	})
+	tm := termtest.Run(t, func(ctx context.Context) (string, error) {
+		return authcmd.PromptForWorkspaceSelection(ctx, args, oauth2.StaticTokenSource(&oauth2.Token{AccessToken: workspaceTestToken}))
+	})
+	tm.WaitFor(workspacePickerLabel)
+	tm.Golden("01-initial")
+
+	tm.Type("999999")
+	tm.WaitFor("No results")
+	tm.Type(termtest.KeyEnter)
+	tm.Type(strings.Repeat(termtest.KeyBackspace, 6))
+	require.Eventually(t, func() bool {
+		return strings.Contains(tm.Snapshot(), workspaceSkipLabel) && !strings.Contains(tm.Snapshot(), "No results")
+	}, 5*time.Second, 5*time.Millisecond)
+	tm.Type(termtest.KeyDown + termtest.KeyEnter)
+	id, err := tm.Result()
+	require.NoError(t, err)
+	assert.Equal(t, "222", id)
+	assert.EqualValues(t, 1, requests.Load())
+}
+
+func TestPromptForWorkspaceSelectionWithoutPicker(t *testing.T) {
+	for _, tc := range []struct {
+		name       string
+		workspaces []provisioning.Workspace
+		want       string
+		message    string
+	}{
+		{name: "no workspaces", workspaces: []provisioning.Workspace{}},
+		{
+			name:       "one workspace",
+			workspaces: []provisioning.Workspace{{WorkspaceId: 123, WorkspaceName: "Only Workspace"}},
+			want:       "123",
+			message:    `Auto-selected workspace "Only Workspace" (123)`,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			args, requests := newWorkspaceListServer(t, http.StatusOK, tc.workspaces)
+			var output bytes.Buffer
+			ctx := cmdio.InContext(t.Context(), cmdio.NewTestIO(strings.NewReader(""), io.Discard, &output))
+			id, err := authcmd.PromptForWorkspaceSelection(ctx, args, oauth2.StaticTokenSource(&oauth2.Token{AccessToken: workspaceTestToken}))
+			require.NoError(t, err)
+			assert.Equal(t, tc.want, id)
+			assert.EqualValues(t, 1, requests.Load())
+			assert.Contains(t, output.String(), tc.message)
+			assert.NotContains(t, output.String(), workspacePickerLabel)
+			assert.NotContains(t, output.String(), workspaceIDPrompt)
+		})
+	}
+}
+
+func TestPromptForWorkspaceSelectionNonInteractive(t *testing.T) {
+	args, requests := newWorkspaceListServer(t, http.StatusOK, nil)
+	ctx, output := cmdio.NewTestContextWithStderr(t.Context())
+	id, err := authcmd.PromptForWorkspaceSelection(ctx, args, oauth2.StaticTokenSource(&oauth2.Token{AccessToken: workspaceTestToken}))
+	require.NoError(t, err)
+	assert.Empty(t, id)
+	assert.Zero(t, requests.Load())
+	assert.Contains(t, output.String(), "set workspace_id in your profile")
+}
+
+func TestPromptForWorkspaceSelectionListError(t *testing.T) {
+	for _, input := range []string{" 123456 ", ""} {
+		t.Run(input, func(t *testing.T) {
+			args, requests := newWorkspaceListServer(t, http.StatusForbidden, nil)
+			tm := termtest.Run(t, func(ctx context.Context) (string, error) {
+				return authcmd.PromptForWorkspaceSelection(ctx, args, oauth2.StaticTokenSource(&oauth2.Token{AccessToken: workspaceTestToken}))
+			})
+			tm.WaitFor(workspaceIDPrompt)
+			tm.Type(input + termtest.KeyEnter)
+			id, err := tm.Result()
+			require.NoError(t, err)
+			assert.Equal(t, strings.TrimSpace(input), id)
+			assert.EqualValues(t, 1, requests.Load())
+			assert.NotContains(t, tm.Raw(), workspacePickerLabel)
+		})
+	}
+}
+
+// newWorkspaceListServer exercises the SDK's actual list decoding without a live account.
+func newWorkspaceListServer(t *testing.T, status int, workspaces []provisioning.Workspace) (*auth.AuthArguments, *atomic.Int32) {
+	t.Helper()
+	// A developer's DATABRICKS_CONFIG_PROFILE would make the SDK client load
+	// ~/.databrickscfg and fail on a missing profile. Clearing the whole
+	// environment instead breaks sockets on Windows, which needs SystemRoot.
+	t.Setenv("DATABRICKS_CONFIG_PROFILE", "")
+	body, err := json.Marshal(workspaces)
+	require.NoError(t, err)
+	if status != http.StatusOK {
+		body = []byte(`{"error_code":"PERMISSION_DENIED","message":"Account access denied"}`)
+	}
+	requests := new(atomic.Int32)
+	mux := http.NewServeMux()
+	mux.HandleFunc("GET /api/2.0/accounts/"+workspaceTestAccountID+"/workspaces", func(w http.ResponseWriter, r *http.Request) {
+		requests.Add(1)
+		assert.Empty(t, r.URL.RawQuery)
+		assert.Equal(t, "Bearer "+workspaceTestToken, r.Header.Get("Authorization"))
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(status)
+		_, err := w.Write(body)
+		assert.NoError(t, err)
+	})
+	server := httptest.NewServer(mux)
+	t.Cleanup(server.Close)
+	return &auth.AuthArguments{Host: server.URL, AccountID: workspaceTestAccountID}, requests
+}
diff --git a/cmd/auth/logout.go b/cmd/auth/logout.go
index a8cd14be0a4..d1d559b0a60 100644
--- a/cmd/auth/logout.go
+++ b/cmd/auth/logout.go
@@ -28,7 +28,6 @@ import (
 	"github.com/databricks/cli/libs/databrickscfg/profile"
 	"github.com/databricks/cli/libs/env"
 	"github.com/databricks/databricks-sdk-go/config"
-	"github.com/databricks/databricks-sdk-go/credentials/u2m/cache"
 	"github.com/spf13/cobra"
 )
 
@@ -119,21 +118,23 @@ to specify it explicitly.
 			if err != nil {
 				return err
 			}
-			selected, err := profile.SelectProfile(ctx, profile.SelectConfig{
-				Label:             "Select a profile to log out of",
-				Profiles:          allProfiles,
-				StartInSearchMode: len(allProfiles) > 5,
-				ActiveTemplate:    `▸ {{.PaddedName | bold}}{{if .AccountID}} (account: {{.AccountID}}){{else}} ({{.Host}}){{end}}`,
-				InactiveTemplate:  `  {{.PaddedName}}{{if .AccountID}} (account: {{.AccountID | faint}}){{else}} ({{.Host | faint}}){{end}}`,
-				SelectedTemplate:  `{{ "Selected profile" | faint }}: {{ .Name | bold }}`,
+			currentDefault, _ := databrickscfg.GetDefaultProfile(ctx, env.Get(ctx, "DATABRICKS_CONFIG_FILE"))
+			result, selected, err := pickAuthProfile(ctx, allProfiles, profilePickerOptions{
+				Label:        "Select a profile to log out of",
+				SelectedNoun: "Selected profile",
+				Default:      currentDefault,
 			})
 			if err != nil {
 				return err
 			}
+			// Without IncludeExtras, the picker only returns profile selections.
+			if result != profilePickerProfile {
+				return fmt.Errorf("unexpected picker result: %v", result)
+			}
 			profileName = selected
 		}
 
-		tokenCache, _, err := storage.ResolveCache(ctx, "")
+		tokenStore, _, err := storage.ResolveStore(ctx, "")
 		if err != nil {
 			return fmt.Errorf("failed to open token cache: %w", err)
 		}
@@ -143,7 +144,7 @@ to specify it explicitly.
 			autoApprove:    autoApprove,
 			deleteProfile:  deleteProfile,
 			profiler:       profiler,
-			tokenCache:     tokenCache,
+			tokenStore:     tokenStore,
 			configFilePath: env.Get(ctx, "DATABRICKS_CONFIG_FILE"),
 		})
 	}
@@ -156,7 +157,7 @@ type logoutArgs struct {
 	autoApprove    bool
 	deleteProfile  bool
 	profiler       profile.Profiler
-	tokenCache     cache.TokenCache
+	tokenStore     storage.Store
 	configFilePath string
 }
 
@@ -205,7 +206,7 @@ func runLogout(ctx context.Context, args logoutArgs) error {
 	// Otherwise, we could be deleting profiles that were created by other means (e.g. manually).
 	isCreatedByLogin := matchedProfile.AuthType == "databricks-cli"
 	if isCreatedByLogin {
-		err = clearTokenCache(ctx, *matchedProfile, args.profiler, args.tokenCache)
+		err = clearTokenStore(ctx, *matchedProfile, args.profiler, args.tokenStore)
 		if err != nil {
 			return fmt.Errorf("failed to clear token cache: %w", err)
 		}
@@ -261,15 +262,15 @@ func getMatchingProfile(ctx context.Context, profileName string, profiler profil
 	return &profiles[0], nil
 }
 
-// clearTokenCache removes cached OAuth tokens for the given profile from the
+// clearTokenStore removes cached OAuth tokens for the given profile from the
 // token cache. It removes:
 //  1. The entry keyed by the profile name.
 //  2. The entry keyed by the host-based cache key, but only if no other
 //     remaining profile references the same key. For account and unified
 //     profiles, the cache key includes the OIDC path
 //     (host/oidc/accounts/<account_id>).
-func clearTokenCache(ctx context.Context, p profile.Profile, profiler profile.Profiler, tokenCache cache.TokenCache) error {
-	if err := tokenCache.Store(p.Name, nil); err != nil {
+func clearTokenStore(ctx context.Context, p profile.Profile, profiler profile.Profiler, tokenStore storage.Store) error {
+	if err := tokenStore.Delete(p.Name); err != nil {
 		return fmt.Errorf("failed to delete profile-keyed token for profile %q: %w", p.Name, err)
 	}
 
@@ -289,7 +290,7 @@ func clearTokenCache(ctx context.Context, p profile.Profile, profiler profile.Pr
 	}
 
 	if len(otherProfiles) == 0 {
-		if err := tokenCache.Store(hostCacheKey, nil); err != nil {
+		if err := tokenStore.Delete(hostCacheKey); err != nil {
 			return fmt.Errorf("failed to delete host-keyed token for %q: %w", hostCacheKey, err)
 		}
 	}
diff --git a/cmd/auth/logout_test.go b/cmd/auth/logout_test.go
index c9007e4a5f7..366b2cc4e4e 100644
--- a/cmd/auth/logout_test.go
+++ b/cmd/auth/logout_test.go
@@ -164,7 +164,7 @@ func TestLogout(t *testing.T) {
 			configPath := writeTempConfig(t, logoutTestConfig)
 			t.Setenv("DATABRICKS_CONFIG_FILE", configPath)
 
-			tokenCache := &inMemoryTokenCache{
+			tokenStore := &inMemoryStore{
 				Tokens: copyTokens(logoutTestTokensCacheConfig),
 			}
 
@@ -173,7 +173,7 @@ func TestLogout(t *testing.T) {
 				autoApprove:    tc.autoApprove,
 				deleteProfile:  tc.deleteProfile,
 				profiler:       profile.DefaultProfiler,
-				tokenCache:     tokenCache,
+				tokenStore:     tokenStore,
 				configFilePath: configPath,
 			})
 
@@ -194,14 +194,14 @@ func TestLogout(t *testing.T) {
 			// Verify token cache state.
 			if tc.isNonU2M {
 				// Non-U2M profiles should not touch the token cache at all.
-				assert.NotNil(t, tokenCache.Tokens[tc.profileName], "expected token %q to be preserved for non-U2M profile", tc.profileName)
-				assert.NotNil(t, tokenCache.Tokens[tc.hostBasedKey], "expected token %q to be preserved for non-U2M profile", tc.hostBasedKey)
+				assert.NotNil(t, tokenStore.Tokens[tc.profileName], "expected token %q to be preserved for non-U2M profile", tc.profileName)
+				assert.NotNil(t, tokenStore.Tokens[tc.hostBasedKey], "expected token %q to be preserved for non-U2M profile", tc.hostBasedKey)
 			} else {
-				assert.Nil(t, tokenCache.Tokens[tc.profileName], "expected token %q to be removed", tc.profileName)
+				assert.Nil(t, tokenStore.Tokens[tc.profileName], "expected token %q to be removed", tc.profileName)
 				if tc.isSharedKey {
-					assert.NotNil(t, tokenCache.Tokens[tc.hostBasedKey], "expected token %q to be preserved", tc.hostBasedKey)
+					assert.NotNil(t, tokenStore.Tokens[tc.hostBasedKey], "expected token %q to be preserved", tc.hostBasedKey)
 				} else {
-					assert.Nil(t, tokenCache.Tokens[tc.hostBasedKey], "expected token %q to be removed", tc.hostBasedKey)
+					assert.Nil(t, tokenStore.Tokens[tc.hostBasedKey], "expected token %q to be removed", tc.hostBasedKey)
 				}
 			}
 		})
@@ -213,7 +213,7 @@ func TestLogoutNoTokens(t *testing.T) {
 	configPath := writeTempConfig(t, logoutTestConfig)
 	t.Setenv("DATABRICKS_CONFIG_FILE", configPath)
 
-	tokenCache := &inMemoryTokenCache{
+	tokenStore := &inMemoryStore{
 		Tokens: map[string]*oauth2.Token{},
 	}
 
@@ -221,7 +221,7 @@ func TestLogoutNoTokens(t *testing.T) {
 		profileName:    "my-workspace",
 		autoApprove:    true,
 		profiler:       profile.DefaultProfiler,
-		tokenCache:     tokenCache,
+		tokenStore:     tokenStore,
 		configFilePath: configPath,
 	})
 	require.NoError(t, err)
@@ -237,7 +237,7 @@ func TestLogoutNoTokensWithDelete(t *testing.T) {
 	configPath := writeTempConfig(t, logoutTestConfig)
 	t.Setenv("DATABRICKS_CONFIG_FILE", configPath)
 
-	tokenCache := &inMemoryTokenCache{
+	tokenStore := &inMemoryStore{
 		Tokens: map[string]*oauth2.Token{},
 	}
 
@@ -246,7 +246,7 @@ func TestLogoutNoTokensWithDelete(t *testing.T) {
 		autoApprove:    true,
 		deleteProfile:  true,
 		profiler:       profile.DefaultProfiler,
-		tokenCache:     tokenCache,
+		tokenStore:     tokenStore,
 		configFilePath: configPath,
 	})
 	require.NoError(t, err)
@@ -302,7 +302,7 @@ default_profile = my-workspace
 			configPath := writeTempConfig(t, configWithDefault)
 			t.Setenv("DATABRICKS_CONFIG_FILE", configPath)
 
-			tokenCache := &inMemoryTokenCache{
+			tokenStore := &inMemoryStore{
 				Tokens: copyTokens(logoutTestTokensCacheConfig),
 			}
 
@@ -311,7 +311,7 @@ default_profile = my-workspace
 				autoApprove:    true,
 				deleteProfile:  true,
 				profiler:       profile.DefaultProfiler,
-				tokenCache:     tokenCache,
+				tokenStore:     tokenStore,
 				configFilePath: configPath,
 			})
 			require.NoError(t, err)
@@ -360,7 +360,7 @@ auth_type = databricks-cli
 	t.Setenv("DATABRICKS_CONFIG_FILE", configPath)
 
 	hostKey := spogServer.URL + "/oidc/accounts/spog-acct"
-	tokenCache := &inMemoryTokenCache{
+	tokenStore := &inMemoryStore{
 		Tokens: map[string]*oauth2.Token{
 			"spog-profile": {AccessToken: "spog-profile-token"},
 			hostKey:        {AccessToken: "spog-host-token"},
@@ -371,13 +371,13 @@ auth_type = databricks-cli
 		profileName:    "spog-profile",
 		autoApprove:    true,
 		profiler:       profile.DefaultProfiler,
-		tokenCache:     tokenCache,
+		tokenStore:     tokenStore,
 		configFilePath: configPath,
 	})
 	require.NoError(t, err)
 
-	assert.Nil(t, tokenCache.Tokens["spog-profile"])
-	assert.Nil(t, tokenCache.Tokens[hostKey])
+	assert.Nil(t, tokenStore.Tokens["spog-profile"])
+	assert.Nil(t, tokenStore.Tokens[hostKey])
 }
 
 func TestHostCacheKeyAndMatchFn(t *testing.T) {
diff --git a/cmd/auth/profile_picker.go b/cmd/auth/profile_picker.go
new file mode 100644
index 00000000000..79fc440c566
--- /dev/null
+++ b/cmd/auth/profile_picker.go
@@ -0,0 +1,144 @@
+package auth
+
+import (
+	"context"
+	"errors"
+	"strings"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/databrickscfg/profile"
+)
+
+// profilePickerResult represents the user's choice from pickAuthProfile.
+type profilePickerResult int
+
+const (
+	profilePickerProfile   profilePickerResult = iota // an existing profile was picked
+	profilePickerCreateNew                            // user chose "Create a new profile"
+	profilePickerEnterHost                            // user chose "Enter a host URL manually"
+)
+
+const (
+	profilePickerCreateNewLabel = "+ Create a new profile"
+	profilePickerEnterHostLabel = "→ Enter a host URL manually"
+)
+
+// profilePickerOptions configures pickAuthProfile.
+type profilePickerOptions struct {
+	// Label shown above the picker.
+	Label string
+
+	// SelectedNoun is the noun shown after selection ("Using profile",
+	// "Selected profile", "Default profile"). Defaults to "Using profile".
+	SelectedNoun string
+
+	// Default is the name of the default profile. When set, it is moved to the
+	// top of the list and decorated with "[default]".
+	Default string
+
+	// IncludeExtras appends "Create a new profile" and "Enter a host URL
+	// manually" entries after the profile list. Picker action entries are
+	// shown even when the profile list is empty.
+	IncludeExtras bool
+}
+
+// pickerItem is a single entry rendered by the picker. It can be either a real
+// profile or one of the extra action entries (Create new / Enter host).
+type pickerItem struct {
+	Name      string
+	Host      string
+	AccountID string
+	IsDefault bool
+
+	// IsExtra distinguishes action entries (Create new / Enter host) from
+	// real profiles, so a profile that happens to share a label name still
+	// resolves correctly.
+	IsExtra bool
+	Extra   profilePickerResult
+}
+
+// buildPickerItems returns the items shown by pickAuthProfile, with the default
+// profile moved to the top and the extras appended (when requested).
+func buildPickerItems(profiles profile.Profiles, defaultName string, includeExtras bool) []pickerItem {
+	defaultIdx := -1
+	if defaultName != "" {
+		for i, p := range profiles {
+			if p.Name == defaultName {
+				defaultIdx = i
+				break
+			}
+		}
+	}
+
+	itemFor := func(p profile.Profile, isDefault bool) pickerItem {
+		return pickerItem{
+			Name:      p.Name,
+			Host:      p.Host,
+			AccountID: p.AccountID,
+			IsDefault: isDefault,
+		}
+	}
+
+	items := make([]pickerItem, 0, len(profiles)+2)
+	if defaultIdx >= 0 {
+		items = append(items, itemFor(profiles[defaultIdx], true))
+	}
+	for i, p := range profiles {
+		if i == defaultIdx {
+			continue
+		}
+		items = append(items, itemFor(p, false))
+	}
+	if includeExtras {
+		items = append(items,
+			pickerItem{Name: profilePickerCreateNewLabel, IsExtra: true, Extra: profilePickerCreateNew},
+			pickerItem{Name: profilePickerEnterHostLabel, IsExtra: true, Extra: profilePickerEnterHost},
+		)
+	}
+	return items
+}
+
+// pickAuthProfile shows the auth profile picker and returns the user's choice.
+// When the result is profilePickerProfile, the second return value is the
+// selected profile name. For the other results it is empty.
+func pickAuthProfile(ctx context.Context, profiles profile.Profiles, opts profilePickerOptions) (profilePickerResult, string, error) {
+	items := buildPickerItems(profiles, opts.Default, opts.IncludeExtras)
+	if len(items) == 0 {
+		return 0, "", errors.New("no profiles configured. Run 'databricks auth login' to create a profile")
+	}
+	noun := opts.SelectedNoun
+	if noun == "" {
+		noun = "Using profile"
+	}
+
+	idx, err := cmdio.RunSelect(ctx, cmdio.SelectOptions{
+		Label:             opts.Label,
+		Items:             items,
+		StartInSearchMode: true,
+		Searcher: func(input string, index int) bool {
+			// Action entries (Create new / Enter host) stay visible regardless
+			// of the search query so the user can always reach them, including
+			// when the typed query doesn't match any profile.
+			if items[index].IsExtra {
+				return true
+			}
+			input = strings.ToLower(input)
+			return strings.Contains(strings.ToLower(items[index].Name), input) ||
+				strings.Contains(strings.ToLower(items[index].Host), input) ||
+				strings.Contains(strings.ToLower(items[index].AccountID), input)
+		},
+		LabelTemplate: "{{ . | faint }}",
+		Active:        `▸ {{if .IsExtra}}{{.Name | faint | bold}}{{else}}{{.Name | bold}}{{if .IsDefault}} {{ "[default]" | green }}{{end}}{{if .AccountID}} (account: {{.AccountID|faint}}){{else if .Host}} ({{.Host|faint}}){{end}}{{end}}`,
+		Inactive:      `  {{if .IsExtra}}{{.Name | faint}}{{else}}{{.Name}}{{if .IsDefault}} [default]{{end}}{{if .AccountID}} (account: {{.AccountID|faint}}){{else if .Host}} ({{.Host|faint}}){{end}}{{end}}`,
+		Selected:      `{{ "` + noun + `" | faint }}: {{ .Name | bold }}`,
+	})
+	if err != nil {
+		return 0, "", err
+	}
+
+	picked := items[idx]
+	if picked.IsExtra {
+		return picked.Extra, "", nil
+	}
+	return profilePickerProfile, picked.Name, nil
+}
diff --git a/cmd/auth/profile_picker_test.go b/cmd/auth/profile_picker_test.go
new file mode 100644
index 00000000000..dba2f989c86
--- /dev/null
+++ b/cmd/auth/profile_picker_test.go
@@ -0,0 +1,91 @@
+package auth
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/databrickscfg/profile"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestBuildPickerItems(t *testing.T) {
+	profiles := profile.Profiles{
+		{Name: "alpha", Host: "https://alpha.cloud.databricks.example"},
+		{Name: "bravo", Host: "https://bravo.cloud.databricks.example"},
+		{Name: "charlie", Host: "https://charlie.cloud.databricks.example"},
+	}
+
+	cases := []struct {
+		name          string
+		defaultName   string
+		includeExtras bool
+		wantNames     []string
+		wantDefault   string
+		wantExtras    []profilePickerResult
+	}{
+		{
+			name:        "no default no extras",
+			wantNames:   []string{"alpha", "bravo", "charlie"},
+			wantDefault: "",
+		},
+		{
+			name:        "default moves to top",
+			defaultName: "bravo",
+			wantNames:   []string{"bravo", "alpha", "charlie"},
+			wantDefault: "bravo",
+		},
+		{
+			name:          "extras appended after profiles",
+			includeExtras: true,
+			wantNames:     []string{"alpha", "bravo", "charlie", profilePickerCreateNewLabel, profilePickerEnterHostLabel},
+			wantExtras:    []profilePickerResult{profilePickerCreateNew, profilePickerEnterHost},
+		},
+		{
+			name:          "default first, then extras at the bottom",
+			defaultName:   "charlie",
+			includeExtras: true,
+			wantNames:     []string{"charlie", "alpha", "bravo", profilePickerCreateNewLabel, profilePickerEnterHostLabel},
+			wantDefault:   "charlie",
+			wantExtras:    []profilePickerResult{profilePickerCreateNew, profilePickerEnterHost},
+		},
+		{
+			name:        "default not in profiles is ignored",
+			defaultName: "missing",
+			wantNames:   []string{"alpha", "bravo", "charlie"},
+			wantDefault: "",
+		},
+	}
+
+	t.Run("empty profiles with extras shows only extras", func(t *testing.T) {
+		items := buildPickerItems(profile.Profiles{}, "", true)
+		assert.Equal(t, []string{profilePickerCreateNewLabel, profilePickerEnterHostLabel}, namesOf(items))
+	})
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			items := buildPickerItems(profiles, tc.defaultName, tc.includeExtras)
+
+			gotDefault := ""
+			var gotExtras []profilePickerResult
+			for _, it := range items {
+				if it.IsDefault {
+					assert.Empty(t, gotDefault)
+					gotDefault = it.Name
+				}
+				if it.IsExtra {
+					gotExtras = append(gotExtras, it.Extra)
+				}
+			}
+			assert.Equal(t, tc.wantNames, namesOf(items))
+			assert.Equal(t, tc.wantDefault, gotDefault)
+			assert.Equal(t, tc.wantExtras, gotExtras)
+		})
+	}
+}
+
+func namesOf(items []pickerItem) []string {
+	names := make([]string, len(items))
+	for i, it := range items {
+		names[i] = it.Name
+	}
+	return names
+}
diff --git a/cmd/auth/profiles.go b/cmd/auth/profiles.go
index 51c397a9ea9..e65b11371b7 100644
--- a/cmd/auth/profiles.go
+++ b/cmd/auth/profiles.go
@@ -16,10 +16,18 @@ import (
 	"github.com/databricks/cli/libs/log"
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/config"
+	"github.com/databricks/databricks-sdk-go/service/iam"
 	"github.com/spf13/cobra"
 	"gopkg.in/ini.v1"
 )
 
+// profileValidationTimeout bounds each per-profile validation so a host the SDK
+// retries — connection refused, connect/TLS timeout, retriable 5xx — cannot
+// stall the whole listing. Without it a single such host blocks `auth profiles`
+// for the SDK's default retry budget (~5 minutes). Hosts that fail DNS are not
+// retriable and already fail fast, so this only bounds the retriable cases.
+const profileValidationTimeout = 5 * time.Second
+
 type profileMetadata struct {
 	Name        string `json:"name"`
 	Host        string `json:"host,omitempty"`
@@ -35,12 +43,31 @@ func (c *profileMetadata) IsEmpty() bool {
 	return c.Host == "" && c.AccountID == ""
 }
 
-func (c *profileMetadata) Load(ctx context.Context, configFilePath string, skipValidate bool) {
+func (c *profileMetadata) Load(ctx context.Context, configFilePath string, skipValidate bool, timeout time.Duration) {
+	timeoutSeconds := int(timeout / time.Second)
 	cfg := &config.Config{
 		Loaders:           []config.Loader{config.ConfigFile},
 		ConfigFile:        configFilePath,
 		Profile:           c.Name,
 		DatabricksCliPath: env.Get(ctx, "DATABRICKS_CLI_PATH"),
+
+		// Bound the SDK's per-request and total-retry budgets to the same
+		// per-profile ceiling. EnsureResolved fetches host metadata via the
+		// SDK's retrier, which defaults to 5 minutes — and it runs on
+		// context.Background internally, so the context.WithTimeout below on the
+		// validation call cannot reach it. Without these a single unreachable
+		// host stalls the listing well past the validation timeout.
+		HTTPTimeoutSeconds:  timeoutSeconds,
+		RetryTimeoutSeconds: timeoutSeconds,
+	}
+	if skipValidate {
+		// EnsureResolved fetches <host>/.well-known/databricks-config to enrich
+		// the config, so without this stub a skip-validate listing still makes
+		// one network call per profile (and warns when offline). Resolve from
+		// the config file alone; cloud detection falls back to the host pattern.
+		cfg.HostMetadataResolver = func(context.Context, string) (*config.HostMetadata, error) {
+			return nil, nil
+		}
 	}
 	_ = cfg.EnsureResolved()
 	if cfg.IsAws() {
@@ -62,13 +89,16 @@ func (c *profileMetadata) Load(ctx context.Context, configFilePath string, skipV
 		log.Debugf(ctx, "Profile %q: overrode config type from %s to %s (SPOG host)", c.Name, cfg.ConfigType(), configType)
 	}
 
+	callCtx, cancel := context.WithTimeout(ctx, timeout)
+	defer cancel()
+
 	switch configType {
 	case config.AccountConfig:
 		a, err := databricks.NewAccountClient((*databricks.Config)(cfg))
 		if err != nil {
 			return
 		}
-		_, err = a.Workspaces.List(ctx)
+		_, err = a.Workspaces.List(callCtx)
 		c.Host = cfg.Host
 		c.AuthType = cfg.AuthType
 		if err != nil {
@@ -80,7 +110,7 @@ func (c *profileMetadata) Load(ctx context.Context, configFilePath string, skipV
 		if err != nil {
 			return
 		}
-		_, err = w.CurrentUser.Me(ctx)
+		_, err = w.CurrentUser.Me(callCtx, iam.MeRequest{})
 		c.Host = cfg.Host
 		c.AuthType = cfg.AuthType
 		if err != nil {
@@ -138,7 +168,7 @@ func newProfilesCommand() *cobra.Command {
 			wg.Go(func() {
 				ctx := cmd.Context()
 				t := time.Now()
-				profile.Load(ctx, iniFile.Path(), skipValidate)
+				profile.Load(ctx, iniFile.Path(), skipValidate, profileValidationTimeout)
 				log.Debugf(ctx, "Profile %q took %s to load", profile.Name, time.Since(t))
 			})
 			profiles = append(profiles, profile)
diff --git a/cmd/auth/profiles_test.go b/cmd/auth/profiles_test.go
index 59803e210cf..90efa2a99bd 100644
--- a/cmd/auth/profiles_test.go
+++ b/cmd/auth/profiles_test.go
@@ -7,7 +7,9 @@ import (
 	"os"
 	"path/filepath"
 	"runtime"
+	"sync/atomic"
 	"testing"
+	"time"
 
 	"github.com/databricks/cli/libs/databrickscfg"
 	"github.com/databricks/databricks-sdk-go/config"
@@ -39,7 +41,7 @@ func TestProfiles(t *testing.T) {
 
 	// Load the profile
 	profile := &profileMetadata{Name: "profile1"}
-	profile.Load(ctx, configFile, true)
+	profile.Load(ctx, configFile, true, profileValidationTimeout)
 
 	// Check the profile
 	assert.Equal(t, "profile1", profile.Name)
@@ -48,6 +50,35 @@ func TestProfiles(t *testing.T) {
 	assert.Equal(t, "pat", profile.AuthType)
 }
 
+// TestProfileLoadSkipValidateMakesNoRequests guards the --skip-validate
+// contract: EnsureResolved would otherwise fetch /.well-known/databricks-config
+// for every profile, so the handler counts every request it receives.
+func TestProfileLoadSkipValidateMakesNoRequests(t *testing.T) {
+	var requests atomic.Int32
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		requests.Add(1)
+		w.WriteHeader(http.StatusNotFound)
+	}))
+	t.Cleanup(server.Close)
+
+	dir := t.TempDir()
+	configFile := filepath.Join(dir, ".databrickscfg")
+	t.Setenv("HOME", dir)
+	if runtime.GOOS == "windows" {
+		t.Setenv("USERPROFILE", dir)
+	}
+
+	content := "[offline-profile]\nhost = " + server.URL + "\ntoken = test-token\n"
+	require.NoError(t, os.WriteFile(configFile, []byte(content), 0o600))
+
+	p := &profileMetadata{Name: "offline-profile", Host: server.URL}
+	p.Load(t.Context(), configFile, true, profileValidationTimeout)
+
+	assert.Zero(t, requests.Load(), "expected no network calls with skipValidate")
+	assert.Equal(t, server.URL, p.Host)
+	assert.False(t, p.Valid)
+}
+
 func TestProfilesDefaultMarker(t *testing.T) {
 	ctx := t.Context()
 	dir := t.TempDir()
@@ -192,7 +223,7 @@ func TestProfileLoadSPOGConfigType(t *testing.T) {
 				Host:      tc.host,
 				AccountID: tc.accountID,
 			}
-			p.Load(t.Context(), configFile, false)
+			p.Load(t.Context(), configFile, false, profileValidationTimeout)
 
 			assert.Equal(t, tc.wantValid, p.Valid, "Valid mismatch")
 			assert.NotEmpty(t, p.Host, "Host should be set")
@@ -248,9 +279,51 @@ func TestProfileLoadNoDiscoveryStaysWorkspace(t *testing.T) {
 		Host:      server.URL,
 		AccountID: "some-acct",
 	}
-	p.Load(t.Context(), configFile, false)
+	p.Load(t.Context(), configFile, false, profileValidationTimeout)
 
 	assert.True(t, p.Valid, "should validate as workspace when discovery is unavailable")
 	assert.NotEmpty(t, p.Host)
 	assert.Equal(t, "pat", p.AuthType)
 }
+
+// TestProfileLoadTimesOutOnUnresponsiveHost is a regression test for a hang:
+// the SDK retries transient network failures for ~5 minutes by default, so a
+// host that accepts the connection but never responds would stall the whole
+// `auth profiles` listing. The timeout passed to Load must bound the wait
+// (including the EnsureResolved metadata fetch, which runs on context.Background
+// and so is only reachable via HTTPTimeoutSeconds/RetryTimeoutSeconds).
+//
+// A 2s timeout is passed here — kept >=1s because Load derives the SDK's
+// integer-second budgets from it, and a sub-second value would floor to 0
+// (which the SDK reads as "use the default", defeating the test).
+func TestProfileLoadTimesOutOnUnresponsiveHost(t *testing.T) {
+	// A server that hangs every request until the client gives up. Waiting on
+	// the request context (rather than a private channel) means the handler
+	// returns as soon as our timeout cancels the call, so server.Close doesn't
+	// block on a leaked connection during cleanup.
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		<-r.Context().Done()
+	}))
+	t.Cleanup(server.Close)
+
+	dir := t.TempDir()
+	configFile := filepath.Join(dir, ".databrickscfg")
+	t.Setenv("HOME", dir)
+	if runtime.GOOS == "windows" {
+		t.Setenv("USERPROFILE", dir)
+	}
+	content := "[hung]\nhost = " + server.URL + "\ntoken = test-token\n"
+	require.NoError(t, os.WriteFile(configFile, []byte(content), 0o600))
+
+	p := &profileMetadata{Name: "hung", Host: server.URL}
+	start := time.Now()
+	p.Load(t.Context(), configFile, false, 2*time.Second)
+	elapsed := time.Since(start)
+
+	assert.False(t, p.Valid, "an unresponsive host must not validate")
+	// Generously above the 2s bound (metadata fetch + validation call, each
+	// bounded) but far below the SDK's ~5m default that this timeout prevents.
+	// A regression that drops the bound would blow past this and the whole
+	// package would then hit the go test -timeout instead.
+	assert.Less(t, elapsed, 60*time.Second, "Load must be bounded by profileValidationTimeout, not the SDK default")
+}
diff --git a/cmd/auth/resolve.go b/cmd/auth/resolve.go
index e6cc199c38f..2117135d2cb 100644
--- a/cmd/auth/resolve.go
+++ b/cmd/auth/resolve.go
@@ -8,7 +8,10 @@ import (
 	"strings"
 
 	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/databrickscfg"
 	"github.com/databricks/cli/libs/databrickscfg/profile"
+	"github.com/databricks/cli/libs/env"
+	"github.com/databricks/cli/libs/log"
 	"github.com/databricks/databricks-sdk-go/config"
 )
 
@@ -72,6 +75,17 @@ func resolveHostToProfile(ctx context.Context, host string, profiler profile.Pro
 		names := strings.Join(allProfiles.Names(), ", ")
 		return "", fmt.Errorf("no profile found matching host %q. Available profiles: %s", host, names)
 	default:
+		// Prefer the configured default profile when it's one of the host
+		// matches, so commands that pass --host don't trip the picker for
+		// users who already picked a default.
+		if defaultProfile, _ := databrickscfg.GetDefaultProfile(ctx, env.Get(ctx, "DATABRICKS_CONFIG_FILE")); defaultProfile != "" {
+			for _, p := range hostProfiles {
+				if p.Name == defaultProfile {
+					log.Debugf(ctx, "multiple profiles match host %q; using default profile %q", host, defaultProfile)
+					return p.Name, nil
+				}
+			}
+		}
 		if cmdio.IsPromptSupported(ctx) {
 			selected, err := profile.SelectProfile(ctx, profile.SelectConfig{
 				Label:             fmt.Sprintf("Multiple profiles found for %q. Select one to use", host),
diff --git a/cmd/auth/resolve_test.go b/cmd/auth/resolve_test.go
index 8f4fcbbc111..2cb2fb6ff36 100644
--- a/cmd/auth/resolve_test.go
+++ b/cmd/auth/resolve_test.go
@@ -1,6 +1,8 @@
 package auth
 
 import (
+	"os"
+	"path/filepath"
 	"testing"
 
 	"github.com/databricks/cli/libs/cmdio"
@@ -113,6 +115,12 @@ func TestResolveHostToProfileMatchesOneProfile(t *testing.T) {
 }
 
 func TestResolveHostToProfileMatchesMultipleProfiles(t *testing.T) {
+	// Point at an isolated config file with no default_profile so the new
+	// prefer-default branch doesn't pick up the caller's real .databrickscfg.
+	cfgPath := filepath.Join(t.TempDir(), ".databrickscfg")
+	require.NoError(t, os.WriteFile(cfgPath, []byte(""), 0o600))
+	t.Setenv("DATABRICKS_CONFIG_FILE", cfgPath)
+
 	ctx := cmdio.MockDiscard(t.Context())
 	profiler := profile.InMemoryProfiler{
 		Profiles: profile.Profiles{
@@ -127,6 +135,36 @@ func TestResolveHostToProfileMatchesMultipleProfiles(t *testing.T) {
 	assert.ErrorContains(t, err, "dev2")
 }
 
+func TestResolveHostToProfilePrefersConfiguredDefault(t *testing.T) {
+	cfgPath := filepath.Join(t.TempDir(), ".databrickscfg")
+	err := os.WriteFile(cfgPath, []byte(`
+[__settings__]
+default_profile = dev2
+
+[dev1]
+host = https://shared.cloud.databricks.com
+auth_type = databricks-cli
+
+[dev2]
+host = https://shared.cloud.databricks.com
+auth_type = databricks-cli
+`), 0o600)
+	require.NoError(t, err)
+	t.Setenv("DATABRICKS_CONFIG_FILE", cfgPath)
+
+	ctx := cmdio.MockDiscard(t.Context())
+	profiler := profile.InMemoryProfiler{
+		Profiles: profile.Profiles{
+			{Name: "dev1", Host: "https://shared.cloud.databricks.com", AuthType: "databricks-cli"},
+			{Name: "dev2", Host: "https://shared.cloud.databricks.com", AuthType: "databricks-cli"},
+		},
+	}
+
+	resolved, err := resolveHostToProfile(ctx, "https://shared.cloud.databricks.com", profiler)
+	require.NoError(t, err)
+	assert.Equal(t, "dev2", resolved)
+}
+
 func TestResolveHostToProfileMatchesNothing(t *testing.T) {
 	ctx := cmdio.MockDiscard(t.Context())
 	profiler := profile.InMemoryProfiler{
diff --git a/cmd/auth/switch.go b/cmd/auth/switch.go
index 2ff7dfad1a3..c91894fe85a 100644
--- a/cmd/auth/switch.go
+++ b/cmd/auth/switch.go
@@ -1,10 +1,8 @@
 package auth
 
 import (
-	"context"
 	"errors"
 	"fmt"
-	"strings"
 
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/databrickscfg"
@@ -45,11 +43,23 @@ to see which profile is currently the default.`,
 			}
 
 			currentDefault, _ := databrickscfg.GetDefaultProfile(ctx, configFile)
-			selectedName, err := promptForSwitchProfile(ctx, allProfiles, currentDefault)
+			label := "Select a profile to set as default"
+			if currentDefault != "" {
+				label = fmt.Sprintf("Current default: %s. Select a new default", currentDefault)
+			}
+			result, selected, err := pickAuthProfile(ctx, allProfiles, profilePickerOptions{
+				Label:        label,
+				SelectedNoun: "Default profile",
+				Default:      currentDefault,
+			})
 			if err != nil {
 				return err
 			}
-			profileName = selectedName
+			// Without IncludeExtras, the picker only returns profile selections.
+			if result != profilePickerProfile {
+				return fmt.Errorf("unexpected picker result: %v", result)
+			}
+			profileName = selected
 		} else {
 			// Validate the profile exists.
 			profiles, err := profile.DefaultProfiler.LoadProfiles(ctx, profile.WithName(profileName))
@@ -72,37 +82,3 @@ to see which profile is currently the default.`,
 
 	return cmd
 }
-
-// promptForSwitchProfile shows an interactive profile picker for the switch command.
-// Reuses profileSelectItem from token.go for consistent display.
-func promptForSwitchProfile(ctx context.Context, profiles profile.Profiles, currentDefault string) (string, error) {
-	items := make([]profileSelectItem, 0, len(profiles))
-	for _, p := range profiles {
-		items = append(items, profileSelectItem{Name: p.Name, Host: p.Host})
-	}
-
-	label := "Select a profile to set as default"
-	if currentDefault != "" {
-		label = fmt.Sprintf("Current default: %s. Select a new default", currentDefault)
-	}
-
-	i, err := cmdio.RunSelect(ctx, cmdio.SelectOptions{
-		Label:             label,
-		Items:             items,
-		StartInSearchMode: len(profiles) > 5,
-		Searcher: func(input string, index int) bool {
-			input = strings.ToLower(input)
-			name := strings.ToLower(items[index].Name)
-			host := strings.ToLower(items[index].Host)
-			return strings.Contains(name, input) || strings.Contains(host, input)
-		},
-		LabelTemplate: "{{ . | faint }}",
-		Active:        `{{.Name | bold}}{{if .Host}} ({{.Host|faint}}){{end}}`,
-		Inactive:      `{{.Name}}{{if .Host}} ({{.Host}}){{end}}`,
-		Selected:      `{{ "Default profile" | faint }}: {{ .Name | bold }}`,
-	})
-	if err != nil {
-		return "", err
-	}
-	return profiles[i].Name, nil
-}
diff --git a/cmd/auth/testdata/.databrickscfg b/cmd/auth/testdata/.databrickscfg
index acd227d515e..cbcd36fc148 100644
--- a/cmd/auth/testdata/.databrickscfg
+++ b/cmd/auth/testdata/.databrickscfg
@@ -31,3 +31,7 @@ experimental_is_unified_host = true
 host = https://spog.example.com
 account_id = spog-account
 workspace_id = none
+
+[spog-skip-workspace-new]
+host = https://spog.example.com
+account_id = spog-account
diff --git a/cmd/auth/testdata/.gitattributes b/cmd/auth/testdata/.gitattributes
new file mode 100644
index 00000000000..c111764a37e
--- /dev/null
+++ b/cmd/auth/testdata/.gitattributes
@@ -0,0 +1,3 @@
+# termtest goldens are LF-only snapshots of the VT emulator; keep Windows
+# checkouts from converting them to CRLF.
+*.golden text eol=lf
diff --git a/cmd/auth/testdata/TestPromptForWorkspaceSelectionNoResults/01-initial.golden b/cmd/auth/testdata/TestPromptForWorkspaceSelectionNoResults/01-initial.golden
new file mode 100644
index 00000000000..66cd29acfdb
--- /dev/null
+++ b/cmd/auth/testdata/TestPromptForWorkspaceSelectionNoResults/01-initial.golden
@@ -0,0 +1,6 @@
+Search: █
+? Select a workspace (search by name or ID):
+  ▸ Alpha (111)
+    Beta (222)
+    333
+    Skip (account-level access only)
diff --git a/cmd/auth/token.go b/cmd/auth/token.go
index 67dc56807ca..e28d71083a0 100644
--- a/cmd/auth/token.go
+++ b/cmd/auth/token.go
@@ -12,34 +12,31 @@ import (
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/auth"
 	"github.com/databricks/cli/libs/auth/storage"
+	"github.com/databricks/cli/libs/auth/u2m"
 	"github.com/databricks/cli/libs/browser"
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/databrickscfg"
 	"github.com/databricks/cli/libs/databrickscfg/profile"
 	"github.com/databricks/cli/libs/env"
 	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/cli/libs/log"
 	"github.com/databricks/databricks-sdk-go/config"
-	"github.com/databricks/databricks-sdk-go/credentials/u2m"
-	"github.com/databricks/databricks-sdk-go/credentials/u2m/cache"
 	"github.com/spf13/cobra"
 	"golang.org/x/oauth2"
 )
 
+const unauthenticatedErrorCode = "UNAUTHENTICATED"
+
+type tokenErrorOutput struct {
+	ErrorCode string `json:"error_code"`
+	Message   string `json:"message"`
+}
+
 func helpfulError(ctx context.Context, profile string, persistentAuth u2m.OAuthArgument) string {
 	loginMsg := auth.BuildLoginCommand(ctx, profile, persistentAuth)
 	return fmt.Sprintf("Try logging in again with `%s` before retrying. If this fails, please report this issue to the Databricks CLI maintainers at https://github.com/databricks/cli/issues/new", loginMsg)
 }
 
-// profileSelectionResult represents the user's choice from the interactive
-// profile picker.
-type profileSelectionResult int
-
-const (
-	profileSelected   profileSelectionResult = iota // User picked a profile
-	enterHostSelected                               // User chose "Enter a host URL manually"
-	createNewSelected                               // User chose "Create a new profile"
-)
-
 func newTokenCommand(authArguments *auth.AuthArguments) *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "token [PROFILE]",
@@ -65,7 +62,7 @@ and secret is not supported.`,
 		ctx := cmd.Context()
 		profileName := cmd.Flag("profile").Value.String()
 
-		tokenCache, mode, err := storage.ResolveCache(ctx, "")
+		tokenStore, mode, err := storage.ResolveStore(ctx, "")
 		if err != nil {
 			return err
 		}
@@ -77,11 +74,19 @@ and secret is not supported.`,
 			tokenTimeout:       tokenTimeout,
 			forceRefresh:       forceRefresh,
 			profiler:           profile.DefaultProfiler,
-			tokenCache:         tokenCache,
+			tokenStore:         tokenStore,
 			mode:               mode,
 			persistentAuthOpts: nil,
 		})
 		if err != nil {
+			if cmd.Flag("output").Changed && root.OutputType(cmd) == flags.OutputJSON {
+				if _, ok := errors.AsType[*u2m.InvalidRefreshTokenError](err); ok {
+					if outputErr := writeTokenErrorOutput(cmd.OutOrStdout(), err); outputErr != nil {
+						return outputErr
+					}
+					return root.ErrAlreadyPrinted
+				}
+			}
 			return err
 		}
 		// Only honor the explicit --output text flag, not implicit text mode
@@ -108,6 +113,15 @@ func writeTokenOutput(w io.Writer, t *oauth2.Token, textMode bool) error {
 	return err
 }
 
+func writeTokenErrorOutput(w io.Writer, err error) error {
+	encoder := json.NewEncoder(w)
+	encoder.SetIndent("", "  ")
+	return encoder.Encode(tokenErrorOutput{
+		ErrorCode: unauthenticatedErrorCode,
+		Message:   err.Error(),
+	})
+}
+
 type loadTokenArgs struct {
 	// authArguments is the parsed auth arguments, including the host and optionally the account ID.
 	authArguments *auth.AuthArguments
@@ -127,9 +141,9 @@ type loadTokenArgs struct {
 	// profiler is the profiler to use for reading the host and account ID from the .databrickscfg file.
 	profiler profile.Profiler
 
-	// tokenCache is the underlying TokenCache used for OAuth tokens. The caller is
-	// responsible for construction so that tests can substitute an in-memory cache.
-	tokenCache cache.TokenCache
+	// tokenStore is the underlying CLI store used for OAuth tokens. The caller is
+	// responsible for construction so that tests can substitute an in-memory store.
+	tokenStore storage.Store
 
 	// mode is the resolved storage mode. When set to StorageModePlaintext,
 	// login paths mirror freshly minted tokens under the legacy host-based
@@ -185,7 +199,7 @@ func loadToken(ctx context.Context, args loadTokenArgs) (*oauth2.Token, error) {
 	// resolve the target through environment variables or interactive profile selection.
 	if args.profileName == "" && args.authArguments.Host == "" && len(args.args) == 0 {
 		var resolvedProfile string
-		resolvedProfile, existingProfile, err = resolveNoArgsToken(ctx, args.profiler, args.authArguments, args.tokenCache, args.mode)
+		resolvedProfile, existingProfile, err = resolveNoArgsToken(ctx, args.profiler, args.authArguments, args.tokenStore, args.mode)
 		if err != nil {
 			return nil, err
 		}
@@ -200,11 +214,11 @@ func loadToken(ctx context.Context, args loadTokenArgs) (*oauth2.Token, error) {
 	// When no profile was specified, resolve the host to a profile in
 	// .databrickscfg. This ensures the token cache lookup uses the profile
 	// key (e.g. "logfood") rather than the host URL, which is important
-	// because the SDK's dualWrite is a transitional mechanism: it writes
-	// tokens under both keys for backward compatibility with older SDKs
+	// because the store's dual-write wrapper is a transitional mechanism: it
+	// writes tokens under both keys for backward compatibility with older SDKs
 	// that only know host keys, but the profile key is the intended
 	// primary key. Once older SDKs have migrated to profile-based keys,
-	// dualWrite and the host key can be removed entirely.
+	// dual-writing and the host key can be removed entirely.
 	if args.profileName == "" && args.authArguments.Host != "" {
 		// Match profiles by host and available identifiers. For SPOG workspace
 		// profiles (host + account_id + workspace_id), use all three to
@@ -273,7 +287,13 @@ func loadToken(ctx context.Context, args loadTokenArgs) (*oauth2.Token, error) {
 	if err != nil {
 		return nil, err
 	}
-	allArgs := append([]u2m.PersistentAuthOption{u2m.WithTokenCache(args.tokenCache)}, args.persistentAuthOpts...)
+	allArgs := append([]u2m.PersistentAuthOption{u2m.WithTokenStore(storage.OAuthTokenStore(ctx, args.tokenStore, args.mode))}, args.persistentAuthOpts...)
+	if clientID := u2mClientIDFromProfile(existingProfile); clientID != "" {
+		allArgs = append(allArgs, u2m.WithClientID(clientID))
+	}
+	if resources := u2mResourcesFromProfile(existingProfile); len(resources) > 0 {
+		allArgs = append(allArgs, u2m.WithResources(resources))
+	}
 	allArgs = append(allArgs, u2m.WithOAuthArgument(oauthArgument))
 	persistentAuth, err := u2m.NewPersistentAuth(ctx, allArgs...)
 	if err != nil {
@@ -287,17 +307,29 @@ func loadToken(ctx context.Context, args loadTokenArgs) (*oauth2.Token, error) {
 		t, err = persistentAuth.Token()
 	}
 	if err != nil {
-		if errors.Is(err, cache.ErrNotFound) {
+		if errors.Is(err, storage.ErrNotFound) {
 			// The error returned by the SDK when the token cache doesn't exist or doesn't contain a token
 			// for the given host changed in SDK v0.77.0: https://github.com/databricks/databricks-sdk-go/pull/1250.
 			// This was released as part of CLI v0.264.0.
 			//
 			// Older SDK versions check for a particular substring to determine if
 			// the OAuth authentication type can fall through or if it is a real error.
-			// This means we need to keep this error message constant for backwards compatibility.
+			// This means we need to keep "databricks OAuth is not configured for
+			// this host" present in the error for backwards compatibility.
 			//
 			// This is captured in an acceptance test under "cmd/auth/token".
-			err = errors.New("cache: databricks OAuth is not configured for this host")
+			const compatSubstring = "databricks OAuth is not configured for this host"
+			// When storage's notFoundHintCache wrapped the ErrNotFound with
+			// an actionable hint (e.g. the post-upgrade "stored credentials
+			// from older CLI versions are no longer used; run `databricks
+			// auth login`..." copy), surface it instead of the generic
+			// "Try logging in again with ... If this fails, please report
+			// this issue" trailer. The hint is more specific and avoids
+			// users reporting expected post-upgrade behavior as a bug.
+			if hint := storage.HintForNotFound(err); hint != "" {
+				return nil, fmt.Errorf("cache: %s. %s", compatSubstring, hint)
+			}
+			err = errors.New("cache: " + compatSubstring)
 		}
 		if rewritten, rewrittenErr := auth.RewriteAuthError(ctx, args.authArguments.Host, args.authArguments.AccountID, args.profileName, err); rewritten {
 			return nil, rewrittenErr
@@ -315,7 +347,7 @@ func loadToken(ctx context.Context, args loadTokenArgs) (*oauth2.Token, error) {
 //
 // Returns the resolved profile name and profile (if any). The host and related
 // fields on authArgs are updated in place when resolved via environment variables.
-func resolveNoArgsToken(ctx context.Context, profiler profile.Profiler, authArgs *auth.AuthArguments, tokenCache cache.TokenCache, mode storage.StorageMode) (string, *profile.Profile, error) {
+func resolveNoArgsToken(ctx context.Context, profiler profile.Profiler, authArgs *auth.AuthArguments, tokenStore storage.Store, mode storage.StorageMode) (string, *profile.Profile, error) {
 	// Step 1: Try DATABRICKS_HOST env var (highest priority).
 	if envHost := env.Get(ctx, "DATABRICKS_HOST"); envHost != "" {
 		authArgs.Host = envHost
@@ -337,6 +369,18 @@ func resolveNoArgsToken(ctx context.Context, profiler profile.Profiler, authArgs
 		return envProfile, p, nil
 	}
 
+	// Step 2.5: Try [__settings__].default_profile from the config file.
+	// default_profile is advisory: if it points at a profile that no longer
+	// exists, fall through to the interactive picker rather than erroring.
+	if defaultProfile := databrickscfg.ResolveDefaultProfile(ctx); defaultProfile != "" {
+		p, err := loadProfileByName(ctx, defaultProfile, profiler)
+		if err != nil {
+			log.Warnf(ctx, "default_profile %q not loadable: %v", defaultProfile, err)
+		} else if p != nil {
+			return defaultProfile, p, nil
+		}
+	}
+
 	// Step 3: No env vars resolved. Load all profiles for interactive selection
 	// or non-interactive error.
 	allProfiles, err := profiler.LoadProfiles(ctx, profile.MatchAllProfiles)
@@ -352,16 +396,21 @@ func resolveNoArgsToken(ctx context.Context, profiler profile.Profiler, authArgs
 	}
 
 	// Interactive: show profile picker.
-	result, selectedName, err := promptForProfileSelection(ctx, allProfiles)
+	currentDefault, _ := databrickscfg.GetDefaultProfile(ctx, env.Get(ctx, "DATABRICKS_CONFIG_FILE"))
+	result, selectedName, err := pickAuthProfile(ctx, allProfiles, profilePickerOptions{
+		Label:         "Select a profile",
+		Default:       currentDefault,
+		IncludeExtras: true,
+	})
 	if err != nil {
 		return "", nil, err
 	}
 	switch result {
-	case enterHostSelected:
+	case profilePickerEnterHost:
 		// Fall through — setHostAndAccountId will prompt for the host.
 		return "", nil, nil
-	case createNewSelected:
-		return runInlineLogin(ctx, profiler, tokenCache, mode)
+	case profilePickerCreateNew:
+		return runInlineLogin(ctx, profiler, tokenStore, mode)
 	default:
 		p, err := loadProfileByName(ctx, selectedName, profiler)
 		if err != nil {
@@ -371,59 +420,10 @@ func resolveNoArgsToken(ctx context.Context, profiler profile.Profiler, authArgs
 	}
 }
 
-// profileSelectItem is used by promptForProfileSelection to render both
-// regular profiles and special action options in the same select list.
-type profileSelectItem struct {
-	Name string
-	Host string
-}
-
-// promptForProfileSelection shows a select list with all configured profiles
-// plus "Enter a host URL" and "Create a new profile" options.
-// Returns the selection type and, when a profile is selected, its name.
-func promptForProfileSelection(ctx context.Context, profiles profile.Profiles) (profileSelectionResult, string, error) {
-	items := make([]profileSelectItem, 0, len(profiles)+2)
-	for _, p := range profiles {
-		items = append(items, profileSelectItem{Name: p.Name, Host: p.Host})
-	}
-	createProfileIdx := len(items)
-	items = append(items, profileSelectItem{Name: "Create a new profile"})
-	enterHostIdx := len(items)
-	items = append(items, profileSelectItem{Name: "Enter a host URL manually"})
-
-	i, err := cmdio.RunSelect(ctx, cmdio.SelectOptions{
-		Label:             "Select a profile",
-		Items:             items,
-		StartInSearchMode: len(profiles) > 5,
-		Searcher: func(input string, index int) bool {
-			input = strings.ToLower(input)
-			name := strings.ToLower(items[index].Name)
-			host := strings.ToLower(items[index].Host)
-			return strings.Contains(name, input) || strings.Contains(host, input)
-		},
-		LabelTemplate: "{{ . | faint }}",
-		Active:        `{{.Name | bold}}{{if .Host}} ({{.Host|faint}}){{end}}`,
-		Inactive:      `{{.Name}}{{if .Host}} ({{.Host}}){{end}}`,
-		Selected:      `{{ "Using profile" | faint }}: {{ .Name | bold }}`,
-	})
-	if err != nil {
-		return 0, "", err
-	}
-
-	switch i {
-	case enterHostIdx:
-		return enterHostSelected, "", nil
-	case createProfileIdx:
-		return createNewSelected, "", nil
-	default:
-		return profileSelected, profiles[i].Name, nil
-	}
-}
-
 // runInlineLogin runs a minimal interactive login flow: prompts for a profile
 // name and host, performs the OAuth challenge, saves the profile to
 // .databrickscfg, and returns the new profile name and profile.
-func runInlineLogin(ctx context.Context, profiler profile.Profiler, tokenCache cache.TokenCache, mode storage.StorageMode) (string, *profile.Profile, error) {
+func runInlineLogin(ctx context.Context, profiler profile.Profiler, tokenStore storage.Store, mode storage.StorageMode) (string, *profile.Profile, error) {
 	profileName, err := promptForProfile(ctx, "DEFAULT")
 	if err != nil {
 		return "", nil, err
@@ -450,6 +450,10 @@ func runInlineLogin(ctx context.Context, profiler profile.Profiler, tokenCache c
 		scopesList = splitScopes(existingProfile.Scopes)
 	}
 
+	// Preserve RFC 8707 resource indicators from the existing profile so the
+	// inline login requests the same resources the user previously configured.
+	resourcesList := u2mResourcesFromProfile(existingProfile)
+
 	oauthArgument, err := loginArgs.ToOAuthArgument()
 	if err != nil {
 		return "", nil, err
@@ -457,11 +461,16 @@ func runInlineLogin(ctx context.Context, profiler profile.Profiler, tokenCache c
 	persistentAuthOpts := []u2m.PersistentAuthOption{
 		u2m.WithOAuthArgument(oauthArgument),
 		u2m.WithBrowser(func(url string) error { return browser.Open(ctx, url) }),
-		u2m.WithTokenCache(storage.WrapForOAuthArgument(tokenCache, mode, oauthArgument)),
+	}
+	if clientID := u2mClientIDFromProfile(existingProfile); clientID != "" {
+		persistentAuthOpts = append(persistentAuthOpts, u2m.WithClientID(clientID))
 	}
 	if len(scopesList) > 0 {
 		persistentAuthOpts = append(persistentAuthOpts, u2m.WithScopes(scopesList))
 	}
+	if len(resourcesList) > 0 {
+		persistentAuthOpts = append(persistentAuthOpts, u2m.WithResources(resourcesList))
+	}
 	persistentAuth, err := u2m.NewPersistentAuth(ctx, persistentAuthOpts...)
 	if err != nil {
 		return "", nil, err
@@ -471,7 +480,8 @@ func runInlineLogin(ctx context.Context, profiler profile.Profiler, tokenCache c
 	ctx, cancel := context.WithTimeout(ctx, defaultTimeout)
 	defer cancel()
 
-	if err = persistentAuth.Challenge(); err != nil {
+	token, err := persistentAuth.Challenge()
+	if err != nil {
 		return "", nil, err
 	}
 
@@ -486,10 +496,20 @@ func runInlineLogin(ctx context.Context, profiler profile.Profiler, tokenCache c
 		WorkspaceID: loginArgs.WorkspaceID,
 		ConfigFile:  env.Get(ctx, "DATABRICKS_CONFIG_FILE"),
 		Scopes:      scopesList,
+		ClientID:    u2mClientIDFromProfile(existingProfile),
 	}, clearKeys...)
 	if err != nil {
 		return "", nil, err
 	}
+	// TODO: resources is not supported in the SDK yet. This function is
+	// a short-cut to add the property to the profile until it is supported
+	// in the SDK.
+	if err := databrickscfg.SaveResourcesToProfile(ctx, profileName, env.Get(ctx, "DATABRICKS_CONFIG_FILE"), resourcesList); err != nil {
+		return "", nil, err
+	}
+	if err := storeLoginToken(ctx, tokenStore, mode, oauthArgument, token); err != nil {
+		return "", nil, err
+	}
 
 	cmdio.LogString(ctx, fmt.Sprintf("Profile %s was successfully saved", profileName))
 
diff --git a/cmd/auth/token_test.go b/cmd/auth/token_test.go
index 3dfa4e5d21a..e37e7cdc01b 100644
--- a/cmd/auth/token_test.go
+++ b/cmd/auth/token_test.go
@@ -6,19 +6,39 @@ import (
 	"encoding/json"
 	"errors"
 	"net/http"
+	"net/url"
 	"testing"
 	"time"
 
 	"github.com/databricks/cli/libs/auth"
+	"github.com/databricks/cli/libs/auth/storage"
+	"github.com/databricks/cli/libs/auth/u2m"
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/databrickscfg/profile"
 	"github.com/databricks/cli/libs/env"
-	"github.com/databricks/databricks-sdk-go/credentials/u2m"
 	"github.com/databricks/databricks-sdk-go/httpclient/fixtures"
 	"github.com/stretchr/testify/assert"
 	"golang.org/x/oauth2"
 )
 
+// upgradeHintStore returns a notFoundHint-wrapped ErrNotFound on
+// Lookup, mirroring what storage.notFoundHintCache produces in
+// production when ~/.databricks/token-cache.json has entries and the
+// resolver picked secure mode by default. Used by TestToken_loadToken
+// to verify that auth token surfaces the upgrade-specific hint instead
+// of dropping it for the SDK-compat constant string.
+type upgradeHintStore struct{}
+
+func (upgradeHintStore) Put(string, storage.Entry) error { return nil }
+func (upgradeHintStore) Delete(string) error             { return nil }
+func (upgradeHintStore) Lookup(string) (storage.Entry, error) {
+	return storage.Entry{}, storage.NewNotFoundHint(
+		"stored credentials from older CLI versions are no longer used; run `databricks auth login` to sign in again, or set DATABRICKS_AUTH_STORAGE=plaintext to keep using the file cache",
+	)
+}
+
+var _ storage.Store = upgradeHintStore{}
+
 type failOnCallTransport struct{}
 
 func (failOnCallTransport) RoundTrip(*http.Request) (*http.Response, error) {
@@ -148,9 +168,16 @@ func TestToken_loadToken(t *testing.T) {
 				Name: "valid-token",
 				Host: "https://valid-token.cloud.databricks.com",
 			},
+			{
+				Name:      "custom-client",
+				Host:      "https://accounts.cloud.databricks.com",
+				AccountID: "custom-client",
+				AuthType:  authTypeDatabricksCLI,
+				ClientID:  "custom-client-id",
+			},
 		},
 	}
-	tokenCache := &inMemoryTokenCache{
+	tokenStore := &inMemoryStore{
 		Tokens: map[string]*oauth2.Token{
 			"https://accounts.cloud.databricks.com/oidc/accounts/expired": {
 				RefreshToken: "expired",
@@ -199,6 +226,9 @@ func TestToken_loadToken(t *testing.T) {
 				RefreshToken: "valid-token",
 				Expiry:       time.Now().Add(1 * time.Hour),
 			},
+			"custom-client": {
+				RefreshToken: "custom-refresh-token",
+			},
 		},
 	}
 	validateToken := func(got *oauth2.Token) {
@@ -207,11 +237,12 @@ func TestToken_loadToken(t *testing.T) {
 	}
 
 	cases := []struct {
-		name          string
-		setupCtx      func(context.Context) context.Context
-		args          loadTokenArgs
-		validateToken func(*oauth2.Token)
-		wantErr       string
+		name                    string
+		setupCtx                func(context.Context) context.Context
+		args                    loadTokenArgs
+		validateToken           func(*oauth2.Token)
+		wantErr                 string
+		wantInvalidRefreshToken bool
 	}{
 		{
 			name: "prints helpful login message on refresh failure when profile is specified",
@@ -221,15 +252,16 @@ func TestToken_loadToken(t *testing.T) {
 				args:          []string{},
 				tokenTimeout:  1 * time.Hour,
 				profiler:      profiler,
-				tokenCache:    tokenCache,
+				tokenStore:    tokenStore,
 				persistentAuthOpts: []u2m.PersistentAuthOption{
-					u2m.WithTokenCache(tokenCache),
+					u2m.WithTokenStore(tokenStore),
 					u2m.WithOAuthEndpointSupplier(&MockApiClient{}),
 					u2m.WithHttpClient(&http.Client{Transport: fixtures.SliceTransport{refreshFailureTokenResponse}}),
 				},
 			},
 			wantErr: `A new access token could not be retrieved because the refresh token is invalid. To reauthenticate, run the following command:
   $ databricks auth login --profile expired`,
+			wantInvalidRefreshToken: true,
 		},
 		{
 			name: "prints helpful login message on refresh failure when host is specified",
@@ -242,15 +274,16 @@ func TestToken_loadToken(t *testing.T) {
 				args:         []string{},
 				tokenTimeout: 1 * time.Hour,
 				profiler:     profiler,
-				tokenCache:   tokenCache,
+				tokenStore:   tokenStore,
 				persistentAuthOpts: []u2m.PersistentAuthOption{
-					u2m.WithTokenCache(tokenCache),
+					u2m.WithTokenStore(tokenStore),
 					u2m.WithOAuthEndpointSupplier(&MockApiClient{}),
 					u2m.WithHttpClient(&http.Client{Transport: fixtures.SliceTransport{refreshFailureTokenResponse}}),
 				},
 			},
 			wantErr: `A new access token could not be retrieved because the refresh token is invalid. To reauthenticate, run the following command:
   $ databricks auth login --profile expired`,
+			wantInvalidRefreshToken: true,
 		},
 		{
 			name: "prints helpful login message on invalid response",
@@ -260,9 +293,9 @@ func TestToken_loadToken(t *testing.T) {
 				args:          []string{},
 				tokenTimeout:  1 * time.Hour,
 				profiler:      profiler,
-				tokenCache:    tokenCache,
+				tokenStore:    tokenStore,
 				persistentAuthOpts: []u2m.PersistentAuthOption{
-					u2m.WithTokenCache(tokenCache),
+					u2m.WithTokenStore(tokenStore),
 					u2m.WithOAuthEndpointSupplier(&MockApiClient{}),
 					u2m.WithHttpClient(&http.Client{Transport: fixtures.SliceTransport{refreshFailureInvalidResponse}}),
 				},
@@ -278,9 +311,9 @@ func TestToken_loadToken(t *testing.T) {
 				args:          []string{},
 				tokenTimeout:  1 * time.Hour,
 				profiler:      profiler,
-				tokenCache:    tokenCache,
+				tokenStore:    tokenStore,
 				persistentAuthOpts: []u2m.PersistentAuthOption{
-					u2m.WithTokenCache(tokenCache),
+					u2m.WithTokenStore(tokenStore),
 					u2m.WithOAuthEndpointSupplier(&MockApiClient{}),
 					u2m.WithHttpClient(&http.Client{Transport: fixtures.SliceTransport{refreshFailureOtherError}}),
 				},
@@ -296,15 +329,44 @@ func TestToken_loadToken(t *testing.T) {
 				args:          []string{},
 				tokenTimeout:  1 * time.Hour,
 				profiler:      profiler,
-				tokenCache:    tokenCache,
+				tokenStore:    tokenStore,
 				persistentAuthOpts: []u2m.PersistentAuthOption{
-					u2m.WithTokenCache(tokenCache),
+					u2m.WithTokenStore(tokenStore),
 					u2m.WithOAuthEndpointSupplier(&MockApiClient{}),
 					u2m.WithHttpClient(&http.Client{Transport: fixtures.SliceTransport{refreshSuccessTokenResponse}}),
 				},
 			},
 			validateToken: validateToken,
 		},
+		{
+			name: "profile client ID is used for refresh",
+			args: loadTokenArgs{
+				authArguments: &auth.AuthArguments{},
+				profileName:   "custom-client",
+				args:          []string{},
+				tokenTimeout:  time.Hour,
+				profiler:      profiler,
+				tokenStore:    tokenStore,
+				persistentAuthOpts: []u2m.PersistentAuthOption{
+					u2m.WithTokenStore(tokenStore),
+					u2m.WithOAuthEndpointSupplier(&MockApiClient{}),
+					u2m.WithHttpClient(&http.Client{Transport: fixtures.SliceTransport{{
+						MatchAny: true,
+						ExpectedRequest: url.Values{
+							"client_id":     {"custom-client-id"},
+							"grant_type":    {"refresh_token"},
+							"refresh_token": {"custom-refresh-token"},
+						},
+						Response: map[string]string{
+							"access_token": "new-access-token",
+							"token_type":   "Bearer",
+							"expires_in":   "3600",
+						},
+					}}}),
+				},
+			},
+			validateToken: validateToken,
+		},
 		{
 			name: "succeeds with host",
 			args: loadTokenArgs{
@@ -313,9 +375,9 @@ func TestToken_loadToken(t *testing.T) {
 				args:          []string{},
 				tokenTimeout:  1 * time.Hour,
 				profiler:      profiler,
-				tokenCache:    tokenCache,
+				tokenStore:    tokenStore,
 				persistentAuthOpts: []u2m.PersistentAuthOption{
-					u2m.WithTokenCache(tokenCache),
+					u2m.WithTokenStore(tokenStore),
 					u2m.WithOAuthEndpointSupplier(&MockApiClient{}),
 					u2m.WithHttpClient(&http.Client{Transport: fixtures.SliceTransport{refreshSuccessTokenResponse}}),
 				},
@@ -330,9 +392,9 @@ func TestToken_loadToken(t *testing.T) {
 				args:          []string{},
 				tokenTimeout:  1 * time.Hour,
 				profiler:      profiler,
-				tokenCache:    tokenCache,
+				tokenStore:    tokenStore,
 				persistentAuthOpts: []u2m.PersistentAuthOption{
-					u2m.WithTokenCache(tokenCache),
+					u2m.WithTokenStore(tokenStore),
 					u2m.WithOAuthEndpointSupplier(&MockApiClient{}),
 					u2m.WithHttpClient(&http.Client{Transport: fixtures.SliceTransport{refreshSuccessTokenResponse}}),
 				},
@@ -347,9 +409,9 @@ func TestToken_loadToken(t *testing.T) {
 				args:          []string{"workspace-a"},
 				tokenTimeout:  1 * time.Hour,
 				profiler:      profiler,
-				tokenCache:    tokenCache,
+				tokenStore:    tokenStore,
 				persistentAuthOpts: []u2m.PersistentAuthOption{
-					u2m.WithTokenCache(tokenCache),
+					u2m.WithTokenStore(tokenStore),
 					u2m.WithOAuthEndpointSupplier(&MockApiClient{}),
 					u2m.WithHttpClient(&http.Client{Transport: fixtures.SliceTransport{refreshSuccessTokenResponse}}),
 				},
@@ -364,9 +426,9 @@ func TestToken_loadToken(t *testing.T) {
 				args:          []string{"workspace-a.cloud.databricks.com"},
 				tokenTimeout:  1 * time.Hour,
 				profiler:      profiler,
-				tokenCache:    tokenCache,
+				tokenStore:    tokenStore,
 				persistentAuthOpts: []u2m.PersistentAuthOption{
-					u2m.WithTokenCache(tokenCache),
+					u2m.WithTokenStore(tokenStore),
 					u2m.WithOAuthEndpointSupplier(&MockApiClient{}),
 					u2m.WithHttpClient(&http.Client{Transport: fixtures.SliceTransport{refreshSuccessTokenResponse}}),
 				},
@@ -381,9 +443,9 @@ func TestToken_loadToken(t *testing.T) {
 				args:          []string{"default.dev"},
 				tokenTimeout:  1 * time.Hour,
 				profiler:      profiler,
-				tokenCache:    tokenCache,
+				tokenStore:    tokenStore,
 				persistentAuthOpts: []u2m.PersistentAuthOption{
-					u2m.WithTokenCache(tokenCache),
+					u2m.WithTokenStore(tokenStore),
 					u2m.WithOAuthEndpointSupplier(&MockApiClient{}),
 					u2m.WithHttpClient(&http.Client{Transport: fixtures.SliceTransport{refreshSuccessTokenResponse}}),
 				},
@@ -398,9 +460,9 @@ func TestToken_loadToken(t *testing.T) {
 				args:          []string{"nonexistent.cloud.databricks.com"},
 				tokenTimeout:  1 * time.Hour,
 				profiler:      profiler,
-				tokenCache:    tokenCache,
+				tokenStore:    tokenStore,
 				persistentAuthOpts: []u2m.PersistentAuthOption{
-					u2m.WithTokenCache(tokenCache),
+					u2m.WithTokenStore(tokenStore),
 					u2m.WithOAuthEndpointSupplier(&MockApiClient{}),
 				},
 			},
@@ -408,6 +470,35 @@ func TestToken_loadToken(t *testing.T) {
 				"Try logging in again with `databricks auth login --host https://nonexistent.cloud.databricks.com` before retrying. " +
 				"If this fails, please report this issue to the Databricks CLI maintainers at https://github.com/databricks/cli/issues/new",
 		},
+		{
+			// Regression test: when notFoundHintCache wraps ErrNotFound
+			// with the upgrade copy (post-upgrade default-secure user
+			// with a populated token-cache.json), `auth token` must
+			// surface that hint instead of dropping it for the SDK-compat
+			// constant string. The combined message keeps the
+			// "OAuth is not configured for this host" substring older
+			// SDK versions look for and skips the generic "Try logging
+			// in again ... If this fails, please report this issue"
+			// trailer, which would mislead users into reporting expected
+			// post-upgrade behavior.
+			name: "ErrNotFound carrying upgrade hint surfaces it",
+			args: loadTokenArgs{
+				authArguments: &auth.AuthArguments{},
+				profileName:   "",
+				args:          []string{"nonexistent.cloud.databricks.com"},
+				tokenTimeout:  1 * time.Hour,
+				profiler:      profiler,
+				tokenStore:    upgradeHintStore{},
+				persistentAuthOpts: []u2m.PersistentAuthOption{
+					u2m.WithTokenStore(upgradeHintStore{}),
+					u2m.WithOAuthEndpointSupplier(&MockApiClient{}),
+				},
+			},
+			wantErr: "cache: databricks OAuth is not configured for this host. " +
+				"stored credentials from older CLI versions are no longer used; " +
+				"run `databricks auth login` to sign in again, " +
+				"or set DATABRICKS_AUTH_STORAGE=plaintext to keep using the file cache",
+		},
 		{
 			name: "errors with clear message for non-host non-profile positional arg",
 			args: loadTokenArgs{
@@ -430,9 +521,9 @@ func TestToken_loadToken(t *testing.T) {
 				args:         []string{},
 				tokenTimeout: 1 * time.Hour,
 				profiler:     profiler,
-				tokenCache:   tokenCache,
+				tokenStore:   tokenStore,
 				persistentAuthOpts: []u2m.PersistentAuthOption{
-					u2m.WithTokenCache(tokenCache),
+					u2m.WithTokenStore(tokenStore),
 					u2m.WithOAuthEndpointSupplier(&MockApiClient{}),
 				},
 			},
@@ -448,9 +539,9 @@ func TestToken_loadToken(t *testing.T) {
 				args:         []string{},
 				tokenTimeout: 1 * time.Hour,
 				profiler:     profiler,
-				tokenCache:   tokenCache,
+				tokenStore:   tokenStore,
 				persistentAuthOpts: []u2m.PersistentAuthOption{
-					u2m.WithTokenCache(tokenCache),
+					u2m.WithTokenStore(tokenStore),
 					u2m.WithOAuthEndpointSupplier(&MockApiClient{}),
 				},
 			},
@@ -467,9 +558,9 @@ func TestToken_loadToken(t *testing.T) {
 				args:         []string{},
 				tokenTimeout: 1 * time.Hour,
 				profiler:     profiler,
-				tokenCache:   tokenCache,
+				tokenStore:   tokenStore,
 				persistentAuthOpts: []u2m.PersistentAuthOption{
-					u2m.WithTokenCache(tokenCache),
+					u2m.WithTokenStore(tokenStore),
 					u2m.WithOAuthEndpointSupplier(&MockApiClient{}),
 					u2m.WithHttpClient(&http.Client{Transport: fixtures.SliceTransport{refreshSuccessTokenResponse}}),
 				},
@@ -487,9 +578,9 @@ func TestToken_loadToken(t *testing.T) {
 				args:         []string{},
 				tokenTimeout: 1 * time.Hour,
 				profiler:     profiler,
-				tokenCache:   tokenCache,
+				tokenStore:   tokenStore,
 				persistentAuthOpts: []u2m.PersistentAuthOption{
-					u2m.WithTokenCache(tokenCache),
+					u2m.WithTokenStore(tokenStore),
 					u2m.WithOAuthEndpointSupplier(&MockApiClient{}),
 				},
 			},
@@ -505,9 +596,9 @@ func TestToken_loadToken(t *testing.T) {
 				args:         []string{},
 				tokenTimeout: 1 * time.Hour,
 				profiler:     profiler,
-				tokenCache:   tokenCache,
+				tokenStore:   tokenStore,
 				persistentAuthOpts: []u2m.PersistentAuthOption{
-					u2m.WithTokenCache(tokenCache),
+					u2m.WithTokenStore(tokenStore),
 					u2m.WithOAuthEndpointSupplier(&MockApiClient{}),
 					u2m.WithHttpClient(&http.Client{Transport: fixtures.SliceTransport{refreshSuccessTokenResponse}}),
 				},
@@ -524,28 +615,9 @@ func TestToken_loadToken(t *testing.T) {
 				args:         []string{},
 				tokenTimeout: 1 * time.Hour,
 				profiler:     profiler,
-				tokenCache:   tokenCache,
+				tokenStore:   tokenStore,
 				persistentAuthOpts: []u2m.PersistentAuthOption{
-					u2m.WithTokenCache(tokenCache),
-					u2m.WithOAuthEndpointSupplier(&MockApiClient{}),
-					u2m.WithHttpClient(&http.Client{Transport: fixtures.SliceTransport{refreshSuccessTokenResponse}}),
-				},
-			},
-			validateToken: validateToken,
-		},
-		{
-			name: "host with one matching profile and host-key-only token found via SDK fallback",
-			args: loadTokenArgs{
-				authArguments: &auth.AuthArguments{
-					Host: "https://legacy-ws.cloud.databricks.com",
-				},
-				profileName:  "",
-				args:         []string{},
-				tokenTimeout: 1 * time.Hour,
-				profiler:     profiler,
-				tokenCache:   tokenCache,
-				persistentAuthOpts: []u2m.PersistentAuthOption{
-					u2m.WithTokenCache(tokenCache),
+					u2m.WithTokenStore(tokenStore),
 					u2m.WithOAuthEndpointSupplier(&MockApiClient{}),
 					u2m.WithHttpClient(&http.Client{Transport: fixtures.SliceTransport{refreshSuccessTokenResponse}}),
 				},
@@ -560,9 +632,9 @@ func TestToken_loadToken(t *testing.T) {
 				args:          []string{"workspace-a"},
 				tokenTimeout:  1 * time.Hour,
 				profiler:      profiler,
-				tokenCache:    tokenCache,
+				tokenStore:    tokenStore,
 				persistentAuthOpts: []u2m.PersistentAuthOption{
-					u2m.WithTokenCache(tokenCache),
+					u2m.WithTokenStore(tokenStore),
 					u2m.WithOAuthEndpointSupplier(&MockApiClient{}),
 				},
 			},
@@ -576,7 +648,7 @@ func TestToken_loadToken(t *testing.T) {
 				args:               []string{},
 				tokenTimeout:       1 * time.Hour,
 				profiler:           profiler,
-				tokenCache:         tokenCache,
+				tokenStore:         tokenStore,
 				persistentAuthOpts: nil,
 			},
 			wantErr: "no profile specified. Use --profile <name> to specify which profile to use",
@@ -589,7 +661,7 @@ func TestToken_loadToken(t *testing.T) {
 				args:               []string{},
 				tokenTimeout:       1 * time.Hour,
 				profiler:           profile.InMemoryProfiler{},
-				tokenCache:         tokenCache,
+				tokenStore:         tokenStore,
 				persistentAuthOpts: nil,
 			},
 			wantErr: "no profiles configured. Run 'databricks auth login' to create a profile",
@@ -602,7 +674,7 @@ func TestToken_loadToken(t *testing.T) {
 				args:               []string{},
 				tokenTimeout:       1 * time.Hour,
 				profiler:           errProfiler{err: profile.ErrNoConfiguration},
-				tokenCache:         tokenCache,
+				tokenStore:         tokenStore,
 				persistentAuthOpts: nil,
 			},
 			wantErr: "no profiles configured. Run 'databricks auth login' to create a profile",
@@ -660,9 +732,9 @@ func TestToken_loadToken(t *testing.T) {
 				args:          []string{},
 				tokenTimeout:  1 * time.Hour,
 				profiler:      profiler,
-				tokenCache:    tokenCache,
+				tokenStore:    tokenStore,
 				persistentAuthOpts: []u2m.PersistentAuthOption{
-					u2m.WithTokenCache(tokenCache),
+					u2m.WithTokenStore(tokenStore),
 					u2m.WithOAuthEndpointSupplier(&MockApiClient{}),
 					u2m.WithHttpClient(&http.Client{Transport: fixtures.SliceTransport{refreshSuccessTokenResponse}}),
 				},
@@ -681,9 +753,9 @@ func TestToken_loadToken(t *testing.T) {
 				args:          []string{},
 				tokenTimeout:  1 * time.Hour,
 				profiler:      profiler,
-				tokenCache:    tokenCache,
+				tokenStore:    tokenStore,
 				persistentAuthOpts: []u2m.PersistentAuthOption{
-					u2m.WithTokenCache(tokenCache),
+					u2m.WithTokenStore(tokenStore),
 					u2m.WithOAuthEndpointSupplier(&MockApiClient{}),
 					u2m.WithHttpClient(&http.Client{Transport: fixtures.SliceTransport{refreshSuccessTokenResponse}}),
 				},
@@ -702,9 +774,9 @@ func TestToken_loadToken(t *testing.T) {
 				args:          []string{},
 				tokenTimeout:  1 * time.Hour,
 				profiler:      profiler,
-				tokenCache:    tokenCache,
+				tokenStore:    tokenStore,
 				persistentAuthOpts: []u2m.PersistentAuthOption{
-					u2m.WithTokenCache(tokenCache),
+					u2m.WithTokenStore(tokenStore),
 					u2m.WithOAuthEndpointSupplier(&MockApiClient{}),
 					u2m.WithHttpClient(&http.Client{Transport: fixtures.SliceTransport{refreshSuccessTokenResponse}}),
 				},
@@ -724,9 +796,9 @@ func TestToken_loadToken(t *testing.T) {
 				args:          []string{},
 				tokenTimeout:  1 * time.Hour,
 				profiler:      profiler,
-				tokenCache:    tokenCache,
+				tokenStore:    tokenStore,
 				persistentAuthOpts: []u2m.PersistentAuthOption{
-					u2m.WithTokenCache(tokenCache),
+					u2m.WithTokenStore(tokenStore),
 					u2m.WithOAuthEndpointSupplier(&MockApiClient{}),
 					u2m.WithHttpClient(&http.Client{Transport: fixtures.SliceTransport{refreshSuccessTokenResponse}}),
 				},
@@ -760,9 +832,9 @@ func TestToken_loadToken(t *testing.T) {
 				args:         []string{},
 				tokenTimeout: 1 * time.Hour,
 				profiler:     profiler,
-				tokenCache:   tokenCache,
+				tokenStore:   tokenStore,
 				persistentAuthOpts: []u2m.PersistentAuthOption{
-					u2m.WithTokenCache(tokenCache),
+					u2m.WithTokenStore(tokenStore),
 					u2m.WithOAuthEndpointSupplier(&MockApiClient{}),
 					u2m.WithHttpClient(&http.Client{Transport: fixtures.SliceTransport{refreshSuccessTokenResponse}}),
 				},
@@ -777,9 +849,9 @@ func TestToken_loadToken(t *testing.T) {
 				args:          []string{},
 				tokenTimeout:  1 * time.Hour,
 				profiler:      profiler,
-				tokenCache:    tokenCache,
+				tokenStore:    tokenStore,
 				persistentAuthOpts: []u2m.PersistentAuthOption{
-					u2m.WithTokenCache(tokenCache),
+					u2m.WithTokenStore(tokenStore),
 					u2m.WithOAuthEndpointSupplier(&MockApiClient{}),
 					u2m.WithHttpClient(&http.Client{Transport: failOnCallTransport{}}),
 				},
@@ -797,9 +869,9 @@ func TestToken_loadToken(t *testing.T) {
 				tokenTimeout:  1 * time.Hour,
 				forceRefresh:  true,
 				profiler:      profiler,
-				tokenCache:    tokenCache,
+				tokenStore:    tokenStore,
 				persistentAuthOpts: []u2m.PersistentAuthOption{
-					u2m.WithTokenCache(tokenCache),
+					u2m.WithTokenStore(tokenStore),
 					u2m.WithOAuthEndpointSupplier(&MockApiClient{}),
 					u2m.WithHttpClient(&http.Client{Transport: fixtures.SliceTransport{refreshSuccessTokenResponse}}),
 				},
@@ -815,15 +887,16 @@ func TestToken_loadToken(t *testing.T) {
 				tokenTimeout:  1 * time.Hour,
 				forceRefresh:  true,
 				profiler:      profiler,
-				tokenCache:    tokenCache,
+				tokenStore:    tokenStore,
 				persistentAuthOpts: []u2m.PersistentAuthOption{
-					u2m.WithTokenCache(tokenCache),
+					u2m.WithTokenStore(tokenStore),
 					u2m.WithOAuthEndpointSupplier(&MockApiClient{}),
 					u2m.WithHttpClient(&http.Client{Transport: fixtures.SliceTransport{refreshFailureTokenResponse}}),
 				},
 			},
 			wantErr: `A new access token could not be retrieved because the refresh token is invalid. To reauthenticate, run the following command:
   $ databricks auth login --profile valid-token`,
+			wantInvalidRefreshToken: true,
 		},
 	}
 	for _, c := range cases {
@@ -835,6 +908,8 @@ func TestToken_loadToken(t *testing.T) {
 			got, err := loadToken(ctx, c.args)
 			if c.wantErr != "" {
 				assert.Equal(t, c.wantErr, err.Error())
+				_, isInvalidRefreshToken := errors.AsType[*u2m.InvalidRefreshTokenError](err)
+				assert.Equal(t, c.wantInvalidRefreshToken, isInvalidRefreshToken)
 			} else {
 				assert.NoError(t, err)
 				c.validateToken(got)
@@ -879,3 +954,14 @@ func TestWriteTokenOutput(t *testing.T) {
 		assert.Equal(t, "my-access-token\n", buf.String())
 	})
 }
+
+func TestWriteTokenErrorOutput(t *testing.T) {
+	var buf bytes.Buffer
+	err := writeTokenErrorOutput(&buf, errors.New("refresh token is invalid"))
+	assert.NoError(t, err)
+
+	var got tokenErrorOutput
+	assert.NoError(t, json.Unmarshal(buf.Bytes(), &got))
+	assert.Equal(t, unauthenticatedErrorCode, got.ErrorCode)
+	assert.Equal(t, "refresh token is invalid", got.Message)
+}
diff --git a/cmd/bundle/bundle.go b/cmd/bundle/bundle.go
index 3f4985c2480..d8334d38289 100644
--- a/cmd/bundle/bundle.go
+++ b/cmd/bundle/bundle.go
@@ -40,5 +40,6 @@ Online documentation: https://docs.databricks.com/en/dev-tools/bundles/index.htm
 	cmd.AddCommand(newOpenCommand())
 	cmd.AddCommand(newPlanCommand())
 	cmd.AddCommand(newConfigRemoteSyncCommand())
+
 	return cmd
 }
diff --git a/cmd/bundle/config_remote_sync.go b/cmd/bundle/config_remote_sync.go
index c50e613d71a..8044a28bf9c 100644
--- a/cmd/bundle/config_remote_sync.go
+++ b/cmd/bundle/config_remote_sync.go
@@ -2,23 +2,29 @@ package bundle
 
 import (
 	"context"
-	"encoding/json"
 	"errors"
 	"fmt"
+	"maps"
 	"runtime"
+	"slices"
+	"strings"
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/bundle/configsync"
+	"github.com/databricks/cli/bundle/deployplan"
 	"github.com/databricks/cli/bundle/statemgmt"
 	"github.com/databricks/cli/cmd/bundle/utils"
 	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
 	"github.com/databricks/cli/libs/flags"
 	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/telemetry/protos"
 	"github.com/spf13/cobra"
 )
 
 func newConfigRemoteSyncCommand() *cobra.Command {
 	var save bool
+	var selectIDs []string
 
 	cmd := &cobra.Command{
 		Use:   "config-remote-sync",
@@ -35,17 +41,40 @@ Examples:
   databricks bundle config-remote-sync
 
   # Show diff and save to files
-  databricks bundle config-remote-sync --save`,
+  databricks bundle config-remote-sync --save
+
+  # Restrict the sync to a single resource by its type and deployed resource ID
+  databricks bundle config-remote-sync --select-ids jobs:123456789 --save`,
 		Hidden: true, // Used by DABs in the Workspace only
 	}
 
 	cmd.Flags().BoolVar(&save, "save", false, "Write updated config files to disk")
+	cmd.Flags().StringSliceVar(&selectIDs, "select-ids", nil, "Sync only the given resources, each as <type>:<id> (e.g. jobs:123456789). Can be repeated or comma-separated.")
 
 	cmd.RunE = func(cmd *cobra.Command, args []string) error {
 		if runtime.GOOS == "windows" {
 			return errors.New("config-remote-sync command is not supported on Windows")
 		}
 
+		stats := configsync.Stats{Save: save}
+
+		// Emit telemetry on every exit path, including failures inside
+		// ProcessBundleRet before PostStateFunc runs. Skip when no auth config
+		// was resolved: without it the upload at the end of the command
+		// lifecycle has no workspace to send to.
+		defer func() {
+			if cmdctx.HasConfigUsed(cmd.Context()) {
+				stats.LogTelemetry(cmd.Context())
+			}
+		}()
+
+		// Populated by PostStateFunc on success; rendered after the run so an
+		// error raised anywhere in ProcessBundleRet takes the same output path.
+		var (
+			files   []configsync.FileChange
+			changes configsync.Changes
+		)
+
 		_, _, err := utils.ProcessBundleRet(cmd, utils.ProcessOptions{
 			ReadState:  true,
 			Build:      true,
@@ -54,52 +83,90 @@ Examples:
 				b.SkipLocalFileValidation = true
 			},
 			PostStateFunc: func(ctx context.Context, b *bundle.Bundle, stateDesc *statemgmt.StateDesc) error {
-				changes, err := configsync.DetectChanges(ctx, b, stateDesc.Engine)
+				stats.Engine = stateDesc.Engine
+				stats.CollectStateStats(stateDesc, b.DeploymentBundle.StateDB.VersionID)
+
+				// ProcessBundleRet has already opened the direct state for reading.
+				deployBundle := &b.DeploymentBundle
+
+				plan, err := deployBundle.CalculatePlan(ctx, b.WorkspaceClient(ctx), &b.Config)
 				if err != nil {
+					stats.ErrorCategory = protos.BundleConfigRemoteSyncErrorCategoryDetectChangesFailed
 					return fmt.Errorf("failed to detect changes: %w", err)
 				}
 
-				fieldChanges, err := configsync.ResolveChanges(ctx, b, changes)
+				detected, err := configsync.ExtractChanges(ctx, b, plan)
 				if err != nil {
+					stats.ErrorCategory = protos.BundleConfigRemoteSyncErrorCategoryDetectChangesFailed
+					return fmt.Errorf("failed to extract changes: %w", err)
+				}
+				stats.CollectChangeStats(ctx, detected)
+
+				// Record the ids present in state and the ids requested: on failure
+				// they are what classifies the miss.
+				stats.CollectStateIDs(slices.Collect(maps.Keys(configsync.IndexDeployedResources(&deployBundle.StateDB))))
+
+				if len(selectIDs) > 0 {
+					stats.CollectSelectedIDs(selectIDs)
+					// Filter after planning, never before: the plan must cover every
+					// resource so ${resources.*} references resolve; only the emitted
+					// changes are restricted to the selected resources.
+					selected, err := configsync.ResolveResourceSelectors(ctx, &deployBundle.StateDB, selectIDs)
+					if err != nil {
+						return err
+					}
+					// A selected resource planned as a delete was renamed or removed in the
+					// config, so its remote changes have nowhere to be written back.
+					var missing []string
+					for _, key := range selected {
+						if plan.Plan[key].Action == deployplan.Delete {
+							missing = append(missing, key)
+						}
+					}
+					if len(missing) > 0 {
+						stats.ErrorCategory = protos.BundleConfigRemoteSyncErrorCategoryResourceNotInConfig
+						return fmt.Errorf("deployed resources missing from the bundle configuration (renamed or removed since the last deploy): %s", strings.Join(missing, ", "))
+					}
+					detected = configsync.FilterChanges(detected, selected)
+				}
+
+				// Loaded once and shared: ResolveChanges uses it to skip changes whose
+				// parent is a variable reference, RestoreVariableReferences to restore refs.
+				preResolved := configsync.LoadPreResolvedConfig(ctx, b)
+
+				fieldChanges, skipped, err := configsync.ResolveChanges(ctx, b, detected, preResolved)
+				if err != nil {
+					stats.ErrorCategory = protos.BundleConfigRemoteSyncErrorCategoryResolveFailed
 					return fmt.Errorf("failed to resolve field changes: %w", err)
 				}
+				stats.SkippedChangesCount = int64(skipped)
 
-				if err := configsync.RestoreVariableReferences(ctx, b, fieldChanges); err != nil {
+				if err := configsync.RestoreVariableReferences(ctx, b, fieldChanges, preResolved, &stats.Restore); err != nil {
 					log.Warnf(ctx, "variable restoration skipped: %v", err)
 				}
 
-				files, err := configsync.ApplyChangesToYAML(ctx, b, fieldChanges)
+				applied, err := configsync.ApplyChangesToYAML(ctx, b, fieldChanges)
 				if err != nil {
+					stats.ErrorCategory = protos.BundleConfigRemoteSyncErrorCategoryYamlApplyFailed
 					return fmt.Errorf("failed to generate YAML files: %w", err)
 				}
+				stats.FilesChangedCount = int64(len(applied))
 
 				if save {
-					if err := configsync.SaveFiles(ctx, b, files); err != nil {
+					if err := configsync.SaveFiles(ctx, b, applied); err != nil {
+						stats.ErrorCategory = protos.BundleConfigRemoteSyncErrorCategorySaveFailed
 						return fmt.Errorf("failed to save files: %w", err)
 					}
+					stats.FilesWrittenCount = int64(len(applied))
 				}
 
-				var result []byte
-				if root.OutputType(cmd) == flags.OutputJSON {
-					diffOutput := &configsync.DiffOutput{
-						Files:   files,
-						Changes: changes,
-					}
-					result, err = json.MarshalIndent(diffOutput, "", "  ")
-					if err != nil {
-						return fmt.Errorf("failed to marshal output: %w", err)
-					}
-				} else if root.OutputType(cmd) == flags.OutputText {
-					result = []byte(configsync.FormatTextOutput(changes))
-				}
-
-				out := cmd.OutOrStdout()
-				_, _ = out.Write(result)
-				_, _ = out.Write([]byte{'\n'})
+				files = applied
+				changes = detected
 				return nil
 			},
 		})
-		return err
+
+		return configsync.WriteResult(cmd.OutOrStdout(), root.OutputType(cmd) == flags.OutputJSON, &stats, files, changes, err)
 	}
 
 	return cmd
diff --git a/cmd/bundle/debug.go b/cmd/bundle/debug.go
index c62c75080cc..e87f6bcd297 100644
--- a/cmd/bundle/debug.go
+++ b/cmd/bundle/debug.go
@@ -13,10 +13,10 @@ func newDebugCommand() *cobra.Command {
 		// This command group is currently intended for the Databricks VSCode extension only
 		Hidden: true,
 	}
-	cmd.AddCommand(debug.NewTerraformCommand())
 	cmd.AddCommand(debug.NewRefSchemaCommand())
 	cmd.AddCommand(debug.NewStatesCommand())
 	cmd.AddCommand(debug.NewRenderTemplateSchemaCommand())
 	cmd.AddCommand(debug.NewListTargetsCommand())
+	cmd.AddCommand(debug.NewFetchRepositoryInfoCommand())
 	return cmd
 }
diff --git a/cmd/bundle/debug/fetch_repository_info.go b/cmd/bundle/debug/fetch_repository_info.go
new file mode 100644
index 00000000000..f735d215c60
--- /dev/null
+++ b/cmd/bundle/debug/fetch_repository_info.go
@@ -0,0 +1,63 @@
+package debug
+
+import (
+	"encoding/json"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/git"
+	"github.com/spf13/cobra"
+)
+
+// repositoryInfoOutput mirrors git.RepositoryInfo, which has no JSON tags.
+type repositoryInfoOutput struct {
+	WorktreeRoot  string `json:"worktree_root"`
+	CurrentBranch string `json:"current_branch"`
+	LatestCommit  string `json:"latest_commit"`
+	OriginURL     string `json:"origin_url"`
+}
+
+// NewFetchRepositoryInfoCommand returns a command that reports what
+// [git.FetchRepositoryInfoAPI] resolves for a path. It exists so that function
+// can be exercised through the CLI on both a fake and a real workspace; nothing
+// in the product calls it.
+//
+// It always reads the workspace API, which [git.FetchRepositoryInfo] only does on
+// a Databricks Runtime. That cannot be detected off-cluster, and reading .git is
+// covered by the TestFetchRepositoryInfoDotGit integration tests.
+func NewFetchRepositoryInfoCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:    "fetch-repository-info",
+		Short:  "Report the git metadata the workspace API resolves for a path",
+		Args:   root.NoArgs,
+		Hidden: true,
+	}
+
+	var path string
+	cmd.Flags().StringVar(&path, "path", ".", "Path to resolve git metadata for")
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) error {
+		ctx := cmd.Context()
+
+		info, err := git.FetchRepositoryInfoAPI(ctx, path, cmdctx.WorkspaceClient(ctx))
+		if err != nil {
+			return err
+		}
+
+		buf, err := json.MarshalIndent(repositoryInfoOutput{
+			WorktreeRoot:  info.WorktreeRoot,
+			CurrentBranch: info.CurrentBranch,
+			LatestCommit:  info.LatestCommit,
+			OriginURL:     info.OriginURL,
+		}, "", "  ")
+		if err != nil {
+			return err
+		}
+
+		_, err = cmd.OutOrStdout().Write(append(buf, '\n'))
+		return err
+	}
+
+	return cmd
+}
diff --git a/cmd/bundle/debug/list_targets.go b/cmd/bundle/debug/list_targets.go
index 02081a93710..ebd038da11d 100644
--- a/cmd/bundle/debug/list_targets.go
+++ b/cmd/bundle/debug/list_targets.go
@@ -9,6 +9,7 @@ import (
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/config/engine"
 	"github.com/databricks/cli/bundle/phases"
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdio"
@@ -23,18 +24,29 @@ type targetInfo struct {
 	Default bool        `json:"default,omitempty"`
 	Mode    config.Mode `json:"mode,omitempty"`
 	Host    string      `json:"host,omitempty"`
+
+	// Engine is only reported for targets that use the removed Terraform engine.
+	Engine engine.EngineType `json:"engine,omitempty"`
 }
 
 type listTargetsOutput struct {
 	Targets []targetInfo `json:"targets"`
 }
 
-func collectTargets(targets map[string]*config.Target) []targetInfo {
+// collectTargets returns the targets sorted by name. The engine of a target is
+// its own bundle.engine if set, otherwise the top-level bundle.engine.
+func collectTargets(targets map[string]*config.Target, rootEngine engine.EngineType) []targetInfo {
 	names := slices.Sorted(maps.Keys(targets))
 
 	result := make([]targetInfo, 0, len(names))
 	for _, name := range names {
 		t := targets[name]
+		// YAML decoding can leave a nil entry in the map when a target is
+		// declared with a null value. Skip rather than dereference and panic.
+		if t == nil {
+			result = append(result, targetInfo{Name: name, Engine: terraformOnly(rootEngine)})
+			continue
+		}
 		info := targetInfo{
 			Name:    name,
 			Default: t.Default,
@@ -43,13 +55,25 @@ func collectTargets(targets map[string]*config.Target) []targetInfo {
 		if t.Workspace != nil {
 			info.Host = t.Workspace.Host
 		}
+		targetEngine := rootEngine
+		if t.Bundle != nil && t.Bundle.Engine != engine.EngineNotSet {
+			targetEngine = t.Bundle.Engine
+		}
+		info.Engine = terraformOnly(targetEngine)
 		result = append(result, info)
 	}
 	return result
 }
 
+func terraformOnly(e engine.EngineType) engine.EngineType {
+	if e == engine.EngineTerraform {
+		return e
+	}
+	return engine.EngineNotSet
+}
+
 // NewListTargetsCommand returns a command that lists all bundle targets
-// with their name, default, mode, and workspace host fields.
+// with their name, default, mode, workspace host, and (if terraform) engine fields.
 func NewListTargetsCommand() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:    "list-targets",
@@ -73,7 +97,7 @@ func NewListTargetsCommand() *cobra.Command {
 			return root.ErrAlreadyPrinted
 		}
 
-		targets := collectTargets(b.Config.Targets)
+		targets := collectTargets(b.Config.Targets, b.Config.Bundle.Engine)
 
 		switch root.OutputType(cmd) {
 		case flags.OutputText:
@@ -88,6 +112,9 @@ func NewListTargetsCommand() *cobra.Command {
 				if t.Host != "" {
 					parts = append(parts, t.Host)
 				}
+				if t.Engine != "" {
+					parts = append(parts, "engine:"+string(t.Engine))
+				}
 				cmdio.LogString(ctx, strings.Join(parts, " "))
 			}
 		case flags.OutputJSON:
diff --git a/cmd/bundle/debug/render_template_schema.go b/cmd/bundle/debug/render_template_schema.go
index 475f73054ac..30743be6f1a 100644
--- a/cmd/bundle/debug/render_template_schema.go
+++ b/cmd/bundle/debug/render_template_schema.go
@@ -44,7 +44,10 @@ func NewRenderTemplateSchemaCommand() *cobra.Command {
 		}
 
 		// Resolve the template reader
-		reader, isGitReader := template.ResolveReader(templatePathOrUrl, templateDir, ref)
+		reader, isGitReader, err := template.ResolveReader(templatePathOrUrl, templateDir, ref)
+		if err != nil {
+			return err
+		}
 		defer reader.Cleanup(ctx)
 
 		// For git reader, load schema first to initialize the temp directory
diff --git a/cmd/bundle/debug/terraform.go b/cmd/bundle/debug/terraform.go
deleted file mode 100644
index dee598e2e7b..00000000000
--- a/cmd/bundle/debug/terraform.go
+++ /dev/null
@@ -1,82 +0,0 @@
-package debug
-
-import (
-	"encoding/json"
-	"fmt"
-
-	"github.com/databricks/cli/bundle/deploy/terraform"
-	"github.com/databricks/cli/cmd/root"
-	"github.com/databricks/cli/libs/cmdio"
-	"github.com/databricks/cli/libs/flags"
-	"github.com/spf13/cobra"
-)
-
-type Dependencies struct {
-	Terraform *terraform.TerraformMetadata `json:"terraform"`
-}
-
-func NewTerraformCommand() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:   "terraform",
-		Short: "Prints Terraform dependencies required for the bundle commands",
-		Args:  root.NoArgs,
-		Annotations: map[string]string{
-			"template": `Terraform version: {{.Version}}
-Terraform URL: https://releases.hashicorp.com/terraform/{{.Version}}
-
-Databricks Terraform Provider version: {{.ProviderVersion}}
-Databricks Terraform Provider URL: https://github.com/databricks/terraform-provider-databricks/releases/tag/v{{.ProviderVersion}}
-
-Databricks CLI downloads its Terraform dependencies automatically.
-
-If you run the CLI in an air-gapped environment, you can download the dependencies manually and set these environment variables:
-
-	DATABRICKS_TF_VERSION={{.Version}}
-	DATABRICKS_TF_EXEC_PATH=/path/to/terraform/binary
-	DATABRICKS_TF_PROVIDER_VERSION={{.ProviderVersion}}
-	DATABRICKS_TF_CLI_CONFIG_FILE=/path/to/terraform/cli/config.tfrc
-
-Here is an example *.tfrc configuration file:
-
-	disable_checkpoint = true
-	provider_installation {
-		filesystem_mirror {
-			path = "/path/to/a/folder/with/databricks/terraform/provider"
-		}
-	}
-
-The filesystem mirror path should point to the folder with the Databricks Terraform Provider. The folder should have this structure: /{{.ProviderHost}}/{{.ProviderSource}}/terraform-provider-databricks_{{.ProviderVersion}}_ARCH.zip
-
-For more information about filesystem mirrors, see the Terraform documentation: https://developer.hashicorp.com/terraform/cli/config/config-file#filesystem_mirror
-`,
-		},
-		// This command is currently intended for the Databricks VSCode extension only
-		Hidden: true,
-	}
-
-	cmd.RunE = func(cmd *cobra.Command, args []string) error {
-		tv, err := terraform.NewTerraformMetadata(cmd.Context())
-		if err != nil {
-			return err
-		}
-		dependencies := &Dependencies{
-			Terraform: tv,
-		}
-		switch root.OutputType(cmd) {
-		case flags.OutputText:
-			_ = cmdio.Render(cmd.Context(), dependencies.Terraform)
-		case flags.OutputJSON:
-			buf, err := json.MarshalIndent(dependencies, "", "  ")
-			if err != nil {
-				return err
-			}
-			_, _ = cmd.OutOrStdout().Write(buf)
-		default:
-			return fmt.Errorf("unknown output type %s", root.OutputType(cmd))
-		}
-
-		return nil
-	}
-
-	return cmd
-}
diff --git a/cmd/bundle/deploy.go b/cmd/bundle/deploy.go
index 31ffe7090d8..6f1dce84d32 100644
--- a/cmd/bundle/deploy.go
+++ b/cmd/bundle/deploy.go
@@ -30,7 +30,9 @@ See https://docs.databricks.com/en/dev-tools/bundles/index.html for more informa
 	var clusterId string
 	var autoApprove bool
 	var verbose bool
+	var quiet int
 	var readPlanPath string
+	var selectResources []string
 	cmd.Flags().BoolVar(&force, "force", false, "Force-override Git branch validation.")
 	cmd.Flags().BoolVar(&forceLock, "force-lock", false, "Force acquisition of deployment lock.")
 	cmd.Flags().BoolVar(&failOnActiveRuns, "fail-on-active-runs", false, "Fail if there are running jobs or pipelines in the deployment.")
@@ -39,7 +41,9 @@ See https://docs.databricks.com/en/dev-tools/bundles/index.html for more informa
 	cmd.Flags().BoolVar(&autoApprove, "auto-approve", false, "Skip interactive approvals that might be required for deployment.")
 	cmd.Flags().MarkDeprecated("compute-id", "use --cluster-id instead")
 	cmd.Flags().BoolVar(&verbose, "verbose", false, "Enable verbose output.")
-	cmd.Flags().StringVar(&readPlanPath, "plan", "", "Path to a JSON plan file to apply instead of planning (direct engine only).")
+	cmd.Flags().CountVarP(&quiet, "quiet", "q", "Reduce output: -q prints only the summary, -qq prints only warnings and errors.")
+	cmd.Flags().StringVar(&readPlanPath, "plan", "", "Path to a JSON plan file to apply instead of planning.")
+	cmd.Flags().StringSliceVar(&selectResources, "select", nil, "Deploy only the specified resource (e.g. 'my_job' or 'jobs.my_job'). Can be repeated or comma-separated.")
 	// Verbose flag currently only affects file sync output, it's used by the vscode extension
 	cmd.Flags().MarkHidden("verbose")
 
@@ -47,8 +51,10 @@ See https://docs.databricks.com/en/dev-tools/bundles/index.html for more informa
 		_, err := utils.ProcessBundle(cmd, utils.ProcessOptions{
 			InitFunc: func(b *bundle.Bundle) {
 				b.Config.Bundle.Force = force
-				b.Config.Bundle.Deployment.Lock.Force = forceLock
+				utils.SetForceLock(cmd, b, forceLock)
 				b.AutoApprove = autoApprove
+				b.Select = selectResources
+				b.Quiet = bundle.QuietLevel(quiet)
 
 				if cmd.Flag("compute-id").Changed {
 					b.Config.Bundle.ClusterId = clusterId
diff --git a/cmd/bundle/deployment/bind_resource.go b/cmd/bundle/deployment/bind_resource.go
index fc972d4d7c6..7a9c01fe1f1 100644
--- a/cmd/bundle/deployment/bind_resource.go
+++ b/cmd/bundle/deployment/bind_resource.go
@@ -4,7 +4,6 @@ import (
 	"fmt"
 
 	"github.com/databricks/cli/bundle"
-	"github.com/databricks/cli/bundle/deploy/terraform"
 	"github.com/databricks/cli/bundle/phases"
 	"github.com/databricks/cli/cmd/bundle/utils"
 	"github.com/databricks/cli/cmd/root"
@@ -20,7 +19,7 @@ func BindResource(cmd *cobra.Command, resourceKey, resourceId string, autoApprov
 		SkipInitContext: skipInitContext,
 		AlwaysPull:      true,
 		InitFunc: func(b *bundle.Bundle) {
-			b.Config.Bundle.Deployment.Lock.Force = forceLock
+			utils.SetForceLock(cmd, b, forceLock)
 		},
 	})
 	if err != nil {
@@ -28,7 +27,7 @@ func BindResource(cmd *cobra.Command, resourceKey, resourceId string, autoApprov
 	}
 	ctx := cmd.Context()
 
-	resource, err := b.Config.Resources.FindResourceByConfigKey(resourceKey)
+	resource, resourceKey, err := b.Config.Resources.ResolveKey(resourceKey)
 	if err != nil {
 		return err
 	}
@@ -43,16 +42,12 @@ func BindResource(cmd *cobra.Command, resourceKey, resourceId string, autoApprov
 		return fmt.Errorf("%s with an id '%s' is not found", resource.ResourceDescription().SingularName, resourceId)
 	}
 
-	tfName, ok := terraform.GroupToTerraformName[resource.ResourceDescription().PluralName]
-	if !ok {
-		tfName = resource.ResourceDescription().PluralName
-	}
-	phases.Bind(ctx, b, &terraform.BindOptions{
-		AutoApprove:  autoApprove,
-		ResourceType: tfName,
-		ResourceKey:  resourceKey,
-		ResourceId:   resourceId,
-	}, stateDesc.Engine)
+	phases.Bind(ctx, b, &phases.BindOptions{
+		AutoApprove: autoApprove,
+		Group:       resource.ResourceDescription().PluralName,
+		ResourceKey: resourceKey,
+		ResourceId:  resourceId,
+	}, stateDesc)
 	if logdiag.HasError(ctx) {
 		return root.ErrAlreadyPrinted
 	}
diff --git a/cmd/bundle/deployment/migrate.go b/cmd/bundle/deployment/migrate.go
index 5020d88e73a..f329ec7962c 100644
--- a/cmd/bundle/deployment/migrate.go
+++ b/cmd/bundle/deployment/migrate.go
@@ -1,125 +1,53 @@
 package deployment
 
 import (
-	"bytes"
-	"context"
-	"encoding/json"
 	"errors"
 	"fmt"
 	"os"
-	"os/exec"
 	"strings"
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/bundle/config/engine"
 	"github.com/databricks/cli/bundle/config/mutator/resourcemutator"
-	"github.com/databricks/cli/bundle/deploy/terraform"
-	"github.com/databricks/cli/bundle/deployplan"
-	"github.com/databricks/cli/bundle/direct"
+	"github.com/databricks/cli/bundle/direct/dresources"
 	"github.com/databricks/cli/bundle/direct/dstate"
+	"github.com/databricks/cli/bundle/migrate"
 	"github.com/databricks/cli/cmd/bundle/utils"
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/env"
 	"github.com/databricks/cli/libs/logdiag"
 	"github.com/databricks/cli/libs/shellquote"
-	"github.com/databricks/cli/libs/structs/structaccess"
-	"github.com/databricks/cli/libs/structs/structpath"
 	"github.com/spf13/cobra"
 )
 
 const backupSuffix = ".backup"
 
-// runPlanCheck runs bundle plan and checks if there are any actions planned.
-// Returns error if plan fails or if there are actions planned.
-func runPlanCheck(cmd *cobra.Command, extraArgs []string, extraArgsStr string) error {
-	ctx := cmd.Context()
-
-	executable, err := os.Executable()
-	if err != nil {
-		return fmt.Errorf("failed to get executable path: %w", err)
-	}
-
-	args := []string{"bundle", "plan"}
-	args = append(args, extraArgs...)
-
-	planCmd := exec.CommandContext(ctx, executable, args...)
-	var stdout bytes.Buffer
-	planCmd.Stdout = &stdout
-	planCmd.Stderr = cmd.ErrOrStderr()
-
-	// Use the engine encoded in the state
-	planCmd.Env = append(os.Environ(), "DATABRICKS_BUNDLE_ENGINE=terraform")
-
-	err = planCmd.Run()
-
-	// Output the plan stdout as is
-	output := stdout.String()
-	fmt.Fprint(cmd.OutOrStdout(), output)
-
-	if err != nil {
-		var exitErr *exec.ExitError
-		msg := ""
-		if errors.As(err, &exitErr) {
-			msg = fmt.Sprintf("exit code %d", exitErr.ExitCode())
-		} else {
-			msg = err.Error()
-		}
-		return fmt.Errorf("bundle plan failed with %s, aborting migration. To proceed with migration anyway, re-run the command with --noplancheck option", msg)
-	}
-
-	if !strings.Contains(output, "Plan:") {
-		return fmt.Errorf("cannot parse 'databricks bundle plan%s' output, aborting migration. Skip plan check with --noplancheck option", extraArgsStr)
-	}
-
-	if !strings.Contains(output, "Plan: 0 to add, 0 to change, 0 to delete") {
-		return fmt.Errorf("'databricks bundle plan%s' shows actions planned, aborting migration. Please run 'databricks bundle deploy%s' first to ensure your bundle is up to date, If actions persist after deploy, skip plan check with --noplancheck option", extraArgsStr, extraArgsStr)
-	}
-
-	return nil
-}
-
-func getCommonArgs(cmd *cobra.Command) ([]string, string) {
-	var args []string
+func getCommonArgs(cmd *cobra.Command) string {
 	var quotedArgs []string
 
 	if flag := cmd.Flag("target"); flag != nil && flag.Changed {
-		target := flag.Value.String()
-		if target != "" {
-			args = append(args, "-t")
-			args = append(args, target)
-			quotedArgs = append(quotedArgs, "-t")
-			quotedArgs = append(quotedArgs, shellquote.BashArg(target))
+		if target := flag.Value.String(); target != "" {
+			quotedArgs = append(quotedArgs, "-t", shellquote.BashArg(target))
 		}
 	}
 	if flag := cmd.Flag("profile"); flag != nil && flag.Changed {
-		profile := flag.Value.String()
-		if profile != "" {
-			args = append(args, "-p")
-			args = append(args, profile)
-			quotedArgs = append(quotedArgs, "-p")
-			quotedArgs = append(quotedArgs, shellquote.BashArg(profile))
+		if profile := flag.Value.String(); profile != "" {
+			quotedArgs = append(quotedArgs, "-p", shellquote.BashArg(profile))
 		}
 	}
 	if flag := cmd.Flag("var"); flag != nil && flag.Changed {
-		varValues, err := cmd.Flags().GetStringSlice("var")
-		if err == nil {
+		if varValues, err := cmd.Flags().GetStringSlice("var"); err == nil {
 			for _, v := range varValues {
-				args = append(args, "--var")
-				args = append(args, v)
-				quotedArgs = append(quotedArgs, "--var")
-				quotedArgs = append(quotedArgs, shellquote.BashArg(v))
+				quotedArgs = append(quotedArgs, "--var", shellquote.BashArg(v))
 			}
 		}
 	}
 
-	argsStr := ""
-
-	if len(quotedArgs) > 0 {
-		argsStr = " " + strings.Join(quotedArgs, " ")
+	if len(quotedArgs) == 0 {
+		return ""
 	}
-
-	return args, argsStr
+	return " " + strings.Join(quotedArgs, " ")
 }
 
 func newMigrateCommand() *cobra.Command {
@@ -137,14 +65,15 @@ to the workspace so that subsequent deploys of this bundle use direct deployment
 		Args: root.NoArgs,
 	}
 
-	var noPlanCheck bool
-	cmd.Flags().BoolVar(&noPlanCheck, "noplancheck", false, "Skip running bundle plan before migration.")
+	// --noplancheck kept for backward compatibility; the plan check was removed
+	// because the command no longer invokes the Terraform engine.
+	cmd.Flags().Bool("noplancheck", false, "No-op (kept for compatibility).")
 
 	cmd.RunE = func(cmd *cobra.Command, args []string) error {
-		extraArgs, extraArgsStr := getCommonArgs(cmd)
+		extraArgsStr := getCommonArgs(cmd)
 
-		// Clear the engine env var so migrate always uses terraform engine to read existing state,
-		// regardless of what the user may have set in their environment.
+		// Clear the engine env var so the user's environment cannot affect how the existing
+		// Terraform state is read for migration.
 		cmd.SetContext(env.Set(cmd.Context(), engine.EnvVar, ""))
 
 		opts := utils.ProcessOptions{
@@ -152,12 +81,6 @@ to the workspace so that subsequent deploys of this bundle use direct deployment
 			// Same options as regular deploy, to ensure bundle config is in the same state
 			FastValidate: true,
 			Build:        true,
-			PostInitFunc: func(_ context.Context, b *bundle.Bundle) error {
-				if b.Config.Bundle.Engine == engine.EngineTerraform {
-					return fmt.Errorf("bundle.engine is set to %q. Migration requires \"engine: direct\" or no engine setting. Change the setting to \"engine: direct\" and retry", engine.EngineTerraform)
-				}
-				return nil
-			},
 		}
 
 		b, stateDesc, err := utils.ProcessBundleRet(cmd, opts)
@@ -169,7 +92,7 @@ to the workspace so that subsequent deploys of this bundle use direct deployment
 		if stateDesc.Lineage == "" {
 			cmdio.LogString(ctx, `Error: This command migrates the existing Terraform state file (terraform.tfstate) to a direct deployment state file (resources.json). However, no existing local or remote state was found.
 
-To start using direct engine, set "engine: direct" under bundle in your databricks.yml or deploy with DATABRICKS_BUNDLE_ENGINE=direct env var set.`)
+New bundles use the direct engine automatically, no migration is needed.`)
 			return root.ErrAlreadyPrinted
 		}
 
@@ -182,13 +105,13 @@ To start using direct engine, set "engine: direct" under bundle in your databric
 			return fmt.Errorf("reading %s: %w", localTerraformPath, err)
 		}
 
-		terraformResources, err := terraform.ParseResourcesState(ctx, b)
+		tfState, err := migrate.ParseTFStateFull(ctx, localTerraformPath)
 		if err != nil {
 			return fmt.Errorf("failed to parse terraform state: %w", err)
 		}
 
-		for key, resourceEntry := range terraformResources {
-			if resourceEntry.ID == "" {
+		for key, id := range tfState.IDs {
+			if id == "" {
 				return fmt.Errorf("failed to intepret terraform state for %s: missing ID", key)
 			}
 		}
@@ -202,37 +125,8 @@ To start using direct engine, set "engine: direct" under bundle in your databric
 			return fmt.Errorf("state file %s already exists", localPath)
 		}
 
-		// Run plan check unless --noplancheck is set
-		if !noPlanCheck {
-			cmdio.LogString(ctx, "Note: Migration should be done after a full deploy. Running plan now to verify that deployment was done:")
-			if err = runPlanCheck(cmd, extraArgs, extraArgsStr); err != nil {
-				return err
-			}
-		}
-
-		etags := map[string]string{}
-
-		state := make(map[string]dstate.ResourceEntry)
-		for key, resourceEntry := range terraformResources {
-			state[key] = dstate.ResourceEntry{
-				ID:    resourceEntry.ID,
-				State: json.RawMessage("{}"),
-			}
-			if resourceEntry.ETag != "" {
-				// dashboard:
-				etags[key] = resourceEntry.ETag
-			}
-		}
-
-		migratedDB := dstate.NewDatabase(stateDesc.Lineage, stateDesc.Serial+1)
-		migratedDB.State = state
-
-		deploymentBundle := &direct.DeploymentBundle{
-			StateDB: dstate.DeploymentState{
-				Path: tempStatePath,
-				Data: migratedDB,
-			},
-		}
+		var stateDB dstate.DeploymentState
+		stateDB.OpenWithData(tempStatePath, dstate.NewDatabase(stateDesc.Lineage, stateDesc.Serial+1))
 
 		tempStatePathAutoRemove := true
 
@@ -245,44 +139,29 @@ To start using direct engine, set "engine: direct" under bundle in your databric
 		// Apply SecretScopeFixups so the config matches what the direct engine expects.
 		// This adds MANAGE ACL for the current user to all secret scopes, ensuring
 		// the migrated state and config agree on .permissions entries.
-		bundle.ApplyContext(ctx, b, resourcemutator.SecretScopeFixups(engine.EngineDirect))
+		bundle.ApplyContext(ctx, b, resourcemutator.SecretScopeFixups())
 		if logdiag.HasError(ctx) {
 			return root.ErrAlreadyPrinted
 		}
 
-		plan, err := deploymentBundle.CalculatePlan(ctx, b.WorkspaceClient(ctx), &b.Config)
+		adapters, err := dresources.InitAll(nil)
 		if err != nil {
 			return err
 		}
 
-		for _, entry := range plan.Plan {
-			// Force all actions to be "update" so that deploym below goes through every resource
-			entry.Action = deployplan.Update
+		if err := stateDB.UpgradeToWrite(); err != nil {
+			return fmt.Errorf("upgrading state for apply: %w", err)
 		}
 
-		// We need to copy ETag into new state.
-		// For most resources state consists of fully resolved local config snapshot + id.
-		// Dashboards are special in that they also store "etag" in state which is not provided by user but
-		// comes from remote state. If we don't store "etag" in state, we won't detect remote drift, because
-		// local=nil, remote="<some new etag>" which will be classified as a backend default and skipped.
+		if err := migrate.SeedState(ctx, &stateDB, tfState); err != nil {
+			return err
+		}
 
-		for key := range plan.Plan {
-			etag := etags[key]
-			if etag == "" {
-				continue
-			}
-			sv, ok := deploymentBundle.StateCache.Load(key)
-			if !ok {
-				return fmt.Errorf("failed to read state for %q", key)
-			}
-			err := structaccess.Set(sv.Value, structpath.NewStringKey(nil, "etag"), etag)
-			if err != nil {
-				return fmt.Errorf("failed to set etag on %q: %w", key, err)
-			}
+		if _, err := migrate.BuildStateFromTF(ctx, &b.Config, adapters, &stateDB, tfState.Attrs, tfState.IDs, ""); err != nil {
+			return err
 		}
 
-		deploymentBundle.Apply(ctx, b.WorkspaceClient(ctx), plan, direct.MigrateMode(true))
-		if err := deploymentBundle.StateDB.Finalize(); err != nil {
+		if _, err := stateDB.Finalize(ctx); err != nil {
 			logdiag.LogError(ctx, err)
 		}
 		if logdiag.HasError(ctx) {
@@ -310,7 +189,7 @@ Validate the migration by running "databricks bundle plan%s", there should be no
 The state file is not synchronized to the workspace yet. To do that and finalize the migration, run "bundle deploy%s".
 
 To undo the migration, remove %s and rename %s to %s
-`, len(deploymentBundle.StateDB.Data.State), localPath, extraArgsStr, extraArgsStr, localPath, localTerraformBackupPath, localTerraformPath))
+`, len(tfState.IDs), localPath, extraArgsStr, extraArgsStr, localPath, localTerraformBackupPath, localTerraformPath))
 		return nil
 	}
 
diff --git a/cmd/bundle/deployment/unbind.go b/cmd/bundle/deployment/unbind.go
index 576c46cba0f..3d0c927bbd6 100644
--- a/cmd/bundle/deployment/unbind.go
+++ b/cmd/bundle/deployment/unbind.go
@@ -2,7 +2,6 @@ package deployment
 
 import (
 	"github.com/databricks/cli/bundle"
-	"github.com/databricks/cli/bundle/deploy/terraform"
 	"github.com/databricks/cli/bundle/phases"
 	"github.com/databricks/cli/cmd/bundle/utils"
 	"github.com/databricks/cli/cmd/root"
@@ -54,7 +53,7 @@ To re-bind the resource later, use:
 	cmd.RunE = func(cmd *cobra.Command, args []string) error {
 		b, stateDesc, err := utils.ProcessBundleRet(cmd, utils.ProcessOptions{
 			InitFunc: func(b *bundle.Bundle) {
-				b.Config.Bundle.Deployment.Lock.Force = forceLock
+				utils.SetForceLock(cmd, b, forceLock)
 			},
 			AlwaysPull: true,
 		})
@@ -63,17 +62,12 @@ To re-bind the resource later, use:
 		}
 		ctx := cmd.Context()
 
-		resource, err := b.Config.Resources.FindResourceByConfigKey(args[0])
+		resource, resourceKey, err := b.Config.Resources.ResolveKey(args[0])
 		if err != nil {
 			return err
 		}
 
-		rd := resource.ResourceDescription()
-		tfName, ok := terraform.GroupToTerraformName[rd.PluralName]
-		if !ok {
-			tfName = rd.PluralName
-		}
-		phases.Unbind(ctx, b, rd.SingularName, tfName, args[0], stateDesc.Engine)
+		phases.Unbind(ctx, b, resource.ResourceDescription().PluralName, resourceKey, stateDesc.Engine)
 		if logdiag.HasError(ctx) {
 			return root.ErrAlreadyPrinted
 		}
diff --git a/cmd/bundle/destroy.go b/cmd/bundle/destroy.go
index bd69e1a7513..f227fc89abd 100644
--- a/cmd/bundle/destroy.go
+++ b/cmd/bundle/destroy.go
@@ -3,16 +3,8 @@
 package bundle
 
 import (
-	"context"
-	"errors"
-
-	"github.com/databricks/cli/bundle"
-	"github.com/databricks/cli/bundle/phases"
-	"github.com/databricks/cli/bundle/statemgmt"
 	"github.com/databricks/cli/cmd/bundle/utils"
 	"github.com/databricks/cli/cmd/root"
-	"github.com/databricks/cli/libs/cmdio"
-	"github.com/databricks/cli/libs/logdiag"
 	"github.com/spf13/cobra"
 )
 
@@ -37,45 +29,14 @@ Typical use cases:
 
 	var autoApprove bool
 	var forceDestroy bool
+	var quiet int
 	cmd.Flags().BoolVar(&autoApprove, "auto-approve", false, "Skip interactive approvals for deleting resources and files")
 	cmd.Flags().BoolVar(&forceDestroy, "force-lock", false, "Force acquisition of deployment lock.")
+	cmd.Flags().CountVarP(&quiet, "quiet", "q", "Reduce output: -qq prints only warnings and errors.")
 
 	cmd.RunE = func(cmd *cobra.Command, args []string) error {
-		return CommandBundleDestroy(cmd, args, autoApprove, forceDestroy)
+		return utils.CommandBundleDestroy(cmd, args, autoApprove, forceDestroy)
 	}
 
 	return cmd
 }
-
-func CommandBundleDestroy(cmd *cobra.Command, args []string, autoApprove, forceDestroy bool) error {
-	// We require auto-approve for non-interactive terminals since prompts are not possible.
-	if !cmdio.IsPromptSupported(cmd.Context()) && !autoApprove {
-		return errors.New("please specify --auto-approve since terminal does not support interactive prompts")
-	}
-
-	// Check if context is already initialized (e.g., when called from apps delete override)
-	skipInitContext := logdiag.IsSetup(cmd.Context())
-
-	opts := utils.ProcessOptions{
-		InitFunc: func(b *bundle.Bundle) {
-			// If `--force-lock` is specified, force acquisition of the deployment lock.
-			b.Config.Bundle.Deployment.Lock.Force = forceDestroy
-
-			// If `--auto-approve`` is specified, we skip confirmation checks
-			b.AutoApprove = autoApprove
-		},
-		// Skip context initialization if already initialized by parent command
-		SkipInitContext: skipInitContext,
-		AlwaysPull:      true,
-		PostStateFunc: func(ctx context.Context, b *bundle.Bundle, stateDesc *statemgmt.StateDesc) error {
-			phases.Destroy(ctx, b, stateDesc.Engine)
-			if logdiag.HasError(ctx) {
-				return root.ErrAlreadyPrinted
-			}
-			return nil
-		},
-	}
-
-	_, _, err := utils.ProcessBundleRet(cmd, opts)
-	return err
-}
diff --git a/cmd/bundle/generate.go b/cmd/bundle/generate.go
index 9caf7fa1e37..12452293bc6 100644
--- a/cmd/bundle/generate.go
+++ b/cmd/bundle/generate.go
@@ -40,6 +40,7 @@ Use --bind to automatically bind the generated resource to the existing workspac
 	cmd.AddCommand(generate.NewGenerateDashboardCommand())
 	cmd.AddCommand(generate.NewGenerateAlertCommand())
 	cmd.AddCommand(generate.NewGenerateAppCommand())
+	cmd.AddCommand(generate.NewGenerateGenieSpaceCommand())
 	cmd.PersistentFlags().StringVar(&key, "key", "", `resource key to use for the generated configuration`)
 	return cmd
 }
diff --git a/cmd/bundle/generate/alert.go b/cmd/bundle/generate/alert.go
index 87ba3eacb9e..cb78b24de1e 100644
--- a/cmd/bundle/generate/alert.go
+++ b/cmd/bundle/generate/alert.go
@@ -57,11 +57,6 @@ After generation, you can deploy this alert to other targets using:
 	cmd.Flags().StringVar(&alertID, "existing-id", "", `ID of the alert to generate configuration for`)
 	cmd.MarkFlagRequired("existing-id")
 
-	// Alias lookup flag that includes the resource type name.
-	// Included for symmetry with the other generate commands, but we prefer the shorter flag.
-	cmd.Flags().StringVar(&alertID, "existing-alert-id", "", `ID of the alert to generate configuration for`)
-	cmd.Flags().MarkHidden("existing-alert-id")
-
 	cmd.Flags().StringVarP(&configDir, "config-dir", "d", "resources", `directory to write the configuration to`)
 	cmd.Flags().StringVarP(&sourceDir, "source-dir", "s", "src", `directory to write the alert definition to`)
 	cmd.Flags().BoolVarP(&force, "force", "f", false, `force overwrite existing files in the output directory`)
@@ -81,8 +76,7 @@ After generation, you can deploy this alert to other targets using:
 		alert, err := w.AlertsV2.GetAlert(ctx, sql.GetAlertV2Request{Id: alertID})
 		if err != nil {
 			// Check if it's a not found error to provide a better message
-			var apiErr *apierr.APIError
-			if errors.As(err, &apiErr) && apiErr.StatusCode == http.StatusNotFound {
+			if apiErr, ok := errors.AsType[*apierr.APIError](err); ok && apiErr.StatusCode == http.StatusNotFound {
 				return fmt.Errorf("alert with ID %s not found", alertID)
 			}
 			return err
@@ -174,6 +168,8 @@ After generation, you can deploy this alert to other targets using:
 		cmdio.LogString(ctx, "Alert configuration successfully saved to "+filepath.ToSlash(configPath))
 		cmdio.LogString(ctx, "Serialized alert definition to "+filepath.ToSlash(alertPath))
 
+		warnIfNotIncluded(ctx, b, configPath)
+
 		return nil
 	}
 
diff --git a/cmd/bundle/generate/app.go b/cmd/bundle/generate/app.go
index 120c405e793..bec005408cd 100644
--- a/cmd/bundle/generate/app.go
+++ b/cmd/bundle/generate/app.go
@@ -81,8 +81,10 @@ per target environment.`,
 
 		sourceCodePath := app.DefaultSourceCodePath
 		// If the source code path is not set, we don't need to download anything.
-		// This is the case for apps that are not yet deployed.
-		if sourceCodePath != "" {
+		// This is the case for apps that are not yet deployed. A git-backed app
+		// keeps its source in Git rather than the workspace, so there is nothing
+		// to download and ConvertAppToValue emits git_repository/git_source instead.
+		if app.GitRepository == nil && sourceCodePath != "" {
 			err = downloader.MarkDirectoryForDownload(ctx, &sourceCodePath)
 			if err != nil {
 				return err
@@ -128,6 +130,8 @@ per target environment.`,
 
 		cmdio.LogString(ctx, "App configuration successfully saved to "+filename)
 
+		warnIfNotIncluded(ctx, b, filename)
+
 		if bind {
 			return deployment.BindResource(cmd, appKey, app.Name, true, false, true)
 		}
diff --git a/cmd/bundle/generate/dashboard.go b/cmd/bundle/generate/dashboard.go
index 70de46225c2..9c4be81b391 100644
--- a/cmd/bundle/generate/dashboard.go
+++ b/cmd/bundle/generate/dashboard.go
@@ -17,11 +17,8 @@ import (
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/bundle/generate"
-	"github.com/databricks/cli/bundle/phases"
 	"github.com/databricks/cli/bundle/resources"
-	"github.com/databricks/cli/bundle/statemgmt"
 	"github.com/databricks/cli/cmd/bundle/deployment"
-	"github.com/databricks/cli/cmd/bundle/utils"
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/diag"
@@ -77,13 +74,13 @@ func (d *dashboard) resolveID(ctx context.Context, b *bundle.Bundle) string {
 		return d.resolveFromID(ctx, b)
 	}
 
-	logdiag.LogError(ctx, errors.New("expected one of --dashboard-path, --dashboard-id"))
+	logdiag.LogError(ctx, errors.New("expected one of --existing-path, --existing-id"))
 	return ""
 }
 
 func (d *dashboard) resolveFromPath(ctx context.Context, b *bundle.Bundle) string {
 	w := b.WorkspaceClient(ctx)
-	obj, err := w.Workspace.GetStatusByPath(ctx, d.existingPath) //nolint:staticcheck // Deprecated in SDK v0.127.0. Migration to WorkspaceHierarchyService tracked separately.
+	obj, err := w.Workspace.GetStatusByPath(ctx, d.existingPath)
 	if err != nil {
 		if apierr.IsMissing(err) {
 			logdiag.LogError(ctx, fmt.Errorf("dashboard %q not found", path.Base(d.existingPath)))
@@ -249,6 +246,8 @@ func (d *dashboard) saveConfiguration(ctx context.Context, b *bundle.Bundle, das
 		return err
 	}
 
+	warnIfNotIncluded(ctx, b, resourcePath)
+
 	return nil
 }
 
@@ -261,7 +260,7 @@ func waitForChanges(ctx context.Context, w *databricks.WorkspaceClient, dashboar
 	}
 
 	for {
-		obj, err := w.Workspace.GetStatusByPath(ctx, dashboard.Path) //nolint:staticcheck // Deprecated in SDK v0.127.0. Migration to WorkspaceHierarchyService tracked separately.
+		obj, err := w.Workspace.GetStatusByPath(ctx, dashboard.Path)
 		if err != nil {
 			logdiag.LogError(ctx, err)
 			return
@@ -273,7 +272,11 @@ func waitForChanges(ctx context.Context, w *databricks.WorkspaceClient, dashboar
 			break
 		}
 
-		time.Sleep(1 * time.Second)
+		select {
+		case <-ctx.Done():
+			return
+		case <-time.After(1 * time.Second):
+		}
 	}
 }
 
@@ -338,7 +341,11 @@ func (d *dashboard) generateForExisting(ctx context.Context, b *bundle.Bundle, d
 		return
 	}
 
-	key := textutil.NormalizeString(dashboard.DisplayName)
+	// The "key" flag is a persistent flag on the parent "generate" command.
+	key := d.cmd.Flag("key").Value.String()
+	if key == "" {
+		key = textutil.NormalizeString(dashboard.DisplayName)
+	}
 	err = d.saveConfiguration(ctx, b, dashboard, key)
 	if err != nil {
 		logdiag.LogError(ctx, err)
@@ -374,32 +381,7 @@ func (d *dashboard) initialize(ctx context.Context, b *bundle.Bundle) {
 }
 
 func (d *dashboard) runForResource(ctx context.Context, b *bundle.Bundle) {
-	phases.Initialize(ctx, b)
-	if logdiag.HasError(ctx) {
-		return
-	}
-
-	requiredEngine, err := utils.ResolveEngineSetting(ctx, b)
-	if err != nil {
-		logdiag.LogError(ctx, err)
-		return
-	}
-	ctx, stateDesc := statemgmt.PullResourcesState(ctx, b, statemgmt.AlwaysPull(true), requiredEngine)
-	if logdiag.HasError(ctx) {
-		return
-	}
-
-	if stateDesc.Engine.IsDirect() {
-		_, localPath := b.StateFilenameDirect(ctx)
-		if err := b.DeploymentBundle.StateDB.Open(localPath); err != nil {
-			logdiag.LogError(ctx, err)
-			return
-		}
-	}
-
-	bundle.ApplySeqContext(ctx, b,
-		statemgmt.Load(stateDesc.Engine),
-	)
+	ctx = loadStateForGenerate(ctx, b)
 	if logdiag.HasError(ctx) {
 		return
 	}
@@ -510,13 +492,6 @@ bundle files automatically, useful during active dashboard development.`,
 	cmd.Flags().StringVar(&d.existingID, "existing-id", "", `ID of the dashboard to generate configuration for`)
 	cmd.Flags().StringVar(&d.resource, "resource", "", `resource key of dashboard to watch for changes`)
 
-	// Alias lookup flags that include the resource type name.
-	// Included for symmetry with the other generate commands, but we prefer the shorter flags.
-	cmd.Flags().StringVar(&d.existingPath, "existing-dashboard-path", "", `workspace path of the dashboard to generate configuration for`)
-	cmd.Flags().StringVar(&d.existingID, "existing-dashboard-id", "", `ID of the dashboard to generate configuration for`)
-	cmd.Flags().MarkHidden("existing-dashboard-path")
-	cmd.Flags().MarkHidden("existing-dashboard-id")
-
 	// Output flags.
 	cmd.Flags().StringVarP(&d.resourceDir, "resource-dir", "d", "resources", `directory to write the configuration to`)
 	cmd.Flags().StringVarP(&d.dashboardDir, "dashboard-dir", "s", "src", `directory to write the dashboard representation to`)
@@ -531,6 +506,11 @@ bundle files automatically, useful during active dashboard development.`,
 		"existing-id",
 		"resource",
 	)
+	cmd.MarkFlagsMutuallyExclusive(
+		"existing-path",
+		"existing-id",
+		"resource",
+	)
 
 	// Watch flag. This is relevant only in combination with the resource flag.
 	cmd.Flags().BoolVar(&d.watch, "watch", false, `watch for changes to the dashboard and update the configuration`)
diff --git a/cmd/bundle/generate/dashboard_test.go b/cmd/bundle/generate/dashboard_test.go
index d7cb53ad46b..8c346250c8c 100644
--- a/cmd/bundle/generate/dashboard_test.go
+++ b/cmd/bundle/generate/dashboard_test.go
@@ -1,6 +1,7 @@
 package generate
 
 import (
+	"io"
 	"testing"
 
 	"github.com/databricks/cli/bundle"
@@ -47,3 +48,20 @@ func TestDashboard_ErrorOnLegacyDashboard(t *testing.T) {
 	require.Len(t, diags, 1)
 	assert.Equal(t, "dashboard \"legacy dashboard\" is a legacy dashboard", diags[0].Summary)
 }
+
+func TestDashboard_LookupFlagsAreMutuallyExclusive(t *testing.T) {
+	tests := [][]string{
+		{"--existing-path", "/path/to/dashboard", "--existing-id", "f00dcafe"},
+		{"--existing-path", "/path/to/dashboard", "--resource", "test_dashboard"},
+		{"--existing-id", "f00dcafe", "--resource", "test_dashboard"},
+	}
+
+	for _, args := range tests {
+		cmd := NewGenerateDashboardCommand()
+		cmd.SetArgs(args)
+		cmd.SetOut(io.Discard)
+		cmd.SetErr(io.Discard)
+		err := cmd.Execute()
+		assert.ErrorContains(t, err, "none of the others can be")
+	}
+}
diff --git a/cmd/bundle/generate/genie_space.go b/cmd/bundle/generate/genie_space.go
new file mode 100644
index 00000000000..7c520abc320
--- /dev/null
+++ b/cmd/bundle/generate/genie_space.go
@@ -0,0 +1,436 @@
+package generate
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"maps"
+	"os"
+	"path"
+	"path/filepath"
+	"slices"
+	"time"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/generate"
+	"github.com/databricks/cli/bundle/resources"
+	"github.com/databricks/cli/cmd/bundle/deployment"
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/dyn/yamlsaver"
+	"github.com/databricks/cli/libs/logdiag"
+	"github.com/databricks/cli/libs/textutil"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/service/dashboards"
+	"github.com/spf13/cobra"
+	"go.yaml.in/yaml/v3"
+)
+
+const genieSpaceWatchInterval = 1 * time.Second
+
+type genieSpace struct {
+	// Lookup flag for one-time generate.
+	existingID string
+
+	// Lookup flag for existing bundle resource.
+	resource string
+
+	// Where to write the configuration and genie space representation.
+	resourceDir   string
+	genieSpaceDir string
+
+	// Force overwrite of existing files.
+	force bool
+
+	// Watch for changes to the genie space.
+	watch bool
+
+	// Relative path from the resource directory to the genie space directory.
+	relativeGenieSpaceDir string
+
+	// Command.
+	cmd *cobra.Command
+
+	// Automatically bind the generated resource to the existing resource.
+	bind bool
+}
+
+func (g *genieSpace) resolveFromID(ctx context.Context, b *bundle.Bundle) string {
+	w := b.WorkspaceClient(ctx)
+	obj, err := w.Genie.GetSpace(ctx, dashboards.GenieGetSpaceRequest{
+		SpaceId: g.existingID,
+	})
+	if err != nil {
+		if apierr.IsMissing(err) {
+			logdiag.LogError(ctx, fmt.Errorf("genie space with ID %s not found", g.existingID))
+			return ""
+		}
+		logdiag.LogError(ctx, err)
+		return ""
+	}
+
+	return obj.SpaceId
+}
+
+func (g *genieSpace) saveSerializedGenieSpace(ctx context.Context, b *bundle.Bundle, genieSpace *dashboards.GenieSpace, filename string) error {
+	if genieSpace.SerializedSpace == "" {
+		return fmt.Errorf("genie space response did not include serialized_space; refusing to write %s", filepath.ToSlash(filename))
+	}
+
+	// Unmarshal and remarshal the serialized genie space to ensure it is formatted correctly.
+	// The result will have alphabetically sorted keys and be indented.
+	data, err := remarshalJSON([]byte(genieSpace.SerializedSpace))
+	if err != nil {
+		return err
+	}
+
+	// Make sure the output directory exists.
+	if err := os.MkdirAll(filepath.Dir(filename), 0o755); err != nil {
+		return err
+	}
+
+	// Clean the filename to ensure it is a valid path (and can be used on this OS).
+	filename = filepath.Clean(filename)
+
+	// Attempt to make the path relative to the bundle root.
+	rel, err := filepath.Rel(b.BundleRootPath, filename)
+	if err != nil {
+		rel = filename
+	}
+
+	// Verify that the file does not already exist.
+	info, err := os.Stat(filename)
+	if err == nil {
+		if info.IsDir() {
+			return fmt.Errorf("%s is a directory", filepath.ToSlash(rel))
+		}
+		if !g.force {
+			return fmt.Errorf("%s already exists. Use --force to overwrite", filepath.ToSlash(rel))
+		}
+	}
+
+	cmdio.LogString(ctx, "Writing genie space to "+filepath.ToSlash(rel))
+	return os.WriteFile(filename, data, 0o644)
+}
+
+func (g *genieSpace) saveConfiguration(ctx context.Context, b *bundle.Bundle, genieSpace *dashboards.GenieSpace, key string) error {
+	// Save serialized genie space definition to the genie space directory.
+	genieSpaceBasename := key + ".geniespace.json"
+	genieSpacePath := filepath.Join(g.genieSpaceDir, genieSpaceBasename)
+	err := g.saveSerializedGenieSpace(ctx, b, genieSpace, genieSpacePath)
+	if err != nil {
+		return err
+	}
+
+	// Synthesize resource configuration.
+	v, err := generate.ConvertGenieSpaceToValue(genieSpace, path.Join(g.relativeGenieSpaceDir, genieSpaceBasename))
+	if err != nil {
+		return err
+	}
+
+	result := map[string]dyn.Value{
+		"resources": dyn.V(map[string]dyn.Value{
+			"genie_spaces": dyn.V(map[string]dyn.Value{
+				key: v,
+			}),
+		}),
+	}
+
+	// Make sure the output directory exists.
+	if err := os.MkdirAll(g.resourceDir, 0o755); err != nil {
+		return err
+	}
+
+	// Save the configuration to the resource directory.
+	resourcePath := filepath.Join(g.resourceDir, key+".genie_space.yml")
+	saver := yamlsaver.NewSaverWithStyle(map[string]yaml.Style{
+		"title": yaml.DoubleQuotedStyle,
+	})
+
+	// Attempt to make the path relative to the bundle root.
+	rel, err := filepath.Rel(b.BundleRootPath, resourcePath)
+	if err != nil {
+		rel = resourcePath
+	}
+
+	cmdio.LogString(ctx, "Writing configuration to "+filepath.ToSlash(rel))
+	err = saver.SaveAsYAML(result, resourcePath, g.force)
+	if err != nil {
+		return err
+	}
+
+	warnIfNotIncluded(ctx, b, resourcePath)
+
+	return nil
+}
+
+func (g *genieSpace) updateGenieSpaceForResource(ctx context.Context, b *bundle.Bundle) {
+	resource, ok := b.Config.Resources.GenieSpaces[g.resource]
+	if !ok {
+		logdiag.LogError(ctx, fmt.Errorf("genie space resource %q is not defined", g.resource))
+		return
+	}
+
+	if resource.FilePath == "" {
+		logdiag.LogError(ctx, fmt.Errorf("genie space resource %q has no file path defined", g.resource))
+		return
+	}
+
+	genieSpaceID := resource.ID
+	genieSpacePath := resource.FilePath
+
+	w := b.WorkspaceClient(ctx)
+
+	first := true
+	for {
+		genieSpace, err := w.Genie.GetSpace(ctx, dashboards.GenieGetSpaceRequest{
+			SpaceId:                genieSpaceID,
+			IncludeSerializedSpace: true,
+		})
+		if err != nil {
+			logdiag.LogError(ctx, err)
+			return
+		}
+
+		// Genie has no remote modification timestamp we can poll. Compare
+		// the canonicalized remote body against the on-disk body and only
+		// re-save when they differ. The first iteration always saves, to
+		// match the prior behavior of an unconditional initial sync.
+		shouldSave := first
+		if !first {
+			differs, err := genieSpaceBodyDiffersFromDisk(genieSpace.SerializedSpace, genieSpacePath)
+			if err != nil {
+				logdiag.LogError(ctx, err)
+				return
+			}
+			shouldSave = differs
+		}
+
+		if shouldSave {
+			if err := g.saveSerializedGenieSpace(ctx, b, genieSpace, genieSpacePath); err != nil {
+				logdiag.LogError(ctx, err)
+				return
+			}
+		}
+
+		if !g.watch {
+			return
+		}
+
+		first = false
+		select {
+		case <-ctx.Done():
+			return
+		case <-time.After(genieSpaceWatchInterval):
+		}
+	}
+}
+
+// genieSpaceBodyDiffersFromDisk reports whether the canonicalized remote
+// serialized_space differs from the contents of filename.
+func genieSpaceBodyDiffersFromDisk(remoteSerialized, filename string) (bool, error) {
+	if remoteSerialized == "" {
+		return false, nil
+	}
+	canonical, err := remarshalJSON([]byte(remoteSerialized))
+	if err != nil {
+		return false, err
+	}
+	onDisk, err := os.ReadFile(filename)
+	if err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			return true, nil
+		}
+		return false, err
+	}
+	return !bytes.Equal(canonical, onDisk), nil
+}
+
+func (g *genieSpace) generateForExisting(ctx context.Context, b *bundle.Bundle, genieSpaceID string) {
+	w := b.WorkspaceClient(ctx)
+	genieSpace, err := w.Genie.GetSpace(ctx, dashboards.GenieGetSpaceRequest{
+		SpaceId:                genieSpaceID,
+		IncludeSerializedSpace: true,
+	})
+	if err != nil {
+		logdiag.LogError(ctx, err)
+		return
+	}
+
+	key := g.cmd.Flag("key").Value.String()
+	if key == "" {
+		key = textutil.NormalizeString(genieSpace.Title)
+	}
+	err = g.saveConfiguration(ctx, b, genieSpace, key)
+	if err != nil {
+		logdiag.LogError(ctx, err)
+		return
+	}
+
+	if g.bind {
+		err = deployment.BindResource(g.cmd, key, genieSpaceID, true, false, true)
+		if err != nil {
+			logdiag.LogError(ctx, err)
+			return
+		}
+		cmdio.LogString(ctx, fmt.Sprintf("Successfully bound genie space with an id '%s'", genieSpaceID))
+	}
+}
+
+func (g *genieSpace) initialize(ctx context.Context, b *bundle.Bundle) {
+	// Make the paths absolute if they aren't already.
+	if !filepath.IsAbs(g.resourceDir) {
+		g.resourceDir = filepath.Join(b.BundleRootPath, g.resourceDir)
+	}
+	if !filepath.IsAbs(g.genieSpaceDir) {
+		g.genieSpaceDir = filepath.Join(b.BundleRootPath, g.genieSpaceDir)
+	}
+
+	// Make sure we know how the genie space path is relative to the resource path.
+	rel, err := filepath.Rel(g.resourceDir, g.genieSpaceDir)
+	if err != nil {
+		logdiag.LogError(ctx, err)
+		return
+	}
+
+	g.relativeGenieSpaceDir = filepath.ToSlash(rel)
+}
+
+func (g *genieSpace) runForResource(ctx context.Context, b *bundle.Bundle) {
+	ctx = loadStateForGenerate(ctx, b)
+	if logdiag.HasError(ctx) {
+		return
+	}
+
+	g.updateGenieSpaceForResource(ctx, b)
+}
+
+func (g *genieSpace) runForExisting(ctx context.Context, b *bundle.Bundle) {
+	// Resolve the ID of the genie space to generate configuration for.
+	genieSpaceID := g.resolveFromID(ctx, b)
+	if logdiag.HasError(ctx) {
+		return
+	}
+
+	g.generateForExisting(ctx, b, genieSpaceID)
+}
+
+func (g *genieSpace) RunE(cmd *cobra.Command, args []string) error {
+	ctx := logdiag.InitContext(cmd.Context())
+	cmd.SetContext(ctx)
+
+	b := root.MustConfigureBundle(cmd)
+	if b == nil || logdiag.HasError(ctx) {
+		return root.ErrAlreadyPrinted
+	}
+
+	g.initialize(ctx, b)
+	if logdiag.HasError(ctx) {
+		return root.ErrAlreadyPrinted
+	}
+
+	if g.resource != "" {
+		g.runForResource(ctx, b)
+	} else {
+		g.runForExisting(ctx, b)
+	}
+
+	if logdiag.HasError(ctx) {
+		return root.ErrAlreadyPrinted
+	}
+
+	return nil
+}
+
+// filterGenieSpaces returns a filter that only includes genie spaces.
+func filterGenieSpaces(ref resources.Reference) bool {
+	return ref.Description.SingularName == "genie_space"
+}
+
+// genieSpaceResourceCompletion executes to autocomplete the argument to the resource flag.
+func genieSpaceResourceCompletion(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	b := root.MustConfigureBundle(cmd)
+	if logdiag.HasError(cmd.Context()) {
+		return nil, cobra.ShellCompDirectiveError
+	}
+
+	if b == nil {
+		return nil, cobra.ShellCompDirectiveNoFileComp
+	}
+
+	return slices.Collect(maps.Keys(resources.Completions(b, filterGenieSpaces))), cobra.ShellCompDirectiveNoFileComp
+}
+
+func NewGenerateGenieSpaceCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "genie-space",
+		Short: "Generate configuration for a Genie space",
+		Long: `Generate bundle configuration for an existing Databricks Genie space.
+
+This command downloads an existing Genie space and creates bundle files
+that you can use to deploy the Genie space to other environments or manage it as code.
+
+Examples:
+  # Import Genie space by ID
+  databricks bundle generate genie-space --existing-id abc123 --key my_genie_space
+
+  # Watch for changes to keep bundle in sync with UI modifications
+  databricks bundle generate genie-space --resource my_genie_space --watch --force
+
+Use --key to set the resource name in the generated configuration.
+
+What gets generated:
+- Genie space configuration YAML file with settings and a reference to the Genie space definition
+- Genie space definition (.geniespace.json) file with the serialized space content
+
+Sync workflow for Genie space development:
+When developing Genie spaces, you can modify them in the Databricks UI and sync
+changes back to your bundle:
+
+1. Make changes to Genie space in the Databricks UI
+2. Run: databricks bundle generate genie-space --resource my_genie_space --force
+3. Commit changes to version control
+4. Deploy to other environments with: databricks bundle deploy --target prod
+
+The --watch flag continuously polls for remote changes and updates your local
+bundle files automatically, useful during active Genie space development.`,
+	}
+
+	g := &genieSpace{}
+
+	// Lookup flags.
+	cmd.Flags().StringVar(&g.existingID, "existing-id", "", `ID of the Genie space to generate configuration for`)
+	cmd.Flags().StringVar(&g.resource, "resource", "", `resource key of Genie space to watch for changes`)
+
+	// Output flags.
+	cmd.Flags().StringVarP(&g.resourceDir, "resource-dir", "d", "resources", `directory to write the configuration to`)
+	cmd.Flags().StringVarP(&g.genieSpaceDir, "genie-space-dir", "s", "src", `directory to write the Genie space representation to`)
+	cmd.Flags().BoolVarP(&g.force, "force", "f", false, `force overwrite existing files in the output directory`)
+
+	cmd.Flags().BoolVarP(&g.bind, "bind", "b", false, `automatically bind the generated Genie space config to the existing Genie space`)
+	cmd.Flags().MarkHidden("bind")
+
+	// Exactly one of the lookup flags must be provided.
+	cmd.MarkFlagsOneRequired(
+		"existing-id",
+		"resource",
+	)
+
+	// Watch flag. This is relevant only in combination with the resource flag.
+	cmd.Flags().BoolVar(&g.watch, "watch", false, `watch for changes to the Genie space and update the configuration`)
+
+	// Make sure the watch flag is only used with the existing-resource flag.
+	cmd.MarkFlagsMutuallyExclusive("watch", "existing-id")
+
+	// Make sure the bind flag is only used with the existing-resource flag.
+	cmd.MarkFlagsMutuallyExclusive("bind", "resource")
+
+	// Completion for the resource flag.
+	cmd.RegisterFlagCompletionFunc("resource", genieSpaceResourceCompletion)
+
+	cmd.RunE = g.RunE
+	g.cmd = cmd
+	return cmd
+}
diff --git a/cmd/bundle/generate/genie_space_test.go b/cmd/bundle/generate/genie_space_test.go
new file mode 100644
index 00000000000..746b2b1c3af
--- /dev/null
+++ b/cmd/bundle/generate/genie_space_test.go
@@ -0,0 +1,126 @@
+package generate
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/logdiag"
+	"github.com/databricks/databricks-sdk-go/experimental/mocks"
+	"github.com/databricks/databricks-sdk-go/service/dashboards"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+)
+
+func newGenieSpaceTestBundle(t *testing.T, m *mocks.MockWorkspaceClient, filePath string) *bundle.Bundle {
+	t.Helper()
+	b := &bundle.Bundle{
+		BundleRootPath: t.TempDir(),
+		Config: config.Root{
+			Resources: config.Resources{
+				GenieSpaces: map[string]*resources.GenieSpace{
+					"my_space": {
+						GenieSpaceConfig: resources.GenieSpaceConfig{
+							Title: "My Space",
+						},
+						FilePath: filePath,
+					},
+				},
+			},
+		},
+	}
+	b.Config.Resources.GenieSpaces["my_space"].ID = "space-id-1"
+	b.SetWorkpaceClient(m.WorkspaceClient)
+	return b
+}
+
+func TestGenieSpace_UpdateForResource_WritesFileWhenNotWatching(t *testing.T) {
+	dir := t.TempDir()
+	filePath := filepath.Join(dir, "my_space.geniespace.json")
+
+	m := mocks.NewMockWorkspaceClient(t)
+	m.GetMockGenieAPI().EXPECT().
+		GetSpace(mock.Anything, dashboards.GenieGetSpaceRequest{
+			SpaceId:                "space-id-1",
+			IncludeSerializedSpace: true,
+		}).
+		Return(&dashboards.GenieSpace{
+			SpaceId:         "space-id-1",
+			Title:           "My Space",
+			SerializedSpace: `{"version":1}`,
+		}, nil).
+		Once()
+
+	g := &genieSpace{
+		resource: "my_space",
+		force:    true,
+	}
+	b := newGenieSpaceTestBundle(t, m, filePath)
+
+	ctx, _ := cmdio.NewTestContextWithStdout(t.Context())
+	ctx = logdiag.InitContext(ctx)
+	logdiag.SetCollect(ctx, true)
+	g.updateGenieSpaceForResource(ctx, b)
+
+	require.Empty(t, logdiag.FlushCollected(ctx))
+
+	contents, err := os.ReadFile(filePath)
+	require.NoError(t, err)
+	assert.Contains(t, string(contents), `"version"`)
+}
+
+func TestGenieSpace_UpdateForResource_WatchExitsOnCancel(t *testing.T) {
+	dir := t.TempDir()
+	filePath := filepath.Join(dir, "my_space.geniespace.json")
+
+	m := mocks.NewMockWorkspaceClient(t)
+	// Allow any number of GetSpace calls; we don't know how many fire before cancel.
+	m.GetMockGenieAPI().EXPECT().
+		GetSpace(mock.Anything, dashboards.GenieGetSpaceRequest{
+			SpaceId:                "space-id-1",
+			IncludeSerializedSpace: true,
+		}).
+		Return(&dashboards.GenieSpace{
+			SpaceId:         "space-id-1",
+			Title:           "My Space",
+			SerializedSpace: `{"version":1}`,
+		}, nil).
+		Maybe()
+
+	g := &genieSpace{
+		resource: "my_space",
+		force:    true,
+		watch:    true,
+	}
+	b := newGenieSpaceTestBundle(t, m, filePath)
+
+	base, _ := cmdio.NewTestContextWithStdout(t.Context())
+	ctx, cancel := context.WithCancel(logdiag.InitContext(base))
+	logdiag.SetCollect(ctx, true)
+
+	done := make(chan struct{})
+	go func() {
+		g.updateGenieSpaceForResource(ctx, b)
+		close(done)
+	}()
+
+	// First iteration always saves. Wait until the file lands, then cancel.
+	require.Eventually(t, func() bool {
+		_, err := os.Stat(filePath)
+		return err == nil
+	}, 2*time.Second, 10*time.Millisecond, "expected initial save to write file")
+
+	cancel()
+	select {
+	case <-done:
+	case <-time.After(2 * time.Second):
+		t.Fatal("watch loop did not exit promptly after ctx cancel")
+	}
+}
diff --git a/cmd/bundle/generate/include.go b/cmd/bundle/generate/include.go
new file mode 100644
index 00000000000..bb9703a4cbf
--- /dev/null
+++ b/cmd/bundle/generate/include.go
@@ -0,0 +1,49 @@
+package generate
+
+import (
+	"context"
+	"fmt"
+	"path/filepath"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/libs/diag"
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/logdiag"
+)
+
+// warnIfNotIncluded warns when the freshly generated configuration file is not
+// matched by any pattern in the root databricks.yml 'include' section. Such a
+// file is written to disk but silently ignored during deploy, so without a
+// matching 'include' entry the generate command is effectively a no-op.
+func warnIfNotIncluded(ctx context.Context, b *bundle.Bundle, filename string) {
+	absFilename, err := filepath.Abs(filename)
+	if err != nil {
+		log.Debugf(ctx, "Skipping include check: %v", err)
+		return
+	}
+
+	if b.IsFileIncluded(absFilename) {
+		return
+	}
+
+	rel, err := filepath.Rel(b.BundleRootPath, absFilename)
+	if err != nil {
+		rel = absFilename
+	}
+	rel = filepath.ToSlash(rel)
+
+	// Suggest a glob that covers the directory the file was written to.
+	suggestion := filepath.ToSlash(filepath.Join(filepath.Dir(rel), "*.yml"))
+
+	logdiag.LogDiag(ctx, diag.Diagnostic{
+		Severity: diag.Warning,
+		Summary:  "Generated configuration is not included in the bundle",
+		Detail: fmt.Sprintf(""+
+			"The file %s is not matched by any pattern in the 'include' section of databricks.yml,\n"+
+			"so it will not be deployed. Add a matching entry to the 'include' section, for example:\n"+
+			"\n"+
+			"include:\n"+
+			"  - %s",
+			rel, suggestion),
+	})
+}
diff --git a/cmd/bundle/generate/job.go b/cmd/bundle/generate/job.go
index 56bc8d582b7..db6839ade98 100644
--- a/cmd/bundle/generate/job.go
+++ b/cmd/bundle/generate/job.go
@@ -27,6 +27,7 @@ func NewGenerateJobCommand() *cobra.Command {
 	var jobId int64
 	var force bool
 	var bind bool
+	var downloadSparkPythonFiles bool
 
 	cmd := &cobra.Command{
 		Use:   "job",
@@ -49,7 +50,8 @@ Examples:
 
 What gets generated:
 - Job configuration YAML file in the resources directory
-- Any associated notebook or Python files in the source directory
+- Any associated notebook files in the source directory
+- Any associated python spark files in the source directory, if --download-spark-python-files is provided
 
 After generation, you can deploy this job to other targets using:
   databricks bundle deploy --target staging
@@ -64,6 +66,7 @@ After generation, you can deploy this job to other targets using:
 	cmd.Flags().BoolVarP(&force, "force", "f", false, `Force overwrite existing files in the output directory`)
 	cmd.Flags().BoolVarP(&bind, "bind", "b", false, `automatically bind the generated resource to the existing resource`)
 	cmd.Flags().MarkHidden("bind")
+	cmd.Flags().BoolVar(&downloadSparkPythonFiles, "download-spark-python-files", false, `download workspace files referenced by spark_python_task and rewrite them to a relative path`)
 
 	cmd.RunE = func(cmd *cobra.Command, args []string) error {
 		ctx := logdiag.InitContext(cmd.Context())
@@ -80,7 +83,11 @@ After generation, you can deploy this job to other targets using:
 			return err
 		}
 
-		downloader := generate.NewDownloader(w, sourceDir, configDir)
+		var opts []generate.DownloaderOption
+		if downloadSparkPythonFiles {
+			opts = append(opts, generate.WithSparkPythonFiles())
+		}
+		downloader := generate.NewDownloader(w, sourceDir, configDir, opts...)
 
 		// Don't download files if the job is using Git source
 		// When Git source is used, the job will be using the files from the Git repository
@@ -92,11 +99,9 @@ After generation, you can deploy this job to other targets using:
 		if job.Settings.GitSource != nil {
 			cmdio.LogString(ctx, "Job is using Git source, skipping downloading files")
 		} else {
-			for _, task := range job.Settings.Tasks {
-				err := downloader.MarkTaskForDownload(ctx, &task)
-				if err != nil {
-					return err
-				}
+			err = downloader.MarkTasksForDownload(ctx, job.Settings.Tasks)
+			if err != nil {
+				return err
 			}
 		}
 
@@ -123,6 +128,8 @@ After generation, you can deploy this job to other targets using:
 			return err
 		}
 
+		downloader.CleanupOldFiles(ctx)
+
 		oldFilename := filepath.Join(configDir, jobKey+".yml")
 		filename := filepath.Join(configDir, jobKey+".job.yml")
 
@@ -147,6 +154,8 @@ After generation, you can deploy this job to other targets using:
 
 		cmdio.LogString(ctx, "Job configuration successfully saved to "+filepath.ToSlash(filename))
 
+		warnIfNotIncluded(ctx, b, filename)
+
 		if bind {
 			return deployment.BindResource(cmd, jobKey, strconv.FormatInt(jobId, 10), true, false, true)
 		}
diff --git a/cmd/bundle/generate/pipeline.go b/cmd/bundle/generate/pipeline.go
index 35fb073cadd..cdde5984d40 100644
--- a/cmd/bundle/generate/pipeline.go
+++ b/cmd/bundle/generate/pipeline.go
@@ -151,6 +151,8 @@ like catalogs, schemas, and compute configurations per target.`,
 
 		cmdio.LogString(ctx, "Pipeline configuration successfully saved to "+filepath.ToSlash(filename))
 
+		warnIfNotIncluded(ctx, b, filename)
+
 		if bind {
 			return deployment.BindResource(cmd, pipelineKey, pipelineId, true, false, true)
 		}
diff --git a/cmd/bundle/generate/state.go b/cmd/bundle/generate/state.go
new file mode 100644
index 00000000000..2868be7166d
--- /dev/null
+++ b/cmd/bundle/generate/state.go
@@ -0,0 +1,56 @@
+package generate
+
+import (
+	"context"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/deploy/terraform"
+	"github.com/databricks/cli/bundle/phases"
+	"github.com/databricks/cli/bundle/statemgmt"
+	"github.com/databricks/cli/cmd/bundle/utils"
+	"github.com/databricks/cli/libs/logdiag"
+	"github.com/databricks/databricks-sdk-go/useragent"
+)
+
+// loadStateForGenerate initializes the bundle, pulls the deployment state, tags the
+// resolved engine in the user agent, and loads the state into the bundle. Shared by the
+// resource-key paths of "generate dashboard" and "generate genie-space" - the only
+// generate commands that resolve a bundle resource against deployment state. Errors are
+// reported through logdiag; callers check logdiag.HasError on the returned context.
+func loadStateForGenerate(ctx context.Context, b *bundle.Bundle) context.Context {
+	phases.Initialize(ctx, b)
+	if logdiag.HasError(ctx) {
+		return ctx
+	}
+
+	if err := utils.ValidateEngineSetting(ctx, b); err != nil {
+		logdiag.LogError(ctx, err)
+		return ctx
+	}
+
+	stateDesc := statemgmt.PullResourcesState(ctx, b, statemgmt.AlwaysPull(true))
+	if logdiag.HasError(ctx) {
+		return ctx
+	}
+	ctx = useragent.InContext(ctx, "engine", string(stateDesc.Engine))
+	ctx = utils.WithLineage(ctx, stateDesc)
+
+	var state statemgmt.ExportedResourcesMap
+	if stateDesc.Engine.IsDirect() {
+		if err := utils.OpenDirectStateForRead(ctx, b, stateDesc); err != nil {
+			logdiag.LogError(ctx, err)
+			return ctx
+		}
+		state = b.DeploymentBundle.ExportState(ctx)
+	} else {
+		var err error
+		state, err = terraform.ParseResourcesState(ctx, b)
+		if err != nil {
+			logdiag.LogError(ctx, err)
+			return ctx
+		}
+	}
+
+	bundle.ApplySeqContext(ctx, b, statemgmt.Load(state))
+	return ctx
+}
diff --git a/cmd/bundle/init.go b/cmd/bundle/init.go
index 8b6ce633a8c..00b8d73809a 100644
--- a/cmd/bundle/init.go
+++ b/cmd/bundle/init.go
@@ -6,6 +6,7 @@ import (
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
 	"github.com/databricks/cli/libs/template"
 	"github.com/spf13/cobra"
 )
@@ -23,13 +24,11 @@ TEMPLATE_PATH optionally specifies which template to use. It can be one of the f
 - a Git repository URL, e.g. https://github.com/my/repository
 
 Examples:
-  databricks bundle init                   # Choose from built-in templates
-  databricks bundle init default-python    # Python jobs and notebooks
-  databricks bundle init dbt-sql           # dbt + SQL warehouse project
-  databricks bundle init --output-dir ./my-project
+  databricks bundle init default-python
+  databricks bundle init app-appkit --config-file input.json  # {"project_name":"my-app"}
 
 After initialization:
-  databricks bundle deploy --target dev
+  databricks bundle deploy
 
 See https://docs.databricks.com/en/dev-tools/bundles/templates.html for more information on templates.`, template.HelpDescriptions()),
 	}
@@ -42,18 +41,38 @@ See https://docs.databricks.com/en/dev-tools/bundles/templates.html for more inf
 	cmd.Flags().StringVar(&configFile, "config-file", "", "JSON file containing key value pairs of input parameters required for template initialization.")
 	cmd.Flags().StringVar(&templateDir, "template-dir", "", "Directory path within a Git repository containing the template.")
 	cmd.Flags().StringVar(&outputDir, "output-dir", "", "Directory to write the initialized template to.")
-	cmd.Flags().StringVar(&branch, "tag", "", "Git tag to use for template initialization")
-	cmd.Flags().StringVar(&tag, "branch", "", "Git branch to use for template initialization")
+	cmd.Flags().StringVar(&tag, "tag", "", "Git tag to use for template initialization")
+	cmd.Flags().StringVar(&branch, "branch", "", "Git branch to use for template initialization")
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) error {
 		if tag != "" && branch != "" {
 			return errors.New("only one of --tag or --branch can be specified")
 		}
-
+		ctx := cmd.Context()
 		var templatePathOrUrl string
 		if len(args) > 0 {
 			templatePathOrUrl = args[0]
+		} else {
+			selected, err := template.SelectTemplate(ctx)
+			if errors.Is(err, template.ErrCustomSelected) {
+				cmdio.LogString(ctx, "Please specify a path or Git repository to use a custom template.")
+				cmdio.LogString(ctx, "See https://docs.databricks.com/en/dev-tools/bundles/templates.html to learn more about custom templates.")
+				return nil
+			}
+			if err != nil {
+				return err
+			}
+			templatePathOrUrl = string(selected)
+		}
+		if templatePathOrUrl == string(template.AppKitApp) {
+			return runAppKitInit(cmd, appKitInitOptions{
+				configFile:  configFile,
+				outputDir:   outputDir,
+				templateDir: templateDir,
+				tag:         tag,
+				branch:      branch,
+			})
 		}
 		r := template.Resolver{
 			TemplatePathOrUrl: templatePathOrUrl,
@@ -64,13 +83,7 @@ See https://docs.databricks.com/en/dev-tools/bundles/templates.html for more inf
 			Branch:            branch,
 		}
 
-		ctx := cmd.Context()
 		tmpl, err := r.Resolve(ctx)
-		if errors.Is(err, template.ErrCustomSelected) {
-			cmdio.LogString(ctx, "Please specify a path or Git repository to use a custom template.")
-			cmdio.LogString(ctx, "See https://docs.databricks.com/en/dev-tools/bundles/templates.html to learn more about custom templates.")
-			return nil
-		}
 		if err != nil {
 			return err
 		}
@@ -81,6 +94,12 @@ See https://docs.databricks.com/en/dev-tools/bundles/templates.html for more inf
 			return err
 		}
 		tmpl.Writer.LogTelemetry(ctx)
+
+		// Gated on JSON output to keep the text output unchanged: the success
+		// message is already printed by Materialize.
+		if root.OutputType(cmd) == flags.OutputJSON {
+			return cmdio.Render(ctx, tmpl.Writer.InitResult())
+		}
 		return nil
 	}
 	return cmd
diff --git a/cmd/bundle/init_appkit.go b/cmd/bundle/init_appkit.go
new file mode 100644
index 00000000000..bada4b0e345
--- /dev/null
+++ b/cmd/bundle/init_appkit.go
@@ -0,0 +1,128 @@
+package bundle
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"strings"
+
+	"github.com/databricks/cli/cmd/apps"
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/spf13/cobra"
+)
+
+type appKitInitOptions struct {
+	configFile  string
+	outputDir   string
+	templateDir string
+	tag         string
+	branch      string
+}
+
+type appKitInitConfig struct {
+	ProjectName    string   `json:"project_name"`
+	AppDescription string   `json:"app_description"`
+	Features       []string `json:"features"`
+	Set            []string `json:"set"`
+	AuthMode       string   `json:"auth_mode"`
+	PackageManager string   `json:"package_manager"`
+	SkipInstall    bool     `json:"skip_install"`
+	Version        string   `json:"version"`
+}
+
+func readAppKitInitConfig(path string) (appKitInitConfig, error) {
+	var config appKitInitConfig
+	if path == "" {
+		return config, nil
+	}
+
+	file, err := os.Open(path)
+	if err != nil {
+		return config, fmt.Errorf("open AppKit config file: %w", err)
+	}
+	defer file.Close()
+
+	decoder := json.NewDecoder(file)
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(&config); err != nil {
+		return config, fmt.Errorf("read AppKit config file: %w", err)
+	}
+	var extra any
+	if err := decoder.Decode(&extra); !errors.Is(err, io.EOF) {
+		return config, errors.New("AppKit config file must contain one JSON object")
+	}
+	return config, nil
+}
+
+func runAppKitInit(cmd *cobra.Command, opts appKitInitOptions) error {
+	if opts.templateDir != "" {
+		return errors.New("--template-dir is not supported for app-appkit; use databricks apps init --template for a custom AppKit template")
+	}
+	if root.OutputType(cmd) == flags.OutputJSON {
+		return errors.New("-o json is not supported for app-appkit; use text output")
+	}
+
+	config, err := readAppKitInitConfig(opts.configFile)
+	if err != nil {
+		return err
+	}
+	if config.Version != "" && (opts.tag != "" || opts.branch != "") {
+		return errors.New("version in --config-file cannot be combined with --tag or --branch")
+	}
+	if config.ProjectName == "" && !cmdio.IsPromptSupported(cmd.Context()) {
+		return errors.New("app-appkit requires project_name in --config-file in non-interactive mode")
+	}
+
+	appCmd := apps.NewInitCommand()
+	appCmd.SetContext(cmd.Context())
+	appFlags := appCmd.Flags()
+	values := map[string]string{
+		"name":            config.ProjectName,
+		"description":     config.AppDescription,
+		"output-dir":      opts.outputDir,
+		"auth-mode":       config.AuthMode,
+		"package-manager": config.PackageManager,
+	}
+	for flag, value := range values {
+		if value == "" {
+			continue
+		}
+		if err := appFlags.Set(flag, value); err != nil {
+			return fmt.Errorf("set AppKit %s: %w", flag, err)
+		}
+	}
+	if len(config.Features) > 0 {
+		if err := appFlags.Set("features", strings.Join(config.Features, ",")); err != nil {
+			return fmt.Errorf("set AppKit features: %w", err)
+		}
+	}
+	for _, value := range config.Set {
+		if err := appFlags.Set("set", value); err != nil {
+			return fmt.Errorf("set AppKit resource value: %w", err)
+		}
+	}
+	if opts.branch != "" || opts.tag != "" {
+		ref := opts.branch
+		if ref == "" {
+			ref = opts.tag
+		}
+		if err := appFlags.Set("branch", ref); err != nil {
+			return fmt.Errorf("set AppKit template ref: %w", err)
+		}
+	} else if config.Version != "" {
+		if err := appFlags.Set("version", config.Version); err != nil {
+			return fmt.Errorf("set AppKit version: %w", err)
+		}
+	}
+	if config.SkipInstall {
+		if err := appFlags.Set("skip-install", "true"); err != nil {
+			return fmt.Errorf("set AppKit skip-install: %w", err)
+		}
+	}
+
+	return appCmd.RunE(appCmd, nil)
+}
diff --git a/cmd/bundle/init_appkit_test.go b/cmd/bundle/init_appkit_test.go
new file mode 100644
index 00000000000..08c7c1abd60
--- /dev/null
+++ b/cmd/bundle/init_appkit_test.go
@@ -0,0 +1,30 @@
+package bundle
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestReadAppKitInitConfigRejectsInvalidJSON(t *testing.T) {
+	tests := []struct {
+		name     string
+		contents string
+		want     string
+	}{
+		{"malformed", `{"project_name":`, "unexpected EOF"},
+		{"unknown field", `{"project_name":"app","extra":true}`, `unknown field "extra"`},
+		{"trailing object", `{"project_name":"app"} {"project_name":"other"}`, "must contain one JSON object"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			path := filepath.Join(t.TempDir(), "input.json")
+			require.NoError(t, os.WriteFile(path, []byte(tt.contents), 0o600))
+			_, err := readAppKitInitConfig(path)
+			require.ErrorContains(t, err, tt.want)
+		})
+	}
+}
diff --git a/cmd/bundle/open.go b/cmd/bundle/open.go
index ca2bec04d0f..5926b1419f8 100644
--- a/cmd/bundle/open.go
+++ b/cmd/bundle/open.go
@@ -74,7 +74,8 @@ Use after deployment to quickly navigate to your resources in the workspace.`,
 				arg, err = resolveOpenArgument(ctx, b, args)
 				return err
 			},
-			InitIDs: true,
+			AlwaysPull: forcePull,
+			InitIDs:    true,
 		})
 		if err != nil {
 			return err
@@ -87,7 +88,10 @@ Use after deployment to quickly navigate to your resources in the workspace.`,
 		}
 
 		// Confirm that the resource has a URL.
-		url := ref.Resource.GetURL()
+		url, supported := ref.Resource.GetURL()
+		if !supported {
+			return errors.New("this resource type does not have a URL")
+		}
 		if url == "" {
 			return errors.New("resource does not have a URL associated with it (has it been deployed?)")
 		}
diff --git a/cmd/bundle/plan.go b/cmd/bundle/plan.go
index e3dd63929ed..1132834bc4d 100644
--- a/cmd/bundle/plan.go
+++ b/cmd/bundle/plan.go
@@ -6,6 +6,7 @@ import (
 	"strings"
 
 	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/deploy/snapshot"
 	"github.com/databricks/cli/bundle/deployplan"
 	"github.com/databricks/cli/bundle/phases"
 	"github.com/databricks/cli/cmd/bundle/utils"
@@ -27,11 +28,15 @@ It is useful for previewing changes before running 'bundle deploy'.`,
 	}
 
 	var force bool
+	var quiet int
 	var clusterId string
+	var selectResources []string
 	cmd.Flags().BoolVar(&force, "force", false, "Force-override Git branch validation.")
+	cmd.Flags().CountVarP(&quiet, "quiet", "q", "Reduce output: -q prints only the summary, -qq prints nothing on success.")
 	cmd.Flags().StringVar(&clusterId, "compute-id", "", "Override cluster in the deployment with the given compute ID.")
 	cmd.Flags().StringVarP(&clusterId, "cluster-id", "c", "", "Override cluster in the deployment with the given cluster ID.")
 	cmd.Flags().MarkDeprecated("compute-id", "use --cluster-id instead")
+	cmd.Flags().StringSliceVar(&selectResources, "select", nil, "Plan only the specified resource (e.g. 'my_job' or 'jobs.my_job'). Can be repeated or comma-separated.")
 
 	cmd.RunE = func(cmd *cobra.Command, args []string) error {
 		opts := utils.ProcessOptions{
@@ -39,12 +44,9 @@ It is useful for previewing changes before running 'bundle deploy'.`,
 			FastValidate:    true,
 			Build:           true,
 			PreDeployChecks: true,
-		}
-
-		// Only add InitFunc if we need to set force or cluster ID
-		if force || cmd.Flag("compute-id").Changed || cmd.Flag("cluster-id").Changed {
-			opts.InitFunc = func(b *bundle.Bundle) {
+			InitFunc: func(b *bundle.Bundle) {
 				b.Config.Bundle.Force = force
+				b.Select = selectResources
 
 				if cmd.Flag("compute-id").Changed {
 					b.Config.Bundle.ClusterId = clusterId
@@ -53,62 +55,59 @@ It is useful for previewing changes before running 'bundle deploy'.`,
 				if cmd.Flag("cluster-id").Changed {
 					b.Config.Bundle.ClusterId = clusterId
 				}
-			}
+			},
 		}
 
-		b, stateDesc, err := utils.ProcessBundleRet(cmd, opts)
+		b, _, err := utils.ProcessBundleRet(cmd, opts)
 		if err != nil {
 			return err
 		}
 		ctx := cmd.Context()
 
-		plan := phases.RunPlan(ctx, b, stateDesc.Engine)
+		if b.IsImmutableFolder() {
+			bundle.ApplyContext(ctx, b, snapshot.PlanUpload(snapshot.PlanUploadOptions{Clean: true}))
+			if logdiag.HasError(ctx) {
+				return root.ErrAlreadyPrinted
+			}
+		}
+		plan := phases.RunPlan(ctx, b)
 		if logdiag.HasError(ctx) {
 			return root.ErrAlreadyPrinted
 		}
 
-		// Count actions by type and collect formatted actions
-		createCount := 0
-		updateCount := 0
-		deleteCount := 0
-		unchangedCount := 0
-
-		for _, change := range plan.GetActions() {
-			switch change.ActionType {
-			case deployplan.Create:
-				createCount++
-			case deployplan.Update, deployplan.UpdateWithID, deployplan.Resize:
-				updateCount++
-			case deployplan.Delete:
-				deleteCount++
-			case deployplan.Recreate:
-				// A recreate counts as both a delete and a create
-				deleteCount++
-				createCount++
-			case deployplan.Skip, deployplan.Undefined:
-				unchangedCount++
-			}
-		}
+		counts := plan.CountActions()
 
 		out := cmd.OutOrStdout()
 
 		switch root.OutputType(cmd) {
 		case flags.OutputText:
 			// Print summary line and actions to stdout
-			totalChanges := createCount + updateCount + deleteCount
-			if totalChanges > 0 {
+			totalChanges := counts.Create + counts.Change + counts.Delete
+			if totalChanges > 0 && bundle.QuietLevel(quiet) < bundle.QuietSummary {
 				// Print all actions in the order they were processed
 				for _, action := range plan.GetActions() {
 					if action.ActionType == deployplan.Skip {
 						continue
 					}
+					// A state-only delete has no backend effect; keep it in the JSON
+					// plan but omit it from the human-readable action list.
+					if action.IsStateOnlyDelete() {
+						continue
+					}
 					key := strings.TrimPrefix(action.ResourceKey, "resources.")
 					fmt.Fprintf(out, "%s %s\n", action.ActionType.StringShort(), key)
 				}
 				fmt.Fprintln(out)
 			}
+			if bundle.QuietLevel(quiet) >= bundle.QuietAll {
+				break
+			}
 			// Note, this string should not be changed, "bundle deployment migrate" depends on this format:
-			fmt.Fprintf(out, "Plan: %d to add, %d to change, %d to delete, %d unchanged\n", createCount, updateCount, deleteCount, unchangedCount)
+			fmt.Fprintf(out, "Plan: %d to add, %d to change, %d to delete, %d unchanged", counts.Create, counts.Change, counts.Delete, counts.Unchanged)
+			if len(selectResources) > 0 {
+				fmt.Fprintf(out, ", %d not selected", plan.NotSelected)
+			}
+			fmt.Fprintln(out)
 		case flags.OutputJSON:
 			buf, err := json.MarshalIndent(plan, "", "  ")
 			if err != nil {
diff --git a/cmd/bundle/run.go b/cmd/bundle/run.go
index e98fe59ac4e..17199a6cabf 100644
--- a/cmd/bundle/run.go
+++ b/cmd/bundle/run.go
@@ -10,6 +10,7 @@ import (
 	"slices"
 
 	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
 	"github.com/databricks/cli/bundle/env"
 	"github.com/databricks/cli/bundle/resources"
 	"github.com/databricks/cli/bundle/run"
@@ -20,6 +21,7 @@ import (
 	"github.com/databricks/cli/libs/auth"
 	"github.com/databricks/cli/libs/cmdctx"
 	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/cli/libs/execv"
 	"github.com/databricks/cli/libs/flags"
 	"github.com/databricks/cli/libs/logdiag"
@@ -136,6 +138,9 @@ Example usage:
 		if cmd.ArgsLenAtDash() == 0 && len(args) > 0 {
 			b, err := utils.ProcessBundle(cmd, utils.ProcessOptions{
 				SkipInitialize: true,
+				InitFunc: func(b *bundle.Bundle) {
+					b.AllowTerraformEngineConfig = true
+				},
 			})
 			if err != nil {
 				return err
@@ -152,6 +157,10 @@ Example usage:
 		_, _, err := utils.ProcessBundleRet(cmd, utils.ProcessOptions{
 			AlwaysPull:        true,
 			ErrorOnEmptyState: true,
+			// Let users run a bundle that pins the removed Terraform engine.
+			InitFunc: func(b *bundle.Bundle) {
+				b.AllowTerraformEngineConfig = true
+			},
 			PostInitFunc: func(ctx context.Context, b *bundle.Bundle) error {
 				var err error
 				key, runArgs, err = resolveRunArgument(ctx, b, args)
@@ -165,12 +174,28 @@ Example usage:
 					if len(runArgs) > 0 {
 						return fmt.Errorf("additional arguments are not supported for scripts. Got: %v. We recommend using environment variables to pass runtime arguments to a script. For example: FOO=bar databricks bundle run my_script", runArgs)
 					}
-					return executeScript(b.Config.Scripts[key].Content, cmd, b)
+					return executeScript(b.Config.Scripts[key], cmd, b)
 				}
 
 				return nil
 			},
 			PostStateFunc: func(ctx context.Context, b *bundle.Bundle, stateDesc *statemgmt.StateDesc) error {
+				ref, err := resources.Lookup(b, key, run.IsRunnable)
+				if err != nil {
+					return err
+				}
+
+				// Resolve ${resources.*} references within the resource being run so its
+				// runner sees concrete values (e.g. an app's env vars referencing another
+				// resource, or its source_code_path pointing at the immutable snapshot's
+				// full_path, which lives only in the deployed state).
+				target := dyn.NewPath(dyn.Key("resources"), dyn.Key(ref.Description.PluralName), dyn.Key(ref.Key))
+				if err := b.DeploymentBundle.ResolveConfigAgainstState(&b.Config, target); err != nil {
+					return err
+				}
+
+				// Re-resolve after ResolveConfigAgainstState so the runner reads the resolved
+				// resource; the ref above is a pre-resolution snapshot.
 				runner, err := keyToRunner(b, key)
 				if err != nil {
 					return err
@@ -276,8 +301,14 @@ func scriptEnv(cmd *cobra.Command, b *bundle.Bundle) []string {
 	return out
 }
 
-func executeScript(content string, cmd *cobra.Command, b *bundle.Bundle) error {
-	return execv.Shell(content, b.BundleRootPath, scriptEnv(cmd, b))
+func executeScript(script config.Script, cmd *cobra.Command, b *bundle.Bundle) error {
+	env := scriptEnv(cmd, b)
+	// Append after the auth/target variables so a script's env: section takes
+	// precedence on collision (os/exec uses the last value for a duplicate key).
+	for _, name := range slices.Sorted(maps.Keys(script.Env)) {
+		env = append(env, name+"="+script.Env[name])
+	}
+	return execv.Shell(script.Content, b.BundleRootPath, env)
 }
 
 func executeInline(cmd *cobra.Command, args []string, b *bundle.Bundle) error {
diff --git a/cmd/bundle/schema.go b/cmd/bundle/schema.go
index 22890dff0b3..68ba2cf879a 100644
--- a/cmd/bundle/schema.go
+++ b/cmd/bundle/schema.go
@@ -13,7 +13,7 @@ func newSchemaCommand() *cobra.Command {
 		Long: `Generate JSON Schema for bundle configuration to enable validation and autocomplete.
 
 This command outputs the JSON Schema that describes the structure and validation
-rules for Databricks Asset Bundle configuration files.
+rules for Declarative Automation Bundle configuration files.
 
 Common use cases:
 - Configure IDE/editor validation for databricks.yml files
diff --git a/cmd/bundle/summary.go b/cmd/bundle/summary.go
index 9f2aa3e54bb..1a49a89c334 100644
--- a/cmd/bundle/summary.go
+++ b/cmd/bundle/summary.go
@@ -1,14 +1,10 @@
 package bundle
 
 import (
-	"context"
-
 	"github.com/databricks/cli/bundle"
-	"github.com/databricks/cli/bundle/config/mutator"
 	"github.com/databricks/cli/bundle/render"
 	"github.com/databricks/cli/cmd/bundle/utils"
 	"github.com/databricks/cli/cmd/root"
-	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/flags"
 	"github.com/databricks/cli/libs/logdiag"
 	"github.com/spf13/cobra"
@@ -25,37 +21,27 @@ Useful after deployment to see what was created and where to find it.`,
 
 	var forcePull bool
 	var includeLocations bool
-	var shouldShowFullConfig bool
 	cmd.Flags().BoolVar(&forcePull, "force-pull", false, "Skip local cache and load the state from the remote workspace")
 	cmd.Flags().BoolVar(&includeLocations, "include-locations", false, "Include location information in the output")
 	cmd.Flags().MarkHidden("include-locations")
-	cmd.Flags().BoolVar(&shouldShowFullConfig, "show-full-config", false, "Load and output the full bundle config")
-	cmd.Flags().MarkHidden("show-full-config")
 
 	cmd.RunE = func(cmd *cobra.Command, args []string) error {
-		var err error
-		if shouldShowFullConfig {
-			ctx := logdiag.InitContext(cmd.Context())
-			cmd.SetContext(ctx)
-			logdiag.SetSeverity(ctx, diag.Warning)
-
-			err = showFullConfig(ctx, cmd, includeLocations)
-			if err != nil {
-				return err
-			}
-		} else {
-			b, err := utils.ProcessBundle(cmd, utils.ProcessOptions{
-				ReadState:        true,
-				IncludeLocations: includeLocations,
-				InitIDs:          true,
-			})
-			if err != nil {
-				return err
-			}
-			err = showSummary(cmd, b)
-			if err != nil {
-				return err
-			}
+		b, err := utils.ProcessBundle(cmd, utils.ProcessOptions{
+			ReadState:        true,
+			AlwaysPull:       forcePull,
+			IncludeLocations: includeLocations,
+			InitIDs:          true,
+			// Let users inspect a bundle that pins the removed Terraform engine.
+			InitFunc: func(b *bundle.Bundle) {
+				b.AllowTerraformEngineConfig = true
+			},
+		})
+		if err != nil {
+			return err
+		}
+		err = showSummary(cmd, b)
+		if err != nil {
+			return err
 		}
 
 		if logdiag.HasError(cmd.Context()) {
@@ -68,35 +54,6 @@ Useful after deployment to see what was created and where to find it.`,
 	return cmd
 }
 
-func showFullConfig(ctx context.Context, cmd *cobra.Command, includeLocations bool) error {
-	// call `MustLoad` directly instead of `MustConfigureBundle` because the latter does
-	// validation that we're not interested in here
-	b := bundle.MustLoad(ctx)
-	if b == nil || logdiag.HasError(ctx) {
-		return nil
-	}
-
-	mutator.DefaultMutators(ctx, b)
-	if logdiag.HasError(ctx) {
-		return nil
-	}
-
-	if includeLocations {
-		// Include location information in the output
-		bundle.ApplyContext(ctx, b, mutator.PopulateLocations())
-		if logdiag.HasError(ctx) {
-			return nil
-		}
-	}
-
-	err := renderJsonOutput(cmd, b)
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
 func showSummary(cmd *cobra.Command, b *bundle.Bundle) error {
 	if root.OutputType(cmd) == flags.OutputText {
 		return render.RenderSummary(cmd.Context(), cmd.OutOrStdout(), b)
diff --git a/cmd/bundle/sync.go b/cmd/bundle/sync.go
index f65a5780bd1..955d425f208 100644
--- a/cmd/bundle/sync.go
+++ b/cmd/bundle/sync.go
@@ -17,13 +17,10 @@ import (
 )
 
 type syncFlags struct {
-	interval     time.Duration
-	full         bool
-	watch        bool
-	output       flags.Output
-	dryRun       bool
-	concurrency  int
-	retryTimeout time.Duration
+	interval time.Duration
+	full     bool
+	watch    bool
+	dryRun   bool
 }
 
 func (f *syncFlags) syncOptionsFromBundle(cmd *cobra.Command, b *bundle.Bundle) (*sync.SyncOptions, error) {
@@ -32,26 +29,22 @@ func (f *syncFlags) syncOptionsFromBundle(cmd *cobra.Command, b *bundle.Bundle)
 		return nil, fmt.Errorf("cannot get sync options: %w", err)
 	}
 
-	if f.output != "" {
-		var outputFunc func(context.Context, <-chan sync.Event, io.Writer)
-		switch f.output {
-		case flags.OutputText:
-			outputFunc = sync.TextOutput
-		case flags.OutputJSON:
-			outputFunc = sync.JsonOutput
-		}
-		if outputFunc != nil {
-			opts.OutputHandler = func(ctx context.Context, c <-chan sync.Event) {
-				outputFunc(ctx, c, cmd.OutOrStdout())
-			}
+	var outputFunc func(context.Context, <-chan sync.Event, io.Writer)
+	switch root.OutputType(cmd) {
+	case flags.OutputText:
+		outputFunc = sync.TextOutput
+	case flags.OutputJSON:
+		outputFunc = sync.JsonOutput
+	}
+	if outputFunc != nil {
+		opts.OutputHandler = func(ctx context.Context, c <-chan sync.Event) {
+			outputFunc(ctx, c, cmd.OutOrStdout())
 		}
 	}
 
 	opts.Full = f.full
 	opts.PollInterval = f.interval
 	opts.DryRun = f.dryRun
-	opts.Concurrency = f.concurrency
-	opts.RetryTimeout = f.retryTimeout
 	return opts, nil
 }
 
@@ -76,19 +69,9 @@ Use 'databricks bundle deploy' for full resource deployment.`,
 	cmd.Flags().DurationVar(&f.interval, "interval", 1*time.Second, "file system polling interval (for --watch)")
 	cmd.Flags().BoolVar(&f.full, "full", false, "perform full synchronization (default is incremental)")
 	cmd.Flags().BoolVar(&f.watch, "watch", false, "watch local file system for changes")
-	cmd.Flags().Var(&f.output, "output", "type of the output format")
 	cmd.Flags().BoolVar(&f.dryRun, "dry-run", false, "simulate sync execution without making actual changes")
-	cmd.Flags().IntVar(&f.concurrency, "concurrency", 5, "maximum number of concurrent in-flight requests during sync")
-	cmd.Flags().DurationVar(&f.retryTimeout, "retry-timeout", sync.DefaultRetryTimeout, "per-call deadline for retrying transient gateway errors (HTTP 502/503/504)")
 
 	cmd.RunE = func(cmd *cobra.Command, args []string) error {
-		if f.concurrency < 1 {
-			return fmt.Errorf("--concurrency must be a positive integer, got %d", f.concurrency)
-		}
-		if f.retryTimeout < 0 {
-			return fmt.Errorf("--retry-timeout must be non-negative, got %s", f.retryTimeout)
-		}
-
 		b, err := utils.ProcessBundle(cmd, utils.ProcessOptions{})
 		if err != nil {
 			return err
diff --git a/cmd/bundle/sync_test.go b/cmd/bundle/sync_test.go
new file mode 100644
index 00000000000..579aa69865f
--- /dev/null
+++ b/cmd/bundle/sync_test.go
@@ -0,0 +1,64 @@
+package bundle
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/cli/libs/vfs"
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// newTestSyncCommand attaches the sync command to a root command so the root persistent flags resolve.
+func newTestSyncCommand(t *testing.T) *cobra.Command {
+	syncCmd := newSyncCommand()
+	root.New(t.Context()).AddCommand(syncCmd)
+	return syncCmd
+}
+
+func TestBundleSyncShorthandFlags(t *testing.T) {
+	cmd := newTestSyncCommand(t)
+	require.NoError(t, cmd.ParseFlags([]string{"-o", "json", "-p", "myprofile"}))
+	assert.Equal(t, flags.OutputJSON, root.OutputType(cmd))
+	assert.Equal(t, "myprofile", cmd.Flag("profile").Value.String())
+}
+
+func TestBundleSyncInstallsOutputHandler(t *testing.T) {
+	tempDir := t.TempDir()
+	b := &bundle.Bundle{
+		BundleRootPath: tempDir,
+		BundleRoot:     vfs.MustNew(tempDir),
+		SyncRootPath:   tempDir,
+		SyncRoot:       vfs.MustNew(tempDir),
+		Config: config.Root{
+			Bundle: config.Bundle{
+				Target: "default",
+			},
+			Workspace: config.Workspace{
+				FilePath: "/Users/jane@doe.com/path",
+			},
+		},
+	}
+
+	f := syncFlags{}
+
+	// bundle sync defaults to text output, matching the standalone sync command:
+	// the root --output flag resolves to text when unset, so a handler is installed.
+	cmd := newTestSyncCommand(t)
+	cmd.SetContext(t.Context())
+	require.NoError(t, cmd.ParseFlags(nil))
+	opts, err := f.syncOptionsFromBundle(cmd, b)
+	require.NoError(t, err)
+	assert.NotNil(t, opts.OutputHandler)
+
+	cmd = newTestSyncCommand(t)
+	cmd.SetContext(t.Context())
+	require.NoError(t, cmd.ParseFlags([]string{"-o", "json"}))
+	opts, err = f.syncOptionsFromBundle(cmd, b)
+	require.NoError(t, err)
+	assert.NotNil(t, opts.OutputHandler)
+}
diff --git a/cmd/bundle/utils/destroy.go b/cmd/bundle/utils/destroy.go
new file mode 100644
index 00000000000..7df0a78c328
--- /dev/null
+++ b/cmd/bundle/utils/destroy.go
@@ -0,0 +1,60 @@
+package utils
+
+import (
+	"context"
+	"errors"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/phases"
+	"github.com/databricks/cli/bundle/statemgmt"
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/agent"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/logdiag"
+	"github.com/spf13/cobra"
+)
+
+// CommandBundleDestroy destroys a bundle for the bundle, apps, and pipelines commands.
+func CommandBundleDestroy(cmd *cobra.Command, args []string, autoApprove, forceDestroy bool) error {
+	// We require auto-approve for non-interactive terminals since prompts are not possible.
+	if !cmdio.IsPromptSupported(cmd.Context()) && !autoApprove {
+		return errors.New("this command will destroy all resources deployed by this bundle, " +
+			"including workspace files in the deployment directory.\n" +
+			phases.DataLossWarning + "\n" +
+			"To proceed, use --auto-approve." + agent.AgentNotice())
+	}
+
+	// Check if context is already initialized (e.g., when called from apps delete override)
+	skipInitContext := logdiag.IsSetup(cmd.Context())
+
+	opts := ProcessOptions{
+		InitFunc: func(b *bundle.Bundle) {
+			// If `--force-lock` is specified, force acquisition of the deployment lock.
+			SetForceLock(cmd, b, forceDestroy)
+
+			// If `--auto-approve`` is specified, we skip confirmation checks
+			b.AutoApprove = autoApprove
+
+			// Read --quiet off the command rather than taking it as a parameter, since
+			// other commands reuse this function ("apps delete") without defining it.
+			if cmd.Flags().Lookup("quiet") != nil {
+				n, _ := cmd.Flags().GetCount("quiet")
+				b.Quiet = bundle.QuietLevel(n)
+			}
+		},
+		// Skip context initialization if already initialized by parent command
+		SkipInitContext:                       skipInitContext,
+		AlwaysPull:                            true,
+		SkipEnforcingDeploymentHistorySetting: true,
+		PostStateFunc: func(ctx context.Context, b *bundle.Bundle, stateDesc *statemgmt.StateDesc) error {
+			phases.Destroy(ctx, b)
+			if logdiag.HasError(ctx) {
+				return root.ErrAlreadyPrinted
+			}
+			return nil
+		},
+	}
+
+	_, _, err := ProcessBundleRet(cmd, opts)
+	return err
+}
diff --git a/cmd/bundle/utils/process.go b/cmd/bundle/utils/process.go
index a6f48d99fa2..21c3008f719 100644
--- a/cmd/bundle/utils/process.go
+++ b/cmd/bundle/utils/process.go
@@ -4,26 +4,44 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"path"
 	"path/filepath"
+	"strconv"
 	"time"
 
 	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
 	"github.com/databricks/cli/bundle/config/engine"
 	"github.com/databricks/cli/bundle/config/mutator"
 	"github.com/databricks/cli/bundle/config/validate"
+	"github.com/databricks/cli/bundle/deploy/metadata"
 	"github.com/databricks/cli/bundle/deployplan"
 	"github.com/databricks/cli/bundle/direct"
+	"github.com/databricks/cli/bundle/direct/dstate"
+	bundleenv "github.com/databricks/cli/bundle/env"
 	"github.com/databricks/cli/bundle/phases"
+	"github.com/databricks/cli/bundle/scripts"
 	"github.com/databricks/cli/bundle/statemgmt"
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/internal/build"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/diag"
+	"github.com/databricks/cli/libs/dms"
 	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/cli/libs/log"
 	"github.com/databricks/cli/libs/logdiag"
+	"github.com/databricks/cli/libs/retry"
 	"github.com/databricks/cli/libs/sync"
+	"github.com/databricks/cli/libs/telemetry"
 	"github.com/databricks/cli/libs/telemetry/protos"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/service/bundledeployments"
+	"github.com/databricks/databricks-sdk-go/service/workspace"
+	"github.com/databricks/databricks-sdk-go/useragent"
 	"github.com/spf13/cobra"
+	"golang.org/x/mod/semver"
 )
 
 type ProcessOptions struct {
@@ -68,13 +86,19 @@ type ProcessOptions struct {
 	Deploy          bool
 
 	// Path to pre-computed plan JSON file (direct engine only).
-	// When set, skips Build and PreDeployChecks phases, loads plan from file instead of calculating.
+	// When set, skips Build and PreDeployChecks phases, and loads the plan from
+	// the file instead of calculating it. Artifact uploads are handled directly
+	// inside Deploy by reading the remote paths from the plan's new_state and
+	// finding the matching local files.
 	ReadPlanPath string
 
 	// PostStateFunc is called at the end of ProcessBundleRet, within the state lifecycle scope
 	// (after state is opened and IDs loaded, before deferred Finalize).
 	PostStateFunc func(ctx context.Context, b *bundle.Bundle, stateDesc *statemgmt.StateDesc) error
 
+	// If true, deployment history configuration is ignored after state is resolved.
+	SkipEnforcingDeploymentHistorySetting bool
+
 	// Indicate whether the bundle operation originates from the pipelines CLI
 	IsPipelinesCLI bool
 }
@@ -137,6 +161,24 @@ func ProcessBundleRet(cmd *cobra.Command, opts ProcessOptions) (b *bundle.Bundle
 		bundle.ApplyFuncContext(ctx, b, func(context.Context, *bundle.Bundle) { opts.InitFunc(b) })
 	}
 
+	// InitFunc is where -q is applied, so the quiet context can only be derived
+	// afterwards. Progress messages are emitted from mutators that receive only a
+	// context, not the bundle, so the level has to travel on the context too.
+	if b != nil && b.SuppressProgress() {
+		ctx = cmdio.WithQuiet(ctx)
+		cmd.SetContext(ctx)
+	}
+
+	// Reject an invalid or removed DATABRICKS_BUNDLE_ENGINE before initialization, so
+	// the removal error comes before any initialize-time validation (such as
+	// validate.TFOnlyReferences). A terraform bundle.engine is reported during
+	// initialization by validate.ValidateEngine, with its location.
+	if b.Config.Bundle.Engine == engine.EngineNotSet {
+		if err := ValidateEngineSetting(ctx, b); err != nil {
+			return b, nil, err
+		}
+	}
+
 	if !opts.SkipInitialize {
 		t0 := time.Now()
 		phases.Initialize(ctx, b)
@@ -168,79 +210,61 @@ func ProcessBundleRet(cmd *cobra.Command, opts ProcessOptions) (b *bundle.Bundle
 		}
 	}
 
+	// An invalid or removed DATABRICKS_BUNDLE_ENGINE was already rejected before
+	// initialization and a bad bundle.engine by validate.ValidateEngine, so this
+	// only fails for commands that skip initialization (bundle run -- <cmd>) with
+	// a bad bundle.engine.
+	if err := ValidateEngineSetting(ctx, b); err != nil {
+		return b, nil, err
+	}
+
+	// Record the engine up front so deploy telemetry reports it even when
+	// the deploy fails before the state is pulled (e.g. PullResourcesState itself
+	// errors). Refined to the state's engine below once it is known; the two differ
+	// only mid-migration, when the deploy runs on the existing state's engine.
+	b.Metrics.StateEngine = engine.EngineDirect
+
+	// The current deployment read from the service (nil, id "" if there is none yet). Used for the
+	// metadata diff and to reject a saved plan that predates the deployment's recorded version.
+	var dmsDeployment *bundledeployments.Deployment
+	var dmsDeploymentID string
+
 	shouldReadState := opts.ReadState || opts.AlwaysPull || opts.InitIDs || opts.ErrorOnEmptyState || opts.PreDeployChecks || opts.Deploy || opts.ReadPlanPath != ""
 
 	if shouldReadState {
-		requiredEngine, err := ResolveEngineSetting(ctx, b)
-		if err != nil {
-			return b, nil, err
-		}
-
 		// PullResourcesState depends on stateFiler which needs b.Config.Workspace.StatePath which is set in phases.Initialize
-		ctx, stateDesc = statemgmt.PullResourcesState(ctx, b, statemgmt.AlwaysPull(opts.AlwaysPull), requiredEngine)
+		stateDesc = statemgmt.PullResourcesState(ctx, b, statemgmt.AlwaysPull(opts.AlwaysPull))
 		if logdiag.HasError(ctx) {
 			return b, stateDesc, root.ErrAlreadyPrinted
 		}
-		cmd.SetContext(ctx)
 
-		// Open direct engine state once for all subsequent operations (ExportState, CalculatePlan, Apply, etc.)
-		needDirectState := stateDesc.Engine.IsDirect() && (opts.InitIDs || opts.ErrorOnEmptyState || opts.Deploy || opts.ReadPlanPath != "" || opts.PreDeployChecks || opts.PostStateFunc != nil)
-		if needDirectState {
-			_, localPath := b.StateFilenameDirect(ctx)
-			if err := b.DeploymentBundle.StateDB.Open(localPath); err != nil {
-				logdiag.LogError(ctx, err)
-				return b, stateDesc, root.ErrAlreadyPrinted
-			}
-		}
+		b.MigratingToDirect = !stateDesc.Engine.IsDirect()
 
-		// These are not safe in plan/deploy because they insert empty config settings for deleted resources.
-		if opts.InitIDs || opts.ErrorOnEmptyState {
-			var modes []statemgmt.LoadMode
-			if opts.ErrorOnEmptyState {
-				modes = append(modes, statemgmt.ErrorOnEmptyState)
-			}
-			mutators := []bundle.Mutator{
-				statemgmt.Load(stateDesc.Engine, modes...),
-			}
-			// InitializeURLs makes an extra API call; only run it when URLs are needed.
-			if opts.InitIDs {
-				mutators = append(mutators, mutator.InitializeURLs())
-			}
-			bundle.ApplySeqContext(ctx, b, mutators...)
-			if logdiag.HasError(ctx) {
-				return b, stateDesc, root.ErrAlreadyPrinted
-			}
+		// Tag the user agent with the engine this run actually uses. On the auto-migration
+		// path the engine is only final after the migration runs (below), so leave it unset
+		// here and tag there; setting it once rather than appending avoids a stale
+		// engine/terraform tag alongside engine/direct.
+		if !b.MigratingToDirect {
+			ctx = useragent.InContext(ctx, "engine", string(stateDesc.Engine))
+		}
+		ctx = WithLineage(ctx, stateDesc)
+		cmd.SetContext(ctx)
+		if stateDesc.Engine.IsDirect() {
+			resolveDeploymentHistory(ctx, b, stateDesc)
 		}
-	}
 
-	var plan *deployplan.Plan
+		// Record the engine the resolved state uses now, so deploy telemetry reports
+		// it even when the deploy fails or is cancelled before deployCore runs.
+		b.Metrics.StateEngine = stateDesc.Engine.ThisOrDefault()
+	}
 
+	// --plan applies a precomputed plan, so it skips Build and PreDeployChecks; a plain
+	// deploy builds and runs the predeploy checks. These only flip opts (no state access),
+	// so they run before phases.Build; the plan file itself is loaded during state
+	// resolution after the build, once the engine is known and the state is open.
 	if opts.ReadPlanPath != "" {
-		if !stateDesc.Engine.IsDirect() {
-			logdiag.LogError(ctx, errors.New("--plan is only supported with direct engine (set bundle.engine to \"direct\" or DATABRICKS_BUNDLE_ENGINE=direct)"))
-			return b, stateDesc, root.ErrAlreadyPrinted
-		}
 		opts.Build = false
 		opts.PreDeployChecks = false
-
-		var err error
-		plan, err = deployplan.LoadPlanFromFile(opts.ReadPlanPath)
-		if err != nil {
-			logdiag.LogError(ctx, err)
-			return b, stateDesc, root.ErrAlreadyPrinted
-		}
-		currentVersion := build.GetInfo().Version
-		if plan.CLIVersion != currentVersion {
-			log.Warnf(ctx, "Plan was created with CLI version %s but current version is %s", plan.CLIVersion, currentVersion)
-		}
-
-		// Validate that the plan's lineage and serial match the current state
-		// This must happen before any file operations
-		err = direct.ValidatePlanAgainstState(&b.DeploymentBundle.StateDB, plan)
-		if err != nil {
-			logdiag.LogError(ctx, err)
-			return b, stateDesc, root.ErrAlreadyPrinted
-		}
 	} else if opts.Deploy {
 		opts.Build = true
 		opts.PreDeployChecks = true
@@ -289,15 +313,189 @@ func ProcessBundleRet(cmd *cobra.Command, opts ProcessOptions) (b *bundle.Bundle
 		}
 	}
 
+	// Resolve the deployment state after phases.Build, in one place, so the order reads
+	// build → migrate → open → (plan/deploy). Running the migration after the build lets
+	// its conversion and plan check see library and ${artifacts.*} references resolved by
+	// the build, and record resolved remote paths in the migrated state. Commands without
+	// a build phase (destroy, summary, ...) reach here with the build skipped, so migration
+	// and state opening still happen in this single block.
+	var plan *deployplan.Plan
+	if shouldReadState {
+		// needsState is narrower than shouldReadState: it drops the pull-only flags
+		// (ReadState, AlwaysPull) so read-only consumers like "bundle debug states" pull
+		// and display the state without triggering a migration, and adds PostStateFunc for
+		// commands that operate on the state (destroy, run). It gates migrating and opening
+		// the direct state.
+		needsState := opts.InitIDs || opts.ErrorOnEmptyState || opts.Deploy || opts.ReadPlanPath != "" || opts.PreDeployChecks || opts.PostStateFunc != nil
+
+		// Migrate a Terraform state to the direct engine: the direct engine is the only engine,
+		// so when the existing state still uses Terraform, convert it so the run proceeds on the
+		// direct engine. Migrate is in-memory and reversible - nothing is written or pushed - so
+		// plan, run, and a declined deploy just drop it; deploy makes it durable by calling
+		// CommitMigration after approval, destroy as part of its teardown. The Terraform engine
+		// was removed in v1.20.0, so a migration failure is fatal - there is no engine to fall
+		// back to. Read-only commands that do not need state keep reading the Terraform state.
+		if b.MigratingToDirect && needsState {
+			if err := migrateTerraformToDirect(ctx, b, stateDesc); err != nil {
+				logdiag.LogError(ctx, err)
+				return b, stateDesc, root.ErrAlreadyPrinted
+			}
+		}
+
+		// Tag the user agent with the engine this run actually uses. The tag is left unset
+		// after the pull on the auto-migration path (see above) because the engine is only
+		// final here, after the migration ran, was skipped, or fell back. Setting it once
+		// (rather than appending) avoids a stale engine/terraform tag alongside engine/direct.
+		if b.MigratingToDirect {
+			ctx = useragent.InContext(ctx, "engine", string(stateDesc.Engine))
+			cmd.SetContext(ctx)
+		}
+
+		// Open direct engine state once for all subsequent operations (ExportState, CalculatePlan, Apply, etc.)
+		// A migrated-from-Terraform state is already open (seeded in memory above), so skip the disk open.
+		needDirectState := stateDesc.Engine.IsDirect() && needsState
+		var localPath string
+		if needDirectState && !b.DeploymentBundle.StateDB.IsOpen() {
+			_, localPath = b.StateFilenameDirect(ctx)
+			if !stateDesc.IsDMS() {
+				if err := b.DeploymentBundle.StateDB.Open(ctx, localPath, dstate.WithRecovery(true), dstate.WithWrite(false), dstate.WithDeploymentHistory(false), dstate.OpenDmsArgs{}); err != nil {
+					logdiag.LogError(ctx, err)
+					return b, stateDesc, root.ErrAlreadyPrinted
+				}
+			}
+		}
+
+		if stateDesc.Engine.IsDirect() && !opts.SkipEnforcingDeploymentHistorySetting {
+			if err := enforceDeploymentHistorySetting(ctx, b, stateDesc, opts.Deploy || opts.PreDeployChecks); err != nil {
+				logdiag.LogError(ctx, err)
+				return b, stateDesc, root.ErrAlreadyPrinted
+			}
+		}
+
+		if needDirectState && stateDesc.IsDMS() {
+			var err error
+			dmsDeploymentID, dmsDeployment, err = fetchDeploymentFromStatePath(ctx, b.WorkspaceClient(ctx), b.Config.Workspace.StatePath)
+			if err != nil {
+				logdiag.LogError(ctx, err)
+				return b, stateDesc, root.ErrAlreadyPrinted
+			}
+
+			// Stamp the deployment and the version this run records onto every job and pipeline so
+			// the plan carries them. version_id is always known (last recorded + 1); deployment_id
+			// does not exist until a first deploy creates it, so it is left off here and the deploy
+			// phase stamps the created id.
+			lastVersionID, err := parseLastVersionID(dmsDeployment)
+			if err != nil {
+				logdiag.LogError(ctx, err)
+				return b, stateDesc, root.ErrAlreadyPrinted
+			}
+			nextVersion := lastVersionID + 1
+			muts := []bundle.Mutator{metadata.AnnotateDeploymentVersion(nextVersion)}
+			if dmsDeploymentID != "" {
+				bundle.ApplyFuncContext(ctx, b, func(_ context.Context, b *bundle.Bundle) {
+					b.Config.Bundle.Deployment.DeploymentID = dmsDeploymentID
+					b.Config.Bundle.Deployment.LatestVersionID = lastVersionID
+				})
+				muts = append(muts, metadata.AnnotateDeployment(dmsDeploymentID))
+			}
+			bundle.ApplySeqContext(ctx, b, muts...)
+			if logdiag.HasError(ctx) {
+				return b, stateDesc, root.ErrAlreadyPrinted
+			}
+			// StateDB.Open builds the DMS client from the workspace client on the context.
+			if !cmdctx.HasWorkspaceClient(ctx) {
+				ctx = cmdctx.SetWorkspaceClient(ctx, b.WorkspaceClient(ctx))
+			}
+			if err := b.DeploymentBundle.StateDB.Open(ctx, localPath, dstate.WithRecovery(false), dstate.WithWrite(false), dstate.WithDeploymentHistory(true), dstate.OpenDmsArgs{DeploymentID: dmsDeploymentID, LastVersionID: lastVersionID}); err != nil {
+				logdiag.LogError(ctx, err)
+				return b, stateDesc, root.ErrAlreadyPrinted
+			}
+		}
+
+		if needDirectState {
+			// Warn when the state was last written by a newer CLI than the one
+			// running now. The state schema version is a hard gate (dstate.Open
+			// rejects a too-new state_version), but a state can be written by a
+			// newer CLI that shares this schema; that is allowed, and this only
+			// hints that a downgrade may be unintended.
+			currentVersion := build.GetInfo().Version
+			if stateVersion := b.DeploymentBundle.StateDB.StateCLIVersion(); isNewerVersion(stateVersion, currentVersion) {
+				log.Warnf(ctx, "State was last deployed with CLI version %s but current version is %s", stateVersion, currentVersion)
+			}
+		}
+
+		// These are not safe in plan/deploy because they insert empty config settings for deleted resources.
+		if opts.InitIDs || opts.ErrorOnEmptyState {
+			var modes []statemgmt.LoadMode
+			if opts.ErrorOnEmptyState {
+				modes = append(modes, statemgmt.ErrorOnEmptyState)
+			}
+			mutators := []bundle.Mutator{
+				statemgmt.Load(b.DeploymentBundle.ExportState(ctx), modes...),
+			}
+			// InitializeURLs makes an extra API call; only run it when URLs are needed.
+			if opts.InitIDs {
+				mutators = append(mutators, mutator.InitializeURLs())
+			}
+			bundle.ApplySeqContext(ctx, b, mutators...)
+			if logdiag.HasError(ctx) {
+				return b, stateDesc, root.ErrAlreadyPrinted
+			}
+		}
+
+		// --plan: the engine is now known and the state is open, so validate and load the
+		// precomputed plan. Artifact uploads are handled inside Deploy by extracting remote
+		// paths from the plan's new_state and finding the matching local files.
+		if opts.ReadPlanPath != "" {
+			var err error
+			plan, err = deployplan.LoadPlanFromFile(opts.ReadPlanPath)
+			if err != nil {
+				logdiag.LogError(ctx, err)
+				return b, stateDesc, root.ErrAlreadyPrinted
+			}
+			currentVersion := build.GetInfo().Version
+			if plan.CLIVersion != currentVersion {
+				log.Warnf(ctx, "Plan was created with CLI version %s but current version is %s", plan.CLIVersion, currentVersion)
+			}
+
+			if err := direct.ValidatePlanAgainstState(&b.DeploymentBundle.StateDB, plan); err != nil {
+				logdiag.LogError(ctx, err)
+				return b, stateDesc, root.ErrAlreadyPrinted
+			}
+		}
+	}
+
 	if opts.PreDeployChecks {
 		downgradeWarningToError := !opts.Deploy
-		phases.PreDeployChecks(ctx, b, downgradeWarningToError, stateDesc.Engine)
+		phases.PreDeployChecks(ctx, b, downgradeWarningToError)
 
 		if logdiag.HasError(ctx) {
 			return b, stateDesc, root.ErrAlreadyPrinted
 		}
 	}
 
+	// The predeploy script can generate or rewrite files that on_file_change
+	// watches, so it has to run before those files are fingerprinted below. It
+	// stays ahead of the deployment lock, as it was when phases.Deploy ran it.
+	if opts.Deploy {
+		bundle.ApplyContext(ctx, b, scripts.Execute(config.ScriptPreDeploy))
+		if logdiag.HasError(ctx) {
+			return b, stateDesc, root.ErrAlreadyPrinted
+		}
+	}
+
+	// Fingerprint on_file_change triggers once, after every step that can produce
+	// a watched file: build and the predeploy script. Reads the sync root that
+	// phases.Initialize resolves, so it is skipped along with it; `bundle deploy
+	// --plan` recomputes fingerprints that the loaded plan then overrides with the
+	// ones it recorded.
+	if !opts.SkipInitialize {
+		bundle.ApplyContext(ctx, b, mutator.ResolveJobRunFileTriggers())
+		if logdiag.HasError(ctx) {
+			return b, stateDesc, root.ErrAlreadyPrinted
+		}
+	}
+
 	if opts.Deploy {
 		var outputHandler sync.OutputHandler
 		if opts.Verbose {
@@ -307,7 +505,7 @@ func ProcessBundleRet(cmd *cobra.Command, opts ProcessOptions) (b *bundle.Bundle
 		}
 
 		t3 := time.Now()
-		phases.Deploy(ctx, b, outputHandler, stateDesc.Engine, libs, plan)
+		phases.Deploy(ctx, b, outputHandler, libs, plan, dmsDeployment)
 		b.Metrics.ExecutionTimes = append(b.Metrics.ExecutionTimes, protos.IntMapEntry{
 			Key:   "phases.Deploy",
 			Value: time.Since(t3).Milliseconds(),
@@ -317,7 +515,10 @@ func ProcessBundleRet(cmd *cobra.Command, opts ProcessOptions) (b *bundle.Bundle
 			return b, stateDesc, root.ErrAlreadyPrinted
 		}
 
-		if b != nil && stateDesc != nil && stateDesc.Engine.IsDirect() && stateDesc.HasRemoteTerraformState() {
+		// A migrating deploy already backed up terraform.tfstate when it committed the
+		// converted state above; this handles a plain direct deploy that still finds a
+		// lingering remote terraform state.
+		if b != nil && stateDesc != nil && !b.MigratingToDirect && stateDesc.HasRemoteTerraformState() {
 			statemgmt.BackupRemoteTerraformState(ctx, b)
 
 			if logdiag.HasError(ctx) {
@@ -335,30 +536,187 @@ func ProcessBundleRet(cmd *cobra.Command, opts ProcessOptions) (b *bundle.Bundle
 	return b, stateDesc, nil
 }
 
-// ResolveEngineSetting determines the effective engine setting by combining bundle config and env var.
-// Priority: bundle.engine config > DATABRICKS_BUNDLE_ENGINE env var.
-func ResolveEngineSetting(ctx context.Context, b *bundle.Bundle) (engine.EngineSetting, error) {
+// migrateTerraformToDirect converts the bundle's Terraform state to the direct engine in memory.
+// On success it advances stateDesc and metrics to the direct engine. Any failure (parse,
+// conversion, plan check) is fatal and returns an error: the Terraform engine was removed, so there
+// is no engine to fall back to. Nothing is committed here - deploy calls statemgmt.CommitMigration
+// after approval, destroy commits as part of its teardown. The caller tags the user agent with the
+// resolved stateDesc.Engine afterwards.
+func migrateTerraformToDirect(ctx context.Context, b *bundle.Bundle, stateDesc *statemgmt.StateDesc) error {
+	migrated, err := statemgmt.Migrate(ctx, b)
+	if err != nil {
+		return fmt.Errorf("migrating Terraform state to the direct engine: %w", err)
+	}
+	if migrated {
+		stateDesc.Engine = engine.EngineDirect
+		b.Metrics.StateEngine = engine.EngineDirect
+	}
+	return nil
+}
+
+// ValidateEngineSetting rejects an invalid or removed engine setting. The direct
+// engine is the only one, so a valid setting needs no further resolution.
+// bundle.engine takes priority over DATABRICKS_BUNDLE_ENGINE: when it is set, the
+// env var is not checked.
+func ValidateEngineSetting(ctx context.Context, b *bundle.Bundle) error {
 	configEngine := b.Config.Bundle.Engine
 
 	if configEngine != engine.EngineNotSet {
-		source := "bundle.engine setting"
-		v := dyn.GetValue(b.Config.Value(), "bundle.engine")
-		if locs := v.Locations(); len(locs) > 0 {
-			loc := locs[0]
-			source = fmt.Sprintf("bundle.engine setting at %s:%d:%d", filepath.ToSlash(loc.File), loc.Line, loc.Column)
+		parsed, ok := engine.Parse(string(configEngine))
+		if !ok {
+			return fmt.Errorf("invalid value %q for bundle.engine (expected %q)", configEngine, engine.EngineDirect)
+		}
+		if parsed == engine.EngineTerraform && !b.AllowTerraformEngineConfig {
+			return errors.New(engine.TerraformRemovedConfigMessage)
 		}
-		return engine.EngineSetting{Type: configEngine, Source: source, ConfigType: configEngine}, nil
+		return nil
+	}
+
+	if b.AllowTerraformEngineConfig {
+		return nil
 	}
 
 	envEngine, err := engine.FromEnv(ctx)
 	if err != nil {
-		return engine.EngineSetting{}, err
+		return err
+	}
+	if envEngine == engine.EngineTerraform {
+		return errors.New(engine.TerraformRemovedEnvMessage)
+	}
+	return nil
+}
+
+// Lookup and return the deployment object from ${workspace.state_path}/resources.deployment.json
+//
+// TODO: a deployment is only usable when both the node and the service's record exist, and a
+// half-created one - node present, record missing - blocks the bundle here even though
+// CreateDeployment already recovers from it. Move this behind a dms.ReadDeployment(ctx, statePath)
+// that returns an empty id and version unless both halves are there, leaving the caller to call
+// CreateDeployment to create or finalize it.
+//
+// TODO: ask the service for a lookup by state path, so this is one round trip rather than two - a
+// workspace lookup to turn the node into an id, then a get by that id.
+func fetchDeploymentFromStatePath(ctx context.Context, w *databricks.WorkspaceClient, statePath string) (string, *bundledeployments.Deployment, error) {
+	nodePath := path.Join(statePath, dms.DeploymentNodeName)
+
+	obj, err := retry.With(ctx, retry.IsTransientRead, func() (*workspace.ObjectInfo, error) {
+		return w.Workspace.GetStatusByPath(ctx, nodePath)
+	})
+	if errors.Is(err, apierr.ErrNotFound) || errors.Is(err, apierr.ErrResourceDoesNotExist) {
+		return "", nil, nil
+	}
+	if err != nil {
+		return "", nil, fmt.Errorf("looking up deployment at %s: %w", nodePath, err)
 	}
-	if envEngine != engine.EngineNotSet {
-		return engine.EngineSetting{Type: envEngine, Source: engine.EnvVar + " environment variable"}, nil
+	deploymentID := strconv.FormatInt(obj.ObjectId, 10)
+	deployment, err := retry.With(ctx, retry.IsTransientRead, func() (*bundledeployments.Deployment, error) {
+		return w.BundleDeployments.GetDeployment(ctx, bundledeployments.GetDeploymentRequest{
+			Name: dms.DeploymentName(deploymentID),
+		})
+	})
+	if err != nil {
+		return "", nil, err
 	}
+	return deploymentID, deployment, nil
+}
 
-	return engine.EngineSetting{}, nil
+// parseLastVersionID parses the deployment's last recorded version, which the service reports
+// as a string. It returns 0 when the deployment does not exist yet or has no recorded version.
+func parseLastVersionID(dmsDeployment *bundledeployments.Deployment) (int, error) {
+	if dmsDeployment == nil || dmsDeployment.LastVersionId == "" {
+		return 0, nil
+	}
+	v, err := strconv.Atoi(dmsDeployment.LastVersionId)
+	if err != nil {
+		return 0, fmt.Errorf("failed to parse last_version_id %q: %w", dmsDeployment.LastVersionId, err)
+	}
+	return v, nil
+}
+
+// OpenDirectStateForRead opens the direct-engine state database read-only. When the bundle
+// records deployment history the local state file is only a tombstone, so the resources are
+// read from the deployment metadata service instead.
+func OpenDirectStateForRead(ctx context.Context, b *bundle.Bundle, stateDesc *statemgmt.StateDesc) error {
+	_, localPath := b.StateFilenameDirect(ctx)
+	if !resolveDeploymentHistory(ctx, b, stateDesc) {
+		if err := b.DeploymentBundle.StateDB.Open(ctx, localPath, dstate.WithRecovery(true), dstate.WithWrite(false), dstate.WithDeploymentHistory(false), dstate.OpenDmsArgs{}); err != nil {
+			return err
+		}
+		return enforceDeploymentHistorySetting(ctx, b, stateDesc, false)
+	}
+
+	dmsDeploymentID, dmsDeployment, err := fetchDeploymentFromStatePath(ctx, b.WorkspaceClient(ctx), b.Config.Workspace.StatePath)
+	if err != nil {
+		return err
+	}
+	lastVersionID, err := parseLastVersionID(dmsDeployment)
+	if err != nil {
+		return err
+	}
+	// StateDB.Open builds the DMS client from the workspace client on the context, so ensure one is set.
+	if !cmdctx.HasWorkspaceClient(ctx) {
+		ctx = cmdctx.SetWorkspaceClient(ctx, b.WorkspaceClient(ctx))
+	}
+	if err := b.DeploymentBundle.StateDB.Open(ctx, localPath, dstate.WithRecovery(false), dstate.WithWrite(false), dstate.WithDeploymentHistory(true), dstate.OpenDmsArgs{DeploymentID: dmsDeploymentID, LastVersionID: lastVersionID}); err != nil {
+		return err
+	}
+	return enforceDeploymentHistorySetting(ctx, b, stateDesc, false)
+}
+
+func resolveDeploymentHistory(ctx context.Context, b *bundle.Bundle, stateDesc *statemgmt.StateDesc) bool {
+	configured := configuresDeploymentHistory(ctx, b)
+	if stateDesc.SourcePath == "" {
+		if configured {
+			stateDesc.Features = map[string]struct{}{dstate.FeatureDeploymentHistory: {}}
+		}
+		return configured
+	}
+
+	return stateDesc.IsDMS()
+}
+
+func enforceDeploymentHistorySetting(ctx context.Context, b *bundle.Bundle, stateDesc *statemgmt.StateDesc, requireMatch bool) error {
+	if stateDesc.SourcePath == "" {
+		return nil
+	}
+	configured := configuresDeploymentHistory(ctx, b)
+	recorded := stateDesc.IsDMS()
+	if configured == recorded {
+		return nil
+	}
+	if requireMatch {
+		return fmt.Errorf(`deployment history setting (%t) does not match the existing state (%t)
+
+Update experimental.deployment_history to match the existing deployment, or run "databricks bundle destroy" to start over`, configured, recorded)
+	}
+	if configured {
+		return errors.New(`enabling experimental.deployment_history for an existing deployment is not supported
+
+Run "databricks bundle destroy" first, then deploy again with deployment history enabled`)
+	}
+	log.Warnf(ctx, "Deployment history setting (%t) does not match the existing state (%t). Using the existing state.", configured, recorded)
+	return nil
+}
+
+func configuresDeploymentHistory(ctx context.Context, b *bundle.Bundle) bool {
+	var configured *bool
+	if b.Config.Experimental != nil {
+		configured = b.Config.Experimental.DeploymentHistory
+	}
+	return bundleenv.RecordsDeploymentHistory(ctx, configured)
+}
+
+// isNewerVersion reports whether the state's recorded CLI version is strictly
+// newer than the running build. Both are bare versions without a leading "v".
+// An empty stateVersion (state not written by any CLI yet) or an unparseable
+// version returns false, so we never warn on missing or malformed data.
+func isNewerVersion(stateVersion, currentVersion string) bool {
+	sv := "v" + stateVersion
+	cv := "v" + currentVersion
+	if !semver.IsValid(sv) || !semver.IsValid(cv) {
+		return false
+	}
+	return semver.Compare(sv, cv) > 0
 }
 
 func rejectDefinitions(ctx context.Context, b *bundle.Bundle) {
@@ -374,3 +732,16 @@ Pipelines CLI currently only supports Lakeflow Spark Declarative Pipelines devel
 To see an example of a supported pipelines template, create a new Pipelines CLI project with "pipelines init".`))
 	}
 }
+
+// WithLineage tags the user agent and the command's telemetry with the hashed state
+// lineage, so requests and events from different CLI invocations against the same
+// deployment can be correlated. Before the first deploy there is no lineage and nothing
+// is added.
+func WithLineage(ctx context.Context, stateDesc *statemgmt.StateDesc) context.Context {
+	lineage := stateDesc.LineageHash()
+	if lineage == "" {
+		return ctx
+	}
+	telemetry.SetStateLineageHash(ctx, lineage)
+	return useragent.InContext(ctx, "lineage", lineage)
+}
diff --git a/cmd/bundle/utils/process_test.go b/cmd/bundle/utils/process_test.go
new file mode 100644
index 00000000000..b216f1102d2
--- /dev/null
+++ b/cmd/bundle/utils/process_test.go
@@ -0,0 +1,93 @@
+package utils
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/direct/dstate"
+	"github.com/databricks/cli/bundle/statemgmt"
+	"github.com/databricks/databricks-sdk-go/service/bundledeployments"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestResolveDeploymentHistory(t *testing.T) {
+	b := &bundle.Bundle{Config: config.Root{
+		Experimental: &config.Experimental{DeploymentHistory: new(true)},
+	}}
+
+	newState := &statemgmt.StateDesc{}
+	assert.True(t, resolveDeploymentHistory(t.Context(), b, newState))
+	assert.True(t, newState.IsDMS())
+	assert.False(t, resolveDeploymentHistory(t.Context(), b, &statemgmt.StateDesc{SourcePath: "resources.json"}))
+	b.Config.Experimental.DeploymentHistory = new(false)
+	assert.True(t, resolveDeploymentHistory(t.Context(), b, &statemgmt.StateDesc{
+		SourcePath: "resources.json",
+		Features:   map[string]struct{}{dstate.FeatureDeploymentHistory: {}},
+	}))
+}
+
+func TestIsNewerVersion(t *testing.T) {
+	tests := []struct {
+		name    string
+		state   string
+		current string
+		want    bool
+	}{
+		{"state newer major", "1.0.0", "0.300.0", true},
+		{"state newer minor", "0.301.0", "0.300.0", true},
+		{"state newer patch", "0.300.1", "0.300.0", true},
+		{"same version", "0.300.0", "0.300.0", false},
+		{"state older", "0.299.0", "0.300.0", false},
+		// A dev build is built from main, so its version is the next release with a
+		// -dev prerelease: newer than the last release, older than the release it
+		// will become. Deploying with a dev build after a state written by the last
+		// release is the normal case for a CLI developer and must not warn.
+		{"state from last release, dev current", "0.300.0", "0.301.0-dev+abc123", false},
+		// A released CLI reading a state written by a dev build of the same upcoming
+		// release does warn: that build may have written fields this CLI lacks.
+		{"dev state, released current", "0.301.0-dev+abc123", "0.300.0", true},
+		// A prerelease sorts below its own release per semver.
+		{"prerelease below release", "0.300.0-rc1", "0.300.0", false},
+		{"release above prerelease", "0.300.0", "0.300.0-rc1", true},
+		// Missing or malformed data must never produce a warning.
+		{"empty state version", "", "0.300.0", false},
+		{"empty current version", "0.300.0", "", false},
+		{"malformed state version", "not-a-version", "0.300.0", false},
+		{"malformed current version", "0.300.0", "not-a-version", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, isNewerVersion(tt.state, tt.current))
+		})
+	}
+}
+
+func TestParseLastVersionID(t *testing.T) {
+	tests := []struct {
+		name       string
+		deployment *bundledeployments.Deployment
+		want       int
+		wantErr    bool
+	}{
+		{"nil deployment", nil, 0, false},
+		{"empty version", &bundledeployments.Deployment{}, 0, false},
+		{"version zero", &bundledeployments.Deployment{LastVersionId: "0"}, 0, false},
+		{"valid version", &bundledeployments.Deployment{LastVersionId: "7"}, 7, false},
+		{"invalid version", &bundledeployments.Deployment{LastVersionId: "abc"}, 0, true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := parseLastVersionID(tt.deployment)
+			if tt.wantErr {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
diff --git a/cmd/bundle/utils/resolve_engine_test.go b/cmd/bundle/utils/resolve_engine_test.go
deleted file mode 100644
index feca507433a..00000000000
--- a/cmd/bundle/utils/resolve_engine_test.go
+++ /dev/null
@@ -1,52 +0,0 @@
-package utils
-
-import (
-	"testing"
-
-	"github.com/databricks/cli/bundle"
-	"github.com/databricks/cli/bundle/config"
-	"github.com/databricks/cli/bundle/config/engine"
-	"github.com/databricks/cli/libs/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestResolveEngineSettingConfigTakesPriority(t *testing.T) {
-	ctx := env.Set(t.Context(), engine.EnvVar, "terraform")
-	b := &bundle.Bundle{Config: config.Root{Bundle: config.Bundle{Engine: engine.EngineDirect}}}
-	result, err := ResolveEngineSetting(ctx, b)
-	require.NoError(t, err)
-	assert.Equal(t, engine.EngineDirect, result.Type)
-	assert.Equal(t, engine.EngineDirect, result.ConfigType)
-}
-
-func TestResolveEngineSettingEnvVarUsedWhenNoConfig(t *testing.T) {
-	ctx := env.Set(t.Context(), engine.EnvVar, "direct")
-	b := &bundle.Bundle{Config: config.Root{}}
-	result, err := ResolveEngineSetting(ctx, b)
-	require.NoError(t, err)
-	assert.Equal(t, engine.EngineDirect, result.Type)
-	assert.Contains(t, result.Source, engine.EnvVar)
-}
-
-func TestResolveEngineSettingNothingSet(t *testing.T) {
-	b := &bundle.Bundle{Config: config.Root{}}
-	result, err := ResolveEngineSetting(t.Context(), b)
-	require.NoError(t, err)
-	assert.Equal(t, engine.EngineNotSet, result.Type)
-}
-
-func TestResolveEngineSettingInvalidEnvVar(t *testing.T) {
-	ctx := env.Set(t.Context(), engine.EnvVar, "invalid")
-	b := &bundle.Bundle{Config: config.Root{}}
-	_, err := ResolveEngineSetting(ctx, b)
-	assert.Error(t, err)
-}
-
-func TestResolveEngineSettingInvalidEnvVarIgnoredWhenConfigSet(t *testing.T) {
-	ctx := env.Set(t.Context(), engine.EnvVar, "invalid")
-	b := &bundle.Bundle{Config: config.Root{Bundle: config.Bundle{Engine: engine.EngineDirect}}}
-	result, err := ResolveEngineSetting(ctx, b)
-	require.NoError(t, err)
-	assert.Equal(t, engine.EngineDirect, result.Type)
-}
diff --git a/cmd/bundle/utils/utils.go b/cmd/bundle/utils/utils.go
index 3c4bd1a5b98..6b7b5cbc6c9 100644
--- a/cmd/bundle/utils/utils.go
+++ b/cmd/bundle/utils/utils.go
@@ -8,6 +8,23 @@ import (
 	"github.com/spf13/cobra"
 )
 
+// SetForceLock applies the --force-lock flag to the bundle configuration.
+//
+// The flag must only override bundle.deployment.lock.force when the user passed
+// it explicitly. InitFunc runs after the configuration is loaded, so assigning
+// unconditionally would let the flag's default of false clobber a force: true
+// set in databricks.yml. Commands that share this code path without registering
+// the flag (bundle generate, which binds with forcing disabled) leave the
+// configured value untouched.
+func SetForceLock(cmd *cobra.Command, b *bundle.Bundle, forceLock bool) {
+	flag := cmd.Flags().Lookup("force-lock")
+	if flag == nil || !flag.Changed {
+		return
+	}
+
+	b.Config.Bundle.Deployment.Lock.Force = forceLock
+}
+
 func configureVariables(cmd *cobra.Command, b *bundle.Bundle, variables []string) {
 	bundle.ApplyFuncContext(cmd.Context(), b, func(ctx context.Context, b *bundle.Bundle) {
 		err := b.Config.InitializeVariables(variables)
diff --git a/cmd/bundle/utils/utils_test.go b/cmd/bundle/utils/utils_test.go
new file mode 100644
index 00000000000..3aac3182bc2
--- /dev/null
+++ b/cmd/bundle/utils/utils_test.go
@@ -0,0 +1,71 @@
+package utils
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSetForceLock(t *testing.T) {
+	tests := []struct {
+		name         string
+		args         []string
+		registerFlag bool
+		configured   bool
+		forceLock    bool
+		expected     bool
+	}{
+		{
+			name:         "flag set to true overrides configured false",
+			args:         []string{"--force-lock"},
+			registerFlag: true,
+			forceLock:    true,
+			expected:     true,
+		},
+		{
+			name:         "flag set to false overrides configured true",
+			args:         []string{"--force-lock=false"},
+			registerFlag: true,
+			configured:   true,
+			expected:     false,
+		},
+		{
+			name:         "unset flag preserves configured true",
+			registerFlag: true,
+			configured:   true,
+			expected:     true,
+		},
+		{
+			name:         "unset flag leaves configured false alone",
+			registerFlag: true,
+			expected:     false,
+		},
+		{
+			name:       "unregistered flag preserves configured true",
+			configured: true,
+			expected:   true,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			cmd := &cobra.Command{Use: "deploy"}
+			var forceLock bool
+			if tc.registerFlag {
+				cmd.Flags().BoolVar(&forceLock, "force-lock", false, "")
+			}
+			require.NoError(t, cmd.ParseFlags(tc.args))
+
+			b := &bundle.Bundle{Config: config.Root{}}
+			b.Config.Bundle.Deployment.Lock.Force = tc.configured
+
+			SetForceLock(cmd, b, tc.forceLock)
+
+			assert.Equal(t, tc.expected, b.Config.Bundle.Deployment.Lock.Force)
+		})
+	}
+}
diff --git a/cmd/bundle/utils/validate_engine_test.go b/cmd/bundle/utils/validate_engine_test.go
new file mode 100644
index 00000000000..0c284012bad
--- /dev/null
+++ b/cmd/bundle/utils/validate_engine_test.go
@@ -0,0 +1,58 @@
+package utils
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/config/engine"
+	"github.com/databricks/cli/libs/env"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestValidateEngineSettingConfigTakesPriority(t *testing.T) {
+	ctx := env.Set(t.Context(), engine.EnvVar, "terraform")
+	b := &bundle.Bundle{Config: config.Root{Bundle: config.Bundle{Engine: engine.EngineDirect}}}
+	assert.NoError(t, ValidateEngineSetting(ctx, b))
+}
+
+func TestValidateEngineSettingEnvVarDirect(t *testing.T) {
+	ctx := env.Set(t.Context(), engine.EnvVar, "direct")
+	b := &bundle.Bundle{Config: config.Root{}}
+	assert.NoError(t, ValidateEngineSetting(ctx, b))
+}
+
+func TestValidateEngineSettingNothingSet(t *testing.T) {
+	b := &bundle.Bundle{Config: config.Root{}}
+	assert.NoError(t, ValidateEngineSetting(t.Context(), b))
+}
+
+func TestValidateEngineSettingInvalidConfig(t *testing.T) {
+	b := &bundle.Bundle{Config: config.Root{Bundle: config.Bundle{Engine: "invalid"}}}
+	assert.EqualError(t, ValidateEngineSetting(t.Context(), b), `invalid value "invalid" for bundle.engine (expected "direct")`)
+}
+
+func TestValidateEngineSettingInvalidEnvVar(t *testing.T) {
+	ctx := env.Set(t.Context(), engine.EnvVar, "invalid")
+	b := &bundle.Bundle{Config: config.Root{}}
+	assert.Error(t, ValidateEngineSetting(ctx, b))
+}
+
+func TestValidateEngineSettingInvalidEnvVarIgnoredWhenConfigSet(t *testing.T) {
+	ctx := env.Set(t.Context(), engine.EnvVar, "invalid")
+	b := &bundle.Bundle{Config: config.Root{Bundle: config.Bundle{Engine: engine.EngineDirect}}}
+	assert.NoError(t, ValidateEngineSetting(ctx, b))
+}
+
+func TestValidateEngineSettingTerraformEnvVar(t *testing.T) {
+	ctx := env.Set(t.Context(), engine.EnvVar, "terraform")
+	b := &bundle.Bundle{Config: config.Root{}}
+	assert.EqualError(t, ValidateEngineSetting(ctx, b), engine.TerraformRemovedEnvMessage)
+}
+
+func TestValidateEngineSettingTerraformConfig(t *testing.T) {
+	// The config takes priority, so it is the setting to remove even if the env var also says terraform.
+	ctx := env.Set(t.Context(), engine.EnvVar, "terraform")
+	b := &bundle.Bundle{Config: config.Root{Bundle: config.Bundle{Engine: engine.EngineTerraform}}}
+	assert.EqualError(t, ValidateEngineSetting(ctx, b), engine.TerraformRemovedConfigMessage)
+}
diff --git a/cmd/bundle/validate.go b/cmd/bundle/validate.go
index a2ec31f721b..d28f4ab8d3b 100644
--- a/cmd/bundle/validate.go
+++ b/cmd/bundle/validate.go
@@ -2,12 +2,15 @@ package bundle
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/direct/dresources"
 	"github.com/databricks/cli/bundle/render"
 	"github.com/databricks/cli/cmd/bundle/utils"
 	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/dyn/convert"
 	"github.com/databricks/cli/libs/flags"
 	"github.com/databricks/cli/libs/logdiag"
 	"github.com/spf13/cobra"
@@ -17,7 +20,15 @@ func renderJsonOutput(cmd *cobra.Command, b *bundle.Bundle) error {
 	if b == nil {
 		return nil
 	}
-	buf, err := json.MarshalIndent(b.Config.Value().AsAny(), "", "  ")
+	redactedRoot, err := dresources.RedactSensitiveConfigValues(&b.Config)
+	if err != nil {
+		return err
+	}
+	converted, err := convert.FromTyped(redactedRoot, b.Config.Value())
+	if err != nil {
+		return err
+	}
+	buf, err := json.MarshalIndent(converted.AsAny(), "", "  ")
 	if err != nil {
 		return err
 	}
@@ -57,7 +68,7 @@ Please run this command before deploying to ensure configuration quality.`,
 		})
 		ctx := cmd.Context()
 
-		if err != nil && err != root.ErrAlreadyPrinted {
+		if err != nil && !errors.Is(err, root.ErrAlreadyPrinted) {
 			logdiag.LogError(ctx, err)
 			err = root.ErrAlreadyPrinted
 		}
@@ -87,7 +98,7 @@ Please run this command before deploying to ensure configuration quality.`,
 			} else {
 				prefix = fmt.Sprintf("%d warnings were found", numWarnings)
 			}
-			return fmt.Errorf("%s. Warnings are not allowed in strict mode", prefix)
+			return fmt.Errorf("%s. Warnings are treated as errors in strict mode", prefix)
 		}
 
 		return err
diff --git a/cmd/cmd.go b/cmd/cmd.go
index 014471f7638..7888af65068 100644
--- a/cmd/cmd.go
+++ b/cmd/cmd.go
@@ -4,6 +4,8 @@ import (
 	"context"
 	"strings"
 
+	aircmd "github.com/databricks/cli/cmd/air"
+	aitoolscmd "github.com/databricks/cli/cmd/aitools"
 	"github.com/databricks/cli/cmd/psql"
 	ssh "github.com/databricks/cli/experimental/ssh/cmd"
 
@@ -18,7 +20,9 @@ import (
 	"github.com/databricks/cli/cmd/fs"
 	"github.com/databricks/cli/cmd/labs"
 	"github.com/databricks/cli/cmd/pipelines"
+	"github.com/databricks/cli/cmd/quickstart"
 	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/cmd/sandbox"
 	"github.com/databricks/cli/cmd/selftest"
 	"github.com/databricks/cli/cmd/sync"
 	"github.com/databricks/cli/cmd/version"
@@ -33,9 +37,18 @@ const (
 )
 
 // configureGroups adds groups to the command, only if a group
-// has at least one available command.
+// has at least one available command. When only one group survives
+// filtering, the grouping is dropped so Cobra's default "Available
+// Commands" heading is used — matching commands that don't define
+// groups at all.
 func configureGroups(cmd *cobra.Command, groups []cobra.Group) {
 	filteredGroups := cmdgroup.FilterGroups(groups, cmd.Commands())
+	if len(filteredGroups) <= 1 {
+		for _, sub := range cmd.Commands() {
+			sub.GroupID = ""
+		}
+		return
+	}
 	for i := range filteredGroups {
 		cmd.AddGroup(&filteredGroups[i])
 	}
@@ -77,7 +90,7 @@ func New(ctx context.Context) *cobra.Command {
 		groups := []cobra.Group{
 			{
 				ID:    mainGroup,
-				Title: "Available Commands",
+				Title: "Main Commands",
 			},
 			{
 				ID:    pipelines.ManagementGroupID,
@@ -93,6 +106,8 @@ func New(ctx context.Context) *cobra.Command {
 	}
 
 	// Add other subcommands.
+	cli.AddCommand(aircmd.New())
+	cli.AddCommand(aitoolscmd.NewAitoolsCmd())
 	cli.AddCommand(api.New())
 	cli.AddCommand(auth.New())
 	cli.AddCommand(completion.New())
@@ -103,8 +118,10 @@ func New(ctx context.Context) *cobra.Command {
 	cli.AddCommand(configure.New())
 	cli.AddCommand(fs.New())
 	cli.AddCommand(labs.New(ctx))
+	cli.AddCommand(sandbox.New())
 	cli.AddCommand(sync.New())
 	cli.AddCommand(version.New())
+	cli.AddCommand(quickstart.New())
 	cli.AddCommand(selftest.New())
 	cli.AddCommand(ssh.New())
 
diff --git a/cmd/configure/configure.go b/cmd/configure/configure.go
index 489e4e3050b..35ffad26d83 100644
--- a/cmd/configure/configure.go
+++ b/cmd/configure/configure.go
@@ -120,11 +120,18 @@ The host must be specified with the --host flag or the DATABRICKS_HOST environme
 		}
 
 		// Populate configuration from flags (if set).
+		// The profile flag is the root persistent flag.
 		if flags.Host != "" {
 			cfg.Host = normalizeHost(flags.Host)
 		}
-		if flags.Profile != "" {
-			cfg.Profile = flags.Profile
+		if profile := cmd.Flag("profile").Value.String(); profile != "" {
+			cfg.Profile = profile
+		}
+
+		// The profile name must be non-empty: SaveToProfile matches sections
+		// by host instead of by name when cfg.Profile is empty.
+		if cfg.Profile == "" {
+			cfg.Profile = "DEFAULT"
 		}
 
 		// Normalize and verify that the host is valid (if set).
diff --git a/cmd/configure/configure_test.go b/cmd/configure/configure_test.go
index bd99e6cbe79..3f3d7ea8633 100644
--- a/cmd/configure/configure_test.go
+++ b/cmd/configure/configure_test.go
@@ -27,6 +27,7 @@ func setup(t *testing.T) string {
 	}
 	t.Setenv(homeEnvVar, tempHomeDir)
 	t.Setenv("DATABRICKS_CONFIG_FILE", "")
+	t.Setenv("DATABRICKS_CONFIG_PROFILE", "")
 	t.Setenv("DATABRICKS_TOKEN", "")
 	return tempHomeDir
 }
@@ -180,6 +181,65 @@ func TestEnvVarsConfigureNoArgsNoInteractive(t *testing.T) {
 	assertKeyValueInSection(t, defaultSection, "token", "secret")
 }
 
+func TestEnvProfileConfigureNoInteractive(t *testing.T) {
+	ctx := t.Context()
+	tempHomeDir := setup(t)
+	cfgPath := filepath.Join(tempHomeDir, ".databrickscfg")
+	inp := getTempFileWithContent(t, tempHomeDir, "token\n")
+	defer inp.Close()
+	oldStdin := os.Stdin
+	t.Cleanup(func() { os.Stdin = oldStdin })
+	os.Stdin = inp
+
+	t.Setenv("DATABRICKS_CONFIG_PROFILE", "FROM-ENV")
+
+	cmd := cmd.New(ctx)
+	cmd.SetArgs([]string{"configure", "--token", "--host", "https://host"})
+
+	err := root.Execute(ctx, cmd)
+	assert.NoError(t, err)
+
+	cfg, err := ini.Load(cfgPath)
+	assert.NoError(t, err)
+
+	section, err := cfg.GetSection("FROM-ENV")
+	assert.NoError(t, err)
+
+	assertKeyValueInSection(t, section, "host", "https://host")
+	assertKeyValueInSection(t, section, "token", "token")
+}
+
+func TestProfileShorthandOverridesEnvConfigureNoInteractive(t *testing.T) {
+	ctx := t.Context()
+	tempHomeDir := setup(t)
+	cfgPath := filepath.Join(tempHomeDir, ".databrickscfg")
+	inp := getTempFileWithContent(t, tempHomeDir, "token\n")
+	defer inp.Close()
+	oldStdin := os.Stdin
+	t.Cleanup(func() { os.Stdin = oldStdin })
+	os.Stdin = inp
+
+	t.Setenv("DATABRICKS_CONFIG_PROFILE", "FROM-ENV")
+
+	cmd := cmd.New(ctx)
+	cmd.SetArgs([]string{"configure", "--token", "--host", "https://host", "-p", "FROM-FLAG"})
+
+	err := root.Execute(ctx, cmd)
+	assert.NoError(t, err)
+
+	cfg, err := ini.Load(cfgPath)
+	assert.NoError(t, err)
+
+	section, err := cfg.GetSection("FROM-FLAG")
+	assert.NoError(t, err)
+
+	assertKeyValueInSection(t, section, "host", "https://host")
+	assertKeyValueInSection(t, section, "token", "token")
+
+	_, err = cfg.GetSection("FROM-ENV")
+	assert.Error(t, err)
+}
+
 func TestCustomProfileConfigureNoInteractive(t *testing.T) {
 	ctx := t.Context()
 	tempHomeDir := setup(t)
diff --git a/cmd/configure/flags.go b/cmd/configure/flags.go
index 80e65026890..f4820271c6f 100644
--- a/cmd/configure/flags.go
+++ b/cmd/configure/flags.go
@@ -5,8 +5,7 @@ import (
 )
 
 type configureFlags struct {
-	Host    string
-	Profile string
+	Host string
 
 	// Flag to request a prompt for cluster configuration.
 	ConfigureCluster bool
@@ -15,7 +14,6 @@ type configureFlags struct {
 // Register flags with command.
 func (f *configureFlags) Register(cmd *cobra.Command) {
 	cmd.Flags().StringVar(&f.Host, "host", "", "Databricks workspace host.")
-	cmd.Flags().StringVar(&f.Profile, "profile", "DEFAULT", "Name for the connection profile to configure.")
 	cmd.Flags().BoolVar(&f.ConfigureCluster, "configure-cluster", false, "Prompts to configure cluster")
 
 	// Include token flag for compatibility with the legacy CLI.
diff --git a/cmd/environments/compute.go b/cmd/environments/compute.go
new file mode 100644
index 00000000000..d0b82ba4e52
--- /dev/null
+++ b/cmd/environments/compute.go
@@ -0,0 +1,202 @@
+package environments
+
+import (
+	"context"
+	"fmt"
+	"strconv"
+	"strings"
+
+	localenv "github.com/databricks/cli/libs/localenv"
+	databricks "github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/service/compute"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+)
+
+// sdkCompute adapts the Databricks SDK to the localenv.ComputeClient interface.
+type sdkCompute struct {
+	w *databricks.WorkspaceClient
+}
+
+// GetClusterSparkVersion returns the Spark version string for a running cluster.
+func (c sdkCompute) GetClusterSparkVersion(ctx context.Context, clusterID string) (string, error) {
+	d, err := c.w.Clusters.GetByClusterId(ctx, clusterID)
+	if err != nil {
+		return "", fmt.Errorf("get cluster %s: %w", clusterID, err)
+	}
+	return d.SparkVersion, nil
+}
+
+// GetClusterByName resolves a cluster name to its ID and Spark version.
+//
+// It intentionally does not use the SDK's GetByClusterName, which lists clusters
+// in every state and errors on any name collision: a terminated cluster sharing
+// a name with a live one would then block resolution for a name the user
+// reasonably considers unique. Instead we list only non-terminated clusters and
+// match by name. A name that is still ambiguous among live clusters, or matches
+// none, is a genuine error surfaced to the caller as an actionable E_RESOLVE.
+//
+// The clusters/list API omits clusters terminated more than 30 days ago, so a
+// name that only ever belonged to such a cluster resolves as "no active cluster
+// named"; this is acceptable since a long-terminated cluster is not a usable
+// target and the user can always pass --cluster-id.
+func (c sdkCompute) GetClusterByName(ctx context.Context, name string) (string, string, error) {
+	clusters, err := c.w.Clusters.ListAll(ctx, compute.ListClustersRequest{
+		FilterBy: &compute.ListClustersFilterBy{
+			// TERMINATING is excluded alongside TERMINATED: a cluster on its way
+			// down is not a usable target, and keeping it would reintroduce the
+			// stale-collision problem this filter exists to avoid.
+			ClusterStates: []compute.State{
+				compute.StatePending,
+				compute.StateRunning,
+				compute.StateRestarting,
+				compute.StateResizing,
+			},
+		},
+	})
+	if err != nil {
+		return "", "", fmt.Errorf("list clusters to resolve name %q: %w", name, err)
+	}
+	var matches []compute.ClusterDetails
+	for _, cl := range clusters {
+		if cl.ClusterName == name {
+			matches = append(matches, cl)
+		}
+	}
+	switch len(matches) {
+	case 0:
+		return "", "", fmt.Errorf("no active cluster named %q", name)
+	case 1:
+		return matches[0].ClusterId, matches[0].SparkVersion, nil
+	default:
+		return "", "", fmt.Errorf("there are %d active clusters named %q; use --cluster-id to disambiguate", len(matches), name)
+	}
+}
+
+// JobTaskEnvironment resolves a single job task's compute to an environment.
+//
+// A job can bind multiple tasks to different serverless environment versions, so
+// the target is a specific task, not the whole job. taskKey selects it:
+//   - an empty taskKey is an enumerate request — it returns *localenv.ErrTaskKeyRequired
+//     carrying the job's task keys, so the caller emits an actionable E_USAGE;
+//   - an unknown taskKey returns an error listing the available keys.
+//
+// A serverless task binds an environment_key to one of the job's environments;
+// its version is read directly from that environment's spec (no fallback). A
+// classic task resolves from its new_cluster, its job_cluster_key (a shared
+// job_clusters entry), or its existing_cluster_id (via the Clusters API). A
+// for_each_task is unwrapped to its nested task, whose compute is resolved the
+// same way.
+func (c sdkCompute) JobTaskEnvironment(ctx context.Context, jobID, taskKey string) (sparkVersion string, isServerless bool, version string, err error) {
+	id, err := strconv.ParseInt(jobID, 10, 64)
+	if err != nil {
+		return "", false, "", fmt.Errorf("invalid job ID %q: must be an integer: %w", jobID, err)
+	}
+
+	job, err := c.w.Jobs.GetByJobId(ctx, id)
+	if err != nil {
+		return "", false, "", fmt.Errorf("get job %d: %w", id, err)
+	}
+	if job.Settings == nil {
+		return "", false, "", fmt.Errorf("job %d has no settings", id)
+	}
+
+	taskKeys := make([]string, 0, len(job.Settings.Tasks))
+	for _, t := range job.Settings.Tasks {
+		taskKeys = append(taskKeys, t.TaskKey)
+	}
+
+	// No task key given: ask the caller to pick one, listing what is available.
+	// This is a usage error, not a resolve failure — see ResolveCompute.
+	if taskKey == "" {
+		return "", false, "", &localenv.ErrTaskKeyRequired{JobID: jobID, TaskKeys: taskKeys}
+	}
+
+	var task *jobs.Task
+	for i := range job.Settings.Tasks {
+		if job.Settings.Tasks[i].TaskKey == taskKey {
+			task = &job.Settings.Tasks[i]
+			break
+		}
+	}
+	if task == nil {
+		return "", false, "", fmt.Errorf("job %s has no task %q (available: %s)", jobID, taskKey, strings.Join(taskKeys, ", "))
+	}
+
+	// A for_each_task wraps the real per-iteration task: its compute
+	// (environment_key / new_cluster / existing_cluster_id / job_cluster_key)
+	// lives on the nested task, not the outer one. Resolve against that.
+	if task.ForEachTask != nil {
+		task = &task.ForEachTask.Task
+	}
+
+	return c.resolveTaskCompute(ctx, job.Settings, task, jobID, taskKey)
+}
+
+// resolveTaskCompute resolves one task's compute to an environment. It reads the
+// serverless environment version directly (no fallback) or the classic cluster's
+// Spark version, consulting the job-level environments and job_clusters the task
+// references by key.
+func (c sdkCompute) resolveTaskCompute(ctx context.Context, settings *jobs.JobSettings, task *jobs.Task, jobID, taskKey string) (sparkVersion string, isServerless bool, version string, err error) {
+	// Serverless task: it references one of the job's environments by key; the
+	// version lives on that environment's spec and is used directly.
+	if task.EnvironmentKey != "" {
+		for _, e := range settings.Environments {
+			if e.EnvironmentKey == task.EnvironmentKey {
+				v := environmentVersion(e)
+				if v == "" {
+					return "", false, "", fmt.Errorf("task %q of job %s binds environment %q, which records no environment version", taskKey, jobID, task.EnvironmentKey)
+				}
+				return "", true, v, nil
+			}
+		}
+		return "", false, "", fmt.Errorf("task %q of job %s references environment %q, which the job does not define", taskKey, jobID, task.EnvironmentKey)
+	}
+
+	// Classic task with an inline cluster spec.
+	if task.NewCluster != nil && task.NewCluster.SparkVersion != "" {
+		return task.NewCluster.SparkVersion, false, task.NewCluster.SparkVersion, nil
+	}
+
+	// Classic task referencing a shared job cluster by key: read that cluster's
+	// Spark version from the job's job_clusters (the common classic-task shape).
+	if task.JobClusterKey != "" {
+		for _, jc := range settings.JobClusters {
+			if jc.JobClusterKey == task.JobClusterKey {
+				if jc.NewCluster.SparkVersion == "" {
+					return "", false, "", fmt.Errorf("task %q of job %s uses job cluster %q, which has no spark_version", taskKey, jobID, task.JobClusterKey)
+				}
+				return jc.NewCluster.SparkVersion, false, jc.NewCluster.SparkVersion, nil
+			}
+		}
+		return "", false, "", fmt.Errorf("task %q of job %s references job cluster %q, which the job does not define", taskKey, jobID, task.JobClusterKey)
+	}
+
+	// Classic task pinned to an existing cluster: resolve its Spark version.
+	if task.ExistingClusterId != "" {
+		sv, cerr := c.GetClusterSparkVersion(ctx, task.ExistingClusterId)
+		if cerr != nil {
+			return "", false, "", fmt.Errorf("resolving existing cluster %s for task %q of job %s: %w", task.ExistingClusterId, taskKey, jobID, cerr)
+		}
+		return sv, false, sv, nil
+	}
+
+	return "", false, "", fmt.Errorf("task %q of job %s has no serverless environment or resolvable cluster; pass --cluster-id or --serverless-version explicitly", taskKey, jobID)
+}
+
+// environmentVersion returns the serverless environment version recorded on a
+// job environment, or "" when the spec or version is absent.
+//
+// The version can arrive in either of two fields. environment_version is the
+// current one; client is its deprecated predecessor ("Use environment_version
+// instead") and is still what some jobs pin. Reading both means a client-pinned
+// task is not treated as unversioned. base_environment is deliberately ignored:
+// it is a path/ID, not a version.
+func environmentVersion(e jobs.JobEnvironment) string {
+	if e.Spec == nil {
+		return ""
+	}
+	if e.Spec.EnvironmentVersion != "" {
+		return e.Spec.EnvironmentVersion
+	}
+	return e.Spec.Client
+}
diff --git a/cmd/environments/compute_test.go b/cmd/environments/compute_test.go
new file mode 100644
index 00000000000..7b4b9300b75
--- /dev/null
+++ b/cmd/environments/compute_test.go
@@ -0,0 +1,32 @@
+package environments
+
+import (
+	"testing"
+
+	"github.com/databricks/databricks-sdk-go/service/compute"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestEnvironmentVersion(t *testing.T) {
+	cases := []struct {
+		name string
+		env  jobs.JobEnvironment
+		want string
+	}{
+		{"nil spec", jobs.JobEnvironment{}, ""},
+		{"environment_version", jobs.JobEnvironment{Spec: &compute.Environment{EnvironmentVersion: "3"}}, "3"},
+		// client is the deprecated predecessor of environment_version; some jobs
+		// still pin via it, so it must be read when environment_version is empty.
+		{"client fallback", jobs.JobEnvironment{Spec: &compute.Environment{Client: "2"}}, "2"},
+		// environment_version wins when both are present.
+		{"environment_version wins", jobs.JobEnvironment{Spec: &compute.Environment{EnvironmentVersion: "4", Client: "2"}}, "4"},
+		// base_environment is a path/ID, not a version, and is ignored.
+		{"base_environment ignored", jobs.JobEnvironment{Spec: &compute.Environment{BaseEnvironment: "/Workspace/env.yaml"}}, ""},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, environmentVersion(tc.env))
+		})
+	}
+}
diff --git a/cmd/environments/output.go b/cmd/environments/output.go
new file mode 100644
index 00000000000..51851497eb7
--- /dev/null
+++ b/cmd/environments/output.go
@@ -0,0 +1,213 @@
+package environments
+
+import (
+	"context"
+	"fmt"
+	"path/filepath"
+	"runtime"
+	"strings"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
+	libslocalenv "github.com/databricks/cli/libs/localenv"
+	"github.com/databricks/cli/libs/shellquote"
+	"github.com/spf13/cobra"
+)
+
+// renderResult renders the pipeline result to the command's output.
+// In JSON mode it renders the full structured result (even on error).
+// In text mode it prints a friendly success/failure summary (per-phase progress
+// is shown live via the spinner while the run is in flight), then returns the
+// error.
+//
+// res is always non-nil: Pipeline.Run constructs and returns a fully-populated
+// Result (with the canonical phase list and error object) on every path,
+// including failures, so no nil guard is needed here.
+func renderResult(ctx context.Context, cmd *cobra.Command, res *libslocalenv.Result, pipelineErr error) error {
+	// Emit one telemetry event per real run (success, failure, or cancel);
+	// dry-run runs are not recorded. Best-effort: never affects output.
+	logSetupLocalEvent(ctx, res)
+
+	if root.OutputType(cmd) == flags.OutputJSON {
+		if err := cmdio.Render(ctx, res); err != nil {
+			return err
+		}
+		// The JSON object is the only thing written to stdout. On failure we still
+		// need a non-zero exit, but returning pipelineErr would make the root print
+		// "Error: ..." to stderr. ErrAlreadyPrinted exits non-zero without that.
+		if pipelineErr != nil {
+			return root.ErrAlreadyPrinted
+		}
+		return nil
+	}
+
+	// Text mode. The internal phase log is intentionally NOT printed on success:
+	// it read as noise in the M5 bug bash (DECO-27977). Per-phase progress is shown
+	// live via the spinner reporter (see cmd/environments/progress.go); the full
+	// phase list remains in --output json, and --debug logs each phase as it is
+	// entered.
+	for _, w := range res.Warnings {
+		cmdio.LogString(ctx, "warning: "+w.Message)
+	}
+
+	if pipelineErr != nil {
+		if res.Error != nil && res.Error.Code == libslocalenv.ErrCanceled {
+			cmdio.LogString(ctx, "✗ Setup canceled.")
+		} else {
+			cmdio.LogString(ctx, "✗ Setup failed"+failureClause(res)+".")
+			if res.Error != nil {
+				cmdio.LogString(ctx, "")
+				// Indent every line: uv-driven failures fold uv's (often multi-line)
+				// stderr into the message, and a flush-left continuation reads as
+				// unrelated output rather than part of the reason.
+				cmdio.LogString(ctx, indent(res.Error.Error(), "  "))
+			}
+			// Only on an actual failure, not a user interrupt: after Ctrl-C the
+			// fallback note reads as a contradictory postscript to "Setup canceled".
+			renderInstalledPythonFallback(ctx, res)
+		}
+		cmdio.LogString(ctx, "")
+		cmdio.LogString(ctx, "Re-run with --debug for details, or --output json for a structured report.")
+		// The failing message is already surfaced above; ErrAlreadyPrinted exits
+		// non-zero without root re-printing "Error: ...".
+		return root.ErrAlreadyPrinted
+	}
+
+	if res.DryRun {
+		if res.Plan != nil {
+			cmdio.LogString(ctx, "Plan: "+res.Plan.WouldWrite)
+			if res.Plan.WouldWriteUvWorkspace != "" {
+				cmdio.LogString(ctx, "Plan: "+res.Plan.WouldWriteUvWorkspace+" (uv workspace root)")
+			}
+			for _, region := range res.Plan.ChangedRegions {
+				cmdio.LogString(ctx, "  changed region: "+region)
+			}
+		}
+		cmdio.LogString(ctx, "Check complete. No files were modified.")
+		return nil
+	}
+
+	renderSuccess(ctx, res)
+	return nil
+}
+
+// renderSuccess prints the friendly post-provision summary.
+//
+// It runs only on a non-dry-run success (renderResult returns earlier for JSON,
+// failures, and dry runs), so res.VenvPath is always set: the validate phase — the
+// last thing a successful run does — assigns it unconditionally (see Pipeline.validate).
+func renderSuccess(ctx context.Context, res *libslocalenv.Result) {
+	cmdio.LogString(ctx, "✔ Local environment ready")
+	cmdio.LogString(ctx, "")
+
+	if res.Compute != nil {
+		cmdio.LogString(ctx, fmt.Sprintf("  %-20s%s", "Compute target", res.Compute.Label()))
+	}
+	if res.Resolved != nil {
+		cmdio.LogString(ctx, fmt.Sprintf("  %-20s%s", "Python", res.Resolved.PythonVersion))
+		if res.Resolved.DBConnectVersion != "" {
+			cmdio.LogString(ctx, fmt.Sprintf("  %-20s%s", "databricks-connect", res.Resolved.DBConnectVersion))
+		}
+	}
+	cmdio.LogString(ctx, fmt.Sprintf("  %-20s%s", "Virtual env", res.VenvPath))
+	// pyproject.toml was created (greenfield) or updated in place (with a backup).
+	pyprojectDetail := "updated"
+	if res.Greenfield {
+		pyprojectDetail = "created"
+	} else if res.BackupPath != "" {
+		pyprojectDetail = "updated (backup: " + res.BackupPath + ")"
+	}
+	cmdio.LogString(ctx, fmt.Sprintf("  %-20s%s", "pyproject.toml", pyprojectDetail))
+	if res.UvWorkspaceRoot != "" {
+		// The root file changes only when its constraint block changes, and every
+		// change writes a backup; --no-constraints and a no-op re-run leave it alone.
+		rootDetail := "unchanged"
+		if res.UvWorkspaceBackupPath != "" {
+			rootDetail = "constraints updated (backup: " + res.UvWorkspaceBackupPath + ")"
+		}
+		cmdio.LogString(ctx, fmt.Sprintf("  %-20s%s", "uv workspace root", res.UvWorkspaceRoot))
+		cmdio.LogString(ctx, fmt.Sprintf("  %-20s%s", "Root pyproject.toml", rootDetail))
+	}
+	renderInstalledPythonFallback(ctx, res)
+
+	cmdio.LogString(ctx, "")
+	cmdio.LogString(ctx, "Next steps:")
+	cmdio.LogString(ctx, "  • Activate it:  "+activateHint(res.VenvPath))
+	cmdio.LogString(ctx, "  • Or select "+res.VenvPath+" as the Python interpreter in VS Code / Cursor")
+}
+
+// renderInstalledPythonFallback explains the non-default resolution path on
+// both success and failure, so a later provisioning error is diagnosable.
+func renderInstalledPythonFallback(ctx context.Context, res *libslocalenv.Result) {
+	if res.PythonResolution == libslocalenv.PythonResolutionInstalledFallback {
+		cmdio.LogString(ctx, "")
+		cmdio.LogString(ctx, "Python download failed; using the installed interpreter "+res.PythonInterpreter+" instead.")
+	}
+}
+
+// activateHint returns the shell command to activate the virtual environment,
+// matching the running OS. uv lays the venv out as Scripts\activate on Windows
+// and bin/activate on Unix (see venvPython in libs/localenv/uv.go, which branches
+// the same way); "source" is a POSIX-shell builtin, so Windows gets the bare
+// path instead. Printing the Unix form on Windows would hand the user a command
+// that fails with "source is not recognized" and a path that does not exist.
+func activateHint(venvPath string) string {
+	if runtime.GOOS == "windows" {
+		// venvPath is in slash form; cmd.exe reads "/" as a switch character, so a
+		// relative path such as ../../.venv needs backslashes.
+		return quoteForCmd(filepath.FromSlash(venvPath) + `\Scripts\activate`)
+	}
+	// A leading dash would be read as an option of source.
+	if strings.HasPrefix(venvPath, "-") {
+		venvPath = "./" + venvPath
+	}
+	return "source " + shellquote.BashArg(venvPath+"/bin/activate")
+}
+
+// quoteForCmd wraps path in double quotes when cmd.exe would otherwise split
+// it at a space or a command separator (UV_PROJECT_ENVIRONMENT can name such a
+// folder). Quotes do not stop %VAR% expansion; such folder names are rare.
+func quoteForCmd(path string) string {
+	if strings.ContainsAny(path, " \t&^()<>|,;=!") {
+		return `"` + path + `"`
+	}
+	return path
+}
+
+// failureClause maps the failing phase to a human clause for the failure line,
+// e.g. " while fetching constraints" (note the leading space). Keyed off the
+// recorded FailurePhase so text output stays in step with the --output json
+// error object. Returns "" for an unknown or missing phase, so the caller reads
+// "Setup failed." rather than the redundant "Setup failed during setup."
+func failureClause(res *libslocalenv.Result) string {
+	if res.Error == nil {
+		return ""
+	}
+	switch res.Error.FailurePhase {
+	case libslocalenv.PhasePreflight:
+		return " during preflight checks"
+	case libslocalenv.PhaseResolve:
+		return " while resolving your compute target"
+	case libslocalenv.PhaseFetch:
+		return " while fetching constraints"
+	case libslocalenv.PhaseMerge:
+		return " while updating pyproject.toml"
+	case libslocalenv.PhaseProvision:
+		return " while provisioning the virtual environment"
+	case libslocalenv.PhaseValidate:
+		return " while validating the environment"
+	default:
+		return ""
+	}
+}
+
+// indent prefixes every line of s with prefix. Used so a multi-line failure
+// message (uv stderr folded in) stays visually grouped under the failure line.
+func indent(s, prefix string) string {
+	lines := strings.Split(s, "\n")
+	for i, line := range lines {
+		lines[i] = prefix + line
+	}
+	return strings.Join(lines, "\n")
+}
diff --git a/cmd/environments/output_test.go b/cmd/environments/output_test.go
new file mode 100644
index 00000000000..2349402dbb7
--- /dev/null
+++ b/cmd/environments/output_test.go
@@ -0,0 +1,229 @@
+package environments
+
+import (
+	"runtime"
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
+	libslocalenv "github.com/databricks/cli/libs/localenv"
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/assert"
+)
+
+// renderText runs renderResult in text mode and returns what was written to
+// stderr (where cmdio.LogString writes). The command is wired with a proper
+// *flags.Output persistent flag so root.OutputType does not panic.
+func renderText(t *testing.T, res *libslocalenv.Result, pipelineErr error) string {
+	t.Helper()
+	ctx, buf := cmdio.NewTestContextWithStderr(t.Context())
+	cmd := &cobra.Command{}
+	cmd.SetContext(ctx)
+	// Register the output flag as *flags.Output (text default) so root.OutputType
+	// finds a *flags.Output value and returns OutputText without panicking.
+	output := flags.OutputText
+	cmd.PersistentFlags().VarP(&output, "output", "o", "output type: text or json")
+	_ = renderResult(ctx, cmd, res, pipelineErr)
+	return buf.String()
+}
+
+func TestRenderSuccessSummary(t *testing.T) {
+	res := libslocalenv.NewResult()
+	res.OK = true
+	res.Mode = libslocalenv.ModeDefault.String()
+	res.Compute = &libslocalenv.ComputeInfo{Source: "serverless", ServerlessVersion: "v4", EnvKey: "serverless/serverless-v4"}
+	res.Resolved = &libslocalenv.ResolvedInfo{PythonVersion: "3.12", DBConnectVersion: "16.1.0"}
+	res.VenvPath = ".venv"
+	res.BackupPath = "pyproject.toml.bak"
+
+	out := renderText(t, res, nil)
+
+	assert.Contains(t, out, "Local environment ready")
+	assert.Contains(t, out, "serverless 4")
+	assert.Contains(t, out, "3.12")
+	assert.Contains(t, out, "16.1.0")
+	assert.Contains(t, out, ".venv")
+	assert.Contains(t, out, "pyproject.toml.bak")
+	assert.Contains(t, out, "Next steps")
+	// The raw phase log must NOT appear on success anymore.
+	assert.NotContains(t, out, "preflight  ok")
+}
+
+func TestRenderSuccessExplainsInstalledPythonFallback(t *testing.T) {
+	res := libslocalenv.NewResult()
+	res.OK = true
+	res.Resolved = &libslocalenv.ResolvedInfo{PythonVersion: "3.12"}
+	res.VenvPath = ".venv"
+	res.PythonResolution = libslocalenv.PythonResolutionInstalledFallback
+	res.PythonInterpreter = "/usr/bin/python3.12"
+
+	out := renderText(t, res, nil)
+
+	assert.Contains(t, out, "Python download failed")
+	// The exact interpreter is named so the user knows what backs the venv.
+	assert.Contains(t, out, "/usr/bin/python3.12")
+}
+
+func TestRenderSuccessConstraintsOnlyOmitsDBConnect(t *testing.T) {
+	res := libslocalenv.NewResult()
+	res.OK = true
+	res.Mode = libslocalenv.ModeConstraintsOnly.String()
+	res.Compute = &libslocalenv.ComputeInfo{Source: "serverless", ServerlessVersion: "v4", EnvKey: "serverless/serverless-v4"}
+	res.Resolved = &libslocalenv.ResolvedInfo{PythonVersion: "3.12"} // no DBConnectVersion
+	res.VenvPath = ".venv"
+
+	out := renderText(t, res, nil)
+	// renderSuccess omits the row when DBConnectVersion is empty — which is how constraints-only mode leaves it.
+	assert.NotContains(t, out, "databricks-connect")
+}
+
+func TestRenderFailure(t *testing.T) {
+	res := libslocalenv.NewResult()
+	res.Phases = []libslocalenv.PhaseStatus{}
+	res.Error = &libslocalenv.PipelineError{
+		Code:         libslocalenv.ErrFetch,
+		FailurePhase: libslocalenv.PhaseFetch,
+		Msg:          "constraint repo unreachable",
+	}
+	perr := res.Error
+
+	out := renderText(t, res, perr)
+
+	assert.Contains(t, out, "Setup failed")
+	assert.Contains(t, out, "fetching constraints")
+	assert.Contains(t, out, "constraint repo unreachable")
+	assert.Contains(t, out, "--debug")
+}
+
+func TestRenderFailureExplainsInstalledPythonFallback(t *testing.T) {
+	res := libslocalenv.NewResult()
+	res.PythonResolution = libslocalenv.PythonResolutionInstalledFallback
+	res.PythonInterpreter = "/usr/bin/python3.12"
+	res.Error = &libslocalenv.PipelineError{
+		Code:         libslocalenv.ErrProvision,
+		FailurePhase: libslocalenv.PhaseProvision,
+		Msg:          "sync failed",
+	}
+
+	out := renderText(t, res, res.Error)
+
+	assert.Contains(t, out, "Python download failed")
+	assert.Contains(t, out, "/usr/bin/python3.12")
+}
+
+// A user interrupt after a fallback must not append the fallback note, which
+// would contradict "Setup canceled".
+func TestRenderCanceledOmitsInstalledPythonFallback(t *testing.T) {
+	res := libslocalenv.NewResult()
+	res.PythonResolution = libslocalenv.PythonResolutionInstalledFallback
+	res.PythonInterpreter = "/usr/bin/python3.12"
+	res.Error = &libslocalenv.PipelineError{Code: libslocalenv.ErrCanceled, FailurePhase: libslocalenv.PhaseProvision, Msg: "interrupted"}
+
+	out := renderText(t, res, res.Error)
+
+	assert.Contains(t, out, "canceled")
+	assert.NotContains(t, out, "Python download failed")
+}
+
+func TestRenderCanceled(t *testing.T) {
+	res := libslocalenv.NewResult()
+	res.Error = &libslocalenv.PipelineError{Code: libslocalenv.ErrCanceled, FailurePhase: libslocalenv.PhaseProvision, Msg: "interrupted"}
+	out := renderText(t, res, res.Error)
+	assert.Contains(t, out, "canceled")
+}
+
+func TestRenderDryRun(t *testing.T) {
+	res := libslocalenv.NewResult()
+	res.OK = true
+	res.DryRun = true
+	res.Plan = &libslocalenv.Plan{WouldWrite: "/tmp/pyproject.toml", ChangedRegions: []string{"requires-python"}}
+	out := renderText(t, res, nil)
+	assert.Contains(t, out, "requires-python")
+	assert.Contains(t, out, "No files were modified")
+}
+
+func TestActivateHintWorkspaceMember(t *testing.T) {
+	// venvPath is in slash form; cmd.exe needs backslashes in a relative path.
+	hint := activateHint("../../.venv")
+	if runtime.GOOS == "windows" {
+		assert.Equal(t, `..\..\.venv\Scripts\activate`, hint)
+	} else {
+		assert.Equal(t, "source ../../.venv/bin/activate", hint)
+	}
+}
+
+func TestActivateHintQuotesShellCharacters(t *testing.T) {
+	// UV_PROJECT_ENVIRONMENT can name a folder with spaces or shell characters.
+	if runtime.GOOS == "windows" {
+		assert.Equal(t, `"my env\Scripts\activate"`, activateHint("my env"))
+		assert.Equal(t, `"R&D\Scripts\activate"`, activateHint("R&D"))
+		return
+	}
+	assert.Equal(t, `source 'my env/bin/activate'`, activateHint("my env"))
+	assert.Equal(t, `source '/tmp/env$1/bin/activate'`, activateHint("/tmp/env$1"))
+	// A leading dash would be read as an option.
+	assert.Equal(t, `source ./-env/bin/activate`, activateHint("-env"))
+}
+
+func TestActivateHint(t *testing.T) {
+	hint := activateHint(".venv")
+	if runtime.GOOS == "windows" {
+		// Windows: uv lays the venv out under Scripts\, and "source" is not a
+		// cmd/PowerShell builtin, so the hint must not suggest it.
+		assert.Equal(t, `.venv\Scripts\activate`, hint)
+		assert.NotContains(t, hint, "source ")
+		assert.NotContains(t, hint, "/bin/")
+	} else {
+		assert.Equal(t, "source .venv/bin/activate", hint)
+	}
+}
+
+func TestRenderSuccessWorkspaceMember(t *testing.T) {
+	res := libslocalenv.NewResult()
+	res.OK = true
+	res.Resolved = &libslocalenv.ResolvedInfo{PythonVersion: "3.12"}
+	res.VenvPath = "../../.venv"
+	res.UvWorkspaceRoot = "/repo"
+	res.UvWorkspaceBackupPath = "/repo/pyproject.toml.bak"
+
+	out := renderText(t, res, nil)
+
+	assert.Contains(t, out, "uv workspace root")
+	assert.Contains(t, out, "/repo")
+	assert.Contains(t, out, "Root pyproject.toml")
+	assert.Contains(t, out, "constraints updated (backup: /repo/pyproject.toml.bak)")
+}
+
+func TestRenderSuccessStandaloneOmitsWorkspaceRows(t *testing.T) {
+	res := libslocalenv.NewResult()
+	res.OK = true
+	res.VenvPath = ".venv"
+
+	out := renderText(t, res, nil)
+
+	assert.NotContains(t, out, "uv workspace root")
+	assert.NotContains(t, out, "Root pyproject.toml")
+}
+
+func TestRenderDryRunWorkspaceMember(t *testing.T) {
+	res := libslocalenv.NewResult()
+	res.OK = true
+	res.DryRun = true
+	res.Plan = &libslocalenv.Plan{WouldWrite: "/repo/a/pyproject.toml", WouldWriteUvWorkspace: "/repo/pyproject.toml"}
+	out := renderText(t, res, nil)
+	assert.Contains(t, out, "Plan: /repo/pyproject.toml (uv workspace root)")
+}
+
+func TestRenderSuccessWorkspaceMemberUnchangedRoot(t *testing.T) {
+	// --no-constraints or an idempotent re-run: the root file was not changed.
+	res := libslocalenv.NewResult()
+	res.OK = true
+	res.VenvPath = "../../.venv"
+	res.UvWorkspaceRoot = "/repo"
+
+	out := renderText(t, res, nil)
+
+	assert.Contains(t, out, "Root pyproject.toml")
+	assert.Contains(t, out, "unchanged")
+	assert.NotContains(t, out, "constraints updated")
+}
diff --git a/cmd/environments/progress.go b/cmd/environments/progress.go
new file mode 100644
index 00000000000..cebb7049c75
--- /dev/null
+++ b/cmd/environments/progress.go
@@ -0,0 +1,76 @@
+package environments
+
+import (
+	"context"
+
+	"github.com/databricks/cli/libs/cmdio"
+	libslocalenv "github.com/databricks/cli/libs/localenv"
+)
+
+// phaseMessages maps each pipeline phase to the live-progress text shown on the
+// spinner. Phases without a user-facing message (they complete instantly) are
+// omitted and leave the current message in place.
+//
+// PhasePreflight is intentionally absent: preflight can prompt interactively
+// (confirmUvInstall via cmdio.AskYesOrNo when uv is not installed), and the
+// prompt writes to the same stderr stream the spinner repaints. A spinner
+// running during preflight would clobber the "[y/N]" line and make the command
+// look hung. Omitting preflight keeps the spinner from starting until resolve,
+// after the prompt has been answered (see spinnerReporter's lazy start).
+var phaseMessages = map[libslocalenv.PhaseName]string{
+	libslocalenv.PhaseResolve:   "Resolving your Databricks compute…",
+	libslocalenv.PhaseFetch:     "Fetching matching versions and constraints…",
+	libslocalenv.PhaseMerge:     "Updating pyproject.toml…",
+	libslocalenv.PhaseProvision: "Provisioning the virtual environment with uv…",
+	libslocalenv.PhaseValidate:  "Validating the environment…",
+}
+
+// progressSpinner is the subset of cmdio's spinner the reporter drives. It is an
+// interface so tests can substitute a fake and assert lazy start.
+type progressSpinner interface {
+	Update(string)
+	Close()
+}
+
+// spinnerReporter renders live per-phase progress on a cmdio spinner. The spinner
+// degrades to a no-op in non-interactive terminals (CI, acceptance tests), so
+// this writes nothing there.
+//
+// The spinner is started lazily, on the first phase that has a message, rather
+// than eagerly in the constructor. This keeps its Bubble Tea program — which
+// repaints stderr at ~5fps — from running during PhasePreflight, where an
+// interactive uv-install prompt may be waiting on the same stream. See
+// phaseMessages for why preflight has no message.
+type spinnerReporter struct {
+	// newSpinner constructs the spinner on first use; a field so tests inject a fake.
+	newSpinner func() progressSpinner
+	sp         progressSpinner
+}
+
+// newSpinnerReporter returns a Reporter that starts a spinner on the first phase
+// with a message and updates it as later phases begin. The caller must Close it
+// when the run finishes.
+func newSpinnerReporter(ctx context.Context) *spinnerReporter {
+	return &spinnerReporter{newSpinner: func() progressSpinner { return cmdio.NewSpinner(ctx) }}
+}
+
+// PhaseStarted updates the spinner message for the phase that is beginning,
+// starting the spinner on first use. Phases without a message (preflight) are a
+// no-op, so the spinner never runs while preflight's prompt may be active.
+func (r *spinnerReporter) PhaseStarted(name libslocalenv.PhaseName) {
+	msg, ok := phaseMessages[name]
+	if !ok {
+		return
+	}
+	if r.sp == nil {
+		r.sp = r.newSpinner()
+	}
+	r.sp.Update(msg)
+}
+
+// Close stops the spinner if it was started.
+func (r *spinnerReporter) Close() {
+	if r.sp != nil {
+		r.sp.Close()
+	}
+}
diff --git a/cmd/environments/progress_test.go b/cmd/environments/progress_test.go
new file mode 100644
index 00000000000..7135c2d6a61
--- /dev/null
+++ b/cmd/environments/progress_test.go
@@ -0,0 +1,63 @@
+package environments
+
+import (
+	"testing"
+
+	libslocalenv "github.com/databricks/cli/libs/localenv"
+	"github.com/stretchr/testify/assert"
+)
+
+// fakeSpinner records the messages and Close calls the reporter makes.
+type fakeSpinner struct {
+	updates []string
+	closed  int
+}
+
+func (f *fakeSpinner) Update(msg string) { f.updates = append(f.updates, msg) }
+func (f *fakeSpinner) Close()            { f.closed++ }
+
+// newTestReporter builds a spinnerReporter whose spinner is a fake, and returns
+// both plus a counter of how many times a spinner was constructed.
+func newTestReporter() (*spinnerReporter, *fakeSpinner, *int) {
+	sp := &fakeSpinner{}
+	created := 0
+	r := &spinnerReporter{newSpinner: func() progressSpinner {
+		created++
+		return sp
+	}}
+	return r, sp, &created
+}
+
+// Preflight has no message, so the reporter must not construct a spinner while
+// preflight's interactive uv-install prompt may be on the same stream.
+func TestSpinnerReporterDoesNotStartOnPreflight(t *testing.T) {
+	r, sp, created := newTestReporter()
+
+	r.PhaseStarted(libslocalenv.PhasePreflight)
+
+	assert.Equal(t, 0, *created, "spinner must not start during preflight")
+	assert.Empty(t, sp.updates)
+
+	// Close before any message-bearing phase is a no-op (nothing to stop).
+	r.Close()
+	assert.Equal(t, 0, sp.closed)
+}
+
+// The spinner starts on the first message-bearing phase and is reused (not
+// reconstructed) for later phases; Close stops it once.
+func TestSpinnerReporterStartsLazilyAndReuses(t *testing.T) {
+	r, sp, created := newTestReporter()
+
+	r.PhaseStarted(libslocalenv.PhasePreflight) // no-op
+	r.PhaseStarted(libslocalenv.PhaseResolve)   // starts the spinner
+	r.PhaseStarted(libslocalenv.PhaseFetch)     // reuses it
+
+	assert.Equal(t, 1, *created, "spinner should be constructed exactly once")
+	assert.Equal(t, []string{
+		phaseMessages[libslocalenv.PhaseResolve],
+		phaseMessages[libslocalenv.PhaseFetch],
+	}, sp.updates)
+
+	r.Close()
+	assert.Equal(t, 1, sp.closed)
+}
diff --git a/cmd/environments/setup_local.go b/cmd/environments/setup_local.go
new file mode 100644
index 00000000000..dee8292bb5f
--- /dev/null
+++ b/cmd/environments/setup_local.go
@@ -0,0 +1,18 @@
+package environments
+
+import "github.com/spf13/cobra"
+
+// Commands returns the hand-written subcommands to add to the auto-generated
+// "environments" command group. They are attached via the group's cmdOverrides
+// hook (see cmd/workspace/environments/overrides.go), mirroring how cmd/apps
+// extends the generated apps group.
+//
+// P0 exposes a single verb, "setup-local", which provisions a local Python
+// environment matched to a Databricks compute target. It is Python-only and
+// takes no language selector (spec §naming); a language axis (setup-local
+// python / scala) would be additive if more languages are ever supported.
+func Commands() []*cobra.Command {
+	return []*cobra.Command{
+		newSetupLocalCommand(),
+	}
+}
diff --git a/cmd/environments/sync.go b/cmd/environments/sync.go
new file mode 100644
index 00000000000..ae10ae08eb3
--- /dev/null
+++ b/cmd/environments/sync.go
@@ -0,0 +1,255 @@
+package environments
+
+import (
+	"context"
+	"os"
+	"os/signal"
+	"path/filepath"
+	"syscall"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/flags"
+	libslocalenv "github.com/databricks/cli/libs/localenv"
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/logdiag"
+	"github.com/spf13/cobra"
+)
+
+func newSetupLocalCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   libslocalenv.CommandVerb,
+		Short: "Set up a local Python environment that matches your Databricks compute",
+		Long: `Set up a local Python environment that matches a Databricks cluster or serverless version, so code you run on your machine behaves the same as it does on Databricks.
+
+Use this when you want to develop or debug a Databricks project locally: it installs the matching Python version and a compatible databricks-connect, and pins your dependencies to versions known to work with your chosen compute. It creates or updates a .venv (managed by uv) in the current directory and records the setup in pyproject.toml, leaving the rest of your project untouched.
+
+In a uv workspace member, the command uses the shared .venv at the workspace root and writes the dependency constraints to the root pyproject.toml, because uv reads them only from there. uv sync installs the current member's dependencies into the shared .venv and removes packages that only other members need. All members share one environment, so they must target compatible compute.
+
+If UV_PROJECT_ENVIRONMENT is set, the command uses that environment instead of .venv, as uv does.`,
+		Example: `  # Match a serverless version
+  databricks environments setup-local --serverless-version 5
+
+  # Match an existing cluster by name
+  databricks environments setup-local --cluster-name my-cluster
+
+  # See what would change without writing anything
+  databricks environments setup-local --serverless-version 5 --dry-run`,
+	}
+	// The target is selected via flags; reject stray positional args rather than
+	// silently ignoring them.
+	cmd.Args = cobra.NoArgs
+	// This command resolves its own compute target and only consults the bundle as
+	// an optional source of bundle.cluster_id (see bundleTarget). Skip bundle-based
+	// auth configuration in the shared PreRunE so a malformed databricks.yml (e.g.
+	// two targets marked default) can't fail the command before it runs; the fallback
+	// bundle read in bundleTarget swallows such errors and falls through to E_NO_TARGET.
+	// As a consequence auth resolves from profile/env only: the bundle's
+	// workspace.host/profile no longer feed the workspace client for this command.
+	cmd.PreRunE = func(cmd *cobra.Command, args []string) error {
+		cmd.SetContext(root.SkipLoadBundle(cmd.Context()))
+		return root.MustWorkspaceClient(cmd, args)
+	}
+	addComputeFlags(cmd)
+	cmd.RunE = func(cmd *cobra.Command, args []string) error {
+		return runPipeline(cmd)
+	}
+	return cmd
+}
+
+// addComputeFlags adds the shared compute and mode flags to a command.
+func addComputeFlags(cmd *cobra.Command) {
+	cmd.Flags().String("cluster-id", "", "cluster ID to use as the compute target")
+	cmd.Flags().String("cluster-name", "", "cluster name to use as the compute target (resolved to an ID via the Clusters API)")
+	cmd.Flags().String("serverless-version", "", "serverless version to use as the compute target (e.g. 5)")
+	cmd.Flags().String("job-task", "", "job task to use as the compute target, as <job-id>.<task-key> (the task key is required)")
+	cmd.Flags().Bool("constraints-only", false, "apply the Python version and constraints without adding the databricks-connect dependency")
+	// --constraints-only is superseded by the orthogonal --no-dbconnect (identical
+	// behaviour). Keep it defined so existing scripts and CI keep working, but hide
+	// it from --help and emit a one-line deprecation notice on stderr when it is
+	// used. MarkDeprecated does both; removal is a separate, later step.
+	cmd.Flags().MarkDeprecated("constraints-only", "use --no-dbconnect instead")
+	// The negative flags (--no-constraints, --no-dbconnect) are orthogonal and
+	// compose. --no-dbconnect and the older --constraints-only are equivalent (both
+	// skip the databricks-connect dependency).
+	cmd.Flags().Bool("no-constraints", false, "skip writing the remote Python version and dependency constraints")
+	cmd.Flags().Bool("no-dbconnect", false, "skip adding the databricks-connect dependency")
+	cmd.Flags().Bool("dry-run", false, "compute the plan without writing files or provisioning")
+	// The mutual exclusivity of the target flags is enforced in the pipeline's
+	// preflight (as E_USAGE) rather than via cmd.MarkFlagsMutuallyExclusive, so
+	// the conflict is reported through the phase/JSON contract the --output json
+	// consumer relies on, instead of a bare pre-RunE Cobra error.
+}
+
+// watchInterruptSignals cancels ctx on the first SIGINT (Ctrl-C) or SIGTERM (how
+// a supervisor, CI timeout, or VS Code stops the child), which propagates to the
+// uv subprocesses the pipeline spawns so they are reaped instead of orphaned
+// mid-provision. The CLI root installs no signal handler of its own.
+//
+// The returned stop function uninstalls the handler and joins the goroutine; the
+// caller must defer it.
+//
+// The handler must give the *second* signal back to the OS. signal.Notify (like
+// signal.NotifyContext, which wraps it) disables the default disposition for
+// SIGINT/SIGTERM for as long as the channel stays registered, so without the
+// signal.Stop below a second Ctrl-C is merely buffered and dropped: the user
+// would have no way to abort during the process group's SIGKILL grace window.
+// Stopping the relay as soon as the first signal lands restores SIG_DFL, so a
+// second signal terminates the CLI immediately. That matters more here than in
+// most commands because WithProcessGroup moves uv out of the foreground process
+// group, so the tty no longer delivers Ctrl-C to it directly — this handler is
+// the only delivery path.
+func watchInterruptSignals(ctx context.Context, cancel context.CancelFunc) func() {
+	sigCh := make(chan os.Signal, 1)
+	signal.Notify(sigCh, os.Interrupt, syscall.SIGTERM)
+
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		// Selecting on ctx.Done() too lets the goroutine exit on the normal (no
+		// signal) path rather than blocking on sigCh for the rest of the process:
+		// signal.Stop unregisters the channel but never closes it.
+		select {
+		case <-sigCh:
+			signal.Stop(sigCh)
+			cancel()
+		case <-ctx.Done():
+		}
+	}()
+
+	return func() {
+		signal.Stop(sigCh)
+		// Wake the goroutine in case neither sigCh nor ctx.Done has fired.
+		cancel()
+		<-done
+	}
+}
+
+// runPipeline builds and runs the setup-local Pipeline.
+func runPipeline(cmd *cobra.Command) error {
+	ctx, cancel := context.WithCancel(cmd.Context())
+	defer cancel()
+	defer watchInterruptSignals(ctx, cancel)()
+
+	cluster, _ := cmd.Flags().GetString("cluster-id")
+	clusterName, _ := cmd.Flags().GetString("cluster-name")
+	serverless, _ := cmd.Flags().GetString("serverless-version")
+	jobTask, _ := cmd.Flags().GetString("job-task")
+	constraintsOnly, _ := cmd.Flags().GetBool("constraints-only")
+	noConstraints, _ := cmd.Flags().GetBool("no-constraints")
+	noDBConnect, _ := cmd.Flags().GetBool("no-dbconnect")
+	check, _ := cmd.Flags().GetBool("dry-run")
+
+	computeFlags := libslocalenv.ComputeFlags{
+		Cluster:     cluster,
+		ClusterName: clusterName,
+		Serverless:  serverless,
+		JobTask:     jobTask,
+	}
+	// Flag validation (including mutual exclusivity) happens in the pipeline's
+	// preflight, so a conflict is reported as E_USAGE through the phase/JSON
+	// contract rather than as a bare error here.
+
+	// --no-dbconnect is the orthogonal spelling of --constraints-only; either skips
+	// the databricks-connect dependency, which the pipeline models as the mode.
+	mode := libslocalenv.ModeDefault
+	if constraintsOnly || noDBConnect {
+		mode = libslocalenv.ModeConstraintsOnly
+	}
+
+	constraintBaseURL := libslocalenv.ConstraintBaseURL(ctx)
+
+	projectDir, err := os.Getwd()
+	if err != nil {
+		return err
+	}
+
+	cacheDir, err := os.UserCacheDir()
+	if err != nil {
+		return err
+	}
+	cacheDir = filepath.Join(cacheDir, "databricks", "localenv")
+
+	// The bundle is only a fallback: ResolveCompute consults it solely when no
+	// explicit --cluster-id/--cluster-name/--serverless-version/--job-task flag is set. Skip the bundle load
+	// entirely when a flag is present — it would otherwise re-run TryConfigureBundle
+	// (a second full load) and re-print any bundle load-time diagnostics for nothing.
+	var bt libslocalenv.BundleTarget
+	if cluster == "" && clusterName == "" && serverless == "" && jobTask == "" {
+		bt = bundleTarget(cmd)
+	}
+
+	w := cmdctx.WorkspaceClient(ctx)
+
+	// Show live per-phase progress only in text mode. In --output json the only
+	// thing on stdout must be the JSON object; the spinner writes to stderr and
+	// no-ops when non-interactive, but we still skip it entirely for JSON so the
+	// pipeline stays silent for machine consumers.
+	var rep *spinnerReporter
+	var progress libslocalenv.Reporter
+	if root.OutputType(cmd) != flags.OutputJSON {
+		rep = newSpinnerReporter(ctx)
+		progress = rep
+	}
+
+	p := &libslocalenv.Pipeline{
+		Mode:              mode,
+		Check:             check,
+		SkipConstraints:   noConstraints,
+		ProjectDir:        projectDir,
+		ConstraintBaseURL: constraintBaseURL,
+		CacheDir:          cacheDir,
+		Flags:             computeFlags,
+		Compute:           sdkCompute{w: w},
+		Bundle:            bt,
+		PM:                libslocalenv.NewUvManager(),
+		Progress:          progress,
+	}
+
+	res, pipelineErr := p.Run(ctx)
+	if rep != nil {
+		rep.Close()
+	}
+	return renderResult(ctx, cmd, res, pipelineErr)
+}
+
+// bundleTarget reads the active bundle (if any) and maps its compute configuration
+// to a libslocalenv.BundleTarget.
+//
+// Only the top-level bundle.cluster_id field is consulted here; serverless is not
+// recorded in the bundle config, so Selected=true is set only when a cluster ID is
+// present. If the bundle is absent or has no cluster_id, Selected=false is returned
+// so the pipeline falls through to requiring an explicit flag.
+//
+// TODO: extend once bundle config exposes a serverless field at the bundle level.
+func bundleTarget(cmd *cobra.Command) libslocalenv.BundleTarget {
+	// Load the bundle in an isolated diagnostics context: the bundle is only an
+	// optional source of cluster_id here, so a malformed databricks.yml must not
+	// surface as a fatal command error. Any load error is logged for debugging and
+	// treated as "no bundle target", so the pipeline falls through to E_NO_TARGET
+	// (which tells the user to pass an explicit --cluster-id/--serverless-version/etc).
+	orig := cmd.Context()
+	ctx := logdiag.IsolatedContext(orig)
+	// Collect (buffer) diagnostics instead of rendering them: an isolated context
+	// still prints each diagnostic to stderr unless collection is on, and we want a
+	// bundle load error to be silent (debug-logged) on this optional fallback path.
+	logdiag.SetCollect(ctx, true)
+	cmd.SetContext(ctx)
+	defer cmd.SetContext(orig)
+	b := root.TryConfigureBundle(cmd)
+	if logdiag.HasError(ctx) {
+		log.Debugf(ctx, "ignoring bundle for cluster_id fallback: %s", logdiag.GetFirstErrorSummary(ctx))
+		return libslocalenv.BundleTarget{Selected: false}
+	}
+	if b == nil {
+		return libslocalenv.BundleTarget{Selected: false}
+	}
+	clusterID := b.Config.Bundle.ClusterId
+	if clusterID == "" {
+		return libslocalenv.BundleTarget{Selected: false}
+	}
+	return libslocalenv.BundleTarget{
+		ClusterID: clusterID,
+		Selected:  true,
+	}
+}
diff --git a/cmd/environments/sync_signal_test.go b/cmd/environments/sync_signal_test.go
new file mode 100644
index 00000000000..59477bccd67
--- /dev/null
+++ b/cmd/environments/sync_signal_test.go
@@ -0,0 +1,131 @@
+//go:build unix
+
+// The second-signal escape hatch is a Unix signal-delivery behavior: the test
+// re-execs itself and sends SIGINT/SIGTERM, which os/signal does not support on
+// Windows (the CLI's own signal handling there is likewise a no-op path).
+package environments
+
+import (
+	"bufio"
+	"context"
+	"os"
+	"os/exec"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// The second-signal behavior can only be observed in a real process: signal
+// dispositions are process-wide, and the test binary's own handlers would mask
+// them. So the test re-executes itself as a child (Go resets dispositions to
+// SIG_DFL across exec, unlike a shell background job, which inherits SIGINT as
+// SIG_IGN and would silently invalidate the result).
+const signalChildEnv = "TEST_ENVIRONMENTS_SIGNAL_CHILD"
+
+// TestMain runs the signal-handler-under-test when re-executed as the child.
+func TestMain(m *testing.M) {
+	if os.Getenv(signalChildEnv) == "" {
+		os.Exit(m.Run())
+	}
+
+	// TestMain has no *testing.T, so t.Context() is unavailable here.
+	//nolint:gocritic
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	stop := watchInterruptSignals(ctx, cancel)
+	defer stop()
+
+	// Stand in for the pipeline still draining the uv process group during the
+	// SIGKILL grace window — the interval in which the user needs the hatch.
+	os.Stdout.WriteString("READY\n")
+	<-ctx.Done()
+	os.Stdout.WriteString("CANCELLED\n")
+	time.Sleep(30 * time.Second)
+	os.Stdout.WriteString("SURVIVED\n")
+	os.Exit(0)
+}
+
+// TestWatchInterruptSignalsSecondSignalStillKills is the regression test for the
+// escape hatch: signal.Notify disables the default SIGINT/SIGTERM disposition
+// process-wide, so a handler that only relays the first signal leaves the user
+// unable to abort. The first signal must cancel the context, and the second must
+// terminate the process outright.
+func TestWatchInterruptSignalsSecondSignalStillKills(t *testing.T) {
+	for _, sig := range []syscall.Signal{syscall.SIGINT, syscall.SIGTERM} {
+		t.Run(sig.String(), func(t *testing.T) {
+			cmd := exec.Command(os.Args[0], "-test.run=TestWatchInterruptSignalsSecondSignalStillKills")
+			cmd.Env = append(os.Environ(), signalChildEnv+"=1")
+			stdout, err := cmd.StdoutPipe()
+			require.NoError(t, err)
+			require.NoError(t, cmd.Start())
+			t.Cleanup(func() { _ = cmd.Process.Kill() })
+
+			lines := make(chan string, 8)
+			go func() {
+				sc := bufio.NewScanner(stdout)
+				for sc.Scan() {
+					lines <- sc.Text()
+				}
+				close(lines)
+			}()
+			await := func(want string) bool {
+				deadline := time.After(30 * time.Second)
+				for {
+					select {
+					case l, ok := <-lines:
+						if !ok {
+							return false
+						}
+						if strings.Contains(l, want) {
+							return true
+						}
+					case <-deadline:
+						return false
+					}
+				}
+			}
+
+			require.True(t, await("READY"), "child never started")
+			require.NoError(t, cmd.Process.Signal(sig))
+			require.True(t, await("CANCELLED"), "first %s did not cancel the context", sig)
+
+			// The second signal must reach the default disposition and kill the
+			// child rather than being buffered and dropped by the handler.
+			require.NoError(t, cmd.Process.Signal(sig))
+			waitErr := make(chan error, 1)
+			go func() { waitErr <- cmd.Wait() }()
+			select {
+			case err := <-waitErr:
+				// Killed by the signal, so a non-nil (non-exit-zero) error.
+				assert.Error(t, err, "child should die by signal, not exit cleanly")
+			case <-time.After(15 * time.Second):
+				t.Fatalf("second %s was swallowed: the user has no escape hatch "+
+					"during the process group's SIGKILL grace window", sig)
+			}
+		})
+	}
+}
+
+// TestWatchInterruptSignalsStopsWithoutSignal covers the no-signal path: stop()
+// must return (joining its goroutine) rather than leaving it parked on the
+// channel for the life of the process.
+func TestWatchInterruptSignalsStopsWithoutSignal(t *testing.T) {
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+	stop := watchInterruptSignals(ctx, cancel)
+
+	returned := make(chan struct{})
+	go func() {
+		stop()
+		close(returned)
+	}()
+	select {
+	case <-returned:
+	case <-time.After(10 * time.Second):
+		t.Fatal("stop() blocked: the signal goroutine was never joined")
+	}
+}
diff --git a/cmd/environments/sync_test.go b/cmd/environments/sync_test.go
new file mode 100644
index 00000000000..4c84c898090
--- /dev/null
+++ b/cmd/environments/sync_test.go
@@ -0,0 +1,21 @@
+package environments
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestSetupLocalConstraintsOnlyDeprecated pins --constraints-only as a hidden,
+// deprecated alias for --no-dbconnect: the flag is kept defined so scripts and CI
+// that already pass it keep working, but it is hidden from --help and pflag prints
+// a one-line deprecation notice pointing at --no-dbconnect when it is used.
+func TestSetupLocalConstraintsOnlyDeprecated(t *testing.T) {
+	cmd := newSetupLocalCommand()
+
+	f := cmd.Flags().Lookup("constraints-only")
+	require.NotNil(t, f, "--constraints-only must remain defined for backward compatibility")
+	assert.True(t, f.Hidden, "--constraints-only should be hidden from --help")
+	assert.Equal(t, "use --no-dbconnect instead", f.Deprecated, "--constraints-only should carry the deprecation notice")
+}
diff --git a/cmd/environments/telemetry.go b/cmd/environments/telemetry.go
new file mode 100644
index 00000000000..302260d1244
--- /dev/null
+++ b/cmd/environments/telemetry.go
@@ -0,0 +1,138 @@
+package environments
+
+import (
+	"context"
+
+	libslocalenv "github.com/databricks/cli/libs/localenv"
+	"github.com/databricks/cli/libs/telemetry"
+	"github.com/databricks/cli/libs/telemetry/protos"
+)
+
+// logSetupLocalEvent buffers a setup-local telemetry event for a real run;
+// cmd/root uploads it at exit. It is a no-op for dry-run (buildSetupLocalEvent
+// returns nil), so callers do not need to guard on res.DryRun.
+func logSetupLocalEvent(ctx context.Context, res *libslocalenv.Result) {
+	event := buildSetupLocalEvent(res)
+	if event == nil {
+		return
+	}
+	telemetry.Log(ctx, protos.DatabricksCliLog{SetupLocalEvent: event})
+}
+
+// buildSetupLocalEvent maps a pipeline Result to the telemetry event, or returns
+// nil when there is nothing to report (nil result, or a --dry-run run, which is
+// not recorded). The Result is already PII-safe: it backs the --output json
+// contract, so only abstracted fields (source, mode, env key, error class) are
+// read here — never cluster names/ids or paths.
+func buildSetupLocalEvent(res *libslocalenv.Result) *protos.SetupLocalEvent {
+	if res == nil || res.DryRun {
+		return nil
+	}
+	event := &protos.SetupLocalEvent{
+		Success:         res.OK,
+		Mode:            modeType(res.Mode),
+		SkipConstraints: res.SkipConstraints,
+		Greenfield:      res.Greenfield,
+		ComputeSource:   protos.SetupLocalComputeSourceUnspecified,
+	}
+	if res.Compute != nil {
+		event.ComputeSource = computeSourceType(res.Compute.Source)
+		event.EnvKey = res.Compute.EnvKey
+	}
+	if res.Error != nil {
+		event.ErrorCode = errorCodeType(res.Error.Code)
+		event.FailurePhase = phaseType(res.Error.FailurePhase)
+		event.DiskMutated = res.Error.DiskMutated
+	}
+	return event
+}
+
+// computeSourceType maps a resolved ComputeInfo.Source to its telemetry enum.
+func computeSourceType(source string) protos.SetupLocalComputeSource {
+	switch source {
+	case "cluster":
+		return protos.SetupLocalComputeSourceCluster
+	case "serverless":
+		return protos.SetupLocalComputeSourceServerless
+	case "job":
+		return protos.SetupLocalComputeSourceJob
+	case "bundle":
+		return protos.SetupLocalComputeSourceBundle
+	default:
+		return protos.SetupLocalComputeSourceUnspecified
+	}
+}
+
+// modeType maps the Result.Mode string (Mode.String()) to its telemetry enum.
+func modeType(mode string) protos.SetupLocalMode {
+	switch mode {
+	case libslocalenv.ModeDefault.String():
+		return protos.SetupLocalModeDefault
+	case libslocalenv.ModeConstraintsOnly.String():
+		return protos.SetupLocalModeConstraintsOnly
+	default:
+		return protos.SetupLocalModeUnspecified
+	}
+}
+
+// errorCodeType maps a pipeline ErrorCode to its telemetry enum. The switch has
+// no default, so the exhaustive linter fails the build if a new
+// localenv.ErrorCode is added without a case here, guarding against silently
+// logging a new code as UNSPECIFIED. The trailing return handles a value outside
+// the declared set (a newer localenv than this mapping).
+func errorCodeType(code libslocalenv.ErrorCode) protos.SetupLocalErrorCode {
+	switch code {
+	case libslocalenv.ErrUsage:
+		return protos.SetupLocalErrorCodeUsage
+	case libslocalenv.ErrManagerUnsupported:
+		return protos.SetupLocalErrorCodeManagerUnsupported
+	case libslocalenv.ErrNotWritable:
+		return protos.SetupLocalErrorCodeNotWritable
+	case libslocalenv.ErrUvMissing:
+		return protos.SetupLocalErrorCodeUvMissing
+	case libslocalenv.ErrNoTarget:
+		return protos.SetupLocalErrorCodeNoTarget
+	case libslocalenv.ErrResolve:
+		return protos.SetupLocalErrorCodeResolve
+	case libslocalenv.ErrEnvUnsupported:
+		return protos.SetupLocalErrorCodeEnvUnsupported
+	case libslocalenv.ErrFetch:
+		return protos.SetupLocalErrorCodeFetch
+	case libslocalenv.ErrWrite:
+		return protos.SetupLocalErrorCodeWrite
+	case libslocalenv.ErrMerge:
+		return protos.SetupLocalErrorCodeMerge
+	case libslocalenv.ErrPythonInstall:
+		return protos.SetupLocalErrorCodePythonInstall
+	case libslocalenv.ErrProvision:
+		return protos.SetupLocalErrorCodeProvision
+	case libslocalenv.ErrProvisionConflict:
+		return protos.SetupLocalErrorCodeProvisionConflict
+	case libslocalenv.ErrValidate:
+		return protos.SetupLocalErrorCodeValidate
+	case libslocalenv.ErrCanceled:
+		return protos.SetupLocalErrorCodeCanceled
+	}
+	return protos.SetupLocalErrorCodeUnspecified
+}
+
+// phaseType maps a pipeline PhaseName to its telemetry enum. As with
+// errorCodeType, the switch has no default so the exhaustive linter fails the
+// build if a new localenv.PhaseName is added without a case here.
+func phaseType(phase libslocalenv.PhaseName) protos.SetupLocalPhase {
+	switch phase {
+	case libslocalenv.PhasePreflight:
+		return protos.SetupLocalPhasePreflight
+	case libslocalenv.PhaseResolve:
+		return protos.SetupLocalPhaseResolve
+	case libslocalenv.PhaseFetch:
+		return protos.SetupLocalPhaseFetch
+	case libslocalenv.PhaseMerge:
+		return protos.SetupLocalPhaseMerge
+	case libslocalenv.PhaseProvision:
+		return protos.SetupLocalPhaseProvision
+	case libslocalenv.PhaseValidate:
+		return protos.SetupLocalPhaseValidate
+	}
+	return protos.SetupLocalPhaseUnspecified
+}
diff --git a/cmd/environments/telemetry_test.go b/cmd/environments/telemetry_test.go
new file mode 100644
index 00000000000..130637255e5
--- /dev/null
+++ b/cmd/environments/telemetry_test.go
@@ -0,0 +1,197 @@
+package environments
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdctx"
+	libslocalenv "github.com/databricks/cli/libs/localenv"
+	"github.com/databricks/cli/libs/telemetry"
+	"github.com/databricks/cli/libs/telemetry/protos"
+	"github.com/databricks/cli/libs/testserver"
+	"github.com/databricks/databricks-sdk-go/config"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestBuildSetupLocalEvent(t *testing.T) {
+	t.Run("dry-run emits no event", func(t *testing.T) {
+		res := &libslocalenv.Result{DryRun: true, OK: true}
+		assert.Nil(t, buildSetupLocalEvent(res))
+	})
+
+	t.Run("nil result emits no event", func(t *testing.T) {
+		assert.Nil(t, buildSetupLocalEvent(nil))
+	})
+
+	t.Run("success run maps fields", func(t *testing.T) {
+		res := &libslocalenv.Result{
+			OK:         true,
+			Mode:       libslocalenv.ModeDefault.String(),
+			Greenfield: true,
+			Compute:    &libslocalenv.ComputeInfo{Source: "serverless", EnvKey: "serverless/serverless-v5"},
+		}
+		got := buildSetupLocalEvent(res)
+		assert.Equal(t, &protos.SetupLocalEvent{
+			Success:       true,
+			ComputeSource: protos.SetupLocalComputeSourceServerless,
+			Mode:          protos.SetupLocalModeDefault,
+			Greenfield:    true,
+			EnvKey:        "serverless/serverless-v5",
+		}, got)
+	})
+
+	t.Run("failure run maps error code, phase, diskMutated", func(t *testing.T) {
+		res := &libslocalenv.Result{
+			OK:      false,
+			Mode:    libslocalenv.ModeConstraintsOnly.String(),
+			Compute: &libslocalenv.ComputeInfo{Source: "cluster", EnvKey: "dbr/16.4"},
+			Error: &libslocalenv.PipelineError{
+				Code:         libslocalenv.ErrProvision,
+				FailurePhase: libslocalenv.PhaseProvision,
+				DiskMutated:  true,
+			},
+		}
+		got := buildSetupLocalEvent(res)
+		assert.Equal(t, &protos.SetupLocalEvent{
+			Success:       false,
+			ComputeSource: protos.SetupLocalComputeSourceCluster,
+			Mode:          protos.SetupLocalModeConstraintsOnly,
+			EnvKey:        "dbr/16.4",
+			ErrorCode:     protos.SetupLocalErrorCodeProvision,
+			FailurePhase:  protos.SetupLocalPhaseProvision,
+			DiskMutated:   true,
+		}, got)
+	})
+
+	t.Run("no-constraints run records skipConstraints", func(t *testing.T) {
+		res := &libslocalenv.Result{
+			OK:              true,
+			Mode:            libslocalenv.ModeDefault.String(),
+			SkipConstraints: true,
+			Compute:         &libslocalenv.ComputeInfo{Source: "cluster", EnvKey: "dbr/16.4"},
+		}
+		got := buildSetupLocalEvent(res)
+		assert.True(t, got.SkipConstraints)
+	})
+
+	t.Run("run without --no-constraints leaves skipConstraints false", func(t *testing.T) {
+		res := &libslocalenv.Result{
+			OK:      true,
+			Mode:    libslocalenv.ModeDefault.String(),
+			Compute: &libslocalenv.ComputeInfo{Source: "cluster", EnvKey: "dbr/16.4"},
+		}
+		got := buildSetupLocalEvent(res)
+		assert.False(t, got.SkipConstraints)
+	})
+
+	t.Run("nil compute leaves source and envKey empty", func(t *testing.T) {
+		res := &libslocalenv.Result{
+			OK:    false,
+			Mode:  libslocalenv.ModeDefault.String(),
+			Error: &libslocalenv.PipelineError{Code: libslocalenv.ErrNoTarget, FailurePhase: libslocalenv.PhaseResolve},
+		}
+		got := buildSetupLocalEvent(res)
+		assert.Equal(t, protos.SetupLocalComputeSourceUnspecified, got.ComputeSource)
+		assert.Empty(t, got.EnvKey)
+		assert.Equal(t, protos.SetupLocalErrorCodeNoTarget, got.ErrorCode)
+	})
+}
+
+// TestErrorCodeCoversLocalenv asserts every localenv.ErrorCode maps to a
+// non-unspecified telemetry enum. Completeness of the switch itself is enforced
+// by the exhaustive linter (errorCodeType has no default); this test additionally
+// catches a case that maps to UNSPECIFIED by mistake. Keep this list in sync with
+// the const block in libs/localenv/result.go.
+func TestErrorCodeCoversLocalenv(t *testing.T) {
+	all := []libslocalenv.ErrorCode{
+		libslocalenv.ErrUsage,
+		libslocalenv.ErrManagerUnsupported,
+		libslocalenv.ErrNotWritable,
+		libslocalenv.ErrUvMissing,
+		libslocalenv.ErrNoTarget,
+		libslocalenv.ErrResolve,
+		libslocalenv.ErrEnvUnsupported,
+		libslocalenv.ErrFetch,
+		libslocalenv.ErrWrite,
+		libslocalenv.ErrMerge,
+		libslocalenv.ErrPythonInstall,
+		libslocalenv.ErrProvision,
+		libslocalenv.ErrProvisionConflict,
+		libslocalenv.ErrValidate,
+		libslocalenv.ErrCanceled,
+	}
+	for _, code := range all {
+		assert.NotEqualf(t, protos.SetupLocalErrorCodeUnspecified, errorCodeType(code),
+			"error code %q has no telemetry enum: add a case to errorCodeType and a "+
+				"value to SetupLocalErrorCode (setup_local.go + universe proto)", code)
+	}
+}
+
+// TestPhaseCoversLocalenv asserts every localenv.PhaseName maps to a
+// non-unspecified telemetry enum. As with TestErrorCodeCoversLocalenv, switch
+// completeness is enforced by the exhaustive linter; this guards against a case
+// mapping to UNSPECIFIED by mistake.
+func TestPhaseCoversLocalenv(t *testing.T) {
+	all := []libslocalenv.PhaseName{
+		libslocalenv.PhasePreflight,
+		libslocalenv.PhaseResolve,
+		libslocalenv.PhaseFetch,
+		libslocalenv.PhaseMerge,
+		libslocalenv.PhaseProvision,
+		libslocalenv.PhaseValidate,
+	}
+	for _, phase := range all {
+		assert.NotEqualf(t, protos.SetupLocalPhaseUnspecified, phaseType(phase),
+			"phase %q has no telemetry enum: add a case to phaseType and a value to "+
+				"SetupLocalPhase (setup_local.go + universe proto)", phase)
+	}
+}
+
+func TestLogSetupLocalEventRoundTrip(t *testing.T) {
+	t.Run("real run uploads one setup_local_event", func(t *testing.T) {
+		server := testserver.New(t)
+		t.Cleanup(server.Close)
+
+		var bodies []telemetry.RequestBody
+		server.Handle("POST", "/telemetry-ext", func(req testserver.Request) any {
+			var body telemetry.RequestBody
+			require.NoError(t, json.Unmarshal(req.Body, &body))
+			bodies = append(bodies, body)
+			return telemetry.ResponseBody{NumProtoSuccess: int64(len(body.ProtoLogs))}
+		})
+
+		ctx := telemetry.WithNewLogger(t.Context())
+		logSetupLocalEvent(ctx, &libslocalenv.Result{
+			OK:      true,
+			Mode:    libslocalenv.ModeDefault.String(),
+			Compute: &libslocalenv.ComputeInfo{Source: "serverless", EnvKey: "serverless/serverless-v5"},
+		})
+
+		ctx = cmdctx.SetConfigUsed(ctx, &config.Config{Host: server.URL, Token: "token"})
+		require.NoError(t, telemetry.Upload(ctx, protos.ExecutionContext{}))
+
+		require.Len(t, bodies, 1)
+		require.Len(t, bodies[0].ProtoLogs, 1)
+		assert.Contains(t, bodies[0].ProtoLogs[0], `"setup_local_event"`)
+		assert.Contains(t, bodies[0].ProtoLogs[0], `"env_key":"serverless/serverless-v5"`)
+	})
+
+	t.Run("dry-run buffers nothing to upload", func(t *testing.T) {
+		called := false
+		server := testserver.New(t)
+		t.Cleanup(server.Close)
+		server.Handle("POST", "/telemetry-ext", func(req testserver.Request) any {
+			called = true
+			return telemetry.ResponseBody{}
+		})
+
+		ctx := telemetry.WithNewLogger(t.Context())
+		logSetupLocalEvent(ctx, &libslocalenv.Result{DryRun: true, OK: true})
+
+		ctx = cmdctx.SetConfigUsed(ctx, &config.Config{Host: server.URL, Token: "token"})
+		// Upload no-ops when the buffer is empty, so the endpoint is never hit.
+		require.NoError(t, telemetry.Upload(ctx, protos.ExecutionContext{}))
+		assert.False(t, called, "dry-run must not upload any telemetry")
+	})
+}
diff --git a/cmd/experimental/air.go b/cmd/experimental/air.go
new file mode 100644
index 00000000000..d237224217b
--- /dev/null
+++ b/cmd/experimental/air.go
@@ -0,0 +1,18 @@
+package experimental
+
+import (
+	"errors"
+
+	"github.com/spf13/cobra"
+)
+
+func newAirCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:                "air",
+		Hidden:             true,
+		DisableFlagParsing: true,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			return errors.New(`the AIR commands have moved out of experimental; use "databricks air" instead`)
+		},
+	}
+}
diff --git a/cmd/experimental/air_test.go b/cmd/experimental/air_test.go
new file mode 100644
index 00000000000..ddc5b1e67cc
--- /dev/null
+++ b/cmd/experimental/air_test.go
@@ -0,0 +1,17 @@
+package experimental
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAirCommandMovedOutOfExperimental(t *testing.T) {
+	cmd := newAirCmd()
+	assert.True(t, cmd.Hidden)
+	assert.True(t, cmd.DisableFlagParsing)
+
+	err := cmd.RunE(cmd, []string{"run", "--file", "run.yaml"})
+	require.EqualError(t, err, `the AIR commands have moved out of experimental; use "databricks air" instead`)
+}
diff --git a/cmd/experimental/experimental.go b/cmd/experimental/experimental.go
index 52c6bac79b0..45349fcd29b 100644
--- a/cmd/experimental/experimental.go
+++ b/cmd/experimental/experimental.go
@@ -13,15 +13,17 @@ func New() *cobra.Command {
 		Hidden: true,
 		Long: `Experimental commands that may change in future versions.
 
-╔════════════════════════════════════════════════════════════════╗
-║  ⚠️  EXPERIMENTAL: These commands may change in future versions ║
-╚════════════════════════════════════════════════════════════════╝
+╔══════════════════════════════════════════════════════════════════╗
+║  🚧  EXPERIMENTAL: These commands may change in future versions  ║
+╚══════════════════════════════════════════════════════════════════╝
 
 These commands provide early access to new features that are still under
 development. They may change or be removed in future versions without notice.`,
 	}
 
+	cmd.AddCommand(newAirCmd())
 	cmd.AddCommand(aitoolscmd.NewAitoolsCmd())
+	cmd.AddCommand(newGenieCmd())
 	cmd.AddCommand(postgrescmd.New())
 	cmd.AddCommand(newWorkspaceOpenCommand())
 
diff --git a/cmd/experimental/genie.go b/cmd/experimental/genie.go
new file mode 100644
index 00000000000..a9e6fe0d146
--- /dev/null
+++ b/cmd/experimental/genie.go
@@ -0,0 +1,23 @@
+package experimental
+
+import (
+	geniecmd "github.com/databricks/cli/cmd/genie"
+	"github.com/spf13/cobra"
+)
+
+// newGenieCmd keeps the deprecated `experimental genie ask` path working after
+// the command was promoted to `databricks genie ask`. It reuses the relocated
+// builder and marks the subcommand deprecated so callers get a move notice.
+func newGenieCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:    "genie",
+		Short:  "Ask data questions via Databricks Genie",
+		Hidden: true,
+	}
+
+	ask := geniecmd.NewAskCmd()
+	ask.Deprecated = `use "databricks genie ask" instead; this experimental alias will be removed in a future release`
+	cmd.AddCommand(ask)
+
+	return cmd
+}
diff --git a/cmd/experimental/workspace_open.go b/cmd/experimental/workspace_open.go
index e48bdcc6d96..b6d05e71fc6 100644
--- a/cmd/experimental/workspace_open.go
+++ b/cmd/experimental/workspace_open.go
@@ -8,6 +8,7 @@ import (
 	"github.com/spf13/cobra"
 
 	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/auth"
 	"github.com/databricks/cli/libs/browser"
 	"github.com/databricks/cli/libs/cmdctx"
 	"github.com/databricks/cli/libs/cmdio"
@@ -15,8 +16,8 @@ import (
 	"github.com/databricks/cli/libs/workspaceurls"
 )
 
-var currentWorkspaceID = func(ctx context.Context) (int64, error) {
-	return cmdctx.WorkspaceClient(ctx).CurrentWorkspaceID(ctx)
+var resolveWorkspaceID = func(ctx context.Context) (string, error) {
+	return auth.ResolveWorkspaceID(ctx, cmdctx.WorkspaceClient(ctx))
 }
 
 var openWorkspaceURL = browser.Open
@@ -49,7 +50,7 @@ Examples:
 			resourceType := args[0]
 			id := args[1]
 
-			workspaceID, err := currentWorkspaceID(ctx)
+			workspaceID, err := resolveWorkspaceID(ctx)
 			if err != nil {
 				log.Warnf(ctx, "Could not determine workspace ID: %v", err)
 			}
diff --git a/cmd/experimental/workspace_open_test.go b/cmd/experimental/workspace_open_test.go
index 7ec8e937ece..91aa6d07f63 100644
--- a/cmd/experimental/workspace_open_test.go
+++ b/cmd/experimental/workspace_open_test.go
@@ -34,11 +34,12 @@ func TestBuildWorkspaceURLPathBasedResources(t *testing.T) {
 		{"apps", "my-app", "https://myworkspace.databricks.com/apps/my-app"},
 		{"clusters", "0123-456789-abc", "https://myworkspace.databricks.com/compute/clusters/0123-456789-abc"},
 		{"registered_models", "catalog.schema.model", "https://myworkspace.databricks.com/explore/data/models/catalog/schema/model"},
+		{"features", "catalog.schema.feature", "https://myworkspace.databricks.com/explore/data/features/catalog/schema/feature"},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.resourceType+"/"+tt.id, func(t *testing.T) {
-			got, err := workspaceurls.BuildResourceURL("https://myworkspace.databricks.com", tt.resourceType, tt.id, 0)
+			got, err := workspaceurls.BuildResourceURL("https://myworkspace.databricks.com", tt.resourceType, tt.id, "")
 			require.NoError(t, err)
 			assert.Equal(t, tt.expected, got)
 		})
@@ -57,7 +58,7 @@ func TestBuildWorkspaceURLFragmentBasedResources(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.id, func(t *testing.T) {
-			got, err := workspaceurls.BuildResourceURL("https://myworkspace.databricks.com", tt.resourceType, tt.id, 0)
+			got, err := workspaceurls.BuildResourceURL("https://myworkspace.databricks.com", tt.resourceType, tt.id, "")
 			require.NoError(t, err)
 			assert.Equal(t, tt.expected, got)
 		})
@@ -65,40 +66,40 @@ func TestBuildWorkspaceURLFragmentBasedResources(t *testing.T) {
 }
 
 func TestBuildWorkspaceURLUnknownResourceType(t *testing.T) {
-	_, err := workspaceurls.BuildResourceURL("https://myworkspace.databricks.com", "unknown", "123", 0)
+	_, err := workspaceurls.BuildResourceURL("https://myworkspace.databricks.com", "unknown", "123", "")
 	assert.ErrorContains(t, err, "unknown resource type \"unknown\"")
-	assert.ErrorContains(t, err, "alerts, apps, clusters, dashboards, experiments, jobs, model_serving_endpoints, models, notebooks, pipelines, queries, registered_models, warehouses")
+	assert.ErrorContains(t, err, "alerts, apps, catalogs, cluster_policies, clusters, dashboards, database_catalogs, database_instances, experiments, features, genie_spaces, instance_pools, jobs, mcp_services, model_provider_services, model_services, model_serving_endpoints, models, notebooks, pipelines, postgres_catalogs, postgres_synced_tables, quality_monitors, queries, registered_models, schemas, secrets, synced_database_tables, vector_search_endpoints, vector_search_indexes, volumes, warehouses")
 }
 
 func TestBuildWorkspaceURLHostWithTrailingSlash(t *testing.T) {
-	got, err := workspaceurls.BuildResourceURL("https://myworkspace.databricks.com/", "jobs", "123", 0)
+	got, err := workspaceurls.BuildResourceURL("https://myworkspace.databricks.com/", "jobs", "123", "")
 	require.NoError(t, err)
 	assert.Equal(t, "https://myworkspace.databricks.com/jobs/123", got)
 }
 
 func TestBuildWorkspaceURLWithWorkspaceID(t *testing.T) {
-	got, err := workspaceurls.BuildResourceURL("https://myworkspace.databricks.com", "jobs", "123", 123456)
+	got, err := workspaceurls.BuildResourceURL("https://myworkspace.databricks.com", "jobs", "123", "123456")
 	require.NoError(t, err)
-	assert.Equal(t, "https://myworkspace.databricks.com/jobs/123?o=123456", got)
+	assert.Equal(t, "https://myworkspace.databricks.com/jobs/123?w=123456", got)
 }
 
 func TestBuildWorkspaceURLWithWorkspaceIDInHostname(t *testing.T) {
-	got, err := workspaceurls.BuildResourceURL("https://adb-123456.azuredatabricks.net", "jobs", "123", 123456)
+	got, err := workspaceurls.BuildResourceURL("https://adb-123456.azuredatabricks.net", "jobs", "123", "123456")
 	require.NoError(t, err)
-	// Workspace ID is already in the hostname, so ?o= should not be appended.
+	// Workspace ID is already in the hostname, so ?w= should not be appended.
 	assert.Equal(t, "https://adb-123456.azuredatabricks.net/jobs/123", got)
 }
 
 func TestBuildWorkspaceURLWithWorkspaceIDInVanityHostname(t *testing.T) {
-	got, err := workspaceurls.BuildResourceURL("https://workspace-123456.example.com", "jobs", "123", 123456)
+	got, err := workspaceurls.BuildResourceURL("https://workspace-123456.example.com", "jobs", "123", "123456")
 	require.NoError(t, err)
-	assert.Equal(t, "https://workspace-123456.example.com/jobs/123?o=123456", got)
+	assert.Equal(t, "https://workspace-123456.example.com/jobs/123?w=123456", got)
 }
 
 func TestBuildWorkspaceURLFragmentWithWorkspaceID(t *testing.T) {
-	got, err := workspaceurls.BuildResourceURL("https://myworkspace.databricks.com", "notebooks", "12345", 789)
+	got, err := workspaceurls.BuildResourceURL("https://myworkspace.databricks.com", "notebooks", "12345", "789")
 	require.NoError(t, err)
-	assert.Equal(t, "https://myworkspace.databricks.com/?o=789#notebook/12345", got)
+	assert.Equal(t, "https://myworkspace.databricks.com/?w=789#notebook/12345", got)
 }
 
 func TestWorkspaceOpenCommandCompletion(t *testing.T) {
@@ -106,20 +107,40 @@ func TestWorkspaceOpenCommandCompletion(t *testing.T) {
 
 	completions, directive := cmd.ValidArgsFunction(cmd, []string{}, "")
 	assert.Equal(t, cobra.ShellCompDirectiveNoFileComp, directive)
-	assert.Contains(t, completions, "alerts")
-	assert.Contains(t, completions, "apps")
-	assert.Contains(t, completions, "clusters")
-	assert.Contains(t, completions, "dashboards")
-	assert.Contains(t, completions, "experiments")
-	assert.Contains(t, completions, "jobs")
-	assert.Contains(t, completions, "models")
-	assert.Contains(t, completions, "model_serving_endpoints")
-	assert.Contains(t, completions, "notebooks")
-	assert.Contains(t, completions, "pipelines")
-	assert.Contains(t, completions, "queries")
-	assert.Contains(t, completions, "registered_models")
-	assert.Contains(t, completions, "warehouses")
-	assert.Len(t, completions, 13)
+	assert.Equal(t, []string{
+		"alerts",
+		"apps",
+		"catalogs",
+		"cluster_policies",
+		"clusters",
+		"dashboards",
+		"database_catalogs",
+		"database_instances",
+		"experiments",
+		"features",
+		"genie_spaces",
+		"instance_pools",
+		"jobs",
+		"mcp_services",
+		"model_provider_services",
+		"model_services",
+		"model_serving_endpoints",
+		"models",
+		"notebooks",
+		"pipelines",
+		"postgres_catalogs",
+		"postgres_synced_tables",
+		"quality_monitors",
+		"queries",
+		"registered_models",
+		"schemas",
+		"secrets",
+		"synced_database_tables",
+		"vector_search_endpoints",
+		"vector_search_indexes",
+		"volumes",
+		"warehouses",
+	}, completions)
 }
 
 func TestWorkspaceOpenCommandCompletionSecondArg(t *testing.T) {
@@ -133,7 +154,7 @@ func TestWorkspaceOpenCommandCompletionSecondArg(t *testing.T) {
 func TestWorkspaceOpenCommandHelpText(t *testing.T) {
 	cmd := newWorkspaceOpenCommand()
 
-	assert.Contains(t, cmd.Long, "Supported resource types: alerts, apps, clusters, dashboards, experiments, jobs, model_serving_endpoints, models, notebooks, pipelines, queries, registered_models, warehouses.")
+	assert.Contains(t, cmd.Long, "Supported resource types: alerts, apps, catalogs, cluster_policies, clusters, dashboards, database_catalogs, database_instances, experiments, features, genie_spaces, instance_pools, jobs, mcp_services, model_provider_services, model_services, model_serving_endpoints, models, notebooks, pipelines, postgres_catalogs, postgres_synced_tables, quality_monitors, queries, registered_models, schemas, secrets, synced_database_tables, vector_search_endpoints, vector_search_indexes, volumes, warehouses.")
 	assert.Contains(t, cmd.Long, "databricks experimental open jobs 123456789")
 	assert.Contains(t, cmd.Long, "databricks experimental open notebooks /Users/user@example.com/my-notebook")
 	assert.Contains(t, cmd.Long, "databricks experimental open registered_models catalog.schema.my_model")
@@ -146,15 +167,15 @@ func TestWorkspaceOpenCommandHelpText(t *testing.T) {
 }
 
 func TestWorkspaceOpenCommandOpensBrowserByDefault(t *testing.T) {
-	originalCurrentWorkspaceID := currentWorkspaceID
+	originalResolveWorkspaceID := resolveWorkspaceID
 	originalOpenWorkspaceURL := openWorkspaceURL
 	t.Cleanup(func() {
-		currentWorkspaceID = originalCurrentWorkspaceID
+		resolveWorkspaceID = originalResolveWorkspaceID
 		openWorkspaceURL = originalOpenWorkspaceURL
 	})
 
-	currentWorkspaceID = func(context.Context) (int64, error) {
-		return 0, nil
+	resolveWorkspaceID = func(context.Context) (string, error) {
+		return "", nil
 	}
 
 	var gotURL string
@@ -180,20 +201,20 @@ func TestWorkspaceOpenCommandOpensBrowserByDefault(t *testing.T) {
 	require.NoError(t, err)
 
 	assert.Equal(t, "https://myworkspace.databricks.com/jobs/123", gotURL)
-	assert.Equal(t, "", stdout.String())
+	assert.Empty(t, stdout.String())
 	assert.Contains(t, stderr.String(), "Opening jobs 123 in the browser...")
 }
 
 func TestWorkspaceOpenCommandURLFlag(t *testing.T) {
-	originalCurrentWorkspaceID := currentWorkspaceID
+	originalResolveWorkspaceID := resolveWorkspaceID
 	originalOpenWorkspaceURL := openWorkspaceURL
 	t.Cleanup(func() {
-		currentWorkspaceID = originalCurrentWorkspaceID
+		resolveWorkspaceID = originalResolveWorkspaceID
 		openWorkspaceURL = originalOpenWorkspaceURL
 	})
 
-	currentWorkspaceID = func(context.Context) (int64, error) {
-		return 789, nil
+	resolveWorkspaceID = func(context.Context) (string, error) {
+		return "789", nil
 	}
 
 	browserOpened := false
@@ -221,20 +242,20 @@ func TestWorkspaceOpenCommandURLFlag(t *testing.T) {
 	require.NoError(t, err)
 
 	assert.False(t, browserOpened)
-	assert.Equal(t, "https://myworkspace.databricks.com/jobs/123?o=789\n", stdout.String())
-	assert.Equal(t, "", stderr.String())
+	assert.Equal(t, "https://myworkspace.databricks.com/jobs/123?w=789\n", stdout.String())
+	assert.Empty(t, stderr.String())
 }
 
 func TestWorkspaceOpenCommandWarnsWhenWorkspaceIDLookupFails(t *testing.T) {
-	originalCurrentWorkspaceID := currentWorkspaceID
+	originalResolveWorkspaceID := resolveWorkspaceID
 	originalOpenWorkspaceURL := openWorkspaceURL
 	t.Cleanup(func() {
-		currentWorkspaceID = originalCurrentWorkspaceID
+		resolveWorkspaceID = originalResolveWorkspaceID
 		openWorkspaceURL = originalOpenWorkspaceURL
 	})
 
-	currentWorkspaceID = func(context.Context) (int64, error) {
-		return 0, errors.New("lookup failed")
+	resolveWorkspaceID = func(context.Context) (string, error) {
+		return "", errors.New("lookup failed")
 	}
 
 	openWorkspaceURL = func(ctx context.Context, targetURL string) error {
diff --git a/cmd/fs/cat.go b/cmd/fs/cat.go
index 28df80d70df..c9d23c99d57 100644
--- a/cmd/fs/cat.go
+++ b/cmd/fs/cat.go
@@ -10,7 +10,7 @@ func newCatCommand() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:     "cat FILE_PATH",
 		Short:   "Show file content.",
-		Long:    `Show the contents of a file in DBFS or a UC Volume.`,
+		Long:    `Show the contents of a file in DBFS, a UC Volume or a UC Skill.`,
 		Args:    root.ExactArgs(1),
 		PreRunE: root.MustWorkspaceClient,
 	}
diff --git a/cmd/fs/cp.go b/cmd/fs/cp.go
index d7ae6517539..734faaeb996 100644
--- a/cmd/fs/cp.go
+++ b/cmd/fs/cp.go
@@ -18,9 +18,10 @@ import (
 	"golang.org/x/sync/errgroup"
 )
 
-// Default number of concurrent file copy operations. This is a conservative
-// default that should be sufficient to fully utilize the available bandwidth
-// in most cases.
+// defaultConcurrency is the number of files copied in parallel. Each in-flight
+// file drives Files API requests (a single-shot PUT, or the multipart
+// control-plane calls), which allow only ~10 concurrent requests, so this stays
+// conservative regardless of whether multipart upload is enabled.
 const defaultConcurrency = 8
 
 // errInvalidConcurrency is returned when the value of the concurrency
@@ -37,6 +38,11 @@ type copy struct {
 	sourceScheme string
 	targetScheme string
 
+	// showProgress renders an upload progress bar. It is set only for a single
+	// large-file copy to a Volume, not for recursive copies (where many files
+	// would each fight for the spinner line).
+	showProgress bool
+
 	mu sync.Mutex // protect output from concurrent writes
 }
 
@@ -123,20 +129,31 @@ func (c *copy) cpFileToFile(ctx context.Context, sourcePath, targetPath string)
 	}
 	defer r.Close()
 
+	// For a single large-file copy, attach a progress callback to the context
+	// that the Files filer forwards to the upload engine, rendering an upload bar.
+	// The spinner is stopped before any event line is emitted so its final frame
+	// does not overwrite it.
+	closeProgress := func() {}
+	if c.showProgress {
+		fn, stop := newProgressFunc(ctx)
+		ctx = filer.WithUploadProgress(ctx, fn)
+		closeProgress = stop
+	}
+
+	var writeErr error
 	if c.overwrite {
-		err = c.targetFiler.Write(ctx, targetPath, r, filer.OverwriteIfExists)
-		if err != nil {
-			return err
-		}
+		writeErr = c.targetFiler.Write(ctx, targetPath, r, filer.OverwriteIfExists)
 	} else {
-		err = c.targetFiler.Write(ctx, targetPath, r)
-		// skip if file already exists
-		if err != nil && errors.Is(err, fs.ErrExist) {
-			return c.emitFileSkippedEvent(ctx, sourcePath, targetPath)
-		}
-		if err != nil {
-			return err
-		}
+		writeErr = c.targetFiler.Write(ctx, targetPath, r)
+	}
+	closeProgress()
+
+	// skip if file already exists
+	if !c.overwrite && writeErr != nil && errors.Is(writeErr, fs.ErrExist) {
+		return c.emitFileSkippedEvent(ctx, sourcePath, targetPath)
+	}
+	if writeErr != nil {
+		return writeErr
 	}
 	return c.emitFileCopiedEvent(ctx, sourcePath, targetPath)
 }
@@ -193,9 +210,9 @@ func newCpCommand() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "cp SOURCE_PATH TARGET_PATH",
 		Short: "Copy files and directories.",
-		Long: `Copy files and directories to and from any paths on DBFS, UC Volumes or your local filesystem.
+		Long: `Copy files and directories to and from any paths on DBFS, UC Volumes, UC Skills or your local filesystem.
 
-	  For paths in DBFS and UC Volumes, it is required that you specify the "dbfs" scheme.
+	  For paths in DBFS, UC Volumes and UC Skills, it is required that you specify the "dbfs" scheme.
 	  For example: dbfs:/foo/bar.
 
 	  Recursively copying a directory will copy all files inside directory
@@ -229,7 +246,7 @@ func newCpCommand() *cobra.Command {
 			return err
 		}
 
-		// Get target filer and target path without scheme
+		// Get target filer and target path without scheme.
 		fullTargetPath := args[1]
 		targetFiler, targetPath, err := filerForPath(ctx, fullTargetPath)
 		if err != nil {
@@ -259,6 +276,10 @@ func newCpCommand() *cobra.Command {
 			return c.cpDirToDir(ctx, sourcePath, targetPath)
 		}
 
+		// A single large file copied to a Volume goes through the multipart engine,
+		// which reports progress; render an upload bar for it.
+		c.showProgress = filer.MultipartUploadEnabled(ctx) && strings.HasPrefix(targetPath, "/Volumes/")
+
 		// If target path has a trailing separator, trim it and let case 2 handle it
 		if hasTrailingDirSeparator(fullTargetPath) {
 			targetPath = trimTrailingDirSeparators(targetPath)
diff --git a/cmd/fs/fs.go b/cmd/fs/fs.go
index 1f36696a65a..074bd31a64c 100644
--- a/cmd/fs/fs.go
+++ b/cmd/fs/fs.go
@@ -8,7 +8,7 @@ func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:     "fs",
 		Short:   "Filesystem related commands",
-		Long:    `Commands to do file system operations on DBFS and UC Volumes.`,
+		Long:    `Commands to do file system operations on DBFS, UC Volumes and UC Skills.`,
 		GroupID: "workspace",
 	}
 
diff --git a/cmd/fs/helpers.go b/cmd/fs/helpers.go
index 54d9463ed91..d2e98563314 100644
--- a/cmd/fs/helpers.go
+++ b/cmd/fs/helpers.go
@@ -38,9 +38,9 @@ func filerForPath(ctx context.Context, fullPath string) (filer.Filer, string, er
 	path := parts[1]
 	w := cmdctx.WorkspaceClient(ctx)
 
-	// If the specified path has the "Volumes" prefix, use the Files API.
-	if strings.HasPrefix(path, "/Volumes/") {
-		f, err := filer.NewFilesClient(w, "/")
+	// If the specified path has the "Volumes" or "Skills" prefix, use the Files API.
+	if strings.HasPrefix(path, "/Volumes/") || strings.HasPrefix(path, "/Skills/") {
+		f, err := filer.NewFilesClient(ctx, w, "/")
 		return f, path, err
 	}
 
diff --git a/cmd/fs/helpers_test.go b/cmd/fs/helpers_test.go
index d0ccdd4a209..ee1a88e23fb 100644
--- a/cmd/fs/helpers_test.go
+++ b/cmd/fs/helpers_test.go
@@ -9,6 +9,7 @@ import (
 	"github.com/databricks/cli/libs/cmdctx"
 	"github.com/databricks/cli/libs/fakefs"
 	"github.com/databricks/cli/libs/filer"
+	databrickscfg "github.com/databricks/databricks-sdk-go/config"
 	"github.com/databricks/databricks-sdk-go/experimental/mocks"
 	"github.com/spf13/cobra"
 	"github.com/stretchr/testify/assert"
@@ -41,6 +42,31 @@ func TestFilerForPathForInvalidScheme(t *testing.T) {
 	assert.ErrorContains(t, err, "invalid scheme")
 }
 
+func TestFilerForPathForDbfsScheme(t *testing.T) {
+	tcases := []struct {
+		fullPath string
+		path     string
+		filer    filer.Filer
+	}{
+		{"dbfs:/Volumes/foo/bar/baz", "/Volumes/foo/bar/baz", &filer.FilesClient{}},
+		{"dbfs:/Skills/foo/bar/baz", "/Skills/foo/bar/baz", &filer.FilesClient{}},
+		{"dbfs:/foo/bar/baz", "/foo/bar/baz", &filer.DbfsClient{}},
+	}
+
+	for _, tc := range tcases {
+		t.Run(tc.fullPath, func(t *testing.T) {
+			m := mocks.NewMockWorkspaceClient(t)
+			m.WorkspaceClient.Config = &databrickscfg.Config{}
+			ctx := cmdctx.SetWorkspaceClient(t.Context(), m.WorkspaceClient)
+
+			f, path, err := filerForPath(ctx, tc.fullPath)
+			require.NoError(t, err)
+			assert.Equal(t, tc.path, path)
+			assert.IsType(t, tc.filer, f)
+		})
+	}
+}
+
 func testWindowsFilerForPath(t *testing.T, ctx context.Context, fullPath string) {
 	f, path, err := filerForPath(ctx, fullPath)
 	assert.NoError(t, err)
diff --git a/cmd/fs/ls.go b/cmd/fs/ls.go
index 1e856a35e8d..c6151b8a27a 100644
--- a/cmd/fs/ls.go
+++ b/cmd/fs/ls.go
@@ -42,7 +42,7 @@ func newLsCommand() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:     "ls DIR_PATH",
 		Short:   "Lists files.",
-		Long:    `Lists files in DBFS and UC Volumes.`,
+		Long:    `Lists files in DBFS, UC Volumes and UC Skills.`,
 		Args:    root.ExactArgs(1),
 		PreRunE: root.MustWorkspaceClient,
 	}
diff --git a/cmd/fs/mkdir.go b/cmd/fs/mkdir.go
index 5e9ac784292..15faaad1569 100644
--- a/cmd/fs/mkdir.go
+++ b/cmd/fs/mkdir.go
@@ -12,7 +12,7 @@ func newMkdirCommand() *cobra.Command {
 		// is called databricks fs mkdirs in our legacy CLI: https://github.com/databricks/databricks-cli
 		Aliases: []string{"mkdirs"},
 		Short:   "Make directories.",
-		Long:    `Make directories in DBFS and UC Volumes. Mkdir will create directories along the path to the argument directory.`,
+		Long:    `Make directories in DBFS, UC Volumes and UC Skills. Mkdir will create directories along the path to the argument directory.`,
 		Args:    root.ExactArgs(1),
 		PreRunE: root.MustWorkspaceClient,
 	}
diff --git a/cmd/fs/rm.go b/cmd/fs/rm.go
index a133a83097b..8855e528804 100644
--- a/cmd/fs/rm.go
+++ b/cmd/fs/rm.go
@@ -10,7 +10,7 @@ func newRmCommand() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:     "rm PATH",
 		Short:   "Remove files and directories.",
-		Long:    `Remove files and directories from DBFS and UC Volumes.`,
+		Long:    `Remove files and directories from DBFS, UC Volumes and UC Skills.`,
 		Args:    root.ExactArgs(1),
 		PreRunE: root.MustWorkspaceClient,
 	}
diff --git a/cmd/fs/upload_progress.go b/cmd/fs/upload_progress.go
new file mode 100644
index 00000000000..a186fb5fa76
--- /dev/null
+++ b/cmd/fs/upload_progress.go
@@ -0,0 +1,256 @@
+package fs
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/charmbracelet/lipgloss"
+
+	"github.com/databricks/cli/libs/cmdio"
+	files "github.com/databricks/sdk-go/files/v2"
+)
+
+// renderThrottle caps how often the interactive bar is redrawn so a fast upload
+// does not spend its time repainting the terminal; completion always renders.
+const renderThrottle = 100 * time.Millisecond
+
+// preparingFrame is how long each "Preparing upload" dot frame is shown before
+// the upload reports its first completed part.
+const preparingFrame = 400 * time.Millisecond
+
+// barWidth keeps the rendered bar narrow enough that the whole progress line
+// stays on a single terminal row, so the spinner's in-place redraw is clean.
+const barWidth = 24
+
+// rateWindow is the trailing duration over which the transfer rate is averaged.
+// A few seconds smooths the burstiness of concurrent part completions while
+// still tracking genuine changes in throughput.
+const rateWindow = 5 * time.Second
+
+// Bar styling. Green for the filled portion matches the cmdio spinner glyph;
+// the remainder is dimmed.
+var (
+	barFilledStyle = lipgloss.NewStyle().Foreground(lipgloss.Color("10"))
+	barEmptyStyle  = lipgloss.NewStyle().Foreground(lipgloss.Color("240"))
+)
+
+// barBlocks are partial block glyphs for sub-character precision, so the bar
+// advances smoothly rather than in whole-cell jumps. Index 0 is a full cell
+// (8/8); index i is (8-i)/8 of a cell. Matches experimental/genie/agentstream.
+var barBlocks = []string{"█", "▉", "▊", "▋", "▌", "▍", "▎", "▏"}
+
+// humanBytes formats a byte count using binary (1024-based) units.
+func humanBytes(n int64) string {
+	const unit = 1024
+	if n < unit {
+		return fmt.Sprintf("%d B", n)
+	}
+	units := []string{"KiB", "MiB", "GiB", "TiB", "PiB"}
+	div, exp := int64(unit), 0
+	for n/div >= unit && exp < len(units)-1 {
+		div *= unit
+		exp++
+	}
+	return fmt.Sprintf("%.1f %s", float64(n)/float64(div), units[exp])
+}
+
+// formatSpeed formats a transfer rate in bytes per second.
+func formatSpeed(bytesPerSec float64) string {
+	if bytesPerSec < 0 {
+		bytesPerSec = 0
+	}
+	return humanBytes(int64(bytesPerSec)) + "/s"
+}
+
+// formatETA formats the estimated time remaining as MM:SS. It returns a
+// placeholder when the rate is unknown so the line does not show a misleading
+// estimate before any throughput has been measured.
+func formatETA(remaining int64, bytesPerSec float64) string {
+	if bytesPerSec <= 0 || remaining < 0 {
+		return "--:--"
+	}
+	secs := int(float64(remaining) / bytesPerSec)
+	return fmt.Sprintf("%02d:%02d", secs/60, secs%60)
+}
+
+// formatPlainProgress renders a single non-interactive progress line.
+func formatPlainProgress(p files.Progress) string {
+	if p.Total <= 0 {
+		return "Uploaded " + humanBytes(p.Transferred)
+	}
+	pct := int(float64(p.Transferred) / float64(p.Total) * 100)
+	return fmt.Sprintf("Uploaded %s / %s (%d%%)", humanBytes(p.Transferred), humanBytes(p.Total), pct)
+}
+
+// renderBar returns a fixed-width progress bar for the given completion ratio.
+// The total visible width is always barWidth: full cells, an optional partial
+// cell for the fractional remainder, then the dimmed empty track.
+func renderBar(ratio float64) string {
+	ratio = min(max(ratio, 0), 1)
+	exact := ratio * barWidth
+	full := int(exact)
+
+	filled := strings.Repeat("█", full)
+	partial := int((exact - float64(full)) * 8)
+	if partial > 0 && full < barWidth {
+		filled += barBlocks[8-partial]
+		full++ // the partial glyph occupies one cell of the track
+	}
+
+	return barFilledStyle.Render(filled) +
+		barEmptyStyle.Render(strings.Repeat("░", barWidth-full))
+}
+
+// rateSample is a cumulative byte count observed at a point in time.
+type rateSample struct {
+	at    time.Time
+	bytes int64
+}
+
+// rateMeter computes the transfer rate as a rolling average over a trailing
+// time window. Averaging over elapsed wall-clock time, rather than an
+// exponential moving average over samples, keeps the reported speed and the
+// ETA derived from it stable: the engine reports progress in irregular bursts
+// as concurrent parts complete, and a per-sample EMA spikes on every burst.
+// Callers pass the current time so the meter stays deterministic and
+// unit-testable.
+type rateMeter struct {
+	samples []rateSample
+}
+
+// observe records a cumulative byte count at now and returns the average
+// bytes/sec over the trailing rateWindow. It returns 0 until two samples span
+// a positive interval (the first sample, or one taken after a stall longer
+// than the window, leaves nothing to average against).
+func (m *rateMeter) observe(now time.Time, transferred int64) float64 {
+	// Drop samples that have aged out of the window, then record this one.
+	// Filtering in place reuses the backing array; at the render cadence the
+	// window holds at most a few dozen samples, so this stays cheap.
+	cutoff := now.Add(-rateWindow)
+	kept := m.samples[:0]
+	for _, s := range m.samples {
+		if !s.at.Before(cutoff) {
+			kept = append(kept, s)
+		}
+	}
+	m.samples = append(kept, rateSample{at: now, bytes: transferred})
+
+	oldest := m.samples[0]
+	dt := now.Sub(oldest.at).Seconds()
+	if dt <= 0 {
+		return 0
+	}
+	return float64(transferred-oldest.bytes) / dt
+}
+
+// progressRenderer builds the rich single-line progress string shown as the
+// spinner suffix in an interactive terminal.
+type progressRenderer struct {
+	meter rateMeter
+}
+
+// newProgressRenderer creates a renderer.
+func newProgressRenderer() *progressRenderer {
+	return &progressRenderer{}
+}
+
+// render returns the progress line for the given progress sample at time now.
+func (r *progressRenderer) render(now time.Time, p files.Progress) string {
+	rate := r.meter.observe(now, p.Transferred)
+	if p.Total <= 0 {
+		return fmt.Sprintf("%s  %s", humanBytes(p.Transferred), formatSpeed(rate))
+	}
+	ratio := float64(p.Transferred) / float64(p.Total)
+	return fmt.Sprintf("%s %.0f%%  %s/%s  %s  ETA %s",
+		renderBar(ratio), ratio*100,
+		humanBytes(p.Transferred), humanBytes(p.Total),
+		formatSpeed(rate), formatETA(p.Total-p.Transferred, rate))
+}
+
+// newProgressFunc returns the upload progress callback for the current terminal
+// and a function that stops it. In an interactive terminal it renders a rich
+// single-line bar via the spinner; otherwise it logs coarse progress so a long
+// upload still shows life. The returned stop function is idempotent (it is safe
+// to defer it and also call it before printing a summary line). The callback is
+// serialized by the engine, so its captured state needs no locking.
+func newProgressFunc(ctx context.Context) (files.ProgressFunc, func()) {
+	if cmdio.GetInteractiveMode(ctx) == cmdio.InteractiveModeNone {
+		nextPct := 10
+		fn := func(p files.Progress) {
+			// The final summary line covers completion; only log intermediate steps.
+			if p.Total <= 0 || p.Transferred >= p.Total {
+				return
+			}
+			pct := int(float64(p.Transferred) / float64(p.Total) * 100)
+			if pct < nextPct {
+				return
+			}
+			cmdio.LogString(ctx, formatPlainProgress(p))
+			for pct >= nextPct {
+				nextPct += 10
+			}
+		}
+		return fn, func() {}
+	}
+
+	sp := cmdio.NewSpinner(ctx, cmdio.WithElapsedTime())
+	r := newProgressRenderer()
+
+	// The callback first fires only when a part completes; session initiation, URL
+	// minting, and the first PUT take a beat, during which it never runs. Animate a
+	// "Preparing upload" label with cycling dots over that window so the spinner is
+	// not bare. mu serializes the animator's suffix updates with the callback's, and
+	// preparing gates the animator off once real progress arrives, so the bar
+	// replaces the label with no flicker.
+	var (
+		mu         sync.Mutex
+		preparing  = true
+		lastRender time.Time
+	)
+	prepCtx, stopPreparing := context.WithCancel(ctx)
+	prepDone := make(chan struct{})
+	go func() {
+		defer close(prepDone)
+		ticker := time.NewTicker(preparingFrame)
+		defer ticker.Stop()
+		for dots := 1; ; dots = dots%3 + 1 {
+			mu.Lock()
+			if !preparing {
+				mu.Unlock()
+				return
+			}
+			sp.Update("Preparing upload" + strings.Repeat(".", dots))
+			mu.Unlock()
+			select {
+			case <-prepCtx.Done():
+				return
+			case <-ticker.C:
+			}
+		}
+	}()
+
+	fn := func(p files.Progress) {
+		mu.Lock()
+		defer mu.Unlock()
+		if preparing {
+			preparing = false
+			stopPreparing() // first real progress: stop the animator, the bar takes over
+		}
+		now := time.Now()
+		if p.Total > 0 && p.Transferred < p.Total && now.Sub(lastRender) < renderThrottle {
+			return
+		}
+		lastRender = now
+		sp.Update(r.render(now, p))
+	}
+	// Stop the animator and wait for it to exit before closing the spinner, so no
+	// suffix update races the spinner shutdown.
+	return fn, func() {
+		stopPreparing()
+		<-prepDone
+		sp.Close()
+	}
+}
diff --git a/cmd/fs/upload_progress_test.go b/cmd/fs/upload_progress_test.go
new file mode 100644
index 00000000000..2786cf0fd40
--- /dev/null
+++ b/cmd/fs/upload_progress_test.go
@@ -0,0 +1,96 @@
+package fs
+
+import (
+	"testing"
+	"time"
+
+	"github.com/charmbracelet/lipgloss"
+)
+
+func TestRenderBarWidth(t *testing.T) {
+	// The bar must always occupy exactly barWidth cells regardless of ratio,
+	// including the partial-cell and out-of-range cases.
+	for _, ratio := range []float64{-0.5, 0, 0.0001, 0.123, 0.5, 0.52, 0.999, 1, 1.5} {
+		if w := lipgloss.Width(renderBar(ratio)); w != barWidth {
+			t.Errorf("renderBar(%v) width = %d, want %d", ratio, w, barWidth)
+		}
+	}
+}
+
+func TestRateMeter(t *testing.T) {
+	var m rateMeter
+	base := time.Unix(0, 0)
+
+	if got := m.observe(base, 0); got != 0 {
+		t.Fatalf("first observe = %v, want 0", got)
+	}
+	// A second sample at the same instant spans no interval to average over.
+	if got := m.observe(base, 1<<20); got != 0 {
+		t.Fatalf("zero-dt observe = %v, want 0 (no positive interval)", got)
+	}
+
+	// A steady 1 MiB/s stream averages to 1 MiB/s.
+	var rate float64
+	for i := 1; i <= 50; i++ {
+		rate = m.observe(base.Add(time.Duration(i)*time.Second), int64(i)<<20)
+	}
+	const want = float64(1 << 20)
+	if rate < want*0.99 || rate > want*1.01 {
+		t.Errorf("steady rate = %v, want ~%v", rate, want)
+	}
+}
+
+func TestRateMeterSmoothsBursts(t *testing.T) {
+	var m rateMeter
+	base := time.Unix(0, 0)
+
+	// Prime a steady 1 MiB/s stream over the full window.
+	for i := range 6 {
+		m.observe(base.Add(time.Duration(i)*time.Second), int64(i)<<20)
+	}
+
+	// A large part lands almost instantly: 5 MiB in 100ms. A per-sample EMA
+	// would read this as a ~50 MiB/s spike; the rolling window keeps the
+	// reported rate near the windowed throughput.
+	rate := m.observe(base.Add(5100*time.Millisecond), 10<<20)
+	if rate > 3<<20 {
+		t.Errorf("post-burst rate = %.0f B/s, want smoothed under %d B/s", rate, 3<<20)
+	}
+}
+
+func TestFormatSpeed(t *testing.T) {
+	cases := []struct {
+		bps  float64
+		want string
+	}{
+		{0, "0 B/s"},
+		{-5, "0 B/s"},
+		{512, "512 B/s"},
+		{48 << 20, "48.0 MiB/s"},
+	}
+	for _, tc := range cases {
+		if got := formatSpeed(tc.bps); got != tc.want {
+			t.Errorf("formatSpeed(%v) = %q, want %q", tc.bps, got, tc.want)
+		}
+	}
+}
+
+func TestFormatETA(t *testing.T) {
+	cases := []struct {
+		remaining int64
+		bps       float64
+		want      string
+	}{
+		{0, 0, "--:--"},
+		{1 << 20, 0, "--:--"},
+		{-1, 1 << 20, "--:--"},
+		{0, 1 << 20, "00:00"},
+		{1 << 20, 1 << 20, "00:01"},
+		{120 << 20, 1 << 20, "02:00"},
+	}
+	for _, tc := range cases {
+		if got := formatETA(tc.remaining, tc.bps); got != tc.want {
+			t.Errorf("formatETA(%d, %v) = %q, want %q", tc.remaining, tc.bps, got, tc.want)
+		}
+	}
+}
diff --git a/cmd/fuzz_panic_test.go b/cmd/fuzz_panic_test.go
index 4fb5d5b9d39..970ca17f0a8 100644
--- a/cmd/fuzz_panic_test.go
+++ b/cmd/fuzz_panic_test.go
@@ -198,6 +198,7 @@ func isAutoGenerated(leaf leafCommand) bool {
 	// "bundle", "auth", "sync", "fs", etc. The heuristic: anything whose
 	// root isn't in this block list is auto-generated.
 	manualRoots := map[string]bool{
+		"aitools":      true,
 		"bundle":       true,
 		"auth":         true,
 		"sync":         true,
@@ -208,6 +209,7 @@ func isAutoGenerated(leaf leafCommand) bool {
 		"configure":    true,
 		"experimental": true,
 		"labs":         true,
+		"sandbox":      true,
 		"pipelines":    true,
 		"psql":         true,
 		"selftest":     true,
diff --git a/cmd/genie/ask.go b/cmd/genie/ask.go
new file mode 100644
index 00000000000..0458024a195
--- /dev/null
+++ b/cmd/genie/ask.go
@@ -0,0 +1,135 @@
+package genie
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/signal"
+	"syscall"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/cli/libs/genie"
+	"github.com/databricks/cli/libs/genie/agentstream"
+	"github.com/spf13/cobra"
+)
+
+func NewAskCmd() *cobra.Command {
+	var warehouseID string
+	var raw bool
+	var includeSQL bool
+	var session string
+
+	cmd := &cobra.Command{
+		Use:   "ask QUESTION",
+		Short: "Ask a data question via Databricks Genie",
+		Long: `Ask a data question and get an answer from Databricks Genie.
+
+Examples:
+  databricks genie ask "What were total sales last month?"
+  databricks genie ask "What tables exist?" --output json
+  databricks genie ask "Revenue by region" --warehouse-id 1234567890abcdef
+  databricks genie ask "What tables exist?" --raw
+
+  # Continue a conversation across calls with a session id you choose:
+  databricks genie ask -s sales "What were total sales by quarter?"
+  databricks genie ask -s sales "Break that down by region"`,
+		Args: root.ExactArgs(1),
+		PreRunE: func(cmd *cobra.Command, args []string) error {
+			cmd.SetContext(root.SkipLoadBundle(cmd.Context()))
+			return root.MustWorkspaceClient(cmd, args)
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			// The CLI root doesn't cancel ctx on signals, so handle them here:
+			// SIGINT (Ctrl-C) and SIGTERM (kill — how an agent stops a child)
+			// cancel ctx, aborting the stream.
+			ctx, stop := signal.NotifyContext(cmd.Context(), os.Interrupt, syscall.SIGTERM)
+			defer stop()
+
+			outputType := root.OutputType(cmd)
+			if raw && outputType == flags.OutputJSON {
+				return errors.New("--raw cannot be used with --output json")
+			}
+			if raw && includeSQL {
+				return errors.New("--include-sql cannot be used with --raw")
+			}
+			if raw && session != "" {
+				// --raw doesn't parse a conversation id, so it can't be tracked.
+				fmt.Fprintln(cmd.ErrOrStderr(), "Warning: --session has no effect with --raw (the conversation is not tracked).")
+			}
+
+			w := cmdctx.WorkspaceClient(ctx)
+			host := w.Config.Host
+
+			// ask runs one request+render against serverID ("" starts a fresh
+			// conversation) and reports the conversation id from the response,
+			// whether anything reached stdout, and any error.
+			ask := func(serverID string) (id string, wrote bool, err error) {
+				body, err := genie.PostStream(ctx, w.Config, genie.BuildRequest(args[0], warehouseID, serverID))
+				if err != nil {
+					return "", false, err
+				}
+				defer body.Close()
+				switch {
+				case raw:
+					return "", true, agentstream.RenderDebug(body, cmd.OutOrStdout())
+				case outputType == flags.OutputJSON:
+					id, err := agentstream.RenderJSON(body, cmd.OutOrStdout(), cmd.ErrOrStderr(), genie.NewAdaptSSE())
+					return id, true, err
+				default:
+					opts := agentstream.RenderOptions{ShowSQL: includeSQL, Color: cmdio.SupportsColor(ctx, cmd.OutOrStdout())}
+					return agentstream.RenderText(ctx, body, cmd.OutOrStdout(), cmd.ErrOrStderr(), genie.NewAdaptSSE(), opts)
+				}
+			}
+
+			err := askWithConversation(ctx, cmd.ErrOrStderr(), host, session, ask)
+			switch {
+			case err != nil && ctx.Err() != nil:
+				// Interrupted (Ctrl-C / kill): aborting the request already told
+				// the server to stop.
+				fmt.Fprintln(cmd.ErrOrStderr(), "\nCancelled.")
+				return root.ErrAlreadyPrinted
+			case err != nil && errors.Is(err, context.Canceled):
+				// The SDK's inactivity timeout cancelled the body read while our
+				// own context is still alive: the stream stalled.
+				return fmt.Errorf("the response stream stalled (no data received for %d minutes): %w", genie.StreamingTimeoutSeconds/60, err)
+			default:
+				return err
+			}
+		},
+	}
+
+	cmd.Flags().StringVar(&warehouseID, "warehouse-id", "", "SQL warehouse ID (auto-resolves if omitted)")
+	cmd.Flags().BoolVar(&raw, "raw", false, "Print raw SSE events instead of rendered output")
+	cmd.Flags().BoolVar(&includeSQL, "include-sql", false, "Show SQL queries executed by the agent (text output; JSON always includes them)")
+	cmd.Flags().StringVarP(&session, "session", "s", "", "Session id (any string) to continue a conversation across calls")
+
+	return cmd
+}
+
+// askWithConversation resolves sessionID to its stored conversation id, runs
+// ask, and keeps the session id usable. A resume failure (not a cancel/stall,
+// which surface as context.Canceled) forgets the dead mapping and, if nothing
+// was written yet, retries as a fresh conversation. On success the resulting
+// conversation id is stored. An empty sessionID disables all of this and just
+// runs ask once.
+func askWithConversation(ctx context.Context, stderr io.Writer, host, sessionID string, ask func(serverID string) (string, bool, error)) error {
+	serverID := lookupConversationID(ctx, host, sessionID)
+	id, wrote, err := ask(serverID)
+	if err != nil && serverID != "" && !errors.Is(err, context.Canceled) {
+		forgetConversation(ctx, host, sessionID)
+		if !wrote {
+			fmt.Fprintf(stderr, "Session %q was not found (it may have expired); starting a new one.\n", sessionID)
+			id, _, err = ask("")
+		}
+	}
+	if err != nil {
+		return err
+	}
+	storeConversationID(ctx, host, sessionID, id)
+	return nil
+}
diff --git a/cmd/genie/ask_test.go b/cmd/genie/ask_test.go
new file mode 100644
index 00000000000..7daae23ec16
--- /dev/null
+++ b/cmd/genie/ask_test.go
@@ -0,0 +1,91 @@
+package genie
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/databricks/cli/libs/env"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const askTestHost = "https://example.cloud.databricks.com"
+
+// fakeAsk returns queued results in order and records the server ids it saw.
+type fakeAsk struct {
+	results []askResult
+	calls   []string
+}
+
+type askResult struct {
+	id    string
+	wrote bool
+	err   error
+}
+
+func (f *fakeAsk) run(serverID string) (string, bool, error) {
+	f.calls = append(f.calls, serverID)
+	r := f.results[len(f.calls)-1]
+	return r.id, r.wrote, r.err
+}
+
+func TestAskWithConversation(t *testing.T) {
+	boom := errors.New("boom")
+
+	t.Run("first use stores the new conversation", func(t *testing.T) {
+		ctx := env.WithUserHomeDir(t.Context(), t.TempDir())
+		f := &fakeAsk{results: []askResult{{id: "new", wrote: true}}}
+		require.NoError(t, askWithConversation(ctx, &bytes.Buffer{}, askTestHost, "q", f.run))
+		assert.Equal(t, []string{""}, f.calls)
+		assert.Equal(t, "new", lookupConversationID(ctx, askTestHost, "q"))
+	})
+
+	t.Run("reuse sends the stored id and refreshes it", func(t *testing.T) {
+		ctx := env.WithUserHomeDir(t.Context(), t.TempDir())
+		storeConversationID(ctx, askTestHost, "q", "srv")
+		f := &fakeAsk{results: []askResult{{id: "srv", wrote: true}}}
+		require.NoError(t, askWithConversation(ctx, &bytes.Buffer{}, askTestHost, "q", f.run))
+		assert.Equal(t, []string{"srv"}, f.calls)
+		assert.Equal(t, "srv", lookupConversationID(ctx, askTestHost, "q"))
+	})
+
+	t.Run("dead mapping fails open: forget, note, retry fresh, remap", func(t *testing.T) {
+		ctx := env.WithUserHomeDir(t.Context(), t.TempDir())
+		storeConversationID(ctx, askTestHost, "q", "dead")
+		var stderr bytes.Buffer
+		f := &fakeAsk{results: []askResult{{err: boom}, {id: "fresh", wrote: true}}}
+		require.NoError(t, askWithConversation(ctx, &stderr, askTestHost, "q", f.run))
+		assert.Equal(t, []string{"dead", ""}, f.calls)
+		assert.Contains(t, stderr.String(), "was not found")
+		assert.Equal(t, "fresh", lookupConversationID(ctx, askTestHost, "q"))
+	})
+
+	t.Run("error after output is not retried; mapping forgotten", func(t *testing.T) {
+		ctx := env.WithUserHomeDir(t.Context(), t.TempDir())
+		storeConversationID(ctx, askTestHost, "q", "dead")
+		f := &fakeAsk{results: []askResult{{wrote: true, err: boom}}}
+		err := askWithConversation(ctx, &bytes.Buffer{}, askTestHost, "q", f.run)
+		assert.ErrorIs(t, err, boom)
+		assert.Equal(t, []string{"dead"}, f.calls)
+		assert.Empty(t, lookupConversationID(ctx, askTestHost, "q"))
+	})
+
+	t.Run("cancel keeps the mapping and does not retry", func(t *testing.T) {
+		ctx := env.WithUserHomeDir(t.Context(), t.TempDir())
+		storeConversationID(ctx, askTestHost, "q", "live")
+		f := &fakeAsk{results: []askResult{{err: context.Canceled}}}
+		err := askWithConversation(ctx, &bytes.Buffer{}, askTestHost, "q", f.run)
+		assert.ErrorIs(t, err, context.Canceled)
+		assert.Equal(t, []string{"live"}, f.calls)
+		assert.Equal(t, "live", lookupConversationID(ctx, askTestHost, "q"))
+	})
+
+	t.Run("empty label runs once and stores nothing", func(t *testing.T) {
+		ctx := env.WithUserHomeDir(t.Context(), t.TempDir())
+		f := &fakeAsk{results: []askResult{{id: "x", wrote: true}}}
+		require.NoError(t, askWithConversation(ctx, &bytes.Buffer{}, askTestHost, "", f.run))
+		assert.Equal(t, []string{""}, f.calls)
+	})
+}
diff --git a/cmd/genie/conversations.go b/cmd/genie/conversations.go
new file mode 100644
index 00000000000..bfa86348ff8
--- /dev/null
+++ b/cmd/genie/conversations.go
@@ -0,0 +1,122 @@
+package genie
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"time"
+
+	"github.com/databricks/cli/libs/atomicfile"
+	"github.com/databricks/cli/libs/env"
+)
+
+// A Genie conversation can be continued across CLI calls by giving it a session
+// id (the --session flag). The server only accepts conversation ids it issued,
+// so we map each session id to its server conversation id on disk, in
+// ~/.databricks/genie-conversations.json (the same ~/.databricks JSON-store
+// pattern as cmd/sandbox/state.go). The store is best-effort: any read/write
+// error fails open and the ask just starts a fresh conversation.
+const (
+	// conversationStoreName is the store file inside ~/.databricks.
+	conversationStoreName = "genie-conversations.json"
+	conversationDirPerm   = 0o700
+	conversationFilePerm  = 0o600
+
+	// conversationTTL is how long a session mapping is kept before it expires.
+	conversationTTL = 14 * 24 * time.Hour
+)
+
+// conversationEntry is the stored server conversation id for one session id,
+// plus when it was last used (for TTL expiry).
+type conversationEntry struct {
+	ConversationID string    `json:"conversation_id"`
+	UpdatedAt      time.Time `json:"updated_at"`
+}
+
+// conversationStore maps workspace host -> session id -> entry. Scoping by host
+// keeps the same session id on different workspaces from colliding.
+type conversationStore map[string]map[string]conversationEntry
+
+// loadStore reads and parses the on-disk store so a caller can look up or update
+// a session mapping, dropping entries past the TTL. A missing or unreadable file
+// yields an empty store. The resolved file path is returned so a follow-up
+// saveStore knows where to write (empty if the home dir can't be resolved).
+func loadStore(ctx context.Context) (conversationStore, string) {
+	store := conversationStore{}
+	home, err := env.UserHomeDir(ctx)
+	if err != nil {
+		return store, ""
+	}
+	// Split path elements (not ".databricks/genie-..."), so the separator is
+	// correct on Windows too.
+	path := filepath.Join(home, ".databricks", conversationStoreName)
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		return store, path
+	}
+	var stored conversationStore
+	if json.Unmarshal(raw, &stored) != nil {
+		return store, path
+	}
+	for host, sessions := range stored {
+		for sessionID, e := range sessions {
+			if time.Since(e.UpdatedAt) < conversationTTL {
+				if store[host] == nil {
+					store[host] = map[string]conversationEntry{}
+				}
+				store[host][sessionID] = e
+			}
+		}
+	}
+	return store, path
+}
+
+// saveStore writes the store back to path. It writes a temp file in the same
+// directory and renames it into place, so a crash or concurrent reader never
+// sees a half-written file. Errors are ignored: the store is best-effort.
+func saveStore(path string, store conversationStore) {
+	if path == "" {
+		return
+	}
+	raw, err := json.MarshalIndent(store, "", "  ")
+	if err != nil {
+		return
+	}
+	_ = atomicfile.Write(path, raw, conversationFilePerm, atomicfile.MkDir(conversationDirPerm))
+}
+
+// lookupConversationID returns the server conversation id mapped to sessionID on
+// host, or "" if there is no live mapping.
+func lookupConversationID(ctx context.Context, host, sessionID string) string {
+	if sessionID == "" {
+		return ""
+	}
+	store, _ := loadStore(ctx)
+	return store[host][sessionID].ConversationID
+}
+
+// storeConversationID records sessionID -> conversationID so a later call with
+// the same session id continues the conversation.
+func storeConversationID(ctx context.Context, host, sessionID, conversationID string) {
+	if sessionID == "" || conversationID == "" {
+		return
+	}
+	store, path := loadStore(ctx)
+	if store[host] == nil {
+		store[host] = map[string]conversationEntry{}
+	}
+	store[host][sessionID] = conversationEntry{ConversationID: conversationID, UpdatedAt: time.Now()}
+	saveStore(path, store)
+}
+
+// forgetConversation drops the mapping for sessionID so the next ask starts
+// fresh. It's called when resuming fails because the server conversation is gone.
+func forgetConversation(ctx context.Context, host, sessionID string) {
+	if sessionID == "" {
+		return
+	}
+	store, path := loadStore(ctx)
+	delete(store[host], sessionID)
+	saveStore(path, store)
+}
diff --git a/cmd/genie/conversations_test.go b/cmd/genie/conversations_test.go
new file mode 100644
index 00000000000..aaa8f298dd1
--- /dev/null
+++ b/cmd/genie/conversations_test.go
@@ -0,0 +1,55 @@
+package genie
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/databricks/cli/libs/env"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestConversationStore(t *testing.T) {
+	ctx := env.WithUserHomeDir(t.Context(), t.TempDir())
+	const host = "https://example.cloud.databricks.com"
+
+	// Miss before anything is stored, and an empty session id never maps.
+	assert.Empty(t, lookupConversationID(ctx, host, "sales"))
+	assert.Empty(t, lookupConversationID(ctx, host, ""))
+
+	// Store then resolve.
+	storeConversationID(ctx, host, "sales", "conv-1")
+	assert.Equal(t, "conv-1", lookupConversationID(ctx, host, "sales"))
+
+	// Session ids are scoped by host, and distinct session ids are independent.
+	assert.Empty(t, lookupConversationID(ctx, "https://other.databricks.com", "sales"))
+	assert.Empty(t, lookupConversationID(ctx, host, "revenue"))
+
+	// Forgetting a stale mapping makes the session id resolve fresh again.
+	forgetConversation(ctx, host, "sales")
+	assert.Empty(t, lookupConversationID(ctx, host, "sales"))
+
+	// Entries past the TTL are ignored.
+	_, path := loadStore(ctx)
+	saveStore(path, conversationStore{
+		host: {"old": {ConversationID: "conv-2", UpdatedAt: time.Now().Add(-2 * conversationTTL)}},
+	})
+	assert.Empty(t, lookupConversationID(ctx, host, "old"))
+}
+
+func TestConversationStoreRecoversFromCorruptFile(t *testing.T) {
+	ctx := env.WithUserHomeDir(t.Context(), t.TempDir())
+	const host = "https://example.cloud.databricks.com"
+
+	// A malformed store file reads as empty (no error/panic)...
+	_, path := loadStore(ctx)
+	require.NoError(t, os.MkdirAll(filepath.Dir(path), 0o700))
+	require.NoError(t, os.WriteFile(path, []byte("not valid json {{{"), 0o600))
+	assert.Empty(t, lookupConversationID(ctx, host, "s"))
+
+	// ...and the next write overwrites it with a valid, readable store.
+	storeConversationID(ctx, host, "s", "conv-9")
+	assert.Equal(t, "conv-9", lookupConversationID(ctx, host, "s"))
+}
diff --git a/cmd/labs/github/github.go b/cmd/labs/github/github.go
index 4251bc3e1e7..c33eec99ca8 100644
--- a/cmd/labs/github/github.go
+++ b/cmd/labs/github/github.go
@@ -64,6 +64,7 @@ func getPagedBytes(ctx context.Context, method, url string, body io.Reader) (*pa
 	if err != nil {
 		return nil, err
 	}
+	defer res.Body.Close()
 	if res.StatusCode == http.StatusNotFound {
 		return nil, ErrNotFound
 	}
@@ -71,7 +72,6 @@ func getPagedBytes(ctx context.Context, method, url string, body io.Reader) (*pa
 		return nil, fmt.Errorf("github request failed: %s", res.Status)
 	}
 	nextLink := parseNextLink(res.Header.Get("link"))
-	defer res.Body.Close()
 	bodyBytes, err := io.ReadAll(res.Body)
 	if err != nil {
 		return nil, err
diff --git a/cmd/labs/github/github_test.go b/cmd/labs/github/github_test.go
index bd8fd3a4251..b9f0395ef05 100644
--- a/cmd/labs/github/github_test.go
+++ b/cmd/labs/github/github_test.go
@@ -1,11 +1,65 @@
 package github
 
 import (
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 )
 
+type closeRecordingBody struct {
+	io.Reader
+	closed *bool
+}
+
+func (b *closeRecordingBody) Close() error {
+	*b.closed = true
+	return nil
+}
+
+type stubTransport struct {
+	status int
+	closed bool
+}
+
+func (s *stubTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	return &http.Response{
+		StatusCode: s.status,
+		Status:     fmt.Sprintf("%d %s", s.status, http.StatusText(s.status)),
+		Header:     http.Header{},
+		Body:       &closeRecordingBody{Reader: strings.NewReader("{}"), closed: &s.closed},
+		Request:    req,
+	}, nil
+}
+
+func TestGetPagedBytesClosesBodyOnHTTPError(t *testing.T) {
+	tests := []struct {
+		name   string
+		status int
+	}{
+		{"not found", http.StatusNotFound},
+		{"server error", http.StatusInternalServerError},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// getPagedBytes hardcodes http.DefaultClient, so swapping its
+			// transport is the only seam to observe body closure.
+			stub := &stubTransport{status: tt.status}
+			prev := http.DefaultClient.Transport
+			http.DefaultClient.Transport = stub
+			t.Cleanup(func() { http.DefaultClient.Transport = prev })
+
+			_, err := getPagedBytes(t.Context(), "GET", "https://api.github.test/x", nil)
+			assert.Error(t, err)
+			assert.True(t, stub.closed)
+		})
+	}
+}
+
 func TestParseNextLink(t *testing.T) {
 	tests := []struct {
 		name       string
diff --git a/cmd/labs/list.go b/cmd/labs/list.go
index 171f956a1e7..2e709b7b385 100644
--- a/cmd/labs/list.go
+++ b/cmd/labs/list.go
@@ -2,6 +2,7 @@ package labs
 
 import (
 	"context"
+	"slices"
 
 	"github.com/databricks/cli/cmd/labs/github"
 	"github.com/databricks/cli/cmd/labs/project"
@@ -9,6 +10,15 @@ import (
 	"github.com/spf13/cobra"
 )
 
+const (
+	labsOrg = "databrickslabs"
+
+	// installableTopic is the GitHub repository topic that labs maintainers add to
+	// projects installable via `databricks labs install`. The repositories API
+	// returns topics inline, so filtering on it costs no extra requests.
+	installableTopic = "databricks-cli-installable"
+)
+
 type labsMeta struct {
 	Name        string `json:"name"`
 	Description string `json:"description"`
@@ -20,14 +30,35 @@ func allRepos(ctx context.Context) (github.Repositories, error) {
 	if err != nil {
 		return nil, err
 	}
-	cache := github.NewRepositoryCache("databrickslabs", cacheDir)
+	cache := github.NewRepositoryCache(labsOrg, cacheDir)
 	return cache.Load(ctx)
 }
 
+// installableRepos returns the org repositories that `databricks labs install` can
+// install. Most repositories don't ship a labs.yml manifest (e.g. libraries
+// published to package indexes); maintainers tag the installable ones with
+// installableTopic so the listing doesn't advertise projects that fail to install.
+func installableRepos(ctx context.Context) (github.Repositories, error) {
+	repos, err := allRepos(ctx)
+	if err != nil {
+		return nil, err
+	}
+	var out github.Repositories
+	for _, repo := range repos {
+		if repo.IsArchived || repo.IsFork {
+			continue
+		}
+		if slices.Contains(repo.Topics, installableTopic) {
+			out = append(out, repo)
+		}
+	}
+	return out, nil
+}
+
 func newListCommand() *cobra.Command {
 	return &cobra.Command{
 		Use:   "list",
-		Short: "List all labs",
+		Short: "List labs that can be installed",
 		Annotations: map[string]string{
 			"template": cmdio.Heredoc(`
 			Name	Description
@@ -37,18 +68,12 @@ func newListCommand() *cobra.Command {
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {
 			ctx := cmd.Context()
-			repositories, err := allRepos(ctx)
+			repositories, err := installableRepos(ctx)
 			if err != nil {
 				return err
 			}
 			var info []labsMeta
 			for _, v := range repositories {
-				if v.IsArchived {
-					continue
-				}
-				if v.IsFork {
-					continue
-				}
 				description := v.Description
 				if len(description) > 50 {
 					description = description[:50] + "..."
diff --git a/cmd/labs/list_test.go b/cmd/labs/list_test.go
index d1f763a7f33..f3908b896e1 100644
--- a/cmd/labs/list_test.go
+++ b/cmd/labs/list_test.go
@@ -1,10 +1,14 @@
 package labs_test
 
 import (
+	"net/http"
+	"net/http/httptest"
 	"testing"
 
+	"github.com/databricks/cli/cmd/labs/github"
 	"github.com/databricks/cli/internal/testcli"
 	"github.com/databricks/cli/libs/env"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -15,4 +19,28 @@ func TestListingWorks(t *testing.T) {
 	stdout, _, err := c.Run()
 	require.NoError(t, err)
 	require.Contains(t, stdout.String(), "ucx")
+	// blueprint is in the repositories cache fixture but lacks the
+	// databricks-cli-installable topic, proving the topic filter is applied.
+	require.NotContains(t, stdout.String(), "blueprint")
+}
+
+func TestListingFiltersReposWithoutTopic(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "/users/databrickslabs/repos", r.URL.Path)
+		_, err := w.Write([]byte(`[
+			{"name": "ucx", "description": "Unity Catalog Migrations", "topics": ["databricks-cli-installable"]},
+			{"name": "brickster", "description": "R interface to Databricks", "topics": []}
+		]`))
+		assert.NoError(t, err)
+	}))
+	defer server.Close()
+	ctx := t.Context()
+	ctx = github.WithApiOverride(ctx, server.URL)
+	ctx = env.WithUserHomeDir(ctx, t.TempDir())
+
+	c := testcli.NewRunner(t, ctx, "labs", "list")
+	stdout, _, err := c.Run()
+	require.NoError(t, err)
+	require.Contains(t, stdout.String(), "ucx")
+	require.NotContains(t, stdout.String(), "brickster")
 }
diff --git a/cmd/labs/localcache/jsonfile.go b/cmd/labs/localcache/jsonfile.go
index 1a7c6b940ce..a4fd8c0db39 100644
--- a/cmd/labs/localcache/jsonfile.go
+++ b/cmd/labs/localcache/jsonfile.go
@@ -11,6 +11,7 @@ import (
 	"path/filepath"
 	"time"
 
+	"github.com/databricks/cli/libs/atomicfile"
 	"github.com/databricks/cli/libs/log"
 )
 
@@ -56,8 +57,7 @@ type cached[T any] struct {
 
 func (r *LocalCache[T]) refreshCache(ctx context.Context, refresh func() (T, error), offlineVal T) (T, error) {
 	data, err := refresh()
-	var urlError *url.Error
-	if errors.As(err, &urlError) {
+	if urlError, ok := errors.AsType[*url.Error](err); ok {
 		log.Warnf(ctx, "System offline. Cannot refresh cache: %s", urlError)
 		return offlineVal, nil
 	}
@@ -74,19 +74,7 @@ func (r *LocalCache[T]) writeCache(ctx context.Context, data T) (T, error) {
 		return r.zero, fmt.Errorf("json marshal: %w", err)
 	}
 	cacheFile := r.FileName()
-	err = os.WriteFile(cacheFile, raw, userRW)
-	if errors.Is(err, fs.ErrNotExist) {
-		cacheDir := filepath.Dir(cacheFile)
-		err := os.MkdirAll(cacheDir, ownerRWXworldRX)
-		if err != nil {
-			return r.zero, fmt.Errorf("create %s: %w", cacheDir, err)
-		}
-		err = os.WriteFile(cacheFile, raw, userRW)
-		if err != nil {
-			return r.zero, fmt.Errorf("retry save cache: %w", err)
-		}
-		return data, nil
-	} else if err != nil {
+	if err := atomicfile.Write(cacheFile, raw, userRW, atomicfile.MkDir(ownerRWXworldRX)); err != nil {
 		return r.zero, fmt.Errorf("save cache: %w", err)
 	}
 	return data, nil
diff --git a/cmd/labs/project/command_test.go b/cmd/labs/project/command_test.go
index aac2e973a07..6dc73855f7e 100644
--- a/cmd/labs/project/command_test.go
+++ b/cmd/labs/project/command_test.go
@@ -2,15 +2,20 @@ package project_test
 
 import (
 	"context"
+	"net/http"
+	"net/http/httptest"
+	"os"
 	"path/filepath"
 	"testing"
 	"time"
 
+	"github.com/databricks/cli/cmd/labs/github"
 	"github.com/databricks/cli/internal/testcli"
 	"github.com/databricks/cli/libs/env"
 	"github.com/databricks/cli/libs/python"
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 type echoOut struct {
@@ -67,3 +72,26 @@ func TestRenderingTable(t *testing.T) {
 	Third  Fourth
 	`)
 }
+
+func TestRunningCommandWhenUpdateCheckFails(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusInternalServerError)
+	}))
+	defer server.Close()
+
+	home := copyTestdata(t, "testdata/installed-in-home")
+	// Drop the cached releases so the update check has to hit the API.
+	err := os.Remove(filepath.Join(home, ".databricks", "labs", "blueprint", "cache", "databrickslabs-blueprint-releases.json"))
+	require.NoError(t, err)
+
+	ctx := github.WithApiOverride(t.Context(), server.URL)
+	ctx = env.WithUserHomeDir(ctx, home)
+	py, _ := python.DetectExecutable(ctx)
+	py, _ = filepath.Abs(py)
+	ctx = env.Set(ctx, "PYTHON_BIN", py)
+
+	r := testcli.NewRunner(t, ctx, "labs", "blueprint", "echo")
+	var out echoOut
+	r.RunAndParseJSON(&out)
+	assert.Equal(t, "echo", out.Command)
+}
diff --git a/cmd/labs/project/entrypoint.go b/cmd/labs/project/entrypoint.go
index 1ffb4a8aaf8..20eae235f08 100644
--- a/cmd/labs/project/entrypoint.go
+++ b/cmd/labs/project/entrypoint.go
@@ -204,7 +204,7 @@ func (e *Entrypoint) getLoginConfig(cmd *cobra.Command) (*loginConfig, *config.C
 		ctx := cmd.Context()
 		b := root.TryConfigureBundle(cmd)
 		if b != nil {
-			log.Infof(ctx, "Using login configuration from Databricks Asset Bundle")
+			log.Infof(ctx, "Using login configuration from Declarative Automation Bundle")
 			return &loginConfig{}, b.WorkspaceClient(ctx).Config, nil
 		}
 	}
diff --git a/cmd/labs/project/fetcher.go b/cmd/labs/project/fetcher.go
index c6969ae1ba7..395bd10ca54 100644
--- a/cmd/labs/project/fetcher.go
+++ b/cmd/labs/project/fetcher.go
@@ -151,6 +151,16 @@ func (f *fetcher) loadRemoteProjectDefinition(cmd *cobra.Command, version string
 	var err error
 	if !offlineInstall {
 		raw, err = github.ReadFileFromRef(ctx, "databrickslabs", f.name, version, "labs.yml")
+		// A 404 on labs.yml has two causes we can't tell apart here: the requested
+		// version doesn't exist, or the repository simply doesn't ship a labs.yml
+		// (most databrickslabs repos don't, e.g. libraries published to package
+		// indexes) and so isn't installable through the CLI. Either way it's not a
+		// download failure, so surface both possibilities instead of the raw error.
+		if errors.Is(err, github.ErrNotFound) {
+			return nil, fmt.Errorf("no labs.yml at databrickslabs/%s@%s (%w); "+
+				"either this version does not exist or this project cannot be installed with the Databricks CLI, "+
+				"see https://github.com/databrickslabs/%s for instructions", f.name, version, err, f.name)
+		}
 		if err != nil {
 			return nil, fmt.Errorf("read labs.yml from GitHub: %w", err)
 		}
diff --git a/cmd/labs/project/fetcher_test.go b/cmd/labs/project/fetcher_test.go
new file mode 100644
index 00000000000..2e93c1f79d9
--- /dev/null
+++ b/cmd/labs/project/fetcher_test.go
@@ -0,0 +1,46 @@
+package project_test
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/databricks/cli/cmd/labs/github"
+	"github.com/databricks/cli/internal/testcli"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestInstallerFailsWhenLabsYmlMissing(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if strings.HasSuffix(r.URL.Path, "/labs.yml") {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+		t.Errorf("unexpected request: %s", r.URL.Path)
+		http.Error(w, "unexpected request", http.StatusInternalServerError)
+	}))
+	defer server.Close()
+	ctx := installerContext(t, server)
+
+	// A 404 on labs.yml has two causes: the repository ships no labs.yml (reached
+	// here via the only released version, v0.3.15), or the requested version does
+	// not exist (v9.9.9). Both must produce the same actionable error.
+	tests := []struct {
+		name    string
+		ref     string
+		version string
+	}{
+		{name: "released version without labs.yml", ref: "blueprint", version: "v0.3.15"},
+		{name: "nonexistent version", ref: "blueprint@v9.9.9", version: "v9.9.9"},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			r := testcli.NewRunner(t, ctx, "labs", "install", tc.ref)
+			_, _, err := r.Run()
+			assert.ErrorIs(t, err, github.ErrNotFound)
+			assert.ErrorContains(t, err, "no labs.yml at databrickslabs/blueprint@"+tc.version)
+			assert.ErrorContains(t, err, "either this version does not exist or this project cannot be installed with the Databricks CLI")
+		})
+	}
+}
diff --git a/cmd/labs/project/installer_test.go b/cmd/labs/project/installer_test.go
index 8cfbbf034b3..266d42dbeb8 100644
--- a/cmd/labs/project/installer_test.go
+++ b/cmd/labs/project/installer_test.go
@@ -193,8 +193,8 @@ func TestInstallerWorksForReleases(t *testing.T) {
 			})
 			return
 		}
-		t.Logf("Requested: %s", r.URL.Path)
-		t.FailNow()
+		t.Errorf("unexpected request: %s", r.URL.Path)
+		http.Error(w, "unexpected request", http.StatusInternalServerError)
 	}))
 	defer server.Close()
 
@@ -262,8 +262,8 @@ func TestOfflineInstallerWorksForReleases(t *testing.T) {
 			})
 			return
 		}
-		t.Logf("Requested: %s", r.URL.Path)
-		t.FailNow()
+		t.Errorf("unexpected request: %s", r.URL.Path)
+		http.Error(w, "unexpected request", http.StatusInternalServerError)
 	}))
 	defer server.Close()
 
@@ -362,8 +362,8 @@ func TestInstallerWorksForDevelopment(t *testing.T) {
 			})
 			return
 		}
-		t.Logf("Requested: %s", r.URL.Path)
-		t.FailNow()
+		t.Errorf("unexpected request: %s", r.URL.Path)
+		http.Error(w, "unexpected request", http.StatusInternalServerError)
 	}))
 	defer server.Close()
 
@@ -453,8 +453,8 @@ func TestUpgraderWorksForReleases(t *testing.T) {
 			})
 			return
 		}
-		t.Logf("Requested: %s", r.URL.Path)
-		t.FailNow()
+		t.Errorf("unexpected request: %s", r.URL.Path)
+		http.Error(w, "unexpected request", http.StatusInternalServerError)
 	}))
 	defer server.Close()
 
@@ -496,7 +496,6 @@ func TestUpgraderWorksForReleases(t *testing.T) {
 		}
 	}
 	if !pi {
-		t.Logf(`Expected stub command 'python[\S]+ -m pip install --upgrade --upgrade-strategy eager .' not found`)
-		t.FailNow()
+		t.Fatal(`Expected stub command 'python[\S]+ -m pip install --upgrade --upgrade-strategy eager .' not found`)
 	}
 }
diff --git a/cmd/labs/project/interpreters.go b/cmd/labs/project/interpreters.go
index 5b6bff16fc2..dfa51a1a5ba 100644
--- a/cmd/labs/project/interpreters.go
+++ b/cmd/labs/project/interpreters.go
@@ -76,8 +76,7 @@ func DetectInterpreters(ctx context.Context) (allInterpreters, error) {
 		// Keep in mind, that mswin installations get python.exe and pythonw.exe,
 		// which are slightly different: see https://stackoverflow.com/a/30313091
 		out, err := process.Background(ctx, []string{resolved, "--version"})
-		var processErr *process.ProcessError
-		if errors.As(err, &processErr) {
+		if processErr, ok := errors.AsType[*process.ProcessError](err); ok {
 			log.Debugf(ctx, "failed to check version for %s: %s", resolved, processErr.Err)
 			continue
 		}
diff --git a/cmd/labs/project/login.go b/cmd/labs/project/login.go
index 4631fc1de3e..39ccbf24540 100644
--- a/cmd/labs/project/login.go
+++ b/cmd/labs/project/login.go
@@ -4,9 +4,9 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"os"
 
 	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/atomicfile"
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/databrickscfg/cfgpickers"
 	"github.com/databricks/cli/libs/log"
@@ -120,5 +120,5 @@ func (lc *loginConfig) save(ctx context.Context) error {
 		return err
 	}
 	log.Debugf(ctx, "Writing auth configuration to: %s", authFile)
-	return os.WriteFile(authFile, raw, ownerRW)
+	return atomicfile.Write(authFile, raw, ownerRW)
 }
diff --git a/cmd/labs/project/project.go b/cmd/labs/project/project.go
index a8228126bdf..e40ef2a5501 100644
--- a/cmd/labs/project/project.go
+++ b/cmd/labs/project/project.go
@@ -11,6 +11,7 @@ import (
 	"time"
 
 	"github.com/databricks/cli/cmd/labs/github"
+	"github.com/databricks/cli/libs/atomicfile"
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/env"
 	"github.com/databricks/cli/libs/log"
@@ -291,7 +292,7 @@ func (p *Project) writeVersionFile(ctx context.Context, ver string) error {
 		return err
 	}
 	log.Debugf(ctx, "Writing installed version info to: %s", versionFile)
-	return os.WriteFile(versionFile, raw, ownerRW)
+	return atomicfile.Write(versionFile, raw, ownerRW)
 }
 
 // checkUpdates is called before every command of an installed project,
@@ -308,6 +309,10 @@ func (p *Project) checkUpdates(cmd *cobra.Command) error {
 	if err != nil {
 		return err
 	}
+	// Repositories without releases (and the offline fallback) yield no versions; nothing to advise on.
+	if len(versions) == 0 {
+		return nil
+	}
 	installed, err := p.InstalledVersion(ctx)
 	if err != nil {
 		return err
diff --git a/cmd/labs/project/project_test.go b/cmd/labs/project/project_test.go
index 42f999f4143..62db00b6a53 100644
--- a/cmd/labs/project/project_test.go
+++ b/cmd/labs/project/project_test.go
@@ -2,10 +2,14 @@ package project
 
 import (
 	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 
+	"github.com/databricks/cli/libs/env"
+	"github.com/spf13/cobra"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func assertEqualPaths(t *testing.T, expected, actual string) {
@@ -19,3 +23,21 @@ func TestLoad(t *testing.T) {
 	assert.NoError(t, err)
 	assertEqualPaths(t, "testdata/installed-in-home/.databricks/labs/blueprint/lib", prj.folder)
 }
+
+func TestCheckUpdatesWithEmptyReleaseList(t *testing.T) {
+	ctx := env.WithUserHomeDir(t.Context(), t.TempDir())
+	rootDir, err := PathInLabs(ctx, "blueprint")
+	require.NoError(t, err)
+	prj := &Project{Name: "blueprint", rootDir: rootDir}
+	require.NoError(t, prj.EnsureFoldersExist())
+
+	// The far-future refreshed_at keeps the cache valid so no network call is made.
+	cache := []byte(`{"refreshed_at": "2033-01-01T00:00:00Z", "data": []}`)
+	require.NoError(t, os.WriteFile(filepath.Join(prj.CacheDir(), "databrickslabs-blueprint-releases.json"), cache, ownerRW))
+	version := []byte(`{"version": "v0.3.15", "date": "2023-10-24T15:04:05+01:00"}`)
+	require.NoError(t, os.WriteFile(filepath.Join(prj.StateDir(), "version.json"), version, ownerRW))
+
+	cmd := &cobra.Command{}
+	cmd.SetContext(ctx)
+	assert.NoError(t, prj.checkUpdates(cmd))
+}
diff --git a/cmd/labs/project/proxy.go b/cmd/labs/project/proxy.go
index 82c7fb90cab..c46ac7aecf2 100644
--- a/cmd/labs/project/proxy.go
+++ b/cmd/labs/project/proxy.go
@@ -38,9 +38,9 @@ func (cp *proxy) register(parent *cobra.Command) {
 }
 
 func (cp *proxy) runE(cmd *cobra.Command, _ []string) error {
-	err := cp.checkUpdates(cmd)
-	if err != nil {
-		return err
+	// The update check only prints an upgrade hint, so a failure must not block the command.
+	if err := cp.checkUpdates(cmd); err != nil {
+		log.Debugf(cmd.Context(), "Failed to check for newer release of %s: %s", cp.Project.Name, err)
 	}
 	args, err := cp.commandInput(cmd)
 	if err != nil {
diff --git a/cmd/labs/project/testdata/installed-in-home/.databricks/labs/databrickslabs-repositories.json b/cmd/labs/project/testdata/installed-in-home/.databricks/labs/databrickslabs-repositories.json
index 896ebecc59e..11a96ac42a7 100644
--- a/cmd/labs/project/testdata/installed-in-home/.databricks/labs/databrickslabs-repositories.json
+++ b/cmd/labs/project/testdata/installed-in-home/.databricks/labs/databrickslabs-repositories.json
@@ -25,7 +25,9 @@
       "stargazers_count": 100500,
       "fork": false,
       "archived": false,
-      "topics": [],
+      "topics": [
+        "databricks-cli-installable"
+      ],
       "html_url": "https://github.com/databrickslabs/ucx",
       "clone_url": "https://github.com/databrickslabs/ucx.git",
       "ssh_url": "git@github.com:databrickslabs/ucx.git",
diff --git a/cmd/labs/project/testdata/installed-in-home/.databrickscfg b/cmd/labs/project/testdata/installed-in-home/.databrickscfg
index ec1bf7bdcf2..0906ec9d729 100644
--- a/cmd/labs/project/testdata/installed-in-home/.databrickscfg
+++ b/cmd/labs/project/testdata/installed-in-home/.databrickscfg
@@ -1,5 +1,5 @@
 [workspace-profile]
-host = https://abc
+host = https://abc.test
 token = bcd
 cluster_id = cde
 warehouse_id = def
diff --git a/cmd/pipelines/commands.go b/cmd/pipelines/commands.go
index da8bc06ace1..6a6b6931313 100644
--- a/cmd/pipelines/commands.go
+++ b/cmd/pipelines/commands.go
@@ -20,5 +20,6 @@ func Commands() []*cobra.Command {
 		historyCommand(),
 		logsCommand(),
 		openCommand(),
+		showCommand(),
 	}
 }
diff --git a/cmd/pipelines/deploy.go b/cmd/pipelines/deploy.go
index 2c8d27de140..7275eb246b5 100644
--- a/cmd/pipelines/deploy.go
+++ b/cmd/pipelines/deploy.go
@@ -28,18 +28,21 @@ func deployCommand() *cobra.Command {
 	var failOnActiveRuns bool
 	var autoApprove bool
 	var verbose bool
+	var quiet int
 	cmd.Flags().BoolVar(&forceLock, "force-lock", false, "Force acquisition of deployment lock.")
 	cmd.Flags().BoolVar(&failOnActiveRuns, "fail-on-active-runs", false, "Fail if there are running pipelines in the deployment.")
 	cmd.Flags().BoolVar(&autoApprove, "auto-approve", false, "Skip interactive approvals that might be required for deployment.")
 	cmd.Flags().BoolVar(&verbose, "verbose", false, "Enable verbose output.")
+	cmd.Flags().CountVarP(&quiet, "quiet", "q", "Reduce output: -q prints only the summary, -qq prints only warnings and errors.")
 	// Verbose flag currently only affects file sync output, it's used by the vscode extension
 	cmd.Flags().MarkHidden("verbose")
 
 	cmd.RunE = func(cmd *cobra.Command, args []string) error {
 		b, err := utils.ProcessBundle(cmd, utils.ProcessOptions{
 			InitFunc: func(b *bundle.Bundle) {
-				b.Config.Bundle.Deployment.Lock.Force = forceLock
+				utils.SetForceLock(cmd, b, forceLock)
 				b.AutoApprove = autoApprove
+				b.Quiet = bundle.QuietLevel(quiet)
 
 				if cmd.Flag("fail-on-active-runs").Changed {
 					b.Config.Bundle.Deployment.FailOnActiveRuns = failOnActiveRuns
@@ -58,6 +61,11 @@ func deployCommand() *cobra.Command {
 		}
 		ctx := cmd.Context()
 
+		// --quiet suppresses the per-resource lines, matching bundle deploy.
+		if b.Quiet >= bundle.QuietSummary {
+			return nil
+		}
+
 		bundle.ApplyContext(ctx, b, mutator.InitializeURLs())
 		if logdiag.HasError(ctx) {
 			return root.ErrAlreadyPrinted
@@ -66,7 +74,13 @@ func deployCommand() *cobra.Command {
 		for _, group := range b.Config.Resources.AllResources() {
 			for _, resourceKey := range slices.Sorted(maps.Keys(group.Resources)) {
 				resource := group.Resources[resourceKey]
-				cmdio.LogString(ctx, fmt.Sprintf("View your %s %s here: %s", resource.ResourceDescription().SingularName, resourceKey, resource.GetURL()))
+				// Skip resource types that never have a URL; otherwise we'd print
+				// "View your <resource> here:" with a blank URL.
+				url, supported := resource.GetURL()
+				if !supported {
+					continue
+				}
+				cmdio.LogString(ctx, fmt.Sprintf("View your %s %s here: %s", resource.ResourceDescription().SingularName, resourceKey, url))
 			}
 		}
 
diff --git a/cmd/pipelines/destroy.go b/cmd/pipelines/destroy.go
index 9f98d525fa8..995e6ffd8da 100644
--- a/cmd/pipelines/destroy.go
+++ b/cmd/pipelines/destroy.go
@@ -3,7 +3,7 @@
 package pipelines
 
 import (
-	"github.com/databricks/cli/cmd/bundle"
+	"github.com/databricks/cli/cmd/bundle/utils"
 	"github.com/spf13/cobra"
 )
 
@@ -20,7 +20,7 @@ func destroyCommand() *cobra.Command {
 	cmd.Flags().BoolVar(&forceDestroy, "force-lock", false, "Force acquisition of deployment lock.")
 
 	cmd.RunE = func(cmd *cobra.Command, args []string) error {
-		return bundle.CommandBundleDestroy(cmd, args, autoApprove, forceDestroy)
+		return utils.CommandBundleDestroy(cmd, args, autoApprove, forceDestroy)
 	}
 
 	return cmd
diff --git a/cmd/pipelines/generate.go b/cmd/pipelines/generate.go
index e1e5666b429..c865213c36a 100644
--- a/cmd/pipelines/generate.go
+++ b/cmd/pipelines/generate.go
@@ -10,6 +10,7 @@ import (
 
 	"github.com/databricks/cli/bundle/config"
 	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/cli/libs/dyn/convert"
 	"github.com/databricks/cli/libs/dyn/yamlloader"
@@ -265,12 +266,12 @@ func convertToResources(spec *sdpPipeline, resourceName, srcFolder string) (map[
 		return nil, fmt.Errorf("failed to convert libraries into dyn.Value: %w", err)
 	}
 
-	// maps are unordered, and saver is sorting keys by dyn.Location
+	// maps are unordered, and saver is sorting keys by diag.Location
 	// this is helper function to monotonically assign locations as keys are created
 	var line int
-	nextLocation := func() []dyn.Location {
+	nextLocation := func() []diag.Location {
 		line += 1
-		return []dyn.Location{{Line: line}}
+		return []diag.Location{{Line: line}}
 	}
 
 	pipelineMap := map[string]dyn.Value{
diff --git a/cmd/pipelines/generate_test.go b/cmd/pipelines/generate_test.go
index d9396932dfa..7135031ccbb 100644
--- a/cmd/pipelines/generate_test.go
+++ b/cmd/pipelines/generate_test.go
@@ -5,6 +5,7 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/cli/libs/dyn/dynassert"
 	"github.com/stretchr/testify/assert"
@@ -177,27 +178,27 @@ func TestConvertToResources(t *testing.T) {
 		"resources": dyn.V(map[string]dyn.Value{
 			"pipelines": dyn.V(map[string]dyn.Value{
 				"my_pipeline": dyn.V(map[string]dyn.Value{
-					"name":       dyn.V("My Pipeline").WithLocations([]dyn.Location{{Line: 1}}),
-					"catalog":    dyn.V("${var.catalog}").WithLocations([]dyn.Location{{Line: 2}}),
-					"schema":     dyn.V("${var.schema}").WithLocations([]dyn.Location{{Line: 3}}),
-					"root_path":  dyn.V("../src/my_pipeline").WithLocations([]dyn.Location{{Line: 4}}),
-					"serverless": dyn.V(true).WithLocations([]dyn.Location{{Line: 5}}),
+					"name":       dyn.V("My Pipeline").WithLocations([]diag.Location{{Line: 1}}),
+					"catalog":    dyn.V("${var.catalog}").WithLocations([]diag.Location{{Line: 2}}),
+					"schema":     dyn.V("${var.schema}").WithLocations([]diag.Location{{Line: 3}}),
+					"root_path":  dyn.V("../src/my_pipeline").WithLocations([]diag.Location{{Line: 4}}),
+					"serverless": dyn.V(true).WithLocations([]diag.Location{{Line: 5}}),
 					"libraries": dyn.V([]dyn.Value{
 						dyn.V(map[string]dyn.Value{
 							"glob": dyn.V(map[string]dyn.Value{
 								"include": dyn.V("../src/my_pipeline/transformations/**"),
 							}),
 						}),
-					}).WithLocations([]dyn.Location{{Line: 6}}),
+					}).WithLocations([]diag.Location{{Line: 6}}),
 					"configuration": dyn.V(map[string]dyn.Value{
 						"key0": dyn.V("value0"),
 						"key1": dyn.V("value1"),
-					}).WithLocations([]dyn.Location{{Line: 7}}),
+					}).WithLocations([]diag.Location{{Line: 7}}),
 					"environment": dyn.V(map[string]dyn.Value{
 						"dependencies": dyn.V([]dyn.Value{
 							dyn.V("--editable ${workspace.file_path}"),
 						}),
-					}).WithLocations([]dyn.Location{{Line: 8}}),
+					}).WithLocations([]diag.Location{{Line: 8}}),
 				}),
 			}),
 		}),
diff --git a/cmd/pipelines/history.go b/cmd/pipelines/history.go
index 6c30d1e72bd..84297cf0fdd 100644
--- a/cmd/pipelines/history.go
+++ b/cmd/pipelines/history.go
@@ -2,21 +2,24 @@ package pipelines
 
 import (
 	"fmt"
+	"uuid"
 
 	"github.com/databricks/cli/cmd/bundle/utils"
 	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
 	"github.com/databricks/cli/libs/cmdgroup"
 	"github.com/databricks/cli/libs/cmdio"
+	databricks "github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/service/pipelines"
 	"github.com/spf13/cobra"
 )
 
 func historyCommand() *cobra.Command {
 	cmd := &cobra.Command{
-		Use:   "history [flags] [KEY]",
+		Use:   "history [flags] [KEY|PIPELINE_ID]",
 		Args:  root.MaximumNArgs(1),
 		Short: "Retrieve past runs for a pipeline",
-		Long:  `Retrieve past runs for a pipeline identified by KEY, the unique name of the pipeline as defined in its YAML file.`,
+		Long:  `Retrieve past runs for a pipeline identified by KEY, the unique name of the pipeline as defined in its YAML file, or by PIPELINE_ID, the unique identifier of the pipeline.`,
 	}
 
 	var startTimeStr string
@@ -34,25 +37,45 @@ func historyCommand() *cobra.Command {
 	wrappedCmd.AddFlagGroup(historyGroup)
 
 	cmd.RunE = func(cmd *cobra.Command, args []string) error {
-		b, err := utils.ProcessBundle(cmd, utils.ProcessOptions{
-			InitIDs: true,
-		})
-		if err != nil {
-			return err
+		var key, pipelineId string
+		var w *databricks.WorkspaceClient
+		if len(args) == 1 {
+			id, err := uuid.Parse(args[0])
+			if err == nil {
+				pipelineId = id.String()
+			}
 		}
-		ctx := cmd.Context()
 
-		key, err := resolvePipelineArgument(ctx, b, args)
-		if err != nil {
-			return err
-		}
+		if pipelineId != "" {
+			if cmd.Flag("target").Value.String() == "" {
+				cmd.SetContext(root.SkipLoadBundle(cmd.Context()))
+			}
+			if err := root.MustWorkspaceClient(cmd, args); err != nil {
+				return err
+			}
+			key = pipelineId
+			w = cmdctx.WorkspaceClient(cmd.Context())
+		} else {
+			b, err := utils.ProcessBundle(cmd, utils.ProcessOptions{
+				InitIDs: true,
+			})
+			if err != nil {
+				return err
+			}
+			ctx := cmd.Context()
 
-		pipelineId, err := resolvePipelineIdFromKey(ctx, b, key)
-		if err != nil {
-			return err
-		}
+			key, err = resolvePipelineArgument(ctx, b, args)
+			if err != nil {
+				return err
+			}
 
-		w := b.WorkspaceClient(ctx)
+			pipelineId, err = resolvePipelineIdFromKey(ctx, b, key)
+			if err != nil {
+				return err
+			}
+			w = b.WorkspaceClient(ctx)
+		}
+		ctx := cmd.Context()
 
 		startTimePtr, err := parseTimeToUnixMillis(startTimeStr)
 		if err != nil {
diff --git a/cmd/pipelines/history_test.go b/cmd/pipelines/history_test.go
index 86d6d7d9d6e..a125d74d0d9 100644
--- a/cmd/pipelines/history_test.go
+++ b/cmd/pipelines/history_test.go
@@ -24,25 +24,25 @@ func TestUpdatesBefore(t *testing.T) {
 	}{
 		{
 			name:          "before 700",
-			timestamp:     int64Ptr(700),
+			timestamp:     new(int64(700)),
 			expectedCount: 3,
 			expectedFirst: 600,
 		},
 		{
 			name:          "before 1000",
-			timestamp:     int64Ptr(1000),
+			timestamp:     new(int64(1000)),
 			expectedCount: 5,
 			expectedFirst: 1000,
 		},
 		{
 			name:          "before 200",
-			timestamp:     int64Ptr(200),
+			timestamp:     new(int64(200)),
 			expectedCount: 1,
 			expectedFirst: 200,
 		},
 		{
 			name:          "before 100",
-			timestamp:     int64Ptr(100),
+			timestamp:     new(int64(100)),
 			expectedCount: 0,
 			expectedFirst: 0,
 		},
@@ -79,25 +79,25 @@ func TestUpdatesAfter(t *testing.T) {
 	}{
 		{
 			name:          "after 500",
-			timestamp:     int64Ptr(500),
+			timestamp:     new(int64(500)),
 			expectedCount: 3,
 			expectedFirst: 1000,
 		},
 		{
 			name:          "after 200",
-			timestamp:     int64Ptr(200),
+			timestamp:     new(int64(200)),
 			expectedCount: 5,
 			expectedFirst: 1000,
 		},
 		{
 			name:          "after 1000",
-			timestamp:     int64Ptr(1000),
+			timestamp:     new(int64(1000)),
 			expectedCount: 1,
 			expectedFirst: 1000,
 		},
 		{
 			name:          "after 1200",
-			timestamp:     int64Ptr(1200),
+			timestamp:     new(int64(1200)),
 			expectedCount: 0,
 			expectedFirst: 0,
 		},
@@ -181,7 +181,7 @@ func TestFilterUpdates(t *testing.T) {
 			name:          "start time nil, end time set",
 			updates:       updates,
 			startTime:     nil,
-			endTime:       int64Ptr(700),
+			endTime:       new(int64(700)),
 			expectedCount: 3,
 			expectedFirst: 600,
 			expectedLast:  200,
@@ -189,7 +189,7 @@ func TestFilterUpdates(t *testing.T) {
 		{
 			name:          "start time set, end time nil",
 			updates:       updates,
-			startTime:     int64Ptr(500),
+			startTime:     new(int64(500)),
 			endTime:       nil,
 			expectedCount: 3,
 			expectedFirst: 1000,
@@ -198,8 +198,8 @@ func TestFilterUpdates(t *testing.T) {
 		{
 			name:          "both times set within range",
 			updates:       updates,
-			startTime:     int64Ptr(300),
-			endTime:       int64Ptr(900),
+			startTime:     new(int64(300)),
+			endTime:       new(int64(900)),
 			expectedCount: 3,
 			expectedFirst: 800,
 			expectedLast:  400,
@@ -207,8 +207,8 @@ func TestFilterUpdates(t *testing.T) {
 		{
 			name:          "both times set, no overlap",
 			updates:       updates,
-			startTime:     int64Ptr(1200),
-			endTime:       int64Ptr(1500),
+			startTime:     new(int64(1200)),
+			endTime:       new(int64(1500)),
 			expectedCount: 0,
 			expectedFirst: 0,
 			expectedLast:  0,
@@ -216,7 +216,7 @@ func TestFilterUpdates(t *testing.T) {
 		{
 			name:          "start time after all updates",
 			updates:       updates,
-			startTime:     int64Ptr(1200),
+			startTime:     new(int64(1200)),
 			endTime:       nil,
 			expectedCount: 0,
 			expectedFirst: 0,
@@ -226,7 +226,7 @@ func TestFilterUpdates(t *testing.T) {
 			name:          "end time before all updates",
 			updates:       updates,
 			startTime:     nil,
-			endTime:       int64Ptr(100),
+			endTime:       new(int64(100)),
 			expectedCount: 0,
 			expectedFirst: 0,
 			expectedLast:  0,
@@ -234,8 +234,8 @@ func TestFilterUpdates(t *testing.T) {
 		{
 			name:          "start time after end time but within range",
 			updates:       updates,
-			startTime:     int64Ptr(700),
-			endTime:       int64Ptr(500),
+			startTime:     new(int64(700)),
+			endTime:       new(int64(500)),
 			expectedCount: 0,
 			expectedFirst: 0,
 			expectedLast:  0,
@@ -243,16 +243,16 @@ func TestFilterUpdates(t *testing.T) {
 		{
 			name:          "start and end time match exact values in list",
 			updates:       updates,
-			startTime:     int64Ptr(400),
-			endTime:       int64Ptr(800),
+			startTime:     new(int64(400)),
+			endTime:       new(int64(800)),
 			expectedCount: 3,
 			expectedFirst: 800,
 			expectedLast:  400,
 		},
 		{
-			name:          "no updates - empty slice",
+			name:          "no updates with time filter",
 			updates:       noUpdates,
-			startTime:     nil,
+			startTime:     new(int64(500)),
 			endTime:       nil,
 			expectedCount: 0,
 			expectedFirst: 0,
@@ -273,22 +273,19 @@ func TestFilterUpdates(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			result, err := filterUpdates(tt.updates, tt.startTime, tt.endTime)
 			if err != nil {
-				t.Errorf("filterUpdates(updates, %d, %d) returned error: %v", tt.startTime, tt.endTime, err)
+				t.Errorf("filterUpdates() returned error: %v", err)
 			}
 			if len(result) != tt.expectedCount {
-				t.Errorf("filterUpdates(updates, %d, %d) returned %d updates, want %d", tt.startTime, tt.endTime, len(result), tt.expectedCount)
+				t.Errorf("filterUpdates() returned %d updates, want %d", len(result), tt.expectedCount)
 			}
 			if tt.expectedCount > 0 {
 				if result[0].CreationTime != tt.expectedFirst {
-					t.Errorf("filterUpdates(updates, %d, %d) first update = %d, want %d", tt.startTime, tt.endTime, result[0].CreationTime, tt.expectedFirst)
+					t.Errorf("filterUpdates() first update = %d, want %d", result[0].CreationTime, tt.expectedFirst)
 				}
 				if result[len(result)-1].CreationTime != tt.expectedLast {
-					t.Errorf("filterUpdates(updates, %d, %d) last update = %d, want %d", tt.startTime, tt.endTime, result[len(result)-1].CreationTime, tt.expectedLast)
+					t.Errorf("filterUpdates() last update = %d, want %d", result[len(result)-1].CreationTime, tt.expectedLast)
 				}
 			}
 		})
 	}
 }
-
-// Helper function to create int64 pointers
-func int64Ptr(v int64) *int64 { return &v }
diff --git a/cmd/pipelines/open.go b/cmd/pipelines/open.go
index 6a8419703be..8c0e88510e7 100644
--- a/cmd/pipelines/open.go
+++ b/cmd/pipelines/open.go
@@ -72,7 +72,10 @@ If there is only one pipeline in the project, KEY is optional and the pipeline w
 		}
 
 		// Confirm that the resource has a URL.
-		url := ref.Resource.GetURL()
+		url, supported := ref.Resource.GetURL()
+		if !supported {
+			return errors.New("this resource type does not have a URL")
+		}
 		if url == "" {
 			return errors.New("pipeline does not have a URL associated with it (has it been deployed?)")
 		}
diff --git a/cmd/pipelines/run_test.go b/cmd/pipelines/run_test.go
index 38fc84b3fb2..9937cb83d0d 100644
--- a/cmd/pipelines/run_test.go
+++ b/cmd/pipelines/run_test.go
@@ -30,8 +30,8 @@ func TestDisplayPipelineUpdate(t *testing.T) {
 					Id:          "pipeline-789",
 					Serverless:  true,
 					Channel:     "CURRENT",
-					Continuous:  true,
-					Development: true,
+					Continuous:  true, //nolint:staticcheck // SA1019: pipeline continuous is deprecated in the SDK but remains a supported bundle config field
+					Development: true, //nolint:staticcheck // SA1019: pipeline development is deprecated in the SDK but remains a supported bundle config field
 					Catalog:     "test_catalog",
 					Schema:      "test_schema",
 				},
diff --git a/cmd/pipelines/show.go b/cmd/pipelines/show.go
new file mode 100644
index 00000000000..af8fd732d4c
--- /dev/null
+++ b/cmd/pipelines/show.go
@@ -0,0 +1,128 @@
+package pipelines
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"os/signal"
+	"syscall"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/databrickscfg/cfgpickers"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/cli/libs/sqlexec"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/spf13/cobra"
+)
+
+const defaultLimit = 10
+
+func showCommand() *cobra.Command {
+	var warehouseID string
+	var limit int
+
+	cmd := &cobra.Command{
+		Use:   "show TABLE",
+		Short: "Preview a table's columns and sample rows",
+		Long: `Preview a table's columns and sample rows on a SQL warehouse.
+
+TABLE is a fully-qualified name: catalog.schema.table (Unity Catalog) or
+schema.table (legacy Hive metastore).`,
+		Args:    root.ExactArgs(1),
+		PreRunE: root.MustWorkspaceClient,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			// The CLI root doesn't cancel ctx on signals, so Ctrl-C / kill would
+			// otherwise leave Execute polling the warehouse until the query ends.
+			ctx, stop := signal.NotifyContext(cmd.Context(), os.Interrupt, syscall.SIGTERM)
+			defer stop()
+			w := cmdctx.WorkspaceClient(ctx)
+
+			if limit <= 0 {
+				return errors.New("--limit must be a positive integer")
+			}
+
+			quoted, err := quoteTableName(args[0])
+			if err != nil {
+				return err
+			}
+
+			warehouseID, err = resolveWarehouseID(ctx, w, warehouseID)
+			if err != nil {
+				return err
+			}
+
+			checkForMoreRows := root.OutputType(cmd) == flags.OutputText && !cmd.Flags().Changed("limit")
+			queryLimit := limit
+			if checkForMoreRows {
+				queryLimit++
+			}
+
+			client := sqlexec.New(w.StatementExecution, warehouseID)
+			statement := fmt.Sprintf("SELECT * FROM %s LIMIT %d", quoted, queryLimit)
+			result, err := client.Execute(ctx, statement)
+			if err != nil {
+				if ctx.Err() != nil {
+					fmt.Fprintln(cmd.ErrOrStderr(), "\nCancelled.")
+					return root.ErrAlreadyPrinted
+				}
+				return err
+			}
+
+			rows := result.Rows
+			hasMoreRows := checkForMoreRows && len(rows) > limit
+			if hasMoreRows {
+				rows = rows[:limit]
+			}
+
+			if err := render(ctx, cmd, result.Columns, rows); err != nil {
+				return err
+			}
+			if hasMoreRows {
+				fmt.Fprintln(cmd.OutOrStdout(), "Use --limit <n> to preview more rows.")
+			}
+			return nil
+		},
+	}
+
+	cmd.Flags().StringVar(&warehouseID, "warehouse-id", "", "SQL warehouse to run the query on. Defaults to DATABRICKS_WAREHOUSE_ID or a workspace default.")
+	cmd.Flags().IntVarP(&limit, "limit", "n", defaultLimit, "Maximum number of rows to fetch.")
+
+	return cmd
+}
+
+// warehouse to query either --warehouse-id flag, DATABRICKS_WAREHOUSE_ID config,
+// or the workspace default warehouse.
+func resolveWarehouseID(ctx context.Context, w *databricks.WorkspaceClient, flag string) (string, error) {
+	if flag != "" {
+		return flag, nil
+	}
+	if w.Config.WarehouseID != "" {
+		return w.Config.WarehouseID, nil
+	}
+	warehouse, err := cfgpickers.GetDefaultWarehouse(ctx, w)
+	if errors.Is(err, cfgpickers.ErrNoCompatibleWarehouses) {
+		return "", errors.New("no SQL warehouse available; pass --warehouse-id or set DATABRICKS_WAREHOUSE_ID")
+	}
+	if err != nil {
+		return "", err
+	}
+	return warehouse.Id, nil
+}
+
+// writes the result as JSON (--output json) or a terminal-width-aware table.
+func render(ctx context.Context, cmd *cobra.Command, columns []string, rows [][]string) error {
+	out := cmd.OutOrStdout()
+	switch root.OutputType(cmd) {
+	case flags.OutputJSON:
+		return renderJSON(out, columns, rows)
+	case flags.OutputText:
+		if len(columns) == 0 {
+			return nil
+		}
+		return renderTable(ctx, columns, rows, detectWidth(out))
+	default:
+		return fmt.Errorf("unknown output type %s", root.OutputType(cmd))
+	}
+}
diff --git a/cmd/pipelines/show_identifier.go b/cmd/pipelines/show_identifier.go
new file mode 100644
index 00000000000..b164d0ca6b5
--- /dev/null
+++ b/cmd/pipelines/show_identifier.go
@@ -0,0 +1,25 @@
+package pipelines
+
+import (
+	"fmt"
+	"strings"
+)
+
+// validates a fully-qualified table name and returns it with each
+// segment backtick-quoted. Accepts two-part (schema.table, Hive)
+// and three-part (catalog.schema.table, Unity Catalog) names.
+func quoteTableName(name string) (string, error) {
+	parts := strings.Split(name, ".")
+	if len(parts) < 2 || len(parts) > 3 {
+		return "", fmt.Errorf("invalid table name %q: expected catalog.schema.table (Unity Catalog) or schema.table (legacy Hive metastore)", name)
+	}
+
+	quoted := make([]string, len(parts))
+	for i, part := range parts {
+		if part == "" {
+			return "", fmt.Errorf("invalid table name %q: empty identifier segment", name)
+		}
+		quoted[i] = "`" + strings.ReplaceAll(part, "`", "``") + "`"
+	}
+	return strings.Join(quoted, "."), nil
+}
diff --git a/cmd/pipelines/show_identifier_test.go b/cmd/pipelines/show_identifier_test.go
new file mode 100644
index 00000000000..9e02420068e
--- /dev/null
+++ b/cmd/pipelines/show_identifier_test.go
@@ -0,0 +1,54 @@
+package pipelines
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestQuoteTableName(t *testing.T) {
+	tests := []struct {
+		name string
+		in   string
+		want string
+	}{
+		{"three part", "main.sales.orders", "`main`.`sales`.`orders`"},
+		{"two part", "sales.orders", "`sales`.`orders`"},
+		{"hive metastore", "hive_metastore.sales.orders", "`hive_metastore`.`sales`.`orders`"},
+		{"leading digit segment", "cat.sch.2020_sales", "`cat`.`sch`.`2020_sales`"},
+		{"hyphen segment", "cat.sch.order-items", "`cat`.`sch`.`order-items`"},
+		{"space segment", "cat.sch.my table", "`cat`.`sch`.`my table`"},
+		{"reserved word segment", "cat.sch.order", "`cat`.`sch`.`order`"},
+		{"internal backtick doubled", "cat.sch.wei`rd", "`cat`.`sch`.`wei``rd`"},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got, err := quoteTableName(tc.in)
+			require.NoError(t, err)
+			assert.Equal(t, tc.want, got)
+		})
+	}
+}
+
+func TestQuoteTableNameErrors(t *testing.T) {
+	tests := []struct {
+		name string
+		in   string
+	}{
+		{"one part", "orders"},
+		{"four part", "a.b.c.d"},
+		{"empty", ""},
+		{"empty middle segment", "cat..table"},
+		{"trailing dot", "cat.sch."},
+		{"leading dot", ".sch.table"},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			_, err := quoteTableName(tc.in)
+			assert.Error(t, err)
+		})
+	}
+}
diff --git a/cmd/pipelines/show_render.go b/cmd/pipelines/show_render.go
new file mode 100644
index 00000000000..d829a8f0e47
--- /dev/null
+++ b/cmd/pipelines/show_render.go
@@ -0,0 +1,215 @@
+package pipelines
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"strings"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"golang.org/x/term"
+)
+
+const (
+	maxColumnWidth = 40
+	columnSep      = "  "
+	ellipsis       = "..."
+	separatorChar  = "-"
+)
+
+type tableRow struct {
+	Cells []string
+}
+
+type tableData struct {
+	Rows   []tableRow
+	Footer []string
+}
+
+// Tab-separated cells let cmdio's tabwriter align columns; the footer follows a blank line.
+const rowTemplate = "{{range .Rows}}{{range $i, $c := .Cells}}{{if $i}}\t{{end}}{{$c}}{{end}}\n{{end}}\n" +
+	"{{range .Footer}}{{.}}\n{{end}}"
+
+// marshals a result row as a JSON object with keys in column order.
+type orderedRow struct {
+	columns []string
+	values  []string
+}
+
+func (r orderedRow) MarshalJSON() ([]byte, error) {
+	var buf bytes.Buffer
+	buf.WriteByte('{')
+	for i, col := range r.columns {
+		if i > 0 {
+			buf.WriteByte(',')
+		}
+		key, err := json.Marshal(col)
+		if err != nil {
+			return nil, err
+		}
+		buf.Write(key)
+		buf.WriteByte(':')
+		var val []byte
+		if i < len(r.values) {
+			val, err = json.Marshal(r.values[i])
+		} else {
+			val = []byte("null")
+		}
+		if err != nil {
+			return nil, err
+		}
+		buf.Write(val)
+	}
+	buf.WriteByte('}')
+	return buf.Bytes(), nil
+}
+
+// writes rows as an indented JSON array of column-ordered objects.
+func renderJSON(w io.Writer, columns []string, rows [][]string) error {
+	objects := make([]orderedRow, len(rows))
+	for i, row := range rows {
+		objects[i] = orderedRow{columns: columns, values: row}
+	}
+	output, err := json.MarshalIndent(objects, "", "  ")
+	if err != nil {
+		return fmt.Errorf("marshal results: %w", err)
+	}
+	fmt.Fprintf(w, "%s\n", output)
+	return nil
+}
+
+// renderTable writes a width-aware text table: cells cap at maxColumnWidth, and a positive width that the table exceeds drops trailing columns behind a "..." marker.
+func renderTable(ctx context.Context, columns []string, rows [][]string, width int) error {
+	n := len(columns)
+	colWidth := make([]int, n)
+	for i, col := range columns {
+		colWidth[i] = min(cmdio.Width(col), maxColumnWidth)
+	}
+	for _, row := range rows {
+		for i := 0; i < n && i < len(row); i++ {
+			colWidth[i] = max(colWidth[i], min(cmdio.Width(row[i]), maxColumnWidth))
+		}
+	}
+
+	shown, cropped := fitColumns(colWidth, width)
+
+	header := make([]string, 0, shown+1)
+	sep := make([]string, 0, shown+1)
+	for i := range shown {
+		header = append(header, truncateToWidth(columns[i], colWidth[i]))
+		sep = append(sep, strings.Repeat(separatorChar, colWidth[i]))
+	}
+	if cropped {
+		header = append(header, cmdio.Faint(ctx, ellipsis))
+		sep = append(sep, strings.Repeat(separatorChar, cmdio.Width(ellipsis)))
+	}
+
+	data := tableData{Rows: make([]tableRow, 0, len(rows)+2)}
+	data.Rows = append(data.Rows, tableRow{header}, tableRow{sep})
+	for _, row := range rows {
+		cells := make([]string, 0, shown+1)
+		for i := range shown {
+			cell := ""
+			if i < len(row) {
+				cell = truncateToWidth(row[i], colWidth[i])
+			}
+			cells = append(cells, cell)
+		}
+		if cropped {
+			cells = append(cells, cmdio.Faint(ctx, ellipsis))
+		}
+		data.Rows = append(data.Rows, tableRow{cells})
+	}
+
+	if cropped {
+		data.Footer = append(data.Footer, cmdio.Faint(ctx, fmt.Sprintf("(showing %d of %d columns)", shown, n)))
+	}
+	data.Footer = append(data.Footer, rowCountLabel(len(rows)))
+
+	return cmdio.RenderWithTemplate(ctx, data, "", rowTemplate)
+}
+
+func rowCountLabel(n int) string {
+	if n == 1 {
+		return "1 row"
+	}
+	return fmt.Sprintf("%d rows", n)
+}
+
+// fitColumns returns how many leading columns fit within width (<= 0 means unlimited) and whether any were dropped; at least one column is always shown.
+func fitColumns(colWidth []int, width int) (shown int, cropped bool) {
+	n := len(colWidth)
+	total := 0
+	for i, w := range colWidth {
+		if i > 0 {
+			total += len(columnSep)
+		}
+		total += w
+	}
+	if width <= 0 || total <= width {
+		return n, false
+	}
+	budget := width - len(columnSep) - len(ellipsis)
+	used := 0
+	for i := range colWidth {
+		add := colWidth[i]
+		if i > 0 {
+			add += len(columnSep)
+		}
+		if used+add > budget {
+			s := max(i, 1)
+			return s, s < n
+		}
+		used += add
+	}
+	return n, false
+}
+
+// truncateToWidth shortens s to at most maxWidth display cells, marking truncation with "...".
+func truncateToWidth(s string, maxWidth int) string {
+	if maxWidth <= 0 {
+		return ""
+	}
+	if cmdio.Width(s) <= maxWidth {
+		return s
+	}
+	budget := maxWidth - len(ellipsis)
+	if budget <= 0 {
+		return cutToWidth(s, maxWidth)
+	}
+	return cutToWidth(s, budget) + ellipsis
+}
+
+// cutToWidth returns the longest prefix of s whose display width is <= w.
+func cutToWidth(s string, w int) string {
+	var b strings.Builder
+	used := 0
+	for _, r := range s {
+		rw := cmdio.Width(string(r))
+		if used+rw > w {
+			break
+		}
+		b.WriteRune(r)
+		used += rw
+	}
+	return b.String()
+}
+
+// detectWidth returns the terminal width, or 0 (meaning "no cap") when out is not an interactive terminal.
+func detectWidth(out io.Writer) int {
+	f, ok := out.(*os.File)
+	if !ok {
+		return 0
+	}
+	if !cmdio.IsOutputTTY(f) {
+		return 0
+	}
+	width, _, err := term.GetSize(int(f.Fd()))
+	if err != nil {
+		return 0
+	}
+	return width
+}
diff --git a/cmd/pipelines/show_render_test.go b/cmd/pipelines/show_render_test.go
new file mode 100644
index 00000000000..ee7a01673a2
--- /dev/null
+++ b/cmd/pipelines/show_render_test.go
@@ -0,0 +1,159 @@
+package pipelines
+
+import (
+	"bytes"
+	"strings"
+	"testing"
+	"unicode/utf8"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func renderTableString(t *testing.T, columns []string, rows [][]string, width int) string {
+	t.Helper()
+	var buf bytes.Buffer
+	io := cmdio.NewIO(t.Context(), flags.OutputText, nil, &buf, &buf, "", "")
+	ctx := cmdio.InContext(t.Context(), io)
+	require.NoError(t, renderTable(ctx, columns, rows, width))
+	return buf.String()
+}
+
+func TestRenderJSON(t *testing.T) {
+	var buf bytes.Buffer
+	err := renderJSON(&buf, []string{"id", "name"}, [][]string{{"1", "alice"}, {"2", "bob"}})
+	require.NoError(t, err)
+	assert.JSONEq(t, `[{"id":"1","name":"alice"},{"id":"2","name":"bob"}]`, buf.String())
+}
+
+func TestRenderJSONEmpty(t *testing.T) {
+	var buf bytes.Buffer
+	err := renderJSON(&buf, []string{"id"}, nil)
+	require.NoError(t, err)
+	assert.JSONEq(t, `[]`, buf.String())
+}
+
+func TestRenderJSONPreservesColumnOrder(t *testing.T) {
+	var buf bytes.Buffer
+	err := renderJSON(&buf, []string{"name", "id"}, [][]string{{"alice", "1"}})
+	require.NoError(t, err)
+	assert.Equal(t, "[\n  {\n    \"name\": \"alice\",\n    \"id\": \"1\"\n  }\n]\n", buf.String())
+}
+
+func TestRenderJSONEscapesValues(t *testing.T) {
+	var buf bytes.Buffer
+	err := renderJSON(&buf, []string{"c"}, [][]string{{`a"b	c`}})
+	require.NoError(t, err)
+	assert.JSONEq(t, `[{"c":"a\"b\tc"}]`, buf.String())
+}
+
+func TestRenderTableNoCap(t *testing.T) {
+	out := renderTableString(t, []string{"id", "name"}, [][]string{{"1", "alice"}, {"2", "bob"}}, 0)
+	assert.Equal(t, "id  name\n--  -----\n1   alice\n2   bob\n\n2 rows\n", out)
+}
+
+func TestRenderTableEmptyRows(t *testing.T) {
+	out := renderTableString(t, []string{"id", "name"}, nil, 0)
+	assert.Equal(t, "id  name\n--  ----\n\n0 rows\n", out)
+}
+
+func TestRenderTableRaggedRow(t *testing.T) {
+	out := renderTableString(t, []string{"a", "b"}, [][]string{{"1"}}, 0)
+	assert.Equal(t, "a  b\n-  -\n1  \n\n1 row\n", out)
+}
+
+func TestRenderTableBlankValue(t *testing.T) {
+	out := renderTableString(t, []string{"a", "b"}, [][]string{{"", "x"}}, 0)
+	assert.Equal(t, "a  b\n-  -\n   x\n\n1 row\n", out)
+}
+
+func TestRenderTableCapsColumnWidth(t *testing.T) {
+	long := strings.Repeat("x", maxColumnWidth+10)
+	out := renderTableString(t, []string{"c"}, [][]string{{long}}, 0)
+	assert.Contains(t, out, strings.Repeat("x", maxColumnWidth-len(ellipsis))+ellipsis)
+	assert.NotContains(t, out, long)
+}
+
+func TestRenderTableCellAtCapNotTruncated(t *testing.T) {
+	exact := strings.Repeat("x", maxColumnWidth)
+	out := renderTableString(t, []string{"c"}, [][]string{{exact}}, 0)
+	assert.Contains(t, out, exact)
+	assert.NotContains(t, out, ellipsis)
+}
+
+func TestRenderTableCropsColumns(t *testing.T) {
+	out := renderTableString(t, []string{"a", "b", "c", "d", "e"}, [][]string{{"1", "2", "3", "4", "5"}}, 10)
+	assert.Equal(t, "a  b  ...\n-  -  ---\n1  2  ...\n\n(showing 2 of 5 columns)\n1 row\n", out)
+}
+
+func TestRenderTableCropsColumnsMultipleRows(t *testing.T) {
+	out := renderTableString(t, []string{"a", "b", "c"}, [][]string{{"1", "2", "3"}, {"4", "5", "6"}}, 4)
+	assert.Equal(t, "a  ...\n-  ---\n1  ...\n4  ...\n\n(showing 1 of 3 columns)\n2 rows\n", out)
+}
+
+func TestRenderTableSingleColumnNarrowNotCropped(t *testing.T) {
+	out := renderTableString(t, []string{"name"}, [][]string{{"alice"}}, 4)
+	assert.NotContains(t, out, ellipsis)
+	assert.NotContains(t, out, "showing")
+}
+
+func TestRenderTableTruncatesWideGlyphCellSafely(t *testing.T) {
+	out := renderTableString(t, []string{"c"}, [][]string{{strings.Repeat("世", 30)}}, 0)
+	assert.True(t, utf8.ValidString(out))
+	assert.Contains(t, out, ellipsis)
+}
+
+func TestRowCountLabel(t *testing.T) {
+	assert.Equal(t, "0 rows", rowCountLabel(0))
+	assert.Equal(t, "1 row", rowCountLabel(1))
+	assert.Equal(t, "2 rows", rowCountLabel(2))
+}
+
+func TestFitColumns(t *testing.T) {
+	tests := []struct {
+		name      string
+		colWidth  []int
+		width     int
+		wantShown int
+		wantCrop  bool
+	}{
+		{"no cap", []int{5, 5, 5}, 0, 3, false},
+		{"fits exactly", []int{2, 5}, 9, 2, false},
+		{"one over", []int{2, 5}, 8, 1, true},
+		{"tiny width shows one", []int{3, 3, 3}, 1, 1, true},
+		{"single column never cropped", []int{5}, 4, 1, false},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			shown, cropped := fitColumns(tc.colWidth, tc.width)
+			assert.Equal(t, tc.wantShown, shown)
+			assert.Equal(t, tc.wantCrop, cropped)
+		})
+	}
+}
+
+func TestTruncateToWidth(t *testing.T) {
+	tests := []struct {
+		name     string
+		in       string
+		maxWidth int
+		want     string
+	}{
+		{"under", "abc", 10, "abc"},
+		{"exact", "abcde", 5, "abcde"},
+		{"over", "abcdefgh", 5, "ab..."},
+		{"width below ellipsis hard cuts", "abcdef", 2, "ab"},
+		{"zero width", "abc", 0, ""},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, truncateToWidth(tc.in, tc.maxWidth))
+		})
+	}
+}
+
+func TestDetectWidthNonFile(t *testing.T) {
+	assert.Equal(t, 0, detectWidth(&bytes.Buffer{}))
+}
diff --git a/cmd/pipelines/show_test.go b/cmd/pipelines/show_test.go
new file mode 100644
index 00000000000..116762b6b92
--- /dev/null
+++ b/cmd/pipelines/show_test.go
@@ -0,0 +1,104 @@
+package pipelines
+
+import (
+	"context"
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/sqlexec"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/config"
+	mocksql "github.com/databricks/databricks-sdk-go/experimental/mocks/service/sql"
+	"github.com/databricks/databricks-sdk-go/service/sql"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+)
+
+func TestResolveWarehouseIDFlagWins(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	w := &databricks.WorkspaceClient{Config: &config.Config{WarehouseID: "from-config"}}
+	id, err := resolveWarehouseID(ctx, w, "from-flag")
+	require.NoError(t, err)
+	assert.Equal(t, "from-flag", id)
+}
+
+func TestResolveWarehouseIDFallsBackToConfig(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	w := &databricks.WorkspaceClient{Config: &config.Config{WarehouseID: "from-config"}}
+	id, err := resolveWarehouseID(ctx, w, "")
+	require.NoError(t, err)
+	assert.Equal(t, "from-config", id)
+}
+
+func TestResolveWarehouseIDUsesDefaultWarehouse(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	mockWH := mocksql.NewMockWarehousesInterface(t)
+	mockWH.EXPECT().Get(mock.Anything, sql.GetWarehouseRequest{Id: "default"}).
+		Return(&sql.GetWarehouseResponse{Id: "wh-default"}, nil)
+
+	w := &databricks.WorkspaceClient{Config: &config.Config{}, Warehouses: mockWH}
+	id, err := resolveWarehouseID(ctx, w, "")
+	require.NoError(t, err)
+	assert.Equal(t, "wh-default", id)
+}
+
+func TestExecuteSelectQuotesAndLimits(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	mockAPI := mocksql.NewMockStatementExecutionInterface(t)
+
+	mockAPI.EXPECT().ExecuteStatement(mock.Anything, mock.MatchedBy(func(req sql.ExecuteStatementRequest) bool {
+		return req.WarehouseId == "wh-1" &&
+			req.Statement == "SELECT * FROM `main`.`sales`.`orders` LIMIT 25"
+	})).Return(&sql.StatementResponse{
+		StatementId: "s1",
+		Status:      &sql.StatementStatus{State: sql.StatementStateSucceeded},
+		Manifest:    &sql.ResultManifest{Schema: &sql.ResultSchema{Columns: []sql.ColumnInfo{{Name: "id"}}}},
+		Result:      &sql.ResultData{DataArray: [][]string{{"1"}}},
+	}, nil)
+
+	quoted, err := quoteTableName("main.sales.orders")
+	require.NoError(t, err)
+	client := sqlexec.New(mockAPI, "wh-1")
+	result, err := client.Execute(ctx, "SELECT * FROM "+quoted+" LIMIT 25")
+	require.NoError(t, err)
+	assert.Equal(t, []string{"id"}, result.Columns)
+	assert.Equal(t, [][]string{{"1"}}, result.Rows)
+}
+
+func TestExecuteSelectSurfacesStatementError(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	mockAPI := mocksql.NewMockStatementExecutionInterface(t)
+
+	mockAPI.EXPECT().ExecuteStatement(mock.Anything, mock.Anything).Return(&sql.StatementResponse{
+		StatementId: "s1",
+		Status: &sql.StatementStatus{
+			State: sql.StatementStateFailed,
+			Error: &sql.ServiceError{ErrorCode: sql.ServiceErrorCodeBadRequest, Message: "TABLE_OR_VIEW_NOT_FOUND"},
+		},
+	}, nil)
+
+	client := sqlexec.New(mockAPI, "wh-1")
+	_, err := client.Execute(ctx, "SELECT * FROM `x`.`y`.`z` LIMIT 25")
+	require.Error(t, err)
+
+	var stmtErr *sqlexec.StatementError
+	require.ErrorAs(t, err, &stmtErr)
+	assert.Equal(t, sql.ServiceErrorCodeBadRequest, stmtErr.Code)
+}
+
+func TestExecuteSelectInterruptedSetsContextError(t *testing.T) {
+	ctx, cancel := context.WithCancel(cmdio.MockDiscard(t.Context()))
+	mockAPI := mocksql.NewMockStatementExecutionInterface(t)
+
+	mockAPI.EXPECT().ExecuteStatement(mock.Anything, mock.Anything).RunAndReturn(
+		func(context.Context, sql.ExecuteStatementRequest) (*sql.StatementResponse, error) {
+			cancel()
+			return &sql.StatementResponse{StatementId: "s1", Status: &sql.StatementStatus{State: sql.StatementStatePending}}, nil
+		})
+
+	client := sqlexec.New(mockAPI, "wh-1")
+	_, err := client.Execute(ctx, "SELECT * FROM `x`.`y`.`z` LIMIT 25")
+	require.Error(t, err)
+	assert.Error(t, ctx.Err())
+}
diff --git a/cmd/pipelines/utils.go b/cmd/pipelines/utils.go
index b67d76ad2db..39cc74f3681 100644
--- a/cmd/pipelines/utils.go
+++ b/cmd/pipelines/utils.go
@@ -12,6 +12,7 @@ import (
 	configresources "github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/cli/bundle/resources"
 	"github.com/databricks/cli/bundle/run"
+	"github.com/databricks/cli/libs/auth"
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/logdiag"
@@ -186,7 +187,7 @@ func fetchAllPipelineEvents(ctx context.Context, w *databricks.WorkspaceClient,
 		ctx,
 		"GET",
 		path,
-		nil,
+		auth.WorkspaceIDHeaders(w.Config),
 		nil,
 		queryParams,
 		&response,
@@ -278,6 +279,10 @@ func updatesAfter(updates []pipelines.UpdateInfo, ts int64) []pipelines.UpdateIn
 // assuming updates are in descending order, largest CreationTime first.
 // Time is in milliseconds since epoch. If time is nil, it is ignored.
 func filterUpdates(updates []pipelines.UpdateInfo, startTime, endTime *int64) ([]pipelines.UpdateInfo, error) {
+	if len(updates) == 0 {
+		return updates, nil
+	}
+
 	if (endTime == nil || updates[0].CreationTime <= *endTime) && (startTime == nil || updates[len(updates)-1].CreationTime >= *startTime) {
 		return updates, nil
 	}
diff --git a/cmd/psql/psql.go b/cmd/psql/psql.go
index e7f3a65f8b3..b07f37f6c6c 100644
--- a/cmd/psql/psql.go
+++ b/cmd/psql/psql.go
@@ -181,7 +181,10 @@ For more information, see: https://docs.databricks.com/aws/en/oltp/
 		ctx := cmd.Context()
 		w := cmdctx.WorkspaceClient(ctx)
 
-		instances, projects := listAllDatabases(ctx, w)
+		instances, projects, err := listAllDatabases(ctx, w)
+		if err != nil {
+			return nil, cobra.ShellCompDirectiveError
+		}
 
 		var names []string
 		for _, inst := range instances {
@@ -237,8 +240,10 @@ func parseResourcePath(input string) (project, branch, endpoint string, err erro
 }
 
 // listAllDatabases fetches all database instances and projects in parallel.
-// Errors are silently ignored; callers should check for empty results.
-func listAllDatabases(ctx context.Context, w *databricks.WorkspaceClient) ([]database.DatabaseInstance, []postgres.Project) {
+// A single failing call is tolerated because a workspace may have only one of
+// the two products enabled; an error is returned only when both calls fail,
+// so that e.g. an auth failure is not reported as an empty workspace.
+func listAllDatabases(ctx context.Context, w *databricks.WorkspaceClient) ([]database.DatabaseInstance, []postgres.Project, error) {
 	type result[T any] struct {
 		value []T
 		err   error
@@ -260,6 +265,10 @@ func listAllDatabases(ctx context.Context, w *databricks.WorkspaceClient) ([]dat
 	instResult := <-instancesCh
 	projResult := <-projectsCh
 
+	if instResult.err != nil && projResult.err != nil {
+		return nil, nil, errors.Join(instResult.err, projResult.err)
+	}
+
 	var instances []database.DatabaseInstance
 	var projects []postgres.Project
 	if instResult.err == nil {
@@ -269,7 +278,7 @@ func listAllDatabases(ctx context.Context, w *databricks.WorkspaceClient) ([]dat
 		projects = projResult.value
 	}
 
-	return instances, projects
+	return instances, projects, nil
 }
 
 // showSelectionAndConnect shows a combined dropdown of Lakebase databases.
@@ -278,8 +287,11 @@ func showSelectionAndConnect(ctx context.Context, retryConfig libpsql.RetryConfi
 
 	sp := cmdio.NewSpinner(ctx)
 	sp.Update("Loading Lakebase databases...")
-	instances, projects := listAllDatabases(ctx, w)
+	instances, projects, err := listAllDatabases(ctx, w)
 	sp.Close()
+	if err != nil {
+		return fmt.Errorf("failed to list Lakebase databases: %w", err)
+	}
 
 	if len(instances) == 0 && len(projects) == 0 {
 		return errors.New("no Lakebase databases found in workspace")
diff --git a/cmd/psql/psql_autoscaling.go b/cmd/psql/psql_autoscaling.go
index 00c555e4c12..331e05b55b5 100644
--- a/cmd/psql/psql_autoscaling.go
+++ b/cmd/psql/psql_autoscaling.go
@@ -10,6 +10,7 @@ import (
 	"github.com/databricks/cli/libs/cmdio"
 	libpsql "github.com/databricks/cli/libs/psql"
 	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/service/iam"
 	"github.com/databricks/databricks-sdk-go/service/postgres"
 )
 
@@ -37,7 +38,7 @@ func connectAutoscaling(ctx context.Context, projectID, branchID, endpointID str
 		return err
 	}
 
-	user, err := w.CurrentUser.Me(ctx)
+	user, err := w.CurrentUser.Me(ctx, iam.MeRequest{})
 	if err != nil {
 		return fmt.Errorf("failed to get current user: %w", err)
 	}
diff --git a/cmd/psql/psql_provisioned.go b/cmd/psql/psql_provisioned.go
index 88ca1bb9181..272dfd7d687 100644
--- a/cmd/psql/psql_provisioned.go
+++ b/cmd/psql/psql_provisioned.go
@@ -4,13 +4,14 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"uuid"
 
 	"github.com/databricks/cli/libs/cmdctx"
 	"github.com/databricks/cli/libs/cmdio"
 	libpsql "github.com/databricks/cli/libs/psql"
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/service/database"
-	"github.com/google/uuid"
+	"github.com/databricks/databricks-sdk-go/service/iam"
 )
 
 // provisionedDefaultDatabase is the default database for Lakebase Provisioned instances.
@@ -26,7 +27,7 @@ func connectProvisioned(ctx context.Context, instanceName string, retryConfig li
 		return err
 	}
 
-	user, err := w.CurrentUser.Me(ctx)
+	user, err := w.CurrentUser.Me(ctx, iam.MeRequest{})
 	if err != nil {
 		return fmt.Errorf("failed to get current user: %w", err)
 	}
@@ -41,7 +42,7 @@ func connectProvisioned(ctx context.Context, instanceName string, retryConfig li
 
 	cred, err := w.Database.GenerateDatabaseCredential(ctx, database.GenerateDatabaseCredentialRequest{
 		InstanceNames: []string{instance.Name},
-		RequestId:     uuid.NewString(),
+		RequestId:     uuid.New().String(),
 	})
 	if err != nil {
 		return fmt.Errorf("failed to get database credentials: %w", err)
diff --git a/cmd/psql/psql_test.go b/cmd/psql/psql_test.go
index fc8a7e53cba..c33a8c32a19 100644
--- a/cmd/psql/psql_test.go
+++ b/cmd/psql/psql_test.go
@@ -1,9 +1,14 @@
 package psql
 
 import (
+	"errors"
 	"testing"
 
+	"github.com/databricks/databricks-sdk-go/experimental/mocks"
+	"github.com/databricks/databricks-sdk-go/service/database"
+	"github.com/databricks/databricks-sdk-go/service/postgres"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
 )
 
@@ -81,3 +86,74 @@ func TestParseResourcePath(t *testing.T) {
 		})
 	}
 }
+
+func TestListAllDatabases(t *testing.T) {
+	instErr := errors.New("instances list failed")
+	projErr := errors.New("projects list failed")
+	instances := []database.DatabaseInstance{{Name: "my-instance"}}
+	projects := []postgres.Project{{Name: "projects/my-project"}}
+
+	tests := []struct {
+		name          string
+		instErr       error
+		projErr       error
+		wantInstances []database.DatabaseInstance
+		wantProjects  []postgres.Project
+		wantErr       bool
+	}{
+		{
+			name:          "both succeed",
+			wantInstances: instances,
+			wantProjects:  projects,
+		},
+		{
+			name:         "instances call fails",
+			instErr:      instErr,
+			wantProjects: projects,
+		},
+		{
+			name:          "projects call fails",
+			projErr:       projErr,
+			wantInstances: instances,
+		},
+		{
+			name:    "both calls fail",
+			instErr: instErr,
+			projErr: projErr,
+			wantErr: true,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			m := mocks.NewMockWorkspaceClient(t)
+
+			var instReturn []database.DatabaseInstance
+			if tc.instErr == nil {
+				instReturn = instances
+			}
+			m.GetMockDatabaseAPI().EXPECT().
+				ListDatabaseInstancesAll(mock.Anything, database.ListDatabaseInstancesRequest{}).
+				Return(instReturn, tc.instErr)
+
+			var projReturn []postgres.Project
+			if tc.projErr == nil {
+				projReturn = projects
+			}
+			m.GetMockPostgresAPI().EXPECT().
+				ListProjectsAll(mock.Anything, postgres.ListProjectsRequest{}).
+				Return(projReturn, tc.projErr)
+
+			gotInstances, gotProjects, err := listAllDatabases(t.Context(), m.WorkspaceClient)
+			if tc.wantErr {
+				require.Error(t, err)
+				assert.ErrorIs(t, err, tc.instErr)
+				assert.ErrorIs(t, err, tc.projErr)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tc.wantInstances, gotInstances)
+			assert.Equal(t, tc.wantProjects, gotProjects)
+		})
+	}
+}
diff --git a/cmd/quickstart/.gitattributes b/cmd/quickstart/.gitattributes
new file mode 100644
index 00000000000..c2c839a7c6b
--- /dev/null
+++ b/cmd/quickstart/.gitattributes
@@ -0,0 +1,6 @@
+# These markdown files are embedded into the binary with go:embed and their
+# newlines are semantically important: stripFrontmatter matches an LF fence
+# ("---\n"), so an extra \r on Windows would leave the frontmatter unstripped.
+# Always check them out with \n so the embedded content is identical on every
+# platform.
+*.md text eol=lf
diff --git a/cmd/quickstart/quickstart-agent.md b/cmd/quickstart/quickstart-agent.md
new file mode 100644
index 00000000000..58bef9ea45c
--- /dev/null
+++ b/cmd/quickstart/quickstart-agent.md
@@ -0,0 +1,93 @@
+---
+name: databricks-quickstart
+description: First-contact orientation for the Databricks CLI when no Databricks skill is loaded. Covers OAuth auth, profile selection, command discovery, and installing the right skill for the task. Read this before attempting any Databricks work.
+---
+
+# Databricks Quickstart
+
+The `databricks` CLI wraps the public Databricks REST API — there's a command for essentially every API endpoint, so almost any Databricks task can be driven from here. If something looks unsupported, it's almost always a command you haven't found yet, not a real gap. The headline workflow: build durable resources as code with **Declarative Automation Bundles (DABs)** and ship them with `databricks bundle deploy` (see Build and deploy below).
+
+## Golden rules
+
+- **Reason, don't refuse.** Before telling the user something can't be done, run `databricks <group> --help` and install the matching skill (below). Almost everything is reachable through the CLI.
+- **Build with bundles.** For anything durable — jobs, pipelines, dashboards, apps — define it as code in a Declarative Automation Bundle (DABs) and ship with `databricks bundle deploy`, not one-off API calls.
+- **Pick the profile deliberately.** Run `databricks auth profiles`. If only one profile exists, use it. If one is already set as the default (via `databricks auth switch`), assume that one — you can confirm if unsure. Otherwise, show the user the profiles with their workspace URLs and let them choose. Don't invent profile names.
+- **Always pass `--profile <name>`.** Each Bash command runs in its own shell, so a separate `export DATABRICKS_CONFIG_PROFILE=...` line does NOT persist. Use the flag, or chain with `&&`.
+- **OAuth, never PAT.** Authenticate with `databricks auth login`, not personal access tokens.
+
+## Step 1 — Authenticate
+
+```bash
+databricks auth profiles                  # already set up? lists profiles + validity
+databricks auth login --profile <name>    # if not — opens login.databricks.com to pick a workspace
+```
+
+No host needed: without `--host`, login opens login.databricks.com and the user picks a workspace in the browser. Only pass `--host <url>` if the user already gave you a specific workspace URL. Always pass a descriptive `--profile <name>` (e.g. `dev-aws`, `prod-azure`) so you can target it reliably afterward — ask the user for the name rather than inventing one.
+
+## Step 2 — Verify
+
+```bash
+databricks current-user me --profile <name>
+```
+
+## Build and deploy with Declarative Automation Bundles (DABs)
+
+**DABs are the standard, recommended way to build on Databricks.** A bundle is a project with a `databricks.yml` that declares your resources (jobs, pipelines, dashboards, apps) and its targets (e.g. dev, prod) — one project, one deploy, every resource type:
+
+```bash
+databricks bundle init                     # scaffold a project from a template
+databricks bundle validate                 # check the config
+databricks bundle deploy -t dev            # deploy everything to a target (dev, prod, ...)
+databricks bundle run <resource> -t dev    # run a job or pipeline
+```
+
+Read the `databricks-dabs` skill for bundle structure, resource schemas, and multi-target setup.
+
+**Databricks Apps** (full-stack TypeScript + React via AppKit) build on bundles too, with a dedicated scaffolder — see `databricks-apps`:
+
+```bash
+databricks apps init          # scaffold an AppKit app (generates the bundle for you)
+databricks apps deploy        # deploy it to the workspace
+databricks apps run-local     # develop locally (or `dev-remote` against the workspace)
+```
+
+## Common commands
+
+```bash
+databricks jobs list --profile <name>
+databricks pipelines list --profile <name>
+databricks apps list --profile <name>
+databricks warehouses list --profile <name>
+
+# Unity Catalog data uses POSITIONAL args, NOT flags:
+databricks catalogs list --profile <name>
+databricks schemas list <catalog> --profile <name>
+databricks tables list <catalog> <schema> --profile <name>
+```
+
+Unsure of a command's shape? Run `databricks <command> --help`.
+
+## Install skills for the task
+
+Skills give you Databricks-specific patterns so you build resources correctly instead of guessing. They install into your coding agent (auto-detected):
+
+```bash
+databricks aitools install                 # stable skills
+databricks aitools install --experimental  # broader coverage: more areas, lower quality bar
+databricks aitools list                    # available + installed skills — check this for the latest
+```
+
+The set evolves, so run `databricks aitools list` rather than relying on a fixed list. Common ones: `databricks-core` (CLI/auth), `databricks-jobs`, `databricks-pipelines`, `databricks-dabs` (deploy as code), `databricks-apps`. Experimental skills reach further (Unity Catalog, vector search, dashboards, AI functions, and more) — worth a look depending on the prompt.
+
+## Explore data
+
+Use the built-in tools instead of guessing SQL or navigating by hand:
+
+```bash
+databricks experimental aitools tools discover-schema <catalog>.<schema>.<table> --profile <name>
+databricks experimental aitools tools query "SELECT * FROM <table> LIMIT 10" --profile <name>
+```
+
+## When you get stuck
+
+Re-read `databricks <group> --help`, install the matching skill, and check https://docs.databricks.com. If you truly can't do something yourself, tell the user how they can — don't tell them Databricks can't.
diff --git a/cmd/quickstart/quickstart-human.md b/cmd/quickstart/quickstart-human.md
new file mode 100644
index 00000000000..26bfef18be7
--- /dev/null
+++ b/cmd/quickstart/quickstart-human.md
@@ -0,0 +1,67 @@
+# Welcome to Databricks
+
+Databricks is one place for all your data and AI work: store and govern data, run SQL and notebooks, build pipelines and dashboards, train and serve models, and ship apps. No stitching together separate tools.
+
+This guide takes you from zero to your first command.
+
+## What you need
+
+A **workspace** — your Databricks home, at a URL like `https://your-company.cloud.databricks.com`. No access yet? Sign up for a free trial at https://www.databricks.com (Databricks Free Edition is great for learning). You've already got the CLI — it's how you're reading this.
+
+## A few concepts (the 30-second version)
+
+- **Workspace** — the environment you log into. Notebooks, jobs, dashboards, and data all live here.
+- **Unity Catalog** — how Databricks governs your data. Tables are named in three parts: `catalog.schema.table` (think folder → subfolder → table).
+- **Compute** — where your code runs. *SQL warehouses* run SQL; *clusters* and *serverless* run notebooks and jobs.
+- **Profile** — a saved connection to a workspace on your machine, so you don't re-enter credentials each time.
+
+## Step 1 — Connect to your workspace
+
+```bash
+databricks auth login
+```
+This opens **login.databricks.com** in your browser. Sign in, pick the workspace you want, and you're connected — no URL to look up. The CLI saves the connection as a *profile*; if it's your only workspace, press Enter to accept the suggested name and every command will use it automatically. Run `databricks auth login` again any time to add another workspace.
+
+Already know your workspace URL? Go straight to it: `databricks auth login --host https://your-company.cloud.databricks.com --profile my-workspace`.
+
+## Step 2 — Try it out
+
+```bash
+databricks current-user me     # who am I?
+databricks catalogs list       # what data can I see?
+databricks jobs list           # my jobs
+```
+To see everything a command can do, add `--help` — for example, `databricks jobs --help`.
+
+Got more than one workspace? Name each at login (`databricks auth login --profile prod`), then target it with `--profile`, e.g. `databricks jobs list --profile prod`.
+
+💡 **Tip:** turn on tab-completion so you can `Tab` through commands and flags: `databricks completion install`.
+
+## Step 3 — Build something
+
+The standard way to build on Databricks is **Declarative Automation Bundles (DABs)** — your jobs, pipelines, dashboards, and apps defined as code in one project, shipped with one command:
+
+```bash
+databricks bundle init                 # start from a template
+databricks bundle validate             # check it
+databricks bundle deploy -t dev        # ship it to your workspace
+databricks bundle run <name> -t dev    # run a job or pipeline
+```
+
+Want a **full-stack app**? AppKit scaffolds one in TypeScript + React:
+
+```bash
+databricks apps init          # scaffold the app
+databricks apps deploy        # deploy it to your workspace
+databricks apps run-local     # develop locally (or dev-remote)
+```
+
+## Where to go next
+
+- **Explore your data** — browse catalogs, schemas, and tables, or query them from the workspace UI.
+- **More to build** — Lakeflow Jobs (orchestration), Lakeflow Pipelines (ETL), AI/BI Dashboards, and Model Serving.
+- **Using an AI coding assistant?** Install the Databricks skills so it knows these patterns: `databricks aitools install`.
+
+📚 Full docs: https://docs.databricks.com  •  CLI reference: https://docs.databricks.com/dev-tools/cli
+
+Welcome aboard.
diff --git a/cmd/quickstart/quickstart.go b/cmd/quickstart/quickstart.go
new file mode 100644
index 00000000000..34ab996ba7a
--- /dev/null
+++ b/cmd/quickstart/quickstart.go
@@ -0,0 +1,73 @@
+package quickstart
+
+import (
+	_ "embed"
+	"fmt"
+	"strings"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/spf13/cobra"
+)
+
+// humanQuickstart is the friendly, default introduction shown to people.
+//
+//go:embed quickstart-human.md
+var humanQuickstart string
+
+// agentQuickstart is the denser, agent-oriented version. It is also the
+// `databricks-quickstart` skill, so it carries skill frontmatter that
+// stripFrontmatter removes before printing.
+//
+//go:embed quickstart-agent.md
+var agentQuickstart string
+
+func New() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "quickstart",
+		Args:  root.NoArgs,
+		Short: "Print an introduction to the Databricks CLI",
+		Long: `Print a short introduction to the Databricks CLI: authentication, profiles,
+building with Declarative Automation Bundles, and where to go next.
+
+Prints a human-friendly guide by default. When stdout is not an interactive
+terminal (for example, when a coding agent runs the command), it prints a
+denser, agent-oriented version instead.`,
+	}
+
+	cmd.RunE = func(cmd *cobra.Command, args []string) error {
+		content := quickstartFor(cmdio.IsPromptSupported(cmd.Context()))
+		_, err := fmt.Fprintln(cmd.OutOrStdout(), content)
+		return err
+	}
+
+	return cmd
+}
+
+// quickstartFor returns the quickstart text for the caller. Interactive
+// terminals (people) get the friendly guide; non-interactive callers (coding
+// agents, scripts, CI) get the agent-oriented version. The detection is
+// intentionally simple for now and can grow more precise later.
+func quickstartFor(interactive bool) string {
+	if interactive {
+		return strings.TrimRight(humanQuickstart, "\n")
+	}
+	return stripFrontmatter(agentQuickstart)
+}
+
+// stripFrontmatter removes a leading YAML frontmatter block ("---\n...\n---\n")
+// so the printed output starts at the document heading rather than the skill
+// metadata. Input without frontmatter is returned unchanged (trailing newlines
+// trimmed). Fprintln re-adds a single trailing newline.
+func stripFrontmatter(s string) string {
+	const fence = "---\n"
+	if !strings.HasPrefix(s, fence) {
+		return strings.TrimRight(s, "\n")
+	}
+	rest := s[len(fence):]
+	_, body, found := strings.Cut(rest, "\n"+fence)
+	if !found {
+		return strings.TrimRight(s, "\n")
+	}
+	return strings.TrimRight(strings.TrimLeft(body, "\n"), "\n")
+}
diff --git a/cmd/quickstart/quickstart_test.go b/cmd/quickstart/quickstart_test.go
new file mode 100644
index 00000000000..a2b8b83f434
--- /dev/null
+++ b/cmd/quickstart/quickstart_test.go
@@ -0,0 +1,58 @@
+package quickstart
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestQuickstartForInteractiveReturnsHumanGuide(t *testing.T) {
+	out := quickstartFor(true)
+	assert.Contains(t, out, "# Welcome to Databricks")
+	assert.NotContains(t, out, "## Golden rules")
+	assert.False(t, strings.HasSuffix(out, "\n"), "trailing newline should be trimmed; Fprintln re-adds one")
+}
+
+func TestQuickstartForNonInteractiveReturnsAgentGuide(t *testing.T) {
+	out := quickstartFor(false)
+	assert.Contains(t, out, "# Databricks Quickstart")
+	assert.Contains(t, out, "## Golden rules")
+	// Frontmatter must be stripped so the output starts at the heading.
+	assert.True(t, strings.HasPrefix(out, "# Databricks Quickstart"))
+	assert.NotContains(t, out, "name: databricks-quickstart")
+}
+
+func TestStripFrontmatter(t *testing.T) {
+	tests := []struct {
+		name string
+		in   string
+		want string
+	}{
+		{
+			name: "with frontmatter",
+			in:   "---\nname: x\ndescription: y\n---\n\n# Title\n\nbody\n",
+			want: "# Title\n\nbody",
+		},
+		{
+			name: "without frontmatter",
+			in:   "# Title\n\nbody\n",
+			want: "# Title\n\nbody",
+		},
+		{
+			name: "unterminated frontmatter is left intact",
+			in:   "---\nname: x\n# Title",
+			want: "---\nname: x\n# Title",
+		},
+		{
+			name: "empty",
+			in:   "",
+			want: "",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, stripFrontmatter(tt.in))
+		})
+	}
+}
diff --git a/cmd/root/auth.go b/cmd/root/auth.go
index 0c3c77233f6..5c03c8cfa8c 100644
--- a/cmd/root/auth.go
+++ b/cmd/root/auth.go
@@ -12,7 +12,7 @@ import (
 	"github.com/databricks/cli/libs/databrickscfg"
 	"github.com/databricks/cli/libs/databrickscfg/profile"
 	envlib "github.com/databricks/cli/libs/env"
-	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/liteswap"
 	"github.com/databricks/cli/libs/logdiag"
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/config"
@@ -53,6 +53,55 @@ func initProfileFlag(cmd *cobra.Command) {
 	cmd.RegisterFlagCompletionFunc("profile", profile.ProfileCompletion)
 }
 
+// isPATOnSPOGWithoutWorkspaceID reports whether the resolved config is a PAT
+// profile pointing at a SPOG host with no workspace_id set. The SDK strips the
+// routing identifier from the request, which lands on the account-plane where
+// PATs aren't accepted. The legacy "none" sentinel (profile.WorkspaceIDNone) is
+// treated as empty here, matching the convention used elsewhere in the repo
+// (e.g. libs/databrickscfg/profile/profiler.go).
+func isPATOnSPOGWithoutWorkspaceID(cfg *config.Config) bool {
+	return cfg.AuthType == auth.AuthTypePat &&
+		(cfg.WorkspaceID == "" || cfg.WorkspaceID == profile.WorkspaceIDNone) &&
+		auth.HasUnifiedHostSignal(cfg.DiscoveryURL)
+}
+
+// patSPOGNoWorkspaceIDError describes the configuration gap and how to fix it.
+func patSPOGNoWorkspaceIDError(profileName string) error {
+	if profileName == "" {
+		return errors.New("personal access token (PAT) auth on this host requires a workspace_id; PATs are workspace-scoped, but no workspace_id is set. Add workspace_id = <id> (or set DATABRICKS_WORKSPACE_ID) to the profile associated with this PAT token")
+	}
+	return fmt.Errorf("profile %q uses PAT auth on a SPOG host but is missing workspace_id; PATs are workspace-scoped, so the request can't be routed. Edit the profile to add workspace_id = <id> matching the workspace the token was minted in", profileName)
+}
+
+// ErrAccountOnlyProfile signals that the resolved profile has an account_id
+// but no workspace_id, so workspace APIs can't be reached. Workspace-only
+// commands surface this as an actionable error; MustAnyClient (used by `auth
+// describe` and similar) recognizes the type and falls through to the account
+// client so account-only profiles still describe cleanly.
+type ErrAccountOnlyProfile struct {
+	profileName string
+	// host is the profile's canonical host name (config.CanonicalHostName);
+	// IsClassicAccountHost only matches the canonical form.
+	host string
+}
+
+func (e ErrAccountOnlyProfile) Error() string {
+	// A classic account console host serves no workspace APIs at all, so the
+	// generic "set workspace_id" advice below can never make workspace
+	// commands work there; following it is how broken profiles get created
+	// (https://github.com/databricks/cli/issues/5479).
+	if auth.IsClassicAccountHost(e.host) {
+		return fmt.Sprintf("profile %q points to a Databricks account console host (%s), which serves only account-level APIs; this command requires a workspace. Run `databricks auth login --host https://<workspace-url>` to create a workspace profile, or use `databricks account ...` commands with this profile", e.profileName, e.host)
+	}
+	return fmt.Sprintf("profile %q has no workspace_id set (account-only); this command requires a workspace. Edit the profile to set workspace_id to a real ID, or pass --profile with a workspace-scoped profile", e.profileName)
+}
+
+// accountOnlyProfileError describes why a workspace command can't run against
+// a profile that has an account_id but no workspace_id.
+func accountOnlyProfileError(cfg *config.Config) error {
+	return ErrAccountOnlyProfile{profileName: cfg.Profile, host: cfg.CanonicalHostName()}
+}
+
 func profileFlagValue(cmd *cobra.Command) (string, bool) {
 	profileFlag := cmd.Flag("profile")
 	if profileFlag == nil {
@@ -62,6 +111,17 @@ func profileFlagValue(cmd *cobra.Command) (string, bool) {
 	return value, value != ""
 }
 
+// applyProfileAuthPrecedence makes an explicit --profile win over auth env vars
+// via ProfileAuthLoaders (#5096), skipping env host normalization since the host
+// comes from the profile. Without a profile flag, env-first behavior is kept.
+func applyProfileAuthPrecedence(ctx context.Context, cfg *config.Config, hasProfileFlag bool) {
+	if hasProfileFlag {
+		cfg.Loaders = databrickscfg.ProfileAuthLoaders
+		return
+	}
+	auth.NormalizeDatabricksConfigFromEnv(ctx, cfg)
+}
+
 // Helper function to create an account client or prompt once if the given configuration is not valid.
 func accountClientOrPrompt(ctx context.Context, cfg *config.Config, allowPrompt bool) (*databricks.AccountClient, error) {
 	a, err := databricks.NewAccountClient((*databricks.Config)(cfg))
@@ -110,12 +170,12 @@ func accountClientOrPrompt(ctx context.Context, cfg *config.Config, allowPrompt
 	if err != nil {
 		return nil, err
 	}
+	// The picked profile resolves into its own config, not the caller's cfg.
+	// Return the client (even on failure) so the caller renders errors against
+	// that config rather than the original, otherwise-empty one.
 	a, err = databricks.NewAccountClient(&databricks.Config{Profile: profile})
 	if err == nil {
 		err = a.Config.Authenticate(emptyHttpRequest(ctx))
-		if err != nil {
-			return nil, err
-		}
 	}
 	return a, err
 }
@@ -128,15 +188,17 @@ func MustAnyClient(cmd *cobra.Command, args []string) (bool, error) {
 	}
 
 	// If the error indicates a wrong config type (workspace host used for account client,
-	// or config type mismatch detected by workspaceClientOrPrompt), fall through to try
-	// account client.
-	if !errors.Is(werr, errNotWorkspaceClient) && !errors.As(werr, &ErrNoWorkspaceProfiles{}) {
+	// or config type mismatch detected by workspaceClientOrPrompt), or an account-only
+	// profile (no workspace_id), fall through to try the account client.
+	_, noWorkspaceProfiles := errors.AsType[ErrNoWorkspaceProfiles](werr)
+	_, accountOnly := errors.AsType[ErrAccountOnlyProfile](werr)
+	if !errors.Is(werr, errNotWorkspaceClient) && !noWorkspaceProfiles && !accountOnly {
 		return false, werr
 	}
 
 	// Otherwise, the config used is account client one, so try to create an account client
 	aerr := MustAccountClient(cmd, args)
-	if errors.As(aerr, &ErrNoAccountProfiles{}) {
+	if _, ok := errors.AsType[ErrNoAccountProfiles](aerr); ok {
 		return false, aerr
 	}
 
@@ -145,20 +207,22 @@ func MustAnyClient(cmd *cobra.Command, args []string) (bool, error) {
 
 func MustAccountClient(cmd *cobra.Command, args []string) error {
 	cfg := &config.Config{}
+	ctx := cmd.Context()
+	liteswap.Apply(ctx, cfg)
 
 	// The command-line profile flag takes precedence over DATABRICKS_CONFIG_PROFILE.
 	pr, hasProfileFlag := profileFlagValue(cmd)
 	if hasProfileFlag {
 		cfg.Profile = pr
 	}
+	applyProfileAuthPrecedence(ctx, cfg, hasProfileFlag)
 
-	ctx := cmd.Context()
 	ctx = cmdctx.SetConfigUsed(ctx, cfg)
 	cmd.SetContext(ctx)
 
 	profiler := profile.GetProfiler(ctx)
 
-	resolveDefaultProfile(ctx, cfg)
+	ResolveDefaultProfile(ctx, cfg)
 
 	if cfg.Profile == "" {
 		// account-level CLI was not really done before, so here are the assumptions:
@@ -179,6 +243,11 @@ func MustAccountClient(cmd *cobra.Command, args []string) error {
 	allowPrompt := !hasProfileFlag && !shouldSkipPrompt(cmd.Context())
 	a, err := accountClientOrPrompt(cmd.Context(), cfg, allowPrompt)
 	if err != nil {
+		// A profile picked interactively resolves into the client's own config,
+		// not cfg; render against it so the error names the right profile.
+		if a != nil {
+			cfg = a.Config
+		}
 		return renderError(ctx, cfg, err)
 	}
 
@@ -190,6 +259,30 @@ func MustAccountClient(cmd *cobra.Command, args []string) error {
 // Helper function to create a workspace client or prompt once if the given configuration is not valid.
 func workspaceClientOrPrompt(ctx context.Context, cfg *config.Config, allowPrompt bool) (*databricks.WorkspaceClient, error) {
 	w, err := databricks.NewWorkspaceClient((*databricks.Config)(cfg))
+	if err == nil && cfg.Profile != "" && cfg.AccountID != "" &&
+		(cfg.WorkspaceID == "" || cfg.WorkspaceID == profile.WorkspaceIDNone) {
+		// Account-only profile (created with --skip-workspace): account_id is
+		// set but workspace_id is absent (new shape) or the legacy "none"
+		// sentinel. Without a workspace_id the SDK would either send "none" as
+		// a routing identifier or fail later with an opaque auth error.
+		// Reject up front with a message the user can act on.
+		//
+		// We require cfg.Profile to be set so we don't reject env-var-only
+		// configs targeting a unified host where workspace APIs are also
+		// served from the account host. This branch runs first so MustAnyClient
+		// can recognize ErrAccountOnlyProfile and fall through to the account
+		// client; the PAT-on-SPOG check below handles the remaining cases
+		// (env-var-only configs and profiles without account_id resolved).
+		return nil, accountOnlyProfileError(cfg)
+	}
+	if err == nil && isPATOnSPOGWithoutWorkspaceID(cfg) {
+		// PATs are workspace-scoped. On a SPOG host without workspace_id the
+		// SDK can't add the routing identifier, the backend treats the call as
+		// account-plane, and PATs aren't accepted there. The result is an
+		// opaque "Credential was not sent" error from the auth endpoint;
+		// rewrite up front so the user sees what's actually wrong.
+		return nil, patSPOGNoWorkspaceIDError(cfg.Profile)
+	}
 	if err == nil {
 		err = w.Config.Authenticate(emptyHttpRequest(ctx))
 	}
@@ -229,12 +322,12 @@ func workspaceClientOrPrompt(ctx context.Context, cfg *config.Config, allowPromp
 	if err != nil {
 		return nil, err
 	}
+	// The picked profile resolves into its own config, not the caller's cfg.
+	// Return the client (even on failure) so the caller renders errors against
+	// that config rather than the original, otherwise-empty one.
 	w, err = databricks.NewWorkspaceClient(&databricks.Config{Profile: profile})
 	if err == nil {
 		err = w.Config.Authenticate(emptyHttpRequest(ctx))
-		if err != nil {
-			return nil, err
-		}
 	}
 	return w, err
 }
@@ -244,14 +337,15 @@ func MustWorkspaceClient(cmd *cobra.Command, args []string) error {
 	cmd.SetContext(ctx)
 
 	cfg := &config.Config{}
+	liteswap.Apply(ctx, cfg)
 
 	// The command-line profile flag takes precedence over DATABRICKS_CONFIG_PROFILE.
 	profile, hasProfileFlag := profileFlagValue(cmd)
 	if hasProfileFlag {
 		cfg.Profile = profile
 	}
-
-	resolveDefaultProfile(ctx, cfg)
+	applyProfileAuthPrecedence(ctx, cfg, hasProfileFlag)
+	ResolveDefaultProfile(ctx, cfg)
 
 	_, isTargetFlagSet := targetFlagValue(cmd)
 	// If the profile flag is set but the target flag is not, we should skip loading the bundle configuration.
@@ -285,6 +379,11 @@ func MustWorkspaceClient(cmd *cobra.Command, args []string) error {
 	allowPrompt := !hasProfileFlag && !shouldSkipPrompt(cmd.Context())
 	w, err := workspaceClientOrPrompt(cmd.Context(), cfg, allowPrompt)
 	if err != nil {
+		// A profile picked interactively resolves into the client's own config,
+		// not cfg; render against it so the error names the right profile.
+		if w != nil {
+			cfg = w.Config
+		}
 		return renderError(ctx, cfg, err)
 	}
 
@@ -293,20 +392,21 @@ func MustWorkspaceClient(cmd *cobra.Command, args []string) error {
 	return nil
 }
 
-// resolveDefaultProfile applies the [__settings__].default_profile setting
-// when no profile is specified via --profile flag or DATABRICKS_CONFIG_PROFILE.
-func resolveDefaultProfile(ctx context.Context, cfg *config.Config) {
+// ResolveDefaultProfile applies [__settings__].default_profile when no profile
+// is set via --profile or DATABRICKS_CONFIG_PROFILE.
+//
+// It skips when DATABRICKS_HOST is set: the SDK ignores .databrickscfg while
+// cfg.Profile is empty, so pinning a default profile would merge it with the env
+// config and fail with "more than one authorization method configured" (#5616).
+func ResolveDefaultProfile(ctx context.Context, cfg *config.Config) {
 	if cfg.Profile != "" || envlib.Get(ctx, "DATABRICKS_CONFIG_PROFILE") != "" {
 		return
 	}
-	configFilePath := envlib.Get(ctx, "DATABRICKS_CONFIG_FILE")
-	resolvedProfile, err := databrickscfg.GetConfiguredDefaultProfile(ctx, configFilePath)
-	if err != nil {
-		log.Warnf(ctx, "Failed to load default profile: %v", err)
+	if envlib.Get(ctx, "DATABRICKS_HOST") != "" {
 		return
 	}
-	if resolvedProfile != "" {
-		cfg.Profile = resolvedProfile
+	if resolved := databrickscfg.ResolveDefaultProfile(ctx); resolved != "" {
+		cfg.Profile = resolved
 	}
 }
 
diff --git a/cmd/root/auth_test.go b/cmd/root/auth_test.go
index b0faadd94bf..b455dd0e382 100644
--- a/cmd/root/auth_test.go
+++ b/cmd/root/auth_test.go
@@ -2,7 +2,9 @@ package root
 
 import (
 	"context"
+	"fmt"
 	"net/http"
+	"net/http/httptest"
 	"os"
 	"path/filepath"
 	"testing"
@@ -11,6 +13,7 @@ import (
 	"github.com/databricks/cli/internal/testutil"
 	"github.com/databricks/cli/libs/cmdctx"
 	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/databrickscfg/profile"
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/config"
 	"github.com/stretchr/testify/assert"
@@ -226,6 +229,64 @@ func TestWorkspaceClientOrPrompt(t *testing.T) {
 	})
 }
 
+// TestMustWorkspaceClientRewritesInvalidRefreshTokenForPickedProfile drives the
+// full picker path: with no profile specified, MustWorkspaceClient prompts,
+// picks the only profile, and its cached token fails to refresh. The picked
+// profile lives on a client the picker builds internally, not on the caller's
+// config, so the actionable error must be rendered against the client's config.
+// Before the fix the picker returned a nil client and the user saw the raw
+// "token refresh: ... invalid_grant" error instead. A single-profile store lets
+// AskForWorkspaceProfile resolve without interactive input.
+func TestMustWorkspaceClientRewritesInvalidRefreshTokenForPickedProfile(t *testing.T) {
+	// Fake OIDC endpoints: discovery succeeds, token refresh is rejected as if
+	// the cached refresh token were invalid.
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/oidc/.well-known/oauth-authorization-server":
+			fmt.Fprintf(w, `{"authorization_endpoint":"http://%[1]s/oidc/v1/authorize","token_endpoint":"http://%[1]s/oidc/v1/token"}`, r.Host)
+		case "/oidc/v1/token":
+			w.WriteHeader(http.StatusBadRequest)
+			fmt.Fprint(w, `{"error":"invalid_grant","error_description":"Refresh token is invalid"}`)
+		default:
+			w.WriteHeader(http.StatusNotFound)
+		}
+	}))
+	t.Cleanup(server.Close)
+
+	// Isolate the auth-relevant environment directly rather than via
+	// CleanupEnvironment: that helper calls os.Clearenv, which makes the
+	// httptest server above fail to bind on the Windows CI runner. The other
+	// httptest-based tests avoid it for the same reason.
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
+	t.Setenv("DATABRICKS_AUTH_STORAGE", "plaintext")
+	t.Setenv("DATABRICKS_CACHE_DIR", t.TempDir())
+	t.Setenv("DATABRICKS_HOST", "")
+	t.Setenv("DATABRICKS_TOKEN", "")
+	t.Setenv("DATABRICKS_CONFIG_PROFILE", "")
+
+	configFile := filepath.Join(home, ".databrickscfg")
+	require.NoError(t, os.WriteFile(configFile,
+		[]byte("[only-workspace]\nhost = "+server.URL+"\nauth_type = databricks-cli\n"), 0o600))
+	t.Setenv("DATABRICKS_CONFIG_FILE", configFile)
+
+	// Expired cached token (keyed by profile name) so the command triggers a
+	// refresh, which the server rejects.
+	require.NoError(t, os.MkdirAll(filepath.Join(home, ".databricks"), 0o700))
+	require.NoError(t, os.WriteFile(filepath.Join(home, ".databricks", "token-cache.json"),
+		[]byte(`{"version":1,"tokens":{"only-workspace":{"access_token":"x","token_type":"Bearer","refresh_token":"rt","expiry":"2020-01-01T00:00:00Z"}}}`), 0o600))
+
+	ctx, tt := cmdio.SetupTest(t.Context(), cmdio.TestOptions{PromptSupported: true})
+	t.Cleanup(tt.Done)
+	cmd := New(ctx)
+
+	err := MustWorkspaceClient(cmd, []string{})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "A new access token could not be retrieved because the refresh token is invalid")
+	assert.Contains(t, err.Error(), "databricks auth login --profile only-workspace")
+}
+
 func TestMustAccountClientWorksWithDatabricksCfg(t *testing.T) {
 	testutil.CleanupEnvironment(t)
 
@@ -439,6 +500,139 @@ token = flag-token
 	}
 }
 
+func TestMustWorkspaceClientProfileFlagOverridesAuthEnv(t *testing.T) {
+	testutil.CleanupEnvironment(t)
+
+	configFile := filepath.Join(t.TempDir(), ".databrickscfg")
+	err := os.WriteFile(configFile, []byte(`
+[tst-svc]
+host = https://tst.cloud.databricks.test
+token = tst-token
+`), 0o600)
+	require.NoError(t, err)
+
+	t.Setenv("DATABRICKS_CONFIG_FILE", configFile)
+	// Auth env vars for a different workspace; before #5096 these shadowed --profile.
+	t.Setenv("DATABRICKS_HOST", "https://dev.cloud.databricks.test")
+	t.Setenv("DATABRICKS_TOKEN", "dev-token")
+
+	ctx := cmdio.MockDiscard(t.Context())
+	ctx = SkipLoadBundle(ctx)
+	cmd := New(ctx)
+
+	err = cmd.Flag("profile").Value.Set("tst-svc")
+	require.NoError(t, err)
+
+	err = MustWorkspaceClient(cmd, []string{})
+	require.NoError(t, err)
+
+	w := cmdctx.WorkspaceClient(cmd.Context())
+	require.NotNil(t, w)
+	// The selected profile must win over the auth env vars.
+	assert.Equal(t, "tst-svc", w.Config.Profile)
+	assert.Equal(t, "https://tst.cloud.databricks.test", w.Config.Host)
+	assert.Equal(t, "tst-token", w.Config.Token)
+}
+
+func TestMustWorkspaceClientProfileFlagFillsAuthFromEnv(t *testing.T) {
+	testutil.CleanupEnvironment(t)
+
+	// Host-only profile + DATABRICKS_TOKEN from env, a common CI pattern: the
+	// profile wins for the host, but env fills the token it omits (#5096).
+	configFile := filepath.Join(t.TempDir(), ".databrickscfg")
+	err := os.WriteFile(configFile, []byte(`
+[host-only]
+host = https://tst.cloud.databricks.test
+`), 0o600)
+	require.NoError(t, err)
+
+	t.Setenv("DATABRICKS_CONFIG_FILE", configFile)
+	t.Setenv("DATABRICKS_TOKEN", "env-token")
+
+	ctx := cmdio.MockDiscard(t.Context())
+	ctx = SkipLoadBundle(ctx)
+	cmd := New(ctx)
+
+	err = cmd.Flag("profile").Value.Set("host-only")
+	require.NoError(t, err)
+
+	err = MustWorkspaceClient(cmd, []string{})
+	require.NoError(t, err)
+
+	w := cmdctx.WorkspaceClient(cmd.Context())
+	require.NotNil(t, w)
+	assert.Equal(t, "host-only", w.Config.Profile)
+	assert.Equal(t, "https://tst.cloud.databricks.test", w.Config.Host)
+	// The token is not in the profile, so it is filled from the environment.
+	assert.Equal(t, "env-token", w.Config.Token)
+}
+
+func TestMustWorkspaceClientConfigProfileEnvKeepsAuthEnvPrecedence(t *testing.T) {
+	testutil.CleanupEnvironment(t)
+
+	configFile := filepath.Join(t.TempDir(), ".databrickscfg")
+	err := os.WriteFile(configFile, []byte(`
+[tst-svc]
+host = https://tst.cloud.databricks.test
+token = tst-token
+`), 0o600)
+	require.NoError(t, err)
+
+	t.Setenv("DATABRICKS_CONFIG_FILE", configFile)
+	// Selected via DATABRICKS_CONFIG_PROFILE, not --profile, so env-first
+	// precedence is kept and the auth env vars below still win (#5096).
+	t.Setenv("DATABRICKS_CONFIG_PROFILE", "tst-svc")
+	t.Setenv("DATABRICKS_HOST", "https://dev.cloud.databricks.test")
+	t.Setenv("DATABRICKS_TOKEN", "dev-token")
+
+	ctx := cmdio.MockDiscard(t.Context())
+	ctx = SkipLoadBundle(ctx)
+	cmd := New(ctx)
+
+	err = MustWorkspaceClient(cmd, []string{})
+	require.NoError(t, err)
+
+	w := cmdctx.WorkspaceClient(cmd.Context())
+	require.NotNil(t, w)
+	// The profile name is resolved, but the auth env vars win over its host and
+	// credentials.
+	assert.Equal(t, "tst-svc", w.Config.Profile)
+	assert.Equal(t, "https://dev.cloud.databricks.test", w.Config.Host)
+	assert.Equal(t, "dev-token", w.Config.Token)
+}
+
+func TestMustAccountClientProfileFlagOverridesAuthEnv(t *testing.T) {
+	testutil.CleanupEnvironment(t)
+
+	configFile := filepath.Join(t.TempDir(), ".databrickscfg")
+	err := os.WriteFile(configFile, []byte(`
+[acc-tst]
+host = https://accounts.cloud.databricks.test
+account_id = 1111
+token = tst-token
+`), 0o600)
+	require.NoError(t, err)
+
+	t.Setenv("DATABRICKS_CONFIG_FILE", configFile)
+	// Auth env vars for a different account host; the profile must win.
+	t.Setenv("DATABRICKS_HOST", "https://accounts.dev.databricks.test")
+	t.Setenv("DATABRICKS_TOKEN", "dev-token")
+
+	cmd := New(t.Context())
+	err = cmd.Flag("profile").Value.Set("acc-tst")
+	require.NoError(t, err)
+
+	err = MustAccountClient(cmd, []string{})
+	require.NoError(t, err)
+
+	a := cmdctx.AccountClient(cmd.Context())
+	require.NotNil(t, a)
+	// The selected profile must win over the auth env vars.
+	assert.Equal(t, "acc-tst", a.Config.Profile)
+	assert.Equal(t, "https://accounts.cloud.databricks.test", a.Config.Host)
+	assert.Equal(t, "tst-token", a.Config.Token)
+}
+
 func TestAccountClientOrPromptReturnsErrorForWrongHostType(t *testing.T) {
 	testutil.CleanupEnvironment(t)
 	t.Setenv("PATH", "")
@@ -454,6 +648,247 @@ func TestAccountClientOrPromptReturnsErrorForWrongHostType(t *testing.T) {
 	assert.ErrorIs(t, err, databricks.ErrNotAccountClient)
 }
 
+func TestIsPATOnSPOGWithoutWorkspaceID(t *testing.T) {
+	tests := []struct {
+		name string
+		cfg  *config.Config
+		want bool
+	}{
+		{
+			name: "pat on spog without workspace_id",
+			cfg: &config.Config{
+				AuthType:     "pat",
+				DiscoveryURL: "https://spog.example.test/oidc/accounts/abc/.well-known/oauth-authorization-server",
+			},
+			want: true,
+		},
+		{
+			name: "pat on spog with workspace_id is fine",
+			cfg: &config.Config{
+				AuthType:     "pat",
+				WorkspaceID:  "12345",
+				DiscoveryURL: "https://spog.example.test/oidc/accounts/abc/.well-known/oauth-authorization-server",
+			},
+			want: false,
+		},
+		{
+			name: "pat on spog with legacy 'none' sentinel is treated as missing",
+			cfg: &config.Config{
+				AuthType:     "pat",
+				WorkspaceID:  profile.WorkspaceIDNone,
+				DiscoveryURL: "https://spog.example.test/oidc/accounts/abc/.well-known/oauth-authorization-server",
+			},
+			want: true,
+		},
+		{
+			name: "pat on classic workspace host is fine",
+			cfg: &config.Config{
+				AuthType:     "pat",
+				DiscoveryURL: "https://workspace.example.test/oidc/.well-known/oauth-authorization-server",
+			},
+			want: false,
+		},
+		{
+			name: "u2m on spog is not affected (handled by other paths)",
+			cfg: &config.Config{
+				AuthType:     "databricks-cli",
+				DiscoveryURL: "https://spog.example.test/oidc/accounts/abc/.well-known/oauth-authorization-server",
+			},
+			want: false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, isPATOnSPOGWithoutWorkspaceID(tt.cfg))
+		})
+	}
+}
+
+func TestWorkspaceClientOrPromptRejectsAccountOnlyProfile(t *testing.T) {
+	tests := []struct {
+		name        string
+		workspaceID string
+	}{
+		// New shape: --skip-workspace omits workspace_id entirely.
+		{name: "empty workspace_id", workspaceID: ""},
+		// Legacy shape: older CLIs persisted the "none" sentinel.
+		{name: "legacy none sentinel", workspaceID: "none"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			testutil.CleanupEnvironment(t)
+			t.Setenv("PATH", "")
+
+			cfg := &config.Config{
+				Host:          "https://example.test/",
+				AccountID:     "abc-123",
+				WorkspaceID:   tt.workspaceID,
+				Token:         "foobar",
+				Profile:       "bb",
+				HTTPTransport: noNetworkTransport,
+			}
+
+			w, err := workspaceClientOrPrompt(t.Context(), cfg, false)
+			assert.Nil(t, w)
+			require.Error(t, err)
+			var accountOnly ErrAccountOnlyProfile
+			require.ErrorAs(t, err, &accountOnly)
+			assert.Contains(t, err.Error(), `profile "bb"`)
+			assert.Contains(t, err.Error(), "account-only")
+			assert.Contains(t, err.Error(), "no workspace_id set")
+		})
+	}
+}
+
+func TestErrAccountOnlyProfileMessage(t *testing.T) {
+	tests := []struct {
+		name string
+		err  ErrAccountOnlyProfile
+		want string
+	}{
+		{
+			name: "account console host",
+			err:  ErrAccountOnlyProfile{profileName: "acc", host: "https://accounts.test"},
+			want: "profile \"acc\" points to a Databricks account console host (https://accounts.test), which serves only account-level APIs; " +
+				"this command requires a workspace. Run `databricks auth login --host https://<workspace-url>` to create a workspace profile, " +
+				"or use `databricks account ...` commands with this profile",
+		},
+		{
+			// On non-account-console hosts (SPOG/unified) workspace APIs are
+			// served, so setting workspace_id is still the right fix.
+			name: "other host keeps workspace_id advice",
+			err:  ErrAccountOnlyProfile{profileName: "spog", host: "https://unified.test"},
+			want: "profile \"spog\" has no workspace_id set (account-only); this command requires a workspace. " +
+				"Edit the profile to set workspace_id to a real ID, or pass --profile with a workspace-scoped profile",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, tt.err.Error())
+		})
+	}
+}
+
+func TestWorkspaceClientOrPromptAccountOnlyProfileOnAccountConsoleHost(t *testing.T) {
+	testutil.CleanupEnvironment(t)
+	t.Setenv("PATH", "")
+
+	cfg := &config.Config{
+		Host:          "https://accounts.test/",
+		AccountID:     "abc-123",
+		Token:         "foobar",
+		Profile:       "acc",
+		HTTPTransport: noNetworkTransport,
+	}
+
+	w, err := workspaceClientOrPrompt(t.Context(), cfg, false)
+	assert.Nil(t, w)
+	require.Error(t, err)
+	var accountOnly ErrAccountOnlyProfile
+	require.ErrorAs(t, err, &accountOnly)
+	assert.Contains(t, err.Error(), "account console host (https://accounts.test)")
+	assert.Contains(t, err.Error(), "databricks auth login --host")
+	assert.NotContains(t, err.Error(), "set workspace_id to a real ID")
+}
+
+func TestWorkspaceClientOrPromptRejectsPATOnSPOGWithoutWorkspaceID(t *testing.T) {
+	testutil.CleanupEnvironment(t)
+	t.Setenv("PATH", "")
+
+	// No AccountID is set, so the account-only profile detector (which requires
+	// AccountID) does not fire and the PAT-on-SPOG detector is exercised.
+	cfg := &config.Config{
+		Host:          "https://spog.example.test/",
+		Token:         "dapi-fake",
+		Profile:       "spog-pat",
+		DiscoveryURL:  "https://spog.example.test/oidc/accounts/abc-123/.well-known/oauth-authorization-server",
+		AuthType:      "pat",
+		HTTPTransport: noNetworkTransport,
+	}
+
+	w, err := workspaceClientOrPrompt(t.Context(), cfg, false)
+	assert.Nil(t, w)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), `profile "spog-pat"`)
+	assert.Contains(t, err.Error(), "workspace_id")
+	assert.Contains(t, err.Error(), "PAT")
+}
+
+// TestWorkspaceClientOrPromptRejectsPATOnSPOGFromConfigFile exercises the
+// real .databrickscfg shape from the bug bash: `host` + `token` only, no
+// `auth_type`, no `workspace_id`. The SDK populates AuthType during
+// NewWorkspaceClient via its credential probe, so the PAT-on-SPOG detector
+// must keep working after going through that path.
+func TestWorkspaceClientOrPromptRejectsPATOnSPOGFromConfigFile(t *testing.T) {
+	// testutil.CleanupEnvironment calls os.Clearenv(), which wipes Windows
+	// essentials like SystemRoot and breaks Winsock initialization for
+	// subsequent net.Listen calls. We only need a clean DATABRICKS_CONFIG_FILE
+	// for this test; set it directly with t.Setenv so the rest of the
+	// environment (notably the Windows networking stack) keeps working.
+	t.Setenv("DATABRICKS_AUTH_TYPE", "")
+	t.Setenv("DATABRICKS_HOST", "")
+	t.Setenv("DATABRICKS_TOKEN", "")
+	t.Setenv("DATABRICKS_CONFIG_PROFILE", "")
+	t.Setenv("PATH", "")
+
+	// Mock .well-known/databricks-config to return an account-scoped OIDC
+	// endpoint so the SDK populates cfg.DiscoveryURL with the SPOG signal.
+	// Omit account_id so AccountID stays unset; otherwise the account-only
+	// profile detector would intercept this case before the PAT-on-SPOG check.
+	mux := http.NewServeMux()
+	mux.HandleFunc("/.well-known/databricks-config", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"oidc_endpoint":"https://spog.example.test/oidc/accounts/abc-123"}`))
+	})
+	server := httptest.NewServer(mux)
+	t.Cleanup(server.Close)
+
+	configFile := filepath.Join(t.TempDir(), ".databrickscfg")
+	require.NoError(t, os.WriteFile(configFile, fmt.Appendf(nil, `
+[spog-pat]
+host  = %s
+token = dapi-fake
+`, server.URL), 0o600))
+	t.Setenv("DATABRICKS_CONFIG_FILE", configFile)
+
+	cfg := &config.Config{Profile: "spog-pat"}
+	w, err := workspaceClientOrPrompt(t.Context(), cfg, false)
+	assert.Nil(t, w)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), `profile "spog-pat"`)
+	assert.Contains(t, err.Error(), "workspace_id")
+	assert.Contains(t, err.Error(), "PAT")
+}
+
+func TestMustAnyClientFallsThroughOnAccountOnlyProfile(t *testing.T) {
+	testutil.CleanupEnvironment(t)
+	t.Setenv("PATH", "")
+
+	configFile := filepath.Join(t.TempDir(), ".databrickscfg")
+	err := os.WriteFile(configFile, []byte(`
+[skipws]
+host         = https://accounts.azuredatabricks.net/
+account_id   = abc-123
+token        = foobar
+workspace_id = none
+`), 0o600)
+	require.NoError(t, err)
+	t.Setenv("DATABRICKS_CONFIG_FILE", configFile)
+
+	ctx, tt := cmdio.SetupTest(t.Context(), cmdio.TestOptions{PromptSupported: true})
+	t.Cleanup(tt.Done)
+	cmd := New(ctx)
+	require.NoError(t, cmd.PersistentFlags().Set("profile", "skipws"))
+
+	// Workspace path returns ErrAccountOnlyProfile. MustAnyClient must
+	// recognize the type and fall through to the account client so
+	// `auth describe` shows account info for account-only profiles.
+	isAccount, err := MustAnyClient(cmd, []string{})
+	require.NoError(t, err)
+	require.True(t, isAccount, "expected fall-through to account client")
+	require.NotNil(t, cmdctx.AccountClient(cmd.Context()))
+}
+
 func TestWorkspaceClientOrPromptReturnsSuccessWhenAuthSucceeds(t *testing.T) {
 	testutil.CleanupEnvironment(t)
 	t.Setenv("PATH", "")
@@ -514,6 +949,46 @@ token = named-token
 
 	w := cmdctx.WorkspaceClient(cmd.Context())
 	require.NotNil(t, w)
-	assert.Equal(t, "", w.Config.Profile)
+	// Pinned so the OAuth cache key matches what `databricks auth login` writes.
+	assert.Equal(t, "DEFAULT", w.Config.Profile)
 	assert.Equal(t, "https://default.cloud.databricks.com", w.Config.Host)
 }
+
+func TestMustWorkspaceClientEnvHostSkipsDefaultProfile(t *testing.T) {
+	testutil.CleanupEnvironment(t)
+
+	configFile := filepath.Join(t.TempDir(), ".databrickscfg")
+	// The default profile uses basic auth on the same host as the environment.
+	// If it were pinned and merged with the PAT from the environment, the SDK
+	// would fail validation with "more than one authorization method configured"
+	// (matching hosts do not make the auth methods compatible).
+	err := os.WriteFile(configFile, []byte(`
+[__settings__]
+default_profile = basic-profile
+
+[basic-profile]
+host = https://env.test
+username = user
+password = pass
+`), 0o600)
+	require.NoError(t, err)
+
+	t.Setenv("DATABRICKS_CONFIG_FILE", configFile)
+	t.Setenv("DATABRICKS_HOST", "https://env.test")
+	t.Setenv("DATABRICKS_TOKEN", "env-token")
+
+	ctx := cmdio.MockDiscard(t.Context())
+	ctx = SkipLoadBundle(ctx)
+	cmd := New(ctx)
+
+	err = MustWorkspaceClient(cmd, []string{})
+	require.NoError(t, err)
+
+	w := cmdctx.WorkspaceClient(cmd.Context())
+	require.NotNil(t, w)
+	// Host and token in the environment fully determine auth, so the default
+	// profile must not be pinned (see ResolveDefaultProfile).
+	assert.Empty(t, w.Config.Profile)
+	assert.Equal(t, "https://env.test", w.Config.Host)
+	assert.Equal(t, "env-token", w.Config.Token)
+}
diff --git a/cmd/root/bundle.go b/cmd/root/bundle.go
index 234ca6211bf..a17d88f5fcf 100644
--- a/cmd/root/bundle.go
+++ b/cmd/root/bundle.go
@@ -70,6 +70,18 @@ func getProfile(cmd *cobra.Command) (value string) {
 // configureProfile applies the profile flag to the bundle.
 func configureProfile(cmd *cobra.Command, b *bundle.Bundle) {
 	profile := getProfile(cmd)
+
+	// Fall back to [__settings__].default_profile only when the bundle does
+	// not pin its own host. The legacy [DEFAULT] section is intentionally
+	// NOT considered here: a hostless bundle silently routing to whatever
+	// [DEFAULT] points at could deploy to the wrong workspace and mask a
+	// missing workspace.host. Auth-only paths use the broader
+	// databrickscfg.ResolveDefaultProfile, which also accepts [DEFAULT].
+	if profile == "" && b.Config.Workspace.Host == "" && b.Config.Workspace.Profile == "" {
+		configFilePath := envlib.Get(cmd.Context(), "DATABRICKS_CONFIG_FILE")
+		profile, _ = databrickscfg.GetConfiguredDefaultProfile(cmd.Context(), configFilePath)
+	}
+
 	if profile == "" {
 		return
 	}
diff --git a/cmd/root/bundle_test.go b/cmd/root/bundle_test.go
index 4ab2f1463e0..6116003ea70 100644
--- a/cmd/root/bundle_test.go
+++ b/cmd/root/bundle_test.go
@@ -63,6 +63,26 @@ workspace:
 	return logdiag.FlushCollected(ctx)
 }
 
+// setupBundleNameOnly writes a databricks.yml that declares only the bundle
+// name (no workspace host, no profile). Used to exercise the
+// [__settings__].default_profile fallback in configureProfile.
+func setupBundleNameOnly(t *testing.T, cmd *cobra.Command) []diag.Diagnostic {
+	rootPath := t.TempDir()
+	t.Chdir(rootPath)
+
+	contents := `bundle:
+  name: test-default-profile
+`
+	err := os.WriteFile(filepath.Join(rootPath, "databricks.yml"), []byte(contents), 0o644)
+	require.NoError(t, err)
+
+	ctx := logdiag.InitContext(cmd.Context())
+	logdiag.SetCollect(ctx, true)
+	cmd.SetContext(ctx)
+	_ = MustConfigureBundle(cmd)
+	return logdiag.FlushCollected(ctx)
+}
+
 func setupWithProfile(t *testing.T, cmd *cobra.Command, profile string) []diag.Diagnostic {
 	setupDatabricksCfg(t)
 
@@ -214,6 +234,94 @@ func TestBundleConfigureProfileEnvVariable(t *testing.T) {
 	assert.Equal(t, "PROFILE-2", cmdctx.ConfigUsed(cmd.Context()).Profile)
 }
 
+// setupDatabricksCfgWithDefault writes a databrickscfg with two profiles
+// and an explicit [__settings__].default_profile.
+func setupDatabricksCfgWithDefault(t *testing.T, defaultProfile string) {
+	tempHomeDir := t.TempDir()
+	homeEnvVar := "HOME"
+	if runtime.GOOS == "windows" {
+		homeEnvVar = "USERPROFILE"
+	}
+
+	cfg := fmt.Sprintf(`[PROFILE-1]
+host = https://a.test
+token = a
+
+[PROFILE-2]
+host = https://b.test
+token = b
+
+[__settings__]
+default_profile = %s
+`, defaultProfile)
+	err := os.WriteFile(filepath.Join(tempHomeDir, ".databrickscfg"), []byte(cfg), 0o644)
+	require.NoError(t, err)
+
+	t.Setenv("DATABRICKS_CONFIG_FILE", "")
+	t.Setenv(homeEnvVar, tempHomeDir)
+}
+
+func TestBundleConfigureWithDefaultProfile(t *testing.T) {
+	testutil.CleanupEnvironment(t)
+	setupDatabricksCfgWithDefault(t, "PROFILE-1")
+
+	cmd := emptyCommand(t)
+	diags := setupBundleNameOnly(t, cmd)
+	require.Empty(t, diags)
+	assert.Equal(t, "https://a.test", cmdctx.ConfigUsed(cmd.Context()).Host)
+	assert.Equal(t, "PROFILE-1", cmdctx.ConfigUsed(cmd.Context()).Profile)
+}
+
+func TestBundleConfigureWithDefaultProfile_ProfileFlagOverrides(t *testing.T) {
+	testutil.CleanupEnvironment(t)
+	setupDatabricksCfgWithDefault(t, "PROFILE-1")
+
+	cmd := emptyCommand(t)
+	require.NoError(t, cmd.Flag("profile").Value.Set("PROFILE-2"))
+	diags := setupBundleNameOnly(t, cmd)
+	require.Empty(t, diags)
+	assert.Equal(t, "PROFILE-2", cmdctx.ConfigUsed(cmd.Context()).Profile)
+}
+
+func TestBundleConfigureWithDefaultProfile_EnvVarOverrides(t *testing.T) {
+	testutil.CleanupEnvironment(t)
+	setupDatabricksCfgWithDefault(t, "PROFILE-1")
+	t.Setenv("DATABRICKS_CONFIG_PROFILE", "PROFILE-2")
+
+	cmd := emptyCommand(t)
+	diags := setupBundleNameOnly(t, cmd)
+	require.Empty(t, diags)
+	assert.Equal(t, "PROFILE-2", cmdctx.ConfigUsed(cmd.Context()).Profile)
+}
+
+func TestBundleConfigureWithDefaultProfile_BundleHostWins(t *testing.T) {
+	testutil.CleanupEnvironment(t)
+	// PROFILE-1 points at https://a.test, but the bundle pins https://b.test.
+	// The host-empty guard in configureProfile must NOT apply default_profile,
+	// otherwise the user would silently end up at the wrong host. Instead, the
+	// SDK matches the bundle's host against PROFILE-2 (which has host=b.test).
+	setupDatabricksCfgWithDefault(t, "PROFILE-1")
+
+	rootPath := t.TempDir()
+	t.Chdir(rootPath)
+
+	contents := `workspace:
+  host: "https://b.test"
+`
+	err := os.WriteFile(filepath.Join(rootPath, "databricks.yml"), []byte(contents), 0o644)
+	require.NoError(t, err)
+
+	cmd := emptyCommand(t)
+	ctx := logdiag.InitContext(cmd.Context())
+	logdiag.SetCollect(ctx, true)
+	cmd.SetContext(ctx)
+	_ = MustConfigureBundle(cmd)
+	diags := logdiag.FlushCollected(ctx)
+	require.Empty(t, diags)
+	assert.Equal(t, "https://b.test", cmdctx.ConfigUsed(cmd.Context()).Host)
+	assert.Equal(t, "PROFILE-2", cmdctx.ConfigUsed(cmd.Context()).Profile)
+}
+
 func TestBundleConfigureProfileFlagAndEnvVariable(t *testing.T) {
 	testutil.CleanupEnvironment(t)
 
diff --git a/cmd/root/flag_suggestions.go b/cmd/root/flag_suggestions.go
index effef1fccac..8aa1d822774 100644
--- a/cmd/root/flag_suggestions.go
+++ b/cmd/root/flag_suggestions.go
@@ -50,8 +50,8 @@ func levenshteinDistance(a, b string) int {
 // If a close match is found among the command's flags, it returns an enhanced error
 // with a "Did you mean" suggestion appended. Otherwise it returns the original error.
 func suggestFlagFromError(cmd *cobra.Command, err error) error {
-	var notExist *pflag.NotExistError
-	if !errors.As(err, &notExist) {
+	notExist, ok := errors.AsType[*pflag.NotExistError](err)
+	if !ok {
 		return err
 	}
 
diff --git a/cmd/root/root.go b/cmd/root/root.go
index 6b6de2a9baa..81b341e9c5c 100644
--- a/cmd/root/root.go
+++ b/cmd/root/root.go
@@ -12,6 +12,8 @@ import (
 	"time"
 
 	"github.com/databricks/cli/internal/build"
+	"github.com/databricks/cli/libs/aitools/agents"
+	"github.com/databricks/cli/libs/aitools/installer"
 	"github.com/databricks/cli/libs/auth"
 	"github.com/databricks/cli/libs/cmdctx"
 	"github.com/databricks/cli/libs/cmdio"
@@ -74,13 +76,21 @@ func New(ctx context.Context) *cobra.Command {
 			slog.String("version", build.GetInfo().Version),
 			slog.String("args", strings.Join(os.Args, ", ")))
 
+		warnIfStaleVersion(ctx)
+
 		// Configure our user agent with the command that's about to be executed.
 		ctx = withCommandInUserAgent(ctx, cmd)
 		ctx = withCommandExecIdInUserAgent(ctx)
 		ctx = withUpstreamInUserAgent(ctx)
 		ctx = withInteractiveModeInUserAgent(ctx)
+		ctx = installer.WithAiToolsInUserAgent(ctx)
+		ctx = installer.WithAiDevKitInUserAgent(ctx)
 		ctx = InjectTestPidToUserAgent(ctx)
 		cmd.SetContext(ctx)
+
+		// Recommend installing Databricks AI tooling to Claude Code when it is
+		// driving the CLI without the tooling installed (best-effort, stderr only).
+		agents.MaybeHint(ctx, cmd)
 		return nil
 	}
 
@@ -149,6 +159,12 @@ Stack Trace:
 			cfg := cmdctx.ConfigUsed(cmd.Context())
 			err = auth.EnrichAuthError(cmd.Context(), cfg, err)
 		}
+		// A workspace client on the context means the command operates against
+		// a workspace; see AppendAccountHostHint for why every error from such
+		// commands gets the account-console-host note.
+		if cmdctx.HasWorkspaceClient(cmd.Context()) {
+			err = auth.AppendAccountHostHint(cmdctx.WorkspaceClient(cmd.Context()).Config, err)
+		}
 		fmt.Fprintf(cmd.ErrOrStderr(), "Error: %s\n", err.Error())
 	}
 
@@ -180,13 +196,14 @@ Stack Trace:
 	ctx = cmd.Context()
 
 	telemetryErr := telemetry.Upload(cmd.Context(), protos.ExecutionContext{
-		CmdExecID:       cmdctx.ExecId(ctx),
-		Version:         build.GetInfo().Version,
-		Command:         commandStr,
-		OperatingSystem: runtime.GOOS,
-		DbrVersion:      dbr.RuntimeVersion(ctx).String(),
-		ExecutionTimeMs: time.Since(startTime).Milliseconds(),
-		ExitCode:        int64(exitCode),
+		CmdExecID:        cmdctx.ExecId(ctx),
+		StateLineageHash: telemetry.StateLineageHash(ctx),
+		Version:          build.GetInfo().Version,
+		Command:          commandStr,
+		OperatingSystem:  runtime.GOOS,
+		DbrVersion:       dbr.RuntimeVersion(ctx).String(),
+		ExecutionTimeMs:  time.Since(startTime).Milliseconds(),
+		ExitCode:         int64(exitCode),
 	})
 	if telemetryErr != nil {
 		log.Infof(ctx, "telemetry upload failed: %s", telemetryErr)
diff --git a/cmd/root/root_test.go b/cmd/root/root_test.go
index 44a07073984..ce1584eacd4 100644
--- a/cmd/root/root_test.go
+++ b/cmd/root/root_test.go
@@ -2,9 +2,12 @@ package root
 
 import (
 	"bytes"
+	"context"
+	"errors"
 	"testing"
 
 	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/apierr"
 	"github.com/databricks/databricks-sdk-go/config"
 	"github.com/spf13/cobra"
@@ -77,6 +80,85 @@ func TestExecuteNoEnrichmentWithoutConfigUsed(t *testing.T) {
 	assert.NotContains(t, output, "Next steps:")
 }
 
+func TestExecuteAppendsAccountHostHint(t *testing.T) {
+	tests := []struct {
+		name     string
+		setup    func(ctx context.Context) context.Context
+		wantHint bool
+	}{
+		{
+			name: "workspace client on account console host",
+			setup: func(ctx context.Context) context.Context {
+				cfg := &config.Config{Host: "https://accounts.test", Profile: "acc"}
+				ctx = cmdctx.SetConfigUsed(ctx, cfg)
+				return cmdctx.SetWorkspaceClient(ctx, &databricks.WorkspaceClient{Config: cfg})
+			},
+			wantHint: true,
+		},
+		{
+			name: "workspace client on workspace host",
+			setup: func(ctx context.Context) context.Context {
+				cfg := &config.Config{Host: "https://adb-123.test", Profile: "ws"}
+				ctx = cmdctx.SetConfigUsed(ctx, cfg)
+				return cmdctx.SetWorkspaceClient(ctx, &databricks.WorkspaceClient{Config: cfg})
+			},
+			wantHint: false,
+		},
+		{
+			// `databricks account ...` commands configure an account client,
+			// not a workspace client, so the hint must stay silent.
+			name: "account client on account console host",
+			setup: func(ctx context.Context) context.Context {
+				cfg := &config.Config{Host: "https://accounts.test", Profile: "acc"}
+				ctx = cmdctx.SetConfigUsed(ctx, cfg)
+				return cmdctx.SetAccountClient(ctx, &databricks.AccountClient{Config: cfg})
+			},
+			wantHint: false,
+		},
+		{
+			name: "no client on account console host",
+			setup: func(ctx context.Context) context.Context {
+				cfg := &config.Config{Host: "https://accounts.test", Profile: "acc"}
+				return cmdctx.SetConfigUsed(ctx, cfg)
+			},
+			wantHint: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			stderr := &bytes.Buffer{}
+			cmd := &cobra.Command{
+				Use:           "test",
+				SilenceUsage:  true,
+				SilenceErrors: true,
+				RunE: func(cmd *cobra.Command, args []string) error {
+					// The account console returns unstructured junk for
+					// workspace API paths; this is one real example.
+					return errors.New("received HTML response instead of JSON")
+				},
+			}
+			cmd.SetErr(stderr)
+			cmd.PersistentPreRunE = func(cmd *cobra.Command, args []string) error {
+				cmd.SetContext(tt.setup(cmd.Context()))
+				return nil
+			}
+
+			err := Execute(t.Context(), cmd)
+			require.Error(t, err)
+
+			output := stderr.String()
+			assert.Contains(t, output, "received HTML response instead of JSON")
+			if tt.wantHint {
+				assert.Contains(t, output, "account console host")
+				assert.Contains(t, output, "databricks auth login --host")
+			} else {
+				assert.NotContains(t, output, "account console host")
+			}
+		})
+	}
+}
+
 func TestExecuteErrAlreadyPrintedNotEnriched(t *testing.T) {
 	ctx := t.Context()
 	stderr := &bytes.Buffer{}
diff --git a/cmd/root/stale_version.go b/cmd/root/stale_version.go
new file mode 100644
index 00000000000..4732b1cd22d
--- /dev/null
+++ b/cmd/root/stale_version.go
@@ -0,0 +1,51 @@
+package root
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/databricks/cli/internal/build"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/dbr"
+	"github.com/databricks/cli/libs/versioncheck"
+)
+
+const (
+	staleVersionThreshold = 6 * 30 * 24 * time.Hour
+	installDocsURL        = "https://docs.databricks.com/dev-tools/cli/install.html"
+)
+
+// staleVersionWarning returns the warning for a build older than the threshold, or "" otherwise.
+// An empty upgradeCommand falls back to the install docs.
+func staleVersionWarning(buildTime, now time.Time, upgradeCommand string) string {
+	// Builds without an embedded timestamp report the Unix epoch.
+	if buildTime.Unix() <= 0 || now.Sub(buildTime) < staleVersionThreshold {
+		return ""
+	}
+	msg := fmt.Sprintf("Warning: this version of the Databricks CLI was built on %s and is more than 6 months old. "+
+		"We strongly recommend updating to the latest version.\n", buildTime.UTC().Format(time.DateOnly))
+	if upgradeCommand != "" {
+		return msg + "To upgrade, run: " + upgradeCommand + "\n"
+	}
+	return msg + "See " + installDocsURL + " to upgrade.\n"
+}
+
+func skipStaleVersionWarning(ctx context.Context, info build.Info) bool {
+	if info.IsDevelopment() {
+		return true
+	}
+	// DBR installs the latest CLI by default, so skip the warning there.
+	return dbr.HasDetection(ctx) && dbr.RunsOnRuntime(ctx)
+}
+
+func warnIfStaleVersion(ctx context.Context) {
+	info := build.GetInfo()
+	if skipStaleVersionWarning(ctx, info) {
+		return
+	}
+	_, command := versioncheck.DetectInstallMethod(ctx)
+	if msg := staleVersionWarning(info.BuildTime, time.Now(), command); msg != "" {
+		cmdio.LogString(ctx, msg)
+	}
+}
diff --git a/cmd/root/stale_version_test.go b/cmd/root/stale_version_test.go
new file mode 100644
index 00000000000..8eeea38fbca
--- /dev/null
+++ b/cmd/root/stale_version_test.go
@@ -0,0 +1,67 @@
+package root
+
+import (
+	"testing"
+	"time"
+
+	"github.com/databricks/cli/internal/build"
+	"github.com/databricks/cli/libs/dbr"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestStaleVersionWarning(t *testing.T) {
+	now := time.Date(2026, 10, 1, 0, 0, 0, 0, time.UTC)
+	stale := time.Date(2026, 1, 15, 12, 0, 0, 0, time.UTC)
+	header := "Warning: this version of the Databricks CLI was built on 2026-01-15 and is more than 6 months old. " +
+		"We strongly recommend updating to the latest version.\n"
+
+	tests := []struct {
+		name      string
+		buildTime time.Time
+		command   string
+		want      string
+	}{
+		{name: "no embedded timestamp", buildTime: time.Unix(0, 0), command: "brew upgrade databricks"},
+		{name: "recent build", buildTime: now.AddDate(0, -1, 0), command: "brew upgrade databricks"},
+		{name: "just under threshold", buildTime: now.Add(-staleVersionThreshold + time.Hour)},
+		{
+			name:      "stale with detected install method",
+			buildTime: stale,
+			command:   "brew upgrade databricks",
+			want:      header + "To upgrade, run: brew upgrade databricks\n",
+		},
+		{
+			name:      "stale with unknown install method",
+			buildTime: stale,
+			want:      header + "See " + installDocsURL + " to upgrade.\n",
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, staleVersionWarning(tc.buildTime, now, tc.command))
+		})
+	}
+}
+
+func TestSkipStaleVersionWarning(t *testing.T) {
+	release := build.Info{Version: "1.18.0"}
+	notDBR := dbr.Environment{}
+
+	tests := []struct {
+		name    string
+		info    build.Info
+		runtime dbr.Environment
+		want    bool
+	}{
+		{name: "release build", info: release, runtime: notDBR},
+		{name: "dev build", info: build.Info{Version: "1.19.0-dev+abc"}, runtime: notDBR, want: true},
+		{name: "snapshot build", info: build.Info{Version: "1.18.0", IsSnapshot: true}, runtime: notDBR, want: true},
+		{name: "on DBR", info: release, runtime: dbr.Environment{IsDbr: true, Version: "15.4"}, want: true},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx := dbr.MockRuntime(t.Context(), tc.runtime)
+			assert.Equal(t, tc.want, skipStaleVersionWarning(ctx, tc.info))
+		})
+	}
+}
diff --git a/cmd/sandbox/api.go b/cmd/sandbox/api.go
new file mode 100644
index 00000000000..61fe94d9de5
--- /dev/null
+++ b/cmd/sandbox/api.go
@@ -0,0 +1,416 @@
+package sandbox
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/databricks/cli/libs/databrickscfg/profile"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/client"
+	"github.com/databricks/databricks-sdk-go/config"
+	"github.com/databricks/databricks-sdk-go/httpclient"
+)
+
+// sandboxPath returns the URL path for a single sandbox resource. The ID is
+// path-escaped so a value like `foo;rm -rf /` lands on
+// `/sandboxes/foo%3Brm%20-rf%20%2F` and gets a clean 400 from the server,
+// rather than its unescaped `/` re-routing the request to the list endpoint
+// (which silently returns an empty result the CLI then renders as an
+// all-zero sandbox record).
+func sandboxPath(id string) string {
+	return sandboxAPIPath + "/" + url.PathEscape(id)
+}
+
+// sandboxAPIRoot is the service namespace under which the sandbox and
+// ssh-key sub-collections live. Still says "lakebox" because the
+// server-side rename is pending; this is the only place in the
+// codebase that string should appear, so a future server rename is
+// a one-line change.
+const sandboxAPIRoot = "/api/2.0/lakebox"
+
+// Sub-collections under the sandbox service namespace.
+const (
+	sandboxAPIPath     = sandboxAPIRoot + "/sandboxes"
+	sandboxKeysAPIPath = sandboxAPIRoot + "/ssh-keys"
+)
+
+// max503Attempts caps attempts when the server keeps answering 503; the
+// SDK's default budget would otherwise retry for up to 5 minutes.
+const max503Attempts = 3
+
+type attempt503CounterKey struct{}
+
+// arm503Budget attaches the request's 503 attempt counter; retries of one
+// request run sequentially, so a plain *int suffices.
+func arm503Budget(ctx context.Context) context.Context {
+	return context.WithValue(ctx, attempt503CounterKey{}, new(int))
+}
+
+// allow503Retry consumes one unit of the request's 503 budget. Unarmed
+// contexts get no retries.
+func allow503Retry(ctx context.Context) bool {
+	n, ok := ctx.Value(attempt503CounterKey{}).(*int)
+	if !ok {
+		return false
+	}
+	*n++
+	return *n < max503Attempts
+}
+
+// sandboxDocsURL points users at the Sandbox documentation, including its
+// region availability. The cloud-neutral path redirects to the reader's
+// cloud-specific docs page.
+const sandboxDocsURL = "https://docs.databricks.com/compute/serverless/sandbox"
+
+// translateError replaces a 503 with a user-facing message; the gateway
+// body adds nothing, so it is dropped rather than wrapped.
+func translateError(err error) error {
+	if apiErr, ok := errors.AsType[*apierr.APIError](err); ok && apiErr.StatusCode == http.StatusServiceUnavailable {
+		return fmt.Errorf("the Databricks Sandbox feature is not available in your region. See %s", sandboxDocsURL)
+	}
+	return err
+}
+
+// orgIDHeader scopes the credential to a workspace on multi-workspace
+// gateways. Without it, requests fail with "Credential was not sent or was
+// of an unsupported type for this API."
+const orgIDHeader = "X-Databricks-Org-Id"
+
+// maxNameBytes mirrors the server-side `Sandbox.name` cap. The server
+// measures bytes (not runes), so emoji hit the limit faster than expected;
+// mirroring it client-side lets us fail fast with the observed byte count.
+const maxNameBytes = 256
+
+// validateName rejects names that exceed the wire limit (counted in bytes).
+func validateName(name string) error {
+	if n := len(name); n > maxNameBytes {
+		return fmt.Errorf("--name is %d bytes; limit is %d (emoji and most non-ASCII characters count as 2-4 bytes each)", n, maxNameBytes)
+	}
+	return nil
+}
+
+// sandboxAPI wraps the SDK ApiClient with workspace-id-aware request headers.
+type sandboxAPI struct {
+	c *client.DatabricksClient
+}
+
+// sandboxCreateBody is the inner `Sandbox` message in the create payload.
+// Only `name` is caller-settable; the rest are server-chosen.
+type sandboxCreateBody struct {
+	Name string `json:"name,omitempty"`
+}
+
+// createRequest is the wrapped POST body for sandbox creation.
+type createRequest struct {
+	Sandbox sandboxCreateBody `json:"sandbox"`
+}
+
+// createResponse mirrors the Sandbox proto after JSON transcoding.
+// GatewayHost is `omitempty` so old and new server versions round-trip
+// cleanly.
+type createResponse struct {
+	SandboxID   string `json:"sandboxId"`
+	Status      string `json:"status"`
+	GatewayHost string `json:"gatewayHost,omitempty"`
+}
+
+// sandboxEntry mirrors the Sandbox proto after JSON transcoding.
+// IdleTimeout and NoAutostop are pointer-typed so we can distinguish
+// "field absent on the wire" (server uses its default) from "explicitly
+// set to 0 / false". IdleTimeout is a proto3-canonical Duration string
+// (see idleTimeoutSecs).
+type sandboxEntry struct {
+	SandboxID     string  `json:"sandboxId"`
+	Status        string  `json:"status"`
+	GatewayHost   string  `json:"gatewayHost,omitempty"`
+	Name          string  `json:"name,omitempty"`
+	CreateTime    string  `json:"createTime,omitempty"`
+	LastStartTime string  `json:"lastStartTime,omitempty"`
+	IdleTimeout   *string `json:"idleTimeout,omitempty"`
+	NoAutostop    *bool   `json:"noAutostop,omitempty"`
+}
+
+// idleTimeoutSecs parses the proto3-canonical Duration string off
+// `IdleTimeout` (e.g. `"900s"` → `900`). Returns 0 when unset or when
+// the string is not a recognizable Duration. Sub-second precision is
+// dropped — the watchdog only acts on whole seconds.
+func (e *sandboxEntry) idleTimeoutSecs() int64 {
+	if e.IdleTimeout == nil {
+		return 0
+	}
+	s := *e.IdleTimeout
+	if !strings.HasSuffix(s, "s") {
+		return 0
+	}
+	d, err := time.ParseDuration(s)
+	if err != nil {
+		return 0
+	}
+	return int64(d.Seconds())
+}
+
+// autoStopLabel renders the auto-stop policy for one sandbox:
+//   - `no_autostop == true` → never auto-stops
+//   - `idle_timeout` set and positive → that many seconds
+//   - otherwise → no enforcement today; render as "never"
+//
+// If the manager later enforces an idle-grace default, render it here.
+func (e *sandboxEntry) autoStopLabel() string {
+	if e.NoAutostop != nil && *e.NoAutostop {
+		return "never"
+	}
+	if secs := e.idleTimeoutSecs(); secs > 0 {
+		return formatDurationSecs(secs)
+	}
+	return "never"
+}
+
+// formatDurationSecs prints `secs` as a compact duration (e.g. `90s`,
+// `15m`, `2h`, `1h30m`). Falls back to seconds if it's not a clean
+// minute/hour multiple.
+func formatDurationSecs(secs int64) string {
+	if secs < 60 {
+		return fmt.Sprintf("%ds", secs)
+	}
+	if secs%3600 == 0 {
+		return fmt.Sprintf("%dh", secs/3600)
+	}
+	if secs >= 3600 {
+		return fmt.Sprintf("%dh%dm", secs/3600, (secs%3600)/60)
+	}
+	if secs%60 == 0 {
+		return fmt.Sprintf("%dm", secs/60)
+	}
+	return fmt.Sprintf("%ds", secs)
+}
+
+// listResponse is the JSON body returned by GET /api/2.0/lakebox/sandboxes.
+type listResponse struct {
+	Sandboxes     []sandboxEntry `json:"sandboxes"`
+	NextPageToken string         `json:"nextPageToken,omitempty"`
+}
+
+// listPageSize matches the manager-side default.
+const listPageSize = 100
+
+// updateBody is the PATCH body; the server takes the inner `Sandbox`
+// message directly with no `{"sandbox": ...}` wrapping. Pointer fields
+// encode proto3 optional semantics (see sandboxEntry).
+type updateBody struct {
+	SandboxID   string  `json:"sandbox_id"`
+	Name        *string `json:"name,omitempty"`
+	IdleTimeout *string `json:"idle_timeout,omitempty"`
+	NoAutostop  *bool   `json:"no_autostop,omitempty"`
+}
+
+// registerKeyRequest is the JSON body for POST /api/2.0/lakebox/ssh-keys.
+type registerKeyRequest struct {
+	PublicKey string `json:"public_key"`
+	Name      string `json:"name,omitempty"`
+}
+
+// newSandboxAPI returns a sandboxAPI bound to the workspace client's config.
+func newSandboxAPI(w *databricks.WorkspaceClient) (*sandboxAPI, error) {
+	clientCfg, err := config.HTTPClientConfigFromConfig(w.Config)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create sandbox API client: %w", err)
+	}
+	defaultRetriable := clientCfg.ErrorRetriable
+	clientCfg.ErrorRetriable = func(ctx context.Context, err error) bool {
+		if apiErr, ok := errors.AsType[*apierr.APIError](err); ok && apiErr.StatusCode == http.StatusServiceUnavailable {
+			return allow503Retry(ctx)
+		}
+		return defaultRetriable(ctx, err)
+	}
+	c, err := client.NewWithClient(w.Config, httpclient.NewApiClient(clientCfg))
+	if err != nil {
+		return nil, fmt.Errorf("failed to create sandbox API client: %w", err)
+	}
+	return &sandboxAPI{c: c}, nil
+}
+
+// headers attaches the workspace routing identifier so multi-workspace
+// gateways (e.g. SPOG hosts) can scope the credential. The
+// profile.WorkspaceIDNone sentinel ("none") is treated as unset so the
+// literal string never goes on the wire.
+func (a *sandboxAPI) headers() map[string]string {
+	wsID := a.c.Config.WorkspaceID
+	if wsID == "" || wsID == profile.WorkspaceIDNone {
+		return nil
+	}
+	return map[string]string{orgIDHeader: wsID}
+}
+
+// do issues one sandbox API request: arms the 503 retry budget, attaches
+// the workspace routing headers, and translates terminal errors.
+func (a *sandboxAPI) do(ctx context.Context, method, path string, request, response any) error {
+	return translateError(a.c.Do(arm503Budget(ctx), method, path, a.headers(), nil, request, response))
+}
+
+// create calls POST /api/2.0/lakebox/sandboxes. An empty `name` is omitted
+// so the server treats it as "unset" rather than "explicit empty string".
+func (a *sandboxAPI) create(ctx context.Context, name string) (*createResponse, error) {
+	body := createRequest{Sandbox: sandboxCreateBody{Name: name}}
+	var resp createResponse
+	err := a.do(ctx, http.MethodPost, sandboxAPIPath, body, &resp)
+	if err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+// list calls GET /api/2.0/lakebox/sandboxes, following pagination until the
+// server stops sending `next_page_token`.
+func (a *sandboxAPI) list(ctx context.Context) ([]sandboxEntry, error) {
+	var all []sandboxEntry
+	pageToken := ""
+	for {
+		page, err := a.listPage(ctx, pageToken)
+		if err != nil {
+			return nil, err
+		}
+		all = append(all, page.Sandboxes...)
+		if page.NextPageToken == "" {
+			return all, nil
+		}
+		pageToken = page.NextPageToken
+	}
+}
+
+// listPage fetches a single page of sandboxes.
+//
+// `query` is passed in slot 6 (`request`), not slot 5 (`queryParams`). On
+// GET, the SDK's makeRequestBody serializes `request` into the URL query
+// string and sends an empty body. Routing through `queryParams` instead
+// makes it write a literal `null` body, which the sandbox manager rejects
+// with `INVALID_PARAMETER_VALUE: Request body must be a JSON object`. See
+// databricks-sdk-go/httpclient/request.go:makeRequestBody.
+func (a *sandboxAPI) listPage(ctx context.Context, pageToken string) (*listResponse, error) {
+	query := map[string]any{"page_size": listPageSize}
+	if pageToken != "" {
+		query["page_token"] = pageToken
+	}
+	var resp listResponse
+	err := a.do(ctx, http.MethodGet, sandboxAPIPath, query, &resp)
+	if err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+// get calls GET /api/2.0/lakebox/sandboxes/{id}.
+func (a *sandboxAPI) get(ctx context.Context, id string) (*sandboxEntry, error) {
+	var resp sandboxEntry
+	err := a.do(ctx, http.MethodGet, sandboxPath(id), nil, &resp)
+	if err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+// update calls PATCH /api/2.0/lakebox/sandboxes/{id} with whichever of
+// `idle_timeout` / `no_autostop` the caller chose to set. Fields left nil
+// are omitted from the wire payload, so the server preserves their current
+// values. Returns the refreshed `sandboxEntry`.
+func (a *sandboxAPI) update(ctx context.Context, id string, name *string, idleTimeoutSecs *int64, noAutostop *bool) (*sandboxEntry, error) {
+	var idleTimeout *string
+	if idleTimeoutSecs != nil {
+		s := fmt.Sprintf("%ds", *idleTimeoutSecs)
+		idleTimeout = &s
+	}
+	body := updateBody{
+		SandboxID:   id,
+		Name:        name,
+		IdleTimeout: idleTimeout,
+		NoAutostop:  noAutostop,
+	}
+	var resp sandboxEntry
+	err := a.do(ctx, http.MethodPatch, sandboxPath(id), body, &resp)
+	if err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+// delete calls DELETE /api/2.0/lakebox/sandboxes/{id}.
+func (a *sandboxAPI) delete(ctx context.Context, id string) error {
+	return a.do(ctx, http.MethodDelete, sandboxPath(id), nil, nil)
+}
+
+// stop calls POST /api/2.0/lakebox/sandboxes/{id}/stop and returns the
+// refreshed sandbox.
+func (a *sandboxAPI) stop(ctx context.Context, id string) (*sandboxEntry, error) {
+	body := map[string]string{"sandbox_id": id}
+	var resp sandboxEntry
+	err := a.do(ctx, http.MethodPost, sandboxPath(id)+"/stop", body, &resp)
+	if err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+// start calls POST /api/2.0/lakebox/sandboxes/{id}/start and returns the
+// refreshed sandbox.
+func (a *sandboxAPI) start(ctx context.Context, id string) (*sandboxEntry, error) {
+	body := map[string]string{"sandbox_id": id}
+	var resp sandboxEntry
+	err := a.do(ctx, http.MethodPost, sandboxPath(id)+"/start", body, &resp)
+	if err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+// registerKey calls POST /api/2.0/lakebox/ssh-keys. An empty `name` is
+// omitted so the server records "unset" rather than an explicit empty string.
+// Returns the registered key, which carries the workspace's `GatewayHost` —
+// this is how `register` learns the gateway without a probe `list` /
+// `create` call.
+func (a *sandboxAPI) registerKey(ctx context.Context, publicKey, name string) (*sshKeyEntry, error) {
+	var resp sshKeyEntry
+	err := a.do(ctx, http.MethodPost, sandboxKeysAPIPath, registerKeyRequest{PublicKey: publicKey, Name: name}, &resp)
+	if err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+// sshKeyEntry is a single item in the ssh-key list response. GatewayHost
+// is per-workspace (not per-key) — the server stamps the same value on
+// every response so callers can learn the SSH gateway without provisioning
+// a sandbox first.
+type sshKeyEntry struct {
+	KeyHash     string `json:"keyHash"`
+	Name        string `json:"name,omitempty"`
+	CreateTime  string `json:"createTime,omitempty"`
+	LastUseTime string `json:"lastUseTime,omitempty"`
+	GatewayHost string `json:"gatewayHost,omitempty"`
+}
+
+// listKeysResponse is the JSON body returned by GET /api/2.0/lakebox/ssh-keys.
+// Per-user keys are hard-capped server-side, so the full set fits in one
+// response — no pagination.
+type listKeysResponse struct {
+	SshKeys []sshKeyEntry `json:"sshKeys"`
+}
+
+// listKeys calls GET /api/2.0/lakebox/ssh-keys.
+func (a *sandboxAPI) listKeys(ctx context.Context) ([]sshKeyEntry, error) {
+	var resp listKeysResponse
+	err := a.do(ctx, http.MethodGet, sandboxKeysAPIPath, nil, &resp)
+	if err != nil {
+		return nil, err
+	}
+	return resp.SshKeys, nil
+}
+
+// deleteKey calls DELETE /api/2.0/lakebox/ssh-keys/{key_hash}.
+func (a *sandboxAPI) deleteKey(ctx context.Context, keyHash string) error {
+	return a.do(ctx, http.MethodDelete, sandboxKeysAPIPath+"/"+url.PathEscape(keyHash), nil, nil)
+}
diff --git a/cmd/sandbox/api_test.go b/cmd/sandbox/api_test.go
new file mode 100644
index 00000000000..3b6f0df0117
--- /dev/null
+++ b/cmd/sandbox/api_test.go
@@ -0,0 +1,60 @@
+package sandbox
+
+import (
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestValidateNameAcceptsAscii(t *testing.T) {
+	require.NoError(t, validateName(""))
+	require.NoError(t, validateName("my-project"))
+	require.NoError(t, validateName(strings.Repeat("a", 256))) // boundary: exactly the limit
+}
+
+func TestValidateNameRejectsOversize(t *testing.T) {
+	err := validateName(strings.Repeat("a", 257))
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "257 bytes")
+	assert.Contains(t, err.Error(), "256")
+}
+
+func TestTranslateErrorRewrites503(t *testing.T) {
+	orig := &apierr.APIError{StatusCode: http.StatusServiceUnavailable, Message: "Service Unavailable"}
+	err := translateError(orig)
+	require.Error(t, err)
+	assert.Equal(t, "the Databricks Sandbox feature is not available in your region. See "+sandboxDocsURL, err.Error())
+}
+
+func TestAllow503RetryConsumesBudget(t *testing.T) {
+	ctx := arm503Budget(t.Context())
+	// max503Attempts-1 retries are allowed, then the budget is exhausted.
+	for range max503Attempts - 1 {
+		assert.True(t, allow503Retry(ctx))
+	}
+	assert.False(t, allow503Retry(ctx))
+}
+
+func TestAllow503RetryUnarmedContext(t *testing.T) {
+	assert.False(t, allow503Retry(t.Context()))
+}
+
+func TestTranslateErrorPassesThroughOthers(t *testing.T) {
+	require.NoError(t, translateError(nil))
+
+	notFound := &apierr.APIError{StatusCode: http.StatusNotFound, Message: "Sandbox not found"}
+	assert.Equal(t, error(notFound), translateError(notFound))
+}
+
+func TestValidateNameCountsBytesNotRunes(t *testing.T) {
+	// 64 panda emoji = 64 × 4 bytes = 256 bytes — at the limit, OK.
+	require.NoError(t, validateName(strings.Repeat("🐼", 64)))
+	// 65 = 260 bytes, rejected.
+	err := validateName(strings.Repeat("🐼", 65))
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "260 bytes")
+}
diff --git a/cmd/sandbox/completion.go b/cmd/sandbox/completion.go
new file mode 100644
index 00000000000..e8c48535a3e
--- /dev/null
+++ b/cmd/sandbox/completion.go
@@ -0,0 +1,72 @@
+package sandbox
+
+import (
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/spf13/cobra"
+)
+
+// completeSandboxIDs returns sandbox IDs and (distinct) display names
+// from the local cache for tab completion. Cache-only so an unrefreshed
+// token never hangs the shell; any failure yields no suggestions.
+func completeSandboxIDs(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	if len(args) > 0 {
+		return nil, cobra.ShellCompDirectiveNoFileComp
+	}
+	profile := completionProfile(cmd, args)
+	if profile == "" {
+		return nil, cobra.ShellCompDirectiveNoFileComp
+	}
+	sbs := getSandboxes(cmd.Context(), profile)
+	if len(sbs) == 0 {
+		return nil, cobra.ShellCompDirectiveNoFileComp
+	}
+	// Server defaults `name` to the ID, so only emit the name when it's distinct.
+	suggestions := make([]string, 0, len(sbs)*2)
+	for _, s := range sbs {
+		suggestions = append(suggestions, s.ID)
+		if s.Name != "" && s.Name != s.ID {
+			suggestions = append(suggestions, s.Name)
+		}
+	}
+	return suggestions, cobra.ShellCompDirectiveNoFileComp
+}
+
+// completeSSHKeyHashes returns registered key hashes for `ssh-key delete`.
+// Hashes aren't cached locally, so this path calls the API.
+func completeSSHKeyHashes(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	if len(args) > 0 {
+		return nil, cobra.ShellCompDirectiveNoFileComp
+	}
+	if err := root.MustWorkspaceClient(cmd, args); err != nil {
+		return nil, cobra.ShellCompDirectiveNoFileComp
+	}
+	ctx := cmd.Context()
+	api, err := newSandboxAPI(cmdctx.WorkspaceClient(ctx))
+	if err != nil {
+		return nil, cobra.ShellCompDirectiveNoFileComp
+	}
+	keys, err := api.listKeys(ctx)
+	if err != nil {
+		return nil, cobra.ShellCompDirectiveNoFileComp
+	}
+	hashes := make([]string, 0, len(keys))
+	for _, k := range keys {
+		hashes = append(hashes, k.KeyHash)
+	}
+	return hashes, cobra.ShellCompDirectiveNoFileComp
+}
+
+// completionProfile returns the profile name the cache is keyed under,
+// matching the resolution used by the runtime commands (Profile if set,
+// else Host). Returns "" if the workspace client can't be bootstrapped.
+func completionProfile(cmd *cobra.Command, args []string) string {
+	if err := root.MustWorkspaceClient(cmd, args); err != nil {
+		return ""
+	}
+	w := cmdctx.WorkspaceClient(cmd.Context())
+	if w.Config.Profile != "" {
+		return w.Config.Profile
+	}
+	return w.Config.Host
+}
diff --git a/cmd/sandbox/config.go b/cmd/sandbox/config.go
new file mode 100644
index 00000000000..1fa2666ba15
--- /dev/null
+++ b/cmd/sandbox/config.go
@@ -0,0 +1,169 @@
+package sandbox
+
+import (
+	"errors"
+	"fmt"
+	"time"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/spf13/cobra"
+)
+
+// minIdleTimeoutSecs / maxIdleTimeoutSecs mirror the server-side bounds
+// on `idle_timeout`. Pre-flighting client-side gives a clearer error
+// than waiting for the server's INVALID_ARGUMENT.
+const (
+	minIdleTimeoutSecs = 60
+	maxIdleTimeoutSecs = 86_400
+)
+
+func newConfigCommand() *cobra.Command {
+	var idleTimeoutFlag string
+	var noAutostopFlag bool
+	var nameFlag string
+
+	cmd := &cobra.Command{
+		Use:   "config <sandbox-id>",
+		Short: "Configure a Sandbox's name and auto-stop policy",
+		Long: `Configure a Sandbox's name and auto-stop policy.
+
+Three knobs are independent — pass any combination:
+
+  --name <label>              Display label for the sandbox (max 256 bytes).
+                              Pass an empty string to clear.
+
+  --idle-timeout <duration>   Per-sandbox idle timeout. The watchdog reaps
+                              the sandbox after this much idle time. Pass
+                              0 (or 0s) to clear and revert to the manager's
+                              global default (10m). Valid range when set:
+                              1m to 24h.
+
+  --no-autostop[=true|false]  When true, the sandbox is exempt from
+                              idle-driven auto-stop entirely. The
+                              --idle-timeout setting is ignored while
+                              this is on. Setting --idle-timeout to a
+                              non-zero value in a later call clears
+                              --no-autostop automatically. Sandbox still
+                              stops on explicit 'databricks sandbox delete'.
+
+Examples:
+  databricks sandbox config happy-panda-1234 --name my-project
+  databricks sandbox config happy-panda-1234 --idle-timeout 15m
+  databricks sandbox config happy-panda-1234 --idle-timeout 1h30m
+  databricks sandbox config happy-panda-1234 --idle-timeout 0           # clear, use default
+  databricks sandbox config happy-panda-1234 --no-autostop                  # never auto-stop
+  databricks sandbox config happy-panda-1234 --no-autostop=false            # back to timeout path
+  databricks sandbox config happy-panda-1234 --idle-timeout 30m --no-autostop=false`,
+		Args:              cobra.ExactArgs(1),
+		PreRunE:           root.MustWorkspaceClient,
+		ValidArgsFunction: completeSandboxIDs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			ctx := cmd.Context()
+			w := cmdctx.WorkspaceClient(ctx)
+			api, err := newSandboxAPI(w)
+			if err != nil {
+				return err
+			}
+			out := cmd.OutOrStdout()
+
+			profile := w.Config.Profile
+			if profile == "" {
+				profile = w.Config.Host
+			}
+
+			id, err := resolveLocalID(ctx, profile, args[0])
+			if err != nil {
+				return err
+			}
+
+			var idleSecs *int64
+			if cmd.Flags().Changed("idle-timeout") {
+				secs, err := parseIdleTimeoutFlag(idleTimeoutFlag)
+				if err != nil {
+					return err
+				}
+				idleSecs = &secs
+			}
+
+			var noAutostop *bool
+			if cmd.Flags().Changed("no-autostop") {
+				p := noAutostopFlag
+				noAutostop = &p
+			}
+
+			var name *string
+			if cmd.Flags().Changed("name") {
+				if err := validateName(nameFlag); err != nil {
+					return err
+				}
+				n := nameFlag
+				name = &n
+			}
+
+			if idleSecs == nil && noAutostop == nil && name == nil {
+				return errors.New("nothing to update — pass --name, --idle-timeout, and/or --no-autostop")
+			}
+
+			updated, err := api.update(ctx, id, name, idleSecs, noAutostop)
+			if err != nil {
+				return fmt.Errorf("failed to update sandbox %s: %w", id, err)
+			}
+			_ = setGatewayHost(ctx, profile, updated.GatewayHost)
+			_ = upsertSandbox(ctx, profile, updated.SandboxID, updated.Name)
+
+			blank(out)
+			field(ctx, out, "id", cmdio.Bold(ctx, updated.SandboxID))
+			if updated.Name != "" {
+				field(ctx, out, "name", updated.Name)
+			}
+			field(ctx, out, "autostop", cmdio.Faint(ctx, updated.autoStopLabel()))
+			blank(out)
+			return nil
+		},
+	}
+
+	cmd.Flags().StringVar(&nameFlag, "name", "",
+		"Display label for the sandbox (max 256 bytes). Pass --name= to clear.")
+	cmd.Flags().StringVar(&idleTimeoutFlag, "idle-timeout", "",
+		"Idle timeout (e.g. 15m, 1h30m, 90s). Pass 0 to clear and revert to the manager's default.")
+	cmd.Flags().BoolVar(&noAutostopFlag, "no-autostop", false,
+		"When true, this sandbox never auto-stops on idle. Pass --no-autostop=false to revert.")
+
+	return cmd
+}
+
+// parseIdleTimeoutFlag accepts the same syntax as time.ParseDuration plus
+// the special-case "0" / "0s" → clear. Anything else outside the
+// [60s, 86400s] window is rejected client-side.
+func parseIdleTimeoutFlag(raw string) (int64, error) {
+	d, err := time.ParseDuration(raw)
+	if err != nil {
+		// Allow bare integer seconds as a convenience (`--idle-timeout 900`).
+		var secs int64
+		if _, e2 := fmt.Sscanf(raw, "%d", &secs); e2 == nil {
+			return checkIdleSecs(secs)
+		}
+		return 0, fmt.Errorf("invalid --idle-timeout %q: %w (use Go duration syntax, e.g. 15m, 1h30m)", raw, err)
+	}
+	return checkIdleSecs(int64(d.Seconds()))
+}
+
+func checkIdleSecs(secs int64) (int64, error) {
+	if secs == 0 {
+		return 0, nil // clear / revert to global default
+	}
+	if secs < minIdleTimeoutSecs || secs > maxIdleTimeoutSecs {
+		// Echo bounds in Go duration form so they match the input the
+		// user typed (raw seconds like `86400s` reads as a different
+		// unit).
+		return 0, fmt.Errorf(
+			"idle-timeout must be 0 (clear) or between %s and %s, got %s",
+			formatDurationSecs(minIdleTimeoutSecs),
+			formatDurationSecs(maxIdleTimeoutSecs),
+			formatDurationSecs(secs),
+		)
+	}
+	return secs, nil
+}
diff --git a/cmd/sandbox/create.go b/cmd/sandbox/create.go
new file mode 100644
index 00000000000..2d9beb19763
--- /dev/null
+++ b/cmd/sandbox/create.go
@@ -0,0 +1,107 @@
+package sandbox
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/spf13/cobra"
+)
+
+func newCreateCommand() *cobra.Command {
+	var name string
+	var outputJSON bool
+
+	cmd := &cobra.Command{
+		Use:   "create",
+		Short: "Create a new Sandbox environment",
+		Long: `Create a new Sandbox environment.
+
+Creates a new personal development environment backed by a microVM.
+Blocks until the sandbox is running and prints the sandbox ID.
+
+Examples:
+  databricks sandbox create
+  databricks sandbox create --name my-project
+  databricks sandbox create --json`,
+		PreRunE: root.MustWorkspaceClient,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if err := validateName(name); err != nil {
+				return err
+			}
+
+			ctx := cmd.Context()
+			w := cmdctx.WorkspaceClient(ctx)
+			api, err := newSandboxAPI(w)
+			if err != nil {
+				return err
+			}
+
+			wantJSON := jsonOutput(cmd, outputJSON)
+
+			// In JSON mode, suppress the spinner+ok lines so the only thing
+			// on stdout/stderr that a scripted caller has to parse is the
+			// JSON body itself.
+			var result *createResponse
+			if wantJSON {
+				result, err = api.create(ctx, name)
+				if err != nil {
+					return fmt.Errorf("failed to create sandbox: %w", err)
+				}
+			} else {
+				s := spin(ctx, "Provisioning your sandbox…")
+				defer s.Close()
+				result, err = api.create(ctx, name)
+				if err != nil {
+					s.fail("Failed to create sandbox")
+					return fmt.Errorf("failed to create sandbox: %w", err)
+				}
+				s.ok("Sandbox " + cmdio.Bold(ctx, result.SandboxID) + " is " + status(ctx, result.Status))
+			}
+
+			profile := w.Config.Profile
+			if profile == "" {
+				profile = w.Config.Host
+			}
+			_ = setGatewayHost(ctx, profile, result.GatewayHost)
+			_ = upsertSandbox(ctx, profile, result.SandboxID, name)
+
+			// Only clobber an existing default if it's actually gone
+			// (404). Transient errors (5xx, network blip, rate limit)
+			// must not silently overwrite the user's chosen default.
+			currentDefault := getDefault(ctx, profile)
+			shouldSetDefault := currentDefault == ""
+			if !shouldSetDefault {
+				if _, err := api.get(ctx, currentDefault); errors.Is(err, apierr.ErrNotFound) {
+					shouldSetDefault = true
+				}
+			}
+			if shouldSetDefault {
+				if err := setDefault(ctx, profile, result.SandboxID); err != nil {
+					warn(ctx, fmt.Sprintf("Could not save default: %v", err))
+				} else if !wantJSON {
+					field(ctx, cmd.ErrOrStderr(), "default", result.SandboxID)
+				}
+			}
+
+			if wantJSON {
+				enc := json.NewEncoder(cmd.OutOrStdout())
+				enc.SetIndent("", "  ")
+				return enc.Encode(result)
+			}
+
+			blank(cmd.ErrOrStderr())
+			fmt.Fprintln(cmd.OutOrStdout(), result.SandboxID)
+			return nil
+		},
+	}
+
+	cmd.Flags().StringVar(&name, "name", "", "Display label for the sandbox (max 256 bytes)")
+	cmd.Flags().BoolVar(&outputJSON, "json", false, "Output as JSON")
+
+	return cmd
+}
diff --git a/cmd/sandbox/default.go b/cmd/sandbox/default.go
new file mode 100644
index 00000000000..8e59a1d5348
--- /dev/null
+++ b/cmd/sandbox/default.go
@@ -0,0 +1,63 @@
+package sandbox
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/spf13/cobra"
+)
+
+func newSetDefaultCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:     "default <sandbox-id>",
+		Aliases: []string{"set-default"},
+		Short:   "Set the default Sandbox for SSH",
+		Long: `Set the default Sandbox that 'databricks sandbox ssh' connects to.
+
+The default is stored locally in ~/.databricks/sandbox.json per profile.
+The ID is validated against the server before being written, so a typo
+or a sandbox that lives on a different workspace fails fast instead of
+silently corrupting local state.
+
+Example:
+  databricks sandbox default happy-panda-1234`,
+		Args:              cobra.ExactArgs(1),
+		PreRunE:           root.MustWorkspaceClient,
+		ValidArgsFunction: completeSandboxIDs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			ctx := cmd.Context()
+			w := cmdctx.WorkspaceClient(ctx)
+			profile := w.Config.Profile
+			if profile == "" {
+				profile = w.Config.Host
+			}
+
+			sandboxID, err := resolveLocalID(ctx, profile, args[0])
+			if err != nil {
+				return err
+			}
+			api, err := newSandboxAPI(w)
+			if err != nil {
+				return err
+			}
+			entry, err := api.get(ctx, sandboxID)
+			if err != nil {
+				if errors.Is(err, apierr.ErrNotFound) {
+					return fmt.Errorf("no sandbox named %q — `databricks sandbox list` shows available IDs", sandboxID)
+				}
+				return fmt.Errorf("failed to validate sandbox %s: %w", sandboxID, err)
+			}
+
+			if err := setDefault(ctx, profile, sandboxID); err != nil {
+				return fmt.Errorf("failed to set default: %w", err)
+			}
+			_ = upsertSandbox(ctx, profile, entry.SandboxID, entry.Name)
+			fmt.Fprintf(cmd.OutOrStdout(), "Default sandbox set to: %s\n", sandboxID)
+			return nil
+		},
+	}
+	return cmd
+}
diff --git a/cmd/sandbox/delete.go b/cmd/sandbox/delete.go
new file mode 100644
index 00000000000..589a77dfeac
--- /dev/null
+++ b/cmd/sandbox/delete.go
@@ -0,0 +1,106 @@
+package sandbox
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/spf13/cobra"
+)
+
+func newDeleteCommand() *cobra.Command {
+	var autoApprove bool
+
+	cmd := &cobra.Command{
+		Use:   "delete <sandbox-id>",
+		Short: "Delete a Sandbox environment",
+		Long: `Delete a Sandbox environment.
+
+Permanently terminates and removes the specified sandbox. Prompts for
+confirmation interactively; pass --auto-approve to skip the prompt
+(required in non-interactive contexts).
+
+Examples:
+  databricks sandbox delete happy-panda-1234
+  databricks sandbox delete happy-panda-1234 --auto-approve`,
+		Args:              cobra.ExactArgs(1),
+		PreRunE:           root.MustWorkspaceClient,
+		ValidArgsFunction: completeSandboxIDs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			ctx := cmd.Context()
+			w := cmdctx.WorkspaceClient(ctx)
+			api, err := newSandboxAPI(w)
+			if err != nil {
+				return err
+			}
+
+			profile := w.Config.Profile
+			if profile == "" {
+				profile = w.Config.Host
+			}
+
+			sandboxID, err := resolveLocalID(ctx, profile, args[0])
+			if err != nil {
+				return err
+			}
+
+			// DELETE returns success on 404, so pre-check existence to
+			// surface typos clearly.
+			entry, err := api.get(ctx, sandboxID)
+			if err != nil {
+				if errors.Is(err, apierr.ErrNotFound) {
+					return fmt.Errorf("no sandbox named %q — `databricks sandbox list` shows available IDs", sandboxID)
+				}
+				return fmt.Errorf("failed to look up sandbox %s: %w", sandboxID, err)
+			}
+
+			if !autoApprove {
+				// Non-interactive contexts can't prompt; fail fast with
+				// a pointer to the bypass flag instead of hanging on a
+				// read from a closed/redirected stdin.
+				if !cmdio.IsPromptSupported(ctx) {
+					return errors.New("`databricks sandbox delete` permanently destroys the sandbox; pass --auto-approve to confirm in non-interactive contexts")
+				}
+				question := "Delete sandbox " + cmdio.Bold(ctx, entry.SandboxID)
+				if entry.Name != "" && entry.Name != entry.SandboxID {
+					question += " (name: " + entry.Name + ", status: " + entry.Status + ")"
+				} else {
+					question += " (status: " + entry.Status + ")"
+				}
+				question += "?"
+				confirmed, err := cmdio.AskYesOrNo(ctx, question)
+				if err != nil {
+					return err
+				}
+				if !confirmed {
+					cmdio.LogString(ctx, "Cancelled.")
+					return nil
+				}
+			}
+
+			s := spin(ctx, "Removing "+sandboxID+"…")
+			defer s.Close()
+
+			if err := api.delete(ctx, sandboxID); err != nil {
+				s.fail("Failed to delete " + sandboxID)
+				return fmt.Errorf("failed to delete sandbox %s: %w", sandboxID, err)
+			}
+
+			_ = removeSandbox(ctx, profile, sandboxID)
+			if getDefault(ctx, profile) == sandboxID {
+				_ = clearDefault(ctx, profile)
+				s.ok("Removed " + cmdio.Bold(ctx, sandboxID) + " " + cmdio.Faint(ctx, "(default cleared)"))
+			} else {
+				s.ok("Removed " + cmdio.Bold(ctx, sandboxID))
+			}
+			return nil
+		},
+	}
+
+	cmd.Flags().BoolVar(&autoApprove, "auto-approve", false, "Skip the interactive confirmation prompt")
+
+	return cmd
+}
diff --git a/cmd/sandbox/keyhash.go b/cmd/sandbox/keyhash.go
new file mode 100644
index 00000000000..d7d23459965
--- /dev/null
+++ b/cmd/sandbox/keyhash.go
@@ -0,0 +1,31 @@
+package sandbox
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"strings"
+)
+
+// keyHash returns the identifier the sandbox SSH-keys API assigns to a
+// public key. The algorithm is sha256("<type> <base64-blob>") truncated to
+// the first 16 bytes and hex-encoded; the OpenSSH comment (anything after
+// the second whitespace-separated token) is stripped before hashing, so
+// registering the same key under different comments yields the same hash.
+// Leading and trailing whitespace are trimmed first — `.pub` files end
+// with a newline that would otherwise be hashed in for comment-less keys.
+func keyHash(publicKey string) string {
+	publicKey = strings.TrimSpace(publicKey)
+	end := len(publicKey)
+	spaces := 0
+	for i, c := range publicKey {
+		if c == ' ' {
+			spaces++
+			if spaces == 2 {
+				end = i
+				break
+			}
+		}
+	}
+	sum := sha256.Sum256([]byte(publicKey[:end]))
+	return hex.EncodeToString(sum[:16])
+}
diff --git a/cmd/sandbox/keyhash_test.go b/cmd/sandbox/keyhash_test.go
new file mode 100644
index 00000000000..b85a9d82697
--- /dev/null
+++ b/cmd/sandbox/keyhash_test.go
@@ -0,0 +1,68 @@
+package sandbox
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// Inputs are synthetic; expected values are sha256(canonical input)[:16]
+// in hex. The algorithm was verified against the live
+// /api/2.0/lakebox/ssh-keys endpoint during exploration, so this test
+// pins the algorithm — not a known set of real registered keys.
+func TestKeyHash(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		want  string
+	}{
+		{
+			name:  "single-token input hashed verbatim",
+			input: "a",
+			want:  "ca978112ca1bbdcafac231b39a23dc4d",
+		},
+		{
+			name:  "type and blob with no comment",
+			input: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDUMMY",
+			want:  "2b366430eb9743668b652921d3b22d54",
+		},
+		{
+			name:  "comment is stripped before hashing",
+			input: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDUMMY comment-one",
+			want:  "2b366430eb9743668b652921d3b22d54",
+		},
+		{
+			name:  "different comment same key still matches",
+			input: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDUMMY entirely-different-comment",
+			want:  "2b366430eb9743668b652921d3b22d54",
+		},
+		{
+			name:  "longer key with multi-word comment",
+			input: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAITESTKEY1234 test-from-cli-exploration",
+			want:  "52c927705154e2d98a1b7036cc3e06dc",
+		},
+		{
+			name:  "empty input still produces a hash",
+			input: "",
+			want:  "e3b0c44298fc1c149afbf4c8996fb924",
+		},
+		{
+			// `.pub` files end with a newline. Without trimming, a
+			// comment-less key would hash with `\n` mixed in and
+			// stop matching the server's value.
+			name:  "trailing newline does not change hash",
+			input: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDUMMY\n",
+			want:  "2b366430eb9743668b652921d3b22d54",
+		},
+		{
+			name:  "leading and trailing whitespace stripped",
+			input: "  ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDUMMY  \n",
+			want:  "2b366430eb9743668b652921d3b22d54",
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, keyHash(tc.input))
+		})
+	}
+}
diff --git a/cmd/sandbox/list.go b/cmd/sandbox/list.go
new file mode 100644
index 00000000000..ef0960d21cb
--- /dev/null
+++ b/cmd/sandbox/list.go
@@ -0,0 +1,167 @@
+package sandbox
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/spf13/cobra"
+)
+
+func newListCommand() *cobra.Command {
+	var outputJSON bool
+
+	cmd := &cobra.Command{
+		Use:   "list",
+		Short: "List your Sandbox environments",
+		Long: `List your Sandbox environments.
+
+Shows all sandboxes associated with your account, including their
+current status and ID.
+
+Example:
+  databricks sandbox list
+  databricks sandbox list --json`,
+		PreRunE: root.MustWorkspaceClient,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			ctx := cmd.Context()
+			w := cmdctx.WorkspaceClient(ctx)
+			api, err := newSandboxAPI(w)
+			if err != nil {
+				return err
+			}
+
+			entries, err := api.list(ctx)
+			if err != nil {
+				return fmt.Errorf("failed to list sandboxes: %w", err)
+			}
+
+			profile := w.Config.Profile
+			if profile == "" {
+				profile = w.Config.Host
+			}
+
+			// `list` returns the full set (the API client loops through every
+			// page), so it's the cheapest place to keep local state coherent:
+			//
+			//   - If our saved default isn't in the result, the sandbox was
+			//     deleted elsewhere — clear so the next `ssh` provisions fresh
+			//     instead of erroring against a missing ID.
+			//   - Cache the gateway hostname stamped on any returned entry so
+			//     subsequent `ssh <id>` invocations don't need their own `get`.
+			defaultID := getDefault(ctx, profile)
+			if defaultID != "" {
+				found := false
+				for _, e := range entries {
+					if e.SandboxID == defaultID {
+						found = true
+						break
+					}
+				}
+				if !found {
+					warn(ctx, fmt.Sprintf("Saved default %s no longer exists; clearing", defaultID))
+					_ = clearDefault(ctx, profile)
+					defaultID = ""
+				}
+			}
+			for _, e := range entries {
+				if e.GatewayHost != "" {
+					_ = setGatewayHost(ctx, profile, e.GatewayHost)
+					break
+				}
+			}
+
+			// Replace the local (id, name) cache from this fresh list,
+			// so subsequent name-based commands (`sandbox ssh my-project`,
+			// etc.) resolve locally without another API call.
+			refs := make([]cachedSandbox, 0, len(entries))
+			for _, e := range entries {
+				refs = append(refs, cachedSandbox{ID: e.SandboxID, Name: e.Name})
+			}
+			_ = setSandboxes(ctx, profile, refs)
+
+			if jsonOutput(cmd, outputJSON) {
+				enc := json.NewEncoder(cmd.OutOrStdout())
+				enc.SetIndent("", "  ")
+				return enc.Encode(entries)
+			}
+
+			if len(entries) == 0 {
+				fmt.Fprintf(cmd.ErrOrStderr(), "  %s\n", cmdio.Faint(ctx, "No sandboxes found."))
+				return nil
+			}
+
+			out := cmd.OutOrStdout()
+
+			// NAME is always rendered (even with no --name set on any
+			// row) so the table shape stays stable across calls;
+			// unnamed sandboxes render as `-`. Widths are measured in
+			// terminal cells via cmdio.Width so emoji / CJK names line
+			// up correctly.
+			idCol := 10
+			autostopCol := 8
+			nameCol := 4
+			for _, e := range entries {
+				if l := cmdio.Width(e.SandboxID); l > idCol {
+					idCol = l
+				}
+				if l := cmdio.Width(e.autoStopLabel()); l > autostopCol {
+					autostopCol = l
+				}
+				// A name equal to the id renders as `-`, so don't let
+				// it expand the column.
+				if e.Name != "" && e.Name != e.SandboxID {
+					if l := cmdio.Width(e.Name); l > nameCol {
+						nameCol = l
+					}
+				}
+			}
+			idCol += 2
+			autostopCol += 2
+			nameCol += 2
+			const statusCol = 10
+			const defaultCol = 7
+
+			blank(out)
+			header := fmt.Sprintf("%-*s  %-*s  %-*s  %-*s  %s",
+				idCol, "ID", nameCol, "NAME", statusCol, "STATUS", autostopCol, "AUTOSTOP", "DEFAULT")
+			fmt.Fprintf(out, "  %s\n", cmdio.Faint(ctx, header))
+
+			ruleLen := idCol + nameCol + statusCol + autostopCol + defaultCol + 8
+			fmt.Fprintf(out, "  %s\n", cmdio.Faint(ctx, strings.Repeat("─", ruleLen)))
+
+			for _, e := range entries {
+				id := e.SandboxID
+				def := ""
+				if id == defaultID {
+					def = cmdio.Cyan(ctx, "*")
+				}
+				idStr := cmdio.Bold(ctx, id)
+				if strings.EqualFold(e.Status, "running") {
+					idStr = cmdio.Bold(ctx, cmdio.Cyan(ctx, id))
+				}
+				nm := cmdio.Faint(ctx, "-")
+				if e.Name != "" && e.Name != id {
+					nm = e.Name
+				}
+				// cmdio.PadRight measures visible width, so the ANSI escapes
+				// the color helpers wrap each cell in don't break alignment.
+				fmt.Fprintf(out, "  %s  %s  %s  %s  %s\n",
+					cmdio.PadRight(idStr, idCol),
+					cmdio.PadRight(nm, nameCol),
+					cmdio.PadRight(status(ctx, e.Status), statusCol),
+					cmdio.PadRight(cmdio.Faint(ctx, e.autoStopLabel()), autostopCol),
+					def)
+			}
+			blank(out)
+			return nil
+		},
+	}
+
+	cmd.Flags().BoolVar(&outputJSON, "json", false, "Output as JSON")
+
+	return cmd
+}
diff --git a/cmd/sandbox/register.go b/cmd/sandbox/register.go
new file mode 100644
index 00000000000..c26e45f2d40
--- /dev/null
+++ b/cmd/sandbox/register.go
@@ -0,0 +1,175 @@
+package sandbox
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/env"
+	"github.com/spf13/cobra"
+)
+
+const sandboxKeyName = "sandbox_ed25519"
+
+func newRegisterCommand() *cobra.Command {
+	var name string
+
+	cmd := &cobra.Command{
+		Use:   "register",
+		Short: "Register this machine for sandbox SSH access",
+		Long: `Generate a dedicated SSH key for sandbox and register it with the service.
+
+This command:
+1. Generates an Ed25519 SSH key at ~/.ssh/sandbox_ed25519 (if it doesn't exist)
+2. Registers the public key with the sandbox service, labeled with --name
+   (defaults to this machine's hostname so 'ssh-key list' is meaningful
+   across multiple machines)
+3. Optionally adds a 'Host sandbox-gw' alias to ~/.ssh/config (prompted
+   the first time) so editor Remote-SSH ("Open in VS Code / Cursor"
+   from the workspace UI) and plain 'ssh <id>@sandbox-gw' both work
+
+After registration, 'databricks sandbox ssh' will use this key automatically.
+Run this once per machine.
+
+Examples:
+  databricks sandbox register
+  databricks sandbox register --name my-laptop`,
+		PreRunE: root.MustWorkspaceClient,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			ctx := cmd.Context()
+			w := cmdctx.WorkspaceClient(ctx)
+			api, err := newSandboxAPI(w)
+			if err != nil {
+				return err
+			}
+
+			profile := w.Config.Profile
+			if profile == "" {
+				profile = w.Config.Host
+			}
+
+			keyPath, generated, err := ensureSandboxKey(ctx)
+			if err != nil {
+				return fmt.Errorf("failed to ensure sandbox SSH key: %w", err)
+			}
+
+			// Always print paths with forward slashes so acceptance
+			// goldens are stable across Linux/macOS/Windows.
+			displayKeyPath := filepath.ToSlash(keyPath)
+			stderr := cmd.ErrOrStderr()
+			if generated {
+				ok(ctx, "Generated SSH key at "+cmdio.Faint(ctx, displayKeyPath))
+			} else {
+				field(ctx, stderr, "key", displayKeyPath)
+			}
+
+			pubKeyData, err := os.ReadFile(keyPath + ".pub")
+			if err != nil {
+				return fmt.Errorf("failed to read public key %s.pub: %w", keyPath, err)
+			}
+
+			// Default to hostname so `ssh-key list` is meaningful across machines.
+			if name == "" {
+				if host, err := os.Hostname(); err == nil {
+					name = host
+				}
+			}
+
+			s := spin(ctx, "Registering key…")
+			defer s.Close()
+			registered, err := api.registerKey(ctx, string(pubKeyData), name)
+			if err != nil {
+				s.fail("Failed to register key")
+				return fmt.Errorf("failed to register key: %w", err)
+			}
+			s.ok("SSH key registered")
+
+			// Cache the workspace's gateway host so any subsequent
+			// command (ssh, status, ...) sees it before its own first
+			// API call.
+			if registered.GatewayHost != "" {
+				_ = setGatewayHost(ctx, profile, registered.GatewayHost)
+			}
+
+			// Write the `Host <gateway>` block(s) to ~/.ssh/config so
+			// editor Remote-SSH ("Open in VS Code/Cursor") deep links
+			// and plain `ssh <id>@<gateway>` both work without the
+			// user pasting any config block. Reads the full gateway
+			// set from local state so a user with profiles in
+			// multiple regions accumulates one block per gateway
+			// across registers, rather than overwriting.
+			if err := maybeWriteSSHConfig(ctx, keyPath); err != nil {
+				warn(ctx, fmt.Sprintf("Registered key, but failed to update ~/.ssh/config: %v", err))
+			}
+
+			// Tell the user what to do next based on whether they
+			// already have a sandbox: a brand-new register with no
+			// default yet should land on `create`, not `ssh`.
+			blank(stderr)
+			if getDefault(ctx, profile) == "" {
+				fmt.Fprintf(stderr, "  Run %s to provision your first sandbox.\n\n", cmdio.Bold(ctx, "databricks sandbox create"))
+			} else {
+				fmt.Fprintf(stderr, "  Run %s to connect.\n\n", cmdio.Bold(ctx, "databricks sandbox ssh"))
+			}
+			return nil
+		},
+	}
+
+	cmd.Flags().StringVar(&name, "name", "",
+		"Label for the registered key (defaults to this machine's hostname). "+
+			"Pass --name= to register without a label.")
+
+	return cmd
+}
+
+// sandboxKeyPath returns the path to the dedicated sandbox SSH key.
+func sandboxKeyPath(ctx context.Context) (string, error) {
+	homeDir, err := env.UserHomeDir(ctx)
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(homeDir, ".ssh", sandboxKeyName), nil
+}
+
+// ensureSandboxKey returns the path to the sandbox SSH key, generating it if
+// it doesn't exist.
+func ensureSandboxKey(ctx context.Context) (string, bool, error) {
+	keyPath, err := sandboxKeyPath(ctx)
+	if err != nil {
+		return "", false, err
+	}
+
+	if _, err := os.Stat(keyPath); err == nil {
+		return keyPath, false, nil
+	}
+
+	if _, err := exec.LookPath("ssh-keygen"); err != nil {
+		return "", false, errors.New(
+			"ssh-keygen not found in PATH.\n" +
+				"Please install OpenSSH and run 'databricks sandbox register' again.\n" +
+				"  macOS:   brew install openssh\n" +
+				"  Ubuntu:  sudo apt install openssh-client\n" +
+				"  Windows: install Git for Windows (includes ssh-keygen)")
+	}
+
+	sshDir := filepath.Dir(keyPath)
+	if err := os.MkdirAll(sshDir, 0o700); err != nil {
+		return "", false, fmt.Errorf("failed to create %s: %w", sshDir, err)
+	}
+
+	genCmd := exec.Command("ssh-keygen", "-t", "ed25519", "-f", keyPath, "-N", "", "-q", "-C", "sandbox")
+	genCmd.Stdin = os.Stdin
+	genCmd.Stdout = os.Stderr
+	genCmd.Stderr = os.Stderr
+	if err := genCmd.Run(); err != nil {
+		return "", false, fmt.Errorf("ssh-keygen failed: %w", err)
+	}
+
+	return keyPath, true, nil
+}
diff --git a/cmd/sandbox/resolve.go b/cmd/sandbox/resolve.go
new file mode 100644
index 00000000000..21bbcb841b6
--- /dev/null
+++ b/cmd/sandbox/resolve.go
@@ -0,0 +1,63 @@
+package sandbox
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+)
+
+// resolveLocalID maps a user-typed argument to a sandbox ID using only
+// the local state cache — no API calls. Resolution order:
+//
+//  1. Exact ID match → return arg unchanged. Anyone scripting against
+//     IDs (or pasting an ID they already know) gets the fast path.
+//  2. Exact name match in the cache:
+//     - One match → return that sandbox's ID.
+//     - Several matches → error with the candidate IDs, since the
+//     server allows multiple sandboxes to share a `--name` and the
+//     CLI must not silently guess which one was meant.
+//  3. No match → pass the arg through. It's either an ID the cache
+//     hasn't seen yet (fresh sandbox created elsewhere; the user just
+//     hasn't run `sandbox list` since) or a typo. Either way the next
+//     API call surfaces a clean 404 instead of us refusing locally.
+//
+// This is intentionally an offline shortcut: a stale cache only fails
+// to find a name; it never causes the CLI to act on the wrong sandbox.
+// Run `sandbox list` to refresh.
+func resolveLocalID(ctx context.Context, profile, arg string) (string, error) {
+	if arg == "" {
+		return "", errors.New("empty sandbox identifier")
+	}
+
+	sbs := getSandboxes(ctx, profile)
+
+	for _, s := range sbs {
+		if s.ID == arg {
+			return arg, nil
+		}
+	}
+
+	var matches []cachedSandbox
+	for _, s := range sbs {
+		if s.Name != "" && s.Name == arg {
+			matches = append(matches, s)
+		}
+	}
+
+	switch len(matches) {
+	case 0:
+		return arg, nil
+	case 1:
+		return matches[0].ID, nil
+	default:
+		ids := make([]string, len(matches))
+		for i, m := range matches {
+			ids[i] = m.ID
+		}
+		return "", fmt.Errorf(
+			"name %q is ambiguous in local cache; sandboxes with this name: %s — pass the ID directly",
+			arg, strings.Join(ids, ", "),
+		)
+	}
+}
diff --git a/cmd/sandbox/resolve_test.go b/cmd/sandbox/resolve_test.go
new file mode 100644
index 00000000000..b4b13f2b47a
--- /dev/null
+++ b/cmd/sandbox/resolve_test.go
@@ -0,0 +1,152 @@
+package sandbox
+
+import (
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestResolveLocalIDEmptyArgIsError(t *testing.T) {
+	ctx, _ := stateCtx(t)
+	_, err := resolveLocalID(ctx, "p", "")
+	require.Error(t, err)
+}
+
+func TestResolveLocalIDPassThroughWhenCacheEmpty(t *testing.T) {
+	ctx, _ := stateCtx(t)
+	id, err := resolveLocalID(ctx, "p", "anything-goes")
+	require.NoError(t, err)
+	assert.Equal(t, "anything-goes", id)
+}
+
+func TestResolveLocalIDIDFirstPrecedence(t *testing.T) {
+	// A sandbox whose --name happens to collide with another sandbox's ID
+	// must NOT resolve the typed ID via the name path.
+	ctx, _ := stateCtx(t)
+	require.NoError(t, setSandboxes(ctx, "p", []cachedSandbox{
+		{ID: "happy-panda-1234", Name: "real-panda"},
+		{ID: "other-id-5678", Name: "happy-panda-1234"},
+	}))
+	id, err := resolveLocalID(ctx, "p", "happy-panda-1234")
+	require.NoError(t, err)
+	assert.Equal(t, "happy-panda-1234", id, "must resolve to the ID, not the entry that has this string as its --name")
+}
+
+func TestResolveLocalIDNameMatch(t *testing.T) {
+	ctx, _ := stateCtx(t)
+	require.NoError(t, setSandboxes(ctx, "p", []cachedSandbox{
+		{ID: "happy-panda-1234", Name: "my-project"},
+	}))
+	id, err := resolveLocalID(ctx, "p", "my-project")
+	require.NoError(t, err)
+	assert.Equal(t, "happy-panda-1234", id)
+}
+
+func TestResolveLocalIDAmbiguousNameErrors(t *testing.T) {
+	ctx, _ := stateCtx(t)
+	require.NoError(t, setSandboxes(ctx, "p", []cachedSandbox{
+		{ID: "happy-panda-1234", Name: "foo"},
+		{ID: "sad-otter-5678", Name: "foo"},
+	}))
+	_, err := resolveLocalID(ctx, "p", "foo")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "ambiguous")
+	assert.Contains(t, err.Error(), "happy-panda-1234")
+	assert.Contains(t, err.Error(), "sad-otter-5678")
+}
+
+func TestResolveLocalIDEmptyNamesIgnored(t *testing.T) {
+	// Sandboxes without a --name should not match an empty-string arg or
+	// any other arg by virtue of their name being empty.
+	ctx, _ := stateCtx(t)
+	require.NoError(t, setSandboxes(ctx, "p", []cachedSandbox{
+		{ID: "happy-panda-1234", Name: ""},
+	}))
+	_, err := resolveLocalID(ctx, "p", "")
+	require.Error(t, err, "empty arg always errors")
+
+	id, err := resolveLocalID(ctx, "p", "happy-panda-1234")
+	require.NoError(t, err)
+	assert.Equal(t, "happy-panda-1234", id)
+}
+
+func TestSandboxesPerProfileIsolated(t *testing.T) {
+	ctx, _ := stateCtx(t)
+	require.NoError(t, setSandboxes(ctx, "p-a", []cachedSandbox{{ID: "a-1", Name: "shared-name"}}))
+	require.NoError(t, setSandboxes(ctx, "p-b", []cachedSandbox{{ID: "b-1", Name: "shared-name"}}))
+
+	id, err := resolveLocalID(ctx, "p-a", "shared-name")
+	require.NoError(t, err)
+	assert.Equal(t, "a-1", id)
+
+	id, err = resolveLocalID(ctx, "p-b", "shared-name")
+	require.NoError(t, err)
+	assert.Equal(t, "b-1", id)
+}
+
+func TestUpsertSandboxAddsNewEntry(t *testing.T) {
+	ctx, _ := stateCtx(t)
+	require.NoError(t, upsertSandbox(ctx, "p", "id-1", "name-1"))
+	assert.Equal(t, []cachedSandbox{{ID: "id-1", Name: "name-1"}}, getSandboxes(ctx, "p"))
+}
+
+func TestUpsertSandboxUpdatesExistingEntry(t *testing.T) {
+	ctx, _ := stateCtx(t)
+	require.NoError(t, upsertSandbox(ctx, "p", "id-1", "old"))
+	require.NoError(t, upsertSandbox(ctx, "p", "id-1", "new"))
+	assert.Equal(t, []cachedSandbox{{ID: "id-1", Name: "new"}}, getSandboxes(ctx, "p"))
+}
+
+func TestUpsertSandboxSameValueIsNoop(t *testing.T) {
+	ctx, path := stateCtx(t)
+	require.NoError(t, upsertSandbox(ctx, "p", "id-1", "name-1"))
+	before, err := os.Stat(path)
+	require.NoError(t, err)
+	require.NoError(t, upsertSandbox(ctx, "p", "id-1", "name-1"))
+	after, err := os.Stat(path)
+	require.NoError(t, err)
+	assert.Equal(t, before.ModTime(), after.ModTime(), "no-op upsert must not rewrite the file")
+}
+
+func TestRemoveSandboxDropsEntry(t *testing.T) {
+	ctx, _ := stateCtx(t)
+	require.NoError(t, setSandboxes(ctx, "p", []cachedSandbox{
+		{ID: "keep-me", Name: ""},
+		{ID: "drop-me", Name: "doomed"},
+	}))
+	require.NoError(t, removeSandbox(ctx, "p", "drop-me"))
+	assert.Equal(t, []cachedSandbox{{ID: "keep-me", Name: ""}}, getSandboxes(ctx, "p"))
+}
+
+func TestRemoveSandboxMissingIsNoop(t *testing.T) {
+	ctx, _ := stateCtx(t)
+	require.NoError(t, setSandboxes(ctx, "p", []cachedSandbox{{ID: "keep-me"}}))
+	require.NoError(t, removeSandbox(ctx, "p", "nope"))
+	assert.Equal(t, []cachedSandbox{{ID: "keep-me"}}, getSandboxes(ctx, "p"))
+}
+
+// Removing the last sandbox for a profile must also drop the profile's
+// cached gateway host — otherwise sandbox.json accumulates orphan
+// gatewayHosts entries that no longer correspond to any sandbox.
+func TestRemoveSandboxClearsOrphanGatewayHost(t *testing.T) {
+	ctx, _ := stateCtx(t)
+	require.NoError(t, setSandboxes(ctx, "p", []cachedSandbox{{ID: "only-one"}}))
+	require.NoError(t, setGatewayHost(ctx, "p", "gw.example.test"))
+	require.Equal(t, "gw.example.test", getGatewayHost(ctx, "p"))
+
+	require.NoError(t, removeSandbox(ctx, "p", "only-one"))
+	assert.Empty(t, getSandboxes(ctx, "p"))
+	assert.Empty(t, getGatewayHost(ctx, "p"), "gateway host must be cleared when the last sandbox is removed")
+}
+
+// Removing one of many sandboxes must NOT touch the gateway host — it
+// still applies to the remaining sandboxes on the profile.
+func TestRemoveSandboxKeepsGatewayHostWhileSandboxesRemain(t *testing.T) {
+	ctx, _ := stateCtx(t)
+	require.NoError(t, setSandboxes(ctx, "p", []cachedSandbox{{ID: "keep"}, {ID: "drop"}}))
+	require.NoError(t, setGatewayHost(ctx, "p", "gw.example.test"))
+	require.NoError(t, removeSandbox(ctx, "p", "drop"))
+	assert.Equal(t, "gw.example.test", getGatewayHost(ctx, "p"))
+}
diff --git a/cmd/sandbox/sandbox.go b/cmd/sandbox/sandbox.go
new file mode 100644
index 00000000000..39ff208129b
--- /dev/null
+++ b/cmd/sandbox/sandbox.go
@@ -0,0 +1,49 @@
+package sandbox
+
+import (
+	"github.com/spf13/cobra"
+)
+
+// New returns the root command for the sandbox subcommand.
+func New() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:     "sandbox",
+		Short:   "Manage Databricks Sandbox environments",
+		GroupID: "development",
+		Hidden:  true,
+		Long: `Manage Databricks Sandbox environments.
+
+Sandbox provides SSH-accessible development environments backed by
+microVM isolation. Each sandbox is a personal sandbox with pre-installed
+tooling (Python, Node.js, Rust, Databricks CLI) and persistent storage.
+
+Getting started:
+  databricks auth login --host https://...   # authenticate to a Databricks workspace
+  databricks sandbox register                # generate and register an SSH key
+  databricks sandbox create                  # provision a sandbox (becomes your default)
+  databricks sandbox ssh                     # SSH to your default sandbox
+
+Common workflows:
+  databricks sandbox ssh                     # SSH to your default sandbox
+  databricks sandbox ssh my-project          # SSH to a named sandbox
+  databricks sandbox list                    # list your sandboxes
+  databricks sandbox create                  # create a new sandbox
+  databricks sandbox delete my-project       # delete a sandbox
+  databricks sandbox status my-project       # show sandbox status
+`,
+	}
+
+	cmd.AddCommand(newRegisterCommand())
+	cmd.AddCommand(newSSHKeyCommand())
+	cmd.AddCommand(newSetDefaultCommand())
+	cmd.AddCommand(newSSHCommand())
+	cmd.AddCommand(newListCommand())
+	cmd.AddCommand(newCreateCommand())
+	cmd.AddCommand(newDeleteCommand())
+	cmd.AddCommand(newStopCommand())
+	cmd.AddCommand(newStartCommand())
+	cmd.AddCommand(newStatusCommand())
+	cmd.AddCommand(newConfigCommand())
+
+	return cmd
+}
diff --git a/cmd/sandbox/ssh.go b/cmd/sandbox/ssh.go
new file mode 100644
index 00000000000..7fbe7df1c20
--- /dev/null
+++ b/cmd/sandbox/ssh.go
@@ -0,0 +1,315 @@
+package sandbox
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"strings"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/execv"
+	"github.com/databricks/cli/libs/shellquote"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/spf13/cobra"
+)
+
+const defaultGatewayPort = "2222"
+
+func newSSHCommand() *cobra.Command {
+	var gatewayPort string
+
+	cmd := &cobra.Command{
+		Use:   "ssh [sandbox-id] [-- <ssh-args-or-command>...]",
+		Short: "SSH into a Sandbox environment",
+		Long: `SSH into a Sandbox environment.
+
+Connect to your default or a named sandbox via SSH. Extra arguments
+after -- are passed directly to the ssh process. This lets you run
+remote commands, set up port forwarding, or pass any other ssh flags.
+
+Examples:
+  databricks sandbox ssh                                  # interactive shell on default sandbox
+  databricks sandbox ssh happy-panda-1234                 # interactive shell on specific sandbox
+  databricks sandbox ssh -- ls -la /home                  # run command on default sandbox
+  databricks sandbox ssh happy-panda-1234 -- cat /etc/os-release  # run command on specific sandbox
+  databricks sandbox ssh -- -L 8080:localhost:8080        # port forwarding on default sandbox`,
+		Args:              cobra.ArbitraryArgs,
+		PreRunE:           root.MustWorkspaceClient,
+		ValidArgsFunction: completeSandboxIDs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			ctx := cmd.Context()
+			w := cmdctx.WorkspaceClient(ctx)
+
+			profile := w.Config.Profile
+			if profile == "" {
+				profile = w.Config.Host
+			}
+
+			keyPath, err := sandboxKeyPath(ctx)
+			if err != nil {
+				return fmt.Errorf("failed to determine sandbox key path: %w", err)
+			}
+			if _, err := os.Stat(keyPath); errors.Is(err, fs.ErrNotExist) {
+				return fmt.Errorf("sandbox SSH key not found at %s — run 'databricks sandbox register' first", keyPath)
+			}
+
+			var sandboxID string
+			var extraArgs []string
+
+			switch dashAt := cmd.ArgsLenAtDash(); dashAt {
+			case -1:
+				if len(args) > 0 {
+					sandboxID = args[0]
+				}
+			case 0:
+				extraArgs = args[dashAt:]
+			default:
+				sandboxID = args[0]
+				extraArgs = args[dashAt:]
+			}
+
+			if sandboxID != "" {
+				resolved, err := resolveLocalID(ctx, profile, sandboxID)
+				if err != nil {
+					return err
+				}
+				sandboxID = resolved
+			}
+
+			// Captured from any Sandbox response we touch below; "" when
+			// we never hit the API in this invocation.
+			var (
+				sandboxGatewayHost string
+				sandboxStatus      string
+			)
+
+			api, err := newSandboxAPI(w)
+			if err != nil {
+				return err
+			}
+
+			// Surface deleted-key errors before ssh's opaque "Permission denied".
+			if err := verifyKeyRegistered(ctx, api, keyPath); err != nil {
+				return err
+			}
+
+			if sandboxID == "" {
+				def := getDefault(ctx, profile)
+				if def == "" {
+					return errors.New("no default sandbox configured — run `databricks sandbox create` to provision one, or `databricks sandbox default <id>` to point at an existing sandbox")
+				}
+				// Confirm the saved default still exists. A stale entry is
+				// almost always user-correctable (deleted from another
+				// machine, reaped by an admin); fail fast with an actionable
+				// message rather than silently provisioning a fresh sandbox
+				// and surprising the user with a bill.
+				sb, err := api.get(ctx, def)
+				switch {
+				case err == nil:
+					sandboxID = def
+					sandboxGatewayHost = sb.GatewayHost
+					sandboxStatus = sb.Status
+				case errors.Is(err, apierr.ErrNotFound):
+					_ = clearDefault(ctx, profile)
+					return fmt.Errorf("saved default %q no longer exists (cleared) — run `databricks sandbox create` to provision a new one, or `databricks sandbox default <id>` to point at an existing sandbox", def)
+				default:
+					warn(ctx, fmt.Sprintf("Could not validate default %s: %v", def, err))
+					sandboxID = def
+				}
+			} else {
+				// Validate the explicit ID against the server. Two reasons:
+				//   1. Surface `sandbox ssh fake-id` as a clear 404 instead of
+				//      letting the user wade through `Permission denied` from
+				//      ssh when the gateway can't route an unknown sandbox.
+				//   2. Capture `gateway_host` to drive the resolution below.
+				// Non-NotFound errors fall through so transient API hiccups
+				// don't block a connection the gateway can still route.
+				sb, err := api.get(ctx, sandboxID)
+				switch {
+				case err == nil:
+					sandboxGatewayHost = sb.GatewayHost
+					sandboxStatus = sb.Status
+				case errors.Is(err, apierr.ErrNotFound):
+					return fmt.Errorf("no sandbox named %q — `databricks sandbox list` shows available IDs", sandboxID)
+				default:
+					warn(ctx, fmt.Sprintf("Could not validate sandbox %s: %v", sandboxID, err))
+				}
+			}
+
+			// Drive start ourselves so the user sees a spinner instead
+			// of an opaque multi-minute hang inside ssh's connect path.
+			if sandboxStatus != "" && !strings.EqualFold(sandboxStatus, "running") {
+				final, err := ensureRunning(ctx, api, sandboxID, sandboxStatus)
+				if err != nil {
+					return err
+				}
+				if final.GatewayHost != "" {
+					sandboxGatewayHost = final.GatewayHost
+				}
+			}
+
+			// Resolution precedence: fresh API response → cached value
+			// for this profile. The server stamps the workspace's
+			// gateway on every Sandbox / SshKey response, so the cache
+			// is populated after the first call against the workspace
+			// (sandbox register / list / create / etc.).
+			host := sandboxGatewayHost
+			if host == "" {
+				host = getGatewayHost(ctx, profile)
+			}
+			if host == "" {
+				return errors.New("could not resolve the sandbox SSH gateway — run `databricks sandbox register` first")
+			}
+
+			// Persist whatever the server just told us, so the next invocation
+			// can short-circuit the explicit-id `get` above.
+			if sandboxGatewayHost != "" {
+				_ = setGatewayHost(ctx, profile, sandboxGatewayHost)
+			}
+
+			// No "Connecting…" spinner here. execSSHDirect replaces
+			// the CLI process via execv, so a deferred Close() would
+			// never run — and Bubble Tea hides the terminal cursor at
+			// init and only restores it on clean shutdown, leaving the
+			// cursor invisible for the entire ssh session and after it
+			// exits. The spinner couldn't animate during the handshake
+			// anyway (the CLI process is gone by then).
+			return execSSHDirect(sandboxID, host, gatewayPort, keyPath, extraArgs)
+		},
+	}
+
+	cmd.Flags().StringVar(&gatewayPort, "port", defaultGatewayPort, "Sandbox gateway SSH port")
+
+	return cmd
+}
+
+// verifyKeyRegistered confirms the local sandbox public key is still
+// registered with the workspace before we open the SSH socket. The
+// gateway itself already does this check during userauth, but the
+// SSH protocol's reply surface (USERAUTH_FAILURE has no free-form
+// reason; USERAUTH_BANNER is widely swallowed) flattens "unknown
+// key", "key registered but not authorized for this sandbox", and
+// "upstream service is down" into the same "Permission denied
+// (publickey)". This out-of-band HTTP check surfaces the specific
+// case in language the user can act on. listKeys errors fall
+// through with a warning so a transient API hiccup doesn't block a
+// connection the gateway could still route.
+func verifyKeyRegistered(ctx context.Context, api *sandboxAPI, keyPath string) error {
+	pub, err := os.ReadFile(keyPath + ".pub")
+	if err != nil {
+		return fmt.Errorf("reading public key %s.pub: %w", keyPath, err)
+	}
+	want := keyHash(string(pub))
+
+	keys, err := api.listKeys(ctx)
+	if err != nil {
+		warn(ctx, fmt.Sprintf("Could not verify SSH key registration: %v", err))
+		return nil
+	}
+	for _, k := range keys {
+		if k.KeyHash == want {
+			return nil
+		}
+	}
+	return fmt.Errorf("your sandbox SSH key (%s) is not registered with this workspace — run `databricks sandbox register` to re-register it", want)
+}
+
+// ensureRunning owns the lifecycle transition so SSH does not hang inside
+// connection setup. The caller must not have a spinner open.
+func ensureRunning(ctx context.Context, api *sandboxAPI, id, currentStatus string) (*sandboxEntry, error) {
+	if strings.EqualFold(currentStatus, "running") {
+		return &sandboxEntry{SandboxID: id, Status: currentStatus}, nil
+	}
+
+	s := spin(ctx, "Starting "+cmdio.Bold(ctx, id)+"…")
+	defer s.Close()
+
+	var sb *sandboxEntry
+	if strings.EqualFold(currentStatus, "stopping") {
+		stopped, err := waitForStopped(ctx, api, s, id)
+		if err != nil {
+			s.fail("Failed to start " + id)
+			return nil, err
+		}
+		currentStatus = stopped.Status
+		s.Update("Starting " + id + "…")
+	}
+
+	if strings.EqualFold(currentStatus, "stopped") {
+		updated, err := api.start(ctx, id)
+		if err != nil {
+			s.fail("Failed to start " + id)
+			return nil, fmt.Errorf("failed to start sandbox %s: %w", id, err)
+		}
+		sb = updated
+	}
+
+	if sb == nil || !strings.EqualFold(sb.Status, "running") {
+		final, err := waitForRunning(ctx, api, s, id)
+		if err != nil {
+			s.fail("Failed to start " + id)
+			return nil, err
+		}
+		sb = final
+	}
+
+	s.ok("Started " + cmdio.Bold(ctx, id))
+	return sb, nil
+}
+
+// execSSHDirect replaces the CLI process with ssh (or simulates that on
+// Windows via execv). All options are passed on the command line, so no
+// ~/.ssh/config entry is required.
+func execSSHDirect(sandboxID, host, port, keyPath string, extraArgs []string) error {
+	return execv.Execv(execv.Options{
+		Args: buildSSHArgs(sandboxID, host, port, keyPath, extraArgs),
+		Env:  os.Environ(),
+	})
+}
+
+// buildSSHArgs assembles the argv we hand to the `ssh` binary.
+//
+// `ssh` concatenates remote-command words with spaces and the remote
+// shell re-parses them. That makes the two natural user shapes
+// incompatible by default:
+//
+//   - Single arg that's already a complete shell command:
+//     `sandbox ssh <id> -- 'echo hi | head -3'`
+//     The user expects the remote shell to split and execute this
+//     string. ssh's "concat with spaces" is a no-op here, so we hand
+//     the arg through untouched.
+//
+//   - Multi-arg exec-style invocation:
+//     `sandbox ssh <id> -- bash -c 'echo hi'`
+//     Cobra splits this into `["bash", "-c", "echo hi"]`. ssh's join
+//     produces `bash -c echo hi` on the wire, which bash re-splits into
+//     `-c=echo` and `$0=hi` — losing the second word. We fix that by shell-quoting
+//     each arg before append, so the remote sees `bash -c 'echo hi'`.
+//
+// The heuristic: if there's exactly one extra arg, pass it untouched;
+// otherwise quote every arg. shellquote.BashArg leaves safe args alone,
+// so `ls -la /tmp` round-trips unchanged in the multi-arg path.
+func buildSSHArgs(sandboxID, host, port, keyPath string, extraArgs []string) []string {
+	args := []string{
+		"ssh",
+		"-i", keyPath,
+		"-p", port,
+		"-o", "IdentitiesOnly=yes",
+		"-o", "PreferredAuthentications=publickey",
+		"-o", "StrictHostKeyChecking=no",
+		"-o", "UserKnownHostsFile=/dev/null",
+		"-o", "LogLevel=ERROR",
+		fmt.Sprintf("%s@%s", sandboxID, host),
+	}
+	if len(extraArgs) == 1 {
+		return append(args, extraArgs[0])
+	}
+	for _, a := range extraArgs {
+		args = append(args, shellquote.BashArg(a))
+	}
+	return args
+}
diff --git a/cmd/sandbox/ssh_test.go b/cmd/sandbox/ssh_test.go
new file mode 100644
index 00000000000..31f53eee6b4
--- /dev/null
+++ b/cmd/sandbox/ssh_test.go
@@ -0,0 +1,215 @@
+package sandbox
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"sync/atomic"
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestEnsureRunningLifecycle(t *testing.T) {
+	type requestStep struct {
+		method string
+		path   string
+		status string
+	}
+
+	for _, tc := range []struct {
+		name          string
+		initialStatus string
+		steps         []requestStep
+		wantStatus    string
+		wantErr       string
+		wantStarts    int32
+	}{
+		{
+			name:          "stopping waits for stopped before starting",
+			initialStatus: "Stopping",
+			steps: []requestStep{
+				{method: http.MethodGet, path: sandboxPath("test-id"), status: "Stopped"},
+				{method: http.MethodPost, path: sandboxPath("test-id") + "/start", status: "Pending"},
+				{method: http.MethodGet, path: sandboxPath("test-id"), status: "Running"},
+			},
+			wantStatus: "Running",
+			wantStarts: 1,
+		},
+		{
+			name:          "stopped starts normally",
+			initialStatus: "Stopped",
+			steps: []requestStep{
+				{method: http.MethodPost, path: sandboxPath("test-id") + "/start", status: "Pending"},
+				{method: http.MethodGet, path: sandboxPath("test-id"), status: "Running"},
+			},
+			wantStatus: "Running",
+			wantStarts: 1,
+		},
+		{
+			name:          "running is a no-op",
+			initialStatus: "Running",
+			wantStatus:    "Running",
+		},
+		{
+			name:          "stopped after start remains an error",
+			initialStatus: "Stopped",
+			steps: []requestStep{
+				{method: http.MethodPost, path: sandboxPath("test-id") + "/start", status: "Pending"},
+				{method: http.MethodGet, path: sandboxPath("test-id"), status: "Stopped"},
+			},
+			wantErr:    `sandbox test-id reached unexpected state "Stopped" while starting`,
+			wantStarts: 1,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var requestCount atomic.Int32
+			var startCount atomic.Int32
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if r.URL.Path == "/.well-known/databricks-config" {
+					assert.NoError(t, json.NewEncoder(w).Encode(map[string]string{
+						"oidc_endpoint": "https://workspace.example.test/oidc",
+					}))
+					return
+				}
+
+				index := int(requestCount.Add(1) - 1)
+				if index >= len(tc.steps) {
+					t.Errorf("unexpected request %s %s", r.Method, r.URL.Path)
+					http.Error(w, "unexpected request", http.StatusInternalServerError)
+					return
+				}
+
+				step := tc.steps[index]
+				assert.Equal(t, step.method, r.Method)
+				assert.Equal(t, step.path, r.URL.Path)
+				if r.Method == http.MethodPost && r.URL.Path == sandboxPath("test-id")+"/start" {
+					startCount.Add(1)
+				}
+				assert.NoError(t, json.NewEncoder(w).Encode(sandboxEntry{
+					SandboxID: "test-id",
+					Status:    step.status,
+				}))
+			}))
+			t.Cleanup(server.Close)
+
+			workspaceClient, err := databricks.NewWorkspaceClient(&databricks.Config{
+				Host:  server.URL,
+				Token: "test-token",
+			})
+			require.NoError(t, err)
+			api, err := newSandboxAPI(workspaceClient)
+			require.NoError(t, err)
+
+			ctx := cmdio.MockDiscard(t.Context())
+			got, err := ensureRunning(ctx, api, "test-id", tc.initialStatus)
+			if tc.wantErr != "" {
+				require.EqualError(t, err, tc.wantErr)
+				assert.Nil(t, got)
+			} else {
+				require.NoError(t, err)
+				require.NotNil(t, got)
+				assert.Equal(t, tc.wantStatus, got.Status)
+			}
+			assert.Equal(t, int32(len(tc.steps)), requestCount.Load())
+			assert.Equal(t, tc.wantStarts, startCount.Load())
+		})
+	}
+}
+
+func TestBuildSSHArgsBaseFlags(t *testing.T) {
+	got := buildSSHArgs("happy-panda-1234", "gw.example.test", "2222", "/keys/id", nil)
+	// Sanity: the destination is the last arg when no extras.
+	assert.Equal(t, "happy-panda-1234@gw.example.test", got[len(got)-1])
+	// The base flag set is fixed; spot-check a couple.
+	assert.Contains(t, got, "-i")
+	assert.Contains(t, got, "/keys/id")
+	assert.Contains(t, got, "-p")
+	assert.Contains(t, got, "2222")
+}
+
+func TestBuildSSHArgsQuoting(t *testing.T) {
+	for _, tc := range []struct {
+		name      string
+		extraArgs []string
+		// expected is what we expect at the end of args, after the destination.
+		expected []string
+	}{
+		{
+			name:      "no extras",
+			extraArgs: nil,
+			expected:  nil,
+		},
+		{
+			name:      "single safe word — passed through",
+			extraArgs: []string{"uname"},
+			expected:  []string{"uname"},
+		},
+		{
+			name:      "single string with spaces — passed through so the remote shell can split it",
+			extraArgs: []string{"echo hello-from-string"},
+			expected:  []string{"echo hello-from-string"},
+		},
+		{
+			name:      "single string with a pipe — passed through to the remote shell",
+			extraArgs: []string{"cat /etc/os-release | head -3"},
+			expected:  []string{"cat /etc/os-release | head -3"},
+		},
+		{
+			name:      "multi safe words — no quoting",
+			extraArgs: []string{"ls", "-la", "/tmp"},
+			expected:  []string{"ls", "-la", "/tmp"},
+		},
+		{
+			name: "bash -c '<cmd>' — third arg gets quoted",
+			// The whole point: without the quoting, the remote shell
+			// re-splits "bash -c echo hi" and bash's -c eats just "echo".
+			extraArgs: []string{"bash", "-c", "echo hi"},
+			expected:  []string{"bash", "-c", "'echo hi'"},
+		},
+		{
+			name:      "arg with single quote — escaped, not lost",
+			extraArgs: []string{"echo", "it's fine"},
+			expected:  []string{"echo", `'it'\''s fine'`},
+		},
+		{
+			name:      "glob pattern — quoted so the remote (not the local) shell expands it",
+			extraArgs: []string{"find", ".", "-name", "*.txt"},
+			expected:  []string{"find", ".", "-name", "'*.txt'"},
+		},
+		{
+			name:      "ssh -o key=val style — gets quoted because of '='; harmless given current arg ordering",
+			extraArgs: []string{"-o", "StrictHostKeyChecking=no"},
+			expected:  []string{"-o", "'StrictHostKeyChecking=no'"},
+		},
+		{
+			name:      "empty arg gets explicit empty quotes (not lost)",
+			extraArgs: []string{"sh", "-c", ""},
+			expected:  []string{"sh", "-c", "''"},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			got := buildSSHArgs("id", "host", "2222", "/k", tc.extraArgs)
+			// Trim everything up to and including the destination so we
+			// can assert just on the appended extras.
+			dest := "id@host"
+			cut := -1
+			for i, a := range got {
+				if a == dest {
+					cut = i + 1
+					break
+				}
+			}
+			assert.GreaterOrEqual(t, cut, 0, "destination not found in args")
+			tail := got[cut:]
+			if tc.expected == nil {
+				assert.Empty(t, tail)
+			} else {
+				assert.Equal(t, tc.expected, tail)
+			}
+		})
+	}
+}
diff --git a/cmd/sandbox/sshconfig.go b/cmd/sandbox/sshconfig.go
new file mode 100644
index 00000000000..d4c54986aed
--- /dev/null
+++ b/cmd/sandbox/sshconfig.go
@@ -0,0 +1,226 @@
+package sandbox
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/databricks/cli/libs/atomicfile"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/env"
+)
+
+const (
+	// sshIncludeFileName is the sandbox-managed file referenced by the
+	// user's ~/.ssh/config. The file is fully owned: we rewrite it on
+	// every `sandbox register`, so manual edits to it will not survive.
+	sshIncludeFileName = "databricks-sandbox"
+
+	// sshConfigBeginMarker / sshConfigEndMarker bracket the single line we
+	// add to the user's ~/.ssh/config (the Include directive). Markers make
+	// the line greppable and removable without re-parsing the file.
+	sshConfigBeginMarker = "# >>> databricks sandbox >>>"
+	sshConfigEndMarker   = "# <<< databricks sandbox <<<"
+)
+
+// sshConfigPaths returns (managedFile, mainConfig) under the user's
+// ~/.ssh directory.
+func sshConfigPaths(ctx context.Context) (string, string, error) {
+	home, err := env.UserHomeDir(ctx)
+	if err != nil {
+		return "", "", err
+	}
+	sshDir := filepath.Join(home, ".ssh")
+	return filepath.Join(sshDir, sshIncludeFileName), filepath.Join(sshDir, "config"), nil
+}
+
+// sshConfigAlreadyManaged reports whether ~/.ssh/config already
+// contains the sandbox-managed Include block.
+func sshConfigAlreadyManaged(ctx context.Context) (bool, error) {
+	_, mainPath, err := sshConfigPaths(ctx)
+	if err != nil {
+		return false, err
+	}
+	data, err := os.ReadFile(mainPath)
+	if err != nil {
+		if errors.Is(err, fs.ErrNotExist) {
+			return false, nil
+		}
+		return false, fmt.Errorf("reading %s: %w", mainPath, err)
+	}
+	return hasOurMarkedBlock(string(data)), nil
+}
+
+// writeSSHConfig writes the sandbox-managed SSH config block to a
+// managed file and, if not already present, adds an Include directive
+// to the user's ~/.ssh/config pointing at that file.
+func writeSSHConfig(ctx context.Context, keyPath string, gatewayHosts []string, gatewayPort string) (string, string, error) {
+	home, err := env.UserHomeDir(ctx)
+	if err != nil {
+		return "", "", err
+	}
+	sshDir := filepath.Join(home, ".ssh")
+	if err := os.MkdirAll(sshDir, 0o700); err != nil {
+		return "", "", fmt.Errorf("creating %s: %w", sshDir, err)
+	}
+
+	managedPath := filepath.Join(sshDir, sshIncludeFileName)
+	mainPath := filepath.Join(sshDir, "config")
+
+	block := buildSSHConfigBlock(keyPath, gatewayHosts, gatewayPort)
+	if err := writeManagedConfig(managedPath, block); err != nil {
+		return managedPath, mainPath, err
+	}
+	if err := ensureMainIncludesManaged(mainPath, managedPath); err != nil {
+		return managedPath, mainPath, err
+	}
+	return managedPath, mainPath, nil
+}
+
+// buildSSHConfigBlock renders one Host stanza per gateway. Mirrors the
+// snippet the workspace UI's "First time setup?" disclosure recommends
+// — the Host key is the literal gateway hostname (so editor Remote-SSH
+// deep links like `ssh-remote+<id>@<gateway>` resolve directly), and
+// only the two directives that meaningfully differ from SSH defaults
+// are set:
+//
+//   - Port (the gateway listens on 2222, not 22)
+//   - IdentityFile + IdentitiesOnly (pin our key so ssh doesn't offer
+//     every key in ~/.ssh/ and trip the gateway's rejection cascade)
+//
+// Notably we do NOT set StrictHostKeyChecking, UserKnownHostsFile, or
+// LogLevel — those defaults work fine for IDE / raw-ssh use and
+// matching the user's expectations beats the cosmetic suppression the
+// CLI's own `sandbox ssh` does via argv. No User directive either —
+// the per-sandbox identifier travels in the destination
+// (`ssh <sandbox-id>@<gateway>`).
+//
+// One stanza per gateway means a user with profiles in multiple
+// regions doesn't lose IDE Remote-SSH for the earlier workspaces when
+// they `register` against a new one. Callers pass `gatewayHosts` from
+// state.allGatewayHosts.
+func buildSSHConfigBlock(keyPath string, gatewayHosts []string, gatewayPort string) string {
+	var b strings.Builder
+	b.WriteString("# Managed by `databricks sandbox register`. Manual edits will be overwritten.\n")
+	for _, gw := range gatewayHosts {
+		fmt.Fprintf(&b, "Host %s\n    Port %s\n    IdentityFile %s\n    IdentitiesOnly yes\n", gw, gatewayPort, keyPath)
+	}
+	return b.String()
+}
+
+// writeManagedConfig writes content to path atomically with 0600
+// perms. No-op when the file already matches, to avoid churning mtime.
+func writeManagedConfig(path, content string) error {
+	if existing, err := os.ReadFile(path); err == nil && bytes.Equal(existing, []byte(content)) {
+		return nil
+	}
+	return atomicfile.Write(path, []byte(content), 0o600)
+}
+
+// ensureMainIncludesManaged makes sure ~/.ssh/config begins with an
+// `Include <managedPath>` directive bracketed by our begin/end markers.
+// If our block is already present, the file is left alone; if absent,
+// we prepend the block so it takes precedence over any later Host
+// blocks the user has defined (SSH applies the first match per option).
+func ensureMainIncludesManaged(mainPath, managedPath string) error {
+	managedBlock := fmt.Sprintf("%s\nInclude %s\n%s\n", sshConfigBeginMarker, managedPath, sshConfigEndMarker)
+
+	existing, err := os.ReadFile(mainPath)
+	switch {
+	case err == nil:
+		if hasOurMarkedBlock(string(existing)) {
+			return nil
+		}
+	case errors.Is(err, fs.ErrNotExist):
+		existing = nil
+	default:
+		return fmt.Errorf("reading %s: %w", mainPath, err)
+	}
+
+	// Prepend so our Include wins SSH's first-match-per-option
+	// semantics over any wildcard `Host *` block later in the file.
+	var buf bytes.Buffer
+	buf.WriteString(managedBlock)
+	if len(existing) > 0 {
+		// Avoid double blank lines if the file already starts with one.
+		if !strings.HasPrefix(string(existing), "\n") {
+			buf.WriteString("\n")
+		}
+		buf.Write(existing)
+	}
+
+	return atomicfile.Write(mainPath, buf.Bytes(), 0o600)
+}
+
+// hasOurMarkedBlock reports whether the given config text already has
+// a sandbox-managed Include block (delimited by our markers).
+func hasOurMarkedBlock(text string) bool {
+	scanner := bufio.NewScanner(strings.NewReader(text))
+	for scanner.Scan() {
+		if strings.TrimSpace(scanner.Text()) == sshConfigBeginMarker {
+			return true
+		}
+	}
+	return false
+}
+
+// maybeWriteSSHConfig writes the sandbox-managed SSH config, prompting
+// for consent the first time on this machine. Re-runs silently refresh
+// the managed file. Non-interactive contexts skip the write entirely.
+//
+// Reads the gateway-host set from state (populated by every API call
+// that touches a Sandbox or SshKey response, including the register
+// call the caller just made), so users with multiple workspaces in
+// different regions accumulate one Host stanza per unique gateway
+// instead of losing the earlier ones.
+func maybeWriteSSHConfig(ctx context.Context, keyPath string) error {
+	gateways := allGatewayHosts(ctx)
+	if len(gateways) == 0 {
+		// No gateway has been cached yet — register's API call must
+		// not have stamped one, or state is empty. Skip rather than
+		// guess; the next API call that returns a Sandbox/SshKey
+		// will populate the cache and a future register will write.
+		cmdio.LogString(ctx, "  "+cmdio.Faint(ctx, "skipped SSH config update — no sandbox gateway is known yet"))
+		return nil
+	}
+
+	already, err := sshConfigAlreadyManaged(ctx)
+	if err != nil {
+		return err
+	}
+	if !already {
+		_, mainPath, err := sshConfigPaths(ctx)
+		if err != nil {
+			return err
+		}
+		if !cmdio.IsPromptSupported(ctx) {
+			cmdio.LogString(ctx, "  "+cmdio.Faint(ctx, "skipped SSH config update (non-interactive); re-run `databricks sandbox register` from a terminal to add the sandbox gateway block(s)"))
+			return nil
+		}
+		question := fmt.Sprintf(
+			"Add a sandbox `Host` block to %s? This lets editor Remote-SSH (VS Code / Cursor) and `ssh <id>@<gateway>` connect without further setup.",
+			mainPath,
+		)
+		confirmed, err := cmdio.AskYesOrNo(ctx, question)
+		if err != nil {
+			return err
+		}
+		if !confirmed {
+			cmdio.LogString(ctx, "  "+cmdio.Faint(ctx, "skipped SSH config update; re-run `databricks sandbox register` to revisit"))
+			return nil
+		}
+	}
+
+	managedPath, _, err := writeSSHConfig(ctx, keyPath, gateways, defaultGatewayPort)
+	if err != nil {
+		return err
+	}
+	ok(ctx, "Updated SSH config (managed: "+cmdio.Faint(ctx, managedPath)+")")
+	return nil
+}
diff --git a/cmd/sandbox/sshconfig_test.go b/cmd/sandbox/sshconfig_test.go
new file mode 100644
index 00000000000..66700ee0eaa
--- /dev/null
+++ b/cmd/sandbox/sshconfig_test.go
@@ -0,0 +1,209 @@
+package sandbox
+
+import (
+	"io"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/env"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestBuildSSHConfigBlockShape(t *testing.T) {
+	block := buildSSHConfigBlock("/home/u/.ssh/sandbox_ed25519", []string{"uw2.dbrx.dev"}, "2222")
+
+	// The Host key is the literal gateway hostname (so UI editor deep
+	// links like `ssh-remote+<id>@<gateway>` resolve directly), and we
+	// only set the two directives that meaningfully differ from SSH
+	// defaults: Port (the gateway is on 2222) and IdentityFile +
+	// IdentitiesOnly (pin our key, suppress the offer cascade).
+	assert.Contains(t, block, "# Managed by")
+	assert.Contains(t, block, "Host uw2.dbrx.dev\n")
+	assert.Contains(t, block, "Port 2222")
+	assert.Contains(t, block, "IdentityFile /home/u/.ssh/sandbox_ed25519")
+	assert.Contains(t, block, "IdentitiesOnly yes")
+
+	// No HostName — Host already IS the real host, so HostName would
+	// be a redundant self-reference.
+	assert.NotContains(t, block, "HostName ", "HostName must not be set when Host already equals the hostname")
+
+	// No User directive — the sandbox id travels in the destination
+	// (`ssh <id>@<gateway>`).
+	assert.NotContains(t, block, "\n    User ", "User directive must not be set")
+
+	// Per the design (mirrors the workspace UI's "First time setup?"
+	// snippet), we deliberately do NOT set StrictHostKeyChecking,
+	// UserKnownHostsFile, or LogLevel — IDE Remote-SSH should behave
+	// like a normal `ssh <host>` invocation (TOFU host keys, default
+	// log level).
+	for _, forbidden := range []string{
+		"StrictHostKeyChecking",
+		"UserKnownHostsFile",
+		"LogLevel",
+	} {
+		assert.NotContains(t, block, forbidden, "must not set %q — SSH defaults are correct", forbidden)
+	}
+}
+
+// Two registered workspaces in different regions must each get their
+// own Host stanza so editor Remote-SSH for one doesn't silently break
+// when the user registers against the other.
+func TestBuildSSHConfigBlockMultipleGateways(t *testing.T) {
+	block := buildSSHConfigBlock(
+		"/home/u/.ssh/sandbox_ed25519",
+		[]string{"uw2.dbrx.dev", "ue1.dbrx.dev"},
+		"2222",
+	)
+	assert.Contains(t, block, "Host uw2.dbrx.dev\n")
+	assert.Contains(t, block, "Host ue1.dbrx.dev\n")
+	// Each Host should be followed by Port + IdentityFile, so a naive
+	// "Port 2222" count is a quick sanity check on per-gateway repetition.
+	assert.Equal(t, 2, strings.Count(block, "Port 2222"))
+	assert.Equal(t, 2, strings.Count(block, "IdentityFile /home/u/.ssh/sandbox_ed25519"))
+}
+
+func TestWriteManagedConfigCreatesWithRightPerms(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, sshIncludeFileName)
+	require.NoError(t, writeManagedConfig(path, "Host foo\n    HostName bar\n"))
+
+	info, err := os.Stat(path)
+	require.NoError(t, err)
+
+	// Windows does not honor Unix permission bits; os.Stat reports 0o666
+	// regardless of what was passed to os.WriteFile (matches the carve-out
+	// in state_test.go).
+	if runtime.GOOS != "windows" {
+		assert.Equal(t, os.FileMode(0o600), info.Mode().Perm(), "SSH config files must be 0600")
+	}
+}
+
+func TestWriteManagedConfigIdempotentDoesNotRewriteFile(t *testing.T) {
+	// A no-op re-write must not bump the file's mtime — otherwise
+	// `sandbox register` looks like it's churning files on every call.
+	dir := t.TempDir()
+	path := filepath.Join(dir, sshIncludeFileName)
+	content := "Host foo\n    HostName bar\n"
+	require.NoError(t, writeManagedConfig(path, content))
+	before, err := os.Stat(path)
+	require.NoError(t, err)
+
+	require.NoError(t, writeManagedConfig(path, content))
+	after, err := os.Stat(path)
+	require.NoError(t, err)
+	assert.Equal(t, before.ModTime(), after.ModTime(), "matching content must short-circuit before rename")
+}
+
+func TestWriteManagedConfigReplacesDifferentContent(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, sshIncludeFileName)
+	require.NoError(t, writeManagedConfig(path, "v1\n"))
+	require.NoError(t, writeManagedConfig(path, "v2\n"))
+	data, err := os.ReadFile(path)
+	require.NoError(t, err)
+	assert.Equal(t, "v2\n", string(data))
+}
+
+func TestEnsureMainIncludesManagedCreatesFileFromScratch(t *testing.T) {
+	dir := t.TempDir()
+	mainPath := filepath.Join(dir, "config")
+	managedPath := filepath.Join(dir, sshIncludeFileName)
+
+	require.NoError(t, ensureMainIncludesManaged(mainPath, managedPath))
+
+	data, err := os.ReadFile(mainPath)
+	require.NoError(t, err)
+	text := string(data)
+	assert.Contains(t, text, sshConfigBeginMarker)
+	assert.Contains(t, text, "Include "+managedPath)
+	assert.Contains(t, text, sshConfigEndMarker)
+}
+
+func TestEnsureMainIncludesManagedIsIdempotent(t *testing.T) {
+	// Second call must be a no-op — the existing block is detected by
+	// marker presence and we leave the file alone.
+	dir := t.TempDir()
+	mainPath := filepath.Join(dir, "config")
+	managedPath := filepath.Join(dir, sshIncludeFileName)
+	require.NoError(t, ensureMainIncludesManaged(mainPath, managedPath))
+	first, err := os.ReadFile(mainPath)
+	require.NoError(t, err)
+
+	require.NoError(t, ensureMainIncludesManaged(mainPath, managedPath))
+	second, err := os.ReadFile(mainPath)
+	require.NoError(t, err)
+	assert.Equal(t, string(first), string(second))
+}
+
+func TestEnsureMainIncludesManagedPreservesUserConfigBelow(t *testing.T) {
+	// Existing user config must survive verbatim, and our block must
+	// land *above* it so SSH's first-match-wins behaviour picks our
+	// values for the alias.
+	dir := t.TempDir()
+	mainPath := filepath.Join(dir, "config")
+	managedPath := filepath.Join(dir, sshIncludeFileName)
+	userContent := "Host myserver\n    HostName example.test\n    User alice\n"
+	require.NoError(t, os.WriteFile(mainPath, []byte(userContent), 0o600))
+
+	require.NoError(t, ensureMainIncludesManaged(mainPath, managedPath))
+	data, err := os.ReadFile(mainPath)
+	require.NoError(t, err)
+	text := string(data)
+	assert.Contains(t, text, userContent, "user's existing config must be preserved")
+
+	beginIdx := strings.Index(text, sshConfigBeginMarker)
+	userIdx := strings.Index(text, "Host myserver")
+	require.GreaterOrEqual(t, beginIdx, 0)
+	require.GreaterOrEqual(t, userIdx, 0)
+	assert.Less(t, beginIdx, userIdx, "managed block must precede the user's existing config")
+}
+
+// When state has no cached gateway hosts (no register has populated
+// the cache, or sandbox.json is missing), maybeWriteSSHConfig must
+// short-circuit before any disk I/O so it can't accidentally write a
+// malformed `Host \n` stanza. Also pins the no-disk-touch guarantee
+// against a future refactor that might `os.MkdirAll` before the check.
+func TestMaybeWriteSSHConfigSkipsWhenNoGatewaysCached(t *testing.T) {
+	home := t.TempDir()
+	ctx := env.WithUserHomeDir(t.Context(), home)
+	ctx = cmdio.InContext(ctx, cmdio.NewIO(ctx, flags.OutputText,
+		io.NopCloser(strings.NewReader("")), io.Discard, io.Discard, "", ""))
+
+	require.NoError(t, maybeWriteSSHConfig(ctx, filepath.Join(home, ".ssh", "sandbox_ed25519")))
+
+	// No managed file should have been created.
+	_, err := os.Stat(filepath.Join(home, ".ssh", sshIncludeFileName))
+	assert.ErrorIs(t, err, fs.ErrNotExist, "managed include file must not be created when no gateways are cached")
+
+	// And ~/.ssh/config must not have been touched either.
+	_, err = os.Stat(filepath.Join(home, ".ssh", "config"))
+	assert.ErrorIs(t, err, fs.ErrNotExist, "main ssh config must not be created when no gateways are cached")
+}
+
+func TestHasOurMarkedBlock(t *testing.T) {
+	cases := []struct {
+		name  string
+		input string
+		want  bool
+	}{
+		{"empty", "", false},
+		{"only user content", "Host foo\n    HostName bar\n", false},
+		{"with our marker", sshConfigBeginMarker + "\nInclude /tmp/x\n" + sshConfigEndMarker + "\n", true},
+		{"marker with surrounding whitespace", "   " + sshConfigBeginMarker + "   \n", true},
+		// A user could conceivably write a comment containing the
+		// literal marker text — accepted; it's their own footgun.
+		{"marker mid-line (rejected)", "## " + sshConfigBeginMarker + " inline\n", false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, hasOurMarkedBlock(tc.input))
+		})
+	}
+}
diff --git a/cmd/sandbox/sshkey.go b/cmd/sandbox/sshkey.go
new file mode 100644
index 00000000000..efc74367c21
--- /dev/null
+++ b/cmd/sandbox/sshkey.go
@@ -0,0 +1,190 @@
+package sandbox
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/spf13/cobra"
+)
+
+func newSSHKeyCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "ssh-key",
+		Short: "Manage SSH keys registered with the sandbox service",
+	}
+	cmd.AddCommand(newSSHKeyListCommand())
+	cmd.AddCommand(newSSHKeyDeleteCommand())
+	return cmd
+}
+
+func newSSHKeyDeleteCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "delete <key-hash>",
+		Short: "Delete an SSH key registered with the sandbox service",
+		Long: `Delete an SSH key registered with the sandbox service.
+
+The key hash is the identifier shown by 'databricks sandbox ssh-key list'.
+Once deleted, future SSH attempts authenticated by the corresponding
+private key will fail until the key is re-registered.
+
+Example:
+  databricks sandbox ssh-key delete a1b2c3d4e5f6...`,
+		Args:              cobra.ExactArgs(1),
+		PreRunE:           root.MustWorkspaceClient,
+		ValidArgsFunction: completeSSHKeyHashes,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			ctx := cmd.Context()
+			w := cmdctx.WorkspaceClient(ctx)
+			api, err := newSandboxAPI(w)
+			if err != nil {
+				return err
+			}
+
+			hash := args[0]
+			s := spin(ctx, "Deleting key "+hash+"…")
+			defer s.Close()
+			if err := api.deleteKey(ctx, hash); err != nil {
+				s.fail("Failed to delete key")
+				return fmt.Errorf("failed to delete ssh key %s: %w", hash, err)
+			}
+			s.ok("SSH key " + cmdio.Bold(ctx, hash) + " deleted")
+			return nil
+		},
+	}
+	return cmd
+}
+
+func newSSHKeyListCommand() *cobra.Command {
+	var outputJSON bool
+
+	cmd := &cobra.Command{
+		Use:   "list",
+		Short: "List SSH keys registered with the sandbox service",
+		Long: `List SSH keys registered with the sandbox service.
+
+Each row shows the server-assigned key hash (the identifier used to
+delete the key), the user-supplied name, and create / last-use
+timestamps. The locally-registered key (from 'databricks sandbox
+register') is marked when its hash matches one of the listed entries.
+
+Examples:
+  databricks sandbox ssh-key list
+  databricks sandbox ssh-key list --json`,
+		PreRunE: root.MustWorkspaceClient,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			ctx := cmd.Context()
+			w := cmdctx.WorkspaceClient(ctx)
+			api, err := newSandboxAPI(w)
+			if err != nil {
+				return err
+			}
+
+			keys, err := api.listKeys(ctx)
+			if err != nil {
+				return fmt.Errorf("failed to list ssh keys: %w", err)
+			}
+
+			if jsonOutput(cmd, outputJSON) {
+				enc := json.NewEncoder(cmd.OutOrStdout())
+				enc.SetIndent("", "  ")
+				return enc.Encode(keys)
+			}
+
+			if len(keys) == 0 {
+				fmt.Fprintf(cmd.ErrOrStderr(), "  %s\n",
+					cmdio.Faint(ctx, "No SSH keys registered. Run 'databricks sandbox register' to add one."))
+				return nil
+			}
+
+			// Best-effort: compute the hash of the locally-registered key so
+			// we can highlight which row belongs to this machine. Missing key
+			// file or read errors are non-fatal — just skip the marker.
+			localHash := ""
+			if path, err := sandboxKeyPath(ctx); err == nil {
+				if data, err := os.ReadFile(path + ".pub"); err == nil {
+					localHash = keyHash(string(data))
+				}
+			}
+
+			out := cmd.OutOrStdout()
+			blank(out)
+
+			// Measure in terminal cells (cmdio.Width) so wide / emoji
+			// glyphs in `--name` don't misalign the row.
+			nameCol := 4
+			for _, k := range keys {
+				if l := cmdio.Width(k.Name); l > nameCol {
+					nameCol = l
+				}
+			}
+			nameCol += 2
+			const hashCol = 32
+			const timeCol = 20
+
+			// 4-char gutter holds a per-row `*` for the local key (blank in header).
+			header := fmt.Sprintf("%-*s  %-*s  %-*s  %s",
+				nameCol, "NAME", hashCol, "KEY HASH", timeCol, "CREATED", "LAST USED")
+			fmt.Fprintf(out, "    %s\n", cmdio.Faint(ctx, header))
+			fmt.Fprintf(out, "    %s\n", cmdio.Faint(ctx, strings.Repeat("─", nameCol+hashCol+timeCol+timeCol+6)))
+
+			localFound := false
+			for _, k := range keys {
+				// cmdio.PadRight measures visible width, so the ANSI escapes
+				// cmdio.Faint wraps the NAME cell in don't break alignment.
+				displayName := k.Name
+				if displayName == "" {
+					displayName = cmdio.Faint(ctx, "(unset)")
+				}
+				gutter := "    "
+				if localHash != "" && k.KeyHash == localHash {
+					gutter = "  " + cmdio.Cyan(ctx, "*") + " "
+					localFound = true
+				}
+				fmt.Fprintf(out, "%s%s  %-*s  %-*s  %s\n",
+					gutter,
+					cmdio.PadRight(displayName, nameCol),
+					hashCol, k.KeyHash,
+					timeCol, formatTimeShort(k.CreateTime),
+					formatTimeShort(k.LastUseTime))
+			}
+			// Without a legend the `*` (or its absence) is opaque. Print the
+			// meaning either way so users can tell "no `*` on any row" apart
+			// from "this terminal doesn't print the marker".
+			blank(out)
+			switch {
+			case localFound:
+				fmt.Fprintf(out, "  %s\n", cmdio.Faint(ctx, cmdio.Cyan(ctx, "*")+" key matches the one on this machine"))
+			case localHash != "":
+				fmt.Fprintf(out, "  %s\n", cmdio.Faint(ctx, "(no registered key matches this machine's local key — run `databricks sandbox register` to register it)"))
+			default:
+				fmt.Fprintf(out, "  %s\n", cmdio.Faint(ctx, "(no local sandbox key on this machine — run `databricks sandbox register` to create and register one)"))
+			}
+			blank(out)
+			return nil
+		},
+	}
+
+	cmd.Flags().BoolVar(&outputJSON, "json", false, "Output as JSON")
+	return cmd
+}
+
+// formatTimeShort renders an RFC 3339 timestamp as a short, compact date
+// for table display. Returns "-" for empty input; passes through the raw
+// value if it doesn't parse (so server-side schema changes don't silently
+// hide data).
+func formatTimeShort(rfc3339 string) string {
+	if rfc3339 == "" {
+		return "-"
+	}
+	t, err := time.Parse(time.RFC3339, rfc3339)
+	if err != nil {
+		return rfc3339
+	}
+	return t.Format("2006-01-02 15:04")
+}
diff --git a/cmd/sandbox/start.go b/cmd/sandbox/start.go
new file mode 100644
index 00000000000..ba48a42efd9
--- /dev/null
+++ b/cmd/sandbox/start.go
@@ -0,0 +1,135 @@
+package sandbox
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/spf13/cobra"
+)
+
+// Bounds for `start`'s "wait until Running" poll. StartSandbox returns
+// immediately with status="Creating", so we poll until it actually
+// reaches Running. 10 min covers the observed cold-start range
+// (5–13 min); stuck sandboxes surface as a timeout, not a hang.
+const (
+	startPollInterval = 2 * time.Second
+	startWaitTimeout  = 10 * time.Minute
+)
+
+func newStartCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "start <sandbox-id>",
+		Short: "Start a stopped Sandbox environment",
+		Long: `Start a stopped Sandbox environment.
+
+Boots the backing microVM and blocks until the sandbox reaches
+Running (or up to 10 minutes). 'databricks sandbox ssh' already
+auto-starts a stopped sandbox on connection, so this command is
+mostly useful for pre-warming an environment without immediately
+connecting, or when a script needs to be sure the sandbox is up
+before continuing.
+
+Starting an already-running sandbox is a no-op.
+
+Example:
+  databricks sandbox start happy-panda-1234`,
+		Args:              cobra.ExactArgs(1),
+		PreRunE:           root.MustWorkspaceClient,
+		ValidArgsFunction: completeSandboxIDs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			ctx := cmd.Context()
+			w := cmdctx.WorkspaceClient(ctx)
+			api, err := newSandboxAPI(w)
+			if err != nil {
+				return err
+			}
+
+			profile := w.Config.Profile
+			if profile == "" {
+				profile = w.Config.Host
+			}
+
+			sandboxID, err := resolveLocalID(ctx, profile, args[0])
+			if err != nil {
+				return err
+			}
+
+			s := spin(ctx, "Starting "+sandboxID+"…")
+			defer s.Close()
+
+			updated, err := api.start(ctx, sandboxID)
+			if err != nil {
+				s.fail("Failed to start " + sandboxID)
+				return fmt.Errorf("failed to start sandbox %s: %w", sandboxID, err)
+			}
+
+			_ = setGatewayHost(ctx, profile, updated.GatewayHost)
+			_ = upsertSandbox(ctx, profile, updated.SandboxID, updated.Name)
+
+			// Already up — short-circuit so we don't pretend to wait
+			// when there's nothing to wait for.
+			if strings.EqualFold(updated.Status, "running") {
+				s.ok("Already running " + cmdio.Bold(ctx, updated.SandboxID))
+				return nil
+			}
+
+			final, err := waitForRunning(ctx, api, s, updated.SandboxID)
+			if err != nil {
+				s.fail("Failed to start " + sandboxID)
+				return err
+			}
+			_ = upsertSandbox(ctx, profile, final.SandboxID, final.Name)
+
+			s.ok("Started " + cmdio.Bold(ctx, final.SandboxID))
+			return nil
+		},
+	}
+
+	return cmd
+}
+
+func waitForRunning(ctx context.Context, api *sandboxAPI, s *spinner, id string) (*sandboxEntry, error) {
+	return waitForState(ctx, api, s, id, "Running", "Starting", "Stopped", "Terminated", "Failed")
+}
+
+// The API rejects start requests until teardown finishes, so STOPPING needs
+// its own polling phase.
+func waitForStopped(ctx context.Context, api *sandboxAPI, s *spinner, id string) (*sandboxEntry, error) {
+	return waitForState(ctx, api, s, id, "Stopped", "Stopping", "Terminated", "Failed")
+}
+
+// Centralizing lifecycle polling keeps timeout, cancellation, and terminal
+// state handling consistent across start and SSH.
+func waitForState(ctx context.Context, api *sandboxAPI, s *spinner, id, targetStatus, operation string, unexpectedStatuses ...string) (*sandboxEntry, error) {
+	start := time.Now()
+	deadline := start.Add(startWaitTimeout)
+	for {
+		sb, err := api.get(ctx, id)
+		if err != nil {
+			return nil, fmt.Errorf("polling status of %s: %w", id, err)
+		}
+		if strings.EqualFold(sb.Status, targetStatus) {
+			return sb, nil
+		}
+		for _, unexpectedStatus := range unexpectedStatuses {
+			if strings.EqualFold(sb.Status, unexpectedStatus) {
+				return nil, fmt.Errorf("sandbox %s reached unexpected state %q while %s", id, sb.Status, strings.ToLower(operation))
+			}
+		}
+		elapsed := time.Since(start).Round(time.Second)
+		s.Update(fmt.Sprintf("%s %s… (%s)", operation, id, elapsed))
+		if time.Now().After(deadline) {
+			return nil, fmt.Errorf("sandbox %s did not reach %s within %s (last seen %s)", id, targetStatus, startWaitTimeout, sb.Status)
+		}
+		select {
+		case <-ctx.Done():
+			return nil, ctx.Err()
+		case <-time.After(startPollInterval):
+		}
+	}
+}
diff --git a/cmd/sandbox/state.go b/cmd/sandbox/state.go
new file mode 100644
index 00000000000..64294c17824
--- /dev/null
+++ b/cmd/sandbox/state.go
@@ -0,0 +1,292 @@
+package sandbox
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"slices"
+
+	"github.com/databricks/cli/libs/atomicfile"
+	"github.com/databricks/cli/libs/env"
+)
+
+// stateFile stores per-profile sandbox state on the local filesystem.
+// Located at ~/.databricks/sandbox.json.
+type stateFile struct {
+	// Profile name → default sandbox ID.
+	Defaults map[string]string `json:"defaults"`
+	// Profile name → SSH gateway hostname returned by the manager for any
+	// sandbox in that workspace. Cached so `ssh <id>` does not need to fetch
+	// the sandbox just to learn where to connect. Empty until the first
+	// command that reads a sandbox response populates it.
+	GatewayHosts map[string]string `json:"gatewayHosts,omitempty"`
+	// Profile name → cached (id, name) pairs, used purely for local
+	// name-based resolution (`sandbox ssh my-project` finds the matching
+	// sandbox ID without an extra API call). Refreshed in full by
+	// `sandbox list`; mutated in-place by `create`, `config --name`,
+	// `delete`, and `status`. Cache misses fall through to treating the
+	// argument as an ID, so this never *blocks* an operation — it only
+	// adds the name-to-ID shortcut.
+	Sandboxes map[string][]cachedSandbox `json:"sandboxes,omitempty"`
+}
+
+// cachedSandbox is the minimal (id, name) pair we need to resolve a
+// user-typed name to a wire ID without calling the server.
+type cachedSandbox struct {
+	ID   string `json:"id"`
+	Name string `json:"name,omitempty"`
+}
+
+// stateFilePath returns the on-disk location of the sandbox state file.
+func stateFilePath(ctx context.Context) (string, error) {
+	home, err := env.UserHomeDir(ctx)
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(home, ".databricks", "sandbox.json"), nil
+}
+
+// loadState reads the sandbox state file, returning an empty state when
+// the file doesn't exist yet.
+func loadState(ctx context.Context) (*stateFile, error) {
+	path, err := stateFilePath(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	data, err := os.ReadFile(path)
+	if errors.Is(err, fs.ErrNotExist) {
+		return &stateFile{Defaults: make(map[string]string)}, nil
+	}
+	if err != nil {
+		return nil, fmt.Errorf("failed to read %s: %w", path, err)
+	}
+
+	var state stateFile
+	if err := json.Unmarshal(data, &state); err != nil {
+		return nil, fmt.Errorf("failed to parse %s: %w", path, err)
+	}
+	if state.Defaults == nil {
+		state.Defaults = make(map[string]string)
+	}
+	return &state, nil
+}
+
+// saveState writes the sandbox state file atomically via tmp + rename
+// so a concurrent reader (e.g. another CLI invocation racing this one)
+// never sees a half-written file. os.WriteFile is open-truncate-write,
+// which would expose readers to partial content; the acceptance suite
+// has the workaround documented in script.prepare, but production code
+// needs the real atomic write.
+func saveState(ctx context.Context, state *stateFile) error {
+	path, err := stateFilePath(ctx)
+	if err != nil {
+		return err
+	}
+
+	data, err := json.MarshalIndent(state, "", "  ")
+	if err != nil {
+		return err
+	}
+
+	return atomicfile.Write(path, data, 0o600, atomicfile.MkDir(0o700))
+}
+
+func getDefault(ctx context.Context, profile string) string {
+	state, err := loadState(ctx)
+	if err != nil {
+		return ""
+	}
+	return state.Defaults[profile]
+}
+
+func setDefault(ctx context.Context, profile, sandboxID string) error {
+	state, err := loadState(ctx)
+	if err != nil {
+		return err
+	}
+	if state.Defaults[profile] == sandboxID {
+		return nil
+	}
+	state.Defaults[profile] = sandboxID
+	return saveState(ctx, state)
+}
+
+func clearDefault(ctx context.Context, profile string) error {
+	state, err := loadState(ctx)
+	if err != nil {
+		return err
+	}
+	if _, ok := state.Defaults[profile]; !ok {
+		return nil
+	}
+	delete(state.Defaults, profile)
+	return saveState(ctx, state)
+}
+
+// getGatewayHost returns the cached SSH gateway hostname for the workspace
+// behind `profile`, or "" if nothing has been cached yet.
+func getGatewayHost(ctx context.Context, profile string) string {
+	state, err := loadState(ctx)
+	if err != nil {
+		return ""
+	}
+	return state.GatewayHosts[profile]
+}
+
+// allGatewayHosts returns the deduplicated set of gateway hosts cached
+// across every profile, sorted for deterministic output. Used by the
+// SSH-config writer to emit one Host stanza per unique gateway so a
+// user with multiple workspaces in different regions doesn't lose
+// IDE Remote-SSH config for the earlier-registered ones when they
+// register against a new workspace.
+func allGatewayHosts(ctx context.Context) []string {
+	state, err := loadState(ctx)
+	if err != nil {
+		return nil
+	}
+	seen := make(map[string]struct{}, len(state.GatewayHosts))
+	for _, h := range state.GatewayHosts {
+		if h != "" {
+			seen[h] = struct{}{}
+		}
+	}
+	out := make([]string, 0, len(seen))
+	for h := range seen {
+		out = append(out, h)
+	}
+	slices.Sort(out)
+	return out
+}
+
+// setGatewayHost caches the SSH gateway hostname for `profile`. No-op when
+// `host` is empty or already equal to the cached value, so callers can pipe
+// every Sandbox response through here without churning the state file.
+func setGatewayHost(ctx context.Context, profile, host string) error {
+	if host == "" {
+		return nil
+	}
+	state, err := loadState(ctx)
+	if err != nil {
+		return err
+	}
+	if state.GatewayHosts[profile] == host {
+		return nil
+	}
+	if state.GatewayHosts == nil {
+		state.GatewayHosts = make(map[string]string)
+	}
+	state.GatewayHosts[profile] = host
+	return saveState(ctx, state)
+}
+
+// getSandboxes returns the locally-cached (id, name) pairs for `profile`,
+// or nil if nothing has been cached yet.
+func getSandboxes(ctx context.Context, profile string) []cachedSandbox {
+	state, err := loadState(ctx)
+	if err != nil {
+		return nil
+	}
+	return state.Sandboxes[profile]
+}
+
+// setSandboxes replaces the cached sandbox list for `profile`. Used by
+// `sandbox list` to keep the cache in sync with the server's view.
+// No-op when the new list is byte-for-byte identical to the cached one,
+// to avoid rewriting the state file on every `list` call.
+func setSandboxes(ctx context.Context, profile string, sbs []cachedSandbox) error {
+	state, err := loadState(ctx)
+	if err != nil {
+		return err
+	}
+	if sandboxesEqual(state.Sandboxes[profile], sbs) {
+		return nil
+	}
+	if state.Sandboxes == nil {
+		state.Sandboxes = make(map[string][]cachedSandbox)
+	}
+	if sbs == nil {
+		sbs = []cachedSandbox{}
+	}
+	state.Sandboxes[profile] = sbs
+	return saveState(ctx, state)
+}
+
+// upsertSandbox adds or updates a single cached (id, name) entry for
+// `profile`. Use this when a single command observes one sandbox's
+// state (create, status, config), so the cache stays warm without
+// requiring a full `list`.
+func upsertSandbox(ctx context.Context, profile, id, name string) error {
+	if id == "" {
+		return nil
+	}
+	state, err := loadState(ctx)
+	if err != nil {
+		return err
+	}
+	existing := state.Sandboxes[profile]
+	for i, s := range existing {
+		if s.ID == id {
+			if s.Name == name {
+				return nil // no change
+			}
+			existing[i].Name = name
+			if state.Sandboxes == nil {
+				state.Sandboxes = make(map[string][]cachedSandbox)
+			}
+			state.Sandboxes[profile] = existing
+			return saveState(ctx, state)
+		}
+	}
+	if state.Sandboxes == nil {
+		state.Sandboxes = make(map[string][]cachedSandbox)
+	}
+	state.Sandboxes[profile] = append(existing, cachedSandbox{ID: id, Name: name})
+	return saveState(ctx, state)
+}
+
+// removeSandbox drops a single cached entry for `profile`. Called from
+// `delete` so the cache doesn't keep referencing sandboxes that no
+// longer exist server-side.
+//
+// When the removal empties the sandbox list for a profile, also drop
+// the profile's `GatewayHosts` entry — there is nothing for the
+// gateway hostname to apply to until the user creates a new sandbox,
+// and leaving the entry behind accumulates orphan state across the
+// lifecycle of a profile.
+func removeSandbox(ctx context.Context, profile, id string) error {
+	state, err := loadState(ctx)
+	if err != nil {
+		return err
+	}
+	existing := state.Sandboxes[profile]
+	for i, s := range existing {
+		if s.ID == id {
+			state.Sandboxes[profile] = append(existing[:i], existing[i+1:]...)
+			if len(state.Sandboxes[profile]) == 0 {
+				delete(state.Sandboxes, profile)
+				delete(state.GatewayHosts, profile)
+			}
+			return saveState(ctx, state)
+		}
+	}
+	return nil
+}
+
+// sandboxesEqual reports whether two slices contain the same entries in
+// the same order. Used by setSandboxes to short-circuit no-op writes.
+func sandboxesEqual(a, b []cachedSandbox) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for i := range a {
+		if a[i] != b[i] {
+			return false
+		}
+	}
+	return true
+}
diff --git a/cmd/sandbox/state_test.go b/cmd/sandbox/state_test.go
new file mode 100644
index 00000000000..e57b9ced388
--- /dev/null
+++ b/cmd/sandbox/state_test.go
@@ -0,0 +1,171 @@
+package sandbox
+
+import (
+	"context"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"runtime"
+	"testing"
+
+	"github.com/databricks/cli/libs/env"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// stateCtx returns a context whose $HOME is a temp directory, so state file
+// operations are isolated from the developer's real ~/.databricks/sandbox.json.
+func stateCtx(t *testing.T) (context.Context, string) {
+	t.Helper()
+	home := t.TempDir()
+	ctx := env.WithUserHomeDir(t.Context(), home)
+	return ctx, filepath.Join(home, ".databricks", "sandbox.json")
+}
+
+func TestStateLoadMissingFileReturnsEmpty(t *testing.T) {
+	ctx, _ := stateCtx(t)
+	state, err := loadState(ctx)
+	require.NoError(t, err)
+	assert.Equal(t, &stateFile{Defaults: map[string]string{}}, state)
+}
+
+func TestStateGetDefaultMissingProfileReturnsEmpty(t *testing.T) {
+	ctx, _ := stateCtx(t)
+	assert.Empty(t, getDefault(ctx, "any-profile"))
+}
+
+func TestStateSetGetDefaultRoundTrip(t *testing.T) {
+	ctx, _ := stateCtx(t)
+
+	require.NoError(t, setDefault(ctx, "profile-a", "sandbox-a"))
+	assert.Equal(t, "sandbox-a", getDefault(ctx, "profile-a"))
+	assert.Empty(t, getDefault(ctx, "profile-b"))
+}
+
+func TestStateMultipleProfilesIndependent(t *testing.T) {
+	ctx, _ := stateCtx(t)
+
+	require.NoError(t, setDefault(ctx, "profile-a", "sandbox-a"))
+	require.NoError(t, setDefault(ctx, "profile-b", "sandbox-b"))
+
+	assert.Equal(t, "sandbox-a", getDefault(ctx, "profile-a"))
+	assert.Equal(t, "sandbox-b", getDefault(ctx, "profile-b"))
+}
+
+func TestStateSetDefaultOverwrites(t *testing.T) {
+	ctx, _ := stateCtx(t)
+
+	require.NoError(t, setDefault(ctx, "profile-a", "sandbox-a"))
+	require.NoError(t, setDefault(ctx, "profile-a", "sandbox-a-prime"))
+	assert.Equal(t, "sandbox-a-prime", getDefault(ctx, "profile-a"))
+}
+
+func TestStateClearDefault(t *testing.T) {
+	ctx, _ := stateCtx(t)
+
+	require.NoError(t, setDefault(ctx, "profile-a", "sandbox-a"))
+	require.NoError(t, setDefault(ctx, "profile-b", "sandbox-b"))
+
+	require.NoError(t, clearDefault(ctx, "profile-a"))
+	assert.Empty(t, getDefault(ctx, "profile-a"))
+	assert.Equal(t, "sandbox-b", getDefault(ctx, "profile-b"))
+}
+
+func TestStateClearDefaultMissingProfileDoesNotCreateFile(t *testing.T) {
+	ctx, path := stateCtx(t)
+
+	require.NoError(t, clearDefault(ctx, "no-such-profile"))
+
+	_, err := os.Stat(path)
+	assert.ErrorIs(t, err, fs.ErrNotExist, "clearDefault must not create the state file when there's nothing to remove")
+}
+
+func TestStateSetDefaultSameValueDoesNotRewriteFile(t *testing.T) {
+	ctx, path := stateCtx(t)
+
+	require.NoError(t, setDefault(ctx, "profile-a", "sandbox-a"))
+	before, err := os.Stat(path)
+	require.NoError(t, err)
+
+	// Re-set with the same value should be a no-op.
+	require.NoError(t, setDefault(ctx, "profile-a", "sandbox-a"))
+	after, err := os.Stat(path)
+	require.NoError(t, err)
+	assert.Equal(t, before.ModTime(), after.ModTime(), "no-op setDefault must not rewrite the file")
+}
+
+func TestStateSetDefaultMissingNoFileBeforeWrite(t *testing.T) {
+	ctx, path := stateCtx(t)
+
+	// Loading state on a fresh tempdir must not create the file.
+	assert.Empty(t, getDefault(ctx, "profile-a"))
+	_, err := os.Stat(path)
+	assert.ErrorIs(t, err, fs.ErrNotExist, "getDefault must not create the state file")
+}
+
+// Pre-existing files from earlier CLI versions carry a `last_profile` field
+// the current schema doesn't know about. loadState must accept the file
+// (silently dropping the unknown field) and saveState must rewrite without
+// it, so the field naturally falls off on the next mutation.
+func TestStateLoadIgnoresUnknownFields(t *testing.T) {
+	ctx, path := stateCtx(t)
+	require.NoError(t, os.MkdirAll(filepath.Dir(path), 0o700))
+	require.NoError(t, os.WriteFile(path, []byte(`{
+        "defaults": {"profile-a": "sandbox-a"},
+        "last_profile": "profile-a"
+    }`), 0o600))
+
+	assert.Equal(t, "sandbox-a", getDefault(ctx, "profile-a"))
+
+	require.NoError(t, setDefault(ctx, "profile-a", "sandbox-a-prime"))
+	rewritten, err := os.ReadFile(path)
+	require.NoError(t, err)
+	assert.NotContains(t, string(rewritten), "last_profile")
+}
+
+func TestStateLoadReturnsErrorOnCorruptJSON(t *testing.T) {
+	ctx, path := stateCtx(t)
+	require.NoError(t, os.MkdirAll(filepath.Dir(path), 0o700))
+	require.NoError(t, os.WriteFile(path, []byte("{not valid json"), 0o600))
+
+	_, err := loadState(ctx)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "failed to parse")
+}
+
+// Files written by saveState must round-trip through loadState even if the
+// caller starts from an empty Defaults map.
+func TestStateSaveCreatesParentDirs(t *testing.T) {
+	ctx, path := stateCtx(t)
+
+	// Confirm parent dir does not exist yet.
+	_, err := os.Stat(filepath.Dir(path))
+	assert.ErrorIs(t, err, fs.ErrNotExist)
+
+	require.NoError(t, setDefault(ctx, "profile-a", "sandbox-a"))
+
+	// File and parent dir now exist with sensible perms.
+	info, err := os.Stat(path)
+	require.NoError(t, err)
+
+	dirInfo, err := os.Stat(filepath.Dir(path))
+	require.NoError(t, err)
+
+	// Windows does not honor Unix permission bits; os.Stat reports 0o666/0o777
+	// regardless of what was passed to OpenFile/MkdirAll.
+	if runtime.GOOS != "windows" {
+		assert.Equal(t, os.FileMode(0o600), info.Mode().Perm())
+		assert.Equal(t, os.FileMode(0o700), dirInfo.Mode().Perm())
+	}
+}
+
+// Defaults of nil on disk (legal but not what saveState produces) must still
+// load to a usable empty map so callers can setDefault without nil-deref.
+func TestStateLoadNilDefaultsMap(t *testing.T) {
+	ctx, path := stateCtx(t)
+	require.NoError(t, os.MkdirAll(filepath.Dir(path), 0o700))
+	require.NoError(t, os.WriteFile(path, []byte(`{}`), 0o600))
+
+	require.NoError(t, setDefault(ctx, "profile-a", "sandbox-a"))
+	assert.Equal(t, "sandbox-a", getDefault(ctx, "profile-a"))
+}
diff --git a/cmd/sandbox/status.go b/cmd/sandbox/status.go
new file mode 100644
index 00000000000..3062686ed13
--- /dev/null
+++ b/cmd/sandbox/status.go
@@ -0,0 +1,83 @@
+package sandbox
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/spf13/cobra"
+)
+
+func newStatusCommand() *cobra.Command {
+	var outputJSON bool
+
+	cmd := &cobra.Command{
+		Use:   "status <sandbox-id>",
+		Short: "Show Sandbox environment status",
+		Long: `Show detailed status of a Sandbox environment.
+
+Example:
+  databricks sandbox status happy-panda-1234
+  databricks sandbox status happy-panda-1234 --json`,
+		Args:              cobra.ExactArgs(1),
+		PreRunE:           root.MustWorkspaceClient,
+		ValidArgsFunction: completeSandboxIDs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			ctx := cmd.Context()
+			w := cmdctx.WorkspaceClient(ctx)
+			api, err := newSandboxAPI(w)
+			if err != nil {
+				return err
+			}
+
+			profile := w.Config.Profile
+			if profile == "" {
+				profile = w.Config.Host
+			}
+
+			sandboxID, err := resolveLocalID(ctx, profile, args[0])
+			if err != nil {
+				return err
+			}
+
+			entry, err := api.get(ctx, sandboxID)
+			if err != nil {
+				if errors.Is(err, apierr.ErrNotFound) {
+					return fmt.Errorf("no sandbox named %q — `databricks sandbox list` shows available IDs", sandboxID)
+				}
+				return fmt.Errorf("failed to get sandbox %s: %w", sandboxID, err)
+			}
+
+			_ = setGatewayHost(ctx, profile, entry.GatewayHost)
+			_ = upsertSandbox(ctx, profile, entry.SandboxID, entry.Name)
+
+			if jsonOutput(cmd, outputJSON) {
+				enc := json.NewEncoder(cmd.OutOrStdout())
+				enc.SetIndent("", "  ")
+				return enc.Encode(entry)
+			}
+
+			out := cmd.OutOrStdout()
+			blank(out)
+			field(ctx, out, "id", cmdio.Bold(ctx, entry.SandboxID))
+			if entry.Name != "" {
+				field(ctx, out, "name", entry.Name)
+			}
+			field(ctx, out, "status", status(ctx, entry.Status))
+			if entry.GatewayHost != "" {
+				field(ctx, out, "gateway", cmdio.Faint(ctx, entry.GatewayHost))
+			}
+			field(ctx, out, "autostop", cmdio.Faint(ctx, entry.autoStopLabel()))
+			blank(out)
+			return nil
+		},
+	}
+
+	cmd.Flags().BoolVar(&outputJSON, "json", false, "Output as JSON")
+
+	return cmd
+}
diff --git a/cmd/sandbox/stop.go b/cmd/sandbox/stop.go
new file mode 100644
index 00000000000..ed2d6253149
--- /dev/null
+++ b/cmd/sandbox/stop.go
@@ -0,0 +1,65 @@
+package sandbox
+
+import (
+	"fmt"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/spf13/cobra"
+)
+
+func newStopCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "stop <sandbox-id>",
+		Short: "Stop a running Sandbox environment",
+		Long: `Stop a running Sandbox environment.
+
+Terminates the backing microVM but preserves the sandbox record and its
+persistent storage. To restart, run 'databricks sandbox ssh' — the
+gateway auto-starts a stopped sandbox on connection.
+
+Stopping an already-stopped sandbox is a no-op.
+
+Example:
+  databricks sandbox stop happy-panda-1234`,
+		Args:              cobra.ExactArgs(1),
+		PreRunE:           root.MustWorkspaceClient,
+		ValidArgsFunction: completeSandboxIDs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			ctx := cmd.Context()
+			w := cmdctx.WorkspaceClient(ctx)
+			api, err := newSandboxAPI(w)
+			if err != nil {
+				return err
+			}
+
+			profile := w.Config.Profile
+			if profile == "" {
+				profile = w.Config.Host
+			}
+
+			sandboxID, err := resolveLocalID(ctx, profile, args[0])
+			if err != nil {
+				return err
+			}
+
+			s := spin(ctx, "Stopping "+sandboxID+"…")
+			defer s.Close()
+
+			updated, err := api.stop(ctx, sandboxID)
+			if err != nil {
+				s.fail("Failed to stop " + sandboxID)
+				return fmt.Errorf("failed to stop sandbox %s: %w", sandboxID, err)
+			}
+
+			_ = setGatewayHost(ctx, profile, updated.GatewayHost)
+			_ = upsertSandbox(ctx, profile, updated.SandboxID, updated.Name)
+
+			s.ok("Stopped " + cmdio.Bold(ctx, updated.SandboxID))
+			return nil
+		},
+	}
+
+	return cmd
+}
diff --git a/cmd/sandbox/ui.go b/cmd/sandbox/ui.go
new file mode 100644
index 00000000000..ae97a408260
--- /dev/null
+++ b/cmd/sandbox/ui.go
@@ -0,0 +1,90 @@
+package sandbox
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/spf13/cobra"
+)
+
+// jsonOutput reports whether the user asked for JSON output, via either
+// the local `--json` flag or the framework-global `-o json`.
+func jsonOutput(cmd *cobra.Command, jsonFlag bool) bool {
+	if jsonFlag {
+		return true
+	}
+	if f := cmd.Flag("output"); f != nil && f.Value.String() == "json" {
+		return true
+	}
+	return false
+}
+
+// cmdioSpinner is the subset of *cmdio.spinner's method set we need,
+// defined locally so we can hold the unexported type as a field.
+type cmdioSpinner interface {
+	Update(msg string)
+	Close()
+}
+
+// spinner wraps cmdio.NewSpinner with ok/fail markers. Close (idempotent
+// in cmdio) is safe alongside ok/fail, so callers can `defer s.Close()`.
+type spinner struct {
+	cmdioSpinner
+	ctx context.Context
+}
+
+func spin(ctx context.Context, msg string) *spinner {
+	sp := cmdio.NewSpinner(ctx)
+	sp.Update(msg)
+	return &spinner{cmdioSpinner: sp, ctx: ctx}
+}
+
+func (s *spinner) ok(msg string)   { s.mark("✓", msg) }
+func (s *spinner) fail(msg string) { s.mark("✗", msg) }
+
+func (s *spinner) mark(mark, msg string) {
+	s.Close()
+	cmdio.LogString(s.ctx, "  "+cmdio.Cyan(s.ctx, mark)+" "+msg)
+}
+
+// status formats a sandbox lifecycle status with a color hint.
+func status(ctx context.Context, s string) string {
+	switch strings.ToLower(s) {
+	case "running":
+		return cmdio.Cyan(ctx, "running")
+	case "stopped":
+		return cmdio.Faint(ctx, "stopped")
+	case "creating":
+		return cmdio.Bold(ctx, cmdio.Cyan(ctx, "creating…"))
+	case "stopping":
+		return cmdio.Yellow(ctx, "stopping…")
+	default:
+		return cmdio.Faint(ctx, strings.ToLower(s))
+	}
+}
+
+// field prints "  label  value" to w, where label is dimmed and padded to a
+// fixed visible width. Padding has to happen before Dim so the SGR escapes
+// don't inflate the byte count and break column alignment.
+func field(ctx context.Context, w io.Writer, label, value string) {
+	fmt.Fprintf(w, "  %s %s\n", cmdio.Faint(ctx, fmt.Sprintf("%-10s", label)), value)
+}
+
+// ok prints "  ✓ message" to stderr via the cmdio context.
+func ok(ctx context.Context, msg string) {
+	cmdio.LogString(ctx, "  "+cmdio.Cyan(ctx, "✓")+" "+msg)
+}
+
+// warn prints "  ! message" to stderr via the cmdio context. Yellow so
+// it visually differs from `ok`'s cyan ✓ and `spinner` cyan markers.
+func warn(ctx context.Context, msg string) {
+	cmdio.LogString(ctx, "  "+cmdio.Yellow(ctx, "!")+" "+msg)
+}
+
+// blank prints an empty line to w.
+func blank(w io.Writer) {
+	fmt.Fprintln(w)
+}
diff --git a/cmd/selftest/tui/ask.go b/cmd/selftest/tui/ask.go
new file mode 100644
index 00000000000..1d64eecde64
--- /dev/null
+++ b/cmd/selftest/tui/ask.go
@@ -0,0 +1,45 @@
+package tui
+
+import (
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/spf13/cobra"
+)
+
+func newAskCmd() *cobra.Command {
+	var defaultVal string
+	cmd := &cobra.Command{
+		Use:   "ask",
+		Short: "cmdio.Ask (single-line text input with optional default)",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			ctx := cmd.Context()
+			ans, err := cmdio.Ask(ctx, "Enter a value", defaultVal)
+			if err != nil {
+				return err
+			}
+			cmdio.LogString(ctx, "Entered: "+ans)
+			return nil
+		},
+	}
+	cmd.Flags().StringVar(&defaultVal, "default", "", "default returned if the user just presses Enter")
+	return cmd
+}
+
+func newAskYesOrNoCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "ask-yes-no",
+		Short: "cmdio.AskYesOrNo (yes/no question)",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			ctx := cmd.Context()
+			ans, err := cmdio.AskYesOrNo(ctx, "Continue")
+			if err != nil {
+				return err
+			}
+			if ans {
+				cmdio.LogString(ctx, "Answer: yes")
+			} else {
+				cmdio.LogString(ctx, "Answer: no")
+			}
+			return nil
+		},
+	}
+}
diff --git a/cmd/selftest/tui/colors.go b/cmd/selftest/tui/colors.go
new file mode 100644
index 00000000000..9afc6fd693f
--- /dev/null
+++ b/cmd/selftest/tui/colors.go
@@ -0,0 +1,25 @@
+package tui
+
+import (
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/spf13/cobra"
+)
+
+func newColorsCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "colors",
+		Short: "Print colored text to verify color support",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			ctx := cmd.Context()
+			swatch := "the quick brown fox jumps over the lazy dog"
+			cmdio.LogString(ctx, "red:     "+cmdio.Red(ctx, swatch))
+			cmdio.LogString(ctx, "green:   "+cmdio.Green(ctx, swatch))
+			cmdio.LogString(ctx, "yellow:  "+cmdio.Yellow(ctx, swatch))
+			cmdio.LogString(ctx, "blue:    "+cmdio.Blue(ctx, swatch))
+			cmdio.LogString(ctx, "cyan:    "+cmdio.Cyan(ctx, swatch))
+			cmdio.LogString(ctx, "hiblack: "+cmdio.HiBlack(ctx, swatch))
+			cmdio.LogString(ctx, "hiblue:  "+cmdio.HiBlue(ctx, swatch))
+			return nil
+		},
+	}
+}
diff --git a/cmd/selftest/tui/fixtures.go b/cmd/selftest/tui/fixtures.go
new file mode 100644
index 00000000000..01cd2873abf
--- /dev/null
+++ b/cmd/selftest/tui/fixtures.go
@@ -0,0 +1,175 @@
+package tui
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/databricks/cli/libs/cmdio"
+)
+
+type spinnerMessage struct {
+	text     string
+	duration time.Duration
+}
+
+var spinnerMessages = []spinnerMessage{
+	{"Initializing...", time.Second},
+	{"Loading configuration", time.Second},
+	{"Connecting to workspace", time.Second},
+	{"Processing files", time.Second},
+	{"Finalizing", time.Second},
+}
+
+// databricksFeatures is a stable list of Databricks product / feature names
+// used as fixture data for the prompt scenarios. Drawn from the public docs
+// (https://docs.databricks.com) so the demo data looks like something a user
+// would actually encounter.
+var databricksFeatures = []string{
+	"unity-catalog",
+	"delta-lake",
+	"delta-sharing",
+	"photon",
+	"mlflow",
+	"mosaic-ai",
+	"genie",
+	"lakeflow-connect",
+	"lakeflow-jobs",
+	"vector-search",
+	"model-serving",
+	"feature-store",
+	"databricks-sql",
+	"ai-playground",
+	"foundation-models",
+	"lakehouse-monitoring",
+	"liquid-clustering",
+	"predictive-optimization",
+	"governed-tags",
+	"lakeflow-designer",
+}
+
+// buildItems uses zero-padded ids so the alphabetical Select scenario has
+// a stable sort order.
+func buildItems(n int) []cmdio.Tuple {
+	n = min(n, len(databricksFeatures))
+	items := make([]cmdio.Tuple, 0, n)
+	for i := range n {
+		items = append(items, cmdio.Tuple{
+			Name: databricksFeatures[i],
+			Id:   fmt.Sprintf("id-%02d", i+1),
+		})
+	}
+	return items
+}
+
+// buildFilterItems returns 15 items where 5 share the substring "lake", so
+// progressive typing narrows the list, and a non-matching substring ("xyz")
+// hits the "No results" path.
+func buildFilterItems() []cmdio.Tuple {
+	names := []string{
+		"lakehouse-monitoring",
+		"lakeflow-connect",
+		"lakeflow-jobs",
+		"delta-lake",
+		"lakebase-postgres",
+		"unity-catalog",
+		"mosaic-ai",
+		"vector-search",
+		"model-serving",
+		"feature-store",
+		"ai-playground",
+		"genie-spaces",
+		"mlflow-tracking",
+		"liquid-clustering",
+		"predictive-optimization",
+	}
+	items := make([]cmdio.Tuple, 0, len(names))
+	for i, name := range names {
+		items = append(items, cmdio.Tuple{
+			Name: name,
+			Id:   fmt.Sprintf("id-%02d", i+1),
+		})
+	}
+	return items
+}
+
+// buildLongItems uses fully-qualified workspace URLs as ids so that the
+// rendered field overflows a typical terminal width.
+func buildLongItems() []cmdio.Tuple {
+	hosts := []string{
+		"https://adb-1234567890123456.78.azuredatabricks.net/?o=1234567890123456",
+		"https://adb-2345678901234567.89.azuredatabricks.net/?o=2345678901234567",
+		"https://acme-prod.cloud.databricks.com/?o=3456789012345678",
+		"https://acme-staging.cloud.databricks.com/?o=4567890123456789",
+		"https://acme-dev.cloud.databricks.com/?o=5678901234567890",
+		"https://1234567890123456.7.gcp.databricks.com/?o=6789012345678901",
+		"https://2345678901234567.8.gcp.databricks.com/?o=7890123456789012",
+		"https://field-eng-east.cloud.databricks.com/?o=8901234567890123",
+	}
+	items := make([]cmdio.Tuple, 0, len(hosts))
+	for i, host := range hosts {
+		items = append(items, cmdio.Tuple{
+			Name: fmt.Sprintf("workspace-%02d", i+1),
+			Id:   host,
+		})
+	}
+	return items
+}
+
+// clusterItem mirrors libs/databrickscfg/cfgpickers/clusters.go's
+// compatibleCluster: State, Access, and Runtime are exposed as methods so
+// the Active/Inactive templates exercise text/template's method-resolution
+// path, and State returns a pre-rendered colored string (matching the
+// renderedState cache in production) so the demo also exercises ANSI codes
+// emitted from inside a template.
+type clusterItem struct {
+	Name string
+	Id   string
+
+	access        string
+	runtimeName   string
+	renderedState string
+}
+
+func (c clusterItem) Access() string  { return c.access }
+func (c clusterItem) Runtime() string { return c.runtimeName }
+func (c clusterItem) State() string   { return c.renderedState }
+
+func buildClusterItems(ctx context.Context) []clusterItem {
+	green := func(s string) string { return cmdio.Green(ctx, s) }
+	red := func(s string) string { return cmdio.Red(ctx, s) }
+	blue := func(s string) string { return cmdio.Blue(ctx, s) }
+	return []clusterItem{
+		{Name: "shared-autoscaling-prod", Id: "0123-456789-abcdef01", access: "Shared", runtimeName: "DBR 14.3 LTS", renderedState: green("RUNNING")},
+		{Name: "ml-gpu-experiments", Id: "0123-456789-abcdef02", access: "Assigned", runtimeName: "DBR 15.0 ML", renderedState: red("TERMINATED")},
+		{Name: "job-compute-bronze-etl", Id: "0123-456789-abcdef03", access: "Shared", runtimeName: "DBR 13.3 LTS", renderedState: green("RUNNING")},
+		{Name: "interactive-analytics", Id: "0123-456789-abcdef04", access: "Assigned", runtimeName: "DBR 14.3", renderedState: blue("PENDING")},
+		{Name: "photon-streaming-realtime", Id: "0123-456789-abcdef05", access: "Shared", runtimeName: "DBR 14.3 Photon", renderedState: green("RUNNING")},
+		{Name: "single-node-dev", Id: "0123-456789-abcdef06", access: "Assigned", runtimeName: "DBR 14.3 LTS", renderedState: red("TERMINATED")},
+		{Name: "all-purpose-shared", Id: "0123-456789-abcdef07", access: "Shared", runtimeName: "DBR 15.0", renderedState: green("RUNNING")},
+		{Name: "legacy-data-eng", Id: "0123-456789-abcdef08", access: "Assigned", runtimeName: "DBR 12.2 LTS", renderedState: red("TERMINATED")},
+	}
+}
+
+// profileItem mirrors the profile picker in cmd/auth/token.go: regular items
+// have a Host, the trailing meta items do not (so the {{if .Host}} branch fires).
+type profileItem struct {
+	Name string
+	Host string
+}
+
+// buildProfileItems returns 6 profile-shaped items across AWS / Azure / GCP
+// hosts plus the two trailing meta-rows ("Create a new profile", "Enter a
+// host URL manually") used by the real profile picker.
+func buildProfileItems() []profileItem {
+	return []profileItem{
+		{Name: "DEFAULT", Host: "https://acme.cloud.databricks.com"},
+		{Name: "production", Host: "https://acme-prod.cloud.databricks.com"},
+		{Name: "staging", Host: "https://acme-stg.cloud.databricks.com"},
+		{Name: "field-eng", Host: "https://field-eng.cloud.databricks.com"},
+		{Name: "azure-personal", Host: "https://adb-1234567890123456.78.azuredatabricks.net"},
+		{Name: "gcp-sandbox", Host: "https://1234567890123456.7.gcp.databricks.com"},
+		{Name: "Create a new profile"},
+		{Name: "Enter a host URL manually"},
+	}
+}
diff --git a/cmd/selftest/tui/prompt.go b/cmd/selftest/tui/prompt.go
new file mode 100644
index 00000000000..9c5be5319a3
--- /dev/null
+++ b/cmd/selftest/tui/prompt.go
@@ -0,0 +1,67 @@
+package tui
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/spf13/cobra"
+)
+
+func newPromptCmd() *cobra.Command {
+	var (
+		mask     bool
+		validate bool
+	)
+	cmd := &cobra.Command{
+		Use:   "prompt",
+		Short: "cmdio.RunPrompt (single-line text input)",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			ctx := cmd.Context()
+			opts := cmdio.PromptOptions{
+				Label: "Enter a value",
+			}
+			if mask {
+				opts.Mask = '*'
+			}
+			if validate {
+				opts.Validate = func(input string) error {
+					if !strings.Contains(input, "://") {
+						return errors.New("value must contain '://'")
+					}
+					return nil
+				}
+			}
+			value, err := cmdio.RunPrompt(ctx, opts)
+			if err != nil {
+				return err
+			}
+			if mask {
+				cmdio.LogString(ctx, fmt.Sprintf("Entered %d characters", len(value)))
+				return nil
+			}
+			cmdio.LogString(ctx, "Entered: "+value)
+			return nil
+		},
+	}
+	cmd.Flags().BoolVar(&mask, "mask", false, "echo input as '*'")
+	cmd.Flags().BoolVar(&validate, "validate", false, "require '://' in input")
+	return cmd
+}
+
+func newSecretCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "secret",
+		Short: "cmdio.Secret (masked password input)",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			ctx := cmd.Context()
+			value, err := cmdio.Secret(ctx, "Personal access token")
+			if err != nil {
+				return err
+			}
+			cmdio.LogString(ctx, fmt.Sprintf("Entered %d characters", len(value)))
+			return nil
+		},
+	}
+}
diff --git a/cmd/selftest/tui/select.go b/cmd/selftest/tui/select.go
new file mode 100644
index 00000000000..d7d862a1be4
--- /dev/null
+++ b/cmd/selftest/tui/select.go
@@ -0,0 +1,168 @@
+package tui
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/spf13/cobra"
+)
+
+func validatePositive(n int) error {
+	if n < 1 {
+		return fmt.Errorf("--n must be at least 1, got %d", n)
+	}
+	return nil
+}
+
+func newSelectCmd() *cobra.Command {
+	var n int
+	cmd := &cobra.Command{
+		Use:   "select",
+		Short: "cmdio.Select (map; sorted alphabetically by name)",
+		PreRunE: func(cmd *cobra.Command, args []string) error {
+			return validatePositive(n)
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			ctx := cmd.Context()
+			tuples := buildItems(n)
+			items := make(map[string]string, len(tuples))
+			for _, t := range tuples {
+				items[t.Name] = t.Id
+			}
+			id, err := cmdio.Select(ctx, items, "Pick an item")
+			if err != nil {
+				return err
+			}
+			cmdio.LogString(ctx, "Selected: "+id)
+			return nil
+		},
+	}
+	cmd.Flags().IntVar(&n, "n", 5, "number of items")
+	return cmd
+}
+
+func newSelectOrderedCmd() *cobra.Command {
+	var (
+		n      int
+		long   bool
+		filter bool
+	)
+	cmd := &cobra.Command{
+		Use:   "select-ordered",
+		Short: "cmdio.SelectOrdered ([]Tuple; preserves insertion order)",
+		PreRunE: func(cmd *cobra.Command, args []string) error {
+			if long || filter {
+				return nil
+			}
+			return validatePositive(n)
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			ctx := cmd.Context()
+			var items []cmdio.Tuple
+			switch {
+			case filter:
+				items = buildFilterItems()
+			case long:
+				items = buildLongItems()
+			default:
+				items = buildItems(n)
+			}
+			id, err := cmdio.SelectOrdered(ctx, items, "Pick an item")
+			if err != nil {
+				return err
+			}
+			cmdio.LogString(ctx, "Selected: "+id)
+			return nil
+		},
+	}
+	cmd.Flags().IntVar(&n, "n", 5, "number of items (ignored with --long or --filter)")
+	cmd.Flags().BoolVar(&long, "long", false, "use 8 items with 60+ char ids that overflow the terminal")
+	cmd.Flags().BoolVar(&filter, "filter", false, "use 15 items with overlapping substrings (try typing 'al' or 'xyz')")
+	cmd.MarkFlagsMutuallyExclusive("long", "filter")
+	return cmd
+}
+
+func newRunSelectCmd() *cobra.Command {
+	var (
+		rich        bool
+		conditional bool
+	)
+	cmd := &cobra.Command{
+		Use:   "run-select",
+		Short: "cmdio.RunSelect (custom SelectOptions)",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			ctx := cmd.Context()
+			switch {
+			case rich:
+				return runSelectRich(ctx)
+			case conditional:
+				return runSelectProfile(ctx)
+			default:
+				return runSelectPlain(ctx)
+			}
+		},
+	}
+	cmd.Flags().BoolVar(&rich, "rich", false, "use cluster-style rich Active/Inactive templates (bold + faint)")
+	cmd.Flags().BoolVar(&conditional, "conditional", false, "use profile-style {{if .Host}} template branches and trailing meta-rows")
+	cmd.MarkFlagsMutuallyExclusive("rich", "conditional")
+	return cmd
+}
+
+func runSelectPlain(ctx context.Context) error {
+	items := buildItems(5)
+	i, err := cmdio.RunSelect(ctx, cmdio.SelectOptions{
+		Label: "Pick an item",
+		Items: items,
+	})
+	if err != nil {
+		return err
+	}
+	cmdio.LogString(ctx, "Selected: "+items[i].Id)
+	return nil
+}
+
+func runSelectRich(ctx context.Context) error {
+	items := buildClusterItems(ctx)
+	i, err := cmdio.RunSelect(ctx, cmdio.SelectOptions{
+		Label: "Choose a cluster",
+		Items: items,
+		Searcher: func(input string, idx int) bool {
+			return strings.Contains(strings.ToLower(items[idx].Name), strings.ToLower(input))
+		},
+		StartInSearchMode: true,
+		LabelTemplate:     `{{ . | faint }}`,
+		Active:            `{{.Name | bold}} ({{.State}} {{.Access}} Runtime {{.Runtime}}) ({{.Id | faint}})`,
+		Inactive:          `{{.Name}} ({{.State}} {{.Access}} Runtime {{.Runtime}})`,
+		Selected:          `{{ "Selected cluster" | faint }}: {{ .Name | bold }} ({{ .Id | faint }})`,
+	})
+	if err != nil {
+		return err
+	}
+	cmdio.LogString(ctx, "Selected: "+items[i].Name+" ("+items[i].Id+")")
+	return nil
+}
+
+func runSelectProfile(ctx context.Context) error {
+	items := buildProfileItems()
+	i, err := cmdio.RunSelect(ctx, cmdio.SelectOptions{
+		Label:             "Select a profile",
+		Items:             items,
+		StartInSearchMode: true,
+		Searcher: func(input string, idx int) bool {
+			input = strings.ToLower(input)
+			return strings.Contains(strings.ToLower(items[idx].Name), input) ||
+				strings.Contains(strings.ToLower(items[idx].Host), input)
+		},
+		LabelTemplate: `{{ . | faint }}`,
+		Active:        `{{.Name | bold}}{{if .Host}} ({{.Host | faint}}){{end}}`,
+		Inactive:      `{{.Name}}{{if .Host}} ({{.Host}}){{end}}`,
+		Selected:      `{{ "Using profile" | faint }}: {{ .Name | bold }}`,
+	})
+	if err != nil {
+		return err
+	}
+	cmdio.LogString(ctx, "Selected: "+items[i].Name)
+	return nil
+}
diff --git a/cmd/selftest/tui/spinner.go b/cmd/selftest/tui/spinner.go
index a53591f3159..799ce0585d1 100644
--- a/cmd/selftest/tui/spinner.go
+++ b/cmd/selftest/tui/spinner.go
@@ -7,35 +7,31 @@ import (
 	"github.com/spf13/cobra"
 )
 
-func newSpinner() *cobra.Command {
-	return &cobra.Command{
+func newSpinnerCmd() *cobra.Command {
+	var elapsed bool
+	cmd := &cobra.Command{
 		Use:   "spinner",
-		Short: "Test the cmdio spinner component",
-		Run: func(cmd *cobra.Command, args []string) {
+		Short: "cmdio.NewSpinner (progress indicator)",
+		RunE: func(cmd *cobra.Command, args []string) error {
 			ctx := cmd.Context()
 
-			sp := cmdio.NewSpinner(ctx)
-
-			// Test various status messages
-			messages := []struct {
-				text     string
-				duration time.Duration
-			}{
-				{"Initializing...", time.Second},
-				{"Loading configuration", time.Second},
-				{"Connecting to workspace", time.Second},
-				{"Processing files", time.Second},
-				{"Finalizing", time.Second},
+			var opts []cmdio.SpinnerOption
+			if elapsed {
+				opts = append(opts, cmdio.WithElapsedTime())
 			}
+			sp := cmdio.NewSpinner(ctx, opts...)
 
-			for _, msg := range messages {
+			for _, msg := range spinnerMessages {
 				sp.Update(msg.text)
 				time.Sleep(msg.duration)
 			}
 
 			sp.Close()
 
-			cmdio.LogString(ctx, "✓ Spinner test complete")
+			cmdio.LogString(ctx, "Spinner test complete")
+			return nil
 		},
 	}
+	cmd.Flags().BoolVar(&elapsed, "elapsed", false, "show an MM:SS elapsed-time prefix on the spinner")
+	return cmd
 }
diff --git a/cmd/selftest/tui/tui.go b/cmd/selftest/tui/tui.go
index 5a3f9aad1bc..f1b807fc930 100644
--- a/cmd/selftest/tui/tui.go
+++ b/cmd/selftest/tui/tui.go
@@ -8,6 +8,17 @@ func New() *cobra.Command {
 		Short: "Test terminal UI components (spinners, prompts, etc.)",
 	}
 
-	cmd.AddCommand(newSpinner())
+	cmd.AddCommand(
+		newAskCmd(),
+		newAskYesOrNoCmd(),
+		newColorsCmd(),
+		newPromptCmd(),
+		newRunSelectCmd(),
+		newSecretCmd(),
+		newSelectCmd(),
+		newSelectOrderedCmd(),
+		newSpinnerCmd(),
+	)
+
 	return cmd
 }
diff --git a/cmd/sync/completion.go b/cmd/sync/completion.go
index 52d49d6cb1c..c82d85a1c38 100644
--- a/cmd/sync/completion.go
+++ b/cmd/sync/completion.go
@@ -6,6 +6,7 @@ import (
 	"strings"
 
 	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/service/iam"
 	"github.com/databricks/databricks-sdk-go/service/workspace"
 	"github.com/spf13/cobra"
 )
@@ -17,7 +18,7 @@ func fetchDirs(ctx context.Context, wsc *databricks.WorkspaceClient, path string
 	go func() {
 		defer close(ch)
 
-		files, err := wsc.Workspace.ListAll(ctx, workspace.ListWorkspaceRequest{ //nolint:staticcheck // Deprecated in SDK v0.127.0. Migration to WorkspaceHierarchyService tracked separately.
+		files, err := wsc.Workspace.ListAll(ctx, workspace.ListWorkspaceRequest{
 			Path: path,
 		})
 		if err != nil {
@@ -44,7 +45,7 @@ func completeRemotePath(
 	wsc *databricks.WorkspaceClient,
 	toComplete string,
 ) ([]string, cobra.ShellCompDirective) {
-	me, err := wsc.CurrentUser.Me(ctx)
+	me, err := wsc.CurrentUser.Me(ctx, iam.MeRequest{})
 	if err != nil {
 		return nil, cobra.ShellCompDirectiveError
 	}
diff --git a/cmd/sync/sync.go b/cmd/sync/sync.go
index 652d3ecc9db..027ef79a4a0 100644
--- a/cmd/sync/sync.go
+++ b/cmd/sync/sync.go
@@ -26,27 +26,24 @@ import (
 
 type syncFlags struct {
 	// project files polling interval
-	interval     time.Duration
-	full         bool
-	watch        bool
-	output       flags.Output
-	exclude      []string
-	include      []string
-	dryRun       bool
-	excludeFrom  string
-	includeFrom  string
-	concurrency  int
-	retryTimeout time.Duration
+	interval    time.Duration
+	full        bool
+	watch       bool
+	exclude     []string
+	include     []string
+	dryRun      bool
+	excludeFrom string
+	includeFrom string
 }
 
-func readPatternsFile(filePath string) ([]string, error) {
+func readPatternsFile(flagName, filePath string) ([]string, error) {
 	if filePath == "" {
 		return nil, nil
 	}
 
 	data, err := os.ReadFile(filePath)
 	if err != nil {
-		return nil, fmt.Errorf("failed to read exclude-from file: %w", err)
+		return nil, fmt.Errorf("failed to read %s file: %w", flagName, err)
 	}
 
 	var patterns []string
@@ -57,7 +54,7 @@ func readPatternsFile(filePath string) ([]string, error) {
 	}
 
 	if err := scanner.Err(); err != nil {
-		return nil, fmt.Errorf("error reading exclude-from file: %w", err)
+		return nil, fmt.Errorf("error reading %s file: %w", flagName, err)
 	}
 
 	return patterns, nil
@@ -73,12 +70,12 @@ func (f *syncFlags) syncOptionsFromBundle(cmd *cobra.Command, args []string, b *
 		return nil, fmt.Errorf("cannot get sync options: %w", err)
 	}
 
-	excludePatterns, err := readPatternsFile(f.excludeFrom)
+	excludePatterns, err := readPatternsFile("exclude-from", f.excludeFrom)
 	if err != nil {
 		return nil, err
 	}
 
-	includePatterns, err := readPatternsFile(f.includeFrom)
+	includePatterns, err := readPatternsFile("include-from", f.includeFrom)
 	if err != nil {
 		return nil, err
 	}
@@ -91,8 +88,6 @@ func (f *syncFlags) syncOptionsFromBundle(cmd *cobra.Command, args []string, b *
 	opts.Include = append(opts.Include, f.include...)
 	opts.Include = append(opts.Include, includePatterns...)
 	opts.DryRun = f.dryRun
-	opts.Concurrency = f.concurrency
-	opts.RetryTimeout = f.retryTimeout
 	return opts, nil
 }
 
@@ -102,7 +97,7 @@ func (f *syncFlags) syncOptionsFromArgs(cmd *cobra.Command, args []string) (*syn
 	}
 
 	var outputFunc func(context.Context, <-chan sync.Event, io.Writer)
-	switch f.output {
+	switch root.OutputType(cmd) {
 	case flags.OutputText:
 		outputFunc = sync.TextOutput
 	case flags.OutputJSON:
@@ -123,12 +118,12 @@ func (f *syncFlags) syncOptionsFromArgs(cmd *cobra.Command, args []string) (*syn
 		log.Warnf(ctx, "Running in dry-run mode. No actual changes will be made.")
 	}
 
-	excludePatterns, err := readPatternsFile(f.excludeFrom)
+	excludePatterns, err := readPatternsFile("exclude-from", f.excludeFrom)
 	if err != nil {
 		return nil, err
 	}
 
-	includePatterns, err := readPatternsFile(f.includeFrom)
+	includePatterns, err := readPatternsFile("include-from", f.includeFrom)
 	if err != nil {
 		return nil, err
 	}
@@ -167,8 +162,6 @@ func (f *syncFlags) syncOptionsFromArgs(cmd *cobra.Command, args []string) (*syn
 
 		OutputHandler: outputHandler,
 		DryRun:        f.dryRun,
-		Concurrency:   f.concurrency,
-		RetryTimeout:  f.retryTimeout,
 	}
 	return &opts, nil
 }
@@ -181,20 +174,15 @@ func New() *cobra.Command {
 		GroupID: "development",
 	}
 
-	f := syncFlags{
-		output: flags.OutputText,
-	}
+	var f syncFlags
 	cmd.Flags().DurationVar(&f.interval, "interval", 1*time.Second, "file system polling interval (for --watch)")
 	cmd.Flags().BoolVar(&f.full, "full", false, "perform full synchronization (default is incremental)")
 	cmd.Flags().BoolVar(&f.watch, "watch", false, "watch local file system for changes")
-	cmd.Flags().Var(&f.output, "output", "type of output format")
 	cmd.Flags().StringSliceVar(&f.exclude, "exclude", nil, "patterns to exclude from sync (can be specified multiple times)")
 	cmd.Flags().StringSliceVar(&f.include, "include", nil, "patterns to include in sync (can be specified multiple times)")
 	cmd.Flags().StringVar(&f.excludeFrom, "exclude-from", "", "file containing patterns to exclude from sync (one pattern per line)")
 	cmd.Flags().StringVar(&f.includeFrom, "include-from", "", "file containing patterns to include to sync (one pattern per line)")
 	cmd.Flags().BoolVar(&f.dryRun, "dry-run", false, "simulate sync execution without making actual changes")
-	cmd.Flags().IntVar(&f.concurrency, "concurrency", 5, "maximum number of concurrent in-flight requests during sync")
-	cmd.Flags().DurationVar(&f.retryTimeout, "retry-timeout", sync.DefaultRetryTimeout, "per-call deadline for retrying transient gateway errors (HTTP 502/503/504)")
 
 	// Wrapper for [root.MustWorkspaceClient] that disables loading authentication configuration from a bundle.
 	mustWorkspaceClient := func(cmd *cobra.Command, args []string) error {
@@ -204,13 +192,6 @@ func New() *cobra.Command {
 
 	cmd.PreRunE = mustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) error {
-		if f.concurrency < 1 {
-			return fmt.Errorf("--concurrency must be a positive integer, got %d", f.concurrency)
-		}
-		if f.retryTimeout < 0 {
-			return fmt.Errorf("--retry-timeout must be non-negative, got %s", f.retryTimeout)
-		}
-
 		var opts *sync.SyncOptions
 		var err error
 
diff --git a/cmd/sync/sync_test.go b/cmd/sync/sync_test.go
index 818c7e013aa..757defc34f8 100644
--- a/cmd/sync/sync_test.go
+++ b/cmd/sync/sync_test.go
@@ -8,12 +8,22 @@ import (
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/flags"
 	"github.com/databricks/cli/libs/vfs"
+	"github.com/spf13/cobra"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
+// newTestSyncCommand attaches the sync command to a root command so the root persistent flags resolve.
+func newTestSyncCommand(t *testing.T) *cobra.Command {
+	syncCmd := New()
+	root.New(t.Context()).AddCommand(syncCmd)
+	return syncCmd
+}
+
 func TestSyncOptionsFromBundle(t *testing.T) {
 	tempDir := t.TempDir()
 	b := &bundle.Bundle{
@@ -57,7 +67,7 @@ func TestSyncOptionsFromArgs(t *testing.T) {
 	remote := "/remote"
 
 	f := syncFlags{}
-	cmd := New()
+	cmd := newTestSyncCommand(t)
 	cmd.SetContext(cmdctx.SetWorkspaceClient(t.Context(), nil))
 	opts, err := f.syncOptionsFromArgs(cmd, []string{local, remote})
 	require.NoError(t, err)
@@ -65,6 +75,21 @@ func TestSyncOptionsFromArgs(t *testing.T) {
 	assert.Equal(t, remote, opts.RemotePath)
 }
 
+func TestSyncShorthandFlags(t *testing.T) {
+	cmd := newTestSyncCommand(t)
+	require.NoError(t, cmd.ParseFlags([]string{"-o", "json", "-p", "myprofile"}))
+	assert.Equal(t, flags.OutputJSON, root.OutputType(cmd))
+	assert.Equal(t, "myprofile", cmd.Flag("profile").Value.String())
+}
+
+func TestReadPatternsFileErrorNamesFlag(t *testing.T) {
+	missing := filepath.Join(t.TempDir(), "missing.txt")
+	_, err := readPatternsFile("exclude-from", missing)
+	assert.ErrorContains(t, err, "failed to read exclude-from file")
+	_, err = readPatternsFile("include-from", missing)
+	assert.ErrorContains(t, err, "failed to read include-from file")
+}
+
 func TestExcludeFromFlag(t *testing.T) {
 	// Create a temporary directory
 	tempDir := t.TempDir()
@@ -83,7 +108,7 @@ func TestExcludeFromFlag(t *testing.T) {
 
 	// Set up the flags
 	f := syncFlags{excludeFrom: excludeFromPath}
-	cmd := New()
+	cmd := newTestSyncCommand(t)
 	cmd.SetContext(cmdctx.SetWorkspaceClient(t.Context(), nil))
 
 	// Test with both exclude flag and exclude-from flag
diff --git a/cmd/version/version.go b/cmd/version/version.go
index 813bb97aa79..146e94fce98 100644
--- a/cmd/version/version.go
+++ b/cmd/version/version.go
@@ -6,9 +6,30 @@ import (
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/internal/build"
 	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/versioncheck"
 	"github.com/spf13/cobra"
 )
 
+// updateCheckTemplate renders an update check in text mode. JSON output is
+// rendered directly from the versioncheck.Result struct by cmdio.
+const updateCheckTemplate = `Databricks CLI v{{.CurrentVersion}}
+{{if .DevelopmentBuild -}}
+This is a development build; skipping the update check.
+{{- else if .CheckFailed -}}
+Could not reach GitHub to check for a newer version. See https://github.com/databricks/cli/releases for the latest release.
+{{- else if .UpdateAvailable -}}
+{{yellow "A new version is available"}}: {{.LatestVersion}}
+{{if .UpgradeCommand -}}
+To upgrade, run:
+  {{.UpgradeCommand}}
+{{- else -}}
+Download the latest release: https://github.com/databricks/cli/releases
+{{- end}}
+{{- else -}}
+{{green "You're on the latest version."}}
+{{- end}}
+`
+
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "version",
@@ -19,8 +40,15 @@ func New() *cobra.Command {
 		},
 	}
 
+	var check bool
+	cmd.Flags().BoolVar(&check, "check", false, "Check whether a newer version of the CLI is available")
+
 	cmd.RunE = func(cmd *cobra.Command, args []string) error {
-		return cmdio.Render(cmd.Context(), build.GetInfo())
+		ctx := cmd.Context()
+		if check {
+			return cmdio.RenderWithTemplate(ctx, versioncheck.Check(ctx), "", updateCheckTemplate)
+		}
+		return cmdio.Render(ctx, build.GetInfo())
 	}
 
 	return cmd
diff --git a/cmd/version/version_test.go b/cmd/version/version_test.go
new file mode 100644
index 00000000000..760cc8787a9
--- /dev/null
+++ b/cmd/version/version_test.go
@@ -0,0 +1,87 @@
+package version
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/versioncheck"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestUpdateCheckTemplate(t *testing.T) {
+	tests := []struct {
+		name   string
+		result versioncheck.Result
+		want   string
+	}{
+		{
+			name: "update available with upgrade command",
+			result: versioncheck.Result{
+				CurrentVersion:  "0.240.0",
+				LatestVersion:   "0.245.0",
+				UpdateAvailable: true,
+				InstallMethod:   versioncheck.InstallHomebrew,
+				UpgradeCommand:  "brew upgrade databricks",
+			},
+			want: `Databricks CLI v0.240.0
+A new version is available: 0.245.0
+To upgrade, run:
+  brew upgrade databricks
+`,
+		},
+		{
+			name: "update available without known install method",
+			result: versioncheck.Result{
+				CurrentVersion:  "0.240.0",
+				LatestVersion:   "0.245.0",
+				UpdateAvailable: true,
+				InstallMethod:   versioncheck.InstallUnknown,
+			},
+			want: `Databricks CLI v0.240.0
+A new version is available: 0.245.0
+Download the latest release: https://github.com/databricks/cli/releases
+`,
+		},
+		{
+			name: "up to date",
+			result: versioncheck.Result{
+				CurrentVersion:  "0.245.0",
+				LatestVersion:   "0.245.0",
+				UpdateAvailable: false,
+			},
+			want: `Databricks CLI v0.245.0
+You're on the latest version.
+`,
+		},
+		{
+			name: "development build",
+			result: versioncheck.Result{
+				CurrentVersion:   "0.0.0-dev+abc123",
+				DevelopmentBuild: true,
+			},
+			want: `Databricks CLI v0.0.0-dev+abc123
+This is a development build; skipping the update check.
+`,
+		},
+		{
+			name: "check failed",
+			result: versioncheck.Result{
+				CurrentVersion: "0.240.0",
+				CheckFailed:    true,
+			},
+			want: `Databricks CLI v0.240.0
+Could not reach GitHub to check for a newer version. See https://github.com/databricks/cli/releases for the latest release.
+`,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx, out := cmdio.NewTestContextWithStdout(t.Context())
+			err := cmdio.RenderWithTemplate(ctx, tt.result, "", updateCheckTemplate)
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, out.String())
+		})
+	}
+}
diff --git a/cmd/workspace/access-control/access-control.go b/cmd/workspace/access-control/access-control.go
old mode 100755
new mode 100644
index b5db3d2a313..f3571d21c3f
--- a/cmd/workspace/access-control/access-control.go
+++ b/cmd/workspace/access-control/access-control.go
@@ -3,7 +3,7 @@
 package access_control
 
 import (
-	"fmt"
+	"errors"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
@@ -29,6 +29,10 @@ func New() *cobra.Command {
 		RunE:   root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
 	// Add methods
 	cmd.AddCommand(newCheckPolicy())
 
@@ -64,6 +68,8 @@ func newCheckPolicy() *cobra.Command {
 	cmd.Long = `Check access policy to a resource.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -82,7 +88,7 @@ func newCheckPolicy() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := w.AccessControl.CheckPolicy(ctx, checkPolicyReq)
diff --git a/cmd/workspace/agent-bricks/agent-bricks.go b/cmd/workspace/agent-bricks/agent-bricks.go
old mode 100755
new mode 100644
index 0a043ce8203..145b4198dee
--- a/cmd/workspace/agent-bricks/agent-bricks.go
+++ b/cmd/workspace/agent-bricks/agent-bricks.go
@@ -3,7 +3,7 @@
 package agent_bricks
 
 import (
-	"fmt"
+	"errors"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
@@ -30,6 +30,10 @@ func New() *cobra.Command {
 		RunE:   root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
 	// Add methods
 	cmd.AddCommand(newCancelOptimize())
 	cmd.AddCommand(newCreateCustomLlm())
@@ -65,6 +69,8 @@ func newCancelOptimize() *cobra.Command {
 	cmd.Long = `Cancel a Custom LLM Optimization Run.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -127,12 +133,14 @@ func newCreateCustomLlm() *cobra.Command {
     INSTRUCTIONS: Instructions for the custom LLM to follow`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'instructions' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'instructions' in your JSON input")
 			}
 			return nil
 		}
@@ -206,6 +214,8 @@ func newDeleteCustomLlm() *cobra.Command {
     ID: The id of the custom llm`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -260,6 +270,8 @@ func newGetCustomLlm() *cobra.Command {
     ID: The id of the custom llm`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -315,6 +327,8 @@ func newStartOptimize() *cobra.Command {
     ID: The Id of the tile.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -373,6 +387,8 @@ func newUpdateCustomLlm() *cobra.Command {
     ID: The id of the custom llm`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -396,7 +412,7 @@ func newUpdateCustomLlm() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 		updateCustomLlmReq.Id = args[0]
 
diff --git a/cmd/workspace/agent-kit/agent-kit.go b/cmd/workspace/agent-kit/agent-kit.go
new file mode 100644
index 00000000000..00718cdbcaf
--- /dev/null
+++ b/cmd/workspace/agent-kit/agent-kit.go
@@ -0,0 +1,2225 @@
+// Code generated from OpenAPI specs by Databricks SDK Generator. DO NOT EDIT.
+
+package agent_kit
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/databricks-sdk-go/common/types/fieldmask"
+	"github.com/databricks/databricks-sdk-go/service/agentkit"
+	"github.com/spf13/cobra"
+)
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var cmdOverrides []func(*cobra.Command)
+
+func New() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "agent-kit",
+		Short: `*Beta* APIs for managing agent memory and durable session state.`,
+		Long: `This command is in Beta and may change without notice.
+
+APIs for managing agent memory and durable session state. This interface is
+  under active development and may change.`,
+		GroupID: "agentbricks",
+		RunE:    root.ReportUnknownSubcommand,
+	}
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	// Add methods
+	cmd.AddCommand(newAppendSessionItems())
+	cmd.AddCommand(newClearSessionItems())
+	cmd.AddCommand(newCreateMemory())
+	cmd.AddCommand(newCreateMemoryStore())
+	cmd.AddCommand(newCreateSession())
+	cmd.AddCommand(newCreateSessionStore())
+	cmd.AddCommand(newDeleteMemory())
+	cmd.AddCommand(newDeleteMemoryStore())
+	cmd.AddCommand(newDeleteSession())
+	cmd.AddCommand(newDeleteSessionStore())
+	cmd.AddCommand(newExtractMemories())
+	cmd.AddCommand(newForkSession())
+	cmd.AddCommand(newGetMemory())
+	cmd.AddCommand(newGetMemoryStore())
+	cmd.AddCommand(newGetSession())
+	cmd.AddCommand(newGetSessionStore())
+	cmd.AddCommand(newListMemories())
+	cmd.AddCommand(newListMemoryStores())
+	cmd.AddCommand(newListSessionItems())
+	cmd.AddCommand(newListSessionStores())
+	cmd.AddCommand(newListSessions())
+	cmd.AddCommand(newPopSessionItem())
+	cmd.AddCommand(newSearchMemories())
+	cmd.AddCommand(newUpdateMemory())
+	cmd.AddCommand(newUpdateMemoryStore())
+	cmd.AddCommand(newUpdateSession())
+	cmd.AddCommand(newUpdateSessionStore())
+
+	// Apply optional overrides to this command.
+	for _, fn := range cmdOverrides {
+		fn(cmd)
+	}
+
+	return cmd
+}
+
+// start append-session-items command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var appendSessionItemsOverrides []func(
+	*cobra.Command,
+	*agentkit.AppendSessionItemsRequest,
+)
+
+func newAppendSessionItems() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var appendSessionItemsReq agentkit.AppendSessionItemsRequest
+	var appendSessionItemsJson flags.JsonFlag
+
+	cmd.Flags().Var(&appendSessionItemsJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Use = "append-session-items PARENT"
+	cmd.Short = `*Beta* Append items to a session.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Append items to a session.
+
+  Appends items to a session.
+
+  Arguments:
+    PARENT: Resource name of the containing session, in the form
+      session-stores/{session_store_id}/sessions/{session_id}.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := appendSessionItemsJson.Unmarshal(&appendSessionItemsReq)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		} else {
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
+		}
+		appendSessionItemsReq.Parent = args[0]
+
+		response, err := w.AgentKit.AppendSessionItems(ctx, appendSessionItemsReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range appendSessionItemsOverrides {
+		fn(cmd, &appendSessionItemsReq)
+	}
+
+	return cmd
+}
+
+// start clear-session-items command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var clearSessionItemsOverrides []func(
+	*cobra.Command,
+	*agentkit.ClearSessionItemsRequest,
+)
+
+func newClearSessionItems() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var clearSessionItemsReq agentkit.ClearSessionItemsRequest
+
+	cmd.Use = "clear-session-items PARENT"
+	cmd.Short = `*Beta* Clear items from a session.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Clear items from a session.
+
+  Clears all items from a session.
+
+  Arguments:
+    PARENT: Resource name of the containing session, in the form
+      session-stores/{session_store_id}/sessions/{session_id}.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		clearSessionItemsReq.Parent = args[0]
+
+		response, err := w.AgentKit.ClearSessionItems(ctx, clearSessionItemsReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range clearSessionItemsOverrides {
+		fn(cmd, &clearSessionItemsReq)
+	}
+
+	return cmd
+}
+
+// start create-memory command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var createMemoryOverrides []func(
+	*cobra.Command,
+	*agentkit.CreateManagedMemoryEntryRequest,
+)
+
+func newCreateMemory() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var createMemoryReq agentkit.CreateManagedMemoryEntryRequest
+	createMemoryReq.ManagedMemoryEntry = agentkit.ManagedMemoryEntry{}
+	var createMemoryJson flags.JsonFlag
+
+	cmd.Flags().Var(&createMemoryJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&createMemoryReq.ManagedMemoryEntryId, "managed-memory-entry-id", createMemoryReq.ManagedMemoryEntryId, `Optional caller-selected memory entry ID.`)
+	cmd.Flags().StringVar(&createMemoryReq.ManagedMemoryEntry.Content, "content", createMemoryReq.ManagedMemoryEntry.Content, `Optional free-form memory content.`)
+	cmd.Flags().StringVar(&createMemoryReq.ManagedMemoryEntry.Description, "description", createMemoryReq.ManagedMemoryEntry.Description, `Human-readable description of the memory entry.`)
+	cmd.Flags().StringVar(&createMemoryReq.ManagedMemoryEntry.SessionId, "session-id", createMemoryReq.ManagedMemoryEntry.SessionId, `Optional identifier for the session associated with this memory entry.`)
+	cmd.Flags().Var(&createMemoryReq.ManagedMemoryEntry.SourceType, "source-type", `Which writer created this entry. Supported values: [MANAGED_MEMORY_ENTRY_SOURCE_TYPE_AGENT, MANAGED_MEMORY_ENTRY_SOURCE_TYPE_DREAMER]`)
+
+	cmd.Use = "create-memory PARENT ACTOR_ID PATH"
+	cmd.Short = `*Beta* Create a memory entry.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Create a memory entry.
+
+  Creates a memory entry using exclusive-create semantics. Callers may choose
+  the entry ID; the service generates one when it is omitted. Returns
+  ALREADY_EXISTS when an entry with the same actor, session, and path already
+  exists. Omitted session_id is its own uniqueness key: two omitted-session
+  entries with the same actor and path conflict, but an omitted-session entry
+  does not conflict with a session-scoped entry at the same actor and path.
+
+  Arguments:
+    PARENT: Memory store that will contain the entry, in the form
+      memory-stores/{managed_memory_store_id}.
+    ACTOR_ID: Customer-provided identifier for the actor whose memory this entry
+      represents.
+    PATH: Absolute, case-sensitive path identifying the entry within its actor and
+      optional session. Paths must begin with / and must not contain empty,
+      . or .. segments.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(1)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only PARENT as positional arguments. Provide 'actor_id', 'path' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(3)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := createMemoryJson.Unmarshal(&createMemoryReq.ManagedMemoryEntry)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		createMemoryReq.Parent = args[0]
+		if !cmd.Flags().Changed("json") {
+			createMemoryReq.ManagedMemoryEntry.ActorId = args[1]
+		}
+		if !cmd.Flags().Changed("json") {
+			createMemoryReq.ManagedMemoryEntry.Path = args[2]
+		}
+
+		response, err := w.AgentKit.CreateMemory(ctx, createMemoryReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range createMemoryOverrides {
+		fn(cmd, &createMemoryReq)
+	}
+
+	return cmd
+}
+
+// start create-memory-store command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var createMemoryStoreOverrides []func(
+	*cobra.Command,
+	*agentkit.CreateManagedMemoryStoreRequest,
+)
+
+func newCreateMemoryStore() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var createMemoryStoreReq agentkit.CreateManagedMemoryStoreRequest
+	createMemoryStoreReq.ManagedMemoryStore = agentkit.ManagedMemoryStore{}
+	var createMemoryStoreJson flags.JsonFlag
+
+	cmd.Flags().Var(&createMemoryStoreJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&createMemoryStoreReq.ManagedMemoryStore.Description, "description", createMemoryStoreReq.ManagedMemoryStore.Description, `Human-readable description of the memory store.`)
+	cmd.Flags().StringVar(&createMemoryStoreReq.ManagedMemoryStore.DisplayName, "display-name", createMemoryStoreReq.ManagedMemoryStore.DisplayName, `Deprecated compatibility alias for the caller-provided memory store ID.`)
+	// TODO: complex arg: storage_backend
+
+	cmd.Use = "create-memory-store MANAGED_MEMORY_STORE_ID"
+	cmd.Short = `*Beta* Create a memory store.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Create a memory store.
+
+  Creates a memory store in the caller's workspace.
+
+  Arguments:
+    MANAGED_MEMORY_STORE_ID: Caller-provided, workspace-unique memory store ID. It must be 3-56
+      characters, begin with a lowercase letter, contain only lowercase letters,
+      digits, and hyphens, and end with a letter or digit.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := createMemoryStoreJson.Unmarshal(&createMemoryStoreReq.ManagedMemoryStore)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		createMemoryStoreReq.ManagedMemoryStoreId = args[0]
+
+		response, err := w.AgentKit.CreateMemoryStore(ctx, createMemoryStoreReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range createMemoryStoreOverrides {
+		fn(cmd, &createMemoryStoreReq)
+	}
+
+	return cmd
+}
+
+// start create-session command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var createSessionOverrides []func(
+	*cobra.Command,
+	*agentkit.CreateSessionRequest,
+)
+
+func newCreateSession() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var createSessionReq agentkit.CreateSessionRequest
+	createSessionReq.Session = agentkit.Session{}
+	var createSessionJson flags.JsonFlag
+
+	cmd.Flags().Var(&createSessionJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&createSessionReq.SessionId, "session-id", createSessionReq.SessionId, `Optional caller-selected session ID.`)
+	// TODO: map via StringToStringVar: metadata
+	cmd.Flags().StringVar(&createSessionReq.Session.ParentSessionId, "parent-session-id", createSessionReq.Session.ParentSessionId, `Immediate parent session ID.`)
+
+	cmd.Use = "create-session PARENT ACTOR_ID"
+	cmd.Short = `*Beta* Create a session.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Create a session.
+
+  Creates a session within a session store.
+
+  Arguments:
+    PARENT: Resource name of the containing session store, in the form
+      session-stores/{session_store_id}.
+    ACTOR_ID: Opaque caller-provided identifier for the application actor associated
+      with the session.
+
+      This is application data and has no Databricks authentication or
+      authorization semantics. Use the same value as the Managed Memory Entry
+      actor_id when storing memories associated with this actor. Every session
+      must set it. A child session must use the same value as its parent.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(1)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only PARENT as positional arguments. Provide 'actor_id' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := createSessionJson.Unmarshal(&createSessionReq.Session)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		createSessionReq.Parent = args[0]
+		if !cmd.Flags().Changed("json") {
+			createSessionReq.Session.ActorId = args[1]
+		}
+
+		response, err := w.AgentKit.CreateSession(ctx, createSessionReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range createSessionOverrides {
+		fn(cmd, &createSessionReq)
+	}
+
+	return cmd
+}
+
+// start create-session-store command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var createSessionStoreOverrides []func(
+	*cobra.Command,
+	*agentkit.CreateSessionStoreRequest,
+)
+
+func newCreateSessionStore() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var createSessionStoreReq agentkit.CreateSessionStoreRequest
+	createSessionStoreReq.SessionStore = agentkit.SessionStore{}
+	var createSessionStoreJson flags.JsonFlag
+
+	cmd.Flags().Var(&createSessionStoreJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&createSessionStoreReq.SessionStore.Description, "description", createSessionStoreReq.SessionStore.Description, `Human-readable description of the session store.`)
+	// TODO: map via StringToStringVar: metadata
+
+	cmd.Use = "create-session-store SESSION_STORE_ID"
+	cmd.Short = `*Beta* Create a session store.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Create a session store.
+
+  Creates a session store.
+
+  Arguments:
+    SESSION_STORE_ID: Caller-provided, workspace-unique session store ID. It must be 3-55
+      characters, begin with a lowercase letter, and contain only lowercase
+      letters, digits, and hyphens.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := createSessionStoreJson.Unmarshal(&createSessionStoreReq.SessionStore)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		createSessionStoreReq.SessionStoreId = args[0]
+
+		response, err := w.AgentKit.CreateSessionStore(ctx, createSessionStoreReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range createSessionStoreOverrides {
+		fn(cmd, &createSessionStoreReq)
+	}
+
+	return cmd
+}
+
+// start delete-memory command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteMemoryOverrides []func(
+	*cobra.Command,
+	*agentkit.DeleteManagedMemoryEntryRequest,
+)
+
+func newDeleteMemory() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteMemoryReq agentkit.DeleteManagedMemoryEntryRequest
+
+	cmd.Use = "delete-memory NAME"
+	cmd.Short = `*Beta* Delete a memory entry by resource name.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Delete a memory entry by resource name.
+
+  Deletes a memory entry by resource name. Returns NOT_FOUND when the entry
+  does not exist in the caller's workspace.
+
+  Arguments:
+    NAME: Resource name in the form
+      memory-stores/{managed_memory_store_id}/entries/{managed_memory_entry_id}.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		deleteMemoryReq.Name = args[0]
+
+		err = w.AgentKit.DeleteMemory(ctx, deleteMemoryReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteMemoryOverrides {
+		fn(cmd, &deleteMemoryReq)
+	}
+
+	return cmd
+}
+
+// start delete-memory-store command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteMemoryStoreOverrides []func(
+	*cobra.Command,
+	*agentkit.DeleteManagedMemoryStoreRequest,
+)
+
+func newDeleteMemoryStore() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteMemoryStoreReq agentkit.DeleteManagedMemoryStoreRequest
+
+	cmd.Use = "delete-memory-store NAME"
+	cmd.Short = `*Beta* Delete a memory store by resource name.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Delete a memory store by resource name.
+
+  Deletes a memory store by resource name. Returns NOT_FOUND when the store
+  does not exist in the caller's workspace.
+
+  Arguments:
+    NAME: Resource name in the form memory-stores/{managed_memory_store_id}.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		deleteMemoryStoreReq.Name = args[0]
+
+		err = w.AgentKit.DeleteMemoryStore(ctx, deleteMemoryStoreReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteMemoryStoreOverrides {
+		fn(cmd, &deleteMemoryStoreReq)
+	}
+
+	return cmd
+}
+
+// start delete-session command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteSessionOverrides []func(
+	*cobra.Command,
+	*agentkit.DeleteSessionRequest,
+)
+
+func newDeleteSession() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteSessionReq agentkit.DeleteSessionRequest
+
+	cmd.Use = "delete-session NAME"
+	cmd.Short = `*Beta* Delete a session.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Delete a session.
+
+  Deletes a session, its items, and any descendant sessions recursively.
+  Independently retained memory is not deleted.
+
+  Arguments:
+    NAME: Resource name in the form
+      session-stores/{session_store_id}/sessions/{session_id}.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		deleteSessionReq.Name = args[0]
+
+		err = w.AgentKit.DeleteSession(ctx, deleteSessionReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteSessionOverrides {
+		fn(cmd, &deleteSessionReq)
+	}
+
+	return cmd
+}
+
+// start delete-session-store command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteSessionStoreOverrides []func(
+	*cobra.Command,
+	*agentkit.DeleteSessionStoreRequest,
+)
+
+func newDeleteSessionStore() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteSessionStoreReq agentkit.DeleteSessionStoreRequest
+
+	cmd.Use = "delete-session-store NAME"
+	cmd.Short = `*Beta* Delete a session store.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Delete a session store.
+
+  Deletes a session store, its sessions and items, and its service-managed
+  storage. Memory entries retained by a separate Memory Store are not deleted.
+
+  Arguments:
+    NAME: Resource name in the form session-stores/{session_store_id}.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		deleteSessionStoreReq.Name = args[0]
+
+		err = w.AgentKit.DeleteSessionStore(ctx, deleteSessionStoreReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteSessionStoreOverrides {
+		fn(cmd, &deleteSessionStoreReq)
+	}
+
+	return cmd
+}
+
+// start extract-memories command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var extractMemoriesOverrides []func(
+	*cobra.Command,
+	*agentkit.ExtractMemoriesRequest,
+)
+
+func newExtractMemories() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var extractMemoriesReq agentkit.ExtractMemoriesRequest
+	var extractMemoriesJson flags.JsonFlag
+
+	cmd.Flags().Var(&extractMemoriesJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().BoolVar(&extractMemoriesReq.DryRun, "dry-run", extractMemoriesReq.DryRun, `When true, extract and return the entries without writing them to the memory store.`)
+	cmd.Flags().StringVar(&extractMemoriesReq.Instructions, "instructions", extractMemoriesReq.Instructions, `Instructions steering what is extracted from the session.`)
+
+	cmd.Use = "extract-memories SESSION_STORE SESSION_ID MEMORY_STORE"
+	cmd.Short = `*Beta* Extract memories from a session.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Extract memories from a session.
+
+  Synchronously extracts memories from a single session into the given memory
+  store, returning the entries that were written.
+
+  Arguments:
+    SESSION_STORE: Session store containing the session, in the form
+      session-stores/{session_store_id}.
+    SESSION_ID: Identifier of the session whose transcript is distilled into memories.
+    MEMORY_STORE: Memory store the extracted entries are written to, in the form
+      memory-stores/{managed_memory_store_id}.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(2)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only SESSION_STORE, SESSION_ID as positional arguments. Provide 'memory_store' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(3)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := extractMemoriesJson.Unmarshal(&extractMemoriesReq)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		extractMemoriesReq.SessionStore = args[0]
+		extractMemoriesReq.SessionId = args[1]
+		if !cmd.Flags().Changed("json") {
+			extractMemoriesReq.MemoryStore = args[2]
+		}
+
+		response, err := w.AgentKit.ExtractMemories(ctx, extractMemoriesReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range extractMemoriesOverrides {
+		fn(cmd, &extractMemoriesReq)
+	}
+
+	return cmd
+}
+
+// start fork-session command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var forkSessionOverrides []func(
+	*cobra.Command,
+	*agentkit.ForkSessionRequest,
+)
+
+func newForkSession() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var forkSessionReq agentkit.ForkSessionRequest
+	var forkSessionJson flags.JsonFlag
+
+	cmd.Flags().Var(&forkSessionJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: map via StringToStringVar: metadata
+	cmd.Flags().StringVar(&forkSessionReq.SessionId, "session-id", forkSessionReq.SessionId, `Optional unique ID for the forked session.`)
+	cmd.Flags().StringVar(&forkSessionReq.UpToItemId, "up-to-item-id", forkSessionReq.UpToItemId, `Optional last item ID to copy through, inclusively.`)
+
+	cmd.Use = "fork-session PARENT SOURCE_SESSION_ID ACTOR_ID"
+	cmd.Short = `*Beta* Fork a session.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Fork a session.
+
+  Forks a session into an independent top-level copy.
+
+  Arguments:
+    PARENT: Resource name of the containing session store, in the form
+      session-stores/{session_store_id}.
+    SOURCE_SESSION_ID: ID of the session to copy.
+    ACTOR_ID: Opaque caller-provided identifier for the application actor associated
+      with the forked session.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(1)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only PARENT as positional arguments. Provide 'source_session_id', 'actor_id' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(3)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := forkSessionJson.Unmarshal(&forkSessionReq)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		forkSessionReq.Parent = args[0]
+		if !cmd.Flags().Changed("json") {
+			forkSessionReq.SourceSessionId = args[1]
+		}
+		if !cmd.Flags().Changed("json") {
+			forkSessionReq.ActorId = args[2]
+		}
+
+		response, err := w.AgentKit.ForkSession(ctx, forkSessionReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range forkSessionOverrides {
+		fn(cmd, &forkSessionReq)
+	}
+
+	return cmd
+}
+
+// start get-memory command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getMemoryOverrides []func(
+	*cobra.Command,
+	*agentkit.GetManagedMemoryEntryRequest,
+)
+
+func newGetMemory() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getMemoryReq agentkit.GetManagedMemoryEntryRequest
+
+	cmd.Flags().Var(&getMemoryReq.View, "view", `Controls whether the response includes memory content. Supported values: [MANAGED_MEMORY_ENTRY_VIEW_BASIC, MANAGED_MEMORY_ENTRY_VIEW_FULL]`)
+
+	cmd.Use = "get-memory NAME"
+	cmd.Short = `*Beta* Get a memory entry by resource name.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get a memory entry by resource name.
+
+  Retrieves a memory entry by resource name. view controls whether the
+  response includes memory content. Returns NOT_FOUND when the entry does not
+  exist in the caller's workspace.
+
+  Arguments:
+    NAME: Resource name in the form
+      memory-stores/{managed_memory_store_id}/entries/{managed_memory_entry_id}.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getMemoryReq.Name = args[0]
+
+		response, err := w.AgentKit.GetMemory(ctx, getMemoryReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getMemoryOverrides {
+		fn(cmd, &getMemoryReq)
+	}
+
+	return cmd
+}
+
+// start get-memory-store command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getMemoryStoreOverrides []func(
+	*cobra.Command,
+	*agentkit.GetManagedMemoryStoreRequest,
+)
+
+func newGetMemoryStore() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getMemoryStoreReq agentkit.GetManagedMemoryStoreRequest
+
+	cmd.Use = "get-memory-store NAME"
+	cmd.Short = `*Beta* Get a memory store by resource name.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get a memory store by resource name.
+
+  Retrieves a memory store by resource name. Returns NOT_FOUND when the store
+  does not exist in the caller's workspace.
+
+  Arguments:
+    NAME: Resource name in the form memory-stores/{managed_memory_store_id}.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getMemoryStoreReq.Name = args[0]
+
+		response, err := w.AgentKit.GetMemoryStore(ctx, getMemoryStoreReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getMemoryStoreOverrides {
+		fn(cmd, &getMemoryStoreReq)
+	}
+
+	return cmd
+}
+
+// start get-session command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getSessionOverrides []func(
+	*cobra.Command,
+	*agentkit.GetSessionRequest,
+)
+
+func newGetSession() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getSessionReq agentkit.GetSessionRequest
+
+	cmd.Use = "get-session NAME"
+	cmd.Short = `*Beta* Get a session.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get a session.
+
+  Gets a session by resource name.
+
+  Arguments:
+    NAME: Resource name in the form
+      session-stores/{session_store_id}/sessions/{session_id}.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getSessionReq.Name = args[0]
+
+		response, err := w.AgentKit.GetSession(ctx, getSessionReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getSessionOverrides {
+		fn(cmd, &getSessionReq)
+	}
+
+	return cmd
+}
+
+// start get-session-store command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getSessionStoreOverrides []func(
+	*cobra.Command,
+	*agentkit.GetSessionStoreRequest,
+)
+
+func newGetSessionStore() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getSessionStoreReq agentkit.GetSessionStoreRequest
+
+	cmd.Use = "get-session-store NAME"
+	cmd.Short = `*Beta* Get a session store.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get a session store.
+
+  Gets a session store by resource name.
+
+  Arguments:
+    NAME: Resource name in the form session-stores/{session_store_id}.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getSessionStoreReq.Name = args[0]
+
+		response, err := w.AgentKit.GetSessionStore(ctx, getSessionStoreReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getSessionStoreOverrides {
+		fn(cmd, &getSessionStoreReq)
+	}
+
+	return cmd
+}
+
+// start list-memories command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listMemoriesOverrides []func(
+	*cobra.Command,
+	*agentkit.ListManagedMemoryEntriesRequest,
+)
+
+func newListMemories() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listMemoriesReq agentkit.ListManagedMemoryEntriesRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listMemoriesLimit int
+
+	cmd.Flags().IntVar(&listMemoriesReq.PageSize, "page-size", listMemoriesReq.PageSize, `Maximum number of entries to return.`)
+	cmd.Flags().StringVar(&listMemoriesReq.PathPrefix, "path-prefix", listMemoriesReq.PathPrefix, `Optional path prefix used to restrict entries within the actor partition.`)
+	cmd.Flags().StringVar(&listMemoriesReq.SessionId, "session-id", listMemoriesReq.SessionId, `Optional session identifier.`)
+	cmd.Flags().Var(&listMemoriesReq.View, "view", `Controls whether each returned entry includes memory content. Supported values: [MANAGED_MEMORY_ENTRY_VIEW_BASIC, MANAGED_MEMORY_ENTRY_VIEW_FULL]`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listMemoriesLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listMemoriesReq.PageToken, "page-token", listMemoriesReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-memories PARENT ACTOR_ID"
+	cmd.Short = `*Beta* List memory entries.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+List memory entries.
+
+  Lists memory entries for one actor. An exact path filters entries across
+  sessions, ignoring session metadata. Otherwise, session_id and path_prefix
+  restrict the actor partition. view controls whether each returned entry
+  includes memory content.
+
+  Arguments:
+    PARENT: Memory store whose entries are listed, in the form
+      memory-stores/{managed_memory_store_id}.
+    ACTOR_ID: Customer-provided identifier for the actor whose entries are listed.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		listMemoriesReq.Parent = args[0]
+		listMemoriesReq.ActorId = args[1]
+
+		response := w.AgentKit.ListMemories(ctx, listMemoriesReq)
+		if listMemoriesLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listMemoriesLimit)
+		}
+		if listMemoriesLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listMemoriesLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listMemoriesOverrides {
+		fn(cmd, &listMemoriesReq)
+	}
+
+	return cmd
+}
+
+// start list-memory-stores command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listMemoryStoresOverrides []func(
+	*cobra.Command,
+	*agentkit.ListManagedMemoryStoresRequest,
+)
+
+func newListMemoryStores() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listMemoryStoresReq agentkit.ListManagedMemoryStoresRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listMemoryStoresLimit int
+
+	cmd.Flags().IntVar(&listMemoryStoresReq.PageSize, "page-size", listMemoryStoresReq.PageSize, `Maximum number of stores to return.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listMemoryStoresLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listMemoryStoresReq.PageToken, "page-token", listMemoryStoresReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-memory-stores"
+	cmd.Short = `*Beta* List memory stores.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+List memory stores.
+
+  Lists memory stores in the caller's workspace.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(0)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		response := w.AgentKit.ListMemoryStores(ctx, listMemoryStoresReq)
+		if listMemoryStoresLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listMemoryStoresLimit)
+		}
+		if listMemoryStoresLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listMemoryStoresLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listMemoryStoresOverrides {
+		fn(cmd, &listMemoryStoresReq)
+	}
+
+	return cmd
+}
+
+// start list-session-items command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listSessionItemsOverrides []func(
+	*cobra.Command,
+	*agentkit.ListSessionItemsRequest,
+)
+
+func newListSessionItems() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listSessionItemsReq agentkit.ListSessionItemsRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listSessionItemsLimit int
+
+	cmd.Flags().StringVar(&listSessionItemsReq.OrderBy, "order-by", listSessionItemsReq.OrderBy, `Sort order.`)
+	cmd.Flags().IntVar(&listSessionItemsReq.PageSize, "page-size", listSessionItemsReq.PageSize, `Maximum number of items to return.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listSessionItemsLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listSessionItemsReq.PageToken, "page-token", listSessionItemsReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-session-items PARENT"
+	cmd.Short = `*Beta* List session items.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+List session items.
+
+  Lists items in a session.
+
+  Arguments:
+    PARENT: Resource name of the containing session, in the form
+      session-stores/{session_store_id}/sessions/{session_id}.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		listSessionItemsReq.Parent = args[0]
+
+		response := w.AgentKit.ListSessionItems(ctx, listSessionItemsReq)
+		if listSessionItemsLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listSessionItemsLimit)
+		}
+		if listSessionItemsLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listSessionItemsLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listSessionItemsOverrides {
+		fn(cmd, &listSessionItemsReq)
+	}
+
+	return cmd
+}
+
+// start list-session-stores command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listSessionStoresOverrides []func(
+	*cobra.Command,
+	*agentkit.ListSessionStoresRequest,
+)
+
+func newListSessionStores() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listSessionStoresReq agentkit.ListSessionStoresRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listSessionStoresLimit int
+
+	cmd.Flags().IntVar(&listSessionStoresReq.PageSize, "page-size", listSessionStoresReq.PageSize, `Maximum number of session stores to return.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listSessionStoresLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listSessionStoresReq.PageToken, "page-token", listSessionStoresReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-session-stores"
+	cmd.Short = `*Beta* List session stores.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+List session stores.
+
+  Lists session stores.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(0)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		response := w.AgentKit.ListSessionStores(ctx, listSessionStoresReq)
+		if listSessionStoresLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listSessionStoresLimit)
+		}
+		if listSessionStoresLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listSessionStoresLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listSessionStoresOverrides {
+		fn(cmd, &listSessionStoresReq)
+	}
+
+	return cmd
+}
+
+// start list-sessions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listSessionsOverrides []func(
+	*cobra.Command,
+	*agentkit.ListSessionsRequest,
+)
+
+func newListSessions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listSessionsReq agentkit.ListSessionsRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listSessionsLimit int
+
+	cmd.Flags().StringVar(&listSessionsReq.Filter, "filter", listSessionsReq.Filter, `Filter expression.`)
+	cmd.Flags().StringVar(&listSessionsReq.OrderBy, "order-by", listSessionsReq.OrderBy, `Sort order.`)
+	cmd.Flags().IntVar(&listSessionsReq.PageSize, "page-size", listSessionsReq.PageSize, `Maximum number of sessions to return.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listSessionsLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listSessionsReq.PageToken, "page-token", listSessionsReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-sessions PARENT"
+	cmd.Short = `*Beta* List sessions.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+List sessions.
+
+  Lists sessions within a session store.
+
+  Arguments:
+    PARENT: Resource name of the containing session store, in the form
+      session-stores/{session_store_id}.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		listSessionsReq.Parent = args[0]
+
+		response := w.AgentKit.ListSessions(ctx, listSessionsReq)
+		if listSessionsLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listSessionsLimit)
+		}
+		if listSessionsLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listSessionsLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listSessionsOverrides {
+		fn(cmd, &listSessionsReq)
+	}
+
+	return cmd
+}
+
+// start pop-session-item command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var popSessionItemOverrides []func(
+	*cobra.Command,
+	*agentkit.PopSessionItemRequest,
+)
+
+func newPopSessionItem() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var popSessionItemReq agentkit.PopSessionItemRequest
+
+	cmd.Use = "pop-session-item PARENT"
+	cmd.Short = `*Beta* Pop an item from a session.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Pop an item from a session.
+
+  Pops the newest item from a session.
+
+  Arguments:
+    PARENT: Resource name of the containing session, in the form
+      session-stores/{session_store_id}/sessions/{session_id}.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		popSessionItemReq.Parent = args[0]
+
+		response, err := w.AgentKit.PopSessionItem(ctx, popSessionItemReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range popSessionItemOverrides {
+		fn(cmd, &popSessionItemReq)
+	}
+
+	return cmd
+}
+
+// start search-memories command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var searchMemoriesOverrides []func(
+	*cobra.Command,
+	*agentkit.SearchManagedMemoryEntriesRequest,
+)
+
+func newSearchMemories() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var searchMemoriesReq agentkit.SearchManagedMemoryEntriesRequest
+	var searchMemoriesJson flags.JsonFlag
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var searchMemoriesLimit int
+
+	cmd.Flags().Var(&searchMemoriesJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().IntVar(&searchMemoriesReq.PageSize, "page-size", searchMemoriesReq.PageSize, `Maximum number of relevance-ranked entries to return.`)
+	cmd.Flags().StringVar(&searchMemoriesReq.PathPrefix, "path-prefix", searchMemoriesReq.PathPrefix, `Optional absolute, case-sensitive path prefix used to restrict searched entries within the actor partition.`)
+	cmd.Flags().StringVar(&searchMemoriesReq.SessionId, "session-id", searchMemoriesReq.SessionId, `Optional session identifier.`)
+	cmd.Flags().Var(&searchMemoriesReq.View, "view", `Controls whether each returned entry includes memory content. Supported values: [MANAGED_MEMORY_ENTRY_VIEW_BASIC, MANAGED_MEMORY_ENTRY_VIEW_FULL]`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&searchMemoriesLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&searchMemoriesReq.PageToken, "page-token", searchMemoriesReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "search-memories PARENT ACTOR_ID QUERY"
+	cmd.Short = `*Beta* Search memory entries.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Search memory entries.
+
+  Searches memory entries by text query for one actor. Returns matching entries
+  and scores ranked by relevance; view controls whether each returned entry
+  includes content.
+
+  Arguments:
+    PARENT: Memory store whose entries are searched, in the form
+      memory-stores/{managed_memory_store_id}.
+    ACTOR_ID: Customer-provided identifier for the actor whose entries are searched.
+    QUERY: Free-form search query.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(1)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only PARENT as positional arguments. Provide 'actor_id', 'query' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(3)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := searchMemoriesJson.Unmarshal(&searchMemoriesReq)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		searchMemoriesReq.Parent = args[0]
+		if !cmd.Flags().Changed("json") {
+			searchMemoriesReq.ActorId = args[1]
+		}
+		if !cmd.Flags().Changed("json") {
+			searchMemoriesReq.Query = args[2]
+		}
+
+		response := w.AgentKit.SearchMemories(ctx, searchMemoriesReq)
+		if searchMemoriesLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", searchMemoriesLimit)
+		}
+		if searchMemoriesLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, searchMemoriesLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range searchMemoriesOverrides {
+		fn(cmd, &searchMemoriesReq)
+	}
+
+	return cmd
+}
+
+// start update-memory command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateMemoryOverrides []func(
+	*cobra.Command,
+	*agentkit.UpdateManagedMemoryEntryRequest,
+)
+
+func newUpdateMemory() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateMemoryReq agentkit.UpdateManagedMemoryEntryRequest
+	updateMemoryReq.ManagedMemoryEntry = agentkit.ManagedMemoryEntry{}
+	var updateMemoryJson flags.JsonFlag
+
+	cmd.Flags().Var(&updateMemoryJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&updateMemoryReq.ManagedMemoryEntry.Content, "content", updateMemoryReq.ManagedMemoryEntry.Content, `Optional free-form memory content.`)
+	cmd.Flags().StringVar(&updateMemoryReq.ManagedMemoryEntry.Description, "description", updateMemoryReq.ManagedMemoryEntry.Description, `Human-readable description of the memory entry.`)
+	cmd.Flags().StringVar(&updateMemoryReq.ManagedMemoryEntry.SessionId, "session-id", updateMemoryReq.ManagedMemoryEntry.SessionId, `Optional identifier for the session associated with this memory entry.`)
+	cmd.Flags().Var(&updateMemoryReq.ManagedMemoryEntry.SourceType, "source-type", `Which writer created this entry. Supported values: [MANAGED_MEMORY_ENTRY_SOURCE_TYPE_AGENT, MANAGED_MEMORY_ENTRY_SOURCE_TYPE_DREAMER]`)
+
+	cmd.Use = "update-memory NAME UPDATE_MASK ACTOR_ID PATH"
+	cmd.Short = `*Beta* Update a memory entry.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Update a memory entry.
+
+  Updates selected mutable fields on a memory entry. Identity fields are
+  immutable.
+
+  Arguments:
+    NAME: Resource name in the form
+      memory-stores/{managed_memory_store_id}/entries/{managed_memory_entry_id}.
+    UPDATE_MASK: Fields to update. Only content and description may be updated.
+    ACTOR_ID: Customer-provided identifier for the actor whose memory this entry
+      represents.
+    PATH: Absolute, case-sensitive path identifying the entry within its actor and
+      optional session. Paths must begin with / and must not contain empty,
+      . or .. segments.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(2)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only NAME, UPDATE_MASK as positional arguments. Provide 'actor_id', 'path' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(4)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updateMemoryJson.Unmarshal(&updateMemoryReq.ManagedMemoryEntry)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		updateMemoryReq.Name = args[0]
+		if args[1] != "" {
+			updateMaskArray := strings.Split(args[1], ",")
+			updateMemoryReq.UpdateMask = *fieldmask.New(updateMaskArray)
+		}
+		if !cmd.Flags().Changed("json") {
+			updateMemoryReq.ManagedMemoryEntry.ActorId = args[2]
+		}
+		if !cmd.Flags().Changed("json") {
+			updateMemoryReq.ManagedMemoryEntry.Path = args[3]
+		}
+
+		response, err := w.AgentKit.UpdateMemory(ctx, updateMemoryReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateMemoryOverrides {
+		fn(cmd, &updateMemoryReq)
+	}
+
+	return cmd
+}
+
+// start update-memory-store command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateMemoryStoreOverrides []func(
+	*cobra.Command,
+	*agentkit.UpdateManagedMemoryStoreRequest,
+)
+
+func newUpdateMemoryStore() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateMemoryStoreReq agentkit.UpdateManagedMemoryStoreRequest
+	updateMemoryStoreReq.ManagedMemoryStore = agentkit.ManagedMemoryStore{}
+	var updateMemoryStoreJson flags.JsonFlag
+
+	cmd.Flags().Var(&updateMemoryStoreJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&updateMemoryStoreReq.ManagedMemoryStore.Description, "description", updateMemoryStoreReq.ManagedMemoryStore.Description, `Human-readable description of the memory store.`)
+	cmd.Flags().StringVar(&updateMemoryStoreReq.ManagedMemoryStore.DisplayName, "display-name", updateMemoryStoreReq.ManagedMemoryStore.DisplayName, `Deprecated compatibility alias for the caller-provided memory store ID.`)
+	// TODO: complex arg: storage_backend
+
+	cmd.Use = "update-memory-store NAME UPDATE_MASK"
+	cmd.Short = `*Beta* Update a memory store.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Update a memory store.
+
+  Updates a memory store's description and metadata.
+
+  Arguments:
+    NAME: Resource name in the form memory-stores/{managed_memory_store_id}.
+    UPDATE_MASK: Only description and metadata may be updated. Selecting metadata
+      replaces the entire map.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updateMemoryStoreJson.Unmarshal(&updateMemoryStoreReq.ManagedMemoryStore)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		updateMemoryStoreReq.Name = args[0]
+		if args[1] != "" {
+			updateMaskArray := strings.Split(args[1], ",")
+			updateMemoryStoreReq.UpdateMask = *fieldmask.New(updateMaskArray)
+		}
+
+		response, err := w.AgentKit.UpdateMemoryStore(ctx, updateMemoryStoreReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateMemoryStoreOverrides {
+		fn(cmd, &updateMemoryStoreReq)
+	}
+
+	return cmd
+}
+
+// start update-session command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateSessionOverrides []func(
+	*cobra.Command,
+	*agentkit.UpdateSessionRequest,
+)
+
+func newUpdateSession() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateSessionReq agentkit.UpdateSessionRequest
+	updateSessionReq.Session = agentkit.Session{}
+	var updateSessionJson flags.JsonFlag
+
+	cmd.Flags().Var(&updateSessionJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: map via StringToStringVar: metadata
+	cmd.Flags().StringVar(&updateSessionReq.Session.ParentSessionId, "parent-session-id", updateSessionReq.Session.ParentSessionId, `Immediate parent session ID.`)
+
+	cmd.Use = "update-session NAME UPDATE_MASK ACTOR_ID"
+	cmd.Short = `*Beta* Update a session.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Update a session.
+
+  Updates a session's mutable fields.
+
+  Arguments:
+    NAME: Resource name in the form
+      session-stores/{session_store_id}/sessions/{session_id}.
+    UPDATE_MASK: Fields to update. Only metadata is mutable; any other path returns
+      INVALID_PARAMETER_VALUE.
+    ACTOR_ID: Opaque caller-provided identifier for the application actor associated
+      with the session.
+
+      This is application data and has no Databricks authentication or
+      authorization semantics. Use the same value as the Managed Memory Entry
+      actor_id when storing memories associated with this actor. Every session
+      must set it. A child session must use the same value as its parent.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(2)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only NAME, UPDATE_MASK as positional arguments. Provide 'actor_id' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(3)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updateSessionJson.Unmarshal(&updateSessionReq.Session)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		updateSessionReq.Name = args[0]
+		if args[1] != "" {
+			updateMaskArray := strings.Split(args[1], ",")
+			updateSessionReq.UpdateMask = *fieldmask.New(updateMaskArray)
+		}
+		if !cmd.Flags().Changed("json") {
+			updateSessionReq.Session.ActorId = args[2]
+		}
+
+		response, err := w.AgentKit.UpdateSession(ctx, updateSessionReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateSessionOverrides {
+		fn(cmd, &updateSessionReq)
+	}
+
+	return cmd
+}
+
+// start update-session-store command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateSessionStoreOverrides []func(
+	*cobra.Command,
+	*agentkit.UpdateSessionStoreRequest,
+)
+
+func newUpdateSessionStore() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateSessionStoreReq agentkit.UpdateSessionStoreRequest
+	updateSessionStoreReq.SessionStore = agentkit.SessionStore{}
+	var updateSessionStoreJson flags.JsonFlag
+
+	cmd.Flags().Var(&updateSessionStoreJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&updateSessionStoreReq.SessionStore.Description, "description", updateSessionStoreReq.SessionStore.Description, `Human-readable description of the session store.`)
+	// TODO: map via StringToStringVar: metadata
+
+	cmd.Use = "update-session-store NAME UPDATE_MASK"
+	cmd.Short = `*Beta* Update a session store.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Update a session store.
+
+  Updates a session store's description and metadata.
+
+  Arguments:
+    NAME: Resource name in the form session-stores/{session_store_id}.
+    UPDATE_MASK: Fields to update. Only description and metadata are mutable; any other
+      path returns INVALID_PARAMETER_VALUE.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updateSessionStoreJson.Unmarshal(&updateSessionStoreReq.SessionStore)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		updateSessionStoreReq.Name = args[0]
+		if args[1] != "" {
+			updateMaskArray := strings.Split(args[1], ",")
+			updateSessionStoreReq.UpdateMask = *fieldmask.New(updateMaskArray)
+		}
+
+		response, err := w.AgentKit.UpdateSessionStore(ctx, updateSessionStoreReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateSessionStoreOverrides {
+		fn(cmd, &updateSessionStoreReq)
+	}
+
+	return cmd
+}
+
+// end service AgentKit
diff --git a/cmd/workspace/ai-functions/ai-functions.go b/cmd/workspace/ai-functions/ai-functions.go
new file mode 100644
index 00000000000..942e2e097fc
--- /dev/null
+++ b/cmd/workspace/ai-functions/ai-functions.go
@@ -0,0 +1,353 @@
+// Code generated from OpenAPI specs by Databricks SDK Generator. DO NOT EDIT.
+
+package ai_functions
+
+import (
+	"errors"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/databricks-sdk-go/service/aifunctions"
+	"github.com/spf13/cobra"
+)
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var cmdOverrides []func(*cobra.Command)
+
+func New() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:     "ai-functions",
+		Short:   `Transform and enrich data with AI on Databricks.`,
+		Long:    `Transform and enrich data with AI on Databricks.`,
+		GroupID: "aifunctions",
+		RunE:    root.ReportUnknownSubcommand,
+	}
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	// Add methods
+	cmd.AddCommand(newAiClassify())
+	cmd.AddCommand(newAiDecide())
+	cmd.AddCommand(newAiExtract())
+	cmd.AddCommand(newAiParseDocument())
+
+	// Apply optional overrides to this command.
+	for _, fn := range cmdOverrides {
+		fn(cmd)
+	}
+
+	return cmd
+}
+
+// start ai-classify command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var aiClassifyOverrides []func(
+	*cobra.Command,
+	*aifunctions.AiClassifyRequest,
+)
+
+func newAiClassify() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var aiClassifyReq aifunctions.AiClassifyRequest
+	var aiClassifyJson flags.JsonFlag
+
+	cmd.Flags().Var(&aiClassifyJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: complex arg: options
+
+	cmd.Use = "ai-classify"
+	cmd.Short = `Classify text into labels.`
+	cmd.Long = `Classify text into labels.
+
+  Classifies content according to a set of provided labels. For REST API
+  requests, the default rate limit is 1,200 requests per minute per workspace.
+  Contact your Databricks account team to request a higher limit.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := aiClassifyJson.Unmarshal(&aiClassifyReq)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		} else {
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
+		}
+
+		response, err := w.AiFunctions.AiClassify(ctx, aiClassifyReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range aiClassifyOverrides {
+		fn(cmd, &aiClassifyReq)
+	}
+
+	return cmd
+}
+
+// start ai-decide command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var aiDecideOverrides []func(
+	*cobra.Command,
+	*aifunctions.AiDecideRequest,
+)
+
+func newAiDecide() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var aiDecideReq aifunctions.AiDecideRequest
+	var aiDecideJson flags.JsonFlag
+
+	cmd.Flags().Var(&aiDecideJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: complex arg: options
+
+	cmd.Use = "ai-decide"
+	cmd.Short = `*Beta* Get fast structured decisions.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get fast structured decisions.
+
+  Turn text and structured data into decisions your application can use. Define
+  questions and criteria to choose an option, estimate a probability, or assign
+  a score given a provided state.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := aiDecideJson.Unmarshal(&aiDecideReq)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		} else {
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
+		}
+
+		response, err := w.AiFunctions.AiDecide(ctx, aiDecideReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range aiDecideOverrides {
+		fn(cmd, &aiDecideReq)
+	}
+
+	return cmd
+}
+
+// start ai-extract command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var aiExtractOverrides []func(
+	*cobra.Command,
+	*aifunctions.AiExtractRequest,
+)
+
+func newAiExtract() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var aiExtractReq aifunctions.AiExtractRequest
+	var aiExtractJson flags.JsonFlag
+
+	cmd.Flags().Var(&aiExtractJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: complex arg: options
+
+	cmd.Use = "ai-extract"
+	cmd.Short = `Extract structured data from text.`
+	cmd.Long = `Extract structured data from text.
+
+  Extracts structured data from text and documents according to a provided
+  schema. For REST API requests, the default rate limit is 120 requests per
+  minute per workspace. Contact your Databricks account team to request a higher
+  limit.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := aiExtractJson.Unmarshal(&aiExtractReq)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		} else {
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
+		}
+
+		response, err := w.AiFunctions.AiExtract(ctx, aiExtractReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range aiExtractOverrides {
+		fn(cmd, &aiExtractReq)
+	}
+
+	return cmd
+}
+
+// start ai-parse-document command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var aiParseDocumentOverrides []func(
+	*cobra.Command,
+	*aifunctions.AiParseDocumentRequest,
+)
+
+func newAiParseDocument() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var aiParseDocumentReq aifunctions.AiParseDocumentRequest
+	var aiParseDocumentJson flags.JsonFlag
+
+	cmd.Flags().Var(&aiParseDocumentJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: complex arg: options
+
+	cmd.Use = "ai-parse-document CONTENT"
+	cmd.Short = `Parse documents into structured content.`
+	cmd.Long = `Parse documents into structured content.
+
+  Parse structured content from unstructured documents.
+
+  Arguments:
+    CONTENT: The document to parse. The REST API accepts a Unity Catalog volume path to
+      the source file or a base64 data URL containing the file bytes (for
+      example, data:application/pdf;base64,<encoded-file-bytes> or
+      data:image/jpeg;base64,<encoded-file-bytes>). Supported formats: PDF,
+      DOCX, DOC, PPTX, PPT, JPG, JPEG, PNG, TIFF. Accepts up to 100 pages and
+      100 MB per document.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(0)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'content' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := aiParseDocumentJson.Unmarshal(&aiParseDocumentReq)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		if !cmd.Flags().Changed("json") {
+			aiParseDocumentReq.Content = args[0]
+		}
+
+		response, err := w.AiFunctions.AiParseDocument(ctx, aiParseDocumentReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range aiParseDocumentOverrides {
+		fn(cmd, &aiParseDocumentReq)
+	}
+
+	return cmd
+}
+
+// end service AiFunctions
diff --git a/cmd/workspace/ai-gateway/ai-gateway.go b/cmd/workspace/ai-gateway/ai-gateway.go
new file mode 100644
index 00000000000..3fe1d3da088
--- /dev/null
+++ b/cmd/workspace/ai-gateway/ai-gateway.go
@@ -0,0 +1,2004 @@
+// Code generated from OpenAPI specs by Databricks SDK Generator. DO NOT EDIT.
+
+package ai_gateway
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/databricks-sdk-go/common/types/fieldmask"
+	"github.com/databricks/databricks-sdk-go/service/catalog"
+	"github.com/spf13/cobra"
+)
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var cmdOverrides []func(*cobra.Command)
+
+func New() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "ai-gateway",
+		Short: `Govern AI workloads in Unity Catalog.`,
+		Long: `Govern AI workloads in Unity Catalog. This API manages the Unity Catalog
+  securables that bring centralized access control, lineage, and auditing to
+  AI-serving entities: model services (governed access to foundation models and
+  external LLMs), model provider services (governed resources for external model
+  providers), and MCP services (governed Model Context Protocol servers).`,
+		GroupID: "catalog",
+		RunE:    root.ReportUnknownSubcommand,
+	}
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	// Add methods
+	cmd.AddCommand(newCreateMcpService())
+	cmd.AddCommand(newCreateMcpServiceUserMappedCredential())
+	cmd.AddCommand(newCreateModelProviderService())
+	cmd.AddCommand(newCreateModelService())
+	cmd.AddCommand(newCreateSkill())
+	cmd.AddCommand(newDeleteMcpService())
+	cmd.AddCommand(newDeleteMcpServiceUserMappedCredential())
+	cmd.AddCommand(newDeleteModelProviderService())
+	cmd.AddCommand(newDeleteModelService())
+	cmd.AddCommand(newDeleteSkill())
+	cmd.AddCommand(newFinalizeSkill())
+	cmd.AddCommand(newGetMcpService())
+	cmd.AddCommand(newGetMcpServiceUserMappedCredential())
+	cmd.AddCommand(newGetModelProviderService())
+	cmd.AddCommand(newGetModelService())
+	cmd.AddCommand(newGetSkill())
+	cmd.AddCommand(newListMcpServices())
+	cmd.AddCommand(newListModelProviderServices())
+	cmd.AddCommand(newListModelServices())
+	cmd.AddCommand(newListSkills())
+	cmd.AddCommand(newUpdateMcpService())
+	cmd.AddCommand(newUpdateModelProviderService())
+	cmd.AddCommand(newUpdateModelService())
+	cmd.AddCommand(newUpdateSkill())
+
+	// Apply optional overrides to this command.
+	for _, fn := range cmdOverrides {
+		fn(cmd)
+	}
+
+	return cmd
+}
+
+// start create-mcp-service command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var createMcpServiceOverrides []func(
+	*cobra.Command,
+	*catalog.CreateMcpServiceRequest,
+)
+
+func newCreateMcpService() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var createMcpServiceReq catalog.CreateMcpServiceRequest
+	createMcpServiceReq.McpService = catalog.McpService{}
+	var createMcpServiceJson flags.JsonFlag
+
+	cmd.Flags().Var(&createMcpServiceJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&createMcpServiceReq.McpService.Comment, "comment", createMcpServiceReq.McpService.Comment, `User-provided description.`)
+	// TODO: complex arg: config
+	cmd.Flags().StringVar(&createMcpServiceReq.McpService.Name, "name", createMcpServiceReq.McpService.Name, `Resource name of the MCP service.`)
+
+	cmd.Use = "create-mcp-service PARENT MCP_SERVICE_ID"
+	cmd.Short = `Create an MCP service.`
+	cmd.Long = `Create an MCP service.
+
+  Creates an MCP service in a Unity Catalog schema. An MCP (Model Context
+  Protocol) service is a governed securable that registers an MCP server and
+  exposes its tools for discovery, access control, and invocation. Specify its
+  name in mcp_service_id.
+
+  You must be the owner of the parent schema or have the CREATE_SERVICE and
+  USE_SCHEMA privileges on the parent schema and USE_CATALOG on the parent
+  catalog. You also need USE_CONNECTION on the connection the MCP service
+  references.
+
+  Arguments:
+    PARENT: Name of the parent schema. Format: schemas/{catalog}.{schema}. Each
+      {...} component is capped at 255 characters individually.
+    MCP_SERVICE_ID: Name for the MCP service, e.g. "my_mcp_service".`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := createMcpServiceJson.Unmarshal(&createMcpServiceReq.McpService)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		createMcpServiceReq.Parent = args[0]
+		createMcpServiceReq.McpServiceId = args[1]
+
+		response, err := w.AiGateway.CreateMcpService(ctx, createMcpServiceReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range createMcpServiceOverrides {
+		fn(cmd, &createMcpServiceReq)
+	}
+
+	return cmd
+}
+
+// start create-mcp-service-user-mapped-credential command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var createMcpServiceUserMappedCredentialOverrides []func(
+	*cobra.Command,
+	*catalog.CreateMcpServiceUserMappedCredentialRequest,
+)
+
+func newCreateMcpServiceUserMappedCredential() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var createMcpServiceUserMappedCredentialReq catalog.CreateMcpServiceUserMappedCredentialRequest
+	createMcpServiceUserMappedCredentialReq.Login = catalog.McpServiceUserMappedCredentialLogin{}
+	var createMcpServiceUserMappedCredentialJson flags.JsonFlag
+
+	cmd.Flags().Var(&createMcpServiceUserMappedCredentialJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: map via StringToStringVar: options
+
+	cmd.Use = "create-mcp-service-user-mapped-credential NAME"
+	cmd.Short = `*Beta* Create an MCP service user credential.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Create an MCP service user credential.
+
+  Logs the caller in to an MCP service: creates their per-user OAuth credential,
+  or re-authenticates it if one already exists. The request body carries the
+  OAuth exchange fields.
+
+  You must be the owner of the MCP service or have EXECUTE on it, plus
+  USE_CATALOG on the parent catalog and USE_SCHEMA on the parent schema.
+
+  Arguments:
+    NAME: Resource name of the MCP service. Format:
+      mcp-services/{catalog}.{schema}.{mcp_service}.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := createMcpServiceUserMappedCredentialJson.Unmarshal(&createMcpServiceUserMappedCredentialReq.Login)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		createMcpServiceUserMappedCredentialReq.Name = args[0]
+
+		response, err := w.AiGateway.CreateMcpServiceUserMappedCredential(ctx, createMcpServiceUserMappedCredentialReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range createMcpServiceUserMappedCredentialOverrides {
+		fn(cmd, &createMcpServiceUserMappedCredentialReq)
+	}
+
+	return cmd
+}
+
+// start create-model-provider-service command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var createModelProviderServiceOverrides []func(
+	*cobra.Command,
+	*catalog.CreateModelProviderServiceRequest,
+)
+
+func newCreateModelProviderService() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var createModelProviderServiceReq catalog.CreateModelProviderServiceRequest
+	createModelProviderServiceReq.ModelProviderService = catalog.ModelProviderService{}
+	var createModelProviderServiceJson flags.JsonFlag
+
+	cmd.Flags().Var(&createModelProviderServiceJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&createModelProviderServiceReq.ModelProviderService.Comment, "comment", createModelProviderServiceReq.ModelProviderService.Comment, `User-provided description.`)
+	// TODO: complex arg: config
+	cmd.Flags().StringVar(&createModelProviderServiceReq.ModelProviderService.Name, "name", createModelProviderServiceReq.ModelProviderService.Name, `Resource name of the provider service.`)
+
+	cmd.Use = "create-model-provider-service PARENT MODEL_PROVIDER_SERVICE_ID"
+	cmd.Short = `Create a model provider service.`
+	cmd.Long = `Create a model provider service.
+
+  Creates a model provider service in a Unity Catalog schema. A model provider
+  service stores authentication and request configuration for an external model
+  provider, such as OpenAI, Azure OpenAI, or Amazon Bedrock. Model services
+  reference it to invoke the provider. Specify its name in
+  model_provider_service_id.
+
+  You must be the owner of the parent schema or have the CREATE_SERVICE and
+  USE_SCHEMA privileges on the parent schema and USE_CATALOG on the parent
+  catalog. Inline credentials additionally require CREATE_CONNECTION on the
+  parent schema. When using a Unity Catalog service credential, you must have
+  ACCESS on that credential.
+
+  Arguments:
+    PARENT: Name of the parent schema. Format: schemas/{catalog}.{schema}. Each
+      {...} component is capped at 255 characters individually.
+    MODEL_PROVIDER_SERVICE_ID: Name for the model provider service, e.g. "openai_prod".`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := createModelProviderServiceJson.Unmarshal(&createModelProviderServiceReq.ModelProviderService)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		createModelProviderServiceReq.Parent = args[0]
+		createModelProviderServiceReq.ModelProviderServiceId = args[1]
+
+		response, err := w.AiGateway.CreateModelProviderService(ctx, createModelProviderServiceReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range createModelProviderServiceOverrides {
+		fn(cmd, &createModelProviderServiceReq)
+	}
+
+	return cmd
+}
+
+// start create-model-service command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var createModelServiceOverrides []func(
+	*cobra.Command,
+	*catalog.CreateModelServiceRequest,
+)
+
+func newCreateModelService() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var createModelServiceReq catalog.CreateModelServiceRequest
+	createModelServiceReq.ModelService = catalog.ModelService{}
+	var createModelServiceJson flags.JsonFlag
+
+	cmd.Flags().Var(&createModelServiceJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&createModelServiceReq.ModelService.Comment, "comment", createModelServiceReq.ModelService.Comment, `User-provided description.`)
+	// TODO: complex arg: config
+	cmd.Flags().StringVar(&createModelServiceReq.ModelService.Name, "name", createModelServiceReq.ModelService.Name, `Resource name of the model service.`)
+	// TODO: array: supported_api_types
+
+	cmd.Use = "create-model-service PARENT MODEL_SERVICE_ID"
+	cmd.Short = `Create a model service.`
+	cmd.Long = `Create a model service.
+
+  Creates a model service in a Unity Catalog schema. A model service is a
+  governed AI Gateway endpoint that routes inference requests to one or more
+  model destinations. Specify its name in model_service_id.
+
+  You must be the owner of the parent schema or have the CREATE_SERVICE and
+  USE_SCHEMA privileges on the parent schema and USE_CATALOG on the parent
+  catalog. For every destination, you also need USE_CATALOG and USE_SCHEMA
+  on its parent and EXECUTE on the referenced Unity Catalog model or model
+  provider service. A provisioned-throughput destination additionally requires
+  CAN_MANAGE on its Model Serving endpoint. Configuring an inference table
+  additionally requires CREATE_TABLE.
+
+  Arguments:
+    PARENT: Name of the parent schema. Format: schemas/{catalog}.{schema}. Each
+      {...} component is capped at 255 characters individually.
+    MODEL_SERVICE_ID: Name for the model service, e.g. "my_model_service".`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := createModelServiceJson.Unmarshal(&createModelServiceReq.ModelService)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		createModelServiceReq.Parent = args[0]
+		createModelServiceReq.ModelServiceId = args[1]
+
+		response, err := w.AiGateway.CreateModelService(ctx, createModelServiceReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range createModelServiceOverrides {
+		fn(cmd, &createModelServiceReq)
+	}
+
+	return cmd
+}
+
+// start create-skill command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var createSkillOverrides []func(
+	*cobra.Command,
+	*catalog.CreateSkillRequest,
+)
+
+func newCreateSkill() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var createSkillReq catalog.CreateSkillRequest
+	createSkillReq.Skill = catalog.Skill{}
+	var createSkillJson flags.JsonFlag
+
+	cmd.Flags().Var(&createSkillJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&createSkillReq.Skill.Comment, "comment", createSkillReq.Skill.Comment, `User-provided comment for the skill.`)
+	cmd.Flags().StringVar(&createSkillReq.Skill.Name, "name", createSkillReq.Skill.Name, `Resource name of the skill.`)
+
+	cmd.Use = "create-skill PARENT SKILL_ID"
+	cmd.Short = `*Beta* Create a skill.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Create a skill.
+
+  Creates a skill in a Unity Catalog schema and provisions its managed bundle
+  storage. Specify its name in skill_id. The request contains an optional
+  comment but no bundle bytes. Upload bundle files through the Files API, then
+  call FinalizeSkill.
+
+  You must be the owner of the parent schema or have CREATE_VOLUME and
+  USE_SCHEMA on it, plus USE_CATALOG on the parent catalog.
+
+  Arguments:
+    PARENT: Name of the parent schema. Format: schemas/{catalog}.{schema}. Each
+      {...} component is capped at 255 characters individually.
+    SKILL_ID: Name for the skill, e.g. "basic-math". The server normalizes this
+      identifier to lowercase. It is independent of the bundle name read from
+      SKILL.md.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := createSkillJson.Unmarshal(&createSkillReq.Skill)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		createSkillReq.Parent = args[0]
+		createSkillReq.SkillId = args[1]
+
+		response, err := w.AiGateway.CreateSkill(ctx, createSkillReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range createSkillOverrides {
+		fn(cmd, &createSkillReq)
+	}
+
+	return cmd
+}
+
+// start delete-mcp-service command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteMcpServiceOverrides []func(
+	*cobra.Command,
+	*catalog.DeleteMcpServiceRequest,
+)
+
+func newDeleteMcpService() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteMcpServiceReq catalog.DeleteMcpServiceRequest
+
+	cmd.Flags().StringVar(&deleteMcpServiceReq.Etag, "etag", deleteMcpServiceReq.Etag, `Optimistic concurrency token from the most recent read.`)
+
+	cmd.Use = "delete-mcp-service NAME"
+	cmd.Short = `Delete an MCP service.`
+	cmd.Long = `Delete an MCP service.
+
+  Deletes the MCP service identified by its resource name. Optionally supply an
+  etag to make the delete conditional on the MCP service not having changed
+  since it was read.
+
+  You must be the owner of the MCP service or have MANAGE on it, plus
+  USE_CATALOG on the parent catalog and USE_SCHEMA on the parent schema.
+
+  Arguments:
+    NAME: Resource name of the MCP service. Format:
+      mcp-services/{catalog}.{schema}.{mcp_service}. Each {...} component is
+      capped at 255 characters individually.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		deleteMcpServiceReq.Name = args[0]
+
+		err = w.AiGateway.DeleteMcpService(ctx, deleteMcpServiceReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteMcpServiceOverrides {
+		fn(cmd, &deleteMcpServiceReq)
+	}
+
+	return cmd
+}
+
+// start delete-mcp-service-user-mapped-credential command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteMcpServiceUserMappedCredentialOverrides []func(
+	*cobra.Command,
+	*catalog.DeleteMcpServiceUserMappedCredentialRequest,
+)
+
+func newDeleteMcpServiceUserMappedCredential() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteMcpServiceUserMappedCredentialReq catalog.DeleteMcpServiceUserMappedCredentialRequest
+
+	cmd.Use = "delete-mcp-service-user-mapped-credential NAME"
+	cmd.Short = `*Beta* Delete an MCP service user credential.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Delete an MCP service user credential.
+
+  Revokes (deletes) the caller's per-user OAuth credential for an MCP service
+  (logout).
+
+  You must be the owner of the MCP service or have EXECUTE on it, plus
+  USE_CATALOG on the parent catalog and USE_SCHEMA on the parent schema.
+
+  Arguments:
+    NAME: Resource name of the MCP service. Format:
+      mcp-services/{catalog}.{schema}.{mcp_service}.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		deleteMcpServiceUserMappedCredentialReq.Name = args[0]
+
+		response, err := w.AiGateway.DeleteMcpServiceUserMappedCredential(ctx, deleteMcpServiceUserMappedCredentialReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteMcpServiceUserMappedCredentialOverrides {
+		fn(cmd, &deleteMcpServiceUserMappedCredentialReq)
+	}
+
+	return cmd
+}
+
+// start delete-model-provider-service command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteModelProviderServiceOverrides []func(
+	*cobra.Command,
+	*catalog.DeleteModelProviderServiceRequest,
+)
+
+func newDeleteModelProviderService() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteModelProviderServiceReq catalog.DeleteModelProviderServiceRequest
+
+	cmd.Flags().StringVar(&deleteModelProviderServiceReq.Etag, "etag", deleteModelProviderServiceReq.Etag, `Optimistic concurrency token from the most recent read.`)
+
+	cmd.Use = "delete-model-provider-service NAME"
+	cmd.Short = `Delete a model provider service.`
+	cmd.Long = `Delete a model provider service.
+
+  Deletes the model provider service identified by its resource name. Optionally
+  supply an etag to make the delete conditional on the model provider service
+  not having changed since it was read.
+
+  You must be the owner of the model provider service or have MANAGE on it,
+  plus USE_CATALOG on the parent catalog and USE_SCHEMA on the parent
+  schema.
+
+  Arguments:
+    NAME: Resource name of the model provider service. Format:
+      model-provider-services/{catalog}.{schema}.{model_provider_service}.
+      Each {...} component is capped at 255 characters individually.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		deleteModelProviderServiceReq.Name = args[0]
+
+		err = w.AiGateway.DeleteModelProviderService(ctx, deleteModelProviderServiceReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteModelProviderServiceOverrides {
+		fn(cmd, &deleteModelProviderServiceReq)
+	}
+
+	return cmd
+}
+
+// start delete-model-service command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteModelServiceOverrides []func(
+	*cobra.Command,
+	*catalog.DeleteModelServiceRequest,
+)
+
+func newDeleteModelService() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteModelServiceReq catalog.DeleteModelServiceRequest
+
+	cmd.Flags().StringVar(&deleteModelServiceReq.Etag, "etag", deleteModelServiceReq.Etag, `Optimistic concurrency token from the most recent read.`)
+
+	cmd.Use = "delete-model-service NAME"
+	cmd.Short = `Delete a model service.`
+	cmd.Long = `Delete a model service.
+
+  Deletes the model service identified by its resource name. Optionally supply
+  an etag to make the delete conditional on the model service not having
+  changed since it was read.
+
+  You must be the owner of the model service or have MANAGE on it, plus
+  USE_CATALOG on the parent catalog and USE_SCHEMA on the parent schema.
+
+  Arguments:
+    NAME: Resource name of the model service. Format:
+      model-services/{catalog}.{schema}.{model_service}. Each {...}
+      component is capped at 255 characters individually.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		deleteModelServiceReq.Name = args[0]
+
+		err = w.AiGateway.DeleteModelService(ctx, deleteModelServiceReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteModelServiceOverrides {
+		fn(cmd, &deleteModelServiceReq)
+	}
+
+	return cmd
+}
+
+// start delete-skill command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteSkillOverrides []func(
+	*cobra.Command,
+	*catalog.DeleteSkillRequest,
+)
+
+func newDeleteSkill() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteSkillReq catalog.DeleteSkillRequest
+
+	cmd.Flags().StringVar(&deleteSkillReq.Etag, "etag", deleteSkillReq.Etag, `Optimistic concurrency token from the most recent read.`)
+
+	cmd.Use = "delete-skill NAME"
+	cmd.Short = `*Beta* Delete a skill.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Delete a skill.
+
+  Deletes the skill identified by its resource name and makes its managed bundle
+  path unavailable. Managed bundle data is deleted asynchronously. Optionally
+  supply an etag to make the delete conditional on the skill not having
+  changed since it was read.
+
+  You must be the owner of the skill or have MANAGE on it, plus USE_CATALOG
+  on the parent catalog and USE_SCHEMA on the parent schema.
+
+  Arguments:
+    NAME: Full resource name of the skill. Format:
+      skills/{catalog}.{schema}.{skill}. Each {...} component is capped at
+      255 characters individually.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		deleteSkillReq.Name = args[0]
+
+		err = w.AiGateway.DeleteSkill(ctx, deleteSkillReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteSkillOverrides {
+		fn(cmd, &deleteSkillReq)
+	}
+
+	return cmd
+}
+
+// start finalize-skill command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var finalizeSkillOverrides []func(
+	*cobra.Command,
+	*catalog.FinalizeSkillRequest,
+)
+
+func newFinalizeSkill() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var finalizeSkillReq catalog.FinalizeSkillRequest
+
+	cmd.Use = "finalize-skill NAME"
+	cmd.Short = `*Beta* Finalize a skill.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Finalize a skill.
+
+  Finalizes a skill after its bundle is uploaded. This method reads SKILL.md
+  through the Files API using the caller's authorization. Its YAML frontmatter
+  must contain an agentskills.io-compliant name and a nonblank description
+  within the configured UTF-8 byte limit. On success, it replaces bundle_name
+  and description; refreshes finalize_time, update_time, and updated_by;
+  and returns the updated skill. comment is preserved. Re-finalization uses
+  the latest SKILL.md and is last-write-wins without an etag precondition.
+  Validation failures do not change metadata.
+
+  You must be the owner of the skill or have READ_VOLUME on it, plus
+  USE_CATALOG on the parent catalog and USE_SCHEMA on the parent schema.
+
+  Arguments:
+    NAME: Full resource name of the skill. Format:
+      skills/{catalog}.{schema}.{skill}. Each {...} component is capped at
+      255 characters individually.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		finalizeSkillReq.Name = args[0]
+
+		response, err := w.AiGateway.FinalizeSkill(ctx, finalizeSkillReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range finalizeSkillOverrides {
+		fn(cmd, &finalizeSkillReq)
+	}
+
+	return cmd
+}
+
+// start get-mcp-service command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getMcpServiceOverrides []func(
+	*cobra.Command,
+	*catalog.GetMcpServiceRequest,
+)
+
+func newGetMcpService() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getMcpServiceReq catalog.GetMcpServiceRequest
+
+	cmd.Use = "get-mcp-service NAME"
+	cmd.Short = `Get an MCP service.`
+	cmd.Long = `Get an MCP service.
+
+  Returns the MCP service identified by its resource name.
+
+  You must be the owner of the MCP service or have EXECUTE, READ_METADATA,
+  or MANAGE on it, plus USE_CATALOG on the parent catalog and USE_SCHEMA
+  on the parent schema.
+
+  Arguments:
+    NAME: Resource name of the MCP service. Format:
+      mcp-services/{catalog}.{schema}.{mcp_service}. Each {...} component is
+      capped at 255 characters individually.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getMcpServiceReq.Name = args[0]
+
+		response, err := w.AiGateway.GetMcpService(ctx, getMcpServiceReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getMcpServiceOverrides {
+		fn(cmd, &getMcpServiceReq)
+	}
+
+	return cmd
+}
+
+// start get-mcp-service-user-mapped-credential command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getMcpServiceUserMappedCredentialOverrides []func(
+	*cobra.Command,
+	*catalog.GetMcpServiceUserMappedCredentialRequest,
+)
+
+func newGetMcpServiceUserMappedCredential() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getMcpServiceUserMappedCredentialReq catalog.GetMcpServiceUserMappedCredentialRequest
+
+	cmd.Use = "get-mcp-service-user-mapped-credential NAME"
+	cmd.Short = `*Beta* Get MCP service user credential status.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get MCP service user credential status.
+
+  Returns the caller's per-user OAuth login state for an MCP service. Read
+  provisioning_info.state: ACTIVE means the caller is logged in and the
+  credential is usable; any other state (for example a failed or
+  still-provisioning login) means the login has not completed and the caller
+  should log in again. If the caller has no credential yet, the RPC returns
+  NOT_FOUND.
+
+  You must be the owner of the MCP service or have EXECUTE on it, plus
+  USE_CATALOG on the parent catalog and USE_SCHEMA on the parent schema.
+
+  Arguments:
+    NAME: Resource name of the MCP service. Format:
+      mcp-services/{catalog}.{schema}.{mcp_service}.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getMcpServiceUserMappedCredentialReq.Name = args[0]
+
+		response, err := w.AiGateway.GetMcpServiceUserMappedCredential(ctx, getMcpServiceUserMappedCredentialReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getMcpServiceUserMappedCredentialOverrides {
+		fn(cmd, &getMcpServiceUserMappedCredentialReq)
+	}
+
+	return cmd
+}
+
+// start get-model-provider-service command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getModelProviderServiceOverrides []func(
+	*cobra.Command,
+	*catalog.GetModelProviderServiceRequest,
+)
+
+func newGetModelProviderService() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getModelProviderServiceReq catalog.GetModelProviderServiceRequest
+
+	cmd.Use = "get-model-provider-service NAME"
+	cmd.Short = `Get a model provider service.`
+	cmd.Long = `Get a model provider service.
+
+  Returns the model provider service identified by its resource name.
+
+  You must be the owner of the model provider service or have EXECUTE,
+  READ_METADATA, or MANAGE on it, plus USE_CATALOG on the parent catalog
+  and USE_SCHEMA on the parent schema.
+
+  Arguments:
+    NAME: Resource name of the model provider service. Format:
+      model-provider-services/{catalog}.{schema}.{model_provider_service}.
+      Each {...} component is capped at 255 characters individually.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getModelProviderServiceReq.Name = args[0]
+
+		response, err := w.AiGateway.GetModelProviderService(ctx, getModelProviderServiceReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getModelProviderServiceOverrides {
+		fn(cmd, &getModelProviderServiceReq)
+	}
+
+	return cmd
+}
+
+// start get-model-service command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getModelServiceOverrides []func(
+	*cobra.Command,
+	*catalog.GetModelServiceRequest,
+)
+
+func newGetModelService() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getModelServiceReq catalog.GetModelServiceRequest
+
+	cmd.Use = "get-model-service NAME"
+	cmd.Short = `Get a model service.`
+	cmd.Long = `Get a model service.
+
+  Returns the model service identified by its resource name.
+
+  You must be the owner of the model service or have EXECUTE, READ_METADATA,
+  or MANAGE on it, plus USE_CATALOG on the parent catalog and USE_SCHEMA
+  on the parent schema.
+
+  Arguments:
+    NAME: Resource name of the model service. Format:
+      model-services/{catalog}.{schema}.{model_service}. Each {...}
+      component is capped at 255 characters individually.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getModelServiceReq.Name = args[0]
+
+		response, err := w.AiGateway.GetModelService(ctx, getModelServiceReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getModelServiceOverrides {
+		fn(cmd, &getModelServiceReq)
+	}
+
+	return cmd
+}
+
+// start get-skill command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getSkillOverrides []func(
+	*cobra.Command,
+	*catalog.GetSkillRequest,
+)
+
+func newGetSkill() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getSkillReq catalog.GetSkillRequest
+
+	cmd.Use = "get-skill NAME"
+	cmd.Short = `*Beta* Get a skill.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get a skill.
+
+  Returns the skill identified by its resource name.
+
+  You must be the owner of the skill or have READ_VOLUME, READ_METADATA, or
+  MANAGE on it, plus USE_CATALOG on the parent catalog and USE_SCHEMA on
+  the parent schema.
+
+  Arguments:
+    NAME: Full resource name of the skill. Format:
+      skills/{catalog}.{schema}.{skill}. Each {...} component is capped at
+      255 characters individually.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getSkillReq.Name = args[0]
+
+		response, err := w.AiGateway.GetSkill(ctx, getSkillReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getSkillOverrides {
+		fn(cmd, &getSkillReq)
+	}
+
+	return cmd
+}
+
+// start list-mcp-services command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listMcpServicesOverrides []func(
+	*cobra.Command,
+	*catalog.ListMcpServicesRequest,
+)
+
+func newListMcpServices() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listMcpServicesReq catalog.ListMcpServicesRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listMcpServicesLimit int
+
+	cmd.Flags().IntVar(&listMcpServicesReq.PageSize, "page-size", listMcpServicesReq.PageSize, `Maximum number of MCP services to return.`)
+	cmd.Flags().StringVar(&listMcpServicesReq.Parent, "parent", listMcpServicesReq.Parent, `Parent schema to list within, in the form schemas/{catalog}.{schema}.`)
+	cmd.Flags().Var(&listMcpServicesReq.View, "view", `Fields to return for each service. Supported values: [BASIC, FULL]`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listMcpServicesLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listMcpServicesReq.PageToken, "page-token", listMcpServicesReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-mcp-services"
+	cmd.Short = `List MCP services.`
+	cmd.Long = `List MCP services.
+
+  Lists the MCP services in a Unity Catalog schema. Provide parent as
+  schemas/{catalog}.{schema}. Results are paginated; pass the returned
+  next_page_token to fetch subsequent pages.
+
+  Requires USE_CATALOG on the parent catalog and USE_SCHEMA on the parent
+  schema. Only MCP services the caller can access (as owner or through
+  EXECUTE, READ_METADATA, or MANAGE) are returned.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(0)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		response := w.AiGateway.ListMcpServices(ctx, listMcpServicesReq)
+		if listMcpServicesLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listMcpServicesLimit)
+		}
+		if listMcpServicesLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listMcpServicesLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listMcpServicesOverrides {
+		fn(cmd, &listMcpServicesReq)
+	}
+
+	return cmd
+}
+
+// start list-model-provider-services command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listModelProviderServicesOverrides []func(
+	*cobra.Command,
+	*catalog.ListModelProviderServicesRequest,
+)
+
+func newListModelProviderServices() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listModelProviderServicesReq catalog.ListModelProviderServicesRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listModelProviderServicesLimit int
+
+	cmd.Flags().IntVar(&listModelProviderServicesReq.PageSize, "page-size", listModelProviderServicesReq.PageSize, `Maximum number of provider services to return.`)
+	cmd.Flags().StringVar(&listModelProviderServicesReq.Parent, "parent", listModelProviderServicesReq.Parent, `Parent schema to list within, in the form schemas/{catalog}.{schema}.`)
+	cmd.Flags().Var(&listModelProviderServicesReq.View, "view", `Fields to return for each service. Supported values: [BASIC, FULL]`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listModelProviderServicesLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listModelProviderServicesReq.PageToken, "page-token", listModelProviderServicesReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-model-provider-services"
+	cmd.Short = `List model provider services.`
+	cmd.Long = `List model provider services.
+
+  Lists the model provider services in a Unity Catalog schema. Provide parent
+  as schemas/{catalog}.{schema}. Results are paginated; pass the returned
+  next_page_token to fetch subsequent pages.
+
+  Requires USE_CATALOG on the parent catalog and USE_SCHEMA on the parent
+  schema. Only model provider services the caller can access (as owner or
+  through EXECUTE, READ_METADATA, or MANAGE) are returned.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(0)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		response := w.AiGateway.ListModelProviderServices(ctx, listModelProviderServicesReq)
+		if listModelProviderServicesLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listModelProviderServicesLimit)
+		}
+		if listModelProviderServicesLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listModelProviderServicesLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listModelProviderServicesOverrides {
+		fn(cmd, &listModelProviderServicesReq)
+	}
+
+	return cmd
+}
+
+// start list-model-services command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listModelServicesOverrides []func(
+	*cobra.Command,
+	*catalog.ListModelServicesRequest,
+)
+
+func newListModelServices() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listModelServicesReq catalog.ListModelServicesRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listModelServicesLimit int
+
+	cmd.Flags().IntVar(&listModelServicesReq.PageSize, "page-size", listModelServicesReq.PageSize, `Maximum number of model services to return.`)
+	cmd.Flags().StringVar(&listModelServicesReq.Parent, "parent", listModelServicesReq.Parent, `Parent schema to list within, in the form schemas/{catalog}.{schema}.`)
+	cmd.Flags().Var(&listModelServicesReq.View, "view", `Fields to return for each service. Supported values: [BASIC, FULL]`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listModelServicesLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listModelServicesReq.PageToken, "page-token", listModelServicesReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-model-services"
+	cmd.Short = `List model services.`
+	cmd.Long = `List model services.
+
+  Lists the model services in a Unity Catalog schema. Provide parent as
+  schemas/{catalog}.{schema}. Results are paginated; pass the returned
+  next_page_token to fetch subsequent pages.
+
+  Requires USE_CATALOG on the parent catalog and USE_SCHEMA on the parent
+  schema. Only model services the caller can access (as owner or through
+  EXECUTE, READ_METADATA, or MANAGE) are returned.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(0)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		response := w.AiGateway.ListModelServices(ctx, listModelServicesReq)
+		if listModelServicesLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listModelServicesLimit)
+		}
+		if listModelServicesLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listModelServicesLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listModelServicesOverrides {
+		fn(cmd, &listModelServicesReq)
+	}
+
+	return cmd
+}
+
+// start list-skills command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listSkillsOverrides []func(
+	*cobra.Command,
+	*catalog.ListSkillsRequest,
+)
+
+func newListSkills() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listSkillsReq catalog.ListSkillsRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listSkillsLimit int
+
+	cmd.Flags().IntVar(&listSkillsReq.PageSize, "page-size", listSkillsReq.PageSize, `Maximum number of skills to return.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listSkillsLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listSkillsReq.PageToken, "page-token", listSkillsReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-skills PARENT"
+	cmd.Short = `*Beta* List skills.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+List skills.
+
+  Lists skills in a Unity Catalog schema. Provide parent as
+  schemas/{catalog}.{schema}. Results are paginated; pass the returned
+  next_page_token to fetch subsequent pages.
+
+  Requires USE_CATALOG on the parent catalog and USE_SCHEMA on the parent
+  schema. Only skills the caller can access as owner or through READ_VOLUME,
+  READ_METADATA, or MANAGE are returned.
+
+  Arguments:
+    PARENT: Name of the parent schema. Format: schemas/{catalog}.{schema}. Each
+      {...} component is capped at 255 characters individually.
+
+      Required: skill listing is schema-scoped, so parent must be set; an
+      unset or empty parent is rejected with INVALID_PARAMETER_VALUE.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		listSkillsReq.Parent = args[0]
+
+		response := w.AiGateway.ListSkills(ctx, listSkillsReq)
+		if listSkillsLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listSkillsLimit)
+		}
+		if listSkillsLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listSkillsLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listSkillsOverrides {
+		fn(cmd, &listSkillsReq)
+	}
+
+	return cmd
+}
+
+// start update-mcp-service command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateMcpServiceOverrides []func(
+	*cobra.Command,
+	*catalog.UpdateMcpServiceRequest,
+)
+
+func newUpdateMcpService() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateMcpServiceReq catalog.UpdateMcpServiceRequest
+	updateMcpServiceReq.McpService = catalog.McpService{}
+	var updateMcpServiceJson flags.JsonFlag
+
+	cmd.Flags().Var(&updateMcpServiceJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&updateMcpServiceReq.Etag, "etag", updateMcpServiceReq.Etag, `Optimistic concurrency token from the most recent read.`)
+	cmd.Flags().StringVar(&updateMcpServiceReq.McpService.Comment, "comment", updateMcpServiceReq.McpService.Comment, `User-provided description.`)
+	// TODO: complex arg: config
+	cmd.Flags().StringVar(&updateMcpServiceReq.McpService.Name, "name", updateMcpServiceReq.McpService.Name, `Resource name of the MCP service.`)
+
+	cmd.Use = "update-mcp-service NAME UPDATE_MASK"
+	cmd.Short = `Update an MCP service.`
+	cmd.Long = `Update an MCP service.
+
+  Updates an MCP service. Only the fields named in update_mask are changed;
+  the resource name is immutable. Optionally supply an etag to make the update
+  conditional on the MCP service not having changed since it was read.
+
+  You must be the owner of the MCP service or have MANAGE on it, plus
+  USE_CATALOG on the parent catalog and USE_SCHEMA on the parent schema.
+  When changing config.source_connection.name, the MCP service owner must also
+  have USE_CONNECTION on the new connection.
+
+  Arguments:
+    NAME: Resource name of the MCP service. Format:
+      mcp-services/{catalog}.{schema}.{mcp_service}. Each {...} component is
+      capped at 255 characters individually. Server-derived on Create from
+      parent + mcp_service_id; required and immutable on Update/Get/Delete.
+    UPDATE_MASK: Fields to update. Use config to replace the entire configuration. The
+      replacement must include every required field; any optional field you omit
+      is cleared. To preserve sibling fields, use one or more granular paths:
+      comment, config.source_connection.name,
+      config.include_tool_selectors, or config.rate_limits.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updateMcpServiceJson.Unmarshal(&updateMcpServiceReq.McpService)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		updateMcpServiceReq.Name = args[0]
+		if args[1] != "" {
+			updateMaskArray := strings.Split(args[1], ",")
+			updateMcpServiceReq.UpdateMask = *fieldmask.New(updateMaskArray)
+		}
+
+		response, err := w.AiGateway.UpdateMcpService(ctx, updateMcpServiceReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateMcpServiceOverrides {
+		fn(cmd, &updateMcpServiceReq)
+	}
+
+	return cmd
+}
+
+// start update-model-provider-service command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateModelProviderServiceOverrides []func(
+	*cobra.Command,
+	*catalog.UpdateModelProviderServiceRequest,
+)
+
+func newUpdateModelProviderService() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateModelProviderServiceReq catalog.UpdateModelProviderServiceRequest
+	updateModelProviderServiceReq.ModelProviderService = catalog.ModelProviderService{}
+	var updateModelProviderServiceJson flags.JsonFlag
+
+	cmd.Flags().Var(&updateModelProviderServiceJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&updateModelProviderServiceReq.Etag, "etag", updateModelProviderServiceReq.Etag, `Optimistic concurrency token from the most recent read.`)
+	cmd.Flags().StringVar(&updateModelProviderServiceReq.ModelProviderService.Comment, "comment", updateModelProviderServiceReq.ModelProviderService.Comment, `User-provided description.`)
+	// TODO: complex arg: config
+	cmd.Flags().StringVar(&updateModelProviderServiceReq.ModelProviderService.Name, "name", updateModelProviderServiceReq.ModelProviderService.Name, `Resource name of the provider service.`)
+
+	cmd.Use = "update-model-provider-service NAME UPDATE_MASK"
+	cmd.Short = `Update a model provider service.`
+	cmd.Long = `Update a model provider service.
+
+  Updates a model provider service. Only the fields named in update_mask are
+  changed; the resource name and provider type are immutable. Optionally supply
+  an etag to make the update conditional on the model provider service not
+  having changed since it was read.
+
+  You must be the owner of the model provider service or have MANAGE on it,
+  plus USE_CATALOG on the parent catalog and USE_SCHEMA on the parent
+  schema.
+
+  Updating config.provider cannot change the provider type. Authentication
+  mode changes require feature availability and support for both modes on the
+  selected provider.
+
+  Arguments:
+    NAME: Resource name of the provider service. Format:
+      model-provider-services/{catalog}.{schema}.{model_provider_service}.
+      Each {...} component is capped at 255 characters individually.
+      Server-derived on Create from parent + model_provider_service_id;
+      required and immutable on Update/Get/Delete.
+    UPDATE_MASK: Fields to update. Use config to replace the entire configuration. The
+      replacement must include every required field; any optional field you omit
+      is cleared. To preserve sibling fields, use one or more granular paths:
+      comment; config.provider to replace the active provider-specific value
+      (for example, config.openai; the mask path remains config.provider);
+      config.allow_all_targets, config.targets, config.forward_headers,
+      config.forward_query_parameters, config.forward_unmanaged_paths,
+      config.rate_limits, config.pricing.default_discount_basis_points, or
+      config.inference_table. For a pricing update, an explicitly empty
+      pricing object clears the discount but retains the object; omitting
+      pricing clears it. config.pricing is not a supported mask path. The
+      provider type is immutable. A config or config.provider replacement
+      that carries no authentication material preserves the existing
+      authentication binding; input-only plaintext does not need to be read back
+      and re-sent.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updateModelProviderServiceJson.Unmarshal(&updateModelProviderServiceReq.ModelProviderService)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		updateModelProviderServiceReq.Name = args[0]
+		if args[1] != "" {
+			updateMaskArray := strings.Split(args[1], ",")
+			updateModelProviderServiceReq.UpdateMask = *fieldmask.New(updateMaskArray)
+		}
+
+		response, err := w.AiGateway.UpdateModelProviderService(ctx, updateModelProviderServiceReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateModelProviderServiceOverrides {
+		fn(cmd, &updateModelProviderServiceReq)
+	}
+
+	return cmd
+}
+
+// start update-model-service command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateModelServiceOverrides []func(
+	*cobra.Command,
+	*catalog.UpdateModelServiceRequest,
+)
+
+func newUpdateModelService() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateModelServiceReq catalog.UpdateModelServiceRequest
+	updateModelServiceReq.ModelService = catalog.ModelService{}
+	var updateModelServiceJson flags.JsonFlag
+
+	cmd.Flags().Var(&updateModelServiceJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&updateModelServiceReq.Etag, "etag", updateModelServiceReq.Etag, `Optimistic concurrency token from the most recent read.`)
+	cmd.Flags().StringVar(&updateModelServiceReq.ModelService.Comment, "comment", updateModelServiceReq.ModelService.Comment, `User-provided description.`)
+	// TODO: complex arg: config
+	cmd.Flags().StringVar(&updateModelServiceReq.ModelService.Name, "name", updateModelServiceReq.ModelService.Name, `Resource name of the model service.`)
+	// TODO: array: supported_api_types
+
+	cmd.Use = "update-model-service NAME UPDATE_MASK"
+	cmd.Short = `Update a model service.`
+	cmd.Long = `Update a model service.
+
+  Updates a model service. Only the fields named in update_mask are changed;
+  the resource name is immutable. Optionally supply an etag to make the update
+  conditional on the model service not having changed since it was read.
+
+  You must be the owner of the model service or have MANAGE on it, plus
+  USE_CATALOG on the parent catalog and USE_SCHEMA on the parent schema.
+  When changing destinations, both you and the model service owner need
+  USE_CATALOG and USE_SCHEMA on each destination's parent and EXECUTE on
+  the referenced Unity Catalog model or model provider service. A
+  provisioned-throughput destination additionally requires CAN_MANAGE for you
+  and CAN_QUERY for the model service owner. Adding an inference table
+  additionally requires CREATE_TABLE.
+
+  Arguments:
+    NAME: Resource name of the model service. Format:
+      model-services/{catalog}.{schema}.{model_service}. Each {...}
+      component is capped at 255 characters individually. Server-derived on
+      Create from parent + model_service_id; required and immutable on
+      Update/Get/Delete.
+    UPDATE_MASK: Fields to update. Use config to replace the entire configuration. The
+      replacement must include every required field; any optional field you omit
+      is cleared. To preserve sibling fields, use one or more granular paths:
+      comment, config.routing.destinations,
+      config.routing.fallback.destinations, config.rate_limits, or
+      config.inference_table. Intermediate paths such as config.routing and
+      config.routing.fallback are not supported.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updateModelServiceJson.Unmarshal(&updateModelServiceReq.ModelService)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		updateModelServiceReq.Name = args[0]
+		if args[1] != "" {
+			updateMaskArray := strings.Split(args[1], ",")
+			updateModelServiceReq.UpdateMask = *fieldmask.New(updateMaskArray)
+		}
+
+		response, err := w.AiGateway.UpdateModelService(ctx, updateModelServiceReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateModelServiceOverrides {
+		fn(cmd, &updateModelServiceReq)
+	}
+
+	return cmd
+}
+
+// start update-skill command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateSkillOverrides []func(
+	*cobra.Command,
+	*catalog.UpdateSkillRequest,
+)
+
+func newUpdateSkill() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateSkillReq catalog.UpdateSkillRequest
+	updateSkillReq.Skill = catalog.Skill{}
+	var updateSkillJson flags.JsonFlag
+
+	cmd.Flags().Var(&updateSkillJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&updateSkillReq.Etag, "etag", updateSkillReq.Etag, `Optimistic concurrency token from the most recent read.`)
+	cmd.Flags().StringVar(&updateSkillReq.Skill.Comment, "comment", updateSkillReq.Skill.Comment, `User-provided comment for the skill.`)
+	cmd.Flags().StringVar(&updateSkillReq.Skill.Name, "name", updateSkillReq.Skill.Name, `Resource name of the skill.`)
+
+	cmd.Use = "update-skill NAME UPDATE_MASK"
+	cmd.Short = `*Beta* Update a skill.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Update a skill.
+
+  Updates a skill. Only fields named in update_mask are changed; currently
+  only comment is supported. The resource name is immutable. Optionally supply
+  an etag to make the update conditional on the skill not having changed since
+  it was read. Bundle files, grants, tags, and ownership are unchanged.
+
+  You must be the owner of the skill or have MANAGE on it, plus USE_CATALOG
+  on the parent catalog and USE_SCHEMA on the parent schema.
+
+  Arguments:
+    NAME: Resource name of the skill. Format: skills/{catalog}.{schema}.{skill}.
+      Each {...} component is capped at 255 characters individually.
+      Server-derived on Create from parent + skill_id; required and
+      immutable on Update/Get/Delete.
+    UPDATE_MASK: Fields to update; validated against skill. REQUIRED, matching the
+      sibling Update RPCs. comment is the only mutable field.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updateSkillJson.Unmarshal(&updateSkillReq.Skill)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		updateSkillReq.Name = args[0]
+		if args[1] != "" {
+			updateMaskArray := strings.Split(args[1], ",")
+			updateSkillReq.UpdateMask = *fieldmask.New(updateMaskArray)
+		}
+
+		response, err := w.AiGateway.UpdateSkill(ctx, updateSkillReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateSkillOverrides {
+		fn(cmd, &updateSkillReq)
+	}
+
+	return cmd
+}
+
+// end service AiGateway
diff --git a/cmd/workspace/ai-search/ai-search.go b/cmd/workspace/ai-search/ai-search.go
new file mode 100644
index 00000000000..82e664eb3e2
--- /dev/null
+++ b/cmd/workspace/ai-search/ai-search.go
@@ -0,0 +1,1192 @@
+// Code generated from OpenAPI specs by Databricks SDK Generator. DO NOT EDIT.
+
+package ai_search
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/databricks-sdk-go/common/types/fieldmask"
+	"github.com/databricks/databricks-sdk-go/service/aisearch"
+	"github.com/spf13/cobra"
+)
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var cmdOverrides []func(*cobra.Command)
+
+func New() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "ai-search",
+		Short: `*Public Preview* **AI Search Endpoint**: Represents the compute resources to host AI Search indexes.`,
+		Long: `This command is in Public Preview and may change without notice.
+
+**AI Search Endpoint**: Represents the compute resources to host AI Search
+  indexes. AIP-conformant replacement for the legacy VectorSearchEndpoints API;
+  functionally equivalent.`,
+		GroupID: "aisearch",
+		RunE:    root.ReportUnknownSubcommand,
+	}
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
+	// Add methods
+	cmd.AddCommand(newCreateEndpoint())
+	cmd.AddCommand(newCreateIndex())
+	cmd.AddCommand(newDeleteEndpoint())
+	cmd.AddCommand(newDeleteIndex())
+	cmd.AddCommand(newGetEndpoint())
+	cmd.AddCommand(newGetIndex())
+	cmd.AddCommand(newListEndpoints())
+	cmd.AddCommand(newListIndexes())
+	cmd.AddCommand(newQueryIndex())
+	cmd.AddCommand(newRemoveData())
+	cmd.AddCommand(newScanIndex())
+	cmd.AddCommand(newSyncIndex())
+	cmd.AddCommand(newUpdateEndpoint())
+	cmd.AddCommand(newUpsertData())
+
+	// Apply optional overrides to this command.
+	for _, fn := range cmdOverrides {
+		fn(cmd)
+	}
+
+	return cmd
+}
+
+// start create-endpoint command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var createEndpointOverrides []func(
+	*cobra.Command,
+	*aisearch.CreateEndpointRequest,
+)
+
+func newCreateEndpoint() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var createEndpointReq aisearch.CreateEndpointRequest
+	createEndpointReq.Endpoint = aisearch.Endpoint{}
+	var createEndpointJson flags.JsonFlag
+
+	cmd.Flags().Var(&createEndpointJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&createEndpointReq.EndpointId, "endpoint-id", createEndpointReq.EndpointId, `The user-supplied short name for the Endpoint, per AIP-133.`)
+	cmd.Flags().StringVar(&createEndpointReq.Endpoint.BudgetPolicyId, "budget-policy-id", createEndpointReq.Endpoint.BudgetPolicyId, `The user-selected budget policy id for the endpoint.`)
+	// TODO: array: custom_tags
+	// TODO: complex arg: endpoint_status
+	cmd.Flags().StringVar(&createEndpointReq.Endpoint.Name, "name", createEndpointReq.Endpoint.Name, `Name of the AI Search endpoint.`)
+	cmd.Flags().IntVar(&createEndpointReq.Endpoint.ReplicaCount, "replica-count", createEndpointReq.Endpoint.ReplicaCount, `The client-supplied desired number of replicas for the endpoint, applied at create/update time.`)
+	// TODO: complex arg: scaling_info
+	cmd.Flags().IntVar(&createEndpointReq.Endpoint.TargetQps, "target-qps", createEndpointReq.Endpoint.TargetQps, `Target QPS for the endpoint.`)
+	// TODO: complex arg: throughput_info
+	cmd.Flags().StringVar(&createEndpointReq.Endpoint.UsagePolicyId, "usage-policy-id", createEndpointReq.Endpoint.UsagePolicyId, `The usage policy id applied to the endpoint.`)
+
+	cmd.Use = "create-endpoint PARENT ENDPOINT_TYPE"
+	cmd.Short = `*Public Preview* Create an AI Search endpoint.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Create an AI Search endpoint.
+
+  Create a new AI Search endpoint.
+
+  Arguments:
+    PARENT: The Workspace where this Endpoint will be created. Format:
+      workspaces/{workspace_id}
+    ENDPOINT_TYPE: Type of endpoint. Required on create and immutable thereafter.
+      Supported values: [STANDARD, STORAGE_OPTIMIZED]`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(1)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only PARENT as positional arguments. Provide 'endpoint_type' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := createEndpointJson.Unmarshal(&createEndpointReq.Endpoint)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		createEndpointReq.Parent = args[0]
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[1], &createEndpointReq.Endpoint.EndpointType)
+			if err != nil {
+				return fmt.Errorf("invalid ENDPOINT_TYPE: %s", args[1])
+			}
+
+		}
+
+		response, err := w.AiSearch.CreateEndpoint(ctx, createEndpointReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range createEndpointOverrides {
+		fn(cmd, &createEndpointReq)
+	}
+
+	return cmd
+}
+
+// start create-index command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var createIndexOverrides []func(
+	*cobra.Command,
+	*aisearch.CreateIndexRequest,
+)
+
+func newCreateIndex() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var createIndexReq aisearch.CreateIndexRequest
+	createIndexReq.Index = aisearch.Index{}
+	var createIndexJson flags.JsonFlag
+
+	cmd.Flags().Var(&createIndexJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&createIndexReq.IndexId, "index-id", createIndexReq.IndexId, `The user-supplied Unity Catalog table name for the Index, per AIP-133.`)
+	// TODO: complex arg: delta_sync_index_spec
+	// TODO: complex arg: direct_access_index_spec
+	cmd.Flags().Var(&createIndexReq.Index.IndexSubtype, "index-subtype", `The subtype of the index. Supported values: [FULL_TEXT, HYBRID, VECTOR]`)
+	cmd.Flags().StringVar(&createIndexReq.Index.Name, "name", createIndexReq.Index.Name, `Name of the AI Search index.`)
+	// TODO: complex arg: status
+
+	cmd.Use = "create-index PARENT PRIMARY_KEY INDEX_TYPE"
+	cmd.Short = `*Public Preview* Create an AI Search index.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Create an AI Search index.
+
+  Create a new AI Search index.
+
+  Arguments:
+    PARENT: The Endpoint where this Index will be created. Format:
+      workspaces/{workspace_id}/endpoints/{endpoint_id}
+    PRIMARY_KEY: Primary key of the index. Set on create and immutable thereafter.
+    INDEX_TYPE: Type of index. Required on create and immutable thereafter.
+      Supported values: [DELTA_SYNC, DIRECT_ACCESS]`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(1)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only PARENT as positional arguments. Provide 'primary_key', 'index_type' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(3)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := createIndexJson.Unmarshal(&createIndexReq.Index)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		createIndexReq.Parent = args[0]
+		if !cmd.Flags().Changed("json") {
+			createIndexReq.Index.PrimaryKey = args[1]
+		}
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[2], &createIndexReq.Index.IndexType)
+			if err != nil {
+				return fmt.Errorf("invalid INDEX_TYPE: %s", args[2])
+			}
+
+		}
+
+		response, err := w.AiSearch.CreateIndex(ctx, createIndexReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range createIndexOverrides {
+		fn(cmd, &createIndexReq)
+	}
+
+	return cmd
+}
+
+// start delete-endpoint command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteEndpointOverrides []func(
+	*cobra.Command,
+	*aisearch.DeleteEndpointRequest,
+)
+
+func newDeleteEndpoint() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteEndpointReq aisearch.DeleteEndpointRequest
+
+	cmd.Use = "delete-endpoint NAME"
+	cmd.Short = `*Public Preview* Delete an AI Search endpoint.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Delete an AI Search endpoint.
+
+  Arguments:
+    NAME: Full resource name of the endpoint to delete. Format:
+      workspaces/{workspace_id}/endpoints/{endpoint_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		deleteEndpointReq.Name = args[0]
+
+		err = w.AiSearch.DeleteEndpoint(ctx, deleteEndpointReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteEndpointOverrides {
+		fn(cmd, &deleteEndpointReq)
+	}
+
+	return cmd
+}
+
+// start delete-index command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteIndexOverrides []func(
+	*cobra.Command,
+	*aisearch.DeleteIndexRequest,
+)
+
+func newDeleteIndex() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteIndexReq aisearch.DeleteIndexRequest
+
+	cmd.Use = "delete-index NAME"
+	cmd.Short = `*Public Preview* Delete an AI Search index.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Delete an AI Search index.
+
+  Arguments:
+    NAME: Full resource name of the index to delete. Format:
+      workspaces/{workspace_id}/endpoints/{endpoint_id}/indexes/{index_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		deleteIndexReq.Name = args[0]
+
+		err = w.AiSearch.DeleteIndex(ctx, deleteIndexReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteIndexOverrides {
+		fn(cmd, &deleteIndexReq)
+	}
+
+	return cmd
+}
+
+// start get-endpoint command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getEndpointOverrides []func(
+	*cobra.Command,
+	*aisearch.GetEndpointRequest,
+)
+
+func newGetEndpoint() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getEndpointReq aisearch.GetEndpointRequest
+
+	cmd.Use = "get-endpoint NAME"
+	cmd.Short = `*Public Preview* Get an AI Search endpoint.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get an AI Search endpoint.
+
+  Get details for a single AI Search endpoint.
+
+  Arguments:
+    NAME: Full resource name of the endpoint. Format:
+      workspaces/{workspace_id}/endpoints/{endpoint_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getEndpointReq.Name = args[0]
+
+		response, err := w.AiSearch.GetEndpoint(ctx, getEndpointReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getEndpointOverrides {
+		fn(cmd, &getEndpointReq)
+	}
+
+	return cmd
+}
+
+// start get-index command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getIndexOverrides []func(
+	*cobra.Command,
+	*aisearch.GetIndexRequest,
+)
+
+func newGetIndex() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getIndexReq aisearch.GetIndexRequest
+
+	cmd.Use = "get-index NAME"
+	cmd.Short = `*Public Preview* Get an AI Search index.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get an AI Search index.
+
+  Get details for a single AI Search index.
+
+  Arguments:
+    NAME: Full resource name of the index. Format:
+      workspaces/{workspace_id}/endpoints/{endpoint_id}/indexes/{index_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getIndexReq.Name = args[0]
+
+		response, err := w.AiSearch.GetIndex(ctx, getIndexReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getIndexOverrides {
+		fn(cmd, &getIndexReq)
+	}
+
+	return cmd
+}
+
+// start list-endpoints command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listEndpointsOverrides []func(
+	*cobra.Command,
+	*aisearch.ListEndpointsRequest,
+)
+
+func newListEndpoints() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listEndpointsReq aisearch.ListEndpointsRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listEndpointsLimit int
+
+	cmd.Flags().IntVar(&listEndpointsReq.PageSize, "page-size", listEndpointsReq.PageSize, `Best-effort upper bound on the number of results to return.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listEndpointsLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listEndpointsReq.PageToken, "page-token", listEndpointsReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-endpoints PARENT"
+	cmd.Short = `*Public Preview* List AI Search endpoints.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+List AI Search endpoints.
+
+  List AI Search endpoints in a workspace.
+
+  Arguments:
+    PARENT: The Workspace that owns this collection of endpoints. Format:
+      workspaces/{workspace_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		listEndpointsReq.Parent = args[0]
+
+		response := w.AiSearch.ListEndpoints(ctx, listEndpointsReq)
+		if listEndpointsLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listEndpointsLimit)
+		}
+		if listEndpointsLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listEndpointsLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listEndpointsOverrides {
+		fn(cmd, &listEndpointsReq)
+	}
+
+	return cmd
+}
+
+// start list-indexes command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listIndexesOverrides []func(
+	*cobra.Command,
+	*aisearch.ListIndexesRequest,
+)
+
+func newListIndexes() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listIndexesReq aisearch.ListIndexesRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listIndexesLimit int
+
+	cmd.Flags().IntVar(&listIndexesReq.PageSize, "page-size", listIndexesReq.PageSize, `Best-effort upper bound on the number of results to return.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listIndexesLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listIndexesReq.PageToken, "page-token", listIndexesReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-indexes PARENT"
+	cmd.Short = `*Public Preview* List AI Search indexes.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+List AI Search indexes.
+
+  List AI Search indexes on an endpoint.
+
+  Arguments:
+    PARENT: The Endpoint that owns this collection of indexes. Format:
+      workspaces/{workspace_id}/endpoints/{endpoint_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		listIndexesReq.Parent = args[0]
+
+		response := w.AiSearch.ListIndexes(ctx, listIndexesReq)
+		if listIndexesLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listIndexesLimit)
+		}
+		if listIndexesLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listIndexesLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listIndexesOverrides {
+		fn(cmd, &listIndexesReq)
+	}
+
+	return cmd
+}
+
+// start query-index command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var queryIndexOverrides []func(
+	*cobra.Command,
+	*aisearch.QueryIndexRequest,
+)
+
+func newQueryIndex() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var queryIndexReq aisearch.QueryIndexRequest
+	var queryIndexJson flags.JsonFlag
+
+	cmd.Flags().Var(&queryIndexJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: columns_to_rerank
+	// TODO: array: facets
+	cmd.Flags().StringVar(&queryIndexReq.FiltersJson, "filters-json", queryIndexReq.FiltersJson, `JSON string describing query filters (e.g.`)
+	cmd.Flags().IntVar(&queryIndexReq.MaxResults, "max-results", queryIndexReq.MaxResults, `Maximum number of results to return (the legacy num_results).`)
+	// TODO: array: query_columns
+	cmd.Flags().StringVar(&queryIndexReq.QueryText, "query-text", queryIndexReq.QueryText, `Query text.`)
+	cmd.Flags().StringVar(&queryIndexReq.QueryType, "query-type", queryIndexReq.QueryType, `Query type: ANN, HYBRID, or FULL_TEXT.`)
+	// TODO: array: query_vector
+	// TODO: complex arg: reranker
+	cmd.Flags().Float64Var(&queryIndexReq.ScoreThreshold, "score-threshold", queryIndexReq.ScoreThreshold, `Score threshold for the approximate nearest-neighbor search.`)
+	// TODO: array: sort_columns
+
+	cmd.Use = "query-index NAME"
+	cmd.Short = `*Public Preview* Query an AI Search index.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Query an AI Search index.
+
+  Query (search) an AI Search index. Read-only, so a read-scoped token may
+  invoke it.
+
+  Arguments:
+    NAME: Full resource name of the index to query. Format:
+      workspaces/{workspace_id}/endpoints/{endpoint_id}/indexes/{index_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := queryIndexJson.Unmarshal(&queryIndexReq)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		} else {
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
+		}
+		queryIndexReq.Name = args[0]
+
+		response, err := w.AiSearch.QueryIndex(ctx, queryIndexReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range queryIndexOverrides {
+		fn(cmd, &queryIndexReq)
+	}
+
+	return cmd
+}
+
+// start remove-data command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var removeDataOverrides []func(
+	*cobra.Command,
+	*aisearch.RemoveDataRequest,
+)
+
+func newRemoveData() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var removeDataReq aisearch.RemoveDataRequest
+	var removeDataJson flags.JsonFlag
+
+	cmd.Flags().Var(&removeDataJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Use = "remove-data NAME"
+	cmd.Short = `*Public Preview* Remove data from an AI Search index.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Remove data from an AI Search index.
+
+  Remove rows by primary key from a Direct Access AI Search index.
+
+  Arguments:
+    NAME: Full resource name of the index. Must be a Direct Access index. Format:
+      workspaces/{workspace_id}/endpoints/{endpoint_id}/indexes/{index_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := removeDataJson.Unmarshal(&removeDataReq)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		} else {
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
+		}
+		removeDataReq.Name = args[0]
+
+		response, err := w.AiSearch.RemoveData(ctx, removeDataReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range removeDataOverrides {
+		fn(cmd, &removeDataReq)
+	}
+
+	return cmd
+}
+
+// start scan-index command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var scanIndexOverrides []func(
+	*cobra.Command,
+	*aisearch.ScanIndexRequest,
+)
+
+func newScanIndex() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var scanIndexReq aisearch.ScanIndexRequest
+	var scanIndexJson flags.JsonFlag
+
+	cmd.Flags().Var(&scanIndexJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().IntVar(&scanIndexReq.PageSize, "page-size", scanIndexReq.PageSize, `Maximum number of rows to return in this page.`)
+	cmd.Flags().StringVar(&scanIndexReq.PageToken, "page-token", scanIndexReq.PageToken, `Page token from a previous response; if unset, scanning starts from the beginning.`)
+
+	cmd.Use = "scan-index NAME"
+	cmd.Short = `*Public Preview* Scan an AI Search index.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Scan an AI Search index.
+
+  Scan (paginate over) the rows of an AI Search index.
+
+  Arguments:
+    NAME: Full resource name of the index to scan. Format:
+      workspaces/{workspace_id}/endpoints/{endpoint_id}/indexes/{index_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := scanIndexJson.Unmarshal(&scanIndexReq)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		scanIndexReq.Name = args[0]
+
+		response, err := w.AiSearch.ScanIndex(ctx, scanIndexReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range scanIndexOverrides {
+		fn(cmd, &scanIndexReq)
+	}
+
+	return cmd
+}
+
+// start sync-index command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var syncIndexOverrides []func(
+	*cobra.Command,
+	*aisearch.SyncIndexRequest,
+)
+
+func newSyncIndex() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var syncIndexReq aisearch.SyncIndexRequest
+
+	cmd.Use = "sync-index NAME"
+	cmd.Short = `*Public Preview* Synchronize an AI Search index.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Synchronize an AI Search index.
+
+  Synchronize a Delta Sync AI Search index with its source Delta table. Applies
+  only to Delta Sync indexes; Direct Access indexes are written via the
+  data-plane upsert path.
+
+  Arguments:
+    NAME: Full resource name of the index to synchronize. Must be a Delta Sync
+      index. Format:
+      workspaces/{workspace_id}/endpoints/{endpoint_id}/indexes/{index_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		syncIndexReq.Name = args[0]
+
+		response, err := w.AiSearch.SyncIndex(ctx, syncIndexReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range syncIndexOverrides {
+		fn(cmd, &syncIndexReq)
+	}
+
+	return cmd
+}
+
+// start update-endpoint command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateEndpointOverrides []func(
+	*cobra.Command,
+	*aisearch.UpdateEndpointRequest,
+)
+
+func newUpdateEndpoint() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateEndpointReq aisearch.UpdateEndpointRequest
+	updateEndpointReq.Endpoint = aisearch.Endpoint{}
+	var updateEndpointJson flags.JsonFlag
+
+	cmd.Flags().Var(&updateEndpointJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&updateEndpointReq.Endpoint.BudgetPolicyId, "budget-policy-id", updateEndpointReq.Endpoint.BudgetPolicyId, `The user-selected budget policy id for the endpoint.`)
+	// TODO: array: custom_tags
+	// TODO: complex arg: endpoint_status
+	cmd.Flags().StringVar(&updateEndpointReq.Endpoint.Name, "name", updateEndpointReq.Endpoint.Name, `Name of the AI Search endpoint.`)
+	cmd.Flags().IntVar(&updateEndpointReq.Endpoint.ReplicaCount, "replica-count", updateEndpointReq.Endpoint.ReplicaCount, `The client-supplied desired number of replicas for the endpoint, applied at create/update time.`)
+	// TODO: complex arg: scaling_info
+	cmd.Flags().IntVar(&updateEndpointReq.Endpoint.TargetQps, "target-qps", updateEndpointReq.Endpoint.TargetQps, `Target QPS for the endpoint.`)
+	// TODO: complex arg: throughput_info
+	cmd.Flags().StringVar(&updateEndpointReq.Endpoint.UsagePolicyId, "usage-policy-id", updateEndpointReq.Endpoint.UsagePolicyId, `The usage policy id applied to the endpoint.`)
+
+	cmd.Use = "update-endpoint NAME UPDATE_MASK ENDPOINT_TYPE"
+	cmd.Short = `*Public Preview* Update an AI Search endpoint.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Update an AI Search endpoint.
+
+  Update an existing AI Search endpoint. Multi-bucket masks are supported and
+  dispatched in deterministic bucket order: budget policy, custom tags,
+  throughput, then scaling/replicas. Per-bucket dispatch is not atomic across
+  buckets — if a later bucket fails, earlier buckets may already have been
+  applied.
+
+  Arguments:
+    NAME: Name of the AI Search endpoint. Server-assigned full resource path
+      (workspaces/{workspace}/endpoints/{endpoint}) on output. On create, the
+      user-supplied short name is conveyed via
+      CreateEndpointRequest.endpoint_id; the server composes the full name
+      and returns it on the response.
+    UPDATE_MASK: The list of fields to update.
+    ENDPOINT_TYPE: Type of endpoint. Required on create and immutable thereafter.
+      Supported values: [STANDARD, STORAGE_OPTIMIZED]`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(2)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only NAME, UPDATE_MASK as positional arguments. Provide 'endpoint_type' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(3)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updateEndpointJson.Unmarshal(&updateEndpointReq.Endpoint)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		updateEndpointReq.Name = args[0]
+		if args[1] != "" {
+			updateMaskArray := strings.Split(args[1], ",")
+			updateEndpointReq.UpdateMask = *fieldmask.New(updateMaskArray)
+		}
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[2], &updateEndpointReq.Endpoint.EndpointType)
+			if err != nil {
+				return fmt.Errorf("invalid ENDPOINT_TYPE: %s", args[2])
+			}
+
+		}
+
+		response, err := w.AiSearch.UpdateEndpoint(ctx, updateEndpointReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateEndpointOverrides {
+		fn(cmd, &updateEndpointReq)
+	}
+
+	return cmd
+}
+
+// start upsert-data command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var upsertDataOverrides []func(
+	*cobra.Command,
+	*aisearch.UpsertDataRequest,
+)
+
+func newUpsertData() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var upsertDataReq aisearch.UpsertDataRequest
+	var upsertDataJson flags.JsonFlag
+
+	cmd.Flags().Var(&upsertDataJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Use = "upsert-data NAME INPUTS_JSON"
+	cmd.Short = `*Public Preview* Upsert data into an AI Search index.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Upsert data into an AI Search index.
+
+  Upsert rows into a Direct Access AI Search index.
+
+  Arguments:
+    NAME: Full resource name of the index. Must be a Direct Access index. Format:
+      workspaces/{workspace_id}/endpoints/{endpoint_id}/indexes/{index_id}
+    INPUTS_JSON: JSON document describing the rows to upsert.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(1)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only NAME as positional arguments. Provide 'inputs_json' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := upsertDataJson.Unmarshal(&upsertDataReq)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		upsertDataReq.Name = args[0]
+		if !cmd.Flags().Changed("json") {
+			upsertDataReq.InputsJson = args[1]
+		}
+
+		response, err := w.AiSearch.UpsertData(ctx, upsertDataReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range upsertDataOverrides {
+		fn(cmd, &upsertDataReq)
+	}
+
+	return cmd
+}
+
+// end service AiSearch
diff --git a/cmd/workspace/aibi-dashboard-embedding-access-policy/aibi-dashboard-embedding-access-policy.go b/cmd/workspace/aibi-dashboard-embedding-access-policy/aibi-dashboard-embedding-access-policy.go
old mode 100755
new mode 100644
index 4c063bb9c73..5341051cd12
--- a/cmd/workspace/aibi-dashboard-embedding-access-policy/aibi-dashboard-embedding-access-policy.go
+++ b/cmd/workspace/aibi-dashboard-embedding-access-policy/aibi-dashboard-embedding-access-policy.go
@@ -3,7 +3,7 @@
 package aibi_dashboard_embedding_access_policy
 
 import (
-	"fmt"
+	"errors"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
@@ -20,13 +20,19 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "aibi-dashboard-embedding-access-policy",
-		Short: `Controls whether AI/BI published dashboard embedding is enabled, conditionally enabled, or disabled at the workspace level.`,
-		Long: `Controls whether AI/BI published dashboard embedding is enabled, conditionally
+		Short: `*Public Preview* Controls whether AI/BI published dashboard embedding is enabled, conditionally enabled, or disabled at the workspace level.`,
+		Long: `This command is in Public Preview and may change without notice.
+
+Controls whether AI/BI published dashboard embedding is enabled, conditionally
   enabled, or disabled at the workspace level. By default, this setting is
   conditionally enabled (ALLOW_APPROVED_DOMAINS).`,
 		RunE: root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
 	// Add methods
 	cmd.AddCommand(newDelete())
 	cmd.AddCommand(newGet())
@@ -57,13 +63,17 @@ func newDelete() *cobra.Command {
 	cmd.Flags().StringVar(&deleteReq.Etag, "etag", deleteReq.Etag, `etag used for versioning.`)
 
 	cmd.Use = "delete"
-	cmd.Short = `Delete the AI/BI dashboard embedding access policy.`
-	cmd.Long = `Delete the AI/BI dashboard embedding access policy.
+	cmd.Short = `*Public Preview* Delete the AI/BI dashboard embedding access policy.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Delete the AI/BI dashboard embedding access policy.
 
   Delete the AI/BI dashboard embedding access policy, reverting back to the
   default.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -112,14 +122,18 @@ func newGet() *cobra.Command {
 	cmd.Flags().StringVar(&getReq.Etag, "etag", getReq.Etag, `etag used for versioning.`)
 
 	cmd.Use = "get"
-	cmd.Short = `Retrieve the AI/BI dashboard embedding access policy.`
-	cmd.Long = `Retrieve the AI/BI dashboard embedding access policy.
+	cmd.Short = `*Public Preview* Retrieve the AI/BI dashboard embedding access policy.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Retrieve the AI/BI dashboard embedding access policy.
 
   Retrieves the AI/BI dashboard embedding access policy. The default setting is
   ALLOW_APPROVED_DOMAINS, permitting AI/BI dashboards to be embedded on approved
   domains.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -169,12 +183,16 @@ func newUpdate() *cobra.Command {
 	cmd.Flags().Var(&updateJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Use = "update"
-	cmd.Short = `Update the AI/BI dashboard embedding access policy.`
-	cmd.Long = `Update the AI/BI dashboard embedding access policy.
+	cmd.Short = `*Public Preview* Update the AI/BI dashboard embedding access policy.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Update the AI/BI dashboard embedding access policy.
 
   Updates the AI/BI dashboard embedding access policy at the workspace level.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -193,7 +211,7 @@ func newUpdate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := w.Settings.AibiDashboardEmbeddingAccessPolicy().Update(ctx, updateReq)
diff --git a/cmd/workspace/aibi-dashboard-embedding-approved-domains/aibi-dashboard-embedding-approved-domains.go b/cmd/workspace/aibi-dashboard-embedding-approved-domains/aibi-dashboard-embedding-approved-domains.go
old mode 100755
new mode 100644
index 148905979f7..3477f3a0971
--- a/cmd/workspace/aibi-dashboard-embedding-approved-domains/aibi-dashboard-embedding-approved-domains.go
+++ b/cmd/workspace/aibi-dashboard-embedding-approved-domains/aibi-dashboard-embedding-approved-domains.go
@@ -3,7 +3,7 @@
 package aibi_dashboard_embedding_approved_domains
 
 import (
-	"fmt"
+	"errors"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
@@ -20,13 +20,19 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "aibi-dashboard-embedding-approved-domains",
-		Short: `Controls the list of domains approved to host the embedded AI/BI dashboards.`,
-		Long: `Controls the list of domains approved to host the embedded AI/BI dashboards.
+		Short: `*Public Preview* Controls the list of domains approved to host the embedded AI/BI dashboards.`,
+		Long: `This command is in Public Preview and may change without notice.
+
+Controls the list of domains approved to host the embedded AI/BI dashboards.
   The approved domains list can't be mutated when the current access policy is
   not set to ALLOW_APPROVED_DOMAINS.`,
 		RunE: root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
 	// Add methods
 	cmd.AddCommand(newDelete())
 	cmd.AddCommand(newGet())
@@ -57,13 +63,17 @@ func newDelete() *cobra.Command {
 	cmd.Flags().StringVar(&deleteReq.Etag, "etag", deleteReq.Etag, `etag used for versioning.`)
 
 	cmd.Use = "delete"
-	cmd.Short = `Delete AI/BI dashboard embedding approved domains.`
-	cmd.Long = `Delete AI/BI dashboard embedding approved domains.
+	cmd.Short = `*Public Preview* Delete AI/BI dashboard embedding approved domains.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Delete AI/BI dashboard embedding approved domains.
 
   Delete the list of domains approved to host embedded AI/BI dashboards,
   reverting back to the default empty list.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -112,12 +122,16 @@ func newGet() *cobra.Command {
 	cmd.Flags().StringVar(&getReq.Etag, "etag", getReq.Etag, `etag used for versioning.`)
 
 	cmd.Use = "get"
-	cmd.Short = `Retrieve the list of domains approved to host embedded AI/BI dashboards.`
-	cmd.Long = `Retrieve the list of domains approved to host embedded AI/BI dashboards.
+	cmd.Short = `*Public Preview* Retrieve the list of domains approved to host embedded AI/BI dashboards.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Retrieve the list of domains approved to host embedded AI/BI dashboards.
 
   Retrieves the list of domains approved to host embedded AI/BI dashboards.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -167,14 +181,18 @@ func newUpdate() *cobra.Command {
 	cmd.Flags().Var(&updateJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Use = "update"
-	cmd.Short = `Update the list of domains approved to host embedded AI/BI dashboards.`
-	cmd.Long = `Update the list of domains approved to host embedded AI/BI dashboards.
+	cmd.Short = `*Public Preview* Update the list of domains approved to host embedded AI/BI dashboards.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Update the list of domains approved to host embedded AI/BI dashboards.
 
   Updates the list of domains approved to host embedded AI/BI dashboards. This
   update will fail if the current workspace access policy is not
   ALLOW_APPROVED_DOMAINS.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -193,7 +211,7 @@ func newUpdate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := w.Settings.AibiDashboardEmbeddingApprovedDomains().Update(ctx, updateReq)
diff --git a/cmd/workspace/alerts-legacy/alerts-legacy.go b/cmd/workspace/alerts-legacy/alerts-legacy.go
old mode 100755
new mode 100644
index 1f211a621d0..b381f027b2c
--- a/cmd/workspace/alerts-legacy/alerts-legacy.go
+++ b/cmd/workspace/alerts-legacy/alerts-legacy.go
@@ -3,7 +3,7 @@
 package alerts_legacy
 
 import (
-	"fmt"
+	"errors"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
@@ -20,8 +20,10 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "alerts-legacy",
-		Short: `The alerts API can be used to perform CRUD operations on alerts.`,
-		Long: `The alerts API can be used to perform CRUD operations on alerts. An alert is a
+		Short: `*Public Preview* The alerts API can be used to perform CRUD operations on alerts.`,
+		Long: `This command is in Public Preview and may change without notice.
+
+The alerts API can be used to perform CRUD operations on alerts. An alert is a
   Databricks SQL object that periodically runs a query, evaluates a condition of
   its result, and notifies one or more users and/or notification destinations if
   the condition was met. Alerts can be scheduled using the sql_task type of
@@ -35,6 +37,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -71,8 +77,10 @@ func newCreate() *cobra.Command {
 	cmd.Flags().IntVar(&createReq.Rearm, "rearm", createReq.Rearm, `Number of seconds after being triggered before the alert rearms itself and can be triggered again.`)
 
 	cmd.Use = "create"
-	cmd.Short = `Create an alert.`
-	cmd.Long = `Create an alert.
+	cmd.Short = `*Public Preview* Create an alert.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Create an alert.
 
   Creates an alert. An alert is a Databricks SQL object that periodically runs a
   query, evaluates a condition of its result, and notifies users or notification
@@ -84,6 +92,8 @@ func newCreate() *cobra.Command {
   [Learn more]: https://docs.databricks.com/en/sql/dbsql-api-latest.html`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -102,7 +112,7 @@ func newCreate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := w.AlertsLegacy.Create(ctx, createReq)
@@ -140,8 +150,10 @@ func newDelete() *cobra.Command {
 	var deleteReq sql.DeleteAlertsLegacyRequest
 
 	cmd.Use = "delete ALERT_ID"
-	cmd.Short = `Delete an alert.`
-	cmd.Long = `Delete an alert.
+	cmd.Short = `*Public Preview* Delete an alert.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Delete an alert.
 
   Deletes an alert. Deleted alerts are no longer accessible and cannot be
   restored. **Note**: Unlike queries and dashboards, alerts cannot be moved to
@@ -153,6 +165,8 @@ func newDelete() *cobra.Command {
   [Learn more]: https://docs.databricks.com/en/sql/dbsql-api-latest.html`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -200,8 +214,10 @@ func newGet() *cobra.Command {
 	var getReq sql.GetAlertsLegacyRequest
 
 	cmd.Use = "get ALERT_ID"
-	cmd.Short = `Get an alert.`
-	cmd.Long = `Get an alert.
+	cmd.Short = `*Public Preview* Get an alert.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get an alert.
 
   Gets an alert.
 
@@ -211,6 +227,8 @@ func newGet() *cobra.Command {
   [Learn more]: https://docs.databricks.com/en/sql/dbsql-api-latest.html`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -256,8 +274,10 @@ func newList() *cobra.Command {
 	cmd := &cobra.Command{}
 
 	cmd.Use = "list"
-	cmd.Short = `Get alerts.`
-	cmd.Long = `Get alerts.
+	cmd.Short = `*Public Preview* Get alerts.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get alerts.
 
   Gets a list of alerts.
 
@@ -267,6 +287,8 @@ func newList() *cobra.Command {
   [Learn more]: https://docs.databricks.com/en/sql/dbsql-api-latest.html`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -312,8 +334,10 @@ func newUpdate() *cobra.Command {
 	cmd.Flags().IntVar(&updateReq.Rearm, "rearm", updateReq.Rearm, `Number of seconds after being triggered before the alert rearms itself and can be triggered again.`)
 
 	cmd.Use = "update ALERT_ID"
-	cmd.Short = `Update an alert.`
-	cmd.Long = `Update an alert.
+	cmd.Short = `*Public Preview* Update an alert.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Update an alert.
 
   Updates an alert.
 
@@ -323,6 +347,8 @@ func newUpdate() *cobra.Command {
   [Learn more]: https://docs.databricks.com/en/sql/dbsql-api-latest.html`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -346,7 +372,7 @@ func newUpdate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 		updateReq.AlertId = args[0]
 
diff --git a/cmd/workspace/alerts-v2/alerts-v2.go b/cmd/workspace/alerts-v2/alerts-v2.go
old mode 100755
new mode 100644
index 11ec795d8ba..f7a31691341
--- a/cmd/workspace/alerts-v2/alerts-v2.go
+++ b/cmd/workspace/alerts-v2/alerts-v2.go
@@ -3,6 +3,7 @@
 package alerts_v2
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -26,6 +27,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreateAlert())
 	cmd.AddCommand(newGetAlert())
@@ -61,7 +66,9 @@ func newCreateAlert() *cobra.Command {
 
 	cmd.Flags().StringVar(&createAlertReq.Alert.CustomDescription, "custom-description", createAlertReq.Alert.CustomDescription, `Custom description for the alert.`)
 	cmd.Flags().StringVar(&createAlertReq.Alert.CustomSummary, "custom-summary", createAlertReq.Alert.CustomSummary, `Custom summary for the alert.`)
+	cmd.Flags().Var(&createAlertReq.Alert.CustomTemplateFormat, "custom-template-format", `The format used to interpret the custom_summary and custom_description templates. Supported values: [HTML, MARKDOWN]`)
 	// TODO: complex arg: effective_run_as
+	// TODO: array: parameters
 	cmd.Flags().StringVar(&createAlertReq.Alert.ParentPath, "parent-path", createAlertReq.Alert.ParentPath, `The workspace path of the folder containing the alert.`)
 	// TODO: complex arg: run_as
 	cmd.Flags().StringVar(&createAlertReq.Alert.RunAsUserName, "run-as-user-name", createAlertReq.Alert.RunAsUserName, `The run as username or application ID of service principal.`)
@@ -80,12 +87,14 @@ func newCreateAlert() *cobra.Command {
     SCHEDULE: `
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'display_name', 'query_text', 'warehouse_id', 'evaluation', 'schedule' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'display_name', 'query_text', 'warehouse_id', 'evaluation', 'schedule' in your JSON input")
 			}
 			return nil
 		}
@@ -175,6 +184,8 @@ func newGetAlert() *cobra.Command {
   Gets an alert.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -196,7 +207,7 @@ func newGetAlert() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have ")
+			return errors.New("expected to have ")
 		}
 		getAlertReq.Id = args[0]
 
@@ -254,6 +265,8 @@ func newListAlerts() *cobra.Command {
   Gets a list of alerts accessible to the user, ordered by creation time.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -313,6 +326,8 @@ func newTrashAlert() *cobra.Command {
   UI. A trashed alert is permanently deleted after 30 days.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -334,7 +349,7 @@ func newTrashAlert() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have ")
+			return errors.New("expected to have ")
 		}
 		trashAlertReq.Id = args[0]
 
@@ -377,7 +392,9 @@ func newUpdateAlert() *cobra.Command {
 
 	cmd.Flags().StringVar(&updateAlertReq.Alert.CustomDescription, "custom-description", updateAlertReq.Alert.CustomDescription, `Custom description for the alert.`)
 	cmd.Flags().StringVar(&updateAlertReq.Alert.CustomSummary, "custom-summary", updateAlertReq.Alert.CustomSummary, `Custom summary for the alert.`)
+	cmd.Flags().Var(&updateAlertReq.Alert.CustomTemplateFormat, "custom-template-format", `The format used to interpret the custom_summary and custom_description templates. Supported values: [HTML, MARKDOWN]`)
 	// TODO: complex arg: effective_run_as
+	// TODO: array: parameters
 	cmd.Flags().StringVar(&updateAlertReq.Alert.ParentPath, "parent-path", updateAlertReq.Alert.ParentPath, `The workspace path of the folder containing the alert.`)
 	// TODO: complex arg: run_as
 	cmd.Flags().StringVar(&updateAlertReq.Alert.RunAsUserName, "run-as-user-name", updateAlertReq.Alert.RunAsUserName, `The run as username or application ID of service principal.`)
@@ -389,7 +406,7 @@ func newUpdateAlert() *cobra.Command {
   Update alert
 
   Arguments:
-    ID: UUID identifying the alert.
+    ID: The canonical identifier of the alert to retrieve information about.
     UPDATE_MASK: The field mask must be a single string, with multiple fields separated by
       commas (no spaces). The field path is relative to the resource object,
       using a dot (.) to navigate sub-fields (e.g., author.given_name).
@@ -408,12 +425,14 @@ func newUpdateAlert() *cobra.Command {
     SCHEDULE: `
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(2)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only ID, UPDATE_MASK as positional arguments. Provide 'display_name', 'query_text', 'warehouse_id', 'evaluation', 'schedule' in your JSON input")
+				return errors.New("when --json flag is specified, provide only ID, UPDATE_MASK as positional arguments. Provide 'display_name', 'query_text', 'warehouse_id', 'evaluation', 'schedule' in your JSON input")
 			}
 			return nil
 		}
diff --git a/cmd/workspace/alerts/alerts.go b/cmd/workspace/alerts/alerts.go
old mode 100755
new mode 100644
index 10ef4937fb5..3d7ea15c063
--- a/cmd/workspace/alerts/alerts.go
+++ b/cmd/workspace/alerts/alerts.go
@@ -3,6 +3,7 @@
 package alerts
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -30,6 +31,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -72,6 +77,8 @@ func newCreate() *cobra.Command {
   Creates an alert.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -139,6 +146,8 @@ func newDelete() *cobra.Command {
   alert through the UI. A trashed alert is permanently deleted after 30 days.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -160,7 +169,7 @@ func newDelete() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have ")
+			return errors.New("expected to have ")
 		}
 		deleteReq.Id = args[0]
 
@@ -204,6 +213,8 @@ func newGet() *cobra.Command {
   Gets an alert.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -225,7 +236,7 @@ func newGet() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have ")
+			return errors.New("expected to have ")
 		}
 		getReq.Id = args[0]
 
@@ -285,6 +296,8 @@ func newList() *cobra.Command {
   throttling, service degradation, or a temporary ban.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -360,12 +373,14 @@ func newUpdate() *cobra.Command {
       future.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(1)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only ID as positional arguments. Provide 'update_mask' in your JSON input")
+				return errors.New("when --json flag is specified, provide only ID as positional arguments. Provide 'update_mask' in your JSON input")
 			}
 			return nil
 		}
diff --git a/cmd/workspace/apps-settings/apps-settings.go b/cmd/workspace/apps-settings/apps-settings.go
old mode 100755
new mode 100644
index 7966bf91108..ce5e6d84a41
--- a/cmd/workspace/apps-settings/apps-settings.go
+++ b/cmd/workspace/apps-settings/apps-settings.go
@@ -3,6 +3,7 @@
 package apps_settings
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -30,6 +31,10 @@ func New() *cobra.Command {
 		RunE:   root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
 	// Add methods
 	cmd.AddCommand(newCreateCustomTemplate())
 	cmd.AddCommand(newDeleteCustomTemplate())
@@ -82,12 +87,14 @@ func newCreateCustomTemplate() *cobra.Command {
     GIT_PROVIDER: The Git provider of the template.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'git_repo', 'path', 'manifest', 'git_provider' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'git_repo', 'path', 'manifest', 'git_provider' in your JSON input")
 			}
 			return nil
 		}
@@ -176,6 +183,8 @@ func newDeleteCustomTemplate() *cobra.Command {
     NAME: The name of the custom template.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -233,6 +242,8 @@ func newGetCustomTemplate() *cobra.Command {
     NAME: The name of the custom template.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -300,6 +311,8 @@ func newListCustomTemplates() *cobra.Command {
   Lists all custom templates in the workspace.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -372,12 +385,14 @@ func newUpdateCustomTemplate() *cobra.Command {
     GIT_PROVIDER: The Git provider of the template.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(1)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only NAME as positional arguments. Provide 'name', 'git_repo', 'path', 'manifest', 'git_provider' in your JSON input")
+				return errors.New("when --json flag is specified, provide only NAME as positional arguments. Provide 'name', 'git_repo', 'path', 'manifest', 'git_provider' in your JSON input")
 			}
 			return nil
 		}
diff --git a/cmd/workspace/apps/apps.go b/cmd/workspace/apps/apps.go
old mode 100755
new mode 100644
index b2b9c7eb222..af088696b8b
--- a/cmd/workspace/apps/apps.go
+++ b/cmd/workspace/apps/apps.go
@@ -3,6 +3,7 @@
 package apps
 
 import (
+	"errors"
 	"fmt"
 	"strings"
 	"time"
@@ -32,6 +33,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newCreateSpace())
@@ -94,13 +99,19 @@ func newCreate() *cobra.Command {
 	// TODO: complex arg: active_deployment
 	// TODO: complex arg: app_status
 	cmd.Flags().StringVar(&createReq.App.BudgetPolicyId, "budget-policy-id", createReq.App.BudgetPolicyId, ``)
-	cmd.Flags().Var(&createReq.App.ComputeSize, "compute-size", `Supported values: [LARGE, MEDIUM]`)
+	cmd.Flags().IntVar(&createReq.App.ComputeMaxInstances, "compute-max-instances", createReq.App.ComputeMaxInstances, `Maximum number of app instances the app is configured to run.`)
+	cmd.Flags().IntVar(&createReq.App.ComputeMinInstances, "compute-min-instances", createReq.App.ComputeMinInstances, `Minimum number of app instances the app is configured to run.`)
+	cmd.Flags().Var(&createReq.App.ComputeSize, "compute-size", `Supported values: [LARGE, MEDIUM, XLARGE]`)
 	// TODO: complex arg: compute_status
+	// TODO: complex arg: default_git_source
 	cmd.Flags().StringVar(&createReq.App.Description, "description", createReq.App.Description, `The description of the app.`)
 	// TODO: array: effective_user_api_scopes
+	cmd.Flags().BoolVar(&createReq.App.ForwardUserAccessToken, "forward-user-access-token", createReq.App.ForwardUserAccessToken, `Forward the user's access token to the app.`)
 	// TODO: complex arg: git_repository
+	// TODO: complex arg: git_source
 	// TODO: complex arg: pending_deployment
 	// TODO: array: resources
+	cmd.Flags().StringVar(&createReq.App.SourceCodePath, "source-code-path", createReq.App.SourceCodePath, ``)
 	cmd.Flags().StringVar(&createReq.App.Space, "space", createReq.App.Space, `Name of the space this app belongs to.`)
 	// TODO: array: telemetry_export_destinations
 	cmd.Flags().StringVar(&createReq.App.UsagePolicyId, "usage-policy-id", createReq.App.UsagePolicyId, ``)
@@ -117,12 +128,14 @@ func newCreate() *cobra.Command {
       characters and hyphens. It must be unique within the workspace.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name' in your JSON input")
 			}
 			return nil
 		}
@@ -213,6 +226,7 @@ func newCreateSpace() *cobra.Command {
 
 	cmd.Flags().Var(&createSpaceJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
+	cmd.Flags().StringVar(&createSpaceReq.Space.AssumeGroupId, "assume-group-id", createSpaceReq.Space.AssumeGroupId, `The group whose permissions users assume via Role Authorization for apps in this space.`)
 	cmd.Flags().StringVar(&createSpaceReq.Space.Description, "description", createSpaceReq.Space.Description, `The description of the app space.`)
 	// TODO: array: effective_user_api_scopes
 	// TODO: array: resources
@@ -240,12 +254,14 @@ func newCreateSpace() *cobra.Command {
 	cmd.Hidden = true
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name' in your JSON input")
 			}
 			return nil
 		}
@@ -372,12 +388,14 @@ func newCreateUpdate() *cobra.Command {
       future.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(1)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only APP_NAME as positional arguments. Provide 'update_mask' in your JSON input")
+				return errors.New("when --json flag is specified, provide only APP_NAME as positional arguments. Provide 'update_mask' in your JSON input")
 			}
 			return nil
 		}
@@ -469,6 +487,8 @@ func newDelete() *cobra.Command {
     NAME: The name of the app.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -526,6 +546,8 @@ func newDeleteAppThumbnail() *cobra.Command {
     NAME: The name of the app.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -596,6 +618,8 @@ func newDeleteSpace() *cobra.Command {
 	cmd.Hidden = true
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -689,6 +713,7 @@ func newDeploy() *cobra.Command {
 	cmd.Flags().StringVar(&deployReq.AppDeployment.DeploymentId, "deployment-id", deployReq.AppDeployment.DeploymentId, `The unique id of the deployment.`)
 	// TODO: array: env_vars
 	// TODO: complex arg: git_source
+	// TODO: complex arg: health_check
 	cmd.Flags().Var(&deployReq.AppDeployment.Mode, "mode", `The mode of which the deployment will manage the source code. Supported values: [AUTO_SYNC, SNAPSHOT]`)
 	cmd.Flags().StringVar(&deployReq.AppDeployment.SourceCodePath, "source-code-path", deployReq.AppDeployment.SourceCodePath, `The workspace file system path of the source code used to create the app deployment.`)
 	// TODO: complex arg: status
@@ -703,6 +728,8 @@ func newDeploy() *cobra.Command {
     APP_NAME: The name of the app.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -790,6 +817,8 @@ func newGet() *cobra.Command {
     NAME: The name of the app.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -849,6 +878,8 @@ func newGetDeployment() *cobra.Command {
     DEPLOYMENT_ID: The unique id of the deployment.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -907,6 +938,8 @@ func newGetPermissionLevels() *cobra.Command {
     APP_NAME: The app for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -965,6 +998,8 @@ func newGetPermissions() *cobra.Command {
     APP_NAME: The app for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1025,6 +1060,8 @@ func newGetSpace() *cobra.Command {
 	cmd.Hidden = true
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1085,6 +1122,8 @@ func newGetSpaceOperation() *cobra.Command {
 	cmd.Hidden = true
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1142,6 +1181,8 @@ func newGetUpdate() *cobra.Command {
     APP_NAME: The name of the app.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1210,6 +1251,8 @@ func newList() *cobra.Command {
   Lists all apps in the workspace.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -1281,6 +1324,8 @@ func newListDeployments() *cobra.Command {
     APP_NAME: The name of the app.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1354,6 +1399,8 @@ func newListSpaces() *cobra.Command {
 	cmd.Hidden = true
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -1419,6 +1466,8 @@ func newSetPermissions() *cobra.Command {
     APP_NAME: The app for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1494,6 +1543,8 @@ func newStart() *cobra.Command {
     NAME: The name of the app.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1575,6 +1626,8 @@ func newStop() *cobra.Command {
     NAME: The name of the app.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1647,13 +1700,19 @@ func newUpdate() *cobra.Command {
 	// TODO: complex arg: active_deployment
 	// TODO: complex arg: app_status
 	cmd.Flags().StringVar(&updateReq.App.BudgetPolicyId, "budget-policy-id", updateReq.App.BudgetPolicyId, ``)
-	cmd.Flags().Var(&updateReq.App.ComputeSize, "compute-size", `Supported values: [LARGE, MEDIUM]`)
+	cmd.Flags().IntVar(&updateReq.App.ComputeMaxInstances, "compute-max-instances", updateReq.App.ComputeMaxInstances, `Maximum number of app instances the app is configured to run.`)
+	cmd.Flags().IntVar(&updateReq.App.ComputeMinInstances, "compute-min-instances", updateReq.App.ComputeMinInstances, `Minimum number of app instances the app is configured to run.`)
+	cmd.Flags().Var(&updateReq.App.ComputeSize, "compute-size", `Supported values: [LARGE, MEDIUM, XLARGE]`)
 	// TODO: complex arg: compute_status
+	// TODO: complex arg: default_git_source
 	cmd.Flags().StringVar(&updateReq.App.Description, "description", updateReq.App.Description, `The description of the app.`)
 	// TODO: array: effective_user_api_scopes
+	cmd.Flags().BoolVar(&updateReq.App.ForwardUserAccessToken, "forward-user-access-token", updateReq.App.ForwardUserAccessToken, `Forward the user's access token to the app.`)
 	// TODO: complex arg: git_repository
+	// TODO: complex arg: git_source
 	// TODO: complex arg: pending_deployment
 	// TODO: array: resources
+	cmd.Flags().StringVar(&updateReq.App.SourceCodePath, "source-code-path", updateReq.App.SourceCodePath, ``)
 	cmd.Flags().StringVar(&updateReq.App.Space, "space", updateReq.App.Space, `Name of the space this app belongs to.`)
 	// TODO: array: telemetry_export_destinations
 	cmd.Flags().StringVar(&updateReq.App.UsagePolicyId, "usage-policy-id", updateReq.App.UsagePolicyId, ``)
@@ -1663,13 +1722,16 @@ func newUpdate() *cobra.Command {
 	cmd.Short = `Update an app.`
 	cmd.Long = `Update an app.
 
-  Updates the app with the supplied name.
+  Updates the app with the supplied name. This is a full replacement: fields
+  omitted from the request are cleared, so send the complete app.
 
   Arguments:
     NAME: The name of the app. The name must contain only lowercase alphanumeric
       characters and hyphens. It must be unique within the workspace.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1744,6 +1806,8 @@ func newUpdateAppThumbnail() *cobra.Command {
     NAME: The name of the app.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1819,6 +1883,8 @@ func newUpdatePermissions() *cobra.Command {
     APP_NAME: The app for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1888,6 +1954,7 @@ func newUpdateSpace() *cobra.Command {
 
 	cmd.Flags().Var(&updateSpaceJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
+	cmd.Flags().StringVar(&updateSpaceReq.Space.AssumeGroupId, "assume-group-id", updateSpaceReq.Space.AssumeGroupId, `The group whose permissions users assume via Role Authorization for apps in this space.`)
 	cmd.Flags().StringVar(&updateSpaceReq.Space.Description, "description", updateSpaceReq.Space.Description, `The description of the app space.`)
 	// TODO: array: effective_user_api_scopes
 	// TODO: array: resources
@@ -1927,6 +1994,8 @@ func newUpdateSpace() *cobra.Command {
 	cmd.Hidden = true
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
diff --git a/cmd/workspace/apps/errors.go b/cmd/workspace/apps/errors.go
index 80ccc8af75f..cbcb2ce3860 100644
--- a/cmd/workspace/apps/errors.go
+++ b/cmd/workspace/apps/errors.go
@@ -15,14 +15,13 @@ const tailLinesSuggestedValue = 100
 // These are errors wrapped by retries.Halt() during GetWithTimeout().
 // Excludes API client errors (4xx) which are validation errors before deployment starts.
 func isDeploymentWaitError(err error) bool {
-	var retriesErr *retries.Err
-	if !errors.As(err, &retriesErr) || !retriesErr.Halt {
+	retriesErr, ok := errors.AsType[*retries.Err](err)
+	if !ok || !retriesErr.Halt {
 		return false
 	}
 
 	// Exclude API client errors (4xx) (e.g. app not found)
-	var apiErr *apierr.APIError
-	if errors.As(err, &apiErr) && apiErr.StatusCode >= 400 && apiErr.StatusCode < 500 {
+	if apiErr, ok := errors.AsType[*apierr.APIError](err); ok && apiErr.StatusCode >= 400 && apiErr.StatusCode < 500 {
 		return false
 	}
 
diff --git a/cmd/workspace/apps/git_flags.go b/cmd/workspace/apps/git_flags.go
new file mode 100644
index 00000000000..c600d4d0c05
--- /dev/null
+++ b/cmd/workspace/apps/git_flags.go
@@ -0,0 +1,244 @@
+package apps
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/databricks-sdk-go/service/apps"
+	"github.com/spf13/cobra"
+)
+
+// The apps create/update/deploy commands accept a git repository and a git
+// deployment source, but the code generator emits these nested objects as
+// `// TODO: complex arg` and only exposes them via --json. These overrides add
+// ergonomic top-level flags for the git fields so users can point an app at a
+// repo and deploy a specific ref without hand-writing JSON.
+//
+// The SDK models GitRepository and GitSource as optional pointers on the
+// request. We leave them nil unless the user sets a git flag; allocating them
+// unconditionally would send an empty object on every non-git create/deploy and
+// change the request the server sees.
+
+// gitRepositoryFlags binds the git repository flags onto an *apps.GitRepository
+// pointer field (App.GitRepository), used by both create and update. url and
+// provider identify the repository; auto-deploy is a modifier on it
+// (push-to-deploy). withCallerCredential adds --caller-git-credential-id (the
+// credential granting the app's service principal repo access); the server
+// rejects it on update, so only create passes true. It returns a PreRunE that
+// allocates the struct only when a flag was set.
+func gitRepositoryFlags(cmd *cobra.Command, target **apps.GitRepository, withCallerCredential bool) func(*cobra.Command, []string) error {
+	var url, provider string
+	var autoDeploy bool
+	var callerCredentialID int64
+	cmd.Flags().StringVar(&url, "git-url", "", "URL of the Git repository the app deploys from.")
+	cmd.Flags().StringVar(&provider, "git-provider", "", "Git provider. Case insensitive. Supported values: gitHub, gitHubEnterprise, bitbucketCloud, bitbucketServer, azureDevOpsServices, gitLab, gitLabEnterpriseEdition, awsCodeCommit.")
+	cmd.Flags().BoolVar(&autoDeploy, "git-auto-deploy", false, "Automatically redeploy the app on pushes to the configured Git branch. Requires --git-url and --git-provider.")
+
+	// caller_credential_id can only be set on create; the server rejects it on
+	// update. The modifier list in the "requires repo" error tracks this so the
+	// message never names a flag the command doesn't have.
+	modifiers := "--git-auto-deploy"
+	if withCallerCredential {
+		cmd.Flags().Int64Var(&callerCredentialID, "caller-git-credential-id", 0, "ID of the caller's Git credential used to grant the app's service principal access to the repository. Create only. Requires --git-url and --git-provider.")
+		modifiers = "--git-auto-deploy and --caller-git-credential-id"
+	}
+
+	return func(cmd *cobra.Command, args []string) error {
+		urlSet := cmd.Flags().Changed("git-url")
+		providerSet := cmd.Flags().Changed("git-provider")
+		autoDeploySet := cmd.Flags().Changed("git-auto-deploy")
+		credSet := withCallerCredential && cmd.Flags().Changed("caller-git-credential-id")
+		if !urlSet && !providerSet && !autoDeploySet && !credSet {
+			return nil
+		}
+		// The server requires both url and provider together, so fail early
+		// rather than shipping a half-populated repository it will reject.
+		if urlSet != providerSet {
+			return errors.New("--git-url and --git-provider must be set together")
+		}
+		// auto-deploy and the caller credential are modifiers on the repository;
+		// without url+provider there is no repository to attach them to.
+		if (autoDeploySet || credSet) && !urlSet {
+			return errors.New(modifiers + " require --git-url and --git-provider")
+		}
+		repo := &apps.GitRepository{Url: url, Provider: provider}
+		if autoDeploySet {
+			repo.AutoDeploy = autoDeploy
+			// auto_deploy is omitempty; force-send so --git-auto-deploy=false is
+			// transmitted (e.g. to turn auto-deploy off on update).
+			repo.ForceSendFields = append(repo.ForceSendFields, "AutoDeploy")
+		}
+		if credSet {
+			repo.CallerCredentialId = callerCredentialID
+		}
+		*target = repo
+		return nil
+	}
+}
+
+// gitSourceFlags binds the git source flags onto an *apps.GitSource pointer
+// field: AppDeployment.GitSource on deploy (the ref for one deployment), and
+// App.GitSource on create/update (the app's default deployment source, echoed
+// back as default_git_source). It returns a PreRunE that allocates the struct
+// only when a flag was set.
+func gitSourceFlags(cmd *cobra.Command, target **apps.GitSource) func(*cobra.Command, []string) error {
+	var branch, tag, commit, sourceCodePath string
+	cmd.Flags().StringVar(&branch, "git-branch", "", "Git branch to deploy from.")
+	cmd.Flags().StringVar(&tag, "git-tag", "", "Git tag to deploy from.")
+	cmd.Flags().StringVar(&commit, "git-commit", "", "Git commit SHA to deploy from.")
+	cmd.Flags().StringVar(&sourceCodePath, "git-source-code-path", "", "Relative path to the app source code within the Git repository. Defaults to the repository root.")
+
+	// branch, tag, and commit are a proto oneof (a single git reference) — the
+	// server accepts at most one.
+	cmd.MarkFlagsMutuallyExclusive("git-branch", "git-tag", "git-commit")
+
+	return func(cmd *cobra.Command, args []string) error {
+		refSet := cmd.Flags().Changed("git-branch") ||
+			cmd.Flags().Changed("git-tag") ||
+			cmd.Flags().Changed("git-commit")
+		pathSet := cmd.Flags().Changed("git-source-code-path")
+		if !refSet && !pathSet {
+			return nil
+		}
+		// deployment_source is a proto oneof: a deployment draws its code from
+		// either a workspace path (--source-code-path) or a Git source, never
+		// both. Reject the combination rather than shipping a request the server
+		// and bundle validation treat as invalid.
+		if cmd.Flags().Changed("source-code-path") {
+			return errors.New("--source-code-path (workspace source) cannot be combined with the --git-* flags; a deployment uses either a workspace path or a Git source")
+		}
+		// A source-code path without a reference has no repository to resolve
+		// against — the reference is what selects the code to deploy.
+		if pathSet && !refSet {
+			return errors.New("--git-source-code-path requires one of --git-branch, --git-tag, or --git-commit")
+		}
+		*target = &apps.GitSource{
+			Branch:         branch,
+			Tag:            tag,
+			Commit:         commit,
+			SourceCodePath: sourceCodePath,
+		}
+		return nil
+	}
+}
+
+// chainPreRunE runs fn after any PreRunE already set on the command, preserving
+// the generated cmd.PreRunE (e.g. root.MustWorkspaceClient) rather than
+// replacing it.
+func chainPreRunE(cmd *cobra.Command, fn func(*cobra.Command, []string) error) {
+	prev := cmd.PreRunE
+	cmd.PreRunE = func(cmd *cobra.Command, args []string) error {
+		if prev != nil {
+			if err := prev(cmd, args); err != nil {
+				return err
+			}
+		}
+		return fn(cmd, args)
+	}
+}
+
+// requireBranchForAutoDeploy enforces that enabling auto-deploy is paired with a
+// branch: auto-deploy redeploys on pushes to a branch, so a tag, a commit, or no
+// ref at all has nothing to watch. Turning auto-deploy off needs no branch. Both
+// create and update set the branch explicitly here rather than letting the
+// server fall back to the app's existing default_git_source. The check is a
+// no-op on any command without a --git-branch flag to satisfy it.
+func requireBranchForAutoDeploy(cmd *cobra.Command, args []string) error {
+	if !cmd.Flags().Changed("git-auto-deploy") || cmd.Flags().Lookup("git-branch") == nil {
+		return nil
+	}
+	on, err := cmd.Flags().GetBool("git-auto-deploy")
+	if err != nil {
+		return err
+	}
+	if on && !cmd.Flags().Changed("git-branch") {
+		return errors.New("--git-auto-deploy requires --git-branch: auto-deploy redeploys on pushes to a branch")
+	}
+	return nil
+}
+
+// requireRepoForGitSourceOnCreate enforces that a create-time git source is
+// paired with a repository: App.GitSource resolves its ref against
+// App.GitRepository, and on create there is no prior repository to fall back on
+// (unlike update/deploy, which reference the app's already-configured repo).
+// gitRepositoryFlags runs first and rejects url without provider, so checking
+// --git-url alone implies both are set.
+func requireRepoForGitSourceOnCreate(cmd *cobra.Command, args []string) error {
+	srcSet := cmd.Flags().Changed("git-branch") ||
+		cmd.Flags().Changed("git-tag") ||
+		cmd.Flags().Changed("git-commit") ||
+		cmd.Flags().Changed("git-source-code-path")
+	if srcSet && !cmd.Flags().Changed("git-url") {
+		return errors.New("--git-branch, --git-tag, --git-commit, and --git-source-code-path require --git-url and --git-provider on create: the git source resolves against the app's repository")
+	}
+	return nil
+}
+
+func gitCreateOverride(createCmd *cobra.Command, createReq *apps.CreateAppRequest) {
+	chainPreRunE(createCmd, gitRepositoryFlags(createCmd, &createReq.App.GitRepository, true))
+	// App.GitSource is the create-time deployment source (the default ref);
+	// the server persists it and reports it back as default_git_source.
+	chainPreRunE(createCmd, gitSourceFlags(createCmd, &createReq.App.GitSource))
+	chainPreRunE(createCmd, requireBranchForAutoDeploy)
+	chainPreRunE(createCmd, requireRepoForGitSourceOnCreate)
+}
+
+// applyPreservedAutoDeploy carries a currently-enabled auto_deploy forward onto
+// the update request's git_repository. auto_deploy=true survives the omitempty
+// tag, so no ForceSendFields entry is needed; a currently-disabled auto_deploy
+// stays omitted (the server keeps it off).
+func applyPreservedAutoDeploy(repo *apps.GitRepository, currentAutoDeploy bool) {
+	if repo == nil || !currentAutoDeploy {
+		return
+	}
+	repo.AutoDeploy = true
+}
+
+// preserveAutoDeployOnUpdate keeps auto-deploy from being silently torn down
+// when a flag-based update changes the repository without re-asserting it. It
+// runs only on the flag path (not --json, which owns the whole body), only when
+// a repository change is being sent, and only when the user did not pass
+// --git-auto-deploy themselves; in that case it reads the app's current
+// auto_deploy from GetApp and carries it forward.
+func preserveAutoDeployOnUpdate(req *apps.UpdateAppRequest) func(*cobra.Command, []string) error {
+	return func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") || cmd.Flags().Changed("git-auto-deploy") {
+			return nil
+		}
+		if req.App.GitRepository == nil || len(args) == 0 {
+			return nil
+		}
+		ctx := cmd.Context()
+		current, err := cmdctx.WorkspaceClient(ctx).Apps.GetByName(ctx, args[0])
+		if err != nil {
+			return fmt.Errorf("read current app to preserve auto-deploy: %w", err)
+		}
+		if current.GitRepository != nil {
+			applyPreservedAutoDeploy(req.App.GitRepository, current.GitRepository.AutoDeploy)
+		}
+		return nil
+	}
+}
+
+func gitUpdateOverride(updateCmd *cobra.Command, updateReq *apps.UpdateAppRequest) {
+	chainPreRunE(updateCmd, gitRepositoryFlags(updateCmd, &updateReq.App.GitRepository, false))
+	// App.GitSource lets update set the deployment source (e.g. the branch
+	// auto-deploy watches) explicitly instead of leaning on the app's existing
+	// default_git_source.
+	chainPreRunE(updateCmd, gitSourceFlags(updateCmd, &updateReq.App.GitSource))
+	chainPreRunE(updateCmd, requireBranchForAutoDeploy)
+	// Runs last: preserve auto-deploy across a repository change the user made
+	// without re-asserting --git-auto-deploy.
+	chainPreRunE(updateCmd, preserveAutoDeployOnUpdate(updateReq))
+}
+
+func gitDeployOverride(deployCmd *cobra.Command, deployReq *apps.CreateAppDeploymentRequest) {
+	chainPreRunE(deployCmd, gitSourceFlags(deployCmd, &deployReq.AppDeployment.GitSource))
+}
+
+func init() {
+	createOverrides = append(createOverrides, gitCreateOverride)
+	updateOverrides = append(updateOverrides, gitUpdateOverride)
+	deployOverrides = append(deployOverrides, gitDeployOverride)
+}
diff --git a/cmd/workspace/apps/git_flags_test.go b/cmd/workspace/apps/git_flags_test.go
new file mode 100644
index 00000000000..847afa99347
--- /dev/null
+++ b/cmd/workspace/apps/git_flags_test.go
@@ -0,0 +1,330 @@
+package apps
+
+import (
+	"testing"
+
+	"github.com/databricks/databricks-sdk-go/service/apps"
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// runGitRepositoryFlags wires gitRepositoryFlags (in create mode, so
+// --caller-git-credential-id is available) onto a fresh command, sets the given
+// flags, runs the PreRunE, and returns the resulting pointer + error.
+func runGitRepositoryFlags(t *testing.T, argv []string) (*apps.GitRepository, error) {
+	t.Helper()
+	cmd := &cobra.Command{}
+	var target *apps.GitRepository
+	pre := gitRepositoryFlags(cmd, &target, true)
+	require.NoError(t, cmd.ParseFlags(argv))
+	return target, pre(cmd, nil)
+}
+
+func runGitSourceFlags(t *testing.T, argv []string) (*apps.GitSource, error) {
+	t.Helper()
+	cmd := &cobra.Command{}
+	// The generated deploy command registers --source-code-path (the workspace
+	// source). Register it here too so the workspace-vs-Git mutual-exclusion
+	// guard can be exercised.
+	cmd.Flags().String("source-code-path", "", "")
+	var target *apps.GitSource
+	pre := gitSourceFlags(cmd, &target)
+	require.NoError(t, cmd.ParseFlags(argv))
+	return target, pre(cmd, nil)
+}
+
+func TestGitRepositoryFlags(t *testing.T) {
+	t.Run("no flags leaves target nil", func(t *testing.T) {
+		target, err := runGitRepositoryFlags(t, nil)
+		require.NoError(t, err)
+		assert.Nil(t, target)
+	})
+
+	t.Run("url and provider populate the struct", func(t *testing.T) {
+		target, err := runGitRepositoryFlags(t, []string{
+			"--git-url", "https://github.com/databricks/git_app_repo.git",
+			"--git-provider", "gitHub",
+		})
+		require.NoError(t, err)
+		require.NotNil(t, target)
+		assert.Equal(t, "https://github.com/databricks/git_app_repo.git", target.Url)
+		assert.Equal(t, "gitHub", target.Provider)
+	})
+
+	t.Run("url without provider errors", func(t *testing.T) {
+		_, err := runGitRepositoryFlags(t, []string{"--git-url", "https://github.com/x/y"})
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "must be set together")
+	})
+
+	t.Run("provider without url errors", func(t *testing.T) {
+		_, err := runGitRepositoryFlags(t, []string{"--git-provider", "gitHub"})
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "must be set together")
+	})
+
+	t.Run("auto-deploy and caller credential populate the struct", func(t *testing.T) {
+		target, err := runGitRepositoryFlags(t, []string{
+			"--git-url", "https://github.com/databricks/git_app_repo.git",
+			"--git-provider", "gitHub",
+			"--git-auto-deploy",
+			"--caller-git-credential-id", "93488329053511",
+		})
+		require.NoError(t, err)
+		require.NotNil(t, target)
+		assert.True(t, target.AutoDeploy)
+		assert.Equal(t, int64(93488329053511), target.CallerCredentialId)
+	})
+
+	t.Run("auto-deploy=false is force-sent", func(t *testing.T) {
+		target, err := runGitRepositoryFlags(t, []string{
+			"--git-url", "https://github.com/x/y",
+			"--git-provider", "gitHub",
+			"--git-auto-deploy=false",
+		})
+		require.NoError(t, err)
+		require.NotNil(t, target)
+		assert.False(t, target.AutoDeploy)
+		// Otherwise omitempty would drop the field and the server could not
+		// distinguish "disable auto-deploy" from "unset".
+		assert.Contains(t, target.ForceSendFields, "AutoDeploy")
+	})
+
+	t.Run("auto-deploy without url and provider errors", func(t *testing.T) {
+		_, err := runGitRepositoryFlags(t, []string{"--git-auto-deploy"})
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "require --git-url and --git-provider")
+	})
+
+	t.Run("caller credential without url and provider errors", func(t *testing.T) {
+		_, err := runGitRepositoryFlags(t, []string{"--caller-git-credential-id", "42"})
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "require --git-url and --git-provider")
+	})
+
+	t.Run("caller credential is create-only", func(t *testing.T) {
+		// The server rejects caller_credential_id on UpdateApp, so update mode
+		// (withCallerCredential=false) must not register the flag at all.
+		cmd := &cobra.Command{}
+		var target *apps.GitRepository
+		gitRepositoryFlags(cmd, &target, false)
+		assert.Nil(t, cmd.Flags().Lookup("caller-git-credential-id"))
+		// The auto-deploy modifier is still available on update.
+		assert.NotNil(t, cmd.Flags().Lookup("git-auto-deploy"))
+	})
+
+	t.Run("update mode reports only auto-deploy in the requires-repo error", func(t *testing.T) {
+		cmd := &cobra.Command{}
+		var target *apps.GitRepository
+		pre := gitRepositoryFlags(cmd, &target, false)
+		require.NoError(t, cmd.ParseFlags([]string{"--git-auto-deploy"}))
+		err := pre(cmd, nil)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "--git-auto-deploy require")
+		assert.NotContains(t, err.Error(), "caller-git-credential-id")
+	})
+}
+
+// runAutoDeployBranchRule mimics the create command: it registers both the git
+// repository and git source flags, parses argv, and runs requireBranchForAutoDeploy.
+func runAutoDeployBranchRule(t *testing.T, argv []string) error {
+	t.Helper()
+	cmd := &cobra.Command{}
+	var repo *apps.GitRepository
+	var src *apps.GitSource
+	gitRepositoryFlags(cmd, &repo, true)
+	gitSourceFlags(cmd, &src)
+	require.NoError(t, cmd.ParseFlags(argv))
+	return requireBranchForAutoDeploy(cmd, nil)
+}
+
+func TestRequireBranchForAutoDeploy(t *testing.T) {
+	repo := []string{"--git-url", "https://github.com/x/y", "--git-provider", "gitHub"}
+
+	t.Run("auto-deploy on with a branch is allowed", func(t *testing.T) {
+		err := runAutoDeployBranchRule(t, append(repo, "--git-auto-deploy", "--git-branch", "main"))
+		require.NoError(t, err)
+	})
+
+	t.Run("auto-deploy on without a branch errors", func(t *testing.T) {
+		err := runAutoDeployBranchRule(t, append(repo, "--git-auto-deploy"))
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "requires --git-branch")
+	})
+
+	t.Run("auto-deploy on with only a tag errors", func(t *testing.T) {
+		err := runAutoDeployBranchRule(t, append(repo, "--git-auto-deploy", "--git-tag", "v1.0.0"))
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "requires --git-branch")
+	})
+
+	t.Run("auto-deploy off does not require a branch", func(t *testing.T) {
+		err := runAutoDeployBranchRule(t, append(repo, "--git-auto-deploy=false"))
+		require.NoError(t, err)
+	})
+
+	t.Run("auto-deploy unset does not require a branch", func(t *testing.T) {
+		err := runAutoDeployBranchRule(t, repo)
+		require.NoError(t, err)
+	})
+
+	t.Run("no-op when the command has no git-branch flag", func(t *testing.T) {
+		// A command that wires only the repository flags has no branch to
+		// demand, so the rule must stay out of its way.
+		cmd := &cobra.Command{}
+		var target *apps.GitRepository
+		gitRepositoryFlags(cmd, &target, true)
+		require.NoError(t, cmd.ParseFlags([]string{"--git-url", "https://github.com/x/y", "--git-provider", "gitHub", "--git-auto-deploy"}))
+		require.NoError(t, requireBranchForAutoDeploy(cmd, nil))
+	})
+}
+
+// runRepoForGitSourceRule mimics the create command (both flag groups) and runs
+// requireRepoForGitSourceOnCreate.
+func runRepoForGitSourceRule(t *testing.T, argv []string) error {
+	t.Helper()
+	cmd := &cobra.Command{}
+	var repo *apps.GitRepository
+	var src *apps.GitSource
+	gitRepositoryFlags(cmd, &repo, true)
+	gitSourceFlags(cmd, &src)
+	require.NoError(t, cmd.ParseFlags(argv))
+	return requireRepoForGitSourceOnCreate(cmd, nil)
+}
+
+func TestRequireRepoForGitSourceOnCreate(t *testing.T) {
+	repo := []string{"--git-url", "https://github.com/x/y", "--git-provider", "gitHub"}
+
+	t.Run("git source with a repo is allowed", func(t *testing.T) {
+		require.NoError(t, runRepoForGitSourceRule(t, append(repo, "--git-branch", "main")))
+	})
+
+	t.Run("branch without a repo errors", func(t *testing.T) {
+		err := runRepoForGitSourceRule(t, []string{"--git-branch", "main"})
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "require --git-url and --git-provider on create")
+	})
+
+	t.Run("tag without a repo errors", func(t *testing.T) {
+		err := runRepoForGitSourceRule(t, []string{"--git-tag", "v1.0.0"})
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "require --git-url and --git-provider on create")
+	})
+
+	t.Run("source-code-path with a ref but no repo errors", func(t *testing.T) {
+		err := runRepoForGitSourceRule(t, []string{"--git-commit", "abc123", "--git-source-code-path", "my-app"})
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "require --git-url and --git-provider on create")
+	})
+
+	t.Run("no git source flags is a no-op", func(t *testing.T) {
+		require.NoError(t, runRepoForGitSourceRule(t, repo))
+	})
+}
+
+func TestApplyPreservedAutoDeploy(t *testing.T) {
+	t.Run("carries a currently-enabled auto_deploy forward", func(t *testing.T) {
+		repo := &apps.GitRepository{Url: "https://github.com/x/y", Provider: "gitHub"}
+		applyPreservedAutoDeploy(repo, true)
+		assert.True(t, repo.AutoDeploy)
+	})
+
+	t.Run("leaves a currently-disabled auto_deploy off", func(t *testing.T) {
+		repo := &apps.GitRepository{Url: "https://github.com/x/y", Provider: "gitHub"}
+		applyPreservedAutoDeploy(repo, false)
+		assert.False(t, repo.AutoDeploy)
+	})
+
+	t.Run("nil repo is a no-op", func(t *testing.T) {
+		assert.NotPanics(t, func() { applyPreservedAutoDeploy(nil, true) })
+	})
+}
+
+// newPreserveCmd builds an update-like command with the repo flags and a --json
+// flag so the preserve guards can be exercised without a workspace client.
+func newPreserveCmd(t *testing.T, req *apps.UpdateAppRequest, argv []string) *cobra.Command {
+	t.Helper()
+	cmd := &cobra.Command{}
+	cmd.Flags().String("json", "", "")
+	gitRepositoryFlags(cmd, &req.App.GitRepository, false)
+	require.NoError(t, cmd.ParseFlags(argv))
+	return cmd
+}
+
+func TestPreserveAutoDeployOnUpdate_Guards(t *testing.T) {
+	// Each guard returns before the GetApp call, so no client is needed. If a
+	// guard failed to short-circuit, WorkspaceClient(ctx) would panic here.
+	t.Run("skips when --json is set", func(t *testing.T) {
+		req := &apps.UpdateAppRequest{}
+		cmd := newPreserveCmd(t, req, []string{"--json", "{}", "--git-url", "https://github.com/x/y", "--git-provider", "gitHub"})
+		require.NoError(t, preserveAutoDeployOnUpdate(req)(cmd, []string{"my-app"}))
+	})
+
+	t.Run("skips when --git-auto-deploy was passed", func(t *testing.T) {
+		req := &apps.UpdateAppRequest{}
+		cmd := newPreserveCmd(t, req, []string{"--git-url", "https://github.com/x/y", "--git-provider", "gitHub", "--git-auto-deploy"})
+		require.NoError(t, preserveAutoDeployOnUpdate(req)(cmd, []string{"my-app"}))
+	})
+
+	t.Run("skips when no repository change is being sent", func(t *testing.T) {
+		req := &apps.UpdateAppRequest{}
+		cmd := newPreserveCmd(t, req, nil) // GitRepository stays nil
+		require.NoError(t, preserveAutoDeployOnUpdate(req)(cmd, []string{"my-app"}))
+	})
+
+	t.Run("skips when no app name is available", func(t *testing.T) {
+		req := &apps.UpdateAppRequest{}
+		cmd := newPreserveCmd(t, req, []string{"--git-url", "https://github.com/x/y", "--git-provider", "gitHub"})
+		require.NoError(t, preserveAutoDeployOnUpdate(req)(cmd, nil))
+	})
+}
+
+func TestGitSourceFlags(t *testing.T) {
+	t.Run("no flags leaves target nil", func(t *testing.T) {
+		target, err := runGitSourceFlags(t, nil)
+		require.NoError(t, err)
+		assert.Nil(t, target)
+	})
+
+	t.Run("branch populates the struct", func(t *testing.T) {
+		target, err := runGitSourceFlags(t, []string{"--git-branch", "main"})
+		require.NoError(t, err)
+		require.NotNil(t, target)
+		assert.Equal(t, "main", target.Branch)
+		assert.Empty(t, target.Tag)
+		assert.Empty(t, target.Commit)
+	})
+
+	t.Run("commit with source-code-path populates both", func(t *testing.T) {
+		target, err := runGitSourceFlags(t, []string{
+			"--git-commit", "abc123",
+			"--git-source-code-path", "my-app",
+		})
+		require.NoError(t, err)
+		require.NotNil(t, target)
+		assert.Equal(t, "abc123", target.Commit)
+		assert.Equal(t, "my-app", target.SourceCodePath)
+	})
+
+	t.Run("source-code-path without a ref errors", func(t *testing.T) {
+		_, err := runGitSourceFlags(t, []string{"--git-source-code-path", "my-app"})
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "requires one of")
+	})
+
+	t.Run("workspace source-code-path combined with a git ref errors", func(t *testing.T) {
+		_, err := runGitSourceFlags(t, []string{
+			"--git-branch", "main",
+			"--source-code-path", "/Workspace/Users/me/app",
+		})
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "cannot be combined")
+	})
+
+	t.Run("workspace source-code-path alone leaves git source nil", func(t *testing.T) {
+		target, err := runGitSourceFlags(t, []string{"--source-code-path", "/Workspace/Users/me/app"})
+		require.NoError(t, err)
+		assert.Nil(t, target)
+	})
+}
diff --git a/cmd/workspace/artifact-allowlists/artifact-allowlists.go b/cmd/workspace/artifact-allowlists/artifact-allowlists.go
old mode 100755
new mode 100644
index 540e754e996..d6fce44ebd1
--- a/cmd/workspace/artifact-allowlists/artifact-allowlists.go
+++ b/cmd/workspace/artifact-allowlists/artifact-allowlists.go
@@ -3,6 +3,7 @@
 package artifact_allowlists
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -20,14 +21,18 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "artifact-allowlists",
-		Short: `In Databricks Runtime 13.3 and above, you can add libraries and init scripts to the allowlist in UC so that users can leverage these artifacts on compute configured with shared access mode.`,
+		Short: `In Databricks Runtime 13.3 and above, you can add libraries and init scripts to the allowlist in UC so that users can use these artifacts on compute configured with shared access mode.`,
 		Long: `In Databricks Runtime 13.3 and above, you can add libraries and init scripts
-  to the allowlist in UC so that users can leverage these artifacts on compute
+  to the allowlist in UC so that users can use these artifacts on compute
   configured with shared access mode.`,
 		GroupID: "catalog",
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newGet())
 	cmd.AddCommand(newUpdate())
@@ -66,6 +71,8 @@ func newGet() *cobra.Command {
       Supported values: [INIT_SCRIPT, LIBRARY_JAR, LIBRARY_MAVEN]`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -132,6 +139,8 @@ func newUpdate() *cobra.Command {
       Supported values: [INIT_SCRIPT, LIBRARY_JAR, LIBRARY_MAVEN]`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -155,7 +164,7 @@ func newUpdate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 		_, err = fmt.Sscan(args[0], &updateReq.ArtifactType)
 		if err != nil {
diff --git a/cmd/workspace/automatic-cluster-update/automatic-cluster-update.go b/cmd/workspace/automatic-cluster-update/automatic-cluster-update.go
old mode 100755
new mode 100644
index e8978c755da..2ee11c74d41
--- a/cmd/workspace/automatic-cluster-update/automatic-cluster-update.go
+++ b/cmd/workspace/automatic-cluster-update/automatic-cluster-update.go
@@ -3,7 +3,7 @@
 package automatic_cluster_update
 
 import (
-	"fmt"
+	"errors"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
@@ -20,12 +20,18 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "automatic-cluster-update",
-		Short: `Controls whether automatic cluster update is enabled for the current workspace.`,
-		Long: `Controls whether automatic cluster update is enabled for the current
+		Short: `*Public Preview* Controls whether automatic cluster update is enabled for the current workspace.`,
+		Long: `This command is in Public Preview and may change without notice.
+
+Controls whether automatic cluster update is enabled for the current
   workspace. By default, it is turned off.`,
 		RunE: root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
 	// Add methods
 	cmd.AddCommand(newGet())
 	cmd.AddCommand(newUpdate())
@@ -55,12 +61,16 @@ func newGet() *cobra.Command {
 	cmd.Flags().StringVar(&getReq.Etag, "etag", getReq.Etag, `etag used for versioning.`)
 
 	cmd.Use = "get"
-	cmd.Short = `Get the automatic cluster update setting.`
-	cmd.Long = `Get the automatic cluster update setting.
+	cmd.Short = `*Public Preview* Get the automatic cluster update setting.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get the automatic cluster update setting.
 
   Gets the automatic cluster update setting.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -110,8 +120,10 @@ func newUpdate() *cobra.Command {
 	cmd.Flags().Var(&updateJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Use = "update"
-	cmd.Short = `Update the automatic cluster update setting.`
-	cmd.Long = `Update the automatic cluster update setting.
+	cmd.Short = `*Public Preview* Update the automatic cluster update setting.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Update the automatic cluster update setting.
 
   Updates the automatic cluster update setting for the workspace. A fresh etag
   needs to be provided in PATCH requests (as part of the setting field). The
@@ -120,6 +132,8 @@ func newUpdate() *cobra.Command {
   must be retried by using the fresh etag in the 409 response.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -138,7 +152,7 @@ func newUpdate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := w.Settings.AutomaticClusterUpdate().Update(ctx, updateReq)
diff --git a/cmd/workspace/bundle-deployments/bundle-deployments.go b/cmd/workspace/bundle-deployments/bundle-deployments.go
new file mode 100644
index 00000000000..ddf35aeaf97
--- /dev/null
+++ b/cmd/workspace/bundle-deployments/bundle-deployments.go
@@ -0,0 +1,1197 @@
+// Code generated from OpenAPI specs by Databricks SDK Generator. DO NOT EDIT.
+
+package bundle_deployments
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/databricks-sdk-go/service/bundledeployments"
+	"github.com/spf13/cobra"
+)
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var cmdOverrides []func(*cobra.Command)
+
+func New() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:     "bundle-deployments",
+		Short:   `Service for managing bundle deployment metadata.`,
+		Long:    `Service for managing bundle deployment metadata.`,
+		GroupID: "bundledeployments",
+
+		// This service is being previewed; hide from help output.
+		Hidden: true,
+		RunE:   root.ReportUnknownSubcommand,
+	}
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	// Add methods
+	cmd.AddCommand(newCompleteVersion())
+	cmd.AddCommand(newCreateDeployment())
+	cmd.AddCommand(newCreateVersion())
+	cmd.AddCommand(newDeleteDeployment())
+	cmd.AddCommand(newGetDeployment())
+	cmd.AddCommand(newGetOperation())
+	cmd.AddCommand(newGetResource())
+	cmd.AddCommand(newGetVersion())
+	cmd.AddCommand(newHeartbeat())
+	cmd.AddCommand(newListDeployments())
+	cmd.AddCommand(newListOperations())
+	cmd.AddCommand(newListResources())
+	cmd.AddCommand(newListVersions())
+	cmd.AddCommand(newUpdateDeployment())
+	cmd.AddCommand(newUpdateOperation())
+
+	// Apply optional overrides to this command.
+	for _, fn := range cmdOverrides {
+		fn(cmd)
+	}
+
+	return cmd
+}
+
+// start complete-version command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var completeVersionOverrides []func(
+	*cobra.Command,
+	*bundledeployments.CompleteVersionRequest,
+)
+
+func newCompleteVersion() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var completeVersionReq bundledeployments.CompleteVersionRequest
+	var completeVersionJson flags.JsonFlag
+
+	cmd.Flags().Var(&completeVersionJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().BoolVar(&completeVersionReq.Force, "force", completeVersionReq.Force, `If true, force-completes the version even if the caller is not the original creator.`)
+
+	cmd.Use = "complete-version NAME COMPLETION_REASON"
+	cmd.Short = `Complete a version.`
+	cmd.Long = `Complete a version.
+
+  Marks a version as complete and releases the deployment lock.
+
+  The server atomically: 1. Sets the version status to the provided terminal
+  status. 2. Sets complete_time to the current server timestamp. 3. Releases
+  the lock on the parent deployment. 4. Updates the parent deployment's status
+  and last_version_id.
+
+  Arguments:
+    NAME: The name of the version to complete. Format:
+      deployments/{deployment_id}/versions/{version_id}
+    COMPLETION_REASON: The reason for completing the version. Must be VERSION_COMPLETE_SUCCESS or
+      VERSION_COMPLETE_FAILURE.
+      Supported values: [VERSION_COMPLETE_FAILURE, VERSION_COMPLETE_FORCE_ABORT, VERSION_COMPLETE_LEASE_EXPIRED, VERSION_COMPLETE_SUCCESS]`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(1)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only NAME as positional arguments. Provide 'completion_reason' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := completeVersionJson.Unmarshal(&completeVersionReq)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		completeVersionReq.Name = args[0]
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[1], &completeVersionReq.CompletionReason)
+			if err != nil {
+				return fmt.Errorf("invalid COMPLETION_REASON: %s", args[1])
+			}
+
+		}
+
+		response, err := w.BundleDeployments.CompleteVersion(ctx, completeVersionReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range completeVersionOverrides {
+		fn(cmd, &completeVersionReq)
+	}
+
+	return cmd
+}
+
+// start create-deployment command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var createDeploymentOverrides []func(
+	*cobra.Command,
+	*bundledeployments.CreateDeploymentRequest,
+)
+
+func newCreateDeployment() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var createDeploymentReq bundledeployments.CreateDeploymentRequest
+	createDeploymentReq.Deployment = bundledeployments.Deployment{}
+	var createDeploymentJson flags.JsonFlag
+
+	cmd.Flags().Var(&createDeploymentJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().Var(&createDeploymentReq.Deployment.DeploymentMode, "deployment-mode", `Bundle target deployment mode (development or production). Supported values: [DEPLOYMENT_MODE_DEVELOPMENT, DEPLOYMENT_MODE_PRODUCTION]`)
+	cmd.Flags().StringVar(&createDeploymentReq.Deployment.DisplayName, "display-name", createDeploymentReq.Deployment.DisplayName, `Human-readable name for the deployment, up to 256 characters.`)
+	// TODO: complex arg: git_info
+	cmd.Flags().StringVar(&createDeploymentReq.Deployment.InitialParentPath, "initial-parent-path", createDeploymentReq.Deployment.InitialParentPath, `The workspace path of the existing folder where the deployment is initially created.`)
+	cmd.Flags().StringVar(&createDeploymentReq.Deployment.Name, "name", createDeploymentReq.Deployment.Name, `Resource name of the deployment.`)
+	cmd.Flags().StringVar(&createDeploymentReq.Deployment.TargetName, "target-name", createDeploymentReq.Deployment.TargetName, `The bundle target name associated with this deployment.`)
+	// TODO: complex arg: workspace_info
+
+	cmd.Use = "create-deployment"
+	cmd.Short = `Create a deployment.`
+	cmd.Long = `Create a deployment.
+
+  Creates a new deployment in the workspace.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(0)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := createDeploymentJson.Unmarshal(&createDeploymentReq.Deployment)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+
+		response, err := w.BundleDeployments.CreateDeployment(ctx, createDeploymentReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range createDeploymentOverrides {
+		fn(cmd, &createDeploymentReq)
+	}
+
+	return cmd
+}
+
+// start create-version command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var createVersionOverrides []func(
+	*cobra.Command,
+	*bundledeployments.CreateVersionRequest,
+)
+
+func newCreateVersion() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var createVersionReq bundledeployments.CreateVersionRequest
+	createVersionReq.Version = bundledeployments.Version{}
+	var createVersionJson flags.JsonFlag
+
+	cmd.Flags().Var(&createVersionJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().Var(&createVersionReq.Version.DeploymentMode, "deployment-mode", `Bundle target deployment mode (development or production), captured at the time of this version. Supported values: [DEPLOYMENT_MODE_DEVELOPMENT, DEPLOYMENT_MODE_PRODUCTION]`)
+	cmd.Flags().StringVar(&createVersionReq.Version.DisplayName, "display-name", createVersionReq.Version.DisplayName, `Display name for the deployment, captured at the time of this version.`)
+	// TODO: complex arg: git_info
+	cmd.Flags().StringVar(&createVersionReq.Version.Name, "name", createVersionReq.Version.Name, `Resource name of the version.`)
+	// TODO: array: operations
+	cmd.Flags().StringVar(&createVersionReq.Version.PreviousVersionId, "previous-version-id", createVersionReq.Version.PreviousVersionId, `The version_id this version was created on top of — the deployment's most recent version at creation time.`)
+	cmd.Flags().StringVar(&createVersionReq.Version.TargetName, "target-name", createVersionReq.Version.TargetName, `Target name of the deployment, captured at the time of this version.`)
+	// TODO: complex arg: workspace_info
+
+	cmd.Use = "create-version PARENT VERSION_ID CLI_VERSION VERSION_TYPE"
+	cmd.Short = `Create a version.`
+	cmd.Long = `Create a version.
+
+  Creates a new version under a deployment.
+
+  Creating a version acquires an exclusive lock on the deployment, preventing
+  concurrent deploys. The caller provides a version_id, a numeric string that
+  must be numerically greater than the deployment's most recent version, and
+  sets the version's previous_version_id to the deployment's most recent
+  version (leaving it unset for the first version), which the server validates
+  to detect concurrent deploys.
+
+  The caller also provides the full set of operations planned for this
+  version, each identified by a resource_key and an action_type. The server
+  records one operation per resource in OPERATION_STATUS_PENDING in the same
+  transaction as the version, so the plan is captured atomically. The outcome of
+  each operation is recorded later via UpdateOperation as the resource is
+  applied; the set of operations cannot be changed after the version is created.
+
+  Arguments:
+    PARENT: The parent deployment where this version will be created. Format:
+      deployments/{deployment_id}
+    VERSION_ID: The ID to use for the version, which becomes the final component of the
+      version's resource name. A numeric string (base-10, fits in a signed
+      64-bit integer) chosen by the caller; must be greater than or equal to 1.
+      Must be numerically greater than the deployment's most recent version (see
+      version.previous_version_id); it does not need to start at 1 or increase
+      by exactly 1. If the value is not numerically greater, the server returns
+      INVALID_PARAMETER_VALUE.
+    CLI_VERSION: CLI version used to initiate the version.
+    VERSION_TYPE: Type of version (deploy or destroy).
+      Supported values: [VERSION_TYPE_DEPLOY, VERSION_TYPE_DESTROY]`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(2)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only PARENT, VERSION_ID as positional arguments. Provide 'cli_version', 'version_type' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(4)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := createVersionJson.Unmarshal(&createVersionReq.Version)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		createVersionReq.Parent = args[0]
+		createVersionReq.VersionId = args[1]
+		if !cmd.Flags().Changed("json") {
+			createVersionReq.Version.CliVersion = args[2]
+		}
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[3], &createVersionReq.Version.VersionType)
+			if err != nil {
+				return fmt.Errorf("invalid VERSION_TYPE: %s", args[3])
+			}
+
+		}
+
+		response, err := w.BundleDeployments.CreateVersion(ctx, createVersionReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range createVersionOverrides {
+		fn(cmd, &createVersionReq)
+	}
+
+	return cmd
+}
+
+// start delete-deployment command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteDeploymentOverrides []func(
+	*cobra.Command,
+	*bundledeployments.DeleteDeploymentRequest,
+)
+
+func newDeleteDeployment() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteDeploymentReq bundledeployments.DeleteDeploymentRequest
+
+	cmd.Use = "delete-deployment NAME"
+	cmd.Short = `Delete a deployment.`
+	cmd.Long = `Delete a deployment.
+
+  Deletes a deployment.
+
+  Arguments:
+    NAME: Resource name of the deployment to delete. Format:
+      deployments/{deployment_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		deleteDeploymentReq.Name = args[0]
+
+		err = w.BundleDeployments.DeleteDeployment(ctx, deleteDeploymentReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteDeploymentOverrides {
+		fn(cmd, &deleteDeploymentReq)
+	}
+
+	return cmd
+}
+
+// start get-deployment command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getDeploymentOverrides []func(
+	*cobra.Command,
+	*bundledeployments.GetDeploymentRequest,
+)
+
+func newGetDeployment() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getDeploymentReq bundledeployments.GetDeploymentRequest
+
+	cmd.Use = "get-deployment NAME"
+	cmd.Short = `Get a deployment.`
+	cmd.Long = `Get a deployment.
+
+  Retrieves a deployment by its resource name.
+
+  Arguments:
+    NAME: Resource name of the deployment to retrieve. Format:
+      deployments/{deployment_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getDeploymentReq.Name = args[0]
+
+		response, err := w.BundleDeployments.GetDeployment(ctx, getDeploymentReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getDeploymentOverrides {
+		fn(cmd, &getDeploymentReq)
+	}
+
+	return cmd
+}
+
+// start get-operation command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getOperationOverrides []func(
+	*cobra.Command,
+	*bundledeployments.GetOperationRequest,
+)
+
+func newGetOperation() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getOperationReq bundledeployments.GetOperationRequest
+
+	cmd.Use = "get-operation NAME"
+	cmd.Short = `Get an operation.`
+	cmd.Long = `Get an operation.
+
+  Retrieves a resource operation by its resource name.
+
+  Arguments:
+    NAME: The name of the resource operation to retrieve. Format:
+      deployments/{deployment_id}/versions/{version_id}/operations/{resource_key}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getOperationReq.Name = args[0]
+
+		response, err := w.BundleDeployments.GetOperation(ctx, getOperationReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getOperationOverrides {
+		fn(cmd, &getOperationReq)
+	}
+
+	return cmd
+}
+
+// start get-resource command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getResourceOverrides []func(
+	*cobra.Command,
+	*bundledeployments.GetResourceRequest,
+)
+
+func newGetResource() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getResourceReq bundledeployments.GetResourceRequest
+
+	cmd.Use = "get-resource NAME"
+	cmd.Short = `Get a resource.`
+	cmd.Long = `Get a resource.
+
+  Retrieves a deployment resource by its resource name.
+
+  Arguments:
+    NAME: The name of the resource to retrieve. Format:
+      deployments/{deployment_id}/resources/{resource_key}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getResourceReq.Name = args[0]
+
+		response, err := w.BundleDeployments.GetResource(ctx, getResourceReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getResourceOverrides {
+		fn(cmd, &getResourceReq)
+	}
+
+	return cmd
+}
+
+// start get-version command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getVersionOverrides []func(
+	*cobra.Command,
+	*bundledeployments.GetVersionRequest,
+)
+
+func newGetVersion() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getVersionReq bundledeployments.GetVersionRequest
+
+	cmd.Use = "get-version NAME"
+	cmd.Short = `Get a version.`
+	cmd.Long = `Get a version.
+
+  Retrieves a version by its resource name.
+
+  Arguments:
+    NAME: The name of the version to retrieve. Format:
+      deployments/{deployment_id}/versions/{version_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getVersionReq.Name = args[0]
+
+		response, err := w.BundleDeployments.GetVersion(ctx, getVersionReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getVersionOverrides {
+		fn(cmd, &getVersionReq)
+	}
+
+	return cmd
+}
+
+// start heartbeat command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var heartbeatOverrides []func(
+	*cobra.Command,
+	*bundledeployments.HeartbeatRequest,
+)
+
+func newHeartbeat() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var heartbeatReq bundledeployments.HeartbeatRequest
+
+	cmd.Use = "heartbeat NAME"
+	cmd.Short = `Send a version heartbeat.`
+	cmd.Long = `Send a version heartbeat.
+
+  Sends a heartbeat to renew the lock held by a version.
+
+  The server validates that the version is the active (non-terminal) version on
+  the parent deployment and resets the lock expiry. If the lock has already
+  expired or the version is no longer active, the server returns ABORTED.
+
+  Arguments:
+    NAME: The version whose lock to renew. Format:
+      deployments/{deployment_id}/versions/{version_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		heartbeatReq.Name = args[0]
+
+		response, err := w.BundleDeployments.Heartbeat(ctx, heartbeatReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range heartbeatOverrides {
+		fn(cmd, &heartbeatReq)
+	}
+
+	return cmd
+}
+
+// start list-deployments command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listDeploymentsOverrides []func(
+	*cobra.Command,
+	*bundledeployments.ListDeploymentsRequest,
+)
+
+func newListDeployments() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listDeploymentsReq bundledeployments.ListDeploymentsRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listDeploymentsLimit int
+
+	cmd.Flags().IntVar(&listDeploymentsReq.PageSize, "page-size", listDeploymentsReq.PageSize, `The maximum number of deployments to return.`)
+	cmd.Flags().BoolVar(&listDeploymentsReq.ShowDeleted, "show-deleted", listDeploymentsReq.ShowDeleted, `Whether to include soft-deleted deployments in the response.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listDeploymentsLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listDeploymentsReq.PageToken, "page-token", listDeploymentsReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-deployments"
+	cmd.Short = `List deployments.`
+	cmd.Long = `List deployments.
+
+  Lists deployments in the workspace.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(0)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		response := w.BundleDeployments.ListDeployments(ctx, listDeploymentsReq)
+		if listDeploymentsLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listDeploymentsLimit)
+		}
+		if listDeploymentsLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listDeploymentsLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listDeploymentsOverrides {
+		fn(cmd, &listDeploymentsReq)
+	}
+
+	return cmd
+}
+
+// start list-operations command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listOperationsOverrides []func(
+	*cobra.Command,
+	*bundledeployments.ListOperationsRequest,
+)
+
+func newListOperations() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listOperationsReq bundledeployments.ListOperationsRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listOperationsLimit int
+
+	cmd.Flags().IntVar(&listOperationsReq.PageSize, "page-size", listOperationsReq.PageSize, `The maximum number of operations to return.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listOperationsLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listOperationsReq.PageToken, "page-token", listOperationsReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-operations PARENT"
+	cmd.Short = `List operations.`
+	cmd.Long = `List operations.
+
+  Lists resource operations under a version.
+
+  Arguments:
+    PARENT: The parent version. Format:
+      deployments/{deployment_id}/versions/{version_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		listOperationsReq.Parent = args[0]
+
+		response := w.BundleDeployments.ListOperations(ctx, listOperationsReq)
+		if listOperationsLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listOperationsLimit)
+		}
+		if listOperationsLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listOperationsLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listOperationsOverrides {
+		fn(cmd, &listOperationsReq)
+	}
+
+	return cmd
+}
+
+// start list-resources command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listResourcesOverrides []func(
+	*cobra.Command,
+	*bundledeployments.ListResourcesRequest,
+)
+
+func newListResources() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listResourcesReq bundledeployments.ListResourcesRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listResourcesLimit int
+
+	cmd.Flags().IntVar(&listResourcesReq.PageSize, "page-size", listResourcesReq.PageSize, `The maximum number of resources to return.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listResourcesLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listResourcesReq.PageToken, "page-token", listResourcesReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-resources PARENT"
+	cmd.Short = `List resources.`
+	cmd.Long = `List resources.
+
+  Lists resources under a deployment.
+
+  Arguments:
+    PARENT: The parent deployment. Format: deployments/{deployment_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		listResourcesReq.Parent = args[0]
+
+		response := w.BundleDeployments.ListResources(ctx, listResourcesReq)
+		if listResourcesLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listResourcesLimit)
+		}
+		if listResourcesLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listResourcesLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listResourcesOverrides {
+		fn(cmd, &listResourcesReq)
+	}
+
+	return cmd
+}
+
+// start list-versions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listVersionsOverrides []func(
+	*cobra.Command,
+	*bundledeployments.ListVersionsRequest,
+)
+
+func newListVersions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listVersionsReq bundledeployments.ListVersionsRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listVersionsLimit int
+
+	cmd.Flags().IntVar(&listVersionsReq.PageSize, "page-size", listVersionsReq.PageSize, `The maximum number of versions to return.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listVersionsLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listVersionsReq.PageToken, "page-token", listVersionsReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-versions PARENT"
+	cmd.Short = `List versions.`
+	cmd.Long = `List versions.
+
+  Lists versions under a deployment, ordered numerically by version_id
+  descending (most recent first).
+
+  Arguments:
+    PARENT: The parent deployment. Format: deployments/{deployment_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		listVersionsReq.Parent = args[0]
+
+		response := w.BundleDeployments.ListVersions(ctx, listVersionsReq)
+		if listVersionsLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listVersionsLimit)
+		}
+		if listVersionsLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listVersionsLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listVersionsOverrides {
+		fn(cmd, &listVersionsReq)
+	}
+
+	return cmd
+}
+
+// start update-deployment command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateDeploymentOverrides []func(
+	*cobra.Command,
+	*bundledeployments.UpdateDeploymentRequest,
+)
+
+func newUpdateDeployment() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateDeploymentReq bundledeployments.UpdateDeploymentRequest
+	updateDeploymentReq.Deployment = bundledeployments.Deployment{}
+	var updateDeploymentJson flags.JsonFlag
+
+	cmd.Flags().Var(&updateDeploymentJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Use = "update-deployment NAME"
+	cmd.Short = `Update a deployment.`
+	cmd.Long = `Update a deployment.
+
+  Updates a deployment.
+
+  Arguments:
+    NAME: Resource name of the deployment. Format: deployments/{deployment_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updateDeploymentJson.Unmarshal(&updateDeploymentReq.Deployment)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		} else {
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
+		}
+		updateDeploymentReq.Name = args[0]
+
+		response, err := w.BundleDeployments.UpdateDeployment(ctx, updateDeploymentReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateDeploymentOverrides {
+		fn(cmd, &updateDeploymentReq)
+	}
+
+	return cmd
+}
+
+// start update-operation command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateOperationOverrides []func(
+	*cobra.Command,
+	*bundledeployments.UpdateOperationRequest,
+)
+
+func newUpdateOperation() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateOperationReq bundledeployments.UpdateOperationRequest
+	updateOperationReq.Operation = bundledeployments.Operation{}
+	var updateOperationJson flags.JsonFlag
+
+	cmd.Flags().Var(&updateOperationJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Use = "update-operation NAME"
+	cmd.Short = `Update an operation.`
+	cmd.Long = `Update an operation.
+
+  Updates a resource operation's mutable fields.
+
+  state, error_message, resource_id, status, and dashboard_metadata
+  may be updated, independently; update_mask must contain only those paths.
+  All other fields are immutable. The update is guarded by an
+  optimistic-concurrency check: the caller sets operation.sequence_id to the
+  value it last observed, and the server rejects the update with ABORTED if
+  the operation has been modified since. On success the server increments
+  sequence_id; updates to state, resource_id, and dashboard_metadata are
+  mirrored onto the corresponding deployment-level resource. Listing state in
+  update_mask with no value clears it, which removes the resource, so a delete
+  that is retried until it succeeds must clear state. The parent version must
+  be in progress, and after the update is applied a succeeded operation cannot
+  carry an error_message. See the state and resource_id fields for the
+  rest.
+
+  Arguments:
+    NAME: Resource name of the operation. Format:
+      deployments/{deployment_id}/versions/{version_id}/operations/{resource_key}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updateOperationJson.Unmarshal(&updateOperationReq.Operation)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		} else {
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
+		}
+		updateOperationReq.Name = args[0]
+
+		response, err := w.BundleDeployments.UpdateOperation(ctx, updateOperationReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateOperationOverrides {
+		fn(cmd, &updateOperationReq)
+	}
+
+	return cmd
+}
+
+// end service BundleDeployments
diff --git a/cmd/workspace/catalogs/catalogs.go b/cmd/workspace/catalogs/catalogs.go
old mode 100755
new mode 100644
index f8eccfa6114..0bc03d53555
--- a/cmd/workspace/catalogs/catalogs.go
+++ b/cmd/workspace/catalogs/catalogs.go
@@ -3,6 +3,7 @@
 package catalogs
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -33,6 +34,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -67,6 +72,7 @@ func newCreate() *cobra.Command {
 
 	cmd.Flags().StringVar(&createReq.Comment, "comment", createReq.Comment, `User-provided free-form text description.`)
 	cmd.Flags().StringVar(&createReq.ConnectionName, "connection-name", createReq.ConnectionName, `The name of the connection to an external data source.`)
+	cmd.Flags().Int64Var(&createReq.CustomMaxRetentionHours, "custom-max-retention-hours", createReq.CustomMaxRetentionHours, `Custom maximum retention period in hours for the catalog.`)
 	// TODO: complex arg: managed_encryption_settings
 	// TODO: map via StringToStringVar: options
 	// TODO: map via StringToStringVar: properties
@@ -85,12 +91,14 @@ func newCreate() *cobra.Command {
     NAME: Name of catalog.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name' in your JSON input")
 			}
 			return nil
 		}
@@ -166,6 +174,8 @@ func newDelete() *cobra.Command {
     NAME: The name of the catalog.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -226,6 +236,8 @@ func newGet() *cobra.Command {
     NAME: The name of the catalog.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -308,6 +320,8 @@ func newList() *cobra.Command {
   indication that the end of results has been reached.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -360,6 +374,7 @@ func newUpdate() *cobra.Command {
 	cmd.Flags().Var(&updateJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Flags().StringVar(&updateReq.Comment, "comment", updateReq.Comment, `User-provided free-form text description.`)
+	cmd.Flags().Int64Var(&updateReq.CustomMaxRetentionHours, "custom-max-retention-hours", updateReq.CustomMaxRetentionHours, `Custom maximum retention period in hours for the catalog.`)
 	cmd.Flags().Var(&updateReq.EnablePredictiveOptimization, "enable-predictive-optimization", `Whether predictive optimization should be enabled for this object and objects under it. Supported values: [DISABLE, ENABLE, INHERIT]`)
 	cmd.Flags().Var(&updateReq.IsolationMode, "isolation-mode", `Whether the current securable is accessible from all workspaces or a specific set of workspaces. Supported values: [ISOLATED, OPEN]`)
 	// TODO: complex arg: managed_encryption_settings
@@ -380,6 +395,8 @@ func newUpdate() *cobra.Command {
     NAME: The name of the catalog.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/workspace/clean-room-asset-revisions/clean-room-asset-revisions.go b/cmd/workspace/clean-room-asset-revisions/clean-room-asset-revisions.go
old mode 100755
new mode 100644
index 9e773e0617e..8379f87849f
--- a/cmd/workspace/clean-room-asset-revisions/clean-room-asset-revisions.go
+++ b/cmd/workspace/clean-room-asset-revisions/clean-room-asset-revisions.go
@@ -19,13 +19,19 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "clean-room-asset-revisions",
-		Short: `Clean Room Asset Revisions denote new versions of uploaded assets (e.g.`,
-		Long: `Clean Room Asset Revisions denote new versions of uploaded assets (e.g.
+		Short: `*Beta* Clean Room Asset Revisions denote new versions of uploaded assets (e.g.`,
+		Long: `This command is in Beta and may change without notice.
+
+Clean Room Asset Revisions denote new versions of uploaded assets (e.g.
   notebooks) in the clean room.`,
 		GroupID: "cleanrooms",
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
 	// Add methods
 	cmd.AddCommand(newGet())
 	cmd.AddCommand(newList())
@@ -53,20 +59,31 @@ func newGet() *cobra.Command {
 	var getReq cleanrooms.GetCleanRoomAssetRevisionRequest
 
 	cmd.Use = "get CLEAN_ROOM_NAME ASSET_TYPE NAME ETAG"
-	cmd.Short = `Get an asset revision.`
-	cmd.Long = `Get an asset revision.
+	cmd.Short = `*Beta* Get an asset revision.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get an asset revision.
 
   Get a specific revision of an asset
 
   Arguments:
     CLEAN_ROOM_NAME: Name of the clean room.
     ASSET_TYPE: Asset type. Only NOTEBOOK_FILE is supported.
-      Supported values: [FOREIGN_TABLE, NOTEBOOK_FILE, TABLE, VIEW, VOLUME]
+      Supported values: [
+        FOREIGN_TABLE,
+        JAR_ANALYSIS,
+        NOTEBOOK_FILE,
+        TABLE,
+        VIEW,
+        VOLUME,
+      ]
     NAME: Name of the asset.
     ETAG: Revision etag to fetch. If not provided, the latest revision will be
       returned.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(4)
@@ -135,18 +152,29 @@ func newList() *cobra.Command {
 	cmd.Flags().Lookup("page-token").Hidden = true
 
 	cmd.Use = "list CLEAN_ROOM_NAME ASSET_TYPE NAME"
-	cmd.Short = `List asset revisions.`
-	cmd.Long = `List asset revisions.
+	cmd.Short = `*Beta* List asset revisions.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+List asset revisions.
 
   List revisions for an asset
 
   Arguments:
     CLEAN_ROOM_NAME: Name of the clean room.
     ASSET_TYPE: Asset type. Only NOTEBOOK_FILE is supported.
-      Supported values: [FOREIGN_TABLE, NOTEBOOK_FILE, TABLE, VIEW, VOLUME]
+      Supported values: [
+        FOREIGN_TABLE,
+        JAR_ANALYSIS,
+        NOTEBOOK_FILE,
+        TABLE,
+        VIEW,
+        VOLUME,
+      ]
     NAME: Name of the asset.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(3)
diff --git a/cmd/workspace/clean-room-assets/clean-room-assets.go b/cmd/workspace/clean-room-assets/clean-room-assets.go
old mode 100755
new mode 100644
index 4b371d1d22f..cc8c6f7f334
--- a/cmd/workspace/clean-room-assets/clean-room-assets.go
+++ b/cmd/workspace/clean-room-assets/clean-room-assets.go
@@ -3,6 +3,7 @@
 package clean_room_assets
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -27,6 +28,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newCreateCleanRoomAssetReview())
@@ -64,6 +69,7 @@ func newCreate() *cobra.Command {
 	cmd.Flags().StringVar(&createReq.Asset.CleanRoomName, "clean-room-name", createReq.Asset.CleanRoomName, `The name of the clean room this asset belongs to.`)
 	// TODO: complex arg: foreign_table
 	// TODO: complex arg: foreign_table_local_details
+	// TODO: complex arg: jar_analysis
 	// TODO: complex arg: notebook
 	// TODO: complex arg: table
 	// TODO: complex arg: table_local_details
@@ -91,17 +97,27 @@ func newCreate() *cobra.Command {
       *shared_catalog*.*shared_schema*.*asset_name*
 
       For notebooks, the name is the notebook file name. For jar analyses, the
-      name is the jar analysis name.
+      name is the jar analysis name. For Genie spaces, the name is derived from
+      the clean room; the caller does not choose it.
     ASSET_TYPE: The type of the asset.
-      Supported values: [FOREIGN_TABLE, NOTEBOOK_FILE, TABLE, VIEW, VOLUME]`
+      Supported values: [
+        FOREIGN_TABLE,
+        JAR_ANALYSIS,
+        NOTEBOOK_FILE,
+        TABLE,
+        VIEW,
+        VOLUME,
+      ]`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(1)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only CLEAN_ROOM_NAME as positional arguments. Provide 'name', 'asset_type' in your JSON input")
+				return errors.New("when --json flag is specified, provide only CLEAN_ROOM_NAME as positional arguments. Provide 'name', 'asset_type' in your JSON input")
 			}
 			return nil
 		}
@@ -175,21 +191,33 @@ func newCreateCleanRoomAssetReview() *cobra.Command {
 
 	cmd.Flags().Var(&createCleanRoomAssetReviewJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
+	// TODO: complex arg: jar_analysis_review
 	// TODO: complex arg: notebook_review
 
 	cmd.Use = "create-clean-room-asset-review CLEAN_ROOM_NAME ASSET_TYPE NAME"
-	cmd.Short = `Create a review (e.g. approval) for an asset.`
-	cmd.Long = `Create a review (e.g. approval) for an asset.
+	cmd.Short = `*Beta* Create a review (e.g. approval) for an asset.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Create a review (e.g. approval) for an asset.
 
   Submit an asset review
 
   Arguments:
     CLEAN_ROOM_NAME: Name of the clean room
     ASSET_TYPE: Asset type. Can either be NOTEBOOK_FILE or JAR_ANALYSIS.
-      Supported values: [FOREIGN_TABLE, NOTEBOOK_FILE, TABLE, VIEW, VOLUME]
+      Supported values: [
+        FOREIGN_TABLE,
+        JAR_ANALYSIS,
+        NOTEBOOK_FILE,
+        TABLE,
+        VIEW,
+        VOLUME,
+      ]
     NAME: Name of the asset`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(3)
@@ -264,11 +292,20 @@ func newDelete() *cobra.Command {
   Arguments:
     CLEAN_ROOM_NAME: Name of the clean room.
     ASSET_TYPE: The type of the asset.
-      Supported values: [FOREIGN_TABLE, NOTEBOOK_FILE, TABLE, VIEW, VOLUME]
+      Supported values: [
+        FOREIGN_TABLE,
+        JAR_ANALYSIS,
+        NOTEBOOK_FILE,
+        TABLE,
+        VIEW,
+        VOLUME,
+      ]
     NAME: The fully qualified name of the asset, it is same as the name field in
       CleanRoomAsset.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(3)
@@ -330,11 +367,20 @@ func newGet() *cobra.Command {
   Arguments:
     CLEAN_ROOM_NAME: Name of the clean room.
     ASSET_TYPE: The type of the asset.
-      Supported values: [FOREIGN_TABLE, NOTEBOOK_FILE, TABLE, VIEW, VOLUME]
+      Supported values: [
+        FOREIGN_TABLE,
+        JAR_ANALYSIS,
+        NOTEBOOK_FILE,
+        TABLE,
+        VIEW,
+        VOLUME,
+      ]
     NAME: The fully qualified name of the asset, it is same as the name field in
       CleanRoomAsset.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(3)
@@ -407,6 +453,8 @@ func newList() *cobra.Command {
     CLEAN_ROOM_NAME: Name of the clean room.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -464,6 +512,7 @@ func newUpdate() *cobra.Command {
 	cmd.Flags().StringVar(&updateReq.Asset.CleanRoomName, "clean-room-name", updateReq.Asset.CleanRoomName, `The name of the clean room this asset belongs to.`)
 	// TODO: complex arg: foreign_table
 	// TODO: complex arg: foreign_table_local_details
+	// TODO: complex arg: jar_analysis
 	// TODO: complex arg: notebook
 	// TODO: complex arg: table
 	// TODO: complex arg: table_local_details
@@ -481,7 +530,14 @@ func newUpdate() *cobra.Command {
   Arguments:
     CLEAN_ROOM_NAME: Name of the clean room.
     ASSET_TYPE: The type of the asset.
-      Supported values: [FOREIGN_TABLE, NOTEBOOK_FILE, TABLE, VIEW, VOLUME]
+      Supported values: [
+        FOREIGN_TABLE,
+        JAR_ANALYSIS,
+        NOTEBOOK_FILE,
+        TABLE,
+        VIEW,
+        VOLUME,
+      ]
     NAME: A fully qualified name that uniquely identifies the asset within the clean
       room. This is also the name displayed in the clean room UI.
 
@@ -489,9 +545,12 @@ func newUpdate() *cobra.Command {
       *shared_catalog*.*shared_schema*.*asset_name*
 
       For notebooks, the name is the notebook file name. For jar analyses, the
-      name is the jar analysis name.`
+      name is the jar analysis name. For Genie spaces, the name is derived from
+      the clean room; the caller does not choose it.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(3)
diff --git a/cmd/workspace/clean-room-auto-approval-rules/clean-room-auto-approval-rules.go b/cmd/workspace/clean-room-auto-approval-rules/clean-room-auto-approval-rules.go
old mode 100755
new mode 100644
index 7cefc4a57e8..6ffea68d40d
--- a/cmd/workspace/clean-room-auto-approval-rules/clean-room-auto-approval-rules.go
+++ b/cmd/workspace/clean-room-auto-approval-rules/clean-room-auto-approval-rules.go
@@ -3,6 +3,7 @@
 package clean_room_auto_approval_rules
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -20,14 +21,20 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "clean-room-auto-approval-rules",
-		Short: `Clean room auto-approval rules automatically create an approval on your behalf when an asset (e.g.`,
-		Long: `Clean room auto-approval rules automatically create an approval on your behalf
+		Short: `*Beta* Clean room auto-approval rules automatically create an approval on your behalf when an asset (e.g.`,
+		Long: `This command is in Beta and may change without notice.
+
+Clean room auto-approval rules automatically create an approval on your behalf
   when an asset (e.g. notebook) meeting specific criteria is shared in a clean
   room.`,
 		GroupID: "cleanrooms",
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -61,8 +68,10 @@ func newCreate() *cobra.Command {
 	cmd.Flags().Var(&createJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Use = "create CLEAN_ROOM_NAME"
-	cmd.Short = `Create an auto-approval rule.`
-	cmd.Long = `Create an auto-approval rule.
+	cmd.Short = `*Beta* Create an auto-approval rule.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Create an auto-approval rule.
 
   Create an auto-approval rule
 
@@ -70,6 +79,8 @@ func newCreate() *cobra.Command {
     CLEAN_ROOM_NAME: The name of the clean room this auto-approval rule belongs to.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -93,7 +104,7 @@ func newCreate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 		createReq.CleanRoomName = args[0]
 
@@ -132,12 +143,16 @@ func newDelete() *cobra.Command {
 	var deleteReq cleanrooms.DeleteCleanRoomAutoApprovalRuleRequest
 
 	cmd.Use = "delete CLEAN_ROOM_NAME RULE_ID"
-	cmd.Short = `Delete an auto-approval rule.`
-	cmd.Long = `Delete an auto-approval rule.
+	cmd.Short = `*Beta* Delete an auto-approval rule.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Delete an auto-approval rule.
 
   Delete a auto-approval rule by rule ID`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -186,12 +201,16 @@ func newGet() *cobra.Command {
 	var getReq cleanrooms.GetCleanRoomAutoApprovalRuleRequest
 
 	cmd.Use = "get CLEAN_ROOM_NAME RULE_ID"
-	cmd.Short = `Get an auto-approval rule.`
-	cmd.Long = `Get an auto-approval rule.
+	cmd.Short = `*Beta* Get an auto-approval rule.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get an auto-approval rule.
 
   Get a auto-approval rule by rule ID`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -254,12 +273,16 @@ func newList() *cobra.Command {
 	cmd.Flags().Lookup("page-token").Hidden = true
 
 	cmd.Use = "list CLEAN_ROOM_NAME"
-	cmd.Short = `List auto-approval rules.`
-	cmd.Long = `List auto-approval rules.
+	cmd.Short = `*Beta* List auto-approval rules.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+List auto-approval rules.
 
   List all auto-approval rules for the caller`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -320,8 +343,10 @@ func newUpdate() *cobra.Command {
 	cmd.Flags().StringVar(&updateReq.AutoApprovalRule.RunnerCollaboratorAlias, "runner-collaborator-alias", updateReq.AutoApprovalRule.RunnerCollaboratorAlias, `Collaborator alias of the runner covered by the rule.`)
 
 	cmd.Use = "update CLEAN_ROOM_NAME RULE_ID"
-	cmd.Short = `Update an auto-approval rule.`
-	cmd.Long = `Update an auto-approval rule.
+	cmd.Short = `*Beta* Update an auto-approval rule.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Update an auto-approval rule.
 
   Update a auto-approval rule by rule ID
 
@@ -330,6 +355,8 @@ func newUpdate() *cobra.Command {
     RULE_ID: A generated UUID identifying the rule.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
diff --git a/cmd/workspace/clean-room-task-runs/clean-room-task-runs.go b/cmd/workspace/clean-room-task-runs/clean-room-task-runs.go
old mode 100755
new mode 100644
index 6469e9bc882..1ab6b639bc6
--- a/cmd/workspace/clean-room-task-runs/clean-room-task-runs.go
+++ b/cmd/workspace/clean-room-task-runs/clean-room-task-runs.go
@@ -18,15 +18,21 @@ var cmdOverrides []func(*cobra.Command)
 
 func New() *cobra.Command {
 	cmd := &cobra.Command{
-		Use:     "clean-room-task-runs",
-		Short:   `Clean room task runs are the executions of notebooks in a clean room.`,
-		Long:    `Clean room task runs are the executions of notebooks in a clean room.`,
+		Use:   "clean-room-task-runs",
+		Short: `Clean room task runs are the executions of notebooks and JAR analyses in a clean room.`,
+		Long: `Clean room task runs are the executions of notebooks and JAR analyses in a
+  clean room.`,
 		GroupID: "cleanrooms",
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newList())
+	cmd.AddCommand(newListCleanRoomTaskRunsHandler())
 
 	// Apply optional overrides to this command.
 	for _, fn := range cmdOverrides {
@@ -74,6 +80,8 @@ func newList() *cobra.Command {
     CLEAN_ROOM_NAME: Name of the clean room.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -110,4 +118,81 @@ func newList() *cobra.Command {
 	return cmd
 }
 
+// start list-clean-room-task-runs-handler command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listCleanRoomTaskRunsHandlerOverrides []func(
+	*cobra.Command,
+	*cleanrooms.ListCleanRoomTaskRunsRequest,
+)
+
+func newListCleanRoomTaskRunsHandler() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listCleanRoomTaskRunsHandlerReq cleanrooms.ListCleanRoomTaskRunsRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listCleanRoomTaskRunsHandlerLimit int
+
+	cmd.Flags().StringVar(&listCleanRoomTaskRunsHandlerReq.Name, "name", listCleanRoomTaskRunsHandlerReq.Name, `Executable name.`)
+	cmd.Flags().IntVar(&listCleanRoomTaskRunsHandlerReq.PageSize, "page-size", listCleanRoomTaskRunsHandlerReq.PageSize, `The maximum number of task runs to return.`)
+	cmd.Flags().Var(&listCleanRoomTaskRunsHandlerReq.TaskType, "task-type", `Filter by the type of Clean Room task. Supported values: [JAR, NOTEBOOK]`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listCleanRoomTaskRunsHandlerLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listCleanRoomTaskRunsHandlerReq.PageToken, "page-token", listCleanRoomTaskRunsHandlerReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-clean-room-task-runs-handler CLEAN_ROOM_NAME"
+	cmd.Short = `List task runs.`
+	cmd.Long = `List task runs.
+
+  List all the historical task runs in a clean room.
+
+  Arguments:
+    CLEAN_ROOM_NAME: Name of the clean room.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		listCleanRoomTaskRunsHandlerReq.CleanRoomName = args[0]
+
+		response := w.CleanRoomTaskRuns.ListCleanRoomTaskRunsHandler(ctx, listCleanRoomTaskRunsHandlerReq)
+		if listCleanRoomTaskRunsHandlerLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listCleanRoomTaskRunsHandlerLimit)
+		}
+		if listCleanRoomTaskRunsHandlerLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listCleanRoomTaskRunsHandlerLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listCleanRoomTaskRunsHandlerOverrides {
+		fn(cmd, &listCleanRoomTaskRunsHandlerReq)
+	}
+
+	return cmd
+}
+
 // end service CleanRoomTaskRuns
diff --git a/cmd/workspace/clean-rooms/clean-rooms.go b/cmd/workspace/clean-rooms/clean-rooms.go
old mode 100755
new mode 100644
index 2a323554425..aa904968b58
--- a/cmd/workspace/clean-rooms/clean-rooms.go
+++ b/cmd/workspace/clean-rooms/clean-rooms.go
@@ -29,6 +29,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newCreateOutputCatalog())
@@ -70,6 +74,7 @@ func newCreate() *cobra.Command {
 	cmd.Flags().Var(&createJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Flags().StringVar(&createReq.CleanRoom.Comment, "comment", createReq.CleanRoom.Comment, ``)
+	cmd.Flags().BoolVar(&createReq.CleanRoom.EnableSharedOutput, "enable-shared-output", createReq.CleanRoom.EnableSharedOutput, `Whether allow task to write to shared output schema.`)
 	cmd.Flags().StringVar(&createReq.CleanRoom.Name, "name", createReq.CleanRoom.Name, `The name of the clean room.`)
 	// TODO: complex arg: output_catalog
 	cmd.Flags().StringVar(&createReq.CleanRoom.Owner, "owner", createReq.CleanRoom.Owner, `This is the Databricks username of the owner of the local clean room securable for permission management.`)
@@ -81,15 +86,19 @@ func newCreate() *cobra.Command {
 
   Create a new clean room with the specified collaborators. This method is
   asynchronous; the returned name field inside the clean_room field can be used
-  to poll the clean room status, using the :method:cleanrooms/get method. When
-  this method returns, the clean room will be in a PROVISIONING state, with only
+  to poll the clean room status, using the [cleanrooms/get] method. When this
+  method returns, the clean room will be in a PROVISIONING state, with only
   name, owner, comment, created_at and status populated. The clean room will be
   usable once it enters an ACTIVE state.
 
   The caller must be a metastore admin or have the **CREATE_CLEAN_ROOM**
-  privilege on the metastore.`
+  privilege on the metastore.
+
+  [cleanrooms/get]: https://docs.databricks.com/api/workspace/cleanrooms/get`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -176,6 +185,8 @@ func newCreateOutputCatalog() *cobra.Command {
     CLEAN_ROOM_NAME: Name of the clean room.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -248,6 +259,8 @@ func newDelete() *cobra.Command {
     NAME: Name of the clean room.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -301,6 +314,8 @@ func newGet() *cobra.Command {
   Get the details of a clean room given its name.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -369,6 +384,8 @@ func newList() *cobra.Command {
   has access to are returned.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -435,6 +452,8 @@ func newUpdate() *cobra.Command {
     NAME: Name of the clean room.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/workspace/cluster-policies/cluster-policies.go b/cmd/workspace/cluster-policies/cluster-policies.go
old mode 100755
new mode 100644
index 4aa257d5692..c601693c28c
--- a/cmd/workspace/cluster-policies/cluster-policies.go
+++ b/cmd/workspace/cluster-policies/cluster-policies.go
@@ -3,6 +3,7 @@
 package cluster_policies
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -48,6 +49,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -99,6 +104,8 @@ func newCreate() *cobra.Command {
   Creates a new policy with prescribed settings.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -171,12 +178,14 @@ func newDelete() *cobra.Command {
     POLICY_ID: The ID of the policy to delete.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'policy_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'policy_id' in your JSON input")
 			}
 			return nil
 		}
@@ -215,7 +224,7 @@ func newDelete() *cobra.Command {
 				args = append(args, id)
 			}
 			if len(args) != 1 {
-				return fmt.Errorf("expected to have the id of the policy to delete")
+				return errors.New("expected to have the id of the policy to delete")
 			}
 			deleteReq.PolicyId = args[0]
 		}
@@ -275,12 +284,14 @@ func newEdit() *cobra.Command {
     POLICY_ID: The ID of the policy to update.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'policy_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'policy_id' in your JSON input")
 			}
 			return nil
 		}
@@ -319,7 +330,7 @@ func newEdit() *cobra.Command {
 				args = append(args, id)
 			}
 			if len(args) != 1 {
-				return fmt.Errorf("expected to have the id of the policy to update")
+				return errors.New("expected to have the id of the policy to update")
 			}
 			editReq.PolicyId = args[0]
 
@@ -368,6 +379,8 @@ func newGet() *cobra.Command {
     POLICY_ID: Canonical unique identifier for the Cluster Policy.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -389,7 +402,7 @@ func newGet() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have canonical unique identifier for the cluster policy")
+			return errors.New("expected to have canonical unique identifier for the cluster policy")
 		}
 		getReq.PolicyId = args[0]
 
@@ -437,6 +450,8 @@ func newGetPermissionLevels() *cobra.Command {
     CLUSTER_POLICY_ID: The cluster policy for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -458,7 +473,7 @@ func newGetPermissionLevels() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the cluster policy for which to get or manage permissions")
+			return errors.New("expected to have the cluster policy for which to get or manage permissions")
 		}
 		getPermissionLevelsReq.ClusterPolicyId = args[0]
 
@@ -507,6 +522,8 @@ func newGetPermissions() *cobra.Command {
     CLUSTER_POLICY_ID: The cluster policy for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -528,7 +545,7 @@ func newGetPermissions() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the cluster policy for which to get or manage permissions")
+			return errors.New("expected to have the cluster policy for which to get or manage permissions")
 		}
 		getPermissionsReq.ClusterPolicyId = args[0]
 
@@ -585,6 +602,8 @@ func newList() *cobra.Command {
   Returns a list of policies accessible by the requesting user.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -650,6 +669,8 @@ func newSetPermissions() *cobra.Command {
     CLUSTER_POLICY_ID: The cluster policy for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -683,7 +704,7 @@ func newSetPermissions() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the cluster policy for which to get or manage permissions")
+			return errors.New("expected to have the cluster policy for which to get or manage permissions")
 		}
 		setPermissionsReq.ClusterPolicyId = args[0]
 
@@ -737,6 +758,8 @@ func newUpdatePermissions() *cobra.Command {
     CLUSTER_POLICY_ID: The cluster policy for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -770,7 +793,7 @@ func newUpdatePermissions() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the cluster policy for which to get or manage permissions")
+			return errors.New("expected to have the cluster policy for which to get or manage permissions")
 		}
 		updatePermissionsReq.ClusterPolicyId = args[0]
 
diff --git a/cmd/workspace/clusters/clusters.go b/cmd/workspace/clusters/clusters.go
old mode 100755
new mode 100644
index ca8ed39838c..d0b0302b66f
--- a/cmd/workspace/clusters/clusters.go
+++ b/cmd/workspace/clusters/clusters.go
@@ -3,6 +3,7 @@
 package clusters
 
 import (
+	"errors"
 	"fmt"
 	"time"
 
@@ -52,6 +53,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newChangeOwner())
 	cmd.AddCommand(newCreate())
@@ -113,12 +118,14 @@ func newChangeOwner() *cobra.Command {
     OWNER_USERNAME: New owner of the cluster_id after this RPC.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'cluster_id', 'owner_username' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'cluster_id', 'owner_username' in your JSON input")
 			}
 			return nil
 		}
@@ -213,6 +220,7 @@ func newCreate() *cobra.Command {
   SINGLE_USER,
   USER_ISOLATION,
 ]`)
+	cmd.Flags().Var(&createReq.DependencyMode, "dependency-mode", `Controls dependency configuration for the cluster. Supported values: [DEPENDENCY_MODE_AUTO, DEPENDENCY_MODE_CLUSTER_LIBRARIES, DEPENDENCY_MODE_ENVIRONMENTS]`)
 	// TODO: complex arg: docker_image
 	cmd.Flags().StringVar(&createReq.DriverInstancePoolId, "driver-instance-pool-id", createReq.DriverInstancePoolId, `The optional ID of the instance pool for the driver of the cluster belongs.`)
 	// TODO: complex arg: driver_node_type_flexibility
@@ -263,15 +271,19 @@ func newCreate() *cobra.Command {
   Arguments:
     SPARK_VERSION: The Spark version of the cluster, e.g. 3.3.x-scala2.11. A list of
       available Spark versions can be retrieved by using the
-      :method:clusters/sparkVersions API call.`
+      [clusters/sparkVersions] API call.
+
+      [clusters/sparkVersions]: https://docs.databricks.com/api/workspace/clusters/sparkversions`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'spark_version' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'spark_version' in your JSON input")
 			}
 			return nil
 		}
@@ -367,12 +379,14 @@ func newDelete() *cobra.Command {
     CLUSTER_ID: The cluster to be terminated.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'cluster_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'cluster_id' in your JSON input")
 			}
 			return nil
 		}
@@ -411,7 +425,7 @@ func newDelete() *cobra.Command {
 				args = append(args, id)
 			}
 			if len(args) != 1 {
-				return fmt.Errorf("expected to have the cluster to be terminated")
+				return errors.New("expected to have the cluster to be terminated")
 			}
 			deleteReq.ClusterId = args[0]
 		}
@@ -490,6 +504,7 @@ func newEdit() *cobra.Command {
   SINGLE_USER,
   USER_ISOLATION,
 ]`)
+	cmd.Flags().Var(&editReq.DependencyMode, "dependency-mode", `Controls dependency configuration for the cluster. Supported values: [DEPENDENCY_MODE_AUTO, DEPENDENCY_MODE_CLUSTER_LIBRARIES, DEPENDENCY_MODE_ENVIRONMENTS]`)
 	// TODO: complex arg: docker_image
 	cmd.Flags().StringVar(&editReq.DriverInstancePoolId, "driver-instance-pool-id", editReq.DriverInstancePoolId, `The optional ID of the instance pool for the driver of the cluster belongs.`)
 	// TODO: complex arg: driver_node_type_flexibility
@@ -536,15 +551,19 @@ func newEdit() *cobra.Command {
     CLUSTER_ID: ID of the cluster
     SPARK_VERSION: The Spark version of the cluster, e.g. 3.3.x-scala2.11. A list of
       available Spark versions can be retrieved by using the
-      :method:clusters/sparkVersions API call.`
+      [clusters/sparkVersions] API call.
+
+      [clusters/sparkVersions]: https://docs.databricks.com/api/workspace/clusters/sparkversions`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'cluster_id', 'spark_version' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'cluster_id', 'spark_version' in your JSON input")
 			}
 			return nil
 		}
@@ -654,12 +673,14 @@ func newEvents() *cobra.Command {
     CLUSTER_ID: The ID of the cluster to retrieve events about.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'cluster_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'cluster_id' in your JSON input")
 			}
 			return nil
 		}
@@ -698,7 +719,7 @@ func newEvents() *cobra.Command {
 				args = append(args, id)
 			}
 			if len(args) != 1 {
-				return fmt.Errorf("expected to have the id of the cluster to retrieve events about")
+				return errors.New("expected to have the id of the cluster to retrieve events about")
 			}
 			eventsReq.ClusterId = args[0]
 
@@ -752,6 +773,8 @@ func newGet() *cobra.Command {
     CLUSTER_ID: The cluster about which to retrieve information.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -773,7 +796,7 @@ func newGet() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the cluster about which to retrieve information")
+			return errors.New("expected to have the cluster about which to retrieve information")
 		}
 		getReq.ClusterId = args[0]
 
@@ -821,6 +844,8 @@ func newGetPermissionLevels() *cobra.Command {
     CLUSTER_ID: The cluster for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -842,7 +867,7 @@ func newGetPermissionLevels() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the cluster for which to get or manage permissions")
+			return errors.New("expected to have the cluster for which to get or manage permissions")
 		}
 		getPermissionLevelsReq.ClusterId = args[0]
 
@@ -891,6 +916,8 @@ func newGetPermissions() *cobra.Command {
     CLUSTER_ID: The cluster for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -912,7 +939,7 @@ func newGetPermissions() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the cluster for which to get or manage permissions")
+			return errors.New("expected to have the cluster for which to get or manage permissions")
 		}
 		getPermissionsReq.ClusterId = args[0]
 
@@ -974,6 +1001,8 @@ func newList() *cobra.Command {
   are not included.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -1027,6 +1056,8 @@ func newListNodeTypes() *cobra.Command {
   launch a cluster.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -1071,6 +1102,8 @@ func newListZones() *cobra.Command {
   example, us-west-2a). These zones can be used to launch a cluster.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -1128,12 +1161,14 @@ func newPermanentDelete() *cobra.Command {
     CLUSTER_ID: The cluster to be deleted.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'cluster_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'cluster_id' in your JSON input")
 			}
 			return nil
 		}
@@ -1172,7 +1207,7 @@ func newPermanentDelete() *cobra.Command {
 				args = append(args, id)
 			}
 			if len(args) != 1 {
-				return fmt.Errorf("expected to have the cluster to be deleted")
+				return errors.New("expected to have the cluster to be deleted")
 			}
 			permanentDeleteReq.ClusterId = args[0]
 		}
@@ -1222,12 +1257,14 @@ func newPin() *cobra.Command {
   effect. This API can only be called by workspace admins.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'cluster_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'cluster_id' in your JSON input")
 			}
 			return nil
 		}
@@ -1266,7 +1303,7 @@ func newPin() *cobra.Command {
 				args = append(args, id)
 			}
 			if len(args) != 1 {
-				return fmt.Errorf("expected to have ")
+				return errors.New("expected to have ")
 			}
 			pinReq.ClusterId = args[0]
 		}
@@ -1327,12 +1364,14 @@ func newResize() *cobra.Command {
     CLUSTER_ID: The cluster to be resized.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'cluster_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'cluster_id' in your JSON input")
 			}
 			return nil
 		}
@@ -1371,7 +1410,7 @@ func newResize() *cobra.Command {
 				args = append(args, id)
 			}
 			if len(args) != 1 {
-				return fmt.Errorf("expected to have the cluster to be resized")
+				return errors.New("expected to have the cluster to be resized")
 			}
 			resizeReq.ClusterId = args[0]
 
@@ -1444,12 +1483,14 @@ func newRestart() *cobra.Command {
     CLUSTER_ID: The cluster to be started.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'cluster_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'cluster_id' in your JSON input")
 			}
 			return nil
 		}
@@ -1488,7 +1529,7 @@ func newRestart() *cobra.Command {
 				args = append(args, id)
 			}
 			if len(args) != 1 {
-				return fmt.Errorf("expected to have the cluster to be started")
+				return errors.New("expected to have the cluster to be started")
 			}
 			restartReq.ClusterId = args[0]
 
@@ -1556,6 +1597,8 @@ func newSetPermissions() *cobra.Command {
     CLUSTER_ID: The cluster for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -1589,7 +1632,7 @@ func newSetPermissions() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the cluster for which to get or manage permissions")
+			return errors.New("expected to have the cluster for which to get or manage permissions")
 		}
 		setPermissionsReq.ClusterId = args[0]
 
@@ -1632,6 +1675,8 @@ func newSparkVersions() *cobra.Command {
   launch a cluster.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -1696,12 +1741,14 @@ func newStart() *cobra.Command {
     CLUSTER_ID: The cluster to be started.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'cluster_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'cluster_id' in your JSON input")
 			}
 			return nil
 		}
@@ -1740,7 +1787,7 @@ func newStart() *cobra.Command {
 				args = append(args, id)
 			}
 			if len(args) != 1 {
-				return fmt.Errorf("expected to have the cluster to be started")
+				return errors.New("expected to have the cluster to be started")
 			}
 			startReq.ClusterId = args[0]
 		}
@@ -1802,12 +1849,14 @@ func newUnpin() *cobra.Command {
   This API can only be called by workspace admins.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'cluster_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'cluster_id' in your JSON input")
 			}
 			return nil
 		}
@@ -1846,7 +1895,7 @@ func newUnpin() *cobra.Command {
 				args = append(args, id)
 			}
 			if len(args) != 1 {
-				return fmt.Errorf("expected to have ")
+				return errors.New("expected to have ")
 			}
 			unpinReq.ClusterId = args[0]
 		}
@@ -1928,12 +1977,14 @@ func newUpdate() *cobra.Command {
       future.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'cluster_id', 'update_mask' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'cluster_id', 'update_mask' in your JSON input")
 			}
 			return nil
 		}
@@ -2026,6 +2077,8 @@ func newUpdatePermissions() *cobra.Command {
     CLUSTER_ID: The cluster for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -2059,7 +2112,7 @@ func newUpdatePermissions() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the cluster for which to get or manage permissions")
+			return errors.New("expected to have the cluster for which to get or manage permissions")
 		}
 		updatePermissionsReq.ClusterId = args[0]
 
diff --git a/cmd/workspace/cmd.go b/cmd/workspace/cmd.go
old mode 100755
new mode 100644
index f8d5e672629..d27e90e1b7e
--- a/cmd/workspace/cmd.go
+++ b/cmd/workspace/cmd.go
@@ -5,12 +5,17 @@ package workspace
 import (
 	access_control "github.com/databricks/cli/cmd/workspace/access-control"
 	agent_bricks "github.com/databricks/cli/cmd/workspace/agent-bricks"
+	agent_kit "github.com/databricks/cli/cmd/workspace/agent-kit"
+	ai_functions "github.com/databricks/cli/cmd/workspace/ai-functions"
+	ai_gateway "github.com/databricks/cli/cmd/workspace/ai-gateway"
+	ai_search "github.com/databricks/cli/cmd/workspace/ai-search"
 	alerts "github.com/databricks/cli/cmd/workspace/alerts"
 	alerts_legacy "github.com/databricks/cli/cmd/workspace/alerts-legacy"
 	alerts_v2 "github.com/databricks/cli/cmd/workspace/alerts-v2"
 	apps "github.com/databricks/cli/cmd/workspace/apps"
 	apps_settings "github.com/databricks/cli/cmd/workspace/apps-settings"
 	artifact_allowlists "github.com/databricks/cli/cmd/workspace/artifact-allowlists"
+	bundle_deployments "github.com/databricks/cli/cmd/workspace/bundle-deployments"
 	catalogs "github.com/databricks/cli/cmd/workspace/catalogs"
 	clean_room_asset_revisions "github.com/databricks/cli/cmd/workspace/clean-room-asset-revisions"
 	clean_room_assets "github.com/databricks/cli/cmd/workspace/clean-room-assets"
@@ -34,6 +39,7 @@ import (
 	data_quality "github.com/databricks/cli/cmd/workspace/data-quality"
 	data_sources "github.com/databricks/cli/cmd/workspace/data-sources"
 	database "github.com/databricks/cli/cmd/workspace/database"
+	domains "github.com/databricks/cli/cmd/workspace/domains"
 	entity_tag_assignments "github.com/databricks/cli/cmd/workspace/entity-tag-assignments"
 	environments "github.com/databricks/cli/cmd/workspace/environments"
 	experiments "github.com/databricks/cli/cmd/workspace/experiments"
@@ -94,20 +100,24 @@ import (
 	repos "github.com/databricks/cli/cmd/workspace/repos"
 	resource_quotas "github.com/databricks/cli/cmd/workspace/resource-quotas"
 	rfa "github.com/databricks/cli/cmd/workspace/rfa"
+	sandbox "github.com/databricks/cli/cmd/workspace/sandbox"
 	schemas "github.com/databricks/cli/cmd/workspace/schemas"
 	secrets "github.com/databricks/cli/cmd/workspace/secrets"
+	secrets_uc "github.com/databricks/cli/cmd/workspace/secrets-uc"
 	service_principal_secrets_proxy "github.com/databricks/cli/cmd/workspace/service-principal-secrets-proxy"
 	service_principals_v2 "github.com/databricks/cli/cmd/workspace/service-principals-v2"
 	serving_endpoints "github.com/databricks/cli/cmd/workspace/serving-endpoints"
 	settings "github.com/databricks/cli/cmd/workspace/settings"
 	shares "github.com/databricks/cli/cmd/workspace/shares"
 	storage_credentials "github.com/databricks/cli/cmd/workspace/storage-credentials"
+	supervisor_agents "github.com/databricks/cli/cmd/workspace/supervisor-agents"
 	system_schemas "github.com/databricks/cli/cmd/workspace/system-schemas"
 	table_constraints "github.com/databricks/cli/cmd/workspace/table-constraints"
 	tables "github.com/databricks/cli/cmd/workspace/tables"
 	tag_policies "github.com/databricks/cli/cmd/workspace/tag-policies"
 	temporary_path_credentials "github.com/databricks/cli/cmd/workspace/temporary-path-credentials"
 	temporary_table_credentials "github.com/databricks/cli/cmd/workspace/temporary-table-credentials"
+	temporary_volume_credentials "github.com/databricks/cli/cmd/workspace/temporary-volume-credentials"
 	token_management "github.com/databricks/cli/cmd/workspace/token-management"
 	tokens "github.com/databricks/cli/cmd/workspace/tokens"
 	users_v2 "github.com/databricks/cli/cmd/workspace/users-v2"
@@ -133,12 +143,17 @@ func All() []*cobra.Command {
 
 	out = append(out, access_control.New())
 	out = append(out, agent_bricks.New())
+	out = append(out, agent_kit.New())
+	out = append(out, ai_functions.New())
+	out = append(out, ai_gateway.New())
+	out = append(out, ai_search.New())
 	out = append(out, alerts.New())
 	out = append(out, alerts_legacy.New())
 	out = append(out, alerts_v2.New())
 	out = append(out, apps.New())
 	out = append(out, apps_settings.New())
 	out = append(out, artifact_allowlists.New())
+	out = append(out, bundle_deployments.New())
 	out = append(out, catalogs.New())
 	out = append(out, clean_room_asset_revisions.New())
 	out = append(out, clean_room_assets.New())
@@ -162,6 +177,7 @@ func All() []*cobra.Command {
 	out = append(out, data_quality.New())
 	out = append(out, data_sources.New())
 	out = append(out, database.New())
+	out = append(out, domains.New())
 	out = append(out, entity_tag_assignments.New())
 	out = append(out, environments.New())
 	out = append(out, experiments.New())
@@ -222,20 +238,24 @@ func All() []*cobra.Command {
 	out = append(out, repos.New())
 	out = append(out, resource_quotas.New())
 	out = append(out, rfa.New())
+	out = append(out, sandbox.New())
 	out = append(out, schemas.New())
 	out = append(out, secrets.New())
+	out = append(out, secrets_uc.New())
 	out = append(out, service_principal_secrets_proxy.New())
 	out = append(out, service_principals_v2.New())
 	out = append(out, serving_endpoints.New())
 	out = append(out, settings.New())
 	out = append(out, shares.New())
 	out = append(out, storage_credentials.New())
+	out = append(out, supervisor_agents.New())
 	out = append(out, system_schemas.New())
 	out = append(out, table_constraints.New())
 	out = append(out, tables.New())
 	out = append(out, tag_policies.New())
 	out = append(out, temporary_path_credentials.New())
 	out = append(out, temporary_table_credentials.New())
+	out = append(out, temporary_volume_credentials.New())
 	out = append(out, token_management.New())
 	out = append(out, tokens.New())
 	out = append(out, users_v2.New())
diff --git a/cmd/workspace/compliance-security-profile/compliance-security-profile.go b/cmd/workspace/compliance-security-profile/compliance-security-profile.go
old mode 100755
new mode 100644
index 570c2e1897a..0a87f8a7bc9
--- a/cmd/workspace/compliance-security-profile/compliance-security-profile.go
+++ b/cmd/workspace/compliance-security-profile/compliance-security-profile.go
@@ -3,7 +3,7 @@
 package compliance_security_profile
 
 import (
-	"fmt"
+	"errors"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
@@ -20,8 +20,10 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "compliance-security-profile",
-		Short: `Controls whether to enable the compliance security profile for the current workspace.`,
-		Long: `Controls whether to enable the compliance security profile for the current
+		Short: `*Public Preview* Controls whether to enable the compliance security profile for the current workspace.`,
+		Long: `This command is in Public Preview and may change without notice.
+
+Controls whether to enable the compliance security profile for the current
   workspace. Enabling it on a workspace is permanent. By default, it is turned
   off.
 
@@ -29,6 +31,10 @@ func New() *cobra.Command {
 		RunE: root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
 	// Add methods
 	cmd.AddCommand(newGet())
 	cmd.AddCommand(newUpdate())
@@ -58,12 +64,16 @@ func newGet() *cobra.Command {
 	cmd.Flags().StringVar(&getReq.Etag, "etag", getReq.Etag, `etag used for versioning.`)
 
 	cmd.Use = "get"
-	cmd.Short = `Get the compliance security profile setting.`
-	cmd.Long = `Get the compliance security profile setting.
+	cmd.Short = `*Public Preview* Get the compliance security profile setting.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get the compliance security profile setting.
 
   Gets the compliance security profile setting.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -113,8 +123,10 @@ func newUpdate() *cobra.Command {
 	cmd.Flags().Var(&updateJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Use = "update"
-	cmd.Short = `Update the compliance security profile setting.`
-	cmd.Long = `Update the compliance security profile setting.
+	cmd.Short = `*Public Preview* Update the compliance security profile setting.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Update the compliance security profile setting.
 
   Updates the compliance security profile setting for the workspace. A fresh
   etag needs to be provided in PATCH requests (as part of the setting field).
@@ -123,6 +135,8 @@ func newUpdate() *cobra.Command {
   the request must be retried by using the fresh etag in the 409 response.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -141,7 +155,7 @@ func newUpdate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := w.Settings.ComplianceSecurityProfile().Update(ctx, updateReq)
diff --git a/cmd/workspace/connections/connections.go b/cmd/workspace/connections/connections.go
old mode 100755
new mode 100644
index 5507ed839af..2a923fabda6
--- a/cmd/workspace/connections/connections.go
+++ b/cmd/workspace/connections/connections.go
@@ -3,6 +3,7 @@
 package connections
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -20,22 +21,24 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "connections",
-		Short: `Connections allow for creating a connection to an external data source.`,
-		Long: `Connections allow for creating a connection to an external data source.
-
-  A connection is an abstraction of an external data source that can be
-  connected from Databricks Compute. Creating a connection object is the first
-  step to managing external data sources within Unity Catalog, with the second
-  step being creating a data object (catalog, schema, or table) using the
-  connection. Data objects derived from a connection can be written to or read
-  from similar to other Unity Catalog data objects based on cloud storage. Users
-  may create different types of connections with each connection having a unique
-  set of configuration options to support credential management and other
-  settings.`,
+		Short: `A connection represents an external data source for use within Databricks.`,
+		Long: `A connection represents an external data source for use within Databricks.
+
+  Creating a connection object is the first step to managing external data
+  sources within Unity Catalog. The second step is creating a data object
+  (catalog, schema, or table) using the connection. Data objects derived from a
+  connection can be written to or read from similar to other Unity Catalog data
+  objects based on cloud storage. You can create different types of connections,
+  and each connection has a unique set of configuration options to support
+  credential management and other settings.`,
 		GroupID: "catalog",
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -69,8 +72,11 @@ func newCreate() *cobra.Command {
 	cmd.Flags().Var(&createJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Flags().StringVar(&createReq.Comment, "comment", createReq.Comment, `User-provided free-form text description.`)
+	// TODO: complex arg: environment_settings
+	cmd.Flags().StringVar(&createReq.Parent, "parent", createReq.Parent, `Parent schema for schema-level connections, in format "schemas/{catalog}.{schema}".`)
 	// TODO: map via StringToStringVar: properties
 	cmd.Flags().BoolVar(&createReq.ReadOnly, "read-only", createReq.ReadOnly, `If the connection is read only.`)
+	// TODO: map via StringToStringVar: secrets
 
 	cmd.Use = "create"
 	cmd.Short = `Create a connection.`
@@ -83,6 +89,8 @@ func newCreate() *cobra.Command {
   external server.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -101,7 +109,7 @@ func newCreate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := w.Connections.Create(ctx, createReq)
@@ -148,6 +156,8 @@ func newDelete() *cobra.Command {
     NAME: The name of the connection to be deleted.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -169,7 +179,7 @@ func newDelete() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the name of the connection to be deleted")
+			return errors.New("expected to have the name of the connection to be deleted")
 		}
 		deleteReq.Name = args[0]
 
@@ -216,6 +226,8 @@ func newGet() *cobra.Command {
     NAME: Name of the connection.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -237,7 +249,7 @@ func newGet() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have name of the connection")
+			return errors.New("expected to have name of the connection")
 		}
 		getReq.Name = args[0]
 
@@ -279,6 +291,8 @@ func newList() *cobra.Command {
 	// branches, so the method-call path is always reached.
 	var listLimit int
 
+	cmd.Flags().StringVar(&listReq.Parent, "parent", listReq.Parent, `Optional.`)
+
 	// Limit flag for total result capping.
 	cmd.Flags().IntVar(&listLimit, "limit", 0, `Maximum number of results to return.`)
 
@@ -303,6 +317,8 @@ func newList() *cobra.Command {
   indication that the end of results has been reached.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -354,8 +370,10 @@ func newUpdate() *cobra.Command {
 
 	cmd.Flags().Var(&updateJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
+	// TODO: complex arg: environment_settings
 	cmd.Flags().StringVar(&updateReq.NewName, "new-name", updateReq.NewName, `New name for the connection.`)
 	cmd.Flags().StringVar(&updateReq.Owner, "owner", updateReq.Owner, `Username of current owner of the connection.`)
+	// TODO: map via StringToStringVar: secrets
 
 	cmd.Use = "update NAME"
 	cmd.Short = `Update a connection.`
@@ -367,6 +385,8 @@ func newUpdate() *cobra.Command {
     NAME: Name of the connection.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -390,7 +410,7 @@ func newUpdate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 		updateReq.Name = args[0]
 
diff --git a/cmd/workspace/consumer-fulfillments/consumer-fulfillments.go b/cmd/workspace/consumer-fulfillments/consumer-fulfillments.go
old mode 100755
new mode 100644
index 6bf3a6169a5..5444f2c42f6
--- a/cmd/workspace/consumer-fulfillments/consumer-fulfillments.go
+++ b/cmd/workspace/consumer-fulfillments/consumer-fulfillments.go
@@ -25,6 +25,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newGet())
 	cmd.AddCommand(newList())
@@ -71,6 +75,8 @@ func newGet() *cobra.Command {
   Get a high level preview of the metadata of listing installable content.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -145,6 +151,8 @@ func newList() *cobra.Command {
   repo, as well as the Delta Sharing recipient type.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/workspace/consumer-installations/consumer-installations.go b/cmd/workspace/consumer-installations/consumer-installations.go
old mode 100755
new mode 100644
index 352b8380764..9f9e332b49b
--- a/cmd/workspace/consumer-installations/consumer-installations.go
+++ b/cmd/workspace/consumer-installations/consumer-installations.go
@@ -3,6 +3,7 @@
 package consumer_installations
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -27,6 +28,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -72,6 +77,8 @@ func newCreate() *cobra.Command {
   Install payload associated with a Databricks Marketplace listing.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -138,6 +145,8 @@ func newDelete() *cobra.Command {
   Uninstall an installation associated with a Databricks Marketplace listing.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -205,6 +214,8 @@ func newList() *cobra.Command {
   List all installations across all listings.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -273,6 +284,8 @@ func newListListingInstallations() *cobra.Command {
   List all installations for a particular listing.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -339,6 +352,8 @@ func newUpdate() *cobra.Command {
   rotateToken flag is true and the tokenInfo field is empty`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -362,7 +377,7 @@ func newUpdate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 		updateReq.ListingId = args[0]
 		updateReq.InstallationId = args[1]
diff --git a/cmd/workspace/consumer-listings/consumer-listings.go b/cmd/workspace/consumer-listings/consumer-listings.go
old mode 100755
new mode 100644
index a3bfe6f9c30..7e513847acb
--- a/cmd/workspace/consumer-listings/consumer-listings.go
+++ b/cmd/workspace/consumer-listings/consumer-listings.go
@@ -3,6 +3,7 @@
 package consumer_listings
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -26,6 +27,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newBatchGet())
 	cmd.AddCommand(newGet())
@@ -64,6 +69,8 @@ func newBatchGet() *cobra.Command {
   has access to.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -117,6 +124,8 @@ func newGet() *cobra.Command {
   access to.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -138,7 +147,7 @@ func newGet() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have ")
+			return errors.New("expected to have ")
 		}
 		getReq.Id = args[0]
 
@@ -187,7 +196,7 @@ func newList() *cobra.Command {
 	cmd.Flags().BoolVar(&listReq.IsStaffPick, "is-staff-pick", listReq.IsStaffPick, `Filters each listing based on whether it is a staff pick.`)
 	cmd.Flags().IntVar(&listReq.PageSize, "page-size", listReq.PageSize, ``)
 	// TODO: array: provider_ids
-	// TODO: array: tags
+	// TODO: complex arg: tags
 
 	// Limit flag for total result capping.
 	cmd.Flags().IntVar(&listLimit, "limit", 0, `Maximum number of results to return.`)
@@ -204,6 +213,8 @@ func newList() *cobra.Command {
   has access to.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -282,6 +293,8 @@ func newSearch() *cobra.Command {
     QUERY: Fuzzy matches query`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -303,7 +316,7 @@ func newSearch() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have fuzzy matches query")
+			return errors.New("expected to have fuzzy matches query")
 		}
 		searchReq.Query = args[0]
 
diff --git a/cmd/workspace/consumer-personalization-requests/consumer-personalization-requests.go b/cmd/workspace/consumer-personalization-requests/consumer-personalization-requests.go
old mode 100755
new mode 100644
index 74f6f7e5a95..7c1d7f0ad0f
--- a/cmd/workspace/consumer-personalization-requests/consumer-personalization-requests.go
+++ b/cmd/workspace/consumer-personalization-requests/consumer-personalization-requests.go
@@ -3,6 +3,7 @@
 package consumer_personalization_requests
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -27,6 +28,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newGet())
@@ -71,6 +76,8 @@ func newCreate() *cobra.Command {
   Create a personalization request for a listing.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -94,7 +101,7 @@ func newCreate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 		createReq.ListingId = args[0]
 
@@ -140,6 +147,8 @@ func newGet() *cobra.Command {
   *most* one personalization request for a listing.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -207,6 +216,8 @@ func newList() *cobra.Command {
   List personalization requests for a consumer across all listings.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
diff --git a/cmd/workspace/consumer-providers/consumer-providers.go b/cmd/workspace/consumer-providers/consumer-providers.go
old mode 100755
new mode 100644
index 9c579c5d610..e03eb48a4a9
--- a/cmd/workspace/consumer-providers/consumer-providers.go
+++ b/cmd/workspace/consumer-providers/consumer-providers.go
@@ -3,6 +3,7 @@
 package consumer_providers
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -25,6 +26,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newBatchGet())
 	cmd.AddCommand(newGet())
@@ -62,6 +67,8 @@ func newBatchGet() *cobra.Command {
   listing.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -115,6 +122,8 @@ func newGet() *cobra.Command {
   listing.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -136,7 +145,7 @@ func newGet() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have ")
+			return errors.New("expected to have ")
 		}
 		getReq.Id = args[0]
 
@@ -196,6 +205,8 @@ func newList() *cobra.Command {
   listing.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
diff --git a/cmd/workspace/credentials-manager/credentials-manager.go b/cmd/workspace/credentials-manager/credentials-manager.go
old mode 100755
new mode 100644
index 4e0d2a10d84..6c960ed692f
--- a/cmd/workspace/credentials-manager/credentials-manager.go
+++ b/cmd/workspace/credentials-manager/credentials-manager.go
@@ -3,7 +3,7 @@
 package credentials_manager
 
 import (
-	"fmt"
+	"errors"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
@@ -30,6 +30,10 @@ func New() *cobra.Command {
 		RunE:   root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
 	// Add methods
 	cmd.AddCommand(newExchangeToken())
 
@@ -63,9 +67,22 @@ func newExchangeToken() *cobra.Command {
 	cmd.Long = `Exchange token.
 
   Exchange tokens with an Identity Provider to get a new access token. It allows
-  specifying scopes to determine token permissions.`
+  specifying scopes to determine token permissions.
+
+  POST /exchange-tokens/token is the documented public form, expressed via
+  google.api.http below. GET /exchange-tokens/$exchange is a legacy alias used
+  by the Spark driver's OAuth refresh path (DBHttpClient#get sends a body via
+  HttpGetWithEntity) and stays on the legacy option (rpc).endpoints
+  annotation: its path contains a literal $, which google.api.http's LITERAL
+  grammar does not allow, and HttpPathParser does not percent-decode template
+  segments (so encoding as %24exchange would not match the literal $exchange
+  path the Spark driver sends). Per-endpoint visibility: PUBLIC_UNDOCUMENTED
+  preserves the DECO-7732 intent of suppressing the GET alias from the public
+  API spec.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -84,7 +101,7 @@ func newExchangeToken() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := w.CredentialsManager.ExchangeToken(ctx, exchangeTokenReq)
diff --git a/cmd/workspace/credentials/credentials.go b/cmd/workspace/credentials/credentials.go
old mode 100755
new mode 100644
index cd743f0edf8..60348246c1b
--- a/cmd/workspace/credentials/credentials.go
+++ b/cmd/workspace/credentials/credentials.go
@@ -3,6 +3,7 @@
 package credentials
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -33,6 +34,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreateCredential())
 	cmd.AddCommand(newDeleteCredential())
@@ -92,12 +97,14 @@ func newCreateCredential() *cobra.Command {
       credentials within the metastore.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name' in your JSON input")
 			}
 			return nil
 		}
@@ -173,6 +180,8 @@ func newDeleteCredential() *cobra.Command {
     NAME_ARG: Name of the credential.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -237,12 +246,14 @@ func newGenerateTemporaryServiceCredential() *cobra.Command {
     CREDENTIAL_NAME: The name of the service credential used to generate a temporary credential`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'credential_name' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'credential_name' in your JSON input")
 			}
 			return nil
 		}
@@ -317,6 +328,8 @@ func newGetCredential() *cobra.Command {
     NAME_ARG: Name of the credential.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -396,6 +409,8 @@ func newListCredentials() *cobra.Command {
   end of results has been reached.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -473,6 +488,8 @@ func newUpdateCredential() *cobra.Command {
     NAME_ARG: Name of the credential.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -565,6 +582,8 @@ func newValidateCredential() *cobra.Command {
   **CREATE_EXTERNAL_LOCATION** when purpose is **STORAGE**).`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
diff --git a/cmd/workspace/current-user/current-user.go b/cmd/workspace/current-user/current-user.go
old mode 100755
new mode 100644
index 7a11844f6c5..de32f481229
--- a/cmd/workspace/current-user/current-user.go
+++ b/cmd/workspace/current-user/current-user.go
@@ -6,6 +6,7 @@ import (
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
 	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/databricks-sdk-go/service/iam"
 	"github.com/spf13/cobra"
 )
 
@@ -16,13 +17,19 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "current-user",
-		Short: `This API allows retrieving information about currently authenticated user or service principal.`,
-		Long: `This API allows retrieving information about currently authenticated user or
+		Short: `*Public Preview* This API allows retrieving information about currently authenticated user or service principal.`,
+		Long: `This command is in Public Preview and may change without notice.
+
+This API allows retrieving information about currently authenticated user or
   service principal.`,
 		GroupID: "iam",
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
 	// Add methods
 	cmd.AddCommand(newMe())
 
@@ -40,24 +47,40 @@ func New() *cobra.Command {
 // Functions can be added from the `init()` function in manually curated files in this directory.
 var meOverrides []func(
 	*cobra.Command,
+	*iam.MeRequest,
 )
 
 func newMe() *cobra.Command {
 	cmd := &cobra.Command{}
 
+	var meReq iam.MeRequest
+
+	cmd.Flags().StringVar(&meReq.Attributes, "attributes", meReq.Attributes, `Comma-separated list of attributes to return in response.`)
+	cmd.Flags().StringVar(&meReq.ExcludedAttributes, "excluded-attributes", meReq.ExcludedAttributes, `Comma-separated list of attributes to exclude in response.`)
+
 	cmd.Use = "me"
-	cmd.Short = `Get current user info.`
-	cmd.Long = `Get current user info.
+	cmd.Short = `*Public Preview* Get current user info.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get current user info.
 
   Get details about the current method caller's identity.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(0)
+		return check(cmd, args)
+	}
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
 		ctx := cmd.Context()
 		w := cmdctx.WorkspaceClient(ctx)
-		response, err := w.CurrentUser.Me(ctx)
+
+		response, err := w.CurrentUser.Me(ctx, meReq)
 		if err != nil {
 			return err
 		}
@@ -71,7 +94,7 @@ func newMe() *cobra.Command {
 
 	// Apply optional overrides to this command.
 	for _, fn := range meOverrides {
-		fn(cmd)
+		fn(cmd, &meReq)
 	}
 
 	return cmd
diff --git a/cmd/workspace/dashboard-email-subscriptions/dashboard-email-subscriptions.go b/cmd/workspace/dashboard-email-subscriptions/dashboard-email-subscriptions.go
old mode 100755
new mode 100644
index 702bf376d54..b8cb554761f
--- a/cmd/workspace/dashboard-email-subscriptions/dashboard-email-subscriptions.go
+++ b/cmd/workspace/dashboard-email-subscriptions/dashboard-email-subscriptions.go
@@ -3,7 +3,7 @@
 package dashboard_email_subscriptions
 
 import (
-	"fmt"
+	"errors"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
@@ -20,13 +20,19 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "dashboard-email-subscriptions",
-		Short: `Controls whether schedules or workload tasks for refreshing AI/BI Dashboards in the workspace can send subscription emails containing PDFs and/or images of the dashboard.`,
-		Long: `Controls whether schedules or workload tasks for refreshing AI/BI Dashboards
+		Short: `*Public Preview* Controls whether schedules or workload tasks for refreshing AI/BI Dashboards in the workspace can send subscription emails containing PDFs and/or images of the dashboard.`,
+		Long: `This command is in Public Preview and may change without notice.
+
+Controls whether schedules or workload tasks for refreshing AI/BI Dashboards
   in the workspace can send subscription emails containing PDFs and/or images of
   the dashboard. By default, this setting is enabled (set to true)`,
 		RunE: root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
 	// Add methods
 	cmd.AddCommand(newDelete())
 	cmd.AddCommand(newGet())
@@ -57,12 +63,16 @@ func newDelete() *cobra.Command {
 	cmd.Flags().StringVar(&deleteReq.Etag, "etag", deleteReq.Etag, `etag used for versioning.`)
 
 	cmd.Use = "delete"
-	cmd.Short = `Delete the Dashboard Email Subscriptions setting.`
-	cmd.Long = `Delete the Dashboard Email Subscriptions setting.
+	cmd.Short = `*Public Preview* Delete the Dashboard Email Subscriptions setting.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Delete the Dashboard Email Subscriptions setting.
 
   Reverts the Dashboard Email Subscriptions setting to its default value.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -111,12 +121,16 @@ func newGet() *cobra.Command {
 	cmd.Flags().StringVar(&getReq.Etag, "etag", getReq.Etag, `etag used for versioning.`)
 
 	cmd.Use = "get"
-	cmd.Short = `Get the Dashboard Email Subscriptions setting.`
-	cmd.Long = `Get the Dashboard Email Subscriptions setting.
+	cmd.Short = `*Public Preview* Get the Dashboard Email Subscriptions setting.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get the Dashboard Email Subscriptions setting.
 
   Gets the Dashboard Email Subscriptions setting.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -166,12 +180,16 @@ func newUpdate() *cobra.Command {
 	cmd.Flags().Var(&updateJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Use = "update"
-	cmd.Short = `Update the Dashboard Email Subscriptions setting.`
-	cmd.Long = `Update the Dashboard Email Subscriptions setting.
+	cmd.Short = `*Public Preview* Update the Dashboard Email Subscriptions setting.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Update the Dashboard Email Subscriptions setting.
 
   Updates the Dashboard Email Subscriptions setting.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -190,7 +208,7 @@ func newUpdate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := w.Settings.DashboardEmailSubscriptions().Update(ctx, updateReq)
diff --git a/cmd/workspace/dashboard-widgets/dashboard-widgets.go b/cmd/workspace/dashboard-widgets/dashboard-widgets.go
old mode 100755
new mode 100644
index 89d584ecac8..b417deb6c32
--- a/cmd/workspace/dashboard-widgets/dashboard-widgets.go
+++ b/cmd/workspace/dashboard-widgets/dashboard-widgets.go
@@ -3,7 +3,7 @@
 package dashboard_widgets
 
 import (
-	"fmt"
+	"errors"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
@@ -31,6 +31,10 @@ func New() *cobra.Command {
 		RunE:   root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -62,7 +66,7 @@ func newCreate() *cobra.Command {
 	cmd.Flags().Var(&createJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Flags().StringVar(&createReq.Text, "text", createReq.Text, `If this is a textbox widget, the application displays this text.`)
-	cmd.Flags().StringVar(&createReq.VisualizationId, "visualization-id", createReq.VisualizationId, `Query Vizualization ID returned by :method:queryvisualizations/create.`)
+	cmd.Flags().StringVar(&createReq.VisualizationId, "visualization-id", createReq.VisualizationId, `Query Visualization ID returned by :method:queryvisualizations/create.`)
 
 	cmd.Use = "create"
 	cmd.Short = `Add widget to a dashboard.`
@@ -71,6 +75,8 @@ func newCreate() *cobra.Command {
   Adds a widget to a dashboard`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -89,7 +95,7 @@ func newCreate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := w.DashboardWidgets.Create(ctx, createReq)
@@ -136,6 +142,8 @@ func newDelete() *cobra.Command {
     ID: Widget ID returned by :method:dashboardwidgets/create`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -186,7 +194,7 @@ func newUpdate() *cobra.Command {
 	cmd.Flags().Var(&updateJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Flags().StringVar(&updateReq.Text, "text", updateReq.Text, `If this is a textbox widget, the application displays this text.`)
-	cmd.Flags().StringVar(&updateReq.VisualizationId, "visualization-id", updateReq.VisualizationId, `Query Vizualization ID returned by :method:queryvisualizations/create.`)
+	cmd.Flags().StringVar(&updateReq.VisualizationId, "visualization-id", updateReq.VisualizationId, `Query Visualization ID returned by :method:queryvisualizations/create.`)
 
 	cmd.Use = "update ID"
 	cmd.Short = `Update existing widget.`
@@ -198,6 +206,8 @@ func newUpdate() *cobra.Command {
     ID: Widget ID returned by :method:dashboardwidgets/create`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -221,7 +231,7 @@ func newUpdate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 		updateReq.Id = args[0]
 
diff --git a/cmd/workspace/dashboards/dashboards.go b/cmd/workspace/dashboards/dashboards.go
old mode 100755
new mode 100644
index fedffb5a397..5eb7ed2d3a1
--- a/cmd/workspace/dashboards/dashboards.go
+++ b/cmd/workspace/dashboards/dashboards.go
@@ -36,6 +36,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newDelete())
 	cmd.AddCommand(newGet())
@@ -78,6 +82,8 @@ func newDelete() *cobra.Command {
   [Learn more]: https://docs.databricks.com/en/dashboards/`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -137,6 +143,8 @@ func newGet() *cobra.Command {
   [Learn more]: https://docs.databricks.com/en/dashboards/`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -215,6 +223,8 @@ func newList() *cobra.Command {
   [Learn more]: https://docs.databricks.com/en/dashboards/`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -275,6 +285,8 @@ func newRestore() *cobra.Command {
   [Learn more]: https://docs.databricks.com/en/dashboards/`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -343,6 +355,8 @@ func newUpdate() *cobra.Command {
   [Learn more]: https://docs.databricks.com/en/dashboards/`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/workspace/data-classification/data-classification.go b/cmd/workspace/data-classification/data-classification.go
old mode 100755
new mode 100644
index e3a87558072..edc73c21d4b
--- a/cmd/workspace/data-classification/data-classification.go
+++ b/cmd/workspace/data-classification/data-classification.go
@@ -30,6 +30,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreateCatalogConfig())
 	cmd.AddCommand(newDeleteCatalogConfig())
@@ -63,6 +67,7 @@ func newCreateCatalogConfig() *cobra.Command {
 	cmd.Flags().Var(&createCatalogConfigJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	// TODO: array: auto_tag_configs
+	// TODO: complex arg: excluded_schemas
 	// TODO: complex arg: included_schemas
 	cmd.Flags().StringVar(&createCatalogConfigReq.CatalogConfig.Name, "name", createCatalogConfigReq.CatalogConfig.Name, `Resource name in the format: catalogs/{catalog_name}/config.`)
 
@@ -79,6 +84,8 @@ func newCreateCatalogConfig() *cobra.Command {
     PARENT: Parent resource in the format: catalogs/{catalog_name}`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -148,6 +155,8 @@ func newDeleteCatalogConfig() *cobra.Command {
     NAME: Resource name in the format: catalogs/{catalog_name}/config`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -204,6 +213,8 @@ func newGetCatalogConfig() *cobra.Command {
     NAME: Resource name in the format: catalogs/{catalog_name}/config`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -256,6 +267,7 @@ func newUpdateCatalogConfig() *cobra.Command {
 	cmd.Flags().Var(&updateCatalogConfigJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	// TODO: array: auto_tag_configs
+	// TODO: complex arg: excluded_schemas
 	// TODO: complex arg: included_schemas
 	cmd.Flags().StringVar(&updateCatalogConfigReq.CatalogConfig.Name, "name", updateCatalogConfigReq.CatalogConfig.Name, `Resource name in the format: catalogs/{catalog_name}/config.`)
 
@@ -272,6 +284,8 @@ func newUpdateCatalogConfig() *cobra.Command {
     UPDATE_MASK: Field mask specifying which fields to update.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
diff --git a/cmd/workspace/data-quality/data-quality.go b/cmd/workspace/data-quality/data-quality.go
old mode 100755
new mode 100644
index 905a0076d51..b7ed15b8acb
--- a/cmd/workspace/data-quality/data-quality.go
+++ b/cmd/workspace/data-quality/data-quality.go
@@ -3,6 +3,7 @@
 package data_quality
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -20,13 +21,19 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "data-quality",
-		Short: `Manage the data quality of Unity Catalog objects (currently support schema and table).`,
-		Long: `Manage the data quality of Unity Catalog objects (currently support schema
+		Short: `*Public Preview* Manage the data quality of Unity Catalog objects (currently support schema and table).`,
+		Long: `This command is in Public Preview and may change without notice.
+
+Manage the data quality of Unity Catalog objects (currently support schema
   and table)`,
 		GroupID: "dataquality",
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
 	// Add methods
 	cmd.AddCommand(newCancelRefresh())
 	cmd.AddCommand(newCreateMonitor())
@@ -63,8 +70,10 @@ func newCancelRefresh() *cobra.Command {
 	var cancelRefreshReq dataquality.CancelRefreshRequest
 
 	cmd.Use = "cancel-refresh OBJECT_TYPE OBJECT_ID REFRESH_ID"
-	cmd.Short = `Cancel a refresh.`
-	cmd.Long = `Cancel a refresh.
+	cmd.Short = `*Public Preview* Cancel a refresh.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Cancel a refresh.
 
   Cancels a data quality monitor refresh. Currently only supported for the
   table object_type. The call must be made in the same workspace as where
@@ -97,6 +106,8 @@ func newCancelRefresh() *cobra.Command {
     REFRESH_ID: Unique id of the refresh operation.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(3)
@@ -157,8 +168,10 @@ func newCreateMonitor() *cobra.Command {
 	// TODO: complex arg: data_profiling_config
 
 	cmd.Use = "create-monitor OBJECT_TYPE OBJECT_ID"
-	cmd.Short = `Create a monitor.`
-	cmd.Long = `Create a monitor.
+	cmd.Short = `*Public Preview* Create a monitor.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Create a monitor.
 
   Create a data quality monitor on a Unity Catalog object. The caller must
   provide either anomaly_detection_config for a schema monitor or
@@ -199,12 +212,14 @@ func newCreateMonitor() *cobra.Command {
       [table_id]: https://docs.databricks.com/api/workspace/tables/get#table_id`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'object_type', 'object_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'object_type', 'object_id' in your JSON input")
 			}
 			return nil
 		}
@@ -275,8 +290,10 @@ func newCreateRefresh() *cobra.Command {
 	cmd.Flags().Var(&createRefreshJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Use = "create-refresh OBJECT_TYPE OBJECT_ID"
-	cmd.Short = `Create a refresh.`
-	cmd.Long = `Create a refresh.
+	cmd.Short = `*Public Preview* Create a refresh.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Create a refresh.
 
   Creates a refresh. Currently only supported for the table object_type. The
   call must be made in the same workspace as where the monitor was created.
@@ -289,7 +306,7 @@ func newCreateRefresh() *cobra.Command {
   the table.
 
   Arguments:
-    OBJECT_TYPE: The type of the monitored object. Can be one of the following: schemaor
+    OBJECT_TYPE: The type of the monitored object. Can be one of the following: schema or
       table.
     OBJECT_ID: The UUID of the request object. It is schema_id for schema, and
       table_id for table.
@@ -307,6 +324,8 @@ func newCreateRefresh() *cobra.Command {
       [table_id]: https://docs.databricks.com/api/workspace/tables/get#table_id`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -368,8 +387,10 @@ func newDeleteMonitor() *cobra.Command {
 	var deleteMonitorReq dataquality.DeleteMonitorRequest
 
 	cmd.Use = "delete-monitor OBJECT_TYPE OBJECT_ID"
-	cmd.Short = `Delete a monitor.`
-	cmd.Long = `Delete a monitor.
+	cmd.Short = `*Public Preview* Delete a monitor.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Delete a monitor.
 
   Delete a data quality monitor on Unity Catalog object.
 
@@ -407,6 +428,8 @@ func newDeleteMonitor() *cobra.Command {
       [table_id]: https://docs.databricks.com/api/workspace/tables/get#table_id`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -455,8 +478,10 @@ func newDeleteRefresh() *cobra.Command {
 	var deleteRefreshReq dataquality.DeleteRefreshRequest
 
 	cmd.Use = "delete-refresh OBJECT_TYPE OBJECT_ID REFRESH_ID"
-	cmd.Short = `Delete a refresh.`
-	cmd.Long = `Delete a refresh.
+	cmd.Short = `*Public Preview* Delete a refresh.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Delete a refresh.
 
   (Unimplemented) Delete a refresh
 
@@ -480,6 +505,8 @@ func newDeleteRefresh() *cobra.Command {
     REFRESH_ID: Unique id of the refresh operation.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(3)
@@ -532,8 +559,10 @@ func newGetMonitor() *cobra.Command {
 	var getMonitorReq dataquality.GetMonitorRequest
 
 	cmd.Use = "get-monitor OBJECT_TYPE OBJECT_ID"
-	cmd.Short = `Read a monitor.`
-	cmd.Long = `Read a monitor.
+	cmd.Short = `*Public Preview* Read a monitor.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Read a monitor.
 
   Read a data quality monitor on a Unity Catalog object.
 
@@ -573,6 +602,8 @@ func newGetMonitor() *cobra.Command {
       [table_id]: https://docs.databricks.com/api/workspace/tables/get#table_id`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -622,8 +653,10 @@ func newGetRefresh() *cobra.Command {
 	var getRefreshReq dataquality.GetRefreshRequest
 
 	cmd.Use = "get-refresh OBJECT_TYPE OBJECT_ID REFRESH_ID"
-	cmd.Short = `Get a refresh.`
-	cmd.Long = `Get a refresh.
+	cmd.Short = `*Public Preview* Get a refresh.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get a refresh.
 
   Get data quality monitor refresh. The call must be made in the same workspace
   as where the monitor was created.
@@ -660,6 +693,8 @@ func newGetRefresh() *cobra.Command {
     REFRESH_ID: Unique id of the refresh operation.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(3)
@@ -726,12 +761,16 @@ func newListMonitor() *cobra.Command {
 	cmd.Flags().Lookup("page-token").Hidden = true
 
 	cmd.Use = "list-monitor"
-	cmd.Short = `List monitors.`
-	cmd.Long = `List monitors.
+	cmd.Short = `*Public Preview* List monitors.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+List monitors.
 
   (Unimplemented) List data quality monitors.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -794,8 +833,10 @@ func newListRefresh() *cobra.Command {
 	cmd.Flags().Lookup("page-token").Hidden = true
 
 	cmd.Use = "list-refresh OBJECT_TYPE OBJECT_ID"
-	cmd.Short = `List refreshes.`
-	cmd.Long = `List refreshes.
+	cmd.Short = `*Public Preview* List refreshes.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+List refreshes.
 
   List data quality monitor refreshes. The call must be made in the same
   workspace as where the monitor was created.
@@ -831,6 +872,8 @@ func newListRefresh() *cobra.Command {
       [table_id]: https://docs.databricks.com/api/workspace/tables/get#table_id`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -890,8 +933,10 @@ func newUpdateMonitor() *cobra.Command {
 	// TODO: complex arg: data_profiling_config
 
 	cmd.Use = "update-monitor OBJECT_TYPE OBJECT_ID UPDATE_MASK OBJECT_TYPE OBJECT_ID"
-	cmd.Short = `Update a monitor.`
-	cmd.Long = `Update a monitor.
+	cmd.Short = `*Public Preview* Update a monitor.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Update a monitor.
 
   Update a data quality monitor on Unity Catalog object.
 
@@ -945,12 +990,14 @@ func newUpdateMonitor() *cobra.Command {
       [table_id]: https://docs.databricks.com/api/workspace/tables/get#table_id`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(3)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only OBJECT_TYPE, OBJECT_ID, UPDATE_MASK as positional arguments. Provide 'object_type', 'object_id' in your JSON input")
+				return errors.New("when --json flag is specified, provide only OBJECT_TYPE, OBJECT_ID, UPDATE_MASK as positional arguments. Provide 'object_type', 'object_id' in your JSON input")
 			}
 			return nil
 		}
@@ -1024,8 +1071,10 @@ func newUpdateRefresh() *cobra.Command {
 	cmd.Flags().Var(&updateRefreshJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Use = "update-refresh OBJECT_TYPE OBJECT_ID REFRESH_ID UPDATE_MASK OBJECT_TYPE OBJECT_ID"
-	cmd.Short = `Update a refresh.`
-	cmd.Long = `Update a refresh.
+	cmd.Short = `*Public Preview* Update a refresh.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Update a refresh.
 
   (Unimplemented) Update a refresh
 
@@ -1048,7 +1097,7 @@ func newUpdateRefresh() *cobra.Command {
       [table_id]: https://docs.databricks.com/api/workspace/tables/get#table_id
     REFRESH_ID: Unique id of the refresh operation.
     UPDATE_MASK: The field mask to specify which fields to update.
-    OBJECT_TYPE: The type of the monitored object. Can be one of the following: schemaor
+    OBJECT_TYPE: The type of the monitored object. Can be one of the following: schema or
       table.
     OBJECT_ID: The UUID of the request object. It is schema_id for schema, and
       table_id for table.
@@ -1066,12 +1115,14 @@ func newUpdateRefresh() *cobra.Command {
       [table_id]: https://docs.databricks.com/api/workspace/tables/get#table_id`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(4)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only OBJECT_TYPE, OBJECT_ID, REFRESH_ID, UPDATE_MASK as positional arguments. Provide 'object_type', 'object_id' in your JSON input")
+				return errors.New("when --json flag is specified, provide only OBJECT_TYPE, OBJECT_ID, REFRESH_ID, UPDATE_MASK as positional arguments. Provide 'object_type', 'object_id' in your JSON input")
 			}
 			return nil
 		}
diff --git a/cmd/workspace/data-sources/data-sources.go b/cmd/workspace/data-sources/data-sources.go
old mode 100755
new mode 100644
index 637522c1126..33bee7f17bf
--- a/cmd/workspace/data-sources/data-sources.go
+++ b/cmd/workspace/data-sources/data-sources.go
@@ -36,6 +36,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newList())
 
@@ -72,6 +76,8 @@ func newList() *cobra.Command {
   [Learn more]: https://docs.databricks.com/en/sql/dbsql-api-latest.html`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
diff --git a/cmd/workspace/database/database.go b/cmd/workspace/database/database.go
old mode 100755
new mode 100644
index b2476255bb0..af4e28dbc03
--- a/cmd/workspace/database/database.go
+++ b/cmd/workspace/database/database.go
@@ -3,6 +3,7 @@
 package database
 
 import (
+	"errors"
 	"fmt"
 	"time"
 
@@ -20,13 +21,19 @@ var cmdOverrides []func(*cobra.Command)
 
 func New() *cobra.Command {
 	cmd := &cobra.Command{
-		Use:     "database",
-		Short:   `Database Instances provide access to a database via REST API or direct SQL.`,
-		Long:    `Database Instances provide access to a database via REST API or direct SQL.`,
+		Use:   "database",
+		Short: `*Public Preview* Database Instances provide access to a database via REST API or direct SQL.`,
+		Long: `This command is in Public Preview and may change without notice.
+
+Database Instances provide access to a database via REST API or direct SQL.`,
 		GroupID: "database",
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
 	// Add methods
 	cmd.AddCommand(newCreateDatabaseCatalog())
 	cmd.AddCommand(newCreateDatabaseInstance())
@@ -82,21 +89,25 @@ func newCreateDatabaseCatalog() *cobra.Command {
 	cmd.Flags().BoolVar(&createDatabaseCatalogReq.Catalog.CreateDatabaseIfNotExists, "create-database-if-not-exists", createDatabaseCatalogReq.Catalog.CreateDatabaseIfNotExists, ``)
 
 	cmd.Use = "create-database-catalog NAME DATABASE_INSTANCE_NAME DATABASE_NAME"
-	cmd.Short = `Create a Database Catalog.`
-	cmd.Long = `Create a Database Catalog.
+	cmd.Short = `*Public Preview* Create a Database Catalog.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Create a Database Catalog.
 
   Arguments:
     NAME: The name of the catalog in UC.
     DATABASE_INSTANCE_NAME: The name of the DatabaseInstance housing the database.
-    DATABASE_NAME: The name of the database (in a instance) associated with the catalog.`
+    DATABASE_NAME: The name of the database (in an instance) associated with the catalog.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'database_instance_name', 'database_name' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'database_instance_name', 'database_name' in your JSON input")
 			}
 			return nil
 		}
@@ -188,19 +199,23 @@ func newCreateDatabaseInstance() *cobra.Command {
 	cmd.Flags().StringVar(&createDatabaseInstanceReq.DatabaseInstance.UsagePolicyId, "usage-policy-id", createDatabaseInstanceReq.DatabaseInstance.UsagePolicyId, `The desired usage policy to associate with the instance.`)
 
 	cmd.Use = "create-database-instance NAME"
-	cmd.Short = `Create a Database Instance.`
-	cmd.Long = `Create a Database Instance.
+	cmd.Short = `*Public Preview* Create a Database Instance.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Create a Database Instance.
 
   Arguments:
     NAME: The name of the instance. This is the unique identifier for the instance.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name' in your JSON input")
 			}
 			return nil
 		}
@@ -299,12 +314,14 @@ func newCreateDatabaseInstanceRole() *cobra.Command {
 	cmd.Hidden = true
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(1)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only INSTANCE_NAME as positional arguments. Provide 'name' in your JSON input")
+				return errors.New("when --json flag is specified, provide only INSTANCE_NAME as positional arguments. Provide 'name' in your JSON input")
 			}
 			return nil
 		}
@@ -376,8 +393,10 @@ func newCreateDatabaseTable() *cobra.Command {
 	cmd.Flags().StringVar(&createDatabaseTableReq.Table.LogicalDatabaseName, "logical-database-name", createDatabaseTableReq.Table.LogicalDatabaseName, `Target Postgres database object (logical database) name for this table.`)
 
 	cmd.Use = "create-database-table NAME"
-	cmd.Short = `Create a Database Table.`
-	cmd.Long = `Create a Database Table.
+	cmd.Short = `*Public Preview* Create a Database Table.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Create a Database Table.
 
   Create a Database Table. Useful for registering pre-existing PG tables in UC.
   See CreateSyncedDatabaseTable for creating synced tables in PG from a source
@@ -387,12 +406,14 @@ func newCreateDatabaseTable() *cobra.Command {
     NAME: Full three-part (catalog, schema, table) name of the table.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name' in your JSON input")
 			}
 			return nil
 		}
@@ -465,19 +486,23 @@ func newCreateSyncedDatabaseTable() *cobra.Command {
 	// TODO: complex arg: spec
 
 	cmd.Use = "create-synced-database-table NAME"
-	cmd.Short = `Create a Synced Database Table.`
-	cmd.Long = `Create a Synced Database Table.
+	cmd.Short = `*Public Preview* Create a Synced Database Table.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Create a Synced Database Table.
 
   Arguments:
     NAME: Full three-part (catalog, schema, table) name of the table.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name' in your JSON input")
 			}
 			return nil
 		}
@@ -541,10 +566,14 @@ func newDeleteDatabaseCatalog() *cobra.Command {
 	var deleteDatabaseCatalogReq database.DeleteDatabaseCatalogRequest
 
 	cmd.Use = "delete-database-catalog NAME"
-	cmd.Short = `Delete a Database Catalog.`
-	cmd.Long = `Delete a Database Catalog.`
+	cmd.Short = `*Public Preview* Delete a Database Catalog.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Delete a Database Catalog.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -591,17 +620,21 @@ func newDeleteDatabaseInstance() *cobra.Command {
 
 	var deleteDatabaseInstanceReq database.DeleteDatabaseInstanceRequest
 
-	cmd.Flags().BoolVar(&deleteDatabaseInstanceReq.Force, "force", deleteDatabaseInstanceReq.Force, `By default, a instance cannot be deleted if it has descendant instances created via PITR.`)
+	cmd.Flags().BoolVar(&deleteDatabaseInstanceReq.Force, "force", deleteDatabaseInstanceReq.Force, `By default, an instance cannot be deleted if it has descendant instances created via PITR.`)
 	cmd.Flags().BoolVar(&deleteDatabaseInstanceReq.Purge, "purge", deleteDatabaseInstanceReq.Purge, `Deprecated.`)
 
 	cmd.Use = "delete-database-instance NAME"
-	cmd.Short = `Delete a Database Instance.`
-	cmd.Long = `Delete a Database Instance.
+	cmd.Short = `*Public Preview* Delete a Database Instance.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Delete a Database Instance.
 
   Arguments:
     NAME: Name of the instance to delete.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -661,6 +694,8 @@ func newDeleteDatabaseInstanceRole() *cobra.Command {
 	cmd.Hidden = true
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -709,10 +744,14 @@ func newDeleteDatabaseTable() *cobra.Command {
 	var deleteDatabaseTableReq database.DeleteDatabaseTableRequest
 
 	cmd.Use = "delete-database-table NAME"
-	cmd.Short = `Delete a Database Table.`
-	cmd.Long = `Delete a Database Table.`
+	cmd.Short = `*Public Preview* Delete a Database Table.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Delete a Database Table.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -762,10 +801,14 @@ func newDeleteSyncedDatabaseTable() *cobra.Command {
 	cmd.Flags().BoolVar(&deleteSyncedDatabaseTableReq.PurgeData, "purge-data", deleteSyncedDatabaseTableReq.PurgeData, `Optional.`)
 
 	cmd.Use = "delete-synced-database-table NAME"
-	cmd.Short = `Delete a Synced Database Table.`
-	cmd.Long = `Delete a Synced Database Table.`
+	cmd.Short = `*Public Preview* Delete a Synced Database Table.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Delete a Synced Database Table.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -815,10 +858,14 @@ func newFindDatabaseInstanceByUid() *cobra.Command {
 	cmd.Flags().StringVar(&findDatabaseInstanceByUidReq.Uid, "uid", findDatabaseInstanceByUidReq.Uid, `UID of the cluster to get.`)
 
 	cmd.Use = "find-database-instance-by-uid"
-	cmd.Short = `Find a Database Instance by uid.`
-	cmd.Long = `Find a Database Instance by uid.`
+	cmd.Short = `*Public Preview* Find a Database Instance by uid.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Find a Database Instance by uid.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -872,10 +919,14 @@ func newGenerateDatabaseCredential() *cobra.Command {
 	cmd.Flags().StringVar(&generateDatabaseCredentialReq.RequestId, "request-id", generateDatabaseCredentialReq.RequestId, ``)
 
 	cmd.Use = "generate-database-credential"
-	cmd.Short = `Generates a credential that can be used to access database instances.`
-	cmd.Long = `Generates a credential that can be used to access database instances.`
+	cmd.Short = `*Public Preview* Generates a credential that can be used to access database instances.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Generates a credential that can be used to access database instances.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -935,10 +986,14 @@ func newGetDatabaseCatalog() *cobra.Command {
 	var getDatabaseCatalogReq database.GetDatabaseCatalogRequest
 
 	cmd.Use = "get-database-catalog NAME"
-	cmd.Short = `Get a Database Catalog.`
-	cmd.Long = `Get a Database Catalog.`
+	cmd.Short = `*Public Preview* Get a Database Catalog.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get a Database Catalog.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -987,13 +1042,17 @@ func newGetDatabaseInstance() *cobra.Command {
 	var getDatabaseInstanceReq database.GetDatabaseInstanceRequest
 
 	cmd.Use = "get-database-instance NAME"
-	cmd.Short = `Get a Database Instance.`
-	cmd.Long = `Get a Database Instance.
+	cmd.Short = `*Public Preview* Get a Database Instance.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get a Database Instance.
 
   Arguments:
     NAME: Name of the cluster to get.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1051,6 +1110,8 @@ func newGetDatabaseInstanceRole() *cobra.Command {
 	cmd.Hidden = true
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -1100,10 +1161,14 @@ func newGetDatabaseTable() *cobra.Command {
 	var getDatabaseTableReq database.GetDatabaseTableRequest
 
 	cmd.Use = "get-database-table NAME"
-	cmd.Short = `Get a Database Table.`
-	cmd.Long = `Get a Database Table.`
+	cmd.Short = `*Public Preview* Get a Database Table.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get a Database Table.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1152,10 +1217,14 @@ func newGetSyncedDatabaseTable() *cobra.Command {
 	var getSyncedDatabaseTableReq database.GetSyncedDatabaseTableRequest
 
 	cmd.Use = "get-synced-database-table NAME"
-	cmd.Short = `Get a Synced Database Table.`
-	cmd.Long = `Get a Synced Database Table.`
+	cmd.Short = `*Public Preview* Get a Synced Database Table.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get a Synced Database Table.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1229,6 +1298,8 @@ func newListDatabaseCatalogs() *cobra.Command {
 	cmd.Hidden = true
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1306,6 +1377,8 @@ func newListDatabaseInstanceRoles() *cobra.Command {
 	cmd.Hidden = true
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1370,10 +1443,14 @@ func newListDatabaseInstances() *cobra.Command {
 	cmd.Flags().Lookup("page-token").Hidden = true
 
 	cmd.Use = "list-database-instances"
-	cmd.Short = `List Database Instances.`
-	cmd.Long = `List Database Instances.`
+	cmd.Short = `*Public Preview* List Database Instances.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+List Database Instances.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -1439,7 +1516,7 @@ func newListSyncedDatabaseTables() *cobra.Command {
 	cmd.Short = `List all synced database tables in a Database Instance.`
 	cmd.Long = `List all synced database tables in a Database Instance.
 
-  This API is currently unimplemented, but exposed for Terraform support.
+  List synced database tables in a Database Instance.
 
   Arguments:
     INSTANCE_NAME: Name of the instance to get synced tables for.`
@@ -1448,6 +1525,8 @@ func newListSyncedDatabaseTables() *cobra.Command {
 	cmd.Hidden = true
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1514,18 +1593,20 @@ func newUpdateDatabaseCatalog() *cobra.Command {
     NAME: The name of the catalog in UC.
     UPDATE_MASK: The list of fields to update. Setting this field is not yet supported.
     DATABASE_INSTANCE_NAME: The name of the DatabaseInstance housing the database.
-    DATABASE_NAME: The name of the database (in a instance) associated with the catalog.`
+    DATABASE_NAME: The name of the database (in an instance) associated with the catalog.`
 
 	// This command is being previewed; hide from help output.
 	cmd.Hidden = true
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(2)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only NAME, UPDATE_MASK as positional arguments. Provide 'name', 'database_instance_name', 'database_name' in your JSON input")
+				return errors.New("when --json flag is specified, provide only NAME, UPDATE_MASK as positional arguments. Provide 'name', 'database_instance_name', 'database_name' in your JSON input")
 			}
 			return nil
 		}
@@ -1610,8 +1691,10 @@ func newUpdateDatabaseInstance() *cobra.Command {
 	cmd.Flags().StringVar(&updateDatabaseInstanceReq.DatabaseInstance.UsagePolicyId, "usage-policy-id", updateDatabaseInstanceReq.DatabaseInstance.UsagePolicyId, `The desired usage policy to associate with the instance.`)
 
 	cmd.Use = "update-database-instance NAME UPDATE_MASK"
-	cmd.Short = `Update a Database Instance.`
-	cmd.Long = `Update a Database Instance.
+	cmd.Short = `*Public Preview* Update a Database Instance.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Update a Database Instance.
 
   Arguments:
     NAME: The name of the instance. This is the unique identifier for the instance.
@@ -1620,6 +1703,8 @@ func newUpdateDatabaseInstance() *cobra.Command {
       update_mask with an empty custom_tags map.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -1703,6 +1788,8 @@ func newUpdateSyncedDatabaseTable() *cobra.Command {
 	cmd.Hidden = true
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
diff --git a/cmd/workspace/default-namespace/default-namespace.go b/cmd/workspace/default-namespace/default-namespace.go
old mode 100755
new mode 100644
index 5ec635652f2..c0ebe0ed600
--- a/cmd/workspace/default-namespace/default-namespace.go
+++ b/cmd/workspace/default-namespace/default-namespace.go
@@ -3,7 +3,7 @@
 package default_namespace
 
 import (
-	"fmt"
+	"errors"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
@@ -20,8 +20,10 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "default-namespace",
-		Short: `The default namespace setting API allows users to configure the default namespace for a Databricks workspace.`,
-		Long: `The default namespace setting API allows users to configure the default
+		Short: `*Public Preview* The default namespace setting API allows users to configure the default namespace for a Databricks workspace.`,
+		Long: `This command is in Public Preview and may change without notice.
+
+The default namespace setting API allows users to configure the default
   namespace for a Databricks workspace.
 
   Through this API, users can retrieve, set, or modify the default namespace
@@ -36,6 +38,10 @@ func New() *cobra.Command {
 		RunE: root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
 	// Add methods
 	cmd.AddCommand(newDelete())
 	cmd.AddCommand(newGet())
@@ -66,8 +72,10 @@ func newDelete() *cobra.Command {
 	cmd.Flags().StringVar(&deleteReq.Etag, "etag", deleteReq.Etag, `etag used for versioning.`)
 
 	cmd.Use = "delete"
-	cmd.Short = `Delete the default namespace setting.`
-	cmd.Long = `Delete the default namespace setting.
+	cmd.Short = `*Public Preview* Delete the default namespace setting.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Delete the default namespace setting.
 
   Deletes the default namespace setting for the workspace. A fresh etag needs to
   be provided in DELETE requests (as a query parameter). The etag can be
@@ -76,6 +84,8 @@ func newDelete() *cobra.Command {
   request must be retried by using the fresh etag in the 409 response.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -124,12 +134,16 @@ func newGet() *cobra.Command {
 	cmd.Flags().StringVar(&getReq.Etag, "etag", getReq.Etag, `etag used for versioning.`)
 
 	cmd.Use = "get"
-	cmd.Short = `Get the default namespace setting.`
-	cmd.Long = `Get the default namespace setting.
+	cmd.Short = `*Public Preview* Get the default namespace setting.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get the default namespace setting.
 
   Gets the default namespace setting.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -179,8 +193,10 @@ func newUpdate() *cobra.Command {
 	cmd.Flags().Var(&updateJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Use = "update"
-	cmd.Short = `Update the default namespace setting.`
-	cmd.Long = `Update the default namespace setting.
+	cmd.Short = `*Public Preview* Update the default namespace setting.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Update the default namespace setting.
 
   Updates the default namespace setting for the workspace. A fresh etag needs to
   be provided in PATCH requests (as part of the setting field). The etag can
@@ -191,6 +207,8 @@ func newUpdate() *cobra.Command {
   must be retried by using the fresh etag in the 409 response.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -209,7 +227,7 @@ func newUpdate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := w.Settings.DefaultNamespace().Update(ctx, updateReq)
diff --git a/cmd/workspace/default-warehouse-id/default-warehouse-id.go b/cmd/workspace/default-warehouse-id/default-warehouse-id.go
old mode 100755
new mode 100644
index 1b9a61e41ff..491ac6b972c
--- a/cmd/workspace/default-warehouse-id/default-warehouse-id.go
+++ b/cmd/workspace/default-warehouse-id/default-warehouse-id.go
@@ -3,7 +3,7 @@
 package default_warehouse_id
 
 import (
-	"fmt"
+	"errors"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
@@ -29,6 +29,10 @@ func New() *cobra.Command {
 		RunE:   root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
 	// Add methods
 	cmd.AddCommand(newDelete())
 	cmd.AddCommand(newGet())
@@ -65,6 +69,8 @@ func newDelete() *cobra.Command {
   Reverts the Default Warehouse Id setting to its default value.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -119,6 +125,8 @@ func newGet() *cobra.Command {
   Gets the Default Warehouse Id setting.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -174,6 +182,8 @@ func newUpdate() *cobra.Command {
   Updates the Default Warehouse Id setting.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -192,7 +202,7 @@ func newUpdate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := w.Settings.DefaultWarehouseId().Update(ctx, updateReq)
diff --git a/cmd/workspace/disable-legacy-access/disable-legacy-access.go b/cmd/workspace/disable-legacy-access/disable-legacy-access.go
old mode 100755
new mode 100644
index 317546ea068..5a4c9639605
--- a/cmd/workspace/disable-legacy-access/disable-legacy-access.go
+++ b/cmd/workspace/disable-legacy-access/disable-legacy-access.go
@@ -3,7 +3,7 @@
 package disable_legacy_access
 
 import (
-	"fmt"
+	"errors"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
@@ -30,6 +30,10 @@ func New() *cobra.Command {
 		RunE: root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newDelete())
 	cmd.AddCommand(newGet())
@@ -66,6 +70,8 @@ func newDelete() *cobra.Command {
   Deletes legacy access disablement status.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -120,6 +126,8 @@ func newGet() *cobra.Command {
   Retrieves legacy access disablement Status.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -175,6 +183,8 @@ func newUpdate() *cobra.Command {
   Updates legacy access disablement status.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -193,7 +203,7 @@ func newUpdate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := w.Settings.DisableLegacyAccess().Update(ctx, updateReq)
diff --git a/cmd/workspace/disable-legacy-dbfs/disable-legacy-dbfs.go b/cmd/workspace/disable-legacy-dbfs/disable-legacy-dbfs.go
old mode 100755
new mode 100644
index 5630444ee17..b624e1bffa8
--- a/cmd/workspace/disable-legacy-dbfs/disable-legacy-dbfs.go
+++ b/cmd/workspace/disable-legacy-dbfs/disable-legacy-dbfs.go
@@ -3,7 +3,7 @@
 package disable_legacy_dbfs
 
 import (
-	"fmt"
+	"errors"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
@@ -33,6 +33,10 @@ func New() *cobra.Command {
 		RunE: root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newDelete())
 	cmd.AddCommand(newGet())
@@ -70,6 +74,8 @@ func newDelete() *cobra.Command {
   default.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -124,6 +130,8 @@ func newGet() *cobra.Command {
   Gets the disable legacy DBFS setting.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -179,6 +187,8 @@ func newUpdate() *cobra.Command {
   Updates the disable legacy DBFS setting for the workspace.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -197,7 +207,7 @@ func newUpdate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := w.Settings.DisableLegacyDbfs().Update(ctx, updateReq)
diff --git a/cmd/workspace/domains/domains.go b/cmd/workspace/domains/domains.go
new file mode 100644
index 00000000000..5c4b670cb32
--- /dev/null
+++ b/cmd/workspace/domains/domains.go
@@ -0,0 +1,469 @@
+// Code generated from OpenAPI specs by Databricks SDK Generator. DO NOT EDIT.
+
+package domains
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/databricks-sdk-go/common/types/fieldmask"
+	"github.com/databricks/databricks-sdk-go/service/domains"
+	"github.com/spf13/cobra"
+)
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var cmdOverrides []func(*cobra.Command)
+
+func New() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "domains",
+		Short: `*Beta* Manage domains for organizing and discovering data assets.`,
+		Long: `This command is in Beta and may change without notice.
+
+Manage domains for organizing and discovering data assets.`,
+		GroupID: "domains",
+		RunE:    root.ReportUnknownSubcommand,
+	}
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	// Add methods
+	cmd.AddCommand(newCreateDomain())
+	cmd.AddCommand(newDeleteDomain())
+	cmd.AddCommand(newGetDomain())
+	cmd.AddCommand(newListDomains())
+	cmd.AddCommand(newUpdateDomain())
+
+	// Apply optional overrides to this command.
+	for _, fn := range cmdOverrides {
+		fn(cmd)
+	}
+
+	return cmd
+}
+
+// start create-domain command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var createDomainOverrides []func(
+	*cobra.Command,
+	*domains.CreateDomainRequest,
+)
+
+func newCreateDomain() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var createDomainReq domains.CreateDomainRequest
+	createDomainReq.Domain = domains.Domain{}
+	var createDomainJson flags.JsonFlag
+
+	cmd.Flags().Var(&createDomainJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&createDomainReq.DomainId, "domain-id", createDomainReq.DomainId, `Client-supplied resource ID for the new domain.`)
+	// TODO: array: business_owner_ids
+	cmd.Flags().StringVar(&createDomainReq.Domain.Description, "description", createDomainReq.Domain.Description, `Full description (max 4096 chars).`)
+	cmd.Flags().BoolVar(&createDomainReq.Domain.Draft, "draft", createDomainReq.Domain.Draft, `Whether to mark the domain as a draft.`)
+	// TODO: complex arg: icon
+	cmd.Flags().StringVar(&createDomainReq.Domain.Name, "name", createDomainReq.Domain.Name, `Full resource name of the domain.`)
+	cmd.Flags().StringVar(&createDomainReq.Domain.ParentDomainId, "parent-domain-id", createDomainReq.Domain.ParentDomainId, `Domain ID of the parent.`)
+	cmd.Flags().StringVar(&createDomainReq.Domain.Subtitle, "subtitle", createDomainReq.Domain.Subtitle, `Short description (max 280 chars).`)
+	// TODO: array: technical_owner_ids
+
+	cmd.Use = "create-domain TAG_KEY"
+	cmd.Short = `*Beta* Create a domain.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Create a domain.
+
+  Create a domain. If domain_id is omitted, the server generates one.
+
+  Arguments:
+    TAG_KEY: Governed tag key associated with this domain.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(0)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'tag_key' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := createDomainJson.Unmarshal(&createDomainReq.Domain)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		if !cmd.Flags().Changed("json") {
+			createDomainReq.Domain.TagKey = args[0]
+		}
+
+		response, err := w.Domains.CreateDomain(ctx, createDomainReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range createDomainOverrides {
+		fn(cmd, &createDomainReq)
+	}
+
+	return cmd
+}
+
+// start delete-domain command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteDomainOverrides []func(
+	*cobra.Command,
+	*domains.DeleteDomainRequest,
+)
+
+func newDeleteDomain() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteDomainReq domains.DeleteDomainRequest
+
+	cmd.Flags().BoolVar(&deleteDomainReq.Force, "force", deleteDomainReq.Force, `When false (default), DeleteDomain is rejected with FAILED_PRECONDITION if the domain still has Glossary pages.`)
+
+	cmd.Use = "delete-domain NAME"
+	cmd.Short = `*Beta* Delete a domain.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Delete a domain.
+
+  Delete a domain. By default the request fails if the domain still has Glossary
+  pages; set force to delete those pages along with the domain.
+
+  Arguments:
+    NAME: Full resource name of the domain to delete. Format: domains/{domain_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		deleteDomainReq.Name = args[0]
+
+		err = w.Domains.DeleteDomain(ctx, deleteDomainReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteDomainOverrides {
+		fn(cmd, &deleteDomainReq)
+	}
+
+	return cmd
+}
+
+// start get-domain command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getDomainOverrides []func(
+	*cobra.Command,
+	*domains.GetDomainRequest,
+)
+
+func newGetDomain() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getDomainReq domains.GetDomainRequest
+
+	cmd.Use = "get-domain NAME"
+	cmd.Short = `*Beta* Get a domain.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get a domain.
+
+  Get a domain by resource name.
+
+  Authorization: external callers must have the MANAGE DISCOVER permission.
+
+  Arguments:
+    NAME: Full resource name of the domain to retrieve. Format:
+      domains/{domain_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getDomainReq.Name = args[0]
+
+		response, err := w.Domains.GetDomain(ctx, getDomainReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getDomainOverrides {
+		fn(cmd, &getDomainReq)
+	}
+
+	return cmd
+}
+
+// start list-domains command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listDomainsOverrides []func(
+	*cobra.Command,
+	*domains.ListDomainsRequest,
+)
+
+func newListDomains() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listDomainsReq domains.ListDomainsRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listDomainsLimit int
+
+	cmd.Flags().IntVar(&listDomainsReq.PageSize, "page-size", listDomainsReq.PageSize, ``)
+	cmd.Flags().StringVar(&listDomainsReq.ParentDomainId, "parent-domain-id", listDomainsReq.ParentDomainId, `Filter by parent domain.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listDomainsLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listDomainsReq.PageToken, "page-token", listDomainsReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-domains"
+	cmd.Short = `*Beta* List domains.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+List domains.
+
+  List domains in the account. Set parent_domain_id to return only the direct
+  subdomains of a given domain.
+
+  Authorization: external callers must have the MANAGE DISCOVER permission;
+  only domains the caller is authorized to read are returned.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(0)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		response := w.Domains.ListDomains(ctx, listDomainsReq)
+		if listDomainsLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listDomainsLimit)
+		}
+		if listDomainsLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listDomainsLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listDomainsOverrides {
+		fn(cmd, &listDomainsReq)
+	}
+
+	return cmd
+}
+
+// start update-domain command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateDomainOverrides []func(
+	*cobra.Command,
+	*domains.UpdateDomainRequest,
+)
+
+func newUpdateDomain() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateDomainReq domains.UpdateDomainRequest
+	updateDomainReq.Domain = domains.Domain{}
+	var updateDomainJson flags.JsonFlag
+
+	cmd.Flags().Var(&updateDomainJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: business_owner_ids
+	cmd.Flags().StringVar(&updateDomainReq.Domain.Description, "description", updateDomainReq.Domain.Description, `Full description (max 4096 chars).`)
+	cmd.Flags().BoolVar(&updateDomainReq.Domain.Draft, "draft", updateDomainReq.Domain.Draft, `Whether to mark the domain as a draft.`)
+	// TODO: complex arg: icon
+	cmd.Flags().StringVar(&updateDomainReq.Domain.Name, "name", updateDomainReq.Domain.Name, `Full resource name of the domain.`)
+	cmd.Flags().StringVar(&updateDomainReq.Domain.ParentDomainId, "parent-domain-id", updateDomainReq.Domain.ParentDomainId, `Domain ID of the parent.`)
+	cmd.Flags().StringVar(&updateDomainReq.Domain.Subtitle, "subtitle", updateDomainReq.Domain.Subtitle, `Short description (max 280 chars).`)
+	// TODO: array: technical_owner_ids
+
+	cmd.Use = "update-domain NAME UPDATE_MASK TAG_KEY"
+	cmd.Short = `*Beta* Update a domain.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Update a domain.
+
+  Update a domain. update_mask selects which fields to modify; the domain is
+  identified by its resource name.
+
+  Arguments:
+    NAME: Full resource name of the domain. The primary identifier for this
+      resource. Format: domains/{domain_id} Identifies the domain on get,
+      update, and delete. Not an input on create — to choose the id, set
+      CreateDomainRequest.domain_id.
+    UPDATE_MASK: The field mask must be a single string, with multiple fields separated by
+      commas (no spaces). The field path is relative to the resource object,
+      using a dot (.) to navigate sub-fields (e.g., author.given_name).
+      Specification of elements in sequence or map fields is not allowed, as
+      only the entire collection field can be specified. Field names must
+      exactly match the resource field names.
+
+      A field mask of * indicates full replacement. It’s recommended to
+      always explicitly list the fields being updated and avoid using *
+      wildcards, as it can lead to unintended results if the API changes in the
+      future.
+    TAG_KEY: Governed tag key associated with this domain.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(2)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only NAME, UPDATE_MASK as positional arguments. Provide 'tag_key' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(3)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updateDomainJson.Unmarshal(&updateDomainReq.Domain)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		updateDomainReq.Name = args[0]
+		if args[1] != "" {
+			updateMaskArray := strings.Split(args[1], ",")
+			updateDomainReq.UpdateMask = *fieldmask.New(updateMaskArray)
+		}
+		if !cmd.Flags().Changed("json") {
+			updateDomainReq.Domain.TagKey = args[2]
+		}
+
+		response, err := w.Domains.UpdateDomain(ctx, updateDomainReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateDomainOverrides {
+		fn(cmd, &updateDomainReq)
+	}
+
+	return cmd
+}
+
+// end service Domains
diff --git a/cmd/workspace/enable-export-notebook/enable-export-notebook.go b/cmd/workspace/enable-export-notebook/enable-export-notebook.go
old mode 100755
new mode 100644
index c9670c88034..234e724440d
--- a/cmd/workspace/enable-export-notebook/enable-export-notebook.go
+++ b/cmd/workspace/enable-export-notebook/enable-export-notebook.go
@@ -3,7 +3,7 @@
 package enable_export_notebook
 
 import (
-	"fmt"
+	"errors"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
@@ -20,12 +20,18 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "enable-export-notebook",
-		Short: `Controls whether users can export notebooks and files from the Workspace UI.`,
-		Long: `Controls whether users can export notebooks and files from the Workspace UI.
+		Short: `*Public Preview* Controls whether users can export notebooks and files from the Workspace UI.`,
+		Long: `This command is in Public Preview and may change without notice.
+
+Controls whether users can export notebooks and files from the Workspace UI.
   By default, this setting is enabled.`,
 		RunE: root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
 	// Add methods
 	cmd.AddCommand(newGetEnableExportNotebook())
 	cmd.AddCommand(newPatchEnableExportNotebook())
@@ -50,12 +56,16 @@ func newGetEnableExportNotebook() *cobra.Command {
 	cmd := &cobra.Command{}
 
 	cmd.Use = "get-enable-export-notebook"
-	cmd.Short = `Get the Notebook and File exporting setting.`
-	cmd.Long = `Get the Notebook and File exporting setting.
+	cmd.Short = `*Public Preview* Get the Notebook and File exporting setting.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get the Notebook and File exporting setting.
 
   Gets the Notebook and File exporting setting.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -99,14 +109,18 @@ func newPatchEnableExportNotebook() *cobra.Command {
 	cmd.Flags().Var(&patchEnableExportNotebookJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Use = "patch-enable-export-notebook"
-	cmd.Short = `Update the Notebook and File exporting setting.`
-	cmd.Long = `Update the Notebook and File exporting setting.
+	cmd.Short = `*Public Preview* Update the Notebook and File exporting setting.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Update the Notebook and File exporting setting.
 
   Updates the Notebook and File exporting setting. The model follows eventual
   consistency, which means the get after the update operation might receive
   stale values for some time.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -125,7 +139,7 @@ func newPatchEnableExportNotebook() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := w.Settings.EnableExportNotebook().PatchEnableExportNotebook(ctx, patchEnableExportNotebookReq)
diff --git a/cmd/workspace/enable-notebook-table-clipboard/enable-notebook-table-clipboard.go b/cmd/workspace/enable-notebook-table-clipboard/enable-notebook-table-clipboard.go
old mode 100755
new mode 100644
index 0ec3f7135fd..48e11680f9f
--- a/cmd/workspace/enable-notebook-table-clipboard/enable-notebook-table-clipboard.go
+++ b/cmd/workspace/enable-notebook-table-clipboard/enable-notebook-table-clipboard.go
@@ -3,7 +3,7 @@
 package enable_notebook_table_clipboard
 
 import (
-	"fmt"
+	"errors"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
@@ -20,12 +20,18 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "enable-notebook-table-clipboard",
-		Short: `Controls whether users can copy tabular data to the clipboard via the UI.`,
-		Long: `Controls whether users can copy tabular data to the clipboard via the UI. By
+		Short: `*Public Preview* Controls whether users can copy tabular data to the clipboard via the UI.`,
+		Long: `This command is in Public Preview and may change without notice.
+
+Controls whether users can copy tabular data to the clipboard via the UI. By
   default, this setting is enabled.`,
 		RunE: root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
 	// Add methods
 	cmd.AddCommand(newGetEnableNotebookTableClipboard())
 	cmd.AddCommand(newPatchEnableNotebookTableClipboard())
@@ -50,12 +56,16 @@ func newGetEnableNotebookTableClipboard() *cobra.Command {
 	cmd := &cobra.Command{}
 
 	cmd.Use = "get-enable-notebook-table-clipboard"
-	cmd.Short = `Get the Results Table Clipboard features setting.`
-	cmd.Long = `Get the Results Table Clipboard features setting.
+	cmd.Short = `*Public Preview* Get the Results Table Clipboard features setting.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get the Results Table Clipboard features setting.
 
   Gets the Results Table Clipboard features setting.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -99,14 +109,18 @@ func newPatchEnableNotebookTableClipboard() *cobra.Command {
 	cmd.Flags().Var(&patchEnableNotebookTableClipboardJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Use = "patch-enable-notebook-table-clipboard"
-	cmd.Short = `Update the Results Table Clipboard features setting.`
-	cmd.Long = `Update the Results Table Clipboard features setting.
+	cmd.Short = `*Public Preview* Update the Results Table Clipboard features setting.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Update the Results Table Clipboard features setting.
 
   Updates the Results Table Clipboard features setting. The model follows
   eventual consistency, which means the get after the update operation might
   receive stale values for some time.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -125,7 +139,7 @@ func newPatchEnableNotebookTableClipboard() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := w.Settings.EnableNotebookTableClipboard().PatchEnableNotebookTableClipboard(ctx, patchEnableNotebookTableClipboardReq)
diff --git a/cmd/workspace/enable-results-downloading/enable-results-downloading.go b/cmd/workspace/enable-results-downloading/enable-results-downloading.go
old mode 100755
new mode 100644
index efec5fecf82..9d417344d76
--- a/cmd/workspace/enable-results-downloading/enable-results-downloading.go
+++ b/cmd/workspace/enable-results-downloading/enable-results-downloading.go
@@ -3,7 +3,7 @@
 package enable_results_downloading
 
 import (
-	"fmt"
+	"errors"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
@@ -20,12 +20,18 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "enable-results-downloading",
-		Short: `Controls whether users can download notebook results.`,
-		Long: `Controls whether users can download notebook results. By default, this setting
+		Short: `*Public Preview* Controls whether users can download notebook results.`,
+		Long: `This command is in Public Preview and may change without notice.
+
+Controls whether users can download notebook results. By default, this setting
   is enabled.`,
 		RunE: root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
 	// Add methods
 	cmd.AddCommand(newGetEnableResultsDownloading())
 	cmd.AddCommand(newPatchEnableResultsDownloading())
@@ -50,12 +56,16 @@ func newGetEnableResultsDownloading() *cobra.Command {
 	cmd := &cobra.Command{}
 
 	cmd.Use = "get-enable-results-downloading"
-	cmd.Short = `Get the Notebook results download setting.`
-	cmd.Long = `Get the Notebook results download setting.
+	cmd.Short = `*Public Preview* Get the Notebook results download setting.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get the Notebook results download setting.
 
   Gets the Notebook results download setting.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -99,14 +109,18 @@ func newPatchEnableResultsDownloading() *cobra.Command {
 	cmd.Flags().Var(&patchEnableResultsDownloadingJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Use = "patch-enable-results-downloading"
-	cmd.Short = `Update the Notebook results download setting.`
-	cmd.Long = `Update the Notebook results download setting.
+	cmd.Short = `*Public Preview* Update the Notebook results download setting.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Update the Notebook results download setting.
 
   Updates the Notebook results download setting. The model follows eventual
   consistency, which means the get after the update operation might receive
   stale values for some time.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -125,7 +139,7 @@ func newPatchEnableResultsDownloading() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := w.Settings.EnableResultsDownloading().PatchEnableResultsDownloading(ctx, patchEnableResultsDownloadingReq)
diff --git a/cmd/workspace/enhanced-security-monitoring/enhanced-security-monitoring.go b/cmd/workspace/enhanced-security-monitoring/enhanced-security-monitoring.go
old mode 100755
new mode 100644
index 7582c7f363e..ee5eb69c722
--- a/cmd/workspace/enhanced-security-monitoring/enhanced-security-monitoring.go
+++ b/cmd/workspace/enhanced-security-monitoring/enhanced-security-monitoring.go
@@ -3,7 +3,7 @@
 package enhanced_security_monitoring
 
 import (
-	"fmt"
+	"errors"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
@@ -20,8 +20,10 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "enhanced-security-monitoring",
-		Short: `Controls whether enhanced security monitoring is enabled for the current workspace.`,
-		Long: `Controls whether enhanced security monitoring is enabled for the current
+		Short: `*Public Preview* Controls whether enhanced security monitoring is enabled for the current workspace.`,
+		Long: `This command is in Public Preview and may change without notice.
+
+Controls whether enhanced security monitoring is enabled for the current
   workspace. If the compliance security profile is enabled, this is
   automatically enabled. By default, it is disabled. However, if the compliance
   security profile is enabled, this is automatically enabled.
@@ -31,6 +33,10 @@ func New() *cobra.Command {
 		RunE: root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
 	// Add methods
 	cmd.AddCommand(newGet())
 	cmd.AddCommand(newUpdate())
@@ -60,12 +66,16 @@ func newGet() *cobra.Command {
 	cmd.Flags().StringVar(&getReq.Etag, "etag", getReq.Etag, `etag used for versioning.`)
 
 	cmd.Use = "get"
-	cmd.Short = `Get the enhanced security monitoring setting.`
-	cmd.Long = `Get the enhanced security monitoring setting.
+	cmd.Short = `*Public Preview* Get the enhanced security monitoring setting.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get the enhanced security monitoring setting.
 
   Gets the enhanced security monitoring setting.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -115,8 +125,10 @@ func newUpdate() *cobra.Command {
 	cmd.Flags().Var(&updateJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Use = "update"
-	cmd.Short = `Update the enhanced security monitoring setting.`
-	cmd.Long = `Update the enhanced security monitoring setting.
+	cmd.Short = `*Public Preview* Update the enhanced security monitoring setting.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Update the enhanced security monitoring setting.
 
   Updates the enhanced security monitoring setting for the workspace. A fresh
   etag needs to be provided in PATCH requests (as part of the setting field).
@@ -125,6 +137,8 @@ func newUpdate() *cobra.Command {
   the request must be retried by using the fresh etag in the 409 response.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -143,7 +157,7 @@ func newUpdate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := w.Settings.EnhancedSecurityMonitoring().Update(ctx, updateReq)
diff --git a/cmd/workspace/entity-tag-assignments/entity-tag-assignments.go b/cmd/workspace/entity-tag-assignments/entity-tag-assignments.go
old mode 100755
new mode 100644
index b29ac06da3b..d7caf1bbab7
--- a/cmd/workspace/entity-tag-assignments/entity-tag-assignments.go
+++ b/cmd/workspace/entity-tag-assignments/entity-tag-assignments.go
@@ -3,6 +3,7 @@
 package entity_tag_assignments
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -22,14 +23,18 @@ func New() *cobra.Command {
 		Use:   "entity-tag-assignments",
 		Short: `Tags are attributes that include keys and optional values that you can use to organize and categorize entities in Unity Catalog.`,
 		Long: `Tags are attributes that include keys and optional values that you can use to
-  organize and categorize entities in Unity Catalog. Entity tagging is currently
-  supported on catalogs, schemas, tables (including views), columns, volumes.
-  With these APIs, users can create, update, delete, and list tag assignments
-  across Unity Catalog entities`,
+  organize and categorize entities in Unity Catalog. Entity tagging is supported
+  on catalogs, schemas, tables (including views), columns, and volumes. With
+  these APIs, you can create, update, delete, and list tag assignments across
+  Unity Catalog entities.`,
 		GroupID: "catalog",
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -87,12 +92,14 @@ func newCreate() *cobra.Command {
     ENTITY_TYPE: The type of the entity to which the tag is assigned.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'entity_name', 'tag_key', 'entity_type' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'entity_name', 'tag_key', 'entity_type' in your JSON input")
 			}
 			return nil
 		}
@@ -183,6 +190,8 @@ func newDelete() *cobra.Command {
     TAG_KEY: Required. The key of the tag to delete`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(3)
@@ -243,6 +252,8 @@ func newGet() *cobra.Command {
     TAG_KEY: Required. The key of the tag`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(3)
@@ -321,6 +332,8 @@ func newList() *cobra.Command {
     ENTITY_NAME: The fully qualified name of the entity to which the tag is assigned`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -411,6 +424,8 @@ func newUpdate() *cobra.Command {
       future.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(4)
diff --git a/cmd/workspace/environments/environments.go b/cmd/workspace/environments/environments.go
old mode 100755
new mode 100644
index 385467dffd4..a11d550a52d
--- a/cmd/workspace/environments/environments.go
+++ b/cmd/workspace/environments/environments.go
@@ -3,6 +3,7 @@
 package environments
 
 import (
+	"errors"
 	"fmt"
 	"strings"
 	"time"
@@ -35,6 +36,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreateWorkspaceBaseEnvironment())
 	cmd.AddCommand(newDeleteWorkspaceBaseEnvironment())
@@ -83,6 +88,7 @@ func newCreateWorkspaceBaseEnvironment() *cobra.Command {
 	cmd.Flags().Var(&createWorkspaceBaseEnvironmentReq.WorkspaceBaseEnvironment.BaseEnvironmentType, "base-environment-type", `The type of base environment (CPU or GPU). Supported values: [CPU, GPU]`)
 	cmd.Flags().StringVar(&createWorkspaceBaseEnvironmentReq.WorkspaceBaseEnvironment.Filepath, "filepath", createWorkspaceBaseEnvironmentReq.WorkspaceBaseEnvironment.Filepath, `The WSFS or UC Volumes path to the environment YAML file.`)
 	cmd.Flags().StringVar(&createWorkspaceBaseEnvironmentReq.WorkspaceBaseEnvironment.Name, "name", createWorkspaceBaseEnvironmentReq.WorkspaceBaseEnvironment.Name, `The resource name of the workspace base environment.`)
+	// TODO: complex arg: spec
 
 	cmd.Use = "create-workspace-base-environment DISPLAY_NAME"
 	cmd.Short = `Create a workspace base environment.`
@@ -102,12 +108,14 @@ func newCreateWorkspaceBaseEnvironment() *cobra.Command {
     DISPLAY_NAME: Human-readable display name for the workspace base environment.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'display_name' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'display_name' in your JSON input")
 			}
 			return nil
 		}
@@ -213,6 +221,8 @@ func newDeleteWorkspaceBaseEnvironment() *cobra.Command {
       Format: workspace-base-environments/{workspace_base_environment}`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -272,6 +282,8 @@ func newGetDefaultWorkspaceBaseEnvironment() *cobra.Command {
       default-workspace-base-environment`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -330,6 +342,8 @@ func newGetOperation() *cobra.Command {
     NAME: The name of the operation resource.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -388,6 +402,8 @@ func newGetWorkspaceBaseEnvironment() *cobra.Command {
       Format: workspace-base-environments/{workspace_base_environment}`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -452,9 +468,23 @@ func newListWorkspaceBaseEnvironments() *cobra.Command {
 	cmd.Short = `List workspace base environments.`
 	cmd.Long = `List workspace base environments.
 
-  Lists all WorkspaceBaseEnvironments in the workspace.`
+  Lists all WorkspaceBaseEnvironments in the workspace.
+
+  Databricks provides the following base environments:
+
+  - workspace-base-environments/databricks_ai_...: includes popular AI and
+  deep learning packages for serverless GPU compute.
+
+  - workspace-base-environments/databricks_ml_...: includes popular ML
+  packages for serverless compute.
+
+  Databricks-provided base environments are versioned. For example,
+  workspace-base-environments/databricks_ml_v5 corresponds to the ML
+  environment built on environment version 5.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -529,6 +559,8 @@ func newRefreshWorkspaceBaseEnvironment() *cobra.Command {
       Format: workspace-base-environments/{workspace_base_environment}`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -635,6 +667,8 @@ func newUpdateDefaultWorkspaceBaseEnvironment() *cobra.Command {
       explicitly — the wildcard '*' cannot be used to unset fields.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -711,6 +745,7 @@ func newUpdateWorkspaceBaseEnvironment() *cobra.Command {
 	cmd.Flags().Var(&updateWorkspaceBaseEnvironmentReq.WorkspaceBaseEnvironment.BaseEnvironmentType, "base-environment-type", `The type of base environment (CPU or GPU). Supported values: [CPU, GPU]`)
 	cmd.Flags().StringVar(&updateWorkspaceBaseEnvironmentReq.WorkspaceBaseEnvironment.Filepath, "filepath", updateWorkspaceBaseEnvironmentReq.WorkspaceBaseEnvironment.Filepath, `The WSFS or UC Volumes path to the environment YAML file.`)
 	cmd.Flags().StringVar(&updateWorkspaceBaseEnvironmentReq.WorkspaceBaseEnvironment.Name, "name", updateWorkspaceBaseEnvironmentReq.WorkspaceBaseEnvironment.Name, `The resource name of the workspace base environment.`)
+	// TODO: complex arg: spec
 
 	cmd.Use = "update-workspace-base-environment NAME DISPLAY_NAME"
 	cmd.Short = `Update a workspace base environment.`
@@ -732,12 +767,14 @@ func newUpdateWorkspaceBaseEnvironment() *cobra.Command {
     DISPLAY_NAME: Human-readable display name for the workspace base environment.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(1)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only NAME as positional arguments. Provide 'display_name' in your JSON input")
+				return errors.New("when --json flag is specified, provide only NAME as positional arguments. Provide 'display_name' in your JSON input")
 			}
 			return nil
 		}
diff --git a/cmd/workspace/environments/overrides.go b/cmd/workspace/environments/overrides.go
new file mode 100644
index 00000000000..39864abceaf
--- /dev/null
+++ b/cmd/workspace/environments/overrides.go
@@ -0,0 +1,19 @@
+package environments
+
+import (
+	environmentsCli "github.com/databricks/cli/cmd/environments"
+	"github.com/spf13/cobra"
+)
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		// Attach the hand-written local-provisioning commands (e.g. setup-local)
+		// to the auto-generated "environments" group. The group intentionally
+		// spans server-side environment-resource APIs and local provisioning, so
+		// a local-install verb belongs here (spec §naming). This mirrors how
+		// cmd/apps extends the generated apps group.
+		for _, c := range environmentsCli.Commands() {
+			cmd.AddCommand(c)
+		}
+	})
+}
diff --git a/cmd/workspace/experiments/experiments.go b/cmd/workspace/experiments/experiments.go
old mode 100755
new mode 100644
index 5f24b7e95bf..c2f5d936b19
--- a/cmd/workspace/experiments/experiments.go
+++ b/cmd/workspace/experiments/experiments.go
@@ -3,12 +3,17 @@
 package experiments
 
 import (
+	"encoding/json"
+	"errors"
 	"fmt"
+	"strings"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/databricks-sdk-go/common/types/fieldmask"
+	sdktime "github.com/databricks/databricks-sdk-go/common/types/time"
 	"github.com/databricks/databricks-sdk-go/service/ml"
 	"github.com/spf13/cobra"
 )
@@ -34,8 +39,13 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreateExperiment())
+	cmd.AddCommand(newCreateIssue())
 	cmd.AddCommand(newCreateLoggedModel())
 	cmd.AddCommand(newCreateRun())
 	cmd.AddCommand(newDeleteExperiment())
@@ -48,6 +58,7 @@ func New() *cobra.Command {
 	cmd.AddCommand(newGetByName())
 	cmd.AddCommand(newGetExperiment())
 	cmd.AddCommand(newGetHistory())
+	cmd.AddCommand(newGetIssue())
 	cmd.AddCommand(newGetLoggedModel())
 	cmd.AddCommand(newGetPermissionLevels())
 	cmd.AddCommand(newGetPermissions())
@@ -65,6 +76,7 @@ func New() *cobra.Command {
 	cmd.AddCommand(newRestoreRun())
 	cmd.AddCommand(newRestoreRuns())
 	cmd.AddCommand(newSearchExperiments())
+	cmd.AddCommand(newSearchIssues())
 	cmd.AddCommand(newSearchLoggedModels())
 	cmd.AddCommand(newSearchRuns())
 	cmd.AddCommand(newSetExperimentTag())
@@ -72,6 +84,7 @@ func New() *cobra.Command {
 	cmd.AddCommand(newSetPermissions())
 	cmd.AddCommand(newSetTag())
 	cmd.AddCommand(newUpdateExperiment())
+	cmd.AddCommand(newUpdateIssue())
 	cmd.AddCommand(newUpdatePermissions())
 	cmd.AddCommand(newUpdateRun())
 
@@ -102,6 +115,7 @@ func newCreateExperiment() *cobra.Command {
 
 	cmd.Flags().StringVar(&createExperimentReq.ArtifactLocation, "artifact-location", createExperimentReq.ArtifactLocation, `Location where all artifacts for the experiment are stored.`)
 	// TODO: array: tags
+	// TODO: complex arg: trace_location
 
 	cmd.Use = "create-experiment NAME"
 	cmd.Short = `Create experiment.`
@@ -113,17 +127,21 @@ func newCreateExperiment() *cobra.Command {
   exists.
 
   Throws RESOURCE_ALREADY_EXISTS if an experiment with the given name exists.
+  Note: In some contexts, this error may be remapped to ALREADY_EXISTS. To be
+  safe, clients should check for both error codes.
 
   Arguments:
     NAME: Experiment name.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name' in your JSON input")
 			}
 			return nil
 		}
@@ -172,6 +190,126 @@ func newCreateExperiment() *cobra.Command {
 	return cmd
 }
 
+// start create-issue command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var createIssueOverrides []func(
+	*cobra.Command,
+	*ml.CreateIssueRequest,
+)
+
+func newCreateIssue() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var createIssueReq ml.CreateIssueRequest
+	createIssueReq.Issue = ml.Issue{}
+	var createIssueJson flags.JsonFlag
+
+	cmd.Flags().Var(&createIssueJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&createIssueReq.IssueId, "issue-id", createIssueReq.IssueId, `Optional client-chosen ID: iss- followed by 32 lowercase hex digits.`)
+	// TODO: array: categories
+	cmd.Flags().StringVar(&createIssueReq.Issue.Description, "description", createIssueReq.Issue.Description, `Markdown, at most 32 KiB.`)
+	var lastSeenTimeParam string
+	cmd.Flags().StringVar(&lastSeenTimeParam, "last-seen-time", lastSeenTimeParam, `The request time of the latest trace the Issue affects.`)
+	// TODO: map via StringToStringVar: metadata
+	cmd.Flags().StringVar(&createIssueReq.Issue.Name, "name", createIssueReq.Issue.Name, `experiments/{experiment}/issues/{issue}.`)
+	cmd.Flags().StringVar(&createIssueReq.Issue.SourceId, "source-id", createIssueReq.Issue.SourceId, `Set once at create.`)
+	cmd.Flags().Var(&createIssueReq.Issue.SourceType, "source-type", `Set once at create. Supported values: [ADHOC_RUN, MANUAL, SCHEDULED_RUN, SINGLE_TRACE_ANALYSIS]`)
+	cmd.Flags().Var(&createIssueReq.Issue.Status, "status", `Defaults to PENDING on create, and can't be cleared. Supported values: [PENDING, REJECTED, RESOLVED]`)
+	// TODO: map via StringToStringVar: tags
+
+	cmd.Use = "create-issue PARENT TITLE SEVERITY"
+	cmd.Short = `*Beta* Create an issue.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Create an issue.
+
+  Creates an issue in an experiment.
+
+  Arguments:
+    PARENT: experiments/{experiment}
+    TITLE: Non-empty, at most 250 UTF-8 bytes.
+    SEVERITY: Cannot be cleared: an Issue without a severity would match no severity
+      filter.
+      Supported values: [HIGH, LOW, MEDIUM]`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(1)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only PARENT as positional arguments. Provide 'title', 'severity' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(3)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := createIssueJson.Unmarshal(&createIssueReq.Issue)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		createIssueReq.Parent = args[0]
+		if !cmd.Flags().Changed("json") {
+			createIssueReq.Issue.Title = args[1]
+		}
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[2], &createIssueReq.Issue.Severity)
+			if err != nil {
+				return fmt.Errorf("invalid SEVERITY: %s", args[2])
+			}
+
+		}
+
+		if lastSeenTimeParam != "" {
+			lastSeenTimeBytes := []byte(fmt.Sprintf("\"%s\"", lastSeenTimeParam))
+			var lastSeenTimeField sdktime.Time
+			err = json.Unmarshal(lastSeenTimeBytes, &lastSeenTimeField)
+			if err != nil {
+				return fmt.Errorf("invalid LAST_SEEN_TIME: %s", lastSeenTimeParam)
+			}
+			createIssueReq.Issue.LastSeenTime = &lastSeenTimeField
+		}
+
+		response, err := w.Experiments.CreateIssue(ctx, createIssueReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range createIssueOverrides {
+		fn(cmd, &createIssueReq)
+	}
+
+	return cmd
+}
+
 // start create-logged-model command
 
 // Slice with functions to override default command behavior.
@@ -203,12 +341,14 @@ func newCreateLoggedModel() *cobra.Command {
     EXPERIMENT_ID: The ID of the experiment that owns the model.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'experiment_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'experiment_id' in your JSON input")
 			}
 			return nil
 		}
@@ -290,6 +430,8 @@ func newCreateRun() *cobra.Command {
   execution.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -363,12 +505,14 @@ func newDeleteExperiment() *cobra.Command {
     EXPERIMENT_ID: ID of the associated experiment.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'experiment_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'experiment_id' in your JSON input")
 			}
 			return nil
 		}
@@ -438,6 +582,8 @@ func newDeleteLoggedModel() *cobra.Command {
     MODEL_ID: The ID of the logged model to delete.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -493,6 +639,8 @@ func newDeleteLoggedModelTag() *cobra.Command {
     TAG_KEY: The tag key.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -553,12 +701,14 @@ func newDeleteRun() *cobra.Command {
     RUN_ID: ID of the run to delete.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'run_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'run_id' in your JSON input")
 			}
 			return nil
 		}
@@ -630,8 +780,8 @@ func newDeleteRuns() *cobra.Command {
 	cmd.Long = `Delete runs by creation time.
 
   Bulk delete runs in an experiment that were created prior to or at the
-  specified timestamp. Deletes at most max_runs per request. To call this API
-  from a Databricks Notebook in Python, you can use the client code snippet on
+  specified timestamp. Deletes at most max_runs per request. See the
+  cloud-specific MLflow runs documentation for a Python client example.
 
   Arguments:
     EXPERIMENT_ID: The ID of the experiment containing the runs to delete.
@@ -640,12 +790,14 @@ func newDeleteRuns() *cobra.Command {
       deleted.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'experiment_id', 'max_timestamp_millis' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'experiment_id', 'max_timestamp_millis' in your JSON input")
 			}
 			return nil
 		}
@@ -730,12 +882,14 @@ func newDeleteTag() *cobra.Command {
     KEY: Name of the tag. Maximum size is 255 bytes. Must be provided.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'run_id', 'key' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'run_id', 'key' in your JSON input")
 			}
 			return nil
 		}
@@ -815,12 +969,14 @@ func newFinalizeLoggedModel() *cobra.Command {
       Supported values: [LOGGED_MODEL_PENDING, LOGGED_MODEL_READY, LOGGED_MODEL_UPLOAD_FAILED]`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(1)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only MODEL_ID as positional arguments. Provide 'status' in your JSON input")
+				return errors.New("when --json flag is specified, provide only MODEL_ID as positional arguments. Provide 'status' in your JSON input")
 			}
 			return nil
 		}
@@ -906,6 +1062,8 @@ func newGetByName() *cobra.Command {
     EXPERIMENT_NAME: Name of the associated experiment.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -963,6 +1121,8 @@ func newGetExperiment() *cobra.Command {
     EXPERIMENT_ID: ID of the associated experiment.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1035,6 +1195,8 @@ func newGetHistory() *cobra.Command {
     METRIC_KEY: Name of the metric.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1071,6 +1233,67 @@ func newGetHistory() *cobra.Command {
 	return cmd
 }
 
+// start get-issue command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getIssueOverrides []func(
+	*cobra.Command,
+	*ml.GetIssueRequest,
+)
+
+func newGetIssue() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getIssueReq ml.GetIssueRequest
+
+	cmd.Use = "get-issue NAME"
+	cmd.Short = `*Beta* Get an issue.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get an issue.
+
+  Gets an issue.
+
+  Arguments:
+    NAME: experiments/{experiment}/issues/{issue}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getIssueReq.Name = args[0]
+
+		response, err := w.Experiments.GetIssue(ctx, getIssueReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getIssueOverrides {
+		fn(cmd, &getIssueReq)
+	}
+
+	return cmd
+}
+
 // start get-logged-model command
 
 // Slice with functions to override default command behavior.
@@ -1093,6 +1316,8 @@ func newGetLoggedModel() *cobra.Command {
     MODEL_ID: The ID of the logged model to retrieve.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1150,6 +1375,8 @@ func newGetPermissionLevels() *cobra.Command {
     EXPERIMENT_ID: The experiment for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1208,6 +1435,8 @@ func newGetPermissions() *cobra.Command {
     EXPERIMENT_ID: The experiment for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1272,6 +1501,8 @@ func newGetRun() *cobra.Command {
     RUN_ID: ID of the run to fetch. Must be provided.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1346,6 +1577,8 @@ func newListArtifacts() *cobra.Command {
   API](/api/workspace/files/listdirectorycontents).`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -1415,6 +1648,8 @@ func newListExperiments() *cobra.Command {
   Gets a list of all experiments.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -1520,6 +1755,8 @@ func newLogBatch() *cobra.Command {
   * Parameter and tag values can be up to 250 characters in length`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -1593,12 +1830,14 @@ func newLogInputs() *cobra.Command {
     RUN_ID: ID of the run to log under`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'run_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'run_id' in your JSON input")
 			}
 			return nil
 		}
@@ -1678,6 +1917,8 @@ func newLogLoggedModelParams() *cobra.Command {
     MODEL_ID: The ID of the logged model to log params for.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1760,12 +2001,14 @@ func newLogMetric() *cobra.Command {
     TIMESTAMP: Unix timestamp in milliseconds at the time metric was logged.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'key', 'value', 'timestamp' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'key', 'value', 'timestamp' in your JSON input")
 			}
 			return nil
 		}
@@ -1858,6 +2101,8 @@ func newLogModel() *cobra.Command {
   Log a model to an MLflow Run.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -1930,12 +2175,14 @@ func newLogOutputs() *cobra.Command {
     RUN_ID: The ID of the Run from which to log outputs.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'run_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'run_id' in your JSON input")
 			}
 			return nil
 		}
@@ -2017,12 +2264,14 @@ func newLogParam() *cobra.Command {
     VALUE: String value of the param being logged. Maximum size is 500 bytes.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'key', 'value' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'key', 'value' in your JSON input")
 			}
 			return nil
 		}
@@ -2105,12 +2354,14 @@ func newRestoreExperiment() *cobra.Command {
     EXPERIMENT_ID: ID of the associated experiment.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'experiment_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'experiment_id' in your JSON input")
 			}
 			return nil
 		}
@@ -2189,12 +2440,14 @@ func newRestoreRun() *cobra.Command {
     RUN_ID: ID of the run to restore.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'run_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'run_id' in your JSON input")
 			}
 			return nil
 		}
@@ -2266,8 +2519,8 @@ func newRestoreRuns() *cobra.Command {
 	cmd.Long = `Restore runs by deletion time.
 
   Bulk restore runs in an experiment that were deleted no earlier than the
-  specified timestamp. Restores at most max_runs per request. To call this API
-  from a Databricks Notebook in Python, you can use the client code snippet on
+  specified timestamp. Restores at most max_runs per request. See the
+  cloud-specific MLflow runs documentation for a Python client example.
 
   Arguments:
     EXPERIMENT_ID: The ID of the experiment containing the runs to restore.
@@ -2276,12 +2529,14 @@ func newRestoreRuns() *cobra.Command {
       restored.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'experiment_id', 'min_timestamp_millis' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'experiment_id', 'min_timestamp_millis' in your JSON input")
 			}
 			return nil
 		}
@@ -2377,6 +2632,8 @@ func newSearchExperiments() *cobra.Command {
   Searches for experiments that satisfy specified search criteria.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -2424,6 +2681,106 @@ func newSearchExperiments() *cobra.Command {
 	return cmd
 }
 
+// start search-issues command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var searchIssuesOverrides []func(
+	*cobra.Command,
+	*ml.SearchIssuesRequest,
+)
+
+func newSearchIssues() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var searchIssuesReq ml.SearchIssuesRequest
+	var searchIssuesJson flags.JsonFlag
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var searchIssuesLimit int
+
+	cmd.Flags().Var(&searchIssuesJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: categories
+	cmd.Flags().IntVar(&searchIssuesReq.PageSize, "page-size", searchIssuesReq.PageSize, `Defaults to 20; values above 100 are clamped.`)
+	cmd.Flags().StringVar(&searchIssuesReq.Query, "query", searchIssuesReq.Query, `Case-insensitive substring match on title.`)
+	// TODO: array: severities
+	cmd.Flags().Var(&searchIssuesReq.SortKey, "sort-key", `Defaults to SEVERITY. Supported values: [CREATE_TIME, LAST_SEEN_TIME, SEVERITY, UPDATE_TIME]`)
+	cmd.Flags().Var(&searchIssuesReq.SortOrder, "sort-order", `Defaults to DESCENDING. Supported values: [ASCENDING, DESCENDING]`)
+	// TODO: array: statuses
+	// TODO: array: tag_filters
+	cmd.Flags().Var(&searchIssuesReq.View, "view", `Defaults to BASIC. Supported values: [BASIC, FULL]`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&searchIssuesLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&searchIssuesReq.PageToken, "page-token", searchIssuesReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "search-issues PARENT"
+	cmd.Short = `*Beta* Search issues in an experiment.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Search issues in an experiment.
+
+  Searches the issues in an experiment, filtered and sorted.
+
+  Arguments:
+    PARENT: experiments/{experiment}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := searchIssuesJson.Unmarshal(&searchIssuesReq)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		searchIssuesReq.Parent = args[0]
+
+		response := w.Experiments.SearchIssues(ctx, searchIssuesReq)
+		if searchIssuesLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", searchIssuesLimit)
+		}
+		if searchIssuesLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, searchIssuesLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range searchIssuesOverrides {
+		fn(cmd, &searchIssuesReq)
+	}
+
+	return cmd
+}
+
 // start search-logged-models command
 
 // Slice with functions to override default command behavior.
@@ -2455,6 +2812,8 @@ func newSearchLoggedModels() *cobra.Command {
   Search for Logged Models that satisfy specified search criteria.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -2542,6 +2901,8 @@ func newSearchRuns() *cobra.Command {
   Search expressions can use mlflowMetric and mlflowParam keys.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -2619,12 +2980,14 @@ func newSetExperimentTag() *cobra.Command {
       supported.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'experiment_id', 'key', 'value' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'experiment_id', 'key', 'value' in your JSON input")
 			}
 			return nil
 		}
@@ -2705,6 +3068,8 @@ func newSetLoggedModelTags() *cobra.Command {
     MODEL_ID: The ID of the logged model to set the tags on.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -2780,6 +3145,8 @@ func newSetPermissions() *cobra.Command {
     EXPERIMENT_ID: The experiment for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -2858,12 +3225,14 @@ func newSetTag() *cobra.Command {
       supported.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'key', 'value' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'key', 'value' in your JSON input")
 			}
 			return nil
 		}
@@ -2943,12 +3312,14 @@ func newUpdateExperiment() *cobra.Command {
     EXPERIMENT_ID: ID of the associated experiment.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'experiment_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'experiment_id' in your JSON input")
 			}
 			return nil
 		}
@@ -2996,6 +3367,137 @@ func newUpdateExperiment() *cobra.Command {
 	return cmd
 }
 
+// start update-issue command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateIssueOverrides []func(
+	*cobra.Command,
+	*ml.UpdateIssueRequest,
+)
+
+func newUpdateIssue() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateIssueReq ml.UpdateIssueRequest
+	updateIssueReq.Issue = ml.Issue{}
+	var updateIssueJson flags.JsonFlag
+
+	cmd.Flags().Var(&updateIssueJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: categories
+	cmd.Flags().StringVar(&updateIssueReq.Issue.Description, "description", updateIssueReq.Issue.Description, `Markdown, at most 32 KiB.`)
+	var lastSeenTimeParam string
+	cmd.Flags().StringVar(&lastSeenTimeParam, "last-seen-time", lastSeenTimeParam, `The request time of the latest trace the Issue affects.`)
+	// TODO: map via StringToStringVar: metadata
+	cmd.Flags().StringVar(&updateIssueReq.Issue.Name, "name", updateIssueReq.Issue.Name, `experiments/{experiment}/issues/{issue}.`)
+	cmd.Flags().StringVar(&updateIssueReq.Issue.SourceId, "source-id", updateIssueReq.Issue.SourceId, `Set once at create.`)
+	cmd.Flags().Var(&updateIssueReq.Issue.SourceType, "source-type", `Set once at create. Supported values: [ADHOC_RUN, MANUAL, SCHEDULED_RUN, SINGLE_TRACE_ANALYSIS]`)
+	cmd.Flags().Var(&updateIssueReq.Issue.Status, "status", `Defaults to PENDING on create, and can't be cleared. Supported values: [PENDING, REJECTED, RESOLVED]`)
+	// TODO: map via StringToStringVar: tags
+
+	cmd.Use = "update-issue NAME UPDATE_MASK TITLE SEVERITY"
+	cmd.Short = `*Beta* Update an issue.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Update an issue.
+
+  Updates the fields of an issue named in update_mask.
+
+  Arguments:
+    NAME: experiments/{experiment}/issues/{issue}
+    UPDATE_MASK: Accepts title, description, status, severity, categories, tags,
+      last_seen_time, and metadata.<key>. A path with an empty value clears the
+      field, except that title, status, and severity can't be cleared, and
+      last_seen_time can be cleared only when source_type is MANUAL. categories
+      and tags are replaced whole. metadata is updated per key: a metadata.<key>
+      path sets that key from issue.metadata, or removes it when issue.metadata
+      lacks it, and leaves the other keys alone. A bare metadata path is
+      rejected.
+    TITLE: Non-empty, at most 250 UTF-8 bytes.
+    SEVERITY: Cannot be cleared: an Issue without a severity would match no severity
+      filter.
+      Supported values: [HIGH, LOW, MEDIUM]`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(2)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only NAME, UPDATE_MASK as positional arguments. Provide 'title', 'severity' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(4)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updateIssueJson.Unmarshal(&updateIssueReq.Issue)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		updateIssueReq.Name = args[0]
+		if args[1] != "" {
+			updateMaskArray := strings.Split(args[1], ",")
+			updateIssueReq.UpdateMask = *fieldmask.New(updateMaskArray)
+		}
+		if !cmd.Flags().Changed("json") {
+			updateIssueReq.Issue.Title = args[2]
+		}
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[3], &updateIssueReq.Issue.Severity)
+			if err != nil {
+				return fmt.Errorf("invalid SEVERITY: %s", args[3])
+			}
+
+		}
+
+		if lastSeenTimeParam != "" {
+			lastSeenTimeBytes := []byte(fmt.Sprintf("\"%s\"", lastSeenTimeParam))
+			var lastSeenTimeField sdktime.Time
+			err = json.Unmarshal(lastSeenTimeBytes, &lastSeenTimeField)
+			if err != nil {
+				return fmt.Errorf("invalid LAST_SEEN_TIME: %s", lastSeenTimeParam)
+			}
+			updateIssueReq.Issue.LastSeenTime = &lastSeenTimeField
+		}
+
+		response, err := w.Experiments.UpdateIssue(ctx, updateIssueReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateIssueOverrides {
+		fn(cmd, &updateIssueReq)
+	}
+
+	return cmd
+}
+
 // start update-permissions command
 
 // Slice with functions to override default command behavior.
@@ -3026,6 +3528,8 @@ func newUpdatePermissions() *cobra.Command {
     EXPERIMENT_ID: The experiment for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -3101,6 +3605,8 @@ func newUpdateRun() *cobra.Command {
   Updates run metadata.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
diff --git a/cmd/workspace/external-lineage/external-lineage.go b/cmd/workspace/external-lineage/external-lineage.go
old mode 100755
new mode 100644
index 9c871b5defc..7d6cec7c938
--- a/cmd/workspace/external-lineage/external-lineage.go
+++ b/cmd/workspace/external-lineage/external-lineage.go
@@ -3,6 +3,7 @@
 package external_lineage
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -20,8 +21,10 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "external-lineage",
-		Short: `External Lineage APIs enable defining and managing lineage relationships between Databricks objects and external systems.`,
-		Long: `External Lineage APIs enable defining and managing lineage relationships
+		Short: `*Public Preview* External Lineage APIs enable defining and managing lineage relationships between Databricks objects and external systems.`,
+		Long: `This command is in Public Preview and may change without notice.
+
+External Lineage APIs enable defining and managing lineage relationships
   between Databricks objects and external systems. These APIs allow users to
   capture data flows connecting Databricks tables, models, and file paths with
   external metadata objects.
@@ -32,6 +35,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
 	// Add methods
 	cmd.AddCommand(newCreateExternalLineageRelationship())
 	cmd.AddCommand(newDeleteExternalLineageRelationship())
@@ -68,8 +75,10 @@ func newCreateExternalLineageRelationship() *cobra.Command {
 	// TODO: map via StringToStringVar: properties
 
 	cmd.Use = "create-external-lineage-relationship SOURCE TARGET"
-	cmd.Short = `Create an external lineage relationship.`
-	cmd.Long = `Create an external lineage relationship.
+	cmd.Short = `*Public Preview* Create an external lineage relationship.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Create an external lineage relationship.
 
   Creates an external lineage relationship between a Databricks or external
   metadata object and another external metadata object.
@@ -79,12 +88,14 @@ func newCreateExternalLineageRelationship() *cobra.Command {
     TARGET: Target object of the external lineage relationship.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'source', 'target' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'source', 'target' in your JSON input")
 			}
 			return nil
 		}
@@ -162,13 +173,17 @@ func newDeleteExternalLineageRelationship() *cobra.Command {
 	cmd.Flags().Var(&deleteExternalLineageRelationshipJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Use = "delete-external-lineage-relationship"
-	cmd.Short = `Delete an external lineage relationship.`
-	cmd.Long = `Delete an external lineage relationship.
+	cmd.Short = `*Public Preview* Delete an external lineage relationship.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Delete an external lineage relationship.
 
   Deletes an external lineage relationship between a Databricks or external
   metadata object and another external metadata object.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -187,7 +202,7 @@ func newDeleteExternalLineageRelationship() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		err = w.ExternalLineage.DeleteExternalLineageRelationship(ctx, deleteExternalLineageRelationshipReq)
@@ -240,13 +255,17 @@ func newListExternalLineageRelationships() *cobra.Command {
 	cmd.Flags().Lookup("page-token").Hidden = true
 
 	cmd.Use = "list-external-lineage-relationships"
-	cmd.Short = `List external lineage relationships.`
-	cmd.Long = `List external lineage relationships.
+	cmd.Short = `*Public Preview* List external lineage relationships.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+List external lineage relationships.
 
   Lists external lineage relationships of a Databricks object or external
   metadata given a supplied direction.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -265,7 +284,7 @@ func newListExternalLineageRelationships() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response := w.ExternalLineage.ListExternalLineageRelationships(ctx, listExternalLineageRelationshipsReq)
@@ -313,8 +332,10 @@ func newUpdateExternalLineageRelationship() *cobra.Command {
 	// TODO: map via StringToStringVar: properties
 
 	cmd.Use = "update-external-lineage-relationship UPDATE_MASK SOURCE TARGET"
-	cmd.Short = `Update an external lineage relationship.`
-	cmd.Long = `Update an external lineage relationship.
+	cmd.Short = `*Public Preview* Update an external lineage relationship.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Update an external lineage relationship.
 
   Updates an external lineage relationship between a Databricks or external
   metadata object and another external metadata object.
@@ -335,12 +356,14 @@ func newUpdateExternalLineageRelationship() *cobra.Command {
     TARGET: Target object of the external lineage relationship.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(1)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only UPDATE_MASK as positional arguments. Provide 'source', 'target' in your JSON input")
+				return errors.New("when --json flag is specified, provide only UPDATE_MASK as positional arguments. Provide 'source', 'target' in your JSON input")
 			}
 			return nil
 		}
diff --git a/cmd/workspace/external-locations/external-locations.go b/cmd/workspace/external-locations/external-locations.go
old mode 100755
new mode 100644
index cd9c1b2ab0f..edd702cb4ec
--- a/cmd/workspace/external-locations/external-locations.go
+++ b/cmd/workspace/external-locations/external-locations.go
@@ -3,6 +3,7 @@
 package external_locations
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -38,6 +39,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -93,12 +98,14 @@ func newCreate() *cobra.Command {
     CREDENTIAL_NAME: Name of the storage credential used with this location.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'url', 'credential_name' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'url', 'credential_name' in your JSON input")
 			}
 			return nil
 		}
@@ -180,6 +187,8 @@ func newDelete() *cobra.Command {
     NAME: Name of the external location.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -240,6 +249,8 @@ func newGet() *cobra.Command {
     NAME: Name of the external location.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -321,6 +332,8 @@ func newList() *cobra.Command {
   indication that the end of results has been reached.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -399,6 +412,8 @@ func newUpdate() *cobra.Command {
     NAME: Name of the external location.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/workspace/external-metadata/external-metadata.go b/cmd/workspace/external-metadata/external-metadata.go
old mode 100755
new mode 100644
index 79a9c335599..3d8e7dac3db
--- a/cmd/workspace/external-metadata/external-metadata.go
+++ b/cmd/workspace/external-metadata/external-metadata.go
@@ -3,6 +3,7 @@
 package external_metadata
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -20,8 +21,10 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "external-metadata",
-		Short: `External Metadata objects enable customers to register and manage metadata about external systems within Unity Catalog.`,
-		Long: `External Metadata objects enable customers to register and manage metadata
+		Short: `*Public Preview* External Metadata objects enable customers to register and manage metadata about external systems within Unity Catalog.`,
+		Long: `This command is in Public Preview and may change without notice.
+
+External Metadata objects enable customers to register and manage metadata
   about external systems within Unity Catalog.
 
   These APIs provide a standardized way to create, update, retrieve, list, and
@@ -32,6 +35,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
 	// Add methods
 	cmd.AddCommand(newCreateExternalMetadata())
 	cmd.AddCommand(newDeleteExternalMetadata())
@@ -72,8 +79,10 @@ func newCreateExternalMetadata() *cobra.Command {
 	cmd.Flags().StringVar(&createExternalMetadataReq.ExternalMetadata.Url, "url", createExternalMetadataReq.ExternalMetadata.Url, `URL associated with the external metadata object.`)
 
 	cmd.Use = "create-external-metadata NAME SYSTEM_TYPE ENTITY_TYPE"
-	cmd.Short = `Create an external metadata object.`
-	cmd.Long = `Create an external metadata object.
+	cmd.Short = `*Public Preview* Create an external metadata object.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Create an external metadata object.
 
   Creates a new external metadata object in the parent metastore if the caller
   is a metastore admin or has the **CREATE_EXTERNAL_METADATA** privilege. Grants
@@ -110,12 +119,14 @@ func newCreateExternalMetadata() *cobra.Command {
     ENTITY_TYPE: Type of entity within the external system.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'system_type', 'entity_type' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'system_type', 'entity_type' in your JSON input")
 			}
 			return nil
 		}
@@ -189,14 +200,18 @@ func newDeleteExternalMetadata() *cobra.Command {
 	var deleteExternalMetadataReq catalog.DeleteExternalMetadataRequest
 
 	cmd.Use = "delete-external-metadata NAME"
-	cmd.Short = `Delete an external metadata object.`
-	cmd.Long = `Delete an external metadata object.
+	cmd.Short = `*Public Preview* Delete an external metadata object.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Delete an external metadata object.
 
   Deletes the external metadata object that matches the supplied name. The
   caller must be a metastore admin, the owner of the external metadata object,
   or a user that has the **MANAGE** privilege.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -244,14 +259,18 @@ func newGetExternalMetadata() *cobra.Command {
 	var getExternalMetadataReq catalog.GetExternalMetadataRequest
 
 	cmd.Use = "get-external-metadata NAME"
-	cmd.Short = `Get an external metadata object.`
-	cmd.Long = `Get an external metadata object.
+	cmd.Short = `*Public Preview* Get an external metadata object.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get an external metadata object.
 
   Gets the specified external metadata object in a metastore. The caller must be
   a metastore admin, the owner of the external metadata object, or a user that
   has the **BROWSE** privilege.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -313,8 +332,10 @@ func newListExternalMetadata() *cobra.Command {
 	cmd.Flags().Lookup("page-token").Hidden = true
 
 	cmd.Use = "list-external-metadata"
-	cmd.Short = `List external metadata objects.`
-	cmd.Long = `List external metadata objects.
+	cmd.Short = `*Public Preview* List external metadata objects.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+List external metadata objects.
 
   Gets an array of external metadata objects in the metastore. If the caller is
   the metastore admin, all external metadata objects will be retrieved.
@@ -323,6 +344,8 @@ func newListExternalMetadata() *cobra.Command {
   elements in the array.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -382,8 +405,10 @@ func newUpdateExternalMetadata() *cobra.Command {
 	cmd.Flags().StringVar(&updateExternalMetadataReq.ExternalMetadata.Url, "url", updateExternalMetadataReq.ExternalMetadata.Url, `URL associated with the external metadata object.`)
 
 	cmd.Use = "update-external-metadata NAME UPDATE_MASK SYSTEM_TYPE ENTITY_TYPE"
-	cmd.Short = `Update an external metadata object.`
-	cmd.Long = `Update an external metadata object.
+	cmd.Short = `*Public Preview* Update an external metadata object.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Update an external metadata object.
 
   Updates the external metadata object that matches the supplied name. The
   caller can only update either the owner or other metadata fields in one
@@ -433,12 +458,14 @@ func newUpdateExternalMetadata() *cobra.Command {
     ENTITY_TYPE: Type of entity within the external system.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(2)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only NAME, UPDATE_MASK as positional arguments. Provide 'name', 'system_type', 'entity_type' in your JSON input")
+				return errors.New("when --json flag is specified, provide only NAME, UPDATE_MASK as positional arguments. Provide 'name', 'system_type', 'entity_type' in your JSON input")
 			}
 			return nil
 		}
diff --git a/cmd/workspace/feature-engineering/feature-engineering.go b/cmd/workspace/feature-engineering/feature-engineering.go
old mode 100755
new mode 100644
index d89f65f7d4e..5b2dcc7c833
--- a/cmd/workspace/feature-engineering/feature-engineering.go
+++ b/cmd/workspace/feature-engineering/feature-engineering.go
@@ -3,14 +3,17 @@
 package feature_engineering
 
 import (
+	"errors"
 	"fmt"
 	"strings"
+	"time"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/flags"
 	"github.com/databricks/databricks-sdk-go/common/types/fieldmask"
+	"github.com/databricks/databricks-sdk-go/experimental/api"
 	"github.com/databricks/databricks-sdk-go/service/ml"
 	"github.com/spf13/cobra"
 )
@@ -21,32 +24,43 @@ var cmdOverrides []func(*cobra.Command)
 
 func New() *cobra.Command {
 	cmd := &cobra.Command{
-		Use:     "feature-engineering",
-		Short:   `[description].`,
-		Long:    `[description]`,
+		Use:   "feature-engineering",
+		Short: `Feature Engineering provides APIs for managing features and materialized features.`,
+		Long: `Feature Engineering provides APIs for managing features and materialized
+  features.`,
 		GroupID: "ml",
-
-		// This service is being previewed; hide from help output.
-		Hidden: true,
-		RunE:   root.ReportUnknownSubcommand,
+		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
+	cmd.AddCommand(newBackfillFeatures())
+	cmd.AddCommand(newCancelOperation())
 	cmd.AddCommand(newCreateFeature())
 	cmd.AddCommand(newCreateKafkaConfig())
 	cmd.AddCommand(newCreateMaterializedFeature())
+	cmd.AddCommand(newCreateStream())
 	cmd.AddCommand(newDeleteFeature())
 	cmd.AddCommand(newDeleteKafkaConfig())
 	cmd.AddCommand(newDeleteMaterializedFeature())
+	cmd.AddCommand(newDeleteStream())
 	cmd.AddCommand(newGetFeature())
 	cmd.AddCommand(newGetKafkaConfig())
 	cmd.AddCommand(newGetMaterializedFeature())
+	cmd.AddCommand(newGetOperation())
+	cmd.AddCommand(newGetStream())
 	cmd.AddCommand(newListFeatures())
 	cmd.AddCommand(newListKafkaConfigs())
 	cmd.AddCommand(newListMaterializedFeatures())
+	cmd.AddCommand(newListStreams())
+	cmd.AddCommand(newPurgeFeatureEntities())
 	cmd.AddCommand(newUpdateFeature())
 	cmd.AddCommand(newUpdateKafkaConfig())
 	cmd.AddCommand(newUpdateMaterializedFeature())
+	cmd.AddCommand(newUpdateStream())
 
 	// Apply optional overrides to this command.
 	for _, fn := range cmdOverrides {
@@ -56,6 +70,178 @@ func New() *cobra.Command {
 	return cmd
 }
 
+// start backfill-features command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var backfillFeaturesOverrides []func(
+	*cobra.Command,
+	*ml.BackfillFeaturesRequest,
+)
+
+func newBackfillFeatures() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var backfillFeaturesReq ml.BackfillFeaturesRequest
+	var backfillFeaturesJson flags.JsonFlag
+
+	var backfillFeaturesSkipWait bool
+	var backfillFeaturesTimeout time.Duration
+
+	cmd.Flags().BoolVar(&backfillFeaturesSkipWait, "no-wait", backfillFeaturesSkipWait, `do not wait to reach DONE state`)
+	cmd.Flags().DurationVar(&backfillFeaturesTimeout, "timeout", 0, `maximum amount of time to reach DONE state`)
+
+	cmd.Flags().Var(&backfillFeaturesJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&backfillFeaturesReq.BudgetPolicyId, "budget-policy-id", backfillFeaturesReq.BudgetPolicyId, `The budget policy ID, in UUID format, used to attribute the serverless compute cost of this backfill.`)
+	cmd.Flags().StringVar(&backfillFeaturesReq.RequestId, "request-id", backfillFeaturesReq.RequestId, `Idempotency token for the request.`)
+	// TODO: map via StringToStringVar: tags
+
+	cmd.Use = "backfill-features"
+	cmd.Short = `Backfill features.`
+	cmd.Long = `Backfill features.
+
+  This is a long-running operation. By default, the command waits for the
+  operation to complete. Use --no-wait to return immediately with the raw
+  operation details. The operation's 'name' field can then be used to poll for
+  completion using the get-operation command.`
+
+	// This command is being previewed; hide from help output.
+	cmd.Hidden = true
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := backfillFeaturesJson.Unmarshal(&backfillFeaturesReq)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		} else {
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
+		}
+
+		// Determine which mode to execute based on flags.
+		switch {
+		case backfillFeaturesSkipWait:
+			wait, err := w.FeatureEngineering.BackfillFeatures(ctx, backfillFeaturesReq)
+			if err != nil {
+				return err
+			}
+
+			// Return operation immediately without waiting.
+			operation, err := w.FeatureEngineering.GetOperation(ctx, ml.GetOperationRequest{
+				Name: wait.Name(),
+			})
+			if err != nil {
+				return err
+			}
+			return cmdio.Render(ctx, operation)
+
+		default:
+			wait, err := w.FeatureEngineering.BackfillFeatures(ctx, backfillFeaturesReq)
+			if err != nil {
+				return err
+			}
+
+			// Show spinner while waiting for completion.
+			sp := cmdio.NewSpinner(ctx)
+			sp.Update("Waiting for backfill-features to complete...")
+
+			// Wait for completion.
+			opts := api.WithTimeout(backfillFeaturesTimeout)
+			response, err := wait.Wait(ctx, opts)
+			if err != nil {
+				return err
+			}
+			sp.Close()
+			return cmdio.Render(ctx, response)
+		}
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range backfillFeaturesOverrides {
+		fn(cmd, &backfillFeaturesReq)
+	}
+
+	return cmd
+}
+
+// start cancel-operation command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var cancelOperationOverrides []func(
+	*cobra.Command,
+	*ml.CancelOperationRequest,
+)
+
+func newCancelOperation() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var cancelOperationReq ml.CancelOperationRequest
+
+	cmd.Use = "cancel-operation NAME"
+	cmd.Short = `Cancel an operation.`
+	cmd.Long = `Cancel an operation.
+
+  Arguments:
+    NAME: The name of the operation resource to be cancelled.`
+
+	// This command is being previewed; hide from help output.
+	cmd.Hidden = true
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		cancelOperationReq.Name = args[0]
+
+		err = w.FeatureEngineering.CancelOperation(ctx, cancelOperationReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range cancelOperationOverrides {
+		fn(cmd, &cancelOperationReq)
+	}
+
+	return cmd
+}
+
 // start create-feature command
 
 // Slice with functions to override default command behavior.
@@ -76,7 +262,7 @@ func newCreateFeature() *cobra.Command {
 
 	cmd.Flags().StringVar(&createFeatureReq.Feature.Description, "description", createFeatureReq.Feature.Description, `The description of the feature.`)
 	// TODO: array: entities
-	cmd.Flags().StringVar(&createFeatureReq.Feature.FilterCondition, "filter-condition", createFeatureReq.Feature.FilterCondition, `Deprecated: Use DeltaTableSource.filter_condition or KafkaSource.filter_condition instead.`)
+	cmd.Flags().StringVar(&createFeatureReq.Feature.FilterCondition, "filter-condition", createFeatureReq.Feature.FilterCondition, ``)
 	// TODO: array: inputs
 	// TODO: complex arg: lineage_context
 	// TODO: complex arg: time_window
@@ -94,12 +280,14 @@ func newCreateFeature() *cobra.Command {
     FUNCTION: The function by which the feature is computed.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'full_name', 'source', 'function' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'full_name', 'source', 'function' in your JSON input")
 			}
 			return nil
 		}
@@ -182,6 +370,7 @@ func newCreateKafkaConfig() *cobra.Command {
 
 	// TODO: complex arg: backfill_source
 	// TODO: map via StringToStringVar: extra_options
+	// TODO: complex arg: ingestion_config
 	// TODO: complex arg: key_schema
 	// TODO: complex arg: value_schema
 
@@ -201,13 +390,18 @@ func newCreateKafkaConfig() *cobra.Command {
     SUBSCRIPTION_MODE: Options to configure which Kafka topics to pull data from.
     AUTH_CONFIG: Authentication configuration for connection to topics.`
 
+	// This command is being previewed; hide from help output.
+	cmd.Hidden = true
+
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'bootstrap_servers', 'subscription_mode', 'auth_config' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'bootstrap_servers', 'subscription_mode', 'auth_config' in your JSON input")
 			}
 			return nil
 		}
@@ -291,11 +485,17 @@ func newCreateMaterializedFeature() *cobra.Command {
 
 	cmd.Flags().Var(&createMaterializedFeatureJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
-	cmd.Flags().StringVar(&createMaterializedFeatureReq.MaterializedFeature.CronSchedule, "cron-schedule", createMaterializedFeatureReq.MaterializedFeature.CronSchedule, `The quartz cron expression that defines the schedule of the materialization pipeline.`)
-	cmd.Flags().StringVar(&createMaterializedFeatureReq.MaterializedFeature.MaterializedFeatureId, "materialized-feature-id", createMaterializedFeatureReq.MaterializedFeature.MaterializedFeatureId, `Unique identifier for the materialized feature.`)
+	cmd.Flags().StringVar(&createMaterializedFeatureReq.MaterializedFeature.BudgetPolicyId, "budget-policy-id", createMaterializedFeatureReq.MaterializedFeature.BudgetPolicyId, `The ID of the budget policy used to attribute the serverless compute cost of this materialization.`)
+	cmd.Flags().StringVar(&createMaterializedFeatureReq.MaterializedFeature.CronSchedule, "cron-schedule", createMaterializedFeatureReq.MaterializedFeature.CronSchedule, ``)
+	// TODO: complex arg: cron_schedule_trigger
+	cmd.Flags().StringVar(&createMaterializedFeatureReq.MaterializedFeature.MaterializedFeatureId, "materialized-feature-id", createMaterializedFeatureReq.MaterializedFeature.MaterializedFeatureId, `Server-assigned unique identifier for the materialized feature.`)
+	// TODO: complex arg: notifications
 	// TODO: complex arg: offline_store_config
 	// TODO: complex arg: online_store_config
 	cmd.Flags().Var(&createMaterializedFeatureReq.MaterializedFeature.PipelineScheduleState, "pipeline-schedule-state", `The schedule state of the materialization pipeline. Supported values: [ACTIVE, PAUSED, SNAPSHOT]`)
+	// TODO: complex arg: streaming_mode
+	// TODO: complex arg: table_trigger
+	// TODO: map via StringToStringVar: tags
 
 	cmd.Use = "create-materialized-feature FEATURE_NAME"
 	cmd.Short = `Create a materialized feature.`
@@ -305,12 +505,14 @@ func newCreateMaterializedFeature() *cobra.Command {
     FEATURE_NAME: The full name of the feature in Unity Catalog.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'feature_name' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'feature_name' in your JSON input")
 			}
 			return nil
 		}
@@ -359,6 +561,129 @@ func newCreateMaterializedFeature() *cobra.Command {
 	return cmd
 }
 
+// start create-stream command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var createStreamOverrides []func(
+	*cobra.Command,
+	*ml.CreateStreamRequest,
+)
+
+func newCreateStream() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var createStreamReq ml.CreateStreamRequest
+	createStreamReq.Stream = ml.Stream{}
+	var createStreamJson flags.JsonFlag
+
+	cmd.Flags().Var(&createStreamJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&createStreamReq.Stream.Description, "description", createStreamReq.Stream.Description, `User-provided description.`)
+	// TODO: array: excluded_columns
+	cmd.Flags().StringVar(&createStreamReq.Stream.RecordTypeFilter, "record-type-filter", createStreamReq.Stream.RecordTypeFilter, `Optional SQL predicate to filter which record types from a streaming channel (e.g.`)
+
+	cmd.Use = "create-stream NAME SOURCE_CONFIG CONNECTION_CONFIG SCHEMA_CONFIG INGESTION_CONFIG"
+	cmd.Short = `Create a Stream.`
+	cmd.Long = `Create a Stream.
+
+  Create a Stream, a governed UC entity representing an external streaming data
+  source.
+
+  Arguments:
+    NAME: Full three-part (catalog.schema.stream) name of the stream.
+    SOURCE_CONFIG: Source-specific configuration. Determines the streaming platform source.
+    CONNECTION_CONFIG: Specifies how to connect and authenticate to the stream platform.
+    SCHEMA_CONFIG: Schema definitions for the stream, provided either directly on the Stream
+      or resolved from an external schema registry through a UC Connection.
+    INGESTION_CONFIG: Configuration for streaming data ingestion: the managed table storing an
+      offline copy of forward fill data and optional historical backfill.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(0)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'source_config', 'connection_config', 'schema_config', 'ingestion_config' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(5)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := createStreamJson.Unmarshal(&createStreamReq.Stream)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		if !cmd.Flags().Changed("json") {
+			createStreamReq.Stream.Name = args[0]
+		}
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[1], &createStreamReq.Stream.SourceConfig)
+			if err != nil {
+				return fmt.Errorf("invalid SOURCE_CONFIG: %s", args[1])
+			}
+
+		}
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[2], &createStreamReq.Stream.ConnectionConfig)
+			if err != nil {
+				return fmt.Errorf("invalid CONNECTION_CONFIG: %s", args[2])
+			}
+
+		}
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[3], &createStreamReq.Stream.SchemaConfig)
+			if err != nil {
+				return fmt.Errorf("invalid SCHEMA_CONFIG: %s", args[3])
+			}
+
+		}
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[4], &createStreamReq.Stream.IngestionConfig)
+			if err != nil {
+				return fmt.Errorf("invalid INGESTION_CONFIG: %s", args[4])
+			}
+
+		}
+
+		response, err := w.FeatureEngineering.CreateStream(ctx, createStreamReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range createStreamOverrides {
+		fn(cmd, &createStreamReq)
+	}
+
+	return cmd
+}
+
 // start delete-feature command
 
 // Slice with functions to override default command behavior.
@@ -383,6 +708,8 @@ func newDeleteFeature() *cobra.Command {
     FULL_NAME: Name of the feature to delete.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -440,7 +767,12 @@ func newDeleteKafkaConfig() *cobra.Command {
   Arguments:
     NAME: Name of the Kafka config to delete.`
 
+	// This command is being previewed; hide from help output.
+	cmd.Hidden = true
+
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -495,6 +827,8 @@ func newDeleteMaterializedFeature() *cobra.Command {
     MATERIALIZED_FEATURE_ID: The ID of the materialized feature to delete.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -527,6 +861,64 @@ func newDeleteMaterializedFeature() *cobra.Command {
 	return cmd
 }
 
+// start delete-stream command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteStreamOverrides []func(
+	*cobra.Command,
+	*ml.DeleteStreamRequest,
+)
+
+func newDeleteStream() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteStreamReq ml.DeleteStreamRequest
+
+	cmd.Use = "delete-stream NAME"
+	cmd.Short = `Delete a Stream.`
+	cmd.Long = `Delete a Stream.
+
+  Delete a Stream by its full three-part name (catalog.schema.stream).
+
+  Arguments:
+    NAME: Full three-part name (catalog.schema.stream) of the Stream to delete.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		deleteStreamReq.Name = args[0]
+
+		err = w.FeatureEngineering.DeleteStream(ctx, deleteStreamReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteStreamOverrides {
+		fn(cmd, &deleteStreamReq)
+	}
+
+	return cmd
+}
+
 // start get-feature command
 
 // Slice with functions to override default command behavior.
@@ -551,6 +943,8 @@ func newGetFeature() *cobra.Command {
     FULL_NAME: Name of the feature to get.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -609,7 +1003,12 @@ func newGetKafkaConfig() *cobra.Command {
   Arguments:
     NAME: Name of the Kafka config to get.`
 
+	// This command is being previewed; hide from help output.
+	cmd.Hidden = true
+
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -665,6 +1064,8 @@ func newGetMaterializedFeature() *cobra.Command {
     MATERIALIZED_FEATURE_ID: The ID of the materialized feature.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -698,43 +1099,36 @@ func newGetMaterializedFeature() *cobra.Command {
 	return cmd
 }
 
-// start list-features command
+// start get-operation command
 
 // Slice with functions to override default command behavior.
 // Functions can be added from the `init()` function in manually curated files in this directory.
-var listFeaturesOverrides []func(
+var getOperationOverrides []func(
 	*cobra.Command,
-	*ml.ListFeaturesRequest,
+	*ml.GetOperationRequest,
 )
 
-func newListFeatures() *cobra.Command {
+func newGetOperation() *cobra.Command {
 	cmd := &cobra.Command{}
 
-	var listFeaturesReq ml.ListFeaturesRequest
-	// Registered for all paginated methods. Validated at call time in the
-	// method-call template. Paginated list methods never have Wait or LRO
-	// branches, so the method-call path is always reached.
-	var listFeaturesLimit int
-
-	cmd.Flags().IntVar(&listFeaturesReq.PageSize, "page-size", listFeaturesReq.PageSize, `The maximum number of results to return.`)
-
-	// Limit flag for total result capping.
-	cmd.Flags().IntVar(&listFeaturesLimit, "limit", 0, `Maximum number of results to return.`)
+	var getOperationReq ml.GetOperationRequest
 
-	// Hidden pagination flags (internal API parameters).
-	cmd.Flags().StringVar(&listFeaturesReq.PageToken, "page-token", listFeaturesReq.PageToken, `Pagination token.`)
-	cmd.Flags().Lookup("page-token").Hidden = true
+	cmd.Use = "get-operation NAME"
+	cmd.Short = `Get an operation.`
+	cmd.Long = `Get an operation.
 
-	cmd.Use = "list-features"
-	cmd.Short = `List features.`
-	cmd.Long = `List features.
+  Arguments:
+    NAME: The name of the operation resource.`
 
-  List Features.`
+	// This command is being previewed; hide from help output.
+	cmd.Hidden = true
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
-		check := root.ExactArgs(0)
+		check := root.ExactArgs(1)
 		return check(cmd, args)
 	}
 
@@ -743,6 +1137,141 @@ func newListFeatures() *cobra.Command {
 		ctx := cmd.Context()
 		w := cmdctx.WorkspaceClient(ctx)
 
+		getOperationReq.Name = args[0]
+
+		response, err := w.FeatureEngineering.GetOperation(ctx, getOperationReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getOperationOverrides {
+		fn(cmd, &getOperationReq)
+	}
+
+	return cmd
+}
+
+// start get-stream command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getStreamOverrides []func(
+	*cobra.Command,
+	*ml.GetStreamRequest,
+)
+
+func newGetStream() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getStreamReq ml.GetStreamRequest
+
+	cmd.Use = "get-stream NAME"
+	cmd.Short = `Get a Stream.`
+	cmd.Long = `Get a Stream.
+
+  Get a Stream by its full three-part name (catalog.schema.stream).
+
+  Arguments:
+    NAME: Full three-part name (catalog.schema.stream) of the Stream to get.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getStreamReq.Name = args[0]
+
+		response, err := w.FeatureEngineering.GetStream(ctx, getStreamReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getStreamOverrides {
+		fn(cmd, &getStreamReq)
+	}
+
+	return cmd
+}
+
+// start list-features command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listFeaturesOverrides []func(
+	*cobra.Command,
+	*ml.ListFeaturesRequest,
+)
+
+func newListFeatures() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listFeaturesReq ml.ListFeaturesRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listFeaturesLimit int
+
+	cmd.Flags().IntVar(&listFeaturesReq.PageSize, "page-size", listFeaturesReq.PageSize, `The maximum number of results to return.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listFeaturesLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listFeaturesReq.PageToken, "page-token", listFeaturesReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-features CATALOG_NAME SCHEMA_NAME"
+	cmd.Short = `List features.`
+	cmd.Long = `List features.
+
+  List Features.
+
+  Arguments:
+    CATALOG_NAME: Name of parent catalog for features of interest.
+    SCHEMA_NAME: Name of parent schema relative to its parent catalog.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		listFeaturesReq.CatalogName = args[0]
+		listFeaturesReq.SchemaName = args[1]
+
 		response := w.FeatureEngineering.ListFeatures(ctx, listFeaturesReq)
 		if listFeaturesLimit < 0 {
 			return fmt.Errorf("--limit must be a non-negative integer, got %d", listFeaturesLimit)
@@ -801,7 +1330,12 @@ func newListKafkaConfigs() *cobra.Command {
   creating features under the entire metastore. Only the creator of the Kafka
   config can delete it.`
 
+	// This command is being previewed; hide from help output.
+	cmd.Hidden = true
+
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -869,6 +1403,8 @@ func newListMaterializedFeatures() *cobra.Command {
 	cmd.Long = `List materialized features.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -903,6 +1439,192 @@ func newListMaterializedFeatures() *cobra.Command {
 	return cmd
 }
 
+// start list-streams command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listStreamsOverrides []func(
+	*cobra.Command,
+	*ml.ListStreamsRequest,
+)
+
+func newListStreams() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listStreamsReq ml.ListStreamsRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listStreamsLimit int
+
+	cmd.Flags().IntVar(&listStreamsReq.PageSize, "page-size", listStreamsReq.PageSize, `The maximum number of results to return.`)
+	cmd.Flags().StringVar(&listStreamsReq.Parent, "parent", listStreamsReq.Parent, `Two-part name (catalog.schema) of the parent under which to list Streams.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listStreamsLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listStreamsReq.PageToken, "page-token", listStreamsReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-streams"
+	cmd.Short = `List Streams.`
+	cmd.Long = `List Streams.
+
+  List Streams under a given catalog.schema parent.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(0)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		response := w.FeatureEngineering.ListStreams(ctx, listStreamsReq)
+		if listStreamsLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listStreamsLimit)
+		}
+		if listStreamsLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listStreamsLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listStreamsOverrides {
+		fn(cmd, &listStreamsReq)
+	}
+
+	return cmd
+}
+
+// start purge-feature-entities command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var purgeFeatureEntitiesOverrides []func(
+	*cobra.Command,
+	*ml.PurgeFeatureEntitiesRequest,
+)
+
+func newPurgeFeatureEntities() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var purgeFeatureEntitiesReq ml.PurgeFeatureEntitiesRequest
+	var purgeFeatureEntitiesJson flags.JsonFlag
+
+	var purgeFeatureEntitiesSkipWait bool
+	var purgeFeatureEntitiesTimeout time.Duration
+
+	cmd.Flags().BoolVar(&purgeFeatureEntitiesSkipWait, "no-wait", purgeFeatureEntitiesSkipWait, `do not wait to reach DONE state`)
+	cmd.Flags().DurationVar(&purgeFeatureEntitiesTimeout, "timeout", 0, `maximum amount of time to reach DONE state`)
+
+	cmd.Flags().Var(&purgeFeatureEntitiesJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&purgeFeatureEntitiesReq.BudgetPolicyId, "budget-policy-id", purgeFeatureEntitiesReq.BudgetPolicyId, `The budget policy ID, in UUID format, used to attribute the serverless compute cost of this purge.`)
+	cmd.Flags().StringVar(&purgeFeatureEntitiesReq.RequestId, "request-id", purgeFeatureEntitiesReq.RequestId, `Optional UUID4 idempotency token for the request.`)
+	// TODO: map via StringToStringVar: tags
+
+	cmd.Use = "purge-feature-entities"
+	cmd.Short = `Purge feature values for entities.`
+	cmd.Long = `Purge feature values for entities.
+
+  Purge materialized feature values for specified entities.
+
+  This is a long-running operation. By default, the command waits for the
+  operation to complete. Use --no-wait to return immediately with the raw
+  operation details. The operation's 'name' field can then be used to poll for
+  completion using the get-operation command.`
+
+	// This command is being previewed; hide from help output.
+	cmd.Hidden = true
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := purgeFeatureEntitiesJson.Unmarshal(&purgeFeatureEntitiesReq)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		} else {
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
+		}
+
+		// Determine which mode to execute based on flags.
+		switch {
+		case purgeFeatureEntitiesSkipWait:
+			wait, err := w.FeatureEngineering.PurgeFeatureEntities(ctx, purgeFeatureEntitiesReq)
+			if err != nil {
+				return err
+			}
+
+			// Return operation immediately without waiting.
+			operation, err := w.FeatureEngineering.GetOperation(ctx, ml.GetOperationRequest{
+				Name: wait.Name(),
+			})
+			if err != nil {
+				return err
+			}
+			return cmdio.Render(ctx, operation)
+
+		default:
+			wait, err := w.FeatureEngineering.PurgeFeatureEntities(ctx, purgeFeatureEntitiesReq)
+			if err != nil {
+				return err
+			}
+
+			// Show spinner while waiting for completion.
+			sp := cmdio.NewSpinner(ctx)
+			sp.Update("Waiting for purge-feature-entities to complete...")
+
+			// Wait for completion.
+			opts := api.WithTimeout(purgeFeatureEntitiesTimeout)
+			response, err := wait.Wait(ctx, opts)
+			if err != nil {
+				return err
+			}
+			sp.Close()
+			return cmdio.Render(ctx, response)
+		}
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range purgeFeatureEntitiesOverrides {
+		fn(cmd, &purgeFeatureEntitiesReq)
+	}
+
+	return cmd
+}
+
 // start update-feature command
 
 // Slice with functions to override default command behavior.
@@ -923,7 +1645,7 @@ func newUpdateFeature() *cobra.Command {
 
 	cmd.Flags().StringVar(&updateFeatureReq.Feature.Description, "description", updateFeatureReq.Feature.Description, `The description of the feature.`)
 	// TODO: array: entities
-	cmd.Flags().StringVar(&updateFeatureReq.Feature.FilterCondition, "filter-condition", updateFeatureReq.Feature.FilterCondition, `Deprecated: Use DeltaTableSource.filter_condition or KafkaSource.filter_condition instead.`)
+	cmd.Flags().StringVar(&updateFeatureReq.Feature.FilterCondition, "filter-condition", updateFeatureReq.Feature.FilterCondition, ``)
 	// TODO: array: inputs
 	// TODO: complex arg: lineage_context
 	// TODO: complex arg: time_window
@@ -937,17 +1659,19 @@ func newUpdateFeature() *cobra.Command {
 
   Arguments:
     FULL_NAME: The full three-part name (catalog, schema, name) of the feature.
-    UPDATE_MASK: The list of fields to update.
+    UPDATE_MASK: Fields to update. The only supported path is description.
     SOURCE: The data source of the feature.
     FUNCTION: The function by which the feature is computed.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(2)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only FULL_NAME, UPDATE_MASK as positional arguments. Provide 'full_name', 'source', 'function' in your JSON input")
+				return errors.New("when --json flag is specified, provide only FULL_NAME, UPDATE_MASK as positional arguments. Provide 'full_name', 'source', 'function' in your JSON input")
 			}
 			return nil
 		}
@@ -1029,6 +1753,7 @@ func newUpdateKafkaConfig() *cobra.Command {
 
 	// TODO: complex arg: backfill_source
 	// TODO: map via StringToStringVar: extra_options
+	// TODO: complex arg: ingestion_config
 	// TODO: complex arg: key_schema
 	// TODO: complex arg: value_schema
 
@@ -1049,13 +1774,18 @@ func newUpdateKafkaConfig() *cobra.Command {
     SUBSCRIPTION_MODE: Options to configure which Kafka topics to pull data from.
     AUTH_CONFIG: Authentication configuration for connection to topics.`
 
+	// This command is being previewed; hide from help output.
+	cmd.Hidden = true
+
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(2)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only NAME, UPDATE_MASK as positional arguments. Provide 'name', 'bootstrap_servers', 'subscription_mode', 'auth_config' in your JSON input")
+				return errors.New("when --json flag is specified, provide only NAME, UPDATE_MASK as positional arguments. Provide 'name', 'bootstrap_servers', 'subscription_mode', 'auth_config' in your JSON input")
 			}
 			return nil
 		}
@@ -1141,11 +1871,17 @@ func newUpdateMaterializedFeature() *cobra.Command {
 
 	cmd.Flags().Var(&updateMaterializedFeatureJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
-	cmd.Flags().StringVar(&updateMaterializedFeatureReq.MaterializedFeature.CronSchedule, "cron-schedule", updateMaterializedFeatureReq.MaterializedFeature.CronSchedule, `The quartz cron expression that defines the schedule of the materialization pipeline.`)
-	cmd.Flags().StringVar(&updateMaterializedFeatureReq.MaterializedFeature.MaterializedFeatureId, "materialized-feature-id", updateMaterializedFeatureReq.MaterializedFeature.MaterializedFeatureId, `Unique identifier for the materialized feature.`)
+	cmd.Flags().StringVar(&updateMaterializedFeatureReq.MaterializedFeature.BudgetPolicyId, "budget-policy-id", updateMaterializedFeatureReq.MaterializedFeature.BudgetPolicyId, `The ID of the budget policy used to attribute the serverless compute cost of this materialization.`)
+	cmd.Flags().StringVar(&updateMaterializedFeatureReq.MaterializedFeature.CronSchedule, "cron-schedule", updateMaterializedFeatureReq.MaterializedFeature.CronSchedule, ``)
+	// TODO: complex arg: cron_schedule_trigger
+	cmd.Flags().StringVar(&updateMaterializedFeatureReq.MaterializedFeature.MaterializedFeatureId, "materialized-feature-id", updateMaterializedFeatureReq.MaterializedFeature.MaterializedFeatureId, `Server-assigned unique identifier for the materialized feature.`)
+	// TODO: complex arg: notifications
 	// TODO: complex arg: offline_store_config
 	// TODO: complex arg: online_store_config
 	cmd.Flags().Var(&updateMaterializedFeatureReq.MaterializedFeature.PipelineScheduleState, "pipeline-schedule-state", `The schedule state of the materialization pipeline. Supported values: [ACTIVE, PAUSED, SNAPSHOT]`)
+	// TODO: complex arg: streaming_mode
+	// TODO: complex arg: table_trigger
+	// TODO: map via StringToStringVar: tags
 
 	cmd.Use = "update-materialized-feature MATERIALIZED_FEATURE_ID UPDATE_MASK FEATURE_NAME"
 	cmd.Short = `Update a materialized feature.`
@@ -1154,18 +1890,20 @@ func newUpdateMaterializedFeature() *cobra.Command {
   Update a materialized feature (pause/resume).
 
   Arguments:
-    MATERIALIZED_FEATURE_ID: Unique identifier for the materialized feature.
+    MATERIALIZED_FEATURE_ID: Server-assigned unique identifier for the materialized feature.
     UPDATE_MASK: Provide the materialization feature fields which should be updated.
       Currently, only the pipeline_state field can be updated.
     FEATURE_NAME: The full name of the feature in Unity Catalog.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(2)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only MATERIALIZED_FEATURE_ID, UPDATE_MASK as positional arguments. Provide 'feature_name' in your JSON input")
+				return errors.New("when --json flag is specified, provide only MATERIALIZED_FEATURE_ID, UPDATE_MASK as positional arguments. Provide 'feature_name' in your JSON input")
 			}
 			return nil
 		}
@@ -1216,4 +1954,129 @@ func newUpdateMaterializedFeature() *cobra.Command {
 	return cmd
 }
 
+// start update-stream command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateStreamOverrides []func(
+	*cobra.Command,
+	*ml.UpdateStreamRequest,
+)
+
+func newUpdateStream() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateStreamReq ml.UpdateStreamRequest
+	updateStreamReq.Stream = ml.Stream{}
+	var updateStreamJson flags.JsonFlag
+
+	cmd.Flags().Var(&updateStreamJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&updateStreamReq.Stream.Description, "description", updateStreamReq.Stream.Description, `User-provided description.`)
+	// TODO: array: excluded_columns
+	cmd.Flags().StringVar(&updateStreamReq.Stream.RecordTypeFilter, "record-type-filter", updateStreamReq.Stream.RecordTypeFilter, `Optional SQL predicate to filter which record types from a streaming channel (e.g.`)
+
+	cmd.Use = "update-stream NAME UPDATE_MASK SOURCE_CONFIG CONNECTION_CONFIG SCHEMA_CONFIG INGESTION_CONFIG"
+	cmd.Short = `Update a Stream.`
+	cmd.Long = `Update a Stream.
+
+  Update a Stream. Only fields listed in update_mask are mutated.
+
+  Arguments:
+    NAME: Full three-part (catalog.schema.stream) name of the stream.
+    UPDATE_MASK: The list of fields to update.
+    SOURCE_CONFIG: Source-specific configuration. Determines the streaming platform source.
+    CONNECTION_CONFIG: Specifies how to connect and authenticate to the stream platform.
+    SCHEMA_CONFIG: Schema definitions for the stream, provided either directly on the Stream
+      or resolved from an external schema registry through a UC Connection.
+    INGESTION_CONFIG: Configuration for streaming data ingestion: the managed table storing an
+      offline copy of forward fill data and optional historical backfill.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(2)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only NAME, UPDATE_MASK as positional arguments. Provide 'name', 'source_config', 'connection_config', 'schema_config', 'ingestion_config' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(6)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updateStreamJson.Unmarshal(&updateStreamReq.Stream)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		updateStreamReq.Name = args[0]
+		if args[1] != "" {
+			updateMaskArray := strings.Split(args[1], ",")
+			updateStreamReq.UpdateMask = *fieldmask.New(updateMaskArray)
+		}
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[2], &updateStreamReq.Stream.SourceConfig)
+			if err != nil {
+				return fmt.Errorf("invalid SOURCE_CONFIG: %s", args[2])
+			}
+
+		}
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[3], &updateStreamReq.Stream.ConnectionConfig)
+			if err != nil {
+				return fmt.Errorf("invalid CONNECTION_CONFIG: %s", args[3])
+			}
+
+		}
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[4], &updateStreamReq.Stream.SchemaConfig)
+			if err != nil {
+				return fmt.Errorf("invalid SCHEMA_CONFIG: %s", args[4])
+			}
+
+		}
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[5], &updateStreamReq.Stream.IngestionConfig)
+			if err != nil {
+				return fmt.Errorf("invalid INGESTION_CONFIG: %s", args[5])
+			}
+
+		}
+
+		response, err := w.FeatureEngineering.UpdateStream(ctx, updateStreamReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateStreamOverrides {
+		fn(cmd, &updateStreamReq)
+	}
+
+	return cmd
+}
+
 // end service FeatureEngineering
diff --git a/cmd/workspace/feature-store/feature-store.go b/cmd/workspace/feature-store/feature-store.go
old mode 100755
new mode 100644
index 4b1a7a0150c..1bb57ee7a48
--- a/cmd/workspace/feature-store/feature-store.go
+++ b/cmd/workspace/feature-store/feature-store.go
@@ -3,6 +3,7 @@
 package feature_store
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -35,6 +36,10 @@ func New() *cobra.Command {
 		RunE:   root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
 	// Add methods
 	cmd.AddCommand(newCreateOnlineStore())
 	cmd.AddCommand(newDeleteOnlineStore())
@@ -84,12 +89,14 @@ func newCreateOnlineStore() *cobra.Command {
       "CU_8".`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'capacity' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'capacity' in your JSON input")
 			}
 			return nil
 		}
@@ -163,6 +170,8 @@ func newDeleteOnlineStore() *cobra.Command {
     NAME: Name of the online store to delete.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -219,6 +228,8 @@ func newDeleteOnlineTable() *cobra.Command {
     ONLINE_TABLE_NAME: The full three-part (catalog, schema, table) name of the online table.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -273,6 +284,8 @@ func newGetOnlineStore() *cobra.Command {
     NAME: Name of the online store to get.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -338,6 +351,8 @@ func newListOnlineStores() *cobra.Command {
 	cmd.Long = `List Online Feature Stores.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -397,6 +412,8 @@ func newPublishTable() *cobra.Command {
     SOURCE_TABLE_NAME: The full three-part (catalog, schema, table) name of the source table.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -420,7 +437,7 @@ func newPublishTable() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 		publishTableReq.SourceTableName = args[0]
 
@@ -469,6 +486,12 @@ func newUpdateOnlineStore() *cobra.Command {
 	cmd.Short = `Update an Online Feature Store.`
 	cmd.Long = `Update an Online Feature Store.
 
+  Update an Online Feature Store.
+
+  This update is not guaranteed to be atomic: when a request changes multiple
+  fields, some may be applied while others fail. On a failed response, treat the
+  update as partially applied and retry until it succeeds.
+
   Arguments:
     NAME: The name of the online store. This is the unique identifier for the online
       store.
@@ -477,12 +500,14 @@ func newUpdateOnlineStore() *cobra.Command {
       "CU_8".`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(2)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only NAME, UPDATE_MASK as positional arguments. Provide 'name', 'capacity' in your JSON input")
+				return errors.New("when --json flag is specified, provide only NAME, UPDATE_MASK as positional arguments. Provide 'name', 'capacity' in your JSON input")
 			}
 			return nil
 		}
diff --git a/cmd/workspace/forecasting/forecasting.go b/cmd/workspace/forecasting/forecasting.go
old mode 100755
new mode 100644
index 7802776a93d..29aa8a08fba
--- a/cmd/workspace/forecasting/forecasting.go
+++ b/cmd/workspace/forecasting/forecasting.go
@@ -3,6 +3,7 @@
 package forecasting
 
 import (
+	"errors"
 	"fmt"
 	"time"
 
@@ -31,6 +32,10 @@ func New() *cobra.Command {
 		RunE:   root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
 	// Add methods
 	cmd.AddCommand(newCreateExperiment())
 	cmd.AddCommand(newGetExperiment())
@@ -103,12 +108,14 @@ func newCreateExperiment() *cobra.Command {
       the model should forecast.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'train_data_path', 'target_column', 'time_column', 'forecast_granularity', 'forecast_horizon' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'train_data_path', 'target_column', 'time_column', 'forecast_granularity', 'forecast_horizon' in your JSON input")
 			}
 			return nil
 		}
@@ -209,6 +216,8 @@ func newGetExperiment() *cobra.Command {
     EXPERIMENT_ID: The unique ID of a forecasting experiment`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/workspace/functions/functions.go b/cmd/workspace/functions/functions.go
old mode 100755
new mode 100644
index 7c02b25fb85..4b00519ea87
--- a/cmd/workspace/functions/functions.go
+++ b/cmd/workspace/functions/functions.go
@@ -3,6 +3,7 @@
 package functions
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -31,6 +32,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -76,6 +81,8 @@ func newCreate() *cobra.Command {
   and **CREATE_FUNCTION** on the function's parent schema`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -94,7 +101,7 @@ func newCreate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := w.Functions.Create(ctx, createReq)
@@ -149,6 +156,8 @@ func newDelete() *cobra.Command {
       __catalog_name__.__schema_name__.__function__name__) .`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -170,7 +179,7 @@ func newDelete() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the fully-qualified name of the function (of the form __catalog_name__.__schema_name__.__function__name__) ")
+			return errors.New("expected to have the fully-qualified name of the function (of the form __catalog_name__.__schema_name__.__function__name__) ")
 		}
 		deleteReq.Name = args[0]
 
@@ -226,6 +235,8 @@ func newGet() *cobra.Command {
       __catalog_name__.__schema_name__.__function__name__).`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -247,7 +258,7 @@ func newGet() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the fully-qualified name of the function (of the form __catalog_name__.__schema_name__.__function__name__)")
+			return errors.New("expected to have the fully-qualified name of the function (of the form __catalog_name__.__schema_name__.__function__name__)")
 		}
 		getReq.Name = args[0]
 
@@ -325,6 +336,8 @@ func newList() *cobra.Command {
     SCHEMA_NAME: Parent schema of functions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -399,6 +412,8 @@ func newUpdate() *cobra.Command {
       __catalog_name__.__schema_name__.__function__name__).`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -432,7 +447,7 @@ func newUpdate() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the fully-qualified name of the function (of the form __catalog_name__.__schema_name__.__function__name__)")
+			return errors.New("expected to have the fully-qualified name of the function (of the form __catalog_name__.__schema_name__.__function__name__)")
 		}
 		updateReq.Name = args[0]
 
diff --git a/cmd/workspace/genie/genie.go b/cmd/workspace/genie/genie.go
old mode 100755
new mode 100644
index 08879af3ab5..4d4e9dda5ac
--- a/cmd/workspace/genie/genie.go
+++ b/cmd/workspace/genie/genie.go
@@ -3,6 +3,7 @@
 package genie
 
 import (
+	"errors"
 	"fmt"
 	"time"
 
@@ -31,15 +32,21 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreateMessage())
 	cmd.AddCommand(newCreateMessageComment())
 	cmd.AddCommand(newCreateSpace())
 	cmd.AddCommand(newDeleteConversation())
 	cmd.AddCommand(newDeleteConversationMessage())
+	cmd.AddCommand(newDownloadMessageAttachmentVisualization())
 	cmd.AddCommand(newExecuteMessageAttachmentQuery())
 	cmd.AddCommand(newExecuteMessageQuery())
 	cmd.AddCommand(newGenerateDownloadFullQueryResult())
+	cmd.AddCommand(newGenieCancelResponse())
 	cmd.AddCommand(newGenieCreateEvalRun())
 	cmd.AddCommand(newGenieGetEvalResultDetails())
 	cmd.AddCommand(newGenieGetEvalRun())
@@ -92,13 +99,15 @@ func newCreateMessage() *cobra.Command {
 
 	cmd.Flags().Var(&createMessageJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
+	cmd.Flags().BoolVar(&createMessageReq.EnableVisualization, "enable-visualization", createMessageReq.EnableVisualization, `Enable visualization generation.`)
+
 	cmd.Use = "create-message SPACE_ID CONVERSATION_ID CONTENT"
-	cmd.Short = `Create conversation message.`
-	cmd.Long = `Create conversation message.
+	cmd.Short = `Chat mode: Send a message.`
+	cmd.Long = `Chat mode: Send a message.
 
-  Create new message in a [conversation](:method:genie/startconversation). The
-  AI response uses all previously created messages in the conversation to
-  respond.
+  Sends a new message in a chat-mode
+  [conversation](:method:genie/startconversation). The AI response uses all
+  previously created messages in the conversation to respond.
 
   Arguments:
     SPACE_ID: The ID associated with the Genie space where the conversation is started.
@@ -106,12 +115,14 @@ func newCreateMessage() *cobra.Command {
     CONTENT: User message content.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(2)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only SPACE_ID, CONVERSATION_ID as positional arguments. Provide 'content' in your JSON input")
+				return errors.New("when --json flag is specified, provide only SPACE_ID, CONVERSATION_ID as positional arguments. Provide 'content' in your JSON input")
 			}
 			return nil
 		}
@@ -192,8 +203,10 @@ func newCreateMessageComment() *cobra.Command {
 	cmd.Flags().Var(&createMessageCommentJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Use = "create-message-comment SPACE_ID CONVERSATION_ID MESSAGE_ID CONTENT"
-	cmd.Short = `Create message comment.`
-	cmd.Long = `Create message comment.
+	cmd.Short = `*Public Preview* Add a comment to a message.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Add a comment to a message.
 
   Create a comment on a conversation message.
 
@@ -204,12 +217,14 @@ func newCreateMessageComment() *cobra.Command {
     CONTENT: Comment text content.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(3)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only SPACE_ID, CONVERSATION_ID, MESSAGE_ID as positional arguments. Provide 'content' in your JSON input")
+				return errors.New("when --json flag is specified, provide only SPACE_ID, CONVERSATION_ID, MESSAGE_ID as positional arguments. Provide 'content' in your JSON input")
 			}
 			return nil
 		}
@@ -283,8 +298,8 @@ func newCreateSpace() *cobra.Command {
 	cmd.Flags().StringVar(&createSpaceReq.Title, "title", createSpaceReq.Title, `Optional title override.`)
 
 	cmd.Use = "create-space WAREHOUSE_ID SERIALIZED_SPACE"
-	cmd.Short = `Create Genie Space.`
-	cmd.Long = `Create Genie Space.
+	cmd.Short = `Create a Genie space.`
+	cmd.Long = `Create a Genie space.
 
   Creates a Genie space from a serialized payload.
 
@@ -297,12 +312,14 @@ func newCreateSpace() *cobra.Command {
       components.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'warehouse_id', 'serialized_space' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'warehouse_id', 'serialized_space' in your JSON input")
 			}
 			return nil
 		}
@@ -369,16 +386,16 @@ func newDeleteConversation() *cobra.Command {
 	var deleteConversationReq dashboards.GenieDeleteConversationRequest
 
 	cmd.Use = "delete-conversation SPACE_ID CONVERSATION_ID"
-	cmd.Short = `Delete conversation.`
-	cmd.Long = `Delete conversation.
-
-  Delete a conversation.
+	cmd.Short = `Delete a conversation.`
+	cmd.Long = `Delete a conversation.
 
   Arguments:
     SPACE_ID: The ID associated with the Genie space where the conversation is located.
     CONVERSATION_ID: The ID of the conversation to delete.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -427,10 +444,8 @@ func newDeleteConversationMessage() *cobra.Command {
 	var deleteConversationMessageReq dashboards.GenieDeleteConversationMessageRequest
 
 	cmd.Use = "delete-conversation-message SPACE_ID CONVERSATION_ID MESSAGE_ID"
-	cmd.Short = `Delete conversation message.`
-	cmd.Long = `Delete conversation message.
-
-  Delete a conversation message.
+	cmd.Short = `Delete a conversation message.`
+	cmd.Long = `Delete a conversation message.
 
   Arguments:
     SPACE_ID: The ID associated with the Genie space where the message is located.
@@ -438,6 +453,8 @@ func newDeleteConversationMessage() *cobra.Command {
     MESSAGE_ID: The ID associated with the message to delete.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(3)
@@ -472,6 +489,69 @@ func newDeleteConversationMessage() *cobra.Command {
 	return cmd
 }
 
+// start download-message-attachment-visualization command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var downloadMessageAttachmentVisualizationOverrides []func(
+	*cobra.Command,
+	*dashboards.DownloadMessageAttachmentVisualizationRequest,
+)
+
+func newDownloadMessageAttachmentVisualization() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var downloadMessageAttachmentVisualizationReq dashboards.DownloadMessageAttachmentVisualizationRequest
+
+	cmd.Use = "download-message-attachment-visualization NAME"
+	cmd.Short = `Download an attachment visualization.`
+	cmd.Long = `Download an attachment visualization.
+
+  Download a rendered image of a message visualization attachment. The response
+  body is the raw PNG image, not a JSON payload. This is only available if the
+  attachment is a visualization and the message status is COMPLETED.
+
+  Arguments:
+    NAME: The resource name of the attachment to render, in the format
+      spaces/{space_id}/conversations/{conversation_id}/messages/{message_id}/attachments/{attachment_id}.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		downloadMessageAttachmentVisualizationReq.Name = args[0]
+
+		response, err := w.Genie.DownloadMessageAttachmentVisualization(ctx, downloadMessageAttachmentVisualizationReq)
+		if err != nil {
+			return err
+		}
+
+		defer response.Contents.Close()
+		return cmdio.Render(ctx, response.Contents)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range downloadMessageAttachmentVisualizationOverrides {
+		fn(cmd, &downloadMessageAttachmentVisualizationReq)
+	}
+
+	return cmd
+}
+
 // start execute-message-attachment-query command
 
 // Slice with functions to override default command behavior.
@@ -487,8 +567,8 @@ func newExecuteMessageAttachmentQuery() *cobra.Command {
 	var executeMessageAttachmentQueryReq dashboards.GenieExecuteMessageAttachmentQueryRequest
 
 	cmd.Use = "execute-message-attachment-query SPACE_ID CONVERSATION_ID MESSAGE_ID ATTACHMENT_ID"
-	cmd.Short = `Execute message attachment SQL query.`
-	cmd.Long = `Execute message attachment SQL query.
+	cmd.Short = `Execute an attachment SQL query.`
+	cmd.Long = `Execute an attachment SQL query.
 
   Execute the SQL for a message query attachment. Use this API when the query
   attachment has expired and needs to be re-executed.
@@ -500,6 +580,8 @@ func newExecuteMessageAttachmentQuery() *cobra.Command {
     ATTACHMENT_ID: Attachment ID`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(4)
@@ -566,6 +648,8 @@ func newExecuteMessageQuery() *cobra.Command {
 	cmd.Hidden = true
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(3)
@@ -616,8 +700,8 @@ func newGenerateDownloadFullQueryResult() *cobra.Command {
 	var generateDownloadFullQueryResultReq dashboards.GenieGenerateDownloadFullQueryResultRequest
 
 	cmd.Use = "generate-download-full-query-result SPACE_ID CONVERSATION_ID MESSAGE_ID ATTACHMENT_ID"
-	cmd.Short = `Generate full query result download.`
-	cmd.Long = `Generate full query result download.
+	cmd.Short = `Start a full query-result download.`
+	cmd.Long = `Start a full query-result download.
 
   Initiates a new SQL execution and returns a download_id and
   download_id_signature that you can use to track the progress of the
@@ -631,12 +715,10 @@ func newGenerateDownloadFullQueryResult() *cobra.Command {
   ### **Warning: Databricks strongly recommends that you protect the URLs that
   are returned by the EXTERNAL_LINKS disposition.**
 
-  When you use the EXTERNAL_LINKS disposition, a short-lived, URL is
-  generated, which can be used to download the results directly from . As a
-  short-lived is embedded in this URL, you should protect the URL.
-
-  Because URLs are already generated with embedded temporary s, you must not set
-  an Authorization header in the download requests.
+  When you use the EXTERNAL_LINKS disposition, a short-lived cloud-storage URL
+  is generated to download the results. The URL contains temporary access
+  credentials, so protect it and do not set an Authorization header in the
+  download request.
 
   See [Execute Statement](:method:statementexecution/executestatement) for more
   details.
@@ -650,6 +732,8 @@ func newGenerateDownloadFullQueryResult() *cobra.Command {
     ATTACHMENT_ID: Attachment ID`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(4)
@@ -686,6 +770,72 @@ func newGenerateDownloadFullQueryResult() *cobra.Command {
 	return cmd
 }
 
+// start genie-cancel-response command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var genieCancelResponseOverrides []func(
+	*cobra.Command,
+	*dashboards.GenieCancelResponseRequest,
+)
+
+func newGenieCancelResponse() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var genieCancelResponseReq dashboards.GenieCancelResponseRequest
+
+	cmd.Use = "genie-cancel-response AGENT_ID CONVERSATION_ID RESPONSE_ID"
+	cmd.Short = `Agent mode: Cancel a response.`
+	cmd.Long = `Agent mode: Cancel a response.
+
+  Cancels an in-flight agent-mode response. response_id is the id returned in
+  the response.created event from the agent-mode responses endpoint. The
+  response stops at the next agent boundary and its terminal state is returned.
+
+  Arguments:
+    AGENT_ID: The ID of the Genie agent (synonymous with the Genie space ID).
+    CONVERSATION_ID: The ID of the conversation containing the response.
+    RESPONSE_ID: The ID of the response to cancel (the id from the response.created
+      event).`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(3)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		genieCancelResponseReq.AgentId = args[0]
+		genieCancelResponseReq.ConversationId = args[1]
+		genieCancelResponseReq.ResponseId = args[2]
+
+		response, err := w.Genie.GenieCancelResponse(ctx, genieCancelResponseReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range genieCancelResponseOverrides {
+		fn(cmd, &genieCancelResponseReq)
+	}
+
+	return cmd
+}
+
 // start genie-create-eval-run command
 
 // Slice with functions to override default command behavior.
@@ -706,16 +856,21 @@ func newGenieCreateEvalRun() *cobra.Command {
 	// TODO: array: benchmark_question_ids
 
 	cmd.Use = "genie-create-eval-run SPACE_ID"
-	cmd.Short = `Create eval run for benchmarks.`
-	cmd.Long = `Create eval run for benchmarks.
+	cmd.Short = `*Beta* Start a benchmark evaluation run.`
+	cmd.Long = `This command is in Beta and may change without notice.
 
-  Create and run evaluations for multiple benchmark questions in a Genie space.
+Start a benchmark evaluation run.
+
+  Creates and runs chat-mode evaluations for multiple benchmark questions in a
+  Genie space.
 
   Arguments:
     SPACE_ID: The ID associated with the Genie space where the evaluations will be
       executed.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -776,8 +931,10 @@ func newGenieGetEvalResultDetails() *cobra.Command {
 	var genieGetEvalResultDetailsReq dashboards.GenieGetEvalResultDetailsRequest
 
 	cmd.Use = "genie-get-eval-result-details SPACE_ID EVAL_RUN_ID RESULT_ID"
-	cmd.Short = `Get benchmark evaluation result details.`
-	cmd.Long = `Get benchmark evaluation result details.
+	cmd.Short = `*Beta* Get benchmark evaluation result details.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get benchmark evaluation result details.
 
   Get details for evaluation results.
 
@@ -788,6 +945,8 @@ func newGenieGetEvalResultDetails() *cobra.Command {
     RESULT_ID: The unique identifier for the evaluation result.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(3)
@@ -838,8 +997,10 @@ func newGenieGetEvalRun() *cobra.Command {
 	var genieGetEvalRunReq dashboards.GenieGetEvalRunRequest
 
 	cmd.Use = "genie-get-eval-run SPACE_ID EVAL_RUN_ID"
-	cmd.Short = `Get benchmark evaluation run.`
-	cmd.Long = `Get benchmark evaluation run.
+	cmd.Short = `*Beta* Get a benchmark evaluation run.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get a benchmark evaluation run.
 
   Get evaluation run details.
 
@@ -849,6 +1010,8 @@ func newGenieGetEvalRun() *cobra.Command {
     EVAL_RUN_ID: `
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -901,8 +1064,10 @@ func newGenieListEvalResults() *cobra.Command {
 	cmd.Flags().StringVar(&genieListEvalResultsReq.PageToken, "page-token", genieListEvalResultsReq.PageToken, `Opaque token to retrieve the next page of results.`)
 
 	cmd.Use = "genie-list-eval-results SPACE_ID EVAL_RUN_ID"
-	cmd.Short = `List benchmark evaluation results.`
-	cmd.Long = `List benchmark evaluation results.
+	cmd.Short = `*Beta* List results for a benchmark evaluation run.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+List results for a benchmark evaluation run.
 
   List evaluation results for a specific evaluation run.
 
@@ -912,6 +1077,8 @@ func newGenieListEvalResults() *cobra.Command {
     EVAL_RUN_ID: The unique identifier for the evaluation run.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -964,8 +1131,10 @@ func newGenieListEvalRuns() *cobra.Command {
 	cmd.Flags().StringVar(&genieListEvalRunsReq.PageToken, "page-token", genieListEvalRunsReq.PageToken, `Token to get the next page of results.`)
 
 	cmd.Use = "genie-list-eval-runs SPACE_ID"
-	cmd.Short = `List all evaluation runs in the space.`
-	cmd.Long = `List all evaluation runs in the space.
+	cmd.Short = `*Beta* List benchmark evaluation runs.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+List benchmark evaluation runs.
 
   Lists all evaluation runs in a space.
 
@@ -974,6 +1143,8 @@ func newGenieListEvalRuns() *cobra.Command {
       located.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1022,8 +1193,8 @@ func newGetDownloadFullQueryResult() *cobra.Command {
 	var getDownloadFullQueryResultReq dashboards.GenieGetDownloadFullQueryResultRequest
 
 	cmd.Use = "get-download-full-query-result SPACE_ID CONVERSATION_ID MESSAGE_ID ATTACHMENT_ID DOWNLOAD_ID DOWNLOAD_ID_SIGNATURE"
-	cmd.Short = `Get download full query result.`
-	cmd.Long = `Get download full query result.
+	cmd.Short = `Get full query-result download status.`
+	cmd.Long = `Get full query-result download status.
 
   After [Generating a Full Query Result
   Download](:method:genie/generatedownloadfullqueryresult) and successfully
@@ -1038,12 +1209,10 @@ func newGetDownloadFullQueryResult() *cobra.Command {
   ### **Warning: Databricks strongly recommends that you protect the URLs that
   are returned by the EXTERNAL_LINKS disposition.**
 
-  When you use the EXTERNAL_LINKS disposition, a short-lived, URL is
-  generated, which can be used to download the results directly from . As a
-  short-lived is embedded in this URL, you should protect the URL.
-
-  Because URLs are already generated with embedded temporary s, you must not set
-  an Authorization header in the download requests.
+  When you use the EXTERNAL_LINKS disposition, a short-lived cloud-storage URL
+  is generated to download the results. The URL contains temporary access
+  credentials, so protect it and do not set an Authorization header in the
+  download request.
 
   See [Execute Statement](:method:statementexecution/executestatement) for more
   details.
@@ -1060,6 +1229,8 @@ func newGetDownloadFullQueryResult() *cobra.Command {
     DOWNLOAD_ID_SIGNATURE: JWT signature for the download_id to ensure secure access to query results`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(6)
@@ -1113,10 +1284,11 @@ func newGetMessage() *cobra.Command {
 	var getMessageReq dashboards.GenieGetConversationMessageRequest
 
 	cmd.Use = "get-message SPACE_ID CONVERSATION_ID MESSAGE_ID"
-	cmd.Short = `Get conversation message.`
-	cmd.Long = `Get conversation message.
+	cmd.Short = `Get a conversation message.`
+	cmd.Long = `Get a conversation message.
 
-  Get message from conversation.
+  Gets a message from a chat-mode or agent-mode conversation. For a complete
+  agent-mode transcript, use the List conversation items endpoint.
 
   Arguments:
     SPACE_ID: The ID associated with the Genie space where the target conversation is
@@ -1126,6 +1298,8 @@ func newGetMessage() *cobra.Command {
       conversation.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(3)
@@ -1176,8 +1350,8 @@ func newGetMessageAttachmentQueryResult() *cobra.Command {
 	var getMessageAttachmentQueryResultReq dashboards.GenieGetMessageAttachmentQueryResultRequest
 
 	cmd.Use = "get-message-attachment-query-result SPACE_ID CONVERSATION_ID MESSAGE_ID ATTACHMENT_ID"
-	cmd.Short = `Get message attachment SQL query result.`
-	cmd.Long = `Get message attachment SQL query result.
+	cmd.Short = `Get an attachment SQL result.`
+	cmd.Long = `Get an attachment SQL result.
 
   Get the result of SQL query if the message has a query attachment. This is
   only available if a message has a query attachment and the message status is
@@ -1190,6 +1364,8 @@ func newGetMessageAttachmentQueryResult() *cobra.Command {
     ATTACHMENT_ID: Attachment ID`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(4)
@@ -1256,6 +1432,8 @@ func newGetMessageQueryResult() *cobra.Command {
 	cmd.Hidden = true
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(3)
@@ -1322,6 +1500,8 @@ func newGetMessageQueryResultByAttachment() *cobra.Command {
 	cmd.Hidden = true
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(4)
@@ -1375,8 +1555,8 @@ func newGetSpace() *cobra.Command {
 	cmd.Flags().BoolVar(&getSpaceReq.IncludeSerializedSpace, "include-serialized-space", getSpaceReq.IncludeSerializedSpace, `Whether to include the serialized space export in the response.`)
 
 	cmd.Use = "get-space SPACE_ID"
-	cmd.Short = `Get Genie Space.`
-	cmd.Long = `Get Genie Space.
+	cmd.Short = `Get a Genie space.`
+	cmd.Long = `Get a Genie space.
 
   Get details of a Genie Space.
 
@@ -1384,6 +1564,8 @@ func newGetSpace() *cobra.Command {
     SPACE_ID: The ID associated with the Genie space`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1435,8 +1617,10 @@ func newListConversationComments() *cobra.Command {
 	cmd.Flags().StringVar(&listConversationCommentsReq.PageToken, "page-token", listConversationCommentsReq.PageToken, `Pagination token for getting the next page of results.`)
 
 	cmd.Use = "list-conversation-comments SPACE_ID CONVERSATION_ID"
-	cmd.Short = `List conversation comments.`
-	cmd.Long = `List conversation comments.
+	cmd.Short = `*Public Preview* List all comments in a conversation.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+List all comments in a conversation.
 
   List all comments across all messages in a conversation.
 
@@ -1445,6 +1629,8 @@ func newListConversationComments() *cobra.Command {
     CONVERSATION_ID: The ID associated with the conversation.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -1500,13 +1686,17 @@ func newListConversationMessages() *cobra.Command {
 	cmd.Short = `List conversation messages.`
 	cmd.Long = `List conversation messages.
 
-  List messages in a conversation
+  Lists messages in a chat-mode or agent-mode conversation. Agent-mode messages
+  are returned as GenieMessage projections. Use the List conversation items
+  endpoint for the complete reasoning and tool-call history.
 
   Arguments:
     SPACE_ID: The ID associated with the Genie space where the conversation is located
     CONVERSATION_ID: The ID of the conversation to list messages from`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -1560,8 +1750,8 @@ func newListConversations() *cobra.Command {
 	cmd.Flags().StringVar(&listConversationsReq.PageToken, "page-token", listConversationsReq.PageToken, `Token to get the next page of results.`)
 
 	cmd.Use = "list-conversations SPACE_ID"
-	cmd.Short = `List conversations in a Genie Space.`
-	cmd.Long = `List conversations in a Genie Space.
+	cmd.Short = `List conversations.`
+	cmd.Long = `List conversations.
 
   Get a list of conversations in a Genie Space.
 
@@ -1569,6 +1759,8 @@ func newListConversations() *cobra.Command {
     SPACE_ID: The ID of the Genie space to retrieve conversations from.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1620,8 +1812,10 @@ func newListMessageComments() *cobra.Command {
 	cmd.Flags().StringVar(&listMessageCommentsReq.PageToken, "page-token", listMessageCommentsReq.PageToken, `Pagination token for getting the next page of results.`)
 
 	cmd.Use = "list-message-comments SPACE_ID CONVERSATION_ID MESSAGE_ID"
-	cmd.Short = `List message comments.`
-	cmd.Long = `List message comments.
+	cmd.Short = `*Public Preview* List comments on a message.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+List comments on a message.
 
   List comments on a specific conversation message.
 
@@ -1631,6 +1825,8 @@ func newListMessageComments() *cobra.Command {
     MESSAGE_ID: The ID associated with the message.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(3)
@@ -1690,6 +1886,8 @@ func newListSpaces() *cobra.Command {
   Get list of Genie Spaces.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -1741,10 +1939,10 @@ func newSendMessageFeedback() *cobra.Command {
 	cmd.Flags().StringVar(&sendMessageFeedbackReq.Comment, "comment", sendMessageFeedbackReq.Comment, `Optional text feedback that will be stored as a comment.`)
 
 	cmd.Use = "send-message-feedback SPACE_ID CONVERSATION_ID MESSAGE_ID RATING"
-	cmd.Short = `Send message feedback.`
-	cmd.Long = `Send message feedback.
+	cmd.Short = `Send feedback on a message.`
+	cmd.Long = `Send feedback on a message.
 
-  Send feedback for a message.
+  Sends feedback for a message in a chat-mode or agent-mode conversation.
 
   Arguments:
     SPACE_ID: The ID associated with the Genie space where the message is located.
@@ -1754,12 +1952,14 @@ func newSendMessageFeedback() *cobra.Command {
       Supported values: [NEGATIVE, NONE, POSITIVE]`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(3)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only SPACE_ID, CONVERSATION_ID, MESSAGE_ID as positional arguments. Provide 'rating' in your JSON input")
+				return errors.New("when --json flag is specified, provide only SPACE_ID, CONVERSATION_ID, MESSAGE_ID as positional arguments. Provide 'rating' in your JSON input")
 			}
 			return nil
 		}
@@ -1837,11 +2037,13 @@ func newStartConversation() *cobra.Command {
 
 	cmd.Flags().Var(&startConversationJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
+	cmd.Flags().BoolVar(&startConversationReq.EnableVisualization, "enable-visualization", startConversationReq.EnableVisualization, `Enable visualization generation.`)
+
 	cmd.Use = "start-conversation SPACE_ID CONTENT"
-	cmd.Short = `Start conversation.`
-	cmd.Long = `Start conversation.
+	cmd.Short = `Chat mode: Start a conversation.`
+	cmd.Long = `Chat mode: Start a conversation.
 
-  Start a new conversation.
+  Starts a new chat-mode conversation and sends its first message.
 
   Arguments:
     SPACE_ID: The ID associated with the Genie space where you want to start a
@@ -1849,12 +2051,14 @@ func newStartConversation() *cobra.Command {
     CONTENT: The text of the message that starts the conversation.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(1)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only SPACE_ID as positional arguments. Provide 'content' in your JSON input")
+				return errors.New("when --json flag is specified, provide only SPACE_ID as positional arguments. Provide 'content' in your JSON input")
 			}
 			return nil
 		}
@@ -1931,8 +2135,8 @@ func newTrashSpace() *cobra.Command {
 	var trashSpaceReq dashboards.GenieTrashSpaceRequest
 
 	cmd.Use = "trash-space SPACE_ID"
-	cmd.Short = `Trash Genie Space.`
-	cmd.Long = `Trash Genie Space.
+	cmd.Short = `Trash a Genie space.`
+	cmd.Long = `Trash a Genie space.
 
   Move a Genie Space to the trash.
 
@@ -1940,6 +2144,8 @@ func newTrashSpace() *cobra.Command {
     SPACE_ID: The ID associated with the Genie space to be sent to the trash.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1990,13 +2196,15 @@ func newUpdateSpace() *cobra.Command {
 	cmd.Flags().Var(&updateSpaceJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Flags().StringVar(&updateSpaceReq.Description, "description", updateSpaceReq.Description, `Optional description.`)
+	cmd.Flags().StringVar(&updateSpaceReq.Etag, "etag", updateSpaceReq.Etag, `ETag returned by a previous GET or UPDATE.`)
+	cmd.Flags().StringVar(&updateSpaceReq.ParentPath, "parent-path", updateSpaceReq.ParentPath, `Parent workspace folder path to move this Genie space under.`)
 	cmd.Flags().StringVar(&updateSpaceReq.SerializedSpace, "serialized-space", updateSpaceReq.SerializedSpace, `The contents of the Genie Space in serialized string form (full replacement).`)
 	cmd.Flags().StringVar(&updateSpaceReq.Title, "title", updateSpaceReq.Title, `Optional title override.`)
 	cmd.Flags().StringVar(&updateSpaceReq.WarehouseId, "warehouse-id", updateSpaceReq.WarehouseId, `Optional warehouse override.`)
 
 	cmd.Use = "update-space SPACE_ID"
-	cmd.Short = `Update Genie Space.`
-	cmd.Long = `Update Genie Space.
+	cmd.Short = `Update a Genie space.`
+	cmd.Long = `Update a Genie space.
 
   Updates a Genie space with a serialized payload.
 
@@ -2004,6 +2212,8 @@ func newUpdateSpace() *cobra.Command {
     SPACE_ID: Genie space ID`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/workspace/genie/overrides.go b/cmd/workspace/genie/overrides.go
new file mode 100644
index 00000000000..750cefc96b7
--- /dev/null
+++ b/cmd/workspace/genie/overrides.go
@@ -0,0 +1,15 @@
+package genie
+
+import (
+	geniecmd "github.com/databricks/cli/cmd/genie"
+	"github.com/spf13/cobra"
+)
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		// "ask" is a hand-written streaming data-question command, not part of the
+		// generated Genie spaces/conversations API surface; attach it to the same
+		// top-level "genie" group so it runs as `databricks genie ask`.
+		cmd.AddCommand(geniecmd.NewAskCmd())
+	})
+}
diff --git a/cmd/workspace/git-credentials/git-credentials.go b/cmd/workspace/git-credentials/git-credentials.go
old mode 100755
new mode 100644
index b139272f0f9..9288c2b5941
--- a/cmd/workspace/git-credentials/git-credentials.go
+++ b/cmd/workspace/git-credentials/git-credentials.go
@@ -3,6 +3,7 @@
 package git_credentials
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -31,6 +32,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -79,17 +84,20 @@ func newCreate() *cobra.Command {
 
   Arguments:
     GIT_PROVIDER: Git provider. This field is case-insensitive. The available Git providers
-      are gitHub, bitbucketCloud, gitLab, azureDevOpsServices,
-      gitHubEnterprise, bitbucketServer, gitLabEnterpriseEdition and
-      awsCodeCommit.`
+      are gitHub, bitbucketCloud, gitLab, azureDevOpsServices (Azure
+      DevOps Services, including Microsoft Entra ID authentication),
+      gitHubEnterprise, bitbucketServer (Bitbucket Data Center),
+      gitLabEnterpriseEdition (GitLab Self-Managed), and awsCodeCommit.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'git_provider' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'git_provider' in your JSON input")
 			}
 			return nil
 		}
@@ -164,6 +172,8 @@ func newDelete() *cobra.Command {
     CREDENTIAL_ID: The ID for the corresponding credential to access.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -185,7 +195,7 @@ func newDelete() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the id for the corresponding credential to access")
+			return errors.New("expected to have the id for the corresponding credential to access")
 		}
 		_, err = fmt.Sscan(args[0], &deleteReq.CredentialId)
 		if err != nil {
@@ -237,6 +247,8 @@ func newGet() *cobra.Command {
     CREDENTIAL_ID: The ID for the corresponding credential to access.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -258,7 +270,7 @@ func newGet() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the id for the corresponding credential to access")
+			return errors.New("expected to have the id for the corresponding credential to access")
 		}
 		_, err = fmt.Sscan(args[0], &getReq.CredentialId)
 		if err != nil {
@@ -317,6 +329,8 @@ func newList() *cobra.Command {
   Lists the calling user's Git credentials.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -384,17 +398,20 @@ func newUpdate() *cobra.Command {
   Arguments:
     CREDENTIAL_ID: The ID for the corresponding credential to access.
     GIT_PROVIDER: Git provider. This field is case-insensitive. The available Git providers
-      are gitHub, bitbucketCloud, gitLab, azureDevOpsServices,
-      gitHubEnterprise, bitbucketServer, gitLabEnterpriseEdition and
-      awsCodeCommit.`
+      are gitHub, bitbucketCloud, gitLab, azureDevOpsServices (Azure
+      DevOps Services, including Microsoft Entra ID authentication),
+      gitHubEnterprise, bitbucketServer (Bitbucket Data Center),
+      gitLabEnterpriseEdition (GitLab Self-Managed), and awsCodeCommit.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(1)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only CREDENTIAL_ID as positional arguments. Provide 'git_provider' in your JSON input")
+				return errors.New("when --json flag is specified, provide only CREDENTIAL_ID as positional arguments. Provide 'git_provider' in your JSON input")
 			}
 			return nil
 		}
diff --git a/cmd/workspace/global-init-scripts/global-init-scripts.go b/cmd/workspace/global-init-scripts/global-init-scripts.go
old mode 100755
new mode 100644
index c5a10c1e479..674173ea22b
--- a/cmd/workspace/global-init-scripts/global-init-scripts.go
+++ b/cmd/workspace/global-init-scripts/global-init-scripts.go
@@ -3,6 +3,7 @@
 package global_init_scripts
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -34,6 +35,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -80,12 +85,14 @@ func newCreate() *cobra.Command {
     SCRIPT: The Base64-encoded content of the script.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'script' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'script' in your JSON input")
 			}
 			return nil
 		}
@@ -161,6 +168,8 @@ func newDelete() *cobra.Command {
     SCRIPT_ID: The ID of the global init script.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -182,7 +191,7 @@ func newDelete() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the id of the global init script")
+			return errors.New("expected to have the id of the global init script")
 		}
 		deleteReq.ScriptId = args[0]
 
@@ -229,6 +238,8 @@ func newGet() *cobra.Command {
     SCRIPT_ID: The ID of the global init script.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -250,7 +261,7 @@ func newGet() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the id of the global init script")
+			return errors.New("expected to have the id of the global init script")
 		}
 		getReq.ScriptId = args[0]
 
@@ -304,6 +315,8 @@ func newList() *cobra.Command {
   script](:method:globalinitscripts/get) operation.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -365,12 +378,14 @@ func newUpdate() *cobra.Command {
     SCRIPT: The Base64-encoded content of the script.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(1)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only SCRIPT_ID as positional arguments. Provide 'name', 'script' in your JSON input")
+				return errors.New("when --json flag is specified, provide only SCRIPT_ID as positional arguments. Provide 'name', 'script' in your JSON input")
 			}
 			return nil
 		}
diff --git a/cmd/workspace/grants/grants.go b/cmd/workspace/grants/grants.go
old mode 100755
new mode 100644
index a92c3edfbd3..800e48fe5d2
--- a/cmd/workspace/grants/grants.go
+++ b/cmd/workspace/grants/grants.go
@@ -3,6 +3,8 @@
 package grants
 
 import (
+	"fmt"
+
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
 	"github.com/databricks/cli/libs/cmdio"
@@ -25,18 +27,23 @@ func New() *cobra.Command {
   object. Securable objects in Unity Catalog are hierarchical and privileges are
   inherited downward.
 
-  Securable objects in Unity Catalog are hierarchical and privileges are
-  inherited downward. This means that granting a privilege on the catalog
-  automatically grants the privilege to all current and future objects within
-  the catalog. Similarly, privileges granted on a schema are inherited by all
-  current and future objects within that schema.`,
+  This means that granting a privilege on the catalog automatically grants the
+  privilege to all current and future objects within the catalog. Similarly,
+  privileges granted on a schema are inherited by all current and future objects
+  within that schema.`,
 		GroupID: "catalog",
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newGet())
 	cmd.AddCommand(newGetEffective())
+	cmd.AddCommand(newList())
+	cmd.AddCommand(newListEffective())
 	cmd.AddCommand(newUpdate())
 
 	// Apply optional overrides to this command.
@@ -84,6 +91,8 @@ func newGet() *cobra.Command {
     FULL_NAME: Full name of securable.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -156,6 +165,8 @@ func newGetEffective() *cobra.Command {
     FULL_NAME: Full name of securable.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -190,6 +201,164 @@ func newGetEffective() *cobra.Command {
 	return cmd
 }
 
+// start list command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listOverrides []func(
+	*cobra.Command,
+	*catalog.ListPrivilegeAssignmentsRequest,
+)
+
+func newList() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listReq catalog.ListPrivilegeAssignmentsRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listLimit int
+
+	cmd.Flags().IntVar(&listReq.PageSize, "page-size", listReq.PageSize, `Specifies the maximum number of privilege assignments to return (page length).`)
+	cmd.Flags().StringVar(&listReq.Principal, "principal", listReq.Principal, `If provided, only the permissions for the specified principal (user or group) are returned.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listReq.PageToken, "page-token", listReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list SECURABLE_TYPE FULL_NAME"
+	cmd.Short = `List permissions.`
+	cmd.Long = `List permissions.
+
+  Lists the privilege assignments for a securable. Does not include inherited
+  privileges. Paginated version of Get Permissions API.
+
+  Arguments:
+    SECURABLE_TYPE: Type of securable.
+    FULL_NAME: Full name of securable.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		listReq.SecurableType = args[0]
+		listReq.FullName = args[1]
+
+		response := w.Grants.List(ctx, listReq)
+		if listLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listLimit)
+		}
+		if listLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listOverrides {
+		fn(cmd, &listReq)
+	}
+
+	return cmd
+}
+
+// start list-effective command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listEffectiveOverrides []func(
+	*cobra.Command,
+	*catalog.ListEffectivePrivilegeAssignmentsRequest,
+)
+
+func newListEffective() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listEffectiveReq catalog.ListEffectivePrivilegeAssignmentsRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listEffectiveLimit int
+
+	cmd.Flags().IntVar(&listEffectiveReq.PageSize, "page-size", listEffectiveReq.PageSize, `Specifies the maximum number of privilege assignments to return (page length).`)
+	cmd.Flags().StringVar(&listEffectiveReq.Principal, "principal", listEffectiveReq.Principal, `If provided, only the effective permissions for the specified principal (user or group) are returned.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listEffectiveLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listEffectiveReq.PageToken, "page-token", listEffectiveReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-effective SECURABLE_TYPE FULL_NAME"
+	cmd.Short = `List effective permissions.`
+	cmd.Long = `List effective permissions.
+
+  Lists the effective privilege assignments for a securable. Includes inherited
+  privileges. Paginated version of Get Effective Permissions API.
+
+  Arguments:
+    SECURABLE_TYPE: Type of securable.
+    FULL_NAME: Full name of securable.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		listEffectiveReq.SecurableType = args[0]
+		listEffectiveReq.FullName = args[1]
+
+		response := w.Grants.ListEffective(ctx, listEffectiveReq)
+		if listEffectiveLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listEffectiveLimit)
+		}
+		if listEffectiveLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listEffectiveLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listEffectiveOverrides {
+		fn(cmd, &listEffectiveReq)
+	}
+
+	return cmd
+}
+
 // start update command
 
 // Slice with functions to override default command behavior.
@@ -208,6 +377,7 @@ func newUpdate() *cobra.Command {
 	cmd.Flags().Var(&updateJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	// TODO: array: changes
+	cmd.Flags().BoolVar(&updateReq.OmitPermissionsInResponse, "omit-permissions-in-response", updateReq.OmitPermissionsInResponse, `Optional, default false.`)
 
 	cmd.Use = "update SECURABLE_TYPE FULL_NAME"
 	cmd.Short = `Update permissions.`
@@ -220,6 +390,8 @@ func newUpdate() *cobra.Command {
     FULL_NAME: Full name of securable.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
diff --git a/cmd/workspace/groups-v2/groups-v2.go b/cmd/workspace/groups-v2/groups-v2.go
old mode 100755
new mode 100644
index bc51d1a4927..64b5439cb7a
--- a/cmd/workspace/groups-v2/groups-v2.go
+++ b/cmd/workspace/groups-v2/groups-v2.go
@@ -20,8 +20,10 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "groups-v2",
-		Short: `Groups simplify identity management, making it easier to assign access to Databricks workspace, data, and other securable objects.`,
-		Long: `Groups simplify identity management, making it easier to assign access to
+		Short: `*Public Preview* Groups simplify identity management, making it easier to assign access to Databricks workspace, data, and other securable objects.`,
+		Long: `This command is in Public Preview and may change without notice.
+
+Groups simplify identity management, making it easier to assign access to
   Databricks workspace, data, and other securable objects.
 
   It is best practice to assign access to workspaces and access-control policies
@@ -32,6 +34,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -76,13 +82,17 @@ func newCreate() *cobra.Command {
 	// TODO: array: schemas
 
 	cmd.Use = "create"
-	cmd.Short = `Create a new group.`
-	cmd.Long = `Create a new group.
+	cmd.Short = `*Public Preview* Create a new group.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Create a new group.
 
   Creates a group in the Databricks workspace with a unique name, using the
   supplied group details.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -142,8 +152,10 @@ func newDelete() *cobra.Command {
 	var deleteReq iam.DeleteGroupRequest
 
 	cmd.Use = "delete ID"
-	cmd.Short = `Delete a group.`
-	cmd.Long = `Delete a group.
+	cmd.Short = `*Public Preview* Delete a group.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Delete a group.
 
   Deletes a group from the Databricks workspace.
 
@@ -151,6 +163,8 @@ func newDelete() *cobra.Command {
     ID: Unique ID for a group in the Databricks workspace.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -198,8 +212,10 @@ func newGet() *cobra.Command {
 	var getReq iam.GetGroupRequest
 
 	cmd.Use = "get ID"
-	cmd.Short = `Get group details.`
-	cmd.Long = `Get group details.
+	cmd.Short = `*Public Preview* Get group details.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get group details.
 
   Gets the information for a specific group in the Databricks workspace.
 
@@ -207,6 +223,8 @@ func newGet() *cobra.Command {
     ID: Unique ID for a group in the Databricks workspace.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -274,12 +292,16 @@ func newList() *cobra.Command {
 	cmd.Flags().Lookup("count").Hidden = true
 
 	cmd.Use = "list"
-	cmd.Short = `List group details.`
-	cmd.Long = `List group details.
+	cmd.Short = `*Public Preview* List group details.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+List group details.
 
   Gets all details of the groups associated with the Databricks workspace.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -335,8 +357,10 @@ func newPatch() *cobra.Command {
 	// TODO: array: schemas
 
 	cmd.Use = "patch ID"
-	cmd.Short = `Update group details.`
-	cmd.Long = `Update group details.
+	cmd.Short = `*Public Preview* Update group details.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Update group details.
 
   Partially updates the details of a group.
 
@@ -344,6 +368,8 @@ func newPatch() *cobra.Command {
     ID: Unique ID in the Databricks workspace.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -415,8 +441,10 @@ func newUpdate() *cobra.Command {
 	// TODO: array: schemas
 
 	cmd.Use = "update ID"
-	cmd.Short = `Replace a group.`
-	cmd.Long = `Replace a group.
+	cmd.Short = `*Public Preview* Replace a group.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Replace a group.
 
   Updates the details of a group by replacing the entire group entity.
 
@@ -424,6 +452,8 @@ func newUpdate() *cobra.Command {
     ID: Databricks group ID`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/workspace/groups.go b/cmd/workspace/groups.go
index 8dd096ee630..02f7cc8d70a 100644
--- a/cmd/workspace/groups.go
+++ b/cmd/workspace/groups.go
@@ -16,6 +16,10 @@ func Groups() []cobra.Group {
 			ID:    "compute",
 			Title: "Compute",
 		},
+		{
+			ID:    "sandbox",
+			Title: "Sandbox",
+		},
 		{
 			ID:    "lakeflow",
 			Title: "Lakeflow",
@@ -40,6 +44,10 @@ func Groups() []cobra.Group {
 			ID:    "vectorsearch",
 			Title: "Vector Search",
 		},
+		{
+			ID:    "aisearch",
+			Title: "AI Search",
+		},
 		{
 			ID:    "iam",
 			Title: "Identity and Access Management",
@@ -58,7 +66,7 @@ func Groups() []cobra.Group {
 		},
 		{
 			ID:    "sharing",
-			Title: "Delta Sharing",
+			Title: "Open Sharing",
 		},
 		{
 			ID:    "settings",
@@ -96,6 +104,10 @@ func Groups() []cobra.Group {
 			ID:    "agentbricks",
 			Title: "Agent Bricks",
 		},
+		{
+			ID:    "aifunctions",
+			Title: "AI Functions",
+		},
 		{
 			ID:    "tags",
 			Title: "Tags",
@@ -108,5 +120,13 @@ func Groups() []cobra.Group {
 			ID:    "environments",
 			Title: "Environments",
 		},
+		{
+			ID:    "bundledeployments",
+			Title: "Bundle Deployments",
+		},
+		{
+			ID:    "domains",
+			Title: "Domains",
+		},
 	}
 }
diff --git a/cmd/workspace/instance-pools/instance-pools.go b/cmd/workspace/instance-pools/instance-pools.go
old mode 100755
new mode 100644
index e1f69f62a88..5a2b996c2e0
--- a/cmd/workspace/instance-pools/instance-pools.go
+++ b/cmd/workspace/instance-pools/instance-pools.go
@@ -3,6 +3,7 @@
 package instance_pools
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -43,6 +44,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -107,15 +112,19 @@ func newCreate() *cobra.Command {
       each of the Spark nodes in this cluster. For example, the Spark nodes can
       be provisioned and optimized for memory or compute intensive workloads. A
       list of available node types can be retrieved by using the
-      :method:clusters/listNodeTypes API call.`
+      [clusters/listNodeTypes] API call.
+
+      [clusters/listNodeTypes]: https://docs.databricks.com/api/workspace/clusters/listnodetypes`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'instance_pool_name', 'node_type_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'instance_pool_name', 'node_type_id' in your JSON input")
 			}
 			return nil
 		}
@@ -195,12 +204,14 @@ func newDelete() *cobra.Command {
     INSTANCE_POOL_ID: The instance pool to be terminated.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'instance_pool_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'instance_pool_id' in your JSON input")
 			}
 			return nil
 		}
@@ -239,7 +250,7 @@ func newDelete() *cobra.Command {
 				args = append(args, id)
 			}
 			if len(args) != 1 {
-				return fmt.Errorf("expected to have the instance pool to be terminated")
+				return errors.New("expected to have the instance pool to be terminated")
 			}
 			deleteReq.InstancePoolId = args[0]
 		}
@@ -301,15 +312,19 @@ func newEdit() *cobra.Command {
       each of the Spark nodes in this cluster. For example, the Spark nodes can
       be provisioned and optimized for memory or compute intensive workloads. A
       list of available node types can be retrieved by using the
-      :method:clusters/listNodeTypes API call.`
+      [clusters/listNodeTypes] API call.
+
+      [clusters/listNodeTypes]: https://docs.databricks.com/api/workspace/clusters/listnodetypes`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'instance_pool_id', 'instance_pool_name', 'node_type_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'instance_pool_id', 'instance_pool_name', 'node_type_id' in your JSON input")
 			}
 			return nil
 		}
@@ -387,6 +402,8 @@ func newGet() *cobra.Command {
     INSTANCE_POOL_ID: The canonical unique identifier for the instance pool.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -408,7 +425,7 @@ func newGet() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the canonical unique identifier for the instance pool")
+			return errors.New("expected to have the canonical unique identifier for the instance pool")
 		}
 		getReq.InstancePoolId = args[0]
 
@@ -456,6 +473,8 @@ func newGetPermissionLevels() *cobra.Command {
     INSTANCE_POOL_ID: The instance pool for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -477,7 +496,7 @@ func newGetPermissionLevels() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the instance pool for which to get or manage permissions")
+			return errors.New("expected to have the instance pool for which to get or manage permissions")
 		}
 		getPermissionLevelsReq.InstancePoolId = args[0]
 
@@ -526,6 +545,8 @@ func newGetPermissions() *cobra.Command {
     INSTANCE_POOL_ID: The instance pool for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -547,7 +568,7 @@ func newGetPermissions() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the instance pool for which to get or manage permissions")
+			return errors.New("expected to have the instance pool for which to get or manage permissions")
 		}
 		getPermissionsReq.InstancePoolId = args[0]
 
@@ -598,6 +619,8 @@ func newList() *cobra.Command {
   Gets a list of instance pools with their statistics.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -657,6 +680,8 @@ func newSetPermissions() *cobra.Command {
     INSTANCE_POOL_ID: The instance pool for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -690,7 +715,7 @@ func newSetPermissions() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the instance pool for which to get or manage permissions")
+			return errors.New("expected to have the instance pool for which to get or manage permissions")
 		}
 		setPermissionsReq.InstancePoolId = args[0]
 
@@ -744,6 +769,8 @@ func newUpdatePermissions() *cobra.Command {
     INSTANCE_POOL_ID: The instance pool for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -777,7 +804,7 @@ func newUpdatePermissions() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the instance pool for which to get or manage permissions")
+			return errors.New("expected to have the instance pool for which to get or manage permissions")
 		}
 		updatePermissionsReq.InstancePoolId = args[0]
 
diff --git a/cmd/workspace/instance-profiles/instance-profiles.go b/cmd/workspace/instance-profiles/instance-profiles.go
old mode 100755
new mode 100644
index 190ea50fb12..8ddbdaf8f2f
--- a/cmd/workspace/instance-profiles/instance-profiles.go
+++ b/cmd/workspace/instance-profiles/instance-profiles.go
@@ -3,6 +3,7 @@
 package instance_profiles
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -31,6 +32,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newAdd())
 	cmd.AddCommand(newEdit())
@@ -80,12 +85,14 @@ func newAdd() *cobra.Command {
       field is required.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'instance_profile_arn' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'instance_profile_arn' in your JSON input")
 			}
 			return nil
 		}
@@ -178,12 +185,14 @@ func newEdit() *cobra.Command {
       field is required.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'instance_profile_arn' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'instance_profile_arn' in your JSON input")
 			}
 			return nil
 		}
@@ -260,6 +269,8 @@ func newList() *cobra.Command {
   This API is available to all users.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -318,12 +329,14 @@ func newRemove() *cobra.Command {
     INSTANCE_PROFILE_ARN: The ARN of the instance profile to remove. This field is required.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'instance_profile_arn' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'instance_profile_arn' in your JSON input")
 			}
 			return nil
 		}
diff --git a/cmd/workspace/ip-access-lists/ip-access-lists.go b/cmd/workspace/ip-access-lists/ip-access-lists.go
old mode 100755
new mode 100644
index 2dfec2fb473..2916a1d55b0
--- a/cmd/workspace/ip-access-lists/ip-access-lists.go
+++ b/cmd/workspace/ip-access-lists/ip-access-lists.go
@@ -3,6 +3,7 @@
 package ip_access_lists
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -46,6 +47,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -100,7 +105,9 @@ func newCreate() *cobra.Command {
 
   It can take a few minutes for the changes to take effect. **Note**: Your new
   IP access list has no effect until you enable the feature. See
-  :method:workspaceconf/setStatus
+  [workspaceconf/setStatus]
+
+  [workspaceconf/setStatus]: https://docs.databricks.com/api/workspace/workspaceconf/setstatus
 
   Arguments:
     LABEL: Label for the IP access list. This **cannot** be empty.
@@ -108,12 +115,14 @@ func newCreate() *cobra.Command {
       Supported values: [ALLOW, BLOCK]`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'label', 'list_type' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'label', 'list_type' in your JSON input")
 			}
 			return nil
 		}
@@ -193,6 +202,8 @@ func newDelete() *cobra.Command {
     IP_ACCESS_LIST_ID: The ID for the corresponding IP access list`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -214,7 +225,7 @@ func newDelete() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the id for the corresponding ip access list")
+			return errors.New("expected to have the id for the corresponding ip access list")
 		}
 		deleteReq.IpAccessListId = args[0]
 
@@ -261,6 +272,8 @@ func newGet() *cobra.Command {
     IP_ACCESS_LIST_ID: The ID for the corresponding IP access list`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -282,7 +295,7 @@ func newGet() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the id for the corresponding ip access list")
+			return errors.New("expected to have the id for the corresponding ip access list")
 		}
 		getReq.IpAccessListId = args[0]
 
@@ -333,6 +346,8 @@ func newList() *cobra.Command {
   Gets all IP access lists for the specified workspace.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -395,7 +410,9 @@ func newReplace() *cobra.Command {
   calling user's current IP, error 400 is returned with error_code value
   INVALID_STATE. It can take a few minutes for the changes to take effect.
   Note that your resulting IP access list has no effect until you enable the
-  feature. See :method:workspaceconf/setStatus.
+  feature. See [workspaceconf/setStatus].
+
+  [workspaceconf/setStatus]: https://docs.databricks.com/api/workspace/workspaceconf/setstatus
 
   Arguments:
     IP_ACCESS_LIST_ID: The ID for the corresponding IP access list
@@ -405,12 +422,14 @@ func newReplace() *cobra.Command {
     ENABLED: Specifies whether this IP access list is enabled.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(1)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only IP_ACCESS_LIST_ID as positional arguments. Provide 'label', 'list_type', 'enabled' in your JSON input")
+				return errors.New("when --json flag is specified, provide only IP_ACCESS_LIST_ID as positional arguments. Provide 'label', 'list_type', 'enabled' in your JSON input")
 			}
 			return nil
 		}
@@ -514,12 +533,16 @@ func newUpdate() *cobra.Command {
 
   It can take a few minutes for the changes to take effect. Note that your
   resulting IP access list has no effect until you enable the feature. See
-  :method:workspaceconf/setStatus.
+  [workspaceconf/setStatus].
+
+  [workspaceconf/setStatus]: https://docs.databricks.com/api/workspace/workspaceconf/setstatus
 
   Arguments:
     IP_ACCESS_LIST_ID: The ID for the corresponding IP access list`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -553,7 +576,7 @@ func newUpdate() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the id for the corresponding ip access list")
+			return errors.New("expected to have the id for the corresponding ip access list")
 		}
 		updateReq.IpAccessListId = args[0]
 
diff --git a/cmd/workspace/jobs/jobs.go b/cmd/workspace/jobs/jobs.go
old mode 100755
new mode 100644
index 20b1ca221cf..17d8aff87cf
--- a/cmd/workspace/jobs/jobs.go
+++ b/cmd/workspace/jobs/jobs.go
@@ -3,6 +3,7 @@
 package jobs
 
 import (
+	"errors"
 	"fmt"
 	"time"
 
@@ -44,6 +45,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCancelAllRuns())
 	cmd.AddCommand(newCancelRun())
@@ -102,6 +107,8 @@ func newCancelAllRuns() *cobra.Command {
   doesn't prevent new runs from being started.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -179,12 +186,14 @@ func newCancelRun() *cobra.Command {
     RUN_ID: This field is required.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'run_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'run_id' in your JSON input")
 			}
 			return nil
 		}
@@ -223,7 +232,7 @@ func newCancelRun() *cobra.Command {
 				args = append(args, id)
 			}
 			if len(args) != 1 {
-				return fmt.Errorf("expected to have this field is required")
+				return errors.New("expected to have this field is required")
 			}
 			_, err = fmt.Sscan(args[0], &cancelRunReq.RunId)
 			if err != nil {
@@ -292,6 +301,8 @@ func newCreate() *cobra.Command {
 	cmd.Long = `Create a new job.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -310,7 +321,7 @@ func newCreate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := w.Jobs.Create(ctx, createReq)
@@ -360,12 +371,14 @@ func newDelete() *cobra.Command {
     JOB_ID: The canonical identifier of the job to delete. This field is required.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'job_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'job_id' in your JSON input")
 			}
 			return nil
 		}
@@ -404,7 +417,7 @@ func newDelete() *cobra.Command {
 				args = append(args, id)
 			}
 			if len(args) != 1 {
-				return fmt.Errorf("expected to have the canonical identifier of the job to delete")
+				return errors.New("expected to have the canonical identifier of the job to delete")
 			}
 			_, err = fmt.Sscan(args[0], &deleteReq.JobId)
 			if err != nil {
@@ -459,12 +472,14 @@ func newDeleteRun() *cobra.Command {
     RUN_ID: ID of the run to delete.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'run_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'run_id' in your JSON input")
 			}
 			return nil
 		}
@@ -503,7 +518,7 @@ func newDeleteRun() *cobra.Command {
 				args = append(args, id)
 			}
 			if len(args) != 1 {
-				return fmt.Errorf("expected to have id of the run to delete")
+				return errors.New("expected to have id of the run to delete")
 			}
 			_, err = fmt.Sscan(args[0], &deleteRunReq.RunId)
 			if err != nil {
@@ -557,6 +572,8 @@ func newExportRun() *cobra.Command {
     RUN_ID: The canonical identifier for the run. This field is required.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -578,7 +595,7 @@ func newExportRun() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the canonical identifier for the run")
+			return errors.New("expected to have the canonical identifier for the run")
 		}
 		_, err = fmt.Sscan(args[0], &exportRunReq.RunId)
 		if err != nil {
@@ -619,6 +636,7 @@ func newGet() *cobra.Command {
 
 	var getReq jobs.GetJobRequest
 
+	cmd.Flags().BoolVar(&getReq.IncludeTriggerState, "include-trigger-state", getReq.IncludeTriggerState, `Flag that indicates that trigger state should be included in the response.`)
 	cmd.Flags().StringVar(&getReq.PageToken, "page-token", getReq.PageToken, `Use next_page_token returned from the previous GetJob response to request the next page of the job's array properties.`)
 
 	cmd.Use = "get JOB_ID"
@@ -641,6 +659,8 @@ func newGet() *cobra.Command {
       field is required.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -662,7 +682,7 @@ func newGet() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the canonical identifier of the job to retrieve information about")
+			return errors.New("expected to have the canonical identifier of the job to retrieve information about")
 		}
 		_, err = fmt.Sscan(args[0], &getReq.JobId)
 		if err != nil {
@@ -713,6 +733,8 @@ func newGetPermissionLevels() *cobra.Command {
     JOB_ID: The job for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -734,7 +756,7 @@ func newGetPermissionLevels() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the job for which to get or manage permissions")
+			return errors.New("expected to have the job for which to get or manage permissions")
 		}
 		getPermissionLevelsReq.JobId = args[0]
 
@@ -783,6 +805,8 @@ func newGetPermissions() *cobra.Command {
     JOB_ID: The job for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -804,7 +828,7 @@ func newGetPermissions() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the job for which to get or manage permissions")
+			return errors.New("expected to have the job for which to get or manage permissions")
 		}
 		getPermissionsReq.JobId = args[0]
 
@@ -866,6 +890,8 @@ func newGetRun() *cobra.Command {
       This field is required.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -887,7 +913,7 @@ func newGetRun() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the canonical identifier of the run for which to retrieve the metadata")
+			return errors.New("expected to have the canonical identifier of the run for which to retrieve the metadata")
 		}
 		_, err = fmt.Sscan(args[0], &getRunReq.RunId)
 		if err != nil {
@@ -947,6 +973,8 @@ func newGetRunOutput() *cobra.Command {
     RUN_ID: The canonical identifier for the run.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -968,7 +996,7 @@ func newGetRunOutput() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the canonical identifier for the run")
+			return errors.New("expected to have the canonical identifier for the run")
 		}
 		_, err = fmt.Sscan(args[0], &getRunOutputReq.RunId)
 		if err != nil {
@@ -1033,6 +1061,8 @@ func newList() *cobra.Command {
   Retrieves a list of jobs.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -1110,6 +1140,8 @@ func newListRuns() *cobra.Command {
   List runs in descending order by start time.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -1168,6 +1200,7 @@ func newRepairRun() *cobra.Command {
 	cmd.Flags().Var(&repairRunJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	// TODO: array: dbt_commands
+	cmd.Flags().StringVar(&repairRunReq.DurationTarget, "duration-target", repairRunReq.DurationTarget, `The window the run aims to finish within, in hours, for a Cost-optimized serverless run.`)
 	// TODO: array: jar_params
 	// TODO: map via StringToStringVar: job_parameters
 	cmd.Flags().Int64Var(&repairRunReq.LatestRepairId, "latest-repair-id", repairRunReq.LatestRepairId, `The ID of the latest repair.`)
@@ -1194,12 +1227,14 @@ func newRepairRun() *cobra.Command {
     RUN_ID: The job run ID of the run to repair. The run must not be in progress.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'run_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'run_id' in your JSON input")
 			}
 			return nil
 		}
@@ -1238,7 +1273,7 @@ func newRepairRun() *cobra.Command {
 				args = append(args, id)
 			}
 			if len(args) != 1 {
-				return fmt.Errorf("expected to have the job run id of the run to repair")
+				return errors.New("expected to have the job run id of the run to repair")
 			}
 			_, err = fmt.Sscan(args[0], &repairRunReq.RunId)
 			if err != nil {
@@ -1310,6 +1345,8 @@ func newReset() *cobra.Command {
   endpoint](:method:jobs/update) to update job settings partially.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -1328,7 +1365,7 @@ func newReset() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		err = w.Jobs.Reset(ctx, resetReq)
@@ -1374,6 +1411,7 @@ func newRunNow() *cobra.Command {
 	cmd.Flags().Var(&runNowJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	// TODO: array: dbt_commands
+	cmd.Flags().StringVar(&runNowReq.DurationTarget, "duration-target", runNowReq.DurationTarget, `The window the run aims to finish within, in hours, for a Cost-optimized serverless run.`)
 	cmd.Flags().StringVar(&runNowReq.IdempotencyToken, "idempotency-token", runNowReq.IdempotencyToken, `An optional token to guarantee the idempotency of job run requests.`)
 	// TODO: array: jar_params
 	// TODO: map via StringToStringVar: job_parameters
@@ -1397,12 +1435,14 @@ func newRunNow() *cobra.Command {
     JOB_ID: The ID of the job to be executed`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'job_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'job_id' in your JSON input")
 			}
 			return nil
 		}
@@ -1441,7 +1481,7 @@ func newRunNow() *cobra.Command {
 				args = append(args, id)
 			}
 			if len(args) != 1 {
-				return fmt.Errorf("expected to have the id of the job to be executed")
+				return errors.New("expected to have the id of the job to be executed")
 			}
 			_, err = fmt.Sscan(args[0], &runNowReq.JobId)
 			if err != nil {
@@ -1519,6 +1559,8 @@ func newSetPermissions() *cobra.Command {
     JOB_ID: The job for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -1552,7 +1594,7 @@ func newSetPermissions() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the job for which to get or manage permissions")
+			return errors.New("expected to have the job for which to get or manage permissions")
 		}
 		setPermissionsReq.JobId = args[0]
 
@@ -1601,12 +1643,15 @@ func newSubmit() *cobra.Command {
 
 	// TODO: array: access_control_list
 	cmd.Flags().StringVar(&submitReq.BudgetPolicyId, "budget-policy-id", submitReq.BudgetPolicyId, `The user specified id of the budget policy to use for this one-time run.`)
+	cmd.Flags().StringVar(&submitReq.DurationTarget, "duration-target", submitReq.DurationTarget, `The window the run aims to finish within, in hours, for a Cost-optimized serverless run.`)
 	// TODO: complex arg: email_notifications
+	// TODO: array: environment_variables
 	// TODO: array: environments
 	// TODO: complex arg: git_source
 	// TODO: complex arg: health
 	cmd.Flags().StringVar(&submitReq.IdempotencyToken, "idempotency-token", submitReq.IdempotencyToken, `An optional token that can be used to guarantee the idempotency of job run requests.`)
 	// TODO: complex arg: notification_settings
+	cmd.Flags().Var(&submitReq.PerformanceTarget, "performance-target", `The performance mode on a serverless one-time run. Supported values: [PERFORMANCE_OPTIMIZED, STANDARD]`)
 	// TODO: complex arg: queue
 	// TODO: complex arg: run_as
 	cmd.Flags().StringVar(&submitReq.RunName, "run-name", submitReq.RunName, `An optional name for the run.`)
@@ -1632,6 +1677,8 @@ func newSubmit() *cobra.Command {
   POST /jobs/run-now endpoints to create and run a saved job.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -1725,12 +1772,14 @@ func newUpdate() *cobra.Command {
     JOB_ID: The canonical identifier of the job to update. This field is required.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'job_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'job_id' in your JSON input")
 			}
 			return nil
 		}
@@ -1769,7 +1818,7 @@ func newUpdate() *cobra.Command {
 				args = append(args, id)
 			}
 			if len(args) != 1 {
-				return fmt.Errorf("expected to have the canonical identifier of the job to update")
+				return errors.New("expected to have the canonical identifier of the job to update")
 			}
 			_, err = fmt.Sscan(args[0], &updateReq.JobId)
 			if err != nil {
@@ -1827,6 +1876,8 @@ func newUpdatePermissions() *cobra.Command {
     JOB_ID: The job for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -1860,7 +1911,7 @@ func newUpdatePermissions() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the job for which to get or manage permissions")
+			return errors.New("expected to have the job for which to get or manage permissions")
 		}
 		updatePermissionsReq.JobId = args[0]
 
diff --git a/cmd/workspace/knowledge-assistants/knowledge-assistants.go b/cmd/workspace/knowledge-assistants/knowledge-assistants.go
old mode 100755
new mode 100644
index f72403a61ab..86fa0ec60c8
--- a/cmd/workspace/knowledge-assistants/knowledge-assistants.go
+++ b/cmd/workspace/knowledge-assistants/knowledge-assistants.go
@@ -3,6 +3,7 @@
 package knowledge_assistants
 
 import (
+	"errors"
 	"fmt"
 	"strings"
 
@@ -21,25 +22,40 @@ var cmdOverrides []func(*cobra.Command)
 
 func New() *cobra.Command {
 	cmd := &cobra.Command{
-		Use:     "knowledge-assistants",
-		Short:   `Manage Knowledge Assistants and related resources.`,
-		Long:    `Manage Knowledge Assistants and related resources.`,
+		Use:   "knowledge-assistants",
+		Short: `*Beta* Manage legacy Knowledge Assistants and related resources.`,
+		Long: `This command is in Beta and may change without notice.
+
+Manage legacy Knowledge Assistants and related resources.`,
 		GroupID: "agentbricks",
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
 	// Add methods
+	cmd.AddCommand(newCreateExample())
 	cmd.AddCommand(newCreateKnowledgeAssistant())
 	cmd.AddCommand(newCreateKnowledgeSource())
+	cmd.AddCommand(newDeleteExample())
 	cmd.AddCommand(newDeleteKnowledgeAssistant())
 	cmd.AddCommand(newDeleteKnowledgeSource())
+	cmd.AddCommand(newGetExample())
 	cmd.AddCommand(newGetKnowledgeAssistant())
 	cmd.AddCommand(newGetKnowledgeSource())
+	cmd.AddCommand(newGetPermissionLevels())
+	cmd.AddCommand(newGetPermissions())
+	cmd.AddCommand(newListExamples())
 	cmd.AddCommand(newListKnowledgeAssistants())
 	cmd.AddCommand(newListKnowledgeSources())
+	cmd.AddCommand(newSetPermissions())
 	cmd.AddCommand(newSyncKnowledgeSources())
+	cmd.AddCommand(newUpdateExample())
 	cmd.AddCommand(newUpdateKnowledgeAssistant())
 	cmd.AddCommand(newUpdateKnowledgeSource())
+	cmd.AddCommand(newUpdatePermissions())
 
 	// Apply optional overrides to this command.
 	for _, fn := range cmdOverrides {
@@ -49,6 +65,98 @@ func New() *cobra.Command {
 	return cmd
 }
 
+// start create-example command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var createExampleOverrides []func(
+	*cobra.Command,
+	*knowledgeassistants.CreateExampleRequest,
+)
+
+func newCreateExample() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var createExampleReq knowledgeassistants.CreateExampleRequest
+	createExampleReq.Example = knowledgeassistants.Example{}
+	var createExampleJson flags.JsonFlag
+
+	cmd.Flags().Var(&createExampleJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: guidelines
+	cmd.Flags().StringVar(&createExampleReq.Example.Name, "name", createExampleReq.Example.Name, `Full resource name: knowledge-assistants/{knowledge_assistant_id}/examples/{example_id}.`)
+
+	cmd.Use = "create-example PARENT QUESTION"
+	cmd.Short = `*Beta* Create an example for a Knowledge Assistant.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Create an example for a Knowledge Assistant.
+
+  Creates an example for a Knowledge Assistant.
+
+  Arguments:
+    PARENT: Parent resource where this example will be created. Format:
+      knowledge-assistants/{knowledge_assistant_id}
+    QUESTION: The example question.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(1)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only PARENT as positional arguments. Provide 'question' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := createExampleJson.Unmarshal(&createExampleReq.Example)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		createExampleReq.Parent = args[0]
+		if !cmd.Flags().Changed("json") {
+			createExampleReq.Example.Question = args[1]
+		}
+
+		response, err := w.KnowledgeAssistants.CreateExample(ctx, createExampleReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range createExampleOverrides {
+		fn(cmd, &createExampleReq)
+	}
+
+	return cmd
+}
+
 // start create-knowledge-assistant command
 
 // Slice with functions to override default command behavior.
@@ -71,8 +179,10 @@ func newCreateKnowledgeAssistant() *cobra.Command {
 	cmd.Flags().StringVar(&createKnowledgeAssistantReq.KnowledgeAssistant.Name, "name", createKnowledgeAssistantReq.KnowledgeAssistant.Name, `The resource name of the Knowledge Assistant.`)
 
 	cmd.Use = "create-knowledge-assistant DISPLAY_NAME DESCRIPTION"
-	cmd.Short = `Create a Knowledge Assistant.`
-	cmd.Long = `Create a Knowledge Assistant.
+	cmd.Short = `*Beta* Create a Knowledge Assistant.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Create a Knowledge Assistant.
 
   Creates a Knowledge Assistant.
 
@@ -85,12 +195,14 @@ func newCreateKnowledgeAssistant() *cobra.Command {
       optional unless included in update_mask.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'display_name', 'description' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'display_name', 'description' in your JSON input")
 			}
 			return nil
 		}
@@ -166,8 +278,10 @@ func newCreateKnowledgeSource() *cobra.Command {
 	cmd.Flags().StringVar(&createKnowledgeSourceReq.KnowledgeSource.Name, "name", createKnowledgeSourceReq.KnowledgeSource.Name, `Full resource name: knowledge-assistants/{knowledge_assistant_id}/knowledge-sources/{knowledge_source_id}.`)
 
 	cmd.Use = "create-knowledge-source PARENT DISPLAY_NAME DESCRIPTION SOURCE_TYPE"
-	cmd.Short = `Create a Knowledge Source.`
-	cmd.Long = `Create a Knowledge Source.
+	cmd.Short = `*Beta* Create a Knowledge Source.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Create a Knowledge Source.
 
   Creates a Knowledge Source under a Knowledge Assistant.
 
@@ -185,12 +299,14 @@ func newCreateKnowledgeSource() *cobra.Command {
       is ignored.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(1)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only PARENT as positional arguments. Provide 'display_name', 'description', 'source_type' in your JSON input")
+				return errors.New("when --json flag is specified, provide only PARENT as positional arguments. Provide 'display_name', 'description', 'source_type' in your JSON input")
 			}
 			return nil
 		}
@@ -246,6 +362,67 @@ func newCreateKnowledgeSource() *cobra.Command {
 	return cmd
 }
 
+// start delete-example command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteExampleOverrides []func(
+	*cobra.Command,
+	*knowledgeassistants.DeleteExampleRequest,
+)
+
+func newDeleteExample() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteExampleReq knowledgeassistants.DeleteExampleRequest
+
+	cmd.Use = "delete-example NAME"
+	cmd.Short = `*Beta* Delete an example from a Knowledge Assistant.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Delete an example from a Knowledge Assistant.
+
+  Deletes an example from a Knowledge Assistant.
+
+  Arguments:
+    NAME: The resource name of the example to delete. Format:
+      knowledge-assistants/{knowledge_assistant_id}/examples/{example_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		deleteExampleReq.Name = args[0]
+
+		err = w.KnowledgeAssistants.DeleteExample(ctx, deleteExampleReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteExampleOverrides {
+		fn(cmd, &deleteExampleReq)
+	}
+
+	return cmd
+}
+
 // start delete-knowledge-assistant command
 
 // Slice with functions to override default command behavior.
@@ -261,8 +438,10 @@ func newDeleteKnowledgeAssistant() *cobra.Command {
 	var deleteKnowledgeAssistantReq knowledgeassistants.DeleteKnowledgeAssistantRequest
 
 	cmd.Use = "delete-knowledge-assistant NAME"
-	cmd.Short = `Delete a Knowledge Assistant.`
-	cmd.Long = `Delete a Knowledge Assistant.
+	cmd.Short = `*Beta* Delete a Knowledge Assistant.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Delete a Knowledge Assistant.
 
   Deletes a Knowledge Assistant.
 
@@ -271,6 +450,8 @@ func newDeleteKnowledgeAssistant() *cobra.Command {
       knowledge-assistants/{knowledge_assistant_id}`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -318,8 +499,10 @@ func newDeleteKnowledgeSource() *cobra.Command {
 	var deleteKnowledgeSourceReq knowledgeassistants.DeleteKnowledgeSourceRequest
 
 	cmd.Use = "delete-knowledge-source NAME"
-	cmd.Short = `Delete a Knowledge Source.`
-	cmd.Long = `Delete a Knowledge Source.
+	cmd.Short = `*Beta* Delete a Knowledge Source.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Delete a Knowledge Source.
 
   Deletes a Knowledge Source.
 
@@ -328,6 +511,8 @@ func newDeleteKnowledgeSource() *cobra.Command {
       knowledge-assistants/{knowledge_assistant_id}/knowledge-sources/{knowledge_source_id}`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -360,6 +545,68 @@ func newDeleteKnowledgeSource() *cobra.Command {
 	return cmd
 }
 
+// start get-example command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getExampleOverrides []func(
+	*cobra.Command,
+	*knowledgeassistants.GetExampleRequest,
+)
+
+func newGetExample() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getExampleReq knowledgeassistants.GetExampleRequest
+
+	cmd.Use = "get-example NAME"
+	cmd.Short = `*Beta* Get an example from a Knowledge Assistant.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get an example from a Knowledge Assistant.
+
+  Gets an example from a Knowledge Assistant.
+
+  Arguments:
+    NAME: The resource name of the example. Format:
+      knowledge-assistants/{knowledge_assistant_id}/examples/{example_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getExampleReq.Name = args[0]
+
+		response, err := w.KnowledgeAssistants.GetExample(ctx, getExampleReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getExampleOverrides {
+		fn(cmd, &getExampleReq)
+	}
+
+	return cmd
+}
+
 // start get-knowledge-assistant command
 
 // Slice with functions to override default command behavior.
@@ -375,8 +622,10 @@ func newGetKnowledgeAssistant() *cobra.Command {
 	var getKnowledgeAssistantReq knowledgeassistants.GetKnowledgeAssistantRequest
 
 	cmd.Use = "get-knowledge-assistant NAME"
-	cmd.Short = `Get a Knowledge Assistant.`
-	cmd.Long = `Get a Knowledge Assistant.
+	cmd.Short = `*Beta* Get a Knowledge Assistant.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get a Knowledge Assistant.
 
   Gets a Knowledge Assistant.
 
@@ -385,6 +634,8 @@ func newGetKnowledgeAssistant() *cobra.Command {
       knowledge-assistants/{knowledge_assistant_id}`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -433,8 +684,10 @@ func newGetKnowledgeSource() *cobra.Command {
 	var getKnowledgeSourceReq knowledgeassistants.GetKnowledgeSourceRequest
 
 	cmd.Use = "get-knowledge-source NAME"
-	cmd.Short = `Get a Knowledge Source.`
-	cmd.Long = `Get a Knowledge Source.
+	cmd.Short = `*Beta* Get a Knowledge Source.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get a Knowledge Source.
 
   Gets a Knowledge Source.
 
@@ -443,6 +696,8 @@ func newGetKnowledgeSource() *cobra.Command {
       knowledge-assistants/{knowledge_assistant_id}/knowledge-sources/{knowledge_source_id}`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -476,6 +731,207 @@ func newGetKnowledgeSource() *cobra.Command {
 	return cmd
 }
 
+// start get-permission-levels command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getPermissionLevelsOverrides []func(
+	*cobra.Command,
+	*knowledgeassistants.GetKnowledgeAssistantPermissionLevelsRequest,
+)
+
+func newGetPermissionLevels() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getPermissionLevelsReq knowledgeassistants.GetKnowledgeAssistantPermissionLevelsRequest
+
+	cmd.Use = "get-permission-levels KNOWLEDGE_ASSISTANT_ID"
+	cmd.Short = `*Beta* Get knowledge assistant permission levels.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get knowledge assistant permission levels.
+
+  Gets the permission levels that a user can have on an object.
+
+  Arguments:
+    KNOWLEDGE_ASSISTANT_ID: The knowledge assistant for which to get or manage permissions.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getPermissionLevelsReq.KnowledgeAssistantId = args[0]
+
+		response, err := w.KnowledgeAssistants.GetPermissionLevels(ctx, getPermissionLevelsReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getPermissionLevelsOverrides {
+		fn(cmd, &getPermissionLevelsReq)
+	}
+
+	return cmd
+}
+
+// start get-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getPermissionsOverrides []func(
+	*cobra.Command,
+	*knowledgeassistants.GetKnowledgeAssistantPermissionsRequest,
+)
+
+func newGetPermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getPermissionsReq knowledgeassistants.GetKnowledgeAssistantPermissionsRequest
+
+	cmd.Use = "get-permissions KNOWLEDGE_ASSISTANT_ID"
+	cmd.Short = `*Beta* Get knowledge assistant permissions.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get knowledge assistant permissions.
+
+  Gets the permissions of a knowledge assistant. Knowledge assistants can
+  inherit permissions from their root object.
+
+  Arguments:
+    KNOWLEDGE_ASSISTANT_ID: The knowledge assistant for which to get or manage permissions.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getPermissionsReq.KnowledgeAssistantId = args[0]
+
+		response, err := w.KnowledgeAssistants.GetPermissions(ctx, getPermissionsReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getPermissionsOverrides {
+		fn(cmd, &getPermissionsReq)
+	}
+
+	return cmd
+}
+
+// start list-examples command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listExamplesOverrides []func(
+	*cobra.Command,
+	*knowledgeassistants.ListExamplesRequest,
+)
+
+func newListExamples() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listExamplesReq knowledgeassistants.ListExamplesRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listExamplesLimit int
+
+	cmd.Flags().IntVar(&listExamplesReq.PageSize, "page-size", listExamplesReq.PageSize, `The maximum number of examples to return.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listExamplesLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listExamplesReq.PageToken, "page-token", listExamplesReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-examples PARENT"
+	cmd.Short = `*Beta* List examples for a Knowledge Assistant.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+List examples for a Knowledge Assistant.
+
+  Lists examples under a Knowledge Assistant.
+
+  Arguments:
+    PARENT: Parent resource to list from. Format:
+      knowledge-assistants/{knowledge_assistant_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		listExamplesReq.Parent = args[0]
+
+		response := w.KnowledgeAssistants.ListExamples(ctx, listExamplesReq)
+		if listExamplesLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listExamplesLimit)
+		}
+		if listExamplesLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listExamplesLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listExamplesOverrides {
+		fn(cmd, &listExamplesReq)
+	}
+
+	return cmd
+}
+
 // start list-knowledge-assistants command
 
 // Slice with functions to override default command behavior.
@@ -504,12 +960,16 @@ func newListKnowledgeAssistants() *cobra.Command {
 	cmd.Flags().Lookup("page-token").Hidden = true
 
 	cmd.Use = "list-knowledge-assistants"
-	cmd.Short = `List Knowledge Assistants.`
-	cmd.Long = `List Knowledge Assistants.
+	cmd.Short = `*Beta* List Knowledge Assistants.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+List Knowledge Assistants.
 
   List Knowledge Assistants`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -572,8 +1032,10 @@ func newListKnowledgeSources() *cobra.Command {
 	cmd.Flags().Lookup("page-token").Hidden = true
 
 	cmd.Use = "list-knowledge-sources PARENT"
-	cmd.Short = `List Knowledge Sources.`
-	cmd.Long = `List Knowledge Sources.
+	cmd.Short = `*Beta* List Knowledge Sources.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+List Knowledge Sources.
 
   Lists Knowledge Sources under a Knowledge Assistant.
 
@@ -582,6 +1044,8 @@ func newListKnowledgeSources() *cobra.Command {
       knowledge-assistants/{knowledge_assistant_id}`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -618,6 +1082,86 @@ func newListKnowledgeSources() *cobra.Command {
 	return cmd
 }
 
+// start set-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var setPermissionsOverrides []func(
+	*cobra.Command,
+	*knowledgeassistants.KnowledgeAssistantPermissionsRequest,
+)
+
+func newSetPermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var setPermissionsReq knowledgeassistants.KnowledgeAssistantPermissionsRequest
+	var setPermissionsJson flags.JsonFlag
+
+	cmd.Flags().Var(&setPermissionsJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: access_control_list
+
+	cmd.Use = "set-permissions KNOWLEDGE_ASSISTANT_ID"
+	cmd.Short = `*Beta* Set knowledge assistant permissions.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Set knowledge assistant permissions.
+
+  Sets permissions on an object, replacing existing permissions if they exist.
+  Deletes all direct permissions if none are specified. Objects can inherit
+  permissions from their root object.
+
+  Arguments:
+    KNOWLEDGE_ASSISTANT_ID: The knowledge assistant for which to get or manage permissions.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := setPermissionsJson.Unmarshal(&setPermissionsReq)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		setPermissionsReq.KnowledgeAssistantId = args[0]
+
+		response, err := w.KnowledgeAssistants.SetPermissions(ctx, setPermissionsReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range setPermissionsOverrides {
+		fn(cmd, &setPermissionsReq)
+	}
+
+	return cmd
+}
+
 // start sync-knowledge-sources command
 
 // Slice with functions to override default command behavior.
@@ -633,8 +1177,10 @@ func newSyncKnowledgeSources() *cobra.Command {
 	var syncKnowledgeSourcesReq knowledgeassistants.SyncKnowledgeSourcesRequest
 
 	cmd.Use = "sync-knowledge-sources NAME"
-	cmd.Short = `Syncs all Knowledge Sources for a Knowledge Assistant.`
-	cmd.Long = `Syncs all Knowledge Sources for a Knowledge Assistant.
+	cmd.Short = `*Beta* Syncs all Knowledge Sources for a Knowledge Assistant.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Syncs all Knowledge Sources for a Knowledge Assistant.
 
   Sync all non-index Knowledge Sources for a Knowledge Assistant (index sources
   do not require sync)
@@ -644,6 +1190,8 @@ func newSyncKnowledgeSources() *cobra.Command {
       knowledge-assistants/{knowledge_assistant_id}`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -676,6 +1224,104 @@ func newSyncKnowledgeSources() *cobra.Command {
 	return cmd
 }
 
+// start update-example command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateExampleOverrides []func(
+	*cobra.Command,
+	*knowledgeassistants.UpdateExampleRequest,
+)
+
+func newUpdateExample() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateExampleReq knowledgeassistants.UpdateExampleRequest
+	updateExampleReq.Example = knowledgeassistants.Example{}
+	var updateExampleJson flags.JsonFlag
+
+	cmd.Flags().Var(&updateExampleJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: guidelines
+	cmd.Flags().StringVar(&updateExampleReq.Example.Name, "name", updateExampleReq.Example.Name, `Full resource name: knowledge-assistants/{knowledge_assistant_id}/examples/{example_id}.`)
+
+	cmd.Use = "update-example NAME UPDATE_MASK QUESTION"
+	cmd.Short = `*Beta* Update an example in a Knowledge Assistant.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Update an example in a Knowledge Assistant.
+
+  Updates an example in a Knowledge Assistant.
+
+  Arguments:
+    NAME: The resource name of the example to update. Format:
+      knowledge-assistants/{knowledge_assistant_id}/examples/{example_id}
+    UPDATE_MASK: Comma-delimited list of fields to update on the example. Allowed values:
+      question, guidelines. Examples: - question - question,guidelines
+    QUESTION: The example question.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(2)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only NAME, UPDATE_MASK as positional arguments. Provide 'question' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(3)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updateExampleJson.Unmarshal(&updateExampleReq.Example)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		updateExampleReq.Name = args[0]
+		if args[1] != "" {
+			updateMaskArray := strings.Split(args[1], ",")
+			updateExampleReq.UpdateMask = *fieldmask.New(updateMaskArray)
+		}
+		if !cmd.Flags().Changed("json") {
+			updateExampleReq.Example.Question = args[2]
+		}
+
+		response, err := w.KnowledgeAssistants.UpdateExample(ctx, updateExampleReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateExampleOverrides {
+		fn(cmd, &updateExampleReq)
+	}
+
+	return cmd
+}
+
 // start update-knowledge-assistant command
 
 // Slice with functions to override default command behavior.
@@ -698,8 +1344,10 @@ func newUpdateKnowledgeAssistant() *cobra.Command {
 	cmd.Flags().StringVar(&updateKnowledgeAssistantReq.KnowledgeAssistant.Name, "name", updateKnowledgeAssistantReq.KnowledgeAssistant.Name, `The resource name of the Knowledge Assistant.`)
 
 	cmd.Use = "update-knowledge-assistant NAME UPDATE_MASK DISPLAY_NAME DESCRIPTION"
-	cmd.Short = `Update a Knowledge Assistant.`
-	cmd.Long = `Update a Knowledge Assistant.
+	cmd.Short = `*Beta* Update a Knowledge Assistant.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Update a Knowledge Assistant.
 
   Updates a Knowledge Assistant.
 
@@ -717,12 +1365,14 @@ func newUpdateKnowledgeAssistant() *cobra.Command {
       optional unless included in update_mask.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(2)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only NAME, UPDATE_MASK as positional arguments. Provide 'display_name', 'description' in your JSON input")
+				return errors.New("when --json flag is specified, provide only NAME, UPDATE_MASK as positional arguments. Provide 'display_name', 'description' in your JSON input")
 			}
 			return nil
 		}
@@ -803,8 +1453,10 @@ func newUpdateKnowledgeSource() *cobra.Command {
 	cmd.Flags().StringVar(&updateKnowledgeSourceReq.KnowledgeSource.Name, "name", updateKnowledgeSourceReq.KnowledgeSource.Name, `Full resource name: knowledge-assistants/{knowledge_assistant_id}/knowledge-sources/{knowledge_source_id}.`)
 
 	cmd.Use = "update-knowledge-source NAME UPDATE_MASK DISPLAY_NAME DESCRIPTION SOURCE_TYPE"
-	cmd.Short = `Update a Knowledge Source.`
-	cmd.Long = `Update a Knowledge Source.
+	cmd.Short = `*Beta* Update a Knowledge Source.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Update a Knowledge Source.
 
   Updates a Knowledge Source.
 
@@ -825,12 +1477,14 @@ func newUpdateKnowledgeSource() *cobra.Command {
       is ignored.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(2)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only NAME, UPDATE_MASK as positional arguments. Provide 'display_name', 'description', 'source_type' in your JSON input")
+				return errors.New("when --json flag is specified, provide only NAME, UPDATE_MASK as positional arguments. Provide 'display_name', 'description', 'source_type' in your JSON input")
 			}
 			return nil
 		}
@@ -890,4 +1544,83 @@ func newUpdateKnowledgeSource() *cobra.Command {
 	return cmd
 }
 
+// start update-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updatePermissionsOverrides []func(
+	*cobra.Command,
+	*knowledgeassistants.KnowledgeAssistantPermissionsRequest,
+)
+
+func newUpdatePermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updatePermissionsReq knowledgeassistants.KnowledgeAssistantPermissionsRequest
+	var updatePermissionsJson flags.JsonFlag
+
+	cmd.Flags().Var(&updatePermissionsJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: access_control_list
+
+	cmd.Use = "update-permissions KNOWLEDGE_ASSISTANT_ID"
+	cmd.Short = `*Beta* Update knowledge assistant permissions.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Update knowledge assistant permissions.
+
+  Updates the permissions on a knowledge assistant. Knowledge assistants can
+  inherit permissions from their root object.
+
+  Arguments:
+    KNOWLEDGE_ASSISTANT_ID: The knowledge assistant for which to get or manage permissions.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updatePermissionsJson.Unmarshal(&updatePermissionsReq)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		updatePermissionsReq.KnowledgeAssistantId = args[0]
+
+		response, err := w.KnowledgeAssistants.UpdatePermissions(ctx, updatePermissionsReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updatePermissionsOverrides {
+		fn(cmd, &updatePermissionsReq)
+	}
+
+	return cmd
+}
+
 // end service KnowledgeAssistants
diff --git a/cmd/workspace/lakeview-embedded/lakeview-embedded.go b/cmd/workspace/lakeview-embedded/lakeview-embedded.go
old mode 100755
new mode 100644
index 8034e8086a8..76a4d5b35b7
--- a/cmd/workspace/lakeview-embedded/lakeview-embedded.go
+++ b/cmd/workspace/lakeview-embedded/lakeview-embedded.go
@@ -23,6 +23,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newGetPublishedDashboardTokenInfo())
 
@@ -52,16 +56,26 @@ func newGetPublishedDashboardTokenInfo() *cobra.Command {
 	cmd.Flags().StringVar(&getPublishedDashboardTokenInfoReq.ExternalViewerId, "external-viewer-id", getPublishedDashboardTokenInfoReq.ExternalViewerId, `Provided external viewer id to be included in the custom claim.`)
 
 	cmd.Use = "get-published-dashboard-token-info DASHBOARD_ID"
-	cmd.Short = `Read information of a published dashboard to mint an OAuth token.`
-	cmd.Long = `Read information of a published dashboard to mint an OAuth token.
+	cmd.Short = `*Public Preview* Read information of a published dashboard to mint an OAuth token.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Read information of a published dashboard to mint an OAuth token.
 
   Get a required authorization details and scopes of a published dashboard to
   mint an OAuth token.
 
+  The caller must be a workspace user with one of the following entitlements:
+  Workspace access, Databricks SQL access, or Consumer access.
+
+  Account-level users who are not members of the workspace cannot call this
+  endpoint, even if the dashboard has been shared with them.
+
   Arguments:
     DASHBOARD_ID: UUID identifying the published dashboard.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/workspace/lakeview/lakeview.go b/cmd/workspace/lakeview/lakeview.go
old mode 100755
new mode 100644
index f9ea06c4690..f7b2d2f3c46
--- a/cmd/workspace/lakeview/lakeview.go
+++ b/cmd/workspace/lakeview/lakeview.go
@@ -3,6 +3,7 @@
 package lakeview
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -28,6 +29,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newCreateSchedule())
@@ -43,6 +48,7 @@ func New() *cobra.Command {
 	cmd.AddCommand(newListSubscriptions())
 	cmd.AddCommand(newMigrate())
 	cmd.AddCommand(newPublish())
+	cmd.AddCommand(newRevert())
 	cmd.AddCommand(newTrash())
 	cmd.AddCommand(newUnpublish())
 	cmd.AddCommand(newUpdate())
@@ -84,9 +90,16 @@ func newCreate() *cobra.Command {
 	cmd.Short = `Create dashboard.`
 	cmd.Long = `Create dashboard.
 
-  Create a draft dashboard.`
+  Create a draft dashboard.
+
+  Requires the [Databricks SQL access] entitlement. Grant Databricks SQL access
+  in addition to Workspace access.
+
+  [Databricks SQL access]: https://docs.databricks.com/security/auth/entitlements`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -157,18 +170,27 @@ func newCreateSchedule() *cobra.Command {
 	cmd.Short = `Create dashboard schedule.`
 	cmd.Long = `Create dashboard schedule.
 
+  Create dashboard schedule.
+
+  Requires the [Databricks SQL access] entitlement. Grant Databricks SQL access
+  in addition to Workspace access.
+
+  [Databricks SQL access]: https://docs.databricks.com/security/auth/entitlements
+
   Arguments:
     DASHBOARD_ID: UUID identifying the dashboard to which the schedule belongs.
     CRON_SCHEDULE: The cron expression describing the frequency of the periodic refresh for
       this schedule.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(1)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only DASHBOARD_ID as positional arguments. Provide 'cron_schedule' in your JSON input")
+				return errors.New("when --json flag is specified, provide only DASHBOARD_ID as positional arguments. Provide 'cron_schedule' in your JSON input")
 			}
 			return nil
 		}
@@ -246,6 +268,16 @@ func newCreateSubscription() *cobra.Command {
 	cmd.Short = `Create schedule subscription.`
 	cmd.Long = `Create schedule subscription.
 
+  Create schedule subscription.
+
+  The caller must be a workspace user with one of the following [entitlements]:
+  Workspace access, Databricks SQL access, or Consumer access.
+
+  Account-level users who are not members of the workspace cannot call this
+  endpoint, even if the dashboard has been shared with them.
+
+  [entitlements]: https://docs.databricks.com/security/auth/entitlements
+
   Arguments:
     DASHBOARD_ID: UUID identifying the dashboard to which the subscription belongs.
     SCHEDULE_ID: UUID identifying the schedule to which the subscription belongs.
@@ -253,12 +285,14 @@ func newCreateSubscription() *cobra.Command {
       to the schedule.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(2)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only DASHBOARD_ID, SCHEDULE_ID as positional arguments. Provide 'subscriber' in your JSON input")
+				return errors.New("when --json flag is specified, provide only DASHBOARD_ID, SCHEDULE_ID as positional arguments. Provide 'subscriber' in your JSON input")
 			}
 			return nil
 		}
@@ -333,11 +367,20 @@ func newDeleteSchedule() *cobra.Command {
 	cmd.Short = `Delete dashboard schedule.`
 	cmd.Long = `Delete dashboard schedule.
 
+  Delete dashboard schedule.
+
+  Requires the [Databricks SQL access] entitlement. Grant Databricks SQL access
+  in addition to Workspace access.
+
+  [Databricks SQL access]: https://docs.databricks.com/security/auth/entitlements
+
   Arguments:
     DASHBOARD_ID: UUID identifying the dashboard to which the schedule belongs.
     SCHEDULE_ID: UUID identifying the schedule.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -391,12 +434,24 @@ func newDeleteSubscription() *cobra.Command {
 	cmd.Short = `Delete schedule subscription.`
 	cmd.Long = `Delete schedule subscription.
 
+  Delete schedule subscription.
+
+  The caller must be a workspace user with one of the following [entitlements]:
+  Workspace access, Databricks SQL access, or Consumer access.
+
+  Account-level users who are not members of the workspace cannot call this
+  endpoint, even if the dashboard has been shared with them.
+
+  [entitlements]: https://docs.databricks.com/security/auth/entitlements
+
   Arguments:
     DASHBOARD_ID: UUID identifying the dashboard which the subscription belongs.
     SCHEDULE_ID: UUID identifying the schedule which the subscription belongs.
     SUBSCRIPTION_ID: UUID identifying the subscription.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(3)
@@ -451,10 +506,17 @@ func newGet() *cobra.Command {
 
   Get a draft dashboard.
 
+  Requires the [Databricks SQL access] entitlement. Grant Databricks SQL access
+  in addition to Workspace access.
+
+  [Databricks SQL access]: https://docs.databricks.com/security/auth/entitlements
+
   Arguments:
     DASHBOARD_ID: UUID identifying the dashboard.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -508,10 +570,18 @@ func newGetPublished() *cobra.Command {
 
   Get the current published dashboard.
 
+  The caller must be a workspace user with one of the following entitlements:
+  Workspace access, Databricks SQL access, or Consumer access.
+
+  Account-level users who are not members of the workspace cannot call this
+  endpoint, even if the dashboard has been shared with them.
+
   Arguments:
     DASHBOARD_ID: UUID identifying the published dashboard.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -563,11 +633,23 @@ func newGetSchedule() *cobra.Command {
 	cmd.Short = `Get dashboard schedule.`
 	cmd.Long = `Get dashboard schedule.
 
+  Get dashboard schedule.
+
+  The caller must be a workspace user with one of the following [entitlements]:
+  Workspace access, Databricks SQL access, or Consumer access.
+
+  Account-level users who are not members of the workspace cannot call this
+  endpoint, even if the dashboard has been shared with them.
+
+  [entitlements]: https://docs.databricks.com/security/auth/entitlements
+
   Arguments:
     DASHBOARD_ID: UUID identifying the dashboard to which the schedule belongs.
     SCHEDULE_ID: UUID identifying the schedule.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -620,12 +702,24 @@ func newGetSubscription() *cobra.Command {
 	cmd.Short = `Get schedule subscription.`
 	cmd.Long = `Get schedule subscription.
 
+  Get schedule subscription.
+
+  The caller must be a workspace user with one of the following [entitlements]:
+  Workspace access, Databricks SQL access, or Consumer access.
+
+  Account-level users who are not members of the workspace cannot call this
+  endpoint, even if the dashboard has been shared with them.
+
+  [entitlements]: https://docs.databricks.com/security/auth/entitlements
+
   Arguments:
     DASHBOARD_ID: UUID identifying the dashboard which the subscription belongs.
     SCHEDULE_ID: UUID identifying the schedule which the subscription belongs.
     SUBSCRIPTION_ID: UUID identifying the subscription.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(3)
@@ -681,7 +775,7 @@ func newList() *cobra.Command {
 
 	cmd.Flags().IntVar(&listReq.PageSize, "page-size", listReq.PageSize, `The number of dashboards to return per page.`)
 	cmd.Flags().BoolVar(&listReq.ShowTrashed, "show-trashed", listReq.ShowTrashed, `The flag to include dashboards located in the trash.`)
-	cmd.Flags().Var(&listReq.View, "view", `DASHBOARD_VIEW_BASIConly includes summary metadata from the dashboard. Supported values: [DASHBOARD_VIEW_BASIC]`)
+	cmd.Flags().Var(&listReq.View, "view", `DASHBOARD_VIEW_BASIC only includes summary metadata from the dashboard. Supported values: [DASHBOARD_VIEW_BASIC]`)
 
 	// Limit flag for total result capping.
 	cmd.Flags().IntVar(&listLimit, "limit", 0, `Maximum number of results to return.`)
@@ -692,9 +786,18 @@ func newList() *cobra.Command {
 
 	cmd.Use = "list"
 	cmd.Short = `List dashboards.`
-	cmd.Long = `List dashboards.`
+	cmd.Long = `List dashboards.
+
+  List dashboards.
+
+  Requires the [Databricks SQL access] entitlement. Grant Databricks SQL access
+  in addition to Workspace access.
+
+  [Databricks SQL access]: https://docs.databricks.com/security/auth/entitlements`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -760,10 +863,22 @@ func newListSchedules() *cobra.Command {
 	cmd.Short = `List dashboard schedules.`
 	cmd.Long = `List dashboard schedules.
 
+  List dashboard schedules.
+
+  The caller must be a workspace user with one of the following [entitlements]:
+  Workspace access, Databricks SQL access, or Consumer access.
+
+  Account-level users who are not members of the workspace cannot call this
+  endpoint, even if the dashboard has been shared with them.
+
+  [entitlements]: https://docs.databricks.com/security/auth/entitlements
+
   Arguments:
     DASHBOARD_ID: UUID identifying the dashboard to which the schedules belongs.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -831,11 +946,23 @@ func newListSubscriptions() *cobra.Command {
 	cmd.Short = `List schedule subscriptions.`
 	cmd.Long = `List schedule subscriptions.
 
+  List schedule subscriptions.
+
+  The caller must be a workspace user with one of the following [entitlements]:
+  Workspace access, Databricks SQL access, or Consumer access.
+
+  Account-level users who are not members of the workspace cannot call this
+  endpoint, even if the dashboard has been shared with them.
+
+  [entitlements]: https://docs.databricks.com/security/auth/entitlements
+
   Arguments:
     DASHBOARD_ID: UUID identifying the dashboard which the subscriptions belongs.
     SCHEDULE_ID: UUID identifying the schedule which the subscriptions belongs.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -898,18 +1025,21 @@ func newMigrate() *cobra.Command {
 	cmd.Short = `Migrate dashboard.`
 	cmd.Long = `Migrate dashboard.
 
-  Migrates a classic SQL dashboard to Lakeview.
+  Deprecated: Legacy dashboard migration is no longer supported. Use Lakeview
+  (AI/BI) dashboards instead.
 
   Arguments:
     SOURCE_DASHBOARD_ID: UUID of the dashboard to be migrated.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'source_dashboard_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'source_dashboard_id' in your JSON input")
 			}
 			return nil
 		}
@@ -984,10 +1114,17 @@ func newPublish() *cobra.Command {
 
   Publish the current draft dashboard.
 
+  Requires the [Databricks SQL access] entitlement. Grant Databricks SQL access
+  in addition to Workspace access.
+
+  [Databricks SQL access]: https://docs.databricks.com/security/auth/entitlements
+
   Arguments:
     DASHBOARD_ID: UUID identifying the dashboard to be published.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1033,6 +1170,85 @@ func newPublish() *cobra.Command {
 	return cmd
 }
 
+// start revert command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var revertOverrides []func(
+	*cobra.Command,
+	*dashboards.RevertDashboardRequest,
+)
+
+func newRevert() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var revertReq dashboards.RevertDashboardRequest
+	var revertJson flags.JsonFlag
+
+	cmd.Flags().Var(&revertJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Use = "revert DASHBOARD_ID"
+	cmd.Short = `Revert dashboard.`
+	cmd.Long = `Revert dashboard.
+
+  Revert a dashboard's definition in draft mode to the last published version.
+
+  Requires the [Databricks SQL access] entitlement. Grant Databricks SQL access
+  in addition to Workspace access.
+
+  [Databricks SQL access]: https://docs.databricks.com/security/auth/entitlements
+
+  Arguments:
+    DASHBOARD_ID: UUID identifying the dashboard.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := revertJson.Unmarshal(&revertReq)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		revertReq.DashboardId = args[0]
+
+		response, err := w.Lakeview.Revert(ctx, revertReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range revertOverrides {
+		fn(cmd, &revertReq)
+	}
+
+	return cmd
+}
+
 // start trash command
 
 // Slice with functions to override default command behavior.
@@ -1053,10 +1269,17 @@ func newTrash() *cobra.Command {
 
   Trash a dashboard.
 
+  Requires the [Databricks SQL access] entitlement. Grant Databricks SQL access
+  in addition to Workspace access.
+
+  [Databricks SQL access]: https://docs.databricks.com/security/auth/entitlements
+
   Arguments:
     DASHBOARD_ID: UUID identifying the dashboard.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1109,10 +1332,17 @@ func newUnpublish() *cobra.Command {
 
   Unpublish the dashboard.
 
+  Requires the [Databricks SQL access] entitlement. Grant Databricks SQL access
+  in addition to Workspace access.
+
+  [Databricks SQL access]: https://docs.databricks.com/security/auth/entitlements
+
   Arguments:
     DASHBOARD_ID: UUID identifying the published dashboard.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1175,10 +1405,17 @@ func newUpdate() *cobra.Command {
 
   Update a draft dashboard.
 
+  Requires the [Databricks SQL access] entitlement. Grant Databricks SQL access
+  in addition to Workspace access.
+
+  [Databricks SQL access]: https://docs.databricks.com/security/auth/entitlements
+
   Arguments:
     DASHBOARD_ID: UUID identifying the dashboard.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1250,6 +1487,13 @@ func newUpdateSchedule() *cobra.Command {
 	cmd.Short = `Update dashboard schedule.`
 	cmd.Long = `Update dashboard schedule.
 
+  Update dashboard schedule.
+
+  Requires the [Databricks SQL access] entitlement. Grant Databricks SQL access
+  in addition to Workspace access.
+
+  [Databricks SQL access]: https://docs.databricks.com/security/auth/entitlements
+
   Arguments:
     DASHBOARD_ID: UUID identifying the dashboard to which the schedule belongs.
     SCHEDULE_ID: UUID identifying the schedule.
@@ -1257,12 +1501,14 @@ func newUpdateSchedule() *cobra.Command {
       this schedule.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(2)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only DASHBOARD_ID, SCHEDULE_ID as positional arguments. Provide 'cron_schedule' in your JSON input")
+				return errors.New("when --json flag is specified, provide only DASHBOARD_ID, SCHEDULE_ID as positional arguments. Provide 'cron_schedule' in your JSON input")
 			}
 			return nil
 		}
diff --git a/cmd/workspace/libraries/libraries.go b/cmd/workspace/libraries/libraries.go
old mode 100755
new mode 100644
index 5f890d86819..92b71e73019
--- a/cmd/workspace/libraries/libraries.go
+++ b/cmd/workspace/libraries/libraries.go
@@ -3,6 +3,7 @@
 package libraries
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -41,6 +42,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newAllClusterStatuses())
 	cmd.AddCommand(newClusterStatus())
@@ -83,6 +88,8 @@ func newAllClusterStatuses() *cobra.Command {
   libraries installed on this cluster via the API or the libraries UI.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -150,6 +157,8 @@ func newClusterStatus() *cobra.Command {
     CLUSTER_ID: Unique identifier of the cluster whose status should be retrieved.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -211,6 +220,8 @@ func newInstall() *cobra.Command {
   happens in the background after the completion of this request.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -229,7 +240,7 @@ func newInstall() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		err = w.Libraries.Install(ctx, installReq)
@@ -277,6 +288,8 @@ func newUninstall() *cobra.Command {
   currently installed is ignored.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -295,7 +308,7 @@ func newUninstall() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		err = w.Libraries.Uninstall(ctx, uninstallReq)
diff --git a/cmd/workspace/llm-proxy-partner-powered-workspace/llm-proxy-partner-powered-workspace.go b/cmd/workspace/llm-proxy-partner-powered-workspace/llm-proxy-partner-powered-workspace.go
old mode 100755
new mode 100644
index 90c003e216d..e7186373e02
--- a/cmd/workspace/llm-proxy-partner-powered-workspace/llm-proxy-partner-powered-workspace.go
+++ b/cmd/workspace/llm-proxy-partner-powered-workspace/llm-proxy-partner-powered-workspace.go
@@ -3,7 +3,7 @@
 package llm_proxy_partner_powered_workspace
 
 import (
-	"fmt"
+	"errors"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
@@ -29,6 +29,10 @@ func New() *cobra.Command {
 		RunE:   root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
 	// Add methods
 	cmd.AddCommand(newDelete())
 	cmd.AddCommand(newGet())
@@ -66,6 +70,8 @@ func newDelete() *cobra.Command {
   default value.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -120,6 +126,8 @@ func newGet() *cobra.Command {
   Gets the enable partner powered AI features workspace setting.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -175,6 +183,8 @@ func newUpdate() *cobra.Command {
   Updates the enable partner powered AI features workspace setting.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -193,7 +203,7 @@ func newUpdate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := w.Settings.LlmProxyPartnerPoweredWorkspace().Update(ctx, updateReq)
diff --git a/cmd/workspace/materialized-features/materialized-features.go b/cmd/workspace/materialized-features/materialized-features.go
old mode 100755
new mode 100644
index a9a7f55b142..8da35540e24
--- a/cmd/workspace/materialized-features/materialized-features.go
+++ b/cmd/workspace/materialized-features/materialized-features.go
@@ -3,6 +3,7 @@
 package materialized_features
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -30,6 +31,10 @@ func New() *cobra.Command {
 		RunE:   root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
 	// Add methods
 	cmd.AddCommand(newCreateFeatureTag())
 	cmd.AddCommand(newDeleteFeatureTag())
@@ -73,12 +78,14 @@ func newCreateFeatureTag() *cobra.Command {
   Creates a FeatureTag.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(2)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only TABLE_NAME, FEATURE_NAME as positional arguments. Provide 'key' in your JSON input")
+				return errors.New("when --json flag is specified, provide only TABLE_NAME, FEATURE_NAME as positional arguments. Provide 'key' in your JSON input")
 			}
 			return nil
 		}
@@ -155,6 +162,8 @@ func newDeleteFeatureTag() *cobra.Command {
     KEY: The key of the tag to delete.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(3)
@@ -212,6 +221,8 @@ func newGetFeatureLineage() *cobra.Command {
     FEATURE_NAME: The name of the feature.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -267,6 +278,8 @@ func newGetFeatureTag() *cobra.Command {
   Gets a FeatureTag.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(3)
@@ -336,6 +349,8 @@ func newListFeatureTags() *cobra.Command {
   Lists FeatureTags.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -401,6 +416,8 @@ func newUpdateFeatureTag() *cobra.Command {
   Updates a FeatureTag.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(3)
diff --git a/cmd/workspace/metastores/metastores.go b/cmd/workspace/metastores/metastores.go
old mode 100755
new mode 100644
index 95decff8409..6a1ef18de8c
--- a/cmd/workspace/metastores/metastores.go
+++ b/cmd/workspace/metastores/metastores.go
@@ -3,6 +3,7 @@
 package metastores
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -38,6 +39,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newAssign())
 	cmd.AddCommand(newCreate())
@@ -91,12 +96,14 @@ func newAssign() *cobra.Command {
       catalog for a Databricks workspace.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(1)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only WORKSPACE_ID as positional arguments. Provide 'metastore_id', 'default_catalog_name' in your JSON input")
+				return errors.New("when --json flag is specified, provide only WORKSPACE_ID as positional arguments. Provide 'metastore_id', 'default_catalog_name' in your JSON input")
 			}
 			return nil
 		}
@@ -187,12 +194,14 @@ func newCreate() *cobra.Command {
     NAME: The user-specified name of the metastore.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name' in your JSON input")
 			}
 			return nil
 		}
@@ -259,6 +268,8 @@ func newCurrent() *cobra.Command {
   Gets the metastore assignment for the workspace being accessed.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -310,6 +321,8 @@ func newDelete() *cobra.Command {
     ID: Unique ID of the metastore.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -367,6 +380,8 @@ func newGet() *cobra.Command {
     ID: Unique ID of the metastore.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -444,6 +459,8 @@ func newList() *cobra.Command {
   indication that the end of results has been reached.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -497,6 +514,8 @@ func newSummary() *cobra.Command {
   credential, the cloud vendor, the cloud region, and the global metastore ID.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -547,6 +566,8 @@ func newUnassign() *cobra.Command {
     METASTORE_ID: Query for the ID of the metastore to delete.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -622,6 +643,8 @@ func newUpdate() *cobra.Command {
     ID: Unique ID of the metastore.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -700,6 +723,8 @@ func newUpdateAssignment() *cobra.Command {
     WORKSPACE_ID: A workspace ID.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/workspace/model-registry/model-registry.go b/cmd/workspace/model-registry/model-registry.go
old mode 100755
new mode 100644
index f742fe8a666..2c88d8d7dc1
--- a/cmd/workspace/model-registry/model-registry.go
+++ b/cmd/workspace/model-registry/model-registry.go
@@ -3,6 +3,7 @@
 package model_registry
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -33,6 +34,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newApproveTransitionRequest())
 	cmd.AddCommand(newCreateComment())
@@ -120,12 +125,14 @@ func newApproveTransitionRequest() *cobra.Command {
       stage.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'version', 'stage', 'archive_existing_versions' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'version', 'stage', 'archive_existing_versions' in your JSON input")
 			}
 			return nil
 		}
@@ -218,12 +225,14 @@ func newCreateComment() *cobra.Command {
     COMMENT: User-provided comment on the action.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'version', 'comment' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'version', 'comment' in your JSON input")
 			}
 			return nil
 		}
@@ -310,12 +319,14 @@ func newCreateModel() *cobra.Command {
     NAME: Register models under this name`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name' in your JSON input")
 			}
 			return nil
 		}
@@ -397,12 +408,14 @@ func newCreateModelVersion() *cobra.Command {
     SOURCE: URI indicating the location of the model artifacts.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'source' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'source' in your JSON input")
 			}
 			return nil
 		}
@@ -493,12 +506,14 @@ func newCreateTransitionRequest() *cobra.Command {
       * Archived: Archived stage.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'version', 'stage' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'version', 'stage' in your JSON input")
 			}
 			return nil
 		}
@@ -583,6 +598,8 @@ func newCreateWebhook() *cobra.Command {
   **NOTE:** This endpoint is in Public Preview. Creates a registry webhook.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -601,7 +618,7 @@ func newCreateWebhook() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := w.ModelRegistry.CreateWebhook(ctx, createWebhookReq)
@@ -648,6 +665,8 @@ func newDeleteComment() *cobra.Command {
     ID: Unique identifier of an activity`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -704,6 +723,8 @@ func newDeleteModel() *cobra.Command {
     NAME: Registered model unique name identifier.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -762,6 +783,8 @@ func newDeleteModelTag() *cobra.Command {
       not supported. Maximum size is 250 bytes.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -820,6 +843,8 @@ func newDeleteModelVersion() *cobra.Command {
     VERSION: Model version number`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -880,6 +905,8 @@ func newDeleteModelVersionTag() *cobra.Command {
       not supported. Maximum size is 250 bytes.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(3)
@@ -953,6 +980,8 @@ func newDeleteTransitionRequest() *cobra.Command {
       user will be deleted.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(4)
@@ -1013,6 +1042,8 @@ func newDeleteWebhook() *cobra.Command {
     ID: Webhook ID required to delete a registry webhook.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1083,12 +1114,14 @@ func newGetLatestVersions() *cobra.Command {
     NAME: Registered model unique name identifier.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name' in your JSON input")
 			}
 			return nil
 		}
@@ -1168,6 +1201,8 @@ func newGetModel() *cobra.Command {
     NAME: Registered model unique name identifier.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1224,6 +1259,8 @@ func newGetModelVersion() *cobra.Command {
     VERSION: Model version number`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -1283,6 +1320,8 @@ func newGetModelVersionDownloadUri() *cobra.Command {
     VERSION: Model version number`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -1341,6 +1380,8 @@ func newGetPermissionLevels() *cobra.Command {
     REGISTERED_MODEL_ID: The registered model for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1399,6 +1440,8 @@ func newGetPermissions() *cobra.Command {
     REGISTERED_MODEL_ID: The registered model for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1467,6 +1510,8 @@ func newListModels() *cobra.Command {
   __max_results__.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -1535,6 +1580,8 @@ func newListTransitionRequests() *cobra.Command {
     VERSION: Version of the model.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -1608,6 +1655,8 @@ func newListWebhooks() *cobra.Command {
   **NOTE:** This endpoint is in Public Preview. Lists all registry webhooks.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -1681,12 +1730,14 @@ func newRejectTransitionRequest() *cobra.Command {
       * Archived: Archived stage.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'version', 'stage' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'version', 'stage' in your JSON input")
 			}
 			return nil
 		}
@@ -1770,12 +1821,14 @@ func newRenameModel() *cobra.Command {
     NAME: Registered model unique name identifier.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name' in your JSON input")
 			}
 			return nil
 		}
@@ -1860,6 +1913,8 @@ func newSearchModelVersions() *cobra.Command {
   Searches for specific model versions based on the supplied __filter__.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -1930,6 +1985,8 @@ func newSearchModels() *cobra.Command {
   Search for registered models based on the specified __filter__.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -1998,12 +2055,14 @@ func newSetModelTag() *cobra.Command {
       5000 bytes in size.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'key', 'value' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'key', 'value' in your JSON input")
 			}
 			return nil
 		}
@@ -2092,12 +2151,14 @@ func newSetModelVersionTag() *cobra.Command {
       5000 bytes in size.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'version', 'key', 'value' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'version', 'key', 'value' in your JSON input")
 			}
 			return nil
 		}
@@ -2185,6 +2246,8 @@ func newSetPermissions() *cobra.Command {
     REGISTERED_MODEL_ID: The registered model for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -2272,12 +2335,14 @@ func newTestRegistryWebhook() *cobra.Command {
     ID: Webhook ID`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'id' in your JSON input")
 			}
 			return nil
 		}
@@ -2371,12 +2436,14 @@ func newTransitionStage() *cobra.Command {
       stage.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'version', 'stage', 'archive_existing_versions' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'version', 'stage', 'archive_existing_versions' in your JSON input")
 			}
 			return nil
 		}
@@ -2466,12 +2533,14 @@ func newUpdateComment() *cobra.Command {
     COMMENT: User-provided comment on the action.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'id', 'comment' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'id', 'comment' in your JSON input")
 			}
 			return nil
 		}
@@ -2552,12 +2621,14 @@ func newUpdateModel() *cobra.Command {
     NAME: Registered model unique name identifier.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name' in your JSON input")
 			}
 			return nil
 		}
@@ -2636,12 +2707,14 @@ func newUpdateModelVersion() *cobra.Command {
     VERSION: Model version number`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'version' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'version' in your JSON input")
 			}
 			return nil
 		}
@@ -2723,6 +2796,8 @@ func newUpdatePermissions() *cobra.Command {
     REGISTERED_MODEL_ID: The registered model for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -2801,12 +2876,14 @@ func newUpdateWebhook() *cobra.Command {
     ID: Webhook ID`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'id' in your JSON input")
 			}
 			return nil
 		}
diff --git a/cmd/workspace/model-versions/model-versions.go b/cmd/workspace/model-versions/model-versions.go
old mode 100755
new mode 100644
index 2432693d89c..3d6e21a7f46
--- a/cmd/workspace/model-versions/model-versions.go
+++ b/cmd/workspace/model-versions/model-versions.go
@@ -32,6 +32,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newDelete())
 	cmd.AddCommand(newGet())
@@ -78,6 +82,8 @@ func newDelete() *cobra.Command {
     VERSION: The integer version number of the model version`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -147,6 +153,8 @@ func newGet() *cobra.Command {
     VERSION: The integer version number of the model version`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -216,6 +224,8 @@ func newGetByAlias() *cobra.Command {
     ALIAS: The name of the alias`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -282,13 +292,13 @@ func newList() *cobra.Command {
 	cmd.Short = `List Model Versions.`
 	cmd.Long = `List Model Versions.
 
-  List model versions. You can list model versions under a particular schema, or
-  list all model versions in the current metastore.
+  List the model versions of the specified registered model, identified by its
+  full three-level name (catalog.schema.model).
 
   The returned models are filtered based on the privileges of the calling user.
   For example, the metastore admin is able to list all the model versions. A
   regular user needs to be the owner or have the **EXECUTE** privilege on the
-  parent registered model to recieve the model versions in the response. For the
+  parent registered model to receive the model versions in the response. For the
   latter case, the caller must also be the owner or have the **USE_CATALOG**
   privilege on the parent catalog and the **USE_SCHEMA** privilege on the parent
   schema.
@@ -306,6 +316,8 @@ func newList() *cobra.Command {
       model versions`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -395,6 +407,8 @@ func newUpdate() *cobra.Command {
     VERSION: The integer version number of the model version`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
diff --git a/cmd/workspace/notification-destinations/notification-destinations.go b/cmd/workspace/notification-destinations/notification-destinations.go
old mode 100755
new mode 100644
index b028cf80d69..e463527466a
--- a/cmd/workspace/notification-destinations/notification-destinations.go
+++ b/cmd/workspace/notification-destinations/notification-destinations.go
@@ -30,6 +30,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -72,6 +76,8 @@ func newCreate() *cobra.Command {
   Creates a notification destination. Requires workspace admin permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -137,6 +143,8 @@ func newDelete() *cobra.Command {
   Deletes a notification destination. Requires workspace admin permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -190,6 +198,8 @@ func newGet() *cobra.Command {
   Gets a notification destination.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -257,6 +267,8 @@ func newList() *cobra.Command {
   Lists notification destinations.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -322,6 +334,8 @@ func newUpdate() *cobra.Command {
     ID: UUID identifying notification destination.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/workspace/online-tables/online-tables.go b/cmd/workspace/online-tables/online-tables.go
old mode 100755
new mode 100644
index fb43d85e8a9..d634450328e
--- a/cmd/workspace/online-tables/online-tables.go
+++ b/cmd/workspace/online-tables/online-tables.go
@@ -21,13 +21,19 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "online-tables",
-		Short: `Online tables provide lower latency and higher QPS access to data from Delta tables.`,
-		Long: `Online tables provide lower latency and higher QPS access to data from Delta
+		Short: `*Public Preview* Online tables provide lower latency and higher QPS access to data from Delta tables.`,
+		Long: `This command is in Public Preview and may change without notice.
+
+Online tables provide lower latency and higher QPS access to data from Delta
   tables.`,
 		GroupID: "catalog",
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -70,12 +76,16 @@ func newCreate() *cobra.Command {
 	// TODO: complex arg: status
 
 	cmd.Use = "create"
-	cmd.Short = `Create an Online Table.`
-	cmd.Long = `Create an Online Table.
+	cmd.Short = `*Public Preview* Create an Online Table.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Create an Online Table.
 
   Create a new Online Table.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -147,8 +157,10 @@ func newDelete() *cobra.Command {
 	var deleteReq catalog.DeleteOnlineTableRequest
 
 	cmd.Use = "delete NAME"
-	cmd.Short = `Delete an Online Table.`
-	cmd.Long = `Delete an Online Table.
+	cmd.Short = `*Public Preview* Delete an Online Table.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Delete an Online Table.
 
   Delete an online table. Warning: This will delete all the data in the online
   table. If the source Delta table was deleted or modified since this Online
@@ -158,6 +170,8 @@ func newDelete() *cobra.Command {
     NAME: Full three-part (catalog, schema, table) name of the table.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -205,8 +219,10 @@ func newGet() *cobra.Command {
 	var getReq catalog.GetOnlineTableRequest
 
 	cmd.Use = "get NAME"
-	cmd.Short = `Get an Online Table.`
-	cmd.Long = `Get an Online Table.
+	cmd.Short = `*Public Preview* Get an Online Table.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get an Online Table.
 
   Get information about an existing online table and its status.
 
@@ -214,6 +230,8 @@ func newGet() *cobra.Command {
     NAME: Full three-part (catalog, schema, table) name of the table.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/workspace/permission-migration/permission-migration.go b/cmd/workspace/permission-migration/permission-migration.go
old mode 100755
new mode 100644
index 0bcf145740e..3c9b6741b28
--- a/cmd/workspace/permission-migration/permission-migration.go
+++ b/cmd/workspace/permission-migration/permission-migration.go
@@ -3,6 +3,7 @@
 package permission_migration
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -30,6 +31,10 @@ func New() *cobra.Command {
 		RunE:   root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
 	// Add methods
 	cmd.AddCommand(newMigratePermissions())
 
@@ -71,12 +76,14 @@ func newMigratePermissions() *cobra.Command {
     TO_ACCOUNT_GROUP_NAME: The name of the account group that permissions will be migrated to.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'workspace_id', 'from_workspace_group_name', 'to_account_group_name' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'workspace_id', 'from_workspace_group_name', 'to_account_group_name' in your JSON input")
 			}
 			return nil
 		}
diff --git a/cmd/workspace/permissions/permissions.go b/cmd/workspace/permissions/permissions.go
old mode 100755
new mode 100644
index f12e2f9e41c..02bd53c875d
--- a/cmd/workspace/permissions/permissions.go
+++ b/cmd/workspace/permissions/permissions.go
@@ -25,9 +25,9 @@ func New() *cobra.Command {
   **[Cluster permissions](:service:clusters)** — Manage which users can
   manage, restart, or attach to clusters. * **[Cluster policy
   permissions](:service:clusterpolicies)** — Manage which users can use
-  cluster policies. * **[Delta Live Tables pipeline
+  cluster policies. * **[Spark Declarative Pipelines
   permissions](:service:pipelines)** — Manage which users can view, manage,
-  run, cancel, or own a Delta Live Tables pipeline. * **[Job
+  run, cancel, or own a Spark Declarative Pipeline. * **[Job
   permissions](:service:jobs)** — Manage which users can view, manage,
   trigger, cancel, or own a job. * **[MLflow experiment
   permissions](:service:experiments)** — Manage which users can read, edit, or
@@ -54,6 +54,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newGet())
 	cmd.AddCommand(newGetPermissionLevels())
@@ -93,11 +97,14 @@ func newGet() *cobra.Command {
     REQUEST_OBJECT_TYPE: The type of the request object. Can be one of the following: alerts,
       alertsv2, authorization, clusters, cluster-policies, dashboards,
       database-projects, dbsql-dashboards, directories, experiments, files,
-      genie, instance-pools, jobs, notebooks, pipelines, queries,
-      registered-models, repos, serving-endpoints, or warehouses.
+      genie, instance-pools, jobs, knowledge-assistants, notebooks, pipelines,
+      queries, registered-models, repos, serving-endpoints, supervisor-agents,
+      vector-search-endpoints, or warehouses.
     REQUEST_OBJECT_ID: The id of the request object.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -156,11 +163,14 @@ func newGetPermissionLevels() *cobra.Command {
     REQUEST_OBJECT_TYPE: The type of the request object. Can be one of the following: alerts,
       alertsv2, authorization, clusters, cluster-policies, dashboards,
       database-projects, dbsql-dashboards, directories, experiments, files,
-      genie, instance-pools, jobs, notebooks, pipelines, queries,
-      registered-models, repos, serving-endpoints, or warehouses.
+      genie, instance-pools, jobs, knowledge-assistants, notebooks, pipelines,
+      queries, registered-models, repos, serving-endpoints, supervisor-agents,
+      vector-search-endpoints, or warehouses.
     REQUEST_OBJECT_ID: `
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -226,11 +236,14 @@ func newSet() *cobra.Command {
     REQUEST_OBJECT_TYPE: The type of the request object. Can be one of the following: alerts,
       alertsv2, authorization, clusters, cluster-policies, dashboards,
       database-projects, dbsql-dashboards, directories, experiments, files,
-      genie, instance-pools, jobs, notebooks, pipelines, queries,
-      registered-models, repos, serving-endpoints, or warehouses.
+      genie, instance-pools, jobs, knowledge-assistants, notebooks, pipelines,
+      queries, registered-models, repos, serving-endpoints, supervisor-agents,
+      vector-search-endpoints, or warehouses.
     REQUEST_OBJECT_ID: The id of the request object.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -307,11 +320,14 @@ func newUpdate() *cobra.Command {
     REQUEST_OBJECT_TYPE: The type of the request object. Can be one of the following: alerts,
       alertsv2, authorization, clusters, cluster-policies, dashboards,
       database-projects, dbsql-dashboards, directories, experiments, files,
-      genie, instance-pools, jobs, notebooks, pipelines, queries,
-      registered-models, repos, serving-endpoints, or warehouses.
+      genie, instance-pools, jobs, knowledge-assistants, notebooks, pipelines,
+      queries, registered-models, repos, serving-endpoints, supervisor-agents,
+      vector-search-endpoints, or warehouses.
     REQUEST_OBJECT_ID: The id of the request object.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
diff --git a/cmd/workspace/pipelines/pipelines.go b/cmd/workspace/pipelines/pipelines.go
old mode 100755
new mode 100644
index 2401b325371..fdbe1756026
--- a/cmd/workspace/pipelines/pipelines.go
+++ b/cmd/workspace/pipelines/pipelines.go
@@ -3,6 +3,7 @@
 package pipelines
 
 import (
+	"errors"
 	"fmt"
 	"time"
 
@@ -41,6 +42,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newApplyEnvironment())
 	cmd.AddCommand(newClone())
@@ -82,13 +87,17 @@ func newApplyEnvironment() *cobra.Command {
 	var applyEnvironmentReq pipelines.ApplyEnvironmentRequest
 
 	cmd.Use = "apply-environment PIPELINE_ID"
-	cmd.Short = `Apply the latest environment to the pipeline.`
-	cmd.Long = `Apply the latest environment to the pipeline.
+	cmd.Short = `*Public Preview* Apply the latest environment to the pipeline.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
 
-  * Applies the current pipeline environment onto the pipeline compute. The
+Apply the latest environment to the pipeline.
+
+  Applies the current pipeline environment onto the pipeline compute. The
   environment applied can be used by subsequent dev-mode updates.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -110,7 +119,7 @@ func newApplyEnvironment() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have ")
+			return errors.New("expected to have ")
 		}
 		applyEnvironmentReq.PipelineId = args[0]
 
@@ -163,6 +172,8 @@ func newClone() *cobra.Command {
     PIPELINE_ID: Source pipeline to clone from`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -186,7 +197,7 @@ func newClone() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 		cloneReq.PipelineId = args[0]
 
@@ -235,6 +246,8 @@ func newCreate() *cobra.Command {
   If successful, this method returns the ID of the new pipeline.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -253,7 +266,7 @@ func newCreate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := w.Pipelines.Create(ctx, createReq)
@@ -302,6 +315,8 @@ func newDelete() *cobra.Command {
   support for assistance to undo this action.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -323,7 +338,7 @@ func newDelete() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have ")
+			return errors.New("expected to have ")
 		}
 		deleteReq.PipelineId = args[0]
 
@@ -365,6 +380,8 @@ func newGet() *cobra.Command {
 	cmd.Long = `Get a pipeline.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -386,7 +403,7 @@ func newGet() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have ")
+			return errors.New("expected to have ")
 		}
 		getReq.PipelineId = args[0]
 
@@ -434,6 +451,8 @@ func newGetPermissionLevels() *cobra.Command {
     PIPELINE_ID: The pipeline for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -455,7 +474,7 @@ func newGetPermissionLevels() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the pipeline for which to get or manage permissions")
+			return errors.New("expected to have the pipeline for which to get or manage permissions")
 		}
 		getPermissionLevelsReq.PipelineId = args[0]
 
@@ -504,6 +523,8 @@ func newGetPermissions() *cobra.Command {
     PIPELINE_ID: The pipeline for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -525,7 +546,7 @@ func newGetPermissions() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the pipeline for which to get or manage permissions")
+			return errors.New("expected to have the pipeline for which to get or manage permissions")
 		}
 		getPermissionsReq.PipelineId = args[0]
 
@@ -574,6 +595,8 @@ func newGetUpdate() *cobra.Command {
     UPDATE_ID: The ID of the update.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -647,6 +670,8 @@ func newListPipelineEvents() *cobra.Command {
     PIPELINE_ID: The pipeline to return events for.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -668,7 +693,7 @@ func newListPipelineEvents() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the pipeline to return events for")
+			return errors.New("expected to have the pipeline to return events for")
 		}
 		listPipelineEventsReq.PipelineId = args[0]
 
@@ -731,6 +756,8 @@ func newListPipelines() *cobra.Command {
   Lists pipelines defined in the Spark Declarative Pipelines system.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -793,6 +820,8 @@ func newListUpdates() *cobra.Command {
     PIPELINE_ID: The pipeline to return updates for.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -814,7 +843,7 @@ func newListUpdates() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the pipeline to return updates for")
+			return errors.New("expected to have the pipeline to return updates for")
 		}
 		listUpdatesReq.PipelineId = args[0]
 
@@ -869,6 +898,8 @@ func newSetPermissions() *cobra.Command {
     PIPELINE_ID: The pipeline for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -902,7 +933,7 @@ func newSetPermissions() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the pipeline for which to get or manage permissions")
+			return errors.New("expected to have the pipeline for which to get or manage permissions")
 		}
 		setPermissionsReq.PipelineId = args[0]
 
@@ -952,6 +983,7 @@ func newStartUpdate() *cobra.Command {
   SERVICE_UPGRADE,
   USER_ACTION,
 ]`)
+	cmd.Flags().BoolVar(&startUpdateReq.Development, "development", startUpdateReq.Development, `Whether the update is started in the development mode.`)
 	cmd.Flags().BoolVar(&startUpdateReq.FullRefresh, "full-refresh", startUpdateReq.FullRefresh, `If true, this update will reset all tables before running.`)
 	// TODO: array: full_refresh_selection
 	// TODO: map via StringToStringVar: parameters
@@ -969,6 +1001,8 @@ func newStartUpdate() *cobra.Command {
   the pipeline, the request will fail and the active update will remain running.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -1002,7 +1036,7 @@ func newStartUpdate() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have ")
+			return errors.New("expected to have ")
 		}
 		startUpdateReq.PipelineId = args[0]
 
@@ -1054,6 +1088,8 @@ func newStop() *cobra.Command {
   update for the pipeline, this request is a no-op.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -1075,7 +1111,7 @@ func newStop() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have ")
+			return errors.New("expected to have ")
 		}
 		stopReq.PipelineId = args[0]
 
@@ -1130,7 +1166,7 @@ func newUpdate() *cobra.Command {
 	cmd.Flags().BoolVar(&updateReq.AllowDuplicateNames, "allow-duplicate-names", updateReq.AllowDuplicateNames, `If false, deployment will fail if name has changed and conflicts the name of another pipeline.`)
 	cmd.Flags().StringVar(&updateReq.BudgetPolicyId, "budget-policy-id", updateReq.BudgetPolicyId, `Budget policy of this pipeline.`)
 	cmd.Flags().StringVar(&updateReq.Catalog, "catalog", updateReq.Catalog, `A catalog in Unity Catalog to publish data from this pipeline to.`)
-	cmd.Flags().StringVar(&updateReq.Channel, "channel", updateReq.Channel, `DLT Release Channel that specifies which version to use.`)
+	cmd.Flags().StringVar(&updateReq.Channel, "channel", updateReq.Channel, `SDP Release Channel that specifies which version to use.`)
 	// TODO: array: clusters
 	// TODO: map via StringToStringVar: configuration
 	cmd.Flags().BoolVar(&updateReq.Continuous, "continuous", updateReq.Continuous, `Whether the pipeline is continuous or triggered.`)
@@ -1147,12 +1183,15 @@ func newUpdate() *cobra.Command {
 	// TODO: array: libraries
 	cmd.Flags().StringVar(&updateReq.Name, "name", updateReq.Name, `Friendly identifier for this pipeline.`)
 	// TODO: array: notifications
+	// TODO: map via StringToStringVar: parameters
+	cmd.Flags().StringVar(&updateReq.ParentPath, "parent-path", updateReq.ParentPath, `Path of the pipeline parent folder in workspace file tree.`)
 	cmd.Flags().BoolVar(&updateReq.Photon, "photon", updateReq.Photon, `Whether Photon is enabled for this pipeline.`)
 	// TODO: complex arg: restart_window
 	cmd.Flags().StringVar(&updateReq.RootPath, "root-path", updateReq.RootPath, `Root path for this pipeline.`)
 	// TODO: complex arg: run_as
 	cmd.Flags().StringVar(&updateReq.Schema, "schema", updateReq.Schema, `The default schema (database) where tables are read from or published to.`)
 	cmd.Flags().BoolVar(&updateReq.Serverless, "serverless", updateReq.Serverless, `Whether serverless compute is enabled for this pipeline.`)
+	cmd.Flags().StringVar(&updateReq.ServerlessComputeId, "serverless-compute-id", updateReq.ServerlessComputeId, `Serverless compute ID specified by the user for serverless pipelines.`)
 	cmd.Flags().StringVar(&updateReq.Storage, "storage", updateReq.Storage, `DBFS root directory for storing checkpoints and tables.`)
 	// TODO: map via StringToStringVar: tags
 	cmd.Flags().StringVar(&updateReq.Target, "target", updateReq.Target, `Target schema (database) to add tables in this pipeline to.`)
@@ -1169,6 +1208,8 @@ func newUpdate() *cobra.Command {
     PIPELINE_ID: Unique identifier for this pipeline.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -1202,7 +1243,7 @@ func newUpdate() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have unique identifier for this pipeline")
+			return errors.New("expected to have unique identifier for this pipeline")
 		}
 		updateReq.PipelineId = args[0]
 
@@ -1255,6 +1296,8 @@ func newUpdatePermissions() *cobra.Command {
     PIPELINE_ID: The pipeline for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -1288,7 +1331,7 @@ func newUpdatePermissions() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the pipeline for which to get or manage permissions")
+			return errors.New("expected to have the pipeline for which to get or manage permissions")
 		}
 		updatePermissionsReq.PipelineId = args[0]
 
diff --git a/cmd/workspace/policies/policies.go b/cmd/workspace/policies/policies.go
old mode 100755
new mode 100644
index 8bde169cdc0..a8bc998c1ab
--- a/cmd/workspace/policies/policies.go
+++ b/cmd/workspace/policies/policies.go
@@ -3,6 +3,7 @@
 package policies
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -33,6 +34,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreatePolicy())
 	cmd.AddCommand(newDeletePolicy())
@@ -68,11 +73,15 @@ func newCreatePolicy() *cobra.Command {
 
 	// TODO: complex arg: column_mask
 	cmd.Flags().StringVar(&createPolicyReq.PolicyInfo.Comment, "comment", createPolicyReq.PolicyInfo.Comment, `Optional description of the policy.`)
+	// TODO: complex arg: deny
 	// TODO: array: except_principals
+	// TODO: array: governed_tags
+	// TODO: complex arg: grant
 	// TODO: array: match_columns
 	cmd.Flags().StringVar(&createPolicyReq.PolicyInfo.Name, "name", createPolicyReq.PolicyInfo.Name, `Name of the policy.`)
 	cmd.Flags().StringVar(&createPolicyReq.PolicyInfo.OnSecurableFullname, "on-securable-fullname", createPolicyReq.PolicyInfo.OnSecurableFullname, `Full name of the securable on which the policy is defined.`)
 	cmd.Flags().Var(&createPolicyReq.PolicyInfo.OnSecurableType, "on-securable-type", `Type of the securable on which the policy is defined. Supported values: [
+  AGENT_SERVICE,
   CATALOG,
   CLEAN_ROOM,
   CONNECTION,
@@ -80,12 +89,17 @@ func newCreatePolicy() *cobra.Command {
   EXTERNAL_LOCATION,
   EXTERNAL_METADATA,
   FUNCTION,
+  MCP_SERVICE,
   METASTORE,
+  MODEL,
+  MODEL_PROVIDER_SERVICE,
+  MODEL_SERVICE,
   PIPELINE,
   PROVIDER,
   RECIPIENT,
   SCHEMA,
   SHARE,
+  SKILL,
   STAGING_TABLE,
   STORAGE_CREDENTIAL,
   TABLE,
@@ -104,9 +118,10 @@ func newCreatePolicy() *cobra.Command {
   Arguments:
     TO_PRINCIPALS: List of user or group names that the policy applies to. Required on create
       and optional on update.
-    FOR_SECURABLE_TYPE: Type of securables that the policy should take effect on. Only TABLE is
-      supported at this moment. Required on create and optional on update.
+    FOR_SECURABLE_TYPE: Type of securables that the policy should take effect on. Required on
+      create and optional on update.
       Supported values: [
+        AGENT_SERVICE,
         CATALOG,
         CLEAN_ROOM,
         CONNECTION,
@@ -114,27 +129,34 @@ func newCreatePolicy() *cobra.Command {
         EXTERNAL_LOCATION,
         EXTERNAL_METADATA,
         FUNCTION,
+        MCP_SERVICE,
         METASTORE,
+        MODEL,
+        MODEL_PROVIDER_SERVICE,
+        MODEL_SERVICE,
         PIPELINE,
         PROVIDER,
         RECIPIENT,
         SCHEMA,
         SHARE,
+        SKILL,
         STAGING_TABLE,
         STORAGE_CREDENTIAL,
         TABLE,
         VOLUME,
       ]
     POLICY_TYPE: Type of the policy. Required on create.
-      Supported values: [POLICY_TYPE_COLUMN_MASK, POLICY_TYPE_ROW_FILTER]`
+      Supported values: [POLICY_TYPE_COLUMN_MASK, POLICY_TYPE_DENY, POLICY_TYPE_GRANT, POLICY_TYPE_ROW_FILTER]`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'to_principals', 'for_securable_type', 'policy_type' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'to_principals', 'for_securable_type', 'policy_type' in your JSON input")
 			}
 			return nil
 		}
@@ -228,6 +250,8 @@ func newDeletePolicy() *cobra.Command {
     NAME: Required. The name of the policy to delete`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(3)
@@ -289,6 +313,8 @@ func newGetPolicy() *cobra.Command {
     NAME: Required. The name of the policy to retrieve.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(3)
@@ -369,6 +395,8 @@ func newListPolicies() *cobra.Command {
     ON_SECURABLE_FULLNAME: Required. The fully qualified name of securable to list policies for.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -427,11 +455,15 @@ func newUpdatePolicy() *cobra.Command {
 	cmd.Flags().StringVar(&updatePolicyReq.UpdateMask, "update-mask", updatePolicyReq.UpdateMask, `Optional.`)
 	// TODO: complex arg: column_mask
 	cmd.Flags().StringVar(&updatePolicyReq.PolicyInfo.Comment, "comment", updatePolicyReq.PolicyInfo.Comment, `Optional description of the policy.`)
+	// TODO: complex arg: deny
 	// TODO: array: except_principals
+	// TODO: array: governed_tags
+	// TODO: complex arg: grant
 	// TODO: array: match_columns
 	cmd.Flags().StringVar(&updatePolicyReq.PolicyInfo.Name, "name", updatePolicyReq.PolicyInfo.Name, `Name of the policy.`)
 	cmd.Flags().StringVar(&updatePolicyReq.PolicyInfo.OnSecurableFullname, "on-securable-fullname", updatePolicyReq.PolicyInfo.OnSecurableFullname, `Full name of the securable on which the policy is defined.`)
 	cmd.Flags().Var(&updatePolicyReq.PolicyInfo.OnSecurableType, "on-securable-type", `Type of the securable on which the policy is defined. Supported values: [
+  AGENT_SERVICE,
   CATALOG,
   CLEAN_ROOM,
   CONNECTION,
@@ -439,12 +471,17 @@ func newUpdatePolicy() *cobra.Command {
   EXTERNAL_LOCATION,
   EXTERNAL_METADATA,
   FUNCTION,
+  MCP_SERVICE,
   METASTORE,
+  MODEL,
+  MODEL_PROVIDER_SERVICE,
+  MODEL_SERVICE,
   PIPELINE,
   PROVIDER,
   RECIPIENT,
   SCHEMA,
   SHARE,
+  SKILL,
   STAGING_TABLE,
   STORAGE_CREDENTIAL,
   TABLE,
@@ -466,9 +503,10 @@ func newUpdatePolicy() *cobra.Command {
     NAME: Required. The name of the policy to update.
     TO_PRINCIPALS: List of user or group names that the policy applies to. Required on create
       and optional on update.
-    FOR_SECURABLE_TYPE: Type of securables that the policy should take effect on. Only TABLE is
-      supported at this moment. Required on create and optional on update.
+    FOR_SECURABLE_TYPE: Type of securables that the policy should take effect on. Required on
+      create and optional on update.
       Supported values: [
+        AGENT_SERVICE,
         CATALOG,
         CLEAN_ROOM,
         CONNECTION,
@@ -476,27 +514,34 @@ func newUpdatePolicy() *cobra.Command {
         EXTERNAL_LOCATION,
         EXTERNAL_METADATA,
         FUNCTION,
+        MCP_SERVICE,
         METASTORE,
+        MODEL,
+        MODEL_PROVIDER_SERVICE,
+        MODEL_SERVICE,
         PIPELINE,
         PROVIDER,
         RECIPIENT,
         SCHEMA,
         SHARE,
+        SKILL,
         STAGING_TABLE,
         STORAGE_CREDENTIAL,
         TABLE,
         VOLUME,
       ]
     POLICY_TYPE: Type of the policy. Required on create.
-      Supported values: [POLICY_TYPE_COLUMN_MASK, POLICY_TYPE_ROW_FILTER]`
+      Supported values: [POLICY_TYPE_COLUMN_MASK, POLICY_TYPE_DENY, POLICY_TYPE_GRANT, POLICY_TYPE_ROW_FILTER]`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(3)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only ON_SECURABLE_TYPE, ON_SECURABLE_FULLNAME, NAME as positional arguments. Provide 'to_principals', 'for_securable_type', 'policy_type' in your JSON input")
+				return errors.New("when --json flag is specified, provide only ON_SECURABLE_TYPE, ON_SECURABLE_FULLNAME, NAME as positional arguments. Provide 'to_principals', 'for_securable_type', 'policy_type' in your JSON input")
 			}
 			return nil
 		}
diff --git a/cmd/workspace/policy-compliance-for-clusters/policy-compliance-for-clusters.go b/cmd/workspace/policy-compliance-for-clusters/policy-compliance-for-clusters.go
old mode 100755
new mode 100644
index a4ba0f4f9d7..e18a23b556f
--- a/cmd/workspace/policy-compliance-for-clusters/policy-compliance-for-clusters.go
+++ b/cmd/workspace/policy-compliance-for-clusters/policy-compliance-for-clusters.go
@@ -3,6 +3,7 @@
 package policy_compliance_for_clusters
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -35,7 +36,12 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
+	cmd.AddCommand(newCancelPendingClusterEnforcement())
 	cmd.AddCommand(newEnforceCompliance())
 	cmd.AddCommand(newGetCompliance())
 	cmd.AddCommand(newListCompliance())
@@ -48,6 +54,94 @@ func New() *cobra.Command {
 	return cmd
 }
 
+// start cancel-pending-cluster-enforcement command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var cancelPendingClusterEnforcementOverrides []func(
+	*cobra.Command,
+	*compute.CancelPendingClusterEnforcementRequest,
+)
+
+func newCancelPendingClusterEnforcement() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var cancelPendingClusterEnforcementReq compute.CancelPendingClusterEnforcementRequest
+	var cancelPendingClusterEnforcementJson flags.JsonFlag
+
+	cmd.Flags().Var(&cancelPendingClusterEnforcementJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().BoolVar(&cancelPendingClusterEnforcementReq.AllowMissing, "allow-missing", cancelPendingClusterEnforcementReq.AllowMissing, `If true and no pending enforcement exists, the request will succeed but no action will be taken.`)
+
+	cmd.Use = "cancel-pending-cluster-enforcement CLUSTER_ID"
+	cmd.Short = `Cancel pending policy enforcement for a cluster.`
+	cmd.Long = `Cancel pending policy enforcement for a cluster.
+
+  Cancels a pending enforcement on a cluster. After canceling the pending
+  enforcement, the cluster will no longer update on the next termination or
+  restart. Pending enforcements cannot be canceled when a cluster is in
+  TERMINATING state. Only workspace admins can cancel pending enforcements.
+
+  Arguments:
+    CLUSTER_ID: The ID of the cluster to cancel the pending enforcement for.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(0)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'cluster_id' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := cancelPendingClusterEnforcementJson.Unmarshal(&cancelPendingClusterEnforcementReq)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		if !cmd.Flags().Changed("json") {
+			cancelPendingClusterEnforcementReq.ClusterId = args[0]
+		}
+
+		response, err := w.PolicyComplianceForClusters.CancelPendingClusterEnforcement(ctx, cancelPendingClusterEnforcementReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range cancelPendingClusterEnforcementOverrides {
+		fn(cmd, &cancelPendingClusterEnforcementReq)
+	}
+
+	return cmd
+}
+
 // start enforce-compliance command
 
 // Slice with functions to override default command behavior.
@@ -65,23 +159,22 @@ func newEnforceCompliance() *cobra.Command {
 
 	cmd.Flags().Var(&enforceComplianceJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
+	cmd.Flags().Var(&enforceComplianceReq.EnforceMode, "enforce-mode", `Determines how changes should be made to clusters that are not in TERMINATED state. Supported values: [ENFORCE_IMMEDIATELY, WAIT_FOR_TERMINATION]`)
 	cmd.Flags().BoolVar(&enforceComplianceReq.ValidateOnly, "validate-only", enforceComplianceReq.ValidateOnly, `If set, previews the changes that would be made to a cluster to enforce compliance but does not update the cluster.`)
 
 	cmd.Use = "enforce-compliance CLUSTER_ID"
 	cmd.Short = `Enforce cluster policy compliance.`
 	cmd.Long = `Enforce cluster policy compliance.
 
-  Updates a cluster to be compliant with the current version of its policy. A
-  cluster can be updated if it is in a RUNNING or TERMINATED state.
-
-  If a cluster is updated while in a RUNNING state, it will be restarted so
-  that the new attributes can take effect.
+  Updates a cluster to be compliant with the current version of its policy.
 
   If a cluster is updated while in a TERMINATED state, it will remain
   TERMINATED. The next time the cluster is started, the new attributes will
   take effect.
 
-  Clusters created by the Databricks Jobs, DLT, or Models services cannot be
+  For clusters in other states, the behavior depends on the enforce_mode used.
+
+  Clusters created by the Databricks Jobs, SDP, or Models services cannot be
   enforced by this API. Instead, use the "Enforce job policy compliance" API to
   enforce policy compliance on jobs.
 
@@ -89,12 +182,14 @@ func newEnforceCompliance() *cobra.Command {
     CLUSTER_ID: The ID of the cluster you want to enforce policy compliance on.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'cluster_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'cluster_id' in your JSON input")
 			}
 			return nil
 		}
@@ -168,6 +263,8 @@ func newGetCompliance() *cobra.Command {
     CLUSTER_ID: The ID of the cluster to get the compliance status`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -240,6 +337,8 @@ func newListCompliance() *cobra.Command {
     POLICY_ID: Canonical unique identifier for the cluster policy.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/workspace/policy-compliance-for-jobs/policy-compliance-for-jobs.go b/cmd/workspace/policy-compliance-for-jobs/policy-compliance-for-jobs.go
old mode 100755
new mode 100644
index 2a081689035..7925735e472
--- a/cmd/workspace/policy-compliance-for-jobs/policy-compliance-for-jobs.go
+++ b/cmd/workspace/policy-compliance-for-jobs/policy-compliance-for-jobs.go
@@ -3,6 +3,7 @@
 package policy_compliance_for_jobs
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -38,6 +39,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newEnforceCompliance())
 	cmd.AddCommand(newGetCompliance())
@@ -83,12 +88,14 @@ func newEnforceCompliance() *cobra.Command {
     JOB_ID: The ID of the job you want to enforce policy compliance on.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'job_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'job_id' in your JSON input")
 			}
 			return nil
 		}
@@ -167,6 +174,8 @@ func newGetCompliance() *cobra.Command {
     JOB_ID: The ID of the job whose compliance status you are requesting.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -243,6 +252,8 @@ func newListCompliance() *cobra.Command {
     POLICY_ID: Canonical unique identifier for the cluster policy.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/workspace/policy-families/policy-families.go b/cmd/workspace/policy-families/policy-families.go
old mode 100755
new mode 100644
index 2926c04f260..d760aaf7db6
--- a/cmd/workspace/policy-families/policy-families.go
+++ b/cmd/workspace/policy-families/policy-families.go
@@ -33,6 +33,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newGet())
 	cmd.AddCommand(newList())
@@ -72,6 +76,8 @@ func newGet() *cobra.Command {
     POLICY_FAMILY_ID: The family ID about which to retrieve information.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -140,6 +146,8 @@ func newList() *cobra.Command {
   version. This API is paginated.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
diff --git a/cmd/workspace/postgres/overrides.go b/cmd/workspace/postgres/overrides.go
new file mode 100644
index 00000000000..abbde499eb8
--- /dev/null
+++ b/cmd/workspace/postgres/overrides.go
@@ -0,0 +1,313 @@
+package postgres
+
+import (
+	"errors"
+	"fmt"
+	"math"
+	"regexp"
+	"slices"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/databricks-sdk-go/common/types/duration"
+	"github.com/databricks/databricks-sdk-go/service/postgres"
+	"github.com/spf13/cobra"
+)
+
+// createRoleOverride appends an example body to the auto-generated help and
+// rejects wrapped {"role": ...} bodies with a clear client-side error.
+// The --json flag binds to the inner Role object (CreateRoleRequest.Role,
+// JSON-tagged "role"), so users supply spec/name/etc. directly. Without an
+// example, the auto-generated `// TODO: complex arg: spec` flags leave no
+// hint about the body shape and the API's "Field 'role' is required" error
+// is unhelpful when the request body is wrong.
+func createRoleOverride(createRoleCmd *cobra.Command, _ *postgres.CreateRoleRequest) {
+	prevPreRunE := createRoleCmd.PreRunE
+	createRoleCmd.PreRunE = func(cmd *cobra.Command, args []string) error {
+		if err := rejectWrappedRoleJSON(cmd); err != nil {
+			return err
+		}
+		if prevPreRunE != nil {
+			return prevPreRunE(cmd, args)
+		}
+		return nil
+	}
+
+	createRoleCmd.Long += `
+
+  Body shape (passed via --json): fields go directly on the Role object.
+  Do not wrap them in '{"role": ...}' — the CLI rejects wrapped bodies
+  client-side with a hint pointing to the right shape.
+
+  Example — create a service-principal-backed role:
+
+    databricks postgres create-role projects/<PROJECT_ID>/branches/<BRANCH_ID> \
+      --role-id <SP_CLIENT_ID> \
+      --json '{"spec": {"identity_type": "SERVICE_PRINCIPAL", "postgres_role": "<SP_CLIENT_ID>", "auth_method": "LAKEBASE_OAUTH_V1"}}'
+
+  The example omits 'membership_roles' so the role starts with default
+  privileges only — grant database/schema/table access separately via
+  SQL, following least privilege. Set 'membership_roles' (e.g.
+  ["DATABRICKS_SUPERUSER"]) only when broad administrative access is
+  intentional.
+
+  See databricks-sdk-go/service/postgres.RoleRoleSpec for the full set of
+  spec fields.`
+}
+
+// rejectWrappedRoleJSON returns a clear error when --json is a top-level
+// object containing a "role" key. Without this guard the generated unmarshal
+// strips the unknown outer "role" field with a warning and ships an empty
+// body, and the server rejects with a confusing "Field 'role' is required"
+// message.
+func rejectWrappedRoleJSON(cmd *cobra.Command) error {
+	jf, err := postgresJSONFlag(cmd, "create-role")
+	if err != nil {
+		return err
+	}
+	return jf.RejectWrappedJSON("role", `databricks postgres create-role projects/<PROJECT_ID>/branches/<BRANCH_ID> \
+    --role-id <SP_CLIENT_ID> \
+    --json '{"spec": {"identity_type": "SERVICE_PRINCIPAL", "postgres_role": "<SP_CLIENT_ID>", "auth_method": "LAKEBASE_OAUTH_V1"}}'`)
+}
+
+// createBranchOverride adds --ttl and --no-expiry flags to create-branch, so
+// setting a branch's expiration doesn't need a hand-written --json spec (the
+// generated command leaves the nested spec to --json). It sets req.Branch.Spec in
+// PreRunE, before the generated RunE merges --json and calls the API — the same
+// way the generated --name flag pre-populates the request.
+func createBranchOverride(cmd *cobra.Command, req *postgres.CreateBranchRequest) {
+	var ttl string
+	var noExpiry bool
+	cmd.Flags().StringVar(&ttl, "ttl", "", "Relative time-to-live before the branch expires, e.g. 604800s, 168h, or 7d (7 days). Required unless --no-expiry.")
+	cmd.Flags().BoolVar(&noExpiry, "no-expiry", false, "Create the branch with no expiration. Required unless --ttl.")
+
+	prevPreRunE := cmd.PreRunE
+	cmd.PreRunE = func(cmd *cobra.Command, args []string) error {
+		var jsonBranch postgres.Branch
+		if cmd.Flags().Changed("json") {
+			jf, err := postgresJSONFlag(cmd, "create-branch")
+			if err != nil {
+				return err
+			}
+			// Decode --json into the SDK type via the same path the generated
+			// RunE uses, so expiration detection can't drift from the real merge.
+			if diags := jf.Unmarshal(&jsonBranch); diags.HasError() {
+				return diags.Error()
+			}
+		}
+
+		spec, err := reconcileBranchExpiration(req.Branch.Spec, cmd.Flags().Changed("ttl"), ttl, cmd.Flags().Changed("no-expiry"), noExpiry, specHasExpiration(jsonBranch.Spec))
+		if err != nil {
+			return err
+		}
+		req.Branch.Spec = spec
+
+		if prevPreRunE != nil {
+			return prevPreRunE(cmd, args)
+		}
+		return nil
+	}
+
+	cmd.Long += `
+
+  Branch expiration (required — set exactly one):
+    --ttl <duration>   relative time-to-live; sets spec.ttl. Accepts the REST API
+                       form (604800s), a Go duration (168h), or day/week units
+                       (7d, 3w) — 604800s, 168h and 7d all mean 7 days.
+    --no-expiry        the branch never expires (sets spec.no_expiry).
+
+  You must set --ttl, --no-expiry, or an expiration inside --json (spec.ttl /
+  spec.expire_time / spec.no_expiry). These are mutually exclusive.
+
+  Examples:
+
+    # Expire after 7 days
+    databricks postgres create-branch projects/<PROJECT_ID> <BRANCH_ID> --ttl 604800s
+
+    # Never expire
+    databricks postgres create-branch projects/<PROJECT_ID> <BRANCH_ID> --no-expiry`
+}
+
+// postgresJSONFlag returns the --json flag for a generated postgres create
+// command, or a loud internal error if it is missing or mistyped (a codegen
+// change would be the cause). cmdName names the command for the error message.
+func postgresJSONFlag(cmd *cobra.Command, cmdName string) (*flags.JsonFlag, error) {
+	flag := cmd.Flags().Lookup("json")
+	if flag == nil {
+		return nil, fmt.Errorf("internal: postgres %s expected a --json flag; this override is wired to the wrong command", cmdName)
+	}
+	jf, ok := flag.Value.(*flags.JsonFlag)
+	if !ok {
+		return nil, fmt.Errorf("internal: postgres %s --json flag has unexpected type %T; expected *flags.JsonFlag", cmdName, flag.Value)
+	}
+	return jf, nil
+}
+
+// reconcileBranchExpiration builds the BranchSpec from the --ttl / --no-expiry
+// flags before --json is merged; jsonHasExpiration reports whether --json already
+// sets one. Exactly one expiration source is required, and the three are mutually
+// exclusive (the API rejects no_expiry=false and multiple sources). When the
+// expiration comes from --json alone, spec is left for the generated RunE to merge.
+func reconcileBranchExpiration(spec *postgres.BranchSpec, ttlChanged bool, ttl string, noExpiryChanged, noExpiry, jsonHasExpiration bool) (*postgres.BranchSpec, error) {
+	// --no-expiry=false asks for "expiry on" without saying how, which the API
+	// rejects; point the user at the flag that expresses intent.
+	if noExpiryChanged && !noExpiry {
+		return nil, errors.New("--no-expiry=false is not valid; set --ttl <duration> such as 604800s, or spec.expire_time via --json")
+	}
+
+	flagTTL := ttlChanged
+	flagNoExpiry := noExpiryChanged && noExpiry
+
+	sources := 0
+	for _, set := range []bool{flagTTL, flagNoExpiry, jsonHasExpiration} {
+		if set {
+			sources++
+		}
+	}
+	switch {
+	case sources == 0:
+		return nil, errors.New("a branch expiration is required; set --ttl <duration> such as 604800s, --no-expiry, or a spec expiration in --json")
+	case sources > 1:
+		return nil, errors.New("branch expiration set more than once; use exactly one of --ttl, --no-expiry, or a spec expiration in --json")
+	}
+
+	switch {
+	case flagTTL:
+		d, err := parseTTL(ttl)
+		if err != nil {
+			return nil, err
+		}
+		if spec == nil {
+			spec = &postgres.BranchSpec{}
+		}
+		spec.Ttl = d
+	case flagNoExpiry:
+		if spec == nil {
+			spec = &postgres.BranchSpec{}
+		}
+		spec.NoExpiry = true
+	case jsonHasExpiration:
+		// Expiration comes from --json; leave spec for the generated RunE to merge.
+	}
+	return spec, nil
+}
+
+// specHasExpiration reports whether a decoded BranchSpec sets an expiration:
+// spec.ttl, spec.expire_time, or spec.no_expiry. no_expiry present as false still
+// counts as "set" (detected via ForceSendFields, which the SDK decode populates
+// for explicit zero values), so combining it with --no-expiry is caught as a
+// conflict instead of the json silently overriding the flag on the wire.
+func specHasExpiration(s *postgres.BranchSpec) bool {
+	return s != nil && (s.Ttl != nil || s.ExpireTime != nil || s.NoExpiry ||
+		slices.Contains(s.ForceSendFields, "NoExpiry"))
+}
+
+// parseTTL parses the --ttl value into a *duration.Duration. It accepts the REST
+// API's protobuf-duration form ("604800s"), Go-style durations ("168h"), and the
+// day/week extension ("7d", "3w"); duration.New re-serializes to the API form.
+func parseTTL(s string) (*duration.Duration, error) {
+	if s == "" {
+		return nil, errors.New("--ttl must not be empty; use e.g. 604800s, 168h, or 7d for 7 days")
+	}
+	d, err := parseTTLDuration(s)
+	if err != nil {
+		return nil, fmt.Errorf("invalid --ttl %q: %w; use e.g. 604800s, 168h, 7d, or 3w", s, err)
+	}
+	if d <= 0 {
+		return nil, fmt.Errorf("invalid --ttl %q: must be a positive duration", s)
+	}
+	return duration.New(d), nil
+}
+
+// ttlComponent matches one leading "<number><unit>" component of a duration
+// string, including the day (d) and week (w) units time.ParseDuration lacks.
+var ttlComponent = regexp.MustCompile(`^([0-9]+(?:\.[0-9]+)?)(ns|us|µs|ms|s|m|h|d|w)`)
+
+const (
+	hoursPerDay  = 24
+	hoursPerWeek = 24 * 7
+	// maxDurationHours is the largest whole-hour count representable as a
+	// time.Duration (an int64 nanosecond count).
+	maxDurationHours = int64(math.MaxInt64) / int64(time.Hour)
+)
+
+// parseTTLDuration parses a Go duration string extended with day (d, = 24h) and
+// week (w, = 168h) units. Components in those units are summed here; all other
+// components (h and below) are handed to time.ParseDuration unchanged, which
+// keeps its exact integer handling for the common forms.
+func parseTTLDuration(s string) (time.Duration, error) {
+	// Fast path: no day/week unit means time.ParseDuration handles it all. No
+	// other supported unit contains 'd' or 'w', so this check is exact.
+	if !strings.ContainsAny(s, "dw") {
+		return time.ParseDuration(s)
+	}
+
+	rest := s
+	neg := false
+	switch {
+	case strings.HasPrefix(rest, "-"):
+		neg, rest = true, rest[1:]
+	case strings.HasPrefix(rest, "+"):
+		rest = rest[1:]
+	}
+
+	var extra time.Duration      // accumulated day/week components
+	var residual strings.Builder // remaining components, parsed by time.ParseDuration
+	for rest != "" {
+		m := ttlComponent.FindStringSubmatch(rest)
+		if m == nil {
+			return 0, fmt.Errorf("unrecognized duration component %q", rest)
+		}
+		switch m[2] {
+		case "d", "w":
+			hoursPerUnit := int64(hoursPerDay)
+			if m[2] == "w" {
+				hoursPerUnit = hoursPerWeek
+			}
+			if strings.Contains(m[1], ".") {
+				f, err := strconv.ParseFloat(m[1], 64)
+				if err != nil {
+					return 0, err
+				}
+				ns := f * float64(hoursPerUnit) * float64(time.Hour)
+				if ns > float64(math.MaxInt64) {
+					return 0, fmt.Errorf("duration component %s%s overflows", m[1], m[2])
+				}
+				extra += time.Duration(ns)
+			} else {
+				n, err := strconv.ParseInt(m[1], 10, 64)
+				if err != nil {
+					return 0, err
+				}
+				if n > maxDurationHours/hoursPerUnit {
+					return 0, fmt.Errorf("duration component %s%s overflows", m[1], m[2])
+				}
+				extra += time.Duration(n*hoursPerUnit) * time.Hour
+			}
+		default:
+			residual.WriteString(m[1])
+			residual.WriteString(m[2])
+		}
+		rest = rest[len(m[0]):]
+	}
+
+	total := extra
+	if residual.Len() > 0 {
+		d, err := time.ParseDuration(residual.String())
+		if err != nil {
+			return 0, err
+		}
+		total += d
+	}
+	if neg {
+		total = -total
+	}
+	return total, nil
+}
+
+func init() {
+	createRoleOverrides = append(createRoleOverrides, createRoleOverride)
+	createBranchOverrides = append(createBranchOverrides, createBranchOverride)
+}
diff --git a/cmd/workspace/postgres/overrides_test.go b/cmd/workspace/postgres/overrides_test.go
new file mode 100644
index 00000000000..3154a20336a
--- /dev/null
+++ b/cmd/workspace/postgres/overrides_test.go
@@ -0,0 +1,234 @@
+package postgres
+
+import (
+	"testing"
+	"time"
+
+	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/databricks-sdk-go/common/types/duration"
+	sdktime "github.com/databricks/databricks-sdk-go/common/types/time"
+	"github.com/databricks/databricks-sdk-go/service/postgres"
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func cmdWithJSON(t *testing.T, raw string) *cobra.Command {
+	t.Helper()
+	cmd := &cobra.Command{}
+	var jf flags.JsonFlag
+	cmd.Flags().Var(&jf, "json", "JSON body")
+	if raw != "" {
+		require.NoError(t, jf.Set(raw))
+	}
+	return cmd
+}
+
+func TestRejectWrappedRoleJSON(t *testing.T) {
+	t.Run("rejects wrapped {role: ...}", func(t *testing.T) {
+		cmd := cmdWithJSON(t, `{"role":{"spec":{"identity_type":"SERVICE_PRINCIPAL"}}}`)
+		err := rejectWrappedRoleJSON(cmd)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "should NOT be wrapped")
+		assert.Contains(t, err.Error(), `databricks postgres create-role`)
+	})
+
+	t.Run("passes when body has spec at top level", func(t *testing.T) {
+		cmd := cmdWithJSON(t, `{"spec":{"identity_type":"SERVICE_PRINCIPAL"}}`)
+		assert.NoError(t, rejectWrappedRoleJSON(cmd))
+	})
+
+	t.Run("passes when --json was not provided", func(t *testing.T) {
+		cmd := cmdWithJSON(t, "")
+		assert.NoError(t, rejectWrappedRoleJSON(cmd))
+	})
+
+	t.Run("passes through non-object JSON to the generated diagnostics path", func(t *testing.T) {
+		cmd := cmdWithJSON(t, `"not-an-object"`)
+		assert.NoError(t, rejectWrappedRoleJSON(cmd))
+	})
+
+	t.Run("fails loudly when --json flag is absent on the command", func(t *testing.T) {
+		// Internal invariant: postgres create-role is a generated command and
+		// always has a --json flag. If a future codegen change drops it, this
+		// override is wired to the wrong command and should fail loudly so the
+		// regression is caught rather than silently disabling the guard.
+		err := rejectWrappedRoleJSON(&cobra.Command{})
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "internal:")
+	})
+}
+
+const sevenDays = 7 * 24 * time.Hour
+
+func TestReconcileBranchExpiration(t *testing.T) {
+	tests := []struct {
+		name            string
+		spec            *postgres.BranchSpec
+		ttlChanged      bool
+		ttl             string
+		noExpiryChanged bool
+		noExpiry        bool
+		jsonExpiration  bool
+		wantErr         string
+		check           func(t *testing.T, spec *postgres.BranchSpec)
+	}{
+		{
+			name:    "no flags, nil spec -> expiration required",
+			wantErr: "a branch expiration is required",
+		},
+		{
+			name:       "ttl API form",
+			ttlChanged: true,
+			ttl:        "604800s",
+			check: func(t *testing.T, spec *postgres.BranchSpec) {
+				require.NotNil(t, spec.Ttl)
+				assert.Equal(t, sevenDays, spec.Ttl.AsDuration())
+				assert.False(t, spec.NoExpiry)
+			},
+		},
+		{
+			name:       "ttl Go duration form",
+			ttlChanged: true,
+			ttl:        "168h",
+			check: func(t *testing.T, spec *postgres.BranchSpec) {
+				require.NotNil(t, spec.Ttl)
+				assert.Equal(t, sevenDays, spec.Ttl.AsDuration())
+			},
+		},
+		{
+			name:            "no-expiry flag",
+			noExpiryChanged: true,
+			noExpiry:        true,
+			check: func(t *testing.T, spec *postgres.BranchSpec) {
+				assert.True(t, spec.NoExpiry)
+			},
+		},
+		{
+			name:    "non-expiration spec field is not an expiration source",
+			spec:    &postgres.BranchSpec{SourceBranch: "projects/p/branches/main"},
+			wantErr: "a branch expiration is required",
+		},
+		{
+			name:           "json expiration alone leaves spec untouched",
+			jsonExpiration: true,
+			check: func(t *testing.T, spec *postgres.BranchSpec) {
+				// spec stays nil so the generated RunE merges --json's expiration.
+				assert.Nil(t, spec)
+			},
+		},
+		{
+			name:            "ttl and no-expiry conflict",
+			ttlChanged:      true,
+			ttl:             "604800s",
+			noExpiryChanged: true,
+			noExpiry:        true,
+			wantErr:         "set more than once",
+		},
+		{
+			name:           "ttl and json expiration conflict",
+			ttlChanged:     true,
+			ttl:            "604800s",
+			jsonExpiration: true,
+			wantErr:        "set more than once",
+		},
+		{
+			name:            "no-expiry and json expiration conflict",
+			noExpiryChanged: true,
+			noExpiry:        true,
+			jsonExpiration:  true,
+			wantErr:         "set more than once",
+		},
+		{
+			name:            "no-expiry=false is rejected",
+			noExpiryChanged: true,
+			noExpiry:        false,
+			wantErr:         "--no-expiry=false is not valid",
+		},
+		{
+			name:       "invalid ttl",
+			ttlChanged: true,
+			ttl:        "7x",
+			wantErr:    "invalid --ttl",
+		},
+		{
+			name:       "empty ttl",
+			ttlChanged: true,
+			ttl:        "",
+			wantErr:    "must not be empty",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			spec, err := reconcileBranchExpiration(tc.spec, tc.ttlChanged, tc.ttl, tc.noExpiryChanged, tc.noExpiry, tc.jsonExpiration)
+			if tc.wantErr != "" {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), tc.wantErr)
+				return
+			}
+			require.NoError(t, err)
+			tc.check(t, spec)
+		})
+	}
+}
+
+func TestParseTTL(t *testing.T) {
+	valid := map[string]time.Duration{
+		"604800s": sevenDays,
+		"168h":    sevenDays,
+		"7d":      sevenDays,
+		"1w":      sevenDays,
+		"1.5s":    1500 * time.Millisecond,
+		"12d":     12 * 24 * time.Hour,
+		"3w":      3 * 7 * 24 * time.Hour,
+		"1.5d":    36 * time.Hour,
+		"1w3d":    10 * 24 * time.Hour,
+		"7d12h":   7*24*time.Hour + 12*time.Hour,
+	}
+	for in, want := range valid {
+		t.Run("valid/"+in, func(t *testing.T) {
+			d, err := parseTTL(in)
+			require.NoError(t, err)
+			require.NotNil(t, d)
+			assert.Equal(t, want, d.AsDuration())
+		})
+	}
+
+	for _, in := range []string{"", "abc", "0s", "0d", "-1h", "7x", "7dd", "d", "100000000000000000d", "9999999999w"} {
+		t.Run("invalid/"+in, func(t *testing.T) {
+			_, err := parseTTL(in)
+			assert.Error(t, err)
+		})
+	}
+}
+
+func TestSpecHasExpiration(t *testing.T) {
+	tests := []struct {
+		name string
+		spec *postgres.BranchSpec
+		want bool
+	}{
+		{"nil spec", nil, false},
+		{"empty spec", &postgres.BranchSpec{}, false},
+		{"ttl set", &postgres.BranchSpec{Ttl: duration.New(sevenDays)}, true},
+		{"expire_time set", &postgres.BranchSpec{ExpireTime: sdktime.New(time.Now())}, true},
+		{"no_expiry true", &postgres.BranchSpec{NoExpiry: true}, true},
+		{"no_expiry false, unset", &postgres.BranchSpec{NoExpiry: false}, false},
+		{"no_expiry false, explicitly set", &postgres.BranchSpec{NoExpiry: false, ForceSendFields: []string{"NoExpiry"}}, true},
+		{"non-expiration field only", &postgres.BranchSpec{SourceBranch: "projects/p/branches/main"}, false},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, specHasExpiration(tc.spec))
+		})
+	}
+}
+
+func TestCreateBranchOverrideWiring(t *testing.T) {
+	cmd := newCreateBranch()
+	assert.NotNil(t, cmd.Flags().Lookup("ttl"))
+	assert.NotNil(t, cmd.Flags().Lookup("no-expiry"))
+	assert.Contains(t, cmd.Long, "--ttl")
+	assert.Contains(t, cmd.Long, "604800s")
+}
diff --git a/cmd/workspace/postgres/postgres.go b/cmd/workspace/postgres/postgres.go
old mode 100755
new mode 100644
index e60842b1e76..d8e4689445f
--- a/cmd/workspace/postgres/postgres.go
+++ b/cmd/workspace/postgres/postgres.go
@@ -3,6 +3,8 @@
 package postgres
 
 import (
+	"encoding/json"
+	"errors"
 	"fmt"
 	"strings"
 	"time"
@@ -11,7 +13,9 @@ import (
 	"github.com/databricks/cli/libs/cmdctx"
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/databricks-sdk-go/common/types/duration"
 	"github.com/databricks/databricks-sdk-go/common/types/fieldmask"
+	sdktime "github.com/databricks/databricks-sdk-go/common/types/time"
 	"github.com/databricks/databricks-sdk-go/experimental/api"
 	"github.com/databricks/databricks-sdk-go/service/postgres"
 	"github.com/spf13/cobra"
@@ -41,40 +45,63 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreateBranch())
 	cmd.AddCommand(newCreateCatalog())
+	cmd.AddCommand(newCreateCdfConfig())
+	cmd.AddCommand(newCreateDataApi())
 	cmd.AddCommand(newCreateDatabase())
 	cmd.AddCommand(newCreateEndpoint())
 	cmd.AddCommand(newCreateProject())
 	cmd.AddCommand(newCreateRole())
+	cmd.AddCommand(newCreateSnapshot())
 	cmd.AddCommand(newCreateSyncedTable())
 	cmd.AddCommand(newDeleteBranch())
 	cmd.AddCommand(newDeleteCatalog())
+	cmd.AddCommand(newDeleteCdfConfig())
+	cmd.AddCommand(newDeleteDataApi())
 	cmd.AddCommand(newDeleteDatabase())
 	cmd.AddCommand(newDeleteEndpoint())
 	cmd.AddCommand(newDeleteProject())
 	cmd.AddCommand(newDeleteRole())
+	cmd.AddCommand(newDeleteSnapshot())
 	cmd.AddCommand(newDeleteSyncedTable())
 	cmd.AddCommand(newGenerateDatabaseCredential())
 	cmd.AddCommand(newGetBranch())
 	cmd.AddCommand(newGetCatalog())
+	cmd.AddCommand(newGetCdfConfig())
+	cmd.AddCommand(newGetCdfStatus())
+	cmd.AddCommand(newGetDataApi())
 	cmd.AddCommand(newGetDatabase())
 	cmd.AddCommand(newGetEndpoint())
 	cmd.AddCommand(newGetOperation())
 	cmd.AddCommand(newGetProject())
 	cmd.AddCommand(newGetRole())
+	cmd.AddCommand(newGetSnapshot())
+	cmd.AddCommand(newGetSnapshotSchedule())
 	cmd.AddCommand(newGetSyncedTable())
 	cmd.AddCommand(newListBranches())
+	cmd.AddCommand(newListCdfConfigs())
+	cmd.AddCommand(newListCdfStatuses())
 	cmd.AddCommand(newListDatabases())
 	cmd.AddCommand(newListEndpoints())
 	cmd.AddCommand(newListProjects())
 	cmd.AddCommand(newListRoles())
+	cmd.AddCommand(newListSnapshots())
+	cmd.AddCommand(newRevealRolePassword())
+	cmd.AddCommand(newUndeleteBranch())
+	cmd.AddCommand(newUndeleteProject())
 	cmd.AddCommand(newUpdateBranch())
+	cmd.AddCommand(newUpdateDataApi())
 	cmd.AddCommand(newUpdateDatabase())
 	cmd.AddCommand(newUpdateEndpoint())
 	cmd.AddCommand(newUpdateProject())
 	cmd.AddCommand(newUpdateRole())
+	cmd.AddCommand(newUpdateSnapshotSchedule())
 
 	// Apply optional overrides to this command.
 	for _, fn := range cmdOverrides {
@@ -108,6 +135,7 @@ func newCreateBranch() *cobra.Command {
 
 	cmd.Flags().Var(&createBranchJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
+	cmd.Flags().BoolVar(&createBranchReq.ReplaceExisting, "replace-existing", createBranchReq.ReplaceExisting, `If true, update the branch if it already exists instead of returning an error.`)
 	cmd.Flags().StringVar(&createBranchReq.Branch.Name, "name", createBranchReq.Branch.Name, `Output only.`)
 	// TODO: complex arg: spec
 	// TODO: complex arg: status
@@ -133,6 +161,8 @@ func newCreateBranch() *cobra.Command {
       projects/my-app/branches/development.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -253,6 +283,8 @@ func newCreateCatalog() *cobra.Command {
       example "my_catalog" becomes "catalogs/my_catalog".`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -328,6 +360,275 @@ func newCreateCatalog() *cobra.Command {
 	return cmd
 }
 
+// start create-cdf-config command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var createCdfConfigOverrides []func(
+	*cobra.Command,
+	*postgres.CreateCdfConfigRequest,
+)
+
+func newCreateCdfConfig() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var createCdfConfigReq postgres.CreateCdfConfigRequest
+	createCdfConfigReq.CdfConfig = postgres.CdfConfig{}
+	var createCdfConfigJson flags.JsonFlag
+
+	var createCdfConfigSkipWait bool
+	var createCdfConfigTimeout time.Duration
+
+	cmd.Flags().BoolVar(&createCdfConfigSkipWait, "no-wait", createCdfConfigSkipWait, `do not wait to reach DONE state`)
+	cmd.Flags().DurationVar(&createCdfConfigTimeout, "timeout", 0, `maximum amount of time to reach DONE state`)
+
+	cmd.Flags().Var(&createCdfConfigJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&createCdfConfigReq.CdfConfigId, "cdf-config-id", createCdfConfigReq.CdfConfigId, `The user-specified id for the CdfConfig, forming the final segment of its resource name.`)
+	cmd.Flags().StringVar(&createCdfConfigReq.CdfConfig.Name, "name", createCdfConfigReq.CdfConfig.Name, `Output only.`)
+
+	cmd.Use = "create-cdf-config PARENT CATALOG SCHEMA POSTGRES_SCHEMA"
+	cmd.Short = `*Beta* Create a change data feed configuration.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Create a change data feed configuration.
+
+  Create a CDF configuration that materializes the change data feed for all
+  tables in a Postgres schema as open-format Delta tables in Unity Catalog. Once
+  created, each table's change history is continuously written to its
+  corresponding Lakehouse table.
+
+  This is a long-running operation. By default, the command waits for the
+  operation to complete. Use --no-wait to return immediately with the raw
+  operation details. The operation's 'name' field can then be used to poll for
+  completion using the get-operation command.
+
+  Arguments:
+    PARENT: The parent database under which to create the CdfConfig. Format:
+      projects/{project}/branches/{branch}/databases/{database}
+    CATALOG: The Unity Catalog catalog that replicated tables are written into. Set at
+      creation; the CdfConfig is immutable.
+    SCHEMA: The Unity Catalog schema that replicated tables are written into. Set at
+      creation; the CdfConfig is immutable.
+    POSTGRES_SCHEMA: The Postgres schema this CdfConfig replicates from. Unique within the
+      parent database. Set at creation; the CdfConfig is immutable.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(1)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only PARENT as positional arguments. Provide 'catalog', 'schema', 'postgres_schema' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(4)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := createCdfConfigJson.Unmarshal(&createCdfConfigReq.CdfConfig)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		createCdfConfigReq.Parent = args[0]
+		if !cmd.Flags().Changed("json") {
+			createCdfConfigReq.CdfConfig.Catalog = args[1]
+		}
+		if !cmd.Flags().Changed("json") {
+			createCdfConfigReq.CdfConfig.Schema = args[2]
+		}
+		if !cmd.Flags().Changed("json") {
+			createCdfConfigReq.CdfConfig.PostgresSchema = args[3]
+		}
+
+		// Determine which mode to execute based on flags.
+		switch {
+		case createCdfConfigSkipWait:
+			wait, err := w.Postgres.CreateCdfConfig(ctx, createCdfConfigReq)
+			if err != nil {
+				return err
+			}
+
+			// Return operation immediately without waiting.
+			operation, err := w.Postgres.GetOperation(ctx, postgres.GetOperationRequest{
+				Name: wait.Name(),
+			})
+			if err != nil {
+				return err
+			}
+			return cmdio.Render(ctx, operation)
+
+		default:
+			wait, err := w.Postgres.CreateCdfConfig(ctx, createCdfConfigReq)
+			if err != nil {
+				return err
+			}
+
+			// Show spinner while waiting for completion.
+			sp := cmdio.NewSpinner(ctx)
+			sp.Update("Waiting for create-cdf-config to complete...")
+
+			// Wait for completion.
+			opts := api.WithTimeout(createCdfConfigTimeout)
+			response, err := wait.Wait(ctx, opts)
+			if err != nil {
+				return err
+			}
+			sp.Close()
+			return cmdio.Render(ctx, response)
+		}
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range createCdfConfigOverrides {
+		fn(cmd, &createCdfConfigReq)
+	}
+
+	return cmd
+}
+
+// start create-data-api command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var createDataApiOverrides []func(
+	*cobra.Command,
+	*postgres.CreateDataApiRequest,
+)
+
+func newCreateDataApi() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var createDataApiReq postgres.CreateDataApiRequest
+	createDataApiReq.DataApi = postgres.DataApi{}
+	var createDataApiJson flags.JsonFlag
+
+	var createDataApiSkipWait bool
+	var createDataApiTimeout time.Duration
+
+	cmd.Flags().BoolVar(&createDataApiSkipWait, "no-wait", createDataApiSkipWait, `do not wait to reach DONE state`)
+	cmd.Flags().DurationVar(&createDataApiTimeout, "timeout", 0, `maximum amount of time to reach DONE state`)
+
+	cmd.Flags().Var(&createDataApiJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&createDataApiReq.DataApi.Name, "name", createDataApiReq.DataApi.Name, `Resource name: projects/{project_id}/branches/{branch_id}/databases/{database_id}/data-api.`)
+	// TODO: complex arg: spec
+	// TODO: complex arg: status
+
+	cmd.Use = "create-data-api PARENT"
+	cmd.Short = `Enable Data API for a database.`
+	cmd.Long = `Enable Data API for a database.
+
+  This is a long-running operation. By default, the command waits for the
+  operation to complete. Use --no-wait to return immediately with the raw
+  operation details. The operation's 'name' field can then be used to poll for
+  completion using the get-operation command.
+
+  Arguments:
+    PARENT: Parent database:
+      projects/{project_id}/branches/{branch_id}/databases/{database_id}`
+
+	// This command is being previewed; hide from help output.
+	cmd.Hidden = true
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := createDataApiJson.Unmarshal(&createDataApiReq.DataApi)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		createDataApiReq.Parent = args[0]
+
+		// Determine which mode to execute based on flags.
+		switch {
+		case createDataApiSkipWait:
+			wait, err := w.Postgres.CreateDataApi(ctx, createDataApiReq)
+			if err != nil {
+				return err
+			}
+
+			// Return operation immediately without waiting.
+			operation, err := w.Postgres.GetOperation(ctx, postgres.GetOperationRequest{
+				Name: wait.Name(),
+			})
+			if err != nil {
+				return err
+			}
+			return cmdio.Render(ctx, operation)
+
+		default:
+			wait, err := w.Postgres.CreateDataApi(ctx, createDataApiReq)
+			if err != nil {
+				return err
+			}
+
+			// Show spinner while waiting for completion.
+			sp := cmdio.NewSpinner(ctx)
+			sp.Update("Waiting for create-data-api to complete...")
+
+			// Wait for completion.
+			opts := api.WithTimeout(createDataApiTimeout)
+			response, err := wait.Wait(ctx, opts)
+			if err != nil {
+				return err
+			}
+			sp.Close()
+			return cmdio.Render(ctx, response)
+		}
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range createDataApiOverrides {
+		fn(cmd, &createDataApiReq)
+	}
+
+	return cmd
+}
+
 // start create-database command
 
 // Slice with functions to override default command behavior.
@@ -353,6 +654,7 @@ func newCreateDatabase() *cobra.Command {
 	cmd.Flags().Var(&createDatabaseJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Flags().StringVar(&createDatabaseReq.DatabaseId, "database-id", createDatabaseReq.DatabaseId, `The ID to use for the Database, which will become the final component of the database's resource name.`)
+	cmd.Flags().BoolVar(&createDatabaseReq.ReplaceExisting, "replace-existing", createDatabaseReq.ReplaceExisting, `If true, update the database if it already exists instead of returning an error.`)
 	cmd.Flags().StringVar(&createDatabaseReq.Database.Name, "name", createDatabaseReq.Database.Name, `The resource name of the database.`)
 	// TODO: complex arg: spec
 	// TODO: complex arg: status
@@ -375,10 +677,9 @@ func newCreateDatabase() *cobra.Command {
     PARENT: The Branch where this Database will be created. Format:
       projects/{project_id}/branches/{branch_id}`
 
-	// This command is being previewed; hide from help output.
-	cmd.Hidden = true
-
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -478,6 +779,7 @@ func newCreateEndpoint() *cobra.Command {
 
 	cmd.Flags().Var(&createEndpointJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
+	cmd.Flags().BoolVar(&createEndpointReq.ReplaceExisting, "replace-existing", createEndpointReq.ReplaceExisting, `If true, update the endpoint if it already exists instead of returning an error.`)
 	cmd.Flags().StringVar(&createEndpointReq.Endpoint.Name, "name", createEndpointReq.Endpoint.Name, `Output only.`)
 	// TODO: complex arg: spec
 	// TODO: complex arg: status
@@ -503,6 +805,8 @@ func newCreateEndpoint() *cobra.Command {
       projects/my-app/branches/development/endpoints/primary.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -603,6 +907,7 @@ func newCreateProject() *cobra.Command {
 
 	cmd.Flags().Var(&createProjectJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
+	// TODO: complex arg: initial_branch_spec
 	// TODO: complex arg: initial_endpoint_spec
 	cmd.Flags().StringVar(&createProjectReq.Project.Name, "name", createProjectReq.Project.Name, `Output only.`)
 	// TODO: complex arg: spec
@@ -627,6 +932,8 @@ func newCreateProject() *cobra.Command {
       numbers, and hyphens. For example, my-app becomes projects/my-app.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -726,6 +1033,7 @@ func newCreateRole() *cobra.Command {
 
 	cmd.Flags().Var(&createRoleJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
+	cmd.Flags().BoolVar(&createRoleReq.ReplaceExisting, "replace-existing", createRoleReq.ReplaceExisting, `If true, update the role if it already exists instead of returning an error.`)
 	cmd.Flags().StringVar(&createRoleReq.RoleId, "role-id", createRoleReq.RoleId, `The ID to use for the Role, which will become the final component of the role's resource name.`)
 	cmd.Flags().StringVar(&createRoleReq.Role.Name, "name", createRoleReq.Role.Name, `Output only.`)
 	// TODO: complex arg: spec
@@ -747,6 +1055,8 @@ func newCreateRole() *cobra.Command {
       projects/{project_id}/branches/{branch_id}`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -822,39 +1132,42 @@ func newCreateRole() *cobra.Command {
 	return cmd
 }
 
-// start create-synced-table command
+// start create-snapshot command
 
 // Slice with functions to override default command behavior.
 // Functions can be added from the `init()` function in manually curated files in this directory.
-var createSyncedTableOverrides []func(
+var createSnapshotOverrides []func(
 	*cobra.Command,
-	*postgres.CreateSyncedTableRequest,
+	*postgres.CreateSnapshotRequest,
 )
 
-func newCreateSyncedTable() *cobra.Command {
+func newCreateSnapshot() *cobra.Command {
 	cmd := &cobra.Command{}
 
-	var createSyncedTableReq postgres.CreateSyncedTableRequest
-	createSyncedTableReq.SyncedTable = postgres.SyncedTable{}
-	var createSyncedTableJson flags.JsonFlag
+	var createSnapshotReq postgres.CreateSnapshotRequest
+	createSnapshotReq.Snapshot = postgres.Snapshot{}
+	var createSnapshotJson flags.JsonFlag
 
-	var createSyncedTableSkipWait bool
-	var createSyncedTableTimeout time.Duration
+	var createSnapshotSkipWait bool
+	var createSnapshotTimeout time.Duration
 
-	cmd.Flags().BoolVar(&createSyncedTableSkipWait, "no-wait", createSyncedTableSkipWait, `do not wait to reach DONE state`)
-	cmd.Flags().DurationVar(&createSyncedTableTimeout, "timeout", 0, `maximum amount of time to reach DONE state`)
+	cmd.Flags().BoolVar(&createSnapshotSkipWait, "no-wait", createSnapshotSkipWait, `do not wait to reach DONE state`)
+	cmd.Flags().DurationVar(&createSnapshotTimeout, "timeout", 0, `maximum amount of time to reach DONE state`)
 
-	cmd.Flags().Var(&createSyncedTableJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+	cmd.Flags().Var(&createSnapshotJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
-	cmd.Flags().StringVar(&createSyncedTableReq.SyncedTable.Name, "name", createSyncedTableReq.SyncedTable.Name, `Output only.`)
+	cmd.Flags().StringVar(&createSnapshotReq.Snapshot.Name, "name", createSnapshotReq.Snapshot.Name, `The resource name of the snapshot.`)
 	// TODO: complex arg: spec
 	// TODO: complex arg: status
 
-	cmd.Use = "create-synced-table SYNCED_TABLE_ID"
-	cmd.Short = `Create a Synced Database Table.`
-	cmd.Long = `Create a Synced Database Table.
+	cmd.Use = "create-snapshot PARENT SNAPSHOT_ID"
+	cmd.Short = `*Beta* Create a Snapshot.`
+	cmd.Long = `This command is in Beta and may change without notice.
 
-  Create a Synced Table.
+Create a Snapshot.
+
+  Creates a snapshot, an immutable point-in-time copy of a branch's data, within
+  the project.
 
   This is a long-running operation. By default, the command waits for the
   operation to complete. Use --no-wait to return immediately with the raw
@@ -862,23 +1175,16 @@ func newCreateSyncedTable() *cobra.Command {
   completion using the get-operation command.
 
   Arguments:
-    SYNCED_TABLE_ID: The ID to use for the Synced Table. This becomes the final component of
-      the SyncedTable's resource name. ID is required and is the synced table
-      name, containing (catalog, schema, table) tuple. Elements of the tuple are
-      the UC entity names.
-
-      Example: "{catalog}.{schema}.{table}"
-
-      synced_table_id represents both of the following:
-
-      1. An online VIEW virtual table in the Unity Catalog accessible via the
-      Lakehouse Federation. 2. Postgres table named "{table}" in schema
-      "{schema}" in the connected Postgres database`
+    PARENT: The project in which to create the snapshot. Format: projects/{project_id}
+    SNAPSHOT_ID: Client-chosen ID for the snapshot. It becomes the final segment of the
+      snapshot resource name and cannot be changed after creation.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
-		check := root.ExactArgs(1)
+		check := root.ExactArgs(2)
 		return check(cmd, args)
 	}
 
@@ -888,7 +1194,7 @@ func newCreateSyncedTable() *cobra.Command {
 		w := cmdctx.WorkspaceClient(ctx)
 
 		if cmd.Flags().Changed("json") {
-			diags := createSyncedTableJson.Unmarshal(&createSyncedTableReq.SyncedTable)
+			diags := createSnapshotJson.Unmarshal(&createSnapshotReq.Snapshot)
 			if diags.HasError() {
 				return diags.Error()
 			}
@@ -899,12 +1205,13 @@ func newCreateSyncedTable() *cobra.Command {
 				}
 			}
 		}
-		createSyncedTableReq.SyncedTableId = args[0]
+		createSnapshotReq.Parent = args[0]
+		createSnapshotReq.SnapshotId = args[1]
 
 		// Determine which mode to execute based on flags.
 		switch {
-		case createSyncedTableSkipWait:
-			wait, err := w.Postgres.CreateSyncedTable(ctx, createSyncedTableReq)
+		case createSnapshotSkipWait:
+			wait, err := w.Postgres.CreateSnapshot(ctx, createSnapshotReq)
 			if err != nil {
 				return err
 			}
@@ -919,17 +1226,17 @@ func newCreateSyncedTable() *cobra.Command {
 			return cmdio.Render(ctx, operation)
 
 		default:
-			wait, err := w.Postgres.CreateSyncedTable(ctx, createSyncedTableReq)
+			wait, err := w.Postgres.CreateSnapshot(ctx, createSnapshotReq)
 			if err != nil {
 				return err
 			}
 
 			// Show spinner while waiting for completion.
 			sp := cmdio.NewSpinner(ctx)
-			sp.Update("Waiting for create-synced-table to complete...")
+			sp.Update("Waiting for create-snapshot to complete...")
 
 			// Wait for completion.
-			opts := api.WithTimeout(createSyncedTableTimeout)
+			opts := api.WithTimeout(createSnapshotTimeout)
 			response, err := wait.Wait(ctx, opts)
 			if err != nil {
 				return err
@@ -944,38 +1251,46 @@ func newCreateSyncedTable() *cobra.Command {
 	cmd.ValidArgsFunction = cobra.NoFileCompletions
 
 	// Apply optional overrides to this command.
-	for _, fn := range createSyncedTableOverrides {
-		fn(cmd, &createSyncedTableReq)
+	for _, fn := range createSnapshotOverrides {
+		fn(cmd, &createSnapshotReq)
 	}
 
 	return cmd
 }
 
-// start delete-branch command
+// start create-synced-table command
 
 // Slice with functions to override default command behavior.
 // Functions can be added from the `init()` function in manually curated files in this directory.
-var deleteBranchOverrides []func(
+var createSyncedTableOverrides []func(
 	*cobra.Command,
-	*postgres.DeleteBranchRequest,
+	*postgres.CreateSyncedTableRequest,
 )
 
-func newDeleteBranch() *cobra.Command {
+func newCreateSyncedTable() *cobra.Command {
 	cmd := &cobra.Command{}
 
-	var deleteBranchReq postgres.DeleteBranchRequest
+	var createSyncedTableReq postgres.CreateSyncedTableRequest
+	createSyncedTableReq.SyncedTable = postgres.SyncedTable{}
+	var createSyncedTableJson flags.JsonFlag
 
-	var deleteBranchSkipWait bool
-	var deleteBranchTimeout time.Duration
+	var createSyncedTableSkipWait bool
+	var createSyncedTableTimeout time.Duration
 
-	cmd.Flags().BoolVar(&deleteBranchSkipWait, "no-wait", deleteBranchSkipWait, `do not wait to reach DONE state`)
-	cmd.Flags().DurationVar(&deleteBranchTimeout, "timeout", 0, `maximum amount of time to reach DONE state`)
+	cmd.Flags().BoolVar(&createSyncedTableSkipWait, "no-wait", createSyncedTableSkipWait, `do not wait to reach DONE state`)
+	cmd.Flags().DurationVar(&createSyncedTableTimeout, "timeout", 0, `maximum amount of time to reach DONE state`)
 
-	cmd.Use = "delete-branch NAME"
-	cmd.Short = `Delete a Branch.`
-	cmd.Long = `Delete a Branch.
+	cmd.Flags().Var(&createSyncedTableJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
-  Deletes the specified database branch.
+	cmd.Flags().StringVar(&createSyncedTableReq.SyncedTable.Name, "name", createSyncedTableReq.SyncedTable.Name, `Output only.`)
+	// TODO: complex arg: spec
+	// TODO: complex arg: status
+
+	cmd.Use = "create-synced-table SYNCED_TABLE_ID"
+	cmd.Short = `Create a Synced Database Table.`
+	cmd.Long = `Create a Synced Database Table.
+
+  Create a Synced Table.
 
   This is a long-running operation. By default, the command waits for the
   operation to complete. Use --no-wait to return immediately with the raw
@@ -983,10 +1298,22 @@ func newDeleteBranch() *cobra.Command {
   completion using the get-operation command.
 
   Arguments:
-    NAME: The full resource path of the branch to delete. Format:
-      projects/{project_id}/branches/{branch_id}`
+    SYNCED_TABLE_ID: The ID to use for the Synced Table. This becomes the final component of
+      the SyncedTable's resource name. ID is required and is the synced table
+      name, containing (catalog, schema, table) tuple. Elements of the tuple are
+      the UC entity names.
+
+      Example: "{catalog}.{schema}.{table}"
+
+      synced_table_id represents both of the following:
+
+      1. An online VIEW virtual table in the Unity Catalog accessible via the
+      Lakehouse Federation. 2. Postgres table named "{table}" in schema
+      "{schema}" in the connected Postgres database`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -998,12 +1325,24 @@ func newDeleteBranch() *cobra.Command {
 		ctx := cmd.Context()
 		w := cmdctx.WorkspaceClient(ctx)
 
-		deleteBranchReq.Name = args[0]
+		if cmd.Flags().Changed("json") {
+			diags := createSyncedTableJson.Unmarshal(&createSyncedTableReq.SyncedTable)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		createSyncedTableReq.SyncedTableId = args[0]
 
 		// Determine which mode to execute based on flags.
 		switch {
-		case deleteBranchSkipWait:
-			wait, err := w.Postgres.DeleteBranch(ctx, deleteBranchReq)
+		case createSyncedTableSkipWait:
+			wait, err := w.Postgres.CreateSyncedTable(ctx, createSyncedTableReq)
 			if err != nil {
 				return err
 			}
@@ -1018,24 +1357,23 @@ func newDeleteBranch() *cobra.Command {
 			return cmdio.Render(ctx, operation)
 
 		default:
-			wait, err := w.Postgres.DeleteBranch(ctx, deleteBranchReq)
+			wait, err := w.Postgres.CreateSyncedTable(ctx, createSyncedTableReq)
 			if err != nil {
 				return err
 			}
 
 			// Show spinner while waiting for completion.
 			sp := cmdio.NewSpinner(ctx)
-			sp.Update("Waiting for delete-branch to complete...")
+			sp.Update("Waiting for create-synced-table to complete...")
 
 			// Wait for completion.
-			opts := api.WithTimeout(deleteBranchTimeout)
-
-			err = wait.Wait(ctx, opts)
+			opts := api.WithTimeout(createSyncedTableTimeout)
+			response, err := wait.Wait(ctx, opts)
 			if err != nil {
 				return err
 			}
 			sp.Close()
-			return nil
+			return cmdio.Render(ctx, response)
 		}
 	}
 
@@ -1044,36 +1382,40 @@ func newDeleteBranch() *cobra.Command {
 	cmd.ValidArgsFunction = cobra.NoFileCompletions
 
 	// Apply optional overrides to this command.
-	for _, fn := range deleteBranchOverrides {
-		fn(cmd, &deleteBranchReq)
+	for _, fn := range createSyncedTableOverrides {
+		fn(cmd, &createSyncedTableReq)
 	}
 
 	return cmd
 }
 
-// start delete-catalog command
+// start delete-branch command
 
 // Slice with functions to override default command behavior.
 // Functions can be added from the `init()` function in manually curated files in this directory.
-var deleteCatalogOverrides []func(
+var deleteBranchOverrides []func(
 	*cobra.Command,
-	*postgres.DeleteCatalogRequest,
+	*postgres.DeleteBranchRequest,
 )
 
-func newDeleteCatalog() *cobra.Command {
+func newDeleteBranch() *cobra.Command {
 	cmd := &cobra.Command{}
 
-	var deleteCatalogReq postgres.DeleteCatalogRequest
+	var deleteBranchReq postgres.DeleteBranchRequest
 
-	var deleteCatalogSkipWait bool
-	var deleteCatalogTimeout time.Duration
+	var deleteBranchSkipWait bool
+	var deleteBranchTimeout time.Duration
 
-	cmd.Flags().BoolVar(&deleteCatalogSkipWait, "no-wait", deleteCatalogSkipWait, `do not wait to reach DONE state`)
-	cmd.Flags().DurationVar(&deleteCatalogTimeout, "timeout", 0, `maximum amount of time to reach DONE state`)
+	cmd.Flags().BoolVar(&deleteBranchSkipWait, "no-wait", deleteBranchSkipWait, `do not wait to reach DONE state`)
+	cmd.Flags().DurationVar(&deleteBranchTimeout, "timeout", 0, `maximum amount of time to reach DONE state`)
 
-	cmd.Use = "delete-catalog NAME"
-	cmd.Short = `Delete a Database Catalog.`
-	cmd.Long = `Delete a Database Catalog.
+	cmd.Flags().BoolVar(&deleteBranchReq.Purge, "purge", deleteBranchReq.Purge, `If true, permanently delete the branch; if false, soft delete.`)
+
+	cmd.Use = "delete-branch NAME"
+	cmd.Short = `Delete a Branch.`
+	cmd.Long = `Delete a Branch.
+
+  Deletes the specified database branch.
 
   This is a long-running operation. By default, the command waits for the
   operation to complete. Use --no-wait to return immediately with the raw
@@ -1081,11 +1423,12 @@ func newDeleteCatalog() *cobra.Command {
   completion using the get-operation command.
 
   Arguments:
-    NAME: The full resource path of the catalog to delete.
-
-      Format: "catalogs/{catalog_id}".`
+    NAME: The full resource path of the branch to delete. Format:
+      projects/{project_id}/branches/{branch_id}`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1097,12 +1440,12 @@ func newDeleteCatalog() *cobra.Command {
 		ctx := cmd.Context()
 		w := cmdctx.WorkspaceClient(ctx)
 
-		deleteCatalogReq.Name = args[0]
+		deleteBranchReq.Name = args[0]
 
 		// Determine which mode to execute based on flags.
 		switch {
-		case deleteCatalogSkipWait:
-			wait, err := w.Postgres.DeleteCatalog(ctx, deleteCatalogReq)
+		case deleteBranchSkipWait:
+			wait, err := w.Postgres.DeleteBranch(ctx, deleteBranchReq)
 			if err != nil {
 				return err
 			}
@@ -1117,17 +1460,17 @@ func newDeleteCatalog() *cobra.Command {
 			return cmdio.Render(ctx, operation)
 
 		default:
-			wait, err := w.Postgres.DeleteCatalog(ctx, deleteCatalogReq)
+			wait, err := w.Postgres.DeleteBranch(ctx, deleteBranchReq)
 			if err != nil {
 				return err
 			}
 
 			// Show spinner while waiting for completion.
 			sp := cmdio.NewSpinner(ctx)
-			sp.Update("Waiting for delete-catalog to complete...")
+			sp.Update("Waiting for delete-branch to complete...")
 
 			// Wait for completion.
-			opts := api.WithTimeout(deleteCatalogTimeout)
+			opts := api.WithTimeout(deleteBranchTimeout)
 
 			err = wait.Wait(ctx, opts)
 			if err != nil {
@@ -1143,36 +1486,36 @@ func newDeleteCatalog() *cobra.Command {
 	cmd.ValidArgsFunction = cobra.NoFileCompletions
 
 	// Apply optional overrides to this command.
-	for _, fn := range deleteCatalogOverrides {
-		fn(cmd, &deleteCatalogReq)
+	for _, fn := range deleteBranchOverrides {
+		fn(cmd, &deleteBranchReq)
 	}
 
 	return cmd
 }
 
-// start delete-database command
+// start delete-catalog command
 
 // Slice with functions to override default command behavior.
 // Functions can be added from the `init()` function in manually curated files in this directory.
-var deleteDatabaseOverrides []func(
+var deleteCatalogOverrides []func(
 	*cobra.Command,
-	*postgres.DeleteDatabaseRequest,
+	*postgres.DeleteCatalogRequest,
 )
 
-func newDeleteDatabase() *cobra.Command {
+func newDeleteCatalog() *cobra.Command {
 	cmd := &cobra.Command{}
 
-	var deleteDatabaseReq postgres.DeleteDatabaseRequest
+	var deleteCatalogReq postgres.DeleteCatalogRequest
 
-	var deleteDatabaseSkipWait bool
-	var deleteDatabaseTimeout time.Duration
+	var deleteCatalogSkipWait bool
+	var deleteCatalogTimeout time.Duration
 
-	cmd.Flags().BoolVar(&deleteDatabaseSkipWait, "no-wait", deleteDatabaseSkipWait, `do not wait to reach DONE state`)
-	cmd.Flags().DurationVar(&deleteDatabaseTimeout, "timeout", 0, `maximum amount of time to reach DONE state`)
+	cmd.Flags().BoolVar(&deleteCatalogSkipWait, "no-wait", deleteCatalogSkipWait, `do not wait to reach DONE state`)
+	cmd.Flags().DurationVar(&deleteCatalogTimeout, "timeout", 0, `maximum amount of time to reach DONE state`)
 
-	cmd.Use = "delete-database NAME"
-	cmd.Short = `Delete a Database.`
-	cmd.Long = `Delete a Database.
+	cmd.Use = "delete-catalog NAME"
+	cmd.Short = `Delete a Database Catalog.`
+	cmd.Long = `Delete a Database Catalog.
 
   This is a long-running operation. By default, the command waits for the
   operation to complete. Use --no-wait to return immediately with the raw
@@ -1180,13 +1523,13 @@ func newDeleteDatabase() *cobra.Command {
   completion using the get-operation command.
 
   Arguments:
-    NAME: The resource name of the postgres database. Format:
-      projects/{project_id}/branches/{branch_id}/databases/{database_id}`
+    NAME: The full resource path of the catalog to delete.
 
-	// This command is being previewed; hide from help output.
-	cmd.Hidden = true
+      Format: "catalogs/{catalog_id}".`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1198,12 +1541,12 @@ func newDeleteDatabase() *cobra.Command {
 		ctx := cmd.Context()
 		w := cmdctx.WorkspaceClient(ctx)
 
-		deleteDatabaseReq.Name = args[0]
+		deleteCatalogReq.Name = args[0]
 
 		// Determine which mode to execute based on flags.
 		switch {
-		case deleteDatabaseSkipWait:
-			wait, err := w.Postgres.DeleteDatabase(ctx, deleteDatabaseReq)
+		case deleteCatalogSkipWait:
+			wait, err := w.Postgres.DeleteCatalog(ctx, deleteCatalogReq)
 			if err != nil {
 				return err
 			}
@@ -1218,17 +1561,17 @@ func newDeleteDatabase() *cobra.Command {
 			return cmdio.Render(ctx, operation)
 
 		default:
-			wait, err := w.Postgres.DeleteDatabase(ctx, deleteDatabaseReq)
+			wait, err := w.Postgres.DeleteCatalog(ctx, deleteCatalogReq)
 			if err != nil {
 				return err
 			}
 
 			// Show spinner while waiting for completion.
 			sp := cmdio.NewSpinner(ctx)
-			sp.Update("Waiting for delete-database to complete...")
+			sp.Update("Waiting for delete-catalog to complete...")
 
 			// Wait for completion.
-			opts := api.WithTimeout(deleteDatabaseTimeout)
+			opts := api.WithTimeout(deleteCatalogTimeout)
 
 			err = wait.Wait(ctx, opts)
 			if err != nil {
@@ -1244,38 +1587,44 @@ func newDeleteDatabase() *cobra.Command {
 	cmd.ValidArgsFunction = cobra.NoFileCompletions
 
 	// Apply optional overrides to this command.
-	for _, fn := range deleteDatabaseOverrides {
-		fn(cmd, &deleteDatabaseReq)
+	for _, fn := range deleteCatalogOverrides {
+		fn(cmd, &deleteCatalogReq)
 	}
 
 	return cmd
 }
 
-// start delete-endpoint command
+// start delete-cdf-config command
 
 // Slice with functions to override default command behavior.
 // Functions can be added from the `init()` function in manually curated files in this directory.
-var deleteEndpointOverrides []func(
+var deleteCdfConfigOverrides []func(
 	*cobra.Command,
-	*postgres.DeleteEndpointRequest,
+	*postgres.DeleteCdfConfigRequest,
 )
 
-func newDeleteEndpoint() *cobra.Command {
+func newDeleteCdfConfig() *cobra.Command {
 	cmd := &cobra.Command{}
 
-	var deleteEndpointReq postgres.DeleteEndpointRequest
+	var deleteCdfConfigReq postgres.DeleteCdfConfigRequest
 
-	var deleteEndpointSkipWait bool
-	var deleteEndpointTimeout time.Duration
+	var deleteCdfConfigSkipWait bool
+	var deleteCdfConfigTimeout time.Duration
 
-	cmd.Flags().BoolVar(&deleteEndpointSkipWait, "no-wait", deleteEndpointSkipWait, `do not wait to reach DONE state`)
-	cmd.Flags().DurationVar(&deleteEndpointTimeout, "timeout", 0, `maximum amount of time to reach DONE state`)
+	cmd.Flags().BoolVar(&deleteCdfConfigSkipWait, "no-wait", deleteCdfConfigSkipWait, `do not wait to reach DONE state`)
+	cmd.Flags().DurationVar(&deleteCdfConfigTimeout, "timeout", 0, `maximum amount of time to reach DONE state`)
 
-	cmd.Use = "delete-endpoint NAME"
-	cmd.Short = `Delete an Endpoint.`
-	cmd.Long = `Delete an Endpoint.
+	cmd.Flags().BoolVar(&deleteCdfConfigReq.Force, "force", deleteCdfConfigReq.Force, `When true, also drops the replicated Delta tables in Unity Catalog.`)
 
-  Deletes the specified compute endpoint.
+	cmd.Use = "delete-cdf-config NAME"
+	cmd.Short = `*Beta* Delete a change data feed configuration.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Delete a change data feed configuration.
+
+  Delete a CDF configuration and stop materializing the change data feed. When
+  force=true, also drops the Delta tables in Unity Catalog. When force=false
+  (default), the existing tables are preserved at their last state.
 
   This is a long-running operation. By default, the command waits for the
   operation to complete. Use --no-wait to return immediately with the raw
@@ -1283,10 +1632,12 @@ func newDeleteEndpoint() *cobra.Command {
   completion using the get-operation command.
 
   Arguments:
-    NAME: The full resource path of the endpoint to delete. Format:
-      projects/{project_id}/branches/{branch_id}/endpoints/{endpoint_id}`
+    NAME: The resource name of the CdfConfig to delete. Format:
+      projects/{project}/branches/{branch}/databases/{database}/cdf-configs/{cdf_config}`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1298,12 +1649,12 @@ func newDeleteEndpoint() *cobra.Command {
 		ctx := cmd.Context()
 		w := cmdctx.WorkspaceClient(ctx)
 
-		deleteEndpointReq.Name = args[0]
+		deleteCdfConfigReq.Name = args[0]
 
 		// Determine which mode to execute based on flags.
 		switch {
-		case deleteEndpointSkipWait:
-			wait, err := w.Postgres.DeleteEndpoint(ctx, deleteEndpointReq)
+		case deleteCdfConfigSkipWait:
+			wait, err := w.Postgres.DeleteCdfConfig(ctx, deleteCdfConfigReq)
 			if err != nil {
 				return err
 			}
@@ -1318,17 +1669,17 @@ func newDeleteEndpoint() *cobra.Command {
 			return cmdio.Render(ctx, operation)
 
 		default:
-			wait, err := w.Postgres.DeleteEndpoint(ctx, deleteEndpointReq)
+			wait, err := w.Postgres.DeleteCdfConfig(ctx, deleteCdfConfigReq)
 			if err != nil {
 				return err
 			}
 
 			// Show spinner while waiting for completion.
 			sp := cmdio.NewSpinner(ctx)
-			sp.Update("Waiting for delete-endpoint to complete...")
+			sp.Update("Waiting for delete-cdf-config to complete...")
 
 			// Wait for completion.
-			opts := api.WithTimeout(deleteEndpointTimeout)
+			opts := api.WithTimeout(deleteCdfConfigTimeout)
 
 			err = wait.Wait(ctx, opts)
 			if err != nil {
@@ -1344,38 +1695,36 @@ func newDeleteEndpoint() *cobra.Command {
 	cmd.ValidArgsFunction = cobra.NoFileCompletions
 
 	// Apply optional overrides to this command.
-	for _, fn := range deleteEndpointOverrides {
-		fn(cmd, &deleteEndpointReq)
+	for _, fn := range deleteCdfConfigOverrides {
+		fn(cmd, &deleteCdfConfigReq)
 	}
 
 	return cmd
 }
 
-// start delete-project command
+// start delete-data-api command
 
 // Slice with functions to override default command behavior.
 // Functions can be added from the `init()` function in manually curated files in this directory.
-var deleteProjectOverrides []func(
+var deleteDataApiOverrides []func(
 	*cobra.Command,
-	*postgres.DeleteProjectRequest,
+	*postgres.DeleteDataApiRequest,
 )
 
-func newDeleteProject() *cobra.Command {
+func newDeleteDataApi() *cobra.Command {
 	cmd := &cobra.Command{}
 
-	var deleteProjectReq postgres.DeleteProjectRequest
-
-	var deleteProjectSkipWait bool
-	var deleteProjectTimeout time.Duration
+	var deleteDataApiReq postgres.DeleteDataApiRequest
 
-	cmd.Flags().BoolVar(&deleteProjectSkipWait, "no-wait", deleteProjectSkipWait, `do not wait to reach DONE state`)
-	cmd.Flags().DurationVar(&deleteProjectTimeout, "timeout", 0, `maximum amount of time to reach DONE state`)
+	var deleteDataApiSkipWait bool
+	var deleteDataApiTimeout time.Duration
 
-	cmd.Use = "delete-project NAME"
-	cmd.Short = `Delete a Project.`
-	cmd.Long = `Delete a Project.
+	cmd.Flags().BoolVar(&deleteDataApiSkipWait, "no-wait", deleteDataApiSkipWait, `do not wait to reach DONE state`)
+	cmd.Flags().DurationVar(&deleteDataApiTimeout, "timeout", 0, `maximum amount of time to reach DONE state`)
 
-  Deletes the specified database project.
+	cmd.Use = "delete-data-api NAME"
+	cmd.Short = `Disable Data API for a database.`
+	cmd.Long = `Disable Data API for a database.
 
   This is a long-running operation. By default, the command waits for the
   operation to complete. Use --no-wait to return immediately with the raw
@@ -1383,10 +1732,15 @@ func newDeleteProject() *cobra.Command {
   completion using the get-operation command.
 
   Arguments:
-    NAME: The full resource path of the project to delete. Format:
-      projects/{project_id}`
+    NAME: Resource name:
+      projects/{project_id}/branches/{branch_id}/databases/{database_id}/data-api`
+
+	// This command is being previewed; hide from help output.
+	cmd.Hidden = true
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1398,12 +1752,12 @@ func newDeleteProject() *cobra.Command {
 		ctx := cmd.Context()
 		w := cmdctx.WorkspaceClient(ctx)
 
-		deleteProjectReq.Name = args[0]
+		deleteDataApiReq.Name = args[0]
 
 		// Determine which mode to execute based on flags.
 		switch {
-		case deleteProjectSkipWait:
-			wait, err := w.Postgres.DeleteProject(ctx, deleteProjectReq)
+		case deleteDataApiSkipWait:
+			wait, err := w.Postgres.DeleteDataApi(ctx, deleteDataApiReq)
 			if err != nil {
 				return err
 			}
@@ -1418,17 +1772,17 @@ func newDeleteProject() *cobra.Command {
 			return cmdio.Render(ctx, operation)
 
 		default:
-			wait, err := w.Postgres.DeleteProject(ctx, deleteProjectReq)
+			wait, err := w.Postgres.DeleteDataApi(ctx, deleteDataApiReq)
 			if err != nil {
 				return err
 			}
 
 			// Show spinner while waiting for completion.
 			sp := cmdio.NewSpinner(ctx)
-			sp.Update("Waiting for delete-project to complete...")
+			sp.Update("Waiting for delete-data-api to complete...")
 
 			// Wait for completion.
-			opts := api.WithTimeout(deleteProjectTimeout)
+			opts := api.WithTimeout(deleteDataApiTimeout)
 
 			err = wait.Wait(ctx, opts)
 			if err != nil {
@@ -1444,40 +1798,36 @@ func newDeleteProject() *cobra.Command {
 	cmd.ValidArgsFunction = cobra.NoFileCompletions
 
 	// Apply optional overrides to this command.
-	for _, fn := range deleteProjectOverrides {
-		fn(cmd, &deleteProjectReq)
+	for _, fn := range deleteDataApiOverrides {
+		fn(cmd, &deleteDataApiReq)
 	}
 
 	return cmd
 }
 
-// start delete-role command
+// start delete-database command
 
 // Slice with functions to override default command behavior.
 // Functions can be added from the `init()` function in manually curated files in this directory.
-var deleteRoleOverrides []func(
+var deleteDatabaseOverrides []func(
 	*cobra.Command,
-	*postgres.DeleteRoleRequest,
+	*postgres.DeleteDatabaseRequest,
 )
 
-func newDeleteRole() *cobra.Command {
+func newDeleteDatabase() *cobra.Command {
 	cmd := &cobra.Command{}
 
-	var deleteRoleReq postgres.DeleteRoleRequest
-
-	var deleteRoleSkipWait bool
-	var deleteRoleTimeout time.Duration
-
-	cmd.Flags().BoolVar(&deleteRoleSkipWait, "no-wait", deleteRoleSkipWait, `do not wait to reach DONE state`)
-	cmd.Flags().DurationVar(&deleteRoleTimeout, "timeout", 0, `maximum amount of time to reach DONE state`)
+	var deleteDatabaseReq postgres.DeleteDatabaseRequest
 
-	cmd.Flags().StringVar(&deleteRoleReq.ReassignOwnedTo, "reassign-owned-to", deleteRoleReq.ReassignOwnedTo, `Reassign objects.`)
+	var deleteDatabaseSkipWait bool
+	var deleteDatabaseTimeout time.Duration
 
-	cmd.Use = "delete-role NAME"
-	cmd.Short = `Delete a Postgres Role from a Branch.`
-	cmd.Long = `Delete a Postgres Role from a Branch.
+	cmd.Flags().BoolVar(&deleteDatabaseSkipWait, "no-wait", deleteDatabaseSkipWait, `do not wait to reach DONE state`)
+	cmd.Flags().DurationVar(&deleteDatabaseTimeout, "timeout", 0, `maximum amount of time to reach DONE state`)
 
-  Deletes the specified Postgres role.
+	cmd.Use = "delete-database NAME"
+	cmd.Short = `Delete a Database.`
+	cmd.Long = `Delete a Database.
 
   This is a long-running operation. By default, the command waits for the
   operation to complete. Use --no-wait to return immediately with the raw
@@ -1485,10 +1835,12 @@ func newDeleteRole() *cobra.Command {
   completion using the get-operation command.
 
   Arguments:
-    NAME: The full resource path of the role to delete. Format:
-      projects/{project_id}/branches/{branch_id}/roles/{role_id}`
+    NAME: The resource name of the postgres database. Format:
+      projects/{project_id}/branches/{branch_id}/databases/{database_id}`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1500,12 +1852,12 @@ func newDeleteRole() *cobra.Command {
 		ctx := cmd.Context()
 		w := cmdctx.WorkspaceClient(ctx)
 
-		deleteRoleReq.Name = args[0]
+		deleteDatabaseReq.Name = args[0]
 
 		// Determine which mode to execute based on flags.
 		switch {
-		case deleteRoleSkipWait:
-			wait, err := w.Postgres.DeleteRole(ctx, deleteRoleReq)
+		case deleteDatabaseSkipWait:
+			wait, err := w.Postgres.DeleteDatabase(ctx, deleteDatabaseReq)
 			if err != nil {
 				return err
 			}
@@ -1520,17 +1872,17 @@ func newDeleteRole() *cobra.Command {
 			return cmdio.Render(ctx, operation)
 
 		default:
-			wait, err := w.Postgres.DeleteRole(ctx, deleteRoleReq)
+			wait, err := w.Postgres.DeleteDatabase(ctx, deleteDatabaseReq)
 			if err != nil {
 				return err
 			}
 
 			// Show spinner while waiting for completion.
 			sp := cmdio.NewSpinner(ctx)
-			sp.Update("Waiting for delete-role to complete...")
+			sp.Update("Waiting for delete-database to complete...")
 
 			// Wait for completion.
-			opts := api.WithTimeout(deleteRoleTimeout)
+			opts := api.WithTimeout(deleteDatabaseTimeout)
 
 			err = wait.Wait(ctx, opts)
 			if err != nil {
@@ -1546,13 +1898,427 @@ func newDeleteRole() *cobra.Command {
 	cmd.ValidArgsFunction = cobra.NoFileCompletions
 
 	// Apply optional overrides to this command.
-	for _, fn := range deleteRoleOverrides {
+	for _, fn := range deleteDatabaseOverrides {
+		fn(cmd, &deleteDatabaseReq)
+	}
+
+	return cmd
+}
+
+// start delete-endpoint command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteEndpointOverrides []func(
+	*cobra.Command,
+	*postgres.DeleteEndpointRequest,
+)
+
+func newDeleteEndpoint() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteEndpointReq postgres.DeleteEndpointRequest
+
+	var deleteEndpointSkipWait bool
+	var deleteEndpointTimeout time.Duration
+
+	cmd.Flags().BoolVar(&deleteEndpointSkipWait, "no-wait", deleteEndpointSkipWait, `do not wait to reach DONE state`)
+	cmd.Flags().DurationVar(&deleteEndpointTimeout, "timeout", 0, `maximum amount of time to reach DONE state`)
+
+	cmd.Use = "delete-endpoint NAME"
+	cmd.Short = `Delete an Endpoint.`
+	cmd.Long = `Delete an Endpoint.
+
+  Deletes the specified compute endpoint.
+
+  This is a long-running operation. By default, the command waits for the
+  operation to complete. Use --no-wait to return immediately with the raw
+  operation details. The operation's 'name' field can then be used to poll for
+  completion using the get-operation command.
+
+  Arguments:
+    NAME: The full resource path of the endpoint to delete. Format:
+      projects/{project_id}/branches/{branch_id}/endpoints/{endpoint_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		deleteEndpointReq.Name = args[0]
+
+		// Determine which mode to execute based on flags.
+		switch {
+		case deleteEndpointSkipWait:
+			wait, err := w.Postgres.DeleteEndpoint(ctx, deleteEndpointReq)
+			if err != nil {
+				return err
+			}
+
+			// Return operation immediately without waiting.
+			operation, err := w.Postgres.GetOperation(ctx, postgres.GetOperationRequest{
+				Name: wait.Name(),
+			})
+			if err != nil {
+				return err
+			}
+			return cmdio.Render(ctx, operation)
+
+		default:
+			wait, err := w.Postgres.DeleteEndpoint(ctx, deleteEndpointReq)
+			if err != nil {
+				return err
+			}
+
+			// Show spinner while waiting for completion.
+			sp := cmdio.NewSpinner(ctx)
+			sp.Update("Waiting for delete-endpoint to complete...")
+
+			// Wait for completion.
+			opts := api.WithTimeout(deleteEndpointTimeout)
+
+			err = wait.Wait(ctx, opts)
+			if err != nil {
+				return err
+			}
+			sp.Close()
+			return nil
+		}
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteEndpointOverrides {
+		fn(cmd, &deleteEndpointReq)
+	}
+
+	return cmd
+}
+
+// start delete-project command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteProjectOverrides []func(
+	*cobra.Command,
+	*postgres.DeleteProjectRequest,
+)
+
+func newDeleteProject() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteProjectReq postgres.DeleteProjectRequest
+
+	var deleteProjectSkipWait bool
+	var deleteProjectTimeout time.Duration
+
+	cmd.Flags().BoolVar(&deleteProjectSkipWait, "no-wait", deleteProjectSkipWait, `do not wait to reach DONE state`)
+	cmd.Flags().DurationVar(&deleteProjectTimeout, "timeout", 0, `maximum amount of time to reach DONE state`)
+
+	cmd.Flags().BoolVar(&deleteProjectReq.Purge, "purge", deleteProjectReq.Purge, `If true, permanently deletes the project (hard delete).`)
+
+	cmd.Use = "delete-project NAME"
+	cmd.Short = `Delete a Project.`
+	cmd.Long = `Delete a Project.
+
+  Deletes the specified database project.
+
+  This is a long-running operation. By default, the command waits for the
+  operation to complete. Use --no-wait to return immediately with the raw
+  operation details. The operation's 'name' field can then be used to poll for
+  completion using the get-operation command.
+
+  Arguments:
+    NAME: The full resource path of the project to delete. Format:
+      projects/{project_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		deleteProjectReq.Name = args[0]
+
+		// Determine which mode to execute based on flags.
+		switch {
+		case deleteProjectSkipWait:
+			wait, err := w.Postgres.DeleteProject(ctx, deleteProjectReq)
+			if err != nil {
+				return err
+			}
+
+			// Return operation immediately without waiting.
+			operation, err := w.Postgres.GetOperation(ctx, postgres.GetOperationRequest{
+				Name: wait.Name(),
+			})
+			if err != nil {
+				return err
+			}
+			return cmdio.Render(ctx, operation)
+
+		default:
+			wait, err := w.Postgres.DeleteProject(ctx, deleteProjectReq)
+			if err != nil {
+				return err
+			}
+
+			// Show spinner while waiting for completion.
+			sp := cmdio.NewSpinner(ctx)
+			sp.Update("Waiting for delete-project to complete...")
+
+			// Wait for completion.
+			opts := api.WithTimeout(deleteProjectTimeout)
+
+			err = wait.Wait(ctx, opts)
+			if err != nil {
+				return err
+			}
+			sp.Close()
+			return nil
+		}
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteProjectOverrides {
+		fn(cmd, &deleteProjectReq)
+	}
+
+	return cmd
+}
+
+// start delete-role command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteRoleOverrides []func(
+	*cobra.Command,
+	*postgres.DeleteRoleRequest,
+)
+
+func newDeleteRole() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteRoleReq postgres.DeleteRoleRequest
+
+	var deleteRoleSkipWait bool
+	var deleteRoleTimeout time.Duration
+
+	cmd.Flags().BoolVar(&deleteRoleSkipWait, "no-wait", deleteRoleSkipWait, `do not wait to reach DONE state`)
+	cmd.Flags().DurationVar(&deleteRoleTimeout, "timeout", 0, `maximum amount of time to reach DONE state`)
+
+	cmd.Flags().StringVar(&deleteRoleReq.ReassignOwnedTo, "reassign-owned-to", deleteRoleReq.ReassignOwnedTo, `Reassign objects.`)
+
+	cmd.Use = "delete-role NAME"
+	cmd.Short = `Delete a Postgres Role from a Branch.`
+	cmd.Long = `Delete a Postgres Role from a Branch.
+
+  Deletes the specified Postgres role.
+
+  This is a long-running operation. By default, the command waits for the
+  operation to complete. Use --no-wait to return immediately with the raw
+  operation details. The operation's 'name' field can then be used to poll for
+  completion using the get-operation command.
+
+  Arguments:
+    NAME: The full resource path of the role to delete. Format:
+      projects/{project_id}/branches/{branch_id}/roles/{role_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		deleteRoleReq.Name = args[0]
+
+		// Determine which mode to execute based on flags.
+		switch {
+		case deleteRoleSkipWait:
+			wait, err := w.Postgres.DeleteRole(ctx, deleteRoleReq)
+			if err != nil {
+				return err
+			}
+
+			// Return operation immediately without waiting.
+			operation, err := w.Postgres.GetOperation(ctx, postgres.GetOperationRequest{
+				Name: wait.Name(),
+			})
+			if err != nil {
+				return err
+			}
+			return cmdio.Render(ctx, operation)
+
+		default:
+			wait, err := w.Postgres.DeleteRole(ctx, deleteRoleReq)
+			if err != nil {
+				return err
+			}
+
+			// Show spinner while waiting for completion.
+			sp := cmdio.NewSpinner(ctx)
+			sp.Update("Waiting for delete-role to complete...")
+
+			// Wait for completion.
+			opts := api.WithTimeout(deleteRoleTimeout)
+
+			err = wait.Wait(ctx, opts)
+			if err != nil {
+				return err
+			}
+			sp.Close()
+			return nil
+		}
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteRoleOverrides {
 		fn(cmd, &deleteRoleReq)
 	}
 
 	return cmd
 }
 
+// start delete-snapshot command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteSnapshotOverrides []func(
+	*cobra.Command,
+	*postgres.DeleteSnapshotRequest,
+)
+
+func newDeleteSnapshot() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteSnapshotReq postgres.DeleteSnapshotRequest
+
+	var deleteSnapshotSkipWait bool
+	var deleteSnapshotTimeout time.Duration
+
+	cmd.Flags().BoolVar(&deleteSnapshotSkipWait, "no-wait", deleteSnapshotSkipWait, `do not wait to reach DONE state`)
+	cmd.Flags().DurationVar(&deleteSnapshotTimeout, "timeout", 0, `maximum amount of time to reach DONE state`)
+
+	cmd.Use = "delete-snapshot NAME"
+	cmd.Short = `*Beta* Delete a Snapshot.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Delete a Snapshot.
+
+  Deletes the specified snapshot.
+
+  This is a long-running operation. By default, the command waits for the
+  operation to complete. Use --no-wait to return immediately with the raw
+  operation details. The operation's 'name' field can then be used to poll for
+  completion using the get-operation command.
+
+  Arguments:
+    NAME: The resource name of the snapshot to delete. Format:
+      projects/{project_id}/snapshots/{snapshot_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		deleteSnapshotReq.Name = args[0]
+
+		// Determine which mode to execute based on flags.
+		switch {
+		case deleteSnapshotSkipWait:
+			wait, err := w.Postgres.DeleteSnapshot(ctx, deleteSnapshotReq)
+			if err != nil {
+				return err
+			}
+
+			// Return operation immediately without waiting.
+			operation, err := w.Postgres.GetOperation(ctx, postgres.GetOperationRequest{
+				Name: wait.Name(),
+			})
+			if err != nil {
+				return err
+			}
+			return cmdio.Render(ctx, operation)
+
+		default:
+			wait, err := w.Postgres.DeleteSnapshot(ctx, deleteSnapshotReq)
+			if err != nil {
+				return err
+			}
+
+			// Show spinner while waiting for completion.
+			sp := cmdio.NewSpinner(ctx)
+			sp.Update("Waiting for delete-snapshot to complete...")
+
+			// Wait for completion.
+			opts := api.WithTimeout(deleteSnapshotTimeout)
+
+			err = wait.Wait(ctx, opts)
+			if err != nil {
+				return err
+			}
+			sp.Close()
+			return nil
+		}
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteSnapshotOverrides {
+		fn(cmd, &deleteSnapshotReq)
+	}
+
+	return cmd
+}
+
 // start delete-synced-table command
 
 // Slice with functions to override default command behavior.
@@ -1590,6 +2356,8 @@ func newDeleteSyncedTable() *cobra.Command {
       are the UC entity names.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1672,23 +2440,28 @@ func newGenerateDatabaseCredential() *cobra.Command {
 	cmd.Flags().Var(&generateDatabaseCredentialJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	// TODO: array: claims
+	var expireTimeParam string
+	cmd.Flags().StringVar(&expireTimeParam, "expire-time", expireTimeParam, `Timestamp in UTC of when this credential should expire.`)
+	var ttlParam string
+	cmd.Flags().StringVar(&ttlParam, "ttl", ttlParam, `The requested time-to-live for the generated credential token.`)
 
 	cmd.Use = "generate-database-credential ENDPOINT"
 	cmd.Short = `Generate OAuth credentials for a Postgres database.`
 	cmd.Long = `Generate OAuth credentials for a Postgres database.
 
   Arguments:
-    ENDPOINT: This field is not yet supported. The endpoint for which this credential
-      will be generated. Format:
-      projects/{project_id}/branches/{branch_id}/endpoints/{endpoint_id}`
+    ENDPOINT: The endpoint resource name for which this credential will be generated.
+      Format: projects/{project_id}/branches/{branch_id}/endpoints/{endpoint_id}`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'endpoint' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'endpoint' in your JSON input")
 			}
 			return nil
 		}
@@ -1717,7 +2490,209 @@ func newGenerateDatabaseCredential() *cobra.Command {
 			generateDatabaseCredentialReq.Endpoint = args[0]
 		}
 
-		response, err := w.Postgres.GenerateDatabaseCredential(ctx, generateDatabaseCredentialReq)
+		if expireTimeParam != "" {
+			expireTimeBytes := []byte(fmt.Sprintf("\"%s\"", expireTimeParam))
+			var expireTimeField sdktime.Time
+			err = json.Unmarshal(expireTimeBytes, &expireTimeField)
+			if err != nil {
+				return fmt.Errorf("invalid EXPIRE_TIME: %s", expireTimeParam)
+			}
+			generateDatabaseCredentialReq.ExpireTime = &expireTimeField
+		}
+
+		if ttlParam != "" {
+			ttlBytes := []byte(fmt.Sprintf("\"%s\"", ttlParam))
+			var ttlField duration.Duration
+			err = json.Unmarshal(ttlBytes, &ttlField)
+			if err != nil {
+				return fmt.Errorf("invalid TTL: %s", ttlParam)
+			}
+			generateDatabaseCredentialReq.Ttl = &ttlField
+		}
+
+		response, err := w.Postgres.GenerateDatabaseCredential(ctx, generateDatabaseCredentialReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range generateDatabaseCredentialOverrides {
+		fn(cmd, &generateDatabaseCredentialReq)
+	}
+
+	return cmd
+}
+
+// start get-branch command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getBranchOverrides []func(
+	*cobra.Command,
+	*postgres.GetBranchRequest,
+)
+
+func newGetBranch() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getBranchReq postgres.GetBranchRequest
+
+	cmd.Use = "get-branch NAME"
+	cmd.Short = `Get a Branch.`
+	cmd.Long = `Get a Branch.
+
+  Retrieves information about the specified database branch.
+
+  Arguments:
+    NAME: The full resource path of the branch to retrieve. Format:
+      projects/{project_id}/branches/{branch_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getBranchReq.Name = args[0]
+
+		response, err := w.Postgres.GetBranch(ctx, getBranchReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getBranchOverrides {
+		fn(cmd, &getBranchReq)
+	}
+
+	return cmd
+}
+
+// start get-catalog command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getCatalogOverrides []func(
+	*cobra.Command,
+	*postgres.GetCatalogRequest,
+)
+
+func newGetCatalog() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getCatalogReq postgres.GetCatalogRequest
+
+	cmd.Use = "get-catalog NAME"
+	cmd.Short = `Get a Database Catalog.`
+	cmd.Long = `Get a Database Catalog.
+
+  Arguments:
+    NAME: The full resource path of the catalog to retrieve.
+
+      Format: "catalogs/{catalog_id}".`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getCatalogReq.Name = args[0]
+
+		response, err := w.Postgres.GetCatalog(ctx, getCatalogReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getCatalogOverrides {
+		fn(cmd, &getCatalogReq)
+	}
+
+	return cmd
+}
+
+// start get-cdf-config command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getCdfConfigOverrides []func(
+	*cobra.Command,
+	*postgres.GetCdfConfigRequest,
+)
+
+func newGetCdfConfig() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getCdfConfigReq postgres.GetCdfConfigRequest
+
+	cmd.Use = "get-cdf-config NAME"
+	cmd.Short = `*Beta* Get a change data feed configuration.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get a change data feed configuration.
+
+  Get a single Lakebase CDF configuration, including the source Postgres schema
+  and target Unity Catalog schema.
+
+  Arguments:
+    NAME: The resource name of the CdfConfig to retrieve. Format:
+      projects/{project}/branches/{branch}/databases/{database}/cdf-configs/{cdf_config}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getCdfConfigReq.Name = args[0]
+
+		response, err := w.Postgres.GetCdfConfig(ctx, getCdfConfigReq)
 		if err != nil {
 			return err
 		}
@@ -1730,38 +2705,43 @@ func newGenerateDatabaseCredential() *cobra.Command {
 	cmd.ValidArgsFunction = cobra.NoFileCompletions
 
 	// Apply optional overrides to this command.
-	for _, fn := range generateDatabaseCredentialOverrides {
-		fn(cmd, &generateDatabaseCredentialReq)
+	for _, fn := range getCdfConfigOverrides {
+		fn(cmd, &getCdfConfigReq)
 	}
 
 	return cmd
 }
 
-// start get-branch command
+// start get-cdf-status command
 
 // Slice with functions to override default command behavior.
 // Functions can be added from the `init()` function in manually curated files in this directory.
-var getBranchOverrides []func(
+var getCdfStatusOverrides []func(
 	*cobra.Command,
-	*postgres.GetBranchRequest,
+	*postgres.GetCdfStatusRequest,
 )
 
-func newGetBranch() *cobra.Command {
+func newGetCdfStatus() *cobra.Command {
 	cmd := &cobra.Command{}
 
-	var getBranchReq postgres.GetBranchRequest
+	var getCdfStatusReq postgres.GetCdfStatusRequest
 
-	cmd.Use = "get-branch NAME"
-	cmd.Short = `Get a Branch.`
-	cmd.Long = `Get a Branch.
+	cmd.Use = "get-cdf-status NAME"
+	cmd.Short = `*Beta* Get a change data feed status.`
+	cmd.Long = `This command is in Beta and may change without notice.
 
-  Retrieves information about the specified database branch.
+Get a change data feed status.
+
+  Get the CDF status of a single table within a Lakebase CDF configuration,
+  including its current state and the last committed position in the feed.
 
   Arguments:
-    NAME: The full resource path of the branch to retrieve. Format:
-      projects/{project_id}/branches/{branch_id}`
+    NAME: The resource name of the CdfStatus to retrieve. Format:
+      projects/{project}/branches/{branch}/databases/{database}/cdf-configs/{cdf_config}/cdf-statuses/{cdf_status}`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1773,9 +2753,9 @@ func newGetBranch() *cobra.Command {
 		ctx := cmd.Context()
 		w := cmdctx.WorkspaceClient(ctx)
 
-		getBranchReq.Name = args[0]
+		getCdfStatusReq.Name = args[0]
 
-		response, err := w.Postgres.GetBranch(ctx, getBranchReq)
+		response, err := w.Postgres.GetCdfStatus(ctx, getCdfStatusReq)
 		if err != nil {
 			return err
 		}
@@ -1788,37 +2768,43 @@ func newGetBranch() *cobra.Command {
 	cmd.ValidArgsFunction = cobra.NoFileCompletions
 
 	// Apply optional overrides to this command.
-	for _, fn := range getBranchOverrides {
-		fn(cmd, &getBranchReq)
+	for _, fn := range getCdfStatusOverrides {
+		fn(cmd, &getCdfStatusReq)
 	}
 
 	return cmd
 }
 
-// start get-catalog command
+// start get-data-api command
 
 // Slice with functions to override default command behavior.
 // Functions can be added from the `init()` function in manually curated files in this directory.
-var getCatalogOverrides []func(
+var getDataApiOverrides []func(
 	*cobra.Command,
-	*postgres.GetCatalogRequest,
+	*postgres.GetDataApiRequest,
 )
 
-func newGetCatalog() *cobra.Command {
+func newGetDataApi() *cobra.Command {
 	cmd := &cobra.Command{}
 
-	var getCatalogReq postgres.GetCatalogRequest
+	var getDataApiReq postgres.GetDataApiRequest
 
-	cmd.Use = "get-catalog NAME"
-	cmd.Short = `Get a Database Catalog.`
-	cmd.Long = `Get a Database Catalog.
+	cmd.Use = "get-data-api NAME"
+	cmd.Short = `Get Data API configuration.`
+	cmd.Long = `Get Data API configuration.
+
+  Get Data API configuration for a database.
 
   Arguments:
-    NAME: The full resource path of the catalog to retrieve.
+    NAME: Resource name:
+      projects/{project_id}/branches/{branch_id}/databases/{database_id}/data-api`
 
-      Format: "catalogs/{catalog_id}".`
+	// This command is being previewed; hide from help output.
+	cmd.Hidden = true
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1830,9 +2816,9 @@ func newGetCatalog() *cobra.Command {
 		ctx := cmd.Context()
 		w := cmdctx.WorkspaceClient(ctx)
 
-		getCatalogReq.Name = args[0]
+		getDataApiReq.Name = args[0]
 
-		response, err := w.Postgres.GetCatalog(ctx, getCatalogReq)
+		response, err := w.Postgres.GetDataApi(ctx, getDataApiReq)
 		if err != nil {
 			return err
 		}
@@ -1845,8 +2831,8 @@ func newGetCatalog() *cobra.Command {
 	cmd.ValidArgsFunction = cobra.NoFileCompletions
 
 	// Apply optional overrides to this command.
-	for _, fn := range getCatalogOverrides {
-		fn(cmd, &getCatalogReq)
+	for _, fn := range getDataApiOverrides {
+		fn(cmd, &getDataApiReq)
 	}
 
 	return cmd
@@ -1874,10 +2860,9 @@ func newGetDatabase() *cobra.Command {
     NAME: The name of the Database to retrieve. Format:
       projects/{project_id}/branches/{branch_id}/databases/{database_id}`
 
-	// This command is being previewed; hide from help output.
-	cmd.Hidden = true
-
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1937,6 +2922,8 @@ func newGetEndpoint() *cobra.Command {
       projects/{project_id}/branches/{branch_id}/endpoints/{endpoint_id}`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1994,6 +2981,8 @@ func newGetOperation() *cobra.Command {
     NAME: The name of the operation resource.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -2052,6 +3041,8 @@ func newGetProject() *cobra.Command {
       projects/{project_id}`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -2111,6 +3102,8 @@ func newGetRole() *cobra.Command {
       projects/{project_id}/branches/{branch_id}/roles/{role_id}`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -2144,6 +3137,131 @@ func newGetRole() *cobra.Command {
 	return cmd
 }
 
+// start get-snapshot command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getSnapshotOverrides []func(
+	*cobra.Command,
+	*postgres.GetSnapshotRequest,
+)
+
+func newGetSnapshot() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getSnapshotReq postgres.GetSnapshotRequest
+
+	cmd.Use = "get-snapshot NAME"
+	cmd.Short = `*Beta* Get a Snapshot.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get a Snapshot.
+
+  Retrieves information about the specified snapshot.
+
+  Arguments:
+    NAME: The resource name of the snapshot to retrieve. Format:
+      projects/{project_id}/snapshots/{snapshot_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getSnapshotReq.Name = args[0]
+
+		response, err := w.Postgres.GetSnapshot(ctx, getSnapshotReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getSnapshotOverrides {
+		fn(cmd, &getSnapshotReq)
+	}
+
+	return cmd
+}
+
+// start get-snapshot-schedule command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getSnapshotScheduleOverrides []func(
+	*cobra.Command,
+	*postgres.GetSnapshotScheduleRequest,
+)
+
+func newGetSnapshotSchedule() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getSnapshotScheduleReq postgres.GetSnapshotScheduleRequest
+
+	cmd.Use = "get-snapshot-schedule NAME"
+	cmd.Short = `*Beta* Get a Snapshot Schedule.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get a Snapshot Schedule.
+
+  Retrieves the snapshot schedule for a branch. A branch with no configured
+  schedule returns an empty schedule (not NOT_FOUND).
+
+  Arguments:
+    NAME: The resource name of the branch's snapshot schedule. Format:
+      projects/{project_id}/branches/{branch_id}/snapshot-schedule`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getSnapshotScheduleReq.Name = args[0]
+
+		response, err := w.Postgres.GetSnapshotSchedule(ctx, getSnapshotScheduleReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getSnapshotScheduleOverrides {
+		fn(cmd, &getSnapshotScheduleReq)
+	}
+
+	return cmd
+}
+
 // start get-synced-table command
 
 // Slice with functions to override default command behavior.
@@ -2165,10 +3283,13 @@ func newGetSyncedTable() *cobra.Command {
   Get a Synced Table.
 
   Arguments:
-    NAME: Format: "synced_tables/{catalog}.{schema}.{table}", where (catalog,
-      schema, table) are the entity names in the Unity Catalog.`
+    NAME: The Full resource name of the synced table. Format:
+      "synced_tables/{catalog}.{schema}.{table}", where (catalog, schema, table)
+      are the entity names in the Unity Catalog.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -2221,6 +3342,7 @@ func newListBranches() *cobra.Command {
 	var listBranchesLimit int
 
 	cmd.Flags().IntVar(&listBranchesReq.PageSize, "page-size", listBranchesReq.PageSize, `Upper bound for items returned.`)
+	cmd.Flags().BoolVar(&listBranchesReq.ShowDeleted, "show-deleted", listBranchesReq.ShowDeleted, `Whether to include soft-deleted branches in the response.`)
 
 	// Limit flag for total result capping.
 	cmd.Flags().IntVar(&listBranchesLimit, "limit", 0, `Maximum number of results to return.`)
@@ -2233,13 +3355,175 @@ func newListBranches() *cobra.Command {
 	cmd.Short = `List Branches.`
 	cmd.Long = `List Branches.
 
-  Returns a paginated list of database branches in the project.
+  Returns a paginated list of database branches in the project.
+
+  Arguments:
+    PARENT: The Project that owns this collection of branches. Format:
+      projects/{project_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		listBranchesReq.Parent = args[0]
+
+		response := w.Postgres.ListBranches(ctx, listBranchesReq)
+		if listBranchesLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listBranchesLimit)
+		}
+		if listBranchesLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listBranchesLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listBranchesOverrides {
+		fn(cmd, &listBranchesReq)
+	}
+
+	return cmd
+}
+
+// start list-cdf-configs command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listCdfConfigsOverrides []func(
+	*cobra.Command,
+	*postgres.ListCdfConfigsRequest,
+)
+
+func newListCdfConfigs() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listCdfConfigsReq postgres.ListCdfConfigsRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listCdfConfigsLimit int
+
+	cmd.Flags().IntVar(&listCdfConfigsReq.PageSize, "page-size", listCdfConfigsReq.PageSize, `Maximum number of CdfConfigs to return.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listCdfConfigsLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listCdfConfigsReq.PageToken, "page-token", listCdfConfigsReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-cdf-configs PARENT"
+	cmd.Short = `*Beta* List change data feed configurations.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+List change data feed configurations.
+
+  List all CDF configurations for a Lakebase database. Each configuration maps a
+  Postgres schema to a Unity Catalog schema where the change data feed is
+  materialized.
+
+  Arguments:
+    PARENT: The parent database to list CdfConfigs for. Format:
+      projects/{project}/branches/{branch}/databases/{database}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		listCdfConfigsReq.Parent = args[0]
+
+		response := w.Postgres.ListCdfConfigs(ctx, listCdfConfigsReq)
+		if listCdfConfigsLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listCdfConfigsLimit)
+		}
+		if listCdfConfigsLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listCdfConfigsLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listCdfConfigsOverrides {
+		fn(cmd, &listCdfConfigsReq)
+	}
+
+	return cmd
+}
+
+// start list-cdf-statuses command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listCdfStatusesOverrides []func(
+	*cobra.Command,
+	*postgres.ListCdfStatusesRequest,
+)
+
+func newListCdfStatuses() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listCdfStatusesReq postgres.ListCdfStatusesRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listCdfStatusesLimit int
+
+	cmd.Flags().IntVar(&listCdfStatusesReq.PageSize, "page-size", listCdfStatusesReq.PageSize, `Maximum number of CdfStatuses to return.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listCdfStatusesLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listCdfStatusesReq.PageToken, "page-token", listCdfStatusesReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-cdf-statuses PARENT"
+	cmd.Short = `*Beta* List change data feed statuses.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+List change data feed statuses.
+
+  List the per-table CDF statuses within a Lakebase CDF configuration. Each
+  status shows whether a table's change data feed is snapshotting, streaming, or
+  skipped.
 
   Arguments:
-    PARENT: The Project that owns this collection of branches. Format:
-      projects/{project_id}`
+    PARENT: The parent CdfConfig to list CdfStatuses for. Format:
+      projects/{project}/branches/{branch}/databases/{database}/cdf-configs/{cdf_config}`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -2251,14 +3535,14 @@ func newListBranches() *cobra.Command {
 		ctx := cmd.Context()
 		w := cmdctx.WorkspaceClient(ctx)
 
-		listBranchesReq.Parent = args[0]
+		listCdfStatusesReq.Parent = args[0]
 
-		response := w.Postgres.ListBranches(ctx, listBranchesReq)
-		if listBranchesLimit < 0 {
-			return fmt.Errorf("--limit must be a non-negative integer, got %d", listBranchesLimit)
+		response := w.Postgres.ListCdfStatuses(ctx, listCdfStatusesReq)
+		if listCdfStatusesLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listCdfStatusesLimit)
 		}
-		if listBranchesLimit > 0 {
-			ctx = cmdio.WithLimit(ctx, listBranchesLimit)
+		if listCdfStatusesLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listCdfStatusesLimit)
 		}
 
 		return cmdio.RenderIterator(ctx, response)
@@ -2269,8 +3553,8 @@ func newListBranches() *cobra.Command {
 	cmd.ValidArgsFunction = cobra.NoFileCompletions
 
 	// Apply optional overrides to this command.
-	for _, fn := range listBranchesOverrides {
-		fn(cmd, &listBranchesReq)
+	for _, fn := range listCdfStatusesOverrides {
+		fn(cmd, &listCdfStatusesReq)
 	}
 
 	return cmd
@@ -2313,10 +3597,9 @@ func newListDatabases() *cobra.Command {
     PARENT: The Branch that owns this collection of databases. Format:
       projects/{project_id}/branches/{branch_id}`
 
-	// This command is being previewed; hide from help output.
-	cmd.Hidden = true
-
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -2391,6 +3674,8 @@ func newListEndpoints() *cobra.Command {
       projects/{project_id}/branches/{branch_id}`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -2446,6 +3731,7 @@ func newListProjects() *cobra.Command {
 	var listProjectsLimit int
 
 	cmd.Flags().IntVar(&listProjectsReq.PageSize, "page-size", listProjectsReq.PageSize, `Upper bound for items returned.`)
+	cmd.Flags().BoolVar(&listProjectsReq.ShowDeleted, "show-deleted", listProjectsReq.ShowDeleted, `Whether to include soft-deleted projects in the response.`)
 
 	// Limit flag for total result capping.
 	cmd.Flags().IntVar(&listProjectsLimit, "limit", 0, `Maximum number of results to return.`)
@@ -2462,6 +3748,8 @@ func newListProjects() *cobra.Command {
   has permission to access.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -2514,26 +3802,349 @@ func newListRoles() *cobra.Command {
 	// branches, so the method-call path is always reached.
 	var listRolesLimit int
 
-	cmd.Flags().IntVar(&listRolesReq.PageSize, "page-size", listRolesReq.PageSize, `Upper bound for items returned.`)
+	cmd.Flags().IntVar(&listRolesReq.PageSize, "page-size", listRolesReq.PageSize, `Upper bound for items returned.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listRolesLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listRolesReq.PageToken, "page-token", listRolesReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-roles PARENT"
+	cmd.Short = `List Postgres Roles for a Branch.`
+	cmd.Long = `List Postgres Roles for a Branch.
+
+  Returns a paginated list of Postgres roles in the branch.
+
+  Arguments:
+    PARENT: The Branch that owns this collection of roles. Format:
+      projects/{project_id}/branches/{branch_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		listRolesReq.Parent = args[0]
+
+		response := w.Postgres.ListRoles(ctx, listRolesReq)
+		if listRolesLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listRolesLimit)
+		}
+		if listRolesLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listRolesLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listRolesOverrides {
+		fn(cmd, &listRolesReq)
+	}
+
+	return cmd
+}
+
+// start list-snapshots command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listSnapshotsOverrides []func(
+	*cobra.Command,
+	*postgres.ListSnapshotsRequest,
+)
+
+func newListSnapshots() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listSnapshotsReq postgres.ListSnapshotsRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listSnapshotsLimit int
+
+	cmd.Flags().IntVar(&listSnapshotsReq.PageSize, "page-size", listSnapshotsReq.PageSize, `Maximum number of snapshots to return per page.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listSnapshotsLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listSnapshotsReq.PageToken, "page-token", listSnapshotsReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-snapshots PARENT"
+	cmd.Short = `*Beta* List Snapshots.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+List Snapshots.
+
+  Returns a paginated list of snapshots in the project.
+
+  Arguments:
+    PARENT: The project that owns the snapshots. Format: projects/{project_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		listSnapshotsReq.Parent = args[0]
+
+		response := w.Postgres.ListSnapshots(ctx, listSnapshotsReq)
+		if listSnapshotsLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listSnapshotsLimit)
+		}
+		if listSnapshotsLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listSnapshotsLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listSnapshotsOverrides {
+		fn(cmd, &listSnapshotsReq)
+	}
+
+	return cmd
+}
+
+// start reveal-role-password command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var revealRolePasswordOverrides []func(
+	*cobra.Command,
+	*postgres.RevealRolePasswordRequest,
+)
+
+func newRevealRolePassword() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var revealRolePasswordReq postgres.RevealRolePasswordRequest
+
+	cmd.Use = "reveal-role-password NAME"
+	cmd.Short = `Reveal a Postgres Role password.`
+	cmd.Long = `Reveal a Postgres Role password.
+
+  Reveals the current password for a password-authenticated Postgres role.
+
+  Arguments:
+    NAME: The full resource path of the role whose password should be revealed.
+      Format: projects/{project_id}/branches/{branch_id}/roles/{role_id}`
+
+	// This command is being previewed; hide from help output.
+	cmd.Hidden = true
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		revealRolePasswordReq.Name = args[0]
+
+		response, err := w.Postgres.RevealRolePassword(ctx, revealRolePasswordReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range revealRolePasswordOverrides {
+		fn(cmd, &revealRolePasswordReq)
+	}
+
+	return cmd
+}
+
+// start undelete-branch command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var undeleteBranchOverrides []func(
+	*cobra.Command,
+	*postgres.UndeleteBranchRequest,
+)
+
+func newUndeleteBranch() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var undeleteBranchReq postgres.UndeleteBranchRequest
+
+	var undeleteBranchSkipWait bool
+	var undeleteBranchTimeout time.Duration
+
+	cmd.Flags().BoolVar(&undeleteBranchSkipWait, "no-wait", undeleteBranchSkipWait, `do not wait to reach DONE state`)
+	cmd.Flags().DurationVar(&undeleteBranchTimeout, "timeout", 0, `maximum amount of time to reach DONE state`)
+
+	cmd.Use = "undelete-branch NAME"
+	cmd.Short = `Undelete a Branch.`
+	cmd.Long = `Undelete a Branch.
+
+  Undeletes the specified database branch.
+
+  This is a long-running operation. By default, the command waits for the
+  operation to complete. Use --no-wait to return immediately with the raw
+  operation details. The operation's 'name' field can then be used to poll for
+  completion using the get-operation command.
+
+  Arguments:
+    NAME: The full resource path of the branch to undelete. Format:
+      projects/{project_id}/branches/{branch_id}`
+
+	// This command is being previewed; hide from help output.
+	cmd.Hidden = true
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		undeleteBranchReq.Name = args[0]
+
+		// Determine which mode to execute based on flags.
+		switch {
+		case undeleteBranchSkipWait:
+			wait, err := w.Postgres.UndeleteBranch(ctx, undeleteBranchReq)
+			if err != nil {
+				return err
+			}
+
+			// Return operation immediately without waiting.
+			operation, err := w.Postgres.GetOperation(ctx, postgres.GetOperationRequest{
+				Name: wait.Name(),
+			})
+			if err != nil {
+				return err
+			}
+			return cmdio.Render(ctx, operation)
+
+		default:
+			wait, err := w.Postgres.UndeleteBranch(ctx, undeleteBranchReq)
+			if err != nil {
+				return err
+			}
+
+			// Show spinner while waiting for completion.
+			sp := cmdio.NewSpinner(ctx)
+			sp.Update("Waiting for undelete-branch to complete...")
+
+			// Wait for completion.
+			opts := api.WithTimeout(undeleteBranchTimeout)
+
+			err = wait.Wait(ctx, opts)
+			if err != nil {
+				return err
+			}
+			sp.Close()
+			return nil
+		}
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range undeleteBranchOverrides {
+		fn(cmd, &undeleteBranchReq)
+	}
+
+	return cmd
+}
+
+// start undelete-project command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var undeleteProjectOverrides []func(
+	*cobra.Command,
+	*postgres.UndeleteProjectRequest,
+)
+
+func newUndeleteProject() *cobra.Command {
+	cmd := &cobra.Command{}
 
-	// Limit flag for total result capping.
-	cmd.Flags().IntVar(&listRolesLimit, "limit", 0, `Maximum number of results to return.`)
+	var undeleteProjectReq postgres.UndeleteProjectRequest
 
-	// Hidden pagination flags (internal API parameters).
-	cmd.Flags().StringVar(&listRolesReq.PageToken, "page-token", listRolesReq.PageToken, `Pagination token.`)
-	cmd.Flags().Lookup("page-token").Hidden = true
+	var undeleteProjectSkipWait bool
+	var undeleteProjectTimeout time.Duration
 
-	cmd.Use = "list-roles PARENT"
-	cmd.Short = `List Postgres Roles for a Branch.`
-	cmd.Long = `List Postgres Roles for a Branch.
+	cmd.Flags().BoolVar(&undeleteProjectSkipWait, "no-wait", undeleteProjectSkipWait, `do not wait to reach DONE state`)
+	cmd.Flags().DurationVar(&undeleteProjectTimeout, "timeout", 0, `maximum amount of time to reach DONE state`)
 
-  Returns a paginated list of Postgres roles in the branch.
+	cmd.Use = "undelete-project NAME"
+	cmd.Short = `*Beta* Undelete a Project.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Undelete a Project.
+
+  Undeletes a soft-deleted project.
+
+  This is a long-running operation. By default, the command waits for the
+  operation to complete. Use --no-wait to return immediately with the raw
+  operation details. The operation's 'name' field can then be used to poll for
+  completion using the get-operation command.
 
   Arguments:
-    PARENT: The Branch that owns this collection of roles. Format:
-      projects/{project_id}/branches/{branch_id}`
+    NAME: The full resource path of the project to undelete. Format:
+      projects/{project_id}`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -2545,17 +4156,45 @@ func newListRoles() *cobra.Command {
 		ctx := cmd.Context()
 		w := cmdctx.WorkspaceClient(ctx)
 
-		listRolesReq.Parent = args[0]
+		undeleteProjectReq.Name = args[0]
 
-		response := w.Postgres.ListRoles(ctx, listRolesReq)
-		if listRolesLimit < 0 {
-			return fmt.Errorf("--limit must be a non-negative integer, got %d", listRolesLimit)
-		}
-		if listRolesLimit > 0 {
-			ctx = cmdio.WithLimit(ctx, listRolesLimit)
-		}
+		// Determine which mode to execute based on flags.
+		switch {
+		case undeleteProjectSkipWait:
+			wait, err := w.Postgres.UndeleteProject(ctx, undeleteProjectReq)
+			if err != nil {
+				return err
+			}
 
-		return cmdio.RenderIterator(ctx, response)
+			// Return operation immediately without waiting.
+			operation, err := w.Postgres.GetOperation(ctx, postgres.GetOperationRequest{
+				Name: wait.Name(),
+			})
+			if err != nil {
+				return err
+			}
+			return cmdio.Render(ctx, operation)
+
+		default:
+			wait, err := w.Postgres.UndeleteProject(ctx, undeleteProjectReq)
+			if err != nil {
+				return err
+			}
+
+			// Show spinner while waiting for completion.
+			sp := cmdio.NewSpinner(ctx)
+			sp.Update("Waiting for undelete-project to complete...")
+
+			// Wait for completion.
+			opts := api.WithTimeout(undeleteProjectTimeout)
+
+			err = wait.Wait(ctx, opts)
+			if err != nil {
+				return err
+			}
+			sp.Close()
+			return nil
+		}
 	}
 
 	// Disable completions since they are not applicable.
@@ -2563,8 +4202,8 @@ func newListRoles() *cobra.Command {
 	cmd.ValidArgsFunction = cobra.NoFileCompletions
 
 	// Apply optional overrides to this command.
-	for _, fn := range listRolesOverrides {
-		fn(cmd, &listRolesReq)
+	for _, fn := range undeleteProjectOverrides {
+		fn(cmd, &undeleteProjectReq)
 	}
 
 	return cmd
@@ -2613,10 +4252,11 @@ func newUpdateBranch() *cobra.Command {
   Arguments:
     NAME: Output only. The full resource path of the branch. Format:
       projects/{project_id}/branches/{branch_id}
-    UPDATE_MASK: The list of fields to update. If unspecified, all fields will be updated
-      when possible.`
+    UPDATE_MASK: The list of fields to update.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -2696,6 +4336,135 @@ func newUpdateBranch() *cobra.Command {
 	return cmd
 }
 
+// start update-data-api command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateDataApiOverrides []func(
+	*cobra.Command,
+	*postgres.UpdateDataApiRequest,
+)
+
+func newUpdateDataApi() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateDataApiReq postgres.UpdateDataApiRequest
+	updateDataApiReq.DataApi = postgres.DataApi{}
+	var updateDataApiJson flags.JsonFlag
+
+	var updateDataApiSkipWait bool
+	var updateDataApiTimeout time.Duration
+
+	cmd.Flags().BoolVar(&updateDataApiSkipWait, "no-wait", updateDataApiSkipWait, `do not wait to reach DONE state`)
+	cmd.Flags().DurationVar(&updateDataApiTimeout, "timeout", 0, `maximum amount of time to reach DONE state`)
+
+	cmd.Flags().Var(&updateDataApiJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&updateDataApiReq.DataApi.Name, "name", updateDataApiReq.DataApi.Name, `Resource name: projects/{project_id}/branches/{branch_id}/databases/{database_id}/data-api.`)
+	// TODO: complex arg: spec
+	// TODO: complex arg: status
+
+	cmd.Use = "update-data-api NAME UPDATE_MASK"
+	cmd.Short = `Update Data API configuration.`
+	cmd.Long = `Update Data API configuration.
+
+  Update Data API configuration for a database.
+
+  This is a long-running operation. By default, the command waits for the
+  operation to complete. Use --no-wait to return immediately with the raw
+  operation details. The operation's 'name' field can then be used to poll for
+  completion using the get-operation command.
+
+  Arguments:
+    NAME: Resource name:
+      projects/{project_id}/branches/{branch_id}/databases/{database_id}/data-api
+    UPDATE_MASK: The list of fields to update.`
+
+	// This command is being previewed; hide from help output.
+	cmd.Hidden = true
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updateDataApiJson.Unmarshal(&updateDataApiReq.DataApi)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		updateDataApiReq.Name = args[0]
+		if args[1] != "" {
+			updateMaskArray := strings.Split(args[1], ",")
+			updateDataApiReq.UpdateMask = *fieldmask.New(updateMaskArray)
+		}
+
+		// Determine which mode to execute based on flags.
+		switch {
+		case updateDataApiSkipWait:
+			wait, err := w.Postgres.UpdateDataApi(ctx, updateDataApiReq)
+			if err != nil {
+				return err
+			}
+
+			// Return operation immediately without waiting.
+			operation, err := w.Postgres.GetOperation(ctx, postgres.GetOperationRequest{
+				Name: wait.Name(),
+			})
+			if err != nil {
+				return err
+			}
+			return cmdio.Render(ctx, operation)
+
+		default:
+			wait, err := w.Postgres.UpdateDataApi(ctx, updateDataApiReq)
+			if err != nil {
+				return err
+			}
+
+			// Show spinner while waiting for completion.
+			sp := cmdio.NewSpinner(ctx)
+			sp.Update("Waiting for update-data-api to complete...")
+
+			// Wait for completion.
+			opts := api.WithTimeout(updateDataApiTimeout)
+			response, err := wait.Wait(ctx, opts)
+			if err != nil {
+				return err
+			}
+			sp.Close()
+			return cmdio.Render(ctx, response)
+		}
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateDataApiOverrides {
+		fn(cmd, &updateDataApiReq)
+	}
+
+	return cmd
+}
+
 // start update-database command
 
 // Slice with functions to override default command behavior.
@@ -2736,13 +4505,11 @@ func newUpdateDatabase() *cobra.Command {
   Arguments:
     NAME: The resource name of the database. Format:
       projects/{project_id}/branches/{branch_id}/databases/{database_id}
-    UPDATE_MASK: The list of fields to update. If unspecified, all fields will be updated
-      when possible.`
-
-	// This command is being previewed; hide from help output.
-	cmd.Hidden = true
+    UPDATE_MASK: The list of fields to update.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -2865,10 +4632,11 @@ func newUpdateEndpoint() *cobra.Command {
   Arguments:
     NAME: Output only. The full resource path of the endpoint. Format:
       projects/{project_id}/branches/{branch_id}/endpoints/{endpoint_id}
-    UPDATE_MASK: The list of fields to update. If unspecified, all fields will be updated
-      when possible.`
+    UPDATE_MASK: The list of fields to update.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -2972,6 +4740,7 @@ func newUpdateProject() *cobra.Command {
 
 	cmd.Flags().Var(&updateProjectJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
+	// TODO: complex arg: initial_branch_spec
 	// TODO: complex arg: initial_endpoint_spec
 	cmd.Flags().StringVar(&updateProjectReq.Project.Name, "name", updateProjectReq.Project.Name, `Output only.`)
 	// TODO: complex arg: spec
@@ -2991,10 +4760,11 @@ func newUpdateProject() *cobra.Command {
   Arguments:
     NAME: Output only. The full resource path of the project. Format:
       projects/{project_id}
-    UPDATE_MASK: The list of fields to update. If unspecified, all fields will be updated
-      when possible.`
+    UPDATE_MASK: The list of fields to update.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -3116,10 +4886,11 @@ func newUpdateRole() *cobra.Command {
   Arguments:
     NAME: Output only. The full resource path of the role. Format:
       projects/{project_id}/branches/{branch_id}/roles/{role_id}
-    UPDATE_MASK: The list of fields to update in Postgres Role. If unspecified, all fields
-      will be updated when possible.`
+    UPDATE_MASK: The list of fields to update.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -3199,4 +4970,133 @@ func newUpdateRole() *cobra.Command {
 	return cmd
 }
 
+// start update-snapshot-schedule command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateSnapshotScheduleOverrides []func(
+	*cobra.Command,
+	*postgres.UpdateSnapshotScheduleRequest,
+)
+
+func newUpdateSnapshotSchedule() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateSnapshotScheduleReq postgres.UpdateSnapshotScheduleRequest
+	updateSnapshotScheduleReq.SnapshotSchedule = postgres.SnapshotSchedule{}
+	var updateSnapshotScheduleJson flags.JsonFlag
+
+	var updateSnapshotScheduleSkipWait bool
+	var updateSnapshotScheduleTimeout time.Duration
+
+	cmd.Flags().BoolVar(&updateSnapshotScheduleSkipWait, "no-wait", updateSnapshotScheduleSkipWait, `do not wait to reach DONE state`)
+	cmd.Flags().DurationVar(&updateSnapshotScheduleTimeout, "timeout", 0, `maximum amount of time to reach DONE state`)
+
+	cmd.Flags().Var(&updateSnapshotScheduleJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&updateSnapshotScheduleReq.SnapshotSchedule.Name, "name", updateSnapshotScheduleReq.SnapshotSchedule.Name, `The resource name of the branch's snapshot schedule.`)
+	// TODO: array: schedule
+
+	cmd.Use = "update-snapshot-schedule NAME UPDATE_MASK"
+	cmd.Short = `*Beta* Update a Snapshot Schedule.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Update a Snapshot Schedule.
+
+  Sets the snapshot schedule for a branch. The schedule field is replaced
+  wholesale; an empty schedule disables automatic snapshots.
+
+  This is a long-running operation. By default, the command waits for the
+  operation to complete. Use --no-wait to return immediately with the raw
+  operation details. The operation's 'name' field can then be used to poll for
+  completion using the get-operation command.
+
+  Arguments:
+    NAME: The resource name of the branch's snapshot schedule. Format:
+      projects/{project_id}/branches/{branch_id}/snapshot-schedule
+    UPDATE_MASK: Fields to update. The only updatable path is schedule, which replaces
+      the entire set of cadences.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updateSnapshotScheduleJson.Unmarshal(&updateSnapshotScheduleReq.SnapshotSchedule)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		updateSnapshotScheduleReq.Name = args[0]
+		if args[1] != "" {
+			updateMaskArray := strings.Split(args[1], ",")
+			updateSnapshotScheduleReq.UpdateMask = *fieldmask.New(updateMaskArray)
+		}
+
+		// Determine which mode to execute based on flags.
+		switch {
+		case updateSnapshotScheduleSkipWait:
+			wait, err := w.Postgres.UpdateSnapshotSchedule(ctx, updateSnapshotScheduleReq)
+			if err != nil {
+				return err
+			}
+
+			// Return operation immediately without waiting.
+			operation, err := w.Postgres.GetOperation(ctx, postgres.GetOperationRequest{
+				Name: wait.Name(),
+			})
+			if err != nil {
+				return err
+			}
+			return cmdio.Render(ctx, operation)
+
+		default:
+			wait, err := w.Postgres.UpdateSnapshotSchedule(ctx, updateSnapshotScheduleReq)
+			if err != nil {
+				return err
+			}
+
+			// Show spinner while waiting for completion.
+			sp := cmdio.NewSpinner(ctx)
+			sp.Update("Waiting for update-snapshot-schedule to complete...")
+
+			// Wait for completion.
+			opts := api.WithTimeout(updateSnapshotScheduleTimeout)
+			response, err := wait.Wait(ctx, opts)
+			if err != nil {
+				return err
+			}
+			sp.Close()
+			return cmdio.Render(ctx, response)
+		}
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateSnapshotScheduleOverrides {
+		fn(cmd, &updateSnapshotScheduleReq)
+	}
+
+	return cmd
+}
+
 // end service Postgres
diff --git a/cmd/workspace/provider-exchange-filters/provider-exchange-filters.go b/cmd/workspace/provider-exchange-filters/provider-exchange-filters.go
old mode 100755
new mode 100644
index 2f3e43779b5..c67cac764b0
--- a/cmd/workspace/provider-exchange-filters/provider-exchange-filters.go
+++ b/cmd/workspace/provider-exchange-filters/provider-exchange-filters.go
@@ -3,6 +3,7 @@
 package provider_exchange_filters
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -19,13 +20,19 @@ var cmdOverrides []func(*cobra.Command)
 
 func New() *cobra.Command {
 	cmd := &cobra.Command{
-		Use:     "provider-exchange-filters",
-		Short:   `Marketplace exchanges filters curate which groups can access an exchange.`,
-		Long:    `Marketplace exchanges filters curate which groups can access an exchange.`,
+		Use:   "provider-exchange-filters",
+		Short: `*Public Preview* Marketplace exchanges filters curate which groups can access an exchange.`,
+		Long: `This command is in Public Preview and may change without notice.
+
+Marketplace exchanges filters curate which groups can access an exchange.`,
 		GroupID: "marketplace",
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -58,12 +65,16 @@ func newCreate() *cobra.Command {
 	cmd.Flags().Var(&createJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Use = "create"
-	cmd.Short = `Create a new exchange filter.`
-	cmd.Long = `Create a new exchange filter.
+	cmd.Short = `*Public Preview* Create a new exchange filter.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Create a new exchange filter.
 
   Add an exchange filter.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -82,7 +93,7 @@ func newCreate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := w.ProviderExchangeFilters.Create(ctx, createReq)
@@ -120,12 +131,16 @@ func newDelete() *cobra.Command {
 	var deleteReq marketplace.DeleteExchangeFilterRequest
 
 	cmd.Use = "delete ID"
-	cmd.Short = `Delete an exchange filter.`
-	cmd.Long = `Delete an exchange filter.
+	cmd.Short = `*Public Preview* Delete an exchange filter.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Delete an exchange filter.
 
   Delete an exchange filter`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -147,7 +162,7 @@ func newDelete() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have ")
+			return errors.New("expected to have ")
 		}
 		deleteReq.Id = args[0]
 
@@ -198,12 +213,16 @@ func newList() *cobra.Command {
 	cmd.Flags().Lookup("page-token").Hidden = true
 
 	cmd.Use = "list EXCHANGE_ID"
-	cmd.Short = `List exchange filters.`
-	cmd.Long = `List exchange filters.
+	cmd.Short = `*Public Preview* List exchange filters.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+List exchange filters.
 
   List exchange filter`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -258,12 +277,16 @@ func newUpdate() *cobra.Command {
 	cmd.Flags().Var(&updateJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Use = "update ID"
-	cmd.Short = `Update exchange filter.`
-	cmd.Long = `Update exchange filter.
+	cmd.Short = `*Public Preview* Update exchange filter.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Update exchange filter.
 
   Update an exchange filter.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -287,7 +310,7 @@ func newUpdate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 		updateReq.Id = args[0]
 
diff --git a/cmd/workspace/provider-exchanges/provider-exchanges.go b/cmd/workspace/provider-exchanges/provider-exchanges.go
old mode 100755
new mode 100644
index 5410ad8a038..7c8484fce1b
--- a/cmd/workspace/provider-exchanges/provider-exchanges.go
+++ b/cmd/workspace/provider-exchanges/provider-exchanges.go
@@ -3,6 +3,7 @@
 package provider_exchanges
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -20,13 +21,19 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "provider-exchanges",
-		Short: `Marketplace exchanges allow providers to share their listings with a curated set of customers.`,
-		Long: `Marketplace exchanges allow providers to share their listings with a curated
+		Short: `*Public Preview* Marketplace exchanges allow providers to share their listings with a curated set of customers.`,
+		Long: `This command is in Public Preview and may change without notice.
+
+Marketplace exchanges allow providers to share their listings with a curated
   set of customers.`,
 		GroupID: "marketplace",
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
 	// Add methods
 	cmd.AddCommand(newAddListingToExchange())
 	cmd.AddCommand(newCreate())
@@ -64,18 +71,22 @@ func newAddListingToExchange() *cobra.Command {
 	cmd.Flags().Var(&addListingToExchangeJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Use = "add-listing-to-exchange LISTING_ID EXCHANGE_ID"
-	cmd.Short = `Add an exchange for listing.`
-	cmd.Long = `Add an exchange for listing.
+	cmd.Short = `*Public Preview* Add an exchange for listing.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Add an exchange for listing.
 
   Associate an exchange with a listing`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'listing_id', 'exchange_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'listing_id', 'exchange_id' in your JSON input")
 			}
 			return nil
 		}
@@ -145,12 +156,16 @@ func newCreate() *cobra.Command {
 	cmd.Flags().Var(&createJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Use = "create"
-	cmd.Short = `Create an exchange.`
-	cmd.Long = `Create an exchange.
+	cmd.Short = `*Public Preview* Create an exchange.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Create an exchange.
 
   Create an exchange`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -169,7 +184,7 @@ func newCreate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := w.ProviderExchanges.Create(ctx, createReq)
@@ -207,12 +222,16 @@ func newDelete() *cobra.Command {
 	var deleteReq marketplace.DeleteExchangeRequest
 
 	cmd.Use = "delete ID"
-	cmd.Short = `Delete an exchange.`
-	cmd.Long = `Delete an exchange.
+	cmd.Short = `*Public Preview* Delete an exchange.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Delete an exchange.
 
   This removes a listing from marketplace.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -260,12 +279,16 @@ func newDeleteListingFromExchange() *cobra.Command {
 	var deleteListingFromExchangeReq marketplace.RemoveExchangeForListingRequest
 
 	cmd.Use = "delete-listing-from-exchange ID"
-	cmd.Short = `Remove an exchange for listing.`
-	cmd.Long = `Remove an exchange for listing.
+	cmd.Short = `*Public Preview* Remove an exchange for listing.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Remove an exchange for listing.
 
   Disassociate an exchange with a listing`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -313,10 +336,14 @@ func newGet() *cobra.Command {
 	var getReq marketplace.GetExchangeRequest
 
 	cmd.Use = "get ID"
-	cmd.Short = `Get an exchange.`
-	cmd.Long = `Get an exchange.`
+	cmd.Short = `*Public Preview* Get an exchange.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get an exchange.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -378,12 +405,16 @@ func newList() *cobra.Command {
 	cmd.Flags().Lookup("page-token").Hidden = true
 
 	cmd.Use = "list"
-	cmd.Short = `List exchanges.`
-	cmd.Long = `List exchanges.
+	cmd.Short = `*Public Preview* List exchanges.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+List exchanges.
 
   List exchanges visible to provider`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -446,12 +477,16 @@ func newListExchangesForListing() *cobra.Command {
 	cmd.Flags().Lookup("page-token").Hidden = true
 
 	cmd.Use = "list-exchanges-for-listing LISTING_ID"
-	cmd.Short = `List exchanges for listing.`
-	cmd.Long = `List exchanges for listing.
+	cmd.Short = `*Public Preview* List exchanges for listing.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+List exchanges for listing.
 
   List exchanges associated with a listing`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -516,12 +551,16 @@ func newListListingsForExchange() *cobra.Command {
 	cmd.Flags().Lookup("page-token").Hidden = true
 
 	cmd.Use = "list-listings-for-exchange EXCHANGE_ID"
-	cmd.Short = `List listings for exchange.`
-	cmd.Long = `List listings for exchange.
+	cmd.Short = `*Public Preview* List listings for exchange.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+List listings for exchange.
 
   List listings associated with an exchange`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -576,12 +615,16 @@ func newUpdate() *cobra.Command {
 	cmd.Flags().Var(&updateJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Use = "update ID"
-	cmd.Short = `Update exchange.`
-	cmd.Long = `Update exchange.
+	cmd.Short = `*Public Preview* Update exchange.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Update exchange.
 
   Update an exchange`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -605,7 +648,7 @@ func newUpdate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 		updateReq.Id = args[0]
 
diff --git a/cmd/workspace/provider-files/provider-files.go b/cmd/workspace/provider-files/provider-files.go
old mode 100755
new mode 100644
index ceb4ff5479f..6322769d366
--- a/cmd/workspace/provider-files/provider-files.go
+++ b/cmd/workspace/provider-files/provider-files.go
@@ -3,6 +3,7 @@
 package provider_files
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -20,13 +21,19 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "provider-files",
-		Short: `Marketplace offers a set of file APIs for various purposes such as preview notebooks and provider icons.`,
-		Long: `Marketplace offers a set of file APIs for various purposes such as preview
+		Short: `*Public Preview* Marketplace offers a set of file APIs for various purposes such as preview notebooks and provider icons.`,
+		Long: `This command is in Public Preview and may change without notice.
+
+Marketplace offers a set of file APIs for various purposes such as preview
   notebooks and provider icons.`,
 		GroupID: "marketplace",
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -61,13 +68,17 @@ func newCreate() *cobra.Command {
 	cmd.Flags().StringVar(&createReq.DisplayName, "display-name", createReq.DisplayName, ``)
 
 	cmd.Use = "create"
-	cmd.Short = `Create a file.`
-	cmd.Long = `Create a file.
+	cmd.Short = `*Public Preview* Create a file.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Create a file.
 
   Create a file. Currently, only provider icons and attached notebooks are
   supported.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -86,7 +97,7 @@ func newCreate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := w.ProviderFiles.Create(ctx, createReq)
@@ -124,12 +135,16 @@ func newDelete() *cobra.Command {
 	var deleteReq marketplace.DeleteFileRequest
 
 	cmd.Use = "delete FILE_ID"
-	cmd.Short = `Delete a file.`
-	cmd.Long = `Delete a file.
+	cmd.Short = `*Public Preview* Delete a file.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Delete a file.
 
   Delete a file`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -151,7 +166,7 @@ func newDelete() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have ")
+			return errors.New("expected to have ")
 		}
 		deleteReq.FileId = args[0]
 
@@ -189,12 +204,16 @@ func newGet() *cobra.Command {
 	var getReq marketplace.GetFileRequest
 
 	cmd.Use = "get FILE_ID"
-	cmd.Short = `Get a file.`
-	cmd.Long = `Get a file.
+	cmd.Short = `*Public Preview* Get a file.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get a file.
 
   Get a file`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -216,7 +235,7 @@ func newGet() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have ")
+			return errors.New("expected to have ")
 		}
 		getReq.FileId = args[0]
 
@@ -271,12 +290,16 @@ func newList() *cobra.Command {
 	cmd.Flags().Lookup("page-token").Hidden = true
 
 	cmd.Use = "list"
-	cmd.Short = `List files.`
-	cmd.Long = `List files.
+	cmd.Short = `*Public Preview* List files.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+List files.
 
   List files attached to a parent entity.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -295,7 +318,7 @@ func newList() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response := w.ProviderFiles.List(ctx, listReq)
diff --git a/cmd/workspace/provider-listings/provider-listings.go b/cmd/workspace/provider-listings/provider-listings.go
old mode 100755
new mode 100644
index f50e2d743c2..844f87041ce
--- a/cmd/workspace/provider-listings/provider-listings.go
+++ b/cmd/workspace/provider-listings/provider-listings.go
@@ -3,6 +3,7 @@
 package provider_listings
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -20,13 +21,19 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "provider-listings",
-		Short: `Listings are the core entities in the Marketplace.`,
-		Long: `Listings are the core entities in the Marketplace. They represent the products
+		Short: `*Public Preview* Listings are the core entities in the Marketplace.`,
+		Long: `This command is in Public Preview and may change without notice.
+
+Listings are the core entities in the Marketplace. They represent the products
   that are available for consumption.`,
 		GroupID: "marketplace",
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -60,12 +67,16 @@ func newCreate() *cobra.Command {
 	cmd.Flags().Var(&createJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Use = "create"
-	cmd.Short = `Create a listing.`
-	cmd.Long = `Create a listing.
+	cmd.Short = `*Public Preview* Create a listing.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Create a listing.
 
   Create a new listing`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -84,7 +95,7 @@ func newCreate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := w.ProviderListings.Create(ctx, createReq)
@@ -122,12 +133,16 @@ func newDelete() *cobra.Command {
 	var deleteReq marketplace.DeleteListingRequest
 
 	cmd.Use = "delete ID"
-	cmd.Short = `Delete a listing.`
-	cmd.Long = `Delete a listing.
+	cmd.Short = `*Public Preview* Delete a listing.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Delete a listing.
 
   Delete a listing`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -149,7 +164,7 @@ func newDelete() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have ")
+			return errors.New("expected to have ")
 		}
 		deleteReq.Id = args[0]
 
@@ -187,12 +202,16 @@ func newGet() *cobra.Command {
 	var getReq marketplace.GetListingRequest
 
 	cmd.Use = "get ID"
-	cmd.Short = `Get a listing.`
-	cmd.Long = `Get a listing.
+	cmd.Short = `*Public Preview* Get a listing.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get a listing.
 
   Get a listing`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -214,7 +233,7 @@ func newGet() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have ")
+			return errors.New("expected to have ")
 		}
 		getReq.Id = args[0]
 
@@ -266,12 +285,16 @@ func newList() *cobra.Command {
 	cmd.Flags().Lookup("page-token").Hidden = true
 
 	cmd.Use = "list"
-	cmd.Short = `List listings.`
-	cmd.Long = `List listings.
+	cmd.Short = `*Public Preview* List listings.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+List listings.
 
   List listings owned by this provider`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -324,12 +347,16 @@ func newUpdate() *cobra.Command {
 	cmd.Flags().Var(&updateJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Use = "update ID"
-	cmd.Short = `Update listing.`
-	cmd.Long = `Update listing.
+	cmd.Short = `*Public Preview* Update listing.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Update listing.
 
   Update a listing`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -353,7 +380,7 @@ func newUpdate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 		updateReq.Id = args[0]
 
diff --git a/cmd/workspace/provider-personalization-requests/provider-personalization-requests.go b/cmd/workspace/provider-personalization-requests/provider-personalization-requests.go
old mode 100755
new mode 100644
index dac5c529062..b86741b6b2a
--- a/cmd/workspace/provider-personalization-requests/provider-personalization-requests.go
+++ b/cmd/workspace/provider-personalization-requests/provider-personalization-requests.go
@@ -3,6 +3,7 @@
 package provider_personalization_requests
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -20,13 +21,19 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "provider-personalization-requests",
-		Short: `Personalization requests are an alternate to instantly available listings.`,
-		Long: `Personalization requests are an alternate to instantly available listings.
+		Short: `*Public Preview* Personalization requests are an alternate to instantly available listings.`,
+		Long: `This command is in Public Preview and may change without notice.
+
+Personalization requests are an alternate to instantly available listings.
   Control the lifecycle of personalized solutions.`,
 		GroupID: "marketplace",
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
 	// Add methods
 	cmd.AddCommand(newList())
 	cmd.AddCommand(newUpdate())
@@ -67,13 +74,17 @@ func newList() *cobra.Command {
 	cmd.Flags().Lookup("page-token").Hidden = true
 
 	cmd.Use = "list"
-	cmd.Short = `All personalization requests across all listings.`
-	cmd.Long = `All personalization requests across all listings.
+	cmd.Short = `*Public Preview* All personalization requests across all listings.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+All personalization requests across all listings.
 
   List personalization requests to this provider. This will return all
   personalization requests, regardless of which listing they are for.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -129,19 +140,23 @@ func newUpdate() *cobra.Command {
 	// TODO: complex arg: share
 
 	cmd.Use = "update LISTING_ID REQUEST_ID STATUS"
-	cmd.Short = `Update personalization request status.`
-	cmd.Long = `Update personalization request status.
+	cmd.Short = `*Public Preview* Update personalization request status.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Update personalization request status.
 
   Update personalization request. This method only permits updating the status
   of the request.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(2)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only LISTING_ID, REQUEST_ID as positional arguments. Provide 'status' in your JSON input")
+				return errors.New("when --json flag is specified, provide only LISTING_ID, REQUEST_ID as positional arguments. Provide 'status' in your JSON input")
 			}
 			return nil
 		}
diff --git a/cmd/workspace/provider-provider-analytics-dashboards/provider-provider-analytics-dashboards.go b/cmd/workspace/provider-provider-analytics-dashboards/provider-provider-analytics-dashboards.go
old mode 100755
new mode 100644
index b03523c0ac2..a85c1878af7
--- a/cmd/workspace/provider-provider-analytics-dashboards/provider-provider-analytics-dashboards.go
+++ b/cmd/workspace/provider-provider-analytics-dashboards/provider-provider-analytics-dashboards.go
@@ -17,13 +17,19 @@ var cmdOverrides []func(*cobra.Command)
 
 func New() *cobra.Command {
 	cmd := &cobra.Command{
-		Use:     "provider-provider-analytics-dashboards",
-		Short:   `Manage templated analytics solution for providers.`,
-		Long:    `Manage templated analytics solution for providers.`,
+		Use:   "provider-provider-analytics-dashboards",
+		Short: `*Public Preview* Manage templated analytics solution for providers.`,
+		Long: `This command is in Public Preview and may change without notice.
+
+Manage templated analytics solution for providers.`,
 		GroupID: "marketplace",
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newGet())
@@ -50,13 +56,17 @@ func newCreate() *cobra.Command {
 	cmd := &cobra.Command{}
 
 	cmd.Use = "create"
-	cmd.Short = `Create provider analytics dashboard.`
-	cmd.Long = `Create provider analytics dashboard.
+	cmd.Short = `*Public Preview* Create provider analytics dashboard.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Create provider analytics dashboard.
 
   Create provider analytics dashboard. Returns Marketplace specific id. Not to
   be confused with the Lakeview dashboard id.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -94,10 +104,14 @@ func newGet() *cobra.Command {
 	cmd := &cobra.Command{}
 
 	cmd.Use = "get"
-	cmd.Short = `Get provider analytics dashboard.`
-	cmd.Long = `Get provider analytics dashboard.`
+	cmd.Short = `*Public Preview* Get provider analytics dashboard.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get provider analytics dashboard.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -135,10 +149,14 @@ func newGetLatestVersion() *cobra.Command {
 	cmd := &cobra.Command{}
 
 	cmd.Use = "get-latest-version"
-	cmd.Short = `Get latest version of provider analytics dashboard.`
-	cmd.Long = `Get latest version of provider analytics dashboard.`
+	cmd.Short = `*Public Preview* Get latest version of provider analytics dashboard.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get latest version of provider analytics dashboard.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -184,13 +202,17 @@ func newUpdate() *cobra.Command {
 	cmd.Flags().Int64Var(&updateReq.Version, "version", updateReq.Version, `this is the version of the dashboard template we want to update our user to current expectation is that it should be equal to latest version of the dashboard template.`)
 
 	cmd.Use = "update ID"
-	cmd.Short = `Update provider analytics dashboard.`
-	cmd.Long = `Update provider analytics dashboard.
+	cmd.Short = `*Public Preview* Update provider analytics dashboard.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Update provider analytics dashboard.
 
   Arguments:
     ID: id is immutable property and can't be updated.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/workspace/provider-providers/provider-providers.go b/cmd/workspace/provider-providers/provider-providers.go
old mode 100755
new mode 100644
index 2646c166cdf..92fb2ea916a
--- a/cmd/workspace/provider-providers/provider-providers.go
+++ b/cmd/workspace/provider-providers/provider-providers.go
@@ -3,6 +3,7 @@
 package provider_providers
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -19,13 +20,19 @@ var cmdOverrides []func(*cobra.Command)
 
 func New() *cobra.Command {
 	cmd := &cobra.Command{
-		Use:     "provider-providers",
-		Short:   `Providers are entities that manage assets in Marketplace.`,
-		Long:    `Providers are entities that manage assets in Marketplace.`,
+		Use:   "provider-providers",
+		Short: `*Public Preview* Providers are entities that manage assets in Marketplace.`,
+		Long: `This command is in Public Preview and may change without notice.
+
+Providers are entities that manage assets in Marketplace.`,
 		GroupID: "marketplace",
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -59,12 +66,16 @@ func newCreate() *cobra.Command {
 	cmd.Flags().Var(&createJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Use = "create"
-	cmd.Short = `Create a provider.`
-	cmd.Long = `Create a provider.
+	cmd.Short = `*Public Preview* Create a provider.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Create a provider.
 
   Create a provider`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -83,7 +94,7 @@ func newCreate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := w.ProviderProviders.Create(ctx, createReq)
@@ -121,12 +132,16 @@ func newDelete() *cobra.Command {
 	var deleteReq marketplace.DeleteProviderRequest
 
 	cmd.Use = "delete ID"
-	cmd.Short = `Delete provider.`
-	cmd.Long = `Delete provider.
+	cmd.Short = `*Public Preview* Delete provider.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Delete provider.
 
   Delete provider`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -148,7 +163,7 @@ func newDelete() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have ")
+			return errors.New("expected to have ")
 		}
 		deleteReq.Id = args[0]
 
@@ -186,12 +201,16 @@ func newGet() *cobra.Command {
 	var getReq marketplace.GetProviderRequest
 
 	cmd.Use = "get ID"
-	cmd.Short = `Get provider.`
-	cmd.Long = `Get provider.
+	cmd.Short = `*Public Preview* Get provider.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get provider.
 
   Get provider profile`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -213,7 +232,7 @@ func newGet() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have ")
+			return errors.New("expected to have ")
 		}
 		getReq.Id = args[0]
 
@@ -265,12 +284,16 @@ func newList() *cobra.Command {
 	cmd.Flags().Lookup("page-token").Hidden = true
 
 	cmd.Use = "list"
-	cmd.Short = `List providers.`
-	cmd.Long = `List providers.
+	cmd.Short = `*Public Preview* List providers.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+List providers.
 
   List provider profiles for account.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -323,12 +346,16 @@ func newUpdate() *cobra.Command {
 	cmd.Flags().Var(&updateJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Use = "update ID"
-	cmd.Short = `Update provider.`
-	cmd.Long = `Update provider.
+	cmd.Short = `*Public Preview* Update provider.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Update provider.
 
   Update provider profile`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -352,7 +379,7 @@ func newUpdate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 		updateReq.Id = args[0]
 
diff --git a/cmd/workspace/providers/providers.go b/cmd/workspace/providers/providers.go
old mode 100755
new mode 100644
index 2c4521f553e..8d234ff712b
--- a/cmd/workspace/providers/providers.go
+++ b/cmd/workspace/providers/providers.go
@@ -3,6 +3,7 @@
 package providers
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -28,6 +29,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -78,12 +83,14 @@ func newCreate() *cobra.Command {
       Supported values: [DATABRICKS, OAUTH_CLIENT_CREDENTIALS, OIDC_FEDERATION, TOKEN]`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'authentication_type' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'authentication_type' in your JSON input")
 			}
 			return nil
 		}
@@ -164,6 +171,8 @@ func newDelete() *cobra.Command {
     NAME: Name of the provider.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -185,7 +194,7 @@ func newDelete() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have name of the provider")
+			return errors.New("expected to have name of the provider")
 		}
 		deleteReq.Name = args[0]
 
@@ -234,6 +243,8 @@ func newGet() *cobra.Command {
     NAME: Name of the provider.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -255,7 +266,7 @@ func newGet() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have name of the provider")
+			return errors.New("expected to have name of the provider")
 		}
 		getReq.Name = args[0]
 
@@ -320,6 +331,8 @@ func newList() *cobra.Command {
   the array.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -385,6 +398,8 @@ func newListProviderShareAssets() *cobra.Command {
     SHARE_NAME: The name of the share.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -458,6 +473,8 @@ func newListShares() *cobra.Command {
     NAME: Name of the provider in which to list shares.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -479,7 +496,7 @@ func newListShares() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have name of the provider in which to list shares")
+			return errors.New("expected to have name of the provider in which to list shares")
 		}
 		listSharesReq.Name = args[0]
 
@@ -541,6 +558,8 @@ func newUpdate() *cobra.Command {
     NAME: Name of the provider.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -574,7 +593,7 @@ func newUpdate() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have name of the provider")
+			return errors.New("expected to have name of the provider")
 		}
 		updateReq.Name = args[0]
 
diff --git a/cmd/workspace/quality-monitor-v2/quality-monitor-v2.go b/cmd/workspace/quality-monitor-v2/quality-monitor-v2.go
old mode 100755
new mode 100644
index 313cc96eb55..b9a515c72cb
--- a/cmd/workspace/quality-monitor-v2/quality-monitor-v2.go
+++ b/cmd/workspace/quality-monitor-v2/quality-monitor-v2.go
@@ -3,6 +3,7 @@
 package quality_monitor_v2
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -20,14 +21,20 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "quality-monitor-v2",
-		Short: `Deprecated: Please use the Data Quality Monitoring API instead (REST: /api/data-quality/v1/monitors).`,
-		Long: `Deprecated: Please use the Data Quality Monitoring API instead (REST:
+		Short: `*Beta* Deprecated: Please use the Data Quality Monitoring API instead (REST: /api/data-quality/v1/monitors).`,
+		Long: `This command is in Beta and may change without notice.
+
+Deprecated: Please use the Data Quality Monitoring API instead (REST:
   /api/data-quality/v1/monitors). Manage data quality of UC objects (currently
   support schema).`,
 		GroupID: "qualitymonitor",
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
 	// Add methods
 	cmd.AddCommand(newCreateQualityMonitor())
 	cmd.AddCommand(newDeleteQualityMonitor())
@@ -65,8 +72,10 @@ func newCreateQualityMonitor() *cobra.Command {
 	// TODO: array: validity_check_configurations
 
 	cmd.Use = "create-quality-monitor OBJECT_TYPE OBJECT_ID"
-	cmd.Short = `Create a quality monitor.`
-	cmd.Long = `Create a quality monitor.
+	cmd.Short = `*Beta* Create a quality monitor.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Create a quality monitor.
 
   Deprecated: Use Data Quality Monitoring API instead
   (/api/data-quality/v1/monitors). Create a quality monitor on UC object.
@@ -76,12 +85,14 @@ func newCreateQualityMonitor() *cobra.Command {
     OBJECT_ID: The uuid of the request object. For example, schema id.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'object_type', 'object_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'object_type', 'object_id' in your JSON input")
 			}
 			return nil
 		}
@@ -148,8 +159,10 @@ func newDeleteQualityMonitor() *cobra.Command {
 	var deleteQualityMonitorReq qualitymonitorv2.DeleteQualityMonitorRequest
 
 	cmd.Use = "delete-quality-monitor OBJECT_TYPE OBJECT_ID"
-	cmd.Short = `Delete a quality monitor.`
-	cmd.Long = `Delete a quality monitor.
+	cmd.Short = `*Beta* Delete a quality monitor.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Delete a quality monitor.
 
   Deprecated: Use Data Quality Monitoring API instead
   (/api/data-quality/v1/monitors). Delete a quality monitor on UC object.
@@ -159,6 +172,8 @@ func newDeleteQualityMonitor() *cobra.Command {
     OBJECT_ID: The uuid of the request object. For example, schema id.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -207,8 +222,10 @@ func newGetQualityMonitor() *cobra.Command {
 	var getQualityMonitorReq qualitymonitorv2.GetQualityMonitorRequest
 
 	cmd.Use = "get-quality-monitor OBJECT_TYPE OBJECT_ID"
-	cmd.Short = `Read a quality monitor.`
-	cmd.Long = `Read a quality monitor.
+	cmd.Short = `*Beta* Read a quality monitor.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Read a quality monitor.
 
   Deprecated: Use Data Quality Monitoring API instead
   (/api/data-quality/v1/monitors). Read a quality monitor on UC object.
@@ -218,6 +235,8 @@ func newGetQualityMonitor() *cobra.Command {
     OBJECT_ID: The uuid of the request object. For example, schema id.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -280,13 +299,17 @@ func newListQualityMonitor() *cobra.Command {
 	cmd.Flags().Lookup("page-token").Hidden = true
 
 	cmd.Use = "list-quality-monitor"
-	cmd.Short = `List quality monitors.`
-	cmd.Long = `List quality monitors.
+	cmd.Short = `*Beta* List quality monitors.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+List quality monitors.
 
   Deprecated: Use Data Quality Monitoring API instead
   (/api/data-quality/v1/monitors). (Unimplemented) List quality monitors.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -343,8 +366,10 @@ func newUpdateQualityMonitor() *cobra.Command {
 	// TODO: array: validity_check_configurations
 
 	cmd.Use = "update-quality-monitor OBJECT_TYPE OBJECT_ID OBJECT_TYPE OBJECT_ID"
-	cmd.Short = `Update a quality monitor.`
-	cmd.Long = `Update a quality monitor.
+	cmd.Short = `*Beta* Update a quality monitor.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Update a quality monitor.
 
   Deprecated: Use Data Quality Monitoring API instead
   (/api/data-quality/v1/monitors). (Unimplemented) Update a quality monitor on
@@ -357,12 +382,14 @@ func newUpdateQualityMonitor() *cobra.Command {
     OBJECT_ID: The uuid of the request object. For example, schema id.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(2)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only OBJECT_TYPE, OBJECT_ID as positional arguments. Provide 'object_type', 'object_id' in your JSON input")
+				return errors.New("when --json flag is specified, provide only OBJECT_TYPE, OBJECT_ID as positional arguments. Provide 'object_type', 'object_id' in your JSON input")
 			}
 			return nil
 		}
diff --git a/cmd/workspace/quality-monitors/quality-monitors.go b/cmd/workspace/quality-monitors/quality-monitors.go
old mode 100755
new mode 100644
index ae801caa0ff..c8d43ee3b7f
--- a/cmd/workspace/quality-monitors/quality-monitors.go
+++ b/cmd/workspace/quality-monitors/quality-monitors.go
@@ -3,6 +3,7 @@
 package quality_monitors
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -36,6 +37,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCancelRefresh())
 	cmd.AddCommand(newCreate())
@@ -85,6 +90,8 @@ func newCancelRefresh() *cobra.Command {
 	cmd.Hidden = true
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -179,12 +186,14 @@ func newCreate() *cobra.Command {
       default user location via UI and Python APIs.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(1)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only TABLE_NAME as positional arguments. Provide 'output_schema_name', 'assets_dir' in your JSON input")
+				return errors.New("when --json flag is specified, provide only TABLE_NAME as positional arguments. Provide 'output_schema_name', 'assets_dir' in your JSON input")
 			}
 			return nil
 		}
@@ -275,6 +284,8 @@ func newDelete() *cobra.Command {
       corresponds to the {full_table_name_arg} arg in the endpoint path.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -345,6 +356,8 @@ func newGet() *cobra.Command {
       corresponds to the {full_table_name_arg} arg in the endpoint path.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -414,6 +427,8 @@ func newGetRefresh() *cobra.Command {
     REFRESH_ID: ID of the refresh.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -487,6 +502,8 @@ func newListRefreshes() *cobra.Command {
       insensitive and spaces are disallowed.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -565,6 +582,8 @@ func newRegenerateDashboard() *cobra.Command {
 	cmd.Hidden = true
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -646,6 +665,8 @@ func newRunRefresh() *cobra.Command {
       insensitive and spaces are disallowed.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -734,12 +755,14 @@ func newUpdate() *cobra.Command {
       be in 2-level format {catalog}.{schema}`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(1)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only TABLE_NAME as positional arguments. Provide 'output_schema_name' in your JSON input")
+				return errors.New("when --json flag is specified, provide only TABLE_NAME as positional arguments. Provide 'output_schema_name' in your JSON input")
 			}
 			return nil
 		}
diff --git a/cmd/workspace/queries-legacy/queries-legacy.go b/cmd/workspace/queries-legacy/queries-legacy.go
old mode 100755
new mode 100644
index e3dcc2402b3..c82909cdca8
--- a/cmd/workspace/queries-legacy/queries-legacy.go
+++ b/cmd/workspace/queries-legacy/queries-legacy.go
@@ -34,6 +34,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -96,6 +100,8 @@ func newCreate() *cobra.Command {
   [Learn more]: https://docs.databricks.com/en/sql/dbsql-api-latest.html`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -168,6 +174,8 @@ func newDelete() *cobra.Command {
   [Learn more]: https://docs.databricks.com/en/sql/dbsql-api-latest.html`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -227,6 +235,8 @@ func newGet() *cobra.Command {
   [Learn more]: https://docs.databricks.com/en/sql/dbsql-api-latest.html`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -306,6 +316,8 @@ func newList() *cobra.Command {
   [Learn more]: https://docs.databricks.com/en/sql/dbsql-api-latest.html`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -367,6 +379,8 @@ func newRestore() *cobra.Command {
   [Learn more]: https://docs.databricks.com/en/sql/dbsql-api-latest.html`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -438,6 +452,8 @@ func newUpdate() *cobra.Command {
   [Learn more]: https://docs.databricks.com/en/sql/dbsql-api-latest.html`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/workspace/queries/queries.go b/cmd/workspace/queries/queries.go
old mode 100755
new mode 100644
index e654b765d7b..e0eb80cb58c
--- a/cmd/workspace/queries/queries.go
+++ b/cmd/workspace/queries/queries.go
@@ -3,6 +3,7 @@
 package queries
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -29,6 +30,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -72,6 +77,8 @@ func newCreate() *cobra.Command {
   Creates a query.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -140,6 +147,8 @@ func newDelete() *cobra.Command {
   days.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -161,7 +170,7 @@ func newDelete() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have ")
+			return errors.New("expected to have ")
 		}
 		deleteReq.Id = args[0]
 
@@ -205,6 +214,8 @@ func newGet() *cobra.Command {
   Gets a query.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -226,7 +237,7 @@ func newGet() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have ")
+			return errors.New("expected to have ")
 		}
 		getReq.Id = args[0]
 
@@ -286,6 +297,8 @@ func newList() *cobra.Command {
   throttling, service degradation, or a temporary ban.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -357,6 +370,8 @@ func newListVisualizations() *cobra.Command {
 	cmd.Hidden = true
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -378,7 +393,7 @@ func newListVisualizations() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have ")
+			return errors.New("expected to have ")
 		}
 		listVisualizationsReq.Id = args[0]
 
@@ -446,12 +461,14 @@ func newUpdate() *cobra.Command {
       future.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(1)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only ID as positional arguments. Provide 'update_mask' in your JSON input")
+				return errors.New("when --json flag is specified, provide only ID as positional arguments. Provide 'update_mask' in your JSON input")
 			}
 			return nil
 		}
diff --git a/cmd/workspace/query-history/query-history.go b/cmd/workspace/query-history/query-history.go
old mode 100755
new mode 100644
index b56fb149140..fc9b0a1aa6e
--- a/cmd/workspace/query-history/query-history.go
+++ b/cmd/workspace/query-history/query-history.go
@@ -24,6 +24,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newList())
 
@@ -66,6 +70,8 @@ func newList() *cobra.Command {
   statuses.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
diff --git a/cmd/workspace/query-visualizations-legacy/query-visualizations-legacy.go b/cmd/workspace/query-visualizations-legacy/query-visualizations-legacy.go
old mode 100755
new mode 100644
index 511ce8c60a6..59a1594c7bf
--- a/cmd/workspace/query-visualizations-legacy/query-visualizations-legacy.go
+++ b/cmd/workspace/query-visualizations-legacy/query-visualizations-legacy.go
@@ -3,7 +3,7 @@
 package query_visualizations_legacy
 
 import (
-	"fmt"
+	"errors"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
@@ -20,9 +20,9 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "query-visualizations-legacy",
-		Short: `This is an evolving API that facilitates the addition and removal of vizualisations from existing queries within the Databricks Workspace.`,
+		Short: `This is an evolving API that facilitates the addition and removal of visualizations from existing queries within the Databricks Workspace.`,
 		Long: `This is an evolving API that facilitates the addition and removal of
-  vizualisations from existing queries within the Databricks Workspace. Data
+  visualizations from existing queries within the Databricks Workspace. Data
   structures may change over time.
 
   **Warning**: This API is deprecated. Please see the latest version of the
@@ -36,6 +36,10 @@ func New() *cobra.Command {
 		RunE:   root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -81,6 +85,8 @@ func newCreate() *cobra.Command {
   [Learn more]: https://docs.databricks.com/en/sql/dbsql-api-latest.html`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -99,7 +105,7 @@ func newCreate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := w.QueryVisualizationsLegacy.Create(ctx, createReq)
@@ -151,6 +157,8 @@ func newDelete() *cobra.Command {
     ID: Widget ID returned by :method:queryvisualizations/create`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -221,6 +229,8 @@ func newUpdate() *cobra.Command {
   [Learn more]: https://docs.databricks.com/en/sql/dbsql-api-latest.html`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
diff --git a/cmd/workspace/query-visualizations/query-visualizations.go b/cmd/workspace/query-visualizations/query-visualizations.go
old mode 100755
new mode 100644
index 1017b51554e..4e2b50c8687
--- a/cmd/workspace/query-visualizations/query-visualizations.go
+++ b/cmd/workspace/query-visualizations/query-visualizations.go
@@ -3,7 +3,7 @@
 package query_visualizations
 
 import (
-	"fmt"
+	"errors"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
@@ -31,6 +31,10 @@ func New() *cobra.Command {
 		RunE:   root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -70,6 +74,8 @@ func newCreate() *cobra.Command {
   Adds a visualization to a query.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -135,6 +141,8 @@ func newDelete() *cobra.Command {
   Removes a visualization.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -207,12 +215,14 @@ func newUpdate() *cobra.Command {
       future.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(1)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only ID as positional arguments. Provide 'update_mask' in your JSON input")
+				return errors.New("when --json flag is specified, provide only ID as positional arguments. Provide 'update_mask' in your JSON input")
 			}
 			return nil
 		}
diff --git a/cmd/workspace/recipient-activation/recipient-activation.go b/cmd/workspace/recipient-activation/recipient-activation.go
old mode 100755
new mode 100644
index 8505cbfb98e..0260cd5785f
--- a/cmd/workspace/recipient-activation/recipient-activation.go
+++ b/cmd/workspace/recipient-activation/recipient-activation.go
@@ -32,6 +32,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newGetActivationUrlInfo())
 	cmd.AddCommand(newRetrieveToken())
@@ -68,6 +72,8 @@ func newGetActivationUrlInfo() *cobra.Command {
     ACTIVATION_URL: The one time activation url. It also accepts activation token.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -125,6 +131,8 @@ func newRetrieveToken() *cobra.Command {
     ACTIVATION_URL: The one time activation url. It also accepts activation token.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/workspace/recipient-federation-policies/recipient-federation-policies.go b/cmd/workspace/recipient-federation-policies/recipient-federation-policies.go
old mode 100755
new mode 100644
index a8da9431289..8da45672e62
--- a/cmd/workspace/recipient-federation-policies/recipient-federation-policies.go
+++ b/cmd/workspace/recipient-federation-policies/recipient-federation-policies.go
@@ -20,8 +20,10 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "recipient-federation-policies",
-		Short: `The Recipient Federation Policies APIs are only applicable in the open sharing model where the recipient object has the authentication type of OIDC_RECIPIENT, enabling data sharing from Databricks to non-Databricks recipients.`,
-		Long: `The Recipient Federation Policies APIs are only applicable in the open sharing
+		Short: `*Public Preview* The Recipient Federation Policies APIs are only applicable in the open sharing model where the recipient object has the authentication type of OIDC_RECIPIENT, enabling data sharing from Databricks to non-Databricks recipients.`,
+		Long: `This command is in Public Preview and may change without notice.
+
+The Recipient Federation Policies APIs are only applicable in the open sharing
   model where the recipient object has the authentication type of
   OIDC_RECIPIENT, enabling data sharing from Databricks to non-Databricks
   recipients. OIDC Token Federation enables secure, secret-less authentication
@@ -50,6 +52,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -87,8 +93,10 @@ func newCreate() *cobra.Command {
 	// TODO: complex arg: oidc_policy
 
 	cmd.Use = "create RECIPIENT_NAME"
-	cmd.Short = `Create recipient federation policy.`
-	cmd.Long = `Create recipient federation policy.
+	cmd.Short = `*Public Preview* Create recipient federation policy.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Create recipient federation policy.
 
   Create a federation policy for an OIDC_FEDERATION recipient for sharing data
   from Databricks to non-Databricks recipients. The caller must be the owner of
@@ -122,6 +130,8 @@ func newCreate() *cobra.Command {
       policy is being created.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -182,8 +192,10 @@ func newDelete() *cobra.Command {
 	var deleteReq sharing.DeleteFederationPolicyRequest
 
 	cmd.Use = "delete RECIPIENT_NAME NAME"
-	cmd.Short = `Delete recipient federation policy.`
-	cmd.Long = `Delete recipient federation policy.
+	cmd.Short = `*Public Preview* Delete recipient federation policy.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Delete recipient federation policy.
 
   Deletes an existing federation policy for an OIDC_FEDERATION recipient. The
   caller must be the owner of the recipient.
@@ -194,6 +206,8 @@ func newDelete() *cobra.Command {
     NAME: Name of the policy. This is the name of the policy to be deleted.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -242,8 +256,10 @@ func newGetFederationPolicy() *cobra.Command {
 	var getFederationPolicyReq sharing.GetFederationPolicyRequest
 
 	cmd.Use = "get-federation-policy RECIPIENT_NAME NAME"
-	cmd.Short = `Get recipient federation policy.`
-	cmd.Long = `Get recipient federation policy.
+	cmd.Short = `*Public Preview* Get recipient federation policy.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get recipient federation policy.
 
   Reads an existing federation policy for an OIDC_FEDERATION recipient for
   sharing data from Databricks to non-Databricks recipients. The caller must
@@ -255,6 +271,8 @@ func newGetFederationPolicy() *cobra.Command {
     NAME: Name of the policy. This is the name of the policy to be retrieved.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -317,8 +335,10 @@ func newList() *cobra.Command {
 	cmd.Flags().Lookup("page-token").Hidden = true
 
 	cmd.Use = "list RECIPIENT_NAME"
-	cmd.Short = `List recipient federation policies.`
-	cmd.Long = `List recipient federation policies.
+	cmd.Short = `*Public Preview* List recipient federation policies.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+List recipient federation policies.
 
   Lists federation policies for an OIDC_FEDERATION recipient for sharing data
   from Databricks to non-Databricks recipients. The caller must have read access
@@ -329,6 +349,8 @@ func newList() *cobra.Command {
       policies are being listed.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/workspace/recipients/recipients.go b/cmd/workspace/recipients/recipients.go
old mode 100755
new mode 100644
index 93eab8b7485..ca02fb4d904
--- a/cmd/workspace/recipients/recipients.go
+++ b/cmd/workspace/recipients/recipients.go
@@ -3,6 +3,7 @@
 package recipients
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -42,6 +43,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -98,12 +103,14 @@ func newCreate() *cobra.Command {
       Supported values: [DATABRICKS, OAUTH_CLIENT_CREDENTIALS, OIDC_FEDERATION, TOKEN]`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'authentication_type' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'authentication_type' in your JSON input")
 			}
 			return nil
 		}
@@ -184,6 +191,8 @@ func newDelete() *cobra.Command {
     NAME: Name of the recipient.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -242,6 +251,8 @@ func newGet() *cobra.Command {
     NAME: Name of the recipient.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -314,6 +325,8 @@ func newList() *cobra.Command {
   guarantee of a specific ordering of the elements in the array.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -380,12 +393,14 @@ func newRotateToken() *cobra.Command {
       immediately, negative number will return an error.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(1)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only NAME as positional arguments. Provide 'existing_token_expire_in_seconds' in your JSON input")
+				return errors.New("when --json flag is specified, provide only NAME as positional arguments. Provide 'existing_token_expire_in_seconds' in your JSON input")
 			}
 			return nil
 		}
@@ -468,6 +483,8 @@ func newSharePermissions() *cobra.Command {
     NAME: The name of the Recipient.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -537,6 +554,8 @@ func newUpdate() *cobra.Command {
     NAME: Name of the recipient.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/workspace/redash-config/redash-config.go b/cmd/workspace/redash-config/redash-config.go
old mode 100755
new mode 100644
index ce173b6bb55..5497537c8a7
--- a/cmd/workspace/redash-config/redash-config.go
+++ b/cmd/workspace/redash-config/redash-config.go
@@ -25,6 +25,10 @@ func New() *cobra.Command {
 		RunE:   root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
 	// Add methods
 	cmd.AddCommand(newGetConfig())
 
@@ -52,6 +56,8 @@ func newGetConfig() *cobra.Command {
 	cmd.Long = `Read workspace configuration for Redash-v2.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
diff --git a/cmd/workspace/registered-models/registered-models.go b/cmd/workspace/registered-models/registered-models.go
old mode 100755
new mode 100644
index e776c537aa3..43e7acccda1
--- a/cmd/workspace/registered-models/registered-models.go
+++ b/cmd/workspace/registered-models/registered-models.go
@@ -3,6 +3,7 @@
 package registered_models
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -28,9 +29,9 @@ func New() *cobra.Command {
   An MLflow registered model resides in the third layer of Unity Catalog’s
   three-level namespace. Registered models contain model versions, which
   correspond to actual ML models (MLflow models). Creating new model versions
-  currently requires use of the MLflow Python client. Once model versions are
-  created, you can load them for batch inference using MLflow Python client
-  APIs, or deploy them for real-time serving using Databricks Model Serving.
+  requires use of the MLflow Python client. After model versions are created,
+  you can load them for batch inference using MLflow Python client APIs, or
+  deploy them for real-time serving using Databricks Model Serving.
 
   All operations on registered models and model versions require USE_CATALOG
   permissions on the enclosing catalog and USE_SCHEMA permissions on the
@@ -47,13 +48,17 @@ func New() *cobra.Command {
   update permissions on the registered model, users must be owners of the
   registered model.
 
-  Note: The securable type for models is FUNCTION. When using REST APIs (e.g.
-  tagging, grants) that specify a securable type, use FUNCTION as the securable
-  type.`,
+  Note: The securable type for models is FUNCTION. When using REST APIs (for
+  example, tagging, grants) that specify a securable type, use FUNCTION as the
+  securable type.`,
 		GroupID: "catalog",
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -89,7 +94,6 @@ func newCreate() *cobra.Command {
 	cmd.Flags().Var(&createJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	// TODO: array: aliases
-	cmd.Flags().BoolVar(&createReq.BrowseOnly, "browse-only", createReq.BrowseOnly, `Indicates whether the principal is limited to retrieving metadata for the associated object through the BROWSE privilege when include_browse is enabled in the request.`)
 	cmd.Flags().StringVar(&createReq.CatalogName, "catalog-name", createReq.CatalogName, `The name of the catalog where the schema and the registered model reside.`)
 	cmd.Flags().StringVar(&createReq.Comment, "comment", createReq.Comment, `The comment attached to the registered model.`)
 	cmd.Flags().Int64Var(&createReq.CreatedAt, "created-at", createReq.CreatedAt, `Creation timestamp of the registered model in milliseconds since the Unix epoch.`)
@@ -121,6 +125,8 @@ func newCreate() *cobra.Command {
   schema.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -195,6 +201,8 @@ func newDelete() *cobra.Command {
     FULL_NAME: The three-level (fully qualified) name of the registered model`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -216,7 +224,7 @@ func newDelete() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the three-level (fully qualified) name of the registered model")
+			return errors.New("expected to have the three-level (fully qualified) name of the registered model")
 		}
 		deleteReq.FullName = args[0]
 
@@ -269,6 +277,8 @@ func newDeleteAlias() *cobra.Command {
     ALIAS: The name of the alias`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -334,6 +344,8 @@ func newGet() *cobra.Command {
     FULL_NAME: The three-level (fully qualified) name of the registered model`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -355,7 +367,7 @@ func newGet() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the three-level (fully qualified) name of the registered model")
+			return errors.New("expected to have the three-level (fully qualified) name of the registered model")
 		}
 		getReq.FullName = args[0]
 
@@ -419,7 +431,7 @@ func newList() *cobra.Command {
   The returned models are filtered based on the privileges of the calling user.
   For example, the metastore admin is able to list all the registered models. A
   regular user needs to be the owner or have the **EXECUTE** privilege on the
-  registered model to recieve the registered models in the response. For the
+  registered model to receive the registered models in the response. For the
   latter case, the caller must also be the owner or have the **USE_CATALOG**
   privilege on the parent catalog and the **USE_SCHEMA** privilege on the parent
   schema.
@@ -432,6 +444,8 @@ func newList() *cobra.Command {
   end of results has been reached.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -500,12 +514,14 @@ func newSetAlias() *cobra.Command {
     VERSION_NUM: The version number of the model version to which the alias points`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(2)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only FULL_NAME, ALIAS as positional arguments. Provide 'version_num' in your JSON input")
+				return errors.New("when --json flag is specified, provide only FULL_NAME, ALIAS as positional arguments. Provide 'version_num' in your JSON input")
 			}
 			return nil
 		}
@@ -578,7 +594,6 @@ func newUpdate() *cobra.Command {
 	cmd.Flags().Var(&updateJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	// TODO: array: aliases
-	cmd.Flags().BoolVar(&updateReq.BrowseOnly, "browse-only", updateReq.BrowseOnly, `Indicates whether the principal is limited to retrieving metadata for the associated object through the BROWSE privilege when include_browse is enabled in the request.`)
 	cmd.Flags().StringVar(&updateReq.CatalogName, "catalog-name", updateReq.CatalogName, `The name of the catalog where the schema and the registered model reside.`)
 	cmd.Flags().StringVar(&updateReq.Comment, "comment", updateReq.Comment, `The comment attached to the registered model.`)
 	cmd.Flags().Int64Var(&updateReq.CreatedAt, "created-at", updateReq.CreatedAt, `Creation timestamp of the registered model in milliseconds since the Unix epoch.`)
@@ -610,6 +625,8 @@ func newUpdate() *cobra.Command {
     FULL_NAME: The three-level (fully qualified) name of the registered model`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -643,7 +660,7 @@ func newUpdate() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the three-level (fully qualified) name of the registered model")
+			return errors.New("expected to have the three-level (fully qualified) name of the registered model")
 		}
 		updateReq.FullName = args[0]
 
diff --git a/cmd/workspace/repos/overrides.go b/cmd/workspace/repos/overrides.go
index 17ef8111ba0..ca10dbd0fb3 100644
--- a/cmd/workspace/repos/overrides.go
+++ b/cmd/workspace/repos/overrides.go
@@ -166,14 +166,13 @@ func repoArgumentToRepoID(ctx context.Context, w *databricks.WorkspaceClient, ar
 		return id, nil
 	}
 
-	// If the argument cannot be parsed as a repo ID, try to look it up by name.
-	oi, err := w.Workspace.GetStatusByPath(ctx, arg) //nolint:staticcheck // Deprecated in SDK v0.127.0. Migration to WorkspaceHierarchyService tracked separately.
+	// Look up the path via get-status. We don't gate on the object type: Git-CLI
+	// folders report DIRECTORY rather than REPO, and the repos API is the
+	// authority on whether the ID resolves to a repo.
+	oi, err := w.Workspace.GetStatusByPath(ctx, arg)
 	if err != nil {
 		return 0, fmt.Errorf("failed to look up repo by path: %w", err)
 	}
-	if oi.ObjectType != workspace.ObjectTypeRepo {
-		return 0, fmt.Errorf("object at path %q is not a repo", arg)
-	}
 	return oi.ObjectId, nil
 }
 
diff --git a/cmd/workspace/repos/repos.go b/cmd/workspace/repos/repos.go
old mode 100755
new mode 100644
index 40e4dacf3a7..ba5d95363fe
--- a/cmd/workspace/repos/repos.go
+++ b/cmd/workspace/repos/repos.go
@@ -3,6 +3,7 @@
 package repos
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -35,6 +36,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -71,6 +76,7 @@ func newCreate() *cobra.Command {
 
 	cmd.Flags().Var(&createJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
+	cmd.Flags().Int64Var(&createReq.GitCredentialId, "git-credential-id", createReq.GitCredentialId, `Git credential ID to use when cloning the repository.`)
 	cmd.Flags().StringVar(&createReq.Path, "path", createReq.Path, `Desired path for the repo in the workspace.`)
 	// TODO: complex arg: sparse_checkout
 
@@ -85,17 +91,20 @@ func newCreate() *cobra.Command {
   Arguments:
     URL: URL of the Git repository to be linked.
     PROVIDER: Git provider. This field is case-insensitive. The available Git providers
-      are gitHub, bitbucketCloud, gitLab, azureDevOpsServices,
-      gitHubEnterprise, bitbucketServer, gitLabEnterpriseEdition and
-      awsCodeCommit.`
+      are gitHub, bitbucketCloud, gitLab, azureDevOpsServices (Azure
+      DevOps Services, including Microsoft Entra ID authentication),
+      gitHubEnterprise, bitbucketServer (Bitbucket Data Center),
+      gitLabEnterpriseEdition (GitLab Self-Managed), and awsCodeCommit.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'url', 'provider' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'url', 'provider' in your JSON input")
 			}
 			return nil
 		}
@@ -171,6 +180,8 @@ func newDelete() *cobra.Command {
     REPO_ID: The ID for the corresponding repo to delete.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -192,7 +203,7 @@ func newDelete() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the id for the corresponding repo to delete")
+			return errors.New("expected to have the id for the corresponding repo to delete")
 		}
 		_, err = fmt.Sscan(args[0], &deleteReq.RepoId)
 		if err != nil {
@@ -242,6 +253,8 @@ func newGet() *cobra.Command {
     REPO_ID: ID of the Git folder (repo) object in the workspace.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -263,7 +276,7 @@ func newGet() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have id of the git folder (repo) object in the workspace")
+			return errors.New("expected to have id of the git folder (repo) object in the workspace")
 		}
 		_, err = fmt.Sscan(args[0], &getReq.RepoId)
 		if err != nil {
@@ -314,6 +327,8 @@ func newGetPermissionLevels() *cobra.Command {
     REPO_ID: The repo for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -335,7 +350,7 @@ func newGetPermissionLevels() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the repo for which to get or manage permissions")
+			return errors.New("expected to have the repo for which to get or manage permissions")
 		}
 		getPermissionLevelsReq.RepoId = args[0]
 
@@ -384,6 +399,8 @@ func newGetPermissions() *cobra.Command {
     REPO_ID: The repo for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -405,7 +422,7 @@ func newGetPermissions() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the repo for which to get or manage permissions")
+			return errors.New("expected to have the repo for which to get or manage permissions")
 		}
 		getPermissionsReq.RepoId = args[0]
 
@@ -461,9 +478,16 @@ func newList() *cobra.Command {
 	cmd.Long = `Get repos.
 
   Returns repos that the calling user has Manage permissions on. Use
-  next_page_token to iterate through additional pages.`
+  next_page_token to iterate through additional pages.
+
+  Deprecated: This operation does not return a complete list of the repos in the
+  workspace, because repos with the Git CLI enabled are not included in its
+  results. Instead, use the Repos and Workspace APIs to find repos and their
+  associated metadata in the workspace.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -529,6 +553,8 @@ func newSetPermissions() *cobra.Command {
     REPO_ID: The repo for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -562,7 +588,7 @@ func newSetPermissions() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the repo for which to get or manage permissions")
+			return errors.New("expected to have the repo for which to get or manage permissions")
 		}
 		setPermissionsReq.RepoId = args[0]
 
@@ -604,6 +630,8 @@ func newUpdate() *cobra.Command {
 	cmd.Flags().Var(&updateJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Flags().StringVar(&updateReq.Branch, "branch", updateReq.Branch, `Branch that the local version of the repo is checked out to.`)
+	cmd.Flags().BoolVar(&updateReq.DangerouslyForceDiscardAll, "dangerously-force-discard-all", updateReq.DangerouslyForceDiscardAll, `WARNING: DESTRUCTIVE AND IRREVERSIBLE.`)
+	cmd.Flags().Int64Var(&updateReq.GitCredentialId, "git-credential-id", updateReq.GitCredentialId, `Git credential ID to use for this update operation.`)
 	// TODO: complex arg: sparse_checkout
 	cmd.Flags().StringVar(&updateReq.Tag, "tag", updateReq.Tag, `Tag that the local version of the repo is checked out to.`)
 
@@ -618,6 +646,8 @@ func newUpdate() *cobra.Command {
     REPO_ID: ID of the Git folder (repo) object in the workspace.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -651,7 +681,7 @@ func newUpdate() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have id of the git folder (repo) object in the workspace")
+			return errors.New("expected to have id of the git folder (repo) object in the workspace")
 		}
 		_, err = fmt.Sscan(args[0], &updateReq.RepoId)
 		if err != nil {
@@ -707,6 +737,8 @@ func newUpdatePermissions() *cobra.Command {
     REPO_ID: The repo for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -740,7 +772,7 @@ func newUpdatePermissions() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the repo for which to get or manage permissions")
+			return errors.New("expected to have the repo for which to get or manage permissions")
 		}
 		updatePermissionsReq.RepoId = args[0]
 
diff --git a/cmd/workspace/resource-quotas/resource-quotas.go b/cmd/workspace/resource-quotas/resource-quotas.go
old mode 100755
new mode 100644
index e5ac51456f4..b58233280e4
--- a/cmd/workspace/resource-quotas/resource-quotas.go
+++ b/cmd/workspace/resource-quotas/resource-quotas.go
@@ -32,6 +32,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newGetQuota())
 	cmd.AddCommand(newListQuotas())
@@ -75,6 +79,8 @@ func newGetQuota() *cobra.Command {
       added as a suffix.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(3)
@@ -151,6 +157,8 @@ func newListQuotas() *cobra.Command {
   end of results has been reached.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
diff --git a/cmd/workspace/restrict-workspace-admins/restrict-workspace-admins.go b/cmd/workspace/restrict-workspace-admins/restrict-workspace-admins.go
old mode 100755
new mode 100644
index d81e8e34f03..ca07a765514
--- a/cmd/workspace/restrict-workspace-admins/restrict-workspace-admins.go
+++ b/cmd/workspace/restrict-workspace-admins/restrict-workspace-admins.go
@@ -3,7 +3,7 @@
 package restrict_workspace_admins
 
 import (
-	"fmt"
+	"errors"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
@@ -20,8 +20,10 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "restrict-workspace-admins",
-		Short: `The Restrict Workspace Admins setting lets you control the capabilities of workspace admins.`,
-		Long: `The Restrict Workspace Admins setting lets you control the capabilities of
+		Short: `*Public Preview* The Restrict Workspace Admins setting lets you control the capabilities of workspace admins.`,
+		Long: `This command is in Public Preview and may change without notice.
+
+The Restrict Workspace Admins setting lets you control the capabilities of
   workspace admins. With the setting status set to ALLOW_ALL, workspace admins
   can create service principal personal access tokens on behalf of any service
   principal in their workspace. Workspace admins can also change a job owner to
@@ -36,6 +38,10 @@ func New() *cobra.Command {
 		RunE: root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
 	// Add methods
 	cmd.AddCommand(newDelete())
 	cmd.AddCommand(newGet())
@@ -66,8 +72,10 @@ func newDelete() *cobra.Command {
 	cmd.Flags().StringVar(&deleteReq.Etag, "etag", deleteReq.Etag, `etag used for versioning.`)
 
 	cmd.Use = "delete"
-	cmd.Short = `Delete the restrict workspace admins setting.`
-	cmd.Long = `Delete the restrict workspace admins setting.
+	cmd.Short = `*Public Preview* Delete the restrict workspace admins setting.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Delete the restrict workspace admins setting.
 
   Reverts the restrict workspace admins setting status for the workspace. A
   fresh etag needs to be provided in DELETE requests (as a query parameter).
@@ -76,6 +84,8 @@ func newDelete() *cobra.Command {
   the request must be retried by using the fresh etag in the 409 response.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -124,12 +134,16 @@ func newGet() *cobra.Command {
 	cmd.Flags().StringVar(&getReq.Etag, "etag", getReq.Etag, `etag used for versioning.`)
 
 	cmd.Use = "get"
-	cmd.Short = `Get the restrict workspace admins setting.`
-	cmd.Long = `Get the restrict workspace admins setting.
+	cmd.Short = `*Public Preview* Get the restrict workspace admins setting.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get the restrict workspace admins setting.
 
   Gets the restrict workspace admins setting.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -179,8 +193,10 @@ func newUpdate() *cobra.Command {
 	cmd.Flags().Var(&updateJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Use = "update"
-	cmd.Short = `Update the restrict workspace admins setting.`
-	cmd.Long = `Update the restrict workspace admins setting.
+	cmd.Short = `*Public Preview* Update the restrict workspace admins setting.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Update the restrict workspace admins setting.
 
   Updates the restrict workspace admins setting for the workspace. A fresh etag
   needs to be provided in PATCH requests (as part of the setting field). The
@@ -189,6 +205,8 @@ func newUpdate() *cobra.Command {
   must be retried by using the fresh etag in the 409 response.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -207,7 +225,7 @@ func newUpdate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := w.Settings.RestrictWorkspaceAdmins().Update(ctx, updateReq)
diff --git a/cmd/workspace/rfa/rfa.go b/cmd/workspace/rfa/rfa.go
old mode 100755
new mode 100644
index 51cd9b25cab..75bfec74dd4
--- a/cmd/workspace/rfa/rfa.go
+++ b/cmd/workspace/rfa/rfa.go
@@ -3,6 +3,7 @@
 package rfa
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -20,8 +21,10 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "rfa",
-		Short: `Request for Access enables users to request access for Unity Catalog securables.`,
-		Long: `Request for Access enables users to request access for Unity Catalog
+		Short: `*Public Preview* Request for Access enables users to request access for Unity Catalog securables.`,
+		Long: `This command is in Public Preview and may change without notice.
+
+Request for Access enables users to request access for Unity Catalog
   securables.
 
   These APIs provide a standardized way for securable owners (or users with
@@ -30,6 +33,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
 	// Add methods
 	cmd.AddCommand(newBatchCreateAccessRequests())
 	cmd.AddCommand(newGetAccessRequestDestinations())
@@ -63,8 +70,10 @@ func newBatchCreateAccessRequests() *cobra.Command {
 	// TODO: array: requests
 
 	cmd.Use = "batch-create-access-requests"
-	cmd.Short = `Create Access Requests.`
-	cmd.Long = `Create Access Requests.
+	cmd.Short = `*Public Preview* Create Access Requests.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Create Access Requests.
 
   Creates access requests for Unity Catalog permissions for a specified
   principal on a securable object. This Batch API can take in multiple
@@ -77,6 +86,8 @@ func newBatchCreateAccessRequests() *cobra.Command {
   "registered_model", and "volume".`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -136,8 +147,10 @@ func newGetAccessRequestDestinations() *cobra.Command {
 	var getAccessRequestDestinationsReq catalog.GetAccessRequestDestinationsRequest
 
 	cmd.Use = "get-access-request-destinations SECURABLE_TYPE FULL_NAME"
-	cmd.Short = `Get Access Request Destinations.`
-	cmd.Long = `Get Access Request Destinations.
+	cmd.Short = `*Public Preview* Get Access Request Destinations.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get Access Request Destinations.
 
   Gets an array of access request destinations for the specified securable. Any
   caller can see URL destinations or the destinations on the metastore.
@@ -153,6 +166,8 @@ func newGetAccessRequestDestinations() *cobra.Command {
     FULL_NAME: The full name of the securable.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -209,18 +224,18 @@ func newUpdateAccessRequestDestinations() *cobra.Command {
 	// TODO: array: destinations
 
 	cmd.Use = "update-access-request-destinations UPDATE_MASK SECURABLE"
-	cmd.Short = `Update Access Request Destinations.`
-	cmd.Long = `Update Access Request Destinations.
+	cmd.Short = `*Public Preview* Update Access Request Destinations.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Update Access Request Destinations.
 
   Updates the access request destinations for the given securable. The caller
   must be a metastore admin, the owner of the securable, or a user that has the
-  **MANAGE** privilege on the securable in order to assign destinations.
-  Destinations cannot be updated for securables underneath schemas (tables,
-  volumes, functions, and models). For these securable types, destinations are
-  inherited from the parent securable. A maximum of 5 emails and 5 external
-  notification destinations (Slack, Microsoft Teams, and Generic Webhook
-  destinations) can be assigned to a securable. If a URL destination is
-  assigned, no other destinations can be set.
+  **MANAGE** privilege on the securable in order to assign destinations. A
+  maximum of 5 emails and 5 external notification destinations (Slack, Microsoft
+  Teams, Generic Webhook, and Databricks App Slack/Teams destinations) can be
+  assigned to a securable. If a URL destination is assigned, no other
+  destinations can be set.
 
   The supported securable types are: "metastore", "catalog", "schema", "table",
   "external_location", "connection", "credential", "function",
@@ -242,12 +257,14 @@ func newUpdateAccessRequestDestinations() *cobra.Command {
       or read.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(1)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only UPDATE_MASK as positional arguments. Provide 'securable' in your JSON input")
+				return errors.New("when --json flag is specified, provide only UPDATE_MASK as positional arguments. Provide 'securable' in your JSON input")
 			}
 			return nil
 		}
diff --git a/cmd/workspace/sandbox/sandbox.go b/cmd/workspace/sandbox/sandbox.go
new file mode 100644
index 00000000000..c5d7d99af41
--- /dev/null
+++ b/cmd/workspace/sandbox/sandbox.go
@@ -0,0 +1,1141 @@
+// Code generated from OpenAPI specs by Databricks SDK Generator. DO NOT EDIT.
+
+package sandbox
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/databricks-sdk-go/common/types/duration"
+	"github.com/databricks/databricks-sdk-go/common/types/fieldmask"
+	"github.com/databricks/databricks-sdk-go/service/sandbox"
+	"github.com/spf13/cobra"
+)
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var cmdOverrides []func(*cobra.Command)
+
+func New() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "sandbox",
+		Short: `*Beta* Create, manage, and control the lifecycle of sandboxes -- isolated, pre-configured, low-latency Serverless compute environments for running code.`,
+		Long: `This command is in Beta and may change without notice.
+
+Create, manage, and control the lifecycle of sandboxes -- isolated,
+  pre-configured, low-latency Serverless compute environments for running code.`,
+		GroupID: "sandbox",
+		RunE:    root.ReportUnknownSubcommand,
+	}
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	// Add methods
+	cmd.AddCommand(newCreateDirectory())
+	cmd.AddCommand(newCreateSandbox())
+	cmd.AddCommand(newDeletePath())
+	cmd.AddCommand(newDeleteSandbox())
+	cmd.AddCommand(newExecuteCommandSync())
+	cmd.AddCommand(newGetMetadata())
+	cmd.AddCommand(newGetSandbox())
+	cmd.AddCommand(newListCommands())
+	cmd.AddCommand(newListDirectoryContents())
+	cmd.AddCommand(newListSandboxes())
+	cmd.AddCommand(newRenamePath())
+	cmd.AddCommand(newStartSandbox())
+	cmd.AddCommand(newStopSandbox())
+	cmd.AddCommand(newUpdateSandbox())
+
+	// Apply optional overrides to this command.
+	for _, fn := range cmdOverrides {
+		fn(cmd)
+	}
+
+	return cmd
+}
+
+// start create-directory command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var createDirectoryOverrides []func(
+	*cobra.Command,
+	*sandbox.CreateDirectoryRequest,
+)
+
+func newCreateDirectory() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var createDirectoryReq sandbox.CreateDirectoryRequest
+	var createDirectoryJson flags.JsonFlag
+
+	cmd.Flags().Var(&createDirectoryJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().BoolVar(&createDirectoryReq.Parents, "parents", createDirectoryReq.Parents, `Defaults to true, which also succeeds when the directory already exists.`)
+
+	cmd.Use = "create-directory PARENT PATH"
+	cmd.Short = `.`
+	cmd.Long = `.
+
+  Creates a directory in a sandbox, including missing parents by default.
+
+  Arguments:
+    PARENT:
+    PATH: Absolute UTF-8 path of the directory.`
+
+	// This command is being previewed; hide from help output.
+	cmd.Hidden = true
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(1)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only PARENT as positional arguments. Provide 'path' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := createDirectoryJson.Unmarshal(&createDirectoryReq)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		createDirectoryReq.Parent = args[0]
+		if !cmd.Flags().Changed("json") {
+			createDirectoryReq.Path = args[1]
+		}
+
+		response, err := w.Sandbox.CreateDirectory(ctx, createDirectoryReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range createDirectoryOverrides {
+		fn(cmd, &createDirectoryReq)
+	}
+
+	return cmd
+}
+
+// start create-sandbox command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var createSandboxOverrides []func(
+	*cobra.Command,
+	*sandbox.CreateSandboxRequest,
+)
+
+func newCreateSandbox() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var createSandboxReq sandbox.CreateSandboxRequest
+	createSandboxReq.Sandbox = sandbox.Sandbox{}
+	var createSandboxJson flags.JsonFlag
+
+	cmd.Flags().Var(&createSandboxJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&createSandboxReq.Sandbox.DisplayName, "display-name", createSandboxReq.Sandbox.DisplayName, `Human-readable display label for the sandbox.`)
+	cmd.Flags().StringVar(&createSandboxReq.Sandbox.Name, "name", createSandboxReq.Sandbox.Name, `The sandbox resource name, in the form sandboxes/{sandbox_id}.`)
+	// TODO: complex arg: spec
+	// TODO: complex arg: status
+
+	cmd.Use = "create-sandbox SANDBOX_ID"
+	cmd.Short = `*Beta* Create a sandbox.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Create a sandbox.
+
+  Creates a new Sandbox.
+
+  Arguments:
+    SANDBOX_ID: Client-supplied ID that becomes the final path segment of the resource
+      name.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := createSandboxJson.Unmarshal(&createSandboxReq.Sandbox)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		createSandboxReq.SandboxId = args[0]
+
+		response, err := w.Sandbox.CreateSandbox(ctx, createSandboxReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range createSandboxOverrides {
+		fn(cmd, &createSandboxReq)
+	}
+
+	return cmd
+}
+
+// start delete-path command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deletePathOverrides []func(
+	*cobra.Command,
+	*sandbox.DeletePathRequest,
+)
+
+func newDeletePath() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deletePathReq sandbox.DeletePathRequest
+	var deletePathJson flags.JsonFlag
+
+	cmd.Flags().Var(&deletePathJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().BoolVar(&deletePathReq.Recursive, "recursive", deletePathReq.Recursive, `Required for a non-empty directory.`)
+
+	cmd.Use = "delete-path PARENT PATH"
+	cmd.Short = `.`
+	cmd.Long = `.
+
+  Deletes a file, symlink, or empty directory, with an option for recursive
+  deletion. Succeeds if the path is already absent.
+
+  Arguments:
+    PARENT:
+    PATH: Absolute UTF-8 path of the entry to delete.`
+
+	// This command is being previewed; hide from help output.
+	cmd.Hidden = true
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(1)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only PARENT as positional arguments. Provide 'path' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := deletePathJson.Unmarshal(&deletePathReq)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		deletePathReq.Parent = args[0]
+		if !cmd.Flags().Changed("json") {
+			deletePathReq.Path = args[1]
+		}
+
+		response, err := w.Sandbox.DeletePath(ctx, deletePathReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deletePathOverrides {
+		fn(cmd, &deletePathReq)
+	}
+
+	return cmd
+}
+
+// start delete-sandbox command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteSandboxOverrides []func(
+	*cobra.Command,
+	*sandbox.DeleteSandboxRequest,
+)
+
+func newDeleteSandbox() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteSandboxReq sandbox.DeleteSandboxRequest
+
+	cmd.Use = "delete-sandbox NAME"
+	cmd.Short = `*Beta* Delete a sandbox.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Delete a sandbox.
+
+  Deletes a Sandbox.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		deleteSandboxReq.Name = args[0]
+
+		err = w.Sandbox.DeleteSandbox(ctx, deleteSandboxReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteSandboxOverrides {
+		fn(cmd, &deleteSandboxReq)
+	}
+
+	return cmd
+}
+
+// start execute-command-sync command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var executeCommandSyncOverrides []func(
+	*cobra.Command,
+	*sandbox.ExecuteCommandSyncRequest,
+)
+
+func newExecuteCommandSync() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var executeCommandSyncReq sandbox.ExecuteCommandSyncRequest
+	var executeCommandSyncJson flags.JsonFlag
+
+	cmd.Flags().Var(&executeCommandSyncJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: args
+	// TODO: map via StringToStringVar: envs
+	var executionTimeoutParam string
+	cmd.Flags().StringVar(&executionTimeoutParam, "execution-timeout", executionTimeoutParam, `Maximum time to wait for the command to finish.`)
+
+	cmd.Use = "execute-command-sync NAME CMD"
+	cmd.Short = `*Beta* Run a command in a sandbox and wait for its result.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Run a command in a sandbox and wait for its result.
+
+  Runs a command in the sandbox and blocks until it exits, returning the
+  captured stdout, stderr and exit code in a single response.
+
+  Arguments:
+    NAME: Resource name of the sandbox to run the command in, in the form
+      sandboxes/{sandbox_id}. Bound from the URL path.
+    CMD: Executable or command to run (e.g. /bin/echo, python3).`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(1)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only NAME as positional arguments. Provide 'cmd' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := executeCommandSyncJson.Unmarshal(&executeCommandSyncReq)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		executeCommandSyncReq.Name = args[0]
+		if !cmd.Flags().Changed("json") {
+			executeCommandSyncReq.Cmd = args[1]
+		}
+
+		if executionTimeoutParam != "" {
+			executionTimeoutBytes := []byte(fmt.Sprintf("\"%s\"", executionTimeoutParam))
+			var executionTimeoutField duration.Duration
+			err = json.Unmarshal(executionTimeoutBytes, &executionTimeoutField)
+			if err != nil {
+				return fmt.Errorf("invalid EXECUTION_TIMEOUT: %s", executionTimeoutParam)
+			}
+			executeCommandSyncReq.ExecutionTimeout = &executionTimeoutField
+		}
+
+		response, err := w.Sandbox.ExecuteCommandSync(ctx, executeCommandSyncReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range executeCommandSyncOverrides {
+		fn(cmd, &executeCommandSyncReq)
+	}
+
+	return cmd
+}
+
+// start get-metadata command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getMetadataOverrides []func(
+	*cobra.Command,
+	*sandbox.GetMetadataRequest,
+)
+
+func newGetMetadata() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getMetadataReq sandbox.GetMetadataRequest
+
+	cmd.Use = "get-metadata PARENT PATH"
+	cmd.Short = `.`
+	cmd.Long = `.
+
+  Returns metadata for a path without following its final symlink.
+
+  Arguments:
+    PARENT:
+    PATH: Absolute UTF-8 path of the entry to inspect.`
+
+	// This command is being previewed; hide from help output.
+	cmd.Hidden = true
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getMetadataReq.Parent = args[0]
+		getMetadataReq.Path = args[1]
+
+		response, err := w.Sandbox.GetMetadata(ctx, getMetadataReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getMetadataOverrides {
+		fn(cmd, &getMetadataReq)
+	}
+
+	return cmd
+}
+
+// start get-sandbox command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getSandboxOverrides []func(
+	*cobra.Command,
+	*sandbox.GetSandboxRequest,
+)
+
+func newGetSandbox() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getSandboxReq sandbox.GetSandboxRequest
+
+	cmd.Use = "get-sandbox NAME"
+	cmd.Short = `*Beta* Get a sandbox.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get a sandbox.
+
+  Retrieves a Sandbox by name.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getSandboxReq.Name = args[0]
+
+		response, err := w.Sandbox.GetSandbox(ctx, getSandboxReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getSandboxOverrides {
+		fn(cmd, &getSandboxReq)
+	}
+
+	return cmd
+}
+
+// start list-commands command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listCommandsOverrides []func(
+	*cobra.Command,
+	*sandbox.ListCommandsRequest,
+)
+
+func newListCommands() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listCommandsReq sandbox.ListCommandsRequest
+
+	cmd.Flags().IntVar(&listCommandsReq.PageSize, "page-size", listCommandsReq.PageSize, `Maximum number of commands to return.`)
+	cmd.Flags().StringVar(&listCommandsReq.PageToken, "page-token", listCommandsReq.PageToken, `Page token returned by a previous ListCommands call.`)
+
+	cmd.Use = "list-commands PARENT"
+	cmd.Short = `*Beta* List the tracked command executions in a sandbox.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+List the tracked command executions in a sandbox.
+
+  Lists the tracked command executions (running and completed) in a sandbox.
+
+  Arguments:
+    PARENT: The sandbox whose commands to list, in the form sandboxes/{sandbox_id}.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		listCommandsReq.Parent = args[0]
+
+		response, err := w.Sandbox.ListCommands(ctx, listCommandsReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listCommandsOverrides {
+		fn(cmd, &listCommandsReq)
+	}
+
+	return cmd
+}
+
+// start list-directory-contents command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listDirectoryContentsOverrides []func(
+	*cobra.Command,
+	*sandbox.ListDirectoryContentsRequest,
+)
+
+func newListDirectoryContents() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listDirectoryContentsReq sandbox.ListDirectoryContentsRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listDirectoryContentsLimit int
+
+	cmd.Flags().IntVar(&listDirectoryContentsReq.PageSize, "page-size", listDirectoryContentsReq.PageSize, `Zero uses the default of 1000; values above 1000 are clamped to 1000.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listDirectoryContentsLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listDirectoryContentsReq.PageToken, "page-token", listDirectoryContentsReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-directory-contents PARENT PATH"
+	cmd.Short = `.`
+	cmd.Long = `.
+
+  Lists a directory's immediate children in UTF-8 name order. Later pages may
+  reflect concurrent changes.
+
+  Arguments:
+    PARENT:
+    PATH: Absolute UTF-8 path of the directory.`
+
+	// This command is being previewed; hide from help output.
+	cmd.Hidden = true
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		listDirectoryContentsReq.Parent = args[0]
+		listDirectoryContentsReq.Path = args[1]
+
+		response := w.Sandbox.ListDirectoryContents(ctx, listDirectoryContentsReq)
+		if listDirectoryContentsLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listDirectoryContentsLimit)
+		}
+		if listDirectoryContentsLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listDirectoryContentsLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listDirectoryContentsOverrides {
+		fn(cmd, &listDirectoryContentsReq)
+	}
+
+	return cmd
+}
+
+// start list-sandboxes command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listSandboxesOverrides []func(
+	*cobra.Command,
+	*sandbox.ListSandboxesRequest,
+)
+
+func newListSandboxes() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listSandboxesReq sandbox.ListSandboxesRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listSandboxesLimit int
+
+	cmd.Flags().IntVar(&listSandboxesReq.PageSize, "page-size", listSandboxesReq.PageSize, ``)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listSandboxesLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listSandboxesReq.PageToken, "page-token", listSandboxesReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-sandboxes"
+	cmd.Short = `*Beta* List sandboxes.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+List sandboxes.
+
+  Lists all Sandboxes.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(0)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		response := w.Sandbox.ListSandboxes(ctx, listSandboxesReq)
+		if listSandboxesLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listSandboxesLimit)
+		}
+		if listSandboxesLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listSandboxesLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listSandboxesOverrides {
+		fn(cmd, &listSandboxesReq)
+	}
+
+	return cmd
+}
+
+// start rename-path command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var renamePathOverrides []func(
+	*cobra.Command,
+	*sandbox.RenamePathRequest,
+)
+
+func newRenamePath() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var renamePathReq sandbox.RenamePathRequest
+	var renamePathJson flags.JsonFlag
+
+	cmd.Flags().Var(&renamePathJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Use = "rename-path PARENT SOURCE DESTINATION"
+	cmd.Short = `.`
+	cmd.Long = `.
+
+  Renames a path within a sandbox. The destination must be absent and on the
+  same filesystem.
+
+  Arguments:
+    PARENT: Sandbox resource name, for example sandboxes/my-sandbox.
+    SOURCE: Absolute UTF-8 path to move.
+    DESTINATION: Exact absolute UTF-8 destination; it must not already exist.`
+
+	// This command is being previewed; hide from help output.
+	cmd.Hidden = true
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(1)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only PARENT as positional arguments. Provide 'source', 'destination' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(3)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := renamePathJson.Unmarshal(&renamePathReq)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		renamePathReq.Parent = args[0]
+		if !cmd.Flags().Changed("json") {
+			renamePathReq.Source = args[1]
+		}
+		if !cmd.Flags().Changed("json") {
+			renamePathReq.Destination = args[2]
+		}
+
+		response, err := w.Sandbox.RenamePath(ctx, renamePathReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range renamePathOverrides {
+		fn(cmd, &renamePathReq)
+	}
+
+	return cmd
+}
+
+// start start-sandbox command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var startSandboxOverrides []func(
+	*cobra.Command,
+	*sandbox.StartSandboxRequest,
+)
+
+func newStartSandbox() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var startSandboxReq sandbox.StartSandboxRequest
+
+	cmd.Use = "start-sandbox NAME"
+	cmd.Short = `*Beta* Start a sandbox.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Start a sandbox.
+
+  Starts a previously stopped Sandbox under the same sandbox name. Returns
+  NOT_FOUND if there is no stopped sandbox to start for the given name.
+
+  Arguments:
+    NAME: Resource name of the sandbox to start, in the form
+      sandboxes/{sandbox_id}.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		startSandboxReq.Name = args[0]
+
+		response, err := w.Sandbox.StartSandbox(ctx, startSandboxReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range startSandboxOverrides {
+		fn(cmd, &startSandboxReq)
+	}
+
+	return cmd
+}
+
+// start stop-sandbox command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var stopSandboxOverrides []func(
+	*cobra.Command,
+	*sandbox.StopSandboxRequest,
+)
+
+func newStopSandbox() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var stopSandboxReq sandbox.StopSandboxRequest
+
+	cmd.Use = "stop-sandbox NAME"
+	cmd.Short = `*Beta* Stop a sandbox.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Stop a sandbox.
+
+  Stops a running Sandbox, preserving it so it can later be restarted with a
+  Start request.
+
+  Arguments:
+    NAME: Resource name of the sandbox to stop, in the form
+      sandboxes/{sandbox_id}.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		stopSandboxReq.Name = args[0]
+
+		response, err := w.Sandbox.StopSandbox(ctx, stopSandboxReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range stopSandboxOverrides {
+		fn(cmd, &stopSandboxReq)
+	}
+
+	return cmd
+}
+
+// start update-sandbox command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateSandboxOverrides []func(
+	*cobra.Command,
+	*sandbox.UpdateSandboxRequest,
+)
+
+func newUpdateSandbox() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateSandboxReq sandbox.UpdateSandboxRequest
+	updateSandboxReq.Sandbox = sandbox.Sandbox{}
+	var updateSandboxJson flags.JsonFlag
+
+	cmd.Flags().Var(&updateSandboxJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&updateSandboxReq.Sandbox.DisplayName, "display-name", updateSandboxReq.Sandbox.DisplayName, `Human-readable display label for the sandbox.`)
+	cmd.Flags().StringVar(&updateSandboxReq.Sandbox.Name, "name", updateSandboxReq.Sandbox.Name, `The sandbox resource name, in the form sandboxes/{sandbox_id}.`)
+	// TODO: complex arg: spec
+	// TODO: complex arg: status
+
+	cmd.Use = "update-sandbox NAME UPDATE_MASK"
+	cmd.Short = `*Beta* Update a sandbox.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Update a sandbox.
+
+  Updates mutable fields on an existing Sandbox. Allowlisted update_mask paths
+  today: display_name, spec.compute.inactivity_timeout. Returns
+  INVALID_PARAMETER_VALUE for empty masks or unknown paths; NOT_FOUND if the
+  sandbox does not exist.
+
+  Arguments:
+    NAME: Resource name of the sandbox to update, in the form
+      sandboxes/{sandbox_id}.
+    UPDATE_MASK: Field paths to update. Must be a non-empty subset of: - display_name -
+      spec.compute.inactivity_timeout Any other path returns
+      INVALID_PARAMETER_VALUE.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updateSandboxJson.Unmarshal(&updateSandboxReq.Sandbox)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		updateSandboxReq.Name = args[0]
+		if args[1] != "" {
+			updateMaskArray := strings.Split(args[1], ",")
+			updateSandboxReq.UpdateMask = *fieldmask.New(updateMaskArray)
+		}
+
+		response, err := w.Sandbox.UpdateSandbox(ctx, updateSandboxReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateSandboxOverrides {
+		fn(cmd, &updateSandboxReq)
+	}
+
+	return cmd
+}
+
+// end service Sandbox
diff --git a/cmd/workspace/schemas/schemas.go b/cmd/workspace/schemas/schemas.go
old mode 100755
new mode 100644
index dcc49042d12..709452cd3a9
--- a/cmd/workspace/schemas/schemas.go
+++ b/cmd/workspace/schemas/schemas.go
@@ -3,6 +3,7 @@
 package schemas
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -22,7 +23,7 @@ func New() *cobra.Command {
 		Use:   "schemas",
 		Short: `A schema (also called a database) is the second layer of Unity Catalog’s three-level namespace.`,
 		Long: `A schema (also called a database) is the second layer of Unity Catalog’s
-  three-level namespace. A schema organizes tables, views and functions. To
+  three-level namespace. A schema organizes tables, views, and functions. To
   access (or list) a table or view in a schema, users must have the USE_SCHEMA
   data permission on the schema and its parent catalog, and they must have the
   SELECT permission on the table or view.`,
@@ -30,6 +31,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -63,6 +68,7 @@ func newCreate() *cobra.Command {
 	cmd.Flags().Var(&createJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Flags().StringVar(&createReq.Comment, "comment", createReq.Comment, `User-provided free-form text description.`)
+	cmd.Flags().Int64Var(&createReq.CustomMaxRetentionHours, "custom-max-retention-hours", createReq.CustomMaxRetentionHours, `Custom maximum retention period in hours for the schema.`)
 	// TODO: map via StringToStringVar: properties
 	cmd.Flags().StringVar(&createReq.StorageRoot, "storage-root", createReq.StorageRoot, `Storage root URL for managed tables within schema.`)
 
@@ -79,12 +85,14 @@ func newCreate() *cobra.Command {
     CATALOG_NAME: Name of parent catalog.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'catalog_name' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'catalog_name' in your JSON input")
 			}
 			return nil
 		}
@@ -163,6 +171,8 @@ func newDelete() *cobra.Command {
     FULL_NAME: Full name of the schema.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -223,6 +233,8 @@ func newGet() *cobra.Command {
     FULL_NAME: Full name of the schema.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -307,6 +319,8 @@ func newList() *cobra.Command {
     CATALOG_NAME: Parent catalog for schemas of interest.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -361,6 +375,7 @@ func newUpdate() *cobra.Command {
 	cmd.Flags().Var(&updateJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Flags().StringVar(&updateReq.Comment, "comment", updateReq.Comment, `User-provided free-form text description.`)
+	cmd.Flags().Int64Var(&updateReq.CustomMaxRetentionHours, "custom-max-retention-hours", updateReq.CustomMaxRetentionHours, `Custom maximum retention period in hours for the schema.`)
 	cmd.Flags().Var(&updateReq.EnablePredictiveOptimization, "enable-predictive-optimization", `Whether predictive optimization should be enabled for this object and objects under it. Supported values: [DISABLE, ENABLE, INHERIT]`)
 	cmd.Flags().StringVar(&updateReq.NewName, "new-name", updateReq.NewName, `New name for the schema.`)
 	cmd.Flags().StringVar(&updateReq.Owner, "owner", updateReq.Owner, `Username of current owner of schema.`)
@@ -380,6 +395,8 @@ func newUpdate() *cobra.Command {
     FULL_NAME: Full name of the schema.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/workspace/secrets-uc/secrets-uc.go b/cmd/workspace/secrets-uc/secrets-uc.go
new file mode 100644
index 00000000000..d2609bc1d86
--- /dev/null
+++ b/cmd/workspace/secrets-uc/secrets-uc.go
@@ -0,0 +1,524 @@
+// Code generated from OpenAPI specs by Databricks SDK Generator. DO NOT EDIT.
+
+package secrets_uc
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/databricks-sdk-go/common/types/fieldmask"
+	sdktime "github.com/databricks/databricks-sdk-go/common/types/time"
+	"github.com/databricks/databricks-sdk-go/service/catalog"
+	"github.com/spf13/cobra"
+)
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var cmdOverrides []func(*cobra.Command)
+
+func New() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "secrets-uc",
+		Short: `A secret is a Unity Catalog securable object that stores sensitive credential data (such as passwords, tokens, and keys) within a three-level namespace (**catalog_name.schema_name.secret_name**).`,
+		Long: `A secret is a Unity Catalog securable object that stores sensitive credential
+  data (such as passwords, tokens, and keys) within a three-level namespace
+  (**catalog_name.schema_name.secret_name**).
+
+  Secrets can be managed using standard Unity Catalog permissions and are scoped
+  to a schema within a catalog.`,
+		GroupID: "catalog",
+		RunE:    root.ReportUnknownSubcommand,
+	}
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	// Add methods
+	cmd.AddCommand(newCreateSecret())
+	cmd.AddCommand(newDeleteSecret())
+	cmd.AddCommand(newGetSecret())
+	cmd.AddCommand(newListSecrets())
+	cmd.AddCommand(newUpdateSecret())
+
+	// Apply optional overrides to this command.
+	for _, fn := range cmdOverrides {
+		fn(cmd)
+	}
+
+	return cmd
+}
+
+// start create-secret command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var createSecretOverrides []func(
+	*cobra.Command,
+	*catalog.CreateSecretRequest,
+)
+
+func newCreateSecret() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var createSecretReq catalog.CreateSecretRequest
+	createSecretReq.Secret = catalog.Secret{}
+	var createSecretJson flags.JsonFlag
+
+	cmd.Flags().Var(&createSecretJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&createSecretReq.Secret.Comment, "comment", createSecretReq.Secret.Comment, `User-provided free-form text description of the secret.`)
+	var expireTimeParam string
+	cmd.Flags().StringVar(&expireTimeParam, "expire-time", expireTimeParam, `User-provided expiration time of the secret.`)
+	cmd.Flags().StringVar(&createSecretReq.Secret.Owner, "owner", createSecretReq.Secret.Owner, `The owner of the secret.`)
+
+	cmd.Use = "create-secret NAME CATALOG_NAME SCHEMA_NAME VALUE"
+	cmd.Short = `Create a secret.`
+	cmd.Long = `Create a secret.
+
+  Creates a new secret in Unity Catalog.
+
+  You must be the owner of the parent schema or have the **CREATE_SECRET** and
+  **USE SCHEMA** privileges on the parent schema and **USE CATALOG** on the
+  parent catalog.
+
+  The secret is stored in the specified catalog and schema, and the **value**
+  field contains the sensitive data to be securely stored.
+
+  Arguments:
+    NAME: The name of the secret, relative to its parent schema.
+    CATALOG_NAME: The name of the catalog where the schema and the secret reside.
+    SCHEMA_NAME: The name of the schema where the secret resides.
+    VALUE: The secret value to store. This field is input-only and is not returned in
+      responses — use the **effective_value** field (via GetSecret with
+      **include_value** set to true) to read the secret value. The maximum size
+      is 60 KiB (pre-encryption). Accepted content includes passwords, tokens,
+      keys, and other sensitive credential data.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(0)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'catalog_name', 'schema_name', 'value' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(4)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := createSecretJson.Unmarshal(&createSecretReq.Secret)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		if !cmd.Flags().Changed("json") {
+			createSecretReq.Secret.Name = args[0]
+		}
+		if !cmd.Flags().Changed("json") {
+			createSecretReq.Secret.CatalogName = args[1]
+		}
+		if !cmd.Flags().Changed("json") {
+			createSecretReq.Secret.SchemaName = args[2]
+		}
+		if !cmd.Flags().Changed("json") {
+			createSecretReq.Secret.Value = args[3]
+		}
+
+		if expireTimeParam != "" {
+			expireTimeBytes := []byte(fmt.Sprintf("\"%s\"", expireTimeParam))
+			var expireTimeField sdktime.Time
+			err = json.Unmarshal(expireTimeBytes, &expireTimeField)
+			if err != nil {
+				return fmt.Errorf("invalid EXPIRE_TIME: %s", expireTimeParam)
+			}
+			createSecretReq.Secret.ExpireTime = &expireTimeField
+		}
+
+		response, err := w.SecretsUc.CreateSecret(ctx, createSecretReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range createSecretOverrides {
+		fn(cmd, &createSecretReq)
+	}
+
+	return cmd
+}
+
+// start delete-secret command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteSecretOverrides []func(
+	*cobra.Command,
+	*catalog.DeleteSecretRequest,
+)
+
+func newDeleteSecret() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteSecretReq catalog.DeleteSecretRequest
+
+	cmd.Use = "delete-secret FULL_NAME"
+	cmd.Short = `Delete a secret.`
+	cmd.Long = `Delete a secret.
+
+  Deletes a secret by its three-level (fully qualified) name.
+
+  You must be the owner of the secret or a metastore admin.
+
+  Arguments:
+    FULL_NAME: The three-level (fully qualified) name of the secret (for example,
+      **catalog_name.schema_name.secret_name**).`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		deleteSecretReq.FullName = args[0]
+
+		err = w.SecretsUc.DeleteSecret(ctx, deleteSecretReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteSecretOverrides {
+		fn(cmd, &deleteSecretReq)
+	}
+
+	return cmd
+}
+
+// start get-secret command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getSecretOverrides []func(
+	*cobra.Command,
+	*catalog.GetSecretRequest,
+)
+
+func newGetSecret() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getSecretReq catalog.GetSecretRequest
+
+	cmd.Flags().BoolVar(&getSecretReq.IncludeValue, "include-value", getSecretReq.IncludeValue, `Whether to include the secret value in the response.`)
+
+	cmd.Use = "get-secret FULL_NAME"
+	cmd.Short = `Get a secret.`
+	cmd.Long = `Get a secret.
+
+  Gets a secret by its three-level (fully qualified) name.
+
+  You must be a metastore admin, the owner of the secret, or have the **MANAGE**
+  privilege on the secret.
+
+  The secret value isn't returned by default. To retrieve it, you must also have
+  the **READ_SECRET** privilege and set **include_value** to true in the
+  request.
+
+  Arguments:
+    FULL_NAME: The three-level (fully qualified) name of the secret (for example,
+      **catalog_name.schema_name.secret_name**).`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getSecretReq.FullName = args[0]
+
+		response, err := w.SecretsUc.GetSecret(ctx, getSecretReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getSecretOverrides {
+		fn(cmd, &getSecretReq)
+	}
+
+	return cmd
+}
+
+// start list-secrets command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listSecretsOverrides []func(
+	*cobra.Command,
+	*catalog.ListSecretsRequest,
+)
+
+func newListSecrets() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listSecretsReq catalog.ListSecretsRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listSecretsLimit int
+
+	cmd.Flags().StringVar(&listSecretsReq.CatalogName, "catalog-name", listSecretsReq.CatalogName, `The name of the catalog under which to list secrets.`)
+	cmd.Flags().IntVar(&listSecretsReq.PageSize, "page-size", listSecretsReq.PageSize, `Maximum number of secrets to return.`)
+	cmd.Flags().StringVar(&listSecretsReq.SchemaName, "schema-name", listSecretsReq.SchemaName, `The name of the schema under which to list secrets.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listSecretsLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listSecretsReq.PageToken, "page-token", listSecretsReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-secrets"
+	cmd.Short = `List secrets.`
+	cmd.Long = `List secrets.
+
+  Lists secrets in Unity Catalog.
+
+  You must be a metastore admin, the owner of the secret, or have the **MANAGE**
+  privilege on the secret.
+
+  Both **catalog_name** and **schema_name** must be specified together to filter
+  secrets within a specific schema. Results are paginated; use the
+  **page_token** field from the response to retrieve subsequent pages.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(0)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		response := w.SecretsUc.ListSecrets(ctx, listSecretsReq)
+		if listSecretsLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listSecretsLimit)
+		}
+		if listSecretsLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listSecretsLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listSecretsOverrides {
+		fn(cmd, &listSecretsReq)
+	}
+
+	return cmd
+}
+
+// start update-secret command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateSecretOverrides []func(
+	*cobra.Command,
+	*catalog.UpdateSecretRequest,
+)
+
+func newUpdateSecret() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateSecretReq catalog.UpdateSecretRequest
+	updateSecretReq.Secret = catalog.Secret{}
+	var updateSecretJson flags.JsonFlag
+
+	cmd.Flags().Var(&updateSecretJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&updateSecretReq.Secret.Comment, "comment", updateSecretReq.Secret.Comment, `User-provided free-form text description of the secret.`)
+	var expireTimeParam string
+	cmd.Flags().StringVar(&expireTimeParam, "expire-time", expireTimeParam, `User-provided expiration time of the secret.`)
+	cmd.Flags().StringVar(&updateSecretReq.Secret.Owner, "owner", updateSecretReq.Secret.Owner, `The owner of the secret.`)
+
+	cmd.Use = "update-secret FULL_NAME UPDATE_MASK NAME CATALOG_NAME SCHEMA_NAME VALUE"
+	cmd.Short = `Update a secret.`
+	cmd.Long = `Update a secret.
+
+  Updates an existing secret in Unity Catalog.
+
+  You must be the owner of the secret or a metastore admin. If you are a
+  metastore admin, only the **owner** field can be changed.
+
+  Use the **update_mask** field to specify which fields to update. Supported
+  updatable fields include **value**, **comment**, **owner**, and
+  **expire_time**.
+
+  Arguments:
+    FULL_NAME: The three-level (fully qualified) name of the secret (for example,
+      **catalog_name.schema_name.secret_name**).
+    UPDATE_MASK: The field mask specifying which fields of the secret to update. - If
+      **update_mask** is **"*"**, all fields specified in **secret** are
+      updated. - If **update_mask** specifies one or more fields, only those
+      fields are updated. Each specified field must be set in **secret**.
+      Supported fields: **value**, **comment**, **owner**, **expire_time**. To
+      change the secret name, delete and recreate the secret.
+    NAME: The name of the secret, relative to its parent schema.
+    CATALOG_NAME: The name of the catalog where the schema and the secret reside.
+    SCHEMA_NAME: The name of the schema where the secret resides.
+    VALUE: The secret value to store. This field is input-only and is not returned in
+      responses — use the **effective_value** field (via GetSecret with
+      **include_value** set to true) to read the secret value. The maximum size
+      is 60 KiB (pre-encryption). Accepted content includes passwords, tokens,
+      keys, and other sensitive credential data.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(2)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only FULL_NAME, UPDATE_MASK as positional arguments. Provide 'name', 'catalog_name', 'schema_name', 'value' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(6)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updateSecretJson.Unmarshal(&updateSecretReq.Secret)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		updateSecretReq.FullName = args[0]
+		if args[1] != "" {
+			updateMaskArray := strings.Split(args[1], ",")
+			updateSecretReq.UpdateMask = *fieldmask.New(updateMaskArray)
+		}
+		if !cmd.Flags().Changed("json") {
+			updateSecretReq.Secret.Name = args[2]
+		}
+		if !cmd.Flags().Changed("json") {
+			updateSecretReq.Secret.CatalogName = args[3]
+		}
+		if !cmd.Flags().Changed("json") {
+			updateSecretReq.Secret.SchemaName = args[4]
+		}
+		if !cmd.Flags().Changed("json") {
+			updateSecretReq.Secret.Value = args[5]
+		}
+
+		if expireTimeParam != "" {
+			expireTimeBytes := []byte(fmt.Sprintf("\"%s\"", expireTimeParam))
+			var expireTimeField sdktime.Time
+			err = json.Unmarshal(expireTimeBytes, &expireTimeField)
+			if err != nil {
+				return fmt.Errorf("invalid EXPIRE_TIME: %s", expireTimeParam)
+			}
+			updateSecretReq.Secret.ExpireTime = &expireTimeField
+		}
+
+		response, err := w.SecretsUc.UpdateSecret(ctx, updateSecretReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateSecretOverrides {
+		fn(cmd, &updateSecretReq)
+	}
+
+	return cmd
+}
+
+// end service SecretsUc
diff --git a/cmd/workspace/secrets/secrets.go b/cmd/workspace/secrets/secrets.go
old mode 100755
new mode 100644
index 0edd4f049f2..e3268ccfe6e
--- a/cmd/workspace/secrets/secrets.go
+++ b/cmd/workspace/secrets/secrets.go
@@ -3,6 +3,7 @@
 package secrets
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -37,6 +38,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreateScope())
 	cmd.AddCommand(newDeleteAcl())
@@ -124,12 +129,14 @@ func newCreateScope() *cobra.Command {
     SCOPE: Scope name requested by the user. Scope names are unique.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'scope' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'scope' in your JSON input")
 			}
 			return nil
 		}
@@ -218,12 +225,14 @@ func newDeleteAcl() *cobra.Command {
     PRINCIPAL: The principal to remove an existing ACL from.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'scope', 'principal' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'scope', 'principal' in your JSON input")
 			}
 			return nil
 		}
@@ -312,12 +321,14 @@ func newDeleteScope() *cobra.Command {
     SCOPE: Name of the scope to delete.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'scope' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'scope' in your JSON input")
 			}
 			return nil
 		}
@@ -405,12 +416,14 @@ func newDeleteSecret() *cobra.Command {
     KEY: Name of the secret to delete.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'scope', 'key' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'scope', 'key' in your JSON input")
 			}
 			return nil
 		}
@@ -499,6 +512,8 @@ func newGetAcl() *cobra.Command {
     PRINCIPAL: The principal to fetch ACL information for.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -584,6 +599,8 @@ func newGetSecret() *cobra.Command {
     KEY: Name of the secret to fetch value information.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -664,6 +681,8 @@ func newListAcls() *cobra.Command {
     SCOPE: The name of the scope to fetch ACL information from.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -737,6 +756,8 @@ func newListScopes() *cobra.Command {
   API call.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -814,6 +835,8 @@ func newListSecrets() *cobra.Command {
     SCOPE: The name of the scope to list secrets within.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -912,12 +935,14 @@ func newPutAcl() *cobra.Command {
       Supported values: [MANAGE, READ, WRITE]`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'scope', 'principal', 'permission' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'scope', 'principal', 'permission' in your JSON input")
 			}
 			return nil
 		}
diff --git a/cmd/workspace/service-principal-secrets-proxy/service-principal-secrets-proxy.go b/cmd/workspace/service-principal-secrets-proxy/service-principal-secrets-proxy.go
old mode 100755
new mode 100644
index f556a26644c..38f75b98bef
--- a/cmd/workspace/service-principal-secrets-proxy/service-principal-secrets-proxy.go
+++ b/cmd/workspace/service-principal-secrets-proxy/service-principal-secrets-proxy.go
@@ -40,6 +40,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -71,6 +75,7 @@ func newCreate() *cobra.Command {
 	cmd.Flags().Var(&createJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Flags().StringVar(&createReq.Lifetime, "lifetime", createReq.Lifetime, `The lifetime of the secret in seconds.`)
+	// TODO: array: scopes
 
 	cmd.Use = "create SERVICE_PRINCIPAL_ID"
 	cmd.Short = `Create service principal secret.`
@@ -82,6 +87,8 @@ func newCreate() *cobra.Command {
     SERVICE_PRINCIPAL_ID: The service principal ID.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -152,6 +159,8 @@ func newDelete() *cobra.Command {
     SECRET_ID: The secret ID.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -224,6 +233,8 @@ func newList() *cobra.Command {
     SERVICE_PRINCIPAL_ID: The service principal ID.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/workspace/service-principals-v2/service-principals-v2.go b/cmd/workspace/service-principals-v2/service-principals-v2.go
old mode 100755
new mode 100644
index 6e23e348923..2bce2b79cbf
--- a/cmd/workspace/service-principals-v2/service-principals-v2.go
+++ b/cmd/workspace/service-principals-v2/service-principals-v2.go
@@ -20,8 +20,10 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "service-principals-v2",
-		Short: `Identities for use with jobs, automated tools, and systems such as scripts, apps, and CI/CD platforms.`,
-		Long: `Identities for use with jobs, automated tools, and systems such as scripts,
+		Short: `*Public Preview* Identities for use with jobs, automated tools, and systems such as scripts, apps, and CI/CD platforms.`,
+		Long: `This command is in Public Preview and may change without notice.
+
+Identities for use with jobs, automated tools, and systems such as scripts,
   apps, and CI/CD platforms. Databricks recommends creating service principals
   to run production jobs or modify production data. If all processes that act on
   production data run with service principals, interactive users do not need any
@@ -31,6 +33,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -75,12 +81,16 @@ func newCreate() *cobra.Command {
 	// TODO: array: schemas
 
 	cmd.Use = "create"
-	cmd.Short = `Create a service principal.`
-	cmd.Long = `Create a service principal.
+	cmd.Short = `*Public Preview* Create a service principal.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Create a service principal.
 
   Creates a new service principal in the Databricks workspace.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -140,8 +150,10 @@ func newDelete() *cobra.Command {
 	var deleteReq iam.DeleteServicePrincipalRequest
 
 	cmd.Use = "delete ID"
-	cmd.Short = `Delete a service principal.`
-	cmd.Long = `Delete a service principal.
+	cmd.Short = `*Public Preview* Delete a service principal.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Delete a service principal.
 
   Delete a single service principal in the Databricks workspace.
 
@@ -149,6 +161,8 @@ func newDelete() *cobra.Command {
     ID: Unique ID for a service principal in the Databricks workspace.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -196,8 +210,10 @@ func newGet() *cobra.Command {
 	var getReq iam.GetServicePrincipalRequest
 
 	cmd.Use = "get ID"
-	cmd.Short = `Get service principal details.`
-	cmd.Long = `Get service principal details.
+	cmd.Short = `*Public Preview* Get service principal details.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get service principal details.
 
   Gets the details for a single service principal define in the Databricks
   workspace.
@@ -206,6 +222,8 @@ func newGet() *cobra.Command {
     ID: Unique ID for a service principal in the Databricks workspace.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -273,12 +291,16 @@ func newList() *cobra.Command {
 	cmd.Flags().Lookup("count").Hidden = true
 
 	cmd.Use = "list"
-	cmd.Short = `List service principals.`
-	cmd.Long = `List service principals.
+	cmd.Short = `*Public Preview* List service principals.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+List service principals.
 
   Gets the set of service principals associated with a Databricks workspace.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -334,8 +356,10 @@ func newPatch() *cobra.Command {
 	// TODO: array: schemas
 
 	cmd.Use = "patch ID"
-	cmd.Short = `Update service principal details.`
-	cmd.Long = `Update service principal details.
+	cmd.Short = `*Public Preview* Update service principal details.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Update service principal details.
 
   Partially updates the details of a single service principal in the Databricks
   workspace.
@@ -344,6 +368,8 @@ func newPatch() *cobra.Command {
     ID: Unique ID in the Databricks workspace.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -415,8 +441,10 @@ func newUpdate() *cobra.Command {
 	// TODO: array: schemas
 
 	cmd.Use = "update ID"
-	cmd.Short = `Replace service principal.`
-	cmd.Long = `Replace service principal.
+	cmd.Short = `*Public Preview* Replace service principal.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Replace service principal.
 
   Updates the details of a single service principal.
 
@@ -426,6 +454,8 @@ func newUpdate() *cobra.Command {
     ID: Databricks service principal ID.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/workspace/serving-endpoints/serving-endpoints.go b/cmd/workspace/serving-endpoints/serving-endpoints.go
old mode 100755
new mode 100644
index 88c70401064..7c837c5d2dd
--- a/cmd/workspace/serving-endpoints/serving-endpoints.go
+++ b/cmd/workspace/serving-endpoints/serving-endpoints.go
@@ -3,6 +3,7 @@
 package serving_endpoints
 
 import (
+	"errors"
 	"fmt"
 	"time"
 
@@ -39,6 +40,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newBuildLogs())
 	cmd.AddCommand(newCreate())
@@ -53,6 +58,7 @@ func New() *cobra.Command {
 	cmd.AddCommand(newList())
 	cmd.AddCommand(newLogs())
 	cmd.AddCommand(newPatch())
+	cmd.AddCommand(newPatchTelemetryConfig())
 	cmd.AddCommand(newPut())
 	cmd.AddCommand(newPutAiGateway())
 	cmd.AddCommand(newQuery())
@@ -97,6 +103,8 @@ func newBuildLogs() *cobra.Command {
       field is required.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -162,6 +170,7 @@ func newCreate() *cobra.Command {
 	// TODO: array: rate_limits
 	cmd.Flags().BoolVar(&createReq.RouteOptimized, "route-optimized", createReq.RouteOptimized, `Enable route optimization for the serving endpoint.`)
 	// TODO: array: tags
+	// TODO: complex arg: telemetry_config
 
 	cmd.Use = "create NAME"
 	cmd.Short = `Create a new serving endpoint.`
@@ -173,12 +182,14 @@ func newCreate() *cobra.Command {
       alphanumeric characters, dashes, and underscores.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name' in your JSON input")
 			}
 			return nil
 		}
@@ -268,10 +279,14 @@ func newCreateProvisionedThroughputEndpoint() *cobra.Command {
 	// TODO: array: tags
 
 	cmd.Use = "create-provisioned-throughput-endpoint"
-	cmd.Short = `Create a new PT serving endpoint.`
-	cmd.Long = `Create a new PT serving endpoint.`
+	cmd.Short = `*Public Preview* Create a new PT serving endpoint.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Create a new PT serving endpoint.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -290,7 +305,7 @@ func newCreateProvisionedThroughputEndpoint() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		wait, err := w.ServingEndpoints.CreateProvisionedThroughputEndpoint(ctx, createProvisionedThroughputEndpointReq)
@@ -344,6 +359,8 @@ func newDelete() *cobra.Command {
 	cmd.Long = `Delete a serving endpoint.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -402,6 +419,8 @@ func newExportMetrics() *cobra.Command {
       required.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -460,6 +479,8 @@ func newGet() *cobra.Command {
     NAME: The name of the serving endpoint. This field is required.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -508,8 +529,10 @@ func newGetOpenApi() *cobra.Command {
 	var getOpenApiReq serving.GetOpenApiRequest
 
 	cmd.Use = "get-open-api NAME"
-	cmd.Short = `Get the schema for a serving endpoint.`
-	cmd.Long = `Get the schema for a serving endpoint.
+	cmd.Short = `*Public Preview* Get the schema for a serving endpoint.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get the schema for a serving endpoint.
 
   Get the query schema of the serving endpoint in OpenAPI format. The schema
   contains information for the supported paths, input and output format and
@@ -520,6 +543,8 @@ func newGetOpenApi() *cobra.Command {
       field is required.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -578,6 +603,8 @@ func newGetPermissionLevels() *cobra.Command {
     SERVING_ENDPOINT_ID: The serving endpoint for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -636,6 +663,8 @@ func newGetPermissions() *cobra.Command {
     SERVING_ENDPOINT_ID: The serving endpoint for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -703,6 +732,8 @@ func newHttpRequest() *cobra.Command {
 	cmd.Hidden = true
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(3)
@@ -768,6 +799,8 @@ func newList() *cobra.Command {
 	cmd.Long = `Get all serving endpoints.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -823,6 +856,8 @@ func newLogs() *cobra.Command {
       is required.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -889,6 +924,8 @@ func newPatch() *cobra.Command {
       required.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -934,6 +971,83 @@ func newPatch() *cobra.Command {
 	return cmd
 }
 
+// start patch-telemetry-config command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var patchTelemetryConfigOverrides []func(
+	*cobra.Command,
+	*serving.PatchTelemetryConfigRequest,
+)
+
+func newPatchTelemetryConfig() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var patchTelemetryConfigReq serving.PatchTelemetryConfigRequest
+	var patchTelemetryConfigJson flags.JsonFlag
+
+	cmd.Flags().Var(&patchTelemetryConfigJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: complex arg: telemetry_config
+
+	cmd.Use = "patch-telemetry-config NAME"
+	cmd.Short = `Update the telemetry config of a serving endpoint.`
+	cmd.Long = `Update the telemetry config of a serving endpoint.
+
+  Updates the telemetry configuration of a serving endpoint.
+
+  Arguments:
+    NAME: The name of the serving endpoint whose telemetry configuration is being
+      updated. This field is required.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := patchTelemetryConfigJson.Unmarshal(&patchTelemetryConfigReq)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		patchTelemetryConfigReq.Name = args[0]
+
+		response, err := w.ServingEndpoints.PatchTelemetryConfig(ctx, patchTelemetryConfigReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range patchTelemetryConfigOverrides {
+		fn(cmd, &patchTelemetryConfigReq)
+	}
+
+	return cmd
+}
+
 // start put command
 
 // Slice with functions to override default command behavior.
@@ -954,8 +1068,10 @@ func newPut() *cobra.Command {
 	// TODO: array: rate_limits
 
 	cmd.Use = "put NAME"
-	cmd.Short = `Update rate limits of a serving endpoint.`
-	cmd.Long = `Update rate limits of a serving endpoint.
+	cmd.Short = `*Public Preview* Update rate limits of a serving endpoint.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Update rate limits of a serving endpoint.
 
   Deprecated: Please use AI Gateway to manage rate limits instead.
 
@@ -964,6 +1080,8 @@ func newPut() *cobra.Command {
       field is required.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1045,6 +1163,8 @@ func newPutAiGateway() *cobra.Command {
       field is required.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1134,6 +1254,8 @@ func newQuery() *cobra.Command {
       via the path parameter.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1210,6 +1332,8 @@ func newSetPermissions() *cobra.Command {
     SERVING_ENDPOINT_ID: The serving endpoint for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1296,6 +1420,8 @@ func newUpdateConfig() *cobra.Command {
     NAME: The name of the serving endpoint to update. This field is required.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1383,6 +1509,8 @@ func newUpdateNotifications() *cobra.Command {
       This field is required.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1458,6 +1586,8 @@ func newUpdatePermissions() *cobra.Command {
     SERVING_ENDPOINT_ID: The serving endpoint for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1527,8 +1657,10 @@ func newUpdateProvisionedThroughputEndpointConfig() *cobra.Command {
 	cmd.Flags().Var(&updateProvisionedThroughputEndpointConfigJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Use = "update-provisioned-throughput-endpoint-config NAME"
-	cmd.Short = `Update config of a PT serving endpoint.`
-	cmd.Long = `Update config of a PT serving endpoint.
+	cmd.Short = `*Public Preview* Update config of a PT serving endpoint.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Update config of a PT serving endpoint.
 
   Updates any combination of the pt endpoint's served entities, the compute
   configuration of those served entities, and the endpoint's traffic config.
@@ -1538,6 +1670,8 @@ func newUpdateProvisionedThroughputEndpointConfig() *cobra.Command {
     NAME: The name of the pt endpoint to update. This field is required.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -1561,7 +1695,7 @@ func newUpdateProvisionedThroughputEndpointConfig() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 		updateProvisionedThroughputEndpointConfigReq.Name = args[0]
 
diff --git a/cmd/workspace/settings/settings.go b/cmd/workspace/settings/settings.go
old mode 100755
new mode 100644
index 7dedfbfab1b..8518f522dd8
--- a/cmd/workspace/settings/settings.go
+++ b/cmd/workspace/settings/settings.go
@@ -37,6 +37,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add subservices
 	cmd.AddCommand(aibi_dashboard_embedding_access_policy.New())
 	cmd.AddCommand(aibi_dashboard_embedding_approved_domains.New())
diff --git a/cmd/workspace/shares/shares.go b/cmd/workspace/shares/shares.go
old mode 100755
new mode 100644
index 47615ce4d7f..40baf4d5b66
--- a/cmd/workspace/shares/shares.go
+++ b/cmd/workspace/shares/shares.go
@@ -3,6 +3,7 @@
 package shares
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -30,6 +31,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -65,6 +70,7 @@ func newCreate() *cobra.Command {
 	cmd.Flags().Var(&createJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Flags().StringVar(&createReq.Comment, "comment", createReq.Comment, `User-provided free-form text description.`)
+	// TODO: complex arg: replication_config
 	cmd.Flags().StringVar(&createReq.StorageRoot, "storage-root", createReq.StorageRoot, `Storage root URL for the share.`)
 
 	cmd.Use = "create NAME"
@@ -79,12 +85,14 @@ func newCreate() *cobra.Command {
     NAME: Name of the share.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name' in your JSON input")
 			}
 			return nil
 		}
@@ -158,6 +166,8 @@ func newDelete() *cobra.Command {
     NAME: The name of the share.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -217,6 +227,8 @@ func newGet() *cobra.Command {
     NAME: The name of the share.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -287,6 +299,8 @@ func newListShares() *cobra.Command {
   ordering of the elements in the array.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -349,6 +363,8 @@ func newSharePermissions() *cobra.Command {
     NAME: The name of the Recipient.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -431,6 +447,8 @@ func newUpdate() *cobra.Command {
     NAME: The name of the share.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -511,6 +529,8 @@ func newUpdatePermissions() *cobra.Command {
     NAME: The name of the share.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/workspace/sql-results-download/sql-results-download.go b/cmd/workspace/sql-results-download/sql-results-download.go
old mode 100755
new mode 100644
index b929a79cc49..84e177a4b8b
--- a/cmd/workspace/sql-results-download/sql-results-download.go
+++ b/cmd/workspace/sql-results-download/sql-results-download.go
@@ -3,7 +3,7 @@
 package sql_results_download
 
 import (
-	"fmt"
+	"errors"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
@@ -20,13 +20,19 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "sql-results-download",
-		Short: `Controls whether users within the workspace are allowed to download results from the SQL Editor and AI/BI Dashboards UIs.`,
-		Long: `Controls whether users within the workspace are allowed to download results
+		Short: `*Public Preview* Controls whether users within the workspace are allowed to download results from the SQL Editor and AI/BI Dashboards UIs.`,
+		Long: `This command is in Public Preview and may change without notice.
+
+Controls whether users within the workspace are allowed to download results
   from the SQL Editor and AI/BI Dashboards UIs. By default, this setting is
   enabled (set to true)`,
 		RunE: root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
 	// Add methods
 	cmd.AddCommand(newDelete())
 	cmd.AddCommand(newGet())
@@ -57,12 +63,16 @@ func newDelete() *cobra.Command {
 	cmd.Flags().StringVar(&deleteReq.Etag, "etag", deleteReq.Etag, `etag used for versioning.`)
 
 	cmd.Use = "delete"
-	cmd.Short = `Delete the SQL Results Download setting.`
-	cmd.Long = `Delete the SQL Results Download setting.
+	cmd.Short = `*Public Preview* Delete the SQL Results Download setting.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Delete the SQL Results Download setting.
 
   Reverts the SQL Results Download setting to its default value.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -111,12 +121,16 @@ func newGet() *cobra.Command {
 	cmd.Flags().StringVar(&getReq.Etag, "etag", getReq.Etag, `etag used for versioning.`)
 
 	cmd.Use = "get"
-	cmd.Short = `Get the SQL Results Download setting.`
-	cmd.Long = `Get the SQL Results Download setting.
+	cmd.Short = `*Public Preview* Get the SQL Results Download setting.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get the SQL Results Download setting.
 
   Gets the SQL Results Download setting.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -166,12 +180,16 @@ func newUpdate() *cobra.Command {
 	cmd.Flags().Var(&updateJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Use = "update"
-	cmd.Short = `Update the SQL Results Download setting.`
-	cmd.Long = `Update the SQL Results Download setting.
+	cmd.Short = `*Public Preview* Update the SQL Results Download setting.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Update the SQL Results Download setting.
 
   Updates the SQL Results Download setting.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -190,7 +208,7 @@ func newUpdate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := w.Settings.SqlResultsDownload().Update(ctx, updateReq)
diff --git a/cmd/workspace/storage-credentials/storage-credentials.go b/cmd/workspace/storage-credentials/storage-credentials.go
old mode 100755
new mode 100644
index 878ba367a8f..ff64940025f
--- a/cmd/workspace/storage-credentials/storage-credentials.go
+++ b/cmd/workspace/storage-credentials/storage-credentials.go
@@ -3,6 +3,7 @@
 package storage_credentials
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -38,6 +39,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -94,12 +99,14 @@ func newCreate() *cobra.Command {
       credentials within the metastore.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name' in your JSON input")
 			}
 			return nil
 		}
@@ -175,6 +182,8 @@ func newDelete() *cobra.Command {
     NAME: Name of the storage credential.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -233,6 +242,8 @@ func newGet() *cobra.Command {
     NAME: Name of the storage credential.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -314,6 +325,8 @@ func newList() *cobra.Command {
   indication that the end of results has been reached.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -391,6 +404,8 @@ func newUpdate() *cobra.Command {
     NAME: Name of the storage credential.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -481,6 +496,8 @@ func newValidate() *cobra.Command {
   credential.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
diff --git a/cmd/workspace/supervisor-agents/supervisor-agents.go b/cmd/workspace/supervisor-agents/supervisor-agents.go
new file mode 100644
index 00000000000..491beca6b78
--- /dev/null
+++ b/cmd/workspace/supervisor-agents/supervisor-agents.go
@@ -0,0 +1,1566 @@
+// Code generated from OpenAPI specs by Databricks SDK Generator. DO NOT EDIT.
+
+package supervisor_agents
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/databricks-sdk-go/common/types/fieldmask"
+	"github.com/databricks/databricks-sdk-go/service/supervisoragents"
+	"github.com/spf13/cobra"
+)
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var cmdOverrides []func(*cobra.Command)
+
+func New() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "supervisor-agents",
+		Short: `*Beta* Manage legacy Supervisor Agents and related resources.`,
+		Long: `This command is in Beta and may change without notice.
+
+Manage legacy Supervisor Agents and related resources.`,
+		GroupID: "agentbricks",
+		RunE:    root.ReportUnknownSubcommand,
+	}
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	// Add methods
+	cmd.AddCommand(newCreateExample())
+	cmd.AddCommand(newCreateSupervisorAgent())
+	cmd.AddCommand(newCreateTool())
+	cmd.AddCommand(newDeleteExample())
+	cmd.AddCommand(newDeleteSupervisorAgent())
+	cmd.AddCommand(newDeleteTool())
+	cmd.AddCommand(newGetExample())
+	cmd.AddCommand(newGetPermissionLevels())
+	cmd.AddCommand(newGetPermissions())
+	cmd.AddCommand(newGetSupervisorAgent())
+	cmd.AddCommand(newGetTool())
+	cmd.AddCommand(newListExamples())
+	cmd.AddCommand(newListSupervisorAgents())
+	cmd.AddCommand(newListTools())
+	cmd.AddCommand(newSetPermissions())
+	cmd.AddCommand(newUpdateExample())
+	cmd.AddCommand(newUpdatePermissions())
+	cmd.AddCommand(newUpdateSupervisorAgent())
+	cmd.AddCommand(newUpdateTool())
+
+	// Apply optional overrides to this command.
+	for _, fn := range cmdOverrides {
+		fn(cmd)
+	}
+
+	return cmd
+}
+
+// start create-example command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var createExampleOverrides []func(
+	*cobra.Command,
+	*supervisoragents.CreateExampleRequest,
+)
+
+func newCreateExample() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var createExampleReq supervisoragents.CreateExampleRequest
+	createExampleReq.Example = supervisoragents.Example{}
+	var createExampleJson flags.JsonFlag
+
+	cmd.Flags().Var(&createExampleJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&createExampleReq.Example.Name, "name", createExampleReq.Example.Name, `Full resource name: supervisor-agents/{supervisor_agent_id}/examples/{example_id}.`)
+
+	cmd.Use = "create-example PARENT QUESTION GUIDELINES"
+	cmd.Short = `*Beta* Create an example for a Supervisor Agent.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Create an example for a Supervisor Agent.
+
+  Creates an example for a Supervisor Agent.
+
+  Arguments:
+    PARENT: Parent resource where this example will be created. Format:
+      supervisor-agents/{supervisor_agent_id}
+    QUESTION: The example question.
+    GUIDELINES: Guidelines for answering the question.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(1)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only PARENT as positional arguments. Provide 'question', 'guidelines' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(3)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := createExampleJson.Unmarshal(&createExampleReq.Example)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		createExampleReq.Parent = args[0]
+		if !cmd.Flags().Changed("json") {
+			createExampleReq.Example.Question = args[1]
+		}
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[2], &createExampleReq.Example.Guidelines)
+			if err != nil {
+				return fmt.Errorf("invalid GUIDELINES: %s", args[2])
+			}
+
+		}
+
+		response, err := w.SupervisorAgents.CreateExample(ctx, createExampleReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range createExampleOverrides {
+		fn(cmd, &createExampleReq)
+	}
+
+	return cmd
+}
+
+// start create-supervisor-agent command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var createSupervisorAgentOverrides []func(
+	*cobra.Command,
+	*supervisoragents.CreateSupervisorAgentRequest,
+)
+
+func newCreateSupervisorAgent() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var createSupervisorAgentReq supervisoragents.CreateSupervisorAgentRequest
+	createSupervisorAgentReq.SupervisorAgent = supervisoragents.SupervisorAgent{}
+	var createSupervisorAgentJson flags.JsonFlag
+
+	cmd.Flags().Var(&createSupervisorAgentJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&createSupervisorAgentReq.SupervisorAgent.Description, "description", createSupervisorAgentReq.SupervisorAgent.Description, `Description of what this agent can do (user-facing).`)
+	cmd.Flags().StringVar(&createSupervisorAgentReq.SupervisorAgent.Instructions, "instructions", createSupervisorAgentReq.SupervisorAgent.Instructions, `Optional natural-language instructions for the supervisor agent.`)
+	cmd.Flags().StringVar(&createSupervisorAgentReq.SupervisorAgent.Name, "name", createSupervisorAgentReq.SupervisorAgent.Name, `The resource name of the SupervisorAgent.`)
+
+	cmd.Use = "create-supervisor-agent DISPLAY_NAME"
+	cmd.Short = `*Beta* Create a Supervisor Agent.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Create a Supervisor Agent.
+
+  Creates a new Supervisor Agent.
+
+  Arguments:
+    DISPLAY_NAME: The display name of the Supervisor Agent, unique at workspace level.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(0)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'display_name' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := createSupervisorAgentJson.Unmarshal(&createSupervisorAgentReq.SupervisorAgent)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		if !cmd.Flags().Changed("json") {
+			createSupervisorAgentReq.SupervisorAgent.DisplayName = args[0]
+		}
+
+		response, err := w.SupervisorAgents.CreateSupervisorAgent(ctx, createSupervisorAgentReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range createSupervisorAgentOverrides {
+		fn(cmd, &createSupervisorAgentReq)
+	}
+
+	return cmd
+}
+
+// start create-tool command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var createToolOverrides []func(
+	*cobra.Command,
+	*supervisoragents.CreateToolRequest,
+)
+
+func newCreateTool() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var createToolReq supervisoragents.CreateToolRequest
+	createToolReq.Tool = supervisoragents.Tool{}
+	var createToolJson flags.JsonFlag
+
+	cmd.Flags().Var(&createToolJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: complex arg: app
+	cmd.Flags().StringVar(&createToolReq.Tool.Description, "description", createToolReq.Tool.Description, `Description of what this tool does (user-facing).`)
+	// TODO: complex arg: genie_space
+	// TODO: complex arg: knowledge_assistant
+	cmd.Flags().StringVar(&createToolReq.Tool.Name, "name", createToolReq.Tool.Name, `Full resource name: supervisor-agents/{supervisor_agent_id}/tools/{tool_id}.`)
+	// TODO: complex arg: uc_connection
+	// TODO: complex arg: uc_function
+	// TODO: complex arg: volume
+
+	cmd.Use = "create-tool PARENT TOOL_ID TOOL_TYPE"
+	cmd.Short = `*Beta* Create a Tool.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Create a Tool.
+
+  Creates a Tool under a Supervisor Agent. Specify one of "genie_space",
+  "knowledge_assistant", "uc_function", "uc_connection", "app", "volume",
+  "dashboard", "table", "vector_search_index", "catalog", "schema",
+  "supervisor_agent", "databricks_web_search", "skill" in the request body. The
+  legacy values "lakeview_dashboard", "uc_table", and "web_search" are also
+  accepted and remain equivalent to "dashboard", "table", and
+  "databricks_web_search" respectively. The "databricks_web_search" tool_type
+  maps to the web_search spec field.
+
+  Arguments:
+    PARENT: Parent resource where this tool will be created. Format:
+      supervisor-agents/{supervisor_agent_id}
+    TOOL_ID: The ID to use for the tool, which will become the final component of the
+      tool's resource name.
+    TOOL_TYPE: Tool type. Must be one of: "genie_space", "knowledge_assistant",
+      "uc_function", "uc_connection", "uc_mcp", "app", "volume", "dashboard",
+      "serving_endpoint", "table", "vector_search_index", "catalog", "schema",
+      "supervisor_agent", "databricks_web_search", "skill". The legacy values
+      "lakeview_dashboard", "uc_table", and "web_search" are also accepted and
+      remain equivalent to "dashboard", "table", and "databricks_web_search"
+      respectively. The "databricks_web_search" tool_type maps to the
+      web_search spec field.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(2)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only PARENT, TOOL_ID as positional arguments. Provide 'tool_type' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(3)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := createToolJson.Unmarshal(&createToolReq.Tool)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		createToolReq.Parent = args[0]
+		createToolReq.ToolId = args[1]
+		if !cmd.Flags().Changed("json") {
+			createToolReq.Tool.ToolType = args[2]
+		}
+
+		response, err := w.SupervisorAgents.CreateTool(ctx, createToolReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range createToolOverrides {
+		fn(cmd, &createToolReq)
+	}
+
+	return cmd
+}
+
+// start delete-example command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteExampleOverrides []func(
+	*cobra.Command,
+	*supervisoragents.DeleteExampleRequest,
+)
+
+func newDeleteExample() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteExampleReq supervisoragents.DeleteExampleRequest
+
+	cmd.Use = "delete-example NAME"
+	cmd.Short = `*Beta* Delete an example from a Supervisor Agent.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Delete an example from a Supervisor Agent.
+
+  Deletes an example from a Supervisor Agent.
+
+  Arguments:
+    NAME: The resource name of the example to delete. Format:
+      supervisor-agents/{supervisor_agent_id}/examples/{example_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		deleteExampleReq.Name = args[0]
+
+		err = w.SupervisorAgents.DeleteExample(ctx, deleteExampleReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteExampleOverrides {
+		fn(cmd, &deleteExampleReq)
+	}
+
+	return cmd
+}
+
+// start delete-supervisor-agent command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteSupervisorAgentOverrides []func(
+	*cobra.Command,
+	*supervisoragents.DeleteSupervisorAgentRequest,
+)
+
+func newDeleteSupervisorAgent() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteSupervisorAgentReq supervisoragents.DeleteSupervisorAgentRequest
+
+	cmd.Use = "delete-supervisor-agent NAME"
+	cmd.Short = `*Beta* Delete a Supervisor Agent.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Delete a Supervisor Agent.
+
+  Deletes a Supervisor Agent.
+
+  Arguments:
+    NAME: The resource name of the Supervisor Agent. Format:
+      supervisor-agents/{supervisor_agent_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		deleteSupervisorAgentReq.Name = args[0]
+
+		err = w.SupervisorAgents.DeleteSupervisorAgent(ctx, deleteSupervisorAgentReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteSupervisorAgentOverrides {
+		fn(cmd, &deleteSupervisorAgentReq)
+	}
+
+	return cmd
+}
+
+// start delete-tool command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteToolOverrides []func(
+	*cobra.Command,
+	*supervisoragents.DeleteToolRequest,
+)
+
+func newDeleteTool() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteToolReq supervisoragents.DeleteToolRequest
+
+	cmd.Use = "delete-tool NAME"
+	cmd.Short = `*Beta* Delete a Tool.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Delete a Tool.
+
+  Deletes a Tool.
+
+  Arguments:
+    NAME: The resource name of the Tool. Format:
+      supervisor-agents/{supervisor_agent_id}/tools/{tool_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		deleteToolReq.Name = args[0]
+
+		err = w.SupervisorAgents.DeleteTool(ctx, deleteToolReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteToolOverrides {
+		fn(cmd, &deleteToolReq)
+	}
+
+	return cmd
+}
+
+// start get-example command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getExampleOverrides []func(
+	*cobra.Command,
+	*supervisoragents.GetExampleRequest,
+)
+
+func newGetExample() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getExampleReq supervisoragents.GetExampleRequest
+
+	cmd.Use = "get-example NAME"
+	cmd.Short = `*Beta* Get an example from a Supervisor Agent.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get an example from a Supervisor Agent.
+
+  Gets an example from a Supervisor Agent.
+
+  Arguments:
+    NAME: The resource name of the example. Format:
+      supervisor-agents/{supervisor_agent_id}/examples/{example_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getExampleReq.Name = args[0]
+
+		response, err := w.SupervisorAgents.GetExample(ctx, getExampleReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getExampleOverrides {
+		fn(cmd, &getExampleReq)
+	}
+
+	return cmd
+}
+
+// start get-permission-levels command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getPermissionLevelsOverrides []func(
+	*cobra.Command,
+	*supervisoragents.GetSupervisorAgentPermissionLevelsRequest,
+)
+
+func newGetPermissionLevels() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getPermissionLevelsReq supervisoragents.GetSupervisorAgentPermissionLevelsRequest
+
+	cmd.Use = "get-permission-levels SUPERVISOR_AGENT_ID"
+	cmd.Short = `*Beta* Get supervisor agent permission levels.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get supervisor agent permission levels.
+
+  Gets the permission levels that a user can have on an object.
+
+  Arguments:
+    SUPERVISOR_AGENT_ID: The supervisor agent for which to get or manage permissions.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getPermissionLevelsReq.SupervisorAgentId = args[0]
+
+		response, err := w.SupervisorAgents.GetPermissionLevels(ctx, getPermissionLevelsReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getPermissionLevelsOverrides {
+		fn(cmd, &getPermissionLevelsReq)
+	}
+
+	return cmd
+}
+
+// start get-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getPermissionsOverrides []func(
+	*cobra.Command,
+	*supervisoragents.GetSupervisorAgentPermissionsRequest,
+)
+
+func newGetPermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getPermissionsReq supervisoragents.GetSupervisorAgentPermissionsRequest
+
+	cmd.Use = "get-permissions SUPERVISOR_AGENT_ID"
+	cmd.Short = `*Beta* Get supervisor agent permissions.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get supervisor agent permissions.
+
+  Gets the permissions of a supervisor agent. Supervisor agents can inherit
+  permissions from their root object.
+
+  Arguments:
+    SUPERVISOR_AGENT_ID: The supervisor agent for which to get or manage permissions.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getPermissionsReq.SupervisorAgentId = args[0]
+
+		response, err := w.SupervisorAgents.GetPermissions(ctx, getPermissionsReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getPermissionsOverrides {
+		fn(cmd, &getPermissionsReq)
+	}
+
+	return cmd
+}
+
+// start get-supervisor-agent command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getSupervisorAgentOverrides []func(
+	*cobra.Command,
+	*supervisoragents.GetSupervisorAgentRequest,
+)
+
+func newGetSupervisorAgent() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getSupervisorAgentReq supervisoragents.GetSupervisorAgentRequest
+
+	cmd.Use = "get-supervisor-agent NAME"
+	cmd.Short = `*Beta* Get a Supervisor Agent.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get a Supervisor Agent.
+
+  Gets a Supervisor Agent.
+
+  Arguments:
+    NAME: The resource name of the Supervisor Agent. Format:
+      supervisor-agents/{supervisor_agent_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getSupervisorAgentReq.Name = args[0]
+
+		response, err := w.SupervisorAgents.GetSupervisorAgent(ctx, getSupervisorAgentReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getSupervisorAgentOverrides {
+		fn(cmd, &getSupervisorAgentReq)
+	}
+
+	return cmd
+}
+
+// start get-tool command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getToolOverrides []func(
+	*cobra.Command,
+	*supervisoragents.GetToolRequest,
+)
+
+func newGetTool() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getToolReq supervisoragents.GetToolRequest
+
+	cmd.Use = "get-tool NAME"
+	cmd.Short = `*Beta* Get a Tool.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get a Tool.
+
+  Gets a Tool.
+
+  Arguments:
+    NAME: The resource name of the Tool. Format:
+      supervisor-agents/{supervisor_agent_id}/tools/{tool_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getToolReq.Name = args[0]
+
+		response, err := w.SupervisorAgents.GetTool(ctx, getToolReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getToolOverrides {
+		fn(cmd, &getToolReq)
+	}
+
+	return cmd
+}
+
+// start list-examples command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listExamplesOverrides []func(
+	*cobra.Command,
+	*supervisoragents.ListExamplesRequest,
+)
+
+func newListExamples() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listExamplesReq supervisoragents.ListExamplesRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listExamplesLimit int
+
+	cmd.Flags().IntVar(&listExamplesReq.PageSize, "page-size", listExamplesReq.PageSize, `The maximum number of examples to return.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listExamplesLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listExamplesReq.PageToken, "page-token", listExamplesReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-examples PARENT"
+	cmd.Short = `*Beta* List examples for a Supervisor Agent.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+List examples for a Supervisor Agent.
+
+  Lists examples under a Supervisor Agent.
+
+  Arguments:
+    PARENT: Parent resource to list from. Format:
+      supervisor-agents/{supervisor_agent_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		listExamplesReq.Parent = args[0]
+
+		response := w.SupervisorAgents.ListExamples(ctx, listExamplesReq)
+		if listExamplesLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listExamplesLimit)
+		}
+		if listExamplesLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listExamplesLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listExamplesOverrides {
+		fn(cmd, &listExamplesReq)
+	}
+
+	return cmd
+}
+
+// start list-supervisor-agents command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listSupervisorAgentsOverrides []func(
+	*cobra.Command,
+	*supervisoragents.ListSupervisorAgentsRequest,
+)
+
+func newListSupervisorAgents() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listSupervisorAgentsReq supervisoragents.ListSupervisorAgentsRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listSupervisorAgentsLimit int
+
+	cmd.Flags().IntVar(&listSupervisorAgentsReq.PageSize, "page-size", listSupervisorAgentsReq.PageSize, `The maximum number of supervisor agents to return.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listSupervisorAgentsLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listSupervisorAgentsReq.PageToken, "page-token", listSupervisorAgentsReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-supervisor-agents"
+	cmd.Short = `*Beta* List Supervisor Agents.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+List Supervisor Agents.
+
+  Lists Supervisor Agents.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(0)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		response := w.SupervisorAgents.ListSupervisorAgents(ctx, listSupervisorAgentsReq)
+		if listSupervisorAgentsLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listSupervisorAgentsLimit)
+		}
+		if listSupervisorAgentsLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listSupervisorAgentsLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listSupervisorAgentsOverrides {
+		fn(cmd, &listSupervisorAgentsReq)
+	}
+
+	return cmd
+}
+
+// start list-tools command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listToolsOverrides []func(
+	*cobra.Command,
+	*supervisoragents.ListToolsRequest,
+)
+
+func newListTools() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listToolsReq supervisoragents.ListToolsRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listToolsLimit int
+
+	cmd.Flags().IntVar(&listToolsReq.PageSize, "page-size", listToolsReq.PageSize, ``)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listToolsLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listToolsReq.PageToken, "page-token", listToolsReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-tools PARENT"
+	cmd.Short = `*Beta* List Tools.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+List Tools.
+
+  Lists Tools under a Supervisor Agent.
+
+  Arguments:
+    PARENT: Parent resource to list from. Format:
+      supervisor-agents/{supervisor_agent_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		listToolsReq.Parent = args[0]
+
+		response := w.SupervisorAgents.ListTools(ctx, listToolsReq)
+		if listToolsLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listToolsLimit)
+		}
+		if listToolsLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listToolsLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listToolsOverrides {
+		fn(cmd, &listToolsReq)
+	}
+
+	return cmd
+}
+
+// start set-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var setPermissionsOverrides []func(
+	*cobra.Command,
+	*supervisoragents.SupervisorAgentPermissionsRequest,
+)
+
+func newSetPermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var setPermissionsReq supervisoragents.SupervisorAgentPermissionsRequest
+	var setPermissionsJson flags.JsonFlag
+
+	cmd.Flags().Var(&setPermissionsJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: access_control_list
+
+	cmd.Use = "set-permissions SUPERVISOR_AGENT_ID"
+	cmd.Short = `*Beta* Set supervisor agent permissions.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Set supervisor agent permissions.
+
+  Sets permissions on an object, replacing existing permissions if they exist.
+  Deletes all direct permissions if none are specified. Objects can inherit
+  permissions from their root object.
+
+  Arguments:
+    SUPERVISOR_AGENT_ID: The supervisor agent for which to get or manage permissions.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := setPermissionsJson.Unmarshal(&setPermissionsReq)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		setPermissionsReq.SupervisorAgentId = args[0]
+
+		response, err := w.SupervisorAgents.SetPermissions(ctx, setPermissionsReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range setPermissionsOverrides {
+		fn(cmd, &setPermissionsReq)
+	}
+
+	return cmd
+}
+
+// start update-example command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateExampleOverrides []func(
+	*cobra.Command,
+	*supervisoragents.UpdateExampleRequest,
+)
+
+func newUpdateExample() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateExampleReq supervisoragents.UpdateExampleRequest
+	updateExampleReq.Example = supervisoragents.Example{}
+	var updateExampleJson flags.JsonFlag
+
+	cmd.Flags().Var(&updateExampleJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&updateExampleReq.Example.Name, "name", updateExampleReq.Example.Name, `Full resource name: supervisor-agents/{supervisor_agent_id}/examples/{example_id}.`)
+
+	cmd.Use = "update-example NAME UPDATE_MASK QUESTION GUIDELINES"
+	cmd.Short = `*Beta* Update an example in a Supervisor Agent.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Update an example in a Supervisor Agent.
+
+  Updates an example in a Supervisor Agent.
+
+  Arguments:
+    NAME: The resource name of the example to update. Format:
+      supervisor-agents/{supervisor_agent_id}/examples/{example_id}
+    UPDATE_MASK: Comma-delimited list of fields to update on the example. Allowed values:
+      question, guidelines. Examples: - question - question,guidelines
+    QUESTION: The example question.
+    GUIDELINES: Guidelines for answering the question.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(2)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only NAME, UPDATE_MASK as positional arguments. Provide 'question', 'guidelines' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(4)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updateExampleJson.Unmarshal(&updateExampleReq.Example)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		updateExampleReq.Name = args[0]
+		if args[1] != "" {
+			updateMaskArray := strings.Split(args[1], ",")
+			updateExampleReq.UpdateMask = *fieldmask.New(updateMaskArray)
+		}
+		if !cmd.Flags().Changed("json") {
+			updateExampleReq.Example.Question = args[2]
+		}
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[3], &updateExampleReq.Example.Guidelines)
+			if err != nil {
+				return fmt.Errorf("invalid GUIDELINES: %s", args[3])
+			}
+
+		}
+
+		response, err := w.SupervisorAgents.UpdateExample(ctx, updateExampleReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateExampleOverrides {
+		fn(cmd, &updateExampleReq)
+	}
+
+	return cmd
+}
+
+// start update-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updatePermissionsOverrides []func(
+	*cobra.Command,
+	*supervisoragents.SupervisorAgentPermissionsRequest,
+)
+
+func newUpdatePermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updatePermissionsReq supervisoragents.SupervisorAgentPermissionsRequest
+	var updatePermissionsJson flags.JsonFlag
+
+	cmd.Flags().Var(&updatePermissionsJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: access_control_list
+
+	cmd.Use = "update-permissions SUPERVISOR_AGENT_ID"
+	cmd.Short = `*Beta* Update supervisor agent permissions.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Update supervisor agent permissions.
+
+  Updates the permissions on a supervisor agent. Supervisor agents can inherit
+  permissions from their root object.
+
+  Arguments:
+    SUPERVISOR_AGENT_ID: The supervisor agent for which to get or manage permissions.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updatePermissionsJson.Unmarshal(&updatePermissionsReq)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		updatePermissionsReq.SupervisorAgentId = args[0]
+
+		response, err := w.SupervisorAgents.UpdatePermissions(ctx, updatePermissionsReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updatePermissionsOverrides {
+		fn(cmd, &updatePermissionsReq)
+	}
+
+	return cmd
+}
+
+// start update-supervisor-agent command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateSupervisorAgentOverrides []func(
+	*cobra.Command,
+	*supervisoragents.UpdateSupervisorAgentRequest,
+)
+
+func newUpdateSupervisorAgent() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateSupervisorAgentReq supervisoragents.UpdateSupervisorAgentRequest
+	updateSupervisorAgentReq.SupervisorAgent = supervisoragents.SupervisorAgent{}
+	var updateSupervisorAgentJson flags.JsonFlag
+
+	cmd.Flags().Var(&updateSupervisorAgentJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&updateSupervisorAgentReq.SupervisorAgent.Description, "description", updateSupervisorAgentReq.SupervisorAgent.Description, `Description of what this agent can do (user-facing).`)
+	cmd.Flags().StringVar(&updateSupervisorAgentReq.SupervisorAgent.Instructions, "instructions", updateSupervisorAgentReq.SupervisorAgent.Instructions, `Optional natural-language instructions for the supervisor agent.`)
+	cmd.Flags().StringVar(&updateSupervisorAgentReq.SupervisorAgent.Name, "name", updateSupervisorAgentReq.SupervisorAgent.Name, `The resource name of the SupervisorAgent.`)
+
+	cmd.Use = "update-supervisor-agent NAME UPDATE_MASK DISPLAY_NAME"
+	cmd.Short = `*Beta* Update a Supervisor Agent.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Update a Supervisor Agent.
+
+  Updates a Supervisor Agent. The fields that are required depend on the paths
+  specified in update_mask. Only fields included in the mask will be updated.
+
+  Arguments:
+    NAME: The resource name of the SupervisorAgent. Format:
+      supervisor-agents/{supervisor_agent_id}
+    UPDATE_MASK: Field mask for fields to be updated.
+    DISPLAY_NAME: The display name of the Supervisor Agent, unique at workspace level.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(2)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only NAME, UPDATE_MASK as positional arguments. Provide 'display_name' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(3)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updateSupervisorAgentJson.Unmarshal(&updateSupervisorAgentReq.SupervisorAgent)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		updateSupervisorAgentReq.Name = args[0]
+		if args[1] != "" {
+			updateMaskArray := strings.Split(args[1], ",")
+			updateSupervisorAgentReq.UpdateMask = *fieldmask.New(updateMaskArray)
+		}
+		if !cmd.Flags().Changed("json") {
+			updateSupervisorAgentReq.SupervisorAgent.DisplayName = args[2]
+		}
+
+		response, err := w.SupervisorAgents.UpdateSupervisorAgent(ctx, updateSupervisorAgentReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateSupervisorAgentOverrides {
+		fn(cmd, &updateSupervisorAgentReq)
+	}
+
+	return cmd
+}
+
+// start update-tool command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateToolOverrides []func(
+	*cobra.Command,
+	*supervisoragents.UpdateToolRequest,
+)
+
+func newUpdateTool() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateToolReq supervisoragents.UpdateToolRequest
+	updateToolReq.Tool = supervisoragents.Tool{}
+	var updateToolJson flags.JsonFlag
+
+	cmd.Flags().Var(&updateToolJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: complex arg: app
+	cmd.Flags().StringVar(&updateToolReq.Tool.Description, "description", updateToolReq.Tool.Description, `Description of what this tool does (user-facing).`)
+	// TODO: complex arg: genie_space
+	// TODO: complex arg: knowledge_assistant
+	cmd.Flags().StringVar(&updateToolReq.Tool.Name, "name", updateToolReq.Tool.Name, `Full resource name: supervisor-agents/{supervisor_agent_id}/tools/{tool_id}.`)
+	// TODO: complex arg: uc_connection
+	// TODO: complex arg: uc_function
+	// TODO: complex arg: volume
+
+	cmd.Use = "update-tool NAME UPDATE_MASK TOOL_TYPE"
+	cmd.Short = `*Beta* Update a Tool.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Update a Tool.
+
+  Updates a Tool. Only the description field can be updated. To change
+  immutable fields such as tool type, spec, or tool ID, delete the tool and
+  recreate it.
+
+  Arguments:
+    NAME: Full resource name:
+      supervisor-agents/{supervisor_agent_id}/tools/{tool_id}
+    UPDATE_MASK: Field mask for fields to be updated.
+    TOOL_TYPE: Tool type. Must be one of: "genie_space", "knowledge_assistant",
+      "uc_function", "uc_connection", "uc_mcp", "app", "volume", "dashboard",
+      "serving_endpoint", "table", "vector_search_index", "catalog", "schema",
+      "supervisor_agent", "databricks_web_search", "skill". The legacy values
+      "lakeview_dashboard", "uc_table", and "web_search" are also accepted and
+      remain equivalent to "dashboard", "table", and "databricks_web_search"
+      respectively. The "databricks_web_search" tool_type maps to the
+      web_search spec field.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(2)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only NAME, UPDATE_MASK as positional arguments. Provide 'tool_type' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(3)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updateToolJson.Unmarshal(&updateToolReq.Tool)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		updateToolReq.Name = args[0]
+		if args[1] != "" {
+			updateMaskArray := strings.Split(args[1], ",")
+			updateToolReq.UpdateMask = *fieldmask.New(updateMaskArray)
+		}
+		if !cmd.Flags().Changed("json") {
+			updateToolReq.Tool.ToolType = args[2]
+		}
+
+		response, err := w.SupervisorAgents.UpdateTool(ctx, updateToolReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateToolOverrides {
+		fn(cmd, &updateToolReq)
+	}
+
+	return cmd
+}
+
+// end service SupervisorAgents
diff --git a/cmd/workspace/system-schemas/system-schemas.go b/cmd/workspace/system-schemas/system-schemas.go
old mode 100755
new mode 100644
index 8b41369ba37..f29cd30a16d
--- a/cmd/workspace/system-schemas/system-schemas.go
+++ b/cmd/workspace/system-schemas/system-schemas.go
@@ -20,14 +20,20 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "system-schemas",
-		Short: `A system schema is a schema that lives within the system catalog.`,
-		Long: `A system schema is a schema that lives within the system catalog. A system
+		Short: `*Public Preview* A system schema is a schema that lives within the system catalog.`,
+		Long: `This command is in Public Preview and may change without notice.
+
+A system schema is a schema that lives within the system catalog. A system
   schema may contain information about customer usage of Unity Catalog such as
-  audit-logs, billing-logs, lineage information, etc.`,
+  audit logs, billing logs, and lineage information.`,
 		GroupID: "catalog",
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
 	// Add methods
 	cmd.AddCommand(newDisable())
 	cmd.AddCommand(newEnable())
@@ -56,8 +62,10 @@ func newDisable() *cobra.Command {
 	var disableReq catalog.DisableRequest
 
 	cmd.Use = "disable METASTORE_ID SCHEMA_NAME"
-	cmd.Short = `Disable a system schema.`
-	cmd.Long = `Disable a system schema.
+	cmd.Short = `*Public Preview* Disable a system schema.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Disable a system schema.
 
   Disables the system schema and removes it from the system catalog. The caller
   must be an account admin or a metastore admin.
@@ -67,6 +75,8 @@ func newDisable() *cobra.Command {
     SCHEMA_NAME: Full name of the system schema.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -120,8 +130,10 @@ func newEnable() *cobra.Command {
 	cmd.Flags().StringVar(&enableReq.CatalogName, "catalog-name", enableReq.CatalogName, `the catalog for which the system schema is to enabled in.`)
 
 	cmd.Use = "enable METASTORE_ID SCHEMA_NAME"
-	cmd.Short = `Enable a system schema.`
-	cmd.Long = `Enable a system schema.
+	cmd.Short = `*Public Preview* Enable a system schema.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Enable a system schema.
 
   Enables the system schema and adds it to the system catalog. The caller must
   be an account admin or a metastore admin.
@@ -131,6 +143,8 @@ func newEnable() *cobra.Command {
     SCHEMA_NAME: Full name of the system schema.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -204,8 +218,10 @@ func newList() *cobra.Command {
 	cmd.Flags().Lookup("max-results").Hidden = true
 
 	cmd.Use = "list METASTORE_ID"
-	cmd.Short = `List system schemas.`
-	cmd.Long = `List system schemas.
+	cmd.Short = `*Public Preview* List system schemas.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+List system schemas.
 
   Gets an array of system schemas for a metastore. The caller must be an account
   admin or a metastore admin.
@@ -222,6 +238,8 @@ func newList() *cobra.Command {
     METASTORE_ID: The ID for the metastore in which the system schema resides.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/workspace/table-constraints/table-constraints.go b/cmd/workspace/table-constraints/table-constraints.go
old mode 100755
new mode 100644
index 369907f0108..021cd317763
--- a/cmd/workspace/table-constraints/table-constraints.go
+++ b/cmd/workspace/table-constraints/table-constraints.go
@@ -3,6 +3,7 @@
 package table_constraints
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -26,9 +27,9 @@ func New() *cobra.Command {
 
   Primary and foreign keys are informational only and are not enforced. Foreign
   keys must reference a primary key in another table. This primary key is the
-  parent constraint of the foreign key and the table this primary key is on is
+  parent constraint of the foreign key, and the table this primary key is on is
   the parent table of the foreign key. Similarly, the foreign key is the child
-  constraint of its referenced primary key; the table of the foreign key is the
+  constraint of its referenced primary key. The table of the foreign key is the
   child table of the primary key.
 
   You can declare primary keys and foreign keys as part of the table
@@ -38,6 +39,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -83,6 +88,8 @@ func newCreate() *cobra.Command {
   table.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -101,7 +108,7 @@ func newCreate() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		response, err := w.TableConstraints.Create(ctx, createReq)
@@ -160,6 +167,8 @@ func newDelete() *cobra.Command {
       constraints.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(3)
diff --git a/cmd/workspace/tables/tables.go b/cmd/workspace/tables/tables.go
old mode 100755
new mode 100644
index 3003fdfd3a7..38a13f87171
--- a/cmd/workspace/tables/tables.go
+++ b/cmd/workspace/tables/tables.go
@@ -3,6 +3,7 @@
 package tables
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -34,6 +35,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -72,8 +77,10 @@ func newCreate() *cobra.Command {
 	// TODO: map via StringToStringVar: properties
 
 	cmd.Use = "create NAME CATALOG_NAME SCHEMA_NAME TABLE_TYPE DATA_SOURCE_FORMAT STORAGE_LOCATION"
-	cmd.Short = `Create a table.`
-	cmd.Long = `Create a table.
+	cmd.Short = `*Public Preview* Create a table.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Create a table.
 
   Creates a new table in the specified catalog and schema.
 
@@ -152,12 +159,14 @@ func newCreate() *cobra.Command {
     STORAGE_LOCATION: Storage root URL for table (for **MANAGED**, **EXTERNAL** tables).`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'catalog_name', 'schema_name', 'table_type', 'data_source_format', 'storage_location' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'catalog_name', 'schema_name', 'table_type', 'data_source_format', 'storage_location' in your JSON input")
 			}
 			return nil
 		}
@@ -257,6 +266,8 @@ func newDelete() *cobra.Command {
     FULL_NAME: Full name of the table.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -320,6 +331,8 @@ func newExists() *cobra.Command {
     FULL_NAME: Full name of the table.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -387,6 +400,8 @@ func newGet() *cobra.Command {
     FULL_NAME: Full name of the table.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -480,6 +495,8 @@ func newList() *cobra.Command {
     SCHEMA_NAME: Parent schema of tables.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -572,6 +589,8 @@ func newListSummaries() *cobra.Command {
     CATALOG_NAME: Name of parent catalog for tables of interest.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -644,6 +663,8 @@ func newUpdate() *cobra.Command {
 	cmd.Hidden = true
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/workspace/tag-policies/tag-policies.go b/cmd/workspace/tag-policies/tag-policies.go
old mode 100755
new mode 100644
index 178d9b399a4..82c31bd1fb4
--- a/cmd/workspace/tag-policies/tag-policies.go
+++ b/cmd/workspace/tag-policies/tag-policies.go
@@ -3,6 +3,7 @@
 package tag_policies
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -32,6 +33,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreateTagPolicy())
 	cmd.AddCommand(newDeleteTagPolicy())
@@ -80,12 +85,14 @@ func newCreateTagPolicy() *cobra.Command {
   [Tag Policy Terraform documentation]: https://registry.terraform.io/providers/databricks/databricks/latest/docs/resources/tag_policy`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'tag_key' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'tag_key' in your JSON input")
 			}
 			return nil
 		}
@@ -159,6 +166,8 @@ func newDeleteTagPolicy() *cobra.Command {
   [Tag Policy Terraform documentation]: https://registry.terraform.io/providers/databricks/databricks/latest/docs/resources/tag_policy`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -217,6 +226,8 @@ func newGetTagPolicy() *cobra.Command {
   [Tag Policy Terraform documentation]: https://registry.terraform.io/providers/databricks/databricks/latest/docs/data-sources/tag_policy`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -289,6 +300,8 @@ func newListTagPolicies() *cobra.Command {
   [Tag Policy Terraform documentation]: https://registry.terraform.io/providers/databricks/databricks/latest/docs/data-sources/tag_policies`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -370,6 +383,8 @@ func newUpdateTagPolicy() *cobra.Command {
       future.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
diff --git a/cmd/workspace/temporary-path-credentials/temporary-path-credentials.go b/cmd/workspace/temporary-path-credentials/temporary-path-credentials.go
old mode 100755
new mode 100644
index 98eda3ccf54..aae3cdd0d0d
--- a/cmd/workspace/temporary-path-credentials/temporary-path-credentials.go
+++ b/cmd/workspace/temporary-path-credentials/temporary-path-credentials.go
@@ -3,6 +3,7 @@
 package temporary_path_credentials
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -20,37 +21,40 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "temporary-path-credentials",
-		Short: `Temporary Path Credentials refer to short-lived, downscoped credentials used to access external cloud storage locations registered in Databricks.`,
-		Long: `Temporary Path Credentials refer to short-lived, downscoped credentials used
-  to access external cloud storage locations registered in Databricks. These
-  credentials are employed to provide secure and time-limited access to data in
-  cloud environments such as AWS, Azure, and Google Cloud. Each cloud provider
-  has its own type of credentials: AWS uses temporary session tokens via AWS
-  Security Token Service (STS), Azure utilizes Shared Access Signatures (SAS)
-  for its data storage services, and Google Cloud supports temporary credentials
+		Short: `Temporary Path Credentials are short-lived, downscoped credentials used to access external cloud storage locations registered in Databricks.`,
+		Long: `Temporary Path Credentials are short-lived, downscoped credentials used to
+  access external cloud storage locations registered in Databricks. These
+  credentials provide secure and time-limited access to data in cloud
+  environments such as AWS, Azure, and Google Cloud. Each cloud provider has its
+  own type of credentials: AWS uses temporary session tokens through AWS
+  Security Token Service (STS), Azure uses Shared Access Signatures (SAS) for
+  its data storage services, and Google Cloud supports temporary credentials
   through OAuth 2.0.
 
   Temporary path credentials ensure that data access is limited in scope and
   duration, reducing the risk of unauthorized access or misuse. To use the
-  temporary path credentials API, a metastore admin needs to enable the
+  temporary path credentials API, a metastore admin must enable the
   external_access_enabled flag (off by default) at the metastore level. A user
-  needs to be granted the EXTERNAL USE LOCATION permission by external location
-  owner. For requests on existing external tables, user also needs to be granted
-  the EXTERNAL USE SCHEMA permission at the schema level by catalog admin.
+  must be granted the EXTERNAL USE LOCATION permission by the external location
+  owner. For requests on existing external tables and external volumes, the user
+  must also be granted the EXTERNAL USE SCHEMA permission at the schema level by
+  the catalog owner.
 
   Note that EXTERNAL USE SCHEMA is a schema level permission that can only be
-  granted by catalog admin explicitly and is not included in schema ownership or
-  ALL PRIVILEGES on the schema for security reasons. Similarly, EXTERNAL USE
-  LOCATION is an external location level permission that can only be granted by
-  external location owner explicitly and is not included in external location
-  ownership or ALL PRIVILEGES on the external location for security reasons.
-
-  This API only supports temporary path credentials for external locations and
-  external tables, and volumes will be supported in the future.`,
+  granted by the catalog owner explicitly and is not included in schema
+  ownership or ALL PRIVILEGES on the schema for security reasons. Similarly,
+  EXTERNAL USE LOCATION is an external location level permission that can only
+  be granted by the external location owner explicitly and is not included in
+  external location ownership or ALL PRIVILEGES on the external location for
+  security reasons.`,
 		GroupID: "catalog",
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newGenerateTemporaryPathCredentials())
 
@@ -102,12 +106,14 @@ func newGenerateTemporaryPathCredentials() *cobra.Command {
       Supported values: [PATH_CREATE_TABLE, PATH_READ, PATH_READ_WRITE]`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'url', 'operation' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'url', 'operation' in your JSON input")
 			}
 			return nil
 		}
diff --git a/cmd/workspace/temporary-table-credentials/temporary-table-credentials.go b/cmd/workspace/temporary-table-credentials/temporary-table-credentials.go
old mode 100755
new mode 100644
index ebc93e63ec1..7ec127cbb05
--- a/cmd/workspace/temporary-table-credentials/temporary-table-credentials.go
+++ b/cmd/workspace/temporary-table-credentials/temporary-table-credentials.go
@@ -18,28 +18,32 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "temporary-table-credentials",
-		Short: `Temporary Table Credentials refer to short-lived, downscoped credentials used to access cloud storage locations where table data is stored in Databricks.`,
-		Long: `Temporary Table Credentials refer to short-lived, downscoped credentials used
-  to access cloud storage locations where table data is stored in Databricks.
-  These credentials are employed to provide secure and time-limited access to
-  data in cloud environments such as AWS, Azure, and Google Cloud. Each cloud
-  provider has its own type of credentials: AWS uses temporary session tokens
-  via AWS Security Token Service (STS), Azure utilizes Shared Access Signatures
-  (SAS) for its data storage services, and Google Cloud supports temporary
-  credentials through OAuth 2.0.
+		Short: `Temporary Table Credentials are short-lived, downscoped credentials used to access cloud storage locations where table data is stored in Databricks.`,
+		Long: `Temporary Table Credentials are short-lived, downscoped credentials used to
+  access cloud storage locations where table data is stored in Databricks. These
+  credentials provide secure and time-limited access to data in cloud
+  environments such as AWS, Azure, and Google Cloud. Each cloud provider has its
+  own type of credentials: AWS uses temporary session tokens through AWS
+  Security Token Service (STS), Azure uses Shared Access Signatures (SAS) for
+  its data storage services, and Google Cloud supports temporary credentials
+  through OAuth 2.0.
 
   Temporary table credentials ensure that data access is limited in scope and
   duration, reducing the risk of unauthorized access or misuse. To use the
-  temporary table credentials API, a metastore admin needs to enable the
-  external_access_enabled flag (off by default) at the metastore level, and user
-  needs to be granted the EXTERNAL USE SCHEMA permission at the schema level by
-  catalog admin. Note that EXTERNAL USE SCHEMA is a schema level permission that
-  can only be granted by catalog admin explicitly and is not included in schema
-  ownership or ALL PRIVILEGES on the schema for security reasons.`,
+  temporary table credentials API, a metastore admin must enable the
+  external_access_enabled flag (off by default) at the metastore level, and the
+  user must be granted the EXTERNAL USE SCHEMA permission at the schema level by
+  the catalog owner. Note that EXTERNAL USE SCHEMA is a schema level permission
+  that can only be granted by the catalog owner explicitly and is not included
+  in schema ownership or ALL PRIVILEGES on the schema for security reasons.`,
 		GroupID: "catalog",
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newGenerateTemporaryTableCredentials())
 
@@ -81,6 +85,8 @@ func newGenerateTemporaryTableCredentials() *cobra.Command {
   the parent schema and this privilege can only be granted by catalog owners.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
diff --git a/cmd/workspace/temporary-volume-credentials/temporary-volume-credentials.go b/cmd/workspace/temporary-volume-credentials/temporary-volume-credentials.go
new file mode 100644
index 00000000000..d503dba3a08
--- /dev/null
+++ b/cmd/workspace/temporary-volume-credentials/temporary-volume-credentials.go
@@ -0,0 +1,138 @@
+// Code generated from OpenAPI specs by Databricks SDK Generator. DO NOT EDIT.
+
+package temporary_volume_credentials
+
+import (
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/databricks-sdk-go/service/catalog"
+	"github.com/spf13/cobra"
+)
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var cmdOverrides []func(*cobra.Command)
+
+func New() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "temporary-volume-credentials",
+		Short: `*Public Preview* Temporary Volume Credentials are short-lived, downscoped credentials used to access cloud storage locations where volume data is stored in Databricks.`,
+		Long: `This command is in Public Preview and may change without notice.
+
+Temporary Volume Credentials are short-lived, downscoped credentials used to
+  access cloud storage locations where volume data is stored in Databricks.
+  These credentials provide secure and time-limited access to data in cloud
+  environments such as AWS, Azure, and Google Cloud. Each cloud provider has its
+  own type of credentials: AWS uses temporary session tokens through AWS
+  Security Token Service (STS), Azure uses Shared Access Signatures (SAS) for
+  its data storage services, and Google Cloud supports temporary credentials
+  through OAuth 2.0.
+
+  Temporary volume credentials ensure that data access is limited in scope and
+  duration, reducing the risk of unauthorized access or misuse. To use the
+  temporary volume credentials API, a metastore admin must enable the
+  external_access_enabled flag (off by default) at the metastore level, and the
+  user must be granted the EXTERNAL USE SCHEMA permission at the schema level by
+  the catalog owner. Note that EXTERNAL USE SCHEMA is a schema level permission
+  that can only be granted by the catalog owner explicitly and is not included
+  in schema ownership or ALL PRIVILEGES on the schema for security reasons.`,
+		GroupID: "catalog",
+		RunE:    root.ReportUnknownSubcommand,
+	}
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
+	// Add methods
+	cmd.AddCommand(newGenerateTemporaryVolumeCredentials())
+
+	// Apply optional overrides to this command.
+	for _, fn := range cmdOverrides {
+		fn(cmd)
+	}
+
+	return cmd
+}
+
+// start generate-temporary-volume-credentials command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var generateTemporaryVolumeCredentialsOverrides []func(
+	*cobra.Command,
+	*catalog.GenerateTemporaryVolumeCredentialRequest,
+)
+
+func newGenerateTemporaryVolumeCredentials() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var generateTemporaryVolumeCredentialsReq catalog.GenerateTemporaryVolumeCredentialRequest
+	var generateTemporaryVolumeCredentialsJson flags.JsonFlag
+
+	cmd.Flags().Var(&generateTemporaryVolumeCredentialsJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().Var(&generateTemporaryVolumeCredentialsReq.Operation, "operation", `The operation performed against the volume data, either READ_VOLUME or WRITE_VOLUME. Supported values: [READ_VOLUME, WRITE_VOLUME]`)
+	cmd.Flags().StringVar(&generateTemporaryVolumeCredentialsReq.VolumeId, "volume-id", generateTemporaryVolumeCredentialsReq.VolumeId, `Id of the volume to read or write.`)
+
+	cmd.Use = "generate-temporary-volume-credentials"
+	cmd.Short = `*Public Preview* Generate a temporary volume credential.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Generate a temporary volume credential.
+
+  Get a short-lived credential for directly accessing the volume data on cloud
+  storage. The metastore must have **external_access_enabled** flag set to true
+  (default false). The caller must have the **EXTERNAL_USE_SCHEMA** privilege on
+  the parent schema and this privilege can only be granted by catalog owners.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(0)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := generateTemporaryVolumeCredentialsJson.Unmarshal(&generateTemporaryVolumeCredentialsReq)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+
+		response, err := w.TemporaryVolumeCredentials.GenerateTemporaryVolumeCredentials(ctx, generateTemporaryVolumeCredentialsReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range generateTemporaryVolumeCredentialsOverrides {
+		fn(cmd, &generateTemporaryVolumeCredentialsReq)
+	}
+
+	return cmd
+}
+
+// end service TemporaryVolumeCredentials
diff --git a/cmd/workspace/token-management/token-management.go b/cmd/workspace/token-management/token-management.go
old mode 100755
new mode 100644
index b62e185f460..ebbcdd9d8dd
--- a/cmd/workspace/token-management/token-management.go
+++ b/cmd/workspace/token-management/token-management.go
@@ -3,6 +3,7 @@
 package token_management
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -28,6 +29,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreateOboToken())
 	cmd.AddCommand(newDelete())
@@ -37,6 +42,7 @@ func New() *cobra.Command {
 	cmd.AddCommand(newList())
 	cmd.AddCommand(newSetPermissions())
 	cmd.AddCommand(newUpdatePermissions())
+	cmd.AddCommand(newUpdateTokenManagement())
 
 	// Apply optional overrides to this command.
 	for _, fn := range cmdOverrides {
@@ -63,6 +69,7 @@ func newCreateOboToken() *cobra.Command {
 
 	cmd.Flags().Var(&createOboTokenJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
+	cmd.Flags().BoolVar(&createOboTokenReq.AutoscopeEnabled, "autoscope-enabled", createOboTokenReq.AutoscopeEnabled, `Whether to enable autoscoping for this token.`)
 	cmd.Flags().StringVar(&createOboTokenReq.Comment, "comment", createOboTokenReq.Comment, `Comment that describes the purpose of the token.`)
 	cmd.Flags().Int64Var(&createOboTokenReq.LifetimeSeconds, "lifetime-seconds", createOboTokenReq.LifetimeSeconds, `The number of seconds before the token expires.`)
 	// TODO: array: scopes
@@ -77,12 +84,14 @@ func newCreateOboToken() *cobra.Command {
     APPLICATION_ID: Application ID of the service principal.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'application_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'application_id' in your JSON input")
 			}
 			return nil
 		}
@@ -121,7 +130,7 @@ func newCreateOboToken() *cobra.Command {
 				args = append(args, id)
 			}
 			if len(args) != 1 {
-				return fmt.Errorf("expected to have application id of the service principal")
+				return errors.New("expected to have application id of the service principal")
 			}
 			createOboTokenReq.ApplicationId = args[0]
 
@@ -171,6 +180,8 @@ func newDelete() *cobra.Command {
     TOKEN_ID: The ID of the token to revoke.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -192,7 +203,7 @@ func newDelete() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the id of the token to revoke")
+			return errors.New("expected to have the id of the token to revoke")
 		}
 		deleteReq.TokenId = args[0]
 
@@ -239,6 +250,8 @@ func newGet() *cobra.Command {
     TOKEN_ID: The ID of the token to get.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -260,7 +273,7 @@ func newGet() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the id of the token to get")
+			return errors.New("expected to have the id of the token to get")
 		}
 		getReq.TokenId = args[0]
 
@@ -302,6 +315,8 @@ func newGetPermissionLevels() *cobra.Command {
   Gets the permission levels that a user can have on an object.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -346,6 +361,8 @@ func newGetPermissions() *cobra.Command {
   root object.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -404,6 +421,8 @@ func newList() *cobra.Command {
   Lists all tokens associated with the specified workspace or user.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -466,6 +485,8 @@ func newSetPermissions() *cobra.Command {
   permissions from their root object.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -537,6 +558,8 @@ func newUpdatePermissions() *cobra.Command {
   their root object.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -581,4 +604,80 @@ func newUpdatePermissions() *cobra.Command {
 	return cmd
 }
 
+// start update-token-management command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateTokenManagementOverrides []func(
+	*cobra.Command,
+	*settings.UpdateTokenManagementRequest,
+)
+
+func newUpdateTokenManagement() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateTokenManagementReq settings.UpdateTokenManagementRequest
+	var updateTokenManagementJson flags.JsonFlag
+
+	cmd.Flags().Var(&updateTokenManagementJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Use = "update-token-management TOKEN_ID"
+	cmd.Short = `Update an on-behalf token.`
+	cmd.Long = `Update an on-behalf token.
+
+  Updates a token, specified by its ID.
+
+  Arguments:
+    TOKEN_ID: ID of the token.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updateTokenManagementJson.Unmarshal(&updateTokenManagementReq)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		} else {
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
+		}
+		updateTokenManagementReq.TokenId = args[0]
+
+		response, err := w.TokenManagement.UpdateTokenManagement(ctx, updateTokenManagementReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateTokenManagementOverrides {
+		fn(cmd, &updateTokenManagementReq)
+	}
+
+	return cmd
+}
+
 // end service TokenManagement
diff --git a/cmd/workspace/tokens/tokens.go b/cmd/workspace/tokens/tokens.go
old mode 100755
new mode 100644
index 5acda52a379..40ca4b786e9
--- a/cmd/workspace/tokens/tokens.go
+++ b/cmd/workspace/tokens/tokens.go
@@ -3,6 +3,7 @@
 package tokens
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -27,10 +28,15 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
 	cmd.AddCommand(newList())
+	cmd.AddCommand(newUpdate())
 
 	// Apply optional overrides to this command.
 	for _, fn := range cmdOverrides {
@@ -57,6 +63,7 @@ func newCreate() *cobra.Command {
 
 	cmd.Flags().Var(&createJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
+	cmd.Flags().BoolVar(&createReq.AutoscopeEnabled, "autoscope-enabled", createReq.AutoscopeEnabled, `Whether to enable autoscoping for this token.`)
 	cmd.Flags().StringVar(&createReq.Comment, "comment", createReq.Comment, `Optional description to attach to the token.`)
 	cmd.Flags().Int64Var(&createReq.LifetimeSeconds, "lifetime-seconds", createReq.LifetimeSeconds, `The lifetime of the token, in seconds.`)
 	// TODO: array: scopes
@@ -71,6 +78,8 @@ func newCreate() *cobra.Command {
   an error **QUOTA_EXCEEDED**.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -145,12 +154,14 @@ func newDelete() *cobra.Command {
     TOKEN_ID: The ID of the token to be revoked.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'token_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'token_id' in your JSON input")
 			}
 			return nil
 		}
@@ -189,7 +200,7 @@ func newDelete() *cobra.Command {
 				args = append(args, id)
 			}
 			if len(args) != 1 {
-				return fmt.Errorf("expected to have the id of the token to be revoked")
+				return errors.New("expected to have the id of the token to be revoked")
 			}
 			deleteReq.TokenId = args[0]
 		}
@@ -240,6 +251,8 @@ func newList() *cobra.Command {
   Lists all the valid tokens for a user-workspace pair.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -268,4 +281,83 @@ func newList() *cobra.Command {
 	return cmd
 }
 
+// start update command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateOverrides []func(
+	*cobra.Command,
+	*settings.UpdateTokenRequest,
+)
+
+func newUpdate() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateReq settings.UpdateTokenRequest
+	var updateJson flags.JsonFlag
+
+	cmd.Flags().Var(&updateJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Use = "update TOKEN_ID"
+	cmd.Short = `Update a user token.`
+	cmd.Long = `Update a user token.
+
+  Updates the comment or scopes of a token.
+
+  If a token with the specified ID is not valid, this call returns an error
+  **NOT_FOUND**.
+
+  Arguments:
+    TOKEN_ID: The SHA-256 hash of the token to be updated.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updateJson.Unmarshal(&updateReq)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		} else {
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
+		}
+		updateReq.TokenId = args[0]
+
+		response, err := w.Tokens.Update(ctx, updateReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateOverrides {
+		fn(cmd, &updateReq)
+	}
+
+	return cmd
+}
+
 // end service Tokens
diff --git a/cmd/workspace/users-v2/users-v2.go b/cmd/workspace/users-v2/users-v2.go
old mode 100755
new mode 100644
index e54d8c2377f..b3c3b08b6b5
--- a/cmd/workspace/users-v2/users-v2.go
+++ b/cmd/workspace/users-v2/users-v2.go
@@ -20,8 +20,10 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "users-v2",
-		Short: `User identities recognized by Databricks and represented by email addresses.`,
-		Long: `User identities recognized by Databricks and represented by email addresses.
+		Short: `*Public Preview* User identities recognized by Databricks and represented by email addresses.`,
+		Long: `This command is in Public Preview and may change without notice.
+
+User identities recognized by Databricks and represented by email addresses.
 
   Databricks recommends using SCIM provisioning to sync users and groups
   automatically from your identity provider to your Databricks workspace. SCIM
@@ -36,6 +38,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -86,13 +92,17 @@ func newCreate() *cobra.Command {
 	cmd.Flags().StringVar(&createReq.UserName, "user-name", createReq.UserName, `Email address of the Databricks user.`)
 
 	cmd.Use = "create"
-	cmd.Short = `Create a new user.`
-	cmd.Long = `Create a new user.
+	cmd.Short = `*Public Preview* Create a new user.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Create a new user.
 
   Creates a new user in the Databricks workspace. This new user will also be
   added to the Databricks account.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -152,8 +162,10 @@ func newDelete() *cobra.Command {
 	var deleteReq iam.DeleteUserRequest
 
 	cmd.Use = "delete ID"
-	cmd.Short = `Delete a user.`
-	cmd.Long = `Delete a user.
+	cmd.Short = `*Public Preview* Delete a user.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Delete a user.
 
   Deletes a user. Deleting a user from a Databricks workspace also removes
   objects associated with the user.
@@ -162,6 +174,8 @@ func newDelete() *cobra.Command {
     ID: Unique ID for a user in the Databricks workspace.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -217,8 +231,10 @@ func newGet() *cobra.Command {
 	cmd.Flags().IntVar(&getReq.StartIndex, "start-index", getReq.StartIndex, `Specifies the index of the first result.`)
 
 	cmd.Use = "get ID"
-	cmd.Short = `Get user details.`
-	cmd.Long = `Get user details.
+	cmd.Short = `*Public Preview* Get user details.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get user details.
 
   Gets information for a specific user in Databricks workspace.
 
@@ -226,6 +242,8 @@ func newGet() *cobra.Command {
     ID: Unique ID for a user in the Databricks workspace.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -274,12 +292,16 @@ func newGetPermissionLevels() *cobra.Command {
 	var getPermissionLevelsReq iam.GetPasswordPermissionLevelsRequest
 
 	cmd.Use = "get-permission-levels"
-	cmd.Short = `Get password permission levels.`
-	cmd.Long = `Get password permission levels.
+	cmd.Short = `*Public Preview* Get password permission levels.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get password permission levels.
 
   Gets the permission levels that a user can have on an object.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -321,13 +343,17 @@ func newGetPermissions() *cobra.Command {
 	var getPermissionsReq iam.GetPasswordPermissionsRequest
 
 	cmd.Use = "get-permissions"
-	cmd.Short = `Get password permissions.`
-	cmd.Long = `Get password permissions.
+	cmd.Short = `*Public Preview* Get password permissions.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Get password permissions.
 
   Gets the permissions of all passwords. Passwords can inherit permissions from
   their root object.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -388,12 +414,16 @@ func newList() *cobra.Command {
 	cmd.Flags().Lookup("count").Hidden = true
 
 	cmd.Use = "list"
-	cmd.Short = `List users.`
-	cmd.Long = `List users.
+	cmd.Short = `*Public Preview* List users.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+List users.
 
   Gets details for all the users associated with a Databricks workspace.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -449,16 +479,21 @@ func newPatch() *cobra.Command {
 	// TODO: array: schemas
 
 	cmd.Use = "patch ID"
-	cmd.Short = `Update user details.`
-	cmd.Long = `Update user details.
+	cmd.Short = `*Public Preview* Update user details.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Update user details.
 
   Partially updates a user resource by applying the supplied operations on
-  specific user attributes.
+  specific user attributes. The userName and emails attributes cannot be
+  updated through this API; any supplied changes to them are ignored (no-op).
 
   Arguments:
     ID: Unique ID in the Databricks workspace.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -523,14 +558,18 @@ func newSetPermissions() *cobra.Command {
 	// TODO: array: access_control_list
 
 	cmd.Use = "set-permissions"
-	cmd.Short = `Set password permissions.`
-	cmd.Long = `Set password permissions.
+	cmd.Short = `*Public Preview* Set password permissions.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Set password permissions.
 
   Sets permissions on an object, replacing existing permissions if they exist.
   Deletes all direct permissions if none are specified. Objects can inherit
   permissions from their root object.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -604,15 +643,21 @@ func newUpdate() *cobra.Command {
 	cmd.Flags().StringVar(&updateReq.UserName, "user-name", updateReq.UserName, `Email address of the Databricks user.`)
 
 	cmd.Use = "update ID"
-	cmd.Short = `Replace a user.`
-	cmd.Long = `Replace a user.
+	cmd.Short = `*Public Preview* Replace a user.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Replace a user.
 
-  Replaces a user's information with the data supplied in request.
+  Replaces a user's information with the data supplied in request. The
+  userName and emails attributes cannot be updated through this API; any
+  supplied changes to them are ignored (no-op).
 
   Arguments:
     ID: Databricks user ID.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -677,13 +722,17 @@ func newUpdatePermissions() *cobra.Command {
 	// TODO: array: access_control_list
 
 	cmd.Use = "update-permissions"
-	cmd.Short = `Update password permissions.`
-	cmd.Long = `Update password permissions.
+	cmd.Short = `*Public Preview* Update password permissions.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Update password permissions.
 
   Updates the permissions on all passwords. Passwords can inherit permissions
   from their root object.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
diff --git a/cmd/workspace/vector-search-endpoints/vector-search-endpoints.go b/cmd/workspace/vector-search-endpoints/vector-search-endpoints.go
old mode 100755
new mode 100644
index 6a0afdd565c..bc4e7d83428
--- a/cmd/workspace/vector-search-endpoints/vector-search-endpoints.go
+++ b/cmd/workspace/vector-search-endpoints/vector-search-endpoints.go
@@ -3,6 +3,7 @@
 package vector_search_endpoints
 
 import (
+	"errors"
 	"fmt"
 	"time"
 
@@ -21,21 +22,29 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:     "vector-search-endpoints",
-		Short:   `**Endpoint**: Represents the compute resources to host vector search indexes.`,
-		Long:    `**Endpoint**: Represents the compute resources to host vector search indexes.`,
+		Short:   `**Endpoint**: Represents the compute resources to host AI Search indexes.`,
+		Long:    `**Endpoint**: Represents the compute resources to host AI Search indexes.`,
 		GroupID: "vectorsearch",
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreateEndpoint())
 	cmd.AddCommand(newDeleteEndpoint())
 	cmd.AddCommand(newGetEndpoint())
+	cmd.AddCommand(newGetPermissionLevels())
+	cmd.AddCommand(newGetPermissions())
 	cmd.AddCommand(newListEndpoints())
 	cmd.AddCommand(newPatchEndpoint())
 	cmd.AddCommand(newRetrieveUserVisibleMetrics())
+	cmd.AddCommand(newSetPermissions())
 	cmd.AddCommand(newUpdateEndpointBudgetPolicy())
 	cmd.AddCommand(newUpdateEndpointCustomTags())
+	cmd.AddCommand(newUpdatePermissions())
 
 	// Apply optional overrides to this command.
 	for _, fn := range cmdOverrides {
@@ -69,7 +78,7 @@ func newCreateEndpoint() *cobra.Command {
 	cmd.Flags().Var(&createEndpointJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Flags().StringVar(&createEndpointReq.BudgetPolicyId, "budget-policy-id", createEndpointReq.BudgetPolicyId, `The budget policy id to be applied.`)
-	cmd.Flags().Int64Var(&createEndpointReq.MinQps, "min-qps", createEndpointReq.MinQps, `Min QPS for the endpoint.`)
+	cmd.Flags().Int64Var(&createEndpointReq.TargetQps, "target-qps", createEndpointReq.TargetQps, `Target QPS for the endpoint.`)
 	cmd.Flags().StringVar(&createEndpointReq.UsagePolicyId, "usage-policy-id", createEndpointReq.UsagePolicyId, `The usage policy id to be applied once we've migrated to usage policies.`)
 
 	cmd.Use = "create-endpoint NAME ENDPOINT_TYPE"
@@ -79,17 +88,19 @@ func newCreateEndpoint() *cobra.Command {
   Create a new endpoint.
 
   Arguments:
-    NAME: Name of the vector search endpoint
+    NAME: Name of the AI Search endpoint
     ENDPOINT_TYPE: Type of endpoint
       Supported values: [STANDARD, STORAGE_OPTIMIZED]`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'endpoint_type' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'endpoint_type' in your JSON input")
 			}
 			return nil
 		}
@@ -181,12 +192,14 @@ func newDeleteEndpoint() *cobra.Command {
 	cmd.Short = `Delete an endpoint.`
 	cmd.Long = `Delete an endpoint.
 
-  Delete a vector search endpoint.
+  Delete an AI Search endpoint.
 
   Arguments:
-    ENDPOINT_NAME: Name of the vector search endpoint`
+    ENDPOINT_NAME: Name of the AI Search endpoint`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -237,12 +250,14 @@ func newGetEndpoint() *cobra.Command {
 	cmd.Short = `Get an endpoint.`
 	cmd.Long = `Get an endpoint.
 
-  Get details for a single vector search endpoint.
+  Get details for a single AI Search endpoint.
 
   Arguments:
     ENDPOINT_NAME: Name of the endpoint`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -276,6 +291,125 @@ func newGetEndpoint() *cobra.Command {
 	return cmd
 }
 
+// start get-permission-levels command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getPermissionLevelsOverrides []func(
+	*cobra.Command,
+	*vectorsearch.GetVectorSearchEndpointPermissionLevelsRequest,
+)
+
+func newGetPermissionLevels() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getPermissionLevelsReq vectorsearch.GetVectorSearchEndpointPermissionLevelsRequest
+
+	cmd.Use = "get-permission-levels ENDPOINT_ID"
+	cmd.Short = `Get vector search endpoint permission levels.`
+	cmd.Long = `Get vector search endpoint permission levels.
+
+  Gets the permission levels that a user can have on an object.
+
+  Arguments:
+    ENDPOINT_ID: The vector search endpoint for which to get or manage permissions.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getPermissionLevelsReq.EndpointId = args[0]
+
+		response, err := w.VectorSearchEndpoints.GetPermissionLevels(ctx, getPermissionLevelsReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getPermissionLevelsOverrides {
+		fn(cmd, &getPermissionLevelsReq)
+	}
+
+	return cmd
+}
+
+// start get-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getPermissionsOverrides []func(
+	*cobra.Command,
+	*vectorsearch.GetVectorSearchEndpointPermissionsRequest,
+)
+
+func newGetPermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getPermissionsReq vectorsearch.GetVectorSearchEndpointPermissionsRequest
+
+	cmd.Use = "get-permissions ENDPOINT_ID"
+	cmd.Short = `Get vector search endpoint permissions.`
+	cmd.Long = `Get vector search endpoint permissions.
+
+  Gets the permissions of a vector search endpoint. Vector search endpoints can
+  inherit permissions from their root object.
+
+  Arguments:
+    ENDPOINT_ID: The vector search endpoint for which to get or manage permissions.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getPermissionsReq.EndpointId = args[0]
+
+		response, err := w.VectorSearchEndpoints.GetPermissions(ctx, getPermissionsReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getPermissionsOverrides {
+		fn(cmd, &getPermissionsReq)
+	}
+
+	return cmd
+}
+
 // start list-endpoints command
 
 // Slice with functions to override default command behavior.
@@ -305,9 +439,11 @@ func newListEndpoints() *cobra.Command {
 	cmd.Short = `List all endpoints.`
 	cmd.Long = `List all endpoints.
 
-  List all vector search endpoints in the workspace.`
+  List all AI Search endpoints in the workspace.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -359,18 +495,22 @@ func newPatchEndpoint() *cobra.Command {
 
 	cmd.Flags().Var(&patchEndpointJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
-	cmd.Flags().Int64Var(&patchEndpointReq.MinQps, "min-qps", patchEndpointReq.MinQps, `Min QPS for the endpoint.`)
+	cmd.Flags().Int64Var(&patchEndpointReq.TargetQps, "target-qps", patchEndpointReq.TargetQps, `Target QPS for the endpoint.`)
 
 	cmd.Use = "patch-endpoint ENDPOINT_NAME"
-	cmd.Short = `Update an endpoint.`
-	cmd.Long = `Update an endpoint.
+	cmd.Short = `*Public Preview* Update an endpoint.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Update an endpoint.
 
   Update an endpoint
 
   Arguments:
-    ENDPOINT_NAME: Name of the vector search endpoint`
+    ENDPOINT_NAME: Name of the AI Search endpoint`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -446,9 +586,11 @@ func newRetrieveUserVisibleMetrics() *cobra.Command {
   Retrieve user-visible metrics for an endpoint
 
   Arguments:
-    NAME: Vector search endpoint name`
+    NAME: AI Search endpoint name`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -494,6 +636,84 @@ func newRetrieveUserVisibleMetrics() *cobra.Command {
 	return cmd
 }
 
+// start set-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var setPermissionsOverrides []func(
+	*cobra.Command,
+	*vectorsearch.VectorSearchEndpointPermissionsRequest,
+)
+
+func newSetPermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var setPermissionsReq vectorsearch.VectorSearchEndpointPermissionsRequest
+	var setPermissionsJson flags.JsonFlag
+
+	cmd.Flags().Var(&setPermissionsJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: access_control_list
+
+	cmd.Use = "set-permissions ENDPOINT_ID"
+	cmd.Short = `Set vector search endpoint permissions.`
+	cmd.Long = `Set vector search endpoint permissions.
+
+  Sets permissions on an object, replacing existing permissions if they exist.
+  Deletes all direct permissions if none are specified. Objects can inherit
+  permissions from their root object.
+
+  Arguments:
+    ENDPOINT_ID: The vector search endpoint for which to get or manage permissions.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := setPermissionsJson.Unmarshal(&setPermissionsReq)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		setPermissionsReq.EndpointId = args[0]
+
+		response, err := w.VectorSearchEndpoints.SetPermissions(ctx, setPermissionsReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range setPermissionsOverrides {
+		fn(cmd, &setPermissionsReq)
+	}
+
+	return cmd
+}
+
 // start update-endpoint-budget-policy command
 
 // Slice with functions to override default command behavior.
@@ -512,22 +732,26 @@ func newUpdateEndpointBudgetPolicy() *cobra.Command {
 	cmd.Flags().Var(&updateEndpointBudgetPolicyJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Use = "update-endpoint-budget-policy ENDPOINT_NAME BUDGET_POLICY_ID"
-	cmd.Short = `Update the budget policy of an endpoint.`
-	cmd.Long = `Update the budget policy of an endpoint.
+	cmd.Short = `*Public Preview* Update the budget policy of an endpoint.`
+	cmd.Long = `This command is in Public Preview and may change without notice.
+
+Update the budget policy of an endpoint.
 
   Update the budget policy of an endpoint
 
   Arguments:
-    ENDPOINT_NAME: Name of the vector search endpoint
+    ENDPOINT_NAME: Name of the AI Search endpoint
     BUDGET_POLICY_ID: The budget policy id to be applied`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Public Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(1)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only ENDPOINT_NAME as positional arguments. Provide 'budget_policy_id' in your JSON input")
+				return errors.New("when --json flag is specified, provide only ENDPOINT_NAME as positional arguments. Provide 'budget_policy_id' in your JSON input")
 			}
 			return nil
 		}
@@ -599,12 +823,14 @@ func newUpdateEndpointCustomTags() *cobra.Command {
 	cmd.Long = `Update the custom tags of an endpoint.
 
   Arguments:
-    ENDPOINT_NAME: Name of the vector search endpoint`
+    ENDPOINT_NAME: Name of the AI Search endpoint`
 
 	// This command is being previewed; hide from help output.
 	cmd.Hidden = true
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -628,7 +854,7 @@ func newUpdateEndpointCustomTags() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 		updateEndpointCustomTagsReq.EndpointName = args[0]
 
@@ -652,4 +878,81 @@ func newUpdateEndpointCustomTags() *cobra.Command {
 	return cmd
 }
 
+// start update-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updatePermissionsOverrides []func(
+	*cobra.Command,
+	*vectorsearch.VectorSearchEndpointPermissionsRequest,
+)
+
+func newUpdatePermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updatePermissionsReq vectorsearch.VectorSearchEndpointPermissionsRequest
+	var updatePermissionsJson flags.JsonFlag
+
+	cmd.Flags().Var(&updatePermissionsJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: access_control_list
+
+	cmd.Use = "update-permissions ENDPOINT_ID"
+	cmd.Short = `Update vector search endpoint permissions.`
+	cmd.Long = `Update vector search endpoint permissions.
+
+  Updates the permissions on a vector search endpoint. Vector search endpoints
+  can inherit permissions from their root object.
+
+  Arguments:
+    ENDPOINT_ID: The vector search endpoint for which to get or manage permissions.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updatePermissionsJson.Unmarshal(&updatePermissionsReq)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		updatePermissionsReq.EndpointId = args[0]
+
+		response, err := w.VectorSearchEndpoints.UpdatePermissions(ctx, updatePermissionsReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updatePermissionsOverrides {
+		fn(cmd, &updatePermissionsReq)
+	}
+
+	return cmd
+}
+
 // end service VectorSearchEndpoints
diff --git a/cmd/workspace/vector-search-indexes/vector-search-indexes.go b/cmd/workspace/vector-search-indexes/vector-search-indexes.go
old mode 100755
new mode 100644
index 60802ee9f11..a1b9bddfcfa
--- a/cmd/workspace/vector-search-indexes/vector-search-indexes.go
+++ b/cmd/workspace/vector-search-indexes/vector-search-indexes.go
@@ -3,6 +3,7 @@
 package vector_search_indexes
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -24,16 +25,20 @@ func New() *cobra.Command {
 		Long: `**Index**: An efficient representation of your embedding vectors that supports
   real-time and efficient approximate nearest neighbor (ANN) search queries.
 
-  There are 2 types of Vector Search indexes: - **Delta Sync Index**: An index
-  that automatically syncs with a source Delta Table, automatically and
-  incrementally updating the index as the underlying data in the Delta Table
-  changes. - **Direct Vector Access Index**: An index that supports direct read
-  and write of vectors and metadata through our REST and SDK APIs. With this
-  model, the user manages index updates.`,
+  There are 2 types of AI Search indexes: - **Delta Sync Index**: An index that
+  automatically syncs with a source Delta Table, automatically and incrementally
+  updating the index as the underlying data in the Delta Table changes. -
+  **Direct Vector Access Index**: An index that supports direct read and write
+  of vectors and metadata through our REST and SDK APIs. With this model, the
+  user manages index updates.`,
 		GroupID: "vectorsearch",
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreateIndex())
 	cmd.AddCommand(newDeleteDataVectorIndex())
@@ -89,12 +94,14 @@ func newCreateIndex() *cobra.Command {
       Supported values: [DELTA_SYNC, DIRECT_ACCESS]`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'endpoint_name', 'primary_key', 'index_type' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'name', 'endpoint_name', 'primary_key', 'index_type' in your JSON input")
 			}
 			return nil
 		}
@@ -184,6 +191,8 @@ func newDeleteDataVectorIndex() *cobra.Command {
       Vector Access Index.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -207,7 +216,7 @@ func newDeleteDataVectorIndex() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 		deleteDataVectorIndexReq.IndexName = args[0]
 
@@ -253,6 +262,8 @@ func newDeleteIndex() *cobra.Command {
     INDEX_NAME: Name of the index`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -309,6 +320,8 @@ func newGetIndex() *cobra.Command {
     INDEX_NAME: Name of the index`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -377,6 +390,8 @@ func newListIndexes() *cobra.Command {
     ENDPOINT_NAME: Name of the endpoint`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -431,13 +446,16 @@ func newQueryIndex() *cobra.Command {
 	cmd.Flags().Var(&queryIndexJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	// TODO: array: columns_to_rerank
+	// TODO: array: facets
 	cmd.Flags().StringVar(&queryIndexReq.FiltersJson, "filters-json", queryIndexReq.FiltersJson, `JSON string representing query filters.`)
 	cmd.Flags().IntVar(&queryIndexReq.NumResults, "num-results", queryIndexReq.NumResults, `Number of results to return.`)
+	// TODO: array: query_columns
 	cmd.Flags().StringVar(&queryIndexReq.QueryText, "query-text", queryIndexReq.QueryText, `Query text.`)
 	cmd.Flags().StringVar(&queryIndexReq.QueryType, "query-type", queryIndexReq.QueryType, `The query type to use.`)
 	// TODO: array: query_vector
 	// TODO: complex arg: reranker
 	cmd.Flags().Float64Var(&queryIndexReq.ScoreThreshold, "score-threshold", queryIndexReq.ScoreThreshold, `Threshold for the approximate nearest neighbor search.`)
+	// TODO: array: sort_columns
 
 	cmd.Use = "query-index INDEX_NAME"
 	cmd.Short = `Query an index.`
@@ -449,6 +467,8 @@ func newQueryIndex() *cobra.Command {
     INDEX_NAME: Name of the vector index to query.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -472,7 +492,7 @@ func newQueryIndex() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 		queryIndexReq.IndexName = args[0]
 
@@ -527,6 +547,8 @@ func newQueryNextPage() *cobra.Command {
     INDEX_NAME: Name of the vector index to query.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -603,6 +625,8 @@ func newScanIndex() *cobra.Command {
     INDEX_NAME: Name of the vector index to scan.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -672,6 +696,8 @@ func newSyncIndex() *cobra.Command {
     INDEX_NAME: Name of the vector index to synchronize. Must be a Delta Sync Index.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -733,12 +759,14 @@ func newUpsertDataVectorIndex() *cobra.Command {
     INPUTS_JSON: JSON string representing the data to be upserted.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(1)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only INDEX_NAME as positional arguments. Provide 'inputs_json' in your JSON input")
+				return errors.New("when --json flag is specified, provide only INDEX_NAME as positional arguments. Provide 'inputs_json' in your JSON input")
 			}
 			return nil
 		}
diff --git a/cmd/workspace/volumes/volumes.go b/cmd/workspace/volumes/volumes.go
old mode 100755
new mode 100644
index 994c61656f4..1361f293c8c
--- a/cmd/workspace/volumes/volumes.go
+++ b/cmd/workspace/volumes/volumes.go
@@ -3,6 +3,7 @@
 package volumes
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -20,19 +21,23 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "volumes",
-		Short: `Volumes are a Unity Catalog (UC) capability for accessing, storing, governing, organizing and processing files.`,
+		Short: `Volumes are a Unity Catalog (UC) capability for accessing, storing, governing, organizing, and processing files.`,
 		Long: `Volumes are a Unity Catalog (UC) capability for accessing, storing, governing,
-  organizing and processing files. Use cases include running machine learning on
-  unstructured data such as image, audio, video, or PDF files, organizing data
-  sets during the data exploration stages in data science, working with
+  organizing, and processing files. Use cases include running machine learning
+  on unstructured data such as image, audio, video, or PDF files, organizing
+  data sets during the data exploration stages in data science, working with
   libraries that require access to the local file system on cluster machines,
   storing library and config files of arbitrary formats such as .whl or .txt
-  centrally and providing secure access across workspaces to it, or transforming
-  and querying non-tabular data files in ETL.`,
+  centrally and providing secure access to those files across workspaces, or
+  transforming and querying non-tabular data files in ETL.`,
 		GroupID: "catalog",
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newDelete())
@@ -104,12 +109,14 @@ func newCreate() *cobra.Command {
       Supported values: [EXTERNAL, MANAGED]`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'catalog_name', 'schema_name', 'name', 'volume_type' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'catalog_name', 'schema_name', 'name', 'volume_type' in your JSON input")
 			}
 			return nil
 		}
@@ -199,6 +206,8 @@ func newDelete() *cobra.Command {
     NAME: The three-level (fully qualified) name of the volume`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -220,7 +229,7 @@ func newDelete() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the three-level (fully qualified) name of the volume")
+			return errors.New("expected to have the three-level (fully qualified) name of the volume")
 		}
 		deleteReq.Name = args[0]
 
@@ -297,6 +306,8 @@ func newList() *cobra.Command {
     SCHEMA_NAME: The identifier of the schema`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -365,6 +376,8 @@ func newRead() *cobra.Command {
     NAME: The three-level (fully qualified) name of the volume`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -386,7 +399,7 @@ func newRead() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the three-level (fully qualified) name of the volume")
+			return errors.New("expected to have the three-level (fully qualified) name of the volume")
 		}
 		readReq.Name = args[0]
 
@@ -448,6 +461,8 @@ func newUpdate() *cobra.Command {
     NAME: The three-level (fully qualified) name of the volume`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -481,7 +496,7 @@ func newUpdate() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the three-level (fully qualified) name of the volume")
+			return errors.New("expected to have the three-level (fully qualified) name of the volume")
 		}
 		updateReq.Name = args[0]
 
diff --git a/cmd/workspace/warehouses/warehouses.go b/cmd/workspace/warehouses/warehouses.go
old mode 100755
new mode 100644
index ff7160ec8c5..2958b509e0c
--- a/cmd/workspace/warehouses/warehouses.go
+++ b/cmd/workspace/warehouses/warehouses.go
@@ -3,6 +3,7 @@
 package warehouses
 
 import (
+	"errors"
 	"fmt"
 	"strings"
 	"time"
@@ -31,6 +32,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreate())
 	cmd.AddCommand(newCreateDefaultWarehouseOverride())
@@ -93,8 +98,9 @@ func newCreate() *cobra.Command {
 	cmd.Flags().IntVar(&createReq.MinNumClusters, "min-num-clusters", createReq.MinNumClusters, `Minimum number of available clusters that will be maintained for this SQL warehouse.`)
 	cmd.Flags().StringVar(&createReq.Name, "name", createReq.Name, `Logical name for the cluster.`)
 	cmd.Flags().Var(&createReq.SpotInstancePolicy, "spot-instance-policy", `Configurations whether the endpoint should use spot instances. Supported values: [COST_OPTIMIZED, POLICY_UNSPECIFIED, RELIABILITY_OPTIMIZED]`)
+	cmd.Flags().IntVar(&createReq.StatementTimeout, "statement-timeout", createReq.StatementTimeout, `Warehouse statement timeout in seconds.`)
 	// TODO: complex arg: tags
-	cmd.Flags().Var(&createReq.WarehouseType, "warehouse-type", `Warehouse type: PRO or CLASSIC. Supported values: [CLASSIC, PRO, TYPE_UNSPECIFIED]`)
+	cmd.Flags().Var(&createReq.WarehouseType, "warehouse-type", `Warehouse type: PRO or CLASSIC. Supported values: [CLASSIC, PRO, REALTIME, TYPE_UNSPECIFIED]`)
 
 	cmd.Use = "create"
 	cmd.Short = `Create a warehouse.`
@@ -103,6 +109,8 @@ func newCreate() *cobra.Command {
   Creates a new SQL warehouse.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -187,8 +195,10 @@ func newCreateDefaultWarehouseOverride() *cobra.Command {
 	cmd.Flags().StringVar(&createDefaultWarehouseOverrideReq.DefaultWarehouseOverride.WarehouseId, "warehouse-id", createDefaultWarehouseOverrideReq.DefaultWarehouseOverride.WarehouseId, `The specific warehouse ID when type is CUSTOM.`)
 
 	cmd.Use = "create-default-warehouse-override DEFAULT_WAREHOUSE_OVERRIDE_ID TYPE"
-	cmd.Short = `Create default warehouse override.`
-	cmd.Long = `Create default warehouse override.
+	cmd.Short = `*Beta* Create default warehouse override.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Create default warehouse override.
 
   Creates a new default warehouse override for a user. Users can create their
   own override. Admins can create overrides for any user.
@@ -201,12 +211,14 @@ func newCreateDefaultWarehouseOverride() *cobra.Command {
       Supported values: [CUSTOM, LAST_SELECTED]`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(1)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only DEFAULT_WAREHOUSE_OVERRIDE_ID as positional arguments. Provide 'type' in your JSON input")
+				return errors.New("when --json flag is specified, provide only DEFAULT_WAREHOUSE_OVERRIDE_ID as positional arguments. Provide 'type' in your JSON input")
 			}
 			return nil
 		}
@@ -284,6 +296,8 @@ func newDelete() *cobra.Command {
     ID: Required. Id of the SQL warehouse.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -305,7 +319,7 @@ func newDelete() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have required")
+			return errors.New("expected to have required")
 		}
 		deleteReq.Id = args[0]
 
@@ -343,8 +357,10 @@ func newDeleteDefaultWarehouseOverride() *cobra.Command {
 	var deleteDefaultWarehouseOverrideReq sql.DeleteDefaultWarehouseOverrideRequest
 
 	cmd.Use = "delete-default-warehouse-override NAME"
-	cmd.Short = `Delete default warehouse override.`
-	cmd.Long = `Delete default warehouse override.
+	cmd.Short = `*Beta* Delete default warehouse override.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Delete default warehouse override.
 
   Deletes the default warehouse override for a user. Users can delete their own
   override. Admins can delete overrides for any user. After deletion, the
@@ -357,6 +373,8 @@ func newDeleteDefaultWarehouseOverride() *cobra.Command {
       string "me" for the current user.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -378,7 +396,7 @@ func newDeleteDefaultWarehouseOverride() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have required")
+			return errors.New("expected to have required")
 		}
 		deleteDefaultWarehouseOverrideReq.Name = args[0]
 
@@ -435,8 +453,9 @@ func newEdit() *cobra.Command {
 	cmd.Flags().IntVar(&editReq.MinNumClusters, "min-num-clusters", editReq.MinNumClusters, `Minimum number of available clusters that will be maintained for this SQL warehouse.`)
 	cmd.Flags().StringVar(&editReq.Name, "name", editReq.Name, `Logical name for the cluster.`)
 	cmd.Flags().Var(&editReq.SpotInstancePolicy, "spot-instance-policy", `Configurations whether the endpoint should use spot instances. Supported values: [COST_OPTIMIZED, POLICY_UNSPECIFIED, RELIABILITY_OPTIMIZED]`)
+	cmd.Flags().IntVar(&editReq.StatementTimeout, "statement-timeout", editReq.StatementTimeout, `Warehouse statement timeout in seconds.`)
 	// TODO: complex arg: tags
-	cmd.Flags().Var(&editReq.WarehouseType, "warehouse-type", `Warehouse type: PRO or CLASSIC. Supported values: [CLASSIC, PRO, TYPE_UNSPECIFIED]`)
+	cmd.Flags().Var(&editReq.WarehouseType, "warehouse-type", `Warehouse type: PRO or CLASSIC. Supported values: [CLASSIC, PRO, REALTIME, TYPE_UNSPECIFIED]`)
 
 	cmd.Use = "edit ID"
 	cmd.Short = `Update a warehouse.`
@@ -448,6 +467,8 @@ func newEdit() *cobra.Command {
     ID: Required. Id of the warehouse to configure.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -481,7 +502,7 @@ func newEdit() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have required")
+			return errors.New("expected to have required")
 		}
 		editReq.Id = args[0]
 
@@ -547,6 +568,8 @@ func newGet() *cobra.Command {
     ID: Required. Id of the SQL warehouse.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -568,7 +591,7 @@ func newGet() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have required")
+			return errors.New("expected to have required")
 		}
 		getReq.Id = args[0]
 
@@ -607,8 +630,10 @@ func newGetDefaultWarehouseOverride() *cobra.Command {
 	var getDefaultWarehouseOverrideReq sql.GetDefaultWarehouseOverrideRequest
 
 	cmd.Use = "get-default-warehouse-override NAME"
-	cmd.Short = `Get default warehouse override.`
-	cmd.Long = `Get default warehouse override.
+	cmd.Short = `*Beta* Get default warehouse override.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get default warehouse override.
 
   Returns the default warehouse override for a user. Users can fetch their own
   override. Admins can fetch overrides for any user. If no override exists, the
@@ -621,6 +646,8 @@ func newGetDefaultWarehouseOverride() *cobra.Command {
       string "me" for the current user.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -642,7 +669,7 @@ func newGetDefaultWarehouseOverride() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have required")
+			return errors.New("expected to have required")
 		}
 		getDefaultWarehouseOverrideReq.Name = args[0]
 
@@ -690,6 +717,8 @@ func newGetPermissionLevels() *cobra.Command {
     WAREHOUSE_ID: The SQL warehouse for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -711,7 +740,7 @@ func newGetPermissionLevels() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the sql warehouse for which to get or manage permissions")
+			return errors.New("expected to have the sql warehouse for which to get or manage permissions")
 		}
 		getPermissionLevelsReq.WarehouseId = args[0]
 
@@ -760,6 +789,8 @@ func newGetPermissions() *cobra.Command {
     WAREHOUSE_ID: The SQL warehouse for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -781,7 +812,7 @@ func newGetPermissions() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the sql warehouse for which to get or manage permissions")
+			return errors.New("expected to have the sql warehouse for which to get or manage permissions")
 		}
 		getPermissionsReq.WarehouseId = args[0]
 
@@ -824,6 +855,8 @@ func newGetWorkspaceWarehouseConfig() *cobra.Command {
   a workspace.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -884,6 +917,8 @@ func newList() *cobra.Command {
   Lists all SQL warehouses that a user has access to.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -946,13 +981,17 @@ func newListDefaultWarehouseOverrides() *cobra.Command {
 	cmd.Flags().Lookup("page-token").Hidden = true
 
 	cmd.Use = "list-default-warehouse-overrides"
-	cmd.Short = `List default warehouse overrides.`
-	cmd.Long = `List default warehouse overrides.
+	cmd.Short = `*Beta* List default warehouse overrides.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+List default warehouse overrides.
 
   Lists all default warehouse overrides in the workspace. Only workspace
   administrators can list all overrides.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -1018,6 +1057,8 @@ func newSetPermissions() *cobra.Command {
     WAREHOUSE_ID: The SQL warehouse for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -1051,7 +1092,7 @@ func newSetPermissions() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the sql warehouse for which to get or manage permissions")
+			return errors.New("expected to have the sql warehouse for which to get or manage permissions")
 		}
 		setPermissionsReq.WarehouseId = args[0]
 
@@ -1111,6 +1152,8 @@ func newSetWorkspaceWarehouseConfig() *cobra.Command {
   a workspace.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -1184,6 +1227,8 @@ func newStart() *cobra.Command {
     ID: Required. Id of the SQL warehouse.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -1205,7 +1250,7 @@ func newStart() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have required")
+			return errors.New("expected to have required")
 		}
 		startReq.Id = args[0]
 
@@ -1277,6 +1322,8 @@ func newStop() *cobra.Command {
     ID: Required. Id of the SQL warehouse.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -1298,7 +1345,7 @@ func newStop() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have required")
+			return errors.New("expected to have required")
 		}
 		stopReq.Id = args[0]
 
@@ -1363,8 +1410,10 @@ func newUpdateDefaultWarehouseOverride() *cobra.Command {
 	cmd.Flags().StringVar(&updateDefaultWarehouseOverrideReq.DefaultWarehouseOverride.WarehouseId, "warehouse-id", updateDefaultWarehouseOverrideReq.DefaultWarehouseOverride.WarehouseId, `The specific warehouse ID when type is CUSTOM.`)
 
 	cmd.Use = "update-default-warehouse-override NAME UPDATE_MASK TYPE"
-	cmd.Short = `Update default warehouse override.`
-	cmd.Long = `Update default warehouse override.
+	cmd.Short = `*Beta* Update default warehouse override.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Update default warehouse override.
 
   Updates an existing default warehouse override for a user. Users can update
   their own override. Admins can update overrides for any user.
@@ -1379,12 +1428,14 @@ func newUpdateDefaultWarehouseOverride() *cobra.Command {
       Supported values: [CUSTOM, LAST_SELECTED]`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(2)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, provide only NAME, UPDATE_MASK as positional arguments. Provide 'type' in your JSON input")
+				return errors.New("when --json flag is specified, provide only NAME, UPDATE_MASK as positional arguments. Provide 'type' in your JSON input")
 			}
 			return nil
 		}
@@ -1472,6 +1523,8 @@ func newUpdatePermissions() *cobra.Command {
     WAREHOUSE_ID: The SQL warehouse for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -1505,7 +1558,7 @@ func newUpdatePermissions() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the sql warehouse for which to get or manage permissions")
+			return errors.New("expected to have the sql warehouse for which to get or manage permissions")
 		}
 		updatePermissionsReq.WarehouseId = args[0]
 
diff --git a/cmd/workspace/workspace-bindings/workspace-bindings.go b/cmd/workspace/workspace-bindings/workspace-bindings.go
old mode 100755
new mode 100644
index abb927ce0fe..eac23b59514
--- a/cmd/workspace/workspace-bindings/workspace-bindings.go
+++ b/cmd/workspace/workspace-bindings/workspace-bindings.go
@@ -34,8 +34,8 @@ func New() *cobra.Command {
   owner of the securable.
 
   The original path (/api/2.1/unity-catalog/workspace-bindings/catalogs/{name})
-  is deprecated. Please use the new path
-  (/api/2.1/unity-catalog/bindings/{securable_type}/{securable_name}) which
+  is deprecated. Use the new path
+  (/api/2.1/unity-catalog/bindings/{securable_type}/{securable_name}), which
   introduces the ability to bind a securable in READ_ONLY mode (catalogs only).
 
   Securable types that support binding: - catalog - storage_credential -
@@ -44,6 +44,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newGet())
 	cmd.AddCommand(newGetBindings())
@@ -83,6 +87,8 @@ func newGet() *cobra.Command {
     NAME: The name of the catalog.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -164,6 +170,8 @@ func newGetBindings() *cobra.Command {
     SECURABLE_NAME: The name of the securable.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -232,6 +240,8 @@ func newUpdate() *cobra.Command {
     NAME: The name of the catalog.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -310,6 +320,8 @@ func newUpdateBindings() *cobra.Command {
     SECURABLE_NAME: The name of the securable.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
diff --git a/cmd/workspace/workspace-conf/workspace-conf.go b/cmd/workspace/workspace-conf/workspace-conf.go
old mode 100755
new mode 100644
index 9fc4e2b750a..8da40a559d7
--- a/cmd/workspace/workspace-conf/workspace-conf.go
+++ b/cmd/workspace/workspace-conf/workspace-conf.go
@@ -3,7 +3,7 @@
 package workspace_conf
 
 import (
-	"fmt"
+	"errors"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
@@ -26,6 +26,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newGetStatus())
 	cmd.AddCommand(newSetStatus())
@@ -59,6 +63,8 @@ func newGetStatus() *cobra.Command {
   Gets the configuration status for a workspace.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -117,6 +123,8 @@ func newSetStatus() *cobra.Command {
   it.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -135,7 +143,7 @@ func newSetStatus() *cobra.Command {
 				}
 			}
 		} else {
-			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+			return errors.New("please provide command input in JSON format by specifying the --json flag")
 		}
 
 		err = w.WorkspaceConf.SetStatus(ctx, setStatusReq)
diff --git a/cmd/workspace/workspace-entity-tag-assignments/workspace-entity-tag-assignments.go b/cmd/workspace/workspace-entity-tag-assignments/workspace-entity-tag-assignments.go
old mode 100755
new mode 100644
index c0154deaa9e..794ab2066f9
--- a/cmd/workspace/workspace-entity-tag-assignments/workspace-entity-tag-assignments.go
+++ b/cmd/workspace/workspace-entity-tag-assignments/workspace-entity-tag-assignments.go
@@ -3,6 +3,7 @@
 package workspace_entity_tag_assignments
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -26,6 +27,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newCreateTagAssignment())
 	cmd.AddCommand(newDeleteTagAssignment())
@@ -76,12 +81,14 @@ func newCreateTagAssignment() *cobra.Command {
       are not allowed`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'entity_type', 'entity_id', 'tag_key' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'entity_type', 'entity_id', 'tag_key' in your JSON input")
 			}
 			return nil
 		}
@@ -165,6 +172,8 @@ func newDeleteTagAssignment() *cobra.Command {
       are not allowed`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(3)
@@ -228,6 +237,8 @@ func newGetTagAssignment() *cobra.Command {
       are not allowed`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(3)
@@ -303,6 +314,8 @@ func newListTagAssignments() *cobra.Command {
       entity_id is the app name`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -386,6 +399,8 @@ func newUpdateTagAssignment() *cobra.Command {
       future.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(4)
diff --git a/cmd/workspace/workspace-iam-v2/workspace-iam-v2.go b/cmd/workspace/workspace-iam-v2/workspace-iam-v2.go
old mode 100755
new mode 100644
index 2596b765cbc..a08739cb176
--- a/cmd/workspace/workspace-iam-v2/workspace-iam-v2.go
+++ b/cmd/workspace/workspace-iam-v2/workspace-iam-v2.go
@@ -3,12 +3,15 @@
 package workspace_iam_v2
 
 import (
+	"errors"
 	"fmt"
+	"strings"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/databricks-sdk-go/common/types/fieldmask"
 	"github.com/databricks/databricks-sdk-go/service/iamv2"
 	"github.com/spf13/cobra"
 )
@@ -20,18 +23,57 @@ var cmdOverrides []func(*cobra.Command)
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "workspace-iam-v2",
-		Short: `These APIs are used to manage identities and the workspace access of these identities in <Databricks>.`,
+		Short: `These APIs are used to manage identities and the workspace access of these identities in Databricks.`,
 		Long: `These APIs are used to manage identities and the workspace access of these
-  identities in <Databricks>.`,
+  identities in Databricks.`,
 		GroupID: "iam",
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
+	cmd.AddCommand(newCreateDirectGroupMemberProxy())
+	cmd.AddCommand(newCreateGroupProxy())
+	cmd.AddCommand(newCreateServicePrincipalProxy())
+	cmd.AddCommand(newCreateUserProxy())
+	cmd.AddCommand(newCreateWorkspaceAssignmentDetailProxy())
+	cmd.AddCommand(newCreateWorkspaceAssignmentProxy())
+	cmd.AddCommand(newDeleteDirectGroupMemberProxy())
+	cmd.AddCommand(newDeleteGroupProxy())
+	cmd.AddCommand(newDeleteServicePrincipalProxy())
+	cmd.AddCommand(newDeleteUserProxy())
+	cmd.AddCommand(newDeleteWorkspaceAssignmentDetailProxy())
+	cmd.AddCommand(newDeleteWorkspaceAssignmentProxy())
+	cmd.AddCommand(newGetDirectGroupMemberProxy())
+	cmd.AddCommand(newGetExternalGroupProxy())
+	cmd.AddCommand(newGetExternalServicePrincipalProxy())
+	cmd.AddCommand(newGetExternalUserProxy())
+	cmd.AddCommand(newGetGroupProxy())
+	cmd.AddCommand(newGetServicePrincipalProxy())
+	cmd.AddCommand(newGetUserProxy())
 	cmd.AddCommand(newGetWorkspaceAccessDetailLocal())
+	cmd.AddCommand(newGetWorkspaceAssignmentDetailProxy())
+	cmd.AddCommand(newGetWorkspaceAssignmentProxy())
+	cmd.AddCommand(newGetWorkspaceIdentityDetail())
+	cmd.AddCommand(newListDirectGroupMembersProxy())
+	cmd.AddCommand(newListGroupsProxy())
+	cmd.AddCommand(newListServicePrincipalsProxy())
+	cmd.AddCommand(newListTransitiveParentGroupsProxy())
+	cmd.AddCommand(newListUsersProxy())
+	cmd.AddCommand(newListWorkspaceAssignmentDetailsProxy())
+	cmd.AddCommand(newListWorkspaceAssignmentsProxy())
 	cmd.AddCommand(newResolveGroupProxy())
 	cmd.AddCommand(newResolveServicePrincipalProxy())
 	cmd.AddCommand(newResolveUserProxy())
+	cmd.AddCommand(newUpdateGroupProxy())
+	cmd.AddCommand(newUpdateServicePrincipalProxy())
+	cmd.AddCommand(newUpdateUserProxy())
+	cmd.AddCommand(newUpdateWorkspaceAssignmentDetailProxy())
+	cmd.AddCommand(newUpdateWorkspaceAssignmentProxy())
+	cmd.AddCommand(newUpdateWorkspaceIdentityDetail())
 
 	// Apply optional overrides to this command.
 	for _, fn := range cmdOverrides {
@@ -41,41 +83,49 @@ func New() *cobra.Command {
 	return cmd
 }
 
-// start get-workspace-access-detail-local command
+// start create-direct-group-member-proxy command
 
 // Slice with functions to override default command behavior.
 // Functions can be added from the `init()` function in manually curated files in this directory.
-var getWorkspaceAccessDetailLocalOverrides []func(
+var createDirectGroupMemberProxyOverrides []func(
 	*cobra.Command,
-	*iamv2.GetWorkspaceAccessDetailLocalRequest,
+	*iamv2.CreateDirectGroupMemberProxyRequest,
 )
 
-func newGetWorkspaceAccessDetailLocal() *cobra.Command {
+func newCreateDirectGroupMemberProxy() *cobra.Command {
 	cmd := &cobra.Command{}
 
-	var getWorkspaceAccessDetailLocalReq iamv2.GetWorkspaceAccessDetailLocalRequest
+	var createDirectGroupMemberProxyReq iamv2.CreateDirectGroupMemberProxyRequest
+	createDirectGroupMemberProxyReq.DirectGroupMember = iamv2.DirectGroupMember{}
+	var createDirectGroupMemberProxyJson flags.JsonFlag
 
-	cmd.Flags().Var(&getWorkspaceAccessDetailLocalReq.View, "view", `Controls what fields are returned. Supported values: [BASIC, FULL]`)
+	cmd.Flags().Var(&createDirectGroupMemberProxyJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
-	cmd.Use = "get-workspace-access-detail-local PRINCIPAL_ID"
-	cmd.Short = `Get workspace access details for a principal.`
-	cmd.Long = `Get workspace access details for a principal.
+	cmd.Use = "create-direct-group-member-proxy GROUP_ID PRINCIPAL_ID"
+	cmd.Short = `*Beta* Create a direct group membership.`
+	cmd.Long = `This command is in Beta and may change without notice.
 
-  Returns the access details for a principal in the current workspace. Allows
-  for checking access details for any provisioned principal (user, service
-  principal, or group) in the current workspace. * Provisioned principal here
-  refers to one that has been synced into Databricks from the customer's IdP or
-  added explicitly to Databricks via SCIM/UI. Allows for passing in a "view"
-  parameter to control what fields are returned (BASIC by default or FULL).
+Create a direct group membership.
+
+  Creates a group membership (assigns a principal to a group).
 
   Arguments:
-    PRINCIPAL_ID: Required. The internal ID of the principal (user/sp/group) for which the
-      access details are being requested.`
+    GROUP_ID: Required. Internal ID of the group in Databricks.
+    PRINCIPAL_ID: Internal ID of the principal in Databricks.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
-		check := root.ExactArgs(1)
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(1)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only GROUP_ID as positional arguments. Provide 'principal_id' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(2)
 		return check(cmd, args)
 	}
 
@@ -84,12 +134,32 @@ func newGetWorkspaceAccessDetailLocal() *cobra.Command {
 		ctx := cmd.Context()
 		w := cmdctx.WorkspaceClient(ctx)
 
-		_, err = fmt.Sscan(args[0], &getWorkspaceAccessDetailLocalReq.PrincipalId)
+		if cmd.Flags().Changed("json") {
+			diags := createDirectGroupMemberProxyJson.Unmarshal(&createDirectGroupMemberProxyReq.DirectGroupMember)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		_, err = fmt.Sscan(args[0], &createDirectGroupMemberProxyReq.GroupId)
 		if err != nil {
-			return fmt.Errorf("invalid PRINCIPAL_ID: %s", args[0])
+			return fmt.Errorf("invalid GROUP_ID: %s", args[0])
 		}
 
-		response, err := w.WorkspaceIamV2.GetWorkspaceAccessDetailLocal(ctx, getWorkspaceAccessDetailLocalReq)
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[1], &createDirectGroupMemberProxyReq.DirectGroupMember.PrincipalId)
+			if err != nil {
+				return fmt.Errorf("invalid PRINCIPAL_ID: %s", args[1])
+			}
+
+		}
+
+		response, err := w.WorkspaceIamV2.CreateDirectGroupMemberProxy(ctx, createDirectGroupMemberProxyReq)
 		if err != nil {
 			return err
 		}
@@ -102,53 +172,151 @@ func newGetWorkspaceAccessDetailLocal() *cobra.Command {
 	cmd.ValidArgsFunction = cobra.NoFileCompletions
 
 	// Apply optional overrides to this command.
-	for _, fn := range getWorkspaceAccessDetailLocalOverrides {
-		fn(cmd, &getWorkspaceAccessDetailLocalReq)
+	for _, fn := range createDirectGroupMemberProxyOverrides {
+		fn(cmd, &createDirectGroupMemberProxyReq)
 	}
 
 	return cmd
 }
 
-// start resolve-group-proxy command
+// start create-group-proxy command
 
 // Slice with functions to override default command behavior.
 // Functions can be added from the `init()` function in manually curated files in this directory.
-var resolveGroupProxyOverrides []func(
+var createGroupProxyOverrides []func(
 	*cobra.Command,
-	*iamv2.ResolveGroupProxyRequest,
+	*iamv2.CreateGroupProxyRequest,
 )
 
-func newResolveGroupProxy() *cobra.Command {
+func newCreateGroupProxy() *cobra.Command {
 	cmd := &cobra.Command{}
 
-	var resolveGroupProxyReq iamv2.ResolveGroupProxyRequest
-	var resolveGroupProxyJson flags.JsonFlag
+	var createGroupProxyReq iamv2.CreateGroupProxyRequest
+	createGroupProxyReq.Group = iamv2.Group{}
+	var createGroupProxyJson flags.JsonFlag
 
-	cmd.Flags().Var(&resolveGroupProxyJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+	cmd.Flags().Var(&createGroupProxyJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
-	cmd.Use = "resolve-group-proxy EXTERNAL_ID"
-	cmd.Short = `Resolve an external group in the Databricks account.`
-	cmd.Long = `Resolve an external group in the Databricks account.
+	cmd.Flags().StringVar(&createGroupProxyReq.Group.ExternalId, "external-id", createGroupProxyReq.Group.ExternalId, `ExternalId of the group in the customer's IdP.`)
+	cmd.Flags().StringVar(&createGroupProxyReq.Group.GroupName, "group-name", createGroupProxyReq.Group.GroupName, `Display name of the group.`)
 
-  Resolves a group with the given external ID from the customer's IdP. If the
-  group does not exist, it will be created in the account. If the customer is
-  not onboarded onto Automatic Identity Management (AIM), this will return an
-  error.
+	cmd.Use = "create-group-proxy"
+	cmd.Short = `*Beta* Create a group in the account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Create a group in the account.
+
+  Creates a local group in the Databricks account that parents the calling
+  workspace and returns the created group. A local group is one that is not
+  synced from the customer's identity provider, and can be created whether or
+  not Account Identity Management (AIM) is enabled.
+
+  When AIM is enabled, supplying an external ID returns an error. To provision
+  the identity from your identity provider, resolve it by its external ID with
+  ResolveGroup; to read an existing external identity, use the ExternalGroup
+  resource.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(0)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := createGroupProxyJson.Unmarshal(&createGroupProxyReq.Group)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+
+		response, err := w.WorkspaceIamV2.CreateGroupProxy(ctx, createGroupProxyReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range createGroupProxyOverrides {
+		fn(cmd, &createGroupProxyReq)
+	}
+
+	return cmd
+}
+
+// start create-service-principal-proxy command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var createServicePrincipalProxyOverrides []func(
+	*cobra.Command,
+	*iamv2.CreateServicePrincipalProxyRequest,
+)
+
+func newCreateServicePrincipalProxy() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var createServicePrincipalProxyReq iamv2.CreateServicePrincipalProxyRequest
+	createServicePrincipalProxyReq.ServicePrincipal = iamv2.ServicePrincipal{}
+	var createServicePrincipalProxyJson flags.JsonFlag
+
+	cmd.Flags().Var(&createServicePrincipalProxyJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&createServicePrincipalProxyReq.ServicePrincipal.ExternalId, "external-id", createServicePrincipalProxyReq.ServicePrincipal.ExternalId, `ExternalId of the service principal in the customer's IdP.`)
+
+	cmd.Use = "create-service-principal-proxy DISPLAY_NAME ACCOUNT_SP_STATUS"
+	cmd.Short = `*Beta* Create a service principal in the account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Create a service principal in the account.
+
+  Creates a local service principal in the Databricks account that parents the
+  calling workspace and returns the created service principal. A local service
+  principal is one that is not synced from the customer's identity provider, and
+  can be created whether or not Account Identity Management (AIM) is enabled.
+
+  When AIM is enabled, supplying an external ID returns an error. To provision
+  the identity from your identity provider, resolve it by its external ID with
+  ResolveServicePrincipal; to read an existing external identity, use the
+  ExternalServicePrincipal resource.
 
   Arguments:
-    EXTERNAL_ID: Required. The external ID of the group in the customer's IdP.`
+    DISPLAY_NAME: Display name of the service principal.
+    ACCOUNT_SP_STATUS: The activity status of a service principal in a Databricks account.
+      Supported values: [ACTIVE, INACTIVE]`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'external_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'display_name', 'account_sp_status' in your JSON input")
 			}
 			return nil
 		}
-		check := root.ExactArgs(1)
+		check := root.ExactArgs(2)
 		return check(cmd, args)
 	}
 
@@ -158,7 +326,7 @@ func newResolveGroupProxy() *cobra.Command {
 		w := cmdctx.WorkspaceClient(ctx)
 
 		if cmd.Flags().Changed("json") {
-			diags := resolveGroupProxyJson.Unmarshal(&resolveGroupProxyReq)
+			diags := createServicePrincipalProxyJson.Unmarshal(&createServicePrincipalProxyReq.ServicePrincipal)
 			if diags.HasError() {
 				return diags.Error()
 			}
@@ -170,10 +338,17 @@ func newResolveGroupProxy() *cobra.Command {
 			}
 		}
 		if !cmd.Flags().Changed("json") {
-			resolveGroupProxyReq.ExternalId = args[0]
+			createServicePrincipalProxyReq.ServicePrincipal.DisplayName = args[0]
 		}
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[1], &createServicePrincipalProxyReq.ServicePrincipal.AccountSpStatus)
+			if err != nil {
+				return fmt.Errorf("invalid ACCOUNT_SP_STATUS: %s", args[1])
+			}
 
-		response, err := w.WorkspaceIamV2.ResolveGroupProxy(ctx, resolveGroupProxyReq)
+		}
+
+		response, err := w.WorkspaceIamV2.CreateServicePrincipalProxy(ctx, createServicePrincipalProxyReq)
 		if err != nil {
 			return err
 		}
@@ -186,48 +361,169 @@ func newResolveGroupProxy() *cobra.Command {
 	cmd.ValidArgsFunction = cobra.NoFileCompletions
 
 	// Apply optional overrides to this command.
-	for _, fn := range resolveGroupProxyOverrides {
-		fn(cmd, &resolveGroupProxyReq)
+	for _, fn := range createServicePrincipalProxyOverrides {
+		fn(cmd, &createServicePrincipalProxyReq)
 	}
 
 	return cmd
 }
 
-// start resolve-service-principal-proxy command
+// start create-user-proxy command
 
 // Slice with functions to override default command behavior.
 // Functions can be added from the `init()` function in manually curated files in this directory.
-var resolveServicePrincipalProxyOverrides []func(
+var createUserProxyOverrides []func(
 	*cobra.Command,
-	*iamv2.ResolveServicePrincipalProxyRequest,
+	*iamv2.CreateUserProxyRequest,
 )
 
-func newResolveServicePrincipalProxy() *cobra.Command {
+func newCreateUserProxy() *cobra.Command {
 	cmd := &cobra.Command{}
 
-	var resolveServicePrincipalProxyReq iamv2.ResolveServicePrincipalProxyRequest
-	var resolveServicePrincipalProxyJson flags.JsonFlag
+	var createUserProxyReq iamv2.CreateUserProxyRequest
+	createUserProxyReq.User = iamv2.User{}
+	var createUserProxyJson flags.JsonFlag
 
-	cmd.Flags().Var(&resolveServicePrincipalProxyJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+	cmd.Flags().Var(&createUserProxyJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
-	cmd.Use = "resolve-service-principal-proxy EXTERNAL_ID"
-	cmd.Short = `Resolve an external service principal in the Databricks account.`
-	cmd.Long = `Resolve an external service principal in the Databricks account.
+	cmd.Flags().StringVar(&createUserProxyReq.User.ExternalId, "external-id", createUserProxyReq.User.ExternalId, `ExternalId of the user in the customer's IdP.`)
 
-  Resolves an SP with the given external ID from the customer's IdP. If the SP
-  does not exist, it will be created. If the customer is not onboarded onto
-  Automatic Identity Management (AIM), this will return an error.
+	cmd.Use = "create-user-proxy USERNAME FULL_NAME ACCOUNT_USER_STATUS"
+	cmd.Short = `*Beta* Create a user in the account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Create a user in the account.
+
+  Creates a local user in the Databricks account that parents the calling
+  workspace and returns the created user. A local user is one that is not synced
+  from the customer's identity provider, and can be created whether or not
+  Account Identity Management (AIM) is enabled.
+
+  When AIM is enabled, supplying an external ID returns an error. To provision
+  the identity from your identity provider, resolve it by its external ID with
+  ResolveUser; to read an existing external identity, use the ExternalUser
+  resource.
 
   Arguments:
-    EXTERNAL_ID: Required. The external ID of the service principal in the customer's IdP.`
+    USERNAME: Username/email of the user.
+    FULL_NAME:
+    ACCOUNT_USER_STATUS: The activity status of a user in a Databricks account.
+      Supported values: [ACTIVE, INACTIVE]`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(0)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'username', 'full_name', 'account_user_status' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(3)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := createUserProxyJson.Unmarshal(&createUserProxyReq.User)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		if !cmd.Flags().Changed("json") {
+			createUserProxyReq.User.Username = args[0]
+		}
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[1], &createUserProxyReq.User.FullName)
+			if err != nil {
+				return fmt.Errorf("invalid FULL_NAME: %s", args[1])
+			}
+
+		}
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[2], &createUserProxyReq.User.AccountUserStatus)
+			if err != nil {
+				return fmt.Errorf("invalid ACCOUNT_USER_STATUS: %s", args[2])
+			}
+
+		}
+
+		response, err := w.WorkspaceIamV2.CreateUserProxy(ctx, createUserProxyReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range createUserProxyOverrides {
+		fn(cmd, &createUserProxyReq)
+	}
+
+	return cmd
+}
+
+// start create-workspace-assignment-detail-proxy command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var createWorkspaceAssignmentDetailProxyOverrides []func(
+	*cobra.Command,
+	*iamv2.CreateWorkspaceAssignmentDetailProxyRequest,
+)
+
+func newCreateWorkspaceAssignmentDetailProxy() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var createWorkspaceAssignmentDetailProxyReq iamv2.CreateWorkspaceAssignmentDetailProxyRequest
+	createWorkspaceAssignmentDetailProxyReq.WorkspaceAssignmentDetail = iamv2.WorkspaceAssignmentDetail{}
+	var createWorkspaceAssignmentDetailProxyJson flags.JsonFlag
+
+	cmd.Flags().Var(&createWorkspaceAssignmentDetailProxyJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: effective_entitlements
+	// TODO: array: entitlements
+
+	cmd.Use = "create-workspace-assignment-detail-proxy PRINCIPAL_ID"
+	cmd.Short = `Create a workspace assignment detail for a workspace.`
+	cmd.Long = `Create a workspace assignment detail for a workspace.
+
+  Creates a workspace assignment detail for a principal in the calling
+  workspace.
+
+  Arguments:
+    PRINCIPAL_ID: The internal ID of the principal (user/sp/group) in Databricks.`
+
+	// This command is being previewed; hide from help output.
+	cmd.Hidden = true
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'external_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'principal_id' in your JSON input")
 			}
 			return nil
 		}
@@ -241,7 +537,7 @@ func newResolveServicePrincipalProxy() *cobra.Command {
 		w := cmdctx.WorkspaceClient(ctx)
 
 		if cmd.Flags().Changed("json") {
-			diags := resolveServicePrincipalProxyJson.Unmarshal(&resolveServicePrincipalProxyReq)
+			diags := createWorkspaceAssignmentDetailProxyJson.Unmarshal(&createWorkspaceAssignmentDetailProxyReq.WorkspaceAssignmentDetail)
 			if diags.HasError() {
 				return diags.Error()
 			}
@@ -253,10 +549,14 @@ func newResolveServicePrincipalProxy() *cobra.Command {
 			}
 		}
 		if !cmd.Flags().Changed("json") {
-			resolveServicePrincipalProxyReq.ExternalId = args[0]
+			_, err = fmt.Sscan(args[0], &createWorkspaceAssignmentDetailProxyReq.WorkspaceAssignmentDetail.PrincipalId)
+			if err != nil {
+				return fmt.Errorf("invalid PRINCIPAL_ID: %s", args[0])
+			}
+
 		}
 
-		response, err := w.WorkspaceIamV2.ResolveServicePrincipalProxy(ctx, resolveServicePrincipalProxyReq)
+		response, err := w.WorkspaceIamV2.CreateWorkspaceAssignmentDetailProxy(ctx, createWorkspaceAssignmentDetailProxyReq)
 		if err != nil {
 			return err
 		}
@@ -269,48 +569,58 @@ func newResolveServicePrincipalProxy() *cobra.Command {
 	cmd.ValidArgsFunction = cobra.NoFileCompletions
 
 	// Apply optional overrides to this command.
-	for _, fn := range resolveServicePrincipalProxyOverrides {
-		fn(cmd, &resolveServicePrincipalProxyReq)
+	for _, fn := range createWorkspaceAssignmentDetailProxyOverrides {
+		fn(cmd, &createWorkspaceAssignmentDetailProxyReq)
 	}
 
 	return cmd
 }
 
-// start resolve-user-proxy command
+// start create-workspace-assignment-proxy command
 
 // Slice with functions to override default command behavior.
 // Functions can be added from the `init()` function in manually curated files in this directory.
-var resolveUserProxyOverrides []func(
+var createWorkspaceAssignmentProxyOverrides []func(
 	*cobra.Command,
-	*iamv2.ResolveUserProxyRequest,
+	*iamv2.CreateWorkspaceAssignmentProxyRequest,
 )
 
-func newResolveUserProxy() *cobra.Command {
+func newCreateWorkspaceAssignmentProxy() *cobra.Command {
 	cmd := &cobra.Command{}
 
-	var resolveUserProxyReq iamv2.ResolveUserProxyRequest
-	var resolveUserProxyJson flags.JsonFlag
+	var createWorkspaceAssignmentProxyReq iamv2.CreateWorkspaceAssignmentProxyRequest
+	createWorkspaceAssignmentProxyReq.WorkspaceAssignment = iamv2.WorkspaceAssignment{}
+	var createWorkspaceAssignmentProxyJson flags.JsonFlag
 
-	cmd.Flags().Var(&resolveUserProxyJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+	cmd.Flags().Var(&createWorkspaceAssignmentProxyJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
-	cmd.Use = "resolve-user-proxy EXTERNAL_ID"
-	cmd.Short = `Resolve an external user in the Databricks account.`
-	cmd.Long = `Resolve an external user in the Databricks account.
+	// TODO: array: effective_entitlements
+	// TODO: array: entitlements
 
-  Resolves a user with the given external ID from the customer's IdP. If the
-  user does not exist, it will be created. If the customer is not onboarded onto
-  Automatic Identity Management (AIM), this will return an error.
+	cmd.Use = "create-workspace-assignment-proxy PRINCIPAL_ID"
+	cmd.Short = `*Beta* Create a workspace assignment for a workspace.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Create a workspace assignment for a workspace.
+
+  Creates a workspace assignment for a principal in the calling workspace.
+  Entitlements are granted one at a time rather than atomically. If the request
+  fails partway through, the principal stays assigned to the workspace with only
+  some of the requested entitlements. Get the assignment afterwards to confirm
+  which entitlements were granted.
 
   Arguments:
-    EXTERNAL_ID: Required. The external ID of the user in the customer's IdP.`
+    PRINCIPAL_ID: The internal ID of the principal (user/sp/group) in Databricks.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'external_id' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'principal_id' in your JSON input")
 			}
 			return nil
 		}
@@ -324,7 +634,7 @@ func newResolveUserProxy() *cobra.Command {
 		w := cmdctx.WorkspaceClient(ctx)
 
 		if cmd.Flags().Changed("json") {
-			diags := resolveUserProxyJson.Unmarshal(&resolveUserProxyReq)
+			diags := createWorkspaceAssignmentProxyJson.Unmarshal(&createWorkspaceAssignmentProxyReq.WorkspaceAssignment)
 			if diags.HasError() {
 				return diags.Error()
 			}
@@ -336,10 +646,14 @@ func newResolveUserProxy() *cobra.Command {
 			}
 		}
 		if !cmd.Flags().Changed("json") {
-			resolveUserProxyReq.ExternalId = args[0]
+			_, err = fmt.Sscan(args[0], &createWorkspaceAssignmentProxyReq.WorkspaceAssignment.PrincipalId)
+			if err != nil {
+				return fmt.Errorf("invalid PRINCIPAL_ID: %s", args[0])
+			}
+
 		}
 
-		response, err := w.WorkspaceIamV2.ResolveUserProxy(ctx, resolveUserProxyReq)
+		response, err := w.WorkspaceIamV2.CreateWorkspaceAssignmentProxy(ctx, createWorkspaceAssignmentProxyReq)
 		if err != nil {
 			return err
 		}
@@ -352,8 +666,2519 @@ func newResolveUserProxy() *cobra.Command {
 	cmd.ValidArgsFunction = cobra.NoFileCompletions
 
 	// Apply optional overrides to this command.
-	for _, fn := range resolveUserProxyOverrides {
-		fn(cmd, &resolveUserProxyReq)
+	for _, fn := range createWorkspaceAssignmentProxyOverrides {
+		fn(cmd, &createWorkspaceAssignmentProxyReq)
+	}
+
+	return cmd
+}
+
+// start delete-direct-group-member-proxy command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteDirectGroupMemberProxyOverrides []func(
+	*cobra.Command,
+	*iamv2.DeleteDirectGroupMemberProxyRequest,
+)
+
+func newDeleteDirectGroupMemberProxy() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteDirectGroupMemberProxyReq iamv2.DeleteDirectGroupMemberProxyRequest
+
+	cmd.Use = "delete-direct-group-member-proxy GROUP_ID PRINCIPAL_ID"
+	cmd.Short = `*Beta* Delete a direct group membership.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Delete a direct group membership.
+
+  Deletes a group membership (unassigns a principal from a group).
+
+  Arguments:
+    GROUP_ID: Required. Internal ID of the group in Databricks.
+    PRINCIPAL_ID: Required. Internal ID of the principal to be unassigned from the group.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		_, err = fmt.Sscan(args[0], &deleteDirectGroupMemberProxyReq.GroupId)
+		if err != nil {
+			return fmt.Errorf("invalid GROUP_ID: %s", args[0])
+		}
+
+		_, err = fmt.Sscan(args[1], &deleteDirectGroupMemberProxyReq.PrincipalId)
+		if err != nil {
+			return fmt.Errorf("invalid PRINCIPAL_ID: %s", args[1])
+		}
+
+		err = w.WorkspaceIamV2.DeleteDirectGroupMemberProxy(ctx, deleteDirectGroupMemberProxyReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteDirectGroupMemberProxyOverrides {
+		fn(cmd, &deleteDirectGroupMemberProxyReq)
+	}
+
+	return cmd
+}
+
+// start delete-group-proxy command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteGroupProxyOverrides []func(
+	*cobra.Command,
+	*iamv2.DeleteGroupProxyRequest,
+)
+
+func newDeleteGroupProxy() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteGroupProxyReq iamv2.DeleteGroupProxyRequest
+
+	cmd.Use = "delete-group-proxy GROUP_ID"
+	cmd.Short = `*Beta* Delete a group in the account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Delete a group in the account.
+
+  Deletes a group by its internal ID from the Databricks account that parents
+  the calling workspace.
+
+  Arguments:
+    GROUP_ID: Required. Internal ID of the group in Databricks.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		deleteGroupProxyReq.GroupId = args[0]
+
+		err = w.WorkspaceIamV2.DeleteGroupProxy(ctx, deleteGroupProxyReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteGroupProxyOverrides {
+		fn(cmd, &deleteGroupProxyReq)
+	}
+
+	return cmd
+}
+
+// start delete-service-principal-proxy command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteServicePrincipalProxyOverrides []func(
+	*cobra.Command,
+	*iamv2.DeleteServicePrincipalProxyRequest,
+)
+
+func newDeleteServicePrincipalProxy() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteServicePrincipalProxyReq iamv2.DeleteServicePrincipalProxyRequest
+
+	cmd.Use = "delete-service-principal-proxy SERVICE_PRINCIPAL_ID"
+	cmd.Short = `*Beta* Delete a service principal in the account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Delete a service principal in the account.
+
+  Deletes a service principal by its internal ID from the Databricks account
+  that parents the calling workspace.
+
+  Arguments:
+    SERVICE_PRINCIPAL_ID: Required. Internal ID of the service principal in Databricks.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		deleteServicePrincipalProxyReq.ServicePrincipalId = args[0]
+
+		err = w.WorkspaceIamV2.DeleteServicePrincipalProxy(ctx, deleteServicePrincipalProxyReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteServicePrincipalProxyOverrides {
+		fn(cmd, &deleteServicePrincipalProxyReq)
+	}
+
+	return cmd
+}
+
+// start delete-user-proxy command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteUserProxyOverrides []func(
+	*cobra.Command,
+	*iamv2.DeleteUserProxyRequest,
+)
+
+func newDeleteUserProxy() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteUserProxyReq iamv2.DeleteUserProxyRequest
+
+	cmd.Use = "delete-user-proxy USER_ID"
+	cmd.Short = `*Beta* Delete a user in the account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Delete a user in the account.
+
+  Deletes a user by its internal ID from the Databricks account that parents the
+  calling workspace.
+
+  Arguments:
+    USER_ID: Required. Internal ID of the user in Databricks.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		deleteUserProxyReq.UserId = args[0]
+
+		err = w.WorkspaceIamV2.DeleteUserProxy(ctx, deleteUserProxyReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteUserProxyOverrides {
+		fn(cmd, &deleteUserProxyReq)
+	}
+
+	return cmd
+}
+
+// start delete-workspace-assignment-detail-proxy command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteWorkspaceAssignmentDetailProxyOverrides []func(
+	*cobra.Command,
+	*iamv2.DeleteWorkspaceAssignmentDetailProxyRequest,
+)
+
+func newDeleteWorkspaceAssignmentDetailProxy() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteWorkspaceAssignmentDetailProxyReq iamv2.DeleteWorkspaceAssignmentDetailProxyRequest
+
+	cmd.Use = "delete-workspace-assignment-detail-proxy PRINCIPAL_ID"
+	cmd.Short = `Delete a workspace assignment detail for a workspace.`
+	cmd.Long = `Delete a workspace assignment detail for a workspace.
+
+  Deletes a workspace assignment detail for a principal in the calling
+  workspace, revoking all of its entitlements. Entitlements are revoked one at a
+  time rather than atomically. If the request fails partway through, the
+  principal stays assigned with some of its original entitlements. Retrying is
+  safe.
+
+  Arguments:
+    PRINCIPAL_ID: Required. ID of the principal in Databricks to delete workspace assignment
+      for.`
+
+	// This command is being previewed; hide from help output.
+	cmd.Hidden = true
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		_, err = fmt.Sscan(args[0], &deleteWorkspaceAssignmentDetailProxyReq.PrincipalId)
+		if err != nil {
+			return fmt.Errorf("invalid PRINCIPAL_ID: %s", args[0])
+		}
+
+		err = w.WorkspaceIamV2.DeleteWorkspaceAssignmentDetailProxy(ctx, deleteWorkspaceAssignmentDetailProxyReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteWorkspaceAssignmentDetailProxyOverrides {
+		fn(cmd, &deleteWorkspaceAssignmentDetailProxyReq)
+	}
+
+	return cmd
+}
+
+// start delete-workspace-assignment-proxy command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteWorkspaceAssignmentProxyOverrides []func(
+	*cobra.Command,
+	*iamv2.DeleteWorkspaceAssignmentProxyRequest,
+)
+
+func newDeleteWorkspaceAssignmentProxy() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteWorkspaceAssignmentProxyReq iamv2.DeleteWorkspaceAssignmentProxyRequest
+
+	cmd.Use = "delete-workspace-assignment-proxy PRINCIPAL_ID"
+	cmd.Short = `*Beta* Delete a workspace assignment for a workspace.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Delete a workspace assignment for a workspace.
+
+  Deletes a workspace assignment for a principal in the calling workspace,
+  revoking all of its entitlements. Entitlements are revoked one at a time
+  rather than atomically. If the request fails partway through, the principal
+  stays assigned with some of its original entitlements. Retrying is safe.
+
+  Arguments:
+    PRINCIPAL_ID: Required. ID of the principal in Databricks to delete workspace assignment
+      for.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		_, err = fmt.Sscan(args[0], &deleteWorkspaceAssignmentProxyReq.PrincipalId)
+		if err != nil {
+			return fmt.Errorf("invalid PRINCIPAL_ID: %s", args[0])
+		}
+
+		err = w.WorkspaceIamV2.DeleteWorkspaceAssignmentProxy(ctx, deleteWorkspaceAssignmentProxyReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteWorkspaceAssignmentProxyOverrides {
+		fn(cmd, &deleteWorkspaceAssignmentProxyReq)
+	}
+
+	return cmd
+}
+
+// start get-direct-group-member-proxy command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getDirectGroupMemberProxyOverrides []func(
+	*cobra.Command,
+	*iamv2.GetDirectGroupMemberProxyRequest,
+)
+
+func newGetDirectGroupMemberProxy() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getDirectGroupMemberProxyReq iamv2.GetDirectGroupMemberProxyRequest
+
+	cmd.Use = "get-direct-group-member-proxy GROUP_ID PRINCIPAL_ID"
+	cmd.Short = `*Beta* Get a direct group member.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get a direct group member.
+
+  Gets a provisioned direct member of a group.
+
+  Arguments:
+    GROUP_ID: Required. Internal ID of the group in Databricks.
+    PRINCIPAL_ID: Required. Internal ID of the principal belonging to the group in
+      Databricks.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		_, err = fmt.Sscan(args[0], &getDirectGroupMemberProxyReq.GroupId)
+		if err != nil {
+			return fmt.Errorf("invalid GROUP_ID: %s", args[0])
+		}
+
+		_, err = fmt.Sscan(args[1], &getDirectGroupMemberProxyReq.PrincipalId)
+		if err != nil {
+			return fmt.Errorf("invalid PRINCIPAL_ID: %s", args[1])
+		}
+
+		response, err := w.WorkspaceIamV2.GetDirectGroupMemberProxy(ctx, getDirectGroupMemberProxyReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getDirectGroupMemberProxyOverrides {
+		fn(cmd, &getDirectGroupMemberProxyReq)
+	}
+
+	return cmd
+}
+
+// start get-external-group-proxy command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getExternalGroupProxyOverrides []func(
+	*cobra.Command,
+	*iamv2.GetExternalGroupProxyRequest,
+)
+
+func newGetExternalGroupProxy() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getExternalGroupProxyReq iamv2.GetExternalGroupProxyRequest
+
+	cmd.Use = "get-external-group-proxy NAME"
+	cmd.Short = `*Beta* Get an external group in the account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get an external group in the account.
+
+  Retrieves an external group with the given external ID from the customer's
+  IdP. If the group does not exist, it will be created in the account. If the
+  customer is not onboarded onto Automatic Identity Management (AIM), this will
+  return an error. Workspace-scoped variant for workspace-authenticated callers.
+
+  Arguments:
+    NAME: Required. The resource name of the external group. Format:
+      external-groups/{external_group_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getExternalGroupProxyReq.Name = args[0]
+
+		response, err := w.WorkspaceIamV2.GetExternalGroupProxy(ctx, getExternalGroupProxyReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getExternalGroupProxyOverrides {
+		fn(cmd, &getExternalGroupProxyReq)
+	}
+
+	return cmd
+}
+
+// start get-external-service-principal-proxy command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getExternalServicePrincipalProxyOverrides []func(
+	*cobra.Command,
+	*iamv2.GetExternalServicePrincipalProxyRequest,
+)
+
+func newGetExternalServicePrincipalProxy() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getExternalServicePrincipalProxyReq iamv2.GetExternalServicePrincipalProxyRequest
+
+	cmd.Use = "get-external-service-principal-proxy NAME"
+	cmd.Short = `*Beta* Get an external service principal in the account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get an external service principal in the account.
+
+  Retrieves an external service principal with the given external ID from the
+  customer's IdP. If the service principal does not exist, it will be created.
+  If the customer is not onboarded onto Automatic Identity Management (AIM),
+  this will return an error. Workspace-scoped variant for
+  workspace-authenticated callers.
+
+  Arguments:
+    NAME: Required. The resource name of the external service principal. Format:
+      external-service-principals/{external_service_principal_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getExternalServicePrincipalProxyReq.Name = args[0]
+
+		response, err := w.WorkspaceIamV2.GetExternalServicePrincipalProxy(ctx, getExternalServicePrincipalProxyReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getExternalServicePrincipalProxyOverrides {
+		fn(cmd, &getExternalServicePrincipalProxyReq)
+	}
+
+	return cmd
+}
+
+// start get-external-user-proxy command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getExternalUserProxyOverrides []func(
+	*cobra.Command,
+	*iamv2.GetExternalUserProxyRequest,
+)
+
+func newGetExternalUserProxy() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getExternalUserProxyReq iamv2.GetExternalUserProxyRequest
+
+	cmd.Use = "get-external-user-proxy NAME"
+	cmd.Short = `*Beta* Get an external user in the account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get an external user in the account.
+
+  Retrieves an external user with the given external ID from the customer's IdP.
+  If the user does not exist, it will be created. If the customer is not
+  onboarded onto Automatic Identity Management (AIM), this will return an error.
+  Workspace-scoped variant for workspace-authenticated callers.
+
+  Arguments:
+    NAME: Required. The resource name of the external user. Format:
+      external-users/{external_user_id}`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getExternalUserProxyReq.Name = args[0]
+
+		response, err := w.WorkspaceIamV2.GetExternalUserProxy(ctx, getExternalUserProxyReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getExternalUserProxyOverrides {
+		fn(cmd, &getExternalUserProxyReq)
+	}
+
+	return cmd
+}
+
+// start get-group-proxy command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getGroupProxyOverrides []func(
+	*cobra.Command,
+	*iamv2.GetGroupProxyRequest,
+)
+
+func newGetGroupProxy() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getGroupProxyReq iamv2.GetGroupProxyRequest
+
+	cmd.Use = "get-group-proxy GROUP_ID"
+	cmd.Short = `*Beta* Get a group in the account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get a group in the account.
+
+  Fetches a group by its internal ID from the Databricks account that parents
+  the calling workspace.
+
+  Arguments:
+    GROUP_ID: Required. Internal ID of the group in Databricks.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getGroupProxyReq.GroupId = args[0]
+
+		response, err := w.WorkspaceIamV2.GetGroupProxy(ctx, getGroupProxyReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getGroupProxyOverrides {
+		fn(cmd, &getGroupProxyReq)
+	}
+
+	return cmd
+}
+
+// start get-service-principal-proxy command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getServicePrincipalProxyOverrides []func(
+	*cobra.Command,
+	*iamv2.GetServicePrincipalProxyRequest,
+)
+
+func newGetServicePrincipalProxy() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getServicePrincipalProxyReq iamv2.GetServicePrincipalProxyRequest
+
+	cmd.Use = "get-service-principal-proxy SERVICE_PRINCIPAL_ID"
+	cmd.Short = `*Beta* Get a service principal in the account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get a service principal in the account.
+
+  Fetches a service principal by its internal ID from the Databricks account
+  that parents the calling workspace.
+
+  Arguments:
+    SERVICE_PRINCIPAL_ID: Required. Internal ID of the service principal in Databricks.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getServicePrincipalProxyReq.ServicePrincipalId = args[0]
+
+		response, err := w.WorkspaceIamV2.GetServicePrincipalProxy(ctx, getServicePrincipalProxyReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getServicePrincipalProxyOverrides {
+		fn(cmd, &getServicePrincipalProxyReq)
+	}
+
+	return cmd
+}
+
+// start get-user-proxy command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getUserProxyOverrides []func(
+	*cobra.Command,
+	*iamv2.GetUserProxyRequest,
+)
+
+func newGetUserProxy() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getUserProxyReq iamv2.GetUserProxyRequest
+
+	cmd.Use = "get-user-proxy USER_ID"
+	cmd.Short = `*Beta* Get a user in the account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get a user in the account.
+
+  Fetches a user by its internal ID from the Databricks account that parents the
+  calling workspace.
+
+  Arguments:
+    USER_ID: Required. Internal ID of the user in Databricks.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		getUserProxyReq.UserId = args[0]
+
+		response, err := w.WorkspaceIamV2.GetUserProxy(ctx, getUserProxyReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getUserProxyOverrides {
+		fn(cmd, &getUserProxyReq)
+	}
+
+	return cmd
+}
+
+// start get-workspace-access-detail-local command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getWorkspaceAccessDetailLocalOverrides []func(
+	*cobra.Command,
+	*iamv2.GetWorkspaceAccessDetailLocalRequest,
+)
+
+func newGetWorkspaceAccessDetailLocal() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getWorkspaceAccessDetailLocalReq iamv2.GetWorkspaceAccessDetailLocalRequest
+
+	cmd.Flags().Var(&getWorkspaceAccessDetailLocalReq.View, "view", `Controls what fields are returned. Supported values: [BASIC, FULL]`)
+
+	cmd.Use = "get-workspace-access-detail-local PRINCIPAL_ID"
+	cmd.Short = `*Beta* Get workspace access details for a principal.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get workspace access details for a principal.
+
+  Returns the access details for a principal in the current workspace. Allows
+  for checking access details for any provisioned principal (user, service
+  principal, or group) in the current workspace. * Provisioned principal here
+  refers to one that has been synced into Databricks from the customer's IdP or
+  added explicitly to Databricks via SCIM/UI. Allows for passing in a "view"
+  parameter to control what fields are returned (BASIC by default or FULL).
+
+  Arguments:
+    PRINCIPAL_ID: Required. The internal ID of the principal (user/sp/group) for which the
+      access details are being requested.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		_, err = fmt.Sscan(args[0], &getWorkspaceAccessDetailLocalReq.PrincipalId)
+		if err != nil {
+			return fmt.Errorf("invalid PRINCIPAL_ID: %s", args[0])
+		}
+
+		response, err := w.WorkspaceIamV2.GetWorkspaceAccessDetailLocal(ctx, getWorkspaceAccessDetailLocalReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getWorkspaceAccessDetailLocalOverrides {
+		fn(cmd, &getWorkspaceAccessDetailLocalReq)
+	}
+
+	return cmd
+}
+
+// start get-workspace-assignment-detail-proxy command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getWorkspaceAssignmentDetailProxyOverrides []func(
+	*cobra.Command,
+	*iamv2.GetWorkspaceAssignmentDetailProxyRequest,
+)
+
+func newGetWorkspaceAssignmentDetailProxy() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getWorkspaceAssignmentDetailProxyReq iamv2.GetWorkspaceAssignmentDetailProxyRequest
+
+	cmd.Use = "get-workspace-assignment-detail-proxy PRINCIPAL_ID"
+	cmd.Short = `Get workspace assignment details for a principal.`
+	cmd.Long = `Get workspace assignment details for a principal.
+
+  Returns the assignment details for a principal in the calling workspace.
+
+  Arguments:
+    PRINCIPAL_ID: Required. The internal ID of the principal (user/sp/group) for which the
+      assignment details are being requested.`
+
+	// This command is being previewed; hide from help output.
+	cmd.Hidden = true
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		_, err = fmt.Sscan(args[0], &getWorkspaceAssignmentDetailProxyReq.PrincipalId)
+		if err != nil {
+			return fmt.Errorf("invalid PRINCIPAL_ID: %s", args[0])
+		}
+
+		response, err := w.WorkspaceIamV2.GetWorkspaceAssignmentDetailProxy(ctx, getWorkspaceAssignmentDetailProxyReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getWorkspaceAssignmentDetailProxyOverrides {
+		fn(cmd, &getWorkspaceAssignmentDetailProxyReq)
+	}
+
+	return cmd
+}
+
+// start get-workspace-assignment-proxy command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getWorkspaceAssignmentProxyOverrides []func(
+	*cobra.Command,
+	*iamv2.GetWorkspaceAssignmentProxyRequest,
+)
+
+func newGetWorkspaceAssignmentProxy() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getWorkspaceAssignmentProxyReq iamv2.GetWorkspaceAssignmentProxyRequest
+
+	cmd.Use = "get-workspace-assignment-proxy PRINCIPAL_ID"
+	cmd.Short = `*Beta* Get a workspace assignment for a principal.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get a workspace assignment for a principal.
+
+  Returns the assignment for a principal in the calling workspace.
+
+  Arguments:
+    PRINCIPAL_ID: Required. The internal ID of the principal (user/sp/group) for which the
+      assignment is being requested.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		_, err = fmt.Sscan(args[0], &getWorkspaceAssignmentProxyReq.PrincipalId)
+		if err != nil {
+			return fmt.Errorf("invalid PRINCIPAL_ID: %s", args[0])
+		}
+
+		response, err := w.WorkspaceIamV2.GetWorkspaceAssignmentProxy(ctx, getWorkspaceAssignmentProxyReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getWorkspaceAssignmentProxyOverrides {
+		fn(cmd, &getWorkspaceAssignmentProxyReq)
+	}
+
+	return cmd
+}
+
+// start get-workspace-identity-detail command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getWorkspaceIdentityDetailOverrides []func(
+	*cobra.Command,
+	*iamv2.GetWorkspaceIdentityDetailRequest,
+)
+
+func newGetWorkspaceIdentityDetail() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getWorkspaceIdentityDetailReq iamv2.GetWorkspaceIdentityDetailRequest
+
+	cmd.Use = "get-workspace-identity-detail PRINCIPAL_ID"
+	cmd.Short = `*Beta* Get workspace identity details for a principal.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Get workspace identity details for a principal.
+
+  Returns the identity details for a principal in a workspace.
+
+  Arguments:
+    PRINCIPAL_ID: Required. The internal ID of the principal (user/sp/group) for which the
+      identity details are being requested.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		_, err = fmt.Sscan(args[0], &getWorkspaceIdentityDetailReq.PrincipalId)
+		if err != nil {
+			return fmt.Errorf("invalid PRINCIPAL_ID: %s", args[0])
+		}
+
+		response, err := w.WorkspaceIamV2.GetWorkspaceIdentityDetail(ctx, getWorkspaceIdentityDetailReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getWorkspaceIdentityDetailOverrides {
+		fn(cmd, &getWorkspaceIdentityDetailReq)
+	}
+
+	return cmd
+}
+
+// start list-direct-group-members-proxy command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listDirectGroupMembersProxyOverrides []func(
+	*cobra.Command,
+	*iamv2.ListDirectGroupMembersProxyRequest,
+)
+
+func newListDirectGroupMembersProxy() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listDirectGroupMembersProxyReq iamv2.ListDirectGroupMembersProxyRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listDirectGroupMembersProxyLimit int
+
+	cmd.Flags().IntVar(&listDirectGroupMembersProxyReq.PageSize, "page-size", listDirectGroupMembersProxyReq.PageSize, `The maximum number of members to return.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listDirectGroupMembersProxyLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listDirectGroupMembersProxyReq.PageToken, "page-token", listDirectGroupMembersProxyReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-direct-group-members-proxy GROUP_ID"
+	cmd.Short = `*Beta* List direct group members.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+List direct group members.
+
+  Lists provisioned direct members of a group with their membership source
+  (internal or from identity provider).
+
+  Arguments:
+    GROUP_ID: Required. Internal ID of the group in Databricks whose direct members are
+      being listed.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		_, err = fmt.Sscan(args[0], &listDirectGroupMembersProxyReq.GroupId)
+		if err != nil {
+			return fmt.Errorf("invalid GROUP_ID: %s", args[0])
+		}
+
+		response := w.WorkspaceIamV2.ListDirectGroupMembersProxy(ctx, listDirectGroupMembersProxyReq)
+		if listDirectGroupMembersProxyLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listDirectGroupMembersProxyLimit)
+		}
+		if listDirectGroupMembersProxyLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listDirectGroupMembersProxyLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listDirectGroupMembersProxyOverrides {
+		fn(cmd, &listDirectGroupMembersProxyReq)
+	}
+
+	return cmd
+}
+
+// start list-groups-proxy command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listGroupsProxyOverrides []func(
+	*cobra.Command,
+	*iamv2.ListGroupsProxyRequest,
+)
+
+func newListGroupsProxy() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listGroupsProxyReq iamv2.ListGroupsProxyRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listGroupsProxyLimit int
+
+	cmd.Flags().StringVar(&listGroupsProxyReq.Filter, "filter", listGroupsProxyReq.Filter, `Optional.`)
+	cmd.Flags().IntVar(&listGroupsProxyReq.PageSize, "page-size", listGroupsProxyReq.PageSize, `The maximum number of groups to return.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listGroupsProxyLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listGroupsProxyReq.PageToken, "page-token", listGroupsProxyReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-groups-proxy"
+	cmd.Short = `*Beta* List groups in the account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+List groups in the account.
+
+  Lists the groups in the Databricks account that parents the calling workspace,
+  returning one page per call. Supports filtering by group name or external ID.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(0)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		response := w.WorkspaceIamV2.ListGroupsProxy(ctx, listGroupsProxyReq)
+		if listGroupsProxyLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listGroupsProxyLimit)
+		}
+		if listGroupsProxyLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listGroupsProxyLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listGroupsProxyOverrides {
+		fn(cmd, &listGroupsProxyReq)
+	}
+
+	return cmd
+}
+
+// start list-service-principals-proxy command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listServicePrincipalsProxyOverrides []func(
+	*cobra.Command,
+	*iamv2.ListServicePrincipalsProxyRequest,
+)
+
+func newListServicePrincipalsProxy() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listServicePrincipalsProxyReq iamv2.ListServicePrincipalsProxyRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listServicePrincipalsProxyLimit int
+
+	cmd.Flags().StringVar(&listServicePrincipalsProxyReq.Filter, "filter", listServicePrincipalsProxyReq.Filter, `Optional.`)
+	cmd.Flags().IntVar(&listServicePrincipalsProxyReq.PageSize, "page-size", listServicePrincipalsProxyReq.PageSize, `The maximum number of SPs to return.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listServicePrincipalsProxyLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listServicePrincipalsProxyReq.PageToken, "page-token", listServicePrincipalsProxyReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-service-principals-proxy"
+	cmd.Short = `*Beta* List service principals in the account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+List service principals in the account.
+
+  Lists the service principals in the Databricks account that parents the
+  calling workspace, returning one page per call. Supports filtering by
+  application ID or external ID.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(0)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		response := w.WorkspaceIamV2.ListServicePrincipalsProxy(ctx, listServicePrincipalsProxyReq)
+		if listServicePrincipalsProxyLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listServicePrincipalsProxyLimit)
+		}
+		if listServicePrincipalsProxyLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listServicePrincipalsProxyLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listServicePrincipalsProxyOverrides {
+		fn(cmd, &listServicePrincipalsProxyReq)
+	}
+
+	return cmd
+}
+
+// start list-transitive-parent-groups-proxy command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listTransitiveParentGroupsProxyOverrides []func(
+	*cobra.Command,
+	*iamv2.ListTransitiveParentGroupsProxyRequest,
+)
+
+func newListTransitiveParentGroupsProxy() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listTransitiveParentGroupsProxyReq iamv2.ListTransitiveParentGroupsProxyRequest
+
+	cmd.Flags().IntVar(&listTransitiveParentGroupsProxyReq.PageSize, "page-size", listTransitiveParentGroupsProxyReq.PageSize, `The maximum number of parent groups to return.`)
+	cmd.Flags().StringVar(&listTransitiveParentGroupsProxyReq.PageToken, "page-token", listTransitiveParentGroupsProxyReq.PageToken, `A page token, received from a previous ListTransitiveParentGroups call.`)
+
+	cmd.Use = "list-transitive-parent-groups-proxy PRINCIPAL_ID"
+	cmd.Short = `*Beta* List all transitive parent groups of a principal.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+List all transitive parent groups of a principal.
+
+  Lists all transitive parent groups of a principal.
+
+  Arguments:
+    PRINCIPAL_ID: Required. Internal ID of the principal in Databricks whose transitive
+      parent groups are being listed.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		_, err = fmt.Sscan(args[0], &listTransitiveParentGroupsProxyReq.PrincipalId)
+		if err != nil {
+			return fmt.Errorf("invalid PRINCIPAL_ID: %s", args[0])
+		}
+
+		response, err := w.WorkspaceIamV2.ListTransitiveParentGroupsProxy(ctx, listTransitiveParentGroupsProxyReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listTransitiveParentGroupsProxyOverrides {
+		fn(cmd, &listTransitiveParentGroupsProxyReq)
+	}
+
+	return cmd
+}
+
+// start list-users-proxy command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listUsersProxyOverrides []func(
+	*cobra.Command,
+	*iamv2.ListUsersProxyRequest,
+)
+
+func newListUsersProxy() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listUsersProxyReq iamv2.ListUsersProxyRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listUsersProxyLimit int
+
+	cmd.Flags().StringVar(&listUsersProxyReq.Filter, "filter", listUsersProxyReq.Filter, `Optional.`)
+	cmd.Flags().IntVar(&listUsersProxyReq.PageSize, "page-size", listUsersProxyReq.PageSize, `The maximum number of users to return.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listUsersProxyLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listUsersProxyReq.PageToken, "page-token", listUsersProxyReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-users-proxy"
+	cmd.Short = `*Beta* List users in the account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+List users in the account.
+
+  Lists the users in the Databricks account that parents the calling workspace,
+  returning one page per call. Supports filtering by username or external ID.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(0)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		response := w.WorkspaceIamV2.ListUsersProxy(ctx, listUsersProxyReq)
+		if listUsersProxyLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listUsersProxyLimit)
+		}
+		if listUsersProxyLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listUsersProxyLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listUsersProxyOverrides {
+		fn(cmd, &listUsersProxyReq)
+	}
+
+	return cmd
+}
+
+// start list-workspace-assignment-details-proxy command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listWorkspaceAssignmentDetailsProxyOverrides []func(
+	*cobra.Command,
+	*iamv2.ListWorkspaceAssignmentDetailsProxyRequest,
+)
+
+func newListWorkspaceAssignmentDetailsProxy() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listWorkspaceAssignmentDetailsProxyReq iamv2.ListWorkspaceAssignmentDetailsProxyRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listWorkspaceAssignmentDetailsProxyLimit int
+
+	cmd.Flags().IntVar(&listWorkspaceAssignmentDetailsProxyReq.PageSize, "page-size", listWorkspaceAssignmentDetailsProxyReq.PageSize, `The maximum number of workspace assignment details to return.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listWorkspaceAssignmentDetailsProxyLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listWorkspaceAssignmentDetailsProxyReq.PageToken, "page-token", listWorkspaceAssignmentDetailsProxyReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-workspace-assignment-details-proxy"
+	cmd.Short = `List workspace assignment details for a workspace.`
+	cmd.Long = `List workspace assignment details for a workspace.
+
+  Lists workspace assignment details for the calling workspace. The response
+  omits the per-principal entitlement fields (entitlements and
+  effective_entitlements). To read the entitlements for a single principal,
+  get that principal's assignment detail.`
+
+	// This command is being previewed; hide from help output.
+	cmd.Hidden = true
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(0)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		response := w.WorkspaceIamV2.ListWorkspaceAssignmentDetailsProxy(ctx, listWorkspaceAssignmentDetailsProxyReq)
+		if listWorkspaceAssignmentDetailsProxyLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listWorkspaceAssignmentDetailsProxyLimit)
+		}
+		if listWorkspaceAssignmentDetailsProxyLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listWorkspaceAssignmentDetailsProxyLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listWorkspaceAssignmentDetailsProxyOverrides {
+		fn(cmd, &listWorkspaceAssignmentDetailsProxyReq)
+	}
+
+	return cmd
+}
+
+// start list-workspace-assignments-proxy command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listWorkspaceAssignmentsProxyOverrides []func(
+	*cobra.Command,
+	*iamv2.ListWorkspaceAssignmentsProxyRequest,
+)
+
+func newListWorkspaceAssignmentsProxy() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listWorkspaceAssignmentsProxyReq iamv2.ListWorkspaceAssignmentsProxyRequest
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var listWorkspaceAssignmentsProxyLimit int
+
+	cmd.Flags().IntVar(&listWorkspaceAssignmentsProxyReq.PageSize, "page-size", listWorkspaceAssignmentsProxyReq.PageSize, `The maximum number of workspace assignments to return.`)
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&listWorkspaceAssignmentsProxyLimit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	cmd.Flags().StringVar(&listWorkspaceAssignmentsProxyReq.PageToken, "page-token", listWorkspaceAssignmentsProxyReq.PageToken, `Pagination token.`)
+	cmd.Flags().Lookup("page-token").Hidden = true
+
+	cmd.Use = "list-workspace-assignments-proxy"
+	cmd.Short = `*Beta* List workspace assignments for a workspace.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+List workspace assignments for a workspace.
+
+  Lists workspace assignments for the calling workspace. The response omits the
+  per-principal entitlement fields (entitlements and
+  effective_entitlements). To read the entitlements for a single principal,
+  get that principal's assignment.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(0)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		response := w.WorkspaceIamV2.ListWorkspaceAssignmentsProxy(ctx, listWorkspaceAssignmentsProxyReq)
+		if listWorkspaceAssignmentsProxyLimit < 0 {
+			return fmt.Errorf("--limit must be a non-negative integer, got %d", listWorkspaceAssignmentsProxyLimit)
+		}
+		if listWorkspaceAssignmentsProxyLimit > 0 {
+			ctx = cmdio.WithLimit(ctx, listWorkspaceAssignmentsProxyLimit)
+		}
+
+		return cmdio.RenderIterator(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listWorkspaceAssignmentsProxyOverrides {
+		fn(cmd, &listWorkspaceAssignmentsProxyReq)
+	}
+
+	return cmd
+}
+
+// start resolve-group-proxy command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var resolveGroupProxyOverrides []func(
+	*cobra.Command,
+	*iamv2.ResolveGroupProxyRequest,
+)
+
+func newResolveGroupProxy() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var resolveGroupProxyReq iamv2.ResolveGroupProxyRequest
+	var resolveGroupProxyJson flags.JsonFlag
+
+	cmd.Flags().Var(&resolveGroupProxyJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Use = "resolve-group-proxy EXTERNAL_ID"
+	cmd.Short = `*Beta* Resolve an external group in the Databricks account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Resolve an external group in the Databricks account.
+
+  Resolves a group with the given external ID from the customer's IdP. If the
+  group does not exist, it will be created in the account. If the customer is
+  not onboarded onto Automatic Identity Management (AIM), this will return an
+  error.
+
+  Arguments:
+    EXTERNAL_ID: Required. The external ID of the group in the customer's IdP.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(0)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'external_id' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := resolveGroupProxyJson.Unmarshal(&resolveGroupProxyReq)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		if !cmd.Flags().Changed("json") {
+			resolveGroupProxyReq.ExternalId = args[0]
+		}
+
+		response, err := w.WorkspaceIamV2.ResolveGroupProxy(ctx, resolveGroupProxyReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range resolveGroupProxyOverrides {
+		fn(cmd, &resolveGroupProxyReq)
+	}
+
+	return cmd
+}
+
+// start resolve-service-principal-proxy command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var resolveServicePrincipalProxyOverrides []func(
+	*cobra.Command,
+	*iamv2.ResolveServicePrincipalProxyRequest,
+)
+
+func newResolveServicePrincipalProxy() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var resolveServicePrincipalProxyReq iamv2.ResolveServicePrincipalProxyRequest
+	var resolveServicePrincipalProxyJson flags.JsonFlag
+
+	cmd.Flags().Var(&resolveServicePrincipalProxyJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Use = "resolve-service-principal-proxy EXTERNAL_ID"
+	cmd.Short = `*Beta* Resolve an external service principal in the Databricks account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Resolve an external service principal in the Databricks account.
+
+  Resolves a service principal with the given external ID from the customer's
+  IdP. If the service principal does not exist, it will be created. If the
+  customer is not onboarded onto Automatic Identity Management (AIM), this will
+  return an error.
+
+  Arguments:
+    EXTERNAL_ID: Required. The external ID of the service principal in the customer's IdP.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(0)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'external_id' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := resolveServicePrincipalProxyJson.Unmarshal(&resolveServicePrincipalProxyReq)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		if !cmd.Flags().Changed("json") {
+			resolveServicePrincipalProxyReq.ExternalId = args[0]
+		}
+
+		response, err := w.WorkspaceIamV2.ResolveServicePrincipalProxy(ctx, resolveServicePrincipalProxyReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range resolveServicePrincipalProxyOverrides {
+		fn(cmd, &resolveServicePrincipalProxyReq)
+	}
+
+	return cmd
+}
+
+// start resolve-user-proxy command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var resolveUserProxyOverrides []func(
+	*cobra.Command,
+	*iamv2.ResolveUserProxyRequest,
+)
+
+func newResolveUserProxy() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var resolveUserProxyReq iamv2.ResolveUserProxyRequest
+	var resolveUserProxyJson flags.JsonFlag
+
+	cmd.Flags().Var(&resolveUserProxyJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Use = "resolve-user-proxy EXTERNAL_ID"
+	cmd.Short = `*Beta* Resolve an external user in the Databricks account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Resolve an external user in the Databricks account.
+
+  Resolves a user with the given external ID from the customer's IdP. If the
+  user does not exist, it will be created. If the customer is not onboarded onto
+  Automatic Identity Management (AIM), this will return an error.
+
+  Arguments:
+    EXTERNAL_ID: Required. The external ID of the user in the customer's IdP.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(0)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'external_id' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := resolveUserProxyJson.Unmarshal(&resolveUserProxyReq)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		if !cmd.Flags().Changed("json") {
+			resolveUserProxyReq.ExternalId = args[0]
+		}
+
+		response, err := w.WorkspaceIamV2.ResolveUserProxy(ctx, resolveUserProxyReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range resolveUserProxyOverrides {
+		fn(cmd, &resolveUserProxyReq)
+	}
+
+	return cmd
+}
+
+// start update-group-proxy command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateGroupProxyOverrides []func(
+	*cobra.Command,
+	*iamv2.UpdateGroupProxyRequest,
+)
+
+func newUpdateGroupProxy() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateGroupProxyReq iamv2.UpdateGroupProxyRequest
+	updateGroupProxyReq.Group = iamv2.Group{}
+	var updateGroupProxyJson flags.JsonFlag
+
+	cmd.Flags().Var(&updateGroupProxyJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&updateGroupProxyReq.Group.ExternalId, "external-id", updateGroupProxyReq.Group.ExternalId, `ExternalId of the group in the customer's IdP.`)
+	cmd.Flags().StringVar(&updateGroupProxyReq.Group.GroupName, "group-name", updateGroupProxyReq.Group.GroupName, `Display name of the group.`)
+
+	cmd.Use = "update-group-proxy GROUP_ID UPDATE_MASK"
+	cmd.Short = `*Beta* Update a group in the account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Update a group in the account.
+
+  Updates an existing group in the Databricks account that parents the calling
+  workspace. Only the fields named in the update mask are modified. Returns the
+  updated Group resource.
+
+  When AIM is enabled and the group is an external identity (its external_id is
+  set), only external_id can be updated; its other fields are sourced from your
+  identity provider. With AIM and group visibility filters, a new nonempty
+  external_id must identify a visible group. Clearing external_id is allowed.
+
+  Arguments:
+    GROUP_ID: Required. Internal ID of the group in Databricks.
+    UPDATE_MASK: Optional. The list of fields to update.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updateGroupProxyJson.Unmarshal(&updateGroupProxyReq.Group)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		updateGroupProxyReq.GroupId = args[0]
+		updateGroupProxyReq.UpdateMask = args[1]
+
+		response, err := w.WorkspaceIamV2.UpdateGroupProxy(ctx, updateGroupProxyReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateGroupProxyOverrides {
+		fn(cmd, &updateGroupProxyReq)
+	}
+
+	return cmd
+}
+
+// start update-service-principal-proxy command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateServicePrincipalProxyOverrides []func(
+	*cobra.Command,
+	*iamv2.UpdateServicePrincipalProxyRequest,
+)
+
+func newUpdateServicePrincipalProxy() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateServicePrincipalProxyReq iamv2.UpdateServicePrincipalProxyRequest
+	updateServicePrincipalProxyReq.ServicePrincipal = iamv2.ServicePrincipal{}
+	var updateServicePrincipalProxyJson flags.JsonFlag
+
+	cmd.Flags().Var(&updateServicePrincipalProxyJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&updateServicePrincipalProxyReq.ServicePrincipal.ExternalId, "external-id", updateServicePrincipalProxyReq.ServicePrincipal.ExternalId, `ExternalId of the service principal in the customer's IdP.`)
+
+	cmd.Use = "update-service-principal-proxy SERVICE_PRINCIPAL_ID UPDATE_MASK DISPLAY_NAME ACCOUNT_SP_STATUS"
+	cmd.Short = `*Beta* Update a service principal in the account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Update a service principal in the account.
+
+  Updates an existing service principal in the Databricks account that parents
+  the calling workspace. Only the fields named in the update mask are modified.
+  Returns the updated ServicePrincipal resource.
+
+  When AIM is enabled and the service principal is an external identity (its
+  external_id is set), only external_id can be updated; its other fields are
+  sourced from your identity provider.
+
+  Arguments:
+    SERVICE_PRINCIPAL_ID: Required. Internal ID of the service principal in Databricks.
+    UPDATE_MASK: Optional. The list of fields to update.
+    DISPLAY_NAME: Display name of the service principal.
+    ACCOUNT_SP_STATUS: The activity status of a service principal in a Databricks account.
+      Supported values: [ACTIVE, INACTIVE]`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(2)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only SERVICE_PRINCIPAL_ID, UPDATE_MASK as positional arguments. Provide 'display_name', 'account_sp_status' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(4)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updateServicePrincipalProxyJson.Unmarshal(&updateServicePrincipalProxyReq.ServicePrincipal)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		updateServicePrincipalProxyReq.ServicePrincipalId = args[0]
+		updateServicePrincipalProxyReq.UpdateMask = args[1]
+		if !cmd.Flags().Changed("json") {
+			updateServicePrincipalProxyReq.ServicePrincipal.DisplayName = args[2]
+		}
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[3], &updateServicePrincipalProxyReq.ServicePrincipal.AccountSpStatus)
+			if err != nil {
+				return fmt.Errorf("invalid ACCOUNT_SP_STATUS: %s", args[3])
+			}
+
+		}
+
+		response, err := w.WorkspaceIamV2.UpdateServicePrincipalProxy(ctx, updateServicePrincipalProxyReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateServicePrincipalProxyOverrides {
+		fn(cmd, &updateServicePrincipalProxyReq)
+	}
+
+	return cmd
+}
+
+// start update-user-proxy command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateUserProxyOverrides []func(
+	*cobra.Command,
+	*iamv2.UpdateUserProxyRequest,
+)
+
+func newUpdateUserProxy() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateUserProxyReq iamv2.UpdateUserProxyRequest
+	updateUserProxyReq.User = iamv2.User{}
+	var updateUserProxyJson flags.JsonFlag
+
+	cmd.Flags().Var(&updateUserProxyJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&updateUserProxyReq.User.ExternalId, "external-id", updateUserProxyReq.User.ExternalId, `ExternalId of the user in the customer's IdP.`)
+
+	cmd.Use = "update-user-proxy USER_ID UPDATE_MASK USERNAME FULL_NAME ACCOUNT_USER_STATUS"
+	cmd.Short = `*Beta* Update a user in the account.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Update a user in the account.
+
+  Updates an existing user in the Databricks account that parents the calling
+  workspace and returns the updated user. Only the fields named in the update
+  mask are modified. The updatable fields are fullName.givenName,
+  fullName.familyName, status, and externalId.
+
+  When AIM is enabled and the user is an external identity (its external_id is
+  set), only external_id can be updated; its other fields are sourced from your
+  identity provider.
+
+  Arguments:
+    USER_ID: Required. Internal ID of the user in Databricks.
+    UPDATE_MASK: Optional. The list of fields to update.
+    USERNAME: Username/email of the user.
+    FULL_NAME:
+    ACCOUNT_USER_STATUS: The activity status of a user in a Databricks account.
+      Supported values: [ACTIVE, INACTIVE]`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(2)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only USER_ID, UPDATE_MASK as positional arguments. Provide 'username', 'full_name', 'account_user_status' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(5)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updateUserProxyJson.Unmarshal(&updateUserProxyReq.User)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		updateUserProxyReq.UserId = args[0]
+		updateUserProxyReq.UpdateMask = args[1]
+		if !cmd.Flags().Changed("json") {
+			updateUserProxyReq.User.Username = args[2]
+		}
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[3], &updateUserProxyReq.User.FullName)
+			if err != nil {
+				return fmt.Errorf("invalid FULL_NAME: %s", args[3])
+			}
+
+		}
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[4], &updateUserProxyReq.User.AccountUserStatus)
+			if err != nil {
+				return fmt.Errorf("invalid ACCOUNT_USER_STATUS: %s", args[4])
+			}
+
+		}
+
+		response, err := w.WorkspaceIamV2.UpdateUserProxy(ctx, updateUserProxyReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateUserProxyOverrides {
+		fn(cmd, &updateUserProxyReq)
+	}
+
+	return cmd
+}
+
+// start update-workspace-assignment-detail-proxy command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateWorkspaceAssignmentDetailProxyOverrides []func(
+	*cobra.Command,
+	*iamv2.UpdateWorkspaceAssignmentDetailProxyRequest,
+)
+
+func newUpdateWorkspaceAssignmentDetailProxy() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateWorkspaceAssignmentDetailProxyReq iamv2.UpdateWorkspaceAssignmentDetailProxyRequest
+	updateWorkspaceAssignmentDetailProxyReq.WorkspaceAssignmentDetail = iamv2.WorkspaceAssignmentDetail{}
+	var updateWorkspaceAssignmentDetailProxyJson flags.JsonFlag
+
+	cmd.Flags().Var(&updateWorkspaceAssignmentDetailProxyJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: effective_entitlements
+	// TODO: array: entitlements
+
+	cmd.Use = "update-workspace-assignment-detail-proxy PRINCIPAL_ID UPDATE_MASK PRINCIPAL_ID"
+	cmd.Short = `Update a workspace assignment detail for a workspace.`
+	cmd.Long = `Update a workspace assignment detail for a workspace.
+
+  Updates the entitlements of a directly assigned principal in the calling
+  workspace. Changes are applied one at a time rather than atomically. If the
+  request fails partway through, only some of the requested changes take effect.
+  Get the assignment detail afterwards to confirm the final state.
+
+  Arguments:
+    PRINCIPAL_ID: Required. ID of the principal in Databricks.
+    UPDATE_MASK: Required. The list of fields to update.
+    PRINCIPAL_ID: The internal ID of the principal (user/sp/group) in Databricks.`
+
+	// This command is being previewed; hide from help output.
+	cmd.Hidden = true
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PRIVATE_PREVIEW"
+	cmd.Annotations["launch_stage_display"] = "Private Preview"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(2)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only PRINCIPAL_ID, UPDATE_MASK as positional arguments. Provide 'principal_id' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(3)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updateWorkspaceAssignmentDetailProxyJson.Unmarshal(&updateWorkspaceAssignmentDetailProxyReq.WorkspaceAssignmentDetail)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		_, err = fmt.Sscan(args[0], &updateWorkspaceAssignmentDetailProxyReq.PrincipalId)
+		if err != nil {
+			return fmt.Errorf("invalid PRINCIPAL_ID: %s", args[0])
+		}
+
+		if args[1] != "" {
+			updateMaskArray := strings.Split(args[1], ",")
+			updateWorkspaceAssignmentDetailProxyReq.UpdateMask = *fieldmask.New(updateMaskArray)
+		}
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[2], &updateWorkspaceAssignmentDetailProxyReq.WorkspaceAssignmentDetail.PrincipalId)
+			if err != nil {
+				return fmt.Errorf("invalid PRINCIPAL_ID: %s", args[2])
+			}
+
+		}
+
+		response, err := w.WorkspaceIamV2.UpdateWorkspaceAssignmentDetailProxy(ctx, updateWorkspaceAssignmentDetailProxyReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateWorkspaceAssignmentDetailProxyOverrides {
+		fn(cmd, &updateWorkspaceAssignmentDetailProxyReq)
+	}
+
+	return cmd
+}
+
+// start update-workspace-assignment-proxy command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateWorkspaceAssignmentProxyOverrides []func(
+	*cobra.Command,
+	*iamv2.UpdateWorkspaceAssignmentProxyRequest,
+)
+
+func newUpdateWorkspaceAssignmentProxy() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateWorkspaceAssignmentProxyReq iamv2.UpdateWorkspaceAssignmentProxyRequest
+	updateWorkspaceAssignmentProxyReq.WorkspaceAssignment = iamv2.WorkspaceAssignment{}
+	var updateWorkspaceAssignmentProxyJson flags.JsonFlag
+
+	cmd.Flags().Var(&updateWorkspaceAssignmentProxyJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: effective_entitlements
+	// TODO: array: entitlements
+
+	cmd.Use = "update-workspace-assignment-proxy PRINCIPAL_ID UPDATE_MASK PRINCIPAL_ID"
+	cmd.Short = `*Beta* Update a workspace assignment for a workspace.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Update a workspace assignment for a workspace.
+
+  Updates the entitlements of a directly assigned principal in the calling
+  workspace. Changes are applied one at a time rather than atomically. If the
+  request fails partway through, only some of the requested changes take effect.
+  Get the assignment afterwards to confirm the final state.
+
+  Arguments:
+    PRINCIPAL_ID: Required. ID of the principal in Databricks.
+    UPDATE_MASK: Required. The list of fields to update.
+    PRINCIPAL_ID: The internal ID of the principal (user/sp/group) in Databricks.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs(2)(cmd, args)
+			if err != nil {
+				return errors.New("when --json flag is specified, provide only PRINCIPAL_ID, UPDATE_MASK as positional arguments. Provide 'principal_id' in your JSON input")
+			}
+			return nil
+		}
+		check := root.ExactArgs(3)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updateWorkspaceAssignmentProxyJson.Unmarshal(&updateWorkspaceAssignmentProxyReq.WorkspaceAssignment)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		_, err = fmt.Sscan(args[0], &updateWorkspaceAssignmentProxyReq.PrincipalId)
+		if err != nil {
+			return fmt.Errorf("invalid PRINCIPAL_ID: %s", args[0])
+		}
+
+		if args[1] != "" {
+			updateMaskArray := strings.Split(args[1], ",")
+			updateWorkspaceAssignmentProxyReq.UpdateMask = *fieldmask.New(updateMaskArray)
+		}
+		if !cmd.Flags().Changed("json") {
+			_, err = fmt.Sscan(args[2], &updateWorkspaceAssignmentProxyReq.WorkspaceAssignment.PrincipalId)
+			if err != nil {
+				return fmt.Errorf("invalid PRINCIPAL_ID: %s", args[2])
+			}
+
+		}
+
+		response, err := w.WorkspaceIamV2.UpdateWorkspaceAssignmentProxy(ctx, updateWorkspaceAssignmentProxyReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateWorkspaceAssignmentProxyOverrides {
+		fn(cmd, &updateWorkspaceAssignmentProxyReq)
+	}
+
+	return cmd
+}
+
+// start update-workspace-identity-detail command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateWorkspaceIdentityDetailOverrides []func(
+	*cobra.Command,
+	*iamv2.UpdateWorkspaceIdentityDetailRequest,
+)
+
+func newUpdateWorkspaceIdentityDetail() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateWorkspaceIdentityDetailReq iamv2.UpdateWorkspaceIdentityDetailRequest
+	updateWorkspaceIdentityDetailReq.WorkspaceIdentityDetail = iamv2.WorkspaceIdentityDetail{}
+	var updateWorkspaceIdentityDetailJson flags.JsonFlag
+
+	cmd.Flags().Var(&updateWorkspaceIdentityDetailJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().Var(&updateWorkspaceIdentityDetailReq.WorkspaceIdentityDetail.WorkspaceIdentityStatus, "workspace-identity-status", `The activity status of an identity in a Databricks workspace. Supported values: [ACTIVE, INACTIVE]`)
+
+	cmd.Use = "update-workspace-identity-detail PRINCIPAL_ID UPDATE_MASK"
+	cmd.Short = `*Beta* Update workspace identity details for a principal.`
+	cmd.Long = `This command is in Beta and may change without notice.
+
+Update workspace identity details for a principal.
+
+  Updates a workspace identity detail for a principal.
+
+  Arguments:
+    PRINCIPAL_ID: Required. ID of the principal in Databricks.
+    UPDATE_MASK: Required. The list of fields to update.`
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "PUBLIC_BETA"
+	cmd.Annotations["launch_stage_display"] = "Beta"
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := root.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := cmdctx.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			diags := updateWorkspaceIdentityDetailJson.Unmarshal(&updateWorkspaceIdentityDetailReq.WorkspaceIdentityDetail)
+			if diags.HasError() {
+				return diags.Error()
+			}
+			if len(diags) > 0 {
+				err := cmdio.RenderDiagnostics(ctx, diags)
+				if err != nil {
+					return err
+				}
+			}
+		}
+		_, err = fmt.Sscan(args[0], &updateWorkspaceIdentityDetailReq.PrincipalId)
+		if err != nil {
+			return fmt.Errorf("invalid PRINCIPAL_ID: %s", args[0])
+		}
+
+		if args[1] != "" {
+			updateMaskArray := strings.Split(args[1], ",")
+			updateWorkspaceIdentityDetailReq.UpdateMask = *fieldmask.New(updateMaskArray)
+		}
+
+		response, err := w.WorkspaceIamV2.UpdateWorkspaceIdentityDetail(ctx, updateWorkspaceIdentityDetailReq)
+		if err != nil {
+			return err
+		}
+
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateWorkspaceIdentityDetailOverrides {
+		fn(cmd, &updateWorkspaceIdentityDetailReq)
 	}
 
 	return cmd
diff --git a/cmd/workspace/workspace-settings-v2/workspace-settings-v2.go b/cmd/workspace/workspace-settings-v2/workspace-settings-v2.go
old mode 100755
new mode 100644
index d4e3d213b06..a9c54d16d03
--- a/cmd/workspace/workspace-settings-v2/workspace-settings-v2.go
+++ b/cmd/workspace/workspace-settings-v2/workspace-settings-v2.go
@@ -26,6 +26,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newGetPublicWorkspaceSetting())
 	cmd.AddCommand(newListWorkspaceSettingsMetadata())
@@ -65,6 +69,8 @@ func newGetPublicWorkspaceSetting() *cobra.Command {
     NAME: Name of the setting`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -134,6 +140,8 @@ func newListWorkspaceSettingsMetadata() *cobra.Command {
   :method:settingsv2/patchpublicworkspacesetting APIs`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(0)
@@ -188,21 +196,29 @@ func newPatchPublicWorkspaceSetting() *cobra.Command {
 
 	// TODO: complex arg: aibi_dashboard_embedding_access_policy
 	// TODO: complex arg: aibi_dashboard_embedding_approved_domains
+	// TODO: complex arg: allowed_apps_user_api_scopes
 	// TODO: complex arg: automatic_cluster_update_workspace
 	// TODO: complex arg: boolean_val
+	// TODO: complex arg: collaboration_platform_connectivity
 	// TODO: complex arg: effective_aibi_dashboard_embedding_access_policy
 	// TODO: complex arg: effective_aibi_dashboard_embedding_approved_domains
+	// TODO: complex arg: effective_allowed_apps_user_api_scopes
 	// TODO: complex arg: effective_automatic_cluster_update_workspace
 	// TODO: complex arg: effective_boolean_val
+	// TODO: complex arg: effective_collaboration_platform_connectivity
 	// TODO: complex arg: effective_integer_val
+	// TODO: complex arg: effective_operational_email_custom_recipient
 	// TODO: complex arg: effective_personal_compute
 	// TODO: complex arg: effective_restrict_workspace_admins
 	// TODO: complex arg: effective_string_val
+	// TODO: complex arg: effective_workspace_label
 	// TODO: complex arg: integer_val
 	cmd.Flags().StringVar(&patchPublicWorkspaceSettingReq.Setting.Name, "name", patchPublicWorkspaceSettingReq.Setting.Name, `Name of the setting.`)
+	// TODO: complex arg: operational_email_custom_recipient
 	// TODO: complex arg: personal_compute
 	// TODO: complex arg: restrict_workspace_admins
 	// TODO: complex arg: string_val
+	// TODO: complex arg: workspace_label
 
 	cmd.Use = "patch-public-workspace-setting NAME"
 	cmd.Short = `Update a workspace setting.`
@@ -220,6 +236,8 @@ func newPatchPublicWorkspaceSetting() *cobra.Command {
     NAME: Name of the setting`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
diff --git a/cmd/workspace/workspace/export_dir.go b/cmd/workspace/workspace/export_dir.go
index b6b4b86c8ad..362b6e4e30b 100644
--- a/cmd/workspace/workspace/export_dir.go
+++ b/cmd/workspace/workspace/export_dir.go
@@ -16,6 +16,7 @@ import (
 	"github.com/databricks/cli/libs/cmdctx"
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/filer"
+	"github.com/databricks/cli/libs/log"
 	"github.com/databricks/cli/libs/notebook"
 	"github.com/databricks/databricks-sdk-go/apierr"
 	"github.com/databricks/databricks-sdk-go/service/workspace"
@@ -30,8 +31,8 @@ type exportDirOptions struct {
 
 // isFileSizeError checks if the error is due to file size limits.
 func isFileSizeError(err error) bool {
-	var aerr *apierr.APIError
-	if !errors.As(err, &aerr) || aerr.StatusCode != http.StatusBadRequest {
+	aerr, ok := errors.AsType[*apierr.APIError](err)
+	if !ok || aerr.StatusCode != http.StatusBadRequest {
 		return false
 	}
 
@@ -56,7 +57,6 @@ func isFileSizeError(err error) bool {
 // These will be skipped with a warning during export-dir.
 var nonExportableTypes = []workspace.ObjectType{
 	workspace.ObjectTypeLibrary,
-	workspace.ObjectTypeDashboard,
 	workspace.ObjectTypeRepo,
 	// MLFLOW_EXPERIMENT is not defined as a constant in the SDK
 	workspace.ObjectType("MLFLOW_EXPERIMENT"),
@@ -125,7 +125,18 @@ func (opts *exportDirOptions) callback(ctx context.Context, workspaceFiler filer
 		// create the file
 		f, err := os.Create(targetPath)
 		if err != nil {
-			return err
+			// A workspace name can be illegal as a local filename (e.g. a ':'
+			// in "New Notebook 2026-05-04 13:54:24" on Windows). Rename it to a
+			// legal name with a warning rather than aborting the export (#5171).
+			if !isInvalidLocalNameError(err) {
+				return err
+			}
+			targetPath = filepath.Join(filepath.Dir(targetPath), sanitizeLocalName(filepath.Base(targetPath)))
+			log.Warnf(ctx, "%s: name is not valid for the local file system, exporting as %q", sourcePath, filepath.Base(targetPath))
+			f, err = os.Create(targetPath)
+			if err != nil {
+				return err
+			}
 		}
 		defer f.Close()
 
diff --git a/cmd/workspace/workspace/export_dir_other.go b/cmd/workspace/workspace/export_dir_other.go
new file mode 100644
index 00000000000..3ada8e8d3eb
--- /dev/null
+++ b/cmd/workspace/workspace/export_dir_other.go
@@ -0,0 +1,18 @@
+//go:build !windows
+
+package workspace
+
+// isInvalidLocalNameError reports whether err means the workspace object could
+// not be written because its name is not a legal filename on the local OS. On
+// non-Windows platforms the only bytes illegal in a filename are '/' and NUL,
+// neither of which can appear in a workspace object name, so this never fires.
+func isInvalidLocalNameError(err error) bool {
+	return false
+}
+
+// sanitizeLocalName is a no-op on non-Windows platforms. It exists to satisfy
+// the call in export_dir.go, which is only reached when isInvalidLocalNameError
+// returns true, so this is never invoked here.
+func sanitizeLocalName(name string) string {
+	return name
+}
diff --git a/cmd/workspace/workspace/export_dir_windows.go b/cmd/workspace/workspace/export_dir_windows.go
new file mode 100644
index 00000000000..358846ca1e3
--- /dev/null
+++ b/cmd/workspace/workspace/export_dir_windows.go
@@ -0,0 +1,38 @@
+//go:build windows
+
+package workspace
+
+import (
+	"errors"
+	"strings"
+	"syscall"
+)
+
+// errorInvalidName is the Windows ERROR_INVALID_NAME code. The file APIs return
+// it when a path contains characters that are illegal in a local filename, such
+// as the ':' in a notebook named "New Notebook 2026-05-04 13:54:24". It is not
+// declared in the standard syscall package, so we use the well-known code.
+// https://learn.microsoft.com/en-us/windows/win32/debug/system-error-codes--0-499-
+const errorInvalidName = syscall.Errno(0x7b)
+
+// isInvalidLocalNameError reports whether err means the workspace object could
+// not be written because its name is not a legal filename on the local OS.
+func isInvalidLocalNameError(err error) bool {
+	return errors.Is(err, errorInvalidName)
+}
+
+// reservedNameChars are the characters that are illegal in a Windows filename.
+// https://learn.microsoft.com/en-us/windows/win32/fileio/naming-a-file
+const reservedNameChars = `<>:"/\|?*`
+
+// sanitizeLocalName replaces characters that are illegal in a Windows filename
+// with '_' so an object whose name is invalid locally can still be written under
+// a legal name.
+func sanitizeLocalName(name string) string {
+	return strings.Map(func(r rune) rune {
+		if strings.ContainsRune(reservedNameChars, r) {
+			return '_'
+		}
+		return r
+	}, name)
+}
diff --git a/cmd/workspace/workspace/export_dir_windows_test.go b/cmd/workspace/workspace/export_dir_windows_test.go
new file mode 100644
index 00000000000..1a26f47383e
--- /dev/null
+++ b/cmd/workspace/workspace/export_dir_windows_test.go
@@ -0,0 +1,86 @@
+//go:build windows
+
+package workspace
+
+import (
+	"errors"
+	"io/fs"
+	"os"
+	"syscall"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// The narrow contract: only the Windows "invalid file name" error is treated as
+// skippable. Genuine failures (permission, missing path, anything else) must not
+// be swallowed, otherwise export-dir would silently drop files on real errors.
+func TestIsInvalidLocalNameError(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want bool
+	}{
+		{
+			name: "invalid name wrapped in PathError",
+			err:  &os.PathError{Op: "open", Path: `C:\tmp\New Notebook 13:54:24.py`, Err: syscall.Errno(0x7b)},
+			want: true,
+		},
+		{
+			name: "permission denied is not skipped",
+			err:  fs.ErrPermission,
+			want: false,
+		},
+		{
+			name: "not exist is not skipped",
+			err:  fs.ErrNotExist,
+			want: false,
+		},
+		{
+			name: "generic error is not skipped",
+			err:  errors.New("boom"),
+			want: false,
+		},
+		{
+			name: "nil is not skipped",
+			err:  nil,
+			want: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, isInvalidLocalNameError(tt.err))
+		})
+	}
+}
+
+func TestSanitizeLocalName(t *testing.T) {
+	tests := []struct {
+		name string
+		in   string
+		want string
+	}{
+		{
+			name: "colons replaced",
+			in:   "New Notebook 2026-05-04 13:54:24.py",
+			want: "New Notebook 2026-05-04 13_54_24.py",
+		},
+		{
+			name: "all reserved characters replaced",
+			in:   `a<b>c:d"e|f?g*h`,
+			want: "a_b_c_d_e_f_g_h",
+		},
+		{
+			name: "legal name unchanged",
+			in:   "hello world.py",
+			want: "hello world.py",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, sanitizeLocalName(tt.in))
+		})
+	}
+}
diff --git a/cmd/workspace/workspace/import_dir.go b/cmd/workspace/workspace/import_dir.go
index 1dbc43cc958..86853faef76 100644
--- a/cmd/workspace/workspace/import_dir.go
+++ b/cmd/workspace/workspace/import_dir.go
@@ -7,7 +7,6 @@ import (
 	"os"
 	"path"
 	"path/filepath"
-	"strings"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
@@ -23,6 +22,22 @@ type importDirOptions struct {
 	overwrite bool
 }
 
+// defaultSkipDirs are directory names skipped when walking the source tree.
+// The previous behavior copied these verbatim into the workspace, which:
+//   - leaks .git/config (often containing template-repo origin URLs and
+//     occasionally cached credentials) into deployed app source trees
+//   - copies the local bundle cache (.databricks) on top of any remote one
+//   - uploads node_modules/ for JS/TS apps, which is large and gets
+//     reinstalled in the runtime anyway
+//
+// Reported as DEPLOY-04 #2 in the EMEA Apps gaps doc; users have been
+// working around it by post-deploy scrubbing scripts.
+var defaultSkipDirs = map[string]struct{}{
+	".git":         {},
+	".databricks":  {},
+	"node_modules": {},
+}
+
 // The callback function imports the file specified at sourcePath. This function is
 // meant to be used in conjunction with fs.WalkDir
 //
@@ -48,6 +63,15 @@ func (opts importDirOptions) callback(ctx context.Context, workspaceFiler filer.
 			return err
 		}
 
+		// Skip default-excluded directories (e.g. .git, .databricks). The check
+		// excludes the explicit root so a user who passes ".git" as the source
+		// can still copy it deliberately.
+		if d.IsDir() && sourcePath != sourceDir {
+			if _, skip := defaultSkipDirs[d.Name()]; skip {
+				return fs.SkipDir
+			}
+		}
+
 		// localName is the name for the file in the local file system
 		localName, err := filepath.Rel(sourceDir, sourcePath)
 		if err != nil {
@@ -71,8 +95,7 @@ func (opts importDirOptions) callback(ctx context.Context, workspaceFiler filer.
 			return err
 		}
 		if isNotebook {
-			ext := path.Ext(remoteName)
-			remoteName = strings.TrimSuffix(remoteName, ext)
+			remoteName = notebook.StripExtension(remoteName)
 		}
 
 		// Open the local file
@@ -117,6 +140,10 @@ func newImportDir() *cobra.Command {
 	cmd.Long = `
 Import a directory recursively from the local file system to a Databricks workspace.
 Notebooks will have their extensions (one of .scala, .py, .sql, .ipynb, .r) stripped
+
+By default, .git, .databricks, and node_modules directories encountered during
+the recursive import are skipped. To import one of these directories deliberately,
+pass it as SOURCE_PATH.
 `
 
 	cmd.Annotations = make(map[string]string)
diff --git a/cmd/workspace/workspace/import_dir_test.go b/cmd/workspace/workspace/import_dir_test.go
new file mode 100644
index 00000000000..0cb89fc008b
--- /dev/null
+++ b/cmd/workspace/workspace/import_dir_test.go
@@ -0,0 +1,156 @@
+package workspace
+
+import (
+	"context"
+	"io"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"slices"
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/filer"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// recordingFiler captures Mkdir and Write calls so a test can assert which
+// paths were visited by the import-dir walker.
+type recordingFiler struct {
+	dirs  []string
+	files []string
+}
+
+func (r *recordingFiler) Mkdir(ctx context.Context, p string) error {
+	r.dirs = append(r.dirs, p)
+	return nil
+}
+
+func (r *recordingFiler) Write(ctx context.Context, p string, reader io.Reader, mode ...filer.WriteMode) error {
+	r.files = append(r.files, p)
+	return nil
+}
+
+func (r *recordingFiler) Read(ctx context.Context, p string) (io.ReadCloser, error) {
+	return nil, fs.ErrNotExist
+}
+
+func (r *recordingFiler) Delete(ctx context.Context, p string, mode ...filer.DeleteMode) error {
+	return nil
+}
+
+func (r *recordingFiler) ReadDir(ctx context.Context, p string) ([]fs.DirEntry, error) {
+	return nil, fs.ErrNotExist
+}
+
+func (r *recordingFiler) Stat(ctx context.Context, name string) (fs.FileInfo, error) {
+	return nil, fs.ErrNotExist
+}
+
+func writeFile(t *testing.T, root, rel, contents string) {
+	t.Helper()
+	full := filepath.Join(root, rel)
+	require.NoError(t, os.MkdirAll(filepath.Dir(full), 0o755))
+	require.NoError(t, os.WriteFile(full, []byte(contents), 0o644))
+}
+
+func runWalk(t *testing.T, sourceDir string) *recordingFiler {
+	t.Helper()
+	rec := &recordingFiler{}
+	ctx := cmdio.InContext(t.Context(),
+		cmdio.NewIO(t.Context(), flags.OutputText, nil, io.Discard, io.Discard, "", ""))
+	opts := importDirOptions{sourceDir: sourceDir, targetDir: "/Workspace/x", overwrite: true}
+	cb := opts.callback(ctx, rec)
+	require.NoError(t, filepath.WalkDir(sourceDir, cb))
+	return rec
+}
+
+func TestImportDirSkipsGitDirectory(t *testing.T) {
+	src := t.TempDir()
+	writeFile(t, src, "app.py", "print('hi')")
+	writeFile(t, src, ".git/config", "[remote]\n  url = git@github.com:org/template.git")
+	writeFile(t, src, ".git/HEAD", "ref: refs/heads/main")
+	writeFile(t, src, ".git/objects/abc123", "binary")
+
+	rec := runWalk(t, src)
+
+	slices.Sort(rec.files)
+	assert.Equal(t, []string{"app.py"}, rec.files)
+	for _, d := range rec.dirs {
+		assert.NotContains(t, d, ".git", "no .git directory should be created in the workspace")
+	}
+}
+
+func TestImportDirSkipsNestedGitDirectory(t *testing.T) {
+	src := t.TempDir()
+	writeFile(t, src, "app.py", "print('hi')")
+	writeFile(t, src, "vendor/sub/.git/config", "[remote]\n  url = ...")
+	writeFile(t, src, "vendor/sub/lib.py", "def f(): pass")
+
+	rec := runWalk(t, src)
+
+	slices.Sort(rec.files)
+	assert.Equal(t, []string{"app.py", filepath.ToSlash("vendor/sub/lib.py")}, rec.files)
+	for _, d := range rec.dirs {
+		assert.NotContains(t, d, ".git")
+	}
+}
+
+func TestImportDirSkipsDatabricksCacheDirectory(t *testing.T) {
+	src := t.TempDir()
+	writeFile(t, src, "databricks.yml", "bundle:\n  name: x")
+	writeFile(t, src, ".databricks/bundle/state.json", "{}")
+
+	rec := runWalk(t, src)
+
+	slices.Sort(rec.files)
+	assert.Equal(t, []string{"databricks.yml"}, rec.files)
+	for _, d := range rec.dirs {
+		assert.NotContains(t, d, ".databricks")
+	}
+}
+
+func TestImportDirSkipsNodeModulesDirectory(t *testing.T) {
+	src := t.TempDir()
+	writeFile(t, src, "package.json", "{}")
+	writeFile(t, src, "app.js", "console.log('hi')")
+	writeFile(t, src, "node_modules/react/index.js", "module.exports = {}")
+	writeFile(t, src, "node_modules/.package-lock.json", "{}")
+
+	rec := runWalk(t, src)
+
+	slices.Sort(rec.files)
+	assert.Equal(t, []string{"app.js", "package.json"}, rec.files)
+	for _, d := range rec.dirs {
+		assert.NotContains(t, d, "node_modules")
+	}
+}
+
+func TestImportDirCopiesGitignoreFile(t *testing.T) {
+	src := t.TempDir()
+	writeFile(t, src, ".gitignore", "*.pyc\n")
+	writeFile(t, src, "app.py", "print('hi')")
+
+	rec := runWalk(t, src)
+
+	slices.Sort(rec.files)
+	assert.Equal(t, []string{".gitignore", "app.py"}, rec.files)
+}
+
+func TestImportDirAllowsExplicitGitRoot(t *testing.T) {
+	// If a user explicitly passes a .git directory as the source root, copy
+	// it: the skip rule applies to .git dirs encountered during the walk,
+	// not to a deliberately-named root.
+	src := t.TempDir()
+	gitRoot := filepath.Join(src, ".git")
+	require.NoError(t, os.MkdirAll(gitRoot, 0o755))
+	writeFile(t, gitRoot, "HEAD", "ref: refs/heads/main")
+	writeFile(t, gitRoot, "config", "[core]\n")
+
+	rec := runWalk(t, gitRoot)
+
+	slices.Sort(rec.files)
+	assert.Equal(t, []string{"HEAD", "config"}, rec.files)
+}
diff --git a/cmd/workspace/workspace/overrides.go b/cmd/workspace/workspace/overrides.go
index c57209b554b..74186ebaf70 100644
--- a/cmd/workspace/workspace/overrides.go
+++ b/cmd/workspace/workspace/overrides.go
@@ -58,8 +58,8 @@ func exportOverride(exportCmd *cobra.Command, exportReq *workspace.ExportRequest
 
 // Give better errors / hints for common API errors.
 func wrapImportAPIErrors(err error, importReq *workspace.Import) error {
-	apiErr := &apierr.APIError{}
-	if !errors.As(err, &apiErr) {
+	apiErr, ok := errors.AsType[*apierr.APIError](err)
+	if !ok {
 		return err
 	}
 	isFormatSource := importReq.Format == workspace.ImportFormatSource || importReq.Format == ""
diff --git a/cmd/workspace/workspace/workspace.go b/cmd/workspace/workspace/workspace.go
old mode 100755
new mode 100644
index b1ad85707da..97c47f80ac0
--- a/cmd/workspace/workspace/workspace.go
+++ b/cmd/workspace/workspace/workspace.go
@@ -3,6 +3,7 @@
 package workspace
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
@@ -31,6 +32,10 @@ func New() *cobra.Command {
 		RunE:    root.ReportUnknownSubcommand,
 	}
 
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
+
 	// Add methods
 	cmd.AddCommand(newDelete())
 	cmd.AddCommand(newExport())
@@ -74,10 +79,9 @@ func newDelete() *cobra.Command {
 	cmd.Short = `Delete a workspace object.`
 	cmd.Long = `Delete a workspace object.
 
-  Deprecated: use WorkspaceHierarchyService.DeleteTreeNode instead. Deletes an
-  object or a directory (and optionally recursively deletes all objects in the
-  directory). * If path does not exist, this call returns an error
-  RESOURCE_DOES_NOT_EXIST. * If path is a non-empty directory and
+  Deletes an object or a directory (and optionally recursively deletes all
+  objects in the directory). * If path does not exist, this call returns an
+  error RESOURCE_DOES_NOT_EXIST. * If path is a non-empty directory and
   recursive is set to false, this call returns an error
   DIRECTORY_NOT_EMPTY.
 
@@ -88,12 +92,14 @@ func newDelete() *cobra.Command {
     PATH: The absolute path of the notebook or directory.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'path' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'path' in your JSON input")
 			}
 			return nil
 		}
@@ -132,7 +138,7 @@ func newDelete() *cobra.Command {
 				args = append(args, id)
 			}
 			if len(args) != 1 {
-				return fmt.Errorf("expected to have the absolute path of the notebook or directory")
+				return errors.New("expected to have the absolute path of the notebook or directory")
 			}
 			deleteReq.Path = args[0]
 
@@ -199,6 +205,8 @@ func newExport() *cobra.Command {
       only supported for the DBC, SOURCE, and AUTO format.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.PreRunE = root.MustWorkspaceClient
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
@@ -220,7 +228,7 @@ func newExport() *cobra.Command {
 			args = append(args, id)
 		}
 		if len(args) != 1 {
-			return fmt.Errorf("expected to have the absolute path of the object or directory")
+			return errors.New("expected to have the absolute path of the object or directory")
 		}
 		exportReq.Path = args[0]
 
@@ -271,6 +279,8 @@ func newGetPermissionLevels() *cobra.Command {
     WORKSPACE_OBJECT_ID: The workspace object for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -333,6 +343,8 @@ func newGetPermissions() *cobra.Command {
     WORKSPACE_OBJECT_ID: The workspace object for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -385,14 +397,15 @@ func newGetStatus() *cobra.Command {
 	cmd.Short = `Get status.`
 	cmd.Long = `Get status.
 
-  Deprecated: use WorkspaceHierarchyService.GetTreeNode instead. Gets the status
-  of an object or a directory. If path does not exist, this call returns an
-  error RESOURCE_DOES_NOT_EXIST.
+  Gets the status of an object or a directory. If path does not exist, this
+  call returns an error RESOURCE_DOES_NOT_EXIST.
 
   Arguments:
     PATH: The absolute path of the notebook or directory.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -472,12 +485,14 @@ func newImport() *cobra.Command {
       only supported for the DBC and SOURCE formats.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'path' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'path' in your JSON input")
 			}
 			return nil
 		}
@@ -554,14 +569,16 @@ func newList() *cobra.Command {
 	cmd.Short = `List contents.`
 	cmd.Long = `List contents.
 
-  Deprecated: use WorkspaceHierarchyService.ListTreeNodes instead. Lists the
-  contents of a directory, or the object if it is not a directory. If the input
-  path does not exist, this call returns an error RESOURCE_DOES_NOT_EXIST.
+  Lists the contents of a directory, or the object if it is not a directory. If
+  the input path does not exist, this call returns an error
+  RESOURCE_DOES_NOT_EXIST.
 
   Arguments:
     PATH: The absolute path of the notebook or directory.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(1)
@@ -619,10 +636,9 @@ func newMkdirs() *cobra.Command {
 	cmd.Short = `Create a directory.`
 	cmd.Long = `Create a directory.
 
-  Deprecated: use WorkspaceHierarchyService.CreateTreeNode instead. Creates the
-  specified directory (and necessary parent directories if they do not exist).
-  If there is an object (not a directory) at any prefix of the input path, this
-  call returns an error RESOURCE_ALREADY_EXISTS.
+  Creates the specified directory (and necessary parent directories if they do
+  not exist). If there is an object (not a directory) at any prefix of the input
+  path, this call returns an error RESOURCE_ALREADY_EXISTS.
 
   Note that if this operation fails it may have succeeded in creating some of
   the necessary parent directories.
@@ -633,12 +649,14 @@ func newMkdirs() *cobra.Command {
       command will do nothing and succeed.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		if cmd.Flags().Changed("json") {
 			err := root.ExactArgs(0)(cmd, args)
 			if err != nil {
-				return fmt.Errorf("when --json flag is specified, no positional arguments are allowed. Provide 'path' in your JSON input")
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide 'path' in your JSON input")
 			}
 			return nil
 		}
@@ -677,7 +695,7 @@ func newMkdirs() *cobra.Command {
 				args = append(args, id)
 			}
 			if len(args) != 1 {
-				return fmt.Errorf("expected to have the absolute path of the directory")
+				return errors.New("expected to have the absolute path of the directory")
 			}
 			mkdirsReq.Path = args[0]
 		}
@@ -735,6 +753,8 @@ func newSetPermissions() *cobra.Command {
     WORKSPACE_OBJECT_ID: The workspace object for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
@@ -814,6 +834,8 @@ func newUpdatePermissions() *cobra.Command {
     WORKSPACE_OBJECT_ID: The workspace object for which to get or manage permissions.`
 
 	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "GA"
+	cmd.Annotations["launch_stage_display"] = "GA"
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
 		check := root.ExactArgs(2)
diff --git a/docker/config.tfrc b/docker/config.tfrc
deleted file mode 100644
index 123f6d63981..00000000000
--- a/docker/config.tfrc
+++ /dev/null
@@ -1,6 +0,0 @@
-provider_installation {
-    filesystem_mirror {
-        path = "/app/providers"
-        include = ["registry.terraform.io/databricks/databricks"]
-    }
-}
diff --git a/docker/setup.sh b/docker/setup.sh
deleted file mode 100755
index d6e6e3b4ad5..00000000000
--- a/docker/setup.sh
+++ /dev/null
@@ -1,40 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-DATABRICKS_TF_VERSION=$(/app/databricks bundle debug terraform --output json | jq -r .terraform.version)
-DATABRICKS_TF_PROVIDER_VERSION=$(/app/databricks bundle debug terraform --output json | jq -r .terraform.providerVersion)
-
-if [ $ARCH != "amd64" ] && [ $ARCH != "arm64" ]; then
-    echo "Unsupported architecture: $ARCH"
-    exit 1
-fi
-
-# Download the terraform binary
-mkdir -p zip
-wget https://releases.hashicorp.com/terraform/${DATABRICKS_TF_VERSION}/terraform_${DATABRICKS_TF_VERSION}_linux_${ARCH}.zip -O zip/terraform.zip
-
-# Verify the checksum. This is to ensure that the downloaded archive is not tampered with.
-EXPECTED_CHECKSUM="$(/app/databricks bundle debug terraform --output json | jq -r .terraform.checksum.linux_$ARCH)"
-COMPUTED_CHECKSUM=$(sha256sum zip/terraform.zip | awk '{ print $1 }')
-if [ "$COMPUTED_CHECKSUM" != "$EXPECTED_CHECKSUM" ]; then
-    echo "Checksum mismatch for Terraform binary. Version: $DATABRICKS_TF_VERSION, Arch: $ARCH, Expected checksum: $EXPECTED_CHECKSUM, Computed checksum: $COMPUTED_CHECKSUM."
-    exit 1
-fi
-
-# Unzip the terraform binary. It's safe to do so because we have already verified the checksum.
-unzip zip/terraform.zip -d zip/terraform
-mkdir -p /app/bin
-mv zip/terraform/terraform /app/bin/terraform
-
-# Download the provider plugin
-TF_PROVIDER_NAME=terraform-provider-databricks_${DATABRICKS_TF_PROVIDER_VERSION}_linux_${ARCH}.zip
-mkdir -p /app/providers/registry.terraform.io/databricks/databricks
-wget https://github.com/databricks/terraform-provider-databricks/releases/download/v${DATABRICKS_TF_PROVIDER_VERSION}/${TF_PROVIDER_NAME} -O /app/providers/registry.terraform.io/databricks/databricks/${TF_PROVIDER_NAME}
-
-# Verify the provider checksum.
-EXPECTED_PROVIDER_CHECKSUM="$(/app/databricks bundle debug terraform --output json | jq -r .terraform.providerChecksum.linux_$ARCH)"
-COMPUTED_PROVIDER_CHECKSUM=$(sha256sum /app/providers/registry.terraform.io/databricks/databricks/${TF_PROVIDER_NAME} | awk '{ print $1 }')
-if [ "$COMPUTED_PROVIDER_CHECKSUM" != "$EXPECTED_PROVIDER_CHECKSUM" ]; then
-    echo "Checksum mismatch for Terraform provider. Version: $DATABRICKS_TF_PROVIDER_VERSION, Arch: $ARCH, Expected checksum: $EXPECTED_PROVIDER_CHECKSUM, Computed checksum: $COMPUTED_PROVIDER_CHECKSUM."
-    exit 1
-fi
diff --git a/docs/direct.md b/docs/direct.md
index 1077dc405ac..e85d9fcee29 100644
--- a/docs/direct.md
+++ b/docs/direct.md
@@ -1,6 +1,6 @@
 ## Status
 
-Status: Public Preview.
+Status: Generally Available (GA). The direct engine is the only deployment engine since Databricks CLI v1.20.0; existing Terraform deployments are migrated to it automatically.
 Known issues: https://github.com/databricks/cli/issues?q=state%3Aopen%20label%3Aengine%2Fdirect
 
 ## Reporting bugs
@@ -12,9 +12,9 @@ Please ensure you are on the latest version of CLI when reporting an issue.
 ## Background
 
 Declarative Automation Bundles were originally implemented on top of databricks-terraform-provider.
-Since version 0.279.0 DABs support two different deployment engines: "terraform" and "direct".
-The latter does not make use of Terraform.
-It is intended to be a drop-in replacement and will become the only engine we support in 2026\.
+Version 0.279.0 added a second deployment engine, "direct", which does not make use of Terraform.
+It was designed as a drop-in replacement, and since v1.20.0 it is the only engine: the Terraform engine was removed
+(see https://github.com/databricks/cli/issues/6765).
 
 ## Advantages
 
@@ -37,28 +37,30 @@ There are known issues, see https://github.com/databricks/cli/issues?q=state%3Ao
 ### Migrating the existing deployment
 
 The direct engine uses its own state file, also JSON, but with a different schema from terraform state file.
-In order to migrate an existing Terraform-based deployment, use the `databricks bundle deployment migrate` command. The command reads IDs from the existing deployment.
+When a bundle still has Terraform state (`.databricks/bundle/<target>/terraform/terraform.tfstate` or its copy in the workspace), the CLI converts it to direct state in memory before running the command. Commands that only read state (e.g. `bundle plan`, `bundle summary`) work on the converted state without writing it. `bundle deploy` and `bundle destroy` commit the migration: the direct state is written locally and to the workspace, and the Terraform state is retired: the workspace copy is backed up and the local `terraform.tfstate` is renamed to `terraform.tfstate.backup`. `bundle destroy` removes all local state for the target, including that backup.
+
+If the automatic migration fails, the command fails with an error; please report it to dabs-feedback@databricks.com. To keep deploying with Terraform in the meantime, use Databricks CLI v1.19.x, the last version that ships the Terraform engine.
+
+#### Manual migration via "bundle deployment migrate" command
+
+Migrating via this command is still possible, but no longer necessary. The command writes local state only and does not push it to the workspace.
 
 The full sequence of operations:
 
-1. Perform full deployment with Terraform: `databricks bundle deploy -t my_target`
-2. Migrate state file locally: `databricks bundle deployment migrate -t my_target`
-3. Verify that migration was successful: bundle plan should work and should not show any changes to be planned: `databricks bundle plan -t my_target`
-4. If not satisfied with the result, remove new state file and restore terraform state file from the backup:
+1. Migrate state file locally: `databricks bundle deployment migrate -t my_target`
+2. Verify that migration was successful: bundle plan should work and should not show any changes to be planned: `databricks bundle plan -t my_target`
+3. If not satisfied with the result, remove new state file and restore terraform state file from the backup:
 ```
-mv .databricks/bundle/my_target/terraform/tfstate.json.backup .databricks/bundle/my_target/terraform/tfstate.json
+mv .databricks/bundle/my_target/terraform/terraform.tfstate.backup .databricks/bundle/my_target/terraform/terraform.tfstate
 rm .databricks/bundle/my_target/resources.json
 ```
-5. If satisfied with the result, do a deployment to synchronize the state file to the workspace: `databricks bundle deploy -t my_target`
+4. If satisfied with the result, do a deployment to synchronize the state file to the workspace: `databricks bundle deploy -t my_target`
 
 ### Using on new bundles
 
-For bundles that were never deployed, the migrate command will not work. To start using direct engine, you have two options:
-
-- Set bundle.engine OR targets.\*.engine to "direct" in your databricks.yml
-- Set DATABRICKS_BUNDLE_ENGINE=direct env var before the deployment.
+New bundles use the direct engine, so no configuration is needed. The migrate command does not apply here; it is only for bundles previously deployed with Terraform.
 
-If both are provided, the config takes precedence over the env var.
+Setting `bundle.engine` (or `targets.*.engine`) or `DATABRICKS_BUNDLE_ENGINE` to "terraform" is an error. To keep using Terraform, use Databricks CLI v1.19.x.
 
 ## Differences from terraform
 
@@ -78,7 +80,7 @@ The consequences of this are:
 
 ### $resources references lookup
 
-Note, the most common use of $resources is resolving ID ($resources.jobs.foo.id) which should behave identically between terraform and direct engine. The differences can happen in other fields.
+Note, the most common use of $resources is resolving ID ($resources.jobs.foo.id) which behaves identically between terraform and direct engine. The differences can happen in other fields.
 
 The resolution of $resources references in direct engine (e.g. $resources.pipelines.foo.name) is performed in two steps:
 
diff --git a/experimental/aitools/README.md b/experimental/aitools/README.md
index ec12ed10f7c..092552250c0 100644
--- a/experimental/aitools/README.md
+++ b/experimental/aitools/README.md
@@ -2,11 +2,12 @@
 
 `databricks experimental aitools` is the remaining experimental surface for coding-agent workflows.
 
+The skills-management commands (`install`, `update`, `uninstall`, `list`, `version`) have been promoted to top-level `databricks aitools`. The old paths under `databricks experimental aitools` keep working as deprecated aliases that print a notice pointing to the new path.
+
 Current commands:
 
 - `databricks experimental aitools skills list`
 - `databricks experimental aitools skills install [skill-name]`
-- `databricks experimental aitools install [skill-name]`
 - `databricks experimental aitools tools query`
 - `databricks experimental aitools tools discover-schema`
 - `databricks experimental aitools tools get-default-warehouse`
@@ -17,8 +18,7 @@ Current commands:
 
 Current behavior:
 
-- `skills install` installs Databricks skills for detected coding agents.
-- `install` is a compatibility alias for `skills install`.
+- `skills install` installs Databricks skills for detected coding agents (delegates to `databricks aitools install`).
 - `tools` exposes a small set of AI-oriented workspace helpers.
 - `tools query` accepts a single SQL or multiple SQLs in one invocation. Pass
   several positional arguments and/or repeat `--file` to run them in parallel
diff --git a/experimental/aitools/cmd/aitools.go b/experimental/aitools/cmd/aitools.go
index f037ac1a22e..c3e6227392b 100644
--- a/experimental/aitools/cmd/aitools.go
+++ b/experimental/aitools/cmd/aitools.go
@@ -1,6 +1,9 @@
 package aitools
 
 import (
+	"fmt"
+
+	aitoolscmd "github.com/databricks/cli/cmd/aitools"
 	"github.com/spf13/cobra"
 )
 
@@ -9,20 +12,30 @@ func NewAitoolsCmd() *cobra.Command {
 		Use:    "aitools",
 		Hidden: true,
 		Short:  "Databricks AI Tools for coding agents",
-		Long: `Manage Databricks AI Tools.
+		Long:   `Experimental coding-agent helpers. Skills management is at "databricks aitools".`,
+	}
 
-Provides commands to:
-- Install the AI tools in coding agents (install)
-- Manage skills (skills)
-- Access tools directly (tools)`,
+	// Backward-compat aliases for the skills-management commands. They live
+	// at top-level `databricks aitools <X>` now; the old paths still work
+	// but print a deprecation notice that points to the new path.
+	aliases := []struct {
+		name string
+		mk   func() *cobra.Command
+	}{
+		{"install", aitoolscmd.NewInstallCmd},
+		{"update", aitoolscmd.NewUpdateCmd},
+		{"uninstall", aitoolscmd.NewUninstallCmd},
+		{"list", aitoolscmd.NewListCmd},
+		{"version", aitoolscmd.NewVersionCmd},
+	}
+	for _, a := range aliases {
+		sub := a.mk()
+		sub.Hidden = true
+		sub.Deprecated = fmt.Sprintf(`use "databricks aitools %s" instead.`, a.name)
+		cmd.AddCommand(sub)
 	}
 
-	cmd.AddCommand(newInstallCmd())
-	cmd.AddCommand(newUpdateCmd())
-	cmd.AddCommand(newUninstallCmd())
-	cmd.AddCommand(newListCmd())
-	cmd.AddCommand(newVersionCmd())
-	cmd.AddCommand(newSkillsCmd())
+	cmd.AddCommand(aitoolscmd.NewLegacySkillsCmd())
 	cmd.AddCommand(newToolsCmd())
 
 	return cmd
diff --git a/experimental/aitools/cmd/batch.go b/experimental/aitools/cmd/batch.go
index 38ecea531e6..cd1890ceb10 100644
--- a/experimental/aitools/cmd/batch.go
+++ b/experimental/aitools/cmd/batch.go
@@ -12,6 +12,7 @@ import (
 
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/sqlexec"
 	"github.com/databricks/databricks-sdk-go/service/sql"
 	"golang.org/x/sync/errgroup"
 )
@@ -53,7 +54,13 @@ type batchResultError struct {
 // On context cancellation (Ctrl+C or parent context), still-running statements
 // are cancelled server-side via CancelExecution. Statements that finished
 // before cancellation are left as-is.
-func executeBatch(ctx context.Context, api sql.StatementExecutionInterface, warehouseID string, sqls []string, concurrency int) []batchResult {
+//
+// params, if non-nil, are bound on every statement. The same parameter set is
+// reused across the batch, so callers must ensure each SQL uses only markers
+// that are covered.
+func executeBatch(ctx context.Context, api sql.StatementExecutionInterface, warehouseID string, sqls []string, params []sql.StatementParameterListItem, concurrency int) []batchResult {
+	client := sqlexec.New(api, warehouseID)
+
 	pollCtx, pollCancel := context.WithCancel(ctx)
 	defer pollCancel()
 
@@ -97,17 +104,17 @@ func executeBatch(ctx context.Context, api sql.StatementExecutionInterface, ware
 	g.SetLimit(concurrency)
 	for i, sqlStr := range sqls {
 		g.Go(func() error {
-			results[i] = runOneBatchQuery(pollCtx, api, warehouseID, sqlStr, statementIDs, i)
+			results[i] = runOneBatchQuery(pollCtx, client, sqlStr, params, statementIDs, i)
 			completed.Add(1)
 			return nil
 		})
 	}
 	_ = g.Wait()
 
-	// pollStatement is a pure helper that returns ctx.Err() on cancellation
-	// without touching the server. Sweep any not-yet-terminal statements here.
+	// Poll returns ctx.Err() on cancellation without touching the server.
+	// Sweep any not-yet-terminal statements here.
 	if pollCtx.Err() != nil {
-		cancelInFlight(ctx, api, statementIDs, results)
+		cancelInFlight(ctx, client, statementIDs, results)
 	}
 
 	return results
@@ -115,32 +122,27 @@ func executeBatch(ctx context.Context, api sql.StatementExecutionInterface, ware
 
 // runOneBatchQuery submits one SQL, polls to completion, and returns its
 // batchResult. All errors are encoded into the result; never returns an error.
-func runOneBatchQuery(ctx context.Context, api sql.StatementExecutionInterface, warehouseID, sqlStr string, statementIDs []string, idx int) batchResult {
+func runOneBatchQuery(ctx context.Context, client *sqlexec.Client, sqlStr string, params []sql.StatementParameterListItem, statementIDs []string, idx int) batchResult {
 	start := time.Now()
 	result := batchResult{SQL: sqlStr}
 
-	resp, err := api.ExecuteStatement(ctx, sql.ExecuteStatementRequest{
-		WarehouseId:   warehouseID,
-		Statement:     sqlStr,
-		WaitTimeout:   "0s",
-		OnWaitTimeout: sql.ExecuteStatementRequestOnWaitTimeoutContinue,
-	})
+	stmt, err := client.Submit(ctx, sqlStr, sqlexec.WithParameters(params))
 	if err != nil {
 		if ctx.Err() != nil {
 			result.State = sql.StatementStateCanceled
 			result.Error = &batchResultError{Message: "submission cancelled"}
 		} else {
 			result.State = sql.StatementStateFailed
-			result.Error = &batchResultError{Message: fmt.Sprintf("execute statement: %v", err)}
+			result.Error = &batchResultError{Message: err.Error()}
 		}
 		result.ElapsedMs = time.Since(start).Milliseconds()
 		return result
 	}
 
-	statementIDs[idx] = resp.StatementId
-	result.StatementID = resp.StatementId
+	statementIDs[idx] = stmt.ID
+	result.StatementID = stmt.ID
 
-	pollResp, err := pollStatement(ctx, api, resp)
+	stmt, err = client.Poll(ctx, stmt)
 	if err != nil {
 		if ctx.Err() != nil {
 			result.State = sql.StatementStateCanceled
@@ -153,30 +155,26 @@ func runOneBatchQuery(ctx context.Context, api sql.StatementExecutionInterface,
 		return result
 	}
 
-	if pollResp.Status != nil {
-		result.State = pollResp.Status.State
-	}
+	result.State = stmt.State
 
-	if result.State != sql.StatementStateSucceeded {
-		result.Error = &batchResultError{}
-		if pollResp.Status != nil && pollResp.Status.Error != nil {
-			result.Error.Message = pollResp.Status.Error.Message
-			result.Error.ErrorCode = string(pollResp.Status.Error.ErrorCode)
-		} else {
-			result.Error.Message = fmt.Sprintf("query reached terminal state %s", result.State)
+	if err := stmt.Err(); err != nil {
+		se, _ := errors.AsType[*sqlexec.StatementError](err)
+		result.Error = &batchResultError{
+			Message:   se.Message,
+			ErrorCode: string(se.Code),
 		}
 		result.ElapsedMs = time.Since(start).Milliseconds()
 		return result
 	}
 
-	result.Columns = extractColumns(pollResp.Manifest)
-	rows, err := fetchAllRows(ctx, api, pollResp)
+	res, err := client.Results(ctx, stmt)
 	if err != nil {
 		result.Error = &batchResultError{Message: fmt.Sprintf("fetch rows: %v", err)}
 		result.ElapsedMs = time.Since(start).Milliseconds()
 		return result
 	}
-	result.Rows = rows
+	result.Columns = res.Columns
+	result.Rows = res.Rows
 	result.ElapsedMs = time.Since(start).Milliseconds()
 	return result
 }
@@ -184,7 +182,7 @@ func runOneBatchQuery(ctx context.Context, api sql.StatementExecutionInterface,
 // cancelInFlight sends CancelExecution for every statement that didn't reach
 // a terminal state server-side before context cancellation. Best effort: errors
 // are logged at warn but don't fail the batch.
-func cancelInFlight(ctx context.Context, api sql.StatementExecutionInterface, statementIDs []string, results []batchResult) {
+func cancelInFlight(ctx context.Context, client *sqlexec.Client, statementIDs []string, results []batchResult) {
 	var cancelled int
 	for i, sid := range statementIDs {
 		if sid == "" {
@@ -203,7 +201,7 @@ func cancelInFlight(ctx context.Context, api sql.StatementExecutionInterface, st
 		// values but drops the cancellation signal so the cancel RPC actually
 		// reaches the warehouse instead of short-circuiting on ctx.Err().
 		cancelCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), cancelTimeout)
-		if err := api.CancelExecution(cancelCtx, sql.CancelExecutionRequest{StatementId: sid}); err != nil {
+		if err := client.Cancel(cancelCtx, sid); err != nil {
 			log.Warnf(ctx, "Failed to cancel statement %s: %v", sid, err)
 		}
 		cancel()
diff --git a/experimental/aitools/cmd/batch_test.go b/experimental/aitools/cmd/batch_test.go
index f6f468768f9..8288a43da5d 100644
--- a/experimental/aitools/cmd/batch_test.go
+++ b/experimental/aitools/cmd/batch_test.go
@@ -73,7 +73,7 @@ func TestExecuteBatchAllSucceed(t *testing.T) {
 		}, nil).Once()
 	}
 
-	results := executeBatch(ctx, mockAPI, "wh-123", sqls, 8)
+	results := executeBatch(ctx, mockAPI, "wh-123", sqls, nil, 8)
 
 	require.Len(t, results, 3)
 	for i, r := range results {
@@ -86,6 +86,25 @@ func TestExecuteBatchAllSucceed(t *testing.T) {
 	}
 }
 
+func TestExecuteBatchPassesParametersToAllStatements(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	mockAPI := mocksql.NewMockStatementExecutionInterface(t)
+
+	params := []sql.StatementParameterListItem{
+		{Name: "since", Type: "DATE", Value: "2026-01-01"},
+	}
+
+	mockAPI.EXPECT().ExecuteStatement(mock.Anything, mock.MatchedBy(func(req sql.ExecuteStatementRequest) bool {
+		return assert.ObjectsAreEqual(params, req.Parameters)
+	})).Return(&sql.StatementResponse{
+		StatementId: "stmt",
+		Status:      &sql.StatementStatus{State: sql.StatementStateSucceeded},
+	}, nil).Times(2)
+
+	results := executeBatch(ctx, mockAPI, "wh-1", []string{"SELECT 1 WHERE 1=1 AND :since IS NOT NULL", "SELECT 2 WHERE :since IS NOT NULL"}, params, 8)
+	require.Len(t, results, 2)
+}
+
 func TestExecuteBatchPartialFailure(t *testing.T) {
 	ctx := cmdio.MockDiscard(t.Context())
 	mockAPI := mocksql.NewMockStatementExecutionInterface(t)
@@ -112,7 +131,7 @@ func TestExecuteBatchPartialFailure(t *testing.T) {
 		},
 	}, nil).Once()
 
-	results := executeBatch(ctx, mockAPI, "wh-123", []string{"SELECT 1", "SELECT bad"}, 8)
+	results := executeBatch(ctx, mockAPI, "wh-123", []string{"SELECT 1", "SELECT bad"}, nil, 8)
 
 	require.Len(t, results, 2)
 	assert.Nil(t, results[0].Error)
@@ -141,7 +160,7 @@ func TestExecuteBatchSubmissionFailure(t *testing.T) {
 		return req.Statement == "SELECT broken"
 	})).Return(nil, errors.New("network unreachable")).Once()
 
-	results := executeBatch(ctx, mockAPI, "wh-123", []string{"SELECT good", "SELECT broken"}, 8)
+	results := executeBatch(ctx, mockAPI, "wh-123", []string{"SELECT good", "SELECT broken"}, nil, 8)
 
 	require.Len(t, results, 2)
 	assert.Nil(t, results[0].Error)
@@ -163,7 +182,7 @@ func TestExecuteBatchSetsOnWaitTimeoutContinue(t *testing.T) {
 		Status:      &sql.StatementStatus{State: sql.StatementStateSucceeded},
 	}, nil).Times(2)
 
-	results := executeBatch(ctx, mockAPI, "wh-123", []string{"q1", "q2"}, 8)
+	results := executeBatch(ctx, mockAPI, "wh-123", []string{"q1", "q2"}, nil, 8)
 	require.Len(t, results, 2)
 }
 
@@ -196,7 +215,7 @@ func TestExecuteBatchPreservesInputOrder(t *testing.T) {
 	}
 
 	sqls := []string{"SELECT 'slow'", "SELECT 'fast1'", "SELECT 'fast2'"}
-	results := executeBatch(ctx, mockAPI, "wh-1", sqls, 8)
+	results := executeBatch(ctx, mockAPI, "wh-1", sqls, nil, 8)
 
 	require.Len(t, results, 3)
 	for i, r := range results {
@@ -233,7 +252,7 @@ func TestExecuteBatchContextCancellationCancelsInFlight(t *testing.T) {
 
 	cancel()
 
-	results := executeBatch(ctx, mockAPI, "wh", []string{"q1", "q2", "q3"}, 8)
+	results := executeBatch(ctx, mockAPI, "wh", []string{"q1", "q2", "q3"}, nil, 8)
 
 	require.Len(t, results, 3)
 	for i, r := range results {
diff --git a/experimental/aitools/cmd/discover_schema.go b/experimental/aitools/cmd/discover_schema.go
index 091222368d9..28f8bcb730b 100644
--- a/experimental/aitools/cmd/discover_schema.go
+++ b/experimental/aitools/cmd/discover_schema.go
@@ -10,6 +10,7 @@ import (
 	"slices"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"syscall"
 
 	"github.com/databricks/cli/cmd/root"
@@ -18,6 +19,7 @@ import (
 	"github.com/databricks/cli/libs/cmdctx"
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/sqlexec"
 	"github.com/databricks/databricks-sdk-go"
 	dbsql "github.com/databricks/databricks-sdk-go/service/sql"
 	"github.com/spf13/cobra"
@@ -44,8 +46,10 @@ func newSQLGate(limit int) *sqlGate {
 // run executes a SQL statement asynchronously, polls until terminal, and
 // records the statement_id so it can be cancelled if the parent context is
 // cancelled. Acquires a slot from the gate before submitting and releases it
-// when polling completes (or the caller's context is cancelled).
-func (g *sqlGate) run(ctx context.Context, w *databricks.WorkspaceClient, warehouseID, statement string) (*dbsql.StatementResponse, error) {
+// when polling completes (or the caller's context is cancelled). On success it
+// returns the assembled result; a terminal non-success state is surfaced as the
+// CLI-facing query error.
+func (g *sqlGate) run(ctx context.Context, w *databricks.WorkspaceClient, warehouseID, statement string) (*sqlexec.Result, error) {
 	// If the caller cancelled before we even tried, don't enter the select:
 	// when the gate has free slots both cases are ready and Go picks one
 	// pseudo-randomly. Without this early-out we'd occasionally submit a
@@ -60,28 +64,25 @@ func (g *sqlGate) run(ctx context.Context, w *databricks.WorkspaceClient, wareho
 		return nil, ctx.Err()
 	}
 
-	resp, err := w.StatementExecution.ExecuteStatement(ctx, dbsql.ExecuteStatementRequest{
-		WarehouseId:   warehouseID,
-		Statement:     statement,
-		WaitTimeout:   "0s",
-		OnWaitTimeout: dbsql.ExecuteStatementRequestOnWaitTimeoutContinue,
-	})
+	client := sqlexec.New(w.StatementExecution, warehouseID)
+
+	stmt, err := client.Submit(ctx, statement)
 	if err != nil {
-		return nil, fmt.Errorf("execute statement: %w", err)
+		return nil, err
 	}
 
 	g.mu.Lock()
-	g.ids = append(g.ids, resp.StatementId)
+	g.ids = append(g.ids, stmt.ID)
 	g.mu.Unlock()
 
-	pollResp, err := pollStatement(ctx, w.StatementExecution, resp)
+	stmt, err = client.Poll(ctx, stmt)
 	if err != nil {
 		return nil, err
 	}
-	if err := checkFailedState(pollResp.Status); err != nil {
+	if err := presentQueryError(stmt.Err()); err != nil {
 		return nil, err
 	}
-	return pollResp, nil
+	return client.Results(ctx, stmt)
 }
 
 // trackedIDs returns a snapshot of statement_ids submitted through this gate.
@@ -161,47 +162,20 @@ CancelExecution before the command exits.`,
 
 			gate := newSQLGate(concurrency)
 
-			results := make([]string, len(args))
-			g := new(errgroup.Group)
-			for i, table := range args {
-				g.Go(func() error {
-					result, err := discoverTable(pollCtx, gate, w, warehouseID, table)
-					if err != nil {
-						results[i] = fmt.Sprintf("Error discovering %s: %v", table, err)
-					} else {
-						results[i] = result
-					}
-					// A failure on one table shouldn't abort the others.
-					return nil
-				})
-			}
-			_ = g.Wait()
+			output, anyFailed := runDiscoverSchemas(pollCtx, gate, w, warehouseID, args)
 
 			if pollCtx.Err() != nil {
 				cancelDiscoverInFlight(ctx, w.StatementExecution, gate.trackedIDs())
 				return root.ErrAlreadyPrinted
 			}
 
-			// format output with dividers for multiple tables
-			var output string
-			if len(results) == 1 {
-				output = results[0]
-			} else {
-				divider := strings.Repeat("-", 70)
-				var sb strings.Builder
-				for i, result := range results {
-					if i > 0 {
-						sb.WriteByte('\n')
-						sb.WriteString(divider)
-						sb.WriteByte('\n')
-					}
-					fmt.Fprintf(&sb, "TABLE: %s\n%s\n", args[i], divider)
-					sb.WriteString(result)
-				}
-				output = sb.String()
-			}
-
 			cmdio.LogString(ctx, output)
+			if anyFailed {
+				// Per-table errors are already in `output`; ErrAlreadyPrinted
+				// gives a non-zero exit without re-printing them so scripts
+				// and CI can detect failure via the exit code.
+				return root.ErrAlreadyPrinted
+			}
 			return nil
 		},
 	}
@@ -211,6 +185,46 @@ CancelExecution before the command exits.`,
 	return cmd
 }
 
+// runDiscoverSchemas discovers schemas for tables concurrently and returns the
+// rendered output. The bool is true if any table failed; per-table errors are
+// inlined into the output so one bad table doesn't abort the others.
+func runDiscoverSchemas(ctx context.Context, gate *sqlGate, w *databricks.WorkspaceClient, warehouseID string, tables []string) (string, bool) {
+	results := make([]string, len(tables))
+	var anyFailed atomic.Bool
+	g := new(errgroup.Group)
+	for i, table := range tables {
+		g.Go(func() error {
+			result, err := discoverTable(ctx, gate, w, warehouseID, table)
+			if err != nil {
+				results[i] = fmt.Sprintf("Error discovering %s: %v", table, err)
+				anyFailed.Store(true)
+			} else {
+				results[i] = result
+			}
+			// A failure on one table shouldn't abort the others.
+			return nil
+		})
+	}
+	_ = g.Wait()
+
+	if len(tables) == 1 {
+		return results[0], anyFailed.Load()
+	}
+
+	divider := strings.Repeat("-", 70)
+	var sb strings.Builder
+	for i, result := range results {
+		if i > 0 {
+			sb.WriteByte('\n')
+			sb.WriteString(divider)
+			sb.WriteByte('\n')
+		}
+		fmt.Fprintf(&sb, "TABLE: %s\n%s\n", tables[i], divider)
+		sb.WriteString(result)
+	}
+	return sb.String(), anyFailed.Load()
+}
+
 // cancelDiscoverInFlight sends CancelExecution for every recorded statement_id.
 // Best effort: errors are logged but don't fail the user-visible exit.
 // Statements that already finished server-side return an error which we just
@@ -221,9 +235,11 @@ func cancelDiscoverInFlight(ctx context.Context, api dbsql.StatementExecutionInt
 		cmdio.LogString(ctx, "discover-schema cancelled.")
 		return
 	}
+	// Cancel/Poll/Get don't use the warehouse ID, so an empty one is fine here.
+	client := sqlexec.New(api, "")
 	for _, id := range ids {
 		cancelCtx, cancel := context.WithTimeout(ctx, cancelTimeout)
-		if err := api.CancelExecution(cancelCtx, dbsql.CancelExecutionRequest{StatementId: id}); err != nil {
+		if err := client.Cancel(cancelCtx, id); err != nil {
 			log.Warnf(ctx, "Failed to cancel statement %s: %v", id, err)
 		}
 		cancel()
@@ -238,12 +254,12 @@ func discoverTable(ctx context.Context, gate *sqlGate, w *databricks.WorkspaceCl
 	}
 
 	// 1. describe table - get columns and types
-	descResp, err := gate.run(ctx, w, warehouseID, "DESCRIBE TABLE "+quoted)
+	descResult, err := gate.run(ctx, w, warehouseID, "DESCRIBE TABLE "+quoted)
 	if err != nil {
 		return "", fmt.Errorf("describe table: %w", err)
 	}
 
-	columns, types := parseDescribeResult(descResp)
+	columns, types := parseDescribeResult(descResult)
 	if len(columns) == 0 {
 		return "", errors.New("no columns found")
 	}
@@ -267,16 +283,16 @@ func discoverTable(ctx context.Context, gate *sqlGate, w *databricks.WorkspaceCl
 	nullSQL := fmt.Sprintf("SELECT COUNT(*) AS total_rows, %s FROM %s",
 		strings.Join(nullCountExprs, ", "), quoted)
 
-	var sampleResp, nullResp *dbsql.StatementResponse
+	var sampleResult, nullResult *sqlexec.Result
 	var sampleErr, nullErr error
 
 	g := new(errgroup.Group)
 	g.Go(func() error {
-		sampleResp, sampleErr = gate.run(ctx, w, warehouseID, sampleSQL)
+		sampleResult, sampleErr = gate.run(ctx, w, warehouseID, sampleSQL)
 		return nil
 	})
 	g.Go(func() error {
-		nullResp, nullErr = gate.run(ctx, w, warehouseID, nullSQL)
+		nullResult, nullErr = gate.run(ctx, w, warehouseID, nullSQL)
 		return nil
 	})
 	_ = g.Wait()
@@ -292,25 +308,21 @@ func discoverTable(ctx context.Context, gate *sqlGate, w *databricks.WorkspaceCl
 		fmt.Fprintf(&sb, "\nSAMPLE DATA: Error - %v\n", sampleErr)
 	} else {
 		sb.WriteString("\nSAMPLE DATA:\n")
-		sb.WriteString(formatTableData(sampleResp))
+		sb.WriteString(formatTableData(sampleResult))
 	}
 
 	if nullErr != nil {
 		fmt.Fprintf(&sb, "\nNULL COUNTS: Error - %v\n", nullErr)
 	} else {
 		sb.WriteString("\nNULL COUNTS:\n")
-		sb.WriteString(formatNullCounts(nullResp, columns))
+		sb.WriteString(formatNullCounts(nullResult, columns))
 	}
 
 	return sb.String(), nil
 }
 
-func parseDescribeResult(resp *dbsql.StatementResponse) (columns, types []string) {
-	if resp.Result == nil || resp.Result.DataArray == nil {
-		return nil, nil
-	}
-
-	for _, row := range resp.Result.DataArray {
+func parseDescribeResult(result *sqlexec.Result) (columns, types []string) {
+	for _, row := range result.Rows {
 		if len(row) < 2 {
 			continue
 		}
@@ -326,20 +338,15 @@ func parseDescribeResult(resp *dbsql.StatementResponse) (columns, types []string
 	return columns, types
 }
 
-func formatTableData(resp *dbsql.StatementResponse) string {
-	if resp.Result == nil || resp.Result.DataArray == nil || len(resp.Result.DataArray) == 0 {
+func formatTableData(result *sqlexec.Result) string {
+	if len(result.Rows) == 0 {
 		return "  (no data)\n"
 	}
 
 	var sb strings.Builder
-	var columns []string
-	if resp.Manifest != nil && resp.Manifest.Schema != nil {
-		for _, col := range resp.Manifest.Schema.Columns {
-			columns = append(columns, col.Name)
-		}
-	}
+	columns := result.Columns
 
-	for i, row := range resp.Result.DataArray {
+	for i, row := range result.Rows {
 		fmt.Fprintf(&sb, "  Row %d:\n", i+1)
 		for j, val := range row {
 			colName := fmt.Sprintf("col%d", j)
@@ -352,12 +359,12 @@ func formatTableData(resp *dbsql.StatementResponse) string {
 	return sb.String()
 }
 
-func formatNullCounts(resp *dbsql.StatementResponse, columns []string) string {
-	if resp.Result == nil || resp.Result.DataArray == nil || len(resp.Result.DataArray) == 0 {
+func formatNullCounts(result *sqlexec.Result, columns []string) string {
+	if len(result.Rows) == 0 {
 		return "  (no data)\n"
 	}
 
-	row := resp.Result.DataArray[0]
+	row := result.Rows[0]
 	var sb strings.Builder
 
 	// first value is total_rows
diff --git a/experimental/aitools/cmd/discover_schema_test.go b/experimental/aitools/cmd/discover_schema_test.go
index fe6d86e799f..d0fae4b24c2 100644
--- a/experimental/aitools/cmd/discover_schema_test.go
+++ b/experimental/aitools/cmd/discover_schema_test.go
@@ -10,6 +10,7 @@ import (
 	"time"
 
 	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/sqlexec"
 	"github.com/databricks/databricks-sdk-go"
 	mocksql "github.com/databricks/databricks-sdk-go/experimental/mocks/service/sql"
 	dbsql "github.com/databricks/databricks-sdk-go/service/sql"
@@ -50,17 +51,17 @@ func TestQuoteTableName(t *testing.T) {
 }
 
 func TestParseDescribeResultSkipsMetadataRows(t *testing.T) {
-	resp := &dbsql.StatementResponse{
-		Result: &dbsql.ResultData{DataArray: [][]string{
+	result := &sqlexec.Result{
+		Rows: [][]string{
 			{"id", "BIGINT", ""},
 			{"name", "STRING", ""},
 			{"# Partition Information", "", ""},
 			{"region", "STRING", ""},
 			{"", "STRING", ""},
-		}},
+		},
 	}
 
-	cols, types := parseDescribeResult(resp)
+	cols, types := parseDescribeResult(result)
 	assert.Equal(t, []string{"id", "name", "region"}, cols)
 	assert.Equal(t, []string{"BIGINT", "STRING", "STRING"}, types)
 }
@@ -82,9 +83,9 @@ func TestSQLGateRunPinsOnWaitTimeoutAndRecordsID(t *testing.T) {
 	w := &databricks.WorkspaceClient{StatementExecution: mockAPI}
 	gate := newSQLGate(2)
 
-	resp, err := gate.run(ctx, w, "wh-1", "SELECT 1")
+	result, err := gate.run(ctx, w, "wh-1", "SELECT 1")
 	require.NoError(t, err)
-	assert.Equal(t, "stmt-1", resp.StatementId)
+	assert.Equal(t, [][]string{{"1"}}, result.Rows)
 	assert.Equal(t, []string{"stmt-1"}, gate.trackedIDs())
 }
 
@@ -324,3 +325,62 @@ func TestDiscoverSchemaInvalidTableNameRejectedBeforeWorkspaceClient(t *testing.
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "expected CATALOG.SCHEMA.TABLE")
 }
+
+func TestRunDiscoverSchemasFlagsTableFailureForExitCode(t *testing.T) {
+	// runDiscoverSchemas must report any per-table failure via the bool
+	// return so the caller can produce a non-zero exit. Without this signal
+	// scripts and CI parse stdout to detect failure, which is brittle.
+	ctx := cmdio.MockDiscard(t.Context())
+	mockAPI := mocksql.NewMockStatementExecutionInterface(t)
+
+	mockAPI.EXPECT().ExecuteStatement(mock.Anything, mock.Anything).Return(&dbsql.StatementResponse{
+		StatementId: "stmt-bad",
+		Status: &dbsql.StatementStatus{
+			State: dbsql.StatementStateFailed,
+			Error: &dbsql.ServiceError{ErrorCode: "TABLE_OR_VIEW_NOT_FOUND", Message: "no such table"},
+		},
+	}, nil).Once()
+
+	w := &databricks.WorkspaceClient{StatementExecution: mockAPI}
+	output, anyFailed := runDiscoverSchemas(ctx, newSQLGate(8), w, "wh-1", []string{"main.public.missing"})
+
+	assert.True(t, anyFailed)
+	assert.Contains(t, output, "Error discovering main.public.missing")
+	assert.Contains(t, output, "TABLE_OR_VIEW_NOT_FOUND")
+}
+
+func TestRunDiscoverSchemasAllSucceedReturnsFalse(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	mockAPI := mocksql.NewMockStatementExecutionInterface(t)
+
+	mockAPI.EXPECT().ExecuteStatement(mock.Anything, mock.MatchedBy(func(req dbsql.ExecuteStatementRequest) bool {
+		return strings.HasPrefix(req.Statement, "DESCRIBE TABLE")
+	})).Return(&dbsql.StatementResponse{
+		StatementId: "stmt-desc",
+		Status:      &dbsql.StatementStatus{State: dbsql.StatementStateSucceeded},
+		Result:      &dbsql.ResultData{DataArray: [][]string{{"id", "BIGINT", ""}}},
+	}, nil).Once()
+
+	mockAPI.EXPECT().ExecuteStatement(mock.Anything, mock.MatchedBy(func(req dbsql.ExecuteStatementRequest) bool {
+		return strings.HasPrefix(req.Statement, "SELECT *")
+	})).Return(&dbsql.StatementResponse{
+		StatementId: "stmt-sample",
+		Status:      &dbsql.StatementStatus{State: dbsql.StatementStateSucceeded},
+	}, nil).Once()
+
+	mockAPI.EXPECT().ExecuteStatement(mock.Anything, mock.MatchedBy(func(req dbsql.ExecuteStatementRequest) bool {
+		return strings.Contains(req.Statement, "SUM(CASE WHEN")
+	})).Return(&dbsql.StatementResponse{
+		StatementId: "stmt-null",
+		Status:      &dbsql.StatementStatus{State: dbsql.StatementStateSucceeded},
+		Manifest:    &dbsql.ResultManifest{Schema: &dbsql.ResultSchema{Columns: []dbsql.ColumnInfo{{Name: "total_rows"}, {Name: "id_nulls"}}}},
+		Result:      &dbsql.ResultData{DataArray: [][]string{{"7", "0"}}},
+	}, nil).Once()
+
+	w := &databricks.WorkspaceClient{StatementExecution: mockAPI}
+	output, anyFailed := runDiscoverSchemas(ctx, newSQLGate(8), w, "wh-1", []string{"main.public.orders"})
+
+	assert.False(t, anyFailed)
+	assert.Contains(t, output, "COLUMNS:")
+	assert.NotContains(t, output, "Error discovering")
+}
diff --git a/experimental/aitools/cmd/install.go b/experimental/aitools/cmd/install.go
deleted file mode 100644
index 8e95e511cf5..00000000000
--- a/experimental/aitools/cmd/install.go
+++ /dev/null
@@ -1,147 +0,0 @@
-package aitools
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"strings"
-
-	"github.com/databricks/cli/experimental/aitools/lib/agents"
-	"github.com/databricks/cli/experimental/aitools/lib/installer"
-	"github.com/databricks/cli/libs/cmdio"
-	"github.com/spf13/cobra"
-)
-
-func newInstallCmd() *cobra.Command {
-	var skillsFlag, agentsFlag string
-	var includeExperimental bool
-	var projectFlag, globalFlag bool
-
-	cmd := &cobra.Command{
-		Use:   "install",
-		Short: "Install AI skills for coding agents",
-		Long: `Install Databricks AI skills for detected coding agents.
-
-By default, skills are installed globally to each agent's skills directory.
-Use --project to install to the current project directory instead.
-When multiple agents are detected, skills are stored in a canonical location
-and symlinked to each agent to avoid duplication.
-
-Supported agents: Claude Code, Cursor, Codex CLI, OpenCode, GitHub Copilot, Antigravity`,
-		Args: cobra.NoArgs,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			ctx := cmd.Context()
-
-			// Resolve scope.
-			scope, err := resolveScopeWithPrompt(ctx, projectFlag, globalFlag)
-			if err != nil {
-				return err
-			}
-
-			// Resolve target agents.
-			var targetAgents []*agents.Agent
-			if agentsFlag != "" {
-				targetAgents, err = resolveAgentNames(ctx, agentsFlag)
-				if err != nil {
-					return err
-				}
-			} else {
-				detected := agents.DetectInstalled(ctx)
-				if len(detected) == 0 {
-					printNoAgentsMessage(ctx)
-					return nil
-				}
-
-				// For project scope, pre-filter to compatible agents before prompting.
-				if scope == installer.ScopeProject {
-					detected = filterProjectScopeAgents(detected)
-					if len(detected) == 0 {
-						return errors.New("no detected agents support project-scoped skills")
-					}
-				}
-
-				switch {
-				case len(detected) == 1:
-					targetAgents = detected
-				case cmdio.IsPromptSupported(ctx):
-					targetAgents, err = promptAgentSelection(ctx, detected)
-					if err != nil {
-						return err
-					}
-				default:
-					targetAgents = detected
-				}
-			}
-
-			// Build install options.
-			opts := installer.InstallOptions{
-				IncludeExperimental: includeExperimental,
-				Scope:               scope,
-			}
-			opts.SpecificSkills = splitAndTrim(skillsFlag)
-
-			installer.PrintInstallingFor(ctx, targetAgents)
-
-			src := &installer.GitHubManifestSource{}
-			return installSkillsForAgentsFn(ctx, src, targetAgents, opts)
-		},
-	}
-
-	cmd.Flags().StringVar(&skillsFlag, "skills", "", "Specific skills to install (comma-separated)")
-	cmd.Flags().StringVar(&agentsFlag, "agents", "", "Agents to install for (comma-separated, e.g. claude-code,cursor)")
-	cmd.Flags().BoolVar(&includeExperimental, "experimental", false, "Include experimental skills")
-	cmd.Flags().BoolVar(&projectFlag, "project", false, "Install to project directory (cwd)")
-	cmd.Flags().BoolVar(&globalFlag, "global", false, "Install globally (default)")
-	return cmd
-}
-
-// resolveAgentNames parses a comma-separated list of agent names and validates
-// them against the registry. Returns an error for unrecognized names.
-func resolveAgentNames(ctx context.Context, names string) ([]*agents.Agent, error) {
-	available := make(map[string]*agents.Agent, len(agents.Registry))
-	var availableNames []string
-	for i := range agents.Registry {
-		a := &agents.Registry[i]
-		available[a.Name] = a
-		availableNames = append(availableNames, a.Name)
-	}
-
-	var result []*agents.Agent
-	seen := make(map[string]bool)
-	for name := range strings.SplitSeq(names, ",") {
-		name = strings.TrimSpace(name)
-		if name == "" || seen[name] {
-			continue
-		}
-		seen[name] = true
-		agent, ok := available[name]
-		if !ok {
-			return nil, fmt.Errorf("unknown agent %q. Available agents: %s", name, strings.Join(availableNames, ", "))
-		}
-		result = append(result, agent)
-	}
-
-	if len(result) == 0 {
-		return nil, errors.New("no agents specified")
-	}
-	return result, nil
-}
-
-// filterProjectScopeAgents returns only agents that support project-scoped skills.
-func filterProjectScopeAgents(detected []*agents.Agent) []*agents.Agent {
-	var compatible []*agents.Agent
-	for _, a := range detected {
-		if a.SupportsProjectScope {
-			compatible = append(compatible, a)
-		}
-	}
-	return compatible
-}
-
-// printNoAgentsMessage prints the "no agents detected" message.
-func printNoAgentsMessage(ctx context.Context) {
-	cmdio.LogString(ctx, cmdio.Yellow(ctx, "No supported coding agents detected."))
-	cmdio.LogString(ctx, "")
-	cmdio.LogString(ctx, "Supported agents: Claude Code, Cursor, Codex CLI, OpenCode, GitHub Copilot, Antigravity")
-	cmdio.LogString(ctx, "Please install at least one coding agent first.")
-}
diff --git a/experimental/aitools/cmd/install_test.go b/experimental/aitools/cmd/install_test.go
deleted file mode 100644
index 38639705ea4..00000000000
--- a/experimental/aitools/cmd/install_test.go
+++ /dev/null
@@ -1,583 +0,0 @@
-package aitools
-
-import (
-	"bufio"
-	"context"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/databricks/cli/experimental/aitools/lib/agents"
-	"github.com/databricks/cli/experimental/aitools/lib/installer"
-	"github.com/databricks/cli/libs/cmdio"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func setupInstallMock(t *testing.T) *[]installCall {
-	t.Helper()
-	orig := installSkillsForAgentsFn
-	t.Cleanup(func() { installSkillsForAgentsFn = orig })
-
-	var calls []installCall
-	installSkillsForAgentsFn = func(_ context.Context, _ installer.ManifestSource, targetAgents []*agents.Agent, opts installer.InstallOptions) error {
-		names := make([]string, len(targetAgents))
-		for i, a := range targetAgents {
-			names[i] = a.Name
-		}
-		calls = append(calls, installCall{agents: names, opts: opts})
-		return nil
-	}
-	return &calls
-}
-
-func setupScopeMock(t *testing.T, scope string) *bool {
-	t.Helper()
-	orig := promptScopeSelection
-	t.Cleanup(func() { promptScopeSelection = orig })
-
-	called := false
-	promptScopeSelection = func(_ context.Context) (string, error) {
-		called = true
-		return scope, nil
-	}
-	return &called
-}
-
-type installCall struct {
-	agents []string
-	opts   installer.InstallOptions
-}
-
-func setupTestAgents(t *testing.T) string {
-	t.Helper()
-	tmp := t.TempDir()
-	t.Setenv("HOME", tmp)
-	// Create config dirs for two agents.
-	require.NoError(t, os.MkdirAll(filepath.Join(tmp, ".claude"), 0o755))
-	require.NoError(t, os.MkdirAll(filepath.Join(tmp, ".cursor"), 0o755))
-	return tmp
-}
-
-func TestInstallAllSkillsForAllAgents(t *testing.T) {
-	setupTestAgents(t)
-	calls := setupInstallMock(t)
-
-	ctx := cmdio.MockDiscard(t.Context())
-	cmd := newInstallCmd()
-	cmd.SetContext(ctx)
-
-	err := cmd.RunE(cmd, nil)
-	require.NoError(t, err)
-
-	require.Len(t, *calls, 1)
-	assert.Len(t, (*calls)[0].agents, 2)
-	assert.Nil(t, (*calls)[0].opts.SpecificSkills)
-}
-
-func TestInstallSpecificSkills(t *testing.T) {
-	setupTestAgents(t)
-	calls := setupInstallMock(t)
-
-	ctx := cmdio.MockDiscard(t.Context())
-	cmd := newInstallCmd()
-	cmd.SetContext(ctx)
-	cmd.SetArgs([]string{"--skills", "databricks,databricks-apps"})
-
-	err := cmd.Execute()
-	require.NoError(t, err)
-
-	require.Len(t, *calls, 1)
-	assert.Equal(t, []string{"databricks", "databricks-apps"}, (*calls)[0].opts.SpecificSkills)
-}
-
-func TestInstallSingleSkill(t *testing.T) {
-	setupTestAgents(t)
-	calls := setupInstallMock(t)
-
-	ctx := cmdio.MockDiscard(t.Context())
-	cmd := newInstallCmd()
-	cmd.SetContext(ctx)
-	cmd.SetArgs([]string{"--skills", "databricks"})
-
-	err := cmd.Execute()
-	require.NoError(t, err)
-
-	require.Len(t, *calls, 1)
-	assert.Equal(t, []string{"databricks"}, (*calls)[0].opts.SpecificSkills)
-}
-
-func TestInstallSpecificAgents(t *testing.T) {
-	setupTestAgents(t)
-	calls := setupInstallMock(t)
-
-	ctx := cmdio.MockDiscard(t.Context())
-	cmd := newInstallCmd()
-	cmd.SetContext(ctx)
-	cmd.SetArgs([]string{"--agents", "claude-code"})
-
-	err := cmd.Execute()
-	require.NoError(t, err)
-
-	require.Len(t, *calls, 1)
-	assert.Equal(t, []string{"claude-code"}, (*calls)[0].agents)
-}
-
-func TestInstallUnknownAgentErrors(t *testing.T) {
-	setupTestAgents(t)
-	setupInstallMock(t)
-
-	ctx := cmdio.MockDiscard(t.Context())
-	cmd := newInstallCmd()
-	cmd.SetContext(ctx)
-	cmd.SetArgs([]string{"--agents", "invalid-agent"})
-	cmd.SilenceErrors = true
-	cmd.SilenceUsage = true
-
-	err := cmd.Execute()
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "unknown agent")
-	assert.Contains(t, err.Error(), "Available agents:")
-}
-
-func TestInstallIncludeExperimental(t *testing.T) {
-	setupTestAgents(t)
-	calls := setupInstallMock(t)
-
-	ctx := cmdio.MockDiscard(t.Context())
-	cmd := newInstallCmd()
-	cmd.SetContext(ctx)
-	cmd.SetArgs([]string{"--experimental"})
-
-	err := cmd.Execute()
-	require.NoError(t, err)
-
-	require.Len(t, *calls, 1)
-	assert.True(t, (*calls)[0].opts.IncludeExperimental)
-}
-
-func TestInstallInteractivePrompt(t *testing.T) {
-	setupTestAgents(t)
-	calls := setupInstallMock(t)
-	setupScopeMock(t, installer.ScopeGlobal)
-
-	origPrompt := promptAgentSelection
-	t.Cleanup(func() { promptAgentSelection = origPrompt })
-
-	promptCalled := false
-	promptAgentSelection = func(_ context.Context, detected []*agents.Agent) ([]*agents.Agent, error) {
-		promptCalled = true
-		return detected[:1], nil
-	}
-
-	ctx, test := cmdio.SetupTest(t.Context(), cmdio.TestOptions{PromptSupported: true})
-	defer test.Done()
-
-	drain := func(r *bufio.Reader) {
-		buf := make([]byte, 4096)
-		for {
-			_, err := r.Read(buf)
-			if err != nil {
-				return
-			}
-		}
-	}
-	go drain(test.Stdout)
-	go drain(test.Stderr)
-
-	cmd := newInstallCmd()
-	cmd.SetContext(ctx)
-
-	err := cmd.RunE(cmd, nil)
-	require.NoError(t, err)
-
-	assert.True(t, promptCalled, "prompt should be called when 2+ agents detected and interactive")
-	require.Len(t, *calls, 1)
-	assert.Len(t, (*calls)[0].agents, 1, "only the selected agent should be passed")
-}
-
-func TestInstallNonInteractiveUsesAllAgents(t *testing.T) {
-	setupTestAgents(t)
-	calls := setupInstallMock(t)
-
-	origPrompt := promptAgentSelection
-	t.Cleanup(func() { promptAgentSelection = origPrompt })
-
-	promptCalled := false
-	promptAgentSelection = func(_ context.Context, detected []*agents.Agent) ([]*agents.Agent, error) {
-		promptCalled = true
-		return detected, nil
-	}
-
-	ctx := cmdio.MockDiscard(t.Context())
-	cmd := newInstallCmd()
-	cmd.SetContext(ctx)
-
-	err := cmd.RunE(cmd, nil)
-	require.NoError(t, err)
-
-	assert.False(t, promptCalled, "prompt should not be called in non-interactive mode")
-	require.Len(t, *calls, 1)
-	assert.Len(t, (*calls)[0].agents, 2, "all detected agents should be used")
-}
-
-func TestInstallNoAgentsDetected(t *testing.T) {
-	tmp := t.TempDir()
-	t.Setenv("HOME", tmp)
-
-	calls := setupInstallMock(t)
-	ctx := cmdio.MockDiscard(t.Context())
-
-	cmd := newInstallCmd()
-	cmd.SetContext(ctx)
-
-	err := cmd.RunE(cmd, nil)
-	require.NoError(t, err)
-	assert.Empty(t, *calls, "install should not be called when no agents detected")
-}
-
-func TestInstallAgentsFlagSkipsPrompt(t *testing.T) {
-	setupTestAgents(t)
-	calls := setupInstallMock(t)
-
-	origPrompt := promptAgentSelection
-	t.Cleanup(func() { promptAgentSelection = origPrompt })
-
-	promptCalled := false
-	promptAgentSelection = func(_ context.Context, detected []*agents.Agent) ([]*agents.Agent, error) {
-		promptCalled = true
-		return detected, nil
-	}
-
-	ctx := cmdio.MockDiscard(t.Context())
-	cmd := newInstallCmd()
-	cmd.SetContext(ctx)
-	cmd.SetArgs([]string{"--agents", "claude-code,cursor"})
-
-	err := cmd.Execute()
-	require.NoError(t, err)
-
-	assert.False(t, promptCalled, "prompt should not be called when --agents is specified")
-	require.Len(t, *calls, 1)
-	assert.Equal(t, []string{"claude-code", "cursor"}, (*calls)[0].agents)
-}
-
-func TestSkillsInstallDelegatesToInstall(t *testing.T) {
-	setupTestAgents(t)
-	calls := setupInstallMock(t)
-
-	ctx := cmdio.MockDiscard(t.Context())
-	cmd := newSkillsInstallCmd()
-	cmd.SetContext(ctx)
-
-	err := cmd.RunE(cmd, nil)
-	require.NoError(t, err)
-
-	require.Len(t, *calls, 1)
-	assert.Len(t, (*calls)[0].agents, 2)
-}
-
-func TestSkillsInstallForwardsSkillName(t *testing.T) {
-	setupTestAgents(t)
-	calls := setupInstallMock(t)
-
-	ctx := cmdio.MockDiscard(t.Context())
-	cmd := newSkillsInstallCmd()
-	cmd.SetContext(ctx)
-
-	err := cmd.RunE(cmd, []string{"databricks"})
-	require.NoError(t, err)
-
-	require.Len(t, *calls, 1)
-	assert.Equal(t, []string{"databricks"}, (*calls)[0].opts.SpecificSkills)
-}
-
-func TestSkillsInstallExecuteNoArgs(t *testing.T) {
-	setupTestAgents(t)
-	calls := setupInstallMock(t)
-
-	ctx := cmdio.MockDiscard(t.Context())
-	cmd := newSkillsInstallCmd()
-	cmd.SetContext(ctx)
-	cmd.SetArgs([]string{})
-
-	err := cmd.Execute()
-	require.NoError(t, err)
-
-	require.Len(t, *calls, 1)
-	assert.Len(t, (*calls)[0].agents, 2)
-	assert.Nil(t, (*calls)[0].opts.SpecificSkills)
-}
-
-func TestSkillsInstallExecuteWithSkillName(t *testing.T) {
-	setupTestAgents(t)
-	calls := setupInstallMock(t)
-
-	ctx := cmdio.MockDiscard(t.Context())
-	cmd := newSkillsInstallCmd()
-	cmd.SetContext(ctx)
-	cmd.SetArgs([]string{"databricks"})
-
-	err := cmd.Execute()
-	require.NoError(t, err)
-
-	require.Len(t, *calls, 1)
-	assert.Equal(t, []string{"databricks"}, (*calls)[0].opts.SpecificSkills)
-}
-
-func TestSkillsInstallForwardsExperimental(t *testing.T) {
-	setupTestAgents(t)
-	calls := setupInstallMock(t)
-
-	ctx := cmdio.MockDiscard(t.Context())
-	cmd := newSkillsInstallCmd()
-	cmd.SetContext(ctx)
-	cmd.SetArgs([]string{"--experimental"})
-
-	err := cmd.Execute()
-	require.NoError(t, err)
-
-	require.Len(t, *calls, 1)
-	assert.True(t, (*calls)[0].opts.IncludeExperimental, "--experimental should be forwarded")
-}
-
-func TestSkillsInstallExecuteRejectsTwoArgs(t *testing.T) {
-	ctx := cmdio.MockDiscard(t.Context())
-	cmd := newSkillsInstallCmd()
-	cmd.SetContext(ctx)
-	cmd.SetArgs([]string{"a", "b"})
-	cmd.SilenceErrors = true
-	cmd.SilenceUsage = true
-
-	err := cmd.Execute()
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "accepts at most 1 arg")
-}
-
-func TestInstallRejectsPositionalArgs(t *testing.T) {
-	ctx := cmdio.MockDiscard(t.Context())
-	cmd := newInstallCmd()
-	cmd.SetContext(ctx)
-	cmd.SetArgs([]string{"databricks"})
-	cmd.SilenceErrors = true
-	cmd.SilenceUsage = true
-
-	err := cmd.Execute()
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "unknown command")
-}
-
-func TestUpdateRejectsPositionalArgs(t *testing.T) {
-	ctx := cmdio.MockDiscard(t.Context())
-	cmd := newUpdateCmd()
-	cmd.SetContext(ctx)
-	cmd.SetArgs([]string{"databricks"})
-	cmd.SilenceErrors = true
-	cmd.SilenceUsage = true
-
-	err := cmd.Execute()
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "unknown command")
-}
-
-func TestUninstallRejectsPositionalArgs(t *testing.T) {
-	ctx := cmdio.MockDiscard(t.Context())
-	cmd := newUninstallCmd()
-	cmd.SetContext(ctx)
-	cmd.SetArgs([]string{"databricks"})
-	cmd.SilenceErrors = true
-	cmd.SilenceUsage = true
-
-	err := cmd.Execute()
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "unknown command")
-}
-
-func TestListRejectsPositionalArgs(t *testing.T) {
-	ctx := cmdio.MockDiscard(t.Context())
-	cmd := newListCmd()
-	cmd.SetContext(ctx)
-	cmd.SetArgs([]string{"databricks"})
-	cmd.SilenceErrors = true
-	cmd.SilenceUsage = true
-
-	err := cmd.Execute()
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "unknown command")
-}
-
-func TestVersionRejectsPositionalArgs(t *testing.T) {
-	ctx := cmdio.MockDiscard(t.Context())
-	cmd := newVersionCmd()
-	cmd.SetContext(ctx)
-	cmd.SetArgs([]string{"databricks"})
-	cmd.SilenceErrors = true
-	cmd.SilenceUsage = true
-
-	err := cmd.Execute()
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "unknown command")
-}
-
-func TestResolveAgentNamesValid(t *testing.T) {
-	ctx := t.Context()
-	result, err := resolveAgentNames(ctx, "claude-code,cursor")
-	require.NoError(t, err)
-	assert.Len(t, result, 2)
-	assert.Equal(t, "claude-code", result[0].Name)
-	assert.Equal(t, "cursor", result[1].Name)
-}
-
-func TestResolveAgentNamesUnknown(t *testing.T) {
-	ctx := t.Context()
-	_, err := resolveAgentNames(ctx, "claude-code,invalid-agent")
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "unknown agent")
-	assert.Contains(t, err.Error(), "invalid-agent")
-}
-
-func TestResolveAgentNamesEmpty(t *testing.T) {
-	ctx := t.Context()
-	_, err := resolveAgentNames(ctx, "")
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "no agents specified")
-}
-
-func TestResolveAgentNamesDuplicatesDeduplicates(t *testing.T) {
-	ctx := t.Context()
-	result, err := resolveAgentNames(ctx, "claude-code,claude-code")
-	require.NoError(t, err)
-	assert.Len(t, result, 1, "duplicate agent names should be deduplicated")
-	assert.Equal(t, "claude-code", result[0].Name)
-}
-
-// --- Scope flag tests ---
-
-func TestInstallProjectFlag(t *testing.T) {
-	setupTestAgents(t)
-	calls := setupInstallMock(t)
-
-	ctx := cmdio.MockDiscard(t.Context())
-	cmd := newInstallCmd()
-	cmd.SetContext(ctx)
-	cmd.SetArgs([]string{"--project"})
-
-	err := cmd.Execute()
-	require.NoError(t, err)
-
-	require.Len(t, *calls, 1)
-	assert.Equal(t, installer.ScopeProject, (*calls)[0].opts.Scope)
-}
-
-func TestInstallGlobalFlag(t *testing.T) {
-	setupTestAgents(t)
-	calls := setupInstallMock(t)
-
-	ctx := cmdio.MockDiscard(t.Context())
-	cmd := newInstallCmd()
-	cmd.SetContext(ctx)
-	cmd.SetArgs([]string{"--global"})
-
-	err := cmd.Execute()
-	require.NoError(t, err)
-
-	require.Len(t, *calls, 1)
-	assert.Equal(t, installer.ScopeGlobal, (*calls)[0].opts.Scope)
-}
-
-func TestInstallGlobalAndProjectErrors(t *testing.T) {
-	setupTestAgents(t)
-	setupInstallMock(t)
-
-	ctx := cmdio.MockDiscard(t.Context())
-	cmd := newInstallCmd()
-	cmd.SetContext(ctx)
-	cmd.SetArgs([]string{"--global", "--project"})
-	cmd.SilenceErrors = true
-	cmd.SilenceUsage = true
-
-	err := cmd.Execute()
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "cannot use --global and --project together")
-}
-
-func TestInstallNoFlagNonInteractiveUsesGlobal(t *testing.T) {
-	setupTestAgents(t)
-	calls := setupInstallMock(t)
-
-	ctx := cmdio.MockDiscard(t.Context())
-	cmd := newInstallCmd()
-	cmd.SetContext(ctx)
-
-	err := cmd.RunE(cmd, nil)
-	require.NoError(t, err)
-
-	require.Len(t, *calls, 1)
-	assert.Equal(t, installer.ScopeGlobal, (*calls)[0].opts.Scope)
-}
-
-func TestInstallNoFlagInteractiveShowsScopePrompt(t *testing.T) {
-	setupTestAgents(t)
-	calls := setupInstallMock(t)
-	scopePromptCalled := setupScopeMock(t, installer.ScopeProject)
-
-	// Also mock agent prompt since interactive mode triggers it.
-	origPrompt := promptAgentSelection
-	t.Cleanup(func() { promptAgentSelection = origPrompt })
-	promptAgentSelection = func(_ context.Context, detected []*agents.Agent) ([]*agents.Agent, error) {
-		return detected, nil
-	}
-
-	ctx, test := cmdio.SetupTest(t.Context(), cmdio.TestOptions{PromptSupported: true})
-	defer test.Done()
-
-	drain := func(r *bufio.Reader) {
-		buf := make([]byte, 4096)
-		for {
-			_, err := r.Read(buf)
-			if err != nil {
-				return
-			}
-		}
-	}
-	go drain(test.Stdout)
-	go drain(test.Stderr)
-
-	cmd := newInstallCmd()
-	cmd.SetContext(ctx)
-
-	err := cmd.RunE(cmd, nil)
-	require.NoError(t, err)
-
-	assert.True(t, *scopePromptCalled, "scope prompt should be called in interactive mode")
-	require.Len(t, *calls, 1)
-	assert.Equal(t, installer.ScopeProject, (*calls)[0].opts.Scope)
-}
-
-func TestResolveScopeValidation(t *testing.T) {
-	tests := []struct {
-		name    string
-		project bool
-		global  bool
-		want    string
-		wantErr string
-	}{
-		{name: "neither", want: installer.ScopeGlobal},
-		{name: "global only", global: true, want: installer.ScopeGlobal},
-		{name: "project only", project: true, want: installer.ScopeProject},
-		{name: "both", project: true, global: true, wantErr: "cannot use --global and --project together"},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			got, err := resolveScope(tc.project, tc.global)
-			if tc.wantErr != "" {
-				require.Error(t, err)
-				assert.Contains(t, err.Error(), tc.wantErr)
-			} else {
-				require.NoError(t, err)
-				assert.Equal(t, tc.want, got)
-			}
-		})
-	}
-}
diff --git a/experimental/aitools/cmd/list.go b/experimental/aitools/cmd/list.go
deleted file mode 100644
index 1be1538c9a0..00000000000
--- a/experimental/aitools/cmd/list.go
+++ /dev/null
@@ -1,179 +0,0 @@
-package aitools
-
-import (
-	"errors"
-	"fmt"
-	"maps"
-	"slices"
-	"strings"
-	"text/tabwriter"
-
-	"github.com/databricks/cli/experimental/aitools/lib/installer"
-	"github.com/databricks/cli/libs/cmdio"
-	"github.com/databricks/cli/libs/log"
-	"github.com/spf13/cobra"
-)
-
-// listSkillsFn is the function used to render the skills list.
-// It is a package-level var so tests can replace the data-fetching layer.
-var listSkillsFn = defaultListSkills
-
-func newListCmd() *cobra.Command {
-	var projectFlag, globalFlag bool
-
-	cmd := &cobra.Command{
-		Use:   "list",
-		Short: "List installed AI tools components",
-		Args:  cobra.NoArgs,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			if projectFlag && globalFlag {
-				return errors.New("cannot use --global and --project together")
-			}
-			// For list: no flag = show both scopes (empty string).
-			var scope string
-			if projectFlag {
-				scope = installer.ScopeProject
-			} else if globalFlag {
-				scope = installer.ScopeGlobal
-			}
-			return listSkillsFn(cmd, scope)
-		},
-	}
-
-	cmd.Flags().BoolVar(&projectFlag, "project", false, "Show only project-scoped skills")
-	cmd.Flags().BoolVar(&globalFlag, "global", false, "Show only globally-scoped skills")
-	return cmd
-}
-
-func defaultListSkills(cmd *cobra.Command, scope string) error {
-	ctx := cmd.Context()
-
-	ref := installer.GetSkillsRef(ctx)
-
-	src := &installer.GitHubManifestSource{}
-	manifest, err := src.FetchManifest(ctx, ref)
-	if err != nil {
-		return fmt.Errorf("failed to fetch manifest: %w", err)
-	}
-
-	// Load global state.
-	var globalState *installer.InstallState
-	if scope != installer.ScopeProject {
-		globalDir, gErr := installer.GlobalSkillsDir(ctx)
-		if gErr == nil {
-			globalState, err = installer.LoadState(globalDir)
-			if err != nil {
-				log.Debugf(ctx, "Could not load global install state: %v", err)
-			}
-		}
-	}
-
-	// Load project state.
-	var projectState *installer.InstallState
-	if scope != installer.ScopeGlobal {
-		projectDir, pErr := installer.ProjectSkillsDir(ctx)
-		if pErr == nil {
-			projectState, err = installer.LoadState(projectDir)
-			if err != nil {
-				log.Debugf(ctx, "Could not load project install state: %v", err)
-			}
-		}
-	}
-
-	// Build sorted list of skill names.
-	names := slices.Sorted(maps.Keys(manifest.Skills))
-
-	version := strings.TrimPrefix(ref, "v")
-	cmdio.LogString(ctx, "Available skills (v"+version+"):")
-	cmdio.LogString(ctx, "")
-
-	var buf strings.Builder
-	tw := tabwriter.NewWriter(&buf, 0, 4, 2, ' ', 0)
-	fmt.Fprintln(tw, "  NAME\tVERSION\tINSTALLED")
-
-	bothScopes := globalState != nil && projectState != nil
-
-	globalCount := 0
-	projectCount := 0
-	for _, name := range names {
-		meta := manifest.Skills[name]
-
-		tag := ""
-		if meta.Experimental {
-			tag = " [experimental]"
-		}
-
-		installedStr := installedStatus(name, meta.Version, globalState, projectState, bothScopes)
-		if globalState != nil {
-			if _, ok := globalState.Skills[name]; ok {
-				globalCount++
-			}
-		}
-		if projectState != nil {
-			if _, ok := projectState.Skills[name]; ok {
-				projectCount++
-			}
-		}
-
-		fmt.Fprintf(tw, "  %s%s\tv%s\t%s\n", name, tag, meta.Version, installedStr)
-	}
-	tw.Flush()
-	cmdio.LogString(ctx, buf.String())
-
-	// Summary line.
-	switch {
-	case bothScopes:
-		cmdio.LogString(ctx, fmt.Sprintf("%d/%d skills installed (global), %d/%d (project)", globalCount, len(names), projectCount, len(names)))
-	case projectState != nil:
-		cmdio.LogString(ctx, fmt.Sprintf("%d/%d skills installed (project)", projectCount, len(names)))
-	case scope == installer.ScopeProject:
-		cmdio.LogString(ctx, fmt.Sprintf("%d/%d skills installed (project)", 0, len(names)))
-	default:
-		cmdio.LogString(ctx, fmt.Sprintf("%d/%d skills installed (global)", globalCount, len(names)))
-	}
-	return nil
-}
-
-// installedStatus returns the display string for a skill's installation status.
-func installedStatus(name, latestVersion string, globalState, projectState *installer.InstallState, bothScopes bool) string {
-	globalVer := ""
-	projectVer := ""
-
-	if globalState != nil {
-		globalVer = globalState.Skills[name]
-	}
-	if projectState != nil {
-		projectVer = projectState.Skills[name]
-	}
-
-	if globalVer == "" && projectVer == "" {
-		return "not installed"
-	}
-
-	// If both scopes have the skill, show the project version (takes precedence).
-	if bothScopes && globalVer != "" && projectVer != "" {
-		return versionLabel(projectVer, latestVersion) + " (project, global)"
-	}
-
-	if projectVer != "" {
-		label := versionLabel(projectVer, latestVersion)
-		if bothScopes {
-			return label + " (project)"
-		}
-		return label
-	}
-
-	label := versionLabel(globalVer, latestVersion)
-	if bothScopes {
-		return label + " (global)"
-	}
-	return label
-}
-
-// versionLabel formats version with update status.
-func versionLabel(installed, latest string) string {
-	if installed == latest {
-		return "v" + installed + " (up to date)"
-	}
-	return "v" + installed + " (update available)"
-}
diff --git a/experimental/aitools/cmd/list_test.go b/experimental/aitools/cmd/list_test.go
deleted file mode 100644
index 31390110c01..00000000000
--- a/experimental/aitools/cmd/list_test.go
+++ /dev/null
@@ -1,61 +0,0 @@
-package aitools
-
-import (
-	"testing"
-
-	"github.com/databricks/cli/libs/cmdio"
-	"github.com/spf13/cobra"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestListCommandExists(t *testing.T) {
-	cmd := newListCmd()
-	assert.Equal(t, "list", cmd.Use)
-}
-
-func TestListCommandCallsListFn(t *testing.T) {
-	orig := listSkillsFn
-	t.Cleanup(func() { listSkillsFn = orig })
-
-	called := false
-	listSkillsFn = func(cmd *cobra.Command, scope string) error {
-		called = true
-		return nil
-	}
-
-	ctx := cmdio.MockDiscard(t.Context())
-	cmd := newListCmd()
-	cmd.SetContext(ctx)
-
-	err := cmd.RunE(cmd, nil)
-	require.NoError(t, err)
-	assert.True(t, called)
-}
-
-func TestListCommandHasScopeFlags(t *testing.T) {
-	cmd := newListCmd()
-	f := cmd.Flags().Lookup("project")
-	require.NotNil(t, f, "--project flag should exist")
-	f = cmd.Flags().Lookup("global")
-	require.NotNil(t, f, "--global flag should exist")
-}
-
-func TestSkillsListDelegatesToListFn(t *testing.T) {
-	orig := listSkillsFn
-	t.Cleanup(func() { listSkillsFn = orig })
-
-	called := false
-	listSkillsFn = func(cmd *cobra.Command, scope string) error {
-		called = true
-		return nil
-	}
-
-	ctx := cmdio.MockDiscard(t.Context())
-	cmd := newSkillsListCmd()
-	cmd.SetContext(ctx)
-
-	err := cmd.RunE(cmd, nil)
-	require.NoError(t, err)
-	assert.True(t, called)
-}
diff --git a/experimental/aitools/cmd/params.go b/experimental/aitools/cmd/params.go
new file mode 100644
index 00000000000..5edc9e17fca
--- /dev/null
+++ b/experimental/aitools/cmd/params.go
@@ -0,0 +1,50 @@
+package aitools
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/databricks/databricks-sdk-go/service/sql"
+)
+
+// parseParams converts --param flag values into SDK parameter list items for
+// the Databricks SQL Statement Execution API. Each input is either
+// "name=value" (defaults to STRING server-side) or "name:TYPE=value" (typed,
+// e.g. "since:DATE=2026-01-01"). An empty value becomes NULL on the wire
+// because StatementParameterListItem.Value uses omitempty.
+//
+// The Databricks API only supports named markers (`:name`), not positional
+// `?`, and parameter names must be unique within a statement.
+func parseParams(raw []string) ([]sql.StatementParameterListItem, error) {
+	if len(raw) == 0 {
+		return nil, nil
+	}
+
+	out := make([]sql.StatementParameterListItem, 0, len(raw))
+	seen := make(map[string]struct{}, len(raw))
+	for _, s := range raw {
+		lhs, value, ok := strings.Cut(s, "=")
+		if !ok {
+			return nil, fmt.Errorf("invalid --param %q: expected name=value or name:TYPE=value", s)
+		}
+
+		name, typ, _ := strings.Cut(lhs, ":")
+		name = strings.TrimSpace(name)
+		typ = strings.TrimSpace(typ)
+
+		if name == "" {
+			return nil, fmt.Errorf("invalid --param %q: name is empty", s)
+		}
+		if _, dup := seen[name]; dup {
+			return nil, fmt.Errorf("duplicate --param name %q", name)
+		}
+		seen[name] = struct{}{}
+
+		out = append(out, sql.StatementParameterListItem{
+			Name:  name,
+			Type:  typ,
+			Value: value,
+		})
+	}
+	return out, nil
+}
diff --git a/experimental/aitools/cmd/params_test.go b/experimental/aitools/cmd/params_test.go
new file mode 100644
index 00000000000..e4a56f8a878
--- /dev/null
+++ b/experimental/aitools/cmd/params_test.go
@@ -0,0 +1,129 @@
+package aitools
+
+import (
+	"testing"
+
+	"github.com/databricks/databricks-sdk-go/service/sql"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseParams(t *testing.T) {
+	tests := []struct {
+		name string
+		in   []string
+		want []sql.StatementParameterListItem
+	}{
+		{
+			name: "nil input returns nil",
+			in:   nil,
+			want: nil,
+		},
+		{
+			name: "empty input returns nil",
+			in:   []string{},
+			want: nil,
+		},
+		{
+			name: "single string param defaults type to empty (server-side STRING)",
+			in:   []string{"name=alice"},
+			want: []sql.StatementParameterListItem{
+				{Name: "name", Value: "alice"},
+			},
+		},
+		{
+			name: "typed param splits name and type on first colon",
+			in:   []string{"since:DATE=2026-01-01"},
+			want: []sql.StatementParameterListItem{
+				{Name: "since", Type: "DATE", Value: "2026-01-01"},
+			},
+		},
+		{
+			name: "value can contain = and :",
+			in:   []string{"clause=ts >= '2026-01-01T00:00:00'"},
+			want: []sql.StatementParameterListItem{
+				{Name: "clause", Value: "ts >= '2026-01-01T00:00:00'"},
+			},
+		},
+		{
+			name: "decimal type with parens preserved",
+			in:   []string{"amount:DECIMAL(10,2)=42.50"},
+			want: []sql.StatementParameterListItem{
+				{Name: "amount", Type: "DECIMAL(10,2)", Value: "42.50"},
+			},
+		},
+		{
+			name: "empty value becomes NULL on the wire via omitempty",
+			in:   []string{"opt="},
+			want: []sql.StatementParameterListItem{
+				{Name: "opt", Value: ""},
+			},
+		},
+		{
+			name: "whitespace around name and type is trimmed",
+			in:   []string{"  name  :  INT  =42"},
+			want: []sql.StatementParameterListItem{
+				{Name: "name", Type: "INT", Value: "42"},
+			},
+		},
+		{
+			name: "multiple params preserve input order",
+			in:   []string{"a=1", "b:INT=2", "c=three"},
+			want: []sql.StatementParameterListItem{
+				{Name: "a", Value: "1"},
+				{Name: "b", Type: "INT", Value: "2"},
+				{Name: "c", Value: "three"},
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got, err := parseParams(tc.in)
+			require.NoError(t, err)
+			assert.Equal(t, tc.want, got)
+		})
+	}
+}
+
+func TestParseParamsErrors(t *testing.T) {
+	tests := []struct {
+		name    string
+		in      []string
+		wantMsg string
+	}{
+		{
+			name:    "no equals sign",
+			in:      []string{"foo"},
+			wantMsg: "expected name=value",
+		},
+		{
+			name:    "empty name",
+			in:      []string{"=value"},
+			wantMsg: "name is empty",
+		},
+		{
+			name:    "empty name with type",
+			in:      []string{":INT=42"},
+			wantMsg: "name is empty",
+		},
+		{
+			name:    "whitespace-only name",
+			in:      []string{"   =value"},
+			wantMsg: "name is empty",
+		},
+		{
+			name:    "duplicate name",
+			in:      []string{"name=alice", "name=bob"},
+			wantMsg: `duplicate --param name "name"`,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			_, err := parseParams(tc.in)
+			require.Error(t, err)
+			assert.Contains(t, err.Error(), tc.wantMsg)
+		})
+	}
+}
diff --git a/experimental/aitools/cmd/query.go b/experimental/aitools/cmd/query.go
index c6291733edb..5fbe8eebe80 100644
--- a/experimental/aitools/cmd/query.go
+++ b/experimental/aitools/cmd/query.go
@@ -17,17 +17,12 @@ import (
 	"github.com/databricks/cli/libs/cmdctx"
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/sqlexec"
 	"github.com/databricks/databricks-sdk-go/service/sql"
 	"github.com/spf13/cobra"
 )
 
 const (
-	// pollIntervalInitial is the starting interval between status polls.
-	pollIntervalInitial = 1 * time.Second
-
-	// pollIntervalMax is the maximum interval between status polls.
-	pollIntervalMax = 5 * time.Second
-
 	// cancelTimeout is how long to wait for server-side cancellation.
 	cancelTimeout = 10 * time.Second
 )
@@ -68,6 +63,8 @@ func newQueryCmd() *cobra.Command {
 	var filePaths []string
 	var outputFormat string
 	var concurrency int
+	var paramFlags []string
+	var params []sql.StatementParameterListItem
 
 	cmd := &cobra.Command{
 		Use:   "query [SQL | file.sql]...",
@@ -91,19 +88,33 @@ or the DATABRICKS_WAREHOUSE_ID environment variable is configured.
 
 For a single query, output is JSON in non-interactive contexts. In
 interactive terminals it renders tables, and large results open an
-interactive table browser. Use --output csv to export results as CSV.`,
+interactive table browser. Use --output csv to export results as CSV.
+
+Pass named parameters with --param. Use ":name" markers in the SQL and
+"--param name=value" (string) or "--param name:TYPE=value" (typed, e.g.
+DATE, INT) to bind values. Positional "?" markers are not supported. In
+multi-query mode, the same parameter set is applied to every statement.`,
 		Example: `  databricks experimental aitools tools query "SELECT * FROM samples.nyctaxi.trips LIMIT 5"
   databricks experimental aitools tools query --warehouse abc123 "SELECT 1"
   databricks experimental aitools tools query --file report.sql
   databricks experimental aitools tools query report.sql
   databricks experimental aitools tools query --output csv "SELECT * FROM samples.nyctaxi.trips LIMIT 5"
   databricks experimental aitools tools query --output json "SELECT 1" "SELECT 2" "SELECT 3"
+  databricks experimental aitools tools query --param name=alice "SELECT * FROM users WHERE name = :name"
+  databricks experimental aitools tools query --param since:DATE=2026-01-01 "SELECT * FROM events WHERE ts > :since"
   echo "SELECT 1" | databricks experimental aitools tools query`,
 		Args: cobra.ArbitraryArgs,
 		PreRunE: func(cmd *cobra.Command, args []string) error {
 			if concurrency <= 0 {
 				return errInvalidBatchConcurrency
 			}
+
+			var err error
+			params, err = parseParams(paramFlags)
+			if err != nil {
+				return err
+			}
+
 			return root.MustWorkspaceClient(cmd, args)
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {
@@ -139,19 +150,22 @@ interactive table browser. Use --output csv to export results as CSV.`,
 			}
 
 			if len(sqls) > 1 {
-				return runBatch(ctx, cmd, w.StatementExecution, wID, sqls, concurrency)
+				return runBatch(ctx, cmd, w.StatementExecution, wID, sqls, params, concurrency)
 			}
 
-			resp, err := executeAndPoll(ctx, w.StatementExecution, wID, sqls[0])
+			client := sqlexec.New(w.StatementExecution, wID)
+
+			stmt, err := executeAndPoll(ctx, client, sqls[0], params)
 			if err != nil {
 				return err
 			}
 
-			columns := extractColumns(resp.Manifest)
-			rows, err := fetchAllRows(ctx, w.StatementExecution, resp)
+			result, err := client.Results(ctx, stmt)
 			if err != nil {
 				return err
 			}
+			columns := result.Columns
+			rows := result.Rows
 
 			// CSV bypasses the normal output mode selection.
 			if format == sqlcli.OutputCSV {
@@ -177,7 +191,7 @@ interactive table browser. Use --output csv to export results as CSV.`,
 			case queryOutputModeStaticTable:
 				return renderStaticTable(cmd.OutOrStdout(), columns, rows)
 			default:
-				return renderInteractiveTable(cmd.OutOrStdout(), columns, rows)
+				return renderInteractiveTable(ctx, cmd.OutOrStdout(), columns, rows)
 			}
 		},
 	}
@@ -185,6 +199,7 @@ interactive table browser. Use --output csv to export results as CSV.`,
 	cmd.Flags().StringVarP(&warehouseID, "warehouse", "w", "", "SQL warehouse ID to use for execution")
 	cmd.Flags().StringSliceVarP(&filePaths, "file", "f", nil, "Path to a SQL file to execute (repeatable; pair with positional SQLs to run a batch)")
 	cmd.Flags().IntVar(&concurrency, "concurrency", defaultBatchConcurrency, "Maximum in-flight statements when running a batch of queries")
+	cmd.Flags().StringArrayVar(&paramFlags, "param", nil, "Named parameter, repeatable. Format: name=value (STRING) or name:TYPE=value (e.g. name:DATE=2026-01-01). Empty value is sent as NULL.")
 	// Local --output flag shadows the root command's persistent --output flag,
 	// adding csv support for this command only.
 	cmd.Flags().StringVarP(&outputFormat, "output", "o", string(sqlcli.OutputText), "Output format: text, json, or csv")
@@ -222,8 +237,10 @@ func resolveSQLs(ctx context.Context, cmd *cobra.Command, args, filePaths []stri
 // without an extra error message) when any statement failed; the failure detail
 // is already encoded in the printed JSON. The caller is responsible for
 // rejecting incompatible output formats before invoking this.
-func runBatch(ctx context.Context, cmd *cobra.Command, api sql.StatementExecutionInterface, warehouseID string, sqls []string, concurrency int) error {
-	results := executeBatch(ctx, api, warehouseID, sqls, concurrency)
+//
+// params, if non-nil, are applied to every statement in the batch.
+func runBatch(ctx context.Context, cmd *cobra.Command, api sql.StatementExecutionInterface, warehouseID string, sqls []string, params []sql.StatementParameterListItem, concurrency int) error {
+	results := executeBatch(ctx, api, warehouseID, sqls, params, concurrency)
 	if err := renderBatchJSON(cmd.OutOrStdout(), results); err != nil {
 		return err
 	}
@@ -252,19 +269,14 @@ func resolveWarehouseID(ctx context.Context, w any, flagValue string) (string, e
 
 // executeAndPoll submits a SQL statement asynchronously and polls until completion.
 // It shows a spinner in interactive mode and supports Ctrl+C cancellation.
-func executeAndPoll(ctx context.Context, api sql.StatementExecutionInterface, warehouseID, statement string) (*sql.StatementResponse, error) {
+func executeAndPoll(ctx context.Context, client *sqlexec.Client, statement string, params []sql.StatementParameterListItem) (*sqlexec.Statement, error) {
 	// Submit asynchronously to get the statement ID immediately for cancellation.
-	resp, err := api.ExecuteStatement(ctx, sql.ExecuteStatementRequest{
-		WarehouseId:   warehouseID,
-		Statement:     statement,
-		WaitTimeout:   "0s",
-		OnWaitTimeout: sql.ExecuteStatementRequestOnWaitTimeoutContinue,
-	})
+	stmt, err := client.Submit(ctx, statement, sqlexec.WithParameters(params))
 	if err != nil {
-		return nil, fmt.Errorf("execute statement: %w", err)
+		return nil, err
 	}
 
-	statementID := resp.StatementId
+	statementID := stmt.ID
 
 	// Set up Ctrl+C: signal cancels the poll context, cleanup is unified below.
 	pollCtx, pollCancel := context.WithCancel(ctx)
@@ -292,9 +304,7 @@ func executeAndPoll(ctx context.Context, api sql.StatementExecutionInterface, wa
 		// reaches the warehouse.
 		cancelCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), cancelTimeout)
 		defer cancel()
-		if err := api.CancelExecution(cancelCtx, sql.CancelExecutionRequest{
-			StatementId: statementID,
-		}); err != nil {
+		if err := client.Cancel(cancelCtx, statementID); err != nil {
 			log.Warnf(ctx, "Failed to cancel statement %s: %v", statementID, err)
 		}
 	}
@@ -319,7 +329,7 @@ func executeAndPoll(ctx context.Context, api sql.StatementExecutionInterface, wa
 		}
 	}()
 
-	pollResp, err := pollStatement(pollCtx, api, resp)
+	stmt, err = client.Poll(pollCtx, stmt)
 	if err != nil {
 		if pollCtx.Err() != nil {
 			cancelStatement()
@@ -330,111 +340,34 @@ func executeAndPoll(ctx context.Context, api sql.StatementExecutionInterface, wa
 	}
 
 	sp.Close()
-	if err := checkFailedState(pollResp.Status); err != nil {
+	if err := presentQueryError(stmt.Err()); err != nil {
 		return nil, err
 	}
-	return pollResp, nil
-}
-
-// pollStatement polls until the statement reaches a terminal state.
-//
-// On context cancellation it returns the context error WITHOUT cancelling the
-// server-side statement. Callers that want server-side cancellation should
-// invoke CancelExecution explicitly.
-//
-// If the input response is already in a terminal state, it is returned without
-// further polling.
-func pollStatement(ctx context.Context, api sql.StatementExecutionInterface, resp *sql.StatementResponse) (*sql.StatementResponse, error) {
-	if isTerminalState(resp.Status) {
-		return resp, nil
-	}
-
-	statementID := resp.StatementId
-	start := time.Now()
-
-	// Poll with additive backoff: 1s, 2s, 3s, 4s, 5s (capped).
-	interval := pollIntervalInitial
-	for {
-		select {
-		case <-ctx.Done():
-			return nil, ctx.Err()
-		case <-time.After(interval):
-		}
-
-		log.Debugf(ctx, "Polling statement %s: %s elapsed", statementID, time.Since(start).Truncate(time.Second))
-
-		pollResp, err := api.GetStatementByStatementId(ctx, statementID)
-		if err != nil {
-			if ctx.Err() != nil {
-				return nil, ctx.Err()
-			}
-			return nil, fmt.Errorf("poll statement status: %w", err)
-		}
-
-		if isTerminalState(pollResp.Status) {
-			return &sql.StatementResponse{
-				StatementId: pollResp.StatementId,
-				Status:      pollResp.Status,
-				Manifest:    pollResp.Manifest,
-				Result:      pollResp.Result,
-			}, nil
-		}
-
-		interval = min(interval+time.Second, pollIntervalMax)
-	}
-}
-
-// fetchAllRows collects all result rows, fetching additional chunks if needed.
-func fetchAllRows(ctx context.Context, api sql.StatementExecutionInterface, resp *sql.StatementResponse) ([][]string, error) {
-	if resp.Result == nil {
-		return nil, nil
-	}
-
-	rows := append([][]string{}, resp.Result.DataArray...)
-
-	totalChunks := 0
-	if resp.Manifest != nil {
-		totalChunks = resp.Manifest.TotalChunkCount
-	}
-
-	for chunk := 1; chunk < totalChunks; chunk++ {
-		log.Debugf(ctx, "Fetching result chunk %d/%d for statement %s", chunk+1, totalChunks, resp.StatementId)
-		chunkResp, err := api.GetStatementResultChunkNByStatementIdAndChunkIndex(ctx, resp.StatementId, chunk)
-		if err != nil {
-			return nil, fmt.Errorf("fetch result chunk %d: %w", chunk, err)
-		}
-		rows = append(rows, chunkResp.DataArray...)
-	}
-
-	return rows, nil
+	return stmt, nil
 }
 
-// isTerminalState returns true if the statement has reached a final state.
-func isTerminalState(status *sql.StatementStatus) bool {
-	if status == nil {
-		return false
+// presentQueryError converts the engine's structured statement error into the
+// CLI-facing message for the query and discover-schema commands. It returns nil
+// for a nil error or any error that is not a *sqlexec.StatementError (the engine
+// only produces the latter on terminal non-success states).
+func presentQueryError(err error) error {
+	if err == nil {
+		return nil
 	}
-	switch status.State {
-	case sql.StatementStateSucceeded, sql.StatementStateFailed,
-		sql.StatementStateCanceled, sql.StatementStateClosed:
-		return true
-	case sql.StatementStatePending, sql.StatementStateRunning:
-		return false
+	se, ok := errors.AsType[*sqlexec.StatementError](err)
+	if !ok {
+		return err
 	}
-	return false
-}
 
-// checkFailedState returns an error if the statement is in a non-success terminal state.
-func checkFailedState(status *sql.StatementStatus) error {
-	if status == nil {
-		return nil
-	}
-	switch status.State {
+	switch se.State {
 	case sql.StatementStateFailed:
 		msg := "query failed"
-		if status.Error != nil {
-			msg = fmt.Sprintf("query failed: %s %s", status.Error.ErrorCode, status.Error.Message)
-			if strings.Contains(status.Error.Message, "UNRESOLVED_MAP_KEY") {
+		// The engine populates Code only when the backend returned a
+		// ServiceError; otherwise Message is a synthesized state string we
+		// don't surface here, matching the original "query failed" fallback.
+		if se.Code != "" {
+			msg = fmt.Sprintf("query failed: %s %s", se.Code, se.Message)
+			if strings.Contains(se.Message, "UNRESOLVED_MAP_KEY") {
 				msg += "\n\nHint: your shell may have stripped quotes from the SQL string. " +
 					"Use single quotes for map keys (e.g. info['key']) or pass the query via --file."
 			}
@@ -444,10 +377,9 @@ func checkFailedState(status *sql.StatementStatus) error {
 		return errors.New("query was cancelled")
 	case sql.StatementStateClosed:
 		return errors.New("query was closed before results could be fetched")
-	case sql.StatementStatePending, sql.StatementStateRunning, sql.StatementStateSucceeded:
-		return nil
+	default:
+		return err
 	}
-	return nil
 }
 
 // cleanSQL removes surrounding quotes, empty lines, and SQL comments.
diff --git a/experimental/aitools/cmd/query_test.go b/experimental/aitools/cmd/query_test.go
index 8458629c8e7..66e70b238ee 100644
--- a/experimental/aitools/cmd/query_test.go
+++ b/experimental/aitools/cmd/query_test.go
@@ -7,12 +7,12 @@ import (
 	"path/filepath"
 	"strings"
 	"testing"
-	"time"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/experimental/libs/sqlcli"
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/env"
+	"github.com/databricks/cli/libs/sqlexec"
 	mocksql "github.com/databricks/databricks-sdk-go/experimental/mocks/service/sql"
 	"github.com/databricks/databricks-sdk-go/service/sql"
 	"github.com/spf13/cobra"
@@ -59,10 +59,30 @@ func TestExecuteAndPollImmediateSuccess(t *testing.T) {
 		Result:      &sql.ResultData{DataArray: [][]string{{"1"}}},
 	}, nil)
 
-	resp, err := executeAndPoll(ctx, mockAPI, "wh-123", "SELECT 1")
+	stmt, err := executeAndPoll(ctx, sqlexec.New(mockAPI, "wh-123"), "SELECT 1", nil)
+	require.NoError(t, err)
+	assert.Equal(t, sql.StatementStateSucceeded, stmt.State)
+	assert.Equal(t, "stmt-1", stmt.ID)
+}
+
+func TestExecuteAndPollPassesParameters(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	mockAPI := mocksql.NewMockStatementExecutionInterface(t)
+
+	params := []sql.StatementParameterListItem{
+		{Name: "name", Value: "alice"},
+		{Name: "since", Type: "DATE", Value: "2026-01-01"},
+	}
+
+	mockAPI.EXPECT().ExecuteStatement(mock.Anything, mock.MatchedBy(func(req sql.ExecuteStatementRequest) bool {
+		return assert.ObjectsAreEqual(params, req.Parameters)
+	})).Return(&sql.StatementResponse{
+		StatementId: "stmt-1",
+		Status:      &sql.StatementStatus{State: sql.StatementStateSucceeded},
+	}, nil)
+
+	_, err := executeAndPoll(ctx, sqlexec.New(mockAPI, "wh-123"), "SELECT * FROM t WHERE name = :name AND ts > :since", params)
 	require.NoError(t, err)
-	assert.Equal(t, sql.StatementStateSucceeded, resp.Status.State)
-	assert.Equal(t, "stmt-1", resp.StatementId)
 }
 
 func TestExecuteAndPollImmediateFailure(t *testing.T) {
@@ -80,7 +100,7 @@ func TestExecuteAndPollImmediateFailure(t *testing.T) {
 		},
 	}, nil)
 
-	_, err := executeAndPoll(ctx, mockAPI, "wh-123", "SELCT 1")
+	_, err := executeAndPoll(ctx, sqlexec.New(mockAPI, "wh-123"), "SELCT 1", nil)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "SYNTAX_ERROR")
 	assert.Contains(t, err.Error(), "syntax error")
@@ -109,10 +129,14 @@ func TestExecuteAndPollWithPolling(t *testing.T) {
 		Result:      &sql.ResultData{DataArray: [][]string{{"42"}}},
 	}, nil).Once()
 
-	resp, err := executeAndPoll(ctx, mockAPI, "wh-123", "SELECT 42")
+	client := sqlexec.New(mockAPI, "wh-123")
+	stmt, err := executeAndPoll(ctx, client, "SELECT 42", nil)
+	require.NoError(t, err)
+	assert.Equal(t, sql.StatementStateSucceeded, stmt.State)
+
+	result, err := client.Results(ctx, stmt)
 	require.NoError(t, err)
-	assert.Equal(t, sql.StatementStateSucceeded, resp.Status.State)
-	assert.Equal(t, [][]string{{"42"}}, resp.Result.DataArray)
+	assert.Equal(t, [][]string{{"42"}}, result.Rows)
 }
 
 func TestExecuteAndPollFailsDuringPolling(t *testing.T) {
@@ -132,7 +156,7 @@ func TestExecuteAndPollFailsDuringPolling(t *testing.T) {
 		},
 	}, nil).Once()
 
-	_, err := executeAndPoll(ctx, mockAPI, "wh-123", "SELECT 1")
+	_, err := executeAndPoll(ctx, sqlexec.New(mockAPI, "wh-123"), "SELECT 1", nil)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "RESOURCE_EXHAUSTED")
 }
@@ -157,115 +181,51 @@ func TestExecuteAndPollCancelledContextCallsCancelExecution(t *testing.T) {
 
 	cancel()
 
-	_, err := executeAndPoll(ctx, mockAPI, "wh-123", "SELECT 1")
+	_, err := executeAndPoll(ctx, sqlexec.New(mockAPI, "wh-123"), "SELECT 1", nil)
 	require.ErrorIs(t, err, root.ErrAlreadyPrinted)
 }
 
-func TestPollStatementImmediateTerminal(t *testing.T) {
-	ctx := cmdio.MockDiscard(t.Context())
-	mockAPI := mocksql.NewMockStatementExecutionInterface(t)
-
-	resp := &sql.StatementResponse{
-		StatementId: "stmt-1",
-		Status:      &sql.StatementStatus{State: sql.StatementStateSucceeded},
-		Manifest:    &sql.ResultManifest{Schema: &sql.ResultSchema{Columns: []sql.ColumnInfo{{Name: "1"}}}},
-		Result:      &sql.ResultData{DataArray: [][]string{{"1"}}},
-	}
-
-	pollResp, err := pollStatement(ctx, mockAPI, resp)
-	require.NoError(t, err)
-	assert.Equal(t, sql.StatementStateSucceeded, pollResp.Status.State)
-	assert.Equal(t, "stmt-1", pollResp.StatementId)
-}
-
-func TestPollStatementTerminalFailureNotErrored(t *testing.T) {
-	// pollStatement returns the response without erroring on failed terminal
-	// states; callers (e.g. executeAndPoll) decide what to do via checkFailedState.
-	ctx := cmdio.MockDiscard(t.Context())
-	mockAPI := mocksql.NewMockStatementExecutionInterface(t)
-
-	resp := &sql.StatementResponse{
-		StatementId: "stmt-1",
-		Status: &sql.StatementStatus{
-			State: sql.StatementStateFailed,
-			Error: &sql.ServiceError{ErrorCode: "ERR", Message: "boom"},
-		},
-	}
-
-	pollResp, err := pollStatement(ctx, mockAPI, resp)
-	require.NoError(t, err)
-	assert.Equal(t, sql.StatementStateFailed, pollResp.Status.State)
-}
-
-func TestPollStatementEventualSuccess(t *testing.T) {
-	ctx := cmdio.MockDiscard(t.Context())
-	mockAPI := mocksql.NewMockStatementExecutionInterface(t)
-
-	initial := &sql.StatementResponse{
-		StatementId: "stmt-1",
-		Status:      &sql.StatementStatus{State: sql.StatementStatePending},
-	}
-
-	mockAPI.EXPECT().GetStatementByStatementId(mock.Anything, "stmt-1").Return(&sql.StatementResponse{
-		StatementId: "stmt-1",
-		Status:      &sql.StatementStatus{State: sql.StatementStateRunning},
-	}, nil).Once()
-
-	mockAPI.EXPECT().GetStatementByStatementId(mock.Anything, "stmt-1").Return(&sql.StatementResponse{
-		StatementId: "stmt-1",
-		Status:      &sql.StatementStatus{State: sql.StatementStateSucceeded},
-		Result:      &sql.ResultData{DataArray: [][]string{{"42"}}},
-	}, nil).Once()
-
-	pollResp, err := pollStatement(ctx, mockAPI, initial)
+func TestResolveWarehouseIDWithFlag(t *testing.T) {
+	ctx := t.Context()
+	id, err := resolveWarehouseID(ctx, nil, "explicit-id")
 	require.NoError(t, err)
-	assert.Equal(t, sql.StatementStateSucceeded, pollResp.Status.State)
-	assert.Equal(t, [][]string{{"42"}}, pollResp.Result.DataArray)
+	assert.Equal(t, "explicit-id", id)
 }
 
-func TestPollStatementContextCancellationDoesNotCancelServerSide(t *testing.T) {
-	// The mock asserts (via t.Cleanup) that no unexpected calls are made.
-	// Specifically, pollStatement must NOT call CancelExecution on context
-	// cancellation; that is the caller's responsibility.
-	ctx, cancel := context.WithCancel(cmdio.MockDiscard(t.Context()))
-	mockAPI := mocksql.NewMockStatementExecutionInterface(t)
+func TestPresentQueryError(t *testing.T) {
+	assert.NoError(t, presentQueryError(nil))
 
-	initial := &sql.StatementResponse{
-		StatementId: "stmt-1",
-		Status:      &sql.StatementStatus{State: sql.StatementStatePending},
-	}
+	// Non-StatementError passes through unchanged.
+	plain := errors.New("boom")
+	assert.Equal(t, plain, presentQueryError(plain))
 
-	cancel()
-
-	pollResp, err := pollStatement(ctx, mockAPI, initial)
-	require.ErrorIs(t, err, context.Canceled)
-	assert.Nil(t, pollResp)
-}
-
-func TestPollStatementGetErrorPropagated(t *testing.T) {
-	ctx := cmdio.MockDiscard(t.Context())
-	mockAPI := mocksql.NewMockStatementExecutionInterface(t)
-
-	initial := &sql.StatementResponse{
-		StatementId: "stmt-1",
-		Status:      &sql.StatementStatus{State: sql.StatementStatePending},
-	}
+	err := presentQueryError(&sqlexec.StatementError{
+		State:   sql.StatementStateFailed,
+		Code:    "ERR",
+		Message: "bad",
+	})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "query failed: ERR bad")
 
-	mockAPI.EXPECT().GetStatementByStatementId(mock.Anything, "stmt-1").
-		Return(nil, errors.New("network unreachable")).Once()
+	err = presentQueryError(&sqlexec.StatementError{State: sql.StatementStateCanceled})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "cancelled")
 
-	pollResp, err := pollStatement(ctx, mockAPI, initial)
+	err = presentQueryError(&sqlexec.StatementError{State: sql.StatementStateClosed})
 	require.Error(t, err)
-	assert.Contains(t, err.Error(), "poll statement status")
-	assert.Contains(t, err.Error(), "network unreachable")
-	assert.Nil(t, pollResp)
+	assert.Contains(t, err.Error(), "closed")
 }
 
-func TestResolveWarehouseIDWithFlag(t *testing.T) {
-	ctx := t.Context()
-	id, err := resolveWarehouseID(ctx, nil, "explicit-id")
-	require.NoError(t, err)
-	assert.Equal(t, "explicit-id", id)
+func TestPresentQueryErrorMapKeyHint(t *testing.T) {
+	err := presentQueryError(&sqlexec.StatementError{
+		State:   sql.StatementStateFailed,
+		Code:    "BAD_REQUEST",
+		Message: "[UNRESOLVED_MAP_KEY.WITH_SUGGESTION] Cannot resolve column",
+	})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "Hint:")
+	assert.Contains(t, err.Error(), "single quotes")
+	assert.Contains(t, err.Error(), "--file")
 }
 
 func TestSelectQueryOutputMode(t *testing.T) {
@@ -327,116 +287,6 @@ func TestSelectQueryOutputMode(t *testing.T) {
 	}
 }
 
-func TestFetchAllRowsSingleChunk(t *testing.T) {
-	ctx := cmdio.MockDiscard(t.Context())
-	mockAPI := mocksql.NewMockStatementExecutionInterface(t)
-
-	resp := &sql.StatementResponse{
-		StatementId: "stmt-1",
-		Manifest:    &sql.ResultManifest{TotalChunkCount: 1},
-		Result:      &sql.ResultData{DataArray: [][]string{{"1", "alice"}, {"2", "bob"}}},
-	}
-
-	rows, err := fetchAllRows(ctx, mockAPI, resp)
-	require.NoError(t, err)
-	assert.Equal(t, [][]string{{"1", "alice"}, {"2", "bob"}}, rows)
-}
-
-func TestFetchAllRowsMultiChunk(t *testing.T) {
-	ctx := cmdio.MockDiscard(t.Context())
-	mockAPI := mocksql.NewMockStatementExecutionInterface(t)
-
-	resp := &sql.StatementResponse{
-		StatementId: "stmt-1",
-		Manifest:    &sql.ResultManifest{TotalChunkCount: 3},
-		Result:      &sql.ResultData{DataArray: [][]string{{"1", "a"}}},
-	}
-
-	mockAPI.EXPECT().GetStatementResultChunkNByStatementIdAndChunkIndex(mock.Anything, "stmt-1", 1).
-		Return(&sql.ResultData{DataArray: [][]string{{"2", "b"}}}, nil).Once()
-	mockAPI.EXPECT().GetStatementResultChunkNByStatementIdAndChunkIndex(mock.Anything, "stmt-1", 2).
-		Return(&sql.ResultData{DataArray: [][]string{{"3", "c"}}}, nil).Once()
-
-	rows, err := fetchAllRows(ctx, mockAPI, resp)
-	require.NoError(t, err)
-	assert.Equal(t, [][]string{{"1", "a"}, {"2", "b"}, {"3", "c"}}, rows)
-}
-
-func TestFetchAllRowsNilResult(t *testing.T) {
-	ctx := cmdio.MockDiscard(t.Context())
-	mockAPI := mocksql.NewMockStatementExecutionInterface(t)
-
-	resp := &sql.StatementResponse{StatementId: "stmt-1"}
-
-	rows, err := fetchAllRows(ctx, mockAPI, resp)
-	require.NoError(t, err)
-	assert.Nil(t, rows)
-}
-
-func TestIsTerminalState(t *testing.T) {
-	tests := []struct {
-		state    sql.StatementState
-		terminal bool
-	}{
-		{sql.StatementStateSucceeded, true},
-		{sql.StatementStateFailed, true},
-		{sql.StatementStateCanceled, true},
-		{sql.StatementStateClosed, true},
-		{sql.StatementStatePending, false},
-		{sql.StatementStateRunning, false},
-	}
-
-	for _, tc := range tests {
-		t.Run(string(tc.state), func(t *testing.T) {
-			status := &sql.StatementStatus{State: tc.state}
-			assert.Equal(t, tc.terminal, isTerminalState(status))
-		})
-	}
-
-	assert.False(t, isTerminalState(nil))
-}
-
-func TestCheckFailedState(t *testing.T) {
-	assert.NoError(t, checkFailedState(nil))
-	assert.NoError(t, checkFailedState(&sql.StatementStatus{State: sql.StatementStateSucceeded}))
-
-	err := checkFailedState(&sql.StatementStatus{
-		State: sql.StatementStateFailed,
-		Error: &sql.ServiceError{ErrorCode: "ERR", Message: "bad"},
-	})
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "ERR")
-	assert.Contains(t, err.Error(), "bad")
-
-	err = checkFailedState(&sql.StatementStatus{State: sql.StatementStateCanceled})
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "cancelled")
-
-	err = checkFailedState(&sql.StatementStatus{State: sql.StatementStateClosed})
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "closed")
-}
-
-func TestCheckFailedStateMapKeyHint(t *testing.T) {
-	err := checkFailedState(&sql.StatementStatus{
-		State: sql.StatementStateFailed,
-		Error: &sql.ServiceError{
-			ErrorCode: "BAD_REQUEST",
-			Message:   "[UNRESOLVED_MAP_KEY.WITH_SUGGESTION] Cannot resolve column",
-		},
-	})
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "Hint:")
-	assert.Contains(t, err.Error(), "single quotes")
-	assert.Contains(t, err.Error(), "--file")
-}
-
-func TestPollingConstants(t *testing.T) {
-	assert.Equal(t, 1*time.Second, pollIntervalInitial)
-	assert.Equal(t, 5*time.Second, pollIntervalMax)
-	assert.Equal(t, 10*time.Second, cancelTimeout)
-}
-
 // newTestCmd creates a minimal cobra.Command for testing resolveSQLs.
 func newTestCmd() *cobra.Command {
 	return &cobra.Command{Use: "test"}
@@ -626,6 +476,16 @@ func TestQueryCommandConcurrencyRejection(t *testing.T) {
 	}
 }
 
+func TestQueryCommandRejectsInvalidParamBeforeWorkspaceClient(t *testing.T) {
+	// Parameter validation runs in PreRunE before MustWorkspaceClient, so a
+	// malformed flag returns an actionable error without auth/profile work.
+	cmd := newQueryCmd()
+	cmd.SetArgs([]string{"--param", "bad", "SELECT 1"})
+	err := cmd.Execute()
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "expected name=value")
+}
+
 func TestQueryCommandOutputFlagIsCaseInsensitive(t *testing.T) {
 	cmd := newQueryCmd()
 	cmd.PreRunE = nil
diff --git a/experimental/aitools/cmd/render.go b/experimental/aitools/cmd/render.go
index d0b62926c20..2c8b5ac4587 100644
--- a/experimental/aitools/cmd/render.go
+++ b/experimental/aitools/cmd/render.go
@@ -1,6 +1,7 @@
 package aitools
 
 import (
+	"context"
 	"encoding/csv"
 	"encoding/json"
 	"fmt"
@@ -9,7 +10,6 @@ import (
 	"text/tabwriter"
 
 	"github.com/databricks/cli/libs/tableview"
-	"github.com/databricks/databricks-sdk-go/service/sql"
 )
 
 const (
@@ -17,18 +17,6 @@ const (
 	maxColumnWidth = 40
 )
 
-// extractColumns returns column names from the query result manifest.
-func extractColumns(manifest *sql.ResultManifest) []string {
-	if manifest == nil || manifest.Schema == nil {
-		return nil
-	}
-	columns := make([]string, len(manifest.Schema.Columns))
-	for i, col := range manifest.Schema.Columns {
-		columns[i] = col.Name
-	}
-	return columns
-}
-
 // renderBatchJSON writes batch results as a JSON array. The array preserves
 // input order and includes one object per submitted statement.
 func renderBatchJSON(w io.Writer, results []batchResult) error {
@@ -126,6 +114,6 @@ func renderStaticTable(w io.Writer, columns []string, rows [][]string) error {
 }
 
 // renderInteractiveTable displays query results in the interactive table browser.
-func renderInteractiveTable(w io.Writer, columns []string, rows [][]string) error {
-	return tableview.Run(w, columns, rows)
+func renderInteractiveTable(ctx context.Context, w io.Writer, columns []string, rows [][]string) error {
+	return tableview.Run(ctx, w, columns, rows)
 }
diff --git a/experimental/aitools/cmd/render_test.go b/experimental/aitools/cmd/render_test.go
index 6d9cf760eef..4e26eff85f3 100644
--- a/experimental/aitools/cmd/render_test.go
+++ b/experimental/aitools/cmd/render_test.go
@@ -4,40 +4,10 @@ import (
 	"bytes"
 	"testing"
 
-	"github.com/databricks/databricks-sdk-go/service/sql"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
-func TestExtractColumns(t *testing.T) {
-	tests := []struct {
-		name     string
-		manifest *sql.ResultManifest
-		want     []string
-	}{
-		{
-			"with columns",
-			&sql.ResultManifest{Schema: &sql.ResultSchema{
-				Columns: []sql.ColumnInfo{{Name: "id"}, {Name: "name"}},
-			}},
-			[]string{"id", "name"},
-		},
-		{"nil manifest", nil, nil},
-		{"nil schema", &sql.ResultManifest{}, nil},
-		{
-			"empty columns",
-			&sql.ResultManifest{Schema: &sql.ResultSchema{}},
-			[]string{},
-		},
-	}
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			got := extractColumns(tc.manifest)
-			assert.Equal(t, tc.want, got)
-		})
-	}
-}
-
 func TestRenderJSON(t *testing.T) {
 	var buf bytes.Buffer
 	columns := []string{"id", "name"}
diff --git a/experimental/aitools/cmd/scope.go b/experimental/aitools/cmd/scope.go
deleted file mode 100644
index 8c6ce0f0130..00000000000
--- a/experimental/aitools/cmd/scope.go
+++ /dev/null
@@ -1,326 +0,0 @@
-package aitools
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"os"
-	"path/filepath"
-
-	"github.com/charmbracelet/huh"
-	"github.com/databricks/cli/experimental/aitools/lib/installer"
-	"github.com/databricks/cli/libs/cmdio"
-	"github.com/databricks/cli/libs/env"
-)
-
-// promptScopeSelection is a package-level var so tests can replace it with a mock.
-var promptScopeSelection = defaultPromptScopeSelection
-
-// promptUpdateScopeSelection is a package-level var for the update scope prompt (3 options: global/project/both).
-var promptUpdateScopeSelection = defaultPromptUpdateScopeSelection
-
-// promptUninstallScopeSelection is a package-level var for the uninstall scope prompt (2 options: global/project).
-var promptUninstallScopeSelection = defaultPromptUninstallScopeSelection
-
-// resolveScope validates --project and --global flags and returns the scope.
-func resolveScope(project, global bool) (string, error) {
-	if project && global {
-		return "", errors.New("cannot use --global and --project together")
-	}
-	if project {
-		return installer.ScopeProject, nil
-	}
-	return installer.ScopeGlobal, nil
-}
-
-// resolveScopeWithPrompt resolves scope with optional interactive prompt.
-// When neither flag is set: interactive mode shows a prompt (default: global),
-// non-interactive mode uses global.
-func resolveScopeWithPrompt(ctx context.Context, project, global bool) (string, error) {
-	if project || global {
-		return resolveScope(project, global)
-	}
-
-	// No flag: prompt if interactive, default to global otherwise.
-	if cmdio.IsPromptSupported(ctx) {
-		return promptScopeSelection(ctx)
-	}
-	return installer.ScopeGlobal, nil
-}
-
-func defaultPromptScopeSelection(ctx context.Context) (string, error) {
-	homeDir, err := env.UserHomeDir(ctx)
-	if err != nil {
-		return "", err
-	}
-	globalPath := filepath.Join(homeDir, ".databricks", "aitools", "skills")
-
-	cwd, err := os.Getwd()
-	if err != nil {
-		return "", err
-	}
-	projectPath := filepath.Join(cwd, ".databricks", "aitools", "skills")
-
-	globalLabel := "User global (" + globalPath + "/)\n    Available to you across all projects."
-	projectLabel := "Project (" + projectPath + "/)\n    Checked into the repo, shared with everyone on the project."
-
-	var scope string
-	err = huh.NewSelect[string]().
-		Title("Where should skills be installed?").
-		Options(
-			huh.NewOption(globalLabel, installer.ScopeGlobal),
-			huh.NewOption(projectLabel, installer.ScopeProject),
-		).
-		Value(&scope).
-		Run()
-	if err != nil {
-		return "", err
-	}
-
-	return scope, nil
-}
-
-const scopeBoth = "both"
-
-// detectInstalledScopes checks which scopes have a .state.json file present.
-func detectInstalledScopes(globalDir, projectDir string) (global, project bool, err error) {
-	globalState, err := installer.LoadState(globalDir)
-	if err != nil {
-		return false, false, err
-	}
-
-	projectState, err := installer.LoadState(projectDir)
-	if err != nil {
-		return false, false, err
-	}
-
-	return globalState != nil, projectState != nil, nil
-}
-
-// resolveScopeForUpdate resolves scopes for the update command.
-// Returns one or more scopes to update. When both flags are set, global always passes through
-// (for legacy install detection) and project is checked via state.
-func resolveScopeForUpdate(ctx context.Context, projectFlag, globalFlag bool, globalDir, projectDir string) ([]string, error) {
-	hasGlobal, hasProject, err := detectInstalledScopes(globalDir, projectDir)
-	if err != nil {
-		return nil, err
-	}
-
-	if projectFlag && globalFlag {
-		var scopes []string
-		if hasGlobal {
-			scopes = append(scopes, installer.ScopeGlobal)
-		}
-		if hasProject {
-			scopes = append(scopes, installer.ScopeProject)
-		}
-		if len(scopes) == 0 {
-			// Neither installed. Fall through to global for legacy detection.
-			return []string{installer.ScopeGlobal}, nil
-		}
-		return scopes, nil
-	}
-	if projectFlag {
-		return withExplicitScopeCheck(projectDir, installer.ScopeProject, "update", projectDir, hasGlobal, hasProject)
-	}
-	if globalFlag {
-		// Always pass through to the installer layer, which handles legacy installs.
-		return []string{installer.ScopeGlobal}, nil
-	}
-
-	// No flags: auto-detect.
-	switch {
-	case hasGlobal && hasProject:
-		if !cmdio.IsPromptSupported(ctx) {
-			return nil, errors.New("skills are installed in both global and project scopes; use --global, --project, or both flags to specify which to update")
-		}
-		scopes, err := promptUpdateScopeSelection(ctx)
-		if err != nil {
-			return nil, err
-		}
-		return scopes, nil
-
-	case hasGlobal:
-		return []string{installer.ScopeGlobal}, nil
-
-	case hasProject:
-		return []string{installer.ScopeProject}, nil
-
-	default:
-		// Fall through to global scope so the installer layer can detect
-		// legacy installs (skills on disk without .state.json) and provide
-		// appropriate migration guidance.
-		return []string{installer.ScopeGlobal}, nil
-	}
-}
-
-// resolveScopeForUninstall resolves the scope for the uninstall command.
-// Unlike update, uninstall never allows "both" scopes at once.
-func resolveScopeForUninstall(ctx context.Context, projectFlag, globalFlag bool, globalDir, projectDir string) (string, error) {
-	if projectFlag && globalFlag {
-		return "", errors.New("cannot uninstall both scopes at once; run uninstall separately for --global and --project")
-	}
-
-	hasGlobal, hasProject, err := detectInstalledScopes(globalDir, projectDir)
-	if err != nil {
-		return "", err
-	}
-
-	if projectFlag {
-		scopes, err := withExplicitScopeCheck(projectDir, installer.ScopeProject, "uninstall", projectDir, hasGlobal, hasProject)
-		if err != nil {
-			return "", err
-		}
-		return scopes[0], nil
-	}
-	if globalFlag {
-		// Always pass through to the installer layer, which handles legacy installs.
-		return installer.ScopeGlobal, nil
-	}
-
-	// No flags: auto-detect.
-	switch {
-	case hasGlobal && hasProject:
-		if !cmdio.IsPromptSupported(ctx) {
-			return "", errors.New("skills are installed in both global and project scopes; use --global or --project to specify which to uninstall")
-		}
-		scope, err := promptUninstallScopeSelection(ctx)
-		if err != nil {
-			return "", err
-		}
-		return scope, nil
-
-	case hasGlobal:
-		return installer.ScopeGlobal, nil
-
-	case hasProject:
-		return installer.ScopeProject, nil
-
-	default:
-		// Fall through to global scope so the installer layer can detect
-		// legacy installs (skills on disk without .state.json) and provide
-		// appropriate migration guidance.
-		return installer.ScopeGlobal, nil
-	}
-}
-
-// withExplicitScopeCheck validates that the explicitly requested scope has an installation.
-// Returns a helpful error with CWD guidance for project scope and cross-scope hints.
-// The verb parameter (e.g. "update", "uninstall") is used in cross-scope hint messages.
-func withExplicitScopeCheck(dir, scope, verb, projectDir string, hasGlobal, hasProject bool) ([]string, error) {
-	state, err := installer.LoadState(dir)
-	if err != nil {
-		return nil, err
-	}
-	if state == nil {
-		return nil, scopeNotInstalledError(scope, verb, projectDir, hasGlobal, hasProject)
-	}
-
-	return []string{scope}, nil
-}
-
-// scopeNotInstalledError builds a detailed error for when the requested scope has no installation.
-// Includes cross-scope hints when the other scope is installed.
-// The verb parameter (e.g. "update", "uninstall") is used in cross-scope hint messages.
-func scopeNotInstalledError(scope, verb, projectDir string, hasGlobal, hasProject bool) error {
-	var msg string
-	if scope == installer.ScopeProject {
-		expectedPath := filepath.ToSlash(projectDir)
-		msg = fmt.Sprintf(
-			"no project-scoped skills found in the current directory.\n\n"+
-				"Project-scoped skills are detected based on your working directory.\n"+
-				"Make sure you are in the project root where you originally ran\n"+
-				"'databricks experimental aitools install --project'.\n\n"+
-				"Expected location: %s/", expectedPath)
-	} else {
-		msg = "no globally-scoped skills installed. Run 'databricks experimental aitools install --global' to install"
-	}
-
-	hint := crossScopeHint(scope, verb, hasGlobal, hasProject)
-	if hint != "" {
-		msg += "\n\n" + hint
-	}
-
-	return errors.New(msg)
-}
-
-// crossScopeHint returns a hint string if the opposite scope has an installation.
-// The verb parameter (e.g. "update", "uninstall") controls the action in the hint message.
-func crossScopeHint(requestedScope, verb string, hasGlobal, hasProject bool) string {
-	if requestedScope == installer.ScopeProject && hasGlobal {
-		return fmt.Sprintf("Global skills are installed. Run without --project to %s those.", verb)
-	}
-	if requestedScope == installer.ScopeGlobal && hasProject {
-		return fmt.Sprintf("Project-scoped skills are installed. Run without --global to %s those.", verb)
-	}
-	return ""
-}
-
-func defaultPromptUpdateScopeSelection(ctx context.Context) ([]string, error) {
-	homeDir, err := env.UserHomeDir(ctx)
-	if err != nil {
-		return nil, err
-	}
-	globalPath := filepath.Join(homeDir, ".databricks", "aitools", "skills")
-
-	cwd, err := os.Getwd()
-	if err != nil {
-		return nil, err
-	}
-	projectPath := filepath.Join(cwd, ".databricks", "aitools", "skills")
-
-	globalLabel := "Global (" + globalPath + "/)"
-	projectLabel := "Project (" + projectPath + "/)"
-	bothLabel := "Both global and project"
-
-	var scope string
-	err = huh.NewSelect[string]().
-		Title("Which installation should be updated?").
-		Options(
-			huh.NewOption(globalLabel, installer.ScopeGlobal),
-			huh.NewOption(projectLabel, installer.ScopeProject),
-			huh.NewOption(bothLabel, scopeBoth),
-		).
-		Value(&scope).
-		Run()
-	if err != nil {
-		return nil, err
-	}
-
-	if scope == scopeBoth {
-		return []string{installer.ScopeGlobal, installer.ScopeProject}, nil
-	}
-	return []string{scope}, nil
-}
-
-func defaultPromptUninstallScopeSelection(ctx context.Context) (string, error) {
-	homeDir, err := env.UserHomeDir(ctx)
-	if err != nil {
-		return "", err
-	}
-	globalPath := filepath.Join(homeDir, ".databricks", "aitools", "skills")
-
-	cwd, err := os.Getwd()
-	if err != nil {
-		return "", err
-	}
-	projectPath := filepath.Join(cwd, ".databricks", "aitools", "skills")
-
-	globalLabel := "Global (" + globalPath + "/)"
-	projectLabel := "Project (" + projectPath + "/)"
-
-	var scope string
-	err = huh.NewSelect[string]().
-		Title("Which installation should be uninstalled?").
-		Options(
-			huh.NewOption(globalLabel, installer.ScopeGlobal),
-			huh.NewOption(projectLabel, installer.ScopeProject),
-		).
-		Value(&scope).
-		Run()
-	if err != nil {
-		return "", err
-	}
-
-	return scope, nil
-}
diff --git a/experimental/aitools/cmd/skills.go b/experimental/aitools/cmd/skills.go
deleted file mode 100644
index 9995ff72a07..00000000000
--- a/experimental/aitools/cmd/skills.go
+++ /dev/null
@@ -1,101 +0,0 @@
-package aitools
-
-import (
-	"context"
-	"errors"
-
-	"github.com/charmbracelet/huh"
-	"github.com/databricks/cli/experimental/aitools/lib/agents"
-	"github.com/databricks/cli/experimental/aitools/lib/installer"
-	"github.com/spf13/cobra"
-)
-
-// Package-level vars for testability.
-var (
-	promptAgentSelection     = defaultPromptAgentSelection
-	installSkillsForAgentsFn = installer.InstallSkillsForAgents
-)
-
-func defaultPromptAgentSelection(ctx context.Context, detected []*agents.Agent) ([]*agents.Agent, error) {
-	options := make([]huh.Option[string], 0, len(detected))
-	agentsByName := make(map[string]*agents.Agent, len(detected))
-	for _, a := range detected {
-		options = append(options, huh.NewOption(a.DisplayName, a.Name).Selected(true))
-		agentsByName[a.Name] = a
-	}
-
-	var selected []string
-	err := huh.NewMultiSelect[string]().
-		Title("Select coding agents to install skills for").
-		Description("space to toggle, enter to confirm").
-		Options(options...).
-		Value(&selected).
-		Run()
-	if err != nil {
-		return nil, err
-	}
-
-	if len(selected) == 0 {
-		return nil, errors.New("at least one agent must be selected")
-	}
-
-	result := make([]*agents.Agent, 0, len(selected))
-	for _, name := range selected {
-		result = append(result, agentsByName[name])
-	}
-	return result, nil
-}
-
-func newSkillsCmd() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:    "skills",
-		Hidden: true,
-		Short:  "Manage Databricks skills for coding agents",
-		Long:   `Manage Databricks skills that extend coding agents with Databricks-specific capabilities.`,
-	}
-
-	// Subcommands delegate to the flat top-level commands.
-	cmd.AddCommand(newSkillsListCmd())
-	cmd.AddCommand(newSkillsInstallCmd())
-
-	return cmd
-}
-
-func newSkillsListCmd() *cobra.Command {
-	return &cobra.Command{
-		Use:   "list",
-		Short: "List available skills",
-		RunE: func(cmd *cobra.Command, args []string) error {
-			// Default to showing all scopes (empty scope = both).
-			return listSkillsFn(cmd, "")
-		},
-	}
-}
-
-func newSkillsInstallCmd() *cobra.Command {
-	var includeExperimental bool
-
-	cmd := &cobra.Command{
-		Use:   "install [skill-name]",
-		Short: "Install Databricks skills for detected coding agents",
-		Args:  cobra.MaximumNArgs(1),
-		RunE: func(cmd *cobra.Command, args []string) error {
-			// Delegate to the flat install command's logic.
-			installCmd := newInstallCmd()
-			installCmd.SetContext(cmd.Context())
-
-			var delegateArgs []string
-			if len(args) > 0 {
-				delegateArgs = append(delegateArgs, "--skills", args[0])
-			}
-			if includeExperimental {
-				delegateArgs = append(delegateArgs, "--experimental")
-			}
-			installCmd.SetArgs(delegateArgs)
-			return installCmd.Execute()
-		},
-	}
-
-	cmd.Flags().BoolVar(&includeExperimental, "experimental", false, "Include experimental skills")
-	return cmd
-}
diff --git a/experimental/aitools/cmd/statement.go b/experimental/aitools/cmd/statement.go
index e1c48a7ddbe..13d2f70e316 100644
--- a/experimental/aitools/cmd/statement.go
+++ b/experimental/aitools/cmd/statement.go
@@ -2,9 +2,11 @@ package aitools
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 
+	"github.com/databricks/cli/libs/sqlexec"
 	"github.com/databricks/databricks-sdk-go/service/sql"
 	"github.com/spf13/cobra"
 )
@@ -31,25 +33,26 @@ func renderStatementInfo(w io.Writer, info statementInfo) error {
 	return nil
 }
 
-// statementErrorFromStatus builds a batchResultError for any terminal non-success
-// state (FAILED, CANCELED, CLOSED), populating it from the server's ServiceError
-// when available and synthesizing a message when it isn't. Returns nil for
-// SUCCEEDED, non-terminal states, and nil status. The synthesized fallback
-// matters because the Statements API can hand back a non-success terminal state
-// with `Error == nil`, and skill consumers should be able to branch on
+// statementError converts the engine's structured statement error into the
+// batchResultError shape emitted in JSON output. It returns nil for a nil error
+// or any error that is not a *sqlexec.StatementError (the engine produces the
+// latter only on terminal non-success states). The error's Message and Code are
+// surfaced directly rather than the formatted Error() string, and the engine
+// synthesizes a "statement reached terminal state <STATE>" message when the
+// backend reports no ServiceError, so skill consumers can branch on
 // `error == null` alone instead of inspecting `state`.
-func statementErrorFromStatus(status *sql.StatementStatus) *batchResultError {
-	if status == nil || !isTerminalState(status) || status.State == sql.StatementStateSucceeded {
+func statementError(err error) *batchResultError {
+	if err == nil {
 		return nil
 	}
-	out := &batchResultError{}
-	if status.Error != nil {
-		out.Message = status.Error.Message
-		out.ErrorCode = string(status.Error.ErrorCode)
-	} else {
-		out.Message = fmt.Sprintf("statement reached terminal state %s", status.State)
+	se, ok := errors.AsType[*sqlexec.StatementError](err)
+	if !ok {
+		return &batchResultError{Message: err.Error()}
+	}
+	return &batchResultError{
+		Message:   se.Message,
+		ErrorCode: string(se.Code),
 	}
-	return out
 }
 
 func newStatementCmd() *cobra.Command {
diff --git a/experimental/aitools/cmd/statement_cancel.go b/experimental/aitools/cmd/statement_cancel.go
index 1774b7abe6a..912f20d83d6 100644
--- a/experimental/aitools/cmd/statement_cancel.go
+++ b/experimental/aitools/cmd/statement_cancel.go
@@ -2,10 +2,10 @@ package aitools
 
 import (
 	"context"
-	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/sqlexec"
 	"github.com/databricks/databricks-sdk-go/service/sql"
 	"github.com/spf13/cobra"
 )
@@ -41,10 +41,10 @@ the server-side state if you need certainty.`,
 // CancelExecution returns no body; the actual server-side state is verified
 // asynchronously. Use 'statement status' to confirm if certainty is required.
 func cancelStatementExecution(ctx context.Context, api sql.StatementExecutionInterface, statementID string) (statementInfo, error) {
-	if err := api.CancelExecution(ctx, sql.CancelExecutionRequest{
-		StatementId: statementID,
-	}); err != nil {
-		return statementInfo{}, fmt.Errorf("cancel statement: %w", err)
+	// Cancel doesn't use the warehouse ID.
+	client := sqlexec.New(api, "")
+	if err := client.Cancel(ctx, statementID); err != nil {
+		return statementInfo{}, err
 	}
 	return statementInfo{
 		StatementID: statementID,
diff --git a/experimental/aitools/cmd/statement_get.go b/experimental/aitools/cmd/statement_get.go
index 617b5c274dd..fe011464a0c 100644
--- a/experimental/aitools/cmd/statement_get.go
+++ b/experimental/aitools/cmd/statement_get.go
@@ -6,6 +6,7 @@ import (
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/sqlexec"
 	"github.com/databricks/databricks-sdk-go/service/sql"
 	"github.com/spf13/cobra"
 )
@@ -54,43 +55,48 @@ invoked the synchronous path.)`,
 // getStatementResult polls a statement until terminal, then assembles a
 // statementInfo with rows on success or an error object on failure.
 //
-// Context cancellation propagates from pollStatement WITHOUT cancelling the
+// Context cancellation propagates from the poll WITHOUT cancelling the
 // server-side statement (intentional: 'get' is a poll-only operation; use
 // 'cancel' to terminate explicitly).
 func getStatementResult(ctx context.Context, api sql.StatementExecutionInterface, statementID string) (statementInfo, error) {
-	// Fetch the current state first so pollStatement can short-circuit if
-	// the statement is already terminal.
-	resp, err := api.GetStatementByStatementId(ctx, statementID)
+	// Get/Poll don't use the warehouse ID.
+	client := sqlexec.New(api, "")
+
+	// Fetch the current state first so Poll can short-circuit if the statement
+	// is already terminal.
+	stmt, err := client.Get(ctx, statementID)
 	if err != nil {
-		return statementInfo{}, fmt.Errorf("get statement: %w", err)
+		return statementInfo{}, err
 	}
 
-	pollResp, err := pollStatement(ctx, api, resp)
+	stmt, err = client.Poll(ctx, stmt)
 	if err != nil {
 		return statementInfo{}, err
 	}
 
-	info := statementInfo{StatementID: pollResp.StatementId}
-	if pollResp.Status != nil {
-		info.State = pollResp.Status.State
+	info := statementInfo{
+		StatementID: stmt.ID,
+		State:       stmt.State,
+		Error:       statementError(stmt.Err()),
 	}
-	info.Error = statementErrorFromStatus(pollResp.Status)
 
 	if info.State == sql.StatementStateSucceeded {
-		info.Columns = extractColumns(pollResp.Manifest)
-		rows, err := fetchAllRows(ctx, api, pollResp)
+		result, err := client.Results(ctx, stmt)
 		if err != nil {
 			// The query succeeded server-side but a later chunk fetch failed
 			// (network blip, throttling, transient 5xx). Surface this as a
 			// structured error on the same statementInfo so the caller still
-			// gets a parseable JSON response with the statement_id; RunE then
-			// signals exit-non-zero based on info.Error.
+			// gets a parseable JSON response with the statement_id and the
+			// column metadata (known from the manifest before any chunk fetch);
+			// RunE then signals exit-non-zero based on info.Error.
+			info.Columns = stmt.Columns()
 			info.Error = &batchResultError{
 				Message: fmt.Sprintf("fetch result rows: %v", err),
 			}
 			return info, nil
 		}
-		info.Rows = rows
+		info.Columns = result.Columns
+		info.Rows = result.Rows
 	}
 	return info, nil
 }
diff --git a/experimental/aitools/cmd/statement_status.go b/experimental/aitools/cmd/statement_status.go
index 9981f49aa63..91ea9c36408 100644
--- a/experimental/aitools/cmd/statement_status.go
+++ b/experimental/aitools/cmd/statement_status.go
@@ -2,10 +2,10 @@ package aitools
 
 import (
 	"context"
-	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/sqlexec"
 	"github.com/databricks/databricks-sdk-go/service/sql"
 	"github.com/spf13/cobra"
 )
@@ -38,15 +38,16 @@ without blocking. For a blocking poll-until-terminal call, use
 
 // getStatementStatus performs a single GET against the Statements API, no polling.
 func getStatementStatus(ctx context.Context, api sql.StatementExecutionInterface, statementID string) (statementInfo, error) {
-	resp, err := api.GetStatementByStatementId(ctx, statementID)
+	// Get doesn't use the warehouse ID.
+	client := sqlexec.New(api, "")
+	stmt, err := client.Get(ctx, statementID)
 	if err != nil {
-		return statementInfo{}, fmt.Errorf("get statement: %w", err)
+		return statementInfo{}, err
 	}
 
-	info := statementInfo{StatementID: resp.StatementId}
-	if resp.Status != nil {
-		info.State = resp.Status.State
-	}
-	info.Error = statementErrorFromStatus(resp.Status)
-	return info, nil
+	return statementInfo{
+		StatementID: stmt.ID,
+		State:       stmt.State,
+		Error:       statementError(stmt.Err()),
+	}, nil
 }
diff --git a/experimental/aitools/cmd/statement_submit.go b/experimental/aitools/cmd/statement_submit.go
index ac8bf424e5f..716f6550ee0 100644
--- a/experimental/aitools/cmd/statement_submit.go
+++ b/experimental/aitools/cmd/statement_submit.go
@@ -3,10 +3,10 @@ package aitools
 import (
 	"context"
 	"errors"
-	"fmt"
 
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/sqlexec"
 	"github.com/databricks/databricks-sdk-go/service/sql"
 	"github.com/spf13/cobra"
 )
@@ -14,10 +14,12 @@ import (
 func newStatementSubmitCmd() *cobra.Command {
 	var warehouseID string
 	var filePath string
+	var paramFlags []string
 	// resolved by PreRunE so input validation runs before any auth/profile
 	// work and the documented "validates input before WorkspaceClient" claim
 	// in the PR description is actually true.
 	var sqlStatement string
+	var params []sql.StatementParameterListItem
 
 	cmd := &cobra.Command{
 		Use:   "submit [SQL | file.sql]",
@@ -27,9 +29,14 @@ statement_id immediately, without waiting for results.
 
 The statement keeps running server-side. Harvest results with
 'statement get <id>', inspect with 'statement status <id>', or stop
-with 'statement cancel <id>'.`,
+with 'statement cancel <id>'.
+
+Pass named parameters with --param. Use ":name" markers in the SQL and
+"--param name=value" (string) or "--param name:TYPE=value" (typed) to
+bind values.`,
 		Example: `  databricks experimental aitools tools statement submit "SELECT pg_sleep(60)" --warehouse <wh>
-  databricks experimental aitools tools statement submit --file query.sql`,
+  databricks experimental aitools tools statement submit --file query.sql
+  databricks experimental aitools tools statement submit --param since:DATE=2026-01-01 "SELECT * FROM events WHERE ts > :since"`,
 		Args: cobra.MaximumNArgs(1),
 		PreRunE: func(cmd *cobra.Command, args []string) error {
 			ctx := cmd.Context()
@@ -47,6 +54,11 @@ with 'statement cancel <id>'.`,
 			}
 			sqlStatement = sqls[0]
 
+			params, err = parseParams(paramFlags)
+			if err != nil {
+				return err
+			}
+
 			return root.MustWorkspaceClient(cmd, args)
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {
@@ -57,7 +69,7 @@ with 'statement cancel <id>'.`,
 				return err
 			}
 
-			info, err := submitStatement(ctx, w.StatementExecution, sqlStatement, wID)
+			info, err := submitStatement(ctx, w.StatementExecution, sqlStatement, wID, params)
 			if err != nil {
 				return err
 			}
@@ -67,28 +79,22 @@ with 'statement cancel <id>'.`,
 
 	cmd.Flags().StringVarP(&warehouseID, "warehouse", "w", "", "SQL warehouse ID to use for execution")
 	cmd.Flags().StringVarP(&filePath, "file", "f", "", "Path to a SQL file to execute")
+	cmd.Flags().StringArrayVar(&paramFlags, "param", nil, "Named parameter, repeatable. Format: name=value (STRING) or name:TYPE=value (e.g. name:DATE=2026-01-01). Empty value is sent as NULL.")
 
 	return cmd
 }
 
 // submitStatement issues an asynchronous ExecuteStatement and returns the handle.
-func submitStatement(ctx context.Context, api sql.StatementExecutionInterface, statement, warehouseID string) (statementInfo, error) {
-	resp, err := api.ExecuteStatement(ctx, sql.ExecuteStatementRequest{
-		WarehouseId:   warehouseID,
-		Statement:     statement,
-		WaitTimeout:   "0s",
-		OnWaitTimeout: sql.ExecuteStatementRequestOnWaitTimeoutContinue,
-	})
+func submitStatement(ctx context.Context, api sql.StatementExecutionInterface, statement, warehouseID string, params []sql.StatementParameterListItem) (statementInfo, error) {
+	client := sqlexec.New(api, warehouseID)
+	stmt, err := client.Submit(ctx, statement, sqlexec.WithParameters(params))
 	if err != nil {
-		return statementInfo{}, fmt.Errorf("execute statement: %w", err)
+		return statementInfo{}, err
 	}
 
-	info := statementInfo{
-		StatementID: resp.StatementId,
+	return statementInfo{
+		StatementID: stmt.ID,
+		State:       stmt.State,
 		WarehouseID: warehouseID,
-	}
-	if resp.Status != nil {
-		info.State = resp.Status.State
-	}
-	return info, nil
+	}, nil
 }
diff --git a/experimental/aitools/cmd/statement_test.go b/experimental/aitools/cmd/statement_test.go
index 9c2264daf2c..e6905b3f20d 100644
--- a/experimental/aitools/cmd/statement_test.go
+++ b/experimental/aitools/cmd/statement_test.go
@@ -9,6 +9,7 @@ import (
 	"testing"
 
 	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/sqlexec"
 	mocksql "github.com/databricks/databricks-sdk-go/experimental/mocks/service/sql"
 	"github.com/databricks/databricks-sdk-go/service/sql"
 	"github.com/stretchr/testify/assert"
@@ -29,13 +30,33 @@ func TestSubmitStatementReturnsHandle(t *testing.T) {
 		Status:      &sql.StatementStatus{State: sql.StatementStatePending},
 	}, nil).Once()
 
-	info, err := submitStatement(ctx, mockAPI, "SELECT 1", "wh-1")
+	info, err := submitStatement(ctx, mockAPI, "SELECT 1", "wh-1", nil)
 	require.NoError(t, err)
 	assert.Equal(t, "stmt-1", info.StatementID)
 	assert.Equal(t, sql.StatementStatePending, info.State)
 	assert.Equal(t, "wh-1", info.WarehouseID)
 }
 
+func TestSubmitStatementPassesParameters(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	mockAPI := mocksql.NewMockStatementExecutionInterface(t)
+
+	params := []sql.StatementParameterListItem{
+		{Name: "since", Type: "DATE", Value: "2026-01-01"},
+	}
+
+	mockAPI.EXPECT().ExecuteStatement(mock.Anything, mock.MatchedBy(func(req sql.ExecuteStatementRequest) bool {
+		return assert.ObjectsAreEqual(params, req.Parameters)
+	})).Return(&sql.StatementResponse{
+		StatementId: "stmt-1",
+		Status:      &sql.StatementStatus{State: sql.StatementStatePending},
+	}, nil).Once()
+
+	info, err := submitStatement(ctx, mockAPI, "SELECT * FROM events WHERE ts > :since", "wh-1", params)
+	require.NoError(t, err)
+	assert.Equal(t, "stmt-1", info.StatementID)
+}
+
 func TestSubmitStatementWrapsTransportError(t *testing.T) {
 	ctx := cmdio.MockDiscard(t.Context())
 	mockAPI := mocksql.NewMockStatementExecutionInterface(t)
@@ -43,7 +64,7 @@ func TestSubmitStatementWrapsTransportError(t *testing.T) {
 	mockAPI.EXPECT().ExecuteStatement(mock.Anything, mock.Anything).
 		Return(nil, errors.New("network unreachable")).Once()
 
-	_, err := submitStatement(ctx, mockAPI, "SELECT 1", "wh-1")
+	_, err := submitStatement(ctx, mockAPI, "SELECT 1", "wh-1", nil)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "execute statement")
 	assert.Contains(t, err.Error(), "network unreachable")
@@ -141,10 +162,12 @@ func TestGetStatementResultChunkFetchFailureRendersPartialInfo(t *testing.T) {
 	info, err := getStatementResult(ctx, mockAPI, "stmt-1")
 	require.NoError(t, err)
 	assert.Equal(t, sql.StatementStateSucceeded, info.State)
-	assert.Equal(t, []string{"n"}, info.Columns, "columns from the initial response are still surfaced")
 	require.NotNil(t, info.Error)
 	assert.Contains(t, info.Error.Message, "fetch result rows")
 	assert.Contains(t, info.Error.Message, "network blip")
+	// Column metadata is known from the manifest before the failed chunk fetch,
+	// so it is still surfaced alongside the error.
+	assert.Equal(t, []string{"n"}, info.Columns)
 }
 
 func TestGetStatementStatusSinglePoll(t *testing.T) {
@@ -283,63 +306,45 @@ func TestStatementSubmitRejectsMultipleSQLsBeforeWorkspaceClient(t *testing.T) {
 	assert.Contains(t, err.Error(), "exactly one")
 }
 
-func TestStatementErrorFromStatus(t *testing.T) {
+func TestStatementError(t *testing.T) {
 	tests := []struct {
 		name     string
-		status   *sql.StatementStatus
+		err      error
 		wantNil  bool
 		wantMsg  string
 		wantCode string
 	}{
 		{
-			name:    "nil status",
-			status:  nil,
+			name:    "nil error",
+			err:     nil,
 			wantNil: true,
 		},
 		{
-			name:    "succeeded never produces an error",
-			status:  &sql.StatementStatus{State: sql.StatementStateSucceeded},
-			wantNil: true,
-		},
-		{
-			name:    "running is not terminal",
-			status:  &sql.StatementStatus{State: sql.StatementStateRunning},
-			wantNil: true,
-		},
-		{
-			name:    "pending is not terminal",
-			status:  &sql.StatementStatus{State: sql.StatementStatePending},
-			wantNil: true,
-		},
-		{
-			name: "failed with backend error preserves both fields",
-			status: &sql.StatementStatus{
-				State: sql.StatementStateFailed,
-				Error: &sql.ServiceError{ErrorCode: "SYNTAX_ERROR", Message: "near 'bad'"},
-			},
+			name:     "failed with backend error preserves both fields",
+			err:      &sqlexec.StatementError{State: sql.StatementStateFailed, Code: "SYNTAX_ERROR", Message: "near 'bad'"},
 			wantMsg:  "near 'bad'",
 			wantCode: "SYNTAX_ERROR",
 		},
 		{
-			name:    "failed without backend error synthesizes message",
-			status:  &sql.StatementStatus{State: sql.StatementStateFailed},
+			name:    "failed without backend error surfaces synthesized message",
+			err:     &sqlexec.StatementError{State: sql.StatementStateFailed, Message: "statement reached terminal state FAILED"},
 			wantMsg: "statement reached terminal state FAILED",
 		},
 		{
-			name:    "canceled without backend error synthesizes message",
-			status:  &sql.StatementStatus{State: sql.StatementStateCanceled},
+			name:    "canceled without backend error surfaces synthesized message",
+			err:     &sqlexec.StatementError{State: sql.StatementStateCanceled, Message: "statement reached terminal state CANCELED"},
 			wantMsg: "statement reached terminal state CANCELED",
 		},
 		{
-			name:    "closed without backend error synthesizes message",
-			status:  &sql.StatementStatus{State: sql.StatementStateClosed},
+			name:    "closed without backend error surfaces synthesized message",
+			err:     &sqlexec.StatementError{State: sql.StatementStateClosed, Message: "statement reached terminal state CLOSED"},
 			wantMsg: "statement reached terminal state CLOSED",
 		},
 	}
 
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
-			got := statementErrorFromStatus(tc.status)
+			got := statementError(tc.err)
 			if tc.wantNil {
 				assert.Nil(t, got)
 				return
diff --git a/experimental/aitools/cmd/uninstall.go b/experimental/aitools/cmd/uninstall.go
deleted file mode 100644
index 3eda84cfbc9..00000000000
--- a/experimental/aitools/cmd/uninstall.go
+++ /dev/null
@@ -1,48 +0,0 @@
-package aitools
-
-import (
-	"github.com/databricks/cli/experimental/aitools/lib/installer"
-	"github.com/spf13/cobra"
-)
-
-func newUninstallCmd() *cobra.Command {
-	var skillsFlag string
-	var projectFlag, globalFlag bool
-
-	cmd := &cobra.Command{
-		Use:   "uninstall",
-		Short: "Uninstall AI skills",
-		Long: `Remove installed Databricks AI skills from all coding agents.
-
-By default, removes all skills. Use --skills to remove specific skills only.`,
-		Args: cobra.NoArgs,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			ctx := cmd.Context()
-
-			globalDir, err := installer.GlobalSkillsDir(ctx)
-			if err != nil {
-				return err
-			}
-			projectDir, err := installer.ProjectSkillsDir(ctx)
-			if err != nil {
-				return err
-			}
-
-			scope, err := resolveScopeForUninstall(ctx, projectFlag, globalFlag, globalDir, projectDir)
-			if err != nil {
-				return err
-			}
-
-			opts := installer.UninstallOptions{
-				Scope: scope,
-			}
-			opts.Skills = splitAndTrim(skillsFlag)
-			return installer.UninstallSkillsOpts(ctx, opts)
-		},
-	}
-
-	cmd.Flags().StringVar(&skillsFlag, "skills", "", "Specific skills to uninstall (comma-separated)")
-	cmd.Flags().BoolVar(&projectFlag, "project", false, "Uninstall project-scoped skills")
-	cmd.Flags().BoolVar(&globalFlag, "global", false, "Uninstall globally-scoped skills")
-	return cmd
-}
diff --git a/experimental/aitools/cmd/update.go b/experimental/aitools/cmd/update.go
deleted file mode 100644
index c5072d1fb19..00000000000
--- a/experimental/aitools/cmd/update.go
+++ /dev/null
@@ -1,79 +0,0 @@
-package aitools
-
-import (
-	"fmt"
-
-	"github.com/databricks/cli/experimental/aitools/lib/agents"
-	"github.com/databricks/cli/experimental/aitools/lib/installer"
-	"github.com/databricks/cli/libs/cmdio"
-	"github.com/spf13/cobra"
-)
-
-func newUpdateCmd() *cobra.Command {
-	var check, force, noNew bool
-	var skillsFlag string
-	var projectFlag, globalFlag bool
-
-	cmd := &cobra.Command{
-		Use:   "update",
-		Short: "Update installed AI skills",
-		Long: `Update installed Databricks AI skills to the latest release.
-
-By default, updates all installed skills and auto-installs new skills
-from the manifest. Use --no-new to skip new skills, or --check to
-preview what would change without downloading.`,
-		Args: cobra.NoArgs,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			ctx := cmd.Context()
-
-			globalDir, err := installer.GlobalSkillsDir(ctx)
-			if err != nil {
-				return err
-			}
-			projectDir, err := installer.ProjectSkillsDir(ctx)
-			if err != nil {
-				return err
-			}
-
-			scopes, err := resolveScopeForUpdate(ctx, projectFlag, globalFlag, globalDir, projectDir)
-			if err != nil {
-				return err
-			}
-
-			installed := agents.DetectInstalled(ctx)
-			src := &installer.GitHubManifestSource{}
-			skills := splitAndTrim(skillsFlag)
-
-			for _, scope := range scopes {
-				if len(scopes) > 1 {
-					cmdio.LogString(ctx, fmt.Sprintf("Updating %s skills...", scope))
-				}
-
-				opts := installer.UpdateOptions{
-					Check: check,
-					Force: force,
-					NoNew: noNew,
-					Scope: scope,
-				}
-				opts.Skills = skills
-
-				result, err := installer.UpdateSkills(ctx, src, installed, opts)
-				if err != nil {
-					return err
-				}
-				if result != nil && (len(result.Updated) > 0 || len(result.Added) > 0) {
-					cmdio.LogString(ctx, installer.FormatUpdateResult(result, check))
-				}
-			}
-			return nil
-		},
-	}
-
-	cmd.Flags().BoolVar(&check, "check", false, "Show what would be updated without downloading")
-	cmd.Flags().BoolVar(&force, "force", false, "Re-download even if versions match")
-	cmd.Flags().BoolVar(&noNew, "no-new", false, "Don't auto-install new skills from manifest")
-	cmd.Flags().StringVar(&skillsFlag, "skills", "", "Specific skills to update (comma-separated)")
-	cmd.Flags().BoolVar(&projectFlag, "project", false, "Update project-scoped skills")
-	cmd.Flags().BoolVar(&globalFlag, "global", false, "Update globally-scoped skills")
-	return cmd
-}
diff --git a/experimental/aitools/cmd/version.go b/experimental/aitools/cmd/version.go
deleted file mode 100644
index 67c38fec42a..00000000000
--- a/experimental/aitools/cmd/version.go
+++ /dev/null
@@ -1,94 +0,0 @@
-package aitools
-
-import (
-	"context"
-	"fmt"
-	"strings"
-
-	"github.com/databricks/cli/experimental/aitools/lib/installer"
-	"github.com/databricks/cli/libs/cmdio"
-	"github.com/spf13/cobra"
-)
-
-func newVersionCmd() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:   "version",
-		Short: "Show installed AI skills version",
-		Args:  cobra.NoArgs,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			ctx := cmd.Context()
-
-			globalDir, err := installer.GlobalSkillsDir(ctx)
-			if err != nil {
-				return err
-			}
-			globalState, err := installer.LoadState(globalDir)
-			if err != nil {
-				return fmt.Errorf("failed to load global install state: %w", err)
-			}
-
-			// Try loading project state (may fail if not in a project, that's ok).
-			var projectState *installer.InstallState
-			projectDir, projErr := installer.ProjectSkillsDir(ctx)
-			if projErr == nil {
-				projectState, err = installer.LoadState(projectDir)
-				if err != nil {
-					return fmt.Errorf("failed to load project install state: %w", err)
-				}
-			}
-
-			if globalState == nil && projectState == nil {
-				cmdio.LogString(ctx, "No Databricks AI Tools components installed.")
-				cmdio.LogString(ctx, "")
-				cmdio.LogString(ctx, "Run 'databricks experimental aitools install' to get started.")
-				return nil
-			}
-
-			latestRef := installer.GetSkillsRef(ctx)
-			bothScopes := globalState != nil && projectState != nil
-
-			cmdio.LogString(ctx, "Databricks AI Tools:")
-
-			if globalState != nil {
-				label := "Skills"
-				if bothScopes {
-					label = "Skills (global)"
-				}
-				printVersionLine(ctx, label, globalState, latestRef)
-			}
-
-			if projectState != nil {
-				label := "Skills"
-				if bothScopes {
-					label = "Skills (project)"
-				}
-				printVersionLine(ctx, label, projectState, latestRef)
-			}
-
-			return nil
-		},
-	}
-
-	return cmd
-}
-
-// printVersionLine prints a single version line for a scope.
-func printVersionLine(ctx context.Context, label string, state *installer.InstallState, latestRef string) {
-	version := strings.TrimPrefix(state.Release, "v")
-	skillNoun := "skills"
-	if len(state.Skills) == 1 {
-		skillNoun = "skill"
-	}
-
-	if latestRef == state.Release {
-		cmdio.LogString(ctx, fmt.Sprintf("  %s: v%s (%d %s, up to date)", label, version, len(state.Skills), skillNoun))
-		cmdio.LogString(ctx, "  Last updated: "+state.LastUpdated.Format("2006-01-02"))
-	} else {
-		latestVersion := strings.TrimPrefix(latestRef, "v")
-		cmdio.LogString(ctx, fmt.Sprintf("  %s: v%s (%d %s)", label, version, len(state.Skills), skillNoun))
-		cmdio.LogString(ctx, "  Update available: v"+latestVersion)
-		cmdio.LogString(ctx, "  Last updated: "+state.LastUpdated.Format("2006-01-02"))
-		cmdio.LogString(ctx, "")
-		cmdio.LogString(ctx, "Run 'databricks experimental aitools update' to update.")
-	}
-}
diff --git a/experimental/aitools/cmd/version_test.go b/experimental/aitools/cmd/version_test.go
deleted file mode 100644
index d24f7e99f81..00000000000
--- a/experimental/aitools/cmd/version_test.go
+++ /dev/null
@@ -1,104 +0,0 @@
-package aitools
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"github.com/databricks/cli/experimental/aitools/lib/installer"
-	"github.com/databricks/cli/libs/cmdio"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestVersionShowsBothScopes(t *testing.T) {
-	tmp := t.TempDir()
-	t.Setenv("HOME", tmp)
-	t.Setenv("DATABRICKS_SKILLS_REF", "v0.1.0")
-
-	// Create global state.
-	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
-	globalState := &installer.InstallState{
-		SchemaVersion: 1,
-		Release:       "v0.1.1",
-		LastUpdated:   time.Date(2026, 3, 22, 10, 0, 0, 0, time.UTC),
-		Skills: map[string]string{
-			"databricks-sql":  "0.1.0",
-			"databricks-jobs": "0.1.0",
-		},
-		Scope: installer.ScopeGlobal,
-	}
-	require.NoError(t, installer.SaveState(globalDir, globalState))
-
-	// Create project state in a temp project dir and chdir to it.
-	projectDir := filepath.Join(tmp, "myproject")
-	require.NoError(t, os.MkdirAll(projectDir, 0o755))
-	t.Chdir(projectDir)
-
-	projectSkillsDir := filepath.Join(projectDir, ".databricks", "aitools", "skills")
-	projectState := &installer.InstallState{
-		SchemaVersion: 1,
-		Release:       "v0.2.0",
-		LastUpdated:   time.Date(2026, 3, 22, 11, 0, 0, 0, time.UTC),
-		Skills: map[string]string{
-			"databricks-sql":       "0.2.0",
-			"databricks-jobs":      "0.2.0",
-			"databricks-notebooks": "0.1.0",
-		},
-		Scope: installer.ScopeProject,
-	}
-	require.NoError(t, installer.SaveState(projectSkillsDir, projectState))
-
-	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
-	cmd := newVersionCmd()
-	cmd.SetContext(ctx)
-
-	err := cmd.RunE(cmd, nil)
-	require.NoError(t, err)
-
-	output := stderr.String()
-	assert.Contains(t, output, "Skills (global)")
-	assert.Contains(t, output, "Skills (project)")
-	assert.Contains(t, output, "v0.1.1")
-	assert.Contains(t, output, "v0.2.0")
-	assert.Contains(t, output, "2 skills")
-	assert.Contains(t, output, "3 skills")
-	assert.Contains(t, output, "Last updated: 2026-03-22")
-}
-
-func TestVersionShowsSingleScopeWithoutQualifier(t *testing.T) {
-	tmp := t.TempDir()
-	t.Setenv("HOME", tmp)
-	t.Setenv("DATABRICKS_SKILLS_REF", "v0.1.0")
-
-	// Create only global state.
-	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
-	globalState := &installer.InstallState{
-		SchemaVersion: 1,
-		Release:       "v0.1.0",
-		LastUpdated:   time.Date(2026, 3, 22, 10, 0, 0, 0, time.UTC),
-		Skills: map[string]string{
-			"databricks-sql": "0.1.0",
-		},
-	}
-	require.NoError(t, installer.SaveState(globalDir, globalState))
-
-	// Chdir to a project without skills.
-	projectDir := filepath.Join(tmp, "myproject")
-	require.NoError(t, os.MkdirAll(projectDir, 0o755))
-	t.Chdir(projectDir)
-
-	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
-	cmd := newVersionCmd()
-	cmd.SetContext(ctx)
-
-	err := cmd.RunE(cmd, nil)
-	require.NoError(t, err)
-
-	output := stderr.String()
-	// Should show "Skills:" without qualifier when only one scope.
-	assert.Contains(t, output, "Skills: v0.1.0")
-	assert.NotContains(t, output, "Skills (global)")
-	assert.NotContains(t, output, "Skills (project)")
-}
diff --git a/experimental/aitools/lib/agents/agents.go b/experimental/aitools/lib/agents/agents.go
deleted file mode 100644
index 91f82f368d9..00000000000
--- a/experimental/aitools/lib/agents/agents.go
+++ /dev/null
@@ -1,121 +0,0 @@
-package agents
-
-import (
-	"context"
-	"os"
-	"path/filepath"
-
-	"github.com/databricks/cli/libs/env"
-)
-
-// Agent defines a supported coding agent.
-type Agent struct {
-	Name        string
-	DisplayName string
-	// ConfigDir returns the agent's config directory (e.g., ~/.claude).
-	// Used for detection and as base for skills directory.
-	ConfigDir func(ctx context.Context) (string, error)
-	// SkillsSubdir is the subdirectory within ConfigDir for skills (default: "skills").
-	SkillsSubdir string
-	// SupportsProjectScope indicates whether this agent supports project-scoped skills.
-	// When true, skills can be installed relative to the project root.
-	SupportsProjectScope bool
-	// ProjectConfigDir is the config directory name relative to a project root
-	// (e.g., ".claude"). Only used when SupportsProjectScope is true.
-	ProjectConfigDir string
-}
-
-// Detected returns true if the agent is installed on the system.
-func (a *Agent) Detected(ctx context.Context) bool {
-	dir, err := a.ConfigDir(ctx)
-	if err != nil {
-		return false
-	}
-	_, err = os.Stat(dir)
-	return err == nil
-}
-
-// SkillsDir returns the full path to the agent's skills directory.
-func (a *Agent) SkillsDir(ctx context.Context) (string, error) {
-	configDir, err := a.ConfigDir(ctx)
-	if err != nil {
-		return "", err
-	}
-	subdir := a.SkillsSubdir
-	if subdir == "" {
-		subdir = "skills"
-	}
-	return filepath.Join(configDir, subdir), nil
-}
-
-// homeSubdir returns a function that computes ~/subpath.
-func homeSubdir(subpath ...string) func(ctx context.Context) (string, error) {
-	return func(ctx context.Context) (string, error) {
-		home, err := env.UserHomeDir(ctx)
-		if err != nil {
-			return "", err
-		}
-		parts := append([]string{home}, subpath...)
-		return filepath.Join(parts...), nil
-	}
-}
-
-// ProjectSkillsDir returns the project-scoped skills directory for this agent.
-// Only valid for agents where SupportsProjectScope is true.
-func (a *Agent) ProjectSkillsDir(cwd string) string {
-	subdir := a.SkillsSubdir
-	if subdir == "" {
-		subdir = "skills"
-	}
-	return filepath.Join(cwd, a.ProjectConfigDir, subdir)
-}
-
-// Registry contains all supported agents.
-var Registry = []Agent{
-	{
-		Name:                 "claude-code",
-		DisplayName:          "Claude Code",
-		ConfigDir:            homeSubdir(".claude"),
-		SupportsProjectScope: true,
-		ProjectConfigDir:     ".claude",
-	},
-	{
-		Name:                 "cursor",
-		DisplayName:          "Cursor",
-		ConfigDir:            homeSubdir(".cursor"),
-		SupportsProjectScope: true,
-		ProjectConfigDir:     ".cursor",
-	},
-	{
-		Name:        "codex",
-		DisplayName: "Codex CLI",
-		ConfigDir:   homeSubdir(".codex"),
-	},
-	{
-		Name:        "opencode",
-		DisplayName: "OpenCode",
-		ConfigDir:   homeSubdir(".config", "opencode"),
-	},
-	{
-		Name:        "copilot",
-		DisplayName: "GitHub Copilot",
-		ConfigDir:   homeSubdir(".copilot"),
-	},
-	{
-		Name:         "antigravity",
-		DisplayName:  "Antigravity",
-		ConfigDir:    homeSubdir(".gemini", "antigravity"),
-		SkillsSubdir: "global_skills",
-	},
-}
-
-// DetectInstalled returns all agents that are installed on the system.
-func DetectInstalled(ctx context.Context) []*Agent {
-	var installed []*Agent
-	for i := range Registry {
-		if Registry[i].Detected(ctx) {
-			installed = append(installed, &Registry[i])
-		}
-	}
-	return installed
-}
diff --git a/experimental/aitools/lib/agents/skills.go b/experimental/aitools/lib/agents/skills.go
deleted file mode 100644
index 0ba522e3565..00000000000
--- a/experimental/aitools/lib/agents/skills.go
+++ /dev/null
@@ -1,52 +0,0 @@
-package agents
-
-import (
-	"context"
-	"os"
-	"path/filepath"
-	"strings"
-
-	"github.com/databricks/cli/libs/env"
-)
-
-const (
-	// databricksSkillPrefix is the prefix used by Databricks skills (e.g., "databricks", "databricks-apps").
-	databricksSkillPrefix = "databricks"
-
-	// CanonicalSkillsDir is the shared location for skills when multiple agents are detected.
-	CanonicalSkillsDir = ".databricks/aitools/skills"
-
-	// legacySkillsDir is the old canonical location, checked for backward compatibility.
-	legacySkillsDir = ".databricks/agent-skills"
-)
-
-// HasDatabricksSkillsInstalled checks if Databricks skills are installed in the canonical location.
-// Returns true if no agents are detected (nothing to recommend) or if skills exist in
-// ~/.databricks/aitools/skills/ or the legacy ~/.databricks/agent-skills/.
-func HasDatabricksSkillsInstalled(ctx context.Context) bool {
-	installed := DetectInstalled(ctx)
-	if len(installed) == 0 {
-		return true
-	}
-
-	homeDir, err := env.UserHomeDir(ctx)
-	if err != nil {
-		return false
-	}
-	return hasDatabricksSkillsIn(filepath.Join(homeDir, CanonicalSkillsDir)) ||
-		hasDatabricksSkillsIn(filepath.Join(homeDir, legacySkillsDir))
-}
-
-// hasDatabricksSkillsIn checks if dir contains a subdirectory starting with "databricks".
-func hasDatabricksSkillsIn(dir string) bool {
-	entries, err := os.ReadDir(dir)
-	if err != nil {
-		return false
-	}
-	for _, e := range entries {
-		if e.IsDir() && strings.HasPrefix(e.Name(), databricksSkillPrefix) {
-			return true
-		}
-	}
-	return false
-}
diff --git a/experimental/aitools/lib/installer/SKILLS_VERSION b/experimental/aitools/lib/installer/SKILLS_VERSION
deleted file mode 100644
index 027a383a35e..00000000000
--- a/experimental/aitools/lib/installer/SKILLS_VERSION
+++ /dev/null
@@ -1 +0,0 @@
-v0.1.5
diff --git a/experimental/aitools/lib/installer/installer.go b/experimental/aitools/lib/installer/installer.go
deleted file mode 100644
index 53285f6ffc9..00000000000
--- a/experimental/aitools/lib/installer/installer.go
+++ /dev/null
@@ -1,548 +0,0 @@
-package installer
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"io/fs"
-	"maps"
-	"net/http"
-	"os"
-	"path/filepath"
-	"slices"
-	"strings"
-	"time"
-
-	"github.com/databricks/cli/experimental/aitools/lib/agents"
-	"github.com/databricks/cli/internal/build"
-	"github.com/databricks/cli/libs/cmdio"
-	"github.com/databricks/cli/libs/env"
-	"github.com/databricks/cli/libs/log"
-	"golang.org/x/mod/semver"
-)
-
-const (
-	skillsRepoOwner = "databricks"
-	skillsRepoName  = "databricks-agent-skills"
-	skillsRepoPath  = "skills"
-)
-
-// fetchFileFn is the function used to download individual skill files.
-// It is a package-level var so tests can replace it with a mock.
-var fetchFileFn = fetchSkillFile
-
-// GetSkillsRef returns the skills repo ref to use. If DATABRICKS_SKILLS_REF
-// is set, it returns that value; otherwise it returns the default ref.
-func GetSkillsRef(ctx context.Context) string {
-	if ref := env.Get(ctx, "DATABRICKS_SKILLS_REF"); ref != "" {
-		return ref
-	}
-	return defaultSkillsRepoRef
-}
-
-// Manifest describes the skills manifest fetched from the skills repo.
-type Manifest struct {
-	Version   string               `json:"version"`
-	UpdatedAt string               `json:"updated_at"`
-	Skills    map[string]SkillMeta `json:"skills"`
-}
-
-// SkillMeta describes a single skill entry in the manifest.
-type SkillMeta struct {
-	Version      string   `json:"version"`
-	UpdatedAt    string   `json:"updated_at"`
-	Files        []string `json:"files"`
-	Experimental bool     `json:"experimental,omitempty"`
-	Description  string   `json:"description,omitempty"`
-	MinCLIVer    string   `json:"min_cli_version,omitempty"`
-}
-
-// InstallOptions controls the behavior of InstallSkillsForAgents.
-type InstallOptions struct {
-	IncludeExperimental bool
-	SpecificSkills      []string // empty = all skills
-	Scope               string   // ScopeGlobal or ScopeProject (default: global)
-}
-
-func fetchSkillFile(ctx context.Context, ref, skillName, filePath string) ([]byte, error) {
-	url := fmt.Sprintf("https://raw.githubusercontent.com/%s/%s/%s/%s/%s/%s",
-		skillsRepoOwner, skillsRepoName, ref, skillsRepoPath, skillName, filePath)
-
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create request: %w", err)
-	}
-
-	client := &http.Client{Timeout: 30 * time.Second}
-	resp, err := client.Do(req)
-	if err != nil {
-		return nil, fmt.Errorf("failed to fetch %s: %w", filePath, err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		return nil, fmt.Errorf("failed to fetch %s: HTTP %d", filePath, resp.StatusCode)
-	}
-
-	return io.ReadAll(resp.Body)
-}
-
-// InstallSkillsForAgents fetches the manifest and installs skills for the given agents.
-// This is the core installation function. Callers are responsible for agent detection,
-// prompting, and printing the "Installing..." header.
-func InstallSkillsForAgents(ctx context.Context, src ManifestSource, targetAgents []*agents.Agent, opts InstallOptions) error {
-	ref := GetSkillsRef(ctx)
-	manifest, err := src.FetchManifest(ctx, ref)
-	if err != nil {
-		return err
-	}
-
-	scope := opts.Scope
-	if scope == "" {
-		scope = ScopeGlobal
-	}
-
-	baseDir, err := skillsDir(ctx, scope)
-	if err != nil {
-		return err
-	}
-
-	// For project scope, filter to agents that support it and warn about the rest.
-	var cwd string
-	if scope == ScopeProject {
-		cwd, err = os.Getwd()
-		if err != nil {
-			return fmt.Errorf("failed to determine working directory: %w", err)
-		}
-		incompatible := incompatibleAgentNames(targetAgents)
-		targetAgents = filterProjectAgents(ctx, targetAgents)
-		if len(targetAgents) == 0 {
-			return fmt.Errorf("no agents support project-scoped skills. The following detected agents are global-only: %s", strings.Join(incompatible, ", "))
-		}
-	}
-
-	// Load existing state for idempotency checks.
-	state, err := LoadState(baseDir)
-	if err != nil {
-		return fmt.Errorf("failed to load install state: %w", err)
-	}
-
-	// Detect legacy installs (skills on disk but no state file). Global only.
-	// Block targeted installs on legacy setups to avoid writing incomplete state
-	// that would hide the legacy warning on future runs.
-	if state == nil && scope == ScopeGlobal {
-		isLegacy := checkLegacyInstall(ctx, baseDir)
-		if isLegacy && len(opts.SpecificSkills) > 0 {
-			return errors.New("legacy install detected without state tracking; run 'databricks experimental aitools install' (without a skill name) first to rebuild state")
-		}
-	}
-
-	// Filter skills based on options, experimental flag, and CLI version.
-	targetSkills, err := resolveSkills(ctx, manifest.Skills, opts)
-	if err != nil {
-		return err
-	}
-
-	params := installParams{
-		baseDir: baseDir,
-		scope:   scope,
-		cwd:     cwd,
-		ref:     ref,
-	}
-
-	// Install each skill in sorted order for determinism.
-	skillNames := slices.Sorted(maps.Keys(targetSkills))
-
-	for _, name := range skillNames {
-		meta := targetSkills[name]
-		// Idempotency: skip if same version is already installed, the canonical
-		// dir exists, AND every requested agent already has the skill on disk.
-		if state != nil && state.Skills[name] == meta.Version {
-			skillDir := filepath.Join(baseDir, name)
-			if _, statErr := os.Stat(skillDir); statErr == nil && allAgentsHaveSkill(ctx, name, targetAgents, scope, cwd) {
-				log.Debugf(ctx, "%s v%s already installed for all agents, skipping", name, meta.Version)
-				continue
-			}
-		}
-
-		if err := installSkillForAgents(ctx, name, meta.Files, targetAgents, params); err != nil {
-			return err
-		}
-	}
-
-	// Save state. Merge into existing state (loaded above) so skills from
-	// previous installs (e.g., experimental skills from a prior run) are preserved.
-	if state == nil {
-		state = &InstallState{
-			SchemaVersion: 1,
-			Skills:        make(map[string]string, len(targetSkills)),
-		}
-	}
-	state.Release = ref
-	state.LastUpdated = time.Now()
-	// IncludeExperimental reflects the last invocation's flag value. The Skills
-	// map may still contain experimental entries from a prior run with the flag
-	// enabled; this field does not retroactively remove them.
-	state.IncludeExperimental = opts.IncludeExperimental
-	state.Scope = scope
-	for name, meta := range targetSkills {
-		state.Skills[name] = meta.Version
-	}
-	if err := SaveState(baseDir, state); err != nil {
-		return err
-	}
-
-	tag := strings.TrimPrefix(ref, "v")
-	noun := "skills"
-	if len(targetSkills) == 1 {
-		noun = "skill"
-	}
-	cmdio.LogString(ctx, fmt.Sprintf("Installed %d %s (v%s).", len(targetSkills), noun, tag))
-	return nil
-}
-
-// skillsDir returns the base skills directory for the given scope.
-func skillsDir(ctx context.Context, scope string) (string, error) {
-	if scope == ScopeProject {
-		return ProjectSkillsDir(ctx)
-	}
-	return GlobalSkillsDir(ctx)
-}
-
-// filterProjectAgents returns only agents that support project scope and warns about skipped agents.
-func filterProjectAgents(ctx context.Context, targetAgents []*agents.Agent) []*agents.Agent {
-	var compatible []*agents.Agent
-	for _, a := range targetAgents {
-		if a.SupportsProjectScope {
-			compatible = append(compatible, a)
-		} else {
-			cmdio.LogString(ctx, "Skipped "+a.DisplayName+": does not support project-scoped skills.")
-		}
-	}
-	return compatible
-}
-
-// incompatibleAgentNames returns the display names of agents that do not support project scope.
-func incompatibleAgentNames(targetAgents []*agents.Agent) []string {
-	var names []string
-	for _, a := range targetAgents {
-		if !a.SupportsProjectScope {
-			names = append(names, a.DisplayName)
-		}
-	}
-	return names
-}
-
-// resolveSkills filters the manifest skills based on the install options,
-// experimental flag, and CLI version constraints.
-func resolveSkills(ctx context.Context, skills map[string]SkillMeta, opts InstallOptions) (map[string]SkillMeta, error) {
-	isSpecific := len(opts.SpecificSkills) > 0
-	cliVersion := build.GetInfo().Version
-	isDev := strings.HasPrefix(cliVersion, build.DefaultSemver)
-
-	// Start with all skills or only the requested ones.
-	var candidates map[string]SkillMeta
-	if isSpecific {
-		candidates = make(map[string]SkillMeta, len(opts.SpecificSkills))
-		for _, name := range opts.SpecificSkills {
-			meta, ok := skills[name]
-			if !ok {
-				return nil, fmt.Errorf("skill %q not found", name)
-			}
-			candidates[name] = meta
-		}
-	} else {
-		candidates = skills
-	}
-
-	result := make(map[string]SkillMeta, len(candidates))
-	for name, meta := range candidates {
-		if meta.Experimental && !opts.IncludeExperimental {
-			if isSpecific {
-				return nil, fmt.Errorf("skill %q is experimental; use --experimental to install", name)
-			}
-			log.Debugf(ctx, "Skipping experimental skill %s", name)
-			continue
-		}
-
-		if meta.MinCLIVer != "" && !isDev && semver.Compare("v"+cliVersion, "v"+meta.MinCLIVer) < 0 {
-			if isSpecific {
-				return nil, fmt.Errorf("skill %q requires CLI version %s (running %s)", name, meta.MinCLIVer, cliVersion)
-			}
-			log.Warnf(ctx, "Skipping %s: requires CLI version %s (running %s)", name, meta.MinCLIVer, cliVersion)
-			continue
-		}
-
-		result[name] = meta
-	}
-	return result, nil
-}
-
-// InstallAllSkills fetches the manifest and installs all skills for detected agents.
-// The signature is func(context.Context) error to satisfy the callback in cmd/apps/init.go.
-func InstallAllSkills(ctx context.Context) error {
-	installed := agents.DetectInstalled(ctx)
-	if len(installed) == 0 {
-		printNoAgentsDetected(ctx)
-		return nil
-	}
-
-	PrintInstallingFor(ctx, installed)
-	src := &GitHubManifestSource{}
-	return InstallSkillsForAgents(ctx, src, installed, InstallOptions{})
-}
-
-// PrintInstallingFor prints the "Installing..." header with agent names.
-func PrintInstallingFor(ctx context.Context, targetAgents []*agents.Agent) {
-	names := make([]string, len(targetAgents))
-	for i, a := range targetAgents {
-		names[i] = a.DisplayName
-	}
-	cmdio.LogString(ctx, fmt.Sprintf("Installing Databricks AI skills for %s...", strings.Join(names, ", ")))
-}
-
-func printNoAgentsDetected(ctx context.Context) {
-	cmdio.LogString(ctx, cmdio.Yellow(ctx, "No supported coding agents detected."))
-	cmdio.LogString(ctx, "")
-	cmdio.LogString(ctx, "Supported agents: Claude Code, Cursor, Codex CLI, OpenCode, GitHub Copilot, Antigravity")
-	cmdio.LogString(ctx, "Please install at least one coding agent first.")
-}
-
-// checkLegacyInstall prints a message if skills exist on disk but no state file was found.
-// Returns true if a legacy install was detected.
-func checkLegacyInstall(ctx context.Context, globalDir string) bool {
-	if hasSkillsOnDisk(globalDir) {
-		cmdio.LogString(ctx, "Found skills installed before state tracking was added. Run 'databricks experimental aitools install' to refresh.")
-		return true
-	}
-	homeDir, err := env.UserHomeDir(ctx)
-	if err != nil {
-		return false
-	}
-	legacyDir := filepath.Join(homeDir, ".databricks", "agent-skills")
-	if hasSkillsOnDisk(legacyDir) {
-		cmdio.LogString(ctx, "Found skills installed before state tracking was added. Run 'databricks experimental aitools install' to refresh.")
-		return true
-	}
-	return false
-}
-
-// hasSkillsOnDisk checks if a directory contains subdirectories starting with "databricks".
-func hasSkillsOnDisk(dir string) bool {
-	entries, err := os.ReadDir(dir)
-	if err != nil {
-		return false
-	}
-	for _, e := range entries {
-		if e.IsDir() && strings.HasPrefix(e.Name(), "databricks") {
-			return true
-		}
-	}
-	return false
-}
-
-// allAgentsHaveSkill returns true if every agent in the list has the named
-// skill directory present (either as a real directory or symlink).
-func allAgentsHaveSkill(ctx context.Context, skillName string, targetAgents []*agents.Agent, scope, cwd string) bool {
-	for _, agent := range targetAgents {
-		agentSkillDir, err := agentSkillsDirForScope(ctx, agent, scope, cwd)
-		if err != nil {
-			return false
-		}
-		if _, err := os.Stat(filepath.Join(agentSkillDir, skillName)); err != nil {
-			return false
-		}
-	}
-	return true
-}
-
-// installParams bundles the parameters for installSkillForAgents to keep the signature manageable.
-type installParams struct {
-	baseDir string
-	scope   string
-	cwd     string
-	ref     string
-}
-
-func installSkillForAgents(ctx context.Context, skillName string, files []string, detectedAgents []*agents.Agent, params installParams) error {
-	canonicalDir := filepath.Join(params.baseDir, skillName)
-	if err := installSkillToDir(ctx, params.ref, skillName, canonicalDir, files); err != nil {
-		return err
-	}
-
-	// For project scope, always symlink. For global, symlink when multiple agents.
-	useSymlinks := params.scope == ScopeProject || len(detectedAgents) > 1
-
-	for _, agent := range detectedAgents {
-		agentSkillDir, err := agentSkillsDirForScope(ctx, agent, params.scope, params.cwd)
-		if err != nil {
-			log.Warnf(ctx, "Skipped %s: %v", agent.DisplayName, err)
-			continue
-		}
-
-		destDir := filepath.Join(agentSkillDir, skillName)
-
-		if err := backupThirdPartySkill(ctx, destDir, canonicalDir, skillName, agent.DisplayName); err != nil {
-			log.Warnf(ctx, "Failed to back up existing skill for %s: %v", agent.DisplayName, err)
-			continue
-		}
-
-		if useSymlinks {
-			symlinkTarget := canonicalDir
-			// For project scope, use relative symlinks so they work for teammates.
-			if params.scope == ScopeProject {
-				rel, relErr := filepath.Rel(filepath.Dir(destDir), canonicalDir)
-				if relErr == nil {
-					symlinkTarget = rel
-				}
-			}
-			if err := createSymlink(symlinkTarget, destDir); err != nil {
-				log.Debugf(ctx, "Symlink failed for %s, copying instead: %v", agent.DisplayName, err)
-				if err := copyDir(canonicalDir, destDir); err != nil {
-					log.Warnf(ctx, "Failed to install for %s: %v", agent.DisplayName, err)
-					continue
-				}
-			}
-			log.Debugf(ctx, "Installed %q for %s (symlinked)", skillName, agent.DisplayName)
-		} else {
-			// Copy from canonical dir instead of re-downloading.
-			if err := copyDir(canonicalDir, destDir); err != nil {
-				log.Warnf(ctx, "Failed to install for %s: %v", agent.DisplayName, err)
-				continue
-			}
-			log.Debugf(ctx, "Installed %q for %s", skillName, agent.DisplayName)
-		}
-	}
-
-	return nil
-}
-
-// agentSkillsDirForScope returns the agent's skills directory for the given scope.
-func agentSkillsDirForScope(ctx context.Context, agent *agents.Agent, scope, cwd string) (string, error) {
-	if scope == ScopeProject {
-		return agent.ProjectSkillsDir(cwd), nil
-	}
-	return agent.SkillsDir(ctx)
-}
-
-// backupThirdPartySkill moves destDir to a temp directory if it exists and is not
-// a symlink pointing to canonicalDir. This preserves skills installed by other tools.
-func backupThirdPartySkill(ctx context.Context, destDir, canonicalDir, skillName, agentName string) error {
-	fi, err := os.Lstat(destDir)
-	if errors.Is(err, fs.ErrNotExist) {
-		return nil
-	}
-	if err != nil {
-		return err
-	}
-
-	// If it's a symlink to our canonical dir, no backup needed.
-	if fi.Mode()&os.ModeSymlink != 0 {
-		target, err := os.Readlink(destDir)
-		if err == nil {
-			absTarget := target
-			if !filepath.IsAbs(target) {
-				absTarget = filepath.Clean(filepath.Join(filepath.Dir(destDir), target))
-			}
-			if absTarget == canonicalDir {
-				return nil
-			}
-		}
-	}
-
-	backupDir, err := os.MkdirTemp("", fmt.Sprintf("databricks-skill-backup-%s-*", skillName))
-	if err != nil {
-		return fmt.Errorf("failed to create backup directory: %w", err)
-	}
-
-	backupDest := filepath.Join(backupDir, skillName)
-	if err := os.Rename(destDir, backupDest); err != nil {
-		return fmt.Errorf("failed to move existing skill: %w", err)
-	}
-
-	log.Debugf(ctx, "Existing %q for %s moved to %s", skillName, agentName, backupDest)
-	return nil
-}
-
-func installSkillToDir(ctx context.Context, ref, skillName, destDir string, files []string) error {
-	// remove existing skill directory for clean install
-	if err := os.RemoveAll(destDir); err != nil {
-		return fmt.Errorf("failed to remove existing skill: %w", err)
-	}
-
-	if err := os.MkdirAll(destDir, 0o755); err != nil {
-		return fmt.Errorf("failed to create directory: %w", err)
-	}
-
-	for _, file := range files {
-		content, err := fetchFileFn(ctx, ref, skillName, file)
-		if err != nil {
-			return err
-		}
-
-		destPath := filepath.Join(destDir, file)
-
-		if err := os.MkdirAll(filepath.Dir(destPath), 0o755); err != nil {
-			return fmt.Errorf("failed to create directory: %w", err)
-		}
-
-		log.Debugf(ctx, "Downloading %s/%s", skillName, file)
-		if err := os.WriteFile(destPath, content, 0o644); err != nil {
-			return fmt.Errorf("failed to write %s: %w", file, err)
-		}
-	}
-
-	return nil
-}
-
-// copyDir copies all files from src to dest, recreating the directory structure.
-func copyDir(src, dest string) error {
-	if err := os.RemoveAll(dest); err != nil {
-		return fmt.Errorf("failed to remove existing path: %w", err)
-	}
-
-	return filepath.Walk(src, func(path string, info os.FileInfo, err error) error {
-		if err != nil {
-			return err
-		}
-
-		rel, err := filepath.Rel(src, path)
-		if err != nil {
-			return err
-		}
-		target := filepath.Join(dest, rel)
-
-		if info.IsDir() {
-			return os.MkdirAll(target, 0o755)
-		}
-
-		data, err := os.ReadFile(path)
-		if err != nil {
-			return fmt.Errorf("failed to read %s: %w", rel, err)
-		}
-		if err := os.MkdirAll(filepath.Dir(target), 0o755); err != nil {
-			return err
-		}
-		return os.WriteFile(target, data, 0o644)
-	})
-}
-
-func createSymlink(source, dest string) error {
-	// ensure parent directory exists
-	if err := os.MkdirAll(filepath.Dir(dest), 0o755); err != nil {
-		return fmt.Errorf("failed to create parent directory: %w", err)
-	}
-
-	// remove existing symlink or directory
-	if err := os.RemoveAll(dest); err != nil {
-		return fmt.Errorf("failed to remove existing path: %w", err)
-	}
-
-	// create symlink
-	if err := os.Symlink(source, dest); err != nil {
-		return fmt.Errorf("failed to create symlink: %w", err)
-	}
-
-	return nil
-}
diff --git a/experimental/aitools/lib/installer/installer_test.go b/experimental/aitools/lib/installer/installer_test.go
deleted file mode 100644
index b769143906d..00000000000
--- a/experimental/aitools/lib/installer/installer_test.go
+++ /dev/null
@@ -1,727 +0,0 @@
-package installer
-
-import (
-	"bytes"
-	"context"
-	"fmt"
-	"io/fs"
-	"log/slog"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/databricks/cli/experimental/aitools/lib/agents"
-	"github.com/databricks/cli/internal/build"
-	"github.com/databricks/cli/libs/cmdio"
-	"github.com/databricks/cli/libs/log"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// mockManifestSource is a test double for ManifestSource.
-type mockManifestSource struct {
-	manifest *Manifest
-	fetchErr error
-}
-
-func (m *mockManifestSource) FetchManifest(_ context.Context, _ string) (*Manifest, error) {
-	if m.fetchErr != nil {
-		return nil, m.fetchErr
-	}
-	return m.manifest, nil
-}
-
-func testManifest() *Manifest {
-	return &Manifest{
-		Version:   "1",
-		UpdatedAt: "2024-01-01",
-		Skills: map[string]SkillMeta{
-			"databricks-sql": {
-				Version: "0.1.0",
-				Files:   []string{"SKILL.md"},
-			},
-			"databricks-jobs": {
-				Version: "0.1.0",
-				Files:   []string{"SKILL.md"},
-			},
-		},
-	}
-}
-
-func setupFetchMock(t *testing.T) {
-	t.Helper()
-	orig := fetchFileFn
-	t.Cleanup(func() { fetchFileFn = orig })
-	fetchFileFn = func(_ context.Context, _, skillName, filePath string) ([]byte, error) {
-		return []byte("# " + skillName + "/" + filePath), nil
-	}
-}
-
-func testAgent(tmpHome string) *agents.Agent {
-	return &agents.Agent{
-		Name:        "test-agent",
-		DisplayName: "Test Agent",
-		ConfigDir: func(_ context.Context) (string, error) {
-			return filepath.Join(tmpHome, ".test-agent"), nil
-		},
-	}
-}
-
-func setupTestHome(t *testing.T) string {
-	t.Helper()
-	tmp := t.TempDir()
-	t.Setenv("HOME", tmp)
-	// Create agent config dir so the agent is "detected".
-	require.NoError(t, os.MkdirAll(filepath.Join(tmp, ".test-agent"), 0o755))
-	return tmp
-}
-
-func setBuildVersion(t *testing.T, version string) {
-	t.Helper()
-	orig := build.GetInfo().Version
-	build.SetBuildVersion(version)
-	t.Cleanup(func() { build.SetBuildVersion(orig) })
-}
-
-// --- Backup tests (unchanged from PR 1) ---
-
-func TestBackupThirdPartySkillDestDoesNotExist(t *testing.T) {
-	ctx := cmdio.MockDiscard(t.Context())
-	destDir := filepath.Join(t.TempDir(), "nonexistent")
-
-	err := backupThirdPartySkill(ctx, destDir, "/canonical", "databricks", "Test Agent")
-	assert.NoError(t, err)
-}
-
-func TestBackupThirdPartySkillSymlinkToCanonical(t *testing.T) {
-	ctx := cmdio.MockDiscard(t.Context())
-	tmp := t.TempDir()
-
-	canonicalDir := filepath.Join(tmp, "canonical", "databricks")
-	require.NoError(t, os.MkdirAll(canonicalDir, 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(canonicalDir, "skill.md"), []byte("ok"), 0o644))
-
-	destDir := filepath.Join(tmp, "agent", "skills", "databricks")
-	require.NoError(t, os.MkdirAll(filepath.Dir(destDir), 0o755))
-	require.NoError(t, os.Symlink(canonicalDir, destDir))
-
-	err := backupThirdPartySkill(ctx, destDir, canonicalDir, "databricks", "Test Agent")
-	assert.NoError(t, err)
-
-	// Symlink should still be in place.
-	target, err := os.Readlink(destDir)
-	require.NoError(t, err)
-	assert.Equal(t, canonicalDir, target)
-}
-
-func TestBackupThirdPartySkillRegularDir(t *testing.T) {
-	ctx := cmdio.MockDiscard(t.Context())
-	tmp := t.TempDir()
-
-	destDir := filepath.Join(tmp, "agent", "skills", "databricks")
-	require.NoError(t, os.MkdirAll(destDir, 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(destDir, "custom.md"), []byte("custom"), 0o644))
-
-	err := backupThirdPartySkill(ctx, destDir, "/some/canonical", "databricks", "Test Agent")
-	require.NoError(t, err)
-
-	// destDir should no longer exist.
-	_, err = os.Stat(destDir)
-	assert.ErrorIs(t, err, fs.ErrNotExist)
-
-	// Backup should contain the original file.
-	matches, err := filepath.Glob(filepath.Join(os.TempDir(), "databricks-skill-backup-databricks-*", "databricks", "custom.md"))
-	require.NoError(t, err)
-	require.NotEmpty(t, matches)
-
-	content, err := os.ReadFile(matches[0])
-	require.NoError(t, err)
-	assert.Equal(t, "custom", string(content))
-
-	// Clean up backup.
-	require.NoError(t, os.RemoveAll(filepath.Dir(filepath.Dir(matches[0]))))
-}
-
-func TestBackupThirdPartySkillSymlinkToOtherTarget(t *testing.T) {
-	ctx := cmdio.MockDiscard(t.Context())
-	tmp := t.TempDir()
-
-	otherDir := filepath.Join(tmp, "other", "databricks")
-	require.NoError(t, os.MkdirAll(otherDir, 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(otherDir, "other.md"), []byte("other"), 0o644))
-
-	destDir := filepath.Join(tmp, "agent", "skills", "databricks")
-	require.NoError(t, os.MkdirAll(filepath.Dir(destDir), 0o755))
-	require.NoError(t, os.Symlink(otherDir, destDir))
-
-	canonicalDir := filepath.Join(tmp, "canonical", "databricks")
-
-	err := backupThirdPartySkill(ctx, destDir, canonicalDir, "databricks", "Test Agent")
-	require.NoError(t, err)
-
-	// destDir (the symlink) should no longer exist.
-	_, err = os.Lstat(destDir)
-	assert.ErrorIs(t, err, fs.ErrNotExist)
-
-	// Original target should be untouched.
-	content, err := os.ReadFile(filepath.Join(otherDir, "other.md"))
-	require.NoError(t, err)
-	assert.Equal(t, "other", string(content))
-}
-
-func TestBackupThirdPartySkillRegularFile(t *testing.T) {
-	ctx := cmdio.MockDiscard(t.Context())
-	tmp := t.TempDir()
-
-	// Edge case: destDir is a file, not a directory.
-	destDir := filepath.Join(tmp, "agent", "skills", "databricks")
-	require.NoError(t, os.MkdirAll(filepath.Dir(destDir), 0o755))
-	require.NoError(t, os.WriteFile(destDir, []byte("file"), 0o644))
-
-	err := backupThirdPartySkill(ctx, destDir, "/some/canonical", "databricks", "Test Agent")
-	require.NoError(t, err)
-
-	_, err = os.Stat(destDir)
-	assert.ErrorIs(t, err, fs.ErrNotExist)
-}
-
-// --- InstallSkillsForAgents tests ---
-
-func TestInstallSkillsForAgentsWritesState(t *testing.T) {
-	tmp := setupTestHome(t)
-	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
-	setupFetchMock(t)
-
-	src := &mockManifestSource{manifest: testManifest()}
-	agent := testAgent(tmp)
-
-	err := InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{})
-	require.NoError(t, err)
-
-	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
-	state, err := LoadState(globalDir)
-	require.NoError(t, err)
-	require.NotNil(t, state)
-	assert.Equal(t, 1, state.SchemaVersion)
-	assert.Equal(t, defaultSkillsRepoRef, state.Release)
-	assert.Len(t, state.Skills, 2)
-	assert.Equal(t, "0.1.0", state.Skills["databricks-sql"])
-	assert.Equal(t, "0.1.0", state.Skills["databricks-jobs"])
-
-	assert.Contains(t, stderr.String(), fmt.Sprintf("Installed 2 skills (%s).", defaultSkillsRepoRef))
-}
-
-func TestInstallSkillForSingleWritesState(t *testing.T) {
-	tmp := setupTestHome(t)
-	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
-	setupFetchMock(t)
-
-	src := &mockManifestSource{manifest: testManifest()}
-	agent := testAgent(tmp)
-
-	err := InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{
-		SpecificSkills: []string{"databricks-sql"},
-	})
-	require.NoError(t, err)
-
-	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
-	state, err := LoadState(globalDir)
-	require.NoError(t, err)
-	require.NotNil(t, state)
-	assert.Len(t, state.Skills, 1)
-	assert.Equal(t, "0.1.0", state.Skills["databricks-sql"])
-
-	assert.Contains(t, stderr.String(), fmt.Sprintf("Installed 1 skill (%s).", defaultSkillsRepoRef))
-}
-
-func TestInstallSkillsSpecificNotFound(t *testing.T) {
-	tmp := setupTestHome(t)
-	ctx := cmdio.MockDiscard(t.Context())
-	setupFetchMock(t)
-
-	src := &mockManifestSource{manifest: testManifest()}
-	agent := testAgent(tmp)
-
-	err := InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{
-		SpecificSkills: []string{"nonexistent"},
-	})
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), `skill "nonexistent" not found`)
-}
-
-func TestExperimentalSkillsSkippedByDefault(t *testing.T) {
-	tmp := setupTestHome(t)
-	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
-	setupFetchMock(t)
-
-	manifest := testManifest()
-	manifest.Skills["databricks-experimental"] = SkillMeta{
-		Version:      "0.1.0",
-		Files:        []string{"SKILL.md"},
-		Experimental: true,
-	}
-
-	src := &mockManifestSource{manifest: manifest}
-	agent := testAgent(tmp)
-
-	err := InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{})
-	require.NoError(t, err)
-
-	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
-	state, err := LoadState(globalDir)
-	require.NoError(t, err)
-	// Only non-experimental skills should be installed.
-	assert.Len(t, state.Skills, 2)
-	assert.NotContains(t, state.Skills, "databricks-experimental")
-
-	assert.Contains(t, stderr.String(), fmt.Sprintf("Installed 2 skills (%s).", defaultSkillsRepoRef))
-}
-
-func TestExperimentalSkillsIncludedWithFlag(t *testing.T) {
-	tmp := setupTestHome(t)
-	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
-	setupFetchMock(t)
-
-	manifest := testManifest()
-	manifest.Skills["databricks-experimental"] = SkillMeta{
-		Version:      "0.1.0",
-		Files:        []string{"SKILL.md"},
-		Experimental: true,
-	}
-
-	src := &mockManifestSource{manifest: manifest}
-	agent := testAgent(tmp)
-
-	err := InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{
-		IncludeExperimental: true,
-	})
-	require.NoError(t, err)
-
-	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
-	state, err := LoadState(globalDir)
-	require.NoError(t, err)
-	assert.Len(t, state.Skills, 3)
-	assert.Contains(t, state.Skills, "databricks-experimental")
-	assert.True(t, state.IncludeExperimental)
-
-	assert.Contains(t, stderr.String(), fmt.Sprintf("Installed 3 skills (%s).", defaultSkillsRepoRef))
-}
-
-func TestMinCLIVersionSkipWithWarningForInstallAll(t *testing.T) {
-	tmp := setupTestHome(t)
-	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
-	setupFetchMock(t)
-	setBuildVersion(t, "0.200.0")
-
-	// Capture log output to verify the warning.
-	var logBuf bytes.Buffer
-	logger := slog.New(slog.NewTextHandler(&logBuf, &slog.HandlerOptions{Level: slog.LevelWarn}))
-	ctx = log.NewContext(ctx, logger)
-
-	manifest := testManifest()
-	manifest.Skills["databricks-future"] = SkillMeta{
-		Version:   "0.1.0",
-		Files:     []string{"SKILL.md"},
-		MinCLIVer: "0.300.0",
-	}
-
-	src := &mockManifestSource{manifest: manifest}
-	agent := testAgent(tmp)
-
-	err := InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{})
-	require.NoError(t, err)
-
-	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
-	state, err := LoadState(globalDir)
-	require.NoError(t, err)
-	// The high-version skill should be skipped.
-	assert.Len(t, state.Skills, 2)
-	assert.NotContains(t, state.Skills, "databricks-future")
-
-	assert.Contains(t, stderr.String(), fmt.Sprintf("Installed 2 skills (%s).", defaultSkillsRepoRef))
-	assert.Contains(t, logBuf.String(), "requires CLI version 0.300.0")
-}
-
-func TestMinCLIVersionHardErrorForInstallSingle(t *testing.T) {
-	tmp := setupTestHome(t)
-	ctx := cmdio.MockDiscard(t.Context())
-	setupFetchMock(t)
-	setBuildVersion(t, "0.200.0")
-
-	manifest := testManifest()
-	manifest.Skills["databricks-future"] = SkillMeta{
-		Version:   "0.1.0",
-		Files:     []string{"SKILL.md"},
-		MinCLIVer: "0.300.0",
-	}
-
-	src := &mockManifestSource{manifest: manifest}
-	agent := testAgent(tmp)
-
-	err := InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{
-		SpecificSkills: []string{"databricks-future"},
-	})
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "requires CLI version 0.300.0")
-	assert.Contains(t, err.Error(), "running 0.200.0")
-}
-
-func TestIdempotentSecondInstallSkips(t *testing.T) {
-	tmp := setupTestHome(t)
-	ctx := cmdio.MockDiscard(t.Context())
-	setupFetchMock(t)
-
-	src := &mockManifestSource{manifest: testManifest()}
-	agent := testAgent(tmp)
-
-	// First install.
-	err := InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{})
-	require.NoError(t, err)
-
-	// Track fetch calls on second install.
-	fetchCalls := 0
-	orig := fetchFileFn
-	t.Cleanup(func() { fetchFileFn = orig })
-	fetchFileFn = func(_ context.Context, _, skillName, filePath string) ([]byte, error) {
-		fetchCalls++
-		return []byte("# " + skillName + "/" + filePath), nil
-	}
-
-	// Second install with same version.
-	err = InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{})
-	require.NoError(t, err)
-
-	// No files should be fetched since everything is up to date.
-	assert.Equal(t, 0, fetchCalls)
-}
-
-func TestIdempotentInstallUpdatesNewVersions(t *testing.T) {
-	tmp := setupTestHome(t)
-	ctx := cmdio.MockDiscard(t.Context())
-	setupFetchMock(t)
-
-	src := &mockManifestSource{manifest: testManifest()}
-	agent := testAgent(tmp)
-
-	// First install.
-	err := InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{})
-	require.NoError(t, err)
-
-	// Update manifest with a new version for one skill.
-	updatedManifest := testManifest()
-	updatedManifest.Skills["databricks-sql"] = SkillMeta{
-		Version: "0.2.0",
-		Files:   []string{"SKILL.md"},
-	}
-	src2 := &mockManifestSource{manifest: updatedManifest}
-
-	// Track which skills are fetched.
-	var fetchedSkills []string
-	orig := fetchFileFn
-	t.Cleanup(func() { fetchFileFn = orig })
-	fetchFileFn = func(_ context.Context, _, skillName, filePath string) ([]byte, error) {
-		fetchedSkills = append(fetchedSkills, skillName)
-		return []byte("# " + skillName + "/" + filePath), nil
-	}
-
-	// Second install with updated manifest.
-	err = InstallSkillsForAgents(ctx, src2, []*agents.Agent{agent}, InstallOptions{})
-	require.NoError(t, err)
-
-	// Only databricks-sql should be re-fetched (version changed from 0.1.0 to 0.2.0).
-	// databricks-jobs keeps version 0.1.0 and should be skipped by the idempotency check.
-	assert.Contains(t, fetchedSkills, "databricks-sql")
-	assert.NotContains(t, fetchedSkills, "databricks-jobs")
-
-	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
-	state, err := LoadState(globalDir)
-	require.NoError(t, err)
-	assert.Equal(t, defaultSkillsRepoRef, state.Release)
-	assert.Equal(t, "0.2.0", state.Skills["databricks-sql"])
-}
-
-func TestLegacyDetectMessagePrinted(t *testing.T) {
-	tmp := setupTestHome(t)
-	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
-	setupFetchMock(t)
-
-	// Create skills on disk at canonical location but no state file.
-	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
-	require.NoError(t, os.MkdirAll(filepath.Join(globalDir, "databricks-sql"), 0o755))
-
-	src := &mockManifestSource{manifest: testManifest()}
-	agent := testAgent(tmp)
-
-	err := InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{})
-	require.NoError(t, err)
-
-	assert.Contains(t, stderr.String(), "Found skills installed before state tracking was added.")
-}
-
-func TestLegacyDetectLegacyDir(t *testing.T) {
-	tmp := setupTestHome(t)
-	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
-	setupFetchMock(t)
-
-	// Create skills in the legacy location.
-	legacyDir := filepath.Join(tmp, ".databricks", "agent-skills")
-	require.NoError(t, os.MkdirAll(filepath.Join(legacyDir, "databricks-sql"), 0o755))
-
-	src := &mockManifestSource{manifest: testManifest()}
-	agent := testAgent(tmp)
-
-	err := InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{})
-	require.NoError(t, err)
-
-	assert.Contains(t, stderr.String(), "Found skills installed before state tracking was added.")
-}
-
-func TestIdempotentInstallReinstallsForNewAgent(t *testing.T) {
-	tmp := setupTestHome(t)
-	ctx := cmdio.MockDiscard(t.Context())
-	setupFetchMock(t)
-
-	src := &mockManifestSource{manifest: testManifest()}
-	agent1 := testAgent(tmp)
-
-	// First install for agent1.
-	err := InstallSkillsForAgents(ctx, src, []*agents.Agent{agent1}, InstallOptions{})
-	require.NoError(t, err)
-
-	// Create a second agent.
-	agent2Dir := filepath.Join(tmp, ".second-agent")
-	require.NoError(t, os.MkdirAll(agent2Dir, 0o755))
-	agent2 := &agents.Agent{
-		Name:        "second-agent",
-		DisplayName: "Second Agent",
-		ConfigDir: func(_ context.Context) (string, error) {
-			return agent2Dir, nil
-		},
-	}
-
-	// Track fetch calls for second install (with both agents).
-	fetchCalls := 0
-	orig := fetchFileFn
-	t.Cleanup(func() { fetchFileFn = orig })
-	fetchFileFn = func(_ context.Context, _, skillName, filePath string) ([]byte, error) {
-		fetchCalls++
-		return []byte("# " + skillName + "/" + filePath), nil
-	}
-
-	// Second install with both agents, same version.
-	err = InstallSkillsForAgents(ctx, src, []*agents.Agent{agent1, agent2}, InstallOptions{})
-	require.NoError(t, err)
-
-	// Skills should be re-fetched because agent2 doesn't have them yet.
-	assert.Positive(t, fetchCalls, "should re-install skills for new agent")
-
-	// Verify agent2 got the skills.
-	agent2SkillsDir := filepath.Join(agent2Dir, "skills")
-	_, err = os.Stat(filepath.Join(agent2SkillsDir, "databricks-sql"))
-	assert.NoError(t, err, "agent2 should have databricks-sql")
-}
-
-func TestLegacyTargetedInstallBlocked(t *testing.T) {
-	tmp := setupTestHome(t)
-	ctx := cmdio.MockDiscard(t.Context())
-	setupFetchMock(t)
-
-	// Create skills on disk at canonical location but no state file (legacy).
-	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
-	require.NoError(t, os.MkdirAll(filepath.Join(globalDir, "databricks-sql"), 0o755))
-
-	src := &mockManifestSource{manifest: testManifest()}
-	agent := testAgent(tmp)
-
-	// Targeted install should fail on legacy setup.
-	err := InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{
-		SpecificSkills: []string{"databricks-sql"},
-	})
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "legacy install detected")
-}
-
-func TestLegacyFullInstallAllowed(t *testing.T) {
-	tmp := setupTestHome(t)
-	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
-	setupFetchMock(t)
-
-	// Create skills on disk at canonical location but no state file (legacy).
-	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
-	require.NoError(t, os.MkdirAll(filepath.Join(globalDir, "databricks-sql"), 0o755))
-
-	src := &mockManifestSource{manifest: testManifest()}
-	agent := testAgent(tmp)
-
-	// Full install (no SpecificSkills) should succeed and rebuild state.
-	err := InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{})
-	require.NoError(t, err)
-
-	assert.Contains(t, stderr.String(), "Found skills installed before state tracking was added.")
-
-	state, err := LoadState(globalDir)
-	require.NoError(t, err)
-	require.NotNil(t, state)
-	assert.Len(t, state.Skills, 2)
-}
-
-func TestInstallAllSkillsSignaturePreserved(t *testing.T) {
-	// Compile-time check that InstallAllSkills satisfies func(context.Context) error.
-	callback := func(fn func(context.Context) error) { _ = fn }
-	callback(InstallAllSkills)
-}
-
-// --- Project scope tests ---
-
-func testProjectAgent(tmpHome string) *agents.Agent {
-	return &agents.Agent{
-		Name:                 "test-project-agent",
-		DisplayName:          "Test Project Agent",
-		SupportsProjectScope: true,
-		ProjectConfigDir:     ".test-project-agent",
-		ConfigDir: func(_ context.Context) (string, error) {
-			return filepath.Join(tmpHome, ".test-project-agent"), nil
-		},
-	}
-}
-
-func TestInstallProjectScopeWritesState(t *testing.T) {
-	tmp := setupTestHome(t)
-	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
-	setupFetchMock(t)
-
-	// Use project dir as cwd.
-	projectDir := filepath.Join(tmp, "myproject")
-	require.NoError(t, os.MkdirAll(projectDir, 0o755))
-	t.Chdir(projectDir)
-
-	src := &mockManifestSource{manifest: testManifest()}
-	agent := testProjectAgent(tmp)
-
-	err := InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{Scope: ScopeProject})
-	require.NoError(t, err)
-
-	projectSkillsDir := filepath.Join(projectDir, ".databricks", "aitools", "skills")
-	state, err := LoadState(projectSkillsDir)
-	require.NoError(t, err)
-	require.NotNil(t, state)
-	assert.Equal(t, ScopeProject, state.Scope)
-	assert.Equal(t, defaultSkillsRepoRef, state.Release)
-	assert.Len(t, state.Skills, 2)
-
-	tag := strings.TrimPrefix(defaultSkillsRepoRef, "v")
-	assert.Contains(t, stderr.String(), fmt.Sprintf("Installed 2 skills (v%s).", tag))
-}
-
-func TestInstallProjectScopeCreatesSymlinks(t *testing.T) {
-	tmp := setupTestHome(t)
-	ctx := cmdio.MockDiscard(t.Context())
-	setupFetchMock(t)
-
-	projectDir := filepath.Join(tmp, "myproject")
-	require.NoError(t, os.MkdirAll(projectDir, 0o755))
-	t.Chdir(projectDir)
-
-	// Use os.Getwd() to match the path the installer sees (macOS may resolve symlinks).
-	cwd, err := os.Getwd()
-	require.NoError(t, err)
-
-	src := &mockManifestSource{manifest: testManifest()}
-	agent := testProjectAgent(tmp)
-
-	err = InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{Scope: ScopeProject})
-	require.NoError(t, err)
-
-	// Check that agent's project skills dir has relative symlinks.
-	agentSkillDir := filepath.Join(projectDir, ".test-project-agent", "skills")
-	for _, skill := range []string{"databricks-sql", "databricks-jobs"} {
-		link := filepath.Join(agentSkillDir, skill)
-		fi, err := os.Lstat(link)
-		require.NoError(t, err, "symlink should exist for %s", skill)
-		assert.NotEqual(t, os.FileMode(0), fi.Mode()&os.ModeSymlink, "should be a symlink for %s", skill)
-
-		target, err := os.Readlink(link)
-		require.NoError(t, err)
-		// Project scope should use relative symlinks for portability.
-		expectedRel := filepath.Join("..", "..", ".databricks", "aitools", "skills", skill)
-		assert.Equal(t, expectedRel, target)
-
-		// Verify the symlink resolves to a valid directory with the expected content.
-		resolved, err := filepath.EvalSymlinks(link)
-		require.NoError(t, err)
-		expectedResolved, err := filepath.EvalSymlinks(filepath.Join(cwd, ".databricks", "aitools", "skills", skill))
-		require.NoError(t, err)
-		assert.Equal(t, expectedResolved, resolved)
-	}
-}
-
-func TestInstallProjectScopeFiltersIncompatibleAgents(t *testing.T) {
-	tmp := setupTestHome(t)
-	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
-	setupFetchMock(t)
-
-	projectDir := filepath.Join(tmp, "myproject")
-	require.NoError(t, os.MkdirAll(projectDir, 0o755))
-	t.Chdir(projectDir)
-
-	src := &mockManifestSource{manifest: testManifest()}
-
-	compatibleAgent := testProjectAgent(tmp)
-	incompatibleAgent := &agents.Agent{
-		Name:        "no-project-agent",
-		DisplayName: "No Project Agent",
-		ConfigDir: func(_ context.Context) (string, error) {
-			return filepath.Join(tmp, ".no-project-agent"), nil
-		},
-	}
-
-	err := InstallSkillsForAgents(ctx, src, []*agents.Agent{compatibleAgent, incompatibleAgent}, InstallOptions{Scope: ScopeProject})
-	require.NoError(t, err)
-
-	assert.Contains(t, stderr.String(), "Skipped No Project Agent: does not support project-scoped skills.")
-	assert.Contains(t, stderr.String(), fmt.Sprintf("Installed 2 skills (%s).", defaultSkillsRepoRef))
-}
-
-func TestInstallProjectScopeZeroCompatibleAgentsReturnsError(t *testing.T) {
-	tmp := setupTestHome(t)
-	ctx := cmdio.MockDiscard(t.Context())
-	setupFetchMock(t)
-
-	projectDir := filepath.Join(tmp, "myproject")
-	require.NoError(t, os.MkdirAll(projectDir, 0o755))
-	t.Chdir(projectDir)
-
-	src := &mockManifestSource{manifest: testManifest()}
-
-	// Only provide agents that don't support project scope.
-	globalOnlyAgent := &agents.Agent{
-		Name:        "no-project-agent",
-		DisplayName: "No Project Agent",
-		ConfigDir: func(_ context.Context) (string, error) {
-			return filepath.Join(tmp, ".no-project-agent"), nil
-		},
-	}
-
-	err := InstallSkillsForAgents(ctx, src, []*agents.Agent{globalOnlyAgent}, InstallOptions{Scope: ScopeProject})
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "no agents support project-scoped skills")
-	assert.Contains(t, err.Error(), "No Project Agent")
-}
-
-func TestSupportsProjectScopeSetCorrectly(t *testing.T) {
-	expected := map[string]bool{
-		"claude-code": true,
-		"cursor":      true,
-		"codex":       false,
-		"opencode":    false,
-		"copilot":     false,
-		"antigravity": false,
-	}
-
-	for _, agent := range agents.Registry {
-		want, ok := expected[agent.Name]
-		require.True(t, ok, "missing expected entry for %s", agent.Name)
-		assert.Equal(t, want, agent.SupportsProjectScope, "SupportsProjectScope for %s", agent.Name)
-	}
-}
diff --git a/experimental/aitools/lib/installer/source.go b/experimental/aitools/lib/installer/source.go
deleted file mode 100644
index e601b26d66d..00000000000
--- a/experimental/aitools/lib/installer/source.go
+++ /dev/null
@@ -1,50 +0,0 @@
-package installer
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"time"
-
-	"github.com/databricks/cli/libs/log"
-)
-
-// ManifestSource abstracts how the skills manifest is fetched.
-type ManifestSource interface {
-	// FetchManifest fetches the skills manifest at the given ref.
-	FetchManifest(ctx context.Context, ref string) (*Manifest, error)
-}
-
-// GitHubManifestSource fetches manifests from GitHub.
-type GitHubManifestSource struct{}
-
-// FetchManifest fetches the skills manifest from GitHub at the given ref.
-func (s *GitHubManifestSource) FetchManifest(ctx context.Context, ref string) (*Manifest, error) {
-	log.Debugf(ctx, "Fetching skills manifest from %s/%s@%s", skillsRepoOwner, skillsRepoName, ref)
-	url := fmt.Sprintf("https://raw.githubusercontent.com/%s/%s/%s/manifest.json",
-		skillsRepoOwner, skillsRepoName, ref)
-
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create request: %w", err)
-	}
-
-	client := &http.Client{Timeout: 30 * time.Second}
-	resp, err := client.Do(req)
-	if err != nil {
-		return nil, fmt.Errorf("failed to fetch manifest: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		return nil, fmt.Errorf("failed to fetch manifest: HTTP %d", resp.StatusCode)
-	}
-
-	var manifest Manifest
-	if err := json.NewDecoder(resp.Body).Decode(&manifest); err != nil {
-		return nil, fmt.Errorf("failed to parse manifest: %w", err)
-	}
-
-	return &manifest, nil
-}
diff --git a/experimental/aitools/lib/installer/state.go b/experimental/aitools/lib/installer/state.go
deleted file mode 100644
index a666a585057..00000000000
--- a/experimental/aitools/lib/installer/state.go
+++ /dev/null
@@ -1,105 +0,0 @@
-package installer
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"os"
-	"path/filepath"
-	"time"
-
-	"github.com/databricks/cli/libs/env"
-)
-
-const stateFileName = ".state.json"
-
-// Scope constants for skill installation.
-const (
-	ScopeGlobal  = "global"
-	ScopeProject = "project"
-)
-
-// InstallState records the state of all installed skills in a scope directory.
-type InstallState struct {
-	SchemaVersion       int               `json:"schema_version"`
-	IncludeExperimental bool              `json:"include_experimental,omitempty"`
-	Release             string            `json:"release"`
-	LastUpdated         time.Time         `json:"last_updated"`
-	Skills              map[string]string `json:"skills"`
-	Scope               string            `json:"scope,omitempty"`
-}
-
-// LoadState reads install state from the given directory.
-// Returns (nil, nil) when the state file does not exist.
-func LoadState(dir string) (*InstallState, error) {
-	data, err := os.ReadFile(filepath.Join(dir, stateFileName))
-	if errors.Is(err, os.ErrNotExist) {
-		return nil, nil
-	}
-	if err != nil {
-		return nil, fmt.Errorf("failed to read state file: %w", err)
-	}
-
-	var state InstallState
-	if err := json.Unmarshal(data, &state); err != nil {
-		return nil, fmt.Errorf("failed to parse state file: %w", err)
-	}
-	return &state, nil
-}
-
-// SaveState writes install state to the given directory atomically.
-// Creates the directory if it does not exist.
-func SaveState(dir string, state *InstallState) error {
-	if err := os.MkdirAll(dir, 0o755); err != nil {
-		return fmt.Errorf("failed to create state directory: %w", err)
-	}
-
-	data, err := json.MarshalIndent(state, "", "  ")
-	if err != nil {
-		return fmt.Errorf("failed to marshal state: %w", err)
-	}
-	data = append(data, '\n')
-
-	// Atomic write: write to temp file in the same directory, then rename.
-	tmp, err := os.CreateTemp(dir, ".state-*.tmp")
-	if err != nil {
-		return fmt.Errorf("failed to create temp file: %w", err)
-	}
-	tmpName := tmp.Name()
-
-	if _, err := tmp.Write(data); err != nil {
-		tmp.Close()
-		os.Remove(tmpName)
-		return fmt.Errorf("failed to write temp file: %w", err)
-	}
-	if err := tmp.Close(); err != nil {
-		os.Remove(tmpName)
-		return fmt.Errorf("failed to close temp file: %w", err)
-	}
-
-	if err := os.Rename(tmpName, filepath.Join(dir, stateFileName)); err != nil {
-		os.Remove(tmpName)
-		return fmt.Errorf("failed to rename state file: %w", err)
-	}
-	return nil
-}
-
-// GlobalSkillsDir returns the path to the global skills directory (~/.databricks/aitools/skills/).
-func GlobalSkillsDir(ctx context.Context) (string, error) {
-	home, err := env.UserHomeDir(ctx)
-	if err != nil {
-		return "", err
-	}
-	return filepath.Join(home, ".databricks", "aitools", "skills"), nil
-}
-
-// ProjectSkillsDir returns the path to the project-scoped skills directory.
-// The project root is the current working directory.
-func ProjectSkillsDir(_ context.Context) (string, error) {
-	cwd, err := os.Getwd()
-	if err != nil {
-		return "", fmt.Errorf("failed to determine working directory: %w", err)
-	}
-	return filepath.Join(cwd, ".databricks", "aitools", "skills"), nil
-}
diff --git a/experimental/aitools/lib/installer/state_test.go b/experimental/aitools/lib/installer/state_test.go
deleted file mode 100644
index f1fcdb8c229..00000000000
--- a/experimental/aitools/lib/installer/state_test.go
+++ /dev/null
@@ -1,117 +0,0 @@
-package installer
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"github.com/databricks/cli/libs/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestLoadStateNonexistentFile(t *testing.T) {
-	state, err := LoadState(t.TempDir())
-	assert.NoError(t, err)
-	assert.Nil(t, state)
-}
-
-func TestSaveAndLoadStateRoundtrip(t *testing.T) {
-	dir := t.TempDir()
-	original := &InstallState{
-		SchemaVersion: 1,
-		Release:       "v0.2.0",
-		LastUpdated:   time.Date(2026, 3, 22, 10, 0, 0, 0, time.UTC),
-		Skills: map[string]string{
-			"databricks": "1.0.0",
-		},
-	}
-
-	err := SaveState(dir, original)
-	require.NoError(t, err)
-
-	loaded, err := LoadState(dir)
-	require.NoError(t, err)
-	assert.Equal(t, original, loaded)
-}
-
-func TestSaveStateCreatesDirectory(t *testing.T) {
-	dir := filepath.Join(t.TempDir(), "nested", "path")
-	state := &InstallState{
-		SchemaVersion: 1,
-		Release:       "v0.1.0",
-		LastUpdated:   time.Date(2026, 3, 22, 9, 0, 0, 0, time.UTC),
-		Skills:        map[string]string{},
-	}
-
-	err := SaveState(dir, state)
-	require.NoError(t, err)
-
-	// Verify file exists.
-	_, err = os.Stat(filepath.Join(dir, stateFileName))
-	assert.NoError(t, err)
-}
-
-func TestSaveStateTrailingNewline(t *testing.T) {
-	dir := t.TempDir()
-	state := &InstallState{
-		SchemaVersion: 1,
-		Release:       "v0.1.0",
-		LastUpdated:   time.Date(2026, 3, 22, 9, 0, 0, 0, time.UTC),
-		Skills:        map[string]string{},
-	}
-
-	err := SaveState(dir, state)
-	require.NoError(t, err)
-
-	data, err := os.ReadFile(filepath.Join(dir, stateFileName))
-	require.NoError(t, err)
-	assert.Equal(t, byte('\n'), data[len(data)-1])
-}
-
-func TestLoadStateCorruptJSON(t *testing.T) {
-	dir := t.TempDir()
-	require.NoError(t, os.WriteFile(filepath.Join(dir, stateFileName), []byte("{bad json"), 0o644))
-
-	state, err := LoadState(dir)
-	assert.Error(t, err)
-	assert.Nil(t, state)
-	assert.Contains(t, err.Error(), "failed to parse state file")
-}
-
-func TestGlobalSkillsDir(t *testing.T) {
-	ctx := env.WithUserHomeDir(t.Context(), "/fake/home")
-	dir, err := GlobalSkillsDir(ctx)
-	require.NoError(t, err)
-	assert.Equal(t, filepath.Join("/fake/home", ".databricks", "aitools", "skills"), dir)
-}
-
-func TestProjectSkillsDirReturnsCwdBased(t *testing.T) {
-	dir, err := ProjectSkillsDir(t.Context())
-	require.NoError(t, err)
-	cwd, _ := os.Getwd()
-	assert.Equal(t, filepath.Join(cwd, ".databricks", "aitools", "skills"), dir)
-}
-
-func TestSaveAndLoadStateWithOptionalFields(t *testing.T) {
-	dir := t.TempDir()
-	original := &InstallState{
-		SchemaVersion:       1,
-		IncludeExperimental: true,
-		Release:             "v0.3.0",
-		LastUpdated:         time.Date(2026, 3, 22, 12, 30, 0, 0, time.UTC),
-		Skills: map[string]string{
-			"databricks": "1.0.0",
-			"sql-tools":  "0.2.0",
-		},
-		Scope: "project",
-	}
-
-	err := SaveState(dir, original)
-	require.NoError(t, err)
-
-	loaded, err := LoadState(dir)
-	require.NoError(t, err)
-	assert.Equal(t, original, loaded)
-}
diff --git a/experimental/aitools/lib/installer/uninstall.go b/experimental/aitools/lib/installer/uninstall.go
deleted file mode 100644
index 1ad9f58511c..00000000000
--- a/experimental/aitools/lib/installer/uninstall.go
+++ /dev/null
@@ -1,228 +0,0 @@
-package installer
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"io/fs"
-	"os"
-	"path/filepath"
-	"strings"
-
-	"github.com/databricks/cli/experimental/aitools/lib/agents"
-	"github.com/databricks/cli/libs/cmdio"
-	"github.com/databricks/cli/libs/log"
-)
-
-// UninstallOptions controls the behavior of UninstallSkillsOpts.
-type UninstallOptions struct {
-	Skills []string // empty = all
-	Scope  string   // ScopeGlobal or ScopeProject (default: global)
-}
-
-// UninstallSkills removes all installed skills, their symlinks, and the state file.
-func UninstallSkills(ctx context.Context) error {
-	return UninstallSkillsOpts(ctx, UninstallOptions{})
-}
-
-// UninstallSkillsOpts removes installed skills based on options.
-// When opts.Skills is empty, all skills are removed (same as UninstallSkills).
-// When opts.Skills is non-empty, only the named skills are removed.
-func UninstallSkillsOpts(ctx context.Context, opts UninstallOptions) error {
-	scope := opts.Scope
-	if scope == "" {
-		scope = ScopeGlobal
-	}
-
-	baseDir, err := skillsDir(ctx, scope)
-	if err != nil {
-		return err
-	}
-
-	var cwd string
-	if scope == ScopeProject {
-		cwd, err = os.Getwd()
-		if err != nil {
-			return fmt.Errorf("failed to determine working directory: %w", err)
-		}
-	}
-
-	state, err := LoadState(baseDir)
-	if err != nil {
-		return fmt.Errorf("failed to load install state: %w", err)
-	}
-
-	if state == nil {
-		if scope == ScopeGlobal && hasLegacyInstall(ctx, baseDir) {
-			return errors.New("found skills from a previous install without state tracking; run 'databricks experimental aitools install' first, then uninstall")
-		}
-		return errors.New("no skills installed")
-	}
-
-	// Determine which skills to remove.
-	var toRemove []string
-	if len(opts.Skills) > 0 {
-		seen := make(map[string]bool)
-		for _, name := range opts.Skills {
-			if seen[name] {
-				continue
-			}
-			seen[name] = true
-			if _, ok := state.Skills[name]; !ok {
-				return fmt.Errorf("skill %q is not installed", name)
-			}
-			toRemove = append(toRemove, name)
-		}
-	} else {
-		for name := range state.Skills {
-			toRemove = append(toRemove, name)
-		}
-	}
-
-	removeAll := len(toRemove) == len(state.Skills)
-
-	// Remove skill directories and symlinks for each skill.
-	for _, name := range toRemove {
-		canonicalDir := filepath.Join(baseDir, name)
-		removeSymlinksFromAgents(ctx, name, canonicalDir, scope, cwd)
-		if err := os.RemoveAll(canonicalDir); err != nil {
-			log.Warnf(ctx, "Failed to remove %s: %v", canonicalDir, err)
-		}
-		delete(state.Skills, name)
-	}
-
-	if removeAll {
-		// Clean up orphaned symlinks and delete state file.
-		cleanOrphanedSymlinks(ctx, baseDir, scope, cwd)
-		stateFile := filepath.Join(baseDir, stateFileName)
-		if err := os.Remove(stateFile); err != nil && !errors.Is(err, fs.ErrNotExist) {
-			return fmt.Errorf("failed to remove state file: %w", err)
-		}
-	} else {
-		// Update state to reflect remaining skills.
-		if err := SaveState(baseDir, state); err != nil {
-			return err
-		}
-	}
-
-	noun := "skills"
-	if len(toRemove) == 1 {
-		noun = "skill"
-	}
-	cmdio.LogString(ctx, fmt.Sprintf("Uninstalled %d %s.", len(toRemove), noun))
-	return nil
-}
-
-// removeSymlinksFromAgents removes a skill's symlink from all agent directories
-// in the registry, but only if the entry is a symlink pointing into canonicalDir.
-// Non-symlink directories are left untouched to avoid deleting user-managed content.
-func removeSymlinksFromAgents(ctx context.Context, skillName, canonicalDir, scope, cwd string) {
-	for i := range agents.Registry {
-		agent := &agents.Registry[i]
-		if scope == ScopeProject && !agent.SupportsProjectScope {
-			continue
-		}
-		agentDir, err := agentSkillsDirForScope(ctx, agent, scope, cwd)
-		if err != nil {
-			continue
-		}
-
-		destDir := filepath.Join(agentDir, skillName)
-
-		// Use Lstat to detect symlinks (Stat follows them).
-		fi, err := os.Lstat(destDir)
-		if errors.Is(err, fs.ErrNotExist) {
-			continue
-		}
-		if err != nil {
-			log.Warnf(ctx, "Failed to stat %s for %s: %v", destDir, agent.DisplayName, err)
-			continue
-		}
-
-		if fi.Mode()&os.ModeSymlink == 0 {
-			log.Debugf(ctx, "Skipping non-symlink %s for %s", destDir, agent.DisplayName)
-			continue
-		}
-
-		target, err := os.Readlink(destDir)
-		if err != nil {
-			log.Warnf(ctx, "Failed to read symlink %s: %v", destDir, err)
-			continue
-		}
-
-		// Resolve relative symlinks to absolute for comparison.
-		absTarget := target
-		if !filepath.IsAbs(target) {
-			absTarget = filepath.Join(filepath.Dir(destDir), target)
-			absTarget = filepath.Clean(absTarget)
-		}
-
-		// Only remove if the symlink points into our canonical dir.
-		if !strings.HasPrefix(absTarget, canonicalDir+string(os.PathSeparator)) && absTarget != canonicalDir {
-			log.Debugf(ctx, "Skipping symlink %s (points to %s, not %s)", destDir, absTarget, canonicalDir)
-			continue
-		}
-
-		if err := os.Remove(destDir); err != nil {
-			log.Warnf(ctx, "Failed to remove symlink %s: %v", destDir, err)
-		} else {
-			log.Debugf(ctx, "Removed %q from %s", skillName, agent.DisplayName)
-		}
-	}
-}
-
-// cleanOrphanedSymlinks scans all agent skill directories for symlinks pointing
-// into baseDir that are not tracked in state, and removes them.
-func cleanOrphanedSymlinks(ctx context.Context, baseDir, scope, cwd string) {
-	for i := range agents.Registry {
-		agent := &agents.Registry[i]
-		if scope == ScopeProject && !agent.SupportsProjectScope {
-			continue
-		}
-		agentDir, err := agentSkillsDirForScope(ctx, agent, scope, cwd)
-		if err != nil {
-			continue
-		}
-
-		entries, err := os.ReadDir(agentDir)
-		if err != nil {
-			continue
-		}
-
-		for _, entry := range entries {
-			entryPath := filepath.Join(agentDir, entry.Name())
-
-			fi, err := os.Lstat(entryPath)
-			if err != nil {
-				continue
-			}
-
-			if fi.Mode()&os.ModeSymlink == 0 {
-				continue
-			}
-
-			target, err := os.Readlink(entryPath)
-			if err != nil {
-				continue
-			}
-
-			// Resolve relative symlinks to absolute for comparison.
-			absTarget := target
-			if !filepath.IsAbs(target) {
-				absTarget = filepath.Clean(filepath.Join(filepath.Dir(entryPath), target))
-			}
-
-			// Check if the symlink points into our managed skills dir.
-			if !strings.HasPrefix(absTarget, baseDir+string(os.PathSeparator)) && absTarget != baseDir {
-				continue
-			}
-
-			// This symlink points into our managed dir. Remove it.
-			if err := os.Remove(entryPath); err != nil {
-				log.Warnf(ctx, "Failed to remove orphaned symlink %s: %v", entryPath, err)
-			} else {
-				log.Debugf(ctx, "Removed orphaned symlink %s -> %s", entryPath, target)
-			}
-		}
-	}
-}
diff --git a/experimental/aitools/lib/installer/uninstall_test.go b/experimental/aitools/lib/installer/uninstall_test.go
deleted file mode 100644
index 6c7589f6f29..00000000000
--- a/experimental/aitools/lib/installer/uninstall_test.go
+++ /dev/null
@@ -1,334 +0,0 @@
-package installer
-
-import (
-	"context"
-	"io/fs"
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"github.com/databricks/cli/experimental/aitools/lib/agents"
-	"github.com/databricks/cli/libs/cmdio"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func installTestSkills(t *testing.T, tmp string) string {
-	t.Helper()
-	ctx := cmdio.MockDiscard(t.Context())
-	setupFetchMock(t)
-
-	src := &mockManifestSource{manifest: testManifest()}
-	agent := testAgent(tmp)
-	require.NoError(t, InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{}))
-
-	return filepath.Join(tmp, ".databricks", "aitools", "skills")
-}
-
-func TestUninstallRemovesSkillDirectories(t *testing.T) {
-	tmp := setupTestHome(t)
-	globalDir := installTestSkills(t, tmp)
-
-	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
-
-	err := UninstallSkills(ctx)
-	require.NoError(t, err)
-
-	// Skill directories should be gone.
-	_, err = os.Stat(filepath.Join(globalDir, "databricks-sql"))
-	assert.ErrorIs(t, err, fs.ErrNotExist)
-	_, err = os.Stat(filepath.Join(globalDir, "databricks-jobs"))
-	assert.ErrorIs(t, err, fs.ErrNotExist)
-
-	assert.Contains(t, stderr.String(), "Uninstalled 2 skills.")
-}
-
-func TestUninstallRemovesSymlinks(t *testing.T) {
-	tmp := setupTestHome(t)
-	ctx := cmdio.MockDiscard(t.Context())
-	setupFetchMock(t)
-
-	// Use two registry-based agents so uninstall can find them.
-	// Create config dirs for claude-code and cursor (both in agents.Registry).
-	require.NoError(t, os.MkdirAll(filepath.Join(tmp, ".claude"), 0o755))
-	require.NoError(t, os.MkdirAll(filepath.Join(tmp, ".cursor"), 0o755))
-
-	claudeAgent := &agents.Agent{
-		Name:        "claude-code",
-		DisplayName: "Claude Code",
-		ConfigDir: func(_ context.Context) (string, error) {
-			return filepath.Join(tmp, ".claude"), nil
-		},
-	}
-	cursorAgent := &agents.Agent{
-		Name:        "cursor",
-		DisplayName: "Cursor",
-		ConfigDir: func(_ context.Context) (string, error) {
-			return filepath.Join(tmp, ".cursor"), nil
-		},
-	}
-
-	src := &mockManifestSource{manifest: testManifest()}
-	require.NoError(t, InstallSkillsForAgents(ctx, src, []*agents.Agent{claudeAgent, cursorAgent}, InstallOptions{}))
-
-	ctx2, _ := cmdio.NewTestContextWithStderr(t.Context())
-	err := UninstallSkills(ctx2)
-	require.NoError(t, err)
-
-	// Check that agent skill directories are cleaned up.
-	// These agents are in agents.Registry so removeSymlinksFromAgents finds them.
-	for _, agentDir := range []string{".claude", ".cursor"} {
-		sqlLink := filepath.Join(tmp, agentDir, "skills", "databricks-sql")
-		_, err := os.Lstat(sqlLink)
-		assert.ErrorIs(t, err, fs.ErrNotExist, "symlink should be removed from %s", agentDir)
-
-		jobsLink := filepath.Join(tmp, agentDir, "skills", "databricks-jobs")
-		_, err = os.Lstat(jobsLink)
-		assert.ErrorIs(t, err, fs.ErrNotExist, "symlink should be removed from %s", agentDir)
-	}
-}
-
-func TestUninstallCleansOrphanedSymlinks(t *testing.T) {
-	tmp := setupTestHome(t)
-	globalDir := installTestSkills(t, tmp)
-
-	// Create an orphaned symlink in a registry agent's dir that points into
-	// globalDir but is not tracked in state.
-	// .claude is in agents.Registry so cleanOrphanedSymlinks will scan it.
-	require.NoError(t, os.MkdirAll(filepath.Join(tmp, ".claude"), 0o755))
-	agentSkillsDir := filepath.Join(tmp, ".claude", "skills")
-	require.NoError(t, os.MkdirAll(agentSkillsDir, 0o755))
-
-	orphanTarget := filepath.Join(globalDir, "databricks-orphan")
-	require.NoError(t, os.MkdirAll(orphanTarget, 0o755))
-	orphanLink := filepath.Join(agentSkillsDir, "databricks-orphan")
-	require.NoError(t, os.Symlink(orphanTarget, orphanLink))
-
-	ctx, _ := cmdio.NewTestContextWithStderr(t.Context())
-	err := UninstallSkills(ctx)
-	require.NoError(t, err)
-
-	// Orphaned symlink should be removed.
-	_, err = os.Lstat(orphanLink)
-	assert.ErrorIs(t, err, fs.ErrNotExist)
-}
-
-func TestUninstallDeletesStateFile(t *testing.T) {
-	tmp := setupTestHome(t)
-	globalDir := installTestSkills(t, tmp)
-
-	// Verify state file exists before uninstall.
-	_, err := os.Stat(filepath.Join(globalDir, ".state.json"))
-	require.NoError(t, err)
-
-	ctx := cmdio.MockDiscard(t.Context())
-	err = UninstallSkills(ctx)
-	require.NoError(t, err)
-
-	// State file should be gone.
-	_, err = os.Stat(filepath.Join(globalDir, ".state.json"))
-	assert.ErrorIs(t, err, fs.ErrNotExist)
-}
-
-func TestUninstallNoStateReturnsError(t *testing.T) {
-	setupTestHome(t)
-	ctx := cmdio.MockDiscard(t.Context())
-
-	err := UninstallSkills(ctx)
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "no skills installed")
-}
-
-func TestUninstallHandlesMissingDirectories(t *testing.T) {
-	tmp := setupTestHome(t)
-	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
-
-	// Create state manually but without actual skill directories on disk.
-	state := &InstallState{
-		SchemaVersion: 1,
-		Release:       "v0.1.0",
-		LastUpdated:   time.Now(),
-		Skills: map[string]string{
-			"databricks-sql":  "0.1.0",
-			"databricks-jobs": "0.1.0",
-		},
-	}
-	require.NoError(t, SaveState(globalDir, state))
-
-	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
-	err := UninstallSkills(ctx)
-	require.NoError(t, err)
-	assert.Contains(t, stderr.String(), "Uninstalled 2 skills.")
-}
-
-func TestUninstallHandlesBrokenSymlinksToCanonicalDir(t *testing.T) {
-	tmp := setupTestHome(t)
-	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
-
-	// Create state with one skill.
-	state := &InstallState{
-		SchemaVersion: 1,
-		Release:       "v0.1.0",
-		LastUpdated:   time.Now(),
-		Skills: map[string]string{
-			"databricks-sql": "0.1.0",
-		},
-	}
-	require.NoError(t, SaveState(globalDir, state))
-
-	// Create a symlink pointing to the canonical dir (which doesn't exist on disk).
-	canonicalTarget := filepath.Join(globalDir, "databricks-sql")
-	require.NoError(t, os.MkdirAll(filepath.Join(tmp, ".claude"), 0o755))
-	agentSkillsDir := filepath.Join(tmp, ".claude", "skills")
-	require.NoError(t, os.MkdirAll(agentSkillsDir, 0o755))
-	link := filepath.Join(agentSkillsDir, "databricks-sql")
-	require.NoError(t, os.Symlink(canonicalTarget, link))
-
-	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
-	err := UninstallSkills(ctx)
-	require.NoError(t, err)
-
-	// Symlink pointing to canonical dir should be removed.
-	_, err = os.Lstat(link)
-	assert.ErrorIs(t, err, fs.ErrNotExist)
-	assert.Contains(t, stderr.String(), "Uninstalled 1 skill.")
-}
-
-func TestUninstallLeavesNonCanonicalSymlinks(t *testing.T) {
-	tmp := setupTestHome(t)
-	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
-
-	state := &InstallState{
-		SchemaVersion: 1,
-		Release:       "v0.1.0",
-		LastUpdated:   time.Now(),
-		Skills: map[string]string{
-			"databricks-sql": "0.1.0",
-		},
-	}
-	require.NoError(t, SaveState(globalDir, state))
-
-	// Create a symlink in an agent dir pointing somewhere other than canonical dir.
-	require.NoError(t, os.MkdirAll(filepath.Join(tmp, ".claude"), 0o755))
-	agentSkillsDir := filepath.Join(tmp, ".claude", "skills")
-	require.NoError(t, os.MkdirAll(agentSkillsDir, 0o755))
-	externalLink := filepath.Join(agentSkillsDir, "databricks-sql")
-	require.NoError(t, os.Symlink("/some/other/place", externalLink))
-
-	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
-	err := UninstallSkills(ctx)
-	require.NoError(t, err)
-
-	// Symlink pointing outside canonical dir should be preserved.
-	_, err = os.Lstat(externalLink)
-	assert.NoError(t, err, "symlink to external path should not be removed")
-	assert.Contains(t, stderr.String(), "Uninstalled 1 skill.")
-}
-
-func TestUninstallLeavesNonSymlinkDirectories(t *testing.T) {
-	tmp := setupTestHome(t)
-	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
-
-	state := &InstallState{
-		SchemaVersion: 1,
-		Release:       "v0.1.0",
-		LastUpdated:   time.Now(),
-		Skills: map[string]string{
-			"databricks-sql": "0.1.0",
-		},
-	}
-	require.NoError(t, SaveState(globalDir, state))
-
-	// Create a regular directory (not symlink) in agent skills dir.
-	require.NoError(t, os.MkdirAll(filepath.Join(tmp, ".claude"), 0o755))
-	agentSkillsDir := filepath.Join(tmp, ".claude", "skills")
-	regularDir := filepath.Join(agentSkillsDir, "databricks-sql")
-	require.NoError(t, os.MkdirAll(regularDir, 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(regularDir, "custom.md"), []byte("custom"), 0o644))
-
-	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
-	err := UninstallSkills(ctx)
-	require.NoError(t, err)
-
-	// Regular directory should be preserved (not a symlink to canonical dir).
-	_, err = os.Stat(regularDir)
-	assert.NoError(t, err, "regular directory should not be removed")
-	assert.Contains(t, stderr.String(), "Uninstalled 1 skill.")
-}
-
-func TestUninstallSelectiveRemovesOnlyNamedSkills(t *testing.T) {
-	tmp := setupTestHome(t)
-	globalDir := installTestSkills(t, tmp)
-
-	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
-	err := UninstallSkillsOpts(ctx, UninstallOptions{Skills: []string{"databricks-sql"}})
-	require.NoError(t, err)
-
-	// databricks-sql should be gone.
-	_, err = os.Stat(filepath.Join(globalDir, "databricks-sql"))
-	assert.ErrorIs(t, err, fs.ErrNotExist)
-
-	// databricks-jobs should still exist.
-	_, err = os.Stat(filepath.Join(globalDir, "databricks-jobs"))
-	assert.NoError(t, err)
-
-	// State should still exist with remaining skill.
-	state, err := LoadState(globalDir)
-	require.NoError(t, err)
-	require.NotNil(t, state)
-	assert.Len(t, state.Skills, 1)
-	assert.Contains(t, state.Skills, "databricks-jobs")
-
-	assert.Contains(t, stderr.String(), "Uninstalled 1 skill.")
-}
-
-func TestUninstallSelectiveUnknownSkillErrors(t *testing.T) {
-	tmp := setupTestHome(t)
-	installTestSkills(t, tmp)
-
-	ctx := cmdio.MockDiscard(t.Context())
-	err := UninstallSkillsOpts(ctx, UninstallOptions{Skills: []string{"nonexistent"}})
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "not installed")
-}
-
-func TestUninstallSelectiveDuplicateNamesDeduplicates(t *testing.T) {
-	tmp := setupTestHome(t)
-	globalDir := installTestSkills(t, tmp)
-
-	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
-	// Pass duplicate: should only remove databricks-sql once, not wipe state.
-	err := UninstallSkillsOpts(ctx, UninstallOptions{Skills: []string{"databricks-sql", "databricks-sql"}})
-	require.NoError(t, err)
-
-	// databricks-sql should be gone.
-	_, err = os.Stat(filepath.Join(globalDir, "databricks-sql"))
-	assert.ErrorIs(t, err, fs.ErrNotExist)
-
-	// databricks-jobs should still exist.
-	_, err = os.Stat(filepath.Join(globalDir, "databricks-jobs"))
-	assert.NoError(t, err, "other skills must not be removed")
-
-	// State should still exist with remaining skill.
-	state, err := LoadState(globalDir)
-	require.NoError(t, err)
-	require.NotNil(t, state, "state file must not be deleted when other skills remain")
-	assert.Len(t, state.Skills, 1)
-	assert.Contains(t, state.Skills, "databricks-jobs")
-
-	assert.Contains(t, stderr.String(), "Uninstalled 1 skill.")
-}
-
-func TestUninstallSelectiveAllRemovesStateFile(t *testing.T) {
-	tmp := setupTestHome(t)
-	globalDir := installTestSkills(t, tmp)
-
-	ctx, _ := cmdio.NewTestContextWithStderr(t.Context())
-	err := UninstallSkillsOpts(ctx, UninstallOptions{Skills: []string{"databricks-sql", "databricks-jobs"}})
-	require.NoError(t, err)
-
-	// State file should be gone since all skills were removed.
-	_, err = os.Stat(filepath.Join(globalDir, ".state.json"))
-	assert.ErrorIs(t, err, fs.ErrNotExist)
-}
diff --git a/experimental/aitools/lib/installer/update.go b/experimental/aitools/lib/installer/update.go
deleted file mode 100644
index 663ad5e908e..00000000000
--- a/experimental/aitools/lib/installer/update.go
+++ /dev/null
@@ -1,271 +0,0 @@
-package installer
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"maps"
-	"os"
-	"path/filepath"
-	"slices"
-	"strings"
-	"time"
-
-	"github.com/databricks/cli/experimental/aitools/lib/agents"
-	"github.com/databricks/cli/internal/build"
-	"github.com/databricks/cli/libs/cmdio"
-	"github.com/databricks/cli/libs/env"
-	"github.com/databricks/cli/libs/log"
-	"golang.org/x/mod/semver"
-)
-
-// UpdateOptions controls the behavior of UpdateSkills.
-type UpdateOptions struct {
-	Force  bool
-	NoNew  bool
-	Check  bool     // dry run: show what would change without downloading
-	Skills []string // empty = all installed
-	Scope  string   // ScopeGlobal or ScopeProject (default: global)
-}
-
-// UpdateResult describes what UpdateSkills did (or would do in check mode).
-type UpdateResult struct {
-	Updated   []SkillUpdate // skills that were updated
-	Added     []SkillUpdate // new skills added (when NoNew is false)
-	Unchanged []string      // skills at current version
-	Skipped   []string      // skills skipped (experimental, version constraint)
-}
-
-// SkillUpdate describes a single skill version change.
-type SkillUpdate struct {
-	Name       string
-	OldVersion string
-	NewVersion string
-}
-
-// UpdateSkills updates installed skills to the latest release.
-func UpdateSkills(ctx context.Context, src ManifestSource, targetAgents []*agents.Agent, opts UpdateOptions) (*UpdateResult, error) {
-	scope := opts.Scope
-	if scope == "" {
-		scope = ScopeGlobal
-	}
-
-	baseDir, err := skillsDir(ctx, scope)
-	if err != nil {
-		return nil, err
-	}
-
-	// For project scope, filter to compatible agents.
-	var cwd string
-	if scope == ScopeProject {
-		cwd, err = os.Getwd()
-		if err != nil {
-			return nil, fmt.Errorf("failed to determine working directory: %w", err)
-		}
-		incompatible := incompatibleAgentNames(targetAgents)
-		targetAgents = filterProjectAgents(ctx, targetAgents)
-		if len(targetAgents) == 0 {
-			return nil, fmt.Errorf("no agents support project-scoped skills. The following detected agents are global-only: %s", strings.Join(incompatible, ", "))
-		}
-	}
-
-	state, err := LoadState(baseDir)
-	if err != nil {
-		return nil, fmt.Errorf("failed to load install state: %w", err)
-	}
-
-	if state == nil {
-		if scope == ScopeGlobal && hasLegacyInstall(ctx, baseDir) {
-			return nil, errors.New("found skills from a previous install without state tracking; run 'databricks experimental aitools install' to refresh before updating")
-		}
-		return nil, errors.New("no skills installed. Run 'databricks experimental aitools install' to install")
-	}
-
-	latestTag := GetSkillsRef(ctx)
-
-	if state.Release == latestTag && !opts.Force {
-		cmdio.LogString(ctx, "Already up to date.")
-		return &UpdateResult{Unchanged: slices.Sorted(maps.Keys(state.Skills))}, nil
-	}
-
-	manifest, err := src.FetchManifest(ctx, latestTag)
-	if err != nil {
-		if opts.Check {
-			log.Warnf(ctx, "Could not fetch manifest: %v", err)
-			return &UpdateResult{}, nil
-		}
-		return nil, err
-	}
-
-	// Determine the skill set to consider.
-	skillSet := buildUpdateSkillSet(state, manifest, opts)
-
-	result := &UpdateResult{}
-
-	cliVersion := build.GetInfo().Version
-	isDev := strings.HasPrefix(cliVersion, build.DefaultSemver)
-
-	// Sort skill names for deterministic output.
-	names := slices.Sorted(maps.Keys(skillSet))
-
-	for _, name := range names {
-		meta, inManifest := manifest.Skills[name]
-		oldVersion := state.Skills[name]
-
-		if !inManifest {
-			_, wasInstalled := state.Skills[name]
-			if wasInstalled {
-				log.Warnf(ctx, "Warning: %q not found in manifest %s (keeping installed version).", name, latestTag)
-			}
-			result.Unchanged = append(result.Unchanged, name)
-			continue
-		}
-
-		// Filter experimental skills unless state opted in.
-		if meta.Experimental && !state.IncludeExperimental {
-			log.Debugf(ctx, "Skipping experimental skill %s", name)
-			result.Skipped = append(result.Skipped, name)
-			continue
-		}
-
-		// Filter skills requiring a newer CLI version.
-		if meta.MinCLIVer != "" && !isDev && semver.Compare("v"+cliVersion, "v"+meta.MinCLIVer) < 0 {
-			log.Warnf(ctx, "Skipping %s: requires CLI version %s (running %s)", name, meta.MinCLIVer, cliVersion)
-			result.Skipped = append(result.Skipped, name)
-			continue
-		}
-
-		// Check if this is a new skill (not in state).
-		_, wasInstalled := state.Skills[name]
-
-		if meta.Version == oldVersion && !opts.Force {
-			result.Unchanged = append(result.Unchanged, name)
-			continue
-		}
-
-		update := SkillUpdate{
-			Name:       name,
-			OldVersion: oldVersion,
-			NewVersion: meta.Version,
-		}
-
-		if !wasInstalled {
-			result.Added = append(result.Added, update)
-		} else {
-			result.Updated = append(result.Updated, update)
-		}
-	}
-
-	if opts.Check {
-		return result, nil
-	}
-
-	// Download and install updated/added skills.
-	allChanges := make([]SkillUpdate, 0, len(result.Updated)+len(result.Added))
-	allChanges = append(allChanges, result.Updated...)
-	allChanges = append(allChanges, result.Added...)
-
-	params := installParams{
-		baseDir: baseDir,
-		scope:   scope,
-		cwd:     cwd,
-		ref:     latestTag,
-	}
-
-	for _, change := range allChanges {
-		meta := manifest.Skills[change.Name]
-		if err := installSkillForAgents(ctx, change.Name, meta.Files, targetAgents, params); err != nil {
-			return nil, err
-		}
-	}
-
-	// Update state.
-	state.Release = latestTag
-	state.LastUpdated = time.Now()
-	for _, change := range allChanges {
-		state.Skills[change.Name] = change.NewVersion
-	}
-	if err := SaveState(baseDir, state); err != nil {
-		return nil, err
-	}
-
-	return result, nil
-}
-
-// buildUpdateSkillSet determines which skills to consider for update.
-func buildUpdateSkillSet(state *InstallState, manifest *Manifest, opts UpdateOptions) map[string]bool {
-	skillSet := make(map[string]bool)
-
-	if len(opts.Skills) > 0 {
-		// Only named skills.
-		for _, name := range opts.Skills {
-			skillSet[name] = true
-		}
-		return skillSet
-	}
-
-	// All installed skills.
-	for name := range state.Skills {
-		skillSet[name] = true
-	}
-
-	// Auto-add new skills from manifest (unless --no-new).
-	if !opts.NoNew {
-		for name := range manifest.Skills {
-			skillSet[name] = true
-		}
-	}
-
-	return skillSet
-}
-
-// hasLegacyInstall checks both canonical and legacy dirs for skills on disk without state.
-func hasLegacyInstall(ctx context.Context, globalDir string) bool {
-	if hasSkillsOnDisk(globalDir) {
-		return true
-	}
-	homeDir, err := env.UserHomeDir(ctx)
-	if err != nil {
-		return false
-	}
-	return hasSkillsOnDisk(filepath.Join(homeDir, ".databricks", "agent-skills"))
-}
-
-// FormatUpdateResult returns a human-readable summary of the update result.
-// When check is true, output uses "Would update/add" instead of "Updated/Added".
-func FormatUpdateResult(result *UpdateResult, check bool) string {
-	var lines []string
-
-	updateVerb := "updated"
-	addVerb := "added"
-	summaryVerb := "Updated"
-	if check {
-		updateVerb = "would update"
-		addVerb = "would add"
-		summaryVerb = "Would update"
-	}
-
-	for _, u := range result.Updated {
-		if u.OldVersion == "" {
-			lines = append(lines, fmt.Sprintf("  %s %s -> v%s", updateVerb, u.Name, u.NewVersion))
-		} else {
-			lines = append(lines, fmt.Sprintf("  %s %s v%s -> v%s", updateVerb, u.Name, u.OldVersion, u.NewVersion))
-		}
-	}
-
-	for _, a := range result.Added {
-		lines = append(lines, fmt.Sprintf("  %s %s v%s", addVerb, a.Name, a.NewVersion))
-	}
-
-	total := len(result.Updated) + len(result.Added)
-	if total == 0 {
-		return "No changes."
-	}
-
-	noun := "skills"
-	if total == 1 {
-		noun = "skill"
-	}
-	lines = append(lines, fmt.Sprintf("%s %d %s.", summaryVerb, total, noun))
-	return strings.Join(lines, "\n")
-}
diff --git a/experimental/aitools/lib/installer/update_test.go b/experimental/aitools/lib/installer/update_test.go
deleted file mode 100644
index 97e3014be65..00000000000
--- a/experimental/aitools/lib/installer/update_test.go
+++ /dev/null
@@ -1,407 +0,0 @@
-package installer
-
-import (
-	"bytes"
-	"context"
-	"log/slog"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/databricks/cli/experimental/aitools/lib/agents"
-	"github.com/databricks/cli/libs/cmdio"
-	"github.com/databricks/cli/libs/log"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestUpdateNoStateReturnsInstallHint(t *testing.T) {
-	tmp := setupTestHome(t)
-	ctx := cmdio.MockDiscard(t.Context())
-	_ = tmp
-
-	src := &mockManifestSource{manifest: testManifest()}
-	_, err := UpdateSkills(ctx, src, nil, UpdateOptions{})
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "no skills installed")
-	assert.Contains(t, err.Error(), "databricks experimental aitools install")
-}
-
-func TestUpdateLegacyInstallDetected(t *testing.T) {
-	tmp := setupTestHome(t)
-	ctx := cmdio.MockDiscard(t.Context())
-
-	// Create skills in canonical location but no state file.
-	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
-	require.NoError(t, os.MkdirAll(filepath.Join(globalDir, "databricks-sql"), 0o755))
-
-	src := &mockManifestSource{manifest: testManifest()}
-	_, err := UpdateSkills(ctx, src, nil, UpdateOptions{})
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "previous install without state tracking")
-	assert.Contains(t, err.Error(), "refresh before updating")
-}
-
-func TestUpdateAlreadyUpToDate(t *testing.T) {
-	tmp := setupTestHome(t)
-	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
-	setupFetchMock(t)
-
-	// Install first.
-	src := &mockManifestSource{manifest: testManifest()}
-	agent := testAgent(tmp)
-	require.NoError(t, InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{}))
-
-	// Reset stderr.
-	stderr.Reset()
-
-	// Update with same release.
-	result, err := UpdateSkills(ctx, src, []*agents.Agent{agent}, UpdateOptions{})
-	require.NoError(t, err)
-	assert.Contains(t, stderr.String(), "Already up to date.")
-	assert.Len(t, result.Unchanged, 2)
-	assert.Empty(t, result.Updated)
-	assert.Empty(t, result.Added)
-}
-
-func TestUpdateVersionDiffDetected(t *testing.T) {
-	tmp := setupTestHome(t)
-	ctx := cmdio.MockDiscard(t.Context())
-	setupFetchMock(t)
-
-	// Install with default ref.
-	src := &mockManifestSource{manifest: testManifest()}
-	agent := testAgent(tmp)
-	require.NoError(t, InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{}))
-
-	// Simulate a new release by changing the ref.
-	t.Setenv("DATABRICKS_SKILLS_REF", "v0.2.0")
-
-	// Updated manifest with new version for one skill.
-	updatedManifest := testManifest()
-	updatedManifest.Skills["databricks-sql"] = SkillMeta{
-		Version: "0.2.0",
-		Files:   []string{"SKILL.md"},
-	}
-	src2 := &mockManifestSource{manifest: updatedManifest}
-
-	result, err := UpdateSkills(ctx, src2, []*agents.Agent{agent}, UpdateOptions{})
-	require.NoError(t, err)
-
-	require.Len(t, result.Updated, 1)
-	assert.Equal(t, "databricks-sql", result.Updated[0].Name)
-	assert.Equal(t, "0.1.0", result.Updated[0].OldVersion)
-	assert.Equal(t, "0.2.0", result.Updated[0].NewVersion)
-
-	// databricks-jobs unchanged.
-	assert.Contains(t, result.Unchanged, "databricks-jobs")
-
-	// State should be updated.
-	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
-	state, err := LoadState(globalDir)
-	require.NoError(t, err)
-	assert.Equal(t, "v0.2.0", state.Release)
-	assert.Equal(t, "0.2.0", state.Skills["databricks-sql"])
-}
-
-func TestUpdateCheckDryRun(t *testing.T) {
-	tmp := setupTestHome(t)
-	ctx := cmdio.MockDiscard(t.Context())
-	setupFetchMock(t)
-
-	// Install with default ref.
-	src := &mockManifestSource{manifest: testManifest()}
-	agent := testAgent(tmp)
-	require.NoError(t, InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{}))
-
-	// Simulate a new release.
-	t.Setenv("DATABRICKS_SKILLS_REF", "v0.2.0")
-
-	// Updated manifest.
-	updatedManifest := testManifest()
-	updatedManifest.Skills["databricks-sql"] = SkillMeta{
-		Version: "0.2.0",
-		Files:   []string{"SKILL.md"},
-	}
-	src2 := &mockManifestSource{manifest: updatedManifest}
-
-	// Track fetch calls to verify no downloads happen.
-	fetchCalls := 0
-	orig := fetchFileFn
-	t.Cleanup(func() { fetchFileFn = orig })
-	fetchFileFn = func(_ context.Context, _, _, _ string) ([]byte, error) {
-		fetchCalls++
-		return []byte("content"), nil
-	}
-
-	result, err := UpdateSkills(ctx, src2, []*agents.Agent{agent}, UpdateOptions{Check: true})
-	require.NoError(t, err)
-
-	// Should report the diff.
-	require.Len(t, result.Updated, 1)
-	assert.Equal(t, "databricks-sql", result.Updated[0].Name)
-
-	// Should NOT have downloaded anything.
-	assert.Equal(t, 0, fetchCalls)
-
-	// State should be unchanged (still the original install ref).
-	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
-	state, err := LoadState(globalDir)
-	require.NoError(t, err)
-	assert.Equal(t, defaultSkillsRepoRef, state.Release)
-}
-
-func TestUpdateForceRedownloads(t *testing.T) {
-	tmp := setupTestHome(t)
-	ctx := cmdio.MockDiscard(t.Context())
-	setupFetchMock(t)
-
-	// Install v0.1.0.
-	src := &mockManifestSource{manifest: testManifest()}
-	agent := testAgent(tmp)
-	require.NoError(t, InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{}))
-
-	// Track fetch calls on forced update (same release).
-	fetchCalls := 0
-	orig := fetchFileFn
-	t.Cleanup(func() { fetchFileFn = orig })
-	fetchFileFn = func(_ context.Context, _, _, _ string) ([]byte, error) {
-		fetchCalls++
-		return []byte("content"), nil
-	}
-
-	result, err := UpdateSkills(ctx, src, []*agents.Agent{agent}, UpdateOptions{Force: true})
-	require.NoError(t, err)
-
-	// All skills should be in Updated since Force re-downloads everything.
-	assert.Len(t, result.Updated, 2)
-	assert.Positive(t, fetchCalls, "force should trigger downloads")
-}
-
-func TestUpdateAutoAddsNewSkills(t *testing.T) {
-	tmp := setupTestHome(t)
-	ctx := cmdio.MockDiscard(t.Context())
-	setupFetchMock(t)
-
-	// Install with default ref.
-	src := &mockManifestSource{manifest: testManifest()}
-	agent := testAgent(tmp)
-	require.NoError(t, InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{}))
-
-	// Simulate a new release.
-	t.Setenv("DATABRICKS_SKILLS_REF", "v0.2.0")
-
-	// New manifest with an additional skill.
-	updatedManifest := testManifest()
-	updatedManifest.Skills["databricks-notebooks"] = SkillMeta{
-		Version: "0.1.0",
-		Files:   []string{"SKILL.md"},
-	}
-	src2 := &mockManifestSource{manifest: updatedManifest}
-
-	result, err := UpdateSkills(ctx, src2, []*agents.Agent{agent}, UpdateOptions{})
-	require.NoError(t, err)
-
-	// The new skill should be in Added.
-	require.Len(t, result.Added, 1)
-	assert.Equal(t, "databricks-notebooks", result.Added[0].Name)
-	assert.Equal(t, "0.1.0", result.Added[0].NewVersion)
-
-	// State should include the new skill.
-	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
-	state, err := LoadState(globalDir)
-	require.NoError(t, err)
-	assert.Equal(t, "0.1.0", state.Skills["databricks-notebooks"])
-}
-
-func TestUpdateNoNewIgnoresNewSkills(t *testing.T) {
-	tmp := setupTestHome(t)
-	ctx := cmdio.MockDiscard(t.Context())
-	setupFetchMock(t)
-
-	// Install with default ref.
-	src := &mockManifestSource{manifest: testManifest()}
-	agent := testAgent(tmp)
-	require.NoError(t, InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{}))
-
-	// Simulate a new release.
-	t.Setenv("DATABRICKS_SKILLS_REF", "v0.2.0")
-
-	// New manifest with an additional skill.
-	updatedManifest := testManifest()
-	updatedManifest.Skills["databricks-notebooks"] = SkillMeta{
-		Version: "0.1.0",
-		Files:   []string{"SKILL.md"},
-	}
-	src2 := &mockManifestSource{manifest: updatedManifest}
-
-	result, err := UpdateSkills(ctx, src2, []*agents.Agent{agent}, UpdateOptions{NoNew: true})
-	require.NoError(t, err)
-
-	// No new skills should be added.
-	assert.Empty(t, result.Added)
-	// Existing skills should be unchanged (same version).
-	assert.Len(t, result.Unchanged, 2)
-
-	// State should NOT include the new skill.
-	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
-	state, err := LoadState(globalDir)
-	require.NoError(t, err)
-	assert.NotContains(t, state.Skills, "databricks-notebooks")
-}
-
-func TestUpdateOutputSortedAlphabetically(t *testing.T) {
-	tmp := setupTestHome(t)
-	ctx := cmdio.MockDiscard(t.Context())
-	setupFetchMock(t)
-
-	// Install with skills.
-	src := &mockManifestSource{manifest: testManifest()}
-	agent := testAgent(tmp)
-	require.NoError(t, InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{}))
-
-	// Simulate a new release.
-	t.Setenv("DATABRICKS_SKILLS_REF", "v0.2.0")
-
-	// Update all skills.
-	updatedManifest := testManifest()
-	updatedManifest.Skills["databricks-sql"] = SkillMeta{Version: "0.2.0", Files: []string{"SKILL.md"}}
-	updatedManifest.Skills["databricks-jobs"] = SkillMeta{Version: "0.2.0", Files: []string{"SKILL.md"}}
-	src2 := &mockManifestSource{manifest: updatedManifest}
-
-	result, err := UpdateSkills(ctx, src2, []*agents.Agent{agent}, UpdateOptions{})
-	require.NoError(t, err)
-
-	require.Len(t, result.Updated, 2)
-	assert.Equal(t, "databricks-jobs", result.Updated[0].Name)
-	assert.Equal(t, "databricks-sql", result.Updated[1].Name)
-}
-
-func TestUpdateSkillRemovedFromManifestWarning(t *testing.T) {
-	tmp := setupTestHome(t)
-	ctx := cmdio.MockDiscard(t.Context())
-	setupFetchMock(t)
-
-	// Capture log output to verify warning.
-	var logBuf bytes.Buffer
-	logger := slog.New(slog.NewTextHandler(&logBuf, &slog.HandlerOptions{Level: slog.LevelWarn}))
-	ctx = log.NewContext(ctx, logger)
-
-	// Install with default ref.
-	src := &mockManifestSource{manifest: testManifest()}
-	agent := testAgent(tmp)
-	require.NoError(t, InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{}))
-
-	// Simulate a new release.
-	t.Setenv("DATABRICKS_SKILLS_REF", "v0.2.0")
-
-	// New manifest that removed databricks-jobs.
-	updatedManifest := &Manifest{
-		Version:   "1",
-		UpdatedAt: "2024-02-01",
-		Skills: map[string]SkillMeta{
-			"databricks-sql": {Version: "0.2.0", Files: []string{"SKILL.md"}},
-		},
-	}
-	src2 := &mockManifestSource{manifest: updatedManifest}
-
-	result, err := UpdateSkills(ctx, src2, []*agents.Agent{agent}, UpdateOptions{})
-	require.NoError(t, err)
-
-	// databricks-jobs should be kept as unchanged.
-	assert.Contains(t, result.Unchanged, "databricks-jobs")
-	// Warning should be logged.
-	assert.Contains(t, logBuf.String(), "databricks-jobs")
-	assert.Contains(t, logBuf.String(), "not found in manifest v0.2.0")
-
-	// State should still have databricks-jobs.
-	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
-	state, err := LoadState(globalDir)
-	require.NoError(t, err)
-	assert.Contains(t, state.Skills, "databricks-jobs")
-}
-
-func TestUpdateSkipsExperimentalSkills(t *testing.T) {
-	tmp := setupTestHome(t)
-	ctx := cmdio.MockDiscard(t.Context())
-	setupFetchMock(t)
-
-	// Install with default ref (not experimental).
-	src := &mockManifestSource{manifest: testManifest()}
-	agent := testAgent(tmp)
-	require.NoError(t, InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{}))
-
-	// Simulate a new release.
-	t.Setenv("DATABRICKS_SKILLS_REF", "v0.2.0")
-
-	// New manifest with an experimental skill.
-	updatedManifest := testManifest()
-	updatedManifest.Skills["databricks-experimental"] = SkillMeta{
-		Version:      "0.1.0",
-		Files:        []string{"SKILL.md"},
-		Experimental: true,
-	}
-	src2 := &mockManifestSource{manifest: updatedManifest}
-
-	result, err := UpdateSkills(ctx, src2, []*agents.Agent{agent}, UpdateOptions{})
-	require.NoError(t, err)
-
-	// Experimental skill should be skipped.
-	assert.Contains(t, result.Skipped, "databricks-experimental")
-	assert.Empty(t, result.Added)
-}
-
-func TestUpdateSkipsMinCLIVersionSkills(t *testing.T) {
-	tmp := setupTestHome(t)
-	ctx := cmdio.MockDiscard(t.Context())
-	setupFetchMock(t)
-	setBuildVersion(t, "0.200.0")
-
-	var logBuf bytes.Buffer
-	logger := slog.New(slog.NewTextHandler(&logBuf, &slog.HandlerOptions{Level: slog.LevelWarn}))
-	ctx = log.NewContext(ctx, logger)
-
-	// Install with default ref.
-	src := &mockManifestSource{manifest: testManifest()}
-	agent := testAgent(tmp)
-	require.NoError(t, InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{}))
-
-	// Simulate a new release.
-	t.Setenv("DATABRICKS_SKILLS_REF", "v0.2.0")
-
-	// New manifest with a skill requiring a newer CLI.
-	updatedManifest := testManifest()
-	updatedManifest.Skills["databricks-future"] = SkillMeta{
-		Version:   "0.1.0",
-		Files:     []string{"SKILL.md"},
-		MinCLIVer: "0.300.0",
-	}
-	src2 := &mockManifestSource{manifest: updatedManifest}
-
-	result, err := UpdateSkills(ctx, src2, []*agents.Agent{agent}, UpdateOptions{})
-	require.NoError(t, err)
-
-	assert.Contains(t, result.Skipped, "databricks-future")
-	assert.Contains(t, logBuf.String(), "requires CLI version 0.300.0")
-}
-
-func TestFormatUpdateResultCheckMode(t *testing.T) {
-	result := &UpdateResult{
-		Updated: []SkillUpdate{
-			{Name: "databricks-sql", OldVersion: "0.1.0", NewVersion: "0.2.0"},
-		},
-		Added: []SkillUpdate{
-			{Name: "databricks-notebooks", NewVersion: "0.1.0"},
-		},
-	}
-
-	output := FormatUpdateResult(result, false)
-	assert.Contains(t, output, "updated databricks-sql")
-	assert.Contains(t, output, "added databricks-notebooks")
-	assert.Contains(t, output, "Updated 2 skills.")
-
-	checkOutput := FormatUpdateResult(result, true)
-	assert.Contains(t, checkOutput, "would update databricks-sql")
-	assert.Contains(t, checkOutput, "would add databricks-notebooks")
-	assert.Contains(t, checkOutput, "Would update 2 skills.")
-}
diff --git a/experimental/aitools/lib/installer/version.go b/experimental/aitools/lib/installer/version.go
deleted file mode 100644
index 0e942ca0a95..00000000000
--- a/experimental/aitools/lib/installer/version.go
+++ /dev/null
@@ -1,14 +0,0 @@
-package installer
-
-import (
-	_ "embed"
-	"strings"
-)
-
-//go:embed SKILLS_VERSION
-var skillsVersionFile string
-
-// defaultSkillsRepoRef is the pinned tag of databricks/databricks-agent-skills.
-// It is sourced from the SKILLS_VERSION file so automation can bump the pin
-// with a single-line file edit instead of patching Go source.
-var defaultSkillsRepoRef = strings.TrimSpace(skillsVersionFile)
diff --git a/experimental/postgres/cmd/connect.go b/experimental/postgres/cmd/connect.go
index 0cc47c998a0..79e7545b152 100644
--- a/experimental/postgres/cmd/connect.go
+++ b/experimental/postgres/cmd/connect.go
@@ -156,8 +156,7 @@ func isRetryableConnectError(err error) bool {
 		return false
 	}
 
-	var pgErr *pgconn.PgError
-	if errors.As(err, &pgErr) {
+	if pgErr, ok := errors.AsType[*pgconn.PgError](err); ok {
 		switch {
 		// 08xxx is the connection_exception class.
 		case len(pgErr.Code) == 5 && pgErr.Code[:2] == "08":
@@ -169,13 +168,11 @@ func isRetryableConnectError(err error) bool {
 		}
 	}
 
-	var connectErr *pgconn.ConnectError
-	if errors.As(err, &connectErr) {
+	if connectErr, ok := errors.AsType[*pgconn.ConnectError](err); ok {
 		return isRetryableConnectError(connectErr.Unwrap())
 	}
 
-	var opErr *net.OpError
-	if errors.As(err, &opErr) {
+	if opErr, ok := errors.AsType[*net.OpError](err); ok {
 		return opErr.Op == "dial"
 	}
 
diff --git a/experimental/postgres/cmd/error.go b/experimental/postgres/cmd/error.go
index 02278a6c58b..5fdcf6eed99 100644
--- a/experimental/postgres/cmd/error.go
+++ b/experimental/postgres/cmd/error.go
@@ -17,8 +17,8 @@ import (
 // surface it directly. The richer LINE+caret rendering is out of scope for
 // this PR; we stick with the plain shape for now.
 func formatPgError(err error) string {
-	var pgErr *pgconn.PgError
-	if !errors.As(err, &pgErr) {
+	pgErr, ok := errors.AsType[*pgconn.PgError](err)
+	if !ok {
 		return err.Error()
 	}
 
diff --git a/experimental/postgres/cmd/execute.go b/experimental/postgres/cmd/execute.go
index 8d0b896031c..a4fe26ad820 100644
--- a/experimental/postgres/cmd/execute.go
+++ b/experimental/postgres/cmd/execute.go
@@ -20,7 +20,7 @@ type rowSink interface {
 	// Begin and uses pgx's Go type mapping (int64, float64, time.Time, ...).
 	Row(values []any) error
 	// End is called once on successful completion.
-	End(commandTag string) error
+	End(ctx context.Context, commandTag string) error
 	// OnError is called if iteration errors after Begin returned successfully.
 	// The sink is expected to flush any in-progress output structures so
 	// stdout remains well-formed. The caller still surfaces err to its caller.
@@ -74,5 +74,5 @@ func executeOne(ctx context.Context, conn *pgx.Conn, sql string, sink rowSink) e
 		return fmt.Errorf("query failed: %w", err)
 	}
 
-	return sink.End(rows.CommandTag().String())
+	return sink.End(ctx, rows.CommandTag().String())
 }
diff --git a/experimental/postgres/cmd/internal/target/provisioned.go b/experimental/postgres/cmd/internal/target/provisioned.go
index 786e86d2886..788f332337e 100644
--- a/experimental/postgres/cmd/internal/target/provisioned.go
+++ b/experimental/postgres/cmd/internal/target/provisioned.go
@@ -3,10 +3,10 @@ package target
 import (
 	"context"
 	"fmt"
+	"uuid"
 
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/service/database"
-	"github.com/google/uuid"
 )
 
 // GetProvisioned fetches a single provisioned instance by name.
@@ -28,7 +28,7 @@ func GetProvisioned(ctx context.Context, w *databricks.WorkspaceClient, name str
 func ProvisionedCredential(ctx context.Context, w *databricks.WorkspaceClient, instanceName string) (string, error) {
 	cred, err := w.Database.GenerateDatabaseCredential(ctx, database.GenerateDatabaseCredentialRequest{
 		InstanceNames: []string{instanceName},
-		RequestId:     uuid.NewString(),
+		RequestId:     uuid.New().String(),
 	})
 	if err != nil {
 		return "", fmt.Errorf("failed to get database credentials: %w", err)
diff --git a/experimental/postgres/cmd/query.go b/experimental/postgres/cmd/query.go
index ca28d6e84ac..53684423f52 100644
--- a/experimental/postgres/cmd/query.go
+++ b/experimental/postgres/cmd/query.go
@@ -235,7 +235,7 @@ func runQuery(ctx context.Context, cmd *cobra.Command, args []string, f queryFla
 		if err != nil {
 			// Render the successful prefix, then surface the error with
 			// rich pgError formatting if applicable.
-			if rerr := renderPartial(out, stderr, format, results, r, err); rerr != nil {
+			if rerr := renderPartial(ctx, out, stderr, format, results, r, err); rerr != nil {
 				// Best-effort partial render failed; surface the original
 				// error to the user, the renderer error to debug logs.
 				fmt.Fprintln(stderr, "warning: failed to render partial result:", rerr)
@@ -254,9 +254,9 @@ func runQuery(ctx context.Context, cmd *cobra.Command, args []string, f queryFla
 
 	switch format {
 	case sqlcli.OutputJSON:
-		return renderJSONMulti(out, stderr, results, nil, "")
+		return renderJSONMulti(ctx, out, stderr, results, nil, "")
 	default:
-		return renderTextMulti(out, results)
+		return renderTextMulti(ctx, out, results)
 	}
 }
 
@@ -312,14 +312,14 @@ func newSinkInteractive(format sqlcli.Format, out, stderr io.Writer, interactive
 // renderPartial emits the rendered output for the prefix of units that ran
 // successfully before a unit errored. For multi-input json this also writes
 // the error envelope as the last array element.
-func renderPartial(out, stderr io.Writer, format sqlcli.Format, results []*unitResult, errored *unitResult, err error) error {
+func renderPartial(ctx context.Context, out, stderr io.Writer, format sqlcli.Format, results []*unitResult, errored *unitResult, err error) error {
 	switch format {
 	case sqlcli.OutputJSON:
-		return renderJSONMulti(out, stderr, results, errored, formatPgError(err))
+		return renderJSONMulti(ctx, out, stderr, results, errored, formatPgError(err))
 	default:
 		// Text: render whatever ran cleanly. The error message goes through
 		// cobra's default error path on stderr after we return.
-		return renderTextMulti(out, results)
+		return renderTextMulti(ctx, out, results)
 	}
 }
 
diff --git a/experimental/postgres/cmd/render.go b/experimental/postgres/cmd/render.go
index 0d09556ece7..4d7ba1f884d 100644
--- a/experimental/postgres/cmd/render.go
+++ b/experimental/postgres/cmd/render.go
@@ -1,6 +1,7 @@
 package postgrescmd
 
 import (
+	"context"
 	"fmt"
 	"io"
 	"strings"
@@ -74,7 +75,7 @@ func escapeControlForTabwriter(s string) string {
 	return r.Replace(s)
 }
 
-func (s *textSink) End(commandTag string) error {
+func (s *textSink) End(ctx context.Context, commandTag string) error {
 	if len(s.columns) == 0 {
 		_, err := fmt.Fprintln(s.out, commandTag)
 		return err
@@ -85,7 +86,7 @@ func (s *textSink) End(commandTag string) error {
 		// resize race, etc.) fall through to the static path so the user
 		// still sees the rows their query returned. Without this fallback
 		// a successful query would surface as "viewer failed" with no data.
-		if err := tableview.Run(s.out, s.columns, s.rows); err == nil {
+		if err := tableview.Run(ctx, s.out, s.columns, s.rows); err == nil {
 			return nil
 		}
 	}
diff --git a/experimental/postgres/cmd/render_csv.go b/experimental/postgres/cmd/render_csv.go
index 940e11324f5..8b25657a1e1 100644
--- a/experimental/postgres/cmd/render_csv.go
+++ b/experimental/postgres/cmd/render_csv.go
@@ -1,6 +1,7 @@
 package postgrescmd
 
 import (
+	"context"
 	"encoding/csv"
 	"fmt"
 	"io"
@@ -63,7 +64,7 @@ func (s *csvSink) Row(values []any) error {
 	return s.w.Error()
 }
 
-func (s *csvSink) End(commandTag string) error {
+func (s *csvSink) End(ctx context.Context, commandTag string) error {
 	if !s.rowsProducing {
 		_, err := fmt.Fprintln(s.stderr, commandTag)
 		return err
diff --git a/experimental/postgres/cmd/render_csv_test.go b/experimental/postgres/cmd/render_csv_test.go
index 5a3ee277e2c..eccb685d3c0 100644
--- a/experimental/postgres/cmd/render_csv_test.go
+++ b/experimental/postgres/cmd/render_csv_test.go
@@ -14,7 +14,7 @@ func TestCSVSink_TwoRows(t *testing.T) {
 	require.NoError(t, s.Begin(fields("id", "name")))
 	require.NoError(t, s.Row([]any{int64(1), "alice"}))
 	require.NoError(t, s.Row([]any{int64(2), "bob"}))
-	require.NoError(t, s.End("SELECT 2"))
+	require.NoError(t, s.End(t.Context(), "SELECT 2"))
 
 	assert.Equal(t, "id,name\n1,alice\n2,bob\n", stdout.String())
 	assert.Empty(t, stderr.String())
@@ -25,7 +25,7 @@ func TestCSVSink_NULLEmptyField(t *testing.T) {
 	s := newCSVSink(&stdout, &stderr)
 	require.NoError(t, s.Begin(fields("id", "note")))
 	require.NoError(t, s.Row([]any{int64(1), nil}))
-	require.NoError(t, s.End("SELECT 1"))
+	require.NoError(t, s.End(t.Context(), "SELECT 1"))
 
 	assert.Equal(t, "id,note\n1,\n", stdout.String())
 }
@@ -34,7 +34,7 @@ func TestCSVSink_CommandOnly(t *testing.T) {
 	var stdout, stderr bytes.Buffer
 	s := newCSVSink(&stdout, &stderr)
 	require.NoError(t, s.Begin(nil))
-	require.NoError(t, s.End("CREATE DATABASE"))
+	require.NoError(t, s.End(t.Context(), "CREATE DATABASE"))
 	assert.Empty(t, stdout.String())
 	assert.Equal(t, "CREATE DATABASE\n", stderr.String())
 }
@@ -44,7 +44,7 @@ func TestCSVSink_QuotesFieldsWithCommas(t *testing.T) {
 	s := newCSVSink(&stdout, &stderr)
 	require.NoError(t, s.Begin(fields("note")))
 	require.NoError(t, s.Row([]any{"a,b"}))
-	require.NoError(t, s.End("SELECT 1"))
+	require.NoError(t, s.End(t.Context(), "SELECT 1"))
 	assert.Contains(t, stdout.String(), `"a,b"`)
 }
 
@@ -53,7 +53,7 @@ func TestCSVSink_EmbeddedNewlineAndQuote(t *testing.T) {
 	s := newCSVSink(&stdout, &stderr)
 	require.NoError(t, s.Begin(fields("note")))
 	require.NoError(t, s.Row([]any{"line1\nline2 \"quoted\""}))
-	require.NoError(t, s.End("SELECT 1"))
+	require.NoError(t, s.End(t.Context(), "SELECT 1"))
 	assert.Contains(t, stdout.String(), "\"line1\nline2 \"\"quoted\"\"\"")
 }
 
diff --git a/experimental/postgres/cmd/render_json.go b/experimental/postgres/cmd/render_json.go
index c50739e2d1f..d30edcfffcc 100644
--- a/experimental/postgres/cmd/render_json.go
+++ b/experimental/postgres/cmd/render_json.go
@@ -2,6 +2,7 @@ package postgrescmd
 
 import (
 	"bytes"
+	"context"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -145,7 +146,7 @@ func marshalJSON(v any) ([]byte, error) {
 	return bytes.TrimRight(buf.Bytes(), "\n"), nil
 }
 
-func (s *jsonSink) End(commandTag string) error {
+func (s *jsonSink) End(ctx context.Context, commandTag string) error {
 	if s.hasOpenedArray {
 		if s.rowsWritten == 0 {
 			// Empty result: collapse to "[]\n" rather than "[\n\n]\n".
diff --git a/experimental/postgres/cmd/render_json_test.go b/experimental/postgres/cmd/render_json_test.go
index 9cf386cb14d..99ed952d493 100644
--- a/experimental/postgres/cmd/render_json_test.go
+++ b/experimental/postgres/cmd/render_json_test.go
@@ -26,7 +26,7 @@ func TestJSONSink_TwoRows(t *testing.T) {
 	require.NoError(t, s.Begin(fieldsWithOIDs([]string{"id", "name"}, []uint32{pgtype.Int8OID, pgtype.TextOID})))
 	require.NoError(t, s.Row([]any{int64(1), "alice"}))
 	require.NoError(t, s.Row([]any{int64(2), "bob"}))
-	require.NoError(t, s.End("SELECT 2"))
+	require.NoError(t, s.End(t.Context(), "SELECT 2"))
 
 	assert.Equal(t,
 		"[\n"+
@@ -42,7 +42,7 @@ func TestJSONSink_EmptyRowsProducing(t *testing.T) {
 	var stdout, stderr bytes.Buffer
 	s := newJSONSink(&stdout, &stderr)
 	require.NoError(t, s.Begin(fieldsWithOIDs([]string{"id"}, []uint32{pgtype.Int8OID})))
-	require.NoError(t, s.End("SELECT 0"))
+	require.NoError(t, s.End(t.Context(), "SELECT 0"))
 	assert.Equal(t, "[\n]\n", stdout.String())
 }
 
@@ -51,7 +51,7 @@ func TestJSONSink_KeysInColumnOrder(t *testing.T) {
 	s := newJSONSink(&stdout, &stderr)
 	require.NoError(t, s.Begin(fieldsWithOIDs([]string{"b", "a"}, []uint32{pgtype.Int8OID, pgtype.Int8OID})))
 	require.NoError(t, s.Row([]any{int64(1), int64(2)}))
-	require.NoError(t, s.End("SELECT 1"))
+	require.NoError(t, s.End(t.Context(), "SELECT 1"))
 	assert.Equal(t, "[\n"+`{"b":1,"a":2}`+"\n]\n", stdout.String())
 }
 
@@ -59,7 +59,7 @@ func TestJSONSink_CommandOnly_WithRowCount(t *testing.T) {
 	var stdout, stderr bytes.Buffer
 	s := newJSONSink(&stdout, &stderr)
 	require.NoError(t, s.Begin(nil))
-	require.NoError(t, s.End("INSERT 0 5"))
+	require.NoError(t, s.End(t.Context(), "INSERT 0 5"))
 	// Byte-equal: pins the field order so adding a future field (e.g. last_oid)
 	// must update the test rather than silently drift.
 	assert.Equal(t, `{"command":"INSERT","rows_affected":5}`+"\n", stdout.String())
@@ -69,7 +69,7 @@ func TestJSONSink_CommandOnly_NoRowCount(t *testing.T) {
 	var stdout, stderr bytes.Buffer
 	s := newJSONSink(&stdout, &stderr)
 	require.NoError(t, s.Begin(nil))
-	require.NoError(t, s.End("CREATE DATABASE"))
+	require.NoError(t, s.End(t.Context(), "CREATE DATABASE"))
 	assert.Equal(t, `{"command":"CREATE"}`+"\n", stdout.String())
 }
 
@@ -78,7 +78,7 @@ func TestJSONSink_DuplicateColumns(t *testing.T) {
 	s := newJSONSink(&stdout, &stderr)
 	require.NoError(t, s.Begin(fieldsWithOIDs([]string{"id", "id", "id"}, []uint32{pgtype.Int8OID, pgtype.Int8OID, pgtype.Int8OID})))
 	require.NoError(t, s.Row([]any{int64(1), int64(2), int64(3)}))
-	require.NoError(t, s.End("SELECT 1"))
+	require.NoError(t, s.End(t.Context(), "SELECT 1"))
 
 	assert.Contains(t, stdout.String(), `"id":1`)
 	assert.Contains(t, stdout.String(), `"id__2":2`)
@@ -149,7 +149,7 @@ func TestJSONSink_DuplicateColumns_DoesNotCollideWithExistingSuffix(t *testing.T
 		[]uint32{pgtype.Int8OID, pgtype.Int8OID, pgtype.Int8OID},
 	)))
 	require.NoError(t, s.Row([]any{int64(1), int64(2), int64(3)}))
-	require.NoError(t, s.End("SELECT 1"))
+	require.NoError(t, s.End(t.Context(), "SELECT 1"))
 
 	// All three keys present with no duplicates.
 	out := stdout.String()
diff --git a/experimental/postgres/cmd/render_multi.go b/experimental/postgres/cmd/render_multi.go
index 2a2d7938163..5307786454f 100644
--- a/experimental/postgres/cmd/render_multi.go
+++ b/experimental/postgres/cmd/render_multi.go
@@ -2,6 +2,7 @@ package postgrescmd
 
 import (
 	"bytes"
+	"context"
 	"fmt"
 	"io"
 )
@@ -14,14 +15,14 @@ import (
 // errIndex/errResult identifies the unit that errored (-1 if none); we still
 // render any successful prefix. The error itself is surfaced by the caller
 // via cobra's default error rendering.
-func renderTextMulti(out io.Writer, results []*unitResult) error {
+func renderTextMulti(ctx context.Context, out io.Writer, results []*unitResult) error {
 	for i, r := range results {
 		if i > 0 {
 			if _, err := io.WriteString(out, "\n"); err != nil {
 				return err
 			}
 		}
-		if err := renderTextResult(out, r); err != nil {
+		if err := renderTextResult(ctx, out, r); err != nil {
 			return err
 		}
 	}
@@ -30,7 +31,7 @@ func renderTextMulti(out io.Writer, results []*unitResult) error {
 
 // renderTextResult renders a single buffered unitResult in the same shape as
 // textSink would for a streamed result.
-func renderTextResult(out io.Writer, r *unitResult) error {
+func renderTextResult(ctx context.Context, out io.Writer, r *unitResult) error {
 	if !r.IsRowsProducing() {
 		_, err := fmt.Fprintln(out, r.CommandTag)
 		return err
@@ -47,7 +48,7 @@ func renderTextResult(out io.Writer, r *unitResult) error {
 			return err
 		}
 	}
-	return sink.End(r.CommandTag)
+	return sink.End(ctx, r.CommandTag)
 }
 
 // renderJSONMulti emits the wrapped multi-input JSON shape: a top-level
@@ -68,7 +69,7 @@ func renderTextResult(out io.Writer, r *unitResult) error {
 //
 // elapsed_ms is present on errors too: it captures how long the failing
 // statement ran before the error fired.
-func renderJSONMulti(out, stderr io.Writer, results []*unitResult, errored *unitResult, errMessage string) error {
+func renderJSONMulti(ctx context.Context, out, stderr io.Writer, results []*unitResult, errored *unitResult, errMessage string) error {
 	if _, err := io.WriteString(out, "[\n"); err != nil {
 		return err
 	}
@@ -80,7 +81,7 @@ func renderJSONMulti(out, stderr io.Writer, results []*unitResult, errored *unit
 			}
 		}
 		var unitBuf bytes.Buffer
-		if err := renderJSONUnit(&unitBuf, stderr, r); err != nil {
+		if err := renderJSONUnit(ctx, &unitBuf, stderr, r); err != nil {
 			return err
 		}
 		if _, err := out.Write(unitBuf.Bytes()); err != nil {
@@ -107,7 +108,7 @@ func renderJSONMulti(out, stderr io.Writer, results []*unitResult, errored *unit
 // renderJSONUnit writes one buffered result object to buf, using the
 // existing single-input json rendering for the rows array so the value
 // mapping stays consistent across single- and multi-input shapes.
-func renderJSONUnit(buf *bytes.Buffer, stderr io.Writer, r *unitResult) error {
+func renderJSONUnit(ctx context.Context, buf *bytes.Buffer, stderr io.Writer, r *unitResult) error {
 	if err := writeJSONUnitHeader(buf, r); err != nil {
 		return err
 	}
@@ -143,7 +144,7 @@ func renderJSONUnit(buf *bytes.Buffer, stderr io.Writer, r *unitResult) error {
 			return err
 		}
 	}
-	if err := sink.End(""); err != nil {
+	if err := sink.End(ctx, ""); err != nil {
 		return err
 	}
 	rowsTrimmed := bytes.TrimRight(rowsBuf.Bytes(), "\n")
diff --git a/experimental/postgres/cmd/render_multi_test.go b/experimental/postgres/cmd/render_multi_test.go
index b4e96f73eb8..269bb537ccd 100644
--- a/experimental/postgres/cmd/render_multi_test.go
+++ b/experimental/postgres/cmd/render_multi_test.go
@@ -27,7 +27,7 @@ func TestRenderTextMulti_TwoResults(t *testing.T) {
 	}
 
 	var buf bytes.Buffer
-	require.NoError(t, renderTextMulti(&buf, []*unitResult{r1, r2}))
+	require.NoError(t, renderTextMulti(t.Context(), &buf, []*unitResult{r1, r2}))
 	out := buf.String()
 	assert.Contains(t, out, "INSERT 0 1\n")
 	assert.Contains(t, out, "id")
@@ -53,7 +53,7 @@ func TestRenderJSONMulti_TwoResults(t *testing.T) {
 	}
 
 	var stdout, stderr bytes.Buffer
-	require.NoError(t, renderJSONMulti(&stdout, &stderr, []*unitResult{r1, r2}, nil, ""))
+	require.NoError(t, renderJSONMulti(t.Context(), &stdout, &stderr, []*unitResult{r1, r2}, nil, ""))
 
 	out := stdout.String()
 	// Canonical key order: source, sql, kind, elapsed_ms, payload.
@@ -81,7 +81,7 @@ func TestRenderJSONMulti_WithErrorAtEnd(t *testing.T) {
 	}
 
 	var stdout, stderr bytes.Buffer
-	require.NoError(t, renderJSONMulti(&stdout, &stderr, []*unitResult{r1}, errored, "ERROR: syntax error (SQLSTATE 42601)"))
+	require.NoError(t, renderJSONMulti(t.Context(), &stdout, &stderr, []*unitResult{r1}, errored, "ERROR: syntax error (SQLSTATE 42601)"))
 
 	out := stdout.String()
 	assert.Contains(t, out, `"kind":"rows"`)
@@ -96,7 +96,7 @@ func TestRenderJSONMulti_FirstUnitFails(t *testing.T) {
 		Elapsed: 7 * time.Millisecond,
 	}
 	var stdout, stderr bytes.Buffer
-	require.NoError(t, renderJSONMulti(&stdout, &stderr, nil, errored, "ERROR: bad"))
+	require.NoError(t, renderJSONMulti(t.Context(), &stdout, &stderr, nil, errored, "ERROR: bad"))
 
 	out := stdout.String()
 	// No leading separator before the single error envelope.
diff --git a/experimental/postgres/cmd/render_test.go b/experimental/postgres/cmd/render_test.go
index bdd2bddd4f6..9b222ef123f 100644
--- a/experimental/postgres/cmd/render_test.go
+++ b/experimental/postgres/cmd/render_test.go
@@ -26,7 +26,7 @@ func TestTextSink_RowsProducing(t *testing.T) {
 	require.NoError(t, s.Begin(fields("id", "name")))
 	require.NoError(t, s.Row([]any{int64(1), "alice"}))
 	require.NoError(t, s.Row([]any{int64(2), "bob"}))
-	require.NoError(t, s.End("SELECT 2"))
+	require.NoError(t, s.End(t.Context(), "SELECT 2"))
 
 	assert.Equal(t,
 		"id   name\n"+
@@ -43,7 +43,7 @@ func TestTextSink_SingleRow(t *testing.T) {
 	s := newTextSink(&buf)
 	require.NoError(t, s.Begin(fields("id")))
 	require.NoError(t, s.Row([]any{int64(42)}))
-	require.NoError(t, s.End("SELECT 1"))
+	require.NoError(t, s.End(t.Context(), "SELECT 1"))
 	assert.Contains(t, buf.String(), "(1 row)\n")
 }
 
@@ -51,7 +51,7 @@ func TestTextSink_Empty(t *testing.T) {
 	var buf bytes.Buffer
 	s := newTextSink(&buf)
 	require.NoError(t, s.Begin(fields("id", "name")))
-	require.NoError(t, s.End("SELECT 0"))
+	require.NoError(t, s.End(t.Context(), "SELECT 0"))
 	assert.Contains(t, buf.String(), "(0 rows)\n")
 }
 
@@ -59,7 +59,7 @@ func TestTextSink_CommandOnly(t *testing.T) {
 	var buf bytes.Buffer
 	s := newTextSink(&buf)
 	require.NoError(t, s.Begin(nil))
-	require.NoError(t, s.End("INSERT 0 5"))
+	require.NoError(t, s.End(t.Context(), "INSERT 0 5"))
 	assert.Equal(t, "INSERT 0 5\n", buf.String())
 }
 
@@ -68,7 +68,7 @@ func TestTextSink_NULLRendersAsNULL(t *testing.T) {
 	s := newTextSink(&buf)
 	require.NoError(t, s.Begin(fields("id")))
 	require.NoError(t, s.Row([]any{nil}))
-	require.NoError(t, s.End("SELECT 1"))
+	require.NoError(t, s.End(t.Context(), "SELECT 1"))
 	assert.Contains(t, buf.String(), "NULL")
 }
 
@@ -89,7 +89,7 @@ func TestTextSink_EscapesTabAndNewlineInCells(t *testing.T) {
 	s := newTextSink(&buf)
 	require.NoError(t, s.Begin(fields("note")))
 	require.NoError(t, s.Row([]any{"a\tb\nc\rd"}))
-	require.NoError(t, s.End("SELECT 1"))
+	require.NoError(t, s.End(t.Context(), "SELECT 1"))
 	// The escape replaces tabs/newlines/CR with their backslash-letter forms
 	// so the tabwriter doesn't treat them as column or row boundaries.
 	assert.Contains(t, buf.String(), `a\tb\nc\rd`)
diff --git a/experimental/postgres/cmd/result.go b/experimental/postgres/cmd/result.go
index 40267260af1..d5a0826d4c4 100644
--- a/experimental/postgres/cmd/result.go
+++ b/experimental/postgres/cmd/result.go
@@ -68,7 +68,7 @@ func (s *bufferSink) Row(values []any) error {
 	return nil
 }
 
-func (s *bufferSink) End(commandTag string) error {
+func (s *bufferSink) End(ctx context.Context, commandTag string) error {
 	s.result.CommandTag = commandTag
 	return nil
 }
diff --git a/experimental/postgres/cmd/result_test.go b/experimental/postgres/cmd/result_test.go
index 22872d3bbd4..b61d7f6236f 100644
--- a/experimental/postgres/cmd/result_test.go
+++ b/experimental/postgres/cmd/result_test.go
@@ -34,7 +34,7 @@ func TestBufferSink_RowAndEnd(t *testing.T) {
 	require.NoError(t, s.Begin([]pgconn.FieldDescription{{Name: "a"}}))
 	require.NoError(t, s.Row([]any{int64(1)}))
 	require.NoError(t, s.Row([]any{int64(2)}))
-	require.NoError(t, s.End("SELECT 2"))
+	require.NoError(t, s.End(t.Context(), "SELECT 2"))
 
 	assert.Equal(t, [][]any{{int64(1)}, {int64(2)}}, r.Rows)
 	assert.Equal(t, "SELECT 2", r.CommandTag)
diff --git a/experimental/postgres/cmd/targeting.go b/experimental/postgres/cmd/targeting.go
index 6d04055cb22..cf1290ad578 100644
--- a/experimental/postgres/cmd/targeting.go
+++ b/experimental/postgres/cmd/targeting.go
@@ -9,6 +9,7 @@ import (
 	"github.com/databricks/cli/libs/cmdctx"
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/service/database"
+	"github.com/databricks/databricks-sdk-go/service/iam"
 	"github.com/databricks/databricks-sdk-go/service/postgres"
 )
 
@@ -113,7 +114,7 @@ func resolveProvisioned(ctx context.Context, w *databricks.WorkspaceClient, inst
 		return nil, fmt.Errorf("database instance %q is not ready for accepting connections (state: %s)", instance.Name, instance.State)
 	}
 
-	user, err := w.CurrentUser.Me(ctx)
+	user, err := w.CurrentUser.Me(ctx, iam.MeRequest{})
 	if err != nil {
 		return nil, fmt.Errorf("failed to get current user: %w", err)
 	}
@@ -174,7 +175,7 @@ func resolveAutoscaling(ctx context.Context, w *databricks.WorkspaceClient, spec
 		return nil, err
 	}
 
-	user, err := w.CurrentUser.Me(ctx)
+	user, err := w.CurrentUser.Me(ctx, iam.MeRequest{})
 	if err != nil {
 		return nil, fmt.Errorf("failed to get current user: %w", err)
 	}
diff --git a/experimental/ssh/AGENTS.md b/experimental/ssh/AGENTS.md
new file mode 100644
index 00000000000..65ac22ee98a
--- /dev/null
+++ b/experimental/ssh/AGENTS.md
@@ -0,0 +1,49 @@
+# Working on `experimental/ssh`
+
+This file provides guidance to AI assistants working on the SSH tunnel. See the
+repository root `AGENTS.md` for project-wide rules.
+
+## Testing an `ssh connect` change against real compute
+
+The binary uploaded to the cluster **is** the server: `ssh connect` uploads the
+local `databricks` CLI and runs it in server mode on the compute. So a fix only
+takes effect if the binary you upload actually contains it. Several ways to
+silently test stale code — verify each before trusting a result:
+
+**RULE: Confirm the binary you run is built from your current checkout.** When a
+fix lives on a branch (or a git worktree), building or running `./cli` from a
+different directory compiles unrelated code. The connection still succeeds and
+looks correct, but the server runs the wrong binary. Before connecting:
+
+```sh
+go build -o ./cli . && ./cli version
+git rev-parse --short HEAD   # the 0.0.0-dev+<sha> suffix must match this
+```
+
+If the version suffix doesn't match `HEAD`, you are running old code — stop and
+rebuild from the right directory.
+
+**RULE: For `--releases-dir`, build with `./task snapshot-release`, not `./task build`.**
+`./task build` produces only `./cli`; it does not populate `./dist`. The tunnel's
+`--releases-dir` loader expects `dist/databricks_cli_linux_{amd64,arm64}.zip`
+(see `getLocalRelease` in `internal/client/releases.go`). With a stale or empty
+`./dist`, the upload finds nothing new and the cluster reuses an older binary.
+Confirm the archive carries your change before uploading, e.g.:
+
+```sh
+unzip -p ./dist/databricks_cli_linux_amd64.zip databricks | strings | grep <a-string-your-change-adds>
+```
+
+**RULE: Start a fresh server after rebuilding.** `uploadReleases`
+(`internal/client/releases.go`) always re-uploads dev and snapshot builds, but
+`connect` reuses a server that is already running for the same version, and that
+server still runs the previous binary. Connect with a fresh `--name` on serverless,
+or a fresh cluster on dedicated.
+
+## Server vs. session
+
+The server process and the interactive login session run as the same OS user with
+the same `$HOME` on serverless compute (CPU and GPU alike). When a session-level
+symptom (wrong `PATH`, a file not seeded, etc.) appears only on one compute type,
+check the binary version first — it is far more often a stale upload than a
+genuine per-compute difference.
diff --git a/experimental/ssh/FAILURE_MODES.md b/experimental/ssh/FAILURE_MODES.md
new file mode 100644
index 00000000000..fd28c81bcba
--- /dev/null
+++ b/experimental/ssh/FAILURE_MODES.md
@@ -0,0 +1,190 @@
+# Reproducing `databricks ssh connect` failure modes
+
+This guide documents container/cluster misconfigurations that make `databricks ssh connect`
+fail, how to reproduce each one, the symptom the user sees, and where the real error lives. It
+is primarily a testing aid for the SSH feature's error-handling paths.
+
+For the connection flow and architecture, see [README.md](./README.md).
+
+## Background: where failures surface
+
+The bootstrap is a **Python notebook job** that starts `databricks ssh server` on the cluster.
+The server publishes its port to the workspace (`metadata.json`), the client reads it, prints
+`Connected!`, and spawns `ssh`. The SSH daemon (`/usr/sbin/sshd`) is launched **lazily, per
+client connection** (see `internal/server/sshd.go` and `internal/proxy/server.go`). Because of
+this ordering, different misconfigurations fail at different stages:
+
+| Stage | Needs | Failure mode if missing |
+| --- | --- | --- |
+| Bootstrap job runs | a working Databricks **Python** runtime in the image | [Mode 2](#mode-2-container-cant-run-the-python-bootstrap) |
+| Per-connection SSH | **`/usr/sbin/sshd`** (OpenSSH server) in the image | [Mode 1](#mode-1-container-missing-the-openssh-server-sshd) |
+
+## Prerequisites
+
+- A workspace with **Databricks Container Services** (custom Docker images) enabled.
+- Permission to create a **dedicated (single-user)** cluster.
+- A dev build of the CLI. See the *Development* section of [README.md](./README.md):
+  ```shell
+  ./task build snapshot-release
+  ./cli ssh connect --cluster=<cluster-id> --releases-dir=./dist --debug
+  ```
+- A container registry the workspace can pull from (e.g. a public Docker Hub repo) to host the
+  test images below. Build them for the cluster's architecture (`linux/amd64` on most clouds):
+  ```shell
+  docker buildx build --platform linux/amd64 -t <namespace>/<image>:<tag> --push .
+  ```
+
+The cluster specs below use a single-node dedicated cluster. Adjust `node_type_id` and
+`spark_version` for your cloud and DBR version:
+
+```json
+{
+  "cluster_name": "ssh-failure-repro",
+  "spark_version": "16.4.x-scala2.12",
+  "node_type_id": "<your-cloud-node-type>",
+  "num_workers": 0,
+  "data_security_mode": "SINGLE_USER",
+  "single_user_name": "<you@example.com>",
+  "spark_conf": { "spark.databricks.cluster.profile": "singleNode", "spark.master": "local[*, 4]" },
+  "custom_tags": { "ResourceClass": "SingleNode" },
+  "autotermination_minutes": 60,
+  "docker_image": { "url": "<namespace>/<image>:<tag>" }
+}
+```
+
+Create it with `databricks clusters create --json @cluster.json --no-wait` and wait for the
+`RUNNING` state (a custom-container pull can take several minutes).
+
+## Mode 1: container missing the OpenSSH server (`sshd`)
+
+A notebook-capable image that does **not** ship `openssh-server`. Build it by removing the SSH
+server from an image that otherwise works:
+
+```dockerfile
+FROM databricksruntime/standard:16.4-LTS
+RUN (apt-get remove -y openssh-server || true) \
+    && rm -f /usr/sbin/sshd /usr/bin/sshd
+```
+
+Create a cluster on this image, then:
+
+```shell
+./cli ssh connect --cluster=<cluster-id> --releases-dir=./dist
+```
+
+**Symptom.** The bootstrap job succeeds and publishes metadata, so the client prints
+`Connected!` — and then the connection drops. The server can't launch `/usr/sbin/sshd` for the
+incoming connection and holds the websocket open, so historically the `ssh` client **hung**
+until its `ConnectTimeout`. The real error,
+`failed to start SSHD process: ... /usr/sbin/sshd: no such file or directory`, is only written
+to the bootstrap job's **stdout logs** while the job is still `RUNNING` — it is never a failed
+job state.
+
+**With the error-handling improvements** the client aborts after a handshake timeout (no SSH
+banner from the server) with an actionable hint to install `openssh-server`, and exits
+promptly instead of hanging. The server also keeps its recent warning/error log lines in
+memory and serves them at `/logs` (next to `/metadata`); when `ssh` exits with a
+connection-level failure (code 255), the client fetches that endpoint and prints the server's
+actual errors in the terminal — the job keeps running throughout.
+
+**Fix.** Install `openssh-server` in the image (`apt-get install -y openssh-server`).
+
+## Mode 2: container can't run the Python bootstrap
+
+A bare/minimal base that lacks a working Databricks Python runtime. The simplest example is
+`databricksruntime/rbase:16.4-LTS` used directly as the cluster image (it is an R *base* layer;
+notably it has no functioning `/databricks/python` notebook-execution environment).
+
+Create a cluster on `databricksruntime/rbase:16.4-LTS`, then:
+
+```shell
+./cli ssh connect --cluster=<cluster-id> --releases-dir=./dist
+```
+
+**Symptom.** The bootstrap is a Python notebook, but the image can't execute notebook commands,
+so the job fails with `Could not reach driver of cluster <id>`. The SSH server never starts and
+never publishes metadata, so the client fails with
+`server metadata error / ... metadata.json doesn't exist` — **before** the `sshd` step is ever
+reached. (A trivial `print(...)` notebook job submitted to the same cluster fails the same way,
+which is a quick way to confirm the image, not the SSH feature, is at fault.)
+
+**With the error-handling improvements** the client fetches the failed run's state message,
+notebook error/trace, and run-page URL and shows them instead of the generic metadata error.
+
+**Fix.** Build on a notebook-capable base (e.g. `databricksruntime/standard:...`) or otherwise
+provide a working Databricks Python environment, in addition to `openssh-server`.
+
+## Working control
+
+`databricksruntime/standard:16.4-LTS` ships **both** a working Python runtime **and** `sshd`,
+so `ssh connect` to a cluster on it succeeds end to end. Use it as a baseline to confirm your
+workspace, cluster spec, and dev build are healthy before reproducing a failure mode.
+
+## Inspecting the bootstrap job logs
+
+`ssh connect` prints `Job submitted successfully with run ID: <id>`. Inspect it with:
+
+```shell
+databricks jobs get-run <id>              # open run_page_url in the UI
+databricks jobs get-run-output <task-run-id>   # task-run-id = .tasks[0].run_id of the run
+```
+
+Caveat: for a **running** server task, `get-run-output`'s `logs`/`error` are not populated —
+the `sshd` error from [Mode 1](#mode-1-container-missing-the-openssh-server-sshd) lives in the
+live notebook cell stdout / driver logs, not the Jobs run-output API. A failed run from
+[Mode 2](#mode-2-container-cant-run-the-python-bootstrap) does populate the run's state message
+and error.
+
+When the `databricks ssh server` process itself exits non-zero (a third shape, distinct from
+the modes above: e.g. bad arguments or a startup crash), the bootstrap notebook tees the
+server's stdout/stderr and fails the run with the last ~2000 bytes of server logs embedded in
+the raised exception — `ssh connect` prints that tail via the failed-run path, so the cause is
+visible without opening the run page.
+
+## Reproducing locally, without a workspace
+
+The proxy-layer behaviors have unit tests that don't need a cluster:
+
+- `internal/proxy/client_server_test.go`
+  - `TestClientExitsWhenServerCommandFails` — server can't launch its command and closes the
+    connection; the client exits promptly.
+  - `TestClientTimesOutWhenServerSendsNothing` — server holds the connection open and sends
+    nothing (the Mode 1 shape); the client aborts on the handshake timeout.
+- `internal/client/client_internal_test.go` — formatting of a failed bootstrap run's error
+  (state message, error trace, run-page URL) using SDK mocks.
+
+```shell
+go test ./experimental/ssh/...
+```
+
+## Filesystem access after the bootstrap notebook exits
+
+If SSH still connects but `/Workspace` or `/Volumes` operations return permission errors,
+check whether the tunnel server registered successfully. Its startup logs contain
+`Registered SSH server PID` for each filesystem daemon that accepted registration.
+`Failed to register SSH filesystem credentials` means at least one registration failed;
+the tunnel continues to run and retries in the background.
+
+From an SSH session, read the process used for workspace-file authorization:
+
+```sh
+cat /Workspace/.proc/self/metadata/pid
+ps -o pid,ppid,args -p <registered-pid>
+```
+
+On dedicated compute, the reported PID should identify the tunnel server. If it identifies
+the bootstrap Python process, workspace-file access still depends on that process.
+The server checks this every 60 seconds and attempts to restore a lost registration.
+Volume registration is refreshed every 60 seconds, independently of this workspace-file check.
+An unavailable daemon produces a warning rather than preventing SSH startup.
+
+On serverless, the server does not register. Its startup logs contain
+`Skipping SSH filesystem registration on serverless` instead, and
+`/Workspace/.proc/self/metadata/pid` naming the bootstrap REPL is expected: that process
+anchors filesystem access for the whole session.
+
+This registration only covers the server and its descendants. A detached process that
+leaves that ancestry can still lose access. The compute can also terminate the server
+after the bootstrap notebook exits; registration does not extend either lifetime.
+An expired or revoked bootstrap credential cannot be repaired by re-registering it.
+In these cases, reconnect to start a new server after the existing server has stopped.
diff --git a/experimental/ssh/README.md b/experimental/ssh/README.md
index 40b553d4bff..67e8042fbef 100644
--- a/experimental/ssh/README.md
+++ b/experimental/ssh/README.md
@@ -3,8 +3,13 @@
 The SSH tunnel lets customers connect any IDE to Databricks compute to run and debug all code - including non-Spark/ML - with environment parity, and simple setup.
 
 ## Compute Requirements
-- Dedicated (single user) access mode if you want to use Remote Development tools in IDEs
-- Dedicated or standard access mode for terminal SSH connections
+- Serverless compute, which is the default when `--cluster` is omitted, or
+- A cluster in Dedicated access mode assigned to a single user, not to a group.
+
+`ValidateClusterAccess` (`internal/client/client.go`) rejects every other access mode up front,
+for terminal SSH sessions as well as for IDE Remote Development: the tunnel runs as a job that
+attaches as a single user. Standard access mode (`USER_ISOLATION`), Dedicated-to-a-group, and
+no-isolation clusters all fail with `cluster '<id>' must be a dedicated single-user cluster`.
 
 ## Usage
 A. With local ssh config setup:
@@ -17,12 +22,107 @@ B. Spawn an ssh session directly:
 databricks ssh connect --cluster=id
 ```
 
+### Connection names and host keys
+
+`--name` is a stable handle for serverless compute, not a live session id: connecting with a
+name reuses the SSH server still running under it, and starts a new one on the same name once
+the previous server has shut down (`--shutdown-delay` after its last client disconnects).
+
+Both cases verify the server's host key. The server generates the key on first use, keeps it in
+the connection's secret scope in the workspace and reuses it for every `sshd` it launches, so
+the workspace is the authority on the key. The client reads it from there and pins it in
+`~/.databricks/ssh-tunnel-known-hosts/<name>` before each connection, and points ssh at that
+file with `StrictHostKeyChecking yes`. Tunnel host keys therefore never land in
+`~/.ssh/known_hosts`, where a name - unique only within one workspace - would collide with an
+entry left by other compute.
+
+### Filesystem access
+
+On dedicated compute, the tunnel server registers its own process with the filesystem
+daemons. SSH sessions that remain descendants of that server can keep accessing
+`/Workspace` and `/Volumes` if the bootstrap notebook exits and the server survives.
+This does not keep the compute or server alive, preserve detached processes that leave
+the server's process tree, or restore them after a server restart.
+
+The server checks its workspace-file registration and current credential every 60 seconds.
+It updates the workspace-file registration when the credential changes or the registered
+process is lost, and retries failed registrations. Unchanged workspace-file registrations
+do not generate updates. Volume registration is refreshed on every tick so it recovers
+after an independent UC-FUSE restart.
+The bootstrap supplies a fixed credential; checking it again cannot renew an expired or
+revoked credential. Registration entries may remain until compute shutdown. Matching
+the process start time prevents a reused PID from inheriting an old registration.
+
+Registration failures are warnings. On compute where the daemon APIs are unavailable,
+the tunnel starts and file access continues to depend on the bootstrap notebook as before.
+
+On serverless, the server skips registration entirely: non-root sessions are firewalled off
+the daemon ports, so every attempt would fail. `/Workspace` and `/Volumes` access comes from
+the bootstrap REPL's own registration, which covers the server and its descendants. The
+container is torn down about 35-60 seconds after the REPL exits, so nothing outlives the
+bootstrap run. The server logs one line at startup saying registration was skipped.
+
+When the current-user lookup succeeds, registration also includes the workspace home
+directory so workspace files can prepopulate its directory cache. This does not change the
+session's working directory or filesystem permissions.
+See [filesystem troubleshooting](./FAILURE_MODES.md#filesystem-access-after-the-bootstrap-notebook-exits).
+
 ## Development
+
 ```shell
 ./task build snapshot-release
 ./cli ssh connect --cluster=<id> --releases-dir=./dist --debug # or modify ssh config accordingly
 ```
 
+To reproduce and test the known `ssh connect` failure modes (container missing `sshd`, or a
+container that can't run the Python bootstrap), see [FAILURE_MODES.md](./FAILURE_MODES.md).
+
+## Keeping detached processes alive
+
+By default nothing outlives the session: when the last client disconnects, the server shuts
+down after `--shutdown-delay` and the bootstrap notebook sweeps every process it parents,
+including work that was deliberately detached with `tmux`, `setsid` or `nohup`.
+
+`--keep-detached-processes` prevents idle shutdown while detached work is still running.
+It works with dedicated clusters and serverless compute:
+
+```sh
+databricks ssh connect --cluster=<id> --keep-detached-processes
+databricks ssh connect --name=my-session --keep-detached-processes
+```
+
+When `--shutdown-delay` elapses with no SSH clients, the server checks for detached processes.
+If it finds any, it stays available for reconnection and checks again every 15 seconds.
+Once no detached work remains, it shuts down. A reconnect cancels the pending check; after
+the last client disconnects again, the full `--shutdown-delay` applies again. If the process
+tree cannot be read, the server postpones shutdown and retries rather than risking the work.
+
+- **It keeps compute running.** On dedicated clusters the active job also
+  suppresses autotermination. An idle `tmux` session counts as detached work even after the
+  command in its pane finishes; close the session when you no longer need it.
+- **Reconnect to the same session.** Use the same cluster ID or serverless connection name.
+  The existing server and notebook remain alive, so a reconnect can attach to the original
+  `tmux` session rather than creating a replacement run.
+- **The maximum lifetime still applies.** `--server-timeout` (24h by default) bounds the job
+  from its start, regardless of connected clients or detached work. The flag does not
+  survive a job cancellation, notebook restart, or compute termination. Multi-day work
+  belongs in Jobs/DABs.
+- **The notebook must remain alive too.** It anchors the detached processes' workspace
+  filesystem access. If the SSH server exits for another reason, the bootstrap still
+  preserves detached work and holds the run open, as before. This fallback preserves work,
+  not SSH access: it does not restart the server inside that run.
+
+`databricks ssh setup` takes the same flag and bakes it into the host's `ProxyCommand`, so
+`ssh <name>` sessions ask for it too. That is the only place a configured host can set it: the
+`ProxyCommand` is the invocation that submits the run, and the mode is fixed at submission.
+
+A reconnect that omits the flag reuses a running server that was started with it, hold
+included, so a session that never asked for it can end up holding the cluster open. Asking for
+it against a server that was started without it starts a fresh server instead.
+
+When the flag is *not* set and the server does find detached processes at teardown, it logs a
+warning naming them, so work that is about to be swept is no longer lost silently.
+
 ## Design
 
 High level:
@@ -33,36 +133,35 @@ config:
   layout: dagre
 ---
 flowchart TD
- n1(["Client A"])
+ n1(["Client"])
  subgraph s1["Control Plane"]
         n3["Jobs API"]
         n2["Driver Proxy API"]
         n11["Workspace API"]
+        n13["Secrets API"]
   end
- subgraph s3["Spark User A or root"]
-        n4["SSH Server A"]
-  end
- subgraph s4["Spark User B or root"]
-        n6["SSH Server B"]
+ subgraph s2["Compute - dedicated single user, or root"]
+        n4["SSH Server"]
+        n7["sshd, one process per connection"]
   end
- subgraph s2["Cluster"]
-        s3
-        s4
-        n12["Workspace Filesystem"]
-  end
-    n1 -. "1 - start an ssh server job" .-> n3
-    n3 -. "2 - start ssh server" .-> n4
-    n4 <-. "3 - save the ssh server port number" .-> n12
-    n1 <-. "4 - get ssh server port number" .-> n11
-    n1 <-. "6 - websocket connection" .-> n2
-    n2 <-. "7 - websocket connection" .-> n4
-    n6 <-.-> n12
+    n1 -. "1 - store the client key pair" .-> n13
+    n1 -. "2 - upload the CLI binary" .-> n11
+    n1 -. "3 - start an ssh server job" .-> n3
+    n3 -. "4 - start ssh server" .-> n4
+    n4 -. "5 - read the client public key and store the host key" .-> n13
+    n4 -. "6 - publish the ssh server port number" .-> n11
+    n1 -. "7 - get the ssh server port number" .-> n11
+    n1 <-. "8 - websocket connection" .-> n2
+    n2 <-. "9 - websocket connection" .-> n4
+    n4 <-. "10 - stdio" .-> n7
     style s2 stroke:#757575
     style s1 stroke:#757575
-    style s4 stroke-dasharray: 5 5
-    style n6 stroke-dasharray: 5 5
 ```
 
+The client public key reaches the server through a secret scope rather than through the
+bootstrap notebook, and the server host key is persisted in the same scope so its fingerprint
+survives a restart - which is what makes `StrictHostKeyChecking accept-new` safe here.
+
 Connection flow:
 ```mermaid
 ---
@@ -74,36 +173,39 @@ sequenceDiagram
   participant P1 as databricks ssh connect
   participant P2 as ssh client
   participant P3 as databricks ssh connect --proxy
-  participant P4 as wsfs
+  participant P4 as workspace api
+  participant P5 as secrets api
   participant P6 as databricks ssh server
   participant P7 as sshd
-  Note over P1,P6: Try to get a port and a remote user name of an existing server<br/> ($v is databricks CLI version, $cluster is supplied by the user)
+  Note over P1,P6: Try to get a port and a remote user name of an existing server.<br/>$v is the databricks CLI version. $s is the session id:<br/>the cluster id, or the --name value for serverless.
   activate P1
-  P1 ->> P4: GET ~/.ssh/$v/$cluster/metadata.json
-  P4 -->> P1: {port: xxxx} or error
-  P1 ->> P6: GET /driver-proxy-api/$cluster/$port/metadata
-  P6 -->> P1: {user: spark-xxxx} or {user: root} or error
-  Note over P1,P6: Start the new server in the case of an error
+  P1 ->> P4: GET /Workspace/Users/$me/.databricks/ssh-tunnel/$v/$s/metadata.json
+  P4 -->> P1: {port, cluster_id, usage_policy_id} or error
+  P1 ->> P6: GET /driver-proxy-api/o/$workspaceId/$cluster/$port/metadata
+  P6 -->> P1: the OS user the server runs as - root - or error
+  Note over P1,P6: Start a new server if either step failed, or if the<br/>running one was started under a different usage policy.
   opt
-    P1 -->> P1: generate<br/>key pair
-    P1 -->> P4: PUT ~/.ssh/$v/bin/databricks, unless it's already there
-    P1 ->> P4: PUT ~/.ssh/$v/$cluster/start-server-with-pub-key.ipynb
-    P1 ->> P6: jobs/runs/submit start-server-with-pub-key.ipynb $cluster
+    P1 ->> P5: create scope $me-$s-ssh-tunnel-keys,<br/>generate and store the client key pair unless already there
+    P1 -->> P4: PUT ssh-tunnel/$v/$cliName/databricks, unless it's already there
+    P1 ->> P4: PUT ssh-tunnel/$v/$s/ssh-server-bootstrap
+    P1 ->> P6: jobs/runs/submit ssh-server-bootstrap $cluster
     activate P6
-    P6 ->> P6: start self-kill-timeout<br/>generate server key pair<br/>create custom sshd config<br/>listen for /ssh and /metadata on a free port
-    P6 ->> P4: PUT ~/.ssh/$v/$cluster/metadata.json<br/>{port: xxxx}
-    loop unil successful or timed out
+    P6 ->> P6: pick a free port, starting at 7772
+    P6 ->> P4: PUT ssh-tunnel/$v/$s/metadata.json<br/>{port, cluster_id, usage_policy_id}
+    P6 ->> P5: read the client public key,<br/>generate and store the server host key unless already there
+    P6 ->> P6: write authorized_keys and a custom sshd config<br/>start self-kill-timeout<br/>listen for /ssh, /metadata and /logs
+    loop until successful or timed out - 30 attempts, 2s apart
       P1 -> P6: Get port and remote user name of the server (sequence 1 - 4 above)
     end
   end
   Note over P1,P7: We know the port and the user, spawn "ssh"
-  P1 ->> P2: ssh -l $user -i $key<br/> -o ProxyCommand="databricks ssh connect --proxy $cluster $user $port"
+  P1 ->> P2: ssh -l $user -i $key -o ServerAliveInterval=30<br/> -o ProxyCommand="databricks ssh connect --proxy<br/> --cluster=$cluster --metadata=$user,$port,$cluster"
   activate P2
   P2 ->> P3: exec ProxyCommand
   activate P3
-  P3 ->> P6: wss:/dirver-proxy-api/$cluster/$port/ssh
+  P3 ->> P6: wss:/driver-proxy-api/o/$workspaceId/$cluster/$port/ssh?id=$connId
   P6 ->> P6: stop self-kill-timeout
-  P6 ->> P7: /usr/sbin/sshd -i -f config
+  P6 ->> P7: /usr/sbin/sshd -f config -i
   activate P7
   P2 -> P7: pubkey auth
   loop until the connection is closed<br/>by ssh client, sshd, or driver-proxy
@@ -115,8 +217,66 @@ sequenceDiagram
     deactivate P1
   end
   break when the last ws connection drops
-    P6 ->> P6: start self-kill-timeout
-    P6 ->> P4: DELETE  ~/.ssh/$v/$cluster/metadata.json
+    P6 ->> P6: start self-kill-timeout, then exit when it fires
     deactivate P6
   end
 ```
+
+Note that `metadata.json` is published before the server starts accepting connections, and is
+left behind when the server exits. Neither its presence nor its contents prove that a server is
+running, which is why the client always re-checks `/metadata` through the driver proxy before
+reusing a port.
+
+### Session resume protocol
+
+Resume protocol v2 lets an SSH session survive a dropped websocket without losing or duplicating
+bytes. The protocol is symmetric: the client and server keep separate offsets and replay buffers
+for their outgoing streams.
+
+Before opening the websocket, the client requests `/capabilities`. It enables resume only when the
+server returns `{"resume_version":2}`. A missing route, another version, an invalid response, or a
+probe that takes more than ten seconds leaves resume disabled. The SSH connection still proceeds.
+When resume is enabled, the initial websocket URL includes these query parameters:
+
+| Parameter | Initial value | Meaning |
+| --- | --- | --- |
+| `id` | A new session UUID | Identifies the SSH session across websocket connections. |
+| `resume_version` | `2` | Selects this protocol version. |
+| `delivered` | `0` | Reports how many peer payload bytes this side has written to its local stream. |
+
+Binary websocket frames carry SSH payload. Text frames contain `{"delivered":N}` and acknowledge
+that the receiver wrote the first `N` bytes to sshd's stdin on the server or stdout on the client.
+Each side appends outgoing payload to a one MiB replay buffer before writing it to the websocket.
+Acknowledgments release buffer space. The receiver sends them after 64 KiB or 100 milliseconds.
+When the buffer is full, the sender stops reading its source until an acknowledgment frees space.
+
+After an unexpected disconnect, the client retries for 60 seconds. The server retains the session
+for 90 seconds so it remains available throughout that retry period.
+
+```mermaid
+sequenceDiagram
+  participant C as Client proxy
+  participant S as Server proxy
+  C->>S: GET /ssh?id=ID&resume_version=2&delivered=C&reattach=1
+  S->>S: Close the old socket and stop delivery at offset S
+  S-->>C: Websocket upgrade
+  S->>C: Text frame {"delivered":S}
+  par Replay server output after C
+    S->>C: Binary frames [C, server sent offset)
+  and Replay client input after S
+    C->>S: Binary frames [S, client sent offset)
+  end
+  C->>S: Continue payload and acknowledgments
+  S->>C: Continue payload and acknowledgments
+```
+
+The `delivered` value on the reattach URL tells the server where to replay its output. The first
+text frame on the new websocket gives the client the corresponding offset for its input. Each side
+replays the buffered range from the peer's offset before sending new payload. The server returns
+HTTP 409 when the existing session did not negotiate resume and HTTP 410 when the session no longer
+exists. Those responses stop retries; other connection failures retry within the 60-second budget.
+
+A normal websocket close with reason `finished` ends the session instead of starting a reattach.
+This explicit reason distinguishes a clean EOF from a dropped connection. Scheduled authentication
+handovers reuse the same session ID without `reattach=1`; if a handover itself drops, protocol v2
+uses the same reattach exchange to recover it.
diff --git a/experimental/ssh/cmd/agent_shim.go b/experimental/ssh/cmd/agent_shim.go
new file mode 100644
index 00000000000..4eb97189201
--- /dev/null
+++ b/experimental/ssh/cmd/agent_shim.go
@@ -0,0 +1,43 @@
+package ssh
+
+import (
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/experimental/ssh/internal/client"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/spf13/cobra"
+)
+
+func newAgentShimCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:    "agent-shim",
+		Short:  "Launch a coding agent configured against Unity AI Gateway (invoked on the remote)",
+		Hidden: true,
+	}
+	for _, agent := range client.SupportedAgentNames() {
+		cmd.AddCommand(newAgentShimAgentCommand(agent))
+	}
+	return cmd
+}
+
+func newAgentShimAgentCommand(agent string) *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   agent,
+		Short: "Launch " + agent + " configured against Unity AI Gateway",
+		// Disable flag parsing: forward everything after the agent name to the agent verbatim.
+		DisableFlagParsing: true,
+	}
+
+	cmd.PreRunE = func(cmd *cobra.Command, args []string) error {
+		// Runs on the driver with injected env auth; no bundle, no prompt.
+		cmd.SetContext(root.SkipLoadBundle(cmd.Context()))
+		cmd.SetContext(root.SkipPrompt(cmd.Context()))
+		return root.MustWorkspaceClient(cmd, args)
+	}
+
+	cmd.RunE = func(cmd *cobra.Command, args []string) error {
+		ctx := cmd.Context()
+		return client.RunAgentShim(ctx, cmdctx.WorkspaceClient(ctx), agent, args)
+	}
+
+	return cmd
+}
diff --git a/experimental/ssh/cmd/connect.go b/experimental/ssh/cmd/connect.go
index a02098923e3..9ac3af75464 100644
--- a/experimental/ssh/cmd/connect.go
+++ b/experimental/ssh/cmd/connect.go
@@ -7,18 +7,38 @@ import (
 	"github.com/databricks/cli/experimental/ssh/internal/client"
 	"github.com/databricks/cli/libs/cmdctx"
 	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
 )
 
+// resolveServerTimeout returns the lifetime to submit the SSH tunnel server job with.
+//
+// Before --server-timeout existed the lifetime was max(24h, --shutdown-delay), so
+// `ssh setup --shutdown-delay=48h` produced a working 48h tunnel and persisted that delay into
+// the generated ProxyCommand. Keep honoring it whenever --server-timeout is not set: OpenSSH
+// runs a persisted ProxyCommand verbatim, so a user whose host config predates the flag cannot
+// add it, and rejecting the pair would break `ssh <name>` with an error naming a flag they have
+// no way to pass. An explicit --server-timeout always wins, and ClientOptions.Validate still
+// rejects a shutdown delay that outlives a lifetime the user asked for explicitly.
+func resolveServerTimeout(flags *pflag.FlagSet, serverTimeout, shutdownDelay time.Duration) time.Duration {
+	if flags.Changed("server-timeout") {
+		return serverTimeout
+	}
+	return max(serverTimeout, shutdownDelay)
+}
+
 func newConnectCommand() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "connect",
-		Short: "Connect to Databricks compute via SSH",
-		Long: `Connect to Databricks compute via SSH.
+		Short: "Connect to your Databricks compute and workspace via SSH",
+		Long: `Connect to your Databricks compute and workspace via SSH.
 
-This command establishes an SSH connection to Databricks compute, setting up
-the SSH server and handling the connection proxy.
+Connect to serverless:
+  databricks ssh connect
+  databricks ssh connect --accelerator=<GPU_type>   # AI Runtime
+  databricks ssh connect --base-environment=<name>  # custom base environment
 
-` + disclaimer,
+Connect to a dedicated cluster:
+  databricks ssh connect --cluster=<cluster-id>`,
 	}
 
 	var clusterID string
@@ -29,26 +49,30 @@ the SSH server and handling the connection proxy.
 	var serverMetadata string
 	var shutdownDelay time.Duration
 	var maxClients int
+	var serverTimeout time.Duration
 	var handoverTimeout time.Duration
 	var releasesDir string
 	var autoStartCluster bool
-	var userKnownHostsFile string
+	var knownHostsDir string
 	var liteswap string
 	var skipSettingsCheck bool
 	var environmentVersion int
+	var baseEnvironment string
 	var autoApprove bool
+	var usagePolicyID string
+	var keepDetachedProcesses bool
 
-	cmd.Flags().StringVar(&clusterID, "cluster", "", "Databricks cluster ID (for dedicated clusters)")
+	cmd.Flags().StringVar(&clusterID, "cluster", "", "Databricks dedicated cluster ID")
 	cmd.Flags().DurationVar(&shutdownDelay, "shutdown-delay", defaultShutdownDelay, "Delay before shutting down the server after the last client disconnects")
 	cmd.Flags().IntVar(&maxClients, "max-clients", defaultMaxClients, "Maximum number of SSH clients")
+	cmd.Flags().DurationVar(&serverTimeout, "server-timeout", defaultServerTimeout, "Maximum lifetime of the SSH server; it is terminated after this duration even if clients are connected")
 	cmd.Flags().BoolVar(&autoStartCluster, "auto-start-cluster", true, "Automatically start the cluster if it is not running")
+	cmd.Flags().BoolVar(&keepDetachedProcesses, "keep-detached-processes", false, "Keep the SSH server and detached processes (tmux, setsid, nohup) running while detached work remains, bounded by --server-timeout")
 
-	cmd.Flags().StringVar(&connectionName, "name", "", "Connection name (for serverless compute)")
-	cmd.Flags().MarkHidden("name")
-	cmd.Flags().StringVar(&accelerator, "accelerator", "", "GPU accelerator type (GPU_1xA10 or GPU_8xH100)")
-	cmd.Flags().MarkHidden("accelerator")
+	cmd.Flags().StringVar(&connectionName, "name", "", "Connection name to reuse across sessions (serverless only)")
+	cmd.Flags().StringVar(&accelerator, "accelerator", "", "Serverless GPU accelerator type (GPU_1xA10 or GPU_8xH100)")
 	cmd.Flags().StringVar(&ide, "ide", "", "Open remote IDE window (vscode or cursor)")
-	cmd.Flags().MarkHidden("ide")
+	cmd.Flags().StringVar(&usagePolicyID, "usage-policy-id", "", "Usage policy ID for the serverless SSH server job (serverless only)")
 
 	cmd.Flags().BoolVar(&proxyMode, "proxy", false, "ProxyCommand mode")
 	cmd.Flags().MarkHidden("proxy")
@@ -60,8 +84,8 @@ the SSH server and handling the connection proxy.
 	cmd.Flags().StringVar(&releasesDir, "releases-dir", "", "Directory for local SSH tunnel development releases")
 	cmd.Flags().MarkHidden("releases-dir")
 
-	cmd.Flags().StringVar(&userKnownHostsFile, "user-known-hosts-file", "", "Path to user known hosts file for SSH client")
-	cmd.Flags().MarkHidden("user-known-hosts-file")
+	cmd.Flags().StringVar(&knownHostsDir, "known-hosts-dir", "", "Directory for the known hosts files the CLI maintains for tunnel connections")
+	cmd.Flags().MarkHidden("known-hosts-dir")
 
 	cmd.Flags().StringVar(&liteswap, "liteswap", "", "Liteswap header value for traffic routing (dev/test only)")
 	cmd.Flags().MarkHidden("liteswap")
@@ -69,9 +93,11 @@ the SSH server and handling the connection proxy.
 	cmd.Flags().BoolVar(&skipSettingsCheck, "skip-settings-check", false, "Skip checking and updating IDE settings")
 	cmd.Flags().MarkHidden("skip-settings-check")
 
-	cmd.Flags().IntVar(&environmentVersion, "environment-version", defaultEnvironmentVersion, "Environment version for serverless compute")
+	cmd.Flags().IntVar(&environmentVersion, "environment-version", defaultEnvironmentVersion, "Environment version for AI Runtime")
 	cmd.Flags().MarkHidden("environment-version")
 
+	cmd.Flags().StringVar(&baseEnvironment, "base-environment", "", "Custom base environment for serverless compute: an env.yaml path, a workspace-base-environments resource ID, or a display name")
+
 	cmd.Flags().BoolVar(&autoApprove, "auto-approve", false, "Skip confirmation prompts, installing IDE extensions and applying IDE settings without asking")
 
 	cmd.PreRunE = func(cmd *cobra.Command, args []string) error {
@@ -89,31 +115,48 @@ the SSH server and handling the connection proxy.
 		ctx := cmd.Context()
 		wsClient := cmdctx.WorkspaceClient(ctx)
 		if connectionName == "" && clusterID == "" && !proxyMode {
-			connectionName = client.GenerateDefaultConnectionName(wsClient.Config.Host, accelerator)
+			connectionName = client.GenerateDefaultConnectionName(wsClient.Config.Host, accelerator, baseEnvironment)
+		}
+		// Serverless GPU compute can take much longer to provision than CPU compute,
+		// so allow extra time for the SSH server job to start.
+		startupTimeout := taskStartupTimeout
+		if accelerator != "" {
+			startupTimeout = gpuTaskStartupTimeout
+		}
+		// Only carry an explicitly-set environment version. Leaving it at 0 otherwise
+		// lets the submit path default to minEnvironmentVersion and lets Validate
+		// detect a real --environment-version + --base-environment conflict.
+		if !cmd.Flags().Changed("environment-version") {
+			environmentVersion = 0
 		}
 		opts := client.ClientOptions{
-			Profile:              wsClient.Config.Profile,
-			ClusterID:            clusterID,
-			ConnectionName:       connectionName,
-			Accelerator:          accelerator,
-			ProxyMode:            proxyMode,
-			IDE:                  ide,
-			ServerMetadata:       serverMetadata,
-			ShutdownDelay:        shutdownDelay,
-			MaxClients:           maxClients,
-			HandoverTimeout:      handoverTimeout,
-			ReleasesDir:          releasesDir,
-			ServerTimeout:        max(serverTimeout, shutdownDelay),
-			TaskStartupTimeout:   taskStartupTimeout,
-			AutoStartCluster:     autoStartCluster,
-			ClientPublicKeyName:  clientPublicKeyName,
-			ClientPrivateKeyName: clientPrivateKeyName,
-			UserKnownHostsFile:   userKnownHostsFile,
-			Liteswap:             liteswap,
-			SkipSettingsCheck:    skipSettingsCheck,
-			EnvironmentVersion:   environmentVersion,
-			AdditionalArgs:       args,
-			AutoApprove:          autoApprove,
+			Profile:               wsClient.Config.Profile,
+			ClusterID:             clusterID,
+			ConnectionName:        connectionName,
+			Accelerator:           accelerator,
+			ProxyMode:             proxyMode,
+			IDE:                   ide,
+			ServerMetadata:        serverMetadata,
+			ShutdownDelay:         shutdownDelay,
+			MaxClients:            maxClients,
+			HandoverTimeout:       handoverTimeout,
+			KeepaliveInterval:     defaultKeepaliveInterval,
+			ReleasesDir:           releasesDir,
+			ServerTimeout:         resolveServerTimeout(cmd.Flags(), serverTimeout, shutdownDelay),
+			TaskStartupTimeout:    startupTimeout,
+			AutoStartCluster:      autoStartCluster,
+			ClientPublicKeyName:   clientPublicKeyName,
+			ClientPrivateKeyName:  clientPrivateKeyName,
+			ServerPublicKeyName:   serverPublicKeyName,
+			KnownHostsDir:         knownHostsDir,
+			Liteswap:              liteswap,
+			SkipSettingsCheck:     skipSettingsCheck,
+			EnvironmentVersion:    environmentVersion,
+			BaseEnvironment:       baseEnvironment,
+			AdditionalArgs:        args,
+			AutoApprove:           autoApprove,
+			UsagePolicyID:         usagePolicyID,
+			KeepDetachedProcesses: keepDetachedProcesses,
 		}
 		if err := opts.Validate(); err != nil {
 			return err
diff --git a/experimental/ssh/cmd/constants.go b/experimental/ssh/cmd/constants.go
index edf95494b75..001ee7f23a6 100644
--- a/experimental/ssh/cmd/constants.go
+++ b/experimental/ssh/cmd/constants.go
@@ -3,18 +3,26 @@ package ssh
 import "time"
 
 const (
-	defaultServerPort         = 7772
-	defaultMaxClients         = 10
-	defaultShutdownDelay      = 10 * time.Minute
-	defaultHandoverTimeout    = 30 * time.Minute
+	defaultServerPort      = 7772
+	defaultMaxClients      = 10
+	defaultShutdownDelay   = 10 * time.Minute
+	defaultHandoverTimeout = 30 * time.Minute
+	// How often the client pings the tunnel websocket so an idle SSH session keeps the transport
+	// alive. Matches the keepalive interval of the vite bridge (libs/apps/vite/bridge.go), and sits
+	// well under both the ~9 minutes after which idle sessions were observed to drop and the
+	// 30 second SSH-level keepalive that was verified to prevent it.
+	defaultKeepaliveInterval  = 20 * time.Second
 	defaultEnvironmentVersion = 4
+	// Default cap on how long an SSH tunnel server is allowed to live. Fixed when the
+	// server job is submitted, so it is only settable by the invocation that starts it.
+	defaultServerTimeout = 24 * time.Hour
 
-	serverTimeout        = 24 * time.Hour
-	taskStartupTimeout   = 10 * time.Minute
-	serverPortRange      = 100
-	serverConfigDir      = ".ssh-tunnel"
-	serverPrivateKeyName = "server-private-key"
-	serverPublicKeyName  = "server-public-key"
-	clientPrivateKeyName = "client-private-key"
-	clientPublicKeyName  = "client-public-key"
+	taskStartupTimeout    = 10 * time.Minute
+	gpuTaskStartupTimeout = 45 * time.Minute
+	serverPortRange       = 100
+	serverConfigDir       = ".ssh-tunnel"
+	serverPrivateKeyName  = "server-private-key"
+	serverPublicKeyName   = "server-public-key"
+	clientPrivateKeyName  = "client-private-key"
+	clientPublicKeyName   = "client-public-key"
 )
diff --git a/experimental/ssh/cmd/server.go b/experimental/ssh/cmd/server.go
index d73ad2d5c4e..0fa93383b42 100644
--- a/experimental/ssh/cmd/server.go
+++ b/experimental/ssh/cmd/server.go
@@ -16,9 +16,7 @@ func newServerCommand() *cobra.Command {
 		Long: `Run SSH tunnel server.
 
 This command starts an SSH tunnel server that accepts WebSocket connections
-and proxies them to local SSH daemon processes.
-
-` + disclaimer,
+and proxies them to local SSH daemon processes.`,
 		// This is an internal command spawned by the SSH client running the "ssh-server-bootstrap.py" job
 		Hidden: true,
 	}
@@ -31,6 +29,8 @@ and proxies them to local SSH daemon processes.
 	var secretScopeName string
 	var authorizedKeySecretName string
 	var serverless bool
+	var usagePolicyID string
+	var keepDetachedProcesses bool
 
 	cmd.Flags().StringVar(&clusterID, "cluster", "", "Databricks cluster ID")
 	cmd.MarkFlagRequired("cluster")
@@ -42,9 +42,11 @@ and proxies them to local SSH daemon processes.
 	cmd.MarkFlagRequired("authorized-key-secret-name")
 
 	cmd.Flags().IntVar(&maxClients, "max-clients", defaultMaxClients, "Maximum number of SSH clients")
-	cmd.Flags().DurationVar(&shutdownDelay, "shutdown-delay", defaultShutdownDelay, "Delay before shutting down after no pings from clients")
+	cmd.Flags().DurationVar(&shutdownDelay, "shutdown-delay", defaultShutdownDelay, "Delay before shutting down the server when there are no active connections")
 	cmd.Flags().StringVar(&version, "version", "", "Client version of the Databricks CLI")
-	cmd.Flags().BoolVar(&serverless, "serverless", false, "Enable serverless mode for Jupyter initialization")
+	cmd.Flags().BoolVar(&serverless, "serverless", false, "Whether the server runs on serverless compute")
+	cmd.Flags().StringVar(&usagePolicyID, "usage-policy-id", "", "Usage policy ID the job was submitted with")
+	cmd.Flags().BoolVar(&keepDetachedProcesses, "keep-detached-processes", false, "Keep the SSH server running while detached processes are alive")
 
 	cmd.PreRunE = func(cmd *cobra.Command, args []string) error {
 		// The server can be executed under a directory with an invalid bundle configuration.
@@ -73,6 +75,8 @@ and proxies them to local SSH daemon processes.
 			DefaultPort:             defaultServerPort,
 			PortRange:               serverPortRange,
 			Serverless:              serverless,
+			UsagePolicyID:           usagePolicyID,
+			KeepDetachedProcesses:   keepDetachedProcesses,
 		}
 		return server.Run(ctx, wsc, opts)
 	}
diff --git a/experimental/ssh/cmd/setup.go b/experimental/ssh/cmd/setup.go
index 104d6bc98a5..261fd092d39 100644
--- a/experimental/ssh/cmd/setup.go
+++ b/experimental/ssh/cmd/setup.go
@@ -1,11 +1,9 @@
 package ssh
 
 import (
-	"fmt"
 	"time"
 
 	"github.com/databricks/cli/cmd/root"
-	"github.com/databricks/cli/experimental/ssh/internal/client"
 	"github.com/databricks/cli/experimental/ssh/internal/setup"
 	"github.com/databricks/cli/libs/cmdctx"
 	"github.com/spf13/cobra"
@@ -14,21 +12,23 @@ import (
 func newSetupCommand() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "setup",
-		Short: "Setup SSH configuration for Databricks compute",
-		Long: `Setup SSH configuration for Databricks compute.
+		Short: "Setup SSH configuration for dedicated (single-user) clusters",
+		Long: `Setup SSH configuration for dedicated (single-user) clusters.
 
-This command configures SSH to connect to Databricks compute by adding
-an SSH host configuration to your SSH config file.
+After running setup, you can connect with ` + "`ssh <name>`" + `.
 
-` + disclaimer,
+For serverless connections, use ` + "`databricks ssh connect`" + ` (no setup step needed).`,
 	}
 
 	var hostName string
 	var clusterID string
 	var sshConfigPath string
 	var shutdownDelay time.Duration
+	var maxClients int
+	var serverTimeout time.Duration
 	var autoStartCluster bool
 	var autoApprove bool
+	var keepDetachedProcesses bool
 
 	cmd.Flags().StringVar(&hostName, "name", "", "Host name to use in SSH config")
 	cmd.MarkFlagRequired("name")
@@ -36,6 +36,9 @@ an SSH host configuration to your SSH config file.
 	cmd.Flags().BoolVar(&autoStartCluster, "auto-start-cluster", true, "Automatically start the cluster when establishing the ssh connection")
 	cmd.Flags().StringVar(&sshConfigPath, "ssh-config", "", "Path to SSH config file (default ~/.ssh/config)")
 	cmd.Flags().DurationVar(&shutdownDelay, "shutdown-delay", defaultShutdownDelay, "SSH server will terminate after this delay if there are no active connections")
+	cmd.Flags().IntVar(&maxClients, "max-clients", defaultMaxClients, "Maximum number of SSH clients")
+	cmd.Flags().DurationVar(&serverTimeout, "server-timeout", defaultServerTimeout, "Maximum lifetime of the SSH server; it is terminated after this duration even if clients are connected")
+	cmd.Flags().BoolVar(&keepDetachedProcesses, "keep-detached-processes", false, "Keep the SSH server and detached processes (tmux, setsid, nohup) running while detached work remains, bounded by --server-timeout")
 	cmd.Flags().BoolVar(&autoApprove, "auto-approve", false, "Skip confirmation prompts, recreating existing SSH host configs without asking")
 
 	cmd.PreRunE = func(cmd *cobra.Command, args []string) error {
@@ -49,25 +52,17 @@ an SSH host configuration to your SSH config file.
 		ctx := cmd.Context()
 		wsClient := cmdctx.WorkspaceClient(ctx)
 		setupOpts := setup.SetupOptions{
-			HostName:         hostName,
-			ClusterID:        clusterID,
-			AutoStartCluster: autoStartCluster,
-			SSHConfigPath:    sshConfigPath,
-			ShutdownDelay:    shutdownDelay,
-			Profile:          wsClient.Config.Profile,
-			AutoApprove:      autoApprove,
+			HostName:              hostName,
+			ClusterID:             clusterID,
+			AutoStartCluster:      autoStartCluster,
+			SSHConfigPath:         sshConfigPath,
+			ShutdownDelay:         shutdownDelay,
+			MaxClients:            maxClients,
+			ServerTimeout:         resolveServerTimeout(cmd.Flags(), serverTimeout, shutdownDelay),
+			KeepDetachedProcesses: keepDetachedProcesses,
+			Profile:               wsClient.Config.Profile,
+			AutoApprove:           autoApprove,
 		}
-		clientOpts := client.ClientOptions{
-			ClusterID:        setupOpts.ClusterID,
-			AutoStartCluster: setupOpts.AutoStartCluster,
-			ShutdownDelay:    setupOpts.ShutdownDelay,
-			Profile:          setupOpts.Profile,
-		}
-		proxyCommand, err := clientOpts.ToProxyCommand()
-		if err != nil {
-			return fmt.Errorf("failed to generate ProxyCommand: %w", err)
-		}
-		setupOpts.ProxyCommand = proxyCommand
 		return setup.Setup(ctx, wsClient, setupOpts)
 	}
 
diff --git a/experimental/ssh/cmd/setup_test.go b/experimental/ssh/cmd/setup_test.go
new file mode 100644
index 00000000000..9cce1f128c6
--- /dev/null
+++ b/experimental/ssh/cmd/setup_test.go
@@ -0,0 +1,183 @@
+package ssh
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/databricks/cli/experimental/ssh/internal/client"
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// The ProxyCommand written by `ssh setup` is what OpenSSH later executes, and it is the
+// invocation that submits the SSH server job. So every flag setup serializes has to exist on
+// `ssh connect` and survive the round trip - otherwise the value the user passed to setup is
+// silently replaced by connect's own default.
+func TestSetupProxyCommandRoundTripsThroughConnect(t *testing.T) {
+	opts := client.ClientOptions{
+		ClusterID:        "cluster-123",
+		AutoStartCluster: true,
+		ShutdownDelay:    15 * time.Minute,
+		MaxClients:       25,
+		ServerTimeout:    48 * time.Hour,
+	}
+	proxyCommand, err := opts.ToProxyCommand()
+	require.NoError(t, err)
+
+	_, args, found := strings.Cut(proxyCommand, " ssh connect ")
+	require.True(t, found, "proxy command %q must invoke 'ssh connect'", proxyCommand)
+
+	flags := newConnectCommand().Flags()
+	require.NoError(t, flags.Parse(strings.Fields(args)))
+
+	proxyMode, err := flags.GetBool("proxy")
+	require.NoError(t, err)
+	assert.True(t, proxyMode)
+
+	clusterID, err := flags.GetString("cluster")
+	require.NoError(t, err)
+	assert.Equal(t, opts.ClusterID, clusterID)
+
+	autoStart, err := flags.GetBool("auto-start-cluster")
+	require.NoError(t, err)
+	assert.Equal(t, opts.AutoStartCluster, autoStart)
+
+	shutdownDelay, err := flags.GetDuration("shutdown-delay")
+	require.NoError(t, err)
+	assert.Equal(t, opts.ShutdownDelay, shutdownDelay)
+
+	maxClients, err := flags.GetInt("max-clients")
+	require.NoError(t, err)
+	assert.Equal(t, opts.MaxClients, maxClients)
+
+	serverTimeout, err := flags.GetDuration("server-timeout")
+	require.NoError(t, err)
+	assert.Equal(t, opts.ServerTimeout, serverTimeout)
+}
+
+// Both commands start the same server, so a value the user does not override has to mean the
+// same thing whether the tunnel was configured with setup or started with connect.
+func TestSetupAndConnectShareServerLifecycleDefaults(t *testing.T) {
+	setupFlags := newSetupCommand().Flags()
+	connectFlags := newConnectCommand().Flags()
+
+	for _, name := range []string{"shutdown-delay", "max-clients", "server-timeout"} {
+		setupFlag := setupFlags.Lookup(name)
+		connectFlag := connectFlags.Lookup(name)
+		require.NotNil(t, setupFlag, "setup is missing --%s", name)
+		require.NotNil(t, connectFlag, "connect is missing --%s", name)
+		assert.Equal(t, connectFlag.DefValue, setupFlag.DefValue, "--%s default differs between setup and connect", name)
+	}
+}
+
+// A ProxyCommand written by `ssh setup --shutdown-delay=48h` before --server-timeout existed
+// carries no --server-timeout, and OpenSSH runs it verbatim - so the delay has to keep raising
+// the server's lifetime the way it did then, or `ssh <name>` breaks for a host config the user
+// cannot edit from the command line.
+func TestLegacyProxyCommandWithLongShutdownDelayStillWorks(t *testing.T) {
+	flags := newConnectCommand().Flags()
+	require.NoError(t, flags.Parse([]string{
+		"--proxy", "--cluster=abc-123", "--auto-start-cluster=true", "--shutdown-delay=48h0m0s",
+	}))
+
+	shutdownDelay, err := flags.GetDuration("shutdown-delay")
+	require.NoError(t, err)
+	serverTimeout, err := flags.GetDuration("server-timeout")
+	require.NoError(t, err)
+
+	opts := client.ClientOptions{
+		ProxyMode:     true,
+		ClusterID:     "abc-123",
+		MaxClients:    defaultMaxClients,
+		ShutdownDelay: shutdownDelay,
+		ServerTimeout: resolveServerTimeout(flags, serverTimeout, shutdownDelay),
+	}
+	require.NoError(t, opts.Validate())
+	assert.Equal(t, 48*time.Hour, opts.ServerTimeout, "the shutdown delay must raise the server's lifetime to cover it")
+}
+
+// The reason the max() above is gated: an explicitly requested lifetime must not be silently
+// widened by a longer shutdown delay. That pair is a real conflict, so it stays an error.
+func TestExplicitServerTimeoutShorterThanShutdownDelayIsRejected(t *testing.T) {
+	flags := newConnectCommand().Flags()
+	require.NoError(t, flags.Parse([]string{
+		"--proxy", "--cluster=abc-123", "--shutdown-delay=48h", "--server-timeout=24h",
+	}))
+
+	shutdownDelay, err := flags.GetDuration("shutdown-delay")
+	require.NoError(t, err)
+	serverTimeout, err := flags.GetDuration("server-timeout")
+	require.NoError(t, err)
+
+	resolved := resolveServerTimeout(flags, serverTimeout, shutdownDelay)
+	assert.Equal(t, 24*time.Hour, resolved, "an explicit --server-timeout wins over a longer --shutdown-delay")
+
+	opts := client.ClientOptions{
+		ProxyMode:     true,
+		ClusterID:     "abc-123",
+		MaxClients:    defaultMaxClients,
+		ShutdownDelay: shutdownDelay,
+		ServerTimeout: resolved,
+	}
+	assert.EqualError(t, opts.Validate(), "--shutdown-delay (48h0m0s) cannot be longer than --server-timeout (24h0m0s)")
+}
+
+func TestResolveServerTimeout(t *testing.T) {
+	tests := []struct {
+		name string
+		args []string
+		want time.Duration
+	}{
+		{
+			name: "no flags: the default lifetime",
+			args: nil,
+			want: defaultServerTimeout,
+		},
+		{
+			name: "shutdown delay within the default lifetime leaves it alone",
+			args: []string{"--shutdown-delay=1h"},
+			want: defaultServerTimeout,
+		},
+		{
+			name: "shutdown delay beyond the default lifetime raises it",
+			args: []string{"--shutdown-delay=48h"},
+			want: 48 * time.Hour,
+		},
+		{
+			name: "an explicit lifetime is used as given",
+			args: []string{"--server-timeout=1h"},
+			want: time.Hour,
+		},
+		{
+			name: "an explicit lifetime is not widened by a longer shutdown delay",
+			args: []string{"--shutdown-delay=2h", "--server-timeout=1h"},
+			want: time.Hour,
+		},
+		{
+			// Same value as the default, but passed explicitly: the user asked for it, so a
+			// longer shutdown delay must not override it.
+			name: "an explicit lifetime equal to the default still wins",
+			args: []string{"--shutdown-delay=48h", "--server-timeout=24h"},
+			want: defaultServerTimeout,
+		},
+	}
+
+	// Both commands resolve the lifetime the same way, so check them together.
+	for _, newCmd := range []func() *cobra.Command{newSetupCommand, newConnectCommand} {
+		for _, tt := range tests {
+			t.Run(newCmd().Name()+"/"+tt.name, func(t *testing.T) {
+				flags := newCmd().Flags()
+				require.NoError(t, flags.Parse(tt.args))
+
+				shutdownDelay, err := flags.GetDuration("shutdown-delay")
+				require.NoError(t, err)
+				serverTimeout, err := flags.GetDuration("server-timeout")
+				require.NoError(t, err)
+
+				assert.Equal(t, tt.want, resolveServerTimeout(flags, serverTimeout, shutdownDelay))
+			})
+		}
+	}
+}
diff --git a/experimental/ssh/cmd/ssh.go b/experimental/ssh/cmd/ssh.go
index b1425054359..19517cd6204 100644
--- a/experimental/ssh/cmd/ssh.go
+++ b/experimental/ssh/cmd/ssh.go
@@ -4,32 +4,25 @@ import (
 	"github.com/spf13/cobra"
 )
 
-const disclaimer = `WARNING! This is an experimental feature:
-- The product is in preview and not intended to be used in production;
-- The product may change or may never be released;
-- While we will not charge separately for this product right now, we may charge for it in the future. You will still incur charges for DBUs;
-- There's no formal support or SLAs for the preview - so please reach out to your account or other contact with any questions or feedback;`
-
 func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:    "ssh",
-		Short:  "Connect to Databricks compute with ssh",
+		Short:  "Connect to your Databricks compute and workspace via SSH",
 		Hidden: true,
-		Long: `Connect to Databricks compute with ssh.
-
-SSH commands let you setup and establish ssh connections to Databricks compute.
+		Long: `Connect to your Databricks compute and workspace via SSH.
 
 Common workflows:
-  databricks ssh connect --cluster=<cluster-id> --profile=<profile-name>  # connect to a cluster without any setup
-  databricks ssh setup --name=my-compute --cluster=<cluster-id>           # update local ssh config
-  ssh my-compute                                                          # connect to the compute using ssh client
+  databricks ssh connect --ide=cursor                         # connect to serverless through Cursor
+  databricks ssh setup --name=<name> --cluster=<cluster-id>   # update ~/.ssh/config so you can reconnect to a dedicated cluster
+  ssh <name>                                                  # connect to dedicated cluster after setup
 
-` + disclaimer,
+Use ` + "`databricks ssh connect --help`" + ` to see all available flags.`,
 	}
 
 	cmd.AddCommand(newSetupCommand())
 	cmd.AddCommand(newConnectCommand())
 	cmd.AddCommand(newServerCommand())
+	cmd.AddCommand(newAgentShimCommand())
 
 	return cmd
 }
diff --git a/experimental/ssh/internal/client/agentshim.go b/experimental/ssh/internal/client/agentshim.go
new file mode 100644
index 00000000000..b021aceb21b
--- /dev/null
+++ b/experimental/ssh/internal/client/agentshim.go
@@ -0,0 +1,852 @@
+package client
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"regexp"
+	"runtime"
+	"strings"
+	"time"
+
+	"github.com/databricks/cli/internal/build"
+	"github.com/databricks/cli/libs/auth"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/dbr"
+	"github.com/databricks/cli/libs/env"
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/telemetry"
+	"github.com/databricks/cli/libs/telemetry/protos"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/client"
+	"github.com/databricks/databricks-sdk-go/config"
+	"github.com/databricks/databricks-sdk-go/httpclient"
+	"github.com/databricks/databricks-sdk-go/listing"
+	"github.com/databricks/databricks-sdk-go/service/catalog"
+)
+
+const (
+	// home-relative directory to hold files/dependencies for the shim.
+	agentRootDir = ".agent-shim"
+
+	// directory which holds the per-agent wrappers; must match remoteShimDir in client.go.
+	agentBinDir = agentRootDir + "/bin"
+
+	// directory which holds toolchain deps (npm, uv) fetched when the image ships none.
+	agentDepsDir = agentRootDir + "/deps"
+
+	// the GitHub repo the shim installs the Unity Gateway CLI from.
+	ugRepo = "databricks/unity-gateway"
+
+	// pins the Unity Gateway CLI commit the shim installs.
+	ugCommit = "034ea0fd11f8e1286b7dd3d945d189be4ff1f42d"
+
+	ugExecutable = "ug"
+
+	// pins the version of uv downloaded
+	uvBaseURL = "https://github.com/astral-sh/uv/releases/download/0.12.18/"
+
+	// SHA-256 of each pinned uv release tarball
+	uvX64LinuxChecksum   = "89eadd7c76fc063887959510d5ba0ab1264dfd5f1143b925ddb73021a40acf16"
+	uvArm64LinuxChecksum = "afb6291f3f0a6b4521fc67b947822506c41dde5b60d2189dd8f3695b2ac8c9e7"
+
+	// overrides for uv tool installs so they are isolated to a directory we control
+	uvToolDir    = agentDepsDir + "/uv_tools"
+	uvToolBinDir = agentDepsDir + "/uv_tools_bin"
+
+	// pins the version of node/npm downloaded
+	nodeVersion = "v24.21.0"
+	nodeBaseURL = "https://nodejs.org/dist/" + nodeVersion + "/"
+
+	// SHA-256 of each pinned node release tarball
+	nodeX64LinuxChecksum   = "fd8e59d5a511510f6a298afb548f18c7d2b1be404d8b4a27d94fbe49f56cb2d6"
+	nodeArm64LinuxChecksum = "6ad1325edbdb5649c379b75a237147a666c95d4f9ae8d340fef2d1575d289ad2"
+
+	npmExecutable = "npm"
+
+	// environment variable used to pass the user's workspace home to the shim for the agent context.
+	workspaceHomeEnv = "DATABRICKS_WORKSPACE_HOME"
+
+	// the file holding the Databricks session context.
+	contextFile = "agent-system-context.md"
+
+	// lock file to serialize first-run toolchain setup across
+	// concurrent SSH clients sharing this driver's $HOME.
+	setupLockName = ".setup.lock"
+
+	// timeout to reclaim a setup lock left behind by a process that died
+	// mid-install. It is deliberately generous: a cold first run can download uv,
+	// ug, and Node
+	setupLockStaleAfter = 2 * time.Minute
+)
+
+type agentSpec struct {
+	name          string
+	telemetryName protos.SshAgentShimAgent
+	// contextFlag passes the context file via this CLI flag (Claude's --append-system-prompt-file).
+	contextFlag string
+	// contextHomeFile writes the context to this $HOME instructions file (codex's AGENTS.md).
+	contextHomeFile string
+}
+
+// Currently limited to the agents whose Unity Gateway CLI command supports --workspace
+var supportedAgents = []agentSpec{
+	{name: "claude", telemetryName: protos.SshAgentShimAgentClaudeCode, contextFlag: "--append-system-prompt-file"},
+	{name: "codex", telemetryName: protos.SshAgentShimAgentCodex, contextHomeFile: ".codex/AGENTS.md"},
+}
+
+// SupportedAgentNames lists the agents the ssh command registers a subcommand for.
+func SupportedAgentNames() []string {
+	names := make([]string, len(supportedAgents))
+	for i, a := range supportedAgents {
+		names[i] = a.name
+	}
+	return names
+}
+
+func agentByName(name string) (agentSpec, bool) {
+	for _, a := range supportedAgents {
+		if a.name == name {
+			return a, true
+		}
+	}
+	return agentSpec{}, false
+}
+
+func RunAgentShim(ctx context.Context, client *databricks.WorkspaceClient, agentName string, agentArgs []string) (retErr error) {
+	// Report the outcome of the launch. Setup runs from here to the exec below, so time it
+	// from here too. Each failing step sets outcome.errorCategory; the returned error is
+	// picked up via the named return.
+	start := time.Now()
+	outcome := agentShimOutcome{}
+	launched := false
+	defer func() {
+		// A successful launch replaces this process with execve below (having emitted and
+		// uploaded its own event first), so this defer normally runs only when the launch
+		// failed; cmd/root then uploads the buffered event as usual on the returned error.
+		// `launched` guards the rare case where execProcess itself returns an error: the
+		// success event is already uploaded, so don't emit a second, contradictory event.
+		if retErr == nil || launched {
+			return
+		}
+		outcome.err = retErr
+		outcome.ctxErr = ctx.Err()
+		logAgentShimEvent(ctx, agentName, outcome, time.Since(start))
+	}()
+
+	agent, ok := agentByName(agentName)
+	if !ok {
+		return categorize(protos.SshAgentShimErrorCategoryUnsupportedAgent, fmt.Errorf("unsupported agent %q", agentName))
+	}
+	// Probe first: fail fast before the slow first-run bootstrap if the gateway is off.
+	// probeAIGateway attributes the specific GATEWAY_* cause; GATEWAY_UNAVAILABLE is the fallback.
+	if err := probeAIGateway(ctx, client); err != nil {
+		return ensureCategory(protos.SshAgentShimErrorCategoryGatewayUnavailable, err)
+	}
+	workspace := strings.TrimRight(client.Config.Host, "/")
+
+	home, err := env.UserHomeDir(ctx)
+	if err != nil {
+		return categorize(protos.SshAgentShimErrorCategoryToolchainSetupFailed, fmt.Errorf("failed to resolve home directory: %w", err))
+	}
+
+	ugPath, err := bootstrapToolchain(ctx, home)
+	if err != nil {
+		return ensureCategory(protos.SshAgentShimErrorCategoryToolchainSetupFailed, err)
+	}
+
+	err = setEnvForUnityGateway(ctx)
+	if err != nil {
+		return categorize(protos.SshAgentShimErrorCategoryAgentConfigurationFailed, fmt.Errorf("failed to set environment variables: %w", err))
+	}
+
+	err = runAgentConfiguration(ctx, agent, workspace)
+	if err != nil {
+		return ensureCategory(protos.SshAgentShimErrorCategoryAgentConfigurationFailed, err)
+	}
+
+	argv, environ, err := prepareAgentLaunch(ctx, home, agent, agentArgs)
+	if err != nil {
+		return ensureCategory(protos.SshAgentShimErrorCategoryAgentLaunchFailed, err)
+	}
+
+	// The agent is ready to launch. execProcess replaces this process, so cmd/root's
+	// end-of-command telemetry upload never runs; emit and flush the success event first.
+	launched = true
+	logAgentShimEvent(ctx, agentName, outcome, time.Since(start))
+	uploadAgentShimTelemetry(ctx, agentName, time.Since(start))
+	return execProcess(ugPath, argv, environ)
+}
+
+// agentShimOutcome is the observed result of an agent-shim launch, collected by
+// RunAgentShim for telemetry.
+type agentShimOutcome struct {
+	err error
+	// ctxErr is the context's error when the outcome is logged. Tracked apart from err
+	// because a step that shells out reports a killed child as *exec.ExitError, which carries
+	// no trace of the cancellation.
+	ctxErr error
+}
+
+// launchError carries the telemetry category for a failure alongside the underlying error,
+// so RunAgentShim can attribute it via errors.As rather than matching on the error text
+// (which the repo forbids). It is transparent to the user: Error and Unwrap both delegate.
+type launchError struct {
+	category protos.SshAgentShimErrorCategory
+	err      error
+}
+
+func (e *launchError) Error() string { return e.err.Error() }
+func (e *launchError) Unwrap() error { return e.err }
+
+// categorize tags err with a telemetry category. A nil err is returned unchanged.
+func categorize(category protos.SshAgentShimErrorCategory, err error) error {
+	if err == nil {
+		return nil
+	}
+	return &launchError{category: category, err: err}
+}
+
+// ensureCategory tags err with fallback unless a deeper call already attributed it, so the
+// most specific category set at the failure site wins over the stage's coarse fallback.
+func ensureCategory(fallback protos.SshAgentShimErrorCategory, err error) error {
+	if err == nil {
+		return nil
+	}
+	if _, ok := errors.AsType[*launchError](err); ok {
+		return err
+	}
+	return categorize(fallback, err)
+}
+
+// category returns the error category to report. An interruption means the user gave up,
+// whichever step observed it first, so it wins over the category attributed at the failure
+// site; an unattributed failure is reported as UNKNOWN so it stays countable.
+func (o agentShimOutcome) category() protos.SshAgentShimErrorCategory {
+	if o.err == nil {
+		return protos.SshAgentShimErrorCategoryUnspecified
+	}
+	if errors.Is(o.ctxErr, context.Canceled) || errors.Is(o.err, context.Canceled) {
+		return protos.SshAgentShimErrorCategoryUserAborted
+	}
+	if le, ok := errors.AsType[*launchError](o.err); ok {
+		return le.category
+	}
+	return protos.SshAgentShimErrorCategoryUnknown
+}
+
+func logAgentShimEvent(ctx context.Context, agentName string, outcome agentShimOutcome, setupDuration time.Duration) {
+	telemetry.Log(ctx, protos.DatabricksCliLog{
+		SshAgentShimEvent: buildAgentShimEvent(agentName, outcome, setupDuration),
+	})
+}
+
+// buildAgentShimEvent maps the agent name and outcome onto the telemetry event. It is
+// separated from logAgentShimEvent so the field mapping can be unit tested.
+func buildAgentShimEvent(agentName string, outcome agentShimOutcome, setupDuration time.Duration) *protos.SshAgentShimEvent {
+	// lookup agent by name so this function is the single decision point for
+	// telemetry and is easily testable
+	telemetryName := protos.SshAgentShimAgentUnspecified
+	agent, ok := agentByName(agentName)
+	if ok {
+		telemetryName = agent.telemetryName
+	}
+	return &protos.SshAgentShimEvent{
+		Agent:           telemetryName,
+		IsSuccess:       outcome.err == nil,
+		ErrorCategory:   outcome.category(),
+		SetupDurationMs: setupDuration.Milliseconds(),
+	}
+}
+
+// uploadAgentShimTelemetry flushes buffered telemetry before the shim execs into the agent.
+// A successful launch replaces this process (see execProcess), so the end-of-command upload
+// in cmd/root.Execute never runs; this rebuilds the ExecutionContext that upload would have
+// attached. Best-effort: an upload failure must not stop the launch.
+func uploadAgentShimTelemetry(ctx context.Context, agentName string, execDuration time.Duration) {
+	err := telemetry.Upload(ctx, protos.ExecutionContext{
+		CmdExecID:       cmdctx.ExecId(ctx),
+		Version:         build.GetInfo().Version,
+		Command:         "ssh_agent-shim_" + agentName,
+		OperatingSystem: runtime.GOOS,
+		DbrVersion:      dbr.RuntimeVersion(ctx).String(),
+		ExecutionTimeMs: execDuration.Milliseconds(),
+		ExitCode:        0,
+	})
+	if err != nil {
+		log.Debugf(ctx, "agent-shim telemetry upload failed: %s", err)
+	}
+}
+
+// --- Unity AI Gateway preflight ---
+//
+// Kept in lockstep with Unity Gateway CLI's probe_unity_gateway_capabilities
+// (https://github.com/databricks/unity-gateway/blob/main/src/ucode/databricks.py)
+// Probe the Unity Catalog model-services API (v3) first, paging through it, then
+// fall back to the legacy AI Gateway endpoints API (v2). A path counts only when
+// its JSON body actually lists a usable resource — a 200 with an empty collection
+// is "reachable but empty", not "enabled". We fail fast with the same actionable
+// guidance Unity Gateway CLI surfaces so the shim's preflight matches what Unity
+// Gateway CLI itself checks.
+
+const (
+	legacyEndpointsPath       = "/api/ai-gateway/v2/endpoints"
+	modelServiceProbePageSize = 50
+	aiGatewayDocsURL          = "https://docs.databricks.com/aws/en/ai-gateway/overview-beta"
+)
+
+type gatewayProbe struct {
+	reachable bool
+	err       error
+	// true if the API returned at least one usable resource
+	resourceAvailable bool
+}
+
+func probeAIGateway(ctx context.Context, wsclient *databricks.WorkspaceClient) error {
+	host := strings.TrimRight(wsclient.Config.Host, "/")
+
+	// build a client with retries disabled so a transient 429/503 fails fast
+	// instead of looping on the SDK's default 5-minute retry budget before the
+	// slow first-run bootstrap even starts.
+	apiClient, err := newProbeAPIClient(wsclient.Config)
+	if err != nil {
+		// this probe is best effort, so don't block
+		log.Debugf(ctx, "Skipping Unity AI Gateway check: %s", err)
+		return nil
+	}
+
+	modelSvc := probeModelServices(ctx, apiClient)
+	// A 401 (or a 400 "invalid token") can't be rescued by trying another API,
+	// so surface it before the fallback probe.
+	if !modelSvc.reachable && looksLikeDefinitiveAuthFailure(modelSvc.err) {
+		return aiGatewayAuthError(host, modelSvc.err.Error())
+	}
+	if modelSvc.resourceAvailable {
+		return nil
+	}
+
+	legacy := probeLegacyEndpoints(ctx, apiClient)
+	switch {
+	case legacy.reachable:
+		// The legacy endpoints API answered, so the gateway is enabled even if no
+		// model services are visible to this caller.
+		if modelSvc.err != nil {
+			log.Warnf(ctx, "Unity AI Gateway model service check: %s", modelSvc.err)
+		}
+		return nil
+	case modelSvc.reachable:
+		// v3 answered; give it the benefit of the doubt rather than blocking on an
+		// unconfirmed "empty".
+		return nil
+	case looksLikeDefinitiveAuthFailure(legacy.err):
+		return aiGatewayAuthError(host, legacy.err.Error())
+	case looksLikeScopeFailure(modelSvc.err):
+		return aiGatewayScopeError(host, modelSvc.err.Error())
+	case looksLikeScopeFailure(legacy.err):
+		return aiGatewayScopeError(host, legacy.err.Error())
+	case looksLikeTransient(modelSvc.err) || looksLikeTransient(legacy.err):
+		// A rate-limit/5xx/network blip is not "disabled" — tell the user to retry
+		// rather than sending them to the enablement docs.
+		return categorize(protos.SshAgentShimErrorCategoryGatewayTransientError, versionNeutralGatewayError(
+			fmt.Sprintf("could not verify the Databricks Unity AI Gateway on %s: the probe hit a transient error (model services: %s; legacy endpoints: %s). Retry in a moment", host, modelSvc.err.Error(), legacy.err.Error()),
+		))
+	case errors.Is(modelSvc.err, apierr.ErrPermissionDenied):
+		return categorize(protos.SshAgentShimErrorCategoryGatewayPermissionDenied, versionNeutralGatewayError(
+			fmt.Sprintf("model service access could not be verified on %s (%s). The legacy endpoint fallback also failed (%s). The model service probe requires permission to list Unity Catalog model services. Verify USE CATALOG on `system`, and USE SCHEMA and EXECUTE on `system.ai`", host, modelSvc.err.Error(), legacy.err.Error()),
+		))
+	case errors.Is(legacy.err, apierr.ErrPermissionDenied):
+		return categorize(protos.SshAgentShimErrorCategoryGatewayPermissionDenied, versionNeutralGatewayError(
+			fmt.Sprintf("legacy endpoint access could not be verified on %s (%s). The model service probe also failed (%s). Verify the caller's workspace permissions for the legacy endpoints listing", host, legacy.err.Error(), modelSvc.err.Error()),
+		))
+	default:
+		return categorize(protos.SshAgentShimErrorCategoryGatewayNotEnabled, versionNeutralGatewayError(
+			fmt.Sprintf("the Databricks Unity AI Gateway is not enabled on this workspace (%s): neither model services (%s) nor legacy endpoints (%s) are available. See %s", host, modelSvc.err.Error(), legacy.err.Error(), aiGatewayDocsURL),
+		))
+	}
+}
+
+// newProbeAPIClient builds a low-level client from cfg with the SDK's retries
+// turned off, so a preflight check is one-shot. Clearing ErrorRetriable and
+// TransientErrors makes a retriable status (429, 503, ...) surface on the first
+// attempt rather than looping until the retry budget expires; it mirrors
+// client.New, which builds the retrying client the rest of the CLI uses.
+func newProbeAPIClient(cfg *config.Config) (*client.DatabricksClient, error) {
+	clientCfg, err := config.HTTPClientConfigFromConfig(cfg)
+	if err != nil {
+		return nil, err
+	}
+	clientCfg.ErrorRetriable = func(context.Context, error) bool { return false }
+	clientCfg.TransientErrors = nil
+	return client.NewWithClient(cfg, httpclient.NewApiClient(clientCfg))
+}
+
+func probeModelServices(ctx context.Context, apiClient *client.DatabricksClient) gatewayProbe {
+	it := catalog.NewAiGateway(apiClient).ListModelServices(ctx, catalog.ListModelServicesRequest{PageSize: modelServiceProbePageSize})
+	_, err := it.Next(ctx)
+	if err != nil {
+		if errors.Is(err, listing.ErrNoMoreItems) {
+			// endpoint is reachable but there are no results
+			return gatewayProbe{reachable: true}
+		}
+		return gatewayProbe{err: err}
+	}
+	return gatewayProbe{reachable: true, resourceAvailable: true}
+}
+
+type legacyEndpointsResponse struct {
+	Endpoints []any `json:"endpoints"`
+}
+
+func probeLegacyEndpoints(ctx context.Context, apiClient *client.DatabricksClient) gatewayProbe {
+	var resp legacyEndpointsResponse
+	err := apiClient.Do(ctx, http.MethodGet, legacyEndpointsPath, auth.WorkspaceIDHeaders(apiClient.Config), map[string]any{
+		"page_size": "1",
+	}, nil, &resp)
+	if err != nil {
+		return gatewayProbe{err: err}
+	}
+	if len(resp.Endpoints) > 0 {
+		return gatewayProbe{reachable: true, resourceAvailable: true}
+	}
+	return gatewayProbe{reachable: true}
+}
+
+var (
+	gatewayDetailV3 = regexp.MustCompile(`(?i)\bv3\b`)
+	gatewayDetailV2 = regexp.MustCompile(`(?i)\bv2\b`)
+)
+
+// rewrite the internal v2/v3 API labels in a failure reason into user-facing terms
+func versionNeutralGatewayError(reason string) error {
+	reason = gatewayDetailV3.ReplaceAllString(reason, "model service")
+	reason = gatewayDetailV2.ReplaceAllString(reason, "legacy endpoint")
+	return errors.New(reason)
+}
+
+// returns true when retrying another workspace API can't rescue the token.
+// A bare 403 is left out: it can be endpoint-specific authorization, so the
+// preflight still tries the fallback before giving up.
+func looksLikeDefinitiveAuthFailure(err error) bool {
+	// HTTP 401
+	if errors.Is(err, apierr.ErrUnauthenticated) {
+		return true
+	}
+	return errors.Is(err, apierr.ErrBadRequest) && strings.Contains(strings.ToLower(err.Error()), "invalid token")
+}
+
+// matches a 403 that reports the OAuth token is missing a required scope (which
+// re-login can fix), as opposed to a plain permission 403.
+func looksLikeScopeFailure(err error) bool {
+	reason := strings.ToLower(err.Error())
+	return errors.Is(err, apierr.ErrPermissionDenied) && strings.Contains(reason, "oauth token") && strings.Contains(reason, "required scopes")
+}
+
+func looksLikeTransient(err error) bool {
+	return strings.HasPrefix(err.Error(), "network error") ||
+		errors.Is(err, apierr.ErrTooManyRequests) || // HTTP 429
+		errors.Is(err, apierr.ErrInternalError) || // HTTP 500
+		errors.Is(err, apierr.ErrTemporarilyUnavailable) || // HTTP 503
+		errors.Is(err, apierr.ErrDeadlineExceeded) // HTTP 504
+}
+
+func aiGatewayAuthError(host, reason string) error {
+	return categorize(protos.SshAgentShimErrorCategoryGatewayAuthFailed, versionNeutralGatewayError(
+		fmt.Sprintf("the Databricks workspace %s rejected the access token (%s). Try:\n  databricks auth logout --host %s\n  databricks auth login --host %s", host, reason, host, host),
+	))
+}
+
+func aiGatewayScopeError(host, reason string) error {
+	return categorize(protos.SshAgentShimErrorCategoryGatewayScopeFailed, versionNeutralGatewayError(
+		fmt.Sprintf("the access token for %s is missing an OAuth scope required by the AI Gateway APIs (%s). Re-authenticate to mint a token with the needed scopes:\n  databricks auth login --host %s", host, reason, host),
+	))
+}
+
+// --- end Unity AI Gateway preflight ---
+
+func bootstrapToolchain(ctx context.Context, home string) (string, error) {
+	// Reconstruct the PATH tooling runs under on every launch rather than caching
+	// it: every entry is a known location, so deriving it can't restore a stale
+	// path (e.g. a versioned CLI dir from an older session). Drop the shim dir so
+	// Unity Gateway CLI execs the real agent rather than this wrapper
+	removePath(ctx, filepath.Join(home, agentBinDir))
+	// add this CLI to PATH so agents can use it
+	if self, err := os.Executable(); err == nil {
+		prependPath(ctx, filepath.Dir(self))
+	}
+
+	err := ensureToolchain(ctx, home, runtime.GOARCH)
+	if err != nil {
+		return "", err
+	}
+
+	// npm is on PATH now (shipped or just installed); silence its update-notifier
+	// box so it doesn't clutter the agent session.
+	disableNpmUpdateNotifier(ctx)
+
+	ugPath, err := exec.LookPath(ugExecutable)
+	if err != nil {
+		return "", categorize(protos.SshAgentShimErrorCategoryUnityGatewayCLINotFound, fmt.Errorf("the Unity Gateway CLI was not found on PATH after setup: %w", err))
+	}
+
+	return ugPath, nil
+}
+
+func toolchainReady() bool {
+	_, ugErr := exec.LookPath(ugExecutable)
+	_, npmErr := exec.LookPath(npmExecutable)
+	return ugErr == nil && npmErr == nil
+}
+
+func ensureToolchain(ctx context.Context, home, arch string) error {
+	// add expected tool locations to PATH first
+	uvSpec := uvArchiveSpec(arch)
+	nodeSpec := nodeArchiveSpec(arch)
+	uvToolDirAbsolute := filepath.Join(home, uvToolDir)
+	uvToolBinDirAbsolute := filepath.Join(home, uvToolBinDir)
+	prependPath(ctx, uvToolBinDirAbsolute)
+	for _, spec := range []archiveSpec{uvSpec, nodeSpec} {
+		binDir := filepath.Join(home, agentDepsDir, spec.dirName, spec.binDirName)
+		prependPath(ctx, binDir)
+	}
+
+	if toolchainReady() {
+		return nil
+	}
+	unlock, err := acquireSetupLock(ctx, home)
+	if err != nil {
+		return err
+	}
+	defer unlock()
+	// Another client may have finished the install while we waited for the lock.
+	if toolchainReady() {
+		return nil
+	}
+
+	if _, err := exec.LookPath("uv"); err != nil {
+		if err := runStep(ctx, "Installing uv", func(out io.Writer) error {
+			if err := ensureBinary(ctx, home, out, uvSpec); err != nil {
+				return fmt.Errorf("failed to install uv: %w", err)
+			}
+			return nil
+		}); err != nil {
+			return categorize(protos.SshAgentShimErrorCategoryUvInstallFailed, err)
+		}
+	}
+
+	if _, err := exec.LookPath(ugExecutable); err != nil {
+		if err := runStep(ctx, "Installing Unity Gateway CLI", func(out io.Writer) error {
+			env := os.Environ()
+			env = append(env, "UV_TOOL_DIR="+uvToolDirAbsolute, "UV_TOOL_BIN_DIR="+uvToolBinDirAbsolute)
+			if err := runCommand(ctx, out, env, "uv", "tool", "install", "git+https://github.com/"+ugRepo+"@"+ugCommit); err != nil {
+				return fmt.Errorf("failed to install Unity Gateway CLI: %w", err)
+			}
+			return nil
+		}); err != nil {
+			return categorize(protos.SshAgentShimErrorCategoryGatewayCLIInstallFailed, err)
+		}
+	}
+
+	if _, err := exec.LookPath("npm"); err != nil {
+		if err := runStep(ctx, "Installing Node.js", func(out io.Writer) error {
+			return ensureBinary(ctx, home, out, nodeSpec)
+		}); err != nil {
+			return categorize(protos.SshAgentShimErrorCategoryNodeInstallFailed, err)
+		}
+	}
+
+	return nil
+}
+
+type archiveSpec struct {
+	// "" if this is an unsupported architecture
+	archiveURL string
+	binaryName string
+	dirName    string
+	// sub-directory inside dirName where the binary is located, "" if it's the same as dirName
+	binDirName string
+	checksum   string
+}
+
+// ensure the specified binary is installed, installing it if it's not already
+// present. Extraction output is written to out. Returns the path to the directory
+// containing the installed binary
+func ensureBinary(ctx context.Context, home string, out io.Writer, spec archiveSpec) error {
+	if spec.archiveURL == "" {
+		return fmt.Errorf("unsupported architecture for %s download: %s", spec.binaryName, runtime.GOARCH)
+	}
+
+	depsRoot := filepath.Join(home, agentDepsDir)
+	depsDir := filepath.Join(depsRoot, spec.dirName)
+	binDir := filepath.Join(depsDir, spec.binDirName)
+	if _, err := os.Stat(filepath.Join(binDir, spec.binaryName)); err == nil {
+		return nil
+	}
+
+	if err := os.MkdirAll(depsRoot, 0o755); err != nil {
+		return fmt.Errorf("failed to create %s: %w", depsRoot, err)
+	}
+
+	tarball, err := downloadVerified(ctx, spec)
+	if err != nil {
+		return err
+	}
+	defer os.Remove(tarball)
+	// Extract into a sibling temp dir and atomically rename it into place, so an
+	// interrupted extraction never leaves a half-populated dir that the os.Stat
+	// check above would then wrongly accept as a finished install.
+	tmpDir, err := os.MkdirTemp(depsRoot, spec.binaryName+"-*")
+	if err != nil {
+		return fmt.Errorf("failed to create temp dir: %w", err)
+	}
+	defer os.RemoveAll(tmpDir) // no-op once renamed; cleans up a failed extraction
+	// extract with tar for brevity
+	if err := runCommand(ctx, out, nil, "tar", "-xf", tarball, "--strip-components=1", "-C", tmpDir); err != nil {
+		return fmt.Errorf("failed to extract %s: %w", spec.binaryName, err)
+	}
+	// Clear any partial leftover from a previously-interrupted run, then publish
+	// atomically (same-filesystem rename, since tmpDir is a sibling of nodeDir).
+	if err := os.RemoveAll(depsDir); err != nil {
+		return fmt.Errorf("failed to remove %s: %w", depsDir, err)
+	}
+	if err := os.Rename(tmpDir, depsDir); err != nil {
+		return fmt.Errorf("failed to install %s: %w", spec.binaryName, err)
+	}
+	return nil
+}
+
+func uvArchiveSpec(goarch string) archiveSpec {
+	spec := archiveSpec{dirName: "uv", binaryName: "uv"}
+	switch goarch {
+	case "amd64":
+		spec.archiveURL = uvBaseURL + "uv-x86_64-unknown-linux-gnu.tar.gz"
+		spec.checksum = uvX64LinuxChecksum
+	case "arm64":
+		spec.archiveURL = uvBaseURL + "uv-aarch64-unknown-linux-gnu.tar.gz"
+		spec.checksum = uvArm64LinuxChecksum
+	}
+	return spec
+}
+
+// take a machine-local lock (an O_EXCL sentinel file) serializing first-run setup
+// across SSH clients. It blocks until the lock is free, reclaiming one left behind
+// by a dead process after setupLockStaleAfter. The returned func releases the lock.
+func acquireSetupLock(ctx context.Context, home string) (func(), error) {
+	lockPath := filepath.Join(home, agentRootDir, setupLockName)
+	if err := os.MkdirAll(filepath.Dir(lockPath), 0o755); err != nil {
+		return nil, fmt.Errorf("failed to create %s: %w", filepath.Dir(lockPath), err)
+	}
+	for {
+		f, err := os.OpenFile(lockPath, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0o644)
+		if err == nil {
+			_ = f.Close()
+			return func() { _ = os.Remove(lockPath) }, nil
+		}
+		if !errors.Is(err, os.ErrExist) {
+			return nil, fmt.Errorf("failed to acquire setup lock: %w", err)
+		}
+		// Held by another process: reclaim it if stale, otherwise wait and retry.
+		if info, statErr := os.Stat(lockPath); statErr == nil && time.Since(info.ModTime()) > setupLockStaleAfter {
+			log.Warnf(ctx, "reclaiming stale agent-shim setup lock at %s", lockPath)
+			_ = os.Remove(lockPath)
+			continue
+		}
+		log.Infof(ctx, "waiting for a concurrent setup to finish")
+		select {
+		case <-ctx.Done():
+			return nil, ctx.Err()
+		case <-time.After(time.Second):
+		}
+	}
+}
+
+func setEnvForUnityGateway(ctx context.Context) error {
+	// Pass the session token as DATABRICKS_BEARER so Unity Gateway CLI authenticates headlessly.
+	if token := env.Get(ctx, "DATABRICKS_TOKEN"); token != "" {
+		err := os.Setenv("DATABRICKS_BEARER", token)
+		if err != nil {
+			return err
+		}
+	}
+	err := os.Setenv("UG_SKIP_OS_SETTINGS", "1")
+	if err != nil {
+		return err
+	}
+	err = os.Setenv("AI_GATEWAY_REQUEST_TAGS", "{\"source\":\"databricks-ssh\"}")
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+func runAgentConfiguration(ctx context.Context, agent agentSpec, workspace string) error {
+	if err := runStep(ctx, "Configuring "+agent.name, func(out io.Writer) error {
+		if err := runCommand(ctx, out, nil, ugExecutable, "configure", "--agent", agent.name, "--workspace", workspace, "--enable-databricks-ai-tools"); err != nil {
+			return fmt.Errorf("failed to configure %s: %w", agent.name, err)
+		}
+		return nil
+	}); err != nil {
+		return categorize(protos.SshAgentShimErrorCategoryAgentConfigurationFailed, err)
+	}
+	return nil
+}
+
+func prepareAgentLaunch(ctx context.Context, home string, agent agentSpec, agentArgs []string) (argv, environ []string, err error) {
+	contextArgs, err := injectAgentContext(ctx, home, agent)
+	if err != nil {
+		return nil, nil, categorize(protos.SshAgentShimErrorCategoryAgentContextSetupFailed, err)
+	}
+	argv = []string{ugExecutable, agent.name, "--"}
+	argv = append(argv, contextArgs...)
+	argv = append(argv, agentArgs...)
+	return argv, os.Environ(), nil
+}
+
+// put the Databricks context where the agent reads it, returning any extra argv.
+func injectAgentContext(ctx context.Context, home string, agent agentSpec) ([]string, error) {
+	systemContext := agentSystemContext(env.Get(ctx, workspaceHomeEnv))
+	switch {
+	case agent.contextFlag != "":
+		// Keep the scratch context file under the shim's own directory so it never
+		// clobbers an unrelated file the user happens to have in their home.
+		dir := filepath.Join(home, agentRootDir)
+		if err := os.MkdirAll(dir, 0o755); err != nil {
+			return nil, fmt.Errorf("failed to create %s: %w", dir, err)
+		}
+		f := filepath.Join(dir, contextFile)
+		if err := os.WriteFile(f, []byte(systemContext), 0o644); err != nil {
+			return nil, fmt.Errorf("failed to write agent context file: %w", err)
+		}
+		return []string{agent.contextFlag, f}, nil
+	case agent.contextHomeFile != "":
+		f := filepath.Join(home, agent.contextHomeFile)
+		if _, err := os.Stat(f); err == nil {
+			return nil, nil // already present — don't clobber
+		} else if !errors.Is(err, os.ErrNotExist) {
+			return nil, fmt.Errorf("failed to stat %s: %w", f, err)
+		}
+		if err := os.MkdirAll(filepath.Dir(f), 0o755); err != nil {
+			return nil, fmt.Errorf("failed to create %s: %w", filepath.Dir(f), err)
+		}
+		if err := os.WriteFile(f, []byte(systemContext), 0o644); err != nil {
+			return nil, fmt.Errorf("failed to write %s: %w", f, err)
+		}
+		return nil, nil
+	default:
+		return nil, nil
+	}
+}
+
+// fetch url to a temp file, failing unless its SHA256 matches the expected checksum.
+// The caller is responsible for removing the returned file.
+func downloadVerified(ctx context.Context, spec archiveSpec) (string, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, spec.archiveURL, nil)
+	if err != nil {
+		return "", err
+	}
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return "", fmt.Errorf("failed to download %s: %w", spec.archiveURL, err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return "", fmt.Errorf("failed to download %s: HTTP %d", spec.archiveURL, resp.StatusCode)
+	}
+
+	// either .tar.gz or .tar.xz
+	fileExt := spec.archiveURL[len(spec.archiveURL)-7:]
+	f, err := os.CreateTemp("", spec.binaryName+"-*."+fileExt)
+	if err != nil {
+		return "", err
+	}
+	sum := sha256.New()
+	if _, err := io.Copy(io.MultiWriter(f, sum), resp.Body); err != nil {
+		f.Close()
+		os.Remove(f.Name())
+		return "", fmt.Errorf("failed to download %s: %w", spec.archiveURL, err)
+	}
+	if err := f.Close(); err != nil {
+		os.Remove(f.Name())
+		return "", err
+	}
+	if got := hex.EncodeToString(sum.Sum(nil)); !strings.EqualFold(got, spec.checksum) {
+		os.Remove(f.Name())
+		return "", fmt.Errorf("checksum mismatch for %s: got %s, want %s", spec.archiveURL, got, spec.checksum)
+	}
+	return f.Name(), nil
+}
+
+func nodeArchiveSpec(goarch string) archiveSpec {
+	spec := archiveSpec{binDirName: "bin", dirName: "node", binaryName: "npm"}
+	switch goarch {
+	case "amd64":
+		spec.archiveURL = nodeBaseURL + "node-" + nodeVersion + "-linux-x64.tar.xz"
+		spec.checksum = nodeX64LinuxChecksum
+	case "arm64":
+		spec.archiveURL = nodeBaseURL + "node-" + nodeVersion + "-linux-arm64.tar.xz"
+		spec.checksum = nodeArm64LinuxChecksum
+	}
+	return spec
+}
+
+// turn off npm's "new version available" box so it doesn't clutter the installation
+// progress. Best-effort: it's cosmetic, so a failure (e.g. npm not runnable) is
+// logged and ignored rather than blocking the launch.
+func disableNpmUpdateNotifier(ctx context.Context) {
+	if err := exec.CommandContext(ctx, "npm", "config", "set", "update-notifier", "false").Run(); err != nil {
+		log.Debugf(ctx, "failed to disable npm update-notifier: %v", err)
+	}
+}
+
+// runCommand runs name with the given args, writing combined stdout+stderr to out
+// (captured so it surfaces only on failure). When env is non-nil it replaces the
+// process environment. Stdin is left closed: the shim's install steps are
+// non-interactive.
+func runCommand(ctx context.Context, out io.Writer, env []string, name string, args ...string) error {
+	cmd := exec.CommandContext(ctx, name, args...)
+	cmd.Stdout = out
+	cmd.Stderr = out
+	if len(env) > 0 {
+		cmd.Env = env
+	}
+	return cmd.Run()
+}
+
+func prependPath(ctx context.Context, dir string) {
+	dirs := []string{dir}
+	for _, d := range filepath.SplitList(env.Get(ctx, "PATH")) {
+		if d != dir {
+			dirs = append(dirs, d)
+		}
+	}
+	_ = os.Setenv("PATH", strings.Join(dirs, string(os.PathListSeparator)))
+}
+
+func removePath(ctx context.Context, dir string) {
+	var dirs []string
+	for _, d := range filepath.SplitList(env.Get(ctx, "PATH")) {
+		if d != dir {
+			dirs = append(dirs, d)
+		}
+	}
+	_ = os.Setenv("PATH", strings.Join(dirs, string(os.PathListSeparator)))
+}
+
+func agentSystemContext(wsHome string) string {
+	cwd := "the user's Databricks workspace home directory"
+	if wsHome != "" {
+		cwd = wsHome
+	}
+	return fmt.Sprintf(`You are running inside a "databricks ssh connect" session on the driver node of a
+Databricks serverless cluster.
+- The "databricks" CLI is installed and already authenticated: DATABRICKS_HOST and DATABRICKS_TOKEN are set in the environment, so "databricks ..." commands work with no "databricks auth login". The same token governs Unity Catalog and serving-endpoint access.
+- This container is ephemeral; only paths under /Workspace and /Volumes persist across sessions. Your working directory is %s.
+- You can run shell commands and use the "databricks" CLI to explore the workspace.`, cwd)
+}
diff --git a/experimental/ssh/internal/client/agentshim_test.go b/experimental/ssh/internal/client/agentshim_test.go
new file mode 100644
index 00000000000..4cd486f25e3
--- /dev/null
+++ b/experimental/ssh/internal/client/agentshim_test.go
@@ -0,0 +1,768 @@
+package client
+
+import (
+	"archive/tar"
+	"bytes"
+	"compress/gzip"
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"io/fs"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/telemetry/protos"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/config"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestPrependPath(t *testing.T) {
+	t.Setenv("PATH", strings.Join([]string{"/a", "/b"}, string(os.PathListSeparator)))
+	prependPath(t.Context(), "/b") // existing entry moves to the front (deduped)
+	assert.Equal(t, []string{"/b", "/a"}, filepath.SplitList(os.Getenv("PATH")))
+	prependPath(t.Context(), "/new")
+	assert.Equal(t, []string{"/new", "/b", "/a"}, filepath.SplitList(os.Getenv("PATH")))
+	prependPath(t.Context(), "/a") // a deeper existing entry also moves to the front (deduped)
+	assert.Equal(t, []string{"/a", "/new", "/b"}, filepath.SplitList(os.Getenv("PATH")))
+}
+
+func TestRemovePath(t *testing.T) {
+	t.Setenv("PATH", strings.Join([]string{"/a", "/b", "/a"}, string(os.PathListSeparator)))
+	removePath(t.Context(), "/a")
+	assert.Equal(t, []string{"/b"}, filepath.SplitList(os.Getenv("PATH")))
+}
+
+func TestAcquireSetupLock(t *testing.T) {
+	home := t.TempDir()
+	lockPath := filepath.Join(home, agentRootDir, setupLockName)
+
+	// Acquire creates the sentinel; release removes it.
+	unlock, err := acquireSetupLock(t.Context(), home)
+	require.NoError(t, err)
+	_, statErr := os.Stat(lockPath)
+	require.NoError(t, statErr, "lock sentinel should exist while held")
+	unlock()
+	_, statErr = os.Stat(lockPath)
+	assert.ErrorIs(t, statErr, fs.ErrNotExist, "lock sentinel should be gone after release")
+
+	// A lock left behind by a dead process is reclaimed once stale, not waited on
+	// forever.
+	require.NoError(t, os.WriteFile(lockPath, nil, 0o644))
+	stale := time.Now().Add(-2 * setupLockStaleAfter)
+	require.NoError(t, os.Chtimes(lockPath, stale, stale))
+	unlock2, err := acquireSetupLock(t.Context(), home)
+	require.NoError(t, err)
+	unlock2()
+}
+
+func TestNodeArchiveSpec(t *testing.T) {
+	x64Spec := nodeArchiveSpec("amd64")
+	assert.Contains(t, x64Spec.archiveURL, "nodejs.org/dist")
+	assert.Equal(t, "npm", x64Spec.binaryName)
+	assert.Equal(t, nodeX64LinuxChecksum, x64Spec.checksum)
+	assert.Equal(t, "node", x64Spec.dirName)
+
+	arm64Spec := nodeArchiveSpec("arm64")
+	assert.Contains(t, arm64Spec.archiveURL, "nodejs.org/dist")
+	assert.Equal(t, "npm", arm64Spec.binaryName)
+	assert.Equal(t, nodeArm64LinuxChecksum, arm64Spec.checksum)
+	assert.Equal(t, "node", arm64Spec.dirName)
+
+	unknownSpec := nodeArchiveSpec("riscv")
+	assert.Empty(t, unknownSpec.archiveURL)
+	assert.Equal(t, "npm", unknownSpec.binaryName)
+	assert.Empty(t, unknownSpec.checksum)
+	assert.Equal(t, "node", unknownSpec.dirName)
+}
+
+func TestUvArchiveSpec(t *testing.T) {
+	x64Spec := uvArchiveSpec("amd64")
+	assert.Contains(t, x64Spec.archiveURL, "github.com/astral-sh/uv/releases")
+	assert.Equal(t, "uv", x64Spec.binaryName)
+	assert.Equal(t, uvX64LinuxChecksum, x64Spec.checksum)
+	assert.Equal(t, "uv", x64Spec.dirName)
+
+	arm64Spec := uvArchiveSpec("arm64")
+	assert.Contains(t, arm64Spec.archiveURL, "github.com/astral-sh/uv/releases")
+	assert.Equal(t, "uv", arm64Spec.binaryName)
+	assert.Equal(t, uvArm64LinuxChecksum, arm64Spec.checksum)
+	assert.Equal(t, "uv", arm64Spec.dirName)
+
+	unknownSpec := uvArchiveSpec("riscv")
+	assert.Empty(t, unknownSpec.archiveURL)
+	assert.Equal(t, "uv", unknownSpec.binaryName)
+	assert.Empty(t, unknownSpec.checksum)
+	assert.Equal(t, "uv", unknownSpec.dirName)
+}
+
+func TestDownloadVerified(t *testing.T) {
+	payload := []byte("fake node tarball")
+	sum := sha256.Sum256(payload)
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write(payload)
+	}))
+	defer srv.Close()
+
+	t.Run("matching checksum writes the file", func(t *testing.T) {
+		path, err := downloadVerified(t.Context(), archiveSpec{
+			archiveURL: srv.URL,
+			binaryName: "npm",
+			checksum:   hex.EncodeToString(sum[:]),
+			dirName:    "node",
+		})
+		require.NoError(t, err)
+		defer os.Remove(path)
+		got, err := os.ReadFile(path)
+		require.NoError(t, err)
+		assert.Equal(t, payload, got)
+	})
+
+	t.Run("mismatched checksum errors and leaves no file", func(t *testing.T) {
+		_, err := downloadVerified(t.Context(), archiveSpec{
+			archiveURL: srv.URL,
+			binaryName: "npm",
+			checksum:   strings.Repeat("0", 64),
+			dirName:    "node",
+		})
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "checksum mismatch")
+	})
+}
+
+// tarGz returns a gzipped tar archive holding a single member at name.
+func tarGz(t *testing.T, name string, content []byte) []byte {
+	t.Helper()
+	var buf bytes.Buffer
+	gz := gzip.NewWriter(&buf)
+	tw := tar.NewWriter(gz)
+	require.NoError(t, tw.WriteHeader(&tar.Header{Name: name, Mode: 0o755, Size: int64(len(content))}))
+	_, err := tw.Write(content)
+	require.NoError(t, err)
+	require.NoError(t, tw.Close())
+	require.NoError(t, gz.Close())
+	return buf.Bytes()
+}
+
+func TestEnsureBinary(t *testing.T) {
+	// ensureBinary uses unix specific tooling, and agent-shim is only intended for Linux,
+	// so skip tests for Windows
+	if runtime.GOOS == "windows" {
+		return
+	}
+
+	t.Run("unsupported architecture errors", func(t *testing.T) {
+		err := ensureBinary(t.Context(), t.TempDir(), io.Discard, nodeArchiveSpec("riscv"))
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "unsupported architecture")
+	})
+
+	nodeArchive := tarGz(t, "node/bin/npm", []byte("#!/bin/sh\necho npm\n"))
+	nodeSum := sha256.Sum256(nodeArchive)
+	uvArchive := tarGz(t, "uv/uv", []byte("#!/bin/sh\necho uv\n"))
+	uvSum := sha256.Sum256(uvArchive)
+
+	var downloads int
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		downloads++
+		switch r.URL.Path {
+		case "/node.tar.gz":
+			_, _ = w.Write(nodeArchive)
+		case "/uv.tar.gz":
+			_, _ = w.Write(uvArchive)
+		default:
+			panic("unsupported archive " + r.URL.Path)
+		}
+	}))
+	defer srv.Close()
+
+	home := t.TempDir()
+	for _, c := range []struct {
+		spec       archiveSpec
+		wantBinDir string
+	}{
+		{
+			spec: archiveSpec{
+				archiveURL: srv.URL + "/node.tar.gz",
+				binaryName: "npm",
+				checksum:   hex.EncodeToString(nodeSum[:]),
+				dirName:    "node",
+				binDirName: "bin",
+			}, wantBinDir: filepath.Join(home, agentDepsDir, "node", "bin"),
+		},
+		{
+			spec: archiveSpec{
+				archiveURL: srv.URL + "/uv.tar.gz",
+				binaryName: "uv",
+				checksum:   hex.EncodeToString(uvSum[:]),
+				dirName:    "uv",
+			}, wantBinDir: filepath.Join(home, agentDepsDir, "uv"),
+		},
+	} {
+		t.Run("downloads, extracts, and returns the bin dir ("+c.spec.binaryName+")", func(t *testing.T) {
+			beforeDownloads := downloads
+			err := ensureBinary(t.Context(), home, io.Discard, c.spec)
+			require.NoError(t, err)
+			_, err = os.Stat(filepath.Join(c.wantBinDir, c.spec.binaryName))
+			require.NoError(t, err)
+			assert.Equal(t, beforeDownloads+1, downloads)
+		})
+
+		t.Run("no-op when the binary is already installed ("+c.spec.binaryName+")", func(t *testing.T) {
+			beforeDownloads := downloads
+			err := ensureBinary(t.Context(), home, io.Discard, c.spec)
+			require.NoError(t, err)
+			assert.Equal(t, beforeDownloads, downloads, "an existing install must not re-download")
+		})
+	}
+}
+
+// writeFakeExec drops an executable POSIX shell script named name into dir.
+func writeFakeExec(t *testing.T, dir, name, body string) {
+	t.Helper()
+	require.NoError(t, os.MkdirAll(dir, 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(dir, name), []byte("#!/bin/sh\n"+body), 0o755))
+}
+
+// fakeUvRecorder is the body of a stand-in `uv` that records how ensureToolchain
+// invoked it (args, the UV_TOOL_* overrides, and whether the setup lock was held)
+// to $FAKE_UV_LOG. It uses only shell builtins so it needs nothing on PATH.
+const fakeUvRecorder = `{
+  echo "args: $*"
+} > "$FAKE_UV_LOG"`
+
+func TestEnsureToolchain(t *testing.T) {
+	// ensureToolchain shells out to POSIX tools and installs a Linux-only toolchain,
+	// so the fake executables below only make sense off Windows.
+	if runtime.GOOS == "windows" {
+		return
+	}
+
+	for _, staleLock := range []bool{false, true} {
+		t.Run(fmt.Sprintf("no-op when the toolchain is already present (staleLock=%v)", staleLock), func(t *testing.T) {
+			home := t.TempDir()
+			writeFakeExec(t, filepath.Join(home, uvToolBinDir), ugExecutable, ":")
+			writeFakeExec(t, filepath.Join(home, agentDepsDir, "node", "bin"), "npm", ":")
+			writeFakeExec(t, filepath.Join(home, agentDepsDir, "uv"), "uv", fakeUvRecorder)
+			if staleLock {
+				// left by a session killed mid-install
+				writeFakeExec(t, filepath.Join(home, agentRootDir), setupLockName, "")
+			}
+			marker := filepath.Join(t.TempDir(), "uv.log")
+			t.Setenv("FAKE_UV_LOG", marker)
+			t.Setenv("PATH", t.TempDir())
+
+			require.NoError(t, ensureToolchain(cmdio.MockDiscard(t.Context()), home, "amd64"))
+			assert.NoFileExists(t, marker, "uv must not run when the toolchain is already present")
+		})
+	}
+
+	t.Run("installs the Unity Gateway CLI via uv when uv is already present", func(t *testing.T) {
+		home := t.TempDir()
+		// uv and npm are present; ug is not, so only ug gets installed and no
+		// download happens
+		writeFakeExec(t, filepath.Join(home, agentDepsDir, "uv"), "uv", fakeUvRecorder)
+		writeFakeExec(t, filepath.Join(home, agentDepsDir, "node", "bin"), "npm", ":")
+		marker := filepath.Join(t.TempDir(), "uv.log")
+		t.Setenv("FAKE_UV_LOG", marker)
+		t.Setenv("PATH", t.TempDir())
+
+		require.NoError(t, ensureToolchain(cmdio.MockDiscard(t.Context()), home, "amd64"))
+
+		out, err := os.ReadFile(marker)
+		require.NoError(t, err)
+		assert.Contains(t, string(out), "tool install git+https://github.com/"+ugRepo+"@"+ugCommit)
+		// The tool bin dir is prepended to PATH so the freshly installed ug is found.
+		assert.Contains(t, filepath.SplitList(os.Getenv("PATH")), filepath.Join(home, uvToolBinDir))
+		assert.NoFileExists(t, filepath.Join(home, agentRootDir, setupLockName), "the setup lock is released once setup finishes")
+	})
+
+	t.Run("recheck after acquiring the lock skips a redundant install", func(t *testing.T) {
+		home := t.TempDir()
+		// uv is present and records if it ever installs; it must not be called once a
+		// concurrent client finishes the toolchain while we wait for the lock.
+		writeFakeExec(t, filepath.Join(home, agentDepsDir, "uv"), "uv", fakeUvRecorder)
+		marker := filepath.Join(t.TempDir(), "uv.log")
+		t.Setenv("FAKE_UV_LOG", marker)
+		t.Setenv("PATH", t.TempDir())
+
+		// Hold the setup lock to stand in for another client mid-install.
+		unlock, err := acquireSetupLock(t.Context(), home)
+		require.NoError(t, err)
+
+		ctx := cmdio.MockDiscard(t.Context())
+		done := make(chan error, 1)
+		go func() { done <- ensureToolchain(ctx, home, "amd64") }()
+
+		// The other client finishes: publish ug+npm into the PATH dir, then release
+		// the lock so the waiting ensureToolchain can proceed.
+		writeFakeExec(t, filepath.Join(home, uvToolBinDir), ugExecutable, ":")
+		writeFakeExec(t, filepath.Join(home, agentDepsDir, "node", "bin"), "npm", ":")
+		unlock()
+
+		require.NoError(t, <-done)
+		assert.NoFileExists(t, marker, "the post-lock readiness recheck must skip installing")
+	})
+}
+
+func TestSupportedAgents(t *testing.T) {
+	names := SupportedAgentNames()
+	assert.Equal(t, []string{"claude", "codex"}, names)
+
+	// Each agent injects context by exactly one mechanism (flag OR home file);
+	// the two are never both set.
+	expect := map[string]struct{ flag, home string }{
+		"claude": {flag: "--append-system-prompt-file"},
+		"codex":  {home: ".codex/AGENTS.md"},
+	}
+	for name, want := range expect {
+		a, ok := agentByName(name)
+		require.True(t, ok)
+		assert.Equal(t, want.flag, a.contextFlag, "%s contextFlag", name)
+		assert.Equal(t, want.home, a.contextHomeFile, "%s contextHomeFile", name)
+	}
+
+	_, ok := agentByName("not-an-agent")
+	assert.False(t, ok)
+}
+
+func TestInjectAgentContext(t *testing.T) {
+	claude, _ := agentByName("claude")
+	codex, _ := agentByName("codex")
+	noContext := agentSpec{name: "none"} // an agent with neither mechanism
+
+	t.Run("flag agent writes a scratch file and returns the flag", func(t *testing.T) {
+		home := t.TempDir()
+		args, err := injectAgentContext(t.Context(), home, claude)
+		require.NoError(t, err)
+		require.Len(t, args, 2)
+		assert.Equal(t, "--append-system-prompt-file", args[0])
+		data, err := os.ReadFile(args[1])
+		require.NoError(t, err)
+		assert.Contains(t, string(data), "databricks ssh connect")
+	})
+
+	t.Run("home-file agent writes the global instructions file, no args", func(t *testing.T) {
+		home := t.TempDir()
+		args, err := injectAgentContext(t.Context(), home, codex)
+		require.NoError(t, err)
+		assert.Nil(t, args)
+		data, err := os.ReadFile(filepath.Join(home, ".codex", "AGENTS.md"))
+		require.NoError(t, err)
+		assert.Contains(t, string(data), "databricks ssh connect")
+	})
+
+	t.Run("home-file agent does not clobber an existing file", func(t *testing.T) {
+		home := t.TempDir()
+		target := filepath.Join(home, ".codex", "AGENTS.md")
+		require.NoError(t, os.MkdirAll(filepath.Dir(target), 0o755))
+		require.NoError(t, os.WriteFile(target, []byte("user's own instructions"), 0o644))
+		args, err := injectAgentContext(t.Context(), home, codex)
+		require.NoError(t, err)
+		assert.Nil(t, args)
+		data, err := os.ReadFile(target)
+		require.NoError(t, err)
+		assert.Equal(t, "user's own instructions", string(data))
+	})
+
+	t.Run("agent without a mechanism writes nothing", func(t *testing.T) {
+		home := t.TempDir()
+		args, err := injectAgentContext(t.Context(), home, noContext)
+		require.NoError(t, err)
+		assert.Nil(t, args)
+		entries, err := os.ReadDir(home)
+		require.NoError(t, err)
+		assert.Empty(t, entries)
+	})
+}
+
+func TestAgentSystemContext(t *testing.T) {
+	assert.Contains(t, agentSystemContext("/Workspace/Users/me@example.com"), "working directory is /Workspace/Users/me@example.com")
+	// Falls back to a generic phrase when the workspace home is unknown.
+	assert.Contains(t, agentSystemContext(""), "working directory is the user's Databricks workspace home directory")
+}
+
+func newProbeClient(t *testing.T, host string) *databricks.WorkspaceClient {
+	t.Helper()
+	w, err := databricks.NewWorkspaceClient((*databricks.Config)(&config.Config{
+		Host:  host,
+		Token: "test-token",
+		// The fake gateway server has no /.well-known/databricks-config, so skip
+		// the metadata fetch that would otherwise log a noisy resolve warning.
+		HostMetadataResolver: func(context.Context, string) (*config.HostMetadata, error) {
+			return nil, nil
+		},
+	}))
+	require.NoError(t, err)
+	return w
+}
+
+// newGatewayServer routes the model-services (v3) and legacy endpoints (v2) probe
+// requests to per-API handlers, 404ing anything else (e.g. the SDK's config
+// discovery). A nil handler means that API is not served (404).
+func newGatewayServer(t *testing.T, modelServices, endpoints http.HandlerFunc) *httptest.Server {
+	t.Helper()
+	return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case strings.HasPrefix(r.URL.Path, "/api/2.1/unity-catalog/model-services") && modelServices != nil:
+			assert.Equal(t, "Bearer test-token", r.Header.Get("Authorization"))
+			modelServices(w, r)
+		case strings.HasPrefix(r.URL.Path, "/api/ai-gateway/v2/endpoints") && endpoints != nil:
+			assert.Equal(t, "Bearer test-token", r.Header.Get("Authorization"))
+			endpoints(w, r)
+		default:
+			w.WriteHeader(http.StatusNotFound)
+			_, _ = w.Write([]byte("{}"))
+		}
+	}))
+}
+
+// jsonHandler replies with status and body for every request it receives.
+func jsonHandler(status int, body string) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(status)
+		_, _ = w.Write([]byte(body))
+	}
+}
+
+func TestProbeAIGateway(t *testing.T) {
+	const modelServicesBody = `{"model_services":[{"name":"model-services/system.ai.gpt-5"}]}`
+	const endpointsBody = `{"endpoints":[{"name":"databricks-gpt-5"}]}`
+	const emptyBody = `{}`
+
+	t.Run("model service available: connected, legacy not probed", func(t *testing.T) {
+		var legacyCalls int
+		srv := newGatewayServer(t,
+			jsonHandler(http.StatusOK, modelServicesBody),
+			func(w http.ResponseWriter, r *http.Request) {
+				legacyCalls++
+				w.WriteHeader(http.StatusOK)
+				_, _ = w.Write([]byte(emptyBody))
+			},
+		)
+		defer srv.Close()
+		require.NoError(t, probeAIGateway(t.Context(), newProbeClient(t, srv.URL)))
+		assert.Zero(t, legacyCalls, "legacy endpoints must not be probed once a model service is found")
+	})
+
+	t.Run("model service found across pages", func(t *testing.T) {
+		srv := newGatewayServer(t, func(w http.ResponseWriter, r *http.Request) {
+			w.WriteHeader(http.StatusOK)
+			if r.URL.Query().Get("page_token") == "" {
+				_, _ = w.Write([]byte(`{"next_page_token":"cursor-1"}`))
+				return
+			}
+			_, _ = w.Write([]byte(modelServicesBody))
+		}, nil)
+		defer srv.Close()
+		require.NoError(t, probeAIGateway(t.Context(), newProbeClient(t, srv.URL)))
+	})
+
+	t.Run("empty model service but legacy reachable: proceeds", func(t *testing.T) {
+		// v3 200-empty and v2 200-empty: both reachable, no resources → proceed (warn).
+		srv := newGatewayServer(t, jsonHandler(http.StatusOK, emptyBody), jsonHandler(http.StatusOK, emptyBody))
+		defer srv.Close()
+		assert.NoError(t, probeAIGateway(t.Context(), newProbeClient(t, srv.URL)))
+	})
+
+	t.Run("legacy-only workspace (v3 404, v2 reachable): proceeds", func(t *testing.T) {
+		srv := newGatewayServer(t,
+			jsonHandler(http.StatusNotFound, `{"message":"not found"}`),
+			jsonHandler(http.StatusOK, endpointsBody),
+		)
+		defer srv.Close()
+		assert.NoError(t, probeAIGateway(t.Context(), newProbeClient(t, srv.URL)))
+	})
+
+	t.Run("auth failure (401) fails fast without probing legacy", func(t *testing.T) {
+		var legacyCalls int
+		srv := newGatewayServer(t,
+			jsonHandler(http.StatusUnauthorized, `{"message":"unauthorized"}`),
+			func(w http.ResponseWriter, r *http.Request) {
+				legacyCalls++
+				w.WriteHeader(http.StatusOK)
+				_, _ = w.Write([]byte(endpointsBody))
+			},
+		)
+		defer srv.Close()
+		err := probeAIGateway(t.Context(), newProbeClient(t, srv.URL))
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "rejected the access token")
+		assert.Zero(t, legacyCalls, "a definitive auth failure must not fall back to the legacy probe")
+	})
+
+	t.Run("missing OAuth scope on both paths routes to re-auth", func(t *testing.T) {
+		scope := jsonHandler(http.StatusForbidden, `{"error_code":"PERMISSION_DENIED","message":"Provided OAuth token does not have required scopes: unity-catalog"}`)
+		srv := newGatewayServer(t, scope, scope)
+		defer srv.Close()
+		err := probeAIGateway(t.Context(), newProbeClient(t, srv.URL))
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "missing an OAuth scope")
+		assert.Contains(t, err.Error(), "databricks auth login")
+	})
+
+	t.Run("plain 403 on both paths is a permission failure", func(t *testing.T) {
+		forbidden := jsonHandler(http.StatusForbidden, `{"message":"forbidden"}`)
+		srv := newGatewayServer(t, forbidden, forbidden)
+		defer srv.Close()
+		err := probeAIGateway(t.Context(), newProbeClient(t, srv.URL))
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "model service access could not be verified")
+	})
+
+	t.Run("neither gateway available: not enabled", func(t *testing.T) {
+		notFound := jsonHandler(http.StatusNotFound, `{"message":"not found"}`)
+		srv := newGatewayServer(t, notFound, notFound)
+		defer srv.Close()
+		err := probeAIGateway(t.Context(), newProbeClient(t, srv.URL))
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "not enabled on this workspace")
+	})
+
+	t.Run("transient failure (5xx both) is retryable, not disabled", func(t *testing.T) {
+		unavailable := jsonHandler(http.StatusServiceUnavailable, `{"message":"try later"}`)
+		srv := newGatewayServer(t, unavailable, unavailable)
+		defer srv.Close()
+		err := probeAIGateway(t.Context(), newProbeClient(t, srv.URL))
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "transient error")
+		assert.NotContains(t, err.Error(), "not enabled")
+	})
+}
+
+func TestProbeModelServicesPageError(t *testing.T) {
+	// A failure while paging surfaces as a probe error: the iterator can't tell a
+	// first-page failure from a later-page one, so any page error is not treated
+	// as a reachable "empty".
+	srv := newGatewayServer(t, func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Query().Get("page_token") == "" {
+			w.WriteHeader(http.StatusOK)
+			_, _ = w.Write([]byte(`{"next_page_token":"cursor-1"}`))
+			return
+		}
+		w.WriteHeader(http.StatusInternalServerError)
+		_, _ = w.Write([]byte("boom"))
+	}, nil)
+	defer srv.Close()
+
+	apiClient, err := newProbeAPIClient(newProbeClient(t, srv.URL).Config)
+	require.NoError(t, err)
+	probe := probeModelServices(t.Context(), apiClient)
+	assert.False(t, probe.reachable)
+	assert.False(t, probe.resourceAvailable)
+	assert.Error(t, probe.err)
+}
+
+func TestBuildAgentShimEvent(t *testing.T) {
+	for _, agent := range supportedAgents {
+		t.Run(agent.name+" has an appropriate enum for telemetry", func(t *testing.T) {
+			got := buildAgentShimEvent(agent.name, agentShimOutcome{}, 0)
+			assert.NotEqual(t, protos.SshAgentShimAgentUnspecified, got.Agent)
+		})
+	}
+
+	t.Run("maps an unknown agent to unspecified", func(t *testing.T) {
+		got := buildAgentShimEvent("wibble", agentShimOutcome{}, 0)
+		assert.Equal(t, protos.SshAgentShimAgentUnspecified, got.Agent)
+	})
+
+	t.Run("successful launch reports success and no category", func(t *testing.T) {
+		got := buildAgentShimEvent("claude", agentShimOutcome{}, 1500*time.Millisecond)
+		assert.Equal(t, &protos.SshAgentShimEvent{
+			Agent:           protos.SshAgentShimAgentClaudeCode,
+			IsSuccess:       true,
+			ErrorCategory:   protos.SshAgentShimErrorCategoryUnspecified,
+			SetupDurationMs: 1500,
+		}, got)
+	})
+
+	t.Run("failed launch reports the attributed category", func(t *testing.T) {
+		got := buildAgentShimEvent("codex", agentShimOutcome{
+			err: categorize(protos.SshAgentShimErrorCategoryGatewayAuthFailed, errors.New("boom")),
+		}, 200*time.Millisecond)
+		assert.Equal(t, &protos.SshAgentShimEvent{
+			Agent:           protos.SshAgentShimAgentCodex,
+			IsSuccess:       false,
+			ErrorCategory:   protos.SshAgentShimErrorCategoryGatewayAuthFailed,
+			SetupDurationMs: 200,
+		}, got)
+	})
+}
+
+func TestAgentShimOutcomeCategory(t *testing.T) {
+	errFailed := errors.New("failed")
+
+	tests := []struct {
+		name    string
+		outcome agentShimOutcome
+		want    protos.SshAgentShimErrorCategory
+	}{
+		{
+			name:    "success reports no category",
+			outcome: agentShimOutcome{},
+			want:    protos.SshAgentShimErrorCategoryUnspecified,
+		},
+		{
+			name:    "attributed failure keeps its category",
+			outcome: agentShimOutcome{err: categorize(protos.SshAgentShimErrorCategoryUvInstallFailed, errFailed)},
+			want:    protos.SshAgentShimErrorCategoryUvInstallFailed,
+		},
+		{
+			// A deeper attributed category survives a stage's coarse fallback.
+			name:    "wrapped specific category survives the stage fallback",
+			outcome: agentShimOutcome{err: ensureCategory(protos.SshAgentShimErrorCategoryToolchainSetupFailed, categorize(protos.SshAgentShimErrorCategoryNodeInstallFailed, errFailed))},
+			want:    protos.SshAgentShimErrorCategoryNodeInstallFailed,
+		},
+		{
+			name:    "unattributed failure reports unknown",
+			outcome: agentShimOutcome{err: errFailed},
+			want:    protos.SshAgentShimErrorCategoryUnknown,
+		},
+		{
+			// A cancelled context means the user gave up, and wins over the failure site's category.
+			name:    "cancelled context reports user aborted",
+			outcome: agentShimOutcome{err: categorize(protos.SshAgentShimErrorCategoryToolchainSetupFailed, errFailed), ctxErr: context.Canceled},
+			want:    protos.SshAgentShimErrorCategoryUserAborted,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, tt.outcome.category())
+		})
+	}
+}
+
+func TestBootstrapToolchain(t *testing.T) {
+	// bootstrapToolchain runs the fake POSIX executables below, and agent-shim is
+	// only intended for Linux, so skip on Windows.
+	if runtime.GOOS == "windows" {
+		return
+	}
+
+	t.Run("returns the path to the Unity Gateway CLI", func(t *testing.T) {
+		home := t.TempDir()
+		writeFakeExec(t, filepath.Join(home, uvToolBinDir), ugExecutable, ":")
+		writeFakeExec(t, filepath.Join(home, agentDepsDir, "node", "bin"), npmExecutable, ":")
+		t.Setenv("PATH", t.TempDir())
+
+		ugPath, err := bootstrapToolchain(cmdio.MockDiscard(t.Context()), home)
+		require.NoError(t, err)
+		assert.Equal(t, filepath.Join(home, uvToolBinDir, ugExecutable), ugPath)
+	})
+
+	t.Run("reports UNITY_GATEWAY_CLI_NOT_FOUND when the install leaves no CLI on PATH", func(t *testing.T) {
+		home := t.TempDir()
+		// uv "succeeds" without installing anything, so the post-setup lookup fails.
+		writeFakeExec(t, filepath.Join(home, agentDepsDir, "uv"), "uv", ":")
+		writeFakeExec(t, filepath.Join(home, agentDepsDir, "node", "bin"), npmExecutable, ":")
+		t.Setenv("PATH", t.TempDir())
+
+		_, err := bootstrapToolchain(cmdio.MockDiscard(t.Context()), home)
+		require.Error(t, err)
+		assert.Equal(t, protos.SshAgentShimErrorCategoryUnityGatewayCLINotFound, agentShimOutcome{err: err}.category())
+	})
+}
+
+func TestSetEnvForUnityGateway(t *testing.T) {
+	t.Run("passes the session token as DATABRICKS_BEARER", func(t *testing.T) {
+		t.Setenv("DATABRICKS_TOKEN", "session-token")
+		t.Setenv("DATABRICKS_BEARER", "stale-bearer")
+		t.Setenv("UG_SKIP_OS_SETTINGS", "")
+		t.Setenv("AI_GATEWAY_REQUEST_TAGS", "")
+
+		require.NoError(t, setEnvForUnityGateway(t.Context()))
+		assert.Equal(t, "session-token", os.Getenv("DATABRICKS_BEARER"))
+		assert.Equal(t, "1", os.Getenv("UG_SKIP_OS_SETTINGS"))
+		assert.JSONEq(t, `{"source":"databricks-ssh"}`, os.Getenv("AI_GATEWAY_REQUEST_TAGS"))
+	})
+
+	t.Run("leaves DATABRICKS_BEARER unset without a session token", func(t *testing.T) {
+		t.Setenv("DATABRICKS_TOKEN", "")
+		t.Setenv("DATABRICKS_BEARER", "")
+		require.NoError(t, os.Unsetenv("DATABRICKS_BEARER"))
+		t.Setenv("UG_SKIP_OS_SETTINGS", "")
+		t.Setenv("AI_GATEWAY_REQUEST_TAGS", "")
+
+		require.NoError(t, setEnvForUnityGateway(t.Context()))
+		_, ok := os.LookupEnv("DATABRICKS_BEARER")
+		assert.False(t, ok)
+		assert.Equal(t, "1", os.Getenv("UG_SKIP_OS_SETTINGS"))
+		assert.JSONEq(t, `{"source":"databricks-ssh"}`, os.Getenv("AI_GATEWAY_REQUEST_TAGS"))
+	})
+}
+
+// fakeUgRecorder is the body of a stand-in `ug` that records its args to
+// $FAKE_UG_LOG. It uses only shell builtins so it needs nothing on PATH.
+const fakeUgRecorder = `echo "args: $*" > "$FAKE_UG_LOG"`
+
+func TestRunAgentConfiguration(t *testing.T) {
+	// runAgentConfiguration runs the fake POSIX `ug` below, and agent-shim is only
+	// intended for Linux, so skip on Windows.
+	if runtime.GOOS == "windows" {
+		return
+	}
+	agent, ok := agentByName("claude")
+	require.True(t, ok)
+
+	t.Run("configures the agent for the workspace", func(t *testing.T) {
+		binDir := t.TempDir()
+		writeFakeExec(t, binDir, ugExecutable, fakeUgRecorder)
+		marker := filepath.Join(t.TempDir(), "ug.log")
+		t.Setenv("FAKE_UG_LOG", marker)
+		t.Setenv("PATH", binDir)
+
+		require.NoError(t, runAgentConfiguration(cmdio.MockDiscard(t.Context()), agent, "https://example.test"))
+
+		out, err := os.ReadFile(marker)
+		require.NoError(t, err)
+		assert.Equal(t, "args: configure --agent claude --workspace https://example.test --enable-databricks-ai-tools\n", string(out))
+	})
+
+	t.Run("a failing configure reports AGENT_CONFIGURATION_FAILED", func(t *testing.T) {
+		binDir := t.TempDir()
+		writeFakeExec(t, binDir, ugExecutable, "exit 1")
+		t.Setenv("PATH", binDir)
+
+		err := runAgentConfiguration(cmdio.MockDiscard(t.Context()), agent, "https://example.test")
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "failed to configure claude")
+		assert.Equal(t, protos.SshAgentShimErrorCategoryAgentConfigurationFailed, agentShimOutcome{err: err}.category())
+	})
+}
+
+func TestPrepareAgentLaunch(t *testing.T) {
+	agent, ok := agentByName("claude")
+	require.True(t, ok)
+
+	t.Run("passes the context args before the user's agent args", func(t *testing.T) {
+		home := t.TempDir()
+		argv, environ, err := prepareAgentLaunch(t.Context(), home, agent, []string{"--resume"})
+		require.NoError(t, err)
+		require.NotEmpty(t, argv)
+		assert.Equal(t, []string{"claude", "--", "--append-system-prompt-file", filepath.Join(home, agentRootDir, contextFile), "--resume"}, argv[1:])
+		assert.Equal(t, os.Environ(), environ)
+	})
+
+	t.Run("a context setup failure reports AGENT_CONTEXT_SETUP_FAILED", func(t *testing.T) {
+		// A regular file where the home directory should be makes creating the
+		// context directory fail.
+		home := filepath.Join(t.TempDir(), "home")
+		require.NoError(t, os.WriteFile(home, nil, 0o644))
+
+		_, _, err := prepareAgentLaunch(t.Context(), home, agent, nil)
+		require.Error(t, err)
+		assert.Equal(t, protos.SshAgentShimErrorCategoryAgentContextSetupFailed, agentShimOutcome{err: err}.category())
+	})
+}
diff --git a/experimental/ssh/internal/client/capabilities_test.go b/experimental/ssh/internal/client/capabilities_test.go
new file mode 100644
index 00000000000..022f625f98f
--- /dev/null
+++ b/experimental/ssh/internal/client/capabilities_test.go
@@ -0,0 +1,46 @@
+package client
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/stretchr/testify/require"
+)
+
+// The capabilities probe runs before the tunnel is dialled, on every proxy-mode connect. A driver
+// proxy that accepts the request and never answers must not hold the connect path open: resume is
+// an optimisation, and failing to learn about it has to cost bounded time, not the whole session.
+func TestServerSupportsResumeGivesUpOnAStalledServer(t *testing.T) {
+	restore := capabilitiesProbeTimeout
+	capabilitiesProbeTimeout = 100 * time.Millisecond
+	defer func() { capabilitiesProbeTimeout = restore }()
+
+	stalled := make(chan struct{})
+
+	mux := http.NewServeMux()
+	mux.HandleFunc("GET /driver-proxy-api/o/123/cluster/7772/capabilities", func(w http.ResponseWriter, r *http.Request) {
+		<-stalled
+	})
+	server := httptest.NewServer(mux)
+	// LIFO: release the stalled handler first, so Close does not wait on it.
+	defer server.Close()
+	defer close(stalled)
+
+	client, err := databricks.NewWorkspaceClient(&databricks.Config{Host: server.URL, Token: "test-token", WorkspaceID: "123", AuthType: "pat"})
+	require.NoError(t, err)
+
+	done := make(chan bool, 1)
+	go func() {
+		done <- serverSupportsResume(t.Context(), client, "cluster", 7772, "")
+	}()
+
+	select {
+	case resumable := <-done:
+		require.False(t, resumable, "a server that never answered cannot be assumed to support resume")
+	case <-time.After(time.Second):
+		t.Fatal("the capabilities probe never returned: it has no timeout of its own, so a stalled driver proxy blocks the connect path indefinitely")
+	}
+}
diff --git a/experimental/ssh/internal/client/client.go b/experimental/ssh/internal/client/client.go
index 5ab096d2929..3ac21fab8f9 100644
--- a/experimental/ssh/internal/client/client.go
+++ b/experimental/ssh/internal/client/client.go
@@ -6,6 +6,7 @@ import (
 	_ "embed"
 	"encoding/base64"
 	"encoding/hex"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
@@ -26,12 +27,18 @@ import (
 	"github.com/databricks/cli/experimental/ssh/internal/vscode"
 	sshWorkspace "github.com/databricks/cli/experimental/ssh/internal/workspace"
 	"github.com/databricks/cli/internal/build"
+	"github.com/databricks/cli/libs/auth"
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/telemetry"
+	"github.com/databricks/cli/libs/telemetry/protos"
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/retries"
 	"github.com/databricks/databricks-sdk-go/service/compute"
+	"github.com/databricks/databricks-sdk-go/service/environments"
+	"github.com/databricks/databricks-sdk-go/service/iam"
 	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/databricks/databricks-sdk-go/service/settingsv2"
 	"github.com/databricks/databricks-sdk-go/service/workspace"
 	"github.com/gorilla/websocket"
 )
@@ -41,14 +48,40 @@ var sshServerBootstrapScript string
 
 var errServerMetadata = errors.New("server metadata error")
 
+// portFwdServerlessSetting is the workspace setting an administrator turns off to disable port
+// forwarding to serverless compute, which the tunnel needs.
+const portFwdServerlessSetting = "port_fwd_serverless_enabled"
+
+var errPortForwardingDisabled = errors.New("port forwarding to serverless compute is disabled for this workspace " +
+	"(setting " + portFwdServerlessSetting + "), and the SSH tunnel needs it. " +
+	"Ask a workspace or account admin to enable it, or connect to a dedicated cluster with --cluster")
+
+// errDriverProxyForbidden is a 403 from the driver proxy. Unlike the other non-200 responses, which a
+// server that is still starting produces too, retrying cannot change it: the workspace forbids the
+// connection, e.g. because an administrator disabled port forwarding to serverless compute.
+var errDriverProxyForbidden = errors.New("the workspace refused the SSH tunnel connection")
+
 var connectionNameRegex = regexp.MustCompile(`^[a-zA-Z0-9][a-zA-Z0-9_-]*$`)
 
 const (
 	sshServerTaskKey         = "start_ssh_server"
 	serverlessEnvironmentKey = "ssh_tunnel_serverless"
 	minEnvironmentVersion    = 4
+
+	serverMetadataTimeout      = 5 * time.Minute
+	serverMetadataPollInterval = 2 * time.Second
 )
 
+// acceleratorProvisioningNotice maps a GPU accelerator type to the upfront notice
+// shown while its serverless compute is provisioned. Latencies vary widely by type
+// (a single A10 is acquired in minutes; an 8xH100 node is ~10 min at P50 and can
+// exceed 30 min at P90), so the wording is tuned per type to set expectations
+// accurately. Types absent from this map fall back to a generic message.
+var acceleratorProvisioningNotice = map[string]string{
+	"GPU_1xA10":  "Provisioning GPU_1xA10 compute. This usually takes a few minutes and may take longer when capacity is constrained.",
+	"GPU_8xH100": "Provisioning GPU_8xH100 compute. This typically takes around 10 minutes and can exceed 30 minutes when capacity is constrained.",
+}
+
 type ClientOptions struct {
 	// Id of the cluster to connect to (for dedicated clusters)
 	ClusterID string
@@ -71,6 +104,8 @@ type ClientOptions struct {
 	ServerMetadata string
 	// How often the CLI should reconnect to the server with new auth.
 	HandoverTimeout time.Duration
+	// How often the CLI pings the tunnel websocket to keep an idle session alive.
+	KeepaliveInterval time.Duration
 	// Max amount of time the server process is allowed to live
 	ServerTimeout time.Duration
 	// Max amount of time to wait for the SSH server task to reach RUNNING state
@@ -80,26 +115,40 @@ type ClientOptions struct {
 	ReleasesDir string
 	// Directory for local SSH keys. Defaults to ~/.databricks/ssh-tunnel-keys
 	SSHKeysDir string
+	// Directory for the known hosts files the CLI maintains for tunnel connections.
+	// Defaults to ~/.databricks/ssh-tunnel-known-hosts. The file within it is always named
+	// after the session, so this relocates a directory the CLI owns and rewrites; it never
+	// names a file to overwrite.
+	KnownHostsDir string
 	// Client public key name located in the ssh-tunnel secrets scope.
 	ClientPublicKeyName string
 	// Client private key name located in the ssh-tunnel secrets scope.
 	ClientPrivateKeyName string
+	// Server public key name located in the ssh-tunnel secrets scope. The server publishes
+	// its host key there; the client pins it so ssh can verify the server.
+	ServerPublicKeyName string
 	// If true, the CLI will attempt to start the cluster if it is not running.
 	AutoStartCluster bool
 	// Optional auth profile name. If present, will be added as --profile flag to the ProxyCommand while spawning ssh client.
 	Profile string
 	// Additional arguments to pass to the SSH client in the non proxy mode.
 	AdditionalArgs []string
-	// Optional path to the user known hosts file.
-	UserKnownHostsFile string
 	// Liteswap header value for traffic routing (dev/test only).
 	Liteswap string
 	// If true, skip checking and updating IDE settings.
 	SkipSettingsCheck bool
 	// Environment version for serverless compute.
 	EnvironmentVersion int
+	// Base environment for serverless compute. Accepts an env.yaml path (leading "/"),
+	// a "workspace-base-environments/..." resource ID, or a bare display name resolved
+	// against the workspace base environments. Maps to compute.Environment.BaseEnvironment.
+	BaseEnvironment string
 	// If true, skip confirmation prompts for IDE extension install and IDE settings updates.
 	AutoApprove bool
+	// Id of the usage policy to use for the serverless SSH server job. Serverless only.
+	UsagePolicyID string
+	// Whether detached processes prevent idle shutdown of the SSH server. Bounded by --server-timeout.
+	KeepDetachedProcesses bool
 }
 
 func (o *ClientOptions) Validate() error {
@@ -109,6 +158,9 @@ func (o *ClientOptions) Validate() error {
 	if o.Accelerator != "" && o.ConnectionName == "" {
 		return errors.New("--accelerator flag can only be used with serverless compute (--name flag)")
 	}
+	if o.UsagePolicyID != "" && o.ClusterID != "" {
+		return errors.New("--usage-policy-id flag can only be used with serverless compute (--name flag)")
+	}
 	if o.Accelerator != "" && o.Accelerator != "GPU_1xA10" && o.Accelerator != "GPU_8xH100" {
 		return fmt.Errorf("invalid accelerator value: %q, expected %q or %q", o.Accelerator, "GPU_1xA10", "GPU_8xH100")
 	}
@@ -121,15 +173,47 @@ func (o *ClientOptions) Validate() error {
 	if o.EnvironmentVersion > 0 && o.EnvironmentVersion < minEnvironmentVersion {
 		return fmt.Errorf("environment version must be >= %d, got %d", minEnvironmentVersion, o.EnvironmentVersion)
 	}
+	// base_environment and environment_version are mutually exclusive in the SDK,
+	// and a custom base environment only applies to serverless compute.
+	if o.BaseEnvironment != "" && o.EnvironmentVersion > 0 {
+		return errors.New("--base-environment cannot be used together with --environment-version")
+	}
+	if o.BaseEnvironment != "" && o.ClusterID != "" {
+		return errors.New("--base-environment can only be used with serverless compute")
+	}
+	// A server started with fewer than one client slot rejects every connection with an
+	// opaque websocket handshake failure, so catch it here instead.
+	if o.MaxClients < 1 {
+		return fmt.Errorf("--max-clients must be at least 1, got %d", o.MaxClients)
+	}
+	// The submitted job carries this as timeout_seconds, a whole number of seconds, and 0 means
+	// "no timeout" in the Jobs API. So every value below one second - not just zero - truncates
+	// to an unbounded run instead of the short-lived server that was asked for.
+	if o.ServerTimeout < time.Second {
+		return fmt.Errorf("--server-timeout must be at least 1s, got %s", o.ServerTimeout)
+	}
+	// The server only starts counting down the shutdown delay once the last client leaves, so a
+	// delay longer than the server's lifetime can never elapse.
+	if o.ShutdownDelay > o.ServerTimeout {
+		return fmt.Errorf("--shutdown-delay (%s) cannot be longer than --server-timeout (%s)", o.ShutdownDelay, o.ServerTimeout)
+	}
 	return nil
 }
 
 // GenerateDefaultConnectionName creates a deterministic connection name from
-// the workspace host and accelerator type. The name includes a hash of the
-// workspace host so that different workspaces produce different names,
-// avoiding SSH known_hosts conflicts.
-func GenerateDefaultConnectionName(host, accelerator string) string {
-	h := md5.Sum([]byte(host))
+// the workspace host, accelerator type, and base environment. The name includes
+// a hash so that different workspaces produce different names (avoiding SSH
+// known_hosts conflicts). The environment is folded into the hash because a
+// serverless server bakes in its environment at startup: distinct environments
+// must map to distinct connection names so they don't reuse each other's server.
+func GenerateDefaultConnectionName(host, accelerator, baseEnvironment string) string {
+	// Keep the hash host-only when no base environment is set so existing default
+	// connection names are preserved.
+	hashInput := host
+	if baseEnvironment != "" {
+		hashInput = host + "\x00" + baseEnvironment
+	}
+	h := md5.Sum([]byte(hashInput))
 	hashStr := hex.EncodeToString(h[:4])
 	if accelerator != "" {
 		acc := strings.ToLower(strings.ReplaceAll(accelerator, "_", "-"))
@@ -179,10 +263,28 @@ func (o *ClientOptions) ToProxyCommand() (string, error) {
 		if o.Accelerator != "" {
 			proxyCommand += " --accelerator=" + o.Accelerator
 		}
+		if o.UsagePolicyID != "" {
+			proxyCommand += " --usage-policy-id=" + o.UsagePolicyID
+		}
 	} else {
 		proxyCommand = fmt.Sprintf("%q ssh connect --proxy --cluster=%s --auto-start-cluster=%t --shutdown-delay=%s",
 			executablePath, o.ClusterID, o.AutoStartCluster, o.ShutdownDelay.String())
 	}
+	if o.KeepDetachedProcesses {
+		proxyCommand += " --keep-detached-processes"
+	}
+
+	// Both of these are fixed when the server job is submitted, and for a host configured by
+	// `ssh setup` the submitting invocation is always the ProxyCommand, so they have to be
+	// carried here or the user's choice is lost. Zero means "not set": the receiving command
+	// then applies its own flag default.
+	if o.MaxClients > 0 {
+		proxyCommand += " --max-clients=" + strconv.Itoa(o.MaxClients)
+	}
+
+	if o.ServerTimeout > 0 {
+		proxyCommand += " --server-timeout=" + o.ServerTimeout.String()
+	}
 
 	if o.ServerMetadata != "" {
 		proxyCommand += " --metadata=" + o.ServerMetadata
@@ -204,10 +306,18 @@ func (o *ClientOptions) ToProxyCommand() (string, error) {
 		proxyCommand += " --environment-version=" + strconv.Itoa(o.EnvironmentVersion)
 	}
 
+	if o.BaseEnvironment != "" {
+		// Shell-quote the value: this command is persisted as an OpenSSH ProxyCommand
+		// and executed via the shell, and base environments accept user-controlled
+		// display names/paths that may contain spaces or shell metacharacters.
+		// Single-quoting (unlike strconv.Quote's double quotes) prevents any expansion.
+		proxyCommand += " --base-environment=" + shellSingleQuote(o.BaseEnvironment)
+	}
+
 	return proxyCommand, nil
 }
 
-func Run(ctx context.Context, client *databricks.WorkspaceClient, opts ClientOptions) error {
+func Run(ctx context.Context, client *databricks.WorkspaceClient, opts ClientOptions) (retErr error) {
 	ctx, cancel := context.WithCancel(ctx)
 	defer cancel()
 
@@ -219,6 +329,23 @@ func Run(ctx context.Context, client *databricks.WorkspaceClient, opts ClientOpt
 		cancel()
 	}()
 
+	// Report the outcome of every path below, so a failure is attributable to the step that
+	// caused it. Registered before the first early return -- in particular before the IDE
+	// preconditions, which fail fast on a permanent per-machine condition and are the failures
+	// most worth measuring. Each failing step sets outcome.errorCategory; the returned error is
+	// picked up here via the named return.
+	outcome := connectOutcome{isReconnect: opts.ServerMetadata != ""}
+	defer func() {
+		outcome.err = retErr
+		// A cancelled context is the only trace a Ctrl-C leaves: exec.CommandContext kills the
+		// child and reports *exec.ExitError, which does not wrap context.Canceled, so a step
+		// that shells out cannot recognise the interruption itself. This defer is registered
+		// after `defer cancel()` and so runs before it (LIFO), which means ctx is cancelled
+		// here only by the signal handler or the caller, never by Run's own cleanup.
+		outcome.ctxErr = ctx.Err()
+		logSshTunnelEvent(ctx, opts, outcome)
+	}()
+
 	sessionID := opts.SessionIdentifier()
 	if sessionID == "" {
 		return errors.New("either --cluster or --name must be provided")
@@ -226,16 +353,24 @@ func Run(ctx context.Context, client *databricks.WorkspaceClient, opts ClientOpt
 
 	if !opts.ProxyMode {
 		cmdio.LogString(ctx, fmt.Sprintf("Connecting to %s...", sessionID))
-		if opts.IsServerlessMode() && opts.Accelerator == "" {
-			cmdio.LogString(ctx, cmdio.Yellow(ctx, "WARNING: serverless compute without an accelerator is in private preview. If you are not enrolled, this command will likely time out with an error. Contact your Databricks account team to enroll."))
+	}
+
+	// Skipped when reconnecting with --metadata (the ProxyCommand child): the server is already
+	// running, so there is no compute left to spare, and every IDE reconnect would repeat the read.
+	if opts.IsServerlessMode() && opts.ServerMetadata == "" {
+		if err := checkPortForwardingToServerless(ctx, client); err != nil {
+			outcome.errorCategory = protos.SshTunnelErrorCategoryPortForwardingDisabled
+			return err
 		}
 	}
 
 	if opts.IDE != "" && !opts.ProxyMode {
 		if err := vscode.CheckIDECommand(opts.IDE); err != nil {
+			outcome.errorCategory = protos.SshTunnelErrorCategoryIDECommandNotOnPath
 			return err
 		}
 		if err := vscode.CheckIDESSHExtension(ctx, opts.IDE, opts.AutoApprove); err != nil {
+			outcome.errorCategory = sshExtensionErrorCategory(err)
 			return err
 		}
 	}
@@ -251,44 +386,63 @@ func Run(ctx context.Context, client *databricks.WorkspaceClient, opts ClientOpt
 			cmdio.LogString(ctx, vscode.GetManualInstructions(opts.IDE, opts.ConnectionName))
 			cmdio.LogString(ctx, "Use --skip-settings-check to bypass IDE settings verification.")
 			if opts.AutoApprove {
+				outcome.errorCategory = protos.SshTunnelErrorCategoryIDESettingsUpdateDeclined
 				return fmt.Errorf("aborted: IDE settings need to be updated manually: %w", err)
 			}
 			shouldProceed, promptErr := cmdio.AskYesOrNo(ctx, "Do you want to proceed with the connection?")
 			if promptErr != nil {
+				outcome.errorCategory = protos.SshTunnelErrorCategoryIDESettingsUpdateDeclined
 				return fmt.Errorf("failed to prompt user: %w", promptErr)
 			}
 			if !shouldProceed {
+				outcome.errorCategory = protos.SshTunnelErrorCategoryIDESettingsUpdateDeclined
 				return errors.New("aborted: IDE settings need to be updated manually, user declined to proceed")
 			}
 		}
 	}
 
+	// A direct `connect --cluster` bypasses `ssh setup`, which is where the access mode is
+	// normally validated, so validate it here too. Proxy mode is skipped because its
+	// ProxyCommand was generated by `setup` (already validated), and re-checking would add a
+	// Clusters.Get on every (re)connection. Serverless has no cluster to inspect.
+	if !opts.ProxyMode && !opts.IsServerlessMode() {
+		if err := ValidateClusterAccess(ctx, client, opts.ClusterID); err != nil {
+			outcome.errorCategory = protos.SshTunnelErrorCategoryClusterAccessDenied
+			return err
+		}
+	}
+
 	// Only check cluster state for dedicated clusters
 	if !opts.IsServerlessMode() {
 		cmdio.LogString(ctx, "Checking cluster state...")
 		err := checkClusterState(ctx, client, opts.ClusterID, opts.AutoStartCluster)
 		if err != nil {
+			outcome.errorCategory = protos.SshTunnelErrorCategoryClusterStartFailed
 			return err
 		}
 	}
 
 	secretScopeName, err := keys.CreateKeysSecretScope(ctx, client, sessionID)
 	if err != nil {
+		outcome.errorCategory = protos.SshTunnelErrorCategorySecretScopeFailed
 		return fmt.Errorf("failed to create secret scope: %w", err)
 	}
 
 	privateKeyBytes, publicKeyBytes, err := keys.CheckAndGenerateSSHKeyPairFromSecrets(ctx, client, secretScopeName, opts.ClientPrivateKeyName, opts.ClientPublicKeyName)
 	if err != nil {
+		outcome.errorCategory = protos.SshTunnelErrorCategoryKeyGenerationFailed
 		return fmt.Errorf("failed to get or generate SSH key pair from secrets: %w", err)
 	}
 
 	keyPath, err := keys.GetLocalSSHKeyPath(ctx, sessionID, opts.SSHKeysDir)
 	if err != nil {
+		outcome.errorCategory = protos.SshTunnelErrorCategoryKeyGenerationFailed
 		return fmt.Errorf("failed to get local keys folder: %w", err)
 	}
 
 	err = keys.SaveSSHKeyPair(keyPath, privateKeyBytes, publicKeyBytes)
 	if err != nil {
+		outcome.errorCategory = protos.SshTunnelErrorCategoryKeyGenerationFailed
 		return fmt.Errorf("failed to save SSH key pair locally: %w", err)
 	}
 	log.Infof(ctx, "Using SSH key: %s", keyPath)
@@ -307,17 +461,24 @@ func Run(ctx context.Context, client *databricks.WorkspaceClient, opts ClientOpt
 		err := UploadTunnelReleases(ctx, client, version, opts.ReleasesDir)
 		sp.Close()
 		if err != nil {
+			outcome.errorCategory = protos.SshTunnelErrorCategoryBinaryUploadFailed
 			return fmt.Errorf("failed to upload ssh-tunnel binaries: %w", err)
 		}
+		serverStartTime := time.Now()
 		userName, serverPort, clusterID, err = ensureSSHServerIsRunning(ctx, client, version, secretScopeName, opts)
 		if err != nil {
-			if opts.IsServerlessMode() && opts.Accelerator == "" && errors.Is(err, errServerMetadata) {
-				return fmt.Errorf("failed to ensure that ssh server is running: %w\n\n"+
-					cmdio.Yellow(ctx, "This may be because serverless compute without an accelerator is in private preview.\nContact your Databricks account team to enroll."), err)
+			outcome.errorCategory = protos.SshTunnelErrorCategoryServerStartTimeout
+			if errors.Is(err, errDriverProxyForbidden) {
+				outcome.errorCategory = protos.SshTunnelErrorCategoryDriverProxyForbidden
 			}
 			return fmt.Errorf("failed to ensure that ssh server is running: %w", err)
 		}
+		outcome.serverStartTimeMs = time.Since(serverStartTime).Milliseconds()
 	} else {
+		// The failures below are left to fall through to UNKNOWN on purpose: --metadata is a
+		// hidden flag whose value we generated ourselves in ToProxyCommand, so a parse failure
+		// here is a CLI bug rather than a per-environment blocker. Attributing them to
+		// SERVER_START_TIMEOUT would pollute the bucket that tracks unreachable servers.
 		// Metadata format: "<user_name>,<port>,<cluster_id>"
 		metadata := strings.Split(opts.ServerMetadata, ",")
 		if len(metadata) < 2 {
@@ -349,28 +510,73 @@ func Run(ctx context.Context, client *databricks.WorkspaceClient, opts ClientOpt
 		log.Infof(ctx, "Cluster ID (from serverless job): %s", clusterID)
 	}
 
+	// Pin the running server's host key for this session name. In proxy mode this happens
+	// before the tunnel carries a single byte, so it is in place well before the ssh client
+	// that spawned us verifies the key during the key exchange.
+	knownHostsPath, err := pinServerHostKey(ctx, client, sessionID, secretScopeName, opts)
+	if err != nil {
+		outcome.errorCategory = protos.SshTunnelErrorCategoryKeyGenerationFailed
+		return err
+	}
+
 	if !opts.ProxyMode {
 		cmdio.LogString(ctx, "Connected!")
 	}
 
+	// The tunnel is up from here on. A later non-zero exit belongs to the SSH client or the
+	// user's own remote command, so it is not counted as a connection failure.
+	outcome.isSuccess = true
+
 	if opts.ProxyMode {
-		return runSSHProxy(ctx, client, serverPort, clusterID, opts)
+		proxyErr := runSSHProxy(ctx, client, serverPort, clusterID, opts)
+		// isSuccess stays true - the tunnel was established - so the category is what says
+		// whether the session ran to completion or was cut short, and why. Without it a
+		// mid-session drop is indistinguishable from a clean exit in telemetry.
+		outcome.errorCategory = proxySessionEndCategory(proxyErr)
+		return proxyErr
 	} else if opts.IDE != "" {
-		return runIDE(ctx, client, userName, keyPath, serverPort, clusterID, opts)
+		return runIDE(ctx, client, userName, keyPath, knownHostsPath, serverPort, clusterID, opts)
 	} else {
 		log.Infof(ctx, "Additional SSH arguments: %v", opts.AdditionalArgs)
-		return spawnSSHClient(ctx, userName, keyPath, serverPort, clusterID, opts)
+		return spawnSSHClient(ctx, client, userName, keyPath, knownHostsPath, serverPort, clusterID, version, opts)
 	}
 }
 
-func runIDE(ctx context.Context, client *databricks.WorkspaceClient, userName, keyPath string, serverPort int, clusterID string, opts ClientOptions) error {
+// pinServerHostKey records the running server's host key as the entry ssh accepts for this
+// session, and returns the path of the known_hosts file it wrote.
+//
+// The server publishes its host key to the session's secret scope when it starts and reuses
+// it for every sshd it launches, which makes the scope the authority on the key. Reading it
+// here replaces whatever was recorded for this session name before, so a key left by an
+// earlier instance - or by the same name in another workspace, since a name is unique only
+// within one - can no longer fail an otherwise valid connection.
+func pinServerHostKey(ctx context.Context, client *databricks.WorkspaceClient, sessionID, secretScopeName string, opts ClientOptions) (string, error) {
+	knownHostsPath, err := sshconfig.GetKnownHostsPath(ctx, sessionID, opts.KnownHostsDir)
+	if err != nil {
+		return "", err
+	}
+
+	publicKey, err := keys.GetSecret(ctx, client, secretScopeName, opts.ServerPublicKeyName)
+	if err != nil {
+		return "", fmt.Errorf("failed to read the SSH server host key: %w", err)
+	}
+
+	if err := sshconfig.PinHostKey(knownHostsPath, sessionID, publicKey); err != nil {
+		return "", err
+	}
+
+	log.Infof(ctx, "Pinned the SSH server host key for %s in %s", sessionID, knownHostsPath)
+	return knownHostsPath, nil
+}
+
+func runIDE(ctx context.Context, client *databricks.WorkspaceClient, userName, keyPath, knownHostsPath string, serverPort int, clusterID string, opts ClientOptions) error {
 	connectionName := opts.SessionIdentifier()
 	if connectionName == "" {
 		return errors.New("connection name is required for IDE integration")
 	}
 
 	// Get Databricks user name for the workspace path
-	currentUser, err := client.CurrentUser.Me(ctx)
+	currentUser, err := client.CurrentUser.Me(ctx, iam.MeRequest{})
 	if err != nil {
 		return fmt.Errorf("failed to get current user: %w", err)
 	}
@@ -381,15 +587,15 @@ func runIDE(ctx context.Context, client *databricks.WorkspaceClient, userName, k
 		return fmt.Errorf("failed to get SSH config path: %w", err)
 	}
 
-	err = ensureSSHConfigEntry(ctx, configPath, connectionName, userName, keyPath, serverPort, clusterID, opts)
+	err = ensureSSHConfigEntry(ctx, configPath, connectionName, userName, keyPath, knownHostsPath, serverPort, clusterID, opts)
 	if err != nil {
 		return fmt.Errorf("failed to ensure SSH config entry: %w", err)
 	}
 
-	return vscode.LaunchIDE(ctx, opts.IDE, connectionName, userName, currentUser.UserName)
+	return vscode.LaunchIDE(ctx, opts.IDE, connectionName, currentUser.UserName)
 }
 
-func ensureSSHConfigEntry(ctx context.Context, configPath, hostName, userName, keyPath string, serverPort int, clusterID string, opts ClientOptions) error {
+func ensureSSHConfigEntry(ctx context.Context, configPath, hostName, userName, keyPath, knownHostsPath string, serverPort int, clusterID string, opts ClientOptions) error {
 	// Ensure the Include directive exists in the main SSH config
 	err := sshconfig.EnsureIncludeDirective(ctx, configPath)
 	if err != nil {
@@ -405,7 +611,10 @@ func ensureSSHConfigEntry(ctx context.Context, configPath, hostName, userName, k
 		return fmt.Errorf("failed to generate ProxyCommand: %w", err)
 	}
 
-	hostConfig := sshconfig.GenerateHostConfig(hostName, userName, keyPath, proxyCommand)
+	// The host key is pinned under the session ID (see pinServerHostKey), so emit it as
+	// HostKeyAlias to keep the key lookup matching the pinned entry (DECO-27882). Here the
+	// host alias already is the session ID, but passing it explicitly keeps the two in step.
+	hostConfig := sshconfig.GenerateHostConfig(hostName, userName, keyPath, knownHostsPath, opts.SessionIdentifier(), proxyCommand)
 
 	_, err = sshconfig.CreateOrUpdateHostConfig(ctx, hostName, hostConfig, true)
 	if err != nil {
@@ -416,14 +625,27 @@ func ensureSSHConfigEntry(ctx context.Context, configPath, hostName, userName, k
 	return nil
 }
 
+// serverMetadata describes a running SSH server, combining the persisted workspace
+// metadata with the user name validated live via Driver Proxy.
+type serverMetadata struct {
+	Port     int
+	UserName string
+	// ClusterID required for Driver Proxy connections. For serverless it comes from the persisted metadata.
+	ClusterID string
+	// UsagePolicyID the server was started with, used to decide whether a running server can be reused.
+	UsagePolicyID string
+	// KeepDetachedProcesses the server's run was submitted with, used the same way as UsagePolicyID.
+	KeepDetachedProcesses bool
+}
+
 // getServerMetadata retrieves the server metadata from the workspace and validates it via Driver Proxy.
 // sessionID is the unique identifier for the session (cluster ID for dedicated clusters, connection name for serverless).
 // For dedicated clusters, clusterID should be the same as sessionID.
 // For serverless, clusterID is read from the workspace metadata.
-func getServerMetadata(ctx context.Context, client *databricks.WorkspaceClient, sessionID, clusterID, version, liteswap string) (int, string, string, error) {
+func getServerMetadata(ctx context.Context, client *databricks.WorkspaceClient, sessionID, clusterID, version, liteswap string) (serverMetadata, error) {
 	wsMetadata, err := sshWorkspace.GetWorkspaceMetadata(ctx, client, version, sessionID)
 	if err != nil {
-		return 0, "", "", errors.Join(errServerMetadata, err)
+		return serverMetadata{}, errors.Join(errServerMetadata, err)
 	}
 	log.Debugf(ctx, "Workspace metadata: %+v", wsMetadata)
 
@@ -434,73 +656,141 @@ func getServerMetadata(ctx context.Context, client *databricks.WorkspaceClient,
 	}
 
 	if effectiveClusterID == "" {
-		return 0, "", "", errors.Join(errServerMetadata, errors.New("cluster ID not available in metadata"))
+		return serverMetadata{}, errors.Join(errServerMetadata, errors.New("cluster ID not available in metadata"))
 	}
 
-	workspaceID, err := client.CurrentWorkspaceID(ctx)
-	if err != nil {
-		return 0, "", "", err
-	}
-	metadataURL := fmt.Sprintf("%s/driver-proxy-api/o/%d/%s/%d/metadata", client.Config.Host, workspaceID, effectiveClusterID, wsMetadata.Port)
-	log.Debugf(ctx, "Metadata URL: %s", metadataURL)
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, metadataURL, nil)
+	req, err := newDriverProxyRequest(ctx, client, effectiveClusterID, wsMetadata.Port, "metadata", liteswap)
 	if err != nil {
-		return 0, "", "", err
-	}
-	if liteswap != "" {
-		req.Header.Set("x-databricks-traffic-id", "testenv://liteswap/"+liteswap)
-	}
-	if err := client.Config.Authenticate(req); err != nil {
-		return 0, "", "", err
+		return serverMetadata{}, err
 	}
+	log.Debugf(ctx, "Metadata URL: %s", req.URL)
 	httpClient := &http.Client{Transport: client.Config.HTTPTransport}
 	resp, err := httpClient.Do(req)
 	if err != nil {
-		return 0, "", "", err
+		return serverMetadata{}, err
 	}
 	defer resp.Body.Close()
 
 	bodyBytes, err := io.ReadAll(resp.Body)
 	if err != nil {
-		return 0, "", "", err
+		return serverMetadata{}, err
 	}
 	log.Debugf(ctx, "Metadata response: %s", string(bodyBytes))
 	log.Debugf(ctx, "Metadata response status code: %d", resp.StatusCode)
 
 	if resp.StatusCode != http.StatusOK {
-		return 0, "", "", errors.Join(errServerMetadata, fmt.Errorf("server is not ok, status code %d", resp.StatusCode))
+		return serverMetadata{}, metadataResponseError(resp.StatusCode, bodyBytes)
 	}
 
-	return wsMetadata.Port, string(bodyBytes), effectiveClusterID, nil
+	return serverMetadata{
+		Port:                  wsMetadata.Port,
+		UserName:              string(bodyBytes),
+		ClusterID:             effectiveClusterID,
+		UsagePolicyID:         wsMetadata.UsagePolicyID,
+		KeepDetachedProcesses: wsMetadata.KeepDetachedProcesses,
+	}, nil
 }
 
-func submitSSHTunnelJob(ctx context.Context, client *databricks.WorkspaceClient, version, secretScopeName string, opts ClientOptions) error {
-	sessionID := opts.SessionIdentifier()
-	contentDir, err := sshWorkspace.GetWorkspaceContentDir(ctx, client, version, sessionID)
-	if err != nil {
-		return fmt.Errorf("failed to get workspace content directory: %w", err)
+// metadataResponseError classifies a non-200 response from the server's /metadata endpoint. A 403
+// is final and carries the driver proxy's own explanation; anything else is errServerMetadata,
+// which callers treat as a server that is not running yet.
+func metadataResponseError(statusCode int, body []byte) error {
+	if statusCode != http.StatusForbidden {
+		return errors.Join(errServerMetadata, fmt.Errorf("server is not ok, status code %d", statusCode))
+	}
+	// The driver proxy writes its error as a JSON string ("CODE: message") rather than the usual
+	// {"error_code", "message"} object.
+	var message string
+	if json.Unmarshal(body, &message) != nil {
+		message = string(body)
 	}
+	message = strings.TrimSpace(message)
+	if message == "" {
+		message = fmt.Sprintf("status code %d", statusCode)
+	}
+	return fmt.Errorf("%w: %s", errDriverProxyForbidden, message)
+}
 
-	err = client.Workspace.MkdirsByPath(ctx, contentDir) //nolint:staticcheck // Deprecated in SDK v0.127.0. Migration to WorkspaceHierarchyService tracked separately.
+// checkPortForwardingToServerless refuses a serverless connection before any compute is started when
+// the workspace setting that the driver proxy enforces for the tunnel is off. The proxy's gate
+// (PortForwardingToServerlessGate in data-plane-router) also depends on an enforcement flag and a port
+// allow-list that the CLI cannot see, and the setting is not readable through the public API in every
+// environment. A read that fails therefore lets the connection go ahead, and the proxy's own 403
+// (errDriverProxyForbidden) remains the backstop. The read goes through a client with retries turned
+// off, so a throttled or unavailable settings service cannot hold up the connection for the SDK's
+// retry budget.
+func checkPortForwardingToServerless(ctx context.Context, client *databricks.WorkspaceClient) error {
+	apiClient, err := newProbeAPIClient(client.Config)
 	if err != nil {
-		return fmt.Errorf("failed to create directory in the remote workspace: %w", err)
+		log.Debugf(ctx, "Could not build a client to read the %s setting, continuing: %v", portFwdServerlessSetting, err)
+		return nil
+	}
+	setting, err := settingsv2.NewWorkspaceSettingsV2(apiClient).GetPublicWorkspaceSetting(ctx, settingsv2.GetPublicWorkspaceSettingRequest{
+		Name: portFwdServerlessSetting,
+	})
+	if err != nil {
+		log.Debugf(ctx, "Could not read the %s setting, continuing: %v", portFwdServerlessSetting, err)
+		return nil
+	}
+	if setting.EffectiveBooleanVal != nil && !setting.EffectiveBooleanVal.Value {
+		return errPortForwardingDisabled
 	}
+	return nil
+}
 
-	sshTunnelJobName := "ssh-server-bootstrap-" + sessionID
-	jobNotebookPath := filepath.ToSlash(filepath.Join(contentDir, "ssh-server-bootstrap"))
-	notebookContent := "# Databricks notebook source\n" + sshServerBootstrapScript
-	encodedContent := base64.StdEncoding.EncodeToString([]byte(notebookContent))
+// newDriverProxyRequest builds an authenticated GET request to one of the SSH server's
+// HTTP endpoints behind the workspace driver proxy.
+func newDriverProxyRequest(ctx context.Context, client *databricks.WorkspaceClient, clusterID string, port int, endpoint, liteswap string) (*http.Request, error) {
+	workspaceID, err := auth.ResolveWorkspaceID(ctx, client)
+	if err != nil {
+		return nil, err
+	}
+	url := fmt.Sprintf("%s/driver-proxy-api/o/%s/%s/%d/%s", client.Config.Host, workspaceID, clusterID, port, endpoint)
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	if err != nil {
+		return nil, err
+	}
+	if liteswap != "" {
+		req.Header.Set("x-databricks-traffic-id", "testenv://liteswap/"+liteswap)
+	}
+	if err := client.Config.Authenticate(req); err != nil {
+		return nil, err
+	}
+	return req, nil
+}
 
-	err = client.Workspace.Import(ctx, workspace.Import{
-		Path:      jobNotebookPath,
-		Format:    workspace.ImportFormatSource,
-		Content:   encodedContent,
-		Language:  workspace.LanguagePython,
-		Overwrite: true,
-	})
+// fetchServerErrorLogs fetches recent warning/error log lines from the running SSH
+// server's /logs endpoint. It is best-effort: any failure (including older server
+// versions that don't serve /logs) yields an empty string.
+func fetchServerErrorLogs(ctx context.Context, client *databricks.WorkspaceClient, clusterID string, serverPort int, liteswap string) string {
+	req, err := newDriverProxyRequest(ctx, client, clusterID, serverPort, "logs", liteswap)
+	if err != nil {
+		log.Debugf(ctx, "Failed to build server logs request: %v", err)
+		return ""
+	}
+	httpClient := &http.Client{Transport: client.Config.HTTPTransport}
+	resp, err := httpClient.Do(req)
 	if err != nil {
-		return fmt.Errorf("failed to create ssh-tunnel notebook: %w", err)
+		log.Debugf(ctx, "Failed to fetch server logs: %v", err)
+		return ""
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		log.Debugf(ctx, "Server logs endpoint returned status %d", resp.StatusCode)
+		return ""
 	}
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		log.Debugf(ctx, "Failed to read server logs response: %v", err)
+		return ""
+	}
+	return strings.TrimSpace(string(body))
+}
+
+// Assemble the SubmitRun request that bootstraps the SSH server.
+// Extracted from submitSSHTunnelJob so this logic can be unit tested.
+func buildSSHServerSubmitRun(version, secretScopeName, jobNotebookPath, baseEnvironment string, opts ClientOptions) jobs.SubmitRun {
+	sessionID := opts.SessionIdentifier()
 
 	baseParams := map[string]string{
 		"version":                 version,
@@ -510,10 +800,14 @@ func submitSSHTunnelJob(ctx context.Context, client *databricks.WorkspaceClient,
 		"maxClients":              strconv.Itoa(opts.MaxClients),
 		"sessionId":               sessionID,
 		"serverless":              strconv.FormatBool(opts.IsServerlessMode()),
+		// Recorded in the server's metadata.json so reconnects can tell which usage policy
+		// the running server was started under.
+		"usagePolicyId": opts.UsagePolicyID,
+		// The bootstrap only needs to know whether to hold the run open. How long it ends up
+		// holding it is decided by the work itself, bounded by the run's own timeout.
+		"keepDetachedProcesses": strconv.FormatBool(opts.KeepDetachedProcesses),
 	}
 
-	log.Infof(ctx, "Submitting a job to start the ssh server...")
-
 	task := jobs.SubmitTask{
 		TaskKey: sshServerTaskKey,
 		NotebookTask: &jobs.NotebookTask{
@@ -526,7 +820,6 @@ func submitSSHTunnelJob(ctx context.Context, client *databricks.WorkspaceClient,
 	if opts.IsServerlessMode() {
 		task.EnvironmentKey = serverlessEnvironmentKey
 		if opts.Accelerator != "" {
-			log.Infof(ctx, "Using accelerator: %s", opts.Accelerator)
 			task.Compute = &jobs.Compute{
 				HardwareAccelerator: compute.HardwareAcceleratorType(opts.Accelerator),
 			}
@@ -536,83 +829,390 @@ func submitSSHTunnelJob(ctx context.Context, client *databricks.WorkspaceClient,
 	}
 
 	submitRequest := jobs.SubmitRun{
-		RunName:        sshTunnelJobName,
+		RunName:        "ssh-server-bootstrap-" + sessionID,
 		TimeoutSeconds: int(opts.ServerTimeout.Seconds()),
 		Tasks:          []jobs.SubmitTask{task},
+		BudgetPolicyId: opts.UsagePolicyID,
 	}
 
 	if opts.IsServerlessMode() {
+		// base_environment and environment_version are mutually exclusive: a custom
+		// base environment carries its own version, so we don't also set one.
+		var spec compute.Environment
+		if baseEnvironment != "" {
+			spec.BaseEnvironment = baseEnvironment
+		} else {
+			spec.EnvironmentVersion = strconv.Itoa(max(opts.EnvironmentVersion, minEnvironmentVersion))
+		}
 		submitRequest.Environments = []jobs.JobEnvironment{
 			{
 				EnvironmentKey: serverlessEnvironmentKey,
-				Spec: &compute.Environment{
-					EnvironmentVersion: strconv.Itoa(max(opts.EnvironmentVersion, minEnvironmentVersion)),
-				},
+				Spec:           &spec,
 			},
 		}
 	}
 
+	return submitRequest
+}
+
+// submitSSHTunnelJob submits the bootstrap job and waits for the SSH server task to start.
+// It returns the job run ID (when known) so callers can fetch and surface the run's error
+// details if the server never comes up.
+func submitSSHTunnelJob(ctx context.Context, client *databricks.WorkspaceClient, version, secretScopeName string, opts ClientOptions) (int64, error) {
+	sessionID := opts.SessionIdentifier()
+	contentDir, err := sshWorkspace.GetWorkspaceContentDir(ctx, client, version, sessionID)
+	if err != nil {
+		return 0, fmt.Errorf("failed to get workspace content directory: %w", err)
+	}
+
+	err = client.Workspace.MkdirsByPath(ctx, contentDir)
+	if err != nil {
+		return 0, fmt.Errorf("failed to create directory in the remote workspace: %w", err)
+	}
+
+	jobNotebookPath := filepath.ToSlash(filepath.Join(contentDir, "ssh-server-bootstrap"))
+	notebookContent := "# Databricks notebook source\n" + sshServerBootstrapScript
+	encodedContent := base64.StdEncoding.EncodeToString([]byte(notebookContent))
+
+	err = client.Workspace.Import(ctx, workspace.Import{
+		Path:      jobNotebookPath,
+		Format:    workspace.ImportFormatSource,
+		Content:   encodedContent,
+		Language:  workspace.LanguagePython,
+		Overwrite: true,
+	})
+	if err != nil {
+		return 0, fmt.Errorf("failed to create ssh-tunnel notebook: %w", err)
+	}
+
+	log.Infof(ctx, "Submitting a job to start the ssh server...")
+	if opts.IsServerlessMode() && opts.Accelerator != "" {
+		log.Infof(ctx, "Using accelerator: %s", opts.Accelerator)
+	}
+
+	var baseEnvironment string
+	if opts.IsServerlessMode() && opts.BaseEnvironment != "" {
+		baseEnvironment, err = resolveBaseEnvironment(ctx, client, opts.BaseEnvironment)
+		if err != nil {
+			return 0, err
+		}
+	}
+
+	submitRequest := buildSSHServerSubmitRun(version, secretScopeName, jobNotebookPath, baseEnvironment, opts)
+
 	waiter, err := client.Jobs.Submit(ctx, submitRequest)
 	if err != nil {
-		return fmt.Errorf("failed to submit job: %w", err)
+		return 0, fmt.Errorf("failed to submit job: %w", err)
 	}
 
 	cmdio.LogString(ctx, fmt.Sprintf("Job submitted successfully with run ID: %d", waiter.RunId))
 
-	return waitForJobToStart(ctx, client, waiter.RunId, opts.TaskStartupTimeout)
+	// Return the run ID even on error so callers can fetch the run's failure details.
+	return waiter.RunId, waitForJobToStart(ctx, client, waiter.RunId, opts)
 }
 
-func spawnSSHClient(ctx context.Context, userName, privateKeyPath string, serverPort int, clusterID string, opts ClientOptions) error {
-	// Create a copy with metadata for the ProxyCommand
-	optsWithMetadata := opts
-	optsWithMetadata.ServerMetadata = FormatMetadata(userName, serverPort, clusterID)
+// resolveBaseEnvironment maps the user-provided --base-environment value to a
+// compute.Environment.BaseEnvironment string. A leading "/" is an env.yaml path and a
+// "workspace-base-environments/" prefix is a resource ID; both are passed through
+// verbatim. Anything else is treated as a display name and resolved to its resource ID
+// via the workspace base environments listing.
+func resolveBaseEnvironment(ctx context.Context, client *databricks.WorkspaceClient, input string) (string, error) {
+	if strings.HasPrefix(input, "/") || strings.HasPrefix(input, "workspace-base-environments/") {
+		return input, nil
+	}
 
-	proxyCommand, err := optsWithMetadata.ToProxyCommand()
+	envs, err := client.Environments.ListWorkspaceBaseEnvironmentsAll(ctx, environments.ListWorkspaceBaseEnvironmentsRequest{})
 	if err != nil {
-		return fmt.Errorf("failed to generate ProxyCommand: %w", err)
+		return "", fmt.Errorf("failed to list workspace base environments: %w", err)
 	}
 
-	hostName := opts.SessionIdentifier()
+	var matches []string
+	for _, e := range envs {
+		if e.DisplayName == input {
+			matches = append(matches, e.Name)
+		}
+	}
+	switch len(matches) {
+	case 0:
+		return "", fmt.Errorf("no workspace base environment found with display name %q", input)
+	case 1:
+		return matches[0], nil
+	default:
+		return "", fmt.Errorf("multiple workspace base environments found with display name %q", input)
+	}
+}
+
+// shellSingleQuote wraps s in single quotes for safe inclusion in a shell
+// command, escaping any embedded single quotes.
+func shellSingleQuote(s string) string {
+	return "'" + strings.ReplaceAll(s, "'", `'\''`) + "'"
+}
+
+// agentWrapperScript returns one agent's on-PATH launcher: it resolves the uploaded
+// databricks CLI for the driver's arch, then delegates to `ssh agent-shim <agent>`.
+// wsHome anchors that binary path and is forwarded (via env) for the agent context.
+func agentWrapperScript(wsHome, version, agent string) string {
+	versionedDir := wsHome + "/.databricks/ssh-tunnel/" + version
+	// Mirror getReleaseName (minus .zip); ${_arch} is expanded on the remote.
+	subdir := strings.TrimSuffix(getReleaseName("${_arch}", version), ".zip")
+	// Single-quote the workspace/version-derived path so a username or version with
+	// shell metacharacters can't break (or inject into) the exec line, while leaving
+	// ${_arch} unquoted so the remote shell still expands it (getReleaseName always
+	// embeds it, so Cut always splits here).
+	before, after, _ := strings.Cut(subdir, "${_arch}")
+	binary := shellSingleQuote(versionedDir+"/"+before) + "${_arch}" + shellSingleQuote(after+"/databricks")
+
+	// buildRemoteShellArgs only installs launchers when wsHome is set, so it is
+	// always non-empty here.
+	exports := "export " + workspaceHomeEnv + "=" + shellSingleQuote(wsHome) + "\n"
+
+	return fmt.Sprintf(`#!/usr/bin/env bash
+# "%[3]s" launcher from "databricks ssh connect"; delegates to "ssh agent-shim %[3]s".
+case "$(uname -m)" in
+  x86_64|amd64) _arch=amd64 ;;
+  aarch64|arm64) _arch=arm64 ;;
+  *) echo "%[3]s: unsupported architecture $(uname -m)" >&2; exit 1 ;;
+esac
+%[1]sexec %[2]s ssh agent-shim %[3]s "$@"`, exports, binary, agent)
+}
+
+// buildRemoteShellArgs returns the ssh arguments that follow the hostname.
+//
+// For the interactive case (no remote command given), it forces PTY allocation
+// and launches an interactive, non-login bash. bash is invoked explicitly because
+// the default shell on Databricks compute images is /bin/sh; if bash is unavailable
+// it falls back to $SHELL or /bin/sh so the connection never breaks. A login shell
+// (-l) would re-source /etc/profile, which rebuilds PATH from scratch and drops the
+// environment's bin directory that sshd forwards via SetEnv, so bare `python`/`pip`
+// would resolve to the system interpreter instead of $DATABRICKS_VIRTUAL_ENV. Using
+// -i avoids that reset; the server's ~/.bashrc snippet (see seedEnvActivation) then
+// re-prepends the environment bin after /etc/bash.bashrc runs, so bare `python`/`pip`
+// resolve to the environment interpreter. It first installs a per-agent launcher
+// (see agentWrapperScript) on PATH, then cds into wsHome when set (else $HOME).
+//
+// For the non-interactive case (e.g. `databricks ssh connect ... -- ls -la`),
+// the user's command is returned verbatim so behavior is unchanged.
+//
+// Note: this returns the remote command only. PTY allocation (-t) is added to
+// the ssh options *before* the destination by the caller; -t placed after the
+// host would be parsed as part of the remote command, not as ssh's flag.
+func buildRemoteShellArgs(opts ClientOptions, wsHome, version string) []string {
+	if len(opts.AdditionalArgs) > 0 {
+		return opts.AdditionalArgs
+	}
+	shell := `command -v bash >/dev/null 2>&1 && exec bash -i || exec "${SHELL:-/bin/sh}" -i`
+	// For any interactive session, land in the user's workspace home when known;
+	// if that directory is missing the cd is ignored and the shell still launches
+	// from $HOME. This is independent of the launcher install below, so dedicated
+	// clusters keep the workspace cwd they had before agent launchers existed.
+	if wsHome != "" {
+		shell = "cd " + shellSingleQuote(wsHome) + " 2>/dev/null; " + shell
+	}
+	// The agent launchers are serverless-only for now: dedicated clusters have no
+	// story for persisting the shims or respecting existing installs. They also
+	// need the workspace path to locate the uploaded CLI. Otherwise just open the shell.
+	if !opts.IsServerlessMode() || wsHome == "" {
+		return []string{shell}
+	}
+	// Write each agent's wrapper (quoted heredoc keeps its $VARS literal), then open the shell.
+	remoteShimDir := "$HOME/" + agentBinDir
+	var cmd strings.Builder
+	fmt.Fprintf(&cmd, "mkdir -p \"%s\"\n", remoteShimDir)
+	for _, agent := range SupportedAgentNames() {
+		fmt.Fprintf(&cmd, `cat > "%[1]s/%[2]s" <<'AGENT_SHIM_WRAPPER_EOF'
+%[3]s
+AGENT_SHIM_WRAPPER_EOF
+chmod +x "%[1]s/%[2]s"
+`, remoteShimDir, agent, agentWrapperScript(wsHome, version, agent))
+	}
+	// Append the shim dir (don't prepend) so the wrappers never shadow a real
+	// binary of the same name earlier on PATH.
+	fmt.Fprintf(&cmd, "export PATH=\"$PATH:%s\"\n", remoteShimDir)
+	return []string{cmd.String() + shell}
+}
 
+// buildSSHArgs assembles the argument list for the ssh client. Options come
+// first, then the destination host, then the remote command (if any). PTY
+// allocation (-t) for the interactive case is added before the host: ssh stops
+// parsing options at the destination, so a -t placed after the host would be
+// treated as part of the remote command rather than as ssh's force-PTY flag.
+//
+// Host key checking is strict rather than accept-new because the caller has already
+// pinned the server's key in knownHostsPath (see pinServerHostKey), so there is nothing
+// left to accept on trust.
+func buildSSHArgs(userName, privateKeyPath, knownHostsPath, proxyCommand, hostName, wsHome, version string, opts ClientOptions) []string {
 	sshArgs := []string{
 		"-l", userName,
 		"-i", privateKeyPath,
 		"-o", "IdentitiesOnly=yes",
-		"-o", "StrictHostKeyChecking=accept-new",
+		"-o", "StrictHostKeyChecking=yes",
+		"-o", "UserKnownHostsFile=" + knownHostsPath,
 		"-o", "ConnectTimeout=360",
+		"-o", "ServerAliveInterval=" + strconv.Itoa(sshconfig.ServerAliveIntervalSeconds),
 		"-o", "ProxyCommand=" + proxyCommand,
 	}
-	if opts.UserKnownHostsFile != "" {
-		sshArgs = append(sshArgs, "-o", "UserKnownHostsFile="+opts.UserKnownHostsFile)
+	if len(opts.AdditionalArgs) == 0 {
+		sshArgs = append(sshArgs, "-t")
 	}
 	sshArgs = append(sshArgs, hostName)
-	sshArgs = append(sshArgs, opts.AdditionalArgs...)
+	sshArgs = append(sshArgs, buildRemoteShellArgs(opts, wsHome, version)...)
+	return sshArgs
+}
+
+func spawnSSHClient(ctx context.Context, client *databricks.WorkspaceClient, userName, privateKeyPath, knownHostsPath string, serverPort int, clusterID, version string, opts ClientOptions) error {
+	// Create a copy with metadata for the ProxyCommand
+	optsWithMetadata := opts
+	optsWithMetadata.ServerMetadata = FormatMetadata(userName, serverPort, clusterID)
+
+	proxyCommand, err := optsWithMetadata.ToProxyCommand()
+	if err != nil {
+		return fmt.Errorf("failed to generate ProxyCommand: %w", err)
+	}
+
+	hostName := opts.SessionIdentifier()
+
+	// For an interactive session (no remote command supplied), land the shell in
+	// the user's workspace home folder (/Workspace/Users/<email>) instead of the
+	// OS home. Only needed for an interactive session; skip the lookup otherwise.
+	var wsHome string
+	if len(opts.AdditionalArgs) == 0 {
+		if currentUser, err := client.CurrentUser.Me(ctx, iam.MeRequest{}); err != nil {
+			log.Warnf(ctx, "Failed to resolve current user for workspace home directory: %v", err)
+		} else {
+			wsHome = "/Workspace/Users/" + currentUser.UserName
+		}
+	}
+
+	sshArgs := buildSSHArgs(userName, privateKeyPath, knownHostsPath, proxyCommand, hostName, wsHome, version, opts)
 
 	log.Debugf(ctx, "Launching SSH client: ssh %s", strings.Join(sshArgs, " "))
 	sshCmd := exec.CommandContext(ctx, "ssh", sshArgs...)
 
 	sshCmd.Stdin = os.Stdin
 	sshCmd.Stdout = os.Stdout
-	sshCmd.Stderr = os.Stderr
-
-	return sshCmd.Run()
+	// Tee ssh's stderr so the user still sees it while we retain the tail to inspect after exit.
+	// A host-key-verification failure is reported only on stderr, so we need a copy to detect it.
+	stderrTail := &tailWriter{maxBytes: hostKeyStderrTailBytes}
+	sshCmd.Stderr = io.MultiWriter(os.Stderr, stderrTail)
+
+	err = sshCmd.Run()
+	// ssh reserves exit code 255 for its own connection-level failures (a remote command's exit
+	// code is passed through as-is, 0-254). The server keeps running after a failed connection
+	// attempt, so its error (e.g. sshd missing from the container image) is only visible in its
+	// own logs — fetch them from the /logs endpoint and show them instead of leaving the user
+	// with ssh's opaque "Connection closed" message.
+	if exitErr, ok := errors.AsType[*exec.ExitError](err); ok && exitErr.ExitCode() == 255 {
+		if hint := hostKeyChangedHint(stderrTail.String(), hostName, knownHostsPath); hint != "" {
+			cmdio.LogString(ctx, cmdio.Yellow(ctx, hint))
+		} else if logs := fetchServerErrorLogs(ctx, client, clusterID, serverPort, opts.Liteswap); logs != "" {
+			cmdio.LogString(ctx, cmdio.Yellow(ctx, "The SSH connection closed unexpectedly. Recent SSH server errors:"))
+			cmdio.LogString(ctx, truncateTail(logs, maxRunFailureTraceBytes))
+		} else {
+			cmdio.LogString(ctx, cmdio.Yellow(ctx, "The SSH connection closed unexpectedly. If it dropped right after connecting, "+
+				"the cluster's container image is likely missing an OpenSSH server: ensure 'openssh-server' "+
+				"is installed (it provides /usr/sbin/sshd), then check the SSH server job run logs."))
+		}
+	}
+	return err
 }
 
 func runSSHProxy(ctx context.Context, client *databricks.WorkspaceClient, serverPort int, clusterID string, opts ClientOptions) error {
-	createConn := func(ctx context.Context, connID string) (*websocket.Conn, error) {
-		return createWebsocketConnection(ctx, client, connID, clusterID, serverPort, opts.Liteswap)
+	resumable := serverSupportsResume(ctx, client, clusterID, serverPort, opts.Liteswap)
+	if !resumable {
+		log.Infof(ctx, "The SSH server does not support session resume, a dropped connection will end the session")
+	}
+	createConn := func(ctx context.Context, req proxy.DialRequest) (*websocket.Conn, error) {
+		req.ResumeCapable = resumable
+		return createWebsocketConnection(ctx, client, req, clusterID, serverPort, opts.Liteswap)
 	}
 	requestHandoverTick := func() <-chan time.Time {
 		return time.After(opts.HandoverTimeout)
 	}
-	return proxy.RunClientProxy(ctx, os.Stdin, os.Stdout, requestHandoverTick, createConn)
+	return proxy.RunClientProxy(ctx, os.Stdin, os.Stdout, requestHandoverTick, opts.KeepaliveInterval, resumable, createConn)
+}
+
+// capabilitiesProbeTimeout caps the pre-connect capabilities probe. The endpoint returns a small,
+// fixed response, so a slow probe should not delay a connection that can still run without resume.
+// A var so tests can shorten it.
+var capabilitiesProbeTimeout = 10 * time.Second
+
+// serverSupportsResume reports whether the running SSH server speaks the resume protocol.
+func serverSupportsResume(ctx context.Context, client *databricks.WorkspaceClient, clusterID string, serverPort int, liteswap string) bool {
+	req, err := newDriverProxyRequest(ctx, client, clusterID, serverPort, "capabilities", liteswap)
+	if err != nil {
+		log.Debugf(ctx, "Failed to build the server capabilities request: %v", err)
+		return false
+	}
+	// Bounded on its own: this probe runs before the tunnel is dialled, and resume is an
+	// optimisation, so a driver proxy that accepts the request and never answers must cost a
+	// bounded wait rather than the whole connect path.
+	httpClient := &http.Client{Transport: client.Config.HTTPTransport, Timeout: capabilitiesProbeTimeout}
+	resp, err := httpClient.Do(req)
+	if err != nil {
+		log.Debugf(ctx, "Failed to query the server capabilities: %v", err)
+		return false
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		log.Debugf(ctx, "The server does not serve /capabilities (status %d)", resp.StatusCode)
+		return false
+	}
+	var capabilities struct {
+		ResumeVersion int `json:"resume_version"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&capabilities); err != nil {
+		log.Debugf(ctx, "Failed to decode the server capabilities: %v", err)
+		return false
+	}
+	return capabilities.ResumeVersion == proxy.ResumeProtocolVersion
+}
+
+// accessModeUILabel maps a cluster's access mode to the name shown in the Databricks UI.
+// The API enum (e.g. USER_ISOLATION) differs from the label the user picked when creating
+// the cluster (e.g. "Standard"), so the error message uses the UI label to stay recognizable.
+// A Dedicated cluster can be assigned to a single user or to a group; only the single-user
+// form works with the SSH tunnel, so the two are distinguished by whether single_user_name is
+// set. Legacy/auto/unknown modes fall back to their raw value.
+func accessModeUILabel(mode compute.DataSecurityMode, singleUserName string) string {
+	switch mode {
+	case compute.DataSecurityModeSingleUser, compute.DataSecurityModeDataSecurityModeDedicated:
+		if singleUserName == "" {
+			return "Dedicated (group)"
+		}
+		return "Dedicated (single user)"
+	case compute.DataSecurityModeUserIsolation, compute.DataSecurityModeDataSecurityModeStandard:
+		return "Standard"
+	case compute.DataSecurityModeNone:
+		return "No isolation"
+	default:
+		return string(mode)
+	}
+}
+
+// ValidateClusterAccess ensures the cluster is a dedicated single-user cluster.
+// The SSH tunnel runs as a job that attaches as a single user, so the cluster must be in
+// Dedicated access mode and assigned to one user (single_user_name set), not a group. We fail
+// early with an actionable message rather than letting the connection fail later.
+func ValidateClusterAccess(ctx context.Context, client *databricks.WorkspaceClient, clusterID string) error {
+	clusterInfo, err := client.Clusters.Get(ctx, compute.GetClusterRequest{ClusterId: clusterID})
+	if err != nil {
+		return fmt.Errorf("failed to get cluster information for cluster ID '%s': %w", clusterID, err)
+	}
+	// SINGLE_USER is the legacy alias for the newer DATA_SECURITY_MODE_DEDICATED enum; the API
+	// may return either for a dedicated cluster, so accept both.
+	isDedicated := clusterInfo.DataSecurityMode == compute.DataSecurityModeSingleUser ||
+		clusterInfo.DataSecurityMode == compute.DataSecurityModeDataSecurityModeDedicated
+	if !isDedicated || clusterInfo.SingleUserName == "" {
+		return fmt.Errorf("cluster '%s' must be a dedicated single-user cluster. Current access mode: %s. Please reconfigure it to Dedicated (single user) access mode", clusterID, accessModeUILabel(clusterInfo.DataSecurityMode, clusterInfo.SingleUserName))
+	}
+	return nil
 }
 
 func checkClusterState(ctx context.Context, client *databricks.WorkspaceClient, clusterID string, autoStart bool) error {
 	sp := cmdio.NewSpinner(ctx, cmdio.WithElapsedTime())
 	defer sp.Close()
 	if autoStart {
-		sp.Update("Ensuring the cluster is running...")
+		sp.Update("Waiting for compute to start...")
 		err := client.Clusters.EnsureClusterIsRunning(ctx, clusterID)
 		if err != nil {
 			return fmt.Errorf("failed to ensure that the cluster is running: %w", err)
@@ -632,13 +1232,27 @@ func checkClusterState(ctx context.Context, client *databricks.WorkspaceClient,
 
 // waitForJobToStart polls the task status until the SSH server task is in RUNNING state or terminates.
 // Returns an error if the task fails to start or if polling times out.
-func waitForJobToStart(ctx context.Context, client *databricks.WorkspaceClient, runID int64, taskStartupTimeout time.Duration) error {
+func waitForJobToStart(ctx context.Context, client *databricks.WorkspaceClient, runID int64, opts ClientOptions) error {
+	waitingMessage := "Waiting for compute to start..."
+	if opts.Accelerator != "" {
+		// GPU capacity is acquired on demand and the wait varies a lot by accelerator
+		// type; without this notice users assume a long PENDING wait means the service
+		// is down. Latencies differ enough between types that a single message would be
+		// misleading, so phrase the heads-up per accelerator with a generic fallback.
+		notice, ok := acceleratorProvisioningNotice[opts.Accelerator]
+		if !ok {
+			notice = fmt.Sprintf("Provisioning %s compute. This can take several minutes and may take longer when capacity is constrained.", opts.Accelerator)
+		}
+		cmdio.LogString(ctx, notice)
+		waitingMessage = fmt.Sprintf("Provisioning %s compute...", opts.Accelerator)
+	}
+
 	sp := cmdio.NewSpinner(ctx, cmdio.WithElapsedTime())
 	defer sp.Close()
-	sp.Update("Starting SSH server...")
+	sp.Update(waitingMessage)
 	var prevState jobs.RunLifecycleStateV2State
 
-	_, err := retries.Poll(ctx, taskStartupTimeout, func() (*jobs.RunTask, *retries.Err) {
+	_, err := retries.Poll(ctx, opts.TaskStartupTimeout, func() (*jobs.RunTask, *retries.Err) {
 		run, err := client.Jobs.GetRun(ctx, jobs.GetRunRequest{
 			RunId: runID,
 		})
@@ -667,7 +1281,7 @@ func waitForJobToStart(ctx context.Context, client *databricks.WorkspaceClient,
 
 		// Update spinner if state changed
 		if currentState != prevState {
-			sp.Update(fmt.Sprintf("Starting SSH server... (task: %s)", currentState))
+			sp.Update(fmt.Sprintf("%s (task: %s)", waitingMessage, currentState))
 			prevState = currentState
 		}
 
@@ -676,9 +1290,10 @@ func waitForJobToStart(ctx context.Context, client *databricks.WorkspaceClient,
 			return sshTask, nil
 		}
 
-		// Check for terminal failure states
+		// Check for terminal failure states. Surface the run's actual error (e.g. a notebook
+		// traceback or "Could not reach driver") instead of a generic message.
 		if currentState == jobs.RunLifecycleStateV2StateTerminated {
-			return nil, retries.Halt(errors.New("task terminated before reaching running state"))
+			return nil, retries.Halt(fmt.Errorf("ssh server bootstrap job failed:\n%s", describeRunFailure(ctx, client, runID)))
 		}
 
 		// Continue polling for other states
@@ -688,41 +1303,353 @@ func waitForJobToStart(ctx context.Context, client *databricks.WorkspaceClient,
 	return err
 }
 
+// maxRunFailureTraceBytes bounds how much of a failed run's error trace we print to the
+// terminal; the full output is always available via the run page URL.
+const maxRunFailureTraceBytes = 2000
+
+// describeRunFailure fetches a failed bootstrap run's error details and formats them for the
+// terminal. It is best-effort: any API error is folded into the returned text rather than
+// propagated, so callers can always embed the result in their own error.
+func describeRunFailure(ctx context.Context, client *databricks.WorkspaceClient, runID int64) string {
+	if runID == 0 {
+		return "  (no job run ID available)"
+	}
+
+	run, err := client.Jobs.GetRun(ctx, jobs.GetRunRequest{RunId: runID})
+	if err != nil {
+		return fmt.Sprintf("  could not fetch job run %d: %v", runID, err)
+	}
+
+	var b strings.Builder
+
+	// Locate the SSH server task to read its termination reason and per-task run output.
+	var sshTask *jobs.RunTask
+	for i := range run.Tasks {
+		if run.Tasks[i].TaskKey == sshServerTaskKey {
+			sshTask = &run.Tasks[i]
+			break
+		}
+	}
+
+	if sshTask != nil && sshTask.Status != nil && sshTask.Status.TerminationDetails != nil {
+		if msg := strings.TrimSpace(sshTask.Status.TerminationDetails.Message); msg != "" {
+			fmt.Fprintf(&b, "  %s\n", msg)
+		}
+	}
+
+	// The notebook error/traceback carries the real cause (e.g. a Python exception).
+	outputRunID := runID
+	if sshTask != nil && sshTask.RunId != 0 {
+		outputRunID = sshTask.RunId
+	}
+	if output, err := client.Jobs.GetRunOutput(ctx, jobs.GetRunOutputRequest{RunId: outputRunID}); err == nil && output != nil {
+		e := strings.TrimSpace(output.Error)
+		trace := strings.TrimSpace(output.ErrorTrace)
+		// Notebook tracebacks end with the same message as Error; skip Error then so the
+		// server-log tail the bootstrap embeds in the message isn't printed twice.
+		if e != "" && !strings.Contains(trace, e) {
+			fmt.Fprintf(&b, "  %s\n", truncateTail(e, maxRunFailureTraceBytes))
+		}
+		if trace != "" {
+			fmt.Fprintf(&b, "%s\n", truncateTail(trace, maxRunFailureTraceBytes))
+		}
+	}
+
+	if run.RunPageUrl != "" {
+		fmt.Fprintf(&b, "  See the full job logs: %s", run.RunPageUrl)
+	}
+
+	if b.Len() == 0 {
+		return fmt.Sprintf("  job run %d failed; see run details in the workspace", runID)
+	}
+	return strings.TrimRight(b.String(), "\n")
+}
+
+// cancelSSHServerRun cancels the bootstrap run this connection submitted once no client can reach
+// its server. Best effort: the server also shuts itself down after its no-client delay, so a
+// failure here must not hide the error that made the connection give up.
+func cancelSSHServerRun(ctx context.Context, client *databricks.WorkspaceClient, runID int64) {
+	if _, err := client.Jobs.CancelRun(ctx, jobs.CancelRun{RunId: runID}); err != nil {
+		log.Debugf(ctx, "Failed to cancel the ssh server job run %d: %v", runID, err)
+	}
+}
+
+// runFailureIfTerminated reports whether the bootstrap run has reached a terminal state (so the
+// SSH server will never come up), returning a formatted failure description when it has.
+func runFailureIfTerminated(ctx context.Context, client *databricks.WorkspaceClient, runID int64) (string, bool) {
+	if runID == 0 {
+		return "", false
+	}
+	run, err := client.Jobs.GetRun(ctx, jobs.GetRunRequest{RunId: runID})
+	if err != nil {
+		return "", false
+	}
+	for i := range run.Tasks {
+		if run.Tasks[i].TaskKey != sshServerTaskKey {
+			continue
+		}
+		if run.Tasks[i].Status != nil && run.Tasks[i].Status.State == jobs.RunLifecycleStateV2StateTerminated {
+			return describeRunFailure(ctx, client, runID), true
+		}
+		return "", false
+	}
+	return "", false
+}
+
+// truncateTail returns the last maxBytes of s, marking the cut when truncated.
+func truncateTail(s string, maxBytes int) string {
+	if len(s) <= maxBytes {
+		return s
+	}
+	return "  ...\n" + s[len(s)-maxBytes:]
+}
+
+// hostKeyStderrTailBytes bounds how much of ssh's stderr we retain to detect a host-key failure.
+// The host-key warning block ssh prints is well under this, so the tail always captures it.
+const hostKeyStderrTailBytes = 4096
+
+// tailWriter retains the last maxBytes written to it, so we can inspect an external command's
+// recent stderr without buffering an unbounded amount.
+type tailWriter struct {
+	maxBytes int
+	buf      []byte
+}
+
+func (w *tailWriter) Write(p []byte) (int, error) {
+	w.buf = append(w.buf, p...)
+	if len(w.buf) > w.maxBytes {
+		w.buf = w.buf[len(w.buf)-w.maxBytes:]
+	}
+	return len(p), nil
+}
+
+func (w *tailWriter) String() string {
+	return string(w.buf)
+}
+
+// hostKeyChangedHint returns advice when ssh's stderr shows a host-key-verification failure,
+// or "" if the failure was something else. The CLI pins the key the workspace published for
+// this session into knownHostsFile immediately before connecting, so the entry ssh rejected
+// is not a leftover from an earlier session: the server that answered is presenting a
+// different key than the one the workspace recorded for it.
+func hostKeyChangedHint(stderr, hostName, knownHostsFile string) string {
+	// "Host key verification failed." is OpenSSH's fixed message for this case; matching it is the
+	// only signal ssh gives (the "don't branch on err.Error()" rule is about Go errors, not the
+	// output of an external program).
+	if !strings.Contains(stderr, "Host key verification failed") {
+		return ""
+	}
+	return "The SSH server answering for " + hostName + " presented a host key that does not match the one " +
+		"the workspace published for it.\nThe CLI refreshed that key in " + knownHostsFile +
+		" just before connecting, so this is not a stale local entry: the tunnel reached a server " +
+		"the workspace does not know about"
+}
+
+func usagePolicyMatches(storedPolicy, requestedPolicy string) bool {
+	return requestedPolicy == "" || storedPolicy == requestedPolicy
+}
+
+// keepDetachedMatches reports whether a running server holds its run open for detached
+// processes when this connection asked it to. The mode is fixed when the run is submitted, so
+// asking for it needs a server that has it; a connection that does not ask takes whatever is
+// already running.
+func keepDetachedMatches(stored, requested bool) bool {
+	return !requested || stored
+}
+
 func ensureSSHServerIsRunning(ctx context.Context, client *databricks.WorkspaceClient, version, secretScopeName string, opts ClientOptions) (string, int, string, error) {
 	sessionID := opts.SessionIdentifier()
 	// For dedicated clusters, use clusterID; for serverless, it will be read from metadata
 	clusterID := opts.ClusterID
 
-	serverPort, userName, effectiveClusterID, err := getServerMetadata(ctx, client, sessionID, clusterID, version, opts.Liteswap)
-	if errors.Is(err, errServerMetadata) {
+	meta, err := getServerMetadata(ctx, client, sessionID, clusterID, version, opts.Liteswap)
+	// This includes errDriverProxyForbidden: a new server would be refused the same way.
+	if err != nil && !errors.Is(err, errServerMetadata) {
+		return "", 0, "", err
+	}
+
+	// Start a new server when none is running, or when the running one was started under a
+	// different usage policy or without keeping detached processes. Both are fixed at
+	// submission, so we can't retarget the existing server; the new server overwrites
+	// metadata.json, and its bootstrap terminates the running server on the cluster before
+	// starting (see cleanup() in ssh-server-bootstrap.py), which ends the previous run.
+	needNewServer := err != nil ||
+		!usagePolicyMatches(meta.UsagePolicyID, opts.UsagePolicyID) ||
+		!keepDetachedMatches(meta.KeepDetachedProcesses, opts.KeepDetachedProcesses)
+	if needNewServer {
 		cmdio.LogString(ctx, "Starting SSH server...")
 
-		err := submitSSHTunnelJob(ctx, client, version, secretScopeName, opts)
-		if err != nil {
-			return "", 0, "", fmt.Errorf("failed to submit and start ssh server job: %w", err)
+		runID, submitErr := submitSSHTunnelJob(ctx, client, version, secretScopeName, opts)
+		if submitErr != nil {
+			return "", 0, "", fmt.Errorf("failed to submit and start ssh server job: %w", submitErr)
 		}
 
 		sp := cmdio.NewSpinner(ctx, cmdio.WithElapsedTime())
 		defer sp.Close()
 		sp.Update("Waiting for the SSH server to start...")
-		maxRetries := 30
+		maxRetries := int(serverMetadataTimeout / serverMetadataPollInterval)
 		for retries := range maxRetries {
 			if ctx.Err() != nil {
 				return "", 0, "", ctx.Err()
 			}
-			serverPort, userName, effectiveClusterID, err = getServerMetadata(ctx, client, sessionID, clusterID, version, opts.Liteswap)
+			meta, err = getServerMetadata(ctx, client, sessionID, clusterID, version, opts.Liteswap)
+			if errors.Is(err, errDriverProxyForbidden) {
+				cancelSSHServerRun(ctx, client, runID)
+				return "", 0, "", err
+			}
+			// Accept only once metadata reflects the requested usage policy, so we don't latch
+			// onto a server a previous connection started under a different policy before our new
+			// server has overwritten metadata.json.
+			if err == nil && !usagePolicyMatches(meta.UsagePolicyID, opts.UsagePolicyID) {
+				err = fmt.Errorf("found a running SSH server with usage policy %q, waiting for the one with %q", meta.UsagePolicyID, opts.UsagePolicyID)
+			}
+			if err == nil && !keepDetachedMatches(meta.KeepDetachedProcesses, opts.KeepDetachedProcesses) {
+				err = errors.New("found a running SSH server that does not keep detached processes, waiting for the one that does")
+			}
 			if err == nil {
 				cmdio.LogString(ctx, "Health check successful, starting ssh WebSocket connection...")
 				break
-			} else if retries < maxRetries-1 {
-				time.Sleep(2 * time.Second)
+			}
+			// The metadata never appears if the bootstrap job dies after reaching RUNNING.
+			// Surface the job's actual error instead of waiting out the full timeout with a
+			// generic "metadata.json doesn't exist" message.
+			if failure, terminated := runFailureIfTerminated(ctx, client, runID); terminated {
+				return "", 0, "", fmt.Errorf("ssh server bootstrap job failed:\n%s", failure)
+			}
+			if retries < maxRetries-1 {
+				time.Sleep(serverMetadataPollInterval)
 			} else {
-				return "", 0, "", fmt.Errorf("failed to start the ssh server: %w", err)
+				return "", 0, "", fmt.Errorf("failed to start the ssh server: %w\n%s", err, describeRunFailure(ctx, client, runID))
 			}
 		}
-	} else if err != nil {
-		return "", 0, "", err
 	}
 
-	return userName, serverPort, effectiveClusterID, nil
+	return meta.UserName, meta.Port, meta.ClusterID, nil
+}
+
+// connectOutcome is the observed result of a connection attempt, collected by Run for telemetry.
+type connectOutcome struct {
+	// isSuccess reports whether the tunnel was established. It stays true when the SSH client
+	// itself later exits non-zero, since by then the tunnel was up.
+	isSuccess         bool
+	isReconnect       bool
+	serverStartTimeMs int64
+	// errorCategory is set at the failure site. Empty means the failure was not attributed.
+	errorCategory protos.SshTunnelErrorCategory
+	err           error
+	// ctxErr is the connect context's error when the outcome is logged. Tracked apart from err
+	// because a step that shells out reports a killed child as *exec.ExitError, which carries no
+	// trace of the cancellation. Only a cancellation counts as the user giving up: a deadline
+	// would be a timeout, so category() matches the cause rather than testing for non-nil.
+	ctxErr error
+}
+
+// sshExtensionErrorCategory attributes a Remote SSH extension check failure to the outcome that
+// caused it. The four are kept apart because they imply different fixes, and because only the
+// first two can occur under --auto-approve, which the IDE button always passes -- so a shift
+// between them and the consent outcomes distinguishes button traffic from direct CLI use.
+func sshExtensionErrorCategory(err error) protos.SshTunnelErrorCategory {
+	switch {
+	case errors.Is(err, vscode.ErrSSHExtensionListFailed):
+		return protos.SshTunnelErrorCategoryIDESSHExtensionListFailed
+	case errors.Is(err, vscode.ErrSSHExtensionInstallFailed):
+		return protos.SshTunnelErrorCategoryIDESSHExtensionInstallFailed
+	case errors.Is(err, vscode.ErrSSHExtensionInstallDeclined):
+		return protos.SshTunnelErrorCategoryIDESSHExtensionInstallDeclined
+	case errors.Is(err, vscode.ErrSSHExtensionInstallUnavailable):
+		return protos.SshTunnelErrorCategoryIDESSHExtensionInstallUnavailable
+	}
+	// CheckIDESSHExtension wraps a sentinel on every failure path, so this is only reachable if
+	// a new one is added without a category. UNKNOWN keeps it countable; see category() below.
+	return protos.SshTunnelErrorCategoryUnknown
+}
+
+// category returns the error category to report. Once the tunnel is up nothing that follows is a
+// connection failure, so an established session reports only how it ended, and only the proxy can
+// say that. For a connection attempt, an interruption means the user gave up, whichever call
+// happened to observe it first, so it wins over the category recorded at the failure site; an
+// unattributed attempt is reported as UNKNOWN so that it stays countable.
+func (o connectOutcome) category() protos.SshTunnelErrorCategory {
+	if o.err == nil {
+		return protos.SshTunnelErrorCategoryUnspecified
+	}
+	if o.isSuccess {
+		// proxySessionEndCategory is the only thing that sets a category this late, so an empty
+		// one means the session simply ended: an interruption, an ordinary exit, or a non-zero
+		// exit from the ssh client or the user's own remote command. None is a tunnel failure.
+		if o.errorCategory != "" {
+			return o.errorCategory
+		}
+		return protos.SshTunnelErrorCategoryUnspecified
+	}
+	if errors.Is(o.ctxErr, context.Canceled) || errors.Is(o.err, context.Canceled) {
+		return protos.SshTunnelErrorCategoryUserAborted
+	}
+	if o.errorCategory == "" {
+		return protos.SshTunnelErrorCategoryUnknown
+	}
+	return o.errorCategory
+}
+
+// proxySessionEndCategory attributes how a proxy-mode session ended. A dropped websocket is
+// checked first on purpose: a drop that lands during a handover surfaces from either the
+// receiving loop or the handover goroutine, whichever the errgroup records first, and it
+// should be counted as a drop in both cases. HANDOVER_FAILED is then only the handover's own
+// failures. An unrecognised error is left unattributed - normalizeProxyError already maps a
+// clean finish and a user interrupt to nil.
+func proxySessionEndCategory(err error) protos.SshTunnelErrorCategory {
+	switch {
+	case err == nil:
+		return ""
+	case errors.Is(err, proxy.ErrWebsocketDropped):
+		return protos.SshTunnelErrorCategoryWebsocketDropped
+	case errors.Is(err, proxy.ErrHandoverFailed):
+		return protos.SshTunnelErrorCategoryHandoverFailed
+	case errors.Is(err, proxy.ErrConnectFailed):
+		return protos.SshTunnelErrorCategoryWebsocketConnectFailed
+	default:
+		return ""
+	}
+}
+
+func logSshTunnelEvent(ctx context.Context, opts ClientOptions, outcome connectOutcome) {
+	telemetry.Log(ctx, protos.DatabricksCliLog{
+		SshTunnelEvent: buildSshTunnelEvent(opts, outcome),
+	})
+}
+
+// buildSshTunnelEvent maps the connection options and outcome onto the telemetry
+// event. It is separated from logSshTunnelEvent so the field mapping can be unit tested.
+func buildSshTunnelEvent(opts ClientOptions, outcome connectOutcome) *protos.SshTunnelEvent {
+	computeType := protos.SshTunnelComputeTypeDedicated
+	if opts.IsServerlessMode() {
+		computeType = protos.SshTunnelComputeTypeServerless
+	}
+
+	var clientMode protos.SshTunnelClientMode
+	switch {
+	case opts.ProxyMode:
+		clientMode = protos.SshTunnelClientModeProxy
+	case opts.IDE != "":
+		clientMode = protos.SshTunnelClientModeIDE
+	default:
+		clientMode = protos.SshTunnelClientModeSSH
+	}
+
+	return &protos.SshTunnelEvent{
+		ComputeType:        computeType,
+		AcceleratorType:    opts.Accelerator,
+		IdeType:            opts.IDE,
+		ClientMode:         clientMode,
+		IsReconnect:        outcome.isReconnect,
+		AutoStartCluster:   opts.AutoStartCluster,
+		ServerStartTimeMs:  outcome.serverStartTimeMs,
+		IsSuccess:          outcome.isSuccess,
+		HasBaseEnvironment: opts.BaseEnvironment != "",
+		HasUsagePolicy:     opts.UsagePolicyID != "",
+		// The connect side can only report that the knob was asked for. Whether any detached
+		// process was there to keep is reported by the server, at teardown.
+		KeepDetachedRequested: opts.KeepDetachedProcesses,
+		ErrorCategory:         outcome.category(),
+	}
 }
diff --git a/experimental/ssh/internal/client/client_internal_test.go b/experimental/ssh/internal/client/client_internal_test.go
new file mode 100644
index 00000000000..746f5d58f98
--- /dev/null
+++ b/experimental/ssh/internal/client/client_internal_test.go
@@ -0,0 +1,920 @@
+package client
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"slices"
+	"strconv"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/databricks/cli/experimental/ssh/internal/proxy"
+	"github.com/databricks/cli/experimental/ssh/internal/sshconfig"
+	"github.com/databricks/cli/experimental/ssh/internal/vscode"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/telemetry/protos"
+	"github.com/databricks/databricks-sdk-go/experimental/mocks"
+	"github.com/databricks/databricks-sdk-go/service/compute"
+	"github.com/databricks/databricks-sdk-go/service/environments"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+)
+
+func TestValidateClusterAccessSingleUser(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	m := mocks.NewMockWorkspaceClient(t)
+	m.GetMockClustersAPI().EXPECT().Get(ctx, compute.GetClusterRequest{ClusterId: "cluster-123"}).Return(&compute.ClusterDetails{
+		DataSecurityMode: compute.DataSecurityModeSingleUser,
+		SingleUserName:   "me@example.com",
+	}, nil)
+
+	err := ValidateClusterAccess(ctx, m.WorkspaceClient, "cluster-123")
+	assert.NoError(t, err)
+}
+
+// A dedicated cluster reporting the newer DATA_SECURITY_MODE_DEDICATED enum (rather than the
+// legacy SINGLE_USER alias) must still pass validation.
+func TestValidateClusterAccessDedicatedEnum(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	m := mocks.NewMockWorkspaceClient(t)
+	m.GetMockClustersAPI().EXPECT().Get(ctx, compute.GetClusterRequest{ClusterId: "cluster-123"}).Return(&compute.ClusterDetails{
+		DataSecurityMode: compute.DataSecurityModeDataSecurityModeDedicated,
+		SingleUserName:   "me@example.com",
+	}, nil)
+
+	err := ValidateClusterAccess(ctx, m.WorkspaceClient, "cluster-123")
+	assert.NoError(t, err)
+}
+
+func TestValidateClusterAccessInvalidAccessMode(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	m := mocks.NewMockWorkspaceClient(t)
+	m.GetMockClustersAPI().EXPECT().Get(ctx, compute.GetClusterRequest{ClusterId: "cluster-123"}).Return(&compute.ClusterDetails{
+		DataSecurityMode: compute.DataSecurityModeUserIsolation,
+	}, nil)
+
+	err := ValidateClusterAccess(ctx, m.WorkspaceClient, "cluster-123")
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "must be a dedicated single-user cluster")
+	// The error surfaces the UI label ("Standard"), not the raw API enum (USER_ISOLATION).
+	assert.Contains(t, err.Error(), "Current access mode: Standard")
+	assert.NotContains(t, err.Error(), "USER_ISOLATION")
+}
+
+// A Dedicated cluster assigned to a group (no single_user_name) is rejected, and the error
+// reports the mode specifically as "Dedicated (group)".
+func TestValidateClusterAccessDedicatedGroup(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	m := mocks.NewMockWorkspaceClient(t)
+	m.GetMockClustersAPI().EXPECT().Get(ctx, compute.GetClusterRequest{ClusterId: "cluster-123"}).Return(&compute.ClusterDetails{
+		DataSecurityMode: compute.DataSecurityModeDataSecurityModeDedicated,
+	}, nil)
+
+	err := ValidateClusterAccess(ctx, m.WorkspaceClient, "cluster-123")
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "must be a dedicated single-user cluster")
+	assert.Contains(t, err.Error(), "Current access mode: Dedicated (group)")
+}
+
+func TestAccessModeUILabel(t *testing.T) {
+	tests := []struct {
+		mode           compute.DataSecurityMode
+		singleUserName string
+		want           string
+	}{
+		{compute.DataSecurityModeSingleUser, "me@example.com", "Dedicated (single user)"},
+		{compute.DataSecurityModeDataSecurityModeDedicated, "me@example.com", "Dedicated (single user)"},
+		{compute.DataSecurityModeDataSecurityModeDedicated, "", "Dedicated (group)"},
+		{compute.DataSecurityModeUserIsolation, "", "Standard"},
+		{compute.DataSecurityModeDataSecurityModeStandard, "", "Standard"},
+		{compute.DataSecurityModeNone, "", "No isolation"},
+		// Legacy/unknown modes fall back to the raw API value.
+		{compute.DataSecurityModeLegacyTableAcl, "", "LEGACY_TABLE_ACL"},
+	}
+	for _, tt := range tests {
+		assert.Equal(t, tt.want, accessModeUILabel(tt.mode, tt.singleUserName), "mode=%s", tt.mode)
+	}
+}
+
+func TestValidateClusterAccessClusterNotFound(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	m := mocks.NewMockWorkspaceClient(t)
+	m.GetMockClustersAPI().EXPECT().Get(ctx, compute.GetClusterRequest{ClusterId: "nonexistent"}).Return(nil, errors.New("cluster not found"))
+
+	err := ValidateClusterAccess(ctx, m.WorkspaceClient, "nonexistent")
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "failed to get cluster information for cluster ID 'nonexistent'")
+}
+
+// terminatedRun builds a job run whose SSH server task has terminated, for the failure-surfacing tests.
+func terminatedRun(runID, taskRunID int64, message, pageURL string) *jobs.Run {
+	return &jobs.Run{
+		RunId:      runID,
+		RunPageUrl: pageURL,
+		Tasks: []jobs.RunTask{{
+			TaskKey: sshServerTaskKey,
+			RunId:   taskRunID,
+			Status: &jobs.RunStatus{
+				State:              jobs.RunLifecycleStateV2StateTerminated,
+				TerminationDetails: &jobs.TerminationDetails{Message: message},
+			},
+		}},
+	}
+}
+
+func TestResolveBaseEnvironment(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+
+	// Paths and resource IDs are passed through without hitting the API.
+	t.Run("env.yaml path passthrough", func(t *testing.T) {
+		m := mocks.NewMockWorkspaceClient(t)
+		got, err := resolveBaseEnvironment(ctx, m.WorkspaceClient, "/Workspace/path/to/env.yaml")
+		require.NoError(t, err)
+		assert.Equal(t, "/Workspace/path/to/env.yaml", got)
+	})
+
+	t.Run("resource ID passthrough", func(t *testing.T) {
+		m := mocks.NewMockWorkspaceClient(t)
+		got, err := resolveBaseEnvironment(ctx, m.WorkspaceClient, "workspace-base-environments/dbe_123")
+		require.NoError(t, err)
+		assert.Equal(t, "workspace-base-environments/dbe_123", got)
+	})
+
+	t.Run("display name resolves to resource ID", func(t *testing.T) {
+		m := mocks.NewMockWorkspaceClient(t)
+		m.GetMockEnvironmentsAPI().EXPECT().
+			ListWorkspaceBaseEnvironmentsAll(mock.Anything, environments.ListWorkspaceBaseEnvironmentsRequest{}).
+			Return([]environments.WorkspaceBaseEnvironment{
+				{DisplayName: "other", Name: "workspace-base-environments/dbe_other"},
+				{DisplayName: "my-env", Name: "workspace-base-environments/dbe_mine"},
+			}, nil)
+
+		got, err := resolveBaseEnvironment(ctx, m.WorkspaceClient, "my-env")
+		require.NoError(t, err)
+		assert.Equal(t, "workspace-base-environments/dbe_mine", got)
+	})
+
+	t.Run("display name not found", func(t *testing.T) {
+		m := mocks.NewMockWorkspaceClient(t)
+		m.GetMockEnvironmentsAPI().EXPECT().
+			ListWorkspaceBaseEnvironmentsAll(mock.Anything, environments.ListWorkspaceBaseEnvironmentsRequest{}).
+			Return([]environments.WorkspaceBaseEnvironment{
+				{DisplayName: "other", Name: "workspace-base-environments/dbe_other"},
+			}, nil)
+
+		_, err := resolveBaseEnvironment(ctx, m.WorkspaceClient, "my-env")
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), `no workspace base environment found with display name "my-env"`)
+	})
+
+	t.Run("display name ambiguous", func(t *testing.T) {
+		m := mocks.NewMockWorkspaceClient(t)
+		m.GetMockEnvironmentsAPI().EXPECT().
+			ListWorkspaceBaseEnvironmentsAll(mock.Anything, environments.ListWorkspaceBaseEnvironmentsRequest{}).
+			Return([]environments.WorkspaceBaseEnvironment{
+				{DisplayName: "my-env", Name: "workspace-base-environments/dbe_1"},
+				{DisplayName: "my-env", Name: "workspace-base-environments/dbe_2"},
+			}, nil)
+
+		_, err := resolveBaseEnvironment(ctx, m.WorkspaceClient, "my-env")
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), `multiple workspace base environments found with display name "my-env"`)
+	})
+}
+
+func TestDescribeRunFailureIncludesMessageTraceAndURL(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	m := mocks.NewMockWorkspaceClient(t)
+	api := m.GetMockJobsAPI()
+	api.EXPECT().GetRun(mock.Anything, jobs.GetRunRequest{RunId: 1}).Return(
+		terminatedRun(1, 99, "Could not reach driver of cluster 0605-x.", "https://example.test/run/1"), nil)
+	api.EXPECT().GetRunOutput(mock.Anything, jobs.GetRunOutputRequest{RunId: 99}).Return(
+		&jobs.RunOutput{Error: "Run failed with error message", ErrorTrace: "Traceback (most recent call last): boom"}, nil)
+
+	out := describeRunFailure(ctx, m.WorkspaceClient, 1)
+	assert.Contains(t, out, "Could not reach driver of cluster 0605-x.")
+	assert.Contains(t, out, "Run failed with error message")
+	assert.Contains(t, out, "Traceback (most recent call last): boom")
+	assert.Contains(t, out, "https://example.test/run/1")
+}
+
+func TestDescribeRunFailureTruncatesLongTrace(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	m := mocks.NewMockWorkspaceClient(t)
+	api := m.GetMockJobsAPI()
+	longTrace := strings.Repeat("x", maxRunFailureTraceBytes+500) + "TAIL_MARKER"
+	api.EXPECT().GetRun(mock.Anything, jobs.GetRunRequest{RunId: 1}).Return(
+		terminatedRun(1, 99, "", "https://example.test/run/1"), nil)
+	api.EXPECT().GetRunOutput(mock.Anything, jobs.GetRunOutputRequest{RunId: 99}).Return(
+		&jobs.RunOutput{ErrorTrace: longTrace}, nil)
+
+	out := describeRunFailure(ctx, m.WorkspaceClient, 1)
+	assert.Contains(t, out, "...")
+	assert.Contains(t, out, "TAIL_MARKER")
+	// The leading run of 'x' is dropped by truncation.
+	assert.NotContains(t, out, strings.Repeat("x", maxRunFailureTraceBytes+1))
+}
+
+func TestDescribeRunFailureDeduplicatesErrorInTrace(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	m := mocks.NewMockWorkspaceClient(t)
+	api := m.GetMockJobsAPI()
+	errMsg := "SSH server exited with code 1. Last server logs:\nLOG_MARKER"
+	api.EXPECT().GetRun(mock.Anything, jobs.GetRunRequest{RunId: 1}).Return(
+		terminatedRun(1, 99, "", "https://example.test/run/1"), nil)
+	api.EXPECT().GetRunOutput(mock.Anything, jobs.GetRunOutputRequest{RunId: 99}).Return(
+		&jobs.RunOutput{Error: errMsg, ErrorTrace: "Traceback (most recent call last):\n  boom\nRuntimeError: " + errMsg}, nil)
+
+	out := describeRunFailure(ctx, m.WorkspaceClient, 1)
+	assert.Contains(t, out, "Traceback (most recent call last):")
+	assert.Equal(t, 1, strings.Count(out, "LOG_MARKER"))
+}
+
+func TestDescribeRunFailureTruncatesLongError(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	m := mocks.NewMockWorkspaceClient(t)
+	api := m.GetMockJobsAPI()
+	longError := strings.Repeat("x", maxRunFailureTraceBytes+500) + "TAIL_MARKER"
+	api.EXPECT().GetRun(mock.Anything, jobs.GetRunRequest{RunId: 1}).Return(
+		terminatedRun(1, 99, "", "https://example.test/run/1"), nil)
+	api.EXPECT().GetRunOutput(mock.Anything, jobs.GetRunOutputRequest{RunId: 99}).Return(
+		&jobs.RunOutput{Error: longError}, nil)
+
+	out := describeRunFailure(ctx, m.WorkspaceClient, 1)
+	assert.Contains(t, out, "...")
+	assert.Contains(t, out, "TAIL_MARKER")
+	assert.NotContains(t, out, strings.Repeat("x", maxRunFailureTraceBytes+1))
+}
+
+func TestDescribeRunFailureNoRunID(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	m := mocks.NewMockWorkspaceClient(t)
+	out := describeRunFailure(ctx, m.WorkspaceClient, 0)
+	assert.Contains(t, out, "no job run ID")
+}
+
+func TestRunFailureIfTerminated(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+
+	t.Run("terminated", func(t *testing.T) {
+		m := mocks.NewMockWorkspaceClient(t)
+		api := m.GetMockJobsAPI()
+		api.EXPECT().GetRun(mock.Anything, jobs.GetRunRequest{RunId: 1}).Return(
+			terminatedRun(1, 99, "boom", "https://example.test/run/1"), nil)
+		api.EXPECT().GetRunOutput(mock.Anything, jobs.GetRunOutputRequest{RunId: 99}).Return(
+			&jobs.RunOutput{}, nil)
+
+		desc, terminated := runFailureIfTerminated(ctx, m.WorkspaceClient, 1)
+		assert.True(t, terminated)
+		assert.Contains(t, desc, "boom")
+	})
+
+	t.Run("still running", func(t *testing.T) {
+		m := mocks.NewMockWorkspaceClient(t)
+		api := m.GetMockJobsAPI()
+		api.EXPECT().GetRun(mock.Anything, jobs.GetRunRequest{RunId: 1}).Return(&jobs.Run{
+			RunId: 1,
+			Tasks: []jobs.RunTask{{
+				TaskKey: sshServerTaskKey,
+				Status:  &jobs.RunStatus{State: jobs.RunLifecycleStateV2StateRunning},
+			}},
+		}, nil)
+
+		_, terminated := runFailureIfTerminated(ctx, m.WorkspaceClient, 1)
+		assert.False(t, terminated)
+	})
+}
+
+func TestWaitForJobToStartSurfacesFailure(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	m := mocks.NewMockWorkspaceClient(t)
+	api := m.GetMockJobsAPI()
+	api.EXPECT().GetRun(mock.Anything, jobs.GetRunRequest{RunId: 1}).Return(
+		terminatedRun(1, 99, "Could not reach driver of cluster 0605-x.", "https://example.test/run/1"), nil)
+	api.EXPECT().GetRunOutput(mock.Anything, jobs.GetRunOutputRequest{RunId: 99}).Return(
+		&jobs.RunOutput{}, nil)
+
+	err := waitForJobToStart(ctx, m.WorkspaceClient, 1, ClientOptions{TaskStartupTimeout: 30 * time.Second})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "ssh server bootstrap job failed")
+	assert.Contains(t, err.Error(), "Could not reach driver of cluster 0605-x.")
+}
+
+// hostKeyFailureStderr is the relevant tail of ssh's stderr when strict checking aborts a
+// connection because the remote host key changed.
+const hostKeyFailureStderr = `@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
+@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
+@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
+Host key for databricks-cpu-6e7644d0 has changed and you have requested strict checking.
+Host key verification failed.`
+
+func TestHostKeyChangedHint(t *testing.T) {
+	tests := []struct {
+		name           string
+		stderr         string
+		hostName       string
+		knownHostsFile string
+		wantContains   []string
+		wantOmits      []string
+		wantEmpty      bool
+	}{
+		{
+			name:           "host key failure names the host and the pinned file",
+			stderr:         hostKeyFailureStderr,
+			hostName:       "databricks-cpu-6e7644d0",
+			knownHostsFile: "/tmp/known_hosts",
+			wantContains:   []string{"databricks-cpu-6e7644d0", "/tmp/known_hosts"},
+		},
+		{
+			// The stale-entry advice this hint used to give no longer applies: the CLI
+			// rewrites the entry from the workspace before every connection.
+			name:           "host key failure does not blame a stale local entry",
+			stderr:         hostKeyFailureStderr,
+			hostName:       "databricks-cpu-6e7644d0",
+			knownHostsFile: "/tmp/known_hosts",
+			wantOmits:      []string{"ssh-keygen -R"},
+		},
+		{
+			name:      "unrelated failure",
+			stderr:    "kex_exchange_identification: Connection closed by remote host",
+			hostName:  "databricks-cpu-6e7644d0",
+			wantEmpty: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := hostKeyChangedHint(tt.stderr, tt.hostName, tt.knownHostsFile)
+			if tt.wantEmpty {
+				assert.Empty(t, got)
+				return
+			}
+			for _, want := range tt.wantContains {
+				assert.Contains(t, got, want)
+			}
+			for _, unwanted := range tt.wantOmits {
+				assert.NotContains(t, got, unwanted)
+			}
+		})
+	}
+}
+
+func TestBuildRemoteShellArgs(t *testing.T) {
+	const bashCmd = `command -v bash >/dev/null 2>&1 && exec bash -i || exec "${SHELL:-/bin/sh}" -i`
+	const version = "1.2.3"
+
+	// A serverless session has a connection name and no cluster ID.
+	serverless := ClientOptions{ConnectionName: "my-conn"}
+
+	t.Run("serverless installs a launcher per agent, cds home, then opens bash", func(t *testing.T) {
+		const wsHome = "/Workspace/Users/me@example.com"
+		args := buildRemoteShellArgs(serverless, wsHome, version)
+		require.Len(t, args, 1)
+		// A wrapper is written for every supported agent before the shell opens.
+		for _, agent := range SupportedAgentNames() {
+			assert.Contains(t, args[0], `cat > "$HOME/.agent-shim/bin/`+agent+`"`)
+			assert.Contains(t, args[0], agentWrapperScript(wsHome, version, agent))
+		}
+		assert.Contains(t, args[0], `export PATH="$PATH:$HOME/.agent-shim/bin"`)
+		// The cd into the workspace home precedes the shell launch.
+		assert.True(t, strings.HasSuffix(args[0], `cd '`+wsHome+`' 2>/dev/null; `+bashCmd))
+	})
+
+	t.Run("dedicated cluster skips the launchers but keeps the workspace cwd", func(t *testing.T) {
+		const wsHome = "/Workspace/Users/me@example.com"
+		args := buildRemoteShellArgs(ClientOptions{ClusterID: "abc-123"}, wsHome, version)
+		require.Len(t, args, 1)
+		// No launchers on a dedicated cluster...
+		assert.NotContains(t, args[0], "agent-shim/bin")
+		// ...but the cd into the workspace home is preserved (regression guard).
+		assert.Equal(t, `cd '`+wsHome+`' 2>/dev/null; `+bashCmd, args[0])
+	})
+
+	t.Run("serverless without a workspace home skips the launchers", func(t *testing.T) {
+		// Without wsHome the wrappers can't locate the CLI, so only the shell opens.
+		args := buildRemoteShellArgs(serverless, "", version)
+		require.Len(t, args, 1)
+		assert.Equal(t, bashCmd, args[0])
+	})
+
+	t.Run("non-interactive passes additional args verbatim", func(t *testing.T) {
+		additional := []string{"ls", "-la"}
+		args := buildRemoteShellArgs(ClientOptions{ConnectionName: "my-conn", AdditionalArgs: additional}, "/Workspace/Users/me@example.com", version)
+		assert.Equal(t, additional, args)
+	})
+}
+
+func TestBuildSSHArgsSetsServerAliveInterval(t *testing.T) {
+	args := buildSSHArgs("user", "/key", "/pins/myhost", "proxy command", "myhost", "", "1.2.3", ClientOptions{})
+
+	// ssh stops parsing options at the destination, so an option placed after the host would be
+	// treated as part of the remote command rather than as an ssh option.
+	optIdx := slices.Index(args, "ServerAliveInterval="+strconv.Itoa(sshconfig.ServerAliveIntervalSeconds))
+	require.NotEqual(t, -1, optIdx, "ssh must be asked to send keepalives")
+	require.Equal(t, "-o", args[optIdx-1])
+	assert.Less(t, optIdx, slices.Index(args, "myhost"), "the option must precede the destination host")
+}
+
+func TestBuildSSHArgsPinsHostKey(t *testing.T) {
+	args := buildSSHArgs("user", "/key", "/pins/myhost", "proxy command", "myhost", "", "1.2.3", ClientOptions{})
+
+	// The pinned file is the whole point of strict checking here: without it ssh would
+	// fall back to ~/.ssh/known_hosts, where an entry for this name may be left over from
+	// other compute (DECO-27882).
+	hostIdx := slices.Index(args, "myhost")
+	for _, want := range []string{"StrictHostKeyChecking=yes", "UserKnownHostsFile=/pins/myhost"} {
+		optIdx := slices.Index(args, want)
+		require.NotEqual(t, -1, optIdx, "%s must be passed to ssh", want)
+		require.Equal(t, "-o", args[optIdx-1])
+		assert.Less(t, optIdx, hostIdx, "the option must precede the destination host")
+	}
+}
+
+func TestAgentWrapperScript(t *testing.T) {
+	const wsHome = "/Workspace/Users/me@example.com"
+
+	t.Run("resolves the uploaded binary and delegates to agent-shim <agent>", func(t *testing.T) {
+		wrapper := agentWrapperScript(wsHome, "1.2.3", "codex")
+		assert.True(t, strings.HasPrefix(wrapper, "#!/usr/bin/env bash"))
+		// Architecture is resolved on the remote via uname -m.
+		assert.Contains(t, wrapper, "case \"$(uname -m)\" in")
+		// Binary path uses the version dir + arch subdir; the workspace/version-derived
+		// portion is single-quoted while ${_arch} stays expandable on the remote.
+		assert.Contains(t, wrapper, `exec '`+wsHome+`/.databricks/ssh-tunnel/1.2.3/databricks_cli_1.2.3_linux_'${_arch}'/databricks' ssh agent-shim codex "$@"`)
+		// The workspace home is forwarded so the shim can name the working directory.
+		assert.Contains(t, wrapper, "export "+workspaceHomeEnv+"='"+wsHome+"'")
+	})
+
+	t.Run("dev builds use the version-less release subdir", func(t *testing.T) {
+		wrapper := agentWrapperScript(wsHome, "1.2.3-dev+abc", "claude")
+		assert.Contains(t, wrapper, `/ssh-tunnel/1.2.3-dev+abc/databricks_cli_linux_'${_arch}'/databricks`)
+	})
+}
+
+func TestBuildSSHArgsPTYPlacement(t *testing.T) {
+	indexOf := func(args []string, want string) int {
+		for i, a := range args {
+			if a == want {
+				return i
+			}
+		}
+		return -1
+	}
+
+	t.Run("interactive forces a PTY before the destination", func(t *testing.T) {
+		args := buildSSHArgs("user", "/key", "/pins/myhost", "proxy command", "myhost", "/Workspace/Users/me@example.com", "1.2.3", ClientOptions{})
+		ptyIdx := indexOf(args, "-t")
+		hostIdx := indexOf(args, "myhost")
+		require.NotEqual(t, -1, ptyIdx, "-t must be present for interactive sessions")
+		require.NotEqual(t, -1, hostIdx)
+		assert.Less(t, ptyIdx, hostIdx, "-t must precede the destination host")
+		// The remote command is the final arg, after the host.
+		assert.Greater(t, len(args)-1, hostIdx)
+		assert.Contains(t, args[len(args)-1], "exec bash -i")
+	})
+
+	t.Run("non-interactive does not force a PTY", func(t *testing.T) {
+		args := buildSSHArgs("user", "/key", "/pins/myhost", "proxy command", "myhost", "", "1.2.3", ClientOptions{AdditionalArgs: []string{"ls", "-la"}})
+		assert.Equal(t, -1, indexOf(args, "-t"), "no PTY for non-interactive passthrough")
+		hostIdx := indexOf(args, "myhost")
+		require.NotEqual(t, -1, hostIdx)
+		assert.Equal(t, []string{"ls", "-la"}, args[hostIdx+1:], "additional args follow the host verbatim")
+	})
+}
+
+func TestTailWriterRetainsTail(t *testing.T) {
+	t.Run("retains only the tail", func(t *testing.T) {
+		w := &tailWriter{maxBytes: 4}
+		n, err := w.Write([]byte("abcdefgh"))
+		require.NoError(t, err)
+		assert.Equal(t, 8, n)
+		assert.Equal(t, "efgh", w.String())
+	})
+
+	t.Run("preserves a short write", func(t *testing.T) {
+		w := &tailWriter{maxBytes: 4}
+		_, err := w.Write([]byte("ab"))
+		require.NoError(t, err)
+		assert.Equal(t, "ab", w.String())
+	})
+}
+
+func TestBuildSshTunnelEvent(t *testing.T) {
+	tests := []struct {
+		name string
+		opts ClientOptions
+		want protos.SshTunnelEvent
+	}{
+		{
+			name: "dedicated cluster via raw SSH client",
+			opts: ClientOptions{ClusterID: "abc-123", AutoStartCluster: true},
+			want: protos.SshTunnelEvent{
+				ComputeType:      protos.SshTunnelComputeTypeDedicated,
+				ClientMode:       protos.SshTunnelClientModeSSH,
+				AutoStartCluster: true,
+			},
+		},
+		{
+			name: "serverless with accelerator",
+			opts: ClientOptions{ConnectionName: "my-conn", Accelerator: "GPU_1xA10"},
+			want: protos.SshTunnelEvent{
+				ComputeType:     protos.SshTunnelComputeTypeServerless,
+				AcceleratorType: "GPU_1xA10",
+				ClientMode:      protos.SshTunnelClientModeSSH,
+			},
+		},
+		{
+			name: "proxy mode takes precedence over IDE",
+			opts: ClientOptions{ConnectionName: "my-conn", ProxyMode: true, IDE: "vscode"},
+			want: protos.SshTunnelEvent{
+				ComputeType: protos.SshTunnelComputeTypeServerless,
+				IdeType:     "vscode",
+				ClientMode:  protos.SshTunnelClientModeProxy,
+			},
+		},
+		{
+			name: "IDE mode",
+			opts: ClientOptions{ConnectionName: "my-conn", IDE: "cursor"},
+			want: protos.SshTunnelEvent{
+				ComputeType: protos.SshTunnelComputeTypeServerless,
+				IdeType:     "cursor",
+				ClientMode:  protos.SshTunnelClientModeIDE,
+			},
+		},
+		{
+			// The raw --base-environment value can carry PII, so only its presence is recorded.
+			name: "custom base environment records presence only",
+			opts: ClientOptions{ConnectionName: "my-conn", BaseEnvironment: "/Workspace/Users/me@example.com/env.yaml"},
+			want: protos.SshTunnelEvent{
+				ComputeType:        protos.SshTunnelComputeTypeServerless,
+				ClientMode:         protos.SshTunnelClientModeSSH,
+				HasBaseEnvironment: true,
+			},
+		},
+		{
+			name: "keeping detached processes records the request",
+			opts: ClientOptions{ClusterID: "abc-123", KeepDetachedProcesses: true},
+			want: protos.SshTunnelEvent{
+				ComputeType:           protos.SshTunnelComputeTypeDedicated,
+				ClientMode:            protos.SshTunnelClientModeSSH,
+				KeepDetachedRequested: true,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := buildSshTunnelEvent(tt.opts, connectOutcome{
+				isSuccess:         true,
+				isReconnect:       true,
+				serverStartTimeMs: 1500,
+			})
+			tt.want.IsSuccess = true
+			tt.want.IsReconnect = true
+			tt.want.ServerStartTimeMs = 1500
+			tt.want.ErrorCategory = protos.SshTunnelErrorCategoryUnspecified
+			assert.Equal(t, &tt.want, got)
+		})
+	}
+}
+
+func TestConnectOutcomeCategory(t *testing.T) {
+	errFailed := errors.New("failed")
+
+	tests := []struct {
+		name    string
+		outcome connectOutcome
+		want    protos.SshTunnelErrorCategory
+	}{
+		{
+			name:    "success reports no category",
+			outcome: connectOutcome{isSuccess: true},
+			want:    protos.SshTunnelErrorCategoryUnspecified,
+		},
+		{
+			// A non-zero exit after the tunnel is up belongs to the ssh client, not the connection.
+			name:    "error after a successful connection reports no category",
+			outcome: connectOutcome{isSuccess: true, err: errFailed},
+			want:    protos.SshTunnelErrorCategoryUnspecified,
+		},
+		{
+			// A session end the proxy did attribute must survive isSuccess, or a mid-session
+			// drop is indistinguishable from a clean exit.
+			name: "attributed session end after a successful connection keeps its category",
+			outcome: connectOutcome{
+				isSuccess:     true,
+				errorCategory: protos.SshTunnelErrorCategoryWebsocketDropped,
+				err:           errFailed,
+			},
+			want: protos.SshTunnelErrorCategoryWebsocketDropped,
+		},
+		{
+			name:    "attributed failure keeps its category",
+			outcome: connectOutcome{errorCategory: protos.SshTunnelErrorCategoryIDECommandNotOnPath, err: errFailed},
+			want:    protos.SshTunnelErrorCategoryIDECommandNotOnPath,
+		},
+		{
+			name:    "unattributed failure falls back to UNKNOWN",
+			outcome: connectOutcome{err: errFailed},
+			want:    protos.SshTunnelErrorCategoryUnknown,
+		},
+		{
+			name:    "cancellation reports USER_ABORTED",
+			outcome: connectOutcome{err: fmt.Errorf("wrapped: %w", context.Canceled)},
+			want:    protos.SshTunnelErrorCategoryUserAborted,
+		},
+		{
+			// Ctrl-C surfaces as a cancellation from whichever step observed it first, so the
+			// interruption must win over the category that step recorded.
+			name: "cancellation wins over the category set at the failure site",
+			outcome: connectOutcome{
+				errorCategory: protos.SshTunnelErrorCategoryServerStartTimeout,
+				err:           fmt.Errorf("wrapped: %w", context.Canceled),
+			},
+			want: protos.SshTunnelErrorCategoryUserAborted,
+		},
+		{
+			// A step that shells out reports a killed child as *exec.ExitError, which does not
+			// wrap context.Canceled, so the cancelled context is the only evidence left. Without
+			// this branch a Ctrl-C during the extension install counts as a rejected install and
+			// pollutes the bucket that is supposed to mean "the marketplace or a policy blocked
+			// it" -- one of only two reachable under --auto-approve.
+			name: "interruption wins over the category set at the failure site",
+			outcome: connectOutcome{
+				ctxErr:        context.Canceled,
+				errorCategory: protos.SshTunnelErrorCategoryIDESSHExtensionInstallFailed,
+				err:           errors.New("signal: killed"),
+			},
+			want: protos.SshTunnelErrorCategoryUserAborted,
+		},
+		{
+			// Only a cancellation is the user giving up. No ancestor of the connect context
+			// carries a deadline today, so this is unreachable; matching the cause rather than
+			// testing ctxErr for non-nil keeps it that way if one is ever added.
+			name: "an expired deadline is not a user abort",
+			outcome: connectOutcome{
+				ctxErr:        context.DeadlineExceeded,
+				errorCategory: protos.SshTunnelErrorCategoryServerStartTimeout,
+				err:           errFailed,
+			},
+			want: protos.SshTunnelErrorCategoryServerStartTimeout,
+		},
+		{
+			// Interrupting an established tunnel is not a connection failure.
+			name:    "interruption after a successful connection reports no category",
+			outcome: connectOutcome{isSuccess: true, ctxErr: context.Canceled, err: errFailed},
+			want:    protos.SshTunnelErrorCategoryUnspecified,
+		},
+		{
+			// ...but a session end the proxy did attribute outranks the interruption, or a drop
+			// that happened to coincide with the user giving up would be lost.
+			name: "an attributed session end wins over an interruption",
+			outcome: connectOutcome{
+				isSuccess:     true,
+				ctxErr:        context.Canceled,
+				errorCategory: protos.SshTunnelErrorCategoryWebsocketDropped,
+				err:           errFailed,
+			},
+			want: protos.SshTunnelErrorCategoryWebsocketDropped,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, tt.outcome.category())
+		})
+	}
+}
+
+// The four Remote SSH extension outcomes were reported as one category until they were split,
+// which left the largest IDE-mode failure bucket unattributable. Pin the mapping, including the
+// wrapping, since CheckIDESSHExtension returns its sentinels wrapped in a message.
+func TestSshExtensionErrorCategory(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want protos.SshTunnelErrorCategory
+	}{
+		{
+			name: "list failure",
+			err:  fmt.Errorf("%w in VS Code: %w", vscode.ErrSSHExtensionListFailed, errors.New("exit 4")),
+			want: protos.SshTunnelErrorCategoryIDESSHExtensionListFailed,
+		},
+		{
+			name: "install failure",
+			err:  fmt.Errorf("%w: %w", vscode.ErrSSHExtensionInstallFailed, errors.New("exit 3")),
+			want: protos.SshTunnelErrorCategoryIDESSHExtensionInstallFailed,
+		},
+		{
+			name: "user declined the install",
+			err:  fmt.Errorf("%w: install it with ...", vscode.ErrSSHExtensionInstallDeclined),
+			want: protos.SshTunnelErrorCategoryIDESSHExtensionInstallDeclined,
+		},
+		{
+			name: "no way to ask for consent",
+			err:  fmt.Errorf("%w: install it with ...", vscode.ErrSSHExtensionInstallUnavailable),
+			want: protos.SshTunnelErrorCategoryIDESSHExtensionInstallUnavailable,
+		},
+		{
+			// Only reachable if a new failure path forgets its sentinel.
+			name: "unsentinelled failure falls back to UNKNOWN",
+			err:  errors.New("something else"),
+			want: protos.SshTunnelErrorCategoryUnknown,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, sshExtensionErrorCategory(tt.err))
+		})
+	}
+}
+
+func TestProxySessionEndCategory(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want protos.SshTunnelErrorCategory
+	}{
+		{
+			name: "clean finish is not attributed",
+			err:  nil,
+			want: "",
+		},
+		{
+			name: "dropped websocket",
+			err:  fmt.Errorf("wrapped: %w", proxy.ErrWebsocketDropped),
+			want: protos.SshTunnelErrorCategoryWebsocketDropped,
+		},
+		{
+			name: "handover failure",
+			err:  fmt.Errorf("wrapped: %w", proxy.ErrHandoverFailed),
+			want: protos.SshTunnelErrorCategoryHandoverFailed,
+		},
+		{
+			name: "connect failure",
+			err:  fmt.Errorf("wrapped: %w", proxy.ErrConnectFailed),
+			want: protos.SshTunnelErrorCategoryWebsocketConnectFailed,
+		},
+		{
+			// A drop landing during a handover surfaces from either the receiving loop or the
+			// handover goroutine, so it must be counted as a drop either way.
+			name: "a drop during a handover counts as a drop",
+			err:  errors.Join(proxy.ErrHandoverFailed, proxy.ErrWebsocketDropped),
+			want: protos.SshTunnelErrorCategoryWebsocketDropped,
+		},
+		{
+			name: "an unrecognised error is left unattributed",
+			err:  errors.New("something else"),
+			want: "",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, proxySessionEndCategory(tt.err))
+		})
+	}
+}
+
+func TestBuildSshTunnelEventReportsErrorCategory(t *testing.T) {
+	got := buildSshTunnelEvent(ClientOptions{ConnectionName: "my-conn", IDE: "vscode"}, connectOutcome{
+		errorCategory: protos.SshTunnelErrorCategoryIDECommandNotOnPath,
+		err:           errors.New("failed"),
+	})
+
+	assert.False(t, got.IsSuccess)
+	assert.Equal(t, protos.SshTunnelErrorCategoryIDECommandNotOnPath, got.ErrorCategory)
+}
+
+// A failed first attempt is the case the telemetry exists to measure, so assert
+// the outcome fields reach the payload as an explicit false rather than being
+// dropped as zero values.
+func TestBuildSshTunnelEventReportsFailure(t *testing.T) {
+	got := buildSshTunnelEvent(ClientOptions{ClusterID: "abc-123"}, connectOutcome{})
+
+	assert.False(t, got.IsSuccess)
+
+	b, err := json.Marshal(got)
+	require.NoError(t, err)
+	assert.Contains(t, string(b), `"is_success":false`)
+}
+
+func TestMetadataResponseError(t *testing.T) {
+	tests := []struct {
+		name       string
+		statusCode int
+		body       string
+		forbidden  bool
+		message    string
+	}{
+		{
+			name:       "feature disabled",
+			statusCode: 403,
+			body:       `"FEATURE_DISABLED: An administrator has disabled port forwarding to serverless compute for this workspace"`,
+			forbidden:  true,
+			message:    "the workspace refused the SSH tunnel connection: FEATURE_DISABLED: An administrator has disabled port forwarding to serverless compute for this workspace",
+		},
+		{
+			name:       "forbidden with a body that is not a JSON string",
+			statusCode: 403,
+			body:       "Forbidden\n",
+			forbidden:  true,
+			message:    "the workspace refused the SSH tunnel connection: Forbidden",
+		},
+		{
+			name:       "forbidden with an empty body",
+			statusCode: 403,
+			body:       "",
+			forbidden:  true,
+			message:    "the workspace refused the SSH tunnel connection: status code 403",
+		},
+		{
+			// A stale metadata.json points at a terminated cluster; the caller must start a new server.
+			name:       "terminated cluster is retried",
+			statusCode: 400,
+			body:       `"INVALID_STATE: Cluster 1014-135824-abcdefgh-v2n is in Terminated state but Spark driver is not healthy"`,
+			forbidden:  false,
+			message:    "server metadata error\nserver is not ok, status code 400",
+		},
+		{
+			name:       "server still starting is retried",
+			statusCode: 502,
+			body:       "",
+			forbidden:  false,
+			message:    "server metadata error\nserver is not ok, status code 502",
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			err := metadataResponseError(tc.statusCode, []byte(tc.body))
+			assert.Equal(t, tc.forbidden, errors.Is(err, errDriverProxyForbidden))
+			assert.Equal(t, !tc.forbidden, errors.Is(err, errServerMetadata))
+			assert.EqualError(t, err, tc.message)
+		})
+	}
+}
+
+func TestCheckPortForwardingToServerless(t *testing.T) {
+	tests := []struct {
+		name    string
+		status  int
+		body    string
+		wantErr error
+	}{
+		{
+			name:    "disabled",
+			status:  http.StatusOK,
+			body:    `{"effective_boolean_val": {"value": false}}`,
+			wantErr: errPortForwardingDisabled,
+		},
+		{
+			name:   "enabled",
+			status: http.StatusOK,
+			body:   `{"effective_boolean_val": {"value": true}}`,
+		},
+		{
+			name:   "no effective value",
+			status: http.StatusOK,
+			body:   `{}`,
+		},
+		{
+			// Production does not serve the setting through the public API yet.
+			name:   "read fails",
+			status: http.StatusBadRequest,
+			body:   `{"error_code": "INVALID_PARAMETER_VALUE", "message": "Setting port_fwd_serverless_enabled is not enabled for public API"}`,
+		},
+		{
+			// A retriable status is not retried, so a throttled service cannot hold up the connection.
+			name:   "throttled",
+			status: http.StatusTooManyRequests,
+			body:   `{"error_code": "TOO_MANY_REQUESTS", "message": "slow down"}`,
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			var reads atomic.Int32
+			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if r.URL.Path != "/api/2.1/settings/"+portFwdServerlessSetting {
+					w.WriteHeader(http.StatusNotFound)
+					return
+				}
+				reads.Add(1)
+				w.WriteHeader(tc.status)
+				_, _ = w.Write([]byte(tc.body))
+			}))
+			defer srv.Close()
+
+			ctx := cmdio.MockDiscard(t.Context())
+			assert.Equal(t, tc.wantErr, checkPortForwardingToServerless(ctx, newProbeClient(t, srv.URL)))
+			assert.Equal(t, int32(1), reads.Load())
+		})
+	}
+}
diff --git a/experimental/ssh/internal/client/client_test.go b/experimental/ssh/internal/client/client_test.go
index ef9e6fb53b7..8363d2e5d0b 100644
--- a/experimental/ssh/internal/client/client_test.go
+++ b/experimental/ssh/internal/client/client_test.go
@@ -94,6 +94,116 @@ func TestValidate(t *testing.T) {
 			name: "valid environment version",
 			opts: client.ClientOptions{ClusterID: "abc-123", EnvironmentVersion: 4},
 		},
+		{
+			name:    "base environment with environment version",
+			opts:    client.ClientOptions{ConnectionName: "my-conn", BaseEnvironment: "my-env", EnvironmentVersion: 4},
+			wantErr: "--base-environment cannot be used together with --environment-version",
+		},
+		{
+			name:    "base environment with cluster",
+			opts:    client.ClientOptions{ClusterID: "abc-123", BaseEnvironment: "my-env"},
+			wantErr: "--base-environment can only be used with serverless compute",
+		},
+		{
+			name: "valid base environment with connection name",
+			opts: client.ClientOptions{ConnectionName: "my-conn", BaseEnvironment: "/Workspace/path/to/env.yaml"},
+		},
+		{
+			name: "base environment with serverless GPU accelerator",
+			opts: client.ClientOptions{ConnectionName: "my-conn", Accelerator: "GPU_1xA10", BaseEnvironment: "my-gpu-env"},
+		},
+		{
+			name:    "usage policy with cluster ID",
+			opts:    client.ClientOptions{ClusterID: "abc-123", UsagePolicyID: "pol-1"},
+			wantErr: "--usage-policy-id flag can only be used with serverless compute (--name flag)",
+		},
+		{
+			name: "usage policy with connection name",
+			opts: client.ClientOptions{ConnectionName: "my-conn", UsagePolicyID: "pol-1"},
+		},
+		{
+			name: "keep detached processes with serverless",
+			opts: client.ClientOptions{ConnectionName: "my-conn", KeepDetachedProcesses: true},
+		},
+		{
+			name: "keep detached processes with cluster ID",
+			opts: client.ClientOptions{ClusterID: "abc-123", KeepDetachedProcesses: true},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			opts := tt.opts
+			// Validate range-checks MaxClients and ServerTimeout, which the commands always
+			// supply from a flag default. Set them for every case here so the cases above,
+			// which are about unrelated fields, aren't rejected by those checks;
+			// TestValidateServerLifecycle covers them directly.
+			opts.MaxClients = 10
+			opts.ServerTimeout = 24 * time.Hour
+			err := opts.Validate()
+			if tt.wantErr == "" {
+				assert.NoError(t, err)
+			} else {
+				assert.EqualError(t, err, tt.wantErr)
+			}
+		})
+	}
+}
+
+func TestValidateServerLifecycle(t *testing.T) {
+	tests := []struct {
+		name    string
+		opts    client.ClientOptions
+		wantErr string
+	}{
+		{
+			name: "defaults",
+			opts: client.ClientOptions{ClusterID: "abc-123", MaxClients: 10, ShutdownDelay: 10 * time.Minute, ServerTimeout: 24 * time.Hour},
+		},
+		{
+			name: "single client slot",
+			opts: client.ClientOptions{ClusterID: "abc-123", MaxClients: 1, ServerTimeout: time.Hour},
+		},
+		{
+			name:    "zero max clients",
+			opts:    client.ClientOptions{ClusterID: "abc-123", MaxClients: 0, ServerTimeout: time.Hour},
+			wantErr: "--max-clients must be at least 1, got 0",
+		},
+		{
+			name:    "negative max clients",
+			opts:    client.ClientOptions{ClusterID: "abc-123", MaxClients: -1, ServerTimeout: time.Hour},
+			wantErr: "--max-clients must be at least 1, got -1",
+		},
+		{
+			name:    "zero server timeout",
+			opts:    client.ClientOptions{ClusterID: "abc-123", MaxClients: 10},
+			wantErr: "--server-timeout must be at least 1s, got 0s",
+		},
+		{
+			name:    "negative server timeout",
+			opts:    client.ClientOptions{ClusterID: "abc-123", MaxClients: 10, ServerTimeout: -time.Minute},
+			wantErr: "--server-timeout must be at least 1s, got -1m0s",
+		},
+		{
+			// Anything under a second truncates to timeout_seconds: 0, which the Jobs API reads
+			// as "no timeout" - the opposite of the short lifetime this asks for.
+			name:    "sub-second server timeout",
+			opts:    client.ClientOptions{ClusterID: "abc-123", MaxClients: 10, ServerTimeout: 999 * time.Millisecond},
+			wantErr: "--server-timeout must be at least 1s, got 999ms",
+		},
+		{
+			name: "one second server timeout",
+			opts: client.ClientOptions{ClusterID: "abc-123", MaxClients: 10, ServerTimeout: time.Second},
+		},
+		{
+			name:    "shutdown delay longer than server timeout",
+			opts:    client.ClientOptions{ClusterID: "abc-123", MaxClients: 10, ShutdownDelay: 48 * time.Hour, ServerTimeout: 24 * time.Hour},
+			wantErr: "--shutdown-delay (48h0m0s) cannot be longer than --server-timeout (24h0m0s)",
+		},
+		{
+			name: "shutdown delay equal to server timeout",
+			opts: client.ClientOptions{ClusterID: "abc-123", MaxClients: 10, ShutdownDelay: time.Hour, ServerTimeout: time.Hour},
+		},
 	}
 
 	for _, tt := range tests {
@@ -146,10 +256,23 @@ func TestGenerateDefaultConnectionName(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			got := client.GenerateDefaultConnectionName(tt.host, tt.accelerator)
+			got := client.GenerateDefaultConnectionName(tt.host, tt.accelerator, "")
 			assert.Equal(t, tt.want, got)
 		})
 	}
+
+	// A serverless server bakes in its base environment, so distinct environments
+	// must map to distinct default names (otherwise --base-environment is silently
+	// ignored when an existing server for the default name is reused).
+	t.Run("base environment differentiates the name", func(t *testing.T) {
+		const host = "https://my-workspace.cloud.databricks.com"
+		base := client.GenerateDefaultConnectionName(host, "", "")
+		withEnv := client.GenerateDefaultConnectionName(host, "", "my-env")
+		otherEnv := client.GenerateDefaultConnectionName(host, "", "other-env")
+		assert.NotEqual(t, base, withEnv, "setting --base-environment must change the default name")
+		assert.NotEqual(t, withEnv, otherEnv, "different environments must produce different names")
+		assert.Equal(t, withEnv, client.GenerateDefaultConnectionName(host, "", "my-env"), "must be deterministic")
+	})
 }
 
 func TestGenerateDefaultConnectionNameMatchesRegex(t *testing.T) {
@@ -159,12 +282,15 @@ func TestGenerateDefaultConnectionNameMatchesRegex(t *testing.T) {
 		"https://workspace3.gcp.databricks.com",
 	}
 	accelerators := []string{"", "GPU_1xA10", "GPU_8xH100"}
+	environments := []string{"", "my-env", "/Workspace/Users/me@example.com/env.yaml"}
 	nameRegex := regexp.MustCompile(`^[a-zA-Z0-9][a-zA-Z0-9_-]*$`)
 
 	for _, host := range hosts {
 		for _, acc := range accelerators {
-			name := client.GenerateDefaultConnectionName(host, acc)
-			assert.Regexp(t, nameRegex, name, "host=%q accelerator=%q name=%q", host, acc, name)
+			for _, env := range environments {
+				name := client.GenerateDefaultConnectionName(host, acc, env)
+				assert.Regexp(t, nameRegex, name, "host=%q accelerator=%q environment=%q name=%q", host, acc, env, name)
+			}
 		}
 	}
 }
@@ -199,6 +325,35 @@ func TestToProxyCommand(t *testing.T) {
 			opts: client.ClientOptions{ConnectionName: "my-conn", Accelerator: "GPU_1xA10", ShutdownDelay: 2 * time.Minute},
 			want: quoted + " ssh connect --proxy --name=my-conn --shutdown-delay=2m0s --accelerator=GPU_1xA10",
 		},
+		{
+			name: "serverless with usage policy",
+			opts: client.ClientOptions{ConnectionName: "my-conn", UsagePolicyID: "pol-1", ShutdownDelay: 2 * time.Minute},
+			want: quoted + " ssh connect --proxy --name=my-conn --shutdown-delay=2m0s --usage-policy-id=pol-1",
+		},
+		{
+			// Both are fixed at server submission, so a host configured by `ssh setup` can only
+			// carry them through the ProxyCommand.
+			name: "with server lifecycle flags",
+			opts: client.ClientOptions{ClusterID: "abc-123", ShutdownDelay: 5 * time.Minute, MaxClients: 25, ServerTimeout: 48 * time.Hour},
+			want: quoted + " ssh connect --proxy --cluster=abc-123 --auto-start-cluster=false --shutdown-delay=5m0s --max-clients=25 --server-timeout=48h0m0s",
+		},
+		{
+			name: "serverless with server lifecycle flags",
+			opts: client.ClientOptions{ConnectionName: "my-conn", ShutdownDelay: 2 * time.Minute, MaxClients: 25, ServerTimeout: 48 * time.Hour},
+			want: quoted + " ssh connect --proxy --name=my-conn --shutdown-delay=2m0s --max-clients=25 --server-timeout=48h0m0s",
+		},
+		{
+			// Carried into the ProxyCommand so a reconnect through ssh asks for the same
+			// mode, instead of starting a server that would sweep the detached work.
+			name: "dedicated cluster keeping detached processes",
+			opts: client.ClientOptions{ClusterID: "abc-123", KeepDetachedProcesses: true, ShutdownDelay: 5 * time.Minute},
+			want: quoted + " ssh connect --proxy --cluster=abc-123 --auto-start-cluster=false --shutdown-delay=5m0s --keep-detached-processes",
+		},
+		{
+			name: "serverless keeping detached processes",
+			opts: client.ClientOptions{ConnectionName: "my-conn", KeepDetachedProcesses: true, ShutdownDelay: 5 * time.Minute},
+			want: quoted + " ssh connect --proxy --name=my-conn --shutdown-delay=5m0s --keep-detached-processes",
+		},
 		{
 			name: "with metadata",
 			opts: client.ClientOptions{ClusterID: "abc-123", ServerMetadata: "user,2222,abc-123"},
@@ -224,6 +379,19 @@ func TestToProxyCommand(t *testing.T) {
 			opts: client.ClientOptions{ClusterID: "abc-123", EnvironmentVersion: 4},
 			want: quoted + " ssh connect --proxy --cluster=abc-123 --auto-start-cluster=false --shutdown-delay=0s --environment-version=4",
 		},
+		{
+			name: "serverless with base environment",
+			opts: client.ClientOptions{ConnectionName: "my-conn", BaseEnvironment: "my env", ShutdownDelay: 2 * time.Minute},
+			want: quoted + ` ssh connect --proxy --name=my-conn --shutdown-delay=2m0s --base-environment='my env'`,
+		},
+		{
+			// The proxy command is executed via the shell, so a base environment
+			// containing shell metacharacters must be single-quoted (and embedded
+			// single quotes escaped) so nothing is expanded or word-split.
+			name: "serverless with base environment containing shell metacharacters",
+			opts: client.ClientOptions{ConnectionName: "my-conn", BaseEnvironment: `$(touch pwned) '; rm -rf /`, ShutdownDelay: 2 * time.Minute},
+			want: quoted + ` ssh connect --proxy --name=my-conn --shutdown-delay=2m0s --base-environment='$(touch pwned) '\''; rm -rf /'`,
+		},
 	}
 
 	for _, tt := range tests {
diff --git a/experimental/ssh/internal/client/exec_unix.go b/experimental/ssh/internal/client/exec_unix.go
new file mode 100644
index 00000000000..8c024b980bf
--- /dev/null
+++ b/experimental/ssh/internal/client/exec_unix.go
@@ -0,0 +1,11 @@
+//go:build !windows
+
+package client
+
+import "syscall"
+
+// execProcess replaces the current process (execve(2)) so the ssh PTY connects
+// straight to the agent and its exit code propagates.
+func execProcess(argv0 string, argv, env []string) error {
+	return syscall.Exec(argv0, argv, env)
+}
diff --git a/experimental/ssh/internal/client/exec_windows.go b/experimental/ssh/internal/client/exec_windows.go
new file mode 100644
index 00000000000..3cfc5b2e1ed
--- /dev/null
+++ b/experimental/ssh/internal/client/exec_windows.go
@@ -0,0 +1,10 @@
+//go:build windows
+
+package client
+
+import "errors"
+
+// execProcess is unsupported on Windows (no syscall.Exec); the shim only runs on the Linux driver.
+func execProcess(argv0 string, argv, env []string) error {
+	return errors.New("process exec is not supported on Windows")
+}
diff --git a/experimental/ssh/internal/client/policy_internal_test.go b/experimental/ssh/internal/client/policy_internal_test.go
new file mode 100644
index 00000000000..dde22f46187
--- /dev/null
+++ b/experimental/ssh/internal/client/policy_internal_test.go
@@ -0,0 +1,48 @@
+package client
+
+import "testing"
+
+func TestUsagePolicyMatches(t *testing.T) {
+	tests := []struct {
+		name      string
+		stored    string
+		requested string
+		want      bool
+	}{
+		{name: "empty request matches any server", stored: "pol-1", requested: "", want: true},
+		{name: "empty request matches server without policy", stored: "", requested: "", want: true},
+		{name: "equal policies match", stored: "pol-1", requested: "pol-1", want: true},
+		{name: "different policies do not match", stored: "pol-1", requested: "pol-2", want: false},
+		{name: "request against server without policy does not match", stored: "", requested: "pol-1", want: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := usagePolicyMatches(tt.stored, tt.requested); got != tt.want {
+				t.Errorf("usagePolicyMatches(%q, %q) = %v, want %v", tt.stored, tt.requested, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestKeepDetachedMatches(t *testing.T) {
+	tests := []struct {
+		name      string
+		stored    bool
+		requested bool
+		want      bool
+	}{
+		{name: "no request takes a server that holds the run open", stored: true, requested: false, want: true},
+		{name: "no request takes a server that does not", stored: false, requested: false, want: true},
+		{name: "request matches a server that holds the run open", stored: true, requested: true, want: true},
+		{name: "request against a server that does not does not match", stored: false, requested: true, want: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := keepDetachedMatches(tt.stored, tt.requested); got != tt.want {
+				t.Errorf("keepDetachedMatches(%v, %v) = %v, want %v", tt.stored, tt.requested, got, tt.want)
+			}
+		})
+	}
+}
diff --git a/experimental/ssh/internal/client/progress.go b/experimental/ssh/internal/client/progress.go
new file mode 100644
index 00000000000..649b4f56360
--- /dev/null
+++ b/experimental/ssh/internal/client/progress.go
@@ -0,0 +1,40 @@
+package client
+
+import (
+	"bytes"
+	"context"
+	"io"
+
+	"github.com/databricks/cli/libs/cmdio"
+)
+
+// runStep shows a cmdio spinner labelled desc while fn runs, giving fn a writer
+// that captures the step's subprocess output. On success it leaves a checkmark
+// line; on failure it prints the captured output (stdout+stderr, in order) before
+// returning fn's error. The shared spinner shows elapsed time and degrades to no
+// output in a non-interactive terminal, so the checkmark line is what the reader
+// sees either way.
+func runStep(ctx context.Context, desc string, fn func(out io.Writer) error) error {
+	sp := cmdio.NewSpinner(ctx, cmdio.WithElapsedTime())
+	// Close is idempotent; defer it so a panic in fn can't leave the spinner (and
+	// its tea-program slot) running, while the explicit Close below still controls
+	// output ordering on the normal path.
+	defer sp.Close()
+	sp.Update(desc)
+
+	var buf bytes.Buffer
+	err := fn(&buf)
+	// Stop the spinner (clearing its line) before printing the step's outcome.
+	sp.Close()
+
+	if err != nil {
+		cmdio.LogProgress(ctx, cmdio.Red(ctx, "✗ "+desc))
+		if out := buf.String(); out != "" {
+			cmdio.LogString(ctx, out)
+		}
+		return err
+	}
+
+	cmdio.LogProgress(ctx, cmdio.Green(ctx, "✓ "+desc))
+	return nil
+}
diff --git a/experimental/ssh/internal/client/progress_test.go b/experimental/ssh/internal/client/progress_test.go
new file mode 100644
index 00000000000..266e72fcbe7
--- /dev/null
+++ b/experimental/ssh/internal/client/progress_test.go
@@ -0,0 +1,46 @@
+package client
+
+import (
+	"bytes"
+	"errors"
+	"io"
+	"strings"
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestRunStepHidesOutputOnSuccess(t *testing.T) {
+	var w bytes.Buffer
+	mockCmdio := cmdio.NewIO(t.Context(), "text", io.NopCloser(strings.NewReader("")), &w, &w, "", "")
+
+	err := runStep(cmdio.InContext(t.Context(), mockCmdio), "Installing dependencies", func(out io.Writer) error {
+		_, _ = io.WriteString(out, "verbose installer chatter\n")
+		return nil
+	})
+	require.NoError(t, err)
+
+	// The step's subprocess output must not surface on success, but the checkmark
+	// line for the step is still emitted.
+	assert.NotContains(t, w.String(), "verbose installer chatter")
+	assert.Contains(t, w.String(), "✓ Installing dependencies")
+}
+
+func TestRunStepShowsOutputOnFailure(t *testing.T) {
+	var w bytes.Buffer
+	mockCmdio := cmdio.NewIO(t.Context(), "text", io.NopCloser(strings.NewReader("")), &w, &w, "", "")
+
+	sentinel := errors.New("install failed")
+	err := runStep(cmdio.InContext(t.Context(), mockCmdio), "Installing ucode", func(out io.Writer) error {
+		_, _ = io.WriteString(out, "line to stdout\nline to stderr")
+		return sentinel
+	})
+	require.ErrorIs(t, err, sentinel)
+
+	// On failure the cross line and the full captured output are printed, with a
+	// trailing newline added.
+	assert.Contains(t, w.String(), "✗ Installing ucode")
+	assert.Contains(t, w.String(), "line to stdout\nline to stderr\n")
+}
diff --git a/experimental/ssh/internal/client/releases.go b/experimental/ssh/internal/client/releases.go
index 6c6ad800aa2..def34ce363c 100644
--- a/experimental/ssh/internal/client/releases.go
+++ b/experimental/ssh/internal/client/releases.go
@@ -2,19 +2,27 @@ package client
 
 import (
 	"context"
+	"crypto/tls"
 	"errors"
 	"fmt"
 	"io"
 	"io/fs"
+	"net"
 	"net/http"
 	"os"
 	"path/filepath"
 	"strings"
+	"syscall"
+	"time"
 
 	"github.com/databricks/cli/experimental/ssh/internal/workspace"
+	"github.com/databricks/cli/internal/build"
 	"github.com/databricks/cli/libs/filer"
 	"github.com/databricks/cli/libs/log"
 	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/config"
+	"golang.org/x/net/http2"
 )
 
 type releaseProvider func(ctx context.Context, architecture, version, releasesDir string) (io.ReadCloser, error)
@@ -25,7 +33,15 @@ func UploadTunnelReleases(ctx context.Context, client *databricks.WorkspaceClien
 		return fmt.Errorf("failed to get versioned directory: %w", err)
 	}
 
-	workspaceFiler, err := filer.NewWorkspaceFilesClient(client, versionedDir)
+	// Upload the CLI bundle over HTTP/1.1. It is a single ~14 MB POST, so HTTP/2
+	// buys us nothing, and some corporate proxies reset large HTTP/2 request bodies
+	// with RST_STREAM(NO_ERROR), which aborts the upload. Forcing HTTP/1.1 only for
+	// this client keeps the rest of the connect flow on HTTP/2.
+	uploadClient, err := newHTTP11WorkspaceClient(client.Config)
+	if err != nil {
+		return fmt.Errorf("failed to create upload client: %w", err)
+	}
+	workspaceFiler, err := filer.NewWorkspaceFilesClient(uploadClient, versionedDir)
 	if err != nil {
 		return fmt.Errorf("failed to create workspace files client: %w", err)
 	}
@@ -37,6 +53,53 @@ func UploadTunnelReleases(ctx context.Context, client *databricks.WorkspaceClien
 	return uploadReleases(ctx, workspaceFiler, getRelease, version, releasesDir)
 }
 
+// newHTTP11WorkspaceClient returns a workspace client that is identical to one
+// built from src but negotiates HTTP/1.1 only, by setting an HTTP/1.1 transport
+// on its config. config.Config embeds a sync.Mutex and cannot be copied by value,
+// so we reconstruct a fresh config from src's public attributes rather than clone
+// the struct; the client then re-resolves auth from those attributes.
+func newHTTP11WorkspaceClient(src *config.Config) (*databricks.WorkspaceClient, error) {
+	cfg := &config.Config{}
+	for _, attr := range config.ConfigAttributes {
+		if attr.IsZero(src) {
+			continue
+		}
+		if err := attr.SetS(cfg, attr.GetString(src)); err != nil {
+			return nil, fmt.Errorf("failed to copy config attribute %s: %w", attr.Name, err)
+		}
+	}
+	cfg.HTTPTransport = newHTTP11Transport(src)
+	return databricks.NewWorkspaceClient((*databricks.Config)(cfg))
+}
+
+// newHTTP11Transport builds a fresh HTTP/1.1-only transport, mirroring the SDK's
+// default transport tuning (see httpclient.makeDefaultTransport) but with HTTP/2
+// left off. It must construct a fresh transport rather than clone one and disable
+// HTTP/2 afterwards: cloning an HTTP/2-capable transport and then clearing
+// ForceAttemptHTTP2 / TLSNextProto leaves the clone in an inconsistent state that
+// fails every request with a bare EOF. A transport built HTTP/1.1-only from the
+// start negotiates http/1.1 cleanly. See https://pkg.go.dev/net/http#Transport
+func newHTTP11Transport(src *config.Config) *http.Transport {
+	t := &http.Transport{
+		Proxy: http.ProxyFromEnvironment,
+		DialContext: (&net.Dialer{
+			Timeout:   30 * time.Second,
+			KeepAlive: 30 * time.Second,
+		}).DialContext,
+		MaxIdleConns:          100,
+		IdleConnTimeout:       180 * time.Second,
+		TLSHandshakeTimeout:   30 * time.Second,
+		ExpectContinueTimeout: 1 * time.Second,
+		// ForceAttemptHTTP2 is intentionally left false, and a non-nil, empty
+		// TLSNextProto disables the transport's automatic HTTP/2 support.
+		TLSNextProto: map[string]func(string, *tls.Conn) http.RoundTripper{},
+	}
+	if src.InsecureSkipVerify {
+		t.TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
+	}
+	return t
+}
+
 func uploadReleases(ctx context.Context, workspaceFiler filer.Filer, getRelease releaseProvider, version, releasesDir string) error {
 	architectures := []string{"amd64", "arm64"}
 
@@ -46,12 +109,21 @@ func uploadReleases(ctx context.Context, workspaceFiler filer.Filer, getRelease
 		remoteBinaryPath := filepath.ToSlash(filepath.Join(remoteSubFolder, "databricks"))
 		remoteArchivePath := filepath.ToSlash(filepath.Join(remoteSubFolder, "databricks.zip"))
 
-		_, err := workspaceFiler.Stat(ctx, remoteBinaryPath)
-		if err == nil {
-			log.Infof(ctx, "File %s already exists in the workspace, skipping upload", remoteBinaryPath)
-			continue
-		} else if !errors.Is(err, fs.ErrNotExist) {
-			return fmt.Errorf("failed to check if file %s exists in workspace: %w", remoteBinaryPath, err)
+		if build.IsDevelopmentVersion(version) {
+			log.Infof(ctx, "Development version %s, overwriting %s in the workspace", version, remoteBinaryPath)
+		} else {
+			_, err := workspaceFiler.Stat(ctx, remoteBinaryPath)
+			if err == nil {
+				log.Infof(ctx, "File %s already exists in the workspace, skipping upload", remoteBinaryPath)
+				continue
+			} else if !errors.Is(err, fs.ErrNotExist) {
+				return fmt.Errorf("failed to check if file %s exists in workspace: %w", remoteBinaryPath, err)
+			}
+		}
+
+		err := workspaceFiler.Mkdir(ctx, remoteSubFolder)
+		if err != nil {
+			return fmt.Errorf("failed to create directory %s in workspace: %w", remoteSubFolder, err)
 		}
 
 		releaseReader, err := getRelease(ctx, arch, version, releasesDir)
@@ -65,6 +137,15 @@ func uploadReleases(ctx context.Context, workspaceFiler filer.Filer, getRelease
 		// producing the filerRoot/remoteSubFolder/*archive-contents* structure, with 'databricks' binary inside.
 		err = workspaceFiler.Write(ctx, remoteArchivePath, releaseReader, filer.OverwriteIfExists, filer.CreateParentDirectories)
 		if err != nil {
+			if isProxyUploadError(err) {
+				return fmt.Errorf("failed to upload file %s to workspace: %w\n\n"+
+					"The upload was rejected before it finished. The CLI already sends this upload over HTTP/1.1, "+
+					"so this is most likely a network intermediary (corporate egress proxy, VPN, or firewall/WAF) "+
+					"enforcing a request-body size limit on POSTs to *.cloud.databricks.com. "+
+					"Ask your network administrator to allow large uploads to that path, "+
+					"or run this command from a network without such restrictions",
+					remoteArchivePath, err)
+			}
 			return fmt.Errorf("failed to upload file %s to workspace: %w", remoteArchivePath, err)
 		}
 		log.Infof(ctx, "Successfully uploaded %s to workspace", remoteBinaryPath)
@@ -73,6 +154,28 @@ func uploadReleases(ctx context.Context, workspaceFiler filer.Filer, getRelease
 	return nil
 }
 
+// isProxyUploadError reports whether err looks like the binary upload was rejected
+// or severed by a network intermediary (corporate proxy / VPN / firewall / WAF)
+// rather than by Databricks — typically an enforced request-body size limit. Because
+// the upload runs over HTTP/1.1 (see newHTTP11Transport), the usual signatures are a
+// 413 response or a connection reset mid-body. The HTTP/2 stream-reset checks are
+// kept as a guard in case the upload ever runs over HTTP/2 again; that error reaches
+// us either as a typed http2.StreamError or, when a transport layer re-formats it,
+// as a string that still preserves the "stream error ... stream ID" shape.
+func isProxyUploadError(err error) bool {
+	if aerr, ok := errors.AsType[*apierr.APIError](err); ok {
+		return aerr.StatusCode == http.StatusRequestEntityTooLarge
+	}
+	if errors.Is(err, syscall.ECONNRESET) {
+		return true
+	}
+	if _, ok := errors.AsType[http2.StreamError](err); ok {
+		return true
+	}
+	msg := err.Error()
+	return strings.Contains(msg, "stream error") && strings.Contains(msg, "stream ID")
+}
+
 func getReleaseName(architecture, version string) string {
 	if strings.Contains(version, "dev") {
 		return fmt.Sprintf("databricks_cli_linux_%s.zip", architecture)
diff --git a/experimental/ssh/internal/client/releases_test.go b/experimental/ssh/internal/client/releases_test.go
new file mode 100644
index 00000000000..e0e2c384d9d
--- /dev/null
+++ b/experimental/ssh/internal/client/releases_test.go
@@ -0,0 +1,213 @@
+package client
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"path"
+	"strings"
+	"sync"
+	"syscall"
+	"testing"
+
+	"github.com/databricks/cli/libs/filer"
+	"github.com/databricks/cli/libs/testserver"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/config"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/net/http2"
+)
+
+func TestIsProxyUploadError(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want bool
+	}{
+		{
+			name: "413 request entity too large",
+			err:  &apierr.APIError{StatusCode: http.StatusRequestEntityTooLarge, Message: "request too large"},
+			want: true,
+		},
+		{
+			name: "connection reset mid-body",
+			err:  fmt.Errorf(`Post "https://example/...": write tcp: %w`, syscall.ECONNRESET),
+			want: true,
+		},
+		{
+			name: "typed http2.StreamError wrapped",
+			err:  fmt.Errorf(`Post "https://example/api/2.0/workspace-files/import-file/...": %w`, http2.StreamError{StreamID: 15, Code: http2.ErrCodeNo}),
+			want: true,
+		},
+		{
+			name: "stringified stream error",
+			err:  errors.New("stream error: stream ID 15; NO_ERROR; received from peer"),
+			want: true,
+		},
+		{
+			name: "non-413 API error",
+			err:  &apierr.APIError{StatusCode: http.StatusForbidden, Message: "permission denied"},
+			want: false,
+		},
+		{
+			name: "unrelated error",
+			err:  errors.New("connection refused"),
+			want: false,
+		},
+		{
+			name: "API error message",
+			err:  errors.New("RESOURCE_DOES_NOT_EXIST: path does not exist"),
+			want: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, isProxyUploadError(tt.err))
+		})
+	}
+}
+
+func TestNewHTTP11TransportDisablesHTTP2(t *testing.T) {
+	tr := newHTTP11Transport(&config.Config{})
+	assert.False(t, tr.ForceAttemptHTTP2)
+	assert.NotNil(t, tr.TLSNextProto)
+	assert.Empty(t, tr.TLSNextProto)
+}
+
+func TestNewHTTP11WorkspaceClient(t *testing.T) {
+	src := &config.Config{
+		Host:               "https://test.databricks.test",
+		Token:              "dapi-test",
+		InsecureSkipVerify: true,
+	}
+
+	w, err := newHTTP11WorkspaceClient(src)
+	require.NoError(t, err)
+
+	// Auth-relevant attributes are carried over to the reconstructed config.
+	assert.Equal(t, src.Host, w.Config.Host)
+	assert.Equal(t, src.Token, w.Config.Token)
+	assert.True(t, w.Config.InsecureSkipVerify)
+
+	// The reconstructed client forces HTTP/1.1 via its transport.
+	tr, ok := w.Config.HTTPTransport.(*http.Transport)
+	require.True(t, ok)
+	assert.False(t, tr.ForceAttemptHTTP2)
+	assert.Empty(t, tr.TLSNextProto)
+
+	// The source config is not mutated: it keeps its own (nil) transport.
+	assert.Nil(t, src.HTTPTransport)
+}
+
+func TestUploadReleasesWithExistingBinary(t *testing.T) {
+	tests := []struct {
+		name         string
+		version      string
+		wantUploaded []string
+	}{
+		{
+			name:         "release version skips the upload",
+			version:      "1.12.0",
+			wantUploaded: nil,
+		},
+		{
+			name:         "dev version overwrites the binary",
+			version:      "1.12.1-dev+abcdef123456",
+			wantUploaded: []string{"amd64", "arm64"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := t.Context()
+			workspaceFiler, err := filer.NewLocalClient(t.TempDir())
+			require.NoError(t, err)
+			for _, arch := range []string{"amd64", "arm64"} {
+				remoteBinaryPath := strings.TrimSuffix(getReleaseName(arch, tt.version), ".zip") + "/databricks"
+				err := workspaceFiler.Write(ctx, remoteBinaryPath, strings.NewReader("old"), filer.CreateParentDirectories)
+				require.NoError(t, err)
+			}
+
+			var uploaded []string
+			getRelease := func(ctx context.Context, architecture, version, releasesDir string) (io.ReadCloser, error) {
+				uploaded = append(uploaded, architecture)
+				return io.NopCloser(strings.NewReader("new")), nil
+			}
+
+			err = uploadReleases(ctx, workspaceFiler, getRelease, tt.version, "")
+			require.NoError(t, err)
+			assert.Equal(t, tt.wantUploaded, uploaded)
+		})
+	}
+}
+
+func TestUploadReleasesSendsEachArchiveOnce(t *testing.T) {
+	tests := []struct {
+		name    string
+		version string
+		uploads int
+		want    []string
+	}{
+		{
+			name:    "release version into new folders",
+			version: "1.12.0",
+			uploads: 1,
+			want: []string{
+				"databricks_cli_1.12.0_linux_amd64 200",
+				"databricks_cli_1.12.0_linux_arm64 200",
+			},
+		},
+		{
+			name:    "dev version again into existing folders",
+			version: "1.12.1-dev+abcdef123456",
+			uploads: 2,
+			want: []string{
+				"databricks_cli_linux_amd64 200",
+				"databricks_cli_linux_arm64 200",
+				"databricks_cli_linux_amd64 200",
+				"databricks_cli_linux_arm64 200",
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			server := testserver.New(t)
+			testserver.AddDefaultHandlers(server)
+			var mu sync.Mutex
+			var imports []string
+			server.ResponseCallback = func(req *testserver.Request, resp *testserver.EncodedResponse) {
+				if !strings.HasPrefix(req.URL.Path, "/api/2.0/workspace-files/import-file/") {
+					return
+				}
+				mu.Lock()
+				defer mu.Unlock()
+				imports = append(imports, fmt.Sprintf("%s %d", path.Base(path.Dir(req.URL.Path)), resp.StatusCode))
+			}
+			client, err := databricks.NewWorkspaceClient(&databricks.Config{
+				Host:  server.URL,
+				Token: "testtoken",
+			})
+			require.NoError(t, err)
+			workspaceFiler, err := filer.NewWorkspaceFilesClient(client, "/Workspace/Users/tester@databricks.test/.databricks/ssh-tunnel/"+tt.version)
+			require.NoError(t, err)
+
+			getRelease := func(ctx context.Context, architecture, version, releasesDir string) (io.ReadCloser, error) {
+				return io.NopCloser(strings.NewReader("archive")), nil
+			}
+			for range tt.uploads {
+				err = uploadReleases(t.Context(), workspaceFiler, getRelease, tt.version, "")
+				require.NoError(t, err)
+			}
+
+			mu.Lock()
+			defer mu.Unlock()
+			assert.Equal(t, tt.want, imports)
+		})
+	}
+}
diff --git a/experimental/ssh/internal/client/ssh-server-bootstrap.py b/experimental/ssh/internal/client/ssh-server-bootstrap.py
index 90cec89df16..7e7df25dba6 100644
--- a/experimental/ssh/internal/client/ssh-server-bootstrap.py
+++ b/experimental/ssh/internal/client/ssh-server-bootstrap.py
@@ -1,28 +1,34 @@
-from dbruntime.databricks_repl_context import get_context
-from databricks.sdk import WorkspaceClient
-import os
-import sys
-import subprocess
+import collections
 import ctypes
 import ctypes.util
-import signal
-import atexit
+import os
 import platform
+import signal
+import subprocess
+import sys
 import time
 
 SSH_TUNNEL_BASENAME = "databricks_cli"
 
-dbutils.widgets.text("version", "")
-dbutils.widgets.text("secretScopeName", "")
-dbutils.widgets.text("authorizedKeySecretName", "")
-dbutils.widgets.text("maxClients", "10")
-dbutils.widgets.text("shutdownDelay", "10m")
-dbutils.widgets.text("sessionId", "")
-dbutils.widgets.text("serverless", "false")
+# How often the linger loop re-checks for detached processes still holding the run open.
+LINGER_POLL_SECONDS = 15
+
+# How often the linger loop repeats its "holding the run open" line while the set of survivors
+# is unchanged. The hold ends with the work rather than at a deadline, so a line per poll would
+# flood the run log for as long as the work lives.
+LINGER_REPORT_SECONDS = 300
+
+# Exit statuses collected by the SIGCHLD subreaper handler, keyed by pid. The handler
+# can reap the server subprocess before Popen.wait() does, in which case Popen would
+# report exit code 0; this map preserves the real status.
+reaped_statuses = {}
 
 
 def cleanup():
-    subprocess.run(["pkill", "-f", SSH_TUNNEL_BASENAME], check=False)
+    # Terminate an SSH server left behind by a previous, hard-killed run. The pattern matches
+    # the server's own argv rather than the CLI binary name alone, so detached work that
+    # happens to run the CLI is not swept away with it.
+    subprocess.run(["pkill", "-f", f"{SSH_TUNNEL_BASENAME}.*ssh server --cluster="], check=False)
 
 
 def setup_subreaper():
@@ -38,6 +44,7 @@ def sigchld_handler(signum, frame):
                 # -1 means any child, WNOHANG means don't block
                 pid, status = os.waitpid(-1, os.WNOHANG)
                 if pid > 0:
+                    reaped_statuses[pid] = status
                     print(f"Reaped child {pid} with status {status}")
                 elif pid == 0:
                     print("No child has changed state")
@@ -67,9 +74,94 @@ def kill_all_children():
         print(f"Error while killing child processes: {e}")
 
 
-def setup_exit_handler():
-    # Register the cleanup function to be called when the script exits
-    atexit.register(kill_all_children)
+def kill_server_group(server_pgid):
+    """Terminate the SSH server's own process group.
+
+    That group holds exactly what the tunnel started: the server and the sshd processes it
+    spawned per connection. A process that deliberately left the group - which is what tmux,
+    setsid and disown do - is not in it, so detached work survives this. Killing by parentage
+    instead (pkill -P) would sweep those too, because PR_SET_CHILD_SUBREAPER makes this
+    process adopt every orphan in the session.
+    """
+    try:
+        os.killpg(server_pgid, signal.SIGTERM)
+        print(f"Terminated SSH server process group {server_pgid}")
+    except ProcessLookupError:
+        print(f"SSH server process group {server_pgid} is already gone")
+
+
+def detached_descendants(server_pgid):
+    """Adopted children of this process that are outside the SSH server's process group.
+
+    PR_SET_CHILD_SUBREAPER makes every orphan in the session reparent to this process, so
+    work that detached itself - tmux, setsid, disown, a plain background command - resurfaces
+    here as a direct child. The server's own sshd children stay in its group and are excluded.
+
+    Reads /proc directly, mirroring detachedDescendants in internal/server/descendants.go.
+    Asking ps for this process's children cannot work: ps is one of them, and subprocess.run
+    leaves it in this process's group, so it matches its own query on every poll and the
+    survivor list is never empty.
+    """
+    self_pid = os.getpid()
+    survivors = []
+    for entry in os.listdir("/proc"):
+        if not entry.isdigit():
+            continue
+        try:
+            with open(f"/proc/{entry}/stat") as stat_file:
+                # Split on the last ')' rather than from the left: the comm field before it
+                # can contain both spaces and parentheses. state, ppid and pgrp follow it.
+                state, ppid, pgrp = stat_file.read().rsplit(")", 1)[1].split()[:3]
+        except OSError:
+            # The process exited while we were walking /proc.
+            continue
+        if ppid != str(self_pid) or pgrp == str(server_pgid):
+            continue
+        # Zombies are already dead; the SIGCHLD handler collects them.
+        if state.startswith("Z"):
+            continue
+        survivors.append(entry)
+    return sorted(survivors, key=int)
+
+
+def has_children():
+    """Probe without reaping; WNOHANG returning None still means children exist."""
+    try:
+        os.waitid(os.P_ALL, 0, os.WEXITED | os.WNOHANG | os.WNOWAIT)
+    except ChildProcessError:
+        return False
+    return True
+
+
+def wait_for_detached_descendants(server_pgid):
+    """Hold the notebook open while detached work is still running.
+
+    WSFS authorises an I/O by walking the live process tree for a registered ancestor, and
+    this process is the registered one. Returning while detached work is still alive would
+    reparent it to PID 1, outside the registered subtree, and silently strip its /Workspace
+    and /Volumes access - trading a visible failure for an invisible one. Holding the run
+    open instead keeps the cluster from auto-terminating, which is why it is opt-in.
+
+    The work decides how long this takes. The only bound is the run's own timeout
+    (--server-timeout), which Jobs enforces and the client requires to be set, so this loop
+    cannot hold a cluster indefinitely.
+    """
+    reported = None
+    reported_at = 0.0
+    while True:
+        survivors = detached_descendants(server_pgid)
+        if not survivors and not has_children():
+            print("No detached processes left, releasing the run", flush=True)
+            return
+        now = time.monotonic()
+        if survivors != reported or now - reported_at >= LINGER_REPORT_SECONDS:
+            print(
+                f"Holding the run open for {len(survivors)} detached process(es): {','.join(survivors)}",
+                flush=True,
+            )
+            reported = survivors
+            reported_at = now
+        time.sleep(LINGER_POLL_SECONDS)
 
 
 def run_ssh_server():
@@ -78,7 +170,7 @@ def run_ssh_server():
     # Old DBRs require explicit WorkspaceClient arguments
     try:
         client = WorkspaceClient()
-    except Exception as e:
+    except Exception:
         client = WorkspaceClient(
             host=ctx.workspaceUrl or spark.conf.get("spark.databricks.workspaceUrl"), token=ctx.apiToken
         )
@@ -118,6 +210,16 @@ def run_ssh_server():
     if not session_id:
         raise RuntimeError("Session ID is required. Please provide it using the 'sessionId' widget.")
     serverless = dbutils.widgets.get("serverless")
+    usage_policy_id = dbutils.widgets.get("usagePolicyId")
+    keep_detached_processes = dbutils.widgets.get("keepDetachedProcesses") == "true"
+
+    # Mark this process's WSFS command origin so workspace-file activity from the
+    # remote SSH session is attributable
+    try:
+        with open("/Workspace/.proc/self/metadata/command_origin", "w") as command_origin_file:
+            command_origin_file.write("RemoteSshServer")
+    except OSError as e:
+        print(f"Could not set WSFS command origin: {e}")
 
     arch = platform.machine()
     if arch == "x86_64":
@@ -156,14 +258,76 @@ def run_ssh_server():
         "--log-file=stdout",
     ]
 
+    # Recorded in the server's metadata.json so reconnects can match the usage policy.
+    if usage_policy_id:
+        server_args.append(f"--usage-policy-id={usage_policy_id}")
+
+    # The server uses this to defer idle shutdown while detached work is running.
+    if keep_detached_processes:
+        server_args.append("--keep-detached-processes")
+
+    # Tee the server output instead of inheriting stdout: the run-page logs remain the only
+    # place to debug a RUNNING server, but on failure we attach the log tail to the exception
+    # so "ssh connect" can print it (the Jobs run-output API has no stdout logs for notebook tasks).
+    tail = collections.deque(maxlen=100)
+    proc = subprocess.Popen(
+        server_args,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.STDOUT,
+        text=True,
+        errors="replace",
+        # Make the server a session and process group leader, so teardown can target exactly
+        # the processes the tunnel started. See kill_server_group.
+        start_new_session=True,
+    )
+    # The server leads the new group, so the group id is its pid. Recorded here because the
+    # pid may already have been reaped by the time we tear the group down.
+    server_pgid = proc.pid
     try:
-        subprocess.run(server_args, check=True)
+        for line in proc.stdout:
+            # flush so the run-page logs stay live while the server is running
+            print(line, end="", flush=True)
+            tail.append(line)
+        returncode = proc.wait()
+        # The SIGCHLD subreaper handler may have collected the server first; Popen reports that as 0.
+        if proc.pid in reaped_statuses:
+            returncode = os.waitstatus_to_exitcode(reaped_statuses[proc.pid])
+        if returncode == -signal.SIGTERM:
+            # A newer session's bootstrap terminates a server already running on this cluster
+            # (see cleanup), which a reconnect asking for --keep-detached-processes against a
+            # server without it now reaches on a normal path. That is a handover, not a failure
+            # of this run, so it must not mark the run FAILED - the hold below still runs.
+            print("SSH server was terminated, most likely by a newer session on this cluster", flush=True)
+        elif returncode != 0:
+            # The tail size matches maxRunFailureTraceBytes, the cap the client prints to the terminal.
+            raise RuntimeError(f"SSH server exited with code {returncode}. Last server logs:\n" + "".join(tail)[-2000:])
     finally:
-        kill_all_children()
+        # Always reap the server and the sshd children it spawned; they are the only things
+        # in its process group. What happens to work that left that group depends on the mode:
+        # keep it and hold the run open as its WSFS anchor, or sweep it as we always have.
+        # Narrowing the sweep without holding the run open would leave survivors alive but cut
+        # off from /Workspace, which is a worse failure than the one it fixes.
+        kill_server_group(server_pgid)
+        if keep_detached_processes:
+            wait_for_detached_descendants(server_pgid)
+        else:
+            kill_all_children()
 
 
 if __name__ == "__main__":
+    from databricks.sdk import WorkspaceClient
+    from dbruntime.databricks_repl_context import get_context
+
+    dbutils.widgets.text("version", "")
+    dbutils.widgets.text("secretScopeName", "")
+    dbutils.widgets.text("authorizedKeySecretName", "")
+    dbutils.widgets.text("maxClients", "10")
+    dbutils.widgets.text("shutdownDelay", "10m")
+    dbutils.widgets.text("sessionId", "")
+    dbutils.widgets.text("serverless", "false")
+    dbutils.widgets.text("usagePolicyId", "")
+    dbutils.widgets.text("keepDetachedProcesses", "false")
+
     cleanup()
     setup_subreaper()
-    setup_exit_handler()
     run_ssh_server()
diff --git a/experimental/ssh/internal/client/ssh_server_bootstrap_test.go b/experimental/ssh/internal/client/ssh_server_bootstrap_test.go
new file mode 100644
index 00000000000..fe29b12aff2
--- /dev/null
+++ b/experimental/ssh/internal/client/ssh_server_bootstrap_test.go
@@ -0,0 +1,17 @@
+package client_test
+
+import (
+	"os/exec"
+	"testing"
+
+	"github.com/databricks/cli/libs/python"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSSHServerBootstrap(test *testing.T) {
+	test.Parallel()
+
+	cmd := exec.CommandContext(test.Context(), python.GetExecutable(), "testdata/ssh_server_bootstrap_test.py")
+	output, err := cmd.CombinedOutput()
+	require.NoError(test, err, "%s", output)
+}
diff --git a/experimental/ssh/internal/client/submit_internal_test.go b/experimental/ssh/internal/client/submit_internal_test.go
new file mode 100644
index 00000000000..d4247cbc2e1
--- /dev/null
+++ b/experimental/ssh/internal/client/submit_internal_test.go
@@ -0,0 +1,135 @@
+package client
+
+import (
+	"testing"
+	"time"
+
+	"github.com/databricks/databricks-sdk-go/service/compute"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestBuildSSHServerSubmitRun(t *testing.T) {
+	const notebookPath = "/Workspace/Users/me/.databricks/ssh-tunnel/v1/conn/ssh-server-bootstrap"
+
+	t.Run("serverless with usage policy", func(t *testing.T) {
+		opts := ClientOptions{
+			ConnectionName:     "conn",
+			UsagePolicyID:      "pol-1",
+			ServerTimeout:      time.Hour,
+			EnvironmentVersion: 4,
+		}
+		got := buildSSHServerSubmitRun("v1", "scope", notebookPath, "", opts)
+
+		// Usage policy flows onto the run and into the base params the server reads.
+		assert.Equal(t, "pol-1", got.BudgetPolicyId)
+		assert.Equal(t, "pol-1", got.Tasks[0].NotebookTask.BaseParameters["usagePolicyId"])
+		assert.Equal(t, "true", got.Tasks[0].NotebookTask.BaseParameters["serverless"])
+
+		// Serverless runs on an environment, not an existing cluster.
+		assert.Equal(t, serverlessEnvironmentKey, got.Tasks[0].EnvironmentKey)
+		assert.Empty(t, got.Tasks[0].ExistingClusterId)
+		assert.Len(t, got.Environments, 1)
+		assert.Nil(t, got.Tasks[0].Compute)
+	})
+
+	t.Run("serverless with accelerator", func(t *testing.T) {
+		opts := ClientOptions{
+			ConnectionName: "conn",
+			Accelerator:    "GPU_1xA10",
+			ServerTimeout:  time.Hour,
+		}
+		got := buildSSHServerSubmitRun("v1", "scope", notebookPath, "", opts)
+
+		assert.Equal(t, compute.HardwareAcceleratorType("GPU_1xA10"), got.Tasks[0].Compute.HardwareAccelerator)
+	})
+
+	t.Run("serverless with base environment", func(t *testing.T) {
+		opts := ClientOptions{
+			ConnectionName:     "conn",
+			ServerTimeout:      time.Hour,
+			EnvironmentVersion: 4,
+			BaseEnvironment:    "my-env",
+		}
+		got := buildSSHServerSubmitRun("v1", "scope", notebookPath, "workspace-base-environments/dbe_123", opts)
+
+		// A resolved base environment carries its own version, so environment_version is not set.
+		require.Len(t, got.Environments, 1)
+		assert.Equal(t, "workspace-base-environments/dbe_123", got.Environments[0].Spec.BaseEnvironment)
+		assert.Empty(t, got.Environments[0].Spec.EnvironmentVersion)
+	})
+
+	t.Run("dedicated cluster", func(t *testing.T) {
+		opts := ClientOptions{
+			ClusterID:     "abc-123",
+			ServerTimeout: time.Hour,
+		}
+		got := buildSSHServerSubmitRun("v1", "scope", notebookPath, "", opts)
+
+		// Usage policy is serverless-only; a dedicated run carries none and targets the cluster.
+		assert.Empty(t, got.BudgetPolicyId)
+		assert.Empty(t, got.Tasks[0].NotebookTask.BaseParameters["usagePolicyId"])
+		assert.Equal(t, "abc-123", got.Tasks[0].ExistingClusterId)
+		assert.Empty(t, got.Tasks[0].EnvironmentKey)
+		assert.Empty(t, got.Environments)
+		// False is what tells the bootstrap to sweep detached work as it always has.
+		assert.Equal(t, "false", got.Tasks[0].NotebookTask.BaseParameters["keepDetachedProcesses"])
+	})
+
+	t.Run("dedicated cluster keeping detached processes", func(t *testing.T) {
+		opts := ClientOptions{
+			ClusterID:             "abc-123",
+			ServerTimeout:         24 * time.Hour,
+			KeepDetachedProcesses: true,
+		}
+		got := buildSSHServerSubmitRun("v1", "scope", notebookPath, "", opts)
+
+		assert.Equal(t, "true", got.Tasks[0].NotebookTask.BaseParameters["keepDetachedProcesses"])
+		// The hold happens inside the run, so the run's own timeout is what bounds it.
+		assert.Equal(t, int(24*time.Hour.Seconds()), got.TimeoutSeconds)
+		assert.Equal(t, int(24*time.Hour.Seconds()), got.Tasks[0].TimeoutSeconds)
+	})
+
+	t.Run("server lifecycle", func(t *testing.T) {
+		opts := ClientOptions{
+			ClusterID:     "abc-123",
+			MaxClients:    25,
+			ShutdownDelay: 15 * time.Minute,
+			ServerTimeout: 48 * time.Hour,
+		}
+		got := buildSSHServerSubmitRun("v1", "scope", notebookPath, "", opts)
+
+		// This is the only place these two take effect: the server reads maxClients from the
+		// widget at startup, and the run's timeout caps the tunnel's lifetime.
+		assert.Equal(t, "25", got.Tasks[0].NotebookTask.BaseParameters["maxClients"])
+		assert.Equal(t, "15m0s", got.Tasks[0].NotebookTask.BaseParameters["shutdownDelay"])
+		assert.Equal(t, 48*60*60, got.TimeoutSeconds)
+		assert.Equal(t, 48*60*60, got.Tasks[0].TimeoutSeconds)
+	})
+}
+
+// Validate's lower bound on --server-timeout exists only to keep timeout_seconds off 0, which the
+// Jobs API reads as "no timeout". Tie the two together: no value Validate accepts may submit an
+// unbounded run, whichever side is changed later.
+func TestServerTimeoutNeverSubmitsUnboundedRun(t *testing.T) {
+	const notebookPath = "/Workspace/Users/me/.databricks/ssh-tunnel/v1/conn/ssh-server-bootstrap"
+
+	for _, d := range []time.Duration{
+		-time.Minute,
+		0,
+		time.Nanosecond,
+		500 * time.Millisecond,
+		999 * time.Millisecond,
+		time.Second,
+		10 * time.Minute,
+		24 * time.Hour,
+	} {
+		opts := ClientOptions{ClusterID: "abc-123", MaxClients: 10, ServerTimeout: d}
+		if err := opts.Validate(); err != nil {
+			continue
+		}
+		got := buildSSHServerSubmitRun("v1", "scope", notebookPath, "", opts)
+		assert.NotZero(t, got.TimeoutSeconds, "--server-timeout=%s passed Validate but submits timeout_seconds: 0 (no timeout)", d)
+		assert.NotZero(t, got.Tasks[0].TimeoutSeconds, "--server-timeout=%s passed Validate but submits a task with timeout_seconds: 0", d)
+	}
+}
diff --git a/experimental/ssh/internal/client/testdata/ssh_server_bootstrap_test.py b/experimental/ssh/internal/client/testdata/ssh_server_bootstrap_test.py
new file mode 100644
index 00000000000..1fdb322bd6d
--- /dev/null
+++ b/experimental/ssh/internal/client/testdata/ssh_server_bootstrap_test.py
@@ -0,0 +1,58 @@
+#!/usr/bin/env python3
+"""Test notebook linger helpers without importing Databricks runtime dependencies."""
+
+import importlib.util
+import unittest
+from pathlib import Path
+from types import SimpleNamespace
+from unittest.mock import Mock, call, patch
+
+
+class LingerTest(unittest.TestCase):
+    def test_wait_for_detached_descendants(self):
+        source = Path(__file__).resolve().parents[1] / "ssh-server-bootstrap.py"
+        spec = importlib.util.spec_from_file_location("ssh_server_bootstrap", source)
+        bootstrap = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(bootstrap)
+
+        cases = {
+            "no children": ([[]], [ChildProcessError()], [], 0),
+            "child awaiting adoption": ([[], ["42"], []], [None, ChildProcessError()], [0, 1], 2),
+            "exited child awaiting reaping": ([[], []], [object(), ChildProcessError()], [0], 1),
+            "adopted child": ([["42"], []], [ChildProcessError()], [0], 1),
+            "pending adoption spans multiple polls": (
+                [[], [], ["42"], []],
+                [None, None, ChildProcessError()],
+                [0, 1, 2],
+                2,
+            ),
+            "pending adoption report interval": ([[], [], []], [None, None, ChildProcessError()], [0, 300], 2),
+        }
+        for name, (survivors, children, timestamps, report_count) in cases.items():
+            with self.subTest(name=name):
+                mock_os = SimpleNamespace(P_ALL=0, WEXITED=1, WNOHANG=2, WNOWAIT=4, waitid=Mock(side_effect=children))
+                mock_time = SimpleNamespace(monotonic=Mock(side_effect=timestamps), sleep=Mock())
+                mock_descendants = Mock(side_effect=survivors)
+                # Nested with-statements rather than a parenthesized context
+                # manager so the test also parses on older interpreters.
+                with patch.object(bootstrap, "os", mock_os):
+                    with patch.object(bootstrap, "time", mock_time):
+                        with patch.object(bootstrap, "detached_descendants", mock_descendants):
+                            with patch("builtins.print") as mock_print:
+                                bootstrap.wait_for_detached_descendants(123)
+
+                self.assertEqual(mock_descendants.call_args_list, [call(123)] * len(survivors))
+                self.assertEqual(
+                    mock_os.waitid.call_args_list,
+                    [call(mock_os.P_ALL, 0, mock_os.WEXITED | mock_os.WNOHANG | mock_os.WNOWAIT)] * len(children),
+                )
+                self.assertEqual(
+                    mock_time.sleep.call_args_list, [call(bootstrap.LINGER_POLL_SECONDS)] * (len(survivors) - 1)
+                )
+                self.assertEqual(mock_time.monotonic.call_count, len(timestamps))
+                self.assertEqual(mock_print.call_count, report_count + 1)
+                self.assertIn("No detached processes left", mock_print.call_args[0][0])
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/experimental/ssh/internal/client/websockets.go b/experimental/ssh/internal/client/websockets.go
index 0dd7e37781f..51cd28c50fe 100644
--- a/experimental/ssh/internal/client/websockets.go
+++ b/experimental/ssh/internal/client/websockets.go
@@ -2,20 +2,25 @@ package client
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"net/http"
+	"net/url"
+	"strconv"
 
+	"github.com/databricks/cli/experimental/ssh/internal/proxy"
+	"github.com/databricks/cli/libs/auth"
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/gorilla/websocket"
 )
 
-func createWebsocketConnection(ctx context.Context, client *databricks.WorkspaceClient, connID, clusterID string, serverPort int, liteswap string) (*websocket.Conn, error) {
-	url, err := getProxyURL(ctx, client, connID, clusterID, serverPort)
+func createWebsocketConnection(ctx context.Context, client *databricks.WorkspaceClient, dial proxy.DialRequest, clusterID string, serverPort int, liteswap string) (*websocket.Conn, error) {
+	proxyURL, err := getProxyURL(ctx, client, dial, clusterID, serverPort)
 	if err != nil {
 		return nil, fmt.Errorf("failed to get proxy URL: %w", err)
 	}
 
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, proxyURL, nil)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create request: %w", err)
 	}
@@ -27,22 +32,60 @@ func createWebsocketConnection(ctx context.Context, client *databricks.Workspace
 		return nil, fmt.Errorf("failed to authenticate: %w", err)
 	}
 
-	req.URL.Scheme = "wss"
 	// websocket connection manages lifecycle of the response object, no need to close the body
-	conn, _, err := websocket.DefaultDialer.Dial(req.URL.String(), req.Header) // nolint:bodyclose
+	conn, resp, err := websocket.DefaultDialer.DialContext(ctx, req.URL.String(), req.Header)
+	if resp != nil {
+		resp.Body.Close()
+	}
 	if err != nil {
+		// Only the server's explicit session refusals bypass the retry budget.
+		// Other responses, including 408, can come from an intermediary.
+		if dial.Reattach && resp != nil && (resp.StatusCode == http.StatusConflict || resp.StatusCode == http.StatusGone) {
+			return nil, errors.Join(proxy.ErrReattachRejected, fmt.Errorf("reattach failed (HTTP %d): %w", resp.StatusCode, err))
+		}
 		return nil, fmt.Errorf("failed to establish websocket connection: %w", err)
 	}
 
 	return conn, nil
 }
 
-func getProxyURL(ctx context.Context, client *databricks.WorkspaceClient, connID, clusterID string, serverPort int) (string, error) {
-	workspaceID, err := client.CurrentWorkspaceID(ctx)
+func getProxyURL(ctx context.Context, client *databricks.WorkspaceClient, dial proxy.DialRequest, clusterID string, serverPort int) (string, error) {
+	workspaceID, err := auth.ResolveWorkspaceID(ctx, client)
 	if err != nil {
 		return "", fmt.Errorf("failed to get current workspace ID: %w", err)
 	}
-	host := client.Config.Host
-	url := fmt.Sprintf("%s/driver-proxy-api/o/%d/%s/%d/ssh?id=%s", host, workspaceID, clusterID, serverPort, connID)
-	return url, nil
+	return buildProxyWebsocketURL(client.Config.Host, workspaceID, clusterID, serverPort, dial)
+}
+
+// buildProxyWebsocketURL builds the driver-proxy websocket URL for an SSH tunnel.
+//
+// The scheme follows the host (http -> ws, else wss) instead of being hardcoded to
+// wss, so the tunnel is also diallable against the plaintext local test server.
+func buildProxyWebsocketURL(host, workspaceID, clusterID string, serverPort int, dial proxy.DialRequest) (string, error) {
+	u, err := url.Parse(host)
+	if err != nil {
+		return "", fmt.Errorf("failed to parse host %q: %w", host, err)
+	}
+	switch u.Scheme {
+	case "http":
+		u.Scheme = "ws"
+	default:
+		u.Scheme = "wss"
+	}
+	// The /driver-proxy-api/o/<workspace-id>/... path is a legacy URL form on
+	// the driver-proxy endpoint and uses an "o" path segment regardless of
+	// whether the workspace ID itself is the legacy or new shape.
+	u.Path = fmt.Sprintf("/driver-proxy-api/o/%s/%s/%d/ssh", workspaceID, clusterID, serverPort)
+	query := url.Values{"id": {dial.ConnID}}
+	if dial.ResumeCapable {
+		query.Set(proxy.ResumeVersionParameter, strconv.Itoa(proxy.ResumeProtocolVersion))
+		// Sending "delivered" at all is what tells the server this client speaks the resume
+		// protocol, so it buffers its own output for replay from the start of the session.
+		query.Set("delivered", strconv.FormatInt(dial.Delivered, 10))
+		if dial.Reattach {
+			query.Set("reattach", "1")
+		}
+	}
+	u.RawQuery = query.Encode()
+	return u.String(), nil
 }
diff --git a/experimental/ssh/internal/client/websockets_test.go b/experimental/ssh/internal/client/websockets_test.go
new file mode 100644
index 00000000000..05d15636688
--- /dev/null
+++ b/experimental/ssh/internal/client/websockets_test.go
@@ -0,0 +1,175 @@
+package client
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/databricks/cli/experimental/ssh/internal/proxy"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/gorilla/websocket"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestServerSupportsResume(t *testing.T) {
+	for _, tc := range []struct {
+		name   string
+		status int
+		body   string
+		want   bool
+	}{
+		{"old server", http.StatusNotFound, "not found", false},
+		{"faulty v1 server", http.StatusOK, `{"resume":true}`, false},
+		{"corrected protocol", http.StatusOK, `{"resume_version":2}`, true},
+		{"unknown protocol", http.StatusOK, `{"resume_version":3}`, false},
+		{"invalid response", http.StatusOK, `{`, false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			mux := http.NewServeMux()
+			mux.HandleFunc("GET /driver-proxy-api/o/123/cluster/7772/capabilities", func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(tc.status)
+				_, _ = w.Write([]byte(tc.body))
+			})
+			server := httptest.NewServer(mux)
+			defer server.Close()
+			client, err := databricks.NewWorkspaceClient(&databricks.Config{Host: server.URL, Token: "test-token", WorkspaceID: "123", AuthType: "pat"})
+			require.NoError(t, err)
+			assert.Equal(t, tc.want, serverSupportsResume(t.Context(), client, "cluster", 7772, ""))
+		})
+	}
+}
+
+func TestCreateWebsocketConnectionReattachRejected(t *testing.T) {
+	for _, tc := range []struct {
+		status   int
+		rejected bool
+	}{
+		{http.StatusGone, true},
+		{http.StatusConflict, true},
+		{http.StatusUnauthorized, false},
+		{http.StatusForbidden, false},
+		{http.StatusRequestTimeout, false},
+		{http.StatusTooManyRequests, false},
+		{http.StatusServiceUnavailable, false},
+	} {
+		t.Run(http.StatusText(tc.status), func(t *testing.T) {
+			mux := http.NewServeMux()
+			mux.HandleFunc("GET /driver-proxy-api/o/123/cluster/7772/ssh", func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(tc.status)
+			})
+			server := httptest.NewServer(mux)
+			defer server.Close()
+			client, err := databricks.NewWorkspaceClient(&databricks.Config{Host: server.URL, Token: "test-token", WorkspaceID: "123", AuthType: "pat"})
+			require.NoError(t, err)
+			ctx, cancel := context.WithTimeout(t.Context(), time.Second)
+			defer cancel()
+			_, err = createWebsocketConnection(ctx, client, proxy.DialRequest{ConnID: "test", ResumeCapable: true, Reattach: true}, "cluster", 7772, "")
+			require.Error(t, err)
+			if tc.rejected {
+				assert.ErrorIs(t, err, proxy.ErrReattachRejected)
+			} else {
+				assert.NotErrorIs(t, err, proxy.ErrReattachRejected)
+			}
+		})
+	}
+}
+
+func TestCreateWebsocketConnectionRetriesRequestTimeout(t *testing.T) {
+	var reattachments atomic.Int32
+	mux := http.NewServeMux()
+	mux.HandleFunc("GET /driver-proxy-api/o/123/cluster/7772/ssh", func(w http.ResponseWriter, r *http.Request) {
+		reattach := r.URL.Query().Get("reattach") == "1"
+		if reattach && reattachments.Add(1) == 1 {
+			w.WriteHeader(http.StatusRequestTimeout)
+			return
+		}
+		conn, err := (&websocket.Upgrader{}).Upgrade(w, r, nil)
+		if !assert.NoError(t, err) {
+			return
+		}
+		defer conn.Close()
+		if !reattach {
+			assert.NoError(t, conn.WriteMessage(websocket.BinaryMessage, []byte("before")))
+			return
+		}
+		assert.Equal(t, "6", r.URL.Query().Get("delivered"))
+		assert.NoError(t, conn.WriteJSON(map[string]int{"delivered": 0}))
+		assert.NoError(t, conn.WriteMessage(websocket.BinaryMessage, []byte("after")))
+		assert.NoError(t, conn.WriteMessage(websocket.CloseMessage, websocket.FormatCloseMessage(websocket.CloseNormalClosure, "finished")))
+	})
+	server := httptest.NewServer(mux)
+	defer server.Close()
+	client, err := databricks.NewWorkspaceClient(&databricks.Config{Host: server.URL, Token: "test-token", WorkspaceID: "123", AuthType: "pat"})
+	require.NoError(t, err)
+	ctx, cancel := context.WithTimeout(t.Context(), 10*time.Second)
+	defer cancel()
+	input, writer := io.Pipe()
+	defer writer.Close()
+	var output bytes.Buffer
+	err = proxy.RunClientProxy(ctx, input, &output, func() <-chan time.Time { return nil }, time.Hour, true,
+		func(ctx context.Context, req proxy.DialRequest) (*websocket.Conn, error) {
+			return createWebsocketConnection(ctx, client, req, "cluster", 7772, "")
+		})
+	require.NoError(t, err)
+	assert.NoError(t, ctx.Err())
+	assert.Equal(t, int32(2), reattachments.Load())
+	assert.Equal(t, "beforeafter", output.String())
+}
+
+func TestBuildProxyWebsocketURL(t *testing.T) {
+	tests := []struct {
+		name string
+		host string
+		dial proxy.DialRequest
+		want string
+	}{
+		{
+			name: "https host is dialed over wss",
+			host: "https://my-workspace.cloud.databricks.test",
+			dial: proxy.DialRequest{ConnID: "conn-1"},
+			want: "wss://my-workspace.cloud.databricks.test/driver-proxy-api/o/900800700600/1234-567890-abc/7772/ssh?id=conn-1",
+		},
+		{
+			name: "plaintext http host is dialed over ws",
+			host: "http://127.0.0.1:8080",
+			dial: proxy.DialRequest{ConnID: "conn-1"},
+			want: "ws://127.0.0.1:8080/driver-proxy-api/o/900800700600/1234-567890-abc/7772/ssh?id=conn-1",
+		},
+		{
+			// A server that does not speak the resume protocol must see the URL it always saw,
+			// so no resume parameters leak out when the capability probe said no.
+			name: "a non-resumable dial carries no resume parameters",
+			host: "http://127.0.0.1:8080",
+			dial: proxy.DialRequest{ConnID: "conn-1", Delivered: 4096, Reattach: true},
+			want: "ws://127.0.0.1:8080/driver-proxy-api/o/900800700600/1234-567890-abc/7772/ssh?id=conn-1",
+		},
+		{
+			// The offset travels on every dial, not just a reattach: its presence is what tells
+			// the server to start buffering its own output for replay.
+			name: "a resumable dial always carries the delivered offset",
+			host: "http://127.0.0.1:8080",
+			dial: proxy.DialRequest{ConnID: "conn-1", ResumeCapable: true},
+			want: "ws://127.0.0.1:8080/driver-proxy-api/o/900800700600/1234-567890-abc/7772/ssh?delivered=0&id=conn-1&resume_version=2",
+		},
+		{
+			name: "a reattach states its intent and its offset",
+			host: "http://127.0.0.1:8080",
+			dial: proxy.DialRequest{ConnID: "conn-1", ResumeCapable: true, Delivered: 4096, Reattach: true},
+			want: "ws://127.0.0.1:8080/driver-proxy-api/o/900800700600/1234-567890-abc/7772/ssh?delivered=4096&id=conn-1&reattach=1&resume_version=2",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := buildProxyWebsocketURL(tt.host, "900800700600", "1234-567890-abc", 7772, tt.dial)
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
diff --git a/experimental/ssh/internal/fuse/client.go b/experimental/ssh/internal/fuse/client.go
new file mode 100644
index 00000000000..b0715400fce
--- /dev/null
+++ b/experimental/ssh/internal/fuse/client.go
@@ -0,0 +1,152 @@
+// Package fuse registers the SSH server's credentials with the compute's filesystem daemons.
+package fuse
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"strconv"
+	"time"
+
+	"github.com/databricks/cli/libs/log"
+)
+
+const (
+	commandOrigin  = "RemoteSshServer"
+	requestTimeout = 2 * time.Second
+)
+
+type request struct {
+	APIToken       string            `json:"apiToken"`
+	ProcStartTime  uint64            `json:"procStartTime"`
+	CommandOrigin  string            `json:"commandOrigin"`
+	PIDNamespaceID uint32            `json:"namespaceId"`
+	NotebookDir    string            `json:"notebookDir,omitempty"`
+	AdditionalTags map[string]string `json:"additionalTags,omitempty"`
+}
+
+type daemon struct {
+	name             string
+	port             int
+	path             string
+	host             string
+	token            string
+	refreshUnchanged bool
+}
+
+// Client tracks the last successful registration for each daemon. It must not be used concurrently.
+type Client struct {
+	registration Registration
+	hosts        []string
+	daemons      []daemon
+	http         *http.Client
+	readPID      func() (int, error)
+}
+
+// NewClient creates a client for the node-local filesystem daemons.
+func NewClient(r Registration) (*Client, error) {
+	if r.PID <= 0 || r.PIDNamespaceID == 0 || r.StartTime == 0 {
+		return nil, errors.New("FUSE registration requires a positive PID, PID namespace and process start time")
+	}
+	transport := http.DefaultTransport.(*http.Transport).Clone()
+	// Credentials belong on this node, even when the server has HTTP_PROXY set.
+	transport.Proxy = nil
+	return &Client{
+		registration: r,
+		readPID:      registeredPID,
+		hosts:        []string{"databricks.node.host.local", "node.host.local", "localhost"},
+		daemons: []daemon{
+			{name: "workspace files", port: 1021, path: fmt.Sprintf("/api/1/pid/%d", r.PID)},
+			// UC-FUSE has no registration probe and its PUT does not invalidate WSFS's caches.
+			{name: "volumes", port: 1015, path: fmt.Sprintf("/dbfs-fuse-api/1/pid/%d", r.PID), refreshUnchanged: true},
+		},
+		http: &http.Client{
+			Timeout:       requestTimeout,
+			Transport:     transport,
+			CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse },
+		},
+	}, nil
+}
+
+// Register refreshes volumes, updates changed credentials, and retries failed registrations.
+// Force also restores a lost workspace-files registration.
+func (c *Client) Register(ctx context.Context, token, userID, notebookDir string, force bool) error {
+	if token == "" {
+		return errors.New("cannot register an empty FUSE token")
+	}
+	body := request{
+		APIToken:       token,
+		ProcStartTime:  c.registration.StartTime,
+		CommandOrigin:  commandOrigin,
+		PIDNamespaceID: c.registration.PIDNamespaceID,
+		NotebookDir:    notebookDir,
+	}
+	if userID != "" {
+		body.AdditionalTags = map[string]string{"userId": userID}
+	}
+	encoded, err := json.Marshal(body)
+	if err != nil {
+		return fmt.Errorf("failed to encode FUSE registration: %w", err)
+	}
+
+	var errs []error
+	for i := range c.daemons {
+		d := &c.daemons[i]
+		if force {
+			d.token = ""
+		}
+		if d.token == token && !d.refreshUnchanged {
+			continue
+		}
+		if err := c.registerDaemon(ctx, d, encoded); err != nil {
+			errs = append(errs, fmt.Errorf("%s: %w", d.name, err))
+			continue
+		}
+		d.token = token
+		log.Infof(ctx, "Registered SSH server PID %d with %s", c.registration.PID, d.name)
+	}
+	return errors.Join(errs...)
+}
+
+func (c *Client) registerDaemon(ctx context.Context, d *daemon, body []byte) error {
+	if d.host != "" {
+		return c.put(ctx, d, d.host, body)
+	}
+	var errs []error
+	for _, host := range c.hosts {
+		if err := ctx.Err(); err != nil {
+			return err
+		}
+		if err := c.put(ctx, d, host, body); err != nil {
+			errs = append(errs, err)
+			continue
+		}
+		// DNS resolution alone does not establish that this endpoint serves the daemon.
+		d.host = host
+		return nil
+	}
+	return errors.Join(errs...)
+}
+
+func (c *Client) put(ctx context.Context, d *daemon, host string, body []byte) error {
+	url := "http://" + net.JoinHostPort(host, strconv.Itoa(d.port)) + d.path
+	req, err := http.NewRequestWithContext(ctx, http.MethodPut, url, bytes.NewReader(body))
+	if err != nil {
+		return fmt.Errorf("failed to build FUSE request: %w", err)
+	}
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := c.http.Do(req)
+	if err != nil {
+		return fmt.Errorf("failed to register with %s: %w", url, err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		// Error bodies may echo credentials from the request.
+		return fmt.Errorf("%s returned HTTP %d", url, resp.StatusCode)
+	}
+	return nil
+}
diff --git a/experimental/ssh/internal/fuse/client_test.go b/experimental/ssh/internal/fuse/client_test.go
new file mode 100644
index 00000000000..f32fa396b42
--- /dev/null
+++ b/experimental/ssh/internal/fuse/client_test.go
@@ -0,0 +1,227 @@
+package fuse_test
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/databricks/cli/experimental/ssh/internal/fuse"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+var testHosts = []string{"first.test", "second.test", "third.test"}
+
+const testNotebookDir = "/Users/user@example.test"
+
+type recordedRequest struct {
+	Host string
+	Path string
+	Body map[string]any
+}
+
+type testDaemon struct {
+	mu       sync.Mutex
+	requests []recordedRequest
+	status   func(*http.Request) int
+}
+
+func newTestClient(t *testing.T, d *testDaemon) *fuse.Client {
+	t.Helper()
+	s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, http.MethodPut, r.Method)
+		assert.Equal(t, "application/json", r.Header.Get("Content-Type"))
+		var body map[string]any
+		if !assert.NoError(t, json.NewDecoder(r.Body).Decode(&body)) {
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+		d.mu.Lock()
+		defer d.mu.Unlock()
+		d.requests = append(d.requests, recordedRequest{r.Host, r.URL.Path, body})
+		status := http.StatusOK
+		if d.status != nil {
+			status = d.status(r)
+		}
+		w.WriteHeader(status)
+		if status != http.StatusOK {
+			_, _ = io.WriteString(w, "secret-token-in-error-body")
+		}
+	}))
+	t.Cleanup(s.Close)
+	c, err := fuse.NewClient(registration)
+	require.NoError(t, err)
+	httpClient := fuse.HTTPClient(c)
+	httpClient.Transport.(*http.Transport).DialContext = func(ctx context.Context, network, _ string) (net.Conn, error) {
+		return (&net.Dialer{}).DialContext(ctx, network, s.Listener.Addr().String())
+	}
+	fuse.ConfigureTestClient(c, httpClient, testHosts, func() (int, error) { return registration.PID, nil })
+	t.Cleanup(httpClient.CloseIdleConnections)
+	return c
+}
+
+func (d *testDaemon) snapshot() []recordedRequest {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	return append([]recordedRequest(nil), d.requests...)
+}
+
+func TestRegister(t *testing.T) {
+	for _, user := range []struct {
+		name, id, notebookDir string
+	}{
+		{name: "unavailable"},
+		{name: "available", id: "12345", notebookDir: testNotebookDir},
+	} {
+		t.Run(user.name, func(t *testing.T) {
+			d := &testDaemon{}
+			c := newTestClient(t, d)
+			require.NoError(t, c.Register(t.Context(), "token-one", user.id, user.notebookDir, false))
+			requests := d.snapshot()
+			require.Len(t, requests, 2)
+			assert.Equal(t, "first.test:1021", requests[0].Host)
+			assert.Equal(t, "/api/1/pid/4242", requests[0].Path)
+			assert.Equal(t, "first.test:1015", requests[1].Host)
+			assert.Equal(t, "/dbfs-fuse-api/1/pid/4242", requests[1].Path)
+			want := map[string]any{
+				"apiToken": "token-one", "procStartTime": float64(8613244),
+				"commandOrigin": "RemoteSshServer", "namespaceId": float64(4026531836),
+			}
+			if user.id != "" {
+				want["additionalTags"] = map[string]any{"userId": user.id}
+				want["notebookDir"] = user.notebookDir
+			}
+			for _, req := range requests {
+				assert.Equal(t, want, req.Body)
+			}
+
+			require.NoError(t, c.Register(t.Context(), "token-one", user.id, user.notebookDir, false))
+			requests = d.snapshot()
+			require.Len(t, requests, 3, "unchanged credentials must only refresh volumes")
+			assert.Equal(t, "first.test:1015", requests[2].Host)
+			require.NoError(t, c.Register(t.Context(), "token-two", user.id, user.notebookDir, false))
+			requests = d.snapshot()
+			require.Len(t, requests, 5)
+			assert.Equal(t, "token-two", requests[3].Body["apiToken"])
+			assert.Equal(t, "token-two", requests[4].Body["apiToken"])
+			require.NoError(t, c.Register(t.Context(), "token-two", user.id, user.notebookDir, true))
+			assert.Len(t, d.snapshot(), 7, "restore a lost registration with the same token")
+		})
+	}
+}
+
+func TestRegisterSelectsReachableHostPerDaemon(t *testing.T) {
+	d := &testDaemon{status: func(r *http.Request) int {
+		if r.Host == "second.test:1021" || r.Host == "third.test:1015" {
+			return http.StatusOK
+		}
+		return http.StatusNotFound
+	}}
+	c := newTestClient(t, d)
+	require.NoError(t, c.Register(t.Context(), "token-one", "", "", false))
+	require.Len(t, d.snapshot(), 5)
+	require.NoError(t, c.Register(t.Context(), "token-two", "", "", false))
+	requests := d.snapshot()
+	require.Len(t, requests, 7)
+	assert.Equal(t, "second.test:1021", requests[5].Host)
+	assert.Equal(t, "third.test:1015", requests[6].Host)
+}
+
+func TestRegisterRetriesOnlyFailedDaemon(t *testing.T) {
+	d := &testDaemon{status: func(r *http.Request) int {
+		if strings.HasSuffix(r.Host, ":1015") {
+			return http.StatusServiceUnavailable
+		}
+		return http.StatusOK
+	}}
+	c := newTestClient(t, d)
+	err := c.Register(t.Context(), "token-one", "", "", false)
+	require.ErrorContains(t, err, "volumes:")
+	assert.NotContains(t, err.Error(), "secret-token-in-error-body")
+	assert.Len(t, d.snapshot(), 4)
+	d.mu.Lock()
+	d.status = nil
+	d.mu.Unlock()
+	require.NoError(t, c.Register(t.Context(), "token-one", "", "", false))
+	requests := d.snapshot()
+	require.Len(t, requests, 5)
+	assert.Equal(t, "first.test:1015", requests[4].Host)
+}
+
+func TestRegisterRejectsInvalidCredentials(t *testing.T) {
+	for _, r := range []fuse.Registration{
+		{PID: -1, PIDNamespaceID: 1, StartTime: 1},
+		{PID: 0, PIDNamespaceID: 1, StartTime: 1},
+		{PID: 1, PIDNamespaceID: 0, StartTime: 1},
+		{PID: 1, PIDNamespaceID: 1, StartTime: 0},
+	} {
+		_, err := fuse.NewClient(r)
+		require.Error(t, err)
+	}
+	d := &testDaemon{}
+	c := newTestClient(t, d)
+	require.ErrorContains(t, c.Register(t.Context(), "", "", "", false), "empty FUSE token")
+	assert.Empty(t, d.snapshot())
+}
+
+type roundTripFunc func(*http.Request) (*http.Response, error)
+
+func (f roundTripFunc) RoundTrip(r *http.Request) (*http.Response, error) { return f(r) }
+
+func TestRegisterBoundsRequests(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		c, err := fuse.NewClient(registration)
+		require.NoError(t, err)
+		httpClient := fuse.HTTPClient(c)
+		calls := 0
+		httpClient.Transport = roundTripFunc(func(r *http.Request) (*http.Response, error) {
+			calls++
+			<-r.Context().Done()
+			return nil, r.Context().Err()
+		})
+		start := time.Now()
+		err = c.Register(t.Context(), "token-one", "", "", false)
+		require.Error(t, err)
+		assert.Equal(t, 6, calls)
+		assert.Equal(t, 12*time.Second, time.Since(start))
+		assert.ErrorIs(t, err, context.DeadlineExceeded)
+	})
+}
+
+func TestRegisterCancellation(t *testing.T) {
+	c, err := fuse.NewClient(registration)
+	require.NoError(t, err)
+	ctx, cancel := context.WithCancel(t.Context())
+	cancel()
+	err = c.Register(ctx, "token-one", "", "", false)
+	require.ErrorIs(t, err, context.Canceled)
+}
+
+func TestRegisterDoesNotRedirectOrProxyCredentials(t *testing.T) {
+	c, err := fuse.NewClient(registration)
+	require.NoError(t, err)
+	httpClient := fuse.HTTPClient(c)
+	assert.Nil(t, httpClient.Transport.(*http.Transport).Proxy)
+	requests := 0
+	httpClient.Transport = roundTripFunc(func(r *http.Request) (*http.Response, error) {
+		requests++
+		assert.NotEqual(t, "redirect.test", r.URL.Hostname())
+		return &http.Response{
+			StatusCode: http.StatusTemporaryRedirect,
+			Header:     http.Header{"Location": {"http://redirect.test/"}},
+			Body:       io.NopCloser(strings.NewReader("secret-token-in-error-body")),
+		}, nil
+	})
+	err = c.Register(t.Context(), "token-one", "", "", false)
+	require.ErrorContains(t, err, "HTTP 307")
+	assert.NotContains(t, err.Error(), "secret-token-in-error-body")
+	assert.Equal(t, 6, requests)
+}
diff --git a/experimental/ssh/internal/fuse/export_test.go b/experimental/ssh/internal/fuse/export_test.go
new file mode 100644
index 00000000000..0dd12e538a4
--- /dev/null
+++ b/experimental/ssh/internal/fuse/export_test.go
@@ -0,0 +1,19 @@
+package fuse
+
+import "net/http"
+
+var ParseRegistration = parseRegistration
+
+const RefreshInterval = refreshInterval
+
+const PIDProbeTimeout = pidProbeTimeout
+
+func ConfigureTestClient(c *Client, httpClient *http.Client, hosts []string, readPID func() (int, error)) {
+	c.http = httpClient
+	c.hosts = hosts
+	c.readPID = readPID
+}
+
+func HTTPClient(c *Client) *http.Client {
+	return c.http
+}
diff --git a/experimental/ssh/internal/fuse/keepalive.go b/experimental/ssh/internal/fuse/keepalive.go
new file mode 100644
index 00000000000..ce9c865ec81
--- /dev/null
+++ b/experimental/ssh/internal/fuse/keepalive.go
@@ -0,0 +1,81 @@
+package fuse
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/databricks/cli/libs/log"
+)
+
+const (
+	refreshInterval = time.Minute
+	pidProbeTimeout = 2 * time.Second
+)
+
+// TokenFunc returns the current credential, including any refresh performed by the SDK.
+type TokenFunc func(context.Context) (string, error)
+
+// KeepRegistered makes an initial attempt before returning, then retries in the background,
+// even if that attempt failed. Cancellation stops refresh; entries remain until compute shutdown.
+func KeepRegistered(ctx context.Context, client *Client, token TokenFunc, userID, notebookDir string) error {
+	err := refresh(ctx, client, token, userID, notebookDir, false)
+	go refreshUntilDone(ctx, client, token, userID, notebookDir)
+	return err
+}
+
+func refresh(ctx context.Context, client *Client, token TokenFunc, userID, notebookDir string, force bool) error {
+	value, err := token(ctx)
+	if err != nil {
+		return fmt.Errorf("failed to get FUSE credentials: %w", err)
+	}
+	return client.Register(ctx, value, userID, notebookDir, force)
+}
+
+func refreshUntilDone(ctx context.Context, client *Client, token TokenFunc, userID, notebookDir string) {
+	ticker := time.NewTicker(refreshInterval)
+	defer ticker.Stop()
+	defer client.http.CloseIdleConnections()
+	var pendingProbe chan bool
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			if pendingProbe == nil {
+				pendingProbe = make(chan bool, 1)
+				go func(result chan<- bool) {
+					pid, err := client.readPID()
+					result <- err != nil || pid != client.registration.PID
+				}(pendingProbe)
+			}
+			// Re-register WSFS only after credential rotation or loss of the registered ancestor.
+			// Unchanged WSFS registrations unnecessarily invalidate the daemon's caches.
+			force := true
+			timer := time.NewTimer(pidProbeTimeout)
+			select {
+			case <-ctx.Done():
+				timer.Stop()
+				return
+			case force = <-pendingProbe:
+				pendingProbe = nil
+			case <-timer.C:
+			}
+			timer.Stop()
+			if err := refresh(ctx, client, token, userID, notebookDir, force); err != nil {
+				log.Warnf(ctx, "Failed to refresh SSH filesystem credentials; retrying in %v: %v", refreshInterval, err)
+			}
+		}
+	}
+}
+
+func registeredPID() (int, error) {
+	content, err := os.ReadFile("/Workspace/.proc/self/metadata/pid")
+	if err != nil {
+		return 0, err
+	}
+	return strconv.Atoi(strings.TrimSpace(string(content)))
+}
diff --git a/experimental/ssh/internal/fuse/keepalive_test.go b/experimental/ssh/internal/fuse/keepalive_test.go
new file mode 100644
index 00000000000..9c7a11ae8ee
--- /dev/null
+++ b/experimental/ssh/internal/fuse/keepalive_test.go
@@ -0,0 +1,277 @@
+package fuse_test
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"strings"
+	"sync"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/databricks/cli/experimental/ssh/internal/fuse"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestKeepRegistered(t *testing.T) {
+	for _, initialFailure := range []string{"", "token", "workspace", "volumes", "both"} {
+		t.Run("initialFailure="+initialFailure, func(t *testing.T) {
+			synctest.Test(t, func(t *testing.T) {
+				ctx, cancel := context.WithCancel(t.Context())
+				defer cancel()
+				c, err := fuse.NewClient(registration)
+				require.NoError(t, err)
+				var mu sync.Mutex
+				failure := initialFailure
+				token := "token-one"
+				pid := registration.PID
+				var probeErr error
+				var requests []recordedRequest
+				httpClient := fuse.HTTPClient(c)
+				httpClient.Transport = roundTripFunc(func(r *http.Request) (*http.Response, error) {
+					mu.Lock()
+					defer mu.Unlock()
+					var body map[string]any
+					if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+						return nil, err
+					}
+					assert.NotEmpty(t, body["apiToken"], "cancellation must not send a revoke")
+					assert.Equal(t, testNotebookDir, body["notebookDir"])
+					requests = append(requests, recordedRequest{r.Host, r.URL.Path, body})
+					status := http.StatusOK
+					if failure == "both" || (failure == "workspace" && r.URL.Port() == "1021") || (failure == "volumes" && r.URL.Port() == "1015") {
+						status = http.StatusServiceUnavailable
+					}
+					return &http.Response{StatusCode: status, Body: io.NopCloser(strings.NewReader(""))}, nil
+				})
+				fuse.ConfigureTestClient(c, httpClient, testHosts, func() (int, error) { mu.Lock(); defer mu.Unlock(); return pid, probeErr })
+				tokenCalls := 0
+				err = fuse.KeepRegistered(ctx, c, func(context.Context) (string, error) {
+					mu.Lock()
+					defer mu.Unlock()
+					tokenCalls++
+					if failure == "token" {
+						return "", errors.New("token unavailable")
+					}
+					return token, nil
+				}, "12345", testNotebookDir)
+				if initialFailure == "" {
+					require.NoError(t, err)
+				} else {
+					require.Error(t, err)
+				}
+				synctest.Wait()
+				mu.Lock()
+				initialRequests := len(requests)
+				failure = ""
+				mu.Unlock()
+				time.Sleep(59 * time.Second)
+				synctest.Wait()
+				mu.Lock()
+				assert.Len(t, requests, initialRequests)
+				assert.Equal(t, 1, tokenCalls)
+				mu.Unlock()
+				time.Sleep(time.Second)
+				synctest.Wait()
+				mu.Lock()
+				refreshes := 1
+				switch initialFailure {
+				case "token", "both", "workspace":
+					refreshes = 2
+				}
+				assert.Len(t, requests, initialRequests+refreshes)
+				assert.Equal(t, 2, tokenCalls, "a failed startup must still start the refresh loop")
+
+				before := len(requests)
+				mu.Unlock()
+				time.Sleep(3 * fuse.RefreshInterval)
+				synctest.Wait()
+				mu.Lock()
+				assert.Len(t, requests, before+3, "steady state must only refresh volumes")
+				for _, req := range requests[before:] {
+					assert.Equal(t, "first.test:1015", req.Host)
+				}
+				before = len(requests)
+
+				token = "token-two"
+				mu.Unlock()
+				time.Sleep(fuse.RefreshInterval)
+				synctest.Wait()
+				mu.Lock()
+				require.Len(t, requests, before+2)
+				assert.Equal(t, token, requests[before].Body["apiToken"])
+				assert.Equal(t, token, requests[before+1].Body["apiToken"])
+
+				pid = registration.PID - 1
+				mu.Unlock()
+				time.Sleep(fuse.RefreshInterval)
+				synctest.Wait()
+				mu.Lock()
+				assert.Len(t, requests, before+4, "restore registration when a different ancestor is reported")
+				pid = registration.PID
+				probeErr = errors.New("filesystem metadata unavailable")
+				mu.Unlock()
+				time.Sleep(fuse.RefreshInterval)
+				synctest.Wait()
+				mu.Lock()
+				assert.Len(t, requests, before+6, "restore registration when the probe fails")
+				probeErr = nil
+				cancel()
+				mu.Unlock()
+				synctest.Wait()
+				mu.Lock()
+				callsAtCancel := tokenCalls
+				mu.Unlock()
+				time.Sleep(2 * fuse.RefreshInterval)
+				synctest.Wait()
+				mu.Lock()
+				assert.Equal(t, callsAtCancel, tokenCalls)
+				assert.Len(t, requests, before+6)
+				mu.Unlock()
+			})
+		})
+	}
+}
+
+func TestKeepRegisteredRecoversVolumesRegistrationLoss(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		ctx, cancel := context.WithCancel(t.Context())
+		defer cancel()
+		c, err := fuse.NewClient(registration)
+		require.NoError(t, err)
+		var mu sync.Mutex
+		registered := map[string]bool{}
+		requests := map[string]int{}
+		httpClient := fuse.HTTPClient(c)
+		httpClient.Transport = roundTripFunc(func(r *http.Request) (*http.Response, error) {
+			mu.Lock()
+			defer mu.Unlock()
+			registered[r.URL.Port()] = true
+			requests[r.URL.Port()]++
+			return &http.Response{StatusCode: http.StatusOK, Body: io.NopCloser(strings.NewReader(""))}, nil
+		})
+		fuse.ConfigureTestClient(c, httpClient, testHosts, func() (int, error) { return registration.PID, nil })
+		require.NoError(t, fuse.KeepRegistered(ctx, c, func(context.Context) (string, error) {
+			return "fixed-bootstrap-token", nil
+		}, "12345", testNotebookDir))
+		synctest.Wait()
+
+		for tick := range 3 {
+			mu.Lock()
+			// A UC-FUSE restart loses its mapping while WSFS still reports the server PID.
+			registered["1015"] = false
+			mu.Unlock()
+			time.Sleep(fuse.RefreshInterval)
+			synctest.Wait()
+			mu.Lock()
+			assert.True(t, registered["1015"], "restore volumes registration with an unchanged credential")
+			assert.Equal(t, 1, requests["1021"], "healthy WSFS must not invalidate its caches")
+			assert.Equal(t, tick+2, requests["1015"])
+			mu.Unlock()
+		}
+	})
+}
+
+type keepaliveTransport struct {
+	http.RoundTripper
+	closed chan struct{}
+}
+
+func (transport *keepaliveTransport) CloseIdleConnections() {
+	close(transport.closed)
+}
+
+func TestKeepRegisteredBlockedPIDProbe(t *testing.T) {
+	for _, scenario := range []string{"cancel", "recover"} {
+		t.Run(scenario, func(t *testing.T) {
+			synctest.Test(t, func(t *testing.T) {
+				ctx, cancel := context.WithCancel(t.Context())
+				defer cancel()
+				client, err := fuse.NewClient(registration)
+				require.NoError(t, err)
+				var mu sync.Mutex
+				requests := map[string]int{}
+				transport := &keepaliveTransport{
+					closed: make(chan struct{}),
+					RoundTripper: roundTripFunc(func(request *http.Request) (*http.Response, error) {
+						mu.Lock()
+						defer mu.Unlock()
+						requests[request.URL.Port()]++
+						return &http.Response{StatusCode: http.StatusOK, Body: http.NoBody}, nil
+					}),
+				}
+				httpClient := fuse.HTTPClient(client)
+				httpClient.Transport = transport
+				releaseProbe := make(chan struct{}, 1)
+				defer close(releaseProbe)
+				probeCalls := 0
+				fuse.ConfigureTestClient(client, httpClient, testHosts, func() (int, error) {
+					mu.Lock()
+					probeCalls++
+					firstProbe := probeCalls == 1
+					mu.Unlock()
+					if firstProbe {
+						<-releaseProbe
+					}
+					return registration.PID, nil
+				})
+				require.NoError(t, fuse.KeepRegistered(ctx, client, func(context.Context) (string, error) {
+					return "fixed-bootstrap-token", nil
+				}, "12345", testNotebookDir))
+				synctest.Wait()
+				start := time.Now()
+				for tick := range 3 {
+					time.Sleep(time.Until(start.Add(time.Duration(tick+1) * fuse.RefreshInterval)))
+					synctest.Wait()
+					mu.Lock()
+					assert.Equal(t, tick+1, requests["1015"], "wait for the probe before refreshing")
+					mu.Unlock()
+					time.Sleep(fuse.PIDProbeTimeout)
+					synctest.Wait()
+					mu.Lock()
+					assert.Equal(t, tick+2, requests["1015"], "keep refreshing volumes while WSFS is blocked")
+					assert.Equal(t, tick+2, requests["1021"], "force WSFS registration after a probe timeout")
+					assert.Equal(t, 1, probeCalls, "reuse the outstanding probe across refreshes")
+					mu.Unlock()
+				}
+
+				if scenario == "recover" {
+					releaseProbe <- struct{}{}
+					synctest.Wait()
+					time.Sleep(2 * fuse.RefreshInterval)
+					synctest.Wait()
+					mu.Lock()
+					assert.Equal(t, 6, requests["1015"])
+					assert.Equal(t, 4, requests["1021"], "stop forcing WSFS registration after probe recovery")
+					assert.Equal(t, 2, probeCalls, "resume probing after the outstanding read completes")
+					mu.Unlock()
+				} else {
+					time.Sleep(fuse.RefreshInterval - fuse.PIDProbeTimeout)
+					synctest.Wait()
+				}
+
+				cancel()
+				synctest.Wait()
+				select {
+				case <-transport.closed:
+				default:
+					assert.Fail(t, "refresh loop must exit on cancellation even with a blocked probe")
+				}
+				mu.Lock()
+				callsAtCancel := probeCalls
+				requestsAtCancel := requests["1015"]
+				mu.Unlock()
+				time.Sleep(2 * fuse.RefreshInterval)
+				synctest.Wait()
+				mu.Lock()
+				assert.Equal(t, callsAtCancel, probeCalls)
+				assert.Equal(t, requestsAtCancel, requests["1015"])
+				mu.Unlock()
+			})
+		})
+	}
+}
diff --git a/experimental/ssh/internal/fuse/process.go b/experimental/ssh/internal/fuse/process.go
new file mode 100644
index 00000000000..a78dd9b59a7
--- /dev/null
+++ b/experimental/ssh/internal/fuse/process.go
@@ -0,0 +1,61 @@
+package fuse
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"strconv"
+	"strings"
+)
+
+// Registration identifies a process without allowing a recycled PID to inherit its credentials.
+type Registration struct {
+	PID            int
+	PIDNamespaceID uint32
+	StartTime      uint64
+}
+
+// Self describes the calling process using Linux procfs.
+func Self() (Registration, error) {
+	link, err := os.Readlink("/proc/self/ns/pid")
+	if err != nil {
+		return Registration{}, fmt.Errorf("failed to read the PID namespace: %w", err)
+	}
+	stat, err := os.ReadFile("/proc/self/stat")
+	if err != nil {
+		return Registration{}, fmt.Errorf("failed to read process stat: %w", err)
+	}
+	return parseRegistration(os.Getpid(), link, string(stat))
+}
+
+func parseRegistration(pid int, namespace, stat string) (Registration, error) {
+	inner, ok := strings.CutPrefix(namespace, "pid:[")
+	if !ok {
+		return Registration{}, fmt.Errorf("unexpected PID namespace link %q", namespace)
+	}
+	inner, ok = strings.CutSuffix(inner, "]")
+	if !ok {
+		return Registration{}, fmt.Errorf("unexpected PID namespace link %q", namespace)
+	}
+	namespaceID, err := strconv.ParseUint(inner, 10, 32)
+	if err != nil {
+		return Registration{}, fmt.Errorf("failed to parse the PID namespace: %w", err)
+	}
+
+	// Field 2 can contain spaces and parentheses. Count field 22 from the last ')'.
+	// https://man7.org/linux/man-pages/man5/proc_pid_stat.5.html
+	_, after, ok := strings.CutLast(stat, ")")
+	if !ok {
+		return Registration{}, errors.New("missing process name in process stat")
+	}
+	fields := strings.Fields(after)
+	const startTimeIndex = 19
+	if len(fields) <= startTimeIndex {
+		return Registration{}, errors.New("missing start time in process stat")
+	}
+	startTime, err := strconv.ParseUint(fields[startTimeIndex], 10, 64)
+	if err != nil {
+		return Registration{}, fmt.Errorf("failed to parse process start time: %w", err)
+	}
+	return Registration{PID: pid, PIDNamespaceID: uint32(namespaceID), StartTime: startTime}, nil
+}
diff --git a/experimental/ssh/internal/fuse/process_test.go b/experimental/ssh/internal/fuse/process_test.go
new file mode 100644
index 00000000000..ef5e5cedd70
--- /dev/null
+++ b/experimental/ssh/internal/fuse/process_test.go
@@ -0,0 +1,53 @@
+package fuse_test
+
+import (
+	"os"
+	"runtime"
+	"testing"
+
+	"github.com/databricks/cli/experimental/ssh/internal/fuse"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const processStat = "4242 (databricks) S 1 1234 1234 0 -1 4194560 5407 0 0 0 33 12 0 0 20 0 14 0 8613244 1234"
+
+var registration = fuse.Registration{PID: 4242, PIDNamespaceID: 4026531836, StartTime: 8613244}
+
+func TestParseRegistration(t *testing.T) {
+	for _, tc := range []struct {
+		name, namespace, stat, err string
+	}{
+		{name: "valid", namespace: "pid:[4026531836]", stat: processStat},
+		{name: "spaces and parentheses", namespace: "pid:[4026531836]", stat: "4242 (weird ) name)) S 1 1234 1234 0 -1 4194560 5407 0 0 0 33 12 0 0 20 0 14 0 8613244"},
+		{name: "wrong namespace", namespace: "mnt:[4026531836]", stat: processStat, err: "unexpected PID namespace"},
+		{name: "incomplete namespace", namespace: "pid:[4026531836", stat: processStat, err: "unexpected PID namespace"},
+		{name: "empty namespace", namespace: "pid:[]", stat: processStat, err: "failed to parse the PID namespace"},
+		{name: "namespace overflow", namespace: "pid:[4294967296]", stat: processStat, err: "failed to parse the PID namespace"},
+		{name: "missing name", namespace: "pid:[4026531836]", stat: "4242 databricks S 1", err: "missing process name"},
+		{name: "truncated stat", namespace: "pid:[4026531836]", stat: "4242 (databricks) S 1", err: "missing start time"},
+		{name: "invalid time", namespace: "pid:[4026531836]", stat: "4242 (databricks) S 1 1234 1234 0 -1 4194560 5407 0 0 0 33 12 0 0 20 0 14 0 invalid", err: "failed to parse process start time"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			got, err := fuse.ParseRegistration(registration.PID, tc.namespace, tc.stat)
+			if tc.err != "" {
+				require.ErrorContains(t, err, tc.err)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, registration, got)
+		})
+	}
+}
+
+func TestSelf(t *testing.T) {
+	r, err := fuse.Self()
+	if runtime.GOOS != "linux" {
+		require.Error(t, err)
+		return
+	}
+	require.NoError(t, err)
+	assert.Equal(t, os.Getpid(), r.PID)
+	assert.Positive(t, r.PIDNamespaceID)
+	assert.Positive(t, r.StartTime)
+}
diff --git a/experimental/ssh/internal/keys/secrets.go b/experimental/ssh/internal/keys/secrets.go
index 76d44da5387..6409770a4d7 100644
--- a/experimental/ssh/internal/keys/secrets.go
+++ b/experimental/ssh/internal/keys/secrets.go
@@ -7,13 +7,14 @@ import (
 	"fmt"
 
 	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/service/iam"
 	"github.com/databricks/databricks-sdk-go/service/workspace"
 )
 
 // CreateKeysSecretScope creates or retrieves the secret scope for SSH keys.
 // sessionID is the unique identifier for the session (cluster ID for dedicated clusters, connection name for serverless).
 func CreateKeysSecretScope(ctx context.Context, client *databricks.WorkspaceClient, sessionID string) (string, error) {
-	me, err := client.CurrentUser.Me(ctx)
+	me, err := client.CurrentUser.Me(ctx, iam.MeRequest{})
 	if err != nil {
 		return "", fmt.Errorf("failed to get current user: %w", err)
 	}
diff --git a/experimental/ssh/internal/proxy/backpressure_test.go b/experimental/ssh/internal/proxy/backpressure_test.go
new file mode 100644
index 00000000000..b86445db742
--- /dev/null
+++ b/experimental/ssh/internal/proxy/backpressure_test.go
@@ -0,0 +1,187 @@
+package proxy_test
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/databricks/cli/experimental/ssh/internal/proxy"
+	"github.com/gorilla/websocket"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestResumeBackpressure covers a live peer whose acknowledgments arrive after the
+// replay window fills, as happens during IDE startup through the driver proxy.
+func TestResumeBackpressure(t *testing.T) {
+	ctx, cancel := context.WithTimeout(t.Context(), 5*time.Second)
+	defer cancel()
+	const window = 8 << 20
+	pattern := []byte("0123456789abcdef")
+	payload := bytes.Repeat(pattern, 2*window/len(pattern))
+	received := make(chan []byte, 1)
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		upgrader := websocket.Upgrader{}
+		conn, err := upgrader.Upgrade(w, r, nil)
+		if !assert.NoError(t, err) {
+			return
+		}
+		defer conn.Close()
+		stop := context.AfterFunc(ctx, func() { conn.Close() })
+		defer stop()
+		if !assert.NoError(t, conn.WriteMessage(websocket.BinaryMessage, []byte("SSH-2.0-test\r\n"))) {
+			return
+		}
+		var data []byte
+		defer func() { received <- data }()
+		acked := 0
+		for len(data) < len(payload) {
+			mt, frame, err := conn.ReadMessage()
+			if err != nil {
+				return
+			}
+			if mt == websocket.TextMessage {
+				var ack struct {
+					Delivered int `json:"delivered"`
+				}
+				if !assert.NoError(t, json.Unmarshal(frame, &ack)) {
+					return
+				}
+				assert.Equal(t, len("SSH-2.0-test\r\n"), ack.Delivered)
+				continue
+			}
+			if !assert.Equal(t, websocket.BinaryMessage, mt) {
+				return
+			}
+			data = append(data, frame...)
+			if len(data)-acked >= window {
+				// Give the sender time to try to exceed its window before acknowledging.
+				select {
+				case <-time.After(50 * time.Millisecond):
+				case <-ctx.Done():
+					return
+				}
+				if err := conn.WriteJSON(map[string]int{"delivered": len(data)}); err != nil {
+					return
+				}
+				acked = len(data)
+			}
+		}
+		_ = conn.WriteMessage(websocket.CloseMessage, websocket.FormatCloseMessage(websocket.CloseNormalClosure, "finished"))
+	}))
+	defer server.Close()
+	input, writer := io.Pipe()
+	defer input.Close()
+	defer writer.Close()
+	go func() { _, _ = writer.Write(payload) }()
+	err := proxy.RunClientProxy(ctx, input, io.Discard, func() <-chan time.Time { return nil }, time.Hour, true,
+		func(ctx context.Context, req proxy.DialRequest) (*websocket.Conn, error) {
+			conn, resp, err := websocket.DefaultDialer.DialContext(ctx, "ws"+server.URL[4:], nil)
+			if resp != nil {
+				resp.Body.Close()
+			}
+			return conn, err
+		})
+	assert.NoError(t, err)
+	cancel()
+	select {
+	case data := <-received:
+		require.Len(t, data, len(payload), "the live peer received a truncated stream")
+		assert.Equal(t, sha256.Sum256(payload), sha256.Sum256(data))
+	case <-time.After(time.Second):
+		t.Fatal("the peer did not finish")
+	}
+}
+
+type lockedBuffer struct {
+	mu sync.Mutex
+	b  bytes.Buffer
+}
+
+func (b *lockedBuffer) Write(p []byte) (int, error) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	return b.b.Write(p)
+}
+
+func (b *lockedBuffer) bytes() []byte {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	return bytes.Clone(b.b.Bytes())
+}
+
+// TestResumeHandoverWithPendingAck exercises data already in flight when the
+// handover owns the write lock. Reading the close frame must not wait on an ack.
+func TestResumeHandoverWithPendingAck(t *testing.T) {
+	ctx, cancel := context.WithTimeout(t.Context(), 3*time.Second)
+	defer cancel()
+	initial := make(chan *websocket.Conn, 1)
+	ready := make(chan struct{})
+	payload := bytes.Repeat([]byte("x"), 64<<10)
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		conn, err := (&websocket.Upgrader{}).Upgrade(w, r, nil)
+		if !assert.NoError(t, err) {
+			return
+		}
+		defer conn.Close()
+		stop := context.AfterFunc(ctx, func() { conn.Close() })
+		defer stop()
+		select {
+		case old := <-initial:
+			if !assert.NoError(t, old.WriteMessage(websocket.BinaryMessage, payload)) {
+				return
+			}
+			if !assert.NoError(t, old.WriteMessage(websocket.CloseMessage, websocket.FormatCloseMessage(websocket.CloseNormalClosure, "handover"))) {
+				return
+			}
+			if !assert.NoError(t, conn.WriteMessage(websocket.BinaryMessage, []byte("after"))) {
+				return
+			}
+		default:
+			if !assert.NoError(t, conn.WriteMessage(websocket.BinaryMessage, []byte("before"))) {
+				return
+			}
+			initial <- conn
+			close(ready)
+		}
+		for {
+			if _, _, err := conn.ReadMessage(); err != nil {
+				return
+			}
+		}
+	}))
+	defer server.Close()
+	input, writer := io.Pipe()
+	defer input.Close()
+	defer writer.Close()
+	var output lockedBuffer
+	ticks := make(chan time.Time, 1)
+	done := make(chan error, 1)
+	go func() {
+		done <- proxy.RunClientProxy(ctx, input, &output, func() <-chan time.Time { return ticks }, time.Hour, true,
+			func(ctx context.Context, req proxy.DialRequest) (*websocket.Conn, error) {
+				conn, resp, err := websocket.DefaultDialer.DialContext(ctx, "ws"+server.URL[4:], nil)
+				if resp != nil {
+					resp.Body.Close()
+				}
+				return conn, err
+			})
+	}()
+	<-ready
+	ticks <- time.Now()
+	want := append(append([]byte("before"), payload...), []byte("after")...)
+	assert.Eventually(t, func() bool { return bytes.Equal(want, output.bytes()) }, 2*time.Second, time.Millisecond)
+	cancel()
+	select {
+	case <-done:
+	case <-time.After(time.Second):
+		t.Fatal("client did not stop after cancellation")
+	}
+}
diff --git a/experimental/ssh/internal/proxy/client.go b/experimental/ssh/internal/proxy/client.go
index 89be5967c9b..b31c928865c 100644
--- a/experimental/ssh/internal/proxy/client.go
+++ b/experimental/ssh/internal/proxy/client.go
@@ -2,41 +2,210 @@ package proxy
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"io"
+	"sync/atomic"
 	"time"
 
 	"github.com/databricks/cli/libs/log"
+	"github.com/gorilla/websocket"
 	"golang.org/x/sync/errgroup"
 )
 
-func RunClientProxy(ctx context.Context, src io.ReadCloser, dst io.Writer, requestHandoverTick func() <-chan time.Time, createConn createWebsocketConnectionFunc) error {
-	proxy := newProxyConnection(createConn)
+// clientHandshakeTimeout bounds how long the client waits for the first byte from the SSH server
+// after the proxy websocket is established. A healthy sshd sends its identification string
+// immediately (RFC 4253 §4.2), so if nothing arrives the server most likely failed to launch
+// sshd — e.g. the cluster's container image has no OpenSSH server. The server can hold the
+// websocket open in that state, leaving the proxy loops blocked forever, so we bail out instead
+// of letting the ssh client hang until its ConnectTimeout. It is a var so tests can shorten it.
+var clientHandshakeTimeout = 30 * time.Second
+
+var errHandshakeTimeout = errors.New("no response from the SSH server: the cluster's container image may be missing an OpenSSH server (sshd) — ensure 'openssh-server' is installed and check the SSH server job run logs")
+
+// firstByteWriter signals (once) the first time any data is written through it, then forwards
+// transparently. The client uses it to detect that the SSH server has started responding.
+type firstByteWriter struct {
+	w         io.Writer
+	signaled  atomic.Bool
+	firstByte chan struct{}
+}
+
+func (f *firstByteWriter) Write(p []byte) (int, error) {
+	if len(p) > 0 && f.signaled.CompareAndSwap(false, true) {
+		close(f.firstByte)
+	}
+	return f.w.Write(p)
+}
+
+// logPongs wraps a connection factory so every connection it creates — the initial one and each
+// one a handover creates — logs the pongs coming back for our keepalive pings. Debug visibility only:
+// the receiving loop stays the only judge of whether a connection is alive.
+func logPongs(ctx context.Context, createConn createWebsocketConnectionFunc) createWebsocketConnectionFunc {
+	return func(connCtx context.Context, req DialRequest) (*websocket.Conn, error) {
+		conn, err := createConn(connCtx, req)
+		if err != nil {
+			return nil, err
+		}
+		conn.SetPongHandler(func(string) error {
+			log.Debugf(ctx, "Received websocket keepalive pong")
+			return nil
+		})
+		return conn, nil
+	}
+}
+
+// RunClientProxy proxies the SSH byte stream over a websocket to the tunnel server.
+//
+// resumable turns on the resume protocol, which lets a session survive an unexpected disconnect.
+// It must only be set when the server is known to speak it: an older server answers a reattach
+// request by starting a fresh sshd, and replaying into that corrupts the SSH stream instead of
+// repairing it.
+func RunClientProxy(ctx context.Context, src io.ReadCloser, dst io.Writer, requestHandoverTick func() <-chan time.Time, keepaliveInterval time.Duration, resumable bool, createConn createWebsocketConnectionFunc) error {
+	newConnection := newProxyConnection
+	if resumable {
+		newConnection = newResumableProxyConnection
+	}
+	proxy := newConnection(logPongs(ctx, createConn))
 	log.Infof(ctx, "Establishing SSH proxy connection...")
-	g, gCtx := errgroup.WithContext(ctx)
-	if err := proxy.connect(gCtx); err != nil {
-		return fmt.Errorf("failed to connect to proxy: %w", err)
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+	if err := proxy.connect(ctx); err != nil {
+		return errors.Join(ErrConnectFailed, fmt.Errorf("failed to connect to proxy: %w", err))
 	}
 	defer proxy.close()
 	log.Infof(ctx, "SSH proxy connection established")
 
-	g.Go(func() error {
-		for {
-			select {
-			case <-gCtx.Done():
-				return gCtx.Err()
-			case <-requestHandoverTick():
-				err := proxy.initiateHandover(gCtx)
-				if err != nil {
-					return err
+	wrappedDst := &firstByteWriter{w: dst, firstByte: make(chan struct{})}
+
+	// Run the proxy loops in the background. We don't wait on them directly: if the server holds
+	// the websocket open without ever launching sshd, both loops can block forever (the sending
+	// loop on os.Stdin, the receiving loop on ReadMessage), so g.Wait would never return.
+	done := make(chan error, 1)
+	go func() {
+		g, gCtx := errgroup.WithContext(ctx)
+		g.Go(func() error {
+			for {
+				select {
+				case <-gCtx.Done():
+					// Return nil, not gCtx.Err(): this helper loop does not decide the session's
+					// outcome, proxy.start does. proxy.start's goroutine below cancels the context
+					// (its deferred cancel) before the errgroup records proxy.start's return value,
+					// so a gCtx.Err() here can be recorded as the group's first error and mask that
+					// real error — which normalizeProxyError would then swallow into a silent nil.
+					return nil
+				case <-requestHandoverTick():
+					if err := proxy.initiateHandover(gCtx); err != nil {
+						// A handover that never got past its dial leaves the current connection
+						// untouched and still carrying traffic, so ending the session over it
+						// would throw away a working tunnel - the failure mode customers see as
+						// a drop every handover interval. The next tick tries again. Deferring
+						// the auth refresh is safe: the driver proxy authenticates a websocket
+						// at upgrade time, so a live connection is not re-checked. Logged at
+						// debug because nothing changed for the user, and this would otherwise
+						// write into their interactive terminal.
+						if errors.Is(err, errHandoverDialFailed) {
+							log.Debugf(gCtx, "Could not open a replacement connection for the auth handover, staying on the current one: %v", err)
+							continue
+						}
+						// The session ended during the handover: see the gCtx.Done case above.
+						if errors.Is(err, context.Canceled) {
+							return nil
+						}
+						if resumable {
+							// The failed handover closes its sockets. The receiving loop
+							// reattaches after the handover releases the write lock.
+							log.Debugf(gCtx, "Auth handover failed, recovering through session reattachment: %v", err)
+							continue
+						}
+						return errors.Join(ErrHandoverFailed, err)
+					}
+				}
+			}
+		})
+		g.Go(func() error {
+			// Keep the websocket carrying traffic while the SSH session is idle. Both proxy loops
+			// are data-driven, so an idle session puts no frames on the connection at all and the
+			// server side reaps the stream it then considers dead (websocket close 4000).
+			ticker := time.NewTicker(keepaliveInterval)
+			defer ticker.Stop()
+			for {
+				select {
+				case <-gCtx.Done():
+					// nil, not gCtx.Err(): see the handover loop above — a helper stopping must
+					// not mask proxy.start's error as the errgroup's first error.
+					return nil
+				case <-ticker.C:
+					// A ping that ticks during a handover goes to the connection being replaced and
+					// may simply fail. Harmless: a handover establishes a fresh connection, which
+					// resets the peer's idle clock anyway, and the next tick uses the new one.
+					if err := proxy.sendPing(); err != nil {
+						// Not fatal, but not harmless either: gorilla puts the connection into a
+						// permanent write-error state after any failed write, so nothing more can
+						// be sent on it. Reads are unaffected and may still be delivering output
+						// the user is waiting on, so the session is left to end the way it would
+						// anyway — the next write fails and the sending loop reports it.
+						log.Warnf(gCtx, "Failed to send websocket keepalive ping, the connection can no longer send: %v", err)
+					} else {
+						// The driver proxy does not return pongs (verified end to end), so this
+						// line is the only evidence in a customer's log that pings were flowing.
+						log.Debugf(gCtx, "Sent websocket keepalive ping")
+					}
 				}
 			}
+		})
+		g.Go(func() error {
+			// When proxy.start returns (EOF from ssh, or the server closing the connection),
+			// cancel so the handover and keepalive goroutines stop too and g.Wait can return.
+			defer cancel()
+			return proxy.start(gCtx, src, wrappedDst)
+		})
+		done <- g.Wait()
+	}()
+
+	select {
+	case err := <-done:
+		// Session ended before the handshake even started (e.g. the server closed the connection).
+		return normalizeProxyError(err)
+	case <-wrappedDst.firstByte:
+		// The server is responding; the handshake is underway. Wait for the session to finish.
+		return normalizeProxyError(<-done)
+	case <-time.After(clientHandshakeTimeout):
+		// cancel() (deferred) unblocks what it can; the process exits and reclaims any goroutine
+		// still stuck on os.Stdin. ssh then fails fast instead of hanging on its ConnectTimeout.
+		if proxy.droppedConnections() > 0 {
+			// The tunnel connected and then kept dropping, so sshd is not the suspect: pointing
+			// the user at a missing openssh-server here sends them to the wrong place, and bills
+			// a network failure to the wrong telemetry category.
+			return errors.Join(ErrWebsocketDropped,
+				fmt.Errorf("the tunnel connection dropped %d time(s) before the SSH server responded", proxy.droppedConnections()))
+		}
+		return errHandshakeTimeout
+	case <-ctx.Done():
+		// proxy.start cancels this context from its own deferred cancel, so it always fires just
+		// before g.Wait delivers the session's outcome. Without waiting for that outcome, every
+		// session that ends before the SSH server's first byte - a drop during the handshake, a
+		// reattach the server refused - is reported as a clean exit: the user sees no reason and
+		// telemetry records no category. Bounded so a wedged loop still cannot hang the exit.
+		select {
+		case err := <-done:
+			return normalizeProxyError(err)
+		case <-time.After(proxyExitGrace):
+			return nil
 		}
-	})
+	}
+}
 
-	g.Go(func() error {
-		return proxy.start(gCtx, src, dst)
-	})
+// proxyExitGrace bounds how long the exit path waits for the session's outcome once the context is
+// cancelled. The outcome is already in flight by then, so this only matters if a proxy loop is
+// wedged, and then reporting nothing beats hanging.
+const proxyExitGrace = 5 * time.Second
 
-	return g.Wait()
+// normalizeProxyError treats a clean finish or a context cancellation (our own exit signal, or the
+// user interrupting) as success; anything else is a real proxy error.
+func normalizeProxyError(err error) error {
+	if err == nil || errors.Is(err, context.Canceled) {
+		return nil
+	}
+	return err
 }
diff --git a/experimental/ssh/internal/proxy/client_server_test.go b/experimental/ssh/internal/proxy/client_server_test.go
index 186cf6b6579..d215612c151 100644
--- a/experimental/ssh/internal/proxy/client_server_test.go
+++ b/experimental/ssh/internal/proxy/client_server_test.go
@@ -8,9 +8,11 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"net/http"
 	"net/http/httptest"
 	"os/exec"
 	"sync"
+	"sync/atomic"
 	"testing"
 	"time"
 
@@ -32,29 +34,36 @@ func createTestServer(t *testing.T, maxClients int, shutdownDelay time.Duration)
 }
 
 type testClient struct {
-	InputWriter io.WriteCloser
+	InputWriter *io.PipeWriter
 	Output      *testBuffer
-	Cleanup     func()
+	// Done is closed when RunClientProxy returns.
+	Done    <-chan struct{}
+	Cleanup func()
 }
 
-func createTestClient(t *testing.T, serverURL string, requestHandoverTick func() <-chan time.Time, errChan chan error) *testClient {
-	ctx := cmdio.MockDiscard(t.Context())
-	clientInput, clientInputWriter := io.Pipe()
-	clientOutput := newTestBuffer(t)
+func createTestClient(t *testing.T, serverURL string, requestHandoverTick func() <-chan time.Time, keepaliveInterval time.Duration, errChan chan error) *testClient {
 	wsURL := "ws" + serverURL[4:]
-	createConn := func(ctx context.Context, connID string) (*websocket.Conn, error) {
-		url := fmt.Sprintf("%s?id=%s", wsURL, connID)
+	createConn := func(ctx context.Context, dial DialRequest) (*websocket.Conn, error) {
+		url := fmt.Sprintf("%s?id=%s", wsURL, dial.ConnID)
 		conn, _, err := websocket.DefaultDialer.Dial(url, nil) // nolint:bodyclose
 		return conn, err
 	}
+	return createTestClientWithDialer(t, createConn, requestHandoverTick, keepaliveInterval, false, errChan)
+}
+
+// createTestClientWithDialer is createTestClient with the websocket dialer supplied by the caller,
+// so a test can control which dials succeed - the initial connection's or a handover's.
+func createTestClientWithDialer(t *testing.T, createConn createWebsocketConnectionFunc, requestHandoverTick func() <-chan time.Time, keepaliveInterval time.Duration, resumable bool, errChan chan error) *testClient {
+	ctx := cmdio.MockDiscard(t.Context())
+	clientInput, clientInputWriter := io.Pipe()
+	clientOutput := newTestBuffer(t)
 	if requestHandoverTick == nil {
-		requestHandoverTick = func() <-chan time.Time {
-			return time.After(time.Hour)
-		}
+		requestHandoverTick = neverTick
 	}
-	wg := sync.WaitGroup{}
-	wg.Go(func() {
-		err := RunClientProxy(ctx, clientInput, clientOutput, requestHandoverTick, createConn)
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		err := RunClientProxy(ctx, clientInput, clientOutput, requestHandoverTick, keepaliveInterval, resumable, createConn)
 		if err != nil && !errors.Is(err, context.Canceled) && !errors.Is(err, io.ErrClosedPipe) {
 			if errChan != nil {
 				errChan <- err
@@ -62,14 +71,15 @@ func createTestClient(t *testing.T, serverURL string, requestHandoverTick func()
 				t.Errorf("client error: %v", err)
 			}
 		}
-	})
+	}()
 	return &testClient{
 		InputWriter: clientInputWriter,
 		Output:      clientOutput,
+		Done:        done,
 		Cleanup: func() {
 			clientInput.Close()
 			clientInputWriter.Close()
-			wg.Wait()
+			<-done
 		},
 	}
 }
@@ -77,7 +87,7 @@ func createTestClient(t *testing.T, serverURL string, requestHandoverTick func()
 func TestClientServerEcho(t *testing.T) {
 	server := createTestServer(t, 2, time.Hour)
 	defer server.Close()
-	client := createTestClient(t, server.URL, nil, nil)
+	client := createTestClient(t, server.URL, nil, time.Hour, nil)
 	defer client.Cleanup()
 
 	testMsg1 := []byte("test message 1\n")
@@ -99,9 +109,9 @@ func TestClientServerEcho(t *testing.T) {
 func TestMultipleClients(t *testing.T) {
 	server := createTestServer(t, 2, time.Hour)
 	defer server.Close()
-	client1 := createTestClient(t, server.URL, nil, nil)
+	client1 := createTestClient(t, server.URL, nil, time.Hour, nil)
 	defer client1.Cleanup()
-	client2 := createTestClient(t, server.URL, nil, nil)
+	client2 := createTestClient(t, server.URL, nil, time.Hour, nil)
 	defer client2.Cleanup()
 
 	messageCount := 10
@@ -130,9 +140,9 @@ func TestMaxClients(t *testing.T) {
 	maxClients := 2
 	server := createTestServer(t, maxClients, time.Hour)
 	defer server.Close()
-	client1 := createTestClient(t, server.URL, nil, nil)
+	client1 := createTestClient(t, server.URL, nil, time.Hour, nil)
 	defer client1.Cleanup()
-	client2 := createTestClient(t, server.URL, nil, nil)
+	client2 := createTestClient(t, server.URL, nil, time.Hour, nil)
 	defer client2.Cleanup()
 
 	testMsg1 := []byte("test message 1\n")
@@ -146,7 +156,7 @@ func TestMaxClients(t *testing.T) {
 	require.NoError(t, err)
 
 	errChan := make(chan error, 1)
-	client3 := createTestClient(t, server.URL, nil, errChan)
+	client3 := createTestClient(t, server.URL, nil, time.Hour, errChan)
 	defer client3.Cleanup()
 	select {
 	case err = <-errChan:
@@ -157,6 +167,17 @@ func TestMaxClients(t *testing.T) {
 }
 
 func TestHandover(t *testing.T) {
+	t.Run("without keepalive", func(t *testing.T) {
+		runHandoverExchange(t, time.Hour)
+	})
+	// Pings and the data stream share the connection's write lock: they must not corrupt or reorder
+	// the stream, nor trip gorilla's concurrent-write panic.
+	t.Run("with keepalive", func(t *testing.T) {
+		runHandoverExchange(t, time.Millisecond)
+	})
+}
+
+func runHandoverExchange(t *testing.T, keepaliveInterval time.Duration) {
 	server := createTestServer(t, 2, time.Hour)
 	defer server.Close()
 
@@ -164,7 +185,7 @@ func TestHandover(t *testing.T) {
 	requestHandoverTick := func() <-chan time.Time {
 		return handoverChan
 	}
-	client := createTestClient(t, server.URL, requestHandoverTick, nil)
+	client := createTestClient(t, server.URL, requestHandoverTick, keepaliveInterval, nil)
 	defer client.Cleanup()
 
 	var expectedOutput []byte
@@ -203,7 +224,7 @@ func TestQuickHandover(t *testing.T) {
 	requestHandoverTick := func() <-chan time.Time {
 		return handoverChan
 	}
-	client := createTestClient(t, server.URL, requestHandoverTick, nil)
+	client := createTestClient(t, server.URL, requestHandoverTick, time.Hour, nil)
 	defer client.Cleanup()
 
 	var expectedOutput []byte
@@ -230,3 +251,314 @@ func TestQuickHandover(t *testing.T) {
 
 	assert.Equal(t, string(expectedOutput), client.Output.String())
 }
+
+// A handover that fails while dialing its replacement connection must not end the session: the
+// connection it was meant to replace is still live and carrying traffic. Until this was handled,
+// a single transient dial failure - a token refresh, a DNS blip, a proxy stumble - dropped an
+// otherwise healthy session once every handover interval.
+func TestHandoverDialFailureKeepsSessionAlive(t *testing.T) {
+	server := createTestServer(t, 2, time.Hour)
+	defer server.Close()
+
+	wsURL := "ws" + server.URL[4:]
+	var dials atomic.Int32
+	// Signalled the instant a handover dial is attempted (and made to fail). initiateHandover
+	// already holds handoverMutex by the time it dials, so a receive here proves the handover
+	// goroutine has entered the dial and taken the mutex. Buffered and sent non-blockingly so the
+	// dialer never stalls on it even if more dials than expected occur.
+	handoverDialAttempted := make(chan struct{}, 1)
+	createConn := func(ctx context.Context, dial DialRequest) (*websocket.Conn, error) {
+		// Let the initial connection through and fail every handover dial after it.
+		if dials.Add(1) > 1 {
+			select {
+			case handoverDialAttempted <- struct{}{}:
+			default:
+			}
+			return nil, errors.New("simulated transient dial failure")
+		}
+		url := fmt.Sprintf("%s?id=%s", wsURL, dial.ConnID)
+		conn, _, err := websocket.DefaultDialer.Dial(url, nil) // nolint:bodyclose
+		return conn, err
+	}
+
+	handoverChan := make(chan time.Time)
+	errChan := make(chan error, 1)
+	client := createTestClientWithDialer(t, createConn, func() <-chan time.Time {
+		return handoverChan
+	}, time.Hour, false, errChan)
+	defer client.Cleanup()
+
+	beforeMsg := []byte("before handover\n")
+	_, err := client.InputWriter.Write(beforeMsg)
+	require.NoError(t, err)
+	require.NoError(t, client.Output.AssertWrite(beforeMsg))
+
+	handoverChan <- time.Now()
+
+	// Completing the tick send only proves the handover goroutine received the tick; it does not
+	// prove it acquired handoverMutex and reached the dial. Wait for the dial to actually be
+	// attempted before sending more traffic - otherwise the payload below can traverse the
+	// original connection before the handover even starts, which is the macOS "dials == 1" flake.
+	select {
+	case <-handoverDialAttempted:
+	case <-time.After(10 * time.Second):
+		t.Fatal("the handover never attempted its replacement dial")
+	}
+
+	// The original connection must still be proxying both ways. sendMessage blocks on the
+	// handover mutex, so this write cannot overtake the failed handover.
+	afterMsg := []byte("after failed handover\n")
+	_, err = client.InputWriter.Write(afterMsg)
+	require.NoError(t, err)
+	require.NoError(t, client.Output.AssertWrite(afterMsg))
+
+	select {
+	case err := <-errChan:
+		t.Fatalf("session ended after a failed handover dial: %v", err)
+	default:
+	}
+	assert.Equal(t, int32(2), dials.Load(), "expected the initial dial plus exactly one handover dial")
+}
+
+// A failed dial never touches the live connection, whatever error it returns, so the handover loop
+// must check for it before it treats context.Canceled as the session ending. Later ticks must still
+// hand over.
+func TestHandoverDialCanceledKeepsHandingOver(t *testing.T) {
+	server := createTestServer(t, 2, time.Hour)
+	defer server.Close()
+
+	wsURL := "ws" + server.URL[4:]
+	var dials atomic.Int32
+	handoverDialed := make(chan struct{}, 2)
+	createConn := func(ctx context.Context, dial DialRequest) (*websocket.Conn, error) {
+		n := dials.Add(1)
+		if n > 1 {
+			handoverDialed <- struct{}{}
+		}
+		if n == 2 {
+			return nil, context.Canceled
+		}
+		url := fmt.Sprintf("%s?id=%s", wsURL, dial.ConnID)
+		conn, _, err := websocket.DefaultDialer.Dial(url, nil) // nolint:bodyclose
+		return conn, err
+	}
+
+	handoverChan := make(chan time.Time)
+	client := createTestClientWithDialer(t, createConn, func() <-chan time.Time {
+		return handoverChan
+	}, time.Hour, false, nil)
+	defer client.Cleanup()
+
+	for i := range 2 {
+		select {
+		case handoverChan <- time.Now():
+		case <-time.After(10 * time.Second):
+			t.Fatalf("handover %d was never started: the handover loop has stopped", i+1)
+		}
+		// The tick only proves the loop received it. Wait for the dial, which runs under the
+		// handover mutex, so the write below cannot overtake the handover.
+		select {
+		case <-handoverDialed:
+		case <-time.After(10 * time.Second):
+			t.Fatalf("handover %d never dialed", i+1)
+		}
+		// sendMessage waits for the handover mutex, so this round trip also waits out the handover.
+		msg := fmt.Appendf(nil, "after handover %d\n", i+1)
+		_, err := client.InputWriter.Write(msg)
+		require.NoError(t, err)
+		require.NoError(t, client.Output.AssertWrite(msg))
+	}
+	assert.Equal(t, int32(3), dials.Load(), "expected the initial dial plus two handover dials")
+}
+
+// rawDrainServer accepts a websocket and reads its raw bytes without processing any frame, so it never
+// answers anything, not even a close frame.
+func rawDrainServer(t *testing.T) *httptest.Server {
+	return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		conn, err := (&websocket.Upgrader{}).Upgrade(w, r, nil)
+		if err != nil {
+			return
+		}
+		defer conn.Close()
+		_, _ = io.Copy(io.Discard, conn.NetConn())
+	}))
+}
+
+// A session that ends while a handover is still waiting for the old connection to close must end
+// with the session's own outcome, not ErrHandoverFailed, and must not start another handover.
+func TestSessionEndDuringHandover(t *testing.T) {
+	errSourceFailed := errors.New("source failed")
+	tests := []struct {
+		name       string
+		resumable  bool
+		endSession func(w *io.PipeWriter)
+		wantErr    error
+	}{
+		{
+			name:       "clean exit",
+			endSession: func(w *io.PipeWriter) { w.Close() },
+		},
+		{
+			name:       "source error",
+			endSession: func(w *io.PipeWriter) { w.CloseWithError(errSourceFailed) },
+			wantErr:    errSourceFailed,
+		},
+		{
+			name:       "resumable clean exit",
+			resumable:  true,
+			endSession: func(w *io.PipeWriter) { w.Close() },
+		},
+		{
+			name:       "resumable source error",
+			resumable:  true,
+			endSession: func(w *io.PipeWriter) { w.CloseWithError(errSourceFailed) },
+			wantErr:    errSourceFailed,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Both connections land on a server that never answers, so nobody closes the old
+			// connection and the handover stays in progress until the session ends. It does not
+			// even echo the close frame of the client's teardown: an echo that arrived before
+			// teardown closed the socket would complete the swap instead.
+			server := rawDrainServer(t)
+			defer server.Close()
+
+			wsURL := "ws" + server.URL[4:]
+			var dials atomic.Int32
+			handoverDialed := make(chan struct{}, 1)
+			createConn := func(ctx context.Context, dial DialRequest) (*websocket.Conn, error) {
+				isHandover := dials.Add(1) > 1
+				conn, _, err := websocket.DefaultDialer.Dial(wsURL, nil) // nolint:bodyclose
+				// Only a successful dial leaves the handover in progress.
+				if isHandover && err == nil {
+					select {
+					case handoverDialed <- struct{}{}:
+					default:
+					}
+				}
+				return conn, err
+			}
+
+			// The second tick waits in the channel while the first handover is in progress, so a
+			// handover loop that keeps going after the session ended dials again.
+			ticks := make(chan time.Time, 2)
+			ticks <- time.Now()
+			ticks <- time.Now()
+			errChan := make(chan error, 1)
+			client := createTestClientWithDialer(t, createConn, func() <-chan time.Time {
+				return ticks
+			}, time.Hour, tt.resumable, errChan)
+			defer client.Cleanup()
+
+			select {
+			case <-handoverDialed:
+			case <-time.After(10 * time.Second):
+				t.Fatal("the handover never dialed its replacement connection")
+			}
+
+			// Wait for the session to end before Cleanup closes the reader too: a read that
+			// wakes up after that returns io.ErrClosedPipe instead of what endSession set.
+			tt.endSession(client.InputWriter)
+			select {
+			case <-client.Done:
+			case <-time.After(10 * time.Second):
+				t.Fatal("the session did not end")
+			}
+			var sessionErr error
+			select {
+			case sessionErr = <-errChan:
+			default:
+			}
+			assert.Equal(t, int32(2), dials.Load(), "expected no handover after the session ended")
+			if tt.wantErr == nil {
+				assert.NoError(t, sessionErr)
+				return
+			}
+			assert.ErrorIs(t, sessionErr, tt.wantErr)
+			assert.NotErrorIs(t, sessionErr, ErrHandoverFailed)
+		})
+	}
+}
+
+// TestClientExitsWhenServerCommandFails reproduces the missing-sshd case: the server accepts the
+// websocket but can't launch its command, so it closes the connection immediately. The client
+// proxy must exit promptly instead of hanging on the handover goroutine (which would leave the
+// ssh client waiting until its ConnectTimeout).
+func TestClientExitsWhenServerCommandFails(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	connections := NewConnectionsManager(2, time.Hour)
+	server := httptest.NewServer(NewProxyServer(ctx, connections, func(ctx context.Context) *exec.Cmd {
+		// A binary that does not exist: serverCmd.Start() fails, mirroring a missing /usr/sbin/sshd.
+		return exec.CommandContext(ctx, "databricks-ssh-nonexistent-binary")
+	}))
+	defer server.Close()
+
+	wsURL := "ws" + server.URL[4:]
+	createConn := func(ctx context.Context, dial DialRequest) (*websocket.Conn, error) {
+		conn, _, err := websocket.DefaultDialer.Dial(fmt.Sprintf("%s?id=%s", wsURL, dial.ConnID), nil) // nolint:bodyclose
+		return conn, err
+	}
+	// Source is never closed by the test; only the server-side close must drive the client to exit.
+	src, _ := io.Pipe()
+	requestHandoverTick := func() <-chan time.Time { return time.After(time.Hour) }
+
+	done := make(chan error, 1)
+	go func() {
+		done <- RunClientProxy(ctx, src, io.Discard, requestHandoverTick, time.Hour, false, createConn)
+	}()
+
+	select {
+	case <-done:
+		// Returned promptly after the server closed the connection — no hang.
+	case <-time.After(10 * time.Second):
+		t.Fatal("RunClientProxy hung after the server closed the connection")
+	}
+}
+
+// TestClientTimesOutWhenServerSendsNothing reproduces the harder missing-sshd case: the server
+// accepts the websocket but holds it open without ever sending the SSH banner (the real server
+// does this after failing to launch sshd). The client must abort on the handshake timeout rather
+// than block forever on its read loops.
+func TestClientTimesOutWhenServerSendsNothing(t *testing.T) {
+	original := clientHandshakeTimeout
+	clientHandshakeTimeout = 300 * time.Millisecond
+	defer func() { clientHandshakeTimeout = original }()
+
+	ctx := cmdio.MockDiscard(t.Context())
+	upgrader := websocket.Upgrader{}
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		conn, err := upgrader.Upgrade(w, r, nil)
+		if err != nil {
+			return
+		}
+		defer conn.Close()
+		// Hold the connection open, sending nothing, until the client goes away.
+		for {
+			if _, _, err := conn.ReadMessage(); err != nil {
+				return
+			}
+		}
+	}))
+	defer server.Close()
+
+	wsURL := "ws" + server.URL[4:]
+	createConn := func(ctx context.Context, dial DialRequest) (*websocket.Conn, error) {
+		conn, _, err := websocket.DefaultDialer.Dial(fmt.Sprintf("%s?id=%s", wsURL, dial.ConnID), nil) // nolint:bodyclose
+		return conn, err
+	}
+	src, _ := io.Pipe()
+	requestHandoverTick := func() <-chan time.Time { return time.After(time.Hour) }
+
+	done := make(chan error, 1)
+	go func() {
+		done <- RunClientProxy(ctx, src, io.Discard, requestHandoverTick, time.Hour, false, createConn)
+	}()
+
+	select {
+	case err := <-done:
+		require.ErrorIs(t, err, errHandshakeTimeout)
+	case <-time.After(10 * time.Second):
+		t.Fatal("RunClientProxy did not abort on the handshake timeout")
+	}
+}
diff --git a/experimental/ssh/internal/proxy/connections.go b/experimental/ssh/internal/proxy/connections.go
index 96194fa430e..3e3991571dc 100644
--- a/experimental/ssh/internal/proxy/connections.go
+++ b/experimental/ssh/internal/proxy/connections.go
@@ -24,7 +24,7 @@ func NewConnectionsManager(maxClients int, shutdownDelay time.Duration) *Connect
 		connections:   make(map[string]*proxyConnection),
 		TimedOut:      make(chan bool),
 	}
-	cm.startShutdownTimer()
+	cm.startShutdownTimer(shutdownDelay)
 	return cm
 }
 
@@ -61,7 +61,7 @@ func (cm *ConnectionsManager) Remove(id string) {
 	cm.removeConnection(id)
 	count := cm.Count()
 	if count <= 0 {
-		cm.startShutdownTimer()
+		cm.startShutdownTimer(cm.shutdownDelay)
 	}
 }
 
@@ -71,13 +71,21 @@ func (cm *ConnectionsManager) removeConnection(id string) {
 	delete(cm.connections, id)
 }
 
-func (cm *ConnectionsManager) startShutdownTimer() {
+func (cm *ConnectionsManager) ExtendIdleTimeout(delay time.Duration) {
+	cm.connectionsMu.Lock()
+	defer cm.connectionsMu.Unlock()
+	if len(cm.connections) == 0 {
+		cm.startShutdownTimer(delay)
+	}
+}
+
+func (cm *ConnectionsManager) startShutdownTimer(delay time.Duration) {
 	cm.shutdownTimerMu.Lock()
 	defer cm.shutdownTimerMu.Unlock()
 	if cm.shutdownTimer != nil {
 		cm.shutdownTimer.Stop()
 	}
-	cm.shutdownTimer = time.AfterFunc(cm.shutdownDelay, func() {
+	cm.shutdownTimer = time.AfterFunc(delay, func() {
 		cm.TimedOut <- true
 	})
 }
diff --git a/experimental/ssh/internal/proxy/connections_idle_test.go b/experimental/ssh/internal/proxy/connections_idle_test.go
new file mode 100644
index 00000000000..6c1c0b7c122
--- /dev/null
+++ b/experimental/ssh/internal/proxy/connections_idle_test.go
@@ -0,0 +1,29 @@
+package proxy_test
+
+import (
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/databricks/cli/experimental/ssh/internal/proxy"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestConnectionsManagerExtendIdleTimeout(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		connections := proxy.NewConnectionsManager(1, time.Minute)
+		connections.ExtendIdleTimeout(time.Second)
+		time.Sleep(time.Second)
+		assert.True(t, <-connections.TimedOut)
+		require.True(t, connections.TryAdd("connected", nil))
+		connections.ExtendIdleTimeout(time.Second)
+		time.Sleep(time.Minute)
+		synctest.Wait()
+		select {
+		case <-connections.TimedOut:
+			t.Fatal("extended timeout fired while a client was connected")
+		default:
+		}
+	})
+}
diff --git a/experimental/ssh/internal/proxy/drop_test.go b/experimental/ssh/internal/proxy/drop_test.go
new file mode 100644
index 00000000000..a5162879182
--- /dev/null
+++ b/experimental/ssh/internal/proxy/drop_test.go
@@ -0,0 +1,163 @@
+//go:build !windows
+
+package proxy
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/gorilla/websocket"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// tcpRelay stands in for the workspace front door: it forwards TCP between the client and the
+// SSH proxy server, and can reset the client leg the way a load balancer recycling a target
+// does. httptest's own CloseClientConnections is no use here - it does not touch the hijacked
+// connections a websocket upgrade leaves behind.
+type tcpRelay struct {
+	listener    net.Listener
+	upstream    string
+	mu          sync.Mutex
+	clientConns []*net.TCPConn
+}
+
+func newTCPRelay(t *testing.T, upstream string) *tcpRelay {
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	relay := &tcpRelay{listener: listener, upstream: upstream}
+	t.Cleanup(func() { listener.Close() })
+	go relay.serve()
+	return relay
+}
+
+func (r *tcpRelay) serve() {
+	for {
+		downstream, err := r.listener.Accept()
+		if err != nil {
+			return
+		}
+		upstream, err := net.Dial("tcp", r.upstream)
+		if err != nil {
+			downstream.Close()
+			return
+		}
+		r.mu.Lock()
+		r.clientConns = append(r.clientConns, downstream.(*net.TCPConn))
+		r.mu.Unlock()
+		// Both directions end with the connection being torn down, so a copy error is the
+		// expected way for these to finish.
+		go func() {
+			_, _ = io.Copy(upstream, downstream)
+			upstream.Close()
+		}()
+		go func() {
+			_, _ = io.Copy(downstream, upstream)
+			downstream.Close()
+		}()
+	}
+}
+
+// resetClients sends a TCP RST on every client leg, so the client's next read fails with
+// "connection reset by peer" rather than seeing a clean close. SetLinger is asserted: without
+// it the close is graceful and the test would exercise the wrong path. Connections are taken off
+// the list as they are reset, so a later call only touches legs opened since.
+func (r *tcpRelay) resetClients(t *testing.T) {
+	r.mu.Lock()
+	conns := r.clientConns
+	r.clientConns = nil
+	r.mu.Unlock()
+	for _, conn := range conns {
+		require.NoError(t, conn.SetLinger(0))
+		require.NoError(t, conn.Close())
+	}
+}
+
+// createResumableTestClient builds a client with the resume protocol enabled, dialing through a
+// URL that mirrors the production one: the delivered offset rides along on every dial, and a
+// reattach says so explicitly.
+func createResumableTestClient(t *testing.T, serverURL string, errChan chan error) *testClient {
+	wsURL := "ws" + serverURL[4:]
+	createConn := func(ctx context.Context, dial DialRequest) (*websocket.Conn, error) {
+		url := fmt.Sprintf("%s?id=%s", wsURL, dial.ConnID)
+		if dial.ResumeCapable {
+			url += fmt.Sprintf("&resume_version=2&delivered=%d", dial.Delivered)
+			if dial.Reattach {
+				url += "&reattach=1"
+			}
+		}
+		conn, _, err := websocket.DefaultDialer.Dial(url, nil) // nolint:bodyclose
+		return conn, err
+	}
+	return createTestClientWithDialer(t, createConn, nil, time.Hour, true, errChan)
+}
+
+// URL returns the relay's address in the http form createTestClient expects.
+func (r *tcpRelay) URL() string {
+	return "http://" + r.listener.Addr().String()
+}
+
+// A mid-session reset on a connection without resume negotiated must end the session and surface
+// as ErrWebsocketDropped. Both halves matter: telemetry needs to tell a dropped session apart from
+// a clean exit, and this is also the fallback a client talking to an older server relies on, so it
+// has to keep working unchanged.
+func TestMidSessionResetIsAttributedAsADrop(t *testing.T) {
+	server := createTestServer(t, 2, time.Hour)
+	defer server.Close()
+
+	relay := newTCPRelay(t, server.Listener.Addr().String())
+
+	errChan := make(chan error, 1)
+	client := createTestClient(t, relay.URL(), nil, time.Hour, errChan)
+	defer client.Cleanup()
+
+	msg := []byte("before drop\n")
+	_, err := client.InputWriter.Write(msg)
+	require.NoError(t, err)
+	require.NoError(t, client.Output.AssertWrite(msg))
+
+	relay.resetClients(t)
+
+	select {
+	case err := <-errChan:
+		assert.ErrorIs(t, err, ErrWebsocketDropped)
+	case <-time.After(10 * time.Second):
+		t.Fatal("the client proxy did not report the dropped connection")
+	}
+}
+
+// The error that ends a session must survive the cancellation it triggers. proxy.start cancels the
+// context before errgroup records its error, so the handover and keepalive goroutines wake up and
+// return first; if they reported the cancellation as their own error, errgroup would keep that one
+// and normalizeProxyError would turn a dropped session into a clean exit. The window is small, so
+// this runs the drop repeatedly rather than once.
+func TestADropIsNeverReportedAsACleanExit(t *testing.T) {
+	for attempt := range 25 {
+		server := createTestServer(t, 2, time.Hour)
+		relay := newTCPRelay(t, server.Listener.Addr().String())
+
+		errChan := make(chan error, 1)
+		client := createTestClient(t, relay.URL(), nil, time.Hour, errChan)
+
+		msg := []byte("before drop\n")
+		_, err := client.InputWriter.Write(msg)
+		require.NoError(t, err)
+		require.NoError(t, client.Output.AssertWrite(msg))
+
+		relay.resetClients(t)
+
+		select {
+		case err := <-errChan:
+			require.ErrorIs(t, err, ErrWebsocketDropped, "attempt %d", attempt)
+		case <-time.After(10 * time.Second):
+			t.Fatalf("attempt %d: the drop was reported as a clean exit", attempt)
+		}
+		client.Cleanup()
+		server.Close()
+	}
+}
diff --git a/experimental/ssh/internal/proxy/handover_teardown_test.go b/experimental/ssh/internal/proxy/handover_teardown_test.go
new file mode 100644
index 00000000000..46580d86b73
--- /dev/null
+++ b/experimental/ssh/internal/proxy/handover_teardown_test.go
@@ -0,0 +1,236 @@
+package proxy
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/gorilla/websocket"
+	"github.com/stretchr/testify/require"
+)
+
+// closeSignalingSource reports when the proxy closes it, which happens during the proxy's teardown.
+type closeSignalingSource struct {
+	io.ReadCloser
+	closed chan struct{}
+}
+
+func (s *closeSignalingSource) Close() error {
+	err := s.ReadCloser.Close()
+	close(s.closed)
+	return err
+}
+
+// The receiving loop also runs on the server. If sshd's stdout ends while the server reads the
+// client's normal close acknowledgment for a handover, the server must still finish the swap, so its
+// teardown closes the replacement connection gracefully and the client sees a clean exit.
+func TestServerEOFDuringHandoverIsACleanExit(t *testing.T) {
+	ctx, cancel := context.WithTimeout(t.Context(), 5*time.Second)
+	defer cancel()
+	serverProxy := newProxyConnection(nil)
+	serverInput, serverWriter := io.Pipe()
+	defer serverWriter.Close()
+	source := &closeSignalingSource{ReadCloser: serverInput, closed: make(chan struct{})}
+	serverReady := make(chan struct{})
+	ackReceived := make(chan struct{})
+	releaseAck := make(chan struct{})
+	serverDone := make(chan error, 1)
+	handoverDone := make(chan error, 1)
+	var accepted atomic.Bool
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if !accepted.CompareAndSwap(false, true) {
+			handoverDone <- serverProxy.acceptHandover(ctx, w, r)
+			return
+		}
+		if err := serverProxy.accept(w, r); err != nil {
+			serverDone <- err
+			return
+		}
+		// Hold the receiving loop right after it reads the client's close acknowledgment, until
+		// the server's source has ended and its teardown has started.
+		conn := serverProxy.conn.Load()
+		defaultCloseHandler := conn.CloseHandler()
+		conn.SetCloseHandler(func(code int, text string) error {
+			err := defaultCloseHandler(code, text)
+			close(ackReceived)
+			select {
+			case <-releaseAck:
+			case <-ctx.Done():
+			}
+			return err
+		})
+		close(serverReady)
+		// Mirrors runServerProxy.
+		err := serverProxy.start(ctx, source, io.Discard)
+		closeProxyConnection(ctx, serverProxy)
+		serverDone <- err
+	}))
+	defer server.Close()
+
+	clientInput, clientWriter := io.Pipe()
+	defer clientWriter.Close()
+	clientOutput := newTestBuffer(t)
+	ticks := make(chan time.Time, 1)
+	clientDone := make(chan error, 1)
+	go func() {
+		clientDone <- RunClientProxy(ctx, clientInput, clientOutput, func() <-chan time.Time { return ticks }, time.Hour, false,
+			func(dialCtx context.Context, _ DialRequest) (*websocket.Conn, error) {
+				conn, _, err := websocket.DefaultDialer.DialContext(dialCtx, "ws"+server.URL[4:], nil) // nolint:bodyclose
+				return conn, err
+			})
+	}()
+
+	select {
+	case <-serverReady:
+	case <-ctx.Done():
+		t.Fatal("the server did not accept the connection")
+	}
+	// The client waits for the server's first byte before it treats the session as started. Wait
+	// until the client has it: the write only proves the sending loop read it, and a handover that
+	// takes the mutex before the sending loop sends it would block the loop from reading the EOF.
+	banner := []byte("SSH-2.0-test\r\n")
+	_, err := serverWriter.Write(banner)
+	require.NoError(t, err)
+	require.NoError(t, clientOutput.WaitForWrite(banner))
+	ticks <- time.Now()
+	select {
+	case <-ackReceived:
+	case <-ctx.Done():
+		t.Fatal("the server did not receive the handover close acknowledgment")
+	}
+	require.NoError(t, serverWriter.Close())
+	select {
+	case <-source.closed:
+	case <-ctx.Done():
+		t.Fatal("the server did not start its teardown")
+	}
+	close(releaseAck)
+
+	select {
+	case <-handoverDone:
+	case <-ctx.Done():
+		t.Fatal("the server handover did not finish")
+	}
+	select {
+	case err := <-serverDone:
+		require.NoError(t, err)
+	case <-ctx.Done():
+		t.Fatal("the server did not finish")
+	}
+	select {
+	case err := <-clientDone:
+		require.NoError(t, err, "a clean server exit during a handover must be a clean client exit")
+	case <-ctx.Done():
+		t.Fatal("the client did not finish")
+	}
+}
+
+// If the client's input ends while its receiving loop holds the server's normal handover close, the
+// client must still complete the swap: its exit then sends the resumable "finished" close on the
+// replacement connection, and the server ends the session at once instead of waiting for a reattach.
+func TestClientEOFDuringHandoverReleasesServer(t *testing.T) {
+	ctx, cancel := context.WithTimeout(t.Context(), 5*time.Second)
+	defer cancel()
+	serverProxy := newResumableProxyConnection(nil)
+	serverInput, serverWriter := io.Pipe()
+	defer serverWriter.Close()
+	serverReady := make(chan struct{})
+	serverDone := make(chan error, 1)
+	handoverDone := make(chan error, 1)
+	var accepted atomic.Bool
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if !accepted.CompareAndSwap(false, true) {
+			handoverDone <- serverProxy.acceptHandover(ctx, w, r)
+			return
+		}
+		if err := serverProxy.accept(w, r); err != nil {
+			serverDone <- err
+			return
+		}
+		close(serverReady)
+		// Mirrors runServerProxy.
+		err := serverProxy.start(ctx, serverInput, io.Discard)
+		closeProxyConnection(ctx, serverProxy)
+		serverDone <- err
+	}))
+	defer server.Close()
+
+	clientInput, clientWriter := io.Pipe()
+	defer clientWriter.Close()
+	clientSource := &closeSignalingSource{ReadCloser: clientInput, closed: make(chan struct{})}
+	clientOutput := newTestBuffer(t)
+	ticks := make(chan time.Time, 1)
+	clientDone := make(chan error, 1)
+	ackSent := make(chan struct{})
+	releaseAck := make(chan struct{})
+	var dials atomic.Int32
+	go func() {
+		clientDone <- RunClientProxy(ctx, clientSource, clientOutput, func() <-chan time.Time { return ticks }, time.Hour, true,
+			func(dialCtx context.Context, _ DialRequest) (*websocket.Conn, error) {
+				conn, _, err := websocket.DefaultDialer.DialContext(dialCtx, "ws"+server.URL[4:], nil) // nolint:bodyclose
+				// Hold the client's receiving loop right after it acknowledges the server's
+				// handover close on the first connection, until the client's teardown has started.
+				if err == nil && dials.Add(1) == 1 {
+					defaultCloseHandler := conn.CloseHandler()
+					conn.SetCloseHandler(func(code int, text string) error {
+						err := defaultCloseHandler(code, text)
+						close(ackSent)
+						select {
+						case <-releaseAck:
+						case <-ctx.Done():
+						}
+						return err
+					})
+				}
+				return conn, err
+			})
+	}()
+
+	select {
+	case <-serverReady:
+	case <-ctx.Done():
+		t.Fatal("the server did not accept the connection")
+	}
+	banner := []byte("SSH-2.0-test\r\n")
+	_, err := serverWriter.Write(banner)
+	require.NoError(t, err)
+	require.NoError(t, clientOutput.WaitForWrite(banner))
+	ticks <- time.Now()
+	select {
+	case <-ackSent:
+	case <-ctx.Done():
+		t.Fatal("the client did not acknowledge the handover close")
+	}
+	select {
+	case err := <-handoverDone:
+		require.NoError(t, err)
+	case <-ctx.Done():
+		t.Fatal("the server did not finish the handover")
+	}
+	require.NoError(t, clientWriter.Close())
+	select {
+	case <-clientSource.closed:
+	case <-ctx.Done():
+		t.Fatal("the client did not start its teardown")
+	}
+	close(releaseAck)
+
+	select {
+	case err := <-clientDone:
+		require.NoError(t, err)
+	case <-ctx.Done():
+		t.Fatal("the client did not finish")
+	}
+	select {
+	case err := <-serverDone:
+		require.NoError(t, err)
+	case <-serverProxy.resume.parked:
+		t.Fatalf("a clean client exit left the server waiting %v for a reattach", serverProxy.resume.grace)
+	case <-ctx.Done():
+		t.Fatal("the server did not finish after a clean client exit")
+	}
+}
diff --git a/experimental/ssh/internal/proxy/keepalive_test.go b/experimental/ssh/internal/proxy/keepalive_test.go
new file mode 100644
index 00000000000..5ce9c34d375
--- /dev/null
+++ b/experimental/ssh/internal/proxy/keepalive_test.go
@@ -0,0 +1,336 @@
+package proxy
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/gorilla/websocket"
+	"github.com/stretchr/testify/require"
+)
+
+// Write modes for pausableConn.
+const (
+	connWriteOK = iota
+	connWriteFail
+	connWritePark
+)
+
+var errTestWriteFailed = errors.New("test: socket write failed")
+
+// unboundedParkDuration stands in for "parks until the kernel gives up", which is what a write with
+// no deadline does on a stalled socket. It must outlast the assertions of any test that parks a
+// write, so that a write path which forgets to bound itself is measured as a stall, not as a failure.
+const unboundedParkDuration = 30 * time.Second
+
+// pausableConn emulates the socket conditions a keepalive meets on a stalled peer: writes can be
+// made to fail outright, or to park the way a full send buffer does — until the write's deadline
+// expires, or effectively forever if it has none. Wrapping the socket rather than the websocket keeps
+// the production write path (gorilla's own locking and deadline handling) in the test.
+type pausableConn struct {
+	net.Conn
+	mode         atomic.Int32
+	deadline     atomic.Pointer[time.Time]
+	parked       chan struct{}
+	signalParked func()
+}
+
+func newPausableConn(conn net.Conn) *pausableConn {
+	parked := make(chan struct{})
+	return &pausableConn{
+		Conn:         conn,
+		parked:       parked,
+		signalParked: sync.OnceFunc(func() { close(parked) }),
+	}
+}
+
+func (c *pausableConn) SetWriteDeadline(t time.Time) error {
+	c.deadline.Store(&t)
+	return c.Conn.SetWriteDeadline(t)
+}
+
+func (c *pausableConn) Write(p []byte) (int, error) {
+	switch c.mode.Load() {
+	case connWriteFail:
+		return 0, errTestWriteFailed
+	case connWritePark:
+		c.signalParked()
+		if d := c.deadline.Load(); d != nil && !d.IsZero() {
+			time.Sleep(time.Until(*d))
+		} else {
+			time.Sleep(unboundedParkDuration)
+		}
+		return 0, os.ErrDeadlineExceeded
+	}
+	return c.Conn.Write(p)
+}
+
+// startKeepaliveTestServer stands up a websocket peer that behaves like the SSH server side of the
+// tunnel for an idle session: it sends the first bytes (which the client waits for before it
+// considers the session established), then only reads. Pings it receives are reported on the
+// returned channel and answered with a pong, the same way gorilla's default ping handler does.
+func startKeepaliveTestServer(t *testing.T) (*httptest.Server, <-chan struct{}) {
+	pings := make(chan struct{}, 1)
+	upgrader := websocket.Upgrader{}
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		conn, err := upgrader.Upgrade(w, r, nil)
+		if err != nil {
+			return
+		}
+		defer conn.Close()
+		conn.SetPingHandler(func(appData string) error {
+			select {
+			case pings <- struct{}{}:
+			default:
+			}
+			return conn.WriteControl(websocket.PongMessage, []byte(appData), time.Now().Add(time.Second))
+		})
+		if err := conn.WriteMessage(websocket.BinaryMessage, []byte("SSH-2.0-test\r\n")); err != nil {
+			return
+		}
+		// Ping handlers only run while a read is in progress, so keep reading until the client goes away.
+		for {
+			if _, _, err := conn.ReadMessage(); err != nil {
+				return
+			}
+		}
+	}))
+	return server, pings
+}
+
+// keepaliveTestDialer returns a connection factory for RunClientProxy. onNetConn, when set, receives
+// each connection's underlying socket — the initial one and each one a handover creates — once its
+// websocket handshake has completed, so a test can control how its writes behave.
+func keepaliveTestDialer(serverURL string, onNetConn func(*pausableConn)) createWebsocketConnectionFunc {
+	wsURL := "ws" + serverURL[4:]
+	return func(ctx context.Context, dial DialRequest) (*websocket.Conn, error) {
+		var wrapped *pausableConn
+		dialer := websocket.Dialer{
+			NetDialContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
+				conn, err := net.Dial(network, addr)
+				if err != nil {
+					return nil, err
+				}
+				wrapped = newPausableConn(conn)
+				return wrapped, nil
+			},
+		}
+		conn, _, err := dialer.DialContext(ctx, fmt.Sprintf("%s?id=%s", wsURL, dial.ConnID), nil) // nolint:bodyclose
+		if err != nil {
+			return nil, err
+		}
+		// Hand the socket to the test only after the handshake succeeds. The socket is dialed
+		// before gorilla writes the upgrade request, so exposing it any earlier lets a test that
+		// flips it to a failing mode poison the handshake itself — which fails connect() before the
+		// proxy loops start, leaving nothing to drain the caller's src pipe.
+		if onNetConn != nil {
+			onNetConn(wrapped)
+		}
+		return conn, nil
+	}
+}
+
+// TestKeepalivePingReachesServer covers the fix itself: an idle session sends no data, so without
+// the keepalive nothing at all crosses the websocket and the server side eventually reaps the
+// stream it considers dead.
+func TestKeepalivePingReachesServer(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	server, pings := startKeepaliveTestServer(t)
+	defer server.Close()
+
+	// Never written to: the session stays idle for the whole test.
+	src, _ := io.Pipe()
+	done := make(chan error, 1)
+	go func() {
+		done <- RunClientProxy(ctx, src, io.Discard, neverTick, 20*time.Millisecond, false, keepaliveTestDialer(server.URL, nil))
+	}()
+
+	select {
+	case <-pings:
+	case err := <-done:
+		t.Fatalf("session ended before a keepalive ping arrived: %v", err)
+	case <-time.After(10 * time.Second):
+		t.Fatal("no keepalive ping arrived at the server")
+	}
+}
+
+// TestKeepalivePingFailureDoesNotEndSession asserts a keepalive can never be the thing that ends a
+// session: it has no information the data loops lack, and it runs in the errgroup that drives them,
+// so a returned error would tear the session down.
+func TestKeepalivePingFailureDoesNotEndSession(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	server, _ := startKeepaliveTestServer(t)
+	defer server.Close()
+
+	var socket atomic.Pointer[pausableConn]
+	src, _ := io.Pipe()
+	done := make(chan error, 1)
+	go func() {
+		done <- RunClientProxy(ctx, src, io.Discard, neverTick, 20*time.Millisecond, false,
+			keepaliveTestDialer(server.URL, func(c *pausableConn) { socket.Store(c) }))
+	}()
+
+	// Fail every write once the connection is up, leaving reads healthy: the connection is otherwise
+	// fine and the session must survive the pings that then fail.
+	require.Eventually(t, func() bool { return socket.Load() != nil }, 10*time.Second, 10*time.Millisecond)
+	socket.Load().mode.Store(connWriteFail)
+
+	// Long enough for tens of pings to be attempted and fail at the 20ms interval above.
+	select {
+	case err := <-done:
+		t.Fatalf("session ended after a failed keepalive ping: %v", err)
+	case <-time.After(time.Second):
+	}
+}
+
+// TestKeepalivePingParkedInWriteDoesNotStallClose covers the hazard of writing from a third
+// goroutine: a ping on a stalled or half-open connection parks in the socket write while holding the
+// websocket's write lock, which the closing handshake also needs. Its deadline is what keeps that
+// from lasting until the kernel abandons its retransmits, minutes later.
+//
+// A ping write with no deadline parks for unboundedParkDuration here, so this fails if the ping ever
+// goes back to a write path that does not bound itself.
+func TestKeepalivePingParkedInWriteDoesNotStallClose(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	server, _ := startKeepaliveTestServer(t)
+	defer server.Close()
+
+	var socket atomic.Pointer[pausableConn]
+	proxy := newProxyConnection(keepaliveTestDialer(server.URL, func(c *pausableConn) { socket.Store(c) }))
+	require.NoError(t, proxy.connect(ctx))
+	require.NotNil(t, socket.Load())
+
+	socket.Load().mode.Store(connWritePark)
+	pingDone := make(chan error, 1)
+	go func() {
+		pingDone <- proxy.sendPing()
+	}()
+	select {
+	case <-socket.Load().parked:
+	case <-time.After(10 * time.Second):
+		t.Fatal("the keepalive ping did not park in the socket write")
+	}
+
+	start := time.Now()
+	closeErr := proxy.close()
+	require.Less(t, time.Since(start), proxyPingWriteTimeout+5*time.Second,
+		"the closing handshake waited on the parked keepalive ping for longer than its write deadline allows")
+	// The write itself fails, which close() reports; the point is that it was not held indefinitely.
+	require.Error(t, closeErr)
+
+	select {
+	case err := <-pingDone:
+		require.Error(t, err, "a parked ping write must end in an error, not succeed")
+	case <-time.After(10 * time.Second):
+		t.Fatal("the keepalive ping never returned from its parked write")
+	}
+}
+
+// TestKeepalivePingFailureDoesNotHangTheSession covers what a failed ping actually costs. gorilla
+// puts the connection into a permanent write-error state after any failed write, so one timed-out
+// keepalive stops the close message going out too — and a session whose close message never reaches
+// the peer used to wait forever for the peer to close the connection, which is the same silent
+// black hole this feature exists to remove. The session must end, promptly and with an error.
+func TestKeepalivePingFailureDoesNotHangTheSession(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	server, _ := startKeepaliveTestServer(t)
+	defer server.Close()
+
+	var socket atomic.Pointer[pausableConn]
+	src, srcWriter := io.Pipe()
+	done := make(chan error, 1)
+	go func() {
+		done <- RunClientProxy(ctx, src, io.Discard, neverTick, 20*time.Millisecond, false,
+			keepaliveTestDialer(server.URL, func(c *pausableConn) { socket.Store(c) }))
+	}()
+
+	require.Eventually(t, func() bool { return socket.Load() != nil }, 10*time.Second, 10*time.Millisecond)
+	socket.Load().mode.Store(connWriteFail)
+	// Let a ping fail, which is what poisons the connection.
+	time.Sleep(100 * time.Millisecond)
+
+	// The session ends the way it would without a keepalive at all: the next write fails and the
+	// sending loop reports it. Before, the teardown could not close the connection and this hung.
+	// Write from a goroutine: src is an unbuffered pipe the sending loop drains, so if the session
+	// has already ended (nothing draining it) the write blocks forever — doing it concurrently
+	// leaves the select below free to fail fast instead of wedging the whole package on the write.
+	go func() { srcWriter.Write([]byte("keystroke")) }() // nolint:errcheck
+
+	select {
+	case err := <-done:
+		require.Error(t, err, "a session that can no longer send must end with an error, not silently")
+	case <-time.After(30 * time.Second):
+		t.Fatal("session hung after a failed keepalive ping poisoned the connection")
+	}
+}
+
+// TestKeepalivePingDuringHandoverDoesNotDisruptIt asserts the two periodic behaviours of the tunnel
+// stay independent: a ping sent while a handover is in flight neither waits for the handover nor
+// breaks it. The keepalive writes from a third goroutine, so nothing else guarantees this.
+func TestKeepalivePingDuringHandoverDoesNotDisruptIt(t *testing.T) {
+	ctx := t.Context()
+
+	server := setupTestServer(ctx, t)
+	defer server.Cleanup()
+
+	// Holds the handover open at the point where it has taken the handover mutex but has not yet
+	// swapped the connection, which is when a ping must neither block nor interfere.
+	handoverDialing := make(chan struct{})
+	releaseHandover := make(chan struct{})
+	release := sync.OnceFunc(func() { close(releaseHandover) })
+	var dials atomic.Int32
+
+	client := setupTestClientWithDialHook(ctx, t, server.URL, func() {
+		if dials.Add(1) > 1 {
+			close(handoverDialing)
+			<-releaseHandover
+		}
+	})
+	defer client.Cleanup()
+	// Deferred after client.Cleanup so it runs before it: a t.Fatal below would otherwise leave the
+	// handover parked in the dial hook, and cleanup waits on proxy loops that cannot finish until it
+	// is released — which wedges the whole package instead of failing one test.
+	defer release()
+
+	handoverDone := make(chan error, 1)
+	go func() {
+		handoverDone <- client.Proxy.initiateHandover(ctx)
+	}()
+	<-handoverDialing
+
+	pingDone := make(chan error, 1)
+	go func() {
+		pingDone <- client.Proxy.sendPing()
+	}()
+
+	select {
+	case err := <-pingDone:
+		require.NoError(t, err)
+	case <-time.After(proxyPingWriteTimeout):
+		t.Fatal("keepalive ping waited on the in-flight handover")
+	}
+
+	release()
+
+	select {
+	case err := <-handoverDone:
+		require.NoError(t, err)
+	case <-time.After(10 * time.Second):
+		t.Fatal("handover did not complete after a concurrent keepalive ping")
+	}
+
+	// The tunnel still carries data on the connection the handover installed.
+	_, err := client.Input.Write(createTestMessage("client", 1))
+	require.NoError(t, err)
+	require.NoError(t, server.Output.WaitForWrite(createTestMessage("client", 1)))
+}
diff --git a/experimental/ssh/internal/proxy/proxy.go b/experimental/ssh/internal/proxy/proxy.go
index e761cbf54c4..91f9e5ae2b5 100644
--- a/experimental/ssh/internal/proxy/proxy.go
+++ b/experimental/ssh/internal/proxy/proxy.go
@@ -2,26 +2,60 @@ package proxy
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
+	"net"
 	"net/http"
 	"os"
 	"sync"
 	"sync/atomic"
 	"time"
+	"uuid"
 
-	"github.com/google/uuid"
+	"github.com/databricks/cli/libs/log"
 	"github.com/gorilla/websocket"
 	"golang.org/x/sync/errgroup"
 )
 
+// Sentinels for how a proxy session ended, so callers can attribute it for telemetry without
+// matching on error text. Joined onto the error at the site that detected it.
+var (
+	// ErrConnectFailed marks a failure to establish the initial proxy websocket.
+	ErrConnectFailed = errors.New("proxy websocket could not be established")
+	// ErrWebsocketDropped marks an established proxy websocket that stopped carrying traffic.
+	ErrWebsocketDropped = errors.New("proxy websocket dropped")
+	// ErrHandoverFailed marks a handover that ended the session. A handover that only failed
+	// to dial its replacement does not end the session and is not reported with this.
+	ErrHandoverFailed = errors.New("proxy handover failed")
+	// ErrReattachRejected marks a permanent rejection, such as an expired session.
+	ErrReattachRejected = errors.New("the server rejected session reattachment")
+)
+
+// ResumeProtocolVersion requires flow control and explicit session completion.
+// Version 1 could terminate a healthy session when its replay window filled.
+const ResumeProtocolVersion = 2
+
+const ResumeVersionParameter = "resume_version"
+
 var (
 	errProxyEOF             = errors.New("proxy EOF error")
 	errSendingLoopStopped   = errors.New("sending loop stopped")
 	errReceivingLoopStopped = errors.New("receiving loop stopped")
+	// Marks a handover that failed while opening its replacement connection, before any
+	// connection state changed. The current connection is still the one both proxy loops
+	// use, so the session can carry on with it instead of ending.
+	errHandoverDialFailed = errors.New("handover dial failed")
+	// Marks a write that failed on a resumable connection. The payload is already buffered for
+	// replay, so the sending loop treats it as a pause rather than the end of the session.
+	errSendFailedResumable = errors.New("send failed on a resumable connection")
 )
 
+// proxyResumeGrace outlasts the client's retry budget so the server does not reap
+// a session while its client is still trying to reconnect.
+const proxyResumeGrace = 90 * time.Second
+
 const (
 	// Same as gorilla/websocket default read/write buffer sizes. Bigger payloads will be split into multiple ws frames.
 	proxyBufferSize = 4 * 1024
@@ -29,8 +63,91 @@ const (
 	proxyHandoverInitTimeout = 30 * time.Second
 	// Timeout for the handover process, when accepted by the server.
 	proxyHandoverAcceptTimeout = 25 * time.Second
+	// Bounds how long a keepalive ping may hold the websocket's write lock. A stalled or half-open
+	// connection parks a write until the kernel gives up retransmitting (~15 minutes with Linux
+	// defaults), and close() and the sending loop need that same lock, so the ping caps its wait.
+	proxyPingWriteTimeout = 5 * time.Second
+
+	// How long the client keeps trying to reattach to its session after the connection drops.
+	// It has to stay clear of ssh's own ceiling: ServerAliveInterval 30 (see
+	// sshconfig.ServerAliveIntervalSeconds) times OpenSSH's default ServerAliveCountMax of 3
+	// means ssh gives up on an unresponsive tunnel after about 90 seconds, and a resume that
+	// outlasts that repairs a session ssh has already abandoned.
+	proxyResumeBudget = 60 * time.Second
+	// Backoff between resume dials. The first attempt is immediate: a reset often clears at once.
+	proxyResumeRetryBackoff = 2 * time.Second
+	// Bounds the wait for the peer's first frame on a reattached connection, which carries the
+	// offset to replay from. The connection is new, but the peer may be wedged.
+	proxyResumeHandshakeTimeout = 10 * time.Second
+	// Cap on unacknowledged payload held for replay, per direction. At 120 ms RTT,
+	// an 8 MiB window sustains over 500 Mbit/s before backpressure pauses the source.
+	proxyResumeBufferLimit = 8 << 20
+	// How much payload may be delivered before we tell the peer about it, so it can release
+	// its replay buffer. Small enough to keep the window far below proxyResumeBufferLimit.
+	proxyAckThreshold = 64 << 10
+	// Acknowledge the tail of an idle stream, including the final bytes before EOF.
+	proxyAckInterval       = 100 * time.Millisecond
+	proxyCloseWriteTimeout = time.Second
+	proxySessionFinished   = "finished"
 )
 
+// proxyEOFDrainTimeout bounds how long the source's EOF waits for the peer to acknowledge the tail
+// of the stream. A peer whose own receiving loop is wedged reads without ever acknowledging, and
+// waiting for it indefinitely outlives the ssh client that spawned us - on the server side it also
+// pins sshd and a client slot, which is what keeps the compute alive. The tail is at most one
+// replay window and acknowledgements are sent every proxyAckInterval, so this only expires when the
+// peer has genuinely stopped delivering. Long enough to cover a reattach that lands right at EOF.
+// A var so tests can shorten it.
+var proxyEOFDrainTimeout = proxyResumeGrace
+
+// resumeState is the per-connection bookkeeping a resumable transport needs. It is nil unless
+// both ends negotiated resume, in which case the proxy behaves exactly as it did before.
+type resumeState struct {
+	// Outgoing payload that may still have to be replayed.
+	sendBuf *sendBuffer
+	// Total payload bytes received from the peer and written to sshd's stdin on the server or
+	// stdout on the client. The peer replays from this offset, so it only advances after a
+	// successful write.
+	delivered atomic.Int64
+	// The delivered count we last told the peer about, so an ack is only sent once the number
+	// has actually moved.
+	acked atomic.Int64
+	// Coalesces acknowledgments so the receiving loop never waits for a write lock.
+	ackNeeded chan struct{}
+	// Protected by handoverMutex. Written before any new payload on a replacement
+	// socket, after the receiving loop is free to drain the peer's replay.
+	replay []byte
+	// Carries the replacement connection to a parked receiving loop. Only the server uses it:
+	// it cannot dial, so it waits here for the client's inbound reattach request. Buffered so a
+	// client that reattaches before this side has noticed the drop is picked up rather than missed.
+	resumed chan *websocket.Conn
+	// Signalled by the receiving loop once it has stopped delivering, so a reattach can report a
+	// delivered count that cannot move under it. Server side only, and buffered for the same
+	// reason as resumed.
+	parked chan struct{}
+	// Throttles the sending loop while a reattach is in progress.
+	gate sendGate
+	// Serializes inbound reattach attempts, including retiring the old socket.
+	reattachMu sync.Mutex
+	// How many times the connection has dropped, so the exit path can tell a tunnel that kept
+	// dropping apart from an SSH server that never answered. The two need different messages.
+	drops atomic.Int64
+	// Closed when the session stops, so an HTTP handler cannot revive it.
+	done  chan struct{}
+	grace time.Duration
+}
+
+func newResumeState() *resumeState {
+	return &resumeState{
+		sendBuf:   newSendBuffer(proxyResumeBufferLimit),
+		ackNeeded: make(chan struct{}, 1),
+		resumed:   make(chan *websocket.Conn, 1),
+		parked:    make(chan struct{}, 1),
+		done:      make(chan struct{}),
+		grace:     proxyResumeGrace,
+	}
+}
+
 // handoverCoordination holds the context and channels used to coordinate a single handover operation
 // between the receiving loop and the handover initiator (initiateHandover or acceptHandover).
 type handoverCoordination struct {
@@ -102,27 +219,85 @@ type proxyConnection struct {
 	// Channel that is closed when the initial connection is established (or failed).
 	// Prevents race conditions where handover is accepted before the initial connection is ready.
 	ready chan struct{}
+	// Byte accounting for reattaching to this session after an unexpected disconnect, or nil
+	// when resume was not negotiated. Immutable after construction.
+	resume *resumeState
 }
 
-type createWebsocketConnectionFunc func(ctx context.Context, connID string) (*websocket.Conn, error)
+// DialRequest describes the connection a client is asking the server for.
+type DialRequest struct {
+	// Identifies the session. A server that already has a connection under this ID treats the
+	// dial as a handover or a reattach rather than a new session.
+	ConnID string
+	// Whether this client speaks the resume protocol. When set, the dial carries the delivered
+	// offset below, and that parameter's presence is how the server learns it must buffer its
+	// own output for replay too.
+	ResumeCapable bool
+	// How many payload bytes this side has written to its destination. Sent on every dial, not
+	// just a reattach, so the offset is always current when a drop does happen.
+	Delivered int64
+	// Asks the server to reattach this connection to an existing session whose previous
+	// connection dropped, and to replay what was lost. Stated explicitly rather than inferred
+	// from the server's own view of the connection, because the client often notices the drop
+	// first and would otherwise race the server into treating a reattach as a handover.
+	Reattach bool
+}
+
+type createWebsocketConnectionFunc func(ctx context.Context, req DialRequest) (*websocket.Conn, error)
 
 func newProxyConnection(createConn createWebsocketConnectionFunc) *proxyConnection {
 	return &proxyConnection{
-		connID:                    uuid.NewString(),
+		connID:                    uuid.New().String(),
 		createWebsocketConnection: createConn,
 		ready:                     make(chan struct{}),
 	}
 }
 
+// newResumableProxyConnection is newProxyConnection with the byte accounting that lets the
+// session survive an unexpected disconnect. Both ends must agree: a server that does not speak
+// the protocol tears the session down on the first dropped connection regardless, and a client
+// must not attempt a resume against one (it would replay into a freshly spawned sshd).
+func newResumableProxyConnection(createConn createWebsocketConnectionFunc) *proxyConnection {
+	pc := newProxyConnection(createConn)
+	pc.resume = newResumeState()
+	return pc
+}
+
+// resumable reports whether this connection can reattach to its session after a drop.
+func (pc *proxyConnection) resumable() bool {
+	return pc.resume != nil
+}
+
+// droppedConnections reports how many times this session's connection has dropped.
+func (pc *proxyConnection) droppedConnections() int64 {
+	if !pc.resumable() {
+		return 0
+	}
+	return pc.resume.drops.Load()
+}
+
 func (pc *proxyConnection) start(ctx context.Context, src io.ReadCloser, dst io.Writer) error {
 	g, gCtx := errgroup.WithContext(ctx)
+	var finished atomic.Bool
+	if pc.resumable() {
+		g.Go(func() error {
+			pc.runAckLoop(gCtx)
+			return nil
+		})
+	}
 	g.Go(func() error {
 		err := pc.runSendingLoop(gCtx, src)
+		if errors.Is(err, errProxyEOF) {
+			finished.Store(true)
+		}
 		// Always return a non nil error to cancel the errgroup context
 		return errors.Join(err, errSendingLoopStopped)
 	})
 	g.Go(func() error {
 		err := pc.runReceivingLoop(gCtx, dst)
+		if errors.Is(err, errProxyEOF) {
+			finished.Store(true)
+		}
 		// Always return a non nil error to cancel the errgroup context
 		return errors.Join(err, errReceivingLoopStopped)
 	})
@@ -134,7 +309,16 @@ func (pc *proxyConnection) start(ctx context.Context, src io.ReadCloser, dst io.
 		// Both loops can still be stuck on conn.ReadMessage or src.Read and won't notice context cancellation,
 		// so we close the connection and the source (sshd stdout pipe or ssh client stdio) to unblock them.
 		<-gCtx.Done()
-		return errors.Join(pc.close(), pc.closeSource(src))
+		if pc.resumable() {
+			close(pc.resume.done)
+		}
+		var closeErr error
+		if finished.Load() || ctx.Err() != nil {
+			closeErr = pc.close()
+		}
+		// Cleanup can win the errgroup's first-error race with the I/O loops.
+		// Preserve parent cancellation even when the close control frame fails.
+		return errors.Join(ctx.Err(), closeErr, pc.closeConnection(), pc.closeSource(src))
 	})
 	err := g.Wait()
 	if err == nil || isNormalClosure(err) {
@@ -145,7 +329,9 @@ func (pc *proxyConnection) start(ctx context.Context, src io.ReadCloser, dst io.
 
 func (pc *proxyConnection) connect(ctx context.Context) error {
 	defer close(pc.ready)
-	conn, err := pc.createWebsocketConnection(ctx, pc.connID)
+	// Nothing has been delivered yet, so the initial dial reports offset zero. Sending it at all
+	// is what tells a resume-capable server that this client speaks the protocol.
+	conn, err := pc.createWebsocketConnection(ctx, DialRequest{ConnID: pc.connID, ResumeCapable: pc.resumable()})
 	if err != nil {
 		return err
 	}
@@ -180,15 +366,50 @@ func (pc *proxyConnection) runSendingLoop(ctx context.Context, src io.Reader) er
 		b := make([]byte, proxyBufferSize)
 		n, readErr := src.Read(b)
 		if n > 0 {
+			// Wait out any reattach in progress, so a connection that is down does not fill the
+			// whole replay window before it comes back. src stays blocked on the OS side
+			// meanwhile, which is the backpressure we want.
+			if pc.resumable() {
+				if err := pc.resume.gate.wait(ctx); err != nil {
+					return err
+				}
+				if err := pc.resume.sendBuf.waitForSpace(ctx, n); err != nil {
+					return err
+				}
+			}
 			// This will block during handover - we stop sending anything except the close message.
 			// Meanwhile the "src" (sshd server stdout or ssh client stdin) will be buffered/blocked on the OS side until we start reading from it again.
 			err := pc.sendMessage(websocket.BinaryMessage, b[:n])
-			if err != nil {
-				return fmt.Errorf("failed to send message: %w", err)
+			switch {
+			case errors.Is(err, errSendFailedResumable):
+				// Buffered for replay, and sendMessage has closed the connection so the
+				// receiving loop starts the reattach. Carry on reading src: its bytes accumulate
+				// in the replay buffer, and the gate above holds the next write until the
+				// connection is back. Falls through to readErr rather than continuing the loop,
+				// so a read that returned data together with an error still reports it.
+				log.Debugf(ctx, "Send failed on a resumable connection, waiting for the reattach: %v", err)
+			case err != nil:
+				return errors.Join(ErrWebsocketDropped, fmt.Errorf("failed to send message: %w", err))
 			}
 		}
 		if readErr != nil {
 			if errors.Is(readErr, io.EOF) {
+				if pc.resumable() {
+					// EOF may accompany the last payload of a failed write. Keep the session alive
+					// until replay delivers and acknowledges those bytes - but only for
+					// proxyEOFDrainTimeout: a peer that reads without ever acknowledging would
+					// otherwise hold the session open forever, long after the ssh client that
+					// spawned us is gone. Our own cancellation still ends it immediately.
+					drainCtx, cancel := context.WithTimeout(ctx, proxyEOFDrainTimeout)
+					err := pc.resume.sendBuf.waitForSpace(drainCtx, proxyResumeBufferLimit)
+					cancel()
+					if err != nil && ctx.Err() != nil {
+						return ctx.Err()
+					}
+					if err != nil {
+						log.Warnf(ctx, "The peer never acknowledged the last bytes of the session: %v", err)
+					}
+				}
 				return errors.Join(errProxyEOF, readErr)
 			} else {
 				return fmt.Errorf("failed to read from source: %w", readErr)
@@ -200,8 +421,106 @@ func (pc *proxyConnection) runSendingLoop(ctx context.Context, src io.Reader) er
 func (pc *proxyConnection) sendMessage(mt int, data []byte) error {
 	pc.handoverMutex.Lock()
 	defer pc.handoverMutex.Unlock()
+	// Record the payload before writing it, and under the same lock a resume swaps the
+	// connection with: that way the buffer always holds every byte the peer may still be
+	// missing, and a resume can never replay a range the sending loop is still appending to.
+	if pc.resumable() && mt == websocket.BinaryMessage {
+		if err := pc.resume.sendBuf.append(data); err != nil {
+			return err
+		}
+	}
 	conn := pc.conn.Load()
-	return conn.WriteMessage(mt, data)
+	var err error
+	if pc.resumable() && len(pc.resume.replay) > 0 {
+		err = conn.WriteMessage(websocket.BinaryMessage, pc.resume.replay)
+		if err == nil {
+			pc.resume.replay = nil
+		}
+	}
+	if err == nil {
+		err = conn.WriteMessage(mt, data)
+	}
+	if err != nil && pc.resumable() {
+		// This failure costs no data whatever the message type: a binary payload was buffered
+		// above, and control/ack messages are regenerated after the resume. gorilla latches a
+		// permanent write error after any failed write, so this connection can never send again -
+		// close it to fail the receiving loop's read now and drive the reattach, rather than let
+		// the sending loop fill the whole window first. This must cover a failed ack (a text
+		// control frame) too, not only a binary payload: when traffic is one-way from the server
+		// the receiving side never writes a binary frame, so a poisoned connection would otherwise
+		// only ever surface as a failed ack. Left as a bare log, the read loop kept running while
+		// the peer stopped getting acks, its replay buffer filled to the limit, and the session
+		// ended instead of reattaching. A failed close message reaches here only during teardown,
+		// where closing the connection is what happens next anyway.
+		conn.Close()
+		return errors.Join(errSendFailedResumable, err)
+	}
+	return err
+}
+
+// sendControlMessage tells the peer how much payload we have written to our destination, so it
+// can release that much of its replay buffer.
+func (pc *proxyConnection) sendControlMessage(delivered int64) error {
+	payload, err := json.Marshal(controlMessage{Delivered: delivered})
+	if err != nil {
+		return err
+	}
+	return pc.sendMessage(websocket.TextMessage, payload)
+}
+
+// ackDelivered queues an acknowledgment without blocking reads. A synchronous
+// write here deadlocks with a handover waiting for this loop to read a close frame.
+func (pc *proxyConnection) ackDelivered() {
+	delivered := pc.resume.delivered.Load()
+	if delivered-pc.resume.acked.Load() < proxyAckThreshold {
+		return
+	}
+	pc.requestAck()
+}
+
+// requestAck coalesces wakeups; the writer reads the latest delivered count.
+func (pc *proxyConnection) requestAck() {
+	select {
+	case pc.resume.ackNeeded <- struct{}{}:
+	default:
+	}
+}
+
+// runAckLoop keeps acknowledgment writes independent of payload reads and source
+// backpressure. A failed write closes the socket and lets the receiver reattach.
+func (pc *proxyConnection) runAckLoop(ctx context.Context) {
+	ticker := time.NewTicker(proxyAckInterval)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			if pc.resume.delivered.Load() == pc.resume.acked.Load() {
+				continue
+			}
+		case <-pc.resume.ackNeeded:
+		}
+		delivered := pc.resume.delivered.Load()
+		if err := pc.sendControlMessage(delivered); err != nil {
+			log.Debugf(ctx, "Failed to acknowledge %d delivered bytes: %v", delivered, err)
+			continue
+		}
+		pc.resume.acked.Store(delivered)
+	}
+}
+
+// sendPing writes a keepalive ping on the current connection. Unlike sendMessage it takes neither
+// the handover mutex nor an unbounded wait: gorilla permits WriteControl concurrently with the data
+// writes, and its deadline bounds how long a stalled socket holds the connection's write lock, which
+// close() and the sending loop also need.
+func (pc *proxyConnection) sendPing() error {
+	conn := pc.conn.Load()
+	err := conn.WriteControl(websocket.PingMessage, nil, time.Now().Add(proxyPingWriteTimeout))
+	if err != nil && pc.resumable() {
+		conn.Close()
+	}
+	return err
 }
 
 func (pc *proxyConnection) runReceivingLoop(ctx context.Context, dst io.Writer) error {
@@ -212,45 +531,102 @@ func (pc *proxyConnection) runReceivingLoop(ctx context.Context, dst io.Writer)
 		conn := pc.conn.Load()
 		mt, data, err := conn.ReadMessage()
 		if err != nil {
-			// During handover a normal closure is expected, but any other error must stop the read loop (and eventually terminate the ssh session).
+			// A normal closure completes handover. An interrupted handover needs
+			// reattachment to recover bytes the close-frame exchange did not drain.
 			if handover := pc.handoverState.Load(); handover != nil {
 				var closeConnSignal error
-				if !websocket.IsCloseError(err, websocket.CloseNormalClosure) {
-					closeConnSignal = fmt.Errorf("failed to read from websocket during handover: %w", err)
+				switch {
+				case websocket.IsCloseError(err, websocket.CloseNormalClosure):
+					// A normal close ends the old connection cleanly, usually as the peer's side of
+					// the handover. Complete the swap even when the session is ending: teardown then
+					// closes the replacement connection gracefully, and a resumable peer does not
+					// wait for a reattach.
+				case ctx.Err() != nil:
+					// The session is ending and teardown closed the connection under the handover
+					// (see the ctx.Err() check below). Pass the cancellation on, so the handover
+					// initiator does not report a failed handover for an ordinary exit.
+					closeConnSignal = ctx.Err()
+				default:
+					closeConnSignal = errors.Join(ErrWebsocketDropped, fmt.Errorf("failed to read from websocket during handover: %w", err))
 				}
 				// Signal the current connection is closed to the handover initiator (initiateHandover or acceptHandover).
-				if err := handover.signalConnectionClosed(closeConnSignal); err != nil {
-					return err
-				}
+				handoverErr := handover.signalConnectionClosed(closeConnSignal)
 				// Wait for the handover initiator to swap the connection.
 				// While we wait for the handover to complete, the new connection might be getting incoming messages.
 				// They will be buffered by the TCP stack and will be read by us after the handover is complete.
-				if err := handover.waitForConnectionToSwap(); err != nil {
-					return err
+				if handoverErr == nil {
+					handoverErr = handover.waitForConnectionToSwap()
 				}
 				// Continue with the receiving loop, pc.conn is now the new connection.
-				continue
-			} else {
-				if errors.Is(err, io.EOF) || websocket.IsCloseError(err, websocket.CloseNormalClosure) {
-					return errors.Join(errProxyEOF, err)
-				} else {
-					return fmt.Errorf("failed to read from websocket: %w", err)
+				if handoverErr == nil {
+					continue
 				}
+				if !pc.resumable() {
+					return handoverErr
+				}
+			}
+			closeErr, closed := errors.AsType[*websocket.CloseError](err)
+			finished := closed && closeErr.Code == websocket.CloseNormalClosure && closeErr.Text == proxySessionFinished
+			if finished || (!pc.resumable() && (errors.Is(err, io.EOF) || websocket.IsCloseError(err, websocket.CloseNormalClosure))) {
+				return errors.Join(errProxyEOF, err)
+			}
+			// A read that fails once our own context is cancelled is the teardown, not a drop:
+			// start's context watcher closes the connection to unblock this very read, and
+			// only after the context is done, so cancellation is always visible here first.
+			// Neither branch below fits - a reattach would warn the user about a drop on every
+			// clean exit and could not succeed anyway (its redial budget comes from this same
+			// context), and ErrWebsocketDropped would bill an ordinary exit to a tunnel failure.
+			if ctx.Err() != nil {
+				return ctx.Err()
 			}
+			// An unexpected drop. With resume negotiated the session state on both ends
+			// outlives the connection, so reattach instead of ending the session.
+			if pc.resumable() {
+				conn.Close()
+				pc.resume.drops.Add(1)
+				if resumeErr := pc.reattach(ctx); resumeErr != nil {
+					return errors.Join(ErrWebsocketDropped, fmt.Errorf("failed to reattach after the connection dropped: %w", resumeErr))
+				}
+				continue
+			}
+			return errors.Join(ErrWebsocketDropped, fmt.Errorf("failed to read from websocket: %w", err))
 		}
 
+		if mt == websocket.TextMessage && pc.resumable() {
+			var msg controlMessage
+			if err := json.Unmarshal(data, &msg); err != nil {
+				return fmt.Errorf("failed to decode control message: %w", err)
+			}
+			pc.resume.sendBuf.ack(msg.Delivered)
+			continue
+		}
 		if mt != websocket.BinaryMessage {
 			return errors.New("received non-binary websocket message")
 		}
-		if _, err := dst.Write(data); err != nil {
+		n, err := dst.Write(data)
+		if err != nil {
 			return fmt.Errorf("failed to copy to writer: %w", err)
 		}
+		if n != len(data) {
+			return fmt.Errorf("failed to copy to writer: %w", io.ErrShortWrite)
+		}
+		if pc.resumable() {
+			// Only count what actually reached the destination: this is the offset the peer
+			// replays from, so counting an unwritten byte would silently lose it.
+			pc.resume.delivered.Add(int64(len(data)))
+			pc.ackDelivered()
+		}
 	}
 }
 
 func (pc *proxyConnection) close() error {
 	// Keep in mind that pc.sendMessage blocks during handover
-	err := pc.sendMessage(websocket.CloseMessage, websocket.FormatCloseMessage(websocket.CloseNormalClosure, ""))
+	reason := ""
+	if pc.resumable() {
+		reason = proxySessionFinished
+	}
+	// WriteControl can run alongside a blocked data write or handover.
+	err := pc.conn.Load().WriteControl(websocket.CloseMessage, websocket.FormatCloseMessage(websocket.CloseNormalClosure, reason), time.Now().Add(proxyCloseWriteTimeout))
 	if err != nil {
 		if isNormalClosure(err) || errors.Is(err, websocket.ErrCloseSent) {
 			return nil
@@ -261,6 +637,19 @@ func (pc *proxyConnection) close() error {
 	return nil
 }
 
+// closeConnection closes the underlying websocket. The close message pc.close sends only ends the
+// session if the peer is still there to react to it by closing the connection, and it does not even
+// go out once a failed write has put the connection into gorilla's permanent write-error state (one
+// timed-out keepalive ping is enough). Without this the receiving loop stays blocked in ReadMessage
+// and the session hangs instead of exiting.
+func (pc *proxyConnection) closeConnection() error {
+	err := pc.conn.Load().Close()
+	if errors.Is(err, net.ErrClosed) {
+		return nil
+	}
+	return err
+}
+
 func (pc *proxyConnection) closeSource(src io.ReadCloser) error {
 	err := src.Close()
 	if err != nil && (errors.Is(err, os.ErrClosed) || errors.Is(err, io.ErrClosedPipe)) {
@@ -288,15 +677,28 @@ func (pc *proxyConnection) initiateHandover(ctx context.Context) error {
 
 	// Create a new websocket connection by sending an /ssh?id=<connID> request to the server.
 	// When server realises it's an ID of an existing connection, it will start AcceptHandover process.
-	newConn, err := pc.createWebsocketConnection(handoverCtx, pc.connID)
+	newConn, err := pc.createWebsocketConnection(handoverCtx, DialRequest{
+		ConnID:        pc.connID,
+		ResumeCapable: pc.resumable(),
+		// A handover replaces a connection that still works, so the close-frame barrier keeps
+		// the byte stream intact and nothing needs replaying. The offset still travels, so the
+		// server keeps buffering for the drop that may come later.
+		Delivered: pc.deliveredCount(),
+	})
 	if err != nil {
-		return fmt.Errorf("failed to create new websocket connection: %w", err)
+		// Nothing has been swapped yet: pc.conn is still live and the receiving loop is still
+		// reading it. Tag the error so the caller can keep the session on it - see
+		// errHandoverDialFailed. Retrying the dial here instead would be unsafe: a dial can
+		// fail after the server already accepted it and began its side of the handover, and a
+		// second dial would then race the first one's acceptHandover for the same connection.
+		return errors.Join(errHandoverDialFailed, fmt.Errorf("failed to create new websocket connection: %w", err))
 	}
 
 	// Wait for the server to close the old connection
 	// (it does so when it receives an /ssh request with known connection ID and starts AcceptHandover process).
 	// Receiving loop will signal about closed connection to the coord.connClosed channel.
 	if err := handoverState.waitForConnectionToClose(); err != nil {
+		pc.conn.Load().Close()
 		newConn.Close()
 		return err
 	}
@@ -349,6 +751,7 @@ func (pc *proxyConnection) acceptHandover(ctx context.Context, w http.ResponseWr
 	}
 	err = currentConn.WriteMessage(websocket.CloseMessage, websocket.FormatCloseMessage(websocket.CloseNormalClosure, "handover"))
 	if err != nil {
+		currentConn.Close()
 		newConn.Close()
 		return fmt.Errorf("failed to send close message to the current connection: %w", err)
 	}
@@ -357,6 +760,7 @@ func (pc *proxyConnection) acceptHandover(ctx context.Context, w http.ResponseWr
 	// On the client its done automatically by the websocket library with the default close handler.
 	// On the server we then receive a close error in the RunReceivingLoop and signal about it to the coord.connClosed channel.
 	if err := handoverState.waitForConnectionToClose(); err != nil {
+		currentConn.Close()
 		newConn.Close()
 		return err
 	}
diff --git a/experimental/ssh/internal/proxy/proxy_test.go b/experimental/ssh/internal/proxy/proxy_test.go
index 0e1db9021e2..548c2ea6ea9 100644
--- a/experimental/ssh/internal/proxy/proxy_test.go
+++ b/experimental/ssh/internal/proxy/proxy_test.go
@@ -6,10 +6,13 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"net"
 	"net/http"
 	"net/http/httptest"
 	"sync"
+	"sync/atomic"
 	"testing"
+	"testing/synctest"
 	"time"
 
 	"github.com/databricks/cli/libs/log"
@@ -139,12 +142,26 @@ func createTestWebsocketConnection(url string) (*websocket.Conn, error) {
 	return conn, err
 }
 
+// neverTick is a tick channel that never fires, for tests that don't exercise a periodic behaviour.
+func neverTick() <-chan time.Time {
+	return time.After(time.Hour)
+}
+
 func setupTestClient(ctx context.Context, t *testing.T, serverURL string) *TestProxy {
+	return setupTestClientWithDialHook(ctx, t, serverURL, nil)
+}
+
+// setupTestClientWithDialHook is setupTestClient with a hook called on every websocket dial: the
+// initial connection and each one a handover creates.
+func setupTestClientWithDialHook(ctx context.Context, t *testing.T, serverURL string, onDial func()) *TestProxy {
 	ctx = log.NewContext(ctx, log.GetLogger(ctx).With("Client", true))
 	clientInput, clientInputWriter := io.Pipe()
 	clientOutput := newTestBuffer(t)
 	wsURL := "ws" + serverURL[4:]
-	clientProxy := newProxyConnection(func(ctx context.Context, connID string) (*websocket.Conn, error) {
+	clientProxy := newProxyConnection(func(ctx context.Context, dial DialRequest) (*websocket.Conn, error) {
+		if onDial != nil {
+			onDial()
+		}
 		return createTestWebsocketConnection(wsURL)
 	})
 	err := clientProxy.connect(ctx)
@@ -254,3 +271,295 @@ func TestConnectionHandover(t *testing.T) {
 		require.NoError(t, err)
 	}
 }
+
+// TestResumeAfterHandoverDrop keeps the same byte streams alive when the old
+// connection drops before the handover's close-frame exchange finishes.
+func TestResumeAfterHandoverDrop(t *testing.T) {
+	for _, tc := range []struct {
+		name              string
+		dropDuringUpgrade bool
+		failDial          bool
+		loseCloseReply    bool
+	}{
+		{name: "during upgrade", dropDuringUpgrade: true},
+		{name: "failed dial", failDial: true},
+		{name: "lost close reply", loseCloseReply: true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx, cancel := context.WithTimeout(t.Context(), 8*time.Second)
+			defer cancel()
+			serverProxy := newResumableProxyConnection(nil)
+			serverInput, serverWriter := io.Pipe()
+			defer serverWriter.Close()
+			serverOutput := newTestBuffer(t)
+			done := make(chan error, 2)
+			var accepted atomic.Bool
+			var reattachments atomic.Int32
+			server := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if accepted.CompareAndSwap(false, true) {
+					if !assert.NoError(t, serverProxy.accept(w, r)) {
+						return
+					}
+					done <- serverProxy.start(ctx, serverInput, serverOutput)
+					return
+				}
+				req, err := parseDialRequest(r)
+				if !assert.NoError(t, err) {
+					return
+				}
+				if req.Reattach {
+					reattachments.Add(1)
+					assert.NoError(t, serverProxy.acceptReattach(ctx, w, r, req.Delivered))
+					return
+				}
+				_ = serverProxy.acceptHandover(ctx, w, r)
+			}))
+			var upgrades atomic.Int32
+			server.Config.ConnState = func(_ net.Conn, state http.ConnState) {
+				if state == http.StateHijacked && upgrades.Add(1) == 2 && tc.dropDuringUpgrade {
+					// Both handover coordinators exist before the replacement is upgraded.
+					assert.NoError(t, serverProxy.conn.Load().Close())
+				}
+			}
+			server.Start()
+			defer server.Close()
+			defer cancel()
+
+			clientInput, clientWriter := io.Pipe()
+			defer clientWriter.Close()
+			clientOutput := newTestBuffer(t)
+			ticks := make(chan time.Time, 1)
+			var initial *websocket.Conn
+			createConn := func(ctx context.Context, req DialRequest) (*websocket.Conn, error) {
+				if initial != nil && !req.Reattach && tc.failDial {
+					assert.NoError(t, initial.Close())
+					return nil, errors.New("handover dial interrupted")
+				}
+				url := fmt.Sprintf("ws%s?id=%s&resume_version=%d&delivered=%d", server.URL[4:], req.ConnID, ResumeProtocolVersion, req.Delivered)
+				if req.Reattach {
+					url += "&reattach=1"
+				}
+				conn, resp, err := websocket.DefaultDialer.DialContext(ctx, url, nil)
+				if resp != nil {
+					resp.Body.Close()
+				}
+				if err == nil && initial == nil {
+					initial = conn
+					if tc.loseCloseReply {
+						conn.SetCloseHandler(func(int, string) error {
+							_ = conn.Close()
+							return net.ErrClosed
+						})
+					}
+				}
+				return conn, err
+			}
+			go func() {
+				done <- RunClientProxy(ctx, clientInput, clientOutput, func() <-chan time.Time { return ticks }, time.Hour, true, createConn)
+			}()
+
+			beforeClient := []byte("before handover to client")
+			beforeServer := []byte("before handover to server")
+			_, err := serverWriter.Write(beforeClient)
+			require.NoError(t, err)
+			require.NoError(t, clientOutput.WaitForWrite(beforeClient))
+			_, err = clientWriter.Write(beforeServer)
+			require.NoError(t, err)
+			require.NoError(t, serverOutput.WaitForWrite(beforeServer))
+			ticks <- time.Now()
+			require.Eventually(t, func() bool { return reattachments.Load() > 0 }, 3*time.Second, time.Millisecond,
+				"a drop during handover must reattach the session")
+
+			afterClient := bytes.Repeat([]byte("download"), 8192)
+			afterServer := bytes.Repeat([]byte("upload!!"), 8192)
+			_, err = serverWriter.Write(afterClient)
+			require.NoError(t, err)
+			_, err = clientWriter.Write(afterServer)
+			require.NoError(t, err)
+			require.NoError(t, clientOutput.WaitForWrite(afterClient))
+			require.NoError(t, serverOutput.WaitForWrite(afterServer))
+			select {
+			case err := <-done:
+				t.Fatalf("session ended before cancellation: %v", err)
+			default:
+			}
+			cancel()
+			for range 2 {
+				select {
+				case err := <-done:
+					// Cancellation closes the source to unblock the sending loop.
+					if err != nil && !errors.Is(err, io.ErrClosedPipe) {
+						assert.ErrorIs(t, err, context.Canceled)
+					}
+				case <-time.After(time.Second):
+					t.Fatal("proxy did not stop after cancellation")
+				}
+			}
+			assert.Equal(t, string(append(beforeClient, afterClient...)), clientOutput.String())
+			assert.Equal(t, string(append(beforeServer, afterServer...)), serverOutput.String())
+		})
+	}
+}
+
+// blockedReadConn lets cleanup finish before either I/O loop returns an error.
+// The test releases the reads and closes the real socket separately.
+type blockedReadConn struct {
+	net.Conn
+	release <-chan struct{}
+}
+
+func (c blockedReadConn) Read([]byte) (int, error) {
+	<-c.release
+	return 0, net.ErrClosed
+}
+
+func (c blockedReadConn) Close() error {
+	return nil
+}
+
+func TestCancellationCloseWriteFailure(t *testing.T) {
+	server, _ := startKeepaliveTestServer(t)
+	defer server.Close()
+	var socket *pausableConn
+	pc := newProxyConnection(keepaliveTestDialer(server.URL, func(conn *pausableConn) {
+		socket = conn
+	}))
+	require.NoError(t, pc.connect(t.Context()))
+	realSocket := socket.Conn
+	defer realSocket.Close()
+
+	synctest.Test(t, func(t *testing.T) {
+		release := make(chan struct{})
+		blocked := blockedReadConn{Conn: realSocket, release: release}
+		socket.Conn = blocked
+		ctx, cancel := context.WithCancel(t.Context())
+		defer cancel()
+		done := make(chan error, 1)
+		go func() { done <- pc.start(ctx, blocked, io.Discard) }()
+		synctest.Wait()
+
+		socket.mode.Store(connWriteFail)
+		cancel()
+		// Both reads remain blocked while cleanup records the failed close write
+		// as the errgroup's first error. No timing or scheduler assumptions needed.
+		synctest.Wait()
+		close(release)
+		err := <-done
+		require.ErrorIs(t, err, context.Canceled)
+		require.ErrorIs(t, err, errTestWriteFailed)
+	})
+}
+
+// A failed acknowledgement write on a resumable connection must be treated exactly like a failed
+// binary write: close the connection and report errSendFailedResumable, so the receiving loop's
+// next read fails and drives the reattach. When traffic is one-way from the server the receiving
+// side never writes a binary frame, so a poisoned connection surfaces only as a failed ack; left
+// as a bare log it would let the peer's replay buffer fill and end the session instead.
+func TestFailedAckWriteClosesResumableConnectionToDriveReattach(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		conn, err := (&websocket.Upgrader{}).Upgrade(w, r, nil)
+		if err != nil {
+			return
+		}
+		// A live peer to dial; drain until the client goes away.
+		for {
+			if _, _, err := conn.ReadMessage(); err != nil {
+				return
+			}
+		}
+	}))
+	defer server.Close()
+
+	wsURL := "ws" + server.URL[4:]
+	conn, err := createTestWebsocketConnection(wsURL)
+	require.NoError(t, err)
+
+	pc := newResumableProxyConnection(nil)
+	pc.conn.Store(conn)
+
+	// Poison the write side the way gorilla latches it after any failed write, without disturbing
+	// reads - the one-way-from-server case where only the ack ever fails.
+	require.NoError(t, conn.SetWriteDeadline(time.Now().Add(-time.Hour)))
+
+	// sendControlMessage is the ack path (a text control frame), not a binary payload.
+	err = pc.sendControlMessage(42)
+	require.ErrorIs(t, err, errSendFailedResumable, "a failed ack write on a resumable connection must report the resumable-send failure that drives the reattach")
+
+	// It must have closed the connection: a second close returns net.ErrClosed. With the
+	// connection closed, the receiving loop's next read fails and reattaches, rather than the
+	// failure being silently swallowed.
+	require.ErrorIs(t, conn.Close(), net.ErrClosed, "sendMessage must close the poisoned connection so the receiving loop reattaches")
+}
+
+// A read that fails during teardown must not be mistaken for a drop. start's context watcher
+// closes the websocket to unblock this read, so on every clean exit the read fails with the
+// context already cancelled - and reattaching there told the user their connection had dropped on
+// every single session, having no chance of succeeding on a cancelled context either.
+func TestTeardownIsNotTreatedAsADrop(t *testing.T) {
+	// Signalled from inside the client's ReadMessage: gorilla dispatches control frames from
+	// there and keeps reading, so this proves the read is in flight and cannot return until the
+	// connection is closed. Without it the loop could be between iterations instead, where the
+	// check at the top of the loop handles the cancellation and the test passes vacuously.
+	readInFlight := make(chan struct{})
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		conn, err := (&websocket.Upgrader{}).Upgrade(w, r, nil)
+		if err != nil {
+			return
+		}
+		if err := conn.WriteControl(websocket.PingMessage, nil, time.Now().Add(time.Minute)); err != nil {
+			return
+		}
+		// Send no payload: the client's read stays blocked until the test closes the connection.
+		for {
+			if _, _, err := conn.ReadMessage(); err != nil {
+				return
+			}
+		}
+	}))
+	defer server.Close()
+
+	wsURL := "ws" + server.URL[4:]
+	conn, err := createTestWebsocketConnection(wsURL)
+	require.NoError(t, err)
+	conn.SetPingHandler(func(string) error {
+		close(readInFlight)
+		return nil
+	})
+
+	var dials atomic.Int32
+	pc := newResumableProxyConnection(func(ctx context.Context, dial DialRequest) (*websocket.Conn, error) {
+		dials.Add(1)
+		return nil, errors.New("a teardown must never dial a reattach")
+	})
+	pc.conn.Store(conn)
+
+	ctx, cancel := context.WithCancel(t.Context())
+	loopErr := make(chan error, 1)
+	go func() {
+		loopErr <- pc.runReceivingLoop(ctx, io.Discard)
+	}()
+
+	select {
+	case <-readInFlight:
+	case <-time.After(10 * time.Second):
+		t.Fatal("the receiving loop never reached its read")
+	}
+
+	// Cancel first and close second, exactly as start's context watcher does it, so the read
+	// error always surfaces with the cancellation already visible.
+	cancel()
+	require.NoError(t, conn.Close())
+
+	select {
+	case err := <-loopErr:
+		require.ErrorIs(t, err, context.Canceled, "a read that fails after cancellation is the teardown, so the loop must report the cancellation")
+		require.NotErrorIs(t, err, ErrWebsocketDropped, "a clean teardown must not be attributed to a dropped websocket")
+	case <-time.After(10 * time.Second):
+		t.Fatal("the receiving loop never returned")
+	}
+
+	// No dial means no reattach was started, and the warning that prompted this test lives inside
+	// the reattach, so it cannot have been printed either.
+	require.Zero(t, dials.Load(), "the reattach must not be attempted once the context is cancelled")
+}
diff --git a/experimental/ssh/internal/proxy/resume.go b/experimental/ssh/internal/proxy/resume.go
new file mode 100644
index 00000000000..504b6b0343b
--- /dev/null
+++ b/experimental/ssh/internal/proxy/resume.go
@@ -0,0 +1,436 @@
+package proxy
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"sync"
+	"time"
+
+	"github.com/databricks/cli/libs/log"
+	"github.com/gorilla/websocket"
+)
+
+// errSendWindowExhausted prevents overwriting unacknowledged bytes. The sending
+// loop waits for room before appending, without holding the websocket write lock.
+var errSendWindowExhausted = errors.New("resume send buffer is full")
+
+// errReplayUnavailable means the peer asked to resume from an offset we no longer hold. It can
+// only happen if the peer acknowledged those bytes and then asked for them again, so it is a
+// protocol violation rather than a condition to recover from.
+var errReplayUnavailable = errors.New("the bytes needed to resume have already been acknowledged and discarded")
+
+// sendBuffer holds the tail of the outgoing payload stream so it can be replayed after an
+// unexpected disconnect.
+//
+// The buffer, not the websocket, is the source of truth for what has been sent: bytes are
+// appended before they are written, so a write that fails on a dying connection loses nothing.
+// SSH runs its own sequence numbers and MACs over the byte stream (RFC 4253 section 6), so a
+// resumed connection has to deliver exactly the bytes the peer missed, once, in order - a
+// single lost or duplicated byte disconnects the session with a corrupted MAC.
+type sendBuffer struct {
+	mu sync.Mutex
+	// Total payload bytes appended since the session began.
+	sent int64
+	// Total payload bytes the peer has confirmed writing to its destination. buf holds
+	// exactly the range [acked, sent).
+	acked int64
+	buf   []byte
+	limit int
+	space chan struct{}
+}
+
+func newSendBuffer(limit int) *sendBuffer {
+	return &sendBuffer{limit: limit, space: make(chan struct{}, 1)}
+}
+
+// waitForSpace applies backpressure to the sole payload producer. Acknowledgments
+// can still arrive, and a reattach can still acquire the websocket write lock.
+func (b *sendBuffer) waitForSpace(ctx context.Context, size int) error {
+	for {
+		if err := ctx.Err(); err != nil {
+			return err
+		}
+		b.mu.Lock()
+		available := b.limit - len(b.buf)
+		b.mu.Unlock()
+		if size <= available {
+			return nil
+		}
+		select {
+		case <-b.space:
+		case <-ctx.Done():
+			return ctx.Err()
+		}
+	}
+}
+
+// append records payload before its websocket write, while the caller holds the
+// same lock used to install a replacement connection and its replay.
+func (b *sendBuffer) append(payload []byte) error {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	if len(b.buf)+len(payload) > b.limit {
+		return fmt.Errorf("%w: %d unacknowledged bytes, limit %d", errSendWindowExhausted, len(b.buf), b.limit)
+	}
+	b.buf = append(b.buf, payload...)
+	b.sent += int64(len(payload))
+	return nil
+}
+
+// ack discards everything the peer has confirmed delivering. A stale or duplicated
+// acknowledgement is ignored rather than treated as an error: acks are sent periodically and
+// may arrive out of order relative to a resume.
+func (b *sendBuffer) ack(delivered int64) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	if delivered <= b.acked || delivered > b.sent {
+		return
+	}
+	b.buf = b.buf[delivered-b.acked:]
+	b.acked = delivered
+	select {
+	case b.space <- struct{}{}:
+	default:
+	}
+}
+
+// replayFrom returns the bytes the peer is missing: everything from the offset it last delivered
+// up to what we have sent. The returned slice is a copy, so the caller can write it without
+// holding the lock.
+func (b *sendBuffer) replayFrom(delivered int64) ([]byte, error) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	if delivered < b.acked {
+		return nil, fmt.Errorf("%w: peer asked for offset %d, buffer starts at %d", errReplayUnavailable, delivered, b.acked)
+	}
+	if delivered > b.sent {
+		return nil, fmt.Errorf("peer claims to have delivered %d bytes but only %d were sent", delivered, b.sent)
+	}
+	missing := b.buf[delivered-b.acked:]
+	return append([]byte(nil), missing...), nil
+}
+
+// controlMessage is exchanged as a websocket text frame; payload always stays binary. It carries
+// the sender's delivered count, both as the periodic acknowledgement and as the first frame of a
+// resumed connection, where it tells the peer where to replay from.
+//
+// Text frames are only ever sent once resume has been negotiated: a server from an older CLI
+// treats any non-binary frame as a protocol error and ends the session.
+type controlMessage struct {
+	Delivered int64 `json:"delivered"`
+}
+
+// deliveredCount is how many payload bytes this side has written to its destination, or zero when
+// resume was not negotiated.
+func (pc *proxyConnection) deliveredCount() int64 {
+	if !pc.resumable() {
+		return 0
+	}
+	return pc.resume.delivered.Load()
+}
+
+// sendGate throttles the sending loop while a reattach is in progress.
+//
+// It is deliberately not the write mutex. A reattach has to wait for the peer - the client for its
+// dial to be answered, the server for the client to come back - and the write mutex is exactly
+// what the other side needs to finish the reattach, so holding it across that wait deadlocks the
+// server. Correctness rests on the write mutex plus appending before writing; this only stops the
+// sending loop from filling the whole replay window while the connection is down.
+type sendGate struct {
+	mu     sync.Mutex
+	waitCh chan struct{}
+}
+
+func (g *sendGate) park() {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	if g.waitCh == nil {
+		g.waitCh = make(chan struct{})
+	}
+}
+
+func (g *sendGate) release() {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	if g.waitCh != nil {
+		close(g.waitCh)
+		g.waitCh = nil
+	}
+}
+
+// wait blocks until the gate is released, and returns immediately when it is already open.
+func (g *sendGate) wait(ctx context.Context) error {
+	g.mu.Lock()
+	waitCh := g.waitCh
+	g.mu.Unlock()
+	if waitCh == nil {
+		return nil
+	}
+	select {
+	case <-waitCh:
+		return nil
+	case <-ctx.Done():
+		return ctx.Err()
+	}
+}
+
+// reattach repairs a dropped connection without the SSH session noticing: both ends replay
+// whatever the other is missing, so the byte stream continues exactly where it left off.
+//
+// The receiving loop owns this, because it is the goroutine that must stop reading the dead
+// connection. The sending loop is only throttled: its payload is already in the replay buffer.
+func (pc *proxyConnection) reattach(ctx context.Context) error {
+	pc.resume.gate.park()
+	defer pc.resume.gate.release()
+
+	// The server cannot dial - its client is behind the driver proxy - so it waits for an inbound
+	// reattach request instead.
+	if pc.createWebsocketConnection == nil {
+		return pc.awaitReattach(ctx)
+	}
+	return pc.dialReattach(ctx)
+}
+
+// dialReattach reattaches from the client side: redial the session, learn where the server got
+// to, and replay what it is missing.
+func (pc *proxyConnection) dialReattach(ctx context.Context) error {
+	// Held for the whole reattach, dial included, so a handover tick cannot start one while this is
+	// in flight. A handover needs the receiving loop to answer it, and the receiving loop is the
+	// goroutine running this - the handover would wait out its own timeout and end a session that
+	// was about to be repaired. Safe to hold across the dial on this side: only the client
+	// initiates handovers, and nothing the reattach waits on needs this lock. The server's side
+	// cannot do the same, which is what sendGate is for.
+	pc.handoverMutex.Lock()
+	defer pc.handoverMutex.Unlock()
+
+	budgetCtx, cancel := context.WithTimeout(ctx, proxyResumeBudget)
+	defer cancel()
+
+	log.Warnf(ctx, "SSH tunnel connection dropped, reattaching to the session...")
+	conn, serverDelivered, err := pc.redial(budgetCtx)
+	if err != nil {
+		return err
+	}
+
+	// The server's first frame says how much of our output it wrote, which is where we replay
+	// from. It replays what we are missing right after, and those frames wait in the socket
+	// until the receiving loop picks the new connection up.
+	if err := pc.prepareReplay(serverDelivered); err != nil {
+		conn.Close()
+		return err
+	}
+	pc.conn.Store(conn)
+	select {
+	case <-pc.resume.done:
+		conn.Close()
+		return ErrReattachRejected
+	default:
+	}
+	pc.requestAck()
+	log.Warnf(ctx, "SSH tunnel connection reattached, the session continues")
+	return nil
+}
+
+func (pc *proxyConnection) redial(ctx context.Context) (*websocket.Conn, int64, error) {
+	var lastErr error
+	for {
+		conn, err := pc.createWebsocketConnection(ctx, DialRequest{
+			ConnID:        pc.connID,
+			Delivered:     pc.resume.delivered.Load(),
+			Reattach:      true,
+			ResumeCapable: true,
+		})
+		if err == nil {
+			var delivered int64
+			delivered, err = readResumeHandshake(ctx, conn)
+			if err == nil {
+				return conn, delivered, nil
+			}
+			conn.Close()
+		}
+		if errors.Is(err, ErrReattachRejected) {
+			return nil, 0, err
+		}
+		lastErr = err
+		log.Debugf(ctx, "Reattach dial failed, retrying: %v", err)
+		select {
+		case <-ctx.Done():
+			return nil, 0, fmt.Errorf("gave up reattaching: %w", errors.Join(lastErr, ctx.Err()))
+		case <-time.After(proxyResumeRetryBackoff):
+		}
+	}
+}
+
+// awaitReattach reattaches from the server side by waiting for the client to come back. The
+// session - sshd, the client slot, and the buffered output - is held for the grace period.
+//
+// It first announces that it has stopped delivering, which is what makes its delivered count
+// stable for acceptReattach to report. Both channels are buffered, so a client that reattaches
+// before this side has even noticed the drop is picked up rather than missed.
+func (pc *proxyConnection) awaitReattach(ctx context.Context) error {
+	log.Infof(ctx, "Connection dropped, holding the session for up to %v for the client to reattach", pc.resume.grace)
+	select {
+	case pc.resume.parked <- struct{}{}:
+	default:
+		// A previous park is still queued, which means acceptReattach has not consumed it yet.
+		// Nothing to add: it is about to read a delivered count that is already stable.
+	}
+	select {
+	case <-pc.resume.resumed:
+		// acceptReattach has already replayed and installed the new connection.
+		log.Info(ctx, "Client reattached to the session")
+		return nil
+	case <-time.After(pc.resume.grace):
+		return fmt.Errorf("the client did not reattach within %v", pc.resume.grace)
+	case <-ctx.Done():
+		return ctx.Err()
+	}
+}
+
+// awaitParked waits until the receiving loop has stopped delivering to sshd, so this side's
+// delivered count cannot move while a reattach reports it.
+//
+// Without this the client can reattach while the server is still draining data buffered on the
+// dying connection: the greeting would carry a stale offset, the client would replay from it, and
+// the server would write those bytes to sshd twice. SSH would then fail on a corrupted MAC - the
+// exact failure the replay accounting exists to prevent.
+func (pc *proxyConnection) awaitParked(ctx context.Context) error {
+	select {
+	case <-pc.resume.parked:
+		return nil
+	case <-pc.resume.done:
+		return ErrReattachRejected
+	case <-time.After(proxyResumeHandshakeTimeout):
+		return fmt.Errorf("the receiving loop did not stop delivering within %v", proxyResumeHandshakeTimeout)
+	case <-ctx.Done():
+		return ctx.Err()
+	}
+}
+
+// acceptReattach installs a client's replacement connection on the server side: announce where we
+// got to, replay what the client is missing, and hand the connection to the parked receiving loop.
+//
+// Called from the HTTP handler goroutine, so it takes the write lock the loops use.
+func (pc *proxyConnection) acceptReattach(ctx context.Context, w http.ResponseWriter, r *http.Request, clientDelivered int64) error {
+	pc.resume.reattachMu.Lock()
+	defer pc.resume.reattachMu.Unlock()
+	select {
+	case <-pc.ready:
+	case <-pc.resume.done:
+		return ErrReattachRejected
+	case <-ctx.Done():
+		return ctx.Err()
+	}
+
+	// Retire the dying connection before anything else. The receiving loop may still be draining
+	// data buffered on it - a reset that only tore down the client's leg leaves this side's read
+	// succeeding for a while, then hanging - and every byte it delivers moves the offset the
+	// greeting below is about to report.
+	previous := pc.conn.Load()
+	if previous != nil {
+		previous.Close()
+	}
+	if err := pc.awaitParked(ctx); err != nil {
+		return err
+	}
+	installed := false
+	defer func() {
+		if !installed {
+			// A failed upgrade or handshake leaves the receiver parked. Let the
+			// next attempt use that same stable delivered offset.
+			pc.resume.parked <- struct{}{}
+		}
+	}()
+
+	pc.handoverMutex.Lock()
+	defer pc.handoverMutex.Unlock()
+	select {
+	case <-pc.resume.done:
+		return ErrReattachRejected
+	default:
+	}
+
+	conn, err := pc.acceptWebsocketConnection(w, r)
+	if err != nil {
+		return fmt.Errorf("failed to accept the reattached connection: %w", err)
+	}
+	// The offset first, then the payload: the client reads exactly one control frame before it
+	// hands the connection to its own receiving loop.
+	if err := pc.sendResumeHandshake(conn); err != nil {
+		conn.Close()
+		return err
+	}
+	if err := pc.prepareReplay(clientDelivered); err != nil {
+		conn.Close()
+		return err
+	}
+	pc.conn.Store(conn)
+	// Teardown can run while the handshake holds the write lock. If it closed
+	// the old socket before this store, this handler must close the replacement.
+	select {
+	case <-pc.resume.done:
+		conn.Close()
+		return ErrReattachRejected
+	default:
+	}
+	pc.requestAck()
+
+	select {
+	case pc.resume.resumed <- conn:
+		installed = true
+	case <-pc.resume.done:
+		conn.Close()
+		return ErrReattachRejected
+	}
+	return nil
+}
+
+// prepareReplay queues missing bytes under the write lock. Replaying here would
+// deadlock when both peers fill their socket buffers before returning to reads.
+func (pc *proxyConnection) prepareReplay(peerDelivered int64) error {
+	missing, err := pc.resume.sendBuf.replayFrom(peerDelivered)
+	if err != nil {
+		return err
+	}
+	pc.resume.sendBuf.ack(peerDelivered)
+	pc.resume.replay = missing
+	return nil
+}
+
+// sendResumeHandshake announces our delivered count as the first frame of a reattached
+// connection, so the peer knows where to replay from. Written directly rather than through
+// sendMessage: the connection is not installed yet, and this must not be recorded as payload.
+func (pc *proxyConnection) sendResumeHandshake(conn *websocket.Conn) error {
+	payload, err := json.Marshal(controlMessage{Delivered: pc.resume.delivered.Load()})
+	if err != nil {
+		return err
+	}
+	return conn.WriteMessage(websocket.TextMessage, payload)
+}
+
+// readResumeHandshake reads the delivered count the peer sends as the first frame of a reattached
+// connection. The deadline bounds the wait: the connection is new, but the peer may be wedged.
+func readResumeHandshake(ctx context.Context, conn *websocket.Conn) (int64, error) {
+	stop := context.AfterFunc(ctx, func() { conn.Close() })
+	defer stop()
+	if err := conn.SetReadDeadline(time.Now().Add(proxyResumeHandshakeTimeout)); err != nil {
+		return 0, err
+	}
+	defer func() { _ = conn.SetReadDeadline(time.Time{}) }()
+
+	mt, data, err := conn.ReadMessage()
+	if err != nil {
+		return 0, fmt.Errorf("failed to read the reattach handshake: %w", err)
+	}
+	if mt != websocket.TextMessage {
+		return 0, fmt.Errorf("expected a reattach handshake control frame, got websocket message type %d", mt)
+	}
+	var msg controlMessage
+	if err := json.Unmarshal(data, &msg); err != nil {
+		return 0, fmt.Errorf("failed to decode the reattach handshake: %w", err)
+	}
+	return msg.Delivered, nil
+}
diff --git a/experimental/ssh/internal/proxy/resume_e2e_test.go b/experimental/ssh/internal/proxy/resume_e2e_test.go
new file mode 100644
index 00000000000..966d0cf53c9
--- /dev/null
+++ b/experimental/ssh/internal/proxy/resume_e2e_test.go
@@ -0,0 +1,200 @@
+//go:build !windows
+
+package proxy
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"os/exec"
+	"testing"
+	"time"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/gorilla/websocket"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// The invariant the whole resume protocol exists to hold: a reset must not cost or duplicate a
+// single byte. SSH verifies a MAC over the byte stream (RFC 4253 section 6), so a resume that got
+// this wrong would disconnect the session rather than repair it - a worse failure than the drop.
+//
+// The reset lands immediately after a burst of writes, while the echo of that burst is still in
+// flight, so the server has bytes it must genuinely replay.
+func TestResumeLosesNoBytesWhenResetMidStream(t *testing.T) {
+	server := createTestServer(t, 2, time.Hour)
+	defer server.Close()
+
+	relay := newTCPRelay(t, server.Listener.Addr().String())
+
+	errChan := make(chan error, 1)
+	client := createResumableTestClient(t, relay.URL(), errChan)
+	defer client.Cleanup()
+
+	const lines = 500
+	var expected []byte
+	for i := range lines {
+		line := fmt.Appendf(nil, "line %d\n", i)
+		_, err := client.InputWriter.Write(line)
+		require.NoError(t, err)
+		expected = append(expected, line...)
+	}
+
+	relay.resetClients(t)
+
+	require.NoError(t, client.Output.WaitForWrite(fmt.Appendf(nil, "line %d\n", lines-1)),
+		"the session did not survive the reset")
+	assert.Equal(t, string(expected), client.Output.String())
+
+	select {
+	case err := <-errChan:
+		t.Fatalf("session ended despite being resumable: %v", err)
+	default:
+	}
+}
+
+// Customers report drops several times a session, so surviving one reset is not enough.
+func TestResumeSurvivesRepeatedResets(t *testing.T) {
+	server := createTestServer(t, 2, time.Hour)
+	defer server.Close()
+
+	relay := newTCPRelay(t, server.Listener.Addr().String())
+
+	errChan := make(chan error, 1)
+	client := createResumableTestClient(t, relay.URL(), errChan)
+	defer client.Cleanup()
+
+	const rounds = 4
+	const linesPerRound = 100
+	var expected []byte
+	for round := range rounds {
+		for i := range linesPerRound {
+			line := fmt.Appendf(nil, "round %d line %d\n", round, i)
+			_, err := client.InputWriter.Write(line)
+			require.NoError(t, err)
+			expected = append(expected, line...)
+		}
+		relay.resetClients(t)
+		last := fmt.Appendf(nil, "round %d line %d\n", round, linesPerRound-1)
+		require.NoError(t, client.Output.WaitForWrite(last), "round %d did not survive its reset", round)
+	}
+
+	assert.Equal(t, string(expected), client.Output.String())
+
+	select {
+	case err := <-errChan:
+		t.Fatalf("session ended despite being resumable: %v", err)
+	default:
+	}
+}
+
+// A client that never comes back must not pin sshd and a client slot forever. Releasing the slot
+// is also what restarts the shutdown timer, so without this a single dropped session would keep
+// the whole server alive until its own timeout.
+func TestServerReleasesASessionThatIsNeverReattached(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	connections := NewConnectionsManager(2, time.Hour)
+	proxyServer := NewProxyServer(ctx, connections, func(ctx context.Context) *exec.Cmd {
+		return exec.CommandContext(ctx, "cat", "-u")
+	})
+	proxyServer.resumeGrace = 300 * time.Millisecond
+	server := httptest.NewServer(proxyServer)
+	defer server.Close()
+
+	wsURL := "ws" + server.URL[4:]
+	conn, _, err := websocket.DefaultDialer.Dial(wsURL+"?id=abandoned&resume_version=2&delivered=0", nil) // nolint:bodyclose
+	require.NoError(t, err)
+
+	require.NoError(t, conn.WriteMessage(websocket.BinaryMessage, []byte("hello\n")))
+	_, _, err = conn.ReadMessage()
+	require.NoError(t, err)
+	require.Equal(t, 1, connections.Count())
+
+	tcpConn, ok := conn.UnderlyingConn().(*net.TCPConn)
+	require.True(t, ok)
+	require.NoError(t, tcpConn.SetLinger(0))
+	require.NoError(t, tcpConn.Close())
+
+	require.Eventually(t, func() bool {
+		return connections.Count() == 0
+	}, 10*time.Second, 20*time.Millisecond, "the server held the session past its resume grace period")
+}
+
+// A reattach for a session the server no longer holds must be refused. Starting a fresh session
+// instead would hand the client a new sshd, and replaying into that fails the SSH stream with a
+// corrupted MAC instead of a clear error.
+func TestReattachToAnUnknownSessionIsRefused(t *testing.T) {
+	server := createTestServer(t, 2, time.Hour)
+	defer server.Close()
+
+	wsURL := "ws" + server.URL[4:]
+	_, resp, err := websocket.DefaultDialer.Dial(wsURL+"?id=never-existed&resume_version=2&delivered=0&reattach=1", nil) // nolint:bodyclose
+	require.Error(t, err)
+	require.NotNil(t, resp)
+	defer resp.Body.Close()
+	assert.Equal(t, http.StatusGone, resp.StatusCode)
+}
+
+// Drives the wire protocol by hand to pin the reattach exchange itself, with a replay that is
+// deliberately non-empty: the client under-reports its delivered offset as zero, so the server has
+// to replay the whole session. Asserts the ordering the client depends on - the delivered offset
+// arrives as a text frame first, and the replayed payload follows it.
+func TestReattachReplaysFromTheOffsetTheClientReports(t *testing.T) {
+	server := createTestServer(t, 2, time.Hour)
+	defer server.Close()
+
+	wsURL := "ws" + server.URL[4:]
+	const sessionID = "replay-session"
+
+	conn, _, err := websocket.DefaultDialer.Dial(wsURL+"?id="+sessionID+"&resume_version=2&delivered=0", nil) // nolint:bodyclose
+	require.NoError(t, err)
+
+	const payload = "hello\n"
+	require.NoError(t, conn.WriteMessage(websocket.BinaryMessage, []byte(payload)))
+	mt, echo, err := conn.ReadMessage()
+	require.NoError(t, err)
+	require.Equal(t, websocket.BinaryMessage, mt)
+	require.Equal(t, payload, string(echo))
+
+	// Kill the connection without a close handshake, so the server treats it as a drop and parks
+	// the session instead of tearing it down.
+	tcpConn, ok := conn.UnderlyingConn().(*net.TCPConn)
+	require.True(t, ok)
+	require.NoError(t, tcpConn.SetLinger(0))
+	require.NoError(t, tcpConn.Close())
+
+	// Reattach claiming to have delivered nothing, so the replay covers the whole echo.
+	resumed, _, err := websocket.DefaultDialer.Dial(wsURL+"?id="+sessionID+"&resume_version=2&delivered=0&reattach=1", nil) // nolint:bodyclose
+	require.NoError(t, err)
+	defer resumed.Close()
+
+	mt, greeting, err := resumed.ReadMessage()
+	require.NoError(t, err)
+	require.Equal(t, websocket.TextMessage, mt, "the reattach handshake must arrive before any payload")
+	var msg controlMessage
+	require.NoError(t, json.Unmarshal(greeting, &msg))
+	assert.Equal(t, int64(len(payload)), msg.Delivered, "the server wrote our payload to sshd, so that is its delivered count")
+
+	mt, replayed, err := resumed.ReadMessage()
+	require.NoError(t, err)
+	require.Equal(t, websocket.BinaryMessage, mt)
+	assert.Equal(t, payload, string(replayed), "the server must replay the echo the client claimed not to have")
+}
+
+// A reattach without the offset it replays from is meaningless, and silently treating it as a new
+// session is the failure this protocol is designed to avoid.
+func TestReattachWithoutADeliveredOffsetIsRejected(t *testing.T) {
+	server := createTestServer(t, 2, time.Hour)
+	defer server.Close()
+
+	wsURL := "ws" + server.URL[4:]
+	_, resp, err := websocket.DefaultDialer.Dial(wsURL+"?id=some-session&reattach=1", nil) // nolint:bodyclose
+	require.Error(t, err)
+	require.NotNil(t, resp)
+	defer resp.Body.Close()
+	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
+}
diff --git a/experimental/ssh/internal/proxy/resume_limits_test.go b/experimental/ssh/internal/proxy/resume_limits_test.go
new file mode 100644
index 00000000000..0b3077b0e6d
--- /dev/null
+++ b/experimental/ssh/internal/proxy/resume_limits_test.go
@@ -0,0 +1,270 @@
+//go:build !windows
+
+package proxy
+
+import (
+	"context"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"os/exec"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/gorilla/websocket"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// blackHoleServer accepts a resume-capable websocket, drains every frame the client sends and never
+// acknowledges any of it. That is what a peer whose own receiving loop is wedged looks like from
+// here: the socket is alive and writes succeed, but its delivered offset never moves.
+func blackHoleServer(t *testing.T) *httptest.Server {
+	return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		conn, err := (&websocket.Upgrader{}).Upgrade(w, r, nil)
+		if err != nil {
+			return
+		}
+		defer conn.Close()
+		for {
+			if _, _, err := conn.ReadMessage(); err != nil {
+				return
+			}
+		}
+	}))
+}
+
+// dropAtOnceServer accepts the upgrade and immediately resets the connection, so the session fails
+// before the SSH server's first byte could ever arrive.
+func dropAtOnceServer(t *testing.T) *httptest.Server {
+	return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		conn, err := (&websocket.Upgrader{}).Upgrade(w, r, nil)
+		if err != nil {
+			return
+		}
+		if tcpConn, ok := conn.UnderlyingConn().(*net.TCPConn); ok {
+			_ = tcpConn.SetLinger(0)
+		}
+		conn.Close()
+	}))
+}
+
+// serverWithConnections is createTestServer with the connections manager exposed, so a test can
+// assert the server released the session, and with the command it runs supplied by the caller.
+func serverWithConnections(t *testing.T, resumeGrace time.Duration, command createServerCommandFunc) (*httptest.Server, *ConnectionsManager) {
+	ctx := cmdio.MockDiscard(t.Context())
+	connections := NewConnectionsManager(1, time.Hour)
+	proxyServer := NewProxyServer(ctx, connections, command)
+	proxyServer.resumeGrace = resumeGrace
+	return httptest.NewServer(proxyServer), connections
+}
+
+// dropWebsocket ends a websocket the way a reset does, with no close handshake, so the peer treats
+// it as a drop rather than an orderly shutdown.
+func dropWebsocket(t *testing.T, conn *websocket.Conn) {
+	tcpConn, ok := conn.UnderlyingConn().(*net.TCPConn)
+	require.True(t, ok)
+	require.NoError(t, tcpConn.SetLinger(0))
+	require.NoError(t, tcpConn.Close())
+}
+
+// EOF on the source is how every clean exit begins: ssh closes the proxy command's stdin. Waiting
+// for the peer to acknowledge the tail is right, but it has to be bounded - a peer that reads
+// without ever acknowledging would otherwise keep the CLI alive after the ssh client that spawned
+// it is gone.
+func TestEOFEndsTheSessionWhenThePeerStopsAcknowledging(t *testing.T) {
+	restore := proxyEOFDrainTimeout
+	proxyEOFDrainTimeout = 500 * time.Millisecond
+	t.Cleanup(func() { proxyEOFDrainTimeout = restore })
+
+	server := blackHoleServer(t)
+	defer server.Close()
+
+	srcWriter, done := runResumableClientTo(t, server.URL, &sink{})
+	_, err := srcWriter.Write([]byte("hello\n"))
+	require.NoError(t, err)
+	// Let the write reach the peer, so the bytes are unacknowledged rather than unsent.
+	time.Sleep(200 * time.Millisecond)
+	require.NoError(t, srcWriter.Close())
+
+	select {
+	case <-done:
+	case <-time.After(30 * time.Second):
+		t.Fatal("the client never exited after EOF: it is waiting for an acknowledgment that will never arrive")
+	}
+}
+
+// The same wait on the server side, where it costs more: the session holds a client slot and keeps
+// the shutdown timer cancelled, so a session that is never released keeps the compute alive with
+// nobody attached to it.
+func TestServerReleasesASessionWhenTheClientStopsAcknowledging(t *testing.T) {
+	restore := proxyEOFDrainTimeout
+	proxyEOFDrainTimeout = 500 * time.Millisecond
+	t.Cleanup(func() { proxyEOFDrainTimeout = restore })
+
+	// sshd's stand-in prints and exits, so the server's sending loop reaches EOF straight away.
+	server, connections := serverWithConnections(t, 500*time.Millisecond, func(ctx context.Context) *exec.Cmd {
+		return exec.CommandContext(ctx, "sh", "-c", "echo hello; exit 0")
+	})
+	defer server.Close()
+
+	wsURL := "ws" + server.URL[4:]
+	conn, _, err := websocket.DefaultDialer.Dial(wsURL+"?id=no-acks&resume_version=2&delivered=0", nil) // nolint:bodyclose
+	require.NoError(t, err)
+	defer conn.Close()
+
+	// Read everything so the server's writes never block, but acknowledge nothing.
+	go func() {
+		for {
+			if _, _, err := conn.ReadMessage(); err != nil {
+				return
+			}
+		}
+	}()
+
+	require.Eventually(t, func() bool {
+		return connections.Count() == 0
+	}, 30*time.Second, 50*time.Millisecond,
+		"the server never released the session: its sending loop is still waiting for an acknowledgment of the bytes sshd printed before it exited")
+}
+
+// A session that dies before the SSH server's first byte must still report why. That error is what
+// the user sees instead of a bare ssh failure, and what telemetry attributes the drop from, so
+// losing it turns a failed session into an apparently clean exit.
+func TestASessionThatFailsBeforeTheFirstByteStillReportsTheFailure(t *testing.T) {
+	server := dropAtOnceServer(t)
+	defer server.Close()
+
+	const attempts = 20
+	silent := 0
+	for range attempts {
+		srcWriter, done := runPlainClientTo(t, server.URL, &sink{})
+		select {
+		case err := <-done:
+			if err == nil {
+				silent++
+			}
+		case <-time.After(30 * time.Second):
+			t.Fatal("the session neither ended nor reported a failure")
+		}
+		srcWriter.Close()
+	}
+	assert.Equal(t, 0, silent,
+		"%d of %d sessions that died before the first byte returned no error at all", silent, attempts)
+}
+
+// What a user is told when the tunnel connects and then keeps dropping before sshd answers. The
+// handshake timeout's own message blames a missing openssh-server, which for a network failure
+// sends them to the wrong place - and bills it to the wrong telemetry category.
+func TestEarlyDropIsReportedAsADropNotAMissingSshd(t *testing.T) {
+	server := dropAtOnceServer(t)
+	defer server.Close()
+
+	srcWriter, done := runResumableClientTo(t, server.URL, &sink{})
+	defer srcWriter.Close()
+
+	select {
+	case err := <-done:
+		require.Error(t, err)
+		assert.ErrorIs(t, err, ErrWebsocketDropped)
+		assert.NotErrorIs(t, err, errHandshakeTimeout)
+	case <-time.After(3 * time.Minute):
+		t.Fatal("the client never gave up on a connection that drops on every attempt")
+	}
+}
+
+// A dropped session holds its client slot for the whole grace period, and a user whose network
+// flapped long enough for ssh to give up comes back as a new session. This pins the cost: with the
+// slots full, that new session is refused until the abandoned ones expire.
+func TestAbandonedSessionsHoldTheirClientSlots(t *testing.T) {
+	server, _ := serverWithConnections(t, 5*time.Second, func(ctx context.Context) *exec.Cmd {
+		return exec.CommandContext(ctx, "cat", "-u")
+	})
+	defer server.Close()
+
+	wsURL := "ws" + server.URL[4:]
+	conn, _, err := websocket.DefaultDialer.Dial(wsURL+"?id=first&resume_version=2&delivered=0", nil) // nolint:bodyclose
+	require.NoError(t, err)
+	require.NoError(t, conn.WriteMessage(websocket.BinaryMessage, []byte("hello\n")))
+	_, _, err = conn.ReadMessage()
+	require.NoError(t, err)
+	dropWebsocket(t, conn)
+
+	_, resp, err := websocket.DefaultDialer.Dial(wsURL+"?id=second&resume_version=2&delivered=0", nil) // nolint:bodyclose
+	if resp != nil {
+		defer resp.Body.Close()
+	}
+	require.Error(t, err, "the abandoned session must still hold the only slot")
+	assert.Equal(t, http.StatusServiceUnavailable, resp.StatusCode)
+}
+
+// closingServer answers the first dial, sends one payload byte so the client is past its handshake
+// window, then ends the session with a normal-closure close frame carrying the given reason. A
+// later reattach is refused the way a server that has torn the session down refuses one.
+func closingServer(t *testing.T, reason string) (*httptest.Server, *atomic.Int64) {
+	var reattachAttempts atomic.Int64
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Query().Get("reattach") == "1" {
+			reattachAttempts.Add(1)
+			http.Error(w, "Session no longer exists", http.StatusGone)
+			return
+		}
+		conn, err := (&websocket.Upgrader{}).Upgrade(w, r, nil)
+		if err != nil {
+			return
+		}
+		defer conn.Close()
+		// A handler cannot fail the test directly; a write that fails here shows up as the client
+		// never seeing the close frame, which its own assertions report.
+		if err := conn.WriteMessage(websocket.BinaryMessage, []byte("x")); err != nil {
+			return
+		}
+		if err := conn.WriteMessage(websocket.CloseMessage,
+			websocket.FormatCloseMessage(websocket.CloseNormalClosure, reason)); err != nil {
+			return
+		}
+		time.Sleep(200 * time.Millisecond)
+	}))
+	return server, &reattachAttempts
+}
+
+// On a resumable connection the "finished" reason in a close frame is the only thing separating a
+// session that ended from a socket that died: a genuine drop arrives as a read error, never as a
+// close frame, so the code cannot tell them apart by anything else. That makes every clean exit
+// depend on the reason text surviving the path between the client and the workspace. Both readings
+// are pinned here, so a change to either side of that contract fails loudly rather than turning
+// every clean exit into a reported drop.
+func TestNormalClosureReasonDecidesCleanExitVersusDrop(t *testing.T) {
+	t.Run("the finished reason ends the session cleanly", func(t *testing.T) {
+		server, reattachAttempts := closingServer(t, proxySessionFinished)
+		defer server.Close()
+
+		srcWriter, done := runResumableClientTo(t, server.URL, &sink{})
+		defer srcWriter.Close()
+		select {
+		case err := <-done:
+			assert.NoError(t, err)
+		case <-time.After(30 * time.Second):
+			t.Fatal("the client did not notice the session had finished")
+		}
+		assert.Zero(t, reattachAttempts.Load(), "a finished session must not be reattached to")
+	})
+
+	t.Run("without the reason the same close frame is a drop", func(t *testing.T) {
+		server, reattachAttempts := closingServer(t, "")
+		defer server.Close()
+
+		srcWriter, done := runResumableClientTo(t, server.URL, &sink{})
+		defer srcWriter.Close()
+		select {
+		case err := <-done:
+			assert.ErrorIs(t, err, ErrWebsocketDropped)
+		case <-time.After(30 * time.Second):
+			t.Fatal("the client hung on a normal closure")
+		}
+		assert.Equal(t, int64(1), reattachAttempts.Load(),
+			"the client tries to reattach, so a stripped reason would warn the user and count a dropped tunnel on every clean exit")
+	})
+}
diff --git a/experimental/ssh/internal/proxy/resume_stress_test.go b/experimental/ssh/internal/proxy/resume_stress_test.go
new file mode 100644
index 00000000000..ff67d559cb3
--- /dev/null
+++ b/experimental/ssh/internal/proxy/resume_stress_test.go
@@ -0,0 +1,243 @@
+//go:build !windows
+
+package proxy
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"runtime"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/gorilla/websocket"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// sink collects everything the proxy writes to its destination. Unlike testBuffer it has no
+// bounded channel, which a multi-megabyte transfer would fill and then block the receiving loop
+// on - the stall would be the test's, not the proxy's.
+type sink struct {
+	mu  sync.Mutex
+	buf bytes.Buffer
+}
+
+func (s *sink) Write(p []byte) (int, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.buf.Write(p)
+}
+
+func (s *sink) Len() int {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.buf.Len()
+}
+
+func (s *sink) Bytes() []byte {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return append([]byte(nil), s.buf.Bytes()...)
+}
+
+// runResumableClientTo runs RunClientProxy against url with resume negotiated, writing what it
+// receives to dst. It returns the writer standing in for ssh's stdin and the session's outcome.
+func runResumableClientTo(t *testing.T, url string, dst io.Writer) (io.WriteCloser, <-chan error) {
+	ctx := cmdio.MockDiscard(t.Context())
+	wsURL := "ws" + url[4:]
+	createConn := func(ctx context.Context, dial DialRequest) (*websocket.Conn, error) {
+		u := fmt.Sprintf("%s?id=%s&resume_version=%d&delivered=%d", wsURL, dial.ConnID, ResumeProtocolVersion, dial.Delivered)
+		if dial.Reattach {
+			u += "&reattach=1"
+		}
+		conn, resp, err := websocket.DefaultDialer.DialContext(ctx, u, nil) // nolint:bodyclose
+		if resp != nil {
+			resp.Body.Close()
+		}
+		// Mirrors what createWebsocketConnection does in internal/client: a 4xx answer to a
+		// reattach is a permanent refusal, so the redial loop stops instead of spending its whole
+		// budget. Without it a test that refuses a reattach waits out proxyResumeBudget.
+		if err != nil && dial.Reattach && resp != nil && resp.StatusCode >= 400 && resp.StatusCode < 500 {
+			return nil, errors.Join(ErrReattachRejected, err)
+		}
+		return conn, err
+	}
+	src, srcWriter := io.Pipe()
+	done := make(chan error, 1)
+	go func() {
+		done <- RunClientProxy(ctx, src, dst, neverTick, time.Hour, true, createConn)
+	}()
+	return srcWriter, done
+}
+
+// runPlainClientTo is runResumableClientTo without resume, the path an older server gets.
+func runPlainClientTo(t *testing.T, url string, dst io.Writer) (io.WriteCloser, <-chan error) {
+	ctx := cmdio.MockDiscard(t.Context())
+	wsURL := "ws" + url[4:]
+	createConn := func(ctx context.Context, dial DialRequest) (*websocket.Conn, error) {
+		conn, _, err := websocket.DefaultDialer.DialContext(ctx, wsURL+"?id="+dial.ConnID, nil) // nolint:bodyclose
+		return conn, err
+	}
+	src, srcWriter := io.Pipe()
+	done := make(chan error, 1)
+	go func() {
+		done <- RunClientProxy(ctx, src, dst, neverTick, time.Hour, false, createConn)
+	}()
+	return srcWriter, done
+}
+
+// firstDifference reports where two byte streams diverge, so a failure names an offset instead of
+// dumping megabytes. Returns -1 when want is a prefix of got.
+func firstDifference(got, want []byte) int {
+	for i := range min(len(got), len(want)) {
+		if got[i] != want[i] {
+			return i
+		}
+	}
+	if len(got) < len(want) {
+		return len(got)
+	}
+	return -1
+}
+
+// context reports the bytes around an offset, for a failure message.
+func context16(b []byte, at int) string {
+	return string(b[max(at-16, 0):min(at+16, len(b))])
+}
+
+// resetClientLegs is resetClients without its assertions: a handover closes connections behind the
+// relay's back, so a leg that is already gone cannot be reset and is not a failure.
+func (r *tcpRelay) resetClientLegs() {
+	r.mu.Lock()
+	conns := r.clientConns
+	r.clientConns = nil
+	r.mu.Unlock()
+	for _, conn := range conns {
+		if conn.SetLinger(0) == nil {
+			conn.Close()
+		}
+	}
+}
+
+// One reset at a quiet moment is the easy case. Customers report drops several times a session, on
+// networks that flap, so resets have to be survivable wherever they land - including while a replay
+// is still being written. A single lost or duplicated byte fails SSH's MAC (RFC 4253 section 6) and
+// disconnects the session the resume exists to save, so the whole stream is compared, not sampled.
+func TestResumeStaysByteExactUnderAResetStorm(t *testing.T) {
+	server := createTestServer(t, 4, time.Hour)
+	defer server.Close()
+	relay := newTCPRelay(t, server.Listener.Addr().String())
+
+	out := &sink{}
+	srcWriter, done := runResumableClientTo(t, relay.URL(), out)
+
+	const chunks = 512
+	const chunkSize = 8 * 1024
+	var sent []byte
+	for i := range chunks {
+		sent = append(sent, bytes.Repeat([]byte{byte('A' + i%26)}, chunkSize)...)
+	}
+
+	storm := make(chan struct{})
+	stormDone := make(chan struct{})
+	var resets atomic.Int64
+	go func() {
+		defer close(stormDone)
+		for {
+			select {
+			case <-storm:
+				return
+			case <-time.After(7 * time.Millisecond):
+				relay.resetClientLegs()
+				resets.Add(1)
+			}
+		}
+	}()
+	stop := func() {
+		close(storm)
+		<-stormDone
+	}
+
+	writeDone := make(chan error, 1)
+	go func() {
+		// Paced, so the resets land inside the transfer rather than after it. A terminal or an scp
+		// stream is not delivered as one instantaneous burst either.
+		for i := range chunks {
+			if _, err := srcWriter.Write(sent[i*chunkSize : (i+1)*chunkSize]); err != nil {
+				writeDone <- err
+				return
+			}
+			time.Sleep(5 * time.Millisecond)
+		}
+		writeDone <- nil
+	}()
+
+	deadline := time.After(60 * time.Second)
+	for out.Len() < len(sent) {
+		select {
+		case err := <-done:
+			stop()
+			t.Fatalf("session ended after %d resets with %d/%d bytes echoed: %v", resets.Load(), out.Len(), len(sent), err)
+		case <-deadline:
+			stop()
+			t.Fatalf("transfer stalled after %d resets with %d/%d bytes echoed", resets.Load(), out.Len(), len(sent))
+		case <-time.After(20 * time.Millisecond):
+		}
+	}
+	stop()
+	require.NoError(t, <-writeDone)
+
+	got := out.Bytes()
+	if diff := firstDifference(got, sent); diff >= 0 {
+		t.Fatalf("the echoed stream diverges from what was sent at offset %d (after %d resets): got %q, want %q",
+			diff, resets.Load(), context16(got, diff), context16(sent, diff))
+	}
+	assert.Len(t, got, len(sent), "the echoed stream must not carry extra bytes")
+}
+
+// Every reset spawns a reattach, and a session on a flapping network gets hundreds of them.
+// Goroutines that outlive their reattach would accumulate for the life of the session.
+func TestRepeatedResetsDoNotLeakGoroutines(t *testing.T) {
+	server := createTestServer(t, 4, time.Hour)
+	defer server.Close()
+	relay := newTCPRelay(t, server.Listener.Addr().String())
+
+	out := &sink{}
+	srcWriter, done := runResumableClientTo(t, relay.URL(), out)
+
+	// Settle the session first, so the baseline covers only what the resets add.
+	_, err := srcWriter.Write([]byte("warmup\n"))
+	require.NoError(t, err)
+	require.Eventually(t, func() bool { return out.Len() >= len("warmup\n") }, 10*time.Second, 10*time.Millisecond)
+	time.Sleep(500 * time.Millisecond)
+	baseline := runtime.NumGoroutine()
+
+	const rounds = 30
+	for i := range rounds {
+		relay.resetClientLegs()
+		line := []byte("after reset\n")
+		want := out.Len() + len(line)
+		_, err := srcWriter.Write(line)
+		require.NoError(t, err)
+		require.Eventually(t, func() bool { return out.Len() >= want }, 20*time.Second, 10*time.Millisecond,
+			"round %d did not survive its reset", i)
+	}
+
+	select {
+	case err := <-done:
+		t.Fatalf("session ended during the resets: %v", err)
+	default:
+	}
+
+	// Reattach goroutines retire asynchronously, so give them a moment.
+	time.Sleep(time.Second)
+	assert.Less(t, runtime.NumGoroutine()-baseline, rounds,
+		"goroutine count grew from %d to %d across %d resets, which is close to one per reset",
+		baseline, runtime.NumGoroutine(), rounds)
+}
diff --git a/experimental/ssh/internal/proxy/resume_test.go b/experimental/ssh/internal/proxy/resume_test.go
new file mode 100644
index 00000000000..1ba09bfc13b
--- /dev/null
+++ b/experimental/ssh/internal/proxy/resume_test.go
@@ -0,0 +1,348 @@
+package proxy
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/gorilla/websocket"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestResumeRetriesADroppedHandshake(t *testing.T) {
+	ctx, cancel := context.WithTimeout(t.Context(), 3*time.Second)
+	defer cancel()
+	var attempts atomic.Int32
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		conn, err := (&websocket.Upgrader{}).Upgrade(w, r, nil)
+		if !assert.NoError(t, err) {
+			return
+		}
+		defer conn.Close()
+		if attempts.Add(1) == 1 {
+			return
+		}
+		assert.NoError(t, conn.WriteJSON(controlMessage{}))
+		<-ctx.Done()
+	}))
+	defer server.Close()
+	defer cancel()
+	pc := newResumableProxyConnection(func(ctx context.Context, req DialRequest) (*websocket.Conn, error) {
+		conn, resp, err := websocket.DefaultDialer.DialContext(ctx, "ws"+server.URL[4:], nil)
+		if resp != nil {
+			resp.Body.Close()
+		}
+		return conn, err
+	})
+	require.NoError(t, pc.dialReattach(ctx))
+	defer func() { _ = pc.closeConnection() }()
+	assert.Equal(t, int32(2), attempts.Load())
+}
+
+func TestResumeDoesNotRetryARejectedSession(t *testing.T) {
+	var attempts int
+	pc := newResumableProxyConnection(func(ctx context.Context, req DialRequest) (*websocket.Conn, error) {
+		attempts++
+		return nil, ErrReattachRejected
+	})
+	ctx, cancel := context.WithTimeout(t.Context(), time.Second)
+	defer cancel()
+	err := pc.dialReattach(ctx)
+	assert.ErrorIs(t, err, ErrReattachRejected)
+	assert.NoError(t, ctx.Err())
+	assert.Equal(t, 1, attempts)
+}
+
+func TestSendBufferWaitForSpace(t *testing.T) {
+	for _, cancelWait := range []bool{false, true} {
+		t.Run(fmt.Sprintf("cancel=%t", cancelWait), func(t *testing.T) {
+			b := newSendBuffer(8)
+			require.NoError(t, b.append([]byte("12345678")))
+			ctx, cancel := context.WithCancel(t.Context())
+			defer cancel()
+			done := make(chan error, 1)
+			go func() { done <- b.waitForSpace(ctx, 1) }()
+			select {
+			case err := <-done:
+				t.Fatalf("full window did not block: %v", err)
+			case <-time.After(20 * time.Millisecond):
+			}
+			if cancelWait {
+				cancel()
+			} else {
+				b.ack(1)
+			}
+			select {
+			case err := <-done:
+				assert.Equal(t, cancelWait, errors.Is(err, context.Canceled))
+			case <-time.After(time.Second):
+				t.Fatal("waiting producer did not wake up")
+			}
+		})
+	}
+}
+
+func TestParseDialRequestRequiresCorrectedResumeProtocol(t *testing.T) {
+	for _, tc := range []struct {
+		query      string
+		wantResume bool
+		wantError  bool
+	}{
+		{"id=test", false, false},
+		{"id=test&delivered=0", false, true},
+		{"id=test&resume_version=1&delivered=0", false, true},
+		{"id=test&resume_version=2&delivered=0", true, false},
+		{"id=test&resume_version=2&delivered=-1", false, true},
+		{"id=test&resume_version=2", false, true},
+		{"id=test&reattach=1", false, true},
+	} {
+		t.Run(tc.query, func(t *testing.T) {
+			req, err := parseDialRequest(httptest.NewRequest(http.MethodGet, "/?"+tc.query, nil))
+			if tc.wantError {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tc.wantResume, req.ResumeCapable)
+		})
+	}
+}
+
+func TestResumeCancellationInterruptsHandshake(t *testing.T) {
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+	ready := make(chan struct{})
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		conn, err := (&websocket.Upgrader{}).Upgrade(w, r, nil)
+		if !assert.NoError(t, err) {
+			return
+		}
+		defer conn.Close()
+		close(ready)
+		_, _, _ = conn.ReadMessage()
+	}))
+	defer server.Close()
+	pc := newResumableProxyConnection(func(ctx context.Context, req DialRequest) (*websocket.Conn, error) {
+		conn, resp, err := websocket.DefaultDialer.DialContext(ctx, "ws"+server.URL[4:], nil)
+		if resp != nil {
+			resp.Body.Close()
+		}
+		return conn, err
+	})
+	done := make(chan error, 1)
+	go func() { done <- pc.dialReattach(ctx) }()
+	<-ready
+	cancel()
+	select {
+	case err := <-done:
+		assert.ErrorIs(t, err, context.Canceled)
+	case <-time.After(time.Second):
+		t.Fatal("cancellation did not interrupt the handshake")
+	}
+}
+
+func TestResumeReplaysFullWindowsInBothDirections(t *testing.T) {
+	ctx, cancel := context.WithTimeout(t.Context(), 4*time.Second)
+	defer cancel()
+	// TestResumeBackpressure covers the production limit. A smaller window keeps this
+	// simultaneous replay test focused on coordination rather than transfer volume.
+	const testWindow = 1 << 20
+	serverProxy := newResumableProxyConnection(nil)
+	serverProxy.resume.sendBuf = newSendBuffer(testWindow)
+	var accepted atomic.Bool
+	server := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if accepted.CompareAndSwap(false, true) {
+			assert.NoError(t, serverProxy.accept(w, r))
+			return
+		}
+		req, err := parseDialRequest(r)
+		if assert.NoError(t, err) {
+			if req.Reattach {
+				_ = serverProxy.acceptReattach(ctx, w, r, req.Delivered)
+			} else {
+				_ = serverProxy.acceptHandover(ctx, w, r)
+			}
+		}
+	}))
+	server.Config.ConnState = func(conn net.Conn, state http.ConnState) {
+		if state == http.StateHijacked {
+			assert.NoError(t, conn.(*net.TCPConn).SetWriteBuffer(4096))
+		}
+	}
+	server.Start()
+	defer server.Close()
+	defer cancel()
+	sessionCtx := ctx
+	clientProxy := newResumableProxyConnection(func(ctx context.Context, req DialRequest) (*websocket.Conn, error) {
+		url := fmt.Sprintf("ws%s?id=test&resume_version=2&delivered=%d", server.URL[4:], req.Delivered)
+		if req.Reattach {
+			url += "&reattach=1"
+		}
+		dialer := websocket.Dialer{NetDialContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
+			conn, err := (&net.Dialer{}).DialContext(ctx, network, addr)
+			if err == nil {
+				err = conn.(*net.TCPConn).SetWriteBuffer(4096)
+			}
+			return conn, err
+		}}
+		conn, resp, err := dialer.DialContext(ctx, url, nil)
+		if resp != nil {
+			resp.Body.Close()
+		}
+		if err == nil {
+			context.AfterFunc(sessionCtx, func() { conn.Close() })
+		}
+		return conn, err
+	})
+	clientProxy.resume.sendBuf = newSendBuffer(testWindow)
+	require.NoError(t, clientProxy.connect(ctx))
+	<-serverProxy.ready
+	defer func() { _ = serverProxy.closeConnection() }()
+	defer func() { _ = clientProxy.closeConnection() }()
+
+	// Both writes failed before reaching the peer. Neither direction has room for
+	// new payload, and neither can finish replay unless the peer resumes reading.
+	toClient := bytes.Repeat([]byte("s"), testWindow)
+	toServer := bytes.Repeat([]byte("c"), testWindow)
+	require.NoError(t, serverProxy.resume.sendBuf.append(toClient))
+	require.NoError(t, clientProxy.resume.sendBuf.append(toServer))
+	require.NoError(t, clientProxy.closeConnection())
+
+	clientInput, clientWriter := io.Pipe()
+	serverInput, serverWriter := io.Pipe()
+	defer clientWriter.Close()
+	defer serverWriter.Close()
+	clientOutput := newTestBuffer(t)
+	serverOutput := newTestBuffer(t)
+	clientOutput.OnWrite = make(chan []byte, 4096)
+	serverOutput.OnWrite = make(chan []byte, 4096)
+	done := make(chan error, 2)
+	go func() { done <- serverProxy.start(ctx, serverInput, serverOutput) }()
+	go func() { done <- clientProxy.start(ctx, clientInput, clientOutput) }()
+	require.Eventually(t, func() bool {
+		return clientOutput.Contains(toClient) && serverOutput.Contains(toServer)
+	}, 2*time.Second, time.Millisecond, "both peers must read while replaying")
+
+	// Resume must remain available after a transfer larger than the replay window,
+	// including an auth handover and another reset while data is in flight.
+	moreClient := bytes.Repeat([]byte("download"), testWindow)
+	moreServer := bytes.Repeat([]byte("upload!!"), testWindow)
+	writes := make(chan error, 2)
+	go func() { _, err := serverWriter.Write(moreClient); writes <- err }()
+	go func() { _, err := clientWriter.Write(moreServer); writes <- err }()
+	require.NoError(t, clientProxy.initiateHandover(ctx))
+	require.NoError(t, clientProxy.conn.Load().UnderlyingConn().Close())
+	for range 2 {
+		select {
+		case err := <-writes:
+			require.NoError(t, err)
+		case <-ctx.Done():
+			t.Fatal("transfer stalled after reattach")
+		}
+	}
+	toClient = append(toClient, moreClient...)
+	toServer = append(toServer, moreServer...)
+	require.Eventually(t, func() bool {
+		return clientOutput.Contains(toClient) && serverOutput.Contains(toServer)
+	}, 2*time.Second, time.Millisecond, "large transfers must remain byte-exact after reconnecting")
+	cancel()
+	for range 2 {
+		select {
+		case <-done:
+		case <-time.After(time.Second):
+			t.Fatal("proxy did not stop")
+		}
+	}
+	assert.Len(t, clientOutput.String(), len(toClient))
+	assert.Len(t, serverOutput.String(), len(toServer))
+}
+
+func TestSendBufferReplaysWhatThePeerMissed(t *testing.T) {
+	b := newSendBuffer(64)
+	require.NoError(t, b.append([]byte("hello ")))
+	require.NoError(t, b.append([]byte("world")))
+
+	// The peer wrote only the first 6 bytes before the connection broke.
+	missing, err := b.replayFrom(6)
+	require.NoError(t, err)
+	assert.Equal(t, "world", string(missing))
+}
+
+func TestSendBufferReplayFromCurrentOffsetIsEmpty(t *testing.T) {
+	b := newSendBuffer(64)
+	require.NoError(t, b.append([]byte("hello")))
+
+	missing, err := b.replayFrom(5)
+	require.NoError(t, err)
+	assert.Empty(t, missing)
+}
+
+func TestSendBufferAckDiscardsThePrefix(t *testing.T) {
+	b := newSendBuffer(64)
+	require.NoError(t, b.append([]byte("aaaabbbb")))
+	b.ack(4)
+
+	// Everything from the acknowledged offset is still replayable.
+	missing, err := b.replayFrom(4)
+	require.NoError(t, err)
+	assert.Equal(t, "bbbb", string(missing))
+
+	// The discarded prefix is not.
+	_, err = b.replayFrom(3)
+	assert.ErrorIs(t, err, errReplayUnavailable)
+}
+
+func TestSendBufferAckFreesTheWindow(t *testing.T) {
+	b := newSendBuffer(8)
+	require.NoError(t, b.append([]byte("12345678")))
+	require.ErrorIs(t, b.append([]byte("9")), errSendWindowExhausted)
+
+	b.ack(8)
+	assert.NoError(t, b.append([]byte("9")))
+}
+
+func TestSendBufferIgnoresStaleAndImpossibleAcks(t *testing.T) {
+	b := newSendBuffer(64)
+	require.NoError(t, b.append([]byte("abcdef")))
+	b.ack(4)
+
+	// A stale ack must not rewind the buffer, and an ack beyond what we sent must not
+	// discard bytes the peer cannot have received.
+	b.ack(2)
+	b.ack(99)
+
+	missing, err := b.replayFrom(4)
+	require.NoError(t, err)
+	assert.Equal(t, "ef", string(missing))
+}
+
+func TestSendBufferRejectsAnImpossibleReplayOffset(t *testing.T) {
+	b := newSendBuffer(64)
+	require.NoError(t, b.append([]byte("abc")))
+
+	_, err := b.replayFrom(4)
+	require.Error(t, err)
+	assert.NotErrorIs(t, err, errReplayUnavailable)
+}
+
+func TestSendBufferReplayIsACopy(t *testing.T) {
+	b := newSendBuffer(64)
+	require.NoError(t, b.append([]byte("abcdef")))
+
+	missing, err := b.replayFrom(0)
+	require.NoError(t, err)
+	missing[0] = 'z'
+
+	again, err := b.replayFrom(0)
+	require.NoError(t, err)
+	assert.Equal(t, "abcdef", string(again), "mutating a replay must not corrupt the buffer")
+}
diff --git a/experimental/ssh/internal/proxy/server.go b/experimental/ssh/internal/proxy/server.go
index c709e85a72c..fd5a93417ba 100644
--- a/experimental/ssh/internal/proxy/server.go
+++ b/experimental/ssh/internal/proxy/server.go
@@ -2,10 +2,12 @@ package proxy
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"net/http"
 	"os"
 	"os/exec"
+	"strconv"
 	"time"
 
 	"github.com/databricks/cli/libs/log"
@@ -20,6 +22,7 @@ type proxyServer struct {
 	ctx                 context.Context
 	connections         *ConnectionsManager
 	createServerCommand createServerCommandFunc
+	resumeGrace         time.Duration
 }
 
 func NewProxyServer(ctx context.Context, connections *ConnectionsManager, createServerCommand createServerCommandFunc) *proxyServer {
@@ -27,6 +30,7 @@ func NewProxyServer(ctx context.Context, connections *ConnectionsManager, create
 		ctx:                 ctx,
 		connections:         connections,
 		createServerCommand: createServerCommand,
+		resumeGrace:         proxyResumeGrace,
 	}
 }
 
@@ -36,12 +40,69 @@ func (server *proxyServer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "Missing 'id' query parameter", http.StatusBadRequest)
 		return
 	}
+	req, err := parseDialRequest(r)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
 	ctx := log.NewContext(server.ctx, log.GetLogger(server.ctx).With("session", id))
-	if conn, exists := server.connections.Get(id); exists && conn != nil {
+	conn, exists := server.connections.Get(id)
+	switch {
+	case exists && conn != nil && req.Reattach:
+		server.handleReattach(ctx, w, r, conn, req)
+	case exists && conn != nil:
 		server.handleExistingConnection(ctx, w, r, conn)
-	} else {
-		server.handleNewConnection(ctx, w, r, id)
+	case req.Reattach:
+		// The session is gone: its grace period expired, or the server restarted. Say so instead
+		// of starting a fresh one. A new sshd would answer the client's replayed bytes with a
+		// fresh SSH handshake, and ssh would fail on a corrupted MAC rather than a clear error.
+		log.Info(ctx, "Reattach requested for a session that no longer exists")
+		http.Error(w, "Session no longer exists", http.StatusGone)
+	default:
+		server.handleNewConnection(ctx, w, r, id, req)
+	}
+}
+
+// parseDialRequest reads the resume protocol's query parameters. Both are absent for a client
+// that does not speak it, which leaves the session non-resumable on this side too.
+func parseDialRequest(r *http.Request) (DialRequest, error) {
+	query := r.URL.Query()
+	req := DialRequest{
+		ConnID:   query.Get("id"),
+		Reattach: query.Get("reattach") == "1",
+	}
+	if raw := query.Get("delivered"); raw != "" {
+		if query.Get(ResumeVersionParameter) != strconv.Itoa(ResumeProtocolVersion) {
+			return DialRequest{}, fmt.Errorf("session resume requires %s=%d", ResumeVersionParameter, ResumeProtocolVersion)
+		}
+		delivered, err := strconv.ParseInt(raw, 10, 64)
+		if err != nil || delivered < 0 {
+			return DialRequest{}, fmt.Errorf("invalid 'delivered' query parameter: %q", raw)
+		}
+		req.Delivered = delivered
+		req.ResumeCapable = true
+	}
+	if req.Reattach && !req.ResumeCapable {
+		return DialRequest{}, errors.New("'reattach' requires the 'delivered' query parameter")
 	}
+	if query.Has(ResumeVersionParameter) && !req.ResumeCapable {
+		return DialRequest{}, errors.New("'resume_version' requires the 'delivered' query parameter")
+	}
+	return req, nil
+}
+
+func (server *proxyServer) handleReattach(ctx context.Context, w http.ResponseWriter, r *http.Request, conn *proxyConnection, req DialRequest) {
+	if !conn.resumable() {
+		log.Info(ctx, "Reattach requested for a session that was not started as resumable")
+		http.Error(w, "Session is not resumable", http.StatusConflict)
+		return
+	}
+	log.Info(ctx, "Client reattaching to a dropped connection")
+	if err := conn.acceptReattach(ctx, w, r, req.Delivered); err != nil {
+		log.Errorf(ctx, "Failed to accept the reattach: %v", err)
+		return
+	}
+	log.Info(ctx, "Reattach accepted")
 }
 
 func (server *proxyServer) handleExistingConnection(ctx context.Context, w http.ResponseWriter, r *http.Request, conn *proxyConnection) {
@@ -55,8 +116,16 @@ func (server *proxyServer) handleExistingConnection(ctx context.Context, w http.
 	}
 }
 
-func (server *proxyServer) handleNewConnection(ctx context.Context, w http.ResponseWriter, r *http.Request, id string) {
-	conn := newProxyConnection(nil)
+func (server *proxyServer) handleNewConnection(ctx context.Context, w http.ResponseWriter, r *http.Request, id string, req DialRequest) {
+	// The server never dials, so it passes no connection factory: reattaching, for it, means
+	// waiting for the client to come back.
+	var conn *proxyConnection
+	if req.ResumeCapable {
+		conn = newResumableProxyConnection(nil)
+		conn.resume.grace = server.resumeGrace
+	} else {
+		conn = newProxyConnection(nil)
+	}
 	if !server.connections.TryAdd(id, conn) {
 		log.Info(ctx, "Maximum clients reached, rejecting connection")
 		http.Error(w, "Maximum clients reached", http.StatusServiceUnavailable)
@@ -76,7 +145,7 @@ func (server *proxyServer) handleNewConnection(ctx context.Context, w http.Respo
 func runServerProxy(ctx context.Context, proxy *proxyConnection, createServerCommand createServerCommandFunc, w http.ResponseWriter, r *http.Request) error {
 	err := proxy.accept(w, r)
 	if err != nil {
-		return fmt.Errorf("failed to upgrade to websockets: %v", err)
+		return fmt.Errorf("failed to upgrade to websockets: %w", err)
 	}
 	defer closeProxyConnection(ctx, proxy)
 	log.Infof(ctx, "New connection accepted")
@@ -90,23 +159,24 @@ func runServerProxy(ctx context.Context, proxy *proxyConnection, createServerCom
 
 	sshdStdin, err := serverCmd.StdinPipe()
 	if err != nil {
-		return fmt.Errorf("failed to get stdin pipe: %v", err)
+		return fmt.Errorf("failed to get stdin pipe: %w", err)
 	}
 
 	sshdStdout, err := serverCmd.StdoutPipe()
 	if err != nil {
-		return fmt.Errorf("failed to get stdout pipe: %v", err)
+		return fmt.Errorf("failed to get stdout pipe: %w", err)
 	}
 
 	err = serverCmd.Start()
 	if err != nil {
-		return fmt.Errorf("failed to start SSHD process: %v", err)
+		return fmt.Errorf("failed to start SSHD process: %w", err)
 	}
 	defer releaseServerCommand(ctx, serverCmd)
 
 	g, gCtx := errgroup.WithContext(ctx)
 	g.Go(func() error {
-		defer closeProxyConnection(ctx, proxy)
+		// Let the sending loop drain stdout and receive its final acknowledgment
+		// before closing the websocket, even if the process has already exited.
 		// Waiting on the underlying Process, not the command itself.
 		// Command.Wait needs to be called to release all resources,
 		// but it's only safe to do so after we've finished reading from stdout,
diff --git a/experimental/ssh/internal/server/descendants.go b/experimental/ssh/internal/server/descendants.go
new file mode 100644
index 00000000000..e23b8c499ee
--- /dev/null
+++ b/experimental/ssh/internal/server/descendants.go
@@ -0,0 +1,112 @@
+package server
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"slices"
+	"strconv"
+	"strings"
+)
+
+// procRoot is the procfs mount point. The functions below take the root as an argument
+// so tests can run against a fixture tree instead of the live one.
+const procRoot = "/proc"
+
+// procStat is the part of /proc/<pid>/stat this package reads.
+type procStat struct {
+	state string
+	ppid  int
+	pgrp  int
+}
+
+// parseProcStat reads state, ppid and pgrp out of the contents of /proc/<pid>/stat.
+func parseProcStat(content string) (procStat, error) {
+	// Anchor on the last ')' instead of splitting from the left: the second field is the
+	// executable name, and it can contain both spaces and parentheses.
+	_, after, ok := strings.CutLast(content, ")")
+	if !ok {
+		return procStat{}, fmt.Errorf("no comm field in %q", content)
+	}
+	// state, ppid and pgrp are the three fields that follow comm.
+	fields := strings.Fields(after)
+	if len(fields) < 3 {
+		return procStat{}, fmt.Errorf("expected state, ppid and pgrp after comm in %q", content)
+	}
+	ppid, err := strconv.Atoi(fields[1])
+	if err != nil {
+		return procStat{}, fmt.Errorf("failed to parse ppid in %q: %w", content, err)
+	}
+	pgrp, err := strconv.Atoi(fields[2])
+	if err != nil {
+		return procStat{}, fmt.Errorf("failed to parse pgrp in %q: %w", content, err)
+	}
+	return procStat{state: fields[0], ppid: ppid, pgrp: pgrp}, nil
+}
+
+func readProcStat(root string, pid int) (procStat, error) {
+	content, err := os.ReadFile(filepath.Join(root, strconv.Itoa(pid), "stat"))
+	if err != nil {
+		return procStat{}, err
+	}
+	return parseProcStat(string(content))
+}
+
+// detachedDescendants returns the pids of processes the SSH session started that left
+// the server's process group - what tmux, setsid, disown and a plain background command
+// all do.
+//
+// They surface as siblings of the server: the bootstrap notebook sets
+// PR_SET_CHILD_SUBREAPER, so a process that orphans itself is reparented to the notebook
+// rather than to PID 1. Taking the notebook's children and excluding the server's own
+// process group therefore leaves exactly the detached work - the server's sshd children
+// stay in its group, and the notebook starts nothing else.
+func detachedDescendants(root string, selfPid int) ([]int, error) {
+	self, err := readProcStat(root, selfPid)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read own process stat: %w", err)
+	}
+	// The notebook is gone and the server has been reparented to PID 1: there is no
+	// anchor left to enumerate against, and nothing left to keep alive.
+	if self.ppid <= 1 {
+		return nil, nil
+	}
+
+	entries, err := os.ReadDir(root)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read %s: %w", root, err)
+	}
+
+	var pids []int
+	for _, entry := range entries {
+		pid, err := strconv.Atoi(entry.Name())
+		if err != nil {
+			// Not a process directory.
+			continue
+		}
+		stat, err := readProcStat(root, pid)
+		if err != nil {
+			// The process exited while we were walking, or its stat is unreadable.
+			continue
+		}
+		if stat.ppid != self.ppid || stat.pgrp == self.pgrp {
+			continue
+		}
+		// Zombies are already dead; the notebook's SIGCHLD handler collects them.
+		if strings.HasPrefix(stat.state, "Z") {
+			continue
+		}
+		pids = append(pids, pid)
+	}
+	slices.Sort(pids)
+	return pids, nil
+}
+
+// formatPids renders pids for a log line, e.g. "1234, 1235".
+func formatPids(pids []int) string {
+	parts := make([]string, len(pids))
+	for i, pid := range pids {
+		parts[i] = strconv.Itoa(pid)
+	}
+	return strings.Join(parts, ", ")
+}
diff --git a/experimental/ssh/internal/server/descendants_test.go b/experimental/ssh/internal/server/descendants_test.go
new file mode 100644
index 00000000000..6fe22fb50fe
--- /dev/null
+++ b/experimental/ssh/internal/server/descendants_test.go
@@ -0,0 +1,161 @@
+package server
+
+import (
+	"os"
+	"path/filepath"
+	"runtime"
+	"strconv"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// fakeProc writes a /proc-like tree. Each process is described by its ppid, pgrp and state.
+type fakeProcess struct {
+	comm  string
+	ppid  int
+	pgrp  int
+	state string
+}
+
+func fakeProc(t *testing.T, processes map[int]fakeProcess) string {
+	t.Helper()
+	root := t.TempDir()
+	for pid, p := range processes {
+		dir := filepath.Join(root, strconv.Itoa(pid))
+		require.NoError(t, os.MkdirAll(dir, 0o755))
+		// The real format has 50+ fields; only the four leading ones are read.
+		line := strconv.Itoa(pid) + " (" + p.comm + ") " + p.state + " " +
+			strconv.Itoa(p.ppid) + " " + strconv.Itoa(p.pgrp) + " 0 0 -1 4194304\n"
+		require.NoError(t, os.WriteFile(filepath.Join(dir, "stat"), []byte(line), 0o644))
+	}
+	return root
+}
+
+func TestParseProcStat(t *testing.T) {
+	t.Run("parses state, ppid and pgrp", func(t *testing.T) {
+		got, err := parseProcStat("4242 (databricks) S 4200 4242 4242 0 -1 4194304 1 0")
+		require.NoError(t, err)
+		assert.Equal(t, procStat{state: "S", ppid: 4200, pgrp: 4242}, got)
+	})
+
+	// The comm field is unquoted and may contain spaces and parentheses, so the fields
+	// after it can only be located from the last ')'.
+	t.Run("handles a comm with spaces and parentheses", func(t *testing.T) {
+		got, err := parseProcStat("7 (weird ) name) R 3 9 9 0 -1 0")
+		require.NoError(t, err)
+		assert.Equal(t, procStat{state: "R", ppid: 3, pgrp: 9}, got)
+	})
+
+	t.Run("rejects a line without comm", func(t *testing.T) {
+		_, err := parseProcStat("4242 S 4200 4242")
+		assert.ErrorContains(t, err, "no comm field")
+	})
+
+	t.Run("rejects a truncated line", func(t *testing.T) {
+		_, err := parseProcStat("4242 (databricks) S 4200")
+		assert.ErrorContains(t, err, "expected state, ppid and pgrp")
+	})
+}
+
+func TestDetachedDescendants(t *testing.T) {
+	// The shape the server sees at teardown: the notebook (100) is the subreaper, the
+	// server (200) leads its own group, sshd (300) is in the server's group, and the
+	// detached work (400, 500) has been reparented onto the notebook with its own groups.
+	const notebook, server, sshd = 100, 200, 300
+
+	t.Run("returns detached work only", func(t *testing.T) {
+		root := fakeProc(t, map[int]fakeProcess{
+			notebook: {comm: "python", ppid: 1, pgrp: notebook, state: "S"},
+			server:   {comm: "databricks", ppid: notebook, pgrp: server, state: "S"},
+			sshd:     {comm: "sshd", ppid: server, pgrp: server, state: "S"},
+			400:      {comm: "tmux: server", ppid: notebook, pgrp: 400, state: "S"},
+			500:      {comm: "train.py", ppid: notebook, pgrp: 500, state: "R"},
+		})
+
+		pids, err := detachedDescendants(root, server)
+		require.NoError(t, err)
+		assert.Equal(t, []int{400, 500}, pids)
+	})
+
+	t.Run("excludes the server's own process group", func(t *testing.T) {
+		// A login shell that sshd put in its own group, but that is still parented by
+		// sshd rather than adopted by the notebook, is not detached work.
+		root := fakeProc(t, map[int]fakeProcess{
+			notebook: {comm: "python", ppid: 1, pgrp: notebook, state: "S"},
+			server:   {comm: "databricks", ppid: notebook, pgrp: server, state: "S"},
+			sshd:     {comm: "sshd", ppid: server, pgrp: server, state: "S"},
+			400:      {comm: "bash", ppid: sshd, pgrp: 400, state: "S"},
+		})
+
+		pids, err := detachedDescendants(root, server)
+		require.NoError(t, err)
+		assert.Empty(t, pids)
+	})
+
+	t.Run("skips zombies", func(t *testing.T) {
+		root := fakeProc(t, map[int]fakeProcess{
+			notebook: {comm: "python", ppid: 1, pgrp: notebook, state: "S"},
+			server:   {comm: "databricks", ppid: notebook, pgrp: server, state: "S"},
+			400:      {comm: "gone", ppid: notebook, pgrp: 400, state: "Z"},
+		})
+
+		pids, err := detachedDescendants(root, server)
+		require.NoError(t, err)
+		assert.Empty(t, pids)
+	})
+
+	// The notebook died first, so the server was reparented to PID 1. Nothing is anchored
+	// any more and there is no sibling set to enumerate.
+	t.Run("returns nothing once the notebook is gone", func(t *testing.T) {
+		root := fakeProc(t, map[int]fakeProcess{
+			1:      {comm: "systemd", ppid: 0, pgrp: 1, state: "S"},
+			server: {comm: "databricks", ppid: 1, pgrp: server, state: "S"},
+			400:    {comm: "tmux: server", ppid: 1, pgrp: 400, state: "S"},
+		})
+
+		pids, err := detachedDescendants(root, server)
+		require.NoError(t, err)
+		assert.Empty(t, pids)
+	})
+
+	t.Run("ignores unreadable and non-process entries", func(t *testing.T) {
+		root := fakeProc(t, map[int]fakeProcess{
+			notebook: {comm: "python", ppid: 1, pgrp: notebook, state: "S"},
+			server:   {comm: "databricks", ppid: notebook, pgrp: server, state: "S"},
+			400:      {comm: "tmux: server", ppid: notebook, pgrp: 400, state: "S"},
+		})
+		require.NoError(t, os.MkdirAll(filepath.Join(root, "self"), 0o755))
+		// A process that exited between the readdir and the stat read.
+		require.NoError(t, os.MkdirAll(filepath.Join(root, "999"), 0o755))
+
+		pids, err := detachedDescendants(root, server)
+		require.NoError(t, err)
+		assert.Equal(t, []int{400}, pids)
+	})
+
+	t.Run("fails when own stat is missing", func(t *testing.T) {
+		_, err := detachedDescendants(t.TempDir(), server)
+		assert.ErrorContains(t, err, "failed to read own process stat")
+	})
+}
+
+// The fixtures above are hand-written, so this pins the field offsets against a real
+// /proc/<pid>/stat. The server only ever runs on Linux compute.
+func TestParseProcStatAgainstRealProcfs(t *testing.T) {
+	if runtime.GOOS != "linux" {
+		t.Skip("procfs is Linux-only")
+	}
+
+	got, err := readProcStat(procRoot, os.Getpid())
+	require.NoError(t, err)
+	assert.Equal(t, os.Getppid(), got.ppid)
+	assert.NotZero(t, got.pgrp)
+	assert.NotEmpty(t, got.state)
+}
+
+func TestFormatPids(t *testing.T) {
+	assert.Equal(t, "1, 22, 333", formatPids([]int{1, 22, 333}))
+	assert.Empty(t, formatPids(nil))
+}
diff --git a/experimental/ssh/internal/server/export_test.go b/experimental/ssh/internal/server/export_test.go
new file mode 100644
index 00000000000..7f09b1f4dda
--- /dev/null
+++ b/experimental/ssh/internal/server/export_test.go
@@ -0,0 +1,14 @@
+package server
+
+var (
+	WorkspaceToken        = workspaceToken
+	FuseUserInfo          = fuseUserInfo
+	StartFuseRegistration = startFuseRegistration
+	WaitForIdleShutdown   = waitForIdleShutdown
+	ProcWithDetachedWork  = procWithDetachedWork
+)
+
+const (
+	DetachedProcessCheckInterval = detachedProcessCheckInterval
+	TestServerPid                = testServerPid
+)
diff --git a/experimental/ssh/internal/server/fuse.go b/experimental/ssh/internal/server/fuse.go
new file mode 100644
index 00000000000..23366728ab0
--- /dev/null
+++ b/experimental/ssh/internal/server/fuse.go
@@ -0,0 +1,71 @@
+package server
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/databricks/cli/experimental/ssh/internal/fuse"
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/service/iam"
+)
+
+func startFuseRegistration(ctx context.Context, client *databricks.WorkspaceClient, serverless bool) {
+	// Serverless rejects non-root UIDs on the daemon ports; the bootstrap REPL's own registration already covers the server's descendants.
+	if serverless {
+		log.Info(ctx, "Skipping SSH filesystem registration on serverless; /Workspace and /Volumes access depends on the bootstrap notebook")
+		return
+	}
+
+	// Filesystem registration is best-effort on compute without reachable daemons.
+	if err := registerFuseCredentials(ctx, client); err != nil {
+		log.Warnf(ctx, "Failed to register SSH filesystem credentials; file access may depend on the bootstrap notebook: %v", err)
+	}
+}
+
+func registerFuseCredentials(ctx context.Context, client *databricks.WorkspaceClient) error {
+	self, err := fuse.Self()
+	if err != nil {
+		return err
+	}
+	fuseClient, err := fuse.NewClient(self)
+	if err != nil {
+		return err
+	}
+	userID, notebookDir := fuseUserInfo(ctx, client)
+	return fuse.KeepRegistered(ctx, fuseClient, workspaceToken(client), userID, notebookDir)
+}
+
+func fuseUserInfo(ctx context.Context, client *databricks.WorkspaceClient) (userID, notebookDir string) {
+	// User metadata is optional. Limit its lookup before publishing the server port.
+	userCtx, cancel := context.WithTimeout(ctx, 2*time.Second)
+	defer cancel()
+	me, err := client.CurrentUser.Me(userCtx, iam.MeRequest{})
+	if err != nil {
+		log.Debugf(ctx, "Registering filesystem credentials without user metadata: %v", err)
+		return "", ""
+	}
+	return me.Id, "/Users/" + me.UserName
+}
+
+func workspaceToken(client *databricks.WorkspaceClient) fuse.TokenFunc {
+	return func(ctx context.Context) (string, error) {
+		req, err := http.NewRequestWithContext(ctx, http.MethodGet, client.Config.Host, nil)
+		if err != nil {
+			return "", fmt.Errorf("failed to build authentication request: %w", err)
+		}
+		// Authenticate picks up refreshed credentials, unlike reading Config.Token directly.
+		if err := client.Config.Authenticate(req); err != nil {
+			return "", fmt.Errorf("failed to authenticate: %w", err)
+		}
+		token, ok := strings.CutPrefix(req.Header.Get("Authorization"), "Bearer ")
+		if !ok || token == "" {
+			return "", errors.New("resolved credentials do not provide a bearer token")
+		}
+		return token, nil
+	}
+}
diff --git a/experimental/ssh/internal/server/fuse_test.go b/experimental/ssh/internal/server/fuse_test.go
new file mode 100644
index 00000000000..393c5ddaa35
--- /dev/null
+++ b/experimental/ssh/internal/server/fuse_test.go
@@ -0,0 +1,140 @@
+package server_test
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"io"
+	"log/slog"
+	"net/http"
+	"strings"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/databricks/cli/experimental/ssh/internal/server"
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/config"
+	"github.com/databricks/databricks-sdk-go/config/credentials"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type testCredentials struct{ authenticate func(*http.Request) error }
+
+func (c testCredentials) Name() string { return "test" }
+
+func (c testCredentials) Configure(context.Context, *config.Config) (credentials.CredentialsProvider, error) {
+	return credentials.CredentialsProviderFn(c.authenticate), nil
+}
+
+func TestWorkspaceToken(t *testing.T) {
+	for _, header := range []string{"Bearer token-one", "Basic private-credential", "Bearer ", ""} {
+		t.Run(header, func(t *testing.T) {
+			c, err := databricks.NewWorkspaceClient(&databricks.Config{
+				Host: "https://workspace.test", HostMetadataResolver: noHostMetadata, Token: "stale-config-token",
+				Credentials: testCredentials{authenticate: func(r *http.Request) error {
+					r.Header.Set("Authorization", header)
+					return nil
+				}},
+			})
+			require.NoError(t, err)
+			token, err := server.WorkspaceToken(c)(t.Context())
+			if header == "Bearer token-one" {
+				require.NoError(t, err)
+				assert.Equal(t, "token-one", token)
+				return
+			}
+			require.ErrorContains(t, err, "do not provide a bearer token")
+			assert.NotContains(t, err.Error(), "private-credential")
+			assert.Empty(t, token)
+		})
+	}
+}
+
+func TestWorkspaceTokenRefreshAndFailure(t *testing.T) {
+	value := "first"
+	var authErr error
+	c, err := databricks.NewWorkspaceClient(&databricks.Config{
+		Host: "https://workspace.test", HostMetadataResolver: noHostMetadata,
+		Credentials: testCredentials{authenticate: func(r *http.Request) error {
+			r.Header.Set("Authorization", "Bearer "+value)
+			return authErr
+		}},
+	})
+	require.NoError(t, err)
+	token := server.WorkspaceToken(c)
+	first, err := token(t.Context())
+	require.NoError(t, err)
+	assert.Equal(t, "first", first)
+	value = "second"
+	second, err := token(t.Context())
+	require.NoError(t, err)
+	assert.Equal(t, "second", second)
+	authErr = errors.New("credentials unavailable")
+	_, err = token(t.Context())
+	require.ErrorIs(t, err, authErr)
+}
+
+type roundTripFunc func(*http.Request) (*http.Response, error)
+
+func (f roundTripFunc) RoundTrip(r *http.Request) (*http.Response, error) { return f(r) }
+
+func TestFuseUserInfo(t *testing.T) {
+	for _, tc := range []struct {
+		name            string
+		status          int
+		body            string
+		wantUserID      string
+		wantNotebookDir string
+	}{
+		{name: "available", status: http.StatusOK, body: `{"id":"12345","userName":"user@example.test"}`, wantUserID: "12345", wantNotebookDir: "/Users/user@example.test"},
+		{name: "forbidden", status: http.StatusForbidden, body: `{"message":"forbidden"}`},
+		{name: "timeout"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			synctest.Test(t, func(t *testing.T) {
+				c, err := databricks.NewWorkspaceClient(&databricks.Config{
+					Host: "https://workspace.test", HostMetadataResolver: noHostMetadata, Token: "test-token",
+					HTTPTransport: roundTripFunc(func(r *http.Request) (*http.Response, error) {
+						assert.Equal(t, "/api/2.0/preview/scim/v2/Me", r.URL.Path)
+						if tc.status == 0 {
+							<-r.Context().Done()
+							return nil, r.Context().Err()
+						}
+						return &http.Response{StatusCode: tc.status, Header: http.Header{"Content-Type": {"application/json"}}, Body: io.NopCloser(strings.NewReader(tc.body)), Request: r}, nil
+					}),
+				})
+				require.NoError(t, err)
+				start := time.Now()
+				userID, notebookDir := server.FuseUserInfo(t.Context(), c)
+				assert.Equal(t, tc.wantUserID, userID)
+				assert.Equal(t, tc.wantNotebookDir, notebookDir)
+				assert.LessOrEqual(t, time.Since(start), 2*time.Second)
+			})
+		})
+	}
+}
+
+func TestStartFuseRegistrationSkipsServerless(t *testing.T) {
+	c, err := databricks.NewWorkspaceClient(&databricks.Config{
+		Host: "https://workspace.test", HostMetadataResolver: noHostMetadata, Token: "test-token",
+		HTTPTransport: roundTripFunc(func(r *http.Request) (*http.Response, error) {
+			t.Errorf("unexpected request: %s %s", r.Method, r.URL)
+			return nil, errors.New("unexpected request")
+		}),
+	})
+	require.NoError(t, err)
+
+	var out bytes.Buffer
+	ctx := log.NewContext(t.Context(), slog.New(slog.NewTextHandler(&out, &slog.HandlerOptions{Level: slog.LevelDebug})))
+	server.StartFuseRegistration(ctx, c, true)
+
+	logs := out.String()
+	assert.Contains(t, logs, "Skipping SSH filesystem registration on serverless; /Workspace and /Volumes access depends on the bootstrap notebook")
+	assert.NotContains(t, logs, "level=WARN")
+	assert.NotContains(t, logs, "level=ERROR")
+}
+
+func noHostMetadata(context.Context, string) (*config.HostMetadata, error) { return nil, nil }
diff --git a/experimental/ssh/internal/server/idle.go b/experimental/ssh/internal/server/idle.go
new file mode 100644
index 00000000000..2935d63e452
--- /dev/null
+++ b/experimental/ssh/internal/server/idle.go
@@ -0,0 +1,37 @@
+package server
+
+import (
+	"context"
+	"time"
+
+	"github.com/databricks/cli/experimental/ssh/internal/proxy"
+	"github.com/databricks/cli/libs/log"
+)
+
+const detachedProcessCheckInterval = 15 * time.Second
+
+func waitForIdleShutdown(ctx context.Context, connections *proxy.ConnectionsManager, keepDetached bool, root string, selfPid int) error {
+	for {
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		case <-connections.TimedOut:
+		}
+		if connections.Count() > 0 {
+			continue
+		}
+		if !keepDetached {
+			return nil
+		}
+		pids, err := detachedDescendants(root, selfPid)
+		if err == nil && len(pids) == 0 {
+			return nil
+		}
+		if err != nil {
+			log.Warnf(ctx, "Cannot check detached processes; postponing SSH idle shutdown: %v", err)
+		} else {
+			log.Infof(ctx, "Keeping SSH server running for %d detached process(es): %s", len(pids), formatPids(pids))
+		}
+		connections.ExtendIdleTimeout(detachedProcessCheckInterval)
+	}
+}
diff --git a/experimental/ssh/internal/server/idle_test.go b/experimental/ssh/internal/server/idle_test.go
new file mode 100644
index 00000000000..591ff884372
--- /dev/null
+++ b/experimental/ssh/internal/server/idle_test.go
@@ -0,0 +1,121 @@
+package server_test
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/databricks/cli/experimental/ssh/internal/proxy"
+	"github.com/databricks/cli/experimental/ssh/internal/server"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const detachedProcessDirectory = "400"
+
+func TestWaitForIdleShutdown(t *testing.T) {
+	for _, test := range []struct {
+		name         string
+		keepDetached bool
+		hasDetached  bool
+		unreadable   bool
+		wantHold     bool
+	}{
+		{name: "flag off with detached work", hasDetached: true},
+		{name: "flag off without detached work"},
+		{name: "flag on without detached work", keepDetached: true},
+		{name: "flag on with detached work", keepDetached: true, hasDetached: true, wantHold: true},
+		{name: "flag on with unreadable process tree", keepDetached: true, unreadable: true, wantHold: true},
+		{name: "flag off does not need process tree", unreadable: true},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			synctest.Test(t, func(t *testing.T) {
+				root := server.ProcWithDetachedWork(t)
+				if !test.hasDetached {
+					require.NoError(t, os.RemoveAll(filepath.Join(root, detachedProcessDirectory)))
+				}
+				if test.unreadable {
+					root = t.TempDir()
+				}
+				ctx, cancel := context.WithCancel(t.Context())
+				defer cancel()
+				connections := proxy.NewConnectionsManager(1, time.Second)
+				shutdown := make(chan error, 1)
+				go func() {
+					shutdown <- server.WaitForIdleShutdown(ctx, connections, test.keepDetached, root, server.TestServerPid)
+				}()
+				time.Sleep(time.Second + 2*server.DetachedProcessCheckInterval)
+				synctest.Wait()
+				assert.Equal(t, !test.wantHold, len(shutdown) > 0)
+				require.True(t, connections.TryAdd("cleanup", nil))
+				cancel()
+				synctest.Wait()
+				require.Len(t, shutdown, 1)
+				shutdownErr := <-shutdown
+				if test.wantHold {
+					assert.ErrorIs(t, shutdownErr, context.Canceled)
+				} else {
+					assert.NoError(t, shutdownErr)
+				}
+			})
+		})
+	}
+}
+
+func TestWaitForIdleShutdownWhenDetachedWorkFinishes(t *testing.T) {
+	for _, shutdownDelay := range []time.Duration{0, time.Second} {
+		t.Run(shutdownDelay.String(), func(t *testing.T) {
+			synctest.Test(t, func(t *testing.T) {
+				root := server.ProcWithDetachedWork(t)
+				connections := proxy.NewConnectionsManager(1, shutdownDelay)
+				shutdown := make(chan error, 1)
+				go func() {
+					shutdown <- server.WaitForIdleShutdown(t.Context(), connections, true, root, server.TestServerPid)
+				}()
+				time.Sleep(shutdownDelay)
+				synctest.Wait()
+				require.Empty(t, shutdown)
+				require.NoError(t, os.RemoveAll(filepath.Join(root, detachedProcessDirectory)))
+				time.Sleep(server.DetachedProcessCheckInterval)
+				synctest.Wait()
+				require.Len(t, shutdown, 1)
+				assert.NoError(t, <-shutdown)
+			})
+		})
+	}
+}
+
+func TestWaitForIdleShutdownReconnect(t *testing.T) {
+	for _, connectedFor := range []time.Duration{time.Second, time.Minute} {
+		t.Run(connectedFor.String(), func(t *testing.T) {
+			synctest.Test(t, func(t *testing.T) {
+				root := server.ProcWithDetachedWork(t)
+				shutdownDelay := time.Minute
+				connections := proxy.NewConnectionsManager(1, shutdownDelay)
+				shutdown := make(chan error, 1)
+				go func() {
+					shutdown <- server.WaitForIdleShutdown(t.Context(), connections, true, root, server.TestServerPid)
+				}()
+				time.Sleep(shutdownDelay)
+				synctest.Wait()
+				require.Empty(t, shutdown)
+				require.True(t, connections.TryAdd("reconnected", nil))
+				require.NoError(t, os.RemoveAll(filepath.Join(root, detachedProcessDirectory)))
+				time.Sleep(connectedFor)
+				synctest.Wait()
+				require.Empty(t, shutdown)
+				connections.Remove("reconnected")
+				time.Sleep(shutdownDelay - time.Second)
+				synctest.Wait()
+				require.Empty(t, shutdown)
+				time.Sleep(time.Second)
+				synctest.Wait()
+				require.Len(t, shutdown, 1)
+				assert.NoError(t, <-shutdown)
+			})
+		})
+	}
+}
diff --git a/experimental/ssh/internal/server/jupyter-init.py b/experimental/ssh/internal/server/jupyter-init.py
index 749c5f28fea..055a3966584 100644
--- a/experimental/ssh/internal/server/jupyter-init.py
+++ b/experimental/ssh/internal/server/jupyter-init.py
@@ -1,7 +1,8 @@
+import os
 from typing import List, Optional
+
 from IPython.core.getipython import get_ipython
 from IPython.display import display as ip_display
-import os
 
 
 def _log_exceptions(func):
@@ -20,8 +21,8 @@ def wrapper(*args, **kwargs):
 
 @_log_exceptions
 def _register_runtime_hooks():
+    from dbruntime.IPythonShellHooks import IPythonShellHook, load_ipython_hooks
     from dbruntime.monkey_patches import apply_dataframe_display_patch
-    from dbruntime.IPythonShellHooks import load_ipython_hooks, IPythonShellHook
     from IPython.core.interactiveshell import ExecutionInfo
 
     # Setting executing_raw_cell before cell execution is required to make dbutils.library.restartPython() work
@@ -41,7 +42,8 @@ def _warn_for_dbr_alternative(magic: str):
     if magic in local_magic_dbr_alternative:
         warnings.warn(
             f"\\n{magic} is not supported on Databricks. This notebook might fail when running on a Databricks cluster.\\n"
-            f"Consider using %{local_magic_dbr_alternative[magic]} instead."
+            f"Consider using %{local_magic_dbr_alternative[magic]} instead.",
+            stacklevel=2,
         )
 
 
@@ -102,10 +104,7 @@ def _handle_line_magic(lines: List[str]) -> List[str]:
         lines = lines[1:]
         spark_string = (
             "global _sqldf\n"
-            + "_sqldf = spark.sql('''"
-            + "".join(lines).replace("'", "\\'")
-            + "''')\n"
-            + "display(_sqldf)\n"
+            "_sqldf = spark.sql('''" + "".join(lines).replace("'", "\\'") + "''')\n" + "display(_sqldf)\n"
         )
         return spark_string.splitlines(keepends=True)
 
@@ -152,9 +151,9 @@ def _register_common_magics():
 @_log_exceptions
 def _register_pip_magics():
     """Register the pip magic command parser with IPython."""
+    from dbruntime import UserNamespaceInitializer
     from dbruntime.DatasetInfo import UserNamespaceDict
     from dbruntime.PipMagicOverrides import PipMagicOverrides
-    from dbruntime import UserNamespaceInitializer
 
     user_namespace_initializer = UserNamespaceInitializer.getOrCreate()
     entry_point = user_namespace_initializer.get_spark_entry_point()
diff --git a/experimental/ssh/internal/server/logs.go b/experimental/ssh/internal/server/logs.go
new file mode 100644
index 00000000000..82b6276d622
--- /dev/null
+++ b/experimental/ssh/internal/server/logs.go
@@ -0,0 +1,106 @@
+package server
+
+import (
+	"context"
+	"errors"
+	"io"
+	"log/slog"
+	"net/http"
+	"strings"
+	"sync"
+
+	"github.com/databricks/cli/libs/log"
+)
+
+// maxLogBufferBytes bounds the in-memory log buffer served at /logs.
+const maxLogBufferBytes = 16 * 1024
+
+// logBuffer accumulates recent log records in memory so the client can fetch them
+// via the /logs endpoint after a failed connection attempt. The Jobs API exposes no
+// stdout logs for a running notebook task, so this is the only way for "ssh connect"
+// to read the server's errors while the bootstrap job is still alive.
+type logBuffer struct {
+	mu    sync.Mutex
+	lines []string
+	size  int
+	limit int
+}
+
+func newLogBuffer(limit int) *logBuffer {
+	return &logBuffer{limit: limit}
+}
+
+// Write implements io.Writer; slog handlers emit one Write call per record.
+func (b *logBuffer) Write(p []byte) (int, error) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	b.lines = append(b.lines, string(p))
+	b.size += len(p)
+	for b.size > b.limit && len(b.lines) > 0 {
+		b.size -= len(b.lines[0])
+		b.lines = b.lines[1:]
+	}
+	return len(p), nil
+}
+
+func (b *logBuffer) String() string {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	return strings.Join(b.lines, "")
+}
+
+func (b *logBuffer) serveHTTP(w http.ResponseWriter, r *http.Request) {
+	w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+	if _, err := io.WriteString(w, b.String()); err != nil {
+		http.Error(w, "Failed to write logs", http.StatusInternalServerError)
+	}
+}
+
+// captureWarnLogs returns a context whose logger also records warning-and-above
+// log lines into the returned buffer.
+func captureWarnLogs(ctx context.Context) (context.Context, *logBuffer) {
+	buf := newLogBuffer(maxLogBufferBytes)
+	bufHandler := slog.NewTextHandler(buf, &slog.HandlerOptions{Level: slog.LevelWarn})
+	logger := slog.New(teeHandler{[]slog.Handler{log.GetLogger(ctx).Handler(), bufHandler}})
+	return log.NewContext(ctx, logger), buf
+}
+
+// teeHandler forwards log records to all underlying handlers.
+type teeHandler struct {
+	handlers []slog.Handler
+}
+
+func (t teeHandler) Enabled(ctx context.Context, level slog.Level) bool {
+	for _, h := range t.handlers {
+		if h.Enabled(ctx, level) {
+			return true
+		}
+	}
+	return false
+}
+
+func (t teeHandler) Handle(ctx context.Context, r slog.Record) error {
+	var errs []error
+	for _, h := range t.handlers {
+		if h.Enabled(ctx, r.Level) {
+			errs = append(errs, h.Handle(ctx, r.Clone()))
+		}
+	}
+	return errors.Join(errs...)
+}
+
+func (t teeHandler) WithAttrs(attrs []slog.Attr) slog.Handler {
+	handlers := make([]slog.Handler, len(t.handlers))
+	for i, h := range t.handlers {
+		handlers[i] = h.WithAttrs(attrs)
+	}
+	return teeHandler{handlers}
+}
+
+func (t teeHandler) WithGroup(name string) slog.Handler {
+	handlers := make([]slog.Handler, len(t.handlers))
+	for i, h := range t.handlers {
+		handlers[i] = h.WithGroup(name)
+	}
+	return teeHandler{handlers}
+}
diff --git a/experimental/ssh/internal/server/logs_test.go b/experimental/ssh/internal/server/logs_test.go
new file mode 100644
index 00000000000..090948505ae
--- /dev/null
+++ b/experimental/ssh/internal/server/logs_test.go
@@ -0,0 +1,64 @@
+package server
+
+import (
+	"io"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/databricks/cli/libs/log"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestLogBufferEvictsOldestLines(t *testing.T) {
+	buf := newLogBuffer(25)
+	for _, line := range []string{"first line\n", "second line\n", "third line\n"} {
+		_, err := buf.Write([]byte(line))
+		assert.NoError(t, err)
+	}
+	out := buf.String()
+	assert.NotContains(t, out, "first line")
+	assert.Contains(t, out, "second line")
+	assert.Contains(t, out, "third line")
+}
+
+func TestCaptureWarnLogsRecordsWarnAndAbove(t *testing.T) {
+	ctx := log.NewContext(t.Context(), slog.New(slog.NewTextHandler(io.Discard, nil)))
+	ctx, buf := captureWarnLogs(ctx)
+
+	log.Infof(ctx, "info message")
+	log.Warnf(ctx, "warn message")
+	log.Errorf(ctx, "error message")
+
+	out := buf.String()
+	assert.NotContains(t, out, "info message")
+	assert.Contains(t, out, "warn message")
+	assert.Contains(t, out, "error message")
+}
+
+func TestCaptureWarnLogsKeepsHandlerAttrs(t *testing.T) {
+	ctx := log.NewContext(t.Context(), slog.New(slog.NewTextHandler(io.Discard, nil)))
+	ctx, buf := captureWarnLogs(ctx)
+	// Mirrors how the proxy server scopes its logger per connection.
+	ctx = log.NewContext(ctx, log.GetLogger(ctx).With("session", "abc"))
+
+	log.Errorf(ctx, "connection failed")
+
+	out := buf.String()
+	assert.Contains(t, out, "connection failed")
+	assert.Contains(t, out, "session=abc")
+}
+
+func TestLogBufferServeHTTP(t *testing.T) {
+	ctx := log.NewContext(t.Context(), slog.New(slog.NewTextHandler(io.Discard, nil)))
+	ctx, buf := captureWarnLogs(ctx)
+	log.Errorf(ctx, "boom")
+
+	rec := httptest.NewRecorder()
+	buf.serveHTTP(rec, httptest.NewRequest(http.MethodGet, "/logs", nil))
+
+	assert.Equal(t, 200, rec.Code)
+	assert.Equal(t, "text/plain; charset=utf-8", rec.Header().Get("Content-Type"))
+	assert.Contains(t, rec.Body.String(), "boom")
+}
diff --git a/experimental/ssh/internal/server/server.go b/experimental/ssh/internal/server/server.go
index 6cf137618d9..39f0938b773 100644
--- a/experimental/ssh/internal/server/server.go
+++ b/experimental/ssh/internal/server/server.go
@@ -1,10 +1,14 @@
 package server
 
 import (
+	"bytes"
 	"context"
 	_ "embed"
+	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
+	"io/fs"
 	"net"
 	"net/http"
 	"os"
@@ -16,7 +20,10 @@ import (
 
 	"github.com/databricks/cli/experimental/ssh/internal/proxy"
 	"github.com/databricks/cli/experimental/ssh/internal/workspace"
+	"github.com/databricks/cli/libs/env"
 	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/telemetry"
+	"github.com/databricks/cli/libs/telemetry/protos"
 	"github.com/databricks/databricks-sdk-go"
 )
 
@@ -37,6 +44,11 @@ type ServerOptions struct {
 	SessionID string
 	// Serverless indicates whether the server is running on serverless compute.
 	Serverless bool
+	// UsagePolicyID the job was submitted with. Persisted to metadata.json so reconnects
+	// can tell which usage policy the running server was started under.
+	UsagePolicyID string
+	// KeepDetachedProcesses prevents idle shutdown while detached processes are running.
+	KeepDetachedProcesses bool
 	// The directory to store sshd configuration
 	ConfigDir string
 	// The name of the secrets scope to use for client and server keys
@@ -54,6 +66,12 @@ type ServerOptions struct {
 }
 
 func Run(ctx context.Context, client *databricks.WorkspaceClient, opts ServerOptions) error {
+	ctx, logBuf := captureWarnLogs(ctx)
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	startFuseRegistration(ctx, client, opts.Serverless)
+
 	port, err := findAvailablePort(opts.DefaultPort, opts.PortRange)
 	if err != nil {
 		return fmt.Errorf("failed to find available port: %w", err)
@@ -64,8 +82,10 @@ func Run(ctx context.Context, client *databricks.WorkspaceClient, opts ServerOpt
 
 	// Save metadata including ClusterID (required for Driver Proxy connections in serverless mode)
 	metadata := &workspace.WorkspaceMetadata{
-		Port:      port,
-		ClusterID: opts.ClusterID,
+		Port:                  port,
+		ClusterID:             opts.ClusterID,
+		UsagePolicyID:         opts.UsagePolicyID,
+		KeepDetachedProcesses: opts.KeepDetachedProcesses,
 	}
 	err = workspace.SaveWorkspaceMetadata(ctx, client, opts.Version, opts.SessionID, metadata)
 	if err != nil {
@@ -82,23 +102,98 @@ func Run(ctx context.Context, client *databricks.WorkspaceClient, opts ServerOpt
 		return fmt.Errorf("failed to save Jupyter init script: %w", err)
 	}
 
+	// Best-effort: this only fixes bare python/pip resolution in interactive
+	// sessions. The tunnel works without it (the non-interactive `-- <cmd>` path
+	// is unaffected), so a write failure on a locked-down home must not abort the
+	// server. Mirrors the /run/sshd handling in prepareSSHDConfig.
+	if err := seedEnvActivation(ctx); err != nil {
+		log.Warnf(ctx, "Failed to seed environment activation, bare python/pip may resolve to the wrong interpreter in interactive sessions: %v", err)
+	}
+
 	createServerCommand := func(ctx context.Context) *exec.Cmd {
 		return createSSHDProcess(ctx, sshdConfigPath)
 	}
 	connections := proxy.NewConnectionsManager(opts.MaxClients, opts.ShutdownDelay)
 	http.Handle("/ssh", proxy.NewProxyServer(ctx, connections, createServerCommand))
 	http.HandleFunc("/metadata", serveMetadata)
+	http.HandleFunc("/logs", logBuf.serveHTTP)
+	http.HandleFunc("/capabilities", serveCapabilities)
 
 	http.Handle("/driver-proxy-http/ssh", proxy.NewProxyServer(ctx, connections, createServerCommand))
 	http.HandleFunc("/driver-proxy-http/metadata", serveMetadata)
+	http.HandleFunc("/driver-proxy-http/logs", logBuf.serveHTTP)
+	http.HandleFunc("/driver-proxy-http/capabilities", serveCapabilities)
+
+	listenErr := make(chan error, 1)
+	go func() {
+		listenErr <- http.ListenAndServe(listenAddr, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			// Normalize double slashes from the driver proxy (e.g. //metadata -> /metadata)
+			r.URL.Path = path.Clean(r.URL.Path)
+			http.DefaultServeMux.ServeHTTP(w, r)
+		}))
+	}()
+
+	idleErr := make(chan error, 1)
+	go func() {
+		idleErr <- waitForIdleShutdown(ctx, connections, opts.KeepDetachedProcesses, procRoot, os.Getpid())
+	}()
+
+	select {
+	case err := <-listenErr:
+		return err
+	case err := <-idleErr:
+		if err != nil {
+			return err
+		}
+		// Return rather than exiting in place, so the notebook that started us gets to run
+		// its teardown and this process reports the shutdown through the CLI's normal path.
+		log.Info(ctx, fmt.Sprintf("No SSH clients for %v, shutting down...", opts.ShutdownDelay))
+		reportDetachedDescendants(ctx, opts, procRoot, os.Getpid())
+		return nil
+	}
+}
+
+// reportDetachedDescendants records what the session leaves behind when the server shuts
+// down. Only the server can see this: the client that started the session is long gone by
+// the time the idle timer fires, and the notebook's teardown runs after this process exits.
+func reportDetachedDescendants(ctx context.Context, opts ServerOptions, root string, selfPid int) {
+	pids, err := detachedDescendants(root, selfPid)
+	if err != nil {
+		log.Debugf(ctx, "Failed to look for detached processes: %v", err)
+		return
+	}
 
-	go handleTimeout(ctx, connections.TimedOut, opts.ShutdownDelay)
+	// Warning, not info: without --keep-detached-processes these processes do not outlive the
+	// run, and until now they vanished with no explanation anywhere. The client reads this
+	// back through /logs.
+	if len(pids) > 0 && !opts.KeepDetachedProcesses {
+		log.Warnf(ctx, "Shutting down with %d detached process(es) still running (pids %s). "+
+			"They do not survive the end of this run. To keep them, reconnect with "+
+			"\"databricks ssh connect --keep-detached-processes\", which keeps the SSH server running while they run.",
+			len(pids), formatPids(pids))
+	}
+
+	computeType := protos.SshTunnelComputeTypeDedicated
+	if opts.Serverless {
+		computeType = protos.SshTunnelComputeTypeServerless
+	}
+	telemetry.Log(ctx, protos.DatabricksCliLog{
+		SshTunnelTeardownEvent: &protos.SshTunnelTeardownEvent{
+			ComputeType:                      computeType,
+			KeepDetachedRequested:            opts.KeepDetachedProcesses,
+			HadDetachedDescendantsAtTeardown: len(pids) > 0,
+		},
+	})
+}
 
-	return http.ListenAndServe(listenAddr, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		// Normalize double slashes from the driver proxy (e.g. //metadata -> /metadata)
-		r.URL.Path = path.Clean(r.URL.Path)
-		http.DefaultServeMux.ServeHTTP(w, r)
-	}))
+// serveCapabilities tells the client which optional parts of the tunnel protocol this server
+// speaks. A server from an older CLI has no such route and returns 404, which the client reads as
+// "none of them" - the negotiation this endpoint exists for.
+func serveCapabilities(w http.ResponseWriter, r *http.Request) {
+	w.Header().Set("Content-Type", "application/json")
+	if err := json.NewEncoder(w).Encode(map[string]int{proxy.ResumeVersionParameter: proxy.ResumeProtocolVersion}); err != nil {
+		http.Error(w, "Failed to write capabilities", http.StatusInternalServerError)
+	}
 }
 
 func serveMetadata(w http.ResponseWriter, r *http.Request) {
@@ -113,12 +208,6 @@ func serveMetadata(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
-func handleTimeout(ctx context.Context, timedOutChannel chan bool, shutdownDelay time.Duration) {
-	<-timedOutChannel
-	log.Info(ctx, fmt.Sprintf("No SSH clients for %v, shutting down...", shutdownDelay))
-	os.Exit(0)
-}
-
 func findAvailablePort(startPort, maxAttempts int) (int, error) {
 	for i := range maxAttempts {
 		port := startPort + i
@@ -150,3 +239,57 @@ func saveJupyterInitScript(ctx context.Context) error {
 	log.Info(ctx, "Saved Jupyter init script to: "+initScriptPath)
 	return nil
 }
+
+// envActivationMarker identifies the block seedEnvActivation appends to ~/.bashrc,
+// so a server restart within the same home directory doesn't append it twice.
+const envActivationMarker = "# added by databricks ssh tunnel (DECO-27499)"
+
+// envActivationSnippet re-prepends the environment interpreter's bin directory to
+// PATH for interactive SSH sessions. The client runs an interactive, non-login
+// shell (bash -i), which sources /etc/bash.bashrc; on serverless that file runs
+// activate_root_python_environment.sh, which prepends the cluster-libraries python
+// ahead of the environment interpreter that sshd forwards via SetEnv. bash sources
+// ~/.bashrc after /etc/bash.bashrc, so re-prepending here wins and bare python/pip
+// resolve to $DATABRICKS_VIRTUAL_ENV. The guard makes it a no-op when the variable
+// is unset. /etc/bash.bashrc and /etc/profile.d are root-owned and not writable by
+// the non-root serverless user, so ~/.bashrc is the only usable hook.
+//
+// The bootstrap sets DATABRICKS_VIRTUAL_ENV to sys.executable, always an absolute
+// path, so dirname yields the interpreter's bin directory (not "." for a bare name).
+const envActivationSnippet = envActivationMarker + `
+if [ -n "$DATABRICKS_VIRTUAL_ENV" ]; then
+	export PATH="$(dirname "$DATABRICKS_VIRTUAL_ENV"):$PATH"
+fi
+`
+
+func seedEnvActivation(ctx context.Context) error {
+	homeDir, err := env.UserHomeDir(ctx)
+	if err != nil {
+		return fmt.Errorf("failed to get home directory: %w", err)
+	}
+	bashrcPath := filepath.Join(homeDir, ".bashrc")
+
+	existing, err := os.ReadFile(bashrcPath)
+	if err != nil && !errors.Is(err, fs.ErrNotExist) {
+		return fmt.Errorf("failed to read %s: %w", bashrcPath, err)
+	}
+	if bytes.Contains(existing, []byte(envActivationMarker)) {
+		log.Info(ctx, "Environment activation already present in "+bashrcPath)
+		return nil
+	}
+
+	// Append so the snippet runs after /etc/bash.bashrc and any existing ~/.bashrc
+	// content; the newline guards against a file that doesn't end in one.
+	separator := ""
+	if len(existing) > 0 && !bytes.HasSuffix(existing, []byte("\n")) {
+		separator = "\n"
+	}
+	content := string(existing) + separator + envActivationSnippet
+	err = os.WriteFile(bashrcPath, []byte(content), 0o644)
+	if err != nil {
+		return fmt.Errorf("failed to write %s: %w", bashrcPath, err)
+	}
+
+	log.Info(ctx, "Seeded environment activation in "+bashrcPath)
+	return nil
+}
diff --git a/experimental/ssh/internal/server/server_test.go b/experimental/ssh/internal/server/server_test.go
new file mode 100644
index 00000000000..ae3ca5ba0a0
--- /dev/null
+++ b/experimental/ssh/internal/server/server_test.go
@@ -0,0 +1,85 @@
+package server
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/databricks/cli/libs/env"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSeedEnvActivation(t *testing.T) {
+	t.Run("creates bashrc when absent", func(t *testing.T) {
+		home := t.TempDir()
+		t.Setenv(env.HomeEnvVar(), home)
+
+		require.NoError(t, seedEnvActivation(t.Context()))
+
+		content, err := os.ReadFile(filepath.Join(home, ".bashrc"))
+		require.NoError(t, err)
+		assert.Contains(t, string(content), envActivationMarker)
+		assert.Contains(t, string(content), `export PATH="$(dirname "$DATABRICKS_VIRTUAL_ENV"):$PATH"`)
+	})
+
+	t.Run("seeds the runtime guard so the snippet is a no-op when the var is unset", func(t *testing.T) {
+		home := t.TempDir()
+		t.Setenv(env.HomeEnvVar(), home)
+
+		require.NoError(t, seedEnvActivation(t.Context()))
+
+		content, err := os.ReadFile(filepath.Join(home, ".bashrc"))
+		require.NoError(t, err)
+		assert.Contains(t, string(content), `if [ -n "$DATABRICKS_VIRTUAL_ENV" ]; then`)
+	})
+
+	t.Run("appends after existing content with separating newline", func(t *testing.T) {
+		home := t.TempDir()
+		t.Setenv(env.HomeEnvVar(), home)
+		bashrc := filepath.Join(home, ".bashrc")
+		// No trailing newline, to exercise the separator.
+		require.NoError(t, os.WriteFile(bashrc, []byte("export FOO=bar"), 0o644))
+
+		require.NoError(t, seedEnvActivation(t.Context()))
+
+		content, err := os.ReadFile(bashrc)
+		require.NoError(t, err)
+		assert.Contains(t, string(content), "export FOO=bar\n"+envActivationMarker)
+	})
+
+	t.Run("does not insert a blank line when content already ends in a newline", func(t *testing.T) {
+		home := t.TempDir()
+		t.Setenv(env.HomeEnvVar(), home)
+		bashrc := filepath.Join(home, ".bashrc")
+		require.NoError(t, os.WriteFile(bashrc, []byte("export FOO=bar\n"), 0o644))
+
+		require.NoError(t, seedEnvActivation(t.Context()))
+
+		content, err := os.ReadFile(bashrc)
+		require.NoError(t, err)
+		assert.Contains(t, string(content), "export FOO=bar\n"+envActivationMarker)
+		assert.NotContains(t, string(content), "export FOO=bar\n\n"+envActivationMarker)
+	})
+
+	t.Run("idempotent across restarts and preserves existing content", func(t *testing.T) {
+		home := t.TempDir()
+		t.Setenv(env.HomeEnvVar(), home)
+		bashrc := filepath.Join(home, ".bashrc")
+		require.NoError(t, os.WriteFile(bashrc, []byte("export FOO=bar\n"), 0o644))
+
+		require.NoError(t, seedEnvActivation(t.Context()))
+		after, err := os.ReadFile(bashrc)
+		require.NoError(t, err)
+
+		// The second call must find the marker and leave the file byte-for-byte unchanged.
+		require.NoError(t, seedEnvActivation(t.Context()))
+		again, err := os.ReadFile(bashrc)
+		require.NoError(t, err)
+
+		assert.Equal(t, string(after), string(again))
+		assert.Equal(t, 1, strings.Count(string(again), envActivationMarker))
+		assert.Contains(t, string(again), "export FOO=bar")
+	})
+}
diff --git a/experimental/ssh/internal/server/sshd.go b/experimental/ssh/internal/server/sshd.go
index bfafbbe5212..01fd0e3cdb0 100644
--- a/experimental/ssh/internal/server/sshd.go
+++ b/experimental/ssh/internal/server/sshd.go
@@ -9,6 +9,7 @@ import (
 	"os/exec"
 	"path"
 	"path/filepath"
+	"strconv"
 	"strings"
 
 	"github.com/databricks/cli/experimental/ssh/internal/keys"
@@ -17,6 +18,18 @@ import (
 	"github.com/databricks/databricks-sdk-go"
 )
 
+// clientAliveIntervalSeconds is how often sshd asks the client to confirm it is still there. It
+// drives the keepalive from the server end of the tunnel; sshconfig.ServerAliveIntervalSeconds
+// documents why an SSH keepalive is what keeps the leg past the driver proxy from being reaped.
+// Configuring it here covers clients the CLI does not configure — a hand-written ProxyCommand host
+// block, or an IDE that supplies its own ssh options — where nothing sets ServerAliveInterval.
+// The two intervals are deliberately independent: neither package imports the other, and each end
+// keeps its own leg warm, so they need not track a single shared value.
+//
+// It also brings in ClientAliveCountMax (OpenSSH default 3), so sshd reclaims a session whose
+// client has gone away after ~90s instead of holding it open until the server's shutdown delay.
+const clientAliveIntervalSeconds = 30
+
 func prepareSSHDConfig(ctx context.Context, client *databricks.WorkspaceClient, opts ServerOptions) (string, error) {
 	clientPublicKey, err := keys.GetSecret(ctx, client, opts.SecretScopeName, opts.AuthorizedKeySecretName)
 	if err != nil {
@@ -76,15 +89,7 @@ func prepareSSHDConfig(ctx context.Context, client *databricks.WorkspaceClient,
 	}
 	setEnv := setEnvBuf.String()
 
-	sshdConfigContent := "PubkeyAuthentication yes\n" +
-		"PasswordAuthentication no\n" +
-		"ChallengeResponseAuthentication no\n" +
-		"Subsystem sftp internal-sftp\n" +
-		"HostKey " + keyPath + "\n" +
-		"AuthorizedKeysFile " + authKeysPath + "\n" +
-		setEnv + "\n"
-
-	if err := os.WriteFile(sshdConfig, []byte(sshdConfigContent), 0o600); err != nil {
+	if err := os.WriteFile(sshdConfig, []byte(sshdConfigContent(keyPath, authKeysPath, setEnv)), 0o600); err != nil {
 		return "", err
 	}
 
@@ -97,6 +102,18 @@ func prepareSSHDConfig(ctx context.Context, client *databricks.WorkspaceClient,
 	return sshdConfig, nil
 }
 
+// sshdConfigContent assembles the configuration the tunnel's sshd runs with.
+func sshdConfigContent(hostKeyPath, authorizedKeysPath, setEnv string) string {
+	return "PubkeyAuthentication yes\n" +
+		"PasswordAuthentication no\n" +
+		"ChallengeResponseAuthentication no\n" +
+		"ClientAliveInterval " + strconv.Itoa(clientAliveIntervalSeconds) + "\n" +
+		"Subsystem sftp internal-sftp\n" +
+		"HostKey " + hostKeyPath + "\n" +
+		"AuthorizedKeysFile " + authorizedKeysPath + "\n" +
+		setEnv + "\n"
+}
+
 func createSSHDProcess(ctx context.Context, configPath string) *exec.Cmd {
 	return exec.CommandContext(ctx, "/usr/sbin/sshd", "-f", configPath, "-i")
 }
diff --git a/experimental/ssh/internal/server/sshd_test.go b/experimental/ssh/internal/server/sshd_test.go
index a453d987a00..4887f9895d8 100644
--- a/experimental/ssh/internal/server/sshd_test.go
+++ b/experimental/ssh/internal/server/sshd_test.go
@@ -1,6 +1,7 @@
 package server
 
 import (
+	"strconv"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -71,3 +72,18 @@ func TestEscapeEnvValue(t *testing.T) {
 		})
 	}
 }
+
+func TestSSHDConfigSetsClientAliveInterval(t *testing.T) {
+	config := sshdConfigContent("/keys/server-private-key", "/keys/authorized_keys", `SetEnv FOO="bar"`)
+
+	// This is the half of the keepalive that reaches clients the CLI never configures, so sshd has
+	// to drive it: without ClientAliveInterval sshd sends nothing on an idle session.
+	assert.Contains(t, config, "\nClientAliveInterval "+strconv.Itoa(clientAliveIntervalSeconds)+"\n")
+
+	// The interval has to fire well inside the ~8 minute reap window, and ClientAliveCountMax
+	// (OpenSSH default 3) intervals have to outlast the longest legitimate pause on a healthy
+	// tunnel — the up to 30s a handover can hold the sending loop. The 30 below is
+	// proxy.proxyHandoverInitTimeout's current value; it is unexported, so it can't be referenced.
+	assert.Less(t, clientAliveIntervalSeconds, 8*60)
+	assert.Greater(t, 3*clientAliveIntervalSeconds, 30)
+}
diff --git a/experimental/ssh/internal/server/teardown_test.go b/experimental/ssh/internal/server/teardown_test.go
new file mode 100644
index 00000000000..6e61b364ebf
--- /dev/null
+++ b/experimental/ssh/internal/server/teardown_test.go
@@ -0,0 +1,141 @@
+package server
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/telemetry"
+	"github.com/databricks/cli/libs/telemetry/protos"
+	"github.com/databricks/cli/libs/testserver"
+	"github.com/databricks/databricks-sdk-go/config"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	testNotebookPid = 100
+	testServerPid   = 200
+)
+
+// procWithDetachedWork is the teardown shape the warning is about: the notebook anchors the
+// server, and one process has been adopted by the notebook with a process group of its own.
+func procWithDetachedWork(t *testing.T) string {
+	return fakeProc(t, map[int]fakeProcess{
+		testNotebookPid: {comm: "python", ppid: 1, pgrp: testNotebookPid, state: "S"},
+		testServerPid:   {comm: "databricks", ppid: testNotebookPid, pgrp: testServerPid, state: "S"},
+		400:             {comm: "tmux: server", ppid: testNotebookPid, pgrp: 400, state: "S"},
+	})
+}
+
+func TestReportDetachedDescendantsWarning(t *testing.T) {
+	t.Run("warns and names the flag when the work is about to be swept", func(t *testing.T) {
+		ctx, logs := captureWarnLogs(t.Context())
+		reportDetachedDescendants(ctx, ServerOptions{}, procWithDetachedWork(t), testServerPid)
+
+		assert.Contains(t, logs.String(), "1 detached process(es) still running (pids 400)")
+		assert.Contains(t, logs.String(), "--keep-detached-processes")
+	})
+
+	t.Run("stays quiet when the run is held open for them", func(t *testing.T) {
+		ctx, logs := captureWarnLogs(t.Context())
+		opts := ServerOptions{KeepDetachedProcesses: true}
+		reportDetachedDescendants(ctx, opts, procWithDetachedWork(t), testServerPid)
+
+		assert.Empty(t, logs.String())
+	})
+
+	t.Run("warns on serverless", func(t *testing.T) {
+		ctx, logs := captureWarnLogs(t.Context())
+		reportDetachedDescendants(ctx, ServerOptions{Serverless: true}, procWithDetachedWork(t), testServerPid)
+
+		assert.Contains(t, logs.String(), "--keep-detached-processes")
+	})
+
+	t.Run("stays quiet when nothing was left behind", func(t *testing.T) {
+		root := fakeProc(t, map[int]fakeProcess{
+			testNotebookPid: {comm: "python", ppid: 1, pgrp: testNotebookPid, state: "S"},
+			testServerPid:   {comm: "databricks", ppid: testNotebookPid, pgrp: testServerPid, state: "S"},
+		})
+		ctx, logs := captureWarnLogs(t.Context())
+		reportDetachedDescendants(ctx, ServerOptions{}, root, testServerPid)
+
+		assert.Empty(t, logs.String())
+	})
+
+	t.Run("does not warn when the process tree cannot be read", func(t *testing.T) {
+		ctx, logs := captureWarnLogs(t.Context())
+		reportDetachedDescendants(ctx, ServerOptions{}, t.TempDir(), testServerPid)
+
+		assert.Empty(t, logs.String())
+	})
+}
+
+// The teardown event is the only measurement of how often the tunnel is about to destroy
+// detached work, so this pins that it reaches the wire with the fields a query needs.
+func TestReportDetachedDescendantsTelemetry(t *testing.T) {
+	tests := []struct {
+		name string
+		opts ServerOptions
+		root func(t *testing.T) string
+		want protos.SshTunnelTeardownEvent
+	}{
+		{
+			name: "detached work left behind on a dedicated cluster",
+			opts: ServerOptions{},
+			root: procWithDetachedWork,
+			want: protos.SshTunnelTeardownEvent{
+				ComputeType:                      protos.SshTunnelComputeTypeDedicated,
+				HadDetachedDescendantsAtTeardown: true,
+			},
+		},
+		{
+			name: "the run was held open for it",
+			opts: ServerOptions{KeepDetachedProcesses: true},
+			root: procWithDetachedWork,
+			want: protos.SshTunnelTeardownEvent{
+				ComputeType:                      protos.SshTunnelComputeTypeDedicated,
+				KeepDetachedRequested:            true,
+				HadDetachedDescendantsAtTeardown: true,
+			},
+		},
+		{
+			name: "nothing detached, on serverless",
+			opts: ServerOptions{Serverless: true},
+			root: func(t *testing.T) string {
+				return fakeProc(t, map[int]fakeProcess{
+					testNotebookPid: {comm: "python", ppid: 1, pgrp: testNotebookPid, state: "S"},
+					testServerPid:   {comm: "databricks", ppid: testNotebookPid, pgrp: testServerPid, state: "S"},
+				})
+			},
+			want: protos.SshTunnelTeardownEvent{ComputeType: protos.SshTunnelComputeTypeServerless},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			server := testserver.New(t)
+			t.Cleanup(server.Close)
+
+			var body telemetry.RequestBody
+			server.Handle("POST", "/telemetry-ext", func(req testserver.Request) any {
+				require.NoError(t, json.Unmarshal(req.Body, &body))
+				return telemetry.ResponseBody{NumProtoSuccess: 1}
+			})
+
+			ctx := telemetry.WithNewLogger(t.Context())
+			ctx = cmdctx.SetConfigUsed(ctx, &config.Config{Host: server.URL, Token: "token"})
+
+			reportDetachedDescendants(ctx, tt.opts, tt.root(t), testServerPid)
+			require.NoError(t, telemetry.Upload(ctx, protos.ExecutionContext{}))
+
+			require.Len(t, body.ProtoLogs, 1)
+			var logged protos.FrontendLog
+			require.NoError(t, json.Unmarshal([]byte(body.ProtoLogs[0]), &logged))
+			require.NotNil(t, logged.Entry.DatabricksCliLog.SshTunnelTeardownEvent)
+			assert.Equal(t, tt.want, *logged.Entry.DatabricksCliLog.SshTunnelTeardownEvent)
+			// The connect event stays untouched, so is_success queries keep counting connections.
+			assert.Nil(t, logged.Entry.DatabricksCliLog.SshTunnelEvent)
+		})
+	}
+}
diff --git a/experimental/ssh/internal/setup/setup.go b/experimental/ssh/internal/setup/setup.go
index c2645a63797..bdfd88cc3c3 100644
--- a/experimental/ssh/internal/setup/setup.go
+++ b/experimental/ssh/internal/setup/setup.go
@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"time"
 
+	sshclient "github.com/databricks/cli/experimental/ssh/internal/client"
 	"github.com/databricks/cli/experimental/ssh/internal/keys"
 	"github.com/databricks/cli/experimental/ssh/internal/sshconfig"
 	"github.com/databricks/cli/libs/cmdio"
@@ -22,40 +23,55 @@ type SetupOptions struct {
 	AutoStartCluster bool
 	// Delay before shutting down the SSH tunnel, will be added as a --shutdown-delay flag to the ProxyCommand
 	ShutdownDelay time.Duration
+	// Maximum number of concurrent SSH clients the server accepts, will be added as a --max-clients
+	// flag to the ProxyCommand. Fixed when the server job is submitted, so the ProxyCommand is the
+	// only place it can be set for a host configured through setup.
+	MaxClients int
+	// Maximum lifetime of the SSH server, will be added as a --server-timeout flag to the ProxyCommand.
+	// Also fixed at submission time.
+	ServerTimeout time.Duration
+	// Whether detached work prevents idle shutdown, added as --keep-detached-processes
+	// to the ProxyCommand. Fixed at
+	// submission time like the two above, so this is the only place a host configured through
+	// setup can ask for it.
+	KeepDetachedProcesses bool
 	// Optional path to the local ssh config. Defaults to ~/.ssh/config
 	SSHConfigPath string
 	// Optional path to the local directory to store SSH keys. Defaults to ~/.databricks/ssh-tunnel-keys
 	SSHKeysDir string
 	// Optional auth profile name. If present, will be added as --profile flag to the ProxyCommand
 	Profile string
-	// Proxy command to use for the SSH connection
-	ProxyCommand string
 	// Skip confirmation prompts (e.g. recreate existing host config without asking)
 	AutoApprove bool
 }
 
-func validateClusterAccess(ctx context.Context, client *databricks.WorkspaceClient, clusterID string) error {
-	clusterInfo, err := client.Clusters.Get(ctx, compute.GetClusterRequest{ClusterId: clusterID})
+func generateHostConfig(ctx context.Context, opts SetupOptions, proxyCommand string) (string, error) {
+	identityFilePath, err := keys.GetLocalSSHKeyPath(ctx, opts.ClusterID, opts.SSHKeysDir)
 	if err != nil {
-		return fmt.Errorf("failed to get cluster information for cluster ID '%s': %w", clusterID, err)
-	}
-	if clusterInfo.DataSecurityMode != compute.DataSecurityModeSingleUser {
-		return fmt.Errorf("cluster '%s' does not have dedicated access mode. Current access mode: %s. Please ensure the cluster is configured with dedicated access mode (single user)", clusterID, clusterInfo.DataSecurityMode)
+		return "", fmt.Errorf("failed to get local keys folder: %w", err)
 	}
-	return nil
-}
 
-func generateHostConfig(ctx context.Context, opts SetupOptions) (string, error) {
-	identityFilePath, err := keys.GetLocalSSHKeyPath(ctx, opts.ClusterID, opts.SSHKeysDir)
+	// The ProxyCommand writes this file before the connection reaches host key
+	// verification, so it does not have to exist yet. It carries no directory override, so
+	// resolve the default one here as well.
+	knownHostsPath, err := sshconfig.GetKnownHostsPath(ctx, opts.ClusterID, "")
 	if err != nil {
-		return "", fmt.Errorf("failed to get local keys folder: %w", err)
+		return "", err
 	}
 
-	hostConfig := sshconfig.GenerateHostConfig(opts.HostName, "root", identityFilePath, opts.ProxyCommand)
+	// The ProxyCommand pins the server's key under the cluster ID (the session ID for a
+	// dedicated cluster), but the block is written as `Host <opts.HostName>`. When the
+	// user-facing name differs from the cluster ID, ssh would look the key up under the name
+	// and fail strict checking, so pass the cluster ID as HostKeyAlias to match the pinned
+	// entry (DECO-27882).
+	hostConfig := sshconfig.GenerateHostConfig(opts.HostName, "root", identityFilePath, knownHostsPath, opts.ClusterID, proxyCommand)
 	return hostConfig, nil
 }
 
-func clusterSelectionPrompt(ctx context.Context, client *databricks.WorkspaceClient) (string, error) {
+// clusterSelectionPrompt is a package-level var so tests can replace it with a mock.
+var clusterSelectionPrompt = defaultClusterSelectionPrompt
+
+func defaultClusterSelectionPrompt(ctx context.Context, client *databricks.WorkspaceClient) (string, error) {
 	sp := cmdio.NewSpinner(ctx)
 	sp.Update("Loading clusters.")
 	clusters, err := client.Clusters.ClusterDetailsClusterNameToClusterIdMap(ctx, compute.ListClustersRequest{
@@ -75,6 +91,18 @@ func clusterSelectionPrompt(ctx context.Context, client *databricks.WorkspaceCli
 }
 
 func Setup(ctx context.Context, client *databricks.WorkspaceClient, opts SetupOptions) error {
+	// Reject invalid server-lifecycle flag values before the cluster picker and
+	// cluster-access check: these values don't depend on cluster details.
+	if opts.MaxClients < 1 {
+		return fmt.Errorf("--max-clients must be at least 1, got %d", opts.MaxClients)
+	}
+	if opts.ServerTimeout < time.Second {
+		return fmt.Errorf("--server-timeout must be at least 1s, got %s", opts.ServerTimeout)
+	}
+	if opts.ShutdownDelay > opts.ServerTimeout {
+		return fmt.Errorf("--shutdown-delay (%s) cannot be longer than --server-timeout (%s)", opts.ShutdownDelay, opts.ServerTimeout)
+	}
+
 	if opts.ClusterID == "" {
 		id, err := clusterSelectionPrompt(ctx, client)
 		if err != nil {
@@ -87,11 +115,33 @@ func Setup(ctx context.Context, client *databricks.WorkspaceClient, opts SetupOp
 		return errors.New("cluster ID is required")
 	}
 
-	err := validateClusterAccess(ctx, client, opts.ClusterID)
+	err := sshclient.ValidateClusterAccess(ctx, client, opts.ClusterID)
 	if err != nil {
 		return err
 	}
 
+	// Build the ProxyCommand after the cluster ID is resolved. When the user
+	// omits --cluster, the ID is only known after the interactive picker above,
+	// so building it earlier would serialize an empty --cluster= flag.
+	clientOpts := sshclient.ClientOptions{
+		ClusterID:             opts.ClusterID,
+		AutoStartCluster:      opts.AutoStartCluster,
+		ShutdownDelay:         opts.ShutdownDelay,
+		MaxClients:            opts.MaxClients,
+		ServerTimeout:         opts.ServerTimeout,
+		KeepDetachedProcesses: opts.KeepDetachedProcesses,
+		Profile:               opts.Profile,
+	}
+	// The ProxyCommand is persisted in the SSH config, so reject values that would produce a
+	// tunnel that can never work (e.g. --max-clients=0) here rather than at first `ssh <name>`.
+	if err := clientOpts.Validate(); err != nil {
+		return err
+	}
+	proxyCommand, err := clientOpts.ToProxyCommand()
+	if err != nil {
+		return fmt.Errorf("failed to generate ProxyCommand: %w", err)
+	}
+
 	configPath, err := sshconfig.GetMainConfigPathOrDefault(ctx, opts.SSHConfigPath)
 	if err != nil {
 		return err
@@ -102,7 +152,7 @@ func Setup(ctx context.Context, client *databricks.WorkspaceClient, opts SetupOp
 		return err
 	}
 
-	hostConfig, err := generateHostConfig(ctx, opts)
+	hostConfig, err := generateHostConfig(ctx, opts, proxyCommand)
 	if err != nil {
 		return err
 	}
diff --git a/experimental/ssh/internal/setup/setup_test.go b/experimental/ssh/internal/setup/setup_test.go
index 4cd9970fee8..0846b6caae6 100644
--- a/experimental/ssh/internal/setup/setup_test.go
+++ b/experimental/ssh/internal/setup/setup_test.go
@@ -1,7 +1,7 @@
 package setup
 
 import (
-	"errors"
+	"context"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -9,52 +9,15 @@ import (
 	"time"
 
 	"github.com/databricks/cli/experimental/ssh/internal/client"
+	"github.com/databricks/cli/experimental/ssh/internal/sshconfig"
 	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/experimental/mocks"
 	"github.com/databricks/databricks-sdk-go/service/compute"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
-func TestValidateClusterAccess_SingleUser(t *testing.T) {
-	ctx := cmdio.MockDiscard(t.Context())
-	m := mocks.NewMockWorkspaceClient(t)
-	clustersAPI := m.GetMockClustersAPI()
-
-	clustersAPI.EXPECT().Get(ctx, compute.GetClusterRequest{ClusterId: "cluster-123"}).Return(&compute.ClusterDetails{
-		DataSecurityMode: compute.DataSecurityModeSingleUser,
-	}, nil)
-
-	err := validateClusterAccess(ctx, m.WorkspaceClient, "cluster-123")
-	assert.NoError(t, err)
-}
-
-func TestValidateClusterAccess_InvalidAccessMode(t *testing.T) {
-	ctx := cmdio.MockDiscard(t.Context())
-	m := mocks.NewMockWorkspaceClient(t)
-	clustersAPI := m.GetMockClustersAPI()
-
-	clustersAPI.EXPECT().Get(ctx, compute.GetClusterRequest{ClusterId: "cluster-123"}).Return(&compute.ClusterDetails{
-		DataSecurityMode: compute.DataSecurityModeUserIsolation,
-	}, nil)
-
-	err := validateClusterAccess(ctx, m.WorkspaceClient, "cluster-123")
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "does not have dedicated access mode")
-}
-
-func TestValidateClusterAccess_ClusterNotFound(t *testing.T) {
-	ctx := cmdio.MockDiscard(t.Context())
-	m := mocks.NewMockWorkspaceClient(t)
-	clustersAPI := m.GetMockClustersAPI()
-
-	clustersAPI.EXPECT().Get(ctx, compute.GetClusterRequest{ClusterId: "nonexistent"}).Return(nil, errors.New("cluster not found"))
-
-	err := validateClusterAccess(ctx, m.WorkspaceClient, "nonexistent")
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "failed to get cluster information for cluster ID 'nonexistent'")
-}
-
 func TestGenerateProxyCommand(t *testing.T) {
 	opts := client.ClientOptions{
 		ClusterID:        "cluster-123",
@@ -134,21 +97,31 @@ func TestGenerateHostConfig_Valid(t *testing.T) {
 		SSHKeysDir:    tmpDir,
 		ShutdownDelay: 30 * time.Second,
 		Profile:       "test-profile",
-		ProxyCommand:  proxyCommand,
 	}
 
-	result, err := generateHostConfig(t.Context(), opts)
+	result, err := generateHostConfig(t.Context(), opts, proxyCommand)
 	assert.NoError(t, err)
 
 	assert.Contains(t, result, "Host test-host")
 	assert.Contains(t, result, "User root")
-	assert.Contains(t, result, "StrictHostKeyChecking accept-new")
 	assert.Contains(t, result, "--cluster=cluster-123")
 	assert.Contains(t, result, "--shutdown-delay=30s")
 	assert.Contains(t, result, "--profile=test-profile")
 
 	expectedKeyPath := filepath.Join(tmpDir, "cluster-123")
 	assert.Contains(t, result, fmt.Sprintf(`IdentityFile %q`, expectedKeyPath))
+
+	// `ssh <name>` reaches ssh through this block and nothing else, so the host key the
+	// ProxyCommand pins has to be the one it verifies against (DECO-27882).
+	assert.Contains(t, result, "StrictHostKeyChecking yes")
+	expectedKnownHostsPath, err := sshconfig.GetKnownHostsPath(t.Context(), "cluster-123", "")
+	require.NoError(t, err)
+	assert.Contains(t, result, fmt.Sprintf(`UserKnownHostsFile %q`, expectedKnownHostsPath))
+
+	// The host name (test-host) differs from the cluster ID the key is pinned under, so the
+	// block has to carry HostKeyAlias cluster-123 or strict checking looks the key up under
+	// test-host and fails (DECO-27882).
+	assert.Contains(t, result, "\n    HostKeyAlias cluster-123\n")
 }
 
 func TestGenerateHostConfig_WithoutProfile(t *testing.T) {
@@ -169,10 +142,9 @@ func TestGenerateHostConfig_WithoutProfile(t *testing.T) {
 		SSHKeysDir:    tmpDir,
 		ShutdownDelay: 30 * time.Second,
 		Profile:       "",
-		ProxyCommand:  proxyCommand,
 	}
 
-	result, err := generateHostConfig(t.Context(), opts)
+	result, err := generateHostConfig(t.Context(), opts, proxyCommand)
 	assert.NoError(t, err)
 
 	assert.NotContains(t, result, "--profile=")
@@ -193,7 +165,7 @@ func TestGenerateHostConfig_PathEscaping(t *testing.T) {
 		ShutdownDelay: 30 * time.Second,
 	}
 
-	result, err := generateHostConfig(t.Context(), opts)
+	result, err := generateHostConfig(t.Context(), opts, "")
 	assert.NoError(t, err)
 
 	// Check that quotes are properly escaped
@@ -214,6 +186,7 @@ func TestSetup_SuccessfulWithNewConfigFile(t *testing.T) {
 
 	clustersAPI.EXPECT().Get(ctx, compute.GetClusterRequest{ClusterId: "cluster-123"}).Return(&compute.ClusterDetails{
 		DataSecurityMode: compute.DataSecurityModeSingleUser,
+		SingleUserName:   "me@example.com",
 	}, nil)
 
 	opts := SetupOptions{
@@ -222,20 +195,12 @@ func TestSetup_SuccessfulWithNewConfigFile(t *testing.T) {
 		SSHConfigPath: configPath,
 		SSHKeysDir:    tmpDir,
 		ShutdownDelay: 30 * time.Second,
+		MaxClients:    10,
+		ServerTimeout: 24 * time.Hour,
 		Profile:       "test-profile",
 	}
 
-	clientOpts := client.ClientOptions{
-		ClusterID:        opts.ClusterID,
-		AutoStartCluster: opts.AutoStartCluster,
-		ShutdownDelay:    opts.ShutdownDelay,
-		Profile:          opts.Profile,
-	}
-	proxyCommand, err := clientOpts.ToProxyCommand()
-	require.NoError(t, err)
-	opts.ProxyCommand = proxyCommand
-
-	err = Setup(ctx, m.WorkspaceClient, opts)
+	err := Setup(ctx, m.WorkspaceClient, opts)
 	assert.NoError(t, err)
 
 	// Check that main config has Include directive
@@ -254,6 +219,9 @@ func TestSetup_SuccessfulWithNewConfigFile(t *testing.T) {
 	assert.Contains(t, hostConfigStr, "Host test-host")
 	assert.Contains(t, hostConfigStr, "--cluster=cluster-123")
 	assert.Contains(t, hostConfigStr, "--profile=test-profile")
+	// The written block pins the key lookup to the cluster ID, which differs from the host
+	// name test-host (DECO-27882).
+	assert.Contains(t, hostConfigStr, "HostKeyAlias cluster-123")
 }
 
 func TestSetup_AutoApproveRecreatesExistingHost(t *testing.T) {
@@ -274,6 +242,7 @@ func TestSetup_AutoApproveRecreatesExistingHost(t *testing.T) {
 	clustersAPI := m.GetMockClustersAPI()
 	clustersAPI.EXPECT().Get(ctx, compute.GetClusterRequest{ClusterId: "cluster-123"}).Return(&compute.ClusterDetails{
 		DataSecurityMode: compute.DataSecurityModeSingleUser,
+		SingleUserName:   "me@example.com",
 	}, nil)
 
 	opts := SetupOptions{
@@ -282,18 +251,12 @@ func TestSetup_AutoApproveRecreatesExistingHost(t *testing.T) {
 		SSHConfigPath: configPath,
 		SSHKeysDir:    tmpDir,
 		ShutdownDelay: 30 * time.Second,
+		MaxClients:    10,
+		ServerTimeout: 24 * time.Hour,
 		AutoApprove:   true,
 	}
 
-	clientOpts := client.ClientOptions{
-		ClusterID:     opts.ClusterID,
-		ShutdownDelay: opts.ShutdownDelay,
-	}
-	proxyCommand, err := clientOpts.ToProxyCommand()
-	require.NoError(t, err)
-	opts.ProxyCommand = proxyCommand
-
-	err = Setup(ctx, m.WorkspaceClient, opts)
+	err := Setup(ctx, m.WorkspaceClient, opts)
 	assert.NoError(t, err)
 
 	// Host config should be recreated (no longer contains the stale User).
@@ -304,6 +267,135 @@ func TestSetup_AutoApproveRecreatesExistingHost(t *testing.T) {
 	assert.Contains(t, s, "--cluster=cluster-123")
 }
 
+func TestSetup_SerializesServerLifecycleFlags(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	tmpDir := t.TempDir()
+	t.Setenv("HOME", tmpDir)
+	t.Setenv("USERPROFILE", tmpDir)
+
+	m := mocks.NewMockWorkspaceClient(t)
+	m.GetMockClustersAPI().EXPECT().Get(ctx, compute.GetClusterRequest{ClusterId: "cluster-123"}).Return(&compute.ClusterDetails{
+		DataSecurityMode: compute.DataSecurityModeSingleUser,
+		SingleUserName:   "me@example.com",
+	}, nil)
+
+	opts := SetupOptions{
+		HostName:              "test-host",
+		ClusterID:             "cluster-123",
+		SSHConfigPath:         filepath.Join(tmpDir, "ssh_config"),
+		SSHKeysDir:            tmpDir,
+		ShutdownDelay:         30 * time.Second,
+		MaxClients:            25,
+		ServerTimeout:         48 * time.Hour,
+		KeepDetachedProcesses: true,
+	}
+
+	require.NoError(t, Setup(ctx, m.WorkspaceClient, opts))
+
+	// The ProxyCommand is the invocation that submits the server job, so every value fixed at
+	// submission has to reach the persisted host config or the user's choice is silently dropped.
+	hostContent, err := os.ReadFile(filepath.Join(tmpDir, ".databricks", "ssh-tunnel-configs", "test-host"))
+	require.NoError(t, err)
+	assert.Contains(t, string(hostContent), "--max-clients=25")
+	assert.Contains(t, string(hostContent), "--server-timeout=48h0m0s")
+	assert.Contains(t, string(hostContent), "--keep-detached-processes")
+}
+
+func TestSetup_RejectsUnusableServerLifecycleFlags(t *testing.T) {
+	tests := []struct {
+		name    string
+		opts    SetupOptions
+		wantErr string
+	}{
+		{
+			name:    "zero max clients",
+			opts:    SetupOptions{ServerTimeout: 24 * time.Hour},
+			wantErr: "--max-clients must be at least 1, got 0",
+		},
+		{
+			name:    "zero server timeout",
+			opts:    SetupOptions{MaxClients: 10},
+			wantErr: "--server-timeout must be at least 1s, got 0s",
+		},
+		{
+			name:    "shutdown delay longer than server timeout",
+			opts:    SetupOptions{MaxClients: 10, ShutdownDelay: 48 * time.Hour, ServerTimeout: 24 * time.Hour},
+			wantErr: "--shutdown-delay (48h0m0s) cannot be longer than --server-timeout (24h0m0s)",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := cmdio.MockDiscard(t.Context())
+			tmpDir := t.TempDir()
+			t.Setenv("HOME", tmpDir)
+			t.Setenv("USERPROFILE", tmpDir)
+
+			// Validation fires before any cluster API calls, so no mock expectations needed.
+			m := mocks.NewMockWorkspaceClient(t)
+
+			opts := tt.opts
+			opts.HostName = "test-host"
+			opts.ClusterID = "cluster-123"
+			opts.SSHConfigPath = filepath.Join(tmpDir, "ssh_config")
+			opts.SSHKeysDir = tmpDir
+
+			assert.EqualError(t, Setup(ctx, m.WorkspaceClient, opts), tt.wantErr)
+
+			// Nothing is written when the values are rejected.
+			_, err := os.Stat(filepath.Join(tmpDir, ".databricks", "ssh-tunnel-configs", "test-host"))
+			assert.ErrorIs(t, err, os.ErrNotExist)
+		})
+	}
+}
+
+func TestSetup_PromptsForClusterWhenNotProvided(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	tmpDir := t.TempDir()
+	t.Setenv("HOME", tmpDir)
+	t.Setenv("USERPROFILE", tmpDir)
+
+	configPath := filepath.Join(tmpDir, "ssh_config")
+
+	// Replace the cluster picker with a stub returning a fixed ID. This lets the
+	// test exercise the empty-ClusterID path of Setup without prompting.
+	origPrompt := clusterSelectionPrompt
+	t.Cleanup(func() { clusterSelectionPrompt = origPrompt })
+	promptCalled := false
+	clusterSelectionPrompt = func(_ context.Context, _ *databricks.WorkspaceClient) (string, error) {
+		promptCalled = true
+		return "picked-cluster", nil
+	}
+
+	m := mocks.NewMockWorkspaceClient(t)
+	clustersAPI := m.GetMockClustersAPI()
+	clustersAPI.EXPECT().Get(ctx, compute.GetClusterRequest{ClusterId: "picked-cluster"}).Return(&compute.ClusterDetails{
+		DataSecurityMode: compute.DataSecurityModeSingleUser,
+		SingleUserName:   "me@example.com",
+	}, nil)
+
+	opts := SetupOptions{
+		HostName:      "test-host",
+		SSHConfigPath: configPath,
+		SSHKeysDir:    tmpDir,
+		ShutdownDelay: 30 * time.Second,
+		MaxClients:    10,
+		ServerTimeout: 24 * time.Hour,
+	}
+
+	err := Setup(ctx, m.WorkspaceClient, opts)
+	require.NoError(t, err)
+	assert.True(t, promptCalled, "cluster picker should run when ClusterID is empty")
+
+	// The picked ID must be serialized into the ProxyCommand's --cluster= flag.
+	hostConfigPath := filepath.Join(tmpDir, ".databricks", "ssh-tunnel-configs", "test-host")
+	hostContent, err := os.ReadFile(hostConfigPath)
+	require.NoError(t, err)
+	hostConfigStr := string(hostContent)
+	assert.Contains(t, hostConfigStr, "--cluster=picked-cluster")
+	assert.NotContains(t, hostConfigStr, "--cluster= ")
+}
+
 func TestSetup_SuccessfulWithExistingConfigFile(t *testing.T) {
 	ctx := cmdio.MockDiscard(t.Context())
 	tmpDir := t.TempDir()
@@ -322,6 +414,7 @@ func TestSetup_SuccessfulWithExistingConfigFile(t *testing.T) {
 
 	clustersAPI.EXPECT().Get(ctx, compute.GetClusterRequest{ClusterId: "cluster-456"}).Return(&compute.ClusterDetails{
 		DataSecurityMode: compute.DataSecurityModeSingleUser,
+		SingleUserName:   "me@example.com",
 	}, nil)
 
 	opts := SetupOptions{
@@ -330,18 +423,10 @@ func TestSetup_SuccessfulWithExistingConfigFile(t *testing.T) {
 		SSHConfigPath: configPath,
 		SSHKeysDir:    tmpDir,
 		ShutdownDelay: 60 * time.Second,
+		MaxClients:    10,
+		ServerTimeout: 24 * time.Hour,
 	}
 
-	clientOpts := client.ClientOptions{
-		ClusterID:        opts.ClusterID,
-		AutoStartCluster: opts.AutoStartCluster,
-		ShutdownDelay:    opts.ShutdownDelay,
-		Profile:          opts.Profile,
-	}
-	proxyCommand, err := clientOpts.ToProxyCommand()
-	require.NoError(t, err)
-	opts.ProxyCommand = proxyCommand
-
 	err = Setup(ctx, m.WorkspaceClient, opts)
 	assert.NoError(t, err)
 
diff --git a/experimental/ssh/internal/sshconfig/knownhosts.go b/experimental/ssh/internal/sshconfig/knownhosts.go
new file mode 100644
index 00000000000..f12749feb9e
--- /dev/null
+++ b/experimental/ssh/internal/sshconfig/knownhosts.go
@@ -0,0 +1,68 @@
+package sshconfig
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"github.com/databricks/cli/libs/atomicfile"
+	"github.com/databricks/cli/libs/env"
+	"golang.org/x/crypto/ssh"
+)
+
+// GetKnownHostsPath returns the known_hosts file the CLI maintains for a session
+// (sessionID is the connection name for serverless, the cluster ID otherwise).
+// knownHostsDir defaults to ~/.databricks/ssh-tunnel-known-hosts.
+//
+// The file name is always the session ID, never a path the caller picks, because PinHostKey
+// rewrites the file: relocating the directory is all a caller can do, so no shared
+// known_hosts can end up being replaced with a single tunnel entry.
+//
+// Tunnel host keys are deliberately kept out of the user's ~/.ssh/known_hosts. A session
+// name identifies compute within one workspace, while ~/.ssh/known_hosts is global and
+// keyed by name alone, so the same name used in a second workspace - or against compute
+// whose host key was regenerated - collides with the entry left by the first and trips
+// strict host key checking on a connection that is perfectly legitimate.
+func GetKnownHostsPath(ctx context.Context, sessionID, knownHostsDir string) (string, error) {
+	if knownHostsDir == "" {
+		homeDir, err := env.UserHomeDir(ctx)
+		if err != nil {
+			return "", fmt.Errorf("failed to get home directory: %w", err)
+		}
+		knownHostsDir = filepath.Join(homeDir, ".databricks", "ssh-tunnel-known-hosts")
+	}
+	return filepath.Join(knownHostsDir, sessionID), nil
+}
+
+// PinHostKey makes publicKey the entry for hostName in the known_hosts file at path,
+// replacing the file's previous contents.
+//
+// The tunnel server publishes its host key to the workspace, which makes the workspace the
+// authority on it: pinning that key before every connection lets ssh verify the server
+// with no trust-on-first-use window, and leaves no way for a key recorded under the same
+// name earlier to fail a connection. The file belongs to the CLI, which is why it is
+// rewritten rather than edited - an entry recorded with HashKnownHosts cannot be matched
+// by host name, so selectively dropping the stale one is not possible.
+func PinHostKey(path, hostName string, publicKey []byte) error {
+	parsed, _, _, _, err := ssh.ParseAuthorizedKey(publicKey)
+	if err != nil {
+		return fmt.Errorf("failed to parse the SSH server host key: %w", err)
+	}
+	// MarshalAuthorizedKey drops any comment and terminates the line with "\n".
+	line := hostName + " " + string(ssh.MarshalAuthorizedKey(parsed))
+
+	// Leave an already-correct pin alone, which is the common case: every ssh invocation
+	// refreshes it through the ProxyCommand, and an IDE opens several at once. Renaming over
+	// a file another ssh has open fails on Windows.
+	if existing, err := os.ReadFile(path); err == nil && string(existing) == line {
+		return nil
+	}
+
+	// Write and rename so a connection racing this one (every ssh invocation runs the
+	// ProxyCommand, which refreshes the pin) never reads a half-written file.
+	if err := atomicfile.Write(path, []byte(line), 0o600, atomicfile.MkDir(0o700)); err != nil {
+		return fmt.Errorf("failed to write known hosts file: %w", err)
+	}
+	return nil
+}
diff --git a/experimental/ssh/internal/sshconfig/knownhosts_test.go b/experimental/ssh/internal/sshconfig/knownhosts_test.go
new file mode 100644
index 00000000000..1aa3fa19de6
--- /dev/null
+++ b/experimental/ssh/internal/sshconfig/knownhosts_test.go
@@ -0,0 +1,99 @@
+package sshconfig
+
+import (
+	"os"
+	"path/filepath"
+	"runtime"
+	"testing"
+	"time"
+
+	"github.com/databricks/cli/libs/env"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	testHostKey      = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICTzJweKcgiNoBUAyuvCY2Qu1Od8mKBON5aJeA03Nl+D"
+	testOtherHostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIErh/dj+R5gtO5dZ5ToM4KYZTpNHOQTHW/RsjRXeOBt3"
+)
+
+func TestGetKnownHostsPath(t *testing.T) {
+	tmpDir := t.TempDir()
+	t.Setenv(env.HomeEnvVar(), tmpDir)
+
+	path, err := GetKnownHostsPath(t.Context(), "databricks-cpu-6e7644d0", "")
+	require.NoError(t, err)
+	assert.Equal(t, filepath.Join(tmpDir, ".databricks", "ssh-tunnel-known-hosts", "databricks-cpu-6e7644d0"), path)
+}
+
+func TestGetKnownHostsPathOverrideRelocatesTheDirectoryOnly(t *testing.T) {
+	// The override names a directory, never the file: PinHostKey replaces the file it is
+	// given, so a shared known_hosts must stay out of reach of it.
+	path, err := GetKnownHostsPath(t.Context(), "databricks-cpu-6e7644d0", filepath.Join("/home/me", ".ssh"))
+	require.NoError(t, err)
+	assert.Equal(t, filepath.Join("/home/me", ".ssh", "databricks-cpu-6e7644d0"), path)
+}
+
+func TestPinHostKey(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "known-hosts", "myhost")
+
+	err := PinHostKey(path, "myhost", []byte(testHostKey+" a-comment\n"))
+	require.NoError(t, err)
+
+	content, err := os.ReadFile(path)
+	require.NoError(t, err)
+	// The comment is dropped: known_hosts keeps host and key, and the line is terminated
+	// so ssh doesn't ignore the last entry.
+	assert.Equal(t, "myhost "+testHostKey+"\n", string(content))
+
+	if runtime.GOOS != "windows" {
+		info, err := os.Stat(path)
+		require.NoError(t, err)
+		assert.Equal(t, os.FileMode(0o600), info.Mode().Perm())
+	}
+}
+
+func TestPinHostKeyReplacesPreviousEntry(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "known-hosts", "myhost")
+
+	// A key recorded for this name earlier, in the hashed form OpenSSH writes when
+	// HashKnownHosts is on - it cannot be matched by host name, which is why the file is
+	// rewritten rather than edited (DECO-27882).
+	require.NoError(t, os.MkdirAll(filepath.Dir(path), 0o700))
+	require.NoError(t, os.WriteFile(path, []byte("|1|Lvcr5SHFVcEwAhYIbCCuADji6QQ=|rRdETW4qVc96QcC/TtDezxhkfp4= "+testOtherHostKey+"\n"), 0o600))
+
+	err := PinHostKey(path, "myhost", []byte(testHostKey))
+	require.NoError(t, err)
+
+	content, err := os.ReadFile(path)
+	require.NoError(t, err)
+	assert.Equal(t, "myhost "+testHostKey+"\n", string(content))
+}
+
+func TestPinHostKeyLeavesACorrectPinAlone(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "known-hosts", "myhost")
+	require.NoError(t, PinHostKey(path, "myhost", []byte(testHostKey)))
+
+	// An IDE opens several connections at once and each refreshes the pin, so an
+	// already-correct one must not be rewritten. Backdating the file makes the rewrite
+	// observable without depending on timer resolution.
+	backdated := time.Now().Add(-time.Hour).Truncate(time.Second)
+	require.NoError(t, os.Chtimes(path, backdated, backdated))
+
+	require.NoError(t, PinHostKey(path, "myhost", []byte(testHostKey)))
+
+	info, err := os.Stat(path)
+	require.NoError(t, err)
+	assert.Equal(t, backdated, info.ModTime().Truncate(time.Second))
+}
+
+func TestPinHostKeyRejectsMalformedKey(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "known-hosts", "myhost")
+
+	err := PinHostKey(path, "myhost", []byte("not-a-key"))
+	assert.ErrorContains(t, err, "failed to parse the SSH server host key")
+
+	// A malformed key must not leave a file ssh would then fail to verify against.
+	_, err = os.Stat(path)
+	assert.ErrorIs(t, err, os.ErrNotExist)
+}
diff --git a/experimental/ssh/internal/sshconfig/sshconfig.go b/experimental/ssh/internal/sshconfig/sshconfig.go
index ad8ca0ee2a7..ff9ad9ad69e 100644
--- a/experimental/ssh/internal/sshconfig/sshconfig.go
+++ b/experimental/ssh/internal/sshconfig/sshconfig.go
@@ -10,6 +10,7 @@ import (
 	"strings"
 
 	"github.com/databricks/cli/experimental/ssh/internal/fileutil"
+	"github.com/databricks/cli/libs/atomicfile"
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/env"
 )
@@ -19,6 +20,18 @@ const (
 	configDirName = ".databricks/ssh-tunnel-configs"
 )
 
+// ServerAliveIntervalSeconds is how often the ssh client asks the SSH server to confirm it is
+// still there. The reply is a real SSH packet, so the keepalive puts payload bytes on every hop
+// of the tunnel — and payload is what an idle session needs. The driver proxy terminates
+// websocket control frames itself, so the proxy's own websocket ping never becomes payload on
+// the leg past it, and that leg is reaped after ~8 minutes without any.
+//
+// It also brings in ServerAliveCountMax (OpenSSH default 3), so a tunnel that stops responding
+// is torn down after ~90s with ssh's own "server not responding" message instead of hanging.
+// That is well clear of the up to 30s a handover can hold the sending loop
+// (proxyHandoverInitTimeout), the longest legitimate pause on a healthy tunnel.
+const ServerAliveIntervalSeconds = 30
+
 func GetConfigDir(ctx context.Context) (string, error) {
 	homeDir, err := env.UserHomeDir(ctx)
 	if err != nil {
@@ -95,7 +108,7 @@ func EnsureIncludeDirective(ctx context.Context, configPath string) error {
 		if err := fileutil.BackupFile(ctx, configPath, content); err != nil {
 			return fmt.Errorf("failed to backup SSH config before migration: %w", err)
 		}
-		return os.WriteFile(configPath, replaceLine(content, oldIncludeLine, includeLine), 0o600)
+		return atomicfile.Write(configPath, replaceLine(content, oldIncludeLine, includeLine), 0o600)
 	}
 
 	if err := fileutil.BackupFile(ctx, configPath, content); err != nil {
@@ -107,7 +120,7 @@ func EnsureIncludeDirective(ctx context.Context, configPath string) error {
 	}
 	newContent += string(content)
 
-	err = os.WriteFile(configPath, []byte(newContent), 0o600)
+	err = atomicfile.Write(configPath, []byte(newContent), 0o600)
 	if err != nil {
 		return fmt.Errorf("failed to update SSH config file with Include directive: %w", err)
 	}
@@ -179,13 +192,7 @@ func CreateOrUpdateHostConfig(ctx context.Context, hostName, hostConfig string,
 		return false, nil
 	}
 
-	configDir := filepath.Dir(configPath)
-	err = os.MkdirAll(configDir, 0o700)
-	if err != nil {
-		return false, fmt.Errorf("failed to create config directory: %w", err)
-	}
-
-	err = os.WriteFile(configPath, []byte(hostConfig), 0o600)
+	err = atomicfile.Write(configPath, []byte(hostConfig), 0o600, atomicfile.MkDir(0o700))
 	if err != nil {
 		return false, fmt.Errorf("failed to write host config file: %w", err)
 	}
@@ -201,14 +208,31 @@ func PromptRecreateConfig(ctx context.Context, hostName string) (bool, error) {
 	return response, nil
 }
 
-func GenerateHostConfig(hostName, userName, identityFile, proxyCommand string) string {
+// GenerateHostConfig renders the host block for a tunnel connection. Host key checking is
+// strict rather than accept-new: the ProxyCommand pins the server's key (see PinHostKey)
+// into knownHostsFile before ssh gets as far as verifying it, so there is no first
+// connection that has to be taken on trust.
+//
+// hostKeyAlias is the name the key is pinned under in knownHostsFile - the session ID, i.e.
+// the cluster ID for dedicated compute and the connection name for serverless. When it is
+// non-empty it is emitted as HostKeyAlias so ssh looks the key up under that name. This
+// matters whenever the user-facing hostName differs from it, as with
+// `ssh setup --name <alias> --cluster <id>`: without it ssh would look the key up under the
+// alias, find no matching entry, and fail strict host key checking (DECO-27882).
+func GenerateHostConfig(hostName, userName, identityFile, knownHostsFile, hostKeyAlias, proxyCommand string) string {
+	hostKeyAliasLine := ""
+	if hostKeyAlias != "" {
+		hostKeyAliasLine = fmt.Sprintf("    HostKeyAlias %s\n", hostKeyAlias)
+	}
 	return fmt.Sprintf(`
 Host %s
     User %s
     ConnectTimeout 360
-    StrictHostKeyChecking accept-new
-    IdentitiesOnly yes
+    ServerAliveInterval %d
+    StrictHostKeyChecking yes
+    UserKnownHostsFile %q
+%s    IdentitiesOnly yes
     IdentityFile %q
     ProxyCommand %s
-`, hostName, userName, identityFile, proxyCommand)
+`, hostName, userName, ServerAliveIntervalSeconds, knownHostsFile, hostKeyAliasLine, identityFile, proxyCommand)
 }
diff --git a/experimental/ssh/internal/sshconfig/sshconfig_test.go b/experimental/ssh/internal/sshconfig/sshconfig_test.go
index 6c453910cdc..7d7f695b12a 100644
--- a/experimental/ssh/internal/sshconfig/sshconfig_test.go
+++ b/experimental/ssh/internal/sshconfig/sshconfig_test.go
@@ -1,6 +1,7 @@
 package sshconfig
 
 import (
+	"fmt"
 	"os"
 	"path/filepath"
 	"testing"
@@ -10,6 +11,33 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+func TestGenerateHostConfigSetsServerAliveInterval(t *testing.T) {
+	config := GenerateHostConfig("myhost", "root", "/keys/myhost", "/known-hosts/myhost", "cluster-123", "databricks ssh connect --proxy")
+
+	// `ssh setup` and `--ide` reach ssh through this block and nothing else, so the option has to
+	// be in it.
+	assert.Contains(t, config, fmt.Sprintf("\n    ServerAliveInterval %d\n", ServerAliveIntervalSeconds))
+
+	// The interval has to fire well inside the ~8 minute reap window, and ServerAliveCountMax
+	// (OpenSSH default 3) intervals have to outlast the longest legitimate pause on a healthy
+	// tunnel — the up to 30s a handover can hold the sending loop. The 30 below is
+	// proxy.proxyHandoverInitTimeout's current value; it is unexported, so it can't be referenced.
+	assert.Less(t, ServerAliveIntervalSeconds, 8*60)
+	assert.Greater(t, 3*ServerAliveIntervalSeconds, 30)
+}
+
+func TestGenerateHostConfigPinsHostKeyAlias(t *testing.T) {
+	// `ssh setup --name myhost --cluster cluster-123` writes `Host myhost` but pins the server
+	// key under the cluster ID, so the block has to carry `HostKeyAlias cluster-123` for ssh to
+	// find the pinned entry under strict checking (DECO-27882).
+	config := GenerateHostConfig("myhost", "root", "/keys/myhost", "/known-hosts/cluster-123", "cluster-123", "databricks ssh connect --proxy")
+	assert.Contains(t, config, "\n    HostKeyAlias cluster-123\n")
+
+	// An empty alias omits the directive entirely rather than emitting a bare `HostKeyAlias`.
+	noAlias := GenerateHostConfig("myhost", "root", "/keys/myhost", "/known-hosts/myhost", "", "databricks ssh connect --proxy")
+	assert.NotContains(t, noAlias, "HostKeyAlias")
+}
+
 func TestGetConfigDir(t *testing.T) {
 	dir, err := GetConfigDir(t.Context())
 	assert.NoError(t, err)
diff --git a/experimental/ssh/internal/vscode/run.go b/experimental/ssh/internal/vscode/run.go
index d130e2004a3..912e35a5f17 100644
--- a/experimental/ssh/internal/vscode/run.go
+++ b/experimental/ssh/internal/vscode/run.go
@@ -2,6 +2,7 @@ package vscode
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"os"
 	"os/exec"
@@ -27,6 +28,16 @@ type ideDescriptor struct {
 	SSHExtensionID         string
 	SSHExtensionName       string
 	MinSSHExtensionVersion string
+	// DefaultExtensions are seeded into the remote IDE's
+	// "remote.SSH.defaultExtensions" setting so they auto-install on the remote.
+	DefaultExtensions []string
+	// IncompatibleExtensions are removed from "remote.SSH.defaultExtensions" if
+	// present. Used to heal settings written by older CLI builds that seeded
+	// extensions which hang this IDE's remote auto-install.
+	IncompatibleExtensions []string
+	// LaunchArgs are extra flags passed to the IDE command before "--remote"
+	// when opening the remote window.
+	LaunchArgs []string
 }
 
 var vsCodeIDE = ideDescriptor{
@@ -39,6 +50,7 @@ var vsCodeIDE = ideDescriptor{
 	SSHExtensionName: "Remote - SSH",
 	// Earlier versions might work too, 0.120.0 is a safe not-too-old pick
 	MinSSHExtensionVersion: "0.120.0",
+	DefaultExtensions:      []string{pythonExtension, jupyterExtension, databricksExtension},
 }
 
 var cursorIDE = ideDescriptor{
@@ -51,6 +63,20 @@ var cursorIDE = ideDescriptor{
 	SSHExtensionName: "Remote - SSH",
 	// Earlier versions don't support remote.SSH.serverPickPortsFromRange option
 	MinSSHExtensionVersion: "1.0.32",
+	// Cursor's marketplace silently remaps ms-python.python -> anysphere.python
+	// (and Pylance -> anysphere.cursorpyright), which forms a circular dependency
+	// and hangs the remote auto-install indefinitely. Cursor ships its own Python
+	// stack anyway, so we only seed the Databricks extension here and let the user
+	// (or that extension) pull in Python/Jupyter as needed. See DECO-27339.
+	DefaultExtensions: []string{databricksExtension},
+	// Heal settings written by older CLI builds: these are the extensions that
+	// trigger the Cursor remap hang, so strip them from defaultExtensions if a
+	// prior `ssh connect --ide cursor` left them behind. See DECO-27339.
+	IncompatibleExtensions: []string{pythonExtension, jupyterExtension},
+	// Cursor 3.x defaults new windows to the "Agents Window", which swallows the
+	// "--remote" request and never opens the remote editor. --classic forces a
+	// classic editor window so the remote workspace actually opens. See DECO-27339.
+	LaunchArgs: []string{"--classic"},
 }
 
 func getIDE(option string) ideDescriptor {
@@ -93,15 +119,47 @@ func isExtensionVersionAtLeast(version, minVersion string) bool {
 	return semver.IsValid(v) && semver.Compare(v, "v"+minVersion) >= 0
 }
 
+// The ways CheckIDESSHExtension can fail. Callers match these with errors.Is to attribute a
+// failure without matching on message text. They are separate because they call for different
+// fixes: a list failure means the check never ran, an install failure points at the marketplace
+// or a policy blocking it, and the two consent outcomes cannot happen under --auto-approve.
+var (
+	ErrSSHExtensionListFailed         = errors.New("could not list installed extensions")
+	ErrSSHExtensionInstallFailed      = errors.New("could not install the Remote SSH extension")
+	ErrSSHExtensionInstallDeclined    = errors.New("install of the Remote SSH extension declined")
+	ErrSSHExtensionInstallUnavailable = errors.New("cannot prompt to install the Remote SSH extension")
+)
+
+// consentError renders only the message written for the user while still matching its sentinel
+// via errors.Is. The two exec failures wrap theirs with %w instead: their message ends in the
+// underlying error, so the sentinel reads as a natural prefix. A consent message is a full
+// sentence that already states the problem, and prefixing it would lead with an internal tag
+// and then restate what follows.
+type consentError struct {
+	msg      string
+	sentinel error
+}
+
+func (e *consentError) Error() string { return e.msg }
+
+func (e *consentError) Unwrap() error { return e.sentinel }
+
+// consentErrorf formats a user-facing message and tags it with sentinel.
+func consentErrorf(sentinel error, format string, args ...any) error {
+	return &consentError{msg: fmt.Sprintf(format, args...), sentinel: sentinel}
+}
+
 // CheckIDESSHExtension verifies that the required Remote SSH extension is installed
 // with a compatible version, and offers to install/update it if not.
 // When autoApprove is true, the extension is installed without asking.
+//
+// Every returned error wraps one of the Err* sentinels above.
 func CheckIDESSHExtension(ctx context.Context, option string, autoApprove bool) error {
 	ide := getIDE(option)
 
 	out, err := exec.CommandContext(ctx, ide.Command, "--list-extensions", "--show-versions").Output()
 	if err != nil {
-		return fmt.Errorf("failed to list %s extensions: %w", ide.Name, err)
+		return fmt.Errorf("%w in %s: %w", ErrSSHExtensionListFailed, ide.Name, err)
 	}
 
 	version, found := parseExtensionVersion(string(out), ide.SSHExtensionID)
@@ -119,16 +177,18 @@ func CheckIDESSHExtension(ctx context.Context, option string, autoApprove bool)
 
 	if !autoApprove {
 		if !cmdio.IsPromptSupported(ctx) {
-			return fmt.Errorf("%s Install it with: %s --install-extension %s, or pass --auto-approve",
+			return consentErrorf(ErrSSHExtensionInstallUnavailable,
+				"%s Install it with: %s --install-extension %s, or pass --auto-approve",
 				msg, ide.Command, ide.SSHExtensionID)
 		}
 
 		shouldInstall, err := cmdio.AskYesOrNo(ctx, msg+" Would you like to install it?")
 		if err != nil {
-			return fmt.Errorf("failed to prompt user: %w", err)
+			return fmt.Errorf("%w: %w", ErrSSHExtensionInstallUnavailable, err)
 		}
 		if !shouldInstall {
-			return fmt.Errorf("%s Install it with: %s --install-extension %s",
+			return consentErrorf(ErrSSHExtensionInstallDeclined,
+				"%s Install it with: %s --install-extension %s",
 				msg, ide.Command, ide.SSHExtensionID)
 		}
 	} else {
@@ -140,23 +200,36 @@ func CheckIDESSHExtension(ctx context.Context, option string, autoApprove bool)
 	installCmd.Stdout = os.Stdout
 	installCmd.Stderr = os.Stderr
 	if err := installCmd.Run(); err != nil {
-		return fmt.Errorf("failed to install extension %q: %w", ide.SSHExtensionName, err)
+		return fmt.Errorf("%w in %s: %w", ErrSSHExtensionInstallFailed, ide.Name, err)
 	}
 	return nil
 }
 
+// remoteLaunchArgs builds the arguments that open a remote window on the tunnel
+// host at the user's workspace home folder.
+//
+// The remote authority is the SSH host alias alone, without a "<user>@" prefix.
+// The host config the CLI writes for the connection already carries a User
+// directive (see sshconfig.GenerateHostConfig), and on serverless the remote OS
+// user is a fresh per-instance name (spark-<uuid>), so including it would give
+// every connect a different authority. VS Code keys the "previously opened
+// folders" it lists under a host by URI, so a per-connect authority added a
+// duplicate row to the Remote Explorer on every `ssh connect --ide`.
+func remoteLaunchArgs(ide ideDescriptor, connectionName, databricksUserName string) []string {
+	// Format: ssh-remote+<connection_name> /Workspace/Users/<databricks_user_name>/
+	remoteURI := "ssh-remote+" + connectionName
+	remotePath := fmt.Sprintf("/Workspace/Users/%s/", databricksUserName)
+	return append(append([]string{}, ide.LaunchArgs...), "--remote", remoteURI, remotePath)
+}
+
 // LaunchIDE launches the IDE with a remote SSH connection using special "ssh-remote" URI format.
-func LaunchIDE(ctx context.Context, ideOption, connectionName, userName, databricksUserName string) error {
+func LaunchIDE(ctx context.Context, ideOption, connectionName, databricksUserName string) error {
 	ide := getIDE(ideOption)
+	args := remoteLaunchArgs(ide, connectionName, databricksUserName)
 
-	// Construct the remote SSH URI
-	// Format: ssh-remote+<server_user_name>@<connection_name> /Workspace/Users/<databricks_user_name>/
-	remoteURI := fmt.Sprintf("ssh-remote+%s@%s", userName, connectionName)
-	remotePath := fmt.Sprintf("/Workspace/Users/%s/", databricksUserName)
-
-	log.Infof(ctx, "Launching %s with remote URI: %s and path: %s", ideOption, remoteURI, remotePath)
+	log.Infof(ctx, "Launching %s with args: %v", ideOption, args)
 
-	ideCmd := exec.CommandContext(ctx, ide.Command, "--remote", remoteURI, remotePath)
+	ideCmd := exec.CommandContext(ctx, ide.Command, args...)
 	ideCmd.Stdout = os.Stdout
 	ideCmd.Stderr = os.Stderr
 
diff --git a/experimental/ssh/internal/vscode/run_test.go b/experimental/ssh/internal/vscode/run_test.go
index 2a33b7b3828..839ef931a3b 100644
--- a/experimental/ssh/internal/vscode/run_test.go
+++ b/experimental/ssh/internal/vscode/run_test.go
@@ -2,6 +2,7 @@ package vscode
 
 import (
 	"fmt"
+	"io"
 	"os"
 	"path/filepath"
 	"runtime"
@@ -232,6 +233,37 @@ func createFakeIDEExecutable(t *testing.T, dir, command, output string) {
 	}
 }
 
+// createFailingIDEExecutable writes a fake IDE command that exits non-zero for every
+// invocation, so "--list-extensions" fails and the check never learns what is installed.
+func createFailingIDEExecutable(t *testing.T, dir, command string) {
+	t.Helper()
+	if runtime.GOOS == "windows" {
+		err := os.WriteFile(filepath.Join(dir, command+".cmd"), []byte("@echo off\nexit /b 4\n"), 0o755)
+		require.NoError(t, err)
+	} else {
+		err := os.WriteFile(filepath.Join(dir, command), []byte("#!/bin/sh\nexit 4\n"), 0o755)
+		require.NoError(t, err)
+	}
+}
+
+// createIDEExecutableFailingInstall writes a fake IDE command that lists extensions
+// successfully but rejects "--install-extension", as a marketplace or policy block would.
+func createIDEExecutableFailingInstall(t *testing.T, dir, command, output string) {
+	t.Helper()
+	if runtime.GOOS == "windows" {
+		payloadPath := filepath.Join(dir, command+"-payload.txt")
+		err := os.WriteFile(payloadPath, []byte(output), 0o644)
+		require.NoError(t, err)
+		script := fmt.Sprintf("@echo off\nif \"%%1\"==\"--install-extension\" exit /b 3\ntype \"%s\"\n", payloadPath)
+		err = os.WriteFile(filepath.Join(dir, command+".cmd"), []byte(script), 0o755)
+		require.NoError(t, err)
+	} else {
+		script := fmt.Sprintf("#!/bin/sh\nfor a in \"$@\"; do\n  [ \"$a\" = \"--install-extension\" ] && exit 3\ndone\nprintf '%%s' '%s'\n", output)
+		err := os.WriteFile(filepath.Join(dir, command), []byte(script), 0o755)
+		require.NoError(t, err)
+	}
+}
+
 func TestCheckIDESSHExtension_UpToDate(t *testing.T) {
 	tmpDir := t.TempDir()
 	t.Setenv("PATH", tmpDir)
@@ -268,6 +300,8 @@ func TestCheckIDESSHExtension_Missing(t *testing.T) {
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), `"Remote - SSH"`)
 	assert.Contains(t, err.Error(), "not installed")
+	// The test context is not a TTY, so consent cannot be asked for.
+	assert.ErrorIs(t, err, ErrSSHExtensionInstallUnavailable)
 }
 
 func TestCheckIDESSHExtension_Outdated(t *testing.T) {
@@ -282,6 +316,7 @@ func TestCheckIDESSHExtension_Outdated(t *testing.T) {
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "0.100.0")
 	assert.Contains(t, err.Error(), ">= 0.120.0")
+	assert.ErrorIs(t, err, ErrSSHExtensionInstallUnavailable)
 }
 
 func TestCheckIDESSHExtension_Cursor(t *testing.T) {
@@ -308,6 +343,36 @@ func TestCheckIDESSHExtension_AutoApproveMissing_Installs(t *testing.T) {
 	assert.NoError(t, err)
 }
 
+// The authority must be the host alias alone. The remote OS user is a fresh
+// spark-<uuid> on every serverless instance, so a "<user>@" prefix would give each
+// connect a different authority and VS Code would remember a separate
+// previously-opened folder for each one.
+func TestRemoteLaunchArgs(t *testing.T) {
+	tests := []struct {
+		name string
+		ide  string
+		want []string
+	}{
+		{
+			name: "vscode",
+			ide:  VSCodeOption,
+			want: []string{"--remote", "ssh-remote+databricks-cpu-7f189c39", "/Workspace/Users/me@example.com/"},
+		},
+		{
+			name: "cursor keeps its launch args first",
+			ide:  CursorOption,
+			want: []string{"--classic", "--remote", "ssh-remote+databricks-cpu-7f189c39", "/Workspace/Users/me@example.com/"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			args := remoteLaunchArgs(getIDE(tt.ide), "databricks-cpu-7f189c39", "me@example.com")
+			assert.Equal(t, tt.want, args)
+		})
+	}
+}
+
 func TestCheckIDESSHExtension_NoPrompt_WithoutAutoApprove_Errors(t *testing.T) {
 	tmpDir := t.TempDir()
 	t.Setenv("PATH", tmpDir)
@@ -318,5 +383,67 @@ func TestCheckIDESSHExtension_NoPrompt_WithoutAutoApprove_Errors(t *testing.T) {
 
 	err := CheckIDESSHExtension(ctx, VSCodeOption, false)
 	require.Error(t, err)
-	assert.Contains(t, err.Error(), "--install-extension")
+	assert.ErrorIs(t, err, ErrSSHExtensionInstallUnavailable)
+	// The sentinel is a telemetry tag, so it must stay out of the message: what the user needs
+	// to read first is the problem, not that the CLI had no way to ask about it.
+	assert.Equal(t, `Required extension "Remote - SSH" is not installed in VS Code. `+
+		"Install it with: code --install-extension ms-vscode-remote.remote-ssh, or pass --auto-approve",
+		err.Error())
+}
+
+// Declining at the prompt is the outcome that separates "the user said no" from "there was no
+// way to ask", which is the distinction the split exists to make. Drive the real prompt rather
+// than asserting against a hand-built error, so the wiring is covered and not just the mapping.
+func TestCheckIDESSHExtension_Declined(t *testing.T) {
+	tmpDir := t.TempDir()
+	t.Setenv("PATH", tmpDir)
+	ctx, tst := cmdio.SetupTest(t.Context(), cmdio.TestOptions{PromptSupported: true})
+	defer tst.Done()
+
+	createFakeIDEExecutable(t, tmpDir, "code", "ms-python.python@2024.1.1\n")
+
+	// Drain stderr, where the prompt is written, or AskYesOrNo blocks on the pipe.
+	go func() { _, _ = io.Copy(io.Discard, tst.Stderr) }()
+	go func() {
+		_, _ = tst.Stdin.WriteString("n\n")
+		_ = tst.Stdin.Flush()
+	}()
+
+	err := CheckIDESSHExtension(ctx, VSCodeOption, false)
+	require.Error(t, err)
+	assert.ErrorIs(t, err, ErrSSHExtensionInstallDeclined)
+	assert.NotErrorIs(t, err, ErrSSHExtensionInstallUnavailable)
+	assert.Equal(t, `Required extension "Remote - SSH" is not installed in VS Code. `+
+		"Install it with: code --install-extension ms-vscode-remote.remote-ssh", err.Error())
+}
+
+// A command that is on PATH but whose --list-extensions fails is reported separately from a
+// missing extension: nothing was learned about what is installed, so it is not an install
+// problem. CheckIDECommand passes here, since the command does resolve.
+func TestCheckIDESSHExtension_ListFails(t *testing.T) {
+	tmpDir := t.TempDir()
+	t.Setenv("PATH", tmpDir)
+	ctx, _ := cmdio.NewTestContextWithStdout(t.Context())
+
+	createFailingIDEExecutable(t, tmpDir, "code")
+
+	err := CheckIDESSHExtension(ctx, VSCodeOption, true)
+	require.Error(t, err)
+	assert.ErrorIs(t, err, ErrSSHExtensionListFailed)
+	assert.NotErrorIs(t, err, ErrSSHExtensionInstallFailed)
+}
+
+// With --auto-approve there is no prompt, so a missing extension goes straight to an install.
+// A rejected install is the one outcome the IDE button can produce on this path.
+func TestCheckIDESSHExtension_AutoApprove_InstallFails(t *testing.T) {
+	tmpDir := t.TempDir()
+	t.Setenv("PATH", tmpDir)
+	ctx, _ := cmdio.NewTestContextWithStdout(t.Context())
+
+	createIDEExecutableFailingInstall(t, tmpDir, "code", "ms-python.python@2024.1.1\n")
+
+	err := CheckIDESSHExtension(ctx, VSCodeOption, true)
+	require.Error(t, err)
+	assert.ErrorIs(t, err, ErrSSHExtensionInstallFailed)
+	assert.NotErrorIs(t, err, ErrSSHExtensionInstallUnavailable)
 }
diff --git a/experimental/ssh/internal/vscode/settings.go b/experimental/ssh/internal/vscode/settings.go
index f4253f0db27..ddaf1ace4e7 100644
--- a/experimental/ssh/internal/vscode/settings.go
+++ b/experimental/ssh/internal/vscode/settings.go
@@ -12,6 +12,7 @@ import (
 	"strings"
 
 	"github.com/databricks/cli/experimental/ssh/internal/fileutil"
+	"github.com/databricks/cli/libs/atomicfile"
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/env"
 	"github.com/databricks/cli/libs/log"
@@ -37,10 +38,13 @@ type missingSettings struct {
 	platform       bool
 	listenOnSocket bool
 	extensions     []string
+	// extensionsToRemove are entries currently present in defaultExtensions that
+	// are incompatible with this IDE and should be stripped.
+	extensionsToRemove []string
 }
 
 func (m *missingSettings) isEmpty() bool {
-	return !m.portRange && !m.platform && !m.listenOnSocket && len(m.extensions) == 0
+	return !m.portRange && !m.platform && !m.listenOnSocket && len(m.extensions) == 0 && len(m.extensionsToRemove) == 0
 }
 
 // Builds a JSON Pointer (RFC 6901) from path segments to be used in hujson.Value.Find.
@@ -88,7 +92,7 @@ func CheckAndUpdateSettings(ctx context.Context, ide, connectionName string, aut
 		return fmt.Errorf("failed to load settings: %w", err)
 	}
 
-	missing := validateSettings(settings, connectionName)
+	missing := validateSettings(settings, connectionName, ide)
 	if missing.isEmpty() {
 		log.Debugf(ctx, "IDE settings already correct for %s", connectionName)
 		return nil
@@ -191,8 +195,8 @@ func hasCorrectListenOnSocket(v hujson.Value) bool {
 	return ok && lit.Bool()
 }
 
-func getMissingExtensions(v hujson.Value) []string {
-	required := []string{pythonExtension, jupyterExtension, databricksExtension}
+func getMissingExtensions(v hujson.Value, ide string) []string {
+	required := getIDE(ide).DefaultExtensions
 	found := v.Find(jsonPtr(defaultExtensionsKey))
 	if found == nil {
 		return required
@@ -216,12 +220,45 @@ func getMissingExtensions(v hujson.Value) []string {
 	return missing
 }
 
-func validateSettings(v hujson.Value, connectionName string) *missingSettings {
+// getStaleExtensions returns the IDE's incompatible extensions that are
+// currently present in defaultExtensions and should be removed. This heals
+// settings written by older CLI builds (e.g. ms-python.python under Cursor,
+// which hangs the remote auto-install — see DECO-27339).
+func getStaleExtensions(v hujson.Value, ide string) []string {
+	incompatible := getIDE(ide).IncompatibleExtensions
+	if len(incompatible) == 0 {
+		return nil
+	}
+	found := v.Find(jsonPtr(defaultExtensionsKey))
+	if found == nil {
+		return nil
+	}
+	arr, ok := found.Value.(*hujson.Array)
+	if !ok {
+		return nil
+	}
+	existingSet := make(map[string]bool, len(arr.Elements))
+	for _, el := range arr.Elements {
+		if lit, ok := el.Value.(hujson.Literal); ok {
+			existingSet[lit.String()] = true
+		}
+	}
+	var stale []string
+	for _, ext := range incompatible {
+		if existingSet[ext] {
+			stale = append(stale, ext)
+		}
+	}
+	return stale
+}
+
+func validateSettings(v hujson.Value, connectionName, ide string) *missingSettings {
 	return &missingSettings{
-		portRange:      !hasCorrectPortRange(v, connectionName),
-		platform:       !hasCorrectPlatform(v, connectionName),
-		listenOnSocket: !hasCorrectListenOnSocket(v),
-		extensions:     getMissingExtensions(v),
+		portRange:          !hasCorrectPortRange(v, connectionName),
+		platform:           !hasCorrectPlatform(v, connectionName),
+		listenOnSocket:     !hasCorrectListenOnSocket(v),
+		extensions:         getMissingExtensions(v, ide),
+		extensionsToRemove: getStaleExtensions(v, ide),
 	}
 }
 
@@ -243,6 +280,13 @@ func settingsMessage(connectionName string, missing *missingSettings) string {
 		}
 		lines = append(lines, fmt.Sprintf("    \"%s\": [%s] // Global setting", defaultExtensionsKey, strings.Join(quoted, ", ")))
 	}
+	if len(missing.extensionsToRemove) > 0 {
+		quoted := make([]string, len(missing.extensionsToRemove))
+		for i, ext := range missing.extensionsToRemove {
+			quoted[i] = fmt.Sprintf("\"%s\"", ext)
+		}
+		lines = append(lines, fmt.Sprintf("    // remove from \"%s\": [%s] (incompatible with this IDE)", defaultExtensionsKey, strings.Join(quoted, ", ")))
+	}
 	return "  {\n" + strings.Join(lines, ",\n") + "\n  }"
 }
 
@@ -262,7 +306,7 @@ func handleMissingFile(ctx context.Context, ide, connectionName, settingsPath st
 		portRange:      true,
 		platform:       true,
 		listenOnSocket: true,
-		extensions:     []string{pythonExtension, jupyterExtension, databricksExtension},
+		extensions:     getIDE(ide).DefaultExtensions,
 	}
 	if !autoApprove {
 		shouldCreate, err := promptUserForUpdate(ctx, ide, connectionName, missing)
@@ -306,6 +350,34 @@ func subKeyOp(v *hujson.Value, key, subKey, value string) patchOp {
 	return patchOp{"add", jsonPtr(key, subKey), value}
 }
 
+// existingExtensions returns the current defaultExtensions array values with any
+// entry in remove stripped out, preserving order.
+func existingExtensions(v *hujson.Value, remove []string) []string {
+	removeSet := make(map[string]bool, len(remove))
+	for _, ext := range remove {
+		removeSet[ext] = true
+	}
+	found := v.Find(jsonPtr(defaultExtensionsKey))
+	if found == nil {
+		return nil
+	}
+	arr, ok := found.Value.(*hujson.Array)
+	if !ok {
+		return nil
+	}
+	var kept []string
+	for _, el := range arr.Elements {
+		lit, ok := el.Value.(hujson.Literal)
+		if !ok {
+			continue
+		}
+		if s := lit.String(); !removeSet[s] {
+			kept = append(kept, s)
+		}
+	}
+	return kept
+}
+
 func updateSettings(v *hujson.Value, connectionName string, missing *missingSettings) error {
 	var ops []patchOp
 	if missing.portRange {
@@ -317,11 +389,19 @@ func updateSettings(v *hujson.Value, connectionName string, missing *missingSett
 	if missing.listenOnSocket {
 		ops = append(ops, patchOp{"add", jsonPtr(listenOnSocketKey), true})
 	}
-	if len(missing.extensions) > 0 {
+	if len(missing.extensions) > 0 || len(missing.extensionsToRemove) > 0 {
 		parent := jsonPtr(defaultExtensionsKey)
-		if v.Find(parent) == nil {
+		switch {
+		case v.Find(parent) == nil:
+			// No array yet — create it with the required extensions.
 			ops = append(ops, patchOp{"add", parent, missing.extensions})
-		} else {
+		case len(missing.extensionsToRemove) > 0:
+			// Rebuild the array so incompatible entries are stripped. Replacing
+			// the whole array (rather than index-based removes) avoids shifting
+			// indices when dropping multiple elements.
+			desired := append(existingExtensions(v, missing.extensionsToRemove), missing.extensions...)
+			ops = append(ops, patchOp{"add", parent, desired})
+		default:
 			for _, ext := range missing.extensions {
 				ops = append(ops, patchOp{"add", parent + "/-", ext})
 			}
@@ -338,7 +418,7 @@ func updateSettings(v *hujson.Value, connectionName string, missing *missingSett
 }
 
 func saveSettings(path string, v *hujson.Value) error {
-	if err := os.WriteFile(path, v.Pack(), 0o600); err != nil {
+	if err := atomicfile.Write(path, v.Pack(), 0o600); err != nil {
 		return fmt.Errorf("failed to write settings file: %w", err)
 	}
 	return nil
@@ -349,7 +429,7 @@ func GetManualInstructions(ide, connectionName string) string {
 		portRange:      true,
 		platform:       true,
 		listenOnSocket: true,
-		extensions:     []string{pythonExtension, jupyterExtension, databricksExtension},
+		extensions:     getIDE(ide).DefaultExtensions,
 	}
 	return fmt.Sprintf(
 		"To ensure the remote connection works as expected, manually add these settings to your %s settings.json:\n%s",
diff --git a/experimental/ssh/internal/vscode/settings_test.go b/experimental/ssh/internal/vscode/settings_test.go
index bffe076993d..9ec36ec7364 100644
--- a/experimental/ssh/internal/vscode/settings_test.go
+++ b/experimental/ssh/internal/vscode/settings_test.go
@@ -205,14 +205,14 @@ func TestValidateSettings_Complete(t *testing.T) {
 		"remote.SSH.defaultExtensions": ["ms-python.python", "ms-toolsai.jupyter", "databricks.databricks"]
 	}`)
 
-	missing := validateSettings(v, "test-conn")
+	missing := validateSettings(v, "test-conn", VSCodeOption)
 	assert.True(t, missing.isEmpty())
 }
 
 func TestValidateSettings_Missing(t *testing.T) {
 	v := parseTestValue(t, `{}`)
 
-	missing := validateSettings(v, "test-conn")
+	missing := validateSettings(v, "test-conn", VSCodeOption)
 	assert.False(t, missing.isEmpty())
 	assert.True(t, missing.portRange)
 	assert.True(t, missing.platform)
@@ -226,7 +226,7 @@ func TestValidateSettings_IncorrectValues(t *testing.T) {
 		"remote.SSH.defaultExtensions": ["ms-python.python"]
 	}`)
 
-	missing := validateSettings(v, "test-conn")
+	missing := validateSettings(v, "test-conn", VSCodeOption)
 	assert.False(t, missing.isEmpty())
 	assert.True(t, missing.portRange)
 	assert.True(t, missing.platform)
@@ -241,7 +241,30 @@ func TestValidateSettings_DuplicateExtensionsNotReported(t *testing.T) {
 		"remote.SSH.defaultExtensions": ["ms-python.python", "ms-python.python", "ms-toolsai.jupyter", "databricks.databricks"]
 	}`)
 
-	missing := validateSettings(v, "test-conn")
+	missing := validateSettings(v, "test-conn", VSCodeOption)
+	assert.True(t, missing.isEmpty())
+}
+
+func TestValidateSettings_CursorExcludesRemappedExtensions(t *testing.T) {
+	// Cursor's marketplace remaps ms-python.python -> anysphere.python, which hangs
+	// the remote auto-install (DECO-27339). For Cursor we only seed the Databricks
+	// extension, so an empty settings file should report just that as missing.
+	v := parseTestValue(t, `{}`)
+
+	missing := validateSettings(v, "test-conn", CursorOption)
+	assert.Equal(t, []string{"databricks.databricks"}, missing.extensions)
+}
+
+func TestValidateSettings_CursorComplete(t *testing.T) {
+	// For Cursor, having only the Databricks extension seeded is sufficient.
+	v := parseTestValue(t, `{
+		"remote.SSH.serverPickPortsFromRange": {"test-conn": "29500-29505"},
+		"remote.SSH.remotePlatform": {"test-conn": "linux"},
+		"remote.SSH.remoteServerListenOnSocket": true,
+		"remote.SSH.defaultExtensions": ["databricks.databricks"]
+	}`)
+
+	missing := validateSettings(v, "test-conn", CursorOption)
 	assert.True(t, missing.isEmpty())
 }
 
@@ -253,7 +276,7 @@ func TestValidateSettings_MissingConnection(t *testing.T) {
 	}`)
 
 	// Validating for a different connection should show port and platform as missing
-	missing := validateSettings(v, "test-conn")
+	missing := validateSettings(v, "test-conn", VSCodeOption)
 	assert.False(t, missing.isEmpty())
 	assert.True(t, missing.portRange)
 	assert.True(t, missing.platform)
@@ -396,6 +419,72 @@ func TestUpdateSettings_MergeExtensions(t *testing.T) {
 	assert.Contains(t, exts, "ms-toolsai.jupyter")
 }
 
+func TestValidateSettings_CursorStripsIncompatibleExtensions(t *testing.T) {
+	// A user who ran an older CLI build still has the remapped extensions in their
+	// Cursor settings; validateSettings must flag them for removal (DECO-27339).
+	v := parseTestValue(t, `{
+		"remote.SSH.serverPickPortsFromRange": {"test-conn": "29500-29505"},
+		"remote.SSH.remotePlatform": {"test-conn": "linux"},
+		"remote.SSH.remoteServerListenOnSocket": true,
+		"remote.SSH.defaultExtensions": ["ms-python.python", "ms-toolsai.jupyter", "databricks.databricks"]
+	}`)
+
+	missing := validateSettings(v, "test-conn", CursorOption)
+	assert.False(t, missing.isEmpty())
+	assert.Empty(t, missing.extensions) // databricks.databricks already present
+	assert.ElementsMatch(t, []string{"ms-python.python", "ms-toolsai.jupyter"}, missing.extensionsToRemove)
+}
+
+func TestValidateSettings_VSCodeKeepsAllExtensions(t *testing.T) {
+	// VS Code handles these extensions fine, so nothing should be stripped.
+	v := parseTestValue(t, `{
+		"remote.SSH.serverPickPortsFromRange": {"test-conn": "29500-29505"},
+		"remote.SSH.remotePlatform": {"test-conn": "linux"},
+		"remote.SSH.remoteServerListenOnSocket": true,
+		"remote.SSH.defaultExtensions": ["ms-python.python", "ms-toolsai.jupyter", "databricks.databricks"]
+	}`)
+
+	missing := validateSettings(v, "test-conn", VSCodeOption)
+	assert.True(t, missing.isEmpty())
+	assert.Empty(t, missing.extensionsToRemove)
+}
+
+func TestUpdateSettings_StripIncompatibleExtensions(t *testing.T) {
+	v := parseTestValue(t, `{
+		"remote.SSH.defaultExtensions": ["ms-python.python", "ms-toolsai.jupyter", "databricks.databricks", "other.extension"]
+	}`)
+
+	missing := &missingSettings{
+		extensionsToRemove: []string{"ms-python.python", "ms-toolsai.jupyter"},
+	}
+
+	err := updateSettings(&v, "test-conn", missing)
+	require.NoError(t, err)
+
+	exts := findStringSlice(t, v, jsonPtr(defaultExtensionsKey))
+	assert.ElementsMatch(t, []string{"databricks.databricks", "other.extension"}, exts)
+	assert.NotContains(t, exts, "ms-python.python")
+	assert.NotContains(t, exts, "ms-toolsai.jupyter")
+}
+
+func TestUpdateSettings_StripAndAddExtensions(t *testing.T) {
+	// Strip the remapped entries and add the missing required one in one update.
+	v := parseTestValue(t, `{
+		"remote.SSH.defaultExtensions": ["ms-python.python", "ms-toolsai.jupyter"]
+	}`)
+
+	missing := &missingSettings{
+		extensions:         []string{"databricks.databricks"},
+		extensionsToRemove: []string{"ms-python.python", "ms-toolsai.jupyter"},
+	}
+
+	err := updateSettings(&v, "test-conn", missing)
+	require.NoError(t, err)
+
+	exts := findStringSlice(t, v, jsonPtr(defaultExtensionsKey))
+	assert.Equal(t, []string{"databricks.databricks"}, exts)
+}
+
 func TestUpdateSettings_PartialUpdate(t *testing.T) {
 	v := parseTestValue(t, `{
 		"remote.SSH.serverPickPortsFromRange": {"test-conn": "29500-29505"},
@@ -622,6 +711,9 @@ func TestGetManualInstructions_Cursor(t *testing.T) {
 	assert.Contains(t, instructions, "my-connection")
 	assert.Contains(t, instructions, "29500-29505")
 	assert.Contains(t, instructions, "linux")
-	assert.Contains(t, instructions, "ms-python.python")
-	assert.Contains(t, instructions, "ms-toolsai.jupyter")
+	assert.Contains(t, instructions, "databricks.databricks")
+	// Cursor remaps ms-python.python -> anysphere.python and hangs the remote
+	// auto-install (DECO-27339), so we must NOT seed these for Cursor.
+	assert.NotContains(t, instructions, "ms-python.python")
+	assert.NotContains(t, instructions, "ms-toolsai.jupyter")
 }
diff --git a/experimental/ssh/internal/workspace/workspace.go b/experimental/ssh/internal/workspace/workspace.go
index 2f017cbae12..c67adb6bac4 100644
--- a/experimental/ssh/internal/workspace/workspace.go
+++ b/experimental/ssh/internal/workspace/workspace.go
@@ -10,6 +10,7 @@ import (
 
 	"github.com/databricks/cli/libs/filer"
 	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/service/iam"
 )
 
 const metadataFileName = "metadata.json"
@@ -18,10 +19,18 @@ type WorkspaceMetadata struct {
 	Port int `json:"port"`
 	// ClusterID is required for Driver Proxy websocket connections (for any compute type, including serverless)
 	ClusterID string `json:"cluster_id,omitempty"`
+	// UsagePolicyID records the usage policy the server's job was submitted with, so a
+	// reconnect can tell whether a running server matches the requested usage policy.
+	UsagePolicyID string `json:"usage_policy_id,omitempty"`
+	// KeepDetachedProcesses records whether the server's bootstrap notebook will hold the job
+	// run open for detached processes after the server exits (--keep-detached-processes), so a
+	// reconnect can tell whether a running server honours the requested mode. False, and so
+	// absent, when the session did not ask for it.
+	KeepDetachedProcesses bool `json:"keep_detached_processes,omitempty"`
 }
 
 func getWorkspaceRootDir(ctx context.Context, client *databricks.WorkspaceClient) (string, error) {
-	me, err := client.CurrentUser.Me(ctx)
+	me, err := client.CurrentUser.Me(ctx, iam.MeRequest{})
 	if err != nil {
 		return "", fmt.Errorf("failed to get current user: %w", err)
 	}
diff --git a/go.mod b/go.mod
index cf6e5ebcd56..c2b8ef27741 100644
--- a/go.mod
+++ b/go.mod
@@ -1,70 +1,66 @@
 module github.com/databricks/cli
 
-go 1.25.0
+go 1.27.0
 
-toolchain go1.25.9
+toolchain go1.27.3
 
 require (
 	dario.cat/mergo v1.0.2 // BSD-3-Clause
 	github.com/BurntSushi/toml v1.6.0 // MIT
-	github.com/Masterminds/semver/v3 v3.4.0 // MIT
+	github.com/Masterminds/semver/v3 v3.5.0 // MIT
 	github.com/charmbracelet/bubbles v1.0.0 // MIT
 	github.com/charmbracelet/bubbletea v1.3.10 // MIT
 	github.com/charmbracelet/huh v1.0.0 // MIT
 	github.com/charmbracelet/lipgloss v1.1.0 // MIT
-	github.com/databricks/databricks-sdk-go v0.128.0 // Apache-2.0
+	github.com/charmbracelet/x/ansi v0.11.8 // MIT
+	github.com/databricks/databricks-sdk-go v0.189.0 // Apache-2.0
+	github.com/databricks/sdk-go/auth v0.1.0 // Apache-2.0
+	github.com/databricks/sdk-go/core v0.1.0 // Apache-2.0
+	github.com/databricks/sdk-go/files v0.1.0 // Apache-2.0
+	github.com/databricks/sdk-go/options v0.1.0 // Apache-2.0
 	github.com/google/jsonschema-go v0.4.3 // MIT
-	github.com/google/uuid v1.6.0 // BSD-3-Clause
 	github.com/gorilla/websocket v1.5.3 // BSD-2-Clause
-	github.com/hashicorp/go-version v1.9.0 // MPL-2.0
-	github.com/hashicorp/hc-install v0.9.3 // MPL-2.0
-	github.com/hashicorp/terraform-exec v0.25.0 // MPL-2.0
-	github.com/hashicorp/terraform-json v0.27.2 // MPL-2.0
 	github.com/hexops/gotextdiff v1.0.3 // BSD-3-Clause
-	github.com/jackc/pgx/v5 v5.9.2 // MIT
-	github.com/manifoldco/promptui v0.9.0 // BSD-3-Clause
-	github.com/mattn/go-isatty v0.0.21 // MIT
+	github.com/jackc/pgx/v5 v5.11.0 // MIT
+	github.com/klauspost/pgzip v1.2.7 // MIT
+	github.com/mattn/go-isatty v0.0.24 // MIT
+	github.com/muesli/termenv v0.16.0 // MIT
 	github.com/palantir/pkg/yamlpatch v1.5.0 // BSD-3-Clause
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // BSD-2-Clause
 	github.com/quasilyte/go-ruleguard/dsl v0.3.22 // BSD-3-Clause
 	github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 // MIT
 	github.com/spf13/cobra v1.10.2 // Apache-2.0
 	github.com/spf13/pflag v1.0.10 // BSD-3-Clause
-	github.com/stretchr/testify v1.11.1 // MIT
+	github.com/stretchr/testify v1.12.1 // MIT
 	github.com/tailscale/hujson v0.0.0-20250605163823-992244df8c5a // BSD-3-Clause
 	github.com/zalando/go-keyring v0.2.8 // MIT
-	go.yaml.in/yaml/v3 v3.0.4 // MIT AND Apache-2.0
-	golang.org/x/crypto v0.50.0 // BSD-3-Clause
-	golang.org/x/mod v0.35.0 // BSD-3-Clause
-	golang.org/x/oauth2 v0.36.0 // BSD-3-Clause
-	golang.org/x/sync v0.20.0 // BSD-3-Clause
-	golang.org/x/sys v0.43.0 // BSD-3-Clause
-	golang.org/x/text v0.36.0 // BSD-3-Clause
-	gopkg.in/ini.v1 v1.67.1 // Apache-2.0
+	go.yaml.in/yaml/v3 v3.0.5 // MIT AND Apache-2.0
+	golang.org/x/crypto v0.57.0 // BSD-3-Clause
+	golang.org/x/mod v0.41.0 // BSD-3-Clause
+	golang.org/x/net v0.60.0 // BSD-3-Clause
+	golang.org/x/oauth2 v0.37.0 // BSD-3-Clause
+	golang.org/x/sync v0.24.0 // BSD-3-Clause
+	golang.org/x/sys v0.48.0 // BSD-3-Clause
+	golang.org/x/term v0.46.0 // BSD-3-Clause
+	golang.org/x/text v0.42.0 // BSD-3-Clause
+	gopkg.in/ini.v1 v1.67.3 // Apache-2.0
 )
 
 require (
-	cloud.google.com/go/auth v0.18.1 // indirect
+	cloud.google.com/go/auth v0.18.2 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
 	cloud.google.com/go/compute/metadata v0.9.0 // indirect
-	github.com/ProtonMail/go-crypto v1.3.0 // indirect
-	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
 	github.com/atotto/clipboard v0.1.4 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/catppuccin/go v0.3.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/charmbracelet/colorprofile v0.4.1 // indirect
-	github.com/charmbracelet/x/ansi v0.11.6 // indirect
 	github.com/charmbracelet/x/cellbuf v0.0.15 // indirect
 	github.com/charmbracelet/x/exp/strings v0.0.0-20240722160745-212f7b056ed0 // indirect
 	github.com/charmbracelet/x/term v0.2.2 // indirect
-	github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e // indirect
-	github.com/clipperhouse/displaywidth v0.9.0 // indirect
-	github.com/clipperhouse/stringish v0.1.1 // indirect
-	github.com/clipperhouse/uax29/v2 v2.5.0 // indirect
-	github.com/cloudflare/circl v1.6.3 // indirect
+	github.com/clipperhouse/displaywidth v0.11.0 // indirect
+	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
 	github.com/danieljoos/wincred v1.2.3 // indirect
-	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
@@ -73,38 +69,33 @@ require (
 	github.com/godbus/dbus/v5 v5.2.2 // indirect
 	github.com/google/go-querystring v1.2.0 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
+	github.com/google/uuid v1.6.0 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.11 // indirect
 	github.com/googleapis/gax-go/v2 v2.17.0 // indirect
-	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
-	github.com/lucasb-eyer/go-colorful v1.3.0 // indirect
-	github.com/mattn/go-colorable v0.1.14 // indirect
+	github.com/klauspost/compress v1.20.1 // indirect
+	github.com/lucasb-eyer/go-colorful v1.4.0 // indirect
 	github.com/mattn/go-localereader v0.0.1 // indirect
-	github.com/mattn/go-runewidth v0.0.19 // indirect
+	github.com/mattn/go-runewidth v0.0.24 // indirect
 	github.com/mitchellh/hashstructure/v2 v2.0.2 // indirect
 	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
-	github.com/muesli/termenv v0.16.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
-	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
-	github.com/stretchr/objx v0.5.2 // indirect
+	github.com/stretchr/objx v0.5.3 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
-	github.com/zclconf/go-cty v1.17.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 // indirect
-	go.opentelemetry.io/otel v1.43.0 // indirect
-	go.opentelemetry.io/otel/metric v1.43.0 // indirect
-	go.opentelemetry.io/otel/trace v1.43.0 // indirect
+	go.opentelemetry.io/otel v1.44.0 // indirect
+	go.opentelemetry.io/otel/metric v1.44.0 // indirect
+	go.opentelemetry.io/otel/trace v1.44.0 // indirect
 	golang.org/x/exp v0.0.0-20240222234643-814bf88cf225 // indirect
-	golang.org/x/net v0.52.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
 	google.golang.org/api v0.265.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260203192932-546029d2fa20 // indirect
-	google.golang.org/grpc v1.79.3 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
+	google.golang.org/grpc v1.83.2 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
diff --git a/go.sum b/go.sum
index b9b3843e667..bba164c3a69 100644
--- a/go.sum
+++ b/go.sum
@@ -1,5 +1,5 @@
-cloud.google.com/go/auth v0.18.1 h1:IwTEx92GFUo2pJ6Qea0EU3zYvKnTAeRCODxfA/G5UWs=
-cloud.google.com/go/auth v0.18.1/go.mod h1:GfTYoS9G3CWpRA3Va9doKN9mjPGRS+v41jmZAhBzbrA=
+cloud.google.com/go/auth v0.18.2 h1:+Nbt5Ev0xEqxlNjd6c+yYUeosQ5TtEUaNcN/3FozlaM=
+cloud.google.com/go/auth v0.18.2/go.mod h1:xD+oY7gcahcu7G2SG2DsBerfFxgPAJz17zz2joOFF3M=
 cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
 cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
 cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
@@ -10,14 +10,8 @@ github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk
 github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/MakeNowJust/heredoc v1.0.0 h1:cXCdzVdstXyiTqTvfqk9SDHpKNjxuom+DOlyEeQ4pzQ=
 github.com/MakeNowJust/heredoc v1.0.0/go.mod h1:mG5amYoWBHf8vpLOuehzbGGw0EHxpZZ6lCpQ4fNJ8LE=
-github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
-github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
-github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
-github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
-github.com/ProtonMail/go-crypto v1.3.0 h1:ILq8+Sf5If5DCpHQp4PbZdS1J7HDFRXz/+xKBiRGFrw=
-github.com/ProtonMail/go-crypto v1.3.0/go.mod h1:9whxjD8Rbs29b4XWbB8irEcE8KHMqaR2e7GWU1R+/PE=
-github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew1u1fNQOlOtuGxQY=
-github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4=
+github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE=
+github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/atotto/clipboard v0.1.4 h1:EH0zSVneZPSuFR11BlR9YppQTVDbh5+16AmcJi4g1z4=
 github.com/atotto/clipboard v0.1.4/go.mod h1:ZY9tmq7sm5xIbd9bOK4onWV4S6X0u6GY7Vn0Yu86PYI=
 github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=
@@ -38,8 +32,8 @@ github.com/charmbracelet/huh v1.0.0 h1:wOnedH8G4qzJbmhftTqrpppyqHakl/zbbNdXIWJyI
 github.com/charmbracelet/huh v1.0.0/go.mod h1:5YVc+SlZ1IhQALxRPpkGwwEKftN/+OlJlnJYlDRFqN4=
 github.com/charmbracelet/lipgloss v1.1.0 h1:vYXsiLHVkK7fp74RkV7b2kq9+zDLoEU4MZoFqR/noCY=
 github.com/charmbracelet/lipgloss v1.1.0/go.mod h1:/6Q8FR2o+kj8rz4Dq0zQc3vYf7X+B0binUUBwA0aL30=
-github.com/charmbracelet/x/ansi v0.11.6 h1:GhV21SiDz/45W9AnV2R61xZMRri5NlLnl6CVF7ihZW8=
-github.com/charmbracelet/x/ansi v0.11.6/go.mod h1:2JNYLgQUsyqaiLovhU2Rv/pb8r6ydXKS3NIttu3VGZQ=
+github.com/charmbracelet/x/ansi v0.11.8 h1:JMFwp0CgDC2+jcOB162HH5k7I3FVbgFSMMYg7dSPBQQ=
+github.com/charmbracelet/x/ansi v0.11.8/go.mod h1:ZNN+3mXny/516oTQPLMPIBeSINvNJJQ8uQXDgbeJxY0=
 github.com/charmbracelet/x/cellbuf v0.0.15 h1:ur3pZy0o6z/R7EylET877CBxaiE1Sp1GMxoFPAIztPI=
 github.com/charmbracelet/x/cellbuf v0.0.15/go.mod h1:J1YVbR7MUuEGIFPCaaZ96KDl5NoS0DAWkskup+mOY+Q=
 github.com/charmbracelet/x/conpty v0.1.0 h1:4zc8KaIcbiL4mghEON8D72agYtSeIgq8FSThSPQIb+U=
@@ -56,48 +50,33 @@ github.com/charmbracelet/x/termios v0.1.1 h1:o3Q2bT8eqzGnGPOYheoYS8eEleT5ZVNYNy8
 github.com/charmbracelet/x/termios v0.1.1/go.mod h1:rB7fnv1TgOPOyyKRJ9o+AsTU/vK5WHJ2ivHeut/Pcwo=
 github.com/charmbracelet/x/xpty v0.1.2 h1:Pqmu4TEJ8KeA9uSkISKMU3f+C1F6OGBn8ABuGlqCbtI=
 github.com/charmbracelet/x/xpty v0.1.2/go.mod h1:XK2Z0id5rtLWcpeNiMYBccNNBrP2IJnzHI0Lq13Xzq4=
-github.com/chzyer/logex v1.1.10 h1:Swpa1K6QvQznwJRcfTfQJmTE72DqScAa40E+fbHEXEE=
-github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
-github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e h1:fY5BOSpyZCqRo5OhCuC+XN+r/bBCmeuuJtjz+bCNIf8=
-github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
-github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1 h1:q763qf9huN11kDQavWsoZXJNW3xEE4JJyHa5Q25/sd8=
-github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
-github.com/clipperhouse/displaywidth v0.9.0 h1:Qb4KOhYwRiN3viMv1v/3cTBlz3AcAZX3+y9OLhMtAtA=
-github.com/clipperhouse/displaywidth v0.9.0/go.mod h1:aCAAqTlh4GIVkhQnJpbL0T/WfcrJXHcj8C0yjYcjOZA=
-github.com/clipperhouse/stringish v0.1.1 h1:+NSqMOr3GR6k1FdRhhnXrLfztGzuG+VuFDfatpWHKCs=
-github.com/clipperhouse/stringish v0.1.1/go.mod h1:v/WhFtE1q0ovMta2+m+UbpZ+2/HEXNWYXQgCt4hdOzA=
-github.com/clipperhouse/uax29/v2 v2.5.0 h1:x7T0T4eTHDONxFJsL94uKNKPHrclyFI0lm7+w94cO8U=
-github.com/clipperhouse/uax29/v2 v2.5.0/go.mod h1:Wn1g7MK6OoeDT0vL+Q0SQLDz/KpfsVRgg6W7ihQeh4g=
-github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8=
-github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4=
+github.com/clipperhouse/displaywidth v0.11.0 h1:lBc6kY44VFw+TDx4I8opi/EtL9m20WSEFgwIwO+UVM8=
+github.com/clipperhouse/displaywidth v0.11.0/go.mod h1:bkrFNkf81G8HyVqmKGxsPufD3JhNl3dSqnGhOoSD/o0=
+github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=
+github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
 github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
-github.com/cyphar/filepath-securejoin v0.4.1 h1:JyxxyPEaktOD+GAnqIqTf9A8tHyAG22rowi7HkoSU1s=
-github.com/cyphar/filepath-securejoin v0.4.1/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGLDGQL7h7bg04C/+u9jI=
 github.com/danieljoos/wincred v1.2.3 h1:v7dZC2x32Ut3nEfRH+vhoZGvN72+dQ/snVXo/vMFLdQ=
 github.com/danieljoos/wincred v1.2.3/go.mod h1:6qqX0WNrS4RzPZ1tnroDzq9kY3fu1KwE7MRLQK4X0bs=
-github.com/databricks/databricks-sdk-go v0.128.0 h1:4aGI3KkSZHDkxNIgwQL6dn6q6zZKcgyckidcQZNDGGo=
-github.com/databricks/databricks-sdk-go v0.128.0/go.mod h1:C5LNgGe6hGuRrTwoxFmuup3XtQQEaqtq0e+K8IFDIS4=
+github.com/databricks/databricks-sdk-go v0.189.0 h1:ayn+g67dGFl/LTxsg3bbrHZAslX9CJrdttQQjK0gDg4=
+github.com/databricks/databricks-sdk-go v0.189.0/go.mod h1:udBw6nxkaqa0fgPQ7ZW1kGFkltQncYx+qFJeVFmxtz8=
+github.com/databricks/sdk-go/auth v0.1.0 h1:NZyXdvKE1fX72/4EQbiX3AhfUI63wyPJhFCdZp35L2A=
+github.com/databricks/sdk-go/auth v0.1.0/go.mod h1:eNJdFzBAfu1y32a3wPcTnjaUkjhS9VfyCNblKFPIPEo=
+github.com/databricks/sdk-go/core v0.1.0 h1:ZolzW/KVIJy1xXQ0zTsu/QYsEB4vQAEApbbq4D3RGHc=
+github.com/databricks/sdk-go/core v0.1.0/go.mod h1:7Ckau34bOsaZhHJE6r7ORNa+/kO33jIs6DfrJL6UbsM=
+github.com/databricks/sdk-go/files v0.1.0 h1:sTcGI3cY4xrLij6OPs0B8jACmrCCnTaMyuAKbbSZGz8=
+github.com/databricks/sdk-go/files v0.1.0/go.mod h1:sY+6aLUJFG5wKLbqfsdQwvlgPWoxRVbI+eEb9IPi8ds=
+github.com/databricks/sdk-go/options v0.1.0 h1:L2MPoVmz7lIB/g+7HZouJPtgZUuFSO4C59yGVgsPooA=
+github.com/databricks/sdk-go/options v0.1.0/go.mod h1:vYJEKM0XxyUduTG8aKBkjLSjEcI2z2Ijwq+ESNoUwrs=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
-github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
-github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
 github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f h1:Y/CXytFA4m6baUTXGLOoWe4PQhGxaX0KpnayAqC48p4=
 github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f/go.mod h1:vw97MGsxSvLiUE2X8qFplwetxpGLQrlU1Q9AUEIzCaM=
-github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM=
-github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
-github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
-github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
-github.com/go-git/go-billy/v5 v5.6.2 h1:6Q86EsPXMa7c3YZ3aLAQsMA0VlWmy43r6FHqa/UNbRM=
-github.com/go-git/go-billy/v5 v5.6.2/go.mod h1:rcFC2rAsp/erv7CMz9GczHcuD0D32fWzH+MJAU+jaUU=
-github.com/go-git/go-git/v5 v5.16.5 h1:mdkuqblwr57kVfXri5TTH+nMFLNUxIj9Z7F5ykFbw5s=
-github.com/go-git/go-git/v5 v5.16.5/go.mod h1:QOMLpNf1qxuSY4StA/ArOdfFR2TrKEjJiye2kel2m+M=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
@@ -105,8 +84,6 @@ github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ=
 github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c=
-github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ=
-github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
@@ -126,20 +103,6 @@ github.com/googleapis/gax-go/v2 v2.17.0 h1:RksgfBpxqff0EZkDWYuz9q/uWsTVz+kf43LsZ
 github.com/googleapis/gax-go/v2 v2.17.0/go.mod h1:mzaqghpQp4JDh3HvADwrat+6M3MOIDp5YKHhb9PAgDY=
 github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
 github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
-github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
-github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
-github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
-github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
-github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48=
-github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
-github.com/hashicorp/go-version v1.9.0 h1:CeOIz6k+LoN3qX9Z0tyQrPtiB1DFYRPfCIBtaXPSCnA=
-github.com/hashicorp/go-version v1.9.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
-github.com/hashicorp/hc-install v0.9.3 h1:1H4dgmgzxEVwT6E/d/vIL5ORGVKz9twRwDw+qA5Hyho=
-github.com/hashicorp/hc-install v0.9.3/go.mod h1:FQlQ5I3I/X409N/J1U4pPeQQz1R3BoV0IysB7aiaQE0=
-github.com/hashicorp/terraform-exec v0.25.0 h1:Bkt6m3VkJqYh+laFMrWIpy9KHYFITpOyzRMNI35rNaY=
-github.com/hashicorp/terraform-exec v0.25.0/go.mod h1:dl9IwsCfklDU6I4wq9/StFDp7dNbH/h5AnfS1RmiUl8=
-github.com/hashicorp/terraform-json v0.27.2 h1:BwGuzM6iUPqf9JYM/Z4AF1OJ5VVJEEzoKST/tRDBJKU=
-github.com/hashicorp/terraform-json v0.27.2/go.mod h1:GzPLJ1PLdUG5xL6xn1OXWIjteQRT2CNT9o/6A9mi9hE=
 github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
 github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
@@ -148,30 +111,26 @@ github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsI
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
-github.com/jackc/pgx/v5 v5.9.2 h1:3ZhOzMWnR4yJ+RW1XImIPsD1aNSz4T4fyP7zlQb56hw=
-github.com/jackc/pgx/v5 v5.9.2/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4=
+github.com/jackc/pgx/v5 v5.11.0 h1:IzBBtyK9AHqf98cctWFifYSci2hgQR/cd56wB4p+ogg=
+github.com/jackc/pgx/v5 v5.11.0/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4=
 github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
 github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
-github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
-github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
-github.com/kevinburke/ssh_config v1.2.0 h1:x584FjTGwHzMwvHx18PXxbBVzfnxogHaAReU4gf13a4=
-github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
+github.com/klauspost/compress v1.20.1 h1:T7kKElXUMXrUJ2E9QhQhxFtcK5rPyLdsGZvdbLMPdiQ=
+github.com/klauspost/compress v1.20.1/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
+github.com/klauspost/pgzip v1.2.7 h1:02QB3Ttao6zOWDnSsv3bIvjN24bX0eGjWniQ8vuBfkA=
+github.com/klauspost/pgzip v1.2.7/go.mod h1:g7E6NrOKHOzah4QwK6Ue1tNCJs8IDiNOfjiXTr85U2E=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/lucasb-eyer/go-colorful v1.3.0 h1:2/yBRLdWBZKrf7gB40FoiKfAWYQ0lqNcbuQwVHXptag=
-github.com/lucasb-eyer/go-colorful v1.3.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
-github.com/manifoldco/promptui v0.9.0 h1:3V4HzJk1TtXW1MTZMP7mdlwbBpIinw3HztaIlYthEiA=
-github.com/manifoldco/promptui v0.9.0/go.mod h1:ka04sppxSGFAtxX0qhlYQjISsg9mR4GWtQEhdbn6Pgg=
-github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
-github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.21 h1:xYae+lCNBP7QuW4PUnNG61ffM4hVIfm+zUzDuSzYLGs=
-github.com/mattn/go-isatty v0.0.21/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4=
+github.com/lucasb-eyer/go-colorful v1.4.0 h1:UtrWVfLdarDgc44HcS7pYloGHJUjHV/4FwW4TvVgFr4=
+github.com/lucasb-eyer/go-colorful v1.4.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/mattn/go-localereader v0.0.1 h1:ygSAOl7ZXTx4RdPYinUpg6W99U8jWvWi9Ye2JC/oIi4=
 github.com/mattn/go-localereader v0.0.1/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+EiG4R1k4Cjx5p88=
-github.com/mattn/go-runewidth v0.0.19 h1:v++JhqYnZuu5jSKrk9RbgF5v4CGUjqRfBm05byFGLdw=
-github.com/mattn/go-runewidth v0.0.19/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
+github.com/mattn/go-runewidth v0.0.24 h1:cpokDiIn0MGnhdHwuWnJBITySJ20QyNGnY2kR/ay2DU=
+github.com/mattn/go-runewidth v0.0.24/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
 github.com/mitchellh/hashstructure/v2 v2.0.2 h1:vGKWl0YJqUNxE8d+h8f6NJLcCJrgbhC4NcD46KavDd4=
 github.com/mitchellh/hashstructure/v2 v2.0.2/go.mod h1:MG3aRVU/N29oo/V/IhBX8GR/zz4kQkprJgF2EVszyDE=
 github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 h1:ZK8zHtRHOkbHy6Mmr5D264iyp3TiX5OmNcI5cIARiQI=
@@ -182,13 +141,10 @@ github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc
 github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk=
 github.com/palantir/pkg/yamlpatch v1.5.0 h1:186RUlcHFVf64onUhaI7nUCPzPIaRTQ5HJlKuv0d6NM=
 github.com/palantir/pkg/yamlpatch v1.5.0/go.mod h1:45cYAIiv9E0MiZnHjIIT2hGqi6Wah/DL6J1omJf2ny0=
-github.com/pjbgf/sha1cd v0.3.2 h1:a9wb0bp1oC2TGwStyn0Umc/IGKQnEgF0vVaZ8QF8eo4=
-github.com/pjbgf/sha1cd v0.3.2/go.mod h1:zQWigSxVmsHEZow5qaLtPYxpcKMMQpa09ixqBxuCS6A=
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/quasilyte/go-ruleguard/dsl v0.3.22 h1:wd8zkOhSNr+I+8Qeciml08ivDt1pSXe60+5DqOpCjPE=
 github.com/quasilyte/go-ruleguard/dsl v0.3.22/go.mod h1:KeCP03KrjuSO0H1kTuZQCWlQPulDV6YMIXmpQss17rU=
@@ -199,10 +155,6 @@ github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 h1:OkMGxebDjyw0ULyrTYWeN0UNCCkmCWfjPnIA2W6oviI=
 github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06/go.mod h1:+ePHsJ1keEjQtpvf9HHw0f4ZeJ0TLRsxhunSI2hYJSs=
-github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8=
-github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
-github.com/skeema/knownhosts v1.3.1 h1:X2osQ+RAjK76shCbvhHHHVl3ZlgDm8apHEHFqRjnBY8=
-github.com/skeema/knownhosts v1.3.1/go.mod h1:r7KTdC8l4uxWRyK2TpQZ/1o5HaSzh06ePQNxPwTcfiY=
 github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
 github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
 github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
@@ -211,84 +163,80 @@ github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3A
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4=
+github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
 github.com/tailscale/hujson v0.0.0-20250605163823-992244df8c5a h1:a6TNDN9CgG+cYjaeN8l2mc4kSz2iMiCDQxPEyltUV/I=
 github.com/tailscale/hujson v0.0.0-20250605163823-992244df8c5a/go.mod h1:EbW0wDK/qEUYI0A5bqq0C2kF8JTQwWONmGDBbzsxxHo=
-github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM=
-github.com/xanzy/ssh-agent v0.3.3/go.mod h1:6dzNDKs0J9rVPHPhaGCukekBHKqfl+L3KghI1Bc68Uw=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
 github.com/zalando/go-keyring v0.2.8 h1:6sD/Ucpl7jNq10rM2pgqTs0sZ9V3qMrqfIIy5YPccHs=
 github.com/zalando/go-keyring v0.2.8/go.mod h1:tsMo+VpRq5NGyKfxoBVjCuMrG47yj8cmakZDO5QGii0=
-github.com/zclconf/go-cty v1.17.0 h1:seZvECve6XX4tmnvRzWtJNHdscMtYEx5R7bnnVyd/d0=
-github.com/zclconf/go-cty v1.17.0/go.mod h1:wqFzcImaLTI6A5HfsRwB0nj5n0MRZFwmey8YoFPPs3U=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 h1:q4XOmH/0opmeuJtPsbFNivyl7bCt7yRBbeEm2sC/XtQ=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0/go.mod h1:snMWehoOh2wsEwnvvwtDyFCxVeDAODenXHtn5vzrKjo=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 h1:CqXxU8VOmDefoh0+ztfGaymYbhdB/tT3zs79QaZTNGY=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0/go.mod h1:BuhAPThV8PBHBvg8ZzZ/Ok3idOdhWIodywz2xEcRbJo=
-go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
-go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
-go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
-go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
-go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
-go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
-go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
-go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
-go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
-go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU=
+go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc=
+go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc=
+go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo=
+go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58=
+go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0=
+go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI=
+go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA=
+go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk=
+go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
-golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
+golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
 golang.org/x/exp v0.0.0-20240222234643-814bf88cf225 h1:LfspQV/FYTatPTr/3HzIcmiUFH7PGP+OQ6mgDYo3yuQ=
 golang.org/x/exp v0.0.0-20240222234643-814bf88cf225/go.mod h1:CxmFvTBINI24O/j8iY7H1xHzx2i4OsyguNBmN/uPtqc=
-golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=
-golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
-golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
-golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
-golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
-golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.0.0-20181122145206-62eef0e2fa9b/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
+golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98=
+golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58=
+golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=
+golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
-golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
-golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
-golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
-golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE=
+golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc=
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
+golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
 golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
 golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
-gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
-gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
+gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
+gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
 google.golang.org/api v0.265.0 h1:FZvfUdI8nfmuNrE34aOWFPmLC+qRBEiNm3JdivTvAAU=
 google.golang.org/api v0.265.0/go.mod h1:uAvfEl3SLUj/7n6k+lJutcswVojHPp2Sp08jWCu8hLY=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260203192932-546029d2fa20 h1:Jr5R2J6F6qWyzINc+4AM8t5pfUz6beZpHp678GNrMbE=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260203192932-546029d2fa20/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ=
-google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE=
-google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa h1:mZHHdPZl0dbGHCflZgAq/Q468DWVFcU2whhB2KAo8fk=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU=
+google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/ini.v1 v1.67.1 h1:tVBILHy0R6e4wkYOn3XmiITt/hEVH4TFMYvAX2Ytz6k=
-gopkg.in/ini.v1 v1.67.1/go.mod h1:x/cyOwCgZqOkJoDIJ3c1KNHMo10+nLGAhh+kn3Zizss=
-gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
-gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
+gopkg.in/ini.v1 v1.67.3 h1:iM9Lhz5MRSGhHVGGwCuzG9KO8PoirCXj/m/qTmOJJQw=
+gopkg.in/ini.v1 v1.67.3/go.mod h1:x/cyOwCgZqOkJoDIJ3c1KNHMo10+nLGAhh+kn3Zizss=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/integration/README.md b/integration/README.md
index 9bcddfc54ad..0e000c4c732 100644
--- a/integration/README.md
+++ b/integration/README.md
@@ -2,6 +2,12 @@
 
 This directory contains integration tests for the project.
 
+## Deprecated: do not add tests here
+
+This tree is deprecated and should not be extended with new tests. A test here only ever runs against a real workspace, so it contributes nothing to the local suite and is only exercised when someone runs a cloud job.
+
+Write an acceptance test instead (see `acceptance/README.md`) and set `Cloud = true` in its `test.toml`. One test then covers both: it runs locally against the fake server in `libs/testserver` on every `./task test`, *and* against a real workspace when `CLOUD_ENV` is set. Existing tests here are still maintained; extend them only when there is no acceptance-test equivalent.
+
 The tree structure generally mirrors the source code tree structure.
 
 Requirements for new files in this directory:
diff --git a/integration/assumptions/dashboard_assumptions_test.go b/integration/assumptions/dashboard_assumptions_test.go
index 7d127d10bfe..111482a6f81 100644
--- a/integration/assumptions/dashboard_assumptions_test.go
+++ b/integration/assumptions/dashboard_assumptions_test.go
@@ -54,7 +54,7 @@ func TestDashboardAssumptions_WorkspaceImport(t *testing.T) {
 
 	// Cross-check consistency with the workspace object.
 	{
-		obj, err := wt.W.Workspace.GetStatusByPath(ctx, dashboard.Path) //nolint:staticcheck // Deprecated in SDK v0.127.0. Migration to WorkspaceHierarchyService tracked separately.
+		obj, err := wt.W.Workspace.GetStatusByPath(ctx, dashboard.Path)
 		require.NoError(t, err)
 
 		// Confirm that the resource ID included in the response is equal to the dashboard ID.
diff --git a/integration/bundle/generate_job_test.go b/integration/bundle/generate_job_test.go
deleted file mode 100644
index 8c51a55d407..00000000000
--- a/integration/bundle/generate_job_test.go
+++ /dev/null
@@ -1,116 +0,0 @@
-package bundle_test
-
-import (
-	"context"
-	"os"
-	"path"
-	"path/filepath"
-	"strconv"
-	"strings"
-	"testing"
-
-	"github.com/databricks/cli/integration/internal/acc"
-	"github.com/databricks/cli/internal/testcli"
-	"github.com/databricks/cli/internal/testutil"
-	"github.com/databricks/cli/libs/env"
-	"github.com/databricks/cli/libs/filer"
-	"github.com/databricks/databricks-sdk-go"
-	"github.com/databricks/databricks-sdk-go/service/compute"
-	"github.com/databricks/databricks-sdk-go/service/jobs"
-	"github.com/google/uuid"
-	"github.com/stretchr/testify/require"
-)
-
-func TestGenerateFromExistingJobAndDeploy(t *testing.T) {
-	ctx, wt := acc.WorkspaceTest(t)
-	gt := &generateJobTest{T: wt, w: wt.W}
-
-	uniqueId := uuid.New().String()
-	bundleRoot := initTestTemplate(t, ctx, "with_includes", map[string]any{
-		"unique_id": uniqueId,
-	})
-
-	jobId := gt.createTestJob(ctx)
-	t.Cleanup(func() {
-		gt.destroyJob(context.WithoutCancel(ctx), jobId)
-	})
-
-	ctx = env.Set(ctx, "BUNDLE_ROOT", bundleRoot)
-	c := testcli.NewRunner(t, ctx, "bundle", "generate", "job",
-		"--existing-job-id", strconv.FormatInt(jobId, 10),
-		"--config-dir", filepath.Join(bundleRoot, "resources"),
-		"--source-dir", filepath.Join(bundleRoot, "src"))
-	_, _, err := c.Run()
-	require.NoError(t, err)
-
-	_, err = os.Stat(filepath.Join(bundleRoot, "src", "test.py"))
-	require.NoError(t, err)
-
-	matches, err := filepath.Glob(filepath.Join(bundleRoot, "resources", "generated_job_*.yml"))
-	require.NoError(t, err)
-	require.Len(t, matches, 1)
-
-	// check the content of generated yaml
-	data, err := os.ReadFile(matches[0])
-	require.NoError(t, err)
-	generatedYaml := string(data)
-	require.Contains(t, generatedYaml, "notebook_task:")
-	require.Contains(t, generatedYaml, "notebook_path: "+filepath.Join("..", "src", "test.py"))
-	require.Contains(t, generatedYaml, "task_key: test")
-	require.Contains(t, generatedYaml, "new_cluster:")
-	require.Contains(t, generatedYaml, "spark_version: 13.3.x-scala2.12")
-	require.Contains(t, generatedYaml, "num_workers: 1")
-
-	deployBundle(t, ctx, bundleRoot)
-
-	destroyBundle(t, ctx, bundleRoot)
-}
-
-type generateJobTest struct {
-	T *acc.WorkspaceT
-	w *databricks.WorkspaceClient
-}
-
-func (gt *generateJobTest) createTestJob(ctx context.Context) int64 {
-	t := gt.T
-	w := gt.w
-
-	tmpdir := acc.TemporaryWorkspaceDir(t, "generate-job-")
-	f, err := filer.NewWorkspaceFilesClient(w, tmpdir)
-	require.NoError(t, err)
-
-	err = f.Write(ctx, "test.py", strings.NewReader("# Databricks notebook source\nprint('Hello world!'))"))
-	require.NoError(t, err)
-
-	resp, err := w.Jobs.Create(ctx, jobs.CreateJob{
-		Name: testutil.RandomName("generated-job-"),
-		Tasks: []jobs.Task{
-			{
-				TaskKey: "test",
-				NewCluster: &compute.ClusterSpec{
-					SparkVersion: "13.3.x-scala2.12",
-					NumWorkers:   1,
-					NodeTypeId:   testutil.GetCloud(t).NodeTypeID(),
-					SparkConf: map[string]string{
-						"spark.databricks.enableWsfs":                         "true",
-						"spark.databricks.hive.metastore.glueCatalog.enabled": "true",
-						"spark.databricks.pip.ignoreSSL":                      "true",
-					},
-				},
-				NotebookTask: &jobs.NotebookTask{
-					NotebookPath: path.Join(tmpdir, "test"),
-				},
-			},
-		},
-	})
-	require.NoError(t, err)
-
-	return resp.JobId
-}
-
-func (gt *generateJobTest) destroyJob(ctx context.Context, jobId int64) {
-	err := gt.w.Jobs.Delete(ctx, jobs.DeleteJob{
-		JobId: jobId,
-	})
-	require.NoError(gt.T, err)
-}
diff --git a/integration/bundle/generate_pipeline_test.go b/integration/bundle/generate_pipeline_test.go
deleted file mode 100644
index b1f68f79df9..00000000000
--- a/integration/bundle/generate_pipeline_test.go
+++ /dev/null
@@ -1,139 +0,0 @@
-package bundle_test
-
-import (
-	"context"
-	"os"
-	"path"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/databricks/cli/integration/internal/acc"
-	"github.com/databricks/cli/internal/testcli"
-	"github.com/databricks/cli/internal/testutil"
-	"github.com/databricks/cli/libs/env"
-	"github.com/databricks/cli/libs/filer"
-	"github.com/databricks/databricks-sdk-go"
-	"github.com/databricks/databricks-sdk-go/service/pipelines"
-	"github.com/google/uuid"
-	"github.com/stretchr/testify/require"
-)
-
-func TestGenerateFromExistingPipelineAndDeploy(t *testing.T) {
-	ctx, wt := acc.WorkspaceTest(t)
-	gt := &generatePipelineTest{T: wt, w: wt.W}
-
-	uniqueId := uuid.New().String()
-	bundleRoot := initTestTemplate(t, ctx, "with_includes", map[string]any{
-		"unique_id": uniqueId,
-	})
-
-	pipelineId, name := gt.createTestPipeline(ctx)
-	t.Cleanup(func() {
-		gt.destroyPipeline(context.WithoutCancel(ctx), pipelineId)
-	})
-
-	ctx = env.Set(ctx, "BUNDLE_ROOT", bundleRoot)
-	c := testcli.NewRunner(t, ctx, "bundle", "generate", "pipeline",
-		"--existing-pipeline-id", pipelineId,
-		"--config-dir", filepath.Join(bundleRoot, "resources"),
-		"--source-dir", filepath.Join(bundleRoot, "src"))
-	_, _, err := c.Run()
-	require.NoError(t, err)
-
-	_, err = os.Stat(filepath.Join(bundleRoot, "src", "notebook.py"))
-	require.NoError(t, err)
-
-	_, err = os.Stat(filepath.Join(bundleRoot, "src", "test.py"))
-	require.NoError(t, err)
-
-	matches, err := filepath.Glob(filepath.Join(bundleRoot, "resources", "generated_pipeline_*.yml"))
-	require.NoError(t, err)
-	require.Len(t, matches, 1)
-
-	// check the content of generated yaml
-	fileName := matches[0]
-	data, err := os.ReadFile(fileName)
-	require.NoError(t, err)
-	generatedYaml := string(data)
-
-	// Replace pipeline name
-	generatedYaml = strings.ReplaceAll(generatedYaml, name, testutil.RandomName("copy-generated-pipeline-"))
-	err = os.WriteFile(fileName, []byte(generatedYaml), 0o644)
-	require.NoError(t, err)
-
-	require.Contains(t, generatedYaml, "libraries:")
-	require.Contains(t, generatedYaml, "- notebook:")
-	require.Contains(t, generatedYaml, "path: "+filepath.Join("..", "src", "notebook.py"))
-	require.Contains(t, generatedYaml, "- file:")
-	require.Contains(t, generatedYaml, "path: "+filepath.Join("..", "src", "test.py"))
-
-	deployBundle(t, ctx, bundleRoot)
-
-	destroyBundle(t, ctx, bundleRoot)
-}
-
-type generatePipelineTest struct {
-	T *acc.WorkspaceT
-	w *databricks.WorkspaceClient
-}
-
-func (gt *generatePipelineTest) createTestPipeline(ctx context.Context) (string, string) {
-	t := gt.T
-	w := gt.w
-
-	tmpdir := acc.TemporaryWorkspaceDir(t, "generate-pipeline-")
-	f, err := filer.NewWorkspaceFilesClient(w, tmpdir)
-	require.NoError(t, err)
-
-	err = f.Write(ctx, "notebook.py", strings.NewReader("# Databricks notebook source\nprint('Hello world!'))"))
-	require.NoError(t, err)
-
-	err = f.Write(ctx, "test.py", strings.NewReader("print('Hello!')"))
-	require.NoError(t, err)
-
-	nodeTypeId := testutil.GetCloud(t).NodeTypeID()
-
-	name := testutil.RandomName("generated-pipeline-")
-	resp, err := w.Pipelines.Create(ctx, pipelines.CreatePipeline{
-		Name: name,
-		Libraries: []pipelines.PipelineLibrary{
-			{
-				Notebook: &pipelines.NotebookLibrary{
-					Path: path.Join(tmpdir, "notebook"),
-				},
-			},
-			{
-				File: &pipelines.FileLibrary{
-					Path: path.Join(tmpdir, "test.py"),
-				},
-			},
-		},
-		Clusters: []pipelines.PipelineCluster{
-			{
-				CustomTags: map[string]string{
-					"Tag1": "Yes",
-					"Tag2": "24X7",
-					"Tag3": "APP-1234",
-				},
-				NodeTypeId: nodeTypeId,
-				NumWorkers: 2,
-				SparkConf: map[string]string{
-					"spark.databricks.enableWsfs":                         "true",
-					"spark.databricks.hive.metastore.glueCatalog.enabled": "true",
-					"spark.databricks.pip.ignoreSSL":                      "true",
-				},
-			},
-		},
-	})
-	require.NoError(t, err)
-
-	return resp.PipelineId, name
-}
-
-func (gt *generatePipelineTest) destroyPipeline(ctx context.Context, pipelineId string) {
-	err := gt.w.Pipelines.Delete(ctx, pipelines.DeletePipelineRequest{
-		PipelineId: pipelineId,
-	})
-	require.NoError(gt.T, err)
-}
diff --git a/integration/bundle/helpers_test.go b/integration/bundle/helpers_test.go
deleted file mode 100644
index 712038d0e0f..00000000000
--- a/integration/bundle/helpers_test.go
+++ /dev/null
@@ -1,75 +0,0 @@
-package bundle_test
-
-import (
-	"context"
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"strings"
-
-	"github.com/databricks/cli/internal/testcli"
-	"github.com/databricks/cli/internal/testutil"
-	"github.com/databricks/cli/libs/cmdctx"
-	"github.com/databricks/cli/libs/cmdio"
-	"github.com/databricks/cli/libs/env"
-	"github.com/databricks/cli/libs/flags"
-	"github.com/databricks/cli/libs/template"
-	"github.com/stretchr/testify/require"
-)
-
-func initTestTemplate(t testutil.TestingT, ctx context.Context, templateName string, config map[string]any) string {
-	bundleRoot := t.TempDir()
-	return initTestTemplateWithBundleRoot(t, ctx, templateName, config, bundleRoot)
-}
-
-func initTestTemplateWithBundleRoot(t testutil.TestingT, ctx context.Context, templateName string, config map[string]any, bundleRoot string) string {
-	templateRoot := filepath.Join("bundles", templateName)
-
-	configFilePath := writeConfigFile(t, config)
-
-	ctx = cmdctx.SetWorkspaceClient(ctx, nil)
-	cmd := cmdio.NewIO(ctx, flags.OutputJSON, strings.NewReader(""), os.Stdout, os.Stderr, "", "bundles")
-	ctx = cmdio.InContext(ctx, cmd)
-
-	r := template.Resolver{
-		TemplatePathOrUrl: templateRoot,
-		ConfigFile:        configFilePath,
-		OutputDir:         bundleRoot,
-	}
-
-	tmpl, err := r.Resolve(ctx)
-	require.NoError(t, err)
-	defer tmpl.Reader.Cleanup(ctx)
-
-	err = tmpl.Writer.Materialize(ctx, tmpl.Reader)
-	require.NoError(t, err)
-
-	return bundleRoot
-}
-
-func writeConfigFile(t testutil.TestingT, config map[string]any) string {
-	bytes, err := json.Marshal(config)
-	require.NoError(t, err)
-
-	dir := t.TempDir()
-	filepath := filepath.Join(dir, "config.json")
-	t.Log("Configuration for template: ", string(bytes))
-
-	err = os.WriteFile(filepath, bytes, 0o644)
-	require.NoError(t, err)
-	return filepath
-}
-
-func deployBundle(t testutil.TestingT, ctx context.Context, path string) {
-	ctx = env.Set(ctx, "BUNDLE_ROOT", path)
-	c := testcli.NewRunner(t, ctx, "bundle", "deploy", "--force-lock", "--auto-approve")
-	_, _, err := c.Run()
-	require.NoError(t, err)
-}
-
-func destroyBundle(t testutil.TestingT, ctx context.Context, path string) {
-	ctx = env.Set(ctx, "BUNDLE_ROOT", path)
-	c := testcli.NewRunner(t, ctx, "bundle", "destroy", "--auto-approve")
-	_, _, err := c.Run()
-	require.NoError(t, err)
-}
diff --git a/integration/bundle/init_test.go b/integration/bundle/init_test.go
index 6bec010f7b1..ff8b7de2c87 100644
--- a/integration/bundle/init_test.go
+++ b/integration/bundle/init_test.go
@@ -10,6 +10,7 @@ import (
 	"github.com/databricks/cli/internal/testcli"
 	"github.com/databricks/cli/internal/testutil"
 	"github.com/databricks/cli/libs/iamutil"
+	"github.com/databricks/databricks-sdk-go/service/iam"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -25,7 +26,7 @@ func TestBundleInitHelpers(t *testing.T) {
 	ctx, wt := acc.WorkspaceTest(t)
 	w := wt.W
 
-	me, err := w.CurrentUser.Me(ctx)
+	me, err := w.CurrentUser.Me(ctx, iam.MeRequest{})
 	require.NoError(t, err)
 
 	var smallestNode string
diff --git a/integration/cmd/alerts/alerts_test.go b/integration/cmd/alerts/alerts_test.go
deleted file mode 100644
index dc40fb95ddf..00000000000
--- a/integration/cmd/alerts/alerts_test.go
+++ /dev/null
@@ -1,14 +0,0 @@
-package alerts_test
-
-import (
-	"testing"
-
-	"github.com/databricks/cli/internal/testcli"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestAlertsCreateErrWhenNoArguments(t *testing.T) {
-	ctx := t.Context()
-	_, _, err := testcli.RequireErrorRun(t, ctx, "alerts-legacy", "create")
-	assert.Equal(t, "please provide command input in JSON format by specifying the --json flag", err.Error())
-}
diff --git a/integration/cmd/api/api_test.go b/integration/cmd/api/api_test.go
deleted file mode 100644
index aa87e31e100..00000000000
--- a/integration/cmd/api/api_test.go
+++ /dev/null
@@ -1,55 +0,0 @@
-package api_test
-
-import (
-	"encoding/json"
-	"fmt"
-	"path"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	_ "github.com/databricks/cli/cmd/api"
-	"github.com/databricks/cli/internal/testcli"
-	"github.com/databricks/cli/internal/testutil"
-)
-
-func TestApiGet(t *testing.T) {
-	ctx := t.Context()
-
-	stdout, _ := testcli.RequireSuccessfulRun(t, ctx, "api", "get", "/api/2.0/preview/scim/v2/Me")
-
-	// Deserialize SCIM API response.
-	var out map[string]any
-	err := json.Unmarshal(stdout.Bytes(), &out)
-	require.NoError(t, err)
-
-	// Assert that the output somewhat makes sense for the SCIM API.
-	assert.Equal(t, true, out["active"])
-	assert.NotNil(t, out["id"])
-}
-
-func TestApiPost(t *testing.T) {
-	ctx := t.Context()
-
-	if testutil.GetCloud(t) == testutil.GCP {
-		t.Skip("DBFS REST API is disabled on gcp")
-	}
-
-	dbfsPath := path.Join("/tmp/databricks/integration", testutil.RandomName("api-post"))
-	requestPath := filepath.Join(t.TempDir(), "body.json")
-	testutil.WriteFile(t, requestPath, fmt.Sprintf(`{
-		"path": "%s"
-	}`, dbfsPath))
-
-	// Post to mkdir
-	{
-		testcli.RequireSuccessfulRun(t, ctx, "api", "post", "--json=@"+requestPath, "/api/2.0/dbfs/mkdirs")
-	}
-
-	// Post to delete
-	{
-		testcli.RequireSuccessfulRun(t, ctx, "api", "post", "--json=@"+requestPath, "/api/2.0/dbfs/delete")
-	}
-}
diff --git a/integration/cmd/auth/describe_test.go b/integration/cmd/auth/describe_test.go
deleted file mode 100644
index 1ea843b6b93..00000000000
--- a/integration/cmd/auth/describe_test.go
+++ /dev/null
@@ -1,63 +0,0 @@
-package auth_test
-
-import (
-	"path/filepath"
-	"regexp"
-	"strings"
-	"testing"
-
-	"github.com/databricks/cli/internal/testutil"
-	"github.com/databricks/cli/libs/databrickscfg"
-	"github.com/databricks/databricks-sdk-go/config"
-
-	"github.com/databricks/cli/internal/testcli"
-	"github.com/databricks/databricks-sdk-go"
-	"github.com/stretchr/testify/require"
-)
-
-func TestAuthDescribeSuccess(t *testing.T) {
-	ctx := t.Context()
-	stdout, _ := testcli.RequireSuccessfulRun(t, ctx, "auth", "describe")
-	outStr := stdout.String()
-
-	w, err := databricks.NewWorkspaceClient(&databricks.Config{})
-	require.NoError(t, err)
-
-	require.NotEmpty(t, outStr)
-
-	hostWithoutPrefix := strings.TrimPrefix(w.Config.Host, "https://")
-	require.Regexp(t, "Host: (?:https://)?"+regexp.QuoteMeta(hostWithoutPrefix), outStr)
-
-	me, err := w.CurrentUser.Me(t.Context())
-	require.NoError(t, err)
-	require.Contains(t, outStr, "User: "+me.UserName)
-	require.Contains(t, outStr, "Authenticated with: "+w.Config.AuthType)
-	require.Contains(t, outStr, "Current configuration:")
-	require.Contains(t, outStr, "✓ host: "+w.Config.Host)
-	require.Contains(t, outStr, "✓ profile: default")
-}
-
-func TestAuthDescribeFailure(t *testing.T) {
-	testutil.CleanupEnvironment(t)
-
-	// set up a custom config file:
-	home := t.TempDir()
-	cfg := &config.Config{
-		ConfigFile: filepath.Join(home, "customcfg"),
-		Profile:    "profile1",
-	}
-	err := databrickscfg.SaveToProfile(t.Context(), cfg)
-	require.NoError(t, err)
-	t.Setenv("DATABRICKS_CONFIG_FILE", filepath.Join(home, "customcfg"))
-
-	// run the command:
-	ctx := t.Context()
-	stdout, _ := testcli.RequireSuccessfulRun(t, ctx, "auth", "describe", "--profile", "nonexistent")
-	outStr := stdout.String()
-
-	require.NotEmpty(t, outStr)
-	require.Contains(t, outStr, "Unable to authenticate: resolve")
-	require.Contains(t, outStr, "has no nonexistent profile configured")
-	require.Contains(t, outStr, "Current configuration:")
-	require.Contains(t, outStr, "✓ profile: nonexistent (from --profile flag)")
-}
diff --git a/integration/cmd/clusters/clusters_test.go b/integration/cmd/clusters/clusters_test.go
deleted file mode 100644
index 33a2aa0b3ee..00000000000
--- a/integration/cmd/clusters/clusters_test.go
+++ /dev/null
@@ -1,62 +0,0 @@
-package clusters_test
-
-import (
-	"fmt"
-	"regexp"
-	"testing"
-
-	"github.com/databricks/cli/integration/internal/acc"
-	"github.com/databricks/cli/internal/testcli"
-	"github.com/databricks/databricks-sdk-go/listing"
-	"github.com/databricks/databricks-sdk-go/service/compute"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestClustersList(t *testing.T) {
-	ctx := t.Context()
-	stdout, stderr := testcli.RequireSuccessfulRun(t, ctx, "clusters", "list")
-	outStr := stdout.String()
-	assert.Contains(t, outStr, "ID")
-	assert.Contains(t, outStr, "Name")
-	assert.Contains(t, outStr, "State")
-	assert.Equal(t, "", stderr.String())
-
-	idRegExp := regexp.MustCompile(`[0-9]{4}\-[0-9]{6}-[a-z0-9]{8}`)
-	clusterId := idRegExp.FindString(outStr)
-	assert.NotEmpty(t, clusterId)
-}
-
-func TestClustersGet(t *testing.T) {
-	ctx := t.Context()
-	clusterId := findValidClusterID(t)
-	stdout, stderr := testcli.RequireSuccessfulRun(t, ctx, "clusters", "get", clusterId)
-	outStr := stdout.String()
-	assert.Contains(t, outStr, fmt.Sprintf(`"cluster_id":"%s"`, clusterId))
-	assert.Equal(t, "", stderr.String())
-}
-
-func TestClusterCreateErrorWhenNoArguments(t *testing.T) {
-	ctx := t.Context()
-	_, _, err := testcli.RequireErrorRun(t, ctx, "clusters", "create")
-	assert.Contains(t, err.Error(), "accepts 1 arg(s), received 0")
-}
-
-// findValidClusterID lists clusters in the workspace to find a valid cluster ID.
-func findValidClusterID(t *testing.T) string {
-	ctx, wt := acc.WorkspaceTest(t)
-	it := wt.W.Clusters.List(ctx, compute.ListClustersRequest{
-		FilterBy: &compute.ListClustersFilterBy{
-			ClusterSources: []compute.ClusterSource{
-				compute.ClusterSourceApi,
-				compute.ClusterSourceUi,
-			},
-		},
-	})
-
-	clusterIDs, err := listing.ToSliceN(ctx, it, 1)
-	require.NoError(t, err)
-	require.Len(t, clusterIDs, 1)
-
-	return clusterIDs[0].ClusterId
-}
diff --git a/integration/cmd/environments/setup_local_test.go b/integration/cmd/environments/setup_local_test.go
new file mode 100644
index 00000000000..3d5f83bbd4b
--- /dev/null
+++ b/integration/cmd/environments/setup_local_test.go
@@ -0,0 +1,145 @@
+package environments_test
+
+import (
+	"encoding/json"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"testing"
+
+	"github.com/databricks/cli/integration/internal/acc"
+	"github.com/databricks/cli/internal/testcli"
+	"github.com/databricks/cli/libs/localenv"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// The serverless target needs no running compute: --serverless-version is used
+// verbatim, so these tests resolve against the real Jobs/Clusters-free path and
+// fetch from the public databricks/environments repo. v5 is a published LTS
+// target (see the repo's python/serverless/ tree).
+const testServerlessVersion = "5"
+
+// TestSetupLocalServerlessProvision drives the full non-dry-run pipeline against
+// the real published constraints: resolve -> fetch -> uv sync -> validate. It
+// asserts a real .venv is created and the --output json contract carries the
+// resolved versions. This is the one integration test that exercises a real uv
+// provision end to end; the acceptance suite covers everything else via --dry-run.
+func TestSetupLocalServerlessProvision(t *testing.T) {
+	ctx, _ := acc.WorkspaceTest(t)
+
+	// setup-local operates on the current working directory; run in a fresh
+	// greenfield project (no pre-existing pyproject.toml).
+	dir := t.TempDir()
+	t.Chdir(dir)
+
+	// Skip rather than let the pipeline install uv: EnvAutoInstallUv would run the
+	// remote installer and mutate ~/.local/bin on a developer machine. CI installs
+	// uv, so this only skips where the side effect would be unwanted.
+	if _, err := exec.LookPath("uv"); err != nil {
+		t.Skipf("uv not found on PATH (%v)", err)
+	}
+
+	stdout, _ := testcli.RequireSuccessfulRun(t, ctx,
+		"environments", "setup-local",
+		"--serverless-version", testServerlessVersion,
+		"--output", "json",
+	)
+
+	var res localenv.Result
+	require.NoError(t, json.Unmarshal(stdout.Bytes(), &res))
+
+	assert.True(t, res.OK, "expected ok=true, got result: %s", stdout.String())
+	assert.False(t, res.DryRun)
+	assert.Equal(t, "environments setup-local", res.Command)
+	assert.Equal(t, "default", res.Mode)
+
+	require.NotNil(t, res.Compute)
+	assert.Equal(t, "serverless", res.Compute.Source)
+	assert.Equal(t, "serverless/serverless-v"+testServerlessVersion, res.Compute.EnvKey)
+
+	require.NotNil(t, res.Resolved)
+	assert.NotEmpty(t, res.Resolved.PythonVersion, "resolved python version should be reported")
+	// The default mode installs databricks-connect, so the resolved pin is present.
+	assert.NotEmpty(t, res.Resolved.DBConnectVersion)
+
+	// Every phase must have reached ok, including the real provision and validate.
+	for _, ph := range res.Phases {
+		assert.Equalf(t, localenv.StatusOK, ph.Status, "phase %s not ok", ph.Phase)
+	}
+
+	// A real interpreter and lockfile were written into the project. testcli runs
+	// in-process, so runtime.GOOS is the runner's OS and picks the right layout.
+	assert.FileExists(t, venvPython(dir))
+	assert.FileExists(t, filepath.Join(dir, "pyproject.toml"))
+	assert.FileExists(t, filepath.Join(dir, "uv.lock"))
+}
+
+// TestSetupLocalDryRunWritesNothing verifies the --dry-run contract against the
+// real repo: the plan resolves and fetches, reports ok, but writes no files.
+func TestSetupLocalDryRunWritesNothing(t *testing.T) {
+	ctx, _ := acc.WorkspaceTest(t)
+
+	dir := t.TempDir()
+	t.Chdir(dir)
+
+	stdout, _ := testcli.RequireSuccessfulRun(t, ctx,
+		"environments", "setup-local",
+		"--serverless-version", testServerlessVersion,
+		"--dry-run",
+		"--output", "json",
+	)
+
+	var res localenv.Result
+	require.NoError(t, json.Unmarshal(stdout.Bytes(), &res))
+	assert.True(t, res.OK)
+	assert.True(t, res.DryRun)
+
+	// --dry-run must not touch disk.
+	entries, err := os.ReadDir(dir)
+	require.NoError(t, err)
+	assert.Empty(t, entries, "dry-run wrote files: %v", entries)
+}
+
+// TestSetupLocalUnpublishedVersion verifies the fetch-phase error contract: an
+// unpublished serverless version resolves fine but has no artifact, so the run
+// fails with E_ENV_UNSUPPORTED and a non-zero exit (surfaced as a run error).
+func TestSetupLocalUnpublishedVersion(t *testing.T) {
+	ctx, _ := acc.WorkspaceTest(t)
+
+	dir := t.TempDir()
+	t.Chdir(dir)
+
+	// A version far above anything published; resolution succeeds, fetch 404s.
+	stdout, _, runErr := testcli.RequireErrorRun(t, ctx,
+		"environments", "setup-local",
+		"--serverless-version", "9999",
+		"--dry-run",
+		"--output", "json",
+	)
+	require.Error(t, runErr)
+
+	var res localenv.Result
+	require.NoError(t, json.Unmarshal(stdout.Bytes(), &res))
+	assert.False(t, res.OK)
+	require.NotNil(t, res.Error)
+	assert.Equal(t, localenv.ErrEnvUnsupported, res.Error.Code)
+	assert.Equal(t, localenv.PhaseFetch, res.Error.FailurePhase)
+
+	// Even a failed fetch must not have written anything on a dry run: preflight
+	// skips ensureWritable and cache writes are suppressed, so the project dir
+	// must still be empty.
+	entries, err := os.ReadDir(dir)
+	require.NoError(t, err)
+	assert.Empty(t, entries, "dry-run wrote files: %v", entries)
+}
+
+// venvPython returns the path to the created virtualenv's interpreter, accounting
+// for the Windows (Scripts/python.exe) vs Unix (bin/python) layout.
+func venvPython(dir string) string {
+	if runtime.GOOS == "windows" {
+		return filepath.Join(dir, ".venv", "Scripts", "python.exe")
+	}
+	return filepath.Join(dir, ".venv", "bin", "python")
+}
diff --git a/integration/cmd/fs/cat_test.go b/integration/cmd/fs/cat_test.go
index 49f48974cbf..eab2f86df8a 100644
--- a/integration/cmd/fs/cat_test.go
+++ b/integration/cmd/fs/cat_test.go
@@ -6,7 +6,6 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/databricks/cli/integration/internal/acc"
 	"github.com/databricks/cli/internal/testcli"
 	"github.com/databricks/cli/libs/filer"
 	"github.com/stretchr/testify/assert"
@@ -27,7 +26,7 @@ func TestFsCat(t *testing.T) {
 			require.NoError(t, err)
 
 			stdout, stderr := testcli.RequireSuccessfulRun(t, ctx, "fs", "cat", path.Join(tmpDir, "hello.txt"))
-			assert.Equal(t, "", stderr.String())
+			assert.Empty(t, stderr.String())
 			assert.Equal(t, "abcd", stdout.String())
 		})
 	}
@@ -67,24 +66,3 @@ func TestFsCatOnNonExistentFile(t *testing.T) {
 		})
 	}
 }
-
-func TestFsCatForDbfsInvalidScheme(t *testing.T) {
-	ctx := t.Context()
-	_, _, err := testcli.RequireErrorRun(t, ctx, "fs", "cat", "dab:/non-existent-file")
-	assert.ErrorContains(t, err, "invalid scheme: dab")
-}
-
-func TestFsCatDoesNotSupportOutputModeJson(t *testing.T) {
-	ctx, wt := acc.WorkspaceTest(t)
-	w := wt.W
-
-	tmpDir := acc.TemporaryDbfsDir(wt, "fs-cat-")
-	f, err := filer.NewDbfsClient(w, tmpDir)
-	require.NoError(t, err)
-
-	err = f.Write(ctx, "hello.txt", strings.NewReader("abc"))
-	require.NoError(t, err)
-
-	_, _, err = testcli.RequireErrorRun(t, ctx, "fs", "cat", "dbfs:"+path.Join(tmpDir, "hello.txt"), "--output=json")
-	assert.ErrorContains(t, err, "json output not supported")
-}
diff --git a/integration/cmd/fs/cp_test.go b/integration/cmd/fs/cp_test.go
index 0b22992ea4b..cea277f105b 100644
--- a/integration/cmd/fs/cp_test.go
+++ b/integration/cmd/fs/cp_test.go
@@ -347,12 +347,6 @@ func TestFsCpErrorsWhenSourceIsDirWithoutRecursiveFlag(t *testing.T) {
 	}
 }
 
-func TestFsCpErrorsOnInvalidScheme(t *testing.T) {
-	ctx := t.Context()
-	_, _, err := testcli.RequireErrorRun(t, ctx, "fs", "cp", "dbfs:/a", "https:/b")
-	assert.Equal(t, "invalid scheme: https", err.Error())
-}
-
 func TestFsCpSourceIsDirectoryButTargetIsFile(t *testing.T) {
 	t.Parallel()
 
diff --git a/integration/cmd/fs/helpers_test.go b/integration/cmd/fs/helpers_test.go
index e1bebb28f42..0f16ac5fdb8 100644
--- a/integration/cmd/fs/helpers_test.go
+++ b/integration/cmd/fs/helpers_test.go
@@ -30,14 +30,14 @@ func setupDbfsFiler(t testutil.TestingT) (filer.Filer, string) {
 }
 
 func setupUcVolumesFiler(t testutil.TestingT) (filer.Filer, string) {
-	_, wt := acc.WorkspaceTest(t)
+	ctx, wt := acc.WorkspaceTest(t)
 
 	if os.Getenv("TEST_METASTORE_ID") == "" {
 		t.Skip("Skipping tests that require a UC Volume when metastore id is not set.")
 	}
 
 	tmpdir := acc.TemporaryVolume(wt)
-	f, err := filer.NewFilesClient(wt.W, tmpdir)
+	f, err := filer.NewFilesClient(ctx, wt.W, tmpdir)
 	require.NoError(t, err)
 
 	return f, path.Join("dbfs:/", tmpdir)
diff --git a/integration/cmd/fs/ls_test.go b/integration/cmd/fs/ls_test.go
index cbb8ed8b3a6..565d77b4378 100644
--- a/integration/cmd/fs/ls_test.go
+++ b/integration/cmd/fs/ls_test.go
@@ -50,7 +50,7 @@ func TestFsLs(t *testing.T) {
 			setupLsFiles(t, f)
 
 			stdout, stderr := testcli.RequireSuccessfulRun(t, ctx, "fs", "ls", tmpDir, "--output=json")
-			assert.Equal(t, "", stderr.String())
+			assert.Empty(t, stderr.String())
 
 			var parsedStdout []map[string]any
 			err := json.Unmarshal(stdout.Bytes(), &parsedStdout)
@@ -82,7 +82,7 @@ func TestFsLsWithAbsolutePaths(t *testing.T) {
 			setupLsFiles(t, f)
 
 			stdout, stderr := testcli.RequireSuccessfulRun(t, ctx, "fs", "ls", tmpDir, "--output=json", "--absolute")
-			assert.Equal(t, "", stderr.String())
+			assert.Empty(t, stderr.String())
 
 			var parsedStdout []map[string]any
 			err := json.Unmarshal(stdout.Bytes(), &parsedStdout)
@@ -131,7 +131,7 @@ func TestFsLsOnEmptyDir(t *testing.T) {
 			_, tmpDir := testCase.setupFiler(t)
 
 			stdout, stderr := testcli.RequireSuccessfulRun(t, ctx, "fs", "ls", tmpDir, "--output=json")
-			assert.Equal(t, "", stderr.String())
+			assert.Empty(t, stderr.String())
 			var parsedStdout []map[string]any
 			err := json.Unmarshal(stdout.Bytes(), &parsedStdout)
 			require.NoError(t, err)
@@ -158,11 +158,3 @@ func TestFsLsForNonexistingDir(t *testing.T) {
 		})
 	}
 }
-
-func TestFsLsWithoutScheme(t *testing.T) {
-	t.Parallel()
-
-	ctx := t.Context()
-	_, _, err := testcli.RequireErrorRun(t, ctx, "fs", "ls", "/path-without-a-dbfs-scheme", "--output=json")
-	assert.ErrorIs(t, err, fs.ErrNotExist)
-}
diff --git a/integration/cmd/fs/mkdir_test.go b/integration/cmd/fs/mkdir_test.go
index 2c1f7d29495..eec361546e2 100644
--- a/integration/cmd/fs/mkdir_test.go
+++ b/integration/cmd/fs/mkdir_test.go
@@ -24,8 +24,8 @@ func TestFsMkdir(t *testing.T) {
 
 			// create directory "a"
 			stdout, stderr := testcli.RequireSuccessfulRun(t, ctx, "fs", "mkdir", path.Join(tmpDir, "a"))
-			assert.Equal(t, "", stderr.String())
-			assert.Equal(t, "", stdout.String())
+			assert.Empty(t, stderr.String())
+			assert.Empty(t, stdout.String())
 
 			// assert directory "a" is created
 			info, err := f.Stat(t.Context(), "a")
@@ -48,8 +48,8 @@ func TestFsMkdirCreatesIntermediateDirectories(t *testing.T) {
 
 			// create directory "a/b/c"
 			stdout, stderr := testcli.RequireSuccessfulRun(t, ctx, "fs", "mkdir", path.Join(tmpDir, "a", "b", "c"))
-			assert.Equal(t, "", stderr.String())
-			assert.Equal(t, "", stdout.String())
+			assert.Empty(t, stderr.String())
+			assert.Empty(t, stdout.String())
 
 			// assert directory "a" is created
 			infoA, err := f.Stat(t.Context(), "a")
@@ -88,8 +88,8 @@ func TestFsMkdirWhenDirectoryAlreadyExists(t *testing.T) {
 
 			// assert run is successful without any errors
 			stdout, stderr := testcli.RequireSuccessfulRun(t, ctx, "fs", "mkdir", path.Join(tmpDir, "a"))
-			assert.Equal(t, "", stderr.String())
-			assert.Equal(t, "", stdout.String())
+			assert.Empty(t, stderr.String())
+			assert.Empty(t, stdout.String())
 		})
 	}
 }
diff --git a/integration/cmd/fs/rm_test.go b/integration/cmd/fs/rm_test.go
index ff64196b9c8..a4663c7a075 100644
--- a/integration/cmd/fs/rm_test.go
+++ b/integration/cmd/fs/rm_test.go
@@ -31,8 +31,8 @@ func TestFsRmFile(t *testing.T) {
 
 			// Run rm command
 			stdout, stderr := testcli.RequireSuccessfulRun(t, ctx, "fs", "rm", path.Join(tmpDir, "hello.txt"))
-			assert.Equal(t, "", stderr.String())
-			assert.Equal(t, "", stdout.String())
+			assert.Empty(t, stderr.String())
+			assert.Empty(t, stdout.String())
 
 			// Assert file was deleted
 			_, err = f.Stat(t.Context(), "hello.txt")
@@ -60,8 +60,8 @@ func TestFsRmEmptyDir(t *testing.T) {
 
 			// Run rm command
 			stdout, stderr := testcli.RequireSuccessfulRun(t, ctx, "fs", "rm", path.Join(tmpDir, "a"))
-			assert.Equal(t, "", stderr.String())
-			assert.Equal(t, "", stdout.String())
+			assert.Empty(t, stderr.String())
+			assert.Empty(t, stdout.String())
 
 			// Assert directory was deleted
 			_, err = f.Stat(t.Context(), "a")
@@ -139,8 +139,8 @@ func TestFsRmDirRecursively(t *testing.T) {
 
 			// Run rm command
 			stdout, stderr := testcli.RequireSuccessfulRun(t, ctx, "fs", "rm", path.Join(tmpDir, "a"), "--recursive")
-			assert.Equal(t, "", stderr.String())
-			assert.Equal(t, "", stdout.String())
+			assert.Empty(t, stderr.String())
+			assert.Empty(t, stdout.String())
 
 			// Assert directory was deleted
 			_, err = f.Stat(t.Context(), "a")
diff --git a/integration/cmd/jobs/jobs_test.go b/integration/cmd/jobs/jobs_test.go
deleted file mode 100644
index f168cd53154..00000000000
--- a/integration/cmd/jobs/jobs_test.go
+++ /dev/null
@@ -1,23 +0,0 @@
-package jobs_test
-
-import (
-	"encoding/json"
-	"strconv"
-	"testing"
-
-	"github.com/databricks/cli/internal/testcli"
-	"github.com/databricks/cli/internal/testutil"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestCreateJob(t *testing.T) {
-	testutil.Require(t, testutil.Azure)
-	ctx := t.Context()
-	stdout, stderr := testcli.RequireSuccessfulRun(t, ctx, "jobs", "create", "--json", "@testdata/create_job_without_workers.json", "--log-level=debug")
-	assert.Empty(t, stderr.String())
-	var output map[string]int
-	err := json.Unmarshal(stdout.Bytes(), &output)
-	require.NoError(t, err)
-	testcli.RequireSuccessfulRun(t, ctx, "jobs", "delete", strconv.Itoa(output["job_id"]), "--log-level=debug")
-}
diff --git a/integration/cmd/jobs/testdata/create_job_without_workers.json b/integration/cmd/jobs/testdata/create_job_without_workers.json
deleted file mode 100644
index e92ce82684e..00000000000
--- a/integration/cmd/jobs/testdata/create_job_without_workers.json
+++ /dev/null
@@ -1,35 +0,0 @@
-{
-    "name": "create-job-without-workers",
-    "job_clusters": [{
-        "job_cluster_key": "create-job-without-workers-cluster",
-        "new_cluster": {
-            "num_workers": 0,
-            "spark_version": "10.4.x-scala2.12",
-            "node_type_id": "Standard_DS3_v2"
-        }
-    }],
-    "tasks": [{
-        "job_cluster_key":  "create-job-without-workers-cluster",
-        "task_key": "create-job-without-workers-cluster1",
-        "libraries": [
-            {
-                "jar": "dbfs:/max/jars/exampleJarTask.jar"
-            }
-        ],
-        "spark_jar_task": {
-            "main_class_name":  "com.databricks.quickstart.exampleTask"
-        }
-    },
-    {
-        "job_cluster_key":  "create-job-without-workers-cluster",
-        "task_key": "create-job-without-workers-cluster2",
-        "libraries": [
-            {
-                "jar": "dbfs:/max/jars/exampleJarTask.jar"
-            }
-        ],
-        "spark_jar_task": {
-            "main_class_name":  "com.databricks.quickstart.exampleTask"
-        }
-    }]
-}
diff --git a/integration/cmd/secrets/secrets_test.go b/integration/cmd/secrets/secrets_test.go
deleted file mode 100644
index 31ee71d90f2..00000000000
--- a/integration/cmd/secrets/secrets_test.go
+++ /dev/null
@@ -1,114 +0,0 @@
-package secrets_test
-
-import (
-	"context"
-	"encoding/base64"
-	"fmt"
-	"os"
-	"testing"
-
-	"github.com/databricks/cli/integration/internal/acc"
-	"github.com/databricks/cli/internal/testcli"
-	"github.com/databricks/cli/internal/testutil"
-	"github.com/databricks/databricks-sdk-go/service/workspace"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestSecretsCreateScopeErrWhenNoArguments(t *testing.T) {
-	ctx := t.Context()
-	_, _, err := testcli.RequireErrorRun(t, ctx, "secrets", "create-scope")
-	assert.Contains(t, err.Error(), "accepts 1 arg(s), received 0")
-}
-
-func temporarySecretScope(ctx context.Context, t *acc.WorkspaceT) string {
-	scope := testutil.RandomName("cli-acc-")
-	err := t.W.Secrets.CreateScope(ctx, workspace.CreateScope{
-		Scope: scope,
-	})
-	require.NoError(t, err)
-
-	// Delete the scope after the test.
-	t.Cleanup(func() {
-		err := t.W.Secrets.DeleteScopeByScope(context.WithoutCancel(ctx), scope)
-		require.NoError(t, err)
-	})
-
-	return scope
-}
-
-func assertSecretStringValue(t *acc.WorkspaceT, scope, key, expected string) {
-	out, err := t.RunPython(fmt.Sprintf(`
-		import base64
-		value = dbutils.secrets.get(scope="%s", key="%s")
-		encoded_value = base64.b64encode(value.encode('utf-8'))
-		print(encoded_value.decode('utf-8'))
-	`, scope, key))
-	require.NoError(t, err)
-
-	decoded, err := base64.StdEncoding.DecodeString(out)
-	require.NoError(t, err)
-	assert.Equal(t, expected, string(decoded))
-}
-
-func assertSecretBytesValue(t *acc.WorkspaceT, scope, key string, expected []byte) {
-	out, err := t.RunPython(fmt.Sprintf(`
-		import base64
-		value = dbutils.secrets.getBytes(scope="%s", key="%s")
-		encoded_value = base64.b64encode(value)
-		print(encoded_value.decode('utf-8'))
-	`, scope, key))
-	require.NoError(t, err)
-
-	decoded, err := base64.StdEncoding.DecodeString(out)
-	require.NoError(t, err)
-	assert.Equal(t, expected, decoded)
-}
-
-func TestSecretsPutSecretStringValue(tt *testing.T) {
-	// aws-prod-ucws sets CLOUD_ENV to "ucws"
-	if os.Getenv("CLOUD_ENV") == "ucws" {
-		/*
-					FAIL integration/cmd/secrets.TestSecretsPutSecretStringValue (re-run 2) (1201.25s)
-			      secrets_test.go:73:   args: secrets, put-secret, cli-acc-c4ea35e34b52466cbf9a090c431d6a0b, test-key, --string-value, test-value
-			          with-newlines
-			      secrets_test.go:40:
-			          	Error Trace:	/home/runner/work/eng-dev-ecosystem/eng-dev-ecosystem/ext/cli/integration/internal/acc/workspace.go:75
-			          	Error:      	Received unexpected error:
-			          	            	wait: timed out: Finding instances for new nodes, acquiring more instances if necessary
-			          	Messages:   	Unexpected error from EnsureClusterIsRunning for clusterID=***
-		*/
-		tt.Skip("Skipping to unblock PRs; re-enable if works")
-	}
-
-	ctx, t := acc.WorkspaceTest(tt)
-	scope := temporarySecretScope(ctx, t)
-	key := "test-key"
-	value := "test-value\nwith-newlines\n"
-
-	stdout, stderr := testcli.RequireSuccessfulRun(t, ctx, "secrets", "put-secret", scope, key, "--string-value", value)
-	assert.Empty(t, stdout)
-	assert.Empty(t, stderr)
-
-	assertSecretStringValue(t, scope, key, value)
-	assertSecretBytesValue(t, scope, key, []byte(value))
-}
-
-func TestSecretsPutSecretBytesValue(tt *testing.T) {
-	if os.Getenv("CLOUD_ENV") == "ucws" {
-		tt.Skip("Skipping to unblock PRs; re-enable if works")
-	}
-
-	ctx, t := acc.WorkspaceTest(tt)
-	scope := temporarySecretScope(ctx, t)
-	key := "test-key"
-	value := []byte{0x00, 0x01, 0x02, 0x03}
-
-	stdout, stderr := testcli.RequireSuccessfulRun(t, ctx, "secrets", "put-secret", scope, key, "--bytes-value", string(value))
-	assert.Empty(t, stdout)
-	assert.Empty(t, stderr)
-
-	// Note: this value cannot be represented as Python string,
-	// so we only check equality through the dbutils.secrets.getBytes API.
-	assertSecretBytesValue(t, scope, key, value)
-}
diff --git a/integration/cmd/storage_credentials/storage_credentials_test.go b/integration/cmd/storage_credentials/storage_credentials_test.go
deleted file mode 100644
index e4b861312b7..00000000000
--- a/integration/cmd/storage_credentials/storage_credentials_test.go
+++ /dev/null
@@ -1,21 +0,0 @@
-package storage_credentials_test
-
-import (
-	"testing"
-
-	"github.com/databricks/cli/integration/internal/acc"
-	"github.com/databricks/cli/internal/testcli"
-	"github.com/databricks/cli/internal/testutil"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestStorageCredentialsListRendersResponse(t *testing.T) {
-	ctx, _ := acc.WorkspaceTest(t)
-
-	// Check if metastore is assigned for the workspace, otherwise test will fail
-	t.Log(testutil.GetEnvOrSkipTest(t, "TEST_METASTORE_ID"))
-
-	stdout, stderr := testcli.RequireSuccessfulRun(t, ctx, "storage-credentials", "list")
-	assert.NotEmpty(t, stdout)
-	assert.Empty(t, stderr)
-}
diff --git a/integration/cmd/sync/sync_test.go b/integration/cmd/sync/sync_test.go
index 5871c41db24..b58d00ca2d0 100644
--- a/integration/cmd/sync/sync_test.go
+++ b/integration/cmd/sync/sync_test.go
@@ -23,6 +23,7 @@ import (
 	"github.com/databricks/cli/libs/testfile"
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/client"
+	"github.com/databricks/databricks-sdk-go/service/iam"
 	"github.com/databricks/databricks-sdk-go/service/workspace"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -36,7 +37,7 @@ var (
 // This test needs auth env vars to run.
 // Please run using the deco env test or deco env shell
 func setupRepo(t *testing.T, wsc *databricks.WorkspaceClient, ctx context.Context) (localRoot, remoteRoot string) {
-	me, err := wsc.CurrentUser.Me(ctx)
+	me, err := wsc.CurrentUser.Me(ctx, iam.MeRequest{})
 	require.NoError(t, err)
 	repoPath := fmt.Sprintf("/Repos/%s/%s", me.UserName, testutil.RandomName("empty-repo-sync-integration-"))
 
@@ -125,13 +126,13 @@ func (a *syncTest) waitForCompletionMarker() {
 func (a *syncTest) remoteDirContent(ctx context.Context, relativeDir string, expectedFiles []string) {
 	remoteDir := path.Join(a.remoteRoot, relativeDir)
 	a.c.Eventually(func() bool {
-		objects, err := a.w.Workspace.ListAll(ctx, workspace.ListWorkspaceRequest{ //nolint:staticcheck // Deprecated in SDK v0.127.0. Migration to WorkspaceHierarchyService tracked separately.
+		objects, err := a.w.Workspace.ListAll(ctx, workspace.ListWorkspaceRequest{
 			Path: remoteDir,
 		})
 		require.NoError(a.t, err)
 		return len(objects) == len(expectedFiles)
 	}, 30*time.Second, 5*time.Second)
-	objects, err := a.w.Workspace.ListAll(ctx, workspace.ListWorkspaceRequest{ //nolint:staticcheck // Deprecated in SDK v0.127.0. Migration to WorkspaceHierarchyService tracked separately.
+	objects, err := a.w.Workspace.ListAll(ctx, workspace.ListWorkspaceRequest{
 		Path: remoteDir,
 	})
 	require.NoError(a.t, err)
@@ -184,7 +185,7 @@ func (a *syncTest) objectType(ctx context.Context, relativePath, expected string
 	path := path.Join(a.remoteRoot, relativePath)
 
 	a.c.Eventually(func() bool {
-		metadata, err := a.w.Workspace.GetStatusByPath(ctx, path) //nolint:staticcheck // Deprecated in SDK v0.127.0. Migration to WorkspaceHierarchyService tracked separately.
+		metadata, err := a.w.Workspace.GetStatusByPath(ctx, path)
 		if err != nil {
 			return false
 		}
@@ -196,7 +197,7 @@ func (a *syncTest) language(ctx context.Context, relativePath, expected string)
 	path := path.Join(a.remoteRoot, relativePath)
 
 	a.c.Eventually(func() bool {
-		metadata, err := a.w.Workspace.GetStatusByPath(ctx, path) //nolint:staticcheck // Deprecated in SDK v0.127.0. Migration to WorkspaceHierarchyService tracked separately.
+		metadata, err := a.w.Workspace.GetStatusByPath(ctx, path)
 		if err != nil {
 			return false
 		}
@@ -224,7 +225,7 @@ func (a *syncTest) snapshotContains(files []string) {
 		_, ok := s.LastModifiedTimes[filePath]
 		assert.True(a.t, ok, "%s not in snapshot file: %v", filePath, s.LastModifiedTimes)
 	}
-	assert.Equal(a.t, len(files), len(s.LastModifiedTimes), "files=%s s.LastModifiedTimes=%s", files, s.LastModifiedTimes)
+	assert.Len(a.t, s.LastModifiedTimes, len(files), "files=%s s.LastModifiedTimes=%s", files, s.LastModifiedTimes)
 }
 
 func TestSyncFullFileSync(t *testing.T) {
@@ -487,17 +488,17 @@ func TestSyncEnsureRemotePathIsUsableIfRepoDoesntExist(t *testing.T) {
 	ctx, wt := acc.WorkspaceTest(t)
 	wsc := wt.W
 
-	me, err := wsc.CurrentUser.Me(ctx)
+	me, err := wsc.CurrentUser.Me(ctx, iam.MeRequest{})
 	require.NoError(t, err)
 
 	// Hypothetical repo path doesn't exist.
 	nonExistingRepoPath := fmt.Sprintf("/Repos/%s/%s", me.UserName, testutil.RandomName("doesnt-exist-"))
-	err = sync.EnsureRemotePathIsUsable(ctx, wsc, nonExistingRepoPath, nil)
+	err = sync.EnsureRemotePathIsUsable(ctx, wsc, nonExistingRepoPath, nil, false)
 	assert.ErrorContains(t, err, " does not exist; please create it first")
 
 	// Paths nested under a hypothetical repo path should yield the same error.
 	nestedPath := path.Join(nonExistingRepoPath, "nested/directory")
-	err = sync.EnsureRemotePathIsUsable(ctx, wsc, nestedPath, nil)
+	err = sync.EnsureRemotePathIsUsable(ctx, wsc, nestedPath, nil, false)
 	assert.ErrorContains(t, err, " does not exist; please create it first")
 }
 
@@ -508,16 +509,16 @@ func TestSyncEnsureRemotePathIsUsableIfRepoExists(t *testing.T) {
 	_, remoteRepoPath := setupRepo(t, wsc, ctx)
 
 	// Repo itself is usable.
-	err := sync.EnsureRemotePathIsUsable(ctx, wsc, remoteRepoPath, nil)
+	err := sync.EnsureRemotePathIsUsable(ctx, wsc, remoteRepoPath, nil, false)
 	assert.NoError(t, err)
 
 	// Path nested under repo path is usable.
 	nestedPath := path.Join(remoteRepoPath, "nested/directory")
-	err = sync.EnsureRemotePathIsUsable(ctx, wsc, nestedPath, nil)
+	err = sync.EnsureRemotePathIsUsable(ctx, wsc, nestedPath, nil, false)
 	assert.NoError(t, err)
 
 	// Verify that the directory has been created.
-	info, err := wsc.Workspace.GetStatusByPath(ctx, nestedPath) //nolint:staticcheck // Deprecated in SDK v0.127.0. Migration to WorkspaceHierarchyService tracked separately.
+	info, err := wsc.Workspace.GetStatusByPath(ctx, nestedPath)
 	require.NoError(t, err)
 	require.Equal(t, workspace.ObjectTypeDirectory, info.ObjectType)
 }
@@ -526,23 +527,23 @@ func TestSyncEnsureRemotePathIsUsableInWorkspace(t *testing.T) {
 	ctx, wt := acc.WorkspaceTest(t)
 	wsc := wt.W
 
-	me, err := wsc.CurrentUser.Me(ctx)
+	me, err := wsc.CurrentUser.Me(ctx, iam.MeRequest{})
 	require.NoError(t, err)
 
 	remotePath := fmt.Sprintf("/Users/%s/%s", me.UserName, testutil.RandomName("ensure-path-exists-test-"))
-	err = sync.EnsureRemotePathIsUsable(ctx, wsc, remotePath, me)
+	err = sync.EnsureRemotePathIsUsable(ctx, wsc, remotePath, me, false)
 	assert.NoError(t, err)
 
 	// Clean up directory after test.
 	defer func() {
-		err := wsc.Workspace.Delete(ctx, workspace.Delete{ //nolint:staticcheck // Deprecated in SDK v0.127.0. Migration to WorkspaceHierarchyService tracked separately.
+		err := wsc.Workspace.Delete(ctx, workspace.Delete{
 			Path: remotePath,
 		})
 		assert.NoError(t, err)
 	}()
 
 	// Verify that the directory has been created.
-	info, err := wsc.Workspace.GetStatusByPath(ctx, remotePath) //nolint:staticcheck // Deprecated in SDK v0.127.0. Migration to WorkspaceHierarchyService tracked separately.
+	info, err := wsc.Workspace.GetStatusByPath(ctx, remotePath)
 	require.NoError(t, err)
 	require.Equal(t, workspace.ObjectTypeDirectory, info.ObjectType)
 }
diff --git a/integration/cmd/unknown_command_test.go b/integration/cmd/unknown_command_test.go
deleted file mode 100644
index 8b9ff524b59..00000000000
--- a/integration/cmd/unknown_command_test.go
+++ /dev/null
@@ -1,17 +0,0 @@
-package cmd_test
-
-import (
-	"testing"
-
-	"github.com/databricks/cli/internal/testcli"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestUnknownCommand(t *testing.T) {
-	ctx := t.Context()
-	stdout, stderr, err := testcli.RequireErrorRun(t, ctx, "unknown-command")
-
-	assert.Error(t, err, "unknown command", `unknown command "unknown-command" for "databricks"`)
-	assert.Equal(t, "", stdout.String())
-	assert.Contains(t, stderr.String(), "unknown command")
-}
diff --git a/integration/cmd/version/version_test.go b/integration/cmd/version/version_test.go
deleted file mode 100644
index d60f6c920e0..00000000000
--- a/integration/cmd/version/version_test.go
+++ /dev/null
@@ -1,47 +0,0 @@
-package version_test
-
-import (
-	"encoding/json"
-	"fmt"
-	"testing"
-
-	"github.com/databricks/cli/internal/build"
-	"github.com/databricks/cli/internal/testcli"
-	"github.com/stretchr/testify/assert"
-)
-
-var expectedVersion = fmt.Sprintf("Databricks CLI v%s\n", build.GetInfo().Version)
-
-func TestVersionFlagShort(t *testing.T) {
-	ctx := t.Context()
-	stdout, stderr := testcli.RequireSuccessfulRun(t, ctx, "-v")
-	assert.Equal(t, expectedVersion, stdout.String())
-	assert.Equal(t, "", stderr.String())
-}
-
-func TestVersionFlagLong(t *testing.T) {
-	ctx := t.Context()
-	stdout, stderr := testcli.RequireSuccessfulRun(t, ctx, "--version")
-	assert.Equal(t, expectedVersion, stdout.String())
-	assert.Equal(t, "", stderr.String())
-}
-
-func TestVersionCommand(t *testing.T) {
-	ctx := t.Context()
-	stdout, stderr := testcli.RequireSuccessfulRun(t, ctx, "version")
-	assert.Equal(t, expectedVersion, stdout.String())
-	assert.Equal(t, "", stderr.String())
-}
-
-func TestVersionCommandWithJSONOutput(t *testing.T) {
-	ctx := t.Context()
-	stdout, stderr := testcli.RequireSuccessfulRun(t, ctx, "version", "--output", "json")
-	assert.NotEmpty(t, stdout.String())
-	assert.Equal(t, "", stderr.String())
-
-	// Deserialize stdout and confirm we see the right fields.
-	var output map[string]any
-	err := json.Unmarshal(stdout.Bytes(), &output)
-	assert.NoError(t, err)
-	assert.Equal(t, build.GetInfo().Version, output["Version"])
-}
diff --git a/integration/cmd/workspace/workspace_test.go b/integration/cmd/workspace/workspace_test.go
index 3079665cc33..53456ff8d7a 100644
--- a/integration/cmd/workspace/workspace_test.go
+++ b/integration/cmd/workspace/workspace_test.go
@@ -27,19 +27,7 @@ func TestWorkspaceList(t *testing.T) {
 	assert.Contains(t, outStr, "Type")
 	assert.Contains(t, outStr, "Language")
 	assert.Contains(t, outStr, "Path")
-	assert.Equal(t, "", stderr.String())
-}
-
-func TestWorkpaceListErrorWhenNoArguments(t *testing.T) {
-	ctx := t.Context()
-	_, _, err := testcli.RequireErrorRun(t, ctx, "workspace", "list")
-	assert.Contains(t, err.Error(), "accepts 1 arg(s), received 0")
-}
-
-func TestWorkpaceGetStatusErrorWhenNoArguments(t *testing.T) {
-	ctx := t.Context()
-	_, _, err := testcli.RequireErrorRun(t, ctx, "workspace", "get-status")
-	assert.Contains(t, err.Error(), "accepts 1 arg(s), received 0")
+	assert.Empty(t, stderr.String())
 }
 
 func TestWorkpaceExportPrintsContents(t *testing.T) {
@@ -58,7 +46,7 @@ func TestWorkpaceExportPrintsContents(t *testing.T) {
 	// Run export
 	stdout, stderr := testcli.RequireSuccessfulRun(t, ctx, "workspace", "export", path.Join(tmpdir, "file-a"))
 	assert.Equal(t, contents, stdout.String())
-	assert.Equal(t, "", stderr.String())
+	assert.Empty(t, stderr.String())
 }
 
 func setupWorkspaceImportExportTest(t *testing.T) (context.Context, filer.Filer, string) {
@@ -127,7 +115,7 @@ func TestExportDir(t *testing.T) {
 	// Run Export
 	stdout, stderr := testcli.RequireSuccessfulRun(t, ctx, "workspace", "export-dir", sourceDir, targetDir)
 	assert.Equal(t, expectedLogs, stdout.String())
-	assert.Equal(t, "", stderr.String())
+	assert.Empty(t, stderr.String())
 
 	// Assert files were exported
 	assertLocalFileContents(t, filepath.Join(targetDir, "file-a"), "abc")
@@ -197,7 +185,7 @@ func TestImportDir(t *testing.T) {
 	}, "\n")
 
 	assert.Equal(t, expectedLogs, stdout.String())
-	assert.Equal(t, "", stderr.String())
+	assert.Empty(t, stderr.String())
 
 	// Assert files are imported
 	assertFilerFileContents(t, ctx, workspaceFiler, "file-a", "hello, world")
@@ -307,7 +295,7 @@ func TestExportWithFileFlag(t *testing.T) {
 	b, err := io.ReadAll(&stdout)
 	require.NoError(t, err)
 	// Expect nothing to be printed to stdout
-	assert.Equal(t, "", string(b))
+	assert.Empty(t, string(b))
 	assertLocalFileContents(t, filepath.Join(localTmpDir, "file.txt"), "abc")
 
 	// Export python notebook
@@ -316,14 +304,14 @@ func TestExportWithFileFlag(t *testing.T) {
 	stdout, _ = testcli.RequireSuccessfulRun(t, ctx, "workspace", "export", path.Join(sourceDir, "pyNotebook"), "--file", filepath.Join(localTmpDir, "pyNb.py"))
 	b, err = io.ReadAll(&stdout)
 	require.NoError(t, err)
-	assert.Equal(t, "", string(b))
+	assert.Empty(t, string(b))
 	assertLocalFileContents(t, filepath.Join(localTmpDir, "pyNb.py"), "# Databricks notebook source\n")
 
 	// Export python notebook as jupyter
 	stdout, _ = testcli.RequireSuccessfulRun(t, ctx, "workspace", "export", path.Join(sourceDir, "pyNotebook"), "--format", "JUPYTER", "--file", filepath.Join(localTmpDir, "jupyterNb.ipynb"))
 	b, err = io.ReadAll(&stdout)
 	require.NoError(t, err)
-	assert.Equal(t, "", string(b))
+	assert.Empty(t, string(b))
 	assertLocalFileContents(t, filepath.Join(localTmpDir, "jupyterNb.ipynb"), `"cells":`)
 	assertLocalFileContents(t, filepath.Join(localTmpDir, "jupyterNb.ipynb"), `"metadata":`)
 }
diff --git a/integration/internal/acc/fixtures.go b/integration/internal/acc/fixtures.go
index d902d0b49a1..ff1949ee6ca 100644
--- a/integration/internal/acc/fixtures.go
+++ b/integration/internal/acc/fixtures.go
@@ -8,13 +8,14 @@ import (
 	"github.com/databricks/databricks-sdk-go/apierr"
 	"github.com/databricks/databricks-sdk-go/service/catalog"
 	"github.com/databricks/databricks-sdk-go/service/files"
+	"github.com/databricks/databricks-sdk-go/service/iam"
 	"github.com/databricks/databricks-sdk-go/service/workspace"
 	"github.com/stretchr/testify/require"
 )
 
 func TemporaryWorkspaceDir(t *WorkspaceT, name ...string) string {
 	ctx := t.ctx
-	me, err := t.W.CurrentUser.Me(ctx)
+	me, err := t.W.CurrentUser.Me(ctx, iam.MeRequest{})
 	require.NoError(t, err)
 
 	// Prefix the name with "integration-test-" to make it easier to identify.
@@ -22,13 +23,13 @@ func TemporaryWorkspaceDir(t *WorkspaceT, name ...string) string {
 	basePath := fmt.Sprintf("/Users/%s/%s", me.UserName, testutil.RandomName(name...))
 
 	t.Logf("Creating workspace directory %s", basePath)
-	err = t.W.Workspace.MkdirsByPath(ctx, basePath) //nolint:staticcheck // Deprecated in SDK v0.127.0. Migration to WorkspaceHierarchyService tracked separately.
+	err = t.W.Workspace.MkdirsByPath(ctx, basePath)
 	require.NoError(t, err)
 
 	// Remove test directory on test completion.
 	t.Cleanup(func() {
 		t.Logf("Removing workspace directory %s", basePath)
-		err := t.W.Workspace.Delete(context.WithoutCancel(ctx), workspace.Delete{ //nolint:staticcheck // Deprecated in SDK v0.127.0. Migration to WorkspaceHierarchyService tracked separately.
+		err := t.W.Workspace.Delete(context.WithoutCancel(ctx), workspace.Delete{
 			Path:      basePath,
 			Recursive: true,
 		})
@@ -69,7 +70,7 @@ func TemporaryDbfsDir(t *WorkspaceT, name ...string) string {
 
 func TemporaryRepo(t *WorkspaceT, url string) string {
 	ctx := t.ctx
-	me, err := t.W.CurrentUser.Me(ctx)
+	me, err := t.W.CurrentUser.Me(ctx, iam.MeRequest{})
 	require.NoError(t, err)
 
 	// Prefix the path with "integration-test-" to make it easier to identify.
diff --git a/integration/libs/filer/helpers_test.go b/integration/libs/filer/helpers_test.go
index a3a3aaae589..baca230b791 100644
--- a/integration/libs/filer/helpers_test.go
+++ b/integration/libs/filer/helpers_test.go
@@ -32,8 +32,7 @@ func setupWsfsFiler(t testutil.TestingT) (filer.Filer, string) {
 
 	// Check if we can use this API here, skip test if we cannot.
 	_, err = f.Read(ctx, "we_use_this_call_to_test_if_this_api_is_enabled")
-	var aerr *apierr.APIError
-	if errors.As(err, &aerr) && aerr.StatusCode == http.StatusBadRequest {
+	if aerr, ok := errors.AsType[*apierr.APIError](err); ok && aerr.StatusCode == http.StatusBadRequest {
 		t.Skip(aerr.Message)
 	}
 
@@ -59,14 +58,14 @@ func setupDbfsFiler(t testutil.TestingT) (filer.Filer, string) {
 }
 
 func setupUcVolumesFiler(t testutil.TestingT) (filer.Filer, string) {
-	_, wt := acc.WorkspaceTest(t)
+	ctx, wt := acc.WorkspaceTest(t)
 
 	if os.Getenv("TEST_METASTORE_ID") == "" {
 		t.Skip("Skipping tests that require a UC Volume when metastore id is not set.")
 	}
 
 	tmpdir := acc.TemporaryVolume(wt)
-	f, err := filer.NewFilesClient(wt.W, tmpdir)
+	f, err := filer.NewFilesClient(ctx, wt.W, tmpdir)
 	require.NoError(t, err)
 
 	return f, path.Join("dbfs:/", tmpdir)
diff --git a/integration/libs/git/git_fetch_test.go b/integration/libs/git/git_fetch_test.go
deleted file mode 100644
index 9bade36bf33..00000000000
--- a/integration/libs/git/git_fetch_test.go
+++ /dev/null
@@ -1,170 +0,0 @@
-package git_test
-
-import (
-	"os"
-	"os/exec"
-	"path"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/databricks/cli/integration/internal/acc"
-	"github.com/databricks/cli/libs/dbr"
-	"github.com/databricks/cli/libs/git"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-const (
-	examplesRepoUrl      = "https://github.com/databricks/bundle-examples"
-	examplesRepoProvider = "gitHub"
-)
-
-func assertFullGitInfo(t *testing.T, expectedRoot string, info git.RepositoryInfo) {
-	assert.Equal(t, "main", info.CurrentBranch)
-	assert.NotEmpty(t, info.LatestCommit)
-	assert.Equal(t, examplesRepoUrl, info.OriginURL)
-	assert.Equal(t, expectedRoot, info.WorktreeRoot)
-}
-
-func assertEmptyGitInfo(t *testing.T, info git.RepositoryInfo) {
-	assertSparseGitInfo(t, "", info)
-}
-
-func assertSparseGitInfo(t *testing.T, expectedRoot string, info git.RepositoryInfo) {
-	assert.Equal(t, "", info.CurrentBranch)
-	assert.Equal(t, "", info.LatestCommit)
-	assert.Equal(t, "", info.OriginURL)
-	assert.Equal(t, expectedRoot, info.WorktreeRoot)
-}
-
-func ensureWorkspacePrefix(root string) string {
-	// The fixture helper doesn't include /Workspace, so include it here.
-	if !strings.HasPrefix(root, "/Workspace/") {
-		return path.Join("/Workspace", root)
-	}
-	return root
-}
-
-func TestFetchRepositoryInfoAPI_FromRepo(t *testing.T) {
-	ctx, wt := acc.WorkspaceTest(t)
-	targetPath := ensureWorkspacePrefix(acc.TemporaryRepo(wt, examplesRepoUrl))
-
-	ctx = dbr.MockRuntime(ctx, dbr.Environment{IsDbr: true, Version: "15.4"})
-
-	for _, inputPath := range []string{
-		path.Join(targetPath, "knowledge_base/dashboard_nyc_taxi"),
-		targetPath,
-	} {
-		t.Run(inputPath, func(t *testing.T) {
-			info, err := git.FetchRepositoryInfo(ctx, inputPath, wt.W)
-			assert.NoError(t, err)
-			assertFullGitInfo(t, targetPath, info)
-		})
-	}
-}
-
-func TestFetchRepositoryInfoAPI_FromNonRepo(t *testing.T) {
-	ctx, wt := acc.WorkspaceTest(t)
-	rootPath := ensureWorkspacePrefix(acc.TemporaryWorkspaceDir(wt, "testing-nonrepo-"))
-
-	// Create directory inside this root path (this is cleaned up as part of the root path).
-	err := wt.W.Workspace.MkdirsByPath(ctx, path.Join(rootPath, "a/b/c")) //nolint:staticcheck // Deprecated in SDK v0.127.0. Migration to WorkspaceHierarchyService tracked separately.
-	require.NoError(t, err)
-
-	ctx = dbr.MockRuntime(ctx, dbr.Environment{IsDbr: true, Version: "15.4"})
-
-	tests := []struct {
-		input string
-		msg   string
-	}{
-		{
-			input: path.Join(rootPath, "a/b/c"),
-			msg:   "",
-		},
-		{
-			input: rootPath,
-			msg:   "",
-		},
-		{
-			input: path.Join(rootPath, "/non-existent"),
-			msg:   "doesn't exist",
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.input+" <==> "+test.msg, func(t *testing.T) {
-			info, err := git.FetchRepositoryInfo(ctx, test.input, wt.W)
-			if test.msg == "" {
-				assert.NoError(t, err)
-			} else {
-				assert.Error(t, err)
-				assert.ErrorContains(t, err, test.msg)
-			}
-			assertEmptyGitInfo(t, info)
-		})
-	}
-}
-
-func TestFetchRepositoryInfoDotGit_FromGitRepo(t *testing.T) {
-	ctx, wt := acc.WorkspaceTest(t)
-
-	repo := cloneRepoLocally(t, examplesRepoUrl)
-
-	for _, inputPath := range []string{
-		filepath.Join(repo, "knowledge_base/dashboard_nyc_taxi"),
-		repo,
-	} {
-		t.Run(inputPath, func(t *testing.T) {
-			info, err := git.FetchRepositoryInfo(ctx, inputPath, wt.W)
-			assert.NoError(t, err)
-			assertFullGitInfo(t, repo, info)
-		})
-	}
-}
-
-func cloneRepoLocally(t *testing.T, repoUrl string) string {
-	tempDir := t.TempDir()
-	localRoot := filepath.Join(tempDir, "repo")
-
-	cmd := exec.Command("git", "clone", "--depth=1", examplesRepoUrl, localRoot)
-	err := cmd.Run()
-	require.NoError(t, err)
-	return localRoot
-}
-
-func TestFetchRepositoryInfoDotGit_FromNonGitRepo(t *testing.T) {
-	ctx, wt := acc.WorkspaceTest(t)
-
-	tempDir := t.TempDir()
-	root := filepath.Join(tempDir, "repo")
-	require.NoError(t, os.MkdirAll(filepath.Join(root, "a/b/c"), 0o700))
-
-	tests := []string{
-		filepath.Join(root, "a/b/c"),
-		root,
-		filepath.Join(root, "/non-existent"),
-	}
-
-	for _, input := range tests {
-		t.Run(input, func(t *testing.T) {
-			info, err := git.FetchRepositoryInfo(ctx, input, wt.W)
-			assert.ErrorIs(t, err, os.ErrNotExist)
-			assertEmptyGitInfo(t, info)
-		})
-	}
-}
-
-func TestFetchRepositoryInfoDotGit_FromBrokenGitRepo(t *testing.T) {
-	ctx, wt := acc.WorkspaceTest(t)
-
-	tempDir := t.TempDir()
-	root := filepath.Join(tempDir, "repo")
-	path := filepath.Join(root, "a/b/c")
-	require.NoError(t, os.MkdirAll(path, 0o700))
-	require.NoError(t, os.WriteFile(filepath.Join(root, ".git"), []byte(""), 0o000))
-
-	info, err := git.FetchRepositoryInfo(ctx, path, wt.W)
-	assert.NoError(t, err)
-	assertSparseGitInfo(t, root, info)
-}
diff --git a/integration/libs/sqlexec/sqlexec_test.go b/integration/libs/sqlexec/sqlexec_test.go
new file mode 100644
index 00000000000..a091b437c5f
--- /dev/null
+++ b/integration/libs/sqlexec/sqlexec_test.go
@@ -0,0 +1,100 @@
+package sqlexec_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/integration/internal/acc"
+	"github.com/databricks/cli/internal/testutil"
+	"github.com/databricks/cli/libs/sqlexec"
+	"github.com/databricks/databricks-sdk-go/service/sql"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// These tests exercise libs/sqlexec against a live SQL warehouse to confirm the
+// engine keeps working against the real Statement Execution API. They run in the
+// nightly integration suite and skip without CLOUD_ENV / TEST_DEFAULT_WAREHOUSE_ID.
+//
+// They are limited to UC workspaces: gating on TEST_METASTORE_ID (set only on the
+// *-ucws environments) keeps them off the non-UC workspaces, whose shared classic
+// warehouses are unreliable to start. CLOUD_ENV can't make this distinction
+// because azure-prod-ucws and the non-UC azure-prod both report CLOUD_ENV=azure.
+func newClient(t *testing.T) (*acc.WorkspaceT, *sqlexec.Client) {
+	t.Helper()
+	testutil.GetEnvOrSkipTest(t, "TEST_METASTORE_ID")
+	_, wt := acc.WorkspaceTest(t)
+	warehouseID := testutil.GetEnvOrSkipTest(t, "TEST_DEFAULT_WAREHOUSE_ID")
+	return wt, sqlexec.New(wt.W.StatementExecution, warehouseID)
+}
+
+func TestSQLExecScalar(t *testing.T) {
+	wt, c := newClient(t)
+	got, err := c.ExecuteScalar(wt.Context(), "SELECT 1")
+	require.NoError(t, err)
+	assert.Equal(t, "1", got)
+}
+
+func TestSQLExecColumnsAndRows(t *testing.T) {
+	wt, c := newClient(t)
+	r, err := c.Execute(wt.Context(), "SELECT id, id * 2 AS doubled FROM range(3) ORDER BY id")
+	require.NoError(t, err)
+	assert.Equal(t, []string{"id", "doubled"}, r.Columns)
+	assert.Equal(t, [][]string{{"0", "0"}, {"1", "2"}, {"2", "4"}}, r.Rows)
+}
+
+func TestSQLExecParameters(t *testing.T) {
+	wt, c := newClient(t)
+	r, err := c.Execute(wt.Context(), "SELECT :n AS n, :s AS s", sqlexec.WithParameters([]sql.StatementParameterListItem{
+		{Name: "n", Type: "INT", Value: "42"},
+		{Name: "s", Value: "hello"},
+	}))
+	require.NoError(t, err)
+	assert.Equal(t, [][]string{{"42", "hello"}}, r.Rows)
+}
+
+func TestSQLExecNullParameter(t *testing.T) {
+	wt, c := newClient(t)
+	// An empty value is sent as SQL NULL (StatementParameterListItem.Value is omitempty).
+	got, err := c.ExecuteScalar(wt.Context(), "SELECT :maybe IS NULL", sqlexec.WithParameters([]sql.StatementParameterListItem{
+		{Name: "maybe", Value: ""},
+	}))
+	require.NoError(t, err)
+	assert.Equal(t, "true", got)
+}
+
+func TestSQLExecFailedStatement(t *testing.T) {
+	wt, c := newClient(t)
+	_, err := c.Execute(wt.Context(), "SELECT * FROM a_table_that_does_not_exist_zzz")
+	var se *sqlexec.StatementError
+	require.ErrorAs(t, err, &se)
+	assert.Equal(t, sql.StatementStateFailed, se.State)
+	assert.NotEmpty(t, se.Code)
+	assert.NotEmpty(t, se.Message)
+	// The API populates status.sql_state (SQLSTATE) on failures, e.g. 42P01 for
+	// a missing relation; assert it survives into the typed error.
+	assert.NotEmpty(t, se.SQLState)
+}
+
+func TestSQLExecSubmitAndCancel(t *testing.T) {
+	wt, c := newClient(t)
+	ctx := wt.Context()
+	// Submit returns immediately with the statement ID so we can cancel it.
+	stmt, err := c.Submit(ctx, "SELECT count(*) FROM range(100000000000)")
+	require.NoError(t, err)
+	require.NotEmpty(t, stmt.ID)
+
+	require.NoError(t, c.Cancel(ctx, stmt.ID))
+
+	// The cancel is best-effort; poll to a terminal state and accept either a
+	// CANCELED statement or one that finished before the cancel landed.
+	stmt, err = c.Poll(ctx, stmt)
+	require.NoError(t, err)
+	if stmt.State == sql.StatementStateCanceled {
+		require.Error(t, stmt.Err())
+		var se *sqlexec.StatementError
+		require.ErrorAs(t, stmt.Err(), &se)
+		assert.Equal(t, sql.StatementStateCanceled, se.State)
+	} else {
+		assert.Equal(t, sql.StatementStateSucceeded, stmt.State)
+	}
+}
diff --git a/integration/libs/telemetry/telemetry_test.go b/integration/libs/telemetry/telemetry_test.go
index d329c238e56..32a0fb8ea6a 100644
--- a/integration/libs/telemetry/telemetry_test.go
+++ b/integration/libs/telemetry/telemetry_test.go
@@ -4,12 +4,12 @@ import (
 	"encoding/json"
 	"testing"
 	"time"
+	"uuid"
 
 	"github.com/databricks/cli/integration/internal/acc"
 	"github.com/databricks/cli/libs/telemetry"
 	"github.com/databricks/cli/libs/telemetry/protos"
 	"github.com/databricks/databricks-sdk-go/client"
-	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
diff --git a/integration/testarchive/archive_test.go b/integration/testarchive/archive_test.go
index 65652de3344..79090ad881b 100644
--- a/integration/testarchive/archive_test.go
+++ b/integration/testarchive/archive_test.go
@@ -36,11 +36,11 @@ func TestArchive(t *testing.T) {
 	assert.FileExists(t, filepath.Join(assertDir, "bin", "amd64", "uv"))
 	assert.FileExists(t, filepath.Join(assertDir, "bin", "amd64", "jq"))
 
-	// TODO: Serverless clusters do not support arm64 yet.
-	// Assert these files exist after we support arm64.
-	assert.NoFileExists(t, filepath.Join(assertDir, "bin", "arm64", "go", "bin", "go"))
-	assert.NoFileExists(t, filepath.Join(assertDir, "bin", "arm64", "uv"))
-	assert.NoFileExists(t, filepath.Join(assertDir, "bin", "arm64", "jq"))
+	// arm64 tool binaries are bundled alongside amd64 because the serverless
+	// driver's CPU architecture is chosen at runtime (see CreateArchive).
+	assert.FileExists(t, filepath.Join(assertDir, "bin", "arm64", "go", "bin", "go"))
+	assert.FileExists(t, filepath.Join(assertDir, "bin", "arm64", "uv"))
+	assert.FileExists(t, filepath.Join(assertDir, "bin", "arm64", "jq"))
 
 	assert.FileExists(t, filepath.Join(assertDir, "cli", "go.mod"))
 	assert.FileExists(t, filepath.Join(assertDir, "cli", "go.sum"))
diff --git a/integration/testarchive/downloader_test.go b/integration/testarchive/downloader_test.go
index 4c5ef81e70a..17e304319f8 100644
--- a/integration/testarchive/downloader_test.go
+++ b/integration/testarchive/downloader_test.go
@@ -29,7 +29,7 @@ func TestUvDownloader(t *testing.T) {
 		files, err := os.ReadDir(filepath.Join(tmpDir, arch))
 		require.NoError(t, err)
 
-		assert.Equal(t, 1, len(files))
+		assert.Len(t, files, 1)
 		assert.Equal(t, "uv", files[0].Name())
 	}
 }
@@ -52,7 +52,7 @@ func TestJqDownloader(t *testing.T) {
 		files, err := os.ReadDir(filepath.Join(tmpDir, arch))
 		require.NoError(t, err)
 
-		assert.Equal(t, 1, len(files))
+		assert.Len(t, files, 1)
 		assert.Equal(t, "jq", files[0].Name())
 	}
 }
@@ -75,7 +75,7 @@ func TestGoDownloader(t *testing.T) {
 		entries, err := os.ReadDir(filepath.Join(tmpDir, arch))
 		require.NoError(t, err)
 
-		assert.Equal(t, 1, len(entries))
+		assert.Len(t, entries, 1)
 		assert.Equal(t, "go", entries[0].Name())
 		assert.True(t, entries[0].IsDir())
 
diff --git a/internal/bugbash/README.md b/internal/bugbash/README.md
index 941ab6227cc..0b0e3a8d47a 100644
--- a/internal/bugbash/README.md
+++ b/internal/bugbash/README.md
@@ -3,11 +3,17 @@
 The script in this directory can be used to conveniently exec into a shell
 where a CLI build for a specific branch is made available.
 
+
+## Prerequisites
+
+A snapshot build for your branch needs to exist.
+These are automatically created for branches named `demo-*` and `bugbash-*`.
+
 ## Usage
 
 This script prompts if you do NOT have at least Bash 5 installed,
 but works without command completion with earlier versions.
 
 ```shell
-bash <(curl -fsSL https://raw.githubusercontent.com/databricks/cli/main/internal/bugbash/exec.sh) my-branch
+bash <(curl -fsSL https://raw.githubusercontent.com/databricks/cli/main/internal/bugbash/exec.sh) bugbash-my-branch
 ```
diff --git a/internal/bugbash/exec.sh b/internal/bugbash/exec.sh
index 986f3498d32..07833b42614 100755
--- a/internal/bugbash/exec.sh
+++ b/internal/bugbash/exec.sh
@@ -68,8 +68,8 @@ echo "Looking for a snapshot build of the Databricks CLI on branch $BRANCH..."
 
 # Find last successful build on $BRANCH.
 last_successful_run_id=$(
-  gh run list -b "$BRANCH" -w release-build --json 'databaseId,conclusion' |
-      jq 'limit(1; .[] | select(.conclusion == "success")) | .databaseId'
+  gh run --repo databricks/cli list --branch "$BRANCH" --workflow release-build \
+    --json 'databaseId,conclusion' --jq 'limit(1; .[] | select(.conclusion == "success")) | .databaseId'
 )
 if [ -z "$last_successful_run_id" ]; then
   echo "Unable to find last successful build of the release-build workflow for branch $BRANCH."
@@ -81,7 +81,7 @@ dir=$(mktemp -d)
 
 # Download the artifact.
 echo "Downloading the snapshot build..."
-gh run download "$last_successful_run_id" -n cli -D "$dir/.download"
+gh run --repo databricks/cli download "$last_successful_run_id" --name cli --dir "$dir/.download"
 
 # Extract the archive for this platform.
 archive=$(cli_snapshot_archive)
diff --git a/internal/build/README.md b/internal/build/README.md
new file mode 100644
index 00000000000..0adf8c77a22
--- /dev/null
+++ b/internal/build/README.md
@@ -0,0 +1,85 @@
+# CLI Compatibility Manifest
+
+`cli-compat.json` maps Databricks CLI versions to compatible AppKit and Agent Skills versions. The CLI uses this manifest to determine which template version to use for `apps init` and which skills version to use for `aitools install`.
+
+Raw skills track the latest published skills release for the newest CLI range. Plugin installs use the agent's marketplace commands without a version pin; the manifest's skills settings only control raw-file delivery.
+
+## Manifest format
+
+```json
+{
+  "1.22.0": { "appkit": "0.84.0", "skills": "latest" },
+  "1.20.0": { "appkit": "0.84.0", "skills": "0.2.30" },
+  "1.0.0": { "appkit": "0.76.1", "skills": "0.2.10" },
+  "0.299.2": { "appkit": "0.24.0", "skills": "0.1.5" }
+}
+```
+
+Each key is a CLI version in semver format. Each entry defines a **range floor**: it applies to that CLI version and all versions above it, up to (but not including) the next entry. The manifest should be **sparse** — not every CLI version needs its own entry. Only add a new entry when a compatibility boundary changes.
+
+`skills` is an exact pin for its CLI range or `"latest"` to install the skills repository's latest published GitHub release. When the latest-release lookup fails or the selected skills manifest is missing, ranges tracking latest use `AgentSkillsFallbackVersion` from `internal/build/clicompat.go`. Pinned ranges use their embedded manifest's skills version as the fallback. Changing either fallback takes effect in the next CLI build. Released binaries keep the fallback they shipped with.
+
+This skills fallback only applies to raw-file delivery. Version checks omit update availability when latest is unknown, and plugin operations don't substitute the fallback version.
+
+Raw-skills updates and reinstalls reject automatic downgrades, including with `--force`: the fallback must be at least as new as the installed release. Existing installs without a comparable release require a successful latest-release fetch. Explicit `DATABRICKS_SKILLS_REF` overrides and compatibility pins can still select an older release.
+
+CLIs before `1.6.0` reject the whole remote manifest when any entry uses `"latest"`, even an entry they never resolve to. They use a valid cached manifest or their embedded manifest without returning a parse error. These CLIs stop receiving remote compatibility updates for both AppKit and skills.
+
+Latest tracking starts at the CLI `1.22.0` range. CLI `1.20.x` and `1.21.x` stay pinned.
+
+For example, with the manifest above:
+- CLI `0.299.5` → uses `0.299.2` entry (appkit `0.24.0`)
+- CLI `1.19.0` → uses `1.0.0` entry (appkit `0.76.1`)
+- CLI `1.21.0` → uses `1.20.0` entry (appkit `0.84.0`, skills `0.2.30`)
+- CLI `1.22.0` → uses `1.22.0` entry (appkit `0.84.0`, latest skills with compiled fallback `0.2.30`)
+- CLI `0.0.0-dev+abc` → uses `1.22.0` entry (dev builds use the highest versioned entry)
+
+## How the CLI resolves versions
+
+1. **Dev builds** (`0.0.0-dev*`) → use the highest versioned entry.
+2. **Exact match** on CLI version → use that entry.
+3. **No exact match**, between two entries → use the nearest lower version's entry.
+4. **Newer than all entries** → use the highest versioned entry.
+5. **Older than all entries** → use the lowest (oldest) entry.
+
+## Manifest sources (fallback chain)
+
+At runtime, the CLI resolves the manifest from four sources:
+
+1. **Local cache** (`~/.cache/databricks/compat-manifest.json`) — used if fresh (< 1 hour old).
+2. **Remote fetch** from GitHub — used when cache is stale or missing. On success, the local cache is updated.
+3. **Stale local cache** — if remote fetch fails but a previously cached file exists (even if expired), it is used as-is.
+4. **Embedded manifest** — compiled into the binary via `go:embed`. Used as last resort when both remote and local cache fail.
+
+Set `DATABRICKS_FORCE_EMBEDDED_COMPAT=true` to skip all tiers and use only the embedded manifest. This is useful for local development when testing with a locally compiled binary that has a modified `cli-compat.json`.
+
+## When to update
+
+The goal is to **keep the manifest sparse** — only add entries at compatibility boundaries. Routine skills releases do not require a manifest update: keep `"skills": "latest"` on the newest range.
+
+When updating AppKit or recording a tested skills fallback:
+
+1. **Run evals** on the new AppKit version. If there is no regression, proceed.
+2. **Open a PR** to update `cli-compat.json`. The change depends on the type of release:
+   - **No breaking changes**: update the highest entry's `appkit` in-place, keeping `"skills": "latest"`. To record a tested skills fallback, update `AgentSkillsFallbackVersion` in `internal/build/clicompat.go`. Do NOT add a new versioned key.
+   - **Breaking changes** (the new AppKit templates require specific `apps init` features, or the new skills version requires CLI commands that older CLIs lack): add a new entry keyed to the **minimum CLI version** that supports the new features. Set `"skills": "latest"` on the new entry and update the compiled skills fallback to a tested release. If skills compatibility changed, replace `"latest"` in the affected older ranges with the last compatible release. Preserve unrelated AppKit and skills compatibility boundaries.
+
+This process is manual for now but can be automated as part of the release workflow in the future. Use the `/bump-cli-compat` Claude Code skill to automate the update and PR creation.
+
+## Validation
+
+The manifest is validated by Go tests in `libs/clicompat/`:
+
+```bash
+go test ./libs/clicompat/... -run TestEmbeddedManifest -v
+```
+
+This checks: valid JSON, at least one entry, valid semver keys and AppKit versions, concrete skills versions or `"latest"`, a concrete compiled skills fallback, and latest tracking on the newest CLI range.
+
+## Pruning policy
+
+Entries MUST NOT be removed from the manifest. Older CLI binaries use the lowest entry as their floor when the CLI version is older than all entries. Pruning it causes them to silently resolve to a newer entry that may require CLI features they lack. If the manifest grows too large, consider archiving very old entries to a separate file while keeping the oldest entry as a sentinel.
+
+## Trust model
+
+The live manifest is fetched over HTTPS from GitHub (`raw.githubusercontent.com`). The trust boundary is: TLS certificate validation + GitHub's access controls + write access to the `main` branch of `databricks/cli`. A compromised manifest can only steer clients to existing published tags (AppKit or skills); it cannot inject arbitrary code. The CLI binary always ships an embedded fallback manifest that limits exposure to cache-TTL windows (1 hour). The local cache (`~/.cache/databricks/compat-manifest.json`) is trust-on-disk: an attacker with user-level write access to the cache directory could swap in a malicious manifest pointing to different tags.
diff --git a/internal/build/cli-compat.json b/internal/build/cli-compat.json
new file mode 100644
index 00000000000..c4abac161ce
--- /dev/null
+++ b/internal/build/cli-compat.json
@@ -0,0 +1,6 @@
+{
+  "1.22.0": { "appkit": "0.84.0", "skills": "0.2.32" },
+  "1.20.0": { "appkit": "0.84.0", "skills": "0.2.30" },
+  "1.0.0": { "appkit": "0.76.1", "skills": "0.2.10" },
+  "0.299.2": { "appkit": "0.24.0", "skills": "0.1.5" }
+}
diff --git a/internal/build/clicompat.go b/internal/build/clicompat.go
new file mode 100644
index 00000000000..3142eee1b22
--- /dev/null
+++ b/internal/build/clicompat.go
@@ -0,0 +1,13 @@
+package build
+
+import _ "embed"
+
+// AgentSkillsFallbackVersion is the tested release used when fetching the latest
+// skills release fails. Updating it requires a new CLI build.
+const AgentSkillsFallbackVersion = "0.2.30"
+
+// CLICompatManifestJSON is the cli-compat.json manifest embedded at compile time.
+// Used as the last-resort fallback when both remote fetch and local cache fail.
+//
+//go:embed cli-compat.json
+var CLICompatManifestJSON []byte
diff --git a/internal/build/info.go b/internal/build/info.go
index 54c3f286832..5553d59a455 100644
--- a/internal/build/info.go
+++ b/internal/build/info.go
@@ -8,6 +8,7 @@ import (
 	"sync"
 	"time"
 
+	nextchanges "github.com/databricks/cli/.nextchanges"
 	"golang.org/x/mod/semver"
 )
 
@@ -42,7 +43,65 @@ func (i Info) GetSanitizedVersion() string {
 	return version
 }
 
-const DefaultSemver = "0.0.0-dev"
+// devIdentifier is the prerelease identifier marking a build that was not
+// produced from a release tag.
+const devIdentifier = "dev"
+
+// DefaultSemver is the version reported when buildVersion was not injected,
+// i.e. a plain "go build" rather than a goreleaser build. It is the next release
+// version with a dev prerelease identifier, so it sorts above the latest release
+// and below the release it will become:
+//
+//	Compare(v1.11.0, v1.12.0-dev+sha) = -1
+//	Compare(v1.12.0, v1.12.0-dev+sha) = +1
+//
+// A bare "0.0.0-dev" would instead sort below every published release, even
+// though a local build is built from main and is therefore newer than the
+// latest release. This matches what goreleaser produces for snapshot builds
+// (see snapshot.version_template in .goreleaser.yaml).
+var DefaultSemver = devVersion(nextchanges.Version)
+
+// devVersion returns the development-build version for an upcoming release,
+// normally a plain version with a dev prerelease ("1.12.0" -> "1.12.0-dev").
+//
+// The prerelease branch is for completeness with next_release_version() in
+// internal/genkit/tagging.py, which bumps the prerelease instead of the minor
+// when .nextchanges/version already carries one; it is not because this repo
+// publishes prereleases (it never has). Appending "-dev" to "1.13.0-rc.2" would
+// produce the prerelease "rc.2-dev", a single identifier that merely ends in
+// "dev", so IsDevelopmentVersion would report false and every dev-build
+// exemption would silently switch off. A dot-separated identifier
+// ("1.13.0-rc.2.dev") keeps detection working and still sorts after the rc and
+// before the final release.
+func devVersion(next string) string {
+	if semver.Prerelease("v"+next) != "" {
+		return next + "." + devIdentifier
+	}
+	return next + "-" + devIdentifier
+}
+
+// IsDevelopmentVersion reports whether a version string is a development build's.
+// It keys off the trailing dev prerelease identifier rather than a specific
+// version number, so it keeps working as the next release version changes. The
+// version may be given with or without a leading "v".
+//
+// Prefer Info.IsDevelopment when you have the running build's Info; this is for
+// callers holding only a version string (e.g. one read from a file or a
+// parameter), so the definition of "development build" lives in one place.
+func IsDevelopmentVersion(version string) bool {
+	prerelease := strings.TrimPrefix(semver.Prerelease("v"+strings.TrimPrefix(version, "v")), "-")
+	if prerelease == "" {
+		return false
+	}
+	identifiers := strings.Split(prerelease, ".")
+	return identifiers[len(identifiers)-1] == devIdentifier
+}
+
+// IsDevelopment reports whether this binary was built from a development or
+// snapshot build rather than a release tag.
+func (i Info) IsDevelopment() bool {
+	return i.IsSnapshot || IsDevelopmentVersion(i.Version)
+}
 
 // getDefaultBuildVersion uses build information stored by Go itself
 // to synthesize a build version if one wasn't set.
diff --git a/internal/build/info_test.go b/internal/build/info_test.go
index 7b33a114e86..87eedbf7d04 100644
--- a/internal/build/info_test.go
+++ b/internal/build/info_test.go
@@ -1,15 +1,166 @@
 package build
 
 import (
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/mod/semver"
 )
 
 func TestGetDetails(t *testing.T) {
 	GetInfo()
 }
 
+func TestIsDevelopment(t *testing.T) {
+	tests := []struct {
+		name string
+		info Info
+		want bool
+	}{
+		{"dev build with commit metadata", Info{Version: "1.12.0-dev+abc123"}, true},
+		{"dev build without metadata", Info{Version: "1.12.0-dev"}, true},
+		{"released version", Info{Version: "1.12.0"}, false},
+		// A release candidate is not a dev build: it is built from a tag, so the
+		// version constraints and update checks that dev builds bypass still apply.
+		{"release candidate", Info{Version: "1.12.0-rc.1"}, false},
+		// goreleaser marks snapshots explicitly, independent of the version string.
+		{"snapshot of a release version", Info{Version: "1.12.0", IsSnapshot: true}, true},
+		{"malformed version", Info{Version: "not-a-version"}, false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, tt.info.IsDevelopment())
+		})
+	}
+}
+
+func TestIsDevelopmentVersion(t *testing.T) {
+	tests := []struct {
+		version string
+		want    bool
+	}{
+		{"1.12.0-dev+abc123", true},
+		{"1.12.0-dev", true},
+		// Accepted with or without a leading "v", since callers hold versions in
+		// both forms (the schema's minimum version is v-prefixed).
+		{"v1.12.0-dev", true},
+		// A dev build on a prerelease release track; see devVersion.
+		{"1.13.0-rc.2.dev", true},
+		{"1.12.0", false},
+		{"v1.12.0", false},
+		{"1.12.0-rc.1", false},
+		// "rc.2-dev" is a single identifier that merely ends in "dev", not a dev
+		// marker. This is what naively appending "-dev" to a prerelease produced.
+		{"1.13.0-rc.2-dev", false},
+		{"not-a-version", false},
+		{"", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.version, func(t *testing.T) {
+			assert.Equal(t, tt.want, IsDevelopmentVersion(tt.version))
+		})
+	}
+}
+
+// TestVersionOrdering pins the full ordering model this version scheme exists
+// for. A dev build is built from main, so it must sort ABOVE the release it
+// followed and BELOW the release it will become. The old "0.0.0-dev" scheme
+// violated this: it sorted below every release, including bare "0.0.0".
+//
+// The list is in strictly ascending order; the test asserts every pair, so it
+// covers both the neighbouring steps and the transitive relationships.
+func TestVersionOrdering(t *testing.T) {
+	ascending := []string{
+		"0.0.0-dev",
+		"0.0.0",
+		"1.11.0-dev",
+		"1.11.0",
+		// Build metadata is not part of precedence, so this is EQUAL to the
+		// bare 1.12.0-dev below and must sit between 1.11.0 and 1.12.0.
+		"1.12.0-dev+abc123",
+		"1.12.0-rc.1",
+		// A dev build off a prerelease sorts after the rc it follows and before
+		// the final release; see devVersion for why this shape exists.
+		"1.12.0-rc.1.dev",
+		"1.12.0-rc.2",
+		"1.12.0",
+		"1.12.1-dev",
+		"1.12.1",
+		"2.0.0-dev",
+		"2.0.0",
+	}
+
+	// Build metadata is ignored for precedence, so this pair compares equal.
+	require.Zero(t, semver.Compare("v1.12.0-dev+abc123", "v1.12.0-dev"))
+
+	for i, lower := range ascending {
+		require.True(t, semver.IsValid("v"+lower), "%q must be valid semver", lower)
+		assert.Zero(t, semver.Compare("v"+lower, "v"+lower), "%q must equal itself", lower)
+
+		for _, higher := range ascending[i+1:] {
+			// 1.12.0-dev+abc123 and 1.12.0-rc.1 are adjacent in the list but
+			// -dev sorts below -rc alphabetically, so they are still ordered.
+			assert.Negative(t, semver.Compare("v"+lower, "v"+higher), "%q must sort below %q", lower, higher)
+			assert.Positive(t, semver.Compare("v"+higher, "v"+lower), "%q must sort above %q", higher, lower)
+		}
+	}
+}
+
+// TestDevVersion covers both shapes .nextchanges/version can take. The
+// prerelease case is for completeness with next_release_version() in
+// internal/genkit/tagging.py, which bumps a prerelease when the file carries
+// one; this repo has never published a prerelease.
+func TestDevVersion(t *testing.T) {
+	tests := []struct {
+		next string
+		want string
+		// finalRelease is the release the dev build must sort below: the version
+		// itself on a stable track, or the release the prerelease leads up to.
+		finalRelease string
+	}{
+		{"1.12.0", "1.12.0-dev", "1.12.0"},
+		{"2.0.0", "2.0.0-dev", "2.0.0"},
+		// Appending "-dev" here would yield the prerelease "rc.2-dev", which is
+		// not a dev marker, so IsDevelopmentVersion would report false and every
+		// dev-build exemption would silently switch off.
+		{"1.13.0-rc.2", "1.13.0-rc.2.dev", "1.13.0"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.next, func(t *testing.T) {
+			got := devVersion(tt.next)
+			assert.Equal(t, tt.want, got)
+			require.True(t, semver.IsValid("v"+got), "%q must be valid semver", got)
+			assert.True(t, IsDevelopmentVersion(got), "%q must be recognized as a dev build", got)
+			// The dev build sits below the release it will become, and above the
+			// prerelease it already contains, if any.
+			assert.Negative(t, semver.Compare("v"+got, "v"+tt.finalRelease), "%q must sort below %q", got, tt.finalRelease)
+			if tt.next != tt.finalRelease {
+				assert.Positive(t, semver.Compare("v"+got, "v"+tt.next), "%q must sort above %q", got, tt.next)
+			}
+		})
+	}
+}
+
+// TestDefaultSemverSortsAboveLastRelease applies the ordering above to the
+// version an actual local build reports, which TestVersionOrdering cannot do
+// because DefaultSemver tracks .nextchanges/version.
+func TestDefaultSemverSortsAboveLastRelease(t *testing.T) {
+	v := "v" + DefaultSemver
+	require.True(t, semver.IsValid(v), "DefaultSemver %q must be valid semver", DefaultSemver)
+	require.True(t, IsDevelopmentVersion(DefaultSemver))
+	assert.True(t, Info{Version: DefaultSemver}.IsDevelopment())
+
+	// The release this dev build will become, e.g. v1.12.0 for 1.12.0-dev.
+	next := "v" + strings.TrimSuffix(strings.TrimSuffix(DefaultSemver, "-"+devIdentifier), "."+devIdentifier)
+	require.NotEqual(t, v, next, "DefaultSemver must end with the dev identifier")
+	assert.Positive(t, semver.Compare(next, v), "the upcoming release must sort above the dev build")
+}
+
 func TestGetSanitizedVersion(t *testing.T) {
 	tests := []struct {
 		name     string
diff --git a/internal/build/notice_test.go b/internal/build/notice_test.go
index 972c7aa9c0c..abe1d39287d 100644
--- a/internal/build/notice_test.go
+++ b/internal/build/notice_test.go
@@ -22,18 +22,15 @@ var moduleToGitHub = map[string]string{
 // Modules excluded from NOTICE requirements (Databricks-owned).
 var noticeExclude = map[string]bool{
 	"github.com/databricks/databricks-sdk-go": true,
-}
-
-// Additional entries required in the NOTICE file that are not direct go.mod
-// dependencies (e.g. bundled binaries).
-var noticeExtra = map[string][]string{
-	"hashicorp/terraform": {"MPL-2.0"},
+	"github.com/databricks/sdk-go/core":       true,
+	"github.com/databricks/sdk-go/auth":       true,
+	"github.com/databricks/sdk-go/files":      true,
+	"github.com/databricks/sdk-go/options":    true,
 }
 
 // Expected order of license sections in the NOTICE file.
 var expectedSectionOrder = []string{
 	"Apache-2.0",
-	"MPL-2.0",
 	"BSD-2-Clause",
 	"BSD-3-Clause",
 	"MIT",
@@ -150,11 +147,6 @@ func TestNoticeFileCompleteness(t *testing.T) {
 			expected[id] = append(expected[id], slug)
 		}
 	}
-	for slug, licenses := range noticeExtra {
-		for _, id := range licenses {
-			expected[id] = append(expected[id], slug)
-		}
-	}
 	for k := range expected {
 		slices.Sort(expected[k])
 	}
diff --git a/internal/cligen/cli_json_test.go b/internal/cligen/cli_json_test.go
new file mode 100644
index 00000000000..2aeec36e2d9
--- /dev/null
+++ b/internal/cligen/cli_json_test.go
@@ -0,0 +1,153 @@
+package main
+
+import (
+	"encoding/json"
+	"errors"
+	goformat "go/format"
+	"os"
+	"regexp"
+	"strings"
+	"testing"
+)
+
+// cliJSONPath is the checked-in contract instance, relative to this package.
+const cliJSONPath = "../../.codegen/cli.json"
+
+// fullDoc decodes every block of cli.json that the CLI cares about. The schemas
+// block is consumed by the Python direct-engine generators; here we only need
+// enough of it to assert structural invariants (keys + field refs).
+type fullDoc struct {
+	Schemas  map[string]schemaDoc `json:"schemas"`
+	Commands *CommandsBlock       `json:"commands"`
+}
+
+type schemaDoc struct {
+	Fields map[string]struct {
+		Ref string `json:"ref"`
+	} `json:"fields"`
+}
+
+var shaRE = regexp.MustCompile(`^[0-9a-f]{40}$`)
+
+// TestCliJSONIsInterpretable loads the committed cli.json and asserts the CLI
+// can interpret it: it decodes into the CLI's model, its cross-references
+// resolve, its contents satisfy the invariants the renderer relies on, and
+// every service + batch file renders to syntactically valid Go. This is the
+// CLI-repo-side confirmation that the cli.json spec is consumable.
+func TestCliJSONIsInterpretable(t *testing.T) {
+	raw, err := os.ReadFile(cliJSONPath)
+	if err != nil {
+		t.Fatalf("read %s: %v", cliJSONPath, err)
+	}
+
+	var doc fullDoc
+	if err := json.Unmarshal(raw, &doc); err != nil {
+		t.Fatalf("decode cli.json: %v", err)
+	}
+
+	// The spec SHA is not carried in cli.json metadata; genkit writes it to the
+	// sibling _openapi_sha file, the same convention every other SDK target uses.
+	shaBytes, err := os.ReadFile("../../.codegen/_openapi_sha")
+	if err != nil {
+		t.Fatalf("read _openapi_sha: %v", err)
+	}
+	if sha := strings.TrimSpace(string(shaBytes)); !shaRE.MatchString(sha) {
+		t.Errorf("_openapi_sha = %q, want a 40-char sha", sha)
+	}
+
+	// --- schemas block: non-empty, and every field ref points at a known schema ---
+	if len(doc.Schemas) == 0 {
+		t.Fatal("schemas block is empty")
+	}
+	for name, s := range doc.Schemas {
+		for fname, f := range s.Fields {
+			if f.Ref != "" {
+				if _, ok := doc.Schemas[f.Ref]; !ok {
+					t.Errorf("schema %s.%s: ref %q points at a missing schema", name, fname, f.Ref)
+				}
+			}
+		}
+	}
+
+	// --- commands block: present, resolvable, internally consistent ---
+	if doc.Commands == nil {
+		t.Fatal("commands block is nil")
+	}
+	cmds := doc.Commands
+	if err := cmds.Resolve(); err != nil {
+		t.Fatalf("resolve commands: %v", err)
+	}
+	if len(cmds.Services) == 0 {
+		t.Fatal("commands has no services")
+	}
+
+	// Two services rendering to the same path would silently overwrite each
+	// other's file (Generate writes them in order, last wins).
+	filenames := map[string]string{}
+	for _, s := range cmds.Services {
+		fn := serviceFilename(s)
+		if prev, ok := filenames[fn]; ok {
+			t.Errorf("services %s and %s both render to %s", prev, s.Name, fn)
+		}
+		filenames[fn] = s.Name
+	}
+
+	for _, s := range cmds.Services {
+		if s.Name == "" {
+			t.Errorf("service %q has empty name", s.ID)
+		}
+		if s.Package == nil || s.Package.Name == "" {
+			t.Errorf("service %s has no package name", s.Name)
+		}
+		if s.ParentServiceID != "" && s.ParentService == nil {
+			t.Errorf("service %s: parent_service_id %q did not resolve", s.Name, s.ParentServiceID)
+		}
+		if len(s.Subservices) != len(s.SubserviceIDs) {
+			t.Errorf("service %s: %d subservice ids but %d resolved", s.Name, len(s.SubserviceIDs), len(s.Subservices))
+		}
+		for _, m := range s.Methods {
+			if m.Name == "" {
+				t.Errorf("service %s has a method with empty name", s.Name)
+			}
+		}
+	}
+
+	// --- interpretation proof: every file renders to valid Go ---
+	serviceTmpl := parseTemplate("service", "templates/service.go.tmpl")
+	rendered := 0
+	for _, svc := range cmds.Services {
+		var sb strings.Builder
+		err := serviceTmpl.ExecuteTemplate(&sb, "service.go.tmpl", svc)
+		if errors.Is(err, ErrSkipThisFile) {
+			continue
+		}
+		if err != nil {
+			t.Errorf("render service %s: %v", svc.Name, err)
+			continue
+		}
+		if _, err := goformat.Source([]byte(sb.String())); err != nil {
+			t.Errorf("service %s rendered invalid Go: %v", svc.Name, err)
+		}
+		rendered++
+	}
+	if rendered == 0 {
+		t.Fatal("no services rendered")
+	}
+
+	for _, bf := range []struct{ name, path string }{
+		{"cmds-workspace.go.tmpl", "templates/cmds-workspace.go.tmpl"},
+		{"groups-workspace.go.tmpl", "templates/groups-workspace.go.tmpl"},
+		{"cmds-account.go.tmpl", "templates/cmds-account.go.tmpl"},
+		{"groups-account.go.tmpl", "templates/groups-account.go.tmpl"},
+	} {
+		var sb strings.Builder
+		tmpl := parseTemplate(bf.name, bf.path)
+		if err := tmpl.ExecuteTemplate(&sb, bf.name, cmds); err != nil {
+			t.Errorf("render %s: %v", bf.name, err)
+			continue
+		}
+		if _, err := goformat.Source([]byte(sb.String())); err != nil {
+			t.Errorf("%s rendered invalid Go: %v", bf.name, err)
+		}
+	}
+}
diff --git a/internal/cligen/cligen.go b/internal/cligen/cligen.go
new file mode 100644
index 00000000000..200392f8b68
--- /dev/null
+++ b/internal/cligen/cligen.go
@@ -0,0 +1,121 @@
+// Package cligen regenerates the CLI command stubs (cmd/workspace/** and
+// cmd/account/**) from the cli.json spec produced by genkit.
+//
+// It is the CLI-owned replacement for running genkit's cli_v0 generator against
+// a universe checkout: it renders templates derived from genkit's cli_v0
+// templates (templates/*.tmpl) against a model decoded from cli.json's
+// "commands" block, then formats the output in-process. It has no dependency on
+// genkit or any upstream spec at run time.
+package main
+
+import (
+	"errors"
+	"flag"
+	"fmt"
+	"log"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+
+	"github.com/databricks/cli/internal/clijson"
+)
+
+func main() {
+	input := flag.String("input", ".codegen/cli.json", "path to the cli.json spec")
+	output := flag.String("output", ".", "target directory (CLI repo root)")
+	flag.Parse()
+
+	files, err := Generate(*input, *output)
+	if err != nil {
+		log.Fatalf("cligen: %v", err)
+	}
+	if err := writeGitAttributes(*output, files); err != nil {
+		log.Fatalf("cligen: .gitattributes: %v", err)
+	}
+	for _, f := range files {
+		fmt.Println(f)
+	}
+}
+
+// writeGitAttributes writes .gitattributes marking the generated command files
+// as linguist-generated, mirroring genkit: the header comment comes from the
+// hand-maintained .gitattributes.manual, followed by the sorted file list.
+func writeGitAttributes(dir string, files []string) error {
+	header, err := os.ReadFile(filepath.Join(dir, ".gitattributes.manual"))
+	if err != nil {
+		return err
+	}
+	sorted := append([]string(nil), files...)
+	slices.Sort(sorted)
+	var sb strings.Builder
+	sb.Write(header)
+	for _, f := range sorted {
+		sb.WriteString(f)
+		sb.WriteString(" linguist-generated=true\n")
+	}
+	return os.WriteFile(filepath.Join(dir, ".gitattributes"), []byte(sb.String()), 0o644)
+}
+
+// Generate reads the cli.json spec at jsonPath and writes the command stubs
+// under targetDir. It returns the list of files written (relative to targetDir).
+func Generate(jsonPath, targetDir string) ([]string, error) {
+	doc, err := clijson.Parse(jsonPath)
+	if err != nil {
+		return nil, err
+	}
+	if doc.Commands == nil {
+		return nil, fmt.Errorf("%s: missing \"commands\" block", jsonPath)
+	}
+	batch := fromContract(doc.Commands)
+	if err := batch.Resolve(); err != nil {
+		return nil, fmt.Errorf("%s: %w", jsonPath, err)
+	}
+
+	var filenames []string
+
+	// Batch-level files (mirrors cliv0.Apply order).
+	batchFiles := []struct {
+		tmplName string
+		tmplFile string
+		out      string
+	}{
+		{"cmds-workspace.go.tmpl", "templates/cmds-workspace.go.tmpl", "cmd/workspace/cmd.go"},
+		{"groups-workspace.go.tmpl", "templates/groups-workspace.go.tmpl", "cmd/workspace/groups.go"},
+		{"cmds-account.go.tmpl", "templates/cmds-account.go.tmpl", "cmd/account/cmd.go"},
+		{"groups-account.go.tmpl", "templates/groups-account.go.tmpl", "cmd/account/groups.go"},
+	}
+	for _, bf := range batchFiles {
+		t := parseTemplate(bf.tmplName, bf.tmplFile)
+		if err := renderToFile(batch, t, bf.tmplName, filepath.Join(targetDir, bf.out)); err != nil {
+			return nil, fmt.Errorf("render %s: %w", bf.out, err)
+		}
+		filenames = append(filenames, bf.out)
+	}
+
+	// Per-service files.
+	serviceTmpl := parseTemplate("service", "templates/service.go.tmpl")
+	for _, svc := range batch.Services {
+		out := serviceFilename(svc)
+		err := renderToFile(svc, serviceTmpl, "service.go.tmpl", filepath.Join(targetDir, out))
+		if errors.Is(err, ErrSkipThisFile) {
+			continue
+		}
+		if err != nil {
+			return nil, fmt.Errorf("render %s: %w", out, err)
+		}
+		filenames = append(filenames, out)
+	}
+
+	return filenames, nil
+}
+
+// serviceFilename mirrors cliv0/service.go: account services go under
+// cmd/account/<name>/<name>.go, everything else under cmd/workspace/.
+func serviceFilename(s *ServiceJSON) string {
+	name := s.TrimPrefix("account").KebabName
+	if s.IsAccounts {
+		return fmt.Sprintf("cmd/account/%s/%s.go", name, name)
+	}
+	return fmt.Sprintf("cmd/workspace/%s/%s.go", name, name)
+}
diff --git a/internal/cligen/comment.go b/internal/cligen/comment.go
new file mode 100644
index 00000000000..016cabbe8c2
--- /dev/null
+++ b/internal/cligen/comment.go
@@ -0,0 +1,96 @@
+package main
+
+import (
+	"fmt"
+	"regexp"
+	"slices"
+	"strings"
+)
+
+// This file is a faithful copy of the comment/summary helpers from genkit's
+// codegen/code/named.go. The CLI owns this rendering logic so that command
+// stubs can be regenerated from cli.json without depending on genkit. The
+// cli.json spec carries raw Name/Description/Summary; the wrapping below must
+// match genkit byte-for-byte.
+
+var whitespace = regexp.MustCompile(`\s+`)
+
+// markdownLink matches markdown links, ignoring new lines.
+var markdownLink = regexp.MustCompile(`\[([^\]]+)\]\(([^\)]+)\)`)
+
+// sentences splits a description into sentences on ". ", normalizing whitespace.
+func sentences(description string) []string {
+	if description == "" {
+		return []string{}
+	}
+	norm := whitespace.ReplaceAllString(description, " ")
+	trimmed := strings.TrimSpace(norm)
+	return strings.Split(trimmed, ". ")
+}
+
+// summarize returns the first sentence from the description, always ending in a
+// dot. Mirrors Named.Summary in genkit.
+func summarize(description string) string {
+	s := sentences(description)
+	if len(s) > 0 {
+		return strings.TrimSuffix(s[0], ".") + "."
+	}
+	return ""
+}
+
+// commentWrap formats a description into a language-specific multi-line comment.
+// Mirrors Named.Comment(prefix, maxLen) in genkit.
+func commentWrap(description, prefix string, maxLen int) string {
+	if description == "" {
+		return ""
+	}
+	trimmed := strings.TrimSpace(description)
+	// Collect links, which are later sorted and appended at the bottom.
+	links := map[string]string{}
+	for _, m := range markdownLink.FindAllStringSubmatch(trimmed, -1) {
+		label := strings.TrimSpace(m[1])
+		link := strings.TrimSpace(m[2])
+		if !strings.HasPrefix(link, "http") {
+			// This condition is here until the spec normalizes all links.
+			continue
+		}
+		// Overriding links handles duplicates and yields alphabetical ordering below.
+		links[label] = link
+		// Replace [text](url) with [text].
+		trimmed = strings.ReplaceAll(trimmed, m[0], fmt.Sprintf("[%s]", label))
+	}
+	var linksInBottom []string
+	for k, v := range links {
+		linksInBottom = append(linksInBottom, fmt.Sprintf("[%s]: %s", k, v))
+	}
+	slices.Sort(linksInBottom)
+	// Fix new-line characters.
+	trimmed = strings.ReplaceAll(trimmed, "\\n", "\n")
+	description = strings.ReplaceAll(trimmed, "\n\n", " __BLANK__ ")
+	var lines []string
+	currentLine := strings.Builder{}
+	for _, v := range whitespace.Split(description, -1) {
+		if v == "__BLANK__" {
+			lines = append(lines, currentLine.String())
+			lines = append(lines, "")
+			currentLine.Reset()
+			continue
+		}
+		if len(prefix)+currentLine.Len()+len(v)+1 > maxLen {
+			lines = append(lines, currentLine.String())
+			currentLine.Reset()
+		}
+		if currentLine.Len() > 0 {
+			currentLine.WriteRune(' ')
+		}
+		currentLine.WriteString(v)
+	}
+	if currentLine.Len() > 0 {
+		lines = append(lines, currentLine.String())
+		currentLine.Reset()
+	}
+	if len(linksInBottom) > 0 {
+		lines = append(append(lines, ""), linksInBottom...)
+	}
+	return strings.TrimLeft(prefix, "\t ") + strings.Join(lines, "\n"+prefix)
+}
diff --git a/internal/cligen/format.go b/internal/cligen/format.go
new file mode 100644
index 00000000000..930add7f9dd
--- /dev/null
+++ b/internal/cligen/format.go
@@ -0,0 +1,66 @@
+package main
+
+import (
+	"go/ast"
+	"go/format"
+	"go/parser"
+	"go/token"
+	"path"
+	"strconv"
+	"strings"
+)
+
+// formatSource returns gofmt-formatted src with unused imports removed. It
+// replaces the goimports+gofmt pass genkit ran over the generated files, which
+// dominated generation time (goimports rescans the module for every fix). The
+// templates emit a fixed import block covering every package any branch may
+// reference, so formatting only ever needs to delete imports, never add them.
+func formatSource(src []byte) ([]byte, error) {
+	fset := token.NewFileSet()
+	f, err := parser.ParseFile(fset, "", src, parser.ParseComments)
+	if err != nil {
+		return nil, err
+	}
+
+	// An import is used iff its package name appears as a selector qualifier.
+	// Generated code never shadows an imported package name (locals are
+	// suffixed: xxxReq, xxxJson, xxxParam, ...), so this scan is exact.
+	used := make(map[string]bool)
+	ast.Inspect(f, func(n ast.Node) bool {
+		if sel, ok := n.(*ast.SelectorExpr); ok {
+			if id, ok := sel.X.(*ast.Ident); ok {
+				used[id.Name] = true
+			}
+		}
+		return true
+	})
+
+	drop := make(map[int]bool)
+	for _, imp := range f.Imports {
+		if !used[importName(imp)] {
+			for l := fset.Position(imp.Pos()).Line; l <= fset.Position(imp.End()).Line; l++ {
+				drop[l] = true
+			}
+		}
+	}
+
+	lines := strings.Split(string(src), "\n")
+	keep := lines[:0]
+	for i, line := range lines {
+		if !drop[i+1] {
+			keep = append(keep, line)
+		}
+	}
+	return format.Source([]byte(strings.Join(keep, "\n")))
+}
+
+// importName returns the identifier an import is referenced by: the explicit
+// name when present, the import path base otherwise. Every template import
+// either has base == package name or carries an explicit name.
+func importName(imp *ast.ImportSpec) string {
+	if imp.Name != nil {
+		return imp.Name.Name
+	}
+	p, _ := strconv.Unquote(imp.Path.Value)
+	return path.Base(p)
+}
diff --git a/internal/cligen/format_test.go b/internal/cligen/format_test.go
new file mode 100644
index 00000000000..4d946074903
--- /dev/null
+++ b/internal/cligen/format_test.go
@@ -0,0 +1,138 @@
+package main
+
+import (
+	"go/parser"
+	"go/token"
+	"slices"
+	"strconv"
+	"testing"
+)
+
+// importsOf re-parses formatted source and returns its import paths, asserting
+// the result is valid Go (formatSource must never emit something that won't
+// parse).
+func importsOf(t *testing.T, src []byte) []string {
+	t.Helper()
+	fset := token.NewFileSet()
+	f, err := parser.ParseFile(fset, "", src, 0)
+	if err != nil {
+		t.Fatalf("formatSource produced invalid Go: %v\n%s", err, src)
+	}
+	var paths []string
+	for _, imp := range f.Imports {
+		p, _ := strconv.Unquote(imp.Path.Value)
+		paths = append(paths, p)
+	}
+	return paths
+}
+
+func TestFormatSourcePrunesUnusedImports(t *testing.T) {
+	cases := []struct {
+		name string
+		in   string
+		want []string
+	}{
+		{
+			name: "drops unused, keeps selector-used",
+			in: `package p
+
+import (
+	"bytes"
+	"fmt"
+)
+
+var _ = fmt.Sprint
+`,
+			want: []string{"fmt"},
+		},
+		{
+			name: "keeps import used only as a type qualifier",
+			in: `package p
+
+import "bytes"
+
+var _ bytes.Buffer
+`,
+			want: []string{"bytes"},
+		},
+		{
+			name: "keeps aliased import used by alias, drops unused alias",
+			in: `package p
+
+import (
+	keep "bytes"
+	drop "strings"
+)
+
+var _ = keep.NewBuffer
+`,
+			want: []string{"bytes"},
+		},
+		{
+			// The reason every template import carries an explicit alias when its
+			// path base collides: prune keys on the referenced name, not the path.
+			name: "distinguishes packages sharing a path base via alias",
+			in: `package p
+
+import (
+	"time"
+	sdktime "example.test/sdk/time"
+)
+
+var _ = sdktime.Now
+`,
+			want: []string{"example.test/sdk/time"},
+		},
+		{
+			name: "drops an entire unused group",
+			in: `package p
+
+import (
+	"bytes"
+	"fmt"
+	"strings"
+)
+`,
+			want: nil,
+		},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			out, err := formatSource([]byte(c.in))
+			if err != nil {
+				t.Fatalf("formatSource: %v", err)
+			}
+			if got := importsOf(t, out); !slices.Equal(got, c.want) {
+				t.Errorf("imports = %v, want %v\noutput:\n%s", got, c.want, out)
+			}
+		})
+	}
+}
+
+func TestFormatSourceRejectsInvalidGo(t *testing.T) {
+	if _, err := formatSource([]byte("package p\nfunc (")); err == nil {
+		t.Fatal("expected an error for unparseable input, got nil")
+	}
+}
+
+func TestImportName(t *testing.T) {
+	src := `package p
+
+import (
+	"encoding/json"
+	"github.com/databricks/cli/libs/cmdio"
+	sdktime "github.com/databricks/databricks-sdk-go/common/types/time"
+)
+`
+	fset := token.NewFileSet()
+	f, err := parser.ParseFile(fset, "", src, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := []string{"json", "cmdio", "sdktime"}
+	for i, imp := range f.Imports {
+		if got := importName(imp); got != want[i] {
+			t.Errorf("importName(%s) = %q, want %q", imp.Path.Value, got, want[i])
+		}
+	}
+}
diff --git a/internal/cligen/model.go b/internal/cligen/model.go
new file mode 100644
index 00000000000..ae5ce44dd63
--- /dev/null
+++ b/internal/cligen/model.go
@@ -0,0 +1,355 @@
+package main
+
+import (
+	"fmt"
+	"slices"
+)
+
+// This file defines the CLI-side view of the "commands" block of the cli.json
+// spec. The structs mirror, field-for-field, the dot-paths that the templates
+// (templates/*.tmpl, derived from genkit's cliv0 templates) access.
+//
+// Design rules that keep output byte-for-byte identical to genkit:
+//   - Casings (Kebab/Pascal/Snake/Camel/Constant/Title) are derived at render
+//     time from the single stored `name` via the ported genkit name functions
+//     (names.go); only leaf references (PascalRef, FieldRef, NamedIdMapJSON,
+//     LROMethodRef) carry pre-resolved casing strings.
+//   - Comment-derived text (Summary, Comment, CliComment, HasComment) is NOT
+//     stored. It is derived here from the raw Description with the same pure
+//     helpers genkit uses (see comment.go), so it cannot drift.
+//   - Cross-references that form cycles in genkit's graph (ParentService,
+//     Subservices, RequestBodyField identity) are carried by name/reference and
+//     re-linked in Resolve() after decoding.
+
+// CommandsBlock is the batch-level root of the commands section.
+type CommandsBlock struct {
+	Services            []*ServiceJSON   `json:"services,omitempty"`
+	WorkspaceDocsGroups []*DocsGroupJSON `json:"workspace_docs_groups,omitempty"`
+	AccountDocsGroups   []*DocsGroupJSON `json:"account_docs_groups,omitempty"`
+
+	byID map[string]*ServiceJSON
+}
+
+// DocsGroupJSON is the docs-group shape read by groups-*.go.tmpl.
+type DocsGroupJSON struct {
+	Key         string `json:"key,omitempty"`
+	DisplayName string `json:"display_name,omitempty"`
+}
+
+// NameVariants is the value returned by (Service|Method).TrimPrefix; templates
+// access its SnakeName/KebabName/PascalName fields.
+type NameVariants struct {
+	SnakeName  string `json:"snake_name,omitempty"`
+	KebabName  string `json:"kebab_name,omitempty"`
+	PascalName string `json:"pascal_name,omitempty"`
+}
+
+// PackageRef backs .Package.Name.
+type PackageRef struct {
+	Name string `json:"name,omitempty"`
+}
+
+// PascalRef is a thin reference carrying only PascalName (e.g. request types).
+type PascalRef struct {
+	PascalName string `json:"pascal_name,omitempty"`
+}
+
+// NamedIdMapJSON backs $.List.NamedIdMap.PascalName.
+type NamedIdMapJSON struct {
+	PascalName string `json:"pascal_name,omitempty"`
+}
+
+// EnumEntryJSON backs printArray / supportedValues / wait success states.
+type EnumEntryJSON struct {
+	Content string `json:"content,omitempty"`
+}
+
+// ServiceListRefJSON is the slimmed view of a service's List method that the
+// template reads via $.List (NamedIdMap, IsLegacyEmptyRequest, Request).
+type ServiceListRefJSON struct {
+	NamedIdMap           *NamedIdMapJSON `json:"named_id_map,omitempty"`
+	IsLegacyEmptyRequest bool            `json:"is_legacy_empty_request,omitempty"`
+	Request              *PascalRef      `json:"request,omitempty"`
+}
+
+// ServiceJSON is the render context for service.go.tmpl.
+type ServiceJSON struct {
+	ID string `json:"id,omitempty"`
+
+	Name string `json:"name,omitempty"`
+
+	Description string      `json:"description,omitempty"`
+	Package     *PackageRef `json:"package,omitempty"`
+
+	IsAccounts     bool `json:"is_accounts,omitempty"`
+	HasParent      bool `json:"has_parent,omitempty"`
+	IsDataPlane    bool `json:"is_data_plane,omitempty"`
+	HasSubservices bool `json:"has_subservices,omitempty"`
+	IsHiddenCLI    bool `json:"is_hidden_cli,omitempty"`
+
+	DocsGroup string `json:"docs_group,omitempty"`
+
+	LaunchStage           string `json:"launch_stage,omitempty"`
+	CLILaunchStageLabel   string `json:"cli_launch_stage_label,omitempty"`
+	CLILaunchStageBanner  string `json:"cli_launch_stage_banner,omitempty"`
+	CLILaunchStageDisplay string `json:"cli_launch_stage_display,omitempty"`
+
+	ParentServiceID string              `json:"parent_service_id,omitempty"`
+	SubserviceIDs   []string            `json:"subservice_ids,omitempty"`
+	List            *ServiceListRefJSON `json:"list,omitempty"`
+	Methods         []*MethodJSON       `json:"methods,omitempty"`
+
+	// Re-linked in Resolve().
+	ParentService *ServiceJSON   `json:"-"`
+	Subservices   []*ServiceJSON `json:"-"`
+}
+
+// Casing methods derive from Name via the ported genkit name functions
+// (names.go), so the producer doesn't denormalize every variant into cli.json.
+func (s *ServiceJSON) KebabName() string  { return kebabName(s.Name) }
+func (s *ServiceJSON) SnakeName() string  { return snakeName(s.Name) }
+func (s *ServiceJSON) PascalName() string { return pascalName(s.Name) }
+func (s *ServiceJSON) TitleName() string  { return titleName(s.Name) }
+
+// TrimPrefix mirrors genkit Named.TrimPrefix: trim the prefix from the
+// camel-cased name, then expose the casings of the result.
+func (s *ServiceJSON) TrimPrefix(prefix string) NameVariants {
+	tn := trimPrefixName(s.Name, prefix)
+	return NameVariants{SnakeName: snakeName(tn), KebabName: kebabName(tn), PascalName: pascalName(tn)}
+}
+
+// Summary is the first sentence of the description; matches genkit Named.Summary.
+func (s *ServiceJSON) Summary() string { return summarize(s.Description) }
+
+// Comment wraps the description into a multi-line comment; matches Named.Comment.
+func (s *ServiceJSON) Comment(prefix string, maxLen int) string {
+	return commentWrap(s.Description, prefix, maxLen)
+}
+
+// MethodJSON is the render context for one command (a method of a service).
+type MethodJSON struct {
+	Name string `json:"name,omitempty"`
+
+	Description string `json:"description,omitempty"`
+	// Summary is the method's own summary, pre-resolved by the producer (unlike
+	// Service/Field, Method.Summary() reads a separate field, not the first
+	// sentence of the description).
+	Summary string `json:"summary,omitempty"`
+	Path    string `json:"path,omitempty"`
+
+	IsLegacyEmptyRequest           bool `json:"is_legacy_empty_request,omitempty"`
+	CanUseJson                     bool `json:"can_use_json,omitempty"`
+	MustUseJson                    bool `json:"must_use_json,omitempty"`
+	IsJsonOnly                     bool `json:"is_json_only,omitempty"`
+	IsCrudCreate                   bool `json:"is_crud_create,omitempty"`
+	IsCrudRead                     bool `json:"is_crud_read,omitempty"`
+	IsHiddenCLI                    bool `json:"is_hidden_cli,omitempty"`
+	IsResponseByteStream           bool `json:"is_response_byte_stream,omitempty"`
+	HasRequiredPositionalArguments bool `json:"has_required_positional_arguments,omitempty"`
+
+	LaunchStage           string `json:"launch_stage,omitempty"`
+	CLILaunchStageLabel   string `json:"cli_launch_stage_label,omitempty"`
+	CLILaunchStageBanner  string `json:"cli_launch_stage_banner,omitempty"`
+	CLILaunchStageDisplay string `json:"cli_launch_stage_display,omitempty"`
+
+	Request           *EntityJSON `json:"request,omitempty"`
+	RequestBodyField  *FieldJSON  `json:"request_body_field,omitempty"`
+	Response          *EntityJSON `json:"response,omitempty"`
+	ResponseBodyField *PascalRef  `json:"response_body_field,omitempty"`
+
+	AllFields                   []*FieldJSON `json:"all_fields,omitempty"`
+	RequiredPositionalArguments []*FieldJSON `json:"required_positional_arguments,omitempty"`
+
+	Pagination           *PaginationJSON `json:"pagination,omitempty"`
+	Wait                 *WaitJSON       `json:"wait,omitempty"`
+	LongRunningOperation *LROJSON        `json:"long_running_operation,omitempty"`
+}
+
+func (m *MethodJSON) KebabName() string  { return kebabName(m.Name) }
+func (m *MethodJSON) SnakeName() string  { return snakeName(m.Name) }
+func (m *MethodJSON) PascalName() string { return pascalName(m.Name) }
+func (m *MethodJSON) CamelName() string  { return camelName(m.Name) }
+
+// CliComment mirrors genkit Method.CliComment (method.go:139): prepend the
+// summary as its own paragraph when it differs from the description. Summary is
+// a pre-resolved field (see the struct), not derived from the description.
+func (m *MethodJSON) CliComment(prefix string, maxLen int) string {
+	description := m.Description
+	if m.Summary != "" && m.Summary != m.Description {
+		description = fmt.Sprintf("%s\n\n%s", m.Summary, description)
+	}
+	return commentWrap(description, prefix, maxLen)
+}
+
+// FieldJSON is one request field (flag or positional argument).
+type FieldJSON struct {
+	Name string `json:"name,omitempty"`
+
+	Description string `json:"description,omitempty"`
+
+	Required           bool `json:"required,omitempty"`
+	IsPath             bool `json:"is_path,omitempty"`
+	IsQuery            bool `json:"is_query,omitempty"`
+	IsComputed         bool `json:"is_computed,omitempty"`
+	IsOutputOnly       bool `json:"is_output_only,omitempty"`
+	IsRequestBodyField bool `json:"is_request_body_field,omitempty"`
+	IsOptionalObject   bool `json:"is_optional_object,omitempty"`
+
+	Entity *EntityJSON `json:"entity,omitempty"`
+}
+
+func (f *FieldJSON) KebabName() string    { return kebabName(f.Name) }
+func (f *FieldJSON) PascalName() string   { return pascalName(f.Name) }
+func (f *FieldJSON) CamelName() string    { return camelName(f.Name) }
+func (f *FieldJSON) ConstantName() string { return constantName(f.Name) }
+
+// Summary matches genkit Named.Summary.
+func (f *FieldJSON) Summary() string { return summarize(f.Description) }
+
+// HasComment matches genkit Named.HasComment.
+func (f *FieldJSON) HasComment() bool { return f.Description != "" }
+
+// Comment wraps the description; matches Named.Comment.
+func (f *FieldJSON) Comment(prefix string, maxLen int) string {
+	return commentWrap(f.Description, prefix, maxLen)
+}
+
+// EntityJSON is a value type (message, primitive, enum, array, map). The same
+// struct backs both request entities (which expose required-field collections)
+// and leaf field types (which expose only type predicates).
+type EntityJSON struct {
+	PascalName string `json:"pascal_name,omitempty"`
+
+	IsObject    bool `json:"is_object,omitempty"`
+	IsAny       bool `json:"is_any,omitempty"`
+	IsString    bool `json:"is_string,omitempty"`
+	IsBool      bool `json:"is_bool,omitempty"`
+	IsInt       bool `json:"is_int,omitempty"`
+	IsInt64     bool `json:"is_int64,omitempty"`
+	IsFloat64   bool `json:"is_float64,omitempty"`
+	IsDuration  bool `json:"is_duration,omitempty"`
+	IsTimestamp bool `json:"is_timestamp,omitempty"`
+	IsFieldMask bool `json:"is_field_mask,omitempty"`
+
+	// IsEmptyResponse marks a response that carries nothing renderable
+	// (google.protobuf.Empty or a legacy named-but-fieldless response).
+	IsEmptyResponse bool `json:"is_empty_response,omitempty"`
+
+	ArrayValue *EntityJSON      `json:"array_value,omitempty"`
+	MapValue   *EntityJSON      `json:"map_value,omitempty"`
+	Enum       []*EnumEntryJSON `json:"enum,omitempty"`
+
+	HasFieldMask                 bool `json:"has_field_mask,omitempty"`
+	HasRequiredRequestBodyFields bool `json:"has_required_request_body_fields,omitempty"`
+
+	RequiredFields            []*FieldJSON `json:"required_fields,omitempty"`
+	RequiredInUrlFields       []*FieldJSON `json:"required_in_url_fields,omitempty"`
+	RequiredRequestBodyFields []*FieldJSON `json:"required_request_body_fields,omitempty"`
+}
+
+// PaginationJSON backs .Pagination. Pagination fields are matched against
+// AllFields by Name in the template, so no pointer identity is required.
+type PaginationJSON struct {
+	Token      *TokenJSON `json:"token,omitempty"`
+	Offset     *FieldJSON `json:"offset,omitempty"`
+	Limit      *FieldJSON `json:"limit,omitempty"`
+	MaxResults *FieldJSON `json:"max_results,omitempty"`
+}
+
+// TokenJSON backs .Pagination.Token; only PollField is read.
+type TokenJSON struct {
+	PollField *FieldJSON `json:"poll_field,omitempty"`
+}
+
+// FieldRef is a thin reference for wait status/message path elements.
+type FieldRef struct {
+	PascalName string `json:"pascal_name,omitempty"`
+}
+
+// WaitJSON backs .Wait. Cross-references to the poll method are flattened to
+// the only datum templates read (its response type's PascalName).
+type WaitJSON struct {
+	Success            []*EnumEntryJSON `json:"success,omitempty"`
+	Timeout            int              `json:"timeout,omitempty"`
+	ComplexMessagePath bool             `json:"complex_message_path,omitempty"`
+	Poll               *PollJSON        `json:"poll,omitempty"`
+	StatusPath         []*FieldRef      `json:"status_path,omitempty"`
+	MessagePath        []*FieldRef      `json:"message_path,omitempty"`
+	MessagePathHead    *FieldRef        `json:"message_path_head,omitempty"`
+}
+
+// PollJSON backs .Wait.Poll.Response.PascalName.
+type PollJSON struct {
+	Response *PascalRef `json:"response,omitempty"`
+}
+
+// LROJSON backs .LongRunningOperation.
+type LROJSON struct {
+	GetOperation *LROMethodRef `json:"get_operation,omitempty"`
+	ResponseType *EntityRef    `json:"response_type,omitempty"`
+}
+
+// LROMethodRef backs .LongRunningOperation.GetOperation.{KebabName,PascalName,Request.PascalName}.
+type LROMethodRef struct {
+	KebabName  string     `json:"kebab_name,omitempty"`
+	PascalName string     `json:"pascal_name,omitempty"`
+	Request    *PascalRef `json:"request,omitempty"`
+}
+
+// EntityRef backs .LongRunningOperation.ResponseType.IsEmptyResponse.
+//
+// The producer computes IsEmptyResponse as "google.protobuf.Empty OR legacy
+// named-but-fieldless response", while genkit's LRO branch checked only the
+// former. No current LRO response is a legacy empty message (regeneration is
+// byte-identical), but an LRO that gains one would render its empty-response
+// branch where genkit would not.
+type EntityRef struct {
+	IsEmptyResponse bool `json:"is_empty_response,omitempty"`
+}
+
+// Resolve re-links cross-references after JSON decoding: builds the service
+// index, wires ParentService/Subservices pointers, and restores the pointer
+// identity between each method's RequestBodyField and its AllFields entry (the
+// service.go.tmpl `eq . $method.RequestBodyField` check relies on identity).
+// Any unresolved reference is an error: silently dropping a subservice or
+// keeping the decoded duplicate RequestBodyField pointer would render wrong
+// output (missing subcommands, request-body flags generated as plain flags)
+// without failing generation.
+func (c *CommandsBlock) Resolve() error {
+	c.byID = make(map[string]*ServiceJSON, len(c.Services))
+	for _, s := range c.Services {
+		if _, ok := c.byID[s.ID]; ok {
+			return fmt.Errorf("duplicate service id %q", s.ID)
+		}
+		c.byID[s.ID] = s
+	}
+	for _, s := range c.Services {
+		if s.ParentServiceID != "" {
+			s.ParentService = c.byID[s.ParentServiceID]
+			if s.ParentService == nil {
+				return fmt.Errorf("service %s: unknown parent service id %q", s.Name, s.ParentServiceID)
+			}
+		}
+		s.Subservices = s.Subservices[:0]
+		for _, id := range s.SubserviceIDs {
+			sub := c.byID[id]
+			if sub == nil {
+				return fmt.Errorf("service %s: unknown subservice id %q", s.Name, id)
+			}
+			s.Subservices = append(s.Subservices, sub)
+		}
+		for _, m := range s.Methods {
+			if m.RequestBodyField == nil {
+				continue
+			}
+			i := slices.IndexFunc(m.AllFields, func(f *FieldJSON) bool {
+				return f.Name == m.RequestBodyField.Name
+			})
+			if i < 0 {
+				return fmt.Errorf("service %s, method %s: request body field %q has no all_fields entry", s.Name, m.Name, m.RequestBodyField.Name)
+			}
+			m.RequestBodyField = m.AllFields[i]
+		}
+	}
+	return nil
+}
diff --git a/internal/cligen/names.go b/internal/cligen/names.go
new file mode 100644
index 00000000000..d73e7684c24
--- /dev/null
+++ b/internal/cligen/names.go
@@ -0,0 +1,79 @@
+package main
+
+import (
+	"strings"
+	"unicode"
+)
+
+// This file ports genkit's pure name-casing functions (codegen/code/named.go)
+// so the CLI can derive kebab/snake/pascal/camel/constant/title casings from a
+// single stored `name`, instead of the producer denormalizing every variant
+// into cli.json. The port must match genkit byte-for-byte; names_test.go pins
+// samples that were validated against genkit's output before the stored
+// casings were dropped from cli.json.
+
+// title mirrors strings.Title for the ASCII words splitASCII emits: it
+// uppercases each letter that begins a word. Like strings.Title's isSeparator,
+// digits are not separators, so a letter following a digit stays lowercase
+// ("ai21labs" -> "Ai21labs", matching the SDK's serving.Ai21labsApiKey).
+// Implemented directly to avoid the deprecated strings.Title and stay
+// lint-clean.
+func title(s string) string {
+	out := []rune(s)
+	prevIsSeparator := true
+	for i, r := range out {
+		if prevIsSeparator && unicode.IsLetter(r) {
+			out[i] = unicode.ToUpper(r)
+		}
+		prevIsSeparator = !unicode.IsLetter(r) && !unicode.IsDigit(r)
+	}
+	return string(out)
+}
+
+func pascalName(name string) string {
+	var sb strings.Builder
+	for _, w := range splitASCII(name) {
+		sb.WriteString(title(w))
+	}
+	return sb.String()
+}
+
+func titleName(name string) string {
+	words := splitASCII(name)
+	for i, w := range words {
+		words[i] = title(w)
+	}
+	return strings.Join(words, " ")
+}
+
+func camelName(name string) string {
+	if name == "" {
+		return ""
+	}
+	if name == "_" {
+		return "_"
+	}
+	cc := pascalName(name)
+	return strings.ToLower(cc[0:1]) + cc[1:]
+}
+
+func snakeName(name string) string {
+	if name == "_" {
+		return "_"
+	}
+	return strings.Join(splitASCII(name), "_")
+}
+
+func constantName(name string) string {
+	return strings.ToUpper(snakeName(name))
+}
+
+func kebabName(name string) string {
+	return strings.Join(splitASCII(name), "-")
+}
+
+// trimPrefixName mirrors Named.TrimPrefix: trims the prefix from the camel-cased
+// name and returns the resulting bare name (whose casings are derived as usual).
+func trimPrefixName(name, prefix string) string {
+	return strings.TrimPrefix(camelName(name), prefix)
+}
diff --git a/internal/cligen/names_test.go b/internal/cligen/names_test.go
new file mode 100644
index 00000000000..aa4bb93af06
--- /dev/null
+++ b/internal/cligen/names_test.go
@@ -0,0 +1,67 @@
+package main
+
+import "testing"
+
+// TestNameCasings guards the ported genkit name functions (names.go). The
+// producer no longer denormalizes casings into cliv1.json; cligen derives them
+// from the stored name, so these must match genkit exactly. The values below
+// were validated against genkit's output for all named objects in cliv1.json
+// before the stored casings were dropped.
+func TestNameCasings(t *testing.T) {
+	cases := []struct {
+		name, kebab, snake, pascal, camel, constant, title string
+	}{
+		{"JobSettings", "job-settings", "job_settings", "JobSettings", "jobSettings", "JOB_SETTINGS", "Job Settings"},
+		{"Workspace", "workspace", "workspace", "Workspace", "workspace", "WORKSPACE", "Workspace"},
+		{"IpAccessLists", "ip-access-lists", "ip_access_lists", "IpAccessLists", "ipAccessLists", "IP_ACCESS_LISTS", "Ip Access Lists"},
+		{"IamV2", "iam-v2", "iam_v2", "IamV2", "iamV2", "IAM_V2", "Iam V2"},
+		{"create_run", "create-run", "create_run", "CreateRun", "createRun", "CREATE_RUN", "Create Run"},
+		// Digit-then-letter: digits are not word separators (strings.Title
+		// semantics), so the letter after a digit stays lowercase. The Go SDK
+		// spells these fields the same way (e.g. serving.Ai21labsApiKey).
+		{"ai21labs_api_key", "ai21labs-api-key", "ai21labs_api_key", "Ai21labsApiKey", "ai21labsApiKey", "AI21LABS_API_KEY", "Ai21labs Api Key"},
+		{"oauth2client", "oauth2client", "oauth2client", "Oauth2client", "oauth2client", "OAUTH2CLIENT", "Oauth2client"},
+		// Consecutive-uppercase acronym: splitASCII splits before the last
+		// upper of a run when a lowercase follows.
+		{"HTMLParser", "html-parser", "html_parser", "HtmlParser", "htmlParser", "HTML_PARSER", "Html Parser"},
+		// Empty and "_" hit the special-cased early returns in camelName/snakeName;
+		// note kebab/title/pascal do not special-case them, so they differ.
+		{"", "", "", "", "", "", ""},
+		{"_", "", "_", "", "_", "_", ""},
+	}
+	for _, c := range cases {
+		if got := kebabName(c.name); got != c.kebab {
+			t.Errorf("kebabName(%q) = %q, want %q", c.name, got, c.kebab)
+		}
+		if got := snakeName(c.name); got != c.snake {
+			t.Errorf("snakeName(%q) = %q, want %q", c.name, got, c.snake)
+		}
+		if got := pascalName(c.name); got != c.pascal {
+			t.Errorf("pascalName(%q) = %q, want %q", c.name, got, c.pascal)
+		}
+		if got := camelName(c.name); got != c.camel {
+			t.Errorf("camelName(%q) = %q, want %q", c.name, got, c.camel)
+		}
+		if got := constantName(c.name); got != c.constant {
+			t.Errorf("constantName(%q) = %q, want %q", c.name, got, c.constant)
+		}
+		if got := titleName(c.name); got != c.title {
+			t.Errorf("titleName(%q) = %q, want %q", c.name, got, c.title)
+		}
+	}
+}
+
+// TestTrimPrefix guards Named.TrimPrefix("account") used for account services.
+func TestTrimPrefix(t *testing.T) {
+	cases := []struct{ name, want string }{
+		{"AccountMetastoreAssignments", "metastore-assignments"},
+		{"AccountStorageCredentials", "storage-credentials"},
+		{"Workspaces", "workspaces"}, // no "account" prefix: unchanged
+	}
+	for _, c := range cases {
+		tn := trimPrefixName(c.name, "account")
+		if got := kebabName(tn); got != c.want {
+			t.Errorf("kebabName(trimPrefix(%q,\"account\")) = %q, want %q", c.name, got, c.want)
+		}
+	}
+}
diff --git a/internal/cligen/render.go b/internal/cligen/render.go
new file mode 100644
index 00000000000..61828e3c65f
--- /dev/null
+++ b/internal/cligen/render.go
@@ -0,0 +1,103 @@
+package main
+
+import (
+	"embed"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"text/template"
+)
+
+//go:embed templates/*.tmpl
+var templates embed.FS
+
+// ErrSkipThisFile is panicked by the skipThisFile template helper and recovered
+// by callers to suppress generation of a file. Mirrors genkit's render package.
+var ErrSkipThisFile = errors.New("skip generating this file")
+
+// helperFuncs holds the template helpers actually referenced by the cliv0
+// templates (templates/*.tmpl). It derives from genkit's render.HelperFuncs but
+// drops every helper no template uses, so the set must stay in sync with the
+// templates: an unreferenced helper here is dead, and a referenced-but-missing
+// one fails rendering loudly.
+var helperFuncs = template.FuncMap{
+	"lower": strings.ToLower,
+	"trimSuffix": func(right, left string) string {
+		return strings.TrimSuffix(left, right)
+	},
+	"without": func(left, right string) string {
+		return strings.ReplaceAll(right, left, "")
+	},
+	"skipThisFile": func() error {
+		// The error is rendered as a string in the resulting file, so we must
+		// panic and let callers handle it via errors.Is(err, ErrSkipThisFile).
+		panic(ErrSkipThisFile)
+	},
+	"list": func(l ...any) []any {
+		return l
+	},
+	"in": func(haystack []any, needle string) bool {
+		for _, v := range haystack {
+			if needle == fmt.Sprint(v) {
+				return true
+			}
+		}
+		return false
+	},
+	"dict": func(args ...any) map[string]any {
+		if len(args)%2 != 0 {
+			panic("number of arguments to dict is not even")
+		}
+		result := map[string]any{}
+		for i := 0; i < len(args); i += 2 {
+			k := fmt.Sprint(args[i])
+			v := args[i+1]
+			result[k] = v
+		}
+		return result
+	},
+}
+
+func parseTemplate(name, path string) *template.Template {
+	t := template.New(name).Funcs(helperFuncs)
+	return template.Must(t.ParseFS(templates, path))
+}
+
+// renderToFile renders the named template with data, normalizes whitespace,
+// formats the result (formatSource), and writes it to fileName. A skipThisFile
+// panic during rendering surfaces as an error that callers match with
+// errors.Is(err, ErrSkipThisFile). Whitespace is normalized before formatting so
+// that indentation-only template lines become empty lines, which gofmt treats as
+// import group separators; gofmt introduces no trailing whitespace of its own
+// (raw string contents are already clean).
+func renderToFile(data any, t *template.Template, templateName, fileName string) error {
+	sb := strings.Builder{}
+	if err := t.ExecuteTemplate(&sb, templateName, data); err != nil {
+		return err
+	}
+	src, err := formatSource([]byte(stripTrailingWhitespace(sb.String())))
+	if err != nil {
+		return err
+	}
+	if err := os.MkdirAll(filepath.Dir(fileName), 0o755); err != nil {
+		return err
+	}
+	return os.WriteFile(fileName, src, 0o644)
+}
+
+// stripTrailingWhitespace removes trailing whitespace from every line and
+// normalizes the file to end in exactly one newline. The committed command
+// files are whitespace-normalized (tools/validate_whitespace.py); genkit relied
+// on a separate `task ws` pass for this, cligen produces clean output directly.
+// Note this also normalizes inside raw string literals (help text), where the
+// templates and genkit's comment wrapping leave trailing spaces and
+// whitespace-only paragraph breaks.
+func stripTrailingWhitespace(s string) string {
+	lines := strings.Split(s, "\n")
+	for i, line := range lines {
+		lines[i] = strings.TrimRight(line, " \t")
+	}
+	return strings.TrimRight(strings.Join(lines, "\n"), "\n") + "\n"
+}
diff --git a/internal/cligen/render_test.go b/internal/cligen/render_test.go
new file mode 100644
index 00000000000..1525a28d439
--- /dev/null
+++ b/internal/cligen/render_test.go
@@ -0,0 +1,26 @@
+package main
+
+import "testing"
+
+// TestTemplatesParse ensures every copied template parses against helperFuncs.
+// text/template requires every called function to be registered at parse time,
+// so this fails fast if a template references a helper missing from helperFuncs.
+func TestTemplatesParse(t *testing.T) {
+	cases := []struct{ name, path string }{
+		{"service", "templates/service.go.tmpl"},
+		{"cmds-workspace.go.tmpl", "templates/cmds-workspace.go.tmpl"},
+		{"groups-workspace.go.tmpl", "templates/groups-workspace.go.tmpl"},
+		{"cmds-account.go.tmpl", "templates/cmds-account.go.tmpl"},
+		{"groups-account.go.tmpl", "templates/groups-account.go.tmpl"},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			defer func() {
+				if r := recover(); r != nil {
+					t.Fatalf("parsing %s panicked: %v", c.path, r)
+				}
+			}()
+			_ = parseTemplate(c.name, c.path)
+		})
+	}
+}
diff --git a/internal/cligen/split.go b/internal/cligen/split.go
new file mode 100644
index 00000000000..950db714e5a
--- /dev/null
+++ b/internal/cligen/split.go
@@ -0,0 +1,82 @@
+package main
+
+import "unicode"
+
+// This file holds the name-splitting engine ported from genkit's
+// codegen/code/named.go. The casing helpers in names.go all build on splitASCII.
+
+func searchNearest(name string, cond func(rune) bool, forward bool, i int) bool {
+	incr := 1
+	if !forward {
+		incr = -1
+	}
+	for j := i; j >= 0 && j < len(name); j += incr {
+		if unicode.IsLetter(rune(name[j])) {
+			return cond(rune(name[j]))
+		}
+	}
+	return false
+}
+
+func condAtNearestLetters(name string, cond func(rune) bool, i int) bool {
+	r := rune(name[i])
+	if unicode.IsLetter(r) {
+		return cond(r)
+	}
+	return searchNearest(name, cond, true, i) && searchNearest(name, cond, false, i)
+}
+
+// splitASCII is a faithful port of genkit Named.splitASCII: it splits a name
+// into lowercased words at case boundaries and separators, emulating the JVM
+// lookahead regex genkit documents.
+func splitASCII(name string) (w []string) {
+	var current []rune
+	nameLen := len(name)
+	var isPrevUpper bool
+	for i := range nameLen {
+		r := rune(name[i])
+		if r == '$' {
+			continue
+		}
+		isCurrentUpper := condAtNearestLetters(name, unicode.IsUpper, i)
+		r = unicode.ToLower(r)
+		isNextLower := false
+		isNextUpper := false
+		isNotLastChar := i+1 < nameLen
+		if isNotLastChar {
+			isNextLower = condAtNearestLetters(name, unicode.IsLower, i+1)
+			isNextUpper = condAtNearestLetters(name, unicode.IsUpper, i+1)
+		}
+		split, before, after := false, false, true
+		if isPrevUpper && isCurrentUpper && isNextLower && isNotLastChar {
+			split = true
+			before = false
+			after = true
+		}
+		if !isCurrentUpper && isNextUpper {
+			split = true
+			before = true
+			after = false
+		}
+		if !unicode.IsLetter(r) && !unicode.IsNumber(r) {
+			split = true
+			before = false
+			after = false
+		}
+		if before {
+			current = append(current, r)
+		}
+		if split && len(current) > 0 {
+			w = append(w, string(current))
+			current = []rune{}
+		}
+		if after {
+			current = append(current, r)
+		}
+		isPrevUpper = isCurrentUpper
+	}
+	if len(current) > 0 {
+		w = append(w, string(current))
+	}
+	return w
+}
diff --git a/internal/cligen/split_test.go b/internal/cligen/split_test.go
new file mode 100644
index 00000000000..3b6218cb7c7
--- /dev/null
+++ b/internal/cligen/split_test.go
@@ -0,0 +1,72 @@
+package main
+
+import (
+	"reflect"
+	"testing"
+)
+
+// TestSplitASCII pins the exact behavior of splitASCII (names.go), the engine
+// behind every casing function. splitASCII is a faithful port of genkit's
+// Named.splitASCII, which emulates a JVM lookahead/lookbehind regex by scanning
+// for the nearest letter in both directions. These cases document the
+// non-obvious consequences of that emulation, which a simpler reimplementation
+// (e.g. Go's lookaround-free regexp) would not reproduce.
+func TestSplitASCII(t *testing.T) {
+	cases := []struct {
+		in   string
+		want []string
+	}{
+		// Empty and separator-only inputs yield no words.
+		{"", nil},
+		{"_", nil},
+		{"__", nil},
+
+		// '$' is dropped entirely, joining its neighbors.
+		{"foo$bar", []string{"foobar"}},
+		{"$foo", []string{"foo"}},
+
+		// Single words, any casing, lowercased output.
+		{"a", []string{"a"}},
+		{"A", []string{"a"}},
+		{"AB", []string{"ab"}},
+		{"ABC", []string{"abc"}},
+		{"Abc", []string{"abc"}},
+		{"Workspace", []string{"workspace"}},
+
+		// Plain camel/Pascal and separator splits.
+		{"JobSettings", []string{"job", "settings"}},
+		{"IpAccessLists", []string{"ip", "access", "lists"}},
+		{"create_run", []string{"create", "run"}},
+		{"snake_case_name", []string{"snake", "case", "name"}},
+
+		// Acronym tail: the last capital of a run starts the next word when it is
+		// followed by a lowercase letter.
+		{"HTTPSConnection", []string{"https", "connection"}},
+		{"ServeMLModel", []string{"serve", "ml", "model"}},
+		{"ABCDef", []string{"abc", "def"}},
+		{"GetByID", []string{"get", "by", "id"}},
+		{"DefABC", []string{"def", "abc"}},
+
+		// Acronym head quirk: a leading capital splits off alone when the run is
+		// exactly two capitals followed by lowercase (the lookahead can't see far
+		// enough to keep them together)...
+		{"ABc", []string{"a", "bc"}},
+		{"AItool", []string{"a", "itool"}},
+		{"MLflow", []string{"m", "lflow"}},
+		// ...but three+ capitals before lowercase keep the run intact.
+		{"AIService", []string{"ai", "service"}},
+
+		// Digits attach to the preceding word; they never start a word.
+		{"IamV2", []string{"iam", "v2"}},
+		{"AccountGroupsV2", []string{"account", "groups", "v2"}},
+		{"HTTP2Server", []string{"http2", "server"}},
+		{"OAuth2Config", []string{"o", "auth2", "config"}},
+		{"UUID4", []string{"uuid4"}},
+		{"a1b2", []string{"a1b2"}},
+	}
+	for _, c := range cases {
+		if got := splitASCII(c.in); !reflect.DeepEqual(got, c.want) {
+			t.Errorf("splitASCII(%q) = %#v, want %#v", c.in, got, c.want)
+		}
+	}
+}
diff --git a/internal/cligen/templates/cmds-account.go.tmpl b/internal/cligen/templates/cmds-account.go.tmpl
new file mode 100644
index 00000000000..b368d3218bf
--- /dev/null
+++ b/internal/cligen/templates/cmds-account.go.tmpl
@@ -0,0 +1,31 @@
+// Code generated from OpenAPI specs by Databricks SDK Generator. DO NOT EDIT.
+
+package account
+
+{{$excludes := list}}
+
+import (
+	"github.com/spf13/cobra"
+	{{range .Services}}{{if and .IsAccounts (not .HasParent) (not .IsDataPlane)}}{{if not (in $excludes .KebabName) }}
+	{{.SnakeName}} "github.com/databricks/cli/cmd/account/{{(.TrimPrefix "account").KebabName}}"{{end}}{{end}}{{end}}
+
+	account_groups "github.com/databricks/cli/cmd/account/groups"
+	account_service_principals "github.com/databricks/cli/cmd/account/service-principals"
+	account_users "github.com/databricks/cli/cmd/account/users"
+)
+
+func New() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "account",
+		Short: `Databricks Account Commands`,
+	}
+
+	{{range .Services}}{{if and .IsAccounts (not .HasParent) (not .IsDataPlane)}}{{if not (in $excludes .KebabName) -}}
+	cmd.AddCommand({{.SnakeName}}.New())
+	{{end}}{{end}}{{end}}
+	cmd.AddCommand(account_groups.New())
+	cmd.AddCommand(account_service_principals.New())
+	cmd.AddCommand(account_users.New())
+
+	return cmd
+}
diff --git a/internal/cligen/templates/cmds-workspace.go.tmpl b/internal/cligen/templates/cmds-workspace.go.tmpl
new file mode 100644
index 00000000000..6e748488893
--- /dev/null
+++ b/internal/cligen/templates/cmds-workspace.go.tmpl
@@ -0,0 +1,36 @@
+// Code generated from OpenAPI specs by Databricks SDK Generator. DO NOT EDIT.
+
+package workspace
+
+{{ $excludes :=
+	list
+		"command-execution"
+		"statement-execution"
+		"dbfs"
+		"dbsql-permissions"
+		"account-access-control-proxy"
+		"files"
+}}
+
+import (
+	{{- range .Services}}{{if and (not .IsAccounts) (not .HasParent) (not .IsDataPlane)}}{{if not (in $excludes .KebabName) }}
+	{{.SnakeName}} "github.com/databricks/cli/cmd/workspace/{{.KebabName}}"{{end}}{{end}}{{end}}
+	"github.com/spf13/cobra"
+
+	groups "github.com/databricks/cli/cmd/workspace/groups"
+	service_principals "github.com/databricks/cli/cmd/workspace/service-principals"
+	users "github.com/databricks/cli/cmd/workspace/users"
+)
+
+func All() []*cobra.Command {
+	var out []*cobra.Command
+
+	{{range .Services}}{{if and (not .IsAccounts) (not .HasParent) (not .IsDataPlane)}}{{if not (in $excludes .KebabName) -}}
+	out = append(out, {{.SnakeName}}.New())
+	{{end}}{{end}}{{end}}
+    out = append(out, groups.New())
+    out = append(out, service_principals.New())
+    out = append(out, users.New())
+
+	return out
+}
diff --git a/internal/cligen/templates/groups-account.go.tmpl b/internal/cligen/templates/groups-account.go.tmpl
new file mode 100644
index 00000000000..7aad9730fc4
--- /dev/null
+++ b/internal/cligen/templates/groups-account.go.tmpl
@@ -0,0 +1,18 @@
+// Code generated from OpenAPI specs by Databricks SDK Generator. DO NOT EDIT.
+
+package account
+
+import (
+	"github.com/spf13/cobra"
+)
+
+func Groups() []cobra.Group {
+	return []cobra.Group{
+{{- range .AccountDocsGroups}}
+		{
+			ID:    "{{.Key}}",
+			Title: "{{.DisplayName}}",
+		},
+{{- end}}
+	}
+}
diff --git a/internal/cligen/templates/groups-workspace.go.tmpl b/internal/cligen/templates/groups-workspace.go.tmpl
new file mode 100644
index 00000000000..fde8e53a38e
--- /dev/null
+++ b/internal/cligen/templates/groups-workspace.go.tmpl
@@ -0,0 +1,18 @@
+// Code generated from OpenAPI specs by Databricks SDK Generator. DO NOT EDIT.
+
+package workspace
+
+import (
+	"github.com/spf13/cobra"
+)
+
+func Groups() []cobra.Group {
+	return []cobra.Group{
+{{- range .WorkspaceDocsGroups}}
+		{
+			ID:    "{{.Key}}",
+			Title: "{{.DisplayName}}",
+		},
+{{- end}}
+	}
+}
diff --git a/internal/cligen/templates/service.go.tmpl b/internal/cligen/templates/service.go.tmpl
new file mode 100644
index 00000000000..f17bcedde67
--- /dev/null
+++ b/internal/cligen/templates/service.go.tmpl
@@ -0,0 +1,637 @@
+// Code generated from OpenAPI specs by Databricks SDK Generator. DO NOT EDIT.
+
+package {{(.TrimPrefix "account").SnakeName}}
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/databricks-sdk-go/experimental/api"
+	"github.com/databricks/databricks-sdk-go/common/types/duration"
+	"github.com/databricks/databricks-sdk-go/common/types/fieldmask"
+	sdktime "github.com/databricks/databricks-sdk-go/common/types/time"
+	"github.com/databricks/databricks-sdk-go/service/{{.Package.Name}}"
+	"github.com/spf13/cobra"
+
+	{{range .Subservices -}}
+	{{.SnakeName}} "github.com/databricks/cli/cmd/{{ if .ParentService.IsAccounts }}account{{ else }}workspace{{ end }}/{{.KebabName}}"
+	{{end}}
+)
+
+{{ $excludes :=
+	list
+		"command-execution"
+		"statement-execution"
+		"dbfs"
+		"dbsql-permissions"
+		"account-access-control-proxy"
+		"files"
+		"serving-endpoints-data-plane"
+}}
+
+{{if not (in $excludes .KebabName) }}
+	{{template "service" .}}
+{{else}}
+	{{skipThisFile}}
+{{end}}
+
+{{define "printArray" -}}
+{{if le (len .) 5 -}}
+	[{{range $index, $element := .}}{{if ne $index 0}}, {{end}}{{$element.Content}}{{end}}]
+{{- else -}}[{{range $index, $element := .}}
+  {{$element.Content}},{{end}}
+]{{end}}{{end}}
+
+{{define "supportedValuesForPositionalArg"}}
+      Supported values: {{if le (len .) 5 -}}
+	[{{range $index, $element := .}}{{if ne $index 0}}, {{end}}{{$element.Content}}{{end}}]
+{{- else -}}[{{range $index, $element := .}}
+        {{$element.Content}},{{end}}
+      ]{{end}}{{end}}
+
+{{define "service"}}
+{{- $excludeMethods := list "put-secret" -}}
+{{- $hideService := .IsHiddenCLI }}
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var cmdOverrides []func(*cobra.Command)
+
+func New() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "{{(.TrimPrefix "account").KebabName}}",
+		{{- if .Description }}
+		Short: `{{with .CLILaunchStageLabel}}{{.}} {{end}}{{.Summary | without "`"}}`,
+		Long: `{{with .CLILaunchStageBanner}}{{.}}
+
+{{end}}{{.Comment  "  " 80 | without "`"}}`,
+		{{- end }}
+		{{- if not .HasParent }}
+		{{- if .DocsGroup }}
+		GroupID: "{{ .DocsGroup }}",
+		{{- else }}
+		GroupID: "{{ .Package.Name }}",
+		{{- end }}
+		{{- end }}
+		{{- if $hideService }}
+
+		// This service is being previewed; hide from help output.
+		Hidden: true,
+		{{- end }}
+		RunE: root.ReportUnknownSubcommand,
+	}
+	{{- if .LaunchStage }}
+
+	cmd.Annotations = make(map[string]string)
+	cmd.Annotations["launch_stage"] = "{{.LaunchStage}}"
+	cmd.Annotations["launch_stage_display"] = "{{.CLILaunchStageDisplay}}"
+	{{- end }}
+
+	{{ if gt (len .Methods) 0 -}}
+	// Add methods
+	{{- range .Methods}}
+		{{- if in $excludeMethods .KebabName }}
+			{{- continue}}
+		{{- end}}
+		cmd.AddCommand(new{{.PascalName}}())
+	{{- end}}
+	{{- end}}
+
+	{{ if .HasSubservices }}
+	// Add subservices
+	{{- range .Subservices}}
+	cmd.AddCommand({{.SnakeName}}.New())
+	{{- end}}
+	{{- end}}
+
+	// Apply optional overrides to this command.
+	for _, fn := range cmdOverrides {
+		fn(cmd)
+	}
+
+	return cmd
+}
+
+{{- $serviceName := .KebabName -}}
+{{range .Methods}}
+
+{{if in $excludeMethods .KebabName }}
+	{{continue}}
+{{end}}
+// start {{.KebabName}} command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var {{.CamelName}}Overrides []func(
+	*cobra.Command,
+	{{- if not .IsLegacyEmptyRequest }}
+	*{{$.Package.Name}}.{{.Request.PascalName}},
+	{{- end }}
+)
+
+{{- $excludeFromJson := list "http-request"}}
+
+func new{{.PascalName}}() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	{{- $canUseJson := and .CanUseJson (not (in $excludeFromJson .KebabName )) -}}
+	{{- if not .IsLegacyEmptyRequest}}
+
+	var {{.CamelName}}Req {{$.Package.Name}}.{{.Request.PascalName}}
+	{{- if .RequestBodyField }}
+	{{.CamelName}}Req.{{.RequestBodyField.PascalName}} = {{ if .RequestBodyField.IsOptionalObject }}&{{end}}{{$.Package.Name}}.{{.RequestBodyField.Entity.PascalName}}{}
+	{{- end }}
+	{{- if $canUseJson}}
+	var {{.CamelName}}Json flags.JsonFlag
+	{{- end}}
+	{{- end}}
+	{{- if .Pagination }}
+	// Registered for all paginated methods. Validated at call time in the
+	// method-call template. Paginated list methods never have Wait or LRO
+	// branches, so the method-call path is always reached.
+	var {{.CamelName}}Limit int
+	{{- end}}
+	{{- if or .Wait .LongRunningOperation }}
+
+	var {{.CamelName}}SkipWait bool
+	var {{.CamelName}}Timeout time.Duration
+	{{- end}}
+
+	{{- if .LongRunningOperation }}
+
+	cmd.Flags().BoolVar(&{{.CamelName}}SkipWait, "no-wait", {{.CamelName}}SkipWait, `do not wait to reach DONE state`)
+	cmd.Flags().DurationVar(&{{.CamelName}}Timeout, "timeout", 0, `maximum amount of time to reach DONE state`)
+	{{- else if .Wait }}
+
+	cmd.Flags().BoolVar(&{{.CamelName}}SkipWait, "no-wait", {{.CamelName}}SkipWait, `do not wait to reach {{range $i, $e := .Wait.Success}}{{if $i}} or {{end}}{{.Content}}{{end}} state`)
+	cmd.Flags().DurationVar(&{{.CamelName}}Timeout, "timeout", {{.Wait.Timeout}}*time.Minute, `maximum amount of time to reach {{range $i, $e := .Wait.Success}}{{if $i}} or {{end}}{{.Content}}{{end}} state`)
+	{{- end }}
+	{{- $request := .Request -}}
+	{{- if .RequestBodyField -}}
+	{{- $request = .RequestBodyField.Entity -}}
+	{{- end -}}
+    {{if $request }}
+	{{- if $canUseJson}}
+
+	cmd.Flags().Var(&{{.CamelName}}Json, "json", `either inline JSON string or @path/to/file.json with request body`)
+	{{- end}}
+    {{$method := .}}
+	{{ if not .IsJsonOnly }}
+	{{- $hasFieldMask := $request.HasFieldMask -}}
+	{{- /* Whether a page_size field exists; a deprecated `limit` alias is dropped
+	       below when it does, to avoid two flags claiming --page-size. */ -}}
+	{{- $hasPageSize := false -}}
+	{{- range .AllFields }}{{- if and (not .Required) (eq .KebabName "page-size") }}{{- $hasPageSize = true -}}{{- end -}}{{- end -}}
+	{{range .AllFields -}}
+		{{- if not .Required -}}
+			{{- /* clusters/events special case: cli.json models its pagination as
+			       token-only (page_token), while genkit's cli_v0 modeled it as
+			       offset/limit. To keep the rendered flags byte-identical, page_token
+			       is left to regular (visible) flag generation here and the legacy
+			       offset/limit fields are skipped instead; the "Hidden pagination
+			       flags" block below has the matching special case. Keyed on the
+			       method path, so it stops applying if that path ever changes. */ -}}
+			{{- if and $method.Pagination (or
+				(and (and $method.Pagination.Token $method.Pagination.Token.PollField) (eq .Name $method.Pagination.Token.PollField.Name) (not (eq $method.Path "/api/2.1/clusters/events")))
+				(and $method.Pagination.Offset (eq .Name $method.Pagination.Offset.Name))
+				(and $method.Pagination.Limit (eq .Name $method.Pagination.Limit.Name))
+				(and $method.Pagination.MaxResults (eq .Name $method.Pagination.MaxResults.Name))
+				(and (eq $method.Path "/api/2.1/clusters/events") (or (eq .Name "offset") (eq .Name "limit")))
+			) -}}
+			{{- /* Skip pagination fields; they are generated separately below. */ -}}
+			{{else if and $method.Pagination (eq .KebabName "limit") $hasPageSize -}}
+			{{- /* Deprecated `limit` alias for `page_size`: skip when the method also has
+			       a page_size field, which owns --page-size; rendering both collides. */ -}}
+			{{else if and $method.Pagination (eq .KebabName "limit") -}}
+			{{- /* The API field is named "limit" but isn't a declared pagination field
+			       (e.g. jobs.List.Limit). Rename to --page-size to avoid colliding with
+			       the --limit result capping flag. */ -}}
+	cmd.Flags().{{template "arg-type" .Entity}}(&{{- template "request-body-obj" (dict "Method" $method "Field" .)}}, "page-size", {{- template "request-body-obj" (dict "Method" $method "Field" .)}}, `{{.Summary | without "`" | trimSuffix "."}}{{if .Summary}}.{{end}}`)
+	cmd.Flags().Lookup("page-size").Hidden = true
+			{{else if .Entity.IsObject}}{{if not (eq . $method.RequestBodyField) }}// TODO: complex arg: {{.Name}}{{end}}
+			{{else if .Entity.IsAny }}// TODO: any: {{.Name}}
+			{{else if .Entity.ArrayValue }}// TODO: array: {{.Name}}
+			{{else if .Entity.MapValue }}// TODO: map via StringToStringVar: {{.Name}}
+			{{else if .IsComputed -}}
+			{{else if .IsOutputOnly -}}
+			{{else if .Entity.Enum }}cmd.Flags().Var(&{{- template "request-body-obj" (dict "Method" $method "Field" .)}}, "{{.KebabName}}", `{{.Summary | without "`" | trimSuffix "."}}{{if .Summary}}. {{end}}Supported values: {{template "printArray" .Entity.Enum}}{{if $hasFieldMask}}. Wire name: '{{.Name}}'.{{end}}`)
+			{{else if or .Entity.IsDuration .Entity.IsTimestamp .Entity.IsFieldMask}} var {{.CamelName}}Param string
+			cmd.Flags().StringVar(&{{.CamelName}}Param, "{{.KebabName}}", {{.CamelName}}Param, `{{.Summary | without "`" | trimSuffix "."}}{{if .Summary}}.{{end}}{{if $hasFieldMask}} Wire name: '{{.Name}}'.{{end}}`)
+			{{else}}cmd.Flags().{{template "arg-type" .Entity}}(&{{- template "request-body-obj" (dict "Method" $method "Field" .)}}, "{{.KebabName}}", {{- template "request-body-obj" (dict "Method" $method "Field" .)}}, `{{.Summary | without "`" | trimSuffix "."}}{{if .Summary}}.{{end}}{{if $hasFieldMask}} Wire name: '{{.Name}}'.{{end}}`)
+			{{end}}
+		{{- end -}}
+	{{- end}}
+	{{- end}}
+	{{end}}
+	{{- if .Pagination }}
+
+	// Limit flag for total result capping.
+	cmd.Flags().IntVar(&{{.CamelName}}Limit, "limit", 0, `Maximum number of results to return.`)
+
+	// Hidden pagination flags (internal API parameters).
+	{{- /* clusters/events: render the legacy offset field as the hidden flag,
+	       matching cli_v0's offset/limit pagination model; see the note in the
+	       flag-skip block above. */ -}}
+	{{- if eq .Path "/api/2.1/clusters/events" }}
+	{{- $method := . }}
+	{{- range .AllFields }}{{ if eq .Name "offset" }}
+	cmd.Flags().{{template "arg-type" .Entity}}(&{{$method.CamelName}}Req.{{.PascalName}}, "{{.KebabName}}", {{$method.CamelName}}Req.{{.PascalName}}, `{{.Summary | without "`" | trimSuffix "."}}{{if .Summary}}.{{end}}`)
+	cmd.Flags().Lookup("{{.KebabName}}").Hidden = true
+	{{- end }}{{ end }}
+	{{- else if and .Pagination.Token .Pagination.Token.PollField }}
+	cmd.Flags().{{template "arg-type" .Pagination.Token.PollField.Entity}}(&{{.CamelName}}Req.{{.Pagination.Token.PollField.PascalName}}, "{{.Pagination.Token.PollField.KebabName}}", {{.CamelName}}Req.{{.Pagination.Token.PollField.PascalName}}, `Pagination token.`)
+	cmd.Flags().Lookup("{{.Pagination.Token.PollField.KebabName}}").Hidden = true
+	{{- end }}
+	{{- if .Pagination.Offset }}
+	cmd.Flags().{{template "arg-type" .Pagination.Offset.Entity}}(&{{.CamelName}}Req.{{.Pagination.Offset.PascalName}}, "{{.Pagination.Offset.KebabName}}", {{.CamelName}}Req.{{.Pagination.Offset.PascalName}}, `{{.Pagination.Offset.Summary | without "`" | trimSuffix "."}}{{if .Pagination.Offset.Summary}}.{{end}}`)
+	cmd.Flags().Lookup("{{.Pagination.Offset.KebabName}}").Hidden = true
+	{{- end }}
+	{{- if .Pagination.Limit }}
+	{{- if ne .Pagination.Limit.KebabName "limit" }}
+	cmd.Flags().{{template "arg-type" .Pagination.Limit.Entity}}(&{{.CamelName}}Req.{{.Pagination.Limit.PascalName}}, "{{.Pagination.Limit.KebabName}}", {{.CamelName}}Req.{{.Pagination.Limit.PascalName}}, `Number of results per API page.`)
+	cmd.Flags().Lookup("{{.Pagination.Limit.KebabName}}").Hidden = true
+	{{- end }}
+	{{- end }}
+	{{- if .Pagination.MaxResults }}
+	cmd.Flags().{{template "arg-type" .Pagination.MaxResults.Entity}}(&{{.CamelName}}Req.{{.Pagination.MaxResults.PascalName}}, "{{.Pagination.MaxResults.KebabName}}", {{.CamelName}}Req.{{.Pagination.MaxResults.PascalName}}, `{{.Pagination.MaxResults.Summary | without "`" | trimSuffix "."}}{{if .Pagination.MaxResults.Summary}}.{{end}}`)
+	cmd.Flags().Lookup("{{.Pagination.MaxResults.KebabName}}").Hidden = true
+	{{- end }}
+	{{- end }}
+
+	{{- $excludeFromPrompts := list
+		"workspace get-status"
+		"provider-exchanges get"
+		"provider-exchanges delete"
+		"provider-exchanges delete-listing-from-exchange"
+		"provider-exchanges list-exchanges-for-listing"
+		"provider-exchanges list-listings-for-exchange"
+		"storage-credentials get"
+		-}}
+	{{- $fullCommandName := (print $serviceName " " .KebabName) -}}
+	{{- $noPrompt := or .IsCrudCreate (in $excludeFromPrompts $fullCommandName) }}
+
+	{{- $hasPosArgs := .HasRequiredPositionalArguments -}}
+	{{- $hasSinglePosArg := and $hasPosArgs (and (eq 1 (len .RequiredPositionalArguments)) (eq 1 (len $request.RequiredFields))) -}}
+	{{- $serviceHasNamedIdMap := and (and $.List $.List.NamedIdMap) (not (eq .PascalName "List")) -}}
+	{{- $hasIdPrompt := and (not $noPrompt) (and $hasSinglePosArg $serviceHasNamedIdMap) -}}
+	{{- $wait := and .Wait (and (not .IsCrudRead) (not (eq .SnakeName "get_run"))) -}}
+	{{- $hasRequiredArgs :=  and (not $hasIdPrompt) $hasPosArgs -}}
+	{{- $hasSingleRequiredRequestBodyFieldWithPrompt := and (and $hasIdPrompt $request) (eq 1 (len $request.RequiredRequestBodyFields))  -}}
+	{{- $onlyInUrlArgsRequiredAsPositionalArguments := and (not .IsLegacyEmptyRequest) (eq (len .RequiredPositionalArguments) (len .Request.RequiredInUrlFields)) -}}
+	{{- $hasDifferentArgsWithJsonFlag := and (not $onlyInUrlArgsRequiredAsPositionalArguments) (and $canUseJson (or $request.HasRequiredRequestBodyFields )) -}}
+	{{- $hasCustomArgHandler := or $hasRequiredArgs $hasDifferentArgsWithJsonFlag -}}
+
+	{{- $atleastOneArgumentWithDescription := false -}}
+	{{- if $hasPosArgs -}}
+		{{- range .RequiredPositionalArguments -}}
+			{{- if .HasComment -}}
+				{{- $atleastOneArgumentWithDescription = true -}}
+				{{- break -}}
+			{{- end -}}
+		{{- end -}}
+	{{- end }}
+
+	cmd.Use = "{{.KebabName}}{{if $hasPosArgs}}{{range .RequiredPositionalArguments}} {{.ConstantName}}{{end}}{{end}}"
+	{{- if .CliComment  "  " 80 }}
+	cmd.Short = `{{with .CLILaunchStageLabel}}{{.}} {{end}}{{.Summary | without "`"}}`
+	cmd.Long = `{{with .CLILaunchStageBanner}}{{.}}
+
+{{end}}{{.CliComment  "  " 80 | without "`"}}
+	{{- if .LongRunningOperation }}
+
+  This is a long-running operation. By default, the command waits for the
+  operation to complete. Use --no-wait to return immediately with the raw
+  operation details. The operation's 'name' field can then be used to poll for
+  completion using the {{.LongRunningOperation.GetOperation.KebabName}} command.
+	{{- end }}
+	{{- if $atleastOneArgumentWithDescription }}
+
+  Arguments:
+    {{- range .RequiredPositionalArguments }}
+    {{ .ConstantName }}: {{.Comment "      " 80 | without "`"}}{{- if .Entity.Enum }} {{template "supportedValuesForPositionalArg" .Entity.Enum}} {{- end -}}
+    {{- end -}}
+    {{- end -}}
+	`
+	{{- end }}
+	{{/* Don't hide commands if the service itself is already hidden. */}}
+	{{- if and (not $hideService) .IsHiddenCLI }}
+
+	// This command is being previewed; hide from help output.
+	cmd.Hidden = true
+	{{- end }}
+
+	cmd.Annotations = make(map[string]string)
+	{{- if .LaunchStage }}
+	cmd.Annotations["launch_stage"] = "{{.LaunchStage}}"
+	cmd.Annotations["launch_stage_display"] = "{{.CLILaunchStageDisplay}}"
+	{{- end }}
+	{{ if $hasCustomArgHandler }}
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		{{- if $hasDifferentArgsWithJsonFlag }}
+		if cmd.Flags().Changed("json") {
+			err := root.ExactArgs({{len .Request.RequiredInUrlFields}})(cmd, args)
+			if err != nil {
+			{{- if eq 0 (len .Request.RequiredInUrlFields) }}
+				return errors.New("when --json flag is specified, no positional arguments are allowed. Provide{{- range $index, $field := $request.RequiredFields}}{{if $index}},{{end}} '{{$field.Name}}'{{end}} in your JSON input")
+			{{- else }}
+				return errors.New("when --json flag is specified, provide only{{- range $index, $field := .Request.RequiredInUrlFields}}{{if $index}},{{end}} {{$field.ConstantName}}{{end}} as positional arguments. Provide{{- range $index, $field := $request.RequiredRequestBodyFields}}{{if $index}},{{end}} '{{$field.Name}}'{{end}} in your JSON input")
+			{{- end }}
+			}
+			return nil
+		}
+		{{- end }}
+		{{- if $hasRequiredArgs }}
+		check := root.ExactArgs({{len .RequiredPositionalArguments}})
+		return check(cmd, args)
+		{{- else}}
+		return nil
+		{{- end }}
+	}
+	{{ end }}
+	cmd.PreRunE = root.Must{{if $.IsAccounts}}Account{{else}}Workspace{{end}}Client
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		{{if $.IsAccounts}}a := cmdctx.AccountClient(ctx){{else}}w := cmdctx.WorkspaceClient(ctx){{end}}
+		{{- if not .IsLegacyEmptyRequest }}
+			{{ if $canUseJson }}
+			if cmd.Flags().Changed("json") {
+					diags := {{.CamelName}}Json.Unmarshal(&{{.CamelName}}Req{{ if .RequestBodyField }}.{{.RequestBodyField.PascalName}}{{ end }})
+					if diags.HasError() {
+						return diags.Error()
+					}
+					if len(diags) > 0 {
+						err := cmdio.RenderDiagnostics(ctx, diags)
+						if err != nil {
+							return err
+						}
+					}
+			}{{end}}{{ if .MustUseJson }}else {
+				return errors.New("please provide command input in JSON format by specifying the --json flag")
+			}{{- end}}
+			{{- if $hasPosArgs }}
+			{{- if and $canUseJson $hasSingleRequiredRequestBodyFieldWithPrompt }} else {
+			{{- end}}
+			{{- if $hasIdPrompt}}
+				if len(args) == 0 {
+					sp := cmdio.NewSpinner(ctx)
+					sp.Update("No{{range $request.RequiredFields}} {{.ConstantName}}{{end}} argument specified. Loading names for {{$.TitleName}} drop-down.")
+					names, err := {{if $.IsAccounts}}a{{else}}w{{end}}.{{($.TrimPrefix "account").PascalName}}.{{$.List.NamedIdMap.PascalName}}(ctx{{if not $.List.IsLegacyEmptyRequest}}, {{$.Package.Name}}.{{$.List.Request.PascalName}}{}{{end}})
+					sp.Close()
+					if err != nil {
+						return fmt.Errorf("failed to load names for {{$.TitleName}} drop-down. Please manually specify required arguments. Original error: %w", err)
+					}
+					id, err := cmdio.Select(ctx, names, "{{range $request.RequiredFields}}{{.Summary | trimSuffix "."}}{{end}}")
+					if err != nil {
+						return err
+					}
+					args = append(args, id)
+				}
+				if len(args) != 1 {
+					return errors.New("expected to have {{range $request.RequiredFields}}{{.Summary | trimSuffix "." | lower}}{{end}}")
+				}
+			{{- end -}}
+
+			{{$method := .}}
+			{{- range $arg, $field := .RequiredPositionalArguments}}
+				{{- template "args-scan" (dict "Arg" $arg "Field" $field "Method" $method "HasIdPrompt" $hasIdPrompt "ExcludeFromJson" $excludeFromJson)}}
+			{{- end -}}
+			{{- range .AllFields -}}
+			{{- if and (not .Required) (not .IsComputed) (not .IsOutputOnly)}}
+				{{if or .Entity.IsDuration .Entity.IsTimestamp .Entity.IsFieldMask}}
+			        if {{.CamelName}}Param != "" {
+						{{template "parse-well-known-type" (dict "Method" $method "Field" . "SourceValue" (printf "%sParam" .CamelName))}}
+				    }
+				{{- end -}}
+			{{- end -}}
+			{{- end -}}
+			{{- if and $canUseJson $hasSingleRequiredRequestBodyFieldWithPrompt }}
+			}
+			{{- end}}
+
+			{{- end}}
+		{{end}}
+		{{if .LongRunningOperation -}}
+		// Determine which mode to execute based on flags.
+		switch {
+		case {{.CamelName}}SkipWait:
+			wait, err := {{if $.IsAccounts}}a{{else}}w{{end}}.{{$.PascalName}}.{{.PascalName}}(ctx{{if not .IsLegacyEmptyRequest}}, {{.CamelName}}Req{{end}})
+			if err != nil {
+				return err
+			}
+
+			// Return operation immediately without waiting.
+			operation, err := {{if $.IsAccounts}}a{{else}}w{{end}}.{{$.PascalName}}.{{.LongRunningOperation.GetOperation.PascalName}}(ctx, {{$.Package.Name}}.{{.LongRunningOperation.GetOperation.Request.PascalName}}{
+				Name: wait.Name(),
+			})
+			if err != nil {
+				return err
+			}
+			return cmdio.Render(ctx, operation)
+
+		default:
+			wait, err := {{if $.IsAccounts}}a{{else}}w{{end}}.{{$.PascalName}}.{{.PascalName}}(ctx{{if not .IsLegacyEmptyRequest}}, {{.CamelName}}Req{{end}})
+			if err != nil {
+				return err
+			}
+
+			// Show spinner while waiting for completion.
+			sp := cmdio.NewSpinner(ctx)
+			sp.Update("Waiting for {{.KebabName}} to complete...")
+
+			// Wait for completion.
+			opts := api.WithTimeout({{.CamelName}}Timeout)
+			{{ if not .LongRunningOperation.ResponseType.IsEmptyResponse -}}
+			response, err := wait.Wait(ctx, opts)
+			{{- else }}
+			err = wait.Wait(ctx, opts)
+			{{- end }}
+			if err != nil {
+				return err
+			}
+			sp.Close()
+			{{if not .LongRunningOperation.ResponseType.IsEmptyResponse -}}
+			return cmdio.Render(ctx, response)
+			{{- else -}}
+			return nil
+			{{- end }}
+		}
+		{{else if $wait -}}
+		wait, err := {{if $.IsAccounts}}a{{else}}w{{end}}.{{$.PascalName}}.{{.PascalName}}(ctx{{if not .IsLegacyEmptyRequest}}, {{.CamelName}}Req{{end}})
+		if err != nil {
+			return err
+		}
+		if {{.CamelName}}SkipWait {
+			{{if not .Response.IsEmptyResponse -}}
+			return cmdio.Render(ctx, wait.Response)
+			{{- else -}}
+			return nil
+			{{- end}}
+		}
+		sp := cmdio.NewSpinner(ctx)
+		info, err := wait.OnProgress(func(i *{{$.Package.Name}}.{{.Wait.Poll.Response.PascalName}}) {
+			{{if .Wait.MessagePath -}}
+			{{if .Wait.ComplexMessagePath -}}
+			if i.{{.Wait.MessagePathHead.PascalName}} == nil {
+				return
+			}
+			status := i{{range .Wait.StatusPath}}.{{.PascalName}}{{end}}
+			statusMessage := fmt.Sprintf("current status: %s", status)
+			if i.{{.Wait.MessagePathHead.PascalName}} != nil {
+				statusMessage = i{{range .Wait.MessagePath}}.{{.PascalName}}{{end}}
+			}
+			{{- else -}}
+			statusMessage := i{{range .Wait.MessagePath}}.{{.PascalName}}{{end}}
+			{{- end}}
+			{{- else -}}
+			status := i{{range .Wait.StatusPath}}.{{.PascalName}}{{end}}
+			statusMessage := fmt.Sprintf("current status: %s", status)
+			{{- end}}
+			sp.Update(statusMessage)
+		}).GetWithTimeout({{.CamelName}}Timeout)
+		sp.Close()
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, info)
+		{{- else -}}
+		{{template "method-call" (dict "Method" . "Service" $)}}
+		{{end -}}
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range {{.CamelName}}Overrides {
+		fn(cmd{{if not .IsLegacyEmptyRequest}}, &{{.CamelName}}Req{{end}})
+	}
+
+	return cmd
+}
+
+{{end}}
+// end service {{.Name}}{{end}}
+
+{{- define "method-call" -}}
+	{{- $method := .Method -}}
+	{{- $service := .Service -}}
+
+		{{if not $method.Response.IsEmptyResponse -}}
+		  response{{ if not $method.Pagination}}, err{{end}} :=
+		{{- else -}}
+		  err =
+		{{- end}}
+		{{- if $service.IsAccounts}}a{{else}}w{{end}}.
+		{{- if $service.HasParent }}
+			{{- ($service.ParentService.TrimPrefix "account").PascalName }}.
+			{{- ($service.TrimPrefix "account").PascalName}}().
+		{{- else}}
+			{{- ($service.TrimPrefix "account").PascalName}}.
+		{{- end}}
+		{{- $method.PascalName}}(ctx{{if not $method.IsLegacyEmptyRequest}}, {{$method.CamelName}}Req{{end}})
+		{{- if not (and $method.Response $method.Pagination) }}
+		if err != nil {
+			return err
+		}
+		{{- end}}
+		{{ if not $method.Response.IsEmptyResponse -}}
+			{{- if $method.Pagination -}}
+			if {{$method.CamelName}}Limit < 0 {
+				return fmt.Errorf("--limit must be a non-negative integer, got %d", {{$method.CamelName}}Limit)
+			}
+			if {{$method.CamelName}}Limit > 0 {
+				ctx = cmdio.WithLimit(ctx, {{$method.CamelName}}Limit)
+			}
+			{{- end }}
+			{{ if $method.IsResponseByteStream -}}
+			defer response.{{$method.ResponseBodyField.PascalName}}.Close()
+			return cmdio.Render{{ if $method.Pagination}}Iterator{{end}}(ctx, response.{{$method.ResponseBodyField.PascalName}})
+			{{- else }}
+			return cmdio.Render{{ if $method.Pagination}}Iterator{{end}}(ctx, response)
+			{{- end -}}
+		{{ else -}}
+		return nil
+		{{- end -}}
+{{- end -}}
+
+{{- define "arg-type" -}}
+	{{- if .IsString}}StringVar
+	{{- /* The following Well Known Types are expressed as strings in JSON */}}
+	{{- else if .IsTimestamp}}StringVar
+	{{- else if .IsDuration}}StringVar
+	{{- else if .IsFieldMask}}StringVar
+	{{- else if .IsBool}}BoolVar
+	{{- else if .IsInt64}}Int64Var
+	{{- else if .IsFloat64}}Float64Var
+	{{- else if .IsInt}}IntVar
+	{{- else if .Enum }}StringVar
+	{{- else}}/* NOT PRIMITIVE */
+	{{- end -}}
+{{- end -}}
+
+{{- define "parse-well-known-type" -}}
+	{{- $field := .Field -}}
+	{{- $method := .Method -}}
+	{{- $sourceValue := .SourceValue -}}
+	{{- if $field.Entity.IsTimestamp -}}
+		{{$field.CamelName}}Bytes := []byte(fmt.Sprintf("\"%s\"", {{$sourceValue}}))
+		var {{$field.CamelName}}Field sdktime.Time
+		err = json.Unmarshal({{$field.CamelName}}Bytes, &{{$field.CamelName}}Field)
+		if err != nil {
+			return fmt.Errorf("invalid {{$field.ConstantName}}: %s", {{$sourceValue}})
+		}
+		{{template "request-body-obj" (dict "Method" $method "Field" $field)}} = {{if not $field.Required}}&{{end}}{{$field.CamelName}}Field
+	{{- else if $field.Entity.IsDuration -}}
+		{{$field.CamelName}}Bytes := []byte(fmt.Sprintf("\"%s\"", {{$sourceValue}}))
+		var {{$field.CamelName}}Field duration.Duration
+		err = json.Unmarshal({{$field.CamelName}}Bytes, &{{$field.CamelName}}Field)
+		if err != nil {
+			return fmt.Errorf("invalid {{$field.ConstantName}}: %s", {{$sourceValue}})
+		}
+		{{template "request-body-obj" (dict "Method" $method "Field" $field)}} = {{if not $field.Required}}&{{end}}{{$field.CamelName}}Field
+	{{- else if $field.Entity.IsFieldMask -}}
+		{{$field.CamelName}}Array := strings.Split({{$sourceValue}}, ",")
+		{{template "request-body-obj" (dict "Method" $method "Field" $field)}} = {{if $field.Required}}*{{end}}fieldmask.New({{$field.CamelName}}Array)
+	{{- end -}}
+{{- end -}}
+
+{{- define "args-scan" -}}
+	{{- $field := .Field -}}
+	{{- $method := .Method -}}
+	{{- $arg := .Arg -}}
+	{{- $hasIdPrompt := .HasIdPrompt -}}
+	{{ $canUseJson := and $method.CanUseJson (not (in .ExcludeFromJson $method.KebabName)) }}
+	{{- $optionalIfJsonIsUsed := and (not $hasIdPrompt) (and $field.IsRequestBodyField $canUseJson) }}
+	{{- if $optionalIfJsonIsUsed  }}
+	if !cmd.Flags().Changed("json") {
+	{{- end }}
+	{{if and (not $field.Entity.IsString) (not $field.Entity.IsFieldMask) (not $field.Entity.IsTimestamp) (not $field.Entity.IsDuration) -}}
+	_, err = fmt.Sscan(args[{{$arg}}], &{{- template "request-body-obj" (dict "Method" $method "Field" $field)}})
+	if err != nil {
+		return fmt.Errorf("invalid {{$field.ConstantName}}: %s", args[{{$arg}}])
+	}
+	{{else if or $field.Entity.IsTimestamp $field.Entity.IsDuration $field.Entity.IsFieldMask -}}
+	if args[{{$arg}}] != "" {
+		{{template "parse-well-known-type" (dict "Method" $method "Field" $field "SourceValue" (printf "args[%d]" $arg))}}
+	}
+	{{- else -}}
+	{{- template "request-body-obj" (dict "Method" $method "Field" $field)}} = args[{{$arg}}]
+	{{- end -}}
+	{{- if $optionalIfJsonIsUsed  }}
+	}
+	{{- end }}
+{{- end -}}
+
+{{- define "request-body-obj" -}}
+	{{- $method := .Method -}}
+	{{- $field := .Field -}}
+	{{$method.CamelName}}Req{{ if (and $method.RequestBodyField (and (not $field.IsPath) (not $field.IsQuery))) }}.{{$method.RequestBodyField.PascalName}}{{end}}.{{$field.PascalName}}
+{{- end -}}
diff --git a/internal/cligen/transform.go b/internal/cligen/transform.go
new file mode 100644
index 00000000000..ea7864877e0
--- /dev/null
+++ b/internal/cligen/transform.go
@@ -0,0 +1,265 @@
+package main
+
+import "github.com/databricks/cli/internal/clijson"
+
+// fromContract converts the canonical commands block (decoded from cli.json into
+// the verbatim contract types in internal/clijson) into the CLI's render model.
+//
+// clijson is the single source of truth for the wire shape; this transform is
+// the one place that reads it, so a contract change surfaces here as a compile
+// error rather than silent drift. Render-only state — the byID index, the
+// ParentService/Subservices links, RequestBodyField pointer identity, and
+// noPrompt — is left zero here and populated by CommandsBlock.Resolve().
+func fromContract(c *clijson.CommandsBlock) *CommandsBlock {
+	if c == nil {
+		return nil
+	}
+	return &CommandsBlock{
+		Services:            mapSlice(c.Services, fromService),
+		WorkspaceDocsGroups: mapSlice(c.WorkspaceDocsGroups, fromDocsGroup),
+		AccountDocsGroups:   mapSlice(c.AccountDocsGroups, fromDocsGroup),
+	}
+}
+
+// mapSlice maps src through f, preserving nil so that omitempty fields stay
+// absent rather than becoming an empty slice.
+func mapSlice[S, D any](src []S, f func(S) D) []D {
+	if src == nil {
+		return nil
+	}
+	out := make([]D, len(src))
+	for i, v := range src {
+		out[i] = f(v)
+	}
+	return out
+}
+
+func fromDocsGroup(d *clijson.DocsGroupJSON) *DocsGroupJSON {
+	if d == nil {
+		return nil
+	}
+	return &DocsGroupJSON{Key: d.Key, DisplayName: d.DisplayName}
+}
+
+func fromPackageRef(p *clijson.PackageRef) *PackageRef {
+	if p == nil {
+		return nil
+	}
+	return &PackageRef{Name: p.Name}
+}
+
+func fromPascalRef(p *clijson.PascalRef) *PascalRef {
+	if p == nil {
+		return nil
+	}
+	return &PascalRef{PascalName: p.PascalName}
+}
+
+// fromNamedIdMap and fromFieldRef map the contract's PascalRef onto the render
+// model's distinct-but-identically-shaped NamedIdMapJSON / FieldRef types.
+func fromNamedIdMap(p *clijson.PascalRef) *NamedIdMapJSON {
+	if p == nil {
+		return nil
+	}
+	return &NamedIdMapJSON{PascalName: p.PascalName}
+}
+
+func fromFieldRef(p *clijson.PascalRef) *FieldRef {
+	if p == nil {
+		return nil
+	}
+	return &FieldRef{PascalName: p.PascalName}
+}
+
+func fromEnumEntry(e *clijson.EnumEntryJSON) *EnumEntryJSON {
+	if e == nil {
+		return nil
+	}
+	return &EnumEntryJSON{Content: e.Content}
+}
+
+func fromServiceListRef(l *clijson.ServiceListRefJSON) *ServiceListRefJSON {
+	if l == nil {
+		return nil
+	}
+	return &ServiceListRefJSON{
+		NamedIdMap:           fromNamedIdMap(l.NamedIdMap),
+		IsLegacyEmptyRequest: l.IsLegacyEmptyRequest,
+		Request:              fromPascalRef(l.Request),
+	}
+}
+
+func fromService(s *clijson.ServiceJSON) *ServiceJSON {
+	if s == nil {
+		return nil
+	}
+	return &ServiceJSON{
+		ID:                    s.ID,
+		Name:                  s.Name,
+		Description:           s.Description,
+		Package:               fromPackageRef(s.Package),
+		IsAccounts:            s.IsAccounts,
+		HasParent:             s.HasParent,
+		IsDataPlane:           s.IsDataPlane,
+		HasSubservices:        s.HasSubservices,
+		IsHiddenCLI:           s.IsHiddenCLI,
+		DocsGroup:             s.DocsGroup,
+		LaunchStage:           s.LaunchStage,
+		CLILaunchStageLabel:   s.CLILaunchStageLabel,
+		CLILaunchStageBanner:  s.CLILaunchStageBanner,
+		CLILaunchStageDisplay: s.CLILaunchStageDisplay,
+		ParentServiceID:       s.ParentServiceID,
+		SubserviceIDs:         s.SubserviceIDs,
+		List:                  fromServiceListRef(s.List),
+		Methods:               mapSlice(s.Methods, fromMethod),
+	}
+}
+
+func fromMethod(m *clijson.MethodJSON) *MethodJSON {
+	if m == nil {
+		return nil
+	}
+	return &MethodJSON{
+		Name:                           m.Name,
+		Description:                    m.Description,
+		Summary:                        m.Summary,
+		Path:                           m.Path,
+		IsLegacyEmptyRequest:           m.IsLegacyEmptyRequest,
+		CanUseJson:                     m.CanUseJson,
+		MustUseJson:                    m.MustUseJson,
+		IsJsonOnly:                     m.IsJsonOnly,
+		IsCrudCreate:                   m.IsCrudCreate,
+		IsCrudRead:                     m.IsCrudRead,
+		IsHiddenCLI:                    m.IsHiddenCLI,
+		IsResponseByteStream:           m.IsResponseByteStream,
+		HasRequiredPositionalArguments: m.HasRequiredPositionalArguments,
+		LaunchStage:                    m.LaunchStage,
+		CLILaunchStageLabel:            m.CLILaunchStageLabel,
+		CLILaunchStageBanner:           m.CLILaunchStageBanner,
+		CLILaunchStageDisplay:          m.CLILaunchStageDisplay,
+		Request:                        fromEntity(m.Request),
+		RequestBodyField:               fromField(m.RequestBodyField),
+		Response:                       fromEntity(m.Response),
+		ResponseBodyField:              fromPascalRef(m.ResponseBodyField),
+		AllFields:                      mapSlice(m.AllFields, fromField),
+		RequiredPositionalArguments:    mapSlice(m.RequiredPositionalArguments, fromField),
+		Pagination:                     fromPagination(m.Pagination),
+		Wait:                           fromWait(m.Wait),
+		LongRunningOperation:           fromLRO(m.LongRunningOperation),
+	}
+}
+
+func fromField(f *clijson.FieldJSON) *FieldJSON {
+	if f == nil {
+		return nil
+	}
+	return &FieldJSON{
+		Name:               f.Name,
+		Description:        f.Description,
+		Required:           f.Required,
+		IsPath:             f.IsPath,
+		IsQuery:            f.IsQuery,
+		IsComputed:         f.IsComputed,
+		IsOutputOnly:       f.IsOutputOnly,
+		IsRequestBodyField: f.IsRequestBodyField,
+		IsOptionalObject:   f.IsOptionalObject,
+		Entity:             fromEntity(f.Entity),
+	}
+}
+
+func fromEntity(e *clijson.EntityJSON) *EntityJSON {
+	if e == nil {
+		return nil
+	}
+	return &EntityJSON{
+		PascalName:                   e.PascalName,
+		IsObject:                     e.IsObject,
+		IsAny:                        e.IsAny,
+		IsString:                     e.IsString,
+		IsBool:                       e.IsBool,
+		IsInt:                        e.IsInt,
+		IsInt64:                      e.IsInt64,
+		IsFloat64:                    e.IsFloat64,
+		IsDuration:                   e.IsDuration,
+		IsTimestamp:                  e.IsTimestamp,
+		IsFieldMask:                  e.IsFieldMask,
+		IsEmptyResponse:              e.IsEmptyResponse,
+		ArrayValue:                   fromEntity(e.ArrayValue),
+		MapValue:                     fromEntity(e.MapValue),
+		Enum:                         mapSlice(e.Enum, fromEnumEntry),
+		HasFieldMask:                 e.HasFieldMask,
+		HasRequiredRequestBodyFields: e.HasRequiredRequestBodyFields,
+		RequiredFields:               mapSlice(e.RequiredFields, fromField),
+		RequiredInUrlFields:          mapSlice(e.RequiredInUrlFields, fromField),
+		RequiredRequestBodyFields:    mapSlice(e.RequiredRequestBodyFields, fromField),
+	}
+}
+
+func fromPagination(p *clijson.PaginationJSON) *PaginationJSON {
+	if p == nil {
+		return nil
+	}
+	return &PaginationJSON{
+		Token:      fromToken(p.Token),
+		Offset:     fromField(p.Offset),
+		Limit:      fromField(p.Limit),
+		MaxResults: fromField(p.MaxResults),
+	}
+}
+
+func fromToken(t *clijson.TokenJSON) *TokenJSON {
+	if t == nil {
+		return nil
+	}
+	return &TokenJSON{PollField: fromField(t.PollField)}
+}
+
+func fromWait(w *clijson.WaitJSON) *WaitJSON {
+	if w == nil {
+		return nil
+	}
+	return &WaitJSON{
+		Success:            mapSlice(w.Success, fromEnumEntry),
+		Timeout:            w.Timeout,
+		ComplexMessagePath: w.ComplexMessagePath,
+		Poll:               fromPoll(w.Poll),
+		StatusPath:         mapSlice(w.StatusPath, fromFieldRef),
+		MessagePath:        mapSlice(w.MessagePath, fromFieldRef),
+		MessagePathHead:    fromFieldRef(w.MessagePathHead),
+	}
+}
+
+func fromPoll(p *clijson.PollJSON) *PollJSON {
+	if p == nil {
+		return nil
+	}
+	return &PollJSON{Response: fromPascalRef(p.Response)}
+}
+
+func fromLRO(l *clijson.LROJSON) *LROJSON {
+	if l == nil {
+		return nil
+	}
+	return &LROJSON{
+		GetOperation: fromLROMethodRef(l.GetOperation),
+		ResponseType: fromEntityRef(l.ResponseType),
+	}
+}
+
+func fromLROMethodRef(r *clijson.LROMethodRef) *LROMethodRef {
+	if r == nil {
+		return nil
+	}
+	return &LROMethodRef{
+		KebabName:  r.KebabName,
+		PascalName: r.PascalName,
+		Request:    fromPascalRef(r.Request),
+	}
+}
+
+func fromEntityRef(e *clijson.EntityRef) *EntityRef {
+	if e == nil {
+		return nil
+	}
+	return &EntityRef{IsEmptyResponse: e.IsEmptyResponse}
+}
diff --git a/internal/clijson/launchstage.go b/internal/clijson/launchstage.go
new file mode 100644
index 00000000000..988379dc9ac
--- /dev/null
+++ b/internal/clijson/launchstage.go
@@ -0,0 +1,66 @@
+package clijson
+
+import (
+	"fmt"
+	"slices"
+)
+
+// LaunchStage is a field, enum value, or type's release stage, carried by the
+// contract's launch_stage. Only the constants below are valid.
+//
+// The producer currently emits launch_stage as a plain string, so SchemaJSON
+// and SchemaFieldJSON store it as such and ParseLaunchStage enforces the closed
+// set where the contract is consumed. Once the producer is upstreamed to emit
+// this enum directly, no other value could reach the CLI.
+type LaunchStage string
+
+const (
+	LaunchStageGA             LaunchStage = "GA"
+	LaunchStagePublicPreview  LaunchStage = "PUBLIC_PREVIEW"
+	LaunchStagePublicBeta     LaunchStage = "PUBLIC_BETA"
+	LaunchStagePrivatePreview LaunchStage = "PRIVATE_PREVIEW"
+)
+
+// LaunchStages is the closed set of valid launch stages. ParseLaunchStage
+// validates against it, so extending the contract with a new stage means adding
+// it here too.
+var LaunchStages = []LaunchStage{
+	LaunchStageGA,
+	LaunchStagePublicPreview,
+	LaunchStagePublicBeta,
+	LaunchStagePrivatePreview,
+}
+
+// launchStageRank orders stages from least to most restrictive:
+// GA < Public Preview < Public Beta < Private Preview. The empty string is GA,
+// the implicit default emitted for a field with no stage (see ParseLaunchStage
+// and normalizeLaunchStage in bundle/internal/schema). Extending LaunchStages
+// with a new stage means ranking it here too.
+var launchStageRank = map[LaunchStage]int{
+	"":                        0,
+	LaunchStageGA:             0,
+	LaunchStagePublicPreview:  1,
+	LaunchStagePublicBeta:     2,
+	LaunchStagePrivatePreview: 3,
+}
+
+// MoreRestrictive reports whether stage a is more restrictive than stage b in
+// the launch-stage hierarchy (GA < Public Preview < Public Beta < Private
+// Preview).
+func MoreRestrictive(a, b LaunchStage) bool {
+	return launchStageRank[a] > launchStageRank[b]
+}
+
+// ParseLaunchStage converts a raw launch_stage string from the contract into a
+// LaunchStage, mapping the empty string to GA (the implicit default). It errors
+// on any value outside the closed set.
+func ParseLaunchStage(s string) (LaunchStage, error) {
+	if s == "" {
+		return LaunchStageGA, nil
+	}
+	stage := LaunchStage(s)
+	if !slices.Contains(LaunchStages, stage) {
+		return "", fmt.Errorf("unknown launch stage %q: add it to LaunchStages in internal/clijson/launchstage.go", s)
+	}
+	return stage, nil
+}
diff --git a/internal/clijson/launchstage_test.go b/internal/clijson/launchstage_test.go
new file mode 100644
index 00000000000..45b4c8b8bcf
--- /dev/null
+++ b/internal/clijson/launchstage_test.go
@@ -0,0 +1,66 @@
+package clijson
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseLaunchStage(t *testing.T) {
+	tests := []struct {
+		raw     string
+		want    LaunchStage
+		wantErr bool
+	}{
+		{"", LaunchStageGA, false},
+		{"GA", LaunchStageGA, false},
+		{"PUBLIC_PREVIEW", LaunchStagePublicPreview, false},
+		{"PUBLIC_BETA", LaunchStagePublicBeta, false},
+		{"PRIVATE_PREVIEW", LaunchStagePrivatePreview, false},
+		{"SOMETHING_ELSE", "", true},
+	}
+	for _, tc := range tests {
+		got, err := ParseLaunchStage(tc.raw)
+		if tc.wantErr {
+			assert.Error(t, err, "ParseLaunchStage(%q)", tc.raw)
+			continue
+		}
+		require.NoError(t, err, "ParseLaunchStage(%q)", tc.raw)
+		assert.Equal(t, tc.want, got)
+	}
+}
+
+func TestMoreRestrictive(t *testing.T) {
+	// Ascending restrictiveness: GA < Public Preview < Public Beta < Private Preview.
+	ordered := []LaunchStage{
+		LaunchStageGA,
+		LaunchStagePublicPreview,
+		LaunchStagePublicBeta,
+		LaunchStagePrivatePreview,
+	}
+	for i, a := range ordered {
+		for j, b := range ordered {
+			assert.Equalf(t, i > j, MoreRestrictive(a, b), "MoreRestrictive(%q, %q)", a, b)
+		}
+	}
+
+	// The empty string ranks as GA, the implicit default.
+	assert.False(t, MoreRestrictive("", LaunchStageGA))
+	assert.True(t, MoreRestrictive(LaunchStagePublicBeta, ""))
+}
+
+// Every constant must be a member of LaunchStages, so a constant added without
+// updating the closed set (or vice versa) is caught here.
+func TestLaunchStagesContainsEveryConst(t *testing.T) {
+	for _, stage := range []LaunchStage{
+		LaunchStageGA,
+		LaunchStagePublicPreview,
+		LaunchStagePublicBeta,
+		LaunchStagePrivatePreview,
+	} {
+		got, err := ParseLaunchStage(string(stage))
+		require.NoError(t, err, "stage %q", stage)
+		assert.Equal(t, stage, got)
+	}
+}
diff --git a/internal/clijson/parse.go b/internal/clijson/parse.go
new file mode 100644
index 00000000000..b0fb7981a21
--- /dev/null
+++ b/internal/clijson/parse.go
@@ -0,0 +1,24 @@
+package clijson
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+)
+
+// Parse reads the cli.json file at path and decodes it into the contract types.
+// It is the single entry point for consumers (command generation, bundle schema
+// annotations, …) so none of them re-implement decoding of the contract.
+func Parse(path string) (*CliJSON, error) {
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return nil, err
+	}
+
+	var doc CliJSON
+	if err := json.Unmarshal(b, &doc); err != nil {
+		return nil, fmt.Errorf("parse %s: %w", path, err)
+	}
+
+	return &doc, nil
+}
diff --git a/internal/clijson/types.go b/internal/clijson/types.go
new file mode 100644
index 00000000000..7b0f02277e1
--- /dev/null
+++ b/internal/clijson/types.go
@@ -0,0 +1,228 @@
+// Code generated by genkit; DO NOT EDIT.
+//
+// This file defines the cli.json contract: the exact wire shape the Databricks
+// CLI decodes from .codegen/cli.json. It is generated from the upstream spec
+// producer and regenerated alongside cli.json, so the two cannot drift.
+//
+// Do not hand-edit this file. The upstream producer is the single source of
+// truth; to change the contract, change it upstream and regenerate. The JSON
+// tags are the contract.
+package clijson
+
+// CliJSON is the root document.
+type CliJSON struct {
+	Schemas  map[string]*SchemaJSON `json:"schemas,omitempty"`
+	Commands *CommandsBlock         `json:"commands,omitempty"`
+}
+
+// --- schemas block: the API type graph (messages and enums) ---
+
+// SchemaJSON is one schema in the type graph: a description plus either a
+// message's fields or an enum's values. For enums, EnumLaunchStages and
+// EnumDescriptions carry each value's release stage and docs.
+type SchemaJSON struct {
+	Description string `json:"description,omitempty"`
+	// Enum / EnumLaunchStages / EnumDescriptions are set only on enum schemas.
+	Enum             []string                    `json:"enum,omitempty"`
+	EnumLaunchStages map[string]string           `json:"enum_launch_stages,omitempty"`
+	EnumDescriptions map[string]string           `json:"enum_descriptions,omitempty"`
+	Fields           map[string]*SchemaFieldJSON `json:"fields,omitempty"`
+}
+
+// SchemaFieldJSON is one property of a schema.
+type SchemaFieldJSON struct {
+	Description string `json:"description,omitempty"`
+	Ref         string `json:"ref,omitempty"`
+	Deprecated  bool   `json:"deprecated,omitempty"`
+	LaunchStage string `json:"launch_stage,omitempty"`
+	// Behaviors is x-databricks-field-behaviors (e.g. IMMUTABLE).
+	Behaviors []string `json:"behaviors,omitempty"`
+}
+
+// --- commands block: services, methods, and their arguments ---
+
+type CommandsBlock struct {
+	Services            []*ServiceJSON   `json:"services,omitempty"`
+	WorkspaceDocsGroups []*DocsGroupJSON `json:"workspace_docs_groups,omitempty"`
+	AccountDocsGroups   []*DocsGroupJSON `json:"account_docs_groups,omitempty"`
+}
+
+type DocsGroupJSON struct {
+	Key         string `json:"key,omitempty"`
+	DisplayName string `json:"display_name,omitempty"`
+}
+
+type PackageRef struct {
+	Name string `json:"name,omitempty"`
+}
+
+// PascalRef carries only a named type or field's pascal-cased name, for the
+// places the contract needs just that.
+type PascalRef struct {
+	PascalName string `json:"pascal_name,omitempty"`
+}
+
+type EnumEntryJSON struct {
+	Content string `json:"content,omitempty"`
+}
+
+type ServiceListRefJSON struct {
+	NamedIdMap           *PascalRef `json:"named_id_map,omitempty"`
+	IsLegacyEmptyRequest bool       `json:"is_legacy_empty_request,omitempty"`
+	Request              *PascalRef `json:"request,omitempty"`
+}
+
+type ServiceJSON struct {
+	ID string `json:"id,omitempty"`
+
+	// Name is the only stored identifier; the consumer derives every casing
+	// (kebab/snake/pascal/title and the account-trimmed variants) from it.
+	Name string `json:"name,omitempty"`
+
+	Description string      `json:"description,omitempty"`
+	Package     *PackageRef `json:"package,omitempty"`
+
+	IsAccounts     bool `json:"is_accounts,omitempty"`
+	HasParent      bool `json:"has_parent,omitempty"`
+	IsDataPlane    bool `json:"is_data_plane,omitempty"`
+	HasSubservices bool `json:"has_subservices,omitempty"`
+	IsHiddenCLI    bool `json:"is_hidden_cli,omitempty"`
+
+	DocsGroup string `json:"docs_group,omitempty"`
+
+	LaunchStage           string `json:"launch_stage,omitempty"`
+	CLILaunchStageLabel   string `json:"cli_launch_stage_label,omitempty"`
+	CLILaunchStageBanner  string `json:"cli_launch_stage_banner,omitempty"`
+	CLILaunchStageDisplay string `json:"cli_launch_stage_display,omitempty"`
+
+	ParentServiceID string              `json:"parent_service_id,omitempty"`
+	SubserviceIDs   []string            `json:"subservice_ids,omitempty"`
+	List            *ServiceListRefJSON `json:"list,omitempty"`
+	Methods         []*MethodJSON       `json:"methods,omitempty"`
+}
+
+type MethodJSON struct {
+	// Casings derived by the consumer from Name.
+	Name string `json:"name,omitempty"`
+
+	Description string `json:"description,omitempty"`
+	// Summary is the method's own summary (operation summary / API-reference
+	// title), distinct from the first sentence of the description.
+	Summary string `json:"summary,omitempty"`
+	Path    string `json:"path,omitempty"`
+
+	IsLegacyEmptyRequest           bool `json:"is_legacy_empty_request,omitempty"`
+	CanUseJson                     bool `json:"can_use_json,omitempty"`
+	MustUseJson                    bool `json:"must_use_json,omitempty"`
+	IsJsonOnly                     bool `json:"is_json_only,omitempty"`
+	IsCrudCreate                   bool `json:"is_crud_create,omitempty"`
+	IsCrudRead                     bool `json:"is_crud_read,omitempty"`
+	IsHiddenCLI                    bool `json:"is_hidden_cli,omitempty"`
+	IsResponseByteStream           bool `json:"is_response_byte_stream,omitempty"`
+	HasRequiredPositionalArguments bool `json:"has_required_positional_arguments,omitempty"`
+
+	LaunchStage           string `json:"launch_stage,omitempty"`
+	CLILaunchStageLabel   string `json:"cli_launch_stage_label,omitempty"`
+	CLILaunchStageBanner  string `json:"cli_launch_stage_banner,omitempty"`
+	CLILaunchStageDisplay string `json:"cli_launch_stage_display,omitempty"`
+
+	Request           *EntityJSON `json:"request,omitempty"`
+	RequestBodyField  *FieldJSON  `json:"request_body_field,omitempty"`
+	Response          *EntityJSON `json:"response,omitempty"`
+	ResponseBodyField *PascalRef  `json:"response_body_field,omitempty"`
+
+	AllFields                   []*FieldJSON `json:"all_fields,omitempty"`
+	RequiredPositionalArguments []*FieldJSON `json:"required_positional_arguments,omitempty"`
+
+	Pagination           *PaginationJSON `json:"pagination,omitempty"`
+	Wait                 *WaitJSON       `json:"wait,omitempty"`
+	LongRunningOperation *LROJSON        `json:"long_running_operation,omitempty"`
+}
+
+type FieldJSON struct {
+	// Casings derived by the consumer from Name.
+	Name string `json:"name,omitempty"`
+
+	Description string `json:"description,omitempty"`
+
+	Required           bool `json:"required,omitempty"`
+	IsPath             bool `json:"is_path,omitempty"`
+	IsQuery            bool `json:"is_query,omitempty"`
+	IsComputed         bool `json:"is_computed,omitempty"`
+	IsOutputOnly       bool `json:"is_output_only,omitempty"`
+	IsRequestBodyField bool `json:"is_request_body_field,omitempty"`
+	IsOptionalObject   bool `json:"is_optional_object,omitempty"`
+
+	Entity *EntityJSON `json:"entity,omitempty"`
+}
+
+type EntityJSON struct {
+	PascalName string `json:"pascal_name,omitempty"`
+
+	IsObject    bool `json:"is_object,omitempty"`
+	IsAny       bool `json:"is_any,omitempty"`
+	IsString    bool `json:"is_string,omitempty"`
+	IsBool      bool `json:"is_bool,omitempty"`
+	IsInt       bool `json:"is_int,omitempty"`
+	IsInt64     bool `json:"is_int64,omitempty"`
+	IsFloat64   bool `json:"is_float64,omitempty"`
+	IsDuration  bool `json:"is_duration,omitempty"`
+	IsTimestamp bool `json:"is_timestamp,omitempty"`
+	IsFieldMask bool `json:"is_field_mask,omitempty"`
+
+	// IsEmptyResponse marks a response that carries nothing renderable — e.g.
+	// google.protobuf.Empty or a legacy named-but-fieldless response. Set on a
+	// method's Response and on an LRO's ResponseType.
+	IsEmptyResponse bool `json:"is_empty_response,omitempty"`
+
+	ArrayValue *EntityJSON      `json:"array_value,omitempty"`
+	MapValue   *EntityJSON      `json:"map_value,omitempty"`
+	Enum       []*EnumEntryJSON `json:"enum,omitempty"`
+
+	HasFieldMask                 bool `json:"has_field_mask,omitempty"`
+	HasRequiredRequestBodyFields bool `json:"has_required_request_body_fields,omitempty"`
+
+	RequiredFields            []*FieldJSON `json:"required_fields,omitempty"`
+	RequiredInUrlFields       []*FieldJSON `json:"required_in_url_fields,omitempty"`
+	RequiredRequestBodyFields []*FieldJSON `json:"required_request_body_fields,omitempty"`
+}
+
+type PaginationJSON struct {
+	Token      *TokenJSON `json:"token,omitempty"`
+	Offset     *FieldJSON `json:"offset,omitempty"`
+	Limit      *FieldJSON `json:"limit,omitempty"`
+	MaxResults *FieldJSON `json:"max_results,omitempty"`
+}
+
+type TokenJSON struct {
+	PollField *FieldJSON `json:"poll_field,omitempty"`
+}
+
+type WaitJSON struct {
+	Success            []*EnumEntryJSON `json:"success,omitempty"`
+	Timeout            int              `json:"timeout,omitempty"`
+	ComplexMessagePath bool             `json:"complex_message_path,omitempty"`
+	Poll               *PollJSON        `json:"poll,omitempty"`
+	StatusPath         []*PascalRef     `json:"status_path,omitempty"`
+	MessagePath        []*PascalRef     `json:"message_path,omitempty"`
+	MessagePathHead    *PascalRef       `json:"message_path_head,omitempty"`
+}
+
+type PollJSON struct {
+	Response *PascalRef `json:"response,omitempty"`
+}
+
+type LROJSON struct {
+	GetOperation *LROMethodRef `json:"get_operation,omitempty"`
+	ResponseType *EntityRef    `json:"response_type,omitempty"`
+}
+
+type LROMethodRef struct {
+	KebabName  string     `json:"kebab_name,omitempty"`
+	PascalName string     `json:"pascal_name,omitempty"`
+	Request    *PascalRef `json:"request,omitempty"`
+}
+
+type EntityRef struct {
+	IsEmptyResponse bool `json:"is_empty_response,omitempty"`
+}
diff --git a/internal/genkit/tagging.py b/internal/genkit/tagging.py
index 206ff6c7447..46f0fdae387 100644
--- a/internal/genkit/tagging.py
+++ b/internal/genkit/tagging.py
@@ -1,5 +1,3 @@
-#!/usr/bin/env python3
-
 # /// script
 # dependencies = ["PyGithub>=2,<3", "pyjwt<2.12.0", "charset-normalizer<3.4.6"]
 # ///
@@ -7,18 +5,39 @@
 import os
 import re
 import argparse
-from typing import Optional, List, Callable
-from dataclasses import dataclass
+from typing import Optional, List, Callable, Dict
+from dataclasses import dataclass, replace
 import subprocess
 import time
 import json
-from github import Github, Repository, InputGitTreeElement, InputGitAuthor
+from github import Auth, Github, Repository, InputGitTreeElement, InputGitAuthor
 from datetime import datetime, timezone
 
 NEXT_CHANGELOG_FILE_NAME = "NEXT_CHANGELOG.md"
 CHANGELOG_FILE_NAME = "CHANGELOG.md"
 PACKAGE_FILE_NAME = ".package.json"
 CODEGEN_FILE_NAME = ".codegen.json"
+CREATED_TAGS_FILE_NAME = "created_tags.json"
+
+# Presence of this env var switches the changelog source from a single
+# hand-maintained ``NEXT_CHANGELOG.md`` to per-PR ``<dir>/<section>/*.md``
+# fragments, and the release version from the ``## Release vX.Y.Z`` header to a
+# ``<dir>/version`` file. Its value is the fragment directory name (e.g.
+# ``.nextchanges``). Unset for every SDK repo, so their behavior is unchanged;
+# a repo opts in by setting it in the tagging workflow (see the databricks/cli
+# release workflow). The per-section ``(slug, header)`` mapping is read from
+# ``.codegen.json``'s ``nextchanges_sections`` key.
+NEXTCHANGES_DIR_ENV = "NEXTCHANGES_DIR"
+
+# File inside the fragment directory tracking the next release's version —
+# read at release time and bumped afterward, the role the ``## Release vX.Y.Z``
+# header plays in the ``NEXT_CHANGELOG.md`` flow.
+NEXTCHANGES_VERSION_FILE = "version"
+
+# ``README.md`` in a section slug is documentation (e.g. "put CLI changelog
+# fragments here"), not a changelog fragment. It is excluded from rendering and
+# preserved across releases, so teams can keep per-slug guidance in place.
+NEXTCHANGES_README_FILE = "README.md"
 """
 This script tags the release of the SDKs using a combination of the GitHub API and Git commands.
 It reads the local repository to determine necessary changes, updates changelogs, and creates tags.
@@ -29,6 +48,136 @@
 """
 
 
+@dataclass(frozen=True)
+class Version:
+    """
+    A semver 2.0.0-compliant version (https://semver.org).
+
+    Mirrors the API of the `semver` PyPI package so this implementation can be
+    swapped for that library if it is ever added to the wheelhouse. Supports
+    parsing, stringification, and the two bumps we need: minor (for stable
+    releases) and prerelease (for release trains).
+    """
+
+    # Permissive pattern for locating a semver version string inside larger
+    # text (e.g. a changelog header). Callers use it in f-strings; strict
+    # validation happens via Version.parse.
+    PATTERN = r"\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?"
+
+    # Strict anchored regex per https://semver.org. Rejects leading zeros in
+    # numeric identifiers and invalid pre-release/build identifier charsets.
+    _PARSE_REGEX = re.compile(
+        r"^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)"
+        r"(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)"
+        r"(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?"
+        r"(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$"
+    )
+
+    major: int
+    minor: int
+    patch: int
+    prerelease: str = ""
+    build: str = ""
+
+    @classmethod
+    def parse(cls, text: str) -> "Version":
+        """Parse a semver string, raising ValueError on malformed input."""
+        match = cls._PARSE_REGEX.match(text)
+        if not match:
+            raise ValueError(f"Invalid semver version: {text!r}")
+        major, minor, patch, prerelease, build = match.groups()
+        return cls(
+            major=int(major),
+            minor=int(minor),
+            patch=int(patch),
+            prerelease=prerelease or "",
+            build=build or "",
+        )
+
+    def __str__(self) -> str:
+        result = f"{self.major}.{self.minor}.{self.patch}"
+        if self.prerelease:
+            result += f"-{self.prerelease}"
+        if self.build:
+            result += f"+{self.build}"
+        return result
+
+    def bump_minor(self) -> "Version":
+        """
+        Bump the minor version and reset patch.
+
+        Per semver item 9, a pre-release version has lower precedence than
+        the same MAJOR.MINOR.PATCH, so bumping to a new minor drops any
+        pre-release and build metadata.
+        """
+        return Version(major=self.major, minor=self.minor + 1, patch=0)
+
+    def bump_prerelease(self) -> "Version":
+        """
+        Increment the rightmost numeric identifier in the pre-release.
+
+        Matches the npm `prerelease` bump semantics:
+            0.0.0-alpha.1 -> 0.0.0-alpha.2
+            0.0.0-alpha   -> 0.0.0-alpha.1
+            0.0.0-rc.1.2  -> 0.0.0-rc.1.3
+
+        Raises ValueError if the version has no pre-release to bump.
+        Build metadata is dropped since it does not affect precedence.
+        """
+        if not self.prerelease:
+            raise ValueError(f"Cannot bump prerelease of {self}: no pre-release component")
+        parts = self.prerelease.split(".")
+        for i in range(len(parts) - 1, -1, -1):
+            if parts[i].isdigit():
+                parts[i] = str(int(parts[i]) + 1)
+                return replace(self, prerelease=".".join(parts), build="")
+        # No numeric identifier exists; append ".1" to start a counter.
+        return replace(self, prerelease=f"{self.prerelease}.1", build="")
+
+    def next_release_version(self) -> "Version":
+        """
+        Default next version for the changelog after this one is released.
+
+        If on a pre-release track, stay on it by bumping the pre-release
+        identifier (npm convention). Otherwise, bump the minor version,
+        the script's historical default for stable releases. Teams can
+        override the default in the release PR.
+        """
+        if self.prerelease:
+            return self.bump_prerelease()
+        return self.bump_minor()
+
+
+def _read_local_head_sha() -> str:
+    """
+    Returns the SHA of the local working tree's HEAD via ``git rev-parse``.
+    """
+    return subprocess.check_output(["git", "rev-parse", "HEAD"], text=True).strip()
+
+
+def _release_branch() -> str:
+    """
+    Returns the branch this release is being cut from.
+
+    The tagging workflow sets ``DECO_TAGGING_REF`` to the branch it was
+    dispatched on (``github.ref_name``) so a release can be cut from a
+    branch other than main. It is unset for local runs and the historical
+    main-only release path, so we default to ``main`` and every existing
+    caller is unaffected.
+    """
+    return os.environ.get("DECO_TAGGING_REF", "").strip() or "main"
+
+
+class MainAdvancedError(Exception):
+    """
+    Raised when the release branch (``origin/main`` by default; see
+    ``_release_branch``) has advanced since the workflow's checkout —
+    i.e., another commit landed during this run. The local working tree
+    is now stale, so any commit produced from it would silently revert
+    whatever the concurrent push added.
+    """
+
+
 # GitHub does not support signing commits for GitHub Apps directly.
 # This class replaces usages for git commands such as "git add", "git commit", and "git push".
 @dataclass
@@ -36,9 +185,16 @@ class GitHubRepo:
     def __init__(self, repo: Repository):
         self.repo = repo
         self.changed_files: list[InputGitTreeElement] = []
-        self.ref = "heads/main"
-        head_ref = self.repo.get_git_ref(self.ref)
-        self.sha = head_ref.object.sha
+        # Branch the changelog-bump commit + tag land on. Defaults to
+        # ``heads/main``; ``DECO_TAGGING_REF`` overrides it for a branch
+        # release. See ``_release_branch``.
+        self.ref = f"heads/{_release_branch()}"
+        # Anchor ``self.sha`` to the **local checkout** rather than a
+        # live API call. ``actions/checkout`` populates the working tree
+        # at this SHA, and every subsequent file read in this run is
+        # against that tree; the API HEAD is only relevant when we go
+        # to push.
+        self.sha = _read_local_head_sha()
 
     # Replaces "git add file"
     def add_file(self, loc: str, content: str):
@@ -48,15 +204,29 @@ def add_file(self, loc: str, content: str):
         element = InputGitTreeElement(path=local_path, mode="100644", type="blob", sha=blob.sha)
         self.changed_files.append(element)
 
+    # Replaces "git rm file"
+    def delete_file(self, loc: str):
+        """``git rm`` equivalent for GitHubRepo: stage a tree deletion (sha=None)."""
+        local_path = os.path.relpath(loc, os.getcwd())
+        print(f"Deleting file {local_path}")
+        self.changed_files.append(InputGitTreeElement(path=local_path, mode="100644", type="blob", sha=None))
+
     # Replaces "git commit && git push"
     def commit_and_push(self, message: str):
         head_ref = self.repo.get_git_ref(self.ref)
+        if head_ref.object.sha != self.sha:
+            raise MainAdvancedError(
+                f"{self.ref} advanced from {self.sha} to {head_ref.object.sha} "
+                f"during this run. Local working tree is stale; aborting before "
+                f"the commit would silently revert the new content. Re-run the "
+                f"workflow."
+            )
         base_tree = self.repo.get_git_tree(sha=head_ref.object.sha)
         new_tree = self.repo.create_git_tree(self.changed_files, base_tree)
         parent_commit = self.repo.get_git_commit(head_ref.object.sha)
 
         new_commit = self.repo.create_git_commit(message=message, tree=new_tree, parents=[parent_commit])
-        # Update branch reference
+        # Update branch reference.
         head_ref.edit(new_commit.sha)
         self.sha = new_commit.sha
 
@@ -65,8 +235,7 @@ def reset(self, sha: Optional[str] = None):
         if sha:
             self.sha = sha
         else:
-            head_ref = self.repo.get_git_ref(self.ref)
-            self.sha = head_ref.object.sha
+            self.sha = _read_local_head_sha()
 
     def tag(self, tag_name: str, tag_message: str):
         # Create a tag pointing to the new commit
@@ -154,35 +323,103 @@ def get_package_name(package_path: str) -> str:
     return ""
 
 
-def update_version_references(tag_info: TagInfo) -> None:
+def stage_version_updates(tag_infos: List[TagInfo], packages: List[Package]) -> None:
     """
-    Updates the version of the package in code references.
-    Code references are defined in .package.json files.
+    Stages all version-related edits for the release in a single pass over
+    every package the workspace already opts in via ``.package.json``.
     """
 
-    # Load version patterns from '.codegen.json' file at the top level of the repository
+    # Load patterns from '.codegen.json' at the top level of the repository.
     package_file_path = os.path.join(os.getcwd(), CODEGEN_FILE_NAME)
     with open(package_file_path, "r") as file:
-        package_file = json.load(file)
+        codegen = json.load(file)
+
+    version_patterns = codegen.get("version", {})
+    dep_patterns = codegen.get("dependency_pattern", {})
+    name_template = codegen.get("dependency_name_template", "")
 
-    version = package_file.get("version")
-    if not version:
-        print("`version` not found in .codegen.json. Nothing to update.")
+    if not version_patterns and not dep_patterns:
+        print("Neither `version` nor `dependency_pattern` found in .codegen.json. Nothing to update.")
         return
 
-    # Update the versions
-    for filename, pattern in version.items():
-        loc = os.path.join(os.getcwd(), tag_info.package.path, filename)
-        previous_version = re.sub(r"\$VERSION", r"\\d+\\.\\d+\\.\\d+", pattern)
-        new_version = re.sub(r"\$VERSION", tag_info.version, pattern)
+    bumped_by_dir: Dict[str, TagInfo] = {info.package.path: info for info in tag_infos}
+    new_dep_versions = compute_dependency_rewrites(tag_infos, name_template)
+
+    files = sorted(set(version_patterns.keys()) | set(dep_patterns.keys()))
 
-        with open(loc, "r") as file:
-            content = file.read()
+    for pkg in packages:
+        for filename in files:
+            loc = os.path.join(os.getcwd(), pkg.path, filename)
 
-        # Replace the version in the file content
-        updated_content = re.sub(previous_version, new_version, content)
+            with open(loc, "r") as file:
+                content = file.read()
+            original = content
 
-        gh.add_file(loc, updated_content)
+            # Own version (only when this package is being released and the
+            # file has a version pattern declared).
+            info = bumped_by_dir.get(pkg.path)
+            if info is not None and filename in version_patterns:
+                pattern = version_patterns[filename]
+                previous_version = pattern.replace("$VERSION", Version.PATTERN)
+                new_version = pattern.replace("$VERSION", info.version)
+                content = re.sub(previous_version, new_version, content)
+
+            # Sibling dependency rewrites (only when the file has a
+            # dependency pattern and there is at least one bumped sibling).
+            if filename in dep_patterns and new_dep_versions:
+                content = rewrite_dependencies(content, dep_patterns[filename], new_dep_versions)
+
+            if content != original:
+                gh.add_file(loc, content)
+
+
+def compute_dependency_rewrites(
+    tag_infos: List[TagInfo],
+    name_template: str,
+) -> Dict[str, str]:
+    """
+    Returns a map of dependency-name to the new semver string for each
+    bumped package.
+    """
+    if not name_template:
+        return {}
+    rewrites: Dict[str, str] = {}
+    for info in tag_infos:
+        # Skip legacy releases that don't have a per-package name; their
+        # tag_info has an empty package.name and they can't be referenced
+        # as a sibling dep anyway.
+        if not info.package.name:
+            continue
+        dep_name = name_template.replace("$PACKAGE", info.package.name)
+        rewrites[dep_name] = info.version
+    return rewrites
+
+
+def rewrite_dependencies(content: str, pattern: str, new_versions: Dict[str, str]) -> str:
+    """
+    Apply ``pattern`` (with ``$DEPENDENCY`` and ``$VERSION`` placeholders) to
+    rewrite every entry in ``content`` whose dependency name appears in
+    ``new_versions``.
+    """
+    # Sentinel strings used to protect the placeholders through re.escape:
+    # we substitute them in, escape the whole template, then swap them out
+    # for the dep-name literal and Version.PATTERN. Control characters so
+    # they can't collide with anything in real .codegen.json patterns.
+    dep_sentinel = "\x01DEPENDENCY\x01"
+    ver_sentinel = "\x01VERSION\x01"
+
+    for dep_name, new_value in new_versions.items():
+        regex = pattern.replace("$DEPENDENCY", dep_sentinel).replace("$VERSION", ver_sentinel)
+        regex = re.escape(regex)
+        regex = regex.replace(re.escape(dep_sentinel), re.escape(dep_name))
+        regex = regex.replace(re.escape(ver_sentinel), Version.PATTERN)
+
+        # Build the literal replacement text by substituting the same
+        # placeholders directly. A lambda is used instead of a string to
+        # avoid re.sub interpreting \1, \g<...>, etc. inside the value.
+        replacement_text = pattern.replace("$DEPENDENCY", dep_name).replace("$VERSION", new_value)
+        content = re.sub(regex, lambda _m, text=replacement_text: text, content)
+    return content
 
 
 def clean_next_changelog(package_path: str) -> None:
@@ -197,23 +434,21 @@ def clean_next_changelog(package_path: str) -> None:
     with open(file_path, "r") as file:
         content = file.read()
 
-    # Remove content between ### sections
+    # Remove content between ### sections.
     cleaned_content = re.sub(r"(### [^\n]+\n)(?:.*?\n?)*?(?=###|$)", r"\1", content)
-    # Ensure there is exactly one empty line before each section
+    # Ensure there is exactly one empty line before each section.
     cleaned_content = re.sub(r"(\n*)(###[^\n]+)", r"\n\n\2", cleaned_content)
-    # Find the version number
-    version_match = re.search(r"Release v(\d+)\.(\d+)\.(\d+)", cleaned_content)
+    # Find the version number and compute the default next release version.
+    # Teams can adjust the version in the PR if the default is not desired.
+    # For stable versions, bump minor (historical default since minor releases
+    # are more common than patch or major). For pre-release versions, stay on
+    # the same track by bumping the pre-release identifier (npm convention).
+    version_match = re.search(rf"Release v({Version.PATTERN})", cleaned_content)
     if not version_match:
         raise Exception("Version not found in the changelog")
-    major, minor, patch = map(int, version_match.groups())
-    # Prepare next release version.
-    # When doing a PR, teams can adjust the version.
-    # By default, we increase a minor version, since minor versions releases
-    # are more common than patch or major version releases.
-    minor += 1
-    patch = 0
-    new_version = f"Release v{major}.{minor}.{patch}"
-    cleaned_content = cleaned_content.replace(version_match.group(0), new_version)
+    current = Version.parse(version_match.group(1))
+    new_header = f"Release v{current.next_release_version()}"
+    cleaned_content = cleaned_content.replace(version_match.group(0), new_header)
 
     # Update file with cleaned content
     gh.add_file(file_path, cleaned_content)
@@ -229,27 +464,240 @@ def get_previous_tag_info(package: Package) -> Optional[TagInfo]:
     with open(changelog_path, "r") as f:
         changelog = f.read()
 
-    # Extract the latest release section using regex
-    match = re.search(r"## (\[Release\] )?Release v[\d\.]+.*?(?=\n## (\[Release\] )?Release v|\Z)", changelog, re.S)
+    # Extract the latest release section using regex.
+    match = re.search(
+        rf"## (\[Release\] )?Release v{Version.PATTERN}.*?(?=\n## (\[Release\] )?Release v|\Z)",
+        changelog,
+        re.S,
+    )
 
     # E.g., for new packages.
     if not match:
         return None
 
     latest_release = match.group(0)
-    version_match = re.search(r"## (\[Release\] )?Release v(\d+\.\d+\.\d+)", latest_release)
+    version_match = re.search(rf"## (\[Release\] )?Release v({Version.PATTERN})", latest_release)
 
     if not version_match:
         raise Exception("Version not found in the changelog")
 
-    return TagInfo(package=package, version=version_match.group(2), content=latest_release)
+    # Validate the extracted string is spec-compliant; fail loudly otherwise.
+    version = str(Version.parse(version_match.group(2)))
+    return TagInfo(package=package, version=version, content=latest_release)
+
+
+def _load_codegen_config(package_path: str = "") -> Dict:
+    """
+    Loads ``.codegen.json`` for a package: prefers ``<package_path>/.codegen.json``
+    and falls back to the repo-root file, returning an empty dict when neither
+    exists. ``package_path=""`` (the default) reads the repo root, matching the
+    single-package / root-config layout.
+
+    Package-local lookup keeps the section taxonomy and other codegen options in
+    lockstep with the package-relative directories the nextchanges helpers
+    resolve, so a multi-package repo can give each package its own config
+    instead of every package sharing the root file.
+    """
+    candidates = [os.path.join(os.getcwd(), package_path, CODEGEN_FILE_NAME)]
+    root_config = os.path.join(os.getcwd(), CODEGEN_FILE_NAME)
+    if root_config not in candidates:
+        candidates.append(root_config)
+    for candidate in candidates:
+        if os.path.exists(candidate):
+            with open(candidate, "r") as file:
+                return json.load(file)
+    return {}
+
+
+def _nextchanges_dir() -> Optional[str]:
+    """
+    Returns the fragment directory name when nextchanges mode is enabled
+    (``NEXTCHANGES_DIR`` set to a non-empty value), else ``None``. In the
+    ``None`` case the historical ``NEXT_CHANGELOG.md`` flow is used, so every
+    repo that doesn't set the env var is unaffected.
+    """
+    return os.environ.get(NEXTCHANGES_DIR_ENV, "").strip() or None
+
+
+def _nextchanges_sections(package_path: str = "") -> List[tuple]:
+    """
+    Returns the ordered ``(slug, header)`` section list from the package's
+    ``.codegen.json`` ``nextchanges_sections`` — the mapping of ``<dir>/<slug>/``
+    subdirectories to the ``### <header>`` blocks they render into, in changelog
+    order. Read via ``_load_codegen_config(package_path)`` so it matches the
+    package-relative fragment directories (a multi-package repo can scope the
+    taxonomy per package).
+
+    Declared as a JSON object ``{"<slug>": "<header>", ...}`` so the per-repo
+    section taxonomy stays out of this shared script; insertion order in the
+    object is the changelog order (JSON objects preserve order in Python 3.7+).
+    Raises when nextchanges mode is on but the key is absent/empty, or is not an
+    object, since there would be nothing sensible to render.
+    """
+    sections = _load_codegen_config(package_path).get("nextchanges_sections", {})
+    if not sections:
+        raise Exception(
+            f"nextchanges mode is enabled ({NEXTCHANGES_DIR_ENV} set) but "
+            f"`nextchanges_sections` is missing or empty in {CODEGEN_FILE_NAME}."
+        )
+    if not isinstance(sections, dict):
+        raise Exception(
+            f"`nextchanges_sections` in {CODEGEN_FILE_NAME} must be a JSON object "
+            f'mapping section slug to header (e.g. {{"cli": "CLI"}}), got '
+            f"{type(sections).__name__}."
+        )
+    return list(sections.items())
+
+
+def _render_fragment(text: str) -> str:
+    """
+    Render one fragment body into changelog bullets. Each line that starts with
+    a ``* ``/``- `` marker (ignoring leading whitespace) becomes its own `` * ``
+    bullet; a line without a marker is a continuation of the preceding bullet
+    and is kept as authored. A markerless first line is itself a single bullet.
+
+    So a fragment with multiple ``* ``/``- `` lines renders as multiple bullets,
+    while a bullet followed by plain lines stays one bullet spanning those
+    lines. Every bullet gets the leading-space ``*`` that matches CHANGELOG.md.
+    """
+    lines = []
+    for line in text.split("\n"):
+        marker = line.lstrip()
+        if marker.startswith(("* ", "- ")):
+            lines.append(f" * {marker[2:]}")
+        elif lines:
+            lines.append(line)
+        else:
+            lines.append(f" * {line}")
+    return "\n".join(lines)
+
+
+def render_nextchanges(package_path: str) -> Optional[str]:
+    """
+    Render ``<package_path>/<dir>/<section>/*.md`` fragments into the changelog
+    body: one ``### <Section>`` block per non-empty section in
+    ``nextchanges_sections`` order, fragments sorted by filename. Returns
+    ``None`` when there are no fragments.
+
+    Every ``.md`` file under a section directory is a fragment, except
+    ``README.md`` which is treated as per-slug documentation and skipped (see
+    ``NEXTCHANGES_README_FILE``). Empty/whitespace-only files contribute
+    nothing. Files at the ``<dir>`` root or under a slug not listed in
+    ``nextchanges_sections`` are ignored. Each fragment renders per
+    ``_render_fragment``. Link expansion (e.g. ``(#1234)`` → markdown link) is
+    assumed to have happened before release, so none here.
+    """
+    base = os.path.join(os.getcwd(), package_path, _nextchanges_dir())
+    if not os.path.isdir(base):
+        return None
+
+    blocks = []
+    for slug, header in _nextchanges_sections(package_path):
+        section_dir = os.path.join(base, slug)
+        if not os.path.isdir(section_dir):
+            continue
+        entries = []
+        for name in sorted(os.listdir(section_dir)):
+            if not name.endswith(".md") or name == NEXTCHANGES_README_FILE:
+                continue
+            with open(os.path.join(section_dir, name)) as f:
+                text = f.read().strip()
+            if not text:
+                continue
+            entries.append(_render_fragment(text))
+        if entries:
+            # Blank line after the heading, matching CHANGELOG.md.
+            blocks.append(f"### {header}\n\n" + "\n".join(entries))
+
+    if not blocks:
+        return None
+    return "\n\n".join(blocks)
+
+
+def _nextchanges_version_path(package_path: str) -> str:
+    return os.path.join(os.getcwd(), package_path, _nextchanges_dir(), NEXTCHANGES_VERSION_FILE)
+
+
+def read_nextchanges_version(package: Package) -> str:
+    """
+    Release version for this run, read from the package's own ``<dir>/version``
+    (resolved under ``package.path``, so each package in a multi-package repo
+    keeps its own version source). In nextchanges mode this file — not the
+    ``## Release v…`` changelog header — is the source of truth. To cut a patch
+    or major release, edit it in the PR; otherwise its default (bumped to the
+    next minor after the previous release by ``clean_nextchanges``) applies.
+
+    Raises with an actionable message when the file is absent, so a package that
+    opts into nextchanges mode without a version file fails loudly instead of
+    with a bare ``FileNotFoundError``.
+    """
+    version_path = _nextchanges_version_path(package.path)
+    if not os.path.exists(version_path):
+        raise Exception(
+            f"nextchanges mode is enabled ({NEXTCHANGES_DIR_ENV} set) but the version "
+            f"file {os.path.relpath(version_path, os.getcwd())} is missing; each package "
+            f"in nextchanges mode must provide its own <dir>/version file."
+        )
+    with open(version_path) as f:
+        return str(Version.parse(f.read().strip().lstrip("v")))
+
+
+def get_next_tag_info_from_nextchanges(package: Package) -> Optional[TagInfo]:
+    """
+    nextchanges-mode counterpart of ``get_next_tag_info``: build the release
+    TagInfo from ``<dir>/`` fragments. Returns ``None`` when there are no
+    entries (nothing to release), unless ``allow_empty_changelog`` is set in
+    ``.codegen.json`` — matching the ``NEXT_CHANGELOG.md`` skip behavior.
+    """
+    body = render_nextchanges(package.path)
+    if body is None:
+        if not _load_codegen_config(package.path).get("allow_empty_changelog", False):
+            print(f"No {_nextchanges_dir()}/ entries. No changes will be made to the changelog.")
+            return None
+        if not _source_changed_since_last_release(package):
+            print(f"No {_nextchanges_dir()}/ entries and no source changes since the last release; skipping.")
+            return None
+
+    version = read_nextchanges_version(package)
+    # write_changelog() keys off the "## Release v…" header, so include it.
+    content = f"## Release v{version}\n" + (f"\n{body}\n" if body else "")
+    return TagInfo(package=package, version=version, content=content)
+
+
+def clean_nextchanges(package_path: str) -> None:
+    """
+    nextchanges-mode counterpart of ``clean_next_changelog``: stage deletion of
+    the ``<dir>/`` fragments consumed by this release and bump ``<dir>/version``
+    to the next minor (its post-release default; teams can still override it in
+    a PR). Deletes every ``.md`` under each section directory — the same set
+    ``render_nextchanges`` consumed, so ``README.md`` is preserved — leaving the
+    section directories in place.
+    """
+    base = os.path.join(os.getcwd(), package_path, _nextchanges_dir())
+    for slug, _ in _nextchanges_sections(package_path):
+        section_dir = os.path.join(base, slug)
+        if not os.path.isdir(section_dir):
+            continue
+        # Deletion order is irrelevant, so listdir as-is (no sort needed).
+        for name in os.listdir(section_dir):
+            if name.endswith(".md") and name != NEXTCHANGES_README_FILE:
+                gh.delete_file(os.path.join(section_dir, name))
+
+    version_path = _nextchanges_version_path(package_path)
+    with open(version_path) as f:
+        released = Version.parse(f.read().strip().lstrip("v"))
+    gh.add_file(version_path, f"{released.next_release_version()}\n")
 
 
 def get_next_tag_info(package: Package) -> Optional[TagInfo]:
     """
-    Extracts the changes from the "NEXT_CHANGELOG.md" file.
-    The result is already processed.
+    Extracts the changes for the next release. In nextchanges mode (see
+    ``_nextchanges_dir``) it reads ``<dir>/`` fragments; otherwise it reads the
+    package's ``NEXT_CHANGELOG.md``. The result is already processed.
     """
+    if _nextchanges_dir() is not None:
+        return get_next_tag_info_from_nextchanges(package)
+
     next_changelog_path = os.path.join(os.getcwd(), package.path, NEXT_CHANGELOG_FILE_NAME)
     # Read NEXT_CHANGELOG.md
     with open(next_changelog_path, "r") as f:
@@ -263,16 +711,27 @@ def get_next_tag_info(package: Package) -> Optional[TagInfo]:
     # Ensure there is exactly one empty line before each section
     next_changelog = re.sub(r"(\n*)(###[^\n]+)", r"\n\n\2", next_changelog)
 
+    # By default, packages whose NEXT_CHANGELOG.md has no populated
+    # sections are skipped — there's nothing meaningful to release.
+    # Repos like sdk-js which are still in development can opt in
+    # by setting ``allow_empty_changelog: true`` in .codegen.json — but
+    # even then, only when the package's source actually changed.
     if not re.search(r"###", next_changelog):
-        print("All sections are empty. No changes will be made to the changelog.")
-        return None
+        if not _load_codegen_config(package.path).get("allow_empty_changelog", False):
+            print("All sections are empty. No changes will be made to the changelog.")
+            return None
+        if not _source_changed_since_last_release(package):
+            print("All sections are empty and no source changes since the last release; skipping.")
+            return None
 
-    version_match = re.search(r"## Release v(\d+\.\d+\.\d+)", next_changelog)
+    version_match = re.search(rf"## Release v({Version.PATTERN})", next_changelog)
 
     if not version_match:
         raise Exception("Version not found in the changelog")
 
-    return TagInfo(package=package, version=version_match.group(1), content=next_changelog)
+    # Validate the extracted string is spec-compliant; fail loudly otherwise.
+    version = str(Version.parse(version_match.group(1)))
+    return TagInfo(package=package, version=version, content=next_changelog)
 
 
 def write_changelog(tag_info: TagInfo) -> None:
@@ -283,10 +742,12 @@ def write_changelog(tag_info: TagInfo) -> None:
     with open(changelog_path, "r") as f:
         changelog = f.read()
 
-    # Add current date to the release header
+    # Add current date to the release header.
     current_date = datetime.now(tz=timezone.utc).strftime("%Y-%m-%d")
     content_with_date = re.sub(
-        r"## Release v(\d+\.\d+\.\d+)", rf"## Release v\1 ({current_date})", tag_info.content.strip()
+        rf"## Release v({Version.PATTERN})",
+        rf"## Release v\1 ({current_date})",
+        tag_info.content.strip(),
     )
 
     updated_changelog = re.sub(r"(# Version changelog\n\n)", f"\\1{content_with_date}\n\n\n", changelog)
@@ -295,9 +756,8 @@ def write_changelog(tag_info: TagInfo) -> None:
 
 def process_package(package: Package) -> TagInfo:
     """
-    Processes a package
+    Processes a package's changelog scaffolding for the release.
     """
-    # Prepare tag_info from NEXT_CHANGELOG.md
     print(f"Processing package {package.name}")
     tag_info = get_next_tag_info(package)
 
@@ -306,8 +766,10 @@ def process_package(package: Package) -> TagInfo:
         return
 
     write_changelog(tag_info)
-    clean_next_changelog(package.path)
-    update_version_references(tag_info)
+    if _nextchanges_dir() is not None:
+        clean_nextchanges(package.path)
+    else:
+        clean_next_changelog(package.path)
     return tag_info
 
 
@@ -351,6 +813,151 @@ def is_tag_applied(tag: TagInfo) -> bool:
         raise Exception(f"Git command failed: {e.stderr.strip() or e}") from e
 
 
+def find_last_release_tag(package: Package) -> Optional[str]:
+    """
+    Returns the most recent ``<package>/v*`` tag in the repository, or
+    ``None`` if no such tag exists. Tags are sorted by semver ordering
+    (``--sort=-v:refname``) so pre-releases sort below their stable
+    counterparts.
+
+    :raises Exception: If the git command fails.
+    """
+    pattern = f"{package.name}/v*" if package.name else "v*"
+    try:
+        output = subprocess.check_output(
+            ["git", "tag", "--list", pattern, "--sort=-v:refname"],
+            stderr=subprocess.PIPE,
+            text=True,
+        ).strip()
+    except subprocess.CalledProcessError as e:
+        raise Exception(f"Git command failed: {e.stderr.strip() or e}") from e
+    if not output:
+        return None
+    return output.split("\n")[0].strip()
+
+
+def has_commits_since_tag(tag: str, path: str) -> bool:
+    """
+    Returns True iff at least one commit reachable from HEAD but not from
+    ``tag`` touches ``path``. Detects both that a sibling dependency has
+    unreleased changes that would ship stale (freshness) and, via
+    ``_source_changed_since_last_release``, whether a package has anything to
+    release under allow_empty_changelog.
+
+    :raises Exception: If the git command fails.
+    """
+    args = ["git", "log", "--oneline", f"{tag}..HEAD", "--", path or "."]
+    try:
+        output = subprocess.check_output(args, stderr=subprocess.PIPE, text=True).strip()
+    except subprocess.CalledProcessError as e:
+        raise Exception(f"Git command failed: {e.stderr.strip() or e}") from e
+    return bool(output)
+
+
+def _source_changed_since_last_release(package: Package) -> bool:
+    """
+    True when the package has any commits since its last release tag. A
+    never-released package (no tag) counts as changed. Gates the
+    ``allow_empty_changelog`` path so a package with no changelog entries
+    releases only when something actually changed since it was last released.
+
+    Uses the same commit-based check as ``check_dependency_freshness`` — a
+    package's release bookkeeping is committed *at* its release tag, not after
+    it, so it never falls in the ``tag..HEAD`` window. Sharing the check keeps
+    the two consistent: a package this skips is exactly one freshness will not
+    flag as stale.
+    """
+    tag = find_last_release_tag(package)
+    if tag is None:
+        return True
+    return has_commits_since_tag(tag, package.path)
+
+
+def check_dependency_freshness(tag_infos: List[TagInfo], all_packages: List[Package]) -> None:
+    """
+    Hard-fails when a package being released depends on a sibling package
+    that has unreleased commits since its last tag.
+
+    Why: dependency rewrites (``stage_version_updates``) only fire for
+    siblings that are *also* being released. Without this check, releasing
+    package_a alone — when package_b has commits since its last tag —
+    publishes ``package_a@new`` pinning the *old* package_b artifact, which
+    won't have the changes package_a's source depends on. The check is
+    commit-based (not changelog-based) so a missing ``NEXT_CHANGELOG.md``
+    entry on package_b is still caught.
+
+    No-op when ``.codegen.json`` declares no dependency pattern (legacy
+    SDKs without per-package wiring).
+    """
+    if not tag_infos:
+        return
+
+    package_file_path = os.path.join(os.getcwd(), CODEGEN_FILE_NAME)
+    with open(package_file_path, "r") as file:
+        codegen = json.load(file)
+
+    name_template = codegen.get("dependency_name_template", "")
+    dep_patterns = codegen.get("dependency_pattern", {})
+    if not name_template or not dep_patterns:
+        return
+
+    releasing_paths = {info.package.path for info in tag_infos}
+    by_dep_name: Dict[str, Package] = {}
+    for pkg in all_packages:
+        if not pkg.name:
+            continue
+        by_dep_name[name_template.replace("$PACKAGE", pkg.name)] = pkg
+
+    issues: List[str] = []
+    for info in tag_infos:
+        for filename, pattern in dep_patterns.items():
+            loc = os.path.join(os.getcwd(), info.package.path, filename)
+            if not os.path.exists(loc):
+                continue
+            with open(loc, "r") as f:
+                content = f.read()
+
+            for dep_name, dep_pkg in by_dep_name.items():
+                if dep_pkg.path == info.package.path:
+                    continue
+                if dep_pkg.path in releasing_paths:
+                    continue
+
+                # Same regex construction used by ``rewrite_dependencies``,
+                # so "is this dep referenced?" matches "would the rewrite
+                # touch it?". Keeps the two in lockstep.
+                regex = (
+                    re.escape(pattern)
+                    .replace(re.escape("$DEPENDENCY"), re.escape(dep_name))
+                    .replace(re.escape("$VERSION"), Version.PATTERN)
+                )
+                if not re.search(regex, content):
+                    continue
+
+                last_tag = find_last_release_tag(dep_pkg)
+                if last_tag is None:
+                    # No prior tag means the dep was never released; we
+                    # can't reason about staleness. Surface it anyway so
+                    # the human resolves it explicitly.
+                    issues.append(
+                        f"{info.package.name} depends on {dep_pkg.name}, "
+                        f"which has never been released. Release "
+                        f"{dep_pkg.name} first or include it in this run."
+                    )
+                    continue
+                if has_commits_since_tag(last_tag, dep_pkg.path):
+                    issues.append(
+                        f"{info.package.name} depends on {dep_pkg.name}, "
+                        f"which has commits since {last_tag} but is not "
+                        f"being released. Either release {dep_pkg.name} "
+                        f"as well, or hold this release until its changes "
+                        f"are reverted."
+                    )
+
+    if issues:
+        raise Exception("Dependency freshness check failed:\n  - " + "\n  - ".join(issues))
+
+
 def find_last_tags() -> List[TagInfo]:
     """
     Finds the last tags for each package.
@@ -384,11 +991,11 @@ def generate_commit_message(tag_infos: List[TagInfo]) -> str:
             raise Exception("Multiple packages found in legacy mode")
         return f"[Release] Release v{info.version}\n\n{info.content}"
 
-    # Sort tag_infos by package name for consistency
+    # Sort tag_infos by package name for consistency.
     tag_infos.sort(key=lambda info: info.package.name)
-    return "Release\n\n" + "\n\n".join(
-        f"## {info.package.name}/v{info.version}\n\n{info.content}" for info in tag_infos
-    )
+    titles = ", ".join(f"{info.package.name}/v{info.version}" for info in tag_infos)
+    body = "\n\n".join(f"## {info.package.name}/v{info.version}\n\n{info.content}" for info in tag_infos)
+    return f"[Release] {titles}\n\n{body}"
 
 
 def push_changes(tag_infos: List[TagInfo]) -> None:
@@ -411,21 +1018,20 @@ def reset_repository(hash: Optional[str] = None) -> None:
 
     :param hash: The commit hash to reset to. If None, it resets to HEAD.
     """
-    # Fetch the latest changes from the remote repository
+    # Fetch the latest changes from the remote repository.
     subprocess.run(["git", "fetch"])
 
-    # Determine the commit hash (default to origin/main if none is provided)
-    commit_hash = hash or "origin/main"
+    # Determine the commit hash (default to the release branch's remote
+    # head if none is provided). ``_release_branch`` is ``main`` unless
+    # ``DECO_TAGGING_REF`` selects a branch release.
+    commit_hash = hash or f"origin/{_release_branch()}"
 
-    # Reset in memory changed files and the commit hash
+    # ``git reset --hard`` must land before ``gh.reset(None)``, since
+    # ``gh.reset(None)`` reads ``git rev-parse HEAD`` to anchor
+    # ``self.sha`` to the local working tree.
+    subprocess.run(["git", "reset", "--hard", commit_hash], check=True)
     gh.reset(hash)
 
-    # Construct the Git reset command
-    command = ["git", "reset", "--hard", commit_hash]
-
-    # Execute the git reset command
-    subprocess.run(command, check=True)
-
 
 def retry_function(
     func: Callable[[], List[TagInfo]], cleanup: Callable[[], None], max_attempts: int = 5, delay: int = 5
@@ -443,6 +1049,12 @@ def retry_function(
     while attempts <= max_attempts:
         try:
             return func()  # Call the function
+        except MainAdvancedError:
+            # Permanent failure: another commit landed on main during
+            # this run, so the local tree is stale. Retrying with the
+            # same stale tree would just hit the same mismatch — only
+            # a fresh workflow run against the new main can recover.
+            raise
         except Exception as e:
             attempts += 1
             print(f"Attempt {attempts} failed: {e}")
@@ -454,23 +1066,139 @@ def retry_function(
                 raise e  # Re-raise the exception after max retries
 
 
-def update_changelogs(packages: List[Package]) -> List[TagInfo]:
+def update_changelogs(selected_packages: List[Package], all_packages: List[Package]) -> List[TagInfo]:
     """
     Updates changelogs and pushes the commits.
+
+    ``selected_packages`` are the packages whose ``NEXT_CHANGELOG.md`` is
+    consulted to decide what gets released this run. ``all_packages`` is
+    the full repo inventory used for cross-package dep rewrites.
+
+    The freshness check is deliberately *not* called here. ``process``
+    runs it before entering the retry loop so a freshness violation
+    fails fast — the check is deterministic against the same git state,
+    so wrapping it in retry would just delay the same failure five
+    times.
     """
-    tag_infos = [info for info in (process_package(package) for package in packages) if info is not None]
-    # If any package was changed, push the changes.
+    tag_infos = [info for info in (process_package(package) for package in selected_packages) if info is not None]
+    # If any package was changed, stage version updates and push.
     if tag_infos:
+        stage_version_updates(tag_infos, all_packages)
         push_changes(tag_infos)
     return tag_infos
 
 
+def preview_tag_infos(packages: List[Package]) -> List[TagInfo]:
+    """
+    Read-only sibling of ``process_package``: returns the TagInfos that
+    would be released for ``packages`` without writing any changelog
+    edits. ``process`` calls this before the retry loop so the freshness
+    check has a snapshot to validate against. ``process_package`` will
+    re-derive the same TagInfos when ``update_changelogs`` runs; the
+    duplication is just a couple of NEXT_CHANGELOG.md reads.
+    """
+    return [info for info in (get_next_tag_info(package) for package in packages) if info is not None]
+
+
+def order_tag_infos_by_dependency(tag_infos: List[TagInfo]) -> List[TagInfo]:
+    """
+    Returns ``tag_infos`` in topological order: every package appears
+    after every sibling it depends on.
+    """
+    if not tag_infos:
+        return list(tag_infos)
+
+    if any(not info.package.name for info in tag_infos) and len(tag_infos) > 1:
+        raise Exception("Multiple packages found in legacy mode")
+
+    package_file_path = os.path.join(os.getcwd(), CODEGEN_FILE_NAME)
+    with open(package_file_path, "r") as file:
+        codegen = json.load(file)
+
+    name_template = codegen.get("dependency_name_template", "")
+    dep_patterns = codegen.get("dependency_pattern", {})
+    if not name_template or not dep_patterns:
+        return list(tag_infos)
+
+    by_dep_name: Dict[str, TagInfo] = {
+        name_template.replace("$PACKAGE", info.package.name): info for info in tag_infos if info.package.name
+    }
+
+    # Adjacency: path -> set of paths it depends on (within tag_infos).
+    deps: Dict[str, set] = {info.package.path: set() for info in tag_infos}
+    for info in tag_infos:
+        for filename, pattern in dep_patterns.items():
+            loc = os.path.join(os.getcwd(), info.package.path, filename)
+            if not os.path.exists(loc):
+                continue
+            with open(loc, "r") as f:
+                content = f.read()
+            for dep_name, dep_info in by_dep_name.items():
+                if dep_info.package.path == info.package.path:
+                    continue
+                regex = (
+                    re.escape(pattern)
+                    .replace(re.escape("$DEPENDENCY"), re.escape(dep_name))
+                    .replace(re.escape("$VERSION"), Version.PATTERN)
+                )
+                if re.search(regex, content):
+                    deps[info.package.path].add(dep_info.package.path)
+
+    # Stable topological sort: at each step, emit every node whose deps
+    # are already emitted, alphabetically by package name. Ties broken
+    # alphabetically so the manifest is reproducible across runs.
+    emitted: set = set()
+    ordered: List[TagInfo] = []
+    while len(ordered) < len(tag_infos):
+        ready = sorted(
+            (
+                info
+                for info in tag_infos
+                if info.package.path not in emitted and deps[info.package.path].issubset(emitted)
+            ),
+            key=lambda info: info.package.name,
+        )
+        if not ready:
+            remaining = [info.package.name for info in tag_infos if info.package.path not in emitted]
+            raise Exception(f"Cyclic dependency detected among packages: {remaining}")
+        for info in ready:
+            ordered.append(info)
+            emitted.add(info.package.path)
+    return ordered
+
+
 def push_tags(tag_infos: List[TagInfo]) -> None:
     """
     Creates and pushes tags to the repository.
+
+    Tags are emitted in topological order — dependencies before
+    dependents — so downstream publishing pipelines reading
+    ``created_tags.json`` can walk it sequentially without re-deriving
+    the dependency graph. See ``order_tag_infos_by_dependency``.
+
+    As a side effect, writes the names of successfully created tags to
+    ``./created_tags.json`` so that workflows triggering this script can
+    discover what was produced (the GitHub Actions workflow uploads this
+    file as the ``created-tags`` artifact).
+
+    Schema:
+        {"tags": ["service-a/v1.2.3", "service-b/v0.4.0"]}
+
+    The manifest is written even if tag creation fails partway through:
+    tags that succeeded before the failure are flushed before the
+    exception is re-raised, so recovery-mode runs still surface their
+    output.
     """
-    for tag_info in tag_infos:
-        gh.tag(tag_info.tag_name(), tag_info.content)
+    tag_infos = order_tag_infos_by_dependency(tag_infos)
+    created: List[str] = []
+    try:
+        for tag_info in tag_infos:
+            gh.tag(tag_info.tag_name(), tag_info.content)
+            created.append(tag_info.tag_name())
+    finally:
+        manifest_path = os.path.join(os.getcwd(), CREATED_TAGS_FILE_NAME)
+        with open(manifest_path, "w") as f:
+            json.dump({"tags": created}, f)
 
 
 def run_command(command: List[str]) -> str:
@@ -499,21 +1227,96 @@ def pull_last_release_commit() -> None:
     reset_repository(commit_hash)
 
 
-def get_package_from_args() -> Optional[str]:
+def _build_arg_parser() -> argparse.ArgumentParser:
     """
-    Retrieves an optional package
-    python3 ./tagging.py --package <name>
+    Builds the CLI parser. Shared by ``get_packages_from_args`` and
+    ``args_request_preview`` so both accept the same flags — parsing either one
+    with an unknown flag present would otherwise error.
     """
     parser = argparse.ArgumentParser(description="Update changelogs and tag the release.")
-    parser.add_argument("--package", "-p", type=str, help="Tag a single package")
-    args = parser.parse_args()
-    return args.package
+    parser.add_argument(
+        "--package",
+        "-p",
+        type=str,
+        default="",
+        help="Comma-separated list of packages to tag. Leave empty to tag all packages with pending releases.",
+    )
+    parser.add_argument(
+        "--preview",
+        action="store_true",
+        help=(
+            "Print the changelog section the next release would add, then exit "
+            "(no writes, no network). Only supported in nextchanges mode."
+        ),
+    )
+    return parser
+
+
+def get_packages_from_args() -> List[str]:
+    """
+    Retrieves the list of packages to tag.
+
+        python3 ./tagging.py --package <name>              # single package
+        python3 ./tagging.py --package <name1>,<name2>     # multiple packages
+
+    Returns an empty list when --package is omitted, which means all packages
+    with pending releases will be tagged.
+    """
+    args = _build_arg_parser().parse_args()
+    return [name.strip() for name in args.package.split(",") if name.strip()]
+
+
+def _select_packages(all_packages: List[Package]) -> List[Package]:
+    """
+    Narrow ``all_packages`` to the ``--package`` selection, or return all of
+    them when ``--package`` is omitted. Shared by ``process`` and ``preview`` so
+    the read-only preview covers exactly the release scope the same CLI
+    arguments would execute — ``tagging.py --package foo --preview`` previews
+    only ``foo``, not every package in the repo.
+    """
+    package_names = get_packages_from_args()
+    if not package_names:
+        return all_packages
+    return [package for package in all_packages if package.name in package_names]
+
+
+def args_request_preview() -> bool:
+    """Returns whether ``--preview`` was passed."""
+    return _build_arg_parser().parse_args().preview
+
+
+def preview() -> None:
+    """
+    Print the ``## Release vX.Y.Z`` section(s) the next release would prepend to
+    CHANGELOG.md, rendered from the current ``<dir>/`` fragments — without
+    touching git, GitHub, or any file. Mirrors ``write_changelog``'s date stamp
+    so the output matches what would land. Read-only: safe to run anytime, no
+    credentials. Only meaningful in nextchanges mode.
+    """
+    if _nextchanges_dir() is None:
+        raise Exception(f"--preview requires nextchanges mode ({NEXTCHANGES_DIR_ENV} must be set).")
+
+    current_date = datetime.now(tz=timezone.utc).strftime("%Y-%m-%d")
+    printed = False
+    for package in _select_packages(find_packages()):
+        tag_info = get_next_tag_info(package)
+        if tag_info is None:
+            continue
+        dated = re.sub(
+            rf"## Release v({Version.PATTERN})",
+            rf"## Release v\1 ({current_date})",
+            tag_info.content.strip(),
+        )
+        print(dated)
+        printed = True
+    if not printed:
+        print(f"No {_nextchanges_dir()}/ entries — the next release would add no changelog section.")
 
 
 def init_github():
     token = os.environ["GITHUB_TOKEN"]
     repo_name = os.environ["GITHUB_REPOSITORY"]
-    g = Github(token)
+    g = Github(auth=Auth.Token(token))
     repo = g.get_repo(repo_name)
     global gh
     gh = GitHubRepo(repo)
@@ -533,15 +1336,15 @@ def process():
     If any tag are pending from an early process, it will skip updating the CHANGELOG.md files and only apply the tags.
     """
 
-    package_name = get_package_from_args()
+    package_names = get_packages_from_args()
     pending_tags = find_pending_tags()
 
     # pending_tags is non-empty only when the tagging process previously failed or interrupted.
     # We must complete the interrupted tagging process before starting a new one to avoid inconsistent states and missing changelog entries.
-    # Therefore, we don't support specifying the package until the previously started process has been successfully completed.
-    if pending_tags and package_name:
+    # Therefore, we don't support specifying packages until the previously started process has been successfully completed.
+    if pending_tags and package_names:
         pending_packages = [tag.package.name for tag in pending_tags]
-        raise Exception(f"Cannot release package {package_name}. Pending release for {pending_packages}")
+        raise Exception(f"Cannot release packages {package_names}. Pending release for {pending_packages}")
 
     if pending_tags:
         print("Found pending tags from previous executions, entering recovery mode.")
@@ -549,12 +1352,22 @@ def process():
         push_tags(pending_tags)
         return
 
-    packages = find_packages()
-    # If a package is specified as an argument, only process that package
-    if package_name:
-        packages = [package for package in packages if package.name == package_name]
-
-    pending_tags = retry_function(func=lambda: update_changelogs(packages), cleanup=reset_repository)
+    all_packages = find_packages()
+    # If packages are specified as an argument, only release those — but
+    # dep rewrites and the freshness check still operate over the full
+    # set. Shared with preview() so both scope identically.
+    selected_packages = _select_packages(all_packages)
+
+    # Run the freshness check against a read-only preview before the
+    # retry loop, since the check is deterministic. A freshness
+    # violation fails the run immediately, with no commits, no tags, no
+    # retry storm.
+    check_dependency_freshness(preview_tag_infos(selected_packages), all_packages)
+
+    pending_tags = retry_function(
+        func=lambda: update_changelogs(selected_packages, all_packages),
+        cleanup=reset_repository,
+    )
     push_tags(pending_tags)
 
 
@@ -568,7 +1381,15 @@ def validate_git_root():
         raise Exception("Please run this script from the root of the repository.")
 
 
-if __name__ == "__main__":
+def main():
     validate_git_root()
+    # Preview is read-only: no GitHub credentials, no network, no commits.
+    if args_request_preview():
+        preview()
+        return
     init_github()
     process()
+
+
+if __name__ == "__main__":
+    main()
diff --git a/internal/genkit/tagging.py.lock b/internal/genkit/tagging.py.lock
index d680b187f5b..b1530109674 100644
--- a/internal/genkit/tagging.py.lock
+++ b/internal/genkit/tagging.py.lock
@@ -12,7 +12,7 @@ requirements = [
 [[package]]
 name = "certifi"
 version = "2026.2.25"
-source = { registry = "https://pypi-proxy.dev.databricks.com/simple/" }
+source = { registry = "https://pypi.org/simple" }
 sdist = { url = "https://files.pythonhosted.org/packages/af/2d/7bf41579a8986e348fa033a31cdd0e4121114f6bce2457e8876010b092dd/certifi-2026.2.25.tar.gz", hash = "sha256:e887ab5cee78ea814d3472169153c2d12cd43b14bd03329a39a9c6e2e80bfba7", size = 155029, upload-time = "2026-02-25T02:54:17.342Z" }
 wheels = [
     { url = "https://files.pythonhosted.org/packages/9a/3c/c17fb3ca2d9c3acff52e30b309f538586f9f5b9c9cf454f3845fc9af4881/certifi-2026.2.25-py3-none-any.whl", hash = "sha256:027692e4402ad994f1c42e52a4997a9763c646b73e4096e4d5d6db8af1d6f0fa", size = 153684, upload-time = "2026-02-25T02:54:15.766Z" },
@@ -21,7 +21,7 @@ wheels = [
 [[package]]
 name = "cffi"
 version = "2.0.0"
-source = { registry = "https://pypi-proxy.dev.databricks.com/simple/" }
+source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "pycparser", marker = "implementation_name != 'PyPy'" },
 ]
@@ -78,7 +78,7 @@ wheels = [
 [[package]]
 name = "charset-normalizer"
 version = "3.4.5"
-source = { registry = "https://pypi-proxy.dev.databricks.com/simple/" }
+source = { registry = "https://pypi.org/simple" }
 sdist = { url = "https://files.pythonhosted.org/packages/1d/35/02daf95b9cd686320bb622eb148792655c9412dbb9b67abb5694e5910a24/charset_normalizer-3.4.5.tar.gz", hash = "sha256:95adae7b6c42a6c5b5b559b1a99149f090a57128155daeea91732c8d970d8644", size = 134804, upload-time = "2026-03-06T06:03:19.46Z" }
 wheels = [
     { url = "https://files.pythonhosted.org/packages/9c/b6/9ee9c1a608916ca5feae81a344dffbaa53b26b90be58cc2159e3332d44ec/charset_normalizer-3.4.5-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:ed97c282ee4f994ef814042423a529df9497e3c666dca19be1d4cd1129dc7ade", size = 280976, upload-time = "2026-03-06T06:01:15.276Z" },
@@ -135,7 +135,7 @@ wheels = [
 [[package]]
 name = "cryptography"
 version = "46.0.5"
-source = { registry = "https://pypi-proxy.dev.databricks.com/simple/" }
+source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cffi", marker = "platform_python_implementation != 'PyPy'" },
 ]
@@ -188,7 +188,7 @@ wheels = [
 [[package]]
 name = "idna"
 version = "3.11"
-source = { registry = "https://pypi-proxy.dev.databricks.com/simple/" }
+source = { registry = "https://pypi.org/simple" }
 sdist = { url = "https://files.pythonhosted.org/packages/6f/6d/0703ccc57f3a7233505399edb88de3cbd678da106337b9fcde432b65ed60/idna-3.11.tar.gz", hash = "sha256:795dafcc9c04ed0c1fb032c2aa73654d8e8c5023a7df64a53f39190ada629902", size = 194582, upload-time = "2025-10-12T14:55:20.501Z" }
 wheels = [
     { url = "https://files.pythonhosted.org/packages/0e/61/66938bbb5fc52dbdf84594873d5b51fb1f7c7794e9c0f5bd885f30bc507b/idna-3.11-py3-none-any.whl", hash = "sha256:771a87f49d9defaf64091e6e6fe9c18d4833f140bd19464795bc32d966ca37ea", size = 71008, upload-time = "2025-10-12T14:55:18.883Z" },
@@ -197,7 +197,7 @@ wheels = [
 [[package]]
 name = "pycparser"
 version = "3.0"
-source = { registry = "https://pypi-proxy.dev.databricks.com/simple/" }
+source = { registry = "https://pypi.org/simple" }
 sdist = { url = "https://files.pythonhosted.org/packages/1b/7d/92392ff7815c21062bea51aa7b87d45576f649f16458d78b7cf94b9ab2e6/pycparser-3.0.tar.gz", hash = "sha256:600f49d217304a5902ac3c37e1281c9fe94e4d0489de643a9504c5cdfdfc6b29", size = 103492, upload-time = "2026-01-21T14:26:51.89Z" }
 wheels = [
     { url = "https://files.pythonhosted.org/packages/0c/c3/44f3fbbfa403ea2a7c779186dc20772604442dde72947e7d01069cbe98e3/pycparser-3.0-py3-none-any.whl", hash = "sha256:b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992", size = 48172, upload-time = "2026-01-21T14:26:50.693Z" },
@@ -206,7 +206,7 @@ wheels = [
 [[package]]
 name = "pygithub"
 version = "2.8.1"
-source = { registry = "https://pypi-proxy.dev.databricks.com/simple/" }
+source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "pyjwt", extra = ["crypto"] },
     { name = "pynacl" },
@@ -222,7 +222,7 @@ wheels = [
 [[package]]
 name = "pyjwt"
 version = "2.11.0"
-source = { registry = "https://pypi-proxy.dev.databricks.com/simple/" }
+source = { registry = "https://pypi.org/simple" }
 sdist = { url = "https://files.pythonhosted.org/packages/5c/5a/b46fa56bf322901eee5b0454a34343cdbdae202cd421775a8ee4e42fd519/pyjwt-2.11.0.tar.gz", hash = "sha256:35f95c1f0fbe5d5ba6e43f00271c275f7a1a4db1dab27bf708073b75318ea623", size = 98019, upload-time = "2026-01-30T19:59:55.694Z" }
 wheels = [
     { url = "https://files.pythonhosted.org/packages/6f/01/c26ce75ba460d5cd503da9e13b21a33804d38c2165dec7b716d06b13010c/pyjwt-2.11.0-py3-none-any.whl", hash = "sha256:94a6bde30eb5c8e04fee991062b534071fd1439ef58d2adc9ccb823e7bcd0469", size = 28224, upload-time = "2026-01-30T19:59:54.539Z" },
@@ -236,7 +236,7 @@ crypto = [
 [[package]]
 name = "pynacl"
 version = "1.6.2"
-source = { registry = "https://pypi-proxy.dev.databricks.com/simple/" }
+source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cffi", marker = "platform_python_implementation != 'PyPy'" },
 ]
@@ -271,7 +271,7 @@ wheels = [
 [[package]]
 name = "requests"
 version = "2.32.5"
-source = { registry = "https://pypi-proxy.dev.databricks.com/simple/" }
+source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "certifi" },
     { name = "charset-normalizer" },
@@ -286,7 +286,7 @@ wheels = [
 [[package]]
 name = "typing-extensions"
 version = "4.15.0"
-source = { registry = "https://pypi-proxy.dev.databricks.com/simple/" }
+source = { registry = "https://pypi.org/simple" }
 sdist = { url = "https://files.pythonhosted.org/packages/72/94/1a15dd82efb362ac84269196e94cf00f187f7ed21c242792a923cdb1c61f/typing_extensions-4.15.0.tar.gz", hash = "sha256:0cea48d173cc12fa28ecabc3b837ea3cf6f38c6d1136f85cbaaf598984861466", size = 109391, upload-time = "2025-08-25T13:49:26.313Z" }
 wheels = [
     { url = "https://files.pythonhosted.org/packages/18/67/36e9267722cc04a6b9f15c7f3441c2363321a3ea07da7ae0c0707beb2a9c/typing_extensions-4.15.0-py3-none-any.whl", hash = "sha256:f0fa19c6845758ab08074a0cfa8b7aecb71c999ca73d62883bc25cc018c4e548", size = 44614, upload-time = "2025-08-25T13:49:24.86Z" },
@@ -295,7 +295,7 @@ wheels = [
 [[package]]
 name = "urllib3"
 version = "2.6.3"
-source = { registry = "https://pypi-proxy.dev.databricks.com/simple/" }
+source = { registry = "https://pypi.org/simple" }
 sdist = { url = "https://files.pythonhosted.org/packages/c7/24/5f1b3bdffd70275f6661c76461e25f024d5a38a46f04aaca912426a2b1d3/urllib3-2.6.3.tar.gz", hash = "sha256:1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed", size = 435556, upload-time = "2026-01-07T16:24:43.925Z" }
 wheels = [
     { url = "https://files.pythonhosted.org/packages/39/08/aaaad47bc4e9dc8c725e68f9d04865dbcb2052843ff09c97b08904852d84/urllib3-2.6.3-py3-none-any.whl", hash = "sha256:bf272323e553dfb2e87d9bfd225ca7b0f467b919d7bbd355436d3fd37cb0acd4", size = 131584, upload-time = "2026-01-07T16:24:42.685Z" },
diff --git a/internal/mocks/.gitattributes b/internal/mocks/.gitattributes
new file mode 100644
index 00000000000..80ff44c834c
--- /dev/null
+++ b/internal/mocks/.gitattributes
@@ -0,0 +1 @@
+*.go linguist-generated=true
diff --git a/internal/testarchive/archive.go b/internal/testarchive/archive.go
index 4def785e90d..c9f90c5284e 100644
--- a/internal/testarchive/archive.go
+++ b/internal/testarchive/archive.go
@@ -109,12 +109,12 @@ func CreateArchive(archiveDir, binDir, repoRoot string) error {
 		GoDownloader{Arch: "amd64", BinDir: binDir, RepoRoot: repoRoot},
 		UvDownloader{Arch: "amd64", BinDir: binDir},
 		JqDownloader{Arch: "amd64", BinDir: binDir},
+		RuffDownloader{Arch: "amd64", BinDir: binDir},
 
-		// TODO: Serverless clusters do not support arm64 yet.
-		// Enable ARM64 once serverless clusters support it.
-		// GoDownloader{Arch: "arm64", BinDir: binDir, RepoRoot: repoRoot},
-		// UvDownloader{Arch: "arm64", BinDir: binDir},
-		// JqDownloader{Arch: "arm64", BinDir: binDir},
+		GoDownloader{Arch: "arm64", BinDir: binDir, RepoRoot: repoRoot},
+		UvDownloader{Arch: "arm64", BinDir: binDir},
+		JqDownloader{Arch: "arm64", BinDir: binDir},
+		RuffDownloader{Arch: "arm64", BinDir: binDir},
 	}
 
 	for _, downloader := range downloaders {
diff --git a/internal/testarchive/ruff.go b/internal/testarchive/ruff.go
new file mode 100644
index 00000000000..dc57ea19284
--- /dev/null
+++ b/internal/testarchive/ruff.go
@@ -0,0 +1,74 @@
+package testarchive
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+)
+
+// ruffVersion pins the ruff release bundled into the archive. It must match the
+// version pinned across the repo (python/pyproject.toml, Taskfile.yml) and the
+// minimum required by acceptance/internal/ruff.go, because the check-formatting
+// test's golden output assumes that formatter's behavior. Unlike uv and jq
+// (which the archive tracks at latest), ruff is pinned for that reason.
+const ruffVersion = "0.9.1"
+
+// RuffDownloader handles downloading and extracting ruff releases.
+type RuffDownloader struct {
+	BinDir string
+	Arch   string
+}
+
+// mapArchitecture maps our architecture names to ruff's naming convention.
+func (r RuffDownloader) mapArchitecture(arch string) (string, error) {
+	switch arch {
+	case "arm64":
+		return "aarch64", nil
+	case "amd64":
+		return "x86_64", nil
+	default:
+		return "", fmt.Errorf("unsupported architecture: %s (supported: arm64, amd64)", arch)
+	}
+}
+
+// Download downloads and extracts ruff for Linux.
+func (r RuffDownloader) Download() error {
+	ruffArch, err := r.mapArchitecture(r.Arch)
+	if err != nil {
+		return err
+	}
+
+	dir := filepath.Join(r.BinDir, r.Arch)
+	err = os.MkdirAll(dir, 0o755)
+	if err != nil {
+		return err
+	}
+
+	// Ruff releases are tagged with the bare version (no "v" prefix).
+	// https://github.com/astral-sh/ruff/releases
+	ruffTarName := fmt.Sprintf("ruff-%s-unknown-linux-gnu", ruffArch)
+	url := fmt.Sprintf("https://github.com/astral-sh/ruff/releases/download/%s/%s.tar.gz", ruffVersion, ruffTarName)
+
+	tempFile := filepath.Join(dir, "ruff.tar.gz")
+	if err := downloadFile(url, tempFile); err != nil {
+		return err
+	}
+
+	if err := ExtractTarGz(tempFile, dir); err != nil {
+		return err
+	}
+
+	err = os.Remove(tempFile)
+	if err != nil {
+		return err
+	}
+
+	// The ruff binary is extracted into a directory named like
+	// ruff-x86_64-unknown-linux-gnu. Move the binary one level up and drop the
+	// extra directory to keep the bin layout flat, matching uv.
+	err = os.Rename(filepath.Join(dir, ruffTarName, "ruff"), filepath.Join(dir, "ruff"))
+	if err != nil {
+		return err
+	}
+	return os.RemoveAll(filepath.Join(dir, ruffTarName))
+}
diff --git a/internal/testcli/runner.go b/internal/testcli/runner.go
index deb7e59a2f5..5f2d1a23b75 100644
--- a/internal/testcli/runner.go
+++ b/internal/testcli/runner.go
@@ -236,9 +236,19 @@ func (r *Runner) Eventually(condition func() bool, waitFor, tick time.Duration,
 	var wg sync.WaitGroup
 	defer wg.Wait()
 
+	// Closed when this function returns to release any condition goroutine still
+	// blocked sending into the size-1 [ch]. Without it, a timeout leaves in-flight
+	// senders stuck forever and the deferred [wg.Wait] deadlocks. The defer order
+	// matters: [close] runs before [wg.Wait] (defers run last-in-first-out).
+	done := make(chan struct{})
+	defer close(done)
+
 	// Kick off condition check immediately.
 	wg.Go(func() {
-		ch <- condition()
+		select {
+		case ch <- condition():
+		case <-done:
+		}
 	})
 
 	for tick := ticker.C; ; {
@@ -252,7 +262,10 @@ func (r *Runner) Eventually(condition func() bool, waitFor, tick time.Duration,
 		case <-tick:
 			tick = nil
 			wg.Go(func() {
-				ch <- condition()
+				select {
+				case ch <- condition():
+				case <-done:
+				}
 			})
 		case v := <-ch:
 			if v {
diff --git a/internal/testutil/helpers.go b/internal/testutil/helpers.go
index c6e24f8cc4e..e86f4ae15c9 100644
--- a/internal/testutil/helpers.go
+++ b/internal/testutil/helpers.go
@@ -2,9 +2,9 @@ package testutil
 
 import (
 	"strings"
+	"uuid"
 
 	"github.com/databricks/cli/libs/env"
-	"github.com/google/uuid"
 )
 
 // GetEnvOrSkipTest proceeds with test only with that env variable.
diff --git a/libs/agent/agent_notice.go b/libs/agent/agent_notice.go
new file mode 100644
index 00000000000..22f63b9d5de
--- /dev/null
+++ b/libs/agent/agent_notice.go
@@ -0,0 +1,20 @@
+package agent
+
+import (
+	"fmt"
+
+	"github.com/databricks/databricks-sdk-go/useragent"
+)
+
+// AgentNotice returns a notice string to append to error messages when an AI
+// agent is detected. Returns an empty string for non-agent callers.
+func AgentNotice() string {
+	name := useragent.AgentProvider()
+	if name == "" {
+		return ""
+	}
+	return fmt.Sprintf("\n\nNote for AI agents (%s): do not retry with the flag suggested above\n"+
+		"unless the user has explicitly approved it. The flag bypasses a safety check\n"+
+		"and the operation may be irreversible.",
+		name)
+}
diff --git a/libs/aitools/agents/agents.go b/libs/aitools/agents/agents.go
new file mode 100644
index 00000000000..0c6cdfcbfb2
--- /dev/null
+++ b/libs/aitools/agents/agents.go
@@ -0,0 +1,429 @@
+package agents
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+
+	"github.com/databricks/cli/libs/env"
+)
+
+// PluginSpec describes the databricks plugin for an agent. A non-nil
+// Agent.Plugin means the agent has a databricks plugin the CLI can install
+// headlessly (Claude Code, Codex, Copilot); a nil Plugin means raw skill files
+// are the only delivery (OpenCode, Antigravity, Cursor).
+type PluginSpec struct {
+	// Marketplace is the marketplace registry name the plugin is served from,
+	// as registered by `<agent> plugin marketplace add` (e.g. "databricks-agent-skills").
+	Marketplace string
+	// ID is the plugin identifier that is installed/enabled (e.g. "databricks").
+	ID string
+	// Source is the argument passed to `<agent> plugin marketplace add`
+	// (e.g. "databricks/databricks-agent-skills").
+	Source string
+	// Shared marks a marketplace we do not own. It is still added when missing — an
+	// unregistered marketplace can't be refreshed or installed from — but is never
+	// de-registered on uninstall, since other plugins may rely on it.
+	Shared bool
+}
+
+// Agent defines a supported coding agent.
+type Agent struct {
+	Name        string
+	DisplayName string
+	// ConfigDir returns the agent's config directory (e.g., ~/.claude).
+	// Used for detection and as base for skills directory.
+	ConfigDir func(ctx context.Context) (string, error)
+	// SkillsSubdir is the subdirectory within ConfigDir for skills (default: "skills").
+	SkillsSubdir string
+	// SupportsProjectScope indicates whether this agent supports project-scoped skills.
+	// When true, skills can be installed relative to the project root.
+	SupportsProjectScope bool
+	// ProjectConfigDir is the config directory name relative to a project root
+	// (e.g., ".claude"). Only used when SupportsProjectScope is true.
+	ProjectConfigDir string
+	// Binary is the agent's CLI binary name on PATH, used by exec.LookPath for
+	// plugin-capability detection and as the program for the plugin probe.
+	// Empty for agents with no CLI binary (Antigravity is IDE-only).
+	Binary string
+	// MandatoryFile is a marker file required to confirm installation. It is a
+	// relative filename in ConfigDir. Use it when the presence of ConfigDir is not
+	// enough to determine if the agent is installed, such as when ConfigDir is
+	// shared with other products.
+	MandatoryFile string
+	// Plugin describes the databricks plugin for this agent, or nil when the
+	// agent has no plugin and skills files are its native delivery.
+	Plugin *PluginSpec
+	// pluginVersion reads the installed databricks plugin version from the
+	// agent's own plugin manifest. Each agent's manifest format differs, so it is
+	// set per agent (only for formats we have verified); when nil,
+	// DatabricksPluginVersion reports no version. New agents extend support by
+	// providing their own reader here.
+	pluginVersion func(ctx context.Context, a *Agent) (string, bool)
+}
+
+// Detected reports whether the agent is installed: its config directory exists,
+// or its mandatory file or installed Databricks skills exist when one is set.
+func (a *Agent) Detected(ctx context.Context) bool {
+	dir, err := a.ConfigDir(ctx)
+	if err != nil {
+		return false
+	}
+	target := dir
+	if a.MandatoryFile != "" {
+		target = filepath.Join(dir, a.MandatoryFile)
+	}
+	if _, err = os.Stat(target); err == nil {
+		return true
+	}
+	if a.MandatoryFile == "" {
+		return false // ConfigDir does not exist
+	}
+	skillsDir, err := a.SkillsDir(ctx)
+	return err == nil && HasDatabricksSkillsIn(skillsDir)
+}
+
+// SkillsDir returns the full path to the agent's skills directory.
+func (a *Agent) SkillsDir(ctx context.Context) (string, error) {
+	configDir, err := a.ConfigDir(ctx)
+	if err != nil {
+		return "", err
+	}
+	subdir := a.SkillsSubdir
+	if subdir == "" {
+		subdir = "skills"
+	}
+	return filepath.Join(configDir, subdir), nil
+}
+
+// homeSubdir returns a function that computes ~/subpath.
+func homeSubdir(subpath ...string) func(ctx context.Context) (string, error) {
+	return func(ctx context.Context) (string, error) {
+		home, err := env.UserHomeDir(ctx)
+		if err != nil {
+			return "", err
+		}
+		parts := append([]string{home}, subpath...)
+		return filepath.Join(parts...), nil
+	}
+}
+
+// ProjectSkillsDir returns the project-scoped skills directory for this agent.
+// Only valid for agents where SupportsProjectScope is true.
+func (a *Agent) ProjectSkillsDir(cwd string) string {
+	subdir := a.SkillsSubdir
+	if subdir == "" {
+		subdir = "skills"
+	}
+	return filepath.Join(cwd, a.ProjectConfigDir, subdir)
+}
+
+// Registry agent names. Behavior keyed on a specific agent (e.g. per-agent
+// plugin command shapes) references these instead of bare string literals.
+const (
+	NameClaudeCode  = "claude-code"
+	NameCursor      = "cursor"
+	NameCodex       = "codex"
+	NameOpenCode    = "opencode"
+	NameCopilot     = "copilot"
+	NameAntigravity = "antigravity"
+	NamePi          = "pi"
+	NameGemini      = "gemini"
+	NameGoose       = "goose"
+	NameKiro        = "kiro"
+)
+
+// Databricks plugin identity, shared across the agents that ship a plugin.
+// The verified install commands are e.g.
+//
+//	claude plugin marketplace add databricks/databricks-agent-skills
+//	claude plugin install        databricks@databricks-agent-skills
+const (
+	databricksMarketplace = "databricks-agent-skills"
+	databricksPluginID    = "databricks"
+	databricksPluginSrc   = "databricks/databricks-agent-skills"
+
+	claudeOfficialMarketplace    = "claude-plugins-official"
+	claudeOfficialMarketplaceSrc = "anthropics/claude-plugins-official"
+)
+
+// databricksPlugin returns the shared plugin descriptor for an agent that
+// installs from our own marketplace (Codex, Copilot).
+func databricksPlugin() *PluginSpec {
+	return &PluginSpec{
+		Marketplace: databricksMarketplace,
+		ID:          databricksPluginID,
+		Source:      databricksPluginSrc,
+	}
+}
+
+func claudePlugin() *PluginSpec {
+	return &PluginSpec{
+		Marketplace: claudeOfficialMarketplace,
+		ID:          databricksPluginID,
+		Source:      claudeOfficialMarketplaceSrc,
+		Shared:      true,
+	}
+}
+
+// Registry contains all supported agents. It holds pointers so callers can take
+// an *Agent without the &Registry[i] dance and call its pointer-receiver methods.
+var Registry = []*Agent{
+	{
+		Name:                 NameClaudeCode,
+		DisplayName:          "Claude Code",
+		ConfigDir:            claudeConfigDir,
+		SupportsProjectScope: true,
+		ProjectConfigDir:     ".claude",
+		Binary:               "claude",
+		Plugin:               claudePlugin(),
+		pluginVersion:        claudePluginVersion,
+	},
+	{
+		Name:        NameCursor,
+		DisplayName: "Cursor",
+		ConfigDir:   homeSubdir(".cursor"),
+		// Cursor's CLI binary is `cursor-agent`, not `cursor` (the latter is an
+		// IDE shim that isn't on PATH unless the user ran "install shell command").
+		Binary: "cursor-agent",
+		// Cursor has a databricks plugin, but it can't be installed headlessly, so
+		// the CLI treats Cursor as a skills-only agent (Plugin nil) rather than
+		// referencing a plugin it can't act on.
+	},
+	{
+		Name:        NameCodex,
+		DisplayName: "Codex CLI",
+		ConfigDir:   homeSubdir(".codex"),
+		Binary:      "codex",
+		Plugin:      databricksPlugin(),
+	},
+	{
+		Name:        NameOpenCode,
+		DisplayName: "OpenCode",
+		ConfigDir:   openCodeConfigDir,
+		Binary:      "opencode",
+		// OpenCode exposes an `opencode plugin <module>` command, but that's an
+		// npm-module system, not the agent-skills marketplace, so OpenCode stays
+		// skills-only (Plugin nil).
+	},
+	{
+		Name:        NameCopilot,
+		DisplayName: "GitHub Copilot",
+		ConfigDir:   homeSubdir(".copilot"),
+		Binary:      "copilot",
+		Plugin:      databricksPlugin(),
+	},
+	{
+		Name:         NameAntigravity,
+		DisplayName:  "Antigravity",
+		ConfigDir:    homeSubdir(".gemini", "antigravity"),
+		SkillsSubdir: "global_skills",
+		// Antigravity is IDE-only with no CLI binary, so it has no plugin path.
+	},
+	{
+		Name:                 NamePi,
+		DisplayName:          "Pi",
+		ConfigDir:            piConfigDir,
+		SupportsProjectScope: true,
+		ProjectConfigDir:     ".pi",
+		Binary:               "pi",
+		// Pi reads agent skills (SKILL.md) but has no databricks plugin, so it is
+		// skills-only (Plugin nil).
+	},
+	{
+		Name:                 NameGemini,
+		DisplayName:          "Gemini CLI",
+		ConfigDir:            geminiConfigDir,
+		SupportsProjectScope: true,
+		ProjectConfigDir:     ".gemini",
+		Binary:               "gemini",
+		// Gemini CLI reads agent skills (SKILL.md) but has no databricks plugin, so
+		// it is skills-only (Plugin nil).
+		// Gemini writes projects.json after real use. Antigravity shares ~/.gemini,
+		// and installation_id is not reliable, so detection uses this Gemini-only file.
+		MandatoryFile: "projects.json",
+	},
+	{
+		Name:                 NameGoose,
+		DisplayName:          "Goose",
+		ConfigDir:            gooseConfigDir,
+		SupportsProjectScope: true,
+		ProjectConfigDir:     ".goose",
+		Binary:               "goose",
+		// Goose reads agent skills (SKILL.md) but has no databricks plugin, so it is
+		// skills-only (Plugin nil).
+	},
+	{
+		Name:                 NameKiro,
+		DisplayName:          "Kiro",
+		ConfigDir:            homeSubdir(".kiro"),
+		SupportsProjectScope: true,
+		ProjectConfigDir:     ".kiro",
+		Binary:               "kiro",
+		// Kiro reads agent skills (SKILL.md) but has no databricks plugin, so it is
+		// skills-only (Plugin nil). Kiro's own picker text documents both scopes:
+		// "Skills can be added to ~/.kiro/skills/ (user-level) or .kiro/skills/
+		// (workspace-level)". Kiro is IDE-first, so `kiro` is frequently absent from
+		// PATH; detection then falls back to ConfigDir and reports files-only.
+	},
+}
+
+// claudeConfigDir follows Claude Code's configuration directory override.
+// See https://code.claude.com/docs/en/env-vars for CLAUDE_CONFIG_DIR.
+func claudeConfigDir(ctx context.Context) (string, error) {
+	if dir := env.Get(ctx, "CLAUDE_CONFIG_DIR"); dir != "" {
+		return dir, nil
+	}
+	return homeSubdir(".claude")(ctx)
+}
+
+// piConfigDir returns Pi's agent config directory: PI_CODING_AGENT_DIR when set,
+// else ~/.pi/agent. Mirroring Pi's own override keeps skills where Pi reads them
+// when a launcher (e.g. ucode) relocates its home.
+// See getAgentDir in @earendil-works/pi-coding-agent (config.ts).
+func piConfigDir(ctx context.Context) (string, error) {
+	if dir := env.Get(ctx, "PI_CODING_AGENT_DIR"); dir != "" {
+		if dir == "~" || strings.HasPrefix(dir, "~/") || (runtime.GOOS == "windows" && strings.HasPrefix(dir, `~\`)) {
+			home, err := env.UserHomeDir(ctx)
+			if err != nil {
+				return "", err
+			}
+			if dir == "~" {
+				return home, nil
+			}
+			return filepath.Join(home, dir[2:]), nil
+		}
+		return dir, nil
+	}
+	home, err := env.UserHomeDir(ctx)
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(home, ".pi", "agent"), nil
+}
+
+// geminiConfigDir returns Gemini CLI's config directory: <GEMINI_CLI_HOME>/.gemini
+// when set, else ~/.gemini. Honoring Gemini's own override keeps skills where it
+// reads them under a relocated home (e.g. ucode).
+// https://github.com/google-gemini/gemini-cli/blob/main/docs/reference/configuration.md
+func geminiConfigDir(ctx context.Context) (string, error) {
+	root := env.Get(ctx, "GEMINI_CLI_HOME")
+	if root == "" {
+		home, err := env.UserHomeDir(ctx)
+		if err != nil {
+			return "", err
+		}
+		root = home
+	}
+	return filepath.Join(root, ".gemini"), nil
+}
+
+// openCodeConfigDir returns OpenCode's config directory. OpenCode stores its
+// config under %APPDATA%\opencode (Roaming AppData) on Windows, and honors
+// XDG_CONFIG_HOME on other platforms, defaulting to ~/.config/opencode. The
+// previous hardcoded ~/.config/opencode made OpenCode undetectable on Windows
+// and ignored XDG_CONFIG_HOME on Linux.
+// See https://opencode.ai/docs/config/ and the XDG Base Directory spec.
+func openCodeConfigDir(ctx context.Context) (string, error) {
+	if runtime.GOOS == "windows" {
+		if appData := env.Get(ctx, "APPDATA"); appData != "" {
+			return filepath.Join(appData, "opencode"), nil
+		}
+	}
+	home, err := env.UserHomeDir(ctx)
+	if err != nil {
+		return "", err
+	}
+	xdg := env.Get(ctx, "XDG_CONFIG_HOME")
+	if xdg == "" {
+		xdg = filepath.Join(home, ".config")
+	}
+	return filepath.Join(xdg, "opencode"), nil
+}
+
+// gooseConfigDir returns Goose's config directory, matching how Goose resolves it
+// so skills land where it reads them, including under a relocated root. The Windows
+// path keeps the legacy "Block" segment for backwards compatibility.
+// See crates/goose/src/config/paths.rs (etcetera crate). https://block.github.io/goose/
+func gooseConfigDir(ctx context.Context) (string, error) {
+	if root := env.Get(ctx, "GOOSE_PATH_ROOT"); filepath.IsAbs(root) {
+		return filepath.Join(root, "config"), nil
+	}
+	if runtime.GOOS == "windows" {
+		if appData := env.Get(ctx, "APPDATA"); appData != "" {
+			return filepath.Join(appData, "Block", "goose", "config"), nil
+		}
+		home, err := env.UserHomeDir(ctx)
+		if err != nil {
+			return "", err
+		}
+		return filepath.Join(home, "AppData", "Roaming", "Block", "goose", "config"), nil
+	}
+	home, err := env.UserHomeDir(ctx)
+	if err != nil {
+		return "", err
+	}
+	xdg := env.Get(ctx, "XDG_CONFIG_HOME")
+	if !filepath.IsAbs(xdg) {
+		xdg = filepath.Join(home, ".config")
+	}
+	return filepath.Join(xdg, "goose"), nil
+}
+
+// ByName returns the registry agent with the given name, or nil if not found.
+func ByName(name string) *Agent {
+	for _, a := range Registry {
+		if a.Name == name {
+			return a
+		}
+	}
+	return nil
+}
+
+// DetectInstalled returns all agents that are installed on the system.
+func DetectInstalled(ctx context.Context) []*Agent {
+	var installed []*Agent
+	for _, a := range Registry {
+		if a.Detected(ctx) {
+			installed = append(installed, a)
+		}
+	}
+	return installed
+}
+
+// DetectProjectInstalled returns project-scope agents that already have Databricks
+// skills in the current project. Config-dir detection is home-based, so it misses
+// project-local installs; update uses this to also refresh those.
+func DetectProjectInstalled(cwd string) []*Agent {
+	var installed []*Agent
+	for _, a := range Registry {
+		if a.SupportsProjectScope && HasDatabricksSkillsIn(a.ProjectSkillsDir(cwd)) {
+			installed = append(installed, a)
+		}
+	}
+	return installed
+}
+
+// SupportedNames returns every agent's display name in registry order, so the
+// "Supported agents" messages can't drift as agents are added.
+func SupportedNames() []string {
+	names := make([]string, len(Registry))
+	for i, a := range Registry {
+		names[i] = a.DisplayName
+	}
+	return names
+}
+
+// SkillsOnlyNames returns the display names of skills-only agents (Plugin == nil)
+// in registry order, so the install help can't drift as they are added.
+func SkillsOnlyNames() []string {
+	var names []string
+	for _, a := range Registry {
+		if a.Plugin == nil {
+			names = append(names, a.DisplayName)
+		}
+	}
+	return names
+}
diff --git a/libs/aitools/agents/agents_test.go b/libs/aitools/agents/agents_test.go
new file mode 100644
index 00000000000..79cc0b79f58
--- /dev/null
+++ b/libs/aitools/agents/agents_test.go
@@ -0,0 +1,59 @@
+package agents
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/databricks/cli/libs/env"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestClaudeConfigDir(t *testing.T) {
+	home := t.TempDir()
+	custom := t.TempDir()
+	for _, tc := range []struct {
+		name     string
+		override string
+		want     string
+	}{
+		{"default", "", filepath.Join(home, ".claude")},
+		{"custom", custom, custom},
+		{"relative", "custom-claude", "custom-claude"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx := env.WithUserHomeDir(t.Context(), home)
+			ctx = env.Set(ctx, "CLAUDE_CONFIG_DIR", tc.override)
+			agent := ByName(NameClaudeCode)
+			dir, err := agent.ConfigDir(ctx)
+			require.NoError(t, err)
+			assert.Equal(t, tc.want, dir)
+			skills, err := agent.SkillsDir(ctx)
+			require.NoError(t, err)
+			assert.Equal(t, filepath.Join(tc.want, "skills"), skills)
+		})
+	}
+}
+
+func TestSupportedNamesMatchesRegistry(t *testing.T) {
+	names := SupportedNames()
+	assert.Len(t, names, len(Registry))
+	for i, a := range Registry {
+		assert.Equal(t, a.DisplayName, names[i])
+	}
+}
+
+func TestSkillsOnlyNamesMatchesRegistry(t *testing.T) {
+	names := SkillsOnlyNames()
+	// Skills-only agents (Plugin nil) are listed; plugin agents are not.
+	assert.Contains(t, names, "Pi")
+	assert.Contains(t, names, "Gemini CLI")
+	assert.Contains(t, names, "Goose")
+	assert.Contains(t, names, "Kiro")
+	assert.NotContains(t, names, "Claude Code")
+	for _, a := range Registry {
+		if a.Plugin != nil {
+			assert.NotContains(t, names, a.DisplayName)
+		}
+	}
+}
diff --git a/libs/aitools/agents/detect.go b/libs/aitools/agents/detect.go
new file mode 100644
index 00000000000..4b7edbf4dd1
--- /dev/null
+++ b/libs/aitools/agents/detect.go
@@ -0,0 +1,118 @@
+package agents
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os/exec"
+	"time"
+
+	"github.com/databricks/cli/libs/process"
+)
+
+// lookPath resolves a binary on PATH. It is a package-level var so tests can
+// inject a fake resolver without depending on the host PATH. It mirrors the
+// exec.LookPath precedent in libs/python/detect.go.
+var lookPath = exec.LookPath
+
+// pluginProbeTimeout bounds the `<agent> plugin --help` capability probe so a
+// hung agent CLI cannot stall install.
+const pluginProbeTimeout = 5 * time.Second
+
+// DisplayState describes how an agent should be presented in the install
+// picker. It combines the two cheap presence signals (binary on PATH and
+// config dir on disk) without running the agent.
+type DisplayState string
+
+const (
+	// StateAvailable: the agent's CLI binary is on PATH, so its plugin can be installed.
+	StateAvailable DisplayState = "available"
+	// StateInstalledCLIMissing: the config dir exists but the CLI binary is not on PATH.
+	StateInstalledCLIMissing DisplayState = "installed-cli-missing"
+	// StateFilesOnly: the agent has no plugin; skill files are its only delivery.
+	StateFilesOnly DisplayState = "files-only"
+	// StateNotFound: neither presence signal is present.
+	StateNotFound DisplayState = "not-found"
+)
+
+// ErrPluginUnsupported is returned by ProbePlugin when the agent cannot install
+// the databricks plugin: it has no binary, no plugin, or its CLI does not
+// expose a working `plugin` subcommand.
+var ErrPluginUnsupported = errors.New("agent CLI does not support plugins")
+
+// HasBinary reports whether the agent's CLI binary is resolvable on PATH.
+// Agents with no CLI binary (Antigravity) always report false.
+func (a *Agent) HasBinary(_ context.Context) bool {
+	if a.Binary == "" {
+		return false
+	}
+	_, err := lookPath(a.Binary)
+	return err == nil
+}
+
+// DisplayState returns the picker presentation state for the agent. It never
+// runs the agent (that is ProbePlugin's job); it only checks the binary on
+// PATH and the config dir on disk, so it is cheap enough for every render.
+func (a *Agent) DisplayState(ctx context.Context) DisplayState {
+	hasBinary := a.HasBinary(ctx)
+	hasConfig := a.Detected(ctx)
+
+	if a.Plugin == nil {
+		if hasBinary || hasConfig {
+			return StateFilesOnly
+		}
+		return StateNotFound
+	}
+
+	switch {
+	case hasBinary:
+		return StateAvailable
+	case hasConfig:
+		return StateInstalledCLIMissing
+	default:
+		return StateNotFound
+	}
+}
+
+// IsPreselected reports whether the agent should be pre-checked in the picker. Only
+// agents that can complete an install automatically (a plugin agent with its
+// binary on PATH) and files-only agents whose config dir exists are pre-checked;
+// binary-missing agents are shown but left unchecked.
+func (a *Agent) IsPreselected(ctx context.Context) bool {
+	switch a.DisplayState(ctx) {
+	case StateAvailable:
+		return true
+	case StateFilesOnly:
+		return a.Detected(ctx)
+	default:
+		return false
+	}
+}
+
+// ProbePlugin checks whether the agent's CLI actually supports the plugin
+// subcommand by running `<agent> plugin --help` with a short timeout. It is the
+// only function here that executes the agent and is meant to be called once,
+// for a selected agent, right before install. It returns ErrPluginUnsupported
+// when the agent has no plugin path or its CLI lacks the subcommand.
+func (a *Agent) ProbePlugin(ctx context.Context) error {
+	if a.Binary == "" || a.Plugin == nil {
+		return ErrPluginUnsupported
+	}
+
+	// exec.LookPath returns exec.ErrDot (along with the path) when the binary
+	// resolves only relative to the current directory. Returning on any error,
+	// including ErrDot, means we never execute a binary resolved from cwd (a
+	// malicious ./claude dropped there is refused, not run).
+	path, err := lookPath(a.Binary)
+	if err != nil {
+		return fmt.Errorf("could not resolve %s on PATH: %w", a.Binary, err)
+	}
+
+	cctx, cancel := context.WithTimeout(ctx, pluginProbeTimeout)
+	defer cancel()
+
+	if _, err := process.Background(cctx, []string{path, "plugin", "--help"}); err != nil {
+		return fmt.Errorf("%s plugin subcommand unavailable: %w", a.Binary, errors.Join(ErrPluginUnsupported, err))
+	}
+	return nil
+}
diff --git a/libs/aitools/agents/detect_test.go b/libs/aitools/agents/detect_test.go
new file mode 100644
index 00000000000..dfb7a8c6ec1
--- /dev/null
+++ b/libs/aitools/agents/detect_test.go
@@ -0,0 +1,401 @@
+package agents
+
+import (
+	"context"
+	"errors"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"testing"
+
+	"github.com/databricks/cli/libs/process"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// stubLookPath replaces the package lookPath with one that resolves only the
+// named binaries, restoring the original when the test finishes.
+func stubLookPath(t *testing.T, onPath ...string) {
+	t.Helper()
+	set := make(map[string]bool, len(onPath))
+	for _, name := range onPath {
+		set[name] = true
+	}
+	orig := lookPath
+	lookPath = func(name string) (string, error) {
+		if set[name] {
+			return filepath.Join("/usr/bin", name), nil
+		}
+		return "", exec.ErrNotFound
+	}
+	t.Cleanup(func() { lookPath = orig })
+}
+
+// configDir returns a closure usable as Agent.ConfigDir. When create is true a
+// directory is materialized so Detected reports it; otherwise it points at a
+// path that does not exist.
+func configDir(t *testing.T, create bool) func(context.Context) (string, error) {
+	t.Helper()
+	dir := filepath.Join(t.TempDir(), "config")
+	if create {
+		require.NoError(t, os.MkdirAll(dir, 0o755))
+	}
+	return func(_ context.Context) (string, error) { return dir, nil }
+}
+
+func TestDetected(t *testing.T) {
+	ctx := t.Context()
+
+	t.Run("bare config dir is the default signal", func(t *testing.T) {
+		a := &Agent{ConfigDir: configDir(t, true)}
+		assert.True(t, a.Detected(ctx))
+	})
+
+	t.Run("missing config dir is not detected", func(t *testing.T) {
+		a := &Agent{ConfigDir: configDir(t, false)}
+		assert.False(t, a.Detected(ctx))
+	})
+
+	t.Run("MandatoryFile requires the marker, not just the dir", func(t *testing.T) {
+		dir := t.TempDir()
+		a := &Agent{ConfigDir: func(context.Context) (string, error) { return dir, nil }, MandatoryFile: "marker"}
+		// Directory exists but the marker does not: not detected.
+		assert.False(t, a.Detected(ctx))
+		require.NoError(t, os.WriteFile(filepath.Join(dir, "marker"), []byte("x"), 0o644))
+		assert.True(t, a.Detected(ctx))
+	})
+
+	t.Run("Gemini remains detected after skills install before first run", func(t *testing.T) {
+		home := t.TempDir()
+		t.Setenv("HOME", home)
+		t.Setenv("USERPROFILE", home)
+		t.Setenv("GEMINI_CLI_HOME", "")
+		require.NoError(t, os.MkdirAll(filepath.Join(home, ".gemini", "skills", "databricks-core"), 0o755))
+
+		gemini := ByName(NameGemini)
+		require.NotNil(t, gemini)
+		assert.NoFileExists(t, filepath.Join(home, ".gemini", "projects.json"))
+		assert.True(t, gemini.Detected(ctx))
+	})
+
+	t.Run("Gemini is not detected merely because Antigravity exists", func(t *testing.T) {
+		home := t.TempDir()
+		t.Setenv("HOME", home)
+		t.Setenv("USERPROFILE", home)
+		// Antigravity creates ~/.gemini/antigravity, which also makes ~/.gemini exist.
+		require.NoError(t, os.MkdirAll(filepath.Join(home, ".gemini", "antigravity"), 0o755))
+
+		gemini := ByName(NameGemini)
+		require.NotNil(t, gemini)
+		antigravity := ByName(NameAntigravity)
+		require.NotNil(t, antigravity)
+
+		assert.True(t, antigravity.Detected(ctx), "Antigravity should be detected from its own dir")
+		assert.False(t, gemini.Detected(ctx), "Gemini must not be detected from Antigravity's shared ~/.gemini")
+
+		// Once Gemini writes its own marker, it is detected.
+		require.NoError(t, os.WriteFile(filepath.Join(home, ".gemini", "projects.json"), []byte("id"), 0o644))
+		assert.True(t, gemini.Detected(ctx))
+	})
+}
+
+func TestPiConfigDir(t *testing.T) {
+	ctx := t.Context()
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
+
+	t.Run("defaults to ~/.pi/agent", func(t *testing.T) {
+		t.Setenv("PI_CODING_AGENT_DIR", "")
+		dir, err := piConfigDir(ctx)
+		require.NoError(t, err)
+		assert.Equal(t, filepath.Join(home, ".pi", "agent"), dir)
+	})
+
+	t.Run("honors PI_CODING_AGENT_DIR override", func(t *testing.T) {
+		override := t.TempDir()
+		t.Setenv("PI_CODING_AGENT_DIR", override)
+		dir, err := piConfigDir(ctx)
+		require.NoError(t, err)
+		assert.Equal(t, override, dir)
+	})
+
+	t.Run("expands home in PI_CODING_AGENT_DIR override", func(t *testing.T) {
+		t.Setenv("PI_CODING_AGENT_DIR", "~/custom-agent")
+		dir, err := piConfigDir(ctx)
+		require.NoError(t, err)
+		assert.Equal(t, filepath.Join(home, "custom-agent"), dir)
+	})
+
+	t.Run("expands bare home in PI_CODING_AGENT_DIR override", func(t *testing.T) {
+		t.Setenv("PI_CODING_AGENT_DIR", "~")
+		dir, err := piConfigDir(ctx)
+		require.NoError(t, err)
+		assert.Equal(t, home, dir)
+	})
+
+	t.Run("expands Windows home separator", func(t *testing.T) {
+		if runtime.GOOS != "windows" {
+			t.Skip("Windows-only path form")
+		}
+		t.Setenv("PI_CODING_AGENT_DIR", `~\custom-agent`)
+		dir, err := piConfigDir(ctx)
+		require.NoError(t, err)
+		assert.Equal(t, filepath.Join(home, "custom-agent"), dir)
+	})
+
+	t.Run("preserves other tilde prefixes", func(t *testing.T) {
+		t.Setenv("PI_CODING_AGENT_DIR", "~other/custom-agent")
+		dir, err := piConfigDir(ctx)
+		require.NoError(t, err)
+		assert.Equal(t, "~other/custom-agent", dir)
+	})
+}
+
+func TestGooseConfigDir(t *testing.T) {
+	ctx := t.Context()
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
+
+	absRoot := t.TempDir()
+	absXDG := t.TempDir()
+	absAppData := t.TempDir()
+	// Windows resolves under %APPDATA%, falling back to %USERPROFILE%\AppData\Roaming.
+	winDefault := filepath.Join(home, "AppData", "Roaming", "Block", "goose", "config")
+
+	// onlyOn restricts a case to one platform: "windows", "unix" (any non-Windows),
+	// or "" for every platform. Goose only honors an absolute path override.
+	tests := []struct {
+		name      string
+		onlyOn    string
+		gooseRoot string
+		xdg       string
+		appData   string
+		want      string
+	}{
+		{name: "absolute GOOSE_PATH_ROOT wins", gooseRoot: absRoot, want: filepath.Join(absRoot, "config")},
+		{name: "relative GOOSE_PATH_ROOT ignored, unix", onlyOn: "unix", gooseRoot: "relative/root", want: filepath.Join(home, ".config", "goose")},
+		{name: "relative GOOSE_PATH_ROOT ignored, windows", onlyOn: "windows", gooseRoot: "relative/root", want: winDefault},
+		{name: "honors XDG_CONFIG_HOME", onlyOn: "unix", xdg: absXDG, want: filepath.Join(absXDG, "goose")},
+		{name: "ignores relative XDG_CONFIG_HOME", onlyOn: "unix", xdg: "relative/config", want: filepath.Join(home, ".config", "goose")},
+		{name: "defaults to ~/.config when XDG unset", onlyOn: "unix", want: filepath.Join(home, ".config", "goose")},
+		{name: "honors APPDATA", onlyOn: "windows", appData: absAppData, want: filepath.Join(absAppData, "Block", "goose", "config")},
+		{name: "defaults to USERPROFILE when APPDATA unset", onlyOn: "windows", want: winDefault},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			if tc.onlyOn == "windows" && runtime.GOOS != "windows" {
+				t.Skip("Windows-only path")
+			}
+			if tc.onlyOn == "unix" && runtime.GOOS == "windows" {
+				t.Skip("non-Windows path")
+			}
+			t.Setenv("GOOSE_PATH_ROOT", tc.gooseRoot)
+			t.Setenv("XDG_CONFIG_HOME", tc.xdg)
+			t.Setenv("APPDATA", tc.appData)
+			dir, err := gooseConfigDir(ctx)
+			require.NoError(t, err)
+			assert.Equal(t, tc.want, dir)
+		})
+	}
+}
+
+func TestGeminiConfigDir(t *testing.T) {
+	ctx := t.Context()
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
+
+	t.Run("defaults to ~/.gemini", func(t *testing.T) {
+		t.Setenv("GEMINI_CLI_HOME", "")
+		dir, err := geminiConfigDir(ctx)
+		require.NoError(t, err)
+		assert.Equal(t, filepath.Join(home, ".gemini"), dir)
+	})
+
+	t.Run("honors GEMINI_CLI_HOME override and appends .gemini", func(t *testing.T) {
+		root := t.TempDir()
+		t.Setenv("GEMINI_CLI_HOME", root)
+		dir, err := geminiConfigDir(ctx)
+		require.NoError(t, err)
+		assert.Equal(t, filepath.Join(root, ".gemini"), dir)
+	})
+}
+
+func TestHasBinary(t *testing.T) {
+	ctx := t.Context()
+
+	t.Run("empty binary is never on path", func(t *testing.T) {
+		stubLookPath(t)
+		a := &Agent{Binary: ""}
+		assert.False(t, a.HasBinary(ctx))
+	})
+
+	t.Run("resolved binary is on path", func(t *testing.T) {
+		stubLookPath(t, "claude")
+		a := &Agent{Binary: "claude"}
+		assert.True(t, a.HasBinary(ctx))
+	})
+
+	t.Run("missing binary is not on path", func(t *testing.T) {
+		stubLookPath(t)
+		a := &Agent{Binary: "claude"}
+		assert.False(t, a.HasBinary(ctx))
+	})
+}
+
+func TestDisplayState(t *testing.T) {
+	ctx := t.Context()
+
+	tests := []struct {
+		name     string
+		binary   string
+		onPath   []string
+		plugin   *PluginSpec
+		hasCfg   bool
+		expected DisplayState
+	}{
+		{"plugin agent, binary on path", "claude", []string{"claude"}, &PluginSpec{}, false, StateAvailable},
+		{"plugin agent, binary on path, config too", "claude", []string{"claude"}, &PluginSpec{}, true, StateAvailable},
+		{"plugin agent, no binary, config exists", "claude", nil, &PluginSpec{}, true, StateInstalledCLIMissing},
+		{"plugin agent, no binary, no config", "claude", nil, &PluginSpec{}, false, StateNotFound},
+		{"files-only agent, binary on path", "opencode", []string{"opencode"}, nil, false, StateFilesOnly},
+		{"files-only agent, config only", "opencode", nil, nil, true, StateFilesOnly},
+		{"files-only agent, neither", "opencode", nil, nil, false, StateNotFound},
+		{"files-only agent, no binary name, config", "", nil, nil, true, StateFilesOnly},
+		{"files-only agent, no binary name, no config", "", nil, nil, false, StateNotFound},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			stubLookPath(t, tc.onPath...)
+			a := &Agent{Binary: tc.binary, Plugin: tc.plugin, ConfigDir: configDir(t, tc.hasCfg)}
+			assert.Equal(t, tc.expected, a.DisplayState(ctx))
+		})
+	}
+}
+
+func TestIsPreselected(t *testing.T) {
+	ctx := t.Context()
+
+	tests := []struct {
+		name     string
+		binary   string
+		onPath   []string
+		plugin   *PluginSpec
+		hasCfg   bool
+		expected bool
+	}{
+		{"available is pre-checked", "claude", []string{"claude"}, &PluginSpec{}, false, true},
+		{"files-only with config is pre-checked", "opencode", nil, nil, true, true},
+		{"files-only without config is not", "opencode", []string{"opencode"}, nil, false, false},
+		{"installed-cli-missing is not pre-checked", "claude", nil, &PluginSpec{}, true, false},
+		{"not-found is not pre-checked", "claude", nil, &PluginSpec{}, false, false},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			stubLookPath(t, tc.onPath...)
+			a := &Agent{Binary: tc.binary, Plugin: tc.plugin, ConfigDir: configDir(t, tc.hasCfg)}
+			assert.Equal(t, tc.expected, a.IsPreselected(ctx))
+		})
+	}
+}
+
+func TestProbePluginUnsupportedWithoutCapability(t *testing.T) {
+	ctx := t.Context()
+
+	tests := []struct {
+		name  string
+		agent *Agent
+	}{
+		{"no binary", &Agent{Binary: "", Plugin: &PluginSpec{}}},
+		{"no plugin", &Agent{Binary: "antigravity"}},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			err := tc.agent.ProbePlugin(ctx)
+			assert.ErrorIs(t, err, ErrPluginUnsupported)
+		})
+	}
+}
+
+func TestProbePluginSupported(t *testing.T) {
+	stubLookPath(t, "claude")
+	ctx, stub := process.WithStub(t.Context())
+	stub.WithCallback(func(*exec.Cmd) error { return nil })
+
+	a := &Agent{Binary: "claude", Plugin: &PluginSpec{}}
+	require.NoError(t, a.ProbePlugin(ctx))
+	assert.Equal(t, []string{"claude plugin --help"}, stub.Commands())
+}
+
+func TestProbePluginCLIReportsUnsupported(t *testing.T) {
+	stubLookPath(t, "codex")
+	ctx, stub := process.WithStub(t.Context())
+	stub.WithFailure(errors.New("unknown command: plugin"))
+
+	a := &Agent{Binary: "codex", Plugin: &PluginSpec{}}
+	err := a.ProbePlugin(ctx)
+	assert.ErrorIs(t, err, ErrPluginUnsupported)
+	assert.Equal(t, 1, stub.Len())
+}
+
+func TestProbePluginBinaryNotOnPath(t *testing.T) {
+	stubLookPath(t)
+	ctx, stub := process.WithStub(t.Context())
+
+	a := &Agent{Binary: "claude", Plugin: &PluginSpec{}}
+	err := a.ProbePlugin(ctx)
+	assert.ErrorIs(t, err, exec.ErrNotFound)
+	assert.Equal(t, 0, stub.Len(), "binary not on PATH must not be executed")
+}
+
+func TestProbePluginRefusesDotRelativeBinary(t *testing.T) {
+	// LookPath returns ErrDot (with a path) when the binary resolves only
+	// relative to cwd. ProbePlugin must refuse to run it.
+	orig := lookPath
+	lookPath = func(name string) (string, error) { return filepath.Join(".", name), exec.ErrDot }
+	t.Cleanup(func() { lookPath = orig })
+
+	ctx, stub := process.WithStub(t.Context())
+	a := &Agent{Binary: "claude", Plugin: &PluginSpec{}}
+	err := a.ProbePlugin(ctx)
+	assert.ErrorIs(t, err, exec.ErrDot)
+	assert.Equal(t, 0, stub.Len(), "a cwd-relative binary must never be executed")
+}
+
+func TestOpenCodeConfigDir(t *testing.T) {
+	ctx := t.Context()
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
+
+	if runtime.GOOS == "windows" {
+		appData := t.TempDir()
+		t.Setenv("APPDATA", appData)
+		dir, err := openCodeConfigDir(ctx)
+		require.NoError(t, err)
+		assert.Equal(t, filepath.Join(appData, "opencode"), dir)
+		return
+	}
+
+	t.Run("honors XDG_CONFIG_HOME", func(t *testing.T) {
+		xdg := t.TempDir()
+		t.Setenv("XDG_CONFIG_HOME", xdg)
+		dir, err := openCodeConfigDir(ctx)
+		require.NoError(t, err)
+		assert.Equal(t, filepath.Join(xdg, "opencode"), dir)
+	})
+
+	t.Run("defaults to ~/.config when XDG is unset", func(t *testing.T) {
+		t.Setenv("XDG_CONFIG_HOME", "")
+		dir, err := openCodeConfigDir(ctx)
+		require.NoError(t, err)
+		assert.Equal(t, filepath.Join(home, ".config", "opencode"), dir)
+	})
+}
diff --git a/libs/aitools/agents/hint.go b/libs/aitools/agents/hint.go
new file mode 100644
index 00000000000..802c04bbc90
--- /dev/null
+++ b/libs/aitools/agents/hint.go
@@ -0,0 +1,141 @@
+package agents
+
+import (
+	"context"
+	"path/filepath"
+	"time"
+
+	"github.com/databricks/cli/libs/cache"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/env"
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/databricks-sdk-go/useragent"
+	"github.com/spf13/cobra"
+)
+
+const (
+	// hintText recommends installing the Databricks AI tooling. The wording
+	// is deliberately chosen to be effective at helping agents; change it only
+	// after thorough testing.
+	hintText = "Databricks skills are not installed. To work with Databricks reliably, first run: databricks aitools install"
+
+	// claudeAgentProvider is the useragent.AgentProvider() value for Claude Code.
+	// The SDK maps the CLAUDECODE env var to this product name. The hint is
+	// Claude-only for now (detection reads Claude's own on-disk state).
+	// https://github.com/databricks/databricks-sdk-go/blob/main/useragent/agent.go
+	claudeAgentProvider = "claude-code"
+
+	// aiToolsCommandName is the top-level command whose subtree is never hinted:
+	// telling the agent to run `databricks aitools install` while it is already
+	// running an aitools command makes no sense.
+	aiToolsCommandName = "aitools"
+
+	// claudeSessionEnv is Claude Code's per-session identifier. It keys the
+	// per-session throttle (at most one hint per hintSessionTTL per session);
+	// when unset (older Claude) the hint degrades to per-command.
+	claudeSessionEnv = "CLAUDE_CODE_SESSION_ID"
+
+	// hintCacheComponent names the cache bucket holding per-session "already
+	// hinted" markers.
+	hintCacheComponent = "aitools-hint"
+)
+
+// hintSessionTTL is how long a session's "already hinted" marker lives. Within
+// that window a session is hinted at most once; after it expires the hint may
+// fire again for the same session.
+const hintSessionTTL = time.Hour
+
+// MaybeHint prints a one-line recommendation to install the Databricks AI
+// tooling when Claude Code drives the CLI without it installed. It is a no-op
+// for human callers, other agents, aitools commands themselves, when there is
+// no output stream, once the tooling is present, and when the session was
+// hinted within the last hintSessionTTL. Best-effort: it writes only to stderr
+// and never fails the command.
+func MaybeHint(ctx context.Context, cmd *cobra.Command) {
+	if useragent.AgentProvider() != claudeAgentProvider {
+		return
+	}
+	if isAIToolsCommand(cmd) {
+		return
+	}
+	if !cmdio.HasIO(ctx) {
+		return
+	}
+	// Check the session throttle before the filesystem probe: once a session has
+	// been hinted, later commands short-circuit here and skip the plugin/skills
+	// detection. The throttle token is written only after a hint prints (below),
+	// so an already-installed environment never burns it.
+	if alreadyHintedThisSession(ctx) {
+		return
+	}
+	if claudeToolingInstalled(ctx) {
+		return
+	}
+	cmdio.LogString(ctx, hintText)
+	recordSessionHint(ctx)
+}
+
+// isAIToolsCommand reports whether cmd is the aitools command or one of its
+// subcommands, walking the parent chain (mirrors versioncheck.isExemptCommand).
+func isAIToolsCommand(cmd *cobra.Command) bool {
+	for c := cmd; c != nil; c = c.Parent() {
+		if c.Name() == aiToolsCommandName {
+			return true
+		}
+	}
+	return false
+}
+
+// claudeToolingInstalled reports whether Databricks AI tooling is present for
+// Claude Code. It checks two signals: the databricks plugin in Claude's own
+// plugin manifest (written both by `databricks aitools install` and by a direct
+// `claude plugin install`), and databricks skill files in the shared canonical
+// skills dir (written by `aitools install --skills-only`). Any read/parse
+// failure reports false, so an unreadable state errs toward hinting.
+func claudeToolingInstalled(ctx context.Context) bool {
+	claude := ByName(NameClaudeCode)
+	if claude == nil {
+		// claude-code is always in the registry; this guard keeps the hint
+		// best-effort rather than panicking in a persistent pre-run hook.
+		return false
+	}
+	if version, ok := claude.DatabricksPluginVersion(ctx); ok {
+		log.Debugf(ctx, "Databricks plugin detected for Claude Code (version %q); skipping install hint", version)
+		return true
+	}
+
+	// The canonical dir always holds a real databricks* subdir after a skills
+	// install, regardless of whether the agent copy is a symlink or a copy. The
+	// legacy dir is checked too so users of an older install aren't hinted.
+	home, err := env.UserHomeDir(ctx)
+	if err != nil {
+		return false
+	}
+	return HasDatabricksSkillsIn(filepath.Join(home, CanonicalSkillsDir)) ||
+		HasDatabricksSkillsIn(filepath.Join(home, LegacySkillsDir))
+}
+
+// alreadyHintedThisSession reports whether this Claude session was hinted
+// within the last hintSessionTTL. With no session id it returns false so the
+// hint fires per command.
+func alreadyHintedThisSession(ctx context.Context) bool {
+	session := env.Get(ctx, claudeSessionEnv)
+	if session == "" {
+		return false
+	}
+	c := cache.NewCache(ctx, hintCacheComponent, hintSessionTTL, nil)
+	_, seen := cache.Get[bool](ctx, c, session)
+	return seen
+}
+
+// recordSessionHint marks the current Claude session as hinted, so later
+// commands in the same session stay quiet until the marker expires
+// (hintSessionTTL). No-op when the session id is unset.
+func recordSessionHint(ctx context.Context) {
+	session := env.Get(ctx, claudeSessionEnv)
+	if session == "" {
+		return
+	}
+	c := cache.NewCache(ctx, hintCacheComponent, hintSessionTTL, nil)
+	cache.Put(ctx, c, session, true)
+}
diff --git a/libs/aitools/agents/hint_test.go b/libs/aitools/agents/hint_test.go
new file mode 100644
index 00000000000..b2a16ffb8e8
--- /dev/null
+++ b/libs/aitools/agents/hint_test.go
@@ -0,0 +1,231 @@
+package agents
+
+import (
+	"bytes"
+	"context"
+	"log/slog"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/env"
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/databricks-sdk-go/useragent"
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// agentEnvVars are the env vars useragent.AgentProvider() inspects. Kept in
+// sync with listKnownAgents() in the SDK plus the AGENT/AI_AGENT fallbacks
+// (mirrors acceptance/acceptance_test.go).
+var agentEnvVars = []string{
+	"AGENT", "AI_AGENT", "AMP_CURRENT_THREAD_ID", "ANTIGRAVITY_AGENT",
+	"AUGMENT_AGENT", "CLAUDECODE", "CLINE_ACTIVE", "CODEX_CI", "COPILOT_CLI",
+	"CURSOR_AGENT", "GEMINI_CLI", "GOOSE_TERMINAL", "KIRO", "OPENCLAW_SHELL",
+	"OPENCODE", "VSCODE_AGENT", "WINDSURF_AGENT",
+}
+
+// clearAgentEnv unsets every agent-detection env var (restoring them after the
+// test) so the host agent driving this test binary does not leak into
+// AgentProvider(). t.Setenv cannot unset, hence the manual save/restore.
+func clearAgentEnv(t *testing.T) {
+	for _, v := range agentEnvVars {
+		if orig, ok := os.LookupEnv(v); ok {
+			t.Cleanup(func() { os.Setenv(v, orig) }) //nolint:usetesting // restoring, not setting fresh
+			os.Unsetenv(v)                           //nolint:usetesting // t.Setenv cannot unset
+		}
+	}
+}
+
+// setClaudeAgent makes useragent.AgentProvider() report Claude Code for this
+// test. It clears the ambient agent env, sets CLAUDECODE, and resets the SDK's
+// process-global cache, so these tests must not run in parallel. The cleanup
+// clears the cache again so the value never leaks into another test.
+func setClaudeAgent(t *testing.T) {
+	clearAgentEnv(t)
+	t.Setenv("CLAUDECODE", "1")
+	useragent.ClearCache()
+	t.Cleanup(useragent.ClearCache)
+}
+
+// claudeCtx returns a context with a captured stderr buffer and an isolated
+// HOME + cache dir, so detection and the session throttle read only the test's
+// temp state. home is returned so the test can drop fixtures under it.
+func claudeCtx(t *testing.T, home string) (context.Context, *bytes.Buffer) {
+	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
+	ctx = env.WithUserHomeDir(ctx, home)
+	ctx = env.Set(ctx, "DATABRICKS_CACHE_DIR", t.TempDir())
+	return ctx, stderr
+}
+
+func regularCmd() *cobra.Command { return &cobra.Command{Use: "current-user"} }
+
+func writePluginManifest(t *testing.T, home, body string) {
+	dir := filepath.Join(home, ".claude", "plugins")
+	require.NoError(t, os.MkdirAll(dir, 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "installed_plugins.json"), []byte(body), 0o600))
+}
+
+func writeCanonicalSkill(t *testing.T, home, name string) {
+	require.NoError(t, os.MkdirAll(filepath.Join(home, ".databricks", "aitools", "skills", name), 0o755))
+}
+
+func TestMaybeHint_HumanCallerSilent(t *testing.T) {
+	// No agent env: AgentProvider() == "", so no hint even with nothing installed.
+	clearAgentEnv(t)
+	useragent.ClearCache()
+	t.Cleanup(useragent.ClearCache)
+	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
+	ctx = env.WithUserHomeDir(ctx, t.TempDir())
+	MaybeHint(ctx, regularCmd())
+	assert.Empty(t, stderr.String())
+}
+
+func TestMaybeHint_ClaudeNotInstalledHints(t *testing.T) {
+	setClaudeAgent(t)
+	ctx, stderr := claudeCtx(t, t.TempDir())
+	MaybeHint(ctx, regularCmd())
+	assert.Contains(t, stderr.String(), hintText)
+}
+
+func TestMaybeHint_PluginInstalledSilent(t *testing.T) {
+	setClaudeAgent(t)
+	home := t.TempDir()
+	ctx, stderr := claudeCtx(t, home)
+	// The core regression: a plugin install writes only Claude's manifest, no
+	// skills subdir. Detection must treat it as installed.
+	writePluginManifest(t, home, `{"plugins":{"databricks@claude-plugins-official":[{"scope":"user"}]}}`)
+
+	MaybeHint(ctx, regularCmd())
+	assert.Empty(t, stderr.String())
+}
+
+func TestClaudeToolingInstalled_LogsPluginVersion(t *testing.T) {
+	home := t.TempDir()
+	writePluginManifest(t, home, `{"plugins":{"databricks@claude-plugins-official":[{"version":"0.2.6"}]}}`)
+
+	// Capture debug output by installing a text logger on the context.
+	var buf bytes.Buffer
+	handler := slog.NewTextHandler(&buf, &slog.HandlerOptions{Level: log.LevelDebug})
+	ctx := log.NewContext(t.Context(), slog.New(handler))
+	ctx = env.WithUserHomeDir(ctx, home)
+
+	assert.True(t, claudeToolingInstalled(ctx))
+
+	// The text handler escapes the inner quotes around the version, so assert on
+	// the stable, unescaped fragments rather than the full quoted message.
+	out := buf.String()
+	assert.Contains(t, out, "Databricks plugin detected for Claude Code")
+	assert.Contains(t, out, "0.2.6")
+	assert.Contains(t, out, "skipping install hint")
+}
+
+func TestMaybeHint_CustomClaudeConfigDir(t *testing.T) {
+	setClaudeAgent(t)
+	for _, tc := range []struct {
+		name             string
+		customInstalled  bool
+		defaultInstalled bool
+		wantHint         bool
+	}{
+		{"custom plugin", true, false, false},
+		{"both plugins", true, true, false},
+		{"default plugin only", false, true, true},
+		{"neither plugin", false, false, true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			home := t.TempDir()
+			customHome := t.TempDir()
+			ctx, stderr := claudeCtx(t, home)
+			ctx = env.Set(ctx, "CLAUDE_CONFIG_DIR", filepath.Join(customHome, ".claude"))
+			manifest := `{"plugins":{"databricks@local":[{"version":"1.0.0"}]}}`
+			if tc.customInstalled {
+				writePluginManifest(t, customHome, manifest)
+			}
+			if tc.defaultInstalled {
+				writePluginManifest(t, home, manifest)
+			}
+
+			MaybeHint(ctx, regularCmd())
+			if tc.wantHint {
+				assert.Contains(t, stderr.String(), hintText)
+			} else {
+				assert.Empty(t, stderr.String())
+			}
+		})
+	}
+}
+
+func TestMaybeHint_SkillsInstalledSilent(t *testing.T) {
+	setClaudeAgent(t)
+	home := t.TempDir()
+	ctx, stderr := claudeCtx(t, home)
+	writeCanonicalSkill(t, home, "databricks")
+
+	MaybeHint(ctx, regularCmd())
+	assert.Empty(t, stderr.String())
+}
+
+func TestMaybeHint_LegacySkillsInstalledSilent(t *testing.T) {
+	setClaudeAgent(t)
+	home := t.TempDir()
+	ctx, stderr := claudeCtx(t, home)
+	require.NoError(t, os.MkdirAll(filepath.Join(home, ".databricks", "agent-skills", "databricks"), 0o755))
+
+	MaybeHint(ctx, regularCmd())
+	assert.Empty(t, stderr.String())
+}
+
+func TestMaybeHint_NonDatabricksSkillStillHints(t *testing.T) {
+	setClaudeAgent(t)
+	home := t.TempDir()
+	ctx, stderr := claudeCtx(t, home)
+	writeCanonicalSkill(t, home, "some-other-skill")
+
+	MaybeHint(ctx, regularCmd())
+	assert.Contains(t, stderr.String(), hintText)
+}
+
+func TestMaybeHint_AIToolsCommandSilent(t *testing.T) {
+	setClaudeAgent(t)
+	ctx, stderr := claudeCtx(t, t.TempDir())
+
+	parent := &cobra.Command{Use: aiToolsCommandName}
+	child := &cobra.Command{Use: "install"}
+	parent.AddCommand(child)
+
+	MaybeHint(ctx, child)
+	assert.Empty(t, stderr.String())
+}
+
+func TestMaybeHint_NoIONoPanic(t *testing.T) {
+	setClaudeAgent(t)
+	// Bare context without cmdio installed: cobra resolves --help and bare
+	// invocations before PersistentPreRunE runs, so HasIO can be false here.
+	ctx := env.WithUserHomeDir(t.Context(), t.TempDir())
+	assert.NotPanics(t, func() { MaybeHint(ctx, regularCmd()) })
+}
+
+func TestMaybeHint_ThrottledPerSession(t *testing.T) {
+	setClaudeAgent(t)
+	home := t.TempDir()
+	cacheDir := t.TempDir()
+	newCtx := func() (context.Context, *bytes.Buffer) {
+		ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
+		ctx = env.WithUserHomeDir(ctx, home)
+		ctx = env.Set(ctx, "DATABRICKS_CACHE_DIR", cacheDir)
+		ctx = env.Set(ctx, claudeSessionEnv, "session-abc")
+		return ctx, stderr
+	}
+
+	ctx1, stderr1 := newCtx()
+	MaybeHint(ctx1, regularCmd())
+	assert.Contains(t, stderr1.String(), hintText)
+
+	// Same session id, second command: must stay quiet.
+	ctx2, stderr2 := newCtx()
+	MaybeHint(ctx2, regularCmd())
+	assert.Empty(t, stderr2.String())
+}
diff --git a/libs/aitools/agents/plugins.go b/libs/aitools/agents/plugins.go
new file mode 100644
index 00000000000..ce8d2eeef6a
--- /dev/null
+++ b/libs/aitools/agents/plugins.go
@@ -0,0 +1,78 @@
+package agents
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"golang.org/x/mod/semver"
+)
+
+// pluginManifestFile is the file an agent's own plugin CLI writes to record
+// installed plugins. Claude Code stores it at <configDir>/plugins and keys each
+// entry as "<id>@<marketplace>" (e.g. "databricks@claude-plugins-official").
+const pluginManifestFile = "installed_plugins.json"
+
+// pluginInstall is one install record in an agent's plugin manifest. A plugin
+// installed in more than one scope has several records; only the version is
+// consumed here.
+type pluginInstall struct {
+	Version string `json:"version"`
+}
+
+// DatabricksPluginVersion reports the recorded version of the databricks plugin
+// in the agent's own plugin manifest and whether the plugin is installed at all.
+// This catches installs done through `databricks aitools install` and a direct
+// `<agent> plugin install`, unlike the CLI's own state file, which only records
+// CLI-driven installs. Each agent's manifest format differs, so parsing is
+// delegated to a per-agent reader; agents without a verified reader report
+// ("", false), i.e. "not installed as far as we can tell".
+func (a *Agent) DatabricksPluginVersion(ctx context.Context) (string, bool) {
+	if a.pluginVersion == nil {
+		return "", false
+	}
+	return a.pluginVersion(ctx, a)
+}
+
+// claudePluginVersion reads the databricks plugin version from Claude Code's
+// installed_plugins.json (<ConfigDir>/plugins/), which keys each entry as
+// "<id>@<marketplace>" (e.g. "databricks@claude-plugins-official") with one
+// record per install scope. Any read/parse failure reports ("", false), so an
+// unreadable manifest reads as "not installed". When the plugin is recorded for
+// more than one scope, the highest recorded version is returned (they match in
+// the common single-scope case, but the cache can retain a stale scope); the
+// version is "" when installed but unversioned.
+func claudePluginVersion(ctx context.Context, a *Agent) (string, bool) {
+	configDir, err := a.ConfigDir(ctx)
+	if err != nil {
+		return "", false
+	}
+	data, err := os.ReadFile(filepath.Join(configDir, "plugins", pluginManifestFile))
+	if err != nil {
+		return "", false
+	}
+	var manifest struct {
+		Plugins map[string][]pluginInstall `json:"plugins"`
+	}
+	if err := json.Unmarshal(data, &manifest); err != nil {
+		return "", false
+	}
+	for key, installs := range manifest.Plugins {
+		id, _, _ := strings.Cut(key, "@")
+		if id != databricksPluginID {
+			continue
+		}
+		// Installed. Report the highest version across scopes;
+		best := ""
+		for _, install := range installs {
+			// Compare as semver (versions are unprefixed, e.g. "0.2.9").
+			if install.Version != "" && (best == "" || semver.Compare("v"+install.Version, "v"+best) > 0) {
+				best = install.Version
+			}
+		}
+		return best, true
+	}
+	return "", false
+}
diff --git a/libs/aitools/agents/plugins_test.go b/libs/aitools/agents/plugins_test.go
new file mode 100644
index 00000000000..74308d5aa80
--- /dev/null
+++ b/libs/aitools/agents/plugins_test.go
@@ -0,0 +1,75 @@
+package agents
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// agentWithConfigDir returns an Agent whose ConfigDir resolves to dir, using
+// Claude Code's manifest reader (the format these tests write).
+func agentWithConfigDir(dir string) *Agent {
+	return &Agent{
+		Name:          "test-agent",
+		DisplayName:   "Test Agent",
+		ConfigDir:     func(_ context.Context) (string, error) { return dir, nil },
+		pluginVersion: claudePluginVersion,
+	}
+}
+
+// writeManifest writes body to <configDir>/plugins/installed_plugins.json.
+func writeManifest(t *testing.T, configDir, body string) {
+	dir := filepath.Join(configDir, "plugins")
+	require.NoError(t, os.MkdirAll(dir, 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(dir, pluginManifestFile), []byte(body), 0o600))
+}
+
+func TestDatabricksPluginVersion(t *testing.T) {
+	tests := []struct {
+		name        string
+		body        string // manifest body; "" means no manifest file at all
+		wantOK      bool
+		wantVersion string
+	}{
+		{"no manifest", "", false, ""},
+		{"databricks plugin present", `{"plugins":{"databricks@claude-plugins-official":[{"scope":"user","version":"0.2.6"}]}}`, true, "0.2.6"},
+		{"other plugin only", `{"plugins":{"gopls-lsp@claude-plugins-official":[{"version":"1.0.0"}]}}`, false, ""},
+		{"databricks among others", `{"plugins":{"gopls-lsp@m":[{"version":"1.0.0"}],"databricks@claude-plugins-official":[{"version":"0.3.0"}]}}`, true, "0.3.0"},
+		{"highest version across scopes", `{"plugins":{"databricks@m":[{"scope":"user","version":"0.2.9"},{"scope":"project","version":"0.2.10"},{"scope":"local","version":"0.2.8"}]}}`, true, "0.2.10"},
+		{"databricks-prefixed but distinct id does not match", `{"plugins":{"databricks-foo@m":[{"version":"9.9.9"}]}}`, false, ""},
+		{"installed but no records", `{"plugins":{"databricks@m":[]}}`, true, ""},
+		{"installed but unversioned record", `{"plugins":{"databricks@m":[{"scope":"user"}]}}`, true, ""},
+		{"malformed json", `{not json`, false, ""},
+		{"empty plugins map", `{"plugins":{}}`, false, ""},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			configDir := t.TempDir()
+			if tt.body != "" {
+				writeManifest(t, configDir, tt.body)
+			}
+			version, ok := agentWithConfigDir(configDir).DatabricksPluginVersion(t.Context())
+			assert.Equal(t, tt.wantOK, ok)
+			assert.Equal(t, tt.wantVersion, version)
+		})
+	}
+}
+
+func TestDatabricksPluginVersionWithoutReader(t *testing.T) {
+	// An agent with no per-agent manifest reader (its format is unverified)
+	// reports no version, even when an installed_plugins.json is present, so its
+	// manifest is never parsed with another agent's format.
+	configDir := t.TempDir()
+	writeManifest(t, configDir, `{"plugins":{"databricks@m":[{"version":"0.2.9"}]}}`)
+	a := &Agent{
+		Name:      "codex",
+		ConfigDir: func(_ context.Context) (string, error) { return configDir, nil },
+	}
+	version, ok := a.DatabricksPluginVersion(t.Context())
+	assert.False(t, ok)
+	assert.Empty(t, version)
+}
diff --git a/experimental/aitools/lib/agents/recommend.go b/libs/aitools/agents/recommend.go
similarity index 90%
rename from experimental/aitools/lib/agents/recommend.go
rename to libs/aitools/agents/recommend.go
index bf10c67bfd9..de906752316 100644
--- a/experimental/aitools/lib/agents/recommend.go
+++ b/libs/aitools/agents/recommend.go
@@ -15,7 +15,7 @@ func RecommendSkillsInstall(ctx context.Context, installFn func(context.Context)
 	}
 
 	if !cmdio.IsPromptSupported(ctx) {
-		cmdio.LogString(ctx, "Tip: coding agents detected without Databricks skills. Run 'databricks experimental aitools skills install' to install them.")
+		cmdio.LogString(ctx, "Tip: coding agents detected without Databricks skills. Run 'databricks aitools install' to install them.")
 		return nil
 	}
 
diff --git a/experimental/aitools/lib/agents/recommend_test.go b/libs/aitools/agents/recommend_test.go
similarity index 88%
rename from experimental/aitools/lib/agents/recommend_test.go
rename to libs/aitools/agents/recommend_test.go
index c2c27699212..e6952256627 100644
--- a/experimental/aitools/lib/agents/recommend_test.go
+++ b/libs/aitools/agents/recommend_test.go
@@ -17,6 +17,7 @@ func noopInstall(context.Context) error { return nil }
 func TestRecommendSkillsInstallSkipsWhenSkillsExist(t *testing.T) {
 	tmpDir := t.TempDir()
 	t.Setenv("HOME", tmpDir)
+	t.Setenv("USERPROFILE", tmpDir)
 	// Skills must be in canonical location to be detected.
 	require.NoError(t, os.MkdirAll(filepath.Join(tmpDir, CanonicalSkillsDir, "databricks"), 0o755))
 
@@ -24,7 +25,7 @@ func TestRecommendSkillsInstallSkipsWhenSkillsExist(t *testing.T) {
 	require.NoError(t, os.MkdirAll(agentDir, 0o755))
 
 	origRegistry := Registry
-	Registry = []Agent{
+	Registry = []*Agent{
 		{
 			Name:        "test-agent",
 			DisplayName: "Test Agent",
@@ -39,10 +40,12 @@ func TestRecommendSkillsInstallSkipsWhenSkillsExist(t *testing.T) {
 }
 
 func TestRecommendSkillsInstallSkipsWhenNoAgents(t *testing.T) {
-	t.Setenv("HOME", t.TempDir())
+	tmp := t.TempDir()
+	t.Setenv("HOME", tmp)
+	t.Setenv("USERPROFILE", tmp)
 
 	origRegistry := Registry
-	Registry = []Agent{}
+	Registry = []*Agent{}
 	defer func() { Registry = origRegistry }()
 
 	ctx := cmdio.MockDiscard(t.Context())
@@ -53,9 +56,10 @@ func TestRecommendSkillsInstallSkipsWhenNoAgents(t *testing.T) {
 func TestRecommendSkillsInstallNonInteractive(t *testing.T) {
 	tmpDir := t.TempDir()
 	t.Setenv("HOME", tmpDir)
+	t.Setenv("USERPROFILE", tmpDir)
 
 	origRegistry := Registry
-	Registry = []Agent{
+	Registry = []*Agent{
 		{
 			Name:        "test-agent",
 			DisplayName: "Test Agent",
@@ -67,15 +71,16 @@ func TestRecommendSkillsInstallNonInteractive(t *testing.T) {
 	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
 	err := RecommendSkillsInstall(ctx, noopInstall)
 	require.NoError(t, err)
-	assert.Contains(t, stderr.String(), "databricks experimental aitools skills install")
+	assert.Contains(t, stderr.String(), "databricks aitools install")
 }
 
 func TestRecommendSkillsInstallInteractiveDecline(t *testing.T) {
 	tmpDir := t.TempDir()
 	t.Setenv("HOME", tmpDir)
+	t.Setenv("USERPROFILE", tmpDir)
 
 	origRegistry := Registry
-	Registry = []Agent{
+	Registry = []*Agent{
 		{
 			Name:        "test-agent",
 			DisplayName: "Test Agent",
diff --git a/libs/aitools/agents/registry_test.go b/libs/aitools/agents/registry_test.go
new file mode 100644
index 00000000000..20eca404cdf
--- /dev/null
+++ b/libs/aitools/agents/registry_test.go
@@ -0,0 +1,70 @@
+package agents
+
+import (
+	"os"
+	"path/filepath"
+	"runtime"
+	"testing"
+
+	"github.com/databricks/cli/libs/env"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSkillAgentRegistryPaths(t *testing.T) {
+	home := t.TempDir()
+	cwd := t.TempDir()
+	ctx := env.WithUserHomeDir(t.Context(), home)
+	ctx = env.Set(ctx, "XDG_CONFIG_HOME", filepath.Join(home, ".config"))
+	ctx = env.Set(ctx, "APPDATA", "")
+
+	gooseGlobalDir := filepath.Join(home, ".config", "goose", "skills")
+	if runtime.GOOS == "windows" {
+		gooseGlobalDir = filepath.Join(home, "AppData", "Roaming", "Block", "goose", "config", "skills")
+	}
+
+	tests := []struct {
+		name        string
+		binary      string
+		displayName string
+		globalDir   string
+		projectDir  string
+	}{
+		{NamePi, "pi", "Pi", filepath.Join(home, ".pi", "agent", "skills"), filepath.Join(cwd, ".pi", "skills")},
+		{NameGemini, "gemini", "Gemini CLI", filepath.Join(home, ".gemini", "skills"), filepath.Join(cwd, ".gemini", "skills")},
+		{NameGoose, "goose", "Goose", gooseGlobalDir, filepath.Join(cwd, ".goose", "skills")},
+		{NameKiro, "kiro", "Kiro", filepath.Join(home, ".kiro", "skills"), filepath.Join(cwd, ".kiro", "skills")},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			a := ByName(tc.name)
+			require.NotNil(t, a)
+			assert.Equal(t, tc.binary, a.Binary)
+			assert.Equal(t, tc.displayName, a.DisplayName)
+			assert.True(t, a.SupportsProjectScope)
+			assert.Nil(t, a.Plugin)
+
+			globalDir, err := a.SkillsDir(ctx)
+			require.NoError(t, err)
+			assert.Equal(t, tc.globalDir, globalDir)
+			assert.Equal(t, tc.projectDir, a.ProjectSkillsDir(cwd))
+		})
+	}
+}
+
+func TestDetectProjectInstalled(t *testing.T) {
+	cwd := t.TempDir()
+	for _, name := range []string{NamePi, NameGemini, NameGoose, NameKiro} {
+		dir := filepath.Join(ByName(name).ProjectSkillsDir(cwd), "databricks-core")
+		require.NoError(t, os.MkdirAll(dir, 0o755))
+	}
+	// A non-databricks skill must not count as a Databricks install.
+	require.NoError(t, os.MkdirAll(filepath.Join(cwd, ".pi", "skills", "other-skill"), 0o755))
+
+	var names []string
+	for _, a := range DetectProjectInstalled(cwd) {
+		names = append(names, a.Name)
+	}
+	assert.ElementsMatch(t, []string{NamePi, NameGemini, NameGoose, NameKiro}, names)
+}
diff --git a/libs/aitools/agents/skills.go b/libs/aitools/agents/skills.go
new file mode 100644
index 00000000000..b575f825c2b
--- /dev/null
+++ b/libs/aitools/agents/skills.go
@@ -0,0 +1,59 @@
+package agents
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/databricks/cli/libs/env"
+)
+
+const (
+	// databricksSkillPrefix is the prefix used by Databricks skills (e.g., "databricks", "databricks-apps").
+	databricksSkillPrefix = "databricks"
+
+	// CanonicalSkillsDir is the shared location for skills when multiple agents are detected.
+	CanonicalSkillsDir = ".databricks/aitools/skills"
+
+	// LegacySkillsDir is the old canonical location, checked for backward compatibility.
+	LegacySkillsDir = ".databricks/agent-skills"
+)
+
+// HasDatabricksSkillsInstalled checks if Databricks skills are installed in the canonical location.
+// Returns true if no agents are detected (nothing to recommend) or if skills exist in
+// ~/.databricks/aitools/skills/ or the legacy ~/.databricks/agent-skills/.
+func HasDatabricksSkillsInstalled(ctx context.Context) bool {
+	installed := DetectInstalled(ctx)
+	if len(installed) == 0 {
+		return true
+	}
+
+	homeDir, err := env.UserHomeDir(ctx)
+	if err != nil {
+		return false
+	}
+	return HasDatabricksSkillsIn(filepath.Join(homeDir, CanonicalSkillsDir)) ||
+		HasDatabricksSkillsIn(filepath.Join(homeDir, LegacySkillsDir))
+}
+
+// HasDatabricksSkillsIn checks if dir contains a subdirectory starting with "databricks".
+// The CLI installs skills into an agent's skills dir as symlinks to the canonical
+// store, and os.ReadDir reports symlinks via Lstat (so IsDir is false for them), so
+// entries are resolved with os.Stat to follow the link to its target.
+func HasDatabricksSkillsIn(dir string) bool {
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		return false
+	}
+	for _, e := range entries {
+		if !strings.HasPrefix(e.Name(), databricksSkillPrefix) {
+			continue
+		}
+		info, err := os.Stat(filepath.Join(dir, e.Name()))
+		if err == nil && info.IsDir() {
+			return true
+		}
+	}
+	return false
+}
diff --git a/experimental/aitools/lib/agents/skills_test.go b/libs/aitools/agents/skills_test.go
similarity index 75%
rename from experimental/aitools/lib/agents/skills_test.go
rename to libs/aitools/agents/skills_test.go
index 09192d721c9..4f58438b8b1 100644
--- a/experimental/aitools/lib/agents/skills_test.go
+++ b/libs/aitools/agents/skills_test.go
@@ -12,7 +12,7 @@ import (
 
 func TestHasDatabricksSkillsInstalledNoAgents(t *testing.T) {
 	origRegistry := Registry
-	Registry = []Agent{}
+	Registry = []*Agent{}
 	defer func() { Registry = origRegistry }()
 
 	assert.True(t, HasDatabricksSkillsInstalled(t.Context()))
@@ -21,10 +21,11 @@ func TestHasDatabricksSkillsInstalledNoAgents(t *testing.T) {
 func TestHasDatabricksSkillsInstalledCanonicalOnly(t *testing.T) {
 	tmpHome := t.TempDir()
 	t.Setenv("HOME", tmpHome)
+	t.Setenv("USERPROFILE", tmpHome)
 	require.NoError(t, os.MkdirAll(filepath.Join(tmpHome, CanonicalSkillsDir, "databricks"), 0o755))
 
 	origRegistry := Registry
-	Registry = []Agent{
+	Registry = []*Agent{
 		{
 			Name:        "test-agent",
 			DisplayName: "Test Agent",
@@ -39,12 +40,13 @@ func TestHasDatabricksSkillsInstalledCanonicalOnly(t *testing.T) {
 func TestHasDatabricksSkillsInstalledIgnoresAgentDir(t *testing.T) {
 	tmpHome := t.TempDir()
 	t.Setenv("HOME", tmpHome)
+	t.Setenv("USERPROFILE", tmpHome)
 	// Skills in agent dir only (e.g., installed by another tool) should not count.
 	agentDir := filepath.Join(tmpHome, ".claude")
 	require.NoError(t, os.MkdirAll(filepath.Join(agentDir, "skills", "databricks"), 0o755))
 
 	origRegistry := Registry
-	Registry = []Agent{
+	Registry = []*Agent{
 		{
 			Name:        "test-agent",
 			DisplayName: "Test Agent",
@@ -59,12 +61,13 @@ func TestHasDatabricksSkillsInstalledIgnoresAgentDir(t *testing.T) {
 func TestHasDatabricksSkillsInstalledWithOnlyNonDatabricksSkills(t *testing.T) {
 	tmpDir := t.TempDir()
 	t.Setenv("HOME", tmpDir)
+	t.Setenv("USERPROFILE", tmpDir)
 	// Non-databricks skills should not count.
 	require.NoError(t, os.MkdirAll(filepath.Join(tmpDir, "skills", "mcp-builder"), 0o755))
 	require.NoError(t, os.MkdirAll(filepath.Join(tmpDir, "skills", "rust-webapp"), 0o755))
 
 	origRegistry := Registry
-	Registry = []Agent{
+	Registry = []*Agent{
 		{
 			Name:        "test-agent",
 			DisplayName: "Test Agent",
@@ -79,9 +82,10 @@ func TestHasDatabricksSkillsInstalledWithOnlyNonDatabricksSkills(t *testing.T) {
 func TestHasDatabricksSkillsInstalledNoSkillsDir(t *testing.T) {
 	tmpDir := t.TempDir()
 	t.Setenv("HOME", tmpDir)
+	t.Setenv("USERPROFILE", tmpDir)
 
 	origRegistry := Registry
-	Registry = []Agent{
+	Registry = []*Agent{
 		{
 			Name:        "test-agent",
 			DisplayName: "Test Agent",
@@ -96,11 +100,12 @@ func TestHasDatabricksSkillsInstalledNoSkillsDir(t *testing.T) {
 func TestHasDatabricksSkillsInstalledCustomSubdirNotChecked(t *testing.T) {
 	tmpHome := t.TempDir()
 	t.Setenv("HOME", tmpHome)
+	t.Setenv("USERPROFILE", tmpHome)
 	// Skills in agent's custom subdir should not count — only canonical matters.
 	require.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".gemini", "antigravity", "global_skills", "databricks"), 0o755))
 
 	origRegistry := Registry
-	Registry = []Agent{
+	Registry = []*Agent{
 		{
 			Name:         "test-agent",
 			DisplayName:  "Test Agent",
@@ -116,6 +121,7 @@ func TestHasDatabricksSkillsInstalledCustomSubdirNotChecked(t *testing.T) {
 func TestHasDatabricksSkillsInstalledDatabricksAppsCanonical(t *testing.T) {
 	tmpHome := t.TempDir()
 	t.Setenv("HOME", tmpHome)
+	t.Setenv("USERPROFILE", tmpHome)
 	// databricks-apps prefix should match in canonical location.
 	require.NoError(t, os.MkdirAll(filepath.Join(tmpHome, CanonicalSkillsDir, "databricks-apps"), 0o755))
 
@@ -123,7 +129,7 @@ func TestHasDatabricksSkillsInstalledDatabricksAppsCanonical(t *testing.T) {
 	require.NoError(t, os.MkdirAll(agentDir, 0o755))
 
 	origRegistry := Registry
-	Registry = []Agent{
+	Registry = []*Agent{
 		{
 			Name:        "test-agent",
 			DisplayName: "Test Agent",
@@ -135,17 +141,42 @@ func TestHasDatabricksSkillsInstalledDatabricksAppsCanonical(t *testing.T) {
 	assert.True(t, HasDatabricksSkillsInstalled(t.Context()))
 }
 
+func TestHasDatabricksSkillsInFollowsSymlinks(t *testing.T) {
+	// The CLI installs skills into an agent's dir as symlinks to the canonical
+	// store, so the check must follow the link rather than rely on IsDir (which
+	// os.ReadDir reports false for a symlink).
+	tmp := t.TempDir()
+	target := filepath.Join(tmp, "store", "databricks-jobs")
+	require.NoError(t, os.MkdirAll(target, 0o755))
+
+	skillsDir := filepath.Join(tmp, "skills")
+	require.NoError(t, os.MkdirAll(skillsDir, 0o755))
+	require.NoError(t, os.Symlink(target, filepath.Join(skillsDir, "databricks-jobs")))
+
+	assert.True(t, HasDatabricksSkillsIn(skillsDir))
+}
+
+func TestHasDatabricksSkillsInIgnoresDanglingSymlink(t *testing.T) {
+	tmp := t.TempDir()
+	skillsDir := filepath.Join(tmp, "skills")
+	require.NoError(t, os.MkdirAll(skillsDir, 0o755))
+	require.NoError(t, os.Symlink(filepath.Join(tmp, "missing"), filepath.Join(skillsDir, "databricks-jobs")))
+
+	assert.False(t, HasDatabricksSkillsIn(skillsDir))
+}
+
 func TestHasDatabricksSkillsInstalledLegacyPath(t *testing.T) {
 	tmpHome := t.TempDir()
 	t.Setenv("HOME", tmpHome)
+	t.Setenv("USERPROFILE", tmpHome)
 	// Skills only in the legacy location should still be detected.
-	require.NoError(t, os.MkdirAll(filepath.Join(tmpHome, legacySkillsDir, "databricks"), 0o755))
+	require.NoError(t, os.MkdirAll(filepath.Join(tmpHome, LegacySkillsDir, "databricks"), 0o755))
 
 	agentDir := filepath.Join(tmpHome, ".claude")
 	require.NoError(t, os.MkdirAll(agentDir, 0o755))
 
 	origRegistry := Registry
-	Registry = []Agent{
+	Registry = []*Agent{
 		{
 			Name:        "test-agent",
 			DisplayName: "Test Agent",
diff --git a/libs/aitools/installer/aidevkit.go b/libs/aitools/installer/aidevkit.go
new file mode 100644
index 00000000000..857aa04d427
--- /dev/null
+++ b/libs/aitools/installer/aidevkit.go
@@ -0,0 +1,73 @@
+package installer
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/databricks/cli/libs/env"
+	"github.com/databricks/databricks-sdk-go/useragent"
+)
+
+// aiDevKitStateDir is the marker directory the ai-dev-kit installer
+// (github.com/databricks-solutions/ai-dev-kit) writes into both the project root
+// and the global home (or $AIDEVKIT_HOME).
+const aiDevKitStateDir = ".ai-dev-kit"
+
+// aiDevKitVersionFile is the version file the ai-dev-kit installer writes under aiDevKitStateDir.
+// See https://github.com/databricks-solutions/ai-dev-kit install.sh.
+const aiDevKitVersionFile = "version"
+
+// aiDevKitHomeEnv overrides the global ai-dev-kit install location.
+const aiDevKitHomeEnv = "AIDEVKIT_HOME"
+
+// AiDevKitVersion returns the installed ai-dev-kit version and whether it is
+// installed, sanitized for the user agent.
+func AiDevKitVersion(ctx context.Context) (string, bool) {
+	installed := false
+	for _, dir := range aiDevKitStateDirs(ctx) {
+		version, ok := readAiDevKitVersion(dir)
+		if !ok {
+			continue
+		}
+		installed = true
+		// A blank marker still means installed; keep scanning so a real version
+		// in a lower-precedence scope isn't masked by an empty higher one.
+		if version != "" {
+			return version, true
+		}
+	}
+	return "", installed
+}
+
+// aiDevKitStateDirs returns the candidate ai-dev-kit state directories to probe,
+// project scope first. A scope whose base path can't be resolved is skipped
+// rather than guessed.
+func aiDevKitStateDirs(ctx context.Context) []string {
+	var dirs []string
+	if cwd, err := os.Getwd(); err == nil {
+		dirs = append(dirs, filepath.Join(cwd, aiDevKitStateDir))
+	}
+	// AIDEVKIT_HOME already points at the install root, so the marker lives
+	// directly under it; otherwise it defaults to ~/.ai-dev-kit.
+	if home := env.Get(ctx, aiDevKitHomeEnv); home != "" {
+		dirs = append(dirs, home)
+	} else if home, err := env.UserHomeDir(ctx); err == nil {
+		dirs = append(dirs, filepath.Join(home, aiDevKitStateDir))
+	}
+	return dirs
+}
+
+// readAiDevKitVersion reads the version marker under dir, reporting whether it
+// exists. A present-but-blank marker reports ("", true).
+func readAiDevKitVersion(dir string) (string, bool) {
+	data, err := os.ReadFile(filepath.Join(dir, aiDevKitVersionFile))
+	if err != nil {
+		return "", false
+	}
+	// Sanitize the first line: the value is set outside our control and
+	// useragent panics on anything but alphanumerics/semver.
+	firstLine, _, _ := strings.Cut(string(data), "\n")
+	return useragent.Sanitize(strings.TrimSpace(firstLine)), true
+}
diff --git a/libs/aitools/installer/aidevkit_test.go b/libs/aitools/installer/aidevkit_test.go
new file mode 100644
index 00000000000..1f04c4f62aa
--- /dev/null
+++ b/libs/aitools/installer/aidevkit_test.go
@@ -0,0 +1,86 @@
+package installer
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// writeAiDevKitMarker writes a .ai-dev-kit/version marker under baseDir (a temp
+// dir standing in for a project root or the global home).
+func writeAiDevKitMarker(t *testing.T, baseDir, contents string) {
+	t.Helper()
+	dir := filepath.Join(baseDir, aiDevKitStateDir)
+	require.NoError(t, os.MkdirAll(dir, 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(dir, aiDevKitVersionFile), []byte(contents), 0o644))
+}
+
+func TestAiDevKitVersion(t *testing.T) {
+	tests := []struct {
+		name string
+		// global/project contents; "" means no marker written for that scope.
+		global      string
+		project     string
+		wantVersion string
+		wantOK      bool
+	}{
+		{"not installed", "", "", "", false},
+		{"global marker", "1.2.3\n", "", "1.2.3", true},
+		{"project marker", "", "2.0.0\n", "2.0.0", true},
+		{"project overrides global", "1.2.3\n", "2.0.0\n", "2.0.0", true},
+		{"dev version", "dev\n", "", "dev", true},
+		{"empty marker still installed", "\n", "", "", true},
+		{"whitespace-only marker", "  \n", "", "", true},
+		// A blank project marker must not mask a real global version: still
+		// installed, but the global version wins over project's "unknown".
+		{"empty project does not mask global", "1.2.3\n", "\n", "1.2.3", true},
+		{"trailing newline trimmed", "1.2.3\n", "", "1.2.3", true},
+		{"multi-line keeps first line", "1.2.3\nextra\n", "", "1.2.3", true},
+		{"multi-line CRLF has no trailing hyphen", "1.2.3\r\nextra\r\n", "", "1.2.3", true},
+		{"sanitizes illegal chars", "1.2.3 (beta/rc)\n", "", "1.2.3--beta-rc-", true},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			home := t.TempDir()
+			project := t.TempDir()
+			t.Setenv("HOME", home)
+			t.Setenv("USERPROFILE", home)
+			t.Chdir(project)
+
+			if tc.global != "" {
+				writeAiDevKitMarker(t, home, tc.global)
+			}
+			if tc.project != "" {
+				writeAiDevKitMarker(t, project, tc.project)
+			}
+
+			version, ok := AiDevKitVersion(t.Context())
+			assert.Equal(t, tc.wantOK, ok)
+			assert.Equal(t, tc.wantVersion, version)
+		})
+	}
+}
+
+// TestAiDevKitVersionHomeOverride verifies AIDEVKIT_HOME points directly at the
+// install root, so the marker is read from $AIDEVKIT_HOME/version, not
+// $AIDEVKIT_HOME/.ai-dev-kit/version.
+func TestAiDevKitVersionHomeOverride(t *testing.T) {
+	home := t.TempDir()
+	installRoot := t.TempDir()
+	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
+	t.Setenv(aiDevKitHomeEnv, installRoot)
+	t.Chdir(t.TempDir())
+
+	require.NoError(t, os.WriteFile(filepath.Join(installRoot, aiDevKitVersionFile), []byte("3.1.4\n"), 0o644))
+	// A marker under ~/.ai-dev-kit must be ignored once AIDEVKIT_HOME is set.
+	writeAiDevKitMarker(t, home, "9.9.9\n")
+
+	version, ok := AiDevKitVersion(t.Context())
+	assert.True(t, ok)
+	assert.Equal(t, "3.1.4", version)
+}
diff --git a/libs/aitools/installer/cleanup.go b/libs/aitools/installer/cleanup.go
new file mode 100644
index 00000000000..a307ef85476
--- /dev/null
+++ b/libs/aitools/installer/cleanup.go
@@ -0,0 +1,88 @@
+package installer
+
+import (
+	"context"
+	"errors"
+	"io/fs"
+	"os"
+	"path/filepath"
+
+	"github.com/databricks/cli/libs/aitools/agents"
+	"github.com/databricks/cli/libs/log"
+)
+
+// RemoveLegacyRawSkills removes raw skill directories the CLI previously placed
+// in a plugin agent's skills dir, so installing the plugin doesn't leave the
+// same skills duplicated as loose files. It only removes our own content: a
+// symlink into our canonical dir, or a copied skill whose contents exactly match
+// the recorded checksums. User-modified or third-party directories, dirs with
+// extra files, and copies with no recorded provenance are left untouched.
+func RemoveLegacyRawSkills(ctx context.Context, agent *agents.Agent, scope string) error {
+	entries, err := managedRawSkillEntriesForAgent(ctx, agent, scope)
+	if err != nil {
+		return err
+	}
+
+	for _, entryPath := range entries {
+		// RemoveAll on a symlink removes the link, not its target.
+		if err := os.RemoveAll(entryPath); err != nil {
+			log.Warnf(ctx, "Failed to remove legacy skill %s: %v", entryPath, err)
+		} else {
+			log.Debugf(ctx, "Removed legacy skill %s for %s", filepath.Base(entryPath), agent.DisplayName)
+		}
+	}
+	return nil
+}
+
+// HasManagedRawSkillsForAgent reports whether an agent has raw skill exposure
+// that this CLI can safely remove after migrating that agent to the plugin.
+func HasManagedRawSkillsForAgent(ctx context.Context, agent *agents.Agent, scope string) (bool, error) {
+	entries, err := managedRawSkillEntriesForAgent(ctx, agent, scope)
+	if err != nil {
+		return false, err
+	}
+	return len(entries) > 0, nil
+}
+
+func managedRawSkillEntriesForAgent(ctx context.Context, agent *agents.Agent, scope string) ([]string, error) {
+	baseDir, err := skillsDir(ctx, scope)
+	if err != nil {
+		return nil, err
+	}
+	state, err := LoadState(baseDir)
+	if err != nil {
+		return nil, err
+	}
+
+	var cwd string
+	if scope == ScopeProject {
+		cwd, err = os.Getwd()
+		if err != nil {
+			return nil, err
+		}
+	}
+	agentDir, err := agentSkillsDirForScope(ctx, agent, scope, cwd)
+	if err != nil {
+		return nil, err
+	}
+
+	entries, err := os.ReadDir(agentDir)
+	if errors.Is(err, fs.ErrNotExist) {
+		// No skills dir for this agent; nothing to clean up.
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+
+	var managed []string
+	for _, entry := range entries {
+		entryPath := filepath.Join(agentDir, entry.Name())
+		canonicalDir := filepath.Join(baseDir, entry.Name())
+		if !exposureRemovable(entryPath, canonicalDir, entry.Name(), state) {
+			continue
+		}
+		managed = append(managed, entryPath)
+	}
+	return managed, nil
+}
diff --git a/libs/aitools/installer/cleanup_test.go b/libs/aitools/installer/cleanup_test.go
new file mode 100644
index 00000000000..b19d6272653
--- /dev/null
+++ b/libs/aitools/installer/cleanup_test.go
@@ -0,0 +1,128 @@
+package installer
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/databricks/cli/libs/aitools/agents"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func sha(content string) string {
+	sum := sha256.Sum256([]byte(content))
+	return hex.EncodeToString(sum[:])
+}
+
+func TestRemoveLegacyRawSkills(t *testing.T) {
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
+	ctx := cmdio.MockDiscard(t.Context())
+
+	baseDir, err := GlobalSkillsDir(ctx)
+	require.NoError(t, err)
+	require.NoError(t, os.MkdirAll(filepath.Join(baseDir, "alpha"), 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(baseDir, "alpha", "SKILL.md"), []byte("alpha"), 0o644))
+
+	agentDir := filepath.Join(home, ".claude", "skills")
+	require.NoError(t, os.MkdirAll(agentDir, 0o755))
+
+	// alpha: a symlink into our canonical dir -> removed.
+	require.NoError(t, os.Symlink(filepath.Join(baseDir, "alpha"), filepath.Join(agentDir, "alpha")))
+	// beta: a copy whose file matches the recorded checksum -> removed.
+	require.NoError(t, os.MkdirAll(filepath.Join(agentDir, "beta"), 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(agentDir, "beta", "SKILL.md"), []byte("beta-content"), 0o644))
+	// gamma: recorded but the on-disk file differs (user edited) -> kept.
+	require.NoError(t, os.MkdirAll(filepath.Join(agentDir, "gamma"), 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(agentDir, "gamma", "SKILL.md"), []byte("user edited"), 0o644))
+	// thirdparty: no recorded provenance -> kept.
+	require.NoError(t, os.MkdirAll(filepath.Join(agentDir, "thirdparty"), 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(agentDir, "thirdparty", "SKILL.md"), []byte("tp"), 0o644))
+	// delta: recorded file matches but the user added an extra file -> kept.
+	require.NoError(t, os.MkdirAll(filepath.Join(agentDir, "delta"), 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(agentDir, "delta", "SKILL.md"), []byte("delta-content"), 0o644))
+	require.NoError(t, os.WriteFile(filepath.Join(agentDir, "delta", "extra.md"), []byte("mine"), 0o644))
+
+	require.NoError(t, SaveState(baseDir, &InstallState{
+		SchemaVersion: schemaVersionV2,
+		Files: map[string]FileRecord{
+			"alpha/SKILL.md": {SHA256: sha("alpha")},
+			"beta/SKILL.md":  {SHA256: sha("beta-content")},
+			"gamma/SKILL.md": {SHA256: sha("gamma-original")},
+			"delta/SKILL.md": {SHA256: sha("delta-content")},
+		},
+	}))
+
+	agent := &agents.Agent{
+		Name:        agents.NameClaudeCode,
+		DisplayName: "Claude Code",
+		ConfigDir:   func(_ context.Context) (string, error) { return filepath.Join(home, ".claude"), nil },
+	}
+
+	require.NoError(t, RemoveLegacyRawSkills(ctx, agent, ScopeGlobal))
+
+	assertGone(t, filepath.Join(agentDir, "alpha"))
+	assertGone(t, filepath.Join(agentDir, "beta"))
+	assertExists(t, filepath.Join(agentDir, "gamma"))
+	assertExists(t, filepath.Join(agentDir, "thirdparty"))
+	assertExists(t, filepath.Join(agentDir, "delta"))
+}
+
+func TestHasManagedRawSkillsForAgent(t *testing.T) {
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
+	ctx := cmdio.MockDiscard(t.Context())
+
+	baseDir, err := GlobalSkillsDir(ctx)
+	require.NoError(t, err)
+	require.NoError(t, os.MkdirAll(filepath.Join(baseDir, "alpha"), 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(baseDir, "alpha", "SKILL.md"), []byte("alpha"), 0o644))
+
+	agentDir := filepath.Join(home, ".claude", "skills")
+	require.NoError(t, os.MkdirAll(agentDir, 0o755))
+	require.NoError(t, os.Symlink(filepath.Join(baseDir, "alpha"), filepath.Join(agentDir, "alpha")))
+	require.NoError(t, os.MkdirAll(filepath.Join(agentDir, "thirdparty"), 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(agentDir, "thirdparty", "SKILL.md"), []byte("mine"), 0o644))
+
+	require.NoError(t, SaveState(baseDir, &InstallState{
+		SchemaVersion: schemaVersionV2,
+		Files: map[string]FileRecord{
+			"alpha/SKILL.md": {SHA256: sha("alpha")},
+		},
+	}))
+
+	agent := &agents.Agent{
+		Name:        agents.NameClaudeCode,
+		DisplayName: "Claude Code",
+		ConfigDir:   func(_ context.Context) (string, error) { return filepath.Join(home, ".claude"), nil },
+	}
+
+	has, err := HasManagedRawSkillsForAgent(ctx, agent, ScopeGlobal)
+	require.NoError(t, err)
+	assert.True(t, has)
+
+	require.NoError(t, RemoveLegacyRawSkills(ctx, agent, ScopeGlobal))
+	has, err = HasManagedRawSkillsForAgent(ctx, agent, ScopeGlobal)
+	require.NoError(t, err)
+	assert.False(t, has)
+}
+
+func assertGone(t *testing.T, path string) {
+	t.Helper()
+	_, err := os.Lstat(path)
+	assert.ErrorIs(t, err, fs.ErrNotExist, "%s should be removed", path)
+}
+
+func assertExists(t *testing.T, path string) {
+	t.Helper()
+	_, err := os.Lstat(path)
+	assert.NoError(t, err, "%s should be kept", path)
+}
diff --git a/libs/aitools/installer/detect.go b/libs/aitools/installer/detect.go
new file mode 100644
index 00000000000..ce4312dca28
--- /dev/null
+++ b/libs/aitools/installer/detect.go
@@ -0,0 +1,64 @@
+package installer
+
+import (
+	"context"
+	"slices"
+
+	"github.com/databricks/cli/libs/aitools/agents"
+	"github.com/databricks/cli/libs/log"
+)
+
+// InstalledTools returns "<agent>_<version>" tokens for every coding tool that
+// has the Databricks plugin installed, sorted. The version is taken from the
+// agent's own plugin cache (ground truth, catches installs made directly through
+// the agent), falling back to the version recorded in the CLI install state when
+// the plugin is not found on disk. An agent with no resolvable version is
+// omitted rather than reported without one.
+func InstalledTools(ctx context.Context) []string {
+	recorded := recordedPluginVersions(ctx)
+
+	var tools []string
+	for _, a := range agents.Registry {
+		if a.Plugin == nil {
+			continue
+		}
+		version, _ := a.DatabricksPluginVersion(ctx)
+		if version == "" {
+			version = recorded[a.Name]
+		}
+		if version != "" {
+			tools = append(tools, a.Name+"_"+version)
+		}
+	}
+	slices.Sort(tools)
+	return tools
+}
+
+// recordedPluginVersions maps agent name to the databricks plugin version
+// recorded in the CLI install state, merged across global and project scope.
+// When both scopes record a version, the project scope wins (it is the more
+// specific, closer-to-the-invocation install).
+func recordedPluginVersions(ctx context.Context) map[string]string {
+	versions := map[string]string{}
+	// Load global first, then project, so project overwrites on conflict.
+	for _, scope := range []string{ScopeGlobal, ScopeProject} {
+		dir, err := skillsDir(ctx, scope)
+		if err != nil {
+			continue
+		}
+		state, err := LoadState(dir)
+		if err != nil {
+			log.Debugf(ctx, "Could not load AI Tools install state in %s: %v", dir, err)
+			continue
+		}
+		if state == nil {
+			continue
+		}
+		for name, rec := range state.Plugins {
+			if rec.Version != "" {
+				versions[name] = rec.Version
+			}
+		}
+	}
+	return versions
+}
diff --git a/libs/aitools/installer/detect_test.go b/libs/aitools/installer/detect_test.go
new file mode 100644
index 00000000000..5ef20ae2359
--- /dev/null
+++ b/libs/aitools/installer/detect_test.go
@@ -0,0 +1,112 @@
+package installer
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestInstalledTools exercises the real agent registry: claude-code reads its
+// authoritative manifest (installed_plugins.json), while agents without a
+// verified manifest reader (e.g. codex, copilot) fall back to the CLI install
+// state. HOME is redirected to a temp dir so both signals resolve there.
+func TestInstalledTools(t *testing.T) {
+	tests := []struct {
+		name string
+		// claudeManifestVersion, when set, is written to claude-code's manifest.
+		claudeManifestVersion string
+		// globalPlugins / projectPlugins map agent -> recorded state version.
+		globalPlugins  map[string]string
+		projectPlugins map[string]string
+		want           []string
+	}{
+		{
+			name: "none installed",
+			want: nil,
+		},
+		{
+			// Direct-from-marketplace install: claude-code version from manifest.
+			name:                  "claude manifest version",
+			claudeManifestVersion: "0.2.9",
+			want:                  []string{"claude-code_0.2.9"},
+		},
+		{
+			// codex has no verified manifest reader, so it uses the state version.
+			name:          "state fallback for codex",
+			globalPlugins: map[string]string{"codex": "0.2.7"},
+			want:          []string{"codex_0.2.7"},
+		},
+		{
+			// Manifest wins over state for claude-code when both are present.
+			name:                  "manifest overrides state",
+			claudeManifestVersion: "0.2.9",
+			globalPlugins:         map[string]string{"claude-code": "0.2.5"},
+			want:                  []string{"claude-code_0.2.9"},
+		},
+		{
+			// Project scope wins over global in the state fallback.
+			name:           "project state overrides global",
+			globalPlugins:  map[string]string{"codex": "0.2.5"},
+			projectPlugins: map[string]string{"codex": "0.2.7"},
+			want:           []string{"codex_0.2.7"},
+		},
+		{
+			// Manifest (claude) and state (codex) contribute; output is sorted.
+			name:                  "mixed sources sorted",
+			claudeManifestVersion: "0.2.9",
+			globalPlugins:         map[string]string{"codex": "0.2.8"},
+			want:                  []string{"claude-code_0.2.9", "codex_0.2.8"},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			tmp := t.TempDir()
+			t.Setenv("HOME", tmp)
+			t.Setenv("USERPROFILE", tmp)
+			// Fresh cwd so project-scope state does not leak from the package dir.
+			t.Chdir(t.TempDir())
+
+			if tc.claudeManifestVersion != "" {
+				writeClaudeManifest(t, filepath.Join(tmp, ".claude"), tc.claudeManifestVersion)
+			}
+			savePluginState(t, GlobalSkillsDir, tc.globalPlugins)
+			savePluginState(t, ProjectSkillsDir, tc.projectPlugins)
+
+			assert.Equal(t, tc.want, InstalledTools(t.Context()))
+		})
+	}
+}
+
+// writeClaudeManifest writes a Claude installed_plugins.json recording the
+// databricks plugin at the given version under configDir.
+func writeClaudeManifest(t *testing.T, configDir, version string) {
+	t.Helper()
+	require.NoError(t, os.MkdirAll(filepath.Join(configDir, "plugins"), 0o755))
+	body := `{"version":2,"plugins":{"databricks@claude-plugins-official":[{"version":"` + version + `"}]}}`
+	require.NoError(t, os.WriteFile(filepath.Join(configDir, "plugins", "installed_plugins.json"), []byte(body), 0o644))
+}
+
+// savePluginState writes an install state recording a databricks plugin version
+// for each agent into the directory returned by dirFn. It is a no-op when the
+// map is empty, so a scope with no plugin installs leaves no state file.
+func savePluginState(t *testing.T, dirFn func(context.Context) (string, error), versions map[string]string) {
+	t.Helper()
+	if len(versions) == 0 {
+		return
+	}
+	plugins := make(map[string]PluginRecord, len(versions))
+	for name, v := range versions {
+		plugins[name] = PluginRecord{Plugin: "databricks", Version: v}
+	}
+	dir, err := dirFn(t.Context())
+	require.NoError(t, err)
+	require.NoError(t, SaveState(dir, &InstallState{
+		SchemaVersion: schemaVersionV2,
+		Plugins:       plugins,
+	}))
+}
diff --git a/libs/aitools/installer/dump.go b/libs/aitools/installer/dump.go
new file mode 100644
index 00000000000..4d7ced91361
--- /dev/null
+++ b/libs/aitools/installer/dump.go
@@ -0,0 +1,49 @@
+package installer
+
+import (
+	"context"
+	"fmt"
+	"maps"
+	"path/filepath"
+	"slices"
+
+	"github.com/databricks/cli/libs/cmdio"
+)
+
+// DumpSkillsToPath writes resolved skill files into destDir and returns the
+// number of skills written. It is a dumb dump: no agents, no .state.json, no
+// lifecycle (update/list/uninstall ignore it). It honors DATABRICKS_SKILLS_REF,
+// the cli-compat version pin, --skills cherry-picks, and --experimental exactly
+// as the agent install path does, since it reuses resolveSkills.
+func DumpSkillsToPath(ctx context.Context, src ManifestSource, destDir string, opts InstallOptions) (int, error) {
+	ref, explicit, err := getSkillsRef(ctx, true)
+	if err != nil {
+		return 0, err
+	}
+	cmdio.LogString(ctx, "Using skills version "+DisplaySkillsVersion(ref))
+
+	manifest, ref, err := FetchSkillsManifestWithFallback(ctx, src, ref, !explicit)
+	if err != nil {
+		return 0, err
+	}
+
+	targetSkills, err := resolveSkills(ctx, manifest.Skills, opts)
+	if err != nil {
+		return 0, err
+	}
+
+	names := slices.Sorted(maps.Keys(targetSkills))
+	for _, name := range names {
+		meta := targetSkills[name]
+		if _, err := installSkillToDir(ctx, ref, meta.RepoDir, meta.SourceName, filepath.Join(destDir, name), meta.Files); err != nil {
+			return 0, err
+		}
+	}
+
+	noun := "skills"
+	if len(names) == 1 {
+		noun = "skill"
+	}
+	cmdio.LogString(ctx, fmt.Sprintf("Wrote %d %s to %s", len(names), noun, filepath.ToSlash(destDir)))
+	return len(names), nil
+}
diff --git a/libs/aitools/installer/dump_test.go b/libs/aitools/installer/dump_test.go
new file mode 100644
index 00000000000..c73601d250b
--- /dev/null
+++ b/libs/aitools/installer/dump_test.go
@@ -0,0 +1,68 @@
+package installer
+
+import (
+	"errors"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestDumpSkillsToPathWritesFilesNoState(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+
+	dest := filepath.Join(t.TempDir(), "out")
+	src := &mockManifestSource{manifest: testManifest()}
+
+	n, err := DumpSkillsToPath(ctx, src, dest, InstallOptions{})
+	require.NoError(t, err)
+	assert.Equal(t, 2, n)
+
+	for _, name := range []string{"databricks-sql", "databricks-jobs"} {
+		_, err := os.Stat(filepath.Join(dest, name, "SKILL.md"))
+		assert.NoError(t, err)
+	}
+
+	// A dumb dump writes no state and no agent dirs.
+	_, err = os.Stat(filepath.Join(dest, stateFileName))
+	assert.ErrorIs(t, err, fs.ErrNotExist)
+}
+
+func TestDumpSkillsToPathCherryPick(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+
+	dest := filepath.Join(t.TempDir(), "out")
+	src := &mockManifestSource{manifest: testManifest()}
+
+	n, err := DumpSkillsToPath(ctx, src, dest, InstallOptions{SpecificSkills: []string{"databricks-sql"}})
+	require.NoError(t, err)
+	assert.Equal(t, 1, n)
+
+	_, err = os.Stat(filepath.Join(dest, "databricks-sql", "SKILL.md"))
+	assert.NoError(t, err)
+	_, err = os.Stat(filepath.Join(dest, "databricks-jobs"))
+	assert.ErrorIs(t, err, fs.ErrNotExist)
+}
+
+func TestDumpSkillsToPathFallsBackWhenLatestUnknown(t *testing.T) {
+	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
+	setupFetchMock(t)
+	src, fallbackRef := setupSkillsFallback(t, errors.New("network down"))
+	dest := filepath.Join(t.TempDir(), "out")
+
+	n, err := DumpSkillsToPath(ctx, src, dest, InstallOptions{})
+	require.NoError(t, err)
+	assert.Equal(t, 2, n)
+	assert.Contains(t, stderr.String(), "Using skills version "+DisplaySkillsVersion(fallbackRef))
+	for _, name := range []string{"databricks-sql", "databricks-jobs"} {
+		assert.FileExists(t, filepath.Join(dest, name, "SKILL.md"))
+	}
+}
diff --git a/libs/aitools/installer/errors.go b/libs/aitools/installer/errors.go
new file mode 100644
index 00000000000..a3c7bc41022
--- /dev/null
+++ b/libs/aitools/installer/errors.go
@@ -0,0 +1,33 @@
+package installer
+
+import "fmt"
+
+// SkillError reports that a skill named via --skills could not be resolved from
+// the manifest. Reason drives telemetry categorization (the command layer maps
+// it with errors.AsType); Detail is the human-readable remainder of the message.
+// Building the message from fields keeps a classification tag out of the
+// user-facing string, so the error is stated exactly once.
+type SkillError struct {
+	Skill  string
+	Reason string
+	Detail string
+}
+
+// Reasons a --skills entry can fail to resolve.
+const (
+	// ReasonSkillNotFound: the named skill is absent from the resolved manifest.
+	ReasonSkillNotFound = "skill-not-found"
+	// ReasonVersionIncompatible: the skill requires a newer CLI than the one running.
+	ReasonVersionIncompatible = "version-incompatible"
+	// ReasonExperimentalSkill: the named skill is experimental and --experimental was not set.
+	ReasonExperimentalSkill = "experimental-skill"
+)
+
+func (e *SkillError) Error() string {
+	// Detail is the human-readable remainder; fall back to Reason when it is empty
+	// so the message stays self-describing (mirrors BlockedError.Error()).
+	if e.Detail != "" {
+		return fmt.Sprintf("skill %q %s", e.Skill, e.Detail)
+	}
+	return fmt.Sprintf("skill %q %s", e.Skill, e.Reason)
+}
diff --git a/libs/aitools/installer/installer.go b/libs/aitools/installer/installer.go
new file mode 100644
index 00000000000..0ca33012f0f
--- /dev/null
+++ b/libs/aitools/installer/installer.go
@@ -0,0 +1,940 @@
+package installer
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"io/fs"
+	"maps"
+	"net/http"
+	"os"
+	"path/filepath"
+	"runtime"
+	"slices"
+	"strings"
+	"sync"
+	"syscall"
+	"time"
+
+	"github.com/databricks/cli/internal/build"
+	"github.com/databricks/cli/libs/aitools/agents"
+	"github.com/databricks/cli/libs/clicompat"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/env"
+	"github.com/databricks/cli/libs/log"
+	"golang.org/x/mod/semver"
+	"golang.org/x/sync/errgroup"
+)
+
+const (
+	skillsRepoOwner      = "databricks"
+	skillsRepoName       = "databricks-agent-skills"
+	stableSkillsRepoPath = "skills"
+	experimentalRepoPath = "experimental"
+
+	// fetchConcurrency caps the number of in-flight skill file fetches.
+	// Each file is one HTTPS GET to raw.githubusercontent.com; sequential
+	// fetches were latency-bound on TLS handshakes. 8 is enough to amortise
+	// the round-trip across a typical skill's files without overwhelming the
+	// upstream CDN.
+	fetchConcurrency = 8
+)
+
+// httpClient is shared across all skill file fetches so the underlying
+// transport reuses TCP+TLS connections. The default MaxIdleConnsPerHost
+// (2) is bumped to leave headroom above fetchConcurrency so a brief overlap
+// between a closing and a new connection doesn't force a fresh handshake.
+var httpClient = sync.OnceValue(func() *http.Client {
+	t := http.DefaultTransport.(*http.Transport).Clone()
+	t.MaxIdleConnsPerHost = fetchConcurrency * 2
+	return &http.Client{
+		Timeout:   30 * time.Second,
+		Transport: t,
+	}
+})
+
+func manifestHasExperimental(m *Manifest) bool {
+	for _, meta := range m.Skills {
+		if meta.IsExperimental() {
+			return true
+		}
+	}
+	return false
+}
+
+func stateRepoDir(state *InstallState, name string) string {
+	if state != nil && state.RepoDirs != nil {
+		if repoDir := state.RepoDirs[name]; repoDir != "" {
+			return repoDir
+		}
+	}
+	return stableSkillsRepoPath
+}
+
+// fetchFileFn is the function used to download individual skill files.
+// It is a package-level var so tests can replace it with a mock.
+var fetchFileFn func(ctx context.Context, ref, repoDir, skillName, filePath string) ([]byte, error) = fetchSkillFile
+
+// renamePathFn is the function used to move paths into place. Tests replace it
+// to exercise cross-device fallback paths without depending on host mounts.
+var renamePathFn = os.Rename
+
+// latestSkillsReleaseRefFn resolves the skills repo's latest release tag. Tests
+// replace it so default ref resolution stays deterministic and offline.
+var latestSkillsReleaseRefFn = fetchLatestSkillsReleaseRef
+
+// skillsLatestSentinel is the value cli-compat.json uses for the skills version
+// to mean "track latest" rather than pinning a specific release.
+const skillsLatestSentinel = clicompat.AgentSkillsLatest
+
+// GetSkillsRef returns the skills repo ref to use and whether it was explicitly
+// pinned (as opposed to tracking latest). An unresolved latest release is an error.
+//
+// By default we track the latest skills release tag, not the skills repo's main
+// branch. cli-compat.json is the remote control for this: its newest range
+// normally tracks latest, but if a future change makes a skills release
+// incompatible with older CLIs, it can be edited remotely to pin those CLIs to
+// the last compatible version with no CLI release. DATABRICKS_SKILLS_REF
+// overrides everything for eval/reproducibility. (AppKit version resolution is
+// unaffected; cli-compat still manages it via its own field.)
+func GetSkillsRef(ctx context.Context) (ref string, explicit bool, err error) {
+	return getSkillsRef(ctx, false)
+}
+
+func getSkillsRef(ctx context.Context, allowFallback bool) (ref string, explicit bool, err error) {
+	if ref := env.Get(ctx, "DATABRICKS_SKILLS_REF"); ref != "" {
+		return ref, true, nil
+	}
+	v, err := clicompat.ResolveAgentSkillsVersion(ctx)
+	if err != nil {
+		log.Debugf(ctx, "could not resolve skills compatibility, resolving latest release: %v", err)
+		return resolveLatestSkillsReleaseRef(ctx, allowFallback)
+	}
+	if v == "" || v == skillsLatestSentinel {
+		return resolveLatestSkillsReleaseRef(ctx, allowFallback)
+	}
+	return "v" + v, true, nil
+}
+
+func resolveLatestSkillsReleaseRef(ctx context.Context, allowFallback bool) (ref string, explicit bool, err error) {
+	ref, err = latestSkillsReleaseRefFn(ctx)
+	if err == nil {
+		return ref, false, nil
+	}
+	if !allowFallback {
+		return "", false, fmt.Errorf("resolve latest skills release: %w", err)
+	}
+
+	embedded, embeddedErr := clicompat.ResolveEmbeddedAgentSkillsVersion()
+	if embeddedErr == nil && embedded != "" && embedded != skillsLatestSentinel {
+		log.Warnf(ctx, "Could not resolve latest skills release (%v); falling back to embedded skills version %s", err, embedded)
+		return "v" + embedded, false, nil
+	}
+	if embeddedErr != nil {
+		return "", false, fmt.Errorf("resolve latest skills release: %w (embedded fallback failed: %v)", err, embeddedErr) //nolint:errorlint // only the primary error belongs in the chain
+	}
+	return "", false, fmt.Errorf("resolve latest skills release: %w", err)
+}
+
+func fetchLatestSkillsReleaseRef(ctx context.Context) (string, error) {
+	url := fmt.Sprintf("https://api.github.com/repos/%s/%s/releases/latest", skillsRepoOwner, skillsRepoName)
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	if err != nil {
+		return "", fmt.Errorf("failed to create request: %w", err)
+	}
+
+	resp, err := httpClient().Do(req)
+	if err != nil {
+		return "", err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return "", fmt.Errorf("HTTP %d fetching latest skills release", resp.StatusCode)
+	}
+
+	var payload struct {
+		TagName string `json:"tag_name"`
+	}
+	if err := json.NewDecoder(io.LimitReader(resp.Body, 1<<20)).Decode(&payload); err != nil {
+		return "", fmt.Errorf("parse latest skills release: %w", err)
+	}
+	tag := strings.TrimSpace(payload.TagName)
+	if tag == "" {
+		return "", errors.New("latest skills release has empty tag_name")
+	}
+	if !strings.HasPrefix(tag, "v") {
+		tag = "v" + tag
+	}
+	if !semver.IsValid(tag) {
+		return "", fmt.Errorf("latest skills release has invalid tag %q", payload.TagName)
+	}
+	return tag, nil
+}
+
+// DisplaySkillsVersion renders a skills ref for humans: a pinned tag drops its
+// leading "v".
+func DisplaySkillsVersion(ref string) string {
+	return strings.TrimPrefix(ref, "v")
+}
+
+// GetSkillsBaseURL returns the manifest and skill fetch base URL.
+// DATABRICKS_SKILLS_BASE_URL overrides GitHub raw URLs for acceptance tests.
+func GetSkillsBaseURL(ctx context.Context) string {
+	if base := env.Get(ctx, "DATABRICKS_SKILLS_BASE_URL"); base != "" {
+		return strings.TrimRight(base, "/")
+	}
+	return "https://raw.githubusercontent.com/" + skillsRepoOwner + "/" + skillsRepoName
+}
+
+// Manifest describes the skills manifest fetched from the skills repo.
+type Manifest struct {
+	Version   string               `json:"version"`
+	UpdatedAt string               `json:"updated_at"`
+	Skills    map[string]SkillMeta `json:"skills"`
+}
+
+// SkillMeta describes a single skill entry in the manifest.
+type SkillMeta struct {
+	Version     string   `json:"version"`
+	UpdatedAt   string   `json:"updated_at"`
+	Files       []string `json:"files"`
+	Description string   `json:"description,omitempty"`
+	MinCLIVer   string   `json:"min_cli_version,omitempty"`
+
+	// RepoDir is "skills" or "experimental" (manifest field repo_dir).
+	RepoDir string `json:"repo_dir,omitempty"`
+
+	// SourceName is the upstream skill directory name within RepoDir.
+	// Set during normalization, not from JSON.
+	SourceName string `json:"-"`
+}
+
+func (s SkillMeta) IsExperimental() bool {
+	return s.RepoDir == experimentalRepoPath
+}
+
+// InstallOptions controls the behavior of InstallSkillsForAgents.
+type InstallOptions struct {
+	IncludeExperimental bool
+	SpecificSkills      []string // empty = all skills
+	Scope               string   // ScopeGlobal or ScopeProject (default: global)
+}
+
+func fetchSkillFile(ctx context.Context, ref, repoDir, skillName, filePath string) ([]byte, error) {
+	if repoDir == "" {
+		repoDir = stableSkillsRepoPath
+	}
+	url := fmt.Sprintf("%s/%s/%s/%s/%s",
+		GetSkillsBaseURL(ctx), ref, repoDir, skillName, filePath)
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create request: %w", err)
+	}
+
+	resp, err := httpClient().Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("HTTP %d", resp.StatusCode)
+	}
+
+	data, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read response: %w", err)
+	}
+	return data, nil
+}
+
+// FetchSkillsManifestWithFallback fetches the skills manifest at the given ref.
+// If the ref points to a non-existent tag (not-found error), it falls back to
+// the embedded manifest's skills version. Returns the manifest, the (possibly
+// updated) ref, and any error.
+func FetchSkillsManifestWithFallback(ctx context.Context, src ManifestSource, ref string, allowFallback bool) (*Manifest, string, error) {
+	tag := strings.TrimPrefix(ref, "v")
+	manifest, err := src.FetchManifest(ctx, ref)
+	if err != nil && allowFallback && clicompat.IsNotFoundError(err) {
+		fallbackVersion, fbErr := clicompat.ResolveEmbeddedAgentSkillsVersion()
+		if fbErr == nil && fallbackVersion != "" && fallbackVersion != skillsLatestSentinel && fallbackVersion != tag {
+			log.Warnf(ctx, "Skills version %s not found, falling back to embedded version %s", tag, fallbackVersion)
+			ref = "v" + fallbackVersion
+			manifest, err = src.FetchManifest(ctx, ref)
+		} else if fbErr != nil {
+			log.Warnf(ctx, "Could not resolve embedded skills version: %v", fbErr)
+		}
+	}
+	return manifest, ref, err
+}
+
+// installedSkillsRelease returns the newest recorded raw-skills release and
+// whether fallback is safe to consider. Branch refs cannot be ordered, so they
+// require a successful latest-release fetch instead of an embedded fallback.
+func installedSkillsRelease(state *InstallState) (ref string, allowFallback bool) {
+	if state == nil || len(state.Skills) == 0 {
+		return "", true
+	}
+	ref = semver.Canonical("v" + DisplaySkillsVersion(state.Release))
+	allowFallback = ref != ""
+	// Plugin installs can overwrite state.Release, and selective skill installs
+	// can leave files from a newer release. Keep their provenance in the check.
+	knownSkills := make(map[string]bool, len(state.Skills))
+	for path, record := range state.Files {
+		if record.Origin == "" {
+			continue
+		}
+		origin := semver.Canonical("v" + DisplaySkillsVersion(record.Origin))
+		if origin == "" {
+			allowFallback = false
+		} else {
+			name, _, _ := strings.Cut(path, "/")
+			knownSkills[name] = true
+		}
+		if semver.Compare(origin, ref) > 0 {
+			ref = origin
+		}
+	}
+	// Without raw-file provenance, a mixed legacy/plugin install has no
+	// reliable raw-skills release to compare with the fallback.
+	if len(state.Plugins) > 0 {
+		for name := range state.Skills {
+			if !knownSkills[name] {
+				allowFallback = false
+			}
+		}
+	}
+	return ref, allowFallback
+}
+
+func checkSkillsDowngrade(installedRef, ref string, explicit bool) error {
+	if !explicit && semver.Compare(ref, installedRef) < 0 {
+		return fmt.Errorf("refusing to downgrade skills from %s to %s; retry when the latest release is available or set DATABRICKS_SKILLS_REF=%s to select this version explicitly", DisplaySkillsVersion(installedRef), DisplaySkillsVersion(ref), ref)
+	}
+	return nil
+}
+
+// InstallSkillsForAgents fetches the manifest and installs skills for the given agents.
+// This is the core installation function. Callers are responsible for agent detection,
+// prompting, and printing the "Installing..." header.
+func InstallSkillsForAgents(ctx context.Context, src ManifestSource, targetAgents []*agents.Agent, opts InstallOptions) error {
+	scope := opts.Scope
+	if scope == "" {
+		scope = ScopeGlobal
+	}
+
+	baseDir, err := skillsDir(ctx, scope)
+	if err != nil {
+		return err
+	}
+
+	// For project scope, filter to agents that support it and warn about the rest.
+	var cwd string
+	if scope == ScopeProject {
+		cwd, err = os.Getwd()
+		if err != nil {
+			return fmt.Errorf("failed to determine working directory: %w", err)
+		}
+		incompatible := incompatibleAgentNames(targetAgents)
+		targetAgents = filterProjectAgents(ctx, targetAgents)
+		if len(targetAgents) == 0 {
+			return fmt.Errorf("no agents support project-scoped skills. The following detected agents are global-only: %s", strings.Join(incompatible, ", "))
+		}
+	}
+
+	// Load existing state for idempotency and downgrade checks.
+	state, err := LoadState(baseDir)
+	if err != nil {
+		return fmt.Errorf("failed to load install state: %w", err)
+	}
+
+	// A "legacy install" is one from before the CLI tracked install state in a
+	// JSON file: skills exist on disk but there's no state file (state == nil).
+	// A targeted install (--skills foo) here would write a state file listing only
+	// foo, leaving the other on-disk skills untracked. Block it so the user runs a
+	// full install first, which rebuilds complete state. Global scope only, since
+	// legacy installs only ever wrote to the global dir.
+	// hasLegacyInstall lives in update.go (shared with the update/uninstall paths).
+	legacyInstall := state == nil && scope == ScopeGlobal && hasLegacyInstall(ctx, baseDir)
+	if legacyInstall && len(opts.SpecificSkills) > 0 {
+		return errors.New("legacy install detected without state tracking; run 'databricks aitools install' (without a skill name) first to rebuild state")
+	}
+
+	installedRef, allowFallback := installedSkillsRelease(state)
+	allowFallback = allowFallback && !legacyInstall
+	ref, explicit, err := getSkillsRef(ctx, allowFallback)
+	if err != nil {
+		return err
+	}
+	cmdio.LogProgress(ctx, "Using skills version "+DisplaySkillsVersion(ref))
+	cmdio.LogProgress(ctx, "Fetching skills manifest...")
+	manifest, ref, err := FetchSkillsManifestWithFallback(ctx, src, ref, allowFallback && !explicit)
+	if err != nil {
+		return err
+	}
+	if err := checkSkillsDowngrade(installedRef, ref, explicit); err != nil {
+		return err
+	}
+
+	if opts.IncludeExperimental && !manifestHasExperimental(manifest) {
+		log.Warnf(ctx, "--experimental was set but the manifest at %s exposes no experimental skills. Set DATABRICKS_SKILLS_REF to a release or ref that includes them.", ref)
+	}
+
+	// Filter skills based on options, experimental flag, and CLI version.
+	targetSkills, err := resolveSkills(ctx, manifest.Skills, opts)
+	if err != nil {
+		return err
+	}
+
+	params := installParams{
+		baseDir: baseDir,
+		scope:   scope,
+		cwd:     cwd,
+		ref:     ref,
+	}
+
+	// Install each skill in sorted order for determinism.
+	skillNames := slices.Sorted(maps.Keys(targetSkills))
+
+	// Scoped to the loop, not the manifest fetch above, so earlier warnings print
+	// as plain lines instead of racing the live spinner's redraw.
+	sp := cmdio.NewSpinner(ctx)
+	defer sp.Close()
+
+	// Accumulate file provenance for skills we (re)fetch this run. Skipped
+	// (already-installed) skills keep their existing records via the merge below.
+	fileRecords := map[string]FileRecord{}
+	var refetched []string
+
+	for _, name := range skillNames {
+		meta := targetSkills[name]
+
+		// Idempotency: skip if same version is already installed, the canonical
+		// dir exists, AND every requested agent already has the skill on disk.
+		if state != nil && state.Skills[name] == meta.Version && stateRepoDir(state, name) == meta.RepoDir {
+			skillDir := filepath.Join(baseDir, name)
+			if _, statErr := os.Stat(skillDir); statErr == nil && allAgentsHaveSkill(ctx, name, targetAgents, scope, cwd) {
+				log.Debugf(ctx, "%s v%s already installed for all agents, skipping", name, meta.Version)
+				continue
+			}
+		}
+
+		sp.Update("Installing " + name + "...")
+		records, err := installSkillForAgents(ctx, name, meta, targetAgents, params)
+		if err != nil {
+			return err
+		}
+		maps.Copy(fileRecords, records)
+		refetched = append(refetched, name)
+	}
+
+	// Save state. Merge into existing state (loaded above) so skills from
+	// previous installs (e.g., experimental skills from a prior run) are preserved.
+	if state == nil {
+		state = &InstallState{
+			SchemaVersion: schemaVersionV2,
+			Skills:        make(map[string]string, len(targetSkills)),
+			RepoDirs:      make(map[string]string, len(targetSkills)),
+		}
+	}
+	if state.Skills == nil {
+		state.Skills = make(map[string]string, len(targetSkills))
+	}
+	if state.RepoDirs == nil {
+		state.RepoDirs = make(map[string]string, len(state.Skills)+len(targetSkills))
+	}
+	if state.Files == nil {
+		state.Files = make(map[string]FileRecord, len(fileRecords))
+	}
+	state.Release = ref
+	state.LastUpdated = time.Now()
+	// IncludeExperimental reflects the last invocation's flag value. The Skills
+	// map may still contain experimental entries from a prior run with the flag
+	// enabled; this field does not retroactively remove them.
+	state.IncludeExperimental = opts.IncludeExperimental
+	state.Scope = scope
+	for name, meta := range targetSkills {
+		state.Skills[name] = meta.Version
+		state.RepoDirs[name] = meta.RepoDir
+	}
+	// Drop stale provenance for refetched skills before recording the fresh set,
+	// so files removed/renamed in a new version don't leave orphaned records.
+	for _, name := range refetched {
+		clearFileRecords(state.Files, name)
+	}
+	maps.Copy(state.Files, fileRecords)
+	if err := SaveState(baseDir, state); err != nil {
+		return err
+	}
+
+	// Stop the spinner before the summary so its transient line doesn't linger
+	// above the persistent "Installed N skills." output.
+	sp.Close()
+
+	noun := "skills"
+	if len(targetSkills) == 1 {
+		noun = "skill"
+	}
+	cmdio.LogProgress(ctx, fmt.Sprintf("Installed %d %s.", len(targetSkills), noun))
+	return nil
+}
+
+// skillsDir returns the base skills directory for the given scope.
+func skillsDir(ctx context.Context, scope string) (string, error) {
+	if scope == ScopeProject {
+		return ProjectSkillsDir(ctx)
+	}
+	return GlobalSkillsDir(ctx)
+}
+
+// filterProjectAgents returns only agents that support project scope and warns about skipped agents.
+func filterProjectAgents(ctx context.Context, targetAgents []*agents.Agent) []*agents.Agent {
+	var compatible []*agents.Agent
+	for _, a := range targetAgents {
+		if a.SupportsProjectScope {
+			compatible = append(compatible, a)
+		} else {
+			cmdio.LogProgress(ctx, "Skipped "+a.DisplayName+": does not support project-scoped skills.")
+		}
+	}
+	return compatible
+}
+
+// incompatibleAgentNames returns the display names of agents that do not support project scope.
+func incompatibleAgentNames(targetAgents []*agents.Agent) []string {
+	var names []string
+	for _, a := range targetAgents {
+		if !a.SupportsProjectScope {
+			names = append(names, a.DisplayName)
+		}
+	}
+	return names
+}
+
+// resolveSkills filters the manifest skills based on the install options,
+// experimental flag, and CLI version constraints.
+func resolveSkills(ctx context.Context, skills map[string]SkillMeta, opts InstallOptions) (map[string]SkillMeta, error) {
+	isSpecific := len(opts.SpecificSkills) > 0
+	cliVersion := build.GetInfo().Version
+	isDev := build.GetInfo().IsDevelopment()
+
+	// Start with all skills or only the requested ones.
+	var candidates map[string]SkillMeta
+	if isSpecific {
+		candidates = make(map[string]SkillMeta, len(opts.SpecificSkills))
+		for _, name := range opts.SpecificSkills {
+			meta, ok := skills[name]
+			if !ok {
+				return nil, &SkillError{Skill: name, Reason: ReasonSkillNotFound, Detail: "not found"}
+			}
+			candidates[name] = meta
+		}
+	} else {
+		candidates = skills
+	}
+
+	result := make(map[string]SkillMeta, len(candidates))
+	for name, meta := range candidates {
+		if meta.IsExperimental() && !opts.IncludeExperimental {
+			if isSpecific {
+				return nil, &SkillError{Skill: name, Reason: ReasonExperimentalSkill, Detail: "is experimental; use --experimental to install"}
+			}
+			log.Debugf(ctx, "Skipping experimental skill %s", name)
+			continue
+		}
+
+		if meta.MinCLIVer != "" && !isDev && semver.Compare("v"+cliVersion, "v"+meta.MinCLIVer) < 0 {
+			if isSpecific {
+				return nil, &SkillError{Skill: name, Reason: ReasonVersionIncompatible, Detail: fmt.Sprintf("requires CLI version %s (running %s)", meta.MinCLIVer, cliVersion)}
+			}
+			log.Warnf(ctx, "Skipping %s: requires CLI version %s (running %s)", name, meta.MinCLIVer, cliVersion)
+			continue
+		}
+
+		result[name] = meta
+	}
+	return result, nil
+}
+
+// InstallAllSkills fetches the manifest and installs all skills for detected agents.
+// The signature is func(context.Context) error to satisfy the callback in cmd/apps/init.go.
+func InstallAllSkills(ctx context.Context) error {
+	installed := agents.DetectInstalled(ctx)
+	if len(installed) == 0 {
+		printNoAgentsDetected(ctx)
+		return nil
+	}
+
+	PrintInstallingFor(ctx, installed)
+	src := &GitHubManifestSource{}
+	return InstallSkillsForAgents(ctx, src, installed, InstallOptions{})
+}
+
+// PrintInstallingFor prints the "Installing..." header with agent names.
+func PrintInstallingFor(ctx context.Context, targetAgents []*agents.Agent) {
+	names := make([]string, len(targetAgents))
+	for i, a := range targetAgents {
+		names[i] = a.DisplayName
+	}
+	cmdio.LogString(ctx, fmt.Sprintf("Installing Databricks skills for %s...", strings.Join(names, ", ")))
+}
+
+func printNoAgentsDetected(ctx context.Context) {
+	cmdio.LogString(ctx, cmdio.Yellow(ctx, "No supported coding agents detected."))
+	cmdio.LogString(ctx, "")
+	cmdio.LogString(ctx, "Supported agents: "+strings.Join(agents.SupportedNames(), ", "))
+	cmdio.LogString(ctx, "Please install at least one coding agent first.")
+}
+
+// hasSkillsOnDisk checks if a directory contains subdirectories starting with "databricks".
+func hasSkillsOnDisk(dir string) bool {
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		return false
+	}
+	for _, e := range entries {
+		if e.IsDir() && strings.HasPrefix(e.Name(), "databricks") {
+			return true
+		}
+	}
+	return false
+}
+
+// allAgentsHaveSkill returns true if every agent in the list has the named
+// skill directory present (either as a real directory or symlink).
+func allAgentsHaveSkill(ctx context.Context, skillName string, targetAgents []*agents.Agent, scope, cwd string) bool {
+	for _, agent := range targetAgents {
+		agentSkillDir, err := agentSkillsDirForScope(ctx, agent, scope, cwd)
+		if err != nil {
+			return false
+		}
+		if _, err := os.Stat(filepath.Join(agentSkillDir, skillName)); err != nil {
+			return false
+		}
+	}
+	return true
+}
+
+// installParams bundles the parameters for installSkillForAgents to keep the signature manageable.
+type installParams struct {
+	baseDir string
+	scope   string
+	cwd     string
+	ref     string
+}
+
+func installSkillForAgents(ctx context.Context, skillName string, meta SkillMeta, detectedAgents []*agents.Agent, params installParams) (map[string]FileRecord, error) {
+	canonicalDir := filepath.Join(params.baseDir, skillName)
+	records, err := installSkillToDir(ctx, params.ref, meta.RepoDir, meta.SourceName, canonicalDir, meta.Files)
+	if err != nil {
+		return nil, err
+	}
+
+	// For project scope, always symlink. For global, symlink when multiple agents.
+	useSymlinks := params.scope == ScopeProject || len(detectedAgents) > 1
+
+	for _, agent := range detectedAgents {
+		agentSkillDir, err := agentSkillsDirForScope(ctx, agent, params.scope, params.cwd)
+		if err != nil {
+			log.Warnf(ctx, "Skipped %s: %v", agent.DisplayName, err)
+			continue
+		}
+
+		destDir := filepath.Join(agentSkillDir, skillName)
+
+		if err := backupThirdPartySkill(ctx, destDir, canonicalDir, skillName, agent.DisplayName); err != nil {
+			log.Warnf(ctx, "Failed to back up existing skill for %s: %v", agent.DisplayName, err)
+			continue
+		}
+
+		if useSymlinks {
+			symlinkTarget := canonicalDir
+			// For project scope, use relative symlinks so they work for teammates.
+			if params.scope == ScopeProject {
+				rel, relErr := filepath.Rel(filepath.Dir(destDir), canonicalDir)
+				if relErr == nil {
+					symlinkTarget = rel
+				}
+			}
+			if err := createSymlink(symlinkTarget, destDir); err != nil {
+				log.Debugf(ctx, "Symlink failed for %s, copying instead: %v", agent.DisplayName, err)
+				if err := copyDir(canonicalDir, destDir); err != nil {
+					log.Warnf(ctx, "Failed to install for %s: %v", agent.DisplayName, err)
+					continue
+				}
+			}
+			log.Debugf(ctx, "Installed %q for %s (symlinked)", skillName, agent.DisplayName)
+		} else {
+			// Copy from canonical dir instead of re-downloading.
+			if err := copyDir(canonicalDir, destDir); err != nil {
+				log.Warnf(ctx, "Failed to install for %s: %v", agent.DisplayName, err)
+				continue
+			}
+			log.Debugf(ctx, "Installed %q for %s", skillName, agent.DisplayName)
+		}
+	}
+
+	return records, nil
+}
+
+// agentSkillsDirForScope returns the agent's skills directory for the given scope.
+func agentSkillsDirForScope(ctx context.Context, agent *agents.Agent, scope, cwd string) (string, error) {
+	if scope == ScopeProject {
+		return agent.ProjectSkillsDir(cwd), nil
+	}
+	return agent.SkillsDir(ctx)
+}
+
+// backupThirdPartySkill moves destDir to a temp directory if it exists and is not
+// a symlink pointing to canonicalDir. This preserves skills installed by other tools.
+func backupThirdPartySkill(ctx context.Context, destDir, canonicalDir, skillName, agentName string) error {
+	fi, err := os.Lstat(destDir)
+	if errors.Is(err, fs.ErrNotExist) {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+
+	// If it's a symlink to our canonical dir, no backup needed.
+	if fi.Mode()&os.ModeSymlink != 0 {
+		target, err := os.Readlink(destDir)
+		if err == nil {
+			absTarget := target
+			if !filepath.IsAbs(target) {
+				absTarget = filepath.Clean(filepath.Join(filepath.Dir(destDir), target))
+			}
+			if absTarget == canonicalDir {
+				return nil
+			}
+		}
+	}
+
+	backupDir, err := os.MkdirTemp("", fmt.Sprintf("databricks-skill-backup-%s-*", skillName))
+	if err != nil {
+		return fmt.Errorf("failed to create backup directory: %w", err)
+	}
+
+	backupDest := filepath.Join(backupDir, skillName)
+	if err := movePathWithCrossDeviceFallback(destDir, backupDest); err != nil {
+		return fmt.Errorf("failed to move existing skill: %w", err)
+	}
+
+	log.Debugf(ctx, "Existing %q for %s moved to %s", skillName, agentName, backupDest)
+	return nil
+}
+
+func movePathWithCrossDeviceFallback(src, dest string) error {
+	if err := renamePathFn(src, dest); err != nil {
+		if !isCrossDeviceRenameError(err) {
+			return err
+		}
+		if err := copyPath(src, dest); err != nil {
+			return err
+		}
+		if err := os.RemoveAll(src); err != nil {
+			return fmt.Errorf("failed to remove original path after copy: %w", err)
+		}
+	}
+	return nil
+}
+
+func isCrossDeviceRenameError(err error) bool {
+	if errors.Is(err, syscall.EXDEV) {
+		return true
+	}
+	if runtime.GOOS != "windows" {
+		return false
+	}
+
+	errno, ok := errors.AsType[syscall.Errno](err)
+	return ok && errno == syscall.Errno(17) // ERROR_NOT_SAME_DEVICE
+}
+
+// installSkillToDir downloads a skill's files into destDir and returns a
+// FileRecord per file (keyed by "<skillName>/<file>", forward slashes) capturing
+// the sha256 of the bytes written, so a later update can prune only the files we
+// wrote that the user hasn't modified.
+func installSkillToDir(ctx context.Context, ref, repoDir, skillName, destDir string, files []string) (map[string]FileRecord, error) {
+	parentDir := filepath.Dir(destDir)
+	if err := os.MkdirAll(parentDir, 0o755); err != nil {
+		return nil, fmt.Errorf("failed to create skills directory: %w", err)
+	}
+	tmpDir, err := os.MkdirTemp(parentDir, "."+filepath.Base(destDir)+"-*.tmp")
+	if err != nil {
+		return nil, fmt.Errorf("failed to create temporary skill directory: %w", err)
+	}
+	cleanupTmp := true
+	defer func() {
+		if cleanupTmp {
+			_ = os.RemoveAll(tmpDir)
+		}
+	}()
+
+	var mu sync.Mutex
+	records := make(map[string]FileRecord, len(files))
+
+	// Fetch files concurrently. Each file is a separate HTTPS GET, so
+	// wall-clock time is dominated by per-request TLS handshakes rather
+	// than payload size.
+	g, gctx := errgroup.WithContext(ctx)
+	g.SetLimit(fetchConcurrency)
+	for _, file := range files {
+		g.Go(func() error {
+			content, err := fetchFileFn(gctx, ref, repoDir, skillName, file)
+			if err != nil {
+				return fmt.Errorf("failed to fetch %s/%s/%s at %s: %w", repoDir, skillName, filepath.ToSlash(file), ref, err)
+			}
+			destPath := filepath.Join(tmpDir, file)
+			if err := os.MkdirAll(filepath.Dir(destPath), 0o755); err != nil {
+				return fmt.Errorf("failed to create directory: %w", err)
+			}
+			log.Debugf(gctx, "Downloading %s/%s", skillName, file)
+			if err := os.WriteFile(destPath, content, 0o644); err != nil {
+				return fmt.Errorf("failed to write %s: %w", file, err)
+			}
+			sum := sha256.Sum256(content)
+			mu.Lock()
+			records[skillName+"/"+filepath.ToSlash(file)] = FileRecord{
+				SHA256: hex.EncodeToString(sum[:]),
+				Origin: ref,
+			}
+			mu.Unlock()
+			return nil
+		})
+	}
+	if err := g.Wait(); err != nil {
+		return nil, err
+	}
+
+	if err := replaceDir(destDir, tmpDir); err != nil {
+		return nil, err
+	}
+	cleanupTmp = false
+	return records, nil
+}
+
+func replaceDir(destDir, tmpDir string) error {
+	parentDir := filepath.Dir(destDir)
+	base := filepath.Base(destDir)
+
+	var backupParent string
+	var backupDest string
+	if _, err := os.Lstat(destDir); err == nil {
+		var mkErr error
+		backupParent, mkErr = os.MkdirTemp(parentDir, "."+base+"-backup-*.tmp")
+		if mkErr != nil {
+			return fmt.Errorf("failed to create backup directory: %w", mkErr)
+		}
+		backupDest = filepath.Join(backupParent, base)
+		if err := renamePathFn(destDir, backupDest); err != nil {
+			_ = os.RemoveAll(backupParent)
+			return fmt.Errorf("failed to move existing skill aside: %w", err)
+		}
+	} else if !errors.Is(err, fs.ErrNotExist) {
+		return fmt.Errorf("failed to inspect existing skill: %w", err)
+	}
+
+	if err := renamePathFn(tmpDir, destDir); err != nil {
+		if backupDest != "" {
+			if restoreErr := renamePathFn(backupDest, destDir); restoreErr != nil {
+				return fmt.Errorf("failed to move skill into place: %w (also failed to restore existing skill: %v)", err, restoreErr) //nolint:errorlint // only the primary error belongs in the chain
+			}
+		}
+		return fmt.Errorf("failed to move skill into place: %w", err)
+	}
+
+	if backupParent != "" {
+		_ = os.RemoveAll(backupParent)
+	}
+	return nil
+}
+
+func copyPath(src, dest string) error {
+	info, err := os.Lstat(src)
+	if err != nil {
+		return err
+	}
+	if info.Mode()&os.ModeSymlink != 0 {
+		target, err := os.Readlink(src)
+		if err != nil {
+			return fmt.Errorf("failed to read symlink: %w", err)
+		}
+		if err := os.MkdirAll(filepath.Dir(dest), 0o755); err != nil {
+			return err
+		}
+		return os.Symlink(target, dest)
+	}
+	if info.IsDir() {
+		return copyDir(src, dest)
+	}
+	return copyFile(src, dest, info.Mode())
+}
+
+// copyDir copies all files from src to dest, recreating the directory structure.
+func copyDir(src, dest string) error {
+	if err := os.RemoveAll(dest); err != nil {
+		return fmt.Errorf("failed to remove existing path: %w", err)
+	}
+
+	return filepath.Walk(src, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+
+		rel, err := filepath.Rel(src, path)
+		if err != nil {
+			return err
+		}
+		target := filepath.Join(dest, rel)
+
+		if info.IsDir() {
+			return os.MkdirAll(target, 0o755)
+		}
+
+		data, err := os.ReadFile(path)
+		if err != nil {
+			return fmt.Errorf("failed to read %s: %w", rel, err)
+		}
+		if err := os.MkdirAll(filepath.Dir(target), 0o755); err != nil {
+			return err
+		}
+		return os.WriteFile(target, data, 0o644)
+	})
+}
+
+func copyFile(src, dest string, mode fs.FileMode) error {
+	data, err := os.ReadFile(src)
+	if err != nil {
+		return fmt.Errorf("failed to read %s: %w", src, err)
+	}
+	if err := os.MkdirAll(filepath.Dir(dest), 0o755); err != nil {
+		return err
+	}
+	return os.WriteFile(dest, data, mode.Perm())
+}
+
+func createSymlink(source, dest string) error {
+	// ensure parent directory exists
+	if err := os.MkdirAll(filepath.Dir(dest), 0o755); err != nil {
+		return fmt.Errorf("failed to create parent directory: %w", err)
+	}
+
+	// remove existing symlink or directory
+	if err := os.RemoveAll(dest); err != nil {
+		return fmt.Errorf("failed to remove existing path: %w", err)
+	}
+
+	// create symlink
+	if err := os.Symlink(source, dest); err != nil {
+		return fmt.Errorf("failed to create symlink: %w", err)
+	}
+
+	return nil
+}
diff --git a/libs/aitools/installer/installer_test.go b/libs/aitools/installer/installer_test.go
new file mode 100644
index 00000000000..8c395fad84a
--- /dev/null
+++ b/libs/aitools/installer/installer_test.go
@@ -0,0 +1,1483 @@
+package installer
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/fs"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"sync"
+	"syscall"
+	"testing"
+	"time"
+
+	"github.com/databricks/cli/internal/build"
+	"github.com/databricks/cli/libs/aitools/agents"
+	"github.com/databricks/cli/libs/clicompat"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/log"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const testSkillsRef = "v0.1.5"
+
+// mockManifestSource is a test double for ManifestSource.
+type mockManifestSource struct {
+	manifest *Manifest
+	fetchErr error
+}
+
+func (m *mockManifestSource) FetchManifest(_ context.Context, _ string) (*Manifest, error) {
+	if m.fetchErr != nil {
+		return nil, m.fetchErr
+	}
+	normalizeManifest(m.manifest)
+	return m.manifest, nil
+}
+
+func testManifest() *Manifest {
+	return &Manifest{
+		Version:   "1",
+		UpdatedAt: "2024-01-01",
+		Skills: map[string]SkillMeta{
+			"databricks-sql": {
+				Version: "0.1.0",
+				Files:   []string{"SKILL.md"},
+			},
+			"databricks-jobs": {
+				Version: "0.1.0",
+				Files:   []string{"SKILL.md"},
+			},
+		},
+	}
+}
+
+func setupFetchMock(t *testing.T) {
+	t.Helper()
+	orig := fetchFileFn
+	t.Cleanup(func() { fetchFileFn = orig })
+	fetchFileFn = func(_ context.Context, _, _, skillName, filePath string) ([]byte, error) {
+		return []byte("# " + skillName + "/" + filePath), nil
+	}
+}
+
+func stubLatestSkillsReleaseRef(t *testing.T, ref string, err error) {
+	t.Helper()
+	orig := latestSkillsReleaseRefFn
+	t.Cleanup(func() { latestSkillsReleaseRefFn = orig })
+	latestSkillsReleaseRefFn = func(context.Context) (string, error) {
+		return ref, err
+	}
+}
+
+func testAgent(tmpHome string) *agents.Agent {
+	return &agents.Agent{
+		Name:        "test-agent",
+		DisplayName: "Test Agent",
+		ConfigDir: func(_ context.Context) (string, error) {
+			return filepath.Join(tmpHome, ".test-agent"), nil
+		},
+	}
+}
+
+func setupTestHome(t *testing.T) string {
+	t.Helper()
+	tmp := t.TempDir()
+	t.Setenv("HOME", tmp)
+	t.Setenv("USERPROFILE", tmp)
+	// Create agent config dir so the agent is "detected".
+	require.NoError(t, os.MkdirAll(filepath.Join(tmp, ".test-agent"), 0o755))
+	return tmp
+}
+
+func setBuildVersion(t *testing.T, version string) {
+	t.Helper()
+	orig := build.GetInfo().Version
+	build.SetBuildVersion(version)
+	t.Cleanup(func() { build.SetBuildVersion(orig) })
+}
+
+// --- Backup tests (unchanged from PR 1) ---
+
+func TestBackupThirdPartySkillDestDoesNotExist(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	destDir := filepath.Join(t.TempDir(), "nonexistent")
+
+	err := backupThirdPartySkill(ctx, destDir, "/canonical", "databricks", "Test Agent")
+	assert.NoError(t, err)
+}
+
+func TestBackupThirdPartySkillSymlinkToCanonical(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	tmp := t.TempDir()
+
+	canonicalDir := filepath.Join(tmp, "canonical", "databricks")
+	require.NoError(t, os.MkdirAll(canonicalDir, 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(canonicalDir, "skill.md"), []byte("ok"), 0o644))
+
+	destDir := filepath.Join(tmp, "agent", "skills", "databricks")
+	require.NoError(t, os.MkdirAll(filepath.Dir(destDir), 0o755))
+	require.NoError(t, os.Symlink(canonicalDir, destDir))
+
+	err := backupThirdPartySkill(ctx, destDir, canonicalDir, "databricks", "Test Agent")
+	assert.NoError(t, err)
+
+	// Symlink should still be in place.
+	target, err := os.Readlink(destDir)
+	require.NoError(t, err)
+	assert.Equal(t, canonicalDir, target)
+}
+
+func TestBackupThirdPartySkillRegularDir(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	tmp := t.TempDir()
+
+	destDir := filepath.Join(tmp, "agent", "skills", "databricks")
+	require.NoError(t, os.MkdirAll(destDir, 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(destDir, "custom.md"), []byte("custom"), 0o644))
+
+	err := backupThirdPartySkill(ctx, destDir, "/some/canonical", "databricks", "Test Agent")
+	require.NoError(t, err)
+
+	// destDir should no longer exist.
+	_, err = os.Stat(destDir)
+	assert.ErrorIs(t, err, fs.ErrNotExist)
+
+	// Backup should contain the original file.
+	matches, err := filepath.Glob(filepath.Join(os.TempDir(), "databricks-skill-backup-databricks-*", "databricks", "custom.md"))
+	require.NoError(t, err)
+	require.NotEmpty(t, matches)
+
+	content, err := os.ReadFile(matches[0])
+	require.NoError(t, err)
+	assert.Equal(t, "custom", string(content))
+
+	// Clean up backup.
+	require.NoError(t, os.RemoveAll(filepath.Dir(filepath.Dir(matches[0]))))
+}
+
+func TestBackupThirdPartySkillCrossDeviceFallback(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	tmp := t.TempDir()
+	skillName := "databricks-cross-device"
+
+	cleanupBackups := func() {
+		matches, _ := filepath.Glob(filepath.Join(os.TempDir(), "databricks-skill-backup-"+skillName+"-*"))
+		for _, match := range matches {
+			_ = os.RemoveAll(match)
+		}
+	}
+	cleanupBackups()
+	t.Cleanup(cleanupBackups)
+
+	destDir := filepath.Join(tmp, "agent", "skills", skillName)
+	require.NoError(t, os.MkdirAll(destDir, 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(destDir, "custom.md"), []byte("custom"), 0o644))
+
+	orig := renamePathFn
+	t.Cleanup(func() { renamePathFn = orig })
+	renameCalled := false
+	renamePathFn = func(oldpath, newpath string) error {
+		if oldpath == destDir {
+			renameCalled = true
+			return &os.LinkError{Op: "rename", Old: oldpath, New: newpath, Err: syscall.EXDEV}
+		}
+		return os.Rename(oldpath, newpath)
+	}
+
+	err := backupThirdPartySkill(ctx, destDir, "/some/canonical", skillName, "Test Agent")
+	require.NoError(t, err)
+	assert.True(t, renameCalled)
+
+	_, err = os.Stat(destDir)
+	assert.ErrorIs(t, err, fs.ErrNotExist)
+
+	matches, err := filepath.Glob(filepath.Join(os.TempDir(), "databricks-skill-backup-"+skillName+"-*", skillName, "custom.md"))
+	require.NoError(t, err)
+	require.Len(t, matches, 1)
+
+	content, err := os.ReadFile(matches[0])
+	require.NoError(t, err)
+	assert.Equal(t, "custom", string(content))
+}
+
+func TestBackupThirdPartySkillSymlinkToOtherTarget(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	tmp := t.TempDir()
+
+	otherDir := filepath.Join(tmp, "other", "databricks")
+	require.NoError(t, os.MkdirAll(otherDir, 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(otherDir, "other.md"), []byte("other"), 0o644))
+
+	destDir := filepath.Join(tmp, "agent", "skills", "databricks")
+	require.NoError(t, os.MkdirAll(filepath.Dir(destDir), 0o755))
+	require.NoError(t, os.Symlink(otherDir, destDir))
+
+	canonicalDir := filepath.Join(tmp, "canonical", "databricks")
+
+	err := backupThirdPartySkill(ctx, destDir, canonicalDir, "databricks", "Test Agent")
+	require.NoError(t, err)
+
+	// destDir (the symlink) should no longer exist.
+	_, err = os.Lstat(destDir)
+	assert.ErrorIs(t, err, fs.ErrNotExist)
+
+	// Original target should be untouched.
+	content, err := os.ReadFile(filepath.Join(otherDir, "other.md"))
+	require.NoError(t, err)
+	assert.Equal(t, "other", string(content))
+}
+
+func TestBackupThirdPartySkillRegularFile(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	tmp := t.TempDir()
+
+	// Edge case: destDir is a file, not a directory.
+	destDir := filepath.Join(tmp, "agent", "skills", "databricks")
+	require.NoError(t, os.MkdirAll(filepath.Dir(destDir), 0o755))
+	require.NoError(t, os.WriteFile(destDir, []byte("file"), 0o644))
+
+	err := backupThirdPartySkill(ctx, destDir, "/some/canonical", "databricks", "Test Agent")
+	require.NoError(t, err)
+
+	_, err = os.Stat(destDir)
+	assert.ErrorIs(t, err, fs.ErrNotExist)
+}
+
+func TestInstallSkillToDirFetchesFilesConcurrently(t *testing.T) {
+	baseCtx, cancel := context.WithTimeout(t.Context(), 2*time.Second)
+	defer cancel()
+	ctx := cmdio.MockDiscard(baseCtx)
+
+	orig := fetchFileFn
+	t.Cleanup(func() { fetchFileFn = orig })
+
+	started := make(chan string, 2)
+	release := make(chan struct{})
+	releaseOnce := sync.OnceFunc(func() { close(release) })
+	t.Cleanup(releaseOnce)
+
+	fetchFileFn = func(ctx context.Context, _, _, _, filePath string) ([]byte, error) {
+		started <- filePath
+		select {
+		case <-release:
+			return []byte(filePath), nil
+		case <-ctx.Done():
+			return nil, ctx.Err()
+		}
+	}
+
+	destDir := filepath.Join(t.TempDir(), "databricks-test")
+	errCh := make(chan error, 1)
+	go func() {
+		_, err := installSkillToDir(ctx, testSkillsRef, stableSkillsRepoPath, "databricks-test", destDir, []string{"one.md", "two.md"})
+		errCh <- err
+	}()
+
+	fetched := make(map[string]bool, 2)
+	for range 2 {
+		select {
+		case filePath := <-started:
+			fetched[filePath] = true
+		case <-ctx.Done():
+			require.FailNow(t, "timed out waiting for concurrent fetches to start")
+		}
+	}
+	assert.Equal(t, map[string]bool{"one.md": true, "two.md": true}, fetched)
+
+	releaseOnce()
+	require.NoError(t, <-errCh)
+
+	one, err := os.ReadFile(filepath.Join(destDir, "one.md"))
+	require.NoError(t, err)
+	assert.Equal(t, "one.md", string(one))
+	two, err := os.ReadFile(filepath.Join(destDir, "two.md"))
+	require.NoError(t, err)
+	assert.Equal(t, "two.md", string(two))
+}
+
+func TestInstallSkillToDirCancelsInFlightFetchesOnError(t *testing.T) {
+	baseCtx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+	ctx := cmdio.MockDiscard(baseCtx)
+
+	orig := fetchFileFn
+	t.Cleanup(func() { fetchFileFn = orig })
+
+	fetchErr := errors.New("fetch failed")
+	blockedStarted := make(chan struct{})
+	cancelled := make(chan struct{})
+
+	fetchFileFn = func(ctx context.Context, _, _, _, filePath string) ([]byte, error) {
+		switch filePath {
+		case "blocked.md":
+			close(blockedStarted)
+			<-ctx.Done()
+			close(cancelled)
+			return nil, ctx.Err()
+		case "fail.md":
+			select {
+			case <-blockedStarted:
+				return nil, fetchErr
+			case <-ctx.Done():
+				return nil, ctx.Err()
+			}
+		default:
+			return []byte(filePath), nil
+		}
+	}
+
+	destDir := filepath.Join(t.TempDir(), "databricks-test")
+	errCh := make(chan error, 1)
+	go func() {
+		_, err := installSkillToDir(ctx, testSkillsRef, stableSkillsRepoPath, "databricks-test", destDir, []string{"blocked.md", "fail.md"})
+		errCh <- err
+	}()
+
+	var err error
+	select {
+	case err = <-errCh:
+	case <-time.After(5 * time.Second):
+		cancel()
+		select {
+		case <-errCh:
+		case <-time.After(time.Second):
+		}
+		require.FailNow(t, "timed out waiting for errgroup cancellation")
+	}
+	require.ErrorIs(t, err, fetchErr)
+
+	select {
+	case <-cancelled:
+	default:
+		require.Fail(t, "expected in-flight fetch to observe context cancellation")
+	}
+}
+
+func TestInstallSkillToDirFetchErrorIncludesContextAndCleansTemp(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+
+	orig := fetchFileFn
+	t.Cleanup(func() { fetchFileFn = orig })
+
+	fetchErr := errors.New("HTTP 404")
+	fetchFileFn = func(_ context.Context, _, _, _, _ string) ([]byte, error) {
+		return nil, fetchErr
+	}
+
+	destDir := filepath.Join(t.TempDir(), "databricks-test")
+	_, err := installSkillToDir(ctx, testSkillsRef, stableSkillsRepoPath, "databricks-test", destDir, []string{"assets/databricks.png"})
+	require.ErrorIs(t, err, fetchErr)
+	assert.Contains(t, err.Error(), stableSkillsRepoPath+"/databricks-test/assets/databricks.png")
+	assert.Contains(t, err.Error(), testSkillsRef)
+
+	_, statErr := os.Stat(destDir)
+	assert.ErrorIs(t, statErr, fs.ErrNotExist)
+
+	matches, globErr := filepath.Glob(filepath.Join(filepath.Dir(destDir), "."+filepath.Base(destDir)+"-*.tmp"))
+	require.NoError(t, globErr)
+	assert.Empty(t, matches)
+}
+
+func TestInstallSkillToDirFetchFailureKeepsExistingSkill(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+
+	orig := fetchFileFn
+	t.Cleanup(func() { fetchFileFn = orig })
+
+	fetchErr := errors.New("HTTP 404")
+	fetchFileFn = func(_ context.Context, _, _, _, filePath string) ([]byte, error) {
+		if filePath == "assets/databricks.png" {
+			return nil, fetchErr
+		}
+		return []byte("new"), nil
+	}
+
+	destDir := filepath.Join(t.TempDir(), "databricks-test")
+	require.NoError(t, os.MkdirAll(destDir, 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(destDir, "SKILL.md"), []byte("old"), 0o644))
+
+	_, err := installSkillToDir(ctx, testSkillsRef, stableSkillsRepoPath, "databricks-test", destDir, []string{"SKILL.md", "assets/databricks.png"})
+	require.ErrorIs(t, err, fetchErr)
+
+	content, err := os.ReadFile(filepath.Join(destDir, "SKILL.md"))
+	require.NoError(t, err)
+	assert.Equal(t, "old", string(content))
+	_, err = os.Stat(filepath.Join(destDir, "assets", "databricks.png"))
+	assert.ErrorIs(t, err, fs.ErrNotExist)
+}
+
+// --- InstallSkillsForAgents tests ---
+
+func TestInstallSkillsForAgentsWritesState(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+
+	src := &mockManifestSource{manifest: testManifest()}
+	agent := testAgent(tmp)
+
+	err := InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{})
+	require.NoError(t, err)
+
+	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
+	state, err := LoadState(globalDir)
+	require.NoError(t, err)
+	require.NotNil(t, state)
+	assert.Equal(t, schemaVersionV2, state.SchemaVersion)
+	assert.Equal(t, testSkillsRef, state.Release)
+	assert.Len(t, state.Skills, 2)
+	assert.Equal(t, "0.1.0", state.Skills["databricks-sql"])
+	assert.Equal(t, "0.1.0", state.Skills["databricks-jobs"])
+
+	// File provenance is captured for the prune safeguard.
+	require.Contains(t, state.Files, "databricks-sql/SKILL.md")
+	assert.NotEmpty(t, state.Files["databricks-sql/SKILL.md"].SHA256)
+	assert.Equal(t, testSkillsRef, state.Files["databricks-sql/SKILL.md"].Origin)
+
+	// Per-skill progress now goes through a spinner, which is silent in this
+	// non-interactive test, so only these plain lines remain.
+	assert.Contains(t, stderr.String(), "Using skills version")
+	assert.Contains(t, stderr.String(), "Fetching skills manifest...")
+	assert.Contains(t, stderr.String(), "Installed 2 skills.")
+}
+
+func setupSkillsFallback(t *testing.T, latestErr error) (ManifestSource, string) {
+	t.Helper()
+	setBuildVersion(t, "1.22.0")
+	t.Setenv("DATABRICKS_SKILLS_REF", "")
+	t.Setenv("DATABRICKS_FORCE_EMBEDDED_COMPAT", "false")
+	t.Setenv("DATABRICKS_CACHE_ENABLED", "true")
+	withCachedCompat(t, skillsLatestSentinel)
+	stubLatestSkillsReleaseRef(t, "v9.9.9", latestErr)
+	fallbackVersion, err := clicompat.ResolveEmbeddedAgentSkillsVersion()
+	require.NoError(t, err)
+	fallbackRef := "v" + fallbackVersion
+	body, err := json.Marshal(testManifest())
+	require.NoError(t, err)
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/"+fallbackRef+"/manifest.json" {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+		_, _ = w.Write(body)
+	}))
+	t.Cleanup(srv.Close)
+	t.Setenv("DATABRICKS_SKILLS_BASE_URL", srv.URL)
+	return &GitHubManifestSource{}, fallbackRef
+}
+
+func testSkillsFallbackVersions(t *testing.T, run func(context.Context, ManifestSource, []*agents.Agent) error) {
+	t.Helper()
+	for _, failure := range []struct {
+		name      string
+		latestErr error
+	}{
+		{name: "release lookup failed", latestErr: errors.New("HTTP 403 fetching latest skills release")},
+		{name: "latest manifest missing"},
+	} {
+		t.Run(failure.name, func(t *testing.T) {
+			for _, tc := range []struct {
+				name          string
+				installedRef  string
+				pluginInstall bool
+				legacyState   bool
+				unknown       bool
+				downgrade     bool
+			}{
+				{name: "newer fallback", installedRef: "v0.0.1"},
+				{name: "equal fallback"},
+				{name: "older fallback", installedRef: "v9.9.8", downgrade: true},
+				{name: "older fallback after plugin install", installedRef: "v9.9.8", pluginInstall: true, downgrade: true},
+				{name: "unknown installed release", installedRef: "main", unknown: true},
+				{name: "unknown release after plugin install", installedRef: "main", pluginInstall: true, unknown: true},
+				{name: "legacy state after plugin install", installedRef: "v9.9.8", pluginInstall: true, legacyState: true, unknown: true},
+			} {
+				t.Run(tc.name, func(t *testing.T) {
+					tmp := setupTestHome(t)
+					ctx := cmdio.MockDiscard(t.Context())
+					setupFetchMock(t)
+					src, fallbackRef := setupSkillsFallback(t, failure.latestErr)
+					installedRef := tc.installedRef
+					if installedRef == "" {
+						installedRef = fallbackRef
+					}
+					t.Setenv("DATABRICKS_SKILLS_REF", installedRef)
+					targetAgents := []*agents.Agent{testAgent(tmp)}
+					installedManifest := testManifest()
+					switch {
+					case tc.downgrade || tc.unknown:
+						installedManifest.Skills["databricks-sql"] = SkillMeta{Version: "0.2.0", Files: []string{"SKILL.md"}}
+						installedManifest.Skills["databricks-new"] = SkillMeta{Version: "0.1.0", Files: []string{"SKILL.md"}}
+					case tc.installedRef != "":
+						installedManifest.Skills["databricks-sql"] = SkillMeta{Version: "0.0.9", Files: []string{"SKILL.md"}}
+					}
+					require.NoError(t, InstallSkillsForAgents(ctx, &mockManifestSource{manifest: installedManifest}, targetAgents, InstallOptions{}))
+					baseDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
+					if tc.legacyState {
+						state, err := LoadState(baseDir)
+						require.NoError(t, err)
+						state.Files = nil
+						require.NoError(t, SaveState(baseDir, state))
+					}
+					if tc.pluginInstall {
+						require.NoError(t, RecordPluginInstalls(ctx, ScopeGlobal, map[string]PluginRecord{
+							"claude-code": {Plugin: "databricks", Version: DisplaySkillsVersion(fallbackRef)},
+						}, fallbackRef))
+					}
+					statePath := filepath.Join(baseDir, stateFileName)
+					before, err := os.ReadFile(statePath)
+					require.NoError(t, err)
+
+					t.Setenv("DATABRICKS_SKILLS_REF", "")
+					err = run(ctx, src, targetAgents)
+					switch {
+					case tc.downgrade:
+						require.ErrorContains(t, err, "refusing to downgrade skills from 9.9.8 to "+DisplaySkillsVersion(fallbackRef))
+						require.ErrorContains(t, err, "DATABRICKS_SKILLS_REF="+fallbackRef)
+					case tc.unknown && failure.latestErr != nil:
+						require.ErrorIs(t, err, failure.latestErr)
+					case tc.unknown:
+						require.ErrorIs(t, err, clicompat.ErrNotFound)
+					default:
+						require.NoError(t, err)
+						state, err := LoadState(baseDir)
+						require.NoError(t, err)
+						assert.Equal(t, fallbackRef, state.Release)
+						assert.Equal(t, map[string]string{"databricks-sql": "0.1.0", "databricks-jobs": "0.1.0"}, state.Skills)
+						return
+					}
+
+					after, err := os.ReadFile(statePath)
+					require.NoError(t, err)
+					assert.Equal(t, before, after, "rejected fallback must not rewrite install state")
+					for name := range installedManifest.Skills {
+						for _, dir := range []string{baseDir, filepath.Join(tmp, ".test-agent", "skills")} {
+							content, err := os.ReadFile(filepath.Join(dir, name, "SKILL.md"))
+							require.NoError(t, err)
+							assert.Equal(t, "# "+name+"/SKILL.md", string(content))
+						}
+					}
+				})
+			}
+		})
+	}
+}
+
+func TestInstallSkillsForAgentsFallbackVersions(t *testing.T) {
+	testSkillsFallbackVersions(t, func(ctx context.Context, src ManifestSource, targetAgents []*agents.Agent) error {
+		return InstallSkillsForAgents(ctx, src, targetAgents, InstallOptions{})
+	})
+}
+
+func testSkillsRefSelection(t *testing.T, run func(context.Context, ManifestSource, []*agents.Agent) error) {
+	t.Helper()
+	for _, tc := range []struct {
+		name         string
+		installedRef string
+		selectedRef  string
+		envPin       bool
+		compatPin    bool
+		wantErr      bool
+	}{
+		{name: "environment pin", installedRef: "v9.9.8", selectedRef: testSkillsRef, envPin: true},
+		{name: "compatibility pin", installedRef: "v9.9.8", selectedRef: testSkillsRef, compatPin: true},
+		{name: "latest after branch", installedRef: "main", selectedRef: "v9.9.9"},
+		{name: "older latest release", installedRef: "v9.9.8", selectedRef: testSkillsRef, wantErr: true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			tmp := setupTestHome(t)
+			ctx := cmdio.MockDiscard(t.Context())
+			setupFetchMock(t)
+			t.Setenv("DATABRICKS_SKILLS_REF", tc.installedRef)
+			targetAgents := []*agents.Agent{testAgent(tmp)}
+			installedManifest := testManifest()
+			version := "0.2.0"
+			if tc.installedRef == "main" {
+				version = "0.0.9"
+			}
+			installedManifest.Skills["databricks-sql"] = SkillMeta{Version: version, Files: []string{"SKILL.md"}}
+			require.NoError(t, InstallSkillsForAgents(ctx, &mockManifestSource{manifest: installedManifest}, targetAgents, InstallOptions{}))
+
+			t.Setenv("DATABRICKS_SKILLS_REF", "")
+			switch {
+			case tc.envPin:
+				t.Setenv("DATABRICKS_SKILLS_REF", tc.selectedRef)
+			case tc.compatPin:
+				withCachedCompat(t, DisplaySkillsVersion(tc.selectedRef))
+			default:
+				withCachedCompat(t, skillsLatestSentinel)
+			}
+			stubLatestSkillsReleaseRef(t, tc.selectedRef, nil)
+			err := run(ctx, &mockManifestSource{manifest: testManifest()}, targetAgents)
+			if tc.wantErr {
+				require.ErrorContains(t, err, "refusing to downgrade skills")
+			} else {
+				require.NoError(t, err)
+			}
+			state, err := LoadState(filepath.Join(tmp, ".databricks", "aitools", "skills"))
+			require.NoError(t, err)
+			if tc.wantErr {
+				assert.Equal(t, tc.installedRef, state.Release)
+				assert.Equal(t, version, state.Skills["databricks-sql"])
+			} else {
+				assert.Equal(t, tc.selectedRef, state.Release)
+				assert.Equal(t, "0.1.0", state.Skills["databricks-sql"])
+			}
+		})
+	}
+}
+
+func TestInstallSkillsForAgentsRefSelection(t *testing.T) {
+	testSkillsRefSelection(t, func(ctx context.Context, src ManifestSource, targetAgents []*agents.Agent) error {
+		return InstallSkillsForAgents(ctx, src, targetAgents, InstallOptions{})
+	})
+}
+
+func TestCheckSkillsDowngrade(t *testing.T) {
+	for _, tc := range []struct {
+		name         string
+		installedRef string
+		ref          string
+		wantErr      bool
+	}{
+		{name: "fresh install", ref: "v0.2.30"},
+		{name: "same release", installedRef: "v0.2.30", ref: "v0.2.30"},
+		{name: "numeric upgrade", installedRef: "v0.2.9", ref: "v0.2.30"},
+		{name: "numeric downgrade", installedRef: "v0.2.30", ref: "v0.2.9", wantErr: true},
+		{name: "prerelease upgrade", installedRef: "v0.2.30-rc.1", ref: "v0.2.30"},
+		{name: "prerelease downgrade", installedRef: "v0.2.30", ref: "v0.2.30-rc.1", wantErr: true},
+		{name: "build metadata", installedRef: "v0.2.30+test", ref: "v0.2.30"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			err := checkSkillsDowngrade(tc.installedRef, tc.ref, false)
+			if tc.wantErr {
+				require.ErrorContains(t, err, "refusing to downgrade skills")
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestInstallSkillsForAgentsFallbackForFreshInstall(t *testing.T) {
+	for _, pluginOnly := range []bool{false, true} {
+		for _, missingManifest := range []bool{false, true} {
+			t.Run(fmt.Sprintf("pluginOnly=%t/missingManifest=%t", pluginOnly, missingManifest), func(t *testing.T) {
+				tmp := setupTestHome(t)
+				ctx := cmdio.MockDiscard(t.Context())
+				setupFetchMock(t)
+				if pluginOnly {
+					require.NoError(t, RecordPluginInstalls(ctx, ScopeGlobal, map[string]PluginRecord{
+						"claude-code": {Plugin: "databricks", Version: "9.9.8"},
+					}, "v9.9.8"))
+				}
+				var latestErr error
+				if !missingManifest {
+					latestErr = errors.New("HTTP 403 fetching latest skills release")
+				}
+				src, fallbackRef := setupSkillsFallback(t, latestErr)
+				require.NoError(t, InstallSkillsForAgents(ctx, src, []*agents.Agent{testAgent(tmp)}, InstallOptions{}))
+				state, err := LoadState(filepath.Join(tmp, ".databricks", "aitools", "skills"))
+				require.NoError(t, err)
+				require.NotNil(t, state)
+				assert.Equal(t, fallbackRef, state.Release)
+				assert.Len(t, state.Skills, 2)
+				if pluginOnly {
+					assert.Contains(t, state.Plugins, "claude-code")
+				}
+			})
+		}
+	}
+}
+
+func TestInstallSkillsForAgentsPreservesLegacySkillsOnFallback(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx := cmdio.MockDiscard(t.Context())
+	baseDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
+	skillDir := filepath.Join(baseDir, "databricks-sql")
+	require.NoError(t, os.MkdirAll(skillDir, 0o755))
+	skillPath := filepath.Join(skillDir, "SKILL.md")
+	require.NoError(t, os.WriteFile(skillPath, []byte("installed skill"), 0o644))
+	latestErr := errors.New("network down")
+	src, _ := setupSkillsFallback(t, latestErr)
+
+	err := InstallSkillsForAgents(ctx, src, []*agents.Agent{testAgent(tmp)}, InstallOptions{})
+	require.ErrorIs(t, err, latestErr)
+	content, err := os.ReadFile(skillPath)
+	require.NoError(t, err)
+	assert.Equal(t, "installed skill", string(content))
+	assert.NoFileExists(t, filepath.Join(baseDir, stateFileName))
+}
+
+func TestInstallPurgesStaleFileRecordsOnRefetch(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx := cmdio.MockDiscard(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+
+	agent := testAgent(tmp)
+	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
+
+	// v1: the skill ships two files.
+	m1 := &Manifest{Version: "1", Skills: map[string]SkillMeta{
+		"databricks-sql": {Version: "0.1.0", Files: []string{"a.md", "b.md"}},
+	}}
+	require.NoError(t, InstallSkillsForAgents(ctx, &mockManifestSource{manifest: m1}, []*agents.Agent{agent}, InstallOptions{SpecificSkills: []string{"databricks-sql"}}))
+	st, err := LoadState(globalDir)
+	require.NoError(t, err)
+	require.Contains(t, st.Files, "databricks-sql/a.md")
+	require.Contains(t, st.Files, "databricks-sql/b.md")
+
+	// v2 drops b.md. Refetching must purge the stale record.
+	t.Setenv("DATABRICKS_SKILLS_REF", "v0.2.0")
+	m2 := &Manifest{Version: "2", Skills: map[string]SkillMeta{
+		"databricks-sql": {Version: "0.2.0", Files: []string{"a.md"}},
+	}}
+	require.NoError(t, InstallSkillsForAgents(ctx, &mockManifestSource{manifest: m2}, []*agents.Agent{agent}, InstallOptions{SpecificSkills: []string{"databricks-sql"}}))
+	st2, err := LoadState(globalDir)
+	require.NoError(t, err)
+	assert.Contains(t, st2.Files, "databricks-sql/a.md")
+	assert.NotContains(t, st2.Files, "databricks-sql/b.md")
+}
+
+func TestInstallSkillForSingleWritesState(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+
+	src := &mockManifestSource{manifest: testManifest()}
+	agent := testAgent(tmp)
+
+	err := InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{
+		SpecificSkills: []string{"databricks-sql"},
+	})
+	require.NoError(t, err)
+
+	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
+	state, err := LoadState(globalDir)
+	require.NoError(t, err)
+	require.NotNil(t, state)
+	assert.Len(t, state.Skills, 1)
+	assert.Equal(t, "0.1.0", state.Skills["databricks-sql"])
+
+	assert.Contains(t, stderr.String(), "Installed 1 skill.")
+}
+
+func TestInstallSkillsSpecificNotFound(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx := cmdio.MockDiscard(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+
+	src := &mockManifestSource{manifest: testManifest()}
+	agent := testAgent(tmp)
+
+	err := InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{
+		SpecificSkills: []string{"nonexistent"},
+	})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), `skill "nonexistent" not found`)
+}
+
+func TestExperimentalSkillsSkippedByDefault(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+
+	manifest := testManifest()
+	manifest.Skills["databricks-iceberg"] = SkillMeta{
+		Version: "0.1.0",
+		Files:   []string{"SKILL.md"},
+		RepoDir: experimentalRepoPath,
+	}
+
+	src := &mockManifestSource{manifest: manifest}
+	agent := testAgent(tmp)
+
+	err := InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{})
+	require.NoError(t, err)
+
+	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
+	state, err := LoadState(globalDir)
+	require.NoError(t, err)
+	// Only non-experimental skills should be installed.
+	assert.Len(t, state.Skills, 2)
+	assert.NotContains(t, state.Skills, "databricks-iceberg")
+
+	assert.Contains(t, stderr.String(), "Installed 2 skills.")
+}
+
+func TestExperimentalSkillsIncludedWithFlag(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+
+	manifest := testManifest()
+	manifest.Skills["databricks-iceberg"] = SkillMeta{
+		Version: "0.1.0",
+		Files:   []string{"SKILL.md"},
+		RepoDir: experimentalRepoPath,
+	}
+
+	src := &mockManifestSource{manifest: manifest}
+	agent := testAgent(tmp)
+
+	err := InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{
+		IncludeExperimental: true,
+	})
+	require.NoError(t, err)
+
+	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
+	state, err := LoadState(globalDir)
+	require.NoError(t, err)
+	assert.Len(t, state.Skills, 3)
+	assert.Contains(t, state.Skills, "databricks-iceberg")
+	assert.True(t, state.IncludeExperimental)
+
+	assert.Contains(t, stderr.String(), "Installed 3 skills.")
+}
+
+func TestMinCLIVersionSkipWithWarningForInstallAll(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+	setBuildVersion(t, "0.200.0")
+
+	// Capture log output to verify the warning.
+	var logBuf bytes.Buffer
+	logger := slog.New(slog.NewTextHandler(&logBuf, &slog.HandlerOptions{Level: slog.LevelWarn}))
+	ctx = log.NewContext(ctx, logger)
+
+	manifest := testManifest()
+	manifest.Skills["databricks-future"] = SkillMeta{
+		Version:   "0.1.0",
+		Files:     []string{"SKILL.md"},
+		MinCLIVer: "0.300.0",
+	}
+
+	src := &mockManifestSource{manifest: manifest}
+	agent := testAgent(tmp)
+
+	err := InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{})
+	require.NoError(t, err)
+
+	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
+	state, err := LoadState(globalDir)
+	require.NoError(t, err)
+	// The high-version skill should be skipped.
+	assert.Len(t, state.Skills, 2)
+	assert.NotContains(t, state.Skills, "databricks-future")
+
+	assert.Contains(t, stderr.String(), "Installed 2 skills.")
+	assert.Contains(t, logBuf.String(), "requires CLI version 0.300.0")
+}
+
+func TestMinCLIVersionHardErrorForInstallSingle(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx := cmdio.MockDiscard(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+	setBuildVersion(t, "0.200.0")
+
+	manifest := testManifest()
+	manifest.Skills["databricks-future"] = SkillMeta{
+		Version:   "0.1.0",
+		Files:     []string{"SKILL.md"},
+		MinCLIVer: "0.300.0",
+	}
+
+	src := &mockManifestSource{manifest: manifest}
+	agent := testAgent(tmp)
+
+	err := InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{
+		SpecificSkills: []string{"databricks-future"},
+	})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "requires CLI version 0.300.0")
+	assert.Contains(t, err.Error(), "running 0.200.0")
+}
+
+func TestIdempotentSecondInstallSkips(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx := cmdio.MockDiscard(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+
+	src := &mockManifestSource{manifest: testManifest()}
+	agent := testAgent(tmp)
+
+	// First install.
+	err := InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{})
+	require.NoError(t, err)
+
+	// Track fetch calls on second install.
+	fetchCalls := 0
+	orig := fetchFileFn
+	t.Cleanup(func() { fetchFileFn = orig })
+	fetchFileFn = func(_ context.Context, _, _, skillName, filePath string) ([]byte, error) {
+		fetchCalls++
+		return []byte("# " + skillName + "/" + filePath), nil
+	}
+
+	// Second install with same version.
+	err = InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{})
+	require.NoError(t, err)
+
+	// No files should be fetched since everything is up to date.
+	assert.Equal(t, 0, fetchCalls)
+}
+
+func TestIdempotentInstallUpdatesNewVersions(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx := cmdio.MockDiscard(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+
+	src := &mockManifestSource{manifest: testManifest()}
+	agent := testAgent(tmp)
+
+	// First install.
+	err := InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{})
+	require.NoError(t, err)
+
+	// Update manifest with a new version for one skill.
+	updatedManifest := testManifest()
+	updatedManifest.Skills["databricks-sql"] = SkillMeta{
+		Version: "0.2.0",
+		Files:   []string{"SKILL.md"},
+	}
+	src2 := &mockManifestSource{manifest: updatedManifest}
+
+	// Track which skills are fetched.
+	var fetchedSkills []string
+	orig := fetchFileFn
+	t.Cleanup(func() { fetchFileFn = orig })
+	fetchFileFn = func(_ context.Context, _, _, skillName, filePath string) ([]byte, error) {
+		fetchedSkills = append(fetchedSkills, skillName)
+		return []byte("# " + skillName + "/" + filePath), nil
+	}
+
+	// Second install with updated manifest.
+	err = InstallSkillsForAgents(ctx, src2, []*agents.Agent{agent}, InstallOptions{})
+	require.NoError(t, err)
+
+	// Only databricks-sql should be re-fetched (version changed from 0.1.0 to 0.2.0).
+	// databricks-jobs keeps version 0.1.0 and should be skipped by the idempotency check.
+	assert.Contains(t, fetchedSkills, "databricks-sql")
+	assert.NotContains(t, fetchedSkills, "databricks-jobs")
+
+	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
+	state, err := LoadState(globalDir)
+	require.NoError(t, err)
+	assert.Equal(t, testSkillsRef, state.Release)
+	assert.Equal(t, "0.2.0", state.Skills["databricks-sql"])
+}
+
+func TestLegacyTargetedInstallBlockedFromLegacyDir(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx := cmdio.MockDiscard(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+
+	// Skills in the legacy location (~/.databricks/agent-skills), no state file.
+	legacyDir := filepath.Join(tmp, ".databricks", "agent-skills")
+	require.NoError(t, os.MkdirAll(filepath.Join(legacyDir, "databricks-sql"), 0o755))
+
+	src := &mockManifestSource{manifest: testManifest()}
+	agent := testAgent(tmp)
+
+	// A targeted install must be blocked when a legacy install is detected via
+	// the legacy dir, mirroring the canonical-dir case.
+	err := InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{
+		SpecificSkills: []string{"databricks-sql"},
+	})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "legacy install detected")
+}
+
+func TestIdempotentInstallReinstallsForNewAgent(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx := cmdio.MockDiscard(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+
+	src := &mockManifestSource{manifest: testManifest()}
+	agent1 := testAgent(tmp)
+
+	// First install for agent1.
+	err := InstallSkillsForAgents(ctx, src, []*agents.Agent{agent1}, InstallOptions{})
+	require.NoError(t, err)
+
+	// Create a second agent.
+	agent2Dir := filepath.Join(tmp, ".second-agent")
+	require.NoError(t, os.MkdirAll(agent2Dir, 0o755))
+	agent2 := &agents.Agent{
+		Name:        "second-agent",
+		DisplayName: "Second Agent",
+		ConfigDir: func(_ context.Context) (string, error) {
+			return agent2Dir, nil
+		},
+	}
+
+	// Track fetch calls for second install (with both agents).
+	fetchCalls := 0
+	orig := fetchFileFn
+	t.Cleanup(func() { fetchFileFn = orig })
+	fetchFileFn = func(_ context.Context, _, _, skillName, filePath string) ([]byte, error) {
+		fetchCalls++
+		return []byte("# " + skillName + "/" + filePath), nil
+	}
+
+	// Second install with both agents, same version.
+	err = InstallSkillsForAgents(ctx, src, []*agents.Agent{agent1, agent2}, InstallOptions{})
+	require.NoError(t, err)
+
+	// Skills should be re-fetched because agent2 doesn't have them yet.
+	assert.Positive(t, fetchCalls, "should re-install skills for new agent")
+
+	// Verify agent2 got the skills.
+	agent2SkillsDir := filepath.Join(agent2Dir, "skills")
+	_, err = os.Stat(filepath.Join(agent2SkillsDir, "databricks-sql"))
+	assert.NoError(t, err, "agent2 should have databricks-sql")
+}
+
+func TestLegacyTargetedInstallBlocked(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx := cmdio.MockDiscard(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+
+	// Create skills on disk at canonical location but no state file (legacy).
+	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
+	require.NoError(t, os.MkdirAll(filepath.Join(globalDir, "databricks-sql"), 0o755))
+
+	src := &mockManifestSource{manifest: testManifest()}
+	agent := testAgent(tmp)
+
+	// Targeted install should fail on legacy setup.
+	err := InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{
+		SpecificSkills: []string{"databricks-sql"},
+	})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "legacy install detected")
+}
+
+func TestLegacyFullInstallAllowed(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+
+	// Create skills on disk at canonical location but no state file (legacy).
+	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
+	require.NoError(t, os.MkdirAll(filepath.Join(globalDir, "databricks-sql"), 0o755))
+
+	src := &mockManifestSource{manifest: testManifest()}
+	agent := testAgent(tmp)
+
+	// Full install (no SpecificSkills) should succeed and rebuild state silently.
+	err := InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{})
+	require.NoError(t, err)
+
+	assert.Contains(t, stderr.String(), "Installed 2 skills.")
+
+	state, err := LoadState(globalDir)
+	require.NoError(t, err)
+	require.NotNil(t, state)
+	assert.Len(t, state.Skills, 2)
+}
+
+func TestInstallAllSkillsSignaturePreserved(t *testing.T) {
+	// Compile-time check that InstallAllSkills satisfies func(context.Context) error.
+	callback := func(fn func(context.Context) error) { _ = fn }
+	callback(InstallAllSkills)
+}
+
+// --- Project scope tests ---
+
+func testProjectAgent(tmpHome string) *agents.Agent {
+	return &agents.Agent{
+		Name:                 "test-project-agent",
+		DisplayName:          "Test Project Agent",
+		SupportsProjectScope: true,
+		ProjectConfigDir:     ".test-project-agent",
+		ConfigDir: func(_ context.Context) (string, error) {
+			return filepath.Join(tmpHome, ".test-project-agent"), nil
+		},
+	}
+}
+
+func TestInstallProjectScopeWritesState(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+
+	// Use project dir as cwd.
+	projectDir := filepath.Join(tmp, "myproject")
+	require.NoError(t, os.MkdirAll(projectDir, 0o755))
+	t.Chdir(projectDir)
+
+	src := &mockManifestSource{manifest: testManifest()}
+	agent := testProjectAgent(tmp)
+
+	err := InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{Scope: ScopeProject})
+	require.NoError(t, err)
+
+	projectSkillsDir := filepath.Join(projectDir, ".databricks", "aitools", "skills")
+	state, err := LoadState(projectSkillsDir)
+	require.NoError(t, err)
+	require.NotNil(t, state)
+	assert.Equal(t, ScopeProject, state.Scope)
+	assert.Equal(t, testSkillsRef, state.Release)
+	assert.Len(t, state.Skills, 2)
+
+	assert.Contains(t, stderr.String(), "Installed 2 skills.")
+}
+
+func TestInstallProjectScopeCreatesSymlinks(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx := cmdio.MockDiscard(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+
+	projectDir := filepath.Join(tmp, "myproject")
+	require.NoError(t, os.MkdirAll(projectDir, 0o755))
+	t.Chdir(projectDir)
+
+	// Use os.Getwd() to match the path the installer sees (macOS may resolve symlinks).
+	cwd, err := os.Getwd()
+	require.NoError(t, err)
+
+	src := &mockManifestSource{manifest: testManifest()}
+	agent := testProjectAgent(tmp)
+
+	err = InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{Scope: ScopeProject})
+	require.NoError(t, err)
+
+	// Check that agent's project skills dir has relative symlinks.
+	agentSkillDir := filepath.Join(projectDir, ".test-project-agent", "skills")
+	for _, skill := range []string{"databricks-sql", "databricks-jobs"} {
+		link := filepath.Join(agentSkillDir, skill)
+		fi, err := os.Lstat(link)
+		require.NoError(t, err, "symlink should exist for %s", skill)
+		assert.NotEqual(t, os.FileMode(0), fi.Mode()&os.ModeSymlink, "should be a symlink for %s", skill)
+
+		target, err := os.Readlink(link)
+		require.NoError(t, err)
+		// Project scope should use relative symlinks for portability.
+		expectedRel := filepath.Join("..", "..", ".databricks", "aitools", "skills", skill)
+		assert.Equal(t, expectedRel, target)
+
+		// Verify the symlink resolves to a valid directory with the expected content.
+		resolved, err := filepath.EvalSymlinks(link)
+		require.NoError(t, err)
+		expectedResolved, err := filepath.EvalSymlinks(filepath.Join(cwd, ".databricks", "aitools", "skills", skill))
+		require.NoError(t, err)
+		assert.Equal(t, expectedResolved, resolved)
+	}
+}
+
+func TestInstallProjectScopeFiltersIncompatibleAgents(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+
+	projectDir := filepath.Join(tmp, "myproject")
+	require.NoError(t, os.MkdirAll(projectDir, 0o755))
+	t.Chdir(projectDir)
+
+	src := &mockManifestSource{manifest: testManifest()}
+
+	compatibleAgent := testProjectAgent(tmp)
+	incompatibleAgent := &agents.Agent{
+		Name:        "no-project-agent",
+		DisplayName: "No Project Agent",
+		ConfigDir: func(_ context.Context) (string, error) {
+			return filepath.Join(tmp, ".no-project-agent"), nil
+		},
+	}
+
+	err := InstallSkillsForAgents(ctx, src, []*agents.Agent{compatibleAgent, incompatibleAgent}, InstallOptions{Scope: ScopeProject})
+	require.NoError(t, err)
+
+	assert.Contains(t, stderr.String(), "Skipped No Project Agent: does not support project-scoped skills.")
+	assert.Contains(t, stderr.String(), "Installed 2 skills.")
+}
+
+func TestInstallProjectScopeZeroCompatibleAgentsReturnsError(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx := cmdio.MockDiscard(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+
+	projectDir := filepath.Join(tmp, "myproject")
+	require.NoError(t, os.MkdirAll(projectDir, 0o755))
+	t.Chdir(projectDir)
+
+	src := &mockManifestSource{manifest: testManifest()}
+
+	// Only provide agents that don't support project scope.
+	globalOnlyAgent := &agents.Agent{
+		Name:        "no-project-agent",
+		DisplayName: "No Project Agent",
+		ConfigDir: func(_ context.Context) (string, error) {
+			return filepath.Join(tmp, ".no-project-agent"), nil
+		},
+	}
+
+	err := InstallSkillsForAgents(ctx, src, []*agents.Agent{globalOnlyAgent}, InstallOptions{Scope: ScopeProject})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "no agents support project-scoped skills")
+	assert.Contains(t, err.Error(), "No Project Agent")
+}
+
+func TestInstallKeepsNameWhenRepoDirChanges(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx := cmdio.MockDiscard(t.Context())
+	agent := testAgent(tmp)
+	var fetchedFrom []string
+	orig := fetchFileFn
+	t.Cleanup(func() { fetchFileFn = orig })
+	fetchFileFn = func(_ context.Context, _, repoDir, skillName, filePath string) ([]byte, error) {
+		fetchedFrom = append(fetchedFrom, filepath.Join(repoDir, skillName, filePath))
+		return []byte("# " + skillName + "/" + filePath), nil
+	}
+
+	stableManifest := &Manifest{
+		Version: "1",
+		Skills: map[string]SkillMeta{
+			"databricks-jobs": {Version: "0.1.0", Files: []string{"SKILL.md"}},
+		},
+	}
+	require.NoError(t, InstallSkillsForAgents(
+		ctx, &mockManifestSource{manifest: stableManifest},
+		[]*agents.Agent{agent}, InstallOptions{},
+	))
+
+	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
+	require.DirExists(t, filepath.Join(globalDir, "databricks-jobs"))
+	assert.Contains(t, fetchedFrom, filepath.Join(stableSkillsRepoPath, "databricks-jobs", "SKILL.md"))
+	fetchedFrom = nil
+
+	experimentalManifest := &Manifest{
+		Version: "1",
+		Skills: map[string]SkillMeta{
+			"databricks-jobs": {Version: "0.1.0", Files: []string{"SKILL.md"}, RepoDir: experimentalRepoPath},
+		},
+	}
+	require.NoError(t, InstallSkillsForAgents(
+		ctx, &mockManifestSource{manifest: experimentalManifest},
+		[]*agents.Agent{agent}, InstallOptions{IncludeExperimental: true},
+	))
+
+	state, err := LoadState(globalDir)
+	require.NoError(t, err)
+	assert.Equal(t, "0.1.0", state.Skills["databricks-jobs"])
+	assert.Equal(t, experimentalRepoPath, state.RepoDirs["databricks-jobs"])
+	assert.DirExists(t, filepath.Join(globalDir, "databricks-jobs"))
+	assert.Contains(t, fetchedFrom, filepath.Join(experimentalRepoPath, "databricks-jobs", "SKILL.md"))
+}
+
+func TestSupportsProjectScopeSetCorrectly(t *testing.T) {
+	expected := map[string]bool{
+		"claude-code": true,
+		"cursor":      false,
+		"codex":       false,
+		"opencode":    false,
+		"copilot":     false,
+		"antigravity": false,
+		"pi":          true,
+		"gemini":      true,
+		"goose":       true,
+		"kiro":        true,
+	}
+
+	for _, agent := range agents.Registry {
+		want, ok := expected[agent.Name]
+		require.True(t, ok, "missing expected entry for %s", agent.Name)
+		assert.Equal(t, want, agent.SupportsProjectScope, "SupportsProjectScope for %s", agent.Name)
+	}
+}
+
+func TestGetSkillsRefDefaultsToLatest(t *testing.T) {
+	// cli-compat reports "latest", so we resolve it to the skills repo's
+	// latest release tag rather than tracking the default branch.
+	t.Setenv("DATABRICKS_SKILLS_REF", "")
+	withCachedCompat(t, skillsLatestSentinel)
+	stubLatestSkillsReleaseRef(t, "v0.2.8", nil)
+
+	ref, explicit, err := GetSkillsRef(t.Context())
+	require.NoError(t, err)
+	assert.Equal(t, "v0.2.8", ref)
+	assert.False(t, explicit, "tracking latest is not an explicit pin")
+}
+
+func TestGetSkillsRefDefaultManifest(t *testing.T) {
+	var m clicompat.Manifest
+	require.NoError(t, json.Unmarshal(build.CLICompatManifestJSON, &m))
+
+	// The table only records which CLI versions track latest. Pins come from
+	// the embedded manifest so routine skills bumps need no test changes.
+	tests := []struct {
+		version string
+		latest  bool
+	}{
+		{version: "0.299.2"},
+		{version: "1.0.0"},
+		{version: "1.19.9"},
+		{version: "1.20.0"},
+		{version: "1.21.0"},
+		{version: "1.21.9"},
+		{version: "1.22.0"},
+		{version: "1.23.0"},
+		{version: "0.0.0-dev+test"},
+	}
+	for _, tc := range tests {
+		entry, err := clicompat.Resolve(m, tc.version)
+		require.NoError(t, err)
+		pinnedRef := "v" + entry.AgentSkills
+
+		for _, offline := range []bool{false, true} {
+			t.Run(fmt.Sprintf("%s/offline=%t", tc.version, offline), func(t *testing.T) {
+				t.Setenv("DATABRICKS_SKILLS_REF", "")
+				setBuildVersion(t, tc.version)
+				cacheDir := t.TempDir()
+				t.Setenv("DATABRICKS_CACHE_DIR", cacheDir)
+				require.NoError(t, os.WriteFile(filepath.Join(cacheDir, "compat-manifest.json"), build.CLICompatManifestJSON, 0o600))
+				wantRef := pinnedRef
+				var latestErr error
+				if offline {
+					latestErr = errors.New("HTTP 403 fetching latest skills release")
+				}
+				switch {
+				case tc.latest && offline:
+					wantRef = ""
+				case tc.latest:
+					wantRef = "v9.9.9"
+				}
+				stubLatestSkillsReleaseRef(t, "v9.9.9", latestErr)
+
+				ref, explicit, err := GetSkillsRef(t.Context())
+				if tc.latest && offline {
+					require.ErrorIs(t, err, latestErr)
+				} else {
+					require.NoError(t, err)
+				}
+				assert.Equal(t, wantRef, ref)
+				assert.Equal(t, !tc.latest, explicit)
+			})
+		}
+	}
+}
+
+func TestGetSkillsRefLatestReleaseLookupFails(t *testing.T) {
+	setBuildVersion(t, "1.22.0")
+	t.Setenv("DATABRICKS_SKILLS_REF", "")
+	withCachedCompat(t, skillsLatestSentinel)
+	latestErr := errors.New("network down")
+	stubLatestSkillsReleaseRef(t, "", latestErr)
+
+	ref, explicit, err := GetSkillsRef(t.Context())
+	require.ErrorIs(t, err, latestErr)
+	assert.Empty(t, ref, "the embedded fallback is not the latest release")
+	assert.False(t, explicit)
+}
+
+func TestFetchSkillsManifestWithFallback(t *testing.T) {
+	const missingRef = "v9.9.9"
+	setBuildVersion(t, "1.22.0")
+	fallbackVersion, err := clicompat.ResolveEmbeddedAgentSkillsVersion()
+	require.NoError(t, err)
+	fallbackRef := "v" + fallbackVersion
+
+	tests := []struct {
+		name          string
+		status        int
+		allowFallback bool
+		wantRef       string
+		wantErr       bool
+	}{
+		{name: "latest manifest missing", status: http.StatusNotFound, allowFallback: true, wantRef: fallbackRef},
+		{name: "explicit pin missing", status: http.StatusNotFound, wantRef: missingRef, wantErr: true},
+		{name: "server error", status: http.StatusInternalServerError, allowFallback: true, wantRef: missingRef, wantErr: true},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			body, err := json.Marshal(testManifest())
+			require.NoError(t, err)
+			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if r.URL.Path != "/"+fallbackRef+"/manifest.json" {
+					w.WriteHeader(tc.status)
+					return
+				}
+				_, _ = w.Write(body)
+			}))
+			defer srv.Close()
+			t.Setenv("DATABRICKS_SKILLS_BASE_URL", srv.URL)
+
+			manifest, ref, err := FetchSkillsManifestWithFallback(
+				cmdio.MockDiscard(t.Context()), &GitHubManifestSource{}, missingRef, tc.allowFallback,
+			)
+			assert.Equal(t, tc.wantRef, ref)
+			if tc.wantErr {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, "1", manifest.Version)
+		})
+	}
+}
+
+func TestGetSkillsRefEnvEscapeHatch(t *testing.T) {
+	t.Setenv("DATABRICKS_SKILLS_REF", "v9.9.9")
+
+	ref, explicit, err := GetSkillsRef(t.Context())
+	require.NoError(t, err)
+	assert.Equal(t, "v9.9.9", ref)
+	assert.True(t, explicit, "an explicit ref is a pin")
+}
+
+func TestGetSkillsRefPinnedByCliCompat(t *testing.T) {
+	// cli-compat reports a concrete version: the remote safety valve pinning this
+	// CLI (e.g. after a future breaking change).
+	t.Setenv("DATABRICKS_SKILLS_REF", "")
+	withCachedCompat(t, "0.1.5")
+
+	ref, explicit, err := GetSkillsRef(t.Context())
+	require.NoError(t, err, "GetSkillsRef should succeed via cached manifest")
+	assert.Equal(t, "v0.1.5", ref)
+	assert.True(t, explicit, "a cli-compat pin is explicit")
+}
+
+func TestDisplaySkillsVersion(t *testing.T) {
+	assert.Equal(t, "0.2.5", DisplaySkillsVersion("v0.2.5"))
+	assert.Equal(t, "0.2.5", DisplaySkillsVersion("0.2.5"))
+	assert.Equal(t, "latest", DisplaySkillsVersion("latest"))
+}
+
+// withCachedCompat pre-populates the cli-compat cache so resolution is offline
+// and deterministic (a fresh local cache is tier 1, ahead of the network). A
+// single "0.0.0" entry matches every CLI version, including dev test builds.
+func withCachedCompat(t *testing.T, skills string) {
+	t.Helper()
+	cacheDir := t.TempDir()
+	t.Setenv("DATABRICKS_CACHE_DIR", cacheDir)
+	manifest := fmt.Sprintf(`{"0.0.0":{"appkit":"0.24.0","skills":%q}}`, skills)
+	require.NoError(t, os.WriteFile(filepath.Join(cacheDir, "compat-manifest.json"), []byte(manifest), 0o644))
+}
diff --git a/libs/aitools/installer/installer_windows_test.go b/libs/aitools/installer/installer_windows_test.go
new file mode 100644
index 00000000000..4b1528b851c
--- /dev/null
+++ b/libs/aitools/installer/installer_windows_test.go
@@ -0,0 +1,59 @@
+//go:build windows
+
+package installer
+
+import (
+	"os"
+	"path/filepath"
+	"syscall"
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestBackupThirdPartySkillWindowsNotSameDeviceFallback(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	tmp := t.TempDir()
+	skillName := "databricks-windows-cross-device"
+
+	cleanupBackups := func() {
+		matches, _ := filepath.Glob(filepath.Join(os.TempDir(), "databricks-skill-backup-"+skillName+"-*"))
+		for _, match := range matches {
+			_ = os.RemoveAll(match)
+		}
+	}
+	cleanupBackups()
+	t.Cleanup(cleanupBackups)
+
+	destDir := filepath.Join(tmp, "agent", "skills", skillName)
+	require.NoError(t, os.MkdirAll(destDir, 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(destDir, "custom.md"), []byte("custom"), 0o644))
+
+	orig := renamePathFn
+	t.Cleanup(func() { renamePathFn = orig })
+	renameCalled := false
+	renamePathFn = func(oldpath, newpath string) error {
+		if oldpath == destDir {
+			renameCalled = true
+			return &os.LinkError{Op: "rename", Old: oldpath, New: newpath, Err: syscall.Errno(17)}
+		}
+		return os.Rename(oldpath, newpath)
+	}
+
+	err := backupThirdPartySkill(ctx, destDir, "/some/canonical", skillName, "Test Agent")
+	require.NoError(t, err)
+	assert.True(t, renameCalled)
+
+	_, err = os.Stat(destDir)
+	assert.ErrorIs(t, err, os.ErrNotExist)
+
+	matches, err := filepath.Glob(filepath.Join(os.TempDir(), "databricks-skill-backup-"+skillName+"-*", skillName, "custom.md"))
+	require.NoError(t, err)
+	require.Len(t, matches, 1)
+
+	content, err := os.ReadFile(matches[0])
+	require.NoError(t, err)
+	assert.Equal(t, "custom", string(content))
+}
diff --git a/libs/aitools/installer/plugin.go b/libs/aitools/installer/plugin.go
new file mode 100644
index 00000000000..12081a171c0
--- /dev/null
+++ b/libs/aitools/installer/plugin.go
@@ -0,0 +1,380 @@
+package installer
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"maps"
+	"os/exec"
+	"strings"
+	"time"
+
+	"github.com/databricks/cli/libs/aitools/agents"
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/process"
+)
+
+// lookPath resolves a binary on PATH. It is a package-level var so tests can
+// inject a fake resolver without depending on the host PATH.
+var lookPath = exec.LookPath
+
+const (
+	// pluginProbeTimeout bounds the `<agent> plugin --help` capability check.
+	pluginProbeTimeout = 5 * time.Second
+	// pluginCmdTimeout bounds an install/update/uninstall command, which may
+	// clone the marketplace repo, so it gets more headroom than the probe.
+	pluginCmdTimeout = 60 * time.Second
+)
+
+// BlockedError reports that a plugin operation could not be performed for an
+// agent. The command layer maps Reason to a user-facing message and decides
+// whether to skip-with-warning or hard-fail (per the non-TTY policy). It never
+// causes a silent fall back to skills.
+type BlockedError struct {
+	Agent  string
+	Reason string
+	Detail string
+}
+
+// Reasons a plugin operation can be blocked.
+const (
+	// ReasonCLINotOnPath: the agent's CLI binary is not on PATH, or its CLI does
+	// not expose a working `plugin` subcommand.
+	ReasonCLINotOnPath = "cli-not-on-path"
+	// ReasonInstallFailed: the agent's plugin CLI ran but returned an error.
+	ReasonInstallFailed = "install-failed"
+	// ReasonNoPlugin: the agent has no installable plugin. Callers filter these
+	// out; it is guarded here to avoid a nil dereference.
+	ReasonNoPlugin = "no-plugin"
+)
+
+func (e *BlockedError) Error() string {
+	if e.Detail != "" {
+		return fmt.Sprintf("%s: %s: %s", e.Agent, e.Reason, e.Detail)
+	}
+	return fmt.Sprintf("%s: %s", e.Agent, e.Reason)
+}
+
+// runAgentCmd runs an agent CLI command with a timeout, returning stdout and any
+// error. Errors are *process.ProcessError, which carries the captured stderr.
+func runAgentCmd(ctx context.Context, timeout time.Duration, argv []string) (string, error) {
+	cctx, cancel := context.WithTimeout(ctx, timeout)
+	defer cancel()
+	return process.Background(cctx, argv)
+}
+
+// stderrOf returns the captured stderr of a failed agent command, falling back
+// to the error's own message. Callers must not branch on this string.
+func stderrOf(err error) string {
+	if perr, ok := errors.AsType[*process.ProcessError](err); ok {
+		if s := strings.TrimSpace(perr.Stderr); s != "" {
+			return s
+		}
+	}
+	return err.Error()
+}
+
+// resolveAgentBinary resolves the agent's CLI binary to an absolute path.
+// It refuses a binary that resolves only relative to the current directory
+// (exec.ErrDot), so a malicious ./claude is never executed.
+func resolveAgentBinary(agent *agents.Agent) (string, error) {
+	if agent.Binary == "" {
+		return "", fmt.Errorf("%s has no CLI binary", agent.DisplayName)
+	}
+	path, err := lookPath(agent.Binary)
+	if err != nil {
+		return "", fmt.Errorf("could not resolve %s on PATH: %w", agent.Binary, err)
+	}
+	return path, nil
+}
+
+// installTarget is the `<plugin>@<marketplace>` argument the agent CLIs accept,
+// e.g. "databricks@databricks-agent-skills".
+func installTarget(spec *agents.PluginSpec) string {
+	return spec.ID + "@" + spec.Marketplace
+}
+
+func recordedInstallTarget(agent *agents.Agent, rec PluginRecord) string {
+	plugin := rec.Plugin
+	if plugin == "" {
+		plugin = agent.Plugin.ID
+	}
+	marketplace := rec.Marketplace
+	if marketplace == "" {
+		marketplace = agent.Plugin.Marketplace
+	}
+	return plugin + "@" + marketplace
+}
+
+// marketplaceAddArgs builds the `plugin marketplace add <source>` argv (sans binary).
+func marketplaceAddArgs(spec *agents.PluginSpec) []string {
+	return []string{"plugin", "marketplace", "add", spec.Source}
+}
+
+// marketplaceRegistered reports whether the named marketplace is already listed
+// by the agent's plugin CLI. On any uncertainty (command unsupported, error) it
+// returns true, so we never claim to have added a marketplace we didn't, which
+// keeps uninstall from de-registering a marketplace another plugin may share.
+// The `plugin marketplace list` output shape is pending per-agent verification;
+// until then the conservative default applies.
+func marketplaceRegistered(ctx context.Context, bin, marketplace string) bool {
+	out, err := runAgentCmd(ctx, pluginProbeTimeout, []string{bin, "plugin", "marketplace", "list"})
+	if err != nil {
+		return true
+	}
+	return strings.Contains(out, marketplace)
+}
+
+// marketplaceRemoveArgs builds the `plugin marketplace remove <name>` argv (sans binary).
+func marketplaceRemoveArgs(spec *agents.PluginSpec) []string {
+	return []string{"plugin", "marketplace", "remove", spec.Marketplace}
+}
+
+func marketplaceRemoveArgsForRecord(agent *agents.Agent, rec PluginRecord) []string {
+	marketplace := rec.Marketplace
+	if marketplace == "" {
+		marketplace = agent.Plugin.Marketplace
+	}
+	return []string{"plugin", "marketplace", "remove", marketplace}
+}
+
+// marketplaceUpdateArgs builds the marketplace refresh command for agents whose
+// plugin CLI supports it. Claude's official marketplace can be stale locally,
+// causing install/update to report that a published plugin does not exist.
+func marketplaceUpdateArgs(agent *agents.Agent) []string {
+	if agent.Name == agents.NameClaudeCode {
+		return []string{"plugin", "marketplace", "update"}
+	}
+	return nil
+}
+
+// pluginInstallArgs builds the per-agent install argv (sans binary). Codex uses
+// `plugin add`; Claude is the only agent that accepts `--scope`.
+func pluginInstallArgs(agent *agents.Agent, scope string) []string {
+	target := installTarget(agent.Plugin)
+	switch agent.Name {
+	case agents.NameCodex:
+		return []string{"plugin", "add", target}
+	case agents.NameClaudeCode:
+		args := []string{"plugin", "install", target}
+		if scope != "" {
+			args = append(args, "--scope", scope)
+		}
+		return args
+	default:
+		return []string{"plugin", "install", target}
+	}
+}
+
+// pluginUpdateSteps builds the ordered per-agent update argv sets (sans binary).
+// Codex updates in two steps: refresh the marketplace, then re-add.
+func pluginUpdateSteps(agent *agents.Agent, rec PluginRecord) [][]string {
+	target := recordedInstallTarget(agent, rec)
+	switch agent.Name {
+	case agents.NameCodex:
+		return [][]string{
+			{"plugin", "marketplace", "upgrade"},
+			{"plugin", "add", target},
+		}
+	case agents.NameClaudeCode:
+		return [][]string{
+			marketplaceUpdateArgs(agent),
+			appendScopeArg([]string{"plugin", "update", target}, rec.Scope),
+		}
+	default:
+		return [][]string{{"plugin", "update", target}}
+	}
+}
+
+// pluginUninstallArgs builds the per-agent uninstall argv (sans binary).
+// Codex removes with `plugin remove`; the others use `plugin uninstall`.
+func pluginUninstallArgs(agent *agents.Agent, rec PluginRecord) []string {
+	target := recordedInstallTarget(agent, rec)
+	switch agent.Name {
+	case agents.NameCodex:
+		return []string{"plugin", "remove", target}
+	case agents.NameClaudeCode:
+		return appendScopeArg([]string{"plugin", "uninstall", target}, rec.Scope)
+	default:
+		return []string{"plugin", "uninstall", target}
+	}
+}
+
+func pluginDisableArgs(agent *agents.Agent, rec PluginRecord) []string {
+	if agent.Name != agents.NameClaudeCode {
+		return nil
+	}
+	return appendScopeArg([]string{"plugin", "disable", recordedInstallTarget(agent, rec)}, rec.Scope)
+}
+
+func appendScopeArg(args []string, scope string) []string {
+	if scope == "" {
+		return args
+	}
+	return append(args, "--scope", scope)
+}
+
+// probePluginCLI resolves the agent's binary and confirms its CLI exposes the
+// plugin subcommand, so we don't register a marketplace on a CLI that can't
+// install plugins. Returns the resolved absolute path.
+func probePluginCLI(ctx context.Context, agent *agents.Agent) (string, error) {
+	bin, err := resolveAgentBinary(agent)
+	if err != nil {
+		return "", &BlockedError{Agent: agent.Name, Reason: ReasonCLINotOnPath, Detail: err.Error()}
+	}
+	if _, err := runAgentCmd(ctx, pluginProbeTimeout, []string{bin, "plugin", "--help"}); err != nil {
+		return "", &BlockedError{Agent: agent.Name, Reason: ReasonCLINotOnPath, Detail: stderrOf(err)}
+	}
+	return bin, nil
+}
+
+// InstallPluginForAgent registers the databricks marketplace and installs the
+// plugin through the agent's own CLI, returning the record to persist in state.
+// It never falls back to skills: a blocked install returns a *BlockedError.
+func InstallPluginForAgent(ctx context.Context, agent *agents.Agent, nativeScope, ref string) (PluginRecord, error) {
+	if agent.Plugin == nil {
+		return PluginRecord{}, &BlockedError{Agent: agent.Name, Reason: ReasonNoPlugin}
+	}
+
+	bin, err := probePluginCLI(ctx, agent)
+	if err != nil {
+		return PluginRecord{}, err
+	}
+
+	// Register the marketplace. We only record InstalledMarketplace (and thus
+	// later de-register on uninstall) when the marketplace was absent before and
+	// our add succeeded, so we never remove a marketplace another plugin shares.
+	// On any uncertainty marketplaceRegistered returns true, keeping us off the
+	// de-register path.
+	installedMarketplace := false
+	if agent.Plugin.Source != "" {
+		alreadyPresent := marketplaceRegistered(ctx, bin, agent.Plugin.Marketplace)
+		_, addErr := runAgentCmd(ctx, pluginCmdTimeout, prepend(bin, marketplaceAddArgs(agent.Plugin)))
+		installedMarketplace = addErr == nil && !alreadyPresent
+	}
+	if args := marketplaceUpdateArgs(agent); args != nil {
+		if _, err := runAgentCmd(ctx, pluginCmdTimeout, prepend(bin, args)); err != nil {
+			if installedMarketplace {
+				if _, rmErr := runAgentCmd(ctx, pluginCmdTimeout, prepend(bin, marketplaceRemoveArgs(agent.Plugin))); rmErr != nil {
+					log.Warnf(ctx, "%s plugin marketplace refresh failed and the marketplace could not be de-registered: %v", agent.DisplayName, rmErr)
+				}
+			}
+			return PluginRecord{}, &BlockedError{Agent: agent.Name, Reason: ReasonInstallFailed, Detail: stderrOf(err)}
+		}
+	}
+
+	if _, err := runAgentCmd(ctx, pluginCmdTimeout, prepend(bin, pluginInstallArgs(agent, nativeScope))); err != nil {
+		// Roll back a marketplace we just added so a failed install doesn't
+		// leave an orphaned, untracked marketplace registration behind.
+		if installedMarketplace {
+			if _, rmErr := runAgentCmd(ctx, pluginCmdTimeout, prepend(bin, marketplaceRemoveArgs(agent.Plugin))); rmErr != nil {
+				log.Warnf(ctx, "%s plugin install failed and the marketplace could not be de-registered: %v", agent.DisplayName, rmErr)
+			}
+		}
+		return PluginRecord{}, &BlockedError{Agent: agent.Name, Reason: ReasonInstallFailed, Detail: stderrOf(err)}
+	}
+
+	return PluginRecord{
+		Marketplace:          agent.Plugin.Marketplace,
+		Plugin:               agent.Plugin.ID,
+		Scope:                nativeScope,
+		Version:              DisplaySkillsVersion(ref),
+		InstalledMarketplace: installedMarketplace,
+	}, nil
+}
+
+// UpdatePluginForAgent updates the plugin through the agent's own CLI. The
+// plugin's own update handles content the release dropped, so there is no
+// per-skill prune for plugin agents.
+func UpdatePluginForAgent(ctx context.Context, agent *agents.Agent, rec PluginRecord) error {
+	if agent.Plugin == nil {
+		return &BlockedError{Agent: agent.Name, Reason: ReasonNoPlugin}
+	}
+	bin, err := resolveAgentBinary(agent)
+	if err != nil {
+		return &BlockedError{Agent: agent.Name, Reason: ReasonCLINotOnPath, Detail: err.Error()}
+	}
+	for _, args := range pluginUpdateSteps(agent, rec) {
+		if _, err := runAgentCmd(ctx, pluginCmdTimeout, prepend(bin, args)); err != nil {
+			return &BlockedError{Agent: agent.Name, Reason: ReasonInstallFailed, Detail: stderrOf(err)}
+		}
+	}
+	return nil
+}
+
+// UninstallPluginForAgent removes the plugin through the agent's own CLI, and
+// de-registers the marketplace only when this CLI registered it and the caller
+// did not ask to keep it. It never removes a marketplace another plugin shares.
+//
+// A returned error means the plugin itself could not be removed, so the caller
+// should keep its state record. Once the plugin is removed, a failure to
+// de-register the marketplace is only warned about (not returned): the plugin is
+// gone, so the record is cleared, and the leftover marketplace registration is
+// harmless and can be removed manually.
+func UninstallPluginForAgent(ctx context.Context, agent *agents.Agent, rec PluginRecord, keepMarketplace bool) error {
+	if agent.Plugin == nil {
+		return &BlockedError{Agent: agent.Name, Reason: ReasonNoPlugin}
+	}
+	bin, err := resolveAgentBinary(agent)
+	if err != nil {
+		return &BlockedError{Agent: agent.Name, Reason: ReasonCLINotOnPath, Detail: err.Error()}
+	}
+	if args := pluginDisableArgs(agent, rec); args != nil {
+		if _, err := runAgentCmd(ctx, pluginCmdTimeout, prepend(bin, args)); err != nil && !claudeAlreadyDisabled(err) {
+			return &BlockedError{Agent: agent.Name, Reason: ReasonInstallFailed, Detail: stderrOf(err)}
+		}
+	}
+	if _, err := runAgentCmd(ctx, pluginCmdTimeout, prepend(bin, pluginUninstallArgs(agent, rec))); err != nil {
+		return &BlockedError{Agent: agent.Name, Reason: ReasonInstallFailed, Detail: stderrOf(err)}
+	}
+	// Never de-register a Shared marketplace, it is shared infrastructure we don't own
+	if rec.InstalledMarketplace && !keepMarketplace && !agent.Plugin.Shared {
+		if _, err := runAgentCmd(ctx, pluginCmdTimeout, prepend(bin, marketplaceRemoveArgsForRecord(agent, rec))); err != nil {
+			log.Warnf(ctx, "Removed the %s plugin but could not de-register its marketplace (remove it manually if needed): %v", agent.DisplayName, stderrOf(err))
+		}
+	}
+	return nil
+}
+
+func claudeAlreadyDisabled(err error) bool {
+	return strings.Contains(strings.ToLower(stderrOf(err)), "already disabled")
+}
+
+// RecordPluginInstalls persists plugin install records into the state file for
+// the given CLI scope (global or project), creating state if none exists. ref
+// is the resolved skills release the install corresponds to.
+func RecordPluginInstalls(ctx context.Context, cliScope string, records map[string]PluginRecord, ref string) error {
+	dir, err := skillsDir(ctx, cliScope)
+	if err != nil {
+		return err
+	}
+	state, err := LoadState(dir)
+	if err != nil {
+		return err
+	}
+	if state == nil {
+		// Initialize all maps so a later skills install/update can assign into a
+		// plugin-only state without hitting a nil map.
+		state = &InstallState{
+			SchemaVersion: schemaVersionV2,
+			Skills:        map[string]string{},
+			RepoDirs:      map[string]string{},
+			Files:         map[string]FileRecord{},
+		}
+	}
+	if state.Plugins == nil {
+		state.Plugins = make(map[string]PluginRecord, len(records))
+	}
+	maps.Copy(state.Plugins, records)
+	state.Release = ref
+	state.LastUpdated = time.Now()
+	state.Scope = cliScope
+	return SaveState(dir, state)
+}
+
+// prepend returns a fresh argv with bin as argv[0] followed by args.
+func prepend(bin string, args []string) []string {
+	argv := make([]string, 0, len(args)+1)
+	argv = append(argv, bin)
+	return append(argv, args...)
+}
diff --git a/libs/aitools/installer/plugin_test.go b/libs/aitools/installer/plugin_test.go
new file mode 100644
index 00000000000..4b536e0e187
--- /dev/null
+++ b/libs/aitools/installer/plugin_test.go
@@ -0,0 +1,528 @@
+package installer
+
+import (
+	"errors"
+	"os/exec"
+	"path/filepath"
+	"testing"
+
+	"github.com/databricks/cli/libs/aitools/agents"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/process"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func stubAgentLookPath(t *testing.T, found bool) {
+	t.Helper()
+	orig := lookPath
+	lookPath = func(name string) (string, error) {
+		if found {
+			return filepath.Join("/usr/bin", name), nil
+		}
+		return "", exec.ErrNotFound
+	}
+	t.Cleanup(func() { lookPath = orig })
+}
+
+func pluginAgent(name, display, binary string) *agents.Agent {
+	return &agents.Agent{
+		Name:        name,
+		DisplayName: display,
+		Binary:      binary,
+		Plugin: &agents.PluginSpec{
+			Marketplace: "databricks-agent-skills",
+			ID:          "databricks",
+			Source:      "databricks/databricks-agent-skills",
+		},
+	}
+}
+
+func claudeAgent() *agents.Agent { return pluginAgent(agents.NameClaudeCode, "Claude Code", "claude") }
+func codexAgent() *agents.Agent  { return pluginAgent(agents.NameCodex, "Codex CLI", "codex") }
+
+func noPluginAgent() *agents.Agent {
+	return &agents.Agent{Name: agents.NameOpenCode, DisplayName: "OpenCode", Binary: "opencode"}
+}
+
+func TestInstallPluginForAgentClaudeSuccess(t *testing.T) {
+	stubAgentLookPath(t, true)
+	ctx, stub := process.WithStub(t.Context())
+	stub.WithCallback(func(*exec.Cmd) error { return nil })
+
+	rec, err := InstallPluginForAgent(ctx, claudeAgent(), "user", "v0.2.6")
+	require.NoError(t, err)
+	assert.Equal(t, "databricks-agent-skills", rec.Marketplace)
+	assert.Equal(t, "databricks", rec.Plugin)
+	assert.Equal(t, "user", rec.Scope)
+	assert.Equal(t, "0.2.6", rec.Version)
+	assert.True(t, rec.InstalledMarketplace)
+
+	cmds := stub.Commands()
+	assert.Contains(t, cmds, "claude plugin --help")
+	assert.Contains(t, cmds, "claude plugin marketplace add databricks/databricks-agent-skills")
+	assert.Contains(t, cmds, "claude plugin marketplace update")
+	assert.Contains(t, cmds, "claude plugin install databricks@databricks-agent-skills --scope user")
+}
+
+func TestInstallPluginForAgentSharedMarketplace(t *testing.T) {
+	stubAgentLookPath(t, true)
+	ctx, stub := process.WithStub(t.Context())
+	stub.WithCallback(func(*exec.Cmd) error { return nil })
+
+	// Claude installs from its official, Shared marketplace (claude-plugins-official).
+	// It is not reliably registered locally, so the CLI must add it from its source
+	// before refreshing and installing. Use the real registry spec.
+	agent := agents.ByName(agents.NameClaudeCode)
+
+	rec, err := InstallPluginForAgent(ctx, agent, "user", "main")
+	require.NoError(t, err)
+	assert.Equal(t, "claude-plugins-official", rec.Marketplace)
+	assert.True(t, rec.InstalledMarketplace, "an absent shared marketplace is added by us")
+
+	cmds := stub.Commands()
+	assert.Contains(t, cmds, "claude plugin marketplace add anthropics/claude-plugins-official")
+	assert.Contains(t, cmds, "claude plugin marketplace update")
+	assert.Contains(t, cmds, "claude plugin install databricks@claude-plugins-official --scope user")
+}
+
+func TestInstallPluginForAgentCodexUsesAddNoScope(t *testing.T) {
+	stubAgentLookPath(t, true)
+	ctx, stub := process.WithStub(t.Context())
+	stub.WithCallback(func(*exec.Cmd) error { return nil })
+
+	_, err := InstallPluginForAgent(ctx, codexAgent(), "user", "v0.2.6")
+	require.NoError(t, err)
+
+	cmds := stub.Commands()
+	assert.Contains(t, cmds, "codex plugin add databricks@databricks-agent-skills")
+	for _, c := range cmds {
+		assert.NotContains(t, c, "--scope")
+	}
+}
+
+func TestInstallPluginForAgentNoPlugin(t *testing.T) {
+	_, err := InstallPluginForAgent(t.Context(), noPluginAgent(), "user", "v0.2.6")
+	var be *BlockedError
+	require.ErrorAs(t, err, &be)
+	assert.Equal(t, ReasonNoPlugin, be.Reason)
+}
+
+func TestInstallPluginForAgentCLINotOnPath(t *testing.T) {
+	stubAgentLookPath(t, false)
+	ctx, stub := process.WithStub(t.Context())
+
+	_, err := InstallPluginForAgent(ctx, claudeAgent(), "user", "v0.2.6")
+	var be *BlockedError
+	require.ErrorAs(t, err, &be)
+	assert.Equal(t, ReasonCLINotOnPath, be.Reason)
+	assert.Equal(t, 0, stub.Len(), "a missing CLI must not be executed")
+}
+
+func TestInstallPluginForAgentInstallFails(t *testing.T) {
+	stubAgentLookPath(t, true)
+	ctx, stub := process.WithStub(t.Context())
+	stub.WithCallback(func(*exec.Cmd) error { return nil })
+	stub.WithStderrFor("claude plugin install", "you must run `copilot login`").
+		WithFailureFor("claude plugin install", errors.New("exit status 1"))
+
+	_, err := InstallPluginForAgent(ctx, claudeAgent(), "user", "v0.2.6")
+	var be *BlockedError
+	require.ErrorAs(t, err, &be)
+	assert.Equal(t, ReasonInstallFailed, be.Reason)
+	// The agent's own stderr is surfaced verbatim, not classified by us.
+	assert.Equal(t, "you must run `copilot login`", be.Detail)
+}
+
+func TestInstallPluginForAgentMarketplaceAlreadyPresent(t *testing.T) {
+	stubAgentLookPath(t, true)
+	ctx, stub := process.WithStub(t.Context())
+	stub.WithCallback(func(*exec.Cmd) error { return nil })
+	// The marketplace is already registered, so even though `add` succeeds we must
+	// not claim ownership (and must not de-register it on uninstall).
+	stub.WithStdoutFor("plugin marketplace list", "databricks-agent-skills\n")
+
+	rec, err := InstallPluginForAgent(ctx, claudeAgent(), "user", "v0.2.6")
+	require.NoError(t, err)
+	assert.False(t, rec.InstalledMarketplace, "a pre-existing marketplace must not be recorded as ours")
+}
+
+func TestInstallPluginRollsBackMarketplaceOnInstallFailure(t *testing.T) {
+	stubAgentLookPath(t, true)
+	ctx, stub := process.WithStub(t.Context())
+	stub.WithCallback(func(*exec.Cmd) error { return nil })
+	// Marketplace absent (empty list) so we add it; then the plugin install fails.
+	stub.WithFailureFor("plugin install", errors.New("boom"))
+
+	_, err := InstallPluginForAgent(ctx, claudeAgent(), "user", "v0.2.6")
+	var be *BlockedError
+	require.ErrorAs(t, err, &be)
+	assert.Equal(t, ReasonInstallFailed, be.Reason)
+	// We added the marketplace, so a failed install must de-register it again.
+	assert.Contains(t, stub.Commands(), "claude plugin marketplace remove databricks-agent-skills")
+}
+
+func TestInstallPluginRollsBackMarketplaceOnRefreshFailure(t *testing.T) {
+	stubAgentLookPath(t, true)
+	ctx, stub := process.WithStub(t.Context())
+	stub.WithCallback(func(*exec.Cmd) error { return nil })
+	// Marketplace absent (empty list) so we add it; then the refresh fails.
+	stub.WithFailureFor("plugin marketplace update", errors.New("boom"))
+
+	_, err := InstallPluginForAgent(ctx, claudeAgent(), "user", "v0.2.6")
+	var be *BlockedError
+	require.ErrorAs(t, err, &be)
+	assert.Equal(t, ReasonInstallFailed, be.Reason)
+	// We added the marketplace, so a failed refresh must de-register it again.
+	assert.Contains(t, stub.Commands(), "claude plugin marketplace remove databricks-agent-skills")
+}
+
+func TestUpdatePluginForAgentCodexTwoStep(t *testing.T) {
+	stubAgentLookPath(t, true)
+	ctx, stub := process.WithStub(t.Context())
+	stub.WithCallback(func(*exec.Cmd) error { return nil })
+
+	require.NoError(t, UpdatePluginForAgent(ctx, codexAgent(), PluginRecord{Marketplace: "databricks-agent-skills", Plugin: "databricks", Scope: "user"}))
+	cmds := stub.Commands()
+	assert.Contains(t, cmds, "codex plugin marketplace upgrade")
+	assert.Contains(t, cmds, "codex plugin add databricks@databricks-agent-skills")
+}
+
+func TestUpdatePluginForAgentClaudeOneStep(t *testing.T) {
+	stubAgentLookPath(t, true)
+	ctx, stub := process.WithStub(t.Context())
+	stub.WithCallback(func(*exec.Cmd) error { return nil })
+
+	require.NoError(t, UpdatePluginForAgent(ctx, claudeAgent(), PluginRecord{Marketplace: "databricks-agent-skills", Plugin: "databricks", Scope: "user"}))
+	cmds := stub.Commands()
+	assert.Contains(t, cmds, "claude plugin marketplace update")
+	assert.Contains(t, cmds, "claude plugin update databricks@databricks-agent-skills --scope user")
+}
+
+func TestUninstallPluginClaudeAlreadyDisabledContinues(t *testing.T) {
+	stubAgentLookPath(t, true)
+	ctx, stub := process.WithStub(t.Context())
+	stub.WithCallback(func(*exec.Cmd) error { return nil })
+	stub.WithStderrFor("plugin disable", "Plugin databricks is already disabled in user scope").
+		WithFailureFor("plugin disable", errors.New("exit status 1"))
+
+	rec := PluginRecord{Marketplace: "databricks-agent-skills", Plugin: "databricks", Scope: "user"}
+	require.NoError(t, UninstallPluginForAgent(ctx, claudeAgent(), rec, false))
+
+	cmds := stub.Commands()
+	assert.Contains(t, cmds, "claude plugin disable databricks@databricks-agent-skills --scope user")
+	assert.Contains(t, cmds, "claude plugin uninstall databricks@databricks-agent-skills --scope user")
+}
+
+func TestUninstallPluginDeregistersMarketplaceWhenInstalledByUs(t *testing.T) {
+	stubAgentLookPath(t, true)
+	ctx, stub := process.WithStub(t.Context())
+	stub.WithCallback(func(*exec.Cmd) error { return nil })
+
+	rec := PluginRecord{Marketplace: "databricks-agent-skills", Plugin: "databricks", InstalledMarketplace: true}
+	require.NoError(t, UninstallPluginForAgent(ctx, claudeAgent(), rec, false))
+
+	cmds := stub.Commands()
+	assert.Contains(t, cmds, "claude plugin uninstall databricks@databricks-agent-skills")
+	assert.Contains(t, cmds, "claude plugin marketplace remove databricks-agent-skills")
+}
+
+func TestUninstallPluginKeepsSharedMarketplace(t *testing.T) {
+	stubAgentLookPath(t, true)
+	ctx, stub := process.WithStub(t.Context())
+	stub.WithCallback(func(*exec.Cmd) error { return nil })
+
+	rec := PluginRecord{Marketplace: "databricks-agent-skills", Plugin: "databricks", InstalledMarketplace: false}
+	require.NoError(t, UninstallPluginForAgent(ctx, claudeAgent(), rec, false))
+
+	for _, c := range stub.Commands() {
+		assert.NotContains(t, c, "marketplace remove")
+	}
+}
+
+func TestUninstallSkillsOptsTearsDownPlugin(t *testing.T) {
+	setupTestHome(t)
+	stubAgentLookPath(t, true)
+	ctx, stub := process.WithStub(t.Context())
+	stub.WithCallback(func(*exec.Cmd) error { return nil })
+	ctx, stderr := cmdio.NewTestContextWithStderr(ctx)
+
+	dir, err := GlobalSkillsDir(ctx)
+	require.NoError(t, err)
+	require.NoError(t, SaveState(dir, &InstallState{
+		SchemaVersion: schemaVersionV2,
+		Release:       "v0.2.6",
+		Plugins: map[string]PluginRecord{
+			agents.NameCopilot: {Marketplace: "databricks-agent-skills", Plugin: "databricks", Scope: "user", InstalledMarketplace: true},
+		},
+	}))
+
+	require.NoError(t, UninstallSkillsOpts(ctx, UninstallOptions{Scope: ScopeGlobal}))
+
+	cmds := stub.Commands()
+	assert.Contains(t, cmds, "copilot plugin uninstall databricks@databricks-agent-skills")
+	assert.Contains(t, cmds, "copilot plugin marketplace remove databricks-agent-skills")
+	assert.Contains(t, stderr.String(), "Uninstalled the plugin from 1 agent.")
+
+	// State file removed since nothing remains.
+	state, err := LoadState(dir)
+	require.NoError(t, err)
+	assert.Nil(t, state)
+}
+
+func TestUninstallSkillsOptsTargetsPluginAgents(t *testing.T) {
+	setupTestHome(t)
+	stubAgentLookPath(t, true)
+	ctx, stub := process.WithStub(t.Context())
+	stub.WithCallback(func(*exec.Cmd) error { return nil })
+	ctx = cmdio.MockDiscard(ctx)
+
+	dir, err := GlobalSkillsDir(ctx)
+	require.NoError(t, err)
+	require.NoError(t, SaveState(dir, &InstallState{
+		SchemaVersion: schemaVersionV2,
+		Release:       "v0.2.6",
+		Plugins: map[string]PluginRecord{
+			agents.NameClaudeCode: {Marketplace: "claude-plugins-official", Plugin: "databricks", Scope: "user"},
+			agents.NameCopilot:    {Marketplace: "databricks-agent-skills", Plugin: "databricks", Scope: "user"},
+		},
+	}))
+
+	require.NoError(t, UninstallSkillsOpts(ctx, UninstallOptions{Scope: ScopeGlobal, Agents: []string{agents.NameClaudeCode}}))
+
+	cmds := stub.Commands()
+	assert.Contains(t, cmds, "claude plugin uninstall databricks@claude-plugins-official --scope user")
+	for _, cmd := range cmds {
+		assert.NotContains(t, cmd, "copilot plugin uninstall")
+	}
+
+	state, err := LoadState(dir)
+	require.NoError(t, err)
+	require.NotNil(t, state)
+	assert.NotContains(t, state.Plugins, agents.NameClaudeCode)
+	assert.Contains(t, state.Plugins, agents.NameCopilot)
+}
+
+func TestUninstallNeverDeregistersSharedMarketplace(t *testing.T) {
+	setupTestHome(t)
+	stubAgentLookPath(t, true)
+	ctx, stub := process.WithStub(t.Context())
+	stub.WithCallback(func(*exec.Cmd) error { return nil })
+	ctx, stderr := cmdio.NewTestContextWithStderr(ctx)
+
+	dir, err := GlobalSkillsDir(ctx)
+	require.NoError(t, err)
+	// Claude's claude-plugins-official is a Shared marketplace; even a stale
+	// InstalledMarketplace=true must never trigger a de-register.
+	require.NoError(t, SaveState(dir, &InstallState{
+		SchemaVersion: schemaVersionV2,
+		Plugins: map[string]PluginRecord{
+			agents.NameClaudeCode: {Marketplace: "claude-plugins-official", Plugin: "databricks", InstalledMarketplace: true},
+		},
+	}))
+
+	require.NoError(t, UninstallSkillsOpts(ctx, UninstallOptions{Scope: ScopeGlobal}))
+
+	cmds := stub.Commands()
+	assert.Contains(t, cmds, "claude plugin uninstall databricks@claude-plugins-official")
+	for _, c := range cmds {
+		assert.NotContains(t, c, "marketplace remove")
+	}
+	// The message must not claim to have removed the shared marketplace.
+	assert.Contains(t, stderr.String(), "removed databricks plugin")
+	assert.NotContains(t, stderr.String(), "+ marketplace")
+}
+
+func TestUninstallKeepMarketplace(t *testing.T) {
+	setupTestHome(t)
+	stubAgentLookPath(t, true)
+	ctx, stub := process.WithStub(t.Context())
+	stub.WithCallback(func(*exec.Cmd) error { return nil })
+	ctx = cmdio.MockDiscard(ctx)
+
+	dir, err := GlobalSkillsDir(ctx)
+	require.NoError(t, err)
+	require.NoError(t, SaveState(dir, &InstallState{
+		SchemaVersion: schemaVersionV2,
+		Plugins: map[string]PluginRecord{
+			agents.NameCopilot: {Marketplace: "databricks-agent-skills", Plugin: "databricks", InstalledMarketplace: true},
+		},
+	}))
+
+	require.NoError(t, UninstallSkillsOpts(ctx, UninstallOptions{Scope: ScopeGlobal, KeepMarketplace: true}))
+
+	for _, c := range stub.Commands() {
+		assert.NotContains(t, c, "marketplace remove")
+	}
+}
+
+func TestUninstallKeepsUnknownAgentRecord(t *testing.T) {
+	setupTestHome(t)
+	ctx := cmdio.MockDiscard(t.Context())
+
+	dir, err := GlobalSkillsDir(ctx)
+	require.NoError(t, err)
+	require.NoError(t, SaveState(dir, &InstallState{
+		SchemaVersion: schemaVersionV2,
+		Plugins: map[string]PluginRecord{
+			"mystery-agent": {Marketplace: "databricks-agent-skills", Plugin: "databricks"},
+		},
+	}))
+
+	// An unknown agent can't be torn down; its record (and the state file) must be
+	// kept rather than silently dropped while the plugin may still exist.
+	require.NoError(t, UninstallSkillsOpts(ctx, UninstallOptions{Scope: ScopeGlobal}))
+
+	st, err := LoadState(dir)
+	require.NoError(t, err)
+	require.NotNil(t, st)
+	assert.Contains(t, st.Plugins, "mystery-agent")
+}
+
+func TestUninstallClearsRecordWhenMarketplaceRemoveFails(t *testing.T) {
+	setupTestHome(t)
+	stubAgentLookPath(t, true)
+	ctx, stub := process.WithStub(t.Context())
+	stub.WithCallback(func(*exec.Cmd) error { return nil })
+	// The plugin uninstall succeeds; only the marketplace de-register fails.
+	stub.WithFailureFor("plugin marketplace remove", errors.New("boom"))
+	ctx = cmdio.MockDiscard(ctx)
+
+	dir, err := GlobalSkillsDir(ctx)
+	require.NoError(t, err)
+	require.NoError(t, SaveState(dir, &InstallState{
+		SchemaVersion: schemaVersionV2,
+		Plugins: map[string]PluginRecord{
+			agents.NameCopilot: {Marketplace: "databricks-agent-skills", Plugin: "databricks", InstalledMarketplace: true},
+		},
+	}))
+
+	require.NoError(t, UninstallSkillsOpts(ctx, UninstallOptions{Scope: ScopeGlobal}))
+
+	// The plugin is gone, so the record is cleared even though the marketplace
+	// de-register failed (otherwise a retry would be stuck).
+	st, err := LoadState(dir)
+	require.NoError(t, err)
+	assert.Nil(t, st)
+}
+
+func TestUpdateInstalledPlugins(t *testing.T) {
+	setupTestHome(t)
+	stubAgentLookPath(t, true)
+	ctx, stub := process.WithStub(t.Context())
+	stub.WithCallback(func(*exec.Cmd) error { return nil })
+
+	dir, err := GlobalSkillsDir(ctx)
+	require.NoError(t, err)
+	require.NoError(t, SaveState(dir, &InstallState{
+		SchemaVersion: schemaVersionV2,
+		Release:       "v0.2.6",
+		Plugins: map[string]PluginRecord{
+			agents.NameCopilot: {Marketplace: "databricks-agent-skills", Plugin: "databricks", Scope: "user", Version: "0.2.6"},
+		},
+	}))
+
+	updated, err := UpdateInstalledPlugins(ctx, ScopeGlobal, "v0.2.7")
+	require.NoError(t, err)
+	require.Len(t, updated, 1)
+	assert.Equal(t, "GitHub Copilot", updated[0].Agent)
+	assert.Equal(t, "0.2.7", updated[0].Version)
+	assert.Contains(t, stub.Commands(), "copilot plugin update databricks@databricks-agent-skills")
+
+	state, err := LoadState(dir)
+	require.NoError(t, err)
+	assert.Equal(t, "0.2.7", state.Plugins[agents.NameCopilot].Version)
+}
+
+func TestUpdateInstalledPluginsUsesRecordedClaudeScope(t *testing.T) {
+	for _, scope := range []string{"project", "user", "local"} {
+		t.Run(scope, func(t *testing.T) {
+			setupTestHome(t)
+			stubAgentLookPath(t, true)
+			ctx, stub := process.WithStub(t.Context())
+			stub.WithCallback(func(*exec.Cmd) error { return nil })
+
+			dir, err := GlobalSkillsDir(ctx)
+			require.NoError(t, err)
+			require.NoError(t, SaveState(dir, &InstallState{
+				SchemaVersion: schemaVersionV2,
+				Release:       "v0.2.6",
+				Plugins: map[string]PluginRecord{
+					agents.NameClaudeCode: {Marketplace: "claude-plugins-official", Plugin: "databricks", Scope: scope, Version: "0.2.6"},
+				},
+			}))
+
+			updated, err := UpdateInstalledPlugins(ctx, ScopeGlobal, "v0.2.7")
+			require.NoError(t, err)
+			require.Len(t, updated, 1)
+
+			cmds := stub.Commands()
+			assert.Contains(t, cmds, "claude plugin marketplace update")
+			assert.Contains(t, cmds, "claude plugin update databricks@claude-plugins-official --scope "+scope)
+		})
+	}
+}
+
+func TestUninstallSkillsOptsUsesRecordedClaudeScope(t *testing.T) {
+	for _, scope := range []string{"project", "user", "local"} {
+		t.Run(scope, func(t *testing.T) {
+			setupTestHome(t)
+			stubAgentLookPath(t, true)
+			ctx, stub := process.WithStub(t.Context())
+			stub.WithCallback(func(*exec.Cmd) error { return nil })
+			ctx = cmdio.MockDiscard(ctx)
+
+			dir, err := GlobalSkillsDir(ctx)
+			require.NoError(t, err)
+			require.NoError(t, SaveState(dir, &InstallState{
+				SchemaVersion: schemaVersionV2,
+				Plugins: map[string]PluginRecord{
+					agents.NameClaudeCode: {Marketplace: "claude-plugins-official", Plugin: "databricks", Scope: scope},
+				},
+			}))
+
+			require.NoError(t, UninstallSkillsOpts(ctx, UninstallOptions{Scope: ScopeGlobal}))
+
+			cmds := stub.Commands()
+			assert.Contains(t, cmds, "claude plugin disable databricks@claude-plugins-official --scope "+scope)
+			assert.Contains(t, cmds, "claude plugin uninstall databricks@claude-plugins-official --scope "+scope)
+		})
+	}
+}
+
+func TestUninstallPluginKeepMarketplaceFlag(t *testing.T) {
+	stubAgentLookPath(t, true)
+	ctx, stub := process.WithStub(t.Context())
+	stub.WithCallback(func(*exec.Cmd) error { return nil })
+
+	rec := PluginRecord{Marketplace: "databricks-agent-skills", Plugin: "databricks", InstalledMarketplace: true}
+	require.NoError(t, UninstallPluginForAgent(ctx, claudeAgent(), rec, true))
+
+	for _, c := range stub.Commands() {
+		assert.NotContains(t, c, "marketplace remove")
+	}
+}
+
+func TestRecordPluginInstallsThenSkillsInstallNoPanic(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx := cmdio.MockDiscard(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+
+	dir, err := GlobalSkillsDir(ctx)
+	require.NoError(t, err)
+
+	// A pure-plugin install creates state with no skills.
+	require.NoError(t, RecordPluginInstalls(ctx, ScopeGlobal, map[string]PluginRecord{
+		agents.NameClaudeCode: {Marketplace: "databricks-agent-skills", Plugin: "databricks", Version: "0.2.6"},
+	}, "v0.2.6"))
+
+	// A later raw-skills install over that plugin-only state must not panic on a
+	// nil Skills map.
+	require.NoError(t, InstallSkillsForAgents(ctx, &mockManifestSource{manifest: testManifest()}, []*agents.Agent{testAgent(tmp)}, InstallOptions{}))
+
+	st, err := LoadState(dir)
+	require.NoError(t, err)
+	assert.NotEmpty(t, st.Skills)
+	assert.Contains(t, st.Plugins, agents.NameClaudeCode)
+}
diff --git a/libs/aitools/installer/source.go b/libs/aitools/installer/source.go
new file mode 100644
index 00000000000..f3d9842f876
--- /dev/null
+++ b/libs/aitools/installer/source.go
@@ -0,0 +1,68 @@
+package installer
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"time"
+
+	"github.com/databricks/cli/libs/clicompat"
+	"github.com/databricks/cli/libs/log"
+)
+
+// ManifestSource abstracts how the skills manifest is fetched.
+type ManifestSource interface {
+	// FetchManifest fetches the skills manifest at the given ref.
+	FetchManifest(ctx context.Context, ref string) (*Manifest, error)
+}
+
+// GitHubManifestSource fetches manifests from GitHub.
+type GitHubManifestSource struct{}
+
+// FetchManifest fetches the skills manifest from GitHub at the given ref.
+func (s *GitHubManifestSource) FetchManifest(ctx context.Context, ref string) (*Manifest, error) {
+	log.Debugf(ctx, "Fetching skills manifest from %s/%s@%s", skillsRepoOwner, skillsRepoName, ref)
+	url := fmt.Sprintf("%s/%s/manifest.json", GetSkillsBaseURL(ctx), ref)
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create request: %w", err)
+	}
+
+	client := &http.Client{Timeout: 30 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("failed to fetch manifest: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode == http.StatusNotFound {
+		return nil, fmt.Errorf("skills manifest at %s@%s: %w", skillsRepoName, ref, clicompat.ErrNotFound)
+	}
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("failed to fetch manifest: HTTP %d", resp.StatusCode)
+	}
+
+	var manifest Manifest
+	if err := json.NewDecoder(resp.Body).Decode(&manifest); err != nil {
+		return nil, fmt.Errorf("failed to parse manifest: %w", err)
+	}
+
+	normalizeManifest(&manifest)
+	return &manifest, nil
+}
+
+// normalizeManifest stamps SourceName and defaults RepoDir for older manifests.
+func normalizeManifest(m *Manifest) {
+	if m.Skills == nil {
+		m.Skills = map[string]SkillMeta{}
+	}
+	for name, meta := range m.Skills {
+		if meta.RepoDir == "" {
+			meta.RepoDir = stableSkillsRepoPath
+		}
+		meta.SourceName = name
+		m.Skills[name] = meta
+	}
+}
diff --git a/libs/aitools/installer/source_test.go b/libs/aitools/installer/source_test.go
new file mode 100644
index 00000000000..fb52563b686
--- /dev/null
+++ b/libs/aitools/installer/source_test.go
@@ -0,0 +1,62 @@
+package installer
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestNormalizeManifestStampsSourceNameAndRepoDir(t *testing.T) {
+	m := &Manifest{
+		Skills: map[string]SkillMeta{
+			"databricks-apps":    {Version: "0.1.0", Files: []string{"SKILL.md"}},
+			"databricks-iceberg": {Version: "0.0.1", Files: []string{"SKILL.md"}, RepoDir: experimentalRepoPath},
+		},
+	}
+
+	normalizeManifest(m)
+
+	stable := m.Skills["databricks-apps"]
+	assert.False(t, stable.IsExperimental())
+	assert.Equal(t, stableSkillsRepoPath, stable.RepoDir)
+	assert.Equal(t, "databricks-apps", stable.SourceName)
+
+	exp, ok := m.Skills["databricks-iceberg"]
+	assert.True(t, ok)
+	assert.True(t, exp.IsExperimental())
+	assert.Equal(t, experimentalRepoPath, exp.RepoDir)
+	assert.Equal(t, "databricks-iceberg", exp.SourceName)
+}
+
+func TestManifestHasExperimental(t *testing.T) {
+	stableOnly := &Manifest{Skills: map[string]SkillMeta{
+		"databricks-apps": {Version: "0.1.0"},
+	}}
+	normalizeManifest(stableOnly)
+	assert.False(t, manifestHasExperimental(stableOnly))
+
+	withExperimental := &Manifest{
+		Skills: map[string]SkillMeta{
+			"databricks-apps":    {Version: "0.1.0"},
+			"databricks-iceberg": {Version: "0.0.1", RepoDir: experimentalRepoPath},
+		},
+	}
+	normalizeManifest(withExperimental)
+	assert.True(t, manifestHasExperimental(withExperimental))
+}
+
+func TestNormalizeManifestOnlyExperimentalSkills(t *testing.T) {
+	m := &Manifest{
+		Skills: map[string]SkillMeta{
+			"x": {Version: "0.0.1", RepoDir: experimentalRepoPath},
+		},
+	}
+
+	normalizeManifest(m)
+
+	got, ok := m.Skills["x"]
+	assert.True(t, ok)
+	assert.True(t, got.IsExperimental())
+	assert.Equal(t, experimentalRepoPath, got.RepoDir)
+	assert.Equal(t, "x", got.SourceName)
+}
diff --git a/libs/aitools/installer/state.go b/libs/aitools/installer/state.go
new file mode 100644
index 00000000000..ddd51568bde
--- /dev/null
+++ b/libs/aitools/installer/state.go
@@ -0,0 +1,148 @@
+package installer
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/databricks/cli/libs/atomicfile"
+	"github.com/databricks/cli/libs/env"
+)
+
+// clearFileRecords removes all file-provenance entries belonging to a skill
+// (keys are "<skill>/<file>"), so refetching or removing a skill never leaves
+// orphaned records behind.
+func clearFileRecords(files map[string]FileRecord, skillName string) {
+	prefix := skillName + "/"
+	for path := range files {
+		if strings.HasPrefix(path, prefix) {
+			delete(files, path)
+		}
+	}
+}
+
+const stateFileName = ".state.json"
+
+// schemaVersionV2 is the current on-disk state schema version. v2 adds the
+// additive Plugins and Files maps; v1 state loads forward without data changes.
+const schemaVersionV2 = 2
+
+// Scope constants for skill installation.
+const (
+	ScopeGlobal  = "global"
+	ScopeProject = "project"
+)
+
+// InstallState records the state of all installed skills in a scope directory.
+type InstallState struct {
+	SchemaVersion       int               `json:"schema_version"`
+	IncludeExperimental bool              `json:"include_experimental,omitempty"`
+	Release             string            `json:"release"`
+	LastUpdated         time.Time         `json:"last_updated"`
+	Skills              map[string]string `json:"skills"`
+	RepoDirs            map[string]string `json:"repo_dirs,omitempty"`
+	Scope               string            `json:"scope,omitempty"`
+
+	// Plugins records databricks plugins installed through an agent's own CLI,
+	// keyed by registry agent name (e.g. "claude-code"). Added in schema v2;
+	// omitted for files-only installs.
+	Plugins map[string]PluginRecord `json:"plugins,omitempty"`
+	// Files records provenance for skill files the CLI wrote, keyed by the
+	// file path relative to the scope's canonical skills dir (forward slashes,
+	// e.g. "databricks/SKILL.md"). Added in schema v2; used to prune only the
+	// skills we wrote that the user hasn't modified.
+	Files map[string]FileRecord `json:"files,omitempty"`
+}
+
+// PluginRecord records a databricks plugin installed for an agent through the
+// agent's own plugin CLI, so update/uninstall act on exactly where we
+// installed and list/version can report real plugin state.
+type PluginRecord struct {
+	// Marketplace is the marketplace registry name the plugin was installed from.
+	Marketplace string `json:"marketplace"`
+	// Plugin is the installed plugin id (e.g. "databricks").
+	Plugin string `json:"plugin"`
+	// Scope is the agent-native install scope (e.g. "user" or "project").
+	Scope string `json:"scope,omitempty"`
+	// Version is the last seen plugin/release version, when known.
+	Version string `json:"version,omitempty"`
+	// InstalledMarketplace is true when this CLI registered the marketplace,
+	// so uninstall may de-register it. False when it was already present and we
+	// must leave it for whatever else shares it.
+	InstalledMarketplace bool `json:"installed_marketplace,omitempty"`
+}
+
+// FileRecord records provenance for a single skill file the CLI wrote, so
+// update can prune a vanished skill only when the on-disk file still matches
+// what we wrote (i.e. the user hasn't modified it).
+type FileRecord struct {
+	// SHA256 is the hex-encoded checksum of the file content the CLI wrote.
+	SHA256 string `json:"sha256"`
+	// Origin is the skills ref the file was fetched from, when known.
+	Origin string `json:"origin,omitempty"`
+}
+
+// LoadState reads install state from the given directory.
+// Returns (nil, nil) when the state file does not exist.
+func LoadState(dir string) (*InstallState, error) {
+	data, err := os.ReadFile(filepath.Join(dir, stateFileName))
+	if errors.Is(err, os.ErrNotExist) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, fmt.Errorf("failed to read state file: %w", err)
+	}
+
+	var state InstallState
+	if err := json.Unmarshal(data, &state); err != nil {
+		return nil, fmt.Errorf("failed to parse state file: %w", err)
+	}
+	migrateState(&state)
+	return &state, nil
+}
+
+// migrateState brings a loaded state forward to the current schema version. It
+// is forward-only and idempotent. v1 -> v2 needs no data transformation (the
+// Plugins/Files maps are additive and optional), so it only stamps the version;
+// writers lazily initialize the maps, matching how RepoDirs is handled.
+func migrateState(state *InstallState) {
+	if state.SchemaVersion < schemaVersionV2 {
+		state.SchemaVersion = schemaVersionV2
+	}
+}
+
+// SaveState writes install state to the given directory atomically.
+// Creates the directory if it does not exist.
+func SaveState(dir string, state *InstallState) error {
+	data, err := json.MarshalIndent(state, "", "  ")
+	if err != nil {
+		return fmt.Errorf("failed to marshal state: %w", err)
+	}
+	data = append(data, '\n')
+
+	return atomicfile.Write(filepath.Join(dir, stateFileName), data, 0o600, atomicfile.MkDir(0o755))
+}
+
+// GlobalSkillsDir returns the path to the global skills directory (~/.databricks/aitools/skills/).
+func GlobalSkillsDir(ctx context.Context) (string, error) {
+	home, err := env.UserHomeDir(ctx)
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(home, ".databricks", "aitools", "skills"), nil
+}
+
+// ProjectSkillsDir returns the path to the project-scoped skills directory.
+// The project root is the current working directory.
+func ProjectSkillsDir(_ context.Context) (string, error) {
+	cwd, err := os.Getwd()
+	if err != nil {
+		return "", fmt.Errorf("failed to determine working directory: %w", err)
+	}
+	return filepath.Join(cwd, ".databricks", "aitools", "skills"), nil
+}
diff --git a/libs/aitools/installer/state_test.go b/libs/aitools/installer/state_test.go
new file mode 100644
index 00000000000..8650d19d27e
--- /dev/null
+++ b/libs/aitools/installer/state_test.go
@@ -0,0 +1,180 @@
+package installer
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/databricks/cli/libs/env"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestLoadStateNonexistentFile(t *testing.T) {
+	state, err := LoadState(t.TempDir())
+	assert.NoError(t, err)
+	assert.Nil(t, state)
+}
+
+func TestSaveAndLoadStateRoundtrip(t *testing.T) {
+	dir := t.TempDir()
+	original := &InstallState{
+		SchemaVersion: schemaVersionV2,
+		Release:       "v0.2.0",
+		LastUpdated:   time.Date(2026, 3, 22, 10, 0, 0, 0, time.UTC),
+		Skills: map[string]string{
+			"databricks": "1.0.0",
+		},
+		RepoDirs: map[string]string{
+			"databricks": stableSkillsRepoPath,
+		},
+	}
+
+	err := SaveState(dir, original)
+	require.NoError(t, err)
+
+	loaded, err := LoadState(dir)
+	require.NoError(t, err)
+	assert.Equal(t, original, loaded)
+}
+
+func TestSaveStateCreatesDirectory(t *testing.T) {
+	dir := filepath.Join(t.TempDir(), "nested", "path")
+	state := &InstallState{
+		SchemaVersion: 1,
+		Release:       "v0.1.0",
+		LastUpdated:   time.Date(2026, 3, 22, 9, 0, 0, 0, time.UTC),
+		Skills:        map[string]string{},
+	}
+
+	err := SaveState(dir, state)
+	require.NoError(t, err)
+
+	// Verify file exists.
+	_, err = os.Stat(filepath.Join(dir, stateFileName))
+	assert.NoError(t, err)
+}
+
+func TestSaveStateTrailingNewline(t *testing.T) {
+	dir := t.TempDir()
+	state := &InstallState{
+		SchemaVersion: 1,
+		Release:       "v0.1.0",
+		LastUpdated:   time.Date(2026, 3, 22, 9, 0, 0, 0, time.UTC),
+		Skills:        map[string]string{},
+	}
+
+	err := SaveState(dir, state)
+	require.NoError(t, err)
+
+	data, err := os.ReadFile(filepath.Join(dir, stateFileName))
+	require.NoError(t, err)
+	assert.Equal(t, byte('\n'), data[len(data)-1])
+}
+
+func TestLoadStateCorruptJSON(t *testing.T) {
+	dir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(dir, stateFileName), []byte("{bad json"), 0o644))
+
+	state, err := LoadState(dir)
+	assert.Error(t, err)
+	assert.Nil(t, state)
+	assert.Contains(t, err.Error(), "failed to parse state file")
+}
+
+func TestGlobalSkillsDir(t *testing.T) {
+	ctx := env.WithUserHomeDir(t.Context(), "/fake/home")
+	dir, err := GlobalSkillsDir(ctx)
+	require.NoError(t, err)
+	assert.Equal(t, filepath.Join("/fake/home", ".databricks", "aitools", "skills"), dir)
+}
+
+func TestProjectSkillsDirReturnsCwdBased(t *testing.T) {
+	dir, err := ProjectSkillsDir(t.Context())
+	require.NoError(t, err)
+	cwd, _ := os.Getwd()
+	assert.Equal(t, filepath.Join(cwd, ".databricks", "aitools", "skills"), dir)
+}
+
+func TestLoadStateMigratesV1ToV2(t *testing.T) {
+	dir := t.TempDir()
+	// A v1 state on disk has no plugins/files keys.
+	v1 := `{"schema_version":1,"release":"v0.2.0","last_updated":"2026-03-22T10:00:00Z","skills":{"databricks":"1.0.0"},"repo_dirs":{"databricks":"skills"}}`
+	require.NoError(t, os.WriteFile(filepath.Join(dir, stateFileName), []byte(v1), 0o644))
+
+	loaded, err := LoadState(dir)
+	require.NoError(t, err)
+	assert.Equal(t, schemaVersionV2, loaded.SchemaVersion)
+	// Migration is additive: existing data is untouched and the new maps stay nil.
+	assert.Equal(t, map[string]string{"databricks": "1.0.0"}, loaded.Skills)
+	assert.Nil(t, loaded.Plugins)
+	assert.Nil(t, loaded.Files)
+}
+
+func TestMigrateStateIsIdempotent(t *testing.T) {
+	// Start at v1 so this exercises the real v1 -> v2 migration, then confirm a
+	// second migrateState is a no-op.
+	state := &InstallState{SchemaVersion: 1, Skills: map[string]string{"databricks": "1.0.0"}}
+	migrateState(state)
+	assert.Equal(t, schemaVersionV2, state.SchemaVersion)
+
+	migrated := *state
+	migrateState(state)
+	assert.Equal(t, migrated, *state)
+}
+
+func TestSaveAndLoadStateWithPluginAndFileRecords(t *testing.T) {
+	dir := t.TempDir()
+	original := &InstallState{
+		SchemaVersion: schemaVersionV2,
+		Release:       "v0.2.6",
+		LastUpdated:   time.Date(2026, 6, 24, 0, 0, 0, 0, time.UTC),
+		Skills:        map[string]string{"databricks": "1.0.0"},
+		RepoDirs:      map[string]string{"databricks": stableSkillsRepoPath},
+		Plugins: map[string]PluginRecord{
+			"claude-code": {
+				Marketplace:          "databricks-agent-skills",
+				Plugin:               "databricks",
+				Scope:                "user",
+				Version:              "0.2.6",
+				InstalledMarketplace: true,
+			},
+		},
+		Files: map[string]FileRecord{
+			"databricks/SKILL.md": {SHA256: "abc123", Origin: "v0.2.6"},
+		},
+	}
+
+	require.NoError(t, SaveState(dir, original))
+
+	loaded, err := LoadState(dir)
+	require.NoError(t, err)
+	assert.Equal(t, original, loaded)
+}
+
+func TestSaveAndLoadStateWithOptionalFields(t *testing.T) {
+	dir := t.TempDir()
+	original := &InstallState{
+		SchemaVersion:       schemaVersionV2,
+		IncludeExperimental: true,
+		Release:             "v0.3.0",
+		LastUpdated:         time.Date(2026, 3, 22, 12, 30, 0, 0, time.UTC),
+		Skills: map[string]string{
+			"databricks": "1.0.0",
+			"sql-tools":  "0.2.0",
+		},
+		RepoDirs: map[string]string{
+			"databricks": stableSkillsRepoPath,
+			"sql-tools":  experimentalRepoPath,
+		},
+		Scope: "project",
+	}
+
+	err := SaveState(dir, original)
+	require.NoError(t, err)
+
+	loaded, err := LoadState(dir)
+	require.NoError(t, err)
+	assert.Equal(t, original, loaded)
+}
diff --git a/libs/aitools/installer/uninstall.go b/libs/aitools/installer/uninstall.go
new file mode 100644
index 00000000000..713ec27f39e
--- /dev/null
+++ b/libs/aitools/installer/uninstall.go
@@ -0,0 +1,391 @@
+package installer
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io/fs"
+	"maps"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+
+	"github.com/databricks/cli/libs/aitools/agents"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/log"
+)
+
+// UninstallOptions controls the behavior of UninstallSkillsOpts.
+type UninstallOptions struct {
+	Skills          []string // empty = all
+	Agents          []string // empty = all agents
+	Scope           string   // ScopeGlobal or ScopeProject (default: global)
+	KeepMarketplace bool     // keep the marketplace registration when removing a plugin
+}
+
+// UninstallSkills removes all installed skills, their symlinks, and the state file.
+func UninstallSkills(ctx context.Context) error {
+	return UninstallSkillsOpts(ctx, UninstallOptions{})
+}
+
+// UninstallSkillsOpts removes installed skills based on options.
+// When opts.Skills is empty, all skills are removed (same as UninstallSkills).
+// When opts.Skills is non-empty, only the named skills are removed.
+func UninstallSkillsOpts(ctx context.Context, opts UninstallOptions) error {
+	scope := opts.Scope
+	if scope == "" {
+		scope = ScopeGlobal
+	}
+
+	baseDir, err := skillsDir(ctx, scope)
+	if err != nil {
+		return err
+	}
+
+	var cwd string
+	if scope == ScopeProject {
+		cwd, err = os.Getwd()
+		if err != nil {
+			return fmt.Errorf("failed to determine working directory: %w", err)
+		}
+	}
+
+	state, err := LoadState(baseDir)
+	if err != nil {
+		return fmt.Errorf("failed to load install state: %w", err)
+	}
+
+	if state == nil {
+		if scope == ScopeGlobal && hasLegacyInstall(ctx, baseDir) {
+			return errors.New("found skills from a previous install without state tracking; run 'databricks aitools install' first, then uninstall")
+		}
+		return errors.New("no skills or plugins installed")
+	}
+
+	// A full uninstall (no --skills filter) also tears down plugins.
+	fullUninstall := len(opts.Skills) == 0
+	agentFilter := stringSet(opts.Agents)
+	targetedAgents := len(agentFilter) > 0
+
+	pluginCount := 0
+	if fullUninstall {
+		for _, name := range slices.Sorted(maps.Keys(state.Plugins)) {
+			if targetedAgents && !agentFilter[name] {
+				continue
+			}
+			agent := agents.ByName(name)
+			if agent == nil {
+				// We can't tear down an agent we don't know; keep the record (and
+				// the state file) rather than silently dropping a live plugin.
+				log.Warnf(ctx, "Leaving plugin record for unknown agent %q; remove its plugin manually", name)
+				continue
+			}
+			rec := state.Plugins[name]
+			if err := UninstallPluginForAgent(ctx, agent, rec, opts.KeepMarketplace); err != nil {
+				log.Warnf(ctx, "Skipped %s: %v", agent.DisplayName, err)
+				continue
+			}
+			delete(state.Plugins, name)
+			pluginCount++
+			// Mirror the de-register condition in UninstallPluginForAgent: a Shared
+			// marketplace is never removed, so don't claim we did.
+			note := " + marketplace"
+			if opts.KeepMarketplace || !rec.InstalledMarketplace || agent.Plugin.Shared {
+				note = ""
+			}
+			cmdio.LogString(ctx, fmt.Sprintf("  %s  removed databricks plugin%s", agent.DisplayName, note))
+		}
+	}
+
+	// Determine which skills to remove.
+	var toRemove []string
+	if len(opts.Skills) > 0 {
+		seen := make(map[string]bool)
+		for _, name := range opts.Skills {
+			if _, ok := state.Skills[name]; !ok {
+				if targetedAgents {
+					if foundIn, found := untrackedSkillAgents(ctx, name, opts.Agents, scope, cwd); found {
+						return fmt.Errorf("skill %q is not tracked in Databricks aitools state but exists for %s. Run 'databricks aitools install --skills-only --agents %s' to rebuild state before uninstalling, or remove it manually", name, strings.Join(foundIn, ", "), strings.Join(opts.Agents, ","))
+					}
+				}
+				return fmt.Errorf("skill %q is not installed", name)
+			}
+			if seen[name] {
+				continue
+			}
+			seen[name] = true
+			toRemove = append(toRemove, name)
+		}
+	} else {
+		for name := range state.Skills {
+			toRemove = append(toRemove, name)
+		}
+	}
+
+	// Remove skill directories and symlinks for each skill.
+	for _, name := range toRemove {
+		canonicalDir := filepath.Join(baseDir, name)
+		removeCanonical := true
+		if targetedAgents {
+			removeSkillExposuresFromAgents(ctx, name, canonicalDir, scope, cwd, state, opts.Agents)
+			removeCanonical = !hasRemainingSkillExposure(ctx, name, canonicalDir, scope, cwd, opts.Agents)
+		} else {
+			removeSymlinksFromAgents(ctx, name, canonicalDir, scope, cwd)
+		}
+		if !removeCanonical {
+			continue
+		}
+		if err := os.RemoveAll(canonicalDir); err != nil {
+			log.Warnf(ctx, "Failed to remove %s: %v", canonicalDir, err)
+		}
+		delete(state.Skills, name)
+		delete(state.RepoDirs, name)
+		for path := range state.Files {
+			if strings.HasPrefix(path, name+"/") {
+				delete(state.Files, path)
+			}
+		}
+	}
+
+	// If nothing remains in this scope, clean up orphaned symlinks and delete the
+	// state file; otherwise persist the trimmed state.
+	if len(state.Skills) == 0 && len(state.Plugins) == 0 {
+		cleanOrphanedSymlinks(ctx, baseDir, scope, cwd)
+		stateFile := filepath.Join(baseDir, stateFileName)
+		if err := os.Remove(stateFile); err != nil && !errors.Is(err, fs.ErrNotExist) {
+			return fmt.Errorf("failed to remove state file: %w", err)
+		}
+	} else {
+		if err := SaveState(baseDir, state); err != nil {
+			return err
+		}
+	}
+
+	if pluginCount > 0 {
+		noun := "agent"
+		if pluginCount != 1 {
+			noun = "agents"
+		}
+		cmdio.LogString(ctx, fmt.Sprintf("Uninstalled the plugin from %d %s.", pluginCount, noun))
+	}
+	if len(toRemove) > 0 {
+		noun := "skills"
+		if len(toRemove) == 1 {
+			noun = "skill"
+		}
+		cmdio.LogString(ctx, fmt.Sprintf("Uninstalled %d %s.", len(toRemove), noun))
+	}
+	return nil
+}
+
+func stringSet(items []string) map[string]bool {
+	if len(items) == 0 {
+		return nil
+	}
+	set := make(map[string]bool, len(items))
+	for _, item := range items {
+		set[item] = true
+	}
+	return set
+}
+
+func removeSkillExposuresFromAgents(ctx context.Context, skillName, canonicalDir, scope, cwd string, state *InstallState, agentNames []string) {
+	for _, name := range agentNames {
+		agent := agents.ByName(name)
+		if agent == nil {
+			continue
+		}
+		if scope == ScopeProject && !agent.SupportsProjectScope {
+			continue
+		}
+		agentDir, err := agentSkillsDirForScope(ctx, agent, scope, cwd)
+		if err != nil {
+			continue
+		}
+		entry := filepath.Join(agentDir, skillName)
+		if !exposureRemovable(entry, canonicalDir, skillName, state) {
+			log.Debugf(ctx, "Skipping unmanaged skill %s for %s", entry, agent.DisplayName)
+			continue
+		}
+		if err := os.RemoveAll(entry); err != nil {
+			log.Warnf(ctx, "Failed to remove %s: %v", entry, err)
+		}
+	}
+}
+
+func hasRemainingSkillExposure(ctx context.Context, skillName, canonicalDir, scope, cwd string, removedAgents []string) bool {
+	removed := stringSet(removedAgents)
+	for _, agent := range agents.Registry {
+		if removed[agent.Name] {
+			continue
+		}
+		if scope == ScopeProject && !agent.SupportsProjectScope {
+			continue
+		}
+		agentDir, err := agentSkillsDirForScope(ctx, agent, scope, cwd)
+		if err != nil {
+			continue
+		}
+		entry := filepath.Join(agentDir, skillName)
+		if skillExposureExists(entry, canonicalDir) {
+			return true
+		}
+	}
+	return false
+}
+
+func skillExposureExists(entry, canonicalDir string) bool {
+	fi, err := os.Lstat(entry)
+	if errors.Is(err, fs.ErrNotExist) {
+		return false
+	}
+	if err != nil {
+		return true
+	}
+	if fi.Mode()&os.ModeSymlink == 0 {
+		return true
+	}
+	target, err := os.Readlink(entry)
+	if err != nil {
+		return true
+	}
+	abs := target
+	if !filepath.IsAbs(target) {
+		abs = filepath.Clean(filepath.Join(filepath.Dir(entry), target))
+	}
+	return abs == canonicalDir || strings.HasPrefix(abs, canonicalDir+string(os.PathSeparator))
+}
+
+func untrackedSkillAgents(ctx context.Context, skillName string, agentNames []string, scope, cwd string) ([]string, bool) {
+	var found []string
+	for _, name := range agentNames {
+		agent := agents.ByName(name)
+		if agent == nil {
+			continue
+		}
+		if scope == ScopeProject && !agent.SupportsProjectScope {
+			continue
+		}
+		agentDir, err := agentSkillsDirForScope(ctx, agent, scope, cwd)
+		if err != nil {
+			continue
+		}
+		if _, err := os.Lstat(filepath.Join(agentDir, skillName)); err == nil {
+			found = append(found, agent.DisplayName)
+		}
+	}
+	return found, len(found) > 0
+}
+
+// removeSymlinksFromAgents removes a skill's symlink from all agent directories
+// in the registry, but only if the entry is a symlink pointing into canonicalDir.
+// Non-symlink directories are left untouched to avoid deleting user-managed content.
+func removeSymlinksFromAgents(ctx context.Context, skillName, canonicalDir, scope, cwd string) {
+	for _, agent := range agents.Registry {
+		if scope == ScopeProject && !agent.SupportsProjectScope {
+			continue
+		}
+		agentDir, err := agentSkillsDirForScope(ctx, agent, scope, cwd)
+		if err != nil {
+			continue
+		}
+
+		destDir := filepath.Join(agentDir, skillName)
+
+		// Use Lstat to detect symlinks (Stat follows them).
+		fi, err := os.Lstat(destDir)
+		if errors.Is(err, fs.ErrNotExist) {
+			continue
+		}
+		if err != nil {
+			log.Warnf(ctx, "Failed to stat %s for %s: %v", destDir, agent.DisplayName, err)
+			continue
+		}
+
+		if fi.Mode()&os.ModeSymlink == 0 {
+			log.Debugf(ctx, "Skipping non-symlink %s for %s", destDir, agent.DisplayName)
+			continue
+		}
+
+		target, err := os.Readlink(destDir)
+		if err != nil {
+			log.Warnf(ctx, "Failed to read symlink %s: %v", destDir, err)
+			continue
+		}
+
+		// Resolve relative symlinks to absolute for comparison.
+		absTarget := target
+		if !filepath.IsAbs(target) {
+			absTarget = filepath.Join(filepath.Dir(destDir), target)
+			absTarget = filepath.Clean(absTarget)
+		}
+
+		// Only remove if the symlink points into our canonical dir.
+		if !strings.HasPrefix(absTarget, canonicalDir+string(os.PathSeparator)) && absTarget != canonicalDir {
+			log.Debugf(ctx, "Skipping symlink %s (points to %s, not %s)", destDir, absTarget, canonicalDir)
+			continue
+		}
+
+		if err := os.Remove(destDir); err != nil {
+			log.Warnf(ctx, "Failed to remove symlink %s: %v", destDir, err)
+		} else {
+			log.Debugf(ctx, "Removed %q from %s", skillName, agent.DisplayName)
+		}
+	}
+}
+
+// cleanOrphanedSymlinks scans all agent skill directories for symlinks pointing
+// into baseDir that are not tracked in state, and removes them.
+func cleanOrphanedSymlinks(ctx context.Context, baseDir, scope, cwd string) {
+	for _, agent := range agents.Registry {
+		if scope == ScopeProject && !agent.SupportsProjectScope {
+			continue
+		}
+		agentDir, err := agentSkillsDirForScope(ctx, agent, scope, cwd)
+		if err != nil {
+			continue
+		}
+
+		entries, err := os.ReadDir(agentDir)
+		if err != nil {
+			continue
+		}
+
+		for _, entry := range entries {
+			entryPath := filepath.Join(agentDir, entry.Name())
+
+			fi, err := os.Lstat(entryPath)
+			if err != nil {
+				continue
+			}
+
+			if fi.Mode()&os.ModeSymlink == 0 {
+				continue
+			}
+
+			target, err := os.Readlink(entryPath)
+			if err != nil {
+				continue
+			}
+
+			// Resolve relative symlinks to absolute for comparison.
+			absTarget := target
+			if !filepath.IsAbs(target) {
+				absTarget = filepath.Clean(filepath.Join(filepath.Dir(entryPath), target))
+			}
+
+			// Check if the symlink points into our managed skills dir.
+			if !strings.HasPrefix(absTarget, baseDir+string(os.PathSeparator)) && absTarget != baseDir {
+				continue
+			}
+
+			// This symlink points into our managed dir. Remove it.
+			if err := os.Remove(entryPath); err != nil {
+				log.Warnf(ctx, "Failed to remove orphaned symlink %s: %v", entryPath, err)
+			} else {
+				log.Debugf(ctx, "Removed orphaned symlink %s -> %s", entryPath, target)
+			}
+		}
+	}
+}
diff --git a/libs/aitools/installer/uninstall_test.go b/libs/aitools/installer/uninstall_test.go
new file mode 100644
index 00000000000..3bd7bfcc19e
--- /dev/null
+++ b/libs/aitools/installer/uninstall_test.go
@@ -0,0 +1,409 @@
+package installer
+
+import (
+	"context"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/databricks/cli/libs/aitools/agents"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func installTestSkills(t *testing.T, tmp string) string {
+	t.Helper()
+	ctx := cmdio.MockDiscard(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+
+	src := &mockManifestSource{manifest: testManifest()}
+	agent := testAgent(tmp)
+	require.NoError(t, InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{}))
+
+	return filepath.Join(tmp, ".databricks", "aitools", "skills")
+}
+
+func TestUninstallRemovesSkillDirectories(t *testing.T) {
+	tmp := setupTestHome(t)
+	globalDir := installTestSkills(t, tmp)
+
+	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
+
+	err := UninstallSkills(ctx)
+	require.NoError(t, err)
+
+	// Skill directories should be gone.
+	_, err = os.Stat(filepath.Join(globalDir, "databricks-sql"))
+	assert.ErrorIs(t, err, fs.ErrNotExist)
+	_, err = os.Stat(filepath.Join(globalDir, "databricks-jobs"))
+	assert.ErrorIs(t, err, fs.ErrNotExist)
+
+	assert.Contains(t, stderr.String(), "Uninstalled 2 skills.")
+}
+
+func TestUninstallRemovesSymlinks(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx := cmdio.MockDiscard(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+
+	// Use two registry-based agents so uninstall can find them.
+	// Create config dirs for claude-code and cursor (both in agents.Registry).
+	require.NoError(t, os.MkdirAll(filepath.Join(tmp, ".claude"), 0o755))
+	require.NoError(t, os.MkdirAll(filepath.Join(tmp, ".cursor"), 0o755))
+
+	claudeAgent := &agents.Agent{
+		Name:        "claude-code",
+		DisplayName: "Claude Code",
+		ConfigDir: func(_ context.Context) (string, error) {
+			return filepath.Join(tmp, ".claude"), nil
+		},
+	}
+	cursorAgent := &agents.Agent{
+		Name:        "cursor",
+		DisplayName: "Cursor",
+		ConfigDir: func(_ context.Context) (string, error) {
+			return filepath.Join(tmp, ".cursor"), nil
+		},
+	}
+
+	src := &mockManifestSource{manifest: testManifest()}
+	require.NoError(t, InstallSkillsForAgents(ctx, src, []*agents.Agent{claudeAgent, cursorAgent}, InstallOptions{}))
+
+	ctx2, _ := cmdio.NewTestContextWithStderr(t.Context())
+	err := UninstallSkills(ctx2)
+	require.NoError(t, err)
+
+	// Check that agent skill directories are cleaned up.
+	// These agents are in agents.Registry so removeSymlinksFromAgents finds them.
+	for _, agentDir := range []string{".claude", ".cursor"} {
+		sqlLink := filepath.Join(tmp, agentDir, "skills", "databricks-sql")
+		_, err := os.Lstat(sqlLink)
+		assert.ErrorIs(t, err, fs.ErrNotExist, "symlink should be removed from %s", agentDir)
+
+		jobsLink := filepath.Join(tmp, agentDir, "skills", "databricks-jobs")
+		_, err = os.Lstat(jobsLink)
+		assert.ErrorIs(t, err, fs.ErrNotExist, "symlink should be removed from %s", agentDir)
+	}
+}
+
+func TestUninstallCleansOrphanedSymlinks(t *testing.T) {
+	tmp := setupTestHome(t)
+	globalDir := installTestSkills(t, tmp)
+
+	// Create an orphaned symlink in a registry agent's dir that points into
+	// globalDir but is not tracked in state.
+	// .claude is in agents.Registry so cleanOrphanedSymlinks will scan it.
+	require.NoError(t, os.MkdirAll(filepath.Join(tmp, ".claude"), 0o755))
+	agentSkillsDir := filepath.Join(tmp, ".claude", "skills")
+	require.NoError(t, os.MkdirAll(agentSkillsDir, 0o755))
+
+	orphanTarget := filepath.Join(globalDir, "databricks-orphan")
+	require.NoError(t, os.MkdirAll(orphanTarget, 0o755))
+	orphanLink := filepath.Join(agentSkillsDir, "databricks-orphan")
+	require.NoError(t, os.Symlink(orphanTarget, orphanLink))
+
+	ctx, _ := cmdio.NewTestContextWithStderr(t.Context())
+	err := UninstallSkills(ctx)
+	require.NoError(t, err)
+
+	// Orphaned symlink should be removed.
+	_, err = os.Lstat(orphanLink)
+	assert.ErrorIs(t, err, fs.ErrNotExist)
+}
+
+func TestUninstallDeletesStateFile(t *testing.T) {
+	tmp := setupTestHome(t)
+	globalDir := installTestSkills(t, tmp)
+
+	// Verify state file exists before uninstall.
+	_, err := os.Stat(filepath.Join(globalDir, ".state.json"))
+	require.NoError(t, err)
+
+	ctx := cmdio.MockDiscard(t.Context())
+	err = UninstallSkills(ctx)
+	require.NoError(t, err)
+
+	// State file should be gone.
+	_, err = os.Stat(filepath.Join(globalDir, ".state.json"))
+	assert.ErrorIs(t, err, fs.ErrNotExist)
+}
+
+func TestUninstallNoStateReturnsError(t *testing.T) {
+	setupTestHome(t)
+	ctx := cmdio.MockDiscard(t.Context())
+
+	err := UninstallSkills(ctx)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "no skills or plugins installed")
+}
+
+func TestUninstallHandlesMissingDirectories(t *testing.T) {
+	tmp := setupTestHome(t)
+	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
+
+	// Create state manually but without actual skill directories on disk.
+	state := &InstallState{
+		SchemaVersion: 1,
+		Release:       "v0.1.0",
+		LastUpdated:   time.Now(),
+		Skills: map[string]string{
+			"databricks-sql":  "0.1.0",
+			"databricks-jobs": "0.1.0",
+		},
+	}
+	require.NoError(t, SaveState(globalDir, state))
+
+	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
+	err := UninstallSkills(ctx)
+	require.NoError(t, err)
+	assert.Contains(t, stderr.String(), "Uninstalled 2 skills.")
+}
+
+func TestUninstallHandlesBrokenSymlinksToCanonicalDir(t *testing.T) {
+	tmp := setupTestHome(t)
+	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
+
+	// Create state with one skill.
+	state := &InstallState{
+		SchemaVersion: 1,
+		Release:       "v0.1.0",
+		LastUpdated:   time.Now(),
+		Skills: map[string]string{
+			"databricks-sql": "0.1.0",
+		},
+	}
+	require.NoError(t, SaveState(globalDir, state))
+
+	// Create a symlink pointing to the canonical dir (which doesn't exist on disk).
+	canonicalTarget := filepath.Join(globalDir, "databricks-sql")
+	require.NoError(t, os.MkdirAll(filepath.Join(tmp, ".claude"), 0o755))
+	agentSkillsDir := filepath.Join(tmp, ".claude", "skills")
+	require.NoError(t, os.MkdirAll(agentSkillsDir, 0o755))
+	link := filepath.Join(agentSkillsDir, "databricks-sql")
+	require.NoError(t, os.Symlink(canonicalTarget, link))
+
+	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
+	err := UninstallSkills(ctx)
+	require.NoError(t, err)
+
+	// Symlink pointing to canonical dir should be removed.
+	_, err = os.Lstat(link)
+	assert.ErrorIs(t, err, fs.ErrNotExist)
+	assert.Contains(t, stderr.String(), "Uninstalled 1 skill.")
+}
+
+func TestUninstallLeavesNonCanonicalSymlinks(t *testing.T) {
+	tmp := setupTestHome(t)
+	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
+
+	state := &InstallState{
+		SchemaVersion: 1,
+		Release:       "v0.1.0",
+		LastUpdated:   time.Now(),
+		Skills: map[string]string{
+			"databricks-sql": "0.1.0",
+		},
+	}
+	require.NoError(t, SaveState(globalDir, state))
+
+	// Create a symlink in an agent dir pointing somewhere other than canonical dir.
+	require.NoError(t, os.MkdirAll(filepath.Join(tmp, ".claude"), 0o755))
+	agentSkillsDir := filepath.Join(tmp, ".claude", "skills")
+	require.NoError(t, os.MkdirAll(agentSkillsDir, 0o755))
+	externalLink := filepath.Join(agentSkillsDir, "databricks-sql")
+	require.NoError(t, os.Symlink("/some/other/place", externalLink))
+
+	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
+	err := UninstallSkills(ctx)
+	require.NoError(t, err)
+
+	// Symlink pointing outside canonical dir should be preserved.
+	_, err = os.Lstat(externalLink)
+	assert.NoError(t, err, "symlink to external path should not be removed")
+	assert.Contains(t, stderr.String(), "Uninstalled 1 skill.")
+}
+
+func TestUninstallLeavesNonSymlinkDirectories(t *testing.T) {
+	tmp := setupTestHome(t)
+	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
+
+	state := &InstallState{
+		SchemaVersion: 1,
+		Release:       "v0.1.0",
+		LastUpdated:   time.Now(),
+		Skills: map[string]string{
+			"databricks-sql": "0.1.0",
+		},
+	}
+	require.NoError(t, SaveState(globalDir, state))
+
+	// Create a regular directory (not symlink) in agent skills dir.
+	require.NoError(t, os.MkdirAll(filepath.Join(tmp, ".claude"), 0o755))
+	agentSkillsDir := filepath.Join(tmp, ".claude", "skills")
+	regularDir := filepath.Join(agentSkillsDir, "databricks-sql")
+	require.NoError(t, os.MkdirAll(regularDir, 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(regularDir, "custom.md"), []byte("custom"), 0o644))
+
+	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
+	err := UninstallSkills(ctx)
+	require.NoError(t, err)
+
+	// Regular directory should be preserved (not a symlink to canonical dir).
+	_, err = os.Stat(regularDir)
+	assert.NoError(t, err, "regular directory should not be removed")
+	assert.Contains(t, stderr.String(), "Uninstalled 1 skill.")
+}
+
+func TestUninstallSelectiveRemovesOnlyNamedSkills(t *testing.T) {
+	tmp := setupTestHome(t)
+	globalDir := installTestSkills(t, tmp)
+
+	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
+	err := UninstallSkillsOpts(ctx, UninstallOptions{Skills: []string{"databricks-sql"}})
+	require.NoError(t, err)
+
+	// databricks-sql should be gone.
+	_, err = os.Stat(filepath.Join(globalDir, "databricks-sql"))
+	assert.ErrorIs(t, err, fs.ErrNotExist)
+
+	// databricks-jobs should still exist.
+	_, err = os.Stat(filepath.Join(globalDir, "databricks-jobs"))
+	assert.NoError(t, err)
+
+	// State should still exist with remaining skill.
+	state, err := LoadState(globalDir)
+	require.NoError(t, err)
+	require.NotNil(t, state)
+	assert.Len(t, state.Skills, 1)
+	assert.Contains(t, state.Skills, "databricks-jobs")
+
+	assert.Contains(t, stderr.String(), "Uninstalled 1 skill.")
+}
+
+func TestUninstallSelectiveUnknownSkillErrors(t *testing.T) {
+	tmp := setupTestHome(t)
+	installTestSkills(t, tmp)
+
+	ctx := cmdio.MockDiscard(t.Context())
+	err := UninstallSkillsOpts(ctx, UninstallOptions{Skills: []string{"nonexistent"}})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "not installed")
+}
+
+func TestUninstallSelectiveDuplicateNamesDeduplicates(t *testing.T) {
+	tmp := setupTestHome(t)
+	globalDir := installTestSkills(t, tmp)
+
+	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
+	// Pass duplicate: should only remove databricks-sql once, not wipe state.
+	err := UninstallSkillsOpts(ctx, UninstallOptions{Skills: []string{"databricks-sql", "databricks-sql"}})
+	require.NoError(t, err)
+
+	// databricks-sql should be gone.
+	_, err = os.Stat(filepath.Join(globalDir, "databricks-sql"))
+	assert.ErrorIs(t, err, fs.ErrNotExist)
+
+	// databricks-jobs should still exist.
+	_, err = os.Stat(filepath.Join(globalDir, "databricks-jobs"))
+	assert.NoError(t, err, "other skills must not be removed")
+
+	// State should still exist with remaining skill.
+	state, err := LoadState(globalDir)
+	require.NoError(t, err)
+	require.NotNil(t, state, "state file must not be deleted when other skills remain")
+	assert.Len(t, state.Skills, 1)
+	assert.Contains(t, state.Skills, "databricks-jobs")
+
+	assert.Contains(t, stderr.String(), "Uninstalled 1 skill.")
+}
+
+func TestUninstallSelectiveAllRemovesStateFile(t *testing.T) {
+	tmp := setupTestHome(t)
+	globalDir := installTestSkills(t, tmp)
+
+	ctx, _ := cmdio.NewTestContextWithStderr(t.Context())
+	err := UninstallSkillsOpts(ctx, UninstallOptions{Skills: []string{"databricks-sql", "databricks-jobs"}})
+	require.NoError(t, err)
+
+	// State file should be gone since all skills were removed.
+	_, err = os.Stat(filepath.Join(globalDir, ".state.json"))
+	assert.ErrorIs(t, err, fs.ErrNotExist)
+}
+
+func TestUninstallTargetedAgentKeepsRemainingRawExposure(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx := cmdio.MockDiscard(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+	require.NoError(t, os.MkdirAll(filepath.Join(tmp, ".claude"), 0o755))
+	require.NoError(t, os.MkdirAll(filepath.Join(tmp, ".cursor"), 0o755))
+
+	claudeAgent := agents.ByName(agents.NameClaudeCode)
+	cursorAgent := agents.ByName(agents.NameCursor)
+	src := &mockManifestSource{manifest: testManifest()}
+	require.NoError(t, InstallSkillsForAgents(ctx, src, []*agents.Agent{claudeAgent, cursorAgent}, InstallOptions{}))
+
+	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
+	cursorLink := filepath.Join(tmp, ".cursor", "skills", "databricks-sql")
+	claudeLink := filepath.Join(tmp, ".claude", "skills", "databricks-sql")
+	require.NoError(t, UninstallSkillsOpts(ctx, UninstallOptions{Agents: []string{agents.NameCursor}, Skills: []string{"databricks-sql"}}))
+
+	_, err := os.Lstat(cursorLink)
+	assert.ErrorIs(t, err, fs.ErrNotExist)
+	_, err = os.Lstat(claudeLink)
+	assert.NoError(t, err)
+	_, err = os.Stat(filepath.Join(globalDir, "databricks-sql"))
+	assert.NoError(t, err)
+
+	state, err := LoadState(globalDir)
+	require.NoError(t, err)
+	require.NotNil(t, state)
+	assert.Contains(t, state.Skills, "databricks-sql")
+}
+
+func TestUninstallTargetedAgentRemovesCanonicalWhenNoExposureRemains(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx := cmdio.MockDiscard(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+	require.NoError(t, os.MkdirAll(filepath.Join(tmp, ".cursor"), 0o755))
+
+	cursorAgent := agents.ByName(agents.NameCursor)
+	src := &mockManifestSource{manifest: testManifest()}
+	require.NoError(t, InstallSkillsForAgents(ctx, src, []*agents.Agent{cursorAgent}, InstallOptions{SpecificSkills: []string{"databricks-sql"}}))
+
+	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
+	cursorDir := filepath.Join(tmp, ".cursor", "skills", "databricks-sql")
+	require.NoError(t, UninstallSkillsOpts(ctx, UninstallOptions{Agents: []string{agents.NameCursor}, Skills: []string{"databricks-sql"}}))
+
+	_, err := os.Stat(cursorDir)
+	assert.ErrorIs(t, err, fs.ErrNotExist)
+	_, err = os.Stat(filepath.Join(globalDir, "databricks-sql"))
+	assert.ErrorIs(t, err, fs.ErrNotExist)
+	state, err := LoadState(globalDir)
+	require.NoError(t, err)
+	assert.Nil(t, state)
+}
+
+func TestUninstallTargetedUntrackedSkillGivesRecoveryGuidance(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx := cmdio.MockDiscard(t.Context())
+	require.NoError(t, os.MkdirAll(filepath.Join(tmp, ".cursor", "skills", "databricks-sql"), 0o755))
+
+	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
+	require.NoError(t, SaveState(globalDir, &InstallState{
+		SchemaVersion: schemaVersionV2,
+		Skills:        map[string]string{"databricks-jobs": "0.1.0"},
+	}))
+
+	err := UninstallSkillsOpts(ctx, UninstallOptions{Agents: []string{agents.NameCursor}, Skills: []string{"databricks-sql"}})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "not tracked in Databricks aitools state")
+	assert.Contains(t, err.Error(), "Cursor")
+	assert.Contains(t, err.Error(), "install --skills-only --agents cursor")
+}
diff --git a/libs/aitools/installer/update.go b/libs/aitools/installer/update.go
new file mode 100644
index 00000000000..5fa183e0eae
--- /dev/null
+++ b/libs/aitools/installer/update.go
@@ -0,0 +1,528 @@
+package installer
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io/fs"
+	"maps"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+	"time"
+
+	"github.com/databricks/cli/internal/build"
+	"github.com/databricks/cli/libs/aitools/agents"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/env"
+	"github.com/databricks/cli/libs/log"
+	"golang.org/x/mod/semver"
+)
+
+// UpdateOptions controls the behavior of UpdateSkills.
+type UpdateOptions struct {
+	Force   bool
+	NoNew   bool
+	NoPrune bool     // keep skills that vanished from the manifest instead of removing them
+	Check   bool     // dry run: show what would change without downloading
+	Skills  []string // empty = all installed
+	Scope   string   // ScopeGlobal or ScopeProject (default: global)
+}
+
+// UpdateResult describes what UpdateSkills did (or would do in check mode).
+type UpdateResult struct {
+	Updated   []SkillUpdate // skills that were updated
+	Added     []SkillUpdate // new skills added (when NoNew is false)
+	Removed   []SkillUpdate // skills pruned because they vanished from the manifest
+	Unchanged []string      // skills at current version (or kept despite vanishing)
+	Skipped   []string      // skills skipped (experimental, version constraint)
+}
+
+// SkillUpdate describes a single skill version change.
+type SkillUpdate struct {
+	Name       string
+	OldVersion string
+	NewVersion string
+}
+
+// UpdateSkills updates installed skills to the latest release.
+func UpdateSkills(ctx context.Context, src ManifestSource, targetAgents []*agents.Agent, opts UpdateOptions) (*UpdateResult, error) {
+	scope := opts.Scope
+	if scope == "" {
+		scope = ScopeGlobal
+	}
+
+	baseDir, err := skillsDir(ctx, scope)
+	if err != nil {
+		return nil, err
+	}
+
+	// For project scope, filter to compatible agents.
+	var cwd string
+	if scope == ScopeProject {
+		cwd, err = os.Getwd()
+		if err != nil {
+			return nil, fmt.Errorf("failed to determine working directory: %w", err)
+		}
+		incompatible := incompatibleAgentNames(targetAgents)
+		targetAgents = filterProjectAgents(ctx, targetAgents)
+		if len(targetAgents) == 0 {
+			return nil, fmt.Errorf("no agents support project-scoped skills. The following detected agents are global-only: %s", strings.Join(incompatible, ", "))
+		}
+	}
+
+	state, err := LoadState(baseDir)
+	if err != nil {
+		return nil, fmt.Errorf("failed to load install state: %w", err)
+	}
+
+	if state == nil {
+		if scope == ScopeGlobal && hasLegacyInstall(ctx, baseDir) {
+			return nil, errors.New("found skills from a previous install without state tracking; run 'databricks aitools install' to refresh before updating")
+		}
+		return nil, errors.New("no skills or plugins installed. Run 'databricks aitools install' to install")
+	}
+
+	installedRef, allowFallback := installedSkillsRelease(state)
+	latestTag, explicit, err := getSkillsRef(ctx, allowFallback)
+	if err != nil {
+		return nil, err
+	}
+
+	// Short-circuit only when pinned to an exact ref. When tracking latest (the
+	// default), the ref ("main") never changes, so always reconcile against the
+	// freshly fetched manifest instead of falsely reporting "already up to date".
+	if explicit && state.Release == latestTag && !opts.Force {
+		cmdio.LogString(ctx, "Already up to date.")
+		return &UpdateResult{Unchanged: slices.Sorted(maps.Keys(state.Skills))}, nil
+	}
+
+	manifest, latestTag, err := FetchSkillsManifestWithFallback(ctx, src, latestTag, allowFallback && !explicit)
+	if err != nil {
+		if opts.Check {
+			log.Warnf(ctx, "Could not fetch manifest: %v", err)
+			return &UpdateResult{}, nil
+		}
+		return nil, err
+	}
+	if err := checkSkillsDowngrade(installedRef, latestTag, explicit); err != nil {
+		return nil, err
+	}
+
+	// Determine the skill set to consider.
+	skillSet := buildUpdateSkillSet(state, manifest, opts)
+
+	result := &UpdateResult{}
+
+	cliVersion := build.GetInfo().Version
+	isDev := build.GetInfo().IsDevelopment()
+
+	// Sort skill names for deterministic output.
+	names := slices.Sorted(maps.Keys(skillSet))
+
+	for _, name := range names {
+		meta, inManifest := manifest.Skills[name]
+
+		if !inManifest {
+			if _, ok := state.Skills[name]; ok {
+				// The skill vanished from the manifest. Prune it only when we
+				// installed it and the user hasn't modified it since; otherwise
+				// keep it with a warning so we never delete user-edited content.
+				if !opts.NoPrune && skillPrunable(ctx, baseDir, name, scope, cwd, state) {
+					result.Removed = append(result.Removed, SkillUpdate{Name: name, OldVersion: state.Skills[name]})
+				} else {
+					log.Warnf(ctx, "Warning: %q not found in manifest %s (keeping installed version).", name, latestTag)
+					result.Unchanged = append(result.Unchanged, name)
+				}
+			}
+			continue
+		}
+
+		// Filter experimental skills unless state opted in.
+		if meta.IsExperimental() && !state.IncludeExperimental {
+			log.Debugf(ctx, "Skipping experimental skill %s", name)
+			result.Skipped = append(result.Skipped, name)
+			continue
+		}
+
+		// Filter skills requiring a newer CLI version.
+		if meta.MinCLIVer != "" && !isDev && semver.Compare("v"+cliVersion, "v"+meta.MinCLIVer) < 0 {
+			log.Warnf(ctx, "Skipping %s: requires CLI version %s (running %s)", name, meta.MinCLIVer, cliVersion)
+			result.Skipped = append(result.Skipped, name)
+			continue
+		}
+
+		oldVersion, wasInstalled := state.Skills[name]
+
+		if meta.Version == oldVersion && stateRepoDir(state, name) == meta.RepoDir && !opts.Force {
+			result.Unchanged = append(result.Unchanged, name)
+			continue
+		}
+
+		update := SkillUpdate{
+			Name:       name,
+			OldVersion: oldVersion,
+			NewVersion: meta.Version,
+		}
+
+		if wasInstalled {
+			result.Updated = append(result.Updated, update)
+		} else {
+			result.Added = append(result.Added, update)
+		}
+	}
+
+	if opts.Check {
+		return result, nil
+	}
+
+	// Download and install updated/added skills.
+	allChanges := make([]SkillUpdate, 0, len(result.Updated)+len(result.Added))
+	allChanges = append(allChanges, result.Updated...)
+	allChanges = append(allChanges, result.Added...)
+
+	params := installParams{
+		baseDir: baseDir,
+		scope:   scope,
+		cwd:     cwd,
+		ref:     latestTag,
+	}
+
+	sp := cmdio.NewSpinner(ctx)
+	defer sp.Close()
+
+	fileRecords := map[string]FileRecord{}
+	for _, change := range allChanges {
+		meta := manifest.Skills[change.Name]
+		sp.Update("Installing " + change.Name + "...")
+		records, err := installSkillForAgents(ctx, change.Name, meta, targetAgents, params)
+		if err != nil {
+			return nil, err
+		}
+		maps.Copy(fileRecords, records)
+	}
+	sp.Close()
+
+	// Update state.
+	state.Release = latestTag
+	state.LastUpdated = time.Now()
+	if state.RepoDirs == nil {
+		state.RepoDirs = make(map[string]string, len(state.Skills)+len(allChanges))
+	}
+	if state.Files == nil {
+		state.Files = make(map[string]FileRecord, len(fileRecords))
+	}
+	for _, change := range allChanges {
+		meta := manifest.Skills[change.Name]
+		state.Skills[change.Name] = change.NewVersion
+		state.RepoDirs[change.Name] = meta.RepoDir
+		// Drop stale provenance before recording the refetched files, so a file
+		// removed/renamed in the new version doesn't leave an orphaned record.
+		clearFileRecords(state.Files, change.Name)
+	}
+	maps.Copy(state.Files, fileRecords)
+
+	// Prune skills that vanished from the manifest (and that the user hasn't
+	// modified, as decided above). Removes our symlinks and unmodified copies
+	// from every agent plus the canonical copy; user-managed dirs are left alone.
+	for _, rem := range result.Removed {
+		removeSkillExposures(ctx, baseDir, rem.Name, scope, cwd, state)
+		delete(state.Skills, rem.Name)
+		delete(state.RepoDirs, rem.Name)
+		for path := range state.Files {
+			if strings.HasPrefix(path, rem.Name+"/") {
+				delete(state.Files, path)
+			}
+		}
+	}
+
+	if err := SaveState(baseDir, state); err != nil {
+		return nil, err
+	}
+
+	return result, nil
+}
+
+// buildUpdateSkillSet determines which skills to consider for update.
+func buildUpdateSkillSet(state *InstallState, manifest *Manifest, opts UpdateOptions) map[string]bool {
+	skillSet := make(map[string]bool)
+
+	if len(opts.Skills) > 0 {
+		for _, name := range opts.Skills {
+			skillSet[name] = true
+		}
+		return skillSet
+	}
+
+	// All installed skills.
+	for name := range state.Skills {
+		skillSet[name] = true
+	}
+
+	// Auto-add new skills from manifest (unless --no-new).
+	if !opts.NoNew {
+		for name := range manifest.Skills {
+			skillSet[name] = true
+		}
+	}
+
+	return skillSet
+}
+
+// hasLegacyInstall checks both canonical and legacy dirs for skills on disk without state.
+func hasLegacyInstall(ctx context.Context, globalDir string) bool {
+	if hasSkillsOnDisk(globalDir) {
+		return true
+	}
+	homeDir, err := env.UserHomeDir(ctx)
+	if err != nil {
+		return false
+	}
+	return hasSkillsOnDisk(filepath.Join(homeDir, ".databricks", "agent-skills"))
+}
+
+// skillFilesUnmodified reports whether every file the CLI recorded for a skill
+// still exists in the canonical dir and matches its recorded sha256. Returns
+// false when there is no recorded provenance (e.g. a legacy v1 install), so the
+// caller keeps such skills rather than risk deleting user content.
+// skillPrunable reports whether a vanished skill can be safely removed: the
+// canonical copy and every agent exposure (symlink into canonical, or a copied
+// dir) must be ours and unmodified. If anything is user-modified, has extra
+// files, or has no recorded provenance, the skill is kept (the caller warns).
+func skillPrunable(ctx context.Context, baseDir, skillName, scope, cwd string, state *InstallState) bool {
+	canonicalDir := filepath.Join(baseDir, skillName)
+	if !dirMatchesRecords(canonicalDir, skillName, state) {
+		return false
+	}
+	for _, agent := range agents.Registry {
+		if scope == ScopeProject && !agent.SupportsProjectScope {
+			continue
+		}
+		agentDir, err := agentSkillsDirForScope(ctx, agent, scope, cwd)
+		if err != nil {
+			continue
+		}
+		if !exposureRemovable(filepath.Join(agentDir, skillName), canonicalDir, skillName, state) {
+			return false
+		}
+	}
+	return true
+}
+
+// removeSkillExposures removes a skill's exposure from every scoped agent (a
+// symlink into canonical, or our unmodified copy) plus the canonical dir. Only
+// call after skillPrunable has confirmed everything is removable.
+func removeSkillExposures(ctx context.Context, baseDir, skillName, scope, cwd string, state *InstallState) {
+	canonicalDir := filepath.Join(baseDir, skillName)
+	for _, agent := range agents.Registry {
+		if scope == ScopeProject && !agent.SupportsProjectScope {
+			continue
+		}
+		agentDir, err := agentSkillsDirForScope(ctx, agent, scope, cwd)
+		if err != nil {
+			continue
+		}
+		entry := filepath.Join(agentDir, skillName)
+		if !exposureRemovable(entry, canonicalDir, skillName, state) {
+			continue
+		}
+		// RemoveAll on a symlink removes the link, not its target.
+		if err := os.RemoveAll(entry); err != nil {
+			log.Warnf(ctx, "Failed to remove %s: %v", entry, err)
+		}
+	}
+	if err := os.RemoveAll(canonicalDir); err != nil {
+		log.Warnf(ctx, "Failed to remove %s: %v", canonicalDir, err)
+	}
+}
+
+// exposureRemovable reports whether an agent's skill entry is ours and safe to
+// remove: absent, a symlink into canonicalDir, or a copied dir whose contents
+// exactly match the recorded checksums.
+func exposureRemovable(entry, canonicalDir, skillName string, state *InstallState) bool {
+	fi, err := os.Lstat(entry)
+	if errors.Is(err, fs.ErrNotExist) {
+		return true
+	}
+	if err != nil {
+		return false
+	}
+	if fi.Mode()&os.ModeSymlink != 0 {
+		target, err := os.Readlink(entry)
+		if err != nil {
+			return false
+		}
+		abs := target
+		if !filepath.IsAbs(target) {
+			abs = filepath.Clean(filepath.Join(filepath.Dir(entry), target))
+		}
+		return abs == canonicalDir || strings.HasPrefix(abs, canonicalDir+string(os.PathSeparator))
+	}
+	if fi.IsDir() {
+		return dirMatchesRecords(entry, skillName, state)
+	}
+	return false
+}
+
+// dirMatchesRecords reports whether dir contains exactly the files recorded for
+// skillName, each with its recorded sha256 (no missing, modified, or extra
+// files). Returns false when there is no recorded provenance, so unverifiable
+// content is never deleted.
+func dirMatchesRecords(dir, skillName string, state *InstallState) bool {
+	if state == nil {
+		return false
+	}
+	prefix := skillName + "/"
+	recorded := map[string]string{}
+	for path, rec := range state.Files {
+		if after, ok := strings.CutPrefix(path, prefix); ok {
+			recorded[after] = rec.SHA256
+		}
+	}
+	if len(recorded) == 0 {
+		return false
+	}
+
+	seen := 0
+	matched := true
+	walkErr := filepath.WalkDir(dir, func(p string, d fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		if d.IsDir() {
+			return nil
+		}
+		rel, err := filepath.Rel(dir, p)
+		if err != nil {
+			return err
+		}
+		want, ok := recorded[filepath.ToSlash(rel)]
+		if !ok {
+			matched = false // a file we didn't write -> not ours, keep
+			return filepath.SkipAll
+		}
+		data, err := os.ReadFile(p)
+		if err != nil {
+			return err
+		}
+		sum := sha256.Sum256(data)
+		if hex.EncodeToString(sum[:]) != want {
+			matched = false
+			return filepath.SkipAll
+		}
+		seen++
+		return nil
+	})
+	if walkErr != nil || !matched {
+		return false
+	}
+	return seen == len(recorded)
+}
+
+// PluginUpdate records that a plugin was updated for an agent.
+type PluginUpdate struct {
+	Agent   string
+	Version string
+}
+
+// UpdateInstalledPlugins runs the plugin update for every plugin recorded in the
+// given scope's state, bumping each record's version to ref. A plugin that can't
+// be updated (CLI missing, etc.) is skipped with a warning, never failed, to
+// keep the non-interactive update prompt-free and exit-0 on partial success.
+func UpdateInstalledPlugins(ctx context.Context, scope, ref string) ([]PluginUpdate, error) {
+	dir, err := skillsDir(ctx, scope)
+	if err != nil {
+		return nil, err
+	}
+	state, err := LoadState(dir)
+	if err != nil {
+		return nil, err
+	}
+	if state == nil || len(state.Plugins) == 0 {
+		return nil, nil
+	}
+
+	version := DisplaySkillsVersion(ref)
+	var updated []PluginUpdate
+	for _, name := range slices.Sorted(maps.Keys(state.Plugins)) {
+		agent := agents.ByName(name)
+		if agent == nil {
+			log.Warnf(ctx, "Skipping unknown agent %q in state", name)
+			continue
+		}
+		rec := state.Plugins[name]
+		if err := UpdatePluginForAgent(ctx, agent, rec); err != nil {
+			log.Warnf(ctx, "Skipped %s: %v", agent.DisplayName, err)
+			continue
+		}
+		rec.Version = version
+		state.Plugins[name] = rec
+		updated = append(updated, PluginUpdate{Agent: agent.DisplayName, Version: version})
+	}
+
+	if len(updated) > 0 {
+		state.LastUpdated = time.Now()
+		if err := SaveState(dir, state); err != nil {
+			return nil, err
+		}
+	}
+	return updated, nil
+}
+
+// FormatUpdateResult returns a human-readable summary of the update result.
+// When check is true, output uses "Would update/add" instead of "Updated/Added".
+func FormatUpdateResult(result *UpdateResult, check bool) string {
+	var lines []string
+
+	updateVerb := "updated"
+	addVerb := "added"
+	removeVerb := "removed"
+	summaryVerb := "Updated"
+	removeSummaryVerb := "Removed"
+	if check {
+		updateVerb = "would update"
+		addVerb = "would add"
+		removeVerb = "would remove"
+		summaryVerb = "Would update"
+		removeSummaryVerb = "Would remove"
+	}
+
+	for _, u := range result.Updated {
+		if u.OldVersion == "" {
+			lines = append(lines, fmt.Sprintf("  %s %s -> v%s", updateVerb, u.Name, u.NewVersion))
+		} else {
+			lines = append(lines, fmt.Sprintf("  %s %s v%s -> v%s", updateVerb, u.Name, u.OldVersion, u.NewVersion))
+		}
+	}
+
+	for _, a := range result.Added {
+		lines = append(lines, fmt.Sprintf("  %s %s v%s", addVerb, a.Name, a.NewVersion))
+	}
+
+	for _, r := range result.Removed {
+		lines = append(lines, fmt.Sprintf("  %s %s (no longer in this release)", removeVerb, r.Name))
+	}
+
+	total := len(result.Updated) + len(result.Added)
+	if total == 0 && len(result.Removed) == 0 {
+		return "No changes."
+	}
+
+	if total > 0 {
+		lines = append(lines, fmt.Sprintf("%s %d %s.", summaryVerb, total, skillNoun(total)))
+	}
+	if len(result.Removed) > 0 {
+		lines = append(lines, fmt.Sprintf("%s %d %s.", removeSummaryVerb, len(result.Removed), skillNoun(len(result.Removed))))
+	}
+	return strings.Join(lines, "\n")
+}
+
+func skillNoun(n int) string {
+	if n == 1 {
+		return "skill"
+	}
+	return "skills"
+}
diff --git a/libs/aitools/installer/update_test.go b/libs/aitools/installer/update_test.go
new file mode 100644
index 00000000000..2a9326e4f82
--- /dev/null
+++ b/libs/aitools/installer/update_test.go
@@ -0,0 +1,699 @@
+package installer
+
+import (
+	"bytes"
+	"context"
+	"io/fs"
+	"log/slog"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/databricks/cli/libs/aitools/agents"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/log"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestUpdateNoStateReturnsInstallHint(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx := cmdio.MockDiscard(t.Context())
+	_ = tmp
+
+	src := &mockManifestSource{manifest: testManifest()}
+	_, err := UpdateSkills(ctx, src, nil, UpdateOptions{})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "no skills or plugins installed")
+	assert.Contains(t, err.Error(), "databricks aitools install")
+}
+
+func TestUpdateLegacyInstallDetected(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx := cmdio.MockDiscard(t.Context())
+
+	// Create skills in canonical location but no state file.
+	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
+	require.NoError(t, os.MkdirAll(filepath.Join(globalDir, "databricks-sql"), 0o755))
+
+	src := &mockManifestSource{manifest: testManifest()}
+	_, err := UpdateSkills(ctx, src, nil, UpdateOptions{})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "previous install without state tracking")
+	assert.Contains(t, err.Error(), "refresh before updating")
+}
+
+func TestUpdateAlreadyUpToDate(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+
+	// Install first.
+	src := &mockManifestSource{manifest: testManifest()}
+	agent := testAgent(tmp)
+	require.NoError(t, InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{}))
+
+	// Reset stderr.
+	stderr.Reset()
+
+	// Update with same release.
+	result, err := UpdateSkills(ctx, src, []*agents.Agent{agent}, UpdateOptions{})
+	require.NoError(t, err)
+	assert.Contains(t, stderr.String(), "Already up to date.")
+	assert.Len(t, result.Unchanged, 2)
+	assert.Empty(t, result.Updated)
+	assert.Empty(t, result.Added)
+}
+
+func TestUpdateSkillsFallbackVersions(t *testing.T) {
+	for _, force := range []bool{false, true} {
+		name := "normal"
+		if force {
+			name = "force"
+		}
+		t.Run(name, func(t *testing.T) {
+			testSkillsFallbackVersions(t, func(ctx context.Context, src ManifestSource, targetAgents []*agents.Agent) error {
+				_, err := UpdateSkills(ctx, src, targetAgents, UpdateOptions{Force: force})
+				return err
+			})
+		})
+	}
+}
+
+func TestUpdateSkillsRefSelection(t *testing.T) {
+	testSkillsRefSelection(t, func(ctx context.Context, src ManifestSource, targetAgents []*agents.Agent) error {
+		_, err := UpdateSkills(ctx, src, targetAgents, UpdateOptions{})
+		return err
+	})
+}
+
+func TestUpdateVersionDiffDetected(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx := cmdio.MockDiscard(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+
+	// Install with default ref.
+	src := &mockManifestSource{manifest: testManifest()}
+	agent := testAgent(tmp)
+	require.NoError(t, InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{}))
+
+	// Simulate a new release by changing the ref.
+	t.Setenv("DATABRICKS_SKILLS_REF", "v0.2.0")
+
+	// Updated manifest with new version for one skill.
+	updatedManifest := testManifest()
+	updatedManifest.Skills["databricks-sql"] = SkillMeta{
+		Version: "0.2.0",
+		Files:   []string{"SKILL.md"},
+	}
+	src2 := &mockManifestSource{manifest: updatedManifest}
+
+	result, err := UpdateSkills(ctx, src2, []*agents.Agent{agent}, UpdateOptions{})
+	require.NoError(t, err)
+
+	require.Len(t, result.Updated, 1)
+	assert.Equal(t, "databricks-sql", result.Updated[0].Name)
+	assert.Equal(t, "0.1.0", result.Updated[0].OldVersion)
+	assert.Equal(t, "0.2.0", result.Updated[0].NewVersion)
+
+	// databricks-jobs unchanged.
+	assert.Contains(t, result.Unchanged, "databricks-jobs")
+
+	// State should be updated.
+	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
+	state, err := LoadState(globalDir)
+	require.NoError(t, err)
+	assert.Equal(t, "v0.2.0", state.Release)
+	assert.Equal(t, "0.2.0", state.Skills["databricks-sql"])
+}
+
+func TestUpdateCheckDryRun(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx := cmdio.MockDiscard(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+
+	// Install with default ref.
+	src := &mockManifestSource{manifest: testManifest()}
+	agent := testAgent(tmp)
+	require.NoError(t, InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{}))
+
+	// Simulate a new release.
+	t.Setenv("DATABRICKS_SKILLS_REF", "v0.2.0")
+
+	// Updated manifest.
+	updatedManifest := testManifest()
+	updatedManifest.Skills["databricks-sql"] = SkillMeta{
+		Version: "0.2.0",
+		Files:   []string{"SKILL.md"},
+	}
+	src2 := &mockManifestSource{manifest: updatedManifest}
+
+	// Track fetch calls to verify no downloads happen.
+	fetchCalls := 0
+	orig := fetchFileFn
+	t.Cleanup(func() { fetchFileFn = orig })
+	fetchFileFn = func(_ context.Context, _, _, _, _ string) ([]byte, error) {
+		fetchCalls++
+		return []byte("content"), nil
+	}
+
+	result, err := UpdateSkills(ctx, src2, []*agents.Agent{agent}, UpdateOptions{Check: true})
+	require.NoError(t, err)
+
+	// Should report the diff.
+	require.Len(t, result.Updated, 1)
+	assert.Equal(t, "databricks-sql", result.Updated[0].Name)
+
+	// Should NOT have downloaded anything.
+	assert.Equal(t, 0, fetchCalls)
+
+	// State should be unchanged (still the original install ref).
+	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
+	state, err := LoadState(globalDir)
+	require.NoError(t, err)
+	assert.Equal(t, testSkillsRef, state.Release)
+}
+
+func TestUpdateForceRedownloads(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx := cmdio.MockDiscard(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+
+	// Install v0.1.0.
+	src := &mockManifestSource{manifest: testManifest()}
+	agent := testAgent(tmp)
+	require.NoError(t, InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{}))
+
+	// Track fetch calls on forced update (same release).
+	fetchCalls := 0
+	orig := fetchFileFn
+	t.Cleanup(func() { fetchFileFn = orig })
+	fetchFileFn = func(_ context.Context, _, _, _, _ string) ([]byte, error) {
+		fetchCalls++
+		return []byte("content"), nil
+	}
+
+	result, err := UpdateSkills(ctx, src, []*agents.Agent{agent}, UpdateOptions{Force: true})
+	require.NoError(t, err)
+
+	// All skills should be in Updated since Force re-downloads everything.
+	assert.Len(t, result.Updated, 2)
+	assert.Positive(t, fetchCalls, "force should trigger downloads")
+}
+
+func TestUpdateAutoAddsNewSkills(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx := cmdio.MockDiscard(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+
+	// Install with default ref.
+	src := &mockManifestSource{manifest: testManifest()}
+	agent := testAgent(tmp)
+	require.NoError(t, InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{}))
+
+	// Simulate a new release.
+	t.Setenv("DATABRICKS_SKILLS_REF", "v0.2.0")
+
+	// New manifest with an additional skill.
+	updatedManifest := testManifest()
+	updatedManifest.Skills["databricks-notebooks"] = SkillMeta{
+		Version: "0.1.0",
+		Files:   []string{"SKILL.md"},
+	}
+	src2 := &mockManifestSource{manifest: updatedManifest}
+
+	result, err := UpdateSkills(ctx, src2, []*agents.Agent{agent}, UpdateOptions{})
+	require.NoError(t, err)
+
+	// The new skill should be in Added.
+	require.Len(t, result.Added, 1)
+	assert.Equal(t, "databricks-notebooks", result.Added[0].Name)
+	assert.Equal(t, "0.1.0", result.Added[0].NewVersion)
+
+	// State should include the new skill.
+	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
+	state, err := LoadState(globalDir)
+	require.NoError(t, err)
+	assert.Equal(t, "0.1.0", state.Skills["databricks-notebooks"])
+}
+
+func TestUpdateNoNewIgnoresNewSkills(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx := cmdio.MockDiscard(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+
+	// Install with default ref.
+	src := &mockManifestSource{manifest: testManifest()}
+	agent := testAgent(tmp)
+	require.NoError(t, InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{}))
+
+	// Simulate a new release.
+	t.Setenv("DATABRICKS_SKILLS_REF", "v0.2.0")
+
+	// New manifest with an additional skill.
+	updatedManifest := testManifest()
+	updatedManifest.Skills["databricks-notebooks"] = SkillMeta{
+		Version: "0.1.0",
+		Files:   []string{"SKILL.md"},
+	}
+	src2 := &mockManifestSource{manifest: updatedManifest}
+
+	result, err := UpdateSkills(ctx, src2, []*agents.Agent{agent}, UpdateOptions{NoNew: true})
+	require.NoError(t, err)
+
+	// No new skills should be added.
+	assert.Empty(t, result.Added)
+	// Existing skills should be unchanged (same version).
+	assert.Len(t, result.Unchanged, 2)
+
+	// State should NOT include the new skill.
+	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
+	state, err := LoadState(globalDir)
+	require.NoError(t, err)
+	assert.NotContains(t, state.Skills, "databricks-notebooks")
+}
+
+func TestUpdateOutputSortedAlphabetically(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx := cmdio.MockDiscard(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+
+	// Install with skills.
+	src := &mockManifestSource{manifest: testManifest()}
+	agent := testAgent(tmp)
+	require.NoError(t, InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{}))
+
+	// Simulate a new release.
+	t.Setenv("DATABRICKS_SKILLS_REF", "v0.2.0")
+
+	// Update all skills.
+	updatedManifest := testManifest()
+	updatedManifest.Skills["databricks-sql"] = SkillMeta{Version: "0.2.0", Files: []string{"SKILL.md"}}
+	updatedManifest.Skills["databricks-jobs"] = SkillMeta{Version: "0.2.0", Files: []string{"SKILL.md"}}
+	src2 := &mockManifestSource{manifest: updatedManifest}
+
+	result, err := UpdateSkills(ctx, src2, []*agents.Agent{agent}, UpdateOptions{})
+	require.NoError(t, err)
+
+	require.Len(t, result.Updated, 2)
+	assert.Equal(t, "databricks-jobs", result.Updated[0].Name)
+	assert.Equal(t, "databricks-sql", result.Updated[1].Name)
+}
+
+// installThenVanish installs the two-skill testManifest and returns the global
+// canonical dir plus a manifest source where databricks-jobs has been removed.
+func installThenVanish(t *testing.T, ctx context.Context, tmp string) (string, ManifestSource) {
+	t.Helper()
+	src := &mockManifestSource{manifest: testManifest()}
+	agent := testAgent(tmp)
+	require.NoError(t, InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{}))
+
+	t.Setenv("DATABRICKS_SKILLS_REF", "v0.2.0")
+	updated := &Manifest{
+		Version:   "1",
+		UpdatedAt: "2024-02-01",
+		Skills: map[string]SkillMeta{
+			"databricks-sql": {Version: "0.2.0", Files: []string{"SKILL.md"}},
+		},
+	}
+	return filepath.Join(tmp, ".databricks", "aitools", "skills"), &mockManifestSource{manifest: updated}
+}
+
+func TestUpdatePrunesVanishedUnmodifiedSkill(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx := cmdio.MockDiscard(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+
+	globalDir, src2 := installThenVanish(t, ctx, tmp)
+	agent := testAgent(tmp)
+
+	result, err := UpdateSkills(ctx, src2, []*agents.Agent{agent}, UpdateOptions{})
+	require.NoError(t, err)
+
+	require.Len(t, result.Removed, 1)
+	assert.Equal(t, "databricks-jobs", result.Removed[0].Name)
+
+	state, err := LoadState(globalDir)
+	require.NoError(t, err)
+	assert.NotContains(t, state.Skills, "databricks-jobs")
+	assert.NotContains(t, state.Files, "databricks-jobs/SKILL.md")
+	_, statErr := os.Stat(filepath.Join(globalDir, "databricks-jobs"))
+	assert.ErrorIs(t, statErr, fs.ErrNotExist)
+}
+
+func TestUpdateNoPruneKeepsVanishedSkill(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx := cmdio.MockDiscard(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+
+	globalDir, src2 := installThenVanish(t, ctx, tmp)
+	agent := testAgent(tmp)
+
+	result, err := UpdateSkills(ctx, src2, []*agents.Agent{agent}, UpdateOptions{NoPrune: true})
+	require.NoError(t, err)
+
+	assert.Empty(t, result.Removed)
+	assert.Contains(t, result.Unchanged, "databricks-jobs")
+	state, err := LoadState(globalDir)
+	require.NoError(t, err)
+	assert.Contains(t, state.Skills, "databricks-jobs")
+}
+
+func TestUpdateKeepsModifiedVanishedSkill(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx := cmdio.MockDiscard(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+
+	globalDir, src2 := installThenVanish(t, ctx, tmp)
+	agent := testAgent(tmp)
+
+	// User edits the installed skill: its checksum no longer matches.
+	require.NoError(t, os.WriteFile(filepath.Join(globalDir, "databricks-jobs", "SKILL.md"), []byte("user edit"), 0o644))
+
+	result, err := UpdateSkills(ctx, src2, []*agents.Agent{agent}, UpdateOptions{})
+	require.NoError(t, err)
+
+	assert.Empty(t, result.Removed)
+	assert.Contains(t, result.Unchanged, "databricks-jobs")
+	state, err := LoadState(globalDir)
+	require.NoError(t, err)
+	assert.Contains(t, state.Skills, "databricks-jobs")
+}
+
+func TestUpdateCheckShowsPruneWithoutDeleting(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx := cmdio.MockDiscard(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+
+	globalDir, src2 := installThenVanish(t, ctx, tmp)
+	agent := testAgent(tmp)
+
+	result, err := UpdateSkills(ctx, src2, []*agents.Agent{agent}, UpdateOptions{Check: true})
+	require.NoError(t, err)
+
+	require.Len(t, result.Removed, 1)
+	assert.Equal(t, "databricks-jobs", result.Removed[0].Name)
+	// Check mode does not delete.
+	state, err := LoadState(globalDir)
+	require.NoError(t, err)
+	assert.Contains(t, state.Skills, "databricks-jobs")
+}
+
+func TestUpdatePruneRemovesCopiedAgentExposure(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx := cmdio.MockDiscard(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+	require.NoError(t, os.MkdirAll(filepath.Join(tmp, ".claude"), 0o755))
+
+	// A real registry agent is required so prune (which iterates the registry)
+	// can find and remove the agent's exposure.
+	claude := agents.ByName(agents.NameClaudeCode)
+	require.NotNil(t, claude)
+
+	// One global agent -> the skill is copied into the agent dir, not symlinked.
+	require.NoError(t, InstallSkillsForAgents(ctx, &mockManifestSource{manifest: testManifest()}, []*agents.Agent{claude}, InstallOptions{}))
+	agentCopy := filepath.Join(tmp, ".claude", "skills", "databricks-jobs")
+	_, err := os.Stat(agentCopy)
+	require.NoError(t, err)
+
+	t.Setenv("DATABRICKS_SKILLS_REF", "v0.2.0")
+	updated := &Manifest{Version: "2", Skills: map[string]SkillMeta{
+		"databricks-sql": {Version: "0.2.0", Files: []string{"SKILL.md"}},
+	}}
+	result, err := UpdateSkills(ctx, &mockManifestSource{manifest: updated}, []*agents.Agent{claude}, UpdateOptions{})
+	require.NoError(t, err)
+	require.Len(t, result.Removed, 1)
+
+	// Prune must remove the agent's copy too, not just the canonical dir.
+	_, err = os.Stat(agentCopy)
+	assert.ErrorIs(t, err, fs.ErrNotExist, "the copied exposure must be pruned")
+}
+
+func TestUpdateKeepsVanishedSkillWithExtraCanonicalFile(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx := cmdio.MockDiscard(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+
+	globalDir, src2 := installThenVanish(t, ctx, tmp)
+	agent := testAgent(tmp)
+
+	// An extra file the CLI didn't write means the dir isn't purely ours.
+	require.NoError(t, os.WriteFile(filepath.Join(globalDir, "databricks-jobs", "notes.md"), []byte("mine"), 0o644))
+
+	result, err := UpdateSkills(ctx, src2, []*agents.Agent{agent}, UpdateOptions{})
+	require.NoError(t, err)
+	assert.Empty(t, result.Removed)
+	assert.Contains(t, result.Unchanged, "databricks-jobs")
+}
+
+func TestUpdateSkipsExperimentalSkills(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx := cmdio.MockDiscard(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+
+	// Install with default ref (not experimental).
+	src := &mockManifestSource{manifest: testManifest()}
+	agent := testAgent(tmp)
+	require.NoError(t, InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{}))
+
+	// Simulate a new release.
+	t.Setenv("DATABRICKS_SKILLS_REF", "v0.2.0")
+
+	// New manifest with an experimental skill.
+	updatedManifest := testManifest()
+	updatedManifest.Skills["databricks-iceberg"] = SkillMeta{
+		Version: "0.1.0",
+		Files:   []string{"SKILL.md"},
+		RepoDir: experimentalRepoPath,
+	}
+	src2 := &mockManifestSource{manifest: updatedManifest}
+
+	result, err := UpdateSkills(ctx, src2, []*agents.Agent{agent}, UpdateOptions{})
+	require.NoError(t, err)
+
+	// Experimental skill should be skipped.
+	assert.Contains(t, result.Skipped, "databricks-iceberg")
+	assert.Empty(t, result.Added)
+}
+
+func TestUpdateKeepsNameWhenRepoDirChanges(t *testing.T) {
+	tests := []struct {
+		name              string
+		installedManifest func() *Manifest
+		updatedManifest   func() *Manifest
+		wantRepoDir       string
+	}{
+		{
+			name: "stable to experimental",
+			installedManifest: func() *Manifest {
+				return &Manifest{
+					Version: "1",
+					Skills: map[string]SkillMeta{
+						"databricks-jobs": {Version: "0.1.0", Files: []string{"SKILL.md"}},
+					},
+				}
+			},
+			updatedManifest: func() *Manifest {
+				return &Manifest{
+					Version: "1",
+					Skills: map[string]SkillMeta{
+						"databricks-jobs": {Version: "0.1.0", Files: []string{"SKILL.md"}, RepoDir: experimentalRepoPath},
+					},
+				}
+			},
+			wantRepoDir: experimentalRepoPath,
+		},
+		{
+			name: "experimental to stable",
+			installedManifest: func() *Manifest {
+				return &Manifest{
+					Version: "1",
+					Skills: map[string]SkillMeta{
+						"databricks-jobs": {Version: "0.1.0", Files: []string{"SKILL.md"}, RepoDir: experimentalRepoPath},
+					},
+				}
+			},
+			updatedManifest: func() *Manifest {
+				return &Manifest{
+					Version: "1",
+					Skills: map[string]SkillMeta{
+						"databricks-jobs": {Version: "0.1.0", Files: []string{"SKILL.md"}},
+					},
+				}
+			},
+			wantRepoDir: stableSkillsRepoPath,
+		},
+	}
+
+	for _, tt := range tests {
+		for _, targeted := range []bool{false, true} {
+			mode := "all"
+			opts := UpdateOptions{}
+			if targeted {
+				mode = "targeted"
+				opts.Skills = []string{"databricks-jobs"}
+			}
+
+			t.Run(tt.name+" "+mode, func(t *testing.T) {
+				tmp := setupTestHome(t)
+				ctx := cmdio.MockDiscard(t.Context())
+				setupFetchMock(t)
+				t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+				agent := testAgent(tmp)
+
+				require.NoError(t, InstallSkillsForAgents(
+					ctx, &mockManifestSource{manifest: tt.installedManifest()},
+					[]*agents.Agent{agent}, InstallOptions{IncludeExperimental: true},
+				))
+
+				globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
+				require.DirExists(t, filepath.Join(globalDir, "databricks-jobs"))
+
+				t.Setenv("DATABRICKS_SKILLS_REF", "v0.2.0")
+				result, err := UpdateSkills(
+					ctx, &mockManifestSource{manifest: tt.updatedManifest()},
+					[]*agents.Agent{agent}, opts,
+				)
+				require.NoError(t, err)
+
+				require.Len(t, result.Updated, 1)
+				assert.Equal(t, "databricks-jobs", result.Updated[0].Name)
+				assert.Equal(t, "0.1.0", result.Updated[0].OldVersion)
+				assert.Equal(t, "0.1.0", result.Updated[0].NewVersion)
+				assert.NotContains(t, result.Unchanged, "databricks-jobs")
+				assert.Empty(t, result.Added)
+
+				state, err := LoadState(globalDir)
+				require.NoError(t, err)
+				assert.Equal(t, "0.1.0", state.Skills["databricks-jobs"])
+				assert.Equal(t, tt.wantRepoDir, state.RepoDirs["databricks-jobs"])
+				assert.DirExists(t, filepath.Join(globalDir, "databricks-jobs"))
+			})
+		}
+	}
+}
+
+func TestUpdateRepoDirChangeFromLegacyState(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx := cmdio.MockDiscard(t.Context())
+	agent := testAgent(tmp)
+	t.Setenv("DATABRICKS_SKILLS_REF", "v0.2.0")
+
+	globalDir := filepath.Join(tmp, ".databricks", "aitools", "skills")
+	require.NoError(t, SaveState(globalDir, &InstallState{
+		SchemaVersion:       1,
+		IncludeExperimental: true,
+		Release:             testSkillsRef,
+		Skills: map[string]string{
+			"databricks-jobs": "0.1.0",
+		},
+	}))
+
+	fetchCalls := 0
+	orig := fetchFileFn
+	t.Cleanup(func() { fetchFileFn = orig })
+	fetchFileFn = func(_ context.Context, _, _, _, _ string) ([]byte, error) {
+		fetchCalls++
+		return []byte("content"), nil
+	}
+
+	stableManifest := &Manifest{
+		Version: "1",
+		Skills: map[string]SkillMeta{
+			"databricks-jobs": {Version: "0.1.0", Files: []string{"SKILL.md"}},
+		},
+	}
+	stableResult, err := UpdateSkills(ctx, &mockManifestSource{manifest: stableManifest}, []*agents.Agent{agent}, UpdateOptions{})
+	require.NoError(t, err)
+	assert.Contains(t, stableResult.Unchanged, "databricks-jobs")
+	assert.Equal(t, 0, fetchCalls)
+
+	t.Setenv("DATABRICKS_SKILLS_REF", "v0.3.0")
+	experimentalManifest := &Manifest{
+		Version: "1",
+		Skills: map[string]SkillMeta{
+			"databricks-jobs": {Version: "0.1.0", Files: []string{"SKILL.md"}, RepoDir: experimentalRepoPath},
+		},
+	}
+	experimentalResult, err := UpdateSkills(ctx, &mockManifestSource{manifest: experimentalManifest}, []*agents.Agent{agent}, UpdateOptions{})
+	require.NoError(t, err)
+	require.Len(t, experimentalResult.Updated, 1)
+	assert.Equal(t, "databricks-jobs", experimentalResult.Updated[0].Name)
+	assert.Equal(t, "0.1.0", experimentalResult.Updated[0].OldVersion)
+	assert.Equal(t, "0.1.0", experimentalResult.Updated[0].NewVersion)
+	assert.Positive(t, fetchCalls)
+
+	state, err := LoadState(globalDir)
+	require.NoError(t, err)
+	assert.Equal(t, experimentalRepoPath, state.RepoDirs["databricks-jobs"])
+}
+
+func TestUpdateSkipsMinCLIVersionSkills(t *testing.T) {
+	tmp := setupTestHome(t)
+	ctx := cmdio.MockDiscard(t.Context())
+	setupFetchMock(t)
+	t.Setenv("DATABRICKS_SKILLS_REF", testSkillsRef)
+	setBuildVersion(t, "0.200.0")
+
+	var logBuf bytes.Buffer
+	logger := slog.New(slog.NewTextHandler(&logBuf, &slog.HandlerOptions{Level: slog.LevelWarn}))
+	ctx = log.NewContext(ctx, logger)
+
+	// Install with default ref.
+	src := &mockManifestSource{manifest: testManifest()}
+	agent := testAgent(tmp)
+	require.NoError(t, InstallSkillsForAgents(ctx, src, []*agents.Agent{agent}, InstallOptions{}))
+
+	// Simulate a new release.
+	t.Setenv("DATABRICKS_SKILLS_REF", "v0.2.0")
+
+	// New manifest with a skill requiring a newer CLI.
+	updatedManifest := testManifest()
+	updatedManifest.Skills["databricks-future"] = SkillMeta{
+		Version:   "0.1.0",
+		Files:     []string{"SKILL.md"},
+		MinCLIVer: "0.300.0",
+	}
+	src2 := &mockManifestSource{manifest: updatedManifest}
+
+	result, err := UpdateSkills(ctx, src2, []*agents.Agent{agent}, UpdateOptions{})
+	require.NoError(t, err)
+
+	assert.Contains(t, result.Skipped, "databricks-future")
+	assert.Contains(t, logBuf.String(), "requires CLI version 0.300.0")
+}
+
+func TestFormatUpdateResultCheckMode(t *testing.T) {
+	result := &UpdateResult{
+		Updated: []SkillUpdate{
+			{Name: "databricks-sql", OldVersion: "0.1.0", NewVersion: "0.2.0"},
+		},
+		Added: []SkillUpdate{
+			{Name: "databricks-notebooks", NewVersion: "0.1.0"},
+		},
+	}
+
+	output := FormatUpdateResult(result, false)
+	assert.Contains(t, output, "updated databricks-sql")
+	assert.Contains(t, output, "added databricks-notebooks")
+	assert.Contains(t, output, "Updated 2 skills.")
+
+	checkOutput := FormatUpdateResult(result, true)
+	assert.Contains(t, checkOutput, "would update databricks-sql")
+	assert.Contains(t, checkOutput, "would add databricks-notebooks")
+	assert.Contains(t, checkOutput, "Would update 2 skills.")
+}
diff --git a/libs/aitools/installer/useragent.go b/libs/aitools/installer/useragent.go
new file mode 100644
index 00000000000..d0c9894582a
--- /dev/null
+++ b/libs/aitools/installer/useragent.go
@@ -0,0 +1,47 @@
+package installer
+
+import (
+	"context"
+
+	"github.com/databricks/databricks-sdk-go/useragent"
+)
+
+// aiToolsUserAgentKey is the user-agent key for the Databricks AI Tools
+// dimension. Each installed tool contributes an "<key>/<tool>_<version>" pair.
+const aiToolsUserAgentKey = "aitools"
+
+// aiDevKitUserAgentKey is the user-agent key for the ai-dev-kit toolkit
+// (github.com/databricks-solutions/ai-dev-kit). Its skills have been subsumed
+// into databricks-agent-skills, but we track ai-dev-kit installs separately.
+const aiDevKitUserAgentKey = "aidevkit"
+
+// WithAiToolsInUserAgent adds one aitools/<tool>_<version> pair to the user
+// agent for each coding tool that has the Databricks plugin installed, e.g.
+// "aitools/claude-code_0.2.9 aitools/codex_0.2.9". Nothing is added when no tool
+// has it installed. Versions come from InstalledTools (each tool's own plugin
+// manifest, falling back to the CLI install state).
+func WithAiToolsInUserAgent(ctx context.Context) context.Context {
+	// Each tool appends one aitools/<tool>_<version> pair to the same context;
+	// these accumulate, so this is not the accidental context nesting fatcontext
+	// flags.
+	for _, tool := range InstalledTools(ctx) {
+		ctx = useragent.InContext(ctx, aiToolsUserAgentKey, tool) //nolint:fatcontext
+	}
+	return ctx
+}
+
+// WithAiDevKitInUserAgent adds an "aidevkit/<version>" pair to the user agent
+// when the ai-dev-kit toolkit is installed (project scope preferred, else the
+// global $AIDEVKIT_HOME/~/.ai-dev-kit marker), e.g. "aidevkit/1.2.3". Nothing is
+// added when it is not installed. An installed marker with an unreadable version
+// emits "aidevkit/unknown" so adoption is still counted.
+func WithAiDevKitInUserAgent(ctx context.Context) context.Context {
+	version, ok := AiDevKitVersion(ctx)
+	if !ok {
+		return ctx
+	}
+	if version == "" {
+		version = "unknown"
+	}
+	return useragent.InContext(ctx, aiDevKitUserAgentKey, version)
+}
diff --git a/libs/aitools/installer/useragent_test.go b/libs/aitools/installer/useragent_test.go
new file mode 100644
index 00000000000..9c8aeb9c575
--- /dev/null
+++ b/libs/aitools/installer/useragent_test.go
@@ -0,0 +1,119 @@
+package installer
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/databricks/databricks-sdk-go/useragent"
+	"github.com/stretchr/testify/assert"
+)
+
+// TestWithAiToolsInUserAgent is an end-to-end test of the top-level call tree:
+// it drives WithAiToolsInUserAgent against a prepared environment (HOME, plugin
+// manifests, and CLI install state) and asserts the resulting user-agent string.
+func TestWithAiToolsInUserAgent(t *testing.T) {
+	tests := []struct {
+		name string
+		// claudeManifestVersion, when set, is written to claude-code's manifest.
+		claudeManifestVersion string
+		// globalPlugins maps agent -> version recorded in the CLI install state.
+		globalPlugins  map[string]string
+		wantContains   []string
+		wantNotContain []string
+	}{
+		{
+			name:           "nothing installed adds no pair",
+			wantNotContain: []string{"aitools/"},
+		},
+		{
+			name:                  "version from the tool's own manifest",
+			claudeManifestVersion: "0.2.9",
+			wantContains:          []string{"aitools/claude-code_0.2.9"},
+		},
+		{
+			name:           "version from the CLI install state",
+			globalPlugins:  map[string]string{"codex": "0.2.7"},
+			wantContains:   []string{"aitools/codex_0.2.7"},
+			wantNotContain: []string{"aitools/claude-code"},
+		},
+		{
+			name:                  "a pair per installed tool",
+			claudeManifestVersion: "0.2.9",
+			globalPlugins:         map[string]string{"codex": "0.2.8"},
+			wantContains:          []string{"aitools/claude-code_0.2.9", "aitools/codex_0.2.8"},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			tmp := t.TempDir()
+			t.Setenv("HOME", tmp)
+			t.Setenv("USERPROFILE", tmp)
+			// Fresh cwd so project-scope state does not leak from the package dir.
+			t.Chdir(t.TempDir())
+
+			if tc.claudeManifestVersion != "" {
+				writeClaudeManifest(t, filepath.Join(tmp, ".claude"), tc.claudeManifestVersion)
+			}
+			savePluginState(t, GlobalSkillsDir, tc.globalPlugins)
+
+			ua := useragent.FromContext(WithAiToolsInUserAgent(t.Context()))
+			for _, want := range tc.wantContains {
+				assert.Contains(t, ua, want)
+			}
+			for _, notWant := range tc.wantNotContain {
+				assert.NotContains(t, ua, notWant)
+			}
+		})
+	}
+}
+
+// TestWithAiDevKitInUserAgent drives WithAiDevKitInUserAgent against a prepared
+// HOME containing (or lacking) an ai-dev-kit version marker and asserts the
+// resulting user-agent string.
+func TestWithAiDevKitInUserAgent(t *testing.T) {
+	tests := []struct {
+		name string
+		// marker, when set, is written to ~/.ai-dev-kit/version.
+		marker         string
+		wantContains   []string
+		wantNotContain []string
+	}{
+		{
+			name:           "not installed adds no pair",
+			wantNotContain: []string{"aidevkit/"},
+		},
+		{
+			name:         "version from the marker",
+			marker:       "1.2.3\n",
+			wantContains: []string{"aidevkit/1.2.3"},
+		},
+		{
+			name:         "installed but unversioned reports unknown",
+			marker:       "\n",
+			wantContains: []string{"aidevkit/unknown"},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			home := t.TempDir()
+			t.Setenv("HOME", home)
+			t.Setenv("USERPROFILE", home)
+			// Fresh cwd so a project-scope marker never leaks from the package dir.
+			t.Chdir(t.TempDir())
+
+			if tc.marker != "" {
+				writeAiDevKitMarker(t, home, tc.marker)
+			}
+
+			ua := useragent.FromContext(WithAiDevKitInUserAgent(t.Context()))
+			for _, want := range tc.wantContains {
+				assert.Contains(t, ua, want)
+			}
+			for _, notWant := range tc.wantNotContain {
+				assert.NotContains(t, ua, notWant)
+			}
+		})
+	}
+}
diff --git a/libs/appproxy/appproxy.go b/libs/appproxy/appproxy.go
index d1d7c5c9df8..1358cf5d9b2 100644
--- a/libs/appproxy/appproxy.go
+++ b/libs/appproxy/appproxy.go
@@ -2,6 +2,7 @@ package appproxy
 
 import (
 	"context"
+	"errors"
 	"io"
 	"net"
 	"net/http"
@@ -33,24 +34,16 @@ func New(ctx context.Context, targetURL string) (*Proxy, error) {
 	return &proxy, nil
 }
 
-func (p *Proxy) listen(addr string) (net.Listener, error) {
+// Listen binds the proxy to the given address (host:port, e.g. localhost:8080).
+func (p *Proxy) Listen(addr string) (net.Listener, error) {
 	return net.Listen("tcp", addr)
 }
 
-func (p *Proxy) serve(ln net.Listener) error {
+// Serve accepts connections on the given listener and forwards all requests to the targetURL.
+func (p *Proxy) Serve(ln net.Listener) error {
 	return p.server.Serve(ln)
 }
 
-// ListenAndServe starts the proxy server on the given address (host:port, e.g. localhost:8080)
-// The proxy will forward all requests to the targetURL
-func (p *Proxy) ListenAndServe(addr string) error {
-	ln, err := p.listen(addr)
-	if err != nil {
-		return err
-	}
-	return p.serve(ln)
-}
-
 func (p *Proxy) Stop() error {
 	return p.server.Shutdown(p.ctx)
 }
@@ -121,7 +114,7 @@ func (p *Proxy) handleWebSocket(w http.ResponseWriter, r *http.Request) {
 	err = <-errc
 	if err != nil {
 		// If the error is not EOF, then there was a problem
-		if err != io.EOF {
+		if !errors.Is(err, io.EOF) {
 			// Log the error and perform cleanup
 			log.Warnf(r.Context(), "error copying messages: %v", err)
 			middlewareConn.Close()
diff --git a/libs/appproxy/appproxy_test.go b/libs/appproxy/appproxy_test.go
index 3325a3046a5..2f90ce06d0e 100644
--- a/libs/appproxy/appproxy_test.go
+++ b/libs/appproxy/appproxy_test.go
@@ -37,11 +37,11 @@ func startProxy(t *testing.T, serverAddr string) (*Proxy, string) {
 	proxy, err := New(t.Context(), "http://"+serverAddr)
 	require.NoError(t, err)
 
-	ln, err := proxy.listen(fmt.Sprintf("localhost:%d", PROXY_PORT))
+	ln, err := proxy.Listen(fmt.Sprintf("localhost:%d", PROXY_PORT))
 	require.NoError(t, err)
 
 	go func() {
-		_ = proxy.serve(ln)
+		_ = proxy.Serve(ln)
 	}()
 
 	return proxy, ln.Addr().String()
diff --git a/libs/apps/generator/generator.go b/libs/apps/generator/generator.go
index 185fd1e811e..3f99d80f900 100644
--- a/libs/apps/generator/generator.go
+++ b/libs/apps/generator/generator.go
@@ -3,6 +3,7 @@ package generator
 import (
 	"fmt"
 	"regexp"
+	"slices"
 	"strings"
 
 	"github.com/databricks/cli/libs/apps/manifest"
@@ -39,6 +40,30 @@ type Config struct {
 	// ResourceValues maps resource value keys to values.
 	// Keys use "resource_key.field_name" format (e.g., "sql-warehouse.id" -> "abc123").
 	ResourceValues map[string]string
+	// AuthModes maps a resource's AuthKey to its auth mode (AuthModeSP, AuthModeOBO, or AuthModeBoth).
+	// Resources without an entry use AuthModeSP.
+	AuthModes map[string]string
+}
+
+// Auth modes describe how the app accesses a resource.
+const (
+	// AuthModeSP binds the resource to the app's service principal.
+	AuthModeSP = "sp"
+	// AuthModeOBO injects the resource id and accesses it on behalf of the user.
+	AuthModeOBO = "obo"
+	// AuthModeBoth binds the resource to the service principal and also grants the user scope.
+	AuthModeBoth = "both"
+)
+
+// isOBOOnly returns true if the resource is accessed only on behalf of the user (not bound to the service principal).
+func isOBOOnly(r manifest.Resource, cfg Config) bool {
+	return cfg.AuthModes[r.AuthKey()] == AuthModeOBO
+}
+
+// needsScope returns true if the resource is accessed on behalf of the user.
+func needsScope(r manifest.Resource, cfg Config) bool {
+	mode := cfg.AuthModes[r.AuthKey()]
+	return mode == AuthModeOBO || mode == AuthModeBoth
 }
 
 // hasResourceValues returns true if any value exists in cfg for the given resource.
@@ -59,10 +84,12 @@ func GenerateBundleVariables(plugins []manifest.Plugin, cfg Config) string {
 
 	for _, p := range plugins {
 		for _, r := range p.Resources.Required {
-			lines = append(lines, generateVariableLines(r)...)
+			if !isOBOOnly(r, cfg) {
+				lines = append(lines, generateVariableLines(r)...)
+			}
 		}
 		for _, r := range p.Resources.Optional {
-			if hasResourceValues(r, cfg) {
+			if hasResourceValues(r, cfg) && !isOBOOnly(r, cfg) {
 				lines = append(lines, generateVariableLines(r)...)
 			}
 		}
@@ -100,6 +127,9 @@ func GenerateBundleResources(plugins []manifest.Plugin, cfg Config) string {
 	for _, p := range plugins {
 		// Required resources
 		for _, r := range p.Resources.Required {
+			if isOBOOnly(r, cfg) {
+				continue
+			}
 			resource := generateResourceYAML(r, 8)
 			if resource != "" {
 				blocks = append(blocks, resource)
@@ -107,7 +137,7 @@ func GenerateBundleResources(plugins []manifest.Plugin, cfg Config) string {
 		}
 		// Optional resources (only if value provided)
 		for _, r := range p.Resources.Optional {
-			if hasResourceValues(r, cfg) {
+			if hasResourceValues(r, cfg) && !isOBOOnly(r, cfg) {
 				resource := generateResourceYAML(r, 8)
 				if resource != "" {
 					blocks = append(blocks, resource)
@@ -127,10 +157,12 @@ func GenerateTargetVariables(plugins []manifest.Plugin, cfg Config) string {
 
 	for _, p := range plugins {
 		for _, r := range p.Resources.Required {
-			lines = append(lines, generateTargetVarLines(r, cfg)...)
+			if !isOBOOnly(r, cfg) {
+				lines = append(lines, generateTargetVarLines(r, cfg)...)
+			}
 		}
 		for _, r := range p.Resources.Optional {
-			if hasResourceValues(r, cfg) {
+			if hasResourceValues(r, cfg) && !isOBOOnly(r, cfg) {
 				lines = append(lines, generateTargetVarLines(r, cfg)...)
 			}
 		}
@@ -230,17 +262,18 @@ func GenerateDotEnvExample(plugins []manifest.Plugin) string {
 // GenerateAppEnv generates the env entries for app.yaml.
 // Each resource field with an Env mapping produces a YAML list entry with
 // name (the env var) and valueFrom (the resource key in databricks.yml resources).
+// Resources accessed only on behalf of the user get a literal value instead of valueFrom.
 // Includes both required resources and optional resources that have values.
 func GenerateAppEnv(plugins []manifest.Plugin, cfg Config) string {
 	var lines []string
 
 	for _, p := range plugins {
 		for _, r := range p.Resources.Required {
-			lines = append(lines, appEnvLines(r)...)
+			lines = append(lines, appEnvLines(r, cfg)...)
 		}
 		for _, r := range p.Resources.Optional {
 			if hasResourceValues(r, cfg) {
-				lines = append(lines, appEnvLines(r)...)
+				lines = append(lines, appEnvLines(r, cfg)...)
 			}
 		}
 	}
@@ -249,8 +282,9 @@ func GenerateAppEnv(plugins []manifest.Plugin, cfg Config) string {
 }
 
 // appEnvLines returns app.yaml env entries for a resource.
-// Each field with an Env produces "- name: <ENV>\n  valueFrom: <resourceKey>".
-func appEnvLines(r manifest.Resource) []string {
+// Each field with an Env produces "- name: <ENV>\n  valueFrom: <resourceKey>",
+// or "- name: <ENV>\n  value: <value>" when the resource is accessed only on behalf of the user.
+func appEnvLines(r manifest.Resource, cfg Config) []string {
 	var lines []string
 	for _, fieldName := range r.FieldNames() {
 		field := r.Fields[fieldName]
@@ -260,6 +294,13 @@ func appEnvLines(r manifest.Resource) []string {
 		if field.LocalOnly {
 			continue
 		}
+		if isOBOOnly(r, cfg) {
+			lines = append(lines,
+				"  - name: "+field.Env,
+				"    value: "+quoteYAMLValue(cfg.ResourceValues[r.Key()+"."+fieldName]),
+			)
+			continue
+		}
 		lines = append(lines,
 			"  - name: "+field.Env,
 			"    valueFrom: "+r.Key(),
@@ -268,6 +309,43 @@ func appEnvLines(r manifest.Resource) []string {
 	return lines
 }
 
+// GenerateUserAPIScopes generates the user_api_scopes entries for databricks.yml.
+// Output is indented with 8 spaces for insertion under "user_api_scopes:".
+// Returns "" unless at least one resource is accessed on behalf of the user. The scopes are
+// those of the resources accessed on behalf of the user, followed by the plugins' capability
+// scopes, deduplicated in first-seen order.
+func GenerateUserAPIScopes(plugins []manifest.Plugin, cfg Config) string {
+	var scopes []string
+	for _, p := range plugins {
+		for _, r := range p.Resources.Required {
+			if needsScope(r, cfg) {
+				scopes = append(scopes, r.Scope)
+			}
+		}
+		for _, r := range p.Resources.Optional {
+			if hasResourceValues(r, cfg) && needsScope(r, cfg) {
+				scopes = append(scopes, r.Scope)
+			}
+		}
+	}
+	if len(scopes) == 0 {
+		return ""
+	}
+	for _, p := range plugins {
+		scopes = append(scopes, p.Scopes...)
+	}
+
+	var lines []string
+	seen := make(map[string]bool)
+	for _, s := range scopes {
+		if !seen[s] {
+			seen[s] = true
+			lines = append(lines, "        - "+s)
+		}
+	}
+	return strings.Join(lines, "\n")
+}
+
 // appResourceSpec defines how a manifest resource type maps to DABs AppResource YAML.
 type appResourceSpec struct {
 	yamlKey      string      // DABs YAML key under the resource entry (e.g., "sql_warehouse", "uc_securable")
@@ -277,6 +355,8 @@ type appResourceSpec struct {
 }
 
 // appResourceSpecs maps manifest resource types to their DABs AppResource YAML specification.
+// Compat fallback for manifests without a resource binding; it also supplies the default
+// permission when the manifest does not declare one.
 var appResourceSpecs = map[string]appResourceSpec{
 	"sql_warehouse": {
 		yamlKey:    "sql_warehouse",
@@ -295,7 +375,7 @@ var appResourceSpecs = map[string]appResourceSpec{
 	},
 	"experiment": {
 		yamlKey:    "experiment",
-		varFields:  [][2]string{{"id", "experiment_id"}},
+		varFields:  [][2]string{{"experimentId", "experiment_id"}},
 		permission: "CAN_READ",
 	},
 	"secret": {
@@ -320,7 +400,7 @@ var appResourceSpecs = map[string]appResourceSpec{
 	},
 	"volume": {
 		yamlKey:      "uc_securable",
-		varFields:    [][2]string{{"id", "securable_full_name"}},
+		varFields:    [][2]string{{"path", "securable_full_name"}},
 		staticFields: [][2]string{{"securable_type", "VOLUME"}},
 		permission:   "READ_VOLUME",
 	},
@@ -350,6 +430,34 @@ var appResourceSpecs = map[string]appResourceSpec{
 	// },
 }
 
+// resourceSpec returns the binding spec for a resource, preferring the manifest binding over appResourceSpecs.
+func resourceSpec(r manifest.Resource) (appResourceSpec, bool) {
+	if r.Binding == nil {
+		spec, ok := appResourceSpecs[r.Type]
+		return spec, ok
+	}
+	return appResourceSpec{
+		yamlKey:      r.Binding.YamlKey,
+		varFields:    r.Binding.VarFields,
+		staticFields: r.Binding.StaticFields,
+		permission:   appResourceSpecs[r.Type].permission,
+	}, true
+}
+
+// BindingVarFields returns the yamlKey of the resource's databricks.yml binding and the
+// manifest fields whose values the binding references through ${var.*}. These can include
+// fields the manifest does not declare. ok is false when the resource type has no binding.
+func BindingVarFields(r manifest.Resource) (yamlKey string, fields []string, ok bool) {
+	spec, ok := resourceSpec(r)
+	if !ok {
+		return "", nil, false
+	}
+	for _, f := range spec.varFields {
+		fields = append(fields, f[0])
+	}
+	return spec.yamlKey, fields, true
+}
+
 // varNameForField returns the bundle variable name for a specific field of a resource.
 // Uses VarPrefix (resource_key with hyphens replaced by underscores).
 func varNameForField(r manifest.Resource, fieldName string) string {
@@ -383,7 +491,7 @@ func variableNamesForResource(r manifest.Resource) []varInfo {
 	}
 
 	// Include spec varFields not already covered by manifest Fields.
-	if spec, ok := appResourceSpecs[r.Type]; ok {
+	if spec, ok := resourceSpec(r); ok {
 		for _, f := range spec.varFields {
 			if !covered[f[0]] {
 				vars = append(vars, varInfo{
@@ -408,7 +516,7 @@ func variableNamesForResource(r manifest.Resource) []varInfo {
 // generateResourceYAML generates YAML for a single app resource based on its type.
 // Uses the appResourceSpecs mapping to produce the correct DABs AppResource structure.
 func generateResourceYAML(r manifest.Resource, indent int) string {
-	spec, ok := appResourceSpecs[r.Type]
+	spec, ok := resourceSpec(r)
 	if !ok {
 		return ""
 	}
@@ -446,6 +554,37 @@ func aliasToVarName(prefix string) string {
 	return prefix + "_id"
 }
 
+// DedupeResources returns a copy of plugins with resources shared by several
+// plugins collapsed to a single occurrence, identified by type and key (as in
+// manifest.CollectResources). Otherwise a resource declared by two selected
+// features is emitted twice by every generator. Required declarations are
+// processed before optional ones so a required resource is never dropped in
+// favor of an optional duplicate.
+func DedupeResources(plugins []manifest.Plugin) []manifest.Plugin {
+	seen := make(map[string]bool)
+	filter := func(rs []manifest.Resource) []manifest.Resource {
+		var out []manifest.Resource
+		for _, r := range rs {
+			id := r.Type + ":" + r.Key()
+			if seen[id] {
+				continue
+			}
+			seen[id] = true
+			out = append(out, r)
+		}
+		return out
+	}
+
+	out := slices.Clone(plugins)
+	for i := range out {
+		out[i].Resources.Required = filter(out[i].Resources.Required)
+	}
+	for i := range out {
+		out[i].Resources.Optional = filter(out[i].Resources.Optional)
+	}
+	return out
+}
+
 // GetSelectedPlugins returns plugins that match the given names.
 func GetSelectedPlugins(m *manifest.Manifest, names []string) []manifest.Plugin {
 	nameSet := make(map[string]bool)
diff --git a/libs/apps/generator/generator_internal_test.go b/libs/apps/generator/generator_internal_test.go
new file mode 100644
index 00000000000..f89eef32b07
--- /dev/null
+++ b/libs/apps/generator/generator_internal_test.go
@@ -0,0 +1,80 @@
+package generator
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/databricks/cli/libs/apps/manifest"
+	"github.com/databricks/databricks-sdk-go/service/apps"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestManifestBindingMatchesCompatSpecs checks that a manifest binding equal to the
+// built-in spec for a type produces byte-identical output, so manifests can move to
+// bindings without changing generated projects.
+func TestManifestBindingMatchesCompatSpecs(t *testing.T) {
+	for typ, spec := range appResourceSpecs {
+		t.Run(typ, func(t *testing.T) {
+			fields := map[string]manifest.ResourceField{}
+			values := map[string]string{}
+			for _, f := range spec.varFields {
+				fields[f[0]] = manifest.ResourceField{Env: "ENV_" + f[0], Description: f[0] + " field"}
+				values["res."+f[0]] = "v-" + f[0]
+			}
+			compat := manifest.Resource{Type: typ, ResourceKey: "res", Description: "desc", Fields: fields}
+			bound := compat
+			bound.Binding = &manifest.ResourceBinding{YamlKey: spec.yamlKey, VarFields: spec.varFields, StaticFields: spec.staticFields}
+
+			cfg := Config{ResourceValues: values}
+			compatPlugins := []manifest.Plugin{{Name: "p", Resources: manifest.Resources{Required: []manifest.Resource{compat}}}}
+			boundPlugins := []manifest.Plugin{{Name: "p", Resources: manifest.Resources{Required: []manifest.Resource{bound}}}}
+
+			assert.NotEmpty(t, GenerateBundleResources(compatPlugins, cfg))
+			assert.Equal(t, GenerateBundleResources(compatPlugins, cfg), GenerateBundleResources(boundPlugins, cfg))
+			assert.Equal(t, GenerateBundleVariables(compatPlugins, cfg), GenerateBundleVariables(boundPlugins, cfg))
+			assert.Equal(t, GenerateTargetVariables(compatPlugins, cfg), GenerateTargetVariables(boundPlugins, cfg))
+			assert.Equal(t, GenerateAppEnv(compatPlugins, cfg), GenerateAppEnv(boundPlugins, cfg))
+		})
+	}
+}
+
+// sdkAppResourceKeys returns the resource binding keys of apps.AppResource, which are its
+// pointer-to-struct fields (e.g. sql_warehouse, uc_securable), keyed by their json tag.
+func sdkAppResourceKeys(t *testing.T) map[string]bool {
+	keys := make(map[string]bool)
+	typ := reflect.TypeFor[apps.AppResource]()
+	for f := range typ.Fields() {
+		if f.Type.Kind() != reflect.Pointer || f.Type.Elem().Kind() != reflect.Struct {
+			continue
+		}
+		name, _, _ := strings.Cut(f.Tag.Get("json"), ",")
+		keys[name] = true
+	}
+	require.NotEmpty(t, keys)
+	return keys
+}
+
+// TestBindingYamlKeysMatchSDK anchors binding yamlKeys to the Go SDK. A wrong yamlKey in
+// both the manifest and appResourceSpecs passes the byte-identical test but fails here.
+func TestBindingYamlKeysMatchSDK(t *testing.T) {
+	keys := sdkAppResourceKeys(t)
+
+	for typ, spec := range appResourceSpecs {
+		assert.True(t, keys[spec.yamlKey], "appResourceSpecs[%q].yamlKey %q is not an apps.AppResource field", typ, spec.yamlKey)
+	}
+
+	m, err := manifest.Load("../../../acceptance/apps/init/auth-mode/template")
+	require.NoError(t, err)
+	var checked int
+	for _, p := range m.GetPlugins() {
+		for _, r := range append(p.Resources.Required, p.Resources.Optional...) {
+			if r.Binding != nil {
+				checked++
+				assert.True(t, keys[r.Binding.YamlKey], "fixture binding yamlKey %q of %q is not an apps.AppResource field", r.Binding.YamlKey, r.Key())
+			}
+		}
+	}
+	require.Positive(t, checked)
+}
diff --git a/libs/apps/generator/generator_test.go b/libs/apps/generator/generator_test.go
index 9bd0b999170..d7a1de85cc8 100644
--- a/libs/apps/generator/generator_test.go
+++ b/libs/apps/generator/generator_test.go
@@ -1,11 +1,13 @@
 package generator_test
 
 import (
+	"strings"
 	"testing"
 
 	"github.com/databricks/cli/libs/apps/generator"
 	"github.com/databricks/cli/libs/apps/manifest"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestGenerateBundleVariables(t *testing.T) {
@@ -402,7 +404,7 @@ func TestGenerateResourceYAMLAllTypes(t *testing.T) {
 			expectContains: []string{
 				"- name: exp",
 				"experiment:",
-				"experiment_id: ${var.exp_id}",
+				"experiment_id: ${var.exp_experimentId}",
 				"permission: CAN_READ",
 			},
 		},
@@ -447,7 +449,7 @@ func TestGenerateResourceYAMLAllTypes(t *testing.T) {
 			expectContains: []string{
 				"- name: vol",
 				"uc_securable:",
-				"securable_full_name: ${var.vol_id}",
+				"securable_full_name: ${var.vol_path}",
 				"securable_type: VOLUME",
 				"permission: READ_VOLUME",
 			},
@@ -1041,7 +1043,7 @@ func TestBundleIgnoreFieldSkippedInVariablesAndTargets(t *testing.T) {
 	assert.Contains(t, example, "DB_NAME=your_database_database_name")
 }
 
-func TestVolumeManifestPathFieldMapsToSpecId(t *testing.T) {
+func TestVolumeManifestPathFieldBindsSecurable(t *testing.T) {
 	plugins := []manifest.Plugin{
 		{
 			Name: "files",
@@ -1063,22 +1065,225 @@ func TestVolumeManifestPathFieldMapsToSpecId(t *testing.T) {
 	}
 
 	cfg := generator.Config{
-		ResourceValues: map[string]string{
-			"files.path": "/Volumes/catalog/schema/vol",
-			"files.id":   "catalog.schema.vol",
-		},
+		ResourceValues: map[string]string{"files.path": "/Volumes/catalog/schema/vol"},
 	}
 
+	// The binding must reference the declared "path" field, so the variable it uses is set.
 	vars := generator.GenerateBundleVariables(plugins, cfg)
-	assert.Contains(t, vars, "files_path:")
-	assert.Contains(t, vars, "files_id:")
+	assert.Equal(t, "  files_path:\n    description: Volume path", vars)
 
 	target := generator.GenerateTargetVariables(plugins, cfg)
-	assert.Contains(t, target, "files_path: /Volumes/catalog/schema/vol")
-	assert.Contains(t, target, "files_id: catalog.schema.vol")
+	assert.Equal(t, "      files_path: /Volumes/catalog/schema/vol", target)
 
 	res := generator.GenerateBundleResources(plugins, cfg)
-	assert.Contains(t, res, "securable_full_name: ${var.files_id}")
+	assert.Contains(t, res, "securable_full_name: ${var.files_path}")
 	assert.Contains(t, res, "securable_type: VOLUME")
 	assert.Contains(t, res, "permission: WRITE_VOLUME")
 }
+
+func TestExperimentManifestFieldBindsExperimentID(t *testing.T) {
+	plugins := []manifest.Plugin{
+		{
+			Name: "agents",
+			Resources: manifest.Resources{
+				Optional: []manifest.Resource{
+					{
+						Type:        "experiment",
+						ResourceKey: "agents-mlflow-experiment",
+						Permission:  "CAN_EDIT",
+						Fields: map[string]manifest.ResourceField{
+							"experimentId": {Env: "MLFLOW_EXPERIMENT_ID", Description: "Experiment ID"},
+						},
+					},
+				},
+			},
+		},
+	}
+	cfg := generator.Config{
+		ResourceValues: map[string]string{"agents-mlflow-experiment.experimentId": "123"},
+	}
+
+	assert.Equal(t, "  agents_mlflow_experiment_experimentId:\n    description: Experiment ID", generator.GenerateBundleVariables(plugins, cfg))
+	assert.Equal(t, "      agents_mlflow_experiment_experimentId: 123", generator.GenerateTargetVariables(plugins, cfg))
+	assert.Contains(t, generator.GenerateBundleResources(plugins, cfg), "experiment_id: ${var.agents_mlflow_experiment_experimentId}")
+}
+
+// postgresResource is the shared resource that "database" and "lakebase" both declare.
+func postgresResource() manifest.Resource {
+	return manifest.Resource{
+		Type: "postgres", Alias: "Postgres", ResourceKey: "postgres", Permission: "CAN_CONNECT_AND_CREATE",
+		Fields: map[string]manifest.ResourceField{
+			"branch":       {Env: "PGBRANCH", Description: "Branch"},
+			"database":     {Env: "PGDATABASE", Description: "Database"},
+			"endpointPath": {Env: "LAKEBASE_ENDPOINT", BundleIgnore: true, Description: "Endpoint"},
+		},
+	}
+}
+
+func TestDedupeResourcesSharedAcrossPlugins(t *testing.T) {
+	deduped := generator.DedupeResources([]manifest.Plugin{
+		{Name: "database", Resources: manifest.Resources{Required: []manifest.Resource{postgresResource()}}},
+		{Name: "lakebase", Resources: manifest.Resources{Required: []manifest.Resource{postgresResource()}}},
+	})
+
+	// The shared resource survives on the first plugin and is dropped from the second.
+	require.Len(t, deduped, 2)
+	assert.Len(t, deduped[0].Resources.Required, 1)
+	assert.Empty(t, deduped[1].Resources.Required)
+
+	cfg := generator.Config{ResourceValues: map[string]string{
+		"postgres.branch":   "br-1",
+		"postgres.database": "db-1",
+	}}
+
+	appEnv := generator.GenerateAppEnv(deduped, cfg)
+	assert.Equal(t, 1, strings.Count(appEnv, "name: PGBRANCH"))
+	assert.Equal(t, 1, strings.Count(appEnv, "name: LAKEBASE_ENDPOINT"))
+
+	res := generator.GenerateBundleResources(deduped, cfg)
+	assert.Equal(t, 1, strings.Count(res, "- name: postgres"))
+
+	vars := generator.GenerateBundleVariables(deduped, cfg)
+	assert.Equal(t, 1, strings.Count(vars, "postgres_branch:"))
+
+	env := generator.GenerateDotEnv(deduped, cfg)
+	assert.Equal(t, 1, strings.Count(env, "PGBRANCH="))
+
+	target := generator.GenerateTargetVariables(deduped, cfg)
+	assert.Equal(t, 1, strings.Count(target, "postgres_branch:"))
+
+	example := generator.GenerateDotEnvExample(deduped)
+	assert.Equal(t, 1, strings.Count(example, "PGBRANCH="))
+}
+
+func TestDedupeResourcesRequiredWinsOverOptional(t *testing.T) {
+	deduped := generator.DedupeResources([]manifest.Plugin{
+		{Name: "a", Resources: manifest.Resources{Optional: []manifest.Resource{postgresResource()}}},
+		{Name: "b", Resources: manifest.Resources{Required: []manifest.Resource{postgresResource()}}},
+	})
+
+	// Kept as required on "b"; the optional copy on "a" is dropped.
+	assert.Empty(t, deduped[0].Resources.Optional)
+	assert.Len(t, deduped[1].Resources.Required, 1)
+
+	// No --set values: as a required resource it is still emitted.
+	res := generator.GenerateBundleResources(deduped, generator.Config{})
+	assert.Equal(t, 1, strings.Count(res, "- name: postgres"))
+}
+
+func authModePlugins() []manifest.Plugin {
+	return []manifest.Plugin{
+		{
+			Name:   "analytics",
+			Scopes: []string{"ai-gateway", "sql"},
+			Resources: manifest.Resources{
+				Required: []manifest.Resource{
+					{
+						Type: "sql_warehouse", ResourceKey: "sql-warehouse", Scope: "sql",
+						Fields: map[string]manifest.ResourceField{"id": {Env: "DATABRICKS_WAREHOUSE_ID"}},
+					},
+					{
+						Type: "genie_space", ResourceKey: "genie-space", Scope: "genie",
+						Fields: map[string]manifest.ResourceField{"id": {Env: "GENIE_SPACE_ID"}},
+					},
+				},
+			},
+		},
+	}
+}
+
+func authModeConfig(modes map[string]string) generator.Config {
+	return generator.Config{
+		ResourceValues: map[string]string{"sql-warehouse.id": "wh1", "genie-space.id": "g1", "genie-space.name": "space"},
+		AuthModes:      modes,
+	}
+}
+
+func TestAuthModeSPIsDefault(t *testing.T) {
+	plugins := authModePlugins()
+	sp := authModeConfig(map[string]string{"sql_warehouse:sql-warehouse": generator.AuthModeSP})
+	unset := authModeConfig(nil)
+
+	assert.Equal(t, generator.GenerateBundleResources(plugins, unset), generator.GenerateBundleResources(plugins, sp))
+	assert.Equal(t, generator.GenerateAppEnv(plugins, unset), generator.GenerateAppEnv(plugins, sp))
+	assert.Empty(t, generator.GenerateUserAPIScopes(plugins, unset))
+	assert.Empty(t, generator.GenerateUserAPIScopes(plugins, sp))
+}
+
+func TestAuthModeOBO(t *testing.T) {
+	plugins := authModePlugins()
+	cfg := authModeConfig(map[string]string{"sql_warehouse:sql-warehouse": generator.AuthModeOBO})
+
+	assert.NotContains(t, generator.GenerateBundleResources(plugins, cfg), "sql-warehouse")
+	assert.NotContains(t, generator.GenerateBundleVariables(plugins, cfg), "sql_warehouse_id")
+	assert.NotContains(t, generator.GenerateTargetVariables(plugins, cfg), "sql_warehouse_id")
+	assert.Equal(t, "  - name: DATABRICKS_WAREHOUSE_ID\n    value: wh1\n  - name: GENIE_SPACE_ID\n    valueFrom: genie-space",
+		generator.GenerateAppEnv(plugins, cfg))
+	assert.Equal(t, "        - sql\n        - ai-gateway", generator.GenerateUserAPIScopes(plugins, cfg))
+}
+
+func TestAuthModeBoth(t *testing.T) {
+	plugins := authModePlugins()
+	cfg := authModeConfig(map[string]string{"sql_warehouse:sql-warehouse": generator.AuthModeBoth, "genie_space:genie-space": generator.AuthModeOBO})
+
+	assert.Contains(t, generator.GenerateBundleResources(plugins, cfg), "- name: sql-warehouse")
+	assert.NotContains(t, generator.GenerateBundleResources(plugins, cfg), "genie-space")
+	assert.Contains(t, generator.GenerateAppEnv(plugins, cfg), "valueFrom: sql-warehouse")
+	assert.Equal(t, "        - sql\n        - genie\n        - ai-gateway", generator.GenerateUserAPIScopes(plugins, cfg))
+}
+
+func TestAuthModeKeyDoesNotCollideAcrossTypes(t *testing.T) {
+	// Two resources share the resourceKey "data" but differ in type, so they must
+	// not share an auth mode: making the warehouse OBO must leave the app-only
+	// secret bound to the service principal and must not emit its empty scope.
+	plugins := []manifest.Plugin{
+		{Name: "a", Resources: manifest.Resources{Required: []manifest.Resource{
+			{Type: "sql_warehouse", ResourceKey: "data", Scope: "sql", Fields: map[string]manifest.ResourceField{"id": {Env: "WAREHOUSE_ID"}}},
+		}}},
+		{Name: "b", Resources: manifest.Resources{Required: []manifest.Resource{
+			{Type: "secret", ResourceKey: "data", AppOnly: true, Fields: map[string]manifest.ResourceField{"token": {Env: "TOKEN"}}},
+		}}},
+	}
+	cfg := generator.Config{
+		ResourceValues: map[string]string{"data.id": "wh1", "data.token": "s"},
+		AuthModes:      map[string]string{"sql_warehouse:data": generator.AuthModeOBO},
+	}
+
+	env := generator.GenerateAppEnv(plugins, cfg)
+	assert.Contains(t, env, "  - name: WAREHOUSE_ID\n    value: wh1") // warehouse: OBO literal
+	assert.Contains(t, env, "  - name: TOKEN\n    valueFrom: data")   // secret: still SP-bound
+	assert.Equal(t, "        - sql", generator.GenerateUserAPIScopes(plugins, cfg))
+}
+
+func TestGenerateBundleResourcesFromManifestBinding(t *testing.T) {
+	plugins := []manifest.Plugin{
+		{
+			Name: "tables",
+			Resources: manifest.Resources{
+				Required: []manifest.Resource{
+					{
+						Type:        "uc_table",
+						ResourceKey: "table",
+						Description: "Table to read",
+						Permission:  "SELECT",
+						Fields:      map[string]manifest.ResourceField{"name": {Env: "TABLE_NAME", Description: "Table name"}},
+						Binding: &manifest.ResourceBinding{
+							YamlKey:      "uc_securable",
+							VarFields:    [][2]string{{"name", "securable_full_name"}},
+							StaticFields: [][2]string{{"securable_type", "TABLE"}},
+						},
+					},
+				},
+			},
+		},
+	}
+	cfg := generator.Config{ResourceValues: map[string]string{"table.name": "main.default.t"}}
+
+	assert.Equal(t, `        - name: table
+          uc_securable:
+            securable_full_name: ${var.table_name}
+            securable_type: TABLE
+            permission: SELECT`, generator.GenerateBundleResources(plugins, cfg))
+	assert.Equal(t, "  table_name:\n    description: Table name", generator.GenerateBundleVariables(plugins, cfg))
+	assert.Equal(t, "      table_name: main.default.t", generator.GenerateTargetVariables(plugins, cfg))
+}
diff --git a/libs/apps/initializer/initializer.go b/libs/apps/initializer/initializer.go
index 868413784f5..7406c10bd57 100644
--- a/libs/apps/initializer/initializer.go
+++ b/libs/apps/initializer/initializer.go
@@ -6,6 +6,7 @@ import (
 	"path/filepath"
 	"strings"
 
+	"github.com/databricks/cli/libs/apps/pkgmanager"
 	"go.yaml.in/yaml/v3"
 )
 
@@ -24,6 +25,12 @@ type Initializer interface {
 	// NextSteps returns the next steps message for this project type.
 	NextSteps() string
 
+	// InstallCommand returns the shell command that installs the project's
+	// dependencies (and any prerequisites like a virtualenv). It is shown
+	// to the user when init was run with --skip-install so the user knows
+	// what to run before NextSteps.
+	InstallCommand() string
+
 	// RunDev starts the local development server.
 	RunDev(ctx context.Context, workDir string) error
 
@@ -33,11 +40,12 @@ type Initializer interface {
 
 // GetProjectInitializer returns the appropriate initializer based on project type.
 // Detection order: package.json (Node.js), pyproject.toml (Python/uv), requirements.txt (Python/pip).
+// For Node.js projects, m is required and will be used for PM-specific operations.
 // Returns nil if no initializer is applicable.
-func GetProjectInitializer(workDir string) Initializer {
+func GetProjectInitializer(workDir string, m pkgmanager.Manager) Initializer {
 	// Check for Node.js project (package.json exists)
 	if fileExists(filepath.Join(workDir, "package.json")) {
-		return &InitializerNodeJs{workDir: workDir}
+		return &InitializerNodeJs{workDir: workDir, manager: m}
 	}
 
 	// Check for Python project with pyproject.toml (use uv)
diff --git a/libs/apps/initializer/initializer_test.go b/libs/apps/initializer/initializer_test.go
index 9d02a29623d..4e075c1bc82 100644
--- a/libs/apps/initializer/initializer_test.go
+++ b/libs/apps/initializer/initializer_test.go
@@ -5,6 +5,7 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/databricks/cli/libs/apps/pkgmanager"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -63,8 +64,8 @@ func TestGetProjectInitializer(t *testing.T) {
 				require.NoError(t, err)
 			}
 
-			// Get initializer
-			init := GetProjectInitializer(tmpDir)
+			// Get initializer with default PM
+			init := GetProjectInitializer(tmpDir, pkgmanager.Default())
 
 			if tt.wantType == "" {
 				assert.Nil(t, init)
@@ -77,19 +78,91 @@ func TestGetProjectInitializer(t *testing.T) {
 }
 
 func TestNextSteps(t *testing.T) {
-	nodejs := &InitializerNodeJs{}
-	assert.Equal(t, "npm run dev", nodejs.NextSteps())
+	tests := []struct {
+		name      string
+		init      Initializer
+		wantSteps string
+	}{
+		{
+			name:      "nodejs with pnpm",
+			init:      &InitializerNodeJs{manager: pkgmanager.Manager{Name: "pnpm"}},
+			wantSteps: "pnpm run dev",
+		},
+		{
+			name:      "nodejs with npm",
+			init:      &InitializerNodeJs{manager: pkgmanager.Manager{Name: "npm"}},
+			wantSteps: "npm run dev",
+		},
+		{
+			name:      "python uv",
+			init:      &InitializerPythonUv{},
+			wantSteps: "uv run", // contains check below
+		},
+		{
+			name:      "python pip",
+			init:      &InitializerPythonPip{},
+			wantSteps: ".venv", // contains check below
+		},
+	}
 
-	pythonUv := &InitializerPythonUv{}
-	assert.Contains(t, pythonUv.NextSteps(), "uv run")
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := tt.init.NextSteps()
+			assert.Contains(t, got, tt.wantSteps)
+		})
+	}
+}
 
-	pythonPip := &InitializerPythonPip{}
-	assert.Contains(t, pythonPip.NextSteps(), ".venv")
+func TestInstallCommand(t *testing.T) {
+	tests := []struct {
+		name       string
+		init       Initializer
+		wantCmd    string
+		wantSubstr []string // substrings that must be present
+		notContain string   // substring that must NOT be present
+	}{
+		{
+			name:    "nodejs with pnpm",
+			init:    &InitializerNodeJs{manager: pkgmanager.Manager{InstallCommand: "pnpm install --frozen-lockfile"}},
+			wantCmd: "pnpm install --frozen-lockfile",
+		},
+		{
+			name:    "nodejs with npm",
+			init:    &InitializerNodeJs{manager: pkgmanager.Manager{InstallCommand: "npm ci"}},
+			wantCmd: "npm ci",
+		},
+		{
+			name:    "python uv",
+			init:    &InitializerPythonUv{},
+			wantCmd: "uv sync",
+		},
+		{
+			name:       "python pip",
+			init:       &InitializerPythonPip{},
+			wantSubstr: []string{"venv .venv", "pip install -r requirements.txt"},
+			notContain: "activate",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := tt.init.InstallCommand()
+			if tt.wantCmd != "" {
+				assert.Equal(t, tt.wantCmd, got)
+			}
+			for _, substr := range tt.wantSubstr {
+				assert.Contains(t, got, substr)
+			}
+			if tt.notContain != "" {
+				assert.NotContains(t, got, tt.notContain, "should not contain: "+tt.notContain)
+			}
+		})
+	}
 }
 
 func TestSupportsDevRemote(t *testing.T) {
 	// Node.js without appkit
-	nodejs := &InitializerNodeJs{workDir: ""}
+	nodejs := &InitializerNodeJs{workDir: "", manager: pkgmanager.Default()}
 	assert.False(t, nodejs.SupportsDevRemote())
 
 	// Python initializers never support dev-remote
diff --git a/libs/apps/initializer/nodejs.go b/libs/apps/initializer/nodejs.go
index 2c0c6977478..34651a199dc 100644
--- a/libs/apps/initializer/nodejs.go
+++ b/libs/apps/initializer/nodejs.go
@@ -7,6 +7,7 @@ import (
 	"os/exec"
 	"path/filepath"
 
+	"github.com/databricks/cli/libs/apps/pkgmanager"
 	"github.com/databricks/cli/libs/apps/prompt"
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/log"
@@ -15,14 +16,15 @@ import (
 // InitializerNodeJs implements initialization for Node.js-based projects.
 type InitializerNodeJs struct {
 	workDir string
+	manager pkgmanager.Manager
 }
 
 func (i *InitializerNodeJs) Initialize(ctx context.Context, workDir string) *InitResult {
 	i.workDir = workDir
 
-	// Step 1: Run npm install (skip if node_modules already exists from a background install)
+	// Step 1: Run package manager install (skip if node_modules already exists from a background install)
 	if !fileExists(filepath.Join(workDir, "node_modules")) {
-		if err := i.runNpmInstall(ctx, workDir); err != nil {
+		if err := i.runInstall(ctx, workDir); err != nil {
 			return &InitResult{
 				Success: false,
 				Message: "Failed to install dependencies",
@@ -49,12 +51,17 @@ func (i *InitializerNodeJs) Initialize(ctx context.Context, workDir string) *Ini
 }
 
 func (i *InitializerNodeJs) NextSteps() string {
-	return "npm run dev"
+	return i.manager.Name + " run dev"
+}
+
+func (i *InitializerNodeJs) InstallCommand() string {
+	// Mirrors runInstall — display the clean install command for the selected PM.
+	return i.manager.InstallCommand
 }
 
 func (i *InitializerNodeJs) RunDev(ctx context.Context, workDir string) error {
-	cmdio.LogString(ctx, "Starting development server (npm run dev)...")
-	cmd := exec.CommandContext(ctx, "npm", "run", "dev")
+	cmdio.LogString(ctx, "Starting development server ("+i.manager.Name+" run dev)...")
+	cmd := exec.CommandContext(ctx, i.manager.Name, "run", "dev")
 	cmd.Dir = workDir
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr
@@ -69,17 +76,15 @@ func (i *InitializerNodeJs) SupportsDevRemote() bool {
 	return i.hasAppkit(i.workDir)
 }
 
-// runNpmInstall runs npm install in the project directory.
-func (i *InitializerNodeJs) runNpmInstall(ctx context.Context, workDir string) error {
-	// Check if npm is available
-	if _, err := exec.LookPath("npm"); err != nil {
-		cmdio.LogString(ctx, "⚠ npm not found. Please install Node.js and run 'npm install' manually.")
-		return nil //nolint:nilerr // npm not found is a non-critical warning
+// runInstall runs the package manager install in the project directory.
+func (i *InitializerNodeJs) runInstall(ctx context.Context, workDir string) error {
+	// Check if the package manager binary is available
+	if err := i.manager.ValidateExecutable(); err != nil {
+		return err
 	}
 
 	return prompt.RunWithSpinnerCtx(ctx, "Installing dependencies...", func() error {
-		// Faster npm install command.
-		cmd := exec.CommandContext(ctx, "npm", "ci", "--no-audit", "--no-fund", "--prefer-offline")
+		cmd := exec.CommandContext(ctx, i.manager.Name, i.manager.InstallArgs...)
 		cmd.Dir = workDir
 		cmd.Stdout = nil
 		cmd.Stderr = nil
diff --git a/libs/apps/initializer/nodejs_test.go b/libs/apps/initializer/nodejs_test.go
index f20dd90e006..17f38bee6a2 100644
--- a/libs/apps/initializer/nodejs_test.go
+++ b/libs/apps/initializer/nodejs_test.go
@@ -2,13 +2,34 @@ package initializer
 
 import (
 	"os"
+	"os/exec"
 	"path/filepath"
 	"testing"
 
+	"github.com/databricks/cli/libs/apps/pkgmanager"
+	"github.com/databricks/cli/libs/cmdio"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
+func TestInitializeMissingPackageManager(t *testing.T) {
+	// Keep the test independent of installed tools and prevent registry access.
+	t.Setenv("PATH", t.TempDir())
+	for _, name := range []string{"npm", "pnpm"} {
+		t.Run(name, func(t *testing.T) {
+			dir := t.TempDir()
+			require.NoError(t, os.WriteFile(filepath.Join(dir, "package.json"), []byte(`{"dependencies":{"@databricks/appkit":"0.82.0"}}`), 0o644))
+			m, err := pkgmanager.Resolve(name)
+			require.NoError(t, err)
+			init := &InitializerNodeJs{manager: m}
+			result := init.Initialize(cmdio.MockDiscard(t.Context()), dir)
+			assert.False(t, result.Success)
+			assert.Equal(t, "Failed to install dependencies", result.Message)
+			assert.ErrorIs(t, result.Error, exec.ErrNotFound)
+		})
+	}
+}
+
 func TestHasAppkit(t *testing.T) {
 	tests := []struct {
 		name        string
diff --git a/libs/apps/initializer/python_pip.go b/libs/apps/initializer/python_pip.go
index badb3a01389..34180be52fe 100644
--- a/libs/apps/initializer/python_pip.go
+++ b/libs/apps/initializer/python_pip.go
@@ -51,6 +51,16 @@ func (i *InitializerPythonPip) NextSteps() string {
 	return "source .venv/bin/activate && python app.py"
 }
 
+func (i *InitializerPythonPip) InstallCommand() string {
+	// Create the venv and install via the full pip path so the suggestion
+	// composes with NextSteps (which activates the venv) without
+	// activating twice.
+	if runtime.GOOS == "windows" {
+		return "python -m venv .venv && .venv\\Scripts\\pip install -r requirements.txt"
+	}
+	return "python3 -m venv .venv && .venv/bin/pip install -r requirements.txt"
+}
+
 func (i *InitializerPythonPip) RunDev(ctx context.Context, workDir string) error {
 	cmd := detectPythonCommand(workDir)
 	cmdStr := strings.Join(cmd, " ")
diff --git a/libs/apps/initializer/python_uv.go b/libs/apps/initializer/python_uv.go
index eba37ee74c3..47c4e6bf684 100644
--- a/libs/apps/initializer/python_uv.go
+++ b/libs/apps/initializer/python_uv.go
@@ -42,6 +42,10 @@ func (i *InitializerPythonUv) NextSteps() string {
 	return "uv run python app.py"
 }
 
+func (i *InitializerPythonUv) InstallCommand() string {
+	return "uv sync"
+}
+
 func (i *InitializerPythonUv) RunDev(ctx context.Context, workDir string) error {
 	appCmd := detectPythonCommand(workDir)
 	cmdStr := "uv run " + strings.Join(appCmd, " ")
diff --git a/libs/apps/logstream/streamer.go b/libs/apps/logstream/streamer.go
index 5cbfc87ede9..16f4d4bf742 100644
--- a/libs/apps/logstream/streamer.go
+++ b/libs/apps/logstream/streamer.go
@@ -225,8 +225,7 @@ func (s *logStreamer) consume(ctx context.Context, conn *websocket.Conn) (retErr
 			if ctx.Err() != nil {
 				return ctx.Err()
 			}
-			var netErr net.Error
-			if errors.As(err, &netErr) && netErr.Timeout() {
+			if netErr, ok := errors.AsType[net.Error](err); ok && netErr.Timeout() {
 				if state.HasPendingFlushDeadline() {
 					shouldContinue, flushErr := state.HandleFlushTimeout()
 					if flushErr != nil {
@@ -308,8 +307,7 @@ func (s *logStreamer) shouldRefreshForStatus(respStatusCode *int) bool {
 }
 
 func (s *logStreamer) shouldRefreshForError(err error) bool {
-	var closeErr *websocket.CloseError
-	if errors.As(err, &closeErr) {
+	if closeErr, ok := errors.AsType[*websocket.CloseError](err); ok {
 		switch closeErr.Code {
 		case closeCodeUnauthorized, closeCodeForbidden:
 			return true
@@ -336,8 +334,8 @@ func decorateDialError(err error, resp *http.Response) error {
 }
 
 func handleCloseError(err error) (bool, error) {
-	var closeErr *websocket.CloseError
-	if !errors.As(err, &closeErr) {
+	closeErr, ok := errors.AsType[*websocket.CloseError](err)
+	if !ok {
 		return false, err
 	}
 	if closeErr.Code == websocket.CloseNormalClosure || closeErr.Code == websocket.CloseGoingAway {
diff --git a/libs/apps/logstream/streamer_test.go b/libs/apps/logstream/streamer_test.go
index cde5db8c94c..f264765342b 100644
--- a/libs/apps/logstream/streamer_test.go
+++ b/libs/apps/logstream/streamer_test.go
@@ -31,19 +31,22 @@ func TestLogStreamerTailBufferFlushes(t *testing.T) {
 		for i := 1; i <= 3; i++ {
 			require.NoError(t, sendEntry(conn, float64(i), fmt.Sprintf("msg%d", i)))
 		}
-		time.Sleep(50 * time.Millisecond)
 		_ = conn.WriteControl(websocket.CloseMessage, websocket.FormatCloseMessage(websocket.CloseNormalClosure, ""), time.Now().Add(time.Second))
 	})
 	defer server.Close()
 
 	buf := &bytes.Buffer{}
 	streamer := &logStreamer{
-		dialer:    &websocket.Dialer{},
-		url:       toWebSocketURL(server.URL),
-		token:     "test",
-		tail:      2,
-		follow:    false,
-		prefetch:  25 * time.Millisecond,
+		dialer: &websocket.Dialer{},
+		url:    toWebSocketURL(server.URL),
+		token:  "test",
+		tail:   2,
+		follow: false,
+		// No prefetch: the tail flushes deterministically on the clean connection
+		// close. A wall-clock prefetch timer races message delivery and flushes a
+		// partial buffer on a loaded runner (the prefetch-timer path is covered by
+		// TestLogStreamerTailFlushesWithoutFollow).
+		prefetch:  0,
 		writer:    buf,
 		formatter: newLogFormatter(false, flags.OutputText),
 	}
@@ -360,6 +363,7 @@ func (f *flakyDialer) DialContext(ctx context.Context, urlStr string, requestHea
 func newTestLogServer(t *testing.T, handler func(int, *websocket.Conn)) *httptest.Server {
 	upgrader := websocket.Upgrader{}
 	var connCount atomic.Int32
+	var handlers sync.WaitGroup
 
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		id := int(connCount.Add(1))
@@ -368,12 +372,20 @@ func newTestLogServer(t *testing.T, handler func(int, *websocket.Conn)) *httptes
 			t.Errorf("failed to upgrade connection: %v", err)
 			return
 		}
-		go handler(id, conn)
+		handlers.Go(func() {
+			handler(id, conn)
+		})
 	}))
 
 	t.Cleanup(func() {
+		// Close connections first so handlers blocked on the socket unblock, then
+		// wait for every handler goroutine to finish. Handlers assert with require
+		// on the *testing.T; without this wait a handler could call an assertion
+		// after the test completed, which panics the whole package test binary
+		// instead of failing the one test.
 		server.CloseClientConnections()
 		server.Close()
+		handlers.Wait()
 	})
 	return server
 }
diff --git a/libs/apps/manifest/manifest.go b/libs/apps/manifest/manifest.go
index 0d8f4abb3a9..2b4c5be9c98 100644
--- a/libs/apps/manifest/manifest.go
+++ b/libs/apps/manifest/manifest.go
@@ -26,6 +26,16 @@ type ResourceField struct {
 	Resolve      string `json:"resolve,omitempty"`
 }
 
+// ResourceBinding maps a resource to a DABs app resource entry.
+type ResourceBinding struct {
+	// YamlKey is the key under the app resource entry (e.g., "sql_warehouse", "uc_securable").
+	YamlKey string `json:"yamlKey"`
+	// VarFields are {manifestFieldName, dabsFieldName} pairs that become ${var.xxx} references.
+	VarFields [][2]string `json:"varFields"`
+	// StaticFields are {dabsFieldName, value} pairs emitted as literals.
+	StaticFields [][2]string `json:"staticFields,omitempty"`
+}
+
 // Resource defines a Databricks resource required or optional for a plugin.
 type Resource struct {
 	Type        string                   `json:"type"`        // e.g., "sql_warehouse"
@@ -35,6 +45,17 @@ type Resource struct {
 	Permission  string                   `json:"permission"`  // e.g., "CAN_USE"
 	Fields      map[string]ResourceField `json:"fields"`      // field definitions with env var mappings
 
+	// Scope is the user_api_scope needed to use this resource on behalf of the user.
+	// Empty when the resource type cannot be used on behalf of the user.
+	Scope string `json:"scope,omitempty"`
+
+	// AppOnly resources (e.g., secret, database) are always bound to the service principal.
+	AppOnly bool `json:"appOnly,omitempty"`
+
+	// Binding describes how the resource is bound to the app in databricks.yml.
+	// When nil, the CLI falls back to its built-in mapping for the resource type.
+	Binding *ResourceBinding `json:"binding,omitempty"`
+
 	// PluginName is the machine name of the plugin (e.g., "lakebase").
 	// Set during resource collection. Not part of the JSON manifest.
 	PluginName string `json:"-"`
@@ -49,6 +70,14 @@ func (r Resource) Key() string {
 	return r.ResourceKey
 }
 
+// AuthKey identifies a resource for auth-mode lookups using the same type+key
+// identity as resource de-duplication (CollectResources, generator.DedupeResources).
+// Two resources that collapse to one in the generated bundle therefore share an
+// auth mode, while two resources with the same key but different types do not collide.
+func (r Resource) AuthKey() string {
+	return r.Type + ":" + r.Key()
+}
+
 // VarPrefix returns the variable name prefix derived from the resource key.
 // Hyphens are replaced with underscores for YAML variable name compatibility.
 func (r Resource) VarPrefix() string {
@@ -81,10 +110,17 @@ type Plugin struct {
 	Resources          Resources `json:"resources"`
 	OnSetupMessage     string    `json:"onSetupMessage"`
 
+	// Scopes are user_api_scopes the plugin needs that are not tied to a resource (e.g., "ai-gateway").
+	Scopes []string `json:"scopes,omitempty"`
+
 	// Stability is one of "beta", "ga", or empty.
 	// Stored as a plain string so unknown future values round-trip unchanged.
 	// See https://github.com/databricks/appkit/pull/264.
 	Stability string `json:"stability,omitempty"`
+
+	// Deprecated plugins are hidden from the init picker.
+	// See https://github.com/databricks/appkit/pull/596.
+	Deprecated bool `json:"deprecated,omitempty"`
 }
 
 // StabilityLabel returns a user-facing tier label for non-GA plugins.
@@ -153,7 +189,7 @@ func (m *Manifest) GetPlugins() []Plugin {
 func (m *Manifest) GetSelectablePlugins() []Plugin {
 	var selectable []Plugin
 	for _, p := range m.GetPlugins() {
-		if !p.RequiredByTemplate {
+		if !p.RequiredByTemplate && !p.Deprecated {
 			selectable = append(selectable, p)
 		}
 	}
diff --git a/libs/apps/manifest/manifest_test.go b/libs/apps/manifest/manifest_test.go
index db571993b68..96dbf605165 100644
--- a/libs/apps/manifest/manifest_test.go
+++ b/libs/apps/manifest/manifest_test.go
@@ -1,6 +1,7 @@
 package manifest_test
 
 import (
+	"encoding/json"
 	"os"
 	"path/filepath"
 	"testing"
@@ -169,6 +170,24 @@ func TestGetSelectablePlugins(t *testing.T) {
 	assert.Equal(t, "optional-plugin", selectable[1].Name)
 }
 
+func TestGetSelectablePluginsExcludesDeprecated(t *testing.T) {
+	m := &manifest.Manifest{
+		Plugins: map[string]manifest.Plugin{
+			"analytics": {
+				Name: "analytics",
+			},
+			"legacy": {
+				Name:       "legacy",
+				Deprecated: true,
+			},
+		},
+	}
+
+	selectable := m.GetSelectablePlugins()
+	require.Len(t, selectable, 1)
+	assert.Equal(t, "analytics", selectable[0].Name)
+}
+
 func TestGetMandatoryPlugins(t *testing.T) {
 	m := &manifest.Manifest{
 		Plugins: map[string]manifest.Plugin{
@@ -417,3 +436,26 @@ func TestCollectOptionalResources(t *testing.T) {
 	require.Len(t, resources, 1)
 	assert.Equal(t, "catalog", resources[0].Type)
 }
+
+func TestResourceBindingJSON(t *testing.T) {
+	var r manifest.Resource
+	err := json.Unmarshal([]byte(`{
+		"type": "volume",
+		"resourceKey": "files",
+		"binding": {
+			"yamlKey": "uc_securable",
+			"varFields": [["id", "securable_full_name"]],
+			"staticFields": [["securable_type", "VOLUME"]]
+		}
+	}`), &r)
+	require.NoError(t, err)
+	assert.Equal(t, &manifest.ResourceBinding{
+		YamlKey:      "uc_securable",
+		VarFields:    [][2]string{{"id", "securable_full_name"}},
+		StaticFields: [][2]string{{"securable_type", "VOLUME"}},
+	}, r.Binding)
+
+	var noBinding manifest.Resource
+	require.NoError(t, json.Unmarshal([]byte(`{"type": "volume"}`), &noBinding))
+	assert.Nil(t, noBinding.Binding)
+}
diff --git a/libs/apps/packagejson/package_json.go b/libs/apps/packagejson/package_json.go
new file mode 100644
index 00000000000..214c1716ee4
--- /dev/null
+++ b/libs/apps/packagejson/package_json.go
@@ -0,0 +1,26 @@
+package packagejson
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+)
+
+const FileName = "package.json"
+
+// Read decodes package.json in workDir without interpreting its fields.
+func Read(workDir string) (map[string]json.RawMessage, error) {
+	data, err := os.ReadFile(filepath.Join(workDir, FileName))
+	if err != nil {
+		return nil, fmt.Errorf("failed to read %s: %w", FileName, err)
+	}
+	// npm accepts a UTF-8 BOM: https://github.com/npm/json-parse-even-better-errors.
+	data = bytes.TrimPrefix(data, []byte("\xef\xbb\xbf"))
+	var fields map[string]json.RawMessage
+	if err := json.Unmarshal(data, &fields); err != nil {
+		return nil, fmt.Errorf("failed to parse %s: %w", FileName, err)
+	}
+	return fields, nil
+}
diff --git a/libs/apps/packagejson/package_json_test.go b/libs/apps/packagejson/package_json_test.go
new file mode 100644
index 00000000000..55d4e4fde11
--- /dev/null
+++ b/libs/apps/packagejson/package_json_test.go
@@ -0,0 +1,55 @@
+package packagejson_test
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/databricks/cli/internal/testutil"
+	"github.com/databricks/cli/libs/apps/packagejson"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestRead(t *testing.T) {
+	for _, tt := range []struct {
+		name   string
+		prefix string
+	}{
+		{name: "JSON"},
+		{name: "BOM", prefix: "\xef\xbb\xbf"},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			dir := t.TempDir()
+			testutil.WriteFile(t, filepath.Join(dir, packagejson.FileName), tt.prefix+`{
+				"packageManager": "pnpm@10.30.3",
+				"Scripts": {"build": "echo build"},
+				"scripts": {"typecheck": null, "//": ["a comment"]},
+				"largeNumber": 9007199254740993
+			}`)
+			fields, err := packagejson.Read(dir)
+			require.NoError(t, err)
+			assert.JSONEq(t, `"pnpm@10.30.3"`, string(fields["packageManager"]))
+			assert.JSONEq(t, `{"build": "echo build"}`, string(fields["Scripts"]))
+			assert.JSONEq(t, `{"typecheck": null, "//": ["a comment"]}`, string(fields["scripts"]))
+			assert.Equal(t, "9007199254740993", string(fields["largeNumber"]))
+		})
+	}
+}
+
+func TestReadErrors(t *testing.T) {
+	t.Run("missing file", func(t *testing.T) {
+		fields, err := packagejson.Read(t.TempDir())
+		require.ErrorIs(t, err, os.ErrNotExist)
+		assert.Nil(t, fields)
+	})
+	t.Run("invalid JSON", func(t *testing.T) {
+		dir := t.TempDir()
+		testutil.WriteFile(t, filepath.Join(dir, packagejson.FileName), "{")
+		fields, err := packagejson.Read(dir)
+		require.Error(t, err)
+		assert.ErrorAs(t, err, new(*json.SyntaxError))
+		assert.Nil(t, fields)
+	})
+}
diff --git a/libs/apps/pkgmanager/json.go b/libs/apps/pkgmanager/json.go
new file mode 100644
index 00000000000..e38ab61582b
--- /dev/null
+++ b/libs/apps/pkgmanager/json.go
@@ -0,0 +1,78 @@
+package pkgmanager
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"slices"
+
+	"github.com/tailscale/hujson"
+)
+
+// RewriteJSON updates project naming and package-manager fields without reformatting the manifest.
+func RewriteJSON(data []byte, name string, m Manager) ([]byte, error) {
+	var pkg map[string]any
+	if err := json.Unmarshal(data, &pkg); err != nil {
+		return nil, fmt.Errorf("parse package.json: %w", err)
+	}
+	if pkg == nil {
+		return nil, errors.New("package.json must contain a JSON object")
+	}
+	doc, err := hujson.Parse(data)
+	if err != nil {
+		return nil, fmt.Errorf("parse package.json: %w", err)
+	}
+	Rewrite(pkg, m)
+	obj := doc.Value.(*hujson.Object)
+	setJSONField(obj, "name", name)
+	if pin, ok := pkg["packageManager"].(string); ok {
+		setJSONField(obj, "packageManager", pin)
+	} else {
+		for i, member := range obj.Members {
+			if member.Name.Value.(hujson.Literal).String() == "packageManager" {
+				obj.Members = slices.Delete(obj.Members, i, i+1)
+				break
+			}
+		}
+	}
+	if scripts, ok := pkg["scripts"].(map[string]any); ok {
+		scriptObj := doc.Find("/scripts").Value.(*hujson.Object)
+		for i := range scriptObj.Members {
+			member := &scriptObj.Members[i]
+			key := member.Name.Value.(hujson.Literal).String()
+			if script, ok := scripts[key].(string); ok && script != member.Value.Value.(hujson.Literal).String() {
+				member.Value.Value = hujson.String(script)
+			}
+		}
+	}
+	// Removing the last member can expose a trailing comma in hujson's representation.
+	doc.Standardize()
+	return doc.Pack(), nil
+}
+
+// setJSONField preserves existing whitespace and uses adjacent fields' spacing for insertions.
+func setJSONField(obj *hujson.Object, name, value string) {
+	for i := range obj.Members {
+		member := &obj.Members[i]
+		if member.Name.Value.(hujson.Literal).String() == name {
+			if literal, ok := member.Value.Value.(hujson.Literal); !ok || literal.Kind() != '"' || literal.String() != value {
+				member.Value.Value = hujson.String(value)
+			}
+			return
+		}
+	}
+	member := hujson.ObjectMember{
+		Name:  hujson.Value{Value: hujson.String(name)},
+		Value: hujson.Value{Value: hujson.String(value)},
+	}
+	if len(obj.Members) > 0 {
+		previous := obj.Members[len(obj.Members)-1]
+		member.Name.BeforeExtra = bytes.Clone(previous.Name.BeforeExtra)
+		member.Value.BeforeExtra = bytes.Clone(previous.Value.BeforeExtra)
+	} else if bytes.ContainsRune(obj.AfterExtra, '\n') {
+		member.Name.BeforeExtra = append(bytes.Clone(obj.AfterExtra), ' ', ' ')
+		member.Value.BeforeExtra = []byte(" ")
+	}
+	obj.Members = append(obj.Members, member)
+}
diff --git a/libs/apps/pkgmanager/json_test.go b/libs/apps/pkgmanager/json_test.go
new file mode 100644
index 00000000000..8e0c63a8976
--- /dev/null
+++ b/libs/apps/pkgmanager/json_test.go
@@ -0,0 +1,87 @@
+package pkgmanager_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/apps/pkgmanager"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestRewriteJSON(t *testing.T) {
+	for _, tt := range []struct {
+		name    string
+		manager string
+		input   string
+		want    string
+	}{
+		{
+			name:    "preserve order, numbers, nested formatting, and literal operators",
+			manager: "npm",
+			input:   "{\n  \"version\": \"1.0\",\n  \"name\": \"old\",\n  \"scripts\": {\"z\": \"pnpm run a && echo '<&>'\", \"a\": \"echo done\"},\n  \"custom\": {\"z\": 9007199254740993, \"a\": [1,  2]},\n  \"packageManager\": \"npm@10.8.3\"\n}\n",
+			want:    "{\n  \"version\": \"1.0\",\n  \"name\": \"new\",\n  \"scripts\": {\"z\": \"npm run a && echo '<&>'\", \"a\": \"echo done\"},\n  \"custom\": {\"z\": 9007199254740993, \"a\": [1,  2]},\n  \"packageManager\": \"npm@10.8.3\"\n}\n",
+		},
+		{
+			name:    "preserve pnpm pin and original escapes",
+			manager: "pnpm",
+			input:   `{"packageManager":"pnpm@10.17.1+sha224.abc","name":"new","scripts":{"dev":"echo \u0026"}}`,
+			want:    `{"packageManager":"pnpm@10.17.1+sha224.abc","name":"new","scripts":{"dev":"echo \u0026"}}`,
+		},
+		{
+			name:    "insert pin with tabs and CRLF",
+			manager: "pnpm",
+			input:   "{\r\n\t\"name\": \"old\",\r\n\t\"version\": \"1\"\r\n}\r\n",
+			want:    "{\r\n\t\"name\": \"new\",\r\n\t\"version\": \"1\",\r\n\t\"packageManager\": \"pnpm@11.0.8\"\r\n}\r\n",
+		},
+		{
+			name:    "remove conflicting pin",
+			manager: "npm",
+			input:   "{\n  \"packageManager\": \"pnpm@10.17.1\",\n  \"name\": \"old\"\n}\n",
+			want:    "{\n  \"name\": \"new\"\n}\n",
+		},
+		{
+			name:    "remove final pin",
+			manager: "npm",
+			input:   `{"name":"old","packageManager":"pnpm@11.0.8"}`,
+			want:    `{"name":"new"}`,
+		},
+		{
+			name:    "empty object",
+			manager: "pnpm",
+			input:   `{}`,
+			want:    `{"name":"new","packageManager":"pnpm@11.0.8"}`,
+		},
+		{
+			name:    "empty multiline object",
+			manager: "pnpm",
+			input:   "{\n}\n",
+			want:    "{\n  \"name\": \"new\",\n  \"packageManager\": \"pnpm@11.0.8\"\n}\n",
+		},
+		{
+			name:    "script names with pointer characters and non-string values",
+			manager: "npm",
+			input:   `{"name":"old","scripts":{"a/b~c":"pnpm run dev && pnpm run dev","dev":"node app.js","other":{"nested":1}}}`,
+			want:    `{"name":"new","scripts":{"a/b~c":"npm run dev && npm run dev","dev":"node app.js","other":{"nested":1}}}`,
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			m, err := pkgmanager.Resolve(tt.manager)
+			require.NoError(t, err)
+			got, err := pkgmanager.RewriteJSON([]byte(tt.input), "new", m)
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, string(got))
+			again, err := pkgmanager.RewriteJSON(got, "new", m)
+			require.NoError(t, err)
+			assert.Equal(t, got, again)
+		})
+	}
+}
+
+func TestRewriteJSONInvalid(t *testing.T) {
+	for _, input := range []string{`{`, `[]`, `null`, `{"name":"old",}`, `{"name":/* comment */"old"}`} {
+		t.Run(input, func(t *testing.T) {
+			_, err := pkgmanager.RewriteJSON([]byte(input), "new", pkgmanager.Default())
+			require.Error(t, err)
+		})
+	}
+}
diff --git a/libs/apps/pkgmanager/manager.go b/libs/apps/pkgmanager/manager.go
new file mode 100644
index 00000000000..63ef7610853
--- /dev/null
+++ b/libs/apps/pkgmanager/manager.go
@@ -0,0 +1,306 @@
+package pkgmanager
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"slices"
+	"strings"
+
+	"golang.org/x/mod/semver"
+)
+
+const (
+	// pnpmPin is used when the template does not provide a pnpm pin.
+	pnpmPin = "pnpm@11.0.8"
+
+	// pnpmDualPMThreshold is the first AppKit template version that supports dual package manager
+	// (pnpm and npm). Template versions below this threshold only support npm.
+	pnpmDualPMThreshold = "0.82.0"
+)
+
+// Manager represents a package manager with its properties.
+type Manager struct {
+	Name                string   // e.g., "npm", "pnpm"
+	InstallCommand      string   // e.g., "npm ci", "pnpm install --frozen-lockfile"
+	InstallArgs         []string // exec args after the binary name (e.g., ["ci", "--no-audit", ...])
+	LockfileNames       []string // In precedence order; npm prefers npm-shrinkwrap.json over package-lock.json.
+	WorkspaceConfigName string   // pnpm-workspace.yaml for pnpm, unused for npm
+	Pin                 string   // "name@version"; npm is empty until ResolvePin is called for an install.
+}
+
+// managers is the internal registry of supported package managers.
+var managers = map[string]Manager{
+	"pnpm": {
+		Name:           "pnpm",
+		InstallCommand: "pnpm install --frozen-lockfile",
+		// Include dev dependencies regardless of production settings.
+		// https://pnpm.io/cli/install#--prod--p
+		InstallArgs:         []string{"install", "--frozen-lockfile", "--prod=false"},
+		LockfileNames:       []string{"pnpm-lock.yaml"},
+		WorkspaceConfigName: "pnpm-workspace.yaml",
+		Pin:                 pnpmPin,
+	},
+	"npm": {
+		Name:                "npm",
+		InstallCommand:      "npm ci",
+		InstallArgs:         []string{"ci", "--include=dev", "--no-audit", "--no-fund", "--prefer-offline"},
+		LockfileNames:       []string{"npm-shrinkwrap.json", "package-lock.json"},
+		WorkspaceConfigName: "",
+	},
+}
+
+// Resolve returns the Manager descriptor for the given package manager name.
+// An empty name selects the default manager (pnpm).
+// Returns an error if the name is unknown.
+func Resolve(name string) (Manager, error) {
+	if name == "" {
+		return Default(), nil
+	}
+	if m, ok := managers[name]; ok {
+		return m, nil
+	}
+	// Build the list of allowed values from the managers map for a deterministic error message.
+	allowed := make([]string, 0, len(managers))
+	for k := range managers {
+		allowed = append(allowed, k)
+	}
+	slices.Sort(allowed)
+	return Manager{}, fmt.Errorf("unknown package manager %q (allowed: %s)", name, strings.Join(allowed, ", "))
+}
+
+// Default returns the default package manager (pnpm).
+func Default() Manager {
+	return managers["pnpm"]
+}
+
+// Detect selects pnpm when its lockfile exists, otherwise npm when its lockfile exists.
+// Lockless templates use the default manager and require --skip-install.
+func Detect(dir string) (Manager, error) {
+	for _, name := range []string{"pnpm", "npm"} {
+		m := managers[name]
+		lockfile, err := m.FindLockfile(dir)
+		if err != nil {
+			return Manager{}, err
+		}
+		if lockfile != "" {
+			return m, nil
+		}
+	}
+	return Default(), nil
+}
+
+// IsNodeTemplate reports whether the template contains a Node.js package manifest.
+func IsNodeTemplate(dir string) (bool, error) {
+	for _, name := range []string{"package.json", "package.json.tmpl"} {
+		if _, err := os.Stat(filepath.Join(dir, name)); errors.Is(err, fs.ErrNotExist) {
+			continue
+		} else if err != nil {
+			return false, fmt.Errorf("check %s: %w", name, err)
+		}
+		return true, nil
+	}
+	return false, nil
+}
+
+// ValidateExecutable checks that the selected package manager is available.
+func (m Manager) ValidateExecutable() error {
+	if _, err := exec.LookPath(m.Name); err != nil {
+		if m.Name == "pnpm" {
+			// https://pnpm.io/installation
+			return fmt.Errorf("pnpm is unavailable; use databricks apps init --package-manager npm, install pnpm with corepack enable pnpm or npx get-pnpm, or use databricks apps init --skip-install: %w", err)
+		}
+		return fmt.Errorf("%s is unavailable; install it and retry, or use databricks apps init --skip-install to scaffold without running setup: %w", m.Name, err)
+	}
+	return nil
+}
+
+// ResolvePin records the installed npm version for Node.js templates.
+// Call only when installing; scaffolding with --skip-install must not require npm.
+func (m Manager) ResolvePin(ctx context.Context, templateDir string) (Manager, error) {
+	if m.Name != "npm" {
+		return m, nil
+	}
+	isNode, err := IsNodeTemplate(templateDir)
+	if err != nil || !isNode {
+		return m, err
+	}
+
+	cmd := exec.CommandContext(ctx, m.Name, "--version")
+	// Ignore inherited template/project pins when selecting the installed npm.
+	// https://github.com/nodejs/corepack#environment-variables
+	cmd.Env = append(os.Environ(), "COREPACK_ENABLE_PROJECT_SPEC=0")
+	output, err := cmd.Output()
+	if err != nil {
+		return m, fmt.Errorf("detect npm version; ensure npm is installed and working, or use --skip-install: %w", err)
+	}
+	version := strings.TrimSpace(string(output))
+	if !semver.IsValid("v" + version) {
+		return m, fmt.Errorf("npm --version returned invalid version %q; ensure npm is working, or use --skip-install", version)
+	}
+	m.Pin = "npm@" + version
+	return m, nil
+}
+
+// EffectiveManager applies version-based constraints to determine the actual package manager to use.
+// For pnpm requests against template versions below the dual-PM support threshold, it downgrades to npm.
+// For npm requests, no downgrade occurs (npm is always supported).
+// Returns the effective Manager and a downgraded bool (true only when a pnpm request becomes npm).
+// Non-concrete versions (main, latest, empty, or branch names) are treated as >= threshold (no downgrade).
+func EffectiveManager(selected Manager, resolvedVersion string) (Manager, bool) {
+	// If the selected manager is already npm, no downgrade possible.
+	if selected.Name != "pnpm" {
+		return selected, false
+	}
+
+	// Extract the semantic version from template-v prefix if present.
+	version := resolvedVersion
+	const prefix = "template-v"
+	version = strings.TrimPrefix(version, prefix)
+	if !strings.HasPrefix(version, "v") {
+		version = "v" + version
+	}
+
+	// Non-concrete versions (main, latest, empty, or branch names) are treated as supporting dual-PM.
+	// Only concrete semantic versions are subject to the threshold check.
+	if !semver.IsValid(version) {
+		return selected, false
+	}
+
+	// Compare the version against the threshold.
+	// If version < threshold, downgrade to npm; otherwise honor the selection.
+	threshold := "v" + pnpmDualPMThreshold
+	if semver.Compare(version, threshold) < 0 {
+		return managers["npm"], true
+	}
+
+	return selected, false
+}
+
+// FindLockfile returns the lockfile used by the manager, or an empty name if none exists.
+// npm's precedence is documented at https://docs.npmjs.com/cli/configuring-npm/npm-shrinkwrap-json.
+func (m Manager) FindLockfile(dir string) (string, error) {
+	for _, name := range m.LockfileNames {
+		if _, err := os.Stat(filepath.Join(dir, name)); err == nil {
+			return name, nil
+		} else if !errors.Is(err, fs.ErrNotExist) {
+			return "", fmt.Errorf("check %s: %w", name, err)
+		}
+	}
+	return "", nil
+}
+
+// ValidateTemplate rejects templates with a lockfile only for another supported manager.
+// Templates without lockfiles can still be scaffolded with --skip-install.
+func (m Manager) ValidateTemplate(dir string, skipInstall bool) error {
+	name, err := m.FindLockfile(dir)
+	if err != nil || name != "" {
+		return err
+	}
+	for _, other := range managers {
+		if other.Name == m.Name {
+			continue
+		}
+		name, err := other.FindLockfile(dir)
+		if err != nil {
+			return err
+		}
+		if name != "" {
+			lockfiles := strings.Join(m.LockfileNames, " or ")
+			return fmt.Errorf("template has %s but no %s required by %q; use --package-manager %s or add %s to the template", name, lockfiles, m.InstallCommand, other.Name, lockfiles)
+		}
+	}
+	if skipInstall {
+		return nil
+	}
+	isNode, err := IsNodeTemplate(dir)
+	if err != nil {
+		return err
+	}
+	if isNode {
+		lockfiles := strings.Join(m.LockfileNames, " or ")
+		return fmt.Errorf("template has no %s required by %q; add %s to the template or use --skip-install to scaffold without installing dependencies", lockfiles, m.InstallCommand, lockfiles)
+	}
+	return nil
+}
+
+// Prune removes non-selected package manager artifacts from the given directory.
+// It builds the universe of all PM-specific artifacts from the capability map,
+// then removes all artifacts not belonging to the selected manager.
+// The operation is idempotent: no error is returned if a target artifact is absent.
+func (m Manager) Prune(dir string) error {
+	// Build the universe: all PM-specific artifacts across all managers.
+	universe := make(map[string]bool)
+	for _, mgr := range managers {
+		for _, name := range mgr.LockfileNames {
+			universe[name] = true
+		}
+		if mgr.WorkspaceConfigName != "" {
+			universe[mgr.WorkspaceConfigName] = true
+		}
+	}
+
+	// For the selected manager, identify which files to keep.
+	keep := make(map[string]bool)
+	for _, name := range m.LockfileNames {
+		keep[name] = true
+	}
+	if m.WorkspaceConfigName != "" {
+		keep[m.WorkspaceConfigName] = true
+	}
+
+	// Remove all artifacts in the universe that are not in the keep set.
+	for artifact := range universe {
+		if !keep[artifact] {
+			path := filepath.Join(dir, artifact)
+			// Ignore not-exist errors for idempotency.
+			if err := os.Remove(path); err != nil && !errors.Is(err, fs.ErrNotExist) {
+				return fmt.Errorf("failed to remove %s: %w", artifact, err)
+			}
+		}
+	}
+
+	return nil
+}
+
+// Rewrite mutates a decoded package.json (map[string]any) with package-manager-specific
+// transformations: updates "packageManager" and normalizes scripts. It preserves
+// matching pnpm pins; npm uses the installed version when available.
+// Script invocations, including those in command chains, use explicit "run" form.
+// Native package-manager operations and non-string script values are preserved.
+// Rewrite modifies the map in place and returns it for convenience.
+func Rewrite(pkg map[string]any, m Manager) map[string]any {
+	pin, _ := pkg["packageManager"].(string)
+	if m.Name == "pnpm" && strings.HasPrefix(pin, "pnpm@") {
+		// Templates may require a different pnpm version or an integrity suffix.
+		m.Pin = pin
+	}
+	if m.Pin != "" {
+		pkg["packageManager"] = m.Pin
+	} else if !strings.HasPrefix(pin, m.Name+"@") {
+		delete(pkg, "packageManager")
+	}
+
+	// Normalize script invocations without changing native package-manager operations.
+	scripts, ok := pkg["scripts"].(map[string]any)
+	if !ok {
+		// No scripts or not a map — nothing to normalize.
+		return pkg
+	}
+
+	for key, val := range scripts {
+		scriptStr, ok := val.(string)
+		if !ok {
+			// Skip non-string script values (they may be arrays or objects in some esoteric setups).
+			continue
+		}
+
+		scripts[key] = rewriteScript(scriptStr, m, scripts)
+	}
+
+	return pkg
+}
diff --git a/libs/apps/pkgmanager/manager_test.go b/libs/apps/pkgmanager/manager_test.go
new file mode 100644
index 00000000000..5dbd3887517
--- /dev/null
+++ b/libs/apps/pkgmanager/manager_test.go
@@ -0,0 +1,675 @@
+package pkgmanager_test
+
+import (
+	"maps"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"slices"
+	"strings"
+	"testing"
+
+	"github.com/databricks/cli/libs/apps/pkgmanager"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestResolvePnpm(t *testing.T) {
+	m, err := pkgmanager.Resolve("pnpm")
+	require.NoError(t, err)
+	assert.Equal(t, "pnpm", m.Name)
+	assert.Equal(t, "pnpm install --frozen-lockfile", m.InstallCommand)
+	assert.Equal(t, []string{"pnpm-lock.yaml"}, m.LockfileNames)
+	assert.Equal(t, "pnpm-workspace.yaml", m.WorkspaceConfigName)
+	assert.Equal(t, "pnpm@11.0.8", m.Pin)
+}
+
+func TestResolveNpm(t *testing.T) {
+	m, err := pkgmanager.Resolve("npm")
+	require.NoError(t, err)
+	assert.Equal(t, "npm", m.Name)
+	assert.Equal(t, "npm ci", m.InstallCommand)
+	assert.Equal(t, []string{"npm-shrinkwrap.json", "package-lock.json"}, m.LockfileNames)
+	assert.Empty(t, m.WorkspaceConfigName)
+	assert.Empty(t, m.Pin)
+}
+
+func TestResolvePinWithoutNpm(t *testing.T) {
+	t.Setenv("PATH", t.TempDir())
+	for _, tt := range []struct {
+		name    string
+		manager string
+		file    string
+		missing bool
+	}{
+		{"pnpm", "pnpm", "package.json", false},
+		{"non-Node template", "npm", "pyproject.toml", false},
+		{"npm unavailable", "npm", "package.json", true},
+		{"npm unavailable for Go template", "npm", "package.json.tmpl", true},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			dir := t.TempDir()
+			require.NoError(t, os.WriteFile(filepath.Join(dir, tt.file), []byte("{}"), 0o644))
+			m, err := pkgmanager.Resolve(tt.manager)
+			require.NoError(t, err)
+			resolved, err := m.ResolvePin(t.Context(), dir)
+			if tt.missing {
+				require.ErrorIs(t, err, exec.ErrNotFound)
+				assert.ErrorContains(t, err, "--skip-install")
+			} else {
+				require.NoError(t, err)
+			}
+			assert.Equal(t, m, resolved)
+		})
+	}
+}
+
+func TestRewritePin(t *testing.T) {
+	for _, tt := range []struct {
+		name     string
+		manager  string
+		resolved string
+		template any
+		want     any
+	}{
+		{"installed npm overrides pnpm", "npm", "npm@11.4.1", "pnpm@11.0.8", "npm@11.4.1"},
+		{"installed npm overrides old npm", "npm", "npm@11.4.1", "npm@9.9.4", "npm@11.4.1"},
+		{"installed npm adds pin", "npm", "npm@11.4.1", nil, "npm@11.4.1"},
+		{"skip preserves npm", "npm", "", "npm@9.9.4", "npm@9.9.4"},
+		{"skip preserves npm integrity", "npm", "", "npm@9.9.4+sha224.abc", "npm@9.9.4+sha224.abc"},
+		{"skip removes pnpm", "npm", "", "pnpm@11.0.8", nil},
+		{"skip removes yarn", "npm", "", "yarn@1.22.22", nil},
+		{"skip removes bun", "npm", "", "bun@1.2.0", nil},
+		{"skip leaves absent pin", "npm", "", nil, nil},
+		{"pnpm replaces npm", "pnpm", "", "npm@9.9.4", "pnpm@11.0.8"},
+		{"pnpm preserves template pin", "pnpm", "", "pnpm@10.17.1", "pnpm@10.17.1"},
+		{"pnpm preserves integrity", "pnpm", "", "pnpm@11.0.8+sha224.abc", "pnpm@11.0.8+sha224.abc"},
+		{"pnpm adds missing pin", "pnpm", "", nil, "pnpm@11.0.8"},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			m, err := pkgmanager.Resolve(tt.manager)
+			require.NoError(t, err)
+			if tt.resolved != "" {
+				m.Pin = tt.resolved
+			}
+			pkg := make(map[string]any)
+			if tt.template != nil {
+				pkg["packageManager"] = tt.template
+			}
+			pkgmanager.Rewrite(pkg, m)
+			assert.Equal(t, tt.want, pkg["packageManager"])
+			if tt.want == nil {
+				assert.NotContains(t, pkg, "packageManager")
+			}
+		})
+	}
+}
+
+func TestResolveUnknown(t *testing.T) {
+	_, err := pkgmanager.Resolve("unknown")
+	require.Error(t, err)
+	assert.Equal(t, `unknown package manager "unknown" (allowed: npm, pnpm)`, err.Error())
+}
+
+func TestDefault(t *testing.T) {
+	m := pkgmanager.Default()
+	assert.Equal(t, "pnpm", m.Name)
+	assert.Equal(t, "pnpm install --frozen-lockfile", m.InstallCommand)
+	resolved, err := pkgmanager.Resolve("")
+	require.NoError(t, err)
+	assert.Equal(t, m, resolved)
+}
+
+func TestDetect(t *testing.T) {
+	for _, tt := range []struct {
+		name  string
+		files []string
+		want  string
+	}{
+		{"lockless", nil, "pnpm"},
+		{"npm", []string{"package-lock.json"}, "npm"},
+		{"shrinkwrap", []string{"npm-shrinkwrap.json"}, "npm"},
+		{"pnpm", []string{"pnpm-lock.yaml"}, "pnpm"},
+		{"both", []string{"package-lock.json", "pnpm-lock.yaml"}, "pnpm"},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			dir := t.TempDir()
+			for _, name := range tt.files {
+				require.NoError(t, os.WriteFile(filepath.Join(dir, name), nil, 0o644))
+			}
+			m, err := pkgmanager.Detect(dir)
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, m.Name)
+		})
+	}
+}
+
+func TestIsNodeTemplate(t *testing.T) {
+	for _, tt := range []struct {
+		file string
+		want bool
+	}{
+		{"package.json", true},
+		{"package.json.tmpl", true},
+		{"pyproject.toml", false},
+		{"requirements.txt", false},
+	} {
+		t.Run(tt.file, func(t *testing.T) {
+			dir := t.TempDir()
+			require.NoError(t, os.WriteFile(filepath.Join(dir, tt.file), nil, 0o644))
+			got, err := pkgmanager.IsNodeTemplate(dir)
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
+
+func TestValidateExecutable(t *testing.T) {
+	t.Setenv("PATH", t.TempDir())
+	for _, name := range []string{"npm", "pnpm"} {
+		t.Run(name, func(t *testing.T) {
+			m, err := pkgmanager.Resolve(name)
+			require.NoError(t, err)
+			err = m.ValidateExecutable()
+			require.ErrorIs(t, err, exec.ErrNotFound)
+			assert.ErrorContains(t, err, "databricks apps init --skip-install")
+			if name == "pnpm" {
+				assert.ErrorContains(t, err, "databricks apps init --package-manager npm")
+				assert.ErrorContains(t, err, "corepack enable pnpm")
+				assert.ErrorContains(t, err, "npx get-pnpm")
+			}
+		})
+	}
+	executable, err := os.Executable()
+	require.NoError(t, err)
+	require.NoError(t, (pkgmanager.Manager{Name: executable}).ValidateExecutable())
+}
+
+func TestValidateTemplate(t *testing.T) {
+	for _, name := range []string{"npm", "pnpm"} {
+		m, err := pkgmanager.Resolve(name)
+		require.NoError(t, err)
+		for _, files := range [][]string{
+			nil,
+			{"package-lock.json"},
+			{"npm-shrinkwrap.json"},
+			{"pnpm-lock.yaml"},
+			{"package-lock.json", "pnpm-lock.yaml"},
+			{"npm-shrinkwrap.json", "pnpm-lock.yaml"},
+			{"npm-shrinkwrap.json", "package-lock.json"},
+			{"npm-shrinkwrap.json", "package-lock.json", "pnpm-lock.yaml"},
+		} {
+			t.Run(name+"/"+strings.Join(files, "+"), func(t *testing.T) {
+				dir := t.TempDir()
+				for _, file := range files {
+					require.NoError(t, os.WriteFile(filepath.Join(dir, file), []byte("lockfile"), 0o644))
+				}
+				err := m.ValidateTemplate(dir, false)
+				hasSelectedLockfile := slices.Contains(files, "pnpm-lock.yaml")
+				if name == "npm" {
+					hasSelectedLockfile = slices.Contains(files, "package-lock.json") || slices.Contains(files, "npm-shrinkwrap.json")
+				}
+				if len(files) > 0 && !hasSelectedLockfile {
+					other := "npm"
+					if name == "npm" {
+						other = "pnpm"
+					}
+					require.ErrorContains(t, err, "use --package-manager "+other)
+					assert.ErrorContains(t, err, strings.Join(m.LockfileNames, " or "))
+				} else {
+					require.NoError(t, err)
+				}
+			})
+		}
+	}
+}
+
+func TestValidateTemplateWithoutLockfiles(t *testing.T) {
+	tests := []struct {
+		name        string
+		file        string
+		skipInstall bool
+		wantErr     bool
+	}{
+		{"Node install", "package.json", false, true},
+		{"Node template install", "package.json.tmpl", false, true},
+		{"Node skip install", "package.json", true, false},
+		{"Node template skip install", "package.json.tmpl", true, false},
+		{"Python install", "requirements.txt", false, false},
+		{"empty template", "", false, false},
+	}
+	for _, name := range []string{"npm", "pnpm"} {
+		m, err := pkgmanager.Resolve(name)
+		require.NoError(t, err)
+		for _, tt := range tests {
+			t.Run(name+"/"+tt.name, func(t *testing.T) {
+				dir := t.TempDir()
+				if tt.file != "" {
+					require.NoError(t, os.WriteFile(filepath.Join(dir, tt.file), []byte("{}"), 0o644))
+				}
+				err := m.ValidateTemplate(dir, tt.skipInstall)
+				if tt.wantErr {
+					require.ErrorContains(t, err, strings.Join(m.LockfileNames, " or "))
+					assert.ErrorContains(t, err, m.InstallCommand)
+					assert.ErrorContains(t, err, "--skip-install")
+				} else {
+					require.NoError(t, err)
+				}
+			})
+		}
+	}
+}
+
+func TestFindLockfile(t *testing.T) {
+	m, err := pkgmanager.Resolve("npm")
+	require.NoError(t, err)
+	for _, tt := range []struct {
+		files []string
+		want  string
+	}{
+		{nil, ""},
+		{[]string{"pnpm-lock.yaml"}, ""},
+		{[]string{"package-lock.json"}, "package-lock.json"},
+		{[]string{"npm-shrinkwrap.json"}, "npm-shrinkwrap.json"},
+		{[]string{"package-lock.json", "npm-shrinkwrap.json"}, "npm-shrinkwrap.json"},
+	} {
+		t.Run(strings.Join(tt.files, "+"), func(t *testing.T) {
+			dir := t.TempDir()
+			for _, file := range tt.files {
+				require.NoError(t, os.WriteFile(filepath.Join(dir, file), []byte("lockfile"), 0o644))
+			}
+			name, err := m.FindLockfile(dir)
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, name)
+		})
+	}
+}
+
+func TestPrunePnpm(t *testing.T) {
+	dir := t.TempDir()
+
+	// Create all PM-specific artifacts
+	for _, file := range []string{"pnpm-lock.yaml", "package-lock.json", "npm-shrinkwrap.json", "pnpm-workspace.yaml", "package.json"} {
+		require.NoError(t, os.WriteFile(filepath.Join(dir, file), []byte("content"), 0o644))
+	}
+
+	m, err := pkgmanager.Resolve("pnpm")
+	require.NoError(t, err)
+	require.NoError(t, m.Prune(dir))
+
+	// pnpm should keep its lockfile and workspace config
+	assert.FileExists(t, filepath.Join(dir, "pnpm-lock.yaml"))
+	assert.FileExists(t, filepath.Join(dir, "pnpm-workspace.yaml"))
+	assert.FileExists(t, filepath.Join(dir, "package.json"))
+
+	// pnpm should remove npm lockfile
+	assert.NoFileExists(t, filepath.Join(dir, "package-lock.json"))
+	assert.NoFileExists(t, filepath.Join(dir, "npm-shrinkwrap.json"))
+}
+
+func TestPruneNpm(t *testing.T) {
+	dir := t.TempDir()
+
+	// Create all PM-specific artifacts
+	for _, file := range []string{"pnpm-lock.yaml", "package-lock.json", "npm-shrinkwrap.json", "pnpm-workspace.yaml", "package.json"} {
+		require.NoError(t, os.WriteFile(filepath.Join(dir, file), []byte("content"), 0o644))
+	}
+
+	m, err := pkgmanager.Resolve("npm")
+	require.NoError(t, err)
+	require.NoError(t, m.Prune(dir))
+
+	// npm should keep its lockfile only
+	assert.FileExists(t, filepath.Join(dir, "package-lock.json"))
+	assert.FileExists(t, filepath.Join(dir, "npm-shrinkwrap.json"))
+	assert.FileExists(t, filepath.Join(dir, "package.json"))
+
+	// npm should remove pnpm lockfile and workspace config
+	assert.NoFileExists(t, filepath.Join(dir, "pnpm-lock.yaml"))
+	assert.NoFileExists(t, filepath.Join(dir, "pnpm-workspace.yaml"))
+}
+
+func TestPruneIdempotent(t *testing.T) {
+	dir := t.TempDir()
+
+	// Only create pnpm files
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "pnpm-lock.yaml"), []byte("content"), 0o644))
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "package.json"), []byte("content"), 0o644))
+
+	m, err := pkgmanager.Resolve("pnpm")
+	require.NoError(t, err)
+
+	// Prune should succeed even when npm artifacts don't exist
+	require.NoError(t, m.Prune(dir))
+	require.NoError(t, m.Prune(dir))
+
+	// pnpm artifacts should remain
+	assert.FileExists(t, filepath.Join(dir, "pnpm-lock.yaml"))
+	assert.FileExists(t, filepath.Join(dir, "package.json"))
+}
+
+func TestRewrite(t *testing.T) {
+	tests := []struct {
+		name            string
+		selectedManager string
+		input           map[string]any
+		expectedPin     any
+		expectedScripts map[string]string
+	}{
+		{
+			name:            "pnpm selected - rewrite npm scripts",
+			selectedManager: "pnpm",
+			input: map[string]any{
+				"name": "my-app",
+				"scripts": map[string]any{
+					"build": "npm run build",
+					"dev":   "npm run dev",
+				},
+				"dependencies": map[string]any{
+					"react": "^18.0.0",
+				},
+			},
+			expectedPin: "pnpm@11.0.8",
+			expectedScripts: map[string]string{
+				"build": "pnpm run build",
+				"dev":   "pnpm run dev",
+			},
+		},
+		{
+			name:            "npm selected - rewrite pnpm scripts",
+			selectedManager: "npm",
+			input: map[string]any{
+				"name": "my-app",
+				"scripts": map[string]any{
+					"build": "pnpm run build",
+					"dev":   "pnpm dev",
+				},
+			},
+			expectedScripts: map[string]string{
+				"build": "npm run build",
+				"dev":   "npm run dev",
+			},
+		},
+		{
+			name:            "non-PM leading token - unchanged",
+			selectedManager: "pnpm",
+			input: map[string]any{
+				"scripts": map[string]any{
+					"dev": "vite dev",
+				},
+			},
+			expectedPin: "pnpm@11.0.8",
+			expectedScripts: map[string]string{
+				"dev": "vite dev",
+			},
+		},
+		{
+			name:            "already has run keyword - no double run",
+			selectedManager: "pnpm",
+			input: map[string]any{
+				"scripts": map[string]any{
+					"build": "npm run build",
+				},
+			},
+			expectedPin: "pnpm@11.0.8",
+			expectedScripts: map[string]string{
+				"build": "pnpm run build",
+			},
+		},
+		{
+			name:            "mixed scripts - some rewritten, some unchanged",
+			selectedManager: "pnpm",
+			input: map[string]any{
+				"scripts": map[string]any{
+					"build":  "npm run build",
+					"lint":   "eslint .",
+					"dev":    "pnpm dev",
+					"bundle": "vite build",
+				},
+			},
+			expectedPin: "pnpm@11.0.8",
+			expectedScripts: map[string]string{
+				"build":  "pnpm run build",
+				"lint":   "eslint .",
+				"dev":    "pnpm run dev",
+				"bundle": "vite build",
+			},
+		},
+		{
+			name:            "non-string script value - skip",
+			selectedManager: "pnpm",
+			input: map[string]any{
+				"scripts": map[string]any{
+					"build":  "npm run build",
+					"matrix": []string{"npm run a", "npm run b"},
+				},
+			},
+			expectedPin: "pnpm@11.0.8",
+			expectedScripts: map[string]string{
+				"build": "pnpm run build",
+			},
+		},
+		{
+			name:            "dependencies and overrides unchanged",
+			selectedManager: "pnpm",
+			input: map[string]any{
+				"scripts": map[string]any{
+					"build": "npm run build",
+				},
+				"dependencies": map[string]any{
+					"react": "^18.0.0",
+				},
+				"devDependencies": map[string]any{
+					"typescript": "^5.0.0",
+				},
+				"overrides": map[string]any{
+					"lodash": "4.17.21",
+				},
+			},
+			expectedPin: "pnpm@11.0.8",
+			expectedScripts: map[string]string{
+				"build": "pnpm run build",
+			},
+		},
+		{
+			name:            "npm-prefixed alias in dependencies - unchanged",
+			selectedManager: "pnpm",
+			input: map[string]any{
+				"scripts": map[string]any{
+					"build": "npm run build",
+				},
+				"dependencies": map[string]any{
+					"foo": "npm:bar@^1.0.0",
+				},
+			},
+			expectedPin: "pnpm@11.0.8",
+			expectedScripts: map[string]string{
+				"build": "pnpm run build",
+			},
+		},
+		{
+			name:            "yarn and bun scripts also rewritten",
+			selectedManager: "pnpm",
+			input: map[string]any{
+				"scripts": map[string]any{
+					"yarn-build": "yarn run build",
+					"bun-dev":    "bun dev",
+					"dev":        "vite dev",
+				},
+			},
+			expectedPin: "pnpm@11.0.8",
+			expectedScripts: map[string]string{
+				"yarn-build": "pnpm run build",
+				"bun-dev":    "pnpm run dev",
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			m, err := pkgmanager.Resolve(tt.selectedManager)
+			require.NoError(t, err)
+
+			// Make a copy of the input to avoid mutating the test's input
+			inputCopy := make(map[string]any)
+			maps.Copy(inputCopy, tt.input)
+
+			// Call Rewrite
+			result := pkgmanager.Rewrite(inputCopy, m)
+
+			// Verify packageManager is set to the expected pin
+			assert.Equal(t, tt.expectedPin, result["packageManager"])
+
+			// Verify scripts are rewritten as expected
+			scripts, ok := result["scripts"].(map[string]any)
+			assert.True(t, ok, "scripts should still be a map")
+
+			for name, expectedVal := range tt.expectedScripts {
+				actualVal, ok := scripts[name].(string)
+				assert.True(t, ok, "script %q should be a string", name)
+				assert.Equal(t, expectedVal, actualVal, "script %q", name)
+			}
+
+			// Verify dependencies, devDependencies, and overrides are unchanged
+			if deps, ok := tt.input["dependencies"].(map[string]any); ok {
+				resultDeps, ok := result["dependencies"].(map[string]any)
+				assert.True(t, ok, "dependencies should still be a map")
+				assert.Equal(t, deps, resultDeps, "dependencies should be unchanged")
+			}
+			if devDeps, ok := tt.input["devDependencies"].(map[string]any); ok {
+				resultDevDeps, ok := result["devDependencies"].(map[string]any)
+				assert.True(t, ok, "devDependencies should still be a map")
+				assert.Equal(t, devDeps, resultDevDeps, "devDependencies should be unchanged")
+			}
+			if overrides, ok := tt.input["overrides"].(map[string]any); ok {
+				resultOverrides, ok := result["overrides"].(map[string]any)
+				assert.True(t, ok, "overrides should still be a map")
+				assert.Equal(t, overrides, resultOverrides, "overrides should be unchanged")
+			}
+		})
+	}
+}
+
+func TestEffectiveManager(t *testing.T) {
+	pnpm, err := pkgmanager.Resolve("pnpm")
+	require.NoError(t, err)
+	npm, err := pkgmanager.Resolve("npm")
+	require.NoError(t, err)
+
+	tests := []struct {
+		name            string
+		selectedManager pkgmanager.Manager
+		version         string
+		expectManager   string
+		expectDowngrade bool
+	}{
+		// Explicit pnpm requests with concrete versions
+		{
+			name:            "pnpm with version below threshold",
+			selectedManager: pnpm,
+			version:         "template-v0.81.0",
+			expectManager:   "npm",
+			expectDowngrade: true,
+		},
+		{
+			name:            "pnpm with version at threshold",
+			selectedManager: pnpm,
+			version:         "template-v0.82.0",
+			expectManager:   "pnpm",
+			expectDowngrade: false,
+		},
+		{
+			name:            "pnpm with version above threshold",
+			selectedManager: pnpm,
+			version:         "template-v0.83.0",
+			expectManager:   "pnpm",
+			expectDowngrade: false,
+		},
+		{
+			name:            "pnpm with v-prefixed version below threshold",
+			selectedManager: pnpm,
+			version:         "v0.81.0",
+			expectManager:   "npm",
+			expectDowngrade: true,
+		},
+		{
+			name:            "pnpm with unprefixed version below threshold",
+			selectedManager: pnpm,
+			version:         "0.81.0",
+			expectManager:   "npm",
+			expectDowngrade: true,
+		},
+
+		// Explicit pnpm requests with non-concrete versions
+		{
+			name:            "pnpm with version-like branch below threshold",
+			selectedManager: pnpm,
+			version:         "0.81-maintenance",
+			expectManager:   "pnpm",
+		},
+		{
+			name:            "pnpm with v-prefixed version-like branch above threshold",
+			selectedManager: pnpm,
+			version:         "v0.83-maintenance",
+			expectManager:   "pnpm",
+		},
+		{
+			name:            "pnpm with template-prefixed version-like branch",
+			selectedManager: pnpm,
+			version:         "template-v0.81-maintenance",
+			expectManager:   "pnpm",
+		},
+		{
+			name:            "pnpm with main branch",
+			selectedManager: pnpm,
+			version:         "main",
+			expectManager:   "pnpm",
+			expectDowngrade: false,
+		},
+		{
+			name:            "pnpm with empty version",
+			selectedManager: pnpm,
+			version:         "",
+			expectManager:   "pnpm",
+			expectDowngrade: false,
+		},
+		{
+			name:            "pnpm with branch name",
+			selectedManager: pnpm,
+			version:         "feature-x",
+			expectManager:   "pnpm",
+			expectDowngrade: false,
+		},
+
+		// Explicit npm requests
+		{
+			name:            "npm with version below threshold",
+			selectedManager: npm,
+			version:         "template-v0.81.0",
+			expectManager:   "npm",
+			expectDowngrade: false,
+		},
+		{
+			name:            "npm with version above threshold",
+			selectedManager: npm,
+			version:         "template-v0.83.0",
+			expectManager:   "npm",
+			expectDowngrade: false,
+		},
+		{
+			name:            "npm with main branch",
+			selectedManager: npm,
+			version:         "main",
+			expectManager:   "npm",
+			expectDowngrade: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			effective, downgraded := pkgmanager.EffectiveManager(tt.selectedManager, tt.version)
+			assert.Equal(t, tt.expectManager, effective.Name, "manager name mismatch")
+			assert.Equal(t, tt.expectDowngrade, downgraded, "downgrade bool mismatch")
+		})
+	}
+}
diff --git a/libs/apps/pkgmanager/scripts.go b/libs/apps/pkgmanager/scripts.go
new file mode 100644
index 00000000000..8df70406b1e
--- /dev/null
+++ b/libs/apps/pkgmanager/scripts.go
@@ -0,0 +1,271 @@
+package pkgmanager
+
+import "strings"
+
+// rewriteScript replaces script invocations at command boundaries, preserving
+// argument text and quoting instead of reserializing the shell command.
+func rewriteScript(script string, m Manager, scripts map[string]any) string {
+	var out strings.Builder
+	last := 0
+	commandStart := true
+	for pos := 0; pos < len(script); {
+		start, end := scriptToken(script, pos)
+		if start == end {
+			break
+		}
+		pos = end
+		word := script[start:end]
+		if isScriptSeparator(word[0]) {
+			commandStart = true
+			continue
+		}
+		if !commandStart {
+			continue
+		}
+		if isScriptAssignment(word) {
+			continue
+		}
+		if word == "env" {
+			pos = envCommandStart(script, end)
+			continue
+		}
+		commandStart = false
+		switch word {
+		case "npm", "pnpm", "yarn", "bun":
+		default:
+			continue
+		}
+
+		var options strings.Builder
+		beforeCommand := end
+		for optionEnd := scriptManagerOptionEnd(script, beforeCommand); optionEnd != beforeCommand; optionEnd = scriptManagerOptionEnd(script, beforeCommand) {
+			options.WriteString(script[beforeCommand:optionEnd])
+			beforeCommand = optionEnd
+		}
+		nextStart, nextEnd := scriptToken(script, beforeCommand)
+		command := script[nextStart:nextEnd]
+		run := " run"
+		beforeName, nameEnd := beforeCommand, nextEnd
+		if command == "run" || command == "run-script" {
+			run = script[beforeCommand:nextEnd]
+			beforeName = nextEnd
+			for optionEnd := scriptManagerOptionEnd(script, beforeName); optionEnd != beforeName; optionEnd = scriptManagerOptionEnd(script, beforeName) {
+				options.WriteString(script[beforeName:optionEnd])
+				beforeName = optionEnd
+			}
+			argStart, argEnd := scriptToken(script, beforeName)
+			if argStart == argEnd || isScriptSeparator(script[argStart]) || script[argStart] == '#' {
+				continue // A bare `run` lists scripts; it does not invoke one.
+			}
+			nameEnd = argEnd
+			if word == m.Name {
+				continue
+			}
+		} else if _, ok := scripts[command].(string); !ok || isPackageManagerCommand(command) {
+			continue
+		}
+
+		// npm consumes --; pnpm forwards every argument after the script name.
+		// https://docs.npmjs.com/cli/commands/npm-run-script and https://pnpm.io/cli/run
+		// Yarn and Bun also forward script flags without requiring a separator.
+		// https://yarnpkg.com/cli/run and https://bun.sh/docs/cli/run
+		args := ""
+		pos = nameEnd
+		switch {
+		case (word == "pnpm" || word == "yarn" || word == "bun") && m.Name == "npm":
+			argStart, argEnd := scriptToken(script, nameEnd)
+			if argStart != argEnd && !isScriptSeparator(script[argStart]) && script[argStart] != '#' {
+				args = " --"
+			}
+		case word == "npm" && m.Name == "pnpm":
+			var trailingOptions string
+			trailingOptions, args, pos = npmScriptArguments(script, nameEnd)
+			options.WriteString(trailingOptions)
+		}
+		out.WriteString(script[last:start])
+		out.WriteString(m.Name)
+		out.WriteString(run)
+		out.WriteString(options.String())
+		out.WriteString(script[beforeName:nameEnd])
+		out.WriteString(args)
+		last = pos
+	}
+	out.WriteString(script[last:])
+	return out.String()
+}
+
+// envCommandStart skips env options, leaving assignments for the command scanner.
+// https://pubs.opengroup.org/onlinepubs/9799919799/utilities/env.html
+func envCommandStart(script string, pos int) int {
+	for {
+		start, end := scriptToken(script, pos)
+		word := script[start:end]
+		switch {
+		case word == "--":
+			return end
+		case word == "-i" || word == "--ignore-environment" || strings.HasPrefix(word, "--unset="):
+			pos = end
+		case word == "-u" || word == "--unset":
+			_, pos = scriptToken(script, end)
+		default:
+			return pos
+		}
+	}
+}
+
+// scriptManagerOptionEnd includes a separate value for options that take one.
+// Boolean options must not consume positional script arguments.
+func scriptManagerOptionEnd(script string, pos int) int {
+	start, end := scriptToken(script, pos)
+	word := scriptWordValue(script[start:end])
+	if !strings.HasPrefix(word, "-") || word == "--" {
+		return pos
+	}
+	valueStart, valueEnd := scriptToken(script, end)
+	if valueStart == valueEnd || isScriptSeparator(script[valueStart]) || script[valueStart] == '#' {
+		return end
+	}
+	switch word {
+	case "--loglevel", "--script-shell", "--prefix", "--dir", "-C", "--workspace", "-w", "--filter", "-F":
+		return valueEnd
+	case "--if-present", "--no-if-present":
+		// Logging shortcuts such as --silent and -s do not take boolean values.
+		switch scriptWordValue(script[valueStart:valueEnd]) {
+		case "true", "false":
+			return valueEnd
+		}
+	}
+	return end
+}
+
+// npmScriptArguments separates npm options from child arguments up to a command boundary.
+// Unlike pnpm, npm consumes manager options anywhere before --, even after the script name.
+func npmScriptArguments(script string, pos int) (options, args string, end int) {
+	var managerOptions, scriptArgs strings.Builder
+	argumentsOnly := false
+	for {
+		start, end := scriptToken(script, pos)
+		if start == end || isScriptSeparator(script[start]) || script[start] == '#' {
+			return managerOptions.String(), scriptArgs.String(), pos
+		}
+		if !argumentsOnly {
+			if scriptWordValue(script[start:end]) == "--" {
+				argumentsOnly = true
+				pos = end
+				continue
+			}
+			if optionEnd := scriptManagerOptionEnd(script, pos); optionEnd != pos {
+				managerOptions.WriteString(script[pos:optionEnd])
+				pos = optionEnd
+				continue
+			}
+		}
+		scriptArgs.WriteString(script[pos:end])
+		pos = end
+	}
+}
+
+// scriptWordValue removes shell quoting for classification without expanding variables.
+// The rewriter emits the original source text, preserving literal quotes and escapes.
+// https://pubs.opengroup.org/onlinepubs/9799919799/utilities/V3_chap02.html#tag_19_02
+func scriptWordValue(word string) string {
+	var value strings.Builder
+	var quote byte
+	for pos := 0; pos < len(word); pos++ {
+		c := word[pos]
+		switch {
+		case c == '\\' && quote != '\'':
+			// Within double quotes, backslashes only escape these shell metacharacters.
+			if pos+1 < len(word) && (quote == 0 || strings.ContainsRune("$`\"\\\n", rune(word[pos+1]))) {
+				pos++
+				if word[pos] != '\n' {
+					value.WriteByte(word[pos])
+				}
+			} else {
+				value.WriteByte(c)
+			}
+		case quote != 0 && c == quote:
+			quote = 0
+		case quote == 0 && (c == '\'' || c == '"'):
+			quote = c
+		default:
+			value.WriteByte(c)
+		}
+	}
+	return value.String()
+}
+
+// isScriptAssignment recognizes shell NAME=value prefixes, including quoted values.
+func isScriptAssignment(word string) bool {
+	name, _, ok := strings.Cut(word, "=")
+	if !ok || name == "" {
+		return false
+	}
+	for i, c := range name {
+		if c == '_' || (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || (i > 0 && c >= '0' && c <= '9') {
+			continue
+		}
+		return false
+	}
+	return true
+}
+
+// isPackageManagerCommand distinguishes native operations from script shorthand.
+// Native operations have manager-specific semantics and cannot be translated as
+// script calls. See https://pnpm.io/cli/run and https://docs.npmjs.com/cli/commands.
+func isPackageManagerCommand(command string) bool {
+	switch command {
+	case "add", "audit", "bin", "cache", "ci", "config", "create", "dedupe", "dlx",
+		"env", "exec", "fetch", "help", "import", "info", "init", "install", "link",
+		"list", "login", "logout", "outdated", "pack", "patch", "patch-commit",
+		"prune", "publish", "rebuild", "remove", "root", "run", "run-script",
+		"setup", "store", "uninstall", "unlink", "update", "upgrade", "version", "view", "why":
+		return true
+	}
+	return false
+}
+
+// isScriptSeparator recognizes command boundaries supported by the rewriter.
+func isScriptSeparator(c byte) bool {
+	return strings.ContainsRune("&|;()\n", rune(c))
+}
+
+// scriptToken returns source offsets so untouched arguments retain their quoting
+// and whitespace. Quoted or escaped separators are part of a word, not a command boundary.
+func scriptToken(script string, pos int) (start, end int) {
+	for pos < len(script) && strings.ContainsRune(" \t\r", rune(script[pos])) {
+		pos++
+	}
+	start = pos
+	if pos == len(script) {
+		return start, pos
+	}
+	if isScriptSeparator(script[pos]) {
+		return start, pos + 1
+	}
+	if script[pos] == '#' {
+		for pos < len(script) && script[pos] != '\n' {
+			pos++
+		}
+		return start, pos
+	}
+	var quote byte
+	for pos < len(script) {
+		c := script[pos]
+		switch {
+		case c == '\\' && quote != '\'', c == '^' && quote == 0:
+			pos = min(pos+2, len(script))
+			continue
+		case quote != 0:
+			if c == quote {
+				quote = 0
+			}
+		case c == '\'' || c == '"' || c == '`':
+			quote = c
+		case strings.ContainsRune(" \t\r", rune(c)) || isScriptSeparator(c):
+			return start, pos
+		}
+		pos++
+	}
+	return start, pos
+}
diff --git a/libs/apps/pkgmanager/scripts_test.go b/libs/apps/pkgmanager/scripts_test.go
new file mode 100644
index 00000000000..194d36680bf
--- /dev/null
+++ b/libs/apps/pkgmanager/scripts_test.go
@@ -0,0 +1,154 @@
+package pkgmanager_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/apps/pkgmanager"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestRewriteScriptCommands(t *testing.T) {
+	tests := []struct {
+		name   string
+		script string
+		want   string
+	}{
+		{"compound build", "pnpm run server && pnpm run client", "npm run server && npm run client"},
+		{"compound predev", "pnpm run sync && pnpm run typegen", "npm run sync && npm run typegen"},
+		{"no spaces around separator", "pnpm run server&&pnpm run client", "npm run server&&npm run client"},
+		{"conditional", "pnpm run server || pnpm run client", "npm run server || npm run client"},
+		{"multiple statements", "pnpm run server; pnpm run client", "npm run server; npm run client"},
+		{"pipeline", "pnpm run server | pnpm run client", "npm run server | npm run client"},
+		{"line break", "pnpm run server\npnpm run client", "npm run server\nnpm run client"},
+		{"after another tool", "node --version && pnpm run server", "node --version && npm run server"},
+		{"leading whitespace", "  pnpm run server", "  npm run server"},
+		{"tabs", "pnpm\trun\tserver", "npm\trun\tserver"},
+		{"shorthand", "pnpm server && pnpm client", "npm run server && npm run client"},
+		{"native clean install", "npm ci", "npm ci"},
+		{"native exec", "npm exec tsc", "npm exec tsc"},
+		{"native lifecycle name", "npm install", "npm install"},
+		{"bare manager", "pnpm", "pnpm"},
+		{"list scripts", "pnpm run", "pnpm run"},
+		{"list scripts before comment", "pnpm run # list scripts", "pnpm run # list scripts"},
+		{"quoted argument", `echo "pnpm run server && pnpm run client" && pnpm run server`, `echo "pnpm run server && pnpm run client" && npm run server`},
+		{"single quoted argument", `node -e 'console.log("pnpm run server && pnpm run client")' && pnpm run server`, `node -e 'console.log("pnpm run server && pnpm run client")' && npm run server`},
+		{"command argument", "echo pnpm run server", "echo pnpm run server"},
+		{"script arguments", `pnpm run server -- --label "pnpm run client"`, `npm run server -- -- --label "pnpm run client"`},
+		{"environment assignment", "NODE_ENV=production pnpm run server", "NODE_ENV=production npm run server"},
+		{"multiple assignments", `NODE_ENV=production LABEL="hello world" pnpm run server`, `NODE_ENV=production LABEL="hello world" npm run server`},
+		{"assignment in chain", "pnpm run server && NODE_ENV=production pnpm run client", "npm run server && NODE_ENV=production npm run client"},
+		{"assignment argument", "echo NODE_ENV=production pnpm run server", "echo NODE_ENV=production pnpm run server"},
+		{"environment wrapper", "env NODE_ENV=production pnpm run server", "env NODE_ENV=production npm run server"},
+		{"environment wrapper shorthand", `env NODE_ENV=production LABEL="hello world" pnpm server`, `env NODE_ENV=production LABEL="hello world" npm run server`},
+		{"environment wrapper options", "env -i -u OLD --unset=OTHER -- NODE_ENV=production pnpm run server", "env -i -u OLD --unset=OTHER -- NODE_ENV=production npm run server"},
+		{"environment wrapper in chain", "env pnpm run server && env NODE_ENV=production pnpm run client", "env npm run server && env NODE_ENV=production npm run client"},
+		{"environment wrapper script arguments", "env NODE_ENV=production pnpm run server --port 1234", "env NODE_ENV=production npm run server -- --port 1234"},
+		{"environment wrapper argument", "env echo pnpm run server", "env echo pnpm run server"},
+		{"environment wrapper option value", "env -u pnpm echo pnpm run server", "env -u pnpm echo pnpm run server"},
+		{"environment wrapper quoted value", `env LABEL="pnpm run server" echo pnpm run server`, `env LABEL="pnpm run server" echo pnpm run server`},
+		{"environment wrapper as argument", "echo env pnpm run server", "echo env pnpm run server"},
+		{"escaped separator", `echo pnpm\;pnpm run server && pnpm run client`, `echo pnpm\;pnpm run server && npm run client`},
+		{"Windows escaped separator", `echo pnpm^&pnpm run server && pnpm run client`, `echo pnpm^&pnpm run server && npm run client`},
+	}
+	m, err := pkgmanager.Resolve("npm")
+	require.NoError(t, err)
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			pkg := map[string]any{"scripts": map[string]any{
+				"check": tt.script, "server": "node server.js", "client": "node client.js",
+				"install": "node setup.js",
+			}}
+			pkgmanager.Rewrite(pkg, m)
+			assert.Equal(t, tt.want, pkg["scripts"].(map[string]any)["check"])
+		})
+	}
+}
+
+func TestRewriteScriptArguments(t *testing.T) {
+	tests := []struct {
+		manager string
+		script  string
+		want    string
+	}{
+		{"npm", "pnpm run task --port 1234", "npm run task -- --port 1234"},
+		{"npm", "yarn run task --port 1234", "npm run task -- --port 1234"},
+		{"npm", "bun run task --port 1234", "npm run task -- --port 1234"},
+		{"npm", "yarn task --port 1234", "npm run task -- --port 1234"},
+		{"npm", "bun task --port 1234", "npm run task -- --port 1234"},
+		{"npm", `yarn run task --label "hello world"`, `npm run task -- --label "hello world"`},
+		{"npm", `bun run task --label "hello world"`, `npm run task -- --label "hello world"`},
+		{"npm", "yarn run task # comment", "npm run task # comment"},
+		{"npm", "bun run task # comment", "npm run task # comment"},
+		{"npm", "yarn run task --port 1234 && bun run task --port 5678", "npm run task -- --port 1234 && npm run task -- --port 5678"},
+		{"npm", `pnpm run task --label "hello world"`, `npm run task -- --label "hello world"`},
+		{"npm", "pnpm task --port 1234", "npm run task -- --port 1234"},
+		{"npm", "pnpm run task first -- --port 1234", "npm run task -- first -- --port 1234"},
+		{"npm", "pnpm run task # comment", "npm run task # comment"},
+		{"npm", "pnpm run task --port 1234 && pnpm run task --port 5678", "npm run task -- --port 1234 && npm run task -- --port 5678"},
+		{"pnpm", "npm run task -- --port 1234", "pnpm run task --port 1234"},
+		{"pnpm", `npm run task -- --label "hello world"`, `pnpm run task --label "hello world"`},
+		{"pnpm", "npm run task first -- --port 1234", "pnpm run task first --port 1234"},
+		{"pnpm", "npm run task --", "pnpm run task"},
+		{"pnpm", "npm run task -- -- --port 1234", "pnpm run task -- --port 1234"},
+		{"pnpm", `npm run task "--" --port 1234`, "pnpm run task --port 1234"},
+		{"pnpm", "npm run task -- --port 1234 && npm run task -- --port 5678", "pnpm run task --port 1234 && pnpm run task --port 5678"},
+		{"npm", "npm run task -- --port 1234", "npm run task -- --port 1234"},
+		{"pnpm", "pnpm run task --port 1234", "pnpm run task --port 1234"},
+		{"pnpm", "npm run missing --if-present", "pnpm run --if-present missing"},
+		{"pnpm", "npm run task --silent", "pnpm run --silent task"},
+		{"pnpm", "npm --silent run task", "pnpm run --silent task"},
+		{"pnpm", "npm run --if-present missing", "pnpm run --if-present missing"},
+		{"pnpm", "npm --silent run --if-present missing", "pnpm run --silent --if-present missing"},
+		{"pnpm", "npm run task first --silent second -- --if-present", "pnpm run --silent task first second --if-present"},
+		{"pnpm", "npm run task --if-present --silent -- --silent", "pnpm run --if-present --silent task --silent"},
+		{"pnpm", "npm run task --if-present=false --silent=true", "pnpm run --if-present=false --silent=true task"},
+		{"pnpm", "npm run task -s first -- --silent", "pnpm run -s task first --silent"},
+		{"pnpm", "npm run task --loglevel warn first", "pnpm run --loglevel warn task first"},
+		{"pnpm", `npm run task --script-shell "custom shell" first`, `pnpm run --script-shell "custom shell" task first`},
+		{"pnpm", `npm run task '--silent' -- "--if-present"`, `pnpm run '--silent' task "--if-present"`},
+		{"pnpm", "npm run task --silent && npm run missing --if-present # done", "pnpm run --silent task && pnpm run --if-present missing # done"},
+		{"pnpm", "env NODE_ENV=production npm run task --silent -- --silent", "env NODE_ENV=production pnpm run --silent task --silent"},
+		{"npm", "pnpm run --if-present missing", "npm run --if-present missing"},
+		{"npm", "pnpm --silent run --if-present task --silent", "npm run --silent --if-present task -- --silent"},
+		{"npm", "pnpm run task --silent", "npm run task -- --silent"},
+		{"npm", "npm run task --silent", "npm run task --silent"},
+		{"pnpm", "npm run --silent", "npm run --silent"},
+		{"pnpm", "npm run missing --if-present false", "pnpm run --if-present false missing"},
+		{"pnpm", "npm run task --if-present true", "pnpm run --if-present true task"},
+		{"pnpm", "npm --if-present false run missing", "pnpm run --if-present false missing"},
+		{"pnpm", "npm run --if-present false missing", "pnpm run --if-present false missing"},
+		{"pnpm", `npm run task --if-present "false" first`, `pnpm run --if-present "false" task first`},
+		{"pnpm", `npm run task --if-present f'al'se first`, `pnpm run --if-present f'al'se task first`},
+		{"pnpm", `npm run task --if-present f\alse`, `pnpm run --if-present f\alse task`},
+		{"pnpm", "npm run task --if-present true -- true false", "pnpm run --if-present true task true false"},
+		{"pnpm", "npm run task --if-present=false true", "pnpm run --if-present=false task true"},
+		{"pnpm", `npm run task --if-present '"false"'`, `pnpm run --if-present task '"false"'`},
+		{"pnpm", `npm run task --if-present "fa\lse"`, `pnpm run --if-present task "fa\lse"`},
+		{"pnpm", "npm run task --no-if-present true", "pnpm run --no-if-present true task"},
+		{"pnpm", "npm run missing --no-if-present false", "pnpm run --no-if-present false missing"},
+		{"pnpm", "npm run task --silent false", "pnpm run --silent task false"},
+		{"pnpm", "npm run task -s true", "pnpm run -s task true"},
+		{"pnpm", "npm run missing --if-present false || npm run task --if-present true", "pnpm run --if-present false missing || pnpm run --if-present true task"},
+		{"npm", "pnpm run --if-present false missing", "npm run --if-present false missing"},
+		{"npm", "pnpm run --if-present true task --silent", "npm run --if-present true task -- --silent"},
+		{"pnpm", `npm run task '"--label"'`, `pnpm run task '"--label"'`},
+		{"pnpm", `npm run task "'--label'"`, `pnpm run task "'--label'"`},
+		{"pnpm", `npm run task '""--label""'`, `pnpm run task '""--label""'`},
+		{"pnpm", `npm run task \"--label\"`, `pnpm run task \"--label\"`},
+		{"pnpm", `npm run task '"--"' --silent`, `pnpm run --silent task '"--"'`},
+		{"pnpm", `npm run task ""--silent`, `pnpm run ""--silent task`},
+		{"pnpm", `npm run task '--if-'present false`, `pnpm run '--if-'present false task`},
+		{"pnpm", `npm run task --script-"shell" "custom shell" first`, `pnpm run --script-"shell" "custom shell" task first`},
+		{"pnpm", `npm run task -'-' --if-present false`, "pnpm run task --if-present false"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.manager+"/"+tt.script, func(t *testing.T) {
+			m, err := pkgmanager.Resolve(tt.manager)
+			require.NoError(t, err)
+			pkg := map[string]any{"scripts": map[string]any{"check": tt.script, "task": "node task.js"}}
+			pkgmanager.Rewrite(pkg, m)
+			assert.Equal(t, tt.want, pkg["scripts"].(map[string]any)["check"])
+		})
+	}
+}
diff --git a/libs/apps/prompt/listers.go b/libs/apps/prompt/listers.go
index 5052744eb52..4bc2b1e301e 100644
--- a/libs/apps/prompt/listers.go
+++ b/libs/apps/prompt/listers.go
@@ -4,11 +4,13 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"maps"
 	"net/http"
 	"net/url"
 	"strconv"
 	"strings"
 
+	"github.com/databricks/cli/libs/auth"
 	"github.com/databricks/cli/libs/cmdctx"
 	"github.com/databricks/cli/libs/log"
 	"github.com/databricks/databricks-sdk-go"
@@ -175,6 +177,7 @@ func ListDatabases(ctx context.Context, instanceName string) ([]ListItem, error)
 	var resp listDatabasesResponse
 	path := fmt.Sprintf("/api/2.0/database/instances/%s/databases", url.PathEscape(instanceName))
 	headers := map[string]string{"Accept": "application/json"}
+	maps.Copy(headers, auth.WorkspaceIDHeaders(w.Config))
 	err = api.Do(ctx, http.MethodGet, path, headers, nil, nil, &resp)
 	if err != nil {
 		return nil, err
diff --git a/libs/apps/prompt/prompt.go b/libs/apps/prompt/prompt.go
index 277aa949e1f..6bbbaaa2d28 100644
--- a/libs/apps/prompt/prompt.go
+++ b/libs/apps/prompt/prompt.go
@@ -118,14 +118,32 @@ type CreateProjectConfig struct {
 	Dependencies map[string]string // e.g., {"sql_warehouse_id": "abc123"}
 	Deploy       bool              // Whether to deploy the app after creation
 	RunMode      RunMode           // How to run the app after creation
+	AuthModes    map[string]string // resource AuthKey -> auth mode chosen in the prompt
 }
 
 // App name constraints.
 const (
 	MaxAppNameLength = 30
 	DevTargetPrefix  = "dev-"
+
+	// InPlaceName is the sentinel value for --name that scaffolds the app
+	// into the current working directory instead of a new subdirectory.
+	InPlaceName = "."
 )
 
+// inPlaceAllowedEntries lists entries permitted in the destination directory
+// when scaffolding in place. Anything else triggers an error so that the
+// template never overwrites existing user files.
+//
+// We don't allow anything that the template itself emits (including .gitignore via
+// the _gitignore rename) — otherwise
+// the user's existing file would be silently overwritten by os.WriteFile during
+// copyTemplate. Symlinks named like an allow-listed entry are rejected by
+// CheckInPlaceDirectory below to block symlink-follow overwrites.
+var inPlaceAllowedEntries = map[string]bool{
+	".git": true,
+}
+
 // projectNamePattern is the compiled regex for validating project names.
 // Pre-compiled for efficiency since validation is called on every keystroke.
 var projectNamePattern = regexp.MustCompile(`^[a-z][a-z0-9-]*$`)
@@ -133,8 +151,12 @@ var projectNamePattern = regexp.MustCompile(`^[a-z][a-z0-9-]*$`)
 // ValidateProjectName validates the project name for length and pattern constraints.
 // It checks that the name plus the "dev-" prefix doesn't exceed 30 characters,
 // and that the name follows the pattern: starts with a letter, contains only
-// lowercase letters, numbers, or hyphens.
+// lowercase letters, numbers, or hyphens. The literal "." is accepted as the
+// in-place sentinel and validated separately by DeriveInPlaceAppName.
 func ValidateProjectName(s string) error {
+	if s == InPlaceName {
+		return nil
+	}
 	if s == "" {
 		return errors.New("project name is required")
 	}
@@ -154,8 +176,68 @@ func ValidateProjectName(s string) error {
 	return nil
 }
 
+// DeriveInPlaceAppName returns the app name to use when scaffolding in place.
+// The name is taken from the basename of the absolute path of cwd and must
+// pass ValidateProjectName so that it is a legal Databricks app name.
+func DeriveInPlaceAppName(cwd string) (string, error) {
+	absCwd, err := filepath.Abs(cwd)
+	if err != nil {
+		return "", fmt.Errorf("resolve current directory: %w", err)
+	}
+	base := filepath.Base(absCwd)
+	if err := ValidateProjectName(base); err != nil {
+		maxAllowed := MaxAppNameLength - len(DevTargetPrefix)
+		return "", fmt.Errorf("current directory name %q is not a valid Databricks app name (must match [a-z][a-z0-9-]* and be at most %d chars): %w; rename the directory or run from one whose name is valid", base, maxAllowed, err)
+	}
+	return base, nil
+}
+
+// CheckInPlaceDirectory verifies that dir contains nothing other than the
+// allow-listed entries (currently just .git). Returns a concise error
+// otherwise; we deliberately do not list the offending entries because the
+// user can `ls` themselves and a long list buries the actionable part.
+//
+// Symlinks named like an allow-listed entry are rejected too: os.WriteFile
+// follows symlinks, so a symlink named .git in cwd (or any future allow-listed
+// dotfile) would let the template scaffold overwrite an arbitrary file the
+// running user can reach.
+func CheckInPlaceDirectory(dir string) error {
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		return fmt.Errorf("read directory %s: %w", dir, err)
+	}
+	for _, e := range entries {
+		if inPlaceAllowedEntries[e.Name()] && e.Type()&os.ModeSymlink == 0 {
+			continue
+		}
+		shown := dir
+		if abs, absErr := filepath.Abs(dir); absErr == nil {
+			shown = abs
+		}
+		return fmt.Errorf("%s is not empty; apps init --name . requires an empty directory (.git is allowed)", shown)
+	}
+	return nil
+}
+
+// ShouldOfferInPlace returns the cwd basename and true when both the
+// directory contents and basename are suitable for in-place scaffolding.
+// Used to decide whether the interactive flow surfaces the in-place option.
+func ShouldOfferInPlace(cwd string) (string, bool) {
+	if err := CheckInPlaceDirectory(cwd); err != nil {
+		return "", false
+	}
+	name, err := DeriveInPlaceAppName(cwd)
+	if err != nil {
+		return "", false
+	}
+	return name, true
+}
+
 // PrintHeader prints the AppKit header banner.
-func PrintHeader(ctx context.Context) {
+// If refLabel is non-empty (e.g. "version 0.24.0" or "branch feature-x"),
+// an extra dimmed line shows the resolved template ref so the user can
+// decide whether to continue before naming the project.
+func PrintHeader(ctx context.Context, refLabel string) {
 	headerStyle := lipgloss.NewStyle().
 		Foreground(colorRed).
 		Bold(true)
@@ -166,14 +248,51 @@ func PrintHeader(ctx context.Context) {
 	cmdio.LogString(ctx, "")
 	cmdio.LogString(ctx, headerStyle.Render("◆ Create a new Databricks AppKit project"))
 	cmdio.LogString(ctx, subtitleStyle.Render("  Full-stack TypeScript • React • Tailwind CSS"))
+	if refLabel != "" {
+		cmdio.LogString(ctx, subtitleStyle.Render("  Template "+refLabel))
+	}
 	cmdio.LogString(ctx, "")
 }
 
+// ErrNameDotWithOutputDir is returned when --name . (or the equivalent typed at
+// the interactive prompt) is combined with a non-empty --output-dir. The two
+// are mutually exclusive: --name . already targets the current directory.
+var ErrNameDotWithOutputDir = errors.New("--name . and --output-dir are mutually exclusive: --name . already targets the current directory")
+
+// validateProjectNameForPrompt is the per-keystroke validator used by
+// PromptForProjectName. Exposed (unexported) as a helper so the sentinel
+// handling is unit-testable without a TTY.
+func validateProjectNameForPrompt(s, outputDir string) error {
+	if err := ValidateProjectName(s); err != nil {
+		return err
+	}
+	if s == InPlaceName {
+		if outputDir != "" {
+			return ErrNameDotWithOutputDir
+		}
+		// In-place: skip the directory-exists check; the caller will
+		// derive the app name from the cwd and verify the directory
+		// is suitable.
+		return nil
+	}
+	destDir := s
+	if outputDir != "" {
+		destDir = filepath.Join(outputDir, s)
+	}
+	if _, err := os.Stat(destDir); err == nil {
+		return fmt.Errorf("directory %s already exists", destDir)
+	}
+	return nil
+}
+
 // PromptForProjectName prompts only for project name.
 // Used as the first step before resolving templates.
-// outputDir is used to check if the destination directory already exists.
+// outputDir is used to check if the destination directory already exists,
+// and to reject the in-place sentinel "." when --output-dir is set.
+// The caller is responsible for printing the AppKit header before invoking
+// this function so the header also covers preceding prompts (e.g. the
+// in-place scaffold-location chooser).
 func PromptForProjectName(ctx context.Context, outputDir string) (string, error) {
-	PrintHeader(ctx)
 	theme := AppkitTheme()
 
 	var name string
@@ -183,17 +302,7 @@ func PromptForProjectName(ctx context.Context, outputDir string) (string, error)
 		Placeholder("my-app").
 		Value(&name).
 		Validate(func(s string) error {
-			if err := ValidateProjectName(s); err != nil {
-				return err
-			}
-			destDir := s
-			if outputDir != "" {
-				destDir = filepath.Join(outputDir, s)
-			}
-			if _, err := os.Stat(destDir); err == nil {
-				return fmt.Errorf("directory %s already exists", destDir)
-			}
-			return nil
+			return validateProjectNameForPrompt(s, outputDir)
 		}).
 		WithTheme(theme).
 		Run()
@@ -205,6 +314,40 @@ func PromptForProjectName(ctx context.Context, outputDir string) (string, error)
 	return name, nil
 }
 
+// PromptScaffoldLocation asks where the new app should be scaffolded when the
+// current directory is suitable for in-place use. Defaults to a new
+// subdirectory so users who hit Enter through the prompts get today's
+// behaviour. Returns true when the user opts in to in-place scaffolding.
+func PromptScaffoldLocation(ctx context.Context, basename string) (bool, error) {
+	theme := AppkitTheme()
+
+	const (
+		locSubdir  = "subdir"
+		locCurrent = "current"
+	)
+
+	choice := locSubdir
+	err := huh.NewSelect[string]().
+		Title("Where should we create the app?").
+		Options(
+			huh.NewOption("Create a new subdirectory", locSubdir),
+			huh.NewOption(fmt.Sprintf("Use the current directory (%q)", basename), locCurrent),
+		).
+		Value(&choice).
+		WithTheme(theme).
+		Run()
+	if err != nil {
+		return false, err
+	}
+
+	if choice == locCurrent {
+		printAnswered(ctx, "Location", "current directory")
+		return true, nil
+	}
+	printAnswered(ctx, "Location", "new subdirectory")
+	return false, nil
+}
+
 // PromptForDeployAndRun prompts for post-creation deploy and run options.
 func PromptForDeployAndRun(ctx context.Context) (deploy bool, runMode RunMode, err error) {
 	theme := AppkitTheme()
@@ -1048,7 +1191,9 @@ func PromptForAppSelection(ctx context.Context, title string) (string, error) {
 
 // PrintSuccess prints a success message after project creation.
 // If nextStepsCmd is non-empty, also prints the "Next steps" section with the given command.
-func PrintSuccess(ctx context.Context, projectName, outputDir string, fileCount int, nextStepsCmd string) {
+// When inPlace is true, the "cd <projectName>" line is omitted because the
+// user is already in the destination directory.
+func PrintSuccess(ctx context.Context, projectName, outputDir string, fileCount int, nextStepsCmd string, inPlace bool) {
 	successStyle := lipgloss.NewStyle().
 		Foreground(colorYellow).
 		Bold(true)
@@ -1062,14 +1207,16 @@ func PrintSuccess(ctx context.Context, projectName, outputDir string, fileCount
 	cmdio.LogString(ctx, "")
 	cmdio.LogString(ctx, successStyle.Render("✔ Project created successfully!"))
 	cmdio.LogString(ctx, "")
-	cmdio.LogString(ctx, dimStyle.Render("  Location: "+outputDir))
+	cmdio.LogString(ctx, dimStyle.Render("  Location: "+filepath.ToSlash(outputDir)))
 	cmdio.LogString(ctx, dimStyle.Render("  Files: "+strconv.Itoa(fileCount)))
 
 	if nextStepsCmd != "" {
 		cmdio.LogString(ctx, "")
 		cmdio.LogString(ctx, dimStyle.Render("  Next steps:"))
 		cmdio.LogString(ctx, "")
-		cmdio.LogString(ctx, codeStyle.Render("    cd "+projectName))
+		if !inPlace {
+			cmdio.LogString(ctx, codeStyle.Render("    cd "+projectName))
+		}
 		cmdio.LogString(ctx, codeStyle.Render("    "+nextStepsCmd))
 	}
 	cmdio.LogString(ctx, "")
diff --git a/libs/apps/prompt/prompt_test.go b/libs/apps/prompt/prompt_test.go
index 01091cf72ce..239fb852cfa 100644
--- a/libs/apps/prompt/prompt_test.go
+++ b/libs/apps/prompt/prompt_test.go
@@ -3,6 +3,8 @@ package prompt
 import (
 	"context"
 	"errors"
+	"os"
+	"path/filepath"
 	"testing"
 	"time"
 
@@ -87,6 +89,11 @@ func TestValidateProjectName(t *testing.T) {
 			expectError: true,
 			errorMsg:    "lowercase letters, numbers, or hyphens",
 		},
+		{
+			name:        "in-place sentinel",
+			projectName: InPlaceName,
+			expectError: false,
+		},
 	}
 
 	for _, tt := range tests {
@@ -332,3 +339,188 @@ func TestRenderStabilityTier(t *testing.T) {
 		})
 	}
 }
+
+// mkDirNamed creates a child directory with the given name under t.TempDir()
+// and returns its absolute path. Used to control filepath.Base(absCwd) when
+// exercising in-place name derivation.
+func mkDirNamed(t *testing.T, name string) string {
+	t.Helper()
+	dir := filepath.Join(t.TempDir(), name)
+	require.NoError(t, os.MkdirAll(dir, 0o755))
+	return dir
+}
+
+func TestDeriveInPlaceAppName(t *testing.T) {
+	t.Run("valid basename", func(t *testing.T) {
+		dir := mkDirNamed(t, "my-app")
+		got, err := DeriveInPlaceAppName(dir)
+		require.NoError(t, err)
+		assert.Equal(t, "my-app", got)
+	})
+
+	t.Run("uppercase basename rejected", func(t *testing.T) {
+		dir := mkDirNamed(t, "MyApp")
+		_, err := DeriveInPlaceAppName(dir)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "MyApp")
+		assert.Contains(t, err.Error(), "rename the directory")
+	})
+
+	t.Run("underscore basename rejected", func(t *testing.T) {
+		dir := mkDirNamed(t, "my_app")
+		_, err := DeriveInPlaceAppName(dir)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "my_app")
+	})
+
+	t.Run("leading digit basename rejected", func(t *testing.T) {
+		dir := mkDirNamed(t, "1app")
+		_, err := DeriveInPlaceAppName(dir)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "1app")
+	})
+
+	t.Run("too long basename rejected", func(t *testing.T) {
+		dir := mkDirNamed(t, "this-is-far-too-long-for-the-app-name-limit")
+		_, err := DeriveInPlaceAppName(dir)
+		require.Error(t, err)
+	})
+}
+
+func TestCheckInPlaceDirectory(t *testing.T) {
+	t.Run("empty directory is OK", func(t *testing.T) {
+		dir := t.TempDir()
+		assert.NoError(t, CheckInPlaceDirectory(dir))
+	})
+
+	t.Run("dotgit only is OK", func(t *testing.T) {
+		dir := t.TempDir()
+		require.NoError(t, os.MkdirAll(filepath.Join(dir, ".git"), 0o755))
+		assert.NoError(t, CheckInPlaceDirectory(dir))
+	})
+
+	t.Run("pre-existing gitignore is rejected", func(t *testing.T) {
+		// .gitignore is intentionally NOT allow-listed: the template ships
+		// _gitignore that renames to .gitignore, which would silently
+		// overwrite the user's file.
+		dir := t.TempDir()
+		require.NoError(t, os.MkdirAll(filepath.Join(dir, ".git"), 0o755))
+		require.NoError(t, os.WriteFile(filepath.Join(dir, ".gitignore"), []byte("node_modules\n"), 0o644))
+		err := CheckInPlaceDirectory(dir)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "not empty")
+	})
+
+	t.Run("unexpected file is rejected", func(t *testing.T) {
+		dir := t.TempDir()
+		require.NoError(t, os.WriteFile(filepath.Join(dir, "README.md"), []byte("hi"), 0o644))
+		err := CheckInPlaceDirectory(dir)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "not empty")
+		assert.Contains(t, err.Error(), "apps init --name .")
+		// Concise wording: we deliberately do not enumerate offending files.
+		assert.NotContains(t, err.Error(), "README.md")
+	})
+
+	t.Run("mix of allowed and disallowed is rejected", func(t *testing.T) {
+		dir := t.TempDir()
+		require.NoError(t, os.MkdirAll(filepath.Join(dir, ".git"), 0o755))
+		require.NoError(t, os.WriteFile(filepath.Join(dir, "stray.txt"), []byte(""), 0o644))
+		err := CheckInPlaceDirectory(dir)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "not empty")
+	})
+
+	t.Run("symlink named .git is rejected", func(t *testing.T) {
+		// A symlink masquerading as .git would let os.WriteFile follow the
+		// link if any allow-listed name later became a write target.
+		dir := t.TempDir()
+		target := filepath.Join(t.TempDir(), "elsewhere")
+		require.NoError(t, os.MkdirAll(target, 0o755))
+		require.NoError(t, os.Symlink(target, filepath.Join(dir, ".git")))
+		err := CheckInPlaceDirectory(dir)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "not empty")
+	})
+
+	t.Run("error message shows absolute path", func(t *testing.T) {
+		dir := t.TempDir()
+		require.NoError(t, os.WriteFile(filepath.Join(dir, "stray.txt"), []byte(""), 0o644))
+		err := CheckInPlaceDirectory(dir)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), dir)
+	})
+
+	t.Run("missing directory returns error", func(t *testing.T) {
+		err := CheckInPlaceDirectory(filepath.Join(t.TempDir(), "nope"))
+		require.Error(t, err)
+	})
+}
+
+func TestShouldOfferInPlace(t *testing.T) {
+	t.Run("returns basename when dir is empty and name is valid", func(t *testing.T) {
+		dir := mkDirNamed(t, "my-app")
+		name, ok := ShouldOfferInPlace(dir)
+		assert.True(t, ok)
+		assert.Equal(t, "my-app", name)
+	})
+
+	t.Run("declines when dir has stray files", func(t *testing.T) {
+		dir := mkDirNamed(t, "my-app")
+		require.NoError(t, os.WriteFile(filepath.Join(dir, "stray.txt"), []byte(""), 0o644))
+		_, ok := ShouldOfferInPlace(dir)
+		assert.False(t, ok)
+	})
+
+	t.Run("declines when basename is invalid", func(t *testing.T) {
+		dir := mkDirNamed(t, "Bad_Name")
+		_, ok := ShouldOfferInPlace(dir)
+		assert.False(t, ok)
+	})
+
+	t.Run("declines when dir does not exist", func(t *testing.T) {
+		_, ok := ShouldOfferInPlace(filepath.Join(t.TempDir(), "missing"))
+		assert.False(t, ok)
+	})
+}
+
+func TestValidateProjectNameForPrompt(t *testing.T) {
+	t.Run("valid name without outputDir", func(t *testing.T) {
+		assert.NoError(t, validateProjectNameForPrompt("my-app", ""))
+	})
+
+	t.Run("in-place sentinel without outputDir is accepted", func(t *testing.T) {
+		assert.NoError(t, validateProjectNameForPrompt(InPlaceName, ""))
+	})
+
+	t.Run("in-place sentinel with outputDir is rejected with sentinel error", func(t *testing.T) {
+		err := validateProjectNameForPrompt(InPlaceName, "/some/dir")
+		require.Error(t, err)
+		assert.ErrorIs(t, err, ErrNameDotWithOutputDir)
+	})
+
+	t.Run("invalid name surfaces ValidateProjectName error", func(t *testing.T) {
+		err := validateProjectNameForPrompt("My_App", "")
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "lowercase letters")
+	})
+}
+
+func TestPrintSuccessInPlace(t *testing.T) {
+	ctx, out := cmdio.NewTestContextWithStderr(t.Context())
+	PrintSuccess(ctx, "my-app", filepath.FromSlash("/abs/path/my-app"), 12, "npm run dev", true)
+	got := out.String()
+	assert.Contains(t, got, "Location: /abs/path/my-app")
+	assert.Contains(t, got, "Files: 12")
+	assert.Contains(t, got, "npm run dev")
+	assert.NotContains(t, got, "cd my-app")
+}
+
+func TestPrintSuccessNotInPlace(t *testing.T) {
+	ctx, out := cmdio.NewTestContextWithStderr(t.Context())
+	PrintSuccess(ctx, "my-app", filepath.FromSlash("/abs/path/my-app"), 12, "npm run dev", false)
+	got := out.String()
+	assert.Contains(t, got, "Location: /abs/path/my-app")
+	assert.Contains(t, got, "cd my-app")
+	assert.Contains(t, got, "npm run dev")
+}
diff --git a/libs/apps/runlocal/cfg.go b/libs/apps/runlocal/cfg.go
index d196eb1208d..7b236571d5c 100644
--- a/libs/apps/runlocal/cfg.go
+++ b/libs/apps/runlocal/cfg.go
@@ -8,7 +8,7 @@ import (
 type Config struct {
 	AppName       string
 	AppURL        string
-	WorkspaceID   int64
+	WorkspaceID   string
 	ServerName    string
 	Host          string
 	WorkspaceHost string
@@ -24,7 +24,7 @@ const (
 	DEFAULT_PORT     = 8000
 )
 
-func NewConfig(workspaceHost string, workspaceID int64, appDir, host string, port int) *Config {
+func NewConfig(workspaceHost, workspaceID, appDir, host string, port int) *Config {
 	c := &Config{
 		AppName:       DEFAULT_APP_NAME,
 		AppURL:        "http://" + net.JoinHostPort(host, strconv.Itoa(port)),
diff --git a/libs/apps/runlocal/env.go b/libs/apps/runlocal/env.go
index 7c0f562d41c..1eae427d621 100644
--- a/libs/apps/runlocal/env.go
+++ b/libs/apps/runlocal/env.go
@@ -18,7 +18,7 @@ func GetBaseEnvVars(config *Config) []EnvVar {
 		{Name: "PYTHONUNBUFFERED", Value: "1"},
 		{Name: "DATABRICKS_APP_NAME", Value: config.AppName},
 		{Name: "DATABRICKS_APP_URL", Value: config.AppURL},
-		{Name: "DATABRICKS_WORKSPACE_ID", Value: strconv.FormatInt(config.WorkspaceID, 10)},
+		{Name: "DATABRICKS_WORKSPACE_ID", Value: config.WorkspaceID},
 		{Name: "DATABRICKS_HOST", Value: config.WorkspaceHost},
 		{Name: "DATABRICKS_APP_PORT", Value: strconv.Itoa(config.Port)},
 		{Name: "GRADIO_SERVER_NAME", Value: config.ServerName},
diff --git a/libs/apps/runlocal/headers.go b/libs/apps/runlocal/headers.go
index 9655e51ba28..0fd8c99d721 100644
--- a/libs/apps/runlocal/headers.go
+++ b/libs/apps/runlocal/headers.go
@@ -1,8 +1,9 @@
 package runlocal
 
 import (
+	"uuid"
+
 	"github.com/databricks/databricks-sdk-go/service/iam"
-	"github.com/google/uuid"
 )
 
 func GetXHeaders(user *iam.User) map[string]string {
diff --git a/libs/apps/runlocal/node_test.go b/libs/apps/runlocal/node_test.go
index c52795dde34..ba7de6ca854 100644
--- a/libs/apps/runlocal/node_test.go
+++ b/libs/apps/runlocal/node_test.go
@@ -45,7 +45,8 @@ func TestNodeAppGetCommand(t *testing.T) {
 			config := &Config{}
 			spec := &AppSpec{config: config, Command: tt.command}
 			app := NewNodeApp(config, spec, &PackageJson{})
-			cmd, cmdEnv, err := app.GetCommand(t.Context(), tt.debug)
+			ctx := env.Set(t.Context(), "NODE_OPTIONS", "") // unset ambient NODE_OPTIONS to keep env clean
+			cmd, cmdEnv, err := app.GetCommand(ctx, tt.debug)
 			require.NoError(t, err)
 			assert.Equal(t, tt.wantCmd, cmd)
 			assert.Equal(t, tt.wantEnv, cmdEnv)
@@ -69,7 +70,8 @@ func TestNodeAppGetCommandDebugCustomPort(t *testing.T) {
 	config := &Config{DebugPort: "5555"}
 	spec := &AppSpec{config: config}
 	app := NewNodeApp(config, spec, &PackageJson{})
-	_, cmdEnv, err := app.GetCommand(t.Context(), true)
+	ctx := env.Set(t.Context(), "NODE_OPTIONS", "") // unset ambient NODE_OPTIONS to keep env clean
+	_, cmdEnv, err := app.GetCommand(ctx, true)
 	require.NoError(t, err)
 	assert.Equal(t, []string{"NODE_OPTIONS=--inspect=5555"}, cmdEnv)
 }
diff --git a/libs/apps/runlocal/spec_test.go b/libs/apps/runlocal/spec_test.go
index 3b3cfde51aa..f4218c09e41 100644
--- a/libs/apps/runlocal/spec_test.go
+++ b/libs/apps/runlocal/spec_test.go
@@ -28,11 +28,11 @@ func TestAppSpecLoadEnvVars(t *testing.T) {
 					EnvVars: []AppEnvVar{
 						{
 							Name:  "VAR1",
-							Value: stringPtr("value1"),
+							Value: new("value1"),
 						},
 						{
 							Name:  "VAR2",
-							Value: stringPtr("value2"),
+							Value: new("value2"),
 						},
 					},
 				}
@@ -53,11 +53,11 @@ func TestAppSpecLoadEnvVars(t *testing.T) {
 					EnvVars: []AppEnvVar{
 						{
 							Name:      "VAR1",
-							ValueFrom: stringPtr("VAR1"),
+							ValueFrom: new("VAR1"),
 						},
 						{
 							Name:      "VAR2",
-							ValueFrom: stringPtr("VAR2"),
+							ValueFrom: new("VAR2"),
 						},
 					},
 				}
@@ -77,11 +77,11 @@ func TestAppSpecLoadEnvVars(t *testing.T) {
 					EnvVars: []AppEnvVar{
 						{
 							Name:  "VAR1",
-							Value: stringPtr("value1"),
+							Value: new("value1"),
 						},
 						{
 							Name:      "VAR2",
-							ValueFrom: stringPtr("VAR2"),
+							ValueFrom: new("VAR2"),
 						},
 					},
 				}
@@ -101,7 +101,7 @@ func TestAppSpecLoadEnvVars(t *testing.T) {
 					EnvVars: []AppEnvVar{
 						{
 							Name:      "VAR1",
-							ValueFrom: stringPtr("VAR1"),
+							ValueFrom: new("VAR1"),
 						},
 					},
 				}
@@ -121,7 +121,7 @@ func TestAppSpecLoadEnvVars(t *testing.T) {
 					EnvVars: []AppEnvVar{
 						{
 							Name:      "VAR1",
-							ValueFrom: stringPtr("MISSING_VAR"),
+							ValueFrom: new("MISSING_VAR"),
 						},
 					},
 				}
@@ -149,8 +149,3 @@ func TestAppSpecLoadEnvVars(t *testing.T) {
 		})
 	}
 }
-
-// Helper function to create a string pointer
-func stringPtr(s string) *string {
-	return &s
-}
diff --git a/libs/apps/validation/authmode.go b/libs/apps/validation/authmode.go
new file mode 100644
index 00000000000..9c723310007
--- /dev/null
+++ b/libs/apps/validation/authmode.go
@@ -0,0 +1,129 @@
+package validation
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"slices"
+
+	"github.com/databricks/cli/libs/apps/manifest"
+	"go.yaml.in/yaml/v3"
+)
+
+type appYAML struct {
+	Env []struct {
+		Name  string  `yaml:"name"`
+		Value *string `yaml:"value"`
+	} `yaml:"env"`
+}
+
+type bundleYAML struct {
+	Include   []string `yaml:"include"`
+	Resources struct {
+		Apps map[string]struct {
+			UserAPIScopes []string `yaml:"user_api_scopes"`
+			Resources     []struct {
+				Name string `yaml:"name"`
+			} `yaml:"resources"`
+		} `yaml:"apps"`
+	} `yaml:"resources"`
+}
+
+// ValidateAuthModes checks that resources accessed on behalf of the user are consistent
+// with the manifest. A resource is treated as accessed on behalf of the user when app.yaml
+// sets one of its env vars to a literal value and databricks.yml does not bind it.
+// Such a resource must not be app-only, and its scope must be in user_api_scopes.
+// Projects without appkit.plugins.json, app.yaml, or databricks.yml are not checked.
+func ValidateAuthModes(projectPath string) error {
+	if !manifest.HasManifest(projectPath) {
+		return nil
+	}
+	m, err := manifest.Load(projectPath)
+	if err != nil {
+		return err
+	}
+
+	var app appYAML
+	if ok, err := readYAML(filepath.Join(projectPath, "app.yaml"), &app); !ok {
+		return err
+	}
+	var root bundleYAML
+	if ok, err := readYAML(filepath.Join(projectPath, "databricks.yml"), &root); !ok {
+		return err
+	}
+
+	// Follow the root-level include globs so split-config bundles, where the app
+	// resource and user_api_scopes live in separate files, are seen too.
+	bundles := []bundleYAML{root}
+	for _, pattern := range root.Include {
+		matches, err := filepath.Glob(filepath.Join(projectPath, pattern))
+		if err != nil {
+			return fmt.Errorf("invalid include pattern %q: %w", pattern, err)
+		}
+		for _, path := range matches {
+			var inc bundleYAML
+			ok, err := readYAML(path, &inc)
+			if err != nil {
+				return err
+			}
+			if ok {
+				bundles = append(bundles, inc)
+			}
+		}
+	}
+
+	bound := make(map[string]bool)
+	var scopes []string
+	for _, b := range bundles {
+		for _, a := range b.Resources.Apps {
+			for _, r := range a.Resources {
+				bound[r.Name] = true
+			}
+			scopes = append(scopes, a.UserAPIScopes...)
+		}
+	}
+
+	byEnv := make(map[string]manifest.Resource)
+	for _, p := range m.GetPlugins() {
+		for _, r := range append(p.Resources.Required, p.Resources.Optional...) {
+			for _, f := range r.Fields {
+				if f.Env != "" {
+					byEnv[f.Env] = r
+				}
+			}
+		}
+	}
+
+	var errs []error
+	checked := make(map[string]bool)
+	for _, e := range app.Env {
+		r, ok := byEnv[e.Name]
+		if !ok || e.Value == nil || bound[r.Key()] || checked[r.Key()] {
+			continue
+		}
+		checked[r.Key()] = true
+		switch {
+		case r.AppOnly:
+			errs = append(errs, fmt.Errorf("resource %q must be bound to the app's service principal in databricks.yml, but app.yaml sets %s to a literal value", r.Key(), e.Name))
+		case r.Scope != "" && !slices.Contains(scopes, r.Scope):
+			errs = append(errs, fmt.Errorf("resource %q is accessed on behalf of the user but its scope %q is missing from user_api_scopes in databricks.yml", r.Key(), r.Scope))
+		}
+	}
+	return errors.Join(errs...)
+}
+
+// readYAML parses path into v. Returns false with a nil error if the file does not exist.
+func readYAML(path string, v any) (bool, error) {
+	data, err := os.ReadFile(path)
+	if errors.Is(err, os.ErrNotExist) {
+		return false, nil
+	}
+	if err != nil {
+		return false, err
+	}
+	if err := yaml.Unmarshal(data, v); err != nil {
+		return false, fmt.Errorf("parse %s: %w", filepath.Base(path), err)
+	}
+	return true, nil
+}
diff --git a/libs/apps/validation/authmode_test.go b/libs/apps/validation/authmode_test.go
new file mode 100644
index 00000000000..309de7dd9d4
--- /dev/null
+++ b/libs/apps/validation/authmode_test.go
@@ -0,0 +1,102 @@
+package validation
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const authModeManifest = `{
+  "plugins": {
+    "analytics": {
+      "resources": {
+        "required": [
+          {"type": "sql_warehouse", "resourceKey": "sql-warehouse", "scope": "sql", "fields": {"id": {"env": "WAREHOUSE_ID"}}},
+          {"type": "secret", "resourceKey": "secret", "appOnly": true, "fields": {"scope": {"env": "SECRET_SCOPE"}, "key": {"env": "SECRET_KEY"}}}
+        ]
+      }
+    }
+  }
+}`
+
+func writeAuthModeProject(t *testing.T, appYAML, bundleYAML string) string {
+	dir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "appkit.plugins.json"), []byte(authModeManifest), 0o644))
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "app.yaml"), []byte(appYAML), 0o644))
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "databricks.yml"), []byte(bundleYAML), 0o644))
+	return dir
+}
+
+func TestValidateAuthModes(t *testing.T) {
+	const boundSecret = `
+resources:
+  apps:
+    app:
+      resources:
+        - name: secret
+`
+	tests := []struct {
+		name    string
+		appYAML string
+		bundle  string
+		wantErr string
+	}{
+		{
+			name:    "sp",
+			appYAML: "env:\n  - name: WAREHOUSE_ID\n    valueFrom: sql-warehouse\n",
+			bundle:  "resources:\n  apps:\n    app:\n      resources:\n        - name: sql-warehouse\n",
+		},
+		{
+			name:    "obo with scope",
+			appYAML: "env:\n  - name: WAREHOUSE_ID\n    value: wh1\n",
+			bundle:  "resources:\n  apps:\n    app:\n      user_api_scopes:\n        - sql\n",
+		},
+		{
+			name:    "bound with literal value is not obo",
+			appYAML: "env:\n  - name: WAREHOUSE_ID\n    value: wh1\n",
+			bundle:  "resources:\n  apps:\n    app:\n      resources:\n        - name: sql-warehouse\n",
+		},
+		{
+			name:    "obo missing scope",
+			appYAML: "env:\n  - name: WAREHOUSE_ID\n    value: wh1\n",
+			bundle:  boundSecret,
+			wantErr: `resource "sql-warehouse" is accessed on behalf of the user but its scope "sql" is missing from user_api_scopes in databricks.yml`,
+		},
+		{
+			name:    "app only not bound",
+			appYAML: "env:\n  - name: SECRET_SCOPE\n    value: s\n  - name: SECRET_KEY\n    value: k\n",
+			bundle:  "resources:\n  apps:\n    app:\n      user_api_scopes:\n        - sql\n",
+			wantErr: `resource "secret" must be bound to the app's service principal in databricks.yml, but app.yaml sets SECRET_SCOPE to a literal value`,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := ValidateAuthModes(writeAuthModeProject(t, tt.appYAML, tt.bundle))
+			if tt.wantErr == "" {
+				assert.NoError(t, err)
+				return
+			}
+			assert.EqualError(t, err, tt.wantErr)
+		})
+	}
+}
+
+func TestValidateAuthModesWithoutManifest(t *testing.T) {
+	assert.NoError(t, ValidateAuthModes(t.TempDir()))
+}
+
+func TestValidateAuthModesFollowsIncludes(t *testing.T) {
+	// An OBO resource whose user_api_scopes live in an included file must not be
+	// flagged as missing its scope.
+	dir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "appkit.plugins.json"), []byte(authModeManifest), 0o644))
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "app.yaml"), []byte("env:\n  - name: WAREHOUSE_ID\n    value: wh1\n"), 0o644))
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "databricks.yml"), []byte("include:\n  - resources/*.yml\n"), 0o644))
+	require.NoError(t, os.MkdirAll(filepath.Join(dir, "resources"), 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "resources", "app.yml"), []byte("resources:\n  apps:\n    app:\n      user_api_scopes:\n        - sql\n"), 0o644))
+
+	assert.NoError(t, ValidateAuthModes(dir))
+}
diff --git a/libs/apps/validation/nodejs.go b/libs/apps/validation/nodejs.go
index 3bd25bd5612..3fc76862aa4 100644
--- a/libs/apps/validation/nodejs.go
+++ b/libs/apps/validation/nodejs.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"strings"
 	"time"
 
 	"github.com/databricks/cli/libs/cmdio"
@@ -12,12 +13,18 @@ import (
 	"github.com/databricks/cli/libs/log"
 )
 
+const (
+	packageManagerInstall   = "install"
+	packageManagerRun       = "run"
+	packageManagerIfPresent = "--if-present"
+)
+
 // ValidationNodeJs implements validation for Node.js-based projects.
 type ValidationNodeJs struct{}
 
 type validationStep struct {
 	name        string
-	command     string
+	args        []string
 	errorPrefix string
 	displayName string
 	skipIf      func(workDir string, opts ValidateOptions) bool // Optional: skip step if this returns true
@@ -27,44 +34,51 @@ func (v *ValidationNodeJs) Validate(ctx context.Context, workDir string, opts Va
 	log.Infof(ctx, "Starting Node.js validation: build + typecheck")
 	startTime := time.Now()
 
-	cmdio.LogString(ctx, "Validating project...")
+	manager, err := DetectPackageManager(ctx, workDir)
+	if err != nil {
+		return nil, err
+	}
+
+	cmdio.LogString(ctx, "Validating project using "+manager+"...")
 
 	// TODO: these steps could be changed to npx appkit [command] instead if we can determine its an appkit project.
+	// Let the manager resolve scripts, including configured npm workspaces:
+	// https://docs.npmjs.com/cli/using-npm/workspaces#running-commands-in-the-context-of-workspaces
 	steps := []validationStep{
 		{
-			name:        "install",
-			command:     "npm install",
+			name:        packageManagerInstall,
+			args:        []string{packageManagerInstall},
 			errorPrefix: "Failed to install dependencies",
 			displayName: "Installing dependencies",
 			skipIf:      func(workDir string, _ ValidateOptions) bool { return hasNodeModules(workDir) },
 		},
 		{
 			name:        "generate",
-			command:     "npm run typegen --if-present",
-			errorPrefix: "Failed to run npm typegen",
+			args:        []string{packageManagerRun, packageManagerIfPresent, "typegen"},
+			errorPrefix: "Failed to generate types",
 			displayName: "Generating types",
 		},
 		{
 			name:        "ast-grep-lint",
-			command:     "npm run lint:ast-grep --if-present",
+			args:        []string{packageManagerRun, packageManagerIfPresent, "lint:ast-grep"},
 			errorPrefix: "AST-grep lint found violations",
 			displayName: "Running AST-grep lint",
 		},
 		{
 			name:        "typecheck",
-			command:     "npm run typecheck --if-present",
+			args:        []string{packageManagerRun, packageManagerIfPresent, "typecheck"},
 			errorPrefix: "Failed to run client typecheck",
 			displayName: "Type checking",
 		},
 		{
 			name:        "build",
-			command:     "npm run build --if-present",
-			errorPrefix: "Failed to run npm build",
+			args:        []string{packageManagerRun, packageManagerIfPresent, "build"},
+			errorPrefix: "Failed to build",
 			displayName: "Building",
 		},
 		{
 			name:        "tests",
-			command:     "npm run test --if-present",
+			args:        []string{packageManagerRun, packageManagerIfPresent, "test"},
 			errorPrefix: "Failed to run tests",
 			displayName: "Running tests",
 			skipIf:      func(_ string, opts ValidateOptions) bool { return opts.SkipTests },
@@ -78,6 +92,7 @@ func (v *ValidationNodeJs) Validate(ctx context.Context, workDir string, opts Va
 			cmdio.LogString(ctx, "⏭️  Skipped "+step.displayName)
 			continue
 		}
+		command := manager + " " + strings.Join(step.args, " ")
 
 		log.Debugf(ctx, "running %s...", step.name)
 
@@ -88,7 +103,7 @@ func (v *ValidationNodeJs) Validate(ctx context.Context, workDir string, opts Va
 		spinner := cmdio.NewSpinner(ctx)
 		spinner.Update(step.displayName + "...")
 
-		stepErr = runValidationCommand(ctx, workDir, step.command)
+		stepErr = runValidationCommand(ctx, workDir, command)
 
 		spinner.Close()
 		stepDuration := time.Since(stepStart)
diff --git a/libs/apps/validation/nodejs_test.go b/libs/apps/validation/nodejs_test.go
new file mode 100644
index 00000000000..b844bccd9e9
--- /dev/null
+++ b/libs/apps/validation/nodejs_test.go
@@ -0,0 +1,222 @@
+package validation_test
+
+import (
+	"encoding/json"
+	"os"
+	osexec "os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+
+	"github.com/databricks/cli/internal/testutil"
+	"github.com/databricks/cli/libs/apps/validation"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+var validationScripts = []string{"typegen", "lint:ast-grep", "typecheck", "build", "test"}
+
+// These values define the protocol shared with testdata/package-manager and .cmd.
+const (
+	validationTestFailEnv  = "VALIDATION_TEST_FAIL"
+	validationTestExitCode = 17
+	validationTestStdout   = "validation stdout"
+	validationTestStderr   = "validation stderr"
+)
+
+const npmValidationCommands = `npm install
+npm run --if-present typegen
+npm run --if-present lint:ast-grep
+npm run --if-present typecheck
+npm run --if-present build
+npm run --if-present test
+`
+
+// stubPackageManagers records commands without installing packages or requiring Node.js.
+func stubPackageManagers(t *testing.T) {
+	t.Helper()
+	binDir := t.TempDir()
+	for _, manager := range []string{"npm", "pnpm"} {
+		for _, suffix := range []string{"", ".cmd"} {
+			stub := testutil.ReadFile(t, "testdata/package-manager"+suffix)
+			require.NoError(t, os.WriteFile(filepath.Join(binDir, manager+suffix), []byte(stub), 0o755))
+		}
+	}
+	t.Setenv("PATH", binDir+string(os.PathListSeparator)+os.Getenv("PATH"))
+	t.Setenv(validationTestFailEnv, "")
+}
+
+// writeValidationProject creates a manifest with the requested scripts.
+func writeValidationProject(t *testing.T, dir string, scripts []string) {
+	t.Helper()
+	scriptMap := make(map[string]string, len(scripts))
+	for _, script := range scripts {
+		scriptMap[script] = "echo " + script
+	}
+	data, err := json.Marshal(map[string]any{"scripts": scriptMap})
+	require.NoError(t, err)
+	testutil.WriteFile(t, filepath.Join(dir, "package.json"), string(data))
+}
+
+// isolateValidationShell keeps installed package managers out of PATH.
+func isolateValidationShell(t *testing.T) {
+	t.Helper()
+	shell := "sh"
+	if runtime.GOOS == "windows" {
+		shell = "cmd.exe"
+	}
+	path, err := osexec.LookPath(shell)
+	require.NoError(t, err)
+	// Keep cmd.exe beside its localized message resources on Windows.
+	binDir := filepath.Dir(path)
+	if runtime.GOOS != "windows" {
+		binDir = t.TempDir()
+		require.NoError(t, os.Symlink(path, filepath.Join(binDir, shell)))
+	}
+	t.Setenv("PATH", binDir)
+	for _, manager := range []string{"npm", "pnpm"} {
+		_, err := osexec.LookPath(manager)
+		require.ErrorIs(t, err, osexec.ErrNotFound)
+	}
+}
+
+func TestNodeJsValidatePackageManagers(t *testing.T) {
+	stubPackageManagers(t)
+	tests := []struct {
+		name     string
+		manager  string
+		lockfile string
+		manifest string
+	}{
+		{name: "npm default", manager: "npm"},
+		{name: "npm lockfile", manager: "npm", lockfile: "package-lock.json"},
+		{name: "pnpm lockfile", manager: "pnpm", lockfile: "pnpm-lock.yaml"},
+		{name: "pnpm declaration", manager: "pnpm", manifest: `{"packageManager":"pnpm@10.30.3"}`},
+		{name: "npm declaration overrides lockfile", manager: "npm", lockfile: "pnpm-lock.yaml", manifest: `{"packageManager":"npm@10.9.2"}`},
+		{name: "pnpm declaration overrides lockfile", manager: "pnpm", lockfile: "package-lock.json", manifest: `{"packageManager":"pnpm@10.30.3"}`},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			dir := t.TempDir()
+			writeValidationProject(t, dir, validationScripts)
+			if tt.manifest != "" {
+				testutil.WriteFile(t, filepath.Join(dir, "package.json"), tt.manifest)
+			}
+			if tt.lockfile != "" {
+				testutil.Touch(t, dir, tt.lockfile)
+			}
+			validator := validation.ValidationNodeJs{}
+			result, err := validator.Validate(cmdio.MockDiscard(t.Context()), dir, validation.ValidateOptions{})
+			require.NoError(t, err)
+			require.True(t, result.Success, "%+v", result.Details)
+			wantCommands := strings.ReplaceAll(npmValidationCommands, "npm ", tt.manager+" ")
+			commands := testutil.ReadFile(t, filepath.Join(dir, "commands.log"))
+			assert.Equal(t, wantCommands, strings.ReplaceAll(commands, "\r\n", "\n"))
+		})
+	}
+}
+
+func TestNodeJsValidateSkips(t *testing.T) {
+	stubPackageManagers(t)
+	commands := strings.ReplaceAll(npmValidationCommands, "npm ", "pnpm ")
+	tests := []struct {
+		name        string
+		scripts     []string
+		nodeModules bool
+		skipTests   bool
+		want        string
+	}{
+		{name: "missing scripts", want: commands},
+		{name: "optional scripts", scripts: []string{"build"}, want: commands},
+		{name: "installed dependencies", scripts: []string{"build"}, nodeModules: true, want: strings.TrimPrefix(commands, "pnpm install\n")},
+		{name: "skip tests", scripts: []string{"build", "test"}, skipTests: true, want: strings.TrimSuffix(commands, "pnpm run --if-present test\n")},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			dir := t.TempDir()
+			writeValidationProject(t, dir, tt.scripts)
+			testutil.Touch(t, dir, "pnpm-lock.yaml")
+			if tt.nodeModules {
+				require.NoError(t, os.Mkdir(filepath.Join(dir, "node_modules"), 0o755))
+			}
+			validator := validation.ValidationNodeJs{}
+			result, err := validator.Validate(cmdio.MockDiscard(t.Context()), dir, validation.ValidateOptions{SkipTests: tt.skipTests})
+			require.NoError(t, err)
+			require.True(t, result.Success, "%+v", result.Details)
+			commands := testutil.ReadFile(t, filepath.Join(dir, "commands.log"))
+			assert.Equal(t, tt.want, strings.ReplaceAll(commands, "\r\n", "\n"))
+		})
+	}
+}
+
+func TestNodeJsValidateCommandFailure(t *testing.T) {
+	stubPackageManagers(t)
+	for _, command := range []string{"install", "run --if-present typecheck", "run --if-present test"} {
+		t.Run(command, func(t *testing.T) {
+			dir := t.TempDir()
+			writeValidationProject(t, dir, validationScripts)
+			testutil.Touch(t, dir, "pnpm-lock.yaml")
+			t.Setenv(validationTestFailEnv, command)
+			validator := validation.ValidationNodeJs{}
+			result, err := validator.Validate(cmdio.MockDiscard(t.Context()), dir, validation.ValidateOptions{})
+			require.NoError(t, err)
+			require.False(t, result.Success)
+			require.NotNil(t, result.Details)
+			assert.Equal(t, validationTestExitCode, result.Details.ExitCode)
+			assert.Contains(t, result.Details.Stdout, validationTestStdout)
+			assert.Contains(t, result.Details.Stderr, validationTestStderr)
+			commands := testutil.ReadFile(t, filepath.Join(dir, "commands.log"))
+			assert.True(t, strings.HasSuffix(strings.ReplaceAll(commands, "\r\n", "\n"), "pnpm "+command+"\n"), commands)
+		})
+	}
+}
+
+func TestNodeJsValidateManagerFromRelativePath(t *testing.T) {
+	// Read the stub before chdir so the relative testdata path still resolves.
+	stub := testutil.ReadFile(t, "testdata/package-manager")
+	stubCmd := testutil.ReadFile(t, "testdata/package-manager.cmd")
+	for _, workDir := range []string{".", "app"} {
+		t.Run(workDir, func(t *testing.T) {
+			isolateValidationShell(t)
+			dir := t.TempDir()
+			projectDir := filepath.Join(dir, workDir)
+			// The manager is only available relative to the project's directory.
+			relBin := filepath.Join("node_modules", ".bin")
+			require.NoError(t, os.MkdirAll(filepath.Join(projectDir, relBin), 0o755))
+			require.NoError(t, os.WriteFile(filepath.Join(projectDir, relBin, "pnpm"), []byte(stub), 0o755))
+			require.NoError(t, os.WriteFile(filepath.Join(projectDir, relBin, "pnpm.cmd"), []byte(stubCmd), 0o755))
+			writeValidationProject(t, projectDir, []string{"build"})
+			testutil.Touch(t, projectDir, "pnpm-lock.yaml")
+
+			t.Chdir(dir)
+			t.Setenv("PATH", relBin+string(os.PathListSeparator)+os.Getenv("PATH"))
+			t.Setenv(validationTestFailEnv, "")
+
+			validator := validation.ValidationNodeJs{}
+			result, err := validator.Validate(cmdio.MockDiscard(t.Context()), workDir, validation.ValidateOptions{})
+			require.NoError(t, err)
+			require.True(t, result.Success, "%+v", result.Details)
+			commands := testutil.ReadFile(t, filepath.Join(projectDir, "commands.log"))
+			// node_modules exists, so install is skipped and scripts run via the relative pnpm.
+			want := strings.ReplaceAll(strings.TrimPrefix(npmValidationCommands, "npm install\n"), "npm ", "pnpm ")
+			assert.Equal(t, want, strings.ReplaceAll(commands, "\r\n", "\n"))
+		})
+	}
+}
+
+func TestNodeJsValidateMissingPackageManager(t *testing.T) {
+	isolateValidationShell(t)
+	dir := t.TempDir()
+	writeValidationProject(t, dir, validationScripts)
+	testutil.Touch(t, dir, "pnpm-lock.yaml")
+	validator := validation.ValidationNodeJs{}
+	result, err := validator.Validate(cmdio.MockDiscard(t.Context()), dir, validation.ValidateOptions{})
+	require.NoError(t, err)
+	require.False(t, result.Success)
+	require.NotNil(t, result.Details)
+	assert.NotZero(t, result.Details.ExitCode)
+	assert.Contains(t, result.Details.Stderr, "pnpm")
+	assert.NoFileExists(t, filepath.Join(dir, "commands.log"))
+}
diff --git a/libs/apps/validation/package_manager.go b/libs/apps/validation/package_manager.go
new file mode 100644
index 00000000000..3d392b1e1b3
--- /dev/null
+++ b/libs/apps/validation/package_manager.go
@@ -0,0 +1,112 @@
+package validation
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/databricks/cli/libs/apps/packagejson"
+	"github.com/databricks/cli/libs/log"
+)
+
+const (
+	packageManagerNpm  = "npm"
+	packageManagerPnpm = "pnpm"
+	packageManagerYarn = "yarn"
+	packageManagerBun  = "bun"
+	packageManagerKey  = "packageManager"
+)
+
+// DetectPackageManager prefers package.json's packageManager declaration over lockfiles
+// in workDir. Unsupported declarations and lockfiles are logged and ignored. Without a
+// supported declaration, npm lockfiles take precedence over pnpm, with npm as the default.
+// The selected manager must be installed to run validation.
+func DetectPackageManager(ctx context.Context, workDir string) (string, error) {
+	lockfiles := []struct {
+		name      string
+		manager   string
+		supported bool
+	}{
+		// https://docs.npmjs.com/cli/configuring-npm/package-lock-json
+		// https://docs.npmjs.com/cli/configuring-npm/npm-shrinkwrap-json
+		{"package-lock.json", packageManagerNpm, true},
+		{"npm-shrinkwrap.json", packageManagerNpm, true},
+		// https://pnpm.io/git
+		{"pnpm-lock.yaml", packageManagerPnpm, true},
+		// https://classic.yarnpkg.com/lang/en/docs/yarn-lock/
+		{"yarn.lock", packageManagerYarn, false},
+		// https://bun.sh/docs/install/lockfile
+		{"bun.lock", packageManagerBun, false},
+		{"bun.lockb", packageManagerBun, false},
+	}
+
+	// Lockfiles are listed npm-first, so the first supported one found wins and keeps
+	// npm's precedence when there is no supported packageManager declaration.
+	manager := readDeclaredPackageManager(ctx, workDir)
+	chosen := packagejson.FileName
+	for _, lockfile := range lockfiles {
+		info, err := os.Stat(filepath.Join(workDir, lockfile.name))
+		if errors.Is(err, os.ErrNotExist) {
+			continue
+		}
+		if !lockfile.supported {
+			log.Warnf(ctx, "ignoring unsupported lockfile %s; apps validation uses %s or %s", lockfile.name, packageManagerNpm, packageManagerPnpm)
+			continue
+		}
+		if err != nil {
+			return "", fmt.Errorf("failed to inspect %s: %w", lockfile.name, err)
+		}
+		if !info.Mode().IsRegular() {
+			return "", fmt.Errorf("lockfile %s must be a regular file", lockfile.name)
+		}
+		if manager == "" {
+			manager, chosen = lockfile.manager, lockfile.name
+			continue
+		}
+		if lockfile.manager != manager {
+			log.Warnf(ctx, "found conflicting package managers; using %s from %s and ignoring %s", manager, chosen, lockfile.name)
+		}
+	}
+
+	if manager == "" {
+		return packageManagerNpm, nil
+	}
+	return manager, nil
+}
+
+// readDeclaredPackageManager leaves manifest validation to the selected package manager.
+func readDeclaredPackageManager(ctx context.Context, workDir string) string {
+	fields, err := packagejson.Read(workDir)
+	if err != nil {
+		// Preserve native manifest diagnostics instead of failing during detection.
+		log.Debugf(ctx, "cannot read package manager metadata: %v", err)
+		return ""
+	}
+	value, ok := fields[packageManagerKey]
+	if !ok {
+		return ""
+	}
+	var declaration string
+	if err := json.Unmarshal(value, &declaration); err != nil {
+		log.Warnf(ctx, "ignoring invalid %s in %s; expected a string", packageManagerKey, packagejson.FileName)
+		return ""
+	}
+	if declaration == "" {
+		return ""
+	}
+
+	// Only select the tool; its version policy remains native:
+	// https://nodejs.org/api/packages.html#packagemanager.
+	manager, _, _ := strings.Cut(declaration, "@")
+	switch manager {
+	case packageManagerNpm, packageManagerPnpm:
+		return manager
+	default:
+		log.Warnf(ctx, "ignoring unsupported %s %q in %s; apps validation uses %s or %s", packageManagerKey, declaration, packagejson.FileName, packageManagerNpm, packageManagerPnpm)
+		return ""
+	}
+}
diff --git a/libs/apps/validation/package_manager_test.go b/libs/apps/validation/package_manager_test.go
new file mode 100644
index 00000000000..ff3233ba7a5
--- /dev/null
+++ b/libs/apps/validation/package_manager_test.go
@@ -0,0 +1,219 @@
+package validation_test
+
+import (
+	"bytes"
+	"log/slog"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/databricks/cli/internal/testutil"
+	"github.com/databricks/cli/libs/apps/packagejson"
+	"github.com/databricks/cli/libs/apps/validation"
+	"github.com/databricks/cli/libs/log"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestDetectPackageManager(t *testing.T) {
+	tests := []struct {
+		name      string
+		lockfiles []string
+		want      string
+	}{
+		{name: "no lockfile", want: "npm"},
+		{name: "npm", lockfiles: []string{"package-lock.json"}, want: "npm"},
+		{name: "npm shrinkwrap", lockfiles: []string{"npm-shrinkwrap.json"}, want: "npm"},
+		{name: "pnpm", lockfiles: []string{"pnpm-lock.yaml"}, want: "pnpm"},
+		{name: "npm aliases", lockfiles: []string{"package-lock.json", "npm-shrinkwrap.json"}, want: "npm"},
+		// Unsupported and conflicting lockfiles are ignored (with a warning), never fatal.
+		{name: "unsupported yarn", lockfiles: []string{"yarn.lock"}, want: "npm"},
+		{name: "unsupported bun", lockfiles: []string{"bun.lock"}, want: "npm"},
+		{name: "unsupported bun binary", lockfiles: []string{"bun.lockb"}, want: "npm"},
+		{name: "unsupported manager alongside pnpm", lockfiles: []string{"pnpm-lock.yaml", "yarn.lock"}, want: "pnpm"},
+		{name: "conflicting managers prefer npm", lockfiles: []string{"pnpm-lock.yaml", "package-lock.json"}, want: "npm"},
+		{name: "conflict with npm aliases", lockfiles: []string{"pnpm-lock.yaml", "package-lock.json", "npm-shrinkwrap.json"}, want: "npm"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			dir := t.TempDir()
+			for _, lockfile := range tt.lockfiles {
+				testutil.Touch(t, dir, lockfile)
+			}
+			manager, err := validation.DetectPackageManager(t.Context(), dir)
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, manager)
+		})
+	}
+}
+
+func TestDetectPackageManagerInvalidLockfile(t *testing.T) {
+	for _, lockfile := range []string{"package-lock.json", "npm-shrinkwrap.json", "pnpm-lock.yaml"} {
+		t.Run(lockfile, func(t *testing.T) {
+			dir := t.TempDir()
+			require.NoError(t, os.Mkdir(filepath.Join(dir, lockfile), 0o755))
+			_, err := validation.DetectPackageManager(t.Context(), dir)
+			require.EqualError(t, err, "lockfile "+lockfile+" must be a regular file")
+		})
+	}
+}
+
+func TestDetectPackageManagerDeclaration(t *testing.T) {
+	tests := []struct {
+		name      string
+		manifest  string
+		lockfiles []string
+		want      string
+		warnings  []string
+	}{
+		{name: "npm without lockfile", manifest: `{"packageManager":"npm@10.9.2"}`, want: "npm"},
+		{name: "pnpm without lockfile", manifest: `{"packageManager":"pnpm@10.30.3"}`, want: "pnpm"},
+		{name: "name without version", manifest: `{"packageManager":"pnpm"}`, want: "pnpm"},
+		{name: "version remains native", manifest: `{"packageManager":"pnpm@invalid-version"}`, want: "pnpm"},
+		{
+			name:      "npm overrides pnpm lockfile",
+			manifest:  `{"packageManager":"npm@10.9.2"}`,
+			lockfiles: []string{"pnpm-lock.yaml"},
+			want:      "npm",
+			warnings:  []string{"using npm from package.json and ignoring pnpm-lock.yaml"},
+		},
+		{
+			name:      "pnpm overrides npm lockfiles",
+			manifest:  `{"packageManager":"pnpm@10.30.3"}`,
+			lockfiles: []string{"package-lock.json", "npm-shrinkwrap.json", "pnpm-lock.yaml"},
+			want:      "pnpm",
+			warnings: []string{
+				"using pnpm from package.json and ignoring package-lock.json",
+				"using pnpm from package.json and ignoring npm-shrinkwrap.json",
+			},
+		},
+		{name: "matching lockfile", manifest: `{"packageManager":"pnpm@10.30.3"}`, lockfiles: []string{"pnpm-lock.yaml"}, want: "pnpm"},
+		{name: "missing field", manifest: `{}`, lockfiles: []string{"pnpm-lock.yaml"}, want: "pnpm"},
+		{name: "empty field", manifest: `{"packageManager":""}`, lockfiles: []string{"pnpm-lock.yaml"}, want: "pnpm"},
+		{name: "null field", manifest: `{"packageManager":null}`, lockfiles: []string{"pnpm-lock.yaml"}, want: "pnpm"},
+		{name: "exact field name", manifest: `{"PackageManager":"pnpm@10.30.3"}`, want: "npm"},
+		{name: "devEngines is not used", manifest: `{"devEngines":{"packageManager":{"name":"pnpm"}}}`, want: "npm"},
+		{name: "scripts are not interpreted", manifest: `{"packageManager":"pnpm@10.30.3","scripts":{"typecheck":null,"//":["a comment"]}}`, want: "pnpm"},
+		{name: "BOM", manifest: "\xef\xbb\xbf" + `{"packageManager":"pnpm@10.30.3"}`, want: "pnpm"},
+		{
+			name:      "unsupported declaration uses lockfiles",
+			manifest:  `{"packageManager":"yarn@4.0.0"}`,
+			lockfiles: []string{"pnpm-lock.yaml"},
+			want:      "pnpm",
+			warnings:  []string{"ignoring unsupported packageManager"},
+		},
+		{
+			name:     "unsupported declaration uses npm default",
+			manifest: `{"packageManager":"bun@1.0.0"}`,
+			want:     "npm",
+			warnings: []string{"ignoring unsupported packageManager"},
+		},
+		{
+			name:     "exact manager name",
+			manifest: `{"packageManager":"PNPM@10.30.3"}`,
+			want:     "npm",
+			warnings: []string{"ignoring unsupported packageManager"},
+		},
+		{
+			name:      "non-string declaration uses lockfiles",
+			manifest:  `{"packageManager":{"name":"npm"}}`,
+			lockfiles: []string{"pnpm-lock.yaml"},
+			want:      "pnpm",
+			warnings:  []string{"ignoring invalid packageManager"},
+		},
+		{name: "malformed manifest uses npm default", manifest: `{"packageManager":"pnpm@10.30.3",}`, want: "npm"},
+		{name: "malformed manifest uses lockfiles", manifest: `{"packageManager":"npm@10.9.2",}`, lockfiles: []string{"pnpm-lock.yaml"}, want: "pnpm"},
+		{name: "null manifest stays native", manifest: `null`, lockfiles: []string{"pnpm-lock.yaml"}, want: "pnpm"},
+		{name: "non-object manifest stays native", manifest: `[]`, lockfiles: []string{"pnpm-lock.yaml"}, want: "pnpm"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			dir := t.TempDir()
+			testutil.WriteFile(t, filepath.Join(dir, packagejson.FileName), tt.manifest)
+			for _, lockfile := range tt.lockfiles {
+				testutil.Touch(t, dir, lockfile)
+			}
+			var warnings bytes.Buffer
+			ctx := log.NewContext(t.Context(), slog.New(slog.NewTextHandler(&warnings, nil)))
+			manager, err := validation.DetectPackageManager(ctx, dir)
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, manager)
+			assert.Equal(t, len(tt.warnings), strings.Count(warnings.String(), "level=WARN"), warnings.String())
+			for _, warning := range tt.warnings {
+				assert.Contains(t, warnings.String(), warning)
+			}
+		})
+	}
+}
+
+func TestDetectPackageManagerDeclarationInvalidLockfile(t *testing.T) {
+	dir := t.TempDir()
+	testutil.WriteFile(t, filepath.Join(dir, packagejson.FileName), `{"packageManager":"npm@10.9.2"}`)
+	require.NoError(t, os.Mkdir(filepath.Join(dir, "pnpm-lock.yaml"), 0o755))
+	_, err := validation.DetectPackageManager(t.Context(), dir)
+	require.EqualError(t, err, "lockfile pnpm-lock.yaml must be a regular file")
+}
+
+func TestDetectPackageManagerDeclarationReadError(t *testing.T) {
+	dir := t.TempDir()
+	require.NoError(t, os.Mkdir(filepath.Join(dir, packagejson.FileName), 0o755))
+	testutil.Touch(t, dir, "pnpm-lock.yaml")
+	manager, err := validation.DetectPackageManager(t.Context(), dir)
+	require.NoError(t, err)
+	assert.Equal(t, "pnpm", manager)
+}
+
+func TestDetectPackageManagerDeclarationProjectDirectory(t *testing.T) {
+	dir := t.TempDir()
+	testutil.WriteFile(t, filepath.Join(dir, packagejson.FileName), `{"packageManager":"pnpm@10.30.3"}`)
+	t.Chdir(dir)
+	for _, tt := range []struct {
+		name     string
+		manifest string
+		lockfile string
+	}{
+		{name: "declared", manifest: `{"packageManager":"npm@10.9.2"}`, lockfile: "pnpm-lock.yaml"},
+		{name: "no-parent-inheritance", manifest: `{}`},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			testutil.WriteFile(t, filepath.Join(tt.name, packagejson.FileName), tt.manifest)
+			if tt.lockfile != "" {
+				testutil.Touch(t, tt.name, tt.lockfile)
+			}
+			manager, err := validation.DetectPackageManager(t.Context(), tt.name)
+			require.NoError(t, err)
+			assert.Equal(t, "npm", manager)
+		})
+	}
+}
+
+func TestDetectPackageManagerUnsupportedLockfileDirectory(t *testing.T) {
+	for _, lockfile := range []string{"yarn.lock", "bun.lock", "bun.lockb"} {
+		for _, manager := range []string{"npm", "pnpm"} {
+			t.Run(lockfile+"/"+manager, func(t *testing.T) {
+				dir := t.TempDir()
+				require.NoError(t, os.Mkdir(filepath.Join(dir, lockfile), 0o755))
+				if manager == "pnpm" {
+					testutil.Touch(t, dir, "pnpm-lock.yaml")
+				}
+				var warnings bytes.Buffer
+				ctx := log.NewContext(t.Context(), slog.New(slog.NewTextHandler(&warnings, nil)))
+				actual, err := validation.DetectPackageManager(ctx, dir)
+				require.NoError(t, err)
+				assert.Equal(t, manager, actual)
+				assert.Contains(t, warnings.String(), "ignoring unsupported lockfile "+lockfile)
+			})
+		}
+	}
+}
+
+func TestDetectPackageManagerProjectDirectory(t *testing.T) {
+	dir := t.TempDir()
+	testutil.Touch(t, dir, "pnpm-lock.yaml")
+	projectDir := filepath.Join(dir, "app")
+	testutil.Touch(t, projectDir, "package-lock.json")
+	manager, err := validation.DetectPackageManager(t.Context(), projectDir)
+	require.NoError(t, err)
+	assert.Equal(t, "npm", manager)
+}
diff --git a/libs/apps/validation/testdata/package-manager b/libs/apps/validation/testdata/package-manager
new file mode 100644
index 00000000000..d452c009e29
--- /dev/null
+++ b/libs/apps/validation/testdata/package-manager
@@ -0,0 +1,7 @@
+#!/bin/sh
+printf '%s %s\n' "${0##*/}" "$*" >> commands.log
+if [ "$*" = "${VALIDATION_TEST_FAIL:-}" ]; then
+    echo "validation stdout"
+    echo "validation stderr" >&2
+    exit 17
+fi
diff --git a/libs/apps/validation/testdata/package-manager.cmd b/libs/apps/validation/testdata/package-manager.cmd
new file mode 100644
index 00000000000..1e7de72f5dd
--- /dev/null
+++ b/libs/apps/validation/testdata/package-manager.cmd
@@ -0,0 +1,7 @@
+@echo off
+echo %~n0 %*>>commands.log
+if "%*"=="%VALIDATION_TEST_FAIL%" (
+    echo validation stdout
+    echo validation stderr 1>&2
+    exit /b 17
+)
diff --git a/libs/apps/validation/validation.go b/libs/apps/validation/validation.go
index 7438653d2a0..7eefff387e7 100644
--- a/libs/apps/validation/validation.go
+++ b/libs/apps/validation/validation.go
@@ -6,6 +6,8 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+
+	"github.com/databricks/cli/libs/apps/packagejson"
 )
 
 // ValidationDetail contains detailed output from a failed validation.
@@ -69,7 +71,7 @@ type Validation interface {
 // Returns nil if no validator is applicable.
 func GetProjectValidator(workDir string) Validation {
 	// Check for Node.js project (package.json exists)
-	packageJSON := filepath.Join(workDir, "package.json")
+	packageJSON := filepath.Join(workDir, packagejson.FileName)
 	if _, err := os.Stat(packageJSON); err == nil {
 		return &ValidationNodeJs{}
 	}
diff --git a/libs/apps/vite/bridge.go b/libs/apps/vite/bridge.go
index 0bd665cacbd..7b658e83c7d 100644
--- a/libs/apps/vite/bridge.go
+++ b/libs/apps/vite/bridge.go
@@ -14,6 +14,7 @@ import (
 	"path/filepath"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	"github.com/databricks/cli/libs/cmdio"
@@ -75,10 +76,11 @@ type prioritizedMessage struct {
 }
 
 type Bridge struct {
-	ctx                context.Context
-	w                  *databricks.WorkspaceClient
-	appName            string
-	tunnelConn         *websocket.Conn
+	ctx     context.Context
+	w       *databricks.WorkspaceClient
+	appName string
+	// Atomic because reconnects swap the connection while the writer goroutine reads it.
+	tunnelConn         atomic.Pointer[websocket.Conn]
 	hmrConn            *websocket.Conn
 	tunnelID           string
 	tunnelWriteChan    chan prioritizedMessage
@@ -86,6 +88,7 @@ type Bridge struct {
 	stop               func()
 	httpClient         *http.Client
 	connectionRequests chan *BridgeMessage
+	stdinLines         chan string // Lines read by the persistent stdin reader, consumed by connection prompts
 	port               int
 	keepaliveDone      chan struct{} // Signals keepalive goroutine to stop on reconnect
 	keepaliveMu        sync.Mutex    // Protects keepaliveDone
@@ -116,6 +119,7 @@ func NewBridge(ctx context.Context, w *databricks.WorkspaceClient, appName strin
 		stopChan:           make(chan struct{}),
 		tunnelWriteChan:    make(chan prioritizedMessage, 100), // Buffered channel for async writes
 		connectionRequests: make(chan *BridgeMessage, 10),
+		stdinLines:         make(chan string),
 		port:               port,
 		autoApprove:        autoApprove,
 	}
@@ -123,9 +127,9 @@ func NewBridge(ctx context.Context, w *databricks.WorkspaceClient, appName strin
 	b.stop = sync.OnceFunc(func() {
 		close(b.stopChan)
 
-		if b.tunnelConn != nil {
-			_ = b.tunnelConn.WriteMessage(websocket.CloseMessage, websocket.FormatCloseMessage(websocket.CloseNormalClosure, ""))
-			b.tunnelConn.Close()
+		if conn := b.tunnelConn.Load(); conn != nil {
+			_ = conn.WriteMessage(websocket.CloseMessage, websocket.FormatCloseMessage(websocket.CloseNormalClosure, ""))
+			conn.Close()
 		}
 
 		if b.hmrConn != nil {
@@ -219,7 +223,7 @@ func (vb *Bridge) connectToTunnel(appDomain *url.URL) error {
 		return nil
 	})
 
-	vb.tunnelConn = conn
+	vb.setTunnelConn(conn)
 
 	// Start keepalive ping goroutine (stop existing one first if any)
 	vb.keepaliveMu.Lock()
@@ -235,6 +239,13 @@ func (vb *Bridge) connectToTunnel(appDomain *url.URL) error {
 	return nil
 }
 
+// setTunnelConn installs a new tunnel connection, closing the old one so reconnects don't leak it.
+func (vb *Bridge) setTunnelConn(conn *websocket.Conn) {
+	if old := vb.tunnelConn.Swap(conn); old != nil {
+		old.Close()
+	}
+}
+
 // ConnectToTunnelWithRetry attempts to connect to the tunnel with exponential backoff.
 // This handles cases where the app isn't fully ready yet (e.g., right after deployment).
 func (vb *Bridge) ConnectToTunnelWithRetry(appDomain *url.URL) error {
@@ -346,7 +357,8 @@ func (vb *Bridge) tunnelWriter(ctx context.Context) error {
 		case <-vb.stopChan:
 			return nil
 		case msg := <-vb.tunnelWriteChan:
-			if err := vb.tunnelConn.WriteMessage(msg.messageType, msg.data); err != nil {
+			// Load per message so writes follow a reconnect to the new connection.
+			if err := vb.tunnelConn.Load().WriteMessage(msg.messageType, msg.data); err != nil {
 				log.Errorf(vb.ctx, "[vite_bridge] Failed to write message: %v", err)
 				return fmt.Errorf("failed to write to tunnel: %w", err)
 			}
@@ -364,7 +376,7 @@ func (vb *Bridge) handleTunnelMessages(ctx context.Context) error {
 		default:
 		}
 
-		_, message, err := vb.tunnelConn.ReadMessage()
+		_, message, err := vb.tunnelConn.Load().ReadMessage()
 		if err != nil {
 			if websocket.IsCloseError(err, websocket.CloseNormalClosure, websocket.CloseGoingAway, websocket.CloseNoStatusReceived, websocket.CloseAbnormalClosure) {
 				cmdio.LogString(vb.ctx, "🔄 Tunnel closed, reconnecting...")
@@ -408,8 +420,15 @@ func (vb *Bridge) handleMessage(msg *BridgeMessage) error {
 		return nil
 
 	case "connection:request":
-		vb.connectionRequests <- msg
-		return nil
+		// The consumer may be blocked on a stdin prompt or gone after stop; a bare send could hang the tunnel reader.
+		select {
+		case vb.connectionRequests <- msg:
+			return nil
+		case <-vb.stopChan:
+			return nil
+		case <-time.After(wsWriteTimeout):
+			return errors.New("connection request queue full, dropping request")
+		}
 
 	case "fetch":
 		go func(fetchMsg BridgeMessage) {
@@ -446,6 +465,25 @@ func (vb *Bridge) handleMessage(msg *BridgeMessage) error {
 	}
 }
 
+// readStdinLines forwards lines from r to stdinLines, closing the channel on read
+// error so prompts fail instead of hanging. A single persistent reader keeps a
+// timed-out prompt from leaking a goroutine that swallows the next prompt's answer.
+func (vb *Bridge) readStdinLines(r io.Reader) {
+	reader := bufio.NewReader(r)
+	for {
+		line, err := reader.ReadString('\n')
+		if err != nil {
+			close(vb.stdinLines)
+			return
+		}
+		select {
+		case vb.stdinLines <- line:
+		case <-vb.stopChan:
+			return
+		}
+	}
+}
+
 func (vb *Bridge) handleConnectionRequest(msg *BridgeMessage) error {
 	cmdio.LogString(vb.ctx, "")
 	cmdio.LogString(vb.ctx, "🔔 Connection Request")
@@ -458,25 +496,14 @@ func (vb *Bridge) handleConnectionRequest(msg *BridgeMessage) error {
 	} else {
 		cmdio.LogString(vb.ctx, "   Approve this connection? (y/n)")
 
-		// Read from stdin with timeout to prevent indefinite blocking
-		inputChan := make(chan string, 1)
-		errChan := make(chan error, 1)
-
-		go func() {
-			reader := bufio.NewReader(os.Stdin)
-			input, err := reader.ReadString('\n')
-			if err != nil {
-				errChan <- err
-				return
-			}
-			inputChan <- input
-		}()
-
 		select {
-		case input := <-inputChan:
+		case input, ok := <-vb.stdinLines:
+			if !ok {
+				return errors.New("failed to read user input: stdin closed")
+			}
 			approved = strings.ToLower(strings.TrimSpace(input)) == "y"
-		case err := <-errChan:
-			return fmt.Errorf("failed to read user input: %w", err)
+		case <-vb.stopChan:
+			return nil
 		case <-time.After(BridgeConnTimeout):
 			// Default to denying after timeout
 			cmdio.LogString(vb.ctx, "⏱️  Timeout waiting for response, denying connection")
@@ -907,7 +934,7 @@ func (vb *Bridge) Start() error {
 	readyChan := make(chan error, 1)
 	go func() {
 		for vb.tunnelID == "" {
-			_, message, err := vb.tunnelConn.ReadMessage()
+			_, message, err := vb.tunnelConn.Load().ReadMessage()
 			if err != nil {
 				readyChan <- err
 				return
@@ -953,6 +980,10 @@ func (vb *Bridge) Start() error {
 		return nil
 	})
 
+	if !vb.autoApprove {
+		go vb.readStdinLines(os.Stdin)
+	}
+
 	// Connection request handler - not in errgroup to avoid blocking other handlers
 	go func() {
 		for {
diff --git a/libs/apps/vite/bridge_test.go b/libs/apps/vite/bridge_test.go
index 17f9fb4464b..cadd70f0828 100644
--- a/libs/apps/vite/bridge_test.go
+++ b/libs/apps/vite/bridge_test.go
@@ -6,6 +6,7 @@ import (
 	"net/http/httptest"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 	"time"
 
@@ -192,6 +193,17 @@ func TestBridgeHandleMessage(t *testing.T) {
 	}
 }
 
+// waitForMessage waits for the websocket test server to deliver a message.
+func waitForMessage(t *testing.T, received <-chan []byte) []byte {
+	select {
+	case message := <-received:
+		return message
+	case <-time.After(5 * time.Second):
+		t.Fatal("timed out waiting for message")
+		return nil
+	}
+}
+
 func TestBridgeHandleFileReadRequest(t *testing.T) {
 	// Create a temporary directory structure
 	tmpDir := t.TempDir()
@@ -211,7 +223,7 @@ func TestBridgeHandleFileReadRequest(t *testing.T) {
 		w := &databricks.WorkspaceClient{}
 
 		// Create a mock tunnel connection using httptest
-		var lastMessage []byte
+		received := make(chan []byte, 1)
 		upgrader := websocket.Upgrader{}
 		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			conn, err := upgrader.Upgrade(w, r, nil)
@@ -227,7 +239,7 @@ func TestBridgeHandleFileReadRequest(t *testing.T) {
 				t.Errorf("failed to read message: %v", err)
 				return
 			}
-			lastMessage = message
+			received <- message
 		}))
 		defer server.Close()
 
@@ -239,7 +251,7 @@ func TestBridgeHandleFileReadRequest(t *testing.T) {
 		defer conn.Close()
 
 		vb := NewBridge(ctx, w, "test-app", 5173, false)
-		vb.tunnelConn = conn
+		vb.tunnelConn.Store(conn)
 
 		go func() { _ = vb.tunnelWriter(ctx) }()
 
@@ -252,12 +264,9 @@ func TestBridgeHandleFileReadRequest(t *testing.T) {
 		err = vb.handleFileReadRequest(msg)
 		require.NoError(t, err)
 
-		// Give the message time to be sent
-		time.Sleep(100 * time.Millisecond)
-
 		// Parse the response
 		var response BridgeMessage
-		err = json.Unmarshal(lastMessage, &response)
+		err = json.Unmarshal(waitForMessage(t, received), &response)
 		require.NoError(t, err)
 
 		assert.Equal(t, "file:read:response", response.Type)
@@ -270,7 +279,7 @@ func TestBridgeHandleFileReadRequest(t *testing.T) {
 		ctx := cmdio.MockDiscard(t.Context())
 		w := &databricks.WorkspaceClient{}
 
-		var lastMessage []byte
+		received := make(chan []byte, 1)
 		upgrader := websocket.Upgrader{}
 		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			conn, err := upgrader.Upgrade(w, r, nil)
@@ -285,7 +294,7 @@ func TestBridgeHandleFileReadRequest(t *testing.T) {
 				t.Errorf("failed to read message: %v", err)
 				return
 			}
-			lastMessage = message
+			received <- message
 		}))
 		defer server.Close()
 
@@ -296,7 +305,7 @@ func TestBridgeHandleFileReadRequest(t *testing.T) {
 		defer conn.Close()
 
 		vb := NewBridge(ctx, w, "test-app", 5173, false)
-		vb.tunnelConn = conn
+		vb.tunnelConn.Store(conn)
 
 		go func() { _ = vb.tunnelWriter(ctx) }()
 
@@ -309,11 +318,8 @@ func TestBridgeHandleFileReadRequest(t *testing.T) {
 		err = vb.handleFileReadRequest(msg)
 		require.NoError(t, err)
 
-		// Give the message time to be sent
-		time.Sleep(100 * time.Millisecond)
-
 		var response BridgeMessage
-		err = json.Unmarshal(lastMessage, &response)
+		err = json.Unmarshal(waitForMessage(t, received), &response)
 		require.NoError(t, err)
 
 		assert.Equal(t, "file:read:response", response.Type)
@@ -368,11 +374,129 @@ func TestNewBridge_AutoApprove(t *testing.T) {
 	assert.True(t, vb.autoApprove)
 }
 
+// newWSConn returns a client connection to a test server that discards inbound messages.
+func newWSConn(t *testing.T) *websocket.Conn {
+	upgrader := websocket.Upgrader{}
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		conn, err := upgrader.Upgrade(w, r, nil)
+		if err != nil {
+			return
+		}
+		defer conn.Close()
+		for {
+			if _, _, err := conn.ReadMessage(); err != nil {
+				return
+			}
+		}
+	}))
+	t.Cleanup(server.Close)
+
+	wsURL := "ws" + server.URL[4:]
+	conn, resp, err := websocket.DefaultDialer.Dial(wsURL, nil)
+	require.NoError(t, err)
+	resp.Body.Close()
+	t.Cleanup(func() { conn.Close() })
+	return conn
+}
+
+func TestBridgeSetTunnelConnSwapDuringWrites(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	w := &databricks.WorkspaceClient{}
+
+	conn1 := newWSConn(t)
+	conn2 := newWSConn(t)
+
+	vb := NewBridge(ctx, w, "test-app", 5173, false)
+	vb.tunnelConn.Store(conn1)
+
+	writerDone := make(chan struct{})
+	go func() {
+		defer close(writerDone)
+		// A queued write may hit the just-closed old connection, so the error is ignored.
+		_ = vb.tunnelWriter(ctx)
+	}()
+
+	for i := range 100 {
+		vb.tunnelWriteChan <- prioritizedMessage{
+			messageType: websocket.TextMessage,
+			data:        []byte("payload"),
+			priority:    1,
+		}
+		if i == 50 {
+			vb.setTunnelConn(conn2)
+		}
+	}
+
+	close(vb.stopChan)
+	select {
+	case <-writerDone:
+	case <-time.After(5 * time.Second):
+		t.Fatal("tunnel writer did not stop")
+	}
+
+	// setTunnelConn must close the connection it replaced.
+	err := conn1.WriteMessage(websocket.TextMessage, []byte("x"))
+	require.Error(t, err)
+}
+
+func TestBridgeConnectionRequestSendDoesNotBlockAfterStop(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	w := &databricks.WorkspaceClient{}
+
+	vb := NewBridge(ctx, w, "test-app", 5173, false)
+
+	// Fill the queue so an unguarded send would block forever.
+	for range cap(vb.connectionRequests) {
+		vb.connectionRequests <- &BridgeMessage{Type: "connection:request"}
+	}
+
+	vb.Stop()
+
+	done := make(chan error, 1)
+	go func() {
+		done <- vb.handleMessage(&BridgeMessage{Type: "connection:request"})
+	}()
+
+	select {
+	case err := <-done:
+		require.NoError(t, err)
+	case <-time.After(time.Second):
+		t.Fatal("handleMessage blocked on a full connectionRequests queue after stop")
+	}
+}
+
+func TestBridgeConnectionRequestSequentialPrompts(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	w := &databricks.WorkspaceClient{}
+
+	vb := NewBridge(ctx, w, "test-app", 5173, false)
+	go vb.readStdinLines(strings.NewReader("y\nn\n"))
+
+	// Each prompt must consume exactly one line; a leaked reader would swallow the next prompt's answer.
+	require.NoError(t, vb.handleConnectionRequest(&BridgeMessage{Type: "connection:request", Viewer: "a@example.com", RequestID: "req-1"}))
+	require.NoError(t, vb.handleConnectionRequest(&BridgeMessage{Type: "connection:request", Viewer: "b@example.com", RequestID: "req-2"}))
+
+	var responses []BridgeMessage
+	for range 2 {
+		msg := <-vb.tunnelWriteChan
+		var response BridgeMessage
+		require.NoError(t, json.Unmarshal(msg.data, &response))
+		responses = append(responses, response)
+	}
+
+	assert.Equal(t, "connection:response", responses[0].Type)
+	assert.Equal(t, "req-1", responses[0].RequestID)
+	assert.True(t, responses[0].Approved)
+	assert.Equal(t, "connection:response", responses[1].Type)
+	assert.Equal(t, "req-2", responses[1].RequestID)
+	assert.False(t, responses[1].Approved)
+}
+
 func TestBridgeHandleConnectionRequest_AutoApproveSkipsStdin(t *testing.T) {
 	ctx := cmdio.MockDiscard(t.Context())
 	w := &databricks.WorkspaceClient{}
 
-	var received []byte
+	received := make(chan []byte, 1)
 	upgrader := websocket.Upgrader{}
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		conn, err := upgrader.Upgrade(w, r, nil)
@@ -387,7 +511,7 @@ func TestBridgeHandleConnectionRequest_AutoApproveSkipsStdin(t *testing.T) {
 			t.Errorf("failed to read message: %v", err)
 			return
 		}
-		received = message
+		received <- message
 	}))
 	defer server.Close()
 
@@ -398,7 +522,7 @@ func TestBridgeHandleConnectionRequest_AutoApproveSkipsStdin(t *testing.T) {
 	defer conn.Close()
 
 	vb := NewBridge(ctx, w, "test-app", 5173, true)
-	vb.tunnelConn = conn
+	vb.tunnelConn.Store(conn)
 
 	go func() { _ = vb.tunnelWriter(ctx) }()
 
@@ -410,10 +534,8 @@ func TestBridgeHandleConnectionRequest_AutoApproveSkipsStdin(t *testing.T) {
 
 	require.NoError(t, vb.handleConnectionRequest(msg))
 
-	time.Sleep(100 * time.Millisecond)
-
 	var response BridgeMessage
-	require.NoError(t, json.Unmarshal(received, &response))
+	require.NoError(t, json.Unmarshal(waitForMessage(t, received), &response))
 	assert.Equal(t, "connection:response", response.Type)
 	assert.Equal(t, "req-auto", response.RequestID)
 	assert.True(t, response.Approved)
diff --git a/libs/apps/vite/validate_dir_test.go b/libs/apps/vite/validate_dir_test.go
index a2850c98f4f..3a1c810ab43 100644
--- a/libs/apps/vite/validate_dir_test.go
+++ b/libs/apps/vite/validate_dir_test.go
@@ -7,7 +7,6 @@ import (
 	"os"
 	"path/filepath"
 	"testing"
-	"time"
 
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/databricks-sdk-go"
@@ -123,7 +122,7 @@ func TestBridgeHandleDirListRequest(t *testing.T) {
 		ctx := cmdio.MockDiscard(t.Context())
 		w := &databricks.WorkspaceClient{}
 
-		var lastMessage []byte
+		received := make(chan []byte, 1)
 		upgrader := websocket.Upgrader{}
 		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			conn, err := upgrader.Upgrade(w, r, nil)
@@ -138,7 +137,7 @@ func TestBridgeHandleDirListRequest(t *testing.T) {
 				t.Errorf("failed to read message: %v", err)
 				return
 			}
-			lastMessage = message
+			received <- message
 		}))
 		defer server.Close()
 
@@ -149,7 +148,7 @@ func TestBridgeHandleDirListRequest(t *testing.T) {
 		defer conn.Close()
 
 		vb := NewBridge(ctx, w, "test-app", 5173, false)
-		vb.tunnelConn = conn
+		vb.tunnelConn.Store(conn)
 
 		go func() { _ = vb.tunnelWriter(ctx) }()
 
@@ -162,10 +161,8 @@ func TestBridgeHandleDirListRequest(t *testing.T) {
 		err = vb.handleDirListRequest(msg)
 		require.NoError(t, err)
 
-		time.Sleep(100 * time.Millisecond)
-
 		var response BridgeMessage
-		err = json.Unmarshal(lastMessage, &response)
+		err = json.Unmarshal(waitForMessage(t, received), &response)
 		require.NoError(t, err)
 
 		assert.Equal(t, "dir:list:response", response.Type)
@@ -188,7 +185,7 @@ func TestBridgeHandleDirListRequest(t *testing.T) {
 		ctx := cmdio.MockDiscard(t.Context())
 		w := &databricks.WorkspaceClient{}
 
-		var lastMessage []byte
+		received := make(chan []byte, 1)
 		upgrader := websocket.Upgrader{}
 		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			conn, err := upgrader.Upgrade(w, r, nil)
@@ -203,7 +200,7 @@ func TestBridgeHandleDirListRequest(t *testing.T) {
 				t.Errorf("failed to read message: %v", err)
 				return
 			}
-			lastMessage = message
+			received <- message
 		}))
 		defer server.Close()
 
@@ -214,7 +211,7 @@ func TestBridgeHandleDirListRequest(t *testing.T) {
 		defer conn.Close()
 
 		vb := NewBridge(ctx, w, "test-app", 5173, false)
-		vb.tunnelConn = conn
+		vb.tunnelConn.Store(conn)
 
 		go func() { _ = vb.tunnelWriter(ctx) }()
 
@@ -227,10 +224,8 @@ func TestBridgeHandleDirListRequest(t *testing.T) {
 		err = vb.handleDirListRequest(msg)
 		require.NoError(t, err)
 
-		time.Sleep(100 * time.Millisecond)
-
 		var response BridgeMessage
-		err = json.Unmarshal(lastMessage, &response)
+		err = json.Unmarshal(waitForMessage(t, received), &response)
 		require.NoError(t, err)
 
 		assert.Equal(t, "dir:list:response", response.Type)
diff --git a/libs/atomicfile/atomicfile.go b/libs/atomicfile/atomicfile.go
new file mode 100644
index 00000000000..09cf5a4b139
--- /dev/null
+++ b/libs/atomicfile/atomicfile.go
@@ -0,0 +1,83 @@
+// Package atomicfile writes a file so that readers and crashes never observe a
+// partial result: the data goes to a temporary file in the same directory and
+// is then renamed over the destination. The rename is atomic on a single
+// filesystem, which is why the temp file must live next to the target rather
+// than in os.TempDir (a cross-filesystem rename fails with EXDEV).
+package atomicfile
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+)
+
+// Option configures a Write call.
+type Option func(*config)
+
+type config struct {
+	mkdirPerm os.FileMode
+	mkdir     bool
+}
+
+// MkDir makes Write create path's parent directory (and any missing parents)
+// with mode perm before writing, like os.MkdirAll. The directory mode is a
+// separate, deliberate choice from the file mode (e.g. 0o700 for a directory
+// holding secrets), so callers pass it explicitly rather than it defaulting.
+func MkDir(perm os.FileMode) Option {
+	return func(c *config) {
+		c.mkdir = true
+		c.mkdirPerm = perm
+	}
+}
+
+// Write atomically writes data to path with mode perm. It creates a temp file
+// in path's directory, writes and chmods it, then renames it over path.
+//
+// The resulting file always has mode perm; it does not inherit the permissions
+// of a file it replaces (os.CreateTemp starts at 0600, and the rename replaces
+// the inode, so callers state the mode they want explicitly). The parent
+// directory must already exist unless the MkDir option is passed.
+func Write(path string, data []byte, perm os.FileMode, opts ...Option) error {
+	var cfg config
+	for _, opt := range opts {
+		opt(&cfg)
+	}
+
+	dir := filepath.Dir(path)
+
+	if cfg.mkdir {
+		if err := os.MkdirAll(dir, cfg.mkdirPerm); err != nil {
+			return fmt.Errorf("create directory %s: %w", dir, err)
+		}
+	}
+
+	// Temp file in the same directory so the rename stays on one filesystem.
+	// The "." prefix hides a leftover temp file and the ".tmp" suffix lets
+	// callers sweep leftovers with a ".*.tmp" glob.
+	tmp, err := os.CreateTemp(dir, "."+filepath.Base(path)+".*.tmp")
+	if err != nil {
+		return fmt.Errorf("create temp file for %s: %w", path, err)
+	}
+	tmpPath := tmp.Name()
+
+	if _, err := tmp.Write(data); err != nil {
+		tmp.Close()
+		os.Remove(tmpPath)
+		return fmt.Errorf("write %s: %w", tmpPath, err)
+	}
+	if err := tmp.Chmod(perm); err != nil {
+		tmp.Close()
+		os.Remove(tmpPath)
+		return fmt.Errorf("chmod %s: %w", tmpPath, err)
+	}
+	// Close before the rename: on Windows the file must not be open.
+	if err := tmp.Close(); err != nil {
+		os.Remove(tmpPath)
+		return fmt.Errorf("close %s: %w", tmpPath, err)
+	}
+	if err := os.Rename(tmpPath, path); err != nil {
+		os.Remove(tmpPath)
+		return fmt.Errorf("rename %s to %s: %w", tmpPath, path, err)
+	}
+	return nil
+}
diff --git a/libs/atomicfile/atomicfile_test.go b/libs/atomicfile/atomicfile_test.go
new file mode 100644
index 00000000000..59bbfac5676
--- /dev/null
+++ b/libs/atomicfile/atomicfile_test.go
@@ -0,0 +1,143 @@
+package atomicfile
+
+import (
+	"os"
+	"path/filepath"
+	"runtime"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestWriteCreatesFile(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "out.json")
+
+	require.NoError(t, Write(path, []byte("hello"), 0o600))
+
+	got, err := os.ReadFile(path)
+	require.NoError(t, err)
+	assert.Equal(t, "hello", string(got))
+}
+
+func TestWriteUsesGivenMode(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("Windows does not honor unix file modes")
+	}
+	path := filepath.Join(t.TempDir(), "out")
+
+	require.NoError(t, Write(path, []byte("x"), 0o644))
+
+	info, err := os.Stat(path)
+	require.NoError(t, err)
+	assert.Equal(t, os.FileMode(0o644), info.Mode().Perm())
+}
+
+func TestWriteDoesNotPreserveReplacedMode(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("Windows does not honor unix file modes")
+	}
+	path := filepath.Join(t.TempDir(), "out")
+	require.NoError(t, os.WriteFile(path, []byte("old"), 0o600))
+
+	// Replacing a 0600 file with perm 0644 yields 0644, not the old mode.
+	require.NoError(t, Write(path, []byte("new"), 0o644))
+
+	info, err := os.Stat(path)
+	require.NoError(t, err)
+	assert.Equal(t, os.FileMode(0o644), info.Mode().Perm())
+}
+
+func TestWriteOverwrites(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "out")
+	require.NoError(t, os.WriteFile(path, []byte("old contents"), 0o600))
+
+	require.NoError(t, Write(path, []byte("new"), 0o600))
+
+	got, err := os.ReadFile(path)
+	require.NoError(t, err)
+	assert.Equal(t, "new", string(got))
+}
+
+func TestWriteLeavesNoTempFile(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "out")
+
+	require.NoError(t, Write(path, []byte("x"), 0o600))
+
+	entries, err := os.ReadDir(dir)
+	require.NoError(t, err)
+	require.Len(t, entries, 1)
+	assert.Equal(t, "out", entries[0].Name())
+}
+
+func TestWriteMissingDir(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "no-such-dir", "out")
+
+	err := Write(path, []byte("x"), 0o600)
+	require.Error(t, err)
+
+	// The failure must not leave the target behind.
+	_, statErr := os.Stat(path)
+	assert.ErrorIs(t, statErr, os.ErrNotExist)
+}
+
+func TestWriteMkDirCreatesParents(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "a", "b", "out")
+
+	require.NoError(t, Write(path, []byte("x"), 0o600, MkDir(0o700)))
+
+	got, err := os.ReadFile(path)
+	require.NoError(t, err)
+	assert.Equal(t, "x", string(got))
+
+	if runtime.GOOS != "windows" {
+		info, err := os.Stat(filepath.Dir(path))
+		require.NoError(t, err)
+		assert.Equal(t, os.FileMode(0o700), info.Mode().Perm())
+	}
+}
+
+// MkDir wraps os.MkdirAll, which is a no-op on a directory that already exists
+// and never changes its mode. These two cases pin that down: whether the
+// requested mode matches the existing directory or not, the directory keeps the
+// mode it already had and the write still succeeds.
+func TestWriteMkDirExistingDirSameMode(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("Windows does not honor unix directory modes")
+	}
+	dir := t.TempDir()
+	require.NoError(t, os.Chmod(dir, 0o700))
+	path := filepath.Join(dir, "out")
+
+	require.NoError(t, Write(path, []byte("x"), 0o600, MkDir(0o700)))
+
+	got, err := os.ReadFile(path)
+	require.NoError(t, err)
+	assert.Equal(t, "x", string(got))
+
+	info, err := os.Stat(dir)
+	require.NoError(t, err)
+	assert.Equal(t, os.FileMode(0o700), info.Mode().Perm())
+}
+
+func TestWriteMkDirExistingDirDifferentMode(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("Windows does not honor unix directory modes")
+	}
+	dir := t.TempDir()
+	require.NoError(t, os.Chmod(dir, 0o700))
+	path := filepath.Join(dir, "out")
+
+	// Ask for 0o755 even though the directory already exists at 0o700.
+	require.NoError(t, Write(path, []byte("x"), 0o600, MkDir(0o755)))
+
+	got, err := os.ReadFile(path)
+	require.NoError(t, err)
+	assert.Equal(t, "x", string(got))
+
+	// The existing directory keeps 0o700; MkDir does not widen it to 0o755.
+	info, err := os.Stat(dir)
+	require.NoError(t, err)
+	assert.Equal(t, os.FileMode(0o700), info.Mode().Perm())
+}
diff --git a/libs/auth/arguments.go b/libs/auth/arguments.go
index d18d7058cd8..cfd1ec1927d 100644
--- a/libs/auth/arguments.go
+++ b/libs/auth/arguments.go
@@ -1,14 +1,11 @@
 package auth
 
 import (
+	"github.com/databricks/cli/libs/auth/u2m"
+	"github.com/databricks/cli/libs/databrickscfg/profile"
 	"github.com/databricks/databricks-sdk-go/config"
-	"github.com/databricks/databricks-sdk-go/credentials/u2m"
 )
 
-// WorkspaceIDNone is a sentinel value persisted to .databrickscfg when the
-// user explicitly skips workspace selection for SPOG account-level access.
-const WorkspaceIDNone = "none"
-
 // AuthArguments is a struct that contains the common arguments passed to
 // `databricks auth` commands.
 type AuthArguments struct {
@@ -31,7 +28,7 @@ type AuthArguments struct {
 func (a AuthArguments) ToOAuthArgument() (u2m.OAuthArgument, error) {
 	// Strip the "none" sentinel so it is never passed to the SDK.
 	workspaceID := a.WorkspaceID
-	if workspaceID == WorkspaceIDNone {
+	if workspaceID == profile.WorkspaceIDNone {
 		workspaceID = ""
 	}
 
diff --git a/libs/auth/arguments_test.go b/libs/auth/arguments_test.go
index 6aeb16e22be..873ce557dfe 100644
--- a/libs/auth/arguments_test.go
+++ b/libs/auth/arguments_test.go
@@ -6,7 +6,7 @@ import (
 	"net/http/httptest"
 	"testing"
 
-	"github.com/databricks/databricks-sdk-go/credentials/u2m"
+	"github.com/databricks/cli/libs/auth/u2m"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
diff --git a/libs/auth/config_type.go b/libs/auth/config_type.go
index 0d93b1bf075..d9417971feb 100644
--- a/libs/auth/config_type.go
+++ b/libs/auth/config_type.go
@@ -3,6 +3,7 @@ package auth
 import (
 	"strings"
 
+	"github.com/databricks/cli/libs/databrickscfg/profile"
 	"github.com/databricks/databricks-sdk-go/config"
 )
 
@@ -54,7 +55,7 @@ func ResolveConfigType(cfg *config.Config) config.ConfigType {
 		return configType
 	}
 
-	if cfg.WorkspaceID != "" && cfg.WorkspaceID != WorkspaceIDNone {
+	if cfg.WorkspaceID != "" && cfg.WorkspaceID != profile.WorkspaceIDNone {
 		return config.WorkspaceConfig
 	}
 	return config.AccountConfig
diff --git a/libs/auth/credentials.go b/libs/auth/credentials.go
index ddc95d96021..98278fb53ef 100644
--- a/libs/auth/credentials.go
+++ b/libs/auth/credentials.go
@@ -5,11 +5,11 @@ import (
 	"errors"
 
 	"github.com/databricks/cli/libs/auth/storage"
+	"github.com/databricks/cli/libs/auth/u2m"
 	"github.com/databricks/databricks-sdk-go/config"
 	"github.com/databricks/databricks-sdk-go/config/credentials"
 	"github.com/databricks/databricks-sdk-go/config/experimental/auth"
 	"github.com/databricks/databricks-sdk-go/config/experimental/auth/authconv"
-	"github.com/databricks/databricks-sdk-go/credentials/u2m"
 )
 
 // The credentials chain used by the CLI. It is a custom implementation
@@ -98,19 +98,21 @@ func (c CLICredentials) Configure(ctx context.Context, cfg *config.Config) (cred
 	if err != nil {
 		return nil, err
 	}
-	// Without WithTokenCache, u2m.NewPersistentAuth falls back to the SDK's
-	// default file cache. For secure-storage users that would split tokens
-	// across two backends: login writes to the keyring, but every workspace
-	// client built through this strategy would read an empty file cache and
-	// fail with "cache: token not found".
-	tokenCache, _, err := storage.ResolveCache(ctx, "")
+	// Without WithTokenStore, u2m.NewPersistentAuth falls back to an in-memory
+	// store. Every workspace client built through this strategy would then miss
+	// the token persisted by login and fail with "cache: token not found".
+	tokenStore, mode, err := storage.ResolveStore(ctx, "")
 	if err != nil {
 		return nil, err
 	}
-	ts, err := c.persistentAuth(ctx,
+	opts := []u2m.PersistentAuthOption{
 		u2m.WithOAuthArgument(oauthArg),
-		u2m.WithTokenCache(tokenCache),
-	)
+		u2m.WithTokenStore(storage.OAuthTokenStore(ctx, tokenStore, mode)),
+	}
+	if cfg.AuthType == c.Name() && cfg.ClientID != "" {
+		opts = append(opts, u2m.WithClientID(cfg.ClientID))
+	}
+	ts, err := c.persistentAuth(ctx, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -123,8 +125,8 @@ func (c CLICredentials) Configure(ctx context.Context, cfg *config.Config) (cred
 // persistentAuth returns a token source. It is a convenience function that
 // overrides the default implementation of the persistent auth client if
 // an alternative implementation is provided for testing. The caller is
-// responsible for supplying the token cache via u2m.WithTokenCache; Configure
-// does this via storage.ResolveCache so login, refresh, and all workspace
+// responsible for supplying the token store via u2m.WithTokenStore; Configure
+// does this via storage.ResolveStore so login, refresh, and all workspace
 // clients share the same backend.
 func (c CLICredentials) persistentAuth(ctx context.Context, opts ...u2m.PersistentAuthOption) (auth.TokenSource, error) {
 	if c.persistentAuthFn != nil {
diff --git a/libs/auth/credentials_test.go b/libs/auth/credentials_test.go
index 20c55e4d056..2802c9b4279 100644
--- a/libs/auth/credentials_test.go
+++ b/libs/auth/credentials_test.go
@@ -10,16 +10,16 @@ import (
 	"testing"
 
 	"github.com/databricks/cli/libs/auth/storage"
+	"github.com/databricks/cli/libs/auth/u2m"
 	"github.com/databricks/databricks-sdk-go/config"
 	"github.com/databricks/databricks-sdk-go/config/experimental/auth"
-	"github.com/databricks/databricks-sdk-go/credentials/u2m"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/oauth2"
 )
 
 // hermeticAuthStorage isolates the test from the caller's real env vars and
-// .databrickscfg so storage.ResolveCache sees a clean default.
+// .databrickscfg so storage.ResolveStore sees a clean default.
 func hermeticAuthStorage(t *testing.T) {
 	t.Helper()
 	t.Setenv(storage.EnvVar, "")
@@ -205,12 +205,11 @@ func TestCLICredentialsConfigure(t *testing.T) {
 	}
 }
 
-// TestCLICredentialsConfigure_ThreadsResolvedTokenCache guards against a
-// regression where Configure forgot to pass u2m.WithTokenCache. Without it,
-// the SDK's NewPersistentAuth silently defaulted to the file cache, so users
-// who opted into secure storage saw "cache: token not found" on every command
-// other than auth login/token/logout.
-func TestCLICredentialsConfigure_ThreadsResolvedTokenCache(t *testing.T) {
+// TestCLICredentialsConfigure_ThreadsResolvedTokenStore guards against a
+// regression where Configure forgot to pass u2m.WithTokenStore. Without it,
+// NewPersistentAuth defaults to an in-memory store, so it cannot see the token
+// persisted by auth login.
+func TestCLICredentialsConfigure_ThreadsResolvedTokenStore(t *testing.T) {
 	hermeticAuthStorage(t)
 
 	var receivedOpts []u2m.PersistentAuthOption
@@ -226,16 +225,81 @@ func TestCLICredentialsConfigure_ThreadsResolvedTokenCache(t *testing.T) {
 	_, err := c.Configure(t.Context(), &config.Config{Host: "https://x.cloud.databricks.com"})
 	require.NoError(t, err)
 
-	// Two opts expected: WithOAuthArgument and WithTokenCache. The length
+	// Two opts expected: WithOAuthArgument and WithTokenStore. The length
 	// check is the most resilient way to assert both were passed without
 	// poking at u2m's unexported state.
 	assert.Len(t, receivedOpts, 2)
 }
 
+func TestCLICredentialsConfigure_ClientID(t *testing.T) {
+	tests := []struct {
+		name     string
+		authType string
+		source   config.SourceType
+		wantOpts int
+	}{
+		{
+			name:     "U2M config file client ID",
+			authType: "databricks-cli",
+			source:   config.SourceFile,
+			wantOpts: 3,
+		},
+		{
+			name:     "U2M environment client ID",
+			authType: "databricks-cli",
+			source:   config.SourceEnv,
+			wantOpts: 3,
+		},
+		{
+			name:     "U2M dynamic client ID",
+			authType: "databricks-cli",
+			source:   config.SourceDynamicConfig,
+			wantOpts: 3,
+		},
+		{
+			name:     "non-U2M config file client ID",
+			authType: "oauth-m2m",
+			source:   config.SourceFile,
+			wantOpts: 2,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			hermeticAuthStorage(t)
+			cfg := &config.Config{
+				Host:     "https://workspace.test",
+				AuthType: tt.authType,
+				ClientID: "custom-client-id",
+			}
+			for i := range config.ConfigAttributes {
+				if config.ConfigAttributes[i].Name == "client_id" {
+					cfg.SetAttrSource(&config.ConfigAttributes[i], config.Source{Type: tt.source})
+					break
+				}
+			}
+
+			var receivedOpts []u2m.PersistentAuthOption
+			c := CLICredentials{
+				persistentAuthFn: func(_ context.Context, opts ...u2m.PersistentAuthOption) (auth.TokenSource, error) {
+					receivedOpts = opts
+					return auth.TokenSourceFn(func(_ context.Context) (*oauth2.Token, error) {
+						return &oauth2.Token{AccessToken: "tok"}, nil
+					}), nil
+				},
+			}
+
+			_, err := c.Configure(t.Context(), cfg)
+			require.NoError(t, err)
+			assert.Len(t, receivedOpts, tt.wantOpts)
+		})
+	}
+}
+
 // TestCLICredentialsConfigure_PropagatesStorageResolutionError confirms
 // Configure surfaces invalid DATABRICKS_AUTH_STORAGE values instead of
 // silently falling back to the file cache. If Configure ever stops calling
-// storage.ResolveCache, this test will catch it.
+// storage.ResolveStore, this test will catch it.
 func TestCLICredentialsConfigure_PropagatesStorageResolutionError(t *testing.T) {
 	hermeticAuthStorage(t)
 	t.Setenv(storage.EnvVar, "bogus")
diff --git a/libs/auth/error.go b/libs/auth/error.go
index 2ca8aa5f800..fdb5f256f43 100644
--- a/libs/auth/error.go
+++ b/libs/auth/error.go
@@ -7,9 +7,9 @@ import (
 	"net/http"
 	"strings"
 
+	"github.com/databricks/cli/libs/auth/u2m"
 	"github.com/databricks/databricks-sdk-go/apierr"
 	"github.com/databricks/databricks-sdk-go/config"
-	"github.com/databricks/databricks-sdk-go/credentials/u2m"
 )
 
 // Auth type names returned by credential providers.
@@ -51,21 +51,33 @@ func AuthTypeDisplayName(authType string) string {
 	return authType
 }
 
+type rewrittenAuthError struct {
+	message string
+	cause   error
+}
+
+func (e *rewrittenAuthError) Error() string {
+	return e.message
+}
+
+func (e *rewrittenAuthError) Unwrap() error {
+	return e.cause
+}
+
 // RewriteAuthError rewrites the error message for invalid refresh token error.
 // It returns whether the error was rewritten and the rewritten error.
 func RewriteAuthError(ctx context.Context, host, accountId, profile string, err error) (bool, error) {
-	target := &u2m.InvalidRefreshTokenError{}
-	if errors.As(err, &target) {
-		oauthArgument, err := AuthArguments{
+	if _, ok := errors.AsType[*u2m.InvalidRefreshTokenError](err); ok {
+		oauthArgument, argErr := AuthArguments{
 			Host:      host,
 			AccountID: accountId,
 		}.ToOAuthArgument()
-		if err != nil {
-			return false, err
+		if argErr != nil {
+			return false, argErr
 		}
 		msg := `A new access token could not be retrieved because the refresh token is invalid. To reauthenticate, run the following command:
   $ ` + BuildLoginCommand(ctx, profile, oauthArgument)
-		return true, errors.New(msg)
+		return true, &rewrittenAuthError{message: msg, cause: err}
 	}
 	return false, err
 }
@@ -73,8 +85,8 @@ func RewriteAuthError(ctx context.Context, host, accountId, profile string, err
 // EnrichAuthError appends identity context and remediation steps to 401/403 API errors.
 // For non-API errors or other status codes, the original error is returned unchanged.
 func EnrichAuthError(ctx context.Context, cfg *config.Config, err error) error {
-	var apiErr *apierr.APIError
-	if !errors.As(err, &apiErr) {
+	apiErr, ok := errors.AsType[*apierr.APIError](err)
+	if !ok {
 		return err
 	}
 	if apiErr.StatusCode != http.StatusUnauthorized && apiErr.StatusCode != http.StatusForbidden {
@@ -113,6 +125,27 @@ func EnrichAuthError(ctx context.Context, cfg *config.Config, err error) error {
 	return fmt.Errorf("%w\n%s", err, b.String())
 }
 
+// AppendAccountHostHint appends a note to errors from commands that ran with a
+// workspace client configured against a classic account console host. Such
+// hosts serve only account-level APIs, so a workspace command can never
+// succeed there and the note is relevant for any error. The console's
+// responses to workspace API paths are unstructured (HTML pages, bare-string
+// 400s), so there is no reliable way to detect "this API is not served here"
+// from the error itself; callers gate on the command type instead.
+func AppendAccountHostHint(cfg *config.Config, err error) error {
+	host := cfg.CanonicalHostName()
+	if !IsClassicAccountHost(host) {
+		return err
+	}
+	subject := "this configuration"
+	scope := ""
+	if cfg.Profile != "" {
+		subject = fmt.Sprintf("profile %q", cfg.Profile)
+		scope = " with this profile"
+	}
+	return fmt.Errorf("%w\n\nNote: %s points to a Databricks account console host (%s), which serves only account-level APIs.\nWorkspace commands need a workspace host: run `databricks auth login --host https://<workspace-url>`, or use `databricks account ...` commands%s", err, subject, host, scope)
+}
+
 // writeReauthSteps writes auth-type-aware re-authentication suggestions for 401 errors.
 func writeReauthSteps(ctx context.Context, cfg *config.Config, b *strings.Builder) {
 	switch strings.ToLower(cfg.AuthType) {
diff --git a/libs/auth/error_test.go b/libs/auth/error_test.go
index 1e724a4b251..ce8f0df1b63 100644
--- a/libs/auth/error_test.go
+++ b/libs/auth/error_test.go
@@ -2,6 +2,7 @@ package auth
 
 import (
 	"errors"
+	"strings"
 	"testing"
 
 	"github.com/databricks/databricks-sdk-go/apierr"
@@ -260,3 +261,67 @@ func TestEnrichAuthError(t *testing.T) {
 		})
 	}
 }
+
+func TestAppendAccountHostHint(t *testing.T) {
+	tests := []struct {
+		name string
+		cfg  *config.Config
+		want string
+	}{
+		{
+			name: "account console host with profile",
+			cfg:  &config.Config{Host: "https://accounts.test", Profile: "acc"},
+			want: "base error\n\n" +
+				"Note: profile \"acc\" points to a Databricks account console host (https://accounts.test), which serves only account-level APIs.\n" +
+				"Workspace commands need a workspace host: run `databricks auth login --host https://<workspace-url>`, or use `databricks account ...` commands with this profile",
+		},
+		{
+			name: "account console host without profile",
+			cfg:  &config.Config{Host: "https://accounts.test"},
+			want: "base error\n\n" +
+				"Note: this configuration points to a Databricks account console host (https://accounts.test), which serves only account-level APIs.\n" +
+				"Workspace commands need a workspace host: run `databricks auth login --host https://<workspace-url>`, or use `databricks account ...` commands",
+		},
+		{
+			name: "workspace host is left unchanged",
+			cfg:  &config.Config{Host: "https://adb-123.test", Profile: "ws"},
+			want: "base error",
+		},
+		{
+			name: "empty host is left unchanged",
+			cfg:  &config.Config{},
+			want: "base error",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := AppendAccountHostHint(tt.cfg, errors.New("base error"))
+			assert.Equal(t, tt.want, result.Error())
+		})
+	}
+}
+
+func TestAppendAccountHostHintPreservesErrorChain(t *testing.T) {
+	cfg := &config.Config{Host: "https://accounts.test", Profile: "acc"}
+	original := &apierr.APIError{StatusCode: 400, Message: "Unable to load OAuth Config"}
+
+	result := AppendAccountHostHint(cfg, original)
+
+	var unwrapped *apierr.APIError
+	require.ErrorAs(t, result, &unwrapped)
+	assert.Equal(t, 400, unwrapped.StatusCode)
+}
+
+func TestAppendAccountHostHintComposesWithEnrichAuthError(t *testing.T) {
+	cfg := &config.Config{Host: "https://accounts.test", Profile: "acc", AuthType: AuthTypePat}
+	original := &apierr.APIError{StatusCode: 403, Message: "permission denied"}
+
+	// Same composition order as cmd/root.Execute: enrichment first, hint last.
+	result := AppendAccountHostHint(cfg, EnrichAuthError(t.Context(), cfg, original))
+
+	msg := result.Error()
+	assert.Contains(t, msg, "permission denied")
+	assert.Contains(t, msg, "Next steps:")
+	assert.Contains(t, msg, "Note: profile \"acc\" points to a Databricks account console host")
+	assert.Less(t, strings.Index(msg, "Next steps:"), strings.Index(msg, "Note:"))
+}
diff --git a/libs/auth/headers.go b/libs/auth/headers.go
new file mode 100644
index 00000000000..a712f2bf537
--- /dev/null
+++ b/libs/auth/headers.go
@@ -0,0 +1,32 @@
+package auth
+
+import (
+	"github.com/databricks/cli/libs/databrickscfg/profile"
+	sdkconfig "github.com/databricks/databricks-sdk-go/config"
+)
+
+// WorkspaceIDHeader is the request header name used to route workspace-scoped
+// API calls to the correct workspace on unified ("SPOG") hosts. The platform
+// gateway also accepts the legacy X-Databricks-Org-Id header for rollback
+// safety. Generated SDK service methods set this header per-call when
+// cfg.WorkspaceID is populated; CLI code paths that call client.Do directly
+// need to set it themselves.
+const WorkspaceIDHeader = "X-Databricks-Workspace-Id"
+
+// WorkspaceIDHeaders returns a map suitable as the headers argument to
+// client.DatabricksClient.Do, populated with the workspace routing header
+// when cfg.WorkspaceID is set. Returns nil when the workspace ID is unset
+// or holds the CLI-only "none" sentinel, so callers can pass the result
+// through without conditional checks.
+func WorkspaceIDHeaders(cfg *sdkconfig.Config) map[string]string {
+	if cfg == nil {
+		return nil
+	}
+	wsID := cfg.WorkspaceID
+	if wsID == "" || wsID == profile.WorkspaceIDNone {
+		return nil
+	}
+	return map[string]string{
+		WorkspaceIDHeader: wsID,
+	}
+}
diff --git a/libs/auth/headers_test.go b/libs/auth/headers_test.go
new file mode 100644
index 00000000000..5ca31dc7d30
--- /dev/null
+++ b/libs/auth/headers_test.go
@@ -0,0 +1,50 @@
+package auth_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/auth"
+	"github.com/databricks/cli/libs/databrickscfg/profile"
+	sdkconfig "github.com/databricks/databricks-sdk-go/config"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestWorkspaceIDHeaders(t *testing.T) {
+	tests := []struct {
+		name string
+		cfg  *sdkconfig.Config
+		want map[string]string
+	}{
+		{
+			name: "configured numeric workspace ID",
+			cfg:  &sdkconfig.Config{WorkspaceID: "12345"},
+			want: map[string]string{"X-Databricks-Workspace-Id": "12345"},
+		},
+		{
+			name: "configured connection-id-style workspace ID",
+			cfg:  &sdkconfig.Config{WorkspaceID: "123e4567-e89b-12d3-a456-426614174000"},
+			want: map[string]string{"X-Databricks-Workspace-Id": "123e4567-e89b-12d3-a456-426614174000"},
+		},
+		{
+			name: "empty workspace ID returns nil",
+			cfg:  &sdkconfig.Config{WorkspaceID: ""},
+			want: nil,
+		},
+		{
+			name: `"none" sentinel returns nil`,
+			cfg:  &sdkconfig.Config{WorkspaceID: profile.WorkspaceIDNone},
+			want: nil,
+		},
+		{
+			name: "nil config returns nil",
+			cfg:  nil,
+			want: nil,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, auth.WorkspaceIDHeaders(tt.cfg))
+		})
+	}
+}
diff --git a/libs/auth/host_env.go b/libs/auth/host_env.go
new file mode 100644
index 00000000000..23326e0269f
--- /dev/null
+++ b/libs/auth/host_env.go
@@ -0,0 +1,52 @@
+package auth
+
+import (
+	"context"
+
+	"github.com/databricks/cli/libs/env"
+	sdkconfig "github.com/databricks/databricks-sdk-go/config"
+)
+
+// SPOG URLs from the Databricks UI carry the workspace ID as a ?o= query
+// parameter and the account ID as ?a=, e.g.
+// https://acme.databricks.net/?o=12345. The SDK strips path and query from
+// Host in fixHostIfNeeded without extracting these IDs, so a DATABRICKS_HOST
+// env var with such a URL drops the workspace identifier and API calls hit
+// the SPOG without an X-Databricks-Org-Id header, which the server answers
+// with HTML (a login page) instead of JSON.
+//
+// TODO: stopgap. The matching SDK fix is databricks/databricks-sdk-go#1699,
+// which handles ?o=/?a= directly in fixHostIfNeeded. Delete this helper on
+// the next SDK bump that includes that change.
+
+// NormalizeDatabricksConfigFromEnv promotes ?o=/?workspace_id= and
+// ?a=/?account_id= query parameters from the DATABRICKS_HOST env var into
+// the matching fields on cfg, and sets cfg.Host to the stripped URL. It
+// does not mutate process env, so the effect is scoped to the SDK config
+// built from this cfg (and any subprocess env derived from it via
+// auth.Env).
+//
+// Only fills in empty fields. If cfg.Host is already set, the query
+// params aren't promoted at all (an explicit host takes priority). If a
+// dedicated env var (DATABRICKS_WORKSPACE_ID, DATABRICKS_ACCOUNT_ID) is
+// set, that more explicit signal wins over the query param.
+func NormalizeDatabricksConfigFromEnv(ctx context.Context, cfg *sdkconfig.Config) {
+	if cfg.Host != "" {
+		return
+	}
+	host, ok := env.Lookup(ctx, "DATABRICKS_HOST")
+	if !ok || host == "" {
+		return
+	}
+	params := ExtractHostQueryParams(host)
+	if params.Host == host {
+		return
+	}
+	cfg.Host = params.Host
+	if cfg.WorkspaceID == "" && params.WorkspaceID != "" && env.Get(ctx, "DATABRICKS_WORKSPACE_ID") == "" {
+		cfg.WorkspaceID = params.WorkspaceID
+	}
+	if cfg.AccountID == "" && params.AccountID != "" && env.Get(ctx, "DATABRICKS_ACCOUNT_ID") == "" {
+		cfg.AccountID = params.AccountID
+	}
+}
diff --git a/libs/auth/host_env_test.go b/libs/auth/host_env_test.go
new file mode 100644
index 00000000000..152f4d22d47
--- /dev/null
+++ b/libs/auth/host_env_test.go
@@ -0,0 +1,76 @@
+package auth
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/env"
+	sdkconfig "github.com/databricks/databricks-sdk-go/config"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestNormalizeDatabricksConfigFromEnv(t *testing.T) {
+	tests := []struct {
+		name            string
+		host            string
+		envWorkspaceID  string
+		envAccountID    string
+		cfgInHost       string
+		wantHost        string
+		wantWorkspaceID string
+		wantAccountID   string
+	}{
+		{
+			name:            "spog url promotes workspace id",
+			host:            "https://acme.databricks.net/?o=12345",
+			wantHost:        "https://acme.databricks.net",
+			wantWorkspaceID: "12345",
+		},
+		{
+			name:            "spog url with account id",
+			host:            "https://acme.databricks.net/?a=abc&o=12345",
+			wantHost:        "https://acme.databricks.net",
+			wantWorkspaceID: "12345",
+			wantAccountID:   "abc",
+		},
+		{
+			name: "host without query is a no-op",
+			host: "https://acme.databricks.net",
+		},
+		{
+			name:            "env workspace id wins over query param",
+			host:            "https://acme.databricks.net/?o=12345",
+			envWorkspaceID:  "99999",
+			wantHost:        "https://acme.databricks.net",
+			wantWorkspaceID: "",
+		},
+		{
+			name:      "cfg host already set leaves env alone",
+			host:      "https://other.databricks.net/?o=12345",
+			cfgInHost: "https://acme.databricks.net",
+			wantHost:  "https://acme.databricks.net",
+		},
+		{
+			name: "no host env is a no-op",
+		},
+		{
+			name:     "non-numeric o is dropped, host trailing slash trimmed",
+			host:     "https://acme.databricks.net/?o=notanumber",
+			wantHost: "https://acme.databricks.net",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := env.Set(t.Context(), "DATABRICKS_HOST", tt.host)
+			ctx = env.Set(ctx, "DATABRICKS_WORKSPACE_ID", tt.envWorkspaceID)
+			ctx = env.Set(ctx, "DATABRICKS_ACCOUNT_ID", tt.envAccountID)
+
+			cfg := &sdkconfig.Config{Host: tt.cfgInHost}
+			NormalizeDatabricksConfigFromEnv(ctx, cfg)
+
+			assert.Equal(t, tt.wantHost, cfg.Host)
+			assert.Equal(t, tt.wantWorkspaceID, cfg.WorkspaceID)
+			assert.Equal(t, tt.wantAccountID, cfg.AccountID)
+		})
+	}
+}
diff --git a/libs/auth/hostparams.go b/libs/auth/hostparams.go
index f363cfa5a35..103d2834dcb 100644
--- a/libs/auth/hostparams.go
+++ b/libs/auth/hostparams.go
@@ -11,8 +11,10 @@ type HostParams struct {
 	// Host is the URL with query parameters stripped.
 	Host string
 
-	// WorkspaceID extracted from ?o= or ?workspace_id=.
-	// Empty if not present or not numeric.
+	// WorkspaceID extracted from ?o=, ?w=, or ?workspace_id=.
+	// Empty if not present. ?o= and ?workspace_id= are legacy spellings that
+	// remain numeric-only; ?w= is the new spelling and is passed through
+	// unchanged so non-numeric connection-style identifiers reach the server.
 	WorkspaceID string
 
 	// AccountID extracted from ?a= or ?account_id=.
@@ -21,9 +23,15 @@ type HostParams struct {
 }
 
 // ExtractHostQueryParams parses recognized query parameters from a host URL.
-// Recognized parameters: o (workspace_id), workspace_id, a (account_id), account_id.
-// Workspace IDs must be numeric; non-numeric values are ignored.
-// The returned Host has all query parameters and fragments stripped.
+// Recognized parameters: o (workspace_id), w (workspace_id), workspace_id,
+// a (account_id), account_id. The "w" spelling matches the new
+// X-Databricks-Workspace-Id routing header and accepts any non-empty value
+// (including non-numeric connection-style identifiers). The legacy "o" and
+// "workspace_id" spellings remain numeric-only — they predate the broader
+// identifier shapes and historical URLs carrying those forms are always
+// numeric. When more than one spelling is present, "o" wins to preserve the
+// meaning of existing URLs. The returned Host has all query parameters and
+// fragments stripped.
 func ExtractHostQueryParams(host string) HostParams {
 	u, err := url.Parse(host)
 	if err != nil || u.RawQuery == "" {
@@ -37,6 +45,8 @@ func ExtractHostQueryParams(host string) HostParams {
 		if _, err := strconv.ParseInt(v, 10, 64); err == nil {
 			workspaceID = v
 		}
+	} else if v := q.Get("w"); v != "" {
+		workspaceID = v
 	} else if v := q.Get("workspace_id"); v != "" {
 		if _, err := strconv.ParseInt(v, 10, 64); err == nil {
 			workspaceID = v
diff --git a/libs/auth/hostparams_test.go b/libs/auth/hostparams_test.go
index 900c69fb92d..5fe43a3045a 100644
--- a/libs/auth/hostparams_test.go
+++ b/libs/auth/hostparams_test.go
@@ -27,26 +27,51 @@ func TestExtractHostQueryParams(t *testing.T) {
 			host: "https://spog.example.com/?account_id=abc",
 			want: HostParams{Host: "https://spog.example.com", AccountID: "abc"},
 		},
+		{
+			name: "extract workspace_id from ?w=",
+			host: "https://spog.example.com/?w=12345",
+			want: HostParams{Host: "https://spog.example.com", WorkspaceID: "12345"},
+		},
 		{
 			name: "extract workspace_id from ?workspace_id=",
 			host: "https://spog.example.com/?workspace_id=99999",
 			want: HostParams{Host: "https://spog.example.com", WorkspaceID: "99999"},
 		},
+		{
+			name: "?o= wins over ?w= when both present",
+			host: "https://spog.example.com/?o=11111&w=22222",
+			want: HostParams{Host: "https://spog.example.com", WorkspaceID: "11111"},
+		},
+		{
+			name: "?w= wins over ?workspace_id= when both present",
+			host: "https://spog.example.com/?w=11111&workspace_id=22222",
+			want: HostParams{Host: "https://spog.example.com", WorkspaceID: "11111"},
+		},
 		{
 			name: "no query params leaves host unchanged",
 			host: "https://spog.example.com",
 			want: HostParams{Host: "https://spog.example.com"},
 		},
 		{
-			name: "non-numeric ?o= is skipped",
+			name: "non-numeric ?o= is skipped (legacy spelling stays numeric-only)",
 			host: "https://spog.example.com/?o=abc",
 			want: HostParams{Host: "https://spog.example.com"},
 		},
 		{
-			name: "non-numeric ?workspace_id= is skipped",
+			name: "non-numeric ?w= is passed through",
+			host: "https://spog.example.com/?w=abc",
+			want: HostParams{Host: "https://spog.example.com", WorkspaceID: "abc"},
+		},
+		{
+			name: "non-numeric ?workspace_id= is skipped (legacy spelling stays numeric-only)",
 			host: "https://spog.example.com/?workspace_id=abc",
 			want: HostParams{Host: "https://spog.example.com"},
 		},
+		{
+			name: "connection-id-style ?w= value passed through",
+			host: "https://spog.example.com/?w=123e4567-e89b-12d3-a456-426614174000",
+			want: HostParams{Host: "https://spog.example.com", WorkspaceID: "123e4567-e89b-12d3-a456-426614174000"},
+		},
 		{
 			name: "invalid URL is left unchanged",
 			host: "not a valid url ://???",
diff --git a/libs/auth/introspect.go b/libs/auth/introspect.go
index 65588010143..f6adb417dba 100644
--- a/libs/auth/introspect.go
+++ b/libs/auth/introspect.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"io"
 	"net/http"
 	"strconv"
 	"strings"
@@ -49,8 +48,6 @@ func IntrospectToken(ctx context.Context, host, accessToken string, httpClient *
 	defer resp.Body.Close()
 
 	if resp.StatusCode != http.StatusOK {
-		// Drain the body so the underlying TCP connection can be reused.
-		_, _ = io.Copy(io.Discard, resp.Body)
 		return nil, fmt.Errorf("introspection endpoint returned status %d", resp.StatusCode)
 	}
 
diff --git a/libs/auth/storage/cache.go b/libs/auth/storage/cache.go
index 151646081d3..f121143a7f2 100644
--- a/libs/auth/storage/cache.go
+++ b/libs/auth/storage/cache.go
@@ -2,60 +2,107 @@ package storage
 
 import (
 	"context"
+	"errors"
 	"fmt"
 
-	"github.com/databricks/databricks-sdk-go/credentials/u2m"
-	"github.com/databricks/databricks-sdk-go/credentials/u2m/cache"
+	"github.com/databricks/cli/libs/databrickscfg"
+	"github.com/databricks/cli/libs/env"
+	"github.com/databricks/cli/libs/log"
 )
 
-// cacheFactories bundles the constructors ResolveCache depends on. Extracted
+// storeFactories bundles the constructors ResolveStore depends on. Extracted
 // so unit tests can inject stubs without hitting the real OS keyring or
-// filesystem. Production code uses defaultCacheFactories().
-type cacheFactories struct {
-	newFile    func(context.Context) (cache.TokenCache, error)
-	newKeyring func() cache.TokenCache
+// filesystem. Production code uses defaultStoreFactories().
+type storeFactories struct {
+	newFile          func(context.Context) (Store, error)
+	newKeyring       func() Store
+	probeKeyring     func() error
+	probeKeyringRead func() error
 }
 
-// defaultCacheFactories returns the production factory set.
-func defaultCacheFactories() cacheFactories {
-	return cacheFactories{
-		newFile:    func(ctx context.Context) (cache.TokenCache, error) { return NewFileTokenCache(ctx) },
-		newKeyring: NewKeyringCache,
+// defaultStoreFactories returns the production factory set.
+func defaultStoreFactories() storeFactories {
+	return storeFactories{
+		newFile:          func(ctx context.Context) (Store, error) { return NewFileStore(ctx) },
+		newKeyring:       NewKeyringStore,
+		probeKeyring:     ProbeKeyring,
+		probeKeyringRead: ProbeKeyringRead,
 	}
 }
 
-// ResolveCache resolves the storage mode for this invocation and returns
-// the corresponding token cache plus the resolved mode (so callers can log
+// ResolveStore resolves the storage mode for this invocation and returns
+// the corresponding token store plus the resolved mode (so callers can log
 // or surface it).
 //
 // override is usually the command-level flag value. Pass "" when the command
 // has no flag; precedence then falls through to env -> config -> default.
 //
-// Every CLI code path that calls u2m.NewPersistentAuth must route the result
-// through u2m.WithTokenCache, otherwise the SDK defaults to the file cache
-// and splits the user's tokens across two backends.
-func ResolveCache(ctx context.Context, override StorageMode) (cache.TokenCache, StorageMode, error) {
-	return resolveCacheWith(ctx, override, defaultCacheFactories())
+// When the resolver returns (mode=Secure, source=Default) and the OS
+// keyring is definitively unreachable (a non-timeout probe error), reads
+// fall back to the plaintext file cache so post-upgrade users with legacy
+// token-cache.json entries are not stranded. Unlike the login path, this
+// fallback does not persist auth_storage = plaintext to [__settings__];
+// pinning happens only on successful login.
+//
+// Every CLI code path that calls u2m.NewPersistentAuth must supply the store
+// returned by this package, otherwise U2M uses an in-memory store and bypasses
+// the user's configured storage backend.
+func ResolveStore(ctx context.Context, override StorageMode) (Store, StorageMode, error) {
+	return resolveStoreForReadWith(ctx, override, defaultStoreFactories())
+}
+
+// ResolveStoreForLogin resolves the store like ResolveStore with extra rules
+// for the auth login path:
+//
+//  1. When the resolved mode is secure and the user did not explicitly ask
+//     for it (no override flag, no env var, no config), and the OS keyring
+//     is unreachable, fall back silently to plaintext and persist
+//     auth_storage = plaintext to [__settings__] so subsequent commands
+//     skip the (slow/blocking) probe and route directly to the file cache.
+//  2. When the user explicitly asked for secure (override, env var, or
+//     config) but the keyring is unreachable, return an error. An explicit
+//     "I want secure" is honored strictly: never silently downgrade.
+//  3. When the probe times out, stay on keyring regardless of explicit.
+//     The timeout is ambiguous (locked vs hung); a misdiagnosis fails
+//     the final Store rather than silently downgrading to plaintext.
+//
+// Login-specific. Read paths (auth token, bundle commands) keep the original
+// keyring error so they don't silently mint plaintext copies of tokens that
+// were stored in the keyring on another machine.
+func ResolveStoreForLogin(ctx context.Context, override StorageMode) (Store, StorageMode, error) {
+	return resolveStoreForLoginWith(ctx, override, defaultStoreFactories())
+}
+
+// OAuthTokenStore applies the U2M not-found hint so a store miss carries
+// actionable "run databricks auth login" guidance. Use on read and credential
+// paths. M2M/OIDC callers use the CLI Store directly and must not route through
+// here: the login hint is the wrong remedy for those auth types.
+func OAuthTokenStore(ctx context.Context, s Store, mode StorageMode) Store {
+	return withNotFoundHint(ctx, s, mode)
 }
 
-// WrapForOAuthArgument wraps tokenCache so SDK-side writes (Challenge, refresh)
-// dual-write to the legacy host-based cache key when mode is plaintext. Other
-// modes return tokenCache unchanged: secure mode never writes a host-key entry,
-// and the wrapper has nothing to do for non-file backends.
+// WrapForOAuthArgument is OAuthTokenStore plus, in plaintext mode, a dual-write
+// of the login token to the legacy host-based cache key. Other modes return the
+// hinted store. Secure mode never writes a host-key entry, and the dual-write
+// has nothing to do for non-file backends.
 //
-// Pass the OAuthArgument that the same NewPersistentAuth call will use. For
-// discovery arguments the discovered host is read at Store time, so it is
-// safe to wrap before Challenge populates it.
-func WrapForOAuthArgument(tokenCache cache.TokenCache, mode StorageMode, arg u2m.OAuthArgument) cache.TokenCache {
+// Pass the OAuthArgument used to obtain or refresh the token. For discovery
+// arguments, Challenge must populate the discovered host before the caller
+// stores the token.
+func WrapForOAuthArgument(ctx context.Context, s Store, mode StorageMode, arg TokenKeyProvider) Store {
+	s = OAuthTokenStore(ctx, s, mode)
 	if mode != StorageModePlaintext {
-		return tokenCache
+		return s
 	}
-	return NewDualWritingTokenCache(tokenCache, arg)
+	return NewDualWritingStore(s, arg)
 }
 
-// resolveCacheWith is the pure form of ResolveCache. It takes the factory
-// set as a parameter so tests can inject stubs.
-func resolveCacheWith(ctx context.Context, override StorageMode, f cacheFactories) (cache.TokenCache, StorageMode, error) {
+// resolveStoreWith is the pure form of ResolveStore without the read-path
+// fallback. Takes the factory set as a parameter so tests can inject stubs.
+// Used directly by ResolveStoreForLogin (which has its own fallback rules)
+// and indirectly by ResolveStore (which adds the read-path fallback in
+// resolveStoreForReadWith).
+func resolveStoreWith(ctx context.Context, override StorageMode, f storeFactories) (Store, StorageMode, error) {
 	mode, err := ResolveStorageMode(ctx, override)
 	if err != nil {
 		return nil, "", err
@@ -73,3 +120,154 @@ func resolveCacheWith(ctx context.Context, override StorageMode, f cacheFactorie
 		return nil, "", fmt.Errorf("unsupported storage mode %q", string(mode))
 	}
 }
+
+// resolveStoreForReadWith is the pure form of ResolveStore. It applies the
+// read-path fallback: when mode is secure-from-default and the keyring
+// probes as definitively unavailable, return the file cache instead.
+// Timeouts keep the keyring (could be transient).
+func resolveStoreForReadWith(ctx context.Context, override StorageMode, f storeFactories) (Store, StorageMode, error) {
+	mode, source, err := ResolveStorageModeWithSource(ctx, override)
+	if err != nil {
+		return nil, "", err
+	}
+	return applyReadFallback(ctx, mode, source.Explicit(), f)
+}
+
+// applyReadFallback realizes the read-path fallback. Mirrors
+// applyLoginFallback but:
+//
+//   - Uses a read-only probe (ProbeKeyringRead) so calls do not write to
+//     the keyring on every CLI invocation.
+//   - Does not persist auth_storage = plaintext. Pinning happens only on
+//     successful login, where the write-probe gives us stronger evidence
+//     that the keyring is truly unavailable on this machine.
+//
+// Explicit secure is honored: callers who asked for secure get the keyring
+// cache even if the probe fails, so the actual Lookup error surfaces the
+// unreachability instead of silently using a different backend.
+func applyReadFallback(ctx context.Context, mode StorageMode, explicit bool, f storeFactories) (Store, StorageMode, error) {
+	switch mode {
+	case StorageModePlaintext:
+		c, err := f.newFile(ctx)
+		if err != nil {
+			return nil, "", fmt.Errorf("open file token cache: %w", err)
+		}
+		return c, mode, nil
+	case StorageModeSecure:
+		if explicit {
+			return f.newKeyring(), mode, nil
+		}
+		if probeErr := f.probeKeyringRead(); probeErr != nil {
+			if _, ok := errors.AsType[*TimeoutError](probeErr); ok {
+				log.Debugf(ctx, "keyring read probe timed out (%v); staying on keyring", probeErr)
+				return f.newKeyring(), mode, nil
+			}
+			log.Debugf(ctx, "secure storage unavailable on read path (%v), using file cache", probeErr)
+			store, fileErr := f.newFile(ctx)
+			if fileErr != nil {
+				return nil, "", fmt.Errorf("open file token cache: %w", fileErr)
+			}
+			return store, StorageModePlaintext, nil
+		}
+		return f.newKeyring(), mode, nil
+	default:
+		return nil, "", fmt.Errorf("unsupported storage mode %q", string(mode))
+	}
+}
+
+// resolveStoreForLoginWith is the pure form of ResolveStoreForLogin. It takes
+// the factory set as a parameter so tests can inject stubs.
+func resolveStoreForLoginWith(ctx context.Context, override StorageMode, f storeFactories) (Store, StorageMode, error) {
+	mode, source, err := ResolveStorageModeWithSource(ctx, override)
+	if err != nil {
+		return nil, "", err
+	}
+	return applyLoginFallback(ctx, mode, source.Explicit(), f)
+}
+
+// applyLoginFallback realizes the login-time fallback rules given an already-
+// resolved mode and whether the user explicitly asked for it. Split out so
+// tests can drive the (mode, explicit) input space directly without depending
+// on whatever the resolver's default mode happens to be at any point in time.
+func applyLoginFallback(ctx context.Context, mode StorageMode, explicit bool, f storeFactories) (Store, StorageMode, error) {
+	switch mode {
+	case StorageModePlaintext:
+		c, err := f.newFile(ctx)
+		if err != nil {
+			return nil, "", fmt.Errorf("open file token cache: %w", err)
+		}
+		return c, mode, nil
+	case StorageModeSecure:
+		if probeErr := f.probeKeyring(); probeErr != nil {
+			// Stay on keyring on timeout: a locked keyring being unlocked
+			// during OAuth is the common case, and a misdiagnosed hang
+			// fails the final Store anyway, which is better than a
+			// silent plaintext downgrade.
+			if _, ok := errors.AsType[*TimeoutError](probeErr); ok {
+				log.Debugf(ctx, "keyring probe timed out (%v); staying on keyring", probeErr)
+				return f.newKeyring(), mode, nil
+			}
+			if explicit {
+				return nil, "", fmt.Errorf("secure storage was requested but the OS keyring is not reachable: %w", probeErr)
+			}
+			log.Debugf(ctx, "secure storage unavailable (%v), falling back to plaintext", probeErr)
+			fileStore, fileErr := f.newFile(ctx)
+			if fileErr != nil {
+				return nil, "", fmt.Errorf("open file token cache: %w", fileErr)
+			}
+			persistPlaintextFallback(ctx)
+			return fileStore, StorageModePlaintext, nil
+		}
+		return f.newKeyring(), mode, nil
+	default:
+		return nil, "", fmt.Errorf("unsupported storage mode %q", string(mode))
+	}
+}
+
+// persistPlaintextFallback writes auth_storage = plaintext to [__settings__]
+// in .databrickscfg so subsequent commands skip the (slow/blocking) keyring
+// probe and route straight to the file cache.
+//
+// Only called on the (mode=Secure, explicit=false) probe-failure branch.
+// Best-effort: persistence failures are logged at debug and never block
+// login.
+func persistPlaintextFallback(ctx context.Context) {
+	configPath := env.Get(ctx, "DATABRICKS_CONFIG_FILE")
+	if err := databrickscfg.SetConfiguredAuthStorage(ctx, string(StorageModePlaintext), configPath); err != nil {
+		log.Debugf(ctx, "persist auth_storage=plaintext fallback failed: %v", err)
+	}
+}
+
+// PinSecureMode persists auth_storage = secure to [__settings__] when the
+// user is currently on the secure-from-default path. Once pinned, subsequent
+// invocations see source=Config (explicit), so applyLoginFallback returns an
+// error on a transient keyring probe failure instead of silently demoting
+// the user to plaintext.
+//
+// No-op when mode is not secure or when the user already chose a mode
+// explicitly via override, env var, or config. override must be the same
+// value the caller passed to ResolveStoreForLogin so the source check sees
+// the caller's intent rather than re-resolving without it.
+//
+// Persistence failures are logged at warn: they do not block login, but
+// the user should know the pin did not happen, since a later transient
+// keyring failure could then silently route a default-secure user to
+// plaintext. Concurrent logins racing this write is benign because both
+// write the same value.
+func PinSecureMode(ctx context.Context, mode, override StorageMode) {
+	if mode != StorageModeSecure {
+		return
+	}
+	_, source, err := ResolveStorageModeWithSource(ctx, override)
+	if err != nil {
+		log.Debugf(ctx, "pin secure mode: resolve: %v", err)
+		return
+	}
+	if source.Explicit() {
+		return
+	}
+	configPath := env.Get(ctx, "DATABRICKS_CONFIG_FILE")
+	if err := databrickscfg.SetConfiguredAuthStorage(ctx, string(StorageModeSecure), configPath); err != nil {
+		log.Warnf(ctx, "could not persist auth_storage=secure to %s: %v. Future commands may need DATABRICKS_AUTH_STORAGE=secure to keep using the OS keyring.", configPath, err)
+	}
+}
diff --git a/libs/auth/storage/cache_test.go b/libs/auth/storage/cache_test.go
index b84c1ef3ba0..1ab09ea24aa 100644
--- a/libs/auth/storage/cache_test.go
+++ b/libs/auth/storage/cache_test.go
@@ -3,29 +3,51 @@ package storage
 import (
 	"context"
 	"errors"
+	"fmt"
+	"io/fs"
+	"os"
 	"path/filepath"
 	"testing"
 
+	"github.com/databricks/cli/libs/databrickscfg"
 	"github.com/databricks/cli/libs/env"
-	"github.com/databricks/databricks-sdk-go/credentials/u2m"
-	"github.com/databricks/databricks-sdk-go/credentials/u2m/cache"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/oauth2"
 )
 
-// stubCache is a test double for cache.TokenCache that records the source
-// it was constructed from. It lets the tests confirm which factory ran.
-type stubCache struct{ source string }
+// stubStore is a test double for Store that records the source it was
+// constructed from. It lets the tests confirm which factory ran.
+type stubStore struct{ source string }
 
-func (stubCache) Store(string, *oauth2.Token) error    { return nil }
-func (stubCache) Lookup(string) (*oauth2.Token, error) { return nil, cache.ErrNotFound }
+func (stubStore) Put(string, Entry) error      { return nil }
+func (stubStore) Lookup(string) (Entry, error) { return Entry{}, ErrNotFound }
+func (stubStore) Delete(string) error          { return nil }
 
-func fakeFactories(t *testing.T) cacheFactories {
+// memStore is a functional in-memory Store for exercising the OAuth wrappers.
+type memStore struct{ entries map[string]Entry }
+
+func newMemStore() *memStore { return &memStore{entries: map[string]Entry{}} }
+
+func (m *memStore) Put(key string, e Entry) error { m.entries[key] = e; return nil }
+
+func (m *memStore) Lookup(key string) (Entry, error) {
+	e, ok := m.entries[key]
+	if !ok {
+		return Entry{}, ErrNotFound
+	}
+	return e, nil
+}
+
+func (m *memStore) Delete(key string) error { delete(m.entries, key); return nil }
+
+func fakeFactories(t *testing.T) storeFactories {
 	t.Helper()
-	return cacheFactories{
-		newFile:    func(context.Context) (cache.TokenCache, error) { return stubCache{source: "file"}, nil },
-		newKeyring: func() cache.TokenCache { return stubCache{source: "keyring"} },
+	return storeFactories{
+		newFile:          func(context.Context) (Store, error) { return stubStore{source: "file"}, nil },
+		newKeyring:       func() Store { return stubStore{source: "keyring"} },
+		probeKeyring:     func() error { return nil },
+		probeKeyringRead: func() error { return nil },
 	}
 }
 
@@ -37,92 +59,449 @@ func hermetic(t *testing.T) {
 	t.Setenv("DATABRICKS_CONFIG_FILE", filepath.Join(t.TempDir(), "databrickscfg"))
 }
 
-func TestResolveCache_DefaultsToPlaintextFile(t *testing.T) {
+func TestResolveStore_DefaultsToSecureKeyring(t *testing.T) {
 	hermetic(t)
 	ctx := t.Context()
 
-	got, mode, err := resolveCacheWith(ctx, "", fakeFactories(t))
+	got, mode, err := resolveStoreWith(ctx, "", fakeFactories(t))
 
 	require.NoError(t, err)
-	assert.Equal(t, StorageModePlaintext, mode)
-	assert.Equal(t, "file", got.(stubCache).source)
+	assert.Equal(t, StorageModeSecure, mode)
+	assert.Equal(t, "keyring", got.(stubStore).source)
 }
 
-func TestResolveCache_OverrideSecureUsesKeyring(t *testing.T) {
+func TestResolveStore_OverrideSecureUsesKeyring(t *testing.T) {
 	hermetic(t)
 	ctx := t.Context()
 
-	got, mode, err := resolveCacheWith(ctx, StorageModeSecure, fakeFactories(t))
+	got, mode, err := resolveStoreWith(ctx, StorageModeSecure, fakeFactories(t))
 
 	require.NoError(t, err)
 	assert.Equal(t, StorageModeSecure, mode)
-	assert.Equal(t, "keyring", got.(stubCache).source)
+	assert.Equal(t, "keyring", got.(stubStore).source)
 }
 
-func TestResolveCache_EnvVarSelectsSecure(t *testing.T) {
+func TestResolveStore_EnvVarSelectsSecure(t *testing.T) {
 	hermetic(t)
 	ctx := env.Set(t.Context(), EnvVar, "secure")
 
-	got, mode, err := resolveCacheWith(ctx, "", fakeFactories(t))
+	got, mode, err := resolveStoreWith(ctx, "", fakeFactories(t))
 
 	require.NoError(t, err)
 	assert.Equal(t, StorageModeSecure, mode)
-	assert.Equal(t, "keyring", got.(stubCache).source)
+	assert.Equal(t, "keyring", got.(stubStore).source)
 }
 
-func TestResolveCache_PlaintextOverrideUsesFile(t *testing.T) {
+func TestResolveStore_PlaintextOverrideUsesFile(t *testing.T) {
 	hermetic(t)
 	ctx := t.Context()
 
-	got, mode, err := resolveCacheWith(ctx, StorageModePlaintext, fakeFactories(t))
+	got, mode, err := resolveStoreWith(ctx, StorageModePlaintext, fakeFactories(t))
 
 	require.NoError(t, err)
 	assert.Equal(t, StorageModePlaintext, mode)
-	assert.Equal(t, "file", got.(stubCache).source)
+	assert.Equal(t, "file", got.(stubStore).source)
 }
 
-func TestResolveCache_InvalidOverrideReturnsError(t *testing.T) {
+func TestResolveStore_InvalidOverrideReturnsError(t *testing.T) {
 	hermetic(t)
 	ctx := t.Context()
 
-	_, _, err := resolveCacheWith(ctx, StorageMode("bogus"), fakeFactories(t))
+	_, _, err := resolveStoreWith(ctx, StorageMode("bogus"), fakeFactories(t))
 
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), `unsupported storage mode "bogus"`)
 }
 
-func TestResolveCache_InvalidEnvReturnsError(t *testing.T) {
+func TestResolveStore_InvalidEnvReturnsError(t *testing.T) {
 	hermetic(t)
 	ctx := env.Set(t.Context(), EnvVar, "bogus")
 
-	_, _, err := resolveCacheWith(ctx, "", fakeFactories(t))
+	_, _, err := resolveStoreWith(ctx, "", fakeFactories(t))
 
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "DATABRICKS_AUTH_STORAGE")
 }
 
-func TestResolveCache_FileFactoryErrorPropagates(t *testing.T) {
+func TestResolveStore_FileFactoryErrorPropagates(t *testing.T) {
 	hermetic(t)
 	ctx := t.Context()
 	boom := errors.New("disk full")
-	factories := cacheFactories{
-		newFile:    func(context.Context) (cache.TokenCache, error) { return nil, boom },
-		newKeyring: func() cache.TokenCache { return stubCache{source: "keyring"} },
+	factories := storeFactories{
+		newFile:          func(context.Context) (Store, error) { return nil, boom },
+		newKeyring:       func() Store { return stubStore{source: "keyring"} },
+		probeKeyring:     func() error { return nil },
+		probeKeyringRead: func() error { return nil },
 	}
 
-	_, _, err := resolveCacheWith(ctx, StorageModePlaintext, factories)
+	_, _, err := resolveStoreWith(ctx, StorageModePlaintext, factories)
 
 	require.Error(t, err)
 	assert.ErrorIs(t, err, boom)
 }
 
+// applyReadFallback mirrors applyLoginFallback's logic on the read path:
+// keyring is probed read-only, definitive failures fall through to the file
+// cache so legacy plaintext tokens stay reachable, timeouts stay on the
+// keyring, and explicit-secure is honored even when the probe fails.
+
+func TestApplyReadFallback_PlaintextSkipsProbe(t *testing.T) {
+	hermetic(t)
+	ctx := t.Context()
+	probed := false
+	f := fakeFactories(t)
+	f.probeKeyringRead = func() error {
+		probed = true
+		return nil
+	}
+
+	got, mode, err := applyReadFallback(ctx, StorageModePlaintext, false, f)
+
+	require.NoError(t, err)
+	assert.Equal(t, StorageModePlaintext, mode)
+	assert.Equal(t, "file", got.(stubStore).source)
+	assert.False(t, probed, "probe must not run when mode is already plaintext")
+}
+
+func TestApplyReadFallback_ExplicitSecureSkipsProbe(t *testing.T) {
+	hermetic(t)
+	ctx := t.Context()
+	probed := false
+	f := fakeFactories(t)
+	f.probeKeyringRead = func() error {
+		probed = true
+		return errors.New("unreachable")
+	}
+
+	got, mode, err := applyReadFallback(ctx, StorageModeSecure, true, f)
+
+	require.NoError(t, err)
+	assert.Equal(t, StorageModeSecure, mode)
+	assert.Equal(t, "keyring", got.(stubStore).source)
+	assert.False(t, probed, "probe must not run when user is explicit about secure mode")
+}
+
+func TestApplyReadFallback_DefaultSecure_ProbeOK_UsesKeyring(t *testing.T) {
+	hermetic(t)
+	ctx := t.Context()
+
+	got, mode, err := applyReadFallback(ctx, StorageModeSecure, false, fakeFactories(t))
+
+	require.NoError(t, err)
+	assert.Equal(t, StorageModeSecure, mode)
+	assert.Equal(t, "keyring", got.(stubStore).source)
+}
+
+func TestApplyReadFallback_DefaultSecure_ProbeFail_FallsBack(t *testing.T) {
+	hermetic(t)
+	ctx := t.Context()
+	configPath := env.Get(ctx, "DATABRICKS_CONFIG_FILE")
+
+	f := fakeFactories(t)
+	f.probeKeyringRead = func() error { return errors.New("no keyring") }
+
+	got, mode, err := applyReadFallback(ctx, StorageModeSecure, false, f)
+
+	require.NoError(t, err)
+	assert.Equal(t, StorageModePlaintext, mode)
+	assert.Equal(t, "file", got.(stubStore).source)
+
+	// Read-path fallback must NOT pin: pinning is reserved for login,
+	// where the write-probe gives stronger evidence of unavailability.
+	persisted, gerr := databrickscfg.GetConfiguredAuthStorage(ctx, configPath)
+	require.NoError(t, gerr)
+	assert.Empty(t, persisted, "read-path fallback must not persist auth_storage")
+}
+
+// A timeout could mean a locked keyring that will work once the user unlocks
+// it. Stay on the keyring so the actual Lookup surfaces the real outcome
+// rather than silently routing reads to the file cache.
+func TestApplyReadFallback_DefaultSecure_ProbeTimeout_StaysOnKeyring(t *testing.T) {
+	cases := []struct {
+		name     string
+		probeErr error
+	}{
+		{"bare TimeoutError", &TimeoutError{Op: "get"}},
+		{"wrapped TimeoutError", fmt.Errorf("get: %w", &TimeoutError{Op: "get"})},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			hermetic(t)
+			ctx := t.Context()
+			configPath := env.Get(ctx, "DATABRICKS_CONFIG_FILE")
+
+			f := fakeFactories(t)
+			f.probeKeyringRead = func() error { return tc.probeErr }
+
+			got, mode, err := applyReadFallback(ctx, StorageModeSecure, false, f)
+
+			require.NoError(t, err)
+			assert.Equal(t, StorageModeSecure, mode)
+			assert.Equal(t, "keyring", got.(stubStore).source)
+
+			persisted, gerr := databrickscfg.GetConfiguredAuthStorage(ctx, configPath)
+			require.NoError(t, gerr)
+			assert.Empty(t, persisted, "probe timeout must not persist anything")
+		})
+	}
+}
+
+func TestResolveStoreForLogin_PlaintextSkipsProbe(t *testing.T) {
+	hermetic(t)
+	ctx := t.Context()
+	probed := false
+	f := fakeFactories(t)
+	f.probeKeyring = func() error {
+		probed = true
+		return nil
+	}
+
+	got, mode, err := resolveStoreForLoginWith(ctx, StorageModePlaintext, f)
+
+	require.NoError(t, err)
+	assert.Equal(t, StorageModePlaintext, mode)
+	assert.Equal(t, "file", got.(stubStore).source)
+	assert.False(t, probed, "probe must not run when mode is already plaintext")
+}
+
+func TestResolveStoreForLogin_SecureProbeOK(t *testing.T) {
+	hermetic(t)
+	ctx := env.Set(t.Context(), EnvVar, "secure")
+
+	got, mode, err := resolveStoreForLoginWith(ctx, "", fakeFactories(t))
+
+	require.NoError(t, err)
+	assert.Equal(t, StorageModeSecure, mode)
+	assert.Equal(t, "keyring", got.(stubStore).source)
+}
+
+func TestResolveStoreForLogin_ExplicitEnvSecure_ProbeFail_Errors(t *testing.T) {
+	hermetic(t)
+	ctx := env.Set(t.Context(), EnvVar, "secure")
+	configPath := env.Get(ctx, "DATABRICKS_CONFIG_FILE")
+
+	f := fakeFactories(t)
+	f.probeKeyring = func() error { return errors.New("no keyring") }
+
+	_, _, err := resolveStoreForLoginWith(ctx, "", f)
+	require.Error(t, err)
+	assert.ErrorContains(t, err, "secure storage was requested")
+
+	persisted, gerr := databrickscfg.GetConfiguredAuthStorage(ctx, configPath)
+	require.NoError(t, gerr)
+	assert.Empty(t, persisted, "env-set secure must not be persisted as plaintext")
+}
+
+func TestResolveStoreForLogin_ExplicitConfigSecure_ProbeFail_Errors(t *testing.T) {
+	hermetic(t)
+	ctx := t.Context()
+	configPath := env.Get(ctx, "DATABRICKS_CONFIG_FILE")
+	require.NoError(t, os.WriteFile(configPath, []byte("[__settings__]\nauth_storage = secure\n"), 0o600))
+
+	f := fakeFactories(t)
+	f.probeKeyring = func() error { return errors.New("no keyring") }
+
+	_, _, err := resolveStoreForLoginWith(ctx, "", f)
+	require.Error(t, err)
+	assert.ErrorContains(t, err, "secure storage was requested")
+
+	persisted, gerr := databrickscfg.GetConfiguredAuthStorage(ctx, configPath)
+	require.NoError(t, gerr)
+	assert.Equal(t, "secure", persisted, "config-set secure must not be silently rewritten")
+}
+
+func TestResolveStoreForLogin_ExplicitOverrideSecure_ProbeFail_Errors(t *testing.T) {
+	hermetic(t)
+	ctx := t.Context()
+
+	f := fakeFactories(t)
+	f.probeKeyring = func() error { return errors.New("no keyring") }
+
+	_, _, err := resolveStoreForLoginWith(ctx, StorageModeSecure, f)
+	require.Error(t, err)
+	assert.ErrorContains(t, err, "secure storage was requested")
+}
+
+func TestApplyLoginFallback_DefaultSecure_ProbeFail_FallsBackAndPersists(t *testing.T) {
+	hermetic(t)
+	ctx := t.Context()
+	configPath := env.Get(ctx, "DATABRICKS_CONFIG_FILE")
+
+	f := fakeFactories(t)
+	f.probeKeyring = func() error { return errors.New("no keyring") }
+
+	got, mode, err := applyLoginFallback(ctx, StorageModeSecure, false, f)
+
+	require.NoError(t, err)
+	assert.Equal(t, StorageModePlaintext, mode)
+	assert.Equal(t, "file", got.(stubStore).source)
+
+	persisted, err := databrickscfg.GetConfiguredAuthStorage(ctx, configPath)
+	require.NoError(t, err)
+	assert.Equal(t, "plaintext", persisted, "default-mode fallback must persist auth_storage = plaintext")
+}
+
+func TestApplyLoginFallback_ExplicitSecure_ProbeFail_Errors(t *testing.T) {
+	hermetic(t)
+	ctx := t.Context()
+	configPath := env.Get(ctx, "DATABRICKS_CONFIG_FILE")
+
+	f := fakeFactories(t)
+	f.probeKeyring = func() error { return errors.New("no keyring") }
+
+	_, _, err := applyLoginFallback(ctx, StorageModeSecure, true, f)
+	require.Error(t, err)
+	assert.ErrorContains(t, err, "secure storage was requested")
+
+	persisted, gerr := databrickscfg.GetConfiguredAuthStorage(ctx, configPath)
+	require.NoError(t, gerr)
+	assert.Empty(t, persisted, "explicit-secure error must not write config")
+}
+
+// A locked keyring with a slow user surfaces as TimeoutError. We want login
+// to stay on the keyring so the final Store lands there once the user has
+// finished unlocking, regardless of whether secure was explicit. Cover both
+// the bare TimeoutError (in case probe wraps thinner in the future) and the
+// real wrapped form returned by probeWithBackend.
+func TestApplyLoginFallback_ProbeTimeout_StaysOnKeyring(t *testing.T) {
+	cases := []struct {
+		name     string
+		explicit bool
+		probeErr error
+	}{
+		{"default-secure, bare TimeoutError", false, &TimeoutError{Op: "set"}},
+		{"default-secure, wrapped TimeoutError", false, fmt.Errorf("write: %w", &TimeoutError{Op: "set"})},
+		{"explicit-secure, bare TimeoutError", true, &TimeoutError{Op: "set"}},
+		{"explicit-secure, wrapped TimeoutError", true, fmt.Errorf("write: %w", &TimeoutError{Op: "set"})},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			hermetic(t)
+			ctx := t.Context()
+			configPath := env.Get(ctx, "DATABRICKS_CONFIG_FILE")
+
+			f := fakeFactories(t)
+			f.probeKeyring = func() error { return tc.probeErr }
+
+			got, mode, err := applyLoginFallback(ctx, StorageModeSecure, tc.explicit, f)
+
+			require.NoError(t, err)
+			assert.Equal(t, StorageModeSecure, mode)
+			assert.Equal(t, "keyring", got.(stubStore).source)
+
+			persisted, gerr := databrickscfg.GetConfiguredAuthStorage(ctx, configPath)
+			require.NoError(t, gerr)
+			assert.Empty(t, persisted, "probe timeout must not persist plaintext fallback")
+		})
+	}
+}
+
+func TestPinSecureMode(t *testing.T) {
+	cases := []struct {
+		name        string
+		mode        StorageMode
+		override    StorageMode
+		envValue    string
+		configBody  string
+		wantWritten string
+	}{
+		{
+			name:        "secure from default persists secure",
+			mode:        StorageModeSecure,
+			wantWritten: "secure",
+		},
+		{
+			name:        "plaintext mode is a no-op",
+			mode:        StorageModePlaintext,
+			wantWritten: "",
+		},
+		{
+			name:        "secure from env is a no-op",
+			mode:        StorageModeSecure,
+			envValue:    "secure",
+			wantWritten: "",
+		},
+		{
+			name:        "secure from config is a no-op (already pinned)",
+			mode:        StorageModeSecure,
+			configBody:  "[__settings__]\nauth_storage = secure\n",
+			wantWritten: "secure",
+		},
+		{
+			// The override signal is per-invocation, so persisting it to
+			// config would silently turn an ephemeral choice into a
+			// persistent one. Honor the caller's explicit override by
+			// no-op'ing the pin.
+			name:        "secure from override is a no-op",
+			mode:        StorageModeSecure,
+			override:    StorageModeSecure,
+			wantWritten: "",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			hermetic(t)
+			ctx := t.Context()
+			configPath := env.Get(ctx, "DATABRICKS_CONFIG_FILE")
+			if tc.configBody != "" {
+				require.NoError(t, os.WriteFile(configPath, []byte(tc.configBody), 0o600))
+			}
+			if tc.envValue != "" {
+				ctx = env.Set(ctx, EnvVar, tc.envValue)
+			}
+
+			PinSecureMode(ctx, tc.mode, tc.override)
+
+			got, err := databrickscfg.GetConfiguredAuthStorage(ctx, configPath)
+			require.NoError(t, err)
+			assert.Equal(t, tc.wantWritten, got)
+		})
+	}
+}
+
+func TestPinSecureMode_IsIdempotent(t *testing.T) {
+	hermetic(t)
+	ctx := t.Context()
+	configPath := env.Get(ctx, "DATABRICKS_CONFIG_FILE")
+
+	PinSecureMode(ctx, StorageModeSecure, StorageModeUnknown)
+	first, err := databrickscfg.GetConfiguredAuthStorage(ctx, configPath)
+	require.NoError(t, err)
+	require.Equal(t, "secure", first)
+
+	// Second call should see source=Config and skip the write.
+	PinSecureMode(ctx, StorageModeSecure, StorageModeUnknown)
+	second, err := databrickscfg.GetConfiguredAuthStorage(ctx, configPath)
+	require.NoError(t, err)
+	assert.Equal(t, "secure", second)
+}
+
+func TestPinSecureMode_PersistFailureIsSwallowed(t *testing.T) {
+	hermetic(t)
+	ctx := t.Context()
+	// Point DATABRICKS_CONFIG_FILE at a path whose parent does not exist.
+	// loadOrCreateConfigFile does not mkdir, so the underlying os.OpenFile
+	// fails and SetConfiguredAuthStorage returns an error.
+	configPath := filepath.Join(t.TempDir(), "no-such-dir", ".databrickscfg")
+	t.Setenv("DATABRICKS_CONFIG_FILE", configPath)
+
+	// Must not panic or block; failure surfaces in the warn log.
+	PinSecureMode(ctx, StorageModeSecure, StorageModeUnknown)
+
+	// The persist failure must not have produced any file.
+	_, err := os.Stat(configPath)
+	assert.ErrorIs(t, err, fs.ErrNotExist, "no file should have been written")
+}
+
 func TestWrapForOAuthArgument(t *testing.T) {
 	const (
 		host       = "https://example.com"
 		profileKey = "myprofile"
 	)
-	arg, err := u2m.NewProfileWorkspaceOAuthArgument(host, profileKey)
-	require.NoError(t, err)
+	arg := hostArg{key: profileKey, hostKey: host}
 
 	cases := []struct {
 		name        string
@@ -136,24 +515,24 @@ func TestWrapForOAuthArgument(t *testing.T) {
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
-			inner := newMemoryCache()
-			got := WrapForOAuthArgument(inner, tc.mode, arg)
+			inner := newMemStore()
+			got := WrapForOAuthArgument(t.Context(), inner, tc.mode, arg)
 
-			_, wrapped := got.(*DualWritingTokenCache)
+			_, wrapped := got.(*DualWritingStore)
 			assert.Equal(t, tc.wantWrap, wrapped, "wrapper presence")
 
 			tok := &oauth2.Token{AccessToken: "abc"}
-			require.NoError(t, got.Store(profileKey, tok))
+			require.NoError(t, got.Put(profileKey, Entry{Token: tok}))
 
 			primary, err := inner.Lookup(profileKey)
 			require.NoError(t, err, "primary key must always be written")
-			assert.Equal(t, tok, primary)
+			assert.Equal(t, tok, primary.Token)
 
 			_, err = inner.Lookup(host)
 			if tc.wantHostKey {
 				require.NoError(t, err, "host-key mirror expected in plaintext mode")
 			} else {
-				assert.ErrorIs(t, err, cache.ErrNotFound, "no host-key mirror expected outside plaintext mode")
+				assert.ErrorIs(t, err, ErrNotFound, "no host-key mirror expected outside plaintext mode")
 			}
 		})
 	}
diff --git a/libs/auth/storage/dual_writing_cache.go b/libs/auth/storage/dual_writing_cache.go
deleted file mode 100644
index 4e12c4b97b2..00000000000
--- a/libs/auth/storage/dual_writing_cache.go
+++ /dev/null
@@ -1,73 +0,0 @@
-package storage
-
-import (
-	"github.com/databricks/databricks-sdk-go/credentials/u2m"
-	u2m_cache "github.com/databricks/databricks-sdk-go/credentials/u2m/cache"
-	"golang.org/x/oauth2"
-)
-
-// DualWritingTokenCache wraps a TokenCache so that every write under the
-// primary OAuth cache key is also mirrored under the legacy host-based key.
-// This preserves the cross-SDK compatibility convention historically
-// implemented inside PersistentAuth.dualWrite in the SDK, now moved
-// caller-side per the cache-ownership split between SDK and CLI.
-//
-// Mirroring happens inside Store, so every SDK-internal write (Challenge,
-// refresh, discovery) dual-writes without requiring each call site to invoke
-// a helper explicitly.
-type DualWritingTokenCache struct {
-	inner u2m_cache.TokenCache
-	arg   u2m.OAuthArgument
-}
-
-// NewDualWritingTokenCache returns a TokenCache wrapping inner that mirrors
-// writes made under arg.GetCacheKey() to the argument's host key when one
-// can be derived (via DiscoveryOAuthArgument.GetDiscoveredHost or
-// HostCacheKeyProvider.GetHostCacheKey).
-func NewDualWritingTokenCache(inner u2m_cache.TokenCache, arg u2m.OAuthArgument) *DualWritingTokenCache {
-	return &DualWritingTokenCache{inner: inner, arg: arg}
-}
-
-// Store implements [u2m_cache.TokenCache]. Writes under the primary key are
-// also mirrored under the host key (when distinct); writes under any other
-// key pass through unchanged so that a Store(hostKey, t) from an older SDK
-// that still dual-writes internally does not recursively re-expand.
-//
-// The host-key mirror is best-effort: if the second Store fails, the error
-// is silently dropped. The host-key entry is a backward-compat shim for old
-// Go SDK versions (v0.61-v0.103) that still look up by host. Failing the
-// whole Store call would break primary login over a non-essential mirror,
-// so a stale host-key entry is the lesser harm.
-func (c *DualWritingTokenCache) Store(key string, t *oauth2.Token) error {
-	if err := c.inner.Store(key, t); err != nil {
-		return err
-	}
-	primaryKey := c.arg.GetCacheKey()
-	if key != primaryKey {
-		return nil
-	}
-	hostKey := hostCacheKey(c.arg)
-	if hostKey == "" || hostKey == primaryKey {
-		return nil
-	}
-	_ = c.inner.Store(hostKey, t)
-	return nil
-}
-
-// Lookup implements [u2m_cache.TokenCache]; delegates to the inner cache.
-func (c *DualWritingTokenCache) Lookup(key string) (*oauth2.Token, error) {
-	return c.inner.Lookup(key)
-}
-
-// hostCacheKey mirrors the SDK's former PersistentAuth.hostCacheKey:
-// discovery arguments expose the host via GetDiscoveredHost (populated by
-// Challenge); static arguments expose it via HostCacheKeyProvider.
-func hostCacheKey(arg u2m.OAuthArgument) string {
-	if discoveryArg, ok := arg.(u2m.DiscoveryOAuthArgument); ok {
-		return discoveryArg.GetDiscoveredHost()
-	}
-	if hcp, ok := arg.(u2m.HostCacheKeyProvider); ok {
-		return hcp.GetHostCacheKey()
-	}
-	return ""
-}
diff --git a/libs/auth/storage/dual_writing_cache_test.go b/libs/auth/storage/dual_writing_cache_test.go
deleted file mode 100644
index c08433c03ac..00000000000
--- a/libs/auth/storage/dual_writing_cache_test.go
+++ /dev/null
@@ -1,202 +0,0 @@
-package storage
-
-import (
-	"errors"
-	"sync"
-	"testing"
-
-	"github.com/databricks/databricks-sdk-go/credentials/u2m"
-	u2m_cache "github.com/databricks/databricks-sdk-go/credentials/u2m/cache"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"golang.org/x/oauth2"
-)
-
-// memoryCache is a minimal in-memory TokenCache used only by wrapper tests.
-type memoryCache struct {
-	mu     sync.Mutex
-	tokens map[string]*oauth2.Token
-}
-
-func newMemoryCache() *memoryCache {
-	return &memoryCache{tokens: map[string]*oauth2.Token{}}
-}
-
-func (c *memoryCache) Store(key string, t *oauth2.Token) error {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	if t == nil {
-		delete(c.tokens, key)
-		return nil
-	}
-	c.tokens[key] = t
-	return nil
-}
-
-func (c *memoryCache) Lookup(key string) (*oauth2.Token, error) {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	t, ok := c.tokens[key]
-	if !ok {
-		return nil, u2m_cache.ErrNotFound
-	}
-	return t, nil
-}
-
-// plainArg implements OAuthArgument only, exercising the "no host key" branch.
-type plainArg struct {
-	key string
-}
-
-func (a plainArg) GetCacheKey() string { return a.key }
-
-// hostArg implements HostCacheKeyProvider so the wrapper mirrors the token
-// to the configured host key.
-type hostArg struct {
-	key     string
-	hostKey string
-}
-
-func (a hostArg) GetCacheKey() string     { return a.key }
-func (a hostArg) GetHostCacheKey() string { return a.hostKey }
-
-func TestDualWritingCacheStorePrimaryMirrorsHost(t *testing.T) {
-	inner := newMemoryCache()
-	arg := hostArg{key: "profile-a", hostKey: "https://example.databricks.com"}
-	c := NewDualWritingTokenCache(inner, arg)
-	tok := &oauth2.Token{AccessToken: "abc", RefreshToken: "r"}
-
-	require.NoError(t, c.Store("profile-a", tok))
-
-	primary, err := inner.Lookup("profile-a")
-	require.NoError(t, err)
-	assert.Equal(t, tok, primary)
-
-	host, err := inner.Lookup("https://example.databricks.com")
-	require.NoError(t, err)
-	assert.Equal(t, tok, host)
-}
-
-func TestDualWritingCacheStoreNonPrimaryDoesNotMirror(t *testing.T) {
-	// An older SDK still running its internal dualWrite will follow up the
-	// primary Store with a Store(hostKey, t). The wrapper must pass that
-	// second write through without re-expanding into another pair.
-	inner := newMemoryCache()
-	arg := hostArg{key: "profile-a", hostKey: "https://example.databricks.com"}
-	c := NewDualWritingTokenCache(inner, arg)
-	tok := &oauth2.Token{AccessToken: "abc"}
-
-	require.NoError(t, c.Store("https://example.databricks.com", tok))
-
-	host, err := inner.Lookup("https://example.databricks.com")
-	require.NoError(t, err)
-	assert.Equal(t, tok, host)
-	_, err = inner.Lookup("profile-a")
-	require.ErrorIs(t, err, u2m_cache.ErrNotFound)
-}
-
-func TestDualWritingCacheStoreNoHostKey(t *testing.T) {
-	inner := newMemoryCache()
-	arg := plainArg{key: "profile-a"}
-	c := NewDualWritingTokenCache(inner, arg)
-	tok := &oauth2.Token{AccessToken: "abc"}
-
-	require.NoError(t, c.Store("profile-a", tok))
-
-	got, err := inner.Lookup("profile-a")
-	require.NoError(t, err)
-	assert.Equal(t, tok, got)
-	assert.Len(t, inner.tokens, 1)
-}
-
-func TestDualWritingCacheStoreHostKeyEqualsPrimary(t *testing.T) {
-	inner := newMemoryCache()
-	arg := hostArg{key: "https://example.databricks.com", hostKey: "https://example.databricks.com"}
-	c := NewDualWritingTokenCache(inner, arg)
-	tok := &oauth2.Token{AccessToken: "abc"}
-
-	require.NoError(t, c.Store("https://example.databricks.com", tok))
-
-	assert.Len(t, inner.tokens, 1)
-}
-
-func TestDualWritingCacheDiscoveryArgWithDiscoveredHost(t *testing.T) {
-	inner := newMemoryCache()
-	arg, err := u2m.NewBasicDiscoveryOAuthArgument("profile-a")
-	require.NoError(t, err)
-	arg.SetDiscoveredHost("https://example.databricks.com")
-	c := NewDualWritingTokenCache(inner, arg)
-	tok := &oauth2.Token{AccessToken: "abc"}
-
-	require.NoError(t, c.Store("profile-a", tok))
-
-	primary, err := inner.Lookup("profile-a")
-	require.NoError(t, err)
-	assert.Equal(t, tok, primary)
-
-	host, err := inner.Lookup("https://example.databricks.com")
-	require.NoError(t, err)
-	assert.Equal(t, tok, host)
-}
-
-func TestDualWritingCacheDiscoveryArgWithEmptyDiscoveredHost(t *testing.T) {
-	inner := newMemoryCache()
-	arg, err := u2m.NewBasicDiscoveryOAuthArgument("profile-a")
-	require.NoError(t, err)
-	c := NewDualWritingTokenCache(inner, arg)
-	tok := &oauth2.Token{AccessToken: "abc"}
-
-	require.NoError(t, c.Store("profile-a", tok))
-
-	assert.Len(t, inner.tokens, 1)
-	primary, err := inner.Lookup("profile-a")
-	require.NoError(t, err)
-	assert.Equal(t, tok, primary)
-}
-
-func TestDualWritingCacheLookupDelegates(t *testing.T) {
-	inner := newMemoryCache()
-	arg := hostArg{key: "profile-a", hostKey: "https://example.databricks.com"}
-	c := NewDualWritingTokenCache(inner, arg)
-	tok := &oauth2.Token{AccessToken: "abc"}
-	require.NoError(t, inner.Store("profile-a", tok))
-
-	got, err := c.Lookup("profile-a")
-	require.NoError(t, err)
-	assert.Equal(t, tok, got)
-
-	_, err = c.Lookup("missing")
-	require.ErrorIs(t, err, u2m_cache.ErrNotFound)
-}
-
-// failOnHostKeyCache returns an error when asked to write under hostKey;
-// primary writes succeed. Used to verify the wrapper treats host-key
-// mirrors as best-effort.
-type failOnHostKeyCache struct {
-	memoryCache
-	hostKey string
-}
-
-func (c *failOnHostKeyCache) Store(key string, t *oauth2.Token) error {
-	if key == c.hostKey {
-		return errors.New("simulated host-key write failure")
-	}
-	return c.memoryCache.Store(key, t)
-}
-
-func TestDualWritingCacheStoreHostKeyFailureIsBestEffort(t *testing.T) {
-	const (
-		profileKey = "profile-a"
-		hostKey    = "https://example.databricks.com"
-	)
-	inner := &failOnHostKeyCache{memoryCache: *newMemoryCache(), hostKey: hostKey}
-	arg := hostArg{key: profileKey, hostKey: hostKey}
-	c := NewDualWritingTokenCache(inner, arg)
-	tok := &oauth2.Token{AccessToken: "abc"}
-
-	require.NoError(t, c.Store(profileKey, tok), "host-key mirror failure must not propagate to primary Store")
-
-	primary, err := inner.Lookup(profileKey)
-	require.NoError(t, err)
-	assert.Equal(t, tok, primary, "primary write must persist even when host-key mirror fails")
-}
diff --git a/libs/auth/storage/dual_writing_store.go b/libs/auth/storage/dual_writing_store.go
new file mode 100644
index 00000000000..c6e20021313
--- /dev/null
+++ b/libs/auth/storage/dual_writing_store.go
@@ -0,0 +1,95 @@
+package storage
+
+// TokenKeyProvider supplies the primary key used to store an OAuth token.
+type TokenKeyProvider interface {
+	GetCacheKey() string
+}
+
+type discoveredHostProvider interface {
+	GetDiscoveredHost() string
+}
+
+type hostCacheKeyProvider interface {
+	GetHostCacheKey() string
+}
+
+// DualWritingStore wraps a Store so that every write under the
+// primary OAuth cache key is also mirrored under the legacy host-based key.
+// This preserves the cross-SDK compatibility convention historically
+// implemented inside the SDK's PersistentAuth.dualWrite.
+//
+// Mirroring happens inside Put, so callers do not need a separate write for
+// the legacy host-based key.
+type DualWritingStore struct {
+	inner Store
+	arg   TokenKeyProvider
+}
+
+// NewDualWritingStore returns a Store wrapping inner that mirrors
+// writes made under arg.GetCacheKey() to the argument's host key when one
+// can be derived (via DiscoveryOAuthArgument.GetDiscoveredHost or
+// HostCacheKeyProvider.GetHostCacheKey).
+func NewDualWritingStore(inner Store, arg TokenKeyProvider) *DualWritingStore {
+	return &DualWritingStore{inner: inner, arg: arg}
+}
+
+// Put implements [Store]. Writes under the primary key are also mirrored under
+// the host key (when distinct); writes under any other key pass through
+// unchanged so that an explicit host-key write does not recursively re-expand.
+//
+// The host-key mirror is best-effort: if the second Put fails, the error
+// is silently dropped. The host-key entry is a backward-compat shim for old
+// Go SDK versions (v0.61-v0.103) that still look up by host. Failing the
+// whole Put call would break primary login over a non-essential mirror,
+// so a stale host-key entry is the lesser harm.
+func (s *DualWritingStore) Put(key string, e Entry) error {
+	if err := s.inner.Put(key, e); err != nil {
+		return err
+	}
+	primaryKey := s.arg.GetCacheKey()
+	if key != primaryKey {
+		return nil
+	}
+	hostKey := hostCacheKey(s.arg)
+	if hostKey == "" || hostKey == primaryKey {
+		return nil
+	}
+	_ = s.inner.Put(hostKey, e)
+	return nil
+}
+
+// Lookup implements [Store]; delegates to the inner store.
+func (s *DualWritingStore) Lookup(key string) (Entry, error) {
+	return s.inner.Lookup(key)
+}
+
+// Delete implements [Store]. Deletes under the primary key are also mirrored
+// under the host key, using the same best-effort compatibility policy as Put.
+func (s *DualWritingStore) Delete(key string) error {
+	if err := s.inner.Delete(key); err != nil {
+		return err
+	}
+	primaryKey := s.arg.GetCacheKey()
+	if key != primaryKey {
+		return nil
+	}
+	hostKey := hostCacheKey(s.arg)
+	if hostKey == "" || hostKey == primaryKey {
+		return nil
+	}
+	_ = s.inner.Delete(hostKey)
+	return nil
+}
+
+// hostCacheKey mirrors the SDK's former PersistentAuth.hostCacheKey:
+// discovery arguments expose the host via GetDiscoveredHost (populated by
+// Challenge); static arguments expose it via HostCacheKeyProvider.
+func hostCacheKey(arg TokenKeyProvider) string {
+	if discoveryArg, ok := arg.(discoveredHostProvider); ok {
+		return discoveryArg.GetDiscoveredHost()
+	}
+	if hcp, ok := arg.(hostCacheKeyProvider); ok {
+		return hcp.GetHostCacheKey()
+	}
+	return ""
+}
diff --git a/libs/auth/storage/dual_writing_store_test.go b/libs/auth/storage/dual_writing_store_test.go
new file mode 100644
index 00000000000..721fd729ac9
--- /dev/null
+++ b/libs/auth/storage/dual_writing_store_test.go
@@ -0,0 +1,221 @@
+package storage
+
+import (
+	"errors"
+	"sync"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/oauth2"
+)
+
+// testStore is a minimal in-memory Store used only by wrapper tests.
+type testStore struct {
+	mu      sync.Mutex
+	entries map[string]Entry
+}
+
+func newDualWritingTestStore() *testStore {
+	return &testStore{entries: map[string]Entry{}}
+}
+
+func (s *testStore) Put(key string, e Entry) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.entries[key] = e
+	return nil
+}
+
+func (s *testStore) Lookup(key string) (Entry, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	e, ok := s.entries[key]
+	if !ok {
+		return Entry{}, ErrNotFound
+	}
+	return e, nil
+}
+
+func (s *testStore) Delete(key string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	delete(s.entries, key)
+	return nil
+}
+
+// plainArg implements OAuthArgument only, exercising the "no host key" branch.
+type plainArg struct {
+	key string
+}
+
+func (a plainArg) GetCacheKey() string { return a.key }
+
+// hostArg implements HostCacheKeyProvider so the wrapper mirrors the token
+// to the configured host key.
+type hostArg struct {
+	key     string
+	hostKey string
+}
+
+func (a hostArg) GetCacheKey() string     { return a.key }
+func (a hostArg) GetHostCacheKey() string { return a.hostKey }
+
+type discoveryArg struct {
+	key  string
+	host string
+}
+
+func (a discoveryArg) GetCacheKey() string       { return a.key }
+func (a discoveryArg) GetDiscoveredHost() string { return a.host }
+
+func TestDualWritingStorePutPrimaryMirrorsHost(t *testing.T) {
+	inner := newDualWritingTestStore()
+	arg := hostArg{key: "profile-a", hostKey: "https://example.databricks.com"}
+	c := NewDualWritingStore(inner, arg)
+	tok := &oauth2.Token{AccessToken: "abc", RefreshToken: "r"}
+
+	require.NoError(t, c.Put("profile-a", Entry{Token: tok}))
+
+	primary, err := inner.Lookup("profile-a")
+	require.NoError(t, err)
+	assert.Equal(t, tok, primary.Token)
+
+	host, err := inner.Lookup("https://example.databricks.com")
+	require.NoError(t, err)
+	assert.Equal(t, tok, host.Token)
+}
+
+func TestDualWritingStoreDeletePrimaryMirrorsHost(t *testing.T) {
+	inner := newDualWritingTestStore()
+	arg := hostArg{key: "profile-a", hostKey: "https://example.databricks.com"}
+	s := NewDualWritingStore(inner, arg)
+	require.NoError(t, s.Put("profile-a", Entry{Token: &oauth2.Token{AccessToken: "abc"}}))
+
+	require.NoError(t, s.Delete("profile-a"))
+
+	_, err := inner.Lookup("profile-a")
+	require.ErrorIs(t, err, ErrNotFound)
+	_, err = inner.Lookup("https://example.databricks.com")
+	require.ErrorIs(t, err, ErrNotFound)
+}
+
+func TestDualWritingStorePutNonPrimaryDoesNotMirror(t *testing.T) {
+	// An explicit host-key write must pass through without re-expanding into
+	// another pair.
+	inner := newDualWritingTestStore()
+	arg := hostArg{key: "profile-a", hostKey: "https://example.databricks.com"}
+	c := NewDualWritingStore(inner, arg)
+	tok := &oauth2.Token{AccessToken: "abc"}
+
+	require.NoError(t, c.Put("https://example.databricks.com", Entry{Token: tok}))
+
+	host, err := inner.Lookup("https://example.databricks.com")
+	require.NoError(t, err)
+	assert.Equal(t, tok, host.Token)
+	_, err = inner.Lookup("profile-a")
+	require.ErrorIs(t, err, ErrNotFound)
+}
+
+func TestDualWritingStorePutNoHostKey(t *testing.T) {
+	inner := newDualWritingTestStore()
+	arg := plainArg{key: "profile-a"}
+	c := NewDualWritingStore(inner, arg)
+	tok := &oauth2.Token{AccessToken: "abc"}
+
+	require.NoError(t, c.Put("profile-a", Entry{Token: tok}))
+
+	got, err := inner.Lookup("profile-a")
+	require.NoError(t, err)
+	assert.Equal(t, tok, got.Token)
+	assert.Len(t, inner.entries, 1)
+}
+
+func TestDualWritingStorePutHostKeyEqualsPrimary(t *testing.T) {
+	inner := newDualWritingTestStore()
+	arg := hostArg{key: "https://example.databricks.com", hostKey: "https://example.databricks.com"}
+	c := NewDualWritingStore(inner, arg)
+	tok := &oauth2.Token{AccessToken: "abc"}
+
+	require.NoError(t, c.Put("https://example.databricks.com", Entry{Token: tok}))
+
+	assert.Len(t, inner.entries, 1)
+}
+
+func TestDualWritingStoreDiscoveryArgWithDiscoveredHost(t *testing.T) {
+	inner := newDualWritingTestStore()
+	arg := discoveryArg{key: "profile-a", host: "https://example.databricks.com"}
+	c := NewDualWritingStore(inner, arg)
+	tok := &oauth2.Token{AccessToken: "abc"}
+
+	require.NoError(t, c.Put("profile-a", Entry{Token: tok}))
+
+	primary, err := inner.Lookup("profile-a")
+	require.NoError(t, err)
+	assert.Equal(t, tok, primary.Token)
+
+	host, err := inner.Lookup("https://example.databricks.com")
+	require.NoError(t, err)
+	assert.Equal(t, tok, host.Token)
+}
+
+func TestDualWritingStoreDiscoveryArgWithEmptyDiscoveredHost(t *testing.T) {
+	inner := newDualWritingTestStore()
+	arg := discoveryArg{key: "profile-a"}
+	c := NewDualWritingStore(inner, arg)
+	tok := &oauth2.Token{AccessToken: "abc"}
+
+	require.NoError(t, c.Put("profile-a", Entry{Token: tok}))
+
+	assert.Len(t, inner.entries, 1)
+	primary, err := inner.Lookup("profile-a")
+	require.NoError(t, err)
+	assert.Equal(t, tok, primary.Token)
+}
+
+func TestDualWritingStoreLookupDelegates(t *testing.T) {
+	inner := newDualWritingTestStore()
+	arg := hostArg{key: "profile-a", hostKey: "https://example.databricks.com"}
+	c := NewDualWritingStore(inner, arg)
+	tok := &oauth2.Token{AccessToken: "abc"}
+	require.NoError(t, inner.Put("profile-a", Entry{Token: tok}))
+
+	got, err := c.Lookup("profile-a")
+	require.NoError(t, err)
+	assert.Equal(t, tok, got.Token)
+
+	_, err = c.Lookup("missing")
+	require.ErrorIs(t, err, ErrNotFound)
+}
+
+// failOnHostKeyCache returns an error when asked to write under hostKey;
+// primary writes succeed. Used to verify the wrapper treats host-key
+// mirrors as best-effort.
+type failOnHostKeyStore struct {
+	testStore
+	hostKey string
+}
+
+func (s *failOnHostKeyStore) Put(key string, e Entry) error {
+	if key == s.hostKey {
+		return errors.New("simulated host-key write failure")
+	}
+	return s.testStore.Put(key, e)
+}
+
+func TestDualWritingStorePutHostKeyFailureIsBestEffort(t *testing.T) {
+	const (
+		profileKey = "profile-a"
+		hostKey    = "https://example.databricks.com"
+	)
+	inner := &failOnHostKeyStore{testStore: *newDualWritingTestStore(), hostKey: hostKey}
+	arg := hostArg{key: profileKey, hostKey: hostKey}
+	c := NewDualWritingStore(inner, arg)
+	tok := &oauth2.Token{AccessToken: "abc"}
+
+	require.NoError(t, c.Put(profileKey, Entry{Token: tok}), "host-key mirror failure must not propagate to primary Put")
+
+	primary, err := inner.Lookup(profileKey)
+	require.NoError(t, err)
+	assert.Equal(t, tok, primary.Token, "primary write must persist even when host-key mirror fails")
+}
diff --git a/libs/auth/storage/file_cache.go b/libs/auth/storage/file_cache.go
deleted file mode 100644
index f64e233b017..00000000000
--- a/libs/auth/storage/file_cache.go
+++ /dev/null
@@ -1,218 +0,0 @@
-package storage
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io/fs"
-	"os"
-	"path/filepath"
-	"sync"
-
-	"github.com/databricks/cli/libs/env"
-	u2m_cache "github.com/databricks/databricks-sdk-go/credentials/u2m/cache"
-	"golang.org/x/oauth2"
-)
-
-const (
-	// tokenCacheFile is the path of the default token cache, relative to the
-	// user's home directory.
-	tokenCacheFilePath = ".databricks/token-cache.json"
-
-	// ownerExecReadWrite is the permission for the .databricks directory.
-	ownerExecReadWrite = 0o700
-
-	// ownerReadWrite is the permission for the token-cache.json file.
-	ownerReadWrite = 0o600
-
-	// tokenCacheVersion is the version of the token cache file format.
-	//
-	// Version 1 format:
-	//
-	// {
-	//   "version": 1,
-	//   "tokens": {
-	//     "<key>": {
-	//       "access_token": "<access_token>",
-	//       "token_type": "<token_type>",
-	//       "refresh_token": "<refresh_token>",
-	//       "expiry": "<expiry>"
-	//     }
-	//   }
-	// }
-	tokenCacheVersion = 1
-)
-
-// tokenCacheFile is the format of the token cache file.
-type tokenCacheFile struct {
-	Version int                      `json:"version"`
-	Tokens  map[string]*oauth2.Token `json:"tokens"`
-}
-
-type FileTokenCacheOption func(*fileTokenCache)
-
-func WithFileLocation(fileLocation string) FileTokenCacheOption {
-	return func(c *fileTokenCache) {
-		c.fileLocation = fileLocation
-	}
-}
-
-// fileTokenCache caches tokens in "~/.databricks/token-cache.json". fileTokenCache
-// implements the TokenCache interface.
-type fileTokenCache struct {
-	fileLocation string
-
-	// locker protects the token cache file from concurrent reads and writes.
-	locker sync.Mutex
-}
-
-// NewFileTokenCache creates a new FileTokenCache. By default, the cache is
-// stored in "~/.databricks/token-cache.json". The cache file is created if it
-// does not already exist. The cache file is created with owner permissions
-// 0600 and the directory is created with owner permissions 0700. If the cache
-// file is corrupt or if its version does not match tokenCacheVersion, an error
-// is returned.
-func NewFileTokenCache(ctx context.Context, opts ...FileTokenCacheOption) (u2m_cache.TokenCache, error) {
-	c := &fileTokenCache{}
-	for _, opt := range opts {
-		opt(c)
-	}
-	if err := c.init(ctx); err != nil {
-		return nil, err
-	}
-	// Fail fast if the cache is not working.
-	if _, err := c.load(); err != nil {
-		return nil, fmt.Errorf("load: %w", err)
-	}
-	return c, nil
-}
-
-// Store implements the TokenCache interface.
-func (c *fileTokenCache) Store(key string, t *oauth2.Token) error {
-	c.locker.Lock()
-	defer c.locker.Unlock()
-	f, err := c.load()
-	if err != nil {
-		return fmt.Errorf("load: %w", err)
-	}
-	if f.Tokens == nil {
-		f.Tokens = map[string]*oauth2.Token{}
-	}
-	if t == nil {
-		delete(f.Tokens, key)
-	} else {
-		f.Tokens[key] = t
-	}
-	raw, err := json.MarshalIndent(f, "", "  ")
-	if err != nil {
-		return fmt.Errorf("marshal: %w", err)
-	}
-	if err := c.atomicWriteFile(raw); err != nil {
-		return fmt.Errorf("error storing token in local cache: %w", err)
-	}
-	return nil
-}
-
-// Lookup implements the TokenCache interface.
-func (c *fileTokenCache) Lookup(key string) (*oauth2.Token, error) {
-	c.locker.Lock()
-	defer c.locker.Unlock()
-	f, err := c.load()
-	if err != nil {
-		return nil, fmt.Errorf("load: %w", err)
-	}
-	t, ok := f.Tokens[key]
-	if !ok {
-		return nil, u2m_cache.ErrNotFound
-	}
-	return t, nil
-}
-
-// init initializes the token cache file. It creates the file and directory if
-// they do not already exist.
-func (c *fileTokenCache) init(ctx context.Context) error {
-	// set the default file location
-	if c.fileLocation == "" {
-		home, err := env.UserHomeDir(ctx)
-		if err != nil {
-			return fmt.Errorf("failed loading home directory: %w", err)
-		}
-		c.fileLocation = filepath.Join(home, tokenCacheFilePath)
-	}
-	// Create the cache file if it does not exist.
-	if _, err := os.Stat(c.fileLocation); err != nil {
-		if !errors.Is(err, fs.ErrNotExist) {
-			return fmt.Errorf("stat file: %w", err)
-		}
-		// Create the parent directories if needed.
-		if err := os.MkdirAll(filepath.Dir(c.fileLocation), ownerExecReadWrite); err != nil {
-			return fmt.Errorf("mkdir: %w", err)
-		}
-
-		// Create an empty cache file.
-		f := &tokenCacheFile{
-			Version: tokenCacheVersion,
-			Tokens:  map[string]*oauth2.Token{},
-		}
-		raw, err := json.MarshalIndent(f, "", "  ")
-		if err != nil {
-			return fmt.Errorf("marshal: %w", err)
-		}
-		if err := c.atomicWriteFile(raw); err != nil {
-			return fmt.Errorf("error creating token cache file: %w", err)
-		}
-	}
-	return nil
-}
-
-// load loads the token cache file from disk. If the file is corrupt or if its
-// version does not match tokenCacheVersion, it returns an error.
-func (c *fileTokenCache) load() (*tokenCacheFile, error) {
-	raw, err := os.ReadFile(c.fileLocation)
-	if err != nil {
-		return nil, fmt.Errorf("read: %w", err)
-	}
-	f := &tokenCacheFile{}
-	if err := json.Unmarshal(raw, &f); err != nil {
-		return nil, fmt.Errorf("parse: %w", err)
-	}
-	if f.Version != tokenCacheVersion {
-		// in the later iterations we could do state upgraders,
-		// so that we transform token cache from v1 to v2 without
-		// losing the tokens and asking the user to re-authenticate.
-		return nil, fmt.Errorf("needs version %d, got version %d", tokenCacheVersion, f.Version)
-	}
-	return f, nil
-}
-
-// atomicWriteFile writes data to the file atomically by first writing to a
-// temporary file in the same directory and then renaming it to the target.
-// This prevents corruption from interrupted writes.
-func (c *fileTokenCache) atomicWriteFile(data []byte) error {
-	tmp, err := c.writeTmpFile(data)
-	if err != nil {
-		return err
-	}
-	defer os.Remove(tmp)
-	return os.Rename(tmp, c.fileLocation)
-}
-
-func (c *fileTokenCache) writeTmpFile(data []byte) (string, error) {
-	tmp, err := os.CreateTemp(filepath.Dir(c.fileLocation), ".token-cache-*.tmp")
-	if err != nil {
-		return "", fmt.Errorf("create temp file: %w", err)
-	}
-	defer tmp.Close()
-
-	if _, err := tmp.Write(data); err != nil {
-		return "", err
-	}
-	if err := tmp.Chmod(ownerReadWrite); err != nil {
-		return "", err
-	}
-	if err := tmp.Close(); err != nil {
-		return "", err
-	}
-	return tmp.Name(), nil
-}
diff --git a/libs/auth/storage/file_cache_test.go b/libs/auth/storage/file_cache_test.go
deleted file mode 100644
index 4df7576c698..00000000000
--- a/libs/auth/storage/file_cache_test.go
+++ /dev/null
@@ -1,67 +0,0 @@
-package storage
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	u2m_cache "github.com/databricks/databricks-sdk-go/credentials/u2m/cache"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"golang.org/x/oauth2"
-)
-
-func setup(t *testing.T) string {
-	tempHomeDir := t.TempDir()
-	return filepath.Join(tempHomeDir, "token-cache.json")
-}
-
-func TestStoreAndLookup(t *testing.T) {
-	c, err := NewFileTokenCache(t.Context(), WithFileLocation(setup(t)))
-	require.NoError(t, err)
-	err = c.Store("x", &oauth2.Token{
-		AccessToken: "abc",
-	})
-	require.NoError(t, err)
-
-	err = c.Store("y", &oauth2.Token{
-		AccessToken: "bcd",
-	})
-	require.NoError(t, err)
-
-	tok, err := c.Lookup("x")
-	require.NoError(t, err)
-	assert.Equal(t, "abc", tok.AccessToken)
-
-	_, err = c.Lookup("z")
-	assert.Equal(t, u2m_cache.ErrNotFound, err)
-}
-
-func TestNoCacheFileReturnsErrNotConfigured(t *testing.T) {
-	l, err := NewFileTokenCache(t.Context(), WithFileLocation(setup(t)))
-	require.NoError(t, err)
-	_, err = l.Lookup("x")
-	assert.Equal(t, u2m_cache.ErrNotFound, err)
-}
-
-func TestLoadCorruptFile(t *testing.T) {
-	f := setup(t)
-	err := os.MkdirAll(filepath.Dir(f), ownerExecReadWrite)
-	require.NoError(t, err)
-	err = os.WriteFile(f, []byte("abc"), ownerExecReadWrite)
-	require.NoError(t, err)
-
-	_, err = NewFileTokenCache(t.Context(), WithFileLocation(f))
-	assert.EqualError(t, err, "load: parse: invalid character 'a' looking for beginning of value")
-}
-
-func TestLoadWrongVersion(t *testing.T) {
-	f := setup(t)
-	err := os.MkdirAll(filepath.Dir(f), ownerExecReadWrite)
-	require.NoError(t, err)
-	err = os.WriteFile(f, []byte(`{"version": 823, "things": []}`), ownerExecReadWrite)
-	require.NoError(t, err)
-
-	_, err = NewFileTokenCache(t.Context(), WithFileLocation(f))
-	assert.EqualError(t, err, "load: needs version 1, got version 823")
-}
diff --git a/libs/auth/storage/filestore.go b/libs/auth/storage/filestore.go
new file mode 100644
index 00000000000..d7f13d397d3
--- /dev/null
+++ b/libs/auth/storage/filestore.go
@@ -0,0 +1,208 @@
+package storage
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"sync"
+
+	"github.com/databricks/cli/libs/atomicfile"
+	"github.com/databricks/cli/libs/env"
+	"golang.org/x/oauth2"
+)
+
+const (
+	// tokenStoreFilePath is the path of the default token store, relative to
+	// the user's home directory. The on-disk filename stays "token-cache.json"
+	// for backward compatibility with tokens written by older CLI versions,
+	// even though the Go identifiers now use the "store" vocabulary.
+	tokenStoreFilePath = ".databricks/token-cache.json"
+
+	// ownerExecReadWrite is the permission for the .databricks directory.
+	ownerExecReadWrite = 0o700
+
+	// ownerReadWrite is the permission for the token-cache.json file.
+	ownerReadWrite = 0o600
+
+	// tokenStoreVersion is the version of the token store file format.
+	//
+	// Version 1 format:
+	//
+	// {
+	//   "version": 1,
+	//   "tokens": {
+	//     "<key>": {
+	//       "access_token": "<access_token>",
+	//       "token_type": "<token_type>",
+	//       "refresh_token": "<refresh_token>",
+	//       "expiry": "<expiry>"
+	//     }
+	//   }
+	// }
+	tokenStoreVersion = 1
+)
+
+// fileEntry is the per-key on-disk shape. The embedded *oauth2.Token promotes
+// the token fields to the top level of the entry object so the layout matches
+// the historical bare-token format, leaving room for additive sibling fields.
+type fileEntry struct {
+	*oauth2.Token
+}
+
+// tokenStoreFile is the format of the token store file.
+type tokenStoreFile struct {
+	Version int                   `json:"version"`
+	Tokens  map[string]*fileEntry `json:"tokens"`
+}
+
+type FileStoreOption func(*fileStore)
+
+func WithFileLocation(fileLocation string) FileStoreOption {
+	return func(c *fileStore) {
+		c.fileLocation = fileLocation
+	}
+}
+
+// fileStore stores tokens in "~/.databricks/token-cache.json". fileStore
+// implements the Store interface.
+type fileStore struct {
+	fileLocation string
+
+	// locker protects the token store file from concurrent reads and writes.
+	locker sync.Mutex
+}
+
+// NewFileStore creates a new file-backed Store. By default, tokens are stored
+// in "~/.databricks/token-cache.json". The store file is created if it does
+// not already exist, with owner permissions 0600 and the directory with owner
+// permissions 0700. If the store file is corrupt or if its version does not
+// match tokenStoreVersion, an error is returned.
+func NewFileStore(ctx context.Context, opts ...FileStoreOption) (Store, error) {
+	c := &fileStore{}
+	for _, opt := range opts {
+		opt(c)
+	}
+	if err := c.init(ctx); err != nil {
+		return nil, err
+	}
+	// Fail fast if the store is not working.
+	if _, err := c.load(); err != nil {
+		return nil, fmt.Errorf("load: %w", err)
+	}
+	return c, nil
+}
+
+// Put implements the Store interface.
+func (c *fileStore) Put(key string, e Entry) error {
+	c.locker.Lock()
+	defer c.locker.Unlock()
+	f, err := c.load()
+	if err != nil {
+		return fmt.Errorf("load: %w", err)
+	}
+	if f.Tokens == nil {
+		f.Tokens = map[string]*fileEntry{}
+	}
+	f.Tokens[key] = &fileEntry{Token: e.Token}
+	return c.write(f)
+}
+
+// Lookup implements the Store interface.
+func (c *fileStore) Lookup(key string) (Entry, error) {
+	c.locker.Lock()
+	defer c.locker.Unlock()
+	f, err := c.load()
+	if err != nil {
+		return Entry{}, fmt.Errorf("load: %w", err)
+	}
+	fe, ok := f.Tokens[key]
+	if !ok {
+		return Entry{}, ErrNotFound
+	}
+	return Entry{Token: fe.Token}, nil
+}
+
+// Delete implements the Store interface. Removing a missing key is a no-op.
+func (c *fileStore) Delete(key string) error {
+	c.locker.Lock()
+	defer c.locker.Unlock()
+	f, err := c.load()
+	if err != nil {
+		return fmt.Errorf("load: %w", err)
+	}
+	delete(f.Tokens, key)
+	return c.write(f)
+}
+
+// write marshals f and atomically replaces the store file.
+func (c *fileStore) write(f *tokenStoreFile) error {
+	raw, err := json.MarshalIndent(f, "", "  ")
+	if err != nil {
+		return fmt.Errorf("marshal: %w", err)
+	}
+	if err := atomicfile.Write(c.fileLocation, raw, ownerReadWrite); err != nil {
+		return fmt.Errorf("error storing token in local cache: %w", err)
+	}
+	return nil
+}
+
+// init initializes the token store file. It creates the file and directory if
+// they do not already exist.
+func (c *fileStore) init(ctx context.Context) error {
+	// set the default file location
+	if c.fileLocation == "" {
+		home, err := env.UserHomeDir(ctx)
+		if err != nil {
+			return fmt.Errorf("failed loading home directory: %w", err)
+		}
+		c.fileLocation = filepath.Join(home, tokenStoreFilePath)
+	}
+	// Create the store file if it does not exist.
+	if _, err := os.Stat(c.fileLocation); err != nil {
+		if !errors.Is(err, fs.ErrNotExist) {
+			return fmt.Errorf("stat file: %w", err)
+		}
+		// Create the parent directories if needed.
+		if err := os.MkdirAll(filepath.Dir(c.fileLocation), ownerExecReadWrite); err != nil {
+			return fmt.Errorf("mkdir: %w", err)
+		}
+
+		// Create an empty store file.
+		f := &tokenStoreFile{
+			Version: tokenStoreVersion,
+			Tokens:  map[string]*fileEntry{},
+		}
+		raw, err := json.MarshalIndent(f, "", "  ")
+		if err != nil {
+			return fmt.Errorf("marshal: %w", err)
+		}
+		if err := atomicfile.Write(c.fileLocation, raw, ownerReadWrite); err != nil {
+			return fmt.Errorf("error creating token store file: %w", err)
+		}
+	}
+	return nil
+}
+
+// load loads the token store file from disk. If the file is corrupt or if its
+// version does not match tokenStoreVersion, it returns an error.
+func (c *fileStore) load() (*tokenStoreFile, error) {
+	raw, err := os.ReadFile(c.fileLocation)
+	if err != nil {
+		return nil, fmt.Errorf("read: %w", err)
+	}
+	f := &tokenStoreFile{}
+	if err := json.Unmarshal(raw, &f); err != nil {
+		return nil, fmt.Errorf("parse: %w", err)
+	}
+	if f.Version != tokenStoreVersion {
+		// in the later iterations we could do state upgraders,
+		// so that we transform token store from v1 to v2 without
+		// losing the tokens and asking the user to re-authenticate.
+		return nil, fmt.Errorf("needs version %d, got version %d", tokenStoreVersion, f.Version)
+	}
+	return f, nil
+}
diff --git a/libs/auth/storage/filestore_test.go b/libs/auth/storage/filestore_test.go
new file mode 100644
index 00000000000..d905e304839
--- /dev/null
+++ b/libs/auth/storage/filestore_test.go
@@ -0,0 +1,66 @@
+package storage
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/oauth2"
+)
+
+func setup(t *testing.T) string {
+	tempHomeDir := t.TempDir()
+	return filepath.Join(tempHomeDir, "token-cache.json")
+}
+
+func TestStoreAndLookup(t *testing.T) {
+	c, err := NewFileStore(t.Context(), WithFileLocation(setup(t)))
+	require.NoError(t, err)
+	err = c.Put("x", Entry{Token: &oauth2.Token{
+		AccessToken: "abc",
+	}})
+	require.NoError(t, err)
+
+	err = c.Put("y", Entry{Token: &oauth2.Token{
+		AccessToken: "bcd",
+	}})
+	require.NoError(t, err)
+
+	got, err := c.Lookup("x")
+	require.NoError(t, err)
+	assert.Equal(t, "abc", got.Token.AccessToken)
+
+	_, err = c.Lookup("z")
+	assert.Equal(t, ErrNotFound, err)
+}
+
+func TestNoStoreFileReturnsErrNotConfigured(t *testing.T) {
+	l, err := NewFileStore(t.Context(), WithFileLocation(setup(t)))
+	require.NoError(t, err)
+	_, err = l.Lookup("x")
+	assert.Equal(t, ErrNotFound, err)
+}
+
+func TestLoadCorruptFile(t *testing.T) {
+	f := setup(t)
+	err := os.MkdirAll(filepath.Dir(f), ownerExecReadWrite)
+	require.NoError(t, err)
+	err = os.WriteFile(f, []byte("abc"), ownerExecReadWrite)
+	require.NoError(t, err)
+
+	_, err = NewFileStore(t.Context(), WithFileLocation(f))
+	assert.EqualError(t, err, "load: parse: invalid character 'a' looking for beginning of value")
+}
+
+func TestLoadWrongVersion(t *testing.T) {
+	f := setup(t)
+	err := os.MkdirAll(filepath.Dir(f), ownerExecReadWrite)
+	require.NoError(t, err)
+	err = os.WriteFile(f, []byte(`{"version": 823, "things": []}`), ownerExecReadWrite)
+	require.NoError(t, err)
+
+	_, err = NewFileStore(t.Context(), WithFileLocation(f))
+	assert.EqualError(t, err, "load: needs version 1, got version 823")
+}
diff --git a/libs/auth/storage/keyring.go b/libs/auth/storage/keyring.go
index e9fc7d13dfa..e499c00490c 100644
--- a/libs/auth/storage/keyring.go
+++ b/libs/auth/storage/keyring.go
@@ -6,17 +6,25 @@ import (
 	"errors"
 	"fmt"
 	"time"
+	"uuid"
 
-	"github.com/databricks/databricks-sdk-go/credentials/u2m/cache"
 	"github.com/zalando/go-keyring"
 	"golang.org/x/oauth2"
 )
 
 // keyringServiceName is the service name used for every entry the CLI writes
 // to the OS-native secure store. The account field carries the per-entry
-// cache key the SDK passes through TokenCache.Store / Lookup.
+// cache key the U2M manager passes through Store.Put / Lookup.
 const keyringServiceName = "databricks-cli"
 
+// keyringProbeAccountPrefix is prefixed onto a per-call random suffix to form
+// the account name ProbeKeyring writes and deletes. A fixed name like
+// "__probe__" could collide with a user profile of the same name (which is
+// what keyringStore uses as the account field), so the probe would clobber
+// and delete that user's stored token. Per-call randomness also means
+// concurrent probes don't step on each other.
+const keyringProbeAccountPrefix = "__probe_"
+
 // defaultKeyringTimeout is how long a single keyring operation is allowed
 // to run before the wrapper returns a TimeoutError. Matches the value used
 // by GitHub CLI.
@@ -57,41 +65,88 @@ func (zalandoBackend) Delete(service, account string) error {
 	return keyring.Delete(service, account)
 }
 
-// keyringCache stores OAuth tokens in the OS-native secure store.
-// It implements the SDK's cache.TokenCache interface.
+// keyringStore stores OAuth tokens in the OS-native secure store.
+// It implements the Store interface.
 //
 // The type is unexported so that the only way to construct a working instance
-// is NewKeyringCache. A bare &keyringCache{} has a nil backend, which would
+// is NewKeyringStore. A bare &keyringStore{} has a nil backend, which would
 // panic on first use.
-type keyringCache struct {
+type keyringStore struct {
 	backend        keyringBackend
 	timeout        time.Duration
 	keyringSvcName string
 }
 
-// NewKeyringCache returns a cache.TokenCache backed by the OS-native secure
-// store (via zalando/go-keyring) with a 3-second per-operation timeout.
-func NewKeyringCache() cache.TokenCache {
-	return &keyringCache{
+// NewKeyringStore returns a Store backed by the OS-native secure store (via
+// zalando/go-keyring) with a 3-second per-operation timeout.
+func NewKeyringStore() Store {
+	return &keyringStore{
 		backend:        zalandoBackend{},
 		timeout:        defaultKeyringTimeout,
 		keyringSvcName: keyringServiceName,
 	}
 }
 
-// Store stores t under key. Nil t deletes the entry; deleting a missing
-// entry is not an error.
-func (k *keyringCache) Store(key string, t *oauth2.Token) error {
-	if t == nil {
-		return k.withTimeout("delete", func() error {
-			err := k.backend.Delete(k.keyringSvcName, key)
-			if errors.Is(err, keyring.ErrNotFound) {
-				return nil
-			}
-			return err
-		})
+// ProbeKeyring returns nil if the OS keyring accepted a write+delete
+// cycle within the standard timeout. *TimeoutError means the keyring
+// was unresponsive (locked or hung, indistinguishable here); other
+// errors are definitive failures.
+//
+// Used by the login path, where we want to validate both read and write
+// capability before committing to the keyring backend.
+func ProbeKeyring() error {
+	return probeWithBackend(zalandoBackend{}, defaultKeyringTimeout)
+}
+
+func probeWithBackend(backend keyringBackend, timeout time.Duration) error {
+	c := &keyringStore{
+		backend:        backend,
+		timeout:        timeout,
+		keyringSvcName: keyringServiceName,
+	}
+	account := keyringProbeAccountPrefix + uuid.New().String()
+	tok := &oauth2.Token{AccessToken: "probe"}
+	if err := c.Put(account, Entry{Token: tok}); err != nil {
+		return fmt.Errorf("write: %w", err)
+	}
+	if err := c.Delete(account); err != nil {
+		return fmt.Errorf("delete: %w", err)
+	}
+	return nil
+}
+
+// ProbeKeyringRead returns nil if the OS keyring accepted a Get for a
+// non-existent account within the standard timeout (i.e. the backend is
+// reachable and responded with keyring.ErrNotFound). *TimeoutError means
+// the keyring was unresponsive; other errors are definitive failures.
+//
+// Used by the read path so probing does not write to the keyring. A
+// successful probe is indistinguishable from the user not having an
+// entry for that probe account; we treat both as "reachable".
+func ProbeKeyringRead() error {
+	return probeReadWithBackend(zalandoBackend{}, defaultKeyringTimeout)
+}
+
+func probeReadWithBackend(backend keyringBackend, timeout time.Duration) error {
+	c := &keyringStore{
+		backend:        backend,
+		timeout:        timeout,
+		keyringSvcName: keyringServiceName,
+	}
+	account := keyringProbeAccountPrefix + uuid.New().String()
+	err := c.withTimeout("get", func() error {
+		_, gerr := c.backend.Get(c.keyringSvcName, account)
+		return gerr
+	})
+	if errors.Is(err, keyring.ErrNotFound) {
+		return nil
 	}
-	raw, err := json.Marshal(keyringEntry{Token: t})
+	return err
+}
+
+// Put implements the Store interface.
+func (k *keyringStore) Put(key string, e Entry) error {
+	raw, err := json.Marshal(keyringEntry(e))
 	if err != nil {
 		return fmt.Errorf("marshal token: %w", err)
 	}
@@ -100,8 +155,19 @@ func (k *keyringCache) Store(key string, t *oauth2.Token) error {
 	})
 }
 
-// Lookup returns the token under key or cache.ErrNotFound.
-func (k *keyringCache) Lookup(key string) (*oauth2.Token, error) {
+// Delete implements the Store interface. Removing a missing entry is a no-op.
+func (k *keyringStore) Delete(key string) error {
+	return k.withTimeout("delete", func() error {
+		err := k.backend.Delete(k.keyringSvcName, key)
+		if errors.Is(err, keyring.ErrNotFound) {
+			return nil
+		}
+		return err
+	})
+}
+
+// Lookup implements the Store interface, returning ErrNotFound on a miss.
+func (k *keyringStore) Lookup(key string) (Entry, error) {
 	var raw string
 	err := k.withTimeout("get", func() error {
 		got, gerr := k.backend.Get(k.keyringSvcName, key)
@@ -112,21 +178,39 @@ func (k *keyringCache) Lookup(key string) (*oauth2.Token, error) {
 		return nil
 	})
 	if errors.Is(err, keyring.ErrNotFound) {
-		return nil, cache.ErrNotFound
+		return Entry{}, ErrNotFound
 	}
 	if err != nil {
-		return nil, err
+		return Entry{}, wrapKeyringUnreachable(err)
 	}
 
 	var entry keyringEntry
 	if err := json.Unmarshal([]byte(raw), &entry); err != nil {
-		return nil, fmt.Errorf("unmarshal token: %w", err)
+		return Entry{}, fmt.Errorf("unmarshal token: %w", err)
+	}
+	return Entry(entry), nil
+}
+
+// wrapKeyringUnreachable wraps a non-ErrNotFound keyring error with
+// actionable guidance for users whose system has no usable keyring
+// backend (Linux without a Secret Service / D-Bus session bus, headless
+// containers, certain SSH sessions). Surfaces on the read path, where
+// the resolver does not silently fall back to plaintext: a missing
+// token might actually be reachable from the keyring on another machine,
+// so we surface the unreachability instead of minting a fresh plaintext
+// copy.
+//
+// ErrNotFound passes through unchanged because a clean miss is not an
+// availability problem.
+func wrapKeyringUnreachable(err error) error {
+	if err == nil || errors.Is(err, keyring.ErrNotFound) {
+		return err
 	}
-	return entry.Token, nil
+	return fmt.Errorf("OS keyring unreachable: %w (set DATABRICKS_AUTH_STORAGE=plaintext or run `databricks auth login` to use file-based token storage)", err)
 }
 
-// Compile-time confirmation that keyringCache satisfies the SDK interface.
-var _ cache.TokenCache = (*keyringCache)(nil)
+// Compile-time confirmation that keyringStore satisfies the CLI interface.
+var _ Store = (*keyringStore)(nil)
 
 // TimeoutError is returned when a keyring operation exceeds the configured
 // timeout. Callers can use errors.As to detect and present a clear message.
@@ -143,7 +227,7 @@ func (e *TimeoutError) Error() string {
 // goroutine is not cancelled; it will complete (or outlive the process)
 // in the background. This mirrors the pattern used by GitHub CLI; see
 // https://github.com/cli/cli/blob/trunk/internal/keyring/keyring.go.
-func (k *keyringCache) withTimeout(op string, fn func() error) error {
+func (k *keyringStore) withTimeout(op string, fn func() error) error {
 	ch := make(chan error, 1)
 	go func() {
 		ch <- fn()
diff --git a/libs/auth/storage/keyring_test.go b/libs/auth/storage/keyring_test.go
index 74ea3c0c63f..7418bf7c7e8 100644
--- a/libs/auth/storage/keyring_test.go
+++ b/libs/auth/storage/keyring_test.go
@@ -6,7 +6,6 @@ import (
 	"testing"
 	"time"
 
-	"github.com/databricks/databricks-sdk-go/credentials/u2m/cache"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"github.com/zalando/go-keyring"
@@ -69,21 +68,21 @@ func (f *fakeBackend) Delete(service, account string) error {
 	return nil
 }
 
-func newTestCache(backend keyringBackend) *keyringCache {
-	return &keyringCache{
+func newTestStore(backend keyringBackend) *keyringStore {
+	return &keyringStore{
 		backend:        backend,
 		timeout:        100 * time.Millisecond,
 		keyringSvcName: "databricks-cli",
 	}
 }
 
-func TestKeyringCache_Store_WritesJSON(t *testing.T) {
+func TestKeyringStore_Store_WritesJSON(t *testing.T) {
 	backend := newFakeBackend()
-	c := newTestCache(backend)
+	c := newTestStore(backend)
 
 	tok := &oauth2.Token{AccessToken: "abc", TokenType: "Bearer"}
 
-	require.NoError(t, c.Store("my-profile", tok))
+	require.NoError(t, c.Put("my-profile", Entry{Token: tok}))
 
 	stored, ok := backend.items[itemKey("databricks-cli", "my-profile")]
 	require.True(t, ok, "token should be stored under service=databricks-cli, account=my-profile")
@@ -95,98 +94,117 @@ func TestKeyringCache_Store_WritesJSON(t *testing.T) {
 	assert.Equal(t, "Bearer", got.Token.TokenType)
 }
 
-func TestKeyringCache_Store_PropagatesBackendError(t *testing.T) {
+func TestKeyringStore_Store_PropagatesBackendError(t *testing.T) {
 	boom := errors.New("backend boom")
 	backend := newFakeBackend()
 	backend.setErr = boom
-	c := newTestCache(backend)
+	c := newTestStore(backend)
 
-	err := c.Store("my-profile", &oauth2.Token{AccessToken: "x"})
+	err := c.Put("my-profile", Entry{Token: &oauth2.Token{AccessToken: "x"}})
 	require.Error(t, err)
 	assert.ErrorIs(t, err, boom)
 }
 
-func TestKeyringCache_Lookup_ReturnsStoredToken(t *testing.T) {
+func TestKeyringStore_Lookup_ReturnsStoredToken(t *testing.T) {
 	backend := newFakeBackend()
-	c := newTestCache(backend)
+	c := newTestStore(backend)
 
 	want := &oauth2.Token{AccessToken: "abc", TokenType: "Bearer"}
-	require.NoError(t, c.Store("my-profile", want))
+	require.NoError(t, c.Put("my-profile", Entry{Token: want}))
 
 	got, err := c.Lookup("my-profile")
 	require.NoError(t, err)
-	assert.Equal(t, "abc", got.AccessToken)
-	assert.Equal(t, "Bearer", got.TokenType)
+	assert.Equal(t, "abc", got.Token.AccessToken)
+	assert.Equal(t, "Bearer", got.Token.TokenType)
 }
 
-func TestKeyringCache_Lookup_MissingReturnsCacheErrNotFound(t *testing.T) {
+func TestKeyringStore_Lookup_MissingReturnsCacheErrNotFound(t *testing.T) {
 	backend := newFakeBackend()
-	c := newTestCache(backend)
+	c := newTestStore(backend)
 
 	_, err := c.Lookup("nope")
 	require.Error(t, err)
-	assert.ErrorIs(t, err, cache.ErrNotFound)
+	assert.ErrorIs(t, err, ErrNotFound)
 }
 
-func TestKeyringCache_Lookup_PropagatesOtherErrors(t *testing.T) {
+func TestKeyringStore_Lookup_PropagatesOtherErrors(t *testing.T) {
 	boom := errors.New("backend boom")
 	backend := newFakeBackend()
 	backend.getErr = boom
-	c := newTestCache(backend)
+	c := newTestStore(backend)
 
 	_, err := c.Lookup("my-profile")
 	require.Error(t, err)
 	assert.ErrorIs(t, err, boom)
+	// The non-ErrNotFound path wraps the backend error with actionable
+	// guidance so users on systems without a usable keyring backend
+	// (e.g. headless Linux) know what to do.
+	assert.Contains(t, err.Error(), "OS keyring unreachable")
+	assert.Contains(t, err.Error(), "DATABRICKS_AUTH_STORAGE=plaintext")
+	assert.Contains(t, err.Error(), "databricks auth login")
+}
+
+// ErrNotFound has to pass through unwrapped because callers branch on it
+// (ErrNotFound is the "no token, please log in" signal). Wrapping it
+// with the unreachability hint would mislead the user.
+func TestKeyringStore_Lookup_NotFoundIsNotWrapped(t *testing.T) {
+	backend := newFakeBackend()
+	c := newTestStore(backend)
+
+	_, err := c.Lookup("nope")
+	require.Error(t, err)
+	assert.ErrorIs(t, err, ErrNotFound)
+	assert.NotContains(t, err.Error(), "OS keyring unreachable")
 }
 
-func TestKeyringCache_Lookup_CorruptedJSONReturnsError(t *testing.T) {
+func TestKeyringStore_Lookup_CorruptedJSONReturnsError(t *testing.T) {
 	backend := newFakeBackend()
 	backend.items[itemKey("databricks-cli", "my-profile")] = "{not json"
-	c := newTestCache(backend)
+	c := newTestStore(backend)
 
 	_, err := c.Lookup("my-profile")
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "unmarshal token")
 }
 
-func TestKeyringCache_StoreNil_DeletesEntry(t *testing.T) {
+func TestKeyringStore_StoreNil_DeletesEntry(t *testing.T) {
 	backend := newFakeBackend()
-	c := newTestCache(backend)
+	c := newTestStore(backend)
 
-	require.NoError(t, c.Store("my-profile", &oauth2.Token{AccessToken: "abc"}))
-	require.NoError(t, c.Store("my-profile", nil))
+	require.NoError(t, c.Put("my-profile", Entry{Token: &oauth2.Token{AccessToken: "abc"}}))
+	require.NoError(t, c.Delete("my-profile"))
 
 	_, ok := backend.items[itemKey("databricks-cli", "my-profile")]
 	assert.False(t, ok, "entry should be gone after delete")
 }
 
-func TestKeyringCache_StoreNil_MissingIsIdempotent(t *testing.T) {
+func TestKeyringStore_StoreNil_MissingIsIdempotent(t *testing.T) {
 	backend := newFakeBackend()
 	backend.deleteErr = keyring.ErrNotFound
-	c := newTestCache(backend)
+	c := newTestStore(backend)
 
-	err := c.Store("never-stored", nil)
+	err := c.Delete("never-stored")
 	require.NoError(t, err, "deleting a missing entry must not error")
 }
 
-func TestKeyringCache_StoreNil_PropagatesOtherDeleteErrors(t *testing.T) {
+func TestKeyringStore_StoreNil_PropagatesOtherDeleteErrors(t *testing.T) {
 	boom := errors.New("backend boom")
 	backend := newFakeBackend()
 	backend.deleteErr = boom
-	c := newTestCache(backend)
+	c := newTestStore(backend)
 
-	err := c.Store("my-profile", nil)
+	err := c.Delete("my-profile")
 	require.Error(t, err)
 	assert.ErrorIs(t, err, boom)
 }
 
-func TestKeyringCache_Store_TimesOut(t *testing.T) {
+func TestKeyringStore_Store_TimesOut(t *testing.T) {
 	backend := newFakeBackend()
 	backend.setBlock = true
-	c := newTestCache(backend) // 100ms timeout from newTestCache
+	c := newTestStore(backend) // 100ms timeout from newTestStore
 
 	start := time.Now()
-	err := c.Store("my-profile", &oauth2.Token{AccessToken: "x"})
+	err := c.Put("my-profile", Entry{Token: &oauth2.Token{AccessToken: "x"}})
 	require.Error(t, err)
 
 	var timeoutErr *TimeoutError
@@ -194,10 +212,10 @@ func TestKeyringCache_Store_TimesOut(t *testing.T) {
 	assert.Less(t, time.Since(start), 2*time.Second, "should time out quickly")
 }
 
-func TestKeyringCache_Lookup_TimesOut(t *testing.T) {
+func TestKeyringStore_Lookup_TimesOut(t *testing.T) {
 	backend := newFakeBackend()
 	backend.getBlock = true
-	c := newTestCache(backend)
+	c := newTestStore(backend)
 
 	_, err := c.Lookup("my-profile")
 	require.Error(t, err)
@@ -206,14 +224,130 @@ func TestKeyringCache_Lookup_TimesOut(t *testing.T) {
 	assert.ErrorAs(t, err, &timeoutErr, "expected TimeoutError, got %T: %v", err, err)
 }
 
-func TestKeyringCache_StoreNil_TimesOut(t *testing.T) {
+func TestKeyringStore_StoreNil_TimesOut(t *testing.T) {
 	backend := newFakeBackend()
 	backend.deleteBlock = true
-	c := newTestCache(backend)
+	c := newTestStore(backend)
 
-	err := c.Store("my-profile", nil)
+	err := c.Delete("my-profile")
 	require.Error(t, err)
 
 	var timeoutErr *TimeoutError
 	assert.ErrorAs(t, err, &timeoutErr, "expected TimeoutError, got %T: %v", err, err)
 }
+
+func TestProbeKeyring(t *testing.T) {
+	boom := errors.New("backend boom")
+	cases := []struct {
+		name        string
+		setErr      error
+		deleteErr   error
+		setBlock    bool
+		timeout     time.Duration
+		wantErr     error
+		wantTimeout bool
+	}{
+		{
+			name:    "success leaves no entry",
+			timeout: 100 * time.Millisecond,
+		},
+		{
+			name:    "set error propagates",
+			setErr:  boom,
+			timeout: 100 * time.Millisecond,
+			wantErr: boom,
+		},
+		{
+			name:        "set times out",
+			setBlock:    true,
+			timeout:     50 * time.Millisecond,
+			wantTimeout: true,
+		},
+		{
+			name:      "delete error propagates",
+			deleteErr: boom,
+			timeout:   100 * time.Millisecond,
+			wantErr:   boom,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			backend := newFakeBackend()
+			backend.setErr = tc.setErr
+			backend.deleteErr = tc.deleteErr
+			backend.setBlock = tc.setBlock
+
+			err := probeWithBackend(backend, tc.timeout)
+
+			switch {
+			case tc.wantErr != nil:
+				require.Error(t, err)
+				assert.ErrorIs(t, err, tc.wantErr)
+			case tc.wantTimeout:
+				require.Error(t, err)
+				var timeoutErr *TimeoutError
+				assert.ErrorAs(t, err, &timeoutErr)
+			default:
+				require.NoError(t, err)
+				assert.Empty(t, backend.items, "probe must clean up after itself")
+			}
+		})
+	}
+}
+
+func TestProbeKeyringRead(t *testing.T) {
+	boom := errors.New("backend boom")
+	cases := []struct {
+		name        string
+		getErr      error
+		getBlock    bool
+		timeout     time.Duration
+		wantErr     error
+		wantTimeout bool
+	}{
+		{
+			// keyring.ErrNotFound is the success signal: the backend
+			// responded that no entry exists for our probe account,
+			// which means it is reachable.
+			name:    "ErrNotFound counts as reachable",
+			getErr:  keyring.ErrNotFound,
+			timeout: 100 * time.Millisecond,
+		},
+		{
+			name:    "other backend error propagates",
+			getErr:  boom,
+			timeout: 100 * time.Millisecond,
+			wantErr: boom,
+		},
+		{
+			name:        "get times out",
+			getBlock:    true,
+			timeout:     50 * time.Millisecond,
+			wantTimeout: true,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			backend := newFakeBackend()
+			backend.getErr = tc.getErr
+			backend.getBlock = tc.getBlock
+
+			err := probeReadWithBackend(backend, tc.timeout)
+
+			switch {
+			case tc.wantErr != nil:
+				require.Error(t, err)
+				assert.ErrorIs(t, err, tc.wantErr)
+			case tc.wantTimeout:
+				require.Error(t, err)
+				var timeoutErr *TimeoutError
+				assert.ErrorAs(t, err, &timeoutErr)
+			default:
+				require.NoError(t, err)
+				assert.Empty(t, backend.items, "read probe must not write to the keyring")
+			}
+		})
+	}
+}
diff --git a/libs/auth/storage/memory.go b/libs/auth/storage/memory.go
new file mode 100644
index 00000000000..60918968c31
--- /dev/null
+++ b/libs/auth/storage/memory.go
@@ -0,0 +1,60 @@
+package storage
+
+import (
+	"sync"
+
+	"golang.org/x/oauth2"
+)
+
+// NewMemoryStore returns a Store that stores entries in process
+// memory only. Tokens do not persist across process restarts. This is the
+// default store used by PersistentAuth when no WithTokenStore option is
+// provided. Most production consumers should supply a persistent Store.
+func NewMemoryStore() Store {
+	return &memoryStore{entries: map[string]Entry{}}
+}
+
+type memoryStore struct {
+	mu      sync.Mutex
+	entries map[string]Entry
+}
+
+func cloneToken(t *oauth2.Token) *oauth2.Token {
+	if t == nil {
+		return nil
+	}
+	clone := *t
+	return &clone
+}
+
+func cloneEntry(e Entry) Entry {
+	e.Token = cloneToken(e.Token)
+	return e
+}
+
+// Put implements Store.
+func (s *memoryStore) Put(key string, e Entry) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.entries[key] = cloneEntry(e)
+	return nil
+}
+
+// Lookup implements Store. Returns ErrNotFound when the key is absent.
+func (s *memoryStore) Lookup(key string) (Entry, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	e, ok := s.entries[key]
+	if !ok {
+		return Entry{}, ErrNotFound
+	}
+	return cloneEntry(e), nil
+}
+
+// Delete implements Store.
+func (s *memoryStore) Delete(key string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	delete(s.entries, key)
+	return nil
+}
diff --git a/libs/auth/storage/memory_test.go b/libs/auth/storage/memory_test.go
new file mode 100644
index 00000000000..abccf029248
--- /dev/null
+++ b/libs/auth/storage/memory_test.go
@@ -0,0 +1,100 @@
+package storage
+
+import (
+	"errors"
+	"fmt"
+	"sync"
+	"testing"
+
+	"golang.org/x/oauth2"
+)
+
+func TestMemoryStore_PutAndLookup(t *testing.T) {
+	s := NewMemoryStore()
+	tok := &oauth2.Token{AccessToken: "abc", RefreshToken: "def"}
+	if err := s.Put("key1", Entry{Token: tok}); err != nil {
+		t.Fatalf("Put: %v", err)
+	}
+	got, err := s.Lookup("key1")
+	if err != nil {
+		t.Fatalf("Lookup: %v", err)
+	}
+	if got.Token.AccessToken != "abc" {
+		t.Errorf("AccessToken: want %q, got %q", "abc", got.Token.AccessToken)
+	}
+	if got.Token.RefreshToken != "def" {
+		t.Errorf("RefreshToken: want %q, got %q", "def", got.Token.RefreshToken)
+	}
+}
+
+func TestMemoryStore_PutAndLookupUseCopies(t *testing.T) {
+	s := NewMemoryStore()
+	tok := &oauth2.Token{AccessToken: "abc", RefreshToken: "def"}
+	if err := s.Put("key1", Entry{Token: tok}); err != nil {
+		t.Fatalf("Put: %v", err)
+	}
+
+	tok.RefreshToken = "mutated-after-store"
+
+	got, err := s.Lookup("key1")
+	if err != nil {
+		t.Fatalf("Lookup: %v", err)
+	}
+	if got.Token.RefreshToken != "def" {
+		t.Fatalf("RefreshToken after store mutation: want %q, got %q", "def", got.Token.RefreshToken)
+	}
+
+	got.Token.RefreshToken = "mutated-after-lookup"
+
+	gotAgain, err := s.Lookup("key1")
+	if err != nil {
+		t.Fatalf("Lookup after lookup mutation: %v", err)
+	}
+	if gotAgain.Token.RefreshToken != "def" {
+		t.Fatalf("RefreshToken after lookup mutation: want %q, got %q", "def", gotAgain.Token.RefreshToken)
+	}
+}
+
+func TestMemoryStore_Delete(t *testing.T) {
+	s := NewMemoryStore()
+	if err := s.Put("key1", Entry{Token: &oauth2.Token{AccessToken: "abc"}}); err != nil {
+		t.Fatalf("Put: %v", err)
+	}
+	if err := s.Delete("key1"); err != nil {
+		t.Fatalf("Delete: %v", err)
+	}
+	_, err := s.Lookup("key1")
+	if !errors.Is(err, ErrNotFound) {
+		t.Errorf("Lookup after Delete: want ErrNotFound, got %v", err)
+	}
+}
+
+func TestMemoryStore_LookupUnsetKey(t *testing.T) {
+	s := NewMemoryStore()
+	_, err := s.Lookup("missing")
+	if !errors.Is(err, ErrNotFound) {
+		t.Errorf("Lookup(missing): want ErrNotFound, got %v", err)
+	}
+}
+
+func TestMemoryStore_ConcurrentPutAndLookup(t *testing.T) {
+	s := NewMemoryStore()
+	const goroutines = 20
+	const iterations = 100
+	var wg sync.WaitGroup
+	for i := range goroutines {
+		prefix := fmt.Sprintf("writer-%d", i)
+		wg.Go(func() {
+			for j := range iterations {
+				key := fmt.Sprintf("%s-%d", prefix, j)
+				_ = s.Put(key, Entry{Token: &oauth2.Token{AccessToken: key}})
+			}
+		})
+		wg.Go(func() {
+			for j := range iterations {
+				_, _ = s.Lookup(fmt.Sprintf("%s-%d", prefix, j))
+			}
+		})
+	}
+	wg.Wait()
+}
diff --git a/libs/auth/storage/mode.go b/libs/auth/storage/mode.go
index b3dc846536b..b247bb60940 100644
--- a/libs/auth/storage/mode.go
+++ b/libs/auth/storage/mode.go
@@ -1,9 +1,3 @@
-// Package storage selects and constructs the CLI's U2M token storage backend.
-//
-// Two modes are supported. Plaintext writes to ~/.databricks/token-cache.json
-// with host-key dual-write for older Go SDK versions (v0.61-v0.103); it is the
-// resolver default. Secure writes to the OS-native keyring under the profile
-// cache key only; it is opt-in pre-GA and slated to become the default at GA.
 package storage
 
 import (
@@ -26,18 +20,65 @@ const (
 
 	// StorageModePlaintext writes tokens to ~/.databricks/token-cache.json
 	// and mirrors each token under the legacy host-based cache key for
-	// older Go SDK versions (v0.61-v0.103). This is the resolver default.
+	// older Go SDK versions (v0.61-v0.103). Opt-in via DATABRICKS_AUTH_STORAGE
+	// or [__settings__].auth_storage for environments where the OS keyring
+	// is not available.
 	StorageModePlaintext StorageMode = "plaintext"
 
 	// StorageModeSecure writes tokens to the OS-native secure store
 	// (macOS Keychain, Windows Credential Manager, Linux Secret Service)
 	// under the profile cache key only. No host-key entry is written.
+	// This is the resolver default.
 	StorageModeSecure StorageMode = "secure"
 )
 
 // EnvVar is the environment variable that selects the storage mode.
 const EnvVar = "DATABRICKS_AUTH_STORAGE"
 
+// StorageSource identifies which precedence level produced the resolved
+// storage mode. Callers use it both to decide whether the user explicitly
+// asked for a mode (everything except StorageSourceDefault) and to surface
+// where the choice came from in user-facing output.
+type StorageSource int
+
+const (
+	// StorageSourceDefault is the zero value: no override, env, or config
+	// was set, so the resolver fell through to the built-in default.
+	StorageSourceDefault StorageSource = iota
+	StorageSourceOverride
+	StorageSourceEnvVar
+	StorageSourceConfig
+)
+
+// Explicit reports whether the source came from a user-supplied input
+// (override flag, env var, or config) rather than the built-in default.
+func (s StorageSource) Explicit() bool {
+	return s != StorageSourceDefault
+}
+
+// String returns a human-readable label for the source, matching the style
+// used by the SDK's config.Source.String() (e.g. "DATABRICKS_HOST environment
+// variable").
+//
+// The label for StorageSourceConfig intentionally does not name a specific
+// config file: callers that know the resolved path (e.g. auth describe)
+// should append it themselves to match the SDK's "from <path> config file"
+// convention. The label for StorageSourceOverride is generic because no
+// CLI command currently exposes a storage-mode flag; if one is added in
+// the future, that command can replace the label at the call site.
+func (s StorageSource) String() string {
+	switch s {
+	case StorageSourceOverride:
+		return "command-line override"
+	case StorageSourceEnvVar:
+		return EnvVar + " environment variable"
+	case StorageSourceConfig:
+		return "auth_storage in [__settings__] section of config file"
+	default:
+		return "default"
+	}
+}
+
 // ParseMode parses raw as a StorageMode. Whitespace is trimmed and matching
 // is case-insensitive. Empty or unrecognized input returns StorageModeUnknown;
 // callers decide whether that is an error (user-supplied value) or a
@@ -57,7 +98,7 @@ func ParseMode(raw string) StorageMode {
 //  1. override (typically from a command-level flag such as --secure-storage).
 //  2. DATABRICKS_AUTH_STORAGE env var.
 //  3. [__settings__].auth_storage in .databrickscfg.
-//  4. StorageModePlaintext.
+//  4. StorageModeSecure.
 //
 // StorageModeUnknown as override means "no flag set; fall through." The
 // override is trusted to be a valid StorageMode: callers that parse user
@@ -65,24 +106,36 @@ func ParseMode(raw string) StorageMode {
 // unrecognized env or config value is reported as an error wrapped with
 // the source name.
 func ResolveStorageMode(ctx context.Context, override StorageMode) (StorageMode, error) {
+	mode, _, err := ResolveStorageModeWithSource(ctx, override)
+	return mode, err
+}
+
+// ResolveStorageModeWithSource is like ResolveStorageMode but also reports
+// which precedence level produced the resolved mode. Callers use the source
+// both to honor "I want secure" strictly (when source.Explicit() is true and
+// secure cannot be provided, error out instead of silently downgrading) and
+// to surface where the choice came from in user-facing output.
+func ResolveStorageModeWithSource(ctx context.Context, override StorageMode) (StorageMode, StorageSource, error) {
 	if override != StorageModeUnknown {
-		return override, nil
+		return override, StorageSourceOverride, nil
 	}
 
 	if raw := env.Get(ctx, EnvVar); raw != "" {
-		return parseFromSource(raw, EnvVar)
+		mode, err := parseFromSource(raw, EnvVar)
+		return mode, StorageSourceEnvVar, err
 	}
 
 	configPath := env.Get(ctx, "DATABRICKS_CONFIG_FILE")
 	raw, err := databrickscfg.GetConfiguredAuthStorage(ctx, configPath)
 	if err != nil {
-		return "", fmt.Errorf("read auth_storage setting: %w", err)
+		return "", StorageSourceDefault, fmt.Errorf("read auth_storage setting: %w", err)
 	}
 	if raw != "" {
-		return parseFromSource(raw, "auth_storage")
+		mode, err := parseFromSource(raw, "auth_storage")
+		return mode, StorageSourceConfig, err
 	}
 
-	return StorageModePlaintext, nil
+	return StorageModeSecure, StorageSourceDefault, nil
 }
 
 func parseFromSource(raw, source string) (StorageMode, error) {
diff --git a/libs/auth/storage/mode_test.go b/libs/auth/storage/mode_test.go
index d932d2253a2..431cc903801 100644
--- a/libs/auth/storage/mode_test.go
+++ b/libs/auth/storage/mode_test.go
@@ -41,7 +41,7 @@ func TestResolveStorageMode(t *testing.T) {
 	}{
 		{
 			name: "default when nothing is set",
-			want: StorageModePlaintext,
+			want: StorageModeSecure,
 		},
 		{
 			name:       "override wins over env and config",
@@ -63,8 +63,8 @@ func TestResolveStorageMode(t *testing.T) {
 		},
 		{
 			name:       "config sets mode when env and override unset",
-			configBody: "[__settings__]\nauth_storage = secure\n",
-			want:       StorageModeSecure,
+			configBody: "[__settings__]\nauth_storage = plaintext\n",
+			want:       StorageModePlaintext,
 		},
 		{
 			name:     "env value is case-insensitive and trimmed",
@@ -128,3 +128,84 @@ func TestResolveStorageMode_SkipsConfigReadWhenOverrideOrEnvSet(t *testing.T) {
 		assert.Equal(t, StorageModeSecure, got)
 	})
 }
+
+func TestResolveStorageModeWithSource(t *testing.T) {
+	cases := []struct {
+		name       string
+		override   StorageMode
+		envValue   string
+		configBody string
+		wantMode   StorageMode
+		wantSource StorageSource
+		wantErrSub string
+	}{
+		{
+			name:       "default",
+			wantMode:   StorageModeSecure,
+			wantSource: StorageSourceDefault,
+		},
+		{
+			name:       "override",
+			override:   StorageModePlaintext,
+			wantMode:   StorageModePlaintext,
+			wantSource: StorageSourceOverride,
+		},
+		{
+			name:       "env",
+			envValue:   "plaintext",
+			wantMode:   StorageModePlaintext,
+			wantSource: StorageSourceEnvVar,
+		},
+		{
+			name:       "config",
+			configBody: "[__settings__]\nauth_storage = secure\n",
+			wantMode:   StorageModeSecure,
+			wantSource: StorageSourceConfig,
+		},
+		{
+			name:       "invalid env is rejected",
+			envValue:   "bogus",
+			wantErrSub: "DATABRICKS_AUTH_STORAGE",
+		},
+		{
+			name:       "invalid config value is rejected",
+			configBody: "[__settings__]\nauth_storage = bogus\n",
+			wantErrSub: "auth_storage",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			cfgPath := filepath.Join(t.TempDir(), ".databrickscfg")
+			if tc.configBody != "" {
+				require.NoError(t, os.WriteFile(cfgPath, []byte(tc.configBody), 0o600))
+			}
+			t.Setenv("DATABRICKS_CONFIG_FILE", cfgPath)
+			t.Setenv(EnvVar, tc.envValue)
+
+			mode, source, err := ResolveStorageModeWithSource(t.Context(), tc.override)
+			if tc.wantErrSub != "" {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), tc.wantErrSub)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tc.wantMode, mode)
+			assert.Equal(t, tc.wantSource, source)
+		})
+	}
+}
+
+func TestStorageSource_Explicit(t *testing.T) {
+	assert.False(t, StorageSourceDefault.Explicit())
+	assert.True(t, StorageSourceOverride.Explicit())
+	assert.True(t, StorageSourceEnvVar.Explicit())
+	assert.True(t, StorageSourceConfig.Explicit())
+}
+
+func TestStorageSource_String(t *testing.T) {
+	assert.Equal(t, "default", StorageSourceDefault.String())
+	assert.Equal(t, "command-line override", StorageSourceOverride.String())
+	assert.Equal(t, "DATABRICKS_AUTH_STORAGE environment variable", StorageSourceEnvVar.String())
+	assert.Equal(t, "auth_storage in [__settings__] section of config file", StorageSourceConfig.String())
+}
diff --git a/libs/auth/storage/not_found_hint.go b/libs/auth/storage/not_found_hint.go
new file mode 100644
index 00000000000..76ac854fa56
--- /dev/null
+++ b/libs/auth/storage/not_found_hint.go
@@ -0,0 +1,119 @@
+package storage
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"os"
+	"path/filepath"
+
+	"github.com/databricks/cli/libs/env"
+)
+
+// notFoundHintStore wraps a Store so Lookup returns ErrNotFound with
+// a hint pointing the user at `databricks auth login`. When mode is secure
+// and the legacy file-backed cache has entries, the hint uses the upgrade-
+// specific copy so users who logged in with an older CLI version know why
+// their cached credentials are no longer being read.
+//
+// errors.Is(err, ErrNotFound) continues to return true because the
+// wrap uses %w; PersistentAuth's branches on ErrNotFound still fire.
+//
+// Put and Delete are delegated unchanged; only Lookup needs the message polish.
+type notFoundHintStore struct {
+	inner           Store
+	mode            StorageMode
+	legacyStorePath string
+}
+
+func (s *notFoundHintStore) Put(key string, e Entry) error {
+	return s.inner.Put(key, e)
+}
+
+func (s *notFoundHintStore) Lookup(key string) (Entry, error) {
+	e, err := s.inner.Lookup(key)
+	if err == nil || !errors.Is(err, ErrNotFound) {
+		return e, err
+	}
+	if s.mode == StorageModeSecure && legacyStoreHasTokens(s.legacyStorePath) {
+		return Entry{}, &notFoundHint{msg: "stored credentials from older CLI versions are no longer used; run `databricks auth login` to sign in again, or set DATABRICKS_AUTH_STORAGE=plaintext to keep using the file cache"}
+	}
+	return Entry{}, &notFoundHint{msg: "no cached credentials; run `databricks auth login` to sign in"}
+}
+
+func (s *notFoundHintStore) Delete(key string) error { return s.inner.Delete(key) }
+
+// notFoundHint replaces ErrNotFound's terse "token not found" string
+// with an actionable message while still satisfying errors.Is(err,
+// ErrNotFound). PersistentAuth.loadToken wraps every store error with
+// "cache: %w", and fmt.Errorf("...: %w", ErrNotFound) would tack the
+// original "token not found" onto the end of our hint, producing
+// "cache: <hint>: token not found". A custom type lets us own the
+// rendered message while still unwrapping to ErrNotFound for callers
+// that branch on it.
+type notFoundHint struct {
+	msg string
+}
+
+func (e *notFoundHint) Error() string { return e.msg }
+func (e *notFoundHint) Unwrap() error { return ErrNotFound }
+
+// HintForNotFound extracts the actionable hint message from an error
+// chain produced by notFoundHintStore. Returns the empty string if the
+// chain does not contain a notFoundHint (e.g. an unwrapped
+// ErrNotFound from a plain Store).
+//
+// Used by call sites like `auth token` that rewrite the SDK error for
+// backwards-compatibility (the "databricks OAuth is not configured for
+// this host" substring is load-bearing for older SDK fall-through
+// logic) but want to surface the actionable hint to the user instead of
+// dropping it.
+func HintForNotFound(err error) string {
+	if hint, ok := errors.AsType[*notFoundHint](err); ok {
+		return hint.msg
+	}
+	return ""
+}
+
+// NewNotFoundHint returns an error that renders as msg but unwraps to
+// ErrNotFound, mirroring what notFoundHintStore produces in
+// production. Exported so tests in other packages (e.g. cmd/auth) can
+// construct a hint-wrapped error without going through the full
+// resolver setup.
+func NewNotFoundHint(msg string) error {
+	return &notFoundHint{msg: msg}
+}
+
+// withNotFoundHint wraps inner so ErrNotFound from Lookup carries an
+// actionable hint. The legacy file path is resolved up front (where ctx
+// is available) so Lookup can do its check without needing a context.
+//
+// Resolution failures for the home directory are not fatal: an empty
+// legacyStorePath simply disables the upgrade-specific message, which
+// falls back to the generic "run auth login" hint.
+func withNotFoundHint(ctx context.Context, inner Store, mode StorageMode) Store {
+	var legacyStorePath string
+	if home, err := env.UserHomeDir(ctx); err == nil {
+		legacyStorePath = filepath.Join(home, tokenStoreFilePath)
+	}
+	return &notFoundHintStore{inner: inner, mode: mode, legacyStorePath: legacyStorePath}
+}
+
+// legacyStoreHasTokens reports whether the file at path is a valid token
+// cache with at least one entry. Best-effort and read-only: any I/O or
+// parse error returns false so we never claim "you have legacy tokens"
+// when we cannot actually tell.
+func legacyStoreHasTokens(path string) bool {
+	if path == "" {
+		return false
+	}
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		return false
+	}
+	var f tokenStoreFile
+	if err := json.Unmarshal(raw, &f); err != nil {
+		return false
+	}
+	return len(f.Tokens) > 0
+}
diff --git a/libs/auth/storage/not_found_hint_test.go b/libs/auth/storage/not_found_hint_test.go
new file mode 100644
index 00000000000..f2b197ac2d6
--- /dev/null
+++ b/libs/auth/storage/not_found_hint_test.go
@@ -0,0 +1,182 @@
+package storage
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/oauth2"
+)
+
+// missingStore always returns ErrNotFound on Lookup. Lets us drive the
+// wrapper without going through the real file or keyring cache.
+type missingStore struct{}
+
+func (missingStore) Put(string, Entry) error      { return nil }
+func (missingStore) Lookup(string) (Entry, error) { return Entry{}, ErrNotFound }
+func (missingStore) Delete(string) error          { return nil }
+
+// foundStore always returns a token. Used to confirm the wrapper passes
+// successful lookups through unchanged.
+type foundStore struct{ tok *oauth2.Token }
+
+func (s foundStore) Put(string, Entry) error      { return nil }
+func (s foundStore) Lookup(string) (Entry, error) { return Entry{Token: s.tok}, nil }
+func (s foundStore) Delete(string) error          { return nil }
+
+// boomStore returns a non-ErrNotFound error. The wrapper must not add a
+// "run auth login" hint here; the error is about something else.
+type boomStore struct{ err error }
+
+func (s boomStore) Put(string, Entry) error      { return nil }
+func (s boomStore) Lookup(string) (Entry, error) { return Entry{}, s.err }
+func (s boomStore) Delete(string) error          { return nil }
+
+func writeLegacyStore(t *testing.T, path string, hasEntries bool) {
+	t.Helper()
+	require.NoError(t, os.MkdirAll(filepath.Dir(path), 0o700))
+	tokens := map[string]*fileEntry{}
+	if hasEntries {
+		tokens["my-profile"] = &fileEntry{Token: &oauth2.Token{AccessToken: "abc"}}
+	}
+	body, err := json.Marshal(tokenStoreFile{Version: tokenStoreVersion, Tokens: tokens})
+	require.NoError(t, err)
+	require.NoError(t, os.WriteFile(path, body, 0o600))
+}
+
+func TestNotFoundHintStore_SecureWithLegacyEntries_UsesUpgradeMessage(t *testing.T) {
+	tmp := t.TempDir()
+	legacyPath := filepath.Join(tmp, tokenStoreFilePath)
+	writeLegacyStore(t, legacyPath, true)
+
+	c := &notFoundHintStore{inner: missingStore{}, mode: StorageModeSecure, legacyStorePath: legacyPath}
+	_, err := c.Lookup("anything")
+	require.Error(t, err)
+	assert.ErrorIs(t, err, ErrNotFound)
+	assert.Contains(t, err.Error(), "stored credentials from older CLI versions")
+	assert.Contains(t, err.Error(), "databricks auth login")
+	assert.Contains(t, err.Error(), "DATABRICKS_AUTH_STORAGE=plaintext")
+}
+
+func TestNotFoundHintStore_SecureWithEmptyLegacyFile_UsesGenericMessage(t *testing.T) {
+	tmp := t.TempDir()
+	legacyPath := filepath.Join(tmp, tokenStoreFilePath)
+	writeLegacyStore(t, legacyPath, false)
+
+	c := &notFoundHintStore{inner: missingStore{}, mode: StorageModeSecure, legacyStorePath: legacyPath}
+	_, err := c.Lookup("anything")
+	require.Error(t, err)
+	assert.ErrorIs(t, err, ErrNotFound)
+	assert.Contains(t, err.Error(), "no cached credentials")
+	assert.NotContains(t, err.Error(), "stored credentials from older CLI versions")
+}
+
+func TestNotFoundHintStore_SecureNoLegacyFile_UsesGenericMessage(t *testing.T) {
+	c := &notFoundHintStore{inner: missingStore{}, mode: StorageModeSecure, legacyStorePath: filepath.Join(t.TempDir(), "missing.json")}
+	_, err := c.Lookup("anything")
+	require.Error(t, err)
+	assert.ErrorIs(t, err, ErrNotFound)
+	assert.Contains(t, err.Error(), "no cached credentials")
+}
+
+func TestNotFoundHintStore_Plaintext_AlwaysGenericMessage(t *testing.T) {
+	tmp := t.TempDir()
+	legacyPath := filepath.Join(tmp, tokenStoreFilePath)
+	writeLegacyStore(t, legacyPath, true)
+
+	// Even with a populated legacy file present, plaintext mode reads from
+	// that same file, so the upgrade copy would be misleading.
+	c := &notFoundHintStore{inner: missingStore{}, mode: StorageModePlaintext, legacyStorePath: legacyPath}
+	_, err := c.Lookup("anything")
+	require.Error(t, err)
+	assert.ErrorIs(t, err, ErrNotFound)
+	assert.Contains(t, err.Error(), "no cached credentials")
+	assert.NotContains(t, err.Error(), "stored credentials from older CLI versions")
+}
+
+func TestNotFoundHintStore_NonErrNotFound_PassesThrough(t *testing.T) {
+	boom := errors.New("backend blew up")
+	c := &notFoundHintStore{inner: boomStore{err: boom}, mode: StorageModeSecure, legacyStorePath: ""}
+	_, err := c.Lookup("anything")
+	require.Error(t, err)
+	assert.ErrorIs(t, err, boom)
+	assert.NotContains(t, err.Error(), "no cached credentials")
+}
+
+func TestNotFoundHintStore_SuccessfulLookupUnchanged(t *testing.T) {
+	tok := &oauth2.Token{AccessToken: "abc"}
+	c := &notFoundHintStore{inner: foundStore{tok: tok}, mode: StorageModeSecure, legacyStorePath: ""}
+	got, err := c.Lookup("anything")
+	require.NoError(t, err)
+	assert.Equal(t, tok, got.Token)
+}
+
+func TestNotFoundHintStore_PutIsDelegated(t *testing.T) {
+	s := &notFoundHintStore{inner: missingStore{}, mode: StorageModeSecure, legacyStorePath: ""}
+	require.NoError(t, s.Put("k", Entry{Token: &oauth2.Token{AccessToken: "abc"}}))
+}
+
+func TestHintForNotFound(t *testing.T) {
+	t.Run("nil returns empty", func(t *testing.T) {
+		assert.Empty(t, HintForNotFound(nil))
+	})
+
+	t.Run("plain ErrNotFound returns empty", func(t *testing.T) {
+		// An unwrapped ErrNotFound carries no hint, so the caller
+		// (e.g. `auth token`) falls back to its default error path.
+		assert.Empty(t, HintForNotFound(ErrNotFound))
+	})
+
+	t.Run("unrelated error returns empty", func(t *testing.T) {
+		assert.Empty(t, HintForNotFound(errors.New("something else")))
+	})
+
+	t.Run("notFoundHint returns the hint message", func(t *testing.T) {
+		h := &notFoundHint{msg: "do the thing"}
+		assert.Equal(t, "do the thing", HintForNotFound(h))
+	})
+
+	t.Run("notFoundHint behind an fmt.Errorf wrap returns the hint", func(t *testing.T) {
+		// PersistentAuth wraps every store error with `cache: %w`, so the hint
+		// is one Unwrap away when it surfaces in callers. errors.As must
+		// still find it.
+		h := &notFoundHint{msg: "do the thing"}
+		wrapped := fmt.Errorf("cache: %w", h)
+		assert.Equal(t, "do the thing", HintForNotFound(wrapped))
+	})
+}
+
+func TestLegacyStoreHasTokens(t *testing.T) {
+	tmp := t.TempDir()
+
+	t.Run("empty path returns false", func(t *testing.T) {
+		assert.False(t, legacyStoreHasTokens(""))
+	})
+
+	t.Run("missing file returns false", func(t *testing.T) {
+		assert.False(t, legacyStoreHasTokens(filepath.Join(tmp, "missing.json")))
+	})
+
+	t.Run("garbage file returns false", func(t *testing.T) {
+		p := filepath.Join(tmp, "garbage.json")
+		require.NoError(t, os.WriteFile(p, []byte("not json"), 0o600))
+		assert.False(t, legacyStoreHasTokens(p))
+	})
+
+	t.Run("empty token map returns false", func(t *testing.T) {
+		p := filepath.Join(tmp, "empty.json")
+		writeLegacyStore(t, p, false)
+		assert.False(t, legacyStoreHasTokens(p))
+	})
+
+	t.Run("populated token map returns true", func(t *testing.T) {
+		p := filepath.Join(tmp, "populated.json")
+		writeLegacyStore(t, p, true)
+		assert.True(t, legacyStoreHasTokens(p))
+	})
+}
diff --git a/libs/auth/storage/storage.go b/libs/auth/storage/storage.go
new file mode 100644
index 00000000000..3aad20fc645
--- /dev/null
+++ b/libs/auth/storage/storage.go
@@ -0,0 +1,45 @@
+// Package storage selects and constructs the CLI's U2M token storage backend.
+//
+// Two modes are supported. Secure writes to the OS-native keyring under the
+// profile cache key only; it is the resolver default. Plaintext writes to
+// ~/.databricks/token-cache.json with host-key dual-write for older Go SDK
+// versions (v0.61-v0.103); it is the opt-in fallback for environments where
+// the OS keyring is not available.
+package storage
+
+import (
+	"errors"
+
+	"golang.org/x/oauth2"
+)
+
+// ErrNotFound is returned by Store.Lookup when no entry exists for the key, or
+// when a stored entry cannot be decoded by this CLI version (an unknown format
+// is treated as a miss so the caller re-mints rather than failing). It is the
+// signal to callers that they need to mint or otherwise obtain a token.
+var ErrNotFound = errors.New("token not found")
+
+// Entry is the value held in the CLI token store. It wraps the credential so
+// the schema can grow additive metadata (e.g. a config fingerprint, scopes)
+// without changing the Store interface. Backends persist it verbatim and never
+// interpret its contents.
+type Entry struct {
+	// Token is the cached OAuth token. Always set for stored entries.
+	Token *oauth2.Token
+}
+
+// Store is the CLI's token-storage abstraction: a key/value store with no
+// policy of its own. Implementations are the plaintext file cache and the OS
+// keyring and in-memory stores. The entry schema can evolve with additive
+// metadata without changing the Store interface.
+type Store interface {
+	// Put writes e under key, replacing any existing entry.
+	Put(key string, e Entry) error
+
+	// Lookup returns the entry stored under key, or ErrNotFound.
+	Lookup(key string) (Entry, error)
+
+	// Delete removes the entry under key. Deleting a missing entry is not an
+	// error.
+	Delete(key string) error
+}
diff --git a/libs/auth/u2m/account_oauth_argument.go b/libs/auth/u2m/account_oauth_argument.go
new file mode 100644
index 00000000000..0771c9ede0d
--- /dev/null
+++ b/libs/auth/u2m/account_oauth_argument.go
@@ -0,0 +1,74 @@
+package u2m
+
+import (
+	"fmt"
+)
+
+// AccountOAuthArgument is an interface that provides the necessary information
+// to authenticate using OAuth to a specific account.
+type AccountOAuthArgument interface {
+	OAuthArgument
+
+	// GetAccountHost returns the host of the account to authenticate to.
+	GetAccountHost() string
+
+	// GetAccountId returns the account ID of the account to authenticate to.
+	GetAccountId() string
+}
+
+// BasicAccountOAuthArgument is a basic implementation of the AccountOAuthArgument
+// interface that links each account with exactly one OAuth token.
+type BasicAccountOAuthArgument struct {
+	accountHost string
+	accountID   string
+
+	// profile is the optional profile name. When set, GetCacheKey() returns
+	// the profile name instead of the host-based key.
+	profile string
+}
+
+var (
+	_ AccountOAuthArgument = BasicAccountOAuthArgument{}
+	_ HostCacheKeyProvider = BasicAccountOAuthArgument{}
+)
+
+// NewBasicAccountOAuthArgument creates a new BasicAccountOAuthArgument.
+func NewBasicAccountOAuthArgument(accountsHost, accountID string) (BasicAccountOAuthArgument, error) {
+	return NewProfileAccountOAuthArgument(accountsHost, accountID, "")
+}
+
+// NewProfileAccountOAuthArgument creates a new BasicAccountOAuthArgument with a
+// profile name. When a profile is set, GetCacheKey() returns the profile name
+// instead of the host-based key.
+func NewProfileAccountOAuthArgument(accountsHost, accountID, profile string) (BasicAccountOAuthArgument, error) {
+	if err := validateHost(accountsHost); err != nil {
+		return BasicAccountOAuthArgument{}, err
+	}
+	return BasicAccountOAuthArgument{accountHost: accountsHost, accountID: accountID, profile: profile}, nil
+}
+
+// GetAccountHost returns the host of the account to authenticate to.
+func (a BasicAccountOAuthArgument) GetAccountHost() string {
+	return a.accountHost
+}
+
+// GetAccountId returns the account ID of the account to authenticate to.
+func (a BasicAccountOAuthArgument) GetAccountId() string {
+	return a.accountID
+}
+
+// GetCacheKey returns a unique key for caching the OAuth token for the account.
+// If a profile is set, the profile name is returned as the cache key.
+// Otherwise, the key is in the format "<accountHost>/oidc/accounts/<accountID>".
+func (a BasicAccountOAuthArgument) GetCacheKey() string {
+	if a.profile != "" {
+		return a.profile
+	}
+	return a.GetHostCacheKey()
+}
+
+// GetHostCacheKey returns the host-based cache key regardless of whether a
+// profile is set. The key is in the format "<accountHost>/oidc/accounts/<accountID>".
+func (a BasicAccountOAuthArgument) GetHostCacheKey() string {
+	return fmt.Sprintf("%s/oidc/accounts/%s", a.accountHost, a.accountID)
+}
diff --git a/libs/auth/u2m/account_oauth_argument_test.go b/libs/auth/u2m/account_oauth_argument_test.go
new file mode 100644
index 00000000000..55b6b74cb28
--- /dev/null
+++ b/libs/auth/u2m/account_oauth_argument_test.go
@@ -0,0 +1,81 @@
+package u2m
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestNewProfileAccountOAuthArgument_ValidatesHost(t *testing.T) {
+	_, err := NewProfileAccountOAuthArgument("http://insecure.com", "abc", "my-profile")
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "host must start with 'https://'")
+
+	_, err = NewProfileAccountOAuthArgument("https://accounts.cloud.databricks.test/", "abc", "my-profile")
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "host must not have a trailing slash")
+}
+
+func TestBasicAccountOAuthArgument_ProfileCacheKeys(t *testing.T) {
+	tests := []struct {
+		name        string
+		host        string
+		accountID   string
+		profile     string
+		wantKey     string
+		wantHostKey string
+	}{
+		{
+			name:        "without profile returns host-based key",
+			host:        "https://accounts.cloud.databricks.test",
+			accountID:   "abc",
+			wantKey:     "https://accounts.cloud.databricks.test/oidc/accounts/abc",
+			wantHostKey: "https://accounts.cloud.databricks.test/oidc/accounts/abc",
+		},
+		{
+			name:        "with profile returns profile name",
+			host:        "https://accounts.cloud.databricks.test",
+			accountID:   "abc",
+			profile:     "my-profile",
+			wantKey:     "my-profile",
+			wantHostKey: "https://accounts.cloud.databricks.test/oidc/accounts/abc",
+		},
+		{
+			name:        "empty profile returns host-based key",
+			host:        "https://accounts.cloud.databricks.test",
+			accountID:   "abc",
+			profile:     "",
+			wantKey:     "https://accounts.cloud.databricks.test/oidc/accounts/abc",
+			wantHostKey: "https://accounts.cloud.databricks.test/oidc/accounts/abc",
+		},
+		{
+			name:        "different profiles on same host get different keys",
+			host:        "https://accounts.cloud.databricks.test",
+			accountID:   "abc",
+			profile:     "profile-a",
+			wantKey:     "profile-a",
+			wantHostKey: "https://accounts.cloud.databricks.test/oidc/accounts/abc",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var arg BasicAccountOAuthArgument
+			var err error
+			if tt.profile != "" {
+				arg, err = NewProfileAccountOAuthArgument(tt.host, tt.accountID, tt.profile)
+			} else {
+				arg, err = NewBasicAccountOAuthArgument(tt.host, tt.accountID)
+			}
+			assert.NoError(t, err)
+			assert.Equal(t, tt.wantKey, arg.GetCacheKey())
+			assert.Equal(t, tt.wantHostKey, arg.GetHostCacheKey())
+		})
+	}
+}
+
+func TestBasicAccountOAuthArgument_ImplementsHostCacheKeyProvider(t *testing.T) {
+	arg, err := NewBasicAccountOAuthArgument("https://accounts.cloud.databricks.test", "abc")
+	assert.NoError(t, err)
+	var _ HostCacheKeyProvider = arg
+}
diff --git a/libs/auth/u2m/callback.go b/libs/auth/u2m/callback.go
new file mode 100644
index 00000000000..5db0eeeac6a
--- /dev/null
+++ b/libs/auth/u2m/callback.go
@@ -0,0 +1,156 @@
+package u2m
+
+import (
+	"context"
+	_ "embed"
+	"fmt"
+	"html/template"
+	"net/http"
+	"strings"
+
+	"golang.org/x/text/cases"
+	"golang.org/x/text/language"
+)
+
+//go:embed page.tmpl
+var pageTmpl string
+
+type oauthResult struct {
+	Error            string
+	ErrorDescription string
+	State            string
+	Code             string
+	Issuer           string
+	Host             string
+}
+
+// callbackServer is a server that listens for the redirect from the Databricks
+// identity provider. It renders a page.html template that shows the result of
+// the authentication attempt.
+type callbackServer struct {
+	// ctx is the context used when waiting for the redirect from the identity
+	// provider. This is needed because the Handler() method from the oauth2
+	// library does not accept a context.
+	ctx context.Context
+
+	// srv is the server that listens for the redirect from the identity provider.
+	srv http.Server
+
+	// browser is a function that opens a browser to the given URL.
+	browser func(string) error
+
+	// arg is the OAuth argument used to authenticate.
+	arg OAuthArgument
+
+	// renderErrCh is a channel that receives an error if there is an error
+	// rendering the page.html template.
+	renderErrCh chan error
+
+	// feedbackCh is a channel that receives the result of the authentication
+	// attempt.
+	feedbackCh chan oauthResult
+
+	// tmpl is the template used to render the response page after the user is
+	// redirected back to the callback server.
+	tmpl *template.Template
+}
+
+// newCallbackServer creates a new callback server that listens for the redirect
+// from the Databricks identity provider.
+func (a *PersistentAuth) newCallbackServer() (*callbackServer, error) {
+	tmpl, err := template.New("page").Funcs(template.FuncMap{
+		"title": func(in string) string {
+			title := cases.Title(language.English)
+			return title.String(strings.ReplaceAll(in, "_", " "))
+		},
+	}).Parse(pageTmpl)
+	if err != nil {
+		return nil, err
+	}
+	cb := &callbackServer{
+		feedbackCh:  make(chan oauthResult),
+		renderErrCh: make(chan error),
+		tmpl:        tmpl,
+		ctx:         a.ctx,
+		browser:     a.browser,
+		arg:         a.oAuthArgument,
+	}
+	cb.srv.Handler = cb
+	go func() {
+		_ = cb.srv.Serve(a.ln)
+	}()
+	return cb, nil
+}
+
+// Close closes the callback server.
+func (cb *callbackServer) Close() error {
+	return cb.srv.Close()
+}
+
+// ServeHTTP renders the page.html template.
+func (cb *callbackServer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	res := oauthResult{
+		Error:            r.FormValue("error"),
+		ErrorDescription: r.FormValue("error_description"),
+		Code:             r.FormValue("code"),
+		State:            r.FormValue("state"),
+		Issuer:           r.FormValue("iss"),
+		Host:             cb.getHost(),
+	}
+	if res.Error != "" {
+		w.WriteHeader(http.StatusBadRequest)
+	} else {
+		w.WriteHeader(http.StatusOK)
+	}
+	err := cb.tmpl.Execute(w, res)
+	if err != nil {
+		cb.renderErrCh <- err
+	}
+	cb.feedbackCh <- res
+}
+
+func (cb *callbackServer) getHost() string {
+	switch a := cb.arg.(type) {
+	case AccountOAuthArgument:
+		return a.GetAccountHost()
+	case WorkspaceOAuthArgument:
+		return a.GetWorkspaceHost()
+	default:
+		return ""
+	}
+}
+
+func (cb *callbackServer) awaitResult(authCodeURL string) (oauthResult, error) {
+	err := cb.browser(authCodeURL)
+	if err != nil {
+		fmt.Printf("Please continue the authentication process in your browser:\n%s\n", authCodeURL)
+	}
+	select {
+	case <-cb.ctx.Done():
+		return oauthResult{}, cb.ctx.Err()
+	case renderErr := <-cb.renderErrCh:
+		return oauthResult{}, renderErr
+	case res := <-cb.feedbackCh:
+		if res.Error != "" {
+			return oauthResult{}, fmt.Errorf("%s: %s", res.Error, res.ErrorDescription)
+		}
+		return res, nil
+	}
+}
+
+// Handler opens up a browser waits for redirect to come back from the identity provider
+func (cb *callbackServer) Handler(authCodeURL string) (string, string, error) {
+	res, err := cb.awaitResult(authCodeURL)
+	if err != nil {
+		return "", "", err
+	}
+	return res.Code, res.State, nil
+}
+
+func (cb *callbackServer) handlerWithIssuer(authCodeURL string) (code, state, issuer string, err error) {
+	res, err := cb.awaitResult(authCodeURL)
+	if err != nil {
+		return "", "", "", err
+	}
+	return res.Code, res.State, res.Issuer, nil
+}
diff --git a/libs/auth/u2m/callback_test.go b/libs/auth/u2m/callback_test.go
new file mode 100644
index 00000000000..739575755c8
--- /dev/null
+++ b/libs/auth/u2m/callback_test.go
@@ -0,0 +1,244 @@
+package u2m
+
+import (
+	"fmt"
+	"html/template"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+
+	"github.com/databricks/databricks-sdk-go/httpclient/fixtures"
+	"golang.org/x/oauth2"
+)
+
+func TestCallbackServer_HandlerWithIssuerBindsIssuerToResult(t *testing.T) {
+	browserOpened := make(chan string, 1)
+	cb := &callbackServer{
+		ctx: t.Context(),
+		browser: func(redirect string) error {
+			browserOpened <- redirect
+			return nil
+		},
+		renderErrCh: make(chan error),
+		feedbackCh:  make(chan oauthResult, 2),
+		tmpl:        template.Must(template.New("page").Parse("")),
+	}
+
+	const authCodeURL = "https://login.databricks.test/?destination_url=%2Foidc%2Fv1%2Fauthorize"
+	legitimate := struct {
+		code   string
+		state  string
+		issuer string
+	}{
+		code:   "legit-code",
+		state:  "legit-state",
+		issuer: "https://adb-123.azuredatabricks.test/oidc",
+	}
+
+	serveCallback := func(code, state, issuer string) {
+		callbackURL := fmt.Sprintf("/?code=%s&state=%s&iss=%s",
+			url.QueryEscape(code), url.QueryEscape(state), url.QueryEscape(issuer))
+		req := httptest.NewRequest(http.MethodGet, callbackURL, nil)
+		rec := httptest.NewRecorder()
+		cb.ServeHTTP(rec, req)
+		if rec.Code != http.StatusOK {
+			t.Fatalf("ServeHTTP status = %d, want %d", rec.Code, http.StatusOK)
+		}
+	}
+
+	// Queue two callbacks with different code/state/iss; the handler must
+	// return the values from the first result and not interleave.
+	serveCallback(legitimate.code, legitimate.state, legitimate.issuer)
+	serveCallback("second-code", "second-state", "https://other.example/oidc")
+
+	code, state, issuer, err := cb.handlerWithIssuer(authCodeURL)
+	if err != nil {
+		t.Fatalf("handlerWithIssuer(): %v", err)
+	}
+	if code != legitimate.code {
+		t.Errorf("code = %q, want %q", code, legitimate.code)
+	}
+	if state != legitimate.state {
+		t.Errorf("state = %q, want %q", state, legitimate.state)
+	}
+	if issuer != legitimate.issuer {
+		t.Errorf("issuer = %q, want %q", issuer, legitimate.issuer)
+	}
+
+	select {
+	case got := <-browserOpened:
+		if got != authCodeURL {
+			t.Errorf("browser opened %q, want %q", got, authCodeURL)
+		}
+	default:
+		t.Fatal("browser was not opened")
+	}
+}
+
+func TestCallbackServer_ExtractsIssuer(t *testing.T) {
+	ctx := t.Context()
+
+	browserOpened := make(chan string)
+	browser := func(redirect string) error {
+		browserOpened <- redirect
+		return nil
+	}
+	tokenCache := &tokenStoreMock{
+		store: func(key string, tok *oauth2.Token) error {
+			return nil
+		},
+	}
+	arg, err := NewBasicAccountOAuthArgument("https://accounts.cloud.databricks.test", "xyz")
+	if err != nil {
+		t.Fatalf("NewBasicAccountOAuthArgument(): %v", err)
+	}
+
+	p, err := NewPersistentAuth(
+		ctx,
+		WithTokenStore(tokenCache),
+		WithBrowser(browser),
+		WithHttpClient(&http.Client{
+			Transport: fixtures.SliceTransport{
+				{
+					Method:   "POST",
+					Resource: "/oidc/accounts/xyz/v1/token",
+					Response: `access_token=__ACCESS__&refresh_token=__REFRESH__`,
+					ResponseHeaders: map[string][]string{
+						"Content-Type": {"application/x-www-form-urlencoded"},
+					},
+				},
+			},
+		}),
+		WithOAuthEndpointSupplier(MockOAuthEndpointSupplier{}),
+		WithOAuthArgument(arg),
+	)
+	if err != nil {
+		t.Fatalf("NewPersistentAuth(): %v", err)
+	}
+	defer p.Close()
+
+	// Start a listener so we can create the callback server.
+	err = p.startListener(ctx)
+	if err != nil {
+		t.Fatalf("startListener(): %v", err)
+	}
+
+	cb, err := p.newCallbackServer()
+	if err != nil {
+		t.Fatalf("newCallbackServer(): %v", err)
+	}
+	defer cb.Close()
+
+	// Fire a callback with iss parameter.
+	issuerURL := "https://adb-123.azuredatabricks.test/oidc"
+	resp, err := http.Get(fmt.Sprintf("http://%s?code=xxx&state=yyy&iss=%s", p.redirectAddr, issuerURL))
+	if err != nil {
+		t.Fatalf("http.Get(): %v", err)
+	}
+	defer resp.Body.Close()
+
+	res := <-cb.feedbackCh
+	if got := res.Issuer; got != issuerURL {
+		t.Fatalf("result Issuer: want %q, got %q", issuerURL, got)
+	}
+}
+
+func TestCallbackServer_NoIssuer(t *testing.T) {
+	ctx := t.Context()
+
+	tokenCache := &tokenStoreMock{
+		store: func(key string, tok *oauth2.Token) error {
+			return nil
+		},
+	}
+	arg, err := NewBasicAccountOAuthArgument("https://accounts.cloud.databricks.test", "xyz")
+	if err != nil {
+		t.Fatalf("NewBasicAccountOAuthArgument(): %v", err)
+	}
+
+	p, err := NewPersistentAuth(
+		ctx,
+		WithTokenStore(tokenCache),
+		WithBrowser(func(string) error { return nil }),
+		WithOAuthEndpointSupplier(MockOAuthEndpointSupplier{}),
+		WithOAuthArgument(arg),
+	)
+	if err != nil {
+		t.Fatalf("NewPersistentAuth(): %v", err)
+	}
+	defer p.Close()
+
+	err = p.startListener(ctx)
+	if err != nil {
+		t.Fatalf("startListener(): %v", err)
+	}
+
+	cb, err := p.newCallbackServer()
+	if err != nil {
+		t.Fatalf("newCallbackServer(): %v", err)
+	}
+	defer cb.Close()
+
+	// Fire a callback without iss parameter.
+	resp, err := http.Get(fmt.Sprintf("http://%s?code=xxx&state=yyy", p.redirectAddr))
+	if err != nil {
+		t.Fatalf("http.Get(): %v", err)
+	}
+	defer resp.Body.Close()
+
+	res := <-cb.feedbackCh
+	if got := res.Issuer; got != "" {
+		t.Fatalf("result Issuer: want %q, got %q", "", got)
+	}
+}
+
+func TestCallbackServer_IssuerWithAccountPath(t *testing.T) {
+	ctx := t.Context()
+
+	tokenCache := &tokenStoreMock{
+		store: func(key string, tok *oauth2.Token) error {
+			return nil
+		},
+	}
+	arg, err := NewBasicAccountOAuthArgument("https://accounts.cloud.databricks.test", "xyz")
+	if err != nil {
+		t.Fatalf("NewBasicAccountOAuthArgument(): %v", err)
+	}
+
+	p, err := NewPersistentAuth(
+		ctx,
+		WithTokenStore(tokenCache),
+		WithBrowser(func(string) error { return nil }),
+		WithOAuthEndpointSupplier(MockOAuthEndpointSupplier{}),
+		WithOAuthArgument(arg),
+	)
+	if err != nil {
+		t.Fatalf("NewPersistentAuth(): %v", err)
+	}
+	defer p.Close()
+
+	err = p.startListener(ctx)
+	if err != nil {
+		t.Fatalf("startListener(): %v", err)
+	}
+
+	cb, err := p.newCallbackServer()
+	if err != nil {
+		t.Fatalf("newCallbackServer(): %v", err)
+	}
+	defer cb.Close()
+
+	// Fire a callback with iss containing an account path.
+	issuerURL := "https://nike.databricks.test/oidc/accounts/abc-123-def"
+	resp, err := http.Get(fmt.Sprintf("http://%s?code=xxx&state=yyy&iss=%s", p.redirectAddr, issuerURL))
+	if err != nil {
+		t.Fatalf("http.Get(): %v", err)
+	}
+	defer resp.Body.Close()
+
+	res := <-cb.feedbackCh
+	if got := res.Issuer; got != issuerURL {
+		t.Fatalf("result Issuer: want %q, got %q", issuerURL, got)
+	}
+}
diff --git a/libs/auth/u2m/discovery_oauth_argument.go b/libs/auth/u2m/discovery_oauth_argument.go
new file mode 100644
index 00000000000..7fbe4a04862
--- /dev/null
+++ b/libs/auth/u2m/discovery_oauth_argument.go
@@ -0,0 +1,63 @@
+package u2m
+
+import "errors"
+
+// DiscoveryOAuthArgument is an OAuthArgument for bootstrapping the
+// login.databricks.com discovery flow. Unlike other OAuthArgument types, it
+// has no host at construction time. The host is discovered from the iss
+// parameter in the OAuth callback after the user authenticates and selects a
+// workspace.
+//
+// DiscoveryOAuthArgument is only intended for use with [WithDiscoveryLogin]
+// during [PersistentAuth.Challenge]. Once the host has been discovered,
+// callers should construct the usual host-based OAuthArgument
+// (for example [WorkspaceOAuthArgument]) for future PersistentAuth instances.
+type DiscoveryOAuthArgument interface {
+	OAuthArgument
+
+	// SetDiscoveredHost stores the workspace host derived from the iss
+	// callback parameter.
+	SetDiscoveredHost(host string)
+
+	// GetDiscoveredHost returns the workspace host discovered from the
+	// callback, or empty string if not yet discovered.
+	GetDiscoveredHost() string
+}
+
+// BasicDiscoveryOAuthArgument is a basic implementation of
+// [DiscoveryOAuthArgument] that uses the profile name as the cache key during
+// discovery login bootstrap.
+type BasicDiscoveryOAuthArgument struct {
+	profile        string
+	discoveredHost string
+}
+
+// NewBasicDiscoveryOAuthArgument creates a new [BasicDiscoveryOAuthArgument].
+// The profile name is required and used as the cache key during discovery
+// login. Use it with [WithDiscoveryLogin]. After discovery, construct the
+// usual host-based OAuthArgument with the discovered host.
+func NewBasicDiscoveryOAuthArgument(profile string) (*BasicDiscoveryOAuthArgument, error) {
+	if profile == "" {
+		return nil, errors.New("profile name must not be empty for discovery login")
+	}
+	return &BasicDiscoveryOAuthArgument{profile: profile}, nil
+}
+
+// GetCacheKey returns the profile name as the cache key.
+func (a *BasicDiscoveryOAuthArgument) GetCacheKey() string {
+	return a.profile
+}
+
+// SetDiscoveredHost stores the workspace host derived from the iss callback
+// parameter.
+func (a *BasicDiscoveryOAuthArgument) SetDiscoveredHost(host string) {
+	a.discoveredHost = host
+}
+
+// GetDiscoveredHost returns the workspace host discovered from the callback,
+// or empty string if not yet discovered.
+func (a *BasicDiscoveryOAuthArgument) GetDiscoveredHost() string {
+	return a.discoveredHost
+}
+
+var _ DiscoveryOAuthArgument = &BasicDiscoveryOAuthArgument{}
diff --git a/libs/auth/u2m/discovery_oauth_argument_test.go b/libs/auth/u2m/discovery_oauth_argument_test.go
new file mode 100644
index 00000000000..1eba2bd6c95
--- /dev/null
+++ b/libs/auth/u2m/discovery_oauth_argument_test.go
@@ -0,0 +1,106 @@
+package u2m
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestDiscoveryOAuthArgument_GetCacheKey(t *testing.T) {
+	arg, err := NewBasicDiscoveryOAuthArgument("my-profile")
+	if err != nil {
+		t.Fatalf("NewBasicDiscoveryOAuthArgument(): want no error, got %v", err)
+	}
+	got := arg.GetCacheKey()
+	if got != "my-profile" {
+		t.Errorf("GetCacheKey(): want %q, got %q", "my-profile", got)
+	}
+}
+
+func TestDiscoveryOAuthArgument_SetAndGetDiscoveredHost(t *testing.T) {
+	arg, err := NewBasicDiscoveryOAuthArgument("test-profile")
+	if err != nil {
+		t.Fatalf("NewBasicDiscoveryOAuthArgument(): want no error, got %v", err)
+	}
+	arg.SetDiscoveredHost("https://adb-123.azuredatabricks.test")
+	got := arg.GetDiscoveredHost()
+	if got != "https://adb-123.azuredatabricks.test" {
+		t.Errorf("GetDiscoveredHost(): want %q, got %q", "https://adb-123.azuredatabricks.test", got)
+	}
+}
+
+func TestDiscoveryOAuthArgument_ZeroValueHasEmptyDiscoveredHost(t *testing.T) {
+	arg, err := NewBasicDiscoveryOAuthArgument("test-profile")
+	if err != nil {
+		t.Fatalf("NewBasicDiscoveryOAuthArgument(): want no error, got %v", err)
+	}
+	got := arg.GetDiscoveredHost()
+	if got != "" {
+		t.Errorf("GetDiscoveredHost(): want empty string, got %q", got)
+	}
+}
+
+func TestDiscoveryOAuthArgument_ConstructorRejectsEmptyProfile(t *testing.T) {
+	_, err := NewBasicDiscoveryOAuthArgument("")
+	if err == nil {
+		t.Fatal("NewBasicDiscoveryOAuthArgument(): want error for empty profile, got nil")
+	}
+}
+
+func TestDiscoveryOAuthArgument_NewPersistentAuthRequiresDiscoveryLogin(t *testing.T) {
+	arg, err := NewBasicDiscoveryOAuthArgument("discovery-profile")
+	if err != nil {
+		t.Fatalf("NewBasicDiscoveryOAuthArgument(): want no error, got %v", err)
+	}
+	_, err = NewPersistentAuth(t.Context(), WithOAuthArgument(arg))
+	if err == nil {
+		t.Fatal("NewPersistentAuth(): want error for DiscoveryOAuthArgument without WithDiscoveryLogin, got nil")
+	}
+	if !strings.Contains(err.Error(), "requires WithDiscoveryLogin") {
+		t.Fatalf("NewPersistentAuth(): want discovery login requirement error, got %v", err)
+	}
+}
+
+func TestDiscoveryOAuthArgument_NewPersistentAuthAcceptsItWithDiscoveryLogin(t *testing.T) {
+	arg, err := NewBasicDiscoveryOAuthArgument("discovery-profile")
+	if err != nil {
+		t.Fatalf("NewBasicDiscoveryOAuthArgument(): want no error, got %v", err)
+	}
+	p, err := NewPersistentAuth(
+		t.Context(),
+		WithOAuthArgument(arg),
+		WithDiscoveryLogin(),
+	)
+	if err != nil {
+		t.Fatalf("NewPersistentAuth(): want no error, got %v", err)
+	}
+	defer p.Close()
+}
+
+func TestDiscoveryOAuthArgument_DiscoveryLoginRejectsNonDiscoveryArgument(t *testing.T) {
+	arg, err := NewBasicAccountOAuthArgument("https://accounts.cloud.databricks.test", "xyz")
+	if err != nil {
+		t.Fatalf("NewBasicAccountOAuthArgument(): want no error, got %v", err)
+	}
+	_, err = NewPersistentAuth(
+		t.Context(),
+		WithOAuthArgument(arg),
+		WithDiscoveryLogin(),
+	)
+	if err == nil {
+		t.Fatal("NewPersistentAuth(): want error for discovery login without DiscoveryOAuthArgument, got nil")
+	}
+	if !strings.Contains(err.Error(), "discovery login requires DiscoveryOAuthArgument") {
+		t.Fatalf("NewPersistentAuth(): want discovery login validation error, got %v", err)
+	}
+}
+
+type unsupportedOAuthArgument struct{}
+
+func (u unsupportedOAuthArgument) GetCacheKey() string { return "unsupported" }
+
+func TestDiscoveryOAuthArgument_ValidateArgRejectsUnknownTypes(t *testing.T) {
+	_, err := NewPersistentAuth(t.Context(), WithOAuthArgument(unsupportedOAuthArgument{}))
+	if err == nil {
+		t.Fatal("NewPersistentAuth(): want error for unsupported OAuthArgument type, got nil")
+	}
+}
diff --git a/libs/auth/u2m/discovery_token_source.go b/libs/auth/u2m/discovery_token_source.go
new file mode 100644
index 00000000000..16154771f13
--- /dev/null
+++ b/libs/auth/u2m/discovery_token_source.go
@@ -0,0 +1,188 @@
+package u2m
+
+import (
+	"errors"
+	"fmt"
+	"net/url"
+	"strings"
+
+	"golang.org/x/oauth2"
+)
+
+// defaultLoginDatabricksHost is the production host used for discovery login
+// when no override is configured via WithDiscoveryHost.
+const defaultLoginDatabricksHost = "https://login.databricks.com"
+
+// DeriveHostFromIssuer extracts the workspace host (scheme + host) from an
+// issuer URL returned in the OAuth callback iss parameter.
+//
+// Examples:
+//
+//	"https://adb-xxx.azuredatabricks.net/oidc"           -> "https://adb-xxx.azuredatabricks.net"
+//	"https://nike.databricks.com/oidc/accounts/xxx"      -> "https://nike.databricks.com"
+func DeriveHostFromIssuer(issuer string) (string, error) {
+	if issuer == "" {
+		return "", errors.New("issuer must not be empty")
+	}
+	u, err := url.Parse(issuer)
+	if err != nil {
+		return "", fmt.Errorf("parsing issuer URL %q: %w", issuer, err)
+	}
+	// Allow http for localhost (consistent with validateHost in workspace_oauth_argument.go).
+	local := u.Scheme == "http" && u.Hostname() == "127.0.0.1"
+	if u.Scheme != "https" && !local {
+		return "", fmt.Errorf("issuer must use https scheme: %q", issuer)
+	}
+	if u.Host == "" {
+		return "", fmt.Errorf("issuer must have a non-empty host: %q", issuer)
+	}
+	return fmt.Sprintf("%s://%s", u.Scheme, u.Host), nil
+}
+
+// DeriveTokenEndpoint derives the token endpoint from an issuer URL by
+// appending /v1/token to the issuer path.
+//
+// Example:
+//
+//	"https://adb-xxx.net/oidc" -> "https://adb-xxx.net/oidc/v1/token"
+func DeriveTokenEndpoint(issuer string) string {
+	return strings.TrimRight(issuer, "/") + "/v1/token"
+}
+
+// discoveryTargetAccount is the value of the `target` query parameter that
+// tells login.databricks.com to land the user on the account selector instead
+// of the workspace selector. Used when the caller has signalled (e.g. via
+// WithDiscoveryAccountTarget) that they only want account-level access.
+const discoveryTargetAccount = "ACCOUNT"
+
+// BuildDiscoveryAuthorizeURL builds the login.databricks.com URL that initiates
+// the discovery OAuth flow. The OIDC authorize path with all OAuth query params
+// is URL-encoded as the destination_url parameter.
+func BuildDiscoveryAuthorizeURL(redirectAddr, state string, pkce PKCEParams, scopes []string) string {
+	return buildDiscoveryAuthorizeURL(defaultLoginDatabricksHost, redirectAddr, state, pkce, scopes, appClientID, "")
+}
+
+// buildDiscoveryAuthorizeURL builds the discovery authorize URL against the
+// given host. Trailing slashes on host are trimmed so the result is
+// well-formed regardless of how an override is written. When target is
+// non-empty it is set as the top-level `target` query parameter, which
+// login.databricks.com uses to route the user to a specific selector page
+// (e.g. "ACCOUNT" for the account selector).
+func buildDiscoveryAuthorizeURL(host, redirectAddr, state string, pkce PKCEParams, scopes []string, clientID, target string) string {
+	// Build the nested OIDC authorize path with query parameters.
+	authParams := url.Values{}
+	authParams.Set("client_id", clientID)
+	authParams.Set("redirect_uri", "http://"+redirectAddr)
+	authParams.Set("response_type", "code")
+	authParams.Set("scope", strings.Join(scopes, " "))
+	authParams.Set("state", state)
+	authParams.Set("code_challenge", pkce.Challenge)
+	authParams.Set("code_challenge_method", pkce.ChallengeMethod)
+	destinationURL := "/oidc/v1/authorize?" + authParams.Encode()
+
+	// Wrap the authorize path as the destination_url query parameter on the
+	// discovery host.
+	topParams := url.Values{}
+	if target != "" {
+		topParams.Set("target", target)
+	}
+	topParams.Set("destination_url", destinationURL)
+	return strings.TrimRight(host, "/") + "/?" + topParams.Encode()
+}
+
+// PKCEParams holds the PKCE challenge parameters used to build the discovery
+// authorize URL. This mirrors authhandler.PKCEParams but is used directly so
+// the caller does not need to import authhandler.
+type PKCEParams struct {
+	Challenge       string
+	ChallengeMethod string
+	Verifier        string
+}
+
+// discoveryTokenSource handles the OAuth PKCE flow for login.databricks.com
+// discovery login. Unlike the standard flow, the token endpoint is not known
+// until the callback provides the iss parameter identifying the workspace.
+type discoveryTokenSource struct {
+	pa *PersistentAuth
+	// host overrides defaultLoginDatabricksHost when non-empty.
+	host string
+	// target is the value of the top-level `target` query parameter on the
+	// authorize URL. When non-empty (e.g. "ACCOUNT"), login.databricks.com
+	// routes the user directly to the corresponding selector.
+	target string
+}
+
+// challenge initiates the discovery OAuth flow through login.databricks.com.
+// It builds a custom authorize URL, opens the browser, waits for the callback,
+// derives the workspace host and token endpoint from the iss parameter, and
+// exchanges the authorization code for tokens. The caller is responsible for
+// storing the returned token.
+func (d *discoveryTokenSource) challenge() (*oauth2.Token, error) {
+	cb, err := d.pa.newCallbackServer()
+	if err != nil {
+		return nil, fmt.Errorf("callback server: %w", err)
+	}
+	defer cb.Close()
+
+	state, authPKCE, err := d.pa.stateAndPKCE()
+	if err != nil {
+		return nil, fmt.Errorf("state and pkce: %w", err)
+	}
+
+	scopes := d.pa.resolveScopes()
+
+	pkce := PKCEParams{
+		Challenge:       authPKCE.Challenge,
+		ChallengeMethod: authPKCE.ChallengeMethod,
+		Verifier:        authPKCE.Verifier,
+	}
+	host := d.host
+	if host == "" {
+		host = defaultLoginDatabricksHost
+	}
+	authorizeURL := buildDiscoveryAuthorizeURL(host, d.pa.redirectAddr, state, pkce, scopes, d.pa.clientID, d.target)
+
+	code, returnedState, issuer, err := cb.handlerWithIssuer(authorizeURL)
+	if err != nil {
+		return nil, fmt.Errorf("authorize: %w", err)
+	}
+
+	// Validate state matches what we generated before consuming callback data.
+	if returnedState != state {
+		return nil, fmt.Errorf("state mismatch: expected %q, got %q", state, returnedState)
+	}
+
+	if issuer == "" {
+		return nil, errors.New("discovery login failed: callback did not include an issuer (iss) parameter")
+	}
+
+	// Derive host and token endpoint from the issuer.
+	discoveredHost, err := DeriveHostFromIssuer(issuer)
+	if err != nil {
+		return nil, fmt.Errorf("deriving host from issuer: %w", err)
+	}
+	tokenEndpoint := DeriveTokenEndpoint(issuer)
+
+	// Exchange authorization code for tokens.
+	cfg := &oauth2.Config{
+		ClientID: d.pa.clientID,
+		Endpoint: oauth2.Endpoint{
+			TokenURL:  tokenEndpoint,
+			AuthStyle: oauth2.AuthStyleInParams,
+		},
+		RedirectURL: "http://" + d.pa.redirectAddr,
+	}
+	ctx := d.pa.setOAuthContext(d.pa.ctx)
+	token, err := cfg.Exchange(ctx, code,
+		oauth2.SetAuthURLParam("code_verifier", pkce.Verifier))
+	if err != nil {
+		return nil, fmt.Errorf("token exchange: %w", err)
+	}
+
+	discoveryArg, ok := d.pa.oAuthArgument.(DiscoveryOAuthArgument)
+	if !ok {
+		return nil, fmt.Errorf("discovery login requires DiscoveryOAuthArgument, got %T", d.pa.oAuthArgument)
+	}
+	discoveryArg.SetDiscoveredHost(discoveredHost)
+	return token, nil
+}
diff --git a/libs/auth/u2m/discovery_token_source_test.go b/libs/auth/u2m/discovery_token_source_test.go
new file mode 100644
index 00000000000..ad7d07b0505
--- /dev/null
+++ b/libs/auth/u2m/discovery_token_source_test.go
@@ -0,0 +1,407 @@
+package u2m
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+	"time"
+
+	"golang.org/x/oauth2"
+)
+
+func TestDeriveHostFromIssuer(t *testing.T) {
+	tests := []struct {
+		name    string
+		issuer  string
+		want    string
+		wantErr bool
+	}{
+		{
+			name:   "workspace oidc",
+			issuer: "https://adb-xxx.azuredatabricks.test/oidc",
+			want:   "https://adb-xxx.azuredatabricks.test",
+		},
+		{
+			name:   "workspace cloud",
+			issuer: "https://workspace.cloud.databricks.test/oidc",
+			want:   "https://workspace.cloud.databricks.test",
+		},
+		{
+			name:   "spog with account path",
+			issuer: "https://nike.databricks.test/oidc/accounts/xxx",
+			want:   "https://nike.databricks.test",
+		},
+		{
+			name:    "empty issuer",
+			issuer:  "",
+			wantErr: true,
+		},
+		{
+			name:    "http scheme",
+			issuer:  "http://insecure.net/oidc",
+			wantErr: true,
+		},
+		{
+			name:    "no host",
+			issuer:  "https:///oidc",
+			wantErr: true,
+		},
+		{
+			name:   "http localhost allowed",
+			issuer: "http://127.0.0.1:12345/oidc",
+			want:   "http://127.0.0.1:12345",
+		},
+		{
+			name:    "http non-local host rejected",
+			issuer:  "http://127.0.0.1.attacker.tld/oidc",
+			wantErr: true,
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got, err := DeriveHostFromIssuer(tc.issuer)
+			if tc.wantErr {
+				if err == nil {
+					t.Fatalf("DeriveHostFromIssuer(%q): want error, got nil", tc.issuer)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("DeriveHostFromIssuer(%q): unexpected error: %v", tc.issuer, err)
+			}
+			if got != tc.want {
+				t.Errorf("DeriveHostFromIssuer(%q) = %q, want %q", tc.issuer, got, tc.want)
+			}
+		})
+	}
+}
+
+func TestDeriveTokenEndpoint(t *testing.T) {
+	tests := []struct {
+		name   string
+		issuer string
+		want   string
+	}{
+		{
+			name:   "standard",
+			issuer: "https://adb-xxx.net/oidc",
+			want:   "https://adb-xxx.net/oidc/v1/token",
+		},
+		{
+			name:   "trailing slash",
+			issuer: "https://adb-xxx.net/oidc/",
+			want:   "https://adb-xxx.net/oidc/v1/token",
+		},
+		{
+			name:   "account path",
+			issuer: "https://nike.databricks.test/oidc/accounts/abc123",
+			want:   "https://nike.databricks.test/oidc/accounts/abc123/v1/token",
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got := DeriveTokenEndpoint(tc.issuer)
+			if got != tc.want {
+				t.Errorf("DeriveTokenEndpoint(%q) = %q, want %q", tc.issuer, got, tc.want)
+			}
+		})
+	}
+}
+
+func TestBuildDiscoveryAuthorizeURL(t *testing.T) {
+	pkce := PKCEParams{
+		Challenge:       "test-challenge",
+		ChallengeMethod: "S256",
+		Verifier:        "test-verifier",
+	}
+	scopes := []string{"offline_access", "all-apis"}
+	redirectAddr := "localhost:8020"
+	state := "test-state"
+
+	got := BuildDiscoveryAuthorizeURL(redirectAddr, state, pkce, scopes)
+
+	// Parse the top-level URL.
+	u, err := url.Parse(got)
+	if err != nil {
+		t.Fatalf("parsing URL: %v", err)
+	}
+	if u.Scheme != "https" || u.Host != "login.databricks.com" {
+		t.Errorf("want host https://login.databricks.com, got %s://%s", u.Scheme, u.Host)
+	}
+
+	// Extract and decode destination_url.
+	destURL := u.Query().Get("destination_url")
+	if destURL == "" {
+		t.Fatal("destination_url query param is empty")
+	}
+
+	// Parse the destination_url as a relative URL with query params.
+	destParsed, err := url.Parse(destURL)
+	if err != nil {
+		t.Fatalf("parsing destination_url: %v", err)
+	}
+	if destParsed.Path != "/oidc/v1/authorize" {
+		t.Errorf("destination_url path = %q, want %q", destParsed.Path, "/oidc/v1/authorize")
+	}
+
+	// Verify all expected OAuth params.
+	q := destParsed.Query()
+	expectations := map[string]string{
+		"client_id":             appClientID,
+		"redirect_uri":          "http://localhost:8020",
+		"response_type":         "code",
+		"scope":                 "offline_access all-apis",
+		"state":                 "test-state",
+		"code_challenge":        "test-challenge",
+		"code_challenge_method": "S256",
+	}
+	for key, want := range expectations {
+		if got := q.Get(key); got != want {
+			t.Errorf("destination_url param %q = %q, want %q", key, got, want)
+		}
+	}
+}
+
+func TestBuildDiscoveryAuthorizeURL_HostOverride(t *testing.T) {
+	pkce := PKCEParams{
+		Challenge:       "c",
+		ChallengeMethod: "S256",
+		Verifier:        "v",
+	}
+	scopes := []string{"offline_access", "all-apis"}
+	tests := []struct {
+		name string
+		host string
+	}{
+		{
+			name: "custom host",
+			host: "https://login.dev.databricks.test",
+		},
+		{
+			name: "custom host with trailing slash",
+			host: "https://login.dev.databricks.test/",
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got := buildDiscoveryAuthorizeURL(tc.host, "localhost:8020", "s", pkce, scopes, appClientID, "")
+			u, err := url.Parse(got)
+			if err != nil {
+				t.Fatalf("parsing URL: %v", err)
+			}
+			if u.Host != "login.dev.databricks.test" {
+				t.Errorf("host = %q, want login.dev.databricks.test", u.Host)
+			}
+		})
+	}
+}
+
+func TestBuildDiscoveryAuthorizeURL_Target(t *testing.T) {
+	pkce := PKCEParams{
+		Challenge:       "c",
+		ChallengeMethod: "S256",
+		Verifier:        "v",
+	}
+	scopes := []string{"offline_access", "all-apis"}
+	tests := []struct {
+		name       string
+		target     string
+		wantTarget string
+	}{
+		{name: "no target", target: "", wantTarget: ""},
+		{name: "account target", target: "ACCOUNT", wantTarget: "ACCOUNT"},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got := buildDiscoveryAuthorizeURL(defaultLoginDatabricksHost, "localhost:8020", "s", pkce, scopes, appClientID, tc.target)
+			u, err := url.Parse(got)
+			if err != nil {
+				t.Fatalf("parsing URL: %v", err)
+			}
+			if g := u.Query().Get("target"); g != tc.wantTarget {
+				t.Errorf("target = %q, want %q", g, tc.wantTarget)
+			}
+			// destination_url must still be present in every variant.
+			if u.Query().Get("destination_url") == "" {
+				t.Error("destination_url should be set regardless of target")
+			}
+		})
+	}
+}
+
+func TestWithDiscoveryAccountTarget(t *testing.T) {
+	var a PersistentAuth
+	if a.discoveryAccountTarget {
+		t.Fatal("discoveryAccountTarget should default to false")
+	}
+	WithDiscoveryAccountTarget()(&a)
+	if !a.discoveryAccountTarget {
+		t.Error("WithDiscoveryAccountTarget did not set discoveryAccountTarget")
+	}
+}
+
+func TestWithDiscoveryHost_NormalizesScheme(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		want  string
+	}{
+		{name: "empty stays empty", input: "", want: ""},
+		{name: "https preserved", input: "https://login.dev.databricks.test", want: "https://login.dev.databricks.test"},
+		{name: "http preserved", input: "http://localhost:8080", want: "http://localhost:8080"},
+		{name: "no scheme gets https", input: "login.dev.databricks.test", want: "https://login.dev.databricks.test"},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			var a PersistentAuth
+			WithDiscoveryHost(tc.input)(&a)
+			if a.discoveryHost != tc.want {
+				t.Errorf("discoveryHost = %q, want %q", a.discoveryHost, tc.want)
+			}
+		})
+	}
+}
+
+func TestDiscoveryTokenSource_Challenge(t *testing.T) {
+	// Create a mock token server that responds to POST /oidc/v1/token.
+	tokenServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost {
+			t.Errorf("token server: want POST, got %s", r.Method)
+		}
+		if r.URL.Path != "/oidc/v1/token" {
+			t.Errorf("token server: want path /oidc/v1/token, got %s", r.URL.Path)
+		}
+		if err := r.ParseForm(); err != nil {
+			t.Fatalf("token server: parsing form: %v", err)
+		}
+		if got := r.Form.Get("client_id"); got != "custom-client-id" {
+			t.Errorf("token server: client_id = %q, want %q", got, "custom-client-id")
+		}
+		w.Header().Set("Content-Type", "application/json")
+		fmt.Fprintf(w, `{"access_token":"test-access-token","refresh_token":"test-refresh-token","token_type":"Bearer","expires_in":3600}`)
+	}))
+	defer tokenServer.Close()
+
+	// The issuer will be the mock server URL + /oidc.
+	issuer := tokenServer.URL + "/oidc"
+
+	browserOpened := make(chan string, 1)
+	browserMock := func(u string) error {
+		browserOpened <- u
+		return nil
+	}
+
+	storedTokens := map[string]*oauth2.Token{}
+	cacheMock := &tokenStoreMock{
+		store: func(key string, tok *oauth2.Token) error {
+			storedTokens[key] = tok
+			return nil
+		},
+	}
+
+	arg, err := NewBasicDiscoveryOAuthArgument("test-profile")
+	if err != nil {
+		t.Fatalf("NewBasicDiscoveryOAuthArgument(): %v", err)
+	}
+
+	p, err := NewPersistentAuth(
+		t.Context(),
+		WithTokenStore(cacheMock),
+		WithBrowser(browserMock),
+		WithHttpClient(tokenServer.Client()),
+		WithOAuthEndpointSupplier(MockOAuthEndpointSupplier{}),
+		WithOAuthArgument(arg),
+		WithDiscoveryLogin(),
+		WithClientID("custom-client-id"),
+	)
+	if err != nil {
+		t.Fatalf("NewPersistentAuth(): %v", err)
+	}
+
+	// Start the listener so redirectAddr is set.
+	err = p.startListener(t.Context())
+	if err != nil {
+		t.Fatalf("startListener(): %v", err)
+	}
+	defer p.Close()
+
+	dts := &discoveryTokenSource{pa: p}
+
+	errc := make(chan error, 1)
+	tokenc := make(chan *oauth2.Token, 1)
+	go func() {
+		token, err := dts.challenge()
+		tokenc <- token
+		errc <- err
+	}()
+
+	// Wait for browser to be called and extract state from the URL.
+	var state string
+	select {
+	case authURL := <-browserOpened:
+		u, err := url.Parse(authURL)
+		if err != nil {
+			t.Fatalf("parsing auth URL: %v", err)
+		}
+		destURL := u.Query().Get("destination_url")
+		dest, err := url.Parse(destURL)
+		if err != nil {
+			t.Fatalf("parsing destination_url: %v", err)
+		}
+		if got := dest.Query().Get("client_id"); got != "custom-client-id" {
+			t.Errorf("authorize URL: client_id = %q, want %q", got, "custom-client-id")
+		}
+		state = dest.Query().Get("state")
+		if state == "" {
+			t.Fatal("state is empty in authorize URL")
+		}
+	case <-time.After(5 * time.Second):
+		t.Fatal("timed out waiting for browser to be called")
+	}
+
+	// Fire the callback with code, state, and iss.
+	callbackURL := fmt.Sprintf("http://%s?code=test-code&state=%s&iss=%s",
+		p.redirectAddr, url.QueryEscape(state), url.QueryEscape(issuer))
+	resp, err := http.Get(callbackURL)
+	if err != nil {
+		t.Fatalf("callback GET: %v", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("callback: want status 200, got %d", resp.StatusCode)
+	}
+
+	// Wait for challenge to complete.
+	select {
+	case err := <-errc:
+		if err != nil {
+			t.Fatalf("challenge(): %v", err)
+		}
+	case <-time.After(5 * time.Second):
+		t.Fatal("timed out waiting for challenge to complete")
+	}
+
+	// Verify discovered host was set.
+	expectedHost, err := DeriveHostFromIssuer(issuer)
+	if err != nil {
+		t.Fatalf("DeriveHostFromIssuer(%q): %v", issuer, err)
+	}
+	if arg.GetDiscoveredHost() != expectedHost {
+		t.Errorf("discovered host = %q, want %q", arg.GetDiscoveredHost(), expectedHost)
+	}
+	if len(storedTokens) != 0 {
+		t.Fatalf("store count: want 0, got %d", len(storedTokens))
+	}
+	returnedToken := <-tokenc
+	if returnedToken == nil {
+		t.Fatal("returned token is nil")
+	}
+	if returnedToken.AccessToken != "test-access-token" {
+		t.Errorf("access token = %q, want %q", returnedToken.AccessToken, "test-access-token")
+	}
+	if returnedToken.RefreshToken != "test-refresh-token" {
+		t.Errorf("refresh token = %q, want %q", returnedToken.RefreshToken, "test-refresh-token")
+	}
+}
diff --git a/libs/auth/u2m/doc.go b/libs/auth/u2m/doc.go
new file mode 100644
index 00000000000..ccde2df4f62
--- /dev/null
+++ b/libs/auth/u2m/doc.go
@@ -0,0 +1,46 @@
+/*
+Package u2m supports the user-to-machine (U2M) OAuth flow for authenticating with Databricks.
+
+Databricks uses the authorization code flow from OAuth 2.0 to authenticate users. This flow
+consists of four steps:
+ 1. Retrieve an authorization code for a user by opening a browser and directing them to the
+    Databricks authorization URL.
+ 2. Exchange the authorization code for an access token.
+ 3. Use the access token to authenticate with Databricks.
+ 4. When the access token expires, use the refresh token to get a new access token.
+
+The token and authorization endpoints for Databricks vary depending on whether the host is
+an account- or workspace-level host. Account-level endpoints are fixed based on the account
+ID and host, while workspace-level endpoints are discovered using the OIDC discovery endpoint
+at /oidc/.well-known/oauth-authorization-server.
+
+For host-agnostic login through login.databricks.com, use WithDiscoveryLogin together with a
+DiscoveryOAuthArgument during Challenge(). This is a bootstrap flow only. Once the callback
+reveals the workspace host, construct the usual host-based OAuthArgument for future
+PersistentAuth instances.
+
+To trigger the authorization flow, construct a PersistentAuth object with an
+OAuthArgument and call Challenge:
+
+	arg, err := NewProfileWorkspaceOAuthArgument(host, profile)
+	if err != nil {
+		return err
+	}
+	auth, err := NewPersistentAuth(ctx,
+		WithOAuthArgument(arg),
+		WithTokenStore(tokenStore),
+	)
+	if err != nil {
+		return err
+	}
+	defer auth.Close()
+	token, err := auth.Challenge()
+	if err != nil {
+		return err
+	}
+
+Challenge returns the new token without storing it. The caller is responsible
+for persisting it after any configuration associated with the login is ready.
+WithTokenStore configures the store used by Token and ForceRefreshToken.
+*/
+package u2m
diff --git a/libs/auth/u2m/endpoint_supplier.go b/libs/auth/u2m/endpoint_supplier.go
new file mode 100644
index 00000000000..f5065aa1c61
--- /dev/null
+++ b/libs/auth/u2m/endpoint_supplier.go
@@ -0,0 +1,81 @@
+package u2m
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/httpclient"
+)
+
+var ErrOAuthNotSupported = errors.New("databricks OAuth is not supported for this host")
+
+// OAuthEndpointSupplier provides the http functionality needed for interacting with the
+// Databricks OAuth APIs.
+type OAuthEndpointSupplier interface {
+	// GetWorkspaceOAuthEndpoints returns the OAuth2 endpoints for the workspace.
+	GetWorkspaceOAuthEndpoints(ctx context.Context, workspaceHost string) (*OAuthAuthorizationServer, error)
+
+	// GetAccountOAuthEndpoints returns the OAuth2 endpoints for the account.
+	GetAccountOAuthEndpoints(ctx context.Context, accountHost, accountId string) (*OAuthAuthorizationServer, error)
+
+	// GetUnifiedOAuthEndpoints returns the OAuth2 endpoints for the unified host.
+	GetUnifiedOAuthEndpoints(ctx context.Context, host, accountId string) (*OAuthAuthorizationServer, error)
+
+	// GetEndpointsFromURL fetches OAuth2 endpoints directly from an authorization
+	// server metadata URL, bypassing host-type detection.
+	GetEndpointsFromURL(ctx context.Context, rawURL string) (*OAuthAuthorizationServer, error)
+}
+
+// BasicOAuthEndpointSupplier is an implementation of the OAuthEndpointSupplier interface.
+type BasicOAuthEndpointSupplier struct {
+	// Client is the ApiClient to use for making HTTP requests.
+	Client *httpclient.ApiClient
+}
+
+// GetEndpointsFromURL fetches OAuth2 endpoints directly from an authorization
+// server metadata URL, bypassing host-type detection.
+func (c *BasicOAuthEndpointSupplier) GetEndpointsFromURL(ctx context.Context, rawURL string) (*OAuthAuthorizationServer, error) {
+	var oauthEndpoints OAuthAuthorizationServer
+	if err := c.Client.Do(ctx, "GET", rawURL, httpclient.WithResponseUnmarshal(&oauthEndpoints)); err != nil {
+		if errors.Is(err, apierr.ErrNotFound) {
+			return nil, ErrOAuthNotSupported
+		}
+		return nil, fmt.Errorf("failed to get OAuth endpoints: %w", err)
+	}
+	return &oauthEndpoints, nil
+}
+
+// GetWorkspaceOAuthEndpoints returns the OAuth endpoints for the given workspace.
+func (c *BasicOAuthEndpointSupplier) GetWorkspaceOAuthEndpoints(ctx context.Context, workspaceHost string) (*OAuthAuthorizationServer, error) {
+	oidc := workspaceHost + "/oidc/.well-known/oauth-authorization-server"
+	return c.GetEndpointsFromURL(ctx, oidc)
+}
+
+// GetAccountOAuthEndpoints returns the OAuth2 endpoints for the account. The
+// account-level OAuth endpoints are fixed based on the account ID and host.
+func (c *BasicOAuthEndpointSupplier) GetAccountOAuthEndpoints(ctx context.Context, accountHost, accountId string) (*OAuthAuthorizationServer, error) {
+	return &OAuthAuthorizationServer{
+		AuthorizationEndpoint: fmt.Sprintf("%s/oidc/accounts/%s/v1/authorize", accountHost, accountId),
+		TokenEndpoint:         fmt.Sprintf("%s/oidc/accounts/%s/v1/token", accountHost, accountId),
+	}, nil
+}
+
+// GetUnifiedOAuthEndpoints returns the OAuth2 endpoints for the unified host
+func (c *BasicOAuthEndpointSupplier) GetUnifiedOAuthEndpoints(ctx context.Context, host, accountId string) (*OAuthAuthorizationServer, error) {
+	oidc := fmt.Sprintf("%s/oidc/accounts/%s/.well-known/oauth-authorization-server", host, accountId)
+	return c.GetEndpointsFromURL(ctx, oidc)
+}
+
+// OAuthAuthorizationServer contains the OAuth endpoints for a Databricks account
+// or workspace.
+type OAuthAuthorizationServer struct {
+	// AuthorizationEndpoint is the URL to redirect users to for authorization.
+	// It typically ends with /v1/authroize.
+	AuthorizationEndpoint string `json:"authorization_endpoint"`
+
+	// TokenEndpoint is the URL to exchange an authorization code for an access token.
+	// It typically ends with /v1/token.
+	TokenEndpoint string `json:"token_endpoint"`
+}
diff --git a/libs/auth/u2m/endpoint_supplier_test.go b/libs/auth/u2m/endpoint_supplier_test.go
new file mode 100644
index 00000000000..0d995cec2f7
--- /dev/null
+++ b/libs/auth/u2m/endpoint_supplier_test.go
@@ -0,0 +1,115 @@
+package u2m
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/common"
+	"github.com/databricks/databricks-sdk-go/httpclient"
+	"github.com/databricks/databricks-sdk-go/httpclient/fixtures"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestBasicOAuthClient_GetAccountOAuthEndpoints(t *testing.T) {
+	c := &BasicOAuthEndpointSupplier{}
+	s, err := c.GetAccountOAuthEndpoints(t.Context(), "https://abc", "xyz")
+	assert.NoError(t, err)
+	assert.Equal(t, "https://abc/oidc/accounts/xyz/v1/authorize", s.AuthorizationEndpoint)
+	assert.Equal(t, "https://abc/oidc/accounts/xyz/v1/token", s.TokenEndpoint)
+}
+
+func TestGetWorkspaceOAuthEndpoints(t *testing.T) {
+	p := httpclient.NewApiClient(httpclient.ClientConfig{
+		Transport: fixtures.MappingTransport{
+			"GET /oidc/.well-known/oauth-authorization-server": {
+				Status: 200,
+				Response: map[string]string{
+					"authorization_endpoint": "a",
+					"token_endpoint":         "b",
+				},
+			},
+		},
+	})
+	c := &BasicOAuthEndpointSupplier{Client: p}
+	endpoints, err := c.GetWorkspaceOAuthEndpoints(t.Context(), "https://abc")
+	assert.NoError(t, err)
+	assert.Equal(t, "a", endpoints.AuthorizationEndpoint)
+	assert.Equal(t, "b", endpoints.TokenEndpoint)
+}
+
+func TestGetEndpointsFromURL(t *testing.T) {
+	p := httpclient.NewApiClient(httpclient.ClientConfig{
+		Transport: fixtures.MappingTransport{
+			"GET /oidc/v1/authorize-server": {
+				Status: 200,
+				Response: map[string]string{
+					"authorization_endpoint": "https://abc/oidc/v1/authorize",
+					"token_endpoint":         "https://abc/oidc/v1/token",
+				},
+			},
+		},
+	})
+	c := &BasicOAuthEndpointSupplier{Client: p}
+	endpoints, err := c.GetEndpointsFromURL(t.Context(), "https://abc/oidc/v1/authorize-server")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if endpoints.AuthorizationEndpoint != "https://abc/oidc/v1/authorize" {
+		t.Errorf("unexpected AuthorizationEndpoint: %q", endpoints.AuthorizationEndpoint)
+	}
+	if endpoints.TokenEndpoint != "https://abc/oidc/v1/token" {
+		t.Errorf("unexpected TokenEndpoint: %q", endpoints.TokenEndpoint)
+	}
+}
+
+func TestGetEndpointsFromURL_NotFound(t *testing.T) {
+	p := httpclient.NewApiClient(httpclient.ClientConfig{
+		Transport: fixtures.MappingTransport{
+			"GET /oidc/v1/authorize-server": {
+				Status: 404,
+			},
+		},
+		// Mirror the error mapping done by Config.refreshTokenErrorMapper: map
+		// HTTP 404 to apierr.ErrNotFound so that errors.Is(err, apierr.ErrNotFound)
+		// returns true, matching the production code path.
+		ErrorMapper: func(ctx context.Context, resp common.ResponseWrapper) error {
+			err := httpclient.DefaultErrorMapper(ctx, resp)
+			if err == nil {
+				return nil
+			}
+			if httpErr, ok := errors.AsType[*httpclient.HttpError](err); ok {
+				if sdkErr, ok := apierr.ByStatusCode(httpErr.StatusCode); ok {
+					return sdkErr
+				}
+			}
+			return err
+		},
+	})
+	c := &BasicOAuthEndpointSupplier{Client: p}
+	_, err := c.GetEndpointsFromURL(t.Context(), "https://abc/oidc/v1/authorize-server")
+	if !errors.Is(err, ErrOAuthNotSupported) {
+		t.Errorf("expected ErrOAuthNotSupported, got %v", err)
+	}
+}
+
+func TestGetUnifiedOAuthEndpoints(t *testing.T) {
+	p := httpclient.NewApiClient(httpclient.ClientConfig{
+		Transport: fixtures.MappingTransport{
+			"GET /oidc/accounts/xyz/.well-known/oauth-authorization-server": {
+				Status: 200,
+				Response: map[string]string{
+					"authorization_endpoint": "https://abc/oidc/accounts/xyz/v1/authorize",
+					"token_endpoint":         "https://abc/oidc/accounts/xyz/v1/token",
+				},
+			},
+		},
+	})
+	c := &BasicOAuthEndpointSupplier{Client: p}
+	endpoints, err := c.GetUnifiedOAuthEndpoints(t.Context(), "https://abc", "xyz")
+
+	assert.NoError(t, err)
+	assert.Equal(t, "https://abc/oidc/accounts/xyz/v1/authorize", endpoints.AuthorizationEndpoint)
+	assert.Equal(t, "https://abc/oidc/accounts/xyz/v1/token", endpoints.TokenEndpoint)
+}
diff --git a/libs/auth/u2m/error.go b/libs/auth/u2m/error.go
new file mode 100644
index 00000000000..51ba9036551
--- /dev/null
+++ b/libs/auth/u2m/error.go
@@ -0,0 +1,14 @@
+package u2m
+
+import "errors"
+
+// ErrMissingRefreshToken is returned when a token refresh is requested but the
+// cached OAuth token does not include a refresh token.
+var ErrMissingRefreshToken = errors.New("cached token has no refresh token")
+
+// InvalidRefreshTokenError is returned from PersistentAuth's Token() and
+// ForceRefreshToken() methods when a token refresh is attempted and the cached
+// refresh token is invalid.
+type InvalidRefreshTokenError struct {
+	error
+}
diff --git a/libs/auth/u2m/oauth_argument.go b/libs/auth/u2m/oauth_argument.go
new file mode 100644
index 00000000000..c0f28ee3cfe
--- /dev/null
+++ b/libs/auth/u2m/oauth_argument.go
@@ -0,0 +1,22 @@
+package u2m
+
+// OAuthArgument is an interface that provides the necessary information to
+// authenticate with PersistentAuth. Implementations of this interface must
+// implement either the WorkspaceOAuthArgument or AccountOAuthArgument
+// interface.
+type OAuthArgument interface {
+	// GetCacheKey returns a unique key for the OAuthArgument. This key is used
+	// to store and retrieve the token from the token store.
+	GetCacheKey() string
+}
+
+// HostCacheKeyProvider is an interface for OAuthArgument implementations that
+// can return a host-based cache key regardless of whether a profile is set.
+//
+// PersistentAuth itself no longer uses this key; it is exported so that
+// external token store implementations (for example, the CLI's file-based
+// store) can type-assert on it to mirror tokens under the host key for
+// cross-SDK compatibility with older SDKs that only know host keys.
+type HostCacheKeyProvider interface {
+	GetHostCacheKey() string
+}
diff --git a/libs/auth/u2m/page.tmpl b/libs/auth/u2m/page.tmpl
new file mode 100644
index 00000000000..1540222dbec
--- /dev/null
+++ b/libs/auth/u2m/page.tmpl
@@ -0,0 +1,104 @@
+<!DOCTYPE html SYSTEM "http://www.thymeleaf.org/dtd/xhtml1-strict-thymeleaf-4.dtd">
+
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:th="http://www.thymeleaf.org">
+  <head>
+    <title>{{if .Error }}{{ .Error | title }}{{ else }}Success{{end}}</title>
+    <link rel="preconnect" href="https://fonts.gstatic.com" />
+    <link href="https://fonts.googleapis.com/css2?family=DM+Sans&display=swap" rel="stylesheet" />
+
+    <style>
+      html,
+      body {
+        height: 100%;
+      }
+
+      body {
+        font-family: "DM Sans";
+        font-style: normal;
+        font-size: 14px;
+        margin: 0;
+        padding: 0;
+        height: 100%;
+        width: 100%;
+        background: #f5f6f6;
+        align-items: center;
+      }
+
+      .root-container {
+        display: flex;
+        height: 100%;
+        align-items: center;
+        justify-content: center;
+      }
+
+      .info-container {
+        width: 320px;
+        box-shadow: 0px 2px 4px rgba(0, 0, 0, 0.1),
+          0px 8px 25px rgba(0, 0, 0, 0.1);
+        border-radius: 8px;
+        display: flex;
+        flex-direction: column;
+        padding: 48px;
+        background: #fff;
+        justify-content: center;
+        align-items: center;
+        text-align: center;
+        gap: 24px;
+      }
+
+      .title {
+        font-weight: 600;
+        font-size: 24px;
+        line-height: 28px;
+      }
+
+      a {
+        color: #C4CCD6;
+      }
+
+      a:hover {
+        color: #90A5B1;
+      }
+
+      .content {
+        width: 300px;
+        font-size: 14px;
+      }
+
+      .button {
+        display: flex;
+        background: #1B3139;
+        align-items: center;
+        justify-content: center;
+        height: 40px;
+        width: 300px;
+        border-radius: 4px;
+        text-align: center;
+        text-decoration: none;
+        color: #ffffff !important;
+      }
+    </style>
+  </head>
+
+  <body>
+    <div class="root-container">
+      <div class="info-container">
+        <img
+          src="data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIGRhdGEtbmFtZT0iTGF5ZXIgMSIgdmlld0JveD0iMCAwIDcxMi43NyAxMTIuOTciPjxkZWZzPjxjbGlwUGF0aCBpZD0iYSI+PHBhdGggZD0iTTAgMGg3MjUuMzN2MTEyLjk3SDB6IiBzdHlsZT0iZmlsbDpub25lIi8+PC9jbGlwUGF0aD48L2RlZnM+PHBhdGggZD0iTTAgMjkuNDR2My40bDUyLjEzIDI5LjQxIDQ2LjU2LTI2LjI5LjAxIDEwLjYyLTQ2LjU3IDI2LjQ2TDIuNjIgNDQuOTEgMCA0Ni4zN3YyMC4zNWw1Mi4xMyAyOS4zNCA0Ni41Ni0yNi4yLjAxIDEwLjU0LTQ2LjU3IDI2LjQ2TDIuNjIgNzguNzMgMCA4MC4xOXYzLjQ1bDUyLjEzIDI5LjMzIDUyLjEzLTI5LjMzVjYzLjI3bC0yLjYzLTEuNDUtNDkuNSAyOC4xM0w1LjU2IDYzLjQ5VjUzbDQ2LjU3IDI2LjE3IDUyLjEzLTI5LjM0VjI5Ljc2bC0yLjYzLTEuNDYtNDkuNSAyOC4xNEw3Ljk1IDMxLjMzIDUyLjEzIDYuMzhsMzYuMzkgMjAuNTYgMy4xOC0xLjc5di0yLjhMNTIuMTMgMCAwIDI5LjQ0eiIgc3R5bGU9ImZpbGw6I2ZmMzYyMSIvPjxnIHN0eWxlPSJjbGlwLXBhdGg6dXJsKCNhKSI+PHBhdGggZD0iTTIwMi4xNiA5Ni4yNFY2LjRoLTEzLjg0VjQwYTEuMTkgMS4xOSAwIDAgMS0yLjA5Ljc3Yy00LjY4LTUuNDktMTItOC42NC0yMC04LjY0LTE3LjExIDAtMzAuNSAxNC40My0zMC41IDMyLjg0YTM0LjA3IDM0LjA3IDAgMCAwIDguOCAyMy40MyAyOS4zMyAyOS4zMyAwIDAgMCAyMS43IDkuNDEgMjYgMjYgMCAwIDAgMjAtOSAxLjE5IDEuMTkgMCAwIDEgMi4xLjc3djYuNjlabS0zMi44NC0xMWMtMTEgMC0xOS42NC04LjkyLTE5LjY0LTIwLjNzOC42My0yMC4zIDE5LjY0LTIwLjNTMTg5IDUzLjU4IDE4OSA2NXMtOC42MyAyMC4zLTE5LjY1IDIwLjNNMjc2IDk2LjI0VjMzLjY4aC0xMy42N1Y0MGExLjIgMS4yIDAgMCAxLS43OSAxLjEyIDEuMTcgMS4xNyAwIDAgMS0xLjMxLS4zNmMtNC42NS01LjU0LTExLjc1LTguNi0yMC04LjYtMTcuMSAwLTMwLjUgMTQuNDMtMzAuNSAzMi44NHMxMy40IDMyLjg0IDMwLjUgMzIuODRhMjUuNzUgMjUuNzUgMCAwIDAgMjAtOS4xMSAxLjE4IDEuMTggMCAwIDEgMS4zMi0uMzYgMS4yIDEuMiAwIDAgMSAuNzkgMS4xMnY2Ljc5Wm0tMzIuNzEtMTFjLTExIDAtMTkuNjUtOC45Mi0xOS42NS0yMC4zczguNjMtMjAuMyAxOS42NS0yMC4zUzI2MyA1My41OCAyNjMgNjVzLTguNjMgMjAuMy0xOS42NSAyMC4zbTE0OS45MyAxMC45NFYzMy42OGgtMTMuNzJWNDBhMS4xOSAxLjE5IDAgMCAxLTIuMS43NmMtNC42NC01LjU0LTExLjc1LTguNi0yMC04LjZDMzQwLjM1IDMyLjEyIDMyNyA0Ni41NSAzMjcgNjVzMTMuNCAzMi44NCAzMC41IDMyLjg0YTI1Ljc1IDI1Ljc1IDAgMCAwIDIwLTkuMTEgMS4xOSAxLjE5IDAgMCAxIDIuMS43NnY2Ljc5Wm0tMzIuNzEtMTFjLTExIDAtMTkuNjUtOC45Mi0xOS42NS0yMC4zczguNjMtMjAuMyAxOS42NS0yMC4zIDE5LjY0IDguOTIgMTkuNjQgMjAuMy04LjYzIDIwLjMtMTkuNjQgMjAuM201Ny44NCAzLjU3YTEuMTQgMS4xNCAwIDAgMSAuNDEtLjA3IDEuMjEgMS4yMSAwIDAgMSAuOTEuNDFjNC42OCA1LjUgMTIgOC42NCAyMCA4LjY0IDE3LjEgMCAzMC41LTE0LjQyIDMwLjUtMzIuODNhMzQuMTIgMzQuMTIgMCAwIDAtOC44LTIzLjQzIDI5LjMzIDI5LjMzIDAgMCAwLTIxLjctOS40MSAyNiAyNiAwIDAgMC0yMCA5IDEuMTkgMS4xOSAwIDAgMS0yLjEtLjc2di0zNGgtMTMuODFWOTYuMmgxMy44NHYtNi4yN2ExLjIgMS4yIDAgMCAxIC43OC0xLjEyTTQxNyA2NWMwLTExLjM4IDguNjMtMjAuMyAxOS42NC0yMC4zczE5LjY1IDguOTIgMTkuNjUgMjAuMy04LjYzIDIwLjI5LTE5LjY1IDIwLjI5UzQxNyA3Ni4zNCA0MTcgNjVtOTMuMDctMTguNTJhMTYuMDcgMTYuMDcgMCAwIDEgMy4zNC4zMVYzMi42MWExMS44NCAxMS44NCAwIDAgMC0yLjMtLjIzQTIwLjA1IDIwLjA1IDAgMCAwIDQ5My44IDQyYTEuMTkgMS4xOSAwIDAgMS0yLjIxLS42MXYtNy43MWgtMTMuNzF2NjIuNTZoMTMuODRWNjguNzNjMC0xMy43MyA3LTIyLjI1IDE4LjM1LTIyLjI1bTEyLjAxLTEyLjhoMTMuOTd2NjIuNTZoLTEzLjk3em02LjgyLTI3LjIyYTguNDggOC40OCAwIDEgMCA4LjQ4IDguNDcgOC40OCA4LjQ4IDAgMCAwLTguNDgtOC40N200OC4yIDI1LjY2QzU1Ny45MyAzMi4xMiA1NDQgNDUuOTMgNTQ0IDY1YzAgOS4yNSAzLjI2IDE3LjYyIDkuMTkgMjMuNTZTNTY3LjYgOTcuOCA1NzcgOTcuOGM3Ljc2IDAgMTMuODEtMS41NCAyNS4yMS05LjkxbC03Ljg2LTguMjljLTUuNiAzLjcyLTEwLjgxIDUuNTMtMTUuOTIgNS41My0xMS41NyAwLTIwLjMtOC42Ny0yMC4zLTIwLjE3czguNzMtMjAuMTcgMjAuMy0yMC4xN2EyNS42MyAyNS42MyAwIDAgMSAxNS42NSA1LjUzbDguNzUtOC4zMmMtMTAuMi04Ljg2LTE5LjU2LTkuODktMjUuNzMtOS44OW00OS4zOSAzNi41NGExLjIgMS4yIDAgMCAxIC44LS4zMWguMDhhMS4yNCAxLjI0IDAgMCAxIC44NS40NGwyMi4xMyAyNy40NGgxN0w2MzguNzQgNjEuNmExLjE5IDEuMTkgMCAwIDEgLjA4LTEuNmwyNi4zMi0yNi4zMmgtMTYuODhsLTIyLjY3IDIyLjc4YTEuMTggMS4xOCAwIDAgMS0yLS44NFY2LjRoLTEzLjg2djg5Ljg0aDEzLjg0VjcxLjg2QTEuMTUgMS4xNSAwIDAgMSA2MjQgNzFaIi8+PHBhdGggZD0iTTY4OS45NCA5Ny44YzExLjM1IDAgMjIuODMtNi44NyAyMi44My0yMCAwLTguNTYtNS4zNS0xNC40Ni0xNi4zNy0xOGwtNy41NC0yLjQ3Yy01LjA2LTEuNjktNy41My00LjExLTcuNTMtNy40MSAwLTMuNzcgMy4zOC02LjQgOC4yMi02LjQgNC42IDAgOC43IDMgMTEuMjkgOC4yNGwxMS4xMS02YTI0LjQ0IDI0LjQ0IDAgMCAwLTIyLjQtMTMuNjNjLTEyLjQgMC0yMS40MSA4LTIxLjQxIDE4Ljk0IDAgOC42NyA1LjE5IDE0LjUzIDE1Ljg2IDE3LjkybDcuNjcgMi40N2M1LjQzIDEuNzIgNy42NSAzLjg2IDcuNjUgNy40MSAwIDUuMjktNC45MSA3LjE3LTkuMTIgNy4xNy01LjYyIDAtMTAuNTgtMy42NC0xMy05LjUyTDY2NiA4Mi4zNmMzLjcxIDkuNTMgMTIuODcgMTUuNDQgMjQgMTUuNDRtLTM3NS42Mi0uNjRhNzMuNjggNzMuNjggMCAwIDAgMTAuNTEtLjczdi0xMmE2NC41NiA2NC41NiAwIDAgMS02Ljk0LjQ1Yy01LjYyIDAtOS45MS0xLTkuOTEtMTMuMDZWNDYuMTRhMS4xOCAxLjE4IDAgMCAxIDEuMTgtMS4xNGgxMy40N1YzMy42N2gtMTMuNDdhMS4xOSAxLjE5IDAgMCAxLTEuMjItMS4xOFYxNC4zNWgtMTMuNzJ2MTguMTRhMS4xOSAxLjE5IDAgMCAxLTEuMTkgMS4xOWgtOS42NFY0NWg5LjYzYTEuMTggMS4xOCAwIDAgMSAxLjE5IDEuMTh2MjkuMWMwIDIxLjg4IDE0LjYgMjEuODggMjAuMSAyMS44OCIvPjwvZz48L3N2Zz4="
+        />
+        <!-- {{ if .Error }} -->
+        <div class="title">{{ .Error | title }}</div>
+        <div class="content">{{ .ErrorDescription }}</div>
+        <!-- {{ else }} -->
+        <div class="title">Authenticated</div>
+        {{- if .Host }}
+        <div class="content">Go to <a href="{{.Host}}">{{.Host}}</a></div>
+        {{- end}}
+        <!-- {{ end }} -->
+        <div class="content">
+          You can close this tab. Or go to <a href="https://docs.databricks.com/dev-tools/index-cli.html">documentation</a>
+        </div>
+      </div>
+    </div>
+  </body>
+</html>
diff --git a/libs/auth/u2m/persistent_auth.go b/libs/auth/u2m/persistent_auth.go
new file mode 100644
index 00000000000..a87e37783f4
--- /dev/null
+++ b/libs/auth/u2m/persistent_auth.go
@@ -0,0 +1,711 @@
+package u2m
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/databricks/cli/libs/auth/storage"
+	"github.com/databricks/cli/libs/browser"
+	"github.com/databricks/databricks-sdk-go/httpclient"
+	"github.com/databricks/databricks-sdk-go/logger"
+	"golang.org/x/oauth2"
+	"golang.org/x/oauth2/authhandler"
+)
+
+const (
+	// appClientID is the public OAuth client ID assigned to the Databricks CLI.
+	appClientID = "databricks-cli"
+
+	// defaultPort is the default port for the OAuth2 callback server. If the
+	// port is already in use, the next port is tried (8021, 8022, etc.).
+	defaultPort = 8020
+
+	// maxPortFallback is the maximum port to try when using the fallback
+	// mechanism.
+	maxPortFallback = 8040
+
+	// listenerTimeout is the maximum duration spent trying to acquire a
+	// listener (including port selection).
+	listenerTimeout = 45 * time.Second
+
+	// tokenRefreshBuffer is the duration before token expiry at which the
+	// token is proactively refreshed. This prevents callers from receiving
+	// near-expired tokens that may expire before the next request.
+	tokenRefreshBuffer = 5 * time.Minute
+
+	// Cache update recovery checks immediately and then waits for 25, 50, 100,
+	// and 200 milliseconds. This gives a concurrent store writer time to finish
+	// while bounding the delay for persistent storage failures to 375 milliseconds.
+	storeUpdateRecoveryAttempts = 5
+
+	storeUpdateRecoveryInitialDelay = 25 * time.Millisecond
+	storeUpdateRecoveryDelayFactor  = 2
+
+	// Concurrent refreshes can finish at slightly different times, so their
+	// expiration times need not be identical.
+	storeUpdateRecoveryExpiryDelta = time.Minute
+)
+
+var (
+	// Internal errors used for testing.
+	errListenerTimeout = errors.New("failed to listen on any port: timeout")
+	errNoPortAvailable = errors.New("no port available to listen on")
+)
+
+// PersistentAuth is an OAuth manager that handles the U2M OAuth flow. Tokens
+// are stored in and looked up from the provided store. Tokens include the
+// refresh token. On load, if the access token is expired or close to expiry,
+// it is refreshed using the refresh token.
+//
+// The PersistentAuth is safe for concurrent use. The token store is locked
+// during token retrieval, refresh and storage.
+type PersistentAuth struct {
+	clientID string
+
+	// store stores and looks up tokens.
+	store storage.Store
+
+	// client is the HTTP client to use for OAuth2 requests.
+	client *http.Client
+
+	// endpointSupplier is the HTTP endpointSupplier to use for OAuth2 requests.
+	endpointSupplier OAuthEndpointSupplier
+
+	// oAuthArgument defines the workspace or account to authenticate to and the
+	// cache key for the token.
+	oAuthArgument OAuthArgument
+
+	// browser is the function to open a URL in the default browser.
+	browser func(url string) error
+
+	// ln is the listener for the OAuth2 callback server.
+	ln net.Listener
+
+	// ctx is the context to use for underlying operations. This is needed in
+	// order to implement the oauth2.TokenSource interface.
+	ctx context.Context
+
+	// redirectAddr is the redirect address for OAuth2 callbacks. The value is
+	// set to localhost:PORT by startListener which will dynamically assign a
+	// random port. If a value is already provided, it will be used instead
+	// (e.g. for testing).
+	redirectAddr string
+
+	// Optional port to use for the OAuth2 callback server. If set to 0, the
+	// default port with fallback is used. This means that setting a port will
+	// disable the fallback mechanism.
+	port int
+
+	// netListen is an optional function to listen on a TCP address. If not set,
+	// it will use net.Listen by default. This is useful for testing.
+	netListen func(network, address string) (net.Listener, error)
+
+	// scopes is the list of OAuth scopes to request.
+	scopes []string
+
+	// resources is the list of RFC 8707 resource indicators to send on the
+	// authorization request. The Databricks /oidc authorize endpoint reads
+	// these to scope the login to a specific protected resource (e.g. an AI
+	// Gateway MCP connection), so it can drive that resource's own login
+	// before issuing the authorization code. Empty means an unrestricted login.
+	resources []string
+
+	// disableOfflineAccess controls whether offline_access scope is requested.
+	// When true, offline_access will NOT be automatically added to scopes,
+	// meaning the token will not include a refresh token.
+	disableOfflineAccess bool
+
+	// discoveryMode enables the login.databricks.com discovery flow.
+	// When true, Challenge() uses the discovery token source instead of
+	// the standard authhandler flow.
+	discoveryMode bool
+
+	// discoveryHost overrides the default login.databricks.com host used by
+	// the discovery flow. Empty means the production host.
+	discoveryHost string
+
+	// discoveryAccountTarget, when true, instructs the discovery flow to set
+	// the top-level `target=ACCOUNT` query parameter on the authorize URL so
+	// login.databricks.com lands the user on the account selector instead of
+	// the workspace selector. Use for account-only logins.
+	discoveryAccountTarget bool
+}
+
+type PersistentAuthOption func(*PersistentAuth)
+
+// WithTokenStore sets the token store for the PersistentAuth.
+func WithTokenStore(s storage.Store) PersistentAuthOption {
+	return func(a *PersistentAuth) {
+		a.store = s
+	}
+}
+
+// WithHttpClient sets the HTTP client for the PersistentAuth.
+func WithHttpClient(c *http.Client) PersistentAuthOption {
+	return func(a *PersistentAuth) {
+		a.client = c
+	}
+}
+
+// WithOAuthEndpointSupplier sets the OAuth endpoint supplier for the
+// PersistentAuth.
+func WithOAuthEndpointSupplier(c OAuthEndpointSupplier) PersistentAuthOption {
+	return func(a *PersistentAuth) {
+		a.endpointSupplier = c
+	}
+}
+
+// WithOAuthArgument sets the OAuthArgument for the PersistentAuth.
+func WithOAuthArgument(arg OAuthArgument) PersistentAuthOption {
+	return func(a *PersistentAuth) {
+		a.oAuthArgument = arg
+	}
+}
+
+// WithClientID sets the OAuth client ID for the PersistentAuth.
+func WithClientID(clientID string) PersistentAuthOption {
+	return func(a *PersistentAuth) {
+		a.clientID = clientID
+	}
+}
+
+// WithBrowser sets the browser function for the PersistentAuth.
+func WithBrowser(b func(url string) error) PersistentAuthOption {
+	return func(a *PersistentAuth) {
+		a.browser = b
+	}
+}
+
+// WithPort sets the port for the PersistentAuth.
+//
+//deadcode:allow retained for parity with the deprecated SDK compatibility API
+func WithPort(port int) PersistentAuthOption {
+	return func(a *PersistentAuth) {
+		a.port = port
+	}
+}
+
+// WithScopes sets the OAuth scopes for the PersistentAuth.
+func WithScopes(scopes []string) PersistentAuthOption {
+	return func(a *PersistentAuth) {
+		a.scopes = scopes
+	}
+}
+
+// WithResources sets the RFC 8707 resource indicators for the PersistentAuth.
+// Each value is added as a `resource` query parameter on the authorization
+// request.
+func WithResources(resources []string) PersistentAuthOption {
+	return func(a *PersistentAuth) {
+		a.resources = resources
+	}
+}
+
+// WithDisableOfflineAccess controls whether offline_access scope is requested.
+func WithDisableOfflineAccess(disable bool) PersistentAuthOption {
+	return func(a *PersistentAuth) {
+		a.disableOfflineAccess = disable
+	}
+}
+
+// WithDiscoveryLogin enables the login.databricks.com discovery flow.
+// When enabled, Challenge() routes through login.databricks.com instead
+// of directly to a workspace OIDC endpoint.
+//
+// This option is only valid with [DiscoveryOAuthArgument], which is a
+// bootstrap-only argument type for discovery login. Once the workspace host
+// has been discovered, callers should construct the usual host-based
+// OAuthArgument for future PersistentAuth instances.
+func WithDiscoveryLogin() PersistentAuthOption {
+	return func(a *PersistentAuth) {
+		a.discoveryMode = true
+	}
+}
+
+// WithDiscoveryHost overrides the default https://login.databricks.com host
+// used by the discovery login flow. Intended for testing and development
+// against non-production environments; has no effect unless WithDiscoveryLogin
+// is also set. If host has no scheme, https:// is prepended. Trailing slashes
+// are trimmed.
+func WithDiscoveryHost(host string) PersistentAuthOption {
+	return func(a *PersistentAuth) {
+		if host != "" && !strings.Contains(host, "://") {
+			host = "https://" + host
+		}
+		a.discoveryHost = host
+	}
+}
+
+// WithDiscoveryAccountTarget sets the top-level `target=ACCOUNT` query
+// parameter on the discovery authorize URL so login.databricks.com lands the
+// user on the account selector instead of the workspace selector. Use for
+// account-only logins where workspace selection would be a wasted step.
+//
+// Has no effect unless WithDiscoveryLogin is also set.
+func WithDiscoveryAccountTarget() PersistentAuthOption {
+	return func(a *PersistentAuth) {
+		a.discoveryAccountTarget = true
+	}
+}
+
+// NewPersistentAuth creates a new PersistentAuth with the provided options.
+func NewPersistentAuth(ctx context.Context, opts ...PersistentAuthOption) (*PersistentAuth, error) {
+	p := &PersistentAuth{
+		clientID: appClientID, // defaults to databricks-cli
+	}
+	for _, opt := range opts {
+		opt(p)
+	}
+	// By default, PersistentAuth uses the default ApiClient to make HTTP
+	// requests. Furthermore, if the endpointSupplier is not provided, it uses
+	// this same client to fetch the OAuth endpoints. If the HTTP client is
+	// provided but the endpointSupplier is not, we construct a default
+	// ApiClient for use with BasicOAuthClient.
+	apiClient := httpclient.NewApiClient(httpclient.ClientConfig{})
+	if p.client == nil {
+		p.client = &http.Client{
+			Transport: apiClient,
+			// 30 seconds matches the default timeout of the ApiClient
+			Timeout: 30 * time.Second,
+		}
+	}
+	if p.endpointSupplier == nil {
+		p.endpointSupplier = &BasicOAuthEndpointSupplier{
+			Client: apiClient,
+		}
+	}
+	if p.store == nil {
+		p.store = storage.NewMemoryStore()
+	}
+	if err := p.validateArg(); err != nil {
+		return nil, err
+	}
+	if p.browser == nil {
+		p.browser = func(url string) error { return browser.Open(ctx, url) }
+	}
+	p.ctx = ctx
+	return p, nil
+}
+
+// loadToken loads the cached OAuth2 token for the configured OAuthArgument
+// using GetCacheKey(). The returned token may be expired; callers are
+// responsible for deciding whether and how to refresh it.
+func (a *PersistentAuth) loadToken() (*oauth2.Token, error) {
+	e, err := a.store.Lookup(a.oAuthArgument.GetCacheKey())
+	if err != nil {
+		return nil, fmt.Errorf("cache: %w", err)
+	}
+	return e.Token, nil
+}
+
+// Token loads the OAuth2 token for the given OAuthArgument from the cache. If
+// the token is expired or close to expiry, it is refreshed using the refresh
+// token. When a proactive refresh (token still valid but near expiry) fails,
+// the existing token is returned so the caller is not blocked.
+func (a *PersistentAuth) Token() (*oauth2.Token, error) {
+	t, err := a.loadToken()
+	if err != nil {
+		return nil, err
+	}
+	if needsRefresh(t) {
+		if refreshedToken, err := a.refresh(t); err == nil {
+			t = refreshedToken
+		} else if !t.Valid() {
+			return nil, fmt.Errorf("token refresh: %w", err)
+		} else {
+			logger.Debugf(a.ctx, "proactive token refresh failed, returning existing token: %v", err)
+		}
+	}
+	t.RefreshToken = ""
+	return t, nil
+}
+
+// ForceRefreshToken loads the OAuth2 token from the cache by GetCacheKey(),
+// refreshes it unconditionally, and stores the refreshed token back under the
+// same key. Unlike Token(), if the refresh fails the error is always returned
+// -- the caller explicitly asked for a fresh token, so silently falling back
+// to a stale one would be incorrect.
+func (a *PersistentAuth) ForceRefreshToken() (*oauth2.Token, error) {
+	t, err := a.loadToken()
+	if err != nil {
+		return nil, err
+	}
+	t, err = a.refresh(t)
+	if err != nil {
+		return nil, fmt.Errorf("forced token refresh: %w", err)
+	}
+	t.RefreshToken = ""
+	return t, nil
+}
+
+// needsRefresh returns true when the token should be refreshed, either because
+// it is no longer valid or because it will expire within the
+// tokenRefreshBuffer window.
+func needsRefresh(t *oauth2.Token) bool {
+	if !t.Valid() {
+		return true
+	}
+	return !t.Expiry.IsZero() && time.Until(t.Expiry) < tokenRefreshBuffer
+}
+
+// isFreshReplacement reports whether cached changed from old, is valid, and
+// does not expire significantly sooner than candidate.
+func isFreshReplacement(old, candidate, cached *oauth2.Token) bool {
+	if cached.AccessToken == old.AccessToken || !cached.Valid() {
+		return false
+	}
+	if cached.Expiry.IsZero() {
+		return true
+	}
+	if candidate.Expiry.IsZero() {
+		return false
+	}
+	return !cached.Expiry.Before(candidate.Expiry.Add(-storeUpdateRecoveryExpiryDelta))
+}
+
+// recoverStoreUpdate checks whether a concurrent store update completed.
+// Retrying reads instead of writes avoids recreating the write race.
+func (a *PersistentAuth) recoverStoreUpdate(old, candidate *oauth2.Token) *oauth2.Token {
+	delay := storeUpdateRecoveryInitialDelay
+	for attempt := range storeUpdateRecoveryAttempts {
+		if attempt > 0 {
+			timer := time.NewTimer(delay)
+			select {
+			case <-a.ctx.Done():
+				timer.Stop()
+				return nil
+			case <-timer.C:
+			}
+			delay *= storeUpdateRecoveryDelayFactor
+		}
+
+		cached, err := a.store.Lookup(a.oAuthArgument.GetCacheKey())
+		if err == nil && isFreshReplacement(old, candidate, cached.Token) {
+			return cached.Token
+		}
+	}
+	return nil
+}
+
+// refresh refreshes the token for the given OAuthArgument, storing the new
+// token in the cache.
+//
+// This read-refresh-write sequence is not coordinated across processes.
+// Because the CLI is stateless, two separate CLI invocations can load the same
+// cached refresh token, both attempt a refresh, and race to update the cache.
+// This should be fixed in a follow-up by adding cross-process coordination
+// around refresh and cache writes.
+func (a *PersistentAuth) refresh(oldToken *oauth2.Token) (*oauth2.Token, error) {
+	// Fail fast with ErrMissingRefreshToken instead of letting the oauth2
+	// library attempt to refresh and return a misleading error (e.g. "token
+	// expired" when the real problem is that the cached token is not
+	// refresh-capable).
+	if oldToken.RefreshToken == "" {
+		return nil, ErrMissingRefreshToken
+	}
+	cfg, err := a.oauth2Config()
+	if err != nil {
+		return nil, err
+	}
+	ctx := a.setOAuthContext(a.ctx)
+	// Force the oauth2 library to refresh by ensuring the token appears
+	// expired. PersistentAuth owns the refresh decision (including the
+	// proactive buffer), so the oauth2 library should always perform the
+	// refresh when asked.
+	expired := *oldToken
+	expired.Expiry = time.Now().Add(-time.Minute)
+	t, err := cfg.TokenSource(ctx, &expired).Token()
+	if err != nil {
+		// The default RoundTripper of our httpclient.ApiClient returns an error
+		// if the response status code is not 2xx. This isn't compliant with the
+		// RoundTripper interface, so this error isn't handled by the oauth2
+		// library. We need to handle it here.
+		if internalHttpError, ok := errors.AsType[*httpclient.HttpError](err); ok {
+			// error fields
+			// https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
+			var errResponse struct {
+				Error            string `json:"error"`
+				ErrorDescription string `json:"error_description"`
+			}
+			if unmarshalErr := json.Unmarshal([]byte(internalHttpError.Message), &errResponse); unmarshalErr != nil {
+				return nil, fmt.Errorf("unmarshal: %w", unmarshalErr)
+			}
+			// Invalid refresh tokens get their own error type so they can be
+			// better presented to users.
+			if errResponse.ErrorDescription == "Refresh token is invalid" {
+				return nil, &InvalidRefreshTokenError{err}
+			}
+			return nil, fmt.Errorf("%s (error code: %s)", errResponse.ErrorDescription, errResponse.Error)
+		}
+
+		// Handle responses from well-behaved *http.Client implementations.
+		if httpErr, ok := errors.AsType[*oauth2.RetrieveError](err); ok {
+			// Invalid refresh tokens get their own error type so they can be
+			// better presented to users.
+			if httpErr.ErrorDescription == "Refresh token is invalid" {
+				return nil, &InvalidRefreshTokenError{err}
+			}
+			return nil, fmt.Errorf("%s (error code: %s)", httpErr.ErrorDescription, httpErr.ErrorCode)
+		}
+		return nil, err
+	}
+	err = a.store.Put(a.oAuthArgument.GetCacheKey(), storage.Entry{Token: t})
+	if err != nil {
+		if cached := a.recoverStoreUpdate(oldToken, t); cached != nil {
+			return cached, nil
+		}
+		return nil, fmt.Errorf("cache update: %w", err)
+	}
+	return t, nil
+}
+
+// Challenge initiates the OAuth2 login flow for the given OAuthArgument. The
+// OAuth2 flow is started by opening the browser to the OAuth2 authorization
+// URL. The user is redirected to the callback server on appRedirectAddr. The
+// callback server listens for the redirect from the identity provider and
+// exchanges the authorization code for an access token. The caller is
+// responsible for storing the returned token.
+func (a *PersistentAuth) Challenge() (*oauth2.Token, error) {
+	if a.discoveryMode {
+		return a.discoveryChallenge()
+	}
+	err := a.startListener(a.ctx)
+	if err != nil {
+		return nil, fmt.Errorf("starting listener: %w", err)
+	}
+	// The listener will be closed by the callback server automatically, but if
+	// the callback server is not created, we need to close the listener manually.
+	defer a.Close()
+
+	cfg, err := a.oauth2Config()
+	if err != nil {
+		return nil, fmt.Errorf("fetching oauth config: %w", err)
+	}
+	cb, err := a.newCallbackServer()
+	if err != nil {
+		return nil, fmt.Errorf("callback server: %w", err)
+	}
+	defer cb.Close()
+
+	state, pkce, err := a.stateAndPKCE()
+	if err != nil {
+		return nil, fmt.Errorf("state and pkce: %w", err)
+	}
+	// make OAuth2 library use our client
+	ctx := a.setOAuthContext(a.ctx)
+	ts := authhandler.TokenSourceWithPKCE(ctx, cfg, state, cb.Handler, pkce)
+	t, err := ts.Token()
+	if err != nil {
+		return nil, fmt.Errorf("authorize: %w", err)
+	}
+	return t, nil
+}
+
+// discoveryChallenge handles the login.databricks.com discovery flow.
+// The listener must be started before the discovery token source is invoked
+// because the challenge needs the redirect address to build the authorize URL.
+func (a *PersistentAuth) discoveryChallenge() (*oauth2.Token, error) {
+	err := a.startListener(a.ctx)
+	if err != nil {
+		return nil, fmt.Errorf("starting listener: %w", err)
+	}
+	defer a.Close()
+	ds := &discoveryTokenSource{pa: a, host: a.discoveryHost}
+	if a.discoveryAccountTarget {
+		ds.target = discoveryTargetAccount
+	}
+	return ds.challenge()
+}
+
+// startListener starts a listener on appRedirectAddr, retrying if the address
+// is already in use.
+func (a *PersistentAuth) startListener(ctx context.Context) error {
+	if a.port != 0 { // if port is set, use it
+		return a.startListenerWithPort(a.port)
+	}
+	return a.startListenerWithFallback(ctx)
+}
+
+// startListenerWithFallback starts a listener that will try to find a free
+// port to listen on starting from the default port and incrementing by 1 until
+// a free port is found.
+func (a *PersistentAuth) startListenerWithFallback(ctx context.Context) error {
+	startTime := time.Now()
+	for port := defaultPort; port <= maxPortFallback; port++ {
+		if time.Since(startTime) > listenerTimeout {
+			return errListenerTimeout
+		}
+		if err := a.startListenerWithPort(port); err != nil {
+			logger.Debugf(ctx, "failed to listen on %d: %v, retrying", port, err)
+			continue
+		}
+		logger.Debugf(ctx, "OAuth callback server listening on %s", a.redirectAddr)
+		return nil
+	}
+	return errNoPortAvailable
+}
+
+func (a *PersistentAuth) startListenerWithPort(port int) error {
+	addr := fmt.Sprintf("localhost:%d", port)
+	listener, err := a.listen("tcp", addr)
+	if err != nil {
+		return fmt.Errorf("failed to listen on %s: %w", addr, err)
+	}
+	a.ln = listener
+	a.redirectAddr = addr
+	return nil
+}
+
+func (a *PersistentAuth) listen(network, addr string) (net.Listener, error) {
+	if a.netListen != nil {
+		return a.netListen(network, addr)
+	}
+	return net.Listen(network, addr)
+}
+
+func (a *PersistentAuth) Close() error {
+	if a.ln == nil {
+		return nil
+	}
+	return a.ln.Close()
+}
+
+// validateArg ensures that the OAuthArgument is either a WorkspaceOAuthArgument,
+// AccountOAuthArgument, UnifiedOAuthArgument, or a bootstrap-only
+// DiscoveryOAuthArgument paired with WithDiscoveryLogin.
+func (a *PersistentAuth) validateArg() error {
+	if a.oAuthArgument == nil {
+		return errors.New("missing OAuthArgument")
+	}
+	_, isWorkspaceArg := a.oAuthArgument.(WorkspaceOAuthArgument)
+	_, isAccountArg := a.oAuthArgument.(AccountOAuthArgument)
+	_, isUnifiedArg := a.oAuthArgument.(UnifiedOAuthArgument)
+	_, isDiscoveryArg := a.oAuthArgument.(DiscoveryOAuthArgument)
+	if !isWorkspaceArg && !isAccountArg && !isUnifiedArg && !isDiscoveryArg {
+		return fmt.Errorf("unsupported OAuthArgument type: %T, must implement WorkspaceOAuthArgument, AccountOAuthArgument, UnifiedOAuthArgument, or DiscoveryOAuthArgument", a.oAuthArgument)
+	}
+	if isDiscoveryArg && !a.discoveryMode {
+		return fmt.Errorf("discovery OAuthArgument %T requires WithDiscoveryLogin; after discovery, construct a WorkspaceOAuthArgument with the discovered host", a.oAuthArgument)
+	}
+	if a.discoveryMode && !isDiscoveryArg {
+		return fmt.Errorf("discovery login requires DiscoveryOAuthArgument, got %T", a.oAuthArgument)
+	}
+	return nil
+}
+
+// resolveScopes returns the effective OAuth scopes for this PersistentAuth.
+// It defaults to "all-apis" for backwards compatibility, and prepends
+// "offline_access" unless disabled.
+func (a *PersistentAuth) resolveScopes() []string {
+	scopes := a.scopes
+	if len(scopes) == 0 {
+		scopes = []string{"all-apis"}
+	}
+	if !a.disableOfflineAccess {
+		scopes = append([]string{"offline_access"}, scopes...)
+	}
+	return scopes
+}
+
+// oauth2Config returns the OAuth2 configuration for the given OAuthArgument.
+func (a *PersistentAuth) oauth2Config() (*oauth2.Config, error) {
+	scopes := a.resolveScopes()
+
+	var endpoints *OAuthAuthorizationServer
+	var err error
+	switch argg := a.oAuthArgument.(type) {
+	case WorkspaceOAuthArgument:
+		endpoints, err = a.endpointSupplier.GetWorkspaceOAuthEndpoints(a.ctx, argg.GetWorkspaceHost())
+	case AccountOAuthArgument:
+		endpoints, err = a.endpointSupplier.GetAccountOAuthEndpoints(
+			a.ctx, argg.GetAccountHost(), argg.GetAccountId(),
+		)
+	case UnifiedOAuthArgument:
+		endpoints, err = a.endpointSupplier.GetUnifiedOAuthEndpoints(a.ctx, argg.GetHost(), argg.GetAccountId())
+	case DiscoveryOAuthArgument:
+		return nil, fmt.Errorf("discovery OAuthArgument %T is only supported with WithDiscoveryLogin during Challenge; after discovery, construct a WorkspaceOAuthArgument with the discovered host", a.oAuthArgument)
+	default:
+		return nil, fmt.Errorf("unsupported OAuthArgument type: %T, must implement either WorkspaceOAuthArgument, AccountOAuthArgument or UnifiedOAuthArgument interface", a.oAuthArgument)
+	}
+	if err != nil {
+		return nil, fmt.Errorf("fetching OAuth endpoints: %w", err)
+	}
+	authURL, err := appendResources(endpoints.AuthorizationEndpoint, a.resources)
+	if err != nil {
+		return nil, err
+	}
+	return &oauth2.Config{
+		ClientID: a.clientID,
+		Endpoint: oauth2.Endpoint{
+			AuthURL:   authURL,
+			TokenURL:  endpoints.TokenEndpoint,
+			AuthStyle: oauth2.AuthStyleInParams,
+		},
+		RedirectURL: "http://" + a.redirectAddr,
+		Scopes:      scopes,
+	}, nil
+}
+
+// appendResources adds RFC 8707 `resource` indicators to an authorization
+// endpoint URL, preserving any query parameters the endpoint already carries.
+// The oauth2 library appends its own parameters (client_id, PKCE, etc.) after
+// these when it builds the final authorization URL.
+func appendResources(authURL string, resources []string) (string, error) {
+	if len(resources) == 0 {
+		return authURL, nil
+	}
+	u, err := url.Parse(authURL)
+	if err != nil {
+		return "", fmt.Errorf("parsing authorization endpoint: %w", err)
+	}
+	q := u.Query()
+	for _, r := range resources {
+		q.Add("resource", r)
+	}
+	u.RawQuery = q.Encode()
+	return u.String(), nil
+}
+
+func (a *PersistentAuth) stateAndPKCE() (string, *authhandler.PKCEParams, error) {
+	verifier, err := a.randomString(64)
+	if err != nil {
+		return "", nil, fmt.Errorf("verifier: %w", err)
+	}
+	verifierSha256 := sha256.Sum256([]byte(verifier))
+	challenge := base64.RawURLEncoding.EncodeToString(verifierSha256[:])
+	state, err := a.randomString(16)
+	if err != nil {
+		return "", nil, fmt.Errorf("state: %w", err)
+	}
+	return state, &authhandler.PKCEParams{
+		Challenge:       challenge,
+		ChallengeMethod: "S256",
+		Verifier:        verifier,
+	}, nil
+}
+
+func (a *PersistentAuth) randomString(size int) (string, error) {
+	raw := make([]byte, size)
+	// ignore error as rand.Reader never returns an error
+	_, err := rand.Read(raw)
+	if err != nil {
+		return "", fmt.Errorf("rand.Read: %w", err)
+	}
+	return base64.RawURLEncoding.EncodeToString(raw), nil
+}
+
+func (a *PersistentAuth) setOAuthContext(ctx context.Context) context.Context {
+	return context.WithValue(ctx, oauth2.HTTPClient, a.client)
+}
+
+var _ oauth2.TokenSource = (*PersistentAuth)(nil)
diff --git a/libs/auth/u2m/persistent_auth_test.go b/libs/auth/u2m/persistent_auth_test.go
new file mode 100644
index 00000000000..831fac8402c
--- /dev/null
+++ b/libs/auth/u2m/persistent_auth_test.go
@@ -0,0 +1,1585 @@
+package u2m
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/databricks/cli/libs/auth/storage"
+	"github.com/databricks/databricks-sdk-go/httpclient/fixtures"
+	"golang.org/x/oauth2"
+)
+
+type tokenStoreMock struct {
+	store  func(key string, t *oauth2.Token) error
+	lookup func(key string) (*oauth2.Token, error)
+}
+
+func (m *tokenStoreMock) Put(key string, e storage.Entry) error {
+	return m.store(key, e.Token)
+}
+
+func (m *tokenStoreMock) Lookup(key string) (storage.Entry, error) {
+	t, err := m.lookup(key)
+	return storage.Entry{Token: t}, err
+}
+
+func (m *tokenStoreMock) Delete(string) error { return nil }
+
+func TestToken(t *testing.T) {
+	cache := &tokenStoreMock{
+		lookup: func(key string) (*oauth2.Token, error) {
+			if key != "https://abc/oidc/accounts/xyz" {
+				t.Fatalf("lookup(): want key 'https://abc/oidc/accounts/xyz', got %s", key)
+			}
+			return &oauth2.Token{
+				AccessToken: "bcd",
+				Expiry:      time.Now().Add(1 * time.Hour),
+			}, nil
+		},
+	}
+	arg, err := NewBasicAccountOAuthArgument("https://abc", "xyz")
+	if err != nil {
+		t.Fatalf("NewBasicAccountOAuthArgument(): want no error, got %v", err)
+	}
+	p, err := NewPersistentAuth(t.Context(), WithTokenStore(cache), WithOAuthArgument(arg))
+	if err != nil {
+		t.Fatalf("NewPersistentAuth(): want no error, got %v", err)
+	}
+	defer p.Close()
+
+	tok, err := p.Token()
+	if err != nil {
+		t.Fatalf("p.Token(): want no error, got %v", err)
+	}
+	if tok.AccessToken != "bcd" {
+		t.Errorf("p.Token(): want access token 'bcd', got %s", tok.AccessToken)
+	}
+	if tok.RefreshToken != "" {
+		t.Errorf("p.Token(): want refresh token '', got %s", tok.RefreshToken)
+	}
+}
+
+func TestToken_WithProfile(t *testing.T) {
+	profileKey := "my-profile"
+	cache := &tokenStoreMock{
+		lookup: func(key string) (*oauth2.Token, error) {
+			if key != profileKey {
+				t.Fatalf("lookup(): want key %q, got %q", profileKey, key)
+			}
+			return &oauth2.Token{
+				AccessToken: "profile-token",
+				Expiry:      time.Now().Add(1 * time.Hour),
+			}, nil
+		},
+	}
+	arg, err := NewProfileAccountOAuthArgument("https://accounts.cloud.databricks.test", "xyz", profileKey)
+	if err != nil {
+		t.Fatalf("NewProfileAccountOAuthArgument(): want no error, got %v", err)
+	}
+	p, err := NewPersistentAuth(t.Context(), WithTokenStore(cache), WithOAuthArgument(arg))
+	if err != nil {
+		t.Fatalf("NewPersistentAuth(): want no error, got %v", err)
+	}
+	defer p.Close()
+
+	tok, err := p.Token()
+	if err != nil {
+		t.Fatalf("p.Token(): want no error, got %v", err)
+	}
+	if tok.AccessToken != "profile-token" {
+		t.Errorf("p.Token(): want access token 'profile-token', got %s", tok.AccessToken)
+	}
+}
+
+type MockOAuthEndpointSupplier struct{}
+
+func (m MockOAuthEndpointSupplier) GetAccountOAuthEndpoints(ctx context.Context, accountHost, accountId string) (*OAuthAuthorizationServer, error) {
+	return &OAuthAuthorizationServer{
+		AuthorizationEndpoint: fmt.Sprintf("%s/oidc/accounts/%s/v1/authorize", accountHost, accountId),
+		TokenEndpoint:         fmt.Sprintf("%s/oidc/accounts/%s/v1/token", accountHost, accountId),
+	}, nil
+}
+
+func (m MockOAuthEndpointSupplier) GetWorkspaceOAuthEndpoints(ctx context.Context, workspaceHost string) (*OAuthAuthorizationServer, error) {
+	return &OAuthAuthorizationServer{
+		AuthorizationEndpoint: workspaceHost + "/oidc/v1/authorize",
+		TokenEndpoint:         workspaceHost + "/oidc/v1/token",
+	}, nil
+}
+
+func (m MockOAuthEndpointSupplier) GetUnifiedOAuthEndpoints(ctx context.Context, host, accountId string) (*OAuthAuthorizationServer, error) {
+	return &OAuthAuthorizationServer{
+		AuthorizationEndpoint: fmt.Sprintf("%s/oidc/accounts/%s/v1/authorize", host, accountId),
+		TokenEndpoint:         fmt.Sprintf("%s/oidc/accounts/%s/v1/token", host, accountId),
+	}, nil
+}
+
+func (m MockOAuthEndpointSupplier) GetEndpointsFromURL(_ context.Context, _ string) (*OAuthAuthorizationServer, error) {
+	return nil, ErrOAuthNotSupported
+}
+
+func TestPersistentAuthClientID(t *testing.T) {
+	tests := []struct {
+		name string
+		opts []PersistentAuthOption
+		want string
+	}{
+		{
+			name: "default",
+			want: appClientID,
+		},
+		{
+			name: "custom",
+			opts: []PersistentAuthOption{WithClientID("custom-client-id")},
+			want: "custom-client-id",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			arg, err := NewBasicWorkspaceOAuthArgument("https://workspace.test")
+			if err != nil {
+				t.Fatalf("NewBasicWorkspaceOAuthArgument(): %v", err)
+			}
+			opts := append([]PersistentAuthOption{
+				WithOAuthArgument(arg),
+				WithOAuthEndpointSupplier(MockOAuthEndpointSupplier{}),
+			}, tt.opts...)
+			p, err := NewPersistentAuth(t.Context(), opts...)
+			if err != nil {
+				t.Fatalf("NewPersistentAuth(): %v", err)
+			}
+			cfg, err := p.oauth2Config()
+			if err != nil {
+				t.Fatalf("oauth2Config(): %v", err)
+			}
+			if cfg.ClientID != tt.want {
+				t.Errorf("client ID = %q, want %q", cfg.ClientID, tt.want)
+			}
+		})
+	}
+}
+
+func TestPersistentAuthResources(t *testing.T) {
+	tests := []struct {
+		name string
+		opts []PersistentAuthOption
+		want []string
+	}{
+		{
+			name: "none",
+			want: nil,
+		},
+		{
+			name: "single",
+			opts: []PersistentAuthOption{WithResources([]string{"https://workspace.test/ai-gateway/mcp-services/system.ai.github"})},
+			want: []string{"https://workspace.test/ai-gateway/mcp-services/system.ai.github"},
+		},
+		{
+			name: "multiple",
+			opts: []PersistentAuthOption{WithResources([]string{"https://a.test/r1", "https://b.test/r2"})},
+			want: []string{"https://a.test/r1", "https://b.test/r2"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			arg, err := NewBasicWorkspaceOAuthArgument("https://workspace.test")
+			if err != nil {
+				t.Fatalf("NewBasicWorkspaceOAuthArgument(): %v", err)
+			}
+			opts := append([]PersistentAuthOption{
+				WithOAuthArgument(arg),
+				WithOAuthEndpointSupplier(MockOAuthEndpointSupplier{}),
+			}, tt.opts...)
+			p, err := NewPersistentAuth(t.Context(), opts...)
+			if err != nil {
+				t.Fatalf("NewPersistentAuth(): %v", err)
+			}
+			cfg, err := p.oauth2Config()
+			if err != nil {
+				t.Fatalf("oauth2Config(): %v", err)
+			}
+			parsed, err := url.Parse(cfg.Endpoint.AuthURL)
+			if err != nil {
+				t.Fatalf("parsing AuthURL %q: %v", cfg.Endpoint.AuthURL, err)
+			}
+
+			got := parsed.Query()["resource"]
+
+			if !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("resource params = %v, want %v (AuthURL=%q)", got, tt.want, cfg.Endpoint.AuthURL)
+			}
+		})
+	}
+}
+
+func TestToken_RefreshesExpiredAccessToken(t *testing.T) {
+	ctx := t.Context()
+	expectedKey := "https://accounts.cloud.databricks.test/oidc/accounts/xyz"
+	cache := &tokenStoreMock{
+		lookup: func(key string) (*oauth2.Token, error) {
+			if key != expectedKey {
+				t.Fatalf("lookup(): want key %s, got %s", expectedKey, key)
+			}
+			return &oauth2.Token{
+				AccessToken:  "expired",
+				RefreshToken: "cde",
+				Expiry:       time.Now().Add(-1 * time.Minute),
+			}, nil
+		},
+		store: func(key string, tok *oauth2.Token) error {
+			if key != expectedKey {
+				t.Fatalf("store(): want key %s, got %s", expectedKey, key)
+			}
+			if tok.RefreshToken != "def" {
+				t.Fatalf("store(): want refresh token 'def', got %s", tok.RefreshToken)
+			}
+			return nil
+		},
+	}
+	arg, err := NewBasicAccountOAuthArgument("https://accounts.cloud.databricks.test", "xyz")
+	if err != nil {
+		t.Fatalf("NewBasicAccountOAuthArgument(): want no error, got %v", err)
+	}
+	p, err := NewPersistentAuth(
+		ctx,
+		WithTokenStore(cache),
+		WithHttpClient(&http.Client{
+			Transport: fixtures.SliceTransport{
+				{
+					Method:          "POST",
+					Resource:        "/oidc/accounts/xyz/v1/token",
+					ExpectedRequest: url.Values{"client_id": {"custom-client-id"}, "grant_type": {"refresh_token"}, "refresh_token": {"cde"}},
+					Response:        `access_token=refreshed&refresh_token=def`,
+					ResponseHeaders: map[string][]string{
+						"Content-Type": {"application/x-www-form-urlencoded"},
+					},
+				},
+			},
+		}),
+		WithOAuthEndpointSupplier(MockOAuthEndpointSupplier{}),
+		WithOAuthArgument(arg),
+		WithClientID("custom-client-id"),
+	)
+	if err != nil {
+		t.Errorf("NewPersistentAuth(): want no error, got %v", err)
+	}
+	defer p.Close()
+
+	tok, err := p.Token()
+	if err != nil {
+		t.Fatalf("p.Token(): want no error, got %v", err)
+	}
+	if tok.AccessToken != "refreshed" {
+		t.Errorf("p.Token(): want access token 'refreshed', got %s", tok.AccessToken)
+	}
+	if tok.RefreshToken != "" {
+		t.Errorf("p.Token(): want refresh token '', got %s", tok.RefreshToken)
+	}
+}
+
+func TestToken_RefreshesTokenExpiringSoon(t *testing.T) {
+	ctx := t.Context()
+	expectedKey := "https://accounts.cloud.databricks.test/oidc/accounts/xyz"
+	c := &tokenStoreMock{
+		lookup: func(key string) (*oauth2.Token, error) {
+			if key != expectedKey {
+				t.Fatalf("lookup(): want key %s, got %s", expectedKey, key)
+			}
+			return &oauth2.Token{
+				AccessToken:  "expiring-soon",
+				RefreshToken: "cde",
+				Expiry:       time.Now().Add(4 * time.Minute),
+			}, nil
+		},
+		store: func(key string, tok *oauth2.Token) error {
+			return nil
+		},
+	}
+	arg, err := NewBasicAccountOAuthArgument("https://accounts.cloud.databricks.test", "xyz")
+	if err != nil {
+		t.Fatalf("NewBasicAccountOAuthArgument(): want no error, got %v", err)
+	}
+	p, err := NewPersistentAuth(
+		ctx,
+		WithTokenStore(c),
+		WithHttpClient(&http.Client{
+			Transport: fixtures.SliceTransport{
+				{
+					Method:   "POST",
+					Resource: "/oidc/accounts/xyz/v1/token",
+					Response: `access_token=refreshed&refresh_token=def`,
+					ResponseHeaders: map[string][]string{
+						"Content-Type": {"application/x-www-form-urlencoded"},
+					},
+				},
+			},
+		}),
+		WithOAuthEndpointSupplier(MockOAuthEndpointSupplier{}),
+		WithOAuthArgument(arg),
+	)
+	if err != nil {
+		t.Fatalf("NewPersistentAuth(): want no error, got %v", err)
+	}
+	defer p.Close()
+
+	tok, err := p.Token()
+	if err != nil {
+		t.Fatalf("p.Token(): want no error, got %v", err)
+	}
+	if tok.AccessToken != "refreshed" {
+		t.Errorf("p.Token(): want access token 'refreshed', got %s", tok.AccessToken)
+	}
+}
+
+func TestToken_ReturnsStillValidTokenWhenProactiveRefreshFails(t *testing.T) {
+	ctx := t.Context()
+	expectedKey := "https://accounts.cloud.databricks.test/oidc/accounts/xyz"
+	transport := fixtures.SliceTransport{
+		{
+			Method:   "POST",
+			Resource: "/oidc/accounts/xyz/v1/token",
+			Response: `{"error": "temporarily_unavailable", "error_description": "temporarily unavailable"}`,
+			Status:   503,
+		},
+	}
+	c := &tokenStoreMock{
+		lookup: func(key string) (*oauth2.Token, error) {
+			if key != expectedKey {
+				t.Fatalf("lookup(): want key %s, got %s", expectedKey, key)
+			}
+			return &oauth2.Token{
+				AccessToken:  "still-valid",
+				RefreshToken: "cde",
+				Expiry:       time.Now().Add(4 * time.Minute),
+			}, nil
+		},
+		store: func(key string, tok *oauth2.Token) error {
+			t.Fatalf("store(): unexpected call - refresh should not succeed")
+			return nil
+		},
+	}
+	arg, err := NewBasicAccountOAuthArgument("https://accounts.cloud.databricks.test", "xyz")
+	if err != nil {
+		t.Fatalf("NewBasicAccountOAuthArgument(): want no error, got %v", err)
+	}
+	p, err := NewPersistentAuth(
+		ctx,
+		WithTokenStore(c),
+		WithHttpClient(&http.Client{Transport: transport}),
+		WithOAuthEndpointSupplier(MockOAuthEndpointSupplier{}),
+		WithOAuthArgument(arg),
+	)
+	if err != nil {
+		t.Fatalf("NewPersistentAuth(): want no error, got %v", err)
+	}
+	defer p.Close()
+
+	tok, err := p.Token()
+	if err != nil {
+		t.Fatalf("p.Token(): want no error, got %v", err)
+	}
+	if tok.AccessToken != "still-valid" {
+		t.Errorf("p.Token(): want access token 'still-valid', got %s", tok.AccessToken)
+	}
+	if tok.RefreshToken != "" {
+		t.Errorf("p.Token(): want refresh token '', got %s", tok.RefreshToken)
+	}
+	if transport[0].Method != "" {
+		t.Errorf("refresh(): want proactive refresh attempt, but request was not sent")
+	}
+}
+
+func TestToken_DoesNotRefreshTokenNotExpiringSoon(t *testing.T) {
+	transport := fixtures.SliceTransport{}
+	c := &tokenStoreMock{
+		lookup: func(key string) (*oauth2.Token, error) {
+			return &oauth2.Token{
+				AccessToken: "still-valid",
+				Expiry:      time.Now().Add(6 * time.Minute),
+			}, nil
+		},
+		store: func(key string, tok *oauth2.Token) error {
+			t.Fatalf("store(): unexpected call — token should not be refreshed")
+			return nil
+		},
+	}
+	arg, err := NewBasicAccountOAuthArgument("https://accounts.cloud.databricks.test", "xyz")
+	if err != nil {
+		t.Fatalf("NewBasicAccountOAuthArgument(): want no error, got %v", err)
+	}
+	p, err := NewPersistentAuth(
+		t.Context(),
+		WithTokenStore(c),
+		WithHttpClient(&http.Client{Transport: transport}),
+		WithOAuthEndpointSupplier(MockOAuthEndpointSupplier{}),
+		WithOAuthArgument(arg),
+	)
+	if err != nil {
+		t.Fatalf("NewPersistentAuth(): want no error, got %v", err)
+	}
+	defer p.Close()
+
+	tok, err := p.Token()
+	if err != nil {
+		t.Fatalf("p.Token(): want no error, got %v", err)
+	}
+	if tok.AccessToken != "still-valid" {
+		t.Errorf("p.Token(): want access token 'still-valid', got %s", tok.AccessToken)
+	}
+}
+
+func TestToken_ZeroExpiryDoesNotTriggerRefresh(t *testing.T) {
+	transport := fixtures.SliceTransport{}
+	c := &tokenStoreMock{
+		lookup: func(key string) (*oauth2.Token, error) {
+			return &oauth2.Token{
+				AccessToken: "no-expiry",
+			}, nil
+		},
+		store: func(key string, tok *oauth2.Token) error {
+			t.Fatalf("store(): unexpected call — zero-expiry token should not be refreshed")
+			return nil
+		},
+	}
+	arg, err := NewBasicAccountOAuthArgument("https://accounts.cloud.databricks.test", "xyz")
+	if err != nil {
+		t.Fatalf("NewBasicAccountOAuthArgument(): want no error, got %v", err)
+	}
+	p, err := NewPersistentAuth(
+		t.Context(),
+		WithTokenStore(c),
+		WithHttpClient(&http.Client{Transport: transport}),
+		WithOAuthEndpointSupplier(MockOAuthEndpointSupplier{}),
+		WithOAuthArgument(arg),
+	)
+	if err != nil {
+		t.Fatalf("NewPersistentAuth(): want no error, got %v", err)
+	}
+	defer p.Close()
+
+	tok, err := p.Token()
+	if err != nil {
+		t.Fatalf("p.Token(): want no error, got %v", err)
+	}
+	if tok.AccessToken != "no-expiry" {
+		t.Errorf("p.Token(): want access token 'no-expiry', got %s", tok.AccessToken)
+	}
+}
+
+func TestToken_ReturnsError(t *testing.T) {
+	ctx := t.Context()
+	cache := &tokenStoreMock{
+		lookup: func(key string) (*oauth2.Token, error) {
+			if key != "https://accounts.cloud.databricks.test/oidc/accounts/xyz" {
+				t.Fatalf("lookup(): want key 'https://accounts.cloud.databricks.test/oidc/accounts/xyz', got %s", key)
+			}
+			return &oauth2.Token{
+				AccessToken:  "expired",
+				RefreshToken: "cde",
+				Expiry:       time.Now().Add(-1 * time.Minute),
+			}, nil
+		},
+	}
+	arg, err := NewBasicAccountOAuthArgument("https://accounts.cloud.databricks.test", "xyz")
+	if err != nil {
+		t.Fatalf("NewBasicAccountOAuthArgument(): want no error, got %v", err)
+	}
+	p, err := NewPersistentAuth(
+		ctx,
+		WithTokenStore(cache),
+		WithHttpClient(&http.Client{
+			Transport: fixtures.SliceTransport{
+				{
+					Method:   "POST",
+					Resource: "/oidc/accounts/xyz/v1/token",
+					Response: `{"error": "invalid_grant", "error_description": "Invalid Client"}`,
+					Status:   401,
+				},
+			},
+		}),
+		WithOAuthEndpointSupplier(MockOAuthEndpointSupplier{}),
+		WithOAuthArgument(arg),
+	)
+	if err != nil {
+		t.Errorf("NewPersistentAuth(): want no error, got %v", err)
+	}
+	defer p.Close()
+	tok, err := p.Token()
+
+	if tok != nil {
+		t.Errorf("p.Token(): want nil, got %v", tok)
+	}
+	if !strings.Contains(err.Error(), "Invalid Client (error code: invalid_grant)") {
+		t.Errorf("p.Token(): want error containing 'Invalid Client (error code: invalid_grant)', got %v", err)
+	}
+}
+
+func TestToken_ReturnsInvalidRefreshTokenError(t *testing.T) {
+	ctx := t.Context()
+	cache := &tokenStoreMock{
+		lookup: func(key string) (*oauth2.Token, error) {
+			if key != "https://accounts.cloud.databricks.test/oidc/accounts/xyz" {
+				t.Fatalf("lookup(): want key 'https://accounts.cloud.databricks.test/oidc/accounts/xyz', got %s", key)
+			}
+			return &oauth2.Token{
+				AccessToken:  "expired",
+				RefreshToken: "cde",
+				Expiry:       time.Now().Add(-1 * time.Minute),
+			}, nil
+		},
+	}
+	arg, err := NewBasicAccountOAuthArgument("https://accounts.cloud.databricks.test", "xyz")
+	if err != nil {
+		t.Fatalf("NewBasicAccountOAuthArgument(): want no error, got %v", err)
+	}
+	p, err := NewPersistentAuth(
+		ctx,
+		WithTokenStore(cache),
+		WithHttpClient(&http.Client{
+			Transport: fixtures.SliceTransport{
+				{
+					Method:   "POST",
+					Resource: "/oidc/accounts/xyz/v1/token",
+					Response: `{"error": "invalid_grant", "error_description": "Refresh token is invalid"}`,
+					Status:   401,
+				},
+			},
+		}),
+		WithOAuthEndpointSupplier(MockOAuthEndpointSupplier{}),
+		WithOAuthArgument(arg),
+	)
+	if err != nil {
+		t.Errorf("NewPersistentAuth(): want no error, got %v", err)
+	}
+	defer p.Close()
+	tok, err := p.Token()
+	if tok != nil {
+		t.Fatalf("p.Token(): want nil, got %v", tok)
+	}
+	if _, ok := errors.AsType[*InvalidRefreshTokenError](err); !ok {
+		t.Fatalf("p.Token(): want error of type InvalidRefreshTokenError, got %v", err)
+	}
+}
+
+func TestToken_ReturnsMissingRefreshTokenErrorWhenExpired(t *testing.T) {
+	c := &tokenStoreMock{
+		lookup: func(key string) (*oauth2.Token, error) {
+			return &oauth2.Token{
+				AccessToken: "expired",
+				Expiry:      time.Now().Add(-1 * time.Minute),
+			}, nil
+		},
+		store: func(key string, tok *oauth2.Token) error {
+			t.Fatalf("store(): unexpected call — Token() should fail before writing when refresh token is missing")
+			return nil
+		},
+	}
+	arg, err := NewBasicAccountOAuthArgument("https://accounts.cloud.databricks.test", "xyz")
+	if err != nil {
+		t.Fatalf("NewBasicAccountOAuthArgument(): %v", err)
+	}
+	p, err := NewPersistentAuth(
+		t.Context(),
+		WithTokenStore(c),
+		WithHttpClient(&http.Client{Transport: fixtures.SliceTransport{}}),
+		WithOAuthEndpointSupplier(MockOAuthEndpointSupplier{}),
+		WithOAuthArgument(arg),
+	)
+	if err != nil {
+		t.Fatalf("NewPersistentAuth(): %v", err)
+	}
+	defer p.Close()
+
+	tok, err := p.Token()
+	if err == nil {
+		t.Fatal("Token(): want error when refresh token is missing, got nil")
+	}
+	if tok != nil {
+		t.Errorf("Token(): want nil token on error, got %v", tok)
+	}
+	if !errors.Is(err, ErrMissingRefreshToken) {
+		t.Fatalf("Token(): want ErrMissingRefreshToken, got %v", err)
+	}
+	want := "token refresh: cached token has no refresh token"
+	if got := err.Error(); got != want {
+		t.Errorf("Token(): want error %q, got %q", want, got)
+	}
+}
+
+func TestToken_ReturnsExistingTokenWhenNearExpiryAndNoRefreshToken(t *testing.T) {
+	// Token is still valid but within the proactive refresh window (5 min).
+	// Token() attempts refresh, refresh() returns ErrMissingRefreshToken.
+	// Token() falls back to the existing token since it is still valid.
+	c := &tokenStoreMock{
+		lookup: func(key string) (*oauth2.Token, error) {
+			return &oauth2.Token{
+				AccessToken: "near-expiry",
+				Expiry:      time.Now().Add(3 * time.Minute), // within tokenRefreshBuffer
+			}, nil
+		},
+		store: func(key string, tok *oauth2.Token) error {
+			t.Fatalf("store(): unexpected call — Token() should return existing token without migrating")
+			return nil
+		},
+	}
+	arg, err := NewBasicAccountOAuthArgument("https://accounts.cloud.databricks.test", "xyz")
+	if err != nil {
+		t.Fatalf("NewBasicAccountOAuthArgument(): %v", err)
+	}
+	p, err := NewPersistentAuth(
+		t.Context(),
+		WithTokenStore(c),
+		WithHttpClient(&http.Client{Transport: fixtures.SliceTransport{}}),
+		WithOAuthEndpointSupplier(MockOAuthEndpointSupplier{}),
+		WithOAuthArgument(arg),
+	)
+	if err != nil {
+		t.Fatalf("NewPersistentAuth(): %v", err)
+	}
+	defer p.Close()
+
+	tok, err := p.Token()
+	if err != nil {
+		t.Fatalf("Token(): want no error when falling back to valid token, got %v", err)
+	}
+	if tok == nil {
+		t.Fatal("Token(): want token, got nil")
+	}
+	if tok.AccessToken != "near-expiry" {
+		t.Errorf("Token(): want access token 'near-expiry', got %s", tok.AccessToken)
+	}
+}
+
+func TestForceRefreshToken_RefreshesValidToken(t *testing.T) {
+	refreshCalled := false
+	c := &tokenStoreMock{
+		lookup: func(key string) (*oauth2.Token, error) {
+			return &oauth2.Token{
+				AccessToken:  "still-valid",
+				RefreshToken: "refresh-me",
+				Expiry:       time.Now().Add(1 * time.Hour),
+			}, nil
+		},
+		store: func(key string, tok *oauth2.Token) error {
+			refreshCalled = true
+			return nil
+		},
+	}
+	arg, err := NewBasicAccountOAuthArgument("https://accounts.cloud.databricks.test", "xyz")
+	if err != nil {
+		t.Fatalf("NewBasicAccountOAuthArgument(): %v", err)
+	}
+	p, err := NewPersistentAuth(
+		t.Context(),
+		WithTokenStore(c),
+		WithHttpClient(&http.Client{
+			Transport: fixtures.SliceTransport{
+				{
+					Method:   "POST",
+					Resource: "/oidc/accounts/xyz/v1/token",
+					Response: `access_token=force-refreshed&refresh_token=new-refresh`,
+					ResponseHeaders: map[string][]string{
+						"Content-Type": {"application/x-www-form-urlencoded"},
+					},
+				},
+			},
+		}),
+		WithOAuthEndpointSupplier(MockOAuthEndpointSupplier{}),
+		WithOAuthArgument(arg),
+	)
+	if err != nil {
+		t.Fatalf("NewPersistentAuth(): %v", err)
+	}
+	defer p.Close()
+
+	tok, err := p.ForceRefreshToken()
+	if err != nil {
+		t.Fatalf("ForceRefreshToken(): want no error, got %v", err)
+	}
+	if tok.AccessToken != "force-refreshed" {
+		t.Errorf("ForceRefreshToken(): want access token 'force-refreshed', got %s", tok.AccessToken)
+	}
+	if tok.RefreshToken != "" {
+		t.Errorf("ForceRefreshToken(): want refresh token redacted, got %s", tok.RefreshToken)
+	}
+	if !refreshCalled {
+		t.Error("ForceRefreshToken(): want refresh to be called for valid token, but it was not")
+	}
+}
+
+func TestForceRefreshToken_RecoversConcurrentCacheUpdate(t *testing.T) {
+	now := time.Date(2100, time.January, 1, 0, 0, 0, 0, time.UTC)
+	old := &oauth2.Token{
+		AccessToken:  "old-access",
+		RefreshToken: "old-refresh",
+		Expiry:       now.Add(time.Hour),
+	}
+	winner := &oauth2.Token{
+		AccessToken:  "winner-access",
+		RefreshToken: "winner-refresh",
+		Expiry:       now.Add(time.Hour - 30*time.Second),
+	}
+	lookupCalls := 0
+	c := &tokenStoreMock{
+		lookup: func(key string) (*oauth2.Token, error) {
+			lookupCalls++
+			if lookupCalls <= 2 {
+				return old, nil
+			}
+			return winner, nil
+		},
+		store: func(key string, tok *oauth2.Token) error {
+			if tok.AccessToken != "candidate-access" {
+				t.Fatalf("store(): want candidate access token, got %q", tok.AccessToken)
+			}
+			return errors.New("concurrent cache update")
+		},
+	}
+	arg, err := NewBasicAccountOAuthArgument("https://accounts.cloud.databricks.test", "xyz")
+	if err != nil {
+		t.Fatalf("NewBasicAccountOAuthArgument(): %v", err)
+	}
+	p, err := NewPersistentAuth(
+		t.Context(),
+		WithTokenStore(c),
+		WithHttpClient(&http.Client{
+			Transport: fixtures.SliceTransport{
+				{
+					Method:   "POST",
+					Resource: "/oidc/accounts/xyz/v1/token",
+					Response: `access_token=candidate-access&refresh_token=candidate-refresh&expires_in=3600`,
+					ResponseHeaders: map[string][]string{
+						"Content-Type": {"application/x-www-form-urlencoded"},
+					},
+				},
+			},
+		}),
+		WithOAuthEndpointSupplier(MockOAuthEndpointSupplier{}),
+		WithOAuthArgument(arg),
+	)
+	if err != nil {
+		t.Fatalf("NewPersistentAuth(): %v", err)
+	}
+	defer p.Close()
+
+	tok, err := p.ForceRefreshToken()
+	if err != nil {
+		t.Fatalf("ForceRefreshToken(): want no error, got %v", err)
+	}
+	if tok.AccessToken != winner.AccessToken {
+		t.Errorf("ForceRefreshToken(): want winner access token %q, got %q", winner.AccessToken, tok.AccessToken)
+	}
+	if tok.RefreshToken != "" {
+		t.Errorf("ForceRefreshToken(): want refresh token redacted, got %q", tok.RefreshToken)
+	}
+	if lookupCalls != 3 {
+		t.Errorf("Lookup(): want 3 calls, got %d", lookupCalls)
+	}
+}
+
+func TestIsFreshReplacement(t *testing.T) {
+	now := time.Date(2100, time.January, 1, 0, 0, 0, 0, time.UTC)
+	old := &oauth2.Token{AccessToken: "old", Expiry: now.Add(time.Hour)}
+	candidate := &oauth2.Token{AccessToken: "candidate", Expiry: now.Add(time.Hour)}
+
+	tests := []struct {
+		name      string
+		candidate *oauth2.Token
+		cached    *oauth2.Token
+		want      bool
+	}{
+		{
+			name:      "same token",
+			candidate: candidate,
+			cached:    &oauth2.Token{AccessToken: "old", Expiry: now.Add(time.Hour)},
+			want:      false,
+		},
+		{
+			name:      "expired replacement",
+			candidate: candidate,
+			cached:    &oauth2.Token{AccessToken: "winner", Expiry: time.Date(2000, time.January, 1, 0, 0, 0, 0, time.UTC)},
+			want:      false,
+		},
+		{
+			name:      "replacement expires too soon",
+			candidate: candidate,
+			cached:    &oauth2.Token{AccessToken: "winner", Expiry: candidate.Expiry.Add(-time.Minute - time.Second)},
+			want:      false,
+		},
+		{
+			name:      "replacement expiry within tolerance",
+			candidate: candidate,
+			cached:    &oauth2.Token{AccessToken: "winner", Expiry: candidate.Expiry.Add(-time.Minute)},
+			want:      true,
+		},
+		{
+			name:      "replacement expires later",
+			candidate: candidate,
+			cached:    &oauth2.Token{AccessToken: "winner", Expiry: candidate.Expiry.Add(time.Minute)},
+			want:      true,
+		},
+		{
+			name:      "expiring candidate and non-expiring replacement",
+			candidate: candidate,
+			cached:    &oauth2.Token{AccessToken: "winner"},
+			want:      true,
+		},
+		{
+			name:      "non-expiring candidate and replacement inside refresh buffer",
+			candidate: &oauth2.Token{AccessToken: "candidate"},
+			cached:    &oauth2.Token{AccessToken: "winner", Expiry: now.Add(time.Minute)},
+			want:      false,
+		},
+		{
+			name:      "non-expiring candidate and replacement",
+			candidate: &oauth2.Token{AccessToken: "candidate"},
+			cached:    &oauth2.Token{AccessToken: "winner"},
+			want:      true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := isFreshReplacement(old, tt.candidate, tt.cached); got != tt.want {
+				t.Errorf("isFreshReplacement(): want %t, got %t", tt.want, got)
+			}
+		})
+	}
+}
+
+func TestForceRefreshToken_WithMemoryStorePreservesCachedRefreshToken(t *testing.T) {
+	tokenStore := storage.NewMemoryStore()
+	arg, err := NewBasicAccountOAuthArgument("https://accounts.cloud.databricks.test", "xyz")
+	if err != nil {
+		t.Fatalf("NewBasicAccountOAuthArgument(): %v", err)
+	}
+	if err := tokenStore.Put(arg.GetCacheKey(), storage.Entry{Token: &oauth2.Token{
+		AccessToken:  "still-valid",
+		RefreshToken: "refresh-me",
+		Expiry:       time.Now().Add(1 * time.Hour),
+	}}); err != nil {
+		t.Fatalf("Put(): %v", err)
+	}
+
+	p, err := NewPersistentAuth(
+		t.Context(),
+		WithTokenStore(tokenStore),
+		WithHttpClient(&http.Client{
+			Transport: fixtures.SliceTransport{
+				{
+					Method:   "POST",
+					Resource: "/oidc/accounts/xyz/v1/token",
+					Response: `access_token=force-refreshed&refresh_token=new-refresh`,
+					ResponseHeaders: map[string][]string{
+						"Content-Type": {"application/x-www-form-urlencoded"},
+					},
+				},
+			},
+		}),
+		WithOAuthEndpointSupplier(MockOAuthEndpointSupplier{}),
+		WithOAuthArgument(arg),
+	)
+	if err != nil {
+		t.Fatalf("NewPersistentAuth(): %v", err)
+	}
+	defer p.Close()
+
+	tok, err := p.ForceRefreshToken()
+	if err != nil {
+		t.Fatalf("ForceRefreshToken(): want no error, got %v", err)
+	}
+	if tok.RefreshToken != "" {
+		t.Fatalf("ForceRefreshToken(): want refresh token redacted, got %q", tok.RefreshToken)
+	}
+
+	cached, err := tokenStore.Lookup(arg.GetCacheKey())
+	if err != nil {
+		t.Fatalf("Lookup(): want cached token, got %v", err)
+	}
+	if cached.Token.RefreshToken != "new-refresh" {
+		t.Fatalf("Lookup(): want cached refresh token %q, got %q", "new-refresh", cached.Token.RefreshToken)
+	}
+}
+
+func TestForceRefreshToken_FailsWithoutRefreshToken(t *testing.T) {
+	c := &tokenStoreMock{
+		lookup: func(key string) (*oauth2.Token, error) {
+			return &oauth2.Token{
+				AccessToken: "still-valid",
+				Expiry:      time.Now().Add(1 * time.Hour),
+			}, nil
+		},
+		store: func(key string, tok *oauth2.Token) error {
+			t.Fatalf("store(): unexpected call — ForceRefreshToken() should fail before writing when refresh token is missing")
+			return nil
+		},
+	}
+	arg, err := NewBasicAccountOAuthArgument("https://accounts.cloud.databricks.test", "xyz")
+	if err != nil {
+		t.Fatalf("NewBasicAccountOAuthArgument(): %v", err)
+	}
+	p, err := NewPersistentAuth(
+		t.Context(),
+		WithTokenStore(c),
+		WithHttpClient(&http.Client{Transport: fixtures.SliceTransport{}}),
+		WithOAuthEndpointSupplier(MockOAuthEndpointSupplier{}),
+		WithOAuthArgument(arg),
+	)
+	if err != nil {
+		t.Fatalf("NewPersistentAuth(): %v", err)
+	}
+	defer p.Close()
+
+	tok, err := p.ForceRefreshToken()
+	if err == nil {
+		t.Fatal("ForceRefreshToken(): want error when refresh token is missing, got nil")
+	}
+	if tok != nil {
+		t.Errorf("ForceRefreshToken(): want nil token on error, got %v", tok)
+	}
+	if !errors.Is(err, ErrMissingRefreshToken) {
+		t.Fatalf("ForceRefreshToken(): want ErrMissingRefreshToken, got %v", err)
+	}
+	want := "forced token refresh: cached token has no refresh token"
+	if got := err.Error(); got != want {
+		t.Errorf("ForceRefreshToken(): want error %q, got %q", want, got)
+	}
+}
+
+func TestForceRefreshToken_FailsOnRefreshError(t *testing.T) {
+	c := &tokenStoreMock{
+		lookup: func(key string) (*oauth2.Token, error) {
+			return &oauth2.Token{
+				AccessToken:  "still-valid",
+				RefreshToken: "bad-refresh",
+				Expiry:       time.Now().Add(1 * time.Hour),
+			}, nil
+		},
+		store: func(key string, tok *oauth2.Token) error {
+			t.Fatalf("store(): unexpected call — refresh should not succeed")
+			return nil
+		},
+	}
+	arg, err := NewBasicAccountOAuthArgument("https://accounts.cloud.databricks.test", "xyz")
+	if err != nil {
+		t.Fatalf("NewBasicAccountOAuthArgument(): %v", err)
+	}
+	p, err := NewPersistentAuth(
+		t.Context(),
+		WithTokenStore(c),
+		WithHttpClient(&http.Client{
+			Transport: fixtures.SliceTransport{
+				{
+					Method:   "POST",
+					Resource: "/oidc/accounts/xyz/v1/token",
+					Response: `{"error": "temporarily_unavailable", "error_description": "temporarily unavailable"}`,
+					Status:   503,
+				},
+			},
+		}),
+		WithOAuthEndpointSupplier(MockOAuthEndpointSupplier{}),
+		WithOAuthArgument(arg),
+	)
+	if err != nil {
+		t.Fatalf("NewPersistentAuth(): %v", err)
+	}
+	defer p.Close()
+
+	tok, err := p.ForceRefreshToken()
+	if err == nil {
+		t.Fatal("ForceRefreshToken(): want error when refresh fails, got nil")
+	}
+	if tok != nil {
+		t.Errorf("ForceRefreshToken(): want nil token on error, got %v", tok)
+	}
+	want := "forced token refresh: temporarily unavailable (error code: temporarily_unavailable)"
+	if got := err.Error(); got != want {
+		t.Errorf("ForceRefreshToken(): want error %q, got %q", want, got)
+	}
+}
+
+func TestForceRefreshToken_InvalidRefreshTokenError(t *testing.T) {
+	c := &tokenStoreMock{
+		lookup: func(key string) (*oauth2.Token, error) {
+			return &oauth2.Token{
+				AccessToken:  "expired",
+				RefreshToken: "bad-refresh",
+				Expiry:       time.Now().Add(-1 * time.Minute),
+			}, nil
+		},
+		store: func(key string, tok *oauth2.Token) error {
+			t.Fatalf("store(): unexpected call — refresh should not succeed")
+			return nil
+		},
+	}
+	arg, err := NewBasicAccountOAuthArgument("https://accounts.cloud.databricks.test", "xyz")
+	if err != nil {
+		t.Fatalf("NewBasicAccountOAuthArgument(): %v", err)
+	}
+	p, err := NewPersistentAuth(
+		t.Context(),
+		WithTokenStore(c),
+		WithHttpClient(&http.Client{
+			Transport: fixtures.SliceTransport{
+				{
+					Method:   "POST",
+					Resource: "/oidc/accounts/xyz/v1/token",
+					Response: `{"error": "invalid_grant", "error_description": "Refresh token is invalid"}`,
+					Status:   401,
+				},
+			},
+		}),
+		WithOAuthEndpointSupplier(MockOAuthEndpointSupplier{}),
+		WithOAuthArgument(arg),
+	)
+	if err != nil {
+		t.Fatalf("NewPersistentAuth(): %v", err)
+	}
+	defer p.Close()
+
+	tok, err := p.ForceRefreshToken()
+	if tok != nil {
+		t.Fatalf("ForceRefreshToken(): want nil token, got %v", tok)
+	}
+	if _, ok := errors.AsType[*InvalidRefreshTokenError](err); !ok {
+		t.Fatalf("ForceRefreshToken(): want InvalidRefreshTokenError, got %v", err)
+	}
+}
+
+func TestChallenge(t *testing.T) {
+	ctx := t.Context()
+
+	browserOpened := make(chan string)
+	browser := func(redirect string) error {
+		u, err := url.ParseRequestURI(redirect)
+		if err != nil {
+			return err
+		}
+		if u.Path != "/oidc/accounts/xyz/v1/authorize" {
+			t.Fatalf("browser(): want path '/oidc/accounts/xyz/v1/authorize', got %s", u.Path)
+		}
+		query := u.Query()
+		if query.Get("client_id") != "custom-client-id" {
+			t.Fatalf("browser(): client_id = %q, want %q", query.Get("client_id"), "custom-client-id")
+		}
+		browserOpened <- query.Get("state")
+		return nil
+	}
+	storeWrites := 0
+	store := &tokenStoreMock{
+		store: func(string, *oauth2.Token) error {
+			storeWrites++
+			return nil
+		},
+	}
+	arg, err := NewBasicAccountOAuthArgument("https://accounts.cloud.databricks.test", "xyz")
+	if err != nil {
+		t.Fatalf("NewBasicAccountOAuthArgument(): want no error, got %v", err)
+	}
+
+	p, err := NewPersistentAuth(
+		ctx,
+		WithTokenStore(store),
+		WithBrowser(browser),
+		WithHttpClient(&http.Client{
+			Transport: fixtures.SliceTransport{
+				{
+					Method:   "POST",
+					Resource: "/oidc/accounts/xyz/v1/token",
+					Response: `access_token=__THAT__&refresh_token=__SOMETHING__`,
+					ResponseHeaders: map[string][]string{
+						"Content-Type": {"application/x-www-form-urlencoded"},
+					},
+				},
+			},
+		}),
+		WithOAuthEndpointSupplier(MockOAuthEndpointSupplier{}),
+		WithOAuthArgument(arg),
+		WithClientID("custom-client-id"),
+	)
+	if err != nil {
+		t.Errorf("NewPersistentAuth(): want no error, got %v", err)
+	}
+	defer p.Close()
+
+	type challengeResult struct {
+		token *oauth2.Token
+		err   error
+	}
+	resultc := make(chan challengeResult)
+	go func() {
+		token, err := p.Challenge()
+		resultc <- challengeResult{token: token, err: err}
+	}()
+
+	state := <-browserOpened
+	resp, err := http.Get("http://" + p.redirectAddr + "?code=__THIS__&state=" + state)
+	if err != nil {
+		t.Fatalf("http.Get(): want no error, got %v", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("http.Get(): want status code 200, got %d", resp.StatusCode)
+	}
+
+	result := <-resultc
+	if result.err != nil {
+		t.Fatalf("p.Challenge(): want no error, got %v", result.err)
+	}
+	if result.token.AccessToken != "__THAT__" {
+		t.Errorf("p.Challenge(): want access token '__THAT__', got %s", result.token.AccessToken)
+	}
+	if result.token.RefreshToken != "__SOMETHING__" {
+		t.Errorf("p.Challenge(): want refresh token '__SOMETHING__', got %s", result.token.RefreshToken)
+	}
+	if storeWrites != 0 {
+		t.Errorf("p.Challenge(): want no store writes, got %d", storeWrites)
+	}
+}
+
+func TestChallenge_ReturnsErrorOnFailure(t *testing.T) {
+	ctx := t.Context()
+	browserOpened := make(chan string)
+	browser := func(redirect string) error {
+		u, err := url.ParseRequestURI(redirect)
+		if err != nil {
+			return err
+		}
+		if u.Path != "/oidc/accounts/xyz/v1/authorize" {
+			t.Fatalf("browser(): want path '/oidc/accounts/xyz/v1/authorize', got %s", u.Path)
+		}
+		// for now we're ignoring asserting the fields of the redirect
+		query := u.Query()
+		browserOpened <- query.Get("state")
+		return nil
+	}
+	arg, err := NewBasicAccountOAuthArgument("https://accounts.cloud.databricks.test", "xyz")
+	if err != nil {
+		t.Fatalf("NewBasicAccountOAuthArgument(): want no error, got %v", err)
+	}
+
+	p, err := NewPersistentAuth(ctx, WithBrowser(browser), WithOAuthArgument(arg))
+	if err != nil {
+		t.Errorf("NewPersistentAuth(): want no error, got %v", err)
+	}
+	defer p.Close()
+
+	errc := make(chan error)
+	go func() {
+		_, err := p.Challenge()
+		errc <- err
+		close(errc)
+	}()
+
+	<-browserOpened
+	resp, err := http.Get("http://" + p.redirectAddr + "?error=access_denied&error_description=Policy%20evaluation%20failed%20for%20this%20request")
+	if err != nil {
+		t.Fatalf("http.Get(): want no error, got %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusBadRequest {
+		t.Fatalf("http.Get(): want status code 400, got %d", resp.StatusCode)
+	}
+
+	err = <-errc
+	if err == nil {
+		t.Fatalf("p.Challenge(): want error, got nil")
+	}
+	if !strings.Contains(err.Error(), "authorize: access_denied: Policy evaluation failed for this request") {
+		t.Fatalf("p.Challenge(): want error containing 'authorize: access_denied: Policy evaluation failed for this request', got %v", err)
+	}
+}
+
+func TestPersistentAuth_startListener_startFrom8020(t *testing.T) {
+	pa := &PersistentAuth{}
+	pa.netListen = func(_, address string) (net.Listener, error) {
+		return nil, nil
+	}
+
+	gotErr := pa.startListener(t.Context())
+
+	if gotErr != nil {
+		t.Fatalf("pa.startListener(): want no error, got %v", gotErr)
+	}
+	if pa.redirectAddr != "localhost:8020" {
+		t.Errorf("pa.redirectAddr should be localhost:8020, got %s", pa.redirectAddr)
+	}
+}
+
+func TestPersistentAuth_startListener_incrementalFallBack(t *testing.T) {
+	pa := &PersistentAuth{}
+	pa.netListen = func(_, address string) (net.Listener, error) {
+		if address == "localhost:8020" {
+			return nil, errors.New("address already in use")
+		}
+		if address == "localhost:8021" {
+			return nil, errors.New("address already in use")
+		}
+		return nil, nil
+	}
+
+	gotErr := pa.startListener(t.Context())
+
+	if gotErr != nil {
+		t.Fatalf("pa.startListener(): want no error, got %v", gotErr)
+	}
+	if pa.redirectAddr != "localhost:8022" {
+		t.Errorf("pa.redirectAddr should be localhost:8022, got %s", pa.redirectAddr)
+	}
+}
+
+func TestPersistentAuth_startListener_noAvailablePort(t *testing.T) {
+	pa := &PersistentAuth{}
+	pa.netListen = func(_, address string) (net.Listener, error) {
+		return nil, errors.New("address already in use")
+	}
+
+	gotErr := pa.startListener(t.Context())
+
+	if !errors.Is(gotErr, errNoPortAvailable) {
+		t.Fatalf("pa.startListener(): want error %v, got %v", errNoPortAvailable, gotErr)
+	}
+}
+
+func TestPersistentAuth_startListener_maxPortFallbackIncluded(t *testing.T) {
+	maxAddress := fmt.Sprintf("localhost:%d", maxPortFallback)
+	pa := &PersistentAuth{}
+	pa.netListen = func(_, address string) (net.Listener, error) {
+		if address == maxAddress {
+			return nil, nil
+		}
+		return nil, errors.New("address already in use")
+	}
+
+	gotErr := pa.startListener(t.Context())
+
+	if gotErr != nil {
+		t.Fatalf("pa.startListener(): want no error, got %v", gotErr)
+	}
+	if pa.redirectAddr != maxAddress {
+		t.Errorf("pa.redirectAddr should be %s, got %s", maxAddress, pa.redirectAddr)
+	}
+}
+
+func TestPersistentAuth_startListener_explicitPort(t *testing.T) {
+	explicitPort := 1337
+	pa := &PersistentAuth{port: explicitPort}
+	pa.netListen = func(_, address string) (net.Listener, error) {
+		return nil, nil
+	}
+
+	gotErr := pa.startListener(t.Context())
+
+	if gotErr != nil {
+		t.Fatalf("pa.startListener(): want no error, got %v", gotErr)
+	}
+	if pa.redirectAddr != "localhost:1337" {
+		t.Errorf("pa.redirectAddr should be localhost:1337, got %s", pa.redirectAddr)
+	}
+}
+
+func TestPersistentAuth_startListener_explicitPortNoFallBack(t *testing.T) {
+	testError := errors.New("test error")
+	explicitPort := 1337
+	pa := &PersistentAuth{port: explicitPort}
+	pa.netListen = func(_, address string) (net.Listener, error) {
+		if address == "localhost:1337" {
+			return nil, testError
+		}
+		return nil, nil
+	}
+
+	gotErr := pa.startListener(t.Context())
+
+	if !errors.Is(gotErr, testError) {
+		t.Fatalf("pa.startListener(): want error %v, got %v", testError, gotErr)
+	}
+}
+
+// TestU2M_ScopesAndOfflineAccess verifies that OAuth scopes are correctly configured
+// and sent during the authorization flow, and that the disableOfflineAccess flag
+// correctly controls whether offline_access is added to the scope.
+func TestU2M_ScopesAndOfflineAccess(t *testing.T) {
+	const (
+		testWorkspaceHost = "https://workspace.cloud.databricks.test"
+		testTokenEndpoint = "/oidc/v1/token"
+	)
+
+	tests := []struct {
+		name           string
+		scopes         []string
+		disableOffline bool
+		want           string
+	}{
+		{
+			name:           "nil scopes uses default with offline_access",
+			scopes:         nil,
+			disableOffline: false,
+			want:           "offline_access all-apis",
+		},
+		{
+			name:           "empty scopes uses default with offline_access",
+			scopes:         []string{},
+			disableOffline: false,
+			want:           "offline_access all-apis",
+		},
+		{
+			name:           "single scope with offline_access",
+			scopes:         []string{"dashboards"},
+			disableOffline: false,
+			want:           "offline_access dashboards",
+		},
+		{
+			name:           "multiple scopes with offline_access",
+			scopes:         []string{"files", "jobs", "mlflow:read"},
+			disableOffline: false,
+			want:           "offline_access files jobs mlflow:read",
+		},
+		{
+			name:           "disable offline_access",
+			scopes:         []string{"files", "jobs"},
+			disableOffline: true,
+			want:           "files jobs",
+		},
+		{
+			name:           "nil scopes with disable offline_access",
+			scopes:         nil,
+			disableOffline: true,
+			want:           "all-apis",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := t.Context()
+
+			var scopeReceived, stateReceived string
+			browserCalled := make(chan struct{})
+			defer close(browserCalled)
+			browser := func(redirect string) error {
+				u, err := url.ParseRequestURI(redirect)
+				if err != nil {
+					return err
+				}
+				query := u.Query()
+				scopeReceived = query.Get("scope")
+				stateReceived = query.Get("state")
+				browserCalled <- struct{}{}
+				return nil
+			}
+
+			cache := &tokenStoreMock{
+				store: func(key string, tok *oauth2.Token) error {
+					return nil
+				},
+			}
+
+			arg, err := NewBasicWorkspaceOAuthArgument(testWorkspaceHost)
+			if err != nil {
+				t.Fatalf("NewBasicWorkspaceOAuthArgument(): want no error, got %v", err)
+			}
+
+			var tokenResponse string
+			if tt.disableOffline {
+				tokenResponse = `access_token=token`
+			} else {
+				tokenResponse = `access_token=token&refresh_token=refresh`
+			}
+
+			opts := []PersistentAuthOption{
+				WithTokenStore(cache),
+				WithBrowser(browser),
+				WithHttpClient(&http.Client{
+					Transport: fixtures.SliceTransport{
+						{
+							Method:   "POST",
+							Resource: testTokenEndpoint,
+							Response: tokenResponse,
+							ResponseHeaders: map[string][]string{
+								"Content-Type": {"application/x-www-form-urlencoded"},
+							},
+						},
+					},
+				}),
+				WithOAuthEndpointSupplier(MockOAuthEndpointSupplier{}),
+				WithOAuthArgument(arg),
+				WithDisableOfflineAccess(tt.disableOffline),
+				WithScopes(tt.scopes),
+			}
+
+			p, err := NewPersistentAuth(ctx, opts...)
+			if err != nil {
+				t.Fatalf("NewPersistentAuth(): want no error, got %v", err)
+			}
+			defer p.Close()
+
+			errc := make(chan error)
+			defer close(errc)
+			go func() {
+				_, err := p.Challenge()
+				errc <- err
+			}()
+
+			select {
+			case <-browserCalled:
+			case <-time.After(5 * time.Second):
+				t.Fatal("timed out waiting for browser to be called")
+			}
+
+			if scopeReceived != tt.want {
+				t.Errorf("scope: want %q, got %q", tt.want, scopeReceived)
+			}
+
+			resp, err := http.Get(fmt.Sprintf("http://%s?code=__CODE__&state=%s", p.redirectAddr, stateReceived))
+			if err != nil {
+				t.Fatalf("http.Get(): want no error, got %v", err)
+			}
+			defer resp.Body.Close()
+
+			select {
+			case err = <-errc:
+			case <-time.After(5 * time.Second):
+				t.Fatal("timed out waiting for Challenge() to complete")
+			}
+			if err != nil {
+				t.Fatalf("p.Challenge(): want no error, got %v", err)
+			}
+		})
+	}
+}
+
+func TestChallenge_Discovery(t *testing.T) {
+	// Mock token server that responds to POST /oidc/v1/token.
+	tokenServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost {
+			t.Errorf("token server: want POST, got %s", r.Method)
+		}
+		if r.URL.Path != "/oidc/v1/token" {
+			t.Errorf("token server: want path /oidc/v1/token, got %s", r.URL.Path)
+		}
+		w.Header().Set("Content-Type", "application/json")
+		fmt.Fprintf(w, `{"access_token":"discovery-access-token","refresh_token":"discovery-refresh-token","token_type":"Bearer","expires_in":3600}`)
+	}))
+	defer tokenServer.Close()
+
+	// The issuer is the mock server URL + /oidc.
+	issuer := tokenServer.URL + "/oidc"
+
+	browserOpened := make(chan string, 1)
+	browserMock := func(u string) error {
+		browserOpened <- u
+		return nil
+	}
+
+	storedTokens := map[string]*oauth2.Token{}
+	cacheMock := &tokenStoreMock{
+		store: func(key string, tok *oauth2.Token) error {
+			storedTokens[key] = tok
+			return nil
+		},
+	}
+
+	arg, err := NewBasicDiscoveryOAuthArgument("discovery-profile")
+	if err != nil {
+		t.Fatalf("NewBasicDiscoveryOAuthArgument(): %v", err)
+	}
+
+	p, err := NewPersistentAuth(
+		t.Context(),
+		WithTokenStore(cacheMock),
+		WithBrowser(browserMock),
+		WithHttpClient(tokenServer.Client()),
+		WithOAuthEndpointSupplier(MockOAuthEndpointSupplier{}),
+		WithOAuthArgument(arg),
+		WithDiscoveryLogin(),
+	)
+	if err != nil {
+		t.Fatalf("NewPersistentAuth(): %v", err)
+	}
+	defer p.Close()
+
+	errc := make(chan error, 1)
+	tokenc := make(chan *oauth2.Token, 1)
+	go func() {
+		token, err := p.Challenge()
+		tokenc <- token
+		errc <- err
+	}()
+
+	// Wait for browser to be called and extract state from the authorize URL.
+	var state string
+	select {
+	case authURL := <-browserOpened:
+		u, err := url.Parse(authURL)
+		if err != nil {
+			t.Fatalf("parsing auth URL: %v", err)
+		}
+		destURL := u.Query().Get("destination_url")
+		dest, err := url.Parse(destURL)
+		if err != nil {
+			t.Fatalf("parsing destination_url: %v", err)
+		}
+		state = dest.Query().Get("state")
+		if state == "" {
+			t.Fatal("state is empty in authorize URL")
+		}
+	case <-time.After(5 * time.Second):
+		t.Fatal("timed out waiting for browser to be called")
+	}
+
+	// Fire the callback with code, state, and iss.
+	callbackURL := fmt.Sprintf("http://%s?code=test-code&state=%s&iss=%s",
+		p.redirectAddr, url.QueryEscape(state), url.QueryEscape(issuer))
+	resp, err := http.Get(callbackURL)
+	if err != nil {
+		t.Fatalf("callback GET: %v", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("callback: want status 200, got %d", resp.StatusCode)
+	}
+
+	// Wait for Challenge to complete.
+	select {
+	case err := <-errc:
+		if err != nil {
+			t.Fatalf("Challenge(): %v", err)
+		}
+	case <-time.After(5 * time.Second):
+		t.Fatal("timed out waiting for Challenge to complete")
+	}
+
+	// Verify discovered host was set on the argument.
+	expectedHost, err := DeriveHostFromIssuer(issuer)
+	if err != nil {
+		t.Fatalf("DeriveHostFromIssuer(%q): %v", issuer, err)
+	}
+	if arg.GetDiscoveredHost() != expectedHost {
+		t.Errorf("discovered host = %q, want %q", arg.GetDiscoveredHost(), expectedHost)
+	}
+	if len(storedTokens) != 0 {
+		t.Fatalf("store count: want 0, got %d", len(storedTokens))
+	}
+	returnedToken := <-tokenc
+	if returnedToken == nil {
+		t.Fatal("returned token is nil")
+	}
+	if returnedToken.AccessToken != "discovery-access-token" {
+		t.Errorf("access token = %q, want %q", returnedToken.AccessToken, "discovery-access-token")
+	}
+	if returnedToken.RefreshToken != "discovery-refresh-token" {
+		t.Errorf("refresh token = %q, want %q", returnedToken.RefreshToken, "discovery-refresh-token")
+	}
+}
diff --git a/libs/auth/u2m/unified_oauth_argument.go b/libs/auth/u2m/unified_oauth_argument.go
new file mode 100644
index 00000000000..733127b1421
--- /dev/null
+++ b/libs/auth/u2m/unified_oauth_argument.go
@@ -0,0 +1,74 @@
+package u2m
+
+import (
+	"fmt"
+)
+
+// UnifiedOAuthArgument is an interface that provides the necessary information
+// to authenticate using OAuth to a host that supports both account and workspace APIs.
+type UnifiedOAuthArgument interface {
+	OAuthArgument
+
+	// GetHost returns the host to authenticate to.
+	GetHost() string
+
+	// GetAccountId returns the account ID of the account to authenticate to.
+	GetAccountId() string
+}
+
+// BasicUnifiedOAuthArgument is a basic implementation of the UnifiedOAuthArgument
+// interface that links each account with exactly one OAuth token.
+type BasicUnifiedOAuthArgument struct {
+	host      string
+	accountID string
+
+	// profile is the optional profile name. When set, GetCacheKey() returns
+	// the profile name instead of the host-based key.
+	profile string
+}
+
+var (
+	_ UnifiedOAuthArgument = BasicUnifiedOAuthArgument{}
+	_ HostCacheKeyProvider = BasicUnifiedOAuthArgument{}
+)
+
+// NewBasicUnifiedOAuthArgument creates a new BasicUnifiedOAuthArgument.
+func NewBasicUnifiedOAuthArgument(accountsHost, accountID string) (BasicUnifiedOAuthArgument, error) {
+	return NewProfileUnifiedOAuthArgument(accountsHost, accountID, "")
+}
+
+// NewProfileUnifiedOAuthArgument creates a new BasicUnifiedOAuthArgument with a
+// profile name. When a profile is set, GetCacheKey() returns the profile name
+// instead of the host-based key.
+func NewProfileUnifiedOAuthArgument(accountsHost, accountID, profile string) (BasicUnifiedOAuthArgument, error) {
+	if err := validateHost(accountsHost); err != nil {
+		return BasicUnifiedOAuthArgument{}, err
+	}
+	return BasicUnifiedOAuthArgument{host: accountsHost, accountID: accountID, profile: profile}, nil
+}
+
+// GetHost returns the host to authenticate to.
+func (a BasicUnifiedOAuthArgument) GetHost() string {
+	return a.host
+}
+
+// GetAccountId returns the account ID of the account to authenticate to.
+func (a BasicUnifiedOAuthArgument) GetAccountId() string {
+	return a.accountID
+}
+
+// GetCacheKey returns a unique key for caching the OAuth token for the account.
+// If a profile is set, the profile name is returned as the cache key.
+// Otherwise, the key is in the format "<hostName>/oidc/accounts/<accountID>".
+func (a BasicUnifiedOAuthArgument) GetCacheKey() string {
+	if a.profile != "" {
+		return a.profile
+	}
+	return a.GetHostCacheKey()
+}
+
+// GetHostCacheKey returns the host-based cache key regardless of whether a
+// profile is set. The key is in the format "<hostName>/oidc/accounts/<accountID>".
+func (a BasicUnifiedOAuthArgument) GetHostCacheKey() string {
+	return fmt.Sprintf("%s/oidc/accounts/%s", a.host, a.accountID)
+}
diff --git a/libs/auth/u2m/unified_oauth_argument_test.go b/libs/auth/u2m/unified_oauth_argument_test.go
new file mode 100644
index 00000000000..3ddef30c043
--- /dev/null
+++ b/libs/auth/u2m/unified_oauth_argument_test.go
@@ -0,0 +1,106 @@
+package u2m
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestNewBasicUnifiedOAuthArgument_ValidatesHost(t *testing.T) {
+	tests := []struct {
+		name      string
+		host      string
+		accountID string
+		wantErr   string
+	}{
+		{
+			name:      "invalid http protocol",
+			host:      "http://insecure.com",
+			accountID: "account-123",
+			wantErr:   "host must start with 'https://': http://insecure.com",
+		},
+		{
+			name:      "trailing slash",
+			host:      "https://unified.databricks.test/",
+			accountID: "account-123",
+			wantErr:   "host must not have a trailing slash: https://unified.databricks.test/",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, err := NewBasicUnifiedOAuthArgument(tt.host, tt.accountID)
+			assert.Error(t, err)
+			assert.Contains(t, err.Error(), tt.wantErr)
+		})
+	}
+}
+
+func TestNewProfileUnifiedOAuthArgument_ValidatesHost(t *testing.T) {
+	_, err := NewProfileUnifiedOAuthArgument("http://insecure.com", "account-123", "my-profile")
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "host must start with 'https://'")
+}
+
+func TestBasicUnifiedOAuthArgument_ProfileCacheKeys(t *testing.T) {
+	tests := []struct {
+		name        string
+		host        string
+		accountID   string
+		profile     string
+		wantKey     string
+		wantHostKey string
+	}{
+		{
+			name:        "without profile returns host-based key",
+			host:        "https://unified.databricks.test",
+			accountID:   "account-123",
+			wantKey:     "https://unified.databricks.test/oidc/accounts/account-123",
+			wantHostKey: "https://unified.databricks.test/oidc/accounts/account-123",
+		},
+		{
+			name:        "with profile returns profile name",
+			host:        "https://unified.databricks.test",
+			accountID:   "account-123",
+			profile:     "my-profile",
+			wantKey:     "my-profile",
+			wantHostKey: "https://unified.databricks.test/oidc/accounts/account-123",
+		},
+		{
+			name:        "empty profile returns host-based key",
+			host:        "https://unified.databricks.test",
+			accountID:   "account-123",
+			profile:     "",
+			wantKey:     "https://unified.databricks.test/oidc/accounts/account-123",
+			wantHostKey: "https://unified.databricks.test/oidc/accounts/account-123",
+		},
+		{
+			name:        "different host and account",
+			host:        "https://other-unified.databricks.test",
+			accountID:   "account-456",
+			wantKey:     "https://other-unified.databricks.test/oidc/accounts/account-456",
+			wantHostKey: "https://other-unified.databricks.test/oidc/accounts/account-456",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var arg BasicUnifiedOAuthArgument
+			var err error
+			if tt.profile != "" {
+				arg, err = NewProfileUnifiedOAuthArgument(tt.host, tt.accountID, tt.profile)
+			} else {
+				arg, err = NewBasicUnifiedOAuthArgument(tt.host, tt.accountID)
+			}
+			assert.NoError(t, err)
+			assert.Equal(t, tt.wantKey, arg.GetCacheKey())
+			assert.Equal(t, tt.wantHostKey, arg.GetHostCacheKey())
+		})
+	}
+}
+
+func TestBasicUnifiedOAuthArgument_ImplementsHostCacheKeyProvider(t *testing.T) {
+	arg, err := NewBasicUnifiedOAuthArgument("https://unified.databricks.test", "account-123")
+	assert.NoError(t, err)
+	var _ HostCacheKeyProvider = arg
+}
diff --git a/libs/auth/u2m/workspace_oauth_argument.go b/libs/auth/u2m/workspace_oauth_argument.go
new file mode 100644
index 00000000000..66daba94ebe
--- /dev/null
+++ b/libs/auth/u2m/workspace_oauth_argument.go
@@ -0,0 +1,87 @@
+package u2m
+
+import (
+	"fmt"
+	"strings"
+)
+
+// WorkspaceOAuthArgument is an interface that provides the necessary information
+// to authenticate using OAuth to a specific workspace.
+type WorkspaceOAuthArgument interface {
+	OAuthArgument
+
+	// GetWorkspaceHost returns the host of the workspace to authenticate to.
+	GetWorkspaceHost() string
+}
+
+// BasicWorkspaceOAuthArgument is a basic implementation of the WorkspaceOAuthArgument
+// interface that links each host with exactly one OAuth token.
+type BasicWorkspaceOAuthArgument struct {
+	// host is the host of the workspace to authenticate to. This must start
+	// with "https://" and must not have a trailing slash.
+	host string
+
+	// profile is the optional profile name. When set, GetCacheKey() returns
+	// the profile name instead of the host-based key.
+	profile string
+}
+
+func validateHost(host string) error {
+	// Allow http for localhost. This is necessary for local end to end testing
+	// of the `databricks auth login` command using a test server on localhost.
+	if strings.HasPrefix(host, "http://127.0.0.1") {
+		return nil
+	}
+	if !strings.HasPrefix(host, "https://") {
+		return fmt.Errorf("host must start with 'https://': %s", host)
+	}
+	if strings.HasSuffix(host, "/") {
+		return fmt.Errorf("host must not have a trailing slash: %s", host)
+	}
+	return nil
+}
+
+// NewBasicWorkspaceOAuthArgument creates a new BasicWorkspaceOAuthArgument.
+func NewBasicWorkspaceOAuthArgument(host string) (BasicWorkspaceOAuthArgument, error) {
+	return NewProfileWorkspaceOAuthArgument(host, "")
+}
+
+// NewProfileWorkspaceOAuthArgument creates a new BasicWorkspaceOAuthArgument
+// with a profile name. When a profile is set, GetCacheKey() returns the profile
+// name instead of the host-based key.
+func NewProfileWorkspaceOAuthArgument(host, profile string) (BasicWorkspaceOAuthArgument, error) {
+	if err := validateHost(host); err != nil {
+		return BasicWorkspaceOAuthArgument{}, err
+	}
+	return BasicWorkspaceOAuthArgument{host: host, profile: profile}, nil
+}
+
+// GetWorkspaceHost returns the host of the workspace to authenticate to.
+func (a BasicWorkspaceOAuthArgument) GetWorkspaceHost() string {
+	return a.host
+}
+
+// GetCacheKey returns a unique key for caching the OAuth token for the workspace.
+// If a profile is set, the profile name is returned as the cache key.
+// Otherwise, the key is in the format "<host>".
+func (a BasicWorkspaceOAuthArgument) GetCacheKey() string {
+	if a.profile != "" {
+		return a.profile
+	}
+	return a.GetHostCacheKey()
+}
+
+// GetHostCacheKey returns the host-based cache key regardless of whether a
+// profile is set. The key is in the format "<host>".
+func (a BasicWorkspaceOAuthArgument) GetHostCacheKey() string {
+	host := strings.TrimSuffix(a.host, "/")
+	if !strings.HasPrefix(host, "http") {
+		host = "https://" + host
+	}
+	return host
+}
+
+var (
+	_ WorkspaceOAuthArgument = BasicWorkspaceOAuthArgument{}
+	_ HostCacheKeyProvider   = BasicWorkspaceOAuthArgument{}
+)
diff --git a/libs/auth/u2m/workspace_oauth_argument_test.go b/libs/auth/u2m/workspace_oauth_argument_test.go
new file mode 100644
index 00000000000..652f06206e1
--- /dev/null
+++ b/libs/auth/u2m/workspace_oauth_argument_test.go
@@ -0,0 +1,119 @@
+package u2m
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestBasicWorkspaceOAuthArgument_GetCacheKey(t *testing.T) {
+	tests := []struct {
+		name        string
+		host        string
+		profile     string
+		wantKey     string
+		wantHostKey string
+	}{
+		{
+			name:        "without profile returns host-based key",
+			host:        "https://myworkspace.cloud.databricks.test",
+			wantKey:     "https://myworkspace.cloud.databricks.test",
+			wantHostKey: "https://myworkspace.cloud.databricks.test",
+		},
+		{
+			name:        "with profile returns profile name",
+			host:        "https://myworkspace.cloud.databricks.test",
+			profile:     "my-profile",
+			wantKey:     "my-profile",
+			wantHostKey: "https://myworkspace.cloud.databricks.test",
+		},
+		{
+			name:        "empty profile returns host-based key",
+			host:        "https://myworkspace.cloud.databricks.test",
+			profile:     "",
+			wantKey:     "https://myworkspace.cloud.databricks.test",
+			wantHostKey: "https://myworkspace.cloud.databricks.test",
+		},
+		{
+			name:        "localhost without profile",
+			host:        "http://127.0.0.1:5656",
+			wantKey:     "http://127.0.0.1:5656",
+			wantHostKey: "http://127.0.0.1:5656",
+		},
+		{
+			name:        "localhost with profile",
+			host:        "http://127.0.0.1:5656",
+			profile:     "local-profile",
+			wantKey:     "local-profile",
+			wantHostKey: "http://127.0.0.1:5656",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var arg BasicWorkspaceOAuthArgument
+			var err error
+			if tt.profile != "" {
+				arg, err = NewProfileWorkspaceOAuthArgument(tt.host, tt.profile)
+			} else {
+				arg, err = NewBasicWorkspaceOAuthArgument(tt.host)
+			}
+			assert.NoError(t, err)
+			assert.Equal(t, tt.wantKey, arg.GetCacheKey())
+			assert.Equal(t, tt.wantHostKey, arg.GetHostCacheKey())
+		})
+	}
+}
+
+func TestNewProfileWorkspaceOAuthArgument_ValidatesHost(t *testing.T) {
+	_, err := NewProfileWorkspaceOAuthArgument("http://some-host.com", "my-profile")
+	assert.EqualError(t, err, "host must start with 'https://': http://some-host.com")
+
+	_, err = NewProfileWorkspaceOAuthArgument("https://some-host.com/", "my-profile")
+	assert.EqualError(t, err, "host must not have a trailing slash: https://some-host.com/")
+}
+
+func TestBasicWorkspaceOAuthArgument_ImplementsHostCacheKeyProvider(t *testing.T) {
+	arg, err := NewBasicWorkspaceOAuthArgument("https://myworkspace.cloud.databricks.test")
+	assert.NoError(t, err)
+	var _ HostCacheKeyProvider = arg
+}
+
+func TestValidateHost(t *testing.T) {
+	tests := []struct {
+		host string
+		want string
+	}{
+		// Valid hosts
+		{"https://some-host.com", ""},
+		{"http://127.0.0.1", ""},
+		{"http://127.0.0.1:5656", ""},
+
+		// Invalid hosts
+		{"http://some-host.com", "host must start with 'https://': http://some-host.com"},
+		{"https://some-host.com/", "host must not have a trailing slash: https://some-host.com/"},
+	}
+
+	for _, test := range tests {
+		err := validateHost(test.host)
+		if test.want == "" {
+			assert.NoError(t, err)
+		} else {
+			assert.EqualError(t, err, test.want)
+		}
+
+		_, err = NewBasicWorkspaceOAuthArgument(test.host)
+		if test.want == "" {
+			assert.NoError(t, err)
+		} else {
+			assert.EqualError(t, err, test.want)
+		}
+
+		_, err = NewBasicAccountOAuthArgument(test.host, "123")
+		if test.want == "" {
+			assert.NoError(t, err)
+		} else {
+			assert.EqualError(t, err, test.want)
+		}
+	}
+}
diff --git a/libs/auth/workspace_id.go b/libs/auth/workspace_id.go
new file mode 100644
index 00000000000..84313e3f3aa
--- /dev/null
+++ b/libs/auth/workspace_id.go
@@ -0,0 +1,37 @@
+package auth
+
+import (
+	"context"
+	"strconv"
+
+	"github.com/databricks/cli/libs/databrickscfg/profile"
+	"github.com/databricks/databricks-sdk-go"
+)
+
+// ResolveWorkspaceID returns the workspace ID as a string, preferring the
+// value already configured on the client and falling back to a /Me probe.
+//
+// The fast path short-circuits the API call when w.Config.WorkspaceID is
+// set (via --workspace-id, DATABRICKS_WORKSPACE_ID, workspace_id in
+// .databrickscfg, ?o=/?w= on a host URL, or any other config source). The
+// CLI-only "none" sentinel is treated as unset so it never leaks as a
+// routing identifier.
+//
+// The fallback path delegates to w.CurrentWorkspaceID, which reads the
+// X-Databricks-Org-Id response header on /api/2.0/preview/scim/v2/Me and
+// parses it as int64. The numeric constraint is enforced by the SDK on
+// that path; the helper just stringifies the result.
+//
+// Compared to calling w.CurrentWorkspaceID directly, the string return
+// type lets callers pass the value to URL builders, env vars, and other
+// string-typed sinks without a manual strconv.FormatInt step.
+func ResolveWorkspaceID(ctx context.Context, w *databricks.WorkspaceClient) (string, error) {
+	if id := w.Config.WorkspaceID; id != "" && id != profile.WorkspaceIDNone {
+		return id, nil
+	}
+	id, err := w.CurrentWorkspaceID(ctx)
+	if err != nil {
+		return "", err
+	}
+	return strconv.FormatInt(id, 10), nil
+}
diff --git a/libs/auth/workspace_id_test.go b/libs/auth/workspace_id_test.go
new file mode 100644
index 00000000000..fd0a32aa194
--- /dev/null
+++ b/libs/auth/workspace_id_test.go
@@ -0,0 +1,102 @@
+package auth_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/auth"
+	"github.com/databricks/cli/libs/databrickscfg/profile"
+	"github.com/databricks/cli/libs/testserver"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestResolveWorkspaceID_FastPathReturnsConfiguredValue(t *testing.T) {
+	// Pointing at a /Me handler that would return a different ID lets us
+	// confirm the fast path doesn't hit the API.
+	server := testserver.New(t)
+	server.Handle("GET", "/api/2.0/preview/scim/v2/Me", func(req testserver.Request) any {
+		t.Fatalf("/Me should not be called when WorkspaceID is configured")
+		return nil
+	})
+	testserver.AddDefaultHandlers(server)
+
+	w, err := databricks.NewWorkspaceClient(&databricks.Config{
+		Host:        server.URL,
+		Token:       "testtoken",
+		WorkspaceID: "12345",
+	})
+	require.NoError(t, err)
+
+	got, err := auth.ResolveWorkspaceID(t.Context(), w)
+	require.NoError(t, err)
+	assert.Equal(t, "12345", got)
+}
+
+func TestResolveWorkspaceID_FastPathPassesThroughNonNumericValue(t *testing.T) {
+	// Connection-style identifiers (UUID-shaped, etc.) are valid as of the
+	// X-Databricks-Workspace-Id header rollout. The configured value must
+	// flow through unchanged.
+	server := testserver.New(t)
+	server.Handle("GET", "/api/2.0/preview/scim/v2/Me", func(req testserver.Request) any {
+		t.Fatalf("/Me should not be called when WorkspaceID is configured")
+		return nil
+	})
+	testserver.AddDefaultHandlers(server)
+
+	const connID = "123e4567-e89b-12d3-a456-426614174000"
+	w, err := databricks.NewWorkspaceClient(&databricks.Config{
+		Host:        server.URL,
+		Token:       "testtoken",
+		WorkspaceID: connID,
+	})
+	require.NoError(t, err)
+
+	got, err := auth.ResolveWorkspaceID(t.Context(), w)
+	require.NoError(t, err)
+	assert.Equal(t, connID, got)
+}
+
+func TestResolveWorkspaceID_NoneSentinelFallsThroughToAPI(t *testing.T) {
+	// The CLI persists "none" in .databrickscfg to mark profiles where the
+	// user skipped workspace selection. It must not leak as a routing ID.
+	server := testserver.New(t)
+	testserver.AddDefaultHandlers(server)
+
+	w, err := databricks.NewWorkspaceClient(&databricks.Config{
+		Host:        server.URL,
+		Token:       "testtoken",
+		WorkspaceID: profile.WorkspaceIDNone,
+	})
+	require.NoError(t, err)
+
+	got, err := auth.ResolveWorkspaceID(t.Context(), w)
+	require.NoError(t, err)
+	// The default /Me handler returns X-Databricks-Org-Id: 900800700600.
+	assert.Equal(t, "900800700600", got)
+}
+
+func TestResolveWorkspaceID_FallbackHitsMeAndStringifiesResponse(t *testing.T) {
+	// Note: testserver.New unconditionally registers a
+	// /.well-known/databricks-config handler that returns
+	// workspace_id=900800700600. The SDK config resolver picks that up and
+	// pre-populates cfg.WorkspaceID, which means the helper's fast path
+	// returns "900800700600" without ever hitting /Me. From the helper's
+	// perspective the observable behavior is identical (it returns
+	// "900800700600" either way), so this test still covers what callers
+	// see — it just lands on the fast path rather than the literal
+	// fallback path. The fast path is also exercised explicitly by
+	// TestResolveWorkspaceID_FastPathReturnsConfiguredValue.
+	server := testserver.New(t)
+	testserver.AddDefaultHandlers(server)
+
+	w, err := databricks.NewWorkspaceClient(&databricks.Config{
+		Host:  server.URL,
+		Token: "testtoken",
+	})
+	require.NoError(t, err)
+
+	got, err := auth.ResolveWorkspaceID(t.Context(), w)
+	require.NoError(t, err)
+	assert.Equal(t, "900800700600", got)
+}
diff --git a/libs/cache/file_cache.go b/libs/cache/file_cache.go
index 3d03fa3d167..cb9c5e433d7 100644
--- a/libs/cache/file_cache.go
+++ b/libs/cache/file_cache.go
@@ -11,6 +11,7 @@ import (
 	"time"
 
 	"github.com/databricks/cli/internal/build"
+	"github.com/databricks/cli/libs/atomicfile"
 	"github.com/databricks/cli/libs/env"
 	"github.com/databricks/cli/libs/log"
 )
@@ -95,6 +96,12 @@ func (fc *fileCache) cleanupExpiredFiles(ctx context.Context) {
 	}
 }
 
+// BaseDir returns the root directory of the file cache: DATABRICKS_CACHE_DIR
+// when set, otherwise the user cache dir. It does not create the directory.
+func BaseDir(ctx context.Context) (string, error) {
+	return getCacheBaseDir(ctx)
+}
+
 func getCacheBaseDir(ctx context.Context) (string, error) {
 	// Check if user has configured a custom cache directory
 	if customCacheDir := env.Get(ctx, "DATABRICKS_CACHE_DIR"); customCacheDir != "" {
@@ -272,38 +279,9 @@ func (fc *fileCache) readFromCacheJSON(ctx context.Context, cachePath string) ([
 }
 
 // writeToCacheJSON writes data to the cache file atomically.
-// Uses atomic write: writes to temp file first, then renames to actual cache file.
 func (fc *fileCache) writeToCacheJSON(ctx context.Context, cachePath string, data []byte) {
-	// Create temporary file in the same directory for atomic operation
-	tempFile, err := os.CreateTemp(fc.baseDir, ".cache-*.tmp")
-	if err != nil {
-		log.Debugf(ctx, "[Local Cache] failed to create temp cache file: %v", err)
-		return
-	}
-	tempPath := tempFile.Name()
-	defer func() {
-		_ = tempFile.Close()
-		_ = os.Remove(tempPath) // Clean up temp file if still exists
-	}()
-
-	// Write data to temp file
-	if _, err := tempFile.Write(data); err != nil {
-		log.Debugf(ctx, "[Local Cache] failed to write to temp cache file: %v", err)
-		return
-	}
-
-	if err := tempFile.Close(); err != nil {
-		log.Debugf(ctx, "[Local Cache] failed to close temp cache file: %v", err)
-		return
-	}
-
-	// On Windows, os.Rename fails if target exists, so remove it first
-	// This is a best-effort operation - if it fails because file doesn't exist, that's fine
-	_ = os.Remove(cachePath)
-
-	// Atomically rename temp file to actual cache file
-	if err := os.Rename(tempPath, cachePath); err != nil {
-		log.Debugf(ctx, "[Local Cache] failed to rename temp cache file: %v", err)
+	if err := atomicfile.Write(cachePath, data, 0o600); err != nil {
+		log.Debugf(ctx, "[Local Cache] failed to write cache file: %v", err)
 	}
 }
 
diff --git a/libs/calladapt/calladapt.go b/libs/calladapt/calladapt.go
index db7e2733d42..b6fc3ce046e 100644
--- a/libs/calladapt/calladapt.go
+++ b/libs/calladapt/calladapt.go
@@ -46,7 +46,7 @@ func (c *BoundCaller) call(args ...any) ([]reflect.Value, error) {
 		it := c.InTypes[i]
 		if a == nil {
 			// Allow untyped nil for pointer types, converting to typed nil
-			if it.Kind() == reflect.Ptr {
+			if it.Kind() == reflect.Pointer {
 				in[i+1] = reflect.Zero(it)
 				continue
 			}
diff --git a/libs/calladapt/validate.go b/libs/calladapt/validate.go
index 8613d42d906..e33697a79f4 100644
--- a/libs/calladapt/validate.go
+++ b/libs/calladapt/validate.go
@@ -11,13 +11,12 @@ func EnsureNoExtraMethods(receiver any, ifaceTypes ...reflect.Type) error {
 
 	allowed := make(map[string]struct{})
 	for _, ifaceType := range ifaceTypes {
-		for i := range ifaceType.NumMethod() {
-			allowed[ifaceType.Method(i).Name] = struct{}{}
+		for method := range ifaceType.Methods() {
+			allowed[method.Name] = struct{}{}
 		}
 	}
 
-	for i := range rt.NumMethod() {
-		m := rt.Method(i)
+	for m := range rt.Methods() {
 		if _, ok := allowed[m.Name]; !ok {
 			return fmt.Errorf("unexpected method %s on %v; only methods from %v are allowed", m.Name, rt, ifaceTypes)
 		}
diff --git a/libs/clicompat/clicompat.go b/libs/clicompat/clicompat.go
new file mode 100644
index 00000000000..446c8e4755c
--- /dev/null
+++ b/libs/clicompat/clicompat.go
@@ -0,0 +1,429 @@
+package clicompat
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/databricks/cli/internal/build"
+	"github.com/databricks/cli/libs/atomicfile"
+	"github.com/databricks/cli/libs/env"
+	"github.com/databricks/cli/libs/log"
+	"golang.org/x/mod/semver"
+)
+
+// ErrNotFound indicates that a requested resource (tag, branch, manifest)
+// does not exist at the remote.
+var ErrNotFound = errors.New("not found")
+
+// HTTPStatusError captures a non-200 HTTP status code from a manifest fetch.
+type HTTPStatusError struct {
+	StatusCode int
+}
+
+// Error implements the error interface.
+func (e *HTTPStatusError) Error() string {
+	return fmt.Sprintf("HTTP %d fetching manifest", e.StatusCode)
+}
+
+const (
+	// manifestURL is the raw GitHub URL for the compatibility manifest.
+	manifestURL = "https://raw.githubusercontent.com/databricks/cli/main/internal/build/cli-compat.json"
+
+	// fetchTimeout is the HTTP timeout for fetching the manifest at runtime.
+	fetchTimeout = 3 * time.Second
+
+	// cacheTTL is how long a locally cached manifest is considered fresh.
+	cacheTTL = 1 * time.Hour
+
+	// localManifestFile is the filename for the locally cached manifest.
+	localManifestFile = "compat-manifest.json"
+
+	maxFetchAttempts  = 3
+	fetchRetryBackoff = 300 * time.Millisecond
+)
+
+// Entry maps a CLI version to compatible AppKit and Agent Skills versions.
+type Entry struct {
+	AppKit      string `json:"appkit"`
+	AgentSkills string `json:"skills"`
+}
+
+// Manifest is the compatibility manifest: a map of CLI version strings to entries.
+type Manifest map[string]Entry
+
+// cachedManifest holds a parsed manifest together with its on-disk mod time.
+type cachedManifest struct {
+	manifest Manifest
+	modTime  time.Time
+}
+
+// isFresh reports whether the cached manifest is younger than maxAge.
+func (c cachedManifest) isFresh(maxAge time.Duration) bool {
+	return time.Since(c.modTime) < maxAge
+}
+
+// httpClient is the HTTP client used for manifest fetches. Package-level var
+// so tests can replace it. Not safe for parallel tests; the clicompat test
+// suite does not use t.Parallel().
+var httpClient = &http.Client{Timeout: fetchTimeout}
+
+// FetchManifest returns the compatibility manifest using a 4-tier fallback:
+//  1. Local cached file (if fresh, < 1 hour old)
+//  2. Remote fetch from GitHub (with retry)
+//  3. Stale local file (if remote fails but a previously cached file exists)
+//  4. Embedded manifest compiled into the binary
+//
+// Set DATABRICKS_FORCE_EMBEDDED_COMPAT=true to skip all tiers and use only
+// the embedded manifest. Useful for local development when testing with a
+// locally compiled binary.
+//
+// Set DATABRICKS_CACHE_ENABLED=false to bypass the local cache (tiers 1 and 3a),
+// which is useful to recover from a bad cached manifest.
+func FetchManifest(ctx context.Context) (Manifest, error) {
+	if force, ok := env.GetBool(ctx, "DATABRICKS_FORCE_EMBEDDED_COMPAT"); ok && force {
+		log.Debugf(ctx, "Using embedded manifest (DATABRICKS_FORCE_EMBEDDED_COMPAT=true)")
+		return parseEmbeddedManifest()
+	}
+
+	cacheEnabled := true
+	if enabled, ok := env.GetBool(ctx, "DATABRICKS_CACHE_ENABLED"); ok {
+		cacheEnabled = enabled
+	}
+
+	localPath := manifestLocalPath(ctx)
+
+	// Read local file once — reuse across tiers.
+	var local cachedManifest
+	var localErr error
+	if cacheEnabled {
+		local, localErr = readLocalManifest(localPath)
+	} else {
+		localErr = errors.New("cache disabled")
+	}
+
+	// Tier 1: local file is fresh.
+	if localErr == nil && local.isFresh(cacheTTL) {
+		log.Debugf(ctx, "Using cached manifest from %s", localPath)
+		return local.manifest, nil
+	}
+
+	// Tier 2: fetch from remote (local file missing or stale).
+	m, fetchErr := fetchRemoteWithRetry(ctx)
+	if fetchErr == nil {
+		if cacheEnabled {
+			writeLocalManifest(ctx, localPath, m)
+		}
+		return m, nil
+	}
+
+	// Tier 3a: local file exists but stale — use it anyway.
+	if localErr == nil {
+		log.Debugf(ctx, "Using stale cached manifest (remote failed: %v)", fetchErr)
+		return local.manifest, nil
+	}
+
+	// Tier 3b: embedded manifest.
+	m, embeddedErr := parseEmbeddedManifest()
+	if embeddedErr == nil {
+		log.Debugf(ctx, "Using embedded manifest (remote and local cache failed)")
+		return m, nil
+	}
+
+	return nil, fmt.Errorf("all manifest sources failed (remote: %w, embedded: %w)", fetchErr, embeddedErr)
+}
+
+// parseEmbeddedManifest parses the embedded manifest once and caches the result.
+var parseEmbeddedManifest = sync.OnceValues(func() (Manifest, error) {
+	return parseManifest(build.CLICompatManifestJSON)
+})
+
+// ResolveEmbeddedAppKitVersion resolves the AppKit version from only the
+// embedded manifest for the current CLI version. Used as a fallback when the
+// primary version (from remote or cached manifest) points to a non-existent tag,
+// and for help text defaults where a network call is not appropriate.
+func ResolveEmbeddedAppKitVersion() (string, error) {
+	m, err := parseEmbeddedManifest()
+	if err != nil {
+		return "", fmt.Errorf("embedded manifest: %w", err)
+	}
+	entry, err := Resolve(m, build.GetInfo().Version)
+	if err != nil {
+		return "", fmt.Errorf("embedded manifest resolve: %w", err)
+	}
+	return entry.AppKit, nil
+}
+
+// ResolveEmbeddedAgentSkillsVersion resolves the fallback for the current CLI
+// without fetching compatibility data. Ranges tracking latest use the tested
+// release compiled into the binary.
+func ResolveEmbeddedAgentSkillsVersion() (string, error) {
+	m, err := parseEmbeddedManifest()
+	if err != nil {
+		return "", fmt.Errorf("embedded manifest: %w", err)
+	}
+	entry, err := Resolve(m, build.GetInfo().Version)
+	if err != nil {
+		return "", fmt.Errorf("embedded manifest resolve: %w", err)
+	}
+	if entry.AgentSkills == AgentSkillsLatest {
+		return build.AgentSkillsFallbackVersion, nil
+	}
+	return entry.AgentSkills, nil
+}
+
+// IsNotFoundError reports whether the error indicates a "not found" condition
+// (e.g. HTTP 404, missing git branch/tag). Used by consumers to decide whether
+// to fall back to the embedded manifest.
+func IsNotFoundError(err error) bool {
+	if err == nil {
+		return false
+	}
+	if errors.Is(err, ErrNotFound) {
+		return true
+	}
+	if httpErr, ok := errors.AsType[*HTTPStatusError](err); ok && httpErr.StatusCode == http.StatusNotFound {
+		return true
+	}
+	// Git clone errors include "not found" in stderr when a branch/tag does not
+	// exist (e.g. "Remote branch X not found in upstream origin"). This is a
+	// pragmatic fallback until git.Clone wraps a typed error.
+	msg := strings.ToLower(err.Error())
+	return strings.Contains(msg, "not found")
+}
+
+// Resolve returns the manifest entry for the given CLI version.
+//
+// Each versioned entry defines a range floor: it applies to that CLI version
+// and all versions above it, up to (but not including) the next entry.
+//
+// Resolution order:
+//  1. Dev builds (a -dev prerelease) use the highest versioned entry.
+//  2. Exact match on CLI version.
+//  3. Nearest lower version (semver-sorted). This also handles CLI versions
+//     newer than all entries, returning the highest known entry.
+//  4. If CLI is older than all entries, use the lowest (oldest) entry.
+func Resolve(m Manifest, cliVersion string) (Entry, error) {
+	if len(m) == 0 {
+		return Entry{}, errors.New("empty compatibility manifest")
+	}
+
+	// Collect and sort versioned keys descending.
+	versions := sortedVersions(m)
+	if len(versions) == 0 {
+		return Entry{}, errors.New("compatibility manifest has no versioned entries")
+	}
+
+	// Dev builds are built from main and may carry changes that no released
+	// version has, so resolving them by semver would pick the entry for the
+	// previous release. Use the highest versioned entry instead, since dev
+	// builds represent the bleeding edge.
+	if build.IsDevelopmentVersion(cliVersion) {
+		return m[versions[0]], nil
+	}
+
+	// Exact match.
+	if entry, ok := m[cliVersion]; ok {
+		return entry, nil
+	}
+
+	// Find the nearest lower version.
+	vCLI := "v" + cliVersion
+	for _, v := range versions {
+		if semver.Compare("v"+v, vCLI) <= 0 {
+			return m[v], nil
+		}
+	}
+
+	// CLI is older than all entries — use the lowest (oldest) entry.
+	return m[versions[len(versions)-1]], nil
+}
+
+// sortedVersions returns manifest keys sorted descending by semver.
+func sortedVersions(m Manifest) []string {
+	versions := make([]string, 0, len(m))
+	for k := range m {
+		versions = append(versions, k)
+	}
+	slices.SortFunc(versions, func(a, b string) int {
+		return semver.Compare("v"+b, "v"+a)
+	})
+	return versions
+}
+
+// resolveEntry fetches the manifest, resolves for the given CLI version.
+func resolveEntry(ctx context.Context, cliVersion string) (Entry, error) {
+	m, err := FetchManifest(ctx)
+	if err != nil {
+		return Entry{}, err
+	}
+	return Resolve(m, cliVersion)
+}
+
+// ResolveAppKitVersion resolves the AppKit template version for the current CLI.
+func ResolveAppKitVersion(ctx context.Context) (string, error) {
+	entry, err := resolveEntry(ctx, build.GetInfo().Version)
+	if err != nil {
+		return "", err
+	}
+	return entry.AppKit, nil
+}
+
+// ResolveAgentSkillsVersion resolves the Agent Skills version for the current CLI.
+func ResolveAgentSkillsVersion(ctx context.Context) (string, error) {
+	entry, err := resolveEntry(ctx, build.GetInfo().Version)
+	if err != nil {
+		return "", err
+	}
+	return entry.AgentSkills, nil
+}
+
+// --- Local manifest cache ---
+
+// manifestLocalPath returns the path to the locally cached manifest file.
+func manifestLocalPath(ctx context.Context) string {
+	if dir := env.Get(ctx, "DATABRICKS_CACHE_DIR"); dir != "" {
+		return filepath.Join(dir, localManifestFile)
+	}
+	home, err := os.UserCacheDir()
+	if err != nil {
+		log.Debugf(ctx, "Could not determine user cache directory: %v", err)
+		return ""
+	}
+	return filepath.Join(home, "databricks", localManifestFile)
+}
+
+// readLocalManifest reads and parses the locally cached manifest file.
+func readLocalManifest(path string) (cachedManifest, error) {
+	if path == "" {
+		return cachedManifest{}, errors.New("no cache path")
+	}
+	info, err := os.Stat(path)
+	if err != nil {
+		return cachedManifest{}, err
+	}
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return cachedManifest{}, err
+	}
+	m, err := parseManifest(data)
+	if err != nil {
+		return cachedManifest{}, err
+	}
+	return cachedManifest{manifest: m, modTime: info.ModTime()}, nil
+}
+
+// writeLocalManifest writes the manifest to the local cache path atomically.
+func writeLocalManifest(ctx context.Context, path string, m Manifest) {
+	if path == "" {
+		return
+	}
+	data, err := json.Marshal(m)
+	if err != nil {
+		log.Debugf(ctx, "Failed to marshal manifest for cache: %v", err)
+		return
+	}
+	if err := atomicfile.Write(path, data, 0o600, atomicfile.MkDir(0o700)); err != nil {
+		log.Warnf(ctx, "Failed to write cache file: %v", err)
+	}
+}
+
+// --- Remote fetch ---
+
+// fetchRemoteWithRetry wraps fetchRemote with retries on transient errors.
+// Client errors (4xx) are not retried since they will not recover.
+func fetchRemoteWithRetry(ctx context.Context) (Manifest, error) {
+	var lastErr error
+	for attempt := range maxFetchAttempts {
+		if attempt > 0 {
+			log.Debugf(ctx, "Retrying manifest fetch (attempt %d/%d)", attempt+1, maxFetchAttempts)
+			select {
+			case <-ctx.Done():
+				return nil, ctx.Err()
+			case <-time.After(fetchRetryBackoff):
+			}
+		}
+		m, err := fetchRemote(ctx)
+		if err == nil {
+			return m, nil
+		}
+		lastErr = err
+
+		// Do not retry client errors (4xx) — they won't resolve on retry.
+		if httpErr, ok := errors.AsType[*HTTPStatusError](err); ok && httpErr.StatusCode >= 400 && httpErr.StatusCode < 500 {
+			return nil, lastErr
+		}
+	}
+	return nil, lastErr
+}
+
+func fetchRemote(ctx context.Context) (Manifest, error) {
+	log.Debugf(ctx, "Fetching compatibility manifest from %s", manifestURL)
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, manifestURL, nil)
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("User-Agent", "databricks-cli/"+build.GetInfo().Version)
+
+	resp, err := httpClient.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, &HTTPStatusError{StatusCode: resp.StatusCode}
+	}
+
+	// Cap response size to guard against corrupted or malicious responses.
+	body, err := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
+	if err != nil {
+		return nil, err
+	}
+
+	return parseManifest(body)
+}
+
+// AgentSkillsLatest is the sentinel value the skills field may take instead of a
+// concrete version, meaning "track the latest skills" rather than pinning a
+// release. The aitools installer maps it to the skills repo's latest release tag.
+const AgentSkillsLatest = "latest"
+
+func parseManifest(data []byte) (Manifest, error) {
+	var m Manifest
+	if err := json.Unmarshal(data, &m); err != nil {
+		return nil, fmt.Errorf("invalid manifest JSON: %w", err)
+	}
+	if len(m) == 0 {
+		return nil, errors.New("empty compatibility manifest")
+	}
+	for k := range m {
+		if !semver.IsValid("v" + k) {
+			return nil, fmt.Errorf("invalid semver key %q in compatibility manifest", k)
+		}
+	}
+	for k, entry := range m {
+		if entry.AppKit == "" {
+			return nil, fmt.Errorf("manifest entry %q has empty appkit version", k)
+		}
+		if entry.AgentSkills == "" {
+			return nil, fmt.Errorf("manifest entry %q has empty skills version", k)
+		}
+		if !semver.IsValid("v" + entry.AppKit) {
+			return nil, fmt.Errorf("manifest entry %q has invalid appkit version %q", k, entry.AppKit)
+		}
+		if entry.AgentSkills != AgentSkillsLatest && !semver.IsValid("v"+entry.AgentSkills) {
+			return nil, fmt.Errorf("manifest entry %q has invalid skills version %q", k, entry.AgentSkills)
+		}
+	}
+	return m, nil
+}
diff --git a/libs/clicompat/clicompat_test.go b/libs/clicompat/clicompat_test.go
new file mode 100644
index 00000000000..644df86efdf
--- /dev/null
+++ b/libs/clicompat/clicompat_test.go
@@ -0,0 +1,553 @@
+package clicompat
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/fs"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"path/filepath"
+	"slices"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/databricks/cli/internal/build"
+	"github.com/databricks/cli/libs/env"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/mod/semver"
+)
+
+const pinnedAgentSkillsVersion = "0.2.32"
+
+// roundTripFunc adapts a function into an http.RoundTripper.
+type roundTripFunc func(*http.Request) (*http.Response, error)
+
+func (f roundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) {
+	return f(req)
+}
+
+// redirectToServer replaces the package-level httpClient with one whose
+// transport rewrites every request URL to point at srv.
+func redirectToServer(t *testing.T, srv *httptest.Server) {
+	t.Helper()
+	orig := httpClient
+	httpClient = &http.Client{
+		Transport: roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			target, _ := url.Parse(srv.URL)
+			req.URL.Scheme = target.Scheme
+			req.URL.Host = target.Host
+			return http.DefaultTransport.RoundTrip(req)
+		}),
+	}
+	t.Cleanup(func() { httpClient = orig })
+}
+
+// testContext returns a context with an isolated cache directory so tests don't
+// share cached manifests.
+func testContext(t *testing.T) context.Context {
+	t.Helper()
+	return env.Set(t.Context(), "DATABRICKS_CACHE_DIR", t.TempDir())
+}
+
+// --- Resolve tests ---
+
+// TestResolve_Ranges verifies range-based resolution. Each versioned entry
+// defines a range floor: it applies to that CLI version and all versions above
+// it up to (but not including) the next entry. Dev builds use the highest
+// versioned entry. The manifest uses distinct appkit values so assertions are
+// unambiguous.
+func TestResolve_Ranges(t *testing.T) {
+	m := Manifest{
+		"0.296.0": {AppKit: "0.27.0", AgentSkills: "0.1.5"},
+		"0.290.0": {AppKit: "0.24.0", AgentSkills: "0.1.4"},
+		"0.280.0": {AppKit: "0.20.0", AgentSkills: "0.1.0"},
+	}
+
+	tests := []struct {
+		name       string
+		cliVersion string
+		wantAppKit string
+		wantSkills string
+	}{
+		{"exact match at range floor", "0.280.0", "0.20.0", "0.1.0"},
+		{"mid-range", "0.285.0", "0.20.0", "0.1.0"},
+		{"just below next range", "0.289.9", "0.20.0", "0.1.0"},
+		{"exact match mid entry", "0.290.0", "0.24.0", "0.1.4"},
+		{"between mid and top", "0.293.0", "0.24.0", "0.1.4"},
+		{"exact match highest", "0.296.0", "0.27.0", "0.1.5"},
+		{"newer than all entries uses highest", "0.300.0", "0.27.0", "0.1.5"},
+		{"older than all entries uses lowest", "0.270.0", "0.20.0", "0.1.0"},
+		{"dev build uses highest", "0.0.0-dev+abc123", "0.27.0", "0.1.5"},
+		{"bare dev uses highest", "0.0.0-dev", "0.27.0", "0.1.5"},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			entry, err := Resolve(m, tc.cliVersion)
+			require.NoError(t, err)
+			assert.Equal(t, tc.wantAppKit, entry.AppKit)
+			assert.Equal(t, tc.wantSkills, entry.AgentSkills)
+		})
+	}
+}
+
+func TestResolve_EmptyManifest(t *testing.T) {
+	m := Manifest{}
+	_, err := Resolve(m, "0.296.0")
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "empty compatibility manifest")
+}
+
+// --- FetchManifest tests ---
+
+func TestFetchManifest_RemoteSuccess(t *testing.T) {
+	ctx := testContext(t)
+	want := Manifest{
+		"0.296.0": {AppKit: "0.99.0", AgentSkills: "0.9.9"},
+	}
+	body, _ := json.Marshal(want)
+
+	var called bool
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		called = true
+		_, _ = w.Write(body)
+	}))
+	defer srv.Close()
+	redirectToServer(t, srv)
+
+	result, err := FetchManifest(ctx)
+	require.NoError(t, err)
+	assert.True(t, called, "test server should have been called")
+	assert.Equal(t, "0.99.0", result["0.296.0"].AppKit)
+}
+
+func TestFetchManifest_RemoteFailFallsBackToEmbedded(t *testing.T) {
+	ctx := testContext(t)
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusInternalServerError)
+	}))
+	defer srv.Close()
+	redirectToServer(t, srv)
+
+	// No local cache exists, so should fall back to embedded manifest.
+	result, err := FetchManifest(ctx)
+	require.NoError(t, err)
+
+	// Verify it returned the embedded manifest values.
+	embedded, _ := parseManifest(build.CLICompatManifestJSON)
+	assert.Equal(t, embedded["0.300.0"].AppKit, result["0.300.0"].AppKit)
+}
+
+func TestFetchManifest_RemoteFailFallsBackToStaleCache(t *testing.T) {
+	ctx := testContext(t)
+
+	// Pre-populate the local cache with a stale manifest.
+	staleManifest := Manifest{
+		"0.296.0": {AppKit: "0.88.0", AgentSkills: "0.8.8"},
+	}
+	localPath := manifestLocalPath(ctx)
+	writeLocalManifest(ctx, localPath, staleManifest)
+	// Make it stale by setting mod time to 2 hours ago.
+	past := time.Now().Add(-2 * time.Hour)
+	require.NoError(t, os.Chtimes(localPath, past, past))
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusInternalServerError)
+	}))
+	defer srv.Close()
+	redirectToServer(t, srv)
+
+	result, err := FetchManifest(ctx)
+	require.NoError(t, err)
+	// Should return the stale cached manifest, not the embedded one.
+	assert.Equal(t, "0.88.0", result["0.296.0"].AppKit)
+}
+
+func TestFetchManifest_RemoteSuccessWritesLocalCache(t *testing.T) {
+	ctx := testContext(t)
+	want := Manifest{
+		"0.296.0": {AppKit: "0.99.0", AgentSkills: "0.9.9"},
+	}
+	body, _ := json.Marshal(want)
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write(body)
+	}))
+	defer srv.Close()
+	redirectToServer(t, srv)
+
+	_, err := FetchManifest(ctx)
+	require.NoError(t, err)
+
+	// Verify the local cache was written.
+	localPath := manifestLocalPath(ctx)
+	_, statErr := os.Stat(localPath)
+	assert.NoError(t, statErr, "local cache file should exist after successful fetch")
+}
+
+func TestFetchManifest_CacheHit(t *testing.T) {
+	ctx := testContext(t)
+	want := Manifest{
+		"0.296.0": {AppKit: "0.99.0", AgentSkills: "0.9.9"},
+	}
+	body, _ := json.Marshal(want)
+
+	var callCount atomic.Int32
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		callCount.Add(1)
+		_, _ = w.Write(body)
+	}))
+	defer srv.Close()
+	redirectToServer(t, srv)
+
+	// First call: populates cache.
+	result1, err := FetchManifest(ctx)
+	require.NoError(t, err)
+	assert.Equal(t, "0.99.0", result1["0.296.0"].AppKit)
+
+	// Second call: should come from cache, not hitting the server again.
+	result2, err := FetchManifest(ctx)
+	require.NoError(t, err)
+	assert.Equal(t, "0.99.0", result2["0.296.0"].AppKit)
+
+	assert.Equal(t, int32(1), callCount.Load(), "server should only be called once; second call should be a cache hit")
+}
+
+func TestFetchManifest_RetryOnTransientError(t *testing.T) {
+	ctx := testContext(t)
+	want := Manifest{
+		"0.296.0": {AppKit: "0.99.0", AgentSkills: "0.9.9"},
+	}
+	body, _ := json.Marshal(want)
+
+	var callCount atomic.Int32
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		n := callCount.Add(1)
+		if n == 1 {
+			w.WriteHeader(http.StatusInternalServerError)
+			return
+		}
+		_, _ = w.Write(body)
+	}))
+	defer srv.Close()
+	redirectToServer(t, srv)
+
+	result, err := FetchManifest(ctx)
+	require.NoError(t, err)
+	assert.Equal(t, "0.99.0", result["0.296.0"].AppKit)
+	assert.Equal(t, int32(2), callCount.Load(), "should have retried after first failure")
+}
+
+// --- parseManifest tests ---
+
+func TestParseManifest_Valid(t *testing.T) {
+	data := `{"0.296.0":{"appkit":"0.27.0","skills":"0.1.5"}}`
+	m, err := parseManifest([]byte(data))
+	require.NoError(t, err)
+	assert.Equal(t, "0.27.0", m["0.296.0"].AppKit)
+}
+
+func TestParseManifest_InvalidJSON(t *testing.T) {
+	_, err := parseManifest([]byte("not json"))
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "invalid manifest JSON")
+}
+
+func TestParseManifest_Empty(t *testing.T) {
+	_, err := parseManifest([]byte("{}"))
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "empty compatibility manifest")
+}
+
+// --- resolveEntry tests ---
+
+func TestResolveEntry_RemoteSuccess(t *testing.T) {
+	ctx := testContext(t)
+	want := Manifest{
+		"0.296.0": {AppKit: "0.99.0", AgentSkills: "0.9.9"},
+	}
+	body, _ := json.Marshal(want)
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write(body)
+	}))
+	defer srv.Close()
+	redirectToServer(t, srv)
+
+	entry, err := resolveEntry(ctx, "0.296.0")
+	require.NoError(t, err)
+	assert.Equal(t, "0.99.0", entry.AppKit)
+	assert.Equal(t, "0.9.9", entry.AgentSkills)
+}
+
+func TestResolveEntry_RemoteFailUsesEmbedded(t *testing.T) {
+	ctx := testContext(t)
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusInternalServerError)
+	}))
+	defer srv.Close()
+	redirectToServer(t, srv)
+
+	// Should succeed via the embedded manifest fallback.
+	entry, err := resolveEntry(ctx, "0.0.0-dev+test")
+	require.NoError(t, err)
+	assert.NotEmpty(t, entry.AppKit)
+}
+
+func TestResolveAgentSkillsVersion(t *testing.T) {
+	tests := []struct {
+		name     string
+		manifest string
+		want     string
+	}{
+		{name: "pinned", manifest: `{"0.0.0":{"appkit":"0.84.0","skills":"0.2.30"}}`, want: "0.2.30"},
+		{name: "latest sentinel", manifest: `{"0.0.0":{"appkit":"0.84.0","skills":"latest"}}`, want: AgentSkillsLatest},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx := testContext(t)
+			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				_, _ = w.Write([]byte(tc.manifest))
+			}))
+			defer srv.Close()
+			redirectToServer(t, srv)
+
+			v, err := ResolveAgentSkillsVersion(ctx)
+			require.NoError(t, err)
+			assert.Equal(t, tc.want, v)
+		})
+	}
+}
+
+// --- ResolveEmbeddedAppKitVersion ---
+
+func TestResolveEmbeddedAppKitVersion(t *testing.T) {
+	v, err := ResolveEmbeddedAppKitVersion()
+	require.NoError(t, err)
+	assert.NotEmpty(t, v, "embedded manifest should resolve an appkit version")
+	assert.True(t, semver.IsValid("v"+v), "embedded resolved version should be valid semver")
+}
+
+func TestResolveEmbeddedAgentSkillsVersion(t *testing.T) {
+	for _, tc := range []struct {
+		version string
+		want    string
+	}{
+		{version: "1.0.0", want: "0.2.10"},
+		{version: "1.22.0", want: pinnedAgentSkillsVersion},
+		{version: "0.0.0-dev+test", want: pinnedAgentSkillsVersion},
+	} {
+		t.Run(tc.version, func(t *testing.T) {
+			original := build.GetInfo().Version
+			build.SetBuildVersion(tc.version)
+			t.Cleanup(func() { build.SetBuildVersion(original) })
+
+			v, err := ResolveEmbeddedAgentSkillsVersion()
+			require.NoError(t, err)
+			assert.Equal(t, tc.want, v)
+		})
+	}
+}
+
+// --- Embedded manifest validation (replaces AppKit TS validator) ---
+
+func TestEmbeddedManifest_IsWellFormed(t *testing.T) {
+	m, err := parseManifest(build.CLICompatManifestJSON)
+	require.NoError(t, err, "embedded manifest must be valid JSON")
+	require.NotEmpty(t, m, "embedded manifest must have at least one entry")
+
+	// All keys must be valid semver.
+	var keys []string
+	for k := range m {
+		assert.True(t, semver.IsValid("v"+k), "key %q must be valid semver", k)
+		keys = append(keys, k)
+	}
+
+	// Sort to get deterministic order from map iteration.
+	slices.SortFunc(keys, func(a, b string) int {
+		return semver.Compare("v"+a, "v"+b)
+	})
+
+	// Pinning the newest range (e.g. after a breaking skills release) must
+	// update this assertion in the same change.
+	assert.Equal(t, pinnedAgentSkillsVersion, m[keys[len(keys)-1]].AgentSkills,
+		"the newest CLI range must stay pinned until all callers support latest-release fallback")
+	assert.True(t, semver.IsValid("v"+build.AgentSkillsFallbackVersion),
+		"compiled skills fallback must be a concrete version")
+
+	// Keys must be in ascending semver order.
+	for i := 1; i < len(keys); i++ {
+		cmp := semver.Compare("v"+keys[i-1], "v"+keys[i])
+		assert.LessOrEqual(t, cmp, 0,
+			"keys must be in ascending order: %s should come before %s",
+			keys[i-1], keys[i])
+	}
+}
+
+// --- Local cache helpers ---
+
+func TestManifestLocalPath(t *testing.T) {
+	ctx := env.Set(t.Context(), "DATABRICKS_CACHE_DIR", "/tmp/test-cache")
+	path := manifestLocalPath(ctx)
+	assert.Equal(t, filepath.Join("/tmp/test-cache", localManifestFile), path)
+}
+
+func TestReadWriteLocalManifest(t *testing.T) {
+	ctx := testContext(t)
+	m := Manifest{
+		"0.300.0": {AppKit: "0.50.0", AgentSkills: "0.5.0"},
+	}
+
+	path := manifestLocalPath(ctx)
+	writeLocalManifest(ctx, path, m)
+
+	cached, err := readLocalManifest(path)
+	require.NoError(t, err)
+	assert.Equal(t, "0.50.0", cached.manifest["0.300.0"].AppKit)
+	assert.True(t, cached.isFresh(cacheTTL), "just-written file should be fresh")
+}
+
+// --- IsNotFoundError tests ---
+
+func TestIsNotFoundError(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want bool
+	}{
+		{name: "nil", err: nil, want: false},
+		{name: "unrelated error", err: errors.New("connection refused"), want: false},
+		{name: "sentinel ErrNotFound", err: ErrNotFound, want: true},
+		{name: "wrapped ErrNotFound", err: fmt.Errorf("fetching: %w", ErrNotFound), want: true},
+		{name: "HTTPStatusError 404", err: &HTTPStatusError{StatusCode: 404}, want: true},
+		{name: "wrapped HTTPStatusError 404", err: fmt.Errorf("fetch failed: %w", &HTTPStatusError{StatusCode: 404}), want: true},
+		{name: "HTTPStatusError 500", err: &HTTPStatusError{StatusCode: 500}, want: false},
+		{name: "HTTPStatusError 403", err: &HTTPStatusError{StatusCode: 403}, want: false},
+		{name: "git not found", err: errors.New("Remote branch template-v99 not found in upstream origin"), want: true},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, IsNotFoundError(tc.err))
+		})
+	}
+}
+
+// --- parseManifest entry validation tests ---
+
+func TestParseManifest_EmptyAppKit(t *testing.T) {
+	data := `{"0.296.0":{"appkit":"","skills":"0.1.5"}}`
+	_, err := parseManifest([]byte(data))
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "empty appkit version")
+}
+
+func TestParseManifest_EmptySkills(t *testing.T) {
+	data := `{"0.296.0":{"appkit":"0.27.0","skills":""}}`
+	_, err := parseManifest([]byte(data))
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "empty skills version")
+}
+
+func TestParseManifest_InvalidAppKitSemver(t *testing.T) {
+	data := `{"0.296.0":{"appkit":"not-semver","skills":"0.1.5"}}`
+	_, err := parseManifest([]byte(data))
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "invalid appkit version")
+}
+
+func TestParseManifest_InvalidSkillsSemver(t *testing.T) {
+	data := `{"0.296.0":{"appkit":"0.27.0","skills":"abc"}}`
+	_, err := parseManifest([]byte(data))
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "invalid skills version")
+}
+
+func TestParseManifest_InvalidKey(t *testing.T) {
+	data := `{"not-semver":{"appkit":"0.27.0","skills":"0.1.5"}}`
+	_, err := parseManifest([]byte(data))
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "invalid semver key")
+}
+
+// --- FetchManifest no-retry-on-404 test ---
+
+func TestFetchManifest_NoRetryOn404(t *testing.T) {
+	ctx := testContext(t)
+	var callCount atomic.Int32
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		callCount.Add(1)
+		w.WriteHeader(http.StatusNotFound)
+	}))
+	defer srv.Close()
+	redirectToServer(t, srv)
+
+	// Should fall back to embedded manifest (since 404 is not retried).
+	result, err := FetchManifest(ctx)
+	require.NoError(t, err)
+
+	embedded, _ := parseEmbeddedManifest()
+	assert.Equal(t, embedded["0.300.0"].AppKit, result["0.300.0"].AppKit)
+	assert.Equal(t, int32(1), callCount.Load(), "404 should not be retried")
+}
+
+// --- FetchManifest cache-disabled test ---
+
+func TestFetchManifest_CacheDisabled(t *testing.T) {
+	ctx := testContext(t)
+	ctx = env.Set(ctx, "DATABRICKS_CACHE_ENABLED", "false")
+
+	want := Manifest{
+		"0.296.0": {AppKit: "0.99.0", AgentSkills: "0.9.9"},
+	}
+	body, _ := json.Marshal(want)
+
+	var callCount atomic.Int32
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		callCount.Add(1)
+		_, _ = w.Write(body)
+	}))
+	defer srv.Close()
+	redirectToServer(t, srv)
+
+	// First call fetches from remote.
+	result1, err := FetchManifest(ctx)
+	require.NoError(t, err)
+	assert.Equal(t, "0.99.0", result1["0.296.0"].AppKit)
+
+	// Second call should also fetch from remote (cache is disabled).
+	result2, err := FetchManifest(ctx)
+	require.NoError(t, err)
+	assert.Equal(t, "0.99.0", result2["0.296.0"].AppKit)
+
+	assert.Equal(t, int32(2), callCount.Load(), "with cache disabled, both calls should hit the server")
+
+	// Verify no cache file was written.
+	localPath := manifestLocalPath(ctx)
+	_, statErr := os.Stat(localPath)
+	assert.ErrorIs(t, statErr, fs.ErrNotExist, "cache file should not exist when cache is disabled")
+}
+
+func TestFetchManifest_ForceEmbedded(t *testing.T) {
+	ctx := testContext(t)
+	ctx = env.Set(ctx, "DATABRICKS_FORCE_EMBEDDED_COMPAT", "true")
+
+	var called bool
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		called = true
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+	redirectToServer(t, srv)
+
+	result, err := FetchManifest(ctx)
+	require.NoError(t, err)
+	assert.False(t, called, "server should not be called when DATABRICKS_FORCE_EMBEDDED_COMPAT=true")
+
+	embedded, _ := parseManifest(build.CLICompatManifestJSON)
+	assert.Equal(t, embedded["0.300.0"].AppKit, result["0.300.0"].AppKit)
+}
diff --git a/libs/cmdctx/context.go b/libs/cmdctx/context.go
index 326623dda62..a795cfd8f1e 100644
--- a/libs/cmdctx/context.go
+++ b/libs/cmdctx/context.go
@@ -2,8 +2,7 @@ package cmdctx
 
 import (
 	"context"
-
-	"github.com/google/uuid"
+	"uuid"
 )
 
 // key is a package-local type to use for context keys.
diff --git a/libs/cmdctx/context_test.go b/libs/cmdctx/context_test.go
index 58e2d1efdb5..58a3eaee74d 100644
--- a/libs/cmdctx/context_test.go
+++ b/libs/cmdctx/context_test.go
@@ -2,8 +2,8 @@ package cmdctx
 
 import (
 	"testing"
+	"uuid"
 
-	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -45,5 +45,6 @@ func TestCommandGenerateExecId(t *testing.T) {
 	assert.Equal(t, v, ExecId(ctx))
 
 	// The value should be a valid UUID.
-	assert.NoError(t, uuid.Validate(v))
+	_, err := uuid.Parse(v)
+	assert.NoError(t, err)
 }
diff --git a/libs/cmdctx/workspace_client.go b/libs/cmdctx/workspace_client.go
index 194beee5f66..915ea0337c7 100644
--- a/libs/cmdctx/workspace_client.go
+++ b/libs/cmdctx/workspace_client.go
@@ -20,3 +20,9 @@ func WorkspaceClient(ctx context.Context) *databricks.WorkspaceClient {
 	}
 	return v.(*databricks.WorkspaceClient)
 }
+
+// HasWorkspaceClient reports whether a workspace client was configured on the
+// context via SetWorkspaceClient.
+func HasWorkspaceClient(ctx context.Context) bool {
+	return ctx.Value(workspaceClientKey) != nil
+}
diff --git a/libs/cmdctx/workspace_client_test.go b/libs/cmdctx/workspace_client_test.go
index cd3959602f5..3f2942d8e81 100644
--- a/libs/cmdctx/workspace_client_test.go
+++ b/libs/cmdctx/workspace_client_test.go
@@ -36,3 +36,16 @@ func TestCommandWorkspaceClient(t *testing.T) {
 		cmdctx.SetWorkspaceClient(ctx, client)
 	})
 }
+
+func TestHasWorkspaceClient(t *testing.T) {
+	ctx := t.Context()
+	assert.False(t, cmdctx.HasWorkspaceClient(ctx))
+
+	client := &databricks.WorkspaceClient{
+		Config: &config.Config{
+			Host: "https://test.test",
+		},
+	}
+	ctx = cmdctx.SetWorkspaceClient(ctx, client)
+	assert.True(t, cmdctx.HasWorkspaceClient(ctx))
+}
diff --git a/libs/cmdio/ask.go b/libs/cmdio/ask.go
new file mode 100644
index 00000000000..909076d5e60
--- /dev/null
+++ b/libs/cmdio/ask.go
@@ -0,0 +1,78 @@
+package cmdio
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"strings"
+)
+
+// readLine reads a line from the reader and returns it without the trailing newline characters.
+// It is unbuffered because cmdio's stdin is also unbuffered.
+// If we were to add a [bufio.Reader] to the mix, we would need to update the other uses of the reader.
+// Once cmdio's stdio is made to be buffered, this function can be removed.
+func readLine(r io.Reader) (string, error) {
+	var b strings.Builder
+	buf := make([]byte, 1)
+	for {
+		n, err := r.Read(buf)
+		if n > 0 {
+			if buf[0] == '\n' {
+				break
+			}
+			if buf[0] != '\r' {
+				b.WriteByte(buf[0])
+			}
+		}
+		if err != nil {
+			if b.Len() == 0 {
+				return "", err
+			}
+			break
+		}
+	}
+	return b.String(), nil
+}
+
+// Ask prompts the user with a question and returns the entered answer.
+// If the user just presses enter, defaultVal is returned.
+func Ask(ctx context.Context, question, defaultVal string) (string, error) {
+	c := fromContext(ctx)
+
+	// Add default value to question prompt.
+	if defaultVal != "" {
+		question += fmt.Sprintf(` [%s]`, defaultVal)
+	}
+	question += `: `
+
+	// Print prompt.
+	_, err := io.WriteString(c.err, question)
+	if err != nil {
+		return "", err
+	}
+
+	// Read user input. Trim new line characters.
+	ans, err := readLine(c.in)
+	if err != nil {
+		return "", err
+	}
+
+	// Return default value if user just presses enter.
+	if ans == "" {
+		return defaultVal, nil
+	}
+
+	return ans, nil
+}
+
+// AskYesOrNo prompts the user with a question and returns true if the answer
+// is "y" or "yes" (case-insensitive). Any other answer, including an empty
+// one, returns false.
+func AskYesOrNo(ctx context.Context, question string) (bool, error) {
+	ans, err := Ask(ctx, question+" [y/N]", "")
+	if err != nil {
+		return false, err
+	}
+	ans = strings.ToLower(strings.TrimSpace(ans))
+	return ans == "y" || ans == "yes", nil
+}
diff --git a/libs/cmdio/ask_test.go b/libs/cmdio/ask_test.go
new file mode 100644
index 00000000000..75fc520f8d5
--- /dev/null
+++ b/libs/cmdio/ask_test.go
@@ -0,0 +1,179 @@
+package cmdio
+
+import (
+	"errors"
+	"io"
+	"strings"
+	"testing"
+
+	"github.com/databricks/cli/libs/flags"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestReadLine(t *testing.T) {
+	tests := []struct {
+		name       string
+		reader     io.Reader
+		want       string
+		wantErr    bool
+		errContain string
+	}{
+		{
+			name:   "basic line with LF",
+			reader: strings.NewReader("hello\n"),
+			want:   "hello",
+		},
+		{
+			name:   "line with CRLF",
+			reader: strings.NewReader("hello\r\n"),
+			want:   "hello",
+		},
+		{
+			name:   "line with only CR",
+			reader: strings.NewReader("hello\r"),
+			want:   "hello",
+		},
+		{
+			name:   "empty line with LF",
+			reader: strings.NewReader("\n"),
+			want:   "",
+		},
+		{
+			name:   "empty line with CRLF",
+			reader: strings.NewReader("\r\n"),
+			want:   "",
+		},
+		{
+			name:   "line without newline at EOF",
+			reader: strings.NewReader("hello"),
+			want:   "hello",
+		},
+		{
+			name:   "multi-line input stops at first newline",
+			reader: strings.NewReader("hello\nworld\n"),
+			want:   "hello",
+		},
+		{
+			name:   "line with multiple CR characters",
+			reader: strings.NewReader("hello\r\rworld\n"),
+			want:   "helloworld",
+		},
+		{
+			name:   "line with CR in middle",
+			reader: strings.NewReader("hello\rworld\n"),
+			want:   "helloworld",
+		},
+		{
+			name:   "line with spaces and special chars",
+			reader: strings.NewReader("hello world!@#$%\n"),
+			want:   "hello world!@#$%",
+		},
+		{
+			name:   "unicode characters",
+			reader: strings.NewReader("hello 世界\n"),
+			want:   "hello 世界",
+		},
+		{
+			name:       "empty reader",
+			reader:     strings.NewReader(""),
+			want:       "",
+			wantErr:    true,
+			errContain: "EOF",
+		},
+		{
+			name:       "reader with error",
+			reader:     &errorReader{err: errors.New("read error")},
+			want:       "",
+			wantErr:    true,
+			errContain: "read error",
+		},
+		{
+			name:   "reader with error after some data",
+			reader: &errorAfterNReader{data: []byte("hello"), n: 3, err: io.ErrUnexpectedEOF},
+			want:   "hel",
+		},
+		{
+			name:   "long line",
+			reader: strings.NewReader(strings.Repeat("a", 1000) + "\n"),
+			want:   strings.Repeat("a", 1000),
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			got, err := readLine(test.reader)
+			if test.wantErr {
+				require.Error(t, err)
+				if test.errContain != "" {
+					assert.Contains(t, err.Error(), test.errContain)
+				}
+			} else {
+				require.NoError(t, err)
+			}
+			assert.Equal(t, test.want, got)
+		})
+	}
+}
+
+// errorReader is a test helper that always returns an error
+type errorReader struct {
+	err error
+}
+
+func (e *errorReader) Read(p []byte) (n int, err error) {
+	return 0, e.err
+}
+
+// errorAfterNReader is a test helper that returns data for n reads, then returns an error
+type errorAfterNReader struct {
+	data  []byte
+	n     int
+	count int
+	err   error
+}
+
+func (e *errorAfterNReader) Read(p []byte) (n int, err error) {
+	if e.count >= e.n {
+		return 0, e.err
+	}
+	if len(p) == 0 {
+		return 0, nil
+	}
+	if e.count < len(e.data) {
+		p[0] = e.data[e.count]
+		e.count++
+		return 1, nil
+	}
+	return 0, e.err
+}
+
+func TestAskYesOrNo(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		want  bool
+	}{
+		{name: "y", input: "y\n", want: true},
+		{name: "yes", input: "yes\n", want: true},
+		{name: "Y", input: "Y\n", want: true},
+		{name: "YES", input: "YES\n", want: true},
+		{name: "Yes", input: "Yes\n", want: true},
+		{name: "y with surrounding whitespace", input: "  y  \n", want: true},
+		{name: "yes with CRLF", input: "yes\r\n", want: true},
+		{name: "empty", input: "\n", want: false},
+		{name: "n", input: "n\n", want: false},
+		{name: "no", input: "no\n", want: false},
+		{name: "yeah", input: "yeah\n", want: false},
+		{name: "gibberish", input: "foobar\n", want: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := t.Context()
+			ctx = InContext(ctx, NewIO(ctx, flags.OutputText, strings.NewReader(tt.input), io.Discard, io.Discard, "", ""))
+			got, err := AskYesOrNo(ctx, "Proceed?")
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
diff --git a/libs/cmdio/capabilities.go b/libs/cmdio/capabilities.go
index 5d909b89928..47017b53acc 100644
--- a/libs/cmdio/capabilities.go
+++ b/libs/cmdio/capabilities.go
@@ -63,13 +63,11 @@ func (c Capabilities) SupportsPager() bool {
 	return c.SupportsPrompt() && c.stdoutIsTTY
 }
 
-// detectGitBash returns true if running in Git Bash on Windows (has broken promptui support).
-// We do not allow prompting in Git Bash on Windows.
-// Likely due to fact that Git Bash does not correctly support ANSI escape sequences,
-// we cannot use promptui package there.
-// See known issues:
-// - https://github.com/manifoldco/promptui/issues/208
-// - https://github.com/chzyer/readline/issues/191
+// detectGitBash returns true if running under a Cygwin/MSYS2 environment on
+// Windows (Git Bash is the common case).
+//
+// We disable prompting there because bubbletea is not compatible with the
+// Cygwin/MSYS2 pty emulation; making it work is a follow-up.
 func detectGitBash(ctx context.Context) bool {
 	// Check if the MSYSTEM environment variable is set to "MINGW64"
 	msystem := env.Get(ctx, "MSYSTEM")
diff --git a/libs/cmdio/cmdiotest/prompt_alt_key_noop_baseline_test.go b/libs/cmdio/cmdiotest/prompt_alt_key_noop_baseline_test.go
new file mode 100644
index 00000000000..005f815605d
--- /dev/null
+++ b/libs/cmdio/cmdiotest/prompt_alt_key_noop_baseline_test.go
@@ -0,0 +1,43 @@
+package cmdiotest_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestPromptBaseline_AltKeyNoop pins that Alt-prefixed keys are silent
+// no-ops in [cmdio.RunPrompt]. Specifically, Alt+f (the readline binding
+// for "move forward by word") must neither move the cursor nor insert a
+// literal 'f' into the buffer. The same shape applies to Alt+b, Alt+d,
+// Alt+Backspace, and any other modified key the prompt model doesn't
+// handle; pinning Alt+f covers the class.
+func TestPromptBaseline_AltKeyNoop(t *testing.T) {
+	t.Parallel()
+	tm := termtest.NewPrompt(t, cmdio.PromptOptions{
+		Label: "Workspace name",
+	})
+	tm.WaitFor("Workspace name")
+
+	// Type "hello" and move cursor two places left so it sits mid-word.
+	// If Alt+f moved the cursor (or inserted), goldens 01 and 02 would
+	// diverge.
+	tm.Type("hello")
+	tm.Type(termtest.KeyLeft)
+	tm.Type(termtest.KeyLeft)
+	tm.Golden("01-cursor-mid")
+
+	tm.Type("\x1bf")
+	tm.Golden("02-after-alt-f")
+
+	tm.Type(termtest.KeyEnter)
+	v, err := tm.Result()
+	require.NoError(t, err, "raw output: %q", tm.Raw())
+	// Final guard: the returned value must be exactly "hello". A literal
+	// 'f' insertion would surface here even if the goldens above somehow
+	// missed it.
+	assert.Equal(t, "hello", v)
+}
diff --git a/libs/cmdio/cmdiotest/prompt_ctrl_c_baseline_test.go b/libs/cmdio/cmdiotest/prompt_ctrl_c_baseline_test.go
new file mode 100644
index 00000000000..a818d1ba937
--- /dev/null
+++ b/libs/cmdio/cmdiotest/prompt_ctrl_c_baseline_test.go
@@ -0,0 +1,32 @@
+package cmdiotest_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestPromptBaseline_CtrlC pins Ctrl+C cancellation for RunPrompt. Mirrors
+// the equivalent Secret test: error is returned, value is empty, snapshot
+// captures any "^C" that the terminal echoed.
+func TestPromptBaseline_CtrlC(t *testing.T) {
+	t.Parallel()
+	tm := termtest.NewPrompt(t, cmdio.PromptOptions{
+		Label: "Workspace name",
+	})
+	tm.WaitFor("Workspace name")
+	tm.Golden("01-empty")
+
+	tm.Type("partial input")
+	tm.Golden("02-after-typing")
+
+	tm.Type(termtest.KeyCtrlC)
+
+	v, err := tm.Result()
+	require.Error(t, err)
+	assert.EqualError(t, err, "^C")
+	assert.Empty(t, v)
+}
diff --git a/libs/cmdio/cmdiotest/prompt_ctrl_fb_baseline_test.go b/libs/cmdio/cmdiotest/prompt_ctrl_fb_baseline_test.go
new file mode 100644
index 00000000000..90f1b35579b
--- /dev/null
+++ b/libs/cmdio/cmdiotest/prompt_ctrl_fb_baseline_test.go
@@ -0,0 +1,36 @@
+package cmdiotest_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestPromptBaseline_CtrlFCtrlB pins that Ctrl+F and Ctrl+B move the cursor
+// one character forward and backward in [cmdio.RunPrompt], the same as the
+// right and left arrow keys. The emacs-style bindings are de-facto aliases
+// for the arrow keys; this test pins that equivalence.
+func TestPromptBaseline_CtrlFCtrlB(t *testing.T) {
+	t.Parallel()
+	tm := termtest.NewPrompt(t, cmdio.PromptOptions{
+		Label: "Workspace name",
+	})
+	tm.WaitFor("Workspace name")
+	tm.Type("hello")
+	tm.Golden("01-cursor-end")
+
+	tm.Type(termtest.KeyCtrlB)
+	tm.Type(termtest.KeyCtrlB)
+	tm.Golden("02-after-ctrl-b-twice")
+
+	tm.Type(termtest.KeyCtrlF)
+	tm.Golden("03-after-ctrl-f")
+
+	tm.Type(termtest.KeyEnter)
+	v, err := tm.Result()
+	require.NoError(t, err, "raw output: %q", tm.Raw())
+	assert.Equal(t, "hello", v)
+}
diff --git a/libs/cmdio/cmdiotest/prompt_ctrl_h_baseline_test.go b/libs/cmdio/cmdiotest/prompt_ctrl_h_baseline_test.go
new file mode 100644
index 00000000000..eee56de4616
--- /dev/null
+++ b/libs/cmdio/cmdiotest/prompt_ctrl_h_baseline_test.go
@@ -0,0 +1,35 @@
+package cmdiotest_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestPromptBaseline_CtrlH pins that Ctrl+H deletes the character to the
+// left of the cursor in [cmdio.RunPrompt] — the same as the Backspace key.
+// Ctrl+H sends BS (0x08) and Backspace sends DEL (0x7f); the prompt model
+// handles both as backspace, making the control-character form a de-facto
+// alias. This test pins that equivalence so a future change can't silently
+// drop it.
+func TestPromptBaseline_CtrlH(t *testing.T) {
+	t.Parallel()
+	tm := termtest.NewPrompt(t, cmdio.PromptOptions{
+		Label: "Workspace name",
+	})
+	tm.WaitFor("Workspace name")
+	tm.Type("hello")
+	tm.Golden("01-typed-hello")
+
+	tm.Type(termtest.KeyCtrlH)
+	tm.Type(termtest.KeyCtrlH)
+	tm.Golden("02-after-ctrl-h-twice")
+
+	tm.Type(termtest.KeyEnter)
+	v, err := tm.Result()
+	require.NoError(t, err, "raw output: %q", tm.Raw())
+	assert.Equal(t, "hel", v)
+}
diff --git a/libs/cmdio/cmdiotest/prompt_ctrl_j_baseline_test.go b/libs/cmdio/cmdiotest/prompt_ctrl_j_baseline_test.go
new file mode 100644
index 00000000000..3961f4bd5bb
--- /dev/null
+++ b/libs/cmdio/cmdiotest/prompt_ctrl_j_baseline_test.go
@@ -0,0 +1,30 @@
+package cmdiotest_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestPromptBaseline_CtrlJ pins that Ctrl+J submits the prompt in
+// [cmdio.RunPrompt] — the same as the Enter (Return) key. Enter sends CR
+// (0x0d) and Ctrl+J sends LF (0x0a); the prompt model treats both as
+// submit. A future change that only reacts to CR would silently swallow
+// Ctrl+J; this test pins the parity.
+func TestPromptBaseline_CtrlJ(t *testing.T) {
+	t.Parallel()
+	tm := termtest.NewPrompt(t, cmdio.PromptOptions{
+		Label: "Workspace name",
+	})
+	tm.WaitFor("Workspace name")
+	tm.Type("hello")
+	tm.Golden("01-typed-hello")
+
+	tm.Type(termtest.KeyCtrlJ)
+	v, err := tm.Result()
+	require.NoError(t, err, "raw output: %q", tm.Raw())
+	assert.Equal(t, "hello", v)
+}
diff --git a/libs/cmdio/cmdiotest/prompt_cursor_editing_baseline_test.go b/libs/cmdio/cmdiotest/prompt_cursor_editing_baseline_test.go
new file mode 100644
index 00000000000..7f6bbc5abf0
--- /dev/null
+++ b/libs/cmdio/cmdiotest/prompt_cursor_editing_baseline_test.go
@@ -0,0 +1,59 @@
+package cmdiotest_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestPromptBaseline_CursorEditing pins how RunPrompt responds to cursor
+// movement and line-editing keys: ←/→, Home/End, Backspace, Ctrl+W, Ctrl+U.
+// The prompt model handles ←/→ and Backspace; Home/End/Ctrl+W/Ctrl+U are
+// no-ops, so the goldens after them are intentionally identical to the
+// post-Backspace one. The Delete key (\x1b[3~) is *not* covered here
+// because it exits the prompt with EOF; that behavior is pinned separately
+// by TestPromptBaseline_DeleteKeyExits.
+func TestPromptBaseline_CursorEditing(t *testing.T) {
+	t.Parallel()
+	tm := termtest.NewPrompt(t, cmdio.PromptOptions{
+		Label: "Workspace name",
+	})
+	tm.WaitFor("Workspace name")
+	tm.Golden("01-empty")
+
+	tm.Type("hello world")
+	tm.Golden("02-typed")
+
+	tm.Type(termtest.KeyHome)
+	tm.Type("X")
+	tm.Golden("03-insert-at-start")
+
+	tm.Type(termtest.KeyEnd)
+	tm.Type("!")
+	tm.Golden("04-insert-at-end")
+
+	tm.Type(termtest.KeyLeft)
+	tm.Type(termtest.KeyLeft)
+	tm.Type("Y")
+	tm.Golden("05-insert-mid")
+
+	tm.Type(termtest.KeyBackspace)
+	tm.Golden("06-after-backspace")
+
+	tm.Type(termtest.KeyCtrlW)
+	tm.Golden("07-after-ctrl-w")
+
+	tm.Type(termtest.KeyCtrlU)
+	tm.Golden("08-after-ctrl-u")
+
+	tm.Type(termtest.KeyEnter)
+
+	v, err := tm.Result()
+	require.NoError(t, err, "raw output: %q", tm.Raw())
+	// The goldens above show the visible buffer is "hello worldX!" when
+	// Enter fires; that's what the prompt returns.
+	assert.Equal(t, "hello worldX!", v, "snapshot:\n%s", tm.Snapshot())
+}
diff --git a/libs/cmdio/cmdiotest/prompt_delete_key_exits_baseline_test.go b/libs/cmdio/cmdiotest/prompt_delete_key_exits_baseline_test.go
new file mode 100644
index 00000000000..be9334d9d32
--- /dev/null
+++ b/libs/cmdio/cmdiotest/prompt_delete_key_exits_baseline_test.go
@@ -0,0 +1,36 @@
+package cmdiotest_test
+
+import (
+	"io"
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestPromptBaseline_DeleteKeyExits pins a surprising behavior of
+// [cmdio.RunPrompt]: pressing the Delete key (\x1b[3~) exits the prompt with
+// io.EOF, just like Ctrl+D would on an empty line — and discards any input
+// the user had already typed. The prompt model collapses both keys into the
+// same EOF path; see prompt.go for the rationale. Pinning the behavior here
+// makes sure a future change that splits the two keys is intentional.
+func TestPromptBaseline_DeleteKeyExits(t *testing.T) {
+	t.Parallel()
+	tm := termtest.NewPrompt(t, cmdio.PromptOptions{
+		Label: "Workspace name",
+	})
+	tm.WaitFor("Workspace name")
+
+	// Type some content first to prove the buffer is non-empty from the user's
+	// perspective. This is what makes the behavior surprising: the prompt
+	// still exits even though the user has typed input.
+	tm.Type("hello")
+	tm.Type(termtest.KeyDelete)
+
+	v, err := tm.Result()
+	require.Error(t, err, "raw output: %q", tm.Raw())
+	assert.ErrorIs(t, err, io.EOF)
+	assert.Empty(t, v, "Delete-as-EOF discards typed input")
+}
diff --git a/libs/cmdio/cmdiotest/prompt_hide_entered_baseline_test.go b/libs/cmdio/cmdiotest/prompt_hide_entered_baseline_test.go
new file mode 100644
index 00000000000..ab555a2d5f5
--- /dev/null
+++ b/libs/cmdio/cmdiotest/prompt_hide_entered_baseline_test.go
@@ -0,0 +1,50 @@
+package cmdiotest_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestPromptBaseline_HideEnteredFalse pins the default post-Enter rendering
+// of [cmdio.RunPrompt]: with HideEntered=false (the default), the entered
+// value is shown alongside the label after the prompt closes.
+func TestPromptBaseline_HideEnteredFalse(t *testing.T) {
+	t.Parallel()
+	tm := termtest.NewPrompt(t, cmdio.PromptOptions{
+		Label:       "Workspace name",
+		HideEntered: false,
+	})
+	tm.WaitFor("Workspace name")
+	tm.Type("hello")
+	tm.Type(termtest.KeyEnter)
+
+	v, err := tm.Result()
+	require.NoError(t, err, "raw output: %q", tm.Raw())
+	assert.Equal(t, "hello", v, "snapshot:\n%s", tm.Snapshot())
+
+	tm.Golden("01-after-enter")
+}
+
+// TestPromptBaseline_HideEnteredTrue pins that HideEntered=true clears the
+// prompt frame after the user submits, leaving no trace of the entered value
+// on screen. This is the path used by [cmdio.Secret].
+func TestPromptBaseline_HideEnteredTrue(t *testing.T) {
+	t.Parallel()
+	tm := termtest.NewPrompt(t, cmdio.PromptOptions{
+		Label:       "Workspace name",
+		HideEntered: true,
+	})
+	tm.WaitFor("Workspace name")
+	tm.Type("hello")
+	tm.Type(termtest.KeyEnter)
+
+	v, err := tm.Result()
+	require.NoError(t, err, "raw output: %q", tm.Raw())
+	assert.Equal(t, "hello", v, "snapshot:\n%s", tm.Snapshot())
+
+	tm.Golden("01-after-enter")
+}
diff --git a/libs/cmdio/cmdiotest/prompt_mask_baseline_test.go b/libs/cmdio/cmdiotest/prompt_mask_baseline_test.go
new file mode 100644
index 00000000000..3db492592b2
--- /dev/null
+++ b/libs/cmdio/cmdiotest/prompt_mask_baseline_test.go
@@ -0,0 +1,37 @@
+package cmdiotest_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestPromptBaseline_Mask pins runprompts behavior
+// when configured with Mask='*'. This is the shape used by `databricks
+// configure` for personal access token entry (cmd/configure/configure.go:46).
+func TestPromptBaseline_Mask(t *testing.T) {
+	t.Parallel()
+	tm := termtest.NewPrompt(t, cmdio.PromptOptions{
+		Label: "Personal access token",
+		Mask:  '*',
+	})
+	tm.WaitFor("Personal access token")
+	tm.Golden("01-empty")
+
+	tm.Type("dapi-secret")
+	tm.Golden("02-after-typing")
+
+	tm.Type(termtest.KeyBackspace)
+	tm.Type(termtest.KeyBackspace)
+	tm.Type(termtest.KeyBackspace)
+	tm.Golden("03-after-backspace")
+
+	tm.Type(termtest.KeyEnter)
+
+	v, err := tm.Result()
+	require.NoError(t, err, "raw output: %q", tm.Raw())
+	assert.Equal(t, "dapi-sec", v, "snapshot:\n%s", tm.Snapshot())
+}
diff --git a/libs/cmdio/cmdiotest/prompt_plain_baseline_test.go b/libs/cmdio/cmdiotest/prompt_plain_baseline_test.go
new file mode 100644
index 00000000000..2798d7d5a58
--- /dev/null
+++ b/libs/cmdio/cmdiotest/prompt_plain_baseline_test.go
@@ -0,0 +1,36 @@
+package cmdiotest_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestPromptBaseline_Plain pins prompts behavior when configured with only a
+// Label (no Validate, no Mask). This is the most common shape used across
+// cmd/auth and cmd/configure.
+func TestPromptBaseline_Plain(t *testing.T) {
+	t.Parallel()
+	tm := termtest.NewPrompt(t, cmdio.PromptOptions{
+		Label: "Workspace name",
+	})
+	tm.WaitFor("Workspace name")
+	tm.Golden("01-empty")
+
+	tm.Type("hello")
+	tm.Golden("02-after-typing")
+
+	tm.Type(termtest.KeyBackspace)
+	tm.Type(termtest.KeyBackspace)
+	tm.Type("p there")
+	tm.Golden("03-after-edit")
+
+	tm.Type(termtest.KeyEnter)
+
+	v, err := tm.Result()
+	require.NoError(t, err, "raw output: %q", tm.Raw())
+	assert.Equal(t, "help there", v, "snapshot:\n%s", tm.Snapshot())
+}
diff --git a/libs/cmdio/cmdiotest/prompt_utf8_baseline_test.go b/libs/cmdio/cmdiotest/prompt_utf8_baseline_test.go
new file mode 100644
index 00000000000..184ebd5cb52
--- /dev/null
+++ b/libs/cmdio/cmdiotest/prompt_utf8_baseline_test.go
@@ -0,0 +1,50 @@
+package cmdiotest_test
+
+import (
+	"runtime"
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestPromptBaseline_UTF8 pins multi-byte rune handling: typing "café"
+// (4 runes, 5 bytes) renders as 4 cells, one Backspace deletes one rune
+// not one byte, and the returned value preserves the original code points.
+// An implementation that counts bytes instead of runes would silently
+// corrupt non-ASCII input even with ASCII tests passing.
+func TestPromptBaseline_UTF8(t *testing.T) {
+	// On Windows, bubbletea wraps non-console input in
+	// github.com/mattn/go-localereader (see key_windows.go), which decodes
+	// each incoming byte ≥0x80 as the system ANSI code page (CP1252 on
+	// English Windows). Our pipe-based harness feeds raw UTF-8, so the
+	// c3 a9 bytes for "é" get re-read as Latin-1 Ã + © and never reach
+	// the prompt model as a single rune. The model itself handles UTF-8
+	// correctly in production (where bytes come from the real console).
+	if runtime.GOOS == "windows" {
+		t.Skip("bubbletea localereader mangles UTF-8 over non-console input on Windows")
+	}
+	t.Parallel()
+	tm := termtest.NewPrompt(t, cmdio.PromptOptions{
+		Label: "Name",
+	})
+	tm.WaitFor("Name")
+	tm.Golden("01-empty")
+
+	tm.Type("café")
+	tm.Golden("02-after-typing")
+
+	tm.Type(termtest.KeyBackspace)
+	tm.Golden("03-after-backspace")
+
+	tm.Type("é")
+	tm.Golden("04-restored")
+
+	tm.Type(termtest.KeyEnter)
+
+	v, err := tm.Result()
+	require.NoError(t, err, "raw output: %q", tm.Raw())
+	assert.Equal(t, "café", v, "snapshot:\n%s", tm.Snapshot())
+}
diff --git a/libs/cmdio/cmdiotest/prompt_validate_baseline_test.go b/libs/cmdio/cmdiotest/prompt_validate_baseline_test.go
new file mode 100644
index 00000000000..5f703a5865d
--- /dev/null
+++ b/libs/cmdio/cmdiotest/prompt_validate_baseline_test.go
@@ -0,0 +1,47 @@
+package cmdiotest_test
+
+import (
+	"errors"
+	"strings"
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestPromptBaseline_Validate pins Prompt's behavior when a Validate
+// callback is configured: validation re-runs on every keystroke, the
+// indicator glyph reflects the result, and Enter is blocked while invalid.
+func TestPromptBaseline_Validate(t *testing.T) {
+	t.Parallel()
+	tm := termtest.NewPrompt(t, cmdio.PromptOptions{
+		Label: "Workspace host",
+		Validate: func(s string) error {
+			if !strings.Contains(s, "://") {
+				return errors.New("must contain ://")
+			}
+			return nil
+		},
+	})
+	tm.WaitFor("Workspace host")
+	tm.Golden("01-empty")
+
+	tm.Type("abc")
+	tm.Golden("02-invalid-typing")
+
+	tm.Type(termtest.KeyBackspace)
+	tm.Type(termtest.KeyBackspace)
+	tm.Type(termtest.KeyBackspace)
+	tm.Golden("03-cleared")
+
+	tm.Type("https://example.com")
+	tm.Golden("04-valid")
+
+	tm.Type(termtest.KeyEnter)
+
+	v, err := tm.Result()
+	require.NoError(t, err, "raw output: %q", tm.Raw())
+	assert.Equal(t, "https://example.com", v, "snapshot:\n%s", tm.Snapshot())
+}
diff --git a/libs/cmdio/cmdiotest/secret_baseline_test.go b/libs/cmdio/cmdiotest/secret_baseline_test.go
new file mode 100644
index 00000000000..003f04c6d37
--- /dev/null
+++ b/libs/cmdio/cmdiotest/secret_baseline_test.go
@@ -0,0 +1,31 @@
+package cmdiotest_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestSecretBaseline_Typing pins secrets behavior:
+// each typed character should render as the configured mask ('*'), backspace
+// should erase one mask char, and Enter should return the typed value.
+func TestSecretBaseline_Typing(t *testing.T) {
+	t.Parallel()
+	tm := termtest.NewSecret(t, "Enter password")
+	tm.WaitFor("Enter password")
+	tm.Golden("01-empty")
+
+	tm.Type("hunter2")
+	tm.Golden("02-after-typing")
+
+	tm.Type(termtest.KeyBackspace)
+	tm.Golden("03-after-backspace")
+
+	tm.Type(termtest.KeyEnter)
+
+	v, err := tm.Result()
+	require.NoError(t, err, "raw output: %q", tm.Raw())
+	assert.Equal(t, "hunter", v, "snapshot:\n%s", tm.Snapshot())
+}
diff --git a/libs/cmdio/cmdiotest/secret_ctrl_c_baseline_test.go b/libs/cmdio/cmdiotest/secret_ctrl_c_baseline_test.go
new file mode 100644
index 00000000000..d547df0d77c
--- /dev/null
+++ b/libs/cmdio/cmdiotest/secret_ctrl_c_baseline_test.go
@@ -0,0 +1,28 @@
+package cmdiotest_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestSecretBaseline_CtrlC pins Secret's behavior when the user cancels
+// with Ctrl+C after typing a few characters.
+func TestSecretBaseline_CtrlC(t *testing.T) {
+	t.Parallel()
+	tm := termtest.NewSecret(t, "Personal access token")
+	tm.WaitFor("Personal access token")
+	tm.Golden("01-empty")
+
+	tm.Type("abc")
+	tm.Golden("02-after-typing")
+
+	tm.Type(termtest.KeyCtrlC)
+
+	v, err := tm.Result()
+	require.Error(t, err)
+	assert.EqualError(t, err, "^C")
+	assert.Empty(t, v, "snapshot:\n%s", tm.Snapshot())
+}
diff --git a/libs/cmdio/cmdiotest/secret_empty_enter_baseline_test.go b/libs/cmdio/cmdiotest/secret_empty_enter_baseline_test.go
new file mode 100644
index 00000000000..0e4eeeda4bb
--- /dev/null
+++ b/libs/cmdio/cmdiotest/secret_empty_enter_baseline_test.go
@@ -0,0 +1,24 @@
+package cmdiotest_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestSecretBaseline_EmptyEnter pins Secret's behavior when the user
+// presses Enter immediately without typing anything.
+func TestSecretBaseline_EmptyEnter(t *testing.T) {
+	t.Parallel()
+	tm := termtest.NewSecret(t, "Personal access token")
+	tm.WaitFor("Personal access token")
+	tm.Golden("01-empty")
+
+	tm.Type(termtest.KeyEnter)
+
+	v, err := tm.Result()
+	require.NoError(t, err, "raw output: %q", tm.Raw())
+	assert.Empty(t, v)
+}
diff --git a/libs/cmdio/cmdiotest/select_baseline_arrow_page_nav_test.go b/libs/cmdio/cmdiotest/select_baseline_arrow_page_nav_test.go
new file mode 100644
index 00000000000..4328bb6984f
--- /dev/null
+++ b/libs/cmdio/cmdiotest/select_baseline_arrow_page_nav_test.go
@@ -0,0 +1,46 @@
+package cmdiotest_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestSelectBaseline_ArrowPageNav pins that the right and left arrow
+// keys page through the selection list — the same as Ctrl+F / Ctrl+B
+// (covered by TestSelectBaseline_CtrlFCtrlB). The select model treats
+// both pairs as page-down / page-up rather than item-by-item movement.
+func TestSelectBaseline_ArrowPageNav(t *testing.T) {
+	t.Parallel()
+	items := make([]cmdio.Tuple, 0, 12)
+	for i := 1; i <= 12; i++ {
+		items = append(items, cmdio.Tuple{
+			Name: fmt.Sprintf("item-%02d", i),
+			Id:   fmt.Sprintf("id%02d", i),
+		})
+	}
+
+	tm := termtest.NewSelectOrdered(t, items, "Pick one")
+	tm.WaitFor("Pick one")
+	tm.WaitFor("item-01")
+	tm.Golden("01-initial")
+
+	tm.Type(termtest.KeyRight)
+	tm.Golden("02-after-right")
+
+	tm.Type(termtest.KeyRight)
+	tm.Golden("03-after-right-twice")
+
+	tm.Type(termtest.KeyLeft)
+	tm.Golden("04-after-left")
+
+	tm.Type(termtest.KeyEnter)
+
+	id, err := tm.Result()
+	require.NoError(t, err, "raw output: %q", tm.Raw())
+	assert.Equal(t, "id03", id, "snapshot:\n%s", tm.Snapshot())
+}
diff --git a/libs/cmdio/cmdiotest/select_baseline_ctrl_c_test.go b/libs/cmdio/cmdiotest/select_baseline_ctrl_c_test.go
new file mode 100644
index 00000000000..a9fb6fc9e6a
--- /dev/null
+++ b/libs/cmdio/cmdiotest/select_baseline_ctrl_c_test.go
@@ -0,0 +1,31 @@
+package cmdiotest_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestSelectBaseline_CtrlC pins Select's behavior when the user cancels
+// the prompt with Ctrl+C without making a selection.
+func TestSelectBaseline_CtrlC(t *testing.T) {
+	t.Parallel()
+	tm := termtest.NewSelectOrdered(t, []cmdio.Tuple{
+		{Name: "alpha", Id: "a"},
+		{Name: "beta", Id: "b"},
+		{Name: "gamma", Id: "g"},
+	}, "Pick one")
+	tm.WaitFor("Pick one")
+	tm.WaitFor("alpha")
+	tm.Golden("01-initial")
+
+	tm.Type(termtest.KeyCtrlC)
+
+	id, err := tm.Result()
+	require.Error(t, err)
+	assert.EqualError(t, err, "^C")
+	assert.Empty(t, id)
+}
diff --git a/libs/cmdio/cmdiotest/select_baseline_ctrl_c_with_filter_test.go b/libs/cmdio/cmdiotest/select_baseline_ctrl_c_with_filter_test.go
new file mode 100644
index 00000000000..a1b141aa250
--- /dev/null
+++ b/libs/cmdio/cmdiotest/select_baseline_ctrl_c_with_filter_test.go
@@ -0,0 +1,36 @@
+package cmdiotest_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestSelectBaseline_CtrlCWithFilter pins the cancel path when the search
+// filter is non-empty. Readline interprets Ctrl+C globally as interrupt; a
+// naive replacement could rebind it to "clear input" first and only cancel on
+// the second press. The error sentinel and an empty returned id must match
+// the no-filter case.
+func TestSelectBaseline_CtrlCWithFilter(t *testing.T) {
+	t.Parallel()
+	tm := termtest.NewSelectOrdered(t, []cmdio.Tuple{
+		{Name: "alpha", Id: "a"},
+		{Name: "beta", Id: "b"},
+		{Name: "gamma", Id: "g"},
+	}, "Pick one")
+	tm.WaitFor("Pick one")
+	tm.WaitFor("alpha")
+
+	tm.Type("xyz")
+	tm.Golden("01-no-results-with-filter")
+
+	tm.Type(termtest.KeyCtrlC)
+
+	id, err := tm.Result()
+	require.Error(t, err)
+	assert.EqualError(t, err, "^C")
+	assert.Empty(t, id)
+}
diff --git a/libs/cmdio/cmdiotest/select_baseline_ctrl_f_b_test.go b/libs/cmdio/cmdiotest/select_baseline_ctrl_f_b_test.go
new file mode 100644
index 00000000000..da17f764289
--- /dev/null
+++ b/libs/cmdio/cmdiotest/select_baseline_ctrl_f_b_test.go
@@ -0,0 +1,47 @@
+package cmdiotest_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestSelectBaseline_CtrlFCtrlB pins that Ctrl+F and Ctrl+B page through
+// the selection list — distinct from Ctrl+N / Ctrl+P which move by one
+// item. The list has 12 items against the default 5-row viewport, so a
+// single Ctrl+F should advance the highlighted item by roughly a page
+// rather than a single row, and Ctrl+B should walk it back.
+func TestSelectBaseline_CtrlFCtrlB(t *testing.T) {
+	t.Parallel()
+	items := make([]cmdio.Tuple, 0, 12)
+	for i := 1; i <= 12; i++ {
+		items = append(items, cmdio.Tuple{
+			Name: fmt.Sprintf("item-%02d", i),
+			Id:   fmt.Sprintf("id%02d", i),
+		})
+	}
+
+	tm := termtest.NewSelectOrdered(t, items, "Pick one")
+	tm.WaitFor("Pick one")
+	tm.WaitFor("item-01")
+	tm.Golden("01-initial")
+
+	tm.Type(termtest.KeyCtrlF)
+	tm.Golden("02-after-ctrl-f")
+
+	tm.Type(termtest.KeyCtrlF)
+	tm.Golden("03-after-ctrl-f-twice")
+
+	tm.Type(termtest.KeyCtrlB)
+	tm.Golden("04-after-ctrl-b")
+
+	tm.Type(termtest.KeyEnter)
+
+	id, err := tm.Result()
+	require.NoError(t, err, "raw output: %q", tm.Raw())
+	assert.Equal(t, "id03", id, "snapshot:\n%s", tm.Snapshot())
+}
diff --git a/libs/cmdio/cmdiotest/select_baseline_ctrl_h_test.go b/libs/cmdio/cmdiotest/select_baseline_ctrl_h_test.go
new file mode 100644
index 00000000000..024827c790f
--- /dev/null
+++ b/libs/cmdio/cmdiotest/select_baseline_ctrl_h_test.go
@@ -0,0 +1,40 @@
+package cmdiotest_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestSelectBaseline_CtrlH pins that Ctrl+H deletes the last character
+// from the search filter in [cmdio.Select] — the same as the Backspace
+// key. Ctrl+H sends BS (0x08) and Backspace sends DEL (0x7f); the select
+// model treats both as backspace inside the search buffer, and this test
+// pins that equivalence for the filter editor.
+func TestSelectBaseline_CtrlH(t *testing.T) {
+	t.Parallel()
+	tm := termtest.NewSelectOrdered(t, []cmdio.Tuple{
+		{Name: "alpha", Id: "a"},
+		{Name: "beta", Id: "b"},
+		{Name: "gamma", Id: "g"},
+	}, "Pick one")
+	tm.WaitFor("Pick one")
+	tm.WaitFor("alpha")
+	tm.Golden("01-initial")
+
+	tm.Type("alp")
+	tm.Golden("02-after-typing-alp")
+
+	tm.Type(termtest.KeyCtrlH)
+	tm.Type(termtest.KeyCtrlH)
+	tm.Golden("03-after-ctrl-h-twice")
+
+	tm.Type(termtest.KeyEnter)
+
+	id, err := tm.Result()
+	require.NoError(t, err, "raw output: %q", tm.Raw())
+	assert.Equal(t, "a", id, "snapshot:\n%s", tm.Snapshot())
+}
diff --git a/libs/cmdio/cmdiotest/select_baseline_ctrl_j_test.go b/libs/cmdio/cmdiotest/select_baseline_ctrl_j_test.go
new file mode 100644
index 00000000000..c4ae0533a4b
--- /dev/null
+++ b/libs/cmdio/cmdiotest/select_baseline_ctrl_j_test.go
@@ -0,0 +1,37 @@
+package cmdiotest_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestSelectBaseline_CtrlJ pins that Ctrl+J submits the Select prompt
+// cleanly. Ctrl+J sends LF (0x0a) and Enter sends CR (0x0d); the bubbletea
+// model treats both as submit, so Ctrl+J ends the prompt the same way Enter
+// does. After one KeyDown the highlight is on "b" and that's what gets
+// returned — pin the exact value so a future change can't silently return a
+// different index while still rendering the same screen.
+func TestSelectBaseline_CtrlJ(t *testing.T) {
+	t.Parallel()
+	tm := termtest.NewSelectOrdered(t, []cmdio.Tuple{
+		{Name: "alpha", Id: "a"},
+		{Name: "beta", Id: "b"},
+		{Name: "gamma", Id: "g"},
+	}, "Pick one")
+	tm.WaitFor("Pick one")
+	tm.WaitFor("alpha")
+	tm.Golden("01-initial")
+
+	tm.Type(termtest.KeyDown)
+	tm.Golden("02-after-down")
+
+	tm.Type(termtest.KeyCtrlJ)
+
+	id, err := tm.Result()
+	require.NoError(t, err, "raw output: %q", tm.Raw())
+	assert.Equal(t, "b", id, "snapshot:\n%s", tm.Snapshot())
+}
diff --git a/libs/cmdio/cmdiotest/select_baseline_ctrl_n_p_test.go b/libs/cmdio/cmdiotest/select_baseline_ctrl_n_p_test.go
new file mode 100644
index 00000000000..caa869928f2
--- /dev/null
+++ b/libs/cmdio/cmdiotest/select_baseline_ctrl_n_p_test.go
@@ -0,0 +1,38 @@
+package cmdiotest_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestSelectBaseline_CtrlNCtrlP pins that Ctrl+N and Ctrl+P move the
+// selection down and up by one item — the same as the down and up arrow
+// keys. This test pins that equivalence.
+func TestSelectBaseline_CtrlNCtrlP(t *testing.T) {
+	t.Parallel()
+	tm := termtest.NewSelectOrdered(t, []cmdio.Tuple{
+		{Name: "alpha", Id: "a"},
+		{Name: "beta", Id: "b"},
+		{Name: "gamma", Id: "c"},
+	}, "Pick one")
+	tm.WaitFor("Pick one")
+	tm.WaitFor("alpha")
+	tm.Golden("01-initial")
+
+	tm.Type(termtest.KeyCtrlN)
+	tm.Type(termtest.KeyCtrlN)
+	tm.Golden("02-after-ctrl-n-twice")
+
+	tm.Type(termtest.KeyCtrlP)
+	tm.Golden("03-after-ctrl-p")
+
+	tm.Type(termtest.KeyEnter)
+
+	id, err := tm.Result()
+	require.NoError(t, err, "raw output: %q", tm.Raw())
+	assert.Equal(t, "b", id, "snapshot:\n%s", tm.Snapshot())
+}
diff --git a/libs/cmdio/cmdiotest/select_baseline_default_templates_test.go b/libs/cmdio/cmdiotest/select_baseline_default_templates_test.go
new file mode 100644
index 00000000000..2d2ca0e8032
--- /dev/null
+++ b/libs/cmdio/cmdiotest/select_baseline_default_templates_test.go
@@ -0,0 +1,50 @@
+package cmdiotest_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestSelectBaseline_DefaultTemplates pins the rendering of
+// [cmdio.RunSelect] when no Label / Active / Inactive / Selected
+// template is provided — the model falls back to its built-in defaults,
+// which print {{.}} (Go's default formatting for the item struct rather
+// than any specific field).
+//
+// This mirrors the `databricks selftest tui run-select` plain mode
+// (cmd/selftest/tui/select.go: runSelectPlain) and exists so future
+// changes to the defaults — or accidental loss of a custom template at
+// a call site — produce a visible diff.
+func TestSelectBaseline_DefaultTemplates(t *testing.T) {
+	t.Parallel()
+	// Same data shape as cmd/selftest/tui/fixtures.go buildItems(5).
+	items := []cmdio.Tuple{
+		{Name: "unity-catalog", Id: "id-01"},
+		{Name: "delta-lake", Id: "id-02"},
+		{Name: "delta-sharing", Id: "id-03"},
+		{Name: "photon", Id: "id-04"},
+		{Name: "mlflow", Id: "id-05"},
+	}
+
+	tm := termtest.NewSelect(t, cmdio.SelectOptions{
+		Label: "Pick an item",
+		Items: items,
+	})
+	tm.WaitFor("Pick an item")
+	tm.Golden("01-initial")
+
+	tm.Type(termtest.KeyDown)
+	tm.Golden("02-after-down")
+
+	tm.Type(termtest.KeyEnter)
+
+	idx, err := tm.Result()
+	require.NoError(t, err, "raw output: %q", tm.Raw())
+	assert.Equal(t, 1, idx, "snapshot:\n%s", tm.Snapshot())
+
+	tm.Golden("03-after-enter")
+}
diff --git a/libs/cmdio/cmdiotest/select_baseline_esc_key_test.go b/libs/cmdio/cmdiotest/select_baseline_esc_key_test.go
new file mode 100644
index 00000000000..7504a8ffd95
--- /dev/null
+++ b/libs/cmdio/cmdiotest/select_baseline_esc_key_test.go
@@ -0,0 +1,44 @@
+package cmdiotest_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestSelectBaseline_EscKey pins Select's behavior when the user presses Esc
+// at various states: the initial prompt, and after typing into the search
+// filter. cmdio.Select uses StartInSearchMode: true, so the filter is active
+// from the start.
+func TestSelectBaseline_EscKey(t *testing.T) {
+	t.Parallel()
+	tm := termtest.NewSelectOrdered(t, []cmdio.Tuple{
+		{Name: "alpha", Id: "a"},
+		{Name: "beta", Id: "b"},
+		{Name: "gamma", Id: "g"},
+	}, "Pick one")
+	tm.WaitFor("Pick one")
+	tm.WaitFor("alpha")
+	tm.Golden("01-initial")
+
+	tm.Type(termtest.KeyEsc)
+	tm.Golden("02-esc-from-initial")
+
+	tm.Type("a")
+	tm.Golden("03-after-typing-a")
+
+	tm.Type(termtest.KeyEsc)
+	tm.Golden("04-esc-clears-filter-or-not")
+
+	// Esc is inert in this Select model: it neither finalizes the prompt
+	// nor clears the filter. So the filter is still "a" here, which matches
+	// only "alpha"; Enter submits that match.
+	tm.Type(termtest.KeyEnter)
+
+	id, err := tm.Result()
+	require.NoError(t, err, "raw output: %q", tm.Raw())
+	assert.Equal(t, "a", id, "snapshot:\n%s", tm.Snapshot())
+}
diff --git a/libs/cmdio/cmdiotest/select_baseline_filter_cursor_editing_test.go b/libs/cmdio/cmdiotest/select_baseline_filter_cursor_editing_test.go
new file mode 100644
index 00000000000..2c644b14e80
--- /dev/null
+++ b/libs/cmdio/cmdiotest/select_baseline_filter_cursor_editing_test.go
@@ -0,0 +1,57 @@
+package cmdiotest_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestSelectBaseline_FilterCursorEditing pins how the search filter responds
+// to cursor-editing keys: ←/→, Home/End, Delete, Ctrl+W. The goldens capture
+// which keys actually edit the filter buffer in the current model.
+func TestSelectBaseline_FilterCursorEditing(t *testing.T) {
+	t.Parallel()
+	tm := termtest.NewSelectOrdered(t, []cmdio.Tuple{
+		{Name: "alpha", Id: "a"},
+		{Name: "beta", Id: "b"},
+		{Name: "gamma", Id: "g"},
+		{Name: "delta", Id: "d"},
+		{Name: "epsilon", Id: "e"},
+	}, "Pick one")
+	tm.WaitFor("Pick one")
+	tm.WaitFor("alpha")
+	tm.Golden("01-initial")
+
+	tm.Type("alp")
+	tm.Golden("02-after-typing-alp")
+
+	tm.Type(termtest.KeyLeft)
+	tm.Type(termtest.KeyLeft)
+	tm.Type("X")
+	tm.Golden("03-after-insert-mid")
+
+	tm.Type(termtest.KeyHome)
+	tm.Type("Y")
+	tm.Golden("04-after-insert-at-start")
+
+	tm.Type(termtest.KeyEnd)
+	tm.Type("Z")
+	tm.Golden("05-after-insert-at-end")
+
+	tm.Type(termtest.KeyCtrlU)
+	tm.Golden("06-after-ctrl-u")
+
+	tm.Type("alpha")
+	tm.Type(termtest.KeyCtrlW)
+	tm.Golden("07-after-ctrl-w")
+
+	tm.Type(termtest.KeyCtrlC)
+
+	id, err := tm.Result()
+	require.Error(t, err)
+	assert.EqualError(t, err, "^C")
+	assert.Empty(t, id)
+}
diff --git a/libs/cmdio/cmdiotest/select_baseline_filter_cursor_test.go b/libs/cmdio/cmdiotest/select_baseline_filter_cursor_test.go
new file mode 100644
index 00000000000..2bc59c3e178
--- /dev/null
+++ b/libs/cmdio/cmdiotest/select_baseline_filter_cursor_test.go
@@ -0,0 +1,43 @@
+package cmdiotest_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestSelectBaseline_FilterCursor pins Select's behavior when the user has
+// navigated to a non-first item, then types a filter query. Documents how
+// the cursor moves into and out of filter mode.
+func TestSelectBaseline_FilterCursor(t *testing.T) {
+	t.Parallel()
+	tm := termtest.NewSelectOrdered(t, []cmdio.Tuple{
+		{Name: "alpha", Id: "a"},
+		{Name: "beta", Id: "b"},
+		{Name: "gamma", Id: "g"},
+		{Name: "delta", Id: "d"},
+		{Name: "epsilon", Id: "e"},
+	}, "Pick one")
+	tm.WaitFor("Pick one")
+	tm.WaitFor("alpha")
+	tm.Golden("01-initial")
+
+	tm.Type(termtest.KeyDown)
+	tm.Type(termtest.KeyDown)
+	tm.Golden("02-on-gamma")
+
+	tm.Type("a")
+	tm.Golden("03-after-filter-a")
+
+	tm.Type(termtest.KeyBackspace)
+	tm.Golden("04-after-clear-filter")
+
+	tm.Type(termtest.KeyEnter)
+
+	id, err := tm.Result()
+	require.NoError(t, err, "raw output: %q", tm.Raw())
+	assert.Equal(t, "a", id, "snapshot:\n%s", tm.Snapshot())
+}
diff --git a/libs/cmdio/cmdiotest/select_baseline_filter_no_match_test.go b/libs/cmdio/cmdiotest/select_baseline_filter_no_match_test.go
new file mode 100644
index 00000000000..f1942a2d7ab
--- /dev/null
+++ b/libs/cmdio/cmdiotest/select_baseline_filter_no_match_test.go
@@ -0,0 +1,45 @@
+package cmdiotest_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestSelectBaseline_FilterNoMatch pins Select's behavior when the user
+// types a filter query that matches none of the items, then backspaces it
+// out and hits Enter.
+func TestSelectBaseline_FilterNoMatch(t *testing.T) {
+	t.Parallel()
+	tm := termtest.NewSelectOrdered(t, []cmdio.Tuple{
+		{Name: "alpha", Id: "a"},
+		{Name: "beta", Id: "b"},
+		{Name: "gamma", Id: "g"},
+	}, "Pick one")
+	tm.WaitFor("Pick one")
+	tm.WaitFor("alpha")
+	tm.Golden("01-initial")
+
+	tm.Type("x")
+	tm.Golden("02-after-x")
+
+	tm.Type("y")
+	tm.Golden("03-after-xy")
+
+	tm.Type("z")
+	tm.Golden("04-after-xyz")
+
+	tm.Type(termtest.KeyBackspace)
+	tm.Type(termtest.KeyBackspace)
+	tm.Type(termtest.KeyBackspace)
+	tm.Golden("05-after-backspaces")
+
+	tm.Type(termtest.KeyEnter)
+
+	id, err := tm.Result()
+	require.NoError(t, err, "raw output: %q", tm.Raw())
+	assert.Equal(t, "a", id, "snapshot:\n%s", tm.Snapshot())
+}
diff --git a/libs/cmdio/cmdiotest/select_baseline_filter_scroll_test.go b/libs/cmdio/cmdiotest/select_baseline_filter_scroll_test.go
new file mode 100644
index 00000000000..ce5710ff7bf
--- /dev/null
+++ b/libs/cmdio/cmdiotest/select_baseline_filter_scroll_test.go
@@ -0,0 +1,53 @@
+package cmdiotest_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestSelectBaseline_FilterScroll pins viewport behavior when a filter
+// narrows a long list to a count still larger than the viewport. Combines
+// FilterTyping (substring search) with Scroll (12+ items) — neither test
+// alone exercises the recompute-then-scroll path.
+//
+// 20 items named item-01 .. item-20; the filter "item-1" matches item-01
+// plus item-10..item-19 = 11 items, more than the 5-row viewport.
+func TestSelectBaseline_FilterScroll(t *testing.T) {
+	t.Parallel()
+	items := make([]cmdio.Tuple, 0, 20)
+	for i := 1; i <= 20; i++ {
+		items = append(items, cmdio.Tuple{
+			Name: fmt.Sprintf("item-%02d", i),
+			Id:   fmt.Sprintf("id%02d", i),
+		})
+	}
+
+	tm := termtest.NewSelectOrdered(t, items, "Pick one")
+	tm.WaitFor("Pick one")
+	tm.WaitFor("item-01")
+	tm.Golden("01-initial")
+
+	tm.Type("item-1")
+	tm.Golden("02-filtered-top")
+
+	for range 5 {
+		tm.Type(termtest.KeyDown)
+	}
+	tm.Golden("03-filtered-mid")
+
+	for range 10 {
+		tm.Type(termtest.KeyDown)
+	}
+	tm.Golden("04-filtered-bottom")
+
+	tm.Type(termtest.KeyEnter)
+
+	id, err := tm.Result()
+	require.NoError(t, err, "raw output: %q", tm.Raw())
+	assert.Equal(t, "id19", id, "snapshot:\n%s", tm.Snapshot())
+}
diff --git a/libs/cmdio/cmdiotest/select_baseline_filter_typing_test.go b/libs/cmdio/cmdiotest/select_baseline_filter_typing_test.go
new file mode 100644
index 00000000000..76cbeb9c670
--- /dev/null
+++ b/libs/cmdio/cmdiotest/select_baseline_filter_typing_test.go
@@ -0,0 +1,43 @@
+package cmdiotest_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestSelectBaseline_FilterTyping pins Select's behavior when the user types
+// letters that filter the list. cmdio.Select uses StartInSearchMode: true
+// with a case-insensitive substring searcher on Name, so each keystroke
+// immediately narrows the visible options.
+func TestSelectBaseline_FilterTyping(t *testing.T) {
+	t.Parallel()
+	tm := termtest.NewSelectOrdered(t, []cmdio.Tuple{
+		{Name: "alpha", Id: "a"},
+		{Name: "beta", Id: "b"},
+		{Name: "gamma", Id: "g"},
+		{Name: "delta", Id: "d"},
+		{Name: "epsilon", Id: "e"},
+	}, "Pick one")
+	tm.WaitFor("Pick one")
+	tm.WaitFor("alpha")
+	tm.Golden("01-initial")
+
+	tm.Type("a")
+	tm.Golden("02-after-a")
+
+	tm.Type("l")
+	tm.Golden("03-after-al")
+
+	tm.Type("p")
+	tm.Golden("04-after-alp")
+
+	tm.Type(termtest.KeyEnter)
+
+	id, err := tm.Result()
+	require.NoError(t, err, "raw output: %q", tm.Raw())
+	assert.Equal(t, "a", id, "snapshot:\n%s", tm.Snapshot())
+}
diff --git a/libs/cmdio/cmdiotest/select_baseline_long_descriptions_test.go b/libs/cmdio/cmdiotest/select_baseline_long_descriptions_test.go
new file mode 100644
index 00000000000..4689f78a59c
--- /dev/null
+++ b/libs/cmdio/cmdiotest/select_baseline_long_descriptions_test.go
@@ -0,0 +1,40 @@
+package cmdiotest_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestSelectBaseline_LongDescriptions pins Select's behavior when item Ids
+// are long enough to potentially overflow the terminal width. The active row
+// uses the Tuple template "{{.Name | bold}} ({{.Id|faint}})", so the long Id
+// is only rendered on the active line; non-active rows show only the Name.
+func TestSelectBaseline_LongDescriptions(t *testing.T) {
+	t.Parallel()
+	items := []cmdio.Tuple{
+		{Name: "short", Id: "this-is-a-very-long-resource-identifier-that-exceeds-typical-width-1234567890"},
+		{Name: "medium-length-name", Id: "another-extremely-long-id-string-with-lots-of-content-aaaaaaaaaaaaaaaaaaaaaaaaaaa"},
+		{Name: "x", Id: "yet-another-long-identifier-with-quite-a-bit-of-text-bbbbbbbbbbbbbbbbbbbbbbbbbbb"},
+	}
+
+	tm := termtest.NewSelectOrdered(t, items, "Pick a resource")
+	tm.WaitFor("Pick a resource")
+	tm.WaitFor("short")
+	tm.Golden("01-initial")
+
+	tm.Type(termtest.KeyDown)
+	tm.Golden("02-second-active")
+
+	tm.Type(termtest.KeyDown)
+	tm.Golden("03-third-active")
+
+	tm.Type(termtest.KeyEnter)
+
+	id, err := tm.Result()
+	require.NoError(t, err, "raw output: %q", tm.Raw())
+	assert.Equal(t, items[2].Id, id, "snapshot:\n%s", tm.Snapshot())
+}
diff --git a/libs/cmdio/cmdiotest/select_baseline_scroll_test.go b/libs/cmdio/cmdiotest/select_baseline_scroll_test.go
new file mode 100644
index 00000000000..4c75cdfa76a
--- /dev/null
+++ b/libs/cmdio/cmdiotest/select_baseline_scroll_test.go
@@ -0,0 +1,47 @@
+package cmdiotest_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestSelectBaseline_Scroll pins Select's scrolling behavior for a list
+// larger than the default visible window. It feeds enough KeyDown presses
+// to reach the last item and then keeps pressing past it, so the goldens
+// capture both the bottom-of-list state and the past-bottom state.
+func TestSelectBaseline_Scroll(t *testing.T) {
+	t.Parallel()
+	items := make([]cmdio.Tuple, 0, 12)
+	for i := 1; i <= 12; i++ {
+		items = append(items, cmdio.Tuple{
+			Name: fmt.Sprintf("item-%02d", i),
+			Id:   fmt.Sprintf("id%02d", i),
+		})
+	}
+
+	tm := termtest.NewSelectOrdered(t, items, "Pick one")
+	tm.WaitFor("Pick one")
+	tm.WaitFor("item-01")
+	tm.Golden("01-initial")
+
+	for range 11 {
+		tm.Type(termtest.KeyDown)
+	}
+	tm.Golden("02-bottom")
+
+	for range 5 {
+		tm.Type(termtest.KeyDown)
+	}
+	tm.Golden("03-past-bottom")
+
+	tm.Type(termtest.KeyEnter)
+
+	id, err := tm.Result()
+	require.NoError(t, err, "raw output: %q", tm.Raw())
+	assert.Equal(t, "id12", id, "snapshot:\n%s", tm.Snapshot())
+}
diff --git a/libs/cmdio/cmdiotest/select_baseline_selected_template_test.go b/libs/cmdio/cmdiotest/select_baseline_selected_template_test.go
new file mode 100644
index 00000000000..21970a3e8a1
--- /dev/null
+++ b/libs/cmdio/cmdiotest/select_baseline_selected_template_test.go
@@ -0,0 +1,56 @@
+package cmdiotest_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestSelectBaseline_SelectedTemplate pins the post-Enter rendering of
+// [cmdio.RunSelect] when a non-empty Selected template is provided.
+//
+// cmdio.Select / cmdio.SelectOrdered set HideSelected:true, so the Selected
+// branch is only reachable via RunSelect. Real callers that hit it:
+// cmd/auth/profile_picker.go, libs/databrickscfg/profile/select.go,
+// libs/databrickscfg/cfgpickers/clusters.go. Without this test, breaking the
+// post-submit render or the Selected template behavior goes undetected.
+func TestSelectBaseline_SelectedTemplate(t *testing.T) {
+	t.Parallel()
+	type item struct {
+		Name string
+		Id   string
+	}
+	items := []item{
+		{Name: "alpha", Id: "a"},
+		{Name: "beta", Id: "b"},
+		{Name: "gamma", Id: "c"},
+	}
+
+	tm := termtest.NewSelect(t, cmdio.SelectOptions{
+		Label:    "Pick one",
+		Items:    items,
+		Active:   `> {{ .Name }} ({{ .Id }})`,
+		Inactive: `  {{ .Name }} ({{ .Id }})`,
+		Selected: `Chose: {{ .Name }} ({{ .Id }})`,
+	})
+	tm.WaitFor("Pick one")
+	tm.WaitFor("alpha")
+	tm.Golden("01-initial")
+
+	tm.Type(termtest.KeyDown)
+	tm.Golden("02-after-down")
+
+	tm.Type(termtest.KeyEnter)
+
+	idx, err := tm.Result()
+	require.NoError(t, err, "raw output: %q", tm.Raw())
+	assert.Equal(t, 1, idx, "snapshot:\n%s", tm.Snapshot())
+
+	// Pin the rendered Selected template. This is the only test that asserts
+	// the post-Enter frame; if the Selected template stops rendering, or the
+	// trailing newline / cursor handling changes, this golden catches it.
+	tm.Golden("03-after-enter")
+}
diff --git a/libs/cmdio/cmdiotest/select_baseline_single_item_test.go b/libs/cmdio/cmdiotest/select_baseline_single_item_test.go
new file mode 100644
index 00000000000..51c6517121f
--- /dev/null
+++ b/libs/cmdio/cmdiotest/select_baseline_single_item_test.go
@@ -0,0 +1,32 @@
+package cmdiotest_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestSelectBaseline_SingleItem pins Select's behavior when the input list
+// contains exactly one entry: whether a prompt renders, what KeyDown does
+// (no-op), and what id Enter returns.
+func TestSelectBaseline_SingleItem(t *testing.T) {
+	t.Parallel()
+	tm := termtest.NewSelectOrdered(t, []cmdio.Tuple{
+		{Name: "only", Id: "o"},
+	}, "Pick one")
+	tm.WaitFor("Pick one")
+	tm.WaitFor("only")
+	tm.Golden("01-initial")
+
+	tm.Type(termtest.KeyDown)
+	tm.Golden("02-after-down")
+
+	tm.Type(termtest.KeyEnter)
+
+	id, err := tm.Result()
+	require.NoError(t, err, "raw output: %q", tm.Raw())
+	assert.Equal(t, "o", id, "snapshot:\n%s", tm.Snapshot())
+}
diff --git a/libs/cmdio/cmdiotest/select_baseline_slash_enters_search_test.go b/libs/cmdio/cmdiotest/select_baseline_slash_enters_search_test.go
new file mode 100644
index 00000000000..f4b07015a03
--- /dev/null
+++ b/libs/cmdio/cmdiotest/select_baseline_slash_enters_search_test.go
@@ -0,0 +1,58 @@
+package cmdiotest_test
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestSelectBaseline_SlashEntersSearch pins that pressing "/" toggles a
+// non-search-mode select prompt into search mode. The existing filter
+// tests all use cmdio.SelectOrdered (which sets StartInSearchMode=true)
+// so the toggle path is never exercised. Real callers that depend on it:
+// cmd/auth/resolve.go and cmd/auth/profile_picker.go set
+// StartInSearchMode based on len(items) > 5, so for small lists the
+// only way to filter is to press "/".
+func TestSelectBaseline_SlashEntersSearch(t *testing.T) {
+	t.Parallel()
+	type item struct {
+		Name string
+		Id   string
+	}
+	items := []item{
+		{Name: "alpha", Id: "a"},
+		{Name: "beta", Id: "b"},
+		{Name: "gamma", Id: "c"},
+	}
+
+	tm := termtest.NewSelect(t, cmdio.SelectOptions{
+		Label: "Pick one",
+		Items: items,
+		Searcher: func(input string, idx int) bool {
+			return strings.Contains(strings.ToLower(items[idx].Name), strings.ToLower(input))
+		},
+		Active:   `> {{ .Name }} ({{ .Id }})`,
+		Inactive: `  {{ .Name }} ({{ .Id }})`,
+	})
+	tm.WaitFor("Pick one")
+	tm.WaitFor("alpha")
+	tm.Golden("01-initial-no-search")
+
+	// Slash toggles into search mode: a "Search:" line appears and
+	// subsequent characters become the filter query.
+	tm.Type("/")
+	tm.Golden("02-after-slash")
+
+	tm.Type("b")
+	tm.Golden("03-filtering-b")
+
+	tm.Type(termtest.KeyEnter)
+
+	idx, err := tm.Result()
+	require.NoError(t, err, "raw output: %q", tm.Raw())
+	assert.Equal(t, 1, idx, "expected to land on beta; snapshot:\n%s", tm.Snapshot())
+}
diff --git a/libs/cmdio/cmdiotest/select_baseline_tab_key_test.go b/libs/cmdio/cmdiotest/select_baseline_tab_key_test.go
new file mode 100644
index 00000000000..9176fe5ffb1
--- /dev/null
+++ b/libs/cmdio/cmdiotest/select_baseline_tab_key_test.go
@@ -0,0 +1,43 @@
+package cmdiotest_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestSelectBaseline_TabKey pins Select's behavior when the user presses
+// Tab. Tab is a common navigation key but in search-mode Select it gets
+// typed into the filter; this test records that, plus how Enter behaves
+// after the filter has no matches.
+func TestSelectBaseline_TabKey(t *testing.T) {
+	t.Parallel()
+	tm := termtest.NewSelectOrdered(t, []cmdio.Tuple{
+		{Name: "alpha", Id: "a"},
+		{Name: "beta", Id: "b"},
+		{Name: "gamma", Id: "g"},
+	}, "Pick one")
+	tm.WaitFor("Pick one")
+	tm.WaitFor("alpha")
+	tm.Golden("01-initial")
+
+	tm.Type(termtest.KeyTab)
+	tm.Golden("02-after-tab")
+
+	tm.Type(termtest.KeyTab)
+	tm.Golden("03-after-second-tab")
+
+	// Enter does not terminate the prompt: in search mode with no matching
+	// items (the two Tab keystrokes typed two tab characters into the
+	// filter), the model treats Enter as inert. Ctrl+C cancels cleanly.
+	tm.Type(termtest.KeyEnter)
+	tm.Type(termtest.KeyCtrlC)
+
+	id, err := tm.Result()
+	require.Error(t, err)
+	assert.EqualError(t, err, "^C")
+	assert.Empty(t, id)
+}
diff --git a/libs/cmdio/cmdiotest/select_baseline_test.go b/libs/cmdio/cmdiotest/select_baseline_test.go
new file mode 100644
index 00000000000..ef09bd52ae4
--- /dev/null
+++ b/libs/cmdio/cmdiotest/select_baseline_test.go
@@ -0,0 +1,34 @@
+package cmdiotest_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestSelectBaseline_DownEnter pins Select's rendering end-to-end: the
+// termtest emulator captures the rendered screen and we assert on the chosen
+// item plus a snapshot of the prompt and visible options.
+func TestSelectBaseline_DownEnter(t *testing.T) {
+	t.Parallel()
+	tm := termtest.NewSelectOrdered(t, []cmdio.Tuple{
+		{Name: "alpha", Id: "a"},
+		{Name: "beta", Id: "b"},
+		{Name: "gamma", Id: "c"},
+	}, "Pick one")
+	tm.WaitFor("Pick one")
+	tm.WaitFor("alpha")
+	tm.Golden("01-initial")
+
+	tm.Type(termtest.KeyDown)
+	tm.Golden("02-after-down")
+
+	tm.Type(termtest.KeyEnter)
+
+	id, err := tm.Result()
+	require.NoError(t, err, "raw output: %q", tm.Raw())
+	assert.Equal(t, "b", id, "snapshot:\n%s", tm.Snapshot())
+}
diff --git a/libs/cmdio/cmdiotest/select_baseline_vim_keys_test.go b/libs/cmdio/cmdiotest/select_baseline_vim_keys_test.go
new file mode 100644
index 00000000000..18d29392350
--- /dev/null
+++ b/libs/cmdio/cmdiotest/select_baseline_vim_keys_test.go
@@ -0,0 +1,42 @@
+package cmdiotest_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestSelectBaseline_VimKeys pins how Select reacts to vim-style 'j' and 'k'
+// keys. cmdio.SelectOrdered runs with StartInSearchMode: true, so letters
+// flow into the filter rather than acting as navigation.
+func TestSelectBaseline_VimKeys(t *testing.T) {
+	t.Parallel()
+	tm := termtest.NewSelectOrdered(t, []cmdio.Tuple{
+		{Name: "alpha", Id: "a"},
+		{Name: "beta", Id: "b"},
+		{Name: "gamma", Id: "g"},
+		{Name: "delta", Id: "d"},
+	}, "Pick one")
+	tm.WaitFor("Pick one")
+	tm.WaitFor("alpha")
+	tm.Golden("01-initial")
+
+	tm.Type("j")
+	tm.Golden("02-after-j")
+
+	tm.Type("k")
+	tm.Golden("03-after-jk")
+
+	tm.Type(termtest.KeyBackspace)
+	tm.Type(termtest.KeyBackspace)
+	tm.Golden("04-after-backspaces")
+
+	tm.Type(termtest.KeyEnter)
+
+	id, err := tm.Result()
+	require.NoError(t, err, "raw output: %q", tm.Raw())
+	assert.Equal(t, "a", id, "snapshot:\n%s", tm.Snapshot())
+}
diff --git a/libs/cmdio/cmdiotest/select_baseline_vim_nav_outside_search_test.go b/libs/cmdio/cmdiotest/select_baseline_vim_nav_outside_search_test.go
new file mode 100644
index 00000000000..c9a5f165684
--- /dev/null
+++ b/libs/cmdio/cmdiotest/select_baseline_vim_nav_outside_search_test.go
@@ -0,0 +1,69 @@
+package cmdiotest_test
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestSelectBaseline_VimNavOutsideSearch pins Select's vim-style navigation
+// when the prompt opens outside search mode. With StartInSearchMode=false,
+// j/k move the highlighted item by one and h/l page through the list; with
+// search mode enabled (the default in cmdio.SelectOrdered) those letters
+// would flow into the filter instead. Real callers that hit this branch:
+// cmd/auth/resolve.go and cmd/auth/profile_picker.go both set
+// StartInSearchMode based on len(items) > 5, so small lists open outside
+// search mode.
+func TestSelectBaseline_VimNavOutsideSearch(t *testing.T) {
+	t.Parallel()
+	type item struct {
+		Name string
+		Id   string
+	}
+	items := make([]item, 0, 12)
+	for i := 1; i <= 12; i++ {
+		items = append(items, item{
+			Name: fmt.Sprintf("item-%02d", i),
+			Id:   fmt.Sprintf("id%02d", i),
+		})
+	}
+
+	tm := termtest.NewSelect(t, cmdio.SelectOptions{
+		Label: "Pick one",
+		Items: items,
+		// StartInSearchMode defaults to false; setting a Searcher
+		// makes the / key toggle search mode but does not auto-enter.
+		Searcher: func(input string, idx int) bool {
+			return strings.Contains(strings.ToLower(items[idx].Name), strings.ToLower(input))
+		},
+		Active:   `> {{ .Name }} ({{ .Id }})`,
+		Inactive: `  {{ .Name }} ({{ .Id }})`,
+	})
+	tm.WaitFor("Pick one")
+	tm.WaitFor("item-01")
+	tm.Golden("01-initial")
+
+	tm.Type("j")
+	tm.Type("j")
+	tm.Golden("02-after-jj")
+
+	tm.Type("k")
+	tm.Golden("03-after-k")
+
+	tm.Type("l")
+	tm.Golden("04-after-l-pagedown")
+
+	tm.Type("h")
+	tm.Golden("05-after-h-pageup")
+
+	tm.Type(termtest.KeyEnter)
+
+	idx, err := tm.Result()
+	require.NoError(t, err, "raw output: %q", tm.Raw())
+	assert.Equal(t, 0, idx, "snapshot:\n%s", tm.Snapshot())
+}
diff --git a/libs/cmdio/cmdiotest/select_baseline_wrap_around_test.go b/libs/cmdio/cmdiotest/select_baseline_wrap_around_test.go
new file mode 100644
index 00000000000..b5e771f33aa
--- /dev/null
+++ b/libs/cmdio/cmdiotest/select_baseline_wrap_around_test.go
@@ -0,0 +1,42 @@
+package cmdiotest_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/cmdio/cmdiotest/termtest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestSelectBaseline_WrapAround pins Select's behavior at the list edges:
+// pressing Up on the first item and Down past the last item.
+func TestSelectBaseline_WrapAround(t *testing.T) {
+	t.Parallel()
+	tm := termtest.NewSelectOrdered(t, []cmdio.Tuple{
+		{Name: "alpha", Id: "a"},
+		{Name: "beta", Id: "b"},
+		{Name: "gamma", Id: "g"},
+	}, "Pick one")
+	tm.WaitFor("Pick one")
+	tm.WaitFor("alpha")
+	tm.Golden("01-initial")
+
+	// Up from the top: does the model wrap to the last item, pin to alpha,
+	// or do nothing visible?
+	tm.Type(termtest.KeyUp)
+	tm.Golden("02-up-from-top")
+
+	// Five Downs: with three items, this overshoots the bottom by two,
+	// exposing whether Down wraps, pins, or beeps past the last item.
+	for range 5 {
+		tm.Type(termtest.KeyDown)
+	}
+	tm.Golden("03-down-past-bottom")
+
+	tm.Type(termtest.KeyEnter)
+
+	id, err := tm.Result()
+	require.NoError(t, err, "raw output: %q", tm.Raw())
+	assert.Equal(t, "g", id, "snapshot:\n%s", tm.Snapshot())
+}
diff --git a/libs/cmdio/cmdiotest/select_no_prompt_support_test.go b/libs/cmdio/cmdiotest/select_no_prompt_support_test.go
new file mode 100644
index 00000000000..0f7e18bf803
--- /dev/null
+++ b/libs/cmdio/cmdiotest/select_no_prompt_support_test.go
@@ -0,0 +1,29 @@
+package cmdiotest_test
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestSelect_NoPromptSupport pins the early-error path: when the cmdIO can't
+// prompt (non-TTY streams, no DATABRICKS_OUTPUT_FORMAT override),
+// cmdio.SelectOrdered returns "expected to have <label>" without drawing any
+// UI. This is the path CI and other non-interactive callers hit.
+func TestSelect_NoPromptSupport(t *testing.T) {
+	t.Parallel()
+	ctx := t.Context()
+	var buf bytes.Buffer
+	io := cmdio.NewIO(ctx, flags.OutputText, &bytes.Buffer{}, &buf, &buf, "", "")
+	ctx = cmdio.InContext(ctx, io)
+
+	id, err := cmdio.SelectOrdered(ctx, []cmdio.Tuple{{Name: "alpha", Id: "a"}}, "a workspace")
+	require.Error(t, err)
+	assert.Empty(t, id)
+	assert.EqualError(t, err, "expected to have a workspace")
+	assert.Empty(t, buf.String(), "no UI should render without prompt support")
+}
diff --git a/libs/cmdio/cmdiotest/termtest/emulator.go b/libs/cmdio/cmdiotest/termtest/emulator.go
new file mode 100644
index 00000000000..1072ff6e691
--- /dev/null
+++ b/libs/cmdio/cmdiotest/termtest/emulator.go
@@ -0,0 +1,220 @@
+package termtest
+
+import (
+	"strings"
+
+	"github.com/charmbracelet/x/ansi"
+)
+
+// emulator is a tiny VT-style terminal emulator. It exists to render the
+// byte stream bubbletea writes to its output into a 2D screen of plain text
+// so tests can match against `screen text` goldens.
+//
+// Scope is deliberately narrow: bubbletea's stock renderer (which is what
+// the cmdio prompt/select models run through) emits a small subset of CSI
+// sequences — cursor moves, erase-line, set/reset-mode for cursor
+// visibility — plus printable runes, CR, LF, and BS. SGR styling, alt-screen
+// switches, scroll regions, charsets, OSC, DCS, and friends are recognised
+// by the underlying ansi parser but intentionally ignored: they do not
+// affect cell text.
+type emulator struct {
+	width, height int
+	grid          [][]rune
+	row, col      int
+
+	// Saved cursor (DECSC/DECRC; ESC 7 / ESC 8).
+	savedRow, savedCol int
+
+	parser *ansi.Parser
+}
+
+func newEmulator(width, height int) *emulator {
+	e := &emulator{width: width, height: height}
+	e.reset()
+	e.parser = ansi.NewParser()
+	e.parser.SetHandler(ansi.Handler{
+		Print:     e.handlePrint,
+		Execute:   e.handleControl,
+		HandleCsi: e.handleCsi,
+		HandleEsc: e.handleEsc,
+	})
+	return e
+}
+
+// reset clears the screen and homes the cursor.
+func (e *emulator) reset() {
+	e.grid = make([][]rune, e.height)
+	for i := range e.grid {
+		e.grid[i] = make([]rune, e.width)
+		for j := range e.grid[i] {
+			e.grid[i][j] = ' '
+		}
+	}
+	e.row, e.col = 0, 0
+	e.savedRow, e.savedCol = 0, 0
+}
+
+// Write feeds bytes into the parser.
+func (e *emulator) Write(p []byte) (int, error) {
+	e.parser.Parse(p)
+	return len(p), nil
+}
+
+// String returns the screen contents, joined with "\n".
+func (e *emulator) String() string {
+	var b strings.Builder
+	for i, line := range e.grid {
+		if i > 0 {
+			b.WriteByte('\n')
+		}
+		b.WriteString(string(line))
+	}
+	return b.String()
+}
+
+// handlePrint writes a printable rune at the cursor and advances. Off-screen
+// writes are dropped (no scroll, no wrap — the prompts we render fit easily
+// inside 120x40, which is what termtest.New configures).
+func (e *emulator) handlePrint(r rune) {
+	if e.col >= e.width {
+		// At the right margin: drop the rune rather than wrapping. Real
+		// terminals would wrap; the prompts we test never reach the edge.
+		return
+	}
+	if e.inBounds() {
+		e.grid[e.row][e.col] = r
+	}
+	e.col++
+}
+
+// handleControl handles C0 control characters: BS, HT, LF, CR.
+func (e *emulator) handleControl(b byte) {
+	switch b {
+	case 0x08: // BS
+		if e.col > 0 {
+			e.col--
+		}
+	case 0x09: // HT: next tab stop (every 8 columns).
+		stop := ((e.col / 8) + 1) * 8
+		e.col = min(stop, e.width-1)
+	case 0x0a: // LF: move down one line, no scroll.
+		if e.row+1 < e.height {
+			e.row++
+		}
+	case 0x0d: // CR: start of line.
+		e.col = 0
+	}
+}
+
+// handleCsi handles the CSI sequences emitted by bubbletea's renderer.
+// Only commands that affect cell positions or contents matter. SGR (colors,
+// 'm') and DEC private modes ('h'/'l' with '?' prefix) are no-ops.
+func (e *emulator) handleCsi(cmd ansi.Cmd, params ansi.Params) {
+	n, _, _ := params.Param(0, 1)
+	switch cmd.Final() {
+	case 'A': // CUU: cursor up
+		e.row = max(e.row-n, 0)
+	case 'B', 'e': // CUD / VPR: cursor down
+		e.row = min(e.row+n, e.height-1)
+	case 'C', 'a': // CUF / HPR: cursor forward
+		e.col = min(e.col+n, e.width-1)
+	case 'D': // CUB: cursor back
+		e.col = max(e.col-n, 0)
+	case 'E': // CNL: next line
+		e.row = min(e.row+n, e.height-1)
+		e.col = 0
+	case 'F': // CPL: previous line
+		e.row = max(e.row-n, 0)
+		e.col = 0
+	case 'G', '`': // CHA / HPA: cursor to column n (1-based)
+		e.col = clamp(n-1, 0, e.width-1)
+	case 'd': // VPA: cursor to row n (1-based)
+		e.row = clamp(n-1, 0, e.height-1)
+	case 'H', 'f': // CUP / HVP: cursor position (row;col, 1-based)
+		row, _, _ := params.Param(0, 1)
+		col, _, _ := params.Param(1, 1)
+		e.row = clamp(row-1, 0, e.height-1)
+		e.col = clamp(col-1, 0, e.width-1)
+	case 'J': // ED: erase in display
+		n, _, _ := params.Param(0, 0)
+		e.eraseDisplay(n)
+	case 'K': // EL: erase in line
+		n, _, _ := params.Param(0, 0)
+		e.eraseLine(n)
+	case 's': // SCO save cursor
+		e.savedRow, e.savedCol = e.row, e.col
+	case 'u': // SCO restore cursor
+		e.row, e.col = e.savedRow, e.savedCol
+		// All other CSI commands (SGR 'm', mode set/reset 'h'/'l', cursor
+		// show/hide '?25h/l', etc.) are no-ops for cell text.
+	}
+}
+
+// handleEsc handles ESC sequences: only the C1-equivalent cursor save/restore
+// (ESC 7 / ESC 8) matter for cell positions.
+func (e *emulator) handleEsc(cmd ansi.Cmd) {
+	switch cmd.Final() {
+	case '7': // DECSC: save cursor
+		e.savedRow, e.savedCol = e.row, e.col
+	case '8': // DECRC: restore cursor
+		e.row, e.col = e.savedRow, e.savedCol
+	}
+}
+
+// eraseLine implements CSI K with parameter n: 0 = to end, 1 = from start,
+// 2 = whole line.
+func (e *emulator) eraseLine(n int) {
+	if !e.inBounds() {
+		return
+	}
+	line := e.grid[e.row]
+	switch n {
+	case 0:
+		for i := e.col; i < e.width; i++ {
+			line[i] = ' '
+		}
+	case 1:
+		for i := 0; i <= e.col && i < e.width; i++ {
+			line[i] = ' '
+		}
+	case 2:
+		for i := range line {
+			line[i] = ' '
+		}
+	}
+}
+
+// eraseDisplay implements CSI J with parameter n: 0 = to end of screen,
+// 1 = from start, 2 = whole screen.
+func (e *emulator) eraseDisplay(n int) {
+	switch n {
+	case 0:
+		e.eraseLine(0)
+		for r := e.row + 1; r < e.height; r++ {
+			for c := range e.grid[r] {
+				e.grid[r][c] = ' '
+			}
+		}
+	case 1:
+		for r := range e.row {
+			for c := range e.grid[r] {
+				e.grid[r][c] = ' '
+			}
+		}
+		e.eraseLine(1)
+	case 2, 3:
+		for r := range e.grid {
+			for c := range e.grid[r] {
+				e.grid[r][c] = ' '
+			}
+		}
+	}
+}
+
+func (e *emulator) inBounds() bool {
+	return e.row >= 0 && e.row < e.height && e.col >= 0 && e.col < e.width
+}
+
+func clamp(v, lo, hi int) int {
+	return min(max(v, lo), hi)
+}
diff --git a/libs/cmdio/cmdiotest/termtest/emulator_test.go b/libs/cmdio/cmdiotest/termtest/emulator_test.go
new file mode 100644
index 00000000000..93f7464dda5
--- /dev/null
+++ b/libs/cmdio/cmdiotest/termtest/emulator_test.go
@@ -0,0 +1,340 @@
+package termtest
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// testCols and testRows match a classic VT100 default. The emulator's
+// behavior at margins, after wraps, and around screen-clearing should be
+// independent of the exact dimensions; tests bake these in so failures
+// point at the same coordinates every run.
+const (
+	testCols = 80
+	testRows = 25
+)
+
+// blankLine is testCols spaces — the trimmed equivalent of an empty row.
+var blankLine = strings.Repeat(" ", testCols)
+
+// run constructs a fresh 80x25 emulator, feeds it the byte stream, and
+// returns it. Tests then assert on e.String(), e.row, e.col, etc.
+func feed(input string) *emulator {
+	e := newEmulator(testCols, testRows)
+	_, _ = e.Write([]byte(input))
+	return e
+}
+
+// line returns the i-th row of e.String() with trailing spaces stripped, so
+// tests can use short expected strings.
+func line(e *emulator, i int) string {
+	rows := strings.Split(e.String(), "\n")
+	return strings.TrimRight(rows[i], " ")
+}
+
+// pos asserts the cursor sits at (row, col).
+func pos(t *testing.T, e *emulator, row, col int) {
+	t.Helper()
+	assert.Equal(t, row, e.row, "row")
+	assert.Equal(t, col, e.col, "col")
+}
+
+func TestEmulator_PrintPlain(t *testing.T) {
+	e := feed("hello")
+	assert.Equal(t, "hello", line(e, 0))
+	pos(t, e, 0, 5)
+}
+
+func TestEmulator_PrintUTF8(t *testing.T) {
+	e := feed("café✔█")
+	// café is 4 runes, ✔ and █ are each 1 rune; 6 cells total.
+	assert.Equal(t, "café✔█", line(e, 0))
+	pos(t, e, 0, 6)
+}
+
+func TestEmulator_PrintDropsAtRightMargin(t *testing.T) {
+	// Fill the row exactly to width, then one more rune that should be
+	// dropped (the emulator deliberately does not wrap; prompts we render
+	// fit easily inside 80x25).
+	in := strings.Repeat("x", testCols) + "Y"
+	e := feed(in)
+	assert.Equal(t, strings.Repeat("x", testCols), line(e, 0))
+	// Cursor sits past the right margin but didn't wrap.
+	assert.Equal(t, testCols, e.col)
+	assert.Equal(t, 0, e.row)
+}
+
+func TestEmulator_Backspace(t *testing.T) {
+	e := feed("abc\b")
+	pos(t, e, 0, 2)
+	// Backspace doesn't erase — the rune at col 2 ('c') is still there.
+	assert.Equal(t, "abc", line(e, 0))
+}
+
+func TestEmulator_BackspaceAtCol0IsNoop(t *testing.T) {
+	e := feed("\b")
+	pos(t, e, 0, 0)
+}
+
+func TestEmulator_TabAdvancesToNextEighthColumn(t *testing.T) {
+	cases := []struct {
+		col      int
+		expected int
+	}{
+		{0, 8},
+		{1, 8},
+		{7, 8},
+		{8, 16},
+		{9, 16},
+		{63, 64},
+		{64, 72},
+		{72, testCols - 1}, // clamped: stop would be 80, the last valid col is 79
+		{testCols - 1, testCols - 1},
+	}
+	for _, tc := range cases {
+		e := newEmulator(testCols, testRows)
+		e.col = tc.col
+		_, _ = e.Write([]byte{0x09})
+		assert.Equal(t, tc.expected, e.col, "from col %d", tc.col)
+	}
+}
+
+func TestEmulator_LineFeed(t *testing.T) {
+	e := feed("ab\ncd")
+	// LF moves down one line; it does not return to col 0.
+	assert.Equal(t, "ab", line(e, 0))
+	assert.Equal(t, "  cd", line(e, 1))
+	pos(t, e, 1, 4)
+}
+
+func TestEmulator_LineFeedDoesNotScroll(t *testing.T) {
+	// Park at the bottom row and try to LF off the end.
+	e := newEmulator(testCols, testRows)
+	e.row = testRows - 1
+	_, _ = e.Write([]byte{0x0a})
+	pos(t, e, testRows-1, 0) // stays at last row
+}
+
+func TestEmulator_CarriageReturn(t *testing.T) {
+	e := feed("hello\rWORLD")
+	assert.Equal(t, "WORLD", line(e, 0))
+	pos(t, e, 0, 5)
+}
+
+func TestEmulator_CRLFThenPrint(t *testing.T) {
+	e := feed("line1\r\nline2")
+	assert.Equal(t, "line1", line(e, 0))
+	assert.Equal(t, "line2", line(e, 1))
+	pos(t, e, 1, 5)
+}
+
+func TestEmulator_CursorUp(t *testing.T) {
+	// CUU only changes the row; the column is preserved.
+	e := feed("a\r\nb\r\nc\x1b[2A")
+	pos(t, e, 0, 1)
+}
+
+func TestEmulator_CursorUpClampsAtTop(t *testing.T) {
+	e := feed("\x1b[99A")
+	pos(t, e, 0, 0)
+}
+
+func TestEmulator_CursorDownAndVPR(t *testing.T) {
+	for _, final := range []byte{'B', 'e'} {
+		e := feed("\x1b[3" + string(final))
+		pos(t, e, 3, 0)
+	}
+}
+
+func TestEmulator_CursorDownClampsAtBottom(t *testing.T) {
+	e := feed("\x1b[99B")
+	pos(t, e, testRows-1, 0)
+}
+
+func TestEmulator_CursorForwardAndHPR(t *testing.T) {
+	for _, final := range []byte{'C', 'a'} {
+		e := feed("\x1b[5" + string(final))
+		pos(t, e, 0, 5)
+	}
+}
+
+func TestEmulator_CursorBack(t *testing.T) {
+	e := feed("hello\x1b[3D")
+	pos(t, e, 0, 2)
+}
+
+func TestEmulator_CursorNextLine(t *testing.T) {
+	e := feed("hello\x1b[1E")
+	pos(t, e, 1, 0) // CNL is down + col 0
+}
+
+func TestEmulator_CursorPreviousLine(t *testing.T) {
+	e := feed("\n\nx\x1b[2F")
+	pos(t, e, 0, 0)
+}
+
+func TestEmulator_CursorToColumn(t *testing.T) {
+	// CHA 'G' and HPA '`' are equivalent.
+	for _, final := range []byte{'G', '`'} {
+		e := feed("hello\x1b[3" + string(final))
+		pos(t, e, 0, 2) // 1-based: col 3 → index 2
+	}
+}
+
+func TestEmulator_CursorToColumnDefaultsToOne(t *testing.T) {
+	e := feed("hello\x1b[G")
+	pos(t, e, 0, 0)
+}
+
+func TestEmulator_CursorToRow(t *testing.T) {
+	e := feed("\x1b[5d")
+	pos(t, e, 4, 0) // 1-based
+}
+
+func TestEmulator_CursorPosition(t *testing.T) {
+	cases := []struct {
+		seq string
+		row int
+		col int
+	}{
+		{"\x1b[H", 0, 0},     // default to (1,1)
+		{"\x1b[5;10H", 4, 9}, // 1-based input → 0-based indices
+		{"\x1b[5;10f", 4, 9}, // HVP, same semantics
+	}
+	for _, tc := range cases {
+		e := feed(tc.seq)
+		assert.Equal(t, tc.row, e.row, "row for %q", tc.seq)
+		assert.Equal(t, tc.col, e.col, "col for %q", tc.seq)
+	}
+}
+
+func TestEmulator_CursorPositionClamps(t *testing.T) {
+	// Way out of bounds — should clamp to (height-1, width-1).
+	e := feed("\x1b[999;999H")
+	pos(t, e, testRows-1, testCols-1)
+}
+
+func TestEmulator_EraseLineToEnd(t *testing.T) {
+	e := feed("hello world\x1b[7G\x1b[0K")
+	// Cursor moves to col 7 (1-based) = index 6. EL 0 wipes from col 6 to
+	// end of line.
+	assert.Equal(t, "hello", line(e, 0)) // 'w' at index 6 is gone
+}
+
+func TestEmulator_EraseLineFromStart(t *testing.T) {
+	e := feed("hello world\x1b[7G\x1b[1K")
+	// Cursor at col 7 (1-based) = index 6, where 'w' sits. EL 1 wipes
+	// columns 0..6 inclusive, taking 'w' with it. Result: 7 spaces, then
+	// "orld".
+	assert.Equal(t, "       orld", line(e, 0))
+}
+
+func TestEmulator_EraseLineWhole(t *testing.T) {
+	e := feed("hello\x1b[2K")
+	assert.Empty(t, line(e, 0))
+}
+
+func TestEmulator_EraseLineDefaultsToZero(t *testing.T) {
+	// CSI K with no arg behaves like CSI 0 K.
+	e := feed("hello\x1b[3G\x1b[K")
+	assert.Equal(t, "he", line(e, 0))
+}
+
+func TestEmulator_EraseDisplayToEnd(t *testing.T) {
+	// CR-LF resets col so each row starts at col 0; otherwise LF alone
+	// would carry the cursor column from the previous line.
+	e := feed("aaa\r\nbbb\r\nccc\x1b[2;2H\x1b[0J")
+	// Cursor at (1,1) inside "bbb"; ED 0 clears (1,1) → end. Row 0 intact,
+	// row 1 keeps the first char, rows 2+ blank.
+	assert.Equal(t, "aaa", line(e, 0))
+	assert.Equal(t, "b", line(e, 1))
+	assert.Empty(t, line(e, 2))
+}
+
+func TestEmulator_EraseDisplayFromStart(t *testing.T) {
+	e := feed("aaa\r\nbbb\r\nccc\x1b[2;2H\x1b[1J")
+	// Cursor at (1,1). ED 1 clears start → (1,1). Row 0 blank, row 1 has
+	// space at cols 0..1 and 'b' at col 2, row 2 intact.
+	assert.Empty(t, line(e, 0))
+	assert.Equal(t, "  b", line(e, 1))
+	assert.Equal(t, "ccc", line(e, 2))
+}
+
+func TestEmulator_EraseDisplayWhole(t *testing.T) {
+	for _, n := range []string{"2", "3"} {
+		e := feed("aaa\nbbb\x1b[" + n + "J")
+		assert.Empty(t, line(e, 0))
+		assert.Empty(t, line(e, 1))
+	}
+}
+
+func TestEmulator_SaveAndRestoreCursorSCO(t *testing.T) {
+	// CSI s saves; CSI u restores. Cursor moves in between, restore brings
+	// it back.
+	e := feed("\x1b[5;10H\x1b[s\x1b[1;1H\x1b[u")
+	pos(t, e, 4, 9)
+}
+
+func TestEmulator_SaveAndRestoreCursorDEC(t *testing.T) {
+	// ESC 7 saves; ESC 8 restores.
+	e := feed("\x1b[5;10H\x1b7\x1b[1;1H\x1b8")
+	pos(t, e, 4, 9)
+}
+
+func TestEmulator_RestoreWithoutSaveGoesToOrigin(t *testing.T) {
+	// savedRow/savedCol default to 0,0 — restore on a fresh emulator parks
+	// at the origin.
+	e := feed("\x1b[5;10H\x1b[u")
+	pos(t, e, 0, 0)
+}
+
+func TestEmulator_SGRIsIgnored(t *testing.T) {
+	// Color and style codes must not move the cursor or write cells.
+	e := feed("\x1b[1;31;42mhello\x1b[0m")
+	assert.Equal(t, "hello", line(e, 0))
+	pos(t, e, 0, 5)
+}
+
+func TestEmulator_DECPrivateModesAreIgnored(t *testing.T) {
+	// Show/hide cursor, bracketed paste, mouse modes — all no-ops here.
+	e := feed("\x1b[?25l\x1b[?2004hhello\x1b[?2004l\x1b[?25h")
+	assert.Equal(t, "hello", line(e, 0))
+	pos(t, e, 0, 5)
+}
+
+func TestEmulator_OSCIsIgnored(t *testing.T) {
+	// OSC 0 (set window title) terminated by BEL — must not corrupt the
+	// screen or the cursor.
+	e := feed("\x1b]0;title\x07after")
+	assert.Equal(t, "after", line(e, 0))
+	pos(t, e, 0, 5)
+}
+
+func TestEmulator_PrintAfterCursorMoveOverwrites(t *testing.T) {
+	// Move into the middle of an existing line and write — the rune at
+	// that cell is replaced.
+	e := feed("hello\x1b[1;3Hp")
+	assert.Equal(t, "hepl", line(e, 0)[:4])
+	pos(t, e, 0, 3)
+}
+
+func TestEmulator_ResetClearsGridAndCursor(t *testing.T) {
+	e := feed("hello")
+	e.reset()
+	for i := range testRows {
+		assert.Equal(t, blankLine, strings.Split(e.String(), "\n")[i], "row %d", i)
+	}
+	pos(t, e, 0, 0)
+}
+
+func TestEmulator_WriteIsAdditive(t *testing.T) {
+	// Bytes split across Write calls should produce the same result as one
+	// concatenated call — escape sequences must not lose state at the boundary.
+	e := newEmulator(testCols, testRows)
+	_, _ = e.Write([]byte("\x1b[5;"))
+	_, _ = e.Write([]byte("10Hhello"))
+	pos(t, e, 4, 14) // (4,9) + "hello"
+	assert.Equal(t, "         hello", line(e, 4))
+}
diff --git a/libs/cmdio/cmdiotest/termtest/termtest.go b/libs/cmdio/cmdiotest/termtest/termtest.go
new file mode 100644
index 00000000000..6ef0a71df09
--- /dev/null
+++ b/libs/cmdio/cmdiotest/termtest/termtest.go
@@ -0,0 +1,379 @@
+// Package termtest drives cmdio's interactive prompts as a black box: it
+// wires a [cmdio.NewTestIO] up to a pair of pipes, calls the public entry
+// points ([cmdio.RunPrompt], [cmdio.Secret], [cmdio.SelectOrdered], …) in a
+// goroutine, and exposes the rendered screen via an in-process VT emulator.
+//
+// Tests neither construct the underlying tea.Model nor reach into cmdio's
+// internals — they hand opts in and read (value, err) out, the same way a
+// real command does.
+//
+// Typical usage:
+//
+//	tm := termtest.NewPrompt(t, cmdio.PromptOptions{Label: "Workspace name"})
+//	tm.WaitFor("Workspace name")
+//	tm.Golden("01-empty")
+//	tm.Type("hello")
+//	tm.Golden("02-after-typing")
+//	tm.Type(termtest.KeyEnter)
+//	value, err := tm.Result()
+//
+// # Golden files
+//
+// Golden(step) compares the rendered screen against
+// testdata/<TestName>/<step>.golden. The screen comes from the emulator —
+// what the user would see — not the raw escape-sequence stream, so the
+// goldens are stable across rendering changes as long as the visible UI
+// matches. To create or refresh goldens, pass -update to `go test`
+// (the flag is registered by [testdiff.OverwriteMode]).
+package termtest
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+	"unicode/utf8"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/testdiff"
+	"github.com/stretchr/testify/require"
+)
+
+// Key constants — raw byte sequences as they'd arrive on a terminal's stdin.
+// Bubbletea's input parser converts them into the same KeyMsg values a real
+// keypress would produce. Pass them straight to (*Term).Type — the bytes go
+// down the same pipe as ordinary typed text.
+const (
+	KeyEnter     = "\r"
+	KeyTab       = "\t"
+	KeyBackspace = "\x7f"
+	KeyEsc       = "\x1b"
+	KeyCtrlC     = "\x03"
+	KeyCtrlD     = "\x04"
+	KeyUp        = "\x1b[A"
+	KeyDown      = "\x1b[B"
+	KeyRight     = "\x1b[C"
+	KeyLeft      = "\x1b[D"
+	KeyHome      = "\x1b[H"
+	KeyEnd       = "\x1b[F"
+	KeyDelete    = "\x1b[3~"
+	KeyCtrlA     = "\x01"
+	KeyCtrlB     = "\x02"
+	KeyCtrlE     = "\x05"
+	KeyCtrlF     = "\x06"
+	KeyCtrlH     = "\x08"
+	KeyCtrlJ     = "\x0a"
+	KeyCtrlN     = "\x0e"
+	KeyCtrlP     = "\x10"
+	KeyCtrlU     = "\x15"
+	KeyCtrlW     = "\x17"
+)
+
+const (
+	// defaultTimeout bounds how long any single wait (Golden,
+	// WaitFor, Close, Result) blocks before declaring failure. Generous
+	// so heavy CI load doesn't fail tests that would otherwise pass — if
+	// the test is going to fail it fails anyway, just a bit slower.
+	defaultTimeout = 5 * time.Second
+	pollInterval   = 5 * time.Millisecond
+
+	// updateSettleWait is the fixed delay Golden() waits in update mode
+	// before snapshotting. Update mode is interactive (the author has
+	// passed -update to regenerate goldens), so a small fixed sleep is
+	// enough — if the result looks mid-frame the author re-runs.
+	updateSettleWait = 200 * time.Millisecond
+
+	// escDisambiguationDelay is how long [Term.Type] waits after writing a
+	// lone Esc. The kernel pipe doesn't preserve write boundaries, so a
+	// follow-up Type can land in the same bubbletea Read and the buffer
+	// "\x1ba" gets parsed as Alt+a (bubbletea key.go: any "\x1b" with a
+	// trailing byte is an Alt-modifier; only a buffer of exactly "\x1b"
+	// becomes KeyEscape). Other Key* constants are either single non-Esc
+	// bytes or complete "\x1b[..." CSI sequences whose terminator commits
+	// the parse before any follow-up byte matters, so they don't need this.
+	// 20 ms matches the ESC-disambiguation timeouts neovim and tmux use
+	// for the same problem.
+	escDisambiguationDelay = 20 * time.Millisecond
+)
+
+// resultMsg carries the (value, err) the goroutine running the cmdio entry
+// point produced. T is string for RunPrompt / Secret / SelectOrdered and int
+// for RunSelect.
+type resultMsg[T any] struct {
+	value T
+	err   error
+}
+
+// Term wraps a goroutine running a cmdio prompt/select call. Stdin is an
+// OS-level pipe we write to (bubbletea's cancelreader only knows how to
+// unblock os.File-backed inputs cleanly on Quit; io.Pipe would leak the
+// input goroutine); cmdio's stderr (where the TUI renders) is a
+// synchronized buffer we drain into the VT emulator on demand.
+type Term[T any] struct {
+	t *testing.T
+
+	inW *os.File
+	inR *os.File
+
+	done     chan resultMsg[T]
+	finished chan struct{}
+
+	mu      sync.Mutex
+	out     bytes.Buffer
+	term    *emulator
+	raw     bytes.Buffer
+	pending []byte
+}
+
+// NewPrompt runs [cmdio.RunPrompt] in a goroutine and returns a harness for
+// it.
+func NewPrompt(t *testing.T, opts cmdio.PromptOptions) *Term[string] {
+	t.Helper()
+	return Run(t, func(ctx context.Context) (string, error) {
+		return cmdio.RunPrompt(ctx, opts)
+	})
+}
+
+// NewSecret runs [cmdio.Secret] in a goroutine and returns a harness for it.
+func NewSecret(t *testing.T, label string) *Term[string] {
+	t.Helper()
+	return Run(t, func(ctx context.Context) (string, error) {
+		return cmdio.Secret(ctx, label)
+	})
+}
+
+// NewSelect runs [cmdio.RunSelect] in a goroutine and returns a harness for
+// it.
+func NewSelect(t *testing.T, opts cmdio.SelectOptions) *Term[int] {
+	t.Helper()
+	return Run(t, func(ctx context.Context) (int, error) {
+		return cmdio.RunSelect(ctx, opts)
+	})
+}
+
+// NewSelectOrdered runs [cmdio.SelectOrdered] in a goroutine and returns a
+// harness for it.
+func NewSelectOrdered(t *testing.T, items []cmdio.Tuple, label string) *Term[string] {
+	t.Helper()
+	return Run(t, func(ctx context.Context) (string, error) {
+		return cmdio.SelectOrdered(ctx, items, label)
+	})
+}
+
+// Run drives an interactive command through the same terminal harness as the prompts.
+func Run[T any](t *testing.T, fn func(ctx context.Context) (T, error)) *Term[T] {
+	t.Helper()
+	inR, inW, err := os.Pipe()
+	require.NoError(t, err, "open input pipe")
+	tt := &Term[T]{
+		t:        t,
+		inW:      inW,
+		inR:      inR,
+		done:     make(chan resultMsg[T], 1),
+		finished: make(chan struct{}),
+		term:     newEmulator(cmdio.TestTerminalWidth, cmdio.TestTerminalHeight),
+	}
+	io := cmdio.NewTestIO(inR, io.Discard, &syncWriter{mu: &tt.mu, buf: &tt.out})
+	ctx := cmdio.InContext(t.Context(), io)
+	go func() {
+		v, err := fn(ctx)
+		_ = inR.Close()
+		tt.done <- resultMsg[T]{value: v, err: err}
+		close(tt.finished)
+	}()
+	t.Cleanup(tt.Close)
+	return tt
+}
+
+// syncWriter is the io.Writer cmdio gives bubbletea as stderr. Writes from
+// the program goroutine race with our drain calls, so the buffer is mutex-
+// guarded.
+type syncWriter struct {
+	mu  *sync.Mutex
+	buf *bytes.Buffer
+}
+
+func (w *syncWriter) Write(p []byte) (int, error) {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	return w.buf.Write(p)
+}
+
+// Type writes a string into the program's stdin. The string can be ordinary
+// text or one of the Key* constants — they're all just bytes the user would
+// have typed on a real terminal. After a lone Esc the call sleeps for
+// [escDisambiguationDelay] so a follow-up Type lands in a separate bubbletea
+// Read; see the constant's comment for why that matters.
+func (tt *Term[T]) Type(s string) {
+	tt.t.Helper()
+	_, err := tt.inW.Write([]byte(s))
+	require.NoError(tt.t, err, "write to stdin pipe")
+	if s == KeyEsc {
+		time.Sleep(escDisambiguationDelay)
+	}
+}
+
+// WaitFor blocks until substr appears in the raw output stream, or the
+// default timeout elapses. Returns the captured output for use in failure
+// messages.
+func (tt *Term[T]) WaitFor(substr string) string {
+	tt.t.Helper()
+	deadline := time.Now().Add(defaultTimeout)
+	for {
+		got := tt.Raw()
+		if strings.Contains(got, substr) {
+			return got
+		}
+		if time.Now().After(deadline) {
+			tt.t.Fatalf("WaitFor(%q) timed out after %s\n--- captured raw output ---\n%s", substr, defaultTimeout, got)
+		}
+		time.Sleep(pollInterval)
+	}
+}
+
+// Snapshot returns the current emulator screen contents with trailing
+// whitespace trimmed from each line and trailing empty lines dropped.
+func (tt *Term[T]) Snapshot() string {
+	tt.drainPending()
+	tt.mu.Lock()
+	defer tt.mu.Unlock()
+	lines := strings.Split(tt.term.String(), "\n")
+	for i, l := range lines {
+		lines[i] = strings.TrimRight(l, " \t")
+	}
+	for len(lines) > 0 && lines[len(lines)-1] == "" {
+		lines = lines[:len(lines)-1]
+	}
+	return strings.Join(lines, "\n")
+}
+
+// Raw returns the raw byte stream captured from the program, including all
+// escape sequences. Useful for debugging when Snapshot output is unexpected.
+func (tt *Term[T]) Raw() string {
+	tt.drainPending()
+	tt.mu.Lock()
+	defer tt.mu.Unlock()
+	return tt.raw.String()
+}
+
+// Golden waits for the rendered screen to match
+// testdata/<TestName>/<step>.golden, then asserts they're equal. With
+// the testdiff -update flag set ([testdiff.OverwriteMode]) the golden
+// file is (re)written from the settled snapshot instead. Step names are
+// used verbatim as filenames; prefer "01-", "02-", … to keep listings
+// in checkpoint order.
+func (tt *Term[T]) Golden(step string) {
+	tt.t.Helper()
+	safeName := strings.ReplaceAll(tt.t.Name(), "/", "_")
+	path := filepath.Join("testdata", safeName, step+".golden")
+
+	if testdiff.OverwriteMode {
+		time.Sleep(updateSettleWait)
+		got := tt.Snapshot() + "\n"
+		require.NoError(tt.t, os.MkdirAll(filepath.Dir(path), 0o755))
+		require.NoError(tt.t, os.WriteFile(path, []byte(got), 0o644))
+		return
+	}
+
+	wantBytes, err := os.ReadFile(path)
+	if err != nil {
+		tt.t.Fatalf("read golden %s: %v\nrun with -update to create it\n--- current screen ---\n%s", path, err, tt.Snapshot())
+	}
+	want := string(wantBytes)
+	got := tt.waitForMatch(want) + "\n"
+	testdiff.AssertEqualTexts(tt.t, path, "actual", want, got)
+}
+
+// waitForMatch polls the rendered screen until it (with a trailing
+// newline appended, matching how goldens are stored on disk) equals
+// want, then returns. If defaultTimeout elapses without a match, returns the
+// last snapshot seen so the caller can produce a diff against it.
+func (tt *Term[T]) waitForMatch(want string) string {
+	tt.t.Helper()
+	deadline := time.Now().Add(defaultTimeout)
+	for {
+		got := tt.Snapshot()
+		if got+"\n" == want {
+			return got
+		}
+		if time.Now().After(deadline) {
+			return got
+		}
+		time.Sleep(pollInterval)
+	}
+}
+
+// Close releases the input pipe and waits for the goroutine running the
+// cmdio entry point to finish. Safe to call after Result has already drained
+// the return value, and safe to call repeatedly.
+func (tt *Term[T]) Close() {
+	_ = tt.inW.Close()
+	select {
+	case <-tt.finished:
+	case <-time.After(defaultTimeout):
+		tt.t.Logf("Close: cmdio call did not finish in %s; raw output:\n%s", defaultTimeout, tt.Raw())
+	}
+}
+
+// Result waits for the goroutine running the cmdio entry point to finish and
+// returns the (value, error) it produced. For NewPrompt / NewSecret /
+// NewSelectOrdered T is string; for NewSelect T is int.
+func (tt *Term[T]) Result() (T, error) {
+	tt.t.Helper()
+	select {
+	case r := <-tt.done:
+		return r.value, r.err
+	case <-time.After(defaultTimeout):
+		tt.t.Fatalf("cmdio call did not finish in %s; raw output:\n%s", defaultTimeout, tt.Raw())
+		var zero T
+		return zero, nil
+	}
+}
+
+// drainPending moves whatever bytes the program has written since the last
+// drain into the raw buffer and the VT emulator. The emulator's parser is
+// fed in UTF-8 boundary-aligned chunks because a multi-byte rune split
+// across two writes would otherwise be reported invalid and skip cells.
+func (tt *Term[T]) drainPending() {
+	tt.mu.Lock()
+	defer tt.mu.Unlock()
+	if tt.out.Len() == 0 {
+		return
+	}
+	b := make([]byte, tt.out.Len())
+	_, _ = tt.out.Read(b)
+	tt.raw.Write(b)
+	input := b
+	if len(tt.pending) > 0 {
+		input = append(tt.pending, input...)
+		tt.pending = tt.pending[:0]
+	}
+	consumed := completeUTF8End(input)
+	_, _ = tt.term.Write(input[:consumed])
+	if consumed < len(input) {
+		tt.pending = append(tt.pending, input[consumed:]...)
+	}
+}
+
+// completeUTF8End returns the offset such that p[:offset] contains only
+// complete UTF-8 sequences and p[offset:] is the start of an incomplete rune
+// that needs more bytes. If p ends on a complete rune, the offset is len(p).
+func completeUTF8End(p []byte) int {
+	n := len(p)
+	// A UTF-8 rune is at most 4 bytes, so the partial start can only be in
+	// the last 3 positions. Walk backwards looking for a rune-start byte.
+	for i := 1; i <= 3 && i <= n; i++ {
+		if utf8.RuneStart(p[n-i]) {
+			if !utf8.FullRune(p[n-i:]) {
+				return n - i
+			}
+			return n
+		}
+	}
+	return n
+}
diff --git a/libs/cmdio/cmdiotest/testdata/.gitattributes b/libs/cmdio/cmdiotest/testdata/.gitattributes
new file mode 100644
index 00000000000..ce3086d105c
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/.gitattributes
@@ -0,0 +1,5 @@
+# Goldens record the exact bytes the VT emulator's String() emits, which is
+# always LF-separated. On Windows, the default LF→CRLF translation would
+# turn a checked-out golden into CRLF-separated and cause termtest.Golden()
+# to see a mismatch against the LF-only snapshot.
+*.golden text eol=lf
diff --git a/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_AltKeyNoop/01-cursor-mid.golden b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_AltKeyNoop/01-cursor-mid.golden
new file mode 100644
index 00000000000..635c34f7ff8
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_AltKeyNoop/01-cursor-mid.golden
@@ -0,0 +1 @@
+✔ Workspace name: hel█o
diff --git a/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_AltKeyNoop/02-after-alt-f.golden b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_AltKeyNoop/02-after-alt-f.golden
new file mode 100644
index 00000000000..635c34f7ff8
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_AltKeyNoop/02-after-alt-f.golden
@@ -0,0 +1 @@
+✔ Workspace name: hel█o
diff --git a/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CtrlC/01-empty.golden b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CtrlC/01-empty.golden
new file mode 100644
index 00000000000..573e4d76ba4
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CtrlC/01-empty.golden
@@ -0,0 +1 @@
+✔ Workspace name: █
diff --git a/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CtrlC/02-after-typing.golden b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CtrlC/02-after-typing.golden
new file mode 100644
index 00000000000..e60a3917b8d
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CtrlC/02-after-typing.golden
@@ -0,0 +1 @@
+✔ Workspace name: partial input█
diff --git a/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CtrlFCtrlB/01-cursor-end.golden b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CtrlFCtrlB/01-cursor-end.golden
new file mode 100644
index 00000000000..9953a3130fb
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CtrlFCtrlB/01-cursor-end.golden
@@ -0,0 +1 @@
+✔ Workspace name: hello█
diff --git a/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CtrlFCtrlB/02-after-ctrl-b-twice.golden b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CtrlFCtrlB/02-after-ctrl-b-twice.golden
new file mode 100644
index 00000000000..635c34f7ff8
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CtrlFCtrlB/02-after-ctrl-b-twice.golden
@@ -0,0 +1 @@
+✔ Workspace name: hel█o
diff --git a/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CtrlFCtrlB/03-after-ctrl-f.golden b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CtrlFCtrlB/03-after-ctrl-f.golden
new file mode 100644
index 00000000000..e9fc1040ea1
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CtrlFCtrlB/03-after-ctrl-f.golden
@@ -0,0 +1 @@
+✔ Workspace name: hell█
diff --git a/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CtrlH/01-typed-hello.golden b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CtrlH/01-typed-hello.golden
new file mode 100644
index 00000000000..9953a3130fb
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CtrlH/01-typed-hello.golden
@@ -0,0 +1 @@
+✔ Workspace name: hello█
diff --git a/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CtrlH/02-after-ctrl-h-twice.golden b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CtrlH/02-after-ctrl-h-twice.golden
new file mode 100644
index 00000000000..ea28225666e
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CtrlH/02-after-ctrl-h-twice.golden
@@ -0,0 +1 @@
+✔ Workspace name: hel█
diff --git a/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CtrlJ/01-typed-hello.golden b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CtrlJ/01-typed-hello.golden
new file mode 100644
index 00000000000..9953a3130fb
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CtrlJ/01-typed-hello.golden
@@ -0,0 +1 @@
+✔ Workspace name: hello█
diff --git a/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CursorEditing/01-empty.golden b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CursorEditing/01-empty.golden
new file mode 100644
index 00000000000..573e4d76ba4
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CursorEditing/01-empty.golden
@@ -0,0 +1 @@
+✔ Workspace name: █
diff --git a/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CursorEditing/02-typed.golden b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CursorEditing/02-typed.golden
new file mode 100644
index 00000000000..9c88744b4c2
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CursorEditing/02-typed.golden
@@ -0,0 +1 @@
+✔ Workspace name: hello world█
diff --git a/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CursorEditing/03-insert-at-start.golden b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CursorEditing/03-insert-at-start.golden
new file mode 100644
index 00000000000..264a7886da4
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CursorEditing/03-insert-at-start.golden
@@ -0,0 +1 @@
+✔ Workspace name: hello worldX█
diff --git a/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CursorEditing/04-insert-at-end.golden b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CursorEditing/04-insert-at-end.golden
new file mode 100644
index 00000000000..be057b8e727
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CursorEditing/04-insert-at-end.golden
@@ -0,0 +1 @@
+✔ Workspace name: hello worldX!█
diff --git a/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CursorEditing/05-insert-mid.golden b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CursorEditing/05-insert-mid.golden
new file mode 100644
index 00000000000..6a46ddd34b8
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CursorEditing/05-insert-mid.golden
@@ -0,0 +1 @@
+✔ Workspace name: hello worldY█!
diff --git a/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CursorEditing/06-after-backspace.golden b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CursorEditing/06-after-backspace.golden
new file mode 100644
index 00000000000..ffe7894be43
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CursorEditing/06-after-backspace.golden
@@ -0,0 +1 @@
+✔ Workspace name: hello world█!
diff --git a/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CursorEditing/07-after-ctrl-w.golden b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CursorEditing/07-after-ctrl-w.golden
new file mode 100644
index 00000000000..ffe7894be43
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CursorEditing/07-after-ctrl-w.golden
@@ -0,0 +1 @@
+✔ Workspace name: hello world█!
diff --git a/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CursorEditing/08-after-ctrl-u.golden b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CursorEditing/08-after-ctrl-u.golden
new file mode 100644
index 00000000000..ffe7894be43
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_CursorEditing/08-after-ctrl-u.golden
@@ -0,0 +1 @@
+✔ Workspace name: hello world█!
diff --git a/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_HideEnteredFalse/01-after-enter.golden b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_HideEnteredFalse/01-after-enter.golden
new file mode 100644
index 00000000000..5a85acfe17e
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_HideEnteredFalse/01-after-enter.golden
@@ -0,0 +1 @@
+Workspace name: hello
diff --git a/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_HideEnteredTrue/01-after-enter.golden b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_HideEnteredTrue/01-after-enter.golden
new file mode 100644
index 00000000000..8b137891791
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_HideEnteredTrue/01-after-enter.golden
@@ -0,0 +1 @@
+
diff --git a/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_Mask/01-empty.golden b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_Mask/01-empty.golden
new file mode 100644
index 00000000000..0dbd7dbcc1d
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_Mask/01-empty.golden
@@ -0,0 +1 @@
+✔ Personal access token: █
diff --git a/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_Mask/02-after-typing.golden b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_Mask/02-after-typing.golden
new file mode 100644
index 00000000000..ca12387eeaa
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_Mask/02-after-typing.golden
@@ -0,0 +1 @@
+✔ Personal access token: ***********█
diff --git a/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_Mask/03-after-backspace.golden b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_Mask/03-after-backspace.golden
new file mode 100644
index 00000000000..b6d1e251d43
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_Mask/03-after-backspace.golden
@@ -0,0 +1 @@
+✔ Personal access token: ********█
diff --git a/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_Plain/01-empty.golden b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_Plain/01-empty.golden
new file mode 100644
index 00000000000..573e4d76ba4
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_Plain/01-empty.golden
@@ -0,0 +1 @@
+✔ Workspace name: █
diff --git a/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_Plain/02-after-typing.golden b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_Plain/02-after-typing.golden
new file mode 100644
index 00000000000..9953a3130fb
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_Plain/02-after-typing.golden
@@ -0,0 +1 @@
+✔ Workspace name: hello█
diff --git a/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_Plain/03-after-edit.golden b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_Plain/03-after-edit.golden
new file mode 100644
index 00000000000..5547fe4e5d0
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_Plain/03-after-edit.golden
@@ -0,0 +1 @@
+✔ Workspace name: help there█
diff --git a/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_UTF8/01-empty.golden b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_UTF8/01-empty.golden
new file mode 100644
index 00000000000..88f4f76ce98
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_UTF8/01-empty.golden
@@ -0,0 +1 @@
+✔ Name: █
diff --git a/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_UTF8/02-after-typing.golden b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_UTF8/02-after-typing.golden
new file mode 100644
index 00000000000..a9aee3b592c
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_UTF8/02-after-typing.golden
@@ -0,0 +1 @@
+✔ Name: café█
diff --git a/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_UTF8/03-after-backspace.golden b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_UTF8/03-after-backspace.golden
new file mode 100644
index 00000000000..9a8f1418b40
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_UTF8/03-after-backspace.golden
@@ -0,0 +1 @@
+✔ Name: caf█
diff --git a/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_UTF8/04-restored.golden b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_UTF8/04-restored.golden
new file mode 100644
index 00000000000..a9aee3b592c
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_UTF8/04-restored.golden
@@ -0,0 +1 @@
+✔ Name: café█
diff --git a/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_Validate/01-empty.golden b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_Validate/01-empty.golden
new file mode 100644
index 00000000000..aef99ba9f27
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_Validate/01-empty.golden
@@ -0,0 +1 @@
+✗ Workspace host: █
diff --git a/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_Validate/02-invalid-typing.golden b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_Validate/02-invalid-typing.golden
new file mode 100644
index 00000000000..4a0be169b82
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_Validate/02-invalid-typing.golden
@@ -0,0 +1 @@
+✗ Workspace host: abc█
diff --git a/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_Validate/03-cleared.golden b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_Validate/03-cleared.golden
new file mode 100644
index 00000000000..aef99ba9f27
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_Validate/03-cleared.golden
@@ -0,0 +1 @@
+✗ Workspace host: █
diff --git a/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_Validate/04-valid.golden b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_Validate/04-valid.golden
new file mode 100644
index 00000000000..990a1bf0efa
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestPromptBaseline_Validate/04-valid.golden
@@ -0,0 +1 @@
+✔ Workspace host: https://example.com█
diff --git a/libs/cmdio/cmdiotest/testdata/TestSecretBaseline_CtrlC/01-empty.golden b/libs/cmdio/cmdiotest/testdata/TestSecretBaseline_CtrlC/01-empty.golden
new file mode 100644
index 00000000000..0dbd7dbcc1d
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSecretBaseline_CtrlC/01-empty.golden
@@ -0,0 +1 @@
+✔ Personal access token: █
diff --git a/libs/cmdio/cmdiotest/testdata/TestSecretBaseline_CtrlC/02-after-typing.golden b/libs/cmdio/cmdiotest/testdata/TestSecretBaseline_CtrlC/02-after-typing.golden
new file mode 100644
index 00000000000..b613f6fdede
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSecretBaseline_CtrlC/02-after-typing.golden
@@ -0,0 +1 @@
+✔ Personal access token: ***█
diff --git a/libs/cmdio/cmdiotest/testdata/TestSecretBaseline_EmptyEnter/01-empty.golden b/libs/cmdio/cmdiotest/testdata/TestSecretBaseline_EmptyEnter/01-empty.golden
new file mode 100644
index 00000000000..0dbd7dbcc1d
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSecretBaseline_EmptyEnter/01-empty.golden
@@ -0,0 +1 @@
+✔ Personal access token: █
diff --git a/libs/cmdio/cmdiotest/testdata/TestSecretBaseline_Typing/01-empty.golden b/libs/cmdio/cmdiotest/testdata/TestSecretBaseline_Typing/01-empty.golden
new file mode 100644
index 00000000000..59ec04158be
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSecretBaseline_Typing/01-empty.golden
@@ -0,0 +1 @@
+✔ Enter password: █
diff --git a/libs/cmdio/cmdiotest/testdata/TestSecretBaseline_Typing/02-after-typing.golden b/libs/cmdio/cmdiotest/testdata/TestSecretBaseline_Typing/02-after-typing.golden
new file mode 100644
index 00000000000..aa5a58d38dc
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSecretBaseline_Typing/02-after-typing.golden
@@ -0,0 +1 @@
+✔ Enter password: *******█
diff --git a/libs/cmdio/cmdiotest/testdata/TestSecretBaseline_Typing/03-after-backspace.golden b/libs/cmdio/cmdiotest/testdata/TestSecretBaseline_Typing/03-after-backspace.golden
new file mode 100644
index 00000000000..cfde690c7fd
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSecretBaseline_Typing/03-after-backspace.golden
@@ -0,0 +1 @@
+✔ Enter password: ******█
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_ArrowPageNav/01-initial.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_ArrowPageNav/01-initial.golden
new file mode 100644
index 00000000000..79b50d3685b
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_ArrowPageNav/01-initial.golden
@@ -0,0 +1,7 @@
+Search: █
+? Pick one:
+  item-01 (id01)
+  item-02
+  item-03
+  item-04
+↓ item-05
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_ArrowPageNav/02-after-right.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_ArrowPageNav/02-after-right.golden
new file mode 100644
index 00000000000..8f4c3e519bc
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_ArrowPageNav/02-after-right.golden
@@ -0,0 +1,7 @@
+Search: █
+? Pick one:
+↑ item-06 (id06)
+  item-07
+  item-08
+  item-09
+↓ item-10
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_ArrowPageNav/03-after-right-twice.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_ArrowPageNav/03-after-right-twice.golden
new file mode 100644
index 00000000000..0cc8c1ae3be
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_ArrowPageNav/03-after-right-twice.golden
@@ -0,0 +1,7 @@
+Search: █
+? Pick one:
+↑ item-08 (id08)
+  item-09
+  item-10
+  item-11
+  item-12
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_ArrowPageNav/04-after-left.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_ArrowPageNav/04-after-left.golden
new file mode 100644
index 00000000000..c977445fc75
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_ArrowPageNav/04-after-left.golden
@@ -0,0 +1,7 @@
+Search: █
+? Pick one:
+↑ item-03 (id03)
+  item-04
+  item-05
+  item-06
+↓ item-07
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlC/01-initial.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlC/01-initial.golden
new file mode 100644
index 00000000000..b2cc3177062
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlC/01-initial.golden
@@ -0,0 +1,5 @@
+Search: █
+? Pick one:
+  alpha (a)
+  beta
+  gamma
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlCWithFilter/01-no-results-with-filter.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlCWithFilter/01-no-results-with-filter.golden
new file mode 100644
index 00000000000..d4462b9e7ad
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlCWithFilter/01-no-results-with-filter.golden
@@ -0,0 +1,4 @@
+Search: xyz█
+? Pick one:
+
+No results
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlFCtrlB/01-initial.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlFCtrlB/01-initial.golden
new file mode 100644
index 00000000000..79b50d3685b
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlFCtrlB/01-initial.golden
@@ -0,0 +1,7 @@
+Search: █
+? Pick one:
+  item-01 (id01)
+  item-02
+  item-03
+  item-04
+↓ item-05
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlFCtrlB/02-after-ctrl-f.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlFCtrlB/02-after-ctrl-f.golden
new file mode 100644
index 00000000000..8f4c3e519bc
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlFCtrlB/02-after-ctrl-f.golden
@@ -0,0 +1,7 @@
+Search: █
+? Pick one:
+↑ item-06 (id06)
+  item-07
+  item-08
+  item-09
+↓ item-10
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlFCtrlB/03-after-ctrl-f-twice.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlFCtrlB/03-after-ctrl-f-twice.golden
new file mode 100644
index 00000000000..0cc8c1ae3be
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlFCtrlB/03-after-ctrl-f-twice.golden
@@ -0,0 +1,7 @@
+Search: █
+? Pick one:
+↑ item-08 (id08)
+  item-09
+  item-10
+  item-11
+  item-12
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlFCtrlB/04-after-ctrl-b.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlFCtrlB/04-after-ctrl-b.golden
new file mode 100644
index 00000000000..c977445fc75
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlFCtrlB/04-after-ctrl-b.golden
@@ -0,0 +1,7 @@
+Search: █
+? Pick one:
+↑ item-03 (id03)
+  item-04
+  item-05
+  item-06
+↓ item-07
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlH/01-initial.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlH/01-initial.golden
new file mode 100644
index 00000000000..b2cc3177062
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlH/01-initial.golden
@@ -0,0 +1,5 @@
+Search: █
+? Pick one:
+  alpha (a)
+  beta
+  gamma
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlH/02-after-typing-alp.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlH/02-after-typing-alp.golden
new file mode 100644
index 00000000000..310d9b22c84
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlH/02-after-typing-alp.golden
@@ -0,0 +1,3 @@
+Search: alp█
+? Pick one:
+  alpha (a)
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlH/03-after-ctrl-h-twice.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlH/03-after-ctrl-h-twice.golden
new file mode 100644
index 00000000000..1ebe34ba2d4
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlH/03-after-ctrl-h-twice.golden
@@ -0,0 +1,5 @@
+Search: a█
+? Pick one:
+  alpha (a)
+  beta
+  gamma
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlJ/01-initial.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlJ/01-initial.golden
new file mode 100644
index 00000000000..b2cc3177062
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlJ/01-initial.golden
@@ -0,0 +1,5 @@
+Search: █
+? Pick one:
+  alpha (a)
+  beta
+  gamma
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlJ/02-after-down.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlJ/02-after-down.golden
new file mode 100644
index 00000000000..08aea57a564
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlJ/02-after-down.golden
@@ -0,0 +1,5 @@
+Search: █
+? Pick one:
+  alpha
+  beta (b)
+  gamma
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlNCtrlP/01-initial.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlNCtrlP/01-initial.golden
new file mode 100644
index 00000000000..b2cc3177062
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlNCtrlP/01-initial.golden
@@ -0,0 +1,5 @@
+Search: █
+? Pick one:
+  alpha (a)
+  beta
+  gamma
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlNCtrlP/02-after-ctrl-n-twice.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlNCtrlP/02-after-ctrl-n-twice.golden
new file mode 100644
index 00000000000..911e4cebbfc
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlNCtrlP/02-after-ctrl-n-twice.golden
@@ -0,0 +1,5 @@
+Search: █
+? Pick one:
+  alpha
+  beta
+  gamma (c)
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlNCtrlP/03-after-ctrl-p.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlNCtrlP/03-after-ctrl-p.golden
new file mode 100644
index 00000000000..08aea57a564
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_CtrlNCtrlP/03-after-ctrl-p.golden
@@ -0,0 +1,5 @@
+Search: █
+? Pick one:
+  alpha
+  beta (b)
+  gamma
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_DefaultTemplates/01-initial.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_DefaultTemplates/01-initial.golden
new file mode 100644
index 00000000000..0b041cfa6bd
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_DefaultTemplates/01-initial.golden
@@ -0,0 +1,7 @@
+Use the arrow keys to navigate: ↓ ↑ → ←
+? Pick an item:
+  ▸ {unity-catalog id-01}
+    {delta-lake id-02}
+    {delta-sharing id-03}
+    {photon id-04}
+    {mlflow id-05}
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_DefaultTemplates/02-after-down.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_DefaultTemplates/02-after-down.golden
new file mode 100644
index 00000000000..fe713ec2945
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_DefaultTemplates/02-after-down.golden
@@ -0,0 +1,7 @@
+Use the arrow keys to navigate: ↓ ↑ → ←
+? Pick an item:
+    {unity-catalog id-01}
+  ▸ {delta-lake id-02}
+    {delta-sharing id-03}
+    {photon id-04}
+    {mlflow id-05}
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_DefaultTemplates/03-after-enter.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_DefaultTemplates/03-after-enter.golden
new file mode 100644
index 00000000000..13b2cf483fa
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_DefaultTemplates/03-after-enter.golden
@@ -0,0 +1 @@
+✔ {delta-lake id-02}
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_DownEnter/01-initial.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_DownEnter/01-initial.golden
new file mode 100644
index 00000000000..b2cc3177062
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_DownEnter/01-initial.golden
@@ -0,0 +1,5 @@
+Search: █
+? Pick one:
+  alpha (a)
+  beta
+  gamma
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_DownEnter/02-after-down.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_DownEnter/02-after-down.golden
new file mode 100644
index 00000000000..08aea57a564
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_DownEnter/02-after-down.golden
@@ -0,0 +1,5 @@
+Search: █
+? Pick one:
+  alpha
+  beta (b)
+  gamma
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_EscKey/01-initial.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_EscKey/01-initial.golden
new file mode 100644
index 00000000000..b2cc3177062
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_EscKey/01-initial.golden
@@ -0,0 +1,5 @@
+Search: █
+? Pick one:
+  alpha (a)
+  beta
+  gamma
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_EscKey/02-esc-from-initial.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_EscKey/02-esc-from-initial.golden
new file mode 100644
index 00000000000..b2cc3177062
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_EscKey/02-esc-from-initial.golden
@@ -0,0 +1,5 @@
+Search: █
+? Pick one:
+  alpha (a)
+  beta
+  gamma
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_EscKey/03-after-typing-a.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_EscKey/03-after-typing-a.golden
new file mode 100644
index 00000000000..1ebe34ba2d4
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_EscKey/03-after-typing-a.golden
@@ -0,0 +1,5 @@
+Search: a█
+? Pick one:
+  alpha (a)
+  beta
+  gamma
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_EscKey/04-esc-clears-filter-or-not.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_EscKey/04-esc-clears-filter-or-not.golden
new file mode 100644
index 00000000000..1ebe34ba2d4
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_EscKey/04-esc-clears-filter-or-not.golden
@@ -0,0 +1,5 @@
+Search: a█
+? Pick one:
+  alpha (a)
+  beta
+  gamma
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterCursor/01-initial.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterCursor/01-initial.golden
new file mode 100644
index 00000000000..61e066d6009
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterCursor/01-initial.golden
@@ -0,0 +1,7 @@
+Search: █
+? Pick one:
+  alpha (a)
+  beta
+  gamma
+  delta
+  epsilon
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterCursor/02-on-gamma.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterCursor/02-on-gamma.golden
new file mode 100644
index 00000000000..14990cced58
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterCursor/02-on-gamma.golden
@@ -0,0 +1,7 @@
+Search: █
+? Pick one:
+  alpha
+  beta
+  gamma (g)
+  delta
+  epsilon
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterCursor/03-after-filter-a.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterCursor/03-after-filter-a.golden
new file mode 100644
index 00000000000..230e97a359b
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterCursor/03-after-filter-a.golden
@@ -0,0 +1,6 @@
+Search: a█
+? Pick one:
+  alpha (a)
+  beta
+  gamma
+  delta
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterCursor/04-after-clear-filter.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterCursor/04-after-clear-filter.golden
new file mode 100644
index 00000000000..61e066d6009
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterCursor/04-after-clear-filter.golden
@@ -0,0 +1,7 @@
+Search: █
+? Pick one:
+  alpha (a)
+  beta
+  gamma
+  delta
+  epsilon
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterCursorEditing/01-initial.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterCursorEditing/01-initial.golden
new file mode 100644
index 00000000000..61e066d6009
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterCursorEditing/01-initial.golden
@@ -0,0 +1,7 @@
+Search: █
+? Pick one:
+  alpha (a)
+  beta
+  gamma
+  delta
+  epsilon
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterCursorEditing/02-after-typing-alp.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterCursorEditing/02-after-typing-alp.golden
new file mode 100644
index 00000000000..310d9b22c84
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterCursorEditing/02-after-typing-alp.golden
@@ -0,0 +1,3 @@
+Search: alp█
+? Pick one:
+  alpha (a)
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterCursorEditing/03-after-insert-mid.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterCursorEditing/03-after-insert-mid.golden
new file mode 100644
index 00000000000..81d80a5ee60
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterCursorEditing/03-after-insert-mid.golden
@@ -0,0 +1,4 @@
+Search: alpX█
+? Pick one:
+
+No results
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterCursorEditing/04-after-insert-at-start.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterCursorEditing/04-after-insert-at-start.golden
new file mode 100644
index 00000000000..ea54244299a
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterCursorEditing/04-after-insert-at-start.golden
@@ -0,0 +1,4 @@
+Search: alpXY█
+? Pick one:
+
+No results
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterCursorEditing/05-after-insert-at-end.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterCursorEditing/05-after-insert-at-end.golden
new file mode 100644
index 00000000000..7c39b030625
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterCursorEditing/05-after-insert-at-end.golden
@@ -0,0 +1,4 @@
+Search: alpXYZ█
+? Pick one:
+
+No results
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterCursorEditing/06-after-ctrl-u.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterCursorEditing/06-after-ctrl-u.golden
new file mode 100644
index 00000000000..7c39b030625
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterCursorEditing/06-after-ctrl-u.golden
@@ -0,0 +1,4 @@
+Search: alpXYZ█
+? Pick one:
+
+No results
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterCursorEditing/07-after-ctrl-w.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterCursorEditing/07-after-ctrl-w.golden
new file mode 100644
index 00000000000..f17e9d0ef65
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterCursorEditing/07-after-ctrl-w.golden
@@ -0,0 +1,4 @@
+Search: alpXYZalpha█
+? Pick one:
+
+No results
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterNoMatch/01-initial.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterNoMatch/01-initial.golden
new file mode 100644
index 00000000000..b2cc3177062
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterNoMatch/01-initial.golden
@@ -0,0 +1,5 @@
+Search: █
+? Pick one:
+  alpha (a)
+  beta
+  gamma
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterNoMatch/02-after-x.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterNoMatch/02-after-x.golden
new file mode 100644
index 00000000000..bd95f26bf80
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterNoMatch/02-after-x.golden
@@ -0,0 +1,4 @@
+Search: x█
+? Pick one:
+
+No results
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterNoMatch/03-after-xy.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterNoMatch/03-after-xy.golden
new file mode 100644
index 00000000000..aa46ed60352
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterNoMatch/03-after-xy.golden
@@ -0,0 +1,4 @@
+Search: xy█
+? Pick one:
+
+No results
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterNoMatch/04-after-xyz.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterNoMatch/04-after-xyz.golden
new file mode 100644
index 00000000000..d4462b9e7ad
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterNoMatch/04-after-xyz.golden
@@ -0,0 +1,4 @@
+Search: xyz█
+? Pick one:
+
+No results
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterNoMatch/05-after-backspaces.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterNoMatch/05-after-backspaces.golden
new file mode 100644
index 00000000000..b2cc3177062
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterNoMatch/05-after-backspaces.golden
@@ -0,0 +1,5 @@
+Search: █
+? Pick one:
+  alpha (a)
+  beta
+  gamma
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterScroll/01-initial.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterScroll/01-initial.golden
new file mode 100644
index 00000000000..79b50d3685b
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterScroll/01-initial.golden
@@ -0,0 +1,7 @@
+Search: █
+? Pick one:
+  item-01 (id01)
+  item-02
+  item-03
+  item-04
+↓ item-05
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterScroll/02-filtered-top.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterScroll/02-filtered-top.golden
new file mode 100644
index 00000000000..ea110e74303
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterScroll/02-filtered-top.golden
@@ -0,0 +1,7 @@
+Search: item-1█
+? Pick one:
+  item-10 (id10)
+  item-11
+  item-12
+  item-13
+↓ item-14
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterScroll/03-filtered-mid.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterScroll/03-filtered-mid.golden
new file mode 100644
index 00000000000..7852d41146c
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterScroll/03-filtered-mid.golden
@@ -0,0 +1,7 @@
+Search: item-1█
+? Pick one:
+↑ item-11
+  item-12
+  item-13
+  item-14
+↓ item-15 (id15)
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterScroll/04-filtered-bottom.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterScroll/04-filtered-bottom.golden
new file mode 100644
index 00000000000..00f1decdf28
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterScroll/04-filtered-bottom.golden
@@ -0,0 +1,7 @@
+Search: item-1█
+? Pick one:
+↑ item-15
+  item-16
+  item-17
+  item-18
+  item-19 (id19)
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterTyping/01-initial.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterTyping/01-initial.golden
new file mode 100644
index 00000000000..61e066d6009
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterTyping/01-initial.golden
@@ -0,0 +1,7 @@
+Search: █
+? Pick one:
+  alpha (a)
+  beta
+  gamma
+  delta
+  epsilon
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterTyping/02-after-a.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterTyping/02-after-a.golden
new file mode 100644
index 00000000000..230e97a359b
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterTyping/02-after-a.golden
@@ -0,0 +1,6 @@
+Search: a█
+? Pick one:
+  alpha (a)
+  beta
+  gamma
+  delta
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterTyping/03-after-al.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterTyping/03-after-al.golden
new file mode 100644
index 00000000000..238784814e1
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterTyping/03-after-al.golden
@@ -0,0 +1,3 @@
+Search: al█
+? Pick one:
+  alpha (a)
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterTyping/04-after-alp.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterTyping/04-after-alp.golden
new file mode 100644
index 00000000000..310d9b22c84
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_FilterTyping/04-after-alp.golden
@@ -0,0 +1,3 @@
+Search: alp█
+? Pick one:
+  alpha (a)
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_LongDescriptions/01-initial.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_LongDescriptions/01-initial.golden
new file mode 100644
index 00000000000..0001f76d220
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_LongDescriptions/01-initial.golden
@@ -0,0 +1,5 @@
+Search: █
+? Pick a resource:
+  short (this-is-a-very-long-resource-identifier-that-exceeds-typical-width-1234567890)
+  medium-length-name
+  x
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_LongDescriptions/02-second-active.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_LongDescriptions/02-second-active.golden
new file mode 100644
index 00000000000..6b2bbd360eb
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_LongDescriptions/02-second-active.golden
@@ -0,0 +1,5 @@
+Search: █
+? Pick a resource:
+  short
+  medium-length-name (another-extremely-long-id-string-with-lots-of-content-aaaaaaaaaaaaaaaaaaaaaaaaaaa)
+  x
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_LongDescriptions/03-third-active.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_LongDescriptions/03-third-active.golden
new file mode 100644
index 00000000000..e16c3c3ff37
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_LongDescriptions/03-third-active.golden
@@ -0,0 +1,5 @@
+Search: █
+? Pick a resource:
+  short
+  medium-length-name
+  x (yet-another-long-identifier-with-quite-a-bit-of-text-bbbbbbbbbbbbbbbbbbbbbbbbbbb)
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_Scroll/01-initial.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_Scroll/01-initial.golden
new file mode 100644
index 00000000000..79b50d3685b
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_Scroll/01-initial.golden
@@ -0,0 +1,7 @@
+Search: █
+? Pick one:
+  item-01 (id01)
+  item-02
+  item-03
+  item-04
+↓ item-05
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_Scroll/02-bottom.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_Scroll/02-bottom.golden
new file mode 100644
index 00000000000..004c522a505
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_Scroll/02-bottom.golden
@@ -0,0 +1,7 @@
+Search: █
+? Pick one:
+↑ item-08
+  item-09
+  item-10
+  item-11
+  item-12 (id12)
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_Scroll/03-past-bottom.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_Scroll/03-past-bottom.golden
new file mode 100644
index 00000000000..004c522a505
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_Scroll/03-past-bottom.golden
@@ -0,0 +1,7 @@
+Search: █
+? Pick one:
+↑ item-08
+  item-09
+  item-10
+  item-11
+  item-12 (id12)
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_SelectedTemplate/01-initial.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_SelectedTemplate/01-initial.golden
new file mode 100644
index 00000000000..9cf63a935f0
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_SelectedTemplate/01-initial.golden
@@ -0,0 +1,5 @@
+Use the arrow keys to navigate: ↓ ↑ → ←
+? Pick one:
+  > alpha (a)
+    beta (b)
+    gamma (c)
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_SelectedTemplate/02-after-down.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_SelectedTemplate/02-after-down.golden
new file mode 100644
index 00000000000..f6a46c9d5a8
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_SelectedTemplate/02-after-down.golden
@@ -0,0 +1,5 @@
+Use the arrow keys to navigate: ↓ ↑ → ←
+? Pick one:
+    alpha (a)
+  > beta (b)
+    gamma (c)
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_SelectedTemplate/03-after-enter.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_SelectedTemplate/03-after-enter.golden
new file mode 100644
index 00000000000..d6524b62555
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_SelectedTemplate/03-after-enter.golden
@@ -0,0 +1 @@
+Chose: beta (b)
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_SingleItem/01-initial.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_SingleItem/01-initial.golden
new file mode 100644
index 00000000000..89e6a3574fa
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_SingleItem/01-initial.golden
@@ -0,0 +1,3 @@
+Search: █
+? Pick one:
+  only (o)
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_SingleItem/02-after-down.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_SingleItem/02-after-down.golden
new file mode 100644
index 00000000000..89e6a3574fa
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_SingleItem/02-after-down.golden
@@ -0,0 +1,3 @@
+Search: █
+? Pick one:
+  only (o)
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_SlashEntersSearch/01-initial-no-search.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_SlashEntersSearch/01-initial-no-search.golden
new file mode 100644
index 00000000000..521f49fc291
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_SlashEntersSearch/01-initial-no-search.golden
@@ -0,0 +1,5 @@
+Use the arrow keys to navigate: ↓ ↑ → ←  and / toggles search
+? Pick one:
+  > alpha (a)
+    beta (b)
+    gamma (c)
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_SlashEntersSearch/02-after-slash.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_SlashEntersSearch/02-after-slash.golden
new file mode 100644
index 00000000000..5c1a30e492e
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_SlashEntersSearch/02-after-slash.golden
@@ -0,0 +1,5 @@
+Search: █
+? Pick one:
+  > alpha (a)
+    beta (b)
+    gamma (c)
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_SlashEntersSearch/03-filtering-b.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_SlashEntersSearch/03-filtering-b.golden
new file mode 100644
index 00000000000..5c8ba612a79
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_SlashEntersSearch/03-filtering-b.golden
@@ -0,0 +1,3 @@
+Search: b█
+? Pick one:
+  > beta (b)
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_TabKey/01-initial.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_TabKey/01-initial.golden
new file mode 100644
index 00000000000..b2cc3177062
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_TabKey/01-initial.golden
@@ -0,0 +1,5 @@
+Search: █
+? Pick one:
+  alpha (a)
+  beta
+  gamma
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_TabKey/02-after-tab.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_TabKey/02-after-tab.golden
new file mode 100644
index 00000000000..9a608ef2387
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_TabKey/02-after-tab.golden
@@ -0,0 +1,4 @@
+Search:         █
+? Pick one:
+
+No results
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_TabKey/03-after-second-tab.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_TabKey/03-after-second-tab.golden
new file mode 100644
index 00000000000..6b3da6869c6
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_TabKey/03-after-second-tab.golden
@@ -0,0 +1,4 @@
+Search:                 █
+? Pick one:
+
+No results
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_VimKeys/01-initial.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_VimKeys/01-initial.golden
new file mode 100644
index 00000000000..59153261eb5
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_VimKeys/01-initial.golden
@@ -0,0 +1,6 @@
+Search: █
+? Pick one:
+  alpha (a)
+  beta
+  gamma
+  delta
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_VimKeys/02-after-j.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_VimKeys/02-after-j.golden
new file mode 100644
index 00000000000..97d32688007
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_VimKeys/02-after-j.golden
@@ -0,0 +1,4 @@
+Search: j█
+? Pick one:
+
+No results
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_VimKeys/03-after-jk.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_VimKeys/03-after-jk.golden
new file mode 100644
index 00000000000..80c624969a6
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_VimKeys/03-after-jk.golden
@@ -0,0 +1,4 @@
+Search: jk█
+? Pick one:
+
+No results
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_VimKeys/04-after-backspaces.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_VimKeys/04-after-backspaces.golden
new file mode 100644
index 00000000000..59153261eb5
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_VimKeys/04-after-backspaces.golden
@@ -0,0 +1,6 @@
+Search: █
+? Pick one:
+  alpha (a)
+  beta
+  gamma
+  delta
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_VimNavOutsideSearch/01-initial.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_VimNavOutsideSearch/01-initial.golden
new file mode 100644
index 00000000000..3957291d83d
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_VimNavOutsideSearch/01-initial.golden
@@ -0,0 +1,7 @@
+Use the arrow keys to navigate: ↓ ↑ → ←  and / toggles search
+? Pick one:
+  > item-01 (id01)
+    item-02 (id02)
+    item-03 (id03)
+    item-04 (id04)
+↓   item-05 (id05)
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_VimNavOutsideSearch/02-after-jj.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_VimNavOutsideSearch/02-after-jj.golden
new file mode 100644
index 00000000000..9a8227dc8f2
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_VimNavOutsideSearch/02-after-jj.golden
@@ -0,0 +1,7 @@
+Use the arrow keys to navigate: ↓ ↑ → ←  and / toggles search
+? Pick one:
+    item-01 (id01)
+    item-02 (id02)
+  > item-03 (id03)
+    item-04 (id04)
+↓   item-05 (id05)
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_VimNavOutsideSearch/03-after-k.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_VimNavOutsideSearch/03-after-k.golden
new file mode 100644
index 00000000000..c83aa93f333
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_VimNavOutsideSearch/03-after-k.golden
@@ -0,0 +1,7 @@
+Use the arrow keys to navigate: ↓ ↑ → ←  and / toggles search
+? Pick one:
+    item-01 (id01)
+  > item-02 (id02)
+    item-03 (id03)
+    item-04 (id04)
+↓   item-05 (id05)
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_VimNavOutsideSearch/04-after-l-pagedown.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_VimNavOutsideSearch/04-after-l-pagedown.golden
new file mode 100644
index 00000000000..068cc2cd244
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_VimNavOutsideSearch/04-after-l-pagedown.golden
@@ -0,0 +1,7 @@
+Use the arrow keys to navigate: ↓ ↑ → ←  and / toggles search
+? Pick one:
+↑ > item-06 (id06)
+    item-07 (id07)
+    item-08 (id08)
+    item-09 (id09)
+↓   item-10 (id10)
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_VimNavOutsideSearch/05-after-h-pageup.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_VimNavOutsideSearch/05-after-h-pageup.golden
new file mode 100644
index 00000000000..3957291d83d
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_VimNavOutsideSearch/05-after-h-pageup.golden
@@ -0,0 +1,7 @@
+Use the arrow keys to navigate: ↓ ↑ → ←  and / toggles search
+? Pick one:
+  > item-01 (id01)
+    item-02 (id02)
+    item-03 (id03)
+    item-04 (id04)
+↓   item-05 (id05)
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_WrapAround/01-initial.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_WrapAround/01-initial.golden
new file mode 100644
index 00000000000..b2cc3177062
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_WrapAround/01-initial.golden
@@ -0,0 +1,5 @@
+Search: █
+? Pick one:
+  alpha (a)
+  beta
+  gamma
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_WrapAround/02-up-from-top.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_WrapAround/02-up-from-top.golden
new file mode 100644
index 00000000000..b2cc3177062
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_WrapAround/02-up-from-top.golden
@@ -0,0 +1,5 @@
+Search: █
+? Pick one:
+  alpha (a)
+  beta
+  gamma
diff --git a/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_WrapAround/03-down-past-bottom.golden b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_WrapAround/03-down-past-bottom.golden
new file mode 100644
index 00000000000..4318f9daf28
--- /dev/null
+++ b/libs/cmdio/cmdiotest/testdata/TestSelectBaseline_WrapAround/03-down-past-bottom.golden
@@ -0,0 +1,5 @@
+Search: █
+? Pick one:
+  alpha
+  beta
+  gamma (g)
diff --git a/libs/cmdio/color.go b/libs/cmdio/color.go
index 4066b30f75c..4549b31feff 100644
--- a/libs/cmdio/color.go
+++ b/libs/cmdio/color.go
@@ -3,7 +3,12 @@ package cmdio
 import (
 	"context"
 	"fmt"
+	"io"
+	"strings"
 	"text/template"
+
+	"github.com/charmbracelet/lipgloss"
+	"github.com/muesli/termenv"
 )
 
 // SGR (Select Graphic Rendition) escapes; see
@@ -11,7 +16,9 @@ import (
 const (
 	ansiReset     = "\x1b[0m"
 	ansiBold      = "\x1b[1m"
+	ansiFaint     = "\x1b[2m"
 	ansiItalic    = "\x1b[3m"
+	ansiUnderline = "\x1b[4m"
 	ansiRed       = "\x1b[31m"
 	ansiGreen     = "\x1b[32m"
 	ansiYellow    = "\x1b[33m"
@@ -42,6 +49,18 @@ func render(ctx context.Context, code, msg string) string {
 	return code + msg + ansiReset
 }
 
+// Bold renders msg with increased intensity (bold).
+func Bold(ctx context.Context, msg string) string { return render(ctx, ansiBold, msg) }
+
+// Faint renders msg with decreased intensity (faint, dim).
+func Faint(ctx context.Context, msg string) string { return render(ctx, ansiFaint, msg) }
+
+// Italic renders msg in italic.
+func Italic(ctx context.Context, msg string) string { return render(ctx, ansiItalic, msg) }
+
+// Underline renders msg underlined.
+func Underline(ctx context.Context, msg string) string { return render(ctx, ansiUnderline, msg) }
+
 // Red renders msg in red.
 func Red(ctx context.Context, msg string) string { return render(ctx, ansiRed, msg) }
 
@@ -54,6 +73,9 @@ func Yellow(ctx context.Context, msg string) string { return render(ctx, ansiYel
 // Blue renders msg in blue.
 func Blue(ctx context.Context, msg string) string { return render(ctx, ansiBlue, msg) }
 
+// Magenta renders msg in magenta.
+func Magenta(ctx context.Context, msg string) string { return render(ctx, ansiMagenta, msg) }
+
 // Cyan renders msg in cyan.
 func Cyan(ctx context.Context, msg string) string { return render(ctx, ansiCyan, msg) }
 
@@ -68,14 +90,16 @@ func HiBlue(ctx context.Context, msg string) string { return render(ctx, ansiHiB
 // helpers accept a format string + args.
 func RenderFuncMap(ctx context.Context) template.FuncMap {
 	return template.FuncMap{
-		"red":     templateColor(ctx, ansiRed),
-		"green":   templateColor(ctx, ansiGreen),
-		"blue":    templateColor(ctx, ansiBlue),
-		"yellow":  templateColor(ctx, ansiYellow),
-		"magenta": templateColor(ctx, ansiMagenta),
-		"cyan":    templateColor(ctx, ansiCyan),
-		"bold":    templateColor(ctx, ansiBold),
-		"italic":  templateColor(ctx, ansiItalic),
+		"red":       templateColor(ctx, ansiRed),
+		"green":     templateColor(ctx, ansiGreen),
+		"blue":      templateColor(ctx, ansiBlue),
+		"yellow":    templateColor(ctx, ansiYellow),
+		"magenta":   templateColor(ctx, ansiMagenta),
+		"cyan":      templateColor(ctx, ansiCyan),
+		"bold":      templateColor(ctx, ansiBold),
+		"faint":     templateColor(ctx, ansiFaint),
+		"italic":    templateColor(ctx, ansiItalic),
+		"underline": templateColor(ctx, ansiUnderline),
 	}
 }
 
@@ -88,3 +112,45 @@ func templateColor(ctx context.Context, code string) func(string, ...any) string
 		return render(ctx, code, msg)
 	}
 }
+
+// Width returns the visible cell width of s. ANSI color escapes (such as those
+// emitted by the helpers above) are ignored, and wide glyphs like CJK
+// characters and emoji are counted as two cells. Use this instead of len() or
+// utf8.RuneCountInString when aligning columns of rendered text.
+func Width(s string) int {
+	return lipgloss.Width(s)
+}
+
+// PadRight returns s padded with trailing spaces to a visible width of n (see
+// Width). Because it measures the rendered string, cells already wrapped by the
+// color helpers stay aligned. Strings at or beyond width n are returned as-is.
+func PadRight(s string, n int) string {
+	if pad := n - Width(s); pad > 0 {
+		return s + strings.Repeat(" ", pad)
+	}
+	return s
+}
+
+// PadLeft returns s padded with leading spaces to a visible width of n (see
+// Width), right-aligning the rendered content. Strings at or beyond width n are
+// returned as-is.
+func PadLeft(s string, n int) string {
+	if pad := n - Width(s); pad > 0 {
+		return strings.Repeat(" ", pad) + s
+	}
+	return s
+}
+
+// NewRenderer returns a lipgloss renderer targeting w, along with whether w
+// supports color. When it does not (NO_COLOR, TERM=dumb, or w is piped or
+// redirected) the renderer is forced to the Ascii profile so every Style it
+// mints emits no SGR escapes. Callers still write rendered strings to w
+// themselves; the renderer only carries the color profile.
+func NewRenderer(ctx context.Context, w io.Writer) (*lipgloss.Renderer, bool) {
+	color := SupportsColor(ctx, w)
+	r := lipgloss.NewRenderer(w)
+	if !color {
+		r.SetColorProfile(termenv.Ascii)
+	}
+	return r, color
+}
diff --git a/libs/cmdio/color_test.go b/libs/cmdio/color_test.go
index 54df1859827..404f0c12cdb 100644
--- a/libs/cmdio/color_test.go
+++ b/libs/cmdio/color_test.go
@@ -1,10 +1,12 @@
 package cmdio_test
 
 import (
+	"bytes"
 	"context"
 	"testing"
 
 	"github.com/databricks/cli/libs/cmdio"
+	"github.com/muesli/termenv"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -27,10 +29,15 @@ func TestColorHelpersEmitSGRWhenEnabled(t *testing.T) {
 		got  string
 		want string
 	}{
+		{"Bold", cmdio.Bold(ctx, "id"), "\x1b[1mid\x1b[0m"},
+		{"Faint", cmdio.Faint(ctx, "hint"), "\x1b[2mhint\x1b[0m"},
+		{"Italic", cmdio.Italic(ctx, "em"), "\x1b[3mem\x1b[0m"},
+		{"Underline", cmdio.Underline(ctx, "link"), "\x1b[4mlink\x1b[0m"},
 		{"Red", cmdio.Red(ctx, "hello"), "\x1b[31mhello\x1b[0m"},
 		{"Green", cmdio.Green(ctx, "ok"), "\x1b[32mok\x1b[0m"},
 		{"Yellow", cmdio.Yellow(ctx, "warn"), "\x1b[33mwarn\x1b[0m"},
 		{"Blue", cmdio.Blue(ctx, "info"), "\x1b[34minfo\x1b[0m"},
+		{"Magenta", cmdio.Magenta(ctx, "trace"), "\x1b[35mtrace\x1b[0m"},
 		{"Cyan", cmdio.Cyan(ctx, "debug"), "\x1b[36mdebug\x1b[0m"},
 		{"HiBlack", cmdio.HiBlack(ctx, "dim"), "\x1b[90mdim\x1b[0m"},
 		{"HiBlue", cmdio.HiBlue(ctx, "APP"), "\x1b[94mAPP\x1b[0m"},
@@ -60,11 +67,83 @@ func TestColorHelpersDoNotPanicWithoutCmdIO(t *testing.T) {
 	assert.Equal(t, "label: ", cmdio.Cyan(ctx, "label: "))
 }
 
+func TestWidth(t *testing.T) {
+	cases := []struct {
+		name string
+		in   string
+		want int
+	}{
+		{"empty", "", 0},
+		{"ascii", "hello", 5},
+		{"ansi wrapped", "\x1b[1mhello\x1b[0m", 5},
+		{"nested ansi", "\x1b[1m\x1b[36mid\x1b[0m", 2},
+		{"fullwidth latin", "ＮＡＭＥ", 8},
+		{"emoji", "🚀", 2},
+		{"ansi wrapped fullwidth", "\x1b[36mＣＬＩ\x1b[0m", 6},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			assert.Equal(t, c.want, cmdio.Width(c.in))
+		})
+	}
+}
+
+func TestPadRight(t *testing.T) {
+	cases := []struct {
+		name string
+		in   string
+		n    int
+		want string
+	}{
+		{"pads ascii", "hi", 5, "hi   "},
+		{"exact width unchanged", "hello", 5, "hello"},
+		{"over width unchanged", "toolong", 3, "toolong"},
+		{"measures past ansi", "\x1b[1mhi\x1b[0m", 5, "\x1b[1mhi\x1b[0m   "},
+		{"counts wide glyphs", "ＣＬＩ", 8, "ＣＬＩ  "},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			assert.Equal(t, c.want, cmdio.PadRight(c.in, c.n))
+		})
+	}
+}
+
+func TestPadLeft(t *testing.T) {
+	cases := []struct {
+		name string
+		in   string
+		n    int
+		want string
+	}{
+		{"pads ascii", "hi", 5, "   hi"},
+		{"exact width unchanged", "hello", 5, "hello"},
+		{"over width unchanged", "toolong", 3, "toolong"},
+		{"measures past ansi", "\x1b[1mhi\x1b[0m", 5, "   \x1b[1mhi\x1b[0m"},
+		{"counts wide glyphs", "ＣＬＩ", 8, "  ＣＬＩ"},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			assert.Equal(t, c.want, cmdio.PadLeft(c.in, c.n))
+		})
+	}
+}
+
+func TestNewRendererForcesAsciiWhenNoColor(t *testing.T) {
+	ctx := noColorContext(t)
+
+	// A bytes.Buffer is never a TTY, so the renderer must fall back to Ascii and
+	// its styles must render without SGR escapes.
+	r, color := cmdio.NewRenderer(ctx, &bytes.Buffer{})
+	assert.False(t, color)
+	assert.Equal(t, termenv.Ascii, r.ColorProfile())
+	assert.Equal(t, "hi", r.NewStyle().Bold(true).Render("hi"))
+}
+
 func TestRenderFuncMap(t *testing.T) {
 	ctx := ttyContext(t)
 	fm := cmdio.RenderFuncMap(ctx)
 
-	for _, name := range []string{"red", "green", "blue", "yellow", "magenta", "cyan", "bold", "italic"} {
+	for _, name := range []string{"red", "green", "blue", "yellow", "magenta", "cyan", "bold", "faint", "italic", "underline"} {
 		_, ok := fm[name].(func(string, ...any) string)
 		assert.True(t, ok, "FuncMap missing %q or wrong signature", name)
 	}
diff --git a/libs/cmdio/compat.go b/libs/cmdio/compat.go
deleted file mode 100644
index 95c1ca2d001..00000000000
--- a/libs/cmdio/compat.go
+++ /dev/null
@@ -1,136 +0,0 @@
-package cmdio
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"strings"
-
-	"github.com/manifoldco/promptui"
-)
-
-/*
-Temporary compatibility layer for the progress logger interfaces.
-*/
-
-// Log is a compatibility layer for the progress logger interfaces.
-// It writes the string representation of the stringer to the error writer.
-func Log(ctx context.Context, str fmt.Stringer) {
-	LogString(ctx, str.String())
-}
-
-// LogString is a compatibility layer for the progress logger interfaces.
-// It writes the string to the error writer.
-func LogString(ctx context.Context, str string) {
-	c := fromContext(ctx)
-	_, _ = io.WriteString(c.err, str+"\n")
-}
-
-// readLine reads a line from the reader and returns it without the trailing newline characters.
-// It is unbuffered because cmdio's stdin is also unbuffered.
-// If we were to add a [bufio.Reader] to the mix, we would need to update the other uses of the reader.
-// Once cmdio's stdio is made to be buffered, this function can be removed.
-func readLine(r io.Reader) (string, error) {
-	var b strings.Builder
-	buf := make([]byte, 1)
-	for {
-		n, err := r.Read(buf)
-		if n > 0 {
-			if buf[0] == '\n' {
-				break
-			}
-			if buf[0] != '\r' {
-				b.WriteByte(buf[0])
-			}
-		}
-		if err != nil {
-			if b.Len() == 0 {
-				return "", err
-			}
-			break
-		}
-	}
-	return b.String(), nil
-}
-
-// Ask is a compatibility layer for the progress logger interfaces.
-// It prompts the user with a question and returns the answer.
-func Ask(ctx context.Context, question, defaultVal string) (string, error) {
-	c := fromContext(ctx)
-
-	// Add default value to question prompt.
-	if defaultVal != "" {
-		question += fmt.Sprintf(` [%s]`, defaultVal)
-	}
-	question += `: `
-
-	// Print prompt.
-	_, err := io.WriteString(c.err, question)
-	if err != nil {
-		return "", err
-	}
-
-	// Read user input. Trim new line characters.
-	ans, err := readLine(c.in)
-	if err != nil {
-		return "", err
-	}
-
-	// Return default value if user just presses enter.
-	if ans == "" {
-		return defaultVal, nil
-	}
-
-	return ans, nil
-}
-
-// AskYesOrNo is a compatibility layer for the progress logger interfaces.
-// It prompts the user with a question and returns the answer.
-func AskYesOrNo(ctx context.Context, question string) (bool, error) {
-	ans, err := Ask(ctx, question+" [y/N]", "")
-	if err != nil {
-		return false, err
-	}
-	ans = strings.ToLower(strings.TrimSpace(ans))
-	return ans == "y" || ans == "yes", nil
-}
-
-func splitAtLastNewLine(s string) (string, string) {
-	// Split at the newline character
-	if i := strings.LastIndex(s, "\n"); i != -1 {
-		return s[:i+1], s[i+1:]
-	}
-	// Return the original string if no newline found
-	return "", s
-}
-
-// AskSelect is a compatibility layer for the progress logger interfaces.
-// It prompts the user with a question and returns the answer.
-func AskSelect(ctx context.Context, question string, choices []string) (string, error) {
-	c := fromContext(ctx)
-
-	// Promptui does not support multiline prompts. So we split the question.
-	first, last := splitAtLastNewLine(question)
-	_, err := io.WriteString(c.err, first)
-	if err != nil {
-		return "", err
-	}
-
-	prompt := promptui.Select{
-		Label:    last,
-		Items:    choices,
-		HideHelp: true,
-		Templates: &promptui.SelectTemplates{
-			Label:    "{{.}}: ",
-			Selected: last + ": {{.}}",
-		},
-		Stdin:  c.promptStdin(),
-		Stdout: nopWriteCloser{c.err},
-	}
-
-	_, ans, err := prompt.Run()
-	if err != nil {
-		return "", err
-	}
-	return ans, nil
-}
diff --git a/libs/cmdio/compat_test.go b/libs/cmdio/compat_test.go
deleted file mode 100644
index 3323556e8bf..00000000000
--- a/libs/cmdio/compat_test.go
+++ /dev/null
@@ -1,227 +0,0 @@
-package cmdio
-
-import (
-	"errors"
-	"io"
-	"strings"
-	"testing"
-
-	"github.com/databricks/cli/libs/flags"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestCompat_readLine(t *testing.T) {
-	tests := []struct {
-		name       string
-		reader     io.Reader
-		want       string
-		wantErr    bool
-		errContain string
-	}{
-		{
-			name:   "basic line with LF",
-			reader: strings.NewReader("hello\n"),
-			want:   "hello",
-		},
-		{
-			name:   "line with CRLF",
-			reader: strings.NewReader("hello\r\n"),
-			want:   "hello",
-		},
-		{
-			name:   "line with only CR",
-			reader: strings.NewReader("hello\r"),
-			want:   "hello",
-		},
-		{
-			name:   "empty line with LF",
-			reader: strings.NewReader("\n"),
-			want:   "",
-		},
-		{
-			name:   "empty line with CRLF",
-			reader: strings.NewReader("\r\n"),
-			want:   "",
-		},
-		{
-			name:   "line without newline at EOF",
-			reader: strings.NewReader("hello"),
-			want:   "hello",
-		},
-		{
-			name:   "multi-line input stops at first newline",
-			reader: strings.NewReader("hello\nworld\n"),
-			want:   "hello",
-		},
-		{
-			name:   "line with multiple CR characters",
-			reader: strings.NewReader("hello\r\rworld\n"),
-			want:   "helloworld",
-		},
-		{
-			name:   "line with CR in middle",
-			reader: strings.NewReader("hello\rworld\n"),
-			want:   "helloworld",
-		},
-		{
-			name:   "line with spaces and special chars",
-			reader: strings.NewReader("hello world!@#$%\n"),
-			want:   "hello world!@#$%",
-		},
-		{
-			name:   "unicode characters",
-			reader: strings.NewReader("hello 世界\n"),
-			want:   "hello 世界",
-		},
-		{
-			name:       "empty reader",
-			reader:     strings.NewReader(""),
-			want:       "",
-			wantErr:    true,
-			errContain: "EOF",
-		},
-		{
-			name:       "reader with error",
-			reader:     &errorReader{err: errors.New("read error")},
-			want:       "",
-			wantErr:    true,
-			errContain: "read error",
-		},
-		{
-			name:   "reader with error after some data",
-			reader: &errorAfterNReader{data: []byte("hello"), n: 3, err: io.ErrUnexpectedEOF},
-			want:   "hel",
-		},
-		{
-			name:   "long line",
-			reader: strings.NewReader(strings.Repeat("a", 1000) + "\n"),
-			want:   strings.Repeat("a", 1000),
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			got, err := readLine(test.reader)
-			if test.wantErr {
-				require.Error(t, err)
-				if test.errContain != "" {
-					assert.Contains(t, err.Error(), test.errContain)
-				}
-			} else {
-				require.NoError(t, err)
-			}
-			assert.Equal(t, test.want, got)
-		})
-	}
-}
-
-// errorReader is a test helper that always returns an error
-type errorReader struct {
-	err error
-}
-
-func (e *errorReader) Read(p []byte) (n int, err error) {
-	return 0, e.err
-}
-
-// errorAfterNReader is a test helper that returns data for n reads, then returns an error
-type errorAfterNReader struct {
-	data  []byte
-	n     int
-	count int
-	err   error
-}
-
-func (e *errorAfterNReader) Read(p []byte) (n int, err error) {
-	if e.count >= e.n {
-		return 0, e.err
-	}
-	if len(p) == 0 {
-		return 0, nil
-	}
-	if e.count < len(e.data) {
-		p[0] = e.data[e.count]
-		e.count++
-		return 1, nil
-	}
-	return 0, e.err
-}
-
-func TestCompat_splitAtLastNewLine(t *testing.T) {
-	tests := []struct {
-		name      string
-		input     string
-		wantFirst string
-		wantLast  string
-	}{
-		{
-			name:      "LF newline in middle",
-			input:     "hello\nworld",
-			wantFirst: "hello\n",
-			wantLast:  "world",
-		},
-		{
-			name:      "CRLF newline in middle",
-			input:     "hello\r\nworld",
-			wantFirst: "hello\r\n",
-			wantLast:  "world",
-		},
-		{
-			name:      "no newline",
-			input:     "hello world",
-			wantFirst: "",
-			wantLast:  "hello world",
-		},
-		{
-			name:      "newline at end",
-			input:     "hello\nworld\n",
-			wantFirst: "hello\nworld\n",
-			wantLast:  "",
-		},
-		{
-			name:      "newline at start",
-			input:     "\nhello world",
-			wantFirst: "\n",
-			wantLast:  "hello world",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			first, last := splitAtLastNewLine(tt.input)
-			assert.Equal(t, tt.wantFirst, first)
-			assert.Equal(t, tt.wantLast, last)
-		})
-	}
-}
-
-func TestCompat_AskYesOrNo(t *testing.T) {
-	tests := []struct {
-		name  string
-		input string
-		want  bool
-	}{
-		{name: "y", input: "y\n", want: true},
-		{name: "yes", input: "yes\n", want: true},
-		{name: "Y", input: "Y\n", want: true},
-		{name: "YES", input: "YES\n", want: true},
-		{name: "Yes", input: "Yes\n", want: true},
-		{name: "y with surrounding whitespace", input: "  y  \n", want: true},
-		{name: "yes with CRLF", input: "yes\r\n", want: true},
-		{name: "empty", input: "\n", want: false},
-		{name: "n", input: "n\n", want: false},
-		{name: "no", input: "no\n", want: false},
-		{name: "yeah", input: "yeah\n", want: false},
-		{name: "gibberish", input: "foobar\n", want: false},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			ctx := t.Context()
-			ctx = InContext(ctx, NewIO(ctx, flags.OutputText, strings.NewReader(tt.input), io.Discard, io.Discard, "", ""))
-			got, err := AskYesOrNo(ctx, "Proceed?")
-			require.NoError(t, err)
-			assert.Equal(t, tt.want, got)
-		})
-	}
-}
diff --git a/libs/cmdio/io.go b/libs/cmdio/io.go
index d4c4f42e27a..2b9b395ce13 100644
--- a/libs/cmdio/io.go
+++ b/libs/cmdio/io.go
@@ -2,18 +2,38 @@ package cmdio
 
 import (
 	"context"
-	"fmt"
+	"errors"
 	"io"
-	"os"
-	"slices"
 	"strings"
 	"sync"
 
 	tea "github.com/charmbracelet/bubbletea"
 	"github.com/databricks/cli/libs/flags"
-	"github.com/manifoldco/promptui"
 )
 
+// errCtrlC is returned when the user cancels a TUI prompt with Ctrl+C. The
+// "^C" string matches the historical wire format; goldens depend on it.
+var errCtrlC = errors.New("^C")
+
+// runTUI runs a tea.Program through cmdIO's tea program slot so spinners and
+// pagers can't fight a prompt for the terminal. Blocks until the model quits.
+func (c *cmdIO) runTUI(m tea.Model) (tea.Model, error) {
+	p := tea.NewProgram(m,
+		tea.WithInput(c.in),
+		tea.WithOutput(c.err),
+		// Ctrl+C is delivered as a key event so the model can return errCtrlC.
+		tea.WithoutSignalHandler(),
+	)
+	c.acquireTeaProgram(p)
+	defer c.releaseTeaProgram()
+	// NewTestIO sets a synthetic window size because bubbletea's auto-detect
+	// doesn't fire on pipe-backed streams. Nil in production.
+	if c.teaWindowSize != nil {
+		go p.Send(*c.teaWindowSize)
+	}
+	return p.Run()
+}
+
 // cmdIO is the private instance, that is not supposed to be accessed
 // outside of `cmdio` package. Use the public package-level functions
 // to access the inner state.
@@ -39,6 +59,11 @@ type cmdIO struct {
 	teaMu      sync.Mutex
 	teaProgram *tea.Program
 	teaDone    chan struct{}
+
+	// teaWindowSize, when non-nil, is delivered to the tea.Program before any
+	// user input is processed. Populated only by NewTestIO so pipe-backed
+	// test runs receive a synthetic WindowSizeMsg.
+	teaWindowSize *tea.WindowSizeMsg
 }
 
 func NewIO(ctx context.Context, outputFormat flags.Output, in io.Reader, out, err io.Writer, headerTemplate, template string) *cmdIO {
@@ -58,6 +83,15 @@ func IsPromptSupported(ctx context.Context) bool {
 	return c.capabilities.SupportsPrompt()
 }
 
+// IsPagerSupported reports whether stdin, stdout, and stderr are all interactive
+// terminals. This is the requirement for a full-screen or navigable output
+// program: unlike IsPromptSupported it also checks stdout, so it returns false
+// when stdout is piped or redirected.
+func IsPagerSupported(ctx context.Context) bool {
+	c := fromContext(ctx)
+	return c.capabilities.SupportsPager()
+}
+
 // SupportsColor returns true if the given writer supports colored output.
 // This checks both TTY status and environment variables (NO_COLOR, TERM=dumb).
 func SupportsColor(ctx context.Context, w io.Writer) bool {
@@ -72,95 +106,6 @@ func GetInteractiveMode(ctx context.Context) InteractiveMode {
 	return c.capabilities.InteractiveMode()
 }
 
-type Tuple struct{ Name, Id string }
-
-func (c *cmdIO) Select(items []Tuple, label string) (id string, err error) {
-	if !c.capabilities.SupportsInteractive() {
-		return "", fmt.Errorf("expected to have %s", label)
-	}
-
-	idx, _, err := (&promptui.Select{
-		Label:             label,
-		Items:             items,
-		HideSelected:      true,
-		StartInSearchMode: true,
-		Searcher: func(input string, idx int) bool {
-			lower := strings.ToLower(items[idx].Name)
-			return strings.Contains(lower, strings.ToLower(input))
-		},
-		Templates: &promptui.SelectTemplates{
-			Active:   `{{.Name | bold}} ({{.Id|faint}})`,
-			Inactive: `{{.Name}}`,
-		},
-		Stdin:  c.promptStdin(),
-		Stdout: nopWriteCloser{c.err},
-	}).Run()
-	if err != nil {
-		return id, err
-	}
-	id = items[idx].Id
-	return id, err
-}
-
-// Show a selection prompt where the user can pick one of the name/id items.
-// The items are sorted alphabetically by name.
-func Select[V any](ctx context.Context, names map[string]V, label string) (id string, err error) {
-	c := fromContext(ctx)
-	var items []Tuple
-	for k, v := range names {
-		items = append(items, Tuple{k, fmt.Sprint(v)})
-	}
-	slices.SortFunc(items, func(a, b Tuple) int {
-		return strings.Compare(a.Name, b.Name)
-	})
-	return c.Select(items, label)
-}
-
-// Show a selection prompt where the user can pick one of the name/id items.
-// The items appear in the order specified in the "items" argument.
-func SelectOrdered(ctx context.Context, items []Tuple, label string) (id string, err error) {
-	c := fromContext(ctx)
-	return c.Select(items, label)
-}
-
-func (c *cmdIO) Secret(label string) (value string, err error) {
-	prompt := (promptui.Prompt{
-		Label:       label,
-		Mask:        '*',
-		HideEntered: true,
-		Stdin:       c.promptStdin(),
-		Stdout:      nopWriteCloser{c.err},
-	})
-
-	return prompt.Run()
-}
-
-func Secret(ctx context.Context, label string) (value string, err error) {
-	c := fromContext(ctx)
-	return c.Secret(label)
-}
-
-// promptStdin returns the stdin reader for use with promptui.
-// If the reader is os.Stdin, it returns nil to let the underlying readline
-// library use its platform-specific default. On Windows, this is critical
-// because readline's default uses ReadConsoleInputW to read arrow keys
-// as virtual key events. Passing a wrapped os.Stdin would bypass this
-// and break arrow key navigation in selection prompts.
-func (c *cmdIO) promptStdin() io.ReadCloser {
-	if c.in == os.Stdin {
-		return nil
-	}
-	return io.NopCloser(c.in)
-}
-
-type nopWriteCloser struct {
-	io.Writer
-}
-
-func (nopWriteCloser) Close() error {
-	return nil
-}
-
 // NewSpinner creates a new spinner for displaying progress indicators.
 // The returned spinner should be closed when done to release resources.
 //
@@ -188,6 +133,15 @@ func InContext(ctx context.Context, io *cmdIO) context.Context {
 	return context.WithValue(ctx, cmdIOKey, io)
 }
 
+// HasIO reports whether a cmdIO is set on this context. Commands can assume it
+// is (the root command's PersistentPreRunE installs it), but code that can run
+// before or without that hook (e.g. cobra resolves --help and bare invocations
+// before running hooks) must check first to avoid the panic in fromContext.
+func HasIO(ctx context.Context) bool {
+	_, ok := ctx.Value(cmdIOKey).(*cmdIO)
+	return ok
+}
+
 func fromContext(ctx context.Context) *cmdIO {
 	io, ok := ctx.Value(cmdIOKey).(*cmdIO)
 	if !ok {
@@ -220,8 +174,14 @@ func (c *cmdIO) acquireTeaProgram(p *tea.Program) {
 	defer c.teaMu.Unlock()
 
 	// Wait for existing program to finish
-	if c.teaDone != nil {
-		<-c.teaDone
+	// Receive with teaMu released: releaseTeaProgram locks teaMu to close
+	// teaDone, so waiting while holding it would deadlock. Loop because another
+	// acquirer may register a new program before the lock is reacquired.
+	for c.teaDone != nil {
+		done := c.teaDone
+		c.teaMu.Unlock()
+		<-done
+		c.teaMu.Lock()
 	}
 
 	// Register new program
diff --git a/libs/cmdio/io_test.go b/libs/cmdio/io_test.go
new file mode 100644
index 00000000000..23872d5f95c
--- /dev/null
+++ b/libs/cmdio/io_test.go
@@ -0,0 +1,36 @@
+package cmdio
+
+import (
+	"testing"
+	"time"
+)
+
+func TestAcquireTeaProgramWaitsForRelease(t *testing.T) {
+	c := &cmdIO{}
+	// acquireTeaProgram only stores the pointer, so a nil program suffices.
+	c.acquireTeaProgram(nil)
+
+	acquired := make(chan struct{})
+	go func() {
+		c.acquireTeaProgram(nil)
+		close(acquired)
+	}()
+
+	select {
+	case <-acquired:
+		t.Fatal("second acquireTeaProgram returned while the first program was still active")
+	case <-time.After(50 * time.Millisecond):
+	}
+
+	// Release on a goroutine so a regressed deadlock fails the timeout below
+	// instead of hanging the test.
+	go c.releaseTeaProgram()
+
+	select {
+	case <-acquired:
+	case <-time.After(5 * time.Second):
+		t.Fatal("second acquireTeaProgram did not return after the first program was released")
+	}
+
+	c.releaseTeaProgram()
+}
diff --git a/libs/cmdio/log.go b/libs/cmdio/log.go
new file mode 100644
index 00000000000..8b61664c945
--- /dev/null
+++ b/libs/cmdio/log.go
@@ -0,0 +1,43 @@
+package cmdio
+
+import (
+	"context"
+	"fmt"
+	"io"
+)
+
+// Log calls [LogString] with the string representation of str.
+func Log(ctx context.Context, str fmt.Stringer) {
+	LogString(ctx, str.String())
+}
+
+// LogString writes str to the error writer, followed by a newline.
+func LogString(ctx context.Context, str string) {
+	c := fromContext(ctx)
+	_, _ = io.WriteString(c.err, str+"\n")
+}
+
+type quietKey struct{}
+
+// WithQuiet returns a context in which [LogProgress] writes nothing. Only
+// progress output is affected: diagnostics go through libs/logdiag, and command
+// results go through [LogString], so neither is suppressed.
+func WithQuiet(ctx context.Context) context.Context {
+	return context.WithValue(ctx, quietKey{}, true)
+}
+
+// IsQuiet reports whether progress output is suppressed on this context.
+func IsQuiet(ctx context.Context) bool {
+	quiet, ok := ctx.Value(quietKey{}).(bool)
+	return ok && quiet
+}
+
+// LogProgress writes str like [LogString], unless the context is marked quiet by
+// [WithQuiet]. Use it for messages that only report what the command is doing
+// ("Uploading ...", "Building ..."), not for results the user asked for.
+func LogProgress(ctx context.Context, str string) {
+	if IsQuiet(ctx) {
+		return
+	}
+	LogString(ctx, str)
+}
diff --git a/libs/cmdio/log_test.go b/libs/cmdio/log_test.go
new file mode 100644
index 00000000000..c3873444572
--- /dev/null
+++ b/libs/cmdio/log_test.go
@@ -0,0 +1,41 @@
+package cmdio_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestLogProgressWritesWhenNotQuiet(t *testing.T) {
+	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
+
+	cmdio.LogProgress(ctx, "Uploading bundle files")
+
+	assert.Contains(t, stderr.String(), "Uploading bundle files")
+}
+
+func TestLogProgressSuppressedWhenQuiet(t *testing.T) {
+	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
+	ctx = cmdio.WithQuiet(ctx)
+
+	cmdio.LogProgress(ctx, "Uploading bundle files")
+
+	assert.Empty(t, stderr.String())
+}
+
+// LogString is for results the user asked for, so -qq must not silence it.
+func TestLogStringNotAffectedByQuiet(t *testing.T) {
+	ctx, stderr := cmdio.NewTestContextWithStderr(t.Context())
+	ctx = cmdio.WithQuiet(ctx)
+
+	cmdio.LogString(ctx, "Resources: 1 created")
+
+	assert.Contains(t, stderr.String(), "Resources: 1 created")
+}
+
+func TestIsQuiet(t *testing.T) {
+	ctx := t.Context()
+	assert.False(t, cmdio.IsQuiet(ctx))
+	assert.True(t, cmdio.IsQuiet(cmdio.WithQuiet(ctx)))
+}
diff --git a/libs/cmdio/paged_template.go b/libs/cmdio/paged_template.go
index f0eccc71f6c..c922c079143 100644
--- a/libs/cmdio/paged_template.go
+++ b/libs/cmdio/paged_template.go
@@ -103,7 +103,7 @@ func renderIteratorPagedTemplateCore[T any](
 		rowT:      rowT,
 		headerStr: headerTemplate,
 	}
-	m := newPagerModel(ctx, iter, pager, pageSize, limitFromContext(ctx))
+	m := newPagerModel(ctx, out, iter, pager, pageSize, limitFromContext(ctx))
 	p := tea.NewProgram(
 		m,
 		tea.WithInput(in),
diff --git a/libs/cmdio/paged_template_test.go b/libs/cmdio/paged_template_test.go
index 013f9ff0c58..03a5fc1c9d5 100644
--- a/libs/cmdio/paged_template_test.go
+++ b/libs/cmdio/paged_template_test.go
@@ -190,7 +190,7 @@ func assertSameContentLines(t *testing.T, want, got string) {
 	t.Helper()
 	wantLines := nonEmptyLines(want)
 	gotLines := nonEmptyLines(got)
-	require.Equal(t, len(wantLines), len(gotLines), "line count mismatch\nwant:\n%s\ngot:\n%s", want, got)
+	require.Len(t, gotLines, len(wantLines), "line count mismatch\nwant:\n%s\ngot:\n%s", want, got)
 	for i := range wantLines {
 		assert.Equal(t, wantLines[i], gotLines[i], "line %d", i)
 	}
diff --git a/libs/cmdio/pager.go b/libs/cmdio/pager.go
index 6070e2f2ff1..0ecb330e5cd 100644
--- a/libs/cmdio/pager.go
+++ b/libs/cmdio/pager.go
@@ -2,6 +2,7 @@ package cmdio
 
 import (
 	"context"
+	"io"
 	"strings"
 	"time"
 
@@ -38,8 +39,11 @@ type pagerModel[T any] struct {
 	spinner bubblespinner.Model
 	// fetch is bound at construction with the caller's context captured
 	// so we don't have to stash ctx on the struct (tea.Cmd has no ctx
-	// parameter of its own).
-	fetch    func() tea.Msg
+	// parameter of its own). It takes the paging state as arguments and
+	// returns a pure Cmd: bubbletea runs Cmds on their own goroutine
+	// concurrently with Update, so the returned closure must not read or
+	// write the model.
+	fetch    func(pageSize, limit, total int) tea.Cmd
 	pageSize int
 	limit    int
 	total    int
@@ -59,6 +63,7 @@ type pagerModel[T any] struct {
 // struct has to hold onto a context.
 func newPagerModel[T any](
 	ctx context.Context,
+	out io.Writer,
 	iter listing.Iterator[T],
 	pager *templatePager,
 	pageSize, limit int,
@@ -66,47 +71,55 @@ func newPagerModel[T any](
 	m := &pagerModel[T]{
 		iter:     iter,
 		pager:    pager,
-		spinner:  newPagerSpinner(),
+		spinner:  newPagerSpinner(ctx, out),
 		pageSize: pageSize,
 		limit:    limit,
 	}
-	m.fetch = func() tea.Msg { return m.doFetch(ctx) }
+	m.fetch = func(pageSize, limit, total int) tea.Cmd {
+		return func() tea.Msg { return m.doFetch(ctx, pageSize, limit, total) }
+	}
 	return m
 }
 
 // newPagerSpinner builds a spinner matching the one the cmdio package's
 // NewSpinner uses, so interactive feedback looks the same everywhere.
-func newPagerSpinner() bubblespinner.Model {
+func newPagerSpinner(ctx context.Context, out io.Writer) bubblespinner.Model {
 	s := bubblespinner.New()
 	s.Spinner = bubblespinner.Spinner{
 		Frames: []string{"⣾", "⣽", "⣻", "⢿", "⡿", "⣟", "⣯", "⣷"},
 		FPS:    time.Second / 5,
 	}
-	s.Style = lipgloss.NewStyle().Foreground(lipgloss.Color("10"))
+	r, _ := NewRenderer(ctx, out)
+	s.Style = r.NewStyle().Foreground(lipgloss.Color("10"))
 	return s
 }
 
-// batchMsg carries the rendered lines from one fetch. done is true when
-// the iterator is exhausted or the limit is reached.
+// batchMsg carries the rendered lines from one fetch. count is the number
+// of rows fetched, added to m.total in Update. done is true when the
+// iterator is exhausted or the limit is reached.
 type batchMsg struct {
 	lines []string
+	count int
 	done  bool
 	err   error
 }
 
 func (m *pagerModel[T]) Init() tea.Cmd {
 	m.fetching = true
-	return tea.Batch(m.fetch, m.spinner.Tick)
+	return tea.Batch(m.fetch(m.pageSize, m.limit, m.total), m.spinner.Tick)
 }
 
 // doFetch reads one page from the iterator and renders it into lines.
 // It runs off the update loop so a slow network fetch doesn't stall
-// key handling.
-func (m *pagerModel[T]) doFetch(ctx context.Context) tea.Msg {
-	buf := make([]any, 0, m.pageSize)
+// key handling. The paging state is passed in rather than read off the
+// model: bubbletea runs this on its own goroutine concurrently with
+// Update, so it must not touch shared model fields. m.iter and m.pager
+// are exempt because only one fetch is ever in flight at a time.
+func (m *pagerModel[T]) doFetch(ctx context.Context, pageSize, limit, total int) tea.Msg {
+	buf := make([]any, 0, pageSize)
 	done := false
-	for len(buf) < m.pageSize {
-		if m.limit > 0 && m.total+len(buf) >= m.limit {
+	for len(buf) < pageSize {
+		if limit > 0 && total+len(buf) >= limit {
 			done = true
 			break
 		}
@@ -124,8 +137,11 @@ func (m *pagerModel[T]) doFetch(ctx context.Context) tea.Msg {
 	if err != nil {
 		return batchMsg{err: err}
 	}
-	m.total += len(buf)
-	return batchMsg{lines: lines, done: done}
+	// The loop exits on len(buf) == pageSize before re-checking the limit,
+	// so a page that lands exactly on the limit leaves done false. Re-check
+	// here to avoid scheduling one more (empty) fetch on drain/advance.
+	done = done || (limit > 0 && total+len(buf) >= limit)
+	return batchMsg{lines: lines, count: len(buf), done: done}
 }
 
 func (m *pagerModel[T]) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
@@ -145,6 +161,7 @@ func (m *pagerModel[T]) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 			m.err = msg.err
 			return m, tea.Quit
 		}
+		m.total += msg.count
 		m.hasPrinted = true
 		// One Println cmd (not N) keeps the batch ordered even though
 		// tea.Sequence dispatches each cmd on its own goroutine.
@@ -158,7 +175,7 @@ func (m *pagerModel[T]) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 			return m, tea.Sequence(printCmd, tea.Quit)
 		case m.drainAll:
 			m.fetching = true
-			return m, tea.Sequence(printCmd, m.fetch)
+			return m, tea.Sequence(printCmd, m.fetch(m.pageSize, m.limit, m.total))
 		default:
 			return m, printCmd
 		}
@@ -196,7 +213,7 @@ func (m *pagerModel[T]) startAdvance() tea.Cmd {
 		return nil
 	}
 	m.fetching = true
-	return m.fetch
+	return m.fetch(m.pageSize, m.limit, m.total)
 }
 
 func (m *pagerModel[T]) startDrain() tea.Cmd {
@@ -210,7 +227,7 @@ func (m *pagerModel[T]) startDrain() tea.Cmd {
 		return nil
 	}
 	m.fetching = true
-	return m.fetch
+	return m.fetch(m.pageSize, m.limit, m.total)
 }
 
 func (m *pagerModel[T]) View() string {
diff --git a/libs/cmdio/pager_test.go b/libs/cmdio/pager_test.go
index 645b26cbd04..503172e7176 100644
--- a/libs/cmdio/pager_test.go
+++ b/libs/cmdio/pager_test.go
@@ -2,6 +2,7 @@ package cmdio
 
 import (
 	"errors"
+	"io"
 	"reflect"
 	"testing"
 	"text/template"
@@ -20,7 +21,7 @@ func newTestPager(t *testing.T, iter listing.Iterator[int], pageSize int) *pager
 	require.NoError(t, err)
 	headerT, err := template.New("header").Funcs(fm).Parse("")
 	require.NoError(t, err)
-	return newPagerModel(ctx, iter, &templatePager{
+	return newPagerModel(ctx, io.Discard, iter, &templatePager{
 		headerT: headerT,
 		rowT:    rowT,
 	}, pageSize, 0)
@@ -44,7 +45,7 @@ func unwrapCmds(t *testing.T, msg tea.Msg) []tea.Cmd {
 	require.Equal(t, reflect.Slice, rv.Kind(), "expected a slice-of-cmds msg, got %T", msg)
 	cmds := make([]tea.Cmd, rv.Len())
 	for i := range cmds {
-		c, ok := rv.Index(i).Interface().(tea.Cmd)
+		c, ok := reflect.TypeAssert[tea.Cmd](rv.Index(i))
 		require.True(t, ok, "slice element %d is not a tea.Cmd", i)
 		cmds[i] = c
 	}
@@ -57,9 +58,9 @@ func printedText(t *testing.T, msg tea.Msg) string {
 	t.Helper()
 	rv := reflect.ValueOf(msg)
 	require.Equal(t, reflect.Struct, rv.Kind(), "expected a struct msg, got %T", msg)
-	for i := range rv.NumField() {
-		if rv.Field(i).Kind() == reflect.String {
-			return rv.Field(i).String()
+	for _, field := range rv.Fields() {
+		if field.Kind() == reflect.String {
+			return field.String()
 		}
 	}
 	t.Fatalf("no string field in %T", msg)
@@ -81,6 +82,33 @@ func TestPagerModelInitFetchesFirstBatch(t *testing.T) {
 	assert.True(t, m.fetching, "Init must mark the model as fetching")
 }
 
+func TestPagerModelDoFetchLimit(t *testing.T) {
+	cases := []struct {
+		name      string
+		pageSize  int
+		limit     int
+		total     int
+		wantCount int
+		wantDone  bool
+	}{
+		{"exact boundary marks done", 5, 5, 0, 5, true},
+		{"limit reached mid-page", 5, 12, 10, 2, true},
+		{"page boundary below limit not done", 5, 100, 0, 5, false},
+		{"no limit not done", 5, 0, 0, 5, false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			m := newTestPager(t, &numberIterator{n: 100}, tc.pageSize)
+			msg := m.doFetch(t.Context(), tc.pageSize, tc.limit, tc.total)
+			b, ok := msg.(batchMsg)
+			require.True(t, ok, "expected batchMsg, got %T", msg)
+			require.NoError(t, b.err)
+			assert.Equal(t, tc.wantCount, b.count)
+			assert.Equal(t, tc.wantDone, b.done)
+		})
+	}
+}
+
 func TestPagerModelBatchPrintsAndQuitsWhenDone(t *testing.T) {
 	m := newTestPager(t, &numberIterator{n: 3}, 10)
 	_, cmd := m.Update(batchMsg{lines: []string{"1", "2", "3"}, done: true})
diff --git a/libs/cmdio/prompt.go b/libs/cmdio/prompt.go
index dda4d67c0e2..8c8ca1a3a39 100644
--- a/libs/cmdio/prompt.go
+++ b/libs/cmdio/prompt.go
@@ -2,8 +2,19 @@ package cmdio
 
 import (
 	"context"
+	"fmt"
+	"io"
+	"strings"
 
-	"github.com/manifoldco/promptui"
+	tea "github.com/charmbracelet/bubbletea"
+)
+
+// Glyphs drawn into the prompt's rendered output. cursorBlock stands in for
+// the (hidden) OS cursor at the current edit position.
+const (
+	cursorBlock  = "█"
+	glyphValid   = "✔"
+	glyphInvalid = "✗"
 )
 
 // PromptOptions configures a single-line text prompt shown by [RunPrompt].
@@ -11,28 +22,226 @@ type PromptOptions struct {
 	// Label is shown before the input field. Required.
 	Label string
 
-	// Default is the value pre-filled in the input field.
-	Default string
-
 	// Mask, when non-zero, replaces typed characters with the given rune
 	// (use '*' for password-style input).
 	Mask rune
 
-	// Validate, when set, is called on every keystroke; returning a non-nil
-	// error keeps the prompt open and shows the error to the user.
+	// HideEntered clears the prompt line after submission so the entered
+	// value is not left behind in scrollback. Used by [Secret].
+	HideEntered bool
+
+	// Validate, when set, is called on every keystroke. While it returns a
+	// non-nil error the leading glyph flips from "✔" to "✗" and Enter is
+	// inert; pressing Enter while invalid surfaces the returned error
+	// below the prompt until the next edit.
 	Validate func(input string) error
 }
 
 // RunPrompt shows a single-line text prompt and returns the entered value.
+// Returns an error without prompting when the terminal does not support it.
 func RunPrompt(ctx context.Context, opts PromptOptions) (string, error) {
 	c := fromContext(ctx)
-	p := promptui.Prompt{
-		Label:    opts.Label,
-		Default:  opts.Default,
-		Mask:     opts.Mask,
-		Validate: opts.Validate,
-		Stdin:    c.promptStdin(),
-		Stdout:   nopWriteCloser{c.err},
-	}
-	return p.Run()
+	if !c.capabilities.SupportsPrompt() {
+		return "", fmt.Errorf("expected to have %s", opts.Label)
+	}
+	return c.runPromptModel(newPromptModel(opts))
+}
+
+// Secret prompts the user for a value while masking input with '*' and
+// clearing the prompt line on submission so the masked value isn't left
+// behind in scrollback.
+func Secret(ctx context.Context, label string) (string, error) {
+	return RunPrompt(ctx, PromptOptions{
+		Label:       label,
+		Mask:        '*',
+		HideEntered: true,
+	})
+}
+
+type promptModel struct {
+	label       string
+	mask        rune
+	hideEntered bool
+	validate    func(string) error
+
+	// runes holds the editable input as a slice of runes so cursor positions
+	// remain valid for multibyte characters.
+	runes  []rune
+	cursor int
+
+	cancelled bool
+	deleted   bool
+	submitted bool
+
+	// submitErr is the error from the last failed Enter attempt. Rendered
+	// below the prompt and cleared on the next edit.
+	submitErr error
+}
+
+func newPromptModel(opts PromptOptions) *promptModel {
+	return &promptModel{
+		label:       opts.Label,
+		mask:        opts.Mask,
+		hideEntered: opts.HideEntered,
+		validate:    opts.Validate,
+	}
+}
+
+func (m *promptModel) value() string {
+	return string(m.runes)
+}
+
+// glyph returns the leading status indicator: bold-green ✔ when valid,
+// bold-red ✗ when validate rejects the buffer.
+func (m *promptModel) glyph() string {
+	if m.validate != nil && m.validate(m.value()) != nil {
+		return ansiBold + ansiRed + glyphInvalid + ansiReset
+	}
+	return ansiBold + ansiGreen + glyphValid + ansiReset
+}
+
+func (m *promptModel) Init() tea.Cmd { return nil }
+
+func (m *promptModel) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
+	key, ok := msg.(tea.KeyMsg)
+	if !ok {
+		return m, nil
+	}
+
+	switch key.Type {
+	case tea.KeyCtrlC:
+		m.cancelled = true
+		return m, tea.Quit
+
+	case tea.KeyEnter, tea.KeyCtrlJ:
+		// Enter sends CR, Ctrl+J sends LF; treat both as submit.
+		if m.validate != nil {
+			if err := m.validate(m.value()); err != nil {
+				m.submitErr = err
+				return m, nil
+			}
+		}
+		m.submitted = true
+		return m, tea.Quit
+
+	case tea.KeyDelete, tea.KeyCtrlD:
+		// Delete and Ctrl+D both exit the prompt with EOF, even on a
+		// non-empty buffer. Surprising at first glance, but it matches the
+		// previous prompt library and is pinned by a baseline test —
+		// changing it would silently shift caller behavior.
+		m.deleted = true
+		return m, tea.Quit
+
+	case tea.KeyLeft, tea.KeyCtrlB:
+		if m.cursor > 0 {
+			m.cursor--
+		}
+
+	case tea.KeyRight, tea.KeyCtrlF:
+		if m.cursor < len(m.runes) {
+			m.cursor++
+		}
+
+	case tea.KeyBackspace, tea.KeyCtrlH:
+		// Backspace sends DEL, Ctrl+H sends BS; treat both as backspace.
+		// Alt+Backspace (the word-delete combo) is dropped rather than
+		// falling through as a plain backspace.
+		if key.Alt {
+			return m, nil
+		}
+		if m.cursor == 0 {
+			return m, nil
+		}
+		m.runes = append(m.runes[:m.cursor-1], m.runes[m.cursor:]...)
+		m.cursor--
+		m.submitErr = nil
+
+	case tea.KeyRunes, tea.KeySpace:
+		// Alt+<rune> (e.g. Alt+f, Alt+b) are word-nav combos we do not
+		// support. Drop them rather than inserting the rune literally —
+		// the baseline tests pin this as a no-op, and silently typing
+		// "f" when the user pressed Alt+f would be a regression.
+		if key.Alt {
+			return m, nil
+		}
+		typed := key.Runes
+		if key.Type == tea.KeySpace {
+			typed = []rune{' '}
+		}
+		tail := append([]rune{}, m.runes[m.cursor:]...)
+		m.runes = append(m.runes[:m.cursor], typed...)
+		m.runes = append(m.runes, tail...)
+		m.cursor += len(typed)
+		m.submitErr = nil
+
+	default:
+		// All other key types are intentionally inert (Home/End,
+		// Ctrl+W/Ctrl+U, Ctrl+P/N, function keys, etc.).
+	}
+
+	return m, nil
+}
+
+func (m *promptModel) View() string {
+	// HideEntered: empty final frame so the masked value isn't left in
+	// scrollback after the user presses Enter.
+	if m.submitted && m.hideEntered {
+		return ""
+	}
+
+	display := m.runes
+	if m.mask != 0 {
+		display = make([]rune, len(m.runes))
+		for i := range display {
+			display[i] = m.mask
+		}
+	}
+
+	// Post-submit frame: faint label, faint colon, then the entered value
+	// plain. No cursor block.
+	//
+	// The trailing "\n" is load-bearing. On tea.Quit, bubbletea's renderer
+	// flushes one last frame (so this View runs with submitted=true), then
+	// stop() runs `EraseEntireLine` + "\r" to park the cursor cleanly for
+	// whatever output follows. EraseEntireLine wipes the row the cursor is
+	// on — so we end the frame with "\n" to advance the cursor onto an
+	// empty sacrificial row, leaving the rendered text intact above. Pre-
+	// submit frames must NOT trail "\n" or every keystroke would consume
+	// an extra terminal row and risk scrolling at the screen bottom.
+	if m.submitted {
+		return ansiFaint + m.label + ":" + ansiReset + " " + string(display) + "\n"
+	}
+
+	prefix := m.glyph() + " " + ansiBold + m.label + ansiReset + ansiBold + ":" + ansiReset + " "
+
+	var line string
+	if m.cursor >= len(display) {
+		line = prefix + string(display) + cursorBlock
+	} else {
+		// Cursor block visually replaces the rune at the cursor; the hidden
+		// rune is still in m.runes and reappears once the cursor moves.
+		line = prefix + string(display[:m.cursor]) + cursorBlock + string(display[m.cursor+1:])
+	}
+
+	if m.submitErr != nil {
+		// Validation error line captured at the failed Enter; cleared on
+		// the next edit.
+		line += "\n" + ansiRed + ">> " + m.submitErr.Error() + ansiReset
+	}
+	return line
+}
+
+func (c *cmdIO) runPromptModel(m *promptModel) (string, error) {
+	final, err := c.runTUI(m)
+	if err != nil {
+		return "", err
+	}
+	pm := final.(*promptModel)
+	switch {
+	case pm.cancelled:
+		return "", errCtrlC
+	case pm.deleted:
+		return "", io.EOF
+	}
+	return strings.TrimRight(pm.value(), "\r\n"), nil
 }
diff --git a/libs/cmdio/render.go b/libs/cmdio/render.go
index 874db015c8b..bebb63dee72 100644
--- a/libs/cmdio/render.go
+++ b/libs/cmdio/render.go
@@ -280,6 +280,21 @@ func Render(ctx context.Context, v any) error {
 // locked from the first batch so columns stay aligned across pages).
 // Piped output and JSON output keep the existing non-paged behavior.
 func RenderIterator[T any](ctx context.Context, i listing.Iterator[T]) error {
+	return renderAnyIterator(ctx, anyIterator[T]{i})
+}
+
+// anyIterator erases the element type so that the renderers and pager below
+// are instantiated once rather than once per listed SDK type, which
+// otherwise adds megabytes to the binary.
+type anyIterator[T any] struct {
+	listing.Iterator[T]
+}
+
+func (a anyIterator[T]) Next(ctx context.Context) (any, error) {
+	return a.Iterator.Next(ctx)
+}
+
+func renderAnyIterator(ctx context.Context, i listing.Iterator[any]) error {
 	c := fromContext(ctx)
 	if c.capabilities.SupportsPager() && c.outputFormat == flags.OutputText && c.template != "" {
 		return renderIteratorPagedTemplate(ctx, i, c.in, c.out, c.headerTemplate, c.template)
@@ -287,6 +302,28 @@ func RenderIterator[T any](ctx context.Context, i listing.Iterator[T]) error {
 	return renderWithTemplate(ctx, newIteratorRenderer(i), c.outputFormat, c.out, c.headerTemplate, c.template)
 }
 
+// RenderJSONBytes writes already-serialized JSON to the command's output,
+// re-indented and (on a color-capable stdout) colorized. Unlike Render it does
+// not decode the input into Go values, so it preserves the input's exact
+// tokens — integer literals beyond float64 precision and object key order
+// included.
+func RenderJSONBytes(ctx context.Context, raw []byte) error {
+	var buf bytes.Buffer
+	if err := json.Indent(&buf, raw, "", "  "); err != nil {
+		return err
+	}
+	out := buf.Bytes()
+	if colorEnabled(ctx) {
+		out = colorizeJSON(out)
+	}
+	c := fromContext(ctx)
+	if _, err := c.out.Write(out); err != nil {
+		return err
+	}
+	_, err := c.out.Write([]byte{'\n'})
+	return err
+}
+
 func RenderWithTemplate(ctx context.Context, v any, headerTemplate, template string) error {
 	c := fromContext(ctx)
 	if _, ok := v.(listingInterface); ok {
diff --git a/libs/cmdio/render_test.go b/libs/cmdio/render_test.go
index e4841957b75..dc8eec6dd2d 100644
--- a/libs/cmdio/render_test.go
+++ b/libs/cmdio/render_test.go
@@ -87,85 +87,91 @@ func must[T any](a T, e error) T {
 	return a
 }
 
-var testCases = []testCase{
-	{
-		name:           "Workspace with header and template",
-		v:              dummyWorkspace1,
-		outputFormat:   flags.OutputText,
-		headerTemplate: "id\tname",
-		template:       "{{.WorkspaceId}}\t{{.WorkspaceName}}",
-		expected: `id   name
+// makeTestCases builds the table fresh on every call. The Workspace_Iterator
+// rows wrap a stateful *dummyIterator that's consumed by Next; sharing one
+// across iterations of TestRender (which `go test -count=N` does) makes the
+// second run see an empty iterator and the test fails.
+func makeTestCases() []testCase {
+	return []testCase{
+		{
+			name:           "Workspace with header and template",
+			v:              dummyWorkspace1,
+			outputFormat:   flags.OutputText,
+			headerTemplate: "id\tname",
+			template:       "{{.WorkspaceId}}\t{{.WorkspaceName}}",
+			expected: `id   name
 123  abc`,
-	},
-	{
-		name:         "Workspace with no header and template",
-		v:            dummyWorkspace1,
-		outputFormat: flags.OutputText,
-		template:     "{{.WorkspaceId}}\t{{.WorkspaceName}}",
-		expected:     `123  abc`,
-	},
-	{
-		name:         "Workspace with no header and no template",
-		v:            dummyWorkspace1,
-		outputFormat: flags.OutputText,
-		expected: `{
+		},
+		{
+			name:         "Workspace with no header and template",
+			v:            dummyWorkspace1,
+			outputFormat: flags.OutputText,
+			template:     "{{.WorkspaceId}}\t{{.WorkspaceName}}",
+			expected:     `123  abc`,
+		},
+		{
+			name:         "Workspace with no header and no template",
+			v:            dummyWorkspace1,
+			outputFormat: flags.OutputText,
+			expected: `{
   "workspace_id": 123,
   "workspace_name": "abc"
 }
 `,
-	},
-	{
-		name:           "Workspace Iterator with header and template",
-		v:              makeIterator(2),
-		outputFormat:   flags.OutputText,
-		headerTemplate: "id\tname",
-		template:       "{{range .}}{{.WorkspaceId}}\t{{.WorkspaceName}}\n{{end}}",
-		expected: `id   name
+		},
+		{
+			name:           "Workspace Iterator with header and template",
+			v:              makeIterator(2),
+			outputFormat:   flags.OutputText,
+			headerTemplate: "id\tname",
+			template:       "{{range .}}{{.WorkspaceId}}\t{{.WorkspaceName}}\n{{end}}",
+			expected: `id   name
 123  abc
 456  def
 `,
-	},
-	{
-		name:         "Workspace Iterator with no header and template",
-		v:            makeIterator(2),
-		outputFormat: flags.OutputText,
-		template:     "{{range .}}{{.WorkspaceId}}\t{{.WorkspaceName}}\n{{end}}",
-		expected: `123  abc
+		},
+		{
+			name:         "Workspace Iterator with no header and template",
+			v:            makeIterator(2),
+			outputFormat: flags.OutputText,
+			template:     "{{range .}}{{.WorkspaceId}}\t{{.WorkspaceName}}\n{{end}}",
+			expected: `123  abc
 456  def
 `,
-	},
-	{
-		name:         "Workspace Iterator with no header and no template",
-		v:            makeIterator(2),
-		outputFormat: flags.OutputText,
-		expected:     string(must(json.MarshalIndent(makeWorkspaces(2), "", "  "))) + "\n",
-	},
-	{
-		name:           "Big Workspace Iterator with template",
-		v:              makeIterator(234),
-		outputFormat:   flags.OutputText,
-		headerTemplate: "id\tname",
-		template:       "{{range .}}{{.WorkspaceId}}\t{{.WorkspaceName}}\n{{end}}",
-		expected:       "id   name\n" + makeBigOutput(234),
-	},
-	{
-		name:         "Big Workspace Iterator with no template",
-		v:            makeIterator(234),
-		outputFormat: flags.OutputText,
-		expected:     string(must(json.MarshalIndent(makeWorkspaces(234), "", "  "))) + "\n",
-	},
-	{
-		name:         "io.Reader",
-		v:            strings.NewReader("a test"),
-		outputFormat: flags.OutputText,
-		expected:     "a test",
-	},
-	{
-		name:         "io.Reader",
-		v:            strings.NewReader("a test"),
-		outputFormat: flags.OutputJSON,
-		errMessage:   "json output not supported",
-	},
+		},
+		{
+			name:         "Workspace Iterator with no header and no template",
+			v:            makeIterator(2),
+			outputFormat: flags.OutputText,
+			expected:     string(must(json.MarshalIndent(makeWorkspaces(2), "", "  "))) + "\n",
+		},
+		{
+			name:           "Big Workspace Iterator with template",
+			v:              makeIterator(234),
+			outputFormat:   flags.OutputText,
+			headerTemplate: "id\tname",
+			template:       "{{range .}}{{.WorkspaceId}}\t{{.WorkspaceName}}\n{{end}}",
+			expected:       "id   name\n" + makeBigOutput(234),
+		},
+		{
+			name:         "Big Workspace Iterator with no template",
+			v:            makeIterator(234),
+			outputFormat: flags.OutputText,
+			expected:     string(must(json.MarshalIndent(makeWorkspaces(234), "", "  "))) + "\n",
+		},
+		{
+			name:         "io.Reader",
+			v:            strings.NewReader("a test"),
+			outputFormat: flags.OutputText,
+			expected:     "a test",
+		},
+		{
+			name:         "io.Reader",
+			v:            strings.NewReader("a test"),
+			outputFormat: flags.OutputJSON,
+			errMessage:   "json output not supported",
+		},
+	}
 }
 
 // TestRenderJSONColorGate verifies defaultRenderer.renderJson honors the
@@ -208,8 +214,54 @@ func TestRenderJSONColorGate(t *testing.T) {
 	}
 }
 
+func TestRenderJSONBytes(t *testing.T) {
+	// A >2^53 integer, non-alphabetical keys, and an unescaped '<' that all
+	// survive: RenderJSONBytes must not decode the value (which would round the
+	// integer to a float64, sort the keys, and escape the '<').
+	raw := []byte(`{"job_id":18000000000000000123,"name":"a<b"}`)
+	want := "{\n  \"job_id\": 18000000000000000123,\n  \"name\": \"a<b\"\n}\n"
+
+	ctx, out := NewTestContextWithStdout(t.Context())
+	require.NoError(t, RenderJSONBytes(ctx, raw))
+	assert.Equal(t, want, out.String())
+}
+
+func TestRenderJSONBytesColorGate(t *testing.T) {
+	raw := []byte(`{"n":1}`)
+	for _, tt := range []struct {
+		name        string
+		stdoutIsTTY bool
+		color       bool
+		wantANSI    bool
+	}{
+		{"tty with color", true, true, true},
+		{"no tty with color", false, true, false},
+		{"tty without color", true, false, false},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			out := &bytes.Buffer{}
+			c := &cmdIO{
+				capabilities: Capabilities{stdoutIsTTY: tt.stdoutIsTTY, color: tt.color},
+				out:          out,
+				err:          out,
+			}
+			require.NoError(t, RenderJSONBytes(InContext(t.Context(), c), raw))
+			if tt.wantANSI {
+				assert.Contains(t, out.String(), "\x1b[")
+			} else {
+				assert.NotContains(t, out.String(), "\x1b[")
+			}
+		})
+	}
+}
+
+func TestRenderJSONBytesInvalid(t *testing.T) {
+	ctx, _ := NewTestContextWithStdout(t.Context())
+	assert.Error(t, RenderJSONBytes(ctx, []byte("not json")))
+}
+
 func TestRender(t *testing.T) {
-	for _, c := range testCases {
+	for _, c := range makeTestCases() {
 		t.Run(c.name, func(t *testing.T) {
 			output := &bytes.Buffer{}
 			ctx := t.Context()
diff --git a/libs/cmdio/select.go b/libs/cmdio/select.go
index 186e7a0e760..2d481139bae 100644
--- a/libs/cmdio/select.go
+++ b/libs/cmdio/select.go
@@ -2,10 +2,64 @@ package cmdio
 
 import (
 	"context"
+	"fmt"
+	"reflect"
+	"slices"
+	"strings"
+	"text/template"
+	"unicode/utf8"
 
-	"github.com/manifoldco/promptui"
+	tea "github.com/charmbracelet/bubbletea"
 )
 
+const (
+	// viewportSize is the number of list rows shown at once.
+	viewportSize = 5
+
+	gutterUp   = "↑ "
+	gutterDown = "↓ "
+	gutter     = "  "
+
+	// Default templates: blue "?" before the label, bold "▸" + underlined
+	// item for the active row, two-space prefix + item for inactive rows,
+	// green "✔" + faint item for the post-submit summary. They render
+	// reasonably for any item type whose fmt.Stringer / printf'd form is
+	// a single line.
+	defaultLabelTemplate    = `{{ "?" | blue }} {{.}}: `
+	defaultActiveTemplate   = `{{ "▸" | bold }} {{ . | underline }}`
+	defaultInactiveTemplate = `  {{.}}`
+	defaultSelectedTemplate = `{{ "✔" | green }} {{ . | faint }}`
+
+	// helpTextBase is shown faint above the label when search isn't active
+	// and HideHelp is unset. When a Searcher is configured the trailing
+	// suffix advertises the "/" toggle.
+	helpTextBase   = "Use the arrow keys to navigate: ↓ ↑ → ←"
+	helpTextSearch = helpTextBase + "  and / toggles search"
+)
+
+// promptFuncMap is the pipeline-form template.FuncMap used by select-prompt
+// templates (`{{ . | bold }}`). It always emits SGR codes; color.go's
+// RenderFuncMap is printf-style and gates colors on ctx so the two cannot
+// share an implementation.
+var promptFuncMap = template.FuncMap{
+	"bold":      promptANSI(ansiBold),
+	"faint":     promptANSI(ansiFaint),
+	"italic":    promptANSI(ansiItalic),
+	"underline": promptANSI(ansiUnderline),
+	"red":       promptANSI(ansiRed),
+	"green":     promptANSI(ansiGreen),
+	"yellow":    promptANSI(ansiYellow),
+	"blue":      promptANSI(ansiBlue),
+	"magenta":   promptANSI(ansiMagenta),
+	"cyan":      promptANSI(ansiCyan),
+}
+
+func promptANSI(prefix string) func(any) string {
+	return func(v any) string {
+		return prefix + fmt.Sprint(v) + ansiReset
+	}
+}
+
 // SelectOptions configures an interactive single-choice picker shown by
 // [RunSelect]. Template strings use text/template syntax and have access
 // to the fields of the items in Items.
@@ -23,6 +77,13 @@ type SelectOptions struct {
 	// StartInSearchMode opens the prompt with the search input focused.
 	StartInSearchMode bool
 
+	// HideHelp hides the navigation help line shown by default when no
+	// search is active.
+	HideHelp bool
+
+	// HideSelected hides the rendered selection after the prompt closes.
+	HideSelected bool
+
 	// LabelTemplate renders Label. Empty uses the default.
 	LabelTemplate string
 
@@ -36,23 +97,431 @@ type SelectOptions struct {
 	Selected string
 }
 
-// RunSelect shows an interactive picker and returns the index of the chosen item.
+// RunSelect shows an interactive picker and returns the index of the chosen
+// item. Returns an error without prompting when the terminal does not support
+// it.
 func RunSelect(ctx context.Context, opts SelectOptions) (int, error) {
 	c := fromContext(ctx)
-	sel := &promptui.Select{
-		Label:             opts.Label,
-		Items:             opts.Items,
-		Searcher:          opts.Searcher,
-		StartInSearchMode: opts.StartInSearchMode,
-		Templates: &promptui.SelectTemplates{
-			Label:    opts.LabelTemplate,
-			Active:   opts.Active,
-			Inactive: opts.Inactive,
-			Selected: opts.Selected,
+	if !c.capabilities.SupportsPrompt() {
+		return 0, fmt.Errorf("expected to have %s", opts.Label)
+	}
+	m, err := newSelectModel(opts)
+	if err != nil {
+		return 0, err
+	}
+	return c.runSelectModel(m)
+}
+
+// Tuple pairs a human-friendly Name with an internal Id, used as the row type
+// for [Select] and [SelectOrdered].
+type Tuple struct{ Name, Id string }
+
+// Select shows a selection prompt where the user can pick one of the name/id
+// items. The items are sorted alphabetically by name.
+func Select[V any](ctx context.Context, names map[string]V, label string) (string, error) {
+	items := make([]Tuple, 0, len(names))
+	for k, v := range names {
+		items = append(items, Tuple{k, fmt.Sprint(v)})
+	}
+	slices.SortFunc(items, func(a, b Tuple) int {
+		return strings.Compare(a.Name, b.Name)
+	})
+	return SelectOrdered(ctx, items, label)
+}
+
+// SelectOrdered shows a selection prompt where the user can pick one of the
+// name/id items. The items appear in the order specified in the "items"
+// argument.
+func SelectOrdered(ctx context.Context, items []Tuple, label string) (string, error) {
+	idx, err := RunSelect(ctx, SelectOptions{
+		Label:             label,
+		Items:             items,
+		HideSelected:      true,
+		StartInSearchMode: true,
+		Searcher: func(input string, idx int) bool {
+			return strings.Contains(strings.ToLower(items[idx].Name), strings.ToLower(input))
 		},
-		Stdin:  c.promptStdin(),
-		Stdout: nopWriteCloser{c.err},
+		Active:   `{{.Name | bold}} ({{.Id|faint}})`,
+		Inactive: `{{.Name}}`,
+	})
+	if err != nil {
+		return "", err
+	}
+	return items[idx].Id, nil
+}
+
+type selectModel struct {
+	label string
+	items []any
+
+	labelTpl    *template.Template
+	activeTpl   *template.Template
+	inactiveTpl *template.Template
+	selectedTpl *template.Template
+
+	searcher     func(input string, idx int) bool
+	searchActive bool
+	hideHelp     bool
+	hideSelected bool
+
+	filter      string
+	matches     []int
+	cursor      int
+	viewportTop int
+
+	submitted bool
+	cancelled bool
+}
+
+func newSelectModel(opts SelectOptions) (*selectModel, error) {
+	items, err := normalizeItems(opts.Items)
+	if err != nil {
+		return nil, err
+	}
+	labelTpl, err := parsePromptTemplate("label", defaultIfEmpty(opts.LabelTemplate, defaultLabelTemplate))
+	if err != nil {
+		return nil, err
+	}
+	activeTpl, err := parsePromptTemplate("active", defaultIfEmpty(opts.Active, defaultActiveTemplate))
+	if err != nil {
+		return nil, err
+	}
+	inactiveTpl, err := parsePromptTemplate("inactive", defaultIfEmpty(opts.Inactive, defaultInactiveTemplate))
+	if err != nil {
+		return nil, err
+	}
+	selectedTpl, err := parsePromptTemplate("selected", defaultIfEmpty(opts.Selected, defaultSelectedTemplate))
+	if err != nil {
+		return nil, err
+	}
+
+	m := &selectModel{
+		label:        opts.Label,
+		items:        items,
+		labelTpl:     labelTpl,
+		activeTpl:    activeTpl,
+		inactiveTpl:  inactiveTpl,
+		selectedTpl:  selectedTpl,
+		searcher:     opts.Searcher,
+		searchActive: opts.StartInSearchMode,
+		hideHelp:     opts.HideHelp,
+		hideSelected: opts.HideSelected,
+	}
+	m.recomputeMatches()
+	return m, nil
+}
+
+func defaultIfEmpty(s, fallback string) string {
+	if s == "" {
+		return fallback
+	}
+	return s
+}
+
+func parsePromptTemplate(name, src string) (*template.Template, error) {
+	t, err := template.New(name).Funcs(promptFuncMap).Parse(src)
+	if err != nil {
+		return nil, fmt.Errorf("parse %s template: %w", name, err)
+	}
+	return t, nil
+}
+
+func (m *selectModel) Init() tea.Cmd { return tea.HideCursor }
+
+func (m *selectModel) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
+	key, ok := msg.(tea.KeyMsg)
+	if !ok {
+		return m, nil
+	}
+	switch key.Type {
+	case tea.KeyCtrlC:
+		m.cancelled = true
+		return m, tea.Quit
+
+	case tea.KeyEnter, tea.KeyCtrlJ:
+		// Enter on an empty filtered list is intentionally inert; only
+		// Ctrl+C escapes from a "No results" panel.
+		if len(m.matches) == 0 {
+			return m, nil
+		}
+		m.submitted = true
+		return m, tea.Quit
+
+	case tea.KeyUp, tea.KeyCtrlP:
+		m.cursorUp()
+
+	case tea.KeyDown, tea.KeyCtrlN:
+		m.cursorDown()
+
+	case tea.KeyLeft, tea.KeyCtrlB:
+		m.pageUp()
+
+	case tea.KeyRight, tea.KeyCtrlF:
+		m.pageDown()
+
+	case tea.KeyBackspace, tea.KeyCtrlH:
+		// Backspace sends DEL, Ctrl+H sends BS; treat both as filter
+		// backspace. Alt+Backspace (word-delete) is dropped rather than
+		// deleting a single rune.
+		if key.Alt {
+			return m, nil
+		}
+		if !m.searchActive || m.filter == "" {
+			return m, nil
+		}
+		if r, size := utf8.DecodeLastRuneInString(m.filter); r != utf8.RuneError {
+			m.filter = m.filter[:len(m.filter)-size]
+		}
+		m.recomputeMatches()
+
+	case tea.KeyTab, tea.KeyRunes, tea.KeySpace:
+		// Alt+<rune> are word-nav combos; drop them rather than letting
+		// the rune sneak into the filter buffer. The baseline tests pin
+		// this as a no-op for parity with the previous prompt library.
+		if key.Alt {
+			return m, nil
+		}
+		if !m.searchActive {
+			// Outside search mode, vim-style shortcuts navigate the list and
+			// "/" toggles search when a Searcher is configured. Anything
+			// else is dropped. Multiple runes can arrive in a single KeyMsg
+			// when the user types quickly, so dispatch per-rune.
+			if key.Type == tea.KeyRunes {
+				for _, r := range key.Runes {
+					switch r {
+					case 'j':
+						m.cursorDown()
+					case 'k':
+						m.cursorUp()
+					case 'l':
+						m.pageDown()
+					case 'h':
+						m.pageUp()
+					case '/':
+						if m.searcher != nil {
+							m.searchActive = true
+						}
+					}
+				}
+			}
+			return m, nil
+		}
+		switch key.Type {
+		case tea.KeyTab:
+			m.filter += "\t"
+		case tea.KeySpace:
+			m.filter += " "
+		default:
+			// "/" toggles search off: clear the filter and exit search
+			// mode. Any other runes batched in the same KeyMsg are dropped
+			// — when the user types "/" the surrounding characters almost
+			// certainly belong to a toggle, not the filter.
+			if slices.Contains(key.Runes, '/') {
+				m.filter = ""
+				m.searchActive = false
+				m.recomputeMatches()
+				return m, nil
+			}
+			m.filter += string(key.Runes)
+		}
+		m.recomputeMatches()
+
+	case tea.KeyEsc:
+		// Esc is intentionally inert.
+
+	default:
+		// Other key types (Home/End, Ctrl+U/W, function keys, …) are no-ops.
+	}
+	return m, nil
+}
+
+func (m *selectModel) View() string {
+	var b strings.Builder
+
+	// After submission render only the Selected template; the post-quit
+	// frame stays on screen as the user-visible result. HideSelected
+	// callers leave the screen blank.
+	//
+	// The trailing "\n" is load-bearing for the same reason as in
+	// promptModel.View: bubbletea's renderer wipes the cursor's row on
+	// shutdown, so we park the cursor on an empty row below the content.
+	if m.submitted {
+		if !m.hideSelected {
+			if err := m.selectedTpl.Execute(&b, m.items[m.originalIndex()]); err != nil {
+				fmt.Fprintf(&b, "[selected template error: %v]", err)
+			}
+			b.WriteString("\n")
+		}
+		return b.String()
+	}
+
+	switch {
+	case m.searchActive:
+		b.WriteString("Search: ")
+		// Tab stops every 8 columns from col 8 (after "Search: "). Expand to
+		// spaces because tea's diff-based redraw doesn't reliably clear the
+		// column the previous cursor occupied when a literal \t lands there,
+		// leaving a stale █ behind.
+		b.WriteString(expandTabsFromCol(m.filter, 8))
+		b.WriteString(cursorBlock)
+		b.WriteString("\n")
+	case !m.hideHelp:
+		text := helpTextBase
+		if m.searcher != nil {
+			text = helpTextSearch
+		}
+		b.WriteString(ansiFaint + text + ansiReset)
+		b.WriteString("\n")
+	}
+
+	if err := m.labelTpl.Execute(&b, m.label); err != nil {
+		fmt.Fprintf(&b, "[label template error: %v]", err)
+	}
+	b.WriteString("\n")
+
+	if len(m.matches) == 0 {
+		b.WriteString("\nNo results\n")
+		return b.String()
+	}
+
+	end := min(m.viewportTop+viewportSize, len(m.matches))
+	hasAbove := m.viewportTop > 0
+	hasBelow := end < len(m.matches)
+
+	for i := m.viewportTop; i < end; i++ {
+		switch {
+		case i == m.viewportTop && hasAbove:
+			b.WriteString(gutterUp)
+		case i == end-1 && hasBelow:
+			b.WriteString(gutterDown)
+		default:
+			b.WriteString(gutter)
+		}
+
+		tpl := m.inactiveTpl
+		if i == m.cursor {
+			tpl = m.activeTpl
+		}
+		if err := tpl.Execute(&b, m.items[m.matches[i]]); err != nil {
+			fmt.Fprintf(&b, "[template error: %v]", err)
+		}
+		b.WriteString("\n")
+	}
+
+	return b.String()
+}
+
+func (m *selectModel) recomputeMatches() {
+	m.matches = m.matches[:0]
+	for i := range m.items {
+		if m.filter == "" || m.searcher == nil || m.searcher(m.filter, i) {
+			m.matches = append(m.matches, i)
+		}
+	}
+	m.cursor = 0
+	m.viewportTop = 0
+}
+
+func (m *selectModel) cursorUp() {
+	if m.cursor > 0 {
+		m.cursor--
+		if m.cursor < m.viewportTop {
+			m.viewportTop = m.cursor
+		}
+	}
+}
+
+func (m *selectModel) cursorDown() {
+	if m.cursor < len(m.matches)-1 {
+		m.cursor++
+		if m.cursor >= m.viewportTop+viewportSize {
+			m.viewportTop = m.cursor - viewportSize + 1
+		}
+	}
+}
+
+// pageUp shifts the viewport up by one page, then drops the cursor onto the
+// new top if it was below it.
+func (m *selectModel) pageUp() {
+	m.viewportTop = max(m.viewportTop-viewportSize, 0)
+	if m.viewportTop < m.cursor {
+		m.cursor = m.viewportTop
+	}
+}
+
+// pageDown shifts the viewport down by one page, clamping so the last full
+// page stays visible, then bumps the cursor up to the new top if it lagged
+// behind.
+func (m *selectModel) pageDown() {
+	max := len(m.matches) - viewportSize
+	switch newTop := m.viewportTop + viewportSize; {
+	case len(m.matches) < viewportSize:
+		m.viewportTop = 0
+	case newTop > max:
+		m.viewportTop = max
+	default:
+		m.viewportTop = newTop
+	}
+	if m.cursor < m.viewportTop {
+		m.cursor = m.viewportTop
+	}
+}
+
+// originalIndex returns the items-slice index of the currently selected match,
+// or -1 when nothing is selectable.
+func (m *selectModel) originalIndex() int {
+	if len(m.matches) == 0 {
+		return -1
+	}
+	return m.matches[m.cursor]
+}
+
+// normalizeItems accepts any slice via reflection and copies its elements
+// into a []any so the model can index them without further reflection. A
+// non-slice argument is rejected at construction time.
+func normalizeItems(in any) ([]any, error) {
+	if in == nil {
+		return nil, nil
+	}
+	v := reflect.ValueOf(in)
+	if v.Kind() != reflect.Slice {
+		return nil, fmt.Errorf("SelectOptions.Items must be a slice, got %s", v.Kind())
+	}
+	out := make([]any, v.Len())
+	for i := range out {
+		out[i] = v.Index(i).Interface()
+	}
+	return out, nil
+}
+
+// expandTabsFromCol replaces \t in s with spaces, advancing to the next tab
+// stop (every 8 columns) given a starting column.
+func expandTabsFromCol(s string, startCol int) string {
+	var b strings.Builder
+	col := startCol
+	for _, r := range s {
+		if r == '\t' {
+			stop := ((col / 8) + 1) * 8
+			for col < stop {
+				b.WriteByte(' ')
+				col++
+			}
+			continue
+		}
+		b.WriteRune(r)
+		col++
+	}
+	return b.String()
+}
+
+func (c *cmdIO) runSelectModel(m *selectModel) (int, error) {
+	final, err := c.runTUI(m)
+	if err != nil {
+		return 0, err
+	}
+	sm := final.(*selectModel)
+	if sm.cancelled {
+		return 0, errCtrlC
 	}
-	idx, _, err := sel.Run()
-	return idx, err
+	return sm.originalIndex(), nil
 }
diff --git a/libs/cmdio/spinner.go b/libs/cmdio/spinner.go
index b9bfde46f22..974c673a76a 100644
--- a/libs/cmdio/spinner.go
+++ b/libs/cmdio/spinner.go
@@ -3,6 +3,7 @@ package cmdio
 import (
 	"context"
 	"fmt"
+	"io"
 	"sync"
 	"time"
 
@@ -35,15 +36,17 @@ func WithElapsedTime() SpinnerOption {
 	}
 }
 
-// newSpinnerModel creates a new spinner model.
-func newSpinnerModel(opts ...SpinnerOption) spinnerModel {
+// newSpinnerModel creates a new spinner model. The style is minted from a
+// renderer targeting w so color handling stays centralized in NewRenderer.
+func newSpinnerModel(ctx context.Context, w io.Writer, opts ...SpinnerOption) spinnerModel {
 	s := bubblespinner.New()
 	// Braille spinner frames with 200ms timing
 	s.Spinner = bubblespinner.Spinner{
 		Frames: []string{"⣾", "⣽", "⣻", "⢿", "⡿", "⣟", "⣯", "⣷"},
 		FPS:    time.Second / 5, // 200ms = 5 FPS
 	}
-	s.Style = lipgloss.NewStyle().Foreground(lipgloss.Color("10")) // Green
+	r, _ := NewRenderer(ctx, w)
+	s.Style = r.NewStyle().Foreground(lipgloss.Color("10")) // Green
 
 	m := spinnerModel{
 		spinner: s,
@@ -147,7 +150,7 @@ func (c *cmdIO) NewSpinner(ctx context.Context, opts ...SpinnerOption) *spinner
 	}
 
 	// Create model and program
-	m := newSpinnerModel(opts...)
+	m := newSpinnerModel(ctx, c.err, opts...)
 	p := tea.NewProgram(
 		m,
 		tea.WithInput(nil),
diff --git a/libs/cmdio/spinner_test.go b/libs/cmdio/spinner_test.go
index 2e0fbd2222c..203e9235878 100644
--- a/libs/cmdio/spinner_test.go
+++ b/libs/cmdio/spinner_test.go
@@ -2,6 +2,7 @@ package cmdio
 
 import (
 	"context"
+	"io"
 	"sync"
 	"testing"
 	"time"
@@ -10,14 +11,14 @@ import (
 )
 
 func TestSpinnerModelInit(t *testing.T) {
-	m := newSpinnerModel()
+	m := newSpinnerModel(MockDiscard(t.Context()), io.Discard)
 	assert.False(t, m.quitting)
-	assert.Equal(t, "", m.suffix)
+	assert.Empty(t, m.suffix)
 	assert.NotNil(t, m.spinner)
 }
 
 func TestSpinnerModelUpdateSuffixMsg(t *testing.T) {
-	m := newSpinnerModel()
+	m := newSpinnerModel(MockDiscard(t.Context()), io.Discard)
 	msg := suffixMsg("processing files")
 
 	updatedModel, _ := m.Update(msg)
@@ -28,7 +29,7 @@ func TestSpinnerModelUpdateSuffixMsg(t *testing.T) {
 }
 
 func TestSpinnerModelUpdateQuitMsg(t *testing.T) {
-	m := newSpinnerModel()
+	m := newSpinnerModel(MockDiscard(t.Context()), io.Discard)
 	msg := quitMsg{}
 
 	updatedModel, cmd := m.Update(msg)
@@ -39,7 +40,7 @@ func TestSpinnerModelUpdateQuitMsg(t *testing.T) {
 }
 
 func TestSpinnerModelViewActive(t *testing.T) {
-	m := newSpinnerModel()
+	m := newSpinnerModel(MockDiscard(t.Context()), io.Discard)
 	m.suffix = "loading"
 
 	view := m.View()
@@ -49,7 +50,7 @@ func TestSpinnerModelViewActive(t *testing.T) {
 }
 
 func TestSpinnerModelViewQuitting(t *testing.T) {
-	m := newSpinnerModel()
+	m := newSpinnerModel(MockDiscard(t.Context()), io.Discard)
 	m.quitting = true
 
 	view := m.View()
diff --git a/libs/cmdio/testing.go b/libs/cmdio/testing.go
index 7aecfbd73e3..5e35973ae33 100644
--- a/libs/cmdio/testing.go
+++ b/libs/cmdio/testing.go
@@ -6,9 +6,45 @@ import (
 	"context"
 	"io"
 
+	tea "github.com/charmbracelet/bubbletea"
 	"github.com/databricks/cli/libs/flags"
 )
 
+// TestTerminalWidth and TestTerminalHeight are the virtual terminal
+// dimensions [NewTestIO] reports to bubbletea via a synthetic WindowSizeMsg.
+// They match what the termtest harness expects when rendering the screen.
+const (
+	TestTerminalWidth  = 120
+	TestTerminalHeight = 40
+)
+
+// NewTestIO returns a cmdIO with prompt support forced on regardless of
+// whether in/out/err are TTYs, and a fixed terminal size pre-queued for
+// bubbletea. It exists so tests can drive prompts through the real
+// [RunPrompt] / [Secret] / [SelectOrdered] entry points by wiring their own
+// streams; without forcing capabilities, the SupportsPrompt() gate would
+// reject non-TTY streams.
+func NewTestIO(in io.Reader, out, err io.Writer) *cmdIO {
+	return &cmdIO{
+		capabilities: Capabilities{
+			stdinIsTTY:  true,
+			stdoutIsTTY: true,
+			stderrIsTTY: true,
+			color:       true,
+		},
+		outputFormat: flags.OutputText,
+		in:           in,
+		out:          out,
+		err:          err,
+		// Pre-queue a WindowSizeMsg. bubbletea's auto-detection (tty.go:
+		// checkResize) returns early unless the err writer is an *os.File
+		// that passes term.IsTerminal, which test streams rarely are.
+		// Without this the standard renderer runs with width=0 and produces
+		// stale cells on shrinking redraws.
+		teaWindowSize: &tea.WindowSizeMsg{Width: TestTerminalWidth, Height: TestTerminalHeight},
+	}
+}
+
 type Test struct {
 	Done context.CancelFunc
 
diff --git a/libs/completion/install.go b/libs/completion/install.go
index 9ee6b49ae42..76c2ef60bc9 100644
--- a/libs/completion/install.go
+++ b/libs/completion/install.go
@@ -3,7 +3,8 @@ package completion
 import (
 	"context"
 	"os"
-	"path/filepath"
+
+	"github.com/databricks/cli/libs/atomicfile"
 )
 
 // Install configures shell completion for the given shell. homeDir is used
@@ -26,24 +27,13 @@ func Install(ctx context.Context, shell Shell, homeDir string) (filePath string,
 		return filePath, true, nil
 	}
 
+	// Fish uses a file-drop model; any existing file was ruled out above.
 	if shell == Fish {
-		return installFish(filePath, shell)
+		return filePath, false, atomicfile.Write(filePath, []byte(ShimContent(shell)), 0o644, atomicfile.MkDir(0o755))
 	}
 	return installRC(filePath, shell)
 }
 
-// installFish handles the file-drop model for fish completions.
-// The caller must check Status before calling this — existence checks are not
-// repeated here.
-func installFish(filePath string, shell Shell) (string, bool, error) {
-	dir := filepath.Dir(filePath)
-	if err := os.MkdirAll(dir, 0o755); err != nil {
-		return filePath, false, err
-	}
-
-	return filePath, false, os.WriteFile(filePath, []byte(ShimContent(shell)), 0o644)
-}
-
 // installRC handles the RC file model for bash, zsh, and powershell.
 // The caller must check Status before calling this — marker checks are not
 // repeated here.
@@ -59,27 +49,15 @@ func installRC(filePath string, shell Shell) (string, bool, error) {
 		}
 	}
 
-	// Create parent directory if needed (e.g. for PowerShell profiles).
-	dir := filepath.Dir(filePath)
-	if err := os.MkdirAll(dir, 0o755); err != nil {
-		return filePath, false, err
-	}
-
 	// Ensure a leading newline before the block if the file doesn't end with one.
 	shim := ShimContent(shell)
 	if len(content) > 0 && content[len(content)-1] != '\n' {
 		shim = "\n" + shim
 	}
 
-	f, err := os.OpenFile(filePath, os.O_WRONLY|os.O_CREATE|os.O_APPEND, perm)
-	if err != nil {
-		return filePath, false, err
-	}
-	defer f.Close()
-
-	if _, err := f.WriteString(shim); err != nil {
-		return filePath, false, err
-	}
-
-	return filePath, false, nil
+	// Append our block by rewriting the file atomically, so an interrupted
+	// install cannot leave a torn block in the user's RC file. The parent dir
+	// may be missing (e.g. for PowerShell profiles), so create it too.
+	newContent := append(content, []byte(shim)...)
+	return filePath, false, atomicfile.Write(filePath, newContent, perm, atomicfile.MkDir(0o755))
 }
diff --git a/libs/completion/uninstall.go b/libs/completion/uninstall.go
index 0e70be344da..00654fea06f 100644
--- a/libs/completion/uninstall.go
+++ b/libs/completion/uninstall.go
@@ -7,6 +7,8 @@ import (
 	"os"
 	"regexp"
 	"strings"
+
+	"github.com/databricks/cli/libs/atomicfile"
 )
 
 var multiBlankLine = regexp.MustCompile(`\n{3,}`)
@@ -89,5 +91,5 @@ func uninstallRC(filePath string) (string, bool, error) {
 	// Collapse double blank lines left by removal.
 	result = multiBlankLine.ReplaceAllString(result, "\n\n")
 
-	return filePath, true, os.WriteFile(filePath, []byte(result), info.Mode())
+	return filePath, true, atomicfile.Write(filePath, []byte(result), info.Mode())
 }
diff --git a/libs/databrickscfg/cfgpickers/clusters.go b/libs/databrickscfg/cfgpickers/clusters.go
index 6732c1893c7..0c752f3a4b1 100644
--- a/libs/databrickscfg/cfgpickers/clusters.go
+++ b/libs/databrickscfg/cfgpickers/clusters.go
@@ -17,7 +17,7 @@ import (
 var minUcRuntime = canonicalVersion("v12.0")
 
 var (
-	dbrVersionRegex         = regexp.MustCompile(`^(\d+\.\d+)\.x-.*`)
+	dbrVersionRegex         = regexp.MustCompile(`^(\d+(?:\.\d+)?)\.x-.*`)
 	dbrSnapshotVersionRegex = regexp.MustCompile(`^(\d+)\.x-snapshot.*`)
 )
 
@@ -26,16 +26,16 @@ func canonicalVersion(v string) string {
 }
 
 func GetRuntimeVersion(cluster compute.ClusterDetails) (string, bool) {
-	match := dbrVersionRegex.FindStringSubmatch(cluster.SparkVersion)
-	if len(match) < 1 {
-		match = dbrSnapshotVersionRegex.FindStringSubmatch(cluster.SparkVersion)
-		if len(match) > 1 {
-			// we return 14.999 for 14.x-snapshot for semver.Compare() to work properly
-			return match[1] + ".999", true
-		}
-		return "", false
+	// Snapshots are checked first: dbrVersionRegex now matches major-only versions
+	// like "14.x-...", which would otherwise swallow "14.x-snapshot-..." here.
+	if match := dbrSnapshotVersionRegex.FindStringSubmatch(cluster.SparkVersion); len(match) > 1 {
+		// we return 14.999 for 14.x-snapshot for semver.Compare() to work properly
+		return match[1] + ".999", true
+	}
+	if match := dbrVersionRegex.FindStringSubmatch(cluster.SparkVersion); len(match) > 1 {
+		return match[1], true
 	}
-	return match[1], true
+	return "", false
 }
 
 func IsCompatibleWithUC(cluster compute.ClusterDetails, minVersion string) bool {
@@ -65,7 +65,7 @@ type compatibleCluster struct {
 	compute.ClusterDetails
 	versionName string
 	// renderedState caches the colorized ClusterDetails.State for display in
-	// promptui templates, which can't access ctx-bound color helpers.
+	// SelectOptions templates, which can't access ctx-bound color helpers.
 	renderedState string
 }
 
@@ -140,7 +140,7 @@ func loadInteractiveClusters(ctx context.Context, w *databricks.WorkspaceClient,
 	if err != nil {
 		return nil, fmt.Errorf("list clusters: %w", err)
 	}
-	me, err := w.CurrentUser.Me(ctx)
+	me, err := w.CurrentUser.Me(ctx, iam.MeRequest{})
 	if err != nil {
 		return nil, fmt.Errorf("current user: %w", err)
 	}
diff --git a/libs/databrickscfg/cfgpickers/clusters_test.go b/libs/databrickscfg/cfgpickers/clusters_test.go
index 025a0f43253..1c462eace05 100644
--- a/libs/databrickscfg/cfgpickers/clusters_test.go
+++ b/libs/databrickscfg/cfgpickers/clusters_test.go
@@ -35,6 +35,32 @@ func TestIsCompatible(t *testing.T) {
 	}, "14.0"))
 }
 
+func TestGetRuntimeVersion(t *testing.T) {
+	tests := []struct {
+		sparkVersion string
+		want         string
+		wantOk       bool
+	}{
+		{"13.3.x-scala2.12", "13.3", true},
+		// Newer clusters report the runtime without a minor version, e.g. 19.x.
+		{"19.x-scala2.13", "19", true},
+		{"14.x-snapshot-cpu-ml-scala2.12", "14.999", true},
+		{"custom-9.1.x-photon-scala2.12", "", false},
+	}
+	for _, tc := range tests {
+		got, ok := GetRuntimeVersion(compute.ClusterDetails{SparkVersion: tc.sparkVersion})
+		assert.Equal(t, tc.wantOk, ok, tc.sparkVersion)
+		assert.Equal(t, tc.want, got, tc.sparkVersion)
+	}
+}
+
+func TestIsCompatibleWithMajorOnlyVersion(t *testing.T) {
+	require.True(t, IsCompatibleWithUC(compute.ClusterDetails{
+		SparkVersion:     "19.x-scala2.13",
+		DataSecurityMode: compute.DataSecurityModeUserIsolation,
+	}, "13.0"))
+}
+
 func TestIsCompatibleWithSnapshots(t *testing.T) {
 	require.True(t, IsCompatibleWithUC(compute.ClusterDetails{
 		SparkVersion:     "14.x-snapshot-cpu-ml-scala2.12",
@@ -92,7 +118,7 @@ func TestFirstCompatibleCluster(t *testing.T) {
 		},
 		{
 			Method:   "GET",
-			Resource: "/api/2.0/preview/scim/v2/Me",
+			Resource: "/api/2.0/preview/scim/v2/Me?",
 			Response: iam.User{
 				UserName: "serge",
 			},
@@ -139,7 +165,7 @@ func TestNoCompatibleClusters(t *testing.T) {
 		},
 		{
 			Method:   "GET",
-			Resource: "/api/2.0/preview/scim/v2/Me",
+			Resource: "/api/2.0/preview/scim/v2/Me?",
 			Response: iam.User{
 				UserName: "serge",
 			},
diff --git a/libs/databrickscfg/cfgpickers/warehouses.go b/libs/databrickscfg/cfgpickers/warehouses.go
index 9f0c617e34b..67bdcb7f73a 100644
--- a/libs/databrickscfg/cfgpickers/warehouses.go
+++ b/libs/databrickscfg/cfgpickers/warehouses.go
@@ -8,6 +8,7 @@ import (
 	"slices"
 	"strings"
 
+	"github.com/databricks/cli/libs/auth"
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/apierr"
@@ -110,8 +111,8 @@ func GetDefaultWarehouse(ctx context.Context, w *databricks.WorkspaceClient) (*s
 			State: warehouse.State,
 		}, nil
 	}
-	var apiErr *apierr.APIError
-	if !errors.As(err, &apiErr) || apiErr.StatusCode >= 500 {
+	apiErr, ok := errors.AsType[*apierr.APIError](err)
+	if !ok || apiErr.StatusCode >= 500 {
 		return nil, fmt.Errorf("get default warehouse: %w", err)
 	}
 
@@ -137,8 +138,11 @@ func listUsableWarehouses(ctx context.Context, w *databricks.WorkspaceClient) ([
 	apiClient := httpclient.NewApiClient(clientCfg)
 
 	var response sql.ListWarehousesResponse
-	err = apiClient.Do(ctx, "GET", "/api/2.0/sql/warehouses?skip_cannot_use=true",
-		httpclient.WithResponseUnmarshal(&response))
+	opts := []httpclient.DoOption{httpclient.WithResponseUnmarshal(&response)}
+	for name, value := range auth.WorkspaceIDHeaders(w.Config) {
+		opts = append(opts, httpclient.WithRequestHeader(name, value))
+	}
+	err = apiClient.Do(ctx, "GET", "/api/2.0/sql/warehouses?skip_cannot_use=true", opts...)
 	if err != nil {
 		return nil, fmt.Errorf("list warehouses: %w", err)
 	}
diff --git a/libs/databrickscfg/loader.go b/libs/databrickscfg/loader.go
index 8f4f2a38dbc..1ba5f9e336b 100644
--- a/libs/databrickscfg/loader.go
+++ b/libs/databrickscfg/loader.go
@@ -1,12 +1,14 @@
 package databrickscfg
 
 import (
+	"cmp"
 	"context"
 	"errors"
 	"fmt"
 	"io/fs"
 	"strings"
 
+	"github.com/databricks/cli/libs/databrickscfg/profile"
 	"github.com/databricks/cli/libs/log"
 	"github.com/databricks/databricks-sdk-go/config"
 	"gopkg.in/ini.v1"
@@ -14,6 +16,48 @@ import (
 
 var ResolveProfileFromHost = profileFromHostLoader{}
 
+// ResolveNonAuthFromEnv reads non-auth, non-host config from environment
+// variables. See ProfileAuthLoaders for how it fits into the chain.
+var ResolveNonAuthFromEnv = envLoader{name: "environment (excluding auth)", skipAuth: true}
+
+// resolveAuthGapFromEnv gap-fills the auth attributes and host the profile left
+// empty from environment variables. See ProfileAuthLoaders for how it fits into
+// the chain.
+var resolveAuthGapFromEnv = envLoader{name: "environment (auth gap-fill)", skipAuth: false}
+
+// ProfileAuthLoaders is the loader chain for an explicitly selected profile
+// (--profile or a bundle's workspace.profile). Unlike the SDK's default
+// env-first chain, the profile wins over auth env vars (#5096):
+//
+//  1. ResolveNonAuthFromEnv: non-auth env attrs (e.g. cluster_id), env-wins.
+//  2. ConfigFile: the selected profile (host, routing, auth).
+//  3. resolveAuthGapFromEnv: gap-fills the auth attrs and host the profile left
+//     empty from env, so a host-less profile still reaches the env host and a
+//     complete conflicting env auth method surfaces as an error rather than being
+//     silently dropped. It skips envAlwaysSkipAttrs so routing/auth-steering
+//     attrs come from the profile only; using the SDK's ConfigAttributes here
+//     would let those env vars shadow the profile (e.g. DATABRICKS_AUTH_TYPE=basic
+//     over a PAT profile).
+//
+// A profile from DATABRICKS_CONFIG_PROFILE keeps env-first precedence; only an
+// out-of-band profile name triggers this chain.
+var ProfileAuthLoaders = []config.Loader{
+	ResolveNonAuthFromEnv,
+	config.ConfigFile,
+	resolveAuthGapFromEnv,
+}
+
+// StrictProfileLoaders is ProfileAuthLoaders with strictProfileLoader before
+// the config file. The profile name always comes from the config file, based on
+// the host and workspace ID in the bundle configuration, even when auth env vars
+// are set.
+var StrictProfileLoaders = []config.Loader{
+	ResolveNonAuthFromEnv,
+	strictProfileLoader{},
+	config.ConfigFile,
+	resolveAuthGapFromEnv,
+}
+
 var errNoMatchingProfiles = errors.New("no matching config profiles found")
 
 type errMultipleProfiles []string
@@ -25,8 +69,7 @@ func (e errMultipleProfiles) Error() string {
 // AsMultipleProfiles checks if the error is caused by multiple profiles
 // matching the same host. If so, it returns the matching profile names.
 func AsMultipleProfiles(err error) ([]string, bool) {
-	var e errMultipleProfiles
-	if errors.As(err, &e) {
+	if e, ok := errors.AsType[errMultipleProfiles](err); ok {
 		return []string(e), true
 	}
 	return nil, false
@@ -61,6 +104,69 @@ func findMatchingProfile(configFile *config.File, matcher func(*ini.Section) boo
 	return matching[0], nil
 }
 
+// hostAttr is the SDK config attribute name for the workspace/account host.
+const hostAttr = "host"
+
+// envAlwaysSkipAttrs lists env attributes envLoader must never read when a
+// profile is explicitly selected, in either pass: routing (workspace_id,
+// account_id) and auth-steering fields tagged auth:"-" (auth_type, discovery_url,
+// audience, cloud), which HasAuthAttribute misses. Reading these from env — even
+// as a gap-fill — would re-steer or shadow the selected profile's auth (#5096).
+// The host is deliberately absent: like the auth attrs it is skipped only in the
+// env-first pass (see envLoader), then gap-filled after the profile so a
+// host-less profile falls back to the env host.
+// TestEnvAlwaysSkipAttrsCoverSDKInternalEnvAttrs guards against SDK drift.
+var envAlwaysSkipAttrs = map[string]bool{
+	"workspace_id":  true,
+	"account_id":    true,
+	"auth_type":     true,
+	"discovery_url": true,
+	"audience":      true,
+	"cloud":         true,
+}
+
+// envLoader reads config attributes from environment variables. It always skips
+// envAlwaysSkipAttrs so routing/auth-steering attrs come from the selected
+// profile only (#5096). When skipAuth is true it additionally skips the SDK's
+// auth attributes and the host, for the env-first pass that runs before the
+// profile; the gap-fill pass then fills the ones the profile left empty.
+type envLoader struct {
+	name     string
+	skipAuth bool
+}
+
+func (l envLoader) Name() string {
+	return l.name
+}
+
+func (l envLoader) Configure(cfg *config.Config) error {
+	for _, attr := range config.ConfigAttributes {
+		// Routing/auth-steering come from the profile (config file), not env.
+		if envAlwaysSkipAttrs[attr.Name] {
+			continue
+		}
+		// The env-first pass leaves the auth attrs and host for the profile; the
+		// gap-fill pass runs after the profile and fills only those it left empty.
+		if l.skipAuth && (attr.HasAuthAttribute() || attr.Name == hostAttr) {
+			continue
+		}
+		// Don't overwrite an already-set value (SDK loader semantics).
+		if !attr.IsZero(cfg) {
+			continue
+		}
+		v, envName := attr.ReadEnv()
+		if v == "" {
+			continue
+		}
+		if err := attr.SetS(cfg, v); err != nil {
+			return err
+		}
+		// Record the source so `auth describe` attributes the value to env.
+		cfg.SetAttrSource(&attr, config.Source{Type: config.SourceEnv, Name: envName})
+	}
+	return nil
+}
+
 type profileFromHostLoader struct{}
 
 func (l profileFromHostLoader) Name() string {
@@ -95,7 +201,7 @@ func (l profileFromHostLoader) Configure(cfg *config.Config) error {
 		// Check if this section matches the normalized host
 		return normalizeHost(key.Value()) == host
 	})
-	if err == errNoMatchingProfiles {
+	if errors.Is(err, errNoMatchingProfiles) {
 		return nil
 	}
 
@@ -104,7 +210,7 @@ func (l profileFromHostLoader) Configure(cfg *config.Config) error {
 	if names, ok := AsMultipleProfiles(err); ok && cfg.WorkspaceID != "" {
 		originalErr := err
 		match, err = l.disambiguateByWorkspaceID(ctx, configFile, host, cfg.WorkspaceID, names)
-		if err == errNoMatchingProfiles {
+		if errors.Is(err, errNoMatchingProfiles) {
 			// workspace_id didn't match any of the host-matching profiles.
 			// Fall back to the original ambiguity error.
 			log.Debugf(ctx, "workspace_id=%s did not match any profiles for host %s: %v", cfg.WorkspaceID, host, names)
@@ -175,3 +281,98 @@ func (l profileFromHostLoader) isAnyAuthConfigured(cfg *config.Config) bool {
 	// For example, to force "azure-cli", only the host and the auth type will be set.
 	return cfg.AuthType != ""
 }
+
+// strictProfileLoader selects the profile like profileFromHostLoader, but it
+// always runs and fails when there is no single match, so credentials from the
+// environment only reach a host and workspace that a profile allows. Each
+// workspace profile allows one pair of host and workspace ID, and a profile
+// without a workspace_id allows a config without one. Account profiles are
+// skipped. A config with a workspace ID but no host uses the profile it names.
+type strictProfileLoader struct{}
+
+func (strictProfileLoader) Name() string {
+	return "strict-profile-match"
+}
+
+func (strictProfileLoader) Configure(cfg *config.Config) error {
+	// Without a host or workspace ID there is nothing to match, so the next
+	// loaders resolve the config as without strict mode.
+	if cfg.Host == "" && cfg.WorkspaceID == "" {
+		return nil
+	}
+
+	configFile, err := config.LoadFile(cfg.ConfigFile)
+	if errors.Is(err, fs.ErrNotExist) {
+		return fmt.Errorf("strict profile matching: config file %s not found", cmp.Or(cfg.ConfigFile, "~/.databrickscfg"))
+	}
+	if err != nil {
+		return fmt.Errorf("strict profile matching: %w", err)
+	}
+	if cfg.Host == "" {
+		return checkNamedProfile(cfg, configFile)
+	}
+
+	host := normalizeHost(cfg.Host)
+	var hostMatches, matches []string
+	for _, s := range configFile.Sections() {
+		if normalizeHost(sectionValue(s, hostAttr)) != host || !isWorkspaceSection(s) {
+			continue
+		}
+		hostMatches = append(hostMatches, s.Name())
+		if sectionValue(s, "workspace_id") == cfg.WorkspaceID {
+			matches = append(matches, s.Name())
+		}
+	}
+	switch {
+	case len(matches) > 1:
+		return fmt.Errorf("strict profile matching: multiple profiles match host %s: %s", cfg.Host, strings.Join(matches, ", "))
+	case len(hostMatches) == 0:
+		return fmt.Errorf("strict profile matching: no workspace profile matches host %s", cfg.Host)
+	case len(matches) == 0 && cfg.WorkspaceID == "":
+		return fmt.Errorf("strict profile matching: host %s requires a workspace ID; set workspace.workspace_id or add ?o=<workspace-id> to workspace.host", cfg.Host)
+	case len(matches) == 0:
+		return fmt.Errorf("strict profile matching: no profile for host %s has workspace_id %s", cfg.Host, cfg.WorkspaceID)
+	}
+
+	// A CLI started from a bundle script receives the selected profile through
+	// DATABRICKS_CONFIG_PROFILE, so only a different profile is an error.
+	if cfg.Profile != "" && cfg.Profile != matches[0] {
+		return fmt.Errorf("strict profile matching: profile %s does not match profile %s selected for host %s", cfg.Profile, matches[0], cfg.Host)
+	}
+	cfg.Profile = matches[0]
+	return nil
+}
+
+// checkNamedProfile checks the profile named by a config with a workspace ID but
+// no host. There is no host in the config to compare, so the host comes from the
+// named profile, and the profile must have the config's workspace ID.
+func checkNamedProfile(cfg *config.Config, configFile *config.File) error {
+	if cfg.Profile == "" {
+		return fmt.Errorf("strict profile matching: workspace_id %s needs a host; set workspace.host, or select a profile with --profile, workspace.profile or [__settings__].default_profile", cfg.WorkspaceID)
+	}
+	s, err := configFile.GetSection(cfg.Profile)
+	if err != nil || sectionValue(s, hostAttr) == "" || !isWorkspaceSection(s) {
+		return fmt.Errorf("strict profile matching: %s is not a workspace profile with a host in the config file", cfg.Profile)
+	}
+	if sectionValue(s, "workspace_id") != cfg.WorkspaceID {
+		return fmt.Errorf("strict profile matching: profile %s does not have workspace_id %s", cfg.Profile, cfg.WorkspaceID)
+	}
+	return nil
+}
+
+func isWorkspaceSection(s *ini.Section) bool {
+	return profile.MatchWorkspaceProfiles(profile.Profile{
+		AccountID:   sectionValue(s, "account_id"),
+		WorkspaceID: sectionValue(s, "workspace_id"),
+	})
+}
+
+// sectionValue returns the value of a key, or "" when the section doesn't have
+// it. Unlike Section.Key, it doesn't add a missing key to the section.
+func sectionValue(s *ini.Section, name string) string {
+	key, err := s.GetKey(name)
+	if err != nil {
+		return ""
+	}
+	return key.Value()
+}
diff --git a/libs/databrickscfg/loader_test.go b/libs/databrickscfg/loader_test.go
index c53351ae42b..9fdf993d394 100644
--- a/libs/databrickscfg/loader_test.go
+++ b/libs/databrickscfg/loader_test.go
@@ -2,6 +2,8 @@ package databrickscfg
 
 import (
 	"errors"
+	"os"
+	"path/filepath"
 	"testing"
 
 	"github.com/databricks/databricks-sdk-go/config"
@@ -26,7 +28,7 @@ func TestLoaderSkipsExistingAuth(t *testing.T) {
 		Loaders: []config.Loader{
 			ResolveProfileFromHost,
 		},
-		Host:  "https://foo",
+		Host:  "https://foo.test",
 		Token: "nonempty means pat auth",
 	}
 
@@ -34,13 +36,143 @@ func TestLoaderSkipsExistingAuth(t *testing.T) {
 	assert.NoError(t, err)
 }
 
+func TestResolveNonAuthFromEnvSkipsHostAndAuth(t *testing.T) {
+	t.Setenv("DATABRICKS_HOST", "https://env.test")
+	t.Setenv("DATABRICKS_TOKEN", "env-token")
+	// auth_type, discovery_url, audience and cloud are tagged auth:"-", so
+	// HasAuthAttribute misses them; they steer auth and must still be skipped.
+	t.Setenv("DATABRICKS_AUTH_TYPE", "oauth-m2m")
+	t.Setenv("DATABRICKS_DISCOVERY_URL", "https://discovery.env.test")
+	t.Setenv("DATABRICKS_TOKEN_AUDIENCE", "env-audience")
+	t.Setenv("DATABRICKS_CLOUD", "azure")
+	// workspace_id and account_id are routing identifiers, also skipped.
+	t.Setenv("DATABRICKS_WORKSPACE_ID", "env-workspace")
+	t.Setenv("DATABRICKS_ACCOUNT_ID", "env-account")
+	t.Setenv("DATABRICKS_CLUSTER_ID", "env-cluster")
+
+	cfg := &config.Config{}
+	err := ResolveNonAuthFromEnv.Configure(cfg)
+	require.NoError(t, err)
+
+	// Host, routing and auth settings are left for the profile (config file) to set.
+	assert.Empty(t, cfg.Host)
+	assert.Empty(t, cfg.Token)
+	assert.Empty(t, cfg.AuthType)
+	assert.Empty(t, cfg.DiscoveryURL)
+	assert.Empty(t, cfg.TokenAudience)
+	assert.Empty(t, cfg.Cloud)
+	assert.Empty(t, cfg.WorkspaceID)
+	assert.Empty(t, cfg.AccountID)
+	// Non-auth attributes are still populated from the environment.
+	assert.Equal(t, "env-cluster", cfg.ClusterID)
+}
+
+func TestProfileAuthLoadersProfileWinsOverSteeringEnv(t *testing.T) {
+	// A PAT profile plus auth-steering/routing env vars. The profile owns
+	// host/routing/auth-steering, so these env vars must not shadow it (#5096).
+	// In particular DATABRICKS_AUTH_TYPE=basic must not force basic auth over the
+	// profile's PAT.
+	t.Setenv("DATABRICKS_AUTH_TYPE", "basic")
+	t.Setenv("DATABRICKS_DISCOVERY_URL", "https://discovery.env.test")
+	t.Setenv("DATABRICKS_CLOUD", "azure")
+	t.Setenv("DATABRICKS_WORKSPACE_ID", "env-workspace")
+	t.Setenv("DATABRICKS_ACCOUNT_ID", "env-account")
+
+	cfg := config.Config{
+		Loaders:    ProfileAuthLoaders,
+		ConfigFile: "profile/testdata/databrickscfg",
+		Profile:    "DEFAULT",
+	}
+
+	err := cfg.EnsureResolved()
+	require.NoError(t, err)
+
+	assert.Equal(t, "https://default.test", cfg.Host)
+	assert.Equal(t, "default", cfg.Token)
+	// Steering/routing env vars did not shadow the profile.
+	assert.Empty(t, cfg.AuthType)
+	assert.Empty(t, cfg.DiscoveryURL)
+	assert.Empty(t, cfg.Cloud)
+	assert.Empty(t, cfg.WorkspaceID)
+	assert.Empty(t, cfg.AccountID)
+}
+
+func TestProfileAuthLoadersGapFillsHostFromEnv(t *testing.T) {
+	// A selected profile that leaves the host empty falls back to the env host,
+	// mirroring the token gap-fill (#5096). Auth-steering env vars stay ignored.
+	dir := t.TempDir()
+	cfgFile := filepath.Join(dir, ".databrickscfg")
+	require.NoError(t, os.WriteFile(cfgFile, []byte("[hostless]\ncluster_id = env-cluster\n"), 0o600))
+
+	t.Setenv("DATABRICKS_HOST", "https://env.test")
+	t.Setenv("DATABRICKS_TOKEN", "env-token")
+	t.Setenv("DATABRICKS_AUTH_TYPE", "basic")
+
+	cfg := config.Config{
+		Loaders:    ProfileAuthLoaders,
+		ConfigFile: cfgFile,
+		Profile:    "hostless",
+	}
+
+	err := cfg.EnsureResolved()
+	require.NoError(t, err)
+
+	assert.Equal(t, "https://env.test", cfg.Host)
+	assert.Equal(t, "env-token", cfg.Token)
+	// Auth-steering env var did not leak in via the gap-fill.
+	assert.Empty(t, cfg.AuthType)
+}
+
+func TestProfileAuthLoadersConflictingEnvAuthMethodErrors(t *testing.T) {
+	// Profile has a PAT; env gap-fills a different complete method (OAuth M2M).
+	// The config then carries two auth methods, which the SDK rejects rather
+	// than silently dropping the env one (#5096).
+	t.Setenv("DATABRICKS_CLIENT_ID", "env-client-id")
+	t.Setenv("DATABRICKS_CLIENT_SECRET", "env-client-secret")
+
+	cfg := config.Config{
+		Loaders:    ProfileAuthLoaders,
+		ConfigFile: "profile/testdata/databrickscfg",
+		Profile:    "DEFAULT",
+	}
+
+	err := cfg.EnsureResolved()
+	require.ErrorContains(t, err, "more than one authorization method configured")
+}
+
+// TestEnvAlwaysSkipAttrsCoverSDKInternalEnvAttrs fails when an SDK bump adds an
+// Internal (auth:"-") env-backed attribute that is neither skipped nor listed as
+// a reviewed env-first attribute, forcing a human to classify it (#5096).
+func TestEnvAlwaysSkipAttrsCoverSDKInternalEnvAttrs(t *testing.T) {
+	knownEnvFirstInternal := map[string]bool{
+		"oauth_callback_port":         true,
+		"disable_oauth_refresh_token": true,
+		"debug_truncate_bytes":        true,
+		"debug_headers":               true,
+		"rate_limit":                  true,
+	}
+
+	for _, attr := range config.ConfigAttributes {
+		if !attr.Internal || len(attr.EnvVars) == 0 {
+			continue
+		}
+		if envAlwaysSkipAttrs[attr.Name] || knownEnvFirstInternal[attr.Name] {
+			continue
+		}
+		t.Errorf("SDK config attribute %q (env %v) is internal (auth:\"-\") but unclassified: "+
+			"add it to envAlwaysSkipAttrs if it steers auth/routing, or to "+
+			"knownEnvFirstInternal if env-first precedence is safe (#5096)",
+			attr.Name, attr.EnvVars)
+	}
+}
+
 func TestLoaderSkipsExplicitAuthType(t *testing.T) {
 	cfg := config.Config{
 		Loaders: []config.Loader{
 			ResolveProfileFromHost,
 		},
 		ConfigFile: "testdata/databrickscfg",
-		Host:       "https://default",
+		Host:       "https://default.test",
 		AuthType:   "azure-cli",
 	}
 
@@ -57,7 +189,7 @@ func TestLoaderSkipsNonExistingConfigFile(t *testing.T) {
 			ResolveProfileFromHost,
 		},
 		ConfigFile: "idontexist",
-		Host:       "https://default",
+		Host:       "https://default.test",
 	}
 
 	err := cfg.EnsureResolved()
@@ -71,7 +203,7 @@ func TestLoaderErrorsOnInvalidFile(t *testing.T) {
 			ResolveProfileFromHost,
 		},
 		ConfigFile: "profile/testdata/badcfg",
-		Host:       "https://default",
+		Host:       "https://default.test",
 	}
 
 	err := cfg.EnsureResolved()
@@ -84,7 +216,7 @@ func TestLoaderSkipsNoMatchingHost(t *testing.T) {
 			ResolveProfileFromHost,
 		},
 		ConfigFile: "profile/testdata/databrickscfg",
-		Host:       "https://noneofthehostsmatch",
+		Host:       "https://noneofthehostsmatch.test",
 	}
 
 	err := cfg.EnsureResolved()
@@ -98,7 +230,7 @@ func TestLoaderMatchingHost(t *testing.T) {
 			ResolveProfileFromHost,
 		},
 		ConfigFile: "profile/testdata/databrickscfg",
-		Host:       "https://default",
+		Host:       "https://default.test",
 	}
 
 	err := cfg.EnsureResolved()
@@ -113,7 +245,7 @@ func TestLoaderMatchingHostWithQuery(t *testing.T) {
 			ResolveProfileFromHost,
 		},
 		ConfigFile: "profile/testdata/databrickscfg",
-		Host:       "https://query/?foo=bar",
+		Host:       "https://query.test/?foo=bar",
 	}
 
 	err := cfg.EnsureResolved()
@@ -128,12 +260,12 @@ func TestLoaderErrorsOnMultipleMatches(t *testing.T) {
 			ResolveProfileFromHost,
 		},
 		ConfigFile: "profile/testdata/databrickscfg",
-		Host:       "https://foo/bar",
+		Host:       "https://foo.test/bar",
 	}
 
 	err := cfg.EnsureResolved()
 	assert.Error(t, err)
-	assert.ErrorContains(t, err, "https://foo: multiple profiles matched: foo1, foo2")
+	assert.ErrorContains(t, err, "https://foo.test: multiple profiles matched: foo1, foo2")
 }
 
 func TestAsMultipleProfilesExtractsNames(t *testing.T) {
@@ -142,7 +274,7 @@ func TestAsMultipleProfilesExtractsNames(t *testing.T) {
 			ResolveProfileFromHost,
 		},
 		ConfigFile: "profile/testdata/databrickscfg",
-		Host:       "https://foo/bar",
+		Host:       "https://foo.test/bar",
 	}
 
 	err := cfg.EnsureResolved()
@@ -243,3 +375,111 @@ func TestLoaderNoWorkspaceIDMatchFallsThrough(t *testing.T) {
 	require.Error(t, err)
 	assert.ErrorContains(t, err, "multiple profiles matched: spog-ws1, spog-ws2")
 }
+
+// strictProfiles has the profiles a caller writes for one workspace: the
+// classic host, the classic host with the workspace ID, and a custom host shared
+// by several workspaces. The account profile on the custom host is skipped.
+const strictProfiles = `
+[workspace_classic]
+host = https://classic.test
+
+[workspace_classic_id]
+host = https://classic.test
+workspace_id = 111
+
+[workspace_custom_host]
+host = https://custom.test
+workspace_id = 111
+
+[account_custom_host]
+host = https://custom.test
+account_id = abc
+`
+
+func writeTestConfigFile(t *testing.T, contents string) string {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), ".databrickscfg")
+	require.NoError(t, os.WriteFile(path, []byte(contents), 0o600))
+	return path
+}
+
+func TestStrictProfileLoader(t *testing.T) {
+	profiles := writeTestConfigFile(t, strictProfiles)
+	ambiguous := writeTestConfigFile(t, "[DEFAULT]\nhost = https://classic.test\n\n[workspace_classic]\nhost = https://classic.test\n")
+	missing := filepath.Join(t.TempDir(), "missing")
+
+	for _, tc := range []struct {
+		name        string
+		configFile  string
+		host        string
+		workspaceID string
+		profile     string
+		wantProfile string
+		wantErr     string
+	}{
+		// Without a host or workspace ID there is nothing to match.
+		{name: "empty config", configFile: profiles},
+		{name: "empty config without config file", configFile: missing},
+		{name: "empty config keeps the profile", configFile: profiles, profile: "workspace_custom_host", wantProfile: "workspace_custom_host"},
+
+		// A host must match exactly one workspace profile by host and workspace ID.
+		{name: "classic host", configFile: profiles, host: "https://classic.test", wantProfile: "workspace_classic"},
+		{name: "classic host with trailing slash", configFile: profiles, host: "https://classic.test/", wantProfile: "workspace_classic"},
+		{name: "classic host with workspace ID", configFile: profiles, host: "https://classic.test", workspaceID: "111", wantProfile: "workspace_classic_id"},
+		{name: "custom host with workspace ID", configFile: profiles, host: "https://custom.test", workspaceID: "111", wantProfile: "workspace_custom_host"},
+		{name: "classic host with another workspace ID", configFile: profiles, host: "https://classic.test", workspaceID: "222", wantErr: "no profile for host https://classic.test has workspace_id 222"},
+		{name: "custom host without workspace ID", configFile: profiles, host: "https://custom.test", wantErr: "host https://custom.test requires a workspace ID"},
+		{name: "custom host with another workspace ID", configFile: profiles, host: "https://custom.test", workspaceID: "222", wantErr: "no profile for host https://custom.test has workspace_id 222"},
+		{name: "unknown host", configFile: profiles, host: "https://unknown.test", wantErr: "no workspace profile matches host https://unknown.test"},
+		{name: "host of DEFAULT and a named profile", configFile: ambiguous, host: "https://classic.test", wantErr: "multiple profiles match host https://classic.test: DEFAULT, workspace_classic"},
+		{name: "host without config file", configFile: missing, host: "https://classic.test", wantErr: "config file " + missing + " not found"},
+
+		// A profile set together with a host must be the matched one.
+		{name: "profile that matches the host", configFile: profiles, host: "https://classic.test", profile: "workspace_classic", wantProfile: "workspace_classic"},
+		{name: "profile that doesn't match the host", configFile: profiles, host: "https://classic.test", profile: "workspace_classic_id", wantErr: "profile workspace_classic_id does not match profile workspace_classic selected for host https://classic.test"},
+
+		// A workspace ID without a host needs a profile with that workspace ID.
+		{name: "workspace ID with a matching profile", configFile: profiles, workspaceID: "111", profile: "workspace_custom_host", wantProfile: "workspace_custom_host"},
+		{name: "workspace ID without a profile", configFile: profiles, workspaceID: "111", wantErr: "workspace_id 111 needs a host"},
+		{name: "workspace ID with a profile without it", configFile: profiles, workspaceID: "111", profile: "workspace_classic", wantErr: "profile workspace_classic does not have workspace_id 111"},
+		{name: "workspace ID with an account profile", configFile: profiles, workspaceID: "111", profile: "account_custom_host", wantErr: "account_custom_host is not a workspace profile with a host"},
+		{name: "workspace ID with an unknown profile", configFile: profiles, workspaceID: "111", profile: "unknown", wantErr: "unknown is not a workspace profile with a host"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			cfg := config.Config{
+				Loaders:     []config.Loader{strictProfileLoader{}},
+				ConfigFile:  tc.configFile,
+				Host:        tc.host,
+				WorkspaceID: tc.workspaceID,
+				Profile:     tc.profile,
+			}
+
+			err := cfg.EnsureResolved()
+			if tc.wantErr != "" {
+				assert.ErrorContains(t, err, tc.wantErr)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tc.wantProfile, cfg.Profile)
+		})
+	}
+}
+
+func TestStrictProfileLoadersIgnoreEnvHost(t *testing.T) {
+	// The env token reaches only the host of the selected profile, even when the
+	// env also sets a host.
+	t.Setenv("DATABRICKS_HOST", "https://env.test")
+	t.Setenv("DATABRICKS_TOKEN", "env-token")
+
+	cfg := config.Config{
+		Loaders:     StrictProfileLoaders,
+		ConfigFile:  writeTestConfigFile(t, strictProfiles),
+		WorkspaceID: "111",
+		Profile:     "workspace_custom_host",
+	}
+
+	err := cfg.EnsureResolved()
+	require.NoError(t, err)
+	assert.Equal(t, "https://custom.test", cfg.Host)
+	assert.Equal(t, "env-token", cfg.Token)
+}
diff --git a/libs/databrickscfg/ops.go b/libs/databrickscfg/ops.go
index c4d0f1cc797..6358c5ba49d 100644
--- a/libs/databrickscfg/ops.go
+++ b/libs/databrickscfg/ops.go
@@ -7,6 +7,7 @@ import (
 	"io/fs"
 	"os"
 	"strings"
+	"sync"
 
 	"github.com/databricks/cli/libs/env"
 	"github.com/databricks/cli/libs/log"
@@ -38,6 +39,44 @@ func GetConfiguredDefaultProfile(ctx context.Context, configFilePath string) (st
 	return GetConfiguredDefaultProfileFrom(configFile), nil
 }
 
+// ResolveDefaultProfile returns the default profile from the config file
+// pointed to by DATABRICKS_CONFIG_FILE (or ~/.databrickscfg when unset):
+// [__settings__].default_profile, else [DEFAULT] if it has a host key,
+// else "". Returns "" with no error when the file is missing or parsing
+// fails (a warning is logged on parse error).
+//
+// Callers must respect their own higher-priority sources (an explicit
+// --profile flag or DATABRICKS_CONFIG_PROFILE env var) before consulting
+// this helper. default_profile and [DEFAULT] are CLI-level fallbacks; the
+// SDK loader silently falls back to [DEFAULT] but leaves cfg.Profile empty,
+// which breaks the per-profile OAuth cache key. Pinning the name here keeps
+// cfg.Profile in sync with what the SDK would read.
+//
+// Single-profile fallback (using "the only profile in the file" as the
+// default) is intentionally NOT applied: that is a prompt-seeding convenience
+// (see GetDefaultProfile), not an auth rule, and it would silently route a
+// single account-only profile through the workspace-client path.
+func ResolveDefaultProfile(ctx context.Context) string {
+	configFilePath := env.Get(ctx, "DATABRICKS_CONFIG_FILE")
+	configFile, err := loadConfigFile(ctx, configFilePath)
+	if err != nil {
+		log.Warnf(ctx, "Failed to load default profile: %v", err)
+		return ""
+	}
+	if configFile == nil {
+		return ""
+	}
+	if profile := GetConfiguredDefaultProfileFrom(configFile); profile != "" {
+		log.Debugf(ctx, "profile %q resolved from [__settings__].default_profile", profile)
+		return profile
+	}
+	if section := configFile.Section(ini.DefaultSection); section.HasKey("host") {
+		log.Debugf(ctx, "profile %q resolved from the [DEFAULT] section", ini.DefaultSection)
+		return ini.DefaultSection
+	}
+	return ""
+}
+
 // GetConfiguredDefaultProfileFrom returns the explicit default profile from
 // [__settings__].default_profile, or "" when it is not set or when the value
 // is the reserved __settings__ section name itself.
@@ -196,6 +235,55 @@ func SetDefaultProfile(ctx context.Context, profileName, configFilePath string)
 	return writeConfigFile(ctx, configFile)
 }
 
+// SetConfiguredAuthStorage writes the auth_storage key to the [__settings__]
+// section. Used by auth login to persist a plaintext fallback when the OS
+// keyring is unreachable, so subsequent commands skip the keyring probe and
+// route directly to the file cache.
+func SetConfiguredAuthStorage(ctx context.Context, value, configFilePath string) error {
+	configFile, err := loadOrCreateConfigFile(ctx, configFilePath)
+	if err != nil {
+		return err
+	}
+
+	section, err := configFile.GetSection(databricksSettingsSection)
+	if err != nil {
+		section, err = configFile.NewSection(databricksSettingsSection)
+		if err != nil {
+			return fmt.Errorf("cannot create %s section: %w", databricksSettingsSection, err)
+		}
+	}
+
+	section.Key(authStorageKey).SetValue(value)
+
+	return writeConfigFile(ctx, configFile)
+}
+
+// SaveResourcesToProfile writes (or clears) the `resources` key on a profile
+// section. `resources` is a comma-separated list of RFC 8707 resource indicators
+// requested during U2M login. An empty list removes the key. The profile
+// section must already exist.
+//
+// TODO: this value should ideally be passed with other values in Config.
+// This requires updating the SDK first, and then this dependency. The current
+// code is a short-cut to allow the CLI to support resources without having to
+// go through that cross-repos loop.
+func SaveResourcesToProfile(ctx context.Context, profileName, configFilePath string, resources []string) error {
+	configFile, err := loadOrCreateConfigFile(ctx, configFilePath)
+	if err != nil {
+		return err
+	}
+	section, err := configFile.GetSection(profileName)
+	if err != nil {
+		return fmt.Errorf("profile %q not found: %w", profileName, err)
+	}
+	if len(resources) == 0 {
+		section.DeleteKey("resources")
+	} else {
+		section.Key("resources").SetValue(strings.Join(resources, ","))
+	}
+	return writeConfigFile(ctx, configFile)
+}
+
 // ClearDefaultProfile removes the default_profile key from the [__settings__]
 // section if the current default matches the given profile name.
 func ClearDefaultProfile(ctx context.Context, profileName, configFilePath string) error {
@@ -265,7 +353,7 @@ func matchOrCreateSection(ctx context.Context, configFile *config.File, cfg *con
 		// Check if this section matches the normalized host
 		return normalizeHost(host) == normalizeHost(cfg.Host)
 	})
-	if err == errNoMatchingProfiles {
+	if errors.Is(err, errNoMatchingProfiles) {
 		section, err = configFile.NewSection(cfg.Profile)
 		if err != nil {
 			return nil, fmt.Errorf("cannot create new profile: %w", err)
@@ -296,7 +384,16 @@ func AuthCredentialKeys() []string {
 	return keys
 }
 
+// We document databrickscfg files with a [DEFAULT] header and wish to keep it that way.
+// This, however, does mean we emit a [DEFAULT] section even if it's empty.
+// ini.DefaultHeader is process-global, so it is enabled on first write instead of
+// at import time to keep this package free of import side effects.
+var enableDefaultHeader = sync.OnceFunc(func() {
+	ini.DefaultHeader = true
+})
+
 func writeConfigFile(ctx context.Context, configFile *config.File) error {
+	enableDefaultHeader()
 	section := configFile.Section(ini.DefaultSection)
 	if len(section.Keys()) == 0 && section.Comment == "" {
 		section.Comment = defaultComment
@@ -438,9 +535,3 @@ func ValidateConfigAndProfileHost(cfg *config.Config, profile string) error {
 
 	return nil
 }
-
-func init() {
-	// We document databrickscfg files with a [DEFAULT] header and wish to keep it that way.
-	// This, however, does mean we emit a [DEFAULT] section even if it's empty.
-	ini.DefaultHeader = true
-}
diff --git a/libs/databrickscfg/ops_test.go b/libs/databrickscfg/ops_test.go
index 0555a8171f6..8fe1956a81f 100644
--- a/libs/databrickscfg/ops_test.go
+++ b/libs/databrickscfg/ops_test.go
@@ -5,6 +5,7 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/databricks/cli/libs/env"
 	"github.com/databricks/databricks-sdk-go/config"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -66,7 +67,7 @@ func TestMatchOrCreateSection_AccountID(t *testing.T) {
 
 func TestMatchOrCreateSection_NormalizeHost(t *testing.T) {
 	cfg := &config.Config{
-		Host: "https://query/?o=abracadabra",
+		Host: "https://query.test/?o=abracadabra",
 	}
 	file, err := loadOrCreateConfigFile(t.Context(), "profile/testdata/databrickscfg")
 	assert.NoError(t, err)
@@ -90,7 +91,7 @@ func TestMatchOrCreateSection_NoProfileOrHost(t *testing.T) {
 
 func TestMatchOrCreateSection_MultipleProfiles(t *testing.T) {
 	cfg := &config.Config{
-		Host: "https://foo",
+		Host: "https://foo.test",
 	}
 	file, err := loadOrCreateConfigFile(t.Context(), "profile/testdata/databrickscfg")
 	assert.NoError(t, err)
@@ -184,6 +185,40 @@ default_profile = DEFAULT
 `, string(contents))
 }
 
+func TestSaveResourcesToProfile(t *testing.T) {
+	ctx := t.Context()
+	path := filepath.Join(t.TempDir(), "databrickscfg")
+
+	require.NoError(t, SaveToProfile(ctx, &config.Config{
+		ConfigFile: path,
+		Profile:    "u2m",
+		Host:       "https://foo",
+	}))
+
+	resources := []string{
+		"https://foo/ai-gateway/mcp/system.ai.github",
+		"https://foo/ai-gateway/mcp/system.ai.slack",
+	}
+	require.NoError(t, SaveResourcesToProfile(ctx, "u2m", path, resources))
+
+	contents, err := os.ReadFile(path)
+	require.NoError(t, err)
+	assert.Contains(t, string(contents), "resources = https://foo/ai-gateway/mcp/system.ai.github,https://foo/ai-gateway/mcp/system.ai.slack")
+
+	// An empty list clears the key.
+	require.NoError(t, SaveResourcesToProfile(ctx, "u2m", path, nil))
+	contents, err = os.ReadFile(path)
+	require.NoError(t, err)
+	assert.NotContains(t, string(contents), "resources")
+}
+
+func TestSaveResourcesToProfile_MissingProfile(t *testing.T) {
+	ctx := t.Context()
+	path := filepath.Join(t.TempDir(), "databrickscfg")
+	err := SaveResourcesToProfile(ctx, "does-not-exist", path, []string{"https://foo/ai-gateway/mcp/system.ai.github"})
+	assert.ErrorContains(t, err, `profile "does-not-exist" not found`)
+}
+
 func TestGetDefaultProfile(t *testing.T) {
 	testCases := []struct {
 		name    string
@@ -254,7 +289,7 @@ func TestGetDefaultProfile_NoFile(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "databrickscfg")
 	got, err := GetDefaultProfile(t.Context(), path)
 	require.NoError(t, err)
-	assert.Equal(t, "", got)
+	assert.Empty(t, got)
 	// Verify the file was NOT created as a side effect.
 	assert.NoFileExists(t, path)
 }
@@ -309,11 +344,93 @@ func TestGetConfiguredDefaultProfile_NoFile(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "databrickscfg")
 	got, err := GetConfiguredDefaultProfile(t.Context(), path)
 	require.NoError(t, err)
-	assert.Equal(t, "", got)
+	assert.Empty(t, got)
 	// Verify the file was NOT created as a side effect.
 	assert.NoFileExists(t, path)
 }
 
+func TestResolveDefaultProfile(t *testing.T) {
+	cases := []struct {
+		name     string
+		contents string
+		want     string
+	}{
+		{
+			name:     "explicit default_profile",
+			contents: "[__settings__]\ndefault_profile = my-workspace\n\n[my-workspace]\nhost = https://abc\n",
+			want:     "my-workspace",
+		},
+		{
+			name:     "settings without default_profile, no DEFAULT section",
+			contents: "[__settings__]\nauth_storage = secure\n\n[my-workspace]\nhost = https://abc\n",
+			want:     "",
+		},
+		{
+			name:     "single profile is not auto-promoted",
+			contents: "[only]\nhost = https://abc\n",
+			want:     "",
+		},
+		{
+			name:     "self-referencing __settings__ is ignored",
+			contents: "[__settings__]\ndefault_profile = __settings__\n\n[profile1]\nhost = https://abc\n",
+			want:     "",
+		},
+		{
+			name:     "DEFAULT section with host is used when settings is empty",
+			contents: "[DEFAULT]\nhost = https://default.abc\n\n[profile1]\nhost = https://abc\n",
+			want:     "DEFAULT",
+		},
+		{
+			name:     "DEFAULT section without host is ignored",
+			contents: "[DEFAULT]\naccount_id = 1234\n\n[profile1]\nhost = https://abc\n",
+			want:     "",
+		},
+		{
+			name:     "settings takes precedence over DEFAULT section",
+			contents: "[__settings__]\ndefault_profile = override\n\n[DEFAULT]\nhost = https://default.abc\n\n[override]\nhost = https://override.abc\n",
+			want:     "override",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			path := filepath.Join(t.TempDir(), "databrickscfg")
+			require.NoError(t, os.WriteFile(path, []byte(tc.contents), 0o600))
+
+			ctx := env.Set(t.Context(), "DATABRICKS_CONFIG_FILE", path)
+			got := ResolveDefaultProfile(ctx)
+			assert.Equal(t, tc.want, got)
+		})
+	}
+}
+
+func TestResolveDefaultProfile_FileMissing(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "does-not-exist")
+	ctx := env.Set(t.Context(), "DATABRICKS_CONFIG_FILE", path)
+	assert.Empty(t, ResolveDefaultProfile(ctx))
+}
+
+func TestResolveDefaultProfile_DefaultsToHomeFile(t *testing.T) {
+	home := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(home, ".databrickscfg"),
+		[]byte("[__settings__]\ndefault_profile = home-profile\n\n[home-profile]\nhost = https://abc\n"),
+		0o600))
+
+	ctx := env.WithUserHomeDir(t.Context(), home)
+	// DATABRICKS_CONFIG_FILE intentionally unset.
+	ctx = env.Set(ctx, "DATABRICKS_CONFIG_FILE", "")
+	assert.Equal(t, "home-profile", ResolveDefaultProfile(ctx))
+}
+
+func TestResolveDefaultProfile_ParseError(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "databrickscfg")
+	require.NoError(t, os.WriteFile(path, []byte("not a valid ini file\n[unterminated"), 0o600))
+
+	ctx := env.Set(t.Context(), "DATABRICKS_CONFIG_FILE", path)
+	// Parse error is logged as a warning but ResolveDefaultProfile returns "".
+	assert.Empty(t, ResolveDefaultProfile(ctx))
+}
+
 func TestSetDefaultProfile(t *testing.T) {
 	testCases := []struct {
 		name    string
@@ -707,5 +824,59 @@ func TestGetConfiguredAuthStorage_MissingFile(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "does-not-exist")
 	got, err := GetConfiguredAuthStorage(t.Context(), path)
 	require.NoError(t, err)
-	assert.Equal(t, "", got)
+	assert.Empty(t, got)
+}
+
+func TestSetConfiguredAuthStorage(t *testing.T) {
+	cases := []struct {
+		name     string
+		contents string
+	}{
+		{
+			name:     "missing file is created",
+			contents: "",
+		},
+		{
+			name:     "missing settings section is created",
+			contents: "[my-ws]\nhost = https://example.cloud.databricks.com\n",
+		},
+		{
+			name:     "settings section without auth_storage gets the key added",
+			contents: "[__settings__]\ndefault_profile = my-ws\n",
+		},
+		{
+			name:     "existing auth_storage value is overwritten",
+			contents: "[__settings__]\nauth_storage = secure\n",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			path := filepath.Join(t.TempDir(), ".databrickscfg")
+			if tc.contents != "" {
+				require.NoError(t, os.WriteFile(path, []byte(tc.contents), 0o600))
+			}
+
+			require.NoError(t, SetConfiguredAuthStorage(t.Context(), "plaintext", path))
+
+			got, err := GetConfiguredAuthStorage(t.Context(), path)
+			require.NoError(t, err)
+			assert.Equal(t, "plaintext", got)
+		})
+	}
+}
+
+func TestSetConfiguredAuthStorage_PreservesOtherSettings(t *testing.T) {
+	path := filepath.Join(t.TempDir(), ".databrickscfg")
+	require.NoError(t, os.WriteFile(path, []byte("[__settings__]\ndefault_profile = dev\n\n[dev]\nhost = https://example.cloud.databricks.com\n"), 0o600))
+
+	require.NoError(t, SetConfiguredAuthStorage(t.Context(), "plaintext", path))
+
+	defaultProfile, err := GetConfiguredDefaultProfile(t.Context(), path)
+	require.NoError(t, err)
+	assert.Equal(t, "dev", defaultProfile)
+
+	authStorage, err := GetConfiguredAuthStorage(t.Context(), path)
+	require.NoError(t, err)
+	assert.Equal(t, "plaintext", authStorage)
 }
diff --git a/libs/databrickscfg/profile/file.go b/libs/databrickscfg/profile/file.go
index b7f6074c811..0844794df3a 100644
--- a/libs/databrickscfg/profile/file.go
+++ b/libs/databrickscfg/profile/file.go
@@ -86,7 +86,9 @@ func (f FileProfilerImpl) LoadProfiles(ctx context.Context, fn ProfileMatchFunct
 			ClusterID:            all["cluster_id"],
 			ServerlessComputeID:  all["serverless_compute_id"],
 			HasClientCredentials: all["client_id"] != "" && all["client_secret"] != "",
+			ClientID:             all["client_id"],
 			Scopes:               all["scopes"],
+			Resources:            all["resources"],
 			AuthType:             all["auth_type"],
 		}
 		if fn(profile) {
diff --git a/libs/databrickscfg/profile/file_test.go b/libs/databrickscfg/profile/file_test.go
index 8f6c5ad790c..82243842a94 100644
--- a/libs/databrickscfg/profile/file_test.go
+++ b/libs/databrickscfg/profile/file_test.go
@@ -1,6 +1,7 @@
 package profile
 
 import (
+	"os"
 	"path/filepath"
 	"testing"
 
@@ -64,6 +65,39 @@ func TestLoadProfilesNoConfiguration(t *testing.T) {
 	require.ErrorIs(t, err, ErrNoConfiguration)
 }
 
+func TestLoadProfilesClientID(t *testing.T) {
+	configPath := filepath.Join(t.TempDir(), ".databrickscfg")
+	err := os.WriteFile(configPath, []byte(`[u2m]
+host = https://workspace.test
+auth_type = databricks-cli
+client_id = custom-client-id
+`), 0o600)
+	require.NoError(t, err)
+
+	ctx := env.Set(t.Context(), "DATABRICKS_CONFIG_FILE", configPath)
+	profiles, err := (FileProfilerImpl{}).LoadProfiles(ctx, MatchAllProfiles)
+	require.NoError(t, err)
+	require.Len(t, profiles, 1)
+	assert.Equal(t, "custom-client-id", profiles[0].ClientID)
+	assert.False(t, profiles[0].HasClientCredentials)
+}
+
+func TestLoadProfilesResources(t *testing.T) {
+	configPath := filepath.Join(t.TempDir(), ".databrickscfg")
+	err := os.WriteFile(configPath, []byte(`[u2m]
+host = https://workspace.test
+auth_type = databricks-cli
+resources = https://workspace.test/ai-gateway/mcp/system.ai.github,https://workspace.test/ai-gateway/mcp/system.ai.slack
+`), 0o600)
+	require.NoError(t, err)
+
+	ctx := env.Set(t.Context(), "DATABRICKS_CONFIG_FILE", configPath)
+	profiles, err := (FileProfilerImpl{}).LoadProfiles(ctx, MatchAllProfiles)
+	require.NoError(t, err)
+	require.Len(t, profiles, 1)
+	assert.Equal(t, "https://workspace.test/ai-gateway/mcp/system.ai.github,https://workspace.test/ai-gateway/mcp/system.ai.slack", profiles[0].Resources)
+}
+
 func TestLoadProfilesMatchWorkspace(t *testing.T) {
 	ctx := t.Context()
 	ctx = env.Set(ctx, "DATABRICKS_CONFIG_FILE", "./testdata/databrickscfg")
diff --git a/libs/databrickscfg/profile/profile.go b/libs/databrickscfg/profile/profile.go
index efd358cd4e5..d3627946ee5 100644
--- a/libs/databrickscfg/profile/profile.go
+++ b/libs/databrickscfg/profile/profile.go
@@ -6,6 +6,10 @@ import (
 	"github.com/databricks/databricks-sdk-go/config"
 )
 
+// WorkspaceIDNone is a sentinel value persisted to .databrickscfg when the
+// user explicitly skips workspace selection for SPOG account-level access.
+const WorkspaceIDNone = "none"
+
 // Profile holds a subset of the keys in a databrickscfg profile.
 // It should only be used for prompting and filtering.
 // Use its name to construct a config.Config.
@@ -17,7 +21,9 @@ type Profile struct {
 	ClusterID            string
 	ServerlessComputeID  string
 	HasClientCredentials bool
+	ClientID             string
 	Scopes               string
+	Resources            string
 	AuthType             string
 }
 
diff --git a/libs/databrickscfg/profile/profiler.go b/libs/databrickscfg/profile/profiler.go
index 56cfdb5f522..d7fb38f255a 100644
--- a/libs/databrickscfg/profile/profiler.go
+++ b/libs/databrickscfg/profile/profiler.go
@@ -3,7 +3,6 @@ package profile
 import (
 	"context"
 
-	"github.com/databricks/cli/libs/auth"
 	"github.com/databricks/databricks-sdk-go/config"
 )
 
@@ -13,7 +12,7 @@ func MatchWorkspaceProfiles(p Profile) bool {
 	// Workspace profile: has workspace_id (covers both classic and SPOG profiles),
 	// or is a regular workspace host (no account_id).
 	// workspace_id = "none" is a sentinel for "skip workspace", so it does NOT count.
-	return (p.WorkspaceID != "" && p.WorkspaceID != auth.WorkspaceIDNone) || p.AccountID == ""
+	return (p.WorkspaceID != "" && p.WorkspaceID != WorkspaceIDNone) || p.AccountID == ""
 }
 
 func MatchAccountProfiles(p Profile) bool {
@@ -21,7 +20,7 @@ func MatchAccountProfiles(p Profile) bool {
 	// workspace_id = "none" is a sentinel for account-level access, treated as empty.
 	// This covers classic accounts.* profiles, legacy unified-host account profiles,
 	// and new SPOG account profiles.
-	return p.Host != "" && p.AccountID != "" && (p.WorkspaceID == "" || p.WorkspaceID == auth.WorkspaceIDNone)
+	return p.Host != "" && p.AccountID != "" && (p.WorkspaceID == "" || p.WorkspaceID == WorkspaceIDNone)
 }
 
 func MatchAllProfiles(p Profile) bool {
diff --git a/libs/databrickscfg/profile/select.go b/libs/databrickscfg/profile/select.go
index d0470ef58fa..63d5207db5b 100644
--- a/libs/databrickscfg/profile/select.go
+++ b/libs/databrickscfg/profile/select.go
@@ -10,8 +10,8 @@ import (
 )
 
 var (
-	defaultActiveTemplate   = `{{.Name | bold}} ({{.Host|faint}})`
-	defaultInactiveTemplate = `{{.Name}}`
+	defaultActiveTemplate   = `{{.Name | bold}}{{if .IsDefault}} {{ "[default]" | green }}{{end}} ({{.Host|faint}})`
+	defaultInactiveTemplate = `{{.Name}}{{if .IsDefault}} [default]{{end}}`
 	defaultSelectedTemplate = "{{ \"Using profile\" | faint }}: {{ .Name | bold }}"
 )
 
@@ -25,13 +25,20 @@ type SelectConfig struct {
 
 	StartInSearchMode bool
 
+	// Default is the name of the default profile. When non-empty and matching a
+	// profile in Profiles, that profile is moved to the top of the list and
+	// rendered with IsDefault=true so templates can decorate it (e.g. with a
+	// "[default]" tag).
+	Default string
+
 	// Go template strings for rendering items. Templates have access to all
-	// [Profile] fields, a Cloud method, and a PaddedName field that is the
-	// profile name right-padded to align with the longest name in the list.
+	// [Profile] fields, a Cloud method, a PaddedName field that is the profile
+	// name right-padded to align with the longest name in the list, and an
+	// IsDefault boolean that is true for the entry matching SelectConfig.Default.
 	//
 	// Defaults:
-	//   Active:   `{{.Name | bold}} ({{.Host|faint}})`
-	//   Inactive: `{{.Name}}`
+	//   Active:   `{{.Name | bold}}{{if .IsDefault}} {{ "[default]" | green }}{{end}} ({{.Host|faint}})`
+	//   Inactive: `{{.Name}}{{if .IsDefault}} [default]{{end}}`
 	//   Selected: `{{ "Using profile" | faint }}: {{ .Name | bold }}`
 	ActiveTemplate   string
 	InactiveTemplate string
@@ -42,29 +49,56 @@ type SelectConfig struct {
 type selectItem struct {
 	Profile
 	PaddedName string
+	IsDefault  bool
 }
 
-// SelectProfile shows an interactive profile picker and returns the name of the
-// selected profile.
-func SelectProfile(ctx context.Context, cfg SelectConfig) (string, error) {
-	if len(cfg.Profiles) == 0 {
-		return "", errors.New("no profiles configured. Run 'databricks auth login' to create a profile")
-	}
-
+// buildSelectItems returns the list of items to render, with the default profile
+// moved to the top and tagged with IsDefault=true. The relative order of the
+// other profiles is preserved.
+func buildSelectItems(profiles Profiles, defaultName string) []selectItem {
 	maxNameLen := 0
-	for _, p := range cfg.Profiles {
-		if len(p.Name) > maxNameLen {
-			maxNameLen = len(p.Name)
-		}
+	for _, p := range profiles {
+		maxNameLen = max(maxNameLen, len(p.Name))
 	}
 
-	items := make([]selectItem, len(cfg.Profiles))
-	for i, p := range cfg.Profiles {
-		items[i] = selectItem{
+	items := make([]selectItem, 0, len(profiles))
+	itemFor := func(p Profile) selectItem {
+		return selectItem{
 			Profile:    p,
 			PaddedName: fmt.Sprintf("%-*s", maxNameLen, p.Name),
+			IsDefault:  defaultName != "" && p.Name == defaultName,
+		}
+	}
+
+	defaultIdx := -1
+	if defaultName != "" {
+		for i, p := range profiles {
+			if p.Name == defaultName {
+				defaultIdx = i
+				break
+			}
 		}
 	}
+	if defaultIdx >= 0 {
+		items = append(items, itemFor(profiles[defaultIdx]))
+	}
+	for i, p := range profiles {
+		if i == defaultIdx {
+			continue
+		}
+		items = append(items, itemFor(p))
+	}
+	return items
+}
+
+// SelectProfile shows an interactive profile picker and returns the name of the
+// selected profile.
+func SelectProfile(ctx context.Context, cfg SelectConfig) (string, error) {
+	if len(cfg.Profiles) == 0 {
+		return "", errors.New("no profiles configured. Run 'databricks auth login' to create a profile")
+	}
+
+	items := buildSelectItems(cfg.Profiles, cfg.Default)
 
 	if cfg.ActiveTemplate == "" {
 		cfg.ActiveTemplate = defaultActiveTemplate
diff --git a/libs/databrickscfg/profile/select_test.go b/libs/databrickscfg/profile/select_test.go
new file mode 100644
index 00000000000..90ba3dc4cde
--- /dev/null
+++ b/libs/databrickscfg/profile/select_test.go
@@ -0,0 +1,76 @@
+package profile
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestBuildSelectItems(t *testing.T) {
+	profiles := Profiles{
+		{Name: "alpha", Host: "https://alpha.cloud.databricks.example"},
+		{Name: "bravo", Host: "https://bravo.cloud.databricks.example"},
+		{Name: "charlie", Host: "https://charlie.cloud.databricks.example"},
+	}
+
+	cases := []struct {
+		name        string
+		defaultName string
+		wantOrder   []string
+		wantDefault string
+	}{
+		{
+			name:        "no default preserves order",
+			defaultName: "",
+			wantOrder:   []string{"alpha", "bravo", "charlie"},
+			wantDefault: "",
+		},
+		{
+			name:        "default in the middle moves to the top",
+			defaultName: "bravo",
+			wantOrder:   []string{"bravo", "alpha", "charlie"},
+			wantDefault: "bravo",
+		},
+		{
+			name:        "default already first stays first",
+			defaultName: "alpha",
+			wantOrder:   []string{"alpha", "bravo", "charlie"},
+			wantDefault: "alpha",
+		},
+		{
+			name:        "default not in profiles is ignored",
+			defaultName: "missing",
+			wantOrder:   []string{"alpha", "bravo", "charlie"},
+			wantDefault: "",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			items := buildSelectItems(profiles, tc.defaultName)
+			gotOrder := make([]string, len(items))
+			gotDefault := ""
+			for i, it := range items {
+				gotOrder[i] = it.Name
+				if it.IsDefault {
+					assert.Empty(t, gotDefault, "more than one item flagged as default")
+					gotDefault = it.Name
+				}
+			}
+			assert.Equal(t, tc.wantOrder, gotOrder)
+			assert.Equal(t, tc.wantDefault, gotDefault)
+		})
+	}
+}
+
+func TestBuildSelectItems_PaddedName(t *testing.T) {
+	profiles := Profiles{
+		{Name: "a"},
+		{Name: "looooong"},
+		{Name: "med"},
+	}
+	items := buildSelectItems(profiles, "")
+	for _, it := range items {
+		assert.Len(t, it.PaddedName, len("looooong"))
+	}
+}
diff --git a/libs/databrickscfg/profile/testdata/databrickscfg b/libs/databrickscfg/profile/testdata/databrickscfg
index c88350a752d..6a02f9844f4 100644
--- a/libs/databrickscfg/profile/testdata/databrickscfg
+++ b/libs/databrickscfg/profile/testdata/databrickscfg
@@ -1,26 +1,26 @@
 [DEFAULT]
-host = https://default
+host = https://default.test
 token = default
 
 [query]
-host = https://query/?o=1234
+host = https://query.test/?o=1234
 token = query
 
 [nohost]
 token = query
 
-# Duplicate entry for https://foo
+# Duplicate entry for https://foo.test
 [foo1]
-host = https://foo
+host = https://foo.test
 token = foo1
 
 [acc]
 host = https://accounts.cloud.databricks.com
 account_id = abc
 
-# Duplicate entry for https://foo
+# Duplicate entry for https://foo.test
 [foo2]
-host = https://foo
+host = https://foo.test
 token = foo2
 
 # SPOG profiles sharing the same host but with different workspace_ids
diff --git a/libs/databrickscfg/profile/testdata/sample-home/.databrickscfg b/libs/databrickscfg/profile/testdata/sample-home/.databrickscfg
index 96c8b7ca165..cdd1c078498 100644
--- a/libs/databrickscfg/profile/testdata/sample-home/.databrickscfg
+++ b/libs/databrickscfg/profile/testdata/sample-home/.databrickscfg
@@ -1,5 +1,5 @@
 [DEFAULT]
-host = https://default
+host = https://default.test
 token = default
 
 [acc]
diff --git a/libs/dbr/context.go b/libs/dbr/context.go
index 8aedc4a07d9..26baff339f1 100644
--- a/libs/dbr/context.go
+++ b/libs/dbr/context.go
@@ -112,6 +112,15 @@ func MockRuntime(ctx context.Context, runtime Environment) context.Context {
 	return context.WithValue(ctx, dbrKey, runtime)
 }
 
+// HasDetection reports whether the context carries a detection result, i.e.
+// whether it descends from [DetectRuntime] or [MockRuntime]. Best-effort
+// callers that can run on contexts where detection never happened (e.g. code
+// reached from tests that execute commands without going through root.Execute)
+// can use it to avoid the panic in [RunsOnRuntime].
+func HasDetection(ctx context.Context) bool {
+	return ctx.Value(dbrKey) != nil
+}
+
 // RunsOnRuntime returns the detection result from the context.
 // It expects a context returned by [DetectRuntime] or [MockRuntime].
 //
diff --git a/libs/dbr/context_test.go b/libs/dbr/context_test.go
index 637ee661937..7d2cca7c2bb 100644
--- a/libs/dbr/context_test.go
+++ b/libs/dbr/context_test.go
@@ -72,6 +72,13 @@ func TestContext_RuntimeVersion(t *testing.T) {
 	})
 }
 
+func TestContext_HasDetection(t *testing.T) {
+	ctx := t.Context()
+	assert.False(t, HasDetection(ctx))
+	assert.True(t, HasDetection(DetectRuntime(ctx)))
+	assert.True(t, HasDetection(MockRuntime(ctx, Environment{})))
+}
+
 func TestContext_RunsOnRuntimeWithMock(t *testing.T) {
 	ctx := t.Context()
 	assert.True(t, RunsOnRuntime(MockRuntime(ctx, Environment{IsDbr: true, Version: "15.4"})))
@@ -143,7 +150,7 @@ func TestParseVersion_Empty(t *testing.T) {
 	assert.Equal(t, ClusterTypeUnknown, v.Type)
 	assert.Equal(t, 0, v.Major)
 	assert.Equal(t, 0, v.Minor)
-	assert.Equal(t, "", v.Raw)
+	assert.Empty(t, v.Raw)
 }
 
 func TestClusterType_String(t *testing.T) {
@@ -160,7 +167,7 @@ func TestVersion_String(t *testing.T) {
 	assert.Equal(t, "client.4.9", v.String())
 
 	v = ParseVersion("")
-	assert.Equal(t, "", v.String())
+	assert.Empty(t, v.String())
 }
 
 func TestContext_RuntimeVersionParsed(t *testing.T) {
diff --git a/libs/diag/diagnostic.go b/libs/diag/diagnostic.go
index fe7090462d4..9356cc9ddd6 100644
--- a/libs/diag/diagnostic.go
+++ b/libs/diag/diagnostic.go
@@ -4,7 +4,7 @@ import (
 	"errors"
 	"fmt"
 
-	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/structs/structpath"
 )
 
 type Diagnostic struct {
@@ -20,11 +20,11 @@ type Diagnostic struct {
 
 	// Locations are the source code locations associated with the diagnostic message.
 	// It may be empty if there are no associated locations.
-	Locations []dyn.Location
+	Locations []Location
 
 	// Paths are paths to the values in the configuration tree that the diagnostic is associated with.
 	// It may be nil if there are no associated paths.
-	Paths []dyn.Path
+	Paths []*structpath.PathNode
 
 	// A diagnostic ID. Only used for select diagnostic messages.
 	ID ID
diff --git a/libs/dyn/location.go b/libs/diag/location.go
similarity index 93%
rename from libs/dyn/location.go
rename to libs/diag/location.go
index b8ec818fcde..3b4a799e348 100644
--- a/libs/dyn/location.go
+++ b/libs/diag/location.go
@@ -1,4 +1,4 @@
-package dyn
+package diag
 
 import (
 	"fmt"
diff --git a/libs/diag/location_test.go b/libs/diag/location_test.go
new file mode 100644
index 00000000000..005254009e9
--- /dev/null
+++ b/libs/diag/location_test.go
@@ -0,0 +1,13 @@
+package diag_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/diag"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestLocation(t *testing.T) {
+	loc := diag.Location{File: "file", Line: 1, Column: 2}
+	assert.Equal(t, "file:1:2", loc.String())
+}
diff --git a/libs/diag/sdk_error.go b/libs/diag/sdk_error.go
index 1099dd738dc..d190498d6bf 100644
--- a/libs/diag/sdk_error.go
+++ b/libs/diag/sdk_error.go
@@ -10,8 +10,8 @@ import (
 )
 
 func FormatAPIErrorSummary(e error) string {
-	var apiErr *apierr.APIError
-	if !errors.As(e, &apiErr) {
+	apiErr, ok := errors.AsType[*apierr.APIError](e)
+	if !ok {
 		return e.Error()
 	}
 	extra := strings.TrimSpace(fmt.Sprintf("%d %s", apiErr.StatusCode, apiErr.ErrorCode))
@@ -19,8 +19,8 @@ func FormatAPIErrorSummary(e error) string {
 }
 
 func FormatAPIErrorDetails(e error) string {
-	var apiErr *apierr.APIError
-	if !errors.As(e, &apiErr) {
+	apiErr, ok := errors.AsType[*apierr.APIError](e)
+	if !ok {
 		return ""
 	}
 
diff --git a/libs/dms/fields.go b/libs/dms/fields.go
new file mode 100644
index 00000000000..aa244d3e24b
--- /dev/null
+++ b/libs/dms/fields.go
@@ -0,0 +1,62 @@
+package dms
+
+import "github.com/databricks/databricks-sdk-go/common/types/fieldmask"
+
+// Fields is the set of operation fields an update writes, sent as its update mask. The
+// service rejects any other path, so this is the whole vocabulary.
+type Fields uint8
+
+const (
+	FieldState Fields = 1 << iota
+	FieldErrorMessage
+	FieldResourceID
+	FieldStatus
+)
+
+// DescribesResource is what a write that says how the resource looks claims: every field
+// an update may change.
+const DescribesResource = FieldState | FieldErrorMessage | FieldResourceID | FieldStatus
+
+// ClearsState is what a write that leaves no resource claims: a delete, and the delete half of
+// a recreate. State is named so the service reads the absent value as a clear, which is what
+// drops the resource from the deployment. It cannot name resource_id: the service answers
+// "state must be in update_mask when 'resource_id' is" and means state with a value, so there is
+// no shape that carries an id alongside a cleared state (verified against the API).
+//
+// TODO: record the deleted resource's id too, once the service allows it alongside a cleared state.
+const ClearsState = FieldState | FieldErrorMessage | FieldStatus
+
+// KeepsState is what a failure claims: mark it failed and leave state alone. State means
+// the resource is as it was written; no state means a delete went through and nothing
+// replaced it, so the resource really is gone and the deployment should say so.
+//
+// It cannot name resource_id: the service requires state, with a value, in any mask that names
+// the id, and naming state here would overwrite what the resource last recorded.
+const KeepsState = FieldErrorMessage | FieldStatus
+
+// wireNames pairs each field with its name on the wire, in the order a mask lists them.
+var wireNames = []struct {
+	field Fields
+	name  string
+}{
+	{FieldState, "state"},
+	{FieldErrorMessage, "error_message"},
+	{FieldResourceID, "resource_id"},
+	{FieldStatus, "status"},
+}
+
+// Has reports whether f contains every field in other.
+func (f Fields) Has(other Fields) bool {
+	return f&other == other
+}
+
+// Mask renders f as the update_mask the service expects, always in the same order.
+func (f Fields) Mask() fieldmask.FieldMask {
+	names := make([]string, 0, len(wireNames))
+	for _, w := range wireNames {
+		if f.Has(w.field) {
+			names = append(names, w.name)
+		}
+	}
+	return fieldmask.FieldMask{Paths: names}
+}
diff --git a/libs/dms/fields_test.go b/libs/dms/fields_test.go
new file mode 100644
index 00000000000..daa6df3d919
--- /dev/null
+++ b/libs/dms/fields_test.go
@@ -0,0 +1,23 @@
+package dms
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestFieldsMask(t *testing.T) {
+	// The order is fixed, so the same set always sends the same mask.
+	assert.Equal(t, []string{"state", "error_message", "resource_id", "status"}, DescribesResource.Mask().Paths)
+	assert.Equal(t, []string{"error_message", "status"}, KeepsState.Mask().Paths)
+	assert.Equal(t, []string{"state"}, FieldState.Mask().Paths)
+	assert.Empty(t, Fields(0).Mask().Paths)
+}
+
+func TestFieldsHas(t *testing.T) {
+	assert.True(t, DescribesResource.Has(FieldState))
+	assert.False(t, KeepsState.Has(FieldState))
+	// Has asks for every field, not any of them.
+	assert.True(t, DescribesResource.Has(FieldState|FieldStatus))
+	assert.False(t, KeepsState.Has(FieldState|FieldStatus))
+}
diff --git a/libs/dms/metadata.go b/libs/dms/metadata.go
new file mode 100644
index 00000000000..f9e23a67db0
--- /dev/null
+++ b/libs/dms/metadata.go
@@ -0,0 +1,134 @@
+package dms
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+
+	"github.com/databricks/cli/libs/structs/structdiff"
+	"github.com/databricks/databricks-sdk-go/service/bundledeployments"
+)
+
+// VersionType identifies the kind of deployment a version records.
+type VersionType = bundledeployments.VersionType
+
+const (
+	VersionTypeDeploy  VersionType = bundledeployments.VersionTypeVersionTypeDeploy
+	VersionTypeDestroy VersionType = bundledeployments.VersionTypeVersionTypeDestroy
+)
+
+// Metadata is what a version records about the bundle, its source and where it
+// landed. The service copies these onto the deployment, so they describe it as of
+// its most recent version.
+type Metadata struct {
+	// DisplayName is the bundle's name, which the deployment is listed under.
+	DisplayName string
+	// TargetName is the bundle target that was deployed.
+	TargetName string
+	// Mode is the bundle target's mode, empty when the target sets none.
+	Mode      bundledeployments.DeploymentMode
+	Workspace *bundledeployments.WorkspaceInfo
+}
+
+// deploymentFields are the deployment's own metadata, in the order a mask lists them. Git is not
+// among them: the service derives the deployment's from the version that carried it.
+var deploymentFields = []string{"display_name", "target_name", "deployment_mode", "workspace_info"}
+
+// Deployment renders the metadata the deployment owns.
+func (m Metadata) Deployment() bundledeployments.Deployment {
+	return bundledeployments.Deployment{
+		DisplayName:    m.DisplayName,
+		TargetName:     m.TargetName,
+		DeploymentMode: m.Mode,
+		WorkspaceInfo:  m.Workspace,
+	}
+}
+
+// StaleFields returns the mask that brings current up to m, empty when the deployment already
+// says what this run would say. current is nil before the first recorded deploy.
+func (m Metadata) StaleFields(current *bundledeployments.Deployment) string {
+	if current == nil {
+		return strings.Join(deploymentFields, ",")
+	}
+
+	want := m.Deployment()
+	var stale []string
+	if want.DisplayName != current.DisplayName {
+		stale = append(stale, "display_name")
+	}
+	if want.TargetName != current.TargetName {
+		stale = append(stale, "target_name")
+	}
+	if want.DeploymentMode != current.DeploymentMode {
+		stale = append(stale, "deployment_mode")
+	}
+	if !structdiff.IsEqual(want.WorkspaceInfo, current.WorkspaceInfo) {
+		stale = append(stale, "workspace_info")
+	}
+	return strings.Join(stale, ",")
+}
+
+// NextVersion is the version number this run will create, given the deployment's most recent
+// one. lastVersionID is empty before the deployment has any version.
+func NextVersion(lastVersionID string) (int, error) {
+	if lastVersionID == "" {
+		return 1, nil
+	}
+	last, err := strconv.Atoi(lastVersionID)
+	if err != nil {
+		return 0, fmt.Errorf("failed to parse last_version_id %q: %w", lastVersionID, err)
+	}
+	return last + 1, nil
+}
+
+// DeploymentNodeName is the workspace node DMS makes for each deployment.
+// Keep it equal to the service's DEPLOYMENT_NODE_NAME.
+const DeploymentNodeName = "resources.deployment.json"
+
+// DeploymentName, VersionName and OperationName build the resource names the
+// service uses, so callers pass only ids.
+func DeploymentName(deploymentID string) string {
+	return "deployments/" + deploymentID
+}
+
+func VersionName(deploymentID string, version int) string {
+	return fmt.Sprintf("deployments/%s/versions/%d", deploymentID, version)
+}
+
+// OperationName drops the state prefix DMS keys don't use (see StatePrefix).
+func OperationName(deploymentID string, version int, stateKey string) string {
+	return VersionName(deploymentID, version) + "/operations/" + strings.TrimPrefix(stateKey, StatePrefix)
+}
+
+// DeploymentIDFromName pulls the id out of a "deployments/{id}" name.
+func DeploymentIDFromName(name string) (string, error) {
+	id, ok := strings.CutPrefix(name, DeploymentName(""))
+	if !ok || id == "" {
+		return "", fmt.Errorf("unexpected deployment name %q from the deployment history service", name)
+	}
+	return id, nil
+}
+
+// DeploymentUpdate builds the deployment with only the masked fields.
+// A masked field must be sent even when empty (empty = clear it), so ForceSendFields stops omitempty dropping it.
+func DeploymentUpdate(metadata Metadata, mask string) bundledeployments.Deployment {
+	full := metadata.Deployment()
+	var dep bundledeployments.Deployment
+	for path := range strings.SplitSeq(mask, ",") {
+		switch path {
+		case "display_name":
+			dep.DisplayName = full.DisplayName
+			dep.ForceSendFields = append(dep.ForceSendFields, "DisplayName")
+		case "target_name":
+			dep.TargetName = full.TargetName
+			dep.ForceSendFields = append(dep.ForceSendFields, "TargetName")
+		case "deployment_mode":
+			dep.DeploymentMode = full.DeploymentMode
+			dep.ForceSendFields = append(dep.ForceSendFields, "DeploymentMode")
+		case "workspace_info":
+			dep.WorkspaceInfo = full.WorkspaceInfo
+			dep.ForceSendFields = append(dep.ForceSendFields, "WorkspaceInfo")
+		}
+	}
+	return dep
+}
diff --git a/libs/dms/metadata_test.go b/libs/dms/metadata_test.go
new file mode 100644
index 00000000000..5122533dafc
--- /dev/null
+++ b/libs/dms/metadata_test.go
@@ -0,0 +1,43 @@
+package dms
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestNextVersion(t *testing.T) {
+	for _, tt := range []struct {
+		last string
+		want int
+	}{
+		{"", 1},
+		{"4", 5},
+	} {
+		got, err := NextVersion(tt.last)
+		require.NoError(t, err)
+		assert.Equal(t, tt.want, got)
+	}
+
+	_, err := NextVersion("not-a-number")
+	assert.ErrorContains(t, err, "last_version_id")
+}
+
+func TestResourceNames(t *testing.T) {
+	// One format each, so a call only ever passes ids.
+	assert.Equal(t, "deployments/dep-1", DeploymentName("dep-1"))
+	assert.Equal(t, "deployments/dep-1/versions/2", VersionName("dep-1", 2))
+}
+
+func TestDeploymentIDFromName(t *testing.T) {
+	id, err := DeploymentIDFromName("deployments/abc-123")
+	require.NoError(t, err)
+	assert.Equal(t, "abc-123", id)
+
+	_, err = DeploymentIDFromName("abc-123")
+	assert.Error(t, err)
+
+	_, err = DeploymentIDFromName("deployments/")
+	assert.Error(t, err)
+}
diff --git a/libs/dms/operation.go b/libs/dms/operation.go
new file mode 100644
index 00000000000..3bb2f0b00d8
--- /dev/null
+++ b/libs/dms/operation.go
@@ -0,0 +1,171 @@
+package dms
+
+import (
+	"encoding/json"
+	"fmt"
+	"unicode/utf8"
+
+	"github.com/databricks/cli/libs/diag"
+	"github.com/databricks/databricks-sdk-go/service/bundledeployments"
+)
+
+// StatePrefix is the "resources." that bundle keys carry but DMS keys don't
+// ("resources.jobs.foo" vs "jobs.foo"). Strip it when sending, add it back when reading.
+const StatePrefix = "resources."
+
+// maxStateSize is the largest serialized state DMS accepts per operation. More than this
+// and the resource cannot be recorded at all, so the deploy fails rather than leaving the
+// service holding a resource with no state.
+const maxStateSize = 64 * 1024
+
+// maxErrorMessageSize is how much of a failure's message the service stores.
+const maxErrorMessageSize = 16 * 1024
+
+// StatusPending is what the service calls an operation it has recorded but not applied, which
+// is where a recreate sits between deleting the old resource and creating the new one. Not in
+// the SDK: the enum ships server-first while it is staged DEVELOPMENT, so the generated client
+// carries only the terminal two.
+//
+// TODO: use IN_PROGRESS here once the service supports it - it describes a half-applied recreate
+// better than "recorded but not applied".
+const StatusPending bundledeployments.OperationStatus = "OPERATION_STATUS_PENDING"
+
+// OperationUpdate is one write to an operation the version staged: the fields it claims
+// and their values. It is built where the outcome is known, so a malformed one fails the
+// resource that produced it rather than the upload at the end of apply.
+type OperationUpdate struct {
+	// Fields is the mask to send. It is taken literally: a field named here is written,
+	// one left out keeps the value it had.
+	Fields Fields
+
+	// State is the serialized state after the operation, and nil for a delete.
+	State json.RawMessage
+
+	ResourceID   string
+	Status       bundledeployments.OperationStatus
+	ErrorMessage string
+}
+
+// NewStateUpdate describes how the resource looks now: state is the serialized envelope the
+// state DB just persisted, and nil for a delete. inProgress marks a write that is half of a
+// larger change - a recreate's delete - so an interrupted deploy does not report it finished.
+func NewStateUpdate(resourceID string, state json.RawMessage, inProgress bool) (OperationUpdate, error) {
+	if len(state) > maxStateSize {
+		return OperationUpdate{}, fmt.Errorf("serialized state is %d bytes, which exceeds the %d byte limit for recording deployment history", len(state), maxStateSize)
+	}
+
+	status := bundledeployments.OperationStatusOperationStatusSucceeded
+	if inProgress {
+		status = StatusPending
+	}
+
+	// No state means nothing is left to describe, so the write clears it rather than recording
+	// it as empty: an empty value is a state the service refuses on a delete that succeeded,
+	// while an absent one is how the resource stops being listed at all.
+	if state == nil {
+		return OperationUpdate{
+			Fields: ClearsState,
+			Status: status,
+		}, nil
+	}
+
+	return OperationUpdate{
+		Fields:     DescribesResource,
+		State:      state,
+		ResourceID: resourceID,
+		Status:     status,
+	}, nil
+}
+
+// failureMessage summarizes cause for the history, cut to what the service stores.
+func failureMessage(cause error) string {
+	// Summarized, not cause.Error(): for an API failure that adds the status and error
+	// code, which is often the most actionable part of the history.
+	message := diag.FormatAPIErrorSummary(cause)
+	if len(message) > maxErrorMessageSize {
+		message = message[:maxErrorMessageSize]
+		// The cut can land inside a rune, and the service stores a string. Drop the partial
+		// one: at most UTFMax-1 bytes of it can be left, so a message that was already
+		// invalid loses those bytes rather than being stripped away entirely.
+		for range utf8.UTFMax - 1 {
+			if utf8.ValidString(message) {
+				break
+			}
+			message = message[:len(message)-1]
+		}
+	}
+	return message
+}
+
+// failureUpdate marks an operation failed and carries the message, with no state of its own: it
+// claims KeepsState so a Merge onto the resource's last write keeps that write's state and id.
+// OperationBuffer.RecordFailure uses it when a write already recorded the resource's state.
+func failureUpdate(cause error) OperationUpdate {
+	return OperationUpdate{
+		Fields:       KeepsState,
+		Status:       bundledeployments.OperationStatusOperationStatusFailed,
+		ErrorMessage: failureMessage(cause),
+	}
+}
+
+// NewFailureUpdate records that an operation did not apply, so the history says why a resource
+// failed rather than leaving it pending. state is what the resource still has, which the service
+// requires of a failure on a live one; nil when nothing is left to describe.
+func NewFailureUpdate(resourceID string, state json.RawMessage, cause error) OperationUpdate {
+	u := failureUpdate(cause)
+	if state != nil {
+		// The id travels with the state, which the service requires of any mask naming one.
+		u.Fields = DescribesResource
+		u.State = state
+		u.ResourceID = resourceID
+	}
+	return u
+}
+
+// Merge folds a later update into u, for a resource written twice before either upload ran.
+// Each field comes from whichever update claimed it, newer winning when both did, and the
+// mask is the union. What an update claims is decided where it is built, not here.
+func (u OperationUpdate) Merge(newer OperationUpdate) OperationUpdate {
+	merged := u
+	merged.Fields = u.Fields | newer.Fields
+
+	if newer.Fields.Has(FieldState) {
+		merged.State = newer.State
+	}
+	if newer.Fields.Has(FieldResourceID) {
+		merged.ResourceID = newer.ResourceID
+	}
+	if newer.Fields.Has(FieldErrorMessage) {
+		merged.ErrorMessage = newer.ErrorMessage
+	}
+	if newer.Fields.Has(FieldStatus) {
+		merged.Status = newer.Status
+	}
+
+	return merged
+}
+
+// operation builds the request body from the masked fields, plus the sequence_id check.
+// Force-send them (empty = clear, and 0 is a real sequence_id); never force state, since a missing state means the resource is gone.
+func (u OperationUpdate) operation(sequenceID int64) bundledeployments.Operation {
+	operation := bundledeployments.Operation{
+		SequenceId:      sequenceID,
+		ForceSendFields: []string{"SequenceId"},
+	}
+	if u.Fields.Has(FieldState) && u.State != nil {
+		operation.State = string(u.State)
+	}
+	if u.Fields.Has(FieldErrorMessage) {
+		operation.ErrorMessage = u.ErrorMessage
+		operation.ForceSendFields = append(operation.ForceSendFields, "ErrorMessage")
+	}
+	if u.Fields.Has(FieldResourceID) {
+		operation.ResourceId = u.ResourceID
+		operation.ForceSendFields = append(operation.ForceSendFields, "ResourceId")
+	}
+	if u.Fields.Has(FieldStatus) {
+		operation.Status = u.Status
+		operation.ForceSendFields = append(operation.ForceSendFields, "Status")
+	}
+	return operation
+}
diff --git a/libs/dms/operation_buffer.go b/libs/dms/operation_buffer.go
new file mode 100644
index 00000000000..efecb3a330a
--- /dev/null
+++ b/libs/dms/operation_buffer.go
@@ -0,0 +1,188 @@
+package dms
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"sync"
+
+	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/databricks-sdk-go/service/bundledeployments"
+)
+
+// bufferedOperations caps how far ahead of the service a deploy may get; DMS is what the next
+// plan reads.
+const bufferedOperations = 10
+
+// OperationBuffer records each state write with DMS for one deployment version, off the apply
+// path: writes are queued and sent on one background goroutine. It exists only while a bundle
+// records deployment history; callers hold a nil buffer otherwise and must not call it.
+type OperationBuffer struct {
+	deploymentID string
+	versionNum   int
+
+	// The buffer. queue holds bundle state keys, and pending the newest update per key, so a
+	// second write for a resource replaces the first.
+	queue     chan string
+	done      chan struct{}
+	stopQueue func()
+
+	// sequenceIDs holds the token the last update for a resource returned. A missing key reads as
+	// 0, which is what staging leaves. Unguarded: run is the only goroutine that writes, one update at a time.
+	//
+	// TODO: revisit and possibly deprecate. Sequence ids guard against an earlier update
+	// overwriting a later one, which cannot happen here - updates for a resource are sent one at a
+	// time from a single goroutine. UpdateOperation requires them today, so the client cannot
+	// simply stop sending them.
+	sequenceIDs map[string]int64
+
+	// mu guards the fields below.
+	mu sync.Mutex
+
+	// pending holds the newest update per resource key, absent once the writer takes it.
+	pending map[string]OperationUpdate
+
+	// latestState is the newest state-bearing update per resource key, kept for the buffer's
+	// whole life - unlike pending, which the writer removes on take. RecordFailure merges its
+	// status and message onto this so a failure keeps the state the last write recorded (which
+	// the service may already hold), not the pre-deploy state, which would overwrite it.
+	latestState map[string]OperationUpdate
+
+	err error
+}
+
+// StartOperationBuffer opens the buffer for the version the caller just created. The version
+// must already exist: operations record under it, and nothing here creates it.
+func StartOperationBuffer(ctx context.Context, deploymentID string, versionNum int) *OperationBuffer {
+	b := &OperationBuffer{
+		deploymentID: deploymentID,
+		versionNum:   versionNum,
+		queue:        make(chan string, bufferedOperations),
+		done:         make(chan struct{}),
+		pending:      make(map[string]OperationUpdate),
+		latestState:  make(map[string]OperationUpdate),
+		sequenceIDs:  make(map[string]int64),
+	}
+	b.stopQueue = sync.OnceFunc(func() { close(b.queue) })
+	go b.run(ctx)
+	return b
+}
+
+// RecordOperation records a state write. state is the serialized envelope, nil for a delete.
+// An earlier failure does not stop it: keep recording, best effort.
+func (b *OperationBuffer) RecordOperation(ctx context.Context, resourceKey string, inProgress bool, resourceID string, state json.RawMessage) {
+	update, err := NewStateUpdate(resourceID, state, inProgress)
+	if err != nil {
+		b.setErr(fmt.Errorf("recording operation for %s: %w", resourceKey, err))
+		return
+	}
+
+	b.record(resourceKey, update, false, nil)
+}
+
+// RecordFailure records that a resource did not apply, so the history says why. state is a
+// fallback used only when no write recorded state yet; otherwise record keeps the last state.
+func (b *OperationBuffer) RecordFailure(resourceKey, resourceID string, state json.RawMessage, cause error) {
+	// The passed update is the fallback used only when no write recorded state yet; record
+	// otherwise merges the failure onto the state the last write recorded (see below).
+	b.record(resourceKey, NewFailureUpdate(resourceID, state, cause), true, cause)
+}
+
+// record queues update for resourceKey. keepExistingUpdateIfAny (a failure) merges onto the
+// resource's last recorded state if one exists; otherwise (a state write) update is saved as
+// that latest state. latestState and pending are updated under the one lock. Panics after Drain.
+func (b *OperationBuffer) record(resourceKey string, update OperationUpdate, keepExistingUpdateIfAny bool, cause error) {
+	b.mu.Lock()
+	if keepExistingUpdateIfAny {
+		if latest, recorded := b.latestState[resourceKey]; recorded {
+			update = latest.Merge(failureUpdate(cause))
+		}
+	} else {
+		b.latestState[resourceKey] = update
+	}
+	waiting, queued := b.pending[resourceKey]
+	if queued {
+		update = waiting.Merge(update)
+	}
+	b.pending[resourceKey] = update
+	b.mu.Unlock()
+
+	// when already queued: the writer reads the map when it gets to the key,
+	// so it picks up what was just stored.
+	//
+	// Only when the resource is not already queued, enqueue it.
+	if !queued {
+		b.queue <- resourceKey
+	}
+}
+
+// take claims the update waiting for resourceKey.
+func (b *OperationBuffer) take(resourceKey string) (OperationUpdate, bool) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	update, ok := b.pending[resourceKey]
+	delete(b.pending, resourceKey)
+	return update, ok
+}
+
+func (b *OperationBuffer) run(ctx context.Context) {
+	defer close(b.done)
+
+	for resourceKey := range b.queue {
+		update, ok := b.take(resourceKey)
+		if !ok {
+			// Unreachable: a key is queued only when nothing was waiting for it. Guard so
+			// a stray key could never write a zero-valued update.
+			continue
+		}
+
+		// Keep going after a failure, so one bad write does not drop everything behind it.
+		if err := b.write(ctx, resourceKey, update); err != nil {
+			b.setErr(fmt.Errorf("recording operation for %s: %w", resourceKey, err))
+		}
+	}
+}
+
+// write sends one update, at the sequence id the resource is at.
+func (b *OperationBuffer) write(ctx context.Context, key string, update OperationUpdate) error {
+	w := cmdctx.WorkspaceClient(ctx)
+	result, err := w.BundleDeployments.UpdateOperation(ctx, bundledeployments.UpdateOperationRequest{
+		Name:       OperationName(b.deploymentID, b.versionNum, key),
+		Operation:  update.operation(b.sequenceIDs[key]),
+		UpdateMask: update.Fields.Mask(),
+	})
+	if err != nil {
+		return err
+	}
+
+	// The next write for this resource echoes the sequence id this one earned.
+	b.sequenceIDs[key] = result.SequenceId
+	return nil
+}
+
+// Drain waits for everything buffered to reach the service and returns the first write error,
+// which fails the deploy: DMS is the source of truth for what exists. Safe to call twice.
+func (b *OperationBuffer) Drain() error {
+	b.stopQueue()
+	<-b.done
+	return b.Err()
+}
+
+// setErr keeps the first error; one failure is enough to fail the deploy.
+func (b *OperationBuffer) setErr(err error) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	if b.err == nil {
+		b.err = err
+	}
+}
+
+// Err returns the first recording error, or nil.
+func (b *OperationBuffer) Err() error {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	return b.err
+}
diff --git a/libs/dms/operation_buffer_test.go b/libs/dms/operation_buffer_test.go
new file mode 100644
index 00000000000..49af18c3255
--- /dev/null
+++ b/libs/dms/operation_buffer_test.go
@@ -0,0 +1,116 @@
+package dms
+
+import (
+	"encoding/json"
+	"errors"
+	"strings"
+	"sync"
+	"testing"
+
+	"github.com/databricks/databricks-sdk-go/service/bundledeployments"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// What the service ends up holding - the version a deploy claims, the operations it stages, the
+// completion it reports - is asserted end to end by acceptance/bundle/dms. What is left here is
+// what a deploy cannot reach: the queue's coalescing and the size limit. No test here goes
+// through the API - the queue is driven directly, so nothing waits on a request.
+
+// queued builds a buffer whose queue nothing drains, so a test drives record and take itself.
+func queued() *OperationBuffer {
+	return &OperationBuffer{
+		queue:       make(chan string, bufferedOperations),
+		pending:     make(map[string]OperationUpdate),
+		latestState: make(map[string]OperationUpdate),
+	}
+}
+
+func stateUpdate(t *testing.T, name string) OperationUpdate {
+	t.Helper()
+	update, err := NewStateUpdate("id-1", json.RawMessage(`{"state":{"name":"`+name+`"}}`), false)
+	require.NoError(t, err)
+	return update
+}
+
+func TestBufferCoalescesWhileAKeyIsPending(t *testing.T) {
+	s := queued()
+
+	// Two writes for one resource with nothing draining. They carry the resource's full
+	// state, so only the newest needs to go: one slot in the queue, not two.
+	s.record("resources.jobs.foo", stateUpdate(t, "v1"), false, nil)
+	s.record("resources.jobs.foo", stateUpdate(t, "v2"), false, nil)
+
+	assert.Len(t, s.queue, 1)
+	update, ok := s.take("resources.jobs.foo")
+	require.True(t, ok)
+	assert.JSONEq(t, `{"state":{"name":"v2"}}`, string(update.State))
+
+	// Taken means a request has it, and an in-flight request cannot be recalled, so the next
+	// write gets its own slot rather than joining it.
+	s.record("resources.jobs.foo", stateUpdate(t, "v3"), false, nil)
+	assert.Len(t, s.queue, 2)
+	update, ok = s.take("resources.jobs.foo")
+	require.True(t, ok)
+	assert.JSONEq(t, `{"state":{"name":"v3"}}`, string(update.State))
+}
+
+func TestBufferFailsOnOversizedState(t *testing.T) {
+	// The service will not take a state this large, so the resource cannot be recorded.
+	// Failing here says so, where reporting nothing would leave DMS without the resource
+	// and the next plan would create it again.
+	s := queued()
+
+	s.RecordOperation(t.Context(), "resources.jobs.foo", false, "id-1", json.RawMessage(strings.Repeat("x", maxStateSize+1)))
+
+	assert.ErrorContains(t, s.Err(), "exceeds the 65536 byte limit")
+	assert.Empty(t, s.queue)
+	assert.Empty(t, s.pending)
+}
+
+func TestDrainIsIdempotent(t *testing.T) {
+	// Nothing recorded, so no transport is needed: this is the second drain, which must not
+	// panic on an already closed queue.
+	s := queued()
+	s.done = make(chan struct{})
+	s.stopQueue = sync.OnceFunc(func() { close(s.queue) })
+	go s.run(t.Context())
+
+	require.NoError(t, s.Drain())
+	require.NoError(t, s.Drain())
+}
+
+func TestRecordFailureKeepsTheStateTheLastWriteRecorded(t *testing.T) {
+	s := queued()
+
+	// A write records the resource's post-apply state - a rename, so a new id and new state - and
+	// the writer sends it (take), leaving nothing pending.
+	s.RecordOperation(t.Context(), "resources.jobs.foo", false, "id-new", json.RawMessage(`{"state":{"name":"v2"}}`))
+	_, ok := s.take("resources.jobs.foo")
+	require.True(t, ok)
+	require.Empty(t, s.pending)
+
+	// The post-update wait then fails. The failure carries the pre-deploy state (old id, old
+	// state), which it must not use: the write already recorded v2, which the service may hold.
+	s.RecordFailure("resources.jobs.foo", "id-old", json.RawMessage(`{"state":{"name":"v1"}}`), errors.New("wait timed out"))
+
+	update, ok := s.take("resources.jobs.foo")
+	require.True(t, ok)
+	assert.JSONEq(t, `{"state":{"name":"v2"}}`, string(update.State), "keeps the state the write recorded")
+	assert.Equal(t, "id-new", update.ResourceID, "keeps the id the write recorded, not the pre-deploy id")
+	assert.Equal(t, bundledeployments.OperationStatusOperationStatusFailed, update.Status)
+	assert.Contains(t, update.ErrorMessage, "wait timed out")
+}
+
+func TestRecordFailureUsesTheGivenStateWhenNoWriteRecorded(t *testing.T) {
+	// No write recorded anything - the operation failed before it saved state, e.g. a create that
+	// never landed - so the failure falls back to the state passed in, what the resource still has.
+	s := queued()
+
+	s.RecordFailure("resources.jobs.foo", "id-1", json.RawMessage(`{"state":{"name":"v1"}}`), errors.New("create failed"))
+
+	update, ok := s.take("resources.jobs.foo")
+	require.True(t, ok)
+	assert.JSONEq(t, `{"state":{"name":"v1"}}`, string(update.State))
+	assert.Equal(t, bundledeployments.OperationStatusOperationStatusFailed, update.Status)
+}
diff --git a/libs/dms/operation_test.go b/libs/dms/operation_test.go
new file mode 100644
index 00000000000..2bae9a81144
--- /dev/null
+++ b/libs/dms/operation_test.go
@@ -0,0 +1,83 @@
+package dms
+
+import (
+	"encoding/json"
+	"errors"
+	"strings"
+	"testing"
+	"unicode/utf8"
+
+	"github.com/databricks/databricks-sdk-go/service/bundledeployments"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// What these updates put on the wire - the mask, the status, the state a write carries and a
+// failure leaves alone - is asserted by acceptance/bundle/dms. What is left here are the limits
+// and the merge, which a deploy cannot reach.
+
+func TestNewFailureUpdateTruncatesLongError(t *testing.T) {
+	// Truncated rather than rejected: a message over the limit would make recording
+	// fail and hide the error it is reporting.
+	update := NewFailureUpdate("job-123", nil, errors.New(strings.Repeat("x", maxErrorMessageSize+100)))
+
+	assert.Len(t, update.ErrorMessage, maxErrorMessageSize)
+}
+
+func TestNewFailureUpdatePreservesUTF8OnTruncation(t *testing.T) {
+	// The cut lands one byte into the emoji, so a byte-wise truncation would leave a partial
+	// rune behind and the service stores state and messages as strings.
+	msg := strings.Repeat("a", maxErrorMessageSize-1) + "❌" + "x"
+
+	update := NewFailureUpdate("job-123", nil, errors.New(msg))
+
+	assert.True(t, utf8.ValidString(update.ErrorMessage))
+	// The whole emoji went, so the message is shorter than the limit rather than exactly it.
+	assert.Equal(t, strings.Repeat("a", maxErrorMessageSize-1), update.ErrorMessage)
+}
+
+func TestMergeLetsAWriteSupersedeAFailure(t *testing.T) {
+	// A failure is not the last word. A retry that writes state wins whole - state, id and
+	// mask - and the mask names error_message so the recorded failure is cleared. The service
+	// rejects a succeeded operation that still carries an error.
+	failed := NewFailureUpdate("id-old", nil, errors.New("boom"))
+	retried, err := NewStateUpdate("id-new", json.RawMessage(`{"state":{"name":"after"}}`), false)
+	require.NoError(t, err)
+
+	merged := failed.Merge(retried)
+
+	assert.Equal(t, bundledeployments.OperationStatusOperationStatusSucceeded, merged.Status)
+	assert.Empty(t, merged.ErrorMessage)
+	assert.Equal(t, "id-new", merged.ResourceID)
+	assert.JSONEq(t, `{"state":{"name":"after"}}`, string(merged.State))
+	assert.Equal(t, DescribesResource, merged.Fields)
+}
+
+func TestMergeKeepsTheWritesStateAndMask(t *testing.T) {
+	// A failure claims only status and error_message, so the write's state, id and mask
+	// survive: the resource stays listed as it was written, now marked failed.
+	write, err := NewStateUpdate("id-new", json.RawMessage(`{"state":{"name":"before"}}`), false)
+	require.NoError(t, err)
+	failed := NewFailureUpdate("id-old", nil, errors.New("boom"))
+
+	merged := write.Merge(failed)
+
+	assert.Equal(t, bundledeployments.OperationStatusOperationStatusFailed, merged.Status)
+	assert.Equal(t, "boom", merged.ErrorMessage)
+	assert.Equal(t, "id-new", merged.ResourceID)
+	assert.JSONEq(t, `{"state":{"name":"before"}}`, string(merged.State))
+	assert.Equal(t, DescribesResource, merged.Fields)
+}
+
+func TestMergeLetsADeleteClearTheState(t *testing.T) {
+	// A delete legitimately carries no state, and merging must let it through: the resource
+	// is gone, and keeping the state it replaces would leave it listed.
+	write, err := NewStateUpdate("id-1", json.RawMessage(`{"state":{"name":"before"}}`), false)
+	require.NoError(t, err)
+	deleted, err := NewStateUpdate("id-1", nil, false)
+	require.NoError(t, err)
+
+	merged := write.Merge(deleted)
+
+	assert.Nil(t, merged.State)
+}
diff --git a/libs/dms/resources.go b/libs/dms/resources.go
new file mode 100644
index 00000000000..155903381e3
--- /dev/null
+++ b/libs/dms/resources.go
@@ -0,0 +1,13 @@
+package dms
+
+// Resource is what DMS holds for one resource of a deployment, as of the last operation
+// that recorded it.
+type Resource struct {
+	// Key is the bundle state key, as everything outside this package spells it.
+	Key string
+	ID  string
+
+	// State is the state the last operation recorded, as the opaque string the service
+	// stores, and empty when no operation recorded one.
+	State string
+}
diff --git a/libs/dockercredentials/configure.go b/libs/dockercredentials/configure.go
new file mode 100644
index 00000000000..b567bc02a41
--- /dev/null
+++ b/libs/dockercredentials/configure.go
@@ -0,0 +1,67 @@
+package dockercredentials
+
+import (
+	"context"
+	"fmt"
+	"os/exec"
+	"path/filepath"
+
+	"github.com/databricks/cli/libs/env"
+)
+
+// Configuration describes the installed helper and the Docker configuration it updated.
+type Configuration struct {
+	ConfigPath string
+	Shim       ShimInstallResult
+}
+
+// Status reports Docker's credential helper selection for a registry.
+type Status struct {
+	Host       string `json:"host"`
+	Configured bool   `json:"configured"`
+}
+
+// Configure installs the helper before selecting it in Docker's configuration.
+func Configure(ctx context.Context, executable, registryHost string) (Configuration, error) {
+	shim, err := InstallShim(executable)
+	if err != nil {
+		return Configuration{}, fmt.Errorf("install Docker credential helper: %w", err)
+	}
+	configPath, err := ConfigPath(ctx)
+	if err != nil {
+		return Configuration{}, err
+	}
+	if err := SetCredentialHelper(configPath, registryHost); err != nil {
+		return Configuration{}, fmt.Errorf("update Docker config %s: %w", filepath.ToSlash(configPath), err)
+	}
+	return Configuration{ConfigPath: configPath, Shim: shim}, nil
+}
+
+// Inspect checks the helper selection and executable availability without modifying Docker's configuration.
+func Inspect(ctx context.Context, registryHost string) (Status, error) {
+	configPath, err := ConfigPath(ctx)
+	if err != nil {
+		return Status{}, err
+	}
+	configured, err := CredentialHelperConfigured(configPath, registryHost)
+	if err != nil {
+		return Status{}, err
+	}
+	if configured {
+		_, err := exec.LookPath("docker-credential-" + HelperName)
+		configured = err == nil
+	}
+	return Status{Host: registryHost, Configured: configured}, nil
+}
+
+// ConfigPath resolves Docker's configuration path using DOCKER_CONFIG or the user's home directory.
+func ConfigPath(ctx context.Context) (string, error) {
+	if dir := env.Get(ctx, "DOCKER_CONFIG"); dir != "" {
+		return filepath.Join(dir, "config.json"), nil
+	}
+	home, err := env.UserHomeDir(ctx)
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(home, ".docker", "config.json"), nil
+}
diff --git a/libs/dockercredentials/configure_test.go b/libs/dockercredentials/configure_test.go
new file mode 100644
index 00000000000..1f7362c40a3
--- /dev/null
+++ b/libs/dockercredentials/configure_test.go
@@ -0,0 +1,91 @@
+package dockercredentials_test
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/databricks/cli/libs/dockercredentials"
+	"github.com/databricks/cli/libs/env"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestConfigure(t *testing.T) {
+	dir := t.TempDir()
+	t.Setenv("PATH", filepath.Join(dir, "bin"))
+	t.Setenv("PATHEXT", ".COM;.EXE;.BAT;.CMD")
+	configPath := filepath.Join(dir, "docker", "config.json")
+	ctx := env.Set(t.Context(), "DOCKER_CONFIG", filepath.Dir(configPath))
+	result, err := dockercredentials.Configure(ctx, filepath.Join(dir, "bin", "databricks"), "registry.test")
+	require.NoError(t, err)
+	assert.Equal(t, configPath, result.ConfigPath)
+	assert.FileExists(t, result.Shim.Path)
+	status, err := dockercredentials.Inspect(ctx, "registry.test")
+	require.NoError(t, err)
+	assert.True(t, status.Configured)
+	assert.Equal(t, "registry.test", status.Host)
+}
+
+func TestInspectRequiresHelperOnPath(t *testing.T) {
+	for _, tc := range []struct {
+		name      string
+		installed bool
+		onPath    bool
+		want      bool
+	}{
+		{name: "missing"},
+		{name: "outside PATH", installed: true},
+		{name: "on PATH", installed: true, onPath: true, want: true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			dir := t.TempDir()
+			binDir := filepath.Join(dir, "bin")
+			configPath := filepath.Join(dir, "docker", "config.json")
+			ctx := env.Set(t.Context(), "DOCKER_CONFIG", filepath.Dir(configPath))
+			require.NoError(t, dockercredentials.SetCredentialHelper(configPath, "registry.test"))
+			if tc.onPath {
+				t.Setenv("PATH", binDir)
+			} else {
+				t.Setenv("PATH", t.TempDir())
+			}
+			t.Setenv("PATHEXT", ".COM;.EXE;.BAT;.CMD")
+			if tc.installed {
+				_, err := dockercredentials.InstallShim(filepath.Join(binDir, "databricks"))
+				require.NoError(t, err)
+			}
+
+			status, err := dockercredentials.Inspect(ctx, "registry.test")
+			require.NoError(t, err)
+			assert.Equal(t, "registry.test", status.Host)
+			assert.Equal(t, tc.want, status.Configured)
+		})
+	}
+}
+
+func TestConfigureInstallsShimBeforeUpdatingConfig(t *testing.T) {
+	dir := t.TempDir()
+	blocked := filepath.Join(dir, "file")
+	require.NoError(t, os.WriteFile(blocked, nil, 0o600))
+	configPath := filepath.Join(dir, "docker", "config.json")
+	ctx := env.Set(t.Context(), "DOCKER_CONFIG", filepath.Dir(configPath))
+	_, err := dockercredentials.Configure(ctx, filepath.Join(blocked, "databricks"), "registry.test")
+	assert.ErrorContains(t, err, "install Docker credential helper")
+	assert.NoFileExists(t, configPath)
+}
+
+func TestConfigPath(t *testing.T) {
+	dir := t.TempDir()
+	for _, dockerDir := range []string{"", filepath.Join(dir, "custom")} {
+		ctx := env.Set(t.Context(), "HOME", dir)
+		ctx = env.Set(ctx, "USERPROFILE", dir)
+		ctx = env.Set(ctx, "DOCKER_CONFIG", dockerDir)
+		got, err := dockercredentials.ConfigPath(ctx)
+		require.NoError(t, err)
+		wantDir := filepath.Join(dir, ".docker")
+		if dockerDir != "" {
+			wantDir = dockerDir
+		}
+		assert.Equal(t, filepath.Join(wantDir, "config.json"), got)
+	}
+}
diff --git a/libs/dockercredentials/docker_config.go b/libs/dockercredentials/docker_config.go
new file mode 100644
index 00000000000..569429b2c0b
--- /dev/null
+++ b/libs/dockercredentials/docker_config.go
@@ -0,0 +1,158 @@
+package dockercredentials
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+)
+
+// HelperName is the suffix Docker uses to resolve docker-credential-databricks.
+const HelperName = "databricks"
+
+// CredentialHelperConfigured reports whether Docker selects docker-credential-databricks for registryHost.
+func CredentialHelperConfigured(path, registryHost string) (bool, error) {
+	config, err := readDockerConfig(path)
+	if err != nil {
+		return false, err
+	}
+
+	helpers, err := credentialHelpers(path, config)
+	if err != nil {
+		return false, err
+	}
+	if helper, ok := helpers[registryHost]; ok {
+		return helper == HelperName, nil
+	}
+
+	var store string
+	if raw, ok := config["credsStore"]; ok {
+		if err := json.Unmarshal(raw, &store); err != nil {
+			return false, fmt.Errorf("read Docker config %s: %w", filepath.ToSlash(path), err)
+		}
+	}
+	return store == HelperName, nil
+}
+
+// SetCredentialHelper assigns docker-credential-databricks to registryHost without changing other Docker configuration.
+// See https://docs.docker.com/reference/cli/docker/login/#credential-helpers.
+func SetCredentialHelper(path, registryHost string) error {
+	path, err := resolveDockerConfigPath(path)
+	if err != nil {
+		return err
+	}
+	config, err := readDockerConfig(path)
+	if err != nil {
+		return err
+	}
+
+	helpers, err := credentialHelpers(path, config)
+	if err != nil {
+		return err
+	}
+	if helpers == nil {
+		helpers = map[string]string{}
+	}
+
+	if helpers[registryHost] == HelperName {
+		return nil
+	}
+
+	helpers[registryHost] = HelperName
+	rawHelpers, err := json.Marshal(helpers)
+	if err != nil {
+		return err
+	}
+	config["credHelpers"] = rawHelpers
+
+	return writeDockerConfig(path, config)
+}
+
+// credentialHelpers decodes an optional credHelpers object while preserving an absent or null value as nil.
+func credentialHelpers(path string, config map[string]json.RawMessage) (map[string]string, error) {
+	var helpers map[string]string
+	raw, ok := config["credHelpers"]
+	if !ok {
+		return helpers, nil
+	}
+	if err := json.Unmarshal(raw, &helpers); err != nil {
+		return nil, fmt.Errorf("read Docker config %s: %w", filepath.ToSlash(path), err)
+	}
+	return helpers, nil
+}
+
+// resolveDockerConfigPath follows a config symlink so replacement does not remove the link itself.
+func resolveDockerConfigPath(path string) (string, error) {
+	info, err := os.Lstat(path)
+	if errors.Is(err, fs.ErrNotExist) {
+		return path, nil
+	}
+	if err != nil {
+		return "", fmt.Errorf("inspect Docker config %s: %w", path, err)
+	}
+	if info.Mode()&os.ModeSymlink == 0 {
+		return path, nil
+	}
+
+	resolved, err := filepath.EvalSymlinks(path)
+	if err != nil {
+		return "", fmt.Errorf("resolve Docker config symlink %s: %w", path, err)
+	}
+	return resolved, nil
+}
+
+// readDockerConfig returns an empty writable object when the config file is absent or contains JSON null.
+func readDockerConfig(path string) (map[string]json.RawMessage, error) {
+	raw, err := os.ReadFile(path)
+	if errors.Is(err, fs.ErrNotExist) {
+		return map[string]json.RawMessage{}, nil
+	}
+	if err != nil {
+		return nil, fmt.Errorf("read Docker config %s: %w", filepath.ToSlash(path), err)
+	}
+
+	var config map[string]json.RawMessage
+	if err := json.Unmarshal(raw, &config); err != nil {
+		return nil, fmt.Errorf("read Docker config %s: %w", filepath.ToSlash(path), err)
+	}
+	if config == nil {
+		config = map[string]json.RawMessage{}
+	}
+	return config, nil
+}
+
+func writeDockerConfig(path string, config map[string]json.RawMessage) error {
+	dir := filepath.Dir(path)
+	if err := os.MkdirAll(dir, 0o700); err != nil {
+		return fmt.Errorf("create Docker config directory %s: %w", dir, err)
+	}
+
+	raw, err := json.MarshalIndent(config, "", "  ")
+	if err != nil {
+		return err
+	}
+	raw = append(raw, '\n')
+
+	tmp, err := os.CreateTemp(dir, ".config.json.*")
+	if err != nil {
+		return fmt.Errorf("create temporary Docker config in %s: %w", dir, err)
+	}
+	tmpPath := tmp.Name()
+	defer func() {
+		_ = os.Remove(tmpPath)
+	}()
+
+	if _, err := tmp.Write(raw); err != nil {
+		_ = tmp.Close()
+		return fmt.Errorf("write temporary Docker config %s: %w", tmpPath, err)
+	}
+	if err := tmp.Close(); err != nil {
+		return fmt.Errorf("close temporary Docker config %s: %w", tmpPath, err)
+	}
+	if err := os.Rename(tmpPath, path); err != nil {
+		return fmt.Errorf("write Docker config %s: %w", path, err)
+	}
+	return nil
+}
diff --git a/libs/dockercredentials/docker_config_test.go b/libs/dockercredentials/docker_config_test.go
new file mode 100644
index 00000000000..e2f0135b753
--- /dev/null
+++ b/libs/dockercredentials/docker_config_test.go
@@ -0,0 +1,215 @@
+package dockercredentials
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"runtime"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const testRegistryHost = "123.container.us-west-2.cloud.databricks.test"
+
+func readDockerConfigForTest(t *testing.T, path string) map[string]any {
+	t.Helper()
+
+	raw, err := os.ReadFile(path)
+	require.NoError(t, err)
+
+	var got map[string]any
+	require.NoError(t, json.Unmarshal(raw, &got))
+	return got
+}
+
+func TestConfigureDockerCredentialHelperCreatesConfig(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "docker", "config.json")
+
+	require.NoError(t, SetCredentialHelper(path, testRegistryHost))
+
+	got := readDockerConfigForTest(t, path)
+	assert.Equal(t, map[string]any{
+		testRegistryHost: HelperName,
+	}, got["credHelpers"])
+
+	info, err := os.Stat(path)
+	require.NoError(t, err)
+	if runtime.GOOS != "windows" {
+		assert.Equal(t, os.FileMode(0o600), info.Mode().Perm())
+	}
+}
+
+func TestConfigureDockerCredentialHelperPreservesExistingConfig(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "config.json")
+	require.NoError(t, os.WriteFile(path, []byte(`{
+  "auths": {
+    "registry.example.test": {"auth": "abc"}
+  },
+  "credsStore": "desktop",
+  "credHelpers": {
+    "registry.example.test": "desktop"
+  },
+  "experimental": "enabled"
+}`), 0o600))
+
+	require.NoError(t, SetCredentialHelper(path, testRegistryHost))
+
+	got := readDockerConfigForTest(t, path)
+	assert.Equal(t, "desktop", got["credsStore"])
+	assert.Equal(t, "enabled", got["experimental"])
+	assert.Equal(t, map[string]any{
+		"registry.example.test": "desktop",
+		testRegistryHost:        HelperName,
+	}, got["credHelpers"])
+	assert.Contains(t, got, "auths")
+}
+
+func TestConfigureDockerCredentialHelperPreservesConfigSymlink(t *testing.T) {
+	dir := t.TempDir()
+	target := filepath.Join(dir, "target.json")
+	path := filepath.Join(dir, "config.json")
+	require.NoError(t, os.WriteFile(target, []byte(`{"credsStore":"desktop"}`), 0o600))
+	if err := os.Symlink(target, path); err != nil {
+		t.Skipf("symlinks are unavailable: %v", err)
+	}
+
+	require.NoError(t, SetCredentialHelper(path, testRegistryHost))
+
+	info, err := os.Lstat(path)
+	require.NoError(t, err)
+	assert.NotZero(t, info.Mode()&os.ModeSymlink)
+	got := readDockerConfigForTest(t, target)
+	assert.Equal(t, "desktop", got["credsStore"])
+	assert.Equal(t, map[string]any{testRegistryHost: HelperName}, got["credHelpers"])
+}
+
+func TestConfigureDockerCredentialHelperIsIdempotent(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "config.json")
+	require.NoError(t, os.WriteFile(path, []byte(`{
+  "credHelpers": {
+    "123.container.us-west-2.cloud.databricks.test": "databricks"
+  }
+}`), 0o600))
+
+	before, err := os.ReadFile(path)
+	require.NoError(t, err)
+
+	require.NoError(t, SetCredentialHelper(path, testRegistryHost))
+
+	after, err := os.ReadFile(path)
+	require.NoError(t, err)
+	assert.Equal(t, before, after)
+}
+
+func TestConfigureDockerCredentialHelperReplacesExistingHelper(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "config.json")
+	require.NoError(t, os.WriteFile(path, []byte(`{
+  "credHelpers": {
+    "123.container.us-west-2.cloud.databricks.test": "desktop"
+  }
+}`), 0o600))
+
+	require.NoError(t, SetCredentialHelper(path, testRegistryHost))
+
+	got := readDockerConfigForTest(t, path)
+	assert.Equal(t, map[string]any{
+		testRegistryHost: HelperName,
+	}, got["credHelpers"])
+}
+
+func TestConfigureDockerCredentialHelperTreatsNullCredHelpersAsEmpty(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "config.json")
+	require.NoError(t, os.WriteFile(path, []byte(`{"credHelpers": null}`), 0o600))
+
+	require.NoError(t, SetCredentialHelper(path, testRegistryHost))
+
+	got := readDockerConfigForTest(t, path)
+	assert.Equal(t, map[string]any{
+		testRegistryHost: HelperName,
+	}, got["credHelpers"])
+}
+
+func TestConfigureDockerCredentialHelperRejectsInvalidJSON(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "config.json")
+	require.NoError(t, os.WriteFile(path, []byte("{not valid json"), 0o600))
+
+	err := SetCredentialHelper(path, testRegistryHost)
+	assert.ErrorContains(t, err, "read Docker config")
+}
+
+func TestCredentialHelperConfigured(t *testing.T) {
+	t.Parallel()
+
+	path := filepath.Join(t.TempDir(), "config.json")
+	require.NoError(t, os.WriteFile(path, []byte(`{
+  "credHelpers": {
+    "999.container.us-east-1.cloud.databricks.test": "databricks",
+    "registry.example.test": "desktop",
+    "123.container.us-west-2.cloud.databricks.test": "databricks"
+  }
+}`), 0o600))
+
+	tests := []struct {
+		name string
+		host string
+		want bool
+	}{
+		{name: "configured", host: "123.container.us-west-2.cloud.databricks.test", want: true},
+		{name: "other helper", host: "registry.example.test", want: false},
+		{name: "absent", host: "456.container.us-west-2.cloud.databricks.test", want: false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			got, err := CredentialHelperConfigured(path, tt.host)
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
+
+func TestCredentialHelperConfiguredUsesGlobalStore(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name   string
+		config string
+		want   bool
+	}{
+		{
+			name:   "global store",
+			config: `{"credsStore":"databricks"}`,
+			want:   true,
+		},
+		{
+			name:   "registry override",
+			config: `{"credsStore":"databricks","credHelpers":{"123.container.us-west-2.cloud.databricks.test":"desktop"}}`,
+			want:   false,
+		},
+		{
+			name:   "empty registry override",
+			config: `{"credsStore":"databricks","credHelpers":{"123.container.us-west-2.cloud.databricks.test":""}}`,
+			want:   false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			path := filepath.Join(t.TempDir(), "config.json")
+			require.NoError(t, os.WriteFile(path, []byte(tt.config), 0o600))
+
+			got, err := CredentialHelperConfigured(path, testRegistryHost)
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
diff --git a/libs/dockercredentials/profile.go b/libs/dockercredentials/profile.go
new file mode 100644
index 00000000000..e2a1ca0f092
--- /dev/null
+++ b/libs/dockercredentials/profile.go
@@ -0,0 +1,112 @@
+package dockercredentials
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"github.com/databricks/cli/libs/auth"
+	"github.com/databricks/cli/libs/databrickscfg/profile"
+	"github.com/databricks/databricks-sdk-go/config"
+)
+
+// ValidateProfile verifies that p can be used by the Docker credential helper.
+func ValidateProfile(p profile.Profile) error {
+	if p.HasClientCredentials {
+		return fmt.Errorf("profile %q uses client credentials. Docker credential helper requires a profile created by databricks auth login", p.Name)
+	}
+	if p.AuthType != auth.AuthTypeDatabricksCli {
+		return fmt.Errorf("profile %q uses auth_type %q. Docker credential helper requires a profile created by databricks auth login", p.Name, p.AuthType)
+	}
+	if isAccountOnlyProfile(p) {
+		return fmt.Errorf("profile %q does not target a workspace. Run databricks auth login --host <workspace-url> and retry with that profile", p.Name)
+	}
+	return nil
+}
+
+func isAccountOnlyProfile(p profile.Profile) bool {
+	if p.Host == "" {
+		return true
+	}
+	cfg := &config.Config{Host: p.Host, AccountID: p.AccountID, WorkspaceID: p.WorkspaceID}
+	if auth.IsClassicAccountHost(cfg.CanonicalHostName()) {
+		return true
+	}
+	return p.AccountID != "" && (p.WorkspaceID == "" || p.WorkspaceID == profile.WorkspaceIDNone)
+}
+
+// LoadProfile loads and validates the named Docker credential helper profile.
+func LoadProfile(ctx context.Context, profiler profile.Profiler, name string) (profile.Profile, error) {
+	profiles, err := profiler.LoadProfiles(ctx, profile.WithName(name))
+	if err != nil {
+		return profile.Profile{}, err
+	}
+	if len(profiles) == 0 {
+		return profile.Profile{}, fmt.Errorf("profile %q not found", name)
+	}
+	if err := ValidateProfile(profiles[0]); err != nil {
+		return profile.Profile{}, err
+	}
+	return profiles[0], nil
+}
+
+// EnsureUniqueProfile verifies that workspaceID resolves to only p.
+func EnsureUniqueProfile(ctx context.Context, profiler profile.Profiler, p profile.Profile, workspaceID string) error {
+	matches, err := profiler.LoadProfiles(ctx, func(candidate profile.Profile) bool {
+		return candidate.WorkspaceID == workspaceID
+	})
+	if err != nil {
+		return err
+	}
+
+	if p.WorkspaceID == "" || p.WorkspaceID == profile.WorkspaceIDNone {
+		matches = append(matches, p)
+	}
+	var names []string
+	for _, candidate := range matches {
+		if ValidateProfile(candidate) == nil {
+			names = append(names, candidate.Name)
+		}
+	}
+	if len(names) <= 1 {
+		return nil
+	}
+
+	return fmt.Errorf("multiple Databricks profiles match workspace ID %s: %s. Remove duplicate workspace_id entries before using Docker credential helper", workspaceID, strings.Join(names, " and "))
+}
+
+// ProfileForRegistry returns the Docker credential helper profile for registry.
+func ProfileForRegistry(ctx context.Context, profiler profile.Profiler, registry Registry) (profile.Profile, error) {
+	workspaceProfiles, err := profiler.LoadProfiles(ctx, func(p profile.Profile) bool {
+		return p.WorkspaceID == registry.WorkspaceID && registry.ServesWorkspaceHost(p.Host)
+	})
+	if err != nil {
+		return profile.Profile{}, err
+	}
+	if len(workspaceProfiles) == 0 {
+		return profile.Profile{}, fmt.Errorf("no Databricks profile found for workspace ID %s from registry host %s. Run databricks auth login --host <workspace-url> and set workspace_id for that profile", registry.WorkspaceID, registry.Host)
+	}
+
+	var matchingProfiles profile.Profiles
+	for _, p := range workspaceProfiles {
+		if ValidateProfile(p) == nil {
+			matchingProfiles = append(matchingProfiles, p)
+		}
+	}
+	switch len(matchingProfiles) {
+	case 0:
+		return profile.Profile{}, ValidateProfile(workspaceProfiles[0])
+	case 1:
+		return matchingProfiles[0], nil
+	default:
+		return profile.Profile{}, fmt.Errorf("multiple Databricks profiles match workspace ID %s: %s. Remove duplicate workspace_id entries before using Docker credential helper", registry.WorkspaceID, strings.Join(matchingProfiles.Names(), " and "))
+	}
+}
+
+// RewriteProfileError adds Docker profile context to authentication errors.
+func RewriteProfileError(ctx context.Context, p profile.Profile, err error) error {
+	if rewritten, rewrittenErr := auth.RewriteAuthError(ctx, p.Host, p.AccountID, p.Name, err); rewritten {
+		return rewrittenErr
+	}
+	return err
+}
diff --git a/libs/dockercredentials/profile_test.go b/libs/dockercredentials/profile_test.go
new file mode 100644
index 00000000000..8f426124d8d
--- /dev/null
+++ b/libs/dockercredentials/profile_test.go
@@ -0,0 +1,245 @@
+package dockercredentials_test
+
+import (
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/databricks/cli/libs/auth"
+	"github.com/databricks/cli/libs/auth/u2m"
+	"github.com/databricks/cli/libs/databrickscfg/profile"
+	"github.com/databricks/cli/libs/dockercredentials"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	workspaceID   = "123456789"
+	workspaceHost = "https://workspace.cloud.databricks.test"
+)
+
+type invalidRefreshTokenError struct {
+	error
+}
+
+func (e invalidRefreshTokenError) As(target any) bool {
+	invalidRefreshToken, ok := target.(**u2m.InvalidRefreshTokenError)
+	if !ok {
+		return false
+	}
+	*invalidRefreshToken = new(u2m.InvalidRefreshTokenError)
+	return true
+}
+
+func workspaceProfile(name string) profile.Profile {
+	return profile.Profile{
+		Name:        name,
+		Host:        workspaceHost,
+		WorkspaceID: workspaceID,
+		AuthType:    auth.AuthTypeDatabricksCli,
+	}
+}
+
+func TestValidateProfile(t *testing.T) {
+	tests := []struct {
+		name    string
+		profile profile.Profile
+		wantErr string
+	}{
+		{name: "workspace", profile: workspaceProfile("workspace")},
+		{
+			name: "client credentials",
+			profile: profile.Profile{
+				Name:                 "m2m",
+				Host:                 workspaceHost,
+				WorkspaceID:          workspaceID,
+				HasClientCredentials: true,
+			},
+			wantErr: `profile "m2m" uses client credentials. Docker credential helper requires a profile created by databricks auth login`,
+		},
+		{
+			name: "unsupported auth type",
+			profile: profile.Profile{
+				Name:        "pat",
+				Host:        workspaceHost,
+				WorkspaceID: workspaceID,
+				AuthType:    auth.AuthTypePat,
+			},
+			wantErr: `profile "pat" uses auth_type "pat". Docker credential helper requires a profile created by databricks auth login`,
+		},
+		{
+			name: "classic account",
+			profile: profile.Profile{
+				Name:        "account",
+				Host:        "https://accounts.cloud.databricks.test",
+				AccountID:   "account-id",
+				WorkspaceID: workspaceID,
+				AuthType:    auth.AuthTypeDatabricksCli,
+			},
+			wantErr: `profile "account" does not target a workspace. Run databricks auth login --host <workspace-url> and retry with that profile`,
+		},
+		{
+			name: "unified account",
+			profile: profile.Profile{
+				Name:      "account",
+				Host:      workspaceHost,
+				AccountID: "account-id",
+				AuthType:  auth.AuthTypeDatabricksCli,
+			},
+			wantErr: `profile "account" does not target a workspace. Run databricks auth login --host <workspace-url> and retry with that profile`,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := dockercredentials.ValidateProfile(tt.profile)
+			if tt.wantErr == "" {
+				assert.NoError(t, err)
+				return
+			}
+			assert.EqualError(t, err, tt.wantErr)
+		})
+	}
+}
+
+func TestLoadProfile(t *testing.T) {
+	valid := workspaceProfile("workspace")
+	tests := []struct {
+		name     string
+		profiles profile.Profiles
+		profile  string
+		want     profile.Profile
+		wantErr  string
+	}{
+		{name: "loads valid profile", profiles: profile.Profiles{valid}, profile: valid.Name, want: valid},
+		{name: "profile not found", profile: "missing", wantErr: `profile "missing" not found`},
+		{
+			name: "invalid profile",
+			profiles: profile.Profiles{{
+				Name:                 "m2m",
+				Host:                 workspaceHost,
+				WorkspaceID:          workspaceID,
+				HasClientCredentials: true,
+			}},
+			profile: "m2m",
+			wantErr: `profile "m2m" uses client credentials. Docker credential helper requires a profile created by databricks auth login`,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := dockercredentials.LoadProfile(t.Context(), profile.InMemoryProfiler{Profiles: tt.profiles}, tt.profile)
+			if tt.wantErr != "" {
+				assert.EqualError(t, err, tt.wantErr)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
+
+func TestEnsureUniqueProfile(t *testing.T) {
+	selected := workspaceProfile("prod")
+	tests := []struct {
+		name     string
+		profiles profile.Profiles
+		selected profile.Profile
+		wantErr  string
+	}{
+		{name: "single profile", profiles: profile.Profiles{selected}, selected: selected},
+		{
+			name:     "duplicate workspace ID",
+			profiles: profile.Profiles{selected, workspaceProfile("dev")},
+			selected: selected,
+			wantErr:  "multiple Databricks profiles match workspace ID 123456789: prod and dev. Remove duplicate workspace_id entries before using Docker credential helper",
+		},
+		{
+			name: "unsupported duplicate",
+			profiles: profile.Profiles{selected, {
+				Name:                 "m2m",
+				Host:                 workspaceHost,
+				WorkspaceID:          workspaceID,
+				HasClientCredentials: true,
+			}},
+			selected: selected,
+		},
+		{
+			name:     "resolved workspace ID appends selected profile",
+			profiles: profile.Profiles{selected},
+			selected: profile.Profile{
+				Name:     "workspace",
+				Host:     workspaceHost,
+				AuthType: auth.AuthTypeDatabricksCli,
+			},
+			wantErr: "multiple Databricks profiles match workspace ID 123456789: prod and workspace. Remove duplicate workspace_id entries before using Docker credential helper",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := dockercredentials.EnsureUniqueProfile(t.Context(), profile.InMemoryProfiler{Profiles: tt.profiles}, tt.selected, workspaceID)
+			if tt.wantErr == "" {
+				assert.NoError(t, err)
+				return
+			}
+			assert.EqualError(t, err, tt.wantErr)
+		})
+	}
+}
+
+func TestProfileForRegistry(t *testing.T) {
+	registry := dockercredentials.Registry{
+		WorkspaceID: workspaceID,
+		Host:        "123456789.container.us-west-2.cloud.databricks.test",
+	}
+	workspace := workspaceProfile("workspace")
+	tests := []struct {
+		name     string
+		profiles profile.Profiles
+		want     string
+		wantErr  string
+	}{
+		{name: "selects workspace profile", profiles: profile.Profiles{workspace}, want: workspace.Name},
+		{
+			name:     "duplicate workspace ID",
+			profiles: profile.Profiles{workspaceProfile("prod"), workspaceProfile("dev")},
+			wantErr:  "multiple Databricks profiles match workspace ID 123456789: prod and dev. Remove duplicate workspace_id entries before using Docker credential helper",
+		},
+		{
+			name: "ignores unsupported duplicate",
+			profiles: profile.Profiles{workspace, {
+				Name:                 "m2m",
+				Host:                 workspaceHost,
+				WorkspaceID:          workspaceID,
+				HasClientCredentials: true,
+			}},
+			want: workspace.Name,
+		},
+		{
+			name:    "no matching profile",
+			wantErr: "no Databricks profile found for workspace ID 123456789 from registry host 123456789.container.us-west-2.cloud.databricks.test. Run databricks auth login --host <workspace-url> and set workspace_id for that profile",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := dockercredentials.ProfileForRegistry(t.Context(), profile.InMemoryProfiler{Profiles: tt.profiles}, registry)
+			if tt.wantErr != "" {
+				assert.EqualError(t, err, tt.wantErr)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, got.Name)
+		})
+	}
+}
+
+func TestRewriteProfileErrorPreservesInvalidRefreshTokenCause(t *testing.T) {
+	cause := invalidRefreshTokenError{error: errors.New("raw token refresh error")}
+	err := dockercredentials.RewriteProfileError(t.Context(), workspaceProfile("workspace"), fmt.Errorf("refresh token: %w", cause))
+
+	assert.EqualError(t, err, `A new access token could not be retrieved because the refresh token is invalid. To reauthenticate, run the following command:
+  $ databricks auth login --profile workspace`)
+	assert.ErrorIs(t, err, cause)
+}
diff --git a/libs/dockercredentials/registry.go b/libs/dockercredentials/registry.go
new file mode 100644
index 00000000000..9c77b13057a
--- /dev/null
+++ b/libs/dockercredentials/registry.go
@@ -0,0 +1,173 @@
+package dockercredentials
+
+import (
+	"errors"
+	"fmt"
+	"net/url"
+	"strings"
+	"unicode"
+
+	"github.com/databricks/databricks-sdk-go/common/environment"
+)
+
+const (
+	// OAuthTokenUsername is the username returned to Docker with an OAuth access token.
+	OAuthTokenUsername = "oauthtoken"
+	registryHostInfix  = ".container."
+	// localRegistryDNSZone stands in for the DNS zone of a workspace served by a loopback test server.
+	localRegistryDNSZone = ".localhost"
+)
+
+// Registry identifies the workspace and canonical host of a Databricks Artifact Registry endpoint.
+type Registry struct {
+	WorkspaceID string
+	Host        string
+}
+
+// ServesWorkspaceHost reports whether r may receive tokens for workspaceHost.
+// Loopback test-server registries and real workspaces never match each other.
+func (r Registry) ServesWorkspaceHost(workspaceHost string) bool {
+	return strings.HasSuffix(r.Host, localRegistryDNSZone) == isLocalWorkspaceHost(workspaceHost)
+}
+
+// ValidateWorkspaceHost checks that a workspace host can be used to derive an Artifact Registry host.
+func ValidateWorkspaceHost(workspaceHost string) error {
+	_, err := registryDNSZoneForWorkspaceHost(workspaceHost)
+	return err
+}
+
+// ValidateRegion checks that a region can be used as an Artifact Registry hostname label.
+func ValidateRegion(region string) error {
+	region = strings.TrimSpace(region)
+	if region == "" {
+		return errors.New("region is required")
+	}
+	if !isDNSLabel(region) {
+		return fmt.Errorf("invalid region %q", region)
+	}
+	return nil
+}
+
+// RegistryHost builds a registry host in the workspace's cloud and environment DNS zone.
+func RegistryHost(workspaceID, region, workspaceHost string) (string, error) {
+	workspaceID = strings.TrimSpace(workspaceID)
+	region = strings.TrimSpace(region)
+	if workspaceID == "" {
+		return "", errors.New("workspace ID is required")
+	}
+	if !isDNSLabel(workspaceID) {
+		return "", fmt.Errorf("invalid workspace ID %q", workspaceID)
+	}
+	if err := ValidateRegion(region); err != nil {
+		return "", err
+	}
+	dnsZone, err := registryDNSZoneForWorkspaceHost(workspaceHost)
+	if err != nil {
+		return "", err
+	}
+	return fmt.Sprintf("%s.container.%s%s", workspaceID, region, dnsZone), nil
+}
+
+// normalizeServerAddress accepts the bare host or HTTPS URL forms allowed by Docker's credential-helper protocol.
+// Databricks Artifact Registry uses standard HTTPS and has no configurable port.
+func normalizeServerAddress(raw string) (string, error) {
+	value := strings.TrimSpace(raw)
+	if value == "" {
+		return "", errors.New("server address is required")
+	}
+
+	if !strings.Contains(value, "://") {
+		value = "https://" + value
+	}
+	u, err := url.Parse(value)
+	if err != nil {
+		return "", fmt.Errorf("parse server address %q: %w", raw, err)
+	}
+	if !strings.EqualFold(u.Scheme, "https") {
+		return "", fmt.Errorf("unsupported registry URL scheme %q", u.Scheme)
+	}
+	if u.Port() != "" {
+		return "", errors.New("registry address must not include a port")
+	}
+
+	host := strings.TrimSuffix(strings.ToLower(u.Hostname()), ".")
+	if host == "" {
+		return "", errors.New("server address is required")
+	}
+	return host, nil
+}
+
+// ParseRegistryHost normalizes a Databricks Artifact Registry address and extracts its workspace ID.
+func ParseRegistryHost(raw string) (Registry, error) {
+	host, err := normalizeServerAddress(raw)
+	if err != nil {
+		return Registry{}, err
+	}
+
+	dnsZone, ok := matchingDatabricksDNSZone(host)
+	if strings.HasSuffix(host, localRegistryDNSZone) {
+		dnsZone, ok = localRegistryDNSZone, true
+	}
+	if !ok {
+		return Registry{}, fmt.Errorf("%q is not a Databricks Artifact Registry host", host)
+	}
+
+	trimmed := strings.TrimSuffix(host, dnsZone)
+	workspaceID, region, ok := strings.Cut(trimmed, registryHostInfix)
+	if !ok || !isDNSLabel(workspaceID) || !isDNSLabel(region) {
+		return Registry{}, fmt.Errorf("%q is not a Databricks Artifact Registry host", host)
+	}
+
+	return Registry{
+		WorkspaceID: workspaceID,
+		Host:        host,
+	}, nil
+}
+
+func registryDNSZoneForWorkspaceHost(raw string) (string, error) {
+	if isLocalWorkspaceHost(raw) {
+		return localRegistryDNSZone, nil
+	}
+	host, err := normalizeServerAddress(raw)
+	if err != nil {
+		return "", fmt.Errorf("parse workspace host: %w", err)
+	}
+	dnsZone, ok := matchingDatabricksDNSZone(host)
+	if !ok {
+		return "", fmt.Errorf("%q is not a supported Databricks workspace host", host)
+	}
+	return dnsZone, nil
+}
+
+// isLocalWorkspaceHost matches the plain-HTTP loopback test server that OAuth login also accepts.
+func isLocalWorkspaceHost(raw string) bool {
+	u, err := url.Parse(strings.TrimSpace(raw))
+	return err == nil && u.Scheme == "http" && u.Hostname() == "127.0.0.1"
+}
+
+func matchingDatabricksDNSZone(host string) (string, bool) {
+	dnsZone := strings.ToLower(environment.GetEnvironmentForHostname(host).DnsZone)
+	// The SDK defaults unknown hosts to AWS production, so verify that the returned zone actually matched.
+	return dnsZone, dnsZone != "" && strings.HasSuffix(host, dnsZone)
+}
+
+// isDNSLabel accepts one lowercase ASCII label: letters, digits, and interior hyphens, up to 63 bytes.
+// Workspace IDs, regions, and Docker input are not uniformly prevalidated before becoming hostname components.
+func isDNSLabel(label string) bool {
+	if label == "" || len(label) > 63 {
+		return false
+	}
+	for i, r := range label {
+		if r > unicode.MaxASCII {
+			return false
+		}
+		if (r >= 'a' && r <= 'z') || (r >= '0' && r <= '9') {
+			continue
+		}
+		if r == '-' && i > 0 && i < len(label)-1 {
+			continue
+		}
+		return false
+	}
+	return true
+}
diff --git a/libs/dockercredentials/registry_test.go b/libs/dockercredentials/registry_test.go
new file mode 100644
index 00000000000..10048c5ffc5
--- /dev/null
+++ b/libs/dockercredentials/registry_test.go
@@ -0,0 +1,188 @@
+package dockercredentials
+
+import (
+	"testing"
+
+	"github.com/databricks/databricks-sdk-go/common/environment"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestRegistryHost(t *testing.T) {
+	tests := []struct {
+		name          string
+		workspaceHost string
+		region        string
+		want          string
+	}{
+		{
+			name:          "AWS production",
+			workspaceHost: "https://adb-123.456.cloud.databricks.com",
+			region:        "us-west-2",
+			want:          "123456789.container.us-west-2.cloud.databricks.com",
+		},
+		{
+			name:          "AWS staging",
+			workspaceHost: "https://workspace.staging.cloud.databricks.com",
+			region:        "us-west-2",
+			want:          "123456789.container.us-west-2.staging.cloud.databricks.com",
+		},
+		{
+			name:          "Azure production",
+			workspaceHost: "https://adb-123.456.azuredatabricks.net",
+			region:        "eastus",
+			want:          "123456789.container.eastus.azuredatabricks.net",
+		},
+		{
+			name:          "Azure development",
+			workspaceHost: "https://workspace.dev.azuredatabricks.net",
+			region:        "eastus",
+			want:          "123456789.container.eastus.dev.azuredatabricks.net",
+		},
+		{
+			name:          "GCP production",
+			workspaceHost: "https://workspace.gcp.databricks.com",
+			region:        "us-central1",
+			want:          "123456789.container.us-central1.gcp.databricks.com",
+		},
+		{
+			name:          "GCP development",
+			workspaceHost: "https://workspace.dev.gcp.databricks.com",
+			region:        "us-central1",
+			want:          "123456789.container.us-central1.dev.gcp.databricks.com",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := RegistryHost("123456789", tt.region, tt.workspaceHost)
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
+
+func TestRegistryHostRejectsEmptyParts(t *testing.T) {
+	_, err := RegistryHost("", "us-west-2", "https://workspace.cloud.databricks.test")
+	assert.ErrorContains(t, err, "workspace ID is required")
+
+	_, err = RegistryHost("123456789", "", "https://workspace.cloud.databricks.test")
+	assert.ErrorContains(t, err, "region is required")
+}
+
+func TestRegistryHostRejectsUnsupportedWorkspaceHost(t *testing.T) {
+	_, err := RegistryHost("123456789", "us-west-2", "https://workspace.example.test")
+	assert.ErrorContains(t, err, `"workspace.example.test" is not a supported Databricks workspace host`)
+}
+
+func TestRegistryHostForLoopbackTestServer(t *testing.T) {
+	got, err := RegistryHost("123456789", "us-west-2", "http://127.0.0.1:8080")
+	require.NoError(t, err)
+	assert.Equal(t, "123456789.container.us-west-2.localhost", got)
+
+	registry, err := ParseRegistryHost(got)
+	require.NoError(t, err)
+	assert.Equal(t, Registry{
+		WorkspaceID: "123456789",
+		Host:        "123456789.container.us-west-2.localhost",
+	}, registry)
+}
+
+func TestRegistryServesWorkspaceHost(t *testing.T) {
+	localRegistry := Registry{WorkspaceID: "123456789", Host: "123456789.container.us-west-2.localhost"}
+	remoteRegistry := Registry{WorkspaceID: "123456789", Host: "123456789.container.us-west-2.cloud.databricks.com"}
+
+	assert.True(t, localRegistry.ServesWorkspaceHost("http://127.0.0.1:8080"))
+	assert.False(t, localRegistry.ServesWorkspaceHost("https://workspace.cloud.databricks.com"))
+	assert.True(t, remoteRegistry.ServesWorkspaceHost("https://workspace.cloud.databricks.com"))
+	assert.False(t, remoteRegistry.ServesWorkspaceHost("http://127.0.0.1:8080"))
+}
+
+func TestRegistryHostRejectsLocalhostWorkspaceHost(t *testing.T) {
+	_, err := RegistryHost("123456789", "us-west-2", "https://workspace.localhost")
+	assert.ErrorContains(t, err, `"workspace.localhost" is not a supported Databricks workspace host`)
+}
+
+func TestParseRegistryHost(t *testing.T) {
+	cases := []string{
+		"123456789.container.us-west-2.cloud.databricks.com",
+		"https://123456789.container.us-west-2.cloud.databricks.com",
+		"123456789.container.us-west-2.cloud.databricks.com/v2/",
+	}
+
+	for _, input := range cases {
+		t.Run(input, func(t *testing.T) {
+			got, err := ParseRegistryHost(input)
+			require.NoError(t, err)
+			assert.Equal(t, Registry{
+				WorkspaceID: "123456789",
+				Host:        "123456789.container.us-west-2.cloud.databricks.com",
+			}, got)
+		})
+	}
+}
+
+func TestParseRegistryHostSupportsAllDatabricksEnvironmentZones(t *testing.T) {
+	for _, env := range environment.AllEnvironments() {
+		dnsZone := env.DnsZone
+		if dnsZone == "" {
+			continue
+		}
+		t.Run(dnsZone, func(t *testing.T) {
+			wantHost := "123456789.container.test-region" + dnsZone
+			got, err := RegistryHost("123456789", "test-region", "https://workspace"+dnsZone)
+			require.NoError(t, err)
+			assert.Equal(t, wantHost, got)
+
+			registry, err := ParseRegistryHost("https://" + wantHost + "/v2/")
+			require.NoError(t, err)
+			assert.Equal(t, Registry{
+				WorkspaceID: "123456789",
+				Host:        wantHost,
+			}, registry)
+		})
+	}
+}
+
+func TestParseRegistryHostUsesLongestDNSZoneSuffix(t *testing.T) {
+	got, err := ParseRegistryHost("123456789.container.us-west-2.staging.cloud.databricks.com")
+	require.NoError(t, err)
+	assert.Equal(t, Registry{
+		WorkspaceID: "123456789",
+		Host:        "123456789.container.us-west-2.staging.cloud.databricks.com",
+	}, got)
+}
+
+func TestParseRegistryHostRejectsNonDARHost(t *testing.T) {
+	_, err := ParseRegistryHost("registry.example.com")
+	assert.ErrorContains(t, err, `"registry.example.com" is not a Databricks Artifact Registry host`)
+}
+
+func TestParseRegistryHostRejectsPluralContainersInfix(t *testing.T) {
+	_, err := ParseRegistryHost("123.containers.us-west-2.cloud.databricks.com")
+	assert.ErrorContains(t, err, `"123.containers.us-west-2.cloud.databricks.com" is not a Databricks Artifact Registry host`)
+}
+
+func TestParseRegistryHostRejectsInvalidLabels(t *testing.T) {
+	_, err := ParseRegistryHost("-123.container.us-west-2.cloud.databricks.com")
+	assert.ErrorContains(t, err, `"-123.container.us-west-2.cloud.databricks.com" is not a Databricks Artifact Registry host`)
+
+	_, err = ParseRegistryHost("123.container.-us-west-2.cloud.databricks.com")
+	assert.ErrorContains(t, err, `"123.container.-us-west-2.cloud.databricks.com" is not a Databricks Artifact Registry host`)
+}
+
+func TestNormalizeServerAddress(t *testing.T) {
+	got, err := normalizeServerAddress("HTTPS://123.container.US-WEST-2.cloud.databricks.com/v2/")
+	require.NoError(t, err)
+	assert.Equal(t, "123.container.us-west-2.cloud.databricks.com", got)
+}
+
+func TestNormalizeServerAddressRejectsNonHTTPSURL(t *testing.T) {
+	_, err := normalizeServerAddress("http://123.container.us-west-2.cloud.databricks.com")
+	assert.ErrorContains(t, err, "unsupported registry URL scheme")
+}
+
+func TestNormalizeServerAddressRejectsPort(t *testing.T) {
+	_, err := normalizeServerAddress("https://123.container.us-west-2.cloud.databricks.com:443")
+	assert.ErrorContains(t, err, "registry address must not include a port")
+}
diff --git a/libs/dockercredentials/shim.go b/libs/dockercredentials/shim.go
new file mode 100644
index 00000000000..15670e63ec4
--- /dev/null
+++ b/libs/dockercredentials/shim.go
@@ -0,0 +1,143 @@
+package dockercredentials
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
+)
+
+// ShimInstallResult reports where the helper was installed and whether Docker can resolve it from PATH.
+type ShimInstallResult struct {
+	Path string
+	// OnPath reports whether Path is the first matching helper in the current PATH, using PATHEXT on Windows.
+	OnPath bool
+}
+
+// InstallShim installs the Docker credential helper wrapper next to the Databricks CLI.
+func InstallShim(databricksPath string) (ShimInstallResult, error) {
+	return installShimForGOOS(databricksPath, runtime.GOOS)
+}
+
+func installShimForGOOS(databricksPath, goos string) (ShimInstallResult, error) {
+	if strings.TrimSpace(databricksPath) == "" {
+		return ShimInstallResult{}, errors.New("databricks executable path is required")
+	}
+	installDir := filepath.Dir(databricksPath)
+
+	if err := os.MkdirAll(installDir, 0o755); err != nil {
+		return ShimInstallResult{}, fmt.Errorf("create Docker credential helper directory %s: %w", installDir, err)
+	}
+
+	path := filepath.Join(installDir, shimFilename(goos))
+	mode := os.FileMode(0o755)
+	script := shimScript(databricksPath)
+	if goos == "windows" {
+		mode = 0o644
+		script = cmdShimScript(databricksPath)
+	}
+	if err := writeShimFile(path, []byte(script), mode); err != nil {
+		return ShimInstallResult{}, fmt.Errorf("write Docker credential helper %s: %w", path, err)
+	}
+
+	return ShimInstallResult{
+		Path:   path,
+		OnPath: helperOnPathForGOOS(path, goos, exec.LookPath),
+	}, nil
+}
+
+func shimFilename(goos string) string {
+	if goos == "windows" {
+		return "docker-credential-" + HelperName + ".cmd"
+	}
+	return "docker-credential-" + HelperName
+}
+
+// shimScript accepts only get and sends CLI logs to stderr because Docker parses stdout as credential-helper JSON.
+func shimScript(databricksPath string) string {
+	return fmt.Sprintf(`#!/bin/sh
+if [ "$#" -ne 1 ] || [ "$1" != "get" ]; then
+  echo "docker-credential-databricks only supports get" >&2
+  exit 1
+fi
+shift
+export DATABRICKS_LOG_FILE=stderr
+exec %s auth docker token
+`, posixShellQuote(databricksPath))
+}
+
+func cmdShimScript(databricksPath string) string {
+	// Percent signs must be doubled so cmd.exe treats them literally in executable paths.
+	script := fmt.Sprintf(`@echo off
+setlocal EnableExtensions DisableDelayedExpansion
+set "ERRORLEVEL="
+if not "%%~1"=="get" goto unsupported
+if not "%%~2"=="" goto unsupported
+set DATABRICKS_LOG_FILE=stderr
+"%s" auth docker token
+exit /b %%errorlevel%%
+
+:unsupported
+echo docker-credential-databricks only supports get 1>&2
+exit /b 1
+`, strings.ReplaceAll(databricksPath, "%", "%%"))
+	return strings.ReplaceAll(script, "\n", "\r\n")
+}
+
+// writeShimFile preserves an existing helper if writing its replacement fails.
+func writeShimFile(path string, script []byte, mode os.FileMode) error {
+	dir := filepath.Dir(path)
+	tmp, err := os.CreateTemp(dir, "."+filepath.Base(path)+".*")
+	if err != nil {
+		return err
+	}
+	tmpPath := tmp.Name()
+	defer func() {
+		_ = os.Remove(tmpPath)
+	}()
+
+	if _, err := tmp.Write(script); err != nil {
+		_ = tmp.Close()
+		return err
+	}
+	if err := tmp.Chmod(mode); err != nil {
+		_ = tmp.Close()
+		return err
+	}
+	if err := tmp.Close(); err != nil {
+		return err
+	}
+	return os.Rename(tmpPath, path)
+}
+
+func posixShellQuote(value string) string {
+	return "'" + strings.ReplaceAll(value, "'", "'\\''") + "'"
+}
+
+// helperOnPathForGOOS mirrors Docker's extensionless helper lookup through PATHEXT on Windows.
+func helperOnPathForGOOS(helperPath, goos string, lookPath func(string) (string, error)) bool {
+	name := filepath.Base(helperPath)
+	if goos == "windows" {
+		name = strings.TrimSuffix(name, filepath.Ext(name))
+	}
+	candidate, err := lookPath(name)
+	if err != nil {
+		return false
+	}
+	return samePath(candidate, helperPath)
+}
+
+func samePath(a, b string) bool {
+	aInfo, aErr := os.Stat(a)
+	if aErr != nil {
+		return false
+	}
+	bInfo, bErr := os.Stat(b)
+	if bErr != nil {
+		return false
+	}
+	return os.SameFile(aInfo, bInfo)
+}
diff --git a/libs/dockercredentials/shim_test.go b/libs/dockercredentials/shim_test.go
new file mode 100644
index 00000000000..ae37ca6be6c
--- /dev/null
+++ b/libs/dockercredentials/shim_test.go
@@ -0,0 +1,330 @@
+package dockercredentials
+
+import (
+	"bytes"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const windowsShimChildEnv = "DATABRICKS_WINDOWS_SHIM_TEST_EXIT"
+
+// TestMain lets the Windows shim invoke this test binary as a fake CLI.
+func TestMain(m *testing.M) {
+	if os.Getenv(windowsShimChildEnv) != "" {
+		os.Args = []string{os.Args[0], "-test.run=^TestWindowsShimExitChild$"}
+	}
+	m.Run()
+}
+
+func TestWindowsShimExitChild(t *testing.T) {
+	switch os.Getenv(windowsShimChildEnv) {
+	case "failure":
+		t.Fatal("simulated CLI failure")
+	case "success":
+		return
+	default:
+		t.Skip("shim child process only")
+	}
+}
+
+func writeTestDatabricksExecutable(t *testing.T, dir string) string {
+	t.Helper()
+	name := "databricks"
+	if runtime.GOOS == "windows" {
+		name += ".exe"
+	}
+	path := filepath.Join(dir, name)
+	require.NoError(t, os.WriteFile(path, []byte("databricks executable"), 0o755))
+	return path
+}
+
+func TestShimFilename(t *testing.T) {
+	assert.Equal(t, "docker-credential-databricks", shimFilename("linux"))
+	assert.Equal(t, "docker-credential-databricks.cmd", shimFilename("windows"))
+}
+
+func TestInstallWindowsShimWritesCommandScript(t *testing.T) {
+	installDir := t.TempDir()
+	databricksPath := filepath.Join(installDir, "databricks.exe")
+	require.NoError(t, os.WriteFile(databricksPath, []byte("databricks executable"), 0o755))
+	t.Setenv("PATH", installDir)
+
+	got, err := installShimForGOOS(databricksPath, "windows")
+	require.NoError(t, err)
+	assert.Equal(t, filepath.Join(installDir, "docker-credential-databricks.cmd"), got.Path)
+
+	raw, err := os.ReadFile(got.Path)
+	require.NoError(t, err)
+	assert.NotEqual(t, "databricks executable", string(raw))
+	assert.Contains(t, string(raw), "auth docker token")
+}
+
+func TestUnixShimExecutesOnlyGetAndForcesLogsToStderr(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("Unix shell shim test")
+	}
+
+	dir := t.TempDir()
+	argsPath := filepath.Join(dir, "args")
+	envPath := filepath.Join(dir, "env")
+	stdinPath := filepath.Join(dir, "stdin")
+	fakeDir := filepath.Join(dir, "bin$DATABRICKS_LOG_FILE")
+	require.NoError(t, os.MkdirAll(fakeDir, 0o755))
+	fakeDatabricks := filepath.Join(fakeDir, "data'bricks")
+	require.NoError(t, os.WriteFile(fakeDatabricks, []byte(`#!/bin/sh
+printf '%s' "$*" > "$FAKE_ARGS_FILE"
+printf '%s' "$DATABRICKS_LOG_FILE" > "$FAKE_ENV_FILE"
+cat > "$FAKE_STDIN_FILE"
+printf '{"Username":"oauthtoken","Secret":"secret"}\n'
+`), 0o755))
+	require.NoError(t, os.Chmod(fakeDatabricks, 0o755))
+
+	shim := filepath.Join(dir, "docker-credential-databricks")
+	require.NoError(t, os.WriteFile(shim, []byte(shimScript(fakeDatabricks)), 0o755))
+	require.NoError(t, os.Chmod(shim, 0o755))
+
+	cmd := exec.Command(shim, "get")
+	cmd.Stdin = bytes.NewBufferString("registry-host")
+	cmd.Env = append(os.Environ(),
+		"DATABRICKS_LOG_FILE=stdout",
+		"FAKE_ARGS_FILE="+argsPath,
+		"FAKE_ENV_FILE="+envPath,
+		"FAKE_STDIN_FILE="+stdinPath,
+	)
+	out, err := cmd.Output()
+	require.NoError(t, err)
+	assert.JSONEq(t, `{"Username":"oauthtoken","Secret":"secret"}`, string(out))
+
+	rawArgs, err := os.ReadFile(argsPath)
+	require.NoError(t, err)
+	assert.Equal(t, "auth docker token", string(rawArgs))
+
+	rawEnv, err := os.ReadFile(envPath)
+	require.NoError(t, err)
+	assert.Equal(t, "stderr", string(rawEnv))
+
+	rawStdin, err := os.ReadFile(stdinPath)
+	require.NoError(t, err)
+	assert.Equal(t, "registry-host", string(rawStdin))
+
+	err = exec.Command(shim, "store").Run()
+	assert.Error(t, err)
+	err = exec.Command(shim, "get", "store").Run()
+	assert.Error(t, err)
+}
+
+func TestWindowsShimExecutesOnlyGetAndForcesLogsToStderr(t *testing.T) {
+	if runtime.GOOS != "windows" {
+		t.Skip("Windows command shim test")
+	}
+
+	dir := t.TempDir()
+	argsPath := filepath.Join(dir, "args")
+	envPath := filepath.Join(dir, "env")
+	stdinPath := filepath.Join(dir, "stdin")
+	fakeDir := filepath.Join(dir, "bin%DOCKER_SHIM_UNSET%")
+	require.NoError(t, os.Mkdir(fakeDir, 0o755))
+	fakeDatabricks := filepath.Join(fakeDir, "databricks.cmd")
+	require.NoError(t, os.WriteFile(fakeDatabricks, []byte(`@echo off
+set /p registry=
+> "%FAKE_ARGS_FILE%" echo %*
+> "%FAKE_ENV_FILE%" echo %DATABRICKS_LOG_FILE%
+> "%FAKE_STDIN_FILE%" echo %registry%
+echo {"Username":"oauthtoken","Secret":"secret"}
+`), 0o644))
+
+	shim := filepath.Join(dir, "docker-credential-databricks.cmd")
+	require.NoError(t, os.WriteFile(shim, []byte(cmdShimScript(fakeDatabricks)), 0o644))
+
+	cmd := exec.Command(shim, "get")
+	cmd.Stdin = bytes.NewBufferString("registry-host\n")
+	cmd.Env = append(os.Environ(),
+		"DATABRICKS_LOG_FILE=stdout",
+		"FAKE_ARGS_FILE="+argsPath,
+		"FAKE_ENV_FILE="+envPath,
+		"FAKE_STDIN_FILE="+stdinPath,
+	)
+	out, err := cmd.Output()
+	require.NoError(t, err)
+	assert.JSONEq(t, `{"Username":"oauthtoken","Secret":"secret"}`, string(out))
+
+	rawArgs, err := os.ReadFile(argsPath)
+	require.NoError(t, err)
+	assert.Equal(t, "auth docker token", strings.TrimSpace(string(rawArgs)))
+
+	rawEnv, err := os.ReadFile(envPath)
+	require.NoError(t, err)
+	assert.Equal(t, "stderr", strings.TrimSpace(string(rawEnv)))
+
+	rawStdin, err := os.ReadFile(stdinPath)
+	require.NoError(t, err)
+	assert.Equal(t, "registry-host", strings.TrimSpace(string(rawStdin)))
+
+	assert.Error(t, exec.Command(shim, "store").Run())
+	assert.Error(t, exec.Command(shim, "get", "store").Run())
+}
+
+func TestWindowsShimDisablesInheritedDelayedExpansion(t *testing.T) {
+	if runtime.GOOS != "windows" {
+		t.Skip("Windows command shim test")
+	}
+
+	dir := t.TempDir()
+	fakeDir := filepath.Join(dir, "bin!DOCKER_SHIM_UNSET!")
+	require.NoError(t, os.Mkdir(fakeDir, 0o755))
+	fakeDatabricks := filepath.Join(fakeDir, "databricks.cmd")
+	require.NoError(t, os.WriteFile(fakeDatabricks, []byte("@echo {\"Username\":\"oauthtoken\",\"Secret\":\"secret\"}\r\n"), 0o644))
+
+	shim := filepath.Join(dir, "docker-credential-databricks.cmd")
+	require.NoError(t, os.WriteFile(shim, []byte(cmdShimScript(fakeDatabricks)), 0o644))
+
+	cmd := exec.Command("cmd.exe", "/D", "/V:ON", "/C", "call", shim, "get")
+	cmd.Stdin = bytes.NewBufferString("registry-host\n")
+	out, err := cmd.Output()
+	require.NoError(t, err)
+	assert.JSONEq(t, `{"Username":"oauthtoken","Secret":"secret"}`, string(out))
+}
+
+func TestWindowsShimPropagatesTokenExitCode(t *testing.T) {
+	if runtime.GOOS != "windows" {
+		t.Skip("Windows command shim test")
+	}
+
+	dir := t.TempDir()
+	fakeDatabricks, err := os.Executable()
+	require.NoError(t, err)
+
+	shim := filepath.Join(dir, "docker-credential-databricks.cmd")
+	require.NoError(t, os.WriteFile(shim, []byte(cmdShimScript(fakeDatabricks)), 0o644))
+
+	t.Run("failure with inherited ERRORLEVEL", func(t *testing.T) {
+		cmd := exec.Command(shim, "get")
+		cmd.Env = append(os.Environ(), "ERRORLEVEL=0", windowsShimChildEnv+"=failure")
+		err := cmd.Run()
+		var exitErr *exec.ExitError
+		require.ErrorAs(t, err, &exitErr)
+		assert.Equal(t, 1, exitErr.ExitCode())
+	})
+
+	t.Run("success", func(t *testing.T) {
+		cmd := exec.Command(shim, "get")
+		cmd.Env = append(os.Environ(), "ERRORLEVEL=42", windowsShimChildEnv+"=success")
+		require.NoError(t, cmd.Run())
+		assert.Equal(t, 0, cmd.ProcessState.ExitCode())
+	})
+}
+
+func TestInstallShimReportsPathStatus(t *testing.T) {
+	dir := t.TempDir()
+	databricksPath := writeTestDatabricksExecutable(t, dir)
+	t.Setenv("PATH", dir)
+
+	got, err := InstallShim(databricksPath)
+	require.NoError(t, err)
+	assert.Equal(t, filepath.Join(dir, shimFilename(runtime.GOOS)), got.Path)
+	assert.True(t, got.OnPath)
+
+	info, err := os.Stat(got.Path)
+	require.NoError(t, err)
+	if runtime.GOOS != "windows" {
+		assert.Equal(t, os.FileMode(0o755), info.Mode().Perm())
+	}
+}
+
+func TestInstallShimReportsNotOnPath(t *testing.T) {
+	dir := t.TempDir()
+	databricksPath := writeTestDatabricksExecutable(t, dir)
+	t.Setenv("PATH", t.TempDir())
+
+	got, err := InstallShim(databricksPath)
+	require.NoError(t, err)
+	assert.Equal(t, filepath.Join(dir, shimFilename(runtime.GOOS)), got.Path)
+	assert.False(t, got.OnPath)
+}
+
+func TestInstallShimReportsNotOnPathWhenHelperIsShadowed(t *testing.T) {
+	installDir := t.TempDir()
+	databricksPath := writeTestDatabricksExecutable(t, installDir)
+	shadowDir := t.TempDir()
+	shadowPath := filepath.Join(shadowDir, shimFilename(runtime.GOOS))
+	require.NoError(t, os.WriteFile(shadowPath, []byte("shadow"), 0o755))
+	require.NoError(t, os.Chmod(shadowPath, 0o755))
+	t.Setenv("PATH", shadowDir+string(os.PathListSeparator)+installDir)
+
+	got, err := InstallShim(databricksPath)
+	require.NoError(t, err)
+	assert.Equal(t, filepath.Join(installDir, shimFilename(runtime.GOOS)), got.Path)
+	assert.False(t, got.OnPath)
+}
+
+func TestHelperOnPathUsesDockerLookupName(t *testing.T) {
+	dir := t.TempDir()
+	helperPath := filepath.Join(dir, "docker-credential-databricks.cmd")
+	require.NoError(t, os.WriteFile(helperPath, []byte("helper"), 0o755))
+
+	var gotName string
+	found := helperOnPathForGOOS(helperPath, "windows", func(name string) (string, error) {
+		gotName = name
+		return helperPath, nil
+	})
+
+	assert.True(t, found)
+	assert.Equal(t, "docker-credential-databricks", gotName)
+}
+
+func TestHelperOnPathRejectsEmptyUnixPathEntry(t *testing.T) {
+	dir := t.TempDir()
+	helperPath := filepath.Join(dir, shimFilename(runtime.GOOS))
+	require.NoError(t, os.WriteFile(helperPath, []byte("helper"), 0o755))
+
+	t.Chdir(dir)
+	t.Setenv("PATH", "")
+	assert.False(t, helperOnPathForGOOS(helperPath, runtime.GOOS, exec.LookPath))
+}
+
+func TestSamePathUsesFileIdentity(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("symlink test")
+	}
+
+	dir := t.TempDir()
+	target := filepath.Join(dir, "docker-credential-databricks")
+	link := filepath.Join(dir, "helper-link")
+	require.NoError(t, os.WriteFile(target, []byte("helper"), 0o755))
+	require.NoError(t, os.Symlink(target, link))
+
+	assert.True(t, samePath(target, link))
+}
+
+func TestInstallShimDoesNotTruncateExistingHelperWhenTempCreateFails(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("permission-forced failure test")
+	}
+	if os.Geteuid() == 0 {
+		t.Skip("permission-forced failure test requires a non-root user")
+	}
+
+	installDir := filepath.Join(t.TempDir(), "missing")
+	require.NoError(t, os.MkdirAll(installDir, 0o755))
+	databricksPath := writeTestDatabricksExecutable(t, installDir)
+	shimPath := filepath.Join(installDir, shimFilename(runtime.GOOS))
+	require.NoError(t, os.WriteFile(shimPath, []byte("existing helper"), 0o755))
+	require.NoError(t, os.Chmod(installDir, 0o500))
+	t.Cleanup(func() {
+		_ = os.Chmod(installDir, 0o755)
+	})
+
+	_, err := InstallShim(databricksPath)
+	assert.Error(t, err)
+
+	raw, readErr := os.ReadFile(shimPath)
+	require.NoError(t, readErr)
+	assert.Equal(t, "existing helper", string(raw))
+}
diff --git a/libs/dockercredentials/workspace.go b/libs/dockercredentials/workspace.go
new file mode 100644
index 00000000000..3c1ed0f810e
--- /dev/null
+++ b/libs/dockercredentials/workspace.go
@@ -0,0 +1,41 @@
+package dockercredentials
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"github.com/databricks/cli/libs/auth"
+	"github.com/databricks/cli/libs/databrickscfg/profile"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/service/catalog"
+)
+
+// WorkspaceID uses the selected profile's ID, resolving it only when absent.
+// The client is only needed for profiles without an ID.
+func WorkspaceID(ctx context.Context, p profile.Profile, w *databricks.WorkspaceClient) (string, error) {
+	if p.WorkspaceID != "" && p.WorkspaceID != profile.WorkspaceIDNone {
+		return p.WorkspaceID, nil
+	}
+	// Neither an ambient ID nor the CLI-only "none" sentinel may become a routing header.
+	w.Config.WorkspaceID = ""
+	id, err := auth.ResolveWorkspaceID(ctx, w)
+	if err != nil {
+		err = fmt.Errorf("resolve workspace ID for profile %q: %w. Run databricks auth login --host <workspace-url> and retry with that profile", p.Name, err)
+		return "", RewriteProfileError(ctx, p, err)
+	}
+	return id, nil
+}
+
+// WorkspaceRegion obtains and validates the region returned by the workspace's metastore.
+func WorkspaceRegion(ctx context.Context, p profile.Profile, metastores catalog.MetastoresInterface) (string, error) {
+	summary, err := metastores.Summary(ctx)
+	if err != nil {
+		return "", RewriteProfileError(ctx, p, fmt.Errorf("resolve workspace region for profile %q: %w", p.Name, err))
+	}
+	region := strings.TrimSpace(summary.Region)
+	if region == "" {
+		return "", fmt.Errorf("resolve workspace region for profile %q: metastore summary did not include a region", p.Name)
+	}
+	return region, nil
+}
diff --git a/libs/dockercredentials/workspace_test.go b/libs/dockercredentials/workspace_test.go
new file mode 100644
index 00000000000..3375ff08902
--- /dev/null
+++ b/libs/dockercredentials/workspace_test.go
@@ -0,0 +1,70 @@
+package dockercredentials_test
+
+import (
+	"errors"
+	"net/http"
+	"testing"
+
+	"github.com/databricks/cli/libs/auth"
+	"github.com/databricks/cli/libs/databrickscfg/profile"
+	"github.com/databricks/cli/libs/dockercredentials"
+	"github.com/databricks/cli/libs/testserver"
+	"github.com/databricks/databricks-sdk-go"
+	mockcatalog "github.com/databricks/databricks-sdk-go/experimental/mocks/service/catalog"
+	"github.com/databricks/databricks-sdk-go/service/catalog"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+)
+
+func TestWorkspaceID(t *testing.T) {
+	t.Run("configured", func(t *testing.T) {
+		got, err := dockercredentials.WorkspaceID(t.Context(), profile.Profile{WorkspaceID: "123"}, nil)
+		require.NoError(t, err)
+		assert.Equal(t, "123", got)
+	})
+
+	for _, id := range []string{"", profile.WorkspaceIDNone} {
+		t.Run(id, func(t *testing.T) {
+			server := testserver.New(t)
+			server.Handle("GET", "/api/2.0/preview/scim/v2/Me", func(req testserver.Request) any {
+				assert.Empty(t, req.Headers.Get(auth.WorkspaceIDHeader))
+				return testserver.Response{Headers: http.Header{"X-Databricks-Org-Id": {"456"}}, Body: map[string]any{}}
+			})
+			w, err := databricks.NewWorkspaceClient(&databricks.Config{Host: server.URL, Token: "test-token"})
+			require.NoError(t, err)
+			w.Config.WorkspaceID = "ambient-id"
+			got, err := dockercredentials.WorkspaceID(t.Context(), profile.Profile{Name: "workspace", WorkspaceID: id}, w)
+			require.NoError(t, err)
+			assert.Equal(t, "456", got)
+		})
+	}
+}
+
+func TestWorkspaceRegion(t *testing.T) {
+	wantErr := errors.New("summary failed")
+	for _, tt := range []struct {
+		name, region, want, wantError string
+		err                           error
+	}{
+		{name: "trim", region: " us-west-2 ", want: "us-west-2"},
+		{name: "missing", wantError: "metastore summary did not include a region"},
+		{name: "blank", region: " \t", wantError: "metastore summary did not include a region"},
+		{name: "error", err: wantErr, wantError: "summary failed"},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			metastores := mockcatalog.NewMockMetastoresInterface(t)
+			metastores.EXPECT().Summary(mock.Anything).Return(&catalog.GetMetastoreSummaryResponse{Region: tt.region}, tt.err)
+			got, err := dockercredentials.WorkspaceRegion(t.Context(), profile.Profile{Name: "workspace"}, metastores)
+			if tt.wantError != "" {
+				assert.ErrorContains(t, err, `resolve workspace region for profile "workspace": `+tt.wantError)
+				if tt.err != nil {
+					assert.ErrorIs(t, err, tt.err)
+				}
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
diff --git a/libs/dyn/convert/from_typed_test.go b/libs/dyn/convert/from_typed_test.go
index 0c8cf902bb4..3420c46cbd7 100644
--- a/libs/dyn/convert/from_typed_test.go
+++ b/libs/dyn/convert/from_typed_test.go
@@ -3,6 +3,7 @@ package convert
 import (
 	"testing"
 
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/cli/libs/dyn/dynassert"
 	"github.com/stretchr/testify/assert"
@@ -188,16 +189,16 @@ func TestFromTypedStructSetFieldsRetainLocation(t *testing.T) {
 	}
 
 	ref := dyn.V(map[string]dyn.Value{
-		"foo": dyn.NewValue("bar", []dyn.Location{{File: "foo"}}),
-		"bar": dyn.NewValue("baz", []dyn.Location{{File: "bar"}}),
+		"foo": dyn.NewValue("bar", []diag.Location{{File: "foo"}}),
+		"bar": dyn.NewValue("baz", []diag.Location{{File: "bar"}}),
 	})
 
 	nv, err := FromTyped(src, ref)
 	require.NoError(t, err)
 
 	// Assert foo and bar have retained their location.
-	assert.Equal(t, dyn.NewValue("bar", []dyn.Location{{File: "foo"}}), nv.Get("foo"))
-	assert.Equal(t, dyn.NewValue("qux", []dyn.Location{{File: "bar"}}), nv.Get("bar"))
+	assert.Equal(t, dyn.NewValue("bar", []diag.Location{{File: "foo"}}), nv.Get("foo"))
+	assert.Equal(t, dyn.NewValue("qux", []diag.Location{{File: "bar"}}), nv.Get("bar"))
 }
 
 func TestFromTypedStringMapWithZeroValue(t *testing.T) {
@@ -432,16 +433,16 @@ func TestFromTypedMapNonEmptyRetainLocation(t *testing.T) {
 	}
 
 	ref := dyn.V(map[string]dyn.Value{
-		"foo": dyn.NewValue("bar", []dyn.Location{{File: "foo"}}),
-		"bar": dyn.NewValue("baz", []dyn.Location{{File: "bar"}}),
+		"foo": dyn.NewValue("bar", []diag.Location{{File: "foo"}}),
+		"bar": dyn.NewValue("baz", []diag.Location{{File: "bar"}}),
 	})
 
 	nv, err := FromTyped(src, ref)
 	require.NoError(t, err)
 
 	// Assert foo and bar have retained their locations.
-	assert.Equal(t, dyn.NewValue("bar", []dyn.Location{{File: "foo"}}), nv.Get("foo"))
-	assert.Equal(t, dyn.NewValue("qux", []dyn.Location{{File: "bar"}}), nv.Get("bar"))
+	assert.Equal(t, dyn.NewValue("bar", []diag.Location{{File: "foo"}}), nv.Get("foo"))
+	assert.Equal(t, dyn.NewValue("qux", []diag.Location{{File: "bar"}}), nv.Get("bar"))
 }
 
 func TestFromTypedMapFieldWithZeroValue(t *testing.T) {
@@ -506,16 +507,16 @@ func TestFromTypedSliceNonEmptyRetainLocation(t *testing.T) {
 	}
 
 	ref := dyn.V([]dyn.Value{
-		dyn.NewValue("foo", []dyn.Location{{File: "foo"}}),
-		dyn.NewValue("bar", []dyn.Location{{File: "bar"}}),
+		dyn.NewValue("foo", []diag.Location{{File: "foo"}}),
+		dyn.NewValue("bar", []diag.Location{{File: "bar"}}),
 	})
 
 	nv, err := FromTyped(src, ref)
 	require.NoError(t, err)
 
 	// Assert foo and bar have retained their locations.
-	assert.Equal(t, dyn.NewValue("foo", []dyn.Location{{File: "foo"}}), nv.Index(0))
-	assert.Equal(t, dyn.NewValue("bar", []dyn.Location{{File: "bar"}}), nv.Index(1))
+	assert.Equal(t, dyn.NewValue("foo", []diag.Location{{File: "foo"}}), nv.Index(0))
+	assert.Equal(t, dyn.NewValue("bar", []diag.Location{{File: "bar"}}), nv.Index(1))
 }
 
 func TestFromTypedStringEmpty(t *testing.T) {
@@ -551,19 +552,19 @@ func TestFromTypedStringNonEmptyOverwrite(t *testing.T) {
 }
 
 func TestFromTypedStringRetainsLocations(t *testing.T) {
-	ref := dyn.NewValue("foo", []dyn.Location{{File: "foo"}})
+	ref := dyn.NewValue("foo", []diag.Location{{File: "foo"}})
 
 	// case: value has not been changed
 	src := "foo"
 	nv, err := FromTyped(src, ref)
 	require.NoError(t, err)
-	assert.Equal(t, dyn.NewValue("foo", []dyn.Location{{File: "foo"}}), nv)
+	assert.Equal(t, dyn.NewValue("foo", []diag.Location{{File: "foo"}}), nv)
 
 	// case: value has been changed
 	src = "bar"
 	nv, err = FromTyped(src, ref)
 	require.NoError(t, err)
-	assert.Equal(t, dyn.NewValue("bar", []dyn.Location{{File: "foo"}}), nv)
+	assert.Equal(t, dyn.NewValue("bar", []diag.Location{{File: "foo"}}), nv)
 }
 
 func TestFromTypedStringTypeError(t *testing.T) {
@@ -606,19 +607,19 @@ func TestFromTypedBoolNonEmptyOverwrite(t *testing.T) {
 }
 
 func TestFromTypedBoolRetainsLocations(t *testing.T) {
-	ref := dyn.NewValue(true, []dyn.Location{{File: "foo"}})
+	ref := dyn.NewValue(true, []diag.Location{{File: "foo"}})
 
 	// case: value has not been changed
 	src := true
 	nv, err := FromTyped(src, ref)
 	require.NoError(t, err)
-	assert.Equal(t, dyn.NewValue(true, []dyn.Location{{File: "foo"}}), nv)
+	assert.Equal(t, dyn.NewValue(true, []diag.Location{{File: "foo"}}), nv)
 
 	// case: value has been changed
 	src = false
 	nv, err = FromTyped(src, ref)
 	require.NoError(t, err)
-	assert.Equal(t, dyn.NewValue(false, []dyn.Location{{File: "foo"}}), nv)
+	assert.Equal(t, dyn.NewValue(false, []diag.Location{{File: "foo"}}), nv)
 }
 
 func TestFromTypedBoolVariableReference(t *testing.T) {
@@ -669,19 +670,19 @@ func TestFromTypedIntNonEmptyOverwrite(t *testing.T) {
 }
 
 func TestFromTypedIntRetainsLocations(t *testing.T) {
-	ref := dyn.NewValue(1234, []dyn.Location{{File: "foo"}})
+	ref := dyn.NewValue(1234, []diag.Location{{File: "foo"}})
 
 	// case: value has not been changed
 	src := 1234
 	nv, err := FromTyped(src, ref)
 	require.NoError(t, err)
-	assert.Equal(t, dyn.NewValue(1234, []dyn.Location{{File: "foo"}}), nv)
+	assert.Equal(t, dyn.NewValue(1234, []diag.Location{{File: "foo"}}), nv)
 
 	// case: value has been changed
 	src = 1235
 	nv, err = FromTyped(src, ref)
 	require.NoError(t, err)
-	assert.Equal(t, dyn.NewValue(int64(1235), []dyn.Location{{File: "foo"}}), nv)
+	assert.Equal(t, dyn.NewValue(int64(1235), []diag.Location{{File: "foo"}}), nv)
 }
 
 func TestFromTypedIntVariableReference(t *testing.T) {
@@ -733,19 +734,19 @@ func TestFromTypedFloatNonEmptyOverwrite(t *testing.T) {
 
 func TestFromTypedFloatRetainsLocations(t *testing.T) {
 	var src float64
-	ref := dyn.NewValue(1.23, []dyn.Location{{File: "foo"}})
+	ref := dyn.NewValue(1.23, []diag.Location{{File: "foo"}})
 
 	// case: value has not been changed
 	src = 1.23
 	nv, err := FromTyped(src, ref)
 	require.NoError(t, err)
-	assert.Equal(t, dyn.NewValue(1.23, []dyn.Location{{File: "foo"}}), nv)
+	assert.Equal(t, dyn.NewValue(1.23, []diag.Location{{File: "foo"}}), nv)
 
 	// case: value has been changed
 	src = 1.24
 	nv, err = FromTyped(src, ref)
 	require.NoError(t, err)
-	assert.Equal(t, dyn.NewValue(1.24, []dyn.Location{{File: "foo"}}), nv)
+	assert.Equal(t, dyn.NewValue(1.24, []diag.Location{{File: "foo"}}), nv)
 }
 
 func TestFromTypedFloatVariableReference(t *testing.T) {
@@ -814,29 +815,29 @@ func TestFromTypedNilPointerRetainsLocations(t *testing.T) {
 	}
 
 	var src *Tmp
-	ref := dyn.NewValue(nil, []dyn.Location{{File: "foobar"}})
+	ref := dyn.NewValue(nil, []diag.Location{{File: "foobar"}})
 
 	nv, err := FromTyped(src, ref)
 	require.NoError(t, err)
-	assert.Equal(t, dyn.NewValue(nil, []dyn.Location{{File: "foobar"}}), nv)
+	assert.Equal(t, dyn.NewValue(nil, []diag.Location{{File: "foobar"}}), nv)
 }
 
 func TestFromTypedNilMapRetainsLocation(t *testing.T) {
 	var src map[string]string
-	ref := dyn.NewValue(nil, []dyn.Location{{File: "foobar"}})
+	ref := dyn.NewValue(nil, []diag.Location{{File: "foobar"}})
 
 	nv, err := FromTyped(src, ref)
 	require.NoError(t, err)
-	assert.Equal(t, dyn.NewValue(nil, []dyn.Location{{File: "foobar"}}), nv)
+	assert.Equal(t, dyn.NewValue(nil, []diag.Location{{File: "foobar"}}), nv)
 }
 
 func TestFromTypedNilSliceRetainsLocation(t *testing.T) {
 	var src []string
-	ref := dyn.NewValue(nil, []dyn.Location{{File: "foobar"}})
+	ref := dyn.NewValue(nil, []diag.Location{{File: "foobar"}})
 
 	nv, err := FromTyped(src, ref)
 	require.NoError(t, err)
-	assert.Equal(t, dyn.NewValue(nil, []dyn.Location{{File: "foobar"}}), nv)
+	assert.Equal(t, dyn.NewValue(nil, []diag.Location{{File: "foobar"}}), nv)
 }
 
 func TestFromTypedForceSendFieldsComplexTypes(t *testing.T) {
@@ -909,11 +910,9 @@ func TestFromTypedForceSendFieldsEmbedded(t *testing.T) {
 	}
 
 	src := Outer{
-		Inner: Inner{
-			Field:           nil,
-			ForceSendFields: []string{"Field"},
-		},
-		Other: "value",
+		Field:           nil,
+		ForceSendFields: []string{"Field"},
+		Other:           "value",
 	}
 
 	nv, err := FromTyped(src, dyn.NilValue)
diff --git a/libs/dyn/convert/normalize.go b/libs/dyn/convert/normalize.go
index 79cfee37441..e41ed4a0a87 100644
--- a/libs/dyn/convert/normalize.go
+++ b/libs/dyn/convert/normalize.go
@@ -18,10 +18,19 @@ const (
 	// IncludeMissingFields causes the normalization to include fields that defined on the given
 	// type but are missing in the source value. They are included with their zero values.
 	IncludeMissingFields NormalizeOption = iota
+
+	// DropEmptyStrings drops struct fields whose value is an empty string, unless
+	// the field is tagged without omitempty (i.e. its zero value must be sent).
+	// This mirrors JSON serialization, where an omitempty string field set to ""
+	// is omitted from the request. Without this, an explicitly-set "" reaches
+	// ToTyped, which force-sends it, and the backend rejects it (e.g.
+	// "'' is not a valid cluster policy ID").
+	DropEmptyStrings
 )
 
 type normalizeOptions struct {
 	includeMissingFields bool
+	dropEmptyStrings     bool
 }
 
 func Normalize(dst any, src dyn.Value, opts ...NormalizeOption) (dyn.Value, diag.Diagnostics) {
@@ -30,6 +39,8 @@ func Normalize(dst any, src dyn.Value, opts ...NormalizeOption) (dyn.Value, diag
 		switch opt {
 		case IncludeMissingFields:
 			n.includeMissingFields = true
+		case DropEmptyStrings:
+			n.dropEmptyStrings = true
 		}
 	}
 
@@ -73,8 +84,8 @@ func nullWarning(expected dyn.Kind, src dyn.Value, path dyn.Path) diag.Diagnosti
 	return diag.Diagnostic{
 		Severity:  diag.Warning,
 		Summary:   fmt.Sprintf("expected a %s value, found null", expected),
-		Locations: []dyn.Location{src.Location()},
-		Paths:     []dyn.Path{path},
+		Locations: []diag.Location{src.Location()},
+		Paths:     dyn.ToStructPaths(path),
 	}
 }
 
@@ -82,11 +93,41 @@ func typeMismatch(expected dyn.Kind, src dyn.Value, path dyn.Path) diag.Diagnost
 	return diag.Diagnostic{
 		Severity:  diag.Warning,
 		Summary:   fmt.Sprintf("expected %s, found %s", expected, src.Kind()),
-		Locations: []dyn.Location{src.Location()},
-		Paths:     []dyn.Path{path},
+		Locations: []diag.Location{src.Location()},
+		Paths:     dyn.ToStructPaths(path),
 	}
 }
 
+// isAnchorContainer reports whether v is a YAML anchor or a non-empty
+// sequence/map composed entirely of anchor containers. Anchors define reusable
+// blocks and must not trigger "unknown field" warnings, including when nested
+// inside a container.
+func isAnchorContainer(v dyn.Value) bool {
+	if v.IsAnchor() {
+		return true
+	}
+
+	var elements []dyn.Value
+	switch v.Kind() {
+	case dyn.KindSequence:
+		elements = v.MustSequence()
+	case dyn.KindMap:
+		elements = v.MustMap().Values()
+	default:
+		return false
+	}
+
+	if len(elements) == 0 {
+		return false
+	}
+	for _, e := range elements {
+		if !isAnchorContainer(e) {
+			return false
+		}
+	}
+	return true
+}
+
 func (n normalizeOptions) normalizeStruct(typ reflect.Type, src dyn.Value, seen []reflect.Type, path dyn.Path) (dyn.Value, diag.Diagnostics) {
 	var diags diag.Diagnostics
 
@@ -101,7 +142,7 @@ func (n normalizeOptions) normalizeStruct(typ reflect.Type, src dyn.Value, seen
 			fieldName := pk.MustString()
 			index, ok := info.Fields[fieldName]
 			if !ok {
-				if !pv.IsAnchor() {
+				if !isAnchorContainer(pv) {
 					// Special case: provide a more helpful message for "valueFrom" vs "value_from"
 					if fieldName == "valueFrom" {
 						if _, hasValueFrom := info.Fields["value_from"]; hasValueFrom {
@@ -110,7 +151,7 @@ func (n normalizeOptions) normalizeStruct(typ reflect.Type, src dyn.Value, seen
 								Summary:   "Use 'value_from' instead of 'valueFrom'",
 								Detail:    "The field 'valueFrom' should be 'value_from' (snake_case). The 'valueFrom' field will be ignored.",
 								Locations: pk.Locations(),
-								Paths:     []dyn.Path{path},
+								Paths:     dyn.ToStructPaths(path),
 							})
 							continue
 						}
@@ -120,7 +161,7 @@ func (n normalizeOptions) normalizeStruct(typ reflect.Type, src dyn.Value, seen
 						Severity:  diag.Warning,
 						Summary:   "unknown field: " + fieldName,
 						Locations: pk.Locations(),
-						Paths:     []dyn.Path{path},
+						Paths:     dyn.ToStructPaths(path),
 					})
 				}
 				continue
@@ -136,6 +177,15 @@ func (n normalizeOptions) normalizeStruct(typ reflect.Type, src dyn.Value, seen
 				}
 			}
 
+			// Drop an empty string on an omitempty field so it is not force-sent
+			// to the backend (see DropEmptyStrings). ForceEmpty marks fields whose
+			// zero value must be kept, so those are left in place.
+			if n.dropEmptyStrings && !info.ForceEmpty[fieldName] {
+				if s, ok := nv.AsString(); ok && s == "" {
+					continue
+				}
+			}
+
 			out.SetLoc(pk.MustString(), pk.Locations(), nv)
 		}
 
@@ -311,11 +361,11 @@ func (n normalizeOptions) normalizeBool(typ reflect.Type, src dyn.Value, path dy
 	case dyn.KindBool:
 		return dyn.NewValue(src.MustBool(), src.Locations()), nil
 	case dyn.KindString:
-		// See https://github.com/go-yaml/yaml/blob/f6f7691b1fdeb513f56608cd2c32c51f8194bf51/decode.go#L684-L693.
+		// See https://yaml.org/type/bool.html.
 		switch src.MustString() {
-		case "true", "y", "Y", "yes", "Yes", "YES", "on", "On", "ON":
+		case "true", "True", "TRUE", "y", "Y", "yes", "Yes", "YES", "on", "On", "ON":
 			return dyn.NewValue(true, src.Locations()), nil
-		case "false", "n", "N", "no", "No", "NO", "off", "Off", "OFF":
+		case "false", "False", "FALSE", "n", "N", "no", "No", "NO", "off", "Off", "OFF":
 			return dyn.NewValue(false, src.Locations()), nil
 		default:
 			// Return verbatim if it's a pure variable reference.
@@ -348,8 +398,8 @@ func (n normalizeOptions) normalizeInt(typ reflect.Type, src dyn.Value, path dyn
 			return dyn.InvalidValue, diags.Append(diag.Diagnostic{
 				Severity:  diag.Warning,
 				Summary:   fmt.Sprintf(`cannot accurately represent "%g" as integer due to precision loss`, src.MustFloat()),
-				Locations: []dyn.Location{src.Location()},
-				Paths:     []dyn.Path{path},
+				Locations: []diag.Location{src.Location()},
+				Paths:     dyn.ToStructPaths(path),
 			})
 		}
 		return dyn.NewValue(out, src.Locations()), nil
@@ -365,8 +415,8 @@ func (n normalizeOptions) normalizeInt(typ reflect.Type, src dyn.Value, path dyn
 			return dyn.InvalidValue, diags.Append(diag.Diagnostic{
 				Severity:  diag.Warning,
 				Summary:   fmt.Sprintf("cannot parse %q as an integer", src.MustString()),
-				Locations: []dyn.Location{src.Location()},
-				Paths:     []dyn.Path{path},
+				Locations: []diag.Location{src.Location()},
+				Paths:     dyn.ToStructPaths(path),
 			})
 		}
 		return dyn.NewValue(out, src.Locations()), nil
@@ -392,8 +442,8 @@ func (n normalizeOptions) normalizeFloat(typ reflect.Type, src dyn.Value, path d
 			return dyn.InvalidValue, diags.Append(diag.Diagnostic{
 				Severity:  diag.Warning,
 				Summary:   fmt.Sprintf(`cannot accurately represent "%d" as floating point number due to precision loss`, src.MustInt()),
-				Locations: []dyn.Location{src.Location()},
-				Paths:     []dyn.Path{path},
+				Locations: []diag.Location{src.Location()},
+				Paths:     dyn.ToStructPaths(path),
 			})
 		}
 		return dyn.NewValue(out, src.Locations()), nil
@@ -409,8 +459,8 @@ func (n normalizeOptions) normalizeFloat(typ reflect.Type, src dyn.Value, path d
 			return dyn.InvalidValue, diags.Append(diag.Diagnostic{
 				Severity:  diag.Warning,
 				Summary:   fmt.Sprintf("cannot parse %q as a floating point number", src.MustString()),
-				Locations: []dyn.Location{src.Location()},
-				Paths:     []dyn.Path{path},
+				Locations: []diag.Location{src.Location()},
+				Paths:     dyn.ToStructPaths(path),
 			})
 		}
 		return dyn.NewValue(out, src.Locations()), nil
diff --git a/libs/dyn/convert/normalize_test.go b/libs/dyn/convert/normalize_test.go
index 7eb50a13b67..ac95aaafac6 100644
--- a/libs/dyn/convert/normalize_test.go
+++ b/libs/dyn/convert/normalize_test.go
@@ -6,6 +6,7 @@ import (
 	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/cli/libs/dyn/dynassert"
+	"github.com/databricks/cli/libs/structs/structpath"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -43,8 +44,8 @@ func TestNormalizeStructElementDiagnostic(t *testing.T) {
 	assert.Equal(t, diag.Diagnostic{
 		Severity:  diag.Warning,
 		Summary:   `expected string, found map`,
-		Locations: []dyn.Location{{}},
-		Paths:     []dyn.Path{dyn.NewPath(dyn.Key("bar"))},
+		Locations: []diag.Location{{}},
+		Paths:     structpath.NewPathSlice("bar"),
 	}, diags[0])
 
 	// Elements that encounter an error during normalization are dropped.
@@ -64,7 +65,7 @@ func TestNormalizeStructUnknownField(t *testing.T) {
 	m.SetLoc("foo", nil, dyn.V("val-foo"))
 
 	// Set the unknown field, with location information.
-	m.SetLoc("bar", []dyn.Location{
+	m.SetLoc("bar", []diag.Location{
 		{File: "hello.yaml", Line: 1, Column: 1},
 		{File: "world.yaml", Line: 2, Column: 2},
 	}, dyn.V("var-bar"))
@@ -77,11 +78,11 @@ func TestNormalizeStructUnknownField(t *testing.T) {
 		Severity: diag.Warning,
 		Summary:  `unknown field: bar`,
 		// Assert location of the unknown field is included in the diagnostic.
-		Locations: []dyn.Location{
+		Locations: []diag.Location{
 			{File: "hello.yaml", Line: 1, Column: 1},
 			{File: "world.yaml", Line: 2, Column: 2},
 		},
-		Paths: []dyn.Path{dyn.EmptyPath},
+		Paths: dyn.ToStructPaths(dyn.EmptyPath),
 	}, diags[0])
 
 	// The field that can be mapped to the struct field is retained.
@@ -114,8 +115,8 @@ func TestNormalizeStructError(t *testing.T) {
 	assert.Equal(t, diag.Diagnostic{
 		Severity:  diag.Warning,
 		Summary:   `expected map, found string`,
-		Locations: []dyn.Location{vin.Get("foo").Location()},
-		Paths:     []dyn.Path{dyn.EmptyPath},
+		Locations: []diag.Location{vin.Get("foo").Location()},
+		Paths:     dyn.ToStructPaths(dyn.EmptyPath),
 	}, err[0])
 }
 
@@ -241,7 +242,7 @@ func TestNormalizeStructVariableReference(t *testing.T) {
 	}
 
 	var typ Tmp
-	vin := dyn.NewValue("${var.foo}", []dyn.Location{{File: "file", Line: 1, Column: 1}})
+	vin := dyn.NewValue("${var.foo}", []diag.Location{{File: "file", Line: 1, Column: 1}})
 	vout, err := Normalize(typ, vin)
 	assert.Empty(t, err)
 	assert.Equal(t, vin, vout)
@@ -253,14 +254,14 @@ func TestNormalizeStructRandomStringError(t *testing.T) {
 	}
 
 	var typ Tmp
-	vin := dyn.NewValue("var foo", []dyn.Location{{File: "file", Line: 1, Column: 1}})
+	vin := dyn.NewValue("var foo", []diag.Location{{File: "file", Line: 1, Column: 1}})
 	_, err := Normalize(typ, vin)
 	assert.Len(t, err, 1)
 	assert.Equal(t, diag.Diagnostic{
 		Severity:  diag.Warning,
 		Summary:   `expected map, found string`,
-		Locations: []dyn.Location{vin.Location()},
-		Paths:     []dyn.Path{dyn.EmptyPath},
+		Locations: []diag.Location{vin.Location()},
+		Paths:     dyn.ToStructPaths(dyn.EmptyPath),
 	}, err[0])
 }
 
@@ -270,14 +271,14 @@ func TestNormalizeStructIntError(t *testing.T) {
 	}
 
 	var typ Tmp
-	vin := dyn.NewValue(1, []dyn.Location{{File: "file", Line: 1, Column: 1}})
+	vin := dyn.NewValue(1, []diag.Location{{File: "file", Line: 1, Column: 1}})
 	_, err := Normalize(typ, vin)
 	assert.Len(t, err, 1)
 	assert.Equal(t, diag.Diagnostic{
 		Severity:  diag.Warning,
 		Summary:   `expected map, found int`,
-		Locations: []dyn.Location{vin.Location()},
-		Paths:     []dyn.Path{dyn.EmptyPath},
+		Locations: []diag.Location{vin.Location()},
+		Paths:     dyn.ToStructPaths(dyn.EmptyPath),
 	}, err[0])
 }
 
@@ -305,8 +306,8 @@ func TestNormalizeMapElementDiagnostic(t *testing.T) {
 	assert.Equal(t, diag.Diagnostic{
 		Severity:  diag.Warning,
 		Summary:   `expected string, found map`,
-		Locations: []dyn.Location{{}},
-		Paths:     []dyn.Path{dyn.NewPath(dyn.Key("bar"))},
+		Locations: []diag.Location{{}},
+		Paths:     structpath.NewPathSlice("bar"),
 	}, err[0])
 
 	// Elements that encounter an error during normalization are dropped.
@@ -331,8 +332,8 @@ func TestNormalizeMapError(t *testing.T) {
 	assert.Equal(t, diag.Diagnostic{
 		Severity:  diag.Warning,
 		Summary:   `expected map, found string`,
-		Locations: []dyn.Location{vin.Location()},
-		Paths:     []dyn.Path{dyn.EmptyPath},
+		Locations: []diag.Location{vin.Location()},
+		Paths:     dyn.ToStructPaths(dyn.EmptyPath),
 	}, err[0])
 }
 
@@ -372,7 +373,7 @@ func TestNormalizeMapNestedError(t *testing.T) {
 
 func TestNormalizeMapVariableReference(t *testing.T) {
 	var typ map[string]string
-	vin := dyn.NewValue("${var.foo}", []dyn.Location{{File: "file", Line: 1, Column: 1}})
+	vin := dyn.NewValue("${var.foo}", []diag.Location{{File: "file", Line: 1, Column: 1}})
 	vout, err := Normalize(typ, vin)
 	assert.Empty(t, err)
 	assert.Equal(t, vin, vout)
@@ -380,27 +381,27 @@ func TestNormalizeMapVariableReference(t *testing.T) {
 
 func TestNormalizeMapRandomStringError(t *testing.T) {
 	var typ map[string]string
-	vin := dyn.NewValue("var foo", []dyn.Location{{File: "file", Line: 1, Column: 1}})
+	vin := dyn.NewValue("var foo", []diag.Location{{File: "file", Line: 1, Column: 1}})
 	_, err := Normalize(typ, vin)
 	assert.Len(t, err, 1)
 	assert.Equal(t, diag.Diagnostic{
 		Severity:  diag.Warning,
 		Summary:   `expected map, found string`,
-		Locations: []dyn.Location{vin.Location()},
-		Paths:     []dyn.Path{dyn.EmptyPath},
+		Locations: []diag.Location{vin.Location()},
+		Paths:     dyn.ToStructPaths(dyn.EmptyPath),
 	}, err[0])
 }
 
 func TestNormalizeMapIntError(t *testing.T) {
 	var typ map[string]string
-	vin := dyn.NewValue(1, []dyn.Location{{File: "file", Line: 1, Column: 1}})
+	vin := dyn.NewValue(1, []diag.Location{{File: "file", Line: 1, Column: 1}})
 	_, err := Normalize(typ, vin)
 	assert.Len(t, err, 1)
 	assert.Equal(t, diag.Diagnostic{
 		Severity:  diag.Warning,
 		Summary:   `expected map, found int`,
-		Locations: []dyn.Location{vin.Location()},
-		Paths:     []dyn.Path{dyn.EmptyPath},
+		Locations: []diag.Location{vin.Location()},
+		Paths:     dyn.ToStructPaths(dyn.EmptyPath),
 	}, err[0])
 }
 
@@ -429,8 +430,8 @@ func TestNormalizeSliceElementDiagnostic(t *testing.T) {
 	assert.Equal(t, diag.Diagnostic{
 		Severity:  diag.Warning,
 		Summary:   `expected string, found map`,
-		Locations: []dyn.Location{{}},
-		Paths:     []dyn.Path{dyn.NewPath(dyn.Index(2))},
+		Locations: []diag.Location{{}},
+		Paths:     []*structpath.PathNode{structpath.NewIndex(nil, 2)},
 	}, err[0])
 
 	// Elements that encounter an error during normalization are dropped.
@@ -453,8 +454,8 @@ func TestNormalizeSliceError(t *testing.T) {
 	assert.Equal(t, diag.Diagnostic{
 		Severity:  diag.Warning,
 		Summary:   `expected sequence, found string`,
-		Locations: []dyn.Location{vin.Location()},
-		Paths:     []dyn.Path{dyn.EmptyPath},
+		Locations: []diag.Location{vin.Location()},
+		Paths:     dyn.ToStructPaths(dyn.EmptyPath),
 	}, err[0])
 }
 
@@ -494,7 +495,7 @@ func TestNormalizeSliceNestedError(t *testing.T) {
 
 func TestNormalizeSliceVariableReference(t *testing.T) {
 	var typ []string
-	vin := dyn.NewValue("${var.foo}", []dyn.Location{{File: "file", Line: 1, Column: 1}})
+	vin := dyn.NewValue("${var.foo}", []diag.Location{{File: "file", Line: 1, Column: 1}})
 	vout, err := Normalize(typ, vin)
 	assert.Empty(t, err)
 	assert.Equal(t, vin, vout)
@@ -502,27 +503,27 @@ func TestNormalizeSliceVariableReference(t *testing.T) {
 
 func TestNormalizeSliceRandomStringError(t *testing.T) {
 	var typ []string
-	vin := dyn.NewValue("var foo", []dyn.Location{{File: "file", Line: 1, Column: 1}})
+	vin := dyn.NewValue("var foo", []diag.Location{{File: "file", Line: 1, Column: 1}})
 	_, err := Normalize(typ, vin)
 	assert.Len(t, err, 1)
 	assert.Equal(t, diag.Diagnostic{
 		Severity:  diag.Warning,
 		Summary:   `expected sequence, found string`,
-		Locations: []dyn.Location{vin.Location()},
-		Paths:     []dyn.Path{dyn.EmptyPath},
+		Locations: []diag.Location{vin.Location()},
+		Paths:     dyn.ToStructPaths(dyn.EmptyPath),
 	}, err[0])
 }
 
 func TestNormalizeSliceIntError(t *testing.T) {
 	var typ []string
-	vin := dyn.NewValue(1, []dyn.Location{{File: "file", Line: 1, Column: 1}})
+	vin := dyn.NewValue(1, []diag.Location{{File: "file", Line: 1, Column: 1}})
 	_, err := Normalize(typ, vin)
 	assert.Len(t, err, 1)
 	assert.Equal(t, diag.Diagnostic{
 		Severity:  diag.Warning,
 		Summary:   `expected sequence, found int`,
-		Locations: []dyn.Location{vin.Location()},
-		Paths:     []dyn.Path{dyn.EmptyPath},
+		Locations: []diag.Location{vin.Location()},
+		Paths:     dyn.ToStructPaths(dyn.EmptyPath),
 	}, err[0])
 }
 
@@ -536,20 +537,20 @@ func TestNormalizeString(t *testing.T) {
 
 func TestNormalizeStringNil(t *testing.T) {
 	var typ string
-	vin := dyn.NewValue(nil, []dyn.Location{{File: "file", Line: 1, Column: 1}})
+	vin := dyn.NewValue(nil, []diag.Location{{File: "file", Line: 1, Column: 1}})
 	_, err := Normalize(&typ, vin)
 	assert.Len(t, err, 1)
 	assert.Equal(t, diag.Diagnostic{
 		Severity:  diag.Warning,
 		Summary:   `expected a string value, found null`,
-		Locations: []dyn.Location{vin.Location()},
-		Paths:     []dyn.Path{dyn.EmptyPath},
+		Locations: []diag.Location{vin.Location()},
+		Paths:     dyn.ToStructPaths(dyn.EmptyPath),
 	}, err[0])
 }
 
 func TestNormalizeStringFromBool(t *testing.T) {
 	var typ string
-	vin := dyn.NewValue(true, []dyn.Location{{File: "file", Line: 1, Column: 1}})
+	vin := dyn.NewValue(true, []diag.Location{{File: "file", Line: 1, Column: 1}})
 	vout, err := Normalize(&typ, vin)
 	assert.Empty(t, err)
 	assert.Equal(t, dyn.NewValue("true", vin.Locations()), vout)
@@ -557,7 +558,7 @@ func TestNormalizeStringFromBool(t *testing.T) {
 
 func TestNormalizeStringFromInt(t *testing.T) {
 	var typ string
-	vin := dyn.NewValue(123, []dyn.Location{{File: "file", Line: 1, Column: 1}})
+	vin := dyn.NewValue(123, []diag.Location{{File: "file", Line: 1, Column: 1}})
 	vout, err := Normalize(&typ, vin)
 	assert.Empty(t, err)
 	assert.Equal(t, dyn.NewValue("123", vin.Locations()), vout)
@@ -565,7 +566,7 @@ func TestNormalizeStringFromInt(t *testing.T) {
 
 func TestNormalizeStringFromFloat(t *testing.T) {
 	var typ string
-	vin := dyn.NewValue(1.20, []dyn.Location{{File: "file", Line: 1, Column: 1}})
+	vin := dyn.NewValue(1.20, []diag.Location{{File: "file", Line: 1, Column: 1}})
 	vout, err := Normalize(&typ, vin)
 	assert.Empty(t, err)
 	assert.Equal(t, dyn.NewValue("1.2", vin.Locations()), vout)
@@ -573,7 +574,7 @@ func TestNormalizeStringFromFloat(t *testing.T) {
 
 func TestNormalizeStringFromTime(t *testing.T) {
 	var typ string
-	vin := dyn.NewValue(dyn.MustTime("2024-08-29"), []dyn.Location{{File: "file", Line: 1, Column: 1}})
+	vin := dyn.NewValue(dyn.MustTime("2024-08-29"), []diag.Location{{File: "file", Line: 1, Column: 1}})
 	vout, err := Normalize(&typ, vin)
 	assert.Empty(t, err)
 	assert.Equal(t, dyn.NewValue("2024-08-29", vin.Locations()), vout)
@@ -587,8 +588,8 @@ func TestNormalizeStringError(t *testing.T) {
 	assert.Equal(t, diag.Diagnostic{
 		Severity:  diag.Warning,
 		Summary:   `expected string, found map`,
-		Locations: []dyn.Location{{}},
-		Paths:     []dyn.Path{dyn.EmptyPath},
+		Locations: []diag.Location{{}},
+		Paths:     dyn.ToStructPaths(dyn.EmptyPath),
 	}, err[0])
 }
 
@@ -602,14 +603,14 @@ func TestNormalizeBool(t *testing.T) {
 
 func TestNormalizeBoolNil(t *testing.T) {
 	var typ bool
-	vin := dyn.NewValue(nil, []dyn.Location{{File: "file", Line: 1, Column: 1}})
+	vin := dyn.NewValue(nil, []diag.Location{{File: "file", Line: 1, Column: 1}})
 	_, err := Normalize(&typ, vin)
 	assert.Len(t, err, 1)
 	assert.Equal(t, diag.Diagnostic{
 		Severity:  diag.Warning,
 		Summary:   `expected a bool value, found null`,
-		Locations: []dyn.Location{vin.Location()},
-		Paths:     []dyn.Path{dyn.EmptyPath},
+		Locations: []diag.Location{vin.Location()},
+		Paths:     dyn.ToStructPaths(dyn.EmptyPath),
 	}, err[0])
 }
 
@@ -622,6 +623,10 @@ func TestNormalizeBoolFromString(t *testing.T) {
 	}{
 		{"true", true},
 		{"false", false},
+		{"True", true},
+		{"False", false},
+		{"TRUE", true},
+		{"FALSE", false},
 		{"Y", true},
 		{"N", false},
 		{"on", true},
@@ -650,8 +655,8 @@ func TestNormalizeBoolFromStringError(t *testing.T) {
 	assert.Equal(t, diag.Diagnostic{
 		Severity:  diag.Warning,
 		Summary:   `expected bool, found string`,
-		Locations: []dyn.Location{vin.Location()},
-		Paths:     []dyn.Path{dyn.EmptyPath},
+		Locations: []diag.Location{vin.Location()},
+		Paths:     dyn.ToStructPaths(dyn.EmptyPath),
 	}, err[0])
 }
 
@@ -663,8 +668,8 @@ func TestNormalizeBoolError(t *testing.T) {
 	assert.Equal(t, diag.Diagnostic{
 		Severity:  diag.Warning,
 		Summary:   `expected bool, found map`,
-		Locations: []dyn.Location{{}},
-		Paths:     []dyn.Path{dyn.EmptyPath},
+		Locations: []diag.Location{{}},
+		Paths:     dyn.ToStructPaths(dyn.EmptyPath),
 	}, err[0])
 }
 
@@ -678,14 +683,14 @@ func TestNormalizeInt(t *testing.T) {
 
 func TestNormalizeIntNil(t *testing.T) {
 	var typ int
-	vin := dyn.NewValue(nil, []dyn.Location{{File: "file", Line: 1, Column: 1}})
+	vin := dyn.NewValue(nil, []diag.Location{{File: "file", Line: 1, Column: 1}})
 	_, err := Normalize(&typ, vin)
 	assert.Len(t, err, 1)
 	assert.Equal(t, diag.Diagnostic{
 		Severity:  diag.Warning,
 		Summary:   `expected a int value, found null`,
-		Locations: []dyn.Location{vin.Location()},
-		Paths:     []dyn.Path{dyn.EmptyPath},
+		Locations: []diag.Location{vin.Location()},
+		Paths:     dyn.ToStructPaths(dyn.EmptyPath),
 	}, err[0])
 }
 
@@ -705,8 +710,8 @@ func TestNormalizeIntFromFloatError(t *testing.T) {
 	assert.Equal(t, diag.Diagnostic{
 		Severity:  diag.Warning,
 		Summary:   `cannot accurately represent "1.5" as integer due to precision loss`,
-		Locations: []dyn.Location{vin.Location()},
-		Paths:     []dyn.Path{dyn.EmptyPath},
+		Locations: []diag.Location{vin.Location()},
+		Paths:     dyn.ToStructPaths(dyn.EmptyPath),
 	}, err[0])
 }
 
@@ -734,8 +739,8 @@ func TestNormalizeIntFromStringError(t *testing.T) {
 	assert.Equal(t, diag.Diagnostic{
 		Severity:  diag.Warning,
 		Summary:   `cannot parse "abc" as an integer`,
-		Locations: []dyn.Location{vin.Location()},
-		Paths:     []dyn.Path{dyn.EmptyPath},
+		Locations: []diag.Location{vin.Location()},
+		Paths:     dyn.ToStructPaths(dyn.EmptyPath),
 	}, err[0])
 }
 
@@ -747,8 +752,8 @@ func TestNormalizeIntError(t *testing.T) {
 	assert.Equal(t, diag.Diagnostic{
 		Severity:  diag.Warning,
 		Summary:   `expected int, found map`,
-		Locations: []dyn.Location{{}},
-		Paths:     []dyn.Path{dyn.EmptyPath},
+		Locations: []diag.Location{{}},
+		Paths:     dyn.ToStructPaths(dyn.EmptyPath),
 	}, err[0])
 }
 
@@ -762,14 +767,14 @@ func TestNormalizeFloat(t *testing.T) {
 
 func TestNormalizeFloatNil(t *testing.T) {
 	var typ float64
-	vin := dyn.NewValue(nil, []dyn.Location{{File: "file", Line: 1, Column: 1}})
+	vin := dyn.NewValue(nil, []diag.Location{{File: "file", Line: 1, Column: 1}})
 	_, err := Normalize(&typ, vin)
 	assert.Len(t, err, 1)
 	assert.Equal(t, diag.Diagnostic{
 		Severity:  diag.Warning,
 		Summary:   `expected a float value, found null`,
-		Locations: []dyn.Location{vin.Location()},
-		Paths:     []dyn.Path{dyn.EmptyPath},
+		Locations: []diag.Location{vin.Location()},
+		Paths:     dyn.ToStructPaths(dyn.EmptyPath),
 	}, err[0])
 }
 
@@ -793,8 +798,8 @@ func TestNormalizeFloatFromIntError(t *testing.T) {
 	assert.Equal(t, diag.Diagnostic{
 		Severity:  diag.Warning,
 		Summary:   `cannot accurately represent "9007199254740993" as floating point number due to precision loss`,
-		Locations: []dyn.Location{vin.Location()},
-		Paths:     []dyn.Path{dyn.EmptyPath},
+		Locations: []diag.Location{vin.Location()},
+		Paths:     dyn.ToStructPaths(dyn.EmptyPath),
 	}, err[0])
 }
 
@@ -822,8 +827,8 @@ func TestNormalizeFloatFromStringError(t *testing.T) {
 	assert.Equal(t, diag.Diagnostic{
 		Severity:  diag.Warning,
 		Summary:   `cannot parse "abc" as a floating point number`,
-		Locations: []dyn.Location{vin.Location()},
-		Paths:     []dyn.Path{dyn.EmptyPath},
+		Locations: []diag.Location{vin.Location()},
+		Paths:     dyn.ToStructPaths(dyn.EmptyPath),
 	}, err[0])
 }
 
@@ -835,8 +840,8 @@ func TestNormalizeFloatError(t *testing.T) {
 	assert.Equal(t, diag.Diagnostic{
 		Severity:  diag.Warning,
 		Summary:   `expected float, found map`,
-		Locations: []dyn.Location{{}},
-		Paths:     []dyn.Path{dyn.EmptyPath},
+		Locations: []diag.Location{{}},
+		Paths:     dyn.ToStructPaths(dyn.EmptyPath),
 	}, err[0])
 }
 
@@ -852,7 +857,7 @@ func TestNormalizeAnchors(t *testing.T) {
 	})
 
 	vout, err := Normalize(typ, vin)
-	assert.Len(t, err, 0)
+	assert.Empty(t, err)
 
 	// The field that can be mapped to the struct field is retained.
 	assert.Equal(t, map[string]any{
@@ -860,44 +865,154 @@ func TestNormalizeAnchors(t *testing.T) {
 	}, vout.AsAny())
 }
 
+func TestNormalizeAnchorContainers(t *testing.T) {
+	type Tmp struct {
+		Foo string `json:"foo"`
+	}
+
+	anchor := func() dyn.Value {
+		return dyn.V(map[string]dyn.Value{"name": dyn.V("x")}).MarkAnchor()
+	}
+
+	tcases := []struct {
+		name     string
+		value    dyn.Value
+		wantWarn bool
+	}{
+		{
+			name:     "list of anchors",
+			value:    dyn.V([]dyn.Value{anchor(), anchor()}),
+			wantWarn: false,
+		},
+		{
+			name: "map of anchors",
+			value: dyn.V(map[string]dyn.Value{
+				"a": anchor(),
+				"b": anchor(),
+			}),
+			wantWarn: false,
+		},
+		{
+			name:     "nested list of anchors",
+			value:    dyn.V([]dyn.Value{dyn.V([]dyn.Value{anchor()})}),
+			wantWarn: false,
+		},
+		{
+			name:     "list with a non-anchor element",
+			value:    dyn.V([]dyn.Value{anchor(), dyn.V(map[string]dyn.Value{"name": dyn.V("x")})}),
+			wantWarn: true,
+		},
+		{
+			name:     "empty list",
+			value:    dyn.V([]dyn.Value{}),
+			wantWarn: true,
+		},
+		{
+			name:     "empty map",
+			value:    dyn.V(map[string]dyn.Value{}),
+			wantWarn: true,
+		},
+	}
+
+	for _, tc := range tcases {
+		t.Run(tc.name, func(t *testing.T) {
+			var typ Tmp
+			vin := dyn.V(map[string]dyn.Value{
+				"foo":   dyn.V("bar"),
+				"thing": tc.value,
+			})
+
+			vout, diags := Normalize(typ, vin)
+			if tc.wantWarn {
+				assert.Len(t, diags, 1)
+				assert.Equal(t, "unknown field: thing", diags[0].Summary)
+			} else {
+				assert.Empty(t, diags)
+			}
+
+			// The unknown field is never retained regardless of the warning.
+			assert.Equal(t, map[string]any{
+				"foo": "bar",
+			}, vout.AsAny())
+		})
+	}
+}
+
 func TestNormalizeAnyFromSlice(t *testing.T) {
 	var typ any
-	v1 := dyn.NewValue(1, []dyn.Location{{File: "file", Line: 1, Column: 1}})
-	v2 := dyn.NewValue(2, []dyn.Location{{File: "file", Line: 1, Column: 1}})
-	vin := dyn.NewValue([]dyn.Value{v1, v2}, []dyn.Location{{File: "file", Line: 1, Column: 1}})
+	v1 := dyn.NewValue(1, []diag.Location{{File: "file", Line: 1, Column: 1}})
+	v2 := dyn.NewValue(2, []diag.Location{{File: "file", Line: 1, Column: 1}})
+	vin := dyn.NewValue([]dyn.Value{v1, v2}, []diag.Location{{File: "file", Line: 1, Column: 1}})
 	vout, err := Normalize(&typ, vin)
-	assert.Len(t, err, 0)
-	assert.Equal(t, dyn.NewValue([]dyn.Value{v1, v2}, []dyn.Location{{File: "file", Line: 1, Column: 1}}), vout)
+	assert.Empty(t, err)
+	assert.Equal(t, dyn.NewValue([]dyn.Value{v1, v2}, []diag.Location{{File: "file", Line: 1, Column: 1}}), vout)
 }
 
 func TestNormalizeAnyFromString(t *testing.T) {
 	var typ any
-	vin := dyn.NewValue("string", []dyn.Location{{File: "file", Line: 1, Column: 1}})
+	vin := dyn.NewValue("string", []diag.Location{{File: "file", Line: 1, Column: 1}})
 	vout, err := Normalize(&typ, vin)
-	assert.Len(t, err, 0)
-	assert.Equal(t, dyn.NewValue("string", []dyn.Location{{File: "file", Line: 1, Column: 1}}), vout)
+	assert.Empty(t, err)
+	assert.Equal(t, dyn.NewValue("string", []diag.Location{{File: "file", Line: 1, Column: 1}}), vout)
 }
 
 func TestNormalizeAnyFromBool(t *testing.T) {
 	var typ any
-	vin := dyn.NewValue(false, []dyn.Location{{File: "file", Line: 1, Column: 1}})
+	vin := dyn.NewValue(false, []diag.Location{{File: "file", Line: 1, Column: 1}})
 	vout, err := Normalize(&typ, vin)
-	assert.Len(t, err, 0)
-	assert.Equal(t, dyn.NewValue(false, []dyn.Location{{File: "file", Line: 1, Column: 1}}), vout)
+	assert.Empty(t, err)
+	assert.Equal(t, dyn.NewValue(false, []diag.Location{{File: "file", Line: 1, Column: 1}}), vout)
 }
 
 func TestNormalizeAnyFromInt(t *testing.T) {
 	var typ any
-	vin := dyn.NewValue(10, []dyn.Location{{File: "file", Line: 1, Column: 1}})
+	vin := dyn.NewValue(10, []diag.Location{{File: "file", Line: 1, Column: 1}})
 	vout, err := Normalize(&typ, vin)
-	assert.Len(t, err, 0)
-	assert.Equal(t, dyn.NewValue(10, []dyn.Location{{File: "file", Line: 1, Column: 1}}), vout)
+	assert.Empty(t, err)
+	assert.Equal(t, dyn.NewValue(10, []diag.Location{{File: "file", Line: 1, Column: 1}}), vout)
 }
 
 func TestNormalizeAnyFromTime(t *testing.T) {
 	var typ any
-	vin := dyn.NewValue(dyn.MustTime("2024-08-29"), []dyn.Location{{File: "file", Line: 1, Column: 1}})
+	vin := dyn.NewValue(dyn.MustTime("2024-08-29"), []diag.Location{{File: "file", Line: 1, Column: 1}})
 	vout, err := Normalize(&typ, vin)
 	assert.Empty(t, err)
 	assert.Equal(t, dyn.NewValue("2024-08-29", vin.Locations()), vout)
 }
+
+func TestNormalizeStructDropEmptyStrings(t *testing.T) {
+	type Tmp struct {
+		// Optional: dropped when empty.
+		Opt string `json:"opt,omitempty"`
+		// Required (no omitempty): kept even when empty.
+		Req string `json:"req"`
+	}
+
+	vin := dyn.V(map[string]dyn.Value{
+		"opt": dyn.V(""),
+		"req": dyn.V(""),
+	})
+
+	vout, diags := Normalize(Tmp{}, vin, DropEmptyStrings)
+	assert.Empty(t, diags)
+
+	_, hasOpt := vout.MustMap().Get(dyn.V("opt"))
+	assert.False(t, hasOpt, "empty omitempty string should be dropped")
+	req, hasReq := vout.MustMap().Get(dyn.V("req"))
+	assert.True(t, hasReq, "empty non-omitempty string should be kept")
+	assert.Empty(t, req.MustString())
+}
+
+func TestNormalizeStructDropEmptyStringsKeepsNonEmpty(t *testing.T) {
+	type Tmp struct {
+		Opt string `json:"opt,omitempty"`
+	}
+
+	vin := dyn.V(map[string]dyn.Value{"opt": dyn.V("value")})
+
+	vout, diags := Normalize(Tmp{}, vin, DropEmptyStrings)
+	assert.Empty(t, diags)
+	opt, ok := vout.MustMap().Get(dyn.V("opt"))
+	assert.True(t, ok)
+	assert.Equal(t, "value", opt.MustString())
+}
diff --git a/libs/dyn/convert/struct_info.go b/libs/dyn/convert/struct_info.go
index 7e5b0bc741e..69e8f868ed5 100644
--- a/libs/dyn/convert/struct_info.go
+++ b/libs/dyn/convert/struct_info.go
@@ -28,9 +28,15 @@ type structInfo struct {
 	// Maps JSON-name of the field to Golang struct name
 	GolangNames map[string]string
 
-	// ForceSendFieldsStructKey maps the JSON-name of the field to which ForceSendFields slice it belongs to:
-	// -1 for direct fields, embedded struct index for embedded fields
-	ForceSendFieldsStructKey map[string]int
+	// ForceSendFieldsIndex maps the JSON-name of the field to the index path (for
+	// use with [reflect.Value.FieldByIndex]) of the ForceSendFields slice that
+	// governs it: the one declared by the struct that also declares the field.
+	// The path is static per type, so we resolve it once here rather than walking
+	// the value at conversion time. It can be more than one element deep because a
+	// field's declaring struct may be embedded several levels down (e.g.
+	// PostgresProject -> PostgresProjectConfig -> ProjectSpec). A field whose
+	// declaring struct has no ForceSendFields has no entry.
+	ForceSendFieldsIndex map[string][]int
 }
 
 // structInfoCache caches type information.
@@ -58,10 +64,10 @@ func getStructInfo(typ reflect.Type) structInfo {
 // buildStructInfo populates a new [structInfo] for the given type.
 func buildStructInfo(typ reflect.Type) structInfo {
 	out := structInfo{
-		Fields:                   make(map[string][]int),
-		ForceEmpty:               make(map[string]bool),
-		GolangNames:              make(map[string]string),
-		ForceSendFieldsStructKey: make(map[string]int),
+		Fields:               make(map[string][]int),
+		ForceEmpty:           make(map[string]bool),
+		GolangNames:          make(map[string]string),
+		ForceSendFieldsIndex: make(map[string][]int),
 	}
 
 	// Queue holds the indexes of the structs to visit.
@@ -81,6 +87,15 @@ func buildStructInfo(typ reflect.Type) structInfo {
 			styp = styp.Elem()
 		}
 
+		// Index path to the ForceSendFields declared by this struct, if any. All
+		// fields declared directly by this struct are governed by it. The len==1
+		// check excludes a ForceSendFields promoted from an embedded struct: that
+		// one governs the embedded struct's own fields, which we visit separately.
+		var forceSendFieldsIndex []int
+		if sf, ok := styp.FieldByName("ForceSendFields"); ok && len(sf.Index) == 1 {
+			forceSendFieldsIndex = append(slices.Clone(prefix), sf.Index...)
+		}
+
 		nf := styp.NumField()
 		for j := range nf {
 			sf := styp.Field(j)
@@ -119,13 +134,10 @@ func buildStructInfo(typ reflect.Type) structInfo {
 			}
 			out.GolangNames[name] = sf.Name
 
-			// Determine which ForceSendFields this field belongs to
-			if len(prefix) == 0 {
-				// Direct field on the main struct
-				out.ForceSendFieldsStructKey[name] = -1
-			} else {
-				// Field on embedded struct
-				out.ForceSendFieldsStructKey[name] = prefix[0]
+			// The field is declared directly in this struct, so it is governed by
+			// this struct's ForceSendFields (if it has one).
+			if forceSendFieldsIndex != nil {
+				out.ForceSendFieldsIndex[name] = forceSendFieldsIndex
 			}
 		}
 	}
@@ -142,40 +154,15 @@ type FieldValue struct {
 func (s *structInfo) FieldValues(v reflect.Value) []FieldValue {
 	out := make([]FieldValue, 0, len(s.Fields))
 
-	// Collect ForceSendFields from all levels for field inclusion logic
-	forceSendFieldsMap := getForceSendFieldsValues(v)
-
 	for _, k := range s.FieldNames {
-		index := s.Fields[k]
-		fv := v
-
-		// Locate value in struct (it could be an embedded type).
-		for i, x := range index {
-			if i > 0 {
-				if fv.Kind() == reflect.Pointer && fv.Type().Elem().Kind() == reflect.Struct {
-					if fv.IsNil() {
-						fv = reflect.Value{}
-						break
-					}
-					fv = fv.Elem()
-				}
-			}
-			fv = fv.Field(x)
-		}
+		fv := fieldByIndex(v, s.Fields[k])
 
 		if fv.IsValid() {
 			isForced := true
 
 			// TODO: we should use isEmptyForOmitEmpty instead of IsZero()
 			if fv.IsZero() {
-				goName := s.GolangNames[k]
-				structKey := s.ForceSendFieldsStructKey[k]
-				if fieldValue, exists := forceSendFieldsMap[structKey]; exists {
-					forceSendFields := fieldValue.Interface().([]string)
-					isForced = slices.Contains(forceSendFields, goName)
-				} else {
-					isForced = false
-				}
+				isForced = s.isForceSend(v, k)
 			}
 
 			out = append(out, FieldValue{
@@ -189,45 +176,36 @@ func (s *structInfo) FieldValues(v reflect.Value) []FieldValue {
 	return out
 }
 
-// Type of [dyn.Value].
-var configValueType = reflect.TypeFor[dyn.Value]()
-
-// getForceSendFieldsValues collects ForceSendFields reflect.Values
-// Returns map[structKey]reflect.Value where structKey is -1 for direct fields, embedded index for embedded fields
-func getForceSendFieldsValues(v reflect.Value) map[int]reflect.Value {
-	if !v.IsValid() || v.Type().Kind() != reflect.Struct {
-		return make(map[int]reflect.Value)
+// isForceSend reports whether the field named k is listed in the ForceSendFields
+// that governs it (see structInfo.ForceSendFieldsIndex).
+func (s *structInfo) isForceSend(v reflect.Value, k string) bool {
+	index, ok := s.ForceSendFieldsIndex[k]
+	if !ok {
+		return false
 	}
-
-	result := make(map[int]reflect.Value)
-
-	for i := range v.Type().NumField() {
-		field := v.Type().Field(i)
-		fieldValue := v.Field(i)
-
-		if field.Name == "ForceSendFields" && !field.Anonymous {
-			// Direct ForceSendFields (structKey = -1)
-			result[-1] = fieldValue
-		} else if field.Anonymous {
-			// Embedded struct - check for ForceSendFields inside it
-			if embeddedStruct := deref(fieldValue); embeddedStruct.IsValid() {
-				if forceSendField := embeddedStruct.FieldByName("ForceSendFields"); forceSendField.IsValid() {
-					result[i] = forceSendField
-				}
-			}
-		}
+	fsf := fieldByIndex(v, index)
+	if !fsf.IsValid() {
+		return false
 	}
-
-	return result
+	return slices.Contains(fsf.Interface().([]string), s.GolangNames[k])
 }
 
-// deref dereferences a pointer, returning invalid value if nil
-func deref(v reflect.Value) reflect.Value {
-	if v.Kind() == reflect.Pointer {
-		if v.IsNil() {
-			return reflect.Value{}
+// fieldByIndex resolves the value at the given index path, dereferencing embedded
+// pointer structs on the way. It returns an invalid value if a nil pointer is met.
+func fieldByIndex(v reflect.Value, index []int) reflect.Value {
+	for i, x := range index {
+		if i > 0 {
+			if v.Kind() == reflect.Pointer && v.Type().Elem().Kind() == reflect.Struct {
+				if v.IsNil() {
+					return reflect.Value{}
+				}
+				v = v.Elem()
+			}
 		}
-		return v.Elem()
+		v = v.Field(x)
 	}
 	return v
 }
+
+// Type of [dyn.Value].
+var configValueType = reflect.TypeFor[dyn.Value]()
diff --git a/libs/dyn/convert/to_typed.go b/libs/dyn/convert/to_typed.go
index 6fb63d1f0ba..87b0fe7d8ca 100644
--- a/libs/dyn/convert/to_typed.go
+++ b/libs/dyn/convert/to_typed.go
@@ -75,9 +75,6 @@ func toTypedStruct(dst reflect.Value, src dyn.Value) error {
 
 		info := getStructInfo(dst.Type())
 
-		forceSendFieldLocations := getForceSendFieldsValues(dst)
-		forceSendFieldsMap := make(map[int][]string)
-
 		for _, pair := range src.MustMap().Pairs() {
 			pk := pair.Key
 			pv := pair.Value
@@ -90,20 +87,7 @@ func toTypedStruct(dst reflect.Value, src dyn.Value) error {
 				continue
 			}
 
-			// Create intermediate structs embedded as pointer types.
-			// Code inspired by [reflect.FieldByIndex] implementation.
-			f := dst
-			for i, x := range index {
-				if i > 0 {
-					if f.Kind() == reflect.Pointer {
-						if f.IsNil() {
-							f.Set(reflect.New(f.Type().Elem()))
-						}
-						f = f.Elem()
-					}
-				}
-				f = f.Field(x)
-			}
+			f := getOrNewFieldByIndex(dst, index)
 
 			err := ToTyped(f.Addr().Interface(), pv)
 			if err != nil {
@@ -111,22 +95,14 @@ func toTypedStruct(dst reflect.Value, src dyn.Value) error {
 			}
 
 			if pv.IsZero() {
-				// Use first index as key: -1 for direct fields, struct index for embedded fields
-				var structKey int
-				if len(index) == 1 {
-					structKey = -1 // Direct field
-				} else {
-					structKey = index[0] // Embedded struct index
+				// The field's zero value must still serialize, so append its Go name
+				// to the ForceSendFields of the struct that declares it. That struct
+				// shares a prefix with the field's index path, so it is already
+				// allocated by the walk above.
+				if fsfIndex, ok := info.ForceSendFieldsIndex[jsonKey]; ok {
+					fsf := getOrNewFieldByIndex(dst, fsfIndex)
+					fsf.Set(reflect.Append(fsf, reflect.ValueOf(info.GolangNames[jsonKey])))
 				}
-
-				forceSendFieldsMap[structKey] = append(forceSendFieldsMap[structKey], info.GolangNames[jsonKey])
-			}
-		}
-
-		// Set ForceSendFields using precalculated locations
-		for structKey, fields := range forceSendFieldsMap {
-			if forceSendFieldLocation, exists := forceSendFieldLocations[structKey]; exists {
-				forceSendFieldLocation.Set(reflect.ValueOf(fields))
 			}
 		}
 
@@ -156,6 +132,24 @@ func toTypedStruct(dst reflect.Value, src dyn.Value) error {
 	}
 }
 
+// getOrNewFieldByIndex resolves the value at the given index path within an addressable
+// struct, allocating intermediate structs embedded as pointer types along the way.
+// Code inspired by [reflect.FieldByIndex] implementation.
+func getOrNewFieldByIndex(v reflect.Value, index []int) reflect.Value {
+	for i, x := range index {
+		if i > 0 {
+			if v.Kind() == reflect.Pointer {
+				if v.IsNil() {
+					v.Set(reflect.New(v.Type().Elem()))
+				}
+				v = v.Elem()
+			}
+		}
+		v = v.Field(x)
+	}
+	return v
+}
+
 func toTypedMap(dst reflect.Value, src dyn.Value) error {
 	switch src.Kind() {
 	case dyn.KindMap:
@@ -258,12 +252,12 @@ func toTypedBool(dst reflect.Value, src dyn.Value) error {
 		dst.SetBool(src.MustBool())
 		return nil
 	case dyn.KindString:
-		// See https://github.com/go-yaml/yaml/blob/f6f7691b1fdeb513f56608cd2c32c51f8194bf51/decode.go#L684-L693.
+		// See https://yaml.org/type/bool.html.
 		switch src.MustString() {
-		case "y", "Y", "yes", "Yes", "YES", "on", "On", "ON", "true":
+		case "y", "Y", "yes", "Yes", "YES", "on", "On", "ON", "true", "True", "TRUE":
 			dst.SetBool(true)
 			return nil
-		case "n", "N", "no", "No", "NO", "off", "Off", "OFF", "false":
+		case "n", "N", "no", "No", "NO", "off", "Off", "OFF", "false", "False", "FALSE":
 			dst.SetBool(false)
 			return nil
 		}
diff --git a/libs/dyn/convert/to_typed_test.go b/libs/dyn/convert/to_typed_test.go
index 7b95d17056d..a838dfab33f 100644
--- a/libs/dyn/convert/to_typed_test.go
+++ b/libs/dyn/convert/to_typed_test.go
@@ -414,14 +414,14 @@ func TestToTypedBoolFromString(t *testing.T) {
 	var out bool
 
 	// True-ish
-	for _, v := range []string{"y", "yes", "on", "true"} {
+	for _, v := range []string{"y", "yes", "on", "true", "True", "TRUE"} {
 		err := ToTyped(&out, dyn.V(v))
 		require.NoError(t, err)
 		assert.True(t, out)
 	}
 
 	// False-ish
-	for _, v := range []string{"n", "no", "off", "false"} {
+	for _, v := range []string{"n", "no", "off", "false", "False", "FALSE"} {
 		err := ToTyped(&out, dyn.V(v))
 		require.NoError(t, err)
 		assert.False(t, out)
@@ -754,3 +754,37 @@ func TestToTypedFieldByNameBugRegressionTest(t *testing.T) {
 	assert.Equal(t, "test-job", out.Name)
 	assert.Empty(t, out.Permissions)
 }
+
+func TestToTypedDeeplyEmbeddedStructForceSendFields(t *testing.T) {
+	// Mirrors resources.PostgresProject -> PostgresProjectConfig -> ProjectSpec:
+	// Spec is embedded two levels down and Wrapper shadows ForceSendFields to keep
+	// its own direct field out of Spec's ForceSendFields. A zero-value spec field
+	// must route to Spec.ForceSendFields, not Wrapper's, otherwise the SDK marshaler
+	// fails with "field ... cannot be found in struct".
+	type Spec struct {
+		SpecField       bool     `json:"spec_field,omitempty"`
+		ForceSendFields []string `json:"-"`
+	}
+
+	type Wrapper struct {
+		Spec
+		WrapperField    string   `json:"wrapper_field,omitempty"`
+		ForceSendFields []string `json:"-"`
+	}
+
+	type Outer struct {
+		Wrapper
+	}
+
+	var out Outer
+	m := dyn.Mapping{}
+	m.SetLoc("spec_field", nil, dyn.V(false))
+	m.SetLoc("wrapper_field", nil, dyn.V(""))
+	v := dyn.V(m)
+
+	err := ToTyped(&out, v)
+	require.NoError(t, err)
+
+	assert.Equal(t, []string{"SpecField"}, out.Spec.ForceSendFields)
+	assert.Equal(t, []string{"WrapperField"}, out.ForceSendFields)
+}
diff --git a/libs/dyn/dynloc/locations.go b/libs/dyn/dynloc/locations.go
index 5c8e22f0939..d343e24533c 100644
--- a/libs/dyn/dynloc/locations.go
+++ b/libs/dyn/dynloc/locations.go
@@ -6,6 +6,7 @@ import (
 	"path/filepath"
 	"slices"
 
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
 )
 
@@ -37,8 +38,8 @@ type Locations struct {
 	basePath string
 }
 
-func (l *Locations) gatherLocations(v dyn.Value) (map[string][]dyn.Location, error) {
-	locs := map[string][]dyn.Location{}
+func (l *Locations) gatherLocations(v dyn.Value) (map[string][]diag.Location, error) {
+	locs := map[string][]diag.Location{}
 	patterns := []dyn.Pattern{
 		dyn.NewPattern(dyn.AnyKey()),                                                                          // Top level fields
 		dyn.NewPattern(dyn.Key("resources"), dyn.AnyKey()),                                                    // Resource groups ("resources.jobs")
@@ -74,7 +75,7 @@ func (l *Locations) normalizeFilePath(file string) (string, error) {
 	return filepath.ToSlash(file), nil
 }
 
-func (l *Locations) registerFileNames(locs []dyn.Location) error {
+func (l *Locations) registerFileNames(locs []diag.Location) error {
 	cache := map[string]string{}
 	for _, loc := range locs {
 		// Never process the same file path twice.
diff --git a/libs/dyn/dynvar/ref.go b/libs/dyn/dynvar/ref.go
index a048c80cb8a..de25f44a212 100644
--- a/libs/dyn/dynvar/ref.go
+++ b/libs/dyn/dynvar/ref.go
@@ -3,17 +3,19 @@ package dynvar
 import (
 	"fmt"
 	"regexp"
+	"strings"
 
 	"github.com/databricks/cli/libs/dyn"
 )
 
-var (
-	// !!! Should be in sync with _variable_regex in Python code.
-	// !!!
-	// !!! See python/databricks/bundles/core/_transform.py
-	baseVarDef = `[a-zA-Z]+([-_]*[a-zA-Z0-9]+)*`
-	re         = regexp.MustCompile(fmt.Sprintf(`\$\{(%s(\.%s(\[[0-9]+\])*)*(\[[0-9]+\])*)\}`, baseVarDef, baseVarDef))
-)
+// BaseVarDef matches a single dot-separated path segment in ${...} references.
+// A segment may have leading underscores before the first letter, and may contain
+// letters, digits, hyphens and underscores after that.
+// Keep in sync with _base_var_def in python/databricks/bundles/core/_transform.py.
+// Behavioral parity is enforced by testdata/reference_vectors.json.
+const BaseVarDef = `_*\p{L}+([-_]*[\p{L}\p{N}]+)*`
+
+var re = regexp.MustCompile(fmt.Sprintf(`\$\{(%s(\.%s(\[[0-9]+\])*)*(\[[0-9]+\])*)\}`, BaseVarDef, BaseVarDef))
 
 // Ref represents a variable reference.
 // It is a string [dyn.Value] contained in a larger [dyn.Value].
@@ -27,12 +29,21 @@ type Ref struct {
 
 	// Matches of the variable reference in the string.
 	Matches [][]string
+
+	// Byte offsets [start, end) of each entry in Matches within Str. Interpolation
+	// must substitute by offset: an escaped occurrence of the same reference text
+	// may appear earlier in Str, and a search-based replacement would hit that one.
+	Spans [][2]int
 }
 
 // NewRef returns a new Ref if the given [dyn.Value] contains a string
 // with one or more variable references. It returns false if the given
 // [dyn.Value] does not contain variable references.
 //
+// A reference preceded by "$" is treated as an escaped literal and is not
+// included in the returned Ref. For example, "$${foo}" contains no references
+// because the "${foo}" part is escaped by the leading "$".
+//
 // Examples of a valid variable references:
 //   - "${a.b}"
 //   - "${a.b.c}"
@@ -44,8 +55,30 @@ func NewRef(v dyn.Value) (Ref, bool) {
 		return Ref{}, false
 	}
 
-	// Check if the string contains any variable references.
-	m := re.FindAllStringSubmatch(s, -1)
+	// Find all matches with their byte positions so we can detect escaped references.
+	indices := re.FindAllStringSubmatchIndex(s, -1)
+	if len(indices) == 0 {
+		return Ref{}, false
+	}
+
+	// Convert position-based matches to string matches, filtering out references
+	// escaped with a leading "$" (e.g. "$${foo}" should not match "${foo}").
+	var m [][]string
+	var spans [][2]int
+	for _, idx := range indices {
+		if isEscapedAt(s, idx[0]) {
+			continue
+		}
+		match := make([]string, len(idx)/2)
+		for i := range len(idx) / 2 {
+			if idx[2*i] >= 0 {
+				match[i] = s[idx[2*i]:idx[2*i+1]]
+			}
+		}
+		m = append(m, match)
+		spans = append(spans, [2]int{idx[0], idx[1]})
+	}
+
 	if len(m) == 0 {
 		return Ref{}, false
 	}
@@ -54,9 +87,45 @@ func NewRef(v dyn.Value) (Ref, bool) {
 		Value:   v,
 		Str:     s,
 		Matches: m,
+		Spans:   spans,
 	}, true
 }
 
+// isEscapedAt reports whether the reference starting at byte offset start in s is
+// escaped by an immediately preceding "$".
+func isEscapedAt(s string, start int) bool {
+	return start > 0 && s[start-1] == '$'
+}
+
+// Unescape turns escaped references into literal ones ("$${x}" -> "${x}"). Call it
+// when building a value to send to the API: the extra "$" exists only to hide the
+// reference from bundle variable resolution.
+func Unescape(s string) string {
+	return strings.ReplaceAll(s, "$${", "${")
+}
+
+// ReplaceRef substitutes every unescaped occurrence of reference (a full "${...}"
+// string) in s with value. Escaped occurrences are left as they are, so
+// strings.ReplaceAll is not a valid substitute: it would also rewrite the literal.
+func ReplaceRef(s, reference, value string) string {
+	var sb strings.Builder
+	for pos := 0; ; {
+		i := strings.Index(s[pos:], reference)
+		if i < 0 {
+			sb.WriteString(s[pos:])
+			return sb.String()
+		}
+		start := pos + i
+		sb.WriteString(s[pos:start])
+		if isEscapedAt(s, start) {
+			sb.WriteString(reference)
+		} else {
+			sb.WriteString(value)
+		}
+		pos = start + len(reference)
+	}
+}
+
 // IsPure returns true if the variable reference contains a single
 // variable reference and nothing more. We need this so we can
 // interpolate values of non-string types (i.e. it can be substituted).
@@ -80,8 +149,17 @@ func IsPureVariableReference(s string) bool {
 	return len(s) > 0 && re.FindString(s) == s
 }
 
+// ContainsVariableReference reports whether s contains at least one reference that
+// is not escaped. Callers use it to decide whether a string still needs resolution,
+// so an escaped "$${foo}" must not count: it is a literal, and treating it as
+// pending leaves the value permanently unresolved.
 func ContainsVariableReference(s string) bool {
-	return re.MatchString(s)
+	for _, loc := range re.FindAllStringIndex(s, -1) {
+		if !isEscapedAt(s, loc[0]) {
+			return true
+		}
+	}
+	return false
 }
 
 // If s is a pure variable reference, this function returns the corresponding
diff --git a/libs/dyn/dynvar/ref_test.go b/libs/dyn/dynvar/ref_test.go
index d59d80cba1a..7b93ac633b9 100644
--- a/libs/dyn/dynvar/ref_test.go
+++ b/libs/dyn/dynvar/ref_test.go
@@ -13,74 +13,53 @@ func TestNewRefNoString(t *testing.T) {
 	require.False(t, ok, "should not match non-string")
 }
 
-func TestNewRefValidPattern(t *testing.T) {
-	for in, refs := range map[string][]string{
-		"${hello_world.world_world}":  {"hello_world.world_world"},
-		"${helloworld.world-world}":   {"helloworld.world-world"},
-		"${hello-world.world-world}":  {"hello-world.world-world"},
-		"${hello_world.world__world}": {"hello_world.world__world"},
-		"${hello_world.world--world}": {"hello_world.world--world"},
-		"${hello_world.world-_world}": {"hello_world.world-_world"},
-		"${hello_world.world_-world}": {"hello_world.world_-world"},
-	} {
-		ref, ok := NewRef(dyn.V(in))
-		require.True(t, ok, "should match valid pattern: %s", in)
-		assert.Equal(t, refs, ref.References())
-	}
+func TestNewRefSpans(t *testing.T) {
+	// Spans must point at the unescaped occurrence, not the escaped one that
+	// appears earlier with identical text.
+	ref, ok := NewRef(dyn.V("$${a.b} ${a.b}"))
+	require.True(t, ok)
+	require.Len(t, ref.Matches, 1)
+	require.Len(t, ref.Spans, 1)
+	assert.Equal(t, "${a.b}", ref.Str[ref.Spans[0][0]:ref.Spans[0][1]])
+	assert.Equal(t, 8, ref.Spans[0][0])
 }
 
-func TestNewRefInvalidPattern(t *testing.T) {
-	invalid := []string{
-		"${hello_world-.world_world}",   // the first segment ending must not end with hyphen (-)
-		"${hello_world-_.world_world}",  // the first segment ending must not end with underscore (_)
-		"${helloworld.world-world-}",    // second segment must not end with hyphen (-)
-		"${helloworld-.world-world}",    // first segment must not end with hyphen (-)
-		"${helloworld.-world-world}",    // second segment must not start with hyphen (-)
-		"${-hello-world.-world-world-}", // must not start or end with hyphen (-)
-		"${_-_._-_.id}",                 // cannot use _- in sequence
-		"${0helloworld.world-world}",    // interpolated first section shouldn't start with number
-		"${helloworld.9world-world}",    // interpolated second section shouldn't start with number
+func TestContainsVariableReference(t *testing.T) {
+	tests := map[string]bool{
+		"${a.b}":          true,
+		"x ${a.b} y":      true,
+		"$${a.b}":         false,
+		"$${a.b} $${c.d}": false,
+		"$${a.b} ${c.d}":  true,
+		"no refs":         false,
+		"":                false,
 	}
-	for _, v := range invalid {
-		_, ok := NewRef(dyn.V(v))
-		require.False(t, ok, "should not match invalid pattern: %s", v)
+	for in, want := range tests {
+		assert.Equal(t, want, ContainsVariableReference(in), "input %q", in)
 	}
 }
 
-func TestIsPureVariableReference(t *testing.T) {
-	assert.False(t, IsPureVariableReference(""))
-	assert.False(t, IsPureVariableReference("${foo.bar} suffix"))
-	assert.False(t, IsPureVariableReference("prefix ${foo.bar}"))
-	assert.True(t, IsPureVariableReference("${foo.bar}"))
+func TestUnescape(t *testing.T) {
+	assert.Equal(t, "${a.b}", Unescape("$${a.b}"))
+	assert.Equal(t, "${a} ${b}", Unescape("$${a} $${b}"))
+	assert.Equal(t, "${a.b}", Unescape("${a.b}"), "already unescaped is unchanged")
+	assert.Equal(t, "no refs", Unescape("no refs"))
 }
 
-func TestPureReferenceToPath(t *testing.T) {
-	for _, tc := range []struct {
-		in  string
-		out string
-		ok  bool
+func TestReplaceRef(t *testing.T) {
+	tests := []struct {
+		in   string
+		want string
 	}{
-		{"${foo.bar}", "foo.bar", true},
-		{"${foo.bar.baz}", "foo.bar.baz", true},
-		{"${foo.bar.baz[0]}", "foo.bar.baz[0]", true},
-		{"${foo.bar.baz[0][1]}", "foo.bar.baz[0][1]", true},
-		{"${foo.bar.baz[0][1].qux}", "foo.bar.baz[0][1].qux", true},
-
-		{"${foo.one}${foo.two}", "", false},
-		{"prefix ${foo.bar}", "", false},
-		{"${foo.bar} suffix", "", false},
-		{"${foo.bar", "", false},
-		{"foo.bar}", "", false},
-		{"foo.bar", "", false},
-		{"{foo.bar}", "", false},
-		{"", "", false},
-	} {
-		path, ok := PureReferenceToPath(tc.in)
-		if tc.ok {
-			assert.True(t, ok)
-			assert.Equal(t, dyn.MustPathFromString(tc.out), path)
-		} else {
-			assert.False(t, ok)
-		}
+		{"${a.b}", "V"},
+		{"$${a.b}", "$${a.b}"},
+		{"$${a.b} ${a.b}", "$${a.b} V"},
+		{"${a.b} $${a.b}", "V $${a.b}"},
+		{"${a.b}-${a.b}", "V-V"},
+		{"$${a.b} ${a.b} $${a.b}", "$${a.b} V $${a.b}"},
+		{"untouched ${c.d}", "untouched ${c.d}"},
+	}
+	for _, tt := range tests {
+		assert.Equal(t, tt.want, ReplaceRef(tt.in, "${a.b}", "V"), "input %q", tt.in)
 	}
 }
diff --git a/libs/dyn/dynvar/ref_vectors_test.go b/libs/dyn/dynvar/ref_vectors_test.go
new file mode 100644
index 00000000000..d0084a6ae5c
--- /dev/null
+++ b/libs/dyn/dynvar/ref_vectors_test.go
@@ -0,0 +1,69 @@
+package dynvar
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/databricks/cli/libs/dyn"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type referenceVectorsFile struct {
+	Vectors []referenceVector `json:"vectors"`
+}
+
+type referenceVector struct {
+	ID         string   `json:"id"`
+	Input      string   `json:"input"`
+	Match      bool     `json:"match"`
+	References []string `json:"references,omitempty"`
+	Pure       *bool    `json:"pure,omitempty"`
+	Path       *string  `json:"path,omitempty"`
+	PathOK     *bool    `json:"path_ok,omitempty"`
+}
+
+func loadReferenceVectors(t *testing.T) []referenceVector {
+	t.Helper()
+
+	b, err := os.ReadFile(filepath.Join("testdata", "reference_vectors.json"))
+	require.NoError(t, err)
+
+	var file referenceVectorsFile
+	require.NoError(t, json.Unmarshal(b, &file))
+	require.NotEmpty(t, file.Vectors)
+
+	return file.Vectors
+}
+
+func TestReferenceVectors(t *testing.T) {
+	for _, v := range loadReferenceVectors(t) {
+		t.Run(v.ID, func(t *testing.T) {
+			ref, ok := NewRef(dyn.V(v.Input))
+			assert.Equal(t, v.Match, ok, "NewRef match")
+
+			if v.Match {
+				require.NotEmpty(t, ref.References())
+				if v.References != nil {
+					assert.Equal(t, v.References, ref.References(), "References")
+				}
+			}
+
+			if v.Pure != nil {
+				assert.Equal(t, *v.Pure, IsPureVariableReference(v.Input), "IsPureVariableReference")
+			}
+
+			switch {
+			case v.Path != nil:
+				path, ok := PureReferenceToPath(v.Input)
+				require.True(t, ok, "PureReferenceToPath")
+				assert.Equal(t, dyn.MustPathFromString(*v.Path), path)
+			case v.PathOK != nil:
+				_, ok := PureReferenceToPath(v.Input)
+				assert.Equal(t, *v.PathOK, ok, "PureReferenceToPath")
+			}
+		})
+	}
+}
diff --git a/libs/dyn/dynvar/resolve.go b/libs/dyn/dynvar/resolve.go
index 6f9269f4974..99981a2e51b 100644
--- a/libs/dyn/dynvar/resolve.go
+++ b/libs/dyn/dynvar/resolve.go
@@ -37,6 +37,17 @@ func Resolve(in dyn.Value, fn Lookup) (out dyn.Value, err error) {
 	return resolver{in: in, fn: fn}.run()
 }
 
+// ReferenceError is returned for an unresolved variable reference. Suggestions
+// are carried as data so callers (which can import libs/diag) format them.
+type ReferenceError struct {
+	Reference   string   // original reference text, e.g. "var.hst"
+	Suggestions []string // corrected references, e.g. ["var.host", "var.hosts"]
+}
+
+func (e *ReferenceError) Error() string {
+	return fmt.Sprintf("reference does not exist: ${%s}", e.Reference)
+}
+
 type lookupResult struct {
 	v   dyn.Value
 	err error
@@ -157,9 +168,16 @@ func (r *resolver) resolveRef(ref Ref, seen []string) (dyn.Value, error) {
 	}
 
 	// Not pure; perform string interpolation.
+	//
+	// Substitute by byte offset rather than by searching for the match text: the same
+	// reference may also appear escaped ("$${foo} ${foo}"), and a search would replace
+	// that occurrence instead, corrupting the literal and leaving the real one unresolved.
+	var sb strings.Builder
+	consumed := 0
 	for j := range ref.Matches {
 		// The value is invalid if resolution returned [ErrSkipResolution].
-		// We must skip those and leave the original variable reference in place.
+		// We must skip those and leave the original variable reference in place,
+		// which happens naturally by not advancing past its span.
 		if !resolved[j].IsValid() {
 			continue
 		}
@@ -176,10 +194,14 @@ func (r *resolver) resolveRef(ref Ref, seen []string) (dyn.Value, error) {
 			}
 		}
 
-		ref.Str = strings.Replace(ref.Str, ref.Matches[j][0], s, 1)
+		start, end := ref.Spans[j][0], ref.Spans[j][1]
+		sb.WriteString(ref.Str[consumed:start])
+		sb.WriteString(s)
+		consumed = end
 	}
+	sb.WriteString(ref.Str[consumed:])
 
-	return dyn.NewValue(ref.Str, ref.Value.Locations()), nil
+	return dyn.NewValue(sb.String(), ref.Value.Locations()), nil
 }
 
 func (r *resolver) resolveKey(key string, seen []string) (dyn.Value, error) {
@@ -198,7 +220,8 @@ func (r *resolver) resolveKey(key string, seen []string) (dyn.Value, error) {
 	v, err := r.fn(p)
 	if err != nil {
 		if dyn.IsNoSuchKeyError(err) {
-			err = fmt.Errorf("reference does not exist: ${%s}", key)
+			// Carry suggestions as data; the caller formats them via libs/diag.
+			err = &ReferenceError{Reference: key, Suggestions: dyn.SuggestedReferences(err, key)}
 		}
 
 		// Cache the return value and return to the caller.
diff --git a/libs/dyn/dynvar/resolve_test.go b/libs/dyn/dynvar/resolve_test.go
index 62ef7cb14e3..c4b28e88d3f 100644
--- a/libs/dyn/dynvar/resolve_test.go
+++ b/libs/dyn/dynvar/resolve_test.go
@@ -39,6 +39,20 @@ func TestResolveNotFound(t *testing.T) {
 	require.ErrorContains(t, err, `reference does not exist: ${a}`)
 }
 
+func TestResolveNotFoundSuggestsCloseKey(t *testing.T) {
+	in := dyn.V(map[string]dyn.Value{
+		"host": dyn.V("example.com"),
+		"b":    dyn.V("${hst}"),
+	})
+
+	_, err := dynvar.Resolve(in, dynvar.DefaultLookup(in))
+	require.ErrorContains(t, err, "reference does not exist: ${hst}")
+
+	var refErr *dynvar.ReferenceError
+	require.ErrorAs(t, err, &refErr)
+	assert.Equal(t, []string{"host"}, refErr.Suggestions)
+}
+
 func TestResolveWithNesting(t *testing.T) {
 	in := dyn.V(map[string]dyn.Value{
 		"a": dyn.V("${f.a}"),
@@ -107,6 +121,27 @@ func TestResolveWithStringConcatenation(t *testing.T) {
 	assert.Equal(t, "aba", getByPath(t, out, "c").MustString())
 }
 
+func TestResolveWithEscapedReference(t *testing.T) {
+	in := dyn.V(map[string]dyn.Value{
+		"a":             dyn.V("A"),
+		"escaped_only":  dyn.V("$${a}"),
+		"escaped_first": dyn.V("$${a} ${a}"),
+		"real_first":    dyn.V("${a} $${a}"),
+		"surrounded":    dyn.V("$${a} ${a} $${a}"),
+		"other_name":    dyn.V("$${zz} ${a}"),
+	})
+
+	out, err := dynvar.Resolve(in, dynvar.DefaultLookup(in))
+	require.NoError(t, err)
+
+	// The escape is preserved here; it is removed when the API payload is built.
+	assert.Equal(t, "$${a}", getByPath(t, out, "escaped_only").MustString())
+	assert.Equal(t, "$${a} A", getByPath(t, out, "escaped_first").MustString())
+	assert.Equal(t, "A $${a}", getByPath(t, out, "real_first").MustString())
+	assert.Equal(t, "$${a} A $${a}", getByPath(t, out, "surrounded").MustString())
+	assert.Equal(t, "$${zz} A", getByPath(t, out, "other_name").MustString())
+}
+
 func TestResolveWithTypeInterpolation(t *testing.T) {
 	in := dyn.V(map[string]dyn.Value{
 		"a":          dyn.V(1),
@@ -129,14 +164,14 @@ func TestResolveWithTypeInterpolation(t *testing.T) {
 	require.NoError(t, err)
 
 	// Integer interpolation
-	assert.EqualValues(t, "1 2", getByPath(t, out, "c").MustString())
+	assert.Equal(t, "1 2", getByPath(t, out, "c").MustString())
 
 	// Float interpolation
-	assert.EqualValues(t, "Value: 3.14", getByPath(t, out, "float_interp").MustString())
+	assert.Equal(t, "Value: 3.14", getByPath(t, out, "float_interp").MustString())
 
 	// Bool interpolation
-	assert.EqualValues(t, "Enabled: true", getByPath(t, out, "bool_true_interp").MustString())
-	assert.EqualValues(t, "Disabled: false", getByPath(t, out, "bool_false_interp").MustString())
+	assert.Equal(t, "Enabled: true", getByPath(t, out, "bool_true_interp").MustString())
+	assert.Equal(t, "Disabled: false", getByPath(t, out, "bool_false_interp").MustString())
 
 	// Time interpolation should convert to string representation of time.Time
 	// Note: time.Time string representation includes timezone info
@@ -145,7 +180,7 @@ func TestResolveWithTypeInterpolation(t *testing.T) {
 	assert.Contains(t, timeResult, "00:00:00")
 
 	// Nil interpolation
-	assert.EqualValues(t, "Null: <nil>", getByPath(t, out, "nil_interp").MustString())
+	assert.Equal(t, "Null: <nil>", getByPath(t, out, "nil_interp").MustString())
 }
 
 func TestResolveWithTypeRetentionFailure(t *testing.T) {
@@ -188,8 +223,8 @@ func TestResolveWithTypeRetention(t *testing.T) {
 	assert.Zero(t, 1.0-getByPath(t, out, "float").MustFloat())
 	assert.Zero(t, 1.0-getByPath(t, out, "float_var").MustFloat())
 
-	assert.EqualValues(t, "a", getByPath(t, out, "string").MustString())
-	assert.EqualValues(t, "a", getByPath(t, out, "string_var").MustString())
+	assert.Equal(t, "a", getByPath(t, out, "string").MustString())
+	assert.Equal(t, "a", getByPath(t, out, "string_var").MustString())
 }
 
 func TestResolveWithSkip(t *testing.T) {
diff --git a/libs/dyn/dynvar/testdata/reference_vectors.json b/libs/dyn/dynvar/testdata/reference_vectors.json
new file mode 100644
index 00000000000..2c47b135450
--- /dev/null
+++ b/libs/dyn/dynvar/testdata/reference_vectors.json
@@ -0,0 +1,368 @@
+{
+  "comment": "Shared contract for ${...} reference parsing. Consumed by libs/dyn/dynvar and python/databricks/bundles/core/_transform.py tests.",
+  "vectors": [
+    {
+      "id": "ascii-simple",
+      "input": "${hello_world.world_world}",
+      "match": true,
+      "references": ["hello_world.world_world"],
+      "pure": true,
+      "path": "hello_world.world_world"
+    },
+    {
+      "id": "ascii-hyphen-separators",
+      "input": "${helloworld.world-world}",
+      "match": true,
+      "references": ["helloworld.world-world"],
+      "pure": true,
+      "path": "helloworld.world-world"
+    },
+    {
+      "id": "ascii-hyphen-in-segment",
+      "input": "${hello-world.world-world}",
+      "match": true,
+      "references": ["hello-world.world-world"],
+      "pure": true,
+      "path": "hello-world.world-world"
+    },
+    {
+      "id": "ascii-underscore-separators",
+      "input": "${hello_world.world__world}",
+      "match": true,
+      "references": ["hello_world.world__world"],
+      "pure": true,
+      "path": "hello_world.world__world"
+    },
+    {
+      "id": "ascii-double-hyphen",
+      "input": "${hello_world.world--world}",
+      "match": true,
+      "references": ["hello_world.world--world"],
+      "pure": true,
+      "path": "hello_world.world--world"
+    },
+    {
+      "id": "ascii-mixed-separators-1",
+      "input": "${hello_world.world-_world}",
+      "match": true,
+      "references": ["hello_world.world-_world"],
+      "pure": true,
+      "path": "hello_world.world-_world"
+    },
+    {
+      "id": "ascii-mixed-separators-2",
+      "input": "${hello_world.world_-world}",
+      "match": true,
+      "references": ["hello_world.world_-world"],
+      "pure": true,
+      "path": "hello_world.world_-world"
+    },
+    {
+      "id": "unicode-accent-segment",
+      "input": "${café.bar}",
+      "match": true,
+      "references": ["café.bar"],
+      "pure": true,
+      "path": "café.bar"
+    },
+    {
+      "id": "unicode-accent-trailing-segment",
+      "input": "${hello.café}",
+      "match": true,
+      "references": ["hello.café"],
+      "pure": true,
+      "path": "hello.café"
+    },
+    {
+      "id": "unicode-cjk",
+      "input": "${变量.世界}",
+      "match": true,
+      "references": ["变量.世界"],
+      "pure": true,
+      "path": "变量.世界"
+    },
+    {
+      "id": "unicode-cjk-numeral-letter",
+      "input": "${变量.九世界}",
+      "match": true,
+      "references": ["变量.九世界"],
+      "pure": true,
+      "path": "变量.九世界"
+    },
+    {
+      "id": "unicode-arabic",
+      "input": "${العربية.key}",
+      "match": true,
+      "references": ["العربية.key"],
+      "pure": true,
+      "path": "العربية.key"
+    },
+    {
+      "id": "unicode-multi-ref",
+      "input": "${变量.世界} ${café.bar}",
+      "match": true,
+      "references": ["变量.世界", "café.bar"],
+      "pure": false
+    },
+    {
+      "id": "unicode-var-reference",
+      "input": "${var.变量}",
+      "match": true,
+      "references": ["var.变量"],
+      "pure": true,
+      "path": "var.变量"
+    },
+    {
+      "id": "unicode-resource-reference",
+      "input": "${resources.jobs.工作.name}",
+      "match": true,
+      "references": ["resources.jobs.工作.name"],
+      "pure": true,
+      "path": "resources.jobs.工作.name"
+    },
+    {
+      "id": "indexed-path",
+      "input": "${foo.bar.baz[0]}",
+      "match": true,
+      "references": ["foo.bar.baz[0]"],
+      "pure": true,
+      "path": "foo.bar.baz[0]"
+    },
+    {
+      "id": "nested-indexed-path",
+      "input": "${foo.bar.baz[0][1].qux}",
+      "match": true,
+      "references": ["foo.bar.baz[0][1].qux"],
+      "pure": true,
+      "path": "foo.bar.baz[0][1].qux"
+    },
+    {
+      "id": "indexed-unicode-path",
+      "input": "${变量.世界[0]}",
+      "match": true,
+      "references": ["变量.世界[0]"],
+      "pure": true,
+      "path": "变量.世界[0]"
+    },
+    {
+      "id": "python-simple-variable",
+      "input": "${var.my_var}",
+      "match": true,
+      "references": ["var.my_var"],
+      "pure": true,
+      "path": "var.my_var"
+    },
+    {
+      "id": "python-indexed-variable",
+      "input": "${var.my_var[0].foo}",
+      "match": true,
+      "references": ["var.my_var[0].foo"],
+      "pure": true,
+      "path": "var.my_var[0].foo"
+    },
+    {
+      "id": "leading-underscore",
+      "input": "${_hello_world.world_world}",
+      "match": true,
+      "references": ["_hello_world.world_world"],
+      "pure": true,
+      "path": "_hello_world.world_world"
+    },
+    {
+      "id": "resource-key-leading-underscore",
+      "input": "${resources.jobs._job.id}",
+      "match": true,
+      "references": ["resources.jobs._job.id"],
+      "pure": true,
+      "path": "resources.jobs._job.id"
+    },
+    {
+      "id": "resource-key-leading-underscore-and-hyphens",
+      "input": "${resources.jobs._asset-bundle-deploymentjob.id}",
+      "match": true,
+      "references": ["resources.jobs._asset-bundle-deploymentjob.id"],
+      "pure": true,
+      "path": "resources.jobs._asset-bundle-deploymentjob.id"
+    },
+    {
+      "id": "segment-trailing-hyphen",
+      "input": "${hello_world-.world_world}",
+      "match": false
+    },
+    {
+      "id": "segment-trailing-underscore",
+      "input": "${hello_world-_.world_world}",
+      "match": false
+    },
+    {
+      "id": "second-segment-trailing-hyphen",
+      "input": "${helloworld.world-world-}",
+      "match": false
+    },
+    {
+      "id": "first-segment-trailing-hyphen",
+      "input": "${helloworld-.world-world}",
+      "match": false
+    },
+    {
+      "id": "second-segment-leading-hyphen",
+      "input": "${helloworld.-world-world}",
+      "match": false
+    },
+    {
+      "id": "leading-and-trailing-hyphen",
+      "input": "${-hello-world.-world-world-}",
+      "match": false
+    },
+    {
+      "id": "invalid-separator-sequence",
+      "input": "${_-_._-_.id}",
+      "match": false
+    },
+    {
+      "id": "leading-digit-ascii",
+      "input": "${0helloworld.world-world}",
+      "match": false
+    },
+    {
+      "id": "leading-digit-second-segment",
+      "input": "${helloworld.9world-world}",
+      "match": false
+    },
+    {
+      "id": "leading-digit-unicode",
+      "input": "${0café.bar}",
+      "match": false
+    },
+    {
+      "id": "leading-digit-cjk",
+      "input": "${变量.9世界}",
+      "match": false
+    },
+    {
+      "id": "leading-hyphen-cjk",
+      "input": "${变量.-世界}",
+      "match": false
+    },
+    {
+      "id": "trailing-hyphen-accent",
+      "input": "${café-}",
+      "match": false
+    },
+    {
+      "id": "nfd-decomposed-accent",
+      "comment": "NFD e + combining acute; not equivalent to NFC café",
+      "input": "${cafe\u0301.bar}",
+      "match": false
+    },
+    {
+      "id": "emoji-in-segment",
+      "input": "${foo.🌍}",
+      "match": false
+    },
+    {
+      "id": "emoji-leading-segment",
+      "input": "${🌍.bar}",
+      "match": false
+    },
+    {
+      "id": "symbol-in-segment",
+      "input": "${foo.bar$}",
+      "match": false
+    },
+    {
+      "id": "zero-width-space",
+      "input": "${foo.bar\u200b}",
+      "match": false
+    },
+    {
+      "id": "fullwidth-digit",
+      "input": "${变量.９世界}",
+      "match": false
+    },
+    {
+      "id": "empty-string",
+      "input": "",
+      "match": false,
+      "pure": false
+    },
+    {
+      "id": "suffix-after-reference",
+      "input": "${foo.bar} suffix",
+      "match": true,
+      "references": ["foo.bar"],
+      "pure": false,
+      "path_ok": false
+    },
+    {
+      "id": "prefix-before-reference",
+      "input": "prefix ${foo.bar}",
+      "match": true,
+      "references": ["foo.bar"],
+      "pure": false,
+      "path_ok": false
+    },
+    {
+      "id": "adjacent-references",
+      "input": "${foo.one}${foo.two}",
+      "match": true,
+      "references": ["foo.one", "foo.two"],
+      "pure": false,
+      "path_ok": false
+    },
+    {
+      "id": "multiple-variables-not-pure",
+      "input": "${var.my_var} ${var.my_var}",
+      "match": true,
+      "references": ["var.my_var", "var.my_var"],
+      "pure": false,
+      "path_ok": false
+    },
+    {
+      "id": "unclosed-reference",
+      "input": "${foo.bar",
+      "match": false
+    },
+    {
+      "id": "stray-closing-brace",
+      "input": "foo.bar}",
+      "match": false
+    },
+    {
+      "id": "bare-path",
+      "input": "foo.bar",
+      "match": false
+    },
+    {
+      "id": "wrong-braces",
+      "input": "{foo.bar}",
+      "match": false
+    },
+    {
+      "id": "escaped-double-dollar",
+      "input": "$${foo.bar}",
+      "match": false
+    },
+    {
+      "id": "escaped-only-multiple",
+      "input": "$${a.b} $${c.d}",
+      "match": false
+    },
+    {
+      "id": "escaped-mixed-with-real",
+      "input": "${real.ref} $${escaped.ref}",
+      "match": true,
+      "references": ["real.ref"],
+      "pure": false,
+      "path_ok": false
+    },
+    {
+      "id": "escaped-prefix-real-suffix",
+      "input": "$${escaped} text ${real.ref}",
+      "match": true,
+      "references": ["real.ref"],
+      "pure": false,
+      "path_ok": false
+    }
+  ]
+}
diff --git a/libs/dyn/jsonloader/json.go b/libs/dyn/jsonloader/json.go
index 9fcd4e4f2f3..ffb715e9c9c 100644
--- a/libs/dyn/jsonloader/json.go
+++ b/libs/dyn/jsonloader/json.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"io"
 
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
 )
 
@@ -17,16 +18,19 @@ func LoadJSON(data []byte, source string) (dyn.Value, error) {
 	reader := bytes.NewReader(data)
 	decoder := json.NewDecoder(reader)
 
+	// Use json.Number to avoid losing precision on int64 values above 2^53 (e.g. job and run IDs).
+	decoder.UseNumber()
+
 	// Start decoding from the top-level value
 	value, err := decodeValue(decoder, &offset)
 	if err != nil {
-		if err == io.EOF {
+		if errors.Is(err, io.EOF) {
 			err = errors.New("unexpected end of JSON input")
 		}
 		// Get the current offset for error reporting
 		errorOffset := decoder.InputOffset()
 		errorLocation := offset.GetPosition(errorOffset)
-		return dyn.InvalidValue, fmt.Errorf("error decoding JSON at %s: %v", errorLocation, err)
+		return dyn.InvalidValue, fmt.Errorf("error decoding JSON at %s: %w", errorLocation, err)
 	}
 
 	// Check if there are any remaining tokens (should not be valid JSON)
@@ -75,7 +79,7 @@ func decodeValue(decoder *json.Decoder, o *Offset) (dyn.Value, error) {
 
 				// Get the offset of the key by subtracting the length of the key and the '"' character
 				keyOffset := decoder.InputOffset() - int64(len(key)+1)
-				loc := []dyn.Location{o.GetPosition(keyOffset)}
+				loc := []diag.Location{o.GetPosition(keyOffset)}
 
 				// Decode the value recursively
 				val, err := decodeValue(decoder, o)
@@ -89,7 +93,7 @@ func decodeValue(decoder *json.Decoder, o *Offset) (dyn.Value, error) {
 			if _, err := decoder.Token(); err != nil {
 				return invalidValueWithLocation(decoder, o), err
 			}
-			return dyn.NewValue(obj, []dyn.Location{location}), nil
+			return dyn.NewValue(obj, []diag.Location{location}), nil
 		case '[':
 			location = o.GetPosition(offset - 1)
 			// Decode JSON array
@@ -105,10 +109,20 @@ func decodeValue(decoder *json.Decoder, o *Offset) (dyn.Value, error) {
 			if _, err := decoder.Token(); err != nil {
 				return invalidValueWithLocation(decoder, o), err
 			}
-			return dyn.NewValue(arr, []dyn.Location{location}), nil
+			return dyn.NewValue(arr, []diag.Location{location}), nil
+		}
+	case json.Number:
+		// Integers that overflow int64 fall back to float64, matching the decoder's behavior without UseNumber.
+		if i64, err := tok.Int64(); err == nil {
+			return dyn.NewValue(i64, []diag.Location{location}), nil
+		}
+		f64, err := tok.Float64()
+		if err != nil {
+			return invalidValueWithLocation(decoder, o), fmt.Errorf("invalid number %q: %w", tok.String(), err)
 		}
+		return dyn.NewValue(f64, []diag.Location{location}), nil
 	default:
-		return dyn.NewValue(tok, []dyn.Location{location}), nil
+		return dyn.NewValue(tok, []diag.Location{location}), nil
 	}
 
 	return invalidValueWithLocation(decoder, o), fmt.Errorf("unexpected token: %v", token)
@@ -116,5 +130,5 @@ func decodeValue(decoder *json.Decoder, o *Offset) (dyn.Value, error) {
 
 func invalidValueWithLocation(decoder *json.Decoder, o *Offset) dyn.Value {
 	location := o.GetPosition(decoder.InputOffset())
-	return dyn.InvalidValue.WithLocations([]dyn.Location{location})
+	return dyn.InvalidValue.WithLocations([]diag.Location{location})
 }
diff --git a/libs/dyn/jsonloader/json_test.go b/libs/dyn/jsonloader/json_test.go
index 995855a111d..e274de559ce 100644
--- a/libs/dyn/jsonloader/json_test.go
+++ b/libs/dyn/jsonloader/json_test.go
@@ -6,6 +6,7 @@ import (
 	"github.com/databricks/cli/libs/dyn/convert"
 	"github.com/databricks/databricks-sdk-go/service/jobs"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 const jsonData = `
@@ -78,7 +79,7 @@ const malformedArray = `
 
 func TestJsonLoaderMalformedArray(t *testing.T) {
 	_, err := LoadJSON([]byte(malformedArray), "path/to/file.json")
-	assert.ErrorContains(t, err, "error decoding JSON at path/to/file.json:6:28: invalid character ']' looking for beginning of value")
+	assert.ErrorContains(t, err, "error decoding JSON at path/to/file.json:6:27: invalid character ',' looking for beginning of value")
 }
 
 const eofData = `
@@ -111,3 +112,50 @@ func TestJsonValidInline(t *testing.T) {
 	_, err := LoadJSON([]byte(validInline), "path/to/file.json")
 	assert.NoError(t, err)
 }
+
+func TestJsonLoaderNumbers(t *testing.T) {
+	for _, tc := range []struct {
+		input    string
+		expected any
+	}{
+		{`123`, int64(123)},
+		{`-1`, int64(-1)},
+		{`123456789012345678`, int64(123456789012345678)},
+		{`-123456789012345678`, int64(-123456789012345678)},
+		{`9223372036854775807`, int64(9223372036854775807)},
+		{`2.0`, 2.0},
+		{`2.5`, 2.5},
+		{`1e3`, 1000.0},
+		{`18446744073709551615`, 1.8446744073709552e+19},
+	} {
+		v, err := LoadJSON([]byte(tc.input), "(inline)")
+		assert.NoError(t, err, tc.input)
+		assert.Equal(t, tc.expected, v.AsAny(), tc.input)
+	}
+}
+
+func TestJsonLoaderNumberOutOfRange(t *testing.T) {
+	_, err := LoadJSON([]byte(`1e400`), "(inline)")
+	assert.ErrorContains(t, err, "value out of range")
+}
+
+const mixedNumbersData = `
+{
+    "job_id": 123456789012345678,
+    "new_settings": {
+        "name": "xxx",
+        "timeout_seconds": 100
+    }
+}
+`
+
+func TestJsonLoaderMixedNumbersToTyped(t *testing.T) {
+	v, err := LoadJSON([]byte(mixedNumbersData), "(inline)")
+	require.NoError(t, err)
+
+	var r jobs.ResetJob
+	err = convert.ToTyped(&r, v)
+	require.NoError(t, err)
+	assert.Equal(t, int64(123456789012345678), r.JobId)
+	assert.Equal(t, 100, r.NewSettings.TimeoutSeconds)
+}
diff --git a/libs/dyn/jsonloader/locations.go b/libs/dyn/jsonloader/locations.go
index d69c3c5c861..3dbe2da6630 100644
--- a/libs/dyn/jsonloader/locations.go
+++ b/libs/dyn/jsonloader/locations.go
@@ -3,7 +3,7 @@ package jsonloader
 import (
 	"sort"
 
-	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/diag"
 )
 
 type LineOffset struct {
@@ -30,14 +30,14 @@ func BuildLineOffsets(data []byte) Offset {
 }
 
 // GetPosition maps a byte offset to its corresponding line and column numbers.
-func (o Offset) GetPosition(offset int64) dyn.Location {
+func (o Offset) GetPosition(offset int64) diag.Location {
 	// Binary search to find the line
 	idx := max(sort.Search(len(o.offsets), func(i int) bool {
 		return o.offsets[i].Start > offset
 	})-1, 0)
 
 	lineOffset := o.offsets[idx]
-	return dyn.Location{
+	return diag.Location{
 		File:   o.source,
 		Line:   lineOffset.Line,
 		Column: int(offset-lineOffset.Start) + 1,
diff --git a/libs/dyn/jsonsaver/encoder.go b/libs/dyn/jsonsaver/encoder.go
deleted file mode 100644
index 66997e96de8..00000000000
--- a/libs/dyn/jsonsaver/encoder.go
+++ /dev/null
@@ -1,39 +0,0 @@
-package jsonsaver
-
-import (
-	"bytes"
-	"encoding/json"
-)
-
-// The encoder type encapsulates a [json.Encoder] and its target buffer.
-// Escaping of HTML characters in the output is disabled.
-type encoder struct {
-	*json.Encoder
-	*bytes.Buffer
-}
-
-func newEncoder() encoder {
-	var buf bytes.Buffer
-	enc := json.NewEncoder(&buf)
-
-	// By default, json.Encoder escapes HTML characters, converting symbols like '<' to '\u003c'.
-	// This behavior helps prevent XSS attacks when JSON is embedded within HTML.
-	// However, we disable this feature since we're not dealing with HTML context.
-	// Keeping the escapes enabled would result in unnecessary differences when processing JSON payloads
-	// that already contain escaped characters.
-	enc.SetEscapeHTML(false)
-	return encoder{enc, &buf}
-}
-
-func marshalNoEscape(v any) ([]byte, error) {
-	enc := newEncoder()
-	err := enc.Encode(v)
-	return enc.Bytes(), err
-}
-
-func marshalIndentNoEscape(v any, prefix, indent string) ([]byte, error) {
-	enc := newEncoder()
-	enc.SetIndent(prefix, indent)
-	err := enc.Encode(v)
-	return enc.Bytes(), err
-}
diff --git a/libs/dyn/jsonsaver/encoder_test.go b/libs/dyn/jsonsaver/encoder_test.go
deleted file mode 100644
index da125493f99..00000000000
--- a/libs/dyn/jsonsaver/encoder_test.go
+++ /dev/null
@@ -1,41 +0,0 @@
-package jsonsaver
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestEncoder_MarshalNoEscape(t *testing.T) {
-	out, err := marshalNoEscape("1 < 2")
-	if !assert.NoError(t, err) {
-		return
-	}
-
-	// Confirm the output.
-	assert.JSONEq(t, `"1 < 2"`, string(out))
-
-	// Confirm that HTML escaping is disabled.
-	assert.NotContains(t, string(out), "\\u003c")
-
-	// Confirm that the encoder writes a trailing newline.
-	assert.Contains(t, string(out), "\n")
-}
-
-func TestEncoder_MarshalIndentNoEscape(t *testing.T) {
-	out, err := marshalIndentNoEscape([]string{"1 < 2", "2 < 3"}, "", "  ")
-	if !assert.NoError(t, err) {
-		return
-	}
-
-	// Confirm the output.
-	assert.JSONEq(t, `["1 < 2", "2 < 3"]`, string(out))
-
-	// Confirm that HTML escaping is disabled.
-	assert.NotContains(t, string(out), "\\u003c")
-
-	// Confirm that the encoder performs indenting and writes a trailing newline.
-	assert.Contains(t, string(out), "[\n")
-	assert.Contains(t, string(out), "  \"1 < 2\",\n")
-	assert.Contains(t, string(out), "]\n")
-}
diff --git a/libs/dyn/jsonsaver/marshal.go b/libs/dyn/jsonsaver/marshal.go
deleted file mode 100644
index a78a68f2998..00000000000
--- a/libs/dyn/jsonsaver/marshal.go
+++ /dev/null
@@ -1,89 +0,0 @@
-package jsonsaver
-
-import (
-	"bytes"
-	"fmt"
-
-	"github.com/databricks/cli/libs/dyn"
-)
-
-// Marshal is a version of [json.Marshal] for [dyn.Value].
-//
-// Objects in the output retain the order of keys as they appear in the underlying [dyn.Value].
-// The output does not escape HTML characters in strings.
-func Marshal(v dyn.Value) ([]byte, error) {
-	return marshalNoEscape(wrap{v})
-}
-
-// MarshalIndent is a version of [json.MarshalIndent] for [dyn.Value].
-//
-// Objects in the output retain the order of keys as they appear in the underlying [dyn.Value].
-// The output does not escape HTML characters in strings.
-func MarshalIndent(v dyn.Value, prefix, indent string) ([]byte, error) {
-	return marshalIndentNoEscape(wrap{v}, prefix, indent)
-}
-
-// Wrapper type for [dyn.Value] to expose the [json.Marshaler] interface.
-type wrap struct {
-	v dyn.Value
-}
-
-// MarshalJSON implements the [json.Marshaler] interface for the [dyn.Value] wrapper type.
-func (w wrap) MarshalJSON() ([]byte, error) {
-	var buf bytes.Buffer
-	if err := marshalValue(&buf, w.v); err != nil {
-		return nil, err
-	}
-	return buf.Bytes(), nil
-}
-
-// marshalValue recursively writes JSON for a [dyn.Value] to the buffer.
-func marshalValue(buf *bytes.Buffer, v dyn.Value) error {
-	switch v.Kind() {
-	case dyn.KindString, dyn.KindBool, dyn.KindInt, dyn.KindFloat, dyn.KindTime, dyn.KindNil:
-		out, err := marshalNoEscape(v.AsAny())
-		if err != nil {
-			return err
-		}
-
-		// The encoder writes a trailing newline, so we need to remove it
-		// to avoid adding extra newlines when embedding this JSON.
-		out = out[:len(out)-1]
-		buf.Write(out)
-	case dyn.KindMap:
-		buf.WriteByte('{')
-		for i, pair := range v.MustMap().Pairs() {
-			if i > 0 {
-				buf.WriteByte(',')
-			}
-			// Require keys to be strings.
-			if pair.Key.Kind() != dyn.KindString {
-				return fmt.Errorf("map key must be a string, got %s", pair.Key.Kind())
-			}
-			// Marshal the key
-			if err := marshalValue(buf, pair.Key); err != nil {
-				return err
-			}
-			buf.WriteByte(':')
-			// Marshal the value
-			if err := marshalValue(buf, pair.Value); err != nil {
-				return err
-			}
-		}
-		buf.WriteByte('}')
-	case dyn.KindSequence:
-		buf.WriteByte('[')
-		for i, item := range v.MustSequence() {
-			if i > 0 {
-				buf.WriteByte(',')
-			}
-			if err := marshalValue(buf, item); err != nil {
-				return err
-			}
-		}
-		buf.WriteByte(']')
-	default:
-		return fmt.Errorf("unsupported kind: %d", v.Kind())
-	}
-	return nil
-}
diff --git a/libs/dyn/jsonsaver/marshal_test.go b/libs/dyn/jsonsaver/marshal_test.go
deleted file mode 100644
index 68c2017397f..00000000000
--- a/libs/dyn/jsonsaver/marshal_test.go
+++ /dev/null
@@ -1,100 +0,0 @@
-package jsonsaver
-
-import (
-	"testing"
-
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestMarshal_String(t *testing.T) {
-	b, err := Marshal(dyn.V("string"))
-	if assert.NoError(t, err) {
-		assert.JSONEq(t, `"string"`, string(b))
-	}
-}
-
-func TestMarshal_Bool(t *testing.T) {
-	b, err := Marshal(dyn.V(true))
-	if assert.NoError(t, err) {
-		assert.JSONEq(t, `true`, string(b))
-	}
-}
-
-func TestMarshal_Int(t *testing.T) {
-	b, err := Marshal(dyn.V(42))
-	if assert.NoError(t, err) {
-		assert.JSONEq(t, `42`, string(b))
-	}
-}
-
-func TestMarshal_Float(t *testing.T) {
-	b, err := Marshal(dyn.V(42.1))
-	if assert.NoError(t, err) {
-		assert.JSONEq(t, `42.1`, string(b))
-	}
-}
-
-func TestMarshal_Time(t *testing.T) {
-	b, err := Marshal(dyn.V(dyn.MustTime("2021-01-01T00:00:00Z")))
-	if assert.NoError(t, err) {
-		assert.JSONEq(t, `"2021-01-01T00:00:00Z"`, string(b))
-	}
-}
-
-func TestMarshal_Map(t *testing.T) {
-	m := dyn.NewMapping()
-	m.SetLoc("key1", nil, dyn.V("value1"))
-	m.SetLoc("key2", nil, dyn.V("value2"))
-
-	b, err := Marshal(dyn.V(m))
-	if assert.NoError(t, err) {
-		assert.JSONEq(t, `{"key1":"value1","key2":"value2"}`, string(b))
-	}
-}
-
-func TestMarshal_Sequence(t *testing.T) {
-	var s []dyn.Value
-	s = append(s, dyn.V("value1"))
-	s = append(s, dyn.V("value2"))
-
-	b, err := Marshal(dyn.V(s))
-	if assert.NoError(t, err) {
-		assert.JSONEq(t, `["value1","value2"]`, string(b))
-	}
-}
-
-func TestMarshal_Complex(t *testing.T) {
-	map1 := dyn.NewMapping()
-	map1.SetLoc("str1", nil, dyn.V("value1"))
-	map1.SetLoc("str2", nil, dyn.V("value2"))
-
-	var seq1 []dyn.Value
-	seq1 = append(seq1, dyn.V("value1"))
-	seq1 = append(seq1, dyn.V("value2"))
-
-	root := dyn.NewMapping()
-	root.SetLoc("map1", nil, dyn.V(map1))
-	root.SetLoc("seq1", nil, dyn.V(seq1))
-
-	// Marshal without indent.
-	b, err := Marshal(dyn.V(root))
-	if assert.NoError(t, err) {
-		assert.Equal(t, `{"map1":{"str1":"value1","str2":"value2"},"seq1":["value1","value2"]}`+"\n", string(b))
-	}
-
-	// Marshal with indent.
-	b, err = MarshalIndent(dyn.V(root), "", "  ")
-	if assert.NoError(t, err) {
-		assert.Equal(t, `{
-  "map1": {
-    "str1": "value1",
-    "str2": "value2"
-  },
-  "seq1": [
-    "value1",
-    "value2"
-  ]
-}`+"\n", string(b))
-	}
-}
diff --git a/libs/dyn/location_test.go b/libs/dyn/location_test.go
deleted file mode 100644
index 29226d73d03..00000000000
--- a/libs/dyn/location_test.go
+++ /dev/null
@@ -1,13 +0,0 @@
-package dyn_test
-
-import (
-	"testing"
-
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestLocation(t *testing.T) {
-	loc := dyn.Location{File: "file", Line: 1, Column: 2}
-	assert.Equal(t, "file:1:2", loc.String())
-}
diff --git a/libs/dyn/mapping.go b/libs/dyn/mapping.go
index e7e1bbbc670..8b29181e40f 100644
--- a/libs/dyn/mapping.go
+++ b/libs/dyn/mapping.go
@@ -3,6 +3,8 @@ package dyn
 import (
 	"maps"
 	"slices"
+
+	"github.com/databricks/cli/libs/diag"
 )
 
 // Pair represents a single key-value pair in a Mapping.
@@ -107,7 +109,7 @@ func (m *Mapping) GetByString(skey string) (Value, bool) {
 // Set sets the value for the given key in the mapping.
 // If the key already exists, the value is updated. The location loc is ignored.
 // If the key does not exist, a new key-value pair is added.
-func (m *Mapping) SetLoc(skey string, loc []Location, value Value) {
+func (m *Mapping) SetLoc(skey string, loc []diag.Location, value Value) {
 	// If the key already exists, update the value.
 	if i, ok := m.index[skey]; ok {
 		m.pairs[i].Value = value
diff --git a/libs/dyn/mapping_test.go b/libs/dyn/mapping_test.go
index 7f3d0c77ed9..f646ab7c1d1 100644
--- a/libs/dyn/mapping_test.go
+++ b/libs/dyn/mapping_test.go
@@ -20,8 +20,8 @@ func TestMappingZeroValue(t *testing.T) {
 	value, ok := m.Get(dyn.V("key"))
 	assert.Equal(t, dyn.InvalidValue, value)
 	assert.False(t, ok)
-	assert.Len(t, m.Keys(), 0)
-	assert.Len(t, m.Values(), 0)
+	assert.Empty(t, m.Keys())
+	assert.Empty(t, m.Values())
 }
 
 func TestMappingGet(t *testing.T) {
diff --git a/libs/dyn/merge/elements_by_key_test.go b/libs/dyn/merge/elements_by_key_test.go
index 1cc873636f9..2aa19306820 100644
--- a/libs/dyn/merge/elements_by_key_test.go
+++ b/libs/dyn/merge/elements_by_key_test.go
@@ -4,6 +4,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -50,10 +51,10 @@ func TestElementByKey(t *testing.T) {
 }
 
 func TestElementByKeyPreservesLocations(t *testing.T) {
-	loc := dyn.Location{File: "config.yml", Line: 10, Column: 5}
+	loc := diag.Location{File: "config.yml", Line: 10, Column: 5}
 	vin := dyn.V([]dyn.Value{
 		dyn.V(map[string]dyn.Value{
-			"key":   dyn.NewValue("foo", []dyn.Location{loc}),
+			"key":   dyn.NewValue("foo", []diag.Location{loc}),
 			"value": dyn.V(42),
 		}),
 	})
diff --git a/libs/dyn/merge/merge_test.go b/libs/dyn/merge/merge_test.go
index 43e0e08c182..9545c752258 100644
--- a/libs/dyn/merge/merge_test.go
+++ b/libs/dyn/merge/merge_test.go
@@ -3,22 +3,23 @@ package merge
 import (
 	"testing"
 
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
 	"github.com/stretchr/testify/assert"
 )
 
 func TestMergeMaps(t *testing.T) {
-	l1 := dyn.Location{File: "file1", Line: 1, Column: 2}
+	l1 := diag.Location{File: "file1", Line: 1, Column: 2}
 	v1 := dyn.NewValue(map[string]dyn.Value{
-		"foo": dyn.NewValue("bar", []dyn.Location{l1}),
-		"bar": dyn.NewValue("baz", []dyn.Location{l1}),
-	}, []dyn.Location{l1})
+		"foo": dyn.NewValue("bar", []diag.Location{l1}),
+		"bar": dyn.NewValue("baz", []diag.Location{l1}),
+	}, []diag.Location{l1})
 
-	l2 := dyn.Location{File: "file2", Line: 3, Column: 4}
+	l2 := diag.Location{File: "file2", Line: 3, Column: 4}
 	v2 := dyn.NewValue(map[string]dyn.Value{
-		"bar": dyn.NewValue("qux", []dyn.Location{l2}),
-		"qux": dyn.NewValue("foo", []dyn.Location{l2}),
-	}, []dyn.Location{l2})
+		"bar": dyn.NewValue("qux", []diag.Location{l2}),
+		"qux": dyn.NewValue("foo", []diag.Location{l2}),
+	}, []diag.Location{l2})
 
 	// Merge v2 into v1.
 	{
@@ -31,10 +32,10 @@ func TestMergeMaps(t *testing.T) {
 		}, out.AsAny())
 
 		// Locations of both values should be preserved.
-		assert.Equal(t, []dyn.Location{l1, l2}, out.Locations())
-		assert.Equal(t, []dyn.Location{l2, l1}, out.Get("bar").Locations())
-		assert.Equal(t, []dyn.Location{l1}, out.Get("foo").Locations())
-		assert.Equal(t, []dyn.Location{l2}, out.Get("qux").Locations())
+		assert.Equal(t, []diag.Location{l1, l2}, out.Locations())
+		assert.Equal(t, []diag.Location{l2, l1}, out.Get("bar").Locations())
+		assert.Equal(t, []diag.Location{l1}, out.Get("foo").Locations())
+		assert.Equal(t, []diag.Location{l2}, out.Get("qux").Locations())
 
 		// Location of the merged value should be the location of v1.
 		assert.Equal(t, l1, out.Location())
@@ -59,10 +60,10 @@ func TestMergeMaps(t *testing.T) {
 		}, out.AsAny())
 
 		// Locations of both values should be preserved.
-		assert.Equal(t, []dyn.Location{l2, l1}, out.Locations())
-		assert.Equal(t, []dyn.Location{l1, l2}, out.Get("bar").Locations())
-		assert.Equal(t, []dyn.Location{l1}, out.Get("foo").Locations())
-		assert.Equal(t, []dyn.Location{l2}, out.Get("qux").Locations())
+		assert.Equal(t, []diag.Location{l2, l1}, out.Locations())
+		assert.Equal(t, []diag.Location{l1, l2}, out.Get("bar").Locations())
+		assert.Equal(t, []diag.Location{l1}, out.Get("foo").Locations())
+		assert.Equal(t, []diag.Location{l2}, out.Get("qux").Locations())
 
 		// Location of the merged value should be the location of v2.
 		assert.Equal(t, l2, out.Location())
@@ -78,13 +79,13 @@ func TestMergeMaps(t *testing.T) {
 }
 
 func TestMergeMapsNil(t *testing.T) {
-	l := dyn.Location{File: "file", Line: 1, Column: 2}
+	l := diag.Location{File: "file", Line: 1, Column: 2}
 	v := dyn.NewValue(map[string]dyn.Value{
 		"foo": dyn.V("bar"),
-	}, []dyn.Location{l})
+	}, []diag.Location{l})
 
-	nilL := dyn.Location{File: "file", Line: 3, Column: 4}
-	nilV := dyn.NewValue(nil, []dyn.Location{nilL})
+	nilL := diag.Location{File: "file", Line: 3, Column: 4}
+	nilV := dyn.NewValue(nil, []diag.Location{nilL})
 
 	// Merge nil into v.
 	{
@@ -95,7 +96,7 @@ func TestMergeMapsNil(t *testing.T) {
 		}, out.AsAny())
 
 		// Locations of both values should be preserved.
-		assert.Equal(t, []dyn.Location{l, nilL}, out.Locations())
+		assert.Equal(t, []diag.Location{l, nilL}, out.Locations())
 
 		// Location of the non-nil value should be returned by .Location().
 		assert.Equal(t, l, out.Location())
@@ -110,7 +111,7 @@ func TestMergeMapsNil(t *testing.T) {
 		}, out.AsAny())
 
 		// Locations of both values should be preserved.
-		assert.Equal(t, []dyn.Location{l, nilL}, out.Locations())
+		assert.Equal(t, []diag.Location{l, nilL}, out.Locations())
 
 		// Location of the non-nil value should be returned by .Location().
 		assert.Equal(t, l, out.Location())
@@ -133,18 +134,18 @@ func TestMergeMapsError(t *testing.T) {
 }
 
 func TestMergeSequences(t *testing.T) {
-	l1 := dyn.Location{File: "file1", Line: 1, Column: 2}
+	l1 := diag.Location{File: "file1", Line: 1, Column: 2}
 	v1 := dyn.NewValue([]dyn.Value{
-		dyn.NewValue("bar", []dyn.Location{l1}),
-		dyn.NewValue("baz", []dyn.Location{l1}),
-	}, []dyn.Location{l1})
+		dyn.NewValue("bar", []diag.Location{l1}),
+		dyn.NewValue("baz", []diag.Location{l1}),
+	}, []diag.Location{l1})
 
-	l2 := dyn.Location{File: "file2", Line: 3, Column: 4}
-	l3 := dyn.Location{File: "file3", Line: 5, Column: 6}
+	l2 := diag.Location{File: "file2", Line: 3, Column: 4}
+	l3 := diag.Location{File: "file3", Line: 5, Column: 6}
 	v2 := dyn.NewValue([]dyn.Value{
-		dyn.NewValue("qux", []dyn.Location{l2}),
-		dyn.NewValue("foo", []dyn.Location{l3}),
-	}, []dyn.Location{l2, l3})
+		dyn.NewValue("qux", []diag.Location{l2}),
+		dyn.NewValue("foo", []diag.Location{l3}),
+	}, []diag.Location{l2, l3})
 
 	// Merge v2 into v1.
 	{
@@ -158,7 +159,7 @@ func TestMergeSequences(t *testing.T) {
 		}, out.AsAny())
 
 		// Locations of both values should be preserved.
-		assert.Equal(t, []dyn.Location{l1, l2, l3}, out.Locations())
+		assert.Equal(t, []diag.Location{l1, l2, l3}, out.Locations())
 
 		// Location of the merged value should be the location of v1.
 		assert.Equal(t, l1, out.Location())
@@ -182,7 +183,7 @@ func TestMergeSequences(t *testing.T) {
 		}, out.AsAny())
 
 		// Locations of both values should be preserved.
-		assert.Equal(t, []dyn.Location{l2, l3, l1}, out.Locations())
+		assert.Equal(t, []diag.Location{l2, l3, l1}, out.Locations())
 
 		// Location of the merged value should be the location of v2.
 		assert.Equal(t, l2, out.Location())
@@ -235,10 +236,10 @@ func TestMergeSequencesError(t *testing.T) {
 }
 
 func TestMergePrimitives(t *testing.T) {
-	l1 := dyn.Location{File: "file1", Line: 1, Column: 2}
-	l2 := dyn.Location{File: "file2", Line: 3, Column: 4}
-	v1 := dyn.NewValue("bar", []dyn.Location{l1})
-	v2 := dyn.NewValue("baz", []dyn.Location{l2})
+	l1 := diag.Location{File: "file1", Line: 1, Column: 2}
+	l2 := diag.Location{File: "file2", Line: 3, Column: 4}
+	v1 := dyn.NewValue("bar", []diag.Location{l1})
+	v2 := dyn.NewValue("baz", []diag.Location{l2})
 
 	// Merge v2 into v1.
 	{
@@ -247,7 +248,7 @@ func TestMergePrimitives(t *testing.T) {
 		assert.Equal(t, "baz", out.AsAny())
 
 		// Locations of both values should be preserved.
-		assert.Equal(t, []dyn.Location{l2, l1}, out.Locations())
+		assert.Equal(t, []diag.Location{l2, l1}, out.Locations())
 
 		// Location of the merged value should be the location of v2, the second value.
 		assert.Equal(t, l2, out.Location())
@@ -260,7 +261,7 @@ func TestMergePrimitives(t *testing.T) {
 		assert.Equal(t, "bar", out.AsAny())
 
 		// Locations of both values should be preserved.
-		assert.Equal(t, []dyn.Location{l1, l2}, out.Locations())
+		assert.Equal(t, []diag.Location{l1, l2}, out.Locations())
 
 		// Location of the merged value should be the location of v1, the second value.
 		assert.Equal(t, l1, out.Location())
diff --git a/libs/dyn/merge/override_test.go b/libs/dyn/merge/override_test.go
index dfb000dc9ee..17602f57ad7 100644
--- a/libs/dyn/merge/override_test.go
+++ b/libs/dyn/merge/override_test.go
@@ -5,6 +5,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/cli/libs/dyn/dynassert"
 	"github.com/stretchr/testify/assert"
@@ -20,86 +21,86 @@ type overrideTestCase struct {
 }
 
 func TestOverride_Primitive(t *testing.T) {
-	leftLocation := dyn.Location{File: "left.yml", Line: 1, Column: 1}
-	rightLocation := dyn.Location{File: "right.yml", Line: 1, Column: 1}
+	leftLocation := diag.Location{File: "left.yml", Line: 1, Column: 1}
+	rightLocation := diag.Location{File: "right.yml", Line: 1, Column: 1}
 
 	modifiedTestCases := []overrideTestCase{
 		{
 			name:     "string (updated)",
 			state:    visitorState{updated: []string{"root"}},
-			left:     dyn.NewValue("a", []dyn.Location{leftLocation}),
-			right:    dyn.NewValue("b", []dyn.Location{rightLocation}),
-			expected: dyn.NewValue("b", []dyn.Location{rightLocation}),
+			left:     dyn.NewValue("a", []diag.Location{leftLocation}),
+			right:    dyn.NewValue("b", []diag.Location{rightLocation}),
+			expected: dyn.NewValue("b", []diag.Location{rightLocation}),
 		},
 		{
 			name:     "string (not updated)",
 			state:    visitorState{},
-			left:     dyn.NewValue("a", []dyn.Location{leftLocation}),
-			right:    dyn.NewValue("a", []dyn.Location{rightLocation}),
-			expected: dyn.NewValue("a", []dyn.Location{leftLocation}),
+			left:     dyn.NewValue("a", []diag.Location{leftLocation}),
+			right:    dyn.NewValue("a", []diag.Location{rightLocation}),
+			expected: dyn.NewValue("a", []diag.Location{leftLocation}),
 		},
 		{
 			name:     "bool (updated)",
 			state:    visitorState{updated: []string{"root"}},
-			left:     dyn.NewValue(true, []dyn.Location{leftLocation}),
-			right:    dyn.NewValue(false, []dyn.Location{rightLocation}),
-			expected: dyn.NewValue(false, []dyn.Location{rightLocation}),
+			left:     dyn.NewValue(true, []diag.Location{leftLocation}),
+			right:    dyn.NewValue(false, []diag.Location{rightLocation}),
+			expected: dyn.NewValue(false, []diag.Location{rightLocation}),
 		},
 		{
 			name:     "bool (not updated)",
 			state:    visitorState{},
-			left:     dyn.NewValue(true, []dyn.Location{leftLocation}),
-			right:    dyn.NewValue(true, []dyn.Location{rightLocation}),
-			expected: dyn.NewValue(true, []dyn.Location{leftLocation}),
+			left:     dyn.NewValue(true, []diag.Location{leftLocation}),
+			right:    dyn.NewValue(true, []diag.Location{rightLocation}),
+			expected: dyn.NewValue(true, []diag.Location{leftLocation}),
 		},
 		{
 			name:     "int (updated)",
 			state:    visitorState{updated: []string{"root"}},
-			left:     dyn.NewValue(1, []dyn.Location{leftLocation}),
-			right:    dyn.NewValue(2, []dyn.Location{rightLocation}),
-			expected: dyn.NewValue(2, []dyn.Location{rightLocation}),
+			left:     dyn.NewValue(1, []diag.Location{leftLocation}),
+			right:    dyn.NewValue(2, []diag.Location{rightLocation}),
+			expected: dyn.NewValue(2, []diag.Location{rightLocation}),
 		},
 		{
 			name:     "int (not updated)",
 			state:    visitorState{},
-			left:     dyn.NewValue(int32(1), []dyn.Location{leftLocation}),
-			right:    dyn.NewValue(int64(1), []dyn.Location{rightLocation}),
-			expected: dyn.NewValue(int32(1), []dyn.Location{leftLocation}),
+			left:     dyn.NewValue(int32(1), []diag.Location{leftLocation}),
+			right:    dyn.NewValue(int64(1), []diag.Location{rightLocation}),
+			expected: dyn.NewValue(int32(1), []diag.Location{leftLocation}),
 		},
 		{
 			name:     "float (updated)",
 			state:    visitorState{updated: []string{"root"}},
-			left:     dyn.NewValue(1.0, []dyn.Location{leftLocation}),
-			right:    dyn.NewValue(2.0, []dyn.Location{rightLocation}),
-			expected: dyn.NewValue(2.0, []dyn.Location{rightLocation}),
+			left:     dyn.NewValue(1.0, []diag.Location{leftLocation}),
+			right:    dyn.NewValue(2.0, []diag.Location{rightLocation}),
+			expected: dyn.NewValue(2.0, []diag.Location{rightLocation}),
 		},
 		{
 			name:     "float (not updated)",
 			state:    visitorState{},
-			left:     dyn.NewValue(float32(1.0), []dyn.Location{leftLocation}),
-			right:    dyn.NewValue(float64(1.0), []dyn.Location{rightLocation}),
-			expected: dyn.NewValue(float32(1.0), []dyn.Location{leftLocation}),
+			left:     dyn.NewValue(float32(1.0), []diag.Location{leftLocation}),
+			right:    dyn.NewValue(float64(1.0), []diag.Location{rightLocation}),
+			expected: dyn.NewValue(float32(1.0), []diag.Location{leftLocation}),
 		},
 		{
 			name:     "time (updated)",
 			state:    visitorState{updated: []string{"root"}},
-			left:     dyn.NewValue(dyn.FromTime(time.UnixMilli(10000)), []dyn.Location{leftLocation}),
-			right:    dyn.NewValue(dyn.FromTime(time.UnixMilli(10001)), []dyn.Location{rightLocation}),
-			expected: dyn.NewValue(dyn.FromTime(time.UnixMilli(10001)), []dyn.Location{rightLocation}),
+			left:     dyn.NewValue(dyn.FromTime(time.UnixMilli(10000)), []diag.Location{leftLocation}),
+			right:    dyn.NewValue(dyn.FromTime(time.UnixMilli(10001)), []diag.Location{rightLocation}),
+			expected: dyn.NewValue(dyn.FromTime(time.UnixMilli(10001)), []diag.Location{rightLocation}),
 		},
 		{
 			name:     "time (not updated)",
 			state:    visitorState{},
-			left:     dyn.NewValue(dyn.FromTime(time.UnixMilli(10000)), []dyn.Location{leftLocation}),
-			right:    dyn.NewValue(dyn.FromTime(time.UnixMilli(10000)), []dyn.Location{rightLocation}),
-			expected: dyn.NewValue(dyn.FromTime(time.UnixMilli(10000)), []dyn.Location{leftLocation}),
+			left:     dyn.NewValue(dyn.FromTime(time.UnixMilli(10000)), []diag.Location{leftLocation}),
+			right:    dyn.NewValue(dyn.FromTime(time.UnixMilli(10000)), []diag.Location{rightLocation}),
+			expected: dyn.NewValue(dyn.FromTime(time.UnixMilli(10000)), []diag.Location{leftLocation}),
 		},
 		{
 			name:     "different types (updated)",
 			state:    visitorState{updated: []string{"root"}},
-			left:     dyn.NewValue("a", []dyn.Location{leftLocation}),
-			right:    dyn.NewValue(42, []dyn.Location{rightLocation}),
-			expected: dyn.NewValue(42, []dyn.Location{rightLocation}),
+			left:     dyn.NewValue("a", []diag.Location{leftLocation}),
+			right:    dyn.NewValue(42, []diag.Location{rightLocation}),
+			expected: dyn.NewValue(42, []diag.Location{rightLocation}),
 		},
 		{
 			name: "map - remove 'a', update 'b'",
@@ -109,22 +110,22 @@ func TestOverride_Primitive(t *testing.T) {
 			},
 			left: dyn.NewValue(
 				map[string]dyn.Value{
-					"a": dyn.NewValue(42, []dyn.Location{leftLocation}),
-					"b": dyn.NewValue(10, []dyn.Location{leftLocation}),
+					"a": dyn.NewValue(42, []diag.Location{leftLocation}),
+					"b": dyn.NewValue(10, []diag.Location{leftLocation}),
 				},
-				[]dyn.Location{leftLocation}),
+				[]diag.Location{leftLocation}),
 
 			right: dyn.NewValue(
 				map[string]dyn.Value{
-					"b": dyn.NewValue(20, []dyn.Location{rightLocation}),
+					"b": dyn.NewValue(20, []diag.Location{rightLocation}),
 				},
-				[]dyn.Location{rightLocation}),
+				[]diag.Location{rightLocation}),
 
 			expected: dyn.NewValue(
 				map[string]dyn.Value{
-					"b": dyn.NewValue(20, []dyn.Location{rightLocation}),
+					"b": dyn.NewValue(20, []diag.Location{rightLocation}),
 				},
-				[]dyn.Location{leftLocation}),
+				[]diag.Location{leftLocation}),
 		},
 		{
 			name: "map - add 'a'",
@@ -133,26 +134,26 @@ func TestOverride_Primitive(t *testing.T) {
 			},
 			left: dyn.NewValue(
 				map[string]dyn.Value{
-					"b": dyn.NewValue(10, []dyn.Location{leftLocation}),
+					"b": dyn.NewValue(10, []diag.Location{leftLocation}),
 				},
-				[]dyn.Location{leftLocation},
+				[]diag.Location{leftLocation},
 			),
 
 			right: dyn.NewValue(
 				map[string]dyn.Value{
-					"a": dyn.NewValue(42, []dyn.Location{rightLocation}),
-					"b": dyn.NewValue(10, []dyn.Location{rightLocation}),
+					"a": dyn.NewValue(42, []diag.Location{rightLocation}),
+					"b": dyn.NewValue(10, []diag.Location{rightLocation}),
 				},
-				[]dyn.Location{leftLocation},
+				[]diag.Location{leftLocation},
 			),
 
 			expected: dyn.NewValue(
 				map[string]dyn.Value{
-					"a": dyn.NewValue(42, []dyn.Location{rightLocation}),
+					"a": dyn.NewValue(42, []diag.Location{rightLocation}),
 					// location hasn't changed because value hasn't changed
-					"b": dyn.NewValue(10, []dyn.Location{leftLocation}),
+					"b": dyn.NewValue(10, []diag.Location{leftLocation}),
 				},
-				[]dyn.Location{leftLocation},
+				[]diag.Location{leftLocation},
 			),
 		},
 		{
@@ -162,25 +163,25 @@ func TestOverride_Primitive(t *testing.T) {
 			},
 			left: dyn.NewValue(
 				map[string]dyn.Value{
-					"a": dyn.NewValue(42, []dyn.Location{leftLocation}),
-					"b": dyn.NewValue(10, []dyn.Location{leftLocation}),
+					"a": dyn.NewValue(42, []diag.Location{leftLocation}),
+					"b": dyn.NewValue(10, []diag.Location{leftLocation}),
 				},
-				[]dyn.Location{leftLocation},
+				[]diag.Location{leftLocation},
 			),
 
 			right: dyn.NewValue(
 				map[string]dyn.Value{
-					"b": dyn.NewValue(10, []dyn.Location{rightLocation}),
+					"b": dyn.NewValue(10, []diag.Location{rightLocation}),
 				},
-				[]dyn.Location{leftLocation},
+				[]diag.Location{leftLocation},
 			),
 
 			expected: dyn.NewValue(
 				map[string]dyn.Value{
 					// location hasn't changed because value hasn't changed
-					"b": dyn.NewValue(10, []dyn.Location{leftLocation}),
+					"b": dyn.NewValue(10, []diag.Location{leftLocation}),
 				},
-				[]dyn.Location{leftLocation},
+				[]diag.Location{leftLocation},
 			),
 		},
 		{
@@ -192,38 +193,38 @@ func TestOverride_Primitive(t *testing.T) {
 				map[string]dyn.Value{
 					"jobs": dyn.NewValue(
 						map[string]dyn.Value{
-							"job_0": dyn.NewValue(42, []dyn.Location{leftLocation}),
+							"job_0": dyn.NewValue(42, []diag.Location{leftLocation}),
 						},
-						[]dyn.Location{leftLocation},
+						[]diag.Location{leftLocation},
 					),
 				},
-				[]dyn.Location{leftLocation},
+				[]diag.Location{leftLocation},
 			),
 
 			right: dyn.NewValue(
 				map[string]dyn.Value{
 					"jobs": dyn.NewValue(
 						map[string]dyn.Value{
-							"job_0": dyn.NewValue(42, []dyn.Location{rightLocation}),
-							"job_1": dyn.NewValue(1337, []dyn.Location{rightLocation}),
+							"job_0": dyn.NewValue(42, []diag.Location{rightLocation}),
+							"job_1": dyn.NewValue(1337, []diag.Location{rightLocation}),
 						},
-						[]dyn.Location{rightLocation},
+						[]diag.Location{rightLocation},
 					),
 				},
-				[]dyn.Location{rightLocation},
+				[]diag.Location{rightLocation},
 			),
 
 			expected: dyn.NewValue(
 				map[string]dyn.Value{
 					"jobs": dyn.NewValue(
 						map[string]dyn.Value{
-							"job_0": dyn.NewValue(42, []dyn.Location{leftLocation}),
-							"job_1": dyn.NewValue(1337, []dyn.Location{rightLocation}),
+							"job_0": dyn.NewValue(42, []diag.Location{leftLocation}),
+							"job_1": dyn.NewValue(1337, []diag.Location{rightLocation}),
 						},
-						[]dyn.Location{leftLocation},
+						[]diag.Location{leftLocation},
 					),
 				},
-				[]dyn.Location{leftLocation},
+				[]diag.Location{leftLocation},
 			),
 		},
 		{
@@ -233,35 +234,35 @@ func TestOverride_Primitive(t *testing.T) {
 				map[string]dyn.Value{
 					"jobs": dyn.NewValue(
 						map[string]dyn.Value{
-							"job_0": dyn.NewValue(42, []dyn.Location{leftLocation}),
-							"job_1": dyn.NewValue(1337, []dyn.Location{rightLocation}),
+							"job_0": dyn.NewValue(42, []diag.Location{leftLocation}),
+							"job_1": dyn.NewValue(1337, []diag.Location{rightLocation}),
 						},
-						[]dyn.Location{leftLocation},
+						[]diag.Location{leftLocation},
 					),
 				},
-				[]dyn.Location{leftLocation},
+				[]diag.Location{leftLocation},
 			),
 			right: dyn.NewValue(
 				map[string]dyn.Value{
 					"jobs": dyn.NewValue(
 						map[string]dyn.Value{
-							"job_0": dyn.NewValue(42, []dyn.Location{rightLocation}),
+							"job_0": dyn.NewValue(42, []diag.Location{rightLocation}),
 						},
-						[]dyn.Location{rightLocation},
+						[]diag.Location{rightLocation},
 					),
 				},
-				[]dyn.Location{rightLocation},
+				[]diag.Location{rightLocation},
 			),
 			expected: dyn.NewValue(
 				map[string]dyn.Value{
 					"jobs": dyn.NewValue(
 						map[string]dyn.Value{
-							"job_0": dyn.NewValue(42, []dyn.Location{leftLocation}),
+							"job_0": dyn.NewValue(42, []diag.Location{leftLocation}),
 						},
-						[]dyn.Location{leftLocation},
+						[]diag.Location{leftLocation},
 					),
 				},
-				[]dyn.Location{leftLocation},
+				[]diag.Location{leftLocation},
 			),
 		},
 		{
@@ -269,23 +270,23 @@ func TestOverride_Primitive(t *testing.T) {
 			state: visitorState{added: []string{"root[1]"}},
 			left: dyn.NewValue(
 				[]dyn.Value{
-					dyn.NewValue(42, []dyn.Location{leftLocation}),
+					dyn.NewValue(42, []diag.Location{leftLocation}),
 				},
-				[]dyn.Location{leftLocation},
+				[]diag.Location{leftLocation},
 			),
 			right: dyn.NewValue(
 				[]dyn.Value{
-					dyn.NewValue(42, []dyn.Location{rightLocation}),
-					dyn.NewValue(10, []dyn.Location{rightLocation}),
+					dyn.NewValue(42, []diag.Location{rightLocation}),
+					dyn.NewValue(10, []diag.Location{rightLocation}),
 				},
-				[]dyn.Location{rightLocation},
+				[]diag.Location{rightLocation},
 			),
 			expected: dyn.NewValue(
 				[]dyn.Value{
-					dyn.NewValue(42, []dyn.Location{leftLocation}),
-					dyn.NewValue(10, []dyn.Location{rightLocation}),
+					dyn.NewValue(42, []diag.Location{leftLocation}),
+					dyn.NewValue(10, []diag.Location{rightLocation}),
 				},
-				[]dyn.Location{leftLocation},
+				[]diag.Location{leftLocation},
 			),
 		},
 		{
@@ -293,22 +294,22 @@ func TestOverride_Primitive(t *testing.T) {
 			state: visitorState{removed: []string{"root[1]"}},
 			left: dyn.NewValue(
 				[]dyn.Value{
-					dyn.NewValue(42, []dyn.Location{leftLocation}),
-					dyn.NewValue(10, []dyn.Location{leftLocation}),
+					dyn.NewValue(42, []diag.Location{leftLocation}),
+					dyn.NewValue(10, []diag.Location{leftLocation}),
 				},
-				[]dyn.Location{leftLocation},
+				[]diag.Location{leftLocation},
 			),
 			right: dyn.NewValue(
 				[]dyn.Value{
-					dyn.NewValue(42, []dyn.Location{rightLocation}),
+					dyn.NewValue(42, []diag.Location{rightLocation}),
 				},
-				[]dyn.Location{rightLocation},
+				[]diag.Location{rightLocation},
 			),
 			expected: dyn.NewValue(
 				[]dyn.Value{
-					dyn.NewValue(42, []dyn.Location{leftLocation}),
+					dyn.NewValue(42, []diag.Location{leftLocation}),
 				},
-				[]dyn.Location{leftLocation},
+				[]diag.Location{leftLocation},
 			),
 			// location hasn't changed because value hasn't changed
 		},
@@ -317,43 +318,43 @@ func TestOverride_Primitive(t *testing.T) {
 			state: visitorState{},
 			left: dyn.NewValue(
 				[]dyn.Value{
-					dyn.NewValue(42, []dyn.Location{leftLocation}),
+					dyn.NewValue(42, []diag.Location{leftLocation}),
 				},
-				[]dyn.Location{leftLocation},
+				[]diag.Location{leftLocation},
 			),
 			right: dyn.NewValue(
 				[]dyn.Value{
-					dyn.NewValue(42, []dyn.Location{rightLocation}),
+					dyn.NewValue(42, []diag.Location{rightLocation}),
 				},
-				[]dyn.Location{rightLocation},
+				[]diag.Location{rightLocation},
 			),
 			expected: dyn.NewValue(
 				[]dyn.Value{
-					dyn.NewValue(42, []dyn.Location{leftLocation}),
+					dyn.NewValue(42, []diag.Location{leftLocation}),
 				},
-				[]dyn.Location{leftLocation},
+				[]diag.Location{leftLocation},
 			),
 		},
 		{
 			name:     "nil (not updated)",
 			state:    visitorState{},
-			left:     dyn.NilValue.WithLocations([]dyn.Location{leftLocation}),
-			right:    dyn.NilValue.WithLocations([]dyn.Location{rightLocation}),
-			expected: dyn.NilValue.WithLocations([]dyn.Location{leftLocation}),
+			left:     dyn.NilValue.WithLocations([]diag.Location{leftLocation}),
+			right:    dyn.NilValue.WithLocations([]diag.Location{rightLocation}),
+			expected: dyn.NilValue.WithLocations([]diag.Location{leftLocation}),
 		},
 		{
 			name:     "nil (updated)",
 			state:    visitorState{updated: []string{"root"}},
 			left:     dyn.NilValue,
-			right:    dyn.NewValue(42, []dyn.Location{rightLocation}),
-			expected: dyn.NewValue(42, []dyn.Location{rightLocation}),
+			right:    dyn.NewValue(42, []diag.Location{rightLocation}),
+			expected: dyn.NewValue(42, []diag.Location{rightLocation}),
 		},
 		{
 			name:     "change kind (updated)",
 			state:    visitorState{updated: []string{"root"}},
-			left:     dyn.NewValue(42.0, []dyn.Location{leftLocation}),
-			right:    dyn.NewValue(42, []dyn.Location{rightLocation}),
-			expected: dyn.NewValue(42, []dyn.Location{rightLocation}),
+			left:     dyn.NewValue(42.0, []diag.Location{leftLocation}),
+			right:    dyn.NewValue(42, []diag.Location{rightLocation}),
+			expected: dyn.NewValue(42, []diag.Location{rightLocation}),
 		},
 	}
 
@@ -423,26 +424,26 @@ func TestOverride_Primitive(t *testing.T) {
 }
 
 func TestOverride_PreserveMappingKeys(t *testing.T) {
-	leftLocation := dyn.Location{File: "left.yml", Line: 1, Column: 1}
-	leftKeyLocation := dyn.Location{File: "left.yml", Line: 2, Column: 1}
-	leftValueLocation := dyn.Location{File: "left.yml", Line: 3, Column: 1}
+	leftLocation := diag.Location{File: "left.yml", Line: 1, Column: 1}
+	leftKeyLocation := diag.Location{File: "left.yml", Line: 2, Column: 1}
+	leftValueLocation := diag.Location{File: "left.yml", Line: 3, Column: 1}
 
-	rightLocation := dyn.Location{File: "right.yml", Line: 1, Column: 1}
-	rightKeyLocation := dyn.Location{File: "right.yml", Line: 2, Column: 1}
-	rightValueLocation := dyn.Location{File: "right.yml", Line: 3, Column: 1}
+	rightLocation := diag.Location{File: "right.yml", Line: 1, Column: 1}
+	rightKeyLocation := diag.Location{File: "right.yml", Line: 2, Column: 1}
+	rightValueLocation := diag.Location{File: "right.yml", Line: 3, Column: 1}
 
 	left := dyn.NewMapping()
-	left.SetLoc("a", []dyn.Location{leftKeyLocation}, dyn.NewValue(42, []dyn.Location{leftValueLocation}))
+	left.SetLoc("a", []diag.Location{leftKeyLocation}, dyn.NewValue(42, []diag.Location{leftValueLocation}))
 
 	right := dyn.NewMapping()
-	right.SetLoc("a", []dyn.Location{rightKeyLocation}, dyn.NewValue(7, []dyn.Location{rightValueLocation}))
+	right.SetLoc("a", []diag.Location{rightKeyLocation}, dyn.NewValue(7, []diag.Location{rightValueLocation}))
 
 	state, visitor := createVisitor(visitorOpts{})
 
 	out, err := override(
 		dyn.EmptyPath,
-		dyn.NewValue(left, []dyn.Location{leftLocation}),
-		dyn.NewValue(right, []dyn.Location{rightLocation}),
+		dyn.NewValue(left, []diag.Location{leftLocation}),
+		dyn.NewValue(right, []diag.Location{rightLocation}),
 		visitor,
 	)
 
@@ -452,7 +453,7 @@ func TestOverride_PreserveMappingKeys(t *testing.T) {
 		outPairs := out.MustMap().Pairs()
 
 		assert.Equal(t, visitorState{updated: []string{"a"}}, state)
-		assert.Equal(t, 1, len(outPairs))
+		assert.Len(t, outPairs, 1)
 
 		// mapping was first defined in left, so it should keep its location
 		assert.Equal(t, leftLocation, out.Location())
diff --git a/libs/dyn/merge/select_test.go b/libs/dyn/merge/select_test.go
index f9f010fb9db..c621f226849 100644
--- a/libs/dyn/merge/select_test.go
+++ b/libs/dyn/merge/select_test.go
@@ -3,12 +3,13 @@ package merge
 import (
 	"testing"
 
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
 	"github.com/stretchr/testify/assert"
 )
 
 func TestSelect(t *testing.T) {
-	locations := []dyn.Location{{File: "foo.yml", Line: 1, Column: 1}}
+	locations := []diag.Location{{File: "foo.yml", Line: 1, Column: 1}}
 	included := []string{"foo"}
 	input := dyn.NewValue(
 		map[string]dyn.Value{
@@ -31,7 +32,7 @@ func TestSelect(t *testing.T) {
 }
 
 func TestAntiSelect(t *testing.T) {
-	locations := []dyn.Location{{File: "foo.yml", Line: 1, Column: 1}}
+	locations := []diag.Location{{File: "foo.yml", Line: 1, Column: 1}}
 	excluded := []string{"foo"}
 	input := dyn.NewValue(
 		map[string]dyn.Value{
diff --git a/libs/dyn/pattern.go b/libs/dyn/pattern.go
index 06fd3f776f6..cc53a2b0480 100644
--- a/libs/dyn/pattern.go
+++ b/libs/dyn/pattern.go
@@ -1,6 +1,7 @@
 package dyn
 
 import (
+	"errors"
 	"fmt"
 	"slices"
 	"strings"
@@ -116,6 +117,20 @@ func (e expectedSequenceError) Error() string {
 	return fmt.Sprintf("expected a sequence at %q, found %s", e.p, e.v.Kind())
 }
 
+// isNoMatchError reports whether err means the pattern suffix didn't match the
+// visited value. Wildcard components skip such elements (e.g. a job with an
+// empty "tasks:" block) instead of failing the visit for all valid siblings.
+func isNoMatchError(err error) bool {
+	if IsNoSuchKeyError(err) || IsIndexOutOfBoundsError(err) || IsCannotTraverseNilError(err) {
+		return true
+	}
+	if _, ok := errors.AsType[expectedMapError](err); ok {
+		return true
+	}
+	_, ok := errors.AsType[expectedSequenceError](err)
+	return ok
+}
+
 // This function implements the patternComponent interface.
 func (c anyKeyComponent) visit(v Value, prefix Path, suffix Pattern, opts visitOptions) (Value, error) {
 	m, ok := v.AsMap()
@@ -132,7 +147,7 @@ func (c anyKeyComponent) visit(v Value, prefix Path, suffix Pattern, opts visitO
 		nv, err := visit(pv, append(prefix, Key(pk.MustString())), suffix, opts)
 		if err != nil {
 			// Leave the value intact if the suffix pattern didn't match any value.
-			if IsNoSuchKeyError(err) || IsIndexOutOfBoundsError(err) {
+			if isNoMatchError(err) {
 				continue
 			}
 			return InvalidValue, err
@@ -164,7 +179,7 @@ func (c anyIndexComponent) visit(v Value, prefix Path, suffix Pattern, opts visi
 		nv, err := visit(value, append(prefix, Index(i)), suffix, opts)
 		if err != nil {
 			// Leave the value intact if the suffix pattern didn't match any value.
-			if IsNoSuchKeyError(err) || IsIndexOutOfBoundsError(err) {
+			if isNoMatchError(err) {
 				continue
 			}
 			return InvalidValue, err
diff --git a/libs/dyn/pattern_test.go b/libs/dyn/pattern_test.go
index 8b582f20108..be78b6df61a 100644
--- a/libs/dyn/pattern_test.go
+++ b/libs/dyn/pattern_test.go
@@ -103,7 +103,7 @@ func TestPatternSplitKeyError(t *testing.T) {
 	for ind, p := range patterns {
 		t.Run(fmt.Sprintf("%d %#v", ind, p), func(t *testing.T) {
 			pat, key := p.SplitKey()
-			assert.Equal(t, "", key)
+			assert.Empty(t, key)
 			assert.Empty(t, pat)
 		})
 	}
diff --git a/libs/dyn/structpath.go b/libs/dyn/structpath.go
new file mode 100644
index 00000000000..1cb740ee0d7
--- /dev/null
+++ b/libs/dyn/structpath.go
@@ -0,0 +1,41 @@
+package dyn
+
+import "github.com/databricks/cli/libs/structs/structpath"
+
+// ToStructPath converts a [Path] to a [structpath.PathNode].
+func ToStructPath(p Path) *structpath.PathNode {
+	var result *structpath.PathNode
+	for _, c := range p {
+		if c.isKey() {
+			result = structpath.NewStringKey(result, c.key)
+		} else {
+			result = structpath.NewIndex(result, c.index)
+		}
+	}
+	return result
+}
+
+// ToStructPaths converts each of paths with [ToStructPath], e.g. for diag.Diagnostic.Paths.
+func ToStructPaths(paths ...Path) []*structpath.PathNode {
+	out := make([]*structpath.PathNode, len(paths))
+	for i, p := range paths {
+		out[i] = ToStructPath(p)
+	}
+	return out
+}
+
+// FromStructPath converts a [structpath.PathNode] of keys and indices to a [Path].
+// It reports false for nodes a [Path] cannot represent (key-value selectors, wildcards).
+func FromStructPath(p *structpath.PathNode) (Path, bool) {
+	var out Path
+	for _, n := range p.AsSlice() {
+		if k, ok := n.StringKey(); ok {
+			out = append(out, Key(k))
+		} else if i, ok := n.Index(); ok {
+			out = append(out, Index(i))
+		} else {
+			return nil, false
+		}
+	}
+	return out, true
+}
diff --git a/libs/dyn/structpath_test.go b/libs/dyn/structpath_test.go
new file mode 100644
index 00000000000..6eed07a31fa
--- /dev/null
+++ b/libs/dyn/structpath_test.go
@@ -0,0 +1,39 @@
+package dyn_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/structs/structpath"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestToStructPath(t *testing.T) {
+	assert.Nil(t, dyn.ToStructPath(nil))
+
+	p := dyn.NewPath(dyn.Key("resources"), dyn.Key("jobs"), dyn.Key("a_job"), dyn.Key("tasks"), dyn.Index(1), dyn.Key("task_key"))
+	assert.Equal(t, "resources.jobs.a_job.tasks[1].task_key", dyn.ToStructPath(p).String())
+
+	p = dyn.NewPath(dyn.Key("resources"), dyn.Key("jobs"), dyn.Key("${var.env}_job"))
+	assert.Equal(t, "resources.jobs['${var.env}_job']", dyn.ToStructPath(p).String())
+}
+
+func TestToStructPaths(t *testing.T) {
+	paths := dyn.ToStructPaths(
+		dyn.MustPathFromString("a.b"),
+		dyn.NewPath(dyn.Key("c"), dyn.Index(1)),
+	)
+	assert.Len(t, paths, 2)
+	assert.Equal(t, "a.b", paths[0].String())
+	assert.Equal(t, "c[1]", paths[1].String())
+	assert.Empty(t, dyn.ToStructPaths())
+}
+
+func TestFromStructPath(t *testing.T) {
+	p, ok := dyn.FromStructPath(structpath.NewPath(nil, "resources", "jobs", "a.b", "tasks", 2))
+	assert.True(t, ok)
+	assert.Equal(t, dyn.NewPath(dyn.Key("resources"), dyn.Key("jobs"), dyn.Key("a.b"), dyn.Key("tasks"), dyn.Index(2)), p)
+
+	_, ok = dyn.FromStructPath(structpath.MustParsePath("tasks[task_key='x']"))
+	assert.False(t, ok)
+}
diff --git a/libs/dyn/suggest.go b/libs/dyn/suggest.go
new file mode 100644
index 00000000000..ef8008aae6f
--- /dev/null
+++ b/libs/dyn/suggest.go
@@ -0,0 +1,108 @@
+package dyn
+
+import (
+	"fmt"
+	"slices"
+	"strings"
+)
+
+const maxSuggestionDistance = 2
+
+// levenshteinDistance computes the edit distance between two strings.
+func levenshteinDistance(a, b string) int {
+	if len(a) == 0 {
+		return len(b)
+	}
+	if len(b) == 0 {
+		return len(a)
+	}
+
+	// Use a single row for the DP table.
+	prev := make([]int, len(b)+1)
+	for j := range len(b) + 1 {
+		prev[j] = j
+	}
+
+	for i := range len(a) {
+		curr := make([]int, len(b)+1)
+		curr[0] = i + 1
+		for j := range len(b) {
+			cost := 1
+			if a[i] == b[j] {
+				cost = 0
+			}
+			curr[j+1] = min(
+				curr[j]+1,    // insertion
+				prev[j+1]+1,  // deletion
+				prev[j]+cost, // substitution
+			)
+		}
+		prev = curr
+	}
+
+	return prev[len(b)]
+}
+
+// suggestKeys returns the keys in m whose edit distance from name is at most
+// maxSuggestionDistance, ordered by increasing distance. It is used to build
+// "did you mean" hints for a key that was not found in the map.
+func suggestKeys(m Mapping, name string) []string {
+	type candidate struct {
+		key  string
+		dist int
+	}
+
+	var candidates []candidate
+	for _, kv := range m.Keys() {
+		key := kv.MustString()
+		d := levenshteinDistance(name, key)
+		if d <= maxSuggestionDistance {
+			candidates = append(candidates, candidate{key, d})
+		}
+	}
+
+	slices.SortStableFunc(candidates, func(a, b candidate) int {
+		return a.dist - b.dist
+	})
+
+	suggestions := make([]string, len(candidates))
+	for i, c := range candidates {
+		suggestions[i] = c.key
+	}
+	return suggestions
+}
+
+// didYouMean formats a suggestion clause like `, did you mean "x"?` (or, for
+// multiple candidates, `, did you mean one of: "x", "y"?`). It returns an empty
+// string when there are no suggestions.
+func didYouMean(suggestions []string) string {
+	switch len(suggestions) {
+	case 0:
+		return ""
+	case 1:
+		return fmt.Sprintf(", did you mean %q?", suggestions[0])
+	default:
+		quoted := make([]string, len(suggestions))
+		for i, s := range suggestions {
+			quoted[i] = fmt.Sprintf("%q", s)
+		}
+		return fmt.Sprintf(", did you mean one of: %s?", strings.Join(quoted, ", "))
+	}
+}
+
+// replaceKey returns reference with the component matching failedKey swapped for
+// replacement, or just replacement if reference can't be parsed or has no match.
+func replaceKey(reference, failedKey, replacement string) string {
+	p, err := NewPathFromString(reference)
+	if err != nil {
+		return replacement
+	}
+	for i, c := range p {
+		if c.Key() == failedKey {
+			out := p.Append()
+			out[i] = Key(replacement)
+			return out.String()
+		}
+	}
+	return replacement
+}
diff --git a/libs/dyn/suggest_test.go b/libs/dyn/suggest_test.go
new file mode 100644
index 00000000000..b0aa4a87168
--- /dev/null
+++ b/libs/dyn/suggest_test.go
@@ -0,0 +1,164 @@
+package dyn
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestLevenshteinDistance(t *testing.T) {
+	tests := []struct {
+		a    string
+		b    string
+		want int
+	}{
+		{"", "", 0},
+		{"", "abc", 3},
+		{"abc", "", 3},
+		{"abc", "abc", 0},
+		{"abc", "abd", 1},
+		{"kitten", "sitting", 3},
+		{"host", "hosts", 1},
+	}
+	for _, tt := range tests {
+		assert.Equal(t, tt.want, levenshteinDistance(tt.a, tt.b), "levenshteinDistance(%q, %q)", tt.a, tt.b)
+	}
+}
+
+func newSuggestMapping(keys ...string) Mapping {
+	var m Mapping
+	for _, k := range keys {
+		m.SetLoc(k, nil, V(k))
+	}
+	return m
+}
+
+func TestSuggestKeys(t *testing.T) {
+	tests := []struct {
+		name string
+		keys []string
+		typo string
+		want []string
+	}{
+		{
+			// Keys within distance 2 are returned ordered by increasing
+			// distance; ties keep the map's insertion order.
+			name: "ordered by distance",
+			keys: []string{"host", "hosts", "token", "auth_type"},
+			typo: "host",
+			want: []string{"host", "hosts"},
+		},
+		{
+			name: "no key close enough",
+			keys: []string{"host", "hosts", "token", "auth_type"},
+			typo: "completely_different",
+			want: []string{},
+		},
+		{
+			// Distance-2 substitutions and insertions are both included.
+			name: "distance two included",
+			keys: []string{"profile", "prfile", "prof"},
+			typo: "prfil",
+			want: []string{"prfile", "profile"},
+		},
+		{
+			name: "empty map",
+			keys: nil,
+			typo: "anything",
+			want: []string{},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, suggestKeys(newSuggestMapping(tt.keys...), tt.typo))
+		})
+	}
+}
+
+func TestDidYouMean(t *testing.T) {
+	tests := []struct {
+		name        string
+		suggestions []string
+		want        string
+	}{
+		{"nil", nil, ""},
+		{"empty", []string{}, ""},
+		{"single", []string{"host"}, `, did you mean "host"?`},
+		{"multiple", []string{"host", "hosts"}, `, did you mean one of: "host", "hosts"?`},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, didYouMean(tt.suggestions))
+		})
+	}
+}
+
+func TestSuggestedReferences(t *testing.T) {
+	tests := []struct {
+		name      string
+		err       error
+		reference string
+		want      []string
+	}{
+		{
+			name:      "single suggestion",
+			err:       noSuchKeyError{p: NewPath(Key("variables"), Key("hst")), suggestions: []string{"host"}},
+			reference: "var.hst",
+			want:      []string{"var.host"},
+		},
+		{
+			name:      "multiple suggestions",
+			err:       noSuchKeyError{p: NewPath(Key("variables"), Key("hst")), suggestions: []string{"host", "hosts"}},
+			reference: "var.hst",
+			want:      []string{"var.host", "var.hosts"},
+		},
+		{
+			name:      "nested outer-key typo keeps suffix",
+			err:       noSuchKeyError{p: NewPath(Key("variables"), Key("clustr")), suggestions: []string{"cluster"}},
+			reference: "var.clustr.spark_version",
+			want:      []string{"var.cluster.spark_version"},
+		},
+		{
+			name:      "deep leaf typo keeps prefix",
+			err:       noSuchKeyError{p: NewPath(Key("variables"), Key("cluster"), Key("value"), Key("spark_versio")), suggestions: []string{"spark_version"}},
+			reference: "var.cluster.spark_versio",
+			want:      []string{"var.cluster.spark_version"},
+		},
+		{
+			name:      "index component preserved",
+			err:       noSuchKeyError{p: NewPath(Key("variables"), Key("librariez")), suggestions: []string{"libraries"}},
+			reference: "var.librariez[0].jar",
+			want:      []string{"var.libraries[0].jar"},
+		},
+		{
+			name:      "non-var prefix",
+			err:       noSuchKeyError{p: NewPath(Key("workspace"), Key("stot_path")), suggestions: []string{"root_path", "state_path"}},
+			reference: "workspace.stot_path",
+			want:      []string{"workspace.root_path", "workspace.state_path"},
+		},
+		{
+			name:      "no suggestions",
+			err:       noSuchKeyError{p: NewPath(Key("xyz"))},
+			reference: "var.xyz",
+			want:      nil,
+		},
+		{
+			name:      "other error type",
+			err:       errors.New("some other error"),
+			reference: "var.xyz",
+			want:      nil,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, SuggestedReferences(tt.err, tt.reference))
+		})
+	}
+}
+
+func TestReplaceKeyFallsBackWhenKeyAbsent(t *testing.T) {
+	// The failed key is not present in the reference, so only the replacement
+	// itself is returned rather than a spliced reference.
+	assert.Equal(t, "host", replaceKey("var.foo", "missing", "host"))
+}
diff --git a/libs/dyn/value.go b/libs/dyn/value.go
index e4d72a0b203..8cbd9b801ea 100644
--- a/libs/dyn/value.go
+++ b/libs/dyn/value.go
@@ -4,6 +4,8 @@ import (
 	"fmt"
 	"reflect"
 	"slices"
+
+	"github.com/databricks/cli/libs/diag"
 )
 
 type Value struct {
@@ -14,7 +16,7 @@ type Value struct {
 	// List of locations this value is defined at. The first location in the slice
 	// is the location returned by the `.Location()` method and is typically used
 	// for reporting errors and warnings associated with the value.
-	l []Location
+	l []diag.Location
 
 	// Whether or not this value is an anchor.
 	// If this node doesn't map to a type, we don't need to warn about it.
@@ -37,7 +39,7 @@ func V(v any) Value {
 }
 
 // NewValue constructs a new Value with the given value and location.
-func NewValue(v any, loc []Location) Value {
+func NewValue(v any, loc []diag.Location) Value {
 	switch vin := v.(type) {
 	case map[string]Value:
 		v = newMappingFromGoMap(vin)
@@ -54,7 +56,7 @@ func NewValue(v any, loc []Location) Value {
 }
 
 // WithLocations returns a new Value with its location set to the given value.
-func (v Value) WithLocations(loc []Location) Value {
+func (v Value) WithLocations(loc []diag.Location) Value {
 	return Value{
 		v: v.v,
 		k: v.k,
@@ -81,13 +83,13 @@ func (v Value) Value() any {
 	return v.v
 }
 
-func (v Value) Locations() []Location {
+func (v Value) Locations() []diag.Location {
 	return v.l
 }
 
-func (v Value) Location() Location {
+func (v Value) Location() diag.Location {
 	if len(v.l) == 0 {
-		return Location{}
+		return diag.Location{}
 	}
 
 	return v.l[0]
@@ -206,9 +208,20 @@ func (v Value) eq(w Value) bool {
 
 	switch v.k {
 	case KindMap:
-		// Compare pointers to the underlying map.
+		// Comparing &v.v to &w.v is always false (value receivers), so compare the Mapping's backing storage.
+		vm := v.v.(Mapping)
+		wm := w.v.(Mapping)
+		lv := vm.Len()
+		lw := wm.Len()
+		if lv == 0 && lw == 0 {
+			return true
+		}
+		if lv != lw {
+			return false
+		}
+		// Compare pointers to the underlying pairs slice.
 		// This is safe because we don't allow maps to be mutated.
-		return &v.v == &w.v
+		return &vm.pairs[0] == &wm.pairs[0]
 	case KindSequence:
 		vs := v.v.([]Value)
 		ws := w.v.([]Value)
diff --git a/libs/dyn/value_eq_test.go b/libs/dyn/value_eq_test.go
new file mode 100644
index 00000000000..22fe2df0080
--- /dev/null
+++ b/libs/dyn/value_eq_test.go
@@ -0,0 +1,77 @@
+package dyn
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/diag"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestValueEqMap(t *testing.T) {
+	loc := []diag.Location{{File: "file", Line: 1, Column: 2}}
+	v := NewValue(map[string]Value{"key": V("value")}, loc)
+
+	tests := []struct {
+		name string
+		a, b Value
+		want bool
+	}{
+		{
+			name: "same underlying mapping",
+			a:    v,
+			b:    v,
+			want: true,
+		},
+		{
+			name: "cloned mapping with equal contents",
+			a:    v,
+			b:    Value{v: v.v.(Mapping).Clone(), k: KindMap, l: v.l},
+			want: false,
+		},
+		{
+			name: "different lengths",
+			a:    v,
+			b:    NewValue(map[string]Value{"key": V("value"), "other": V("value")}, loc),
+			want: false,
+		},
+		{
+			name: "different locations",
+			a:    v,
+			b:    v.WithLocations([]diag.Location{{File: "other", Line: 1, Column: 2}}),
+			want: false,
+		},
+		{
+			name: "empty mappings",
+			a:    NewValue(map[string]Value{}, loc),
+			b:    NewValue(map[string]Value{}, loc),
+			want: true,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, tc.a.eq(tc.b))
+		})
+	}
+}
+
+func TestValueEqMapVisitDoesNotRebuildAncestors(t *testing.T) {
+	vin := V(map[string]Value{
+		"a": V(map[string]Value{
+			"b": V("value"),
+		}),
+	})
+
+	vout, err := Map(vin, "a.b", func(_ Path, v Value) (Value, error) {
+		return v, nil
+	})
+	require.NoError(t, err)
+
+	// The identity transform must return the original value without
+	// cloning the ancestor maps.
+	vm := vin.v.(Mapping)
+	wm := vout.v.(Mapping)
+	require.Equal(t, vm.Len(), wm.Len())
+	assert.Same(t, &vm.pairs[0], &wm.pairs[0])
+}
diff --git a/libs/dyn/value_test.go b/libs/dyn/value_test.go
index 8717aae620e..667e2cbdd59 100644
--- a/libs/dyn/value_test.go
+++ b/libs/dyn/value_test.go
@@ -3,6 +3,7 @@ package dyn_test
 import (
 	"testing"
 
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
 	"github.com/stretchr/testify/assert"
 )
@@ -33,9 +34,9 @@ func TestValueAsMap(t *testing.T) {
 		map[string]dyn.Value{
 			"key": dyn.NewValue(
 				"value",
-				[]dyn.Location{{File: "file", Line: 1, Column: 2}}),
+				[]diag.Location{{File: "file", Line: 1, Column: 2}}),
 		},
-		[]dyn.Location{{File: "file", Line: 1, Column: 2}},
+		[]diag.Location{{File: "file", Line: 1, Column: 2}},
 	)
 
 	m, ok := mapValue.AsMap()
diff --git a/libs/dyn/value_underlying_test.go b/libs/dyn/value_underlying_test.go
index 7f9f9184b92..189a49a0ea3 100644
--- a/libs/dyn/value_underlying_test.go
+++ b/libs/dyn/value_underlying_test.go
@@ -4,6 +4,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
 	"github.com/stretchr/testify/assert"
 )
@@ -11,7 +12,7 @@ import (
 func TestValueUnderlyingMap(t *testing.T) {
 	v := dyn.V(
 		map[string]dyn.Value{
-			"key": dyn.NewValue("value", []dyn.Location{{File: "file", Line: 1, Column: 2}}),
+			"key": dyn.NewValue("value", []diag.Location{{File: "file", Line: 1, Column: 2}}),
 		},
 	)
 
@@ -33,7 +34,7 @@ func TestValueUnderlyingMap(t *testing.T) {
 func TestValueUnderlyingSequence(t *testing.T) {
 	v := dyn.V(
 		[]dyn.Value{
-			dyn.NewValue("value", []dyn.Location{{File: "file", Line: 1, Column: 2}}),
+			dyn.NewValue("value", []diag.Location{{File: "file", Line: 1, Column: 2}}),
 		},
 	)
 
diff --git a/libs/dyn/visit.go b/libs/dyn/visit.go
index 1822c7db653..58223e792b9 100644
--- a/libs/dyn/visit.go
+++ b/libs/dyn/visit.go
@@ -24,21 +24,39 @@ func (e cannotTraverseNilError) Error() string {
 }
 
 func IsCannotTraverseNilError(err error) bool {
-	var target cannotTraverseNilError
-	return errors.As(err, &target)
+	_, ok := errors.AsType[cannotTraverseNilError](err)
+	return ok
 }
 
 type noSuchKeyError struct {
-	p Path
+	p           Path
+	suggestions []string
 }
 
 func (e noSuchKeyError) Error() string {
-	return fmt.Sprintf("key not found at %q", e.p)
+	return fmt.Sprintf("key not found at %q%s", e.p, didYouMean(e.suggestions))
 }
 
 func IsNoSuchKeyError(err error) bool {
-	var target noSuchKeyError
-	return errors.As(err, &target)
+	_, ok := errors.AsType[noSuchKeyError](err)
+	return ok
+}
+
+// SuggestedReferences returns drop-in replacement references for a noSuchKeyError
+// (nil otherwise), rebuilt by swapping the failed segment of reference for each
+// suggestion (e.g. "var.hst" -> ["var.host"]).
+func SuggestedReferences(err error, reference string) []string {
+	e, ok := errors.AsType[noSuchKeyError](err)
+	if !ok || len(e.suggestions) == 0 {
+		return nil
+	}
+	// Last component of e.p is the failed key (same in original and rewritten space).
+	failedKey := e.p[len(e.p)-1].Key()
+	refs := make([]string, len(e.suggestions))
+	for i, s := range e.suggestions {
+		refs[i] = replaceKey(reference, failedKey, s)
+	}
+	return refs
 }
 
 type indexOutOfBoundsError struct {
@@ -50,8 +68,8 @@ func (e indexOutOfBoundsError) Error() string {
 }
 
 func IsIndexOutOfBoundsError(err error) bool {
-	var target indexOutOfBoundsError
-	return errors.As(err, &target)
+	_, ok := errors.AsType[indexOutOfBoundsError](err)
+	return ok
 }
 
 type expectedMapToIndexError struct {
@@ -124,7 +142,7 @@ func (c pathComponent) visit(v Value, prefix Path, suffix Pattern, opts visitOpt
 		// Lookup current value in the map.
 		ev, ok := m.GetByString(c.key)
 		if !ok {
-			return InvalidValue, noSuchKeyError{path}
+			return InvalidValue, noSuchKeyError{p: path, suggestions: suggestKeys(m, c.key)}
 		}
 
 		// Recursively transform the value.
diff --git a/libs/dyn/visit_get_test.go b/libs/dyn/visit_get_test.go
index 22dce0858b3..524b4ed5cd9 100644
--- a/libs/dyn/visit_get_test.go
+++ b/libs/dyn/visit_get_test.go
@@ -36,7 +36,14 @@ func TestGetOnMap(t *testing.T) {
 
 	_, err = dyn.GetByPath(vin, dyn.NewPath(dyn.Key("baz")))
 	assert.True(t, dyn.IsNoSuchKeyError(err))
-	assert.ErrorContains(t, err, `key not found at "baz"`)
+	// "baz" is one edit away from "bar", so the error suggests it.
+	assert.ErrorContains(t, err, `key not found at "baz", did you mean "bar"?`)
+
+	// A key that is close to no existing key gets no suggestion.
+	_, err = dyn.GetByPath(vin, dyn.NewPath(dyn.Key("completely_different")))
+	assert.True(t, dyn.IsNoSuchKeyError(err))
+	assert.ErrorContains(t, err, `key not found at "completely_different"`)
+	assert.NotContains(t, err.Error(), "did you mean")
 
 	vfoo, err := dyn.GetByPath(vin, dyn.NewPath(dyn.Key("foo")))
 	assert.NoError(t, err)
diff --git a/libs/dyn/visit_map_test.go b/libs/dyn/visit_map_test.go
index a9ba12145c7..bff4b0bd3f9 100644
--- a/libs/dyn/visit_map_test.go
+++ b/libs/dyn/visit_map_test.go
@@ -371,6 +371,94 @@ func TestMapByPatternOnSequence(t *testing.T) {
 	}, vout.AsAny())
 }
 
+func TestMapByPatternWildcardSkipsNonMatchingSiblings(t *testing.T) {
+	tests := []struct {
+		name    string
+		vin     dyn.Value
+		pattern dyn.Pattern
+		want    any
+		visited []string
+	}{
+		{
+			name: "nil sibling under any key",
+			vin: dyn.V(map[string]dyn.Value{
+				"a": dyn.NilValue,
+				"b": dyn.V(map[string]dyn.Value{"x": dyn.V(1)}),
+			}),
+			pattern: dyn.NewPattern(dyn.AnyKey(), dyn.Key("x")),
+			want: map[string]any{
+				"a": nil,
+				"b": map[string]any{"x": 42},
+			},
+			visited: []string{"b.x"},
+		},
+		{
+			name: "nil sequence sibling under any key",
+			vin: dyn.V(map[string]dyn.Value{
+				"a": dyn.V(map[string]dyn.Value{"tasks": dyn.NilValue}),
+				"b": dyn.V(map[string]dyn.Value{"tasks": dyn.V([]dyn.Value{dyn.V(1)})}),
+			}),
+			pattern: dyn.NewPattern(dyn.AnyKey(), dyn.Key("tasks"), dyn.AnyIndex()),
+			want: map[string]any{
+				"a": map[string]any{"tasks": nil},
+				"b": map[string]any{"tasks": []any{42}},
+			},
+			visited: []string{"b.tasks[0]"},
+		},
+		{
+			name: "wrong kind sibling under any key",
+			vin: dyn.V(map[string]dyn.Value{
+				"a": dyn.V(map[string]dyn.Value{"tasks": dyn.V("oops")}),
+				"b": dyn.V(map[string]dyn.Value{"tasks": dyn.V([]dyn.Value{dyn.V(1)})}),
+			}),
+			pattern: dyn.NewPattern(dyn.AnyKey(), dyn.Key("tasks"), dyn.AnyIndex()),
+			want: map[string]any{
+				"a": map[string]any{"tasks": "oops"},
+				"b": map[string]any{"tasks": []any{42}},
+			},
+			visited: []string{"b.tasks[0]"},
+		},
+		{
+			name: "nil element under any index",
+			vin: dyn.V([]dyn.Value{
+				dyn.NilValue,
+				dyn.V(map[string]dyn.Value{"x": dyn.V(1)}),
+			}),
+			pattern: dyn.NewPattern(dyn.AnyIndex(), dyn.Key("x")),
+			want: []any{
+				nil,
+				map[string]any{"x": 42},
+			},
+			visited: []string{"[1].x"},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			var visited []string
+			vout, err := dyn.MapByPattern(tc.vin, tc.pattern, func(p dyn.Path, v dyn.Value) (dyn.Value, error) {
+				visited = append(visited, p.String())
+				return dyn.V(42), nil
+			})
+			assert.NoError(t, err)
+			assert.Equal(t, tc.want, vout.AsAny())
+			assert.Equal(t, tc.visited, visited)
+		})
+	}
+}
+
+func TestMapByPatternWildcardPropagatesMapFuncError(t *testing.T) {
+	vin := dyn.V(map[string]dyn.Value{
+		"a": dyn.V(map[string]dyn.Value{"x": dyn.V(1)}),
+	})
+
+	ref := errors.New("error")
+	_, err := dyn.MapByPattern(vin, dyn.NewPattern(dyn.AnyKey(), dyn.Key("x")), func(_ dyn.Path, v dyn.Value) (dyn.Value, error) {
+		return dyn.InvalidValue, ref
+	})
+	assert.ErrorIs(t, err, ref)
+}
+
 func TestMapByPatternOnSequenceWithoutMatch(t *testing.T) {
 	vin := dyn.V([]dyn.Value{
 		dyn.V([]dyn.Value{
diff --git a/libs/dyn/walk.go b/libs/dyn/walk.go
index af03ef27743..08123cf85e9 100644
--- a/libs/dyn/walk.go
+++ b/libs/dyn/walk.go
@@ -25,7 +25,7 @@ func Walk(v Value, fn func(p Path, v Value) (Value, error)) (Value, error) {
 func walk(v Value, p Path, fn func(p Path, v Value) (Value, error)) (Value, error) {
 	v, err := fn(p, v)
 	if err != nil {
-		if err == ErrSkip {
+		if errors.Is(err, ErrSkip) {
 			return v, nil
 		}
 		return InvalidValue, err
@@ -39,7 +39,7 @@ func walk(v Value, p Path, fn func(p Path, v Value) (Value, error)) (Value, erro
 			pk := pair.Key
 			pv := pair.Value
 			nv, err := walk(pv, append(p, Key(pk.MustString())), fn)
-			if err == ErrDrop {
+			if errors.Is(err, ErrDrop) {
 				continue
 			}
 			if err != nil {
@@ -53,7 +53,7 @@ func walk(v Value, p Path, fn func(p Path, v Value) (Value, error)) (Value, erro
 		out := make([]Value, 0, len(s))
 		for i := range s {
 			nv, err := walk(s[i], append(p, Index(i)), fn)
-			if err == ErrDrop {
+			if errors.Is(err, ErrDrop) {
 				continue
 			}
 			if err != nil {
diff --git a/libs/dyn/walk_read_only.go b/libs/dyn/walk_read_only.go
index caead36289e..8f8d15e06ea 100644
--- a/libs/dyn/walk_read_only.go
+++ b/libs/dyn/walk_read_only.go
@@ -1,5 +1,7 @@
 package dyn
 
+import "errors"
+
 // WalkReadOnly walks the configuration tree in readonly mode and calls the given function on each node.
 // The callback may return ErrSkip to skip traversal of a subtree.
 // If the callback returns another error, the walk is aborted, and the error is returned.
@@ -12,7 +14,7 @@ func WalkReadOnly(v Value, fn func(p Path, v Value) error) error {
 // such that it can be passed to the callback function.
 func walkReadOnly(v Value, p Path, fn func(p Path, v Value) error) error {
 	if err := fn(p, v); err != nil {
-		if err == ErrSkip {
+		if errors.Is(err, ErrSkip) {
 			return nil
 		}
 		return err
diff --git a/libs/dyn/yamlloader/loader.go b/libs/dyn/yamlloader/loader.go
index 7ff4303d8ee..aebbf0883e9 100644
--- a/libs/dyn/yamlloader/loader.go
+++ b/libs/dyn/yamlloader/loader.go
@@ -6,6 +6,7 @@ import (
 	"strconv"
 	"strings"
 
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
 	"go.yaml.in/yaml/v3"
 )
@@ -13,7 +14,7 @@ import (
 // LocationError is an error with a YAML source location that can be displayed
 // to the user with a file path, line, and column number.
 type LocationError struct {
-	Loc     dyn.Location
+	Loc     diag.Location
 	Summary string
 }
 
@@ -23,20 +24,26 @@ func (e *LocationError) Error() string {
 
 type loader struct {
 	path string
+
+	// Aliases currently being expanded. A self-referential anchor (e.g.
+	// "a: &x {b: *x}") makes the yaml.v3 node graph cyclic; without this
+	// bookkeeping, expansion would recurse until stack overflow.
+	activeAliases map[*yaml.Node]bool
 }
 
-func errorf(loc dyn.Location, format string, args ...any) error {
+func errorf(loc diag.Location, format string, args ...any) error {
 	return fmt.Errorf("yaml (%s): %s", loc, fmt.Sprintf(format, args...))
 }
 
 func newLoader(path string) *loader {
 	return &loader{
-		path: path,
+		path:          path,
+		activeAliases: make(map[*yaml.Node]bool),
 	}
 }
 
-func (d *loader) location(node *yaml.Node) dyn.Location {
-	return dyn.Location{
+func (d *loader) location(node *yaml.Node) diag.Location {
+	return diag.Location{
 		File:   d.path,
 		Line:   node.Line,
 		Column: node.Column,
@@ -44,7 +51,7 @@ func (d *loader) location(node *yaml.Node) dyn.Location {
 }
 
 func (d *loader) load(node *yaml.Node) (dyn.Value, error) {
-	loc := dyn.Location{
+	loc := diag.Location{
 		File:   d.path,
 		Line:   node.Line,
 		Column: node.Column,
@@ -81,11 +88,11 @@ func (d *loader) load(node *yaml.Node) (dyn.Value, error) {
 	return value, nil
 }
 
-func (d *loader) loadDocument(node *yaml.Node, loc dyn.Location) (dyn.Value, error) {
+func (d *loader) loadDocument(node *yaml.Node, loc diag.Location) (dyn.Value, error) {
 	return d.load(node.Content[0])
 }
 
-func (d *loader) loadSequence(node *yaml.Node, loc dyn.Location) (dyn.Value, error) {
+func (d *loader) loadSequence(node *yaml.Node, loc diag.Location) (dyn.Value, error) {
 	acc := make([]dyn.Value, len(node.Content))
 	for i, n := range node.Content {
 		v, err := d.load(n)
@@ -96,10 +103,10 @@ func (d *loader) loadSequence(node *yaml.Node, loc dyn.Location) (dyn.Value, err
 		acc[i] = v
 	}
 
-	return dyn.NewValue(acc, []dyn.Location{loc}), nil
+	return dyn.NewValue(acc, []diag.Location{loc}), nil
 }
 
-func (d *loader) loadMapping(node *yaml.Node, loc dyn.Location) (dyn.Value, error) {
+func (d *loader) loadMapping(node *yaml.Node, loc diag.Location) (dyn.Value, error) {
 	var merge *yaml.Node
 
 	acc := dyn.NewMapping()
@@ -134,7 +141,7 @@ func (d *loader) loadMapping(node *yaml.Node, loc dyn.Location) (dyn.Value, erro
 			return dyn.InvalidValue, errorf(loc, "invalid key tag: %v", st)
 		}
 
-		loc := []dyn.Location{{
+		loc := []diag.Location{{
 			File:   d.path,
 			Line:   key.Line,
 			Column: key.Column,
@@ -149,7 +156,7 @@ func (d *loader) loadMapping(node *yaml.Node, loc dyn.Location) (dyn.Value, erro
 	}
 
 	if merge == nil {
-		return dyn.NewValue(acc, []dyn.Location{loc}), nil
+		return dyn.NewValue(acc, []diag.Location{loc}), nil
 	}
 
 	// Build location for the merge node.
@@ -190,28 +197,28 @@ func (d *loader) loadMapping(node *yaml.Node, loc dyn.Location) (dyn.Value, erro
 		out.Merge(m)
 	}
 
-	return dyn.NewValue(out, []dyn.Location{loc}), nil
+	return dyn.NewValue(out, []diag.Location{loc}), nil
 }
 
-func newIntValue(i64 int64, loc dyn.Location) dyn.Value {
+func newIntValue(i64 int64, loc diag.Location) dyn.Value {
 	// Use regular int type instead of int64 if possible.
 	if i64 >= math.MinInt32 && i64 <= math.MaxInt32 {
-		return dyn.NewValue(int(i64), []dyn.Location{loc})
+		return dyn.NewValue(int(i64), []diag.Location{loc})
 	}
-	return dyn.NewValue(i64, []dyn.Location{loc})
+	return dyn.NewValue(i64, []diag.Location{loc})
 }
 
-func (d *loader) loadScalar(node *yaml.Node, loc dyn.Location) (dyn.Value, error) {
+func (d *loader) loadScalar(node *yaml.Node, loc diag.Location) (dyn.Value, error) {
 	st := node.ShortTag()
 	switch st {
 	case "!!str":
-		return dyn.NewValue(node.Value, []dyn.Location{loc}), nil
+		return dyn.NewValue(node.Value, []diag.Location{loc}), nil
 	case "!!bool":
 		switch strings.ToLower(node.Value) {
 		case "true":
-			return dyn.NewValue(true, []dyn.Location{loc}), nil
+			return dyn.NewValue(true, []diag.Location{loc}), nil
 		case "false":
-			return dyn.NewValue(false, []dyn.Location{loc}), nil
+			return dyn.NewValue(false, []diag.Location{loc}), nil
 		default:
 			return dyn.InvalidValue, errorf(loc, "invalid bool value: %v", node.Value)
 		}
@@ -249,20 +256,20 @@ func (d *loader) loadScalar(node *yaml.Node, loc dyn.Location) (dyn.Value, error
 			// Deal with infinity and NaN values.
 			switch v {
 			case ".inf":
-				return dyn.NewValue(f64, []dyn.Location{loc}), nil
+				return dyn.NewValue(f64, []diag.Location{loc}), nil
 			case ".nan":
-				return dyn.NewValue(math.NaN(), []dyn.Location{loc}), nil
+				return dyn.NewValue(math.NaN(), []diag.Location{loc}), nil
 			}
 
 			return dyn.InvalidValue, errorf(loc, "invalid float value: %v", node.Value)
 		}
-		return dyn.NewValue(f64, []dyn.Location{loc}), nil
+		return dyn.NewValue(f64, []diag.Location{loc}), nil
 	case "!!null":
-		return dyn.NewValue(nil, []dyn.Location{loc}), nil
+		return dyn.NewValue(nil, []diag.Location{loc}), nil
 	case "!!timestamp":
 		t, err := dyn.NewTime(node.Value)
 		if err == nil {
-			return dyn.NewValue(t, []dyn.Location{loc}), nil
+			return dyn.NewValue(t, []diag.Location{loc}), nil
 		}
 		return dyn.InvalidValue, errorf(loc, "invalid timestamp value: %v", node.Value)
 	default:
@@ -270,6 +277,15 @@ func (d *loader) loadScalar(node *yaml.Node, loc dyn.Location) (dyn.Value, error
 	}
 }
 
-func (d *loader) loadAlias(node *yaml.Node, loc dyn.Location) (dyn.Value, error) {
+func (d *loader) loadAlias(node *yaml.Node, loc diag.Location) (dyn.Value, error) {
+	if d.activeAliases[node] {
+		return dyn.InvalidValue, errorf(loc, "cyclic reference to anchor %q", node.Value)
+	}
+
+	// The same alias node may be reached again through another alias to an
+	// enclosing anchor, which is not a cycle.
+	d.activeAliases[node] = true
+	defer delete(d.activeAliases, node)
+
 	return d.load(node.Alias)
 }
diff --git a/libs/dyn/yamlloader/testdata/anchor_09.yml b/libs/dyn/yamlloader/testdata/anchor_09.yml
new file mode 100644
index 00000000000..8005bf445ef
--- /dev/null
+++ b/libs/dyn/yamlloader/testdata/anchor_09.yml
@@ -0,0 +1,2 @@
+anchortest: &x
+  child: *x
diff --git a/libs/dyn/yamlloader/testdata/anchor_10.yml b/libs/dyn/yamlloader/testdata/anchor_10.yml
new file mode 100644
index 00000000000..013832ab3ac
--- /dev/null
+++ b/libs/dyn/yamlloader/testdata/anchor_10.yml
@@ -0,0 +1,5 @@
+leaf: &leaf 1
+shared: &shared
+  value: *leaf
+use1: *shared
+use2: *shared
diff --git a/libs/dyn/yamlloader/yaml.go b/libs/dyn/yamlloader/yaml.go
index 1225fcc7e2f..29570747ab1 100644
--- a/libs/dyn/yamlloader/yaml.go
+++ b/libs/dyn/yamlloader/yaml.go
@@ -1,6 +1,7 @@
 package yamlloader
 
 import (
+	"errors"
 	"io"
 
 	"github.com/databricks/cli/libs/dyn"
@@ -12,7 +13,7 @@ func LoadYAML(path string, r io.Reader) (dyn.Value, error) {
 	dec := yaml.NewDecoder(r)
 	err := dec.Decode(&node)
 	if err != nil {
-		if err == io.EOF {
+		if errors.Is(err, io.EOF) {
 			return dyn.NilValue, nil
 		}
 		return dyn.InvalidValue, err
diff --git a/libs/dyn/yamlloader/yaml_anchor_test.go b/libs/dyn/yamlloader/yaml_anchor_test.go
index 05beb5401d8..00f4576a3e2 100644
--- a/libs/dyn/yamlloader/yaml_anchor_test.go
+++ b/libs/dyn/yamlloader/yaml_anchor_test.go
@@ -1,10 +1,15 @@
 package yamlloader_test
 
 import (
+	"bytes"
+	"os"
 	"testing"
 
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/dyn/yamlloader"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestYAMLAnchor01(t *testing.T) {
@@ -18,7 +23,7 @@ func TestYAMLAnchor01(t *testing.T) {
 
 	pattern := self.Get("shirt1").Get("pattern")
 	assert.Equal(t, "striped", pattern.AsAny())
-	assert.Equal(t, dyn.Location{File: file, Line: 8, Column: 12}, pattern.Location())
+	assert.Equal(t, diag.Location{File: file, Line: 8, Column: 12}, pattern.Location())
 }
 
 func TestYAMLAnchor02(t *testing.T) {
@@ -28,15 +33,15 @@ func TestYAMLAnchor02(t *testing.T) {
 
 	color := self.Get("shirt").Get("color")
 	assert.Equal(t, "red", color.AsAny())
-	assert.Equal(t, dyn.Location{File: file, Line: 4, Column: 10}, color.Location())
+	assert.Equal(t, diag.Location{File: file, Line: 4, Column: 10}, color.Location())
 
 	primary := self.Get("shirt").Get("primary")
 	assert.Equal(t, "cotton", primary.AsAny())
-	assert.Equal(t, dyn.Location{File: file, Line: 8, Column: 12}, primary.Location())
+	assert.Equal(t, diag.Location{File: file, Line: 8, Column: 12}, primary.Location())
 
 	pattern := self.Get("shirt").Get("pattern")
 	assert.Equal(t, "striped", pattern.AsAny())
-	assert.Equal(t, dyn.Location{File: file, Line: 13, Column: 12}, pattern.Location())
+	assert.Equal(t, diag.Location{File: file, Line: 13, Column: 12}, pattern.Location())
 }
 
 func TestYAMLAnchor03(t *testing.T) {
@@ -59,11 +64,11 @@ func TestYAMLAnchor04(t *testing.T) {
 
 	p1 := self.Get("person1").Get("address").Get("city")
 	assert.Equal(t, "San Francisco", p1.AsAny())
-	assert.Equal(t, dyn.Location{File: file, Line: 4, Column: 9}, p1.Location())
+	assert.Equal(t, diag.Location{File: file, Line: 4, Column: 9}, p1.Location())
 
 	p2 := self.Get("person2").Get("address").Get("city")
 	assert.Equal(t, "Los Angeles", p2.AsAny())
-	assert.Equal(t, dyn.Location{File: file, Line: 16, Column: 11}, p2.Location())
+	assert.Equal(t, diag.Location{File: file, Line: 16, Column: 11}, p2.Location())
 }
 
 func TestYAMLAnchor05(t *testing.T) {
@@ -73,9 +78,9 @@ func TestYAMLAnchor05(t *testing.T) {
 
 	features := self.Get("phone1").Get("features")
 	assert.Equal(t, "wifi", features.Index(0).AsAny())
-	assert.Equal(t, dyn.Location{File: file, Line: 4, Column: 5}, features.Index(0).Location())
+	assert.Equal(t, diag.Location{File: file, Line: 4, Column: 5}, features.Index(0).Location())
 	assert.Equal(t, "bluetooth", features.Index(1).AsAny())
-	assert.Equal(t, dyn.Location{File: file, Line: 5, Column: 5}, features.Index(1).Location())
+	assert.Equal(t, diag.Location{File: file, Line: 5, Column: 5}, features.Index(1).Location())
 }
 
 func TestYAMLAnchor06(t *testing.T) {
@@ -85,7 +90,7 @@ func TestYAMLAnchor06(t *testing.T) {
 
 	greeting := self.Get("greeting1")
 	assert.Equal(t, "Hello, World!", greeting.AsAny())
-	assert.Equal(t, dyn.Location{File: file, Line: 2, Column: 16}, greeting.Location())
+	assert.Equal(t, diag.Location{File: file, Line: 2, Column: 16}, greeting.Location())
 }
 
 func TestYAMLAnchor07(t *testing.T) {
@@ -95,11 +100,11 @@ func TestYAMLAnchor07(t *testing.T) {
 
 	name := self.Get("person1").Get("name")
 	assert.Equal(t, "Alice", name.AsAny())
-	assert.Equal(t, dyn.Location{File: file, Line: 5, Column: 9}, name.Location())
+	assert.Equal(t, diag.Location{File: file, Line: 5, Column: 9}, name.Location())
 
 	age := self.Get("person1").Get("age")
 	assert.Equal(t, 25, age.AsAny())
-	assert.Equal(t, dyn.Location{File: file, Line: 2, Column: 13}, age.Location())
+	assert.Equal(t, diag.Location{File: file, Line: 2, Column: 13}, age.Location())
 }
 
 func TestYAMLAnchor08(t *testing.T) {
@@ -109,9 +114,27 @@ func TestYAMLAnchor08(t *testing.T) {
 
 	username := self.Get("user1").Get("username")
 	assert.Equal(t, "user1", username.AsAny())
-	assert.Equal(t, dyn.Location{File: file, Line: 5, Column: 13}, username.Location())
+	assert.Equal(t, diag.Location{File: file, Line: 5, Column: 13}, username.Location())
 
 	active := self.Get("user1").Get("active")
 	assert.Equal(t, true, active.AsAny())
-	assert.Equal(t, dyn.Location{File: file, Line: 2, Column: 11}, active.Location())
+	assert.Equal(t, diag.Location{File: file, Line: 2, Column: 11}, active.Location())
+}
+
+func TestYAMLAnchor09(t *testing.T) {
+	file := "testdata/anchor_09.yml"
+	input, err := os.ReadFile(file)
+	require.NoError(t, err)
+
+	_, err = yamlloader.LoadYAML(file, bytes.NewBuffer(input))
+	assert.ErrorContains(t, err, `cyclic reference to anchor "x"`)
+}
+
+func TestYAMLAnchor10(t *testing.T) {
+	file := "testdata/anchor_10.yml"
+	self := loadYAML(t, file)
+	assert.NotEqual(t, dyn.NilValue, self)
+
+	assert.Equal(t, 1, self.Get("use1").Get("value").AsAny())
+	assert.Equal(t, 1, self.Get("use2").Get("value").AsAny())
 }
diff --git a/libs/dyn/yamlloader/yaml_spec_test.go b/libs/dyn/yamlloader/yaml_spec_test.go
index 9501409c92f..28ad2e7480c 100644
--- a/libs/dyn/yamlloader/yaml_spec_test.go
+++ b/libs/dyn/yamlloader/yaml_spec_test.go
@@ -6,6 +6,7 @@ import (
 	"os"
 	"testing"
 
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/cli/libs/dyn/dynassert"
 	"github.com/databricks/cli/libs/dyn/yamlloader"
@@ -29,11 +30,11 @@ func TestYAMLSpecExample_2_1(t *testing.T) {
 
 	assert.Equal(t, dyn.NewValue(
 		[]dyn.Value{
-			dyn.NewValue("Mark McGwire", []dyn.Location{{File: file, Line: 3, Column: 3}}),
-			dyn.NewValue("Sammy Sosa", []dyn.Location{{File: file, Line: 4, Column: 3}}),
-			dyn.NewValue("Ken Griffey", []dyn.Location{{File: file, Line: 5, Column: 3}}),
+			dyn.NewValue("Mark McGwire", []diag.Location{{File: file, Line: 3, Column: 3}}),
+			dyn.NewValue("Sammy Sosa", []diag.Location{{File: file, Line: 4, Column: 3}}),
+			dyn.NewValue("Ken Griffey", []diag.Location{{File: file, Line: 5, Column: 3}}),
 		},
-		[]dyn.Location{{File: file, Line: 3, Column: 1}},
+		[]diag.Location{{File: file, Line: 3, Column: 1}},
 	), self)
 }
 
@@ -43,11 +44,11 @@ func TestYAMLSpecExample_2_2(t *testing.T) {
 
 	dynassert.Equal(t, dyn.NewValue(
 		map[string]dyn.Value{
-			"hr":  dyn.NewValue(65, []dyn.Location{{File: file, Line: 3, Column: 6}}),
-			"avg": dyn.NewValue(0.278, []dyn.Location{{File: file, Line: 4, Column: 6}}),
-			"rbi": dyn.NewValue(147, []dyn.Location{{File: file, Line: 5, Column: 6}}),
+			"hr":  dyn.NewValue(65, []diag.Location{{File: file, Line: 3, Column: 6}}),
+			"avg": dyn.NewValue(0.278, []diag.Location{{File: file, Line: 4, Column: 6}}),
+			"rbi": dyn.NewValue(147, []diag.Location{{File: file, Line: 5, Column: 6}}),
 		},
-		[]dyn.Location{{File: file, Line: 3, Column: 1}},
+		[]diag.Location{{File: file, Line: 3, Column: 1}},
 	), self)
 }
 
@@ -59,22 +60,22 @@ func TestYAMLSpecExample_2_3(t *testing.T) {
 		map[string]dyn.Value{
 			"american": dyn.NewValue(
 				[]dyn.Value{
-					dyn.NewValue("Boston Red Sox", []dyn.Location{{File: file, Line: 4, Column: 3}}),
-					dyn.NewValue("Detroit Tigers", []dyn.Location{{File: file, Line: 5, Column: 3}}),
-					dyn.NewValue("New York Yankees", []dyn.Location{{File: file, Line: 6, Column: 3}}),
+					dyn.NewValue("Boston Red Sox", []diag.Location{{File: file, Line: 4, Column: 3}}),
+					dyn.NewValue("Detroit Tigers", []diag.Location{{File: file, Line: 5, Column: 3}}),
+					dyn.NewValue("New York Yankees", []diag.Location{{File: file, Line: 6, Column: 3}}),
 				},
-				[]dyn.Location{{File: file, Line: 4, Column: 1}},
+				[]diag.Location{{File: file, Line: 4, Column: 1}},
 			),
 			"national": dyn.NewValue(
 				[]dyn.Value{
-					dyn.NewValue("New York Mets", []dyn.Location{{File: file, Line: 8, Column: 3}}),
-					dyn.NewValue("Chicago Cubs", []dyn.Location{{File: file, Line: 9, Column: 3}}),
-					dyn.NewValue("Atlanta Braves", []dyn.Location{{File: file, Line: 10, Column: 3}}),
+					dyn.NewValue("New York Mets", []diag.Location{{File: file, Line: 8, Column: 3}}),
+					dyn.NewValue("Chicago Cubs", []diag.Location{{File: file, Line: 9, Column: 3}}),
+					dyn.NewValue("Atlanta Braves", []diag.Location{{File: file, Line: 10, Column: 3}}),
 				},
-				[]dyn.Location{{File: file, Line: 8, Column: 1}},
+				[]diag.Location{{File: file, Line: 8, Column: 1}},
 			),
 		},
-		[]dyn.Location{{File: file, Line: 3, Column: 1}},
+		[]diag.Location{{File: file, Line: 3, Column: 1}},
 	), self)
 }
 
@@ -86,22 +87,22 @@ func TestYAMLSpecExample_2_4(t *testing.T) {
 		[]dyn.Value{
 			dyn.NewValue(
 				map[string]dyn.Value{
-					"name": dyn.NewValue("Mark McGwire", []dyn.Location{{File: file, Line: 4, Column: 9}}),
-					"hr":   dyn.NewValue(65, []dyn.Location{{File: file, Line: 5, Column: 9}}),
-					"avg":  dyn.NewValue(0.278, []dyn.Location{{File: file, Line: 6, Column: 9}}),
+					"name": dyn.NewValue("Mark McGwire", []diag.Location{{File: file, Line: 4, Column: 9}}),
+					"hr":   dyn.NewValue(65, []diag.Location{{File: file, Line: 5, Column: 9}}),
+					"avg":  dyn.NewValue(0.278, []diag.Location{{File: file, Line: 6, Column: 9}}),
 				},
-				[]dyn.Location{{File: file, Line: 4, Column: 3}},
+				[]diag.Location{{File: file, Line: 4, Column: 3}},
 			),
 			dyn.NewValue(
 				map[string]dyn.Value{
-					"name": dyn.NewValue("Sammy Sosa", []dyn.Location{{File: file, Line: 8, Column: 9}}),
-					"hr":   dyn.NewValue(63, []dyn.Location{{File: file, Line: 9, Column: 9}}),
-					"avg":  dyn.NewValue(0.288, []dyn.Location{{File: file, Line: 10, Column: 9}}),
+					"name": dyn.NewValue("Sammy Sosa", []diag.Location{{File: file, Line: 8, Column: 9}}),
+					"hr":   dyn.NewValue(63, []diag.Location{{File: file, Line: 9, Column: 9}}),
+					"avg":  dyn.NewValue(0.288, []diag.Location{{File: file, Line: 10, Column: 9}}),
 				},
-				[]dyn.Location{{File: file, Line: 8, Column: 3}},
+				[]diag.Location{{File: file, Line: 8, Column: 3}},
 			),
 		},
-		[]dyn.Location{{File: file, Line: 3, Column: 1}},
+		[]diag.Location{{File: file, Line: 3, Column: 1}},
 	), self)
 }
 
@@ -113,30 +114,30 @@ func TestYAMLSpecExample_2_5(t *testing.T) {
 		[]dyn.Value{
 			dyn.NewValue(
 				[]dyn.Value{
-					dyn.NewValue("name", []dyn.Location{{File: file, Line: 3, Column: 4}}),
-					dyn.NewValue("hr", []dyn.Location{{File: file, Line: 3, Column: 18}}),
-					dyn.NewValue("avg", []dyn.Location{{File: file, Line: 3, Column: 22}}),
+					dyn.NewValue("name", []diag.Location{{File: file, Line: 3, Column: 4}}),
+					dyn.NewValue("hr", []diag.Location{{File: file, Line: 3, Column: 18}}),
+					dyn.NewValue("avg", []diag.Location{{File: file, Line: 3, Column: 22}}),
 				},
-				[]dyn.Location{{File: file, Line: 3, Column: 3}},
+				[]diag.Location{{File: file, Line: 3, Column: 3}},
 			),
 			dyn.NewValue(
 				[]dyn.Value{
-					dyn.NewValue("Mark McGwire", []dyn.Location{{File: file, Line: 4, Column: 4}}),
-					dyn.NewValue(65, []dyn.Location{{File: file, Line: 4, Column: 18}}),
-					dyn.NewValue(0.278, []dyn.Location{{File: file, Line: 4, Column: 22}}),
+					dyn.NewValue("Mark McGwire", []diag.Location{{File: file, Line: 4, Column: 4}}),
+					dyn.NewValue(65, []diag.Location{{File: file, Line: 4, Column: 18}}),
+					dyn.NewValue(0.278, []diag.Location{{File: file, Line: 4, Column: 22}}),
 				},
-				[]dyn.Location{{File: file, Line: 4, Column: 3}},
+				[]diag.Location{{File: file, Line: 4, Column: 3}},
 			),
 			dyn.NewValue(
 				[]dyn.Value{
-					dyn.NewValue("Sammy Sosa", []dyn.Location{{File: file, Line: 5, Column: 4}}),
-					dyn.NewValue(63, []dyn.Location{{File: file, Line: 5, Column: 18}}),
-					dyn.NewValue(0.288, []dyn.Location{{File: file, Line: 5, Column: 22}}),
+					dyn.NewValue("Sammy Sosa", []diag.Location{{File: file, Line: 5, Column: 4}}),
+					dyn.NewValue(63, []diag.Location{{File: file, Line: 5, Column: 18}}),
+					dyn.NewValue(0.288, []diag.Location{{File: file, Line: 5, Column: 22}}),
 				},
-				[]dyn.Location{{File: file, Line: 5, Column: 3}},
+				[]diag.Location{{File: file, Line: 5, Column: 3}},
 			),
 		},
-		[]dyn.Location{{File: file, Line: 3, Column: 1}},
+		[]diag.Location{{File: file, Line: 3, Column: 1}},
 	), self)
 }
 
@@ -148,20 +149,20 @@ func TestYAMLSpecExample_2_6(t *testing.T) {
 		map[string]dyn.Value{
 			"Mark McGwire": dyn.NewValue(
 				map[string]dyn.Value{
-					"hr":  dyn.NewValue(65, []dyn.Location{{File: file, Line: 3, Column: 20}}),
-					"avg": dyn.NewValue(0.278, []dyn.Location{{File: file, Line: 3, Column: 29}}),
+					"hr":  dyn.NewValue(65, []diag.Location{{File: file, Line: 3, Column: 20}}),
+					"avg": dyn.NewValue(0.278, []diag.Location{{File: file, Line: 3, Column: 29}}),
 				},
-				[]dyn.Location{{File: file, Line: 3, Column: 15}},
+				[]diag.Location{{File: file, Line: 3, Column: 15}},
 			),
 			"Sammy Sosa": dyn.NewValue(
 				map[string]dyn.Value{
-					"hr":  dyn.NewValue(63, []dyn.Location{{File: file, Line: 5, Column: 9}}),
-					"avg": dyn.NewValue(0.288, []dyn.Location{{File: file, Line: 6, Column: 10}}),
+					"hr":  dyn.NewValue(63, []diag.Location{{File: file, Line: 5, Column: 9}}),
+					"avg": dyn.NewValue(0.288, []diag.Location{{File: file, Line: 6, Column: 10}}),
 				},
-				[]dyn.Location{{File: file, Line: 4, Column: 13}},
+				[]diag.Location{{File: file, Line: 4, Column: 13}},
 			),
 		},
-		[]dyn.Location{{File: file, Line: 3, Column: 1}},
+		[]diag.Location{{File: file, Line: 3, Column: 1}},
 	), self)
 }
 
@@ -175,18 +176,18 @@ func TestYAMLSpecExample_2_7(t *testing.T) {
 		[]dyn.Value{
 			dyn.NewValue(
 				"Mark McGwire",
-				[]dyn.Location{{File: file, Line: 5, Column: 3}},
+				[]diag.Location{{File: file, Line: 5, Column: 3}},
 			),
 			dyn.NewValue(
 				"Sammy Sosa",
-				[]dyn.Location{{File: file, Line: 6, Column: 3}},
+				[]diag.Location{{File: file, Line: 6, Column: 3}},
 			),
 			dyn.NewValue(
 				"Ken Griffey",
-				[]dyn.Location{{File: file, Line: 7, Column: 3}},
+				[]diag.Location{{File: file, Line: 7, Column: 3}},
 			),
 		},
-		[]dyn.Location{{File: file, Line: 5, Column: 1}},
+		[]diag.Location{{File: file, Line: 5, Column: 1}},
 	), self)
 }
 
@@ -198,11 +199,11 @@ func TestYAMLSpecExample_2_8(t *testing.T) {
 
 	dynassert.Equal(t, dyn.NewValue(
 		map[string]dyn.Value{
-			"time":   dyn.NewValue("20:03:20", []dyn.Location{{File: file, Line: 4, Column: 7}}),
-			"player": dyn.NewValue("Sammy Sosa", []dyn.Location{{File: file, Line: 5, Column: 9}}),
-			"action": dyn.NewValue("strike (miss)", []dyn.Location{{File: file, Line: 6, Column: 9}}),
+			"time":   dyn.NewValue("20:03:20", []diag.Location{{File: file, Line: 4, Column: 7}}),
+			"player": dyn.NewValue("Sammy Sosa", []diag.Location{{File: file, Line: 5, Column: 9}}),
+			"action": dyn.NewValue("strike (miss)", []diag.Location{{File: file, Line: 6, Column: 9}}),
 		},
-		[]dyn.Location{{File: file, Line: 4, Column: 1}},
+		[]diag.Location{{File: file, Line: 4, Column: 1}},
 	), self)
 }
 
@@ -216,20 +217,20 @@ func TestYAMLSpecExample_2_9(t *testing.T) {
 		map[string]dyn.Value{
 			"hr": dyn.NewValue(
 				[]dyn.Value{
-					dyn.NewValue("Mark McGwire", []dyn.Location{{File: file, Line: 5, Column: 3}}),
-					dyn.NewValue("Sammy Sosa", []dyn.Location{{File: file, Line: 6, Column: 3}}),
+					dyn.NewValue("Mark McGwire", []diag.Location{{File: file, Line: 5, Column: 3}}),
+					dyn.NewValue("Sammy Sosa", []diag.Location{{File: file, Line: 6, Column: 3}}),
 				},
-				[]dyn.Location{{File: file, Line: 5, Column: 1}},
+				[]diag.Location{{File: file, Line: 5, Column: 1}},
 			),
 			"rbi": dyn.NewValue(
 				[]dyn.Value{
-					dyn.NewValue("Sammy Sosa", []dyn.Location{{File: file, Line: 9, Column: 3}}),
-					dyn.NewValue("Ken Griffey", []dyn.Location{{File: file, Line: 10, Column: 3}}),
+					dyn.NewValue("Sammy Sosa", []diag.Location{{File: file, Line: 9, Column: 3}}),
+					dyn.NewValue("Ken Griffey", []diag.Location{{File: file, Line: 10, Column: 3}}),
 				},
-				[]dyn.Location{{File: file, Line: 9, Column: 1}},
+				[]diag.Location{{File: file, Line: 9, Column: 1}},
 			),
 		},
-		[]dyn.Location{{File: file, Line: 4, Column: 1}},
+		[]diag.Location{{File: file, Line: 4, Column: 1}},
 	), self)
 }
 
@@ -241,22 +242,22 @@ func TestYAMLSpecExample_2_10(t *testing.T) {
 		map[string]dyn.Value{
 			"hr": dyn.NewValue(
 				[]dyn.Value{
-					dyn.NewValue("Mark McGwire", []dyn.Location{{File: file, Line: 5, Column: 3}}),
-					dyn.NewValue("Sammy Sosa", []dyn.Location{{File: file, Line: 7, Column: 3}}),
+					dyn.NewValue("Mark McGwire", []diag.Location{{File: file, Line: 5, Column: 3}}),
+					dyn.NewValue("Sammy Sosa", []diag.Location{{File: file, Line: 7, Column: 3}}),
 				},
-				[]dyn.Location{{File: file, Line: 5, Column: 1}},
+				[]diag.Location{{File: file, Line: 5, Column: 1}},
 			),
 			"rbi": dyn.NewValue(
 				[]dyn.Value{
 					// The location for an anchored value refers to the anchor, not the reference.
 					// This is the same location as the anchor that appears in the "hr" mapping.
-					dyn.NewValue("Sammy Sosa", []dyn.Location{{File: file, Line: 7, Column: 3}}),
-					dyn.NewValue("Ken Griffey", []dyn.Location{{File: file, Line: 10, Column: 3}}),
+					dyn.NewValue("Sammy Sosa", []diag.Location{{File: file, Line: 7, Column: 3}}),
+					dyn.NewValue("Ken Griffey", []diag.Location{{File: file, Line: 10, Column: 3}}),
 				},
-				[]dyn.Location{{File: file, Line: 9, Column: 1}},
+				[]diag.Location{{File: file, Line: 9, Column: 1}},
 			),
 		},
-		[]dyn.Location{{File: file, Line: 4, Column: 1}},
+		[]diag.Location{{File: file, Line: 4, Column: 1}},
 	), self)
 }
 
@@ -278,27 +279,27 @@ func TestYAMLSpecExample_2_12(t *testing.T) {
 		[]dyn.Value{
 			dyn.NewValue(
 				map[string]dyn.Value{
-					"item":     dyn.NewValue("Super Hoop", []dyn.Location{{File: file, Line: 5, Column: 13}}),
-					"quantity": dyn.NewValue(1, []dyn.Location{{File: file, Line: 6, Column: 13}}),
+					"item":     dyn.NewValue("Super Hoop", []diag.Location{{File: file, Line: 5, Column: 13}}),
+					"quantity": dyn.NewValue(1, []diag.Location{{File: file, Line: 6, Column: 13}}),
 				},
-				[]dyn.Location{{File: file, Line: 5, Column: 3}},
+				[]diag.Location{{File: file, Line: 5, Column: 3}},
 			),
 			dyn.NewValue(
 				map[string]dyn.Value{
-					"item":     dyn.NewValue("Basketball", []dyn.Location{{File: file, Line: 7, Column: 13}}),
-					"quantity": dyn.NewValue(4, []dyn.Location{{File: file, Line: 8, Column: 13}}),
+					"item":     dyn.NewValue("Basketball", []diag.Location{{File: file, Line: 7, Column: 13}}),
+					"quantity": dyn.NewValue(4, []diag.Location{{File: file, Line: 8, Column: 13}}),
 				},
-				[]dyn.Location{{File: file, Line: 7, Column: 3}},
+				[]diag.Location{{File: file, Line: 7, Column: 3}},
 			),
 			dyn.NewValue(
 				map[string]dyn.Value{
-					"item":     dyn.NewValue("Big Shoes", []dyn.Location{{File: file, Line: 9, Column: 13}}),
-					"quantity": dyn.NewValue(1, []dyn.Location{{File: file, Line: 10, Column: 13}}),
+					"item":     dyn.NewValue("Big Shoes", []diag.Location{{File: file, Line: 9, Column: 13}}),
+					"quantity": dyn.NewValue(1, []diag.Location{{File: file, Line: 10, Column: 13}}),
 				},
-				[]dyn.Location{{File: file, Line: 9, Column: 3}},
+				[]diag.Location{{File: file, Line: 9, Column: 3}},
 			),
 		},
-		[]dyn.Location{{File: file, Line: 5, Column: 1}},
+		[]diag.Location{{File: file, Line: 5, Column: 1}},
 	), self)
 }
 
@@ -310,7 +311,7 @@ func TestYAMLSpecExample_2_13(t *testing.T) {
 		``+
 			`\//||\/||`+NL+
 			"// ||  ||__"+NL,
-		[]dyn.Location{{File: file, Line: 4, Column: 5}},
+		[]diag.Location{{File: file, Line: 4, Column: 5}},
 	), self)
 }
 
@@ -320,7 +321,7 @@ func TestYAMLSpecExample_2_14(t *testing.T) {
 
 	dynassert.Equal(t, dyn.NewValue(
 		`Mark McGwire's year was crippled by a knee injury.`+NL,
-		[]dyn.Location{{File: file, Line: 3, Column: 5}},
+		[]diag.Location{{File: file, Line: 3, Column: 5}},
 	), self)
 }
 
@@ -336,7 +337,7 @@ func TestYAMLSpecExample_2_15(t *testing.T) {
 			`  0.288 Batting Average`+NL+
 			NL+
 			`What a year!`+NL,
-		[]dyn.Location{{File: file, Line: 3, Column: 5}},
+		[]diag.Location{{File: file, Line: 3, Column: 5}},
 	), self)
 }
 
@@ -348,20 +349,20 @@ func TestYAMLSpecExample_2_16(t *testing.T) {
 		map[string]dyn.Value{
 			"name": dyn.NewValue(
 				"Mark McGwire",
-				[]dyn.Location{{File: file, Line: 3, Column: 7}},
+				[]diag.Location{{File: file, Line: 3, Column: 7}},
 			),
 			"accomplishment": dyn.NewValue(
 				`Mark set a major league home run record in 1998.`+NL,
-				[]dyn.Location{{File: file, Line: 4, Column: 17}},
+				[]diag.Location{{File: file, Line: 4, Column: 17}},
 			),
 			"stats": dyn.NewValue(
 				``+
 					`65 Home Runs`+NL+
 					`0.278 Batting Average`+NL,
-				[]dyn.Location{{File: file, Line: 7, Column: 8}},
+				[]diag.Location{{File: file, Line: 7, Column: 8}},
 			),
 		},
-		[]dyn.Location{{File: file, Line: 3, Column: 1}},
+		[]diag.Location{{File: file, Line: 3, Column: 1}},
 	), self)
 }
 
@@ -373,30 +374,30 @@ func TestYAMLSpecExample_2_17(t *testing.T) {
 		map[string]dyn.Value{
 			"unicode": dyn.NewValue(
 				`Sosa did fine.`+"\u263A",
-				[]dyn.Location{{File: file, Line: 3, Column: 10}},
+				[]diag.Location{{File: file, Line: 3, Column: 10}},
 			),
 			"control": dyn.NewValue(
 				"\b1998\t1999\t2000\n",
-				[]dyn.Location{{File: file, Line: 4, Column: 10}},
+				[]diag.Location{{File: file, Line: 4, Column: 10}},
 			),
 			"hex esc": dyn.NewValue(
 				"\x0d\x0a is \r\n",
-				[]dyn.Location{{File: file, Line: 5, Column: 10}},
+				[]diag.Location{{File: file, Line: 5, Column: 10}},
 			),
 			"single": dyn.NewValue(
 				`"Howdy!" he cried.`,
-				[]dyn.Location{{File: file, Line: 7, Column: 9}},
+				[]diag.Location{{File: file, Line: 7, Column: 9}},
 			),
 			"quoted": dyn.NewValue(
 				` # Not a 'comment'.`,
-				[]dyn.Location{{File: file, Line: 8, Column: 9}},
+				[]diag.Location{{File: file, Line: 8, Column: 9}},
 			),
 			"tie-fighter": dyn.NewValue(
 				`|\-*-/|`,
-				[]dyn.Location{{File: file, Line: 9, Column: 14}},
+				[]diag.Location{{File: file, Line: 9, Column: 14}},
 			),
 		},
-		[]dyn.Location{{File: file, Line: 3, Column: 1}},
+		[]diag.Location{{File: file, Line: 3, Column: 1}},
 	), self)
 }
 
@@ -408,14 +409,14 @@ func TestYAMLSpecExample_2_18(t *testing.T) {
 		map[string]dyn.Value{
 			"plain": dyn.NewValue(
 				`This unquoted scalar spans many lines.`,
-				[]dyn.Location{{File: file, Line: 4, Column: 3}},
+				[]diag.Location{{File: file, Line: 4, Column: 3}},
 			),
 			"quoted": dyn.NewValue(
 				`So does this quoted scalar.`+NL,
-				[]dyn.Location{{File: file, Line: 7, Column: 9}},
+				[]diag.Location{{File: file, Line: 7, Column: 9}},
 			),
 		},
-		[]dyn.Location{{File: file, Line: 3, Column: 1}},
+		[]diag.Location{{File: file, Line: 3, Column: 1}},
 	), self)
 }
 
@@ -427,26 +428,26 @@ func TestYAMLSpecExample_2_19(t *testing.T) {
 		map[string]dyn.Value{
 			"canonical": dyn.NewValue(
 				12345,
-				[]dyn.Location{{File: file, Line: 3, Column: 12}},
+				[]diag.Location{{File: file, Line: 3, Column: 12}},
 			),
 			"decimal": dyn.NewValue(
 				12345,
-				[]dyn.Location{{File: file, Line: 4, Column: 10}},
+				[]diag.Location{{File: file, Line: 4, Column: 10}},
 			),
 			"octal": dyn.NewValue(
 				12,
-				[]dyn.Location{{File: file, Line: 5, Column: 8}},
+				[]diag.Location{{File: file, Line: 5, Column: 8}},
 			),
 			"hexadecimal": dyn.NewValue(
 				12,
-				[]dyn.Location{{File: file, Line: 6, Column: 14}},
+				[]diag.Location{{File: file, Line: 6, Column: 14}},
 			),
 			"octal11": dyn.NewValue(
 				12345,
-				[]dyn.Location{{File: file, Line: 15, Column: 10}},
+				[]diag.Location{{File: file, Line: 15, Column: 10}},
 			),
 		},
-		[]dyn.Location{{File: file, Line: 3, Column: 1}},
+		[]diag.Location{{File: file, Line: 3, Column: 1}},
 	), self)
 }
 
@@ -469,22 +470,22 @@ func TestYAMLSpecExample_2_20(t *testing.T) {
 		map[string]dyn.Value{
 			"canonical": dyn.NewValue(
 				1230.15,
-				[]dyn.Location{{File: file, Line: 3, Column: 12}},
+				[]diag.Location{{File: file, Line: 3, Column: 12}},
 			),
 			"exponential": dyn.NewValue(
 				1230.15,
-				[]dyn.Location{{File: file, Line: 4, Column: 14}},
+				[]diag.Location{{File: file, Line: 4, Column: 14}},
 			),
 			"fixed": dyn.NewValue(
 				1230.15,
-				[]dyn.Location{{File: file, Line: 5, Column: 8}},
+				[]diag.Location{{File: file, Line: 5, Column: 8}},
 			),
 			"negative infinity": dyn.NewValue(
 				math.Inf(-1),
-				[]dyn.Location{{File: file, Line: 6, Column: 20}},
+				[]diag.Location{{File: file, Line: 6, Column: 20}},
 			),
 		},
-		[]dyn.Location{{File: file, Line: 3, Column: 1}},
+		[]diag.Location{{File: file, Line: 3, Column: 1}},
 	), self)
 }
 
@@ -496,21 +497,21 @@ func TestYAMLSpecExample_2_21(t *testing.T) {
 		map[string]dyn.Value{
 			"null": dyn.NewValue(
 				nil,
-				[]dyn.Location{{File: file, Line: 3, Column: 6}},
+				[]diag.Location{{File: file, Line: 3, Column: 6}},
 			),
 			"booleans": dyn.NewValue(
 				[]dyn.Value{
-					dyn.NewValue(true, []dyn.Location{{File: file, Line: 4, Column: 13}}),
-					dyn.NewValue(false, []dyn.Location{{File: file, Line: 4, Column: 19}}),
+					dyn.NewValue(true, []diag.Location{{File: file, Line: 4, Column: 13}}),
+					dyn.NewValue(false, []diag.Location{{File: file, Line: 4, Column: 19}}),
 				},
-				[]dyn.Location{{File: file, Line: 4, Column: 11}},
+				[]diag.Location{{File: file, Line: 4, Column: 11}},
 			),
 			"string": dyn.NewValue(
 				"012345",
-				[]dyn.Location{{File: file, Line: 5, Column: 9}},
+				[]diag.Location{{File: file, Line: 5, Column: 9}},
 			),
 		},
-		[]dyn.Location{{File: file, Line: 3, Column: 1}},
+		[]diag.Location{{File: file, Line: 3, Column: 1}},
 	), self)
 }
 
@@ -522,24 +523,24 @@ func TestYAMLSpecExample_2_22(t *testing.T) {
 		map[string]dyn.Value{
 			"canonical": dyn.NewValue(
 				dyn.MustTime("2001-12-15T02:59:43.1Z"),
-				[]dyn.Location{{File: file, Line: 3, Column: 12}},
+				[]diag.Location{{File: file, Line: 3, Column: 12}},
 			),
 			"iso8601": dyn.NewValue(
 				dyn.MustTime("2001-12-14t21:59:43.10-05:00"),
-				[]dyn.Location{{File: file, Line: 4, Column: 10}},
+				[]diag.Location{{File: file, Line: 4, Column: 10}},
 			),
 			"spaced": dyn.NewValue(
 				// This is parsed as a string, not a timestamp,
 				// both by "go.yaml.in/yaml/v3" and by our implementation.
 				"2001-12-14 21:59:43.10 -5",
-				[]dyn.Location{{File: file, Line: 5, Column: 9}},
+				[]diag.Location{{File: file, Line: 5, Column: 9}},
 			),
 			"date": dyn.NewValue(
 				dyn.MustTime("2002-12-14"),
-				[]dyn.Location{{File: file, Line: 6, Column: 7}},
+				[]diag.Location{{File: file, Line: 6, Column: 7}},
 			),
 		},
-		[]dyn.Location{{File: file, Line: 3, Column: 1}},
+		[]diag.Location{{File: file, Line: 3, Column: 1}},
 	), self)
 }
 
@@ -564,50 +565,50 @@ func TestYAMLSpecExample_2_24(t *testing.T) {
 				map[string]dyn.Value{
 					"center": dyn.NewValue(
 						map[string]dyn.Value{
-							"x": dyn.NewValue(73, []dyn.Location{{File: file, Line: 8, Column: 23}}),
-							"y": dyn.NewValue(129, []dyn.Location{{File: file, Line: 8, Column: 30}}),
+							"x": dyn.NewValue(73, []diag.Location{{File: file, Line: 8, Column: 23}}),
+							"y": dyn.NewValue(129, []diag.Location{{File: file, Line: 8, Column: 30}}),
 						},
-						[]dyn.Location{{File: file, Line: 8, Column: 11}},
+						[]diag.Location{{File: file, Line: 8, Column: 11}},
 					),
-					"radius": dyn.NewValue(7, []dyn.Location{{File: file, Line: 9, Column: 11}}),
+					"radius": dyn.NewValue(7, []diag.Location{{File: file, Line: 9, Column: 11}}),
 				},
-				[]dyn.Location{{File: file, Line: 7, Column: 3}},
+				[]diag.Location{{File: file, Line: 7, Column: 3}},
 			),
 			dyn.NewValue(
 				map[string]dyn.Value{
 					"start": dyn.NewValue(
 						map[string]dyn.Value{
-							"x": dyn.NewValue(73, []dyn.Location{{File: file, Line: 8, Column: 23}}),
-							"y": dyn.NewValue(129, []dyn.Location{{File: file, Line: 8, Column: 30}}),
+							"x": dyn.NewValue(73, []diag.Location{{File: file, Line: 8, Column: 23}}),
+							"y": dyn.NewValue(129, []diag.Location{{File: file, Line: 8, Column: 30}}),
 						},
-						[]dyn.Location{{File: file, Line: 8, Column: 11}},
+						[]diag.Location{{File: file, Line: 8, Column: 11}},
 					),
 					"finish": dyn.NewValue(
 						map[string]dyn.Value{
-							"x": dyn.NewValue(89, []dyn.Location{{File: file, Line: 12, Column: 16}}),
-							"y": dyn.NewValue(102, []dyn.Location{{File: file, Line: 12, Column: 23}}),
+							"x": dyn.NewValue(89, []diag.Location{{File: file, Line: 12, Column: 16}}),
+							"y": dyn.NewValue(102, []diag.Location{{File: file, Line: 12, Column: 23}}),
 						},
-						[]dyn.Location{{File: file, Line: 12, Column: 11}},
+						[]diag.Location{{File: file, Line: 12, Column: 11}},
 					),
 				},
-				[]dyn.Location{{File: file, Line: 10, Column: 3}},
+				[]diag.Location{{File: file, Line: 10, Column: 3}},
 			),
 			dyn.NewValue(
 				map[string]dyn.Value{
 					"start": dyn.NewValue(
 						map[string]dyn.Value{
-							"x": dyn.NewValue(73, []dyn.Location{{File: file, Line: 8, Column: 23}}),
-							"y": dyn.NewValue(129, []dyn.Location{{File: file, Line: 8, Column: 30}}),
+							"x": dyn.NewValue(73, []diag.Location{{File: file, Line: 8, Column: 23}}),
+							"y": dyn.NewValue(129, []diag.Location{{File: file, Line: 8, Column: 30}}),
 						},
-						[]dyn.Location{{File: file, Line: 8, Column: 11}},
+						[]diag.Location{{File: file, Line: 8, Column: 11}},
 					),
-					"color": dyn.NewValue(16772795, []dyn.Location{{File: file, Line: 15, Column: 10}}),
-					"text":  dyn.NewValue("Pretty vector drawing.", []dyn.Location{{File: file, Line: 16, Column: 9}}),
+					"color": dyn.NewValue(16772795, []diag.Location{{File: file, Line: 15, Column: 10}}),
+					"text":  dyn.NewValue("Pretty vector drawing.", []diag.Location{{File: file, Line: 16, Column: 9}}),
 				},
-				[]dyn.Location{{File: file, Line: 13, Column: 3}},
+				[]diag.Location{{File: file, Line: 13, Column: 3}},
 			),
 		},
-		[]dyn.Location{{File: file, Line: 4, Column: 5}},
+		[]diag.Location{{File: file, Line: 4, Column: 5}},
 	), self)
 }
 
@@ -617,11 +618,11 @@ func TestYAMLSpecExample_2_25(t *testing.T) {
 
 	dynassert.Equal(t, dyn.NewValue(
 		map[string]dyn.Value{
-			"Mark McGwire": dyn.NewValue(nil, []dyn.Location{{File: file, Line: 8, Column: 1}}),
-			"Sammy Sosa":   dyn.NewValue(nil, []dyn.Location{{File: file, Line: 9, Column: 1}}),
-			"Ken Griffey":  dyn.NewValue(nil, []dyn.Location{{File: file, Line: 10, Column: 1}}),
+			"Mark McGwire": dyn.NewValue(nil, []diag.Location{{File: file, Line: 8, Column: 1}}),
+			"Sammy Sosa":   dyn.NewValue(nil, []diag.Location{{File: file, Line: 9, Column: 1}}),
+			"Ken Griffey":  dyn.NewValue(nil, []diag.Location{{File: file, Line: 10, Column: 1}}),
 		},
-		[]dyn.Location{{File: file, Line: 6, Column: 5}},
+		[]diag.Location{{File: file, Line: 6, Column: 5}},
 	), self)
 }
 
@@ -633,24 +634,24 @@ func TestYAMLSpecExample_2_26(t *testing.T) {
 		[]dyn.Value{
 			dyn.NewValue(
 				map[string]dyn.Value{
-					"Mark McGwire": dyn.NewValue(65, []dyn.Location{{File: file, Line: 7, Column: 17}}),
+					"Mark McGwire": dyn.NewValue(65, []diag.Location{{File: file, Line: 7, Column: 17}}),
 				},
-				[]dyn.Location{{File: file, Line: 7, Column: 3}},
+				[]diag.Location{{File: file, Line: 7, Column: 3}},
 			),
 			dyn.NewValue(
 				map[string]dyn.Value{
-					"Sammy Sosa": dyn.NewValue(63, []dyn.Location{{File: file, Line: 8, Column: 15}}),
+					"Sammy Sosa": dyn.NewValue(63, []diag.Location{{File: file, Line: 8, Column: 15}}),
 				},
-				[]dyn.Location{{File: file, Line: 8, Column: 3}},
+				[]diag.Location{{File: file, Line: 8, Column: 3}},
 			),
 			dyn.NewValue(
 				map[string]dyn.Value{
-					"Ken Griffey": dyn.NewValue(58, []dyn.Location{{File: file, Line: 9, Column: 16}}),
+					"Ken Griffey": dyn.NewValue(58, []diag.Location{{File: file, Line: 9, Column: 16}}),
 				},
-				[]dyn.Location{{File: file, Line: 9, Column: 3}},
+				[]diag.Location{{File: file, Line: 9, Column: 3}},
 			),
 		},
-		[]dyn.Location{{File: file, Line: 6, Column: 5}},
+		[]diag.Location{{File: file, Line: 6, Column: 5}},
 	), self)
 }
 
@@ -662,79 +663,79 @@ func TestYAMLSpecExample_2_27(t *testing.T) {
 		map[string]dyn.Value{
 			"invoice": dyn.NewValue(
 				34843,
-				[]dyn.Location{{File: file, Line: 4, Column: 10}},
+				[]diag.Location{{File: file, Line: 4, Column: 10}},
 			),
 			"date": dyn.NewValue(
 				dyn.MustTime("2001-01-23"),
-				[]dyn.Location{{File: file, Line: 5, Column: 10}},
+				[]diag.Location{{File: file, Line: 5, Column: 10}},
 			),
 			"bill-to": dyn.NewValue(
 				map[string]dyn.Value{
 					"given": dyn.NewValue(
 						"Chris",
-						[]dyn.Location{{File: file, Line: 7, Column: 12}},
+						[]diag.Location{{File: file, Line: 7, Column: 12}},
 					),
 					"family": dyn.NewValue(
 						"Dumars",
-						[]dyn.Location{{File: file, Line: 8, Column: 12}},
+						[]diag.Location{{File: file, Line: 8, Column: 12}},
 					),
 					"address": dyn.NewValue(
 						map[string]dyn.Value{
 							"lines": dyn.NewValue(
 								"458 Walkman Dr.\nSuite #292\n",
-								[]dyn.Location{{File: file, Line: 10, Column: 12}},
+								[]diag.Location{{File: file, Line: 10, Column: 12}},
 							),
 							"city": dyn.NewValue(
 								"Royal Oak",
-								[]dyn.Location{{File: file, Line: 13, Column: 15}},
+								[]diag.Location{{File: file, Line: 13, Column: 15}},
 							),
 							"state": dyn.NewValue(
 								"MI",
-								[]dyn.Location{{File: file, Line: 14, Column: 15}},
+								[]diag.Location{{File: file, Line: 14, Column: 15}},
 							),
 							"postal": dyn.NewValue(
 								48046,
-								[]dyn.Location{{File: file, Line: 15, Column: 15}},
+								[]diag.Location{{File: file, Line: 15, Column: 15}},
 							),
 						},
-						[]dyn.Location{{File: file, Line: 10, Column: 5}},
+						[]diag.Location{{File: file, Line: 10, Column: 5}},
 					),
 				},
-				[]dyn.Location{{File: file, Line: 6, Column: 10}},
+				[]diag.Location{{File: file, Line: 6, Column: 10}},
 			),
 			"ship-to": dyn.NewValue(
 				map[string]dyn.Value{
 					"given": dyn.NewValue(
 						"Chris",
-						[]dyn.Location{{File: file, Line: 7, Column: 12}},
+						[]diag.Location{{File: file, Line: 7, Column: 12}},
 					),
 					"family": dyn.NewValue(
 						"Dumars",
-						[]dyn.Location{{File: file, Line: 8, Column: 12}},
+						[]diag.Location{{File: file, Line: 8, Column: 12}},
 					),
 					"address": dyn.NewValue(
 						map[string]dyn.Value{
 							"lines": dyn.NewValue(
 								"458 Walkman Dr.\nSuite #292\n",
-								[]dyn.Location{{File: file, Line: 10, Column: 12}},
+								[]diag.Location{{File: file, Line: 10, Column: 12}},
 							),
 							"city": dyn.NewValue(
 								"Royal Oak",
-								[]dyn.Location{{File: file, Line: 13, Column: 15}},
+								[]diag.Location{{File: file, Line: 13, Column: 15}},
 							),
 							"state": dyn.NewValue(
 								"MI",
-								[]dyn.Location{{File: file, Line: 14, Column: 15}},
+								[]diag.Location{{File: file, Line: 14, Column: 15}},
 							),
 							"postal": dyn.NewValue(
 								48046,
-								[]dyn.Location{{File: file, Line: 15, Column: 15}},
+								[]diag.Location{{File: file, Line: 15, Column: 15}},
 							),
 						},
-						[]dyn.Location{{File: file, Line: 10, Column: 5}},
+						[]diag.Location{{File: file, Line: 10, Column: 5}},
 					),
 				},
-				[]dyn.Location{{File: file, Line: 6, Column: 10}},
+				[]diag.Location{{File: file, Line: 6, Column: 10}},
 			),
 			"product": dyn.NewValue(
 				[]dyn.Value{
@@ -742,60 +743,60 @@ func TestYAMLSpecExample_2_27(t *testing.T) {
 						map[string]dyn.Value{
 							"sku": dyn.NewValue(
 								"BL394D",
-								[]dyn.Location{{File: file, Line: 18, Column: 17}},
+								[]diag.Location{{File: file, Line: 18, Column: 17}},
 							),
 							"quantity": dyn.NewValue(
 								4,
-								[]dyn.Location{{File: file, Line: 19, Column: 17}},
+								[]diag.Location{{File: file, Line: 19, Column: 17}},
 							),
 							"description": dyn.NewValue(
 								"Basketball",
-								[]dyn.Location{{File: file, Line: 20, Column: 17}},
+								[]diag.Location{{File: file, Line: 20, Column: 17}},
 							),
 							"price": dyn.NewValue(
 								450.0,
-								[]dyn.Location{{File: file, Line: 21, Column: 17}},
+								[]diag.Location{{File: file, Line: 21, Column: 17}},
 							),
 						},
-						[]dyn.Location{{File: file, Line: 18, Column: 3}},
+						[]diag.Location{{File: file, Line: 18, Column: 3}},
 					), dyn.NewValue(
 						map[string]dyn.Value{
 							"sku": dyn.NewValue(
 								"BL4438H",
-								[]dyn.Location{{File: file, Line: 22, Column: 17}},
+								[]diag.Location{{File: file, Line: 22, Column: 17}},
 							),
 							"quantity": dyn.NewValue(
 								1,
-								[]dyn.Location{{File: file, Line: 23, Column: 17}},
+								[]diag.Location{{File: file, Line: 23, Column: 17}},
 							),
 							"description": dyn.NewValue(
 								"Super Hoop",
-								[]dyn.Location{{File: file, Line: 24, Column: 17}},
+								[]diag.Location{{File: file, Line: 24, Column: 17}},
 							),
 							"price": dyn.NewValue(
 								2392.0,
-								[]dyn.Location{{File: file, Line: 25, Column: 17}},
+								[]diag.Location{{File: file, Line: 25, Column: 17}},
 							),
 						},
-						[]dyn.Location{{File: file, Line: 22, Column: 3}},
+						[]diag.Location{{File: file, Line: 22, Column: 3}},
 					),
 				},
-				[]dyn.Location{{File: file, Line: 18, Column: 1}},
+				[]diag.Location{{File: file, Line: 18, Column: 1}},
 			),
 			"tax": dyn.NewValue(
 				251.42,
-				[]dyn.Location{{File: file, Line: 26, Column: 8}},
+				[]diag.Location{{File: file, Line: 26, Column: 8}},
 			),
 			"total": dyn.NewValue(
 				4443.52,
-				[]dyn.Location{{File: file, Line: 27, Column: 8}},
+				[]diag.Location{{File: file, Line: 27, Column: 8}},
 			),
 			"comments": dyn.NewValue(
 				"Late afternoon is best. Backup contact is Nancy Billsmer @ 338-4338.",
-				[]dyn.Location{{File: file, Line: 29, Column: 3}},
+				[]diag.Location{{File: file, Line: 29, Column: 3}},
 			),
 		},
-		[]dyn.Location{{File: file, Line: 3, Column: 5}},
+		[]diag.Location{{File: file, Line: 3, Column: 5}},
 	), self)
 }
 
@@ -807,17 +808,17 @@ func TestYAMLSpecExample_2_28(t *testing.T) {
 		map[string]dyn.Value{
 			"Time": dyn.NewValue(
 				"2001-11-23 15:01:42 -5",
-				[]dyn.Location{{File: file, Line: 4, Column: 7}},
+				[]diag.Location{{File: file, Line: 4, Column: 7}},
 			),
 			"User": dyn.NewValue(
 				"ed",
-				[]dyn.Location{{File: file, Line: 5, Column: 7}},
+				[]diag.Location{{File: file, Line: 5, Column: 7}},
 			),
 			"Warning": dyn.NewValue(
 				"This is an error message for the log file",
-				[]dyn.Location{{File: file, Line: 7, Column: 3}},
+				[]diag.Location{{File: file, Line: 7, Column: 3}},
 			),
 		},
-		[]dyn.Location{{File: file, Line: 4, Column: 1}},
+		[]diag.Location{{File: file, Line: 4, Column: 1}},
 	), self)
 }
diff --git a/libs/dyn/yamlsaver/saver_test.go b/libs/dyn/yamlsaver/saver_test.go
index 5752fb4aaa4..a4f50e0b8fb 100644
--- a/libs/dyn/yamlsaver/saver_test.go
+++ b/libs/dyn/yamlsaver/saver_test.go
@@ -3,6 +3,7 @@ package yamlsaver
 import (
 	"testing"
 
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -60,10 +61,10 @@ func TestMarshalSequenceValue(t *testing.T) {
 	s := NewSaver()
 	sequenceValue := dyn.NewValue(
 		[]dyn.Value{
-			dyn.NewValue("value1", []dyn.Location{{File: "file", Line: 1, Column: 2}}),
-			dyn.NewValue("value2", []dyn.Location{{File: "file", Line: 2, Column: 2}}),
+			dyn.NewValue("value1", []diag.Location{{File: "file", Line: 1, Column: 2}}),
+			dyn.NewValue("value2", []diag.Location{{File: "file", Line: 2, Column: 2}}),
 		},
-		[]dyn.Location{{File: "file", Line: 1, Column: 2}},
+		[]diag.Location{{File: "file", Line: 1, Column: 2}},
 	)
 	v, err := s.toYamlNode(sequenceValue)
 	assert.NoError(t, err)
@@ -85,11 +86,11 @@ func TestMarshalMapValue(t *testing.T) {
 	s := NewSaver()
 	mapValue := dyn.NewValue(
 		map[string]dyn.Value{
-			"key3": dyn.NewValue("value3", []dyn.Location{{File: "file", Line: 3, Column: 2}}),
-			"key2": dyn.NewValue("value2", []dyn.Location{{File: "file", Line: 2, Column: 2}}),
-			"key1": dyn.NewValue("value1", []dyn.Location{{File: "file", Line: 1, Column: 2}}),
+			"key3": dyn.NewValue("value3", []diag.Location{{File: "file", Line: 3, Column: 2}}),
+			"key2": dyn.NewValue("value2", []diag.Location{{File: "file", Line: 2, Column: 2}}),
+			"key1": dyn.NewValue("value1", []diag.Location{{File: "file", Line: 1, Column: 2}}),
 		},
-		[]dyn.Location{{File: "file", Line: 1, Column: 2}},
+		[]diag.Location{{File: "file", Line: 1, Column: 2}},
 	)
 
 	v, err := s.toYamlNode(mapValue)
@@ -111,12 +112,12 @@ func TestMarshalNestedValues(t *testing.T) {
 		map[string]dyn.Value{
 			"key1": dyn.NewValue(
 				map[string]dyn.Value{
-					"key2": dyn.NewValue("value", []dyn.Location{{File: "file", Line: 1, Column: 2}}),
+					"key2": dyn.NewValue("value", []diag.Location{{File: "file", Line: 1, Column: 2}}),
 				},
-				[]dyn.Location{{File: "file", Line: 1, Column: 2}},
+				[]diag.Location{{File: "file", Line: 1, Column: 2}},
 			),
 		},
-		[]dyn.Location{{File: "file", Line: 1, Column: 2}},
+		[]diag.Location{{File: "file", Line: 1, Column: 2}},
 	)
 	v, err := s.toYamlNode(mapValue)
 	assert.NoError(t, err)
@@ -219,18 +220,18 @@ func TestCustomStylingWithNestedMap(t *testing.T) {
 
 	styledMap := dyn.NewValue(
 		map[string]dyn.Value{
-			"key1": dyn.NewValue("value1", []dyn.Location{{File: "file", Line: 1, Column: 2}}),
-			"key2": dyn.NewValue("value2", []dyn.Location{{File: "file", Line: 2, Column: 2}}),
+			"key1": dyn.NewValue("value1", []diag.Location{{File: "file", Line: 1, Column: 2}}),
+			"key2": dyn.NewValue("value2", []diag.Location{{File: "file", Line: 2, Column: 2}}),
 		},
-		[]dyn.Location{{File: "file", Line: -2, Column: 2}},
+		[]diag.Location{{File: "file", Line: -2, Column: 2}},
 	)
 
 	unstyledMap := dyn.NewValue(
 		map[string]dyn.Value{
-			"key3": dyn.NewValue("value3", []dyn.Location{{File: "file", Line: 1, Column: 2}}),
-			"key4": dyn.NewValue("value4", []dyn.Location{{File: "file", Line: 2, Column: 2}}),
+			"key3": dyn.NewValue("value3", []diag.Location{{File: "file", Line: 1, Column: 2}}),
+			"key4": dyn.NewValue("value4", []diag.Location{{File: "file", Line: 2, Column: 2}}),
 		},
-		[]dyn.Location{{File: "file", Line: -1, Column: 2}},
+		[]diag.Location{{File: "file", Line: -1, Column: 2}},
 	)
 
 	val := dyn.NewValue(
@@ -238,7 +239,7 @@ func TestCustomStylingWithNestedMap(t *testing.T) {
 			"styled":   styledMap,
 			"unstyled": unstyledMap,
 		},
-		[]dyn.Location{{File: "file", Line: 1, Column: 2}},
+		[]diag.Location{{File: "file", Line: 1, Column: 2}},
 	)
 
 	mv, err := s.toYamlNode(val)
diff --git a/libs/dyn/yamlsaver/utils.go b/libs/dyn/yamlsaver/utils.go
index aa1e925e559..61f41790029 100644
--- a/libs/dyn/yamlsaver/utils.go
+++ b/libs/dyn/yamlsaver/utils.go
@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"slices"
 
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/cli/libs/dyn/convert"
 )
@@ -85,7 +86,7 @@ func skipAndOrder(mv dyn.Value, order *Order, skipFields []string, dst map[strin
 		if order == nil {
 			dst[k] = v
 		} else {
-			dst[k] = dyn.NewValue(v.Value(), []dyn.Location{{Line: order.Get(k)}})
+			dst[k] = dyn.NewValue(v.Value(), []diag.Location{{Line: order.Get(k)}})
 		}
 	}
 
diff --git a/libs/dyn/yamlsaver/utils_test.go b/libs/dyn/yamlsaver/utils_test.go
index d9f81239f7e..8b056e0076f 100644
--- a/libs/dyn/yamlsaver/utils_test.go
+++ b/libs/dyn/yamlsaver/utils_test.go
@@ -3,6 +3,7 @@ package yamlsaver
 import (
 	"testing"
 
+	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/cli/libs/dyn/dynassert"
 	"github.com/stretchr/testify/assert"
@@ -85,19 +86,19 @@ func TestConvertToMapValueWithOrder(t *testing.T) {
 				dyn.V("b"),
 				dyn.V("c"),
 			},
-			[]dyn.Location{{Line: -3}},
+			[]diag.Location{{Line: -3}},
 		),
 		"name": dyn.NewValue(
 			"test",
-			[]dyn.Location{{Line: -2}},
+			[]diag.Location{{Line: -2}},
 		),
 		"map": dyn.NewValue(
 			map[string]dyn.Value{
 				"key1": dyn.V("value1"),
 				"key2": dyn.V("value2"),
 			},
-			[]dyn.Location{{Line: -1}},
+			[]diag.Location{{Line: -1}},
 		),
-		"long_name_field": dyn.NewValue("long name goes here", []dyn.Location{{Line: 1}}),
+		"long_name_field": dyn.NewValue("long name goes here", []diag.Location{{Line: 1}}),
 	}), result)
 }
diff --git a/libs/env/context_test.go b/libs/env/context_test.go
index 6795107520c..a136b2860cd 100644
--- a/libs/env/context_test.go
+++ b/libs/env/context_test.go
@@ -16,7 +16,7 @@ func TestContext(t *testing.T) {
 
 	// Get
 	assert.Equal(t, "bar", env.Get(ctx0, "FOO"))
-	assert.Equal(t, "", env.Get(ctx0, "dontexist"))
+	assert.Empty(t, env.Get(ctx0, "dontexist"))
 
 	// Lookup
 	v, ok := env.Lookup(ctx0, "FOO")
@@ -24,7 +24,7 @@ func TestContext(t *testing.T) {
 	assert.Equal(t, "bar", v)
 	v, ok = env.Lookup(ctx0, "dontexist")
 	assert.False(t, ok)
-	assert.Equal(t, "", v)
+	assert.Empty(t, v)
 
 	// Set and get new context.
 	// Verify that the previous context remains unchanged.
diff --git a/libs/errs/aggregate.go b/libs/errs/aggregate.go
deleted file mode 100644
index 08836494867..00000000000
--- a/libs/errs/aggregate.go
+++ /dev/null
@@ -1,68 +0,0 @@
-package errs
-
-import "errors"
-
-type aggregateError struct {
-	errors []error
-}
-
-func FromMany(errors ...error) error {
-	n := 0
-	for _, err := range errors {
-		if err != nil {
-			n++
-		}
-	}
-	if n == 0 {
-		return nil
-	}
-	aggregateErr := &aggregateError{
-		errors: make([]error, 0, n),
-	}
-	for _, err := range errors {
-		if err != nil {
-			aggregateErr.errors = append(aggregateErr.errors, err)
-		}
-	}
-	return aggregateErr
-}
-
-func (ce *aggregateError) Error() string {
-	var b []byte
-	for i, err := range ce.errors {
-		if i > 0 {
-			b = append(b, '\n')
-		}
-		b = append(b, err.Error()...)
-	}
-	return string(b)
-}
-
-func (ce *aggregateError) Unwrap() error {
-	return errorChain(ce.errors)
-}
-
-// Represents chained list of errors.
-// Implements Error interface so that chain of errors
-// can correctly work with errors.Is/As method
-type errorChain []error
-
-func (ec errorChain) Error() string {
-	return ec[0].Error()
-}
-
-func (ec errorChain) Unwrap() error {
-	if len(ec) == 1 {
-		return nil
-	}
-
-	return ec[1:]
-}
-
-func (ec errorChain) As(target any) bool {
-	return errors.As(ec[0], target)
-}
-
-func (ec errorChain) Is(target error) bool {
-	return errors.Is(ec[0], target)
-}
diff --git a/libs/errs/aggregate_test.go b/libs/errs/aggregate_test.go
deleted file mode 100644
index 216276a0675..00000000000
--- a/libs/errs/aggregate_test.go
+++ /dev/null
@@ -1,36 +0,0 @@
-package errs
-
-import (
-	"errors"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestFromManyErrors(t *testing.T) {
-	e1 := errors.New("Error 1")
-	e2 := errors.New("Error 2")
-	e3 := errors.New("Error 3")
-	err := FromMany(e1, e2, e3)
-
-	assert.ErrorIs(t, err, e1)
-	assert.ErrorIs(t, err, e2)
-	assert.ErrorIs(t, err, e3)
-
-	assert.Equal(t, `Error 1
-Error 2
-Error 3`, err.Error())
-}
-
-func TestFromManyErrorsWihtNil(t *testing.T) {
-	e1 := errors.New("Error 1")
-	var e2 error = nil
-	e3 := errors.New("Error 3")
-	err := FromMany(e1, e2, e3)
-
-	assert.ErrorIs(t, err, e1)
-	assert.ErrorIs(t, err, e3)
-
-	assert.Equal(t, `Error 1
-Error 3`, err.Error())
-}
diff --git a/libs/exec/exec.go b/libs/exec/exec.go
index b867b8631f6..feea8af0f92 100644
--- a/libs/exec/exec.go
+++ b/libs/exec/exec.go
@@ -3,6 +3,7 @@ package exec
 import (
 	"bytes"
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -190,7 +191,7 @@ func (e *Executor) ExecAndCapture(ctx context.Context, command string) (*ExecOut
 	err = cmd.Wait()
 	exitCode := 0
 	if err != nil {
-		if exitErr, ok := err.(*osexec.ExitError); ok {
+		if exitErr, ok := errors.AsType[*osexec.ExitError](err); ok {
 			exitCode = exitErr.ExitCode()
 		} else {
 			return nil, err
diff --git a/libs/execv/shell_test.go b/libs/execv/shell_test.go
index 693516dec7d..c3d70601f5c 100644
--- a/libs/execv/shell_test.go
+++ b/libs/execv/shell_test.go
@@ -70,7 +70,7 @@ func TestShell_Windows(t *testing.T) {
 		// Verify that the temporary file is cleaned up after execution.
 		files, err = os.ReadDir(dir)
 		require.NoError(t, err)
-		assert.Len(t, files, 0)
+		assert.Empty(t, files)
 
 		// Verify that CLI would exit with the correct exit code.
 		assert.Equal(t, test.exitCode, exitCode)
diff --git a/libs/filer/dbfs_client.go b/libs/filer/dbfs_client.go
index 761f279036d..f5d6c5993e4 100644
--- a/libs/filer/dbfs_client.go
+++ b/libs/filer/dbfs_client.go
@@ -98,8 +98,8 @@ func (w *DbfsClient) Write(ctx context.Context, name string, reader io.Reader, m
 	if !slices.Contains(mode, CreateParentDirectories) {
 		_, err = w.workspaceClient.Dbfs.GetStatusByPath(ctx, path.Dir(absPath))
 		if err != nil {
-			var aerr *apierr.APIError
-			if !errors.As(err, &aerr) {
+			aerr, ok := errors.AsType[*apierr.APIError](err)
+			if !ok {
 				return err
 			}
 
@@ -116,8 +116,8 @@ func (w *DbfsClient) Write(ctx context.Context, name string, reader io.Reader, m
 
 	handle, err := w.workspaceClient.Dbfs.Open(ctx, absPath, fileMode)
 	if err != nil {
-		var aerr *apierr.APIError
-		if !errors.As(err, &aerr) {
+		aerr, ok := errors.AsType[*apierr.APIError](err)
+		if !ok {
 			return err
 		}
 
@@ -153,8 +153,8 @@ func (w *DbfsClient) Read(ctx context.Context, name string) (io.ReadCloser, erro
 			return nil, notAFile{absPath}
 		}
 
-		var aerr *apierr.APIError
-		if !errors.As(err, &aerr) {
+		aerr, ok := errors.AsType[*apierr.APIError](err)
+		if !ok {
 			return nil, err
 		}
 
@@ -190,8 +190,8 @@ func (w *DbfsClient) Delete(ctx context.Context, name string, mode ...DeleteMode
 	//
 	_, err = w.workspaceClient.Dbfs.GetStatusByPath(ctx, absPath)
 	if err != nil {
-		var aerr *apierr.APIError
-		if !errors.As(err, &aerr) {
+		aerr, ok := errors.AsType[*apierr.APIError](err)
+		if !ok {
 			return err
 		}
 
@@ -218,8 +218,8 @@ func (w *DbfsClient) Delete(ctx context.Context, name string, mode ...DeleteMode
 	}
 
 	// Special handling of this error only if it is an API error.
-	var aerr *apierr.APIError
-	if !errors.As(err, &aerr) {
+	aerr, ok := errors.AsType[*apierr.APIError](err)
+	if !ok {
 		return err
 	}
 
@@ -248,8 +248,8 @@ func (w *DbfsClient) ReadDir(ctx context.Context, name string) ([]fs.DirEntry, e
 
 	res, err := w.workspaceClient.Dbfs.ListByPath(ctx, absPath)
 	if err != nil {
-		var aerr *apierr.APIError
-		if !errors.As(err, &aerr) {
+		aerr, ok := errors.AsType[*apierr.APIError](err)
+		if !ok {
 			return nil, err
 		}
 
@@ -269,7 +269,7 @@ func (w *DbfsClient) ReadDir(ctx context.Context, name string) ([]fs.DirEntry, e
 
 	info := make([]fs.DirEntry, len(res.Files))
 	for i, v := range res.Files {
-		info[i] = dbfsDirEntry{dbfsFileInfo: dbfsFileInfo{fi: v}}
+		info[i] = dbfsDirEntry{fi: v}
 	}
 
 	// Sort by name for parity with os.ReadDir.
@@ -294,8 +294,8 @@ func (w *DbfsClient) Stat(ctx context.Context, name string) (fs.FileInfo, error)
 
 	info, err := w.workspaceClient.Dbfs.GetStatusByPath(ctx, absPath)
 	if err != nil {
-		var aerr *apierr.APIError
-		if !errors.As(err, &aerr) {
+		aerr, ok := errors.AsType[*apierr.APIError](err)
+		if !ok {
 			return nil, err
 		}
 
diff --git a/libs/filer/errors.go b/libs/filer/errors.go
index 67f15ecb013..8648502c229 100644
--- a/libs/filer/errors.go
+++ b/libs/filer/errors.go
@@ -106,6 +106,10 @@ func (err cannotDeleteRootError) Is(other error) bool {
 // when attempting to create a directory but lacking write permissions.
 type permissionError struct {
 	path string
+	// err is the underlying API error, preserved so callers can inspect its
+	// error_code (e.g. to distinguish a real permission denial from a workspace
+	// directory that is at its child-node limit, which the API also reports as 403).
+	err error
 }
 
 func (err permissionError) Error() string {
@@ -115,3 +119,7 @@ func (err permissionError) Error() string {
 func (err permissionError) Is(other error) bool {
 	return other == fs.ErrPermission
 }
+
+func (err permissionError) Unwrap() error {
+	return err.err
+}
diff --git a/libs/filer/errors_test.go b/libs/filer/errors_test.go
index a1fb066e099..e12fe946450 100644
--- a/libs/filer/errors_test.go
+++ b/libs/filer/errors_test.go
@@ -4,7 +4,9 @@ import (
 	"io/fs"
 	"testing"
 
+	"github.com/databricks/databricks-sdk-go/apierr"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestFileAlreadyExistsError_Is(t *testing.T) {
@@ -94,3 +96,16 @@ func TestPermissionError_Error(t *testing.T) {
 	err := permissionError{path: "/test/path"}
 	assert.Equal(t, "access denied: /test/path", err.Error())
 }
+
+func TestPermissionError_Unwrap(t *testing.T) {
+	// A wrapped API error must remain matchable as fs.ErrPermission while also
+	// being reachable via errors.As so callers can inspect its error_code.
+	apiErr := &apierr.APIError{StatusCode: 403, ErrorCode: "MAX_CHILD_NODE_SIZE_EXCEEDED"}
+	err := permissionError{path: "/test/path", err: apiErr}
+
+	assert.ErrorIs(t, err, fs.ErrPermission)
+
+	var got *apierr.APIError
+	require.ErrorAs(t, err, &got)
+	assert.Equal(t, "MAX_CHILD_NODE_SIZE_EXCEEDED", got.ErrorCode)
+}
diff --git a/libs/filer/files_client.go b/libs/filer/files_client.go
index 2ac76166162..1638acb73bd 100644
--- a/libs/filer/files_client.go
+++ b/libs/filer/files_client.go
@@ -4,24 +4,39 @@ import (
 	"cmp"
 	"context"
 	"errors"
-	"fmt"
 	"io"
 	"io/fs"
 	"net/http"
-	"net/url"
 	"path"
 	"slices"
-	"strings"
 	"time"
 
+	"github.com/databricks/cli/libs/databrickscfg/profile"
+	"github.com/databricks/cli/libs/env"
 	"github.com/databricks/databricks-sdk-go"
-	"github.com/databricks/databricks-sdk-go/apierr"
-	"github.com/databricks/databricks-sdk-go/client"
-	"github.com/databricks/databricks-sdk-go/listing"
-	"github.com/databricks/databricks-sdk-go/service/files"
+	"github.com/databricks/databricks-sdk-go/config"
+	"github.com/databricks/sdk-go/core/apierr"
+	files "github.com/databricks/sdk-go/files/v2"
+	"github.com/databricks/sdk-go/options/client"
 	"golang.org/x/sync/errgroup"
 )
 
+// cloudResponseHeaderTimeout bounds the wait for a cloud storage response header
+// on a large-file part transfer. It matches the files/v2 engine's own default.
+const cloudResponseHeaderTimeout = 60 * time.Second
+
+// httpStatus returns the HTTP status code of err if it is (or wraps) an
+// [apierr.APIError], and -1 otherwise. The filer keys its error mapping off the
+// HTTP status rather than the SDK's canonical codes.Code: the Files API reports
+// "path already exists" as 409 Conflict, which the SDK maps to codes.Aborted
+// (not codes.AlreadyExists), so matching on the code would miss it.
+func httpStatus(err error) int {
+	if aerr, ok := errors.AsType[*apierr.APIError](err); ok {
+		return aerr.HTTPStatusCode()
+	}
+	return -1
+}
+
 // As of 19th Feb 2024, the Files API backend has a rate limit of 10 concurrent
 // requests and 100 QPS. We limit the number of concurrent requests to 5 to
 // avoid hitting the rate limit.
@@ -86,127 +101,209 @@ func (e filesApiDirEntry) Info() (fs.FileInfo, error) {
 	return e.i, nil
 }
 
+// uploadConcurrency bounds the concurrent part uploads of a large-file
+// (multipart) write. Parts go to cloud storage rather than the rate-limited
+// Files API, so this can fan out wider than the file-level copy parallelism.
+const uploadConcurrency = 64
+
+// multipartUploadEnvVar gates whether large Volumes writes are split into parts
+// by the files/v2 upload engine. The engine is new, so multipart is off by
+// default: when unset or not truthy, Write sends a single-shot PUT (via the
+// files/v2 UploadFile endpoint), leaving fs cp and bundle behavior unchanged.
+const multipartUploadEnvVar = "DATABRICKS_EXPERIMENTAL_MULTIPART_UPLOAD"
+
+// MultipartUploadEnabled reports whether large files written to UC Volumes are
+// split into parts by the files/v2 upload engine, gated by
+// DATABRICKS_EXPERIMENTAL_MULTIPART_UPLOAD (off by default). Both paths use the
+// files/v2 client; the flag only selects the multipart engine over a single-shot
+// PUT.
+func MultipartUploadEnabled(ctx context.Context) bool {
+	enabled, _ := env.GetBool(ctx, multipartUploadEnvVar)
+	return enabled
+}
+
+// uploadProgressKey is the context key for an optional large-file upload
+// progress callback.
+type uploadProgressKey struct{}
+
+// WithUploadProgress returns a context carrying a progress callback for
+// large-file (multipart) uploads. FilesClient.Write forwards it to the upload
+// engine; it has no effect on writes that do not go through the engine (small
+// files, non-seekable streams, non-Volumes targets, or when multipart upload is
+// disabled).
+func WithUploadProgress(ctx context.Context, fn files.ProgressFunc) context.Context {
+	return context.WithValue(ctx, uploadProgressKey{}, fn)
+}
+
+func uploadProgressFromContext(ctx context.Context) files.ProgressFunc {
+	fn, _ := ctx.Value(uploadProgressKey{}).(files.ProgressFunc)
+	return fn
+}
+
 // FilesClient implements the [Filer] interface for the Files API backend.
 type FilesClient struct {
-	workspaceClient *databricks.WorkspaceClient
-	apiClient       *client.DatabricksClient
+	client *files.Client
 
 	// File operations will be relative to this path.
 	root WorkspaceRootPath
+
+	// Large files are uploaded with the multipart engine. The limiter and transfer
+	// client are shared across every Write on this filer, so concurrent uploads
+	// (e.g. fs cp -r) draw from one bounded budget and one connection pool.
+	limiter        files.Limiter
+	transferClient *http.Client
 }
 
-func NewFilesClient(w *databricks.WorkspaceClient, root string) (Filer, error) {
-	apiClient, err := client.New(w.Config)
+func NewFilesClient(ctx context.Context, w *databricks.WorkspaceClient, root string) (Filer, error) {
+	c, err := newFilesAPIClient(ctx, w.Config)
 	if err != nil {
 		return nil, err
 	}
 
 	return &FilesClient{
-		workspaceClient: w,
-		apiClient:       apiClient,
+		client: c,
 
 		root: NewWorkspaceRootPath(root),
+
+		limiter:        files.NewLimiter(uploadConcurrency),
+		transferClient: newTransferClient(uploadConcurrency),
 	}, nil
 }
 
-// orgIDHeaders returns headers with X-Databricks-Org-Id set if a workspace ID
-// is configured. SPOG hosts require this header to route requests to the
-// correct workspace.
-func (w *FilesClient) orgIDHeaders() map[string]string {
-	wsID := w.workspaceClient.Config.WorkspaceID
-	if wsID == "" {
-		return nil
-	}
-	return map[string]string{
-		"X-Databricks-Org-Id": wsID,
-	}
+// newTransferClient returns an HTTP client for the cloud-leg part transfers of a
+// large-file upload, sized for n concurrent transfers so idle connections are
+// reused rather than re-dialed (Go's default of 2 per host would force
+// re-dialing). It attaches no Databricks credentials (presigned URLs are
+// self-authenticating) and sets no whole-request timeout, which would abort a
+// legitimately long transfer; the upload is bounded by its context instead.
+// files/v2 builds an equivalent client internally when one is not supplied; this
+// filer supplies a shared one so all writes on it draw from a single pool.
+func newTransferClient(n int) *http.Client {
+	transport := http.DefaultTransport.(*http.Transport).Clone()
+	transport.ResponseHeaderTimeout = cloudResponseHeaderTimeout
+	transport.MaxIdleConnsPerHost = n
+	transport.MaxIdleConns = max(transport.MaxIdleConns, n)
+	return &http.Client{Transport: transport}
 }
 
-func (w *FilesClient) urlPath(name string) (string, string, error) {
-	absPath, err := w.root.Join(name)
-	if err != nil {
-		return "", "", err
-	}
-
-	// The user specified part of the path must be escaped.
-	urlPath := "/api/2.0/fs/files/" + url.PathEscape(strings.TrimLeft(absPath, "/"))
-
-	return absPath, urlPath, nil
+// newFilesAPIClient builds the files/v2 client from the CLI's already resolved
+// config, reusing its auth instead of re-reading a profile. cfg is passed by
+// pointer because config.Config embeds a sync.Mutex and must not be copied.
+func newFilesAPIClient(ctx context.Context, cfg *config.Config) (*files.Client, error) {
+	copts := []client.Option{
+		client.WithHost(cfg.Host),
+		client.WithCredentials(configCredentials{cfg: cfg}),
+		client.WithoutConfigFile(),
+		client.WithoutEnv(),
+	}
+	// The workspace routing header is needed on unified ("SPOG") hosts; the CLI's
+	// "none" sentinel means "no workspace ID", so it is not forwarded.
+	if id := cfg.WorkspaceID; id != "" && id != profile.WorkspaceIDNone {
+		copts = append(copts, client.WithWorkspaceID(id))
+	}
+	return files.NewClient(ctx, copts...)
 }
 
 func (w *FilesClient) Write(ctx context.Context, name string, reader io.Reader, mode ...WriteMode) error {
-	absPath, urlPath, err := w.urlPath(name)
+	absPath, err := w.root.Join(name)
 	if err != nil {
 		return err
 	}
 
 	// Check that target path exists if CreateParentDirectories mode is not set
 	if !slices.Contains(mode, CreateParentDirectories) {
-		err := w.workspaceClient.Files.GetDirectoryMetadataByDirectoryPath(ctx, path.Dir(absPath))
+		dir := path.Dir(absPath)
+		_, err := w.client.GetDirectoryMetadata(ctx, files.GetDirectoryMetadataRequest{DirectoryPath: &dir})
 		if err != nil {
-			var aerr *apierr.APIError
-			if !errors.As(err, &aerr) {
-				return err
-			}
-
-			// This API returns a 404 if the file doesn't exist.
-			if aerr.StatusCode == http.StatusNotFound {
-				return noSuchDirectoryError{path.Dir(absPath)}
+			// This API returns a 404 if the directory doesn't exist.
+			if httpStatus(err) == http.StatusNotFound {
+				return noSuchDirectoryError{dir}
 			}
-
 			return err
 		}
 	}
 
 	overwrite := slices.Contains(mode, OverwriteIfExists)
-	urlPath = fmt.Sprintf("%s?overwrite=%t", urlPath, overwrite)
-	headers := map[string]string{"Content-Type": "application/octet-stream"}
-	if wsID := w.workspaceClient.Config.WorkspaceID; wsID != "" {
-		headers["X-Databricks-Org-Id"] = wsID
+
+	// When the multipart flag is enabled, seekable uploads go through the files/v2
+	// upload engine, which sends small files in a single PUT and splits large ones
+	// into parts. Non-seekable streams and the flag-off case use the single-shot
+	// UploadFile endpoint below: the former to avoid buffering the whole stream in
+	// memory, the latter to keep the default behavior a plain PUT. The engine
+	// recovers an io.ReaderAt for concurrent positioned reads when the source
+	// provides one (a local file).
+	if MultipartUploadEnabled(ctx) && isSeekable(reader) {
+		opts := []files.UploadOption{
+			files.WithOverwrite(overwrite),
+			files.WithLimiter(w.limiter),
+			files.WithTransferClient(w.transferClient),
+		}
+		// A caller (fs cp) can attach a progress callback via the context to
+		// render an upload bar; it is absent for other writers (e.g. bundle).
+		if fn := uploadProgressFromContext(ctx); fn != nil {
+			opts = append(opts, files.WithProgress(fn))
+		}
+		_, uerr := w.client.Upload(ctx, absPath, reader, opts...)
+		return mapUploadError(uerr, absPath)
 	}
-	err = w.apiClient.Do(ctx, http.MethodPut, urlPath, headers, nil, reader, nil)
 
-	// Return early on success.
+	_, err = w.client.UploadFile(ctx, files.UploadFileRequest{
+		FilePath:  &absPath,
+		Contents:  io.NopCloser(reader),
+		Overwrite: &overwrite,
+	})
 	if err == nil {
 		return nil
 	}
 
-	// Special handling of this error only if it is an API error.
-	var aerr *apierr.APIError
-	if !errors.As(err, &aerr) {
-		return err
+	// This API returns 409 if a file already exists at the path.
+	if httpStatus(err) == http.StatusConflict {
+		return fileAlreadyExistsError{absPath}
 	}
+	return err
+}
+
+// isSeekable reports whether r can be seeked, without moving it: a no-op
+// Seek(0, io.SeekCurrent) returns the current offset for a working seeker and
+// errors for a broken one. Probing this way (rather than seeking to the end and
+// back) guarantees the reader keeps its position, so a false result never leaves
+// it parked at EOF for the single-shot fallback, which reads from the current
+// offset and would otherwise upload a truncated object. The engine sizes the
+// stream itself once it takes over.
+func isSeekable(r io.Reader) bool {
+	s, ok := r.(io.Seeker)
+	if !ok {
+		return false
+	}
+	_, err := s.Seek(0, io.SeekCurrent)
+	return err == nil
+}
 
-	// This API returns 409 if the file already exists, when the object type is file
-	if aerr.StatusCode == http.StatusConflict && aerr.ErrorCode == "ALREADY_EXISTS" {
+// mapUploadError translates the upload engine's already-exists sentinel into the
+// filer's error so skip-if-exists logic (which checks fs.ErrExist) keeps working.
+// A nil error passes through unchanged.
+func mapUploadError(err error, absPath string) error {
+	if errors.Is(err, files.ErrAlreadyExists) {
 		return fileAlreadyExistsError{absPath}
 	}
-
 	return err
 }
 
 func (w *FilesClient) Read(ctx context.Context, name string) (io.ReadCloser, error) {
-	absPath, urlPath, err := w.urlPath(name)
+	absPath, err := w.root.Join(name)
 	if err != nil {
 		return nil, err
 	}
 
-	var reader io.ReadCloser
-	err = w.apiClient.Do(ctx, http.MethodGet, urlPath, w.orgIDHeaders(), nil, nil, &reader)
+	resp, err := w.client.DownloadFile(ctx, files.DownloadFileRequest{FilePath: &absPath})
 
 	// Return early on success.
 	if err == nil {
-		return reader, nil
-	}
-
-	// Special handling of this error only if it is an API error.
-	var aerr *apierr.APIError
-	if !errors.As(err, &aerr) {
-		return nil, err
+		return resp.Contents, nil
 	}
 
 	// This API returns a 404 if the specified path does not exist.
-	if aerr.StatusCode == http.StatusNotFound {
+	if httpStatus(err) == http.StatusNotFound {
 		// Check if the path is a directory. If so, return not a file error.
 		if _, err := w.statDir(ctx, name); err == nil {
 			return nil, notAFile{absPath}
@@ -230,21 +327,15 @@ func (w *FilesClient) deleteFile(ctx context.Context, name string) error {
 		return cannotDeleteRootError{}
 	}
 
-	err = w.workspaceClient.Files.DeleteByFilePath(ctx, absPath)
+	_, err = w.client.DeleteFile(ctx, files.DeleteFileRequest{FilePath: &absPath})
 
 	// Return early on success.
 	if err == nil {
 		return nil
 	}
 
-	var aerr *apierr.APIError
-	// Special handling of this error only if it is an API error.
-	if !errors.As(err, &aerr) {
-		return err
-	}
-
 	// This files delete API returns a 404 if the specified path does not exist.
-	if aerr.StatusCode == http.StatusNotFound {
+	if httpStatus(err) == http.StatusNotFound {
 		return fileDoesNotExistError{absPath}
 	}
 
@@ -262,29 +353,30 @@ func (w *FilesClient) deleteDirectory(ctx context.Context, name string) error {
 		return cannotDeleteRootError{}
 	}
 
-	err = w.workspaceClient.Files.DeleteDirectoryByDirectoryPath(ctx, absPath)
+	_, err = w.client.DeleteDirectory(ctx, files.DeleteDirectoryRequest{DirectoryPath: &absPath})
 
-	var aerr *apierr.APIError
-	// Special handling of this error only if it is an API error.
-	if !errors.As(err, &aerr) {
-		return err
+	// Return early on success.
+	if err == nil {
+		return nil
 	}
 
-	// The directory delete API returns a 400 if the directory is not empty
-	if aerr.StatusCode == http.StatusBadRequest {
-		var reasons []string
-		details := aerr.ErrorDetails()
-		if details.ErrorInfo != nil {
-			reasons = append(reasons, details.ErrorInfo.Reason)
+	// The directory delete API returns a 400 if the directory is not empty. That
+	// status is generic, so confirm the specific reason before mapping it.
+	if aerr, ok := errors.AsType[*apierr.APIError](err); ok && aerr.HTTPStatusCode() == http.StatusBadRequest {
+		if info := aerr.Details().ErrorInfo; info != nil && info.Reason == "FILES_API_DIRECTORY_IS_NOT_EMPTY" {
+			return directoryNotEmptyError{absPath}
 		}
-		// Error code 400 is generic and can be returned for other reasons. Make
-		// sure one of the reasons for the error is that the directory is not empty.
-		if !slices.Contains(reasons, "FILES_API_DIRECTORY_IS_NOT_EMPTY") {
-			return err
-		}
-		return directoryNotEmptyError{absPath}
+		return err
 	}
 
+	// On GCS-backed storage a directory created implicitly is just a key prefix
+	// with no standalone object, so it disappears when its last child is
+	// deleted. The delete API then returns 404 for that already-vanished
+	// directory; treat it as a not-found error so recursive delete can consider
+	// its goal satisfied.
+	if httpStatus(err) == http.StatusNotFound {
+		return noSuchDirectoryError{absPath}
+	}
 	return err
 }
 
@@ -344,6 +436,12 @@ func (w *FilesClient) recursiveDelete(ctx context.Context, name string) error {
 	// fs.WalkDir walks the directories in lexicographical order.
 	for _, dir := range slices.Backward(dirsToDelete) {
 		err := w.deleteDirectory(ctx, dir)
+		// A directory may have already vanished after its last child was
+		// deleted (see deleteDirectory for the GCS implicit-directory quirk).
+		// The delete's goal is already satisfied, so tolerate it.
+		if errors.Is(err, fs.ErrNotExist) {
+			continue
+		}
 		if err != nil {
 			return err
 		}
@@ -376,48 +474,37 @@ func (w *FilesClient) ReadDir(ctx context.Context, name string) ([]fs.DirEntry,
 		return nil, err
 	}
 
-	iter := w.workspaceClient.Files.ListDirectoryContents(ctx, files.ListDirectoryContentsRequest{
-		DirectoryPath: absPath,
-	})
-
-	files, err := listing.ToSlice(ctx, iter)
-
-	// Return early on success.
-	if err == nil {
-		entries := make([]fs.DirEntry, len(files))
-		for i, file := range files {
-			entries[i] = filesApiDirEntry{
-				i: filesApiFileInfo{
-					absPath:      file.Path,
-					isDir:        file.IsDirectory,
-					fileSize:     file.FileSize,
-					lastModified: file.LastModified,
-				},
+	var entries []fs.DirEntry
+	for entry, err := range w.client.ListDirectoryContentsIter(ctx, files.ListDirectoryContentsRequest{
+		DirectoryPath: &absPath,
+	}) {
+		if err != nil {
+			// This API returns a 404 if the specified path does not exist.
+			if httpStatus(err) == http.StatusNotFound {
+				// Check if the path is a file. If so, return not a directory error.
+				if _, ferr := w.statFile(ctx, name); ferr == nil {
+					return nil, notADirectory{absPath}
+				}
+
+				// No file or directory exists at the specified path. Return no such directory error.
+				return nil, noSuchDirectoryError{absPath}
 			}
+			return nil, err
 		}
 
-		// Sort by name for parity with os.ReadDir.
-		slices.SortFunc(entries, func(a, b fs.DirEntry) int { return cmp.Compare(a.Name(), b.Name()) })
-		return entries, nil
-	}
-
-	// Special handling of this error only if it is an API error.
-	var apierr *apierr.APIError
-	if !errors.As(err, &apierr) {
-		return nil, err
+		entries = append(entries, filesApiDirEntry{
+			i: filesApiFileInfo{
+				absPath:      value(entry.Path),
+				isDir:        value(entry.IsDirectory),
+				fileSize:     int64(value(entry.FileSize)),
+				lastModified: int64(value(entry.LastModified)),
+			},
+		})
 	}
 
-	// This API returns a 404 if the specified path does not exist.
-	if apierr.StatusCode == http.StatusNotFound {
-		// Check if the path is a file. If so, return not a directory error.
-		if _, err := w.statFile(ctx, name); err == nil {
-			return nil, notADirectory{absPath}
-		}
-
-		// No file or directory exists at the specified path. Return no such directory error.
-		return nil, noSuchDirectoryError{absPath}
-	}
-	return nil, err
+	// Sort by name for parity with os.ReadDir.
+	slices.SortFunc(entries, func(a, b fs.DirEntry) int { return cmp.Compare(a.Name(), b.Name()) })
+	return entries, nil
 }
 
 func (w *FilesClient) Mkdir(ctx context.Context, name string) error {
@@ -426,13 +513,11 @@ func (w *FilesClient) Mkdir(ctx context.Context, name string) error {
 		return err
 	}
 
-	err = w.workspaceClient.Files.CreateDirectory(ctx, files.CreateDirectoryRequest{
-		DirectoryPath: absPath,
-	})
+	_, err = w.client.CreateDirectory(ctx, files.CreateDirectoryRequest{DirectoryPath: &absPath})
 
-	// Special handling of this error only if it is an API error.
-	var aerr *apierr.APIError
-	if errors.As(err, &aerr) && aerr.StatusCode == http.StatusConflict {
+	// This API returns a 409 when a file already exists at the path (the create
+	// is not idempotent over a file).
+	if httpStatus(err) == http.StatusConflict {
 		return fileAlreadyExistsError{absPath}
 	}
 
@@ -446,25 +531,19 @@ func (w *FilesClient) statFile(ctx context.Context, name string) (fs.FileInfo, e
 		return nil, err
 	}
 
-	fileInfo, err := w.workspaceClient.Files.GetMetadataByFilePath(ctx, absPath)
+	resp, err := w.client.GetFileMetadata(ctx, files.GetFileMetadataRequest{FilePath: &absPath})
 
 	// If the HEAD requests succeeds, the file exists.
 	if err == nil {
 		return filesApiFileInfo{
 			absPath:  absPath,
 			isDir:    false,
-			fileSize: fileInfo.ContentLength,
+			fileSize: value(resp.ContentLength),
 		}, nil
 	}
 
-	// Special handling of this error only if it is an API error.
-	var aerr *apierr.APIError
-	if !errors.As(err, &aerr) {
-		return nil, err
-	}
-
 	// This API returns a 404 if the specified path does not exist.
-	if aerr.StatusCode == http.StatusNotFound {
+	if httpStatus(err) == http.StatusNotFound {
 		return nil, fileDoesNotExistError{absPath}
 	}
 
@@ -478,21 +557,15 @@ func (w *FilesClient) statDir(ctx context.Context, name string) (fs.FileInfo, er
 		return nil, err
 	}
 
-	err = w.workspaceClient.Files.GetDirectoryMetadataByDirectoryPath(ctx, absPath)
+	_, err = w.client.GetDirectoryMetadata(ctx, files.GetDirectoryMetadataRequest{DirectoryPath: &absPath})
 
 	// If the HEAD requests succeeds, the directory exists.
 	if err == nil {
 		return filesApiFileInfo{absPath: absPath, isDir: true}, nil
 	}
 
-	// Special handling of this error only if it is an API error.
-	var aerr *apierr.APIError
-	if !errors.As(err, &aerr) {
-		return nil, err
-	}
-
 	// The directory metadata API returns a 404 if the specified path does not exist.
-	if aerr.StatusCode == http.StatusNotFound {
+	if httpStatus(err) == http.StatusNotFound {
 		return nil, noSuchDirectoryError{absPath}
 	}
 
@@ -516,3 +589,12 @@ func (w *FilesClient) Stat(ctx context.Context, name string) (fs.FileInfo, error
 	// Since the path is not a directory, assume that it is a file and issue a stat call.
 	return w.statFile(ctx, name)
 }
+
+// value returns *p, or the zero value of T when p is nil.
+func value[T any](p *T) T {
+	if p == nil {
+		var zero T
+		return zero
+	}
+	return *p
+}
diff --git a/libs/filer/files_client_auth.go b/libs/filer/files_client_auth.go
new file mode 100644
index 00000000000..6ed9098532f
--- /dev/null
+++ b/libs/filer/files_client_auth.go
@@ -0,0 +1,50 @@
+package filer
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/databricks/databricks-sdk-go/config"
+	sdkauth "github.com/databricks/sdk-go/auth"
+)
+
+// configCredentials adapts the CLI's resolved SDK config into the credentials
+// interface expected by the files/v2 client. It signs a throwaway
+// request with config.Authenticate and hands the resulting headers to the
+// client, so the files/v2 client reuses the exact auth the rest of the CLI
+// already resolved instead of re-reading a profile.
+type configCredentials struct {
+	cfg *config.Config
+}
+
+// Name reports the resolved auth mechanism (e.g. "pat", "oauth-m2m"), which the
+// files/v2 client folds into its User-Agent. The CLI resolves auth when it
+// builds the workspace client, so AuthType is normally set before the filer is
+// created; fall back to "unk" when it is empty because the files/v2 client
+// rejects an empty auth name with an "invalid value" error at construction.
+func (c configCredentials) Name() string {
+	if c.cfg.AuthType == "" {
+		return "unk"
+	}
+	return c.cfg.AuthType
+}
+
+func (c configCredentials) AuthHeaders(ctx context.Context) ([]sdkauth.Header, error) {
+	// The URL is irrelevant: config.Authenticate only reads it to pick the auth
+	// scheme, and every files/v2 request targets the same workspace host.
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, c.cfg.Host, nil)
+	if err != nil {
+		return nil, err
+	}
+	if err := c.cfg.Authenticate(req); err != nil {
+		return nil, err
+	}
+
+	headers := make([]sdkauth.Header, 0, len(req.Header))
+	for key, values := range req.Header {
+		for _, value := range values {
+			headers = append(headers, sdkauth.Header{Key: key, Value: value})
+		}
+	}
+	return headers, nil
+}
diff --git a/libs/filer/files_client_test.go b/libs/filer/files_client_test.go
new file mode 100644
index 00000000000..3579c5464c5
--- /dev/null
+++ b/libs/filer/files_client_test.go
@@ -0,0 +1,218 @@
+package filer
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"io"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"testing"
+
+	cliauth "github.com/databricks/cli/libs/auth"
+	"github.com/databricks/cli/libs/databrickscfg/profile"
+	"github.com/databricks/cli/libs/env"
+	"github.com/databricks/cli/libs/testserver"
+	"github.com/databricks/databricks-sdk-go"
+	files "github.com/databricks/sdk-go/files/v2"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestNewFilesAPIClientDoesNotResolveAmbientConfig(t *testing.T) {
+	server := testserver.New(t)
+	server.Handle("HEAD", "/api/2.0/fs/files/{path...}", func(req testserver.Request) any {
+		assert.Equal(t, "Bearer resolved-token", req.Headers.Get("Authorization"))
+		assert.Empty(t, req.Headers.Get(cliauth.WorkspaceIDHeader))
+		return ""
+	})
+
+	workspaceClient, err := databricks.NewWorkspaceClient(&databricks.Config{
+		Host:        server.URL,
+		Token:       "resolved-token",
+		WorkspaceID: profile.WorkspaceIDNone,
+	})
+	require.NoError(t, err)
+
+	configFile := filepath.Join(t.TempDir(), ".databrickscfg")
+	require.NoError(t, os.WriteFile(configFile, []byte(`
+[DEFAULT]
+host = https://ambient.test
+token = ambient-token
+workspace_id = ambient-profile-workspace
+`), 0o600))
+
+	testCases := []struct {
+		name        string
+		configFile  string
+		workspaceID string
+	}{
+		{name: "config file", configFile: configFile},
+		{name: "environment", workspaceID: "ambient-env-workspace"},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Setenv("DATABRICKS_CONFIG_FILE", tc.configFile)
+			t.Setenv("DATABRICKS_CONFIG_PROFILE", "")
+			t.Setenv("DATABRICKS_WORKSPACE_ID", tc.workspaceID)
+
+			client, err := newFilesAPIClient(t.Context(), workspaceClient.Config)
+			require.NoError(t, err)
+
+			filePath := "/Volumes/main/schema/volume/file"
+			_, err = client.GetFileMetadata(t.Context(), files.GetFileMetadataRequest{FilePath: &filePath})
+			require.NoError(t, err)
+		})
+	}
+}
+
+func deleteDirectoryWithError(t *testing.T, statusCode int, errorCode, reason string) error {
+	t.Helper()
+
+	server := testserver.New(t)
+	server.Handle("DELETE", "/api/2.0/fs/directories/{path...}", func(req testserver.Request) any {
+		return testserver.Response{
+			StatusCode: statusCode,
+			Body: map[string]any{
+				"error_code": errorCode,
+				"message":    "test error",
+				"details": []map[string]any{
+					{
+						"@type":  "type.googleapis.com/google.rpc.ErrorInfo",
+						"reason": reason,
+					},
+				},
+			},
+		}
+	})
+	testserver.AddDefaultHandlers(server)
+
+	client, err := databricks.NewWorkspaceClient(&databricks.Config{
+		Host:  server.URL,
+		Token: "testtoken",
+	})
+	require.NoError(t, err)
+
+	f, err := NewFilesClient(t.Context(), client, "/test")
+	require.NoError(t, err)
+
+	return f.(*FilesClient).deleteDirectory(t.Context(), "dir")
+}
+
+func TestFilesClientDeleteDirectoryNotFound(t *testing.T) {
+	// A GCS-backed implicit directory can vanish once its last child is deleted,
+	// so the delete API returns 404 FILES_API_DIRECTORY_IS_NOT_FOUND. It must
+	// map to a not-found error so recursive delete can tolerate it.
+	err := deleteDirectoryWithError(t, 404, "NOT_FOUND", "FILES_API_DIRECTORY_IS_NOT_FOUND")
+	assert.ErrorIs(t, err, fs.ErrNotExist)
+}
+
+func TestFilesClientDeleteDirectoryNotEmpty(t *testing.T) {
+	err := deleteDirectoryWithError(t, 400, "INVALID_PARAMETER_VALUE", "FILES_API_DIRECTORY_IS_NOT_EMPTY")
+	assert.ErrorIs(t, err, fs.ErrInvalid)
+}
+
+func newTestFilesClient(t *testing.T) Filer {
+	t.Helper()
+
+	server := testserver.New(t)
+	testserver.AddDefaultHandlers(server)
+
+	client, err := databricks.NewWorkspaceClient(&databricks.Config{
+		Host:  server.URL,
+		Token: "testtoken",
+	})
+	require.NoError(t, err)
+
+	f, err := NewFilesClient(t.Context(), client, "/")
+	require.NoError(t, err)
+	return f
+}
+
+func TestFilesClientMkdirWhenFileExists(t *testing.T) {
+	// The Files API reports "a file already exists at this path" as a 409, which
+	// the SDK maps to codes.Aborted (not codes.AlreadyExists); the filer keys off
+	// the HTTP status so it still surfaces as fs.ErrExist.
+	ctx := t.Context()
+	f := newTestFilesClient(t)
+
+	require.NoError(t, f.Mkdir(ctx, "/Volumes/main/schema/vol"))
+	require.NoError(t, f.Write(ctx, "/Volumes/main/schema/vol/hello", bytes.NewReader([]byte("abc"))))
+
+	err := f.Mkdir(ctx, "/Volumes/main/schema/vol/hello")
+	assert.ErrorIs(t, err, fs.ErrExist)
+}
+
+// onlyReader hides the Seek method of an underlying reader, modelling a
+// non-seekable stream (e.g. a remote download body).
+type onlyReader struct{ io.Reader }
+
+func TestIsSeekable(t *testing.T) {
+	in := []byte("hello, files API")
+
+	if !isSeekable(bytes.NewReader(in)) {
+		t.Fatal("bytes.Reader should be seekable")
+	}
+
+	// The position must be left at the start so a subsequent read covers every byte.
+	r := bytes.NewReader(in)
+	if !isSeekable(r) {
+		t.Fatal("bytes.Reader should be seekable")
+	}
+	b, err := io.ReadAll(r)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(b, in) {
+		t.Errorf("read %q after isSeekable, want %q (position not left at start)", b, in)
+	}
+
+	if isSeekable(onlyReader{bytes.NewReader(in)}) {
+		t.Error("a non-seekable reader should report false")
+	}
+}
+
+func TestMultipartUploadEnabled(t *testing.T) {
+	ctx := t.Context()
+	if MultipartUploadEnabled(ctx) {
+		t.Error("multipart upload must be disabled by default")
+	}
+	for _, on := range []string{"true", "1", "yes", "on"} {
+		if !MultipartUploadEnabled(env.Set(ctx, multipartUploadEnvVar, on)) {
+			t.Errorf("value %q should enable multipart upload", on)
+		}
+	}
+	for _, off := range []string{"false", "0", "", "nonsense"} {
+		if MultipartUploadEnabled(env.Set(ctx, multipartUploadEnvVar, off)) {
+			t.Errorf("value %q should not enable multipart upload", off)
+		}
+	}
+}
+
+func TestMapUploadError(t *testing.T) {
+	const p = "/Volumes/c/s/v/f.bin"
+
+	if err := mapUploadError(nil, p); err != nil {
+		t.Errorf("nil error should pass through, got %v", err)
+	}
+
+	// The engine's already-exists sentinel (even wrapped) must surface as fs.ErrExist
+	// so skip-if-exists keeps working.
+	for _, in := range []error{
+		files.ErrAlreadyExists,
+		fmt.Errorf("upload failed: %w", files.ErrAlreadyExists),
+	} {
+		got := mapUploadError(in, p)
+		if !errors.Is(got, fs.ErrExist) {
+			t.Errorf("mapUploadError(%v) = %v, want errors.Is fs.ErrExist", in, got)
+		}
+	}
+
+	// Other errors pass through unchanged.
+	other := errors.New("boom")
+	if got := mapUploadError(other, p); got != other { //nolint:errorlint // must be the same error, not a wrapper
+		t.Errorf("mapUploadError(other) = %v, want it unchanged", got)
+	}
+}
diff --git a/libs/filer/local_root_path.go b/libs/filer/local_root_path.go
index 3f8843093aa..f2bbe93be3c 100644
--- a/libs/filer/local_root_path.go
+++ b/libs/filer/local_root_path.go
@@ -19,7 +19,21 @@ func NewLocalRootPath(root string) localRootPath {
 
 func (rp *localRootPath) Join(name string) (string, error) {
 	absPath := filepath.Join(rp.rootPath, name)
-	if !strings.HasPrefix(absPath, rp.rootPath) {
+
+	// An empty root carries no restriction (cmd/fs constructs unrooted local filers).
+	if rp.rootPath == "" {
+		return absPath, nil
+	}
+
+	// Joining exactly the root must stay allowed: calls like ReadDir(".") resolve to it.
+	// Any other path must extend the root past a separator boundary; a plain prefix
+	// check would also accept siblings like "/root-evil" for root "/root".
+	// Cleaned roots like "/" or `C:\` already end in a separator.
+	root := rp.rootPath
+	if !strings.HasSuffix(root, string(filepath.Separator)) {
+		root += string(filepath.Separator)
+	}
+	if absPath != rp.rootPath && !strings.HasPrefix(absPath, root) {
 		return "", fmt.Errorf("relative path escapes root: %s", name)
 	}
 	return absPath, nil
diff --git a/libs/filer/local_root_path_test.go b/libs/filer/local_root_path_test.go
index 1a39c4463b3..a665a9de7bc 100644
--- a/libs/filer/local_root_path_test.go
+++ b/libs/filer/local_root_path_test.go
@@ -52,6 +52,11 @@ func testUnixLocalRootPath(t *testing.T, uncleanRoot string) {
 	assert.NoError(t, err)
 	assert.Equal(t, cleanRoot, remotePath)
 
+	// All roots in this test end in the path element "path".
+	remotePath, err = rp.Join("../path/x")
+	assert.NoError(t, err)
+	assert.Equal(t, cleanRoot+"/x", remotePath)
+
 	_, err = rp.Join("..")
 	assert.ErrorContains(t, err, `relative path escapes root: ..`)
 
@@ -78,6 +83,16 @@ func testUnixLocalRootPath(t *testing.T, uncleanRoot string) {
 
 	_, err = rp.Join("../..")
 	assert.ErrorContains(t, err, `relative path escapes root: ../..`)
+
+	// Siblings that share the root as a string prefix must be rejected.
+	_, err = rp.Join("../path-evil")
+	assert.ErrorContains(t, err, `relative path escapes root: ../path-evil`)
+
+	_, err = rp.Join("../path-evil/x")
+	assert.ErrorContains(t, err, `relative path escapes root: ../path-evil/x`)
+
+	_, err = rp.Join("../pathx")
+	assert.ErrorContains(t, err, `relative path escapes root: ../pathx`)
 }
 
 func TestUnixLocalRootPath(t *testing.T) {
@@ -128,6 +143,21 @@ func testWindowsLocalRootPath(t *testing.T, uncleanRoot string) {
 
 	_, err = rp.Join(`a\..\..`)
 	assert.ErrorContains(t, err, `relative path escapes root`)
+
+	// All roots in this test end in the path element "path".
+	remotePath, err = rp.Join(`..\path\x`)
+	assert.NoError(t, err)
+	assert.Equal(t, cleanRoot+`\x`, remotePath)
+
+	// Siblings that share the root as a string prefix must be rejected.
+	_, err = rp.Join(`..\path-evil`)
+	assert.ErrorContains(t, err, `relative path escapes root`)
+
+	_, err = rp.Join(`..\path-evil\x`)
+	assert.ErrorContains(t, err, `relative path escapes root`)
+
+	_, err = rp.Join(`..\pathx`)
+	assert.ErrorContains(t, err, `relative path escapes root`)
 }
 
 func TestWindowsLocalRootPath(t *testing.T) {
@@ -140,3 +170,16 @@ func TestWindowsLocalRootPath(t *testing.T) {
 	testWindowsLocalRootPath(t, `c:\some\root\path\.`)
 	testWindowsLocalRootPath(t, `C:\some\root\..\path\`)
 }
+
+func TestLocalRootPathEmptyRoot(t *testing.T) {
+	// An empty root is the unrooted local filer used by cmd/fs.
+	rp := NewLocalRootPath("")
+
+	p, err := rp.Join("a/b")
+	assert.NoError(t, err)
+	assert.Equal(t, filepath.Clean("a/b"), p)
+
+	p, err = rp.Join("../a")
+	assert.NoError(t, err)
+	assert.Equal(t, filepath.Clean("../a"), p)
+}
diff --git a/libs/filer/workspace_files_cache.go b/libs/filer/workspace_files_cache.go
index 701a77b9911..3f7175f0486 100644
--- a/libs/filer/workspace_files_cache.go
+++ b/libs/filer/workspace_files_cache.go
@@ -100,7 +100,7 @@ type readDirEntry struct {
 
 // Create a new readDirEntry.
 func newReadDirEntry(name string) *readDirEntry {
-	return &readDirEntry{cacheEntry: cacheEntry{done: make(chan struct{}), name: name}}
+	return &readDirEntry{done: make(chan struct{}), name: name}
 }
 
 // Execute the operation and signal completion.
@@ -140,7 +140,7 @@ type statEntry struct {
 
 // Create a new stat entry.
 func newStatEntry(name string) *statEntry {
-	return &statEntry{cacheEntry: cacheEntry{done: make(chan struct{}), name: name}}
+	return &statEntry{done: make(chan struct{}), name: name}
 }
 
 // Execute the operation and signal completion.
diff --git a/libs/filer/workspace_files_cache_test.go b/libs/filer/workspace_files_cache_test.go
index dffa9ff3849..38d028ac8ba 100644
--- a/libs/filer/workspace_files_cache_test.go
+++ b/libs/filer/workspace_files_cache_test.go
@@ -133,9 +133,7 @@ func TestWorkspaceFilesCache_ReadDirCacheIsolation(t *testing.T) {
 	// Modify the entry to check that mutations are not reflected in the cache.
 	entries[0] = wsfsDirEntry{
 		wsfsFileInfo{
-			ObjectInfo: workspace.ObjectInfo{
-				Path: "tainted",
-			},
+			Path: "tainted",
 		},
 	}
 
@@ -258,18 +256,14 @@ func TestWorkspaceFilesCache_ReadDirTriggersReadahead(t *testing.T) {
 			"a": {
 				wsfsDirEntry{
 					wsfsFileInfo{
-						ObjectInfo: workspace.ObjectInfo{
-							Path:       "b1",
-							ObjectType: workspace.ObjectTypeDirectory,
-						},
+						Path:       "b1",
+						ObjectType: workspace.ObjectTypeDirectory,
 					},
 				},
 				wsfsDirEntry{
 					wsfsFileInfo{
-						ObjectInfo: workspace.ObjectInfo{
-							Path:       "b2",
-							ObjectType: workspace.ObjectTypeDirectory,
-						},
+						Path:       "b2",
+						ObjectType: workspace.ObjectTypeDirectory,
 					},
 				},
 			},
diff --git a/libs/filer/workspace_files_client.go b/libs/filer/workspace_files_client.go
index 54103f8158a..f6a32369f88 100644
--- a/libs/filer/workspace_files_client.go
+++ b/libs/filer/workspace_files_client.go
@@ -15,6 +15,8 @@ import (
 	"strings"
 	"time"
 
+	"github.com/databricks/cli/libs/auth"
+	"github.com/databricks/cli/libs/notebook"
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/apierr"
 	"github.com/databricks/databricks-sdk-go/client"
@@ -109,6 +111,39 @@ type apiClient interface {
 		visitors ...func(*http.Request) error) error
 }
 
+// Extensions that format=AUTO imports as the same asset type the legacy import-file
+// endpoint created: dashboards, alerts and Lakeflow Designer files.
+var autoImportAssetExtensions = []string{".lvdash.json", ".dbalert.json", ".designer.py", ".designer.ipynb"}
+
+// importRequest returns the workspace path and /workspace/import options for a file,
+// matching how the legacy import-file endpoint stored it. Other files avoid format=AUTO
+// because it types them by name and rejects names reserved for other assets
+// (e.g. .geniespace.json, .lwquery.ipynb).
+func importRequest(absPath string, content []byte) (string, []workspace.UploadOption) {
+	lower := strings.ToLower(absPath)
+	for _, ext := range autoImportAssetExtensions {
+		if strings.HasSuffix(lower, ext) {
+			return absPath, []workspace.UploadOption{workspace.UploadFormat(workspace.ImportFormatAuto)}
+		}
+	}
+
+	isNotebook, language, _ := notebook.DetectBytes(absPath, content)
+	if !isNotebook {
+		return absPath, []workspace.UploadOption{workspace.UploadFormat(workspace.ImportFormatRaw)}
+	}
+
+	// Notebooks are imported without their extension and with an explicit format.
+	ext := path.Ext(absPath)
+	notebookPath := strings.TrimSuffix(absPath, ext)
+	if strings.EqualFold(ext, notebook.ExtensionJupyter) {
+		return notebookPath, []workspace.UploadOption{workspace.UploadFormat(workspace.ImportFormatJupyter)}
+	}
+	return notebookPath, []workspace.UploadOption{
+		workspace.UploadFormat(workspace.ImportFormatSource),
+		workspace.UploadLanguage(language),
+	}
+}
+
 // WorkspaceFilesClient implements the files-in-workspace API.
 
 // NOTE: This API is available for files under /Repos if a workspace has files-in-repos enabled.
@@ -121,20 +156,16 @@ type WorkspaceFilesClient struct {
 	root WorkspaceRootPath
 }
 
-// orgIDHeaders returns headers with X-Databricks-Org-Id set if a workspace ID
-// is configured. SPOG hosts require this header to route requests to the
-// correct workspace.
-func (w *WorkspaceFilesClient) orgIDHeaders() map[string]string {
-	if w.workspaceClient == nil || w.workspaceClient.Config == nil {
-		return nil
-	}
-	wsID := w.workspaceClient.Config.WorkspaceID
-	if wsID == "" {
+// workspaceIDHeaders returns the workspace routing header map for outbound
+// API calls, or nil if the workspace client is unset. Wraps the shared
+// auth.WorkspaceIDHeaders helper with a nil-safe workspaceClient guard
+// since this filer struct can legitimately be constructed without one in
+// some test setups.
+func (w *WorkspaceFilesClient) workspaceIDHeaders() map[string]string {
+	if w.workspaceClient == nil {
 		return nil
 	}
-	return map[string]string{
-		"X-Databricks-Org-Id": wsID,
-	}
+	return auth.WorkspaceIDHeaders(w.workspaceClient.Config)
 }
 
 func NewWorkspaceFilesClient(w *databricks.WorkspaceClient, root string) (Filer, error) {
@@ -157,44 +188,49 @@ func (w *WorkspaceFilesClient) Write(ctx context.Context, name string, reader io
 		return err
 	}
 
-	// Remove leading "/" so we can use it in the URL.
-	overwrite := slices.Contains(mode, OverwriteIfExists)
-	urlPath := fmt.Sprintf(
-		"/api/2.0/workspace-files/import-file/%s?overwrite=%t",
-		url.PathEscape(strings.TrimLeft(absPath, "/")),
-		overwrite,
-	)
-
 	// Buffer the file contents because we may need to retry below and we cannot read twice.
 	body, err := io.ReadAll(reader)
 	if err != nil {
 		return err
 	}
 
-	err = w.apiClient.Do(ctx, http.MethodPost, urlPath, w.orgIDHeaders(), nil, body, nil)
+	overwrite := slices.Contains(mode, OverwriteIfExists)
+	if strings.HasSuffix(absPath, ".zip") {
+		// The legacy import-file endpoint extracts a .zip into its parent directory and
+		// overwrites existing entries. /workspace/import imports it as a new folder that
+		// cannot be overwritten, so zips stay on import-file until it supports that.
+		urlPath := fmt.Sprintf(
+			"/api/2.0/workspace-files/import-file/%s?overwrite=%t",
+			url.PathEscape(strings.TrimLeft(absPath, "/")),
+			overwrite,
+		)
+		err = w.apiClient.Do(ctx, http.MethodPost, urlPath, w.workspaceIDHeaders(), nil, body, nil)
+	} else {
+		// Upload with the SDK's multipart Workspace.Upload. The JSON-body workspace.Import
+		// caps content at 10 MB, the multipart form at the 500 MB workspace file limit.
+		uploadPath, opts := importRequest(absPath, body)
+		if overwrite {
+			opts = append(opts, workspace.UploadOverwrite())
+		}
+		err = w.workspaceClient.Workspace.Upload(ctx, uploadPath, bytes.NewReader(body), opts...)
+	}
 
 	// Return early on success.
 	if err == nil {
 		return nil
 	}
 
-	// Special handling of this error only if it is an API error.
-	var aerr *apierr.APIError
-	if !errors.As(err, &aerr) {
-		return err
-	}
-
-	// This API returns a 404 if the parent directory does not exist.
-	if aerr.StatusCode == http.StatusNotFound {
+	// Parent directory does not exist.
+	if errors.Is(err, apierr.ErrNotFound) {
 		if !slices.Contains(mode, CreateParentDirectories) {
 			return noSuchDirectoryError{path.Dir(absPath)}
 		}
 
 		// Create parent directory.
-		err = w.workspaceClient.Workspace.MkdirsByPath(ctx, path.Dir(absPath)) //nolint:staticcheck // Deprecated in SDK v0.127.0. Migration to WorkspaceHierarchyService tracked separately.
+		err = w.workspaceClient.Workspace.MkdirsByPath(ctx, path.Dir(absPath))
 		if err != nil {
-			if errors.As(err, &aerr) && aerr.StatusCode == http.StatusForbidden {
-				return permissionError{absPath}
+			if errors.Is(err, apierr.ErrPermissionDenied) {
+				return permissionError{absPath, err}
 			}
 			return fmt.Errorf("unable to mkdir to write file %s: %w", absPath, err)
 		}
@@ -203,27 +239,32 @@ func (w *WorkspaceFilesClient) Write(ctx context.Context, name string, reader io
 		return w.Write(ctx, name, bytes.NewReader(body), sliceWithout(mode, CreateParentDirectories)...)
 	}
 
-	// This API returns 409 if the file already exists, when the object type is file
-	if aerr.StatusCode == http.StatusConflict {
+	// Path already taken. ErrResourceConflict covers every 409 (including the
+	// bare 409 with only a message); ErrResourceAlreadyExists covers the 400
+	// RESOURCE_ALREADY_EXISTS, which no status maps to a conflict.
+	if errors.Is(err, apierr.ErrResourceConflict) || errors.Is(err, apierr.ErrResourceAlreadyExists) {
 		return fileAlreadyExistsError{absPath}
 	}
-
-	// This API returns 400 if the file already exists when the object type is notebook.
-	// Both the historical "Path (<path>) already exists." format and the newer
-	// "RESOURCE_ALREADY_EXISTS: <path> already exists. ..." format end with the same
-	// "already exists." marker; the JSON error_code is empty in both. The new format
-	// might not have been rolled out to all workspaces yet, so we anchor on the shared
-	// marker and return absPath rather than parsing the message.
-	if aerr.StatusCode == http.StatusBadRequest && strings.Contains(aerr.Message, "already exists.") {
-		return fileAlreadyExistsError{absPath}
+	// Overwrite rejected because the existing object's node type differs from
+	// the upload. The collision carries an AIP-193 ErrorInfo with a stable
+	// reason, so branch on it rather than the message text.
+	if errors.Is(err, apierr.ErrInvalidParameterValue) {
+		if aerr, ok := errors.AsType[*apierr.APIError](err); ok {
+			if info := aerr.ErrorDetails().ErrorInfo; info != nil && info.Reason == "WORKSPACE_OBJECT_TYPE_MISMATCH" {
+				return fileAlreadyExistsError{absPath}
+			}
+		}
 	}
 
-	// This API returns StatusForbidden when you have read access but don't have write access to a file
-	if aerr.StatusCode == http.StatusForbidden {
-		return permissionError{absPath}
+	// Caller has read access but no write access.
+	if errors.Is(err, apierr.ErrPermissionDenied) {
+		return permissionError{absPath, err}
 	}
 
-	return err
+	// Any other failure (e.g. a server-side error with an empty message) is
+	// surfaced with the target path so the user can tell which upload failed;
+	// %w keeps the original error inspectable by callers.
+	return fmt.Errorf("failed to upload %s: %w", absPath, err)
 }
 
 func (w *WorkspaceFilesClient) Read(ctx context.Context, name string) (io.ReadCloser, error) {
@@ -263,7 +304,7 @@ func (w *WorkspaceFilesClient) Delete(ctx context.Context, name string, mode ...
 
 	recursive := slices.Contains(mode, DeleteRecursively)
 
-	err = w.workspaceClient.Workspace.Delete(ctx, workspace.Delete{ //nolint:staticcheck // Deprecated in SDK v0.127.0. Migration to WorkspaceHierarchyService tracked separately.
+	err = w.workspaceClient.Workspace.Delete(ctx, workspace.Delete{
 		Path:      absPath,
 		Recursive: recursive,
 	})
@@ -274,8 +315,8 @@ func (w *WorkspaceFilesClient) Delete(ctx context.Context, name string, mode ...
 	}
 
 	// Special handling of this error only if it is an API error.
-	var aerr *apierr.APIError
-	if !errors.As(err, &aerr) {
+	aerr, ok := errors.AsType[*apierr.APIError](err)
+	if !ok {
 		return err
 	}
 
@@ -297,7 +338,7 @@ func (w *WorkspaceFilesClient) ReadDir(ctx context.Context, name string) ([]fs.D
 		return nil, err
 	}
 
-	objects, err := w.workspaceClient.Workspace.ListAll(ctx, workspace.ListWorkspaceRequest{ //nolint:staticcheck // Deprecated in SDK v0.127.0. Migration to WorkspaceHierarchyService tracked separately.
+	objects, err := w.workspaceClient.Workspace.ListAll(ctx, workspace.ListWorkspaceRequest{
 		Path: absPath,
 	})
 
@@ -307,8 +348,8 @@ func (w *WorkspaceFilesClient) ReadDir(ctx context.Context, name string) ([]fs.D
 
 	if err != nil {
 		// If we got an API error we deal with it below.
-		var aerr *apierr.APIError
-		if !errors.As(err, &aerr) {
+		aerr, ok := errors.AsType[*apierr.APIError](err)
+		if !ok {
 			return nil, err
 		}
 
@@ -329,7 +370,7 @@ func (w *WorkspaceFilesClient) Mkdir(ctx context.Context, name string) error {
 	if err != nil {
 		return err
 	}
-	return w.workspaceClient.Workspace.Mkdirs(ctx, workspace.Mkdirs{ //nolint:staticcheck // Deprecated in SDK v0.127.0. Migration to WorkspaceHierarchyService tracked separately.
+	return w.workspaceClient.Workspace.Mkdirs(ctx, workspace.Mkdirs{
 		Path: dirPath,
 	})
 }
@@ -349,7 +390,7 @@ func (w *WorkspaceFilesClient) Stat(ctx context.Context, name string) (fs.FileIn
 		ctx,
 		http.MethodGet,
 		"/api/2.0/workspace/get-status",
-		w.orgIDHeaders(),
+		w.workspaceIDHeaders(),
 		nil,
 		map[string]string{
 			"path":               absPath,
@@ -359,8 +400,8 @@ func (w *WorkspaceFilesClient) Stat(ctx context.Context, name string) (fs.FileIn
 	)
 	if err != nil {
 		// If we got an API error we deal with it below.
-		var aerr *apierr.APIError
-		if !errors.As(err, &aerr) {
+		aerr, ok := errors.AsType[*apierr.APIError](err)
+		if !ok {
 			return nil, err
 		}
 
@@ -368,6 +409,8 @@ func (w *WorkspaceFilesClient) Stat(ctx context.Context, name string) (fs.FileIn
 		if aerr.StatusCode == http.StatusNotFound {
 			return nil, fileDoesNotExistError{absPath}
 		}
+
+		return nil, err
 	}
 
 	return stat, nil
diff --git a/libs/filer/workspace_files_client_test.go b/libs/filer/workspace_files_client_test.go
index 2603d31d6df..81832694d15 100644
--- a/libs/filer/workspace_files_client_test.go
+++ b/libs/filer/workspace_files_client_test.go
@@ -1,18 +1,25 @@
 package filer
 
 import (
+	"bytes"
 	"encoding/json"
 	"io/fs"
+	"net/http"
+	"strings"
 	"testing"
 	"time"
 
+	"github.com/databricks/cli/libs/testserver"
 	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/apierr"
 	"github.com/databricks/databricks-sdk-go/config"
 	"github.com/databricks/databricks-sdk-go/service/workspace"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
+// Confirms directory entries derived from workspace object infos report the
+// name, type, and size of each object type the workspace can return.
 func TestWorkspaceFilesDirEntry(t *testing.T) {
 	entries := wsfsDirEntriesFromObjectInfos([]workspace.ObjectInfo{
 		{
@@ -59,7 +66,9 @@ func TestWorkspaceFilesDirEntry(t *testing.T) {
 	assert.True(t, i2.IsDir())
 }
 
-func TestWorkspaceFilesClientOrgIDHeaders(t *testing.T) {
+// Confirms the workspace ID routing header is set only when the client config
+// carries a workspace ID, and that a nil workspace client yields no headers.
+func TestWorkspaceFilesClientWorkspaceIDHeaders(t *testing.T) {
 	tests := []struct {
 		name        string
 		workspaceID string
@@ -68,7 +77,7 @@ func TestWorkspaceFilesClientOrgIDHeaders(t *testing.T) {
 		{
 			name:        "with workspace ID",
 			workspaceID: "7474644166319138",
-			expect:      map[string]string{"X-Databricks-Org-Id": "7474644166319138"},
+			expect:      map[string]string{"X-Databricks-Workspace-Id": "7474644166319138"},
 		},
 		{
 			name:        "without workspace ID",
@@ -85,16 +94,198 @@ func TestWorkspaceFilesClientOrgIDHeaders(t *testing.T) {
 					},
 				},
 			}
-			assert.Equal(t, tc.expect, w.orgIDHeaders())
+			assert.Equal(t, tc.expect, w.workspaceIDHeaders())
 		})
 	}
 
 	t.Run("nil workspace client", func(t *testing.T) {
 		w := &WorkspaceFilesClient{}
-		assert.Nil(t, w.orgIDHeaders())
+		assert.Nil(t, w.workspaceIDHeaders())
 	})
 }
 
+// Confirms each error /workspace/import returns is translated to the filer's
+// own error type, and that unrecognized errors pass through unchanged. The
+// endpoint signals an occupied path with three different status/error_code
+// combinations (see the comment on Write), so all three are covered here to
+// pin the mapping the rest of the CLI relies on.
+func TestWorkspaceFilesClientWriteErrorMapping(t *testing.T) {
+	tests := []struct {
+		name            string
+		mode            []WriteMode
+		apiErr          *apierr.APIError
+		expectErrTarget any
+	}{
+		{
+			name:            "404 without create-parent maps to noSuchDirectoryError",
+			apiErr:          &apierr.APIError{StatusCode: http.StatusNotFound, Message: "not found"},
+			expectErrTarget: noSuchDirectoryError{},
+		},
+		{
+			name: "400 RESOURCE_ALREADY_EXISTS maps to fileAlreadyExistsError",
+			apiErr: &apierr.APIError{
+				StatusCode: http.StatusBadRequest,
+				ErrorCode:  "RESOURCE_ALREADY_EXISTS",
+				Message:    "/dir/file.txt already exists. Please pass overwrite=true to overwrite it.",
+			},
+			expectErrTarget: fileAlreadyExistsError{},
+		},
+		{
+			name: "409 ALREADY_EXISTS (concurrent contention) maps to fileAlreadyExistsError",
+			apiErr: &apierr.APIError{
+				StatusCode: http.StatusConflict,
+				ErrorCode:  "ALREADY_EXISTS",
+				Message:    "Node with name /dir/file.txt already exists. Please pass overwrite=true to update it.",
+			},
+			expectErrTarget: fileAlreadyExistsError{},
+		},
+		{
+			// A 409 carrying no error_code unwraps to ErrResourceConflict only,
+			// not to ErrAlreadyExists; the testserver returns exactly this shape.
+			name: "409 without error_code maps to fileAlreadyExistsError",
+			apiErr: &apierr.APIError{
+				StatusCode: http.StatusConflict,
+				Message:    "Node with name /dir/file.txt already exists.",
+			},
+			expectErrTarget: fileAlreadyExistsError{},
+		},
+		{
+			name: "400 INVALID_PARAMETER_VALUE other message passes through",
+			apiErr: &apierr.APIError{
+				StatusCode: http.StatusBadRequest,
+				ErrorCode:  "INVALID_PARAMETER_VALUE",
+				Message:    "some other validation failure",
+			},
+			expectErrTarget: nil,
+		},
+		{
+			name:            "403 maps to permissionError",
+			apiErr:          &apierr.APIError{StatusCode: http.StatusForbidden, Message: "denied"},
+			expectErrTarget: permissionError{},
+		},
+		{
+			name:            "500 passes through",
+			apiErr:          &apierr.APIError{StatusCode: http.StatusInternalServerError, Message: "boom"},
+			expectErrTarget: nil,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			server := testserver.New(t)
+			server.Handle("POST", "/api/2.0/workspace/import", func(req testserver.Request) any {
+				return testserver.Response{
+					StatusCode: tc.apiErr.StatusCode,
+					Body: map[string]string{
+						"error_code": tc.apiErr.ErrorCode,
+						"message":    tc.apiErr.Message,
+					},
+				}
+			})
+			testserver.AddDefaultHandlers(server)
+
+			client, err := databricks.NewWorkspaceClient(&databricks.Config{
+				Host:  server.URL,
+				Token: "testtoken",
+			})
+			require.NoError(t, err)
+
+			f, err := NewWorkspaceFilesClient(client, "/dir")
+			require.NoError(t, err)
+
+			err = f.Write(t.Context(), "file.txt", bytes.NewReader([]byte("data")), tc.mode...)
+			require.Error(t, err)
+			switch target := tc.expectErrTarget.(type) {
+			case noSuchDirectoryError:
+				assert.ErrorAs(t, err, &target)
+			case fileAlreadyExistsError:
+				assert.ErrorAs(t, err, &target)
+			case permissionError:
+				assert.ErrorAs(t, err, &target)
+			case nil:
+				// passthrough — the underlying APIError stays inspectable,
+				// and the message names the file that failed to upload.
+				var aerr *apierr.APIError
+				require.ErrorAs(t, err, &aerr)
+				assert.Equal(t, tc.apiErr.StatusCode, aerr.StatusCode)
+				assert.Contains(t, err.Error(), "/dir/file.txt")
+			}
+		})
+	}
+}
+
+// writeWithImportError exercises Write through a real HTTP roundtrip so the
+// SDK parses AIP-193 error details from the response body (the errorDetails
+// field on apierr.APIError is unexported and only populated during response
+// parsing, so it cannot be set on a directly constructed APIError).
+func writeWithImportError(t *testing.T, body map[string]any) error {
+	t.Helper()
+
+	server := testserver.New(t)
+	server.Handle("POST", "/api/2.0/workspace/import", func(req testserver.Request) any {
+		return testserver.Response{
+			StatusCode: http.StatusBadRequest,
+			Body:       body,
+		}
+	})
+	testserver.AddDefaultHandlers(server)
+
+	client, err := databricks.NewWorkspaceClient(&databricks.Config{
+		Host:  server.URL,
+		Token: "testtoken",
+	})
+	require.NoError(t, err)
+
+	f, err := NewWorkspaceFilesClient(client, "/dir")
+	require.NoError(t, err)
+
+	err = f.Write(t.Context(), "file.txt", strings.NewReader("data"), OverwriteIfExists)
+	require.Error(t, err)
+	return err
+}
+
+// Confirms a type-mismatch collision is recognized from the structured
+// AIP-193 ErrorInfo reason, independent of the error message wording.
+func TestWorkspaceFilesClientWriteTypeMismatchReason(t *testing.T) {
+	// The message is deliberately unrelated to any collision wording, to prove
+	// the branch fires on the structured reason alone.
+	err := writeWithImportError(t, map[string]any{
+		"error_code": "INVALID_PARAMETER_VALUE",
+		"message":    "some future wording for the same condition",
+		"details": []map[string]any{
+			{
+				"@type":    "type.googleapis.com/google.rpc.ErrorInfo",
+				"reason":   "WORKSPACE_OBJECT_TYPE_MISMATCH",
+				"domain":   "workspace.databricks.com",
+				"metadata": map[string]string{"existing_type": "NOTEBOOK"},
+			},
+		},
+	})
+	var target fileAlreadyExistsError
+	assert.ErrorAs(t, err, &target)
+}
+
+// Confirms an ErrorInfo carrying some other reason is not mistaken for a path
+// collision, so the reason check above cannot swallow unrelated failures.
+func TestWorkspaceFilesClientWriteUnrelatedReasonPassesThrough(t *testing.T) {
+	err := writeWithImportError(t, map[string]any{
+		"error_code": "INVALID_PARAMETER_VALUE",
+		"message":    "some other validation failure",
+		"details": []map[string]any{
+			{
+				"@type":  "type.googleapis.com/google.rpc.ErrorInfo",
+				"reason": "SOME_OTHER_REASON",
+				"domain": "workspace.databricks.com",
+			},
+		},
+	})
+	var aerr *apierr.APIError
+	require.ErrorAs(t, err, &aerr)
+	assert.Equal(t, http.StatusBadRequest, aerr.StatusCode)
+}
+
+// Confirms a workspace get-status payload unmarshals into wsfsFileInfo and that
+// the fs.FileInfo methods derived from it report the expected values.
 func TestWorkspaceFilesClient_wsfsUnmarshal(t *testing.T) {
 	payload := `
 		{
@@ -131,3 +322,57 @@ func TestWorkspaceFilesClient_wsfsUnmarshal(t *testing.T) {
 	assert.False(t, info.IsDir())
 	assert.NotNil(t, info.Sys())
 }
+
+func statWithError(t *testing.T, statusCode int, errorCode string) error {
+	t.Helper()
+
+	server := testserver.New(t)
+	server.Handle("GET", "/api/2.0/workspace/get-status", func(req testserver.Request) any {
+		return testserver.Response{
+			StatusCode: statusCode,
+			Body: map[string]string{
+				"error_code": errorCode,
+				"message":    "test error",
+			},
+		}
+	})
+	testserver.AddDefaultHandlers(server)
+
+	client, err := databricks.NewWorkspaceClient(&databricks.Config{
+		Host:  server.URL,
+		Token: "testtoken",
+	})
+	require.NoError(t, err)
+
+	f, err := NewWorkspaceFilesClient(client, "/test")
+	require.NoError(t, err)
+
+	_, err = f.Stat(t.Context(), "file")
+	require.Error(t, err)
+	return err
+}
+
+// Confirms a 403 from get-status surfaces as an APIError rather than being
+// remapped, so callers can distinguish it from a missing file.
+func TestWorkspaceFilesClientStatForbidden(t *testing.T) {
+	err := statWithError(t, 403, "PERMISSION_DENIED")
+	var apiErr *apierr.APIError
+	require.ErrorAs(t, err, &apiErr)
+	assert.Equal(t, 403, apiErr.StatusCode)
+}
+
+// Confirms a 500 from get-status surfaces as an APIError and is not treated as
+// a missing file.
+func TestWorkspaceFilesClientStatInternalError(t *testing.T) {
+	err := statWithError(t, 500, "INTERNAL_ERROR")
+	var apiErr *apierr.APIError
+	require.ErrorAs(t, err, &apiErr)
+	assert.Equal(t, 500, apiErr.StatusCode)
+}
+
+// Confirms RESOURCE_DOES_NOT_EXIST maps to fs.ErrNotExist so the filer plugs
+// into the io/fs error conventions callers check against.
+func TestWorkspaceFilesClientStatNotFound(t *testing.T) {
+	err := statWithError(t, 404, "RESOURCE_DOES_NOT_EXIST")
+	assert.ErrorIs(t, err, fs.ErrNotExist)
+}
diff --git a/libs/filer/workspace_files_extensions_client.go b/libs/filer/workspace_files_extensions_client.go
index 44e21432c51..29adbdbddf6 100644
--- a/libs/filer/workspace_files_extensions_client.go
+++ b/libs/filer/workspace_files_extensions_client.go
@@ -124,6 +124,13 @@ func (w *WorkspaceFilesExtensionsClient) getNotebookStatByNameWithoutExt(ctx con
 		ext = notebook.ExtensionJupyter
 	}
 
+	// Extension-less notebook names cannot round-trip through [Stat] or [Read],
+	// which report them as not found, so return nil to have [ReadDir] omit the entry.
+	if ext == "" {
+		log.Warnf(ctx, "skipping notebook %s: no file extension is associated with notebook language %q", path.Join(w.root, name), stat.Language)
+		return nil, nil
+	}
+
 	// Modify the stat object path to include the extension. This stat object will be used
 	// to return the fs.DirEntry object in the ReadDir method.
 	stat.Path = stat.Path + ext
@@ -205,6 +212,7 @@ func (w *WorkspaceFilesExtensionsClient) ReadDir(ctx context.Context, name strin
 	}
 
 	seenPaths := make(map[string]workspace.ObjectInfo)
+	result := make([]fs.DirEntry, 0, len(entries))
 	for i := range entries {
 		info, err := entries[i].Info()
 		if err != nil {
@@ -218,6 +226,10 @@ func (w *WorkspaceFilesExtensionsClient) ReadDir(ctx context.Context, name strin
 			if err != nil {
 				return nil, err
 			}
+			// A nil stat means the notebook's language has no extension mapping; omit the entry.
+			if stat == nil {
+				continue
+			}
 			// Replace the entry with the new entry that includes the extension.
 			entries[i] = wsfsDirEntry{wsfsFileInfo{ObjectInfo: stat.ObjectInfo}}
 		}
@@ -232,9 +244,10 @@ func (w *WorkspaceFilesExtensionsClient) ReadDir(ctx context.Context, name strin
 			}
 		}
 		seenPaths[entries[i].Name()] = sysInfo
+		result = append(result, entries[i])
 	}
 
-	return entries, nil
+	return result, nil
 }
 
 // Note: The import API returns opaque internal errors for namespace clashes
diff --git a/libs/filer/workspace_files_extensions_client_test.go b/libs/filer/workspace_files_extensions_client_test.go
index b3b4861ee8e..6d7c37a9ada 100644
--- a/libs/filer/workspace_files_extensions_client_test.go
+++ b/libs/filer/workspace_files_extensions_client_test.go
@@ -162,11 +162,9 @@ func TestFilerWorkspaceFilesExtensionsErrorsOnDupName(t *testing.T) {
 			// Mock bespoke API calls to /api/2.0/workspace/get-status, that are
 			// used to figure out the right file extension for the notebook.
 			statNotebook := wsfsFileInfo{
-				ObjectInfo: workspace.ObjectInfo{
-					Path:       tc.notebookPath,
-					Language:   tc.language,
-					ObjectType: workspace.ObjectTypeNotebook,
-				},
+				Path:              tc.notebookPath,
+				Language:          tc.language,
+				ObjectType:        workspace.ObjectTypeNotebook,
 				ReposExportFormat: tc.notebookExportFormat,
 			}
 
@@ -201,3 +199,87 @@ func TestFilerWorkspaceFilesExtensionsErrorsOnDupName(t *testing.T) {
 		})
 	}
 }
+
+func TestFilerWorkspaceFilesExtensionsReadDirWithUnmappedLanguage(t *testing.T) {
+	for _, tc := range []struct {
+		name                 string
+		language             workspace.Language
+		notebookExportFormat workspace.ExportFormat
+		expectedNames        []string
+	}{
+		{
+			name:                 "source notebook with empty language is skipped",
+			language:             "",
+			notebookExportFormat: workspace.ExportFormatSource,
+			expectedNames:        []string{"bar.py"},
+		},
+		{
+			name:                 "source notebook with unknown language is skipped",
+			language:             workspace.Language("FUTURELANG"),
+			notebookExportFormat: workspace.ExportFormatSource,
+			expectedNames:        []string{"bar.py"},
+		},
+		{
+			name:                 "jupyter notebook with unknown language keeps the .ipynb extension",
+			language:             workspace.Language("FUTURELANG"),
+			notebookExportFormat: workspace.ExportFormatJupyter,
+			expectedNames:        []string{"bar.py", "foo.ipynb"},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			mockedWorkspaceClient := mocks.NewMockWorkspaceClient(t)
+			mockedApiClient := mockApiClient{}
+
+			workspaceApi := mockedWorkspaceClient.GetMockWorkspaceAPI()
+			workspaceApi.EXPECT().ListAll(mock.Anything, workspace.ListWorkspaceRequest{
+				Path: "/dir",
+			}).Return([]workspace.ObjectInfo{
+				{
+					Path:       "/dir/bar.py",
+					ObjectType: workspace.ObjectTypeFile,
+				},
+				{
+					Path:       "/dir/foo",
+					Language:   tc.language,
+					ObjectType: workspace.ObjectTypeNotebook,
+				},
+			}, nil)
+
+			// Mock the get-status call used to figure out the notebook's file extension.
+			statNotebook := wsfsFileInfo{
+				Path:              "/dir/foo",
+				Language:          tc.language,
+				ObjectType:        workspace.ObjectTypeNotebook,
+				ReposExportFormat: tc.notebookExportFormat,
+			}
+
+			mockedApiClient.On("Do", mock.Anything, http.MethodGet, "/api/2.0/workspace/get-status", map[string]string(nil), map[string]string{
+				"path":               "/dir/foo",
+				"return_export_info": "true",
+			}, mock.AnythingOfType("*filer.wsfsFileInfo"), []func(*http.Request) error(nil)).Return(nil, statNotebook)
+
+			workspaceFilesClient := WorkspaceFilesClient{
+				workspaceClient: mockedWorkspaceClient.WorkspaceClient,
+				apiClient:       &mockedApiClient,
+				root:            NewWorkspaceRootPath("/dir"),
+			}
+
+			workspaceFilesExtensionsClient := WorkspaceFilesExtensionsClient{
+				workspaceClient: mockedWorkspaceClient.WorkspaceClient,
+				wsfs:            &workspaceFilesClient,
+			}
+
+			entries, err := workspaceFilesExtensionsClient.ReadDir(t.Context(), "/")
+			assert.NoError(t, err)
+
+			names := make([]string, len(entries))
+			for i, entry := range entries {
+				names[i] = entry.Name()
+			}
+			assert.Equal(t, tc.expectedNames, names)
+
+			workspaceApi.AssertNumberOfCalls(t, "ListAll", 1)
+			mockedApiClient.AssertNumberOfCalls(t, "Do", 1)
+		})
+	}
+}
diff --git a/libs/filer/workspace_root_path.go b/libs/filer/workspace_root_path.go
index d5163924a15..5da25c86ae8 100644
--- a/libs/filer/workspace_root_path.go
+++ b/libs/filer/workspace_root_path.go
@@ -26,7 +26,15 @@ func (p *WorkspaceRootPath) Join(name string) (string, error) {
 	absPath := path.Join(p.rootPath, name)
 
 	// Don't allow escaping the specified root using relative paths.
-	if !strings.HasPrefix(absPath, p.rootPath) {
+	// Joining exactly the root must stay allowed: calls like ReadDir(".") resolve to it.
+	// Any other path must extend the root past a separator boundary; a plain prefix
+	// check would also accept siblings like "/root-evil" for root "/root".
+	// Cleaned roots like "/" (see cmd/fs) already end in a separator.
+	root := p.rootPath
+	if !strings.HasSuffix(root, "/") {
+		root += "/"
+	}
+	if absPath != p.rootPath && !strings.HasPrefix(absPath, root) {
 		return "", fmt.Errorf("relative path escapes root: %s", name)
 	}
 
diff --git a/libs/filer/workspace_root_path_test.go b/libs/filer/workspace_root_path_test.go
index 73746d274f8..beadf833b5b 100644
--- a/libs/filer/workspace_root_path_test.go
+++ b/libs/filer/workspace_root_path_test.go
@@ -51,6 +51,11 @@ func testRootPath(t *testing.T, uncleanRoot string) {
 	assert.NoError(t, err)
 	assert.Equal(t, cleanRoot, remotePath)
 
+	// All roots in this test end in the path element "path".
+	remotePath, err = rp.Join("../path/x")
+	assert.NoError(t, err)
+	assert.Equal(t, cleanRoot+"/x", remotePath)
+
 	_, err = rp.Join("..")
 	assert.ErrorContains(t, err, `relative path escapes root: ..`)
 
@@ -77,6 +82,16 @@ func testRootPath(t *testing.T, uncleanRoot string) {
 
 	_, err = rp.Join("../..")
 	assert.ErrorContains(t, err, `relative path escapes root: ../..`)
+
+	// Siblings that share the root as a string prefix must be rejected.
+	_, err = rp.Join("../path-evil")
+	assert.ErrorContains(t, err, `relative path escapes root: ../path-evil`)
+
+	_, err = rp.Join("../path-evil/x")
+	assert.ErrorContains(t, err, `relative path escapes root: ../path-evil/x`)
+
+	_, err = rp.Join("../pathx")
+	assert.ErrorContains(t, err, `relative path escapes root: ../pathx`)
 }
 
 func TestRootPathClean(t *testing.T) {
diff --git a/libs/fileset/file.go b/libs/fileset/file.go
index 0a27b294cf7..1517f1ed539 100644
--- a/libs/fileset/file.go
+++ b/libs/fileset/file.go
@@ -67,6 +67,16 @@ func (f File) Modified() (ts time.Time) {
 	return info.ModTime()
 }
 
+// Size returns the file size in bytes. ok is false if the size cannot be
+// determined, e.g. the file was removed between listing and stat.
+func (f File) Size() (size int64, ok bool) {
+	info, err := f.entry.Info()
+	if err != nil {
+		return 0, false
+	}
+	return info.Size(), true
+}
+
 func (f *File) IsNotebook() (bool, error) {
 	if f.fileType != Unknown {
 		return f.fileType == Notebook, nil
diff --git a/libs/fileset/file_test.go b/libs/fileset/file_test.go
index 1ce1ff59a34..3613246e341 100644
--- a/libs/fileset/file_test.go
+++ b/libs/fileset/file_test.go
@@ -1,6 +1,8 @@
 package fileset
 
 import (
+	"os"
+	"path/filepath"
 	"testing"
 
 	"github.com/databricks/cli/internal/testutil"
@@ -22,6 +24,19 @@ func TestSourceFileIsNotNotebook(t *testing.T) {
 	require.False(t, isNotebook)
 }
 
+func TestFileSize(t *testing.T) {
+	tmpDir := t.TempDir()
+	contents := []byte("hello world")
+	require.NoError(t, os.WriteFile(filepath.Join(tmpDir, "test.txt"), contents, 0o644))
+
+	files, err := New(vfs.MustNew(tmpDir)).Files()
+	require.NoError(t, err)
+	require.Len(t, files, 1)
+	size, ok := files[0].Size()
+	require.True(t, ok)
+	require.Equal(t, int64(len(contents)), size)
+}
+
 func TestUnknownFileDetectsNotebook(t *testing.T) {
 	tmpDir := t.TempDir()
 	root := vfs.MustNew(tmpDir)
diff --git a/libs/fileset/glob_test.go b/libs/fileset/glob_test.go
index 9c5cb63fdf6..40388996447 100644
--- a/libs/fileset/glob_test.go
+++ b/libs/fileset/glob_test.go
@@ -37,7 +37,7 @@ func TestGlobFileset(t *testing.T) {
 	files, err := g.Files()
 	require.NoError(t, err)
 
-	require.Equal(t, len(files), len(entries))
+	require.Len(t, entries, len(files))
 	for _, f := range files {
 		exists := slices.ContainsFunc(entries, func(de fs.DirEntry) bool {
 			return de.Name() == path.Base(f.Relative)
@@ -67,7 +67,7 @@ func TestGlobFilesetWithRelativeRoot(t *testing.T) {
 
 	files, err := g.Files()
 	require.NoError(t, err)
-	require.Equal(t, len(files), len(entries))
+	require.Len(t, entries, len(files))
 }
 
 func TestGlobFilesetRecursively(t *testing.T) {
diff --git a/libs/flags/json_flag.go b/libs/flags/json_flag.go
index d5f143c5654..3ea4834a5f2 100644
--- a/libs/flags/json_flag.go
+++ b/libs/flags/json_flag.go
@@ -2,6 +2,7 @@ package flags
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"os"
 	"reflect"
@@ -23,6 +24,9 @@ func (j *JsonFlag) String() string {
 
 // TODO: Command.MarkFlagFilename()
 func (j *JsonFlag) Set(v string) error {
+	if v == "" {
+		return errors.New("expected inline JSON or @path/to/file, got an empty string")
+	}
 	// Load request from file if it starts with '@' (like curl).
 	if v[0] != '@' {
 		j.raw = []byte(v)
@@ -59,7 +63,7 @@ func (j *JsonFlag) Unmarshal(v any) diag.Diagnostics {
 
 	if !nv.IsValid() {
 		kind := reflect.TypeOf(v).Kind()
-		if kind == reflect.Ptr {
+		if kind == reflect.Pointer {
 			kind = reflect.TypeOf(v).Elem().Kind()
 		}
 
@@ -88,7 +92,7 @@ func (j *JsonFlag) Unmarshal(v any) diag.Diagnostics {
 	}
 
 	kind := reflect.ValueOf(v).Kind()
-	if kind == reflect.Ptr {
+	if kind == reflect.Pointer {
 		kind = reflect.ValueOf(v).Elem().Kind()
 	}
 
@@ -113,3 +117,56 @@ func (j *JsonFlag) Unmarshal(v any) diag.Diagnostics {
 func (j *JsonFlag) Type() string {
 	return "JSON"
 }
+
+// Raw returns the raw JSON bytes the flag was set to (or nil when the flag
+// was not provided). Exposed so command overrides can do shape-level
+// validation before the generated Unmarshal call.
+func (j *JsonFlag) Raw() []byte {
+	return j.raw
+}
+
+// Validate parses the JSON for well-formedness and returns the same positioned
+// error Unmarshal would (including the @file source in the location), without
+// decoding it into a value. Callers that send the raw bytes verbatim use this
+// to keep client-side validation. Returns nil when the flag was not set.
+func (j *JsonFlag) Validate() error {
+	if j.raw == nil {
+		return nil
+	}
+	_, err := jsonloader.LoadJSON(j.raw, j.source)
+	return err
+}
+
+// RejectWrappedJSON returns a clear client-side error when the --json body
+// is a top-level object containing outerKey. It detects the common mistake
+// of wrapping the body in '{"<outerKey>": ...}' when the flag binds to the
+// inner object (the SDK request type's JSON-tagged outer field). Returns
+// nil when the flag is unset, when the body isn't an object, or when no
+// outerKey is present at the top level.
+//
+// example, if non-empty, is appended to the error as a hint at the correct
+// shape. Callers typically construct it as a self-contained command line.
+//
+// This is the shared helper used by the postgres command overrides; the
+// same inner-body --json shape exists across siblings like create-branch,
+// create-database, create-endpoint, and create-project.
+func (j *JsonFlag) RejectWrappedJSON(outerKey, example string) error {
+	if len(j.raw) == 0 {
+		return nil
+	}
+	var top map[string]json.RawMessage
+	if err := json.Unmarshal(j.raw, &top); err != nil {
+		// Defer non-object inputs to the generated unmarshal so its
+		// diagnostics render the original parse error.
+		return nil //nolint:nilerr
+	}
+	if _, found := top[outerKey]; !found {
+		return nil
+	}
+	msg := fmt.Sprintf("--json should NOT be wrapped in '{%q: ...}'.\n\n"+
+		"The flag binds to the inner object — supply its fields directly.", outerKey)
+	if example != "" {
+		msg += "\n\nExample:\n\n  " + example
+	}
+	return fmt.Errorf("%s", msg)
+}
diff --git a/libs/flags/json_flag_test.go b/libs/flags/json_flag_test.go
index 4bebf8b68c0..675e1014922 100644
--- a/libs/flags/json_flag_test.go
+++ b/libs/flags/json_flag_test.go
@@ -7,11 +7,25 @@ import (
 
 	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/structs/structpath"
 	"github.com/databricks/databricks-sdk-go/service/jobs"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
+func TestJsonFlagValidate(t *testing.T) {
+	var unset JsonFlag
+	assert.NoError(t, unset.Validate())
+
+	var valid JsonFlag
+	require.NoError(t, valid.Set(`{"job_id": 18000000000000000123}`))
+	assert.NoError(t, valid.Validate())
+
+	var invalid JsonFlag
+	require.NoError(t, invalid.Set(`{"a": 1,}`))
+	assert.EqualError(t, invalid.Validate(), "error decoding JSON at (inline):1:8: invalid character ',' looking for beginning of value")
+}
+
 func TestJsonFlagEmpty(t *testing.T) {
 	var body JsonFlag
 
@@ -24,6 +38,13 @@ func TestJsonFlagEmpty(t *testing.T) {
 	assert.Nil(t, request)
 }
 
+func TestJsonFlagEmptyValue(t *testing.T) {
+	var body JsonFlag
+
+	err := body.Set("")
+	assert.EqualError(t, err, "expected inline JSON or @path/to/file, got an empty string")
+}
+
 func TestJsonFlagInline(t *testing.T) {
 	var body JsonFlag
 
@@ -174,14 +195,14 @@ func TestJsonUnmarshalRequestMismatch(t *testing.T) {
 	assert.Contains(t, diags, diag.Diagnostic{
 		Severity: diag.Warning,
 		Summary:  "unknown field: settings",
-		Locations: []dyn.Location{
+		Locations: []diag.Location{
 			{
 				File:   "(inline)",
 				Line:   3,
 				Column: 6,
 			},
 		},
-		Paths: []dyn.Path{{}},
+		Paths: dyn.ToStructPaths(dyn.EmptyPath),
 	})
 }
 
@@ -232,14 +253,14 @@ func TestJsonUnmarshalWrongTypeReportsCorrectLocation(t *testing.T) {
 	assert.Contains(t, diags, diag.Diagnostic{
 		Severity: diag.Warning,
 		Summary:  "expected int, found sequence",
-		Locations: []dyn.Location{
+		Locations: []diag.Location{
 			{
 				File:   "(inline)",
 				Line:   2,
 				Column: 15,
 			},
 		},
-		Paths: []dyn.Path{dyn.NewPath(dyn.Key("job_id"))},
+		Paths: structpath.NewPathSlice("job_id"),
 	})
 }
 
@@ -257,14 +278,14 @@ func TestJsonUnmarshalArrayInsteadOfIntReportsCorrectLocation(t *testing.T) {
 	assert.Contains(t, diags, diag.Diagnostic{
 		Severity: diag.Warning,
 		Summary:  "cannot parse \"wrong_type\" as an integer",
-		Locations: []dyn.Location{
+		Locations: []diag.Location{
 			{
 				File:   "(inline)",
 				Line:   14,
 				Column: 40,
 			},
 		},
-		Paths: []dyn.Path{dyn.NewPath(dyn.Key("new_settings"), dyn.Key("timeout_seconds"))},
+		Paths: structpath.NewPathSlice("new_settings", "timeout_seconds"),
 	})
 }
 
@@ -284,3 +305,44 @@ func TestJsonUnmarshalForRequestWithForceSendFields(t *testing.T) {
 	assert.NotContains(t, r.NewSettings.NotificationSettings.ForceSendFields, "NoAlertForSkippedRuns")
 	assert.Contains(t, r.NewSettings.NotificationSettings.ForceSendFields, "NoAlertForCanceledRuns")
 }
+
+func TestRejectWrappedJSON(t *testing.T) {
+	tests := []struct {
+		name     string
+		raw      string
+		outerKey string
+		wantErr  string
+	}{
+		{name: "empty body passes", raw: "", outerKey: "role"},
+		{name: "non-object body passes", raw: `"not-an-object"`, outerKey: "role"},
+		{name: "object without outer key passes", raw: `{"spec":{"foo":"bar"}}`, outerKey: "role"},
+		{name: "object with outer key rejected", raw: `{"role":{"spec":{"foo":"bar"}}}`, outerKey: "role", wantErr: `should NOT be wrapped`},
+		{name: "object with outer key plus siblings still rejected", raw: `{"role":{},"other":1}`, outerKey: "role", wantErr: `should NOT be wrapped`},
+		{name: "outer key differs from body's outer", raw: `{"branch":{}}`, outerKey: "role"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var jf JsonFlag
+			if tt.raw != "" {
+				require.NoError(t, jf.Set(tt.raw))
+			}
+			err := jf.RejectWrappedJSON(tt.outerKey, "")
+			if tt.wantErr != "" {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), tt.wantErr)
+				return
+			}
+			assert.NoError(t, err)
+		})
+	}
+}
+
+func TestRejectWrappedJSONIncludesExample(t *testing.T) {
+	var jf JsonFlag
+	require.NoError(t, jf.Set(`{"role":{}}`))
+	err := jf.RejectWrappedJSON("role", "databricks postgres create-role --json '{\"spec\":{}}'")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "Example:")
+	assert.Contains(t, err.Error(), `--json '{"spec":{}}'`)
+}
diff --git a/libs/folders/folders_test.go b/libs/folders/folders_test.go
index d2afc4f2dd9..8f135c1d6b8 100644
--- a/libs/folders/folders_test.go
+++ b/libs/folders/folders_test.go
@@ -33,6 +33,6 @@ func TestFindDirWithLeaf(t *testing.T) {
 	{
 		out, err := FindDirWithLeaf(root, "this-leaf-doesnt-exist-anywhere")
 		assert.ErrorIs(t, err, os.ErrNotExist)
-		assert.Equal(t, "", out)
+		assert.Empty(t, out)
 	}
 }
diff --git a/libs/genie/adapter.go b/libs/genie/adapter.go
new file mode 100644
index 00000000000..c84b319c7e1
--- /dev/null
+++ b/libs/genie/adapter.go
@@ -0,0 +1,543 @@
+package genie
+
+import (
+	"encoding/json"
+	"fmt"
+	"strconv"
+	"strings"
+
+	"github.com/databricks/cli/libs/genie/agentstream"
+)
+
+// SSE event type constants.
+const (
+	eventError            = "error"
+	eventResponseDone     = "response.done"
+	eventResponseComplete = "response.completed"
+	eventOutputItemAdded  = "response.output_item.added"
+	eventOutputItemDone   = "response.output_item.done"
+)
+
+// Output item type constants.
+const (
+	itemReasoning          = "reasoning"
+	itemMessage            = "message"
+	itemFunctionCall       = "function_call"
+	itemFunctionCallOutput = "function_call_output"
+)
+
+// Item status constants. An in_progress item can carry partial content that
+// its later .done event completes; an empty status is treated as complete
+// because some items (e.g. function_call .added events) omit the field.
+const (
+	itemStatusCompleted  = "completed"
+	itemStatusInProgress = "in_progress"
+)
+
+// UI type metadata constants.
+const (
+	uiTypeThought       = "THOUGHT"
+	uiTypeFinalResponse = "FINAL_RESPONSE"
+	uiTypeViz           = "VIZ"
+	uiTypeQueryExec     = "QUERY_EXECUTION"
+)
+
+// Content and role constants.
+const (
+	roleAssistant     = "assistant"
+	contentOutputText = "output_text"
+)
+
+// Tool names that carry user-facing output rather than hidden tool activity:
+// output_final_response delivers the answer, ask_user_questions asks the user
+// to clarify. Other tool calls are intermediate activity and stay hidden.
+const (
+	toolOutputFinalResponse = "output_final_response"
+	toolAskUserQuestions    = "ask_user_questions"
+)
+
+// sseAdapter tracks per-stream state: parsed SQL results, which item IDs have
+// already been handled (.added and .done can both arrive for one item), and
+// visualizations waiting for their result data.
+type sseAdapter struct {
+	queryData  map[string]*agentstream.TableData // statement_id -> parsed table
+	processed  map[string]bool                   // item ID -> already handled
+	pendingViz []pendingViz                      // viz specs seen before their data
+}
+
+// pendingViz is a visualization whose QUERY_EXECUTION data has not arrived
+// yet, keyed by the statement IDs it joins on.
+type pendingViz struct {
+	spec   *agentstream.VizSpec
+	sqlID  string
+	stmtID string
+	raw    string
+}
+
+// NewAdaptSSE creates a stateful adapter that tracks SQL query results
+// and emits EventViz events when visualizations are encountered.
+//
+// Unknown event types are ignored (the server may add new ones), but a known
+// event whose payload fails to decode becomes EventUnparsed: dropping those
+// silently is how a metadata type change once made this command print
+// nothing and exit 0.
+func NewAdaptSSE() agentstream.AdapterFunc {
+	a := &sseAdapter{
+		queryData: make(map[string]*agentstream.TableData),
+		processed: make(map[string]bool),
+	}
+	return a.adapt
+}
+
+func (a *sseAdapter) adapt(data string) []agentstream.StreamEvent {
+	b := []byte(data)
+
+	var envelope SSEEventEnvelope
+	if err := json.Unmarshal(b, &envelope); err != nil {
+		return unparsed(data)
+	}
+
+	switch envelope.Type {
+	case eventError:
+		return adaptError(b, data)
+	case eventResponseDone, eventResponseComplete:
+		return adaptResponseDone(b, data)
+	case eventOutputItemAdded, eventOutputItemDone:
+		return a.adaptOutputItem(b, data)
+	default:
+		return nil
+	}
+}
+
+// unparsed flags a payload the adapter recognized but could not decode.
+func unparsed(raw string) []agentstream.StreamEvent {
+	return []agentstream.StreamEvent{{
+		Kind: agentstream.EventUnparsed,
+		Raw:  raw,
+	}}
+}
+
+// adaptError converts a server error event. It never returns nil: an error
+// event in an unexpected shape must still fail the stream loudly, so the raw
+// payload stands in when no message can be extracted.
+func adaptError(b []byte, raw string) []agentstream.StreamEvent {
+	var sseErr SSEError
+	_ = json.Unmarshal(b, &sseErr)
+	text := sseErr.Message
+	if text == "" {
+		text = raw
+	}
+	return []agentstream.StreamEvent{{
+		Kind:      agentstream.EventError,
+		Text:      text,
+		ErrorCode: sseErr.ErrorCodeString(),
+		Raw:       raw,
+	}}
+}
+
+func adaptResponseDone(b []byte, raw string) []agentstream.StreamEvent {
+	var done SSEResponseDone
+	if err := json.Unmarshal(b, &done); err != nil {
+		// An undecodable completion event must not pass for a successful
+		// one; the renderers treat a stream without EventDone as incomplete.
+		return unparsed(raw)
+	}
+	return []agentstream.StreamEvent{{
+		Kind:           agentstream.EventDone,
+		Status:         done.Response.Status,
+		ConversationID: done.Response.ConversationID,
+		Raw:            raw,
+	}}
+}
+
+func adaptOutputItemValue(item OutputItem, raw string) []agentstream.StreamEvent {
+	switch item.Type {
+	case itemReasoning:
+		return []agentstream.StreamEvent{{
+			Kind: agentstream.EventThinking,
+			Text: "Thinking...",
+			Raw:  raw,
+		}}
+	case itemMessage:
+		return adaptMessage(item, raw)
+	case itemFunctionCall:
+		return adaptFunctionCall(item, raw)
+	default:
+		return nil
+	}
+}
+
+// adaptFunctionCall converts a function_call item into stream events. Most tool
+// calls become EventToolCall (hidden unless they are SQL with --include-sql),
+// but two carry user-facing output that would otherwise be lost: the final
+// answer (output_final_response) and clarification prompts (ask_user_questions).
+func adaptFunctionCall(item OutputItem, raw string) []agentstream.StreamEvent {
+	// An in_progress item can carry partial arguments that its .done event
+	// completes; emitting it would mark the item processed and dedupe away
+	// the complete version.
+	if item.Status == itemStatusInProgress {
+		return nil
+	}
+	switch item.Name {
+	case toolOutputFinalResponse:
+		text := finalResponseText(item.Arguments)
+		if text == "" {
+			return nil
+		}
+		return []agentstream.StreamEvent{{
+			Kind: agentstream.EventFinalResponse,
+			Text: text,
+			Raw:  raw,
+		}}
+	case toolAskUserQuestions:
+		text := formatQuestions(item.Arguments)
+		if text == "" {
+			return nil
+		}
+		return []agentstream.StreamEvent{{
+			Kind: agentstream.EventText,
+			Text: text,
+			Raw:  raw,
+		}}
+	default:
+		// The .added event for a tool call can carry empty arguments that are
+		// only filled in on the matching .done event. Emitting the empty call
+		// would mark the item as processed and dedupe away the real one.
+		if item.Arguments == "" {
+			return nil
+		}
+		return []agentstream.StreamEvent{{
+			Kind: agentstream.EventToolCall,
+			ToolCall: &agentstream.ToolCallEvent{
+				Name:      item.Name,
+				Arguments: item.Arguments,
+			},
+			Raw: raw,
+		}}
+	}
+}
+
+// finalResponseText extracts the answer from an output_final_response tool
+// call's arguments ({"response": "..."}).
+func finalResponseText(arguments string) string {
+	var args struct {
+		Response string `json:"response"`
+	}
+	if err := json.Unmarshal([]byte(arguments), &args); err != nil {
+		return ""
+	}
+	return args.Response
+}
+
+// formatQuestions renders an ask_user_questions tool call's arguments into a
+// readable clarification prompt. Arguments are
+// {"questions": [{"question", "type", "choices": [{"label", "description"}]}]}.
+func formatQuestions(arguments string) string {
+	var args struct {
+		Questions []struct {
+			Question string `json:"question"`
+			Type     string `json:"type"`
+			Choices  []struct {
+				Label       string `json:"label"`
+				Description string `json:"description"`
+			} `json:"choices"`
+		} `json:"questions"`
+	}
+	if err := json.Unmarshal([]byte(arguments), &args); err != nil {
+		return ""
+	}
+	if len(args.Questions) == 0 {
+		return ""
+	}
+	var b strings.Builder
+	b.WriteString("The agent needs clarification:\n")
+	for i, q := range args.Questions {
+		fmt.Fprintf(&b, "\n%d. %s", i+1, q.Question)
+		if q.Type == "confirmation" {
+			b.WriteString(" (yes / no)")
+		}
+		b.WriteString("\n")
+		for _, c := range q.Choices {
+			if c.Description != "" {
+				fmt.Fprintf(&b, "   - %s: %s\n", c.Label, c.Description)
+			} else {
+				fmt.Fprintf(&b, "   - %s\n", c.Label)
+			}
+		}
+	}
+	b.WriteString("\nReply in plain text to continue.")
+	return b.String()
+}
+
+// itemTypeEnvelope extracts just the item type from an SSE event.
+// This avoids parsing metadata (which may contain non-string values
+// like booleans and objects that break map[string]string).
+type itemTypeEnvelope struct {
+	Item struct {
+		Type string `json:"type"`
+	} `json:"item"`
+}
+
+// adaptOutputItem handles output items with query result tracking.
+func (a *sseAdapter) adaptOutputItem(b []byte, raw string) []agentstream.StreamEvent {
+	// First pass: detect item type without parsing metadata.
+	var typeCheck itemTypeEnvelope
+	if err := json.Unmarshal(b, &typeCheck); err != nil {
+		return unparsed(raw)
+	}
+
+	switch typeCheck.Item.Type {
+	case itemFunctionCallOutput:
+		// Parse with funcCallOutputEvent which handles non-string metadata.
+		return a.adaptFuncCallOutput(b, raw)
+	default:
+		var event SSEOutputItemEvent
+		if err := json.Unmarshal(b, &event); err != nil {
+			return unparsed(raw)
+		}
+		if event.Item.ID != "" {
+			if a.processed[event.Item.ID] {
+				return nil
+			}
+		}
+		events := adaptOutputItemValue(event.Item, raw)
+		if len(events) > 0 && event.Item.ID != "" {
+			a.processed[event.Item.ID] = true
+		}
+		return events
+	}
+}
+
+// adaptFuncCallOutput processes function_call_output items.
+// It stores SQL query results and emits EventViz for visualizations.
+func (a *sseAdapter) adaptFuncCallOutput(b []byte, raw string) []agentstream.StreamEvent {
+	var event funcCallOutputEvent
+	if err := json.Unmarshal(b, &event); err != nil {
+		return unparsed(raw)
+	}
+
+	item := event.Item
+	if item.Status != itemStatusCompleted {
+		return nil
+	}
+
+	if item.ID != "" && a.processed[item.ID] {
+		return nil
+	}
+
+	meta := item.Metadata
+
+	// SQL query result: store the preview rows so a viz can join to them.
+	if meta.UIType == uiTypeQueryExec && meta.StatementID != "" {
+		td := tableDataFromResult(meta.ResultData)
+		if td == nil {
+			return nil
+		}
+		a.queryData[meta.StatementID] = td
+		if item.ID != "" {
+			a.processed[item.ID] = true
+		}
+		return a.flushPendingViz(meta.StatementID)
+	}
+
+	// Visualization: build a VizEvent from the viz_definition spec + stored data.
+	if meta.UIType == uiTypeViz && meta.VizDefinition != "" {
+		spec := vizSpecFromVizDefinition(meta.VizDefinition)
+		if spec == nil {
+			return nil
+		}
+
+		if item.ID != "" {
+			a.processed[item.ID] = true
+		}
+
+		// Look up query data by sql_id (which matches the SQL output's statement_id).
+		if data := a.lookupQueryData(meta.SQLID, meta.StatementID); data != nil {
+			return []agentstream.StreamEvent{vizEvent(spec, data, raw)}
+		}
+
+		// Items normally complete in causal order (the query before the viz
+		// built from it), but a viz observed first is buffered rather than
+		// silently lost.
+		a.pendingViz = append(a.pendingViz, pendingViz{spec: spec, sqlID: meta.SQLID, stmtID: meta.StatementID, raw: raw})
+		return nil
+	}
+
+	return nil
+}
+
+// lookupQueryData resolves the result table a viz joins to. sql_id is the
+// primary key; statement_id appears on some payload variants.
+func (a *sseAdapter) lookupQueryData(sqlID, stmtID string) *agentstream.TableData {
+	if sqlID != "" {
+		if td := a.queryData[sqlID]; td != nil {
+			return td
+		}
+	}
+	if stmtID != "" {
+		return a.queryData[stmtID]
+	}
+	return nil
+}
+
+// flushPendingViz emits buffered visualizations whose data just arrived.
+func (a *sseAdapter) flushPendingViz(stmtID string) []agentstream.StreamEvent {
+	var events []agentstream.StreamEvent
+	var remaining []pendingViz
+	for _, p := range a.pendingViz {
+		if p.sqlID == stmtID || p.stmtID == stmtID {
+			events = append(events, vizEvent(p.spec, a.queryData[stmtID], p.raw))
+			continue
+		}
+		remaining = append(remaining, p)
+	}
+	a.pendingViz = remaining
+	return events
+}
+
+func vizEvent(spec *agentstream.VizSpec, data *agentstream.TableData, raw string) agentstream.StreamEvent {
+	return agentstream.StreamEvent{
+		Kind: agentstream.EventViz,
+		Viz:  &agentstream.VizEvent{Spec: spec, Data: data},
+		Raw:  raw,
+	}
+}
+
+// tableDataFromResult converts QUERY_EXECUTION result_data (columns plus
+// preview rows in array-of-arrays form) into TableData. Returns nil when there
+// are no rows to render.
+func tableDataFromResult(rd *queryResultData) *agentstream.TableData {
+	if rd == nil || len(rd.Columns) == 0 || len(rd.PreviewRows) == 0 {
+		return nil
+	}
+	columns := make([]string, len(rd.Columns))
+	for i, c := range rd.Columns {
+		columns[i] = c.Name
+	}
+	rows := make([][]string, 0, len(rd.PreviewRows))
+	for _, raw := range rd.PreviewRows {
+		row := make([]string, len(columns))
+		for i, v := range raw[:min(len(raw), len(columns))] {
+			row[i] = stringifyCell(v)
+		}
+		rows = append(rows, row)
+	}
+	return &agentstream.TableData{Columns: columns, Rows: rows}
+}
+
+// stringifyCell renders a preview-row cell as a string. The Statement Execution
+// API returns cells as strings, but a numeric cell can arrive as a JSON number.
+func stringifyCell(v any) string {
+	switch x := v.(type) {
+	case nil:
+		return ""
+	case string:
+		return x
+	case float64:
+		return strconv.FormatFloat(x, 'f', -1, 64)
+	case bool:
+		return strconv.FormatBool(x)
+	default:
+		return fmt.Sprintf("%v", x)
+	}
+}
+
+// vizSpecFromVizDefinition parses the JSON-encoded Helios spec from
+// metadata.viz_definition and maps it to a VizSpec. Returns nil if the spec
+// can't be parsed or lacks usable x/y encodings.
+func vizSpecFromVizDefinition(vizDefinition string) *agentstream.VizSpec {
+	var def heliosVizDefinition
+	if err := json.Unmarshal([]byte(vizDefinition), &def); err != nil {
+		return nil
+	}
+	rs := def.RenderSpec
+	if rs == nil {
+		return nil
+	}
+	spec := &agentstream.VizSpec{
+		Title:      rs.Frame.Title,
+		WidgetType: rs.WidgetType,
+	}
+	if rs.Encodings.X != nil {
+		spec.XField = encodingField(rs.Encodings.X)
+		spec.XTitle = rs.Encodings.X.DisplayName
+	}
+	if rs.Encodings.Y != nil {
+		spec.YFields = encodingFields(rs.Encodings.Y)
+		spec.YTitle = rs.Encodings.Y.DisplayName
+	}
+	if spec.XField == "" || len(spec.YFields) == 0 {
+		return nil
+	}
+	return spec
+}
+
+// encodingField returns the single field name for an axis: FieldName, or the
+// first entry of Fields.
+func encodingField(e *heliosEncoding) string {
+	if e.FieldName != "" {
+		return e.FieldName
+	}
+	if len(e.Fields) > 0 {
+		return e.Fields[0].FieldName
+	}
+	return ""
+}
+
+// encodingFields returns every field name for an axis. A single FieldName
+// yields one series; Fields yields one per entry (multi-series).
+func encodingFields(e *heliosEncoding) []string {
+	if len(e.Fields) > 0 {
+		names := make([]string, 0, len(e.Fields))
+		for _, f := range e.Fields {
+			if f.FieldName != "" {
+				names = append(names, f.FieldName)
+			}
+		}
+		return names
+	}
+	if e.FieldName != "" {
+		return []string{e.FieldName}
+	}
+	return nil
+}
+
+func adaptMessage(item OutputItem, raw string) []agentstream.StreamEvent {
+	if item.Role != roleAssistant {
+		return nil
+	}
+
+	// An in_progress message can carry partial text that its .done event
+	// completes; emitting it would mark the item processed and dedupe away
+	// the complete version.
+	if item.Status == itemStatusInProgress {
+		return nil
+	}
+
+	if item.UIType() == uiTypeThought {
+		// Thoughts become status-line updates.
+		for _, c := range item.Content {
+			if c.Type == contentOutputText && c.Text != "" {
+				return []agentstream.StreamEvent{{
+					Kind: agentstream.EventThinking,
+					Text: c.Text,
+					Raw:  raw,
+				}}
+			}
+		}
+		return nil
+	}
+
+	// FINAL_RESPONSE or unlabeled assistant messages become text output.
+	var events []agentstream.StreamEvent
+	for _, c := range item.Content {
+		if c.Type == contentOutputText && c.Text != "" {
+			events = append(events, agentstream.StreamEvent{
+				Kind: agentstream.EventText,
+				Text: c.Text,
+				Raw:  raw,
+			})
+		}
+	}
+	return events
+}
diff --git a/libs/genie/adapter_test.go b/libs/genie/adapter_test.go
new file mode 100644
index 00000000000..ba821dfbd99
--- /dev/null
+++ b/libs/genie/adapter_test.go
@@ -0,0 +1,376 @@
+package genie
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/genie/agentstream"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// Raw SSE data payloads (without "data: " prefix or trailing newlines).
+const reasoningData = `{"type":"response.output_item.added","output_index":0,"item":{"type":"reasoning","id":"r1","status":"in_progress","content":[{"type":"reasoning_text","text":"Looking at data..."}]}}`
+
+const messageData = `{"type":"response.output_item.added","output_index":1,"item":{"type":"message","id":"m1","role":"assistant","status":"completed","content":[{"type":"output_text","text":"Total sales were $1,234,567.","annotations":[]}]}}`
+
+const thoughtData = `{"type":"response.output_item.added","output_index":0,"item":{"type":"message","id":"t1","role":"assistant","status":"completed","content":[{"type":"output_text","text":"I will search for tables...","annotations":[]}],"metadata":{"ui_type":"THOUGHT"}}}`
+
+const finalResponseData = `{"type":"response.output_item.added","output_index":1,"item":{"type":"message","id":"m1","role":"assistant","status":"completed","content":[{"type":"output_text","text":"Here are your tables.","annotations":[]}],"metadata":{"ui_type":"FINAL_RESPONSE"}}}`
+
+const sqlData = `{"type":"response.output_item.added","output_index":2,"item":{"type":"function_call","id":"fc1","call_id":"c1","status":"completed","name":"execute_sql","arguments":"{\"sql\":\"SELECT SUM(amount) FROM sales\",\"title\":\"Total Sales\"}"}}`
+
+const sqlQueryData = `{"type":"response.output_item.added","output_index":9,"item":{"type":"function_call","id":"toolu_1","call_id":"toolu_1","name":"execute_sql_query","arguments":"{\"thought\":\"Let me sample the table\",\"query\":\"SELECT * FROM kie.test.bbc_articles LIMIT 3\"}","metadata":{"ui_type":"QUERY_EXECUTION","query":"SELECT * FROM kie.test.bbc_articles LIMIT 3"}}}`
+
+const doneData = `{"type":"response.completed","response":{"id":"resp_1","status":"completed","output":[]}}`
+
+const doneFailedData = `{"type":"response.done","response":{"id":"resp_1","status":"failed","output":[]}}`
+
+const errorData = `{"type":"error","error_code":"RESOURCE_DOES_NOT_EXIST","message":"No eligible SQL warehouse found"}`
+
+const messageUpdatedData = `{"type":"response.output_item.updated","output_index":1,"item":{"type":"message","id":"m1","role":"assistant","status":"completed","content":[{"type":"output_text","text":"Total sales were $1,234,567.","annotations":[]}]}}`
+
+// adaptOne runs a single payload through a fresh stateful adapter.
+func adaptOne(data string) []agentstream.StreamEvent {
+	return NewAdaptSSE()(data)
+}
+
+func TestAdaptSSE_Reasoning(t *testing.T) {
+	events := adaptOne(reasoningData)
+	require.Len(t, events, 1)
+	assert.Equal(t, agentstream.EventThinking, events[0].Kind)
+	assert.Equal(t, "Thinking...", events[0].Text)
+}
+
+func TestAdaptSSE_Message(t *testing.T) {
+	events := adaptOne(messageData)
+	require.Len(t, events, 1)
+	assert.Equal(t, agentstream.EventText, events[0].Kind)
+	assert.Equal(t, "Total sales were $1,234,567.", events[0].Text)
+}
+
+func TestAdaptSSE_Thought(t *testing.T) {
+	events := adaptOne(thoughtData)
+	require.Len(t, events, 1)
+	assert.Equal(t, agentstream.EventThinking, events[0].Kind)
+	assert.Equal(t, "I will search for tables...", events[0].Text)
+}
+
+func TestAdaptSSE_FinalResponse(t *testing.T) {
+	events := adaptOne(finalResponseData)
+	require.Len(t, events, 1)
+	assert.Equal(t, agentstream.EventText, events[0].Kind)
+	assert.Equal(t, "Here are your tables.", events[0].Text)
+}
+
+func TestAdaptSSE_FunctionCall(t *testing.T) {
+	events := adaptOne(sqlData)
+	require.Len(t, events, 1)
+	assert.Equal(t, agentstream.EventToolCall, events[0].Kind)
+	require.NotNil(t, events[0].ToolCall)
+	assert.Equal(t, "execute_sql", events[0].ToolCall.Name)
+	assert.Contains(t, events[0].ToolCall.Arguments, "SELECT SUM(amount) FROM sales")
+}
+
+func TestAdaptSSE_Error(t *testing.T) {
+	events := adaptOne(errorData)
+	require.Len(t, events, 1)
+	assert.Equal(t, agentstream.EventError, events[0].Kind)
+	assert.Equal(t, "No eligible SQL warehouse found", events[0].Text)
+	assert.Equal(t, "RESOURCE_DOES_NOT_EXIST", events[0].ErrorCode)
+}
+
+func TestAdaptSSE_ErrorInUnexpectedShape(t *testing.T) {
+	// A server failure must never become an empty success, even when the
+	// error payload doesn't match the expected shape.
+	data := `{"type":"error","message":{"nested":"boom"}}`
+	events := adaptOne(data)
+	require.Len(t, events, 1)
+	assert.Equal(t, agentstream.EventError, events[0].Kind)
+	assert.Equal(t, data, events[0].Text)
+	assert.Empty(t, events[0].ErrorCode)
+}
+
+func TestAdaptSSE_DoneCompleted(t *testing.T) {
+	events := adaptOne(doneData)
+	require.Len(t, events, 1)
+	assert.Equal(t, agentstream.EventDone, events[0].Kind)
+	assert.Equal(t, "completed", events[0].Status)
+}
+
+func TestAdaptSSE_DoneFailed(t *testing.T) {
+	events := adaptOne(doneFailedData)
+	require.Len(t, events, 1)
+	assert.Equal(t, agentstream.EventDone, events[0].Kind)
+	assert.Equal(t, "failed", events[0].Status)
+}
+
+func TestAdaptSSE_DoneInUnexpectedShape(t *testing.T) {
+	// An undecodable completion event must not pass for a successful one.
+	events := adaptOne(`{"type":"response.done","response":[1,2]}`)
+	require.Len(t, events, 1)
+	assert.Equal(t, agentstream.EventUnparsed, events[0].Kind)
+}
+
+func TestAdaptSSE_ExecuteSQLQuery(t *testing.T) {
+	events := adaptOne(sqlQueryData)
+	require.Len(t, events, 1)
+	assert.Equal(t, agentstream.EventToolCall, events[0].Kind)
+	require.NotNil(t, events[0].ToolCall)
+	assert.Equal(t, "execute_sql_query", events[0].ToolCall.Name)
+	assert.Contains(t, events[0].ToolCall.Arguments, "SELECT * FROM kie.test.bbc_articles LIMIT 3")
+}
+
+func TestAdaptSSE_UpdatedItemVariantIgnored(t *testing.T) {
+	// Only .added and .done item events are processed; .updated duplicates
+	// what .done will carry.
+	assert.Empty(t, adaptOne(messageUpdatedData))
+}
+
+func TestAdaptSSE_InvalidJSON(t *testing.T) {
+	events := adaptOne("not json")
+	require.Len(t, events, 1)
+	assert.Equal(t, agentstream.EventUnparsed, events[0].Kind)
+}
+
+func TestAdaptSSE_UnknownEventTypeIgnored(t *testing.T) {
+	assert.Empty(t, adaptOne(`{"type":"response.unknown"}`))
+}
+
+func TestAdaptSSE_UnparseableItemFlagged(t *testing.T) {
+	// A known event type whose payload doesn't decode is exactly the failure
+	// mode that once made the command print nothing: it must be flagged.
+	data := `{"type":"response.output_item.added","item":{"type":"message","content":"not an array"}}`
+	events := adaptOne(data)
+	require.Len(t, events, 1)
+	assert.Equal(t, agentstream.EventUnparsed, events[0].Kind)
+}
+
+func TestAdaptSSE_QueryExecutionAndViz(t *testing.T) {
+	adapt := NewAdaptSSE()
+
+	// A QUERY_EXECUTION output carries the preview rows under result_data.
+	qe := `{"type":"response.output_item.done","item":{"type":"function_call_output","id":"o1","call_id":"c1","status":"completed","metadata":{"ui_type":"QUERY_EXECUTION","statement_id":"stmt1","result_data":{"columns":[{"name":"franchise"},{"name":"total"}],"preview_rows":[["Alpha","100"],["Beta","200"]]}}}}`
+	assert.Empty(t, adapt(qe))
+
+	// A VIZ output carries the Helios spec under viz_definition (a JSON string,
+	// nested under renderSpec) and references the query by sql_id.
+	viz := `{"type":"response.output_item.done","item":{"type":"function_call_output","id":"o2","call_id":"c2","status":"completed","metadata":{"ui_type":"VIZ","sql_id":"stmt1","embed_id":"v1","viz_definition":"{\"renderSpec\":{\"widgetType\":\"bar\",\"frame\":{\"title\":\"Total by Franchise\"},\"encodings\":{\"x\":{\"fieldName\":\"franchise\"},\"y\":{\"fieldName\":\"total\",\"displayName\":\"Total Sales\"}}}}"}}}`
+	events := adapt(viz)
+	require.Len(t, events, 1)
+	assert.Equal(t, agentstream.EventViz, events[0].Kind)
+	require.NotNil(t, events[0].Viz)
+	require.NotNil(t, events[0].Viz.Spec)
+	assert.Equal(t, "bar", events[0].Viz.Spec.WidgetType)
+	assert.Equal(t, "Total by Franchise", events[0].Viz.Spec.Title)
+	assert.Equal(t, "franchise", events[0].Viz.Spec.XField)
+	assert.Equal(t, []string{"total"}, events[0].Viz.Spec.YFields)
+	assert.Equal(t, "Total Sales", events[0].Viz.Spec.YTitle)
+	require.NotNil(t, events[0].Viz.Data)
+	assert.Equal(t, []string{"franchise", "total"}, events[0].Viz.Data.Columns)
+	require.Len(t, events[0].Viz.Data.Rows, 2)
+	assert.Equal(t, []string{"Beta", "200"}, events[0].Viz.Data.Rows[1])
+}
+
+func TestAdaptSSE_QueryExecutionCellTypes(t *testing.T) {
+	adapt := NewAdaptSSE()
+
+	// Preview cells can be JSON numbers, booleans, or null, and rows can be
+	// shorter or longer than the column list.
+	qe := `{"type":"response.output_item.done","item":{"type":"function_call_output","id":"o1","call_id":"c1","status":"completed","metadata":{"ui_type":"QUERY_EXECUTION","statement_id":"stmt1","result_data":{"columns":[{"name":"name"},{"name":"total"}],"preview_rows":[["Alpha",100.5],["Beta",true],["Gamma",null],["Delta"],["Epsilon","1","extra"]]}}}}`
+	assert.Empty(t, adapt(qe))
+
+	viz := `{"type":"response.output_item.done","item":{"type":"function_call_output","id":"o2","call_id":"c2","status":"completed","metadata":{"ui_type":"VIZ","sql_id":"stmt1","embed_id":"v1","viz_definition":"{\"renderSpec\":{\"widgetType\":\"bar\",\"frame\":{\"title\":\"T\"},\"encodings\":{\"x\":{\"fieldName\":\"name\"},\"y\":{\"fieldName\":\"total\"}}}}"}}}`
+	events := adapt(viz)
+	require.Len(t, events, 1)
+	require.NotNil(t, events[0].Viz.Data)
+	assert.Equal(t, [][]string{
+		{"Alpha", "100.5"},
+		{"Beta", "true"},
+		{"Gamma", ""},
+		{"Delta", ""},
+		{"Epsilon", "1"},
+	}, events[0].Viz.Data.Rows)
+}
+
+func TestAdaptSSE_MultiSeriesYEncoding(t *testing.T) {
+	adapt := NewAdaptSSE()
+
+	qe := `{"type":"response.output_item.done","item":{"type":"function_call_output","id":"o1","call_id":"c1","status":"completed","metadata":{"ui_type":"QUERY_EXECUTION","statement_id":"stmt1","result_data":{"columns":[{"name":"month"},{"name":"a"},{"name":"b"}],"preview_rows":[["Jan","1","2"]]}}}}`
+	assert.Empty(t, adapt(qe))
+
+	viz := `{"type":"response.output_item.done","item":{"type":"function_call_output","id":"o2","call_id":"c2","status":"completed","metadata":{"ui_type":"VIZ","sql_id":"stmt1","embed_id":"v1","viz_definition":"{\"renderSpec\":{\"widgetType\":\"line\",\"frame\":{\"title\":\"T\"},\"encodings\":{\"x\":{\"fieldName\":\"month\"},\"y\":{\"fields\":[{\"fieldName\":\"a\"},{\"fieldName\":\"b\"}]}}}}"}}}`
+	events := adapt(viz)
+	require.Len(t, events, 1)
+	assert.Equal(t, []string{"a", "b"}, events[0].Viz.Spec.YFields)
+}
+
+func TestAdaptSSE_QueryExecutionCanArriveAfterIncompleteOutput(t *testing.T) {
+	adapt := NewAdaptSSE()
+
+	incomplete := `{"type":"response.output_item.done","item":{"type":"function_call_output","id":"o4","call_id":"c1","status":"completed","metadata":{"ui_type":"QUERY_EXECUTION","statement_id":"stmt2"}}}`
+	assert.Empty(t, adapt(incomplete))
+
+	complete := `{"type":"response.output_item.done","item":{"type":"function_call_output","id":"o4","call_id":"c1","status":"completed","metadata":{"ui_type":"QUERY_EXECUTION","statement_id":"stmt2","result_data":{"columns":[{"name":"name"},{"name":"total"}],"preview_rows":[["Alpha","100"]]}}}}`
+	assert.Empty(t, adapt(complete))
+
+	viz := `{"type":"response.output_item.done","item":{"type":"function_call_output","id":"o5","call_id":"c2","status":"completed","metadata":{"ui_type":"VIZ","sql_id":"stmt2","embed_id":"v1","viz_definition":"{\"renderSpec\":{\"widgetType\":\"bar\",\"frame\":{\"title\":\"Total\"},\"encodings\":{\"x\":{\"fieldName\":\"name\"},\"y\":{\"fieldName\":\"total\"}}}}"}}}`
+	events := adapt(viz)
+	require.Len(t, events, 1)
+	require.NotNil(t, events[0].Viz.Data)
+	assert.Equal(t, []string{"Alpha", "100"}, events[0].Viz.Data.Rows[0])
+}
+
+func TestNewAdaptSSE_VizBeforeQueryData(t *testing.T) {
+	adapt := NewAdaptSSE()
+
+	// The viz arrives before the query data it joins to: it must be buffered
+	// and emitted when the data shows up, not silently lost.
+	viz := `{"type":"response.output_item.done","item":{"type":"function_call_output","id":"o2","call_id":"c2","status":"completed","metadata":{"ui_type":"VIZ","sql_id":"stmt1","embed_id":"v1","viz_definition":"{\"renderSpec\":{\"widgetType\":\"bar\",\"frame\":{\"title\":\"T\"},\"encodings\":{\"x\":{\"fieldName\":\"name\"},\"y\":{\"fieldName\":\"total\"}}}}"}}}`
+	assert.Empty(t, adapt(viz))
+
+	qe := `{"type":"response.output_item.done","item":{"type":"function_call_output","id":"o1","call_id":"c1","status":"completed","metadata":{"ui_type":"QUERY_EXECUTION","statement_id":"stmt1","result_data":{"columns":[{"name":"name"},{"name":"total"}],"preview_rows":[["Alpha","100"]]}}}}`
+	events := adapt(qe)
+	require.Len(t, events, 1)
+	assert.Equal(t, agentstream.EventViz, events[0].Kind)
+	require.NotNil(t, events[0].Viz.Data)
+	assert.Equal(t, []string{"Alpha", "100"}, events[0].Viz.Data.Rows[0])
+}
+
+func TestNewAdaptSSE_InProgressMessageNotDedupedPrematurely(t *testing.T) {
+	adapt := NewAdaptSSE()
+
+	// A partial in_progress message must not be emitted (and must not mark
+	// the item processed), or the complete .done version would be deduped.
+	added := `{"type":"response.output_item.added","output_index":0,"item":{"type":"message","id":"m9","role":"assistant","status":"in_progress","content":[{"type":"output_text","text":"Partial an","annotations":[]}]}}`
+	assert.Empty(t, adapt(added))
+
+	done := `{"type":"response.output_item.done","output_index":0,"item":{"type":"message","id":"m9","role":"assistant","status":"completed","content":[{"type":"output_text","text":"Partial answer completed.","annotations":[]}]}}`
+	events := adapt(done)
+	require.Len(t, events, 1)
+	assert.Equal(t, "Partial answer completed.", events[0].Text)
+}
+
+func TestNewAdaptSSE_InProgressFunctionCallNotDedupedPrematurely(t *testing.T) {
+	adapt := NewAdaptSSE()
+
+	added := `{"type":"response.output_item.added","output_index":0,"item":{"type":"function_call","id":"f9","call_id":"c9","status":"in_progress","name":"execute_sql","arguments":"{\"sql\":\"SELECT"}}`
+	assert.Empty(t, adapt(added))
+
+	done := `{"type":"response.output_item.done","output_index":0,"item":{"type":"function_call","id":"f9","call_id":"c9","status":"completed","name":"execute_sql","arguments":"{\"sql\":\"SELECT 1\",\"title\":\"One\"}"}}`
+	events := adapt(done)
+	require.Len(t, events, 1)
+	assert.Equal(t, agentstream.EventToolCall, events[0].Kind)
+	assert.Contains(t, events[0].ToolCall.Arguments, "SELECT 1")
+}
+
+func TestAdaptSSE_VizWithoutDefinitionIgnored(t *testing.T) {
+	adapt := NewAdaptSSE()
+	viz := `{"type":"response.output_item.done","item":{"type":"function_call_output","id":"o3","call_id":"c3","status":"completed","metadata":{"ui_type":"VIZ","embed_id":"v2"}}}`
+	assert.Empty(t, adapt(viz))
+}
+
+func TestAdaptSSE_OutputFinalResponse(t *testing.T) {
+	data := `{"type":"response.output_item.added","output_index":0,"item":{"type":"function_call","id":"f1","call_id":"c1","name":"output_final_response","arguments":"{\"response\":\"The answer is 42.\"}"}}`
+	events := adaptOne(data)
+	require.Len(t, events, 1)
+	assert.Equal(t, agentstream.EventFinalResponse, events[0].Kind)
+	assert.Equal(t, "The answer is 42.", events[0].Text)
+}
+
+func TestAdaptSSE_AskUserQuestions(t *testing.T) {
+	data := `{"type":"response.output_item.added","output_index":0,"item":{"type":"function_call","id":"f2","call_id":"c2","name":"ask_user_questions","arguments":"{\"questions\":[{\"question\":\"Which region?\",\"type\":\"choice\",\"choices\":[{\"label\":\"US\",\"description\":\"United States\"},{\"label\":\"EU\"}]}]}"}}`
+	events := adaptOne(data)
+	require.Len(t, events, 1)
+	assert.Equal(t, agentstream.EventText, events[0].Kind)
+	assert.Contains(t, events[0].Text, "Which region?")
+	assert.Contains(t, events[0].Text, "US: United States")
+	assert.Contains(t, events[0].Text, "EU")
+}
+
+func TestAdaptSSE_AskUserConfirmation(t *testing.T) {
+	data := `{"type":"response.output_item.added","output_index":0,"item":{"type":"function_call","id":"f2","call_id":"c2","name":"ask_user_questions","arguments":"{\"questions\":[{\"question\":\"Proceed with all regions?\",\"type\":\"confirmation\"}]}"}}`
+	events := adaptOne(data)
+	require.Len(t, events, 1)
+	assert.Contains(t, events[0].Text, "Proceed with all regions? (yes / no)")
+}
+
+func TestNewAdaptSSE_DedupsFunctionCall(t *testing.T) {
+	adapt := NewAdaptSSE()
+	added := `{"type":"response.output_item.added","output_index":0,"item":{"type":"function_call","id":"f3","call_id":"c3","name":"output_final_response","arguments":"{\"response\":\"Hello.\"}"}}`
+	events := adapt(added)
+	require.Len(t, events, 1)
+	assert.Equal(t, agentstream.EventFinalResponse, events[0].Kind)
+
+	// The same item re-observed (e.g. on .done) must not emit a second time.
+	done := `{"type":"response.output_item.done","output_index":0,"item":{"type":"function_call","id":"f3","call_id":"c3","name":"output_final_response","arguments":"{\"response\":\"Hello.\"}"}}`
+	assert.Empty(t, adapt(done))
+}
+
+func TestNewAdaptSSE_DoesNotDedupEmptyFunctionCall(t *testing.T) {
+	adapt := NewAdaptSSE()
+	added := `{"type":"response.output_item.added","output_index":0,"item":{"type":"function_call","id":"f4","call_id":"c4","name":"output_final_response","arguments":""}}`
+	assert.Empty(t, adapt(added))
+
+	done := `{"type":"response.output_item.done","output_index":0,"item":{"type":"function_call","id":"f4","call_id":"c4","name":"output_final_response","arguments":"{\"response\":\"Hello after done.\"}"}}`
+	events := adapt(done)
+	require.Len(t, events, 1)
+	assert.Equal(t, agentstream.EventFinalResponse, events[0].Kind)
+	assert.Equal(t, "Hello after done.", events[0].Text)
+}
+
+func TestNewAdaptSSE_DoesNotDedupEmptyGenericToolCall(t *testing.T) {
+	// The .added event for execute_sql can carry empty arguments that are
+	// filled in on .done. Emitting the empty call would dedupe away the SQL.
+	adapt := NewAdaptSSE()
+	added := `{"type":"response.output_item.added","output_index":0,"item":{"type":"function_call","id":"f5","call_id":"c5","name":"execute_sql","arguments":""}}`
+	assert.Empty(t, adapt(added))
+
+	done := `{"type":"response.output_item.done","output_index":0,"item":{"type":"function_call","id":"f5","call_id":"c5","name":"execute_sql","arguments":"{\"sql\":\"SELECT 1\",\"title\":\"One\"}"}}`
+	events := adapt(done)
+	require.Len(t, events, 1)
+	assert.Equal(t, agentstream.EventToolCall, events[0].Kind)
+	require.NotNil(t, events[0].ToolCall)
+	assert.Contains(t, events[0].ToolCall.Arguments, "SELECT 1")
+}
+
+func TestNewAdaptSSE_DedupsMessageAfterEmitting(t *testing.T) {
+	adapt := NewAdaptSSE()
+	added := `{"type":"response.output_item.added","output_index":0,"item":{"type":"message","id":"m2","role":"assistant","status":"completed","content":[{"type":"output_text","text":"Hello.","annotations":[]}]}}`
+	events := adapt(added)
+	require.Len(t, events, 1)
+	assert.Equal(t, agentstream.EventText, events[0].Kind)
+
+	done := `{"type":"response.output_item.done","output_index":0,"item":{"type":"message","id":"m2","role":"assistant","status":"completed","content":[{"type":"output_text","text":"Hello.","annotations":[]}]}}`
+	assert.Empty(t, adapt(done))
+}
+
+func TestNewAdaptSSE_MessageCanArriveOnDone(t *testing.T) {
+	adapt := NewAdaptSSE()
+	added := `{"type":"response.output_item.added","output_index":0,"item":{"type":"message","id":"m3","role":"assistant","status":"in_progress","content":[]}}`
+	assert.Empty(t, adapt(added))
+
+	done := `{"type":"response.output_item.done","output_index":0,"item":{"type":"message","id":"m3","role":"assistant","status":"completed","content":[{"type":"output_text","text":"Done text.","annotations":[]}]}}`
+	events := adapt(done)
+	require.Len(t, events, 1)
+	assert.Equal(t, agentstream.EventText, events[0].Kind)
+	assert.Equal(t, "Done text.", events[0].Text)
+}
+
+func TestAdaptSSE_FinalResponseWithArrayMetadata(t *testing.T) {
+	// Real backend metadata carries non-string values such as the
+	// source_internal_ids array. The item must still parse and render; a
+	// map[string]string metadata type silently dropped the whole message.
+	data := `{"type":"response.output_item.added","output_index":0,"item":{"type":"message","id":"m1","role":"assistant","status":"completed","content":[{"type":"output_text","text":"The answer.","annotations":[]}],"metadata":{"ui_type":"FINAL_RESPONSE","source_internal_ids":["msg_abc"],"response_id":"resp_1"}}}`
+	events := adaptOne(data)
+	require.Len(t, events, 1)
+	assert.Equal(t, agentstream.EventText, events[0].Kind)
+	assert.Equal(t, "The answer.", events[0].Text)
+}
+
+func TestAdaptSSE_ThoughtWithArrayMetadata(t *testing.T) {
+	data := `{"type":"response.output_item.added","output_index":0,"item":{"type":"message","id":"t1","role":"assistant","status":"completed","content":[{"type":"output_text","text":"Looking...","annotations":[]}],"metadata":{"ui_type":"THOUGHT","source_internal_ids":["msg_x"]}}}`
+	events := adaptOne(data)
+	require.Len(t, events, 1)
+	assert.Equal(t, agentstream.EventThinking, events[0].Kind)
+	assert.Equal(t, "Looking...", events[0].Text)
+}
diff --git a/libs/genie/agentstream/event.go b/libs/genie/agentstream/event.go
new file mode 100644
index 00000000000..abce6f301da
--- /dev/null
+++ b/libs/genie/agentstream/event.go
@@ -0,0 +1,85 @@
+package agentstream
+
+// EventKind identifies the type of stream event.
+type EventKind int
+
+const (
+	EventThinking      EventKind = iota // status line on stderr
+	EventText                           // markdown to stdout
+	EventToolCall                       // function call (e.g. execute_sql)
+	EventError                          // API error
+	EventDone                           // stream completed
+	EventViz                            // visualization chart
+	EventFinalResponse                  // answer delivered via the output_final_response tool
+	EventUnparsed                       // event the adapter recognized but could not parse
+)
+
+// StreamEvent is the protocol-agnostic unit that renderers consume.
+// Protocol-specific adapters convert raw SSE data into these.
+type StreamEvent struct {
+	Kind           EventKind
+	Text           string         // for Thinking, Text, Error
+	ToolCall       *ToolCallEvent // for ToolCall
+	Viz            *VizEvent      // for Viz
+	Status         string         // for Done ("completed", "failed")
+	ConversationID string         // for Done: id to continue the conversation
+	ErrorCode      string         // for Error
+	Raw            string         // original SSE data (for debug)
+}
+
+// VizEvent carries visualization data for terminal chart rendering.
+type VizEvent struct {
+	Spec *VizSpec
+	Data *TableData
+}
+
+// VizSpec describes how to render a visualization.
+type VizSpec struct {
+	Title      string
+	WidgetType string // "bar", "line", "area"
+	XField     string
+	YFields    []string
+	ColorField string
+	Layout     string // "stack", "group"
+	XTitle     string
+	YTitle     string
+}
+
+// TableData holds parsed tabular data.
+type TableData struct {
+	Columns []string
+	Rows    [][]string
+}
+
+// ToolCallEvent represents a function call emitted by an agent.
+type ToolCallEvent struct {
+	Name      string
+	Arguments string
+}
+
+// AdapterFunc converts a raw SSE data payload into zero or more StreamEvents.
+// Each protocol (Genie, ChatCompletions, Anthropic) implements one of these.
+type AdapterFunc func(data string) []StreamEvent
+
+// RenderOptions controls what RenderText displays.
+type RenderOptions struct {
+	ShowSQL bool // display SQL queries executed by the agent
+	Color   bool // emit ANSI colors (callers gate this on cmdio.SupportsColor)
+}
+
+// StreamResult is the structured output for --output json mode.
+type StreamResult struct {
+	Status         string     `json:"status"`
+	ConversationID string     `json:"conversation_id,omitempty"`
+	Text           string     `json:"text,omitempty"`
+	Error          string     `json:"error,omitempty"`
+	ToolCalls      []ToolCall `json:"tool_calls,omitempty"`
+}
+
+// ToolCall is a simplified function call for JSON output.
+type ToolCall struct {
+	Name      string `json:"name"`
+	SQL       string `json:"sql,omitempty"`
+	Title     string `json:"title,omitempty"`
+	Arguments string `json:"arguments,omitempty"`
+}
diff --git a/libs/genie/agentstream/markdown.go b/libs/genie/agentstream/markdown.go
new file mode 100644
index 00000000000..0ca6383dc98
--- /dev/null
+++ b/libs/genie/agentstream/markdown.go
@@ -0,0 +1,46 @@
+package agentstream
+
+import (
+	"fmt"
+	"io"
+	"regexp"
+	"strings"
+)
+
+// embeddedBlockRe matches <!-- begin-embedded:... --> ... <!-- end-embedded:... --> blocks.
+var embeddedBlockRe = regexp.MustCompile(`(?s)<!-- begin-embedded:\w+ -->\n?(.*?)<!-- end-embedded:\w+ -->`)
+
+// vizEmbedBlockRe matches embedded viz blocks that are rendered as terminal charts.
+// These blocks are removed entirely since the chart is rendered separately via EventViz.
+var vizEmbedBlockRe = regexp.MustCompile(`(?s)<!-- begin-embedded:viz_\w+ -->.*?<!-- end-embedded:viz_\w+ -->\n?`)
+
+// vizImageRe matches standalone ![title](#viz_xxx) image references.
+var vizImageRe = regexp.MustCompile(`!\[[^\]]*\]\(#viz_\w+\)\n?`)
+
+// cleanMarkdown strips Genie embedded blocks and viz image references.
+func cleanMarkdown(text string) string {
+	// Remove viz embedded blocks entirely (rendered as terminal charts).
+	cleaned := vizEmbedBlockRe.ReplaceAllString(text, "")
+
+	// Remove any remaining standalone viz image references.
+	cleaned = vizImageRe.ReplaceAllString(cleaned, "")
+
+	// Strip query embedded block wrappers, keeping the content inside.
+	cleaned = embeddedBlockRe.ReplaceAllString(cleaned, "$1")
+
+	// Removed viz blocks can leave a pile of trailing newlines behind;
+	// Fprintln supplies the one that should remain.
+	return strings.TrimRight(cleaned, "\n")
+}
+
+// renderMarkdown prints cleaned markdown as plain text and returns what was
+// printed. A message can consist solely of viz references and produce no
+// visible output; callers must not count that as an answer.
+func renderMarkdown(w io.Writer, text string) string {
+	cleaned := cleanMarkdown(text)
+	if strings.TrimSpace(cleaned) == "" {
+		return ""
+	}
+	fmt.Fprintln(w, cleaned)
+	return cleaned
+}
diff --git a/libs/genie/agentstream/markdown_test.go b/libs/genie/agentstream/markdown_test.go
new file mode 100644
index 00000000000..6ab420ebfe9
--- /dev/null
+++ b/libs/genie/agentstream/markdown_test.go
@@ -0,0 +1,48 @@
+package agentstream
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestRenderMarkdown(t *testing.T) {
+	tests := []struct {
+		name     string
+		in       string
+		contains []string
+		absent   []string
+	}{
+		{
+			name:     "keeps content of query embedded blocks",
+			in:       "Some text\n<!-- begin-embedded:query_abc -->\n| A | B |\n| --- | --- |\n| 1 | 2 |\n<!-- end-embedded:query_abc -->\nMore text",
+			contains: []string{"Some text", "| A | B |", "More text"},
+			absent:   []string{"begin-embedded", "end-embedded"},
+		},
+		{
+			name:     "removes viz embedded blocks entirely",
+			in:       "Before\n<!-- begin-embedded:viz_123 -->\n![Chart](#viz_123)\n<!-- end-embedded:viz_123 -->\nAfter",
+			contains: []string{"Before", "After"},
+			absent:   []string{"viz_123", "Chart", "begin-embedded"},
+		},
+		{
+			name:     "removes standalone viz image references",
+			in:       "Intro\n![Total by Franchise](#viz_abc)\nOutro",
+			contains: []string{"Intro", "Outro"},
+			absent:   []string{"viz_abc", "Total by Franchise"},
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			var buf bytes.Buffer
+			renderMarkdown(&buf, tc.in)
+			for _, s := range tc.contains {
+				assert.Contains(t, buf.String(), s)
+			}
+			for _, s := range tc.absent {
+				assert.NotContains(t, buf.String(), s)
+			}
+		})
+	}
+}
diff --git a/libs/genie/agentstream/renderer.go b/libs/genie/agentstream/renderer.go
new file mode 100644
index 00000000000..37aa3908d3d
--- /dev/null
+++ b/libs/genie/agentstream/renderer.go
@@ -0,0 +1,325 @@
+package agentstream
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/databricks/cli/libs/cmdio"
+)
+
+// Response status constants.
+const (
+	statusCompleted  = "completed"
+	statusError      = "error"
+	statusIncomplete = "incomplete"
+)
+
+// defaultChartWidth is the fixed column budget for terminal charts. Bar and
+// line charts cap their own drawing width well below it, so terminal-width
+// detection would only matter on very narrow terminals.
+const defaultChartWidth = 80
+
+// maxStatusRunes bounds spinner status text: a wrapped status line leaves
+// artifacts behind when the spinner erases it.
+const maxStatusRunes = 100
+
+// UpdateCLIAdvice tells the user how to recover when the undocumented API
+// behind an experimental command has changed or moved: a newer CLI built
+// against the current wire format is the only user-side fix.
+const UpdateCLIAdvice = "update the Databricks CLI to the latest version (run 'databricks version --check')"
+
+// RenderDebug prints every raw SSE data line to w as-is.
+func RenderDebug(r io.Reader, w io.Writer) error {
+	reader := NewSSEReader(r)
+	for {
+		ev, err := reader.Next()
+		if errors.Is(err, io.EOF) {
+			return nil
+		}
+		if err != nil {
+			return fmt.Errorf("reading SSE stream: %w", err)
+		}
+		fmt.Fprintln(w, ev.Data)
+	}
+}
+
+// RenderText renders the SSE stream as human-readable text.
+// The adapt function converts each raw SSE payload into StreamEvents.
+// Viz charts are buffered and rendered after all text output so the
+// narrative context appears first.
+//
+// A stream that ends without producing any user-visible answer returns an
+// error: the most damaging historical failure mode of this command was a wire
+// format change making every item unparseable, which rendered nothing and
+// exited 0.
+//
+// Returns the conversation id (for follow-up turns), whether any output was
+// written to stdout, and any error.
+func RenderText(ctx context.Context, r io.Reader, stdout, stderr io.Writer, adapt AdapterFunc, opts RenderOptions) (string, bool, error) {
+	reader := NewSSEReader(r)
+
+	// The spinner degrades to no output on non-interactive terminals, so
+	// piped stderr stays free of ANSI escapes. It is closed before anything
+	// is written to stdout and recreated on the next thinking update.
+	status := cmdio.NewSpinner(ctx)
+	stopStatus := func() {
+		if status != nil {
+			status.Close()
+			status = nil
+		}
+	}
+	defer stopStatus()
+	updateStatus := func(text string) {
+		if status == nil {
+			status = cmdio.NewSpinner(ctx)
+		}
+		status.Update(truncateStatus(text))
+	}
+	updateStatus("Waiting for response...")
+
+	var vizBuffer []*VizEvent
+	var finalResponse string
+	var conversationID string
+	var rendered strings.Builder // all text shown so far, for final-response dedupe
+	wrote := false               // any bytes written to stdout (gates a safe fail-open retry)
+	events := 0
+	unparsed := 0
+	sawDone := false
+
+	for {
+		ev, err := reader.Next()
+		if errors.Is(err, io.EOF) {
+			break
+		}
+		if err != nil {
+			return conversationID, wrote, fmt.Errorf("reading SSE stream: %w", err)
+		}
+		events++
+
+		for _, se := range adapt(ev.Data) {
+			switch se.Kind {
+			case EventThinking:
+				updateStatus(se.Text)
+			case EventText:
+				stopStatus()
+				if c := renderMarkdown(stdout, se.Text); c != "" {
+					wrote = true
+					rendered.WriteString(c)
+					rendered.WriteString("\n")
+				}
+			case EventFinalResponse:
+				// Buffer the tool-delivered answer; render it after the stream
+				// only if no assistant message already showed the answer.
+				finalResponse = se.Text
+			case EventToolCall:
+				if se.ToolCall != nil && opts.ShowSQL && isSQLTool(se.ToolCall.Name) {
+					stopStatus()
+					renderSQL(stdout, se.ToolCall.Name, se.ToolCall.Arguments)
+					wrote = true
+				}
+			case EventViz:
+				if se.Viz != nil {
+					vizBuffer = append(vizBuffer, se.Viz)
+				}
+			case EventError:
+				return conversationID, wrote, apiError(se)
+			case EventDone:
+				sawDone = true
+				conversationID = se.ConversationID
+				if se.Status != "" && se.Status != statusCompleted {
+					return conversationID, wrote, fmt.Errorf("response finished with status %q", se.Status)
+				}
+			case EventUnparsed:
+				unparsed++
+			}
+		}
+	}
+	stopStatus()
+
+	// Render the tool-delivered answer unless an assistant message already
+	// contained it. Intermediate messages ("Let me check the table first.")
+	// must not suppress the actual answer, so this checks content, not just
+	// whether any text was rendered. Both sides are compared post-cleanup so
+	// a viz reference in one of them cannot defeat the dedupe.
+	answered := rendered.Len() > 0
+	if final := strings.TrimSpace(cleanMarkdown(finalResponse)); final != "" && !strings.Contains(rendered.String(), final) {
+		renderMarkdown(stdout, finalResponse)
+		answered = true
+		wrote = true
+	}
+
+	// Render charts after all text output. A chart that cannot be mapped to
+	// the result data degrades to a visible placeholder: the answer text has
+	// already had its chart references stripped, so silence here would leave
+	// the user staring at "as shown below" with nothing below.
+	for _, viz := range vizBuffer {
+		wrote = true // every branch writes to stdout, even the placeholder
+		if RenderChart(stdout, viz, defaultChartWidth, opts.Color) {
+			answered = true
+			continue
+		}
+		if viz.Spec != nil && viz.Spec.Title != "" {
+			fmt.Fprintf(stdout, "\n[chart %q could not be rendered in the terminal]\n", viz.Spec.Title)
+		} else {
+			fmt.Fprintln(stdout, "\n[a chart could not be rendered in the terminal]")
+		}
+	}
+
+	warnUnparsed(stderr, unparsed)
+	if !answered {
+		return conversationID, wrote, noAnswerError(events)
+	}
+	if !sawDone {
+		fmt.Fprintln(stderr, "Warning: the stream ended without a completion event; the answer may be incomplete.")
+	}
+	return conversationID, wrote, nil
+}
+
+// RenderJSON accumulates all stream events and emits a single StreamResult
+// JSON object. The JSON is written even when the stream fails so callers
+// always have structured output to parse; the returned error still makes the
+// CLI exit non-zero. Status starts as "incomplete" and is only promoted to
+// "completed" by a completion event, so a truncated stream cannot masquerade
+// as a successful one.
+//
+// Returns the conversation id for follow-up turns.
+func RenderJSON(r io.Reader, stdout, stderr io.Writer, adapt AdapterFunc) (string, error) {
+	reader := NewSSEReader(r)
+	result := StreamResult{Status: statusIncomplete}
+	var finalResponse string
+	var apiErr error
+	events := 0
+	unparsed := 0
+
+loop:
+	for {
+		ev, err := reader.Next()
+		if errors.Is(err, io.EOF) {
+			break
+		}
+		if err != nil {
+			result.Status = statusError
+			result.Error = err.Error()
+			writeStreamResult(stdout, result)
+			return result.ConversationID, fmt.Errorf("reading SSE stream: %w", err)
+		}
+		events++
+
+		for _, se := range adapt(ev.Data) {
+			switch se.Kind {
+			case EventThinking, EventViz:
+				// Only relevant for text rendering; skip in JSON.
+			case EventText:
+				result.Text += se.Text
+			case EventFinalResponse:
+				finalResponse = se.Text
+			case EventToolCall:
+				if se.ToolCall != nil {
+					tc := ToolCall{
+						Name:      se.ToolCall.Name,
+						Arguments: se.ToolCall.Arguments,
+					}
+					if isSQLTool(se.ToolCall.Name) {
+						tc.SQL, tc.Title = parseSQLArgs(se.ToolCall.Name, se.ToolCall.Arguments)
+					}
+					result.ToolCalls = append(result.ToolCalls, tc)
+				}
+			case EventError:
+				result.Status = statusError
+				result.Error = se.Text
+				apiErr = apiError(se)
+				break loop
+			case EventDone:
+				result.ConversationID = se.ConversationID
+				if se.Status != "" && se.Status != statusCompleted {
+					result.Status = statusError
+					result.Error = fmt.Sprintf("response finished with status %q", se.Status)
+					apiErr = fmt.Errorf("response finished with status %q", se.Status)
+					break loop
+				}
+				result.Status = statusCompleted
+			case EventUnparsed:
+				unparsed++
+			}
+		}
+	}
+
+	// Mirror the text renderer: append the tool-delivered answer unless the
+	// message text already contains it. The comparison is post-cleanup so a
+	// viz reference in one of them cannot defeat the dedupe; the JSON itself
+	// keeps the raw markdown.
+	if final := strings.TrimSpace(cleanMarkdown(finalResponse)); final != "" && !strings.Contains(cleanMarkdown(result.Text), final) {
+		if result.Text != "" {
+			result.Text += "\n\n"
+		}
+		result.Text += finalResponse
+	}
+
+	if apiErr == nil {
+		if result.Text == "" && len(result.ToolCalls) == 0 {
+			result.Status = statusError
+			apiErr = noAnswerError(events)
+		} else if result.Status == statusIncomplete {
+			// Keep status "incomplete": an answer was produced, the server
+			// just never confirmed completion.
+			apiErr = errors.New("the stream ended without a completion event; the response may be incomplete")
+		}
+		if apiErr != nil {
+			result.Error = apiErr.Error()
+		}
+	}
+
+	warnUnparsed(stderr, unparsed)
+	writeStreamResult(stdout, result)
+	return result.ConversationID, apiErr
+}
+
+// writeStreamResult encodes the result to w. Encoding errors are reported on
+// the same path as the result itself, so they are intentionally not returned:
+// if w is broken there is nowhere left to report to.
+func writeStreamResult(w io.Writer, result StreamResult) {
+	enc := json.NewEncoder(w)
+	enc.SetIndent("", "  ")
+	_ = enc.Encode(result)
+}
+
+// apiError converts an EventError into the error returned to the user. The
+// renderers do not print it themselves; the root command prints returned
+// errors, and printing in both places showed every API error twice.
+func apiError(se StreamEvent) error {
+	if se.ErrorCode == "" {
+		return fmt.Errorf("API error: %s", se.Text)
+	}
+	return fmt.Errorf("API error: %s: %s", se.ErrorCode, se.Text)
+}
+
+// noAnswerError reports a stream that ended without any user-visible answer.
+// Short of a server bug, this means the wire format drifted away from what
+// this build understands, so the message leads with the CLI update advice.
+func noAnswerError(events int) error {
+	return fmt.Errorf("the stream ended without an answer (received %d events); the API may have changed: %s, or re-run with --raw to inspect the raw stream", events, UpdateCLIAdvice)
+}
+
+// warnUnparsed reports events the adapter recognized but could not decode.
+// These are dropped from rendering, and a wire format drift that drops
+// everything must be visible rather than an empty success.
+func warnUnparsed(stderr io.Writer, unparsed int) {
+	if unparsed > 0 {
+		fmt.Fprintf(stderr, "Warning: %d stream event(s) could not be parsed and were ignored; the API may have changed: %s, or re-run with --raw to inspect the raw stream.\n", unparsed, UpdateCLIAdvice)
+	}
+}
+
+// truncateStatus bounds status text to one spinner line, collapsing newlines
+// so multi-sentence thoughts do not break the line-erase protocol.
+func truncateStatus(text string) string {
+	text = strings.ReplaceAll(text, "\n", " ")
+	runes := []rune(text)
+	if len(runes) <= maxStatusRunes {
+		return text
+	}
+	return string(runes[:maxStatusRunes-3]) + "..."
+}
diff --git a/libs/genie/agentstream/renderer_test.go b/libs/genie/agentstream/renderer_test.go
new file mode 100644
index 00000000000..a9cba4b3ffa
--- /dev/null
+++ b/libs/genie/agentstream/renderer_test.go
@@ -0,0 +1,519 @@
+package agentstream
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"strings"
+	"testing"
+	"testing/iotest"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// fakeSSE builds an SSE stream from data payloads.
+func fakeSSE(payloads ...string) string {
+	var b strings.Builder
+	for _, p := range payloads {
+		b.WriteString("data: ")
+		b.WriteString(p)
+		b.WriteString("\n\n")
+	}
+	return b.String()
+}
+
+// testAdapter returns an AdapterFunc that maps data payloads to predefined events.
+func testAdapter(mapping map[string][]StreamEvent) AdapterFunc {
+	return func(data string) []StreamEvent {
+		return mapping[data]
+	}
+}
+
+func testCtx(t *testing.T) context.Context {
+	return cmdio.MockDiscard(t.Context())
+}
+
+func TestRenderDebug(t *testing.T) {
+	input := fakeSSE(`{"type":"reasoning"}`, `{"type":"message"}`)
+	var buf bytes.Buffer
+	err := RenderDebug(strings.NewReader(input), &buf)
+	require.NoError(t, err)
+
+	lines := strings.Split(strings.TrimSpace(buf.String()), "\n")
+	assert.Len(t, lines, 2)
+	assert.Contains(t, lines[0], `"reasoning"`)
+	assert.Contains(t, lines[1], `"message"`)
+}
+
+func TestRenderText_MessageAndThinking(t *testing.T) {
+	adapt := testAdapter(map[string][]StreamEvent{
+		"reasoning": {{Kind: EventThinking, Text: "Thinking..."}},
+		"message":   {{Kind: EventText, Text: "Total sales were $1,234,567."}},
+		"done":      {{Kind: EventDone, Status: "completed"}},
+	})
+	input := fakeSSE("reasoning", "message", "done")
+	var stdout, stderr bytes.Buffer
+	_, _, err := RenderText(testCtx(t), strings.NewReader(input), &stdout, &stderr, adapt, RenderOptions{})
+	require.NoError(t, err)
+
+	assert.Contains(t, stdout.String(), "Total sales were $1,234,567.")
+	assert.Empty(t, stderr.String())
+}
+
+func TestRenderText_SQLExecution(t *testing.T) {
+	adapt := testAdapter(map[string][]StreamEvent{
+		"sql": {{Kind: EventToolCall, ToolCall: &ToolCallEvent{
+			Name:      "execute_sql",
+			Arguments: `{"sql":"SELECT SUM(amount) FROM sales","title":"Total Sales"}`,
+		}}},
+		"message": {{Kind: EventText, Text: "Sales summed."}},
+		"done":    {{Kind: EventDone, Status: "completed"}},
+	})
+	input := fakeSSE("sql", "message", "done")
+	var stdout, stderr bytes.Buffer
+	_, _, err := RenderText(testCtx(t), strings.NewReader(input), &stdout, &stderr, adapt, RenderOptions{ShowSQL: true})
+	require.NoError(t, err)
+
+	assert.Contains(t, stdout.String(), "SQL executed (Total Sales):")
+	assert.Contains(t, stdout.String(), "SELECT SUM(amount) FROM sales")
+}
+
+func TestRenderText_SQLHiddenByDefault(t *testing.T) {
+	adapt := testAdapter(map[string][]StreamEvent{
+		"sql": {{Kind: EventToolCall, ToolCall: &ToolCallEvent{
+			Name:      "execute_sql",
+			Arguments: `{"sql":"SELECT 1","title":"Test"}`,
+		}}},
+		"message": {{Kind: EventText, Text: "Done."}},
+		"done":    {{Kind: EventDone, Status: "completed"}},
+	})
+	input := fakeSSE("sql", "message", "done")
+	var stdout, stderr bytes.Buffer
+	_, _, err := RenderText(testCtx(t), strings.NewReader(input), &stdout, &stderr, adapt, RenderOptions{})
+	require.NoError(t, err)
+
+	assert.NotContains(t, stdout.String(), "SQL executed")
+}
+
+func TestRenderText_ExecuteSQLQuery(t *testing.T) {
+	adapt := testAdapter(map[string][]StreamEvent{
+		"sql": {{Kind: EventToolCall, ToolCall: &ToolCallEvent{
+			Name:      "execute_sql_query",
+			Arguments: `{"query":"SELECT * FROM kie.test.bbc_articles LIMIT 3","thought":"Let me sample the table"}`,
+		}}},
+		"message": {{Kind: EventText, Text: "Sampled."}},
+		"done":    {{Kind: EventDone, Status: "completed"}},
+	})
+	input := fakeSSE("sql", "message", "done")
+	var stdout, stderr bytes.Buffer
+	_, _, err := RenderText(testCtx(t), strings.NewReader(input), &stdout, &stderr, adapt, RenderOptions{ShowSQL: true})
+	require.NoError(t, err)
+
+	assert.Contains(t, stdout.String(), "SQL executed:")
+	assert.Contains(t, stdout.String(), "SELECT * FROM kie.test.bbc_articles LIMIT 3")
+}
+
+func TestRenderText_Error(t *testing.T) {
+	adapt := testAdapter(map[string][]StreamEvent{
+		"error": {{Kind: EventError, Text: "No eligible SQL warehouse found", ErrorCode: "RESOURCE_DOES_NOT_EXIST"}},
+	})
+	input := fakeSSE("error")
+	var stdout, stderr bytes.Buffer
+	_, _, err := RenderText(testCtx(t), strings.NewReader(input), &stdout, &stderr, adapt, RenderOptions{})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "RESOURCE_DOES_NOT_EXIST")
+	assert.Contains(t, err.Error(), "No eligible SQL warehouse found")
+	// The root command prints returned errors; the renderer must not print
+	// the error a second time.
+	assert.Empty(t, stderr.String())
+}
+
+func TestRenderText_ErrorWithoutCode(t *testing.T) {
+	adapt := testAdapter(map[string][]StreamEvent{
+		"error": {{Kind: EventError, Text: "boom"}},
+	})
+	var stdout, stderr bytes.Buffer
+	_, _, err := RenderText(testCtx(t), strings.NewReader(fakeSSE("error")), &stdout, &stderr, adapt, RenderOptions{})
+	require.Error(t, err)
+	assert.Equal(t, "API error: boom", err.Error())
+}
+
+func TestRenderText_FailedResponseStatus(t *testing.T) {
+	adapt := testAdapter(map[string][]StreamEvent{
+		"msg":  {{Kind: EventText, Text: "Some text"}},
+		"done": {{Kind: EventDone, Status: "failed"}},
+	})
+	input := fakeSSE("msg", "done")
+	var stdout, stderr bytes.Buffer
+	_, _, err := RenderText(testCtx(t), strings.NewReader(input), &stdout, &stderr, adapt, RenderOptions{})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "failed")
+}
+
+func TestRenderText_ThoughtsNotInStdout(t *testing.T) {
+	adapt := testAdapter(map[string][]StreamEvent{
+		"thought":  {{Kind: EventThinking, Text: "I will search for tables..."}},
+		"response": {{Kind: EventText, Text: "Here are your tables."}},
+		"done":     {{Kind: EventDone, Status: "completed"}},
+	})
+	input := fakeSSE("thought", "response", "done")
+	var stdout, stderr bytes.Buffer
+	_, _, err := RenderText(testCtx(t), strings.NewReader(input), &stdout, &stderr, adapt, RenderOptions{})
+	require.NoError(t, err)
+
+	assert.NotContains(t, stdout.String(), "I will search for tables...")
+	assert.Contains(t, stdout.String(), "Here are your tables.")
+}
+
+func TestRenderText_FinalResponseOnly(t *testing.T) {
+	adapt := testAdapter(map[string][]StreamEvent{
+		"final": {{Kind: EventFinalResponse, Text: "The answer is 42."}},
+		"done":  {{Kind: EventDone, Status: "completed"}},
+	})
+	input := fakeSSE("final", "done")
+	var stdout, stderr bytes.Buffer
+	_, _, err := RenderText(testCtx(t), strings.NewReader(input), &stdout, &stderr, adapt, RenderOptions{})
+	require.NoError(t, err)
+	assert.Contains(t, stdout.String(), "The answer is 42.")
+}
+
+func TestRenderText_FinalResponseNotSuppressedByIntermediateText(t *testing.T) {
+	adapt := testAdapter(map[string][]StreamEvent{
+		"preamble": {{Kind: EventText, Text: "Let me look at the sales table first."}},
+		"final":    {{Kind: EventFinalResponse, Text: "The answer is 42."}},
+		"done":     {{Kind: EventDone, Status: "completed"}},
+	})
+	input := fakeSSE("preamble", "final", "done")
+	var stdout, stderr bytes.Buffer
+	_, _, err := RenderText(testCtx(t), strings.NewReader(input), &stdout, &stderr, adapt, RenderOptions{})
+	require.NoError(t, err)
+	assert.Contains(t, stdout.String(), "Let me look at the sales table first.")
+	assert.Contains(t, stdout.String(), "The answer is 42.")
+}
+
+func TestRenderText_FinalResponseDuplicateSuppressed(t *testing.T) {
+	adapt := testAdapter(map[string][]StreamEvent{
+		"message": {{Kind: EventText, Text: "The answer is 42."}},
+		"final":   {{Kind: EventFinalResponse, Text: "The answer is 42."}},
+		"done":    {{Kind: EventDone, Status: "completed"}},
+	})
+	input := fakeSSE("message", "final", "done")
+	var stdout, stderr bytes.Buffer
+	_, _, err := RenderText(testCtx(t), strings.NewReader(input), &stdout, &stderr, adapt, RenderOptions{})
+	require.NoError(t, err)
+	assert.Equal(t, 1, strings.Count(stdout.String(), "The answer is 42."))
+}
+
+func TestRenderText_VizOnlyMessageIsNotAnAnswer(t *testing.T) {
+	// A message consisting solely of a viz reference renders no visible text.
+	// If the chart never materializes either, the stream produced nothing and
+	// must fail rather than exit 0.
+	adapt := testAdapter(map[string][]StreamEvent{
+		"message": {{Kind: EventText, Text: "![Chart](#viz_1)"}},
+		"done":    {{Kind: EventDone, Status: "completed"}},
+	})
+	input := fakeSSE("message", "done")
+	var stdout, stderr bytes.Buffer
+	_, _, err := RenderText(testCtx(t), strings.NewReader(input), &stdout, &stderr, adapt, RenderOptions{})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "without an answer")
+}
+
+func TestRenderText_NoAnswerFails(t *testing.T) {
+	adapt := testAdapter(map[string][]StreamEvent{
+		"thinking": {{Kind: EventThinking, Text: "Thinking..."}},
+		"done":     {{Kind: EventDone, Status: "completed"}},
+	})
+	input := fakeSSE("thinking", "done")
+	var stdout, stderr bytes.Buffer
+	_, _, err := RenderText(testCtx(t), strings.NewReader(input), &stdout, &stderr, adapt, RenderOptions{})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "without an answer")
+	assert.Contains(t, err.Error(), "update the Databricks CLI to the latest version")
+	assert.Contains(t, err.Error(), "--raw")
+}
+
+func TestRenderText_MissingDoneWarns(t *testing.T) {
+	adapt := testAdapter(map[string][]StreamEvent{
+		"message": {{Kind: EventText, Text: "Partial answer."}},
+	})
+	input := fakeSSE("message")
+	var stdout, stderr bytes.Buffer
+	_, _, err := RenderText(testCtx(t), strings.NewReader(input), &stdout, &stderr, adapt, RenderOptions{})
+	require.NoError(t, err)
+	assert.Contains(t, stdout.String(), "Partial answer.")
+	assert.Contains(t, stderr.String(), "may be incomplete")
+}
+
+func TestRenderText_UnparsedEventsWarn(t *testing.T) {
+	adapt := testAdapter(map[string][]StreamEvent{
+		"message": {{Kind: EventText, Text: "Answer."}},
+		"junk":    {{Kind: EventUnparsed, Raw: "junk"}},
+		"done":    {{Kind: EventDone, Status: "completed"}},
+	})
+	input := fakeSSE("message", "junk", "junk", "done")
+	var stdout, stderr bytes.Buffer
+	_, _, err := RenderText(testCtx(t), strings.NewReader(input), &stdout, &stderr, adapt, RenderOptions{})
+	require.NoError(t, err)
+	assert.Contains(t, stderr.String(), "2 stream event(s) could not be parsed")
+	assert.Contains(t, stderr.String(), "update the Databricks CLI to the latest version")
+}
+
+func TestRenderText_VizChartAfterText(t *testing.T) {
+	viz := &VizEvent{
+		Spec: &VizSpec{Title: "Totals", WidgetType: widgetBar, XField: "name", YFields: []string{"total"}},
+		Data: &TableData{Columns: []string{"name", "total"}, Rows: [][]string{{"Alpha", "100"}}},
+	}
+	adapt := testAdapter(map[string][]StreamEvent{
+		"message": {{Kind: EventText, Text: "Here is the breakdown."}},
+		"viz":     {{Kind: EventViz, Viz: viz}},
+		"done":    {{Kind: EventDone, Status: "completed"}},
+	})
+	// Viz arrives before the text: the chart must still render after it.
+	input := fakeSSE("viz", "message", "done")
+	var stdout, stderr bytes.Buffer
+	_, _, err := RenderText(testCtx(t), strings.NewReader(input), &stdout, &stderr, adapt, RenderOptions{})
+	require.NoError(t, err)
+
+	out := stdout.String()
+	assert.Less(t, strings.Index(out, "Here is the breakdown."), strings.Index(out, "Totals"))
+	assert.Contains(t, out, "█")
+	assert.NotContains(t, out, "\033[", "color disabled must not emit ANSI escapes")
+}
+
+func TestRenderText_VizPlaceholderWhenUnrenderable(t *testing.T) {
+	viz := &VizEvent{
+		Spec: &VizSpec{Title: "Totals", WidgetType: widgetBar, XField: "name", YFields: []string{"missing"}},
+		Data: &TableData{Columns: []string{"name", "total"}, Rows: [][]string{{"Alpha", "100"}}},
+	}
+	adapt := testAdapter(map[string][]StreamEvent{
+		"message": {{Kind: EventText, Text: "See the chart below."}},
+		"viz":     {{Kind: EventViz, Viz: viz}},
+		"done":    {{Kind: EventDone, Status: "completed"}},
+	})
+	input := fakeSSE("message", "viz", "done")
+	var stdout, stderr bytes.Buffer
+	_, _, err := RenderText(testCtx(t), strings.NewReader(input), &stdout, &stderr, adapt, RenderOptions{})
+	require.NoError(t, err)
+	assert.Contains(t, stdout.String(), `[chart "Totals" could not be rendered in the terminal]`)
+}
+
+func TestRenderJSON_FullStream(t *testing.T) {
+	adapt := testAdapter(map[string][]StreamEvent{
+		"thinking": {{Kind: EventThinking, Text: "Thinking..."}},
+		"text":     {{Kind: EventText, Text: "Total sales were $1,234,567."}},
+		"sql": {{Kind: EventToolCall, ToolCall: &ToolCallEvent{
+			Name:      "execute_sql",
+			Arguments: `{"sql":"SELECT SUM(amount) FROM sales","title":"Total Sales"}`,
+		}}},
+		"done": {{Kind: EventDone, Status: "completed"}},
+	})
+	input := fakeSSE("thinking", "text", "sql", "done")
+	var buf, stderr bytes.Buffer
+	_, err := RenderJSON(strings.NewReader(input), &buf, &stderr, adapt)
+	require.NoError(t, err)
+
+	var result StreamResult
+	require.NoError(t, json.Unmarshal(buf.Bytes(), &result))
+	assert.Equal(t, "completed", result.Status)
+	assert.Equal(t, "Total sales were $1,234,567.", result.Text)
+	assert.Empty(t, result.Error)
+	require.Len(t, result.ToolCalls, 1)
+	assert.Equal(t, "execute_sql", result.ToolCalls[0].Name)
+	assert.Equal(t, "SELECT SUM(amount) FROM sales", result.ToolCalls[0].SQL)
+	assert.Equal(t, "Total Sales", result.ToolCalls[0].Title)
+}
+
+func TestRenderJSON_AppendsTextEvents(t *testing.T) {
+	adapt := testAdapter(map[string][]StreamEvent{
+		"text": {
+			{Kind: EventText, Text: "Total sales "},
+			{Kind: EventText, Text: "were $1,234,567."},
+		},
+		"done": {{Kind: EventDone, Status: "completed"}},
+	})
+	input := fakeSSE("text", "done")
+	var buf, stderr bytes.Buffer
+	_, err := RenderJSON(strings.NewReader(input), &buf, &stderr, adapt)
+	require.NoError(t, err)
+
+	var result StreamResult
+	require.NoError(t, json.Unmarshal(buf.Bytes(), &result))
+	assert.Equal(t, "Total sales were $1,234,567.", result.Text)
+}
+
+func TestRenderJSON_ErrorEvent(t *testing.T) {
+	adapt := testAdapter(map[string][]StreamEvent{
+		"error": {{Kind: EventError, Text: "No eligible SQL warehouse found", ErrorCode: "RESOURCE_DOES_NOT_EXIST"}},
+	})
+	input := fakeSSE("error")
+	var buf, stderr bytes.Buffer
+	_, err := RenderJSON(strings.NewReader(input), &buf, &stderr, adapt)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "RESOURCE_DOES_NOT_EXIST")
+
+	var result StreamResult
+	require.NoError(t, json.Unmarshal(buf.Bytes(), &result))
+	assert.Equal(t, "error", result.Status)
+	assert.Contains(t, result.Error, "No eligible SQL warehouse")
+}
+
+func TestRenderJSON_ErrorPreservesAccumulatedText(t *testing.T) {
+	adapt := testAdapter(map[string][]StreamEvent{
+		"text":  {{Kind: EventText, Text: "Partial answer."}},
+		"error": {{Kind: EventError, Text: "backend exploded", ErrorCode: "INTERNAL"}},
+	})
+	input := fakeSSE("text", "error")
+	var buf, stderr bytes.Buffer
+	_, err := RenderJSON(strings.NewReader(input), &buf, &stderr, adapt)
+	require.Error(t, err)
+
+	var result StreamResult
+	require.NoError(t, json.Unmarshal(buf.Bytes(), &result))
+	assert.Equal(t, "Partial answer.", result.Text)
+	assert.Equal(t, "backend exploded", result.Error)
+	assert.Equal(t, "error", result.Status)
+}
+
+func TestRenderJSON_FailedResponseStatus(t *testing.T) {
+	adapt := testAdapter(map[string][]StreamEvent{
+		"msg":  {{Kind: EventText, Text: "Some text"}},
+		"done": {{Kind: EventDone, Status: "failed"}},
+	})
+	input := fakeSSE("msg", "done")
+	var buf, stderr bytes.Buffer
+	_, err := RenderJSON(strings.NewReader(input), &buf, &stderr, adapt)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "failed")
+
+	var result StreamResult
+	require.NoError(t, json.Unmarshal(buf.Bytes(), &result))
+	assert.Equal(t, "error", result.Status)
+}
+
+func TestRenderJSON_EmptyStreamFails(t *testing.T) {
+	// A stream that produced nothing must not report success: the historical
+	// failure mode was a wire format change that dropped every item.
+	adapt := testAdapter(map[string][]StreamEvent{})
+	var buf, stderr bytes.Buffer
+	_, err := RenderJSON(strings.NewReader(""), &buf, &stderr, adapt)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "without an answer")
+	assert.Contains(t, err.Error(), "update the Databricks CLI to the latest version")
+
+	var result StreamResult
+	require.NoError(t, json.Unmarshal(buf.Bytes(), &result))
+	assert.Equal(t, "error", result.Status)
+	assert.NotEmpty(t, result.Error)
+}
+
+func TestRenderJSON_MissingDoneIsIncomplete(t *testing.T) {
+	adapt := testAdapter(map[string][]StreamEvent{
+		"text": {{Kind: EventText, Text: "Partial answer."}},
+	})
+	input := fakeSSE("text")
+	var buf, stderr bytes.Buffer
+	_, err := RenderJSON(strings.NewReader(input), &buf, &stderr, adapt)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "without a completion event")
+
+	var result StreamResult
+	require.NoError(t, json.Unmarshal(buf.Bytes(), &result))
+	assert.Equal(t, "incomplete", result.Status)
+	assert.Equal(t, "Partial answer.", result.Text)
+}
+
+func TestRenderJSON_FinalResponseFallback(t *testing.T) {
+	adapt := testAdapter(map[string][]StreamEvent{
+		"final": {{Kind: EventFinalResponse, Text: "The answer is 42."}},
+		"done":  {{Kind: EventDone, Status: "completed"}},
+	})
+	input := fakeSSE("final", "done")
+	var buf, stderr bytes.Buffer
+	_, err := RenderJSON(strings.NewReader(input), &buf, &stderr, adapt)
+	require.NoError(t, err)
+
+	var result StreamResult
+	require.NoError(t, json.Unmarshal(buf.Bytes(), &result))
+	assert.Equal(t, "The answer is 42.", result.Text)
+}
+
+func TestRenderJSON_FinalResponseAppendedToDistinctText(t *testing.T) {
+	adapt := testAdapter(map[string][]StreamEvent{
+		"preamble": {{Kind: EventText, Text: "Let me check."}},
+		"final":    {{Kind: EventFinalResponse, Text: "The answer is 42."}},
+		"done":     {{Kind: EventDone, Status: "completed"}},
+	})
+	input := fakeSSE("preamble", "final", "done")
+	var buf, stderr bytes.Buffer
+	_, err := RenderJSON(strings.NewReader(input), &buf, &stderr, adapt)
+	require.NoError(t, err)
+
+	var result StreamResult
+	require.NoError(t, json.Unmarshal(buf.Bytes(), &result))
+	assert.Equal(t, "Let me check.\n\nThe answer is 42.", result.Text)
+}
+
+func TestRenderJSON_FinalResponseDuplicateSuppressed(t *testing.T) {
+	adapt := testAdapter(map[string][]StreamEvent{
+		"message": {{Kind: EventText, Text: "The answer is 42."}},
+		"final":   {{Kind: EventFinalResponse, Text: "The answer is 42."}},
+		"done":    {{Kind: EventDone, Status: "completed"}},
+	})
+	input := fakeSSE("message", "final", "done")
+	var buf, stderr bytes.Buffer
+	_, err := RenderJSON(strings.NewReader(input), &buf, &stderr, adapt)
+	require.NoError(t, err)
+
+	var result StreamResult
+	require.NoError(t, json.Unmarshal(buf.Bytes(), &result))
+	assert.Equal(t, "The answer is 42.", result.Text)
+}
+
+func TestRenderJSON_ReadErrorStillWritesJSON(t *testing.T) {
+	adapt := testAdapter(map[string][]StreamEvent{
+		"text": {{Kind: EventText, Text: "Partial"}},
+	})
+	r := io.MultiReader(strings.NewReader(fakeSSE("text")), iotest.ErrReader(errors.New("connection reset")))
+	var buf, stderr bytes.Buffer
+	_, err := RenderJSON(r, &buf, &stderr, adapt)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "connection reset")
+
+	var result StreamResult
+	require.NoError(t, json.Unmarshal(buf.Bytes(), &result))
+	assert.Equal(t, "error", result.Status)
+	assert.Contains(t, result.Error, "connection reset")
+}
+
+func TestRenderJSON_ExecuteSQLQuery(t *testing.T) {
+	adapt := testAdapter(map[string][]StreamEvent{
+		"sql": {{Kind: EventToolCall, ToolCall: &ToolCallEvent{
+			Name:      "execute_sql_query",
+			Arguments: `{"query":"SELECT COUNT(*) FROM kie.test.bbc_articles","thought":"Check row count"}`,
+		}}},
+		"done": {{Kind: EventDone, Status: "completed"}},
+	})
+	input := fakeSSE("sql", "done")
+	var buf, stderr bytes.Buffer
+	_, err := RenderJSON(strings.NewReader(input), &buf, &stderr, adapt)
+	require.NoError(t, err)
+
+	var result StreamResult
+	require.NoError(t, json.Unmarshal(buf.Bytes(), &result))
+	require.Len(t, result.ToolCalls, 1)
+	assert.Equal(t, "execute_sql_query", result.ToolCalls[0].Name)
+	assert.Equal(t, "SELECT COUNT(*) FROM kie.test.bbc_articles", result.ToolCalls[0].SQL)
+}
+
+func TestTruncateStatus(t *testing.T) {
+	assert.Equal(t, "one line", truncateStatus("one\nline"))
+	long := strings.Repeat("x", 2*maxStatusRunes)
+	got := truncateStatus(long)
+	assert.Len(t, []rune(got), maxStatusRunes)
+	assert.True(t, strings.HasSuffix(got, "..."))
+}
diff --git a/libs/genie/agentstream/sql.go b/libs/genie/agentstream/sql.go
new file mode 100644
index 00000000000..c5d5c661cee
--- /dev/null
+++ b/libs/genie/agentstream/sql.go
@@ -0,0 +1,71 @@
+package agentstream
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"strings"
+)
+
+// SQL tool name constants.
+const (
+	toolExecuteSQL      = "execute_sql"
+	toolExecuteSQLQuery = "execute_sql_query"
+)
+
+// sqlArgs is the JSON shape of execute_sql function call arguments.
+// execute_sql uses {"sql": "...", "title": "..."}.
+type sqlArgs struct {
+	SQL   string `json:"sql"`
+	Title string `json:"title"`
+}
+
+// sqlQueryArgs is the JSON shape of execute_sql_query function call arguments.
+// execute_sql_query uses {"query": "...", "thought": "..."}.
+type sqlQueryArgs struct {
+	Query   string `json:"query"`
+	Thought string `json:"thought"`
+}
+
+// isSQLTool returns true if the tool name is a SQL execution tool.
+func isSQLTool(name string) bool {
+	return name == toolExecuteSQL || name == toolExecuteSQLQuery
+}
+
+// renderSQL parses SQL tool arguments and prints the SQL query.
+func renderSQL(w io.Writer, name, arguments string) {
+	sql, title := parseSQLArgs(name, arguments)
+	if sql == "" {
+		return
+	}
+	fmt.Fprintln(w)
+	if title != "" {
+		fmt.Fprintf(w, "SQL executed (%s):\n", title)
+	} else {
+		fmt.Fprintln(w, "SQL executed:")
+	}
+	for line := range strings.SplitSeq(sql, "\n") {
+		fmt.Fprintf(w, "  %s\n", line)
+	}
+}
+
+// parseSQLArgs extracts SQL and title from SQL tool arguments.
+// Handles both execute_sql and execute_sql_query argument formats.
+func parseSQLArgs(name, arguments string) (sql, title string) {
+	switch name {
+	case toolExecuteSQL:
+		var args sqlArgs
+		if err := json.Unmarshal([]byte(arguments), &args); err != nil {
+			return "", ""
+		}
+		return args.SQL, args.Title
+	case toolExecuteSQLQuery:
+		var args sqlQueryArgs
+		if err := json.Unmarshal([]byte(arguments), &args); err != nil {
+			return "", ""
+		}
+		return args.Query, ""
+	default:
+		return "", ""
+	}
+}
diff --git a/libs/genie/agentstream/sql_test.go b/libs/genie/agentstream/sql_test.go
new file mode 100644
index 00000000000..a67c945e55d
--- /dev/null
+++ b/libs/genie/agentstream/sql_test.go
@@ -0,0 +1,50 @@
+package agentstream
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestParseSQLArgs(t *testing.T) {
+	tests := []struct {
+		name      string
+		tool      string
+		arguments string
+		wantSQL   string
+		wantTitle string
+	}{
+		{"execute_sql", toolExecuteSQL, `{"sql":"SELECT 1","title":"One"}`, "SELECT 1", "One"},
+		{"execute_sql_query", toolExecuteSQLQuery, `{"query":"SELECT 2","thought":"count"}`, "SELECT 2", ""},
+		{"malformed arguments", toolExecuteSQL, `not json`, "", ""},
+		{"unknown tool", "other_tool", `{"sql":"SELECT 3"}`, "", ""},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			sql, title := parseSQLArgs(tc.tool, tc.arguments)
+			assert.Equal(t, tc.wantSQL, sql)
+			assert.Equal(t, tc.wantTitle, title)
+		})
+	}
+}
+
+func TestRenderSQL(t *testing.T) {
+	var buf bytes.Buffer
+	renderSQL(&buf, toolExecuteSQL, `{"sql":"SELECT 1\nFROM t","title":"One"}`)
+	out := buf.String()
+	assert.Contains(t, out, "SQL executed (One):")
+	assert.Contains(t, out, "  SELECT 1\n  FROM t\n")
+}
+
+func TestRenderSQL_MalformedArgumentsPrintsNothing(t *testing.T) {
+	var buf bytes.Buffer
+	renderSQL(&buf, toolExecuteSQL, `not json`)
+	assert.Empty(t, buf.String())
+}
+
+func TestIsSQLTool(t *testing.T) {
+	assert.True(t, isSQLTool(toolExecuteSQL))
+	assert.True(t, isSQLTool(toolExecuteSQLQuery))
+	assert.False(t, isSQLTool("output_final_response"))
+}
diff --git a/libs/genie/agentstream/sse.go b/libs/genie/agentstream/sse.go
new file mode 100644
index 00000000000..9897d6917fa
--- /dev/null
+++ b/libs/genie/agentstream/sse.go
@@ -0,0 +1,68 @@
+package agentstream
+
+import (
+	"bufio"
+	"errors"
+	"fmt"
+	"io"
+	"strings"
+)
+
+const maxSSELineSize = 1 << 20 // 1MB
+
+// SSEEvent represents a single SSE event with its raw data payload.
+type SSEEvent struct {
+	Data string
+}
+
+// SSEReader reads SSE events from an io.Reader.
+type SSEReader struct {
+	scanner *bufio.Scanner
+}
+
+// NewSSEReader creates a new SSE reader with a 1MB buffer.
+func NewSSEReader(r io.Reader) *SSEReader {
+	s := bufio.NewScanner(r)
+	s.Buffer(make([]byte, 0, 64*1024), maxSSELineSize)
+	return &SSEReader{scanner: s}
+}
+
+// Next reads the next SSE event. Returns io.EOF when the stream ends.
+func (r *SSEReader) Next() (*SSEEvent, error) {
+	var dataLines []string
+
+	for r.scanner.Scan() {
+		line := strings.TrimSuffix(r.scanner.Text(), "\r")
+
+		if line == "" {
+			// Blank line terminates an event.
+			if len(dataLines) > 0 {
+				return &SSEEvent{Data: strings.Join(dataLines, "\n")}, nil
+			}
+			continue
+		}
+
+		// SSE data field.
+		if strings.HasPrefix(line, "data: ") {
+			dataLines = append(dataLines, line[len("data: "):])
+		} else if strings.HasPrefix(line, "data:") {
+			dataLines = append(dataLines, line[len("data:"):])
+		}
+		// Ignore other SSE fields (event:, id:, retry:) and comments (:).
+	}
+
+	if err := r.scanner.Err(); err != nil {
+		// "token too long" means nothing to a user; say what limit was hit.
+		if errors.Is(err, bufio.ErrTooLong) {
+			return nil, fmt.Errorf("SSE event exceeds the %d MiB line limit: %w", maxSSELineSize>>20, err)
+		}
+		return nil, err
+	}
+
+	// Handle data accumulated at EOF without trailing blank line.
+	if len(dataLines) > 0 {
+		return &SSEEvent{Data: strings.Join(dataLines, "\n")}, nil
+	}
+
+	return nil, io.EOF
+}
diff --git a/libs/genie/agentstream/sse_test.go b/libs/genie/agentstream/sse_test.go
new file mode 100644
index 00000000000..9d43c742d99
--- /dev/null
+++ b/libs/genie/agentstream/sse_test.go
@@ -0,0 +1,105 @@
+package agentstream
+
+import (
+	"io"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSSEReader_SingleEvent(t *testing.T) {
+	input := "data: {\"type\":\"response.output_item.added\"}\n\n"
+	r := NewSSEReader(strings.NewReader(input))
+
+	ev, err := r.Next()
+	require.NoError(t, err)
+	assert.Equal(t, `{"type":"response.output_item.added"}`, ev.Data)
+
+	_, err = r.Next()
+	assert.ErrorIs(t, err, io.EOF)
+}
+
+func TestSSEReader_MultipleEvents(t *testing.T) {
+	input := "data: first\n\ndata: second\n\n"
+	r := NewSSEReader(strings.NewReader(input))
+
+	ev1, err := r.Next()
+	require.NoError(t, err)
+	assert.Equal(t, "first", ev1.Data)
+
+	ev2, err := r.Next()
+	require.NoError(t, err)
+	assert.Equal(t, "second", ev2.Data)
+
+	_, err = r.Next()
+	assert.ErrorIs(t, err, io.EOF)
+}
+
+func TestSSEReader_EmptyStream(t *testing.T) {
+	r := NewSSEReader(strings.NewReader(""))
+	_, err := r.Next()
+	assert.ErrorIs(t, err, io.EOF)
+}
+
+func TestSSEReader_CommentsAndOtherFieldsIgnored(t *testing.T) {
+	input := ": this is a comment\nevent: update\ndata: hello\nid: 123\n\n"
+	r := NewSSEReader(strings.NewReader(input))
+
+	ev, err := r.Next()
+	require.NoError(t, err)
+	assert.Equal(t, "hello", ev.Data)
+}
+
+func TestSSEReader_DataWithoutSpace(t *testing.T) {
+	input := "data:nospace\n\n"
+	r := NewSSEReader(strings.NewReader(input))
+
+	ev, err := r.Next()
+	require.NoError(t, err)
+	assert.Equal(t, "nospace", ev.Data)
+}
+
+func TestSSEReader_MultiLineData(t *testing.T) {
+	input := "data: line1\ndata: line2\n\n"
+	r := NewSSEReader(strings.NewReader(input))
+
+	ev, err := r.Next()
+	require.NoError(t, err)
+	assert.Equal(t, "line1\nline2", ev.Data)
+}
+
+func TestSSEReader_CRLF(t *testing.T) {
+	input := "data: first\r\n\r\ndata: second\r\n\r\n"
+	r := NewSSEReader(strings.NewReader(input))
+
+	ev1, err := r.Next()
+	require.NoError(t, err)
+	assert.Equal(t, "first", ev1.Data)
+
+	ev2, err := r.Next()
+	require.NoError(t, err)
+	assert.Equal(t, "second", ev2.Data)
+}
+
+func TestSSEReader_EOFWithoutTrailingBlankLine(t *testing.T) {
+	input := "data: trailing"
+	r := NewSSEReader(strings.NewReader(input))
+
+	ev, err := r.Next()
+	require.NoError(t, err)
+	assert.Equal(t, "trailing", ev.Data)
+
+	_, err = r.Next()
+	assert.ErrorIs(t, err, io.EOF)
+}
+
+func TestSSEReader_BlankLinesWithoutData(t *testing.T) {
+	input := "\n\n\ndata: after blanks\n\n"
+	r := NewSSEReader(strings.NewReader(input))
+
+	ev, err := r.Next()
+	require.NoError(t, err)
+	assert.Equal(t, "after blanks", ev.Data)
+}
diff --git a/libs/genie/agentstream/termchart.go b/libs/genie/agentstream/termchart.go
new file mode 100644
index 00000000000..42c861b438b
--- /dev/null
+++ b/libs/genie/agentstream/termchart.go
@@ -0,0 +1,694 @@
+package agentstream
+
+import (
+	"fmt"
+	"io"
+	"math"
+	"slices"
+	"strconv"
+	"strings"
+	"unicode/utf8"
+)
+
+// ANSI 256-color codes for chart series.
+var seriesColors = []string{
+	"\033[38;5;39m",  // blue
+	"\033[38;5;208m", // orange
+	"\033[38;5;82m",  // green
+	"\033[38;5;196m", // red
+	"\033[38;5;44m",  // cyan
+	"\033[38;5;164m", // magenta
+	"\033[38;5;226m", // yellow
+	"\033[38;5;255m", // white
+}
+
+const (
+	ansiDim   = "\033[2m"
+	ansiBold  = "\033[1m"
+	ansiReset = "\033[0m"
+)
+
+// Widget types from the visualization spec.
+const (
+	widgetBar  = "bar"
+	widgetLine = "line"
+	widgetArea = "area"
+)
+
+// Chart layout constants.
+const (
+	yLabelWidth   = 8  // characters reserved for y-axis labels
+	minChartWidth = 20 // minimum usable chart width in characters
+	legendMaxCols = 4  // max legend items per row
+	maxLabelRunes = 30 // x labels longer than this are truncated
+)
+
+// chartStyle holds the ANSI sequences used by a render pass. When color is
+// disabled every sequence is empty, so piped or redirected output stays free
+// of escape codes.
+type chartStyle struct {
+	dim, bold, reset string
+	series           []string
+}
+
+func newChartStyle(color bool) chartStyle {
+	if !color {
+		return chartStyle{series: make([]string, len(seriesColors))}
+	}
+	return chartStyle{dim: ansiDim, bold: ansiBold, reset: ansiReset, series: seriesColors}
+}
+
+// dataSeries is a named series of float64 values.
+type dataSeries struct {
+	Name   string
+	Values []float64
+}
+
+// RenderChart renders a terminal chart for the given visualization and
+// reports whether anything was drawn, so the caller can show a placeholder
+// instead of silently dropping a chart the answer text refers to.
+func RenderChart(w io.Writer, viz *VizEvent, width int, color bool) bool {
+	if viz == nil || viz.Spec == nil || viz.Data == nil || len(viz.Data.Rows) == 0 {
+		return false
+	}
+
+	spec := viz.Spec
+
+	// Drop rows whose y values cannot be parsed instead of plotting them as
+	// zero: a fabricated zero bar misrepresents the data, which is worse than
+	// a missing row.
+	data := filterPlottableRows(spec, viz.Data)
+	if data == nil || len(data.Rows) == 0 {
+		return false
+	}
+
+	series := extractSeries(spec, data)
+	if len(series) == 0 {
+		return false
+	}
+
+	st := newChartStyle(color)
+
+	// Title.
+	fmt.Fprintln(w)
+	fmt.Fprintf(w, "  %s%s%s\n", st.bold, spec.Title, st.reset)
+	titleLen := min(len(spec.Title), width-4)
+	if titleLen > 0 {
+		fmt.Fprintf(w, "  %s%s%s\n", st.dim, strings.Repeat("─", titleLen), st.reset)
+	}
+
+	switch spec.WidgetType {
+	case widgetLine, widgetArea:
+		renderLineChart(w, spec, data, series, width, spec.WidgetType == widgetArea, st)
+	default:
+		// Bar is also the fallback for unknown widget types: bars stay
+		// readable for any categorical data.
+		renderBarChart(w, spec, data, series, width, st)
+	}
+
+	fmt.Fprintln(w)
+	return true
+}
+
+// filterPlottableRows returns a copy of data containing only rows whose y
+// values all parse as finite numbers. Returns nil when no y field matches the
+// columns at all, so spec/column mismatches degrade to "no chart" rather than
+// a chart of zeros.
+func filterPlottableRows(spec *VizSpec, data *TableData) *TableData {
+	var yIdx []int
+	for _, yf := range spec.YFields {
+		if i := columnIndex(data.Columns, yf); i >= 0 {
+			yIdx = append(yIdx, i)
+		}
+	}
+	if len(yIdx) == 0 {
+		return nil
+	}
+
+	rows := make([][]string, 0, len(data.Rows))
+	for _, row := range data.Rows {
+		ok := true
+		for _, i := range yIdx {
+			if _, parsed := parseFloat(rowString(row, i)); !parsed {
+				ok = false
+				break
+			}
+		}
+		if ok {
+			rows = append(rows, row)
+		}
+	}
+	return &TableData{Columns: data.Columns, Rows: rows}
+}
+
+// renderBarChart draws horizontal bars. The caller guarantees series is
+// non-empty, which extractSeries only produces when XField exists, so xIdx
+// is never negative here.
+func renderBarChart(w io.Writer, spec *VizSpec, data *TableData, series []dataSeries, width int, st chartStyle) {
+	xIdx := columnIndex(data.Columns, spec.XField)
+
+	// Collect labels. Measure and truncate in runes: byte-based slicing can
+	// split a multi-byte character, and fmt pads %*s by rune count.
+	labels := extractXLabels(data, xIdx, spec.ColorField != "")
+	maxLabel := 0
+	for _, l := range labels {
+		maxLabel = max(maxLabel, utf8.RuneCountInString(l))
+	}
+	// Cap label width to prevent squishing the bars.
+	maxLabel = min(maxLabel, maxLabelRunes)
+
+	// Bars scale by absolute value so negative aggregates remain visible;
+	// the signed number beside each bar carries the direction.
+	var maxVal float64
+	for _, s := range series {
+		for _, v := range s.Values {
+			maxVal = math.Max(maxVal, math.Abs(v))
+		}
+	}
+	if maxVal == 0 {
+		maxVal = 1
+	}
+
+	// Find max formatted value width for right-alignment.
+	maxValLen := 0
+	for _, s := range series {
+		for _, v := range s.Values {
+			maxValLen = max(maxValLen, len(formatNumber(v)))
+		}
+	}
+
+	// Bar width (chars available for the bar itself).
+	// Cap at 50 chars so bars stay readable on wide terminals.
+	barWidth := min(max(width-maxLabel-maxValLen-8, minChartWidth), 50)
+
+	multiSeries := len(series) > 1
+	nGroups := len(series[0].Values)
+
+	// Use partial block characters for sub-character precision.
+	// Full block = 8/8, then 7/8 through 1/8.
+	blocks := []string{"█", "▉", "▊", "▋", "▌", "▍", "▎", "▏"}
+
+	fmt.Fprintln(w)
+	for gi := range nGroups {
+		label := ""
+		if gi < len(labels) {
+			label = truncateRunes(labels[gi], maxLabelRunes)
+		}
+
+		for si, s := range series {
+			if gi >= len(s.Values) {
+				continue
+			}
+			v := s.Values[gi]
+
+			// Label: only on first bar of group.
+			if si == 0 {
+				fmt.Fprintf(w, "  %*s ", maxLabel, label)
+			} else {
+				fmt.Fprintf(w, "  %*s ", maxLabel, "")
+			}
+
+			// Bar with sub-character precision.
+			color := st.series[si%len(st.series)]
+			exact := math.Abs(v) / maxVal * float64(barWidth)
+			full := int(exact)
+			frac := exact - float64(full)
+			partial := int(frac * 8)
+
+			fmt.Fprint(w, color)
+			fmt.Fprint(w, strings.Repeat("█", full))
+			if partial > 0 && full < barWidth {
+				fmt.Fprint(w, blocks[8-partial])
+			}
+			fmt.Fprint(w, st.reset)
+
+			// Value right-aligned.
+			valStr := formatNumber(v)
+			fmt.Fprintf(w, " %*s", maxValLen, valStr)
+			if multiSeries {
+				fmt.Fprintf(w, " %s(%s)%s", st.dim, s.Name, st.reset)
+			}
+			fmt.Fprintln(w)
+		}
+		if multiSeries && gi < nGroups-1 {
+			fmt.Fprintln(w)
+		}
+	}
+
+	if multiSeries {
+		renderLegend(w, series, st)
+	}
+}
+
+// renderLineChart draws line (or area) charts using braille characters. The
+// caller guarantees series is non-empty, which extractSeries only produces
+// when XField exists, so xIdx is never negative here.
+func renderLineChart(w io.Writer, spec *VizSpec, data *TableData, series []dataSeries, width int, fill bool, st chartStyle) {
+	xIdx := columnIndex(data.Columns, spec.XField)
+
+	// Chart dimensions. Cap width at 70 chars so charts stay
+	// compact on wide terminals.
+	cw := min(max(width-yLabelWidth-4, minChartWidth), 70)
+	// Height is roughly 40% of width for a pleasing aspect ratio.
+	ch := min(max(10, cw*2/5), 25)
+
+	// Pixel dimensions (braille: 2 dots wide x 4 dots tall per char).
+	pxW := cw * 2
+	pxH := ch * 4
+
+	// Y-axis range.
+	yMin := math.Inf(1)
+	yMax := math.Inf(-1)
+	for _, s := range series {
+		for _, v := range s.Values {
+			yMin = math.Min(yMin, v)
+			yMax = math.Max(yMax, v)
+		}
+	}
+	if math.IsInf(yMin, 1) {
+		return
+	}
+	if yMin > 0 {
+		yMin = 0
+	}
+	if yMax < 0 {
+		yMax = 0
+	}
+	if yMin == yMax {
+		yMax = yMin + 1
+	}
+	span := yMax - yMin
+	yMax += span * 0.05
+	if yMin < 0 {
+		yMin -= span * 0.05
+	}
+
+	grid := newBrailleGrid(cw, ch)
+
+	// Plot each series. Render in reverse order so the first series
+	// (visually most important) wins color conflicts.
+	for si, s := range slices.Backward(series) {
+		nPts := len(s.Values)
+		if nPts == 0 {
+			continue
+		}
+
+		for i := range nPts {
+			x0 := mapRange(float64(i), 0, float64(max(nPts-1, 1)), 0, float64(pxW-1))
+			y0 := mapRange(s.Values[i], yMin, yMax, float64(pxH-1), 0)
+
+			if fill {
+				px := int(math.Round(x0))
+				py := int(math.Round(y0))
+				for y := py; y < pxH; y++ {
+					grid.set(px, y, si)
+				}
+			}
+
+			if i < nPts-1 {
+				x1 := mapRange(float64(i+1), 0, float64(max(nPts-1, 1)), 0, float64(pxW-1))
+				y1 := mapRange(s.Values[i+1], yMin, yMax, float64(pxH-1), 0)
+				ix0, iy0 := int(math.Round(x0)), int(math.Round(y0))
+				ix1, iy1 := int(math.Round(x1)), int(math.Round(y1))
+				// Draw a 2px thick line for better visibility.
+				drawLine(grid, ix0, iy0, ix1, iy1, si)
+				drawLine(grid, ix0, iy0+1, ix1, iy1+1, si)
+			} else if nPts == 1 {
+				grid.set(int(math.Round(x0)), int(math.Round(y0)), si)
+			}
+		}
+	}
+
+	// Render with y-axis labels.
+	fmt.Fprintln(w)
+	yLabels := computeYLabels(yMin, yMax, ch)
+	for row := range ch {
+		label := ""
+		// Show labels on first row, last row, and evenly spaced.
+		if row == 0 || row == ch-1 || row%(ch/4) == 0 {
+			label = yLabels[row]
+		}
+		fmt.Fprintf(w, "  %*s ┤", yLabelWidth, label)
+		for col := range cw {
+			brChar := rune(0x2800) + grid.cells[row][col]
+			ci := grid.colors[row][col]
+			if ci >= 0 {
+				fmt.Fprintf(w, "%s%c%s", st.series[ci%len(st.series)], brChar, st.reset)
+			} else {
+				fmt.Fprintf(w, "%c", brChar)
+			}
+		}
+		fmt.Fprintln(w)
+	}
+
+	// X-axis line.
+	fmt.Fprintf(w, "  %*s └%s\n", yLabelWidth, "", strings.Repeat("─", cw))
+
+	// X-axis labels.
+	xLabels := extractXLabels(data, xIdx, spec.ColorField != "")
+	renderXLabels(w, xLabels, cw, yLabelWidth+3)
+
+	if len(series) > 1 {
+		renderLegend(w, series, st)
+	}
+}
+
+// --- Braille grid ---
+
+type brailleGrid struct {
+	width, height int      // in character cells
+	cells         [][]rune // braille offset bits per cell
+	colors        [][]int  // dominant series index per cell (-1 = none)
+}
+
+func newBrailleGrid(w, h int) *brailleGrid {
+	cells := make([][]rune, h)
+	colors := make([][]int, h)
+	for i := range h {
+		cells[i] = make([]rune, w)
+		colors[i] = make([]int, w)
+		for j := range w {
+			colors[i][j] = -1
+		}
+	}
+	return &brailleGrid{width: w, height: h, cells: cells, colors: colors}
+}
+
+// Braille dot layout within a 2x4 cell:
+//
+//	col 0    col 1
+//	bit 0    bit 3    row 0
+//	bit 1    bit 4    row 1
+//	bit 2    bit 5    row 2
+//	bit 6    bit 7    row 3
+var brailleBits = [2][4]rune{
+	{0x01, 0x02, 0x04, 0x40}, // left column
+	{0x08, 0x10, 0x20, 0x80}, // right column
+}
+
+func (g *brailleGrid) set(px, py, series int) {
+	cx, cy := px/2, py/4
+	if cx < 0 || cx >= g.width || cy < 0 || cy >= g.height {
+		return
+	}
+	dx, dy := px%2, py%4
+	g.cells[cy][cx] |= brailleBits[dx][dy]
+	g.colors[cy][cx] = series
+}
+
+// drawLine plots a line between two pixel coordinates using Bresenham's algorithm.
+func drawLine(g *brailleGrid, x0, y0, x1, y1, series int) {
+	dx := intAbs(x1 - x0)
+	dy := intAbs(y1 - y0)
+	sx := 1
+	if x0 > x1 {
+		sx = -1
+	}
+	sy := 1
+	if y0 > y1 {
+		sy = -1
+	}
+	err := dx - dy
+
+	for {
+		g.set(x0, y0, series)
+		if x0 == x1 && y0 == y1 {
+			break
+		}
+		e2 := 2 * err
+		if e2 > -dy {
+			err -= dy
+			x0 += sx
+		}
+		if e2 < dx {
+			err += dx
+			y0 += sy
+		}
+	}
+}
+
+// --- Data extraction ---
+
+// extractSeries converts table data into typed series based on the viz spec.
+func extractSeries(spec *VizSpec, data *TableData) []dataSeries {
+	xIdx := columnIndex(data.Columns, spec.XField)
+	if xIdx < 0 {
+		return nil
+	}
+
+	if spec.ColorField != "" && len(spec.YFields) > 0 {
+		colorIdx := columnIndex(data.Columns, spec.ColorField)
+		yIdx := columnIndex(data.Columns, spec.YFields[0])
+		if colorIdx >= 0 && yIdx >= 0 {
+			return extractLongFormat(data, xIdx, yIdx, colorIdx)
+		}
+	}
+
+	var result []dataSeries
+	for _, yf := range spec.YFields {
+		yi := columnIndex(data.Columns, yf)
+		if yi < 0 {
+			continue
+		}
+		s := dataSeries{Name: yf}
+		for _, row := range data.Rows {
+			// Rows are pre-filtered by filterPlottableRows, so the parse
+			// cannot fail here.
+			v, _ := parseFloat(rowString(row, yi))
+			s.Values = append(s.Values, v)
+		}
+		result = append(result, s)
+	}
+	return result
+}
+
+// extractLongFormat pivots long-format data (one row per x/category combo) into series.
+func extractLongFormat(data *TableData, xIdx, yIdx, colorIdx int) []dataSeries {
+	var xValues []string
+	xSeen := map[string]bool{}
+	for _, row := range data.Rows {
+		x, ok := rowValue(row, xIdx)
+		if !ok {
+			continue
+		}
+		if !xSeen[x] {
+			xValues = append(xValues, x)
+			xSeen[x] = true
+		}
+	}
+
+	type seriesData struct {
+		name   string
+		values map[string]float64
+	}
+	var seriesOrder []string
+	seriesMap := map[string]*seriesData{}
+
+	for _, row := range data.Rows {
+		x, ok := rowValue(row, xIdx)
+		if !ok {
+			continue
+		}
+		sName, ok := rowValue(row, colorIdx)
+		if !ok {
+			continue
+		}
+		if seriesMap[sName] == nil {
+			seriesMap[sName] = &seriesData{name: sName, values: map[string]float64{}}
+			seriesOrder = append(seriesOrder, sName)
+		}
+		// Rows are pre-filtered by filterPlottableRows, so the parse cannot
+		// fail here.
+		v, _ := parseFloat(rowString(row, yIdx))
+		seriesMap[sName].values[x] = v
+	}
+
+	var result []dataSeries
+	for _, name := range seriesOrder {
+		sd := seriesMap[name]
+		s := dataSeries{Name: sd.name}
+		for _, x := range xValues {
+			s.Values = append(s.Values, sd.values[x])
+		}
+		result = append(result, s)
+	}
+	return result
+}
+
+// --- Helpers ---
+
+func columnIndex(columns []string, name string) int {
+	for i, c := range columns {
+		if c == name {
+			return i
+		}
+	}
+	return -1
+}
+
+func rowValue(row []string, idx int) (string, bool) {
+	if idx < 0 || idx >= len(row) {
+		return "", false
+	}
+	return row[idx], true
+}
+
+func rowString(row []string, idx int) string {
+	v, _ := rowValue(row, idx)
+	return v
+}
+
+func uniqueXLabels(data *TableData, xIdx int) []string {
+	var labels []string
+	seen := map[string]bool{}
+	for _, row := range data.Rows {
+		l, ok := rowValue(row, xIdx)
+		if !ok {
+			continue
+		}
+		if !seen[l] {
+			labels = append(labels, l)
+			seen[l] = true
+		}
+	}
+	return labels
+}
+
+func extractXLabels(data *TableData, xIdx int, longFormat bool) []string {
+	if longFormat {
+		return uniqueXLabels(data, xIdx)
+	}
+	labels := make([]string, len(data.Rows))
+	for i, row := range data.Rows {
+		labels[i] = rowString(row, xIdx)
+	}
+	return labels
+}
+
+// parseFloat parses a table cell as a finite float. The second return value
+// distinguishes "zero" from "not a number at all" so unparseable cells can be
+// dropped instead of plotted as zero.
+func parseFloat(s string) (float64, bool) {
+	s = strings.ReplaceAll(s, ",", "")
+	s = strings.TrimSpace(s)
+	v, err := strconv.ParseFloat(s, 64)
+	if err != nil || math.IsNaN(v) || math.IsInf(v, 0) {
+		return 0, false
+	}
+	return v, true
+}
+
+// truncateRunes shortens s to at most n runes, ending with "..." when
+// truncated. Slicing runes rather than bytes keeps multi-byte characters
+// intact.
+func truncateRunes(s string, n int) string {
+	runes := []rune(s)
+	if len(runes) <= n {
+		return s
+	}
+	return string(runes[:n-3]) + "..."
+}
+
+func formatNumber(v float64) string {
+	if v == math.Trunc(v) && math.Abs(v) < 1e15 {
+		s := strconv.FormatInt(int64(v), 10)
+		return addThousandSep(s)
+	}
+	return strconv.FormatFloat(v, 'f', 1, 64)
+}
+
+func addThousandSep(s string) string {
+	negative := false
+	if strings.HasPrefix(s, "-") {
+		negative = true
+		s = s[1:]
+	}
+	n := len(s)
+	if n <= 3 {
+		if negative {
+			return "-" + s
+		}
+		return s
+	}
+	var b strings.Builder
+	first := n % 3
+	if first > 0 {
+		b.WriteString(s[:first])
+	}
+	for i := first; i < n; i += 3 {
+		if b.Len() > 0 {
+			b.WriteByte(',')
+		}
+		b.WriteString(s[i : i+3])
+	}
+	if negative {
+		return "-" + b.String()
+	}
+	return b.String()
+}
+
+func computeYLabels(yMin, yMax float64, rows int) []string {
+	labels := make([]string, rows)
+	if rows == 1 {
+		labels[0] = formatNumber(yMax)
+		return labels
+	}
+	for i := range rows {
+		v := yMax - (yMax-yMin)*float64(i)/float64(rows-1)
+		labels[i] = formatNumber(v)
+	}
+	return labels
+}
+
+func renderXLabels(w io.Writer, labels []string, chartWidth, leftPad int) {
+	if len(labels) == 0 {
+		return
+	}
+
+	maxLabels := max(chartWidth/12, 2)
+	step := max(1, (len(labels)-1)/(maxLabels-1))
+
+	fmt.Fprintf(w, "%*s", leftPad, "")
+	pos := 0
+	for i := 0; i < len(labels); i += step {
+		label := truncateRunes(labels[i], 10)
+		target := int(float64(i) / float64(max(len(labels)-1, 1)) * float64(chartWidth-1))
+		for pos < target {
+			fmt.Fprint(w, " ")
+			pos++
+		}
+		fmt.Fprint(w, label)
+		pos += utf8.RuneCountInString(label)
+	}
+	fmt.Fprintln(w)
+}
+
+func renderLegend(w io.Writer, series []dataSeries, st chartStyle) {
+	fmt.Fprintln(w)
+	col := 0
+	for si, s := range series {
+		color := st.series[si%len(st.series)]
+		entry := fmt.Sprintf("  %s●%s %s", color, st.reset, s.Name)
+		fmt.Fprint(w, entry)
+		col++
+		if col >= legendMaxCols && si < len(series)-1 {
+			fmt.Fprintln(w)
+			col = 0
+		}
+	}
+	fmt.Fprintln(w)
+}
+
+func mapRange(v, inMin, inMax, outMin, outMax float64) float64 {
+	if inMax == inMin {
+		return (outMin + outMax) / 2
+	}
+	return outMin + (v-inMin)/(inMax-inMin)*(outMax-outMin)
+}
+
+func intAbs(x int) int {
+	if x < 0 {
+		return -x
+	}
+	return x
+}
diff --git a/libs/genie/agentstream/termchart_test.go b/libs/genie/agentstream/termchart_test.go
new file mode 100644
index 00000000000..daeaba6bd69
--- /dev/null
+++ b/libs/genie/agentstream/termchart_test.go
@@ -0,0 +1,172 @@
+package agentstream
+
+import (
+	"bytes"
+	"testing"
+	"unicode/utf8"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func barViz(rows [][]string) *VizEvent {
+	return &VizEvent{
+		Spec: &VizSpec{
+			Title:      "Total by Franchise",
+			WidgetType: widgetBar,
+			XField:     "name",
+			YFields:    []string{"total"},
+		},
+		Data: &TableData{
+			Columns: []string{"name", "total"},
+			Rows:    rows,
+		},
+	}
+}
+
+func TestRenderChart_BarContent(t *testing.T) {
+	var buf bytes.Buffer
+	ok := RenderChart(&buf, barViz([][]string{{"Alpha", "100"}, {"Beta", "1250"}}), 80, false)
+	require.True(t, ok)
+
+	out := buf.String()
+	assert.NotContains(t, out, "\033[", "color disabled must not emit ANSI escapes")
+	assert.Contains(t, out, "Total by Franchise")
+	assert.Contains(t, out, "Alpha")
+	assert.Contains(t, out, "Beta")
+	assert.Contains(t, out, "█")
+	assert.Contains(t, out, "1,250")
+}
+
+func TestRenderChart_ColorEmitsANSI(t *testing.T) {
+	var buf bytes.Buffer
+	require.True(t, RenderChart(&buf, barViz([][]string{{"Alpha", "100"}}), 80, true))
+	assert.Contains(t, buf.String(), "\033[")
+}
+
+func TestRenderChart_UnparseableRowsDropped(t *testing.T) {
+	var buf bytes.Buffer
+	ok := RenderChart(&buf, barViz([][]string{{"Alpha", "100"}, {"Beta", "N/A"}}), 80, false)
+	require.True(t, ok)
+
+	out := buf.String()
+	assert.Contains(t, out, "Alpha")
+	assert.NotContains(t, out, "Beta", "a row that cannot be plotted must not show as a zero bar")
+}
+
+func TestRenderChart_NegativeValues(t *testing.T) {
+	var buf bytes.Buffer
+	ok := RenderChart(&buf, barViz([][]string{{"Alpha", "-100"}, {"Beta", "-640"}}), 80, false)
+	require.True(t, ok)
+
+	out := buf.String()
+	// Bars scale by absolute value; the signed numbers carry direction.
+	assert.Contains(t, out, "█")
+	assert.Contains(t, out, "-100")
+	assert.Contains(t, out, "-640")
+}
+
+func TestRenderChart_NothingPlottable(t *testing.T) {
+	var buf bytes.Buffer
+	assert.False(t, RenderChart(&buf, barViz([][]string{{"Alpha", "N/A"}}), 80, false))
+	assert.Empty(t, buf.String())
+}
+
+func TestRenderChart_YFieldMissingFromColumns(t *testing.T) {
+	viz := barViz([][]string{{"Alpha", "100"}})
+	viz.Spec.YFields = []string{"missing"}
+	var buf bytes.Buffer
+	assert.False(t, RenderChart(&buf, viz, 80, false))
+	assert.Empty(t, buf.String())
+}
+
+func TestRenderChart_XFieldMissingFromColumns(t *testing.T) {
+	// A spec/column mismatch must not leave a title-only chart behind: the
+	// caller relies on the false return to print a placeholder instead.
+	viz := barViz([][]string{{"Alpha", "100"}})
+	viz.Spec.XField = "missing"
+	var buf bytes.Buffer
+	assert.False(t, RenderChart(&buf, viz, 80, false))
+	assert.Empty(t, buf.String())
+}
+
+func TestRenderChart_SparseRowsDoesNotPanic(t *testing.T) {
+	viz := barViz([][]string{
+		{"Alpha", "10"},
+		{"Beta"},
+	})
+	viz.Spec.Title = "Sparse rows"
+
+	var buf bytes.Buffer
+	require.NotPanics(t, func() {
+		RenderChart(&buf, viz, 80, false)
+	})
+	assert.Contains(t, buf.String(), "Sparse rows")
+}
+
+func TestRenderChart_LongFormatSparseRowsDoesNotPanic(t *testing.T) {
+	viz := &VizEvent{
+		Spec: &VizSpec{
+			Title:      "Long sparse rows",
+			WidgetType: widgetLine,
+			XField:     "month",
+			YFields:    []string{"total"},
+			ColorField: "region",
+		},
+		Data: &TableData{
+			Columns: []string{"month", "region", "total"},
+			Rows: [][]string{
+				{"Jan", "US", "10"},
+				{"Feb"},
+				{"Mar", "EU", "-5"},
+			},
+		},
+	}
+
+	var buf bytes.Buffer
+	require.NotPanics(t, func() {
+		RenderChart(&buf, viz, 80, false)
+	})
+	assert.Contains(t, buf.String(), "Long sparse rows")
+}
+
+func TestParseFloat(t *testing.T) {
+	tests := []struct {
+		in   string
+		want float64
+		ok   bool
+	}{
+		{"NaN", 0, false},
+		{"+Inf", 0, false},
+		{"not a number", 0, false},
+		{"", 0, false},
+		{"1,234.5", 1234.5, true},
+		{"-5", -5, true},
+		{"0", 0, true},
+	}
+	for _, tc := range tests {
+		v, ok := parseFloat(tc.in)
+		assert.Equal(t, tc.ok, ok, tc.in)
+		assert.InDelta(t, tc.want, v, 0, tc.in)
+	}
+}
+
+func TestFormatNumber(t *testing.T) {
+	assert.Equal(t, "123", formatNumber(123))
+	assert.Equal(t, "1,000", formatNumber(1000))
+	assert.Equal(t, "1,234,567", formatNumber(1234567))
+	assert.Equal(t, "-1,234,567", formatNumber(-1234567))
+	assert.Equal(t, "-1234.6", formatNumber(-1234.56))
+}
+
+func TestTruncateRunes(t *testing.T) {
+	assert.Equal(t, "short", truncateRunes("short", 30))
+	assert.Equal(t, "exactlyten", truncateRunes("exactlyten", 10))
+	got := truncateRunes("ααααααααααααα", 10)
+	assert.Equal(t, "ααααααα...", got)
+	assert.True(t, utf8.ValidString(got))
+}
+
+func TestComputeYLabelsUsesMinimum(t *testing.T) {
+	assert.Equal(t, []string{"10", "0", "-10"}, computeYLabels(-10, 10, 3))
+}
diff --git a/libs/genie/client.go b/libs/genie/client.go
new file mode 100644
index 00000000000..73522afde5a
--- /dev/null
+++ b/libs/genie/client.go
@@ -0,0 +1,106 @@
+package genie
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"maps"
+
+	"github.com/databricks/cli/libs/auth"
+	"github.com/databricks/cli/libs/genie/agentstream"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/client"
+	"github.com/databricks/databricks-sdk-go/config"
+)
+
+// genieResponsesPath is the backend route. The server-side tool is still named
+// "onechat" even though the CLI command is "genie", so the path keeps that name.
+const genieResponsesPath = "/api/2.0/data-rooms/tools/onechat/responses"
+
+// SourceDatabricksCLI is the source tag sent on every request so the OneChat
+// backend attributes CLI traffic distinctly (maps to OneChatEventSource.
+// DATABRICKS_CLI / ConversationSource.CONVERSATION_SOURCE_DATABRICKS_CLI).
+const SourceDatabricksCLI = "databricks_cli"
+
+// StreamingTimeoutSeconds is how long the SDK waits between body reads
+// before canceling the stream. The Genie agent can take minutes between SSE
+// events when executing multi-step tool calls (search, SQL, etc.), so this
+// is much higher than the SDK's 60s default.
+const StreamingTimeoutSeconds = 600
+
+// BuildRequest creates a GenieRequest for a question. warehouseID is the SQL
+// warehouse Genie runs queries on; when empty it is left out of the request and
+// Genie picks a default warehouse itself. A non-empty conversationID continues
+// that conversation instead of starting a new one.
+func BuildRequest(question, warehouseID, conversationID string) GenieRequest {
+	// The CLI runs in a terminal that cannot render visualizations, so viz is
+	// always disabled. Bound as a local because GenieRequest.EnableViz is a
+	// *bool (see the type's comment for why it can't be a plain bool).
+	enableViz := false
+	return GenieRequest{
+		Input: []InputItem{
+			{
+				Type: "message",
+				Role: "user",
+				Content: []ContentItem{
+					{Type: "input_text", Text: question},
+				},
+			},
+		},
+		WarehouseID:    warehouseID,
+		ConversationID: conversationID,
+		Source:         SourceDatabricksCLI,
+		EnableViz:      &enableViz,
+	}
+}
+
+// PostStream sends the request and returns the raw SSE response body.
+// The caller must close the returned ReadCloser.
+//
+// The inactivity timeout is raised on cfg in place: config.Config embeds a
+// mutex, so copying it is a go vet copylocks violation, and the SDK offers no
+// per-request timeout. The command makes no other requests from this config.
+func PostStream(ctx context.Context, cfg *config.Config, req GenieRequest) (io.ReadCloser, error) {
+	cfg.HTTPTimeoutSeconds = StreamingTimeoutSeconds
+
+	api, err := client.New(cfg)
+	if err != nil {
+		return nil, err
+	}
+
+	var body io.ReadCloser
+	headers := map[string]string{
+		"Content-Type": "application/json",
+		"Accept":       "text/event-stream",
+	}
+	maps.Copy(headers, auth.WorkspaceIDHeaders(cfg))
+	err = api.Do(ctx, "POST", genieResponsesPath, headers, nil, req, &body)
+	// The route is fixed and carries no resource IDs, so a 404 normally means
+	// the endpoint itself is gone: the backend route is undocumented and can
+	// move or be disabled between Databricks releases (a removed route returns
+	// 404 ENDPOINT_NOT_FOUND, "No API found for ...", which the SDK maps to
+	// plain ErrNotFound). A 404 RESOURCE_DOES_NOT_EXIST is excluded: it refers
+	// to something the request named (e.g. the warehouse) and must keep the
+	// backend's own message instead of blaming the endpoint.
+	if errors.Is(err, apierr.ErrNotFound) && !errors.Is(err, apierr.ErrResourceDoesNotExist) {
+		return nil, fmt.Errorf("the Genie API is not available on this workspace: %w; the endpoint may have moved since this CLI release: %s", err, agentstream.UpdateCLIAdvice)
+	}
+	// A request body the backend cannot interpret (e.g. after its expected
+	// request shape changed) surfaces as a 500 INTERNAL_ERROR with an empty
+	// message (observed live), leaving the user a blank error. Transient
+	// backend faults share the status code, hence the hedged advice.
+	if errors.Is(err, apierr.ErrInternalError) {
+		if apiErr, ok := errors.AsType[*apierr.APIError](err); ok && apiErr.Message == "" {
+			// An empty message would render as "request: ;" mid-sentence, so
+			// the observed no-details shape gets its own wording. The %w
+			// keeps the error chain and renders as nothing.
+			return nil, fmt.Errorf("the Genie backend could not process the request (500 with no details)%w; if this keeps happening, the request format may have changed since this CLI release: %s", err, agentstream.UpdateCLIAdvice)
+		}
+		return nil, fmt.Errorf("the Genie backend could not process the request: %w; if this keeps happening, the request format may have changed since this CLI release: %s", err, agentstream.UpdateCLIAdvice)
+	}
+	if err != nil {
+		return nil, err
+	}
+	return body, nil
+}
diff --git a/libs/genie/client_test.go b/libs/genie/client_test.go
new file mode 100644
index 00000000000..28cecffc003
--- /dev/null
+++ b/libs/genie/client_test.go
@@ -0,0 +1,207 @@
+package genie
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/databricks/cli/libs/genie/agentstream"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/config"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestBuildRequest_WireFormat(t *testing.T) {
+	// The backend expects camelCase warehouseId; this pins the wire format,
+	// not just the Go field values. source and enable_viz are always sent:
+	// the CLI tags its traffic (databricks_cli) and disables viz because a
+	// terminal cannot render charts.
+	b, err := json.Marshal(BuildRequest("What tables exist?", "abc123", ""))
+	require.NoError(t, err)
+	assert.JSONEq(t, `{
+		"input": [{
+			"type": "message",
+			"role": "user",
+			"content": [{"type": "input_text", "text": "What tables exist?"}]
+		}],
+		"warehouseId": "abc123",
+		"source": "databricks_cli",
+		"enable_viz": false
+	}`, string(b))
+}
+
+func TestBuildRequest_TagsSourceAndDisablesViz(t *testing.T) {
+	// enable_viz:false must always be on the wire (a plain false would be
+	// dropped by omitempty, letting the backend default viz on), and source
+	// tags CLI traffic for backend attribution.
+	b, err := json.Marshal(BuildRequest("q", "", ""))
+	require.NoError(t, err)
+	assert.Contains(t, string(b), `"source":"databricks_cli"`)
+	assert.Contains(t, string(b), `"enable_viz":false`)
+}
+
+func TestBuildRequest_OmitsEmptyWarehouse(t *testing.T) {
+	b, err := json.Marshal(BuildRequest("q", "", ""))
+	require.NoError(t, err)
+	assert.NotContains(t, string(b), "warehouseId")
+}
+
+func TestBuildRequest_Conversation(t *testing.T) {
+	// A conversation id continues an existing conversation; the wire field is
+	// camelCase conversationId (verified live — the snake_case form is ignored).
+	b, err := json.Marshal(BuildRequest("q", "", "conv-123"))
+	require.NoError(t, err)
+	assert.Contains(t, string(b), `"conversationId":"conv-123"`)
+
+	// Omitted when empty (a fresh conversation).
+	b, err = json.Marshal(BuildRequest("q", "", ""))
+	require.NoError(t, err)
+	assert.NotContains(t, string(b), "conversationId")
+}
+
+func TestPostStream(t *testing.T) {
+	var gotMethod, gotPath, gotAccept, gotContentType string
+	var gotBody []byte
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod = r.Method
+		gotPath = r.URL.Path
+		gotAccept = r.Header.Get("Accept")
+		gotContentType = r.Header.Get("Content-Type")
+		gotBody, _ = io.ReadAll(r.Body)
+
+		w.Header().Set("Content-Type", "text/event-stream")
+		fmt.Fprint(w, "data: {\"type\":\"response.completed\"}\n\n")
+	}))
+	defer srv.Close()
+
+	cfg := &config.Config{Host: srv.URL, Token: "dummy"}
+	body, err := PostStream(t.Context(), cfg, BuildRequest("What tables exist?", "wh1", ""))
+	require.NoError(t, err)
+	defer body.Close()
+
+	assert.Equal(t, "POST", gotMethod)
+	assert.Equal(t, genieResponsesPath, gotPath)
+	assert.Equal(t, "text/event-stream", gotAccept)
+	assert.Equal(t, "application/json", gotContentType)
+	assert.Contains(t, string(gotBody), `"warehouseId":"wh1"`)
+	assert.Equal(t, StreamingTimeoutSeconds, cfg.HTTPTimeoutSeconds)
+
+	ev, err := agentstream.NewSSEReader(body).Next()
+	require.NoError(t, err)
+	assert.JSONEq(t, `{"type":"response.completed"}`, ev.Data)
+}
+
+func TestPostStream_SendsWorkspaceIDHeader(t *testing.T) {
+	// The endpoint is workspace-scoped: on SPOG hosts the gateway rejects the
+	// request ("Credential was not sent…") without the workspace-id header even
+	// with valid auth, so a resolved workspace id must be sent. The wire header is
+	// the canonical X-Databricks-Workspace-Id.
+	var gotWorkspaceID string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotWorkspaceID = r.Header.Get("X-Databricks-Workspace-Id")
+		w.Header().Set("Content-Type", "text/event-stream")
+		fmt.Fprint(w, "data: {\"type\":\"response.completed\"}\n\n")
+	}))
+	defer srv.Close()
+
+	cfg := &config.Config{Host: srv.URL, Token: "dummy", WorkspaceID: "987654321"}
+	body, err := PostStream(t.Context(), cfg, BuildRequest("q", "", ""))
+	require.NoError(t, err)
+	defer body.Close()
+	assert.Equal(t, "987654321", gotWorkspaceID)
+}
+
+func TestPostStream_OmitsWorkspaceIDHeaderWhenUnset(t *testing.T) {
+	// No workspace id (e.g. account-level config) means no header rather than an
+	// empty or "none" one.
+	var hadWorkspaceID bool
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, hadWorkspaceID = r.Header["X-Databricks-Workspace-Id"]
+		w.Header().Set("Content-Type", "text/event-stream")
+		fmt.Fprint(w, "data: {\"type\":\"response.completed\"}\n\n")
+	}))
+	defer srv.Close()
+
+	cfg := &config.Config{Host: srv.URL, Token: "dummy"}
+	body, err := PostStream(t.Context(), cfg, BuildRequest("q", "", ""))
+	require.NoError(t, err)
+	defer body.Close()
+	assert.False(t, hadWorkspaceID, "no workspace-id header when workspace id is unset")
+}
+
+func TestPostStream_EndpointGone(t *testing.T) {
+	// Wire shape a live workspace gateway returns for a route that does not
+	// exist. The genie route is undocumented and can disappear between
+	// releases; the error must point at a CLI update instead of leaking a
+	// bare "No API found".
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusNotFound)
+		fmt.Fprint(w, `{"error_code":"ENDPOINT_NOT_FOUND","message":"No API found for 'POST /data-rooms/tools/onechat/responses'"}`)
+	}))
+	defer srv.Close()
+
+	cfg := &config.Config{Host: srv.URL, Token: "dummy"}
+	_, err := PostStream(t.Context(), cfg, BuildRequest("q", "", ""))
+	require.Error(t, err)
+	assert.ErrorIs(t, err, apierr.ErrNotFound)
+	assert.Contains(t, err.Error(), "No API found")
+	assert.Contains(t, err.Error(), "update the Databricks CLI to the latest version")
+}
+
+func TestPostStream_ResourceNotFound(t *testing.T) {
+	// A 404 RESOURCE_DOES_NOT_EXIST refers to a resource the request named
+	// (the warehouse), not the route: it must keep the backend's message and
+	// not claim the endpoint moved.
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusNotFound)
+		fmt.Fprint(w, `{"error_code":"RESOURCE_DOES_NOT_EXIST","message":"Warehouse wh-missing does not exist"}`)
+	}))
+	defer srv.Close()
+
+	cfg := &config.Config{Host: srv.URL, Token: "dummy"}
+	_, err := PostStream(t.Context(), cfg, BuildRequest("q", "wh-missing", ""))
+	require.Error(t, err)
+	assert.ErrorIs(t, err, apierr.ErrResourceDoesNotExist)
+	assert.Contains(t, err.Error(), "Warehouse wh-missing does not exist")
+	assert.NotContains(t, err.Error(), "update the Databricks CLI")
+}
+
+func TestPostStream_HTTPError(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusInternalServerError)
+		fmt.Fprint(w, `{"error_code":"INTERNAL_ERROR","message":"backend exploded"}`)
+	}))
+	defer srv.Close()
+
+	cfg := &config.Config{Host: srv.URL, Token: "dummy"}
+	_, err := PostStream(t.Context(), cfg, BuildRequest("q", "", ""))
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "backend exploded")
+	assert.Contains(t, err.Error(), "update the Databricks CLI to the latest version")
+}
+
+func TestPostStream_InternalErrorEmptyMessage(t *testing.T) {
+	// Wire shape observed live for a request body the backend cannot
+	// interpret: 500 INTERNAL_ERROR with an empty message. Without the wrap
+	// the user sees a blank "Error: ".
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusInternalServerError)
+		fmt.Fprint(w, `{"error_code":"INTERNAL_ERROR","message":""}`)
+	}))
+	defer srv.Close()
+
+	cfg := &config.Config{Host: srv.URL, Token: "dummy"}
+	_, err := PostStream(t.Context(), cfg, BuildRequest("q", "", ""))
+	require.Error(t, err)
+	assert.ErrorIs(t, err, apierr.ErrInternalError)
+	assert.Contains(t, err.Error(), "could not process the request (500 with no details)")
+	assert.Contains(t, err.Error(), "update the Databricks CLI to the latest version")
+}
diff --git a/libs/genie/types.go b/libs/genie/types.go
new file mode 100644
index 00000000000..b63e6777e56
--- /dev/null
+++ b/libs/genie/types.go
@@ -0,0 +1,168 @@
+package genie
+
+// GenieRequest is the request body for POST /api/2.0/data-rooms/tools/onechat/responses.
+type GenieRequest struct {
+	Input       []InputItem `json:"input"`
+	WarehouseID string      `json:"warehouseId,omitempty"`
+	// Tag is camelCase (conversationId), unlike the response's snake_case
+	// conversation_id; the server does not read the snake_case form on input.
+	ConversationID string `json:"conversationId,omitempty"`
+	// Source identifies this client to the OneChat backend so CLI traffic is
+	// attributed distinctly from webapp/Slack/MCP. Always SourceDatabricksCLI;
+	// the server matches it case-insensitively against a fixed allowlist.
+	Source string `json:"source,omitempty"`
+	// EnableViz is a pointer so it always serializes (a plain false would be
+	// dropped by omitempty). The CLI sends false: a terminal cannot render the
+	// chart/plot items, so we tell the agent to skip registering visualization
+	// tools. Nil would let the backend default (viz on) apply.
+	EnableViz *bool `json:"enable_viz,omitempty"`
+}
+
+// InputItem is a message in the input array.
+type InputItem struct {
+	Type    string        `json:"type"`
+	Role    string        `json:"role,omitempty"`
+	Content []ContentItem `json:"content,omitempty"`
+}
+
+// ContentItem is a content block within a message.
+type ContentItem struct {
+	Type        string `json:"type"`
+	Text        string `json:"text"`
+	Annotations []any  `json:"annotations,omitempty"`
+}
+
+// OutputItem represents an item in the SSE response stream.
+type OutputItem struct {
+	Type      string        `json:"type"`
+	ID        string        `json:"id,omitempty"`
+	Role      string        `json:"role,omitempty"`
+	Status    string        `json:"status,omitempty"`
+	Name      string        `json:"name,omitempty"`
+	CallID    string        `json:"call_id,omitempty"`
+	Arguments string        `json:"arguments,omitempty"`
+	Content   []ContentItem `json:"content,omitempty"`
+	// Metadata values are not all strings: the backend sends arrays (e.g.
+	// source_internal_ids) and objects, so this must be map[string]any or the
+	// whole item fails to unmarshal and the message/tool call is silently lost.
+	Metadata map[string]any `json:"metadata,omitempty"`
+}
+
+// UIType returns the metadata ui_type field (e.g. "THOUGHT", "FINAL_RESPONSE").
+func (o OutputItem) UIType() string {
+	s, _ := o.Metadata["ui_type"].(string)
+	return s
+}
+
+// SSEOutputItemEvent is the payload for response.output_item.added events.
+type SSEOutputItemEvent struct {
+	Type        string     `json:"type"`
+	OutputIndex int        `json:"output_index"`
+	Item        OutputItem `json:"item"`
+}
+
+// SSEResponseDone is the payload for response.done events.
+// Only the Status field is used; Output is omitted to avoid deserializing it.
+type SSEResponseDone struct {
+	Type     string `json:"type"`
+	Response struct {
+		ID             string `json:"id"`
+		Status         string `json:"status"`
+		ConversationID string `json:"conversation_id"`
+	} `json:"response"`
+}
+
+// SSEError is the payload for error events.
+// The server may use "code" or "error_code" for the error code field.
+type SSEError struct {
+	Code      string `json:"code"`
+	ErrorCode string `json:"error_code"`
+	Message   string `json:"message"`
+}
+
+// ErrorCodeString returns whichever error code field the server populated.
+func (e SSEError) ErrorCodeString() string {
+	if e.ErrorCode != "" {
+		return e.ErrorCode
+	}
+	return e.Code
+}
+
+// SSEEventEnvelope is used for initial type detection of SSE JSON payloads.
+type SSEEventEnvelope struct {
+	Type string `json:"type"`
+}
+
+// funcCallOutputEvent is used to parse function_call_output items from SSE events.
+// It uses json.RawMessage for metadata since viz events contain nested objects.
+type funcCallOutputEvent struct {
+	Item struct {
+		Type     string             `json:"type"`
+		ID       string             `json:"id"`
+		Status   string             `json:"status"`
+		Output   string             `json:"output"`
+		Metadata funcCallOutputMeta `json:"metadata"`
+	} `json:"item"`
+}
+
+// funcCallOutputMeta holds metadata from function_call_output items.
+type funcCallOutputMeta struct {
+	UIType      string `json:"ui_type"`
+	StatementID string `json:"statement_id"`
+	SQLID       string `json:"sql_id"`
+	EmbedID     string `json:"embed_id"`
+	// VizDefinition is a JSON-encoded Helios chart spec (the spec itself is
+	// nested under "renderSpec"). The backend sends it as a string, not an
+	// object, and it carries no data.
+	VizDefinition string `json:"viz_definition"`
+	// ResultData carries the SQL preview rows for QUERY_EXECUTION outputs. A
+	// later viz is joined to this data by statement_id.
+	ResultData *queryResultData `json:"result_data"`
+}
+
+// heliosVizDefinition is the parsed metadata.viz_definition payload; the Helios
+// chart spec is nested under renderSpec.
+type heliosVizDefinition struct {
+	RenderSpec *heliosSpec `json:"renderSpec"`
+}
+
+// heliosSpec is the Helios chart specification: a widget type plus field
+// encodings. It carries no data; the rows live in the matching QUERY_EXECUTION
+// result_data, joined by statement_id.
+type heliosSpec struct {
+	WidgetType string          `json:"widgetType"`
+	Frame      heliosFrame     `json:"frame"`
+	Encodings  heliosEncodings `json:"encodings"`
+}
+
+type heliosFrame struct {
+	Title string `json:"title"`
+}
+
+type heliosEncodings struct {
+	X *heliosEncoding `json:"x"`
+	Y *heliosEncoding `json:"y"`
+}
+
+// heliosEncoding describes one axis. A single field uses FieldName; multiple
+// series use Fields. DisplayName is the axis label when present.
+type heliosEncoding struct {
+	FieldName   string        `json:"fieldName"`
+	DisplayName string        `json:"displayName"`
+	Fields      []heliosField `json:"fields"`
+}
+
+type heliosField struct {
+	FieldName string `json:"fieldName"`
+}
+
+// queryResultData is the QUERY_EXECUTION result_data: column metadata plus
+// preview rows in array-of-arrays wire format.
+type queryResultData struct {
+	Columns     []queryResultColumn `json:"columns"`
+	PreviewRows [][]any             `json:"preview_rows"`
+}
+
+type queryResultColumn struct {
+	Name string `json:"name"`
+}
diff --git a/libs/genie/types_test.go b/libs/genie/types_test.go
new file mode 100644
index 00000000000..af7beac0ea8
--- /dev/null
+++ b/libs/genie/types_test.go
@@ -0,0 +1,31 @@
+package genie
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestErrorCodeString(t *testing.T) {
+	tests := []struct {
+		name string
+		err  SSEError
+		want string
+	}{
+		{"error_code field", SSEError{ErrorCode: "RESOURCE_DOES_NOT_EXIST"}, "RESOURCE_DOES_NOT_EXIST"},
+		{"code field", SSEError{Code: "INTERNAL"}, "INTERNAL"},
+		{"error_code wins over code", SSEError{ErrorCode: "A", Code: "B"}, "A"},
+		{"neither", SSEError{}, ""},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, tc.err.ErrorCodeString())
+		})
+	}
+}
+
+func TestOutputItemUIType(t *testing.T) {
+	assert.Equal(t, "THOUGHT", OutputItem{Metadata: map[string]any{"ui_type": "THOUGHT"}}.UIType())
+	assert.Empty(t, OutputItem{Metadata: map[string]any{"ui_type": 42}}.UIType())
+	assert.Empty(t, OutputItem{}.UIType())
+}
diff --git a/libs/git/clone.go b/libs/git/clone.go
index 9369686c994..17703b672d8 100644
--- a/libs/git/clone.go
+++ b/libs/git/clone.go
@@ -41,8 +41,7 @@ func (opts cloneOptions) clone(ctx context.Context) error {
 	if errors.Is(err, exec.ErrNotFound) {
 		return fmt.Errorf("please install git CLI to clone a repository: %w", err)
 	}
-	var processErr *process.ProcessError
-	if errors.As(err, &processErr) {
+	if processErr, ok := errors.AsType[*process.ProcessError](err); ok {
 		return fmt.Errorf("git clone failed: %w. %s", err, processErr.Stderr)
 	}
 	if err != nil {
diff --git a/libs/git/info.go b/libs/git/info.go
index f7caf64da93..03f64cb43d7 100644
--- a/libs/git/info.go
+++ b/libs/git/info.go
@@ -2,16 +2,21 @@ package git
 
 import (
 	"context"
+	"errors"
+	"io/fs"
 	"net/http"
 	"path"
 	"strings"
 
+	"github.com/databricks/cli/libs/auth"
 	"github.com/databricks/cli/libs/dbr"
 	"github.com/databricks/cli/libs/folders"
 	"github.com/databricks/cli/libs/log"
 	"github.com/databricks/cli/libs/vfs"
 	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/apierr"
 	"github.com/databricks/databricks-sdk-go/client"
+	"github.com/databricks/databricks-sdk-go/service/workspace"
 )
 
 type RepositoryInfo struct {
@@ -27,6 +32,7 @@ type RepositoryInfo struct {
 type gitInfo struct {
 	Branch       string `json:"branch"`
 	HeadCommitID string `json:"head_commit_id"`
+	ID           int64  `json:"id"`
 	Path         string `json:"path"`
 	URL          string `json:"url"`
 }
@@ -35,22 +41,48 @@ type response struct {
 	GitInfo *gitInfo `json:"git_info,omitempty"`
 }
 
-// Fetch repository information either by quering .git or by fetching it from API (for dabs-in-workspace case).
-//   - In case we could not find git repository, all string fields of RepositoryInfo will be "" and err will be nil.
+// FetchRepositoryInfo reads Workspace Git metadata or a local .git checkout.
+//   - In case we could not find git repository (including when the path does not exist), all string fields of RepositoryInfo will be "" and err will be nil.
 //   - If there were any errors when trying to determine git root (e.g. API call returned an error or there were permission issues
 //     reading the file system), all strings fields of RepositoryInfo will be "" and err will be non-nil.
 //   - If we could determine git worktree root but there were errors when reading metadata (origin, branch, commit), those errors
 //     will be logged as warnings, RepositoryInfo is guaranteed to have non-empty WorktreeRoot and other fields on best effort basis.
 //   - In successful case, all fields are set to proper git repository metadata.
 func FetchRepositoryInfo(ctx context.Context, path string, w *databricks.WorkspaceClient) (RepositoryInfo, error) {
+	var info RepositoryInfo
+	var err error
 	if strings.HasPrefix(path, "/Workspace/") && dbr.RunsOnRuntime(ctx) {
-		return fetchRepositoryInfoAPI(ctx, path, w)
+		info, err = fetchRepositoryInfoFromWorkspace(ctx, path, w)
 	} else {
+		info, err = fetchRepositoryInfoDotGit(ctx, path)
+	}
+
+	// A path that does not exist just means there is no repository there, which
+	// is not an error. Both backends report this as fs.ErrNotExist (the API
+	// backend translates a workspace 404 to it), so it is normalized to a nil
+	// error in a single place rather than special-cased by every caller.
+	if errors.Is(err, fs.ErrNotExist) {
+		return info, nil
+	}
+	return info, err
+}
+
+func fetchRepositoryInfoFromWorkspace(ctx context.Context, path string, w *databricks.WorkspaceClient) (RepositoryInfo, error) {
+	info, err := FetchRepositoryInfoAPI(ctx, path, w)
+	if err == nil && info.WorktreeRoot == "" {
+		// Fall back to Git information from .git for unsupported Git folders like worktree folders
 		return fetchRepositoryInfoDotGit(ctx, path)
 	}
+	return info, err
 }
 
-func fetchRepositoryInfoAPI(ctx context.Context, path string, w *databricks.WorkspaceClient) (RepositoryInfo, error) {
+// FetchRepositoryInfoAPI reads Workspace Git metadata, the primary source on a Runtime.
+// It is exported so `bundle debug fetch-repository-info --workspace-api` can use this backend
+// off Runtime; normal commands call FetchRepositoryInfo.
+//
+// A path that does not exist is reported as fs.ErrNotExist; callers that treat
+// that as "no repository here" must normalize it the way FetchRepositoryInfo does.
+func FetchRepositoryInfoAPI(ctx context.Context, path string, w *databricks.WorkspaceClient) (RepositoryInfo, error) {
 	result := RepositoryInfo{}
 
 	apiClient, err := client.New(w.Config)
@@ -65,7 +97,7 @@ func fetchRepositoryInfoAPI(ctx context.Context, path string, w *databricks.Work
 		ctx,
 		http.MethodGet,
 		apiEndpoint,
-		nil,
+		auth.WorkspaceIDHeaders(w.Config),
 		nil,
 		map[string]string{
 			"path":            path,
@@ -74,6 +106,14 @@ func fetchRepositoryInfoAPI(ctx context.Context, path string, w *databricks.Work
 		&response,
 	)
 	if err != nil {
+		// The workspace API returns 404 when the path is not a workspace object
+		// (for example, an ephemeral directory that is not part of a Repo).
+		// Normalize it to fs.ErrNotExist, the same signal fetchRepositoryInfoDotGit
+		// produces for a missing local path, so FetchRepositoryInfo can treat
+		// "no path" as "no repository" uniformly.
+		if apierr.IsMissing(err) {
+			return result, fs.ErrNotExist
+		}
 		return result, err
 	}
 
@@ -85,6 +125,21 @@ func fetchRepositoryInfoAPI(ctx context.Context, path string, w *databricks.Work
 		result.LatestCommit = gi.HeadCommitID
 		result.CurrentBranch = gi.Branch
 		result.WorktreeRoot = fixedPath
+
+		// A Git folder with Git CLI access does not store the git metadata on the
+		// workspace object, so get-status returns only the id and path for it. The
+		// Repos API still has the metadata, and git_info.id identifies the Git
+		// folder root even when the queried path is a subdirectory of it.
+		if gi.ID != 0 && gi.Branch == "" && gi.HeadCommitID == "" && gi.URL == "" {
+			repo, err := w.Repos.Get(ctx, workspace.GetRepoRequest{RepoId: gi.ID})
+			if err != nil {
+				log.Warnf(ctx, "failed to load git info for repo %d: %s", gi.ID, err)
+			} else {
+				result.OriginURL = repo.Url
+				result.LatestCommit = repo.HeadCommitId
+				result.CurrentBranch = repo.Branch
+			}
+		}
 	} else {
 		log.Infof(ctx, "Failed to load git info from %s", apiEndpoint)
 	}
diff --git a/libs/git/info_test.go b/libs/git/info_test.go
new file mode 100644
index 00000000000..973ba69ddef
--- /dev/null
+++ b/libs/git/info_test.go
@@ -0,0 +1,90 @@
+package git
+
+import (
+	"io/fs"
+	"net/http"
+	"net/url"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/databricks/cli/internal/testutil"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/qa"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestFetchRepositoryInfoFromWorkspace(t *testing.T) {
+	dir := setupWorktree(t)
+	worktree := filepath.Join(dir, "my_worktree")
+	writeGitDir(t, dir, "gitdir: ../.git/worktrees/my_worktree")
+	writeGitCommonDir(t, dir, "../..")
+	want := RepositoryInfo{
+		OriginURL:     "https://example.test/repo.git",
+		LatestCommit:  strings.Repeat("1", 40),
+		CurrentBranch: "projects/task",
+		WorktreeRoot:  worktree,
+	}
+	gitDirectoryWant := want
+	gitDirectoryWant.WorktreeRoot = dir
+	noGitRoot := filepath.VolumeName(dir) + string(filepath.Separator)
+	testutil.WriteFile(t, filepath.Join(dir, ".git", "refs", "heads", want.CurrentBranch), want.LatestCommit)
+	testutil.WriteFile(t, filepath.Join(dir, ".git", "HEAD"), "ref: refs/heads/"+want.CurrentBranch)
+	testutil.WriteFile(t, filepath.Join(dir, ".git", "worktrees", "my_worktree", "HEAD"), "ref: refs/heads/"+want.CurrentBranch)
+	testutil.WriteFile(t, filepath.Join(dir, ".git", "config"), "[remote \"origin\"]\n\turl = "+want.OriginURL)
+	file := testutil.Touch(t, worktree, "subdir", "README.md")
+	malformed := t.TempDir()
+	testutil.WriteFile(t, filepath.Join(malformed, ".git"), "invalid gitfile")
+
+	for _, tc := range []struct {
+		name    string
+		path    string
+		body    string
+		status  int
+		want    RepositoryInfo
+		wantErr error
+	}{
+		{name: "worktree", path: worktree, want: want},
+		{name: "subdirectory", path: filepath.Dir(file), want: want},
+		{
+			name: "workspace metadata takes precedence", path: worktree,
+			body: `{"git_info":{"branch":"api-main","head_commit_id":"2222222222222222222222222222222222222222","path":"/Users/me/api","url":"https://example.test/api.git"}}`,
+			want: RepositoryInfo{
+				OriginURL: "https://example.test/api.git", LatestCommit: strings.Repeat("2", 40),
+				CurrentBranch: "api-main", WorktreeRoot: "/Workspace/Users/me/api",
+			},
+		},
+		{name: "git directory", path: dir, want: gitDirectoryWant},
+		{name: "no git metadata", path: noGitRoot, wantErr: fs.ErrNotExist},
+		{name: "malformed gitfile", path: malformed, want: RepositoryInfo{WorktreeRoot: malformed}},
+		{
+			name: "permission denied", path: worktree, status: http.StatusForbidden,
+			body: `{"error_code":"PERMISSION_DENIED","message":"denied"}`, wantErr: apierr.ErrPermissionDenied,
+		},
+		{
+			name: "workspace path missing", path: worktree, status: http.StatusNotFound,
+			body: `{"error_code":"RESOURCE_DOES_NOT_EXIST","message":"missing"}`, wantErr: fs.ErrNotExist,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			body := tc.body
+			if body == "" {
+				body = `{}`
+			}
+			cfg, server := qa.HTTPFixtures{{
+				Method:   "GET",
+				Resource: "/api/2.0/workspace/get-status?path=" + url.QueryEscape(tc.path) + "&return_git_info=true",
+				Response: body,
+				Status:   tc.status,
+			}}.Config(t)
+			t.Cleanup(server.Close)
+			w := databricks.Must(databricks.NewWorkspaceClient((*databricks.Config)(cfg)))
+
+			got, err := fetchRepositoryInfoFromWorkspace(t.Context(), tc.path, w)
+			require.ErrorIs(t, err, tc.wantErr)
+			assert.Equal(t, tc.want, got)
+		})
+	}
+}
diff --git a/libs/git/reference.go b/libs/git/reference.go
index 6001d70de5c..35dc96bc59e 100644
--- a/libs/git/reference.go
+++ b/libs/git/reference.go
@@ -86,7 +86,7 @@ func (ref *Reference) ResolvePath() (string, error) {
 // `ref: refs/heads/my-branch` returns `my-branch`
 func (ref *Reference) CurrentBranch() (string, error) {
 	branchRefPath, err := ref.ResolvePath()
-	if err == ErrNotAReferencePointer {
+	if errors.Is(err, ErrNotAReferencePointer) {
 		return "", ErrNotABranch
 	}
 	if err != nil {
diff --git a/libs/git/repository_test.go b/libs/git/repository_test.go
index 1095f0be39c..7c76e003133 100644
--- a/libs/git/repository_test.go
+++ b/libs/git/repository_test.go
@@ -197,14 +197,14 @@ func TestRepositoryGitConfigWhenNotARepo(t *testing.T) {
 
 	branch, err := repo.CurrentBranch()
 	assert.NoError(t, err)
-	assert.Equal(t, "", branch)
+	assert.Empty(t, branch)
 
 	commit, err := repo.LatestCommit()
 	assert.NoError(t, err)
-	assert.Equal(t, "", commit)
+	assert.Empty(t, commit)
 
 	originUrl := repo.OriginUrl()
-	assert.Equal(t, "", originUrl)
+	assert.Empty(t, originUrl)
 }
 
 func TestRepositoryOriginUrlRemovesUserCreds(t *testing.T) {
diff --git a/libs/gorules/rule_benchmark_loop.go b/libs/gorules/rule_benchmark_loop.go
new file mode 100644
index 00000000000..50eac3ab494
--- /dev/null
+++ b/libs/gorules/rule_benchmark_loop.go
@@ -0,0 +1,15 @@
+package gorules
+
+import "github.com/quasilyte/go-ruleguard/dsl"
+
+// UseBenchmarkLoop detects classic benchmark loops over b.N and suggests
+// b.Loop() (Go 1.24+; the inlining regression was fixed in 1.26 so there's
+// no longer a reason to keep b.N-based loops).
+func UseBenchmarkLoop(m dsl.Matcher) {
+	m.Match(
+		`for $_ := range $b.N`,
+		`for range $b.N`,
+	).
+		Where(m["b"].Type.Is("*testing.B")).
+		Report(`Use 'for $b.Loop()' instead of looping over $b.N (Go 1.24+, performance-correct in 1.26+)`)
+}
diff --git a/libs/gorules/rule_lipgloss_renderer.go b/libs/gorules/rule_lipgloss_renderer.go
new file mode 100644
index 00000000000..7b50992fe4e
--- /dev/null
+++ b/libs/gorules/rule_lipgloss_renderer.go
@@ -0,0 +1,13 @@
+package gorules
+
+import "github.com/quasilyte/go-ruleguard/dsl"
+
+// NoLipglossNewRenderer steers renderer construction through cmdio.NewRenderer,
+// which forces the Ascii profile when the target writer has no color. A bare
+// lipgloss.NewRenderer bypasses that gate and reads color from process env, so
+// it is only allowed inside libs/cmdio itself (where the wrapper lives).
+func NoLipglossNewRenderer(m dsl.Matcher) {
+	m.Match(`lipgloss.NewRenderer($*_)`).
+		Where(!m.File().PkgPath.Matches(`libs/cmdio$`)).
+		Report(`Do not call lipgloss.NewRenderer directly; use cmdio.NewRenderer(ctx, w) so color handling stays centralized`)
+}
diff --git a/libs/gorules/rule_os_chdir.go b/libs/gorules/rule_os_chdir.go
deleted file mode 100644
index ac28445ee2e..00000000000
--- a/libs/gorules/rule_os_chdir.go
+++ /dev/null
@@ -1,10 +0,0 @@
-package gorules
-
-import "github.com/quasilyte/go-ruleguard/dsl"
-
-// NoOsChdir forbids os.Chdir in test files. Use t.Chdir() instead.
-func NoOsChdir(m dsl.Matcher) {
-	m.Match(`os.Chdir($*_)`).
-		Where(m.File().Name.Matches(`_test\.go$`)).
-		Report(`Use t.Chdir() instead of os.Chdir() in tests`)
-}
diff --git a/libs/gorules/rule_reflect_typefor.go b/libs/gorules/rule_reflect_typefor.go
deleted file mode 100644
index 4a5993d87b5..00000000000
--- a/libs/gorules/rule_reflect_typefor.go
+++ /dev/null
@@ -1,9 +0,0 @@
-package gorules
-
-import "github.com/quasilyte/go-ruleguard/dsl"
-
-// UseReflectTypeFor detects reflect.TypeOf((*T)(nil)).Elem() and suggests reflect.TypeFor[T]() instead.
-func UseReflectTypeFor(m dsl.Matcher) {
-	m.Match(`reflect.TypeOf(($x)(nil)).Elem()`).
-		Report(`Use reflect.TypeFor instead of reflect.TypeOf((*T)(nil)).Elem()`)
-}
diff --git a/libs/iamutil/current_user.go b/libs/iamutil/current_user.go
new file mode 100644
index 00000000000..2908c8e19a2
--- /dev/null
+++ b/libs/iamutil/current_user.go
@@ -0,0 +1,38 @@
+package iamutil
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"time"
+
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/retries"
+	"github.com/databricks/databricks-sdk-go/service/iam"
+)
+
+// meRetryTimeout bounds how long GetCurrentUser retries transient 500s.
+const meRetryTimeout = 30 * time.Second
+
+// GetCurrentUser returns the current user, retrying on HTTP 500 responses.
+//
+// CurrentUser.Me is a read-only endpoint, so retrying any 500 is safe. The
+// Databricks SCIM API intermittently returns "500 TEMPORARILY_UNAVAILABLE" (a
+// condition it otherwise serves as 503), and the SDK retries 503 but not 500 —
+// see the "some API's recommend retries on HTTP 500, but we'll add that later"
+// comment on (*apierr.APIError).IsRetriable in databricks-sdk-go/apierr. This
+// call runs at the start of every bundle command, so an unretried 500 fails the
+// whole command; we close that gap here.
+func GetCurrentUser(ctx context.Context, w *databricks.WorkspaceClient) (*iam.User, error) {
+	return retries.Poll(ctx, meRetryTimeout, func() (*iam.User, *retries.Err) {
+		user, err := w.CurrentUser.Me(ctx, iam.MeRequest{})
+		if err == nil {
+			return user, nil
+		}
+		if apiErr, ok := errors.AsType[*apierr.APIError](err); ok && apiErr.StatusCode == http.StatusInternalServerError {
+			return nil, retries.Continue(err)
+		}
+		return nil, retries.Halt(err)
+	})
+}
diff --git a/libs/iamutil/current_user_test.go b/libs/iamutil/current_user_test.go
new file mode 100644
index 00000000000..decf8eef936
--- /dev/null
+++ b/libs/iamutil/current_user_test.go
@@ -0,0 +1,39 @@
+package iamutil
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/experimental/mocks"
+	"github.com/databricks/databricks-sdk-go/service/iam"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetCurrentUserRetriesOn500(t *testing.T) {
+	m := mocks.NewMockWorkspaceClient(t)
+	me := m.GetMockCurrentUserAPI().EXPECT().Me(mock.Anything, mock.Anything)
+	me.Return(nil, &apierr.APIError{StatusCode: http.StatusInternalServerError, ErrorCode: "TEMPORARILY_UNAVAILABLE"}).Once()
+	me.Return(&iam.User{UserName: "test-user"}, nil).Once()
+
+	user, err := GetCurrentUser(t.Context(), m.WorkspaceClient)
+	require.NoError(t, err)
+	assert.Equal(t, "test-user", user.UserName)
+}
+
+func TestGetCurrentUserDoesNotRetryOn403(t *testing.T) {
+	m := mocks.NewMockWorkspaceClient(t)
+	// A non-500 error must fail immediately, without a retry (Once enforces it).
+	m.GetMockCurrentUserAPI().EXPECT().
+		Me(mock.Anything, mock.Anything).
+		Return(nil, &apierr.APIError{StatusCode: http.StatusForbidden, Message: "denied"}).
+		Once()
+
+	_, err := GetCurrentUser(t.Context(), m.WorkspaceClient)
+	require.Error(t, err)
+	var apiErr *apierr.APIError
+	require.ErrorAs(t, err, &apiErr)
+	assert.Equal(t, http.StatusForbidden, apiErr.StatusCode)
+}
diff --git a/libs/iamutil/service_principal.go b/libs/iamutil/service_principal.go
index 0ae578baf19..e72adfeb37c 100644
--- a/libs/iamutil/service_principal.go
+++ b/libs/iamutil/service_principal.go
@@ -1,8 +1,9 @@
 package iamutil
 
 import (
+	"uuid"
+
 	"github.com/databricks/databricks-sdk-go/service/iam"
-	"github.com/google/uuid"
 )
 
 // Determines whether a given user is a service principal.
diff --git a/libs/jsonschema/extension.go b/libs/jsonschema/extension.go
index 0bc23afcb1b..031c26ac642 100644
--- a/libs/jsonschema/extension.go
+++ b/libs/jsonschema/extension.go
@@ -41,12 +41,20 @@ type Extension struct {
 	// from a different directory (e.g., "../default").
 	TemplateDir string `json:"template_dir,omitempty"`
 
-	// Preview indicates launch stage (e.g. PREVIEW).
+	// LaunchStage is the field's release stage from the cli.json contract.
 	//
-	// This field indicates whether the associated field is part of a private preview feature.
-	// Currently, it is used exclusively by Python code generation to exclude certain fields
-	// from the generated Sphinx documentation.
-	Preview string `json:"x-databricks-preview,omitempty"`
+	// It is emitted only for private-preview fields. Python code generation reads
+	// it to exclude those fields from the generated Sphinx documentation. Other
+	// stages are not emitted here because nothing consumes them in the published
+	// schema (the stage already surfaces as a description prefix and as the
+	// per-value enumDescriptions labels).
+	LaunchStage string `json:"x-databricks-launch-stage,omitempty"`
+
+	// EnumDescriptions is the parallel-array form emitted alongside Enum. VSCode
+	// renders these next to each enum value in autocomplete dropdowns. Each entry
+	// combines the per-value launch-stage label and textual description sourced
+	// from cli.json's enum_launch_stages and enum_descriptions.
+	EnumDescriptions []string `json:"enumDescriptions,omitempty"`
 
 	// This field is not in JSON schema spec, but it is supported in VSCode and in the Databricks Workspace
 	// It is used to provide a rich description of the field in the hover tooltip.
diff --git a/libs/jsonschema/from_type.go b/libs/jsonschema/from_type.go
index 356db14b6b8..08eaf715f22 100644
--- a/libs/jsonschema/from_type.go
+++ b/libs/jsonschema/from_type.go
@@ -113,15 +113,11 @@ func FromType(typ reflect.Type, fns []func(typ reflect.Type, s Schema) Schema) (
 	return res, nil
 }
 
-func TypePath(typ reflect.Type) string {
-	return typePath(typ)
-}
-
 // typePath computes a unique string representation of the type. $ref in the generated
 // JSON schema will refer to this path. See TestTypePath for examples outputs.
 func typePath(typ reflect.Type) string {
 	// Pointers have a typ.Name() of "". Dereference them to get the underlying type.
-	for typ.Kind() == reflect.Ptr {
+	for typ.Kind() == reflect.Pointer {
 		typ = typ.Elem()
 	}
 
@@ -159,7 +155,7 @@ func typePath(typ reflect.Type) string {
 // the corresponding $ref in the JSON schema.
 func (c *constructor) walk(typ reflect.Type) (string, error) {
 	// Dereference pointers if necessary.
-	for typ.Kind() == reflect.Ptr {
+	for typ.Kind() == reflect.Pointer {
 		typ = typ.Elem()
 	}
 
@@ -224,8 +220,8 @@ func getStructFields(typ reflect.Type) []reflect.StructField {
 	var fields []reflect.StructField
 	bfsQueue := list.New()
 
-	for i := range typ.NumField() {
-		bfsQueue.PushBack(typ.Field(i))
+	for field := range typ.Fields() {
+		bfsQueue.PushBack(field)
 	}
 	for bfsQueue.Len() > 0 {
 		front := bfsQueue.Front()
@@ -246,8 +242,8 @@ func getStructFields(typ reflect.Type) []reflect.StructField {
 			fieldType = fieldType.Elem()
 		}
 
-		for i := range fieldType.NumField() {
-			bfsQueue.PushBack(fieldType.Field(i))
+		for field := range fieldType.Fields() {
+			bfsQueue.PushBack(field)
 		}
 	}
 	return fields
diff --git a/libs/jsonschema/schema.go b/libs/jsonschema/schema.go
index 99afa2f677d..302a49366e2 100644
--- a/libs/jsonschema/schema.go
+++ b/libs/jsonschema/schema.go
@@ -270,8 +270,9 @@ func (s *Schema) validateSchemaMinimumCliVersion(currentVersion string) func() e
 			return nil
 		}
 
-		// Ignore this validation rule for local builds.
-		if semver.Compare("v"+build.DefaultSemver, currentVersion) == 0 {
+		// Ignore this validation rule for development builds, which are built from
+		// main and may already carry the change the schema requires.
+		if build.IsDevelopmentVersion(currentVersion) {
 			return nil
 		}
 
diff --git a/libs/jsonschema/schema_test.go b/libs/jsonschema/schema_test.go
index eea6739743b..55646869441 100644
--- a/libs/jsonschema/schema_test.go
+++ b/libs/jsonschema/schema_test.go
@@ -221,9 +221,7 @@ func TestSchemaValidatePatternEnum(t *testing.T) {
 
 func TestValidateSchemaMinimumCliVersionWithInvalidSemver(t *testing.T) {
 	s := &Schema{
-		Extension: Extension{
-			MinDatabricksCliVersion: "1.0.5",
-		},
+		MinDatabricksCliVersion: "1.0.5",
 	}
 	err := s.validateSchemaMinimumCliVersion("v2.0.1")()
 	assert.ErrorContains(t, err, "invalid minimum CLI version \"1.0.5\" specified. Please specify the version in the format v0.0.0")
@@ -235,9 +233,7 @@ func TestValidateSchemaMinimumCliVersionWithInvalidSemver(t *testing.T) {
 
 func TestValidateSchemaMinimumCliVersion(t *testing.T) {
 	s := &Schema{
-		Extension: Extension{
-			MinDatabricksCliVersion: "v1.0.5",
-		},
+		MinDatabricksCliVersion: "v1.0.5",
 	}
 	err := s.validateSchemaMinimumCliVersion("v2.0.1")()
 	assert.NoError(t, err)
diff --git a/libs/jsonschema/utils_test.go b/libs/jsonschema/utils_test.go
index beb126e3905..9c2496a7ae8 100644
--- a/libs/jsonschema/utils_test.go
+++ b/libs/jsonschema/utils_test.go
@@ -151,11 +151,9 @@ func TestValidatePropertyPatternMatch(t *testing.T) {
 
 	// Expect custom error message on match fail
 	err = validatePatternMatch("bar", "axyze", &Schema{
-		Type:    "string",
-		Pattern: "(a*.d)",
-		Extension: Extension{
-			PatternMatchFailureMessage: "my custom msg",
-		},
+		Type:                       "string",
+		Pattern:                    "(a*.d)",
+		PatternMatchFailureMessage: "my custom msg",
 	})
 	assert.EqualError(t, err, "invalid value for bar: \"axyze\". my custom msg")
 
diff --git a/libs/liteswap/liteswap.go b/libs/liteswap/liteswap.go
new file mode 100644
index 00000000000..c83ec0b7b3b
--- /dev/null
+++ b/libs/liteswap/liteswap.go
@@ -0,0 +1,22 @@
+package liteswap
+
+import (
+	"context"
+
+	"github.com/databricks/cli/libs/env"
+	"github.com/databricks/databricks-sdk-go/config"
+)
+
+// TargetVariable names the liteswap unit to route requests to (dev/test only).
+const TargetVariable = "DATABRICKS_LITESWAP_TARGET"
+
+// Apply routes cfg's requests to the liteswap unit named by DATABRICKS_LITESWAP_TARGET.
+func Apply(ctx context.Context, cfg *config.Config) {
+	target := env.Get(ctx, TargetVariable)
+	if target == "" {
+		return
+	}
+	cfg.Headers = config.StaticHeaders(map[string]string{
+		"x-databricks-traffic-id": "testenv://liteswap/" + target,
+	})
+}
diff --git a/libs/localenv/compute.go b/libs/localenv/compute.go
new file mode 100644
index 00000000000..a6d960bb421
--- /dev/null
+++ b/libs/localenv/compute.go
@@ -0,0 +1,209 @@
+package localenv
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+)
+
+// ComputeClient is a narrow seam over the SDK so tests can stub it.
+type ComputeClient interface {
+	// GetClusterSparkVersion returns the Spark version string for a cluster.
+	GetClusterSparkVersion(ctx context.Context, clusterID string) (string, error)
+	// GetClusterByName resolves a cluster name to its ID and Spark version. It
+	// errors when the name is unknown or ambiguous (more than one cluster shares
+	// the name), so the caller can surface an actionable E_RESOLVE.
+	GetClusterByName(ctx context.Context, name string) (clusterID, sparkVersion string, err error)
+	// JobTaskEnvironment resolves a single job task's compute to an environment.
+	//
+	// A job can bind multiple tasks to different environment versions, so the
+	// target is a specific task, not the whole job. taskKey selects it; an empty
+	// taskKey is a request to enumerate — the method returns ErrTaskKeyRequired
+	// wrapping the job's task keys so the caller can prompt for one. An unknown
+	// taskKey returns an error naming the available keys.
+	//
+	// For a serverless task, isServerless is true and version is the task's
+	// recorded serverless environment version (read directly — no fallback). For
+	// a classic task, isServerless is false and sparkVersion is the task cluster's
+	// runtime.
+	JobTaskEnvironment(ctx context.Context, jobID, taskKey string) (sparkVersion string, isServerless bool, version string, err error)
+}
+
+// ErrTaskKeyRequired is returned by JobTaskEnvironment when --job-task names a
+// job but no task, so ResolveCompute can classify it as E_USAGE (the user must
+// pick a task) rather than E_RESOLVE. It carries the job's task keys so the
+// error message can list them.
+type ErrTaskKeyRequired struct {
+	JobID    string
+	TaskKeys []string
+}
+
+func (e *ErrTaskKeyRequired) Error() string {
+	return fmt.Sprintf("job %s has multiple tasks; specify one: --job-task %s.<task-key> (available: %s)",
+		e.JobID, e.JobID, strings.Join(e.TaskKeys, ", "))
+}
+
+// ComputeFlags holds the mutually-exclusive compute target flags from the CLI.
+type ComputeFlags struct {
+	Cluster     string
+	ClusterName string
+	Serverless  string
+	// JobTask is "<job-id>.<task-key>" (or a bare "<job-id>", which resolves to
+	// an E_USAGE listing the job's task keys). A job can bind tasks to different
+	// environment versions, so the target is a specific task, not the whole job.
+	JobTask string
+}
+
+// BundleTarget is the three-state result of reading the bundle's configured
+// target. Selected=false means nothing was configured.
+type BundleTarget struct {
+	ClusterID  string
+	Serverless bool
+	Selected   bool
+}
+
+// noTargetMessage is the actionable message shown when no target is selected,
+// matching spec §2.3.
+const noTargetMessage = "No compute target is selected. Select a cluster or serverless target, or pass --cluster-id / --cluster-name / --serverless-version / --job-task"
+
+// ValidateComputeFlags returns an error if more than one of the target flags is set.
+// Cobra marks them mutually exclusive too; this guards the library path.
+func ValidateComputeFlags(f ComputeFlags) error {
+	var set []string
+	if f.Cluster != "" {
+		set = append(set, "--cluster-id")
+	}
+	if f.ClusterName != "" {
+		set = append(set, "--cluster-name")
+	}
+	if f.Serverless != "" {
+		set = append(set, "--serverless-version")
+	}
+	if f.JobTask != "" {
+		set = append(set, "--job-task")
+	}
+	if len(set) > 1 {
+		return fmt.Errorf("flags %s are mutually exclusive; specify at most one", strings.Join(set, " and "))
+	}
+	return nil
+}
+
+// ResolveCompute resolves the compute target using ordered precedence:
+// --cluster-id → --cluster-name → --serverless-version → --job-task → bundle target.
+// PythonVersion is left empty; it is filled later from constraint data.
+//
+// Incompatible flags are rejected up front: without this a library caller that
+// bypasses Cobra (which also marks the flags mutually exclusive) and passes more
+// than one target flag would have all but the first precedence branch silently
+// ignored, resolving a different target than requested.
+func ResolveCompute(ctx context.Context, f ComputeFlags, c ComputeClient, bt BundleTarget) (*ComputeInfo, error) {
+	if err := ValidateComputeFlags(f); err != nil {
+		return nil, NewError(ErrResolve, err, "invalid compute target flags")
+	}
+
+	if f.Cluster != "" {
+		v, err := c.GetClusterSparkVersion(ctx, f.Cluster)
+		if err != nil {
+			return nil, NewError(ErrResolve, err, "resolving cluster %s", f.Cluster)
+		}
+		return &ComputeInfo{
+			Source:       "cluster",
+			ClusterID:    f.Cluster,
+			SparkVersion: v,
+			EnvKey:       EnvKeyForSparkVersion(v),
+		}, nil
+	}
+
+	if f.ClusterName != "" {
+		// Resolve the name to an ID via the Clusters API; from there it is
+		// identical to --cluster-id. An unknown or ambiguous name (two clusters
+		// sharing it) yields an actionable E_RESOLVE.
+		id, v, err := c.GetClusterByName(ctx, f.ClusterName)
+		if err != nil {
+			return nil, NewError(ErrResolve, err, "resolving cluster name %q", f.ClusterName)
+		}
+		return &ComputeInfo{
+			Source:       "cluster",
+			ClusterID:    id,
+			SparkVersion: v,
+			EnvKey:       EnvKeyForSparkVersion(v),
+		}, nil
+	}
+
+	if f.Serverless != "" {
+		if !ValidServerlessVersion(f.Serverless) {
+			return nil, NewError(ErrResolve, nil, "invalid --serverless-version %q: expected a version number like 5", f.Serverless)
+		}
+		return &ComputeInfo{
+			Source:            "serverless",
+			ServerlessVersion: NormalizeServerless(f.Serverless),
+			EnvKey:            EnvKeyForServerless(f.Serverless),
+		}, nil
+	}
+
+	if f.JobTask != "" {
+		// Split "<job-id>.<task-key>" on the FIRST dot: task keys may themselves
+		// contain dots, so everything after the first separator is the task key.
+		// A bare "<job-id>" (no dot) leaves taskKey empty, which JobTaskEnvironment
+		// treats as an enumerate request and reports back via ErrTaskKeyRequired.
+		jobID, taskKey, _ := strings.Cut(f.JobTask, ".")
+		sparkVersion, isServerless, version, err := c.JobTaskEnvironment(ctx, jobID, taskKey)
+		if err != nil {
+			// A missing task key is a usage error (the user must pick a task),
+			// distinct from a genuine resolve failure (unknown key, API error).
+			if _, ok := errors.AsType[*ErrTaskKeyRequired](err); ok {
+				return nil, NewError(ErrUsage, err, "specify a job task")
+			}
+			return nil, NewError(ErrResolve, err, "resolving job task %s", f.JobTask)
+		}
+		if isServerless {
+			// The task's serverless environment version is read directly from its
+			// bound environment, so there is no version to guess: unlike the bundle
+			// path, the job-task path never applies the serverless-vN fallback.
+			return &ComputeInfo{
+				Source:            "job",
+				ServerlessVersion: NormalizeServerless(version),
+				EnvKey:            EnvKeyForServerless(version),
+			}, nil
+		}
+		// Classic compute: sparkVersion is the task cluster's runtime.
+		return &ComputeInfo{
+			Source:       "job",
+			SparkVersion: sparkVersion,
+			EnvKey:       EnvKeyForSparkVersion(sparkVersion),
+		}, nil
+	}
+
+	// Fall back to bundle target.
+	if !bt.Selected {
+		return nil, NewError(ErrNoTarget, nil, "%s", noTargetMessage)
+	}
+
+	if bt.Serverless {
+		// The bundle records that the target is serverless but not which version,
+		// so use the default stand-in (spec §4.3).
+		return &ComputeInfo{
+			Source:            "bundle",
+			ServerlessVersion: NormalizeServerless(defaultServerlessVersion),
+			EnvKey:            EnvKeyForServerless(defaultServerlessVersion),
+		}, nil
+	}
+
+	if bt.ClusterID != "" {
+		v, err := c.GetClusterSparkVersion(ctx, bt.ClusterID)
+		if err != nil {
+			return nil, NewError(ErrResolve, err, "resolving bundle cluster %s", bt.ClusterID)
+		}
+		return &ComputeInfo{
+			Source:       "bundle",
+			ClusterID:    bt.ClusterID,
+			SparkVersion: v,
+			EnvKey:       EnvKeyForSparkVersion(v),
+		}, nil
+	}
+
+	// Bundle target is selected but has neither serverless nor a cluster ID —
+	// treat this the same as nothing selected so the user gets a clear message.
+	return nil, NewError(ErrNoTarget, nil, "%s", noTargetMessage)
+}
diff --git a/libs/localenv/compute_test.go b/libs/localenv/compute_test.go
new file mode 100644
index 00000000000..ef93810e4e4
--- /dev/null
+++ b/libs/localenv/compute_test.go
@@ -0,0 +1,223 @@
+package localenv
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type stubCompute struct {
+	clusterVersion string
+	clusterErr     error
+	byNameID       string
+	byNameVersion  string
+	byNameErr      error
+}
+
+func (s stubCompute) GetClusterSparkVersion(_ context.Context, _ string) (string, error) {
+	return s.clusterVersion, s.clusterErr
+}
+
+func (s stubCompute) GetClusterByName(_ context.Context, _ string) (string, string, error) {
+	return s.byNameID, s.byNameVersion, s.byNameErr
+}
+
+func (s stubCompute) JobTaskEnvironment(_ context.Context, _, _ string) (string, bool, string, error) {
+	return "", false, "", nil
+}
+
+func TestResolveServerlessFlag(t *testing.T) {
+	ti, err := ResolveCompute(t.Context(), ComputeFlags{Serverless: "v4"}, stubCompute{}, BundleTarget{})
+	require.NoError(t, err)
+	assert.Equal(t, "serverless", ti.Source)
+	assert.Equal(t, "v4", ti.ServerlessVersion)
+	assert.Equal(t, "serverless/serverless-v4", ti.EnvKey)
+}
+
+func TestResolveServerlessFlagBareNumber(t *testing.T) {
+	// The documented input is a bare number; it normalizes to the vN env key.
+	ti, err := ResolveCompute(t.Context(), ComputeFlags{Serverless: "5"}, stubCompute{}, BundleTarget{})
+	require.NoError(t, err)
+	assert.Equal(t, "serverless/serverless-v5", ti.EnvKey)
+}
+
+func TestResolveServerlessFlagRejectsMalformed(t *testing.T) {
+	// Malformed values fail fast at resolve (E_RESOLVE) rather than resolving to
+	// a bogus env key that only 404s at fetch.
+	for _, bad := range []string{"vv5", "v", " 5", "5x", "latest"} {
+		_, err := ResolveCompute(t.Context(), ComputeFlags{Serverless: bad}, stubCompute{}, BundleTarget{})
+		var pe *PipelineError
+		require.ErrorAs(t, err, &pe, "input %q should error", bad)
+		assert.Equal(t, ErrResolve, pe.Code, "input %q", bad)
+	}
+}
+
+func TestResolveClusterFlag(t *testing.T) {
+	c := stubCompute{clusterVersion: "15.4.x-scala2.12"}
+	ti, err := ResolveCompute(t.Context(), ComputeFlags{Cluster: "abc"}, c, BundleTarget{})
+	require.NoError(t, err)
+	assert.Equal(t, "cluster", ti.Source)
+	assert.Equal(t, "15.4.x-scala2.12", ti.SparkVersion)
+	assert.Equal(t, "dbr/15.4.x-scala2.12", ti.EnvKey)
+	assert.Equal(t, "abc", ti.ClusterID)
+}
+
+func TestResolveClusterFlagError(t *testing.T) {
+	c := stubCompute{clusterErr: errors.New("cluster not found")}
+	_, err := ResolveCompute(t.Context(), ComputeFlags{Cluster: "abc"}, c, BundleTarget{})
+	var pe *PipelineError
+	require.ErrorAs(t, err, &pe)
+	assert.Equal(t, ErrResolve, pe.Code)
+}
+
+func TestResolveClusterNameFlag(t *testing.T) {
+	// --cluster-name resolves to an ID via the Clusters API, then behaves like
+	// --cluster-id: source=cluster, the resolved ID is reported, and the env key
+	// derives from the resolved cluster's Spark version.
+	c := stubCompute{byNameID: "cid-123", byNameVersion: "15.4.x-scala2.12"}
+	ti, err := ResolveCompute(t.Context(), ComputeFlags{ClusterName: "my-cluster"}, c, BundleTarget{})
+	require.NoError(t, err)
+	assert.Equal(t, "cluster", ti.Source)
+	assert.Equal(t, "cid-123", ti.ClusterID)
+	assert.Equal(t, "15.4.x-scala2.12", ti.SparkVersion)
+	assert.Equal(t, "dbr/15.4.x-scala2.12", ti.EnvKey)
+}
+
+func TestResolveClusterNameFlagError(t *testing.T) {
+	// An unknown or ambiguous name surfaces as E_RESOLVE.
+	c := stubCompute{byNameErr: errors.New("there are 2 instances of ClusterDetails named 'dup'")}
+	_, err := ResolveCompute(t.Context(), ComputeFlags{ClusterName: "dup"}, c, BundleTarget{})
+	var pe *PipelineError
+	require.ErrorAs(t, err, &pe)
+	assert.Equal(t, ErrResolve, pe.Code)
+}
+
+func TestResolveClusterIdAndNameMutuallyExclusive(t *testing.T) {
+	// The library path rejects setting both --cluster-id and --cluster-name.
+	_, err := ResolveCompute(t.Context(), ComputeFlags{Cluster: "abc", ClusterName: "xyz"}, stubCompute{}, BundleTarget{})
+	var pe *PipelineError
+	require.ErrorAs(t, err, &pe)
+	assert.Equal(t, ErrResolve, pe.Code)
+}
+
+func TestResolveBundleNothingSelected(t *testing.T) {
+	_, err := ResolveCompute(t.Context(), ComputeFlags{}, stubCompute{}, BundleTarget{Selected: false})
+	var pe *PipelineError
+	require.ErrorAs(t, err, &pe)
+	assert.Equal(t, ErrNoTarget, pe.Code)
+}
+
+func TestResolveBundleServerless(t *testing.T) {
+	// The bundle records serverless but no version, so the default stand-in applies.
+	ti, err := ResolveCompute(t.Context(), ComputeFlags{}, stubCompute{}, BundleTarget{Selected: true, Serverless: true})
+	require.NoError(t, err)
+	assert.Equal(t, "bundle", ti.Source)
+	// Concrete literal, not "serverless-"+defaultServerlessVersion: the default
+	// is v5, and asserting the constant against itself would pass for any value.
+	assert.Equal(t, "serverless/serverless-v5", ti.EnvKey)
+}
+
+// jobStubCompute stubs JobTaskEnvironment. It records the jobID and taskKey it
+// was called with (so tests can assert the "<job-id>.<task-key>" split) and
+// returns configurable results, including an error for the bare-job / unknown-key
+// paths. The sparkVersion/version fields are distinct so the classic branch can
+// be checked against the contract (it must use the Spark-version return).
+type jobStubCompute struct {
+	sparkVersion string
+	isServerless bool
+	version      string
+	err          error
+
+	gotJobID   string
+	gotTaskKey string
+}
+
+func (*jobStubCompute) GetClusterSparkVersion(_ context.Context, _ string) (string, error) {
+	return "", nil
+}
+
+func (*jobStubCompute) GetClusterByName(_ context.Context, _ string) (string, string, error) {
+	return "", "", nil
+}
+
+func (s *jobStubCompute) JobTaskEnvironment(_ context.Context, jobID, taskKey string) (string, bool, string, error) {
+	s.gotJobID = jobID
+	s.gotTaskKey = taskKey
+	if s.err != nil {
+		return "", false, "", s.err
+	}
+	return s.sparkVersion, s.isServerless, s.version, nil
+}
+
+func TestResolveJobTaskClassicUsesSparkVersion(t *testing.T) {
+	// A classic task resolves to its cluster's Spark version → dbr/ env key.
+	c := &jobStubCompute{sparkVersion: "15.4.x-scala2.12"}
+	ti, err := ResolveCompute(t.Context(), ComputeFlags{JobTask: "42.ingest"}, c, BundleTarget{})
+	require.NoError(t, err)
+	assert.Equal(t, "job", ti.Source)
+	assert.Equal(t, "15.4.x-scala2.12", ti.SparkVersion)
+	assert.Equal(t, "dbr/15.4.x-scala2.12", ti.EnvKey)
+	// The value is split on the first dot into job ID and task key.
+	assert.Equal(t, "42", c.gotJobID)
+	assert.Equal(t, "ingest", c.gotTaskKey)
+}
+
+func TestResolveJobTaskSplitsOnFirstDot(t *testing.T) {
+	// Task keys may themselves contain dots, so only the first dot separates the
+	// job ID from the task key.
+	c := &jobStubCompute{sparkVersion: "15.4.x-scala2.12"}
+	_, err := ResolveCompute(t.Context(), ComputeFlags{JobTask: "42.a.b.c"}, c, BundleTarget{})
+	require.NoError(t, err)
+	assert.Equal(t, "42", c.gotJobID)
+	assert.Equal(t, "a.b.c", c.gotTaskKey)
+}
+
+func TestResolveJobTaskServerlessUsesTaskVersion(t *testing.T) {
+	// A serverless task's environment version is read directly (no fallback):
+	// it maps to the matching serverless-vN, not the classic dbr path.
+	c := &jobStubCompute{isServerless: true, version: "3"}
+	ti, err := ResolveCompute(t.Context(), ComputeFlags{JobTask: "42.transform"}, c, BundleTarget{})
+	require.NoError(t, err)
+	assert.Equal(t, "job", ti.Source)
+	assert.Empty(t, ti.SparkVersion)
+	assert.Equal(t, "serverless/serverless-v3", ti.EnvKey)
+}
+
+func TestResolveJobTaskMissingKeyIsUsageError(t *testing.T) {
+	// A bare "<job-id>" (no task key) is E_USAGE, not E_RESOLVE: the user must
+	// pick a task. The stub reports the enumerate request via ErrTaskKeyRequired.
+	c := &jobStubCompute{err: &ErrTaskKeyRequired{JobID: "42", TaskKeys: []string{"ingest", "transform"}}}
+	_, err := ResolveCompute(t.Context(), ComputeFlags{JobTask: "42"}, c, BundleTarget{})
+	var pe *PipelineError
+	require.ErrorAs(t, err, &pe)
+	assert.Equal(t, ErrUsage, pe.Code)
+	assert.Empty(t, c.gotTaskKey, "a bare job ID yields an empty task key")
+}
+
+func TestResolveJobTaskUnknownKeyIsResolveError(t *testing.T) {
+	// An unknown task key is a genuine resolve failure (E_RESOLVE), distinct from
+	// the missing-key usage error above.
+	c := &jobStubCompute{err: errors.New(`job 42 has no task "nope" (available: ingest)`)}
+	_, err := ResolveCompute(t.Context(), ComputeFlags{JobTask: "42.nope"}, c, BundleTarget{})
+	var pe *PipelineError
+	require.ErrorAs(t, err, &pe)
+	assert.Equal(t, ErrResolve, pe.Code)
+}
+
+func TestValidateComputeFlagsMutuallyExclusive(t *testing.T) {
+	assert.Error(t, ValidateComputeFlags(ComputeFlags{Cluster: "a", Serverless: "v4"}))
+	assert.NoError(t, ValidateComputeFlags(ComputeFlags{Cluster: "a"}))
+}
+
+func TestResolveComputeRejectsConflictingFlags(t *testing.T) {
+	// ResolveCompute must reject incompatible flags rather than silently taking
+	// the first precedence branch, so a library caller bypassing Cobra can't
+	// resolve a different target than it asked for.
+	_, err := ResolveCompute(t.Context(), ComputeFlags{Cluster: "c", Serverless: "v4"}, stubCompute{}, BundleTarget{})
+	var pe *PipelineError
+	require.ErrorAs(t, err, &pe)
+	assert.Equal(t, ErrResolve, pe.Code)
+}
diff --git a/libs/localenv/constraints.go b/libs/localenv/constraints.go
new file mode 100644
index 00000000000..29c66134ad6
--- /dev/null
+++ b/libs/localenv/constraints.go
@@ -0,0 +1,296 @@
+package localenv
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"time"
+
+	"github.com/BurntSushi/toml"
+	"github.com/databricks/cli/libs/atomicfile"
+	"github.com/databricks/cli/libs/env"
+	"github.com/databricks/cli/libs/log"
+)
+
+// EnvConstraintSourceURLTestOverride names the environment variable that
+// overrides the constraint source with a full base URL. It exists so tests can
+// point the fetch at a local server (see the acceptance suite) and for power-user
+// debugging; normal runs use defaultConstraintBaseURL. The TEST_OVERRIDE naming
+// signals it is not a supported user-facing knob.
+const EnvConstraintSourceURLTestOverride = "DATABRICKS_LOCALENV_CONSTRAINT_SOURCE_URL_TEST_OVERRIDE"
+
+// defaultConstraintBaseURL is the base URL of the published constraint artifacts.
+//
+// The databricks/environments repo nests its language ecosystems under a
+// top-level directory, so the Python artifacts live at python/<env key>/
+// pyproject.toml (e.g. python/serverless/serverless-v5, python/dbr/<spark>),
+// not at the repo root. The base URL is anchored at that python/ subtree so an
+// env key of "serverless/serverless-v5" resolves to the real path.
+const defaultConstraintBaseURL = "https://raw.githubusercontent.com/databricks/environments/main/python"
+
+// ConstraintBaseURL returns the base URL for constraint artifacts: the
+// EnvConstraintSourceURLTestOverride value when set (a full base URL), otherwise
+// the built-in defaultConstraintBaseURL.
+func ConstraintBaseURL(ctx context.Context) string {
+	if v, ok := env.Lookup(ctx, EnvConstraintSourceURLTestOverride); ok && strings.TrimSpace(v) != "" {
+		return strings.TrimSpace(v)
+	}
+	return defaultConstraintBaseURL
+}
+
+// errEnvKeyNotFound is returned by fetchURL when the constraint artifact does
+// not exist for the requested env key (HTTP 404). It is distinct from a
+// transport failure so FetchConstraints can classify it as E_ENV_UNSUPPORTED
+// (a resolvable target with no published environment) rather than E_FETCH.
+var errEnvKeyNotFound = errors.New("environment key not found")
+
+// maxConstraintBytes caps the constraint artifact read. The body is untrusted
+// remote content and a pyproject.toml is small; 1 MiB is far above any real
+// artifact while preventing a misbehaving or hostile host from exhausting memory.
+const maxConstraintBytes int64 = 1 << 20
+
+// constraintHTTPClient fetches constraint artifacts with an explicit timeout, so
+// the request is bounded even when the caller's context has no deadline.
+var constraintHTTPClient = &http.Client{Timeout: 30 * time.Second}
+
+// Constraints holds the parsed contents of a per-environment pyproject.toml.
+type Constraints struct {
+	// EnvKey is the environment key used to look up the constraints.
+	EnvKey string
+	// SourceURL is the URL from which the constraints were fetched.
+	SourceURL string
+	// FromCache is true when the data came from the on-disk cache rather than a live fetch.
+	FromCache bool
+	// RequiresPython is the PEP 440 python version specifier from [project].requires-python.
+	RequiresPython string
+	// DatabricksConnect is the full dependency string for databricks-connect from [dependency-groups].dev.
+	DatabricksConnect string
+	// ConstraintDeps is the list of entries from [tool.uv].constraint-dependencies.
+	ConstraintDeps []string
+	// EnvironmentVersion is the serverless environment version written into
+	// [tool.databricks.environment].environment_version (e.g. "5"). It is not
+	// parsed from the artifact but set by the pipeline from the resolved compute
+	// target; it is empty for cluster targets, where the section is not managed.
+	EnvironmentVersion string
+}
+
+// cacheFileName maps an env key to a single, collision-free cache filename.
+// It keeps a readable slug (path separators flattened to double-underscores so
+// the file stays inside cacheDir on every OS) and appends a short hash of the
+// raw env key. The hash guarantees injectivity: distinct env keys that would
+// otherwise flatten to the same slug (e.g. "a/b" and "a__b") get distinct
+// filenames, so a cache hit can never serve another environment's constraints.
+func cacheFileName(envKey string) string {
+	slug := strings.ReplaceAll(envKey, "/", "__")
+	slug = strings.ReplaceAll(slug, "\\", "__")
+	sum := sha256.Sum256([]byte(envKey))
+	return fmt.Sprintf("%s-%s.toml", slug, hex.EncodeToString(sum[:8]))
+}
+
+// FetchConstraints fetches the pyproject.toml for envKey from baseURL and caches it in
+// cacheDir. On a transport or non-404 HTTP failure it falls back to the cached copy if one
+// exists (E_FETCH otherwise). A 404 means the env key is not published (E_ENV_UNSUPPORTED)
+// and does not fall back to cache — a resolvable target with no environment is a distinct,
+// non-transient condition.
+//
+// baseURL points at the base of the constraint artifacts (see ConstraintBaseURL).
+//
+// writeCache controls whether a successful live fetch populates the on-disk
+// cache. Callers pass false for a dry run (--dry-run), which must not mutate
+// disk; an existing cache is still read for offline fallback, since reading is
+// not a mutation.
+func FetchConstraints(ctx context.Context, baseURL, envKey, cacheDir string, writeCache bool) (*Constraints, error) {
+	if baseURL == "" {
+		// ConstraintBaseURL always returns a non-empty default, so an empty baseURL
+		// here means the resolver was bypassed. Report it at the fetch phase so it
+		// still flows through the same phase/JSON reporting as any other fetch error.
+		return nil, NewError(ErrFetch, nil, "no constraint source configured")
+	}
+	url := baseURL + "/" + envKey + "/pyproject.toml"
+	cachePath := filepath.Join(cacheDir, cacheFileName(envKey))
+
+	data, fetchErr := fetchURL(ctx, url)
+	if fetchErr == nil {
+		// Parse before caching: a malformed 2xx body must not overwrite a valid
+		// cached copy, or a later transport-failure run would serve the poisoned
+		// cache and fail to parse instead of falling back to the last-good file.
+		rp, dbc, deps, err := parseConstraints(data)
+		if err != nil {
+			return nil, fmt.Errorf("parse constraints for %s: %w", envKey, err)
+		}
+		// Write the cache copy (creating cacheDir if needed, atomically); non-fatal
+		// so a read-only cacheDir doesn't break the command. Skipped under a dry
+		// run so --dry-run performs no disk writes at all.
+		if writeCache {
+			if err := atomicfile.Write(cachePath, data, 0o600, atomicfile.MkDir(0o755)); err != nil {
+				log.Debugf(ctx, "failed to write constraint cache %s: %v", filepath.ToSlash(cachePath), err)
+			}
+		}
+		return &Constraints{
+			EnvKey:            envKey,
+			SourceURL:         url,
+			FromCache:         false,
+			RequiresPython:    rp,
+			DatabricksConnect: dbc,
+			ConstraintDeps:    deps,
+		}, nil
+	}
+
+	// A missing env key (404) is not a transport failure and has no useful cache
+	// fallback: the target resolved to an environment that isn't published.
+	if errors.Is(fetchErr, errEnvKeyNotFound) {
+		return nil, NewError(ErrEnvUnsupported, fetchErr,
+			"no published environment for %q. If this is a new runtime, try the latest LTS target (e.g. --serverless-version 5 or a supported --cluster-id DBR)", envKey)
+	}
+
+	// Network or HTTP failure: attempt to serve from cache.
+	cached, readErr := os.ReadFile(cachePath)
+	if readErr != nil {
+		return nil, NewError(ErrFetch, fetchErr, "fetch constraints for %s", envKey)
+	}
+
+	log.Warnf(ctx, "constraint fetch failed, using cached copy: %v", fetchErr)
+	rp, dbc, deps, err := parseConstraints(cached)
+	if err != nil {
+		return nil, fmt.Errorf("parse cached constraints for %s: %w", envKey, err)
+	}
+	return &Constraints{
+		EnvKey:            envKey,
+		SourceURL:         url,
+		FromCache:         true,
+		RequiresPython:    rp,
+		DatabricksConnect: dbc,
+		ConstraintDeps:    deps,
+	}, nil
+}
+
+// fetchURL performs an HTTP GET and returns the body bytes, or an error on non-2xx or transport failure.
+func fetchURL(ctx context.Context, url string) ([]byte, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	if err != nil {
+		return nil, fmt.Errorf("build request for %s: %w", url, err)
+	}
+	// Use a client with an explicit timeout rather than http.DefaultClient, which
+	// has none: the fetch of remote content must be bounded even if the caller's
+	// context carries no deadline.
+	resp, err := constraintHTTPClient.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("GET %s: %w", url, err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode == http.StatusNotFound {
+		return nil, fmt.Errorf("GET %s: %w", url, errEnvKeyNotFound)
+	}
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return nil, fmt.Errorf("GET %s: unexpected status %s", url, resp.Status)
+	}
+	// Cap the read: the body is untrusted remote content and a pyproject.toml is
+	// small, so an oversized (or hostile) response must not be read into memory
+	// unbounded. Read one byte past the cap to detect an over-limit body.
+	data, err := io.ReadAll(io.LimitReader(resp.Body, maxConstraintBytes+1))
+	if err != nil {
+		return nil, fmt.Errorf("read body from %s: %w", url, err)
+	}
+	if int64(len(data)) > maxConstraintBytes {
+		return nil, fmt.Errorf("constraint artifact from %s exceeds %d bytes", url, maxConstraintBytes)
+	}
+	return data, nil
+}
+
+// pyprojectTOML mirrors the pyproject.toml fields we care about.
+type pyprojectTOML struct {
+	Project struct {
+		RequiresPython string `toml:"requires-python"`
+	} `toml:"project"`
+	DependencyGroups struct {
+		Dev []string `toml:"dev"`
+	} `toml:"dependency-groups"`
+	Tool struct {
+		UV struct {
+			ConstraintDependencies []string `toml:"constraint-dependencies"`
+		} `toml:"uv"`
+	} `toml:"tool"`
+}
+
+// parseConstraints parses a pyproject.toml byte slice and extracts requires-python,
+// the databricks-connect entry from dependency-groups.dev, and constraint-dependencies.
+// A body that is valid TOML but carries no requires-python is rejected: it is not a
+// usable constraint artifact, and silently accepting it would cache an empty result
+// and only surface a confusing failure later in the pipeline.
+func parseConstraints(data []byte) (requiresPython, dbconnect string, deps []string, err error) {
+	var p pyprojectTOML
+	if err = toml.Unmarshal(data, &p); err != nil {
+		return "", "", nil, fmt.Errorf("unmarshal pyproject.toml: %w", err)
+	}
+
+	requiresPython = p.Project.RequiresPython
+	if strings.TrimSpace(requiresPython) == "" {
+		return "", "", nil, errors.New("constraint artifact has no [project].requires-python")
+	}
+	// Reject a requires-python that is present but yields no installable floor
+	// (e.g. ">=3", "<3.13", "*") here, before the body is cached. This is the
+	// same check the pipeline applies later; running it in the pre-cache guard
+	// ensures an unusable 2xx body cannot overwrite a valid cached copy and
+	// break offline fallback, which is the guard's stated purpose.
+	if _, err = PythonMinorFromRequires(requiresPython); err != nil {
+		return "", "", nil, fmt.Errorf("constraint artifact has an unusable [project].requires-python: %w", err)
+	}
+
+	for _, entry := range p.DependencyGroups.Dev {
+		if isDatabricksConnectDep(entry) {
+			dbconnect = entry
+			break
+		}
+	}
+
+	// A missing [tool.uv].constraint-dependencies yields a nil slice, which the
+	// merge treats identically to an empty one (an empty managed block). Whether
+	// the constraint region is managed at all is decided by the --no-constraints
+	// flag, threaded explicitly, not by the shape of this value.
+	return requiresPython, dbconnect, p.Tool.UV.ConstraintDependencies, nil
+}
+
+// depNameSepRe matches the first PEP 508 delimiter that ends a requirement's
+// package name: a version specifier, extra, marker, url, or list separator.
+var depNameSepRe = regexp.MustCompile(`[<>=!~;,@\[( \t]`)
+
+// isDepNamed reports whether a dependency-group entry names the package normalizedName
+// (which the caller passes already PEP 503-normalized). It extracts the leading package
+// name (up to the first PEP 508 delimiter) and compares it under PEP 503 normalization,
+// so case and runs of "-", "_", or "." are all treated as equivalent: for
+// "databricks-connect", "Databricks-Connect", "databricks_connect", and
+// "databricks.connect" all match, while a distinct package like "databricks-connectors"
+// does not.
+func isDepNamed(entry, normalizedName string) bool {
+	name := strings.TrimSpace(entry)
+	if i := depNameSepRe.FindStringIndex(name); i != nil {
+		name = name[:i[0]]
+	}
+	return normalizePackageName(name) == normalizedName
+}
+
+// isDatabricksConnectDep reports whether a dependency-group entry is the
+// databricks-connect requirement.
+func isDatabricksConnectDep(entry string) bool { return isDepNamed(entry, "databricks-connect") }
+
+// isPysparkDep reports whether a dependency-group entry is the standalone pyspark
+// requirement. It matches "pyspark" exactly and not a distinct package such as
+// "pyspark-stubs".
+func isPysparkDep(entry string) bool { return isDepNamed(entry, "pyspark") }
+
+// pep503SepRe matches runs of "-", "_", or "." for PEP 503 name normalization.
+var pep503SepRe = regexp.MustCompile(`[-_.]+`)
+
+// normalizePackageName applies PEP 503 normalization: lowercase and collapse any
+// run of "-", "_", or "." to a single "-".
+func normalizePackageName(name string) string {
+	return pep503SepRe.ReplaceAllString(strings.ToLower(strings.TrimSpace(name)), "-")
+}
diff --git a/libs/localenv/constraints_test.go b/libs/localenv/constraints_test.go
new file mode 100644
index 00000000000..65395317dd2
--- /dev/null
+++ b/libs/localenv/constraints_test.go
@@ -0,0 +1,276 @@
+package localenv
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/databricks/cli/libs/env"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestConstraintBaseURL(t *testing.T) {
+	// With nothing set it returns the built-in default, anchored at the python/
+	// subtree of databricks/environments where the Python artifacts live.
+	assert.Equal(t, "https://raw.githubusercontent.com/databricks/environments/main/python", ConstraintBaseURL(t.Context()))
+
+	// The override env var supplies a full base URL verbatim.
+	ctx := env.Set(t.Context(), EnvConstraintSourceURLTestOverride, "http://localhost:8477")
+	assert.Equal(t, "http://localhost:8477", ConstraintBaseURL(ctx))
+
+	// Whitespace-only is treated as unset and falls back to the default.
+	ctx = env.Set(t.Context(), EnvConstraintSourceURLTestOverride, "  ")
+	assert.Equal(t, "https://raw.githubusercontent.com/databricks/environments/main/python", ConstraintBaseURL(ctx))
+}
+
+func TestFetchConstraintsNoSourceConfigured(t *testing.T) {
+	// An empty base URL should never reach FetchConstraints (ConstraintBaseURL
+	// always returns a non-empty default), but if it does it must classify as
+	// E_FETCH so it surfaces at the fetch phase rather than as a bare error.
+	_, err := FetchConstraints(t.Context(), "", "serverless/serverless-v4", t.TempDir(), true)
+	var pe *PipelineError
+	require.ErrorAs(t, err, &pe)
+	assert.Equal(t, ErrFetch, pe.Code)
+}
+
+const sampleToml = `[project]
+requires-python = "==3.12.*"
+
+[dependency-groups]
+dev = [
+    "databricks-connect~=17.2.0",
+    "pytest~=8.0",
+]
+
+[tool.uv]
+constraint-dependencies = [
+    "pydantic~=2.10.6",
+    "anyio~=4.6.2",
+]
+`
+
+func TestParseConstraints(t *testing.T) {
+	rp, dbc, deps, err := parseConstraints([]byte(sampleToml))
+	require.NoError(t, err)
+	assert.Equal(t, "==3.12.*", rp)
+	assert.Equal(t, "databricks-connect~=17.2.0", dbc)
+	assert.Equal(t, []string{"pydantic~=2.10.6", "anyio~=4.6.2"}, deps)
+}
+
+func TestParseConstraintsRejectsMissingRequiresPython(t *testing.T) {
+	// Valid TOML but no requires-python is not a usable artifact; it must error
+	// rather than return an empty result that would be cached and fail later.
+	_, _, _, err := parseConstraints([]byte("[project]\nname = \"x\"\n"))
+	require.Error(t, err)
+}
+
+func TestParseConstraintsDatabricksConnectNameBoundary(t *testing.T) {
+	// A sibling package whose name merely starts with "databricks-connect" must
+	// not be mistaken for the databricks-connect requirement.
+	toml := `[project]
+requires-python = ">=3.10"
+
+[dependency-groups]
+dev = [
+    "databricks-connectors==1.0",
+    "databricks-connect~=17.2.0",
+]
+`
+	_, dbc, _, err := parseConstraints([]byte(toml))
+	require.NoError(t, err)
+	assert.Equal(t, "databricks-connect~=17.2.0", dbc)
+}
+
+func TestParseConstraintsDatabricksConnectPEP503(t *testing.T) {
+	// PEP 503: package names are case-insensitive and runs of -, _, . are
+	// equivalent. Every spelling of databricks-connect must be detected, with the
+	// original entry preserved verbatim in the result.
+	for _, entry := range []string{
+		"Databricks-Connect==16.4.0",
+		"databricks_connect==16.4.0",
+		"databricks.connect==16.4.0",
+		"databricks-connect ~= 17.2",
+	} {
+		toml := "[project]\nrequires-python = \">=3.10\"\n\n[dependency-groups]\ndev = [\"" + entry + "\"]\n"
+		_, dbc, _, err := parseConstraints([]byte(toml))
+		require.NoError(t, err, entry)
+		assert.Equal(t, entry, dbc, "entry %q", entry)
+	}
+	// A distinct sibling package must NOT match.
+	toml := "[project]\nrequires-python = \">=3.10\"\n\n[dependency-groups]\ndev = [\"databricks-connectors==1.0\"]\n"
+	_, dbc, _, err := parseConstraints([]byte(toml))
+	require.NoError(t, err)
+	assert.Empty(t, dbc)
+}
+
+func TestFetchConstraintsCreatesCacheDir(t *testing.T) {
+	// The cache directory may not exist yet on a fresh machine; the fetch must
+	// create it so the cache actually populates (and offline fallback works).
+	cacheDir := filepath.Join(t.TempDir(), "does", "not", "exist", "yet")
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte(sampleToml))
+	}))
+	defer srv.Close()
+
+	_, err := FetchConstraints(t.Context(), srv.URL, "serverless/serverless-v4", cacheDir, true)
+	require.NoError(t, err)
+	// The cache file was written into the freshly created directory.
+	written, err := os.ReadFile(filepath.Join(cacheDir, cacheFileName("serverless/serverless-v4")))
+	require.NoError(t, err)
+	assert.Equal(t, sampleToml, string(written))
+}
+
+func TestFetchConstraintsSkipsCacheWriteWhenDisabled(t *testing.T) {
+	// With writeCache=false (the --dry-run dry-run path), a successful live fetch
+	// must not write anything to cacheDir.
+	cacheDir := t.TempDir()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte(sampleToml))
+	}))
+	defer srv.Close()
+
+	c, err := FetchConstraints(t.Context(), srv.URL, "serverless/serverless-v4", cacheDir, false)
+	require.NoError(t, err)
+	assert.False(t, c.FromCache)
+	entries, err := os.ReadDir(cacheDir)
+	require.NoError(t, err)
+	assert.Empty(t, entries, "no cache file should be written under --dry-run")
+}
+
+func TestCacheFileNameInjective(t *testing.T) {
+	// Distinct env keys that flatten to the same slug must not collide, so a
+	// cache hit can never serve another environment's constraints.
+	assert.NotEqual(t, cacheFileName("a/b"), cacheFileName("a__b"))
+	// The filename stays inside cacheDir (no separators leak through).
+	assert.NotContains(t, cacheFileName("a/b"), "/")
+	assert.NotContains(t, cacheFileName("a\\b"), "\\")
+}
+
+func TestFetchConstraintsHTTP(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "/serverless/serverless-v4/pyproject.toml", r.URL.Path)
+		_, _ = w.Write([]byte(sampleToml))
+	}))
+	defer srv.Close()
+
+	c, err := FetchConstraints(t.Context(), srv.URL, "serverless/serverless-v4", t.TempDir(), true)
+	require.NoError(t, err)
+	assert.False(t, c.FromCache)
+	assert.Equal(t, "databricks-connect~=17.2.0", c.DatabricksConnect)
+	assert.Len(t, c.ConstraintDeps, 2)
+}
+
+func TestFetchConstraintsEnvKeyNotFound(t *testing.T) {
+	// A 404 for a resolved env key means the environment is not published; this
+	// must classify as E_ENV_UNSUPPORTED, not E_FETCH, and not fall back to cache.
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Error(w, "not found", http.StatusNotFound)
+	}))
+	defer srv.Close()
+
+	_, err := FetchConstraints(t.Context(), srv.URL, "dbr/99.9.x-scala2.12", t.TempDir(), true)
+	var pe *PipelineError
+	require.ErrorAs(t, err, &pe)
+	assert.Equal(t, ErrEnvUnsupported, pe.Code)
+}
+
+func TestFetchConstraintsTransportFailureNoCache(t *testing.T) {
+	// A transport failure with no cache classifies as E_FETCH.
+	down := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {}))
+	url := down.URL
+	down.Close()
+
+	_, err := FetchConstraints(t.Context(), url, "serverless/serverless-v4", t.TempDir(), true)
+	var pe *PipelineError
+	require.ErrorAs(t, err, &pe)
+	assert.Equal(t, ErrFetch, pe.Code)
+}
+
+func TestFetchConstraintsRejectsOversizedBody(t *testing.T) {
+	// An over-cap response body must be rejected (classified E_FETCH here, with no
+	// cache to fall back to) rather than read unbounded into memory.
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		big := strings.Repeat("x", int(maxConstraintBytes)+100)
+		_, _ = w.Write([]byte(big))
+	}))
+	defer srv.Close()
+
+	_, err := FetchConstraints(t.Context(), srv.URL, "serverless/serverless-v4", t.TempDir(), true)
+	var pe *PipelineError
+	require.ErrorAs(t, err, &pe)
+	assert.Equal(t, ErrFetch, pe.Code)
+}
+
+func TestFetchConstraintsFallsBackToCache(t *testing.T) {
+	cacheDir := t.TempDir()
+	// First, a successful fetch populates the cache.
+	good := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte(sampleToml))
+	}))
+	_, err := FetchConstraints(t.Context(), good.URL, "serverless/serverless-v4", cacheDir, true)
+	require.NoError(t, err)
+	good.Close()
+
+	// Now the server is down; fetch must serve the cache.
+	c, err := FetchConstraints(t.Context(), good.URL, "serverless/serverless-v4", cacheDir, true)
+	require.NoError(t, err)
+	assert.True(t, c.FromCache)
+}
+
+func TestParseConstraintsRejectsUnusableRequiresPython(t *testing.T) {
+	// requires-python present but with no installable floor is not a usable
+	// artifact; it must be rejected before caching (not only later in the
+	// pipeline) so it cannot poison the cache.
+	for _, rp := range []string{">=3", "<3.13", "!=3.12", "*", ">3"} {
+		toml := "[project]\nrequires-python = \"" + rp + "\"\n"
+		_, _, _, err := parseConstraints([]byte(toml))
+		require.Error(t, err, "requires-python %q should be rejected", rp)
+		assert.Contains(t, err.Error(), "unusable")
+	}
+}
+
+func TestFetchConstraintsUnusableBodyDoesNotPoisonCache(t *testing.T) {
+	// A good artifact populates the cache; a later 2xx body that is valid TOML but
+	// carries an unusable requires-python must NOT overwrite the last-good copy,
+	// so an offline run still recovers via the cache. This is the guard's purpose.
+	cacheDir := t.TempDir()
+	good := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte(sampleToml))
+	}))
+	defer good.Close()
+	_, err := FetchConstraints(t.Context(), good.URL, "serverless/serverless-v4", cacheDir, true)
+	require.NoError(t, err)
+
+	// The repo now publishes a TOML-valid but unusable body (no installable floor).
+	bad := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte("[project]\nrequires-python = \">=3\"\n"))
+	}))
+	defer bad.Close()
+	_, err = FetchConstraints(t.Context(), bad.URL, "serverless/serverless-v4", cacheDir, true)
+	require.Error(t, err)
+
+	// The cache still holds the last-good copy: an offline fetch recovers it.
+	c, err := FetchConstraints(t.Context(), "http://127.0.0.1:0", "serverless/serverless-v4", cacheDir, true)
+	require.NoError(t, err)
+	assert.True(t, c.FromCache)
+	assert.Equal(t, "==3.12.*", c.RequiresPython)
+}
+
+func TestParseConstraintsMissingConstraintDepsIsValid(t *testing.T) {
+	// An artifact without [tool.uv].constraint-dependencies is valid; the parsed
+	// slice is empty. Its nil-vs-empty shape carries no meaning — whether the
+	// constraint region is managed is decided by the --no-constraints flag, threaded
+	// explicitly, so the merge treats nil and empty identically.
+	_, _, deps, err := parseConstraints([]byte(`[project]
+requires-python = ">=3.12"
+
+[dependency-groups]
+dev = ["databricks-connect~=17.2.0"]
+`))
+	require.NoError(t, err)
+	assert.Empty(t, deps)
+}
diff --git a/libs/localenv/detect.go b/libs/localenv/detect.go
new file mode 100644
index 00000000000..8c58c19ec43
--- /dev/null
+++ b/libs/localenv/detect.go
@@ -0,0 +1,84 @@
+package localenv
+
+import (
+	"os"
+	"path/filepath"
+)
+
+// pyprojectFile is the project file this command reads, merges, and writes; it
+// is also the marker detectManager keys on to bias detection toward uv.
+const pyprojectFile = "pyproject.toml"
+
+// manager identifies the Python package manager a project uses. P0 only
+// supports uv; every other value results in a clean E_MANAGER_UNSUPPORTED exit.
+type manager string
+
+const (
+	managerUv    manager = "uv"
+	managerConda manager = "conda"
+	managerPip   manager = "pip"
+)
+
+// detectManager inspects projectDir for package-manager markers, only deep
+// enough to branch uv vs. not-uv (spec §5). It emits no telemetry (spec §5).
+//
+// Detection is deliberately biased toward uv, because uv's native project file
+// is pyproject.toml (PEP 621) — the same format this command writes and merges:
+//   - A uv marker (uv.lock or a [tool.uv] table) → uv.
+//   - A pyproject.toml with no competing marker → uv (a plain PEP 621 project is
+//     exactly the "existing project merge" case; uv can drive it).
+//   - conda (environment.yml) or pip (requirements.txt) with no pyproject.toml →
+//     that manager; automated setup is P1, so the caller exits cleanly.
+//   - Greenfield (no markers at all) → uv, the manager this command provisions.
+//
+// A conda/pip marker that sits alongside a pyproject.toml still resolves to uv:
+// the project already has the file we drive, so we proceed rather than block.
+func detectManager(projectDir string) manager {
+	// uv markers take precedence: an existing uv project or lockfile.
+	if fileExists(filepath.Join(projectDir, "uv.lock")) {
+		return managerUv
+	}
+	if fileExists(filepath.Join(projectDir, pyprojectFile)) {
+		// A pyproject.toml — with or without a [tool.uv] table — is uv-drivable.
+		return managerUv
+	}
+
+	// No pyproject.toml: a conda or pip marker means a non-uv project we cannot
+	// yet automate. conda before pip (environment.yml is the more specific signal).
+	if fileExists(filepath.Join(projectDir, "environment.yml")) ||
+		fileExists(filepath.Join(projectDir, "environment.yaml")) {
+		return managerConda
+	}
+	if fileExists(filepath.Join(projectDir, "requirements.txt")) {
+		return managerPip
+	}
+
+	// Greenfield: nothing to disambiguate; this command provisions uv.
+	return managerUv
+}
+
+// managerGuidance returns the actionable, non-blaming message shown when a
+// non-uv manager is detected (spec §5).
+func managerGuidance(m manager) string {
+	return "detected a " + string(m) + " project; automated setup for " + string(m) +
+		" is not yet available (P1). Use a uv project (add a pyproject.toml with a [tool.uv] table, or run `uv init`) to provision automatically"
+}
+
+// fileExists reports whether path exists and is a regular file.
+func fileExists(path string) bool {
+	info, err := os.Stat(path)
+	return err == nil && !info.IsDir()
+}
+
+// ensureWritable verifies the process can create files in dir by creating and
+// removing a temporary file. A permission failure is reported so preflight can
+// stop before any real write (invariant 1).
+func ensureWritable(dir string) error {
+	f, err := os.CreateTemp(dir, ".localenv-writecheck-*")
+	if err != nil {
+		return err
+	}
+	name := f.Name()
+	f.Close()
+	return os.Remove(name)
+}
diff --git a/libs/localenv/detect_test.go b/libs/localenv/detect_test.go
new file mode 100644
index 00000000000..45eb6655ee2
--- /dev/null
+++ b/libs/localenv/detect_test.go
@@ -0,0 +1,51 @@
+package localenv
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestDetectManager(t *testing.T) {
+	write := func(t *testing.T, files ...string) string {
+		dir := t.TempDir()
+		for _, f := range files {
+			require.NoError(t, os.WriteFile(filepath.Join(dir, f), []byte("x"), 0o644))
+		}
+		return dir
+	}
+
+	cases := []struct {
+		name  string
+		files []string
+		want  manager
+	}{
+		{"greenfield", nil, managerUv},
+		{"uv lock", []string{"uv.lock"}, managerUv},
+		{"plain pyproject", []string{"pyproject.toml"}, managerUv},
+		{"pyproject wins over requirements", []string{"pyproject.toml", "requirements.txt"}, managerUv},
+		{"conda only", []string{"environment.yml"}, managerConda},
+		{"conda yaml", []string{"environment.yaml"}, managerConda},
+		{"pip only", []string{"requirements.txt"}, managerPip},
+		{"conda before pip", []string{"environment.yml", "requirements.txt"}, managerConda},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, detectManager(write(t, tc.files...)))
+		})
+	}
+}
+
+func TestEnsureWritable(t *testing.T) {
+	assert.NoError(t, ensureWritable(t.TempDir()))
+	assert.Error(t, ensureWritable(filepath.Join(t.TempDir(), "does-not-exist")))
+}
+
+func TestManagerGuidance(t *testing.T) {
+	msg := managerGuidance(managerConda)
+	assert.Contains(t, msg, "conda")
+	assert.Contains(t, msg, "uv init")
+}
diff --git a/libs/localenv/envkey.go b/libs/localenv/envkey.go
new file mode 100644
index 00000000000..4e947b0c716
--- /dev/null
+++ b/libs/localenv/envkey.go
@@ -0,0 +1,107 @@
+package localenv
+
+import (
+	"fmt"
+	"regexp"
+	"strconv"
+	"strings"
+)
+
+// clauseRe splits a single requires-python clause into its operator (optional),
+// MAJOR.MINOR version, and an optional patch component. A clause with no operator
+// is a bare floor. The patch capture (group 4) is needed to interpret a strict
+// ">" correctly: ">3.10" excludes all of 3.10.x, but ">3.10.5" is still satisfied
+// by 3.10.6, so only the former bumps the minor.
+var clauseRe = regexp.MustCompile(`^(>=|<=|===|==|~=|!=|<|>)?\s*(\d+)\.(\d+)(\.\d+)?`)
+
+// defaultServerlessVersion is the serverless environment version used when the
+// source (a serverless job with no recorded version, or a bundle that only
+// records "serverless") does not pin one. It is a documented stand-in for the
+// latest LTS (spec §4.3 / §target-resolution); VS Code resolves the real version
+// itself and passes --serverless-version explicitly, so this fallback only
+// applies when the version is genuinely unknown.
+const defaultServerlessVersion = "5"
+
+// serverlessVersionRe matches an accepted --serverless-version input: a bare
+// number ("5", the documented form) or a "v"-prefixed one ("v5"/"V5").
+var serverlessVersionRe = regexp.MustCompile(`^[vV]?[0-9]+$`)
+
+// ValidServerlessVersion reports whether s is an accepted serverless version
+// input. It is validated at resolve time so a malformed value (e.g. "vv5", "v",
+// " 5") fails fast with an actionable error rather than resolving to a bogus
+// env key that only 404s two phases later at fetch.
+func ValidServerlessVersion(s string) bool {
+	return serverlessVersionRe.MatchString(s)
+}
+
+// NormalizeServerless returns the canonical "vN" spelling of a serverless
+// version. The documented input is a bare number ("5"), but a "v"-prefixed form
+// ("v5"/"V5") is also accepted; both map to the "serverless-vN" env key.
+// Callers should validate with ValidServerlessVersion first.
+func NormalizeServerless(version string) string {
+	return "v" + strings.TrimPrefix(strings.ToLower(version), "v")
+}
+
+// EnvKeyForServerless returns the environment key for a serverless version.
+func EnvKeyForServerless(version string) string {
+	return "serverless/serverless-" + NormalizeServerless(version)
+}
+
+// EnvKeyForSparkVersion returns the environment key for a Spark version.
+func EnvKeyForSparkVersion(sparkVersion string) string {
+	return "dbr/" + sparkVersion
+}
+
+// PythonMinorFromRequires parses a PEP 440 requires-python string and returns
+// the MAJOR.MINOR of the Python version to install: the effective lower bound.
+//
+// A requires-python is a comma-separated list of clauses in any order (e.g.
+// "<3.13,>=3.10"). Each clause is classified by operator:
+//   - lower-bound / pinning (>=, >, ==, ~=, ===) or a bare MAJOR.MINOR with no
+//     operator establishes a floor;
+//   - upper-bound / exclusion (<, <=, !=) does not — those versions are capped
+//     or forbidden and must never be installed.
+//
+// The result is the highest floor across all floor clauses (so ">=3.8,>=3.11"
+// yields 3.11, the version that satisfies every clause). A spec with no floor
+// clause at all (e.g. "<3.13" or "!=3.12") is an error rather than a guess.
+func PythonMinorFromRequires(requiresPython string) (string, error) {
+	bestMajor, bestMinor := -1, -1
+	sawClause := false
+	for clause := range strings.SplitSeq(requiresPython, ",") {
+		clause = strings.TrimSpace(clause)
+		if clause == "" {
+			continue
+		}
+		m := clauseRe.FindStringSubmatch(clause)
+		if m == nil {
+			continue
+		}
+		sawClause = true
+		op := m[1]
+		// Upper-bound and exclusion operators never establish a floor.
+		if op == "<" || op == "<=" || op == "!=" {
+			continue
+		}
+		major, _ := strconv.Atoi(m[2])
+		minor, _ := strconv.Atoi(m[3])
+		hasPatch := m[4] != ""
+		// A strict ">" with no patch excludes the whole given minor series (PEP 440:
+		// ">3.10" matches neither 3.10 nor any 3.10.x), so the lowest installable
+		// minor is the next one up. But ">3.10.5" is still satisfied by 3.10.6, so a
+		// patch-qualified strict bound leaves the minor unchanged.
+		if op == ">" && !hasPatch {
+			minor++
+		}
+		if major > bestMajor || (major == bestMajor && minor > bestMinor) {
+			bestMajor, bestMinor = major, minor
+		}
+	}
+	if bestMajor >= 0 {
+		return fmt.Sprintf("%d.%d", bestMajor, bestMinor), nil
+	}
+	if sawClause {
+		return "", fmt.Errorf("requires-python %q has no lower bound to install from", requiresPython)
+	}
+	return "", fmt.Errorf("cannot parse python version from %q", requiresPython)
+}
diff --git a/libs/localenv/envkey_test.go b/libs/localenv/envkey_test.go
new file mode 100644
index 00000000000..c502cac57b4
--- /dev/null
+++ b/libs/localenv/envkey_test.go
@@ -0,0 +1,88 @@
+package localenv
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestEnvKeyForServerless(t *testing.T) {
+	// The documented input is a bare number; a "v"-prefixed form is also accepted.
+	// Both map to the "serverless-vN" env key.
+	for _, in := range []string{"4", "v4", "V4"} {
+		assert.Equal(t, "serverless/serverless-v4", EnvKeyForServerless(in))
+	}
+	for _, in := range []string{"5", "v5", "V5"} {
+		assert.Equal(t, "serverless/serverless-v5", EnvKeyForServerless(in))
+	}
+}
+
+func TestDefaultServerlessVersionIsBareNumber(t *testing.T) {
+	// The default stand-in is stored in the documented bare form; it still maps
+	// to the serverless-vN env key via NormalizeServerless.
+	assert.Equal(t, "5", defaultServerlessVersion)
+	assert.Equal(t, "serverless/serverless-v5", EnvKeyForServerless(defaultServerlessVersion))
+}
+
+func TestValidServerlessVersion(t *testing.T) {
+	for _, ok := range []string{"5", "4", "v5", "V5", "17", "0"} {
+		assert.True(t, ValidServerlessVersion(ok), "%q should be valid", ok)
+	}
+	for _, bad := range []string{"", "v", "vv5", "5x", "latest", " 5", "5 ", "v5.1", "-5"} {
+		assert.False(t, ValidServerlessVersion(bad), "%q should be invalid", bad)
+	}
+}
+
+func TestEnvKeyForSparkVersion(t *testing.T) {
+	assert.Equal(t, "dbr/15.4.x-scala2.12", EnvKeyForSparkVersion("15.4.x-scala2.12"))
+}
+
+func TestPythonMinorFromRequires(t *testing.T) {
+	cases := map[string]string{
+		"==3.12.*": "3.12",
+		">=3.12":   "3.12",
+		"==3.12.3": "3.12",
+		"~=3.11":   "3.11",
+		// Multi-clause specifiers: the lower bound is the version to install,
+		// regardless of clause order. Taking the first number would pick the
+		// excluded upper bound (e.g. 3.13 from "<3.13").
+		"<3.13,>=3.10":  "3.10",
+		">=3.10,<3.13":  "3.10",
+		">=3.10, <3.13": "3.10",
+		"<4.0,>=3.9":    "3.9",
+		"===3.11":       "3.11",
+		// The effective floor is the HIGHEST lower bound, regardless of order.
+		">=3.8,>=3.11": "3.11",
+		">=3.11,>=3.8": "3.11",
+		// A bare floor alongside an exclusion is still a floor.
+		"!=3.11,3.12":   "3.12",
+		"3.12,!=3.12.4": "3.12",
+		// Bare version with no operator.
+		"3.12": "3.12",
+		// Whitespace and patch components tolerated.
+		">= 3.10 , < 3.13": "3.10",
+		// Strict ">" with no patch excludes the whole minor series (PEP 440), so
+		// the floor is the next minor up.
+		">3.10":       "3.11",
+		">3.10,<3.13": "3.11",
+		">=3.9,>3.10": "3.11",
+		// Strict ">" WITH a patch does not exclude the minor series: 3.10.6
+		// satisfies ">3.10.5", so the floor stays 3.10.
+		">3.10.5":       "3.10",
+		">3.10.5,<3.13": "3.10",
+		">=3.10.2":      "3.10",
+	}
+	for in, want := range cases {
+		got, err := PythonMinorFromRequires(in)
+		require.NoError(t, err)
+		assert.Equal(t, want, got, "input %q", in)
+	}
+
+	// No usable floor: only upper-bound / exclusion clauses. Must error rather
+	// than select a forbidden/capped version.
+	for _, in := range []string{"<3.13", "<=3.12", "!=3.12", "<3.13,!=3.12", "garbage", ""} {
+		_, err := PythonMinorFromRequires(in)
+		assert.Error(t, err, "input %q must error", in)
+	}
+}
diff --git a/libs/localenv/main_test.go b/libs/localenv/main_test.go
new file mode 100644
index 00000000000..0eedb71d371
--- /dev/null
+++ b/libs/localenv/main_test.go
@@ -0,0 +1,14 @@
+package localenv
+
+import (
+	"os"
+	"testing"
+)
+
+// TestMain clears uv's UV_PROJECT_ENVIRONMENT from the host shell: it moves the
+// venv the pipeline uses, and most tests expect the default .venv. Tests that
+// need it set it on the context.
+func TestMain(m *testing.M) {
+	os.Unsetenv(EnvUvProjectEnvironment) //nolint:usetesting // t.Setenv cannot unset
+	m.Run()
+}
diff --git a/libs/localenv/merge.go b/libs/localenv/merge.go
new file mode 100644
index 00000000000..ab784564206
--- /dev/null
+++ b/libs/localenv/merge.go
@@ -0,0 +1,1479 @@
+package localenv
+
+import (
+	"cmp"
+	"errors"
+	"fmt"
+	"regexp"
+	"slices"
+	"strings"
+
+	"github.com/BurntSushi/toml"
+)
+
+// errMultilineString and errNoProjectTable are the conditions under which
+// MergeManaged refuses to merge rather than risk corrupting the file. The caller
+// surfaces both as E_MERGE.
+var (
+	errMultilineString = errors.New("pyproject.toml has an unterminated TOML multi-line string")
+	errNoProjectTable  = errors.New("pyproject.toml has no [project] table to hold requires-python")
+)
+
+// managedMarkerStart and managedMarkerEnd bracket the region of pyproject.toml
+// that this command owns. Everything between them is rewritten on each merge;
+// everything outside is preserved byte-for-byte. They derive from CommandName so
+// a command rename stays a single-place change (spec §0 / invariant 8).
+var (
+	managedMarkerStart = "# managed by databricks " + CommandName + " — do not edit"
+	managedMarkerEnd   = "# end managed by databricks " + CommandName
+)
+
+// Region names reported back to the caller via MergeManaged's regions return value.
+const (
+	regionRequiresPython        = "requires-python"
+	regionDatabricksConnect     = "databricks-connect"
+	regionToolUv                = "tool.uv.constraint-dependencies"
+	regionWorkspaceToolUv       = regionToolUv + " (uv workspace root)"
+	regionDatabricksEnvironment = "tool.databricks.environment"
+)
+
+// databricksEnvironmentTable is the TOML table header that carries the
+// serverless environment version, and environmentVersionRe matches the start of
+// its managed environment_version assignment (capturing leading whitespace so it
+// is preserved when the value is replaced).
+const databricksEnvironmentTable = "[tool.databricks.environment]"
+
+var environmentVersionRe = regexp.MustCompile(`^(\s*)environment_version\s*=`)
+
+var (
+	// tableHeaderRe matches a TOML table header line: a standard table like
+	// "[project]" / "[tool.uv]" or an array-of-tables like "[[tool.uv.index]]",
+	// tolerating a trailing inline comment ("[project] # note"). Recognizing both
+	// forms matters for bounds: an unrecognized "[[...]]" header would let a
+	// table's end run past it (e.g. [tool.uv] swallowing its child [[tool.uv.index]]
+	// items), and a commented header would similarly be missed.
+	tableHeaderRe = regexp.MustCompile(`^\s*\[\[?[^\]]+\]\]?\s*(#.*)?$`)
+	// requiresPythonRe captures the leading whitespace of a requires-python assignment so it
+	// can be preserved when the value is replaced.
+	requiresPythonRe = regexp.MustCompile(`^(\s*)requires-python\s*=`)
+)
+
+// removedDBConnect names a databricks-connect requirement the consolidation pass
+// deletes and the array it came from. The location is a human-readable label
+// ("[project].dependencies", "[dependency-groups].test") used in the advisory
+// message and to subtract the pin from the warning detector's resolution view.
+type removedDBConnect struct {
+	location string
+	pin      string
+}
+
+// dbconnectPlan is what the merge does to databricks-connect, computed by running
+// the merge on a clone so the warning detector never re-derives the merge's rules.
+// replacedDevPin is the dev-group pin mergeDatabricksConnect rewrites in place ("" if
+// it inserts the managed pin instead); removed is every stray pin the consolidation
+// pass deletes.
+type dbconnectPlan struct {
+	replacedDevPin string
+	removed        []removedDBConnect
+}
+
+// planDBConnect returns the databricks-connect edits merging target would make, or
+// the zero plan when databricks-connect is skipped (--no-dbconnect / --constraints-only)
+// or the artifact carries no pin — the cases where MergeManaged leaves databricks-connect
+// untouched. It mirrors MergeManaged's preprocessing (CRLF normalization and
+// multi-line string protection) and runs both databricks-connect passes on a clone,
+// in the same order as MergeManaged, so replacedDevPin and removed match what the
+// real merge does.
+func planDBConnect(target []byte, c Constraints, opts MergeOptions) dbconnectPlan {
+	if opts.SkipDBConnect || c.DatabricksConnect == "" {
+		return dbconnectPlan{}
+	}
+	// Mirror MergeManaged's own preprocessing so the same lines are inspected.
+	protected, _, err := protectMultilineStrings(strings.ReplaceAll(string(target), "\r\n", "\n"))
+	if err != nil {
+		return dbconnectPlan{}
+	}
+	lines := strings.Split(protected, "\n")
+	// mergeDatabricksConnect rewrites element lines in place, so hand it a copy: this
+	// probe must not disturb the caller's view of the pre-merge file. The consolidation
+	// pass then runs on its output, so removed reflects the post-dev-merge state where
+	// the managed pin is already the dev group's first databricks-connect element.
+	merged, replaced, _ := mergeDatabricksConnect(slices.Clone(lines), c.DatabricksConnect)
+	_, removed, _ := removeStrayDatabricksConnect(merged, c.DatabricksConnect)
+	return dbconnectPlan{replacedDevPin: replaced, removed: removed}
+}
+
+// MergeOptions selects which orthogonal managed axes are left unmanaged. Each flag
+// is threaded explicitly rather than inferred from empty/nil values in the
+// Constraints, so a caller's intent is unambiguous and the Constraints always carry
+// the real artifact values. The zero value manages every axis. A new axis is a new
+// field here — callers that manage everything keep passing MergeOptions{} unchanged.
+type MergeOptions struct {
+	// SkipConstraints (--no-constraints) leaves the requires-python and [tool.uv]
+	// constraint regions unmanaged: existing values are preserved and none written.
+	SkipConstraints bool
+	// SkipDBConnect (--no-dbconnect / --constraints-only) leaves the
+	// databricks-connect dependency unmanaged: an existing pin is preserved and none
+	// is injected or asserted.
+	SkipDBConnect bool
+	// ConstraintsAtWorkspaceRoot is set for a uv workspace member: its constraint
+	// block is written to the workspace root (uv reads constraint-dependencies only
+	// there), so this file gets none, and a managed block that an earlier run left
+	// here is removed. requires-python is still managed in the member.
+	ConstraintsAtWorkspaceRoot bool
+}
+
+// MergeManaged applies the managed transforms to target, preserving every other
+// byte (comments, ordering, whitespace). It returns the merged bytes and the list of
+// regions that actually changed. The operation is idempotent: feeding its own output
+// back in produces identical bytes. opts selects which axes are managed; the
+// environment region is always reconciled.
+func MergeManaged(target []byte, c Constraints, opts MergeOptions) (merged []byte, regions []string, err error) {
+	merged, err = transformLines(target, func(lines []string) ([]string, error) {
+		// requires-python needs a [project] table to hold it; without one the merge
+		// would silently drop the pin, so fail loudly instead. Only enforced when
+		// constraints are managed — under SkipConstraints there is no requires-python to
+		// write, so a [project]-less file (e.g. one with only dependency groups) is
+		// merged for its other axes rather than rejected.
+		if !opts.SkipConstraints {
+			if _, _, ok := tableBounds(lines, "[project]"); !ok {
+				return nil, errNoProjectTable
+			}
+		}
+
+		if !opts.SkipConstraints {
+			var rpChanged bool
+			lines, rpChanged = mergeRequiresPython(lines, c.RequiresPython)
+			if rpChanged {
+				regions = append(regions, regionRequiresPython)
+			}
+		}
+
+		if !opts.SkipDBConnect {
+			var dbcChanged bool
+			lines, _, dbcChanged = mergeDatabricksConnect(lines, c.DatabricksConnect)
+			// In the install flow, after the managed pin lands in the dev group, remove any
+			// databricks-connect pin elsewhere that is disjoint from it — the pins that would
+			// otherwise make uv unsatisfiable. Compatible pins are left alone. An empty pin
+			// (an artifact without databricks-connect) is a data no-op, distinct from the
+			// SkipDBConnect intent handled by the gate above.
+			strayChanged := false
+			if c.DatabricksConnect != "" {
+				lines, _, strayChanged = removeStrayDatabricksConnect(lines, c.DatabricksConnect)
+			}
+			if dbcChanged || strayChanged {
+				regions = append(regions, regionDatabricksConnect)
+			}
+		}
+
+		lines, envChanged := mergeDatabricksEnvironment(lines, c.EnvironmentVersion)
+		if envChanged {
+			regions = append(regions, regionDatabricksEnvironment)
+		}
+
+		if !opts.SkipConstraints {
+			var uvChanged bool
+			if opts.ConstraintsAtWorkspaceRoot {
+				// A managed block left in the member by an earlier run has no effect
+				// (uv ignores it), so remove it rather than keep pins that disagree
+				// with what uv applies.
+				lines, uvChanged = removeManagedToolUv(lines)
+			} else {
+				lines, uvChanged = mergeToolUv(lines, c.ConstraintDeps)
+			}
+			if uvChanged {
+				regions = append(regions, regionToolUv)
+			}
+		}
+		return lines, nil
+	})
+	if err != nil {
+		return nil, nil, err
+	}
+	return merged, regions, nil
+}
+
+// MergeToolUvBlock reconciles only the managed [tool.uv] constraint-dependencies
+// block of target, preserving every other byte. It is used for the root
+// pyproject.toml of a uv workspace, which may be a virtual root with no [project]
+// table. changed reports whether the block differs from the input; replaced
+// reports whether that change replaces constraint-dependencies the file already
+// had (from an earlier run or from the user).
+func MergeToolUvBlock(target []byte, deps []string) (merged []byte, changed, replaced bool, err error) {
+	merged, err = transformLines(target, func(lines []string) ([]string, error) {
+		if definesToolUvWithoutHeader(lines) {
+			return nil, errDottedToolUv
+		}
+		hadPins := hasConstraintDeps(lines)
+		var out []string
+		out, changed = mergeToolUv(lines, deps)
+		replaced = changed && hadPins
+		return out, nil
+	})
+	if err != nil {
+		return nil, false, false, err
+	}
+	// The line-based merge matches only the plain [tool.uv] spelling. Other valid
+	// spellings ([ tool.uv ], [tool."uv"], a quoted key) can make it define a table
+	// or key twice. This file is shared by every workspace member, so never return
+	// a merge that no longer parses.
+	if _, err := toml.Decode(string(merged), &map[string]any{}); err != nil {
+		return nil, false, false, fmt.Errorf("merged workspace root pyproject.toml is not valid TOML; write [tool.uv] and constraint-dependencies without quotes or spaces: %w", err)
+	}
+	return merged, changed, replaced, nil
+}
+
+// hasConstraintDeps reports whether lines hold pins: a managed block with at
+// least one entry, or a constraint-dependencies key in the [tool.uv] table.
+func hasConstraintDeps(lines []string) bool {
+	if start, stop, found := markerBounds(lines); found {
+		return slices.ContainsFunc(lines[start+1:stop], func(l string) bool {
+			return strings.HasPrefix(strings.TrimSpace(l), `"`)
+		})
+	}
+	header, end, ok := tableBounds(lines, "[tool.uv]")
+	if !ok {
+		return false
+	}
+	for i := header + 1; i < end; i++ {
+		if !constraintDepsRe.MatchString(lines[i]) {
+			continue
+		}
+		last, _ := constraintDepsArrayEnd(lines, i, end)
+		// Drop comments, so a quote in a comment of an empty array is not a pin.
+		var value strings.Builder
+		for _, l := range lines[i : last+1] {
+			if c := commentStart(l); c >= 0 {
+				l = l[:c]
+			}
+			value.WriteString(l)
+		}
+		_, v, _ := strings.Cut(value.String(), "=")
+		return strings.ContainsAny(v, `"'`)
+	}
+	return false
+}
+
+// errDottedToolUv is returned when the file defines the [tool.uv] table without
+// a [tool.uv] header (dotted, quoted, or inline keys). The line-based merge
+// cannot extend such a table, and appending a [tool.uv] header would define it
+// twice, which uv rejects for the whole workspace.
+var errDottedToolUv = errors.New("pyproject.toml defines [tool.uv] without a [tool.uv] header (for example tool.uv.workspace.members or an inline table); use [tool.uv] and [tool.uv.workspace] tables so the constraint block can be added")
+
+// toolUvTopRe and toolUvInToolRe match a key that defines the [tool.uv] table
+// without its header: tool.uv.… or an inline tool = {…} at the top level, and
+// uv.… or uv = {…} inside [tool]. Keys may be quoted.
+var (
+	toolUvTopRe    = regexp.MustCompile(`^\s*["']?tool["']?\s*(\.\s*["']?uv["']?\s*[.=]|=\s*\{)`)
+	toolUvInToolRe = regexp.MustCompile(`^\s*["']?uv["']?\s*[.=]`)
+)
+
+// definesToolUvWithoutHeader reports whether lines define the [tool.uv] table
+// only through keys, with no [tool.uv] header.
+func definesToolUvWithoutHeader(lines []string) bool {
+	if _, _, ok := tableBounds(lines, "[tool.uv]"); ok {
+		return false
+	}
+	table := ""
+	for _, line := range lines {
+		if name := headerName(line); name != "" {
+			table = name
+			continue
+		}
+		if (table == "" && toolUvTopRe.MatchString(line)) || (table == "[tool]" && toolUvInToolRe.MatchString(line)) {
+			return true
+		}
+	}
+	return false
+}
+
+// transformLines runs fn over target split into lines, with CRLF normalized to
+// LF and multiline strings protected, and restores both on the way out.
+func transformLines(target []byte, fn func([]string) ([]string, error)) ([]byte, error) {
+	s := string(target)
+
+	// Detect and normalize line endings. We process on "\n" and restore "\r\n" on
+	// exit. Line endings are treated as a whole-file property: a file that uses
+	// CRLF anywhere is emitted entirely as CRLF. Real pyproject.toml files use one
+	// consistent ending, so this is faithful in practice; a file that deliberately
+	// mixes LF and CRLF would be normalized to CRLF (a benign whitespace-only
+	// change), which we accept rather than track a terminator per line.
+	crlf := strings.Contains(s, "\r\n")
+	if crlf {
+		s = strings.ReplaceAll(s, "\r\n", "\n")
+	}
+
+	protected, restore, err := protectMultilineStrings(s)
+	if err != nil {
+		return nil, err
+	}
+	lines, err := fn(strings.Split(protected, "\n"))
+	if err != nil {
+		return nil, err
+	}
+
+	out := restore(strings.Join(lines, "\n"))
+	if crlf {
+		out = strings.ReplaceAll(out, "\n", "\r\n")
+	}
+	return []byte(out), nil
+}
+
+// headerName returns the bracketed table name of a TOML table-header line (e.g.
+// "[project]" from "  [project] # note", or "[[tool.uv.index]]" from an
+// array-of-tables header), or "" if the line is not a table header. It strips a
+// trailing inline comment so a commented header still matches by name, and keeps
+// the full "[[...]]" form so an array-of-tables header is never treated as the
+// same table as its "[...]" parent.
+func headerName(line string) string {
+	if !tableHeaderRe.MatchString(line) {
+		return ""
+	}
+	s := strings.TrimSpace(line)
+	// Array-of-tables: "[[name]]" — return through the closing "]]".
+	if strings.HasPrefix(s, "[[") {
+		if i := strings.Index(s, "]]"); i >= 0 {
+			return s[:i+2]
+		}
+	}
+	if i := strings.Index(s, "]"); i >= 0 {
+		return s[:i+1]
+	}
+	return s
+}
+
+// tableBounds returns the line index of the header matching name (e.g. "[project]") and
+// the index of the first line after the table body (the next table header or EOF). If the
+// table is absent, found is false.
+func tableBounds(lines []string, name string) (header, end int, found bool) {
+	header = -1
+	for i, line := range lines {
+		if headerName(line) == name {
+			header = i
+			break
+		}
+	}
+	if header == -1 {
+		return -1, -1, false
+	}
+	end = len(lines)
+	for i := header + 1; i < len(lines); i++ {
+		if tableHeaderRe.MatchString(lines[i]) {
+			end = i
+			break
+		}
+	}
+	return header, end, true
+}
+
+// mergeRequiresPython replaces the value of requires-python within [project], preserving
+// the line's leading whitespace. If the key is absent, it is inserted directly under the
+// [project] header. Returns whether the line slice changed.
+func mergeRequiresPython(lines []string, value string) ([]string, bool) {
+	// Only reached when constraints are managed (MergeManaged gates on
+	// skipConstraints), where a fetched artifact always carries a requires-python.
+	header, end, found := tableBounds(lines, "[project]")
+	if !found {
+		return lines, false
+	}
+
+	want := func(indent, comment string) string {
+		return fmt.Sprintf(`%srequires-python = "%s"%s`, indent, value, comment)
+	}
+
+	for i := header + 1; i < end; i++ {
+		m := requiresPythonRe.FindStringSubmatch(lines[i])
+		if m == nil {
+			continue
+		}
+		// Preserve a trailing inline comment; only the value is managed, so
+		// "requires-python = \"...\" # note" keeps its note.
+		replacement := want(m[1], trailingComment(lines[i]))
+		if lines[i] == replacement {
+			return lines, false
+		}
+		lines[i] = replacement
+		return lines, true
+	}
+
+	// Key absent: insert directly under the [project] header.
+	inserted := make([]string, 0, len(lines)+1)
+	inserted = append(inserted, lines[:header+1]...)
+	inserted = append(inserted, want("", ""))
+	inserted = append(inserted, lines[header+1:]...)
+	return inserted, true
+}
+
+// mergeDatabricksEnvironment pins environment_version to version within the
+// env-owned [tool.databricks.environment] table: it replaces an existing value
+// (preserving the line's indentation and any inline comment), inserts the key
+// when the table exists without it, and appends the table when it is absent.
+// An empty version (a cluster target) is a no-op — the section is only written
+// for serverless targets, so an existing one is left untouched rather than
+// removed. Returns whether the line slice changed.
+func mergeDatabricksEnvironment(lines []string, version string) ([]string, bool) {
+	if version == "" {
+		return lines, false
+	}
+
+	header, end, found := tableBounds(lines, databricksEnvironmentTable)
+	if !found {
+		return appendManagedBlock(lines, []string{databricksEnvironmentTable, fmt.Sprintf(`environment_version = "%s"`, version)}), true
+	}
+
+	for i := header + 1; i < end; i++ {
+		m := environmentVersionRe.FindStringSubmatch(lines[i])
+		if m == nil {
+			continue
+		}
+		// Only the value is managed; a trailing inline comment is user content.
+		replacement := fmt.Sprintf(`%senvironment_version = "%s"%s`, m[1], version, trailingComment(lines[i]))
+		if lines[i] == replacement {
+			return lines, false
+		}
+		lines[i] = replacement
+		return lines, true
+	}
+
+	// Table exists but has no environment_version: insert directly under the header.
+	inserted := make([]string, 0, len(lines)+1)
+	inserted = append(inserted, lines[:header+1]...)
+	inserted = append(inserted, fmt.Sprintf(`environment_version = "%s"`, version))
+	inserted = append(inserted, lines[header+1:]...)
+	return inserted, true
+}
+
+// trailingComment returns the inline TOML comment suffix of a line (including the
+// leading whitespace and "#"), or "" if there is none. It ignores "#" characters
+// inside a quoted string so a value like requires-python = ">=3.10 # x" is not
+// mistaken for a comment.
+func trailingComment(line string) string {
+	var quote byte
+	for i := 0; i < len(line); i++ {
+		c := line[i]
+		if quote != 0 {
+			if c == '\\' && quote == '"' {
+				i++
+				continue
+			}
+			if c == quote {
+				quote = 0
+			}
+			continue
+		}
+		switch c {
+		case '"', '\'':
+			quote = c
+		case '#':
+			// Include any whitespace immediately preceding the "#".
+			start := i
+			for start > 0 && (line[start-1] == ' ' || line[start-1] == '\t') {
+				start--
+			}
+			return line[start:]
+		}
+	}
+	return ""
+}
+
+// devKeyRe matches the start of the dev array assignment within [dependency-groups]
+// (e.g. "dev = [" or "dev=["), capturing leading whitespace. Only this key is
+// managed; sibling groups such as test/docs are user-owned and left untouched.
+var devKeyRe = regexp.MustCompile(`^\s*dev\s*=`)
+
+// mergeDatabricksConnect ensures [dependency-groups].dev pins databricks-connect
+// to value. It replaces an existing databricks-connect element (multi-line or
+// single-line array form) and, when none exists, inserts one — creating the dev
+// key and the [dependency-groups] table when those are absent too, mirroring
+// RenderFreshPyproject so an existing project without a pin provisions the same as
+// a greenfield one. An empty value (constraints-only mode) is a no-op: the user's
+// dev group is left untouched rather than having its pin blanked out or one added.
+//
+// The edit is scoped to the dev array's own span (found via bracket depth), so a
+// databricks-connect pin sitting in a sibling group (e.g. docs/test) or inside a
+// trailing comment on some other line is never clobbered. The insert path is
+// idempotent: a subsequent merge finds the element and rewrites it in place.
+//
+// replacedPin is the requirement it rewrote in place, empty when it inserted the
+// managed pin instead. That distinction is what detectMergeWarnings needs: only a
+// rewrite means the user's pin is gone, and only the merge itself can say which
+// spellings it recognizes.
+func mergeDatabricksConnect(lines []string, value string) (out []string, replacedPin string, changed bool) {
+	if value == "" {
+		return lines, "", false
+	}
+	elem := `"` + value + `"`
+
+	header, end, found := tableBounds(lines, "[dependency-groups]")
+	if !found {
+		// No [dependency-groups] table: append a fresh managed dev group.
+		return appendManagedBlock(lines, []string{"[dependency-groups]", "dev = [", "    " + elem + ",", "]"}), "", true
+	}
+
+	// Locate the dev assignment and the line span of its array value.
+	devStart := -1
+	for i := header + 1; i < end; i++ {
+		if devKeyRe.MatchString(lines[i]) {
+			devStart = i
+			break
+		}
+	}
+	if devStart == -1 {
+		// The table exists but has no dev key: insert one right after the header.
+		insert := []string{"dev = [", "    " + elem + ",", "]"}
+		out := make([]string, 0, len(lines)+len(insert))
+		out = append(out, lines[:header+1]...)
+		out = append(out, insert...)
+		out = append(out, lines[header+1:]...)
+		return out, "", true
+	}
+	arrayLast, _ := arrayLineSpan(lines, devStart, end)
+
+	// Single-line form: the whole array is on the dev line itself. Only edit
+	// within the array (through its closing "]"); a trailing comment after it is
+	// user content and must be left byte-for-byte intact.
+	if devStart == arrayLast {
+		line := lines[devStart]
+		arrayPart, commentPart := splitAtArrayClose(line)
+		if rewritten, replaced, ok := replaceDbconnectElement(arrayPart, elem); ok {
+			newLine := rewritten + commentPart
+			if newLine == line {
+				return lines, replaced, false
+			}
+			lines[devStart] = newLine
+			return lines, replaced, true
+		}
+		// No databricks-connect element: insert one as the first array element.
+		open := strings.Index(arrayPart, "[")
+		closeIdx := strings.LastIndex(arrayPart, "]")
+		if open < 0 || closeIdx < open {
+			return lines, "", false
+		}
+		inner := strings.TrimSpace(arrayPart[open+1 : closeIdx])
+		newInner := elem
+		if inner != "" {
+			newInner = elem + ", " + inner
+		}
+		lines[devStart] = arrayPart[:open+1] + newInner + arrayPart[closeIdx:] + commentPart
+		return lines, "", true
+	}
+
+	// Multi-line form: the array spans devStart..arrayLast. An existing
+	// databricks-connect element may sit on a dedicated element line, share the
+	// opening "dev = [" line, or carry a trailing comment, and may be spelled with
+	// any PEP 503-equivalent separators/case — so detect it (outside comments,
+	// name-normalized) anywhere in the span and rewrite in place. Only when no
+	// element exists anywhere do we insert, which avoids duplicating a pin a raw
+	// substring match would miss.
+	lastElem := -1
+	for i := devStart; i <= arrayLast; i++ {
+		code, comment := lines[i], ""
+		if c := commentStart(code); c >= 0 {
+			code, comment = code[:c], code[c:]
+		}
+		if rewritten, replaced, ok := replaceDbconnectElement(code, elem); ok {
+			// Rewrite only the code portion; a trailing comment is user content and
+			// must be preserved byte-for-byte, even if it contains a quoted token.
+			newLine := rewritten + comment
+			if newLine == lines[i] {
+				return lines, replaced, false
+			}
+			lines[i] = newLine
+			return lines, replaced, true
+		}
+		if dbconnectQuotedRe.MatchString(code) {
+			lastElem = i
+		}
+	}
+	// No databricks-connect element anywhere in the array: insert one before the
+	// closing "]", matching the indentation of the existing elements (default four
+	// spaces when empty).
+	indent := "    "
+	for i := devStart + 1; i < arrayLast; i++ {
+		if strings.TrimSpace(lines[i]) != "" {
+			indent = leadingWhitespace(lines[i])
+			break
+		}
+	}
+	// TOML lets the final element omit its trailing comma; appending after it would
+	// then leave two adjacent elements with no separator. Ensure the current last
+	// element (if it is on its own line, not the "]" line) carries a comma first.
+	if lastElem >= 0 && lastElem < arrayLast {
+		lines[lastElem] = ensureTrailingComma(lines[lastElem])
+	}
+	inserted := make([]string, 0, len(lines)+1)
+	inserted = append(inserted, lines[:arrayLast]...)
+	inserted = append(inserted, indent+elem+",")
+	inserted = append(inserted, lines[arrayLast:]...)
+	return inserted, "", true
+}
+
+// dbconnectQuotedRe matches any double-quoted array element token.
+var dbconnectQuotedRe = regexp.MustCompile(`"[^"]*"`)
+
+// replaceDbconnectElement replaces the first quoted element in code whose package
+// name is databricks-connect (compared under PEP 503 normalization, so
+// "databricks_connect" / "Databricks-Connect" / "databricks.connect" all match)
+// with elem. It returns the rewritten code, the requirement it replaced, and
+// whether a replacement was made. Matching mirrors the artifact side
+// (isDatabricksConnectDep) so a differently spelled existing pin is rewritten in
+// place rather than left for the insert path to duplicate.
+func replaceDbconnectElement(code, elem string) (out, replaced string, ok bool) {
+	for _, m := range dbconnectQuotedRe.FindAllStringIndex(code, -1) {
+		inner := code[m[0]+1 : m[1]-1]
+		if isDatabricksConnectDep(inner) {
+			return code[:m[0]] + elem + code[m[1]:], inner, true
+		}
+	}
+	return code, "", false
+}
+
+// arrayKeyRe matches a "key = [" array assignment, capturing the key. The "[" must
+// be on the assignment line (TOML array syntax), so an inline table value ("= {")
+// or a scalar is not matched. "." is allowed in the key so a dotted assignment
+// (optional-dependencies.extra = [...] inside [project]) is captured whole — as the
+// key "optional-dependencies.extra", which is intentionally not equal to "dependencies"
+// and so is skipped, rather than mistaken for the [project].dependencies array.
+var arrayKeyRe = regexp.MustCompile(`^\s*([A-Za-z0-9._-]+)\s*=\s*\[`)
+
+// arraySpan locates one "key = [ ... ]" array assignment: the key and the line
+// indices its value opens and closes on.
+type arraySpan struct {
+	key   string
+	start int
+	last  int
+}
+
+// arrayAssignmentsIn returns each top-level "key = [ ... ]" array assignment in the
+// table body spanning (header, end), in file order. Continuation lines of a
+// multi-line array are skipped so a requirement string that happens to look like an
+// assignment is not mistaken for one.
+func arrayAssignmentsIn(lines []string, header, end int) []arraySpan {
+	var out []arraySpan
+	for i := header + 1; i < end; i++ {
+		m := arrayKeyRe.FindStringSubmatch(lines[i])
+		if m == nil {
+			continue
+		}
+		last, _ := arrayLineSpan(lines, i, end)
+		out = append(out, arraySpan{key: m[1], start: i, last: last})
+		i = last
+	}
+	return out
+}
+
+// removeStrayDatabricksConnect deletes the databricks-connect requirements that
+// provably cannot co-resolve with the managed env pin (envPin) — from
+// [project].dependencies, every [project.optional-dependencies] extra, and every
+// [dependency-groups] group. It reports each deleted pin with its location.
+//
+// Only a *disjoint* pin is removed (see dbconnectPinConflicts). That is the pin that
+// actually makes uv unsatisfiable — the bug this exists to fix — and it is the whole
+// justification for reaching into locations the merge otherwise leaves alone,
+// including [project].dependencies, which the default template compiles into the
+// built wheel's metadata: deleting a pin there is only warranted when the project
+// would not resolve or build as-is. A pin that co-resolves (databricks-connect>=15
+// against ~=17.2.0), carries no version, is marker-gated, or already equals envPin is
+// left untouched — there is nothing to fix, so the user's declaration stands. This
+// deliberately overrides, for disjoint pins only, the "sibling groups are user-owned
+// and left untouched" contract that scopes mergeDatabricksConnect (see devKeyRe).
+//
+// The removal is line-based and matches the same shapes the rewrite does: a
+// double-quoted element under a bare-key array in the [project], [project.optional-
+// dependencies], or [dependency-groups] tables. Rarer-but-valid spellings are out of
+// its reach and left in place — a single-quoted pin, a pin under a quoted TOML key
+// ("qa group" = [...]), and a pin in an inline-table or dotted sub-table form. These
+// are not silent: detectMergeWarnings decodes the file fully, so a disjoint survivor
+// is still surfaced as W_DBCONNECT_PIN_DUPLICATED.
+func removeStrayDatabricksConnect(lines []string, envPin string) (out []string, removed []removedDBConnect, changed bool) {
+	type target struct {
+		span     arraySpan
+		location string
+	}
+	var targets []target
+
+	if h, e, ok := tableBounds(lines, "[project]"); ok {
+		for _, a := range arrayAssignmentsIn(lines, h, e) {
+			// Only [project].dependencies is a resolution requirement; other [project]
+			// arrays (keywords, classifiers, ...) never hold databricks-connect.
+			if a.key == "dependencies" {
+				targets = append(targets, target{a, "[project].dependencies"})
+			}
+		}
+	}
+	if h, e, ok := tableBounds(lines, "[project.optional-dependencies]"); ok {
+		for _, a := range arrayAssignmentsIn(lines, h, e) {
+			targets = append(targets, target{a, "[project.optional-dependencies]." + a.key})
+		}
+	}
+	if h, e, ok := tableBounds(lines, "[dependency-groups]"); ok {
+		for _, a := range arrayAssignmentsIn(lines, h, e) {
+			targets = append(targets, target{a, "[dependency-groups]." + a.key})
+		}
+	}
+	if len(targets) == 0 {
+		return lines, nil, false
+	}
+
+	// Rewrite spans in a single ascending pass so a line-count change from one edit
+	// does not shift the indices of the others. Spans in different tables never
+	// overlap, and arrayAssignmentsIn already returns each table's spans in order.
+	slices.SortFunc(targets, func(a, b target) int { return cmp.Compare(a.span.start, b.span.start) })
+
+	out = make([]string, 0, len(lines))
+	prev := 0
+	for _, t := range targets {
+		out = append(out, lines[prev:t.span.start]...)
+		newSpan, pins := removeDbconnectFromArraySpan(lines[t.span.start:t.span.last+1], envPin)
+		out = append(out, newSpan...)
+		for _, pin := range pins {
+			removed = append(removed, removedDBConnect{location: t.location, pin: pin})
+		}
+		prev = t.span.last + 1
+	}
+	out = append(out, lines[prev:]...)
+
+	// out is fully built above; it is only returned when something was removed, so a
+	// no-op run returns the original slice unchanged.
+	if len(removed) == 0 {
+		return lines, nil, false
+	}
+	return out, removed, true
+}
+
+// dbconnectPinConflicts reports whether a databricks-connect pin provably cannot
+// co-resolve with the managed env pin — their version ranges are disjoint. A pin the
+// range model cannot compare (no version, a marker-gated requirement, an unparseable
+// or wildcard-only spelling) is not provably conflicting, so it is treated as
+// compatible and left in place. envPin, written by the merge, always parses.
+func dbconnectPinConflicts(pin, envPin string) bool {
+	_, pinSpec, pinOK := splitDepSpec(pin)
+	_, envSpec, envOK := splitDepSpec(envPin)
+	return pinOK && envOK && rangesDisjoint(pinSpec, envSpec)
+}
+
+// removeDbconnectFromArraySpan removes the databricks-connect elements that conflict
+// with envPin (see dbconnectPinConflicts) from a single array value spanning spanLines
+// (single- or multi-line), returning the rewritten lines and the removed pins. A
+// compatible databricks-connect element — including the managed dev pin, which equals
+// envPin and so never conflicts with itself — is left in place. It operates on
+// top-level array elements so a version range comma ("databricks-connect>=15,<16") or
+// an inline table is not split, and rejoining survivors preserves each element's own
+// leading whitespace, newline, and trailing comma.
+func removeDbconnectFromArraySpan(spanLines []string, envPin string) (out, removed []string) {
+	block := strings.Join(spanLines, "\n")
+	prefix, body, suffix, ok := arrayParts(block)
+	if !ok {
+		return spanLines, nil
+	}
+	var kept []string
+	// carry holds the leading comment/blank lines of a removed element. splitTopLevelElements
+	// breaks on commas, so a trailing comment left on the *previous* element's line lands as
+	// a leading comment line on this element's token; dropping the whole token would delete
+	// that previous element's comment (MergeManaged preserves comments). Carry those lines to
+	// the next retained token so the comment stays on the line it belonged to. A comment that
+	// instead described the removed element is indistinguishable from that case, so it is kept
+	// too and may end up beside the following element — content is never lost, but a comment
+	// can be relocated; that is the accepted trade-off of the split-on-commas approach.
+	carry := ""
+	for _, elem := range splitTopLevelElements(body) {
+		elem = carry + elem
+		carry = ""
+		if pin, isDBC := dbconnectElementPin(elem); isDBC && dbconnectPinConflicts(pin, envPin) {
+			removed = append(removed, pin)
+			carry = leadingLinesBeforeElement(elem)
+			continue
+		}
+		kept = append(kept, elem)
+	}
+	if len(removed) == 0 {
+		return spanLines, nil
+	}
+	// A carry left over after the last token (the removed element was last) has no following
+	// token; emit it on its own line before the closing "]" so the comment survives and does
+	// not comment out the bracket.
+	if strings.TrimSpace(carry) != "" {
+		kept = append(kept, carry+"\n")
+	}
+	// Removing the last element of a multi-line array would pull the closing "]" up onto
+	// the previous element's line (that element's token carried no trailing newline) and
+	// drop the array's trailing comma. When the array was multi-line (body ends in a
+	// newline) and a real element still remains, restore the trailing comma and the
+	// newline before "]" so the bracket keeps its own line and the magic trailing comma
+	// survives.
+	joined := strings.Join(kept, ",")
+	if strings.HasSuffix(body, "\n") && len(kept) > 0 && !strings.HasSuffix(joined, "\n") {
+		if !strings.HasSuffix(joined, ",") {
+			joined += ","
+		}
+		joined += "\n"
+	}
+	return strings.Split(prefix+joined+suffix, "\n"), removed
+}
+
+// leadingLinesBeforeElement returns the comment/blank lines that precede the value line
+// in an array-element token — the trailing comment splitTopLevelElements moved here from
+// the previous element's line. The value line and anything after it (the element's own
+// trailing comment) is excluded, since that belongs to the element being removed.
+func leadingLinesBeforeElement(elem string) string {
+	lines := strings.Split(elem, "\n")
+	for i, line := range lines {
+		if c := commentStart(line); c >= 0 {
+			line = line[:c]
+		}
+		if strings.TrimSpace(line) != "" {
+			return strings.Join(lines[:i], "\n")
+		}
+	}
+	return ""
+}
+
+// arrayParts splits a joined "key = [ ... ]" block into the text up to and including
+// the opening "[", the body between the brackets, and the text from the matching "]"
+// onward. It scans across newlines, tracking quoted strings and per-line "#" comments
+// so a bracket inside either is ignored. ok is false when no balanced array is found.
+func arrayParts(block string) (prefix, body, suffix string, ok bool) {
+	depth := 0
+	var quote byte
+	inComment := false
+	openIdx := -1
+	for i := 0; i < len(block); i++ {
+		c := block[i]
+		switch {
+		case c == '\n':
+			inComment = false
+		case inComment:
+			// skip until newline
+		case quote != 0:
+			if c == '\\' && quote == '"' {
+				i++
+			} else if c == quote {
+				quote = 0
+			}
+		case c == '"' || c == '\'':
+			quote = c
+		case c == '#':
+			inComment = true
+		case c == '[':
+			depth++
+			if depth == 1 {
+				openIdx = i
+			}
+		case c == ']':
+			depth--
+			if depth == 0 && openIdx != -1 {
+				return block[:openIdx+1], block[openIdx+1 : i], block[i:], true
+			}
+		}
+	}
+	return "", "", "", false
+}
+
+// splitTopLevelElements splits an array body into its element tokens, breaking only
+// on commas outside quotes, outside nested []/{} , and outside "#" comments. Each
+// token keeps its surrounding whitespace, newline, and any comment, so survivors
+// reassemble byte-for-byte. The final segment (the whitespace before "]") is kept so
+// a trailing comma is preserved on rejoin.
+func splitTopLevelElements(body string) []string {
+	var elems []string
+	depth := 0
+	var quote byte
+	inComment := false
+	start := 0
+	for i := 0; i < len(body); i++ {
+		c := body[i]
+		switch {
+		case c == '\n':
+			inComment = false
+		case inComment:
+			// skip until newline
+		case quote != 0:
+			if c == '\\' && quote == '"' {
+				i++
+			} else if c == quote {
+				quote = 0
+			}
+		case c == '"' || c == '\'':
+			quote = c
+		case c == '#':
+			inComment = true
+		case c == '[' || c == '{':
+			depth++
+		case c == ']' || c == '}':
+			depth--
+		case c == ',' && depth == 0:
+			elems = append(elems, body[start:i])
+			start = i + 1
+		}
+	}
+	return append(elems, body[start:])
+}
+
+// dbconnectElementPin returns the databricks-connect requirement an array element
+// token pins, if the token is a double-quoted string naming databricks-connect.
+// Single-quoted and non-string tokens (e.g. a PEP 735 include-group table) are not
+// matched, mirroring replaceDbconnectElement's double-quoted-only rule.
+//
+// The token is scanned line by line rather than as one string: splitTopLevelElements
+// breaks only on commas, so the token for an element carries any inline comment left
+// on the *previous* element's line as a leading comment line. Stripping the comment
+// with commentStart over the whole token would treat that leading "#" as running to
+// end-of-token and hide the quoted requirement on the next line, silently skipping a
+// stray pin. commentStart is therefore applied per line, where it correctly stops at
+// the line's own end.
+func dbconnectElementPin(elem string) (pin string, ok bool) {
+	for line := range strings.SplitSeq(elem, "\n") {
+		if c := commentStart(line); c >= 0 {
+			line = line[:c]
+		}
+		line = strings.TrimSpace(line)
+		if len(line) >= 2 && line[0] == '"' && line[len(line)-1] == '"' {
+			inner := line[1 : len(line)-1]
+			if isDatabricksConnectDep(inner) {
+				return inner, true
+			}
+		}
+	}
+	return "", false
+}
+
+// ensureTrailingComma appends a "," after the last non-space code character of
+// line when it lacks one, preserving any trailing whitespace and inline comment.
+// A blank or comment-only line is returned unchanged.
+func ensureTrailingComma(line string) string {
+	code, comment := line, ""
+	if c := commentStart(code); c >= 0 {
+		code, comment = code[:c], code[c:]
+	}
+	trimmed := strings.TrimRight(code, " \t")
+	if trimmed == "" || strings.HasSuffix(trimmed, ",") {
+		return line
+	}
+	return trimmed + "," + code[len(trimmed):] + comment
+}
+
+// leadingWhitespace returns the run of spaces and tabs at the start of s.
+func leadingWhitespace(s string) string {
+	return s[:len(s)-len(strings.TrimLeft(s, " \t"))]
+}
+
+// splitAtArrayClose splits a single-line array assignment into the part up to and
+// including the array's closing "]" and the remainder (a trailing comment, if any),
+// tracking bracket depth outside quoted strings. This keeps token replacement inside
+// the array from touching a trailing comment. If no balanced close is found the whole
+// line is returned as the array part.
+func splitAtArrayClose(line string) (arrayPart, rest string) {
+	depth := 0
+	var quote byte
+	opened := false
+	for i := 0; i < len(line); i++ {
+		c := line[i]
+		if quote != 0 {
+			if c == '\\' && quote == '"' {
+				i++
+				continue
+			}
+			if c == quote {
+				quote = 0
+			}
+			continue
+		}
+		switch c {
+		case '"', '\'':
+			quote = c
+		case '[':
+			depth++
+			opened = true
+		case ']':
+			depth--
+			if opened && depth == 0 {
+				return line[:i+1], line[i+1:]
+			}
+		}
+	}
+	return line, ""
+}
+
+// arrayLineSpan returns the index of the line on which the array opened at
+// lines[start] closes (brackets balance), scanning outside strings/comments. A
+// single-line array returns start. It bounds in-place edits of an array value to
+// the array's own lines.
+func arrayLineSpan(lines []string, start, limit int) (last int, multiline bool) {
+	depth := bracketDepthDelta(lines[start])
+	if depth <= 0 {
+		return start, false
+	}
+	for j := start + 1; j < limit; j++ {
+		depth += bracketDepthDelta(lines[j])
+		if depth <= 0 {
+			return j, true
+		}
+	}
+	return limit - 1, true
+}
+
+// mergeToolUv rewrites the managed [tool.uv] constraint-dependencies block. If a
+// marker-bracketed block already exists, its contents are replaced in place. Otherwise any
+// plain [tool.uv] table is removed and a fresh marker-bracketed block is appended at EOF.
+func mergeToolUv(lines, deps []string) ([]string, bool) {
+	// Only reached when constraints are managed (MergeManaged gates on
+	// skipConstraints). A nil deps slice is treated identically to an empty one:
+	// both render an empty managed block.
+	start, stop, found := markerBounds(lines)
+	if found {
+		// Replace the existing managed region in place. Whether it owns a [tool.uv]
+		// header depends on whether it sits inside a user-authored [tool.uv] table:
+		// a header-less region attached to the user table stays header-less on
+		// re-merge, so idempotency holds.
+		block := renderToolUvBlock(deps, !markerAttachedToToolUv(lines, start))
+		existing := lines[start : stop+1]
+		if equalLines(existing, block) {
+			return lines, false
+		}
+		out := make([]string, 0, len(lines)-(stop-start+1)+len(block))
+		out = append(out, lines[:start]...)
+		out = append(out, block...)
+		out = append(out, lines[stop+1:]...)
+		return out, true
+	}
+
+	// No managed block yet: reconcile any plain [tool.uv] table.
+	if header, end, ok := tableBounds(lines, "[tool.uv]"); ok {
+		if toolUvHasOnlyConstraintDeps(lines, header, end) {
+			// The table is effectively ours (only constraint-dependencies, from a
+			// pre-marker run): drop it whole and append a fresh standalone block.
+			out := make([]string, 0, len(lines))
+			out = append(out, lines[:header]...)
+			out = append(out, lines[end:]...)
+			return appendManagedBlock(out, renderToolUvBlock(deps, true)), true
+		}
+		// The table holds user-authored keys: strip our stale constraint-dependencies,
+		// then insert a header-less managed block INSIDE the existing table. Emitting a
+		// second "[tool.uv]" header (as a standalone block would) is invalid TOML —
+		// toml.Decode and uv both reject a table defined twice.
+		lines = removeConstraintDeps(lines, header, end)
+		header, end, _ = tableBounds(lines, "[tool.uv]")
+		// Insert after the last non-blank line of the table body so the managed block
+		// stays under [tool.uv] and any blank line separating the next table is kept.
+		insertAt := end
+		for insertAt > header+1 && strings.TrimSpace(lines[insertAt-1]) == "" {
+			insertAt--
+		}
+		block := renderToolUvBlock(deps, false)
+		out := make([]string, 0, len(lines)+len(block))
+		out = append(out, lines[:insertAt]...)
+		out = append(out, block...)
+		out = append(out, lines[insertAt:]...)
+		return out, true
+	}
+
+	// No [tool.uv] at all: append a fresh standalone managed block at EOF.
+	return appendManagedBlock(lines, renderToolUvBlock(deps, true)), true
+}
+
+// removeManagedToolUv removes the marker-bracketed managed [tool.uv] block, and
+// the one blank line appendManagedBlock puts before a standalone block. A
+// header-less block inside a user [tool.uv] table leaves the table's own keys
+// and blank lines.
+// A standalone block keeps its [tool.uv] header when user keys follow its end
+// marker, because those keys belong to that table.
+func removeManagedToolUv(lines []string) ([]string, bool) {
+	start, stop, found := markerBounds(lines)
+	if !found {
+		return removeUnmarkedConstraintDeps(lines)
+	}
+	var keep []string
+	if slices.ContainsFunc(lines[start:stop+1], func(l string) bool { return headerName(l) == "[tool.uv]" }) {
+		if tableBodyHasKeys(lines, stop+1) {
+			keep = []string{"[tool.uv]"}
+		} else if start > 0 && strings.TrimSpace(lines[start-1]) == "" {
+			start--
+		}
+	}
+	out := make([]string, 0, len(lines)-(stop-start+1)+len(keep))
+	out = append(out, lines[:start]...)
+	out = append(out, keep...)
+	out = append(out, lines[stop+1:]...)
+	return out, true
+}
+
+// removeUnmarkedConstraintDeps removes constraint-dependencies from a plain
+// [tool.uv] table, the form a run before the managed markers wrote. Like
+// mergeToolUv, it drops the whole table when that key is all it holds.
+func removeUnmarkedConstraintDeps(lines []string) ([]string, bool) {
+	header, end, ok := tableBounds(lines, "[tool.uv]")
+	if !ok || !slices.ContainsFunc(lines[header+1:end], constraintDepsRe.MatchString) {
+		return lines, false
+	}
+	if toolUvHasOnlyConstraintDeps(lines, header, end) {
+		out := make([]string, 0, len(lines)-(end-header))
+		out = append(out, lines[:header]...)
+		return append(out, lines[end:]...), true
+	}
+	return removeConstraintDeps(lines, header, end), true
+}
+
+// tableBodyHasKeys reports whether the lines from index from up to the next
+// table header hold anything other than blank lines and comments.
+func tableBodyHasKeys(lines []string, from int) bool {
+	for _, line := range lines[from:] {
+		if tableHeaderRe.MatchString(line) {
+			return false
+		}
+		if t := strings.TrimSpace(line); t != "" && !strings.HasPrefix(t, "#") {
+			return true
+		}
+	}
+	return false
+}
+
+// markerAttachedToToolUv reports whether the managed marker region beginning at
+// index start sits inside an existing [tool.uv] table — i.e. the nearest table
+// header above it is [tool.uv]. When true, the managed block must omit its own
+// [tool.uv] header, because a second header for the same table is invalid TOML.
+func markerAttachedToToolUv(lines []string, start int) bool {
+	for i := start - 1; i >= 0; i-- {
+		if name := headerName(lines[i]); name != "" {
+			return name == "[tool.uv]"
+		}
+	}
+	return false
+}
+
+// constraintDepsRe matches the start of a constraint-dependencies assignment within a
+// [tool.uv] table, capturing its leading whitespace.
+var constraintDepsRe = regexp.MustCompile(`^\s*constraint-dependencies\s*=`)
+
+// protectMultilineStrings replaces TOML multi-line strings with unique ordinary
+// string values while the line-based merge runs. This prevents string contents
+// that resemble tables, assignments, brackets, comments, or managed markers
+// from affecting the merge. The returned restore function puts each original
+// string back byte-for-byte after the managed edits are complete.
+func protectMultilineStrings(s string) (protected string, restore func(string) string, err error) {
+	type replacement struct {
+		placeholder string
+		original    string
+	}
+
+	prefix := "__databricks_setup_local_multiline_"
+	for strings.Contains(s, prefix) {
+		prefix += "_"
+	}
+
+	var replacements []replacement
+	var out strings.Builder
+	for i := 0; i < len(s); {
+		switch {
+		case s[i] == '#':
+			end := strings.IndexByte(s[i:], '\n')
+			if end < 0 {
+				out.WriteString(s[i:])
+				i = len(s)
+				continue
+			}
+			end += i
+			out.WriteString(s[i:end])
+			i = end
+		case strings.HasPrefix(s[i:], `"""`) || strings.HasPrefix(s[i:], "'''"):
+			delimiter := s[i : i+3]
+			end, ok := multilineStringEnd(s, i+3, delimiter)
+			if !ok {
+				return "", nil, errMultilineString
+			}
+			placeholder := fmt.Sprintf(`"%s%d__"`, prefix, len(replacements))
+			replacements = append(replacements, replacement{placeholder: placeholder, original: s[i:end]})
+			out.WriteString(placeholder)
+			i = end
+		case s[i] == '"' || s[i] == '\'':
+			quote := s[i]
+			start := i
+			i++
+			for i < len(s) {
+				if quote == '"' && s[i] == '\\' {
+					i += min(2, len(s)-i)
+					continue
+				}
+				i++
+				if s[i-1] == quote {
+					break
+				}
+			}
+			out.WriteString(s[start:i])
+		default:
+			out.WriteByte(s[i])
+			i++
+		}
+	}
+
+	restore = func(merged string) string {
+		for _, r := range replacements {
+			merged = strings.ReplaceAll(merged, r.placeholder, r.original)
+		}
+		return merged
+	}
+	return out.String(), restore, nil
+}
+
+// multilineStringEnd returns the byte immediately after a multi-line string's
+// closing delimiter. Backslash escapes apply only to basic (double-quoted)
+// strings. Runs of four or five quotes include one or two quotes in the value,
+// followed by the closing three-quote delimiter.
+func multilineStringEnd(s string, start int, delimiter string) (int, bool) {
+	for i := start; i < len(s); {
+		if delimiter == `"""` && s[i] == '\\' {
+			i += min(2, len(s)-i)
+			continue
+		}
+		if strings.HasPrefix(s[i:], delimiter) {
+			run := 3
+			for run < 5 && i+run < len(s) && s[i+run] == delimiter[0] {
+				run++
+			}
+			return i + run, true
+		}
+		i++
+	}
+	return 0, false
+}
+
+// commentStart returns the index of the "#" that begins an inline comment on
+// line, or -1 if there is none. A "#" inside a quoted string is not a comment.
+func commentStart(line string) int {
+	var quote byte
+	for i := 0; i < len(line); i++ {
+		c := line[i]
+		if quote != 0 {
+			if c == '\\' && quote == '"' {
+				i++
+				continue
+			}
+			if c == quote {
+				quote = 0
+			}
+			continue
+		}
+		switch c {
+		case '"', '\'':
+			quote = c
+		case '#':
+			return i
+		}
+	}
+	return -1
+}
+
+// bracketDepthDelta returns the net change in "[" nesting contributed by line.
+// It scans outside TOML strings and stops at an unquoted "#" comment, so a "]"
+// inside a string element (e.g. "requests[security]==2.0") or a trailing comment
+// does not affect the count. It underpins single- vs multi-line array detection;
+// testing strings.Contains(line, "]") instead misreads such lines and corrupts
+// the merge.
+func bracketDepthDelta(line string) int {
+	delta := 0
+	var quote byte // 0 = outside a string; otherwise the opening quote rune
+	for i := 0; i < len(line); i++ {
+		c := line[i]
+		if quote != 0 {
+			if c == '\\' && quote == '"' {
+				i++ // skip the escaped char inside a basic string
+				continue
+			}
+			if c == quote {
+				quote = 0
+			}
+			continue
+		}
+		switch c {
+		case '"', '\'':
+			quote = c
+		case '#':
+			return delta // comment tail: ignore the rest of the line
+		case '[':
+			delta++
+		case ']':
+			delta--
+		}
+	}
+	return delta
+}
+
+// constraintDepsArrayEndDelta reports whether the constraint-dependencies array
+// opening at lines[start] spans multiple lines, and if so the index of its last
+// line. A single-line array (brackets balanced on the opening line) returns
+// (start, false).
+func constraintDepsArrayEnd(lines []string, start, limit int) (last int, multiline bool) {
+	depth := bracketDepthDelta(lines[start])
+	if depth <= 0 {
+		return start, false
+	}
+	for j := start + 1; j < limit; j++ {
+		depth += bracketDepthDelta(lines[j])
+		if depth <= 0 {
+			return j, true
+		}
+	}
+	return limit - 1, true
+}
+
+// toolUvHasOnlyConstraintDeps reports whether the [tool.uv] table body spanning
+// (header, end) contains no meaningful key other than constraint-dependencies. Blank lines
+// and comment-only lines are ignored when deciding "only".
+func toolUvHasOnlyConstraintDeps(lines []string, header, end int) bool {
+	for i := header + 1; i < end; i++ {
+		trimmed := strings.TrimSpace(lines[i])
+		if trimmed == "" || strings.HasPrefix(trimmed, "#") {
+			continue
+		}
+		if !constraintDepsRe.MatchString(lines[i]) {
+			return false
+		}
+		// Skip the continuation lines of a multi-line array so the whole managed
+		// key counts as ignorable (mirrors removeConstraintDeps).
+		last, multiline := constraintDepsArrayEnd(lines, i, end)
+		if multiline {
+			i = last
+		}
+	}
+	return true
+}
+
+// removeConstraintDeps strips a constraint-dependencies key from the [tool.uv] table body
+// spanning (header, end), leaving the table header and all other user keys in place. It
+// handles both the single-line array form and the multi-line array form (the value spans
+// several lines until the array's brackets balance).
+func removeConstraintDeps(lines []string, header, end int) []string {
+	for i := header + 1; i < end; i++ {
+		if !constraintDepsRe.MatchString(lines[i]) {
+			continue
+		}
+		last, _ := constraintDepsArrayEnd(lines, i, end)
+		end2 := last + 1
+		out := make([]string, 0, len(lines)-(end2-i))
+		out = append(out, lines[:i]...)
+		out = append(out, lines[end2:]...)
+		return out
+	}
+	return lines
+}
+
+// markerBounds returns the indices of the managed marker start and end lines, if present.
+func markerBounds(lines []string) (start, stop int, found bool) {
+	start, stop = -1, -1
+	for i, line := range lines {
+		if strings.TrimSpace(line) == managedMarkerStart {
+			start = i
+			break
+		}
+	}
+	if start == -1 {
+		return -1, -1, false
+	}
+	for i := start + 1; i < len(lines); i++ {
+		if strings.TrimSpace(lines[i]) == managedMarkerEnd {
+			stop = i
+			break
+		}
+	}
+	if stop == -1 {
+		return -1, -1, false
+	}
+	return start, stop, true
+}
+
+// renderToolUvBlock builds the marker-bracketed managed block lines (no surrounding
+// blank lines). When withHeader is true it emits its own "[tool.uv]" table header
+// (standalone block appended at EOF); when false it omits the header so the block can
+// be nested inside a user-authored [tool.uv] table without defining the table twice.
+func renderToolUvBlock(deps []string, withHeader bool) []string {
+	block := []string{managedMarkerStart}
+	if withHeader {
+		block = append(block, "[tool.uv]")
+	}
+	block = append(block, "constraint-dependencies = [")
+	for _, d := range deps {
+		block = append(block, fmt.Sprintf("    %q,", d))
+	}
+	block = append(block, "]", managedMarkerEnd)
+	return block
+}
+
+// appendManagedBlock appends block to lines, ensuring exactly one blank line separates it
+// from prior content and the file ends with a single trailing newline.
+func appendManagedBlock(lines, block []string) []string {
+	// strings.Split on a trailing "\n" leaves a final empty element; drop trailing empty
+	// lines so we control the spacing precisely.
+	for len(lines) > 0 && lines[len(lines)-1] == "" {
+		lines = lines[:len(lines)-1]
+	}
+
+	out := make([]string, 0, len(lines)+len(block)+2)
+	out = append(out, lines...)
+	if len(out) > 0 {
+		out = append(out, "") // exactly one blank line before the managed block
+	}
+	out = append(out, block...)
+	out = append(out, "") // trailing newline after final join
+	return out
+}
+
+// equalLines reports whether two line slices are identical.
+func equalLines(a, b []string) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for i := range a {
+		if a[i] != b[i] {
+			return false
+		}
+	}
+	return true
+}
+
+// freshProjectVersion is the placeholder version written into a greenfield
+// [project] table. uv rejects a [project] table that has neither project.version
+// nor project.dynamic containing "version", even for a non-distributed local
+// environment, so a concrete value is required for `uv sync` to succeed.
+const freshProjectVersion = "0.0.0"
+
+// RenderFreshPyproject produces a complete managed pyproject.toml for a project that has
+// none, with [project], [dependency-groups].dev (carrying the databricks-connect pin), the
+// [tool.databricks.environment] section (serverless targets only), and the marker-bracketed
+// [tool.uv] constraint block. When databricks-connect is skipped (--no-dbconnect /
+// --constraints-only) or the artifact carries no pin, the dev group is emitted empty.
+func RenderFreshPyproject(projectName string, c Constraints, opts MergeOptions) []byte {
+	var b strings.Builder
+	b.WriteString("[project]\n")
+	fmt.Fprintf(&b, "name = %q\n", projectName)
+	// uv requires project.version when a [project] table is present.
+	fmt.Fprintf(&b, "version = %q\n", freshProjectVersion)
+	// Omitted under SkipConstraints, letting uv pick the interpreter for the project.
+	if !opts.SkipConstraints {
+		fmt.Fprintf(&b, "requires-python = %q\n", c.RequiresPython)
+	}
+	b.WriteString("\n")
+	b.WriteString("[dependency-groups]\n")
+	if !opts.SkipDBConnect && c.DatabricksConnect != "" {
+		b.WriteString("dev = [\n")
+		fmt.Fprintf(&b, "    %q,\n", c.DatabricksConnect)
+		b.WriteString("]\n")
+	} else {
+		b.WriteString("dev = []\n")
+	}
+	b.WriteString("\n")
+	// The serverless environment version is written only for serverless targets;
+	// a cluster target leaves EnvironmentVersion empty and omits the section.
+	if c.EnvironmentVersion != "" {
+		b.WriteString(databricksEnvironmentTable + "\n")
+		fmt.Fprintf(&b, "environment_version = %q\n", c.EnvironmentVersion)
+		b.WriteString("\n")
+	}
+	// Written whenever constraints are managed — an empty block when the artifact
+	// carries no constraint-dependencies (nil and empty are treated alike).
+	if !opts.SkipConstraints {
+		for _, line := range renderToolUvBlock(c.ConstraintDeps, true) {
+			b.WriteString(line)
+			b.WriteString("\n")
+		}
+	}
+	return []byte(b.String())
+}
diff --git a/libs/localenv/merge_test.go b/libs/localenv/merge_test.go
new file mode 100644
index 00000000000..2bf2b741b32
--- /dev/null
+++ b/libs/localenv/merge_test.go
@@ -0,0 +1,1428 @@
+package localenv
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/BurntSushi/toml"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// requireValidTOML fails the test if b is not parseable TOML. String-only
+// assertions miss structural corruption such as a table header emitted twice
+// ("Key 'tool.uv' has already been defined"), which uv also rejects on sync.
+func requireValidTOML(t *testing.T, b []byte) {
+	t.Helper()
+	var v map[string]any
+	_, err := toml.Decode(string(b), &v)
+	require.NoError(t, err, "merged output must be valid TOML:\n%s", b)
+}
+
+func testConstraints() Constraints {
+	return Constraints{
+		RequiresPython:    "==3.12.*",
+		DatabricksConnect: "databricks-connect~=17.2.0",
+		ConstraintDeps:    []string{"pydantic~=2.10.6", "anyio~=4.6.2"},
+	}
+}
+
+func TestMergeReplacesRequiresPythonPreservingComments(t *testing.T) {
+	in := []byte(`[project]
+name = "demo"
+# keep this comment
+requires-python = ">=3.10"
+
+[dependency-groups]
+dev = [
+    "databricks-connect~=16.0.0",
+    "pytest~=8.0",
+]
+`)
+	out, regions, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	assert.Contains(t, string(out), `requires-python = "==3.12.*"`)
+	assert.Contains(t, string(out), "# keep this comment")
+	assert.Contains(t, string(out), `"databricks-connect~=17.2.0",`)
+	assert.Contains(t, string(out), `"pytest~=8.0",`)
+	assert.Contains(t, regions, "requires-python")
+	assert.Contains(t, regions, "databricks-connect")
+	assert.Contains(t, regions, "tool.uv.constraint-dependencies")
+	assert.Contains(t, string(out), "pydantic~=2.10.6")
+}
+
+func TestMergeIsIdempotent(t *testing.T) {
+	in := []byte(`[project]
+requires-python = ">=3.10"
+
+[dependency-groups]
+dev = [
+    "databricks-connect~=16.0.0",
+]
+`)
+	once, _, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	twice, _, err := MergeManaged(once, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	assert.Equal(t, string(once), string(twice))
+}
+
+func TestMergeInsertsRequiresPythonWhenMissing(t *testing.T) {
+	in := []byte(`[project]
+name = "demo"
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0.0"]
+`)
+	out, _, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	assert.Contains(t, string(out), `requires-python = "==3.12.*"`)
+}
+
+func TestMergeReplacesExistingManagedToolUvBlock(t *testing.T) {
+	in := []byte(`[project]
+requires-python = ">=3.10"
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0.0"]
+
+` + managedMarkerStart + `
+[tool.uv]
+constraint-dependencies = [
+    "stale~=1.0.0",
+]
+` + managedMarkerEnd + `
+`)
+	out, _, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	assert.NotContains(t, string(out), "stale~=1.0.0")
+	assert.Contains(t, string(out), "pydantic~=2.10.6")
+	// Only one managed block remains.
+	assert.Equal(t, 1, countOccurrences(string(out), managedMarkerStart))
+}
+
+func TestMergePreservesCRLF(t *testing.T) {
+	in := []byte("[project]\r\nrequires-python = \">=3.10\"\r\n\r\n[dependency-groups]\r\ndev = [\"databricks-connect~=16.0.0\"]\r\n")
+	out, _, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	assert.Contains(t, string(out), "\r\n")
+	assert.Contains(t, string(out), `requires-python = "==3.12.*"`)
+	// Merging the CRLF output again must be byte-identical (idempotent under \r\n).
+	twice, _, err := MergeManaged(out, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	assert.Equal(t, string(out), string(twice))
+}
+
+func TestMergePreservesUserToolUvKeys(t *testing.T) {
+	in := []byte(`[project]
+requires-python = ">=3.10"
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0.0"]
+
+[tool.uv]
+package = true
+dev-dependencies = ["ruff"]
+`)
+	out, _, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	s := string(out)
+	assert.Contains(t, s, "[tool.uv]")
+	assert.Contains(t, s, "package = true")
+	assert.Contains(t, s, `dev-dependencies = ["ruff"]`)
+	assert.Contains(t, s, managedMarkerStart)
+	assert.Contains(t, s, "pydantic~=2.10.6")
+	// The user's keys must live outside the managed marker block.
+	start := strings.Index(s, managedMarkerStart)
+	require.GreaterOrEqual(t, start, 0)
+	assert.NotContains(t, s[start:], "package = true")
+	assert.NotContains(t, s[start:], `dev-dependencies = ["ruff"]`)
+	// The result must be valid TOML: the managed constraint-dependencies nests
+	// inside the user's [tool.uv] rather than emitting a second [tool.uv] header.
+	requireValidTOML(t, out)
+	assert.Equal(t, 1, countOccurrences(s, "[tool.uv]"))
+	// Merge-twice is byte-identical (header-less managed region stays header-less).
+	twice, _, err := MergeManaged(out, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	assert.Equal(t, s, string(twice))
+	requireValidTOML(t, twice)
+}
+
+func TestMergeStripsStaleConstraintDepsFromUserToolUv(t *testing.T) {
+	in := []byte(`[project]
+requires-python = ">=3.10"
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0.0"]
+
+[tool.uv]
+package = true
+constraint-dependencies = ["old~=1.0"]
+`)
+	out, _, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	s := string(out)
+	assert.Contains(t, s, "package = true")
+	// The stale constraint must be gone from the user table; the managed block has the new deps.
+	assert.NotContains(t, s, "old~=1.0")
+	assert.Contains(t, s, "pydantic~=2.10.6")
+	// Valid TOML with a single [tool.uv]: the managed deps nest in the user table.
+	requireValidTOML(t, out)
+	assert.Equal(t, 1, countOccurrences(s, "[tool.uv]"))
+	// Merge-twice is byte-identical.
+	twice, _, err := MergeManaged(out, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	assert.Equal(t, string(out), string(twice))
+}
+
+func TestMergeRemovesOwnedOnlyToolUv(t *testing.T) {
+	in := []byte(`[project]
+requires-python = ">=3.10"
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0.0"]
+
+[tool.uv]
+constraint-dependencies = ["old~=1.0"]
+`)
+	out, _, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	s := string(out)
+	assert.NotContains(t, s, "old~=1.0")
+	assert.Contains(t, s, "pydantic~=2.10.6")
+	// The plain table was removed and replaced by exactly one managed block.
+	assert.Equal(t, 1, countOccurrences(s, "[tool.uv]"))
+	assert.Equal(t, 1, countOccurrences(s, managedMarkerStart))
+	requireValidTOML(t, out)
+}
+
+func TestMergeRemovesOwnedOnlyMultiLineToolUv(t *testing.T) {
+	in := []byte(`[project]
+requires-python = ">=3.10"
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0.0"]
+
+[tool.uv]
+constraint-dependencies = [
+    "old~=1.0",
+]
+`)
+	out, _, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	s := string(out)
+	assert.NotContains(t, s, "old~=1.0")
+	assert.Contains(t, s, "pydantic~=2.10.6")
+	// The multi-line owned-only table was removed whole, leaving exactly one
+	// [tool.uv] (inside the managed block) and no stray empty header.
+	assert.Equal(t, 1, countOccurrences(s, "[tool.uv]"))
+	assert.Equal(t, 1, countOccurrences(s, managedMarkerStart))
+	requireValidTOML(t, out)
+	// Merge-twice is byte-identical.
+	twice, _, err := MergeManaged(out, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	assert.Equal(t, string(out), string(twice))
+}
+
+func TestMergeReplacesSingleLineDevArray(t *testing.T) {
+	in := []byte(`[project]
+requires-python = ">=3.10"
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0.0", "pytest~=8.0"]
+`)
+	out, regions, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	// Sibling element and single-line array layout are preserved.
+	assert.Contains(t, string(out), `dev = ["databricks-connect~=17.2.0", "pytest~=8.0"]`)
+	assert.Contains(t, regions, "databricks-connect")
+}
+
+func TestMergePreservesMultiLineTrailingComma(t *testing.T) {
+	in := []byte(`[project]
+requires-python = ">=3.10"
+
+[dependency-groups]
+dev = [
+    "databricks-connect~=16.0.0",
+]
+`)
+	out, _, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	// The trailing comma on the managed element is preserved.
+	assert.Contains(t, string(out), `    "databricks-connect~=17.2.0",`)
+}
+
+func TestMergeInsertsDatabricksConnectMultiLine(t *testing.T) {
+	// Existing project with a dev group that does not pin databricks-connect: the
+	// pin must be inserted (mirroring greenfield) rather than left absent.
+	in := []byte(`[project]
+requires-python = ">=3.10"
+
+[dependency-groups]
+dev = [
+    "pytest~=8.0",
+]
+`)
+	out, regions, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	s := string(out)
+	assert.Contains(t, s, `"databricks-connect~=17.2.0",`)
+	assert.Contains(t, s, `"pytest~=8.0",`, "existing element preserved")
+	assert.Contains(t, regions, "databricks-connect")
+	// Idempotent: a second merge finds the element and rewrites in place.
+	out2, _, err := MergeManaged(out, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	assert.Equal(t, s, string(out2))
+}
+
+func TestMergeInsertsDatabricksConnectSingleLine(t *testing.T) {
+	in := []byte(`[project]
+requires-python = ">=3.10"
+
+[dependency-groups]
+dev = ["pytest~=8.0"]
+`)
+	out, _, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	assert.Contains(t, string(out), `dev = ["databricks-connect~=17.2.0", "pytest~=8.0"]`)
+	out2, _, err := MergeManaged(out, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	assert.Equal(t, string(out), string(out2))
+}
+
+func TestMergeInsertsDatabricksConnectEmptyDev(t *testing.T) {
+	in := []byte(`[project]
+requires-python = ">=3.10"
+
+[dependency-groups]
+dev = []
+`)
+	out, _, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	assert.Contains(t, string(out), `dev = ["databricks-connect~=17.2.0"]`)
+}
+
+func TestMergeInsertsDevKeyWhenAbsent(t *testing.T) {
+	in := []byte(`[project]
+requires-python = ">=3.10"
+
+[dependency-groups]
+test = ["pytest~=8.0"]
+`)
+	out, _, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	s := string(out)
+	assert.Contains(t, s, `"databricks-connect~=17.2.0",`)
+	assert.Contains(t, s, `test = ["pytest~=8.0"]`, "sibling group untouched")
+	out2, _, err := MergeManaged(out, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	assert.Equal(t, s, string(out2))
+}
+
+func TestMergeInsertsDependencyGroupsWhenAbsent(t *testing.T) {
+	in := []byte(`[project]
+requires-python = ">=3.10"
+`)
+	out, _, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	s := string(out)
+	assert.Contains(t, s, "[dependency-groups]")
+	assert.Contains(t, s, `"databricks-connect~=17.2.0",`)
+	out2, _, err := MergeManaged(out, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	assert.Equal(t, s, string(out2))
+}
+
+func TestMergeReplacesDatabricksConnectOnDevLine(t *testing.T) {
+	// The pin shares the opening "dev = [" line of a multi-line array. It must be
+	// rewritten in place, not duplicated by the insert path.
+	in := []byte(`[project]
+requires-python = ">=3.10"
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0.0",
+    "pytest~=8.0",
+]
+`)
+	out, _, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	s := string(out)
+	assert.Equal(t, 1, strings.Count(s, "databricks-connect"), "must not duplicate the pin")
+	assert.Contains(t, s, "databricks-connect~=17.2.0")
+	assert.NotContains(t, s, "databricks-connect~=16.0.0")
+}
+
+func TestMergeReplacesDatabricksConnectWithTrailingComment(t *testing.T) {
+	// The pin element carries a trailing comment. It must be rewritten in place
+	// (comment preserved), not duplicated.
+	in := []byte(`[project]
+requires-python = ">=3.10"
+
+[dependency-groups]
+dev = [
+    "databricks-connect~=16.0.0", # keep me
+    "pytest~=8.0",
+]
+`)
+	out, _, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	s := string(out)
+	assert.Equal(t, 1, strings.Count(s, "databricks-connect"), "must not duplicate the pin")
+	assert.Contains(t, s, `"databricks-connect~=17.2.0", # keep me`)
+}
+
+func TestMergePreservesCommentMentioningDatabricksConnect(t *testing.T) {
+	// A trailing comment that itself contains a quoted "databricks-connect..."
+	// token must be preserved byte-for-byte; only the code element is rewritten.
+	in := []byte(`[project]
+requires-python = ">=3.10"
+
+[dependency-groups]
+dev = [
+    "databricks-connect~=16.0.0", # was "databricks-connect~=16.0.0"
+    "pytest~=8.0",
+]
+`)
+	out, _, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	s := string(out)
+	// Code element is rewritten; the comment mention is left verbatim.
+	assert.Contains(t, s, `"databricks-connect~=17.2.0", # was "databricks-connect~=16.0.0"`)
+	assert.Equal(t, 1, strings.Count(s, "databricks-connect~=16.0.0"), "only the comment mention of the old pin remains")
+}
+
+func TestMergeRewritesNonCanonicalDatabricksConnectSpelling(t *testing.T) {
+	// A pin spelled with PEP 503-equivalent separators/case must be rewritten in
+	// place, not left undetected so the insert path adds a conflicting second pin.
+	for _, spelling := range []string{"databricks_connect", "Databricks-Connect", "databricks.connect"} {
+		in := []byte("[project]\nrequires-python = \">=3.10\"\n\n[dependency-groups]\ndev = [\n    \"" + spelling + "~=16.0.0\",\n]\n")
+		out, _, err := MergeManaged(in, testConstraints(), MergeOptions{})
+		require.NoError(t, err, spelling)
+		s := string(out)
+		assert.Equal(t, 1, strings.Count(s, `"databricks-connect~=17.2.0"`), "spelling %q must be rewritten in place, not duplicated:\n%s", spelling, s)
+		assert.NotContains(t, s, "~=16.0.0", "old pin (any spelling) must be gone")
+	}
+}
+
+func TestMergeInsertsCommaWhenLastElementHasNone(t *testing.T) {
+	// TOML permits the final array element to omit its trailing comma. Inserting
+	// after it must first add the separating comma, or the result is invalid TOML.
+	in := []byte(`[project]
+requires-python = ">=3.10"
+
+[dependency-groups]
+dev = [
+    "pytest~=8.0"
+]
+`)
+	out, _, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	s := string(out)
+	assert.Contains(t, s, `"pytest~=8.0",`, "previous last element gains a separating comma")
+	assert.Contains(t, s, `"databricks-connect~=17.2.0",`)
+	// Round-trips as valid TOML.
+	out2, _, err := MergeManaged(out, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	assert.Equal(t, s, string(out2))
+}
+
+func TestMergeConstraintsOnlyDoesNotInsertDatabricksConnect(t *testing.T) {
+	// Empty DatabricksConnect (constraints-only) must not add a pin.
+	in := []byte(`[project]
+requires-python = ">=3.10"
+
+[dependency-groups]
+dev = ["pytest~=8.0"]
+`)
+	c := testConstraints()
+	c.DatabricksConnect = ""
+	out, regions, err := MergeManaged(in, c, MergeOptions{})
+	require.NoError(t, err)
+	assert.NotContains(t, string(out), "databricks-connect")
+	assert.NotContains(t, regions, "databricks-connect")
+}
+
+func TestRenderFreshPyproject(t *testing.T) {
+	out := RenderFreshPyproject("demo", testConstraints(), MergeOptions{})
+	s := string(out)
+	assert.Contains(t, s, `name = "demo"`)
+	assert.Contains(t, s, `requires-python = "==3.12.*"`)
+	assert.Contains(t, s, `"databricks-connect~=17.2.0",`)
+	assert.Contains(t, s, managedMarkerStart)
+	assert.Contains(t, s, managedMarkerEnd)
+	assert.Contains(t, s, "pydantic~=2.10.6")
+	// A cluster target (no EnvironmentVersion) writes no [tool.databricks.environment].
+	assert.NotContains(t, s, "[tool.databricks.environment]")
+	// A fresh render is itself a no-op under MergeManaged (already fully managed).
+	merged, _, err := MergeManaged(out, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	assert.Equal(t, s, string(merged))
+}
+
+func TestRenderFreshPyprojectServerlessWritesEnvironment(t *testing.T) {
+	c := testConstraints()
+	c.EnvironmentVersion = "5"
+	out := RenderFreshPyproject("demo", c, MergeOptions{})
+	s := string(out)
+	assert.Contains(t, s, "[tool.databricks.environment]")
+	assert.Contains(t, s, `environment_version = "5"`)
+	requireValidTOML(t, out)
+	// A fresh render is itself a no-op under MergeManaged (already fully managed).
+	merged, _, err := MergeManaged(out, c, MergeOptions{})
+	require.NoError(t, err)
+	assert.Equal(t, s, string(merged))
+}
+
+func TestMergeInsertsDatabricksEnvironmentWhenAbsent(t *testing.T) {
+	in := []byte(`[project]
+requires-python = ">=3.10"
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0.0"]
+`)
+	c := testConstraints()
+	c.EnvironmentVersion = "5"
+	out, regions, err := MergeManaged(in, c, MergeOptions{})
+	require.NoError(t, err)
+	s := string(out)
+	assert.Contains(t, s, "[tool.databricks.environment]")
+	assert.Contains(t, s, `environment_version = "5"`)
+	assert.Contains(t, regions, regionDatabricksEnvironment)
+	requireValidTOML(t, out)
+	// Idempotent.
+	twice, _, err := MergeManaged(out, c, MergeOptions{})
+	require.NoError(t, err)
+	assert.Equal(t, s, string(twice))
+}
+
+func TestMergeReplacesExistingEnvironmentVersionPreservingComment(t *testing.T) {
+	in := []byte(`[project]
+requires-python = ">=3.10"
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0.0"]
+
+[tool.databricks.environment]
+environment_version = "4"  # pinned
+`)
+	c := testConstraints()
+	c.EnvironmentVersion = "5"
+	out, regions, err := MergeManaged(in, c, MergeOptions{})
+	require.NoError(t, err)
+	s := string(out)
+	assert.Contains(t, s, `environment_version = "5"  # pinned`)
+	assert.NotContains(t, s, `environment_version = "4"`)
+	assert.Contains(t, regions, regionDatabricksEnvironment)
+	// The table is refreshed in place, not duplicated.
+	assert.Equal(t, 1, countOccurrences(s, "[tool.databricks.environment]"))
+	requireValidTOML(t, out)
+}
+
+func TestMergeInsertsEnvironmentVersionKeyWhenTableExists(t *testing.T) {
+	in := []byte(`[project]
+requires-python = ">=3.10"
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0.0"]
+
+[tool.databricks.environment]
+# user note
+`)
+	c := testConstraints()
+	c.EnvironmentVersion = "5"
+	out, _, err := MergeManaged(in, c, MergeOptions{})
+	require.NoError(t, err)
+	s := string(out)
+	assert.Contains(t, s, `environment_version = "5"`)
+	assert.Contains(t, s, "# user note")
+	assert.Equal(t, 1, countOccurrences(s, "[tool.databricks.environment]"))
+	requireValidTOML(t, out)
+}
+
+func TestMergeEnvironmentNoopForClusterTarget(t *testing.T) {
+	// A cluster target leaves EnvironmentVersion empty: the section is never
+	// written, and an existing one is left untouched rather than removed.
+	in := []byte(`[project]
+requires-python = ">=3.10"
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0.0"]
+
+[tool.databricks.environment]
+environment_version = "4"
+`)
+	c := testConstraints() // EnvironmentVersion == "": cluster target.
+	out, regions, err := MergeManaged(in, c, MergeOptions{})
+	require.NoError(t, err)
+	assert.Contains(t, string(out), `environment_version = "4"`)
+	assert.NotContains(t, regions, regionDatabricksEnvironment)
+}
+
+func TestMergeAddsEnvironmentToPreFeatureManagedFile(t *testing.T) {
+	// The common upgrade path: a file a pre-feature CLI wrote for a serverless
+	// target already carries the managed [tool.uv] marker block but no
+	// [tool.databricks.environment] section. Re-running the new CLI must add the
+	// section, keep exactly one managed block, and stay idempotent.
+	in := []byte(`[project]
+name = "demo"
+version = "0.0.0"
+requires-python = "==3.12.*"
+
+[dependency-groups]
+dev = [
+    "databricks-connect~=17.2.0",
+]
+
+` + managedMarkerStart + `
+[tool.uv]
+constraint-dependencies = [
+    "pydantic~=2.10.6",
+    "anyio~=4.6.2",
+]
+` + managedMarkerEnd + `
+`)
+	c := testConstraints()
+	c.EnvironmentVersion = "5"
+	out, regions, err := MergeManaged(in, c, MergeOptions{})
+	require.NoError(t, err)
+	s := string(out)
+	assert.Contains(t, s, "[tool.databricks.environment]")
+	assert.Contains(t, s, `environment_version = "5"`)
+	assert.Contains(t, regions, regionDatabricksEnvironment)
+	// The pre-existing managed [tool.uv] block is neither duplicated nor disturbed.
+	assert.Equal(t, 1, countOccurrences(s, managedMarkerStart))
+	assert.Equal(t, 1, countOccurrences(s, "[tool.databricks.environment]"))
+	requireValidTOML(t, out)
+	// Idempotent on the upgraded file.
+	twice, _, err := MergeManaged(out, c, MergeOptions{})
+	require.NoError(t, err)
+	assert.Equal(t, s, string(twice))
+}
+
+func TestMergeStripsMultiLineConstraintDepsWithBracketInFirstElement(t *testing.T) {
+	// The user's stale constraint-dependencies is a multi-line array whose FIRST
+	// element line contains a "]" inside an extras spec. A naive
+	// strings.Contains(line, "]") check would misread this as single-line and
+	// strip only the first element, orphaning the rest and producing invalid TOML.
+	in := []byte(`[project]
+requires-python = ">=3.10"
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0.0"]
+
+[tool.uv]
+package = true
+constraint-dependencies = ["requests[security]~=2.0",
+    "old-dep~=1.0",
+]
+`)
+	out, _, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	s := string(out)
+	// The whole stale array is gone (both the bracket-bearing first element and
+	// the continuation), replaced by the managed deps.
+	assert.NotContains(t, s, "requests[security]")
+	assert.NotContains(t, s, "old-dep~=1.0")
+	assert.Contains(t, s, "package = true")
+	assert.Contains(t, s, "pydantic~=2.10.6")
+	requireValidTOML(t, out)
+	assert.Equal(t, 1, countOccurrences(s, "[tool.uv]"))
+	// Idempotent.
+	twice, _, err := MergeManaged(out, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	assert.Equal(t, s, string(twice))
+}
+
+func TestBracketDepthDeltaIgnoresStringsAndComments(t *testing.T) {
+	cases := map[string]int{
+		`constraint-dependencies = [`:                    1,  // opens, no close
+		`constraint-dependencies = ["a", "b"]`:           0,  // balanced single-line
+		`constraint-dependencies = ["requests[sec]~=2",`: 1,  // ] inside string ignored
+		`    "old~=1.0",`:                                0,  // element line
+		`]`:                                              -1, // close
+		`]  # trailing note ]`:                           -1, // ] in comment ignored
+		`constraint-dependencies = ["x"]  # [note]`:      0,  // comment ] ignored
+	}
+	for line, want := range cases {
+		assert.Equal(t, want, bracketDepthDelta(line), "line: %q", line)
+	}
+}
+
+func TestMergeConsolidatesDatabricksConnectFromSiblingGroup(t *testing.T) {
+	// databricks-connect is fully owned by setup-local in the install flow: a stray pin
+	// in a sibling group (docs) makes uv unsatisfiable, so it is removed and the managed
+	// pin lives only in dev. This deliberately overrides the "sibling groups untouched"
+	// rule that scopes mergeDatabricksConnect, but only for databricks-connect.
+	in := []byte(`[project]
+requires-python = ">=3.10"
+
+[dependency-groups]
+docs = ["databricks-connect~=14.3"]
+dev = [
+    "databricks-connect~=16.0.0",
+]
+`)
+	out, _, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	s := string(out)
+	// docs consolidated (its db-connect removed); dev updated to the managed pin.
+	assert.Contains(t, s, `docs = []`)
+	assert.NotContains(t, s, `databricks-connect~=14.3`)
+	assert.Contains(t, s, `"databricks-connect~=17.2.0",`)
+	requireValidTOML(t, out)
+}
+
+func TestMergeConsolidatesDatabricksConnectFromProjectDeps(t *testing.T) {
+	// The reported bug: a template ships databricks-connect in [project].dependencies
+	// while the dev group carries a different pin, so uv cannot co-resolve them. The
+	// merge removes the [project].dependencies pin and manages db-connect only in dev.
+	in := []byte(`[project]
+requires-python = ">=3.10"
+dependencies = [
+    "databricks-dlt",
+    "pytest",
+    "databricks-connect==15.1.*",
+]
+
+[dependency-groups]
+dev = [
+    "databricks-connect~=16.0",
+]
+`)
+	out, regions, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	s := string(out)
+	assert.NotContains(t, s, "databricks-connect==15.1.*", "the stray project.dependencies pin is removed")
+	assert.Contains(t, s, `"databricks-dlt",`, "sibling dependencies are preserved")
+	assert.Contains(t, s, `"pytest",`)
+	assert.Contains(t, s, `"databricks-connect~=17.2.0",`, "dev carries the single managed pin")
+	assert.Contains(t, regions, regionDatabricksConnect)
+	requireValidTOML(t, out)
+
+	// Idempotent: a second merge finds nothing to remove and produces identical bytes.
+	out2, _, err := MergeManaged(out, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	assert.Equal(t, string(out), string(out2))
+}
+
+func TestMergeConsolidatesDatabricksConnectEmptiesSingleLineArray(t *testing.T) {
+	// Removing the only element of a single-line array leaves a valid empty array,
+	// not a dangling comma.
+	in := []byte(`[project]
+requires-python = ">=3.10"
+
+[project.optional-dependencies]
+spark = ["databricks-connect==15.0.0"]
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0"]
+`)
+	out, _, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	s := string(out)
+	assert.Contains(t, s, "spark = []", "the optional-dependency extra is emptied")
+	assert.NotContains(t, s, "databricks-connect==15.0.0")
+	requireValidTOML(t, out)
+}
+
+func TestMergeConsolidatesLeavesOtherElementsInArray(t *testing.T) {
+	// Only the databricks-connect element is removed from a mixed single-line array;
+	// the surviving elements and the array structure stay intact.
+	in := []byte(`[project]
+requires-python = ">=3.10"
+dependencies = ["numpy", "databricks-connect==15.1.*", "pytest"]
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0"]
+`)
+	out, _, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	s := string(out)
+	assert.Contains(t, s, `dependencies = ["numpy", "pytest"]`)
+	assert.NotContains(t, s, "databricks-connect==15.1.*")
+	requireValidTOML(t, out)
+}
+
+func TestMergeKeepsCompatibleDatabricksConnectPins(t *testing.T) {
+	// Only a databricks-connect pin that provably cannot co-resolve with the managed
+	// pin is removed. A pin that overlaps it, carries no version, or is marker-gated
+	// resolves fine, so it is left in place — the merge does not silently rewrite a
+	// user declaration (including [project].dependencies wheel metadata) that isn't
+	// broken. env pin here is ~=17.2.0.
+	in := []byte(`[project]
+requires-python = ">=3.10"
+dependencies = [
+    "databricks-connect>=15",
+    "databricks-connect ; python_version < '3.13'",
+]
+
+[project.optional-dependencies]
+extra = ["databricks-connect"]
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0"]
+test = ["databricks-connect>=15,<20"]
+`)
+	out, _, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	s := string(out)
+	assert.Contains(t, s, `"databricks-connect>=15",`, "an overlapping pin co-resolves and is kept")
+	assert.Contains(t, s, "python_version < '3.13'", "a marker-gated pin is not compared and is kept")
+	assert.Contains(t, s, `extra = ["databricks-connect"]`, "an unversioned pin is kept")
+	assert.Contains(t, s, `test = ["databricks-connect>=15,<20"]`, "an overlapping ranged pin in another group is kept")
+	assert.Contains(t, s, `"databricks-connect~=17.2.0"`, "the dev pin is still updated to the managed version")
+	requireValidTOML(t, out)
+}
+
+func TestMergeKeepsEnvEqualPinInProjectDeps(t *testing.T) {
+	// A [project].dependencies pin that already equals the managed version is not
+	// disjoint from it, so it is left in place — the only declaration in the wheel
+	// metadata is never silently deleted, and no consolidation warning is emitted.
+	in := []byte(`[project]
+requires-python = ">=3.10"
+dependencies = ["databricks-connect~=17.2.0"]
+`)
+	out, _, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	assert.Contains(t, string(out), `dependencies = ["databricks-connect~=17.2.0"]`, "the env-equal pin is kept")
+	requireValidTOML(t, out)
+}
+
+func TestMergeKeepsClosingBracketOnItsOwnLine(t *testing.T) {
+	// Removing the last element of a multi-line array with no trailing comma on it must
+	// not pull the closing "]" up onto the previous element's line (a common uv-init shape).
+	in := []byte(`[project]
+requires-python = ">=3.10"
+dependencies = [
+    "databricks-dlt",
+    "pytest",
+    "databricks-connect==15.1.*"
+]
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0"]
+`)
+	out, _, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	s := string(out)
+	assert.NotContains(t, s, "databricks-connect==15.1.*")
+	assert.Contains(t, s, "\n    \"pytest\",\n]", "the closing bracket keeps its own line and the trailing comma survives")
+	assert.NotContains(t, s, `"pytest"]`, "the bracket is not pulled up")
+	requireValidTOML(t, out)
+}
+
+func TestMergeConstraintsOnlyLeavesDatabricksConnectUntouched(t *testing.T) {
+	// In constraints-only mode (empty DatabricksConnect) databricks-connect is not
+	// managed at all: no pin is inserted and no stray is removed, anywhere.
+	in := []byte(`[project]
+requires-python = ">=3.10"
+dependencies = ["databricks-connect==15.1.*"]
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0"]
+docs = ["databricks-connect~=14.3"]
+`)
+	c := Constraints{RequiresPython: "==3.12.*", ConstraintDeps: []string{"pydantic~=2.10.6"}}
+	out, regions, err := MergeManaged(in, c, MergeOptions{})
+	require.NoError(t, err)
+	s := string(out)
+	assert.Contains(t, s, "databricks-connect==15.1.*", "project.dependencies pin left untouched")
+	assert.Contains(t, s, "databricks-connect~=16.0", "dev pin left untouched")
+	assert.Contains(t, s, "databricks-connect~=14.3", "sibling group left untouched")
+	assert.NotContains(t, regions, regionDatabricksConnect)
+	requireValidTOML(t, out)
+}
+
+func TestMergeConsolidatesStrayAfterCommentedElement(t *testing.T) {
+	// A stray databricks-connect element whose token carries a leading comment (from
+	// the previous element's trailing comment, or the opening "[" line) must still be
+	// removed. dbconnectElementPin scans the token per line so the leading comment does
+	// not hide the quoted requirement on the next line.
+	cases := map[string]string{
+		"trailing comment on previous element": `[project]
+requires-python = ">=3.10"
+dependencies = [
+    "pytest",  # test runner
+    "databricks-connect==15.1.*",
+]
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0"]
+`,
+		"comment on the opening bracket line": `[project]
+requires-python = ">=3.10"
+dependencies = [  # runtime deps
+    "databricks-connect==15.1.*",
+    "pytest",
+]
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0"]
+`,
+	}
+	// A comment on a surviving element (or the opening line) must be preserved; the
+	// removal only drops the databricks-connect element, not the neighbouring comment.
+	wantComment := map[string]string{
+		"trailing comment on previous element": "# test runner",
+		"comment on the opening bracket line":  "# runtime deps",
+	}
+	for name, in := range cases {
+		out, _, err := MergeManaged([]byte(in), testConstraints(), MergeOptions{})
+		require.NoError(t, err, name)
+		s := string(out)
+		assert.NotContains(t, s, "databricks-connect==15.1.*", name)
+		assert.Contains(t, s, `"pytest",`, name)
+		assert.Contains(t, s, `"databricks-connect~=17.2.0"`, name)
+		assert.Contains(t, s, wantComment[name], name+": neighbouring comment must be preserved")
+		requireValidTOML(t, out)
+	}
+}
+
+func TestMergeConsolidatesSecondDevPinAfterCommentedManagedPin(t *testing.T) {
+	// The dev-group keepFirst dedup must also see through a comment: the managed pin
+	// carries a trailing comment, and the second databricks-connect on the next line
+	// must still be removed rather than shadowed by that comment.
+	in := []byte(`[project]
+requires-python = ">=3.10"
+
+[dependency-groups]
+dev = [
+    "databricks-connect~=16.0",  # managed by setup-local
+    "databricks-connect==15.0.0",
+]
+`)
+	out, _, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	s := string(out)
+	assert.Contains(t, s, `"databricks-connect~=17.2.0",`, "the managed pin is kept and updated")
+	assert.NotContains(t, s, "databricks-connect==15.0.0", "the second pin is removed")
+	assert.Contains(t, s, "# managed by setup-local", "the managed pin's comment is preserved")
+	requireValidTOML(t, out)
+}
+
+func TestMergeConsolidationSkipsIncludeGroupAndLiteralStrings(t *testing.T) {
+	// The removal matches double-quoted databricks-connect elements only, mirroring the
+	// rewrite: a PEP 735 include-group reference and a single-quoted pin are left alone.
+	in := []byte(`[project]
+requires-python = ">=3.10"
+
+[dependency-groups]
+dev = [{include-group = "spark"}]
+spark = ['databricks-connect==15.0.0']
+`)
+	out, _, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	s := string(out)
+	assert.Contains(t, s, `{include-group = "spark"}`, "the include-group reference is preserved")
+	assert.Contains(t, s, `'databricks-connect==15.0.0'`, "the single-quoted pin is not removed")
+	requireValidTOML(t, out)
+}
+
+func TestMergeDatabricksConnectDoesNotClobberComment(t *testing.T) {
+	// A databricks-connect token inside a trailing comment is user content and
+	// must not be rewritten.
+	in := []byte(`[project]
+requires-python = ">=3.10"
+
+[dependency-groups]
+dev = ["pytest"] # keep "databricks-connect~=14.3" for docs
+`)
+	out, _, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	s := string(out)
+	// The comment's databricks-connect~=14.3 is preserved verbatim.
+	assert.Contains(t, s, `# keep "databricks-connect~=14.3" for docs`)
+	requireValidTOML(t, out)
+}
+
+func TestMergeRequiresPythonPreservesInlineComment(t *testing.T) {
+	in := []byte(`[project]
+requires-python = ">=3.10" # maintained by platform team
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0.0"]
+`)
+	out, _, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	s := string(out)
+	assert.Contains(t, s, `requires-python = "==3.12.*" # maintained by platform team`)
+	requireValidTOML(t, out)
+}
+
+func TestMergeHandlesTableHeaderInlineComments(t *testing.T) {
+	// Table headers may carry a trailing comment. requires-python under a
+	// commented [project] must still be updated, and the [dependency-groups] end
+	// bound must not run past a commented sibling header into another table's dev.
+	in := []byte(`[project] # package metadata
+requires-python = ">=3.10"
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0.0"]
+
+[tool.custom] # user table
+dev = ["databricks-connect==1.0.0"] # must not be managed
+`)
+	out, _, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	s := string(out)
+	// [project].requires-python was found and updated despite the header comment.
+	assert.Contains(t, s, `requires-python = "==3.12.*"`)
+	// The real dev group was updated...
+	assert.Contains(t, s, `"databricks-connect~=17.2.0"`)
+	// ...but the lookalike dev under [tool.custom] was left untouched.
+	assert.Contains(t, s, `dev = ["databricks-connect==1.0.0"] # must not be managed`)
+	requireValidTOML(t, out)
+}
+
+func TestHeaderName(t *testing.T) {
+	assert.Equal(t, "[project]", headerName("[project]"))
+	assert.Equal(t, "[project]", headerName("  [project] # note"))
+	assert.Equal(t, "[tool.uv]", headerName("[tool.uv]#x"))
+	// Array-of-tables headers are distinct from their parent table.
+	assert.Equal(t, "[[tool.uv.index]]", headerName("[[tool.uv.index]]"))
+	assert.Equal(t, "[[tool.uv.index]]", headerName("  [[tool.uv.index]] # note"))
+	assert.Empty(t, headerName("requires-python = \"3.12\""))
+	assert.Empty(t, headerName("dev = [\"a\"]"))
+}
+
+func TestMergeToolUvWithArrayOfTablesChild(t *testing.T) {
+	// A [tool.uv] table followed by its [[tool.uv.index]] array-of-tables child:
+	// the managed constraint block must attach to [tool.uv], not leak into the
+	// index item, and the result must be valid TOML.
+	in := []byte(`[project]
+requires-python = ">=3.10"
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0.0"]
+
+[tool.uv]
+
+[[tool.uv.index]]
+name = "internal"
+url = "https://packages.example/simple"
+`)
+	out, _, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	s := string(out)
+	requireValidTOML(t, out)
+	// The index array-of-tables is preserved intact.
+	assert.Contains(t, s, `[[tool.uv.index]]`)
+	assert.Contains(t, s, `name = "internal"`)
+	assert.Contains(t, s, "pydantic~=2.10.6")
+	// Merge-twice is byte-identical.
+	twice, _, err := MergeManaged(out, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	assert.Equal(t, s, string(twice))
+}
+
+func TestMergePreservesMultilineProjectDescription(t *testing.T) {
+	in := []byte(`[project]
+name = "my-databricks-project"
+requires-python = ">=3.10"
+description = """
+A multi-line project description.
+"""
+
+[tool.uv]
+constraint-dependencies = []
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0.0"]
+`)
+	out, _, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	requireValidTOML(t, out)
+	assert.Contains(t, string(out), "description = \"\"\"\nA multi-line project description.\n\"\"\"")
+	assert.Contains(t, string(out), `requires-python = "==3.12.*"`)
+
+	twice, _, err := MergeManaged(out, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	assert.Equal(t, out, twice)
+}
+
+func TestMergeIgnoresStructureInsideMultilineStrings(t *testing.T) {
+	in := []byte(`[project]
+requires-python = ">=3.10"
+description = """
+[tool.uv]
+constraint-dependencies = ["not really"]
+# managed by databricks environments setup-local — do not edit
+"""
+literal-description = '''
+[dependency-groups]
+dev = ["databricks-connect==1.0.0"]
+'''
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0.0"]
+
+[tool.uv]
+constraint-dependencies = []
+`)
+	out, _, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	requireValidTOML(t, out)
+	s := string(out)
+	assert.Contains(t, s, "description = \"\"\"\n[tool.uv]\nconstraint-dependencies = [\"not really\"]\n# managed by databricks environments setup-local — do not edit\n\"\"\"")
+	assert.Contains(t, s, "literal-description = '''\n[dependency-groups]\ndev = [\"databricks-connect==1.0.0\"]\n'''")
+	assert.Contains(t, s, `dev = ["databricks-connect~=17.2.0"]`)
+}
+
+func TestMergeRecognizesMultilineDelimitersOnlyInTOMLCode(t *testing.T) {
+	in := []byte(`[project]
+requires-python = ">=3.10"
+literal = '""" is ordinary string content'
+basic = "''' is ordinary string content"
+# """ is comment content
+description = """same-line value"""
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0.0"]
+`)
+	out, _, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	requireValidTOML(t, out)
+	s := string(out)
+	assert.Contains(t, s, `literal = '""" is ordinary string content'`)
+	assert.Contains(t, s, `basic = "''' is ordinary string content"`)
+	assert.Contains(t, s, `# """ is comment content`)
+	assert.Contains(t, s, `description = """same-line value"""`)
+}
+
+func TestMergePreservesCRLFInsideMultilineString(t *testing.T) {
+	in := []byte("[project]\r\nrequires-python = \">=3.10\"\r\ndescription = \"\"\"\r\ncontinued\r\n\"\"\"\r\n\r\n[dependency-groups]\r\ndev = [\"databricks-connect~=16.0.0\"]\r\n")
+	out, _, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.NoError(t, err)
+	requireValidTOML(t, out)
+	assert.NotContains(t, strings.ReplaceAll(string(out), "\r\n", ""), "\n")
+	assert.Contains(t, string(out), "description = \"\"\"\r\ncontinued\r\n\"\"\"")
+}
+
+func TestMergeBailsOnUnterminatedMultilineString(t *testing.T) {
+	in := []byte(`[project]
+requires-python = ">=3.10"
+description = """
+unterminated
+`)
+	_, _, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.ErrorIs(t, err, errMultilineString)
+}
+
+func TestMergePreservesMultilineStringDelimiterEdgeCases(t *testing.T) {
+	tests := []struct {
+		name  string
+		value string
+	}{
+		{name: "basic escaped quote with odd backslash", value: `"""one \""" two"""`},
+		{name: "basic delimiter after even backslashes", value: `"""one \\"""`},
+		{name: "basic four quote ending", value: `"""value""""`},
+		{name: "basic five quote ending", value: `"""value"""""`},
+		{name: "literal four quote ending", value: `'''value''''`},
+		{name: "literal five quote ending", value: `'''value'''''`},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			in := []byte("[project]\nrequires-python = \">=3.10\"\ndescription = " + tt.value + "\n\n[dependency-groups]\ndev = [\"databricks-connect~=16.0.0\"]\n")
+			requireValidTOML(t, in)
+
+			out, _, err := MergeManaged(in, testConstraints(), MergeOptions{})
+			require.NoError(t, err)
+			requireValidTOML(t, out)
+			assert.Contains(t, string(out), "description = "+tt.value)
+
+			twice, _, err := MergeManaged(out, testConstraints(), MergeOptions{})
+			require.NoError(t, err)
+			assert.Equal(t, out, twice)
+		})
+	}
+}
+
+func TestMergeBailsWhenNoProjectTable(t *testing.T) {
+	// A partial existing file with no [project] table can't receive requires-python;
+	// merging it would silently skip the pin, so it must error instead.
+	in := []byte(`[dependency-groups]
+dev = ["databricks-connect~=16.0.0"]
+
+[tool.uv]
+constraint-dependencies = ["old~=1.0"]
+`)
+	_, _, err := MergeManaged(in, testConstraints(), MergeOptions{})
+	require.Error(t, err)
+	assert.ErrorIs(t, err, errNoProjectTable)
+}
+
+func TestMergeManagedSkipConstraintsAllowsMissingProjectTable(t *testing.T) {
+	// The [project] table is required only to hold requires-python. Under
+	// SkipConstraints there is none to write, so a [project]-less file (e.g. one with
+	// only dependency groups) is merged for its other axes rather than rejected.
+	in := []byte(`[dependency-groups]
+dev = ["databricks-connect~=16.0.0"]
+`)
+	out, regions, err := MergeManaged(in, testConstraints(), MergeOptions{SkipConstraints: true})
+	require.NoError(t, err)
+	// databricks-connect is still reconciled; requires-python is not written.
+	assert.Contains(t, regions, regionDatabricksConnect)
+	assert.Contains(t, string(out), `"databricks-connect~=17.2.0"`)
+	assert.NotContains(t, string(out), "requires-python")
+	requireValidTOML(t, out)
+}
+
+func countOccurrences(s, substr string) int {
+	return strings.Count(s, substr)
+}
+
+func TestMergeManagedSkipConstraintsLeavesRequiresPythonUntouched(t *testing.T) {
+	// skipConstraints=true leaves the user's requires-python untouched even though
+	// the Constraints carry a real pin: the flag, not an empty value, drives the skip.
+	in := []byte(`[project]
+name = "demo"
+requires-python = ">=3.9"
+
+[dependency-groups]
+dev = []
+`)
+	c := testConstraints() // carries requires-python = "==3.12.*"
+	out, regions, err := MergeManaged(in, c, MergeOptions{SkipConstraints: true})
+	require.NoError(t, err)
+	assert.Contains(t, string(out), `requires-python = ">=3.9"`)
+	assert.NotContains(t, regions, regionRequiresPython)
+}
+
+func TestMergeManagedSkipConstraintsLeavesToolUvUntouched(t *testing.T) {
+	// skipConstraints=true writes no managed [tool.uv] constraint block even though
+	// the Constraints carry constraint-dependencies.
+	in := []byte(`[project]
+name = "demo"
+requires-python = "==3.12.*"
+
+[dependency-groups]
+dev = []
+`)
+	c := testConstraints() // carries constraint-dependencies
+	out, regions, err := MergeManaged(in, c, MergeOptions{SkipConstraints: true})
+	require.NoError(t, err)
+	assert.NotContains(t, string(out), "constraint-dependencies")
+	assert.NotContains(t, regions, regionToolUv)
+}
+
+func TestMergeManagedNilConstraintDepsWritesEmptyManagedBlock(t *testing.T) {
+	// With constraints managed, a nil ConstraintDeps (an artifact that simply omits
+	// constraint-dependencies) is treated identically to an empty slice: an empty
+	// managed [tool.uv] block is written. nil no longer signals "skip".
+	in := []byte(`[project]
+name = "demo"
+requires-python = "==3.12.*"
+
+[dependency-groups]
+dev = []
+`)
+	c := testConstraints()
+	c.ConstraintDeps = nil
+	out, regions, err := MergeManaged(in, c, MergeOptions{})
+	require.NoError(t, err)
+	assert.Contains(t, regions, regionToolUv)
+	assert.Contains(t, string(out), "constraint-dependencies = [")
+	requireValidTOML(t, out)
+}
+
+func TestRenderFreshPyprojectSkipConstraintsOmitsConstraints(t *testing.T) {
+	// Greenfield with skipConstraints=true: neither the Python pin nor the [tool.uv]
+	// constraint block is rendered even though the Constraints carry them, but
+	// databricks-connect (orthogonal) still is.
+	c := testConstraints() // carries requires-python and constraint-dependencies
+	out := RenderFreshPyproject("demo", c, MergeOptions{SkipConstraints: true})
+	s := string(out)
+	assert.NotContains(t, s, "requires-python")
+	assert.NotContains(t, s, "constraint-dependencies")
+	assert.Contains(t, s, `"databricks-connect~=17.2.0",`)
+	requireValidTOML(t, out)
+}
+
+func TestMergeManagedSkipDBConnectLeavesExistingPinUntouched(t *testing.T) {
+	// skipDBConnect=true leaves the user's databricks-connect pin untouched even
+	// though the Constraints carry a different managed pin — the flag, not an empty
+	// pin, drives the skip. The orthogonal requires-python is still managed.
+	in := []byte(`[project]
+name = "demo"
+requires-python = ">=3.9"
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0.0"]
+`)
+	c := testConstraints() // carries databricks-connect~=17.2.0
+	out, regions, err := MergeManaged(in, c, MergeOptions{SkipDBConnect: true})
+	require.NoError(t, err)
+	assert.Contains(t, string(out), `"databricks-connect~=16.0.0"`)
+	assert.NotContains(t, string(out), "17.2.0")
+	assert.NotContains(t, regions, regionDatabricksConnect)
+}
+
+func TestRenderFreshPyprojectSkipDBConnectOmitsDBConnect(t *testing.T) {
+	// Greenfield with skipDBConnect=true: the dev group is empty even though the
+	// Constraints carry a databricks-connect pin, but the orthogonal requires-python
+	// and constraint block still render.
+	c := testConstraints() // carries databricks-connect~=17.2.0
+	out := RenderFreshPyproject("demo", c, MergeOptions{SkipDBConnect: true})
+	s := string(out)
+	assert.NotContains(t, s, "databricks-connect")
+	assert.Contains(t, s, "dev = []")
+	assert.Contains(t, s, `requires-python = "==3.12.*"`)
+	assert.Contains(t, s, "constraint-dependencies")
+	requireValidTOML(t, out)
+}
+
+func TestMergeManagedConstraintsAtWorkspaceRootAddsNoBlock(t *testing.T) {
+	in := []byte("[project]\nname = \"a\"\nrequires-python = \">=3.10\"\n")
+	c := Constraints{RequiresPython: ">=3.12", ConstraintDeps: []string{"numpy==1.26.4"}}
+	out, regions, err := MergeManaged(in, c, MergeOptions{ConstraintsAtWorkspaceRoot: true})
+	require.NoError(t, err)
+	assert.Contains(t, string(out), `requires-python = ">=3.12"`)
+	assert.NotContains(t, string(out), "constraint-dependencies")
+	assert.NotContains(t, regions, regionToolUv)
+}
+
+func TestMergeToolUvBlockVirtualRoot(t *testing.T) {
+	in := []byte("[tool.uv.workspace]\nmembers = [\"bundles/*\"]\n")
+	out, changed, _, err := MergeToolUvBlock(in, []string{"numpy==1.26.4"})
+	require.NoError(t, err)
+	assert.True(t, changed)
+	assert.Contains(t, string(out), managedMarkerStart)
+	assert.Contains(t, string(out), `"numpy==1.26.4"`)
+	assert.Contains(t, string(out), "[tool.uv.workspace]")
+
+	again, changed2, _, err := MergeToolUvBlock(out, []string{"numpy==1.26.4"})
+	require.NoError(t, err)
+	assert.False(t, changed2)
+	assert.Equal(t, out, again)
+}
+
+func TestMergeToolUvBlockKeepsCRLF(t *testing.T) {
+	in := []byte("[tool.uv.workspace]\r\nmembers = [\"a\"]\r\n")
+	out, _, _, err := MergeToolUvBlock(in, []string{"x==1"})
+	require.NoError(t, err)
+	assert.NotContains(t, strings.ReplaceAll(string(out), "\r\n", ""), "\n")
+}
+
+func TestMergeManagedConstraintsAtWorkspaceRootRemovesStaleStandaloneBlock(t *testing.T) {
+	// A run before workspace support wrote the managed block into the member,
+	// where uv ignores it. The member merge removes it; the root holds the pins.
+	in := "[project]\nname = \"a\"\nrequires-python = \">=3.12\"\n\n" +
+		managedMarkerStart + "\n[tool.uv]\nconstraint-dependencies = [\n    \"x==1\",\n]\n" + managedMarkerEnd + "\n"
+	c := Constraints{RequiresPython: ">=3.12"}
+	out, regions, err := MergeManaged([]byte(in), c, MergeOptions{ConstraintsAtWorkspaceRoot: true, SkipDBConnect: true})
+	require.NoError(t, err)
+	assert.Equal(t, "[project]\nname = \"a\"\nrequires-python = \">=3.12\"\n", string(out))
+	assert.Contains(t, regions, regionToolUv)
+
+	again, regions2, err := MergeManaged(out, c, MergeOptions{ConstraintsAtWorkspaceRoot: true, SkipDBConnect: true})
+	require.NoError(t, err)
+	assert.Equal(t, out, again)
+	assert.NotContains(t, regions2, regionToolUv)
+}
+
+func TestMergeManagedConstraintsAtWorkspaceRootRemovesStaleBlockKeepsUserTable(t *testing.T) {
+	in := "[project]\nname = \"a\"\nrequires-python = \">=3.12\"\n\n[tool.uv]\npackage = false\n" +
+		managedMarkerStart + "\nconstraint-dependencies = [\n    \"x==1\",\n]\n" + managedMarkerEnd + "\n"
+	c := Constraints{RequiresPython: ">=3.12"}
+	out, _, err := MergeManaged([]byte(in), c, MergeOptions{ConstraintsAtWorkspaceRoot: true, SkipDBConnect: true})
+	require.NoError(t, err)
+	assert.Equal(t, "[project]\nname = \"a\"\nrequires-python = \">=3.12\"\n\n[tool.uv]\npackage = false\n", string(out))
+}
+
+func TestMergeManagedConstraintsAtWorkspaceRootKeepsHeaderForTrailingUserKeys(t *testing.T) {
+	// The user added a key below an earlier standalone block. It belongs to that
+	// block's [tool.uv] table, so the header must survive the block's removal.
+	in := "[project]\nname = \"a\"\nrequires-python = \">=3.12\"\n\n" +
+		managedMarkerStart + "\n[tool.uv]\nconstraint-dependencies = [\n    \"x==1\",\n]\n" + managedMarkerEnd + "\npackage = false\n"
+	c := Constraints{RequiresPython: ">=3.12"}
+	out, _, err := MergeManaged([]byte(in), c, MergeOptions{ConstraintsAtWorkspaceRoot: true, SkipDBConnect: true})
+	require.NoError(t, err)
+	assert.Equal(t, "[project]\nname = \"a\"\nrequires-python = \">=3.12\"\n\n[tool.uv]\npackage = false\n", string(out))
+}
+
+func TestMergeToolUvBlockDottedKeyGuard(t *testing.T) {
+	// A [tool.uv] table defined without its own header cannot be extended by the
+	// line-based merge; appending a [tool.uv] header would define it twice, which
+	// uv rejects for the whole workspace.
+	tests := []struct {
+		name    string
+		in      string
+		wantErr bool
+	}{
+		{"workspace subtable header", "[tool.uv.workspace]\nmembers = [\"bundles/*\"]\n", false},
+		{"dotted key at top level", "tool.uv.workspace.members = [\"bundles/*\"]\n", true},
+		{"quoted dotted key", "\"tool\".\"uv\".workspace.members = [\"bundles/*\"]\n", true},
+		{"dotted key in [tool]", "[tool]\nuv.workspace.members = [\"bundles/*\"]\n", true},
+		{"inline tool table", "tool = { uv = { workspace = { members = [\"bundles/*\"] } } }\n", true},
+		{"inline uv table in [tool]", "[tool]\nuv = { workspace = { members = [\"bundles/*\"] } }\n", true},
+		// Header spellings the line-based merge does not match; the merged file
+		// would define [tool.uv] twice.
+		{"header with spaces", "[ tool.uv ]\ndev-dependencies = []\n", true},
+		{"quoted header", "[tool.\"uv\"]\ndev-dependencies = []\n", true},
+		{"quoted constraint key", "[tool.uv]\n\"constraint-dependencies\" = [\"y==1\"]\n", true},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			_, _, _, err := MergeToolUvBlock([]byte(tc.in), []string{"x==1"})
+			if tc.wantErr {
+				assert.Error(t, err)
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestMergeToolUvBlockReportsReplacedPins(t *testing.T) {
+	tests := []struct {
+		name         string
+		in           string
+		wantReplaced bool
+	}{
+		{"no pins", "[tool.uv.workspace]\nmembers = [\"a\"]\n", false},
+		{"only a comment names the key", "# constraint-dependencies are added by setup-local\n[tool.uv.workspace]\nmembers = [\"a\"]\n", false},
+		{"user pins", "[tool.uv]\nconstraint-dependencies = [\"urllib3<2\"]\n", true},
+		{"managed pins", managedMarkerStart + "\n[tool.uv]\nconstraint-dependencies = [\n    \"old==1\",\n]\n" + managedMarkerEnd + "\n", true},
+		{"empty unmarked key", "[tool.uv]\nconstraint-dependencies = []\n", false},
+		{"quote only in a comment", "[tool.uv]\nconstraint-dependencies = [\n    # \"placeholder\"\n]  # 'none yet'\n", false},
+		{"pin with a trailing comment", "[tool.uv]\nconstraint-dependencies = [\n    \"urllib3<2\", # why\n]\n", true},
+		{"empty managed block", managedMarkerStart + "\n[tool.uv]\nconstraint-dependencies = [\n]\n" + managedMarkerEnd + "\n", false},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			_, _, replaced, err := MergeToolUvBlock([]byte(tc.in), []string{"x==1"})
+			require.NoError(t, err)
+			assert.Equal(t, tc.wantReplaced, replaced)
+		})
+	}
+}
+
+func TestMergeManagedConstraintsAtWorkspaceRootRemovesUnmarkedPins(t *testing.T) {
+	// A run before the managed markers wrote a plain [tool.uv] table with only
+	// constraint-dependencies; the standalone merge treats it as its own, so the
+	// member merge removes it too. Other [tool.uv] keys stay.
+	c := Constraints{RequiresPython: ">=3.12"}
+	opts := MergeOptions{ConstraintsAtWorkspaceRoot: true, SkipDBConnect: true}
+	head := "[project]\nname = \"a\"\nrequires-python = \">=3.12\"\n"
+
+	out, regions, err := MergeManaged([]byte(head+"\n[tool.uv]\nconstraint-dependencies = [\"x==1\"]\n"), c, opts)
+	require.NoError(t, err)
+	assert.Equal(t, head, string(out))
+	assert.Contains(t, regions, regionToolUv)
+
+	out, _, err = MergeManaged([]byte(head+"\n[tool.uv]\npackage = false\nconstraint-dependencies = [\"x==1\"]\n"), c, opts)
+	require.NoError(t, err)
+	assert.Equal(t, head+"\n[tool.uv]\npackage = false\n", string(out))
+}
+
+func TestMergeManagedConstraintsAtWorkspaceRootKeepsUserBlankLine(t *testing.T) {
+	// A header-less managed block sits inside the user's [tool.uv] table; the
+	// blank line before it is the user's, not the merge's.
+	in := "[project]\nname = \"a\"\nrequires-python = \">=3.12\"\n\n[tool.uv]\npackage = false\n\n" +
+		managedMarkerStart + "\nconstraint-dependencies = [\n    \"x==1\",\n]\n" + managedMarkerEnd + "\n"
+	c := Constraints{RequiresPython: ">=3.12"}
+	out, _, err := MergeManaged([]byte(in), c, MergeOptions{ConstraintsAtWorkspaceRoot: true, SkipDBConnect: true})
+	require.NoError(t, err)
+	assert.Equal(t, "[project]\nname = \"a\"\nrequires-python = \">=3.12\"\n\n[tool.uv]\npackage = false\n\n", string(out))
+}
diff --git a/libs/localenv/pipeline.go b/libs/localenv/pipeline.go
new file mode 100644
index 00000000000..99506128210
--- /dev/null
+++ b/libs/localenv/pipeline.go
@@ -0,0 +1,1033 @@
+package localenv
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"time"
+
+	"github.com/databricks/cli/libs/atomicfile"
+	"github.com/databricks/cli/libs/env"
+	"github.com/databricks/cli/libs/log"
+	"github.com/hexops/gotextdiff"
+	"github.com/hexops/gotextdiff/myers"
+	"github.com/hexops/gotextdiff/span"
+)
+
+// Filenames and directories the pipeline reads and writes. venvDir is the name of
+// the virtualenv folder the package manager provisions. pyprojectFile lives in
+// detect.go, the first consumer of it.
+const (
+	backupFile = "pyproject.toml.bak"
+	venvDir    = ".venv"
+)
+
+// backupTimestampLayout is the local-time, second-resolution stamp in a
+// timestamped backup name (pyproject.toml.<stamp>.bak); local so a reader can
+// tell at a glance when each backup was made. Shared with tests that pin the name.
+const backupTimestampLayout = "20060102T150405"
+
+// artifactSource values reported in --json resolved.artifactSource (spec §6).
+const (
+	artifactNetwork = "network"
+	artifactCache   = "cache"
+)
+
+// allPhases is the canonical phase order for the --json "phases" array. The
+// pipeline seeds every phase pending from this slice and flips each to ok/error
+// as the run progresses.
+var allPhases = []PhaseName{
+	PhasePreflight,
+	PhaseResolve,
+	PhaseFetch,
+	PhaseMerge,
+	PhaseProvision,
+	PhaseValidate,
+}
+
+// Pipeline orchestrates the dbconnect sync phases against a project directory.
+type Pipeline struct {
+	Mode              Mode
+	Check             bool
+	ProjectDir        string
+	ConstraintBaseURL string
+	CacheDir          string
+	Flags             ComputeFlags
+	Bundle            BundleTarget
+	Compute           ComputeClient
+	PM                PackageManager
+
+	// SkipConstraints (--no-constraints) leaves the remote Python version and
+	// dependency pins unmanaged: the merge writes neither requires-python nor the
+	// [tool.uv] constraint block, and any existing values are left untouched. It is
+	// orthogonal to Mode (the databricks-connect axis).
+	SkipConstraints bool
+
+	// Progress, when non-nil, receives a PhaseStarted call as each phase begins.
+	// Left nil by callers that don't render progress (e.g. --output json).
+	Progress Reporter
+
+	// res accumulates phase statuses and result fields as the run progresses.
+	res *Result
+
+	// venv is the absolute virtualenv folder that provision seeds and validate
+	// inspects. Set in preflight.
+	venv string
+
+	// venvRel is the venv folder relative to ProjectDir (absolute when
+	// UV_PROJECT_ENVIRONMENT is absolute), reported as Result.VenvPath. Set in
+	// preflight.
+	venvRel string
+
+	// workspaceRoot is the uv workspace root when ProjectDir is a workspace
+	// member, else "". Set in preflight.
+	workspaceRoot string
+
+	// nowFn supplies the time for backup filenames; nil means time.Now. Injected
+	// in tests so backup names are deterministic.
+	nowFn func() time.Time
+}
+
+// clock returns the current time, using nowFn when injected.
+func (p *Pipeline) clock() time.Time {
+	if p.nowFn != nil {
+		return p.nowFn()
+	}
+	return time.Now()
+}
+
+// Run executes all pipeline phases in order and returns a fully populated Result.
+// On a phase error, Result.Error is set and the same error is also returned. The
+// Result always carries the full canonical phase list: phases completed before a
+// failure are "ok", the failing phase is "error", and the rest are "pending".
+func (p *Pipeline) Run(ctx context.Context) (*Result, error) {
+	log.Debugf(ctx, CommandName+": mode=%s check=%v project=%s cacheDir=%s constraintBaseURL=%s flags=%+v",
+		p.Mode,
+		p.Check,
+		filepath.ToSlash(p.ProjectDir),
+		filepath.ToSlash(p.CacheDir),
+		p.ConstraintBaseURL,
+		p.Flags,
+	)
+
+	// NewResult seeds Phases/Warnings to non-nil slices so --json always emits
+	// [] not null; override Phases with the canonical pending phase list.
+	p.res = NewResult()
+	p.res.SchemaVersion = SchemaVersion
+	p.res.Command = CommandName
+	p.res.Mode = p.Mode.String()
+	p.res.DryRun = p.Check
+	p.res.SkipConstraints = p.SkipConstraints
+	// Phases start as pending and flip to ok/error as the run progresses.
+	p.res.Phases = initialPhases()
+
+	// Stamp wall time from a defer so every exit path is covered — success, a phase
+	// failure, and the cancellation reclassification below all return through it.
+	start := time.Now()
+	defer func() { p.res.DurationMs = time.Since(start).Milliseconds() }()
+
+	if err := p.run(ctx); err != nil {
+		// A cancelled context means the user or parent interrupted us (SIGINT/
+		// SIGTERM). The phase that was running reports its own failure (e.g. uv
+		// sync exiting on the signal surfaces as E_PROVISION with "signal:
+		// terminated"), which misleads a --json consumer into thinking something
+		// broke. Reclassify to E_CANCELED here — the single funnel where ctx is in
+		// scope — keeping the recorded FailurePhase and diskMutated so the consumer
+		// still knows where we stopped and whether disk was touched.
+		//
+		// The phase's own error is kept as the wrapped cause rather than replaced:
+		// a real failure can race with the signal (uv sync failing on a dependency
+		// conflict while the user gives up and hits Ctrl-C), and that cause is the
+		// only diagnostic there is.
+		if ctx.Err() != nil && p.res.Error != nil {
+			// Snapshot the phase's error *before* overwriting Code/Msg below. uvFailure
+			// folds uv's stderr — the actual diagnostic (e.g. a dependency-conflict
+			// "no solution found") — into Msg, so wrapping only the inner .Err would
+			// drop it, leaving less than main in exactly the racing-failure case this
+			// is meant to preserve. Wrapping the whole original PipelineError keeps
+			// Msg (stderr and all) in the chain.
+			orig := &PipelineError{Code: p.res.Error.Code, Msg: p.res.Error.Msg, Err: p.res.Error.Err}
+			p.res.Error.Code = ErrCanceled
+			p.res.Error.Msg = "interrupted"
+			// Two %w verbs keep both the context error and the phase's original error
+			// matchable by errors.Is, on one line — errors.Join would embed a newline
+			// and break the single-line phase row text mode prints.
+			p.res.Error.Err = fmt.Errorf("%w; %w", ctx.Err(), orig)
+			// fail() already snapshotted the pre-reclassification text into the
+			// errored phase's Detail, which is what text mode prints. Re-sync it so
+			// text and --json agree on cancellation (see PipelineError.MarshalJSON).
+			p.syncFailureDetail()
+			return p.res, p.res.Error
+		}
+		return p.res, err
+	}
+	p.res.OK = true
+	return p.res, nil
+}
+
+// run drives the phases and returns the first phase error. Result bookkeeping
+// (phase status, error object) is handled by fail / markOK.
+func (p *Pipeline) run(ctx context.Context) error {
+	// Phase: preflight — flag validation, manager detection, writability,
+	// package-manager availability.
+	//
+	// Incompatible target flags are a usage error (E_USAGE), reported at preflight
+	// before any other work so the failure flows through the phase/JSON reporting
+	// (a plain Cobra mutual-exclusion error would print no command JSON object,
+	// which the --output json consumer needs).
+	p.report(ctx, PhasePreflight)
+	if err := ValidateComputeFlags(p.Flags); err != nil {
+		return p.fail(PhasePreflight, false, NewError(ErrUsage, err, "invalid compute target flags"))
+	}
+	// P0 supports only uv; any other detected manager is a clean, non-blaming exit.
+	if m := detectManager(p.ProjectDir); m != managerUv {
+		return p.fail(PhasePreflight, false, NewError(ErrManagerUnsupported, nil, "%s", managerGuidance(m)))
+	}
+	// Under --dry-run the pipeline only reads and reports a plan, so it must not
+	// mutate anything at preflight. Two preflight steps can write:
+	//   - ensureWritable creates and removes a temp file (and would fail a
+	//     read-only project the user only wants to inspect);
+	//   - PackageManager.EnsureAvailable may install the manager (uv) if missing.
+	// Both exist to fail fast before real writes, which --dry-run never performs, so
+	// they are skipped in a dry run. Neither result is needed to compute the plan.
+	detail := "check"
+	if !p.Check {
+		if err := ensureWritable(p.ProjectDir); err != nil {
+			return p.fail(PhasePreflight, false, NewError(ErrNotWritable, err, "project directory %s is not writable", filepath.ToSlash(p.ProjectDir)))
+		}
+		version, err := p.PM.EnsureAvailable(ctx)
+		if err != nil {
+			return p.fail(PhasePreflight, false, asPipelineError(err, ErrUvMissing, "%s unavailable", p.PM.Name()))
+		}
+		detail = p.PM.Name() + " " + version
+	}
+	// A uv workspace member shares the venv at the workspace root, where uv sync
+	// creates it, and keeps its constraint block in the root pyproject.toml, the
+	// only file uv reads constraint-dependencies from.
+	// https://docs.astral.sh/uv/concepts/projects/workspaces/
+	// Every run asks uv, also for a standalone project: only uv applies its member
+	// globs and exclude rules, and one call costs little next to uv sync.
+	var rootRel string
+	p.workspaceRoot, rootRel = p.discoverWorkspaceRoot(ctx)
+	// A discovery failure keeps the standalone behavior, but an interrupt must
+	// not: the run would go on to merge as a standalone project and write files.
+	if err := ctx.Err(); err != nil {
+		return p.fail(PhasePreflight, false, NewError(ErrCanceled, err, "interrupted"))
+	}
+	venvBase := p.ProjectDir
+	if p.workspaceRoot != "" {
+		venvBase = p.workspaceRoot
+		p.res.UvWorkspaceRoot = filepath.ToSlash(p.workspaceRoot)
+		if !p.Check {
+			if err := ensureWritable(p.workspaceRoot); err != nil {
+				return p.fail(PhasePreflight, false, NewError(ErrNotWritable, err, "uv workspace root %s is not writable", filepath.ToSlash(p.workspaceRoot)))
+			}
+		}
+	}
+	if err := p.setVenv(ctx, venvBase, rootRel); err != nil {
+		return err
+	}
+	p.markOK(PhasePreflight, detail)
+
+	// Phase: resolve — compute target → environment key.
+	p.report(ctx, PhaseResolve)
+	compute, err := p.resolve(ctx)
+	if err != nil {
+		return err
+	}
+
+	// Phase: fetch — constraint artifact for the resolved env key.
+	p.report(ctx, PhaseFetch)
+	c, err := p.fetch(ctx, compute)
+	if err != nil {
+		return err
+	}
+
+	// Parse the required Python minor from the artifact; a failure here reflects a
+	// bad artifact, reported at the fetch phase.
+	pyMinor, err := PythonMinorFromRequires(c.RequiresPython)
+	if err != nil {
+		return p.fail(PhaseFetch, false, NewError(ErrFetch, err, "cannot parse python version from constraints %q", c.RequiresPython))
+	}
+
+	// The skip axes are threaded explicitly rather than encoded by clearing c's
+	// values, so c keeps the real artifact values throughout. --constraints-only maps
+	// to --no-dbconnect: it stops managing the pin (not reported here, not asserted in
+	// validate) but keeps the resolved value on c.
+	// A workspace member's constraint block goes to the workspace root (see
+	// planRootMerge). Discovery never reports a greenfield project as a member
+	// (see discoverWorkspaceRoot), so RenderFreshPyproject needs no such option.
+	opts := MergeOptions{
+		SkipConstraints:            p.SkipConstraints,
+		SkipDBConnect:              p.Mode == ModeConstraintsOnly,
+		ConstraintsAtWorkspaceRoot: p.workspaceRoot != "",
+	}
+
+	dbcVersion := dbcVersionFromPin(c.DatabricksConnect)
+	if opts.SkipDBConnect {
+		dbcVersion = ""
+	}
+	p.res.Resolved = &ResolvedInfo{
+		PythonVersion:    pyMinor,
+		DBConnectVersion: dbcVersion,
+		ArtifactSource:   artifactSource(c.FromCache),
+	}
+
+	// Phase: merge — compute the merged pyproject.toml (in-memory, no writes yet).
+	// The serverless environment version (empty for cluster targets) is written
+	// into [tool.databricks.environment] so the project also runs in serverless Jobs.
+	p.report(ctx, PhaseMerge)
+	mergedBytes, root, greenfield, err := p.mergePlan(ctx, pyMinor, c, compute.ServerlessEnvironmentVersion(), opts)
+	if err != nil {
+		return err
+	}
+	p.res.Greenfield = greenfield
+
+	// Check mode stops after planning — nothing below mutates disk.
+	if p.Check {
+		p.markOK(PhaseMerge, "")
+		p.markOK(PhaseProvision, "")
+		p.markOK(PhaseValidate, "")
+		return nil
+	}
+
+	// Apply the merged content to disk (backup first for existing projects).
+	if err := p.applyMerge(ctx, mergedBytes, root, greenfield); err != nil {
+		return err
+	}
+	p.markOK(PhaseMerge, "")
+
+	// The merge proved the written pins conflict with the user's dependencies
+	// (W_USER_CONSTRAINT_CONFLICT): uv sync would deterministically fail to resolve
+	// them, so report the conflict now — with a distinct E_PROVISION_CONFLICT code —
+	// instead of spending a doomed Python install and sync. The constraints are
+	// already on disk (diskMutated=true), which the extension's recovery flow relies
+	// on, and the failure is attributed to the provision phase it stands in for.
+	// Gating this pre-sync check on the CLI's own merge detection keeps it
+	// structural for the direct-pin case: it reports the conflict before a doomed
+	// sync and never false-positives on an unrelated failure. Transitive conflicts
+	// the merge phase cannot see are classified later, from uv's stderr, in
+	// uvManager.Provision (see isUvResolutionConflict).
+	p.report(ctx, PhaseProvision)
+	if p.hasConstraintConflictWarning() {
+		return p.fail(PhaseProvision, true, NewError(ErrProvisionConflict, nil,
+			"dependency pins conflict with the environment constraints; relax the conflicting pins and re-run (see warnings)"))
+	}
+
+	// Phase: provision — ensure Python, run uv sync, seed pip.
+	if err := p.provision(ctx, pyMinor); err != nil {
+		return err
+	}
+
+	// Phase: validate — assert the venv matches the target.
+	p.report(ctx, PhaseValidate)
+	return p.validate(ctx, pyMinor, c.DatabricksConnect, opts)
+}
+
+// setVenv sets the venv folder where uv sync puts the project environment:
+// UV_PROJECT_ENVIRONMENT when set, else .venv in venvBase (the workspace root
+// or ProjectDir). rootRel is venvBase relative to the symlink-resolved
+// ProjectDir ("" outside a workspace; see discoverWorkspaceRoot).
+func (p *Pipeline) setVenv(ctx context.Context, venvBase, rootRel string) error {
+	name := env.Get(ctx, EnvUvProjectEnvironment)
+	switch {
+	case name == "":
+		p.venv = filepath.Join(venvBase, venvDir)
+		p.venvRel = filepath.Join(rootRel, venvDir)
+	case filepath.IsAbs(name):
+		// uv uses an absolute value as is. It is reported as is too: a relative
+		// path cannot cross drives.
+		p.venv = filepath.Clean(name)
+		p.venvRel = p.venv
+	case filepath.VolumeName(name) != "":
+		// A Windows drive-relative value such as C:envs\x names a folder on that
+		// drive; uv uses it as is.
+		p.venv = filepath.Clean(name)
+		p.venvRel = p.venv
+	case strings.HasPrefix(filepath.ToSlash(name), "/"):
+		// A Windows rooted path such as \envs\x: uv keeps only the drive of the
+		// root for it.
+		p.venv = filepath.Clean(filepath.VolumeName(venvBase) + name)
+		p.venvRel = p.venv
+	default:
+		// uv joins a relative value to its working folder. On Unix that folder is
+		// symlink-resolved, so ".." in the value climbs the real folders; Windows
+		// keeps the path as given and resolves ".." by text.
+		base := venvBase
+		if runtime.GOOS != "windows" {
+			resolved, err := filepath.EvalSymlinks(venvBase)
+			if err != nil {
+				return p.fail(PhasePreflight, false, NewError(ErrNotWritable, err, "cannot resolve %s to place %s=%s", filepath.ToSlash(venvBase), EnvUvProjectEnvironment, filepath.ToSlash(name)))
+			}
+			base = resolved
+		}
+		p.venv = filepath.Join(base, name)
+		p.venvRel = filepath.Join(rootRel, name)
+	}
+	return nil
+}
+
+// resolve runs ResolveCompute and records the resolve phase.
+func (p *Pipeline) resolve(ctx context.Context) (*ComputeInfo, error) {
+	compute, err := ResolveCompute(ctx, p.Flags, p.Compute, p.Bundle)
+	if err != nil {
+		return nil, p.fail(PhaseResolve, false, asPipelineError(err, ErrResolve, "compute resolution failed"))
+	}
+	p.res.Compute = compute
+	p.markOK(PhaseResolve, fmt.Sprintf("source=%s envKey=%s", compute.Source, compute.EnvKey))
+	return compute, nil
+}
+
+// fetch fetches constraints for the resolved target and records the fetch phase.
+// Under --dry-run the cache is not populated, so a dry run performs no disk writes
+// (an existing cache is still read for offline fallback).
+func (p *Pipeline) fetch(ctx context.Context, compute *ComputeInfo) (*Constraints, error) {
+	c, err := FetchConstraints(ctx, p.ConstraintBaseURL, compute.EnvKey, p.CacheDir, !p.Check)
+	if err != nil {
+		// FetchConstraints classifies the cause: E_ENV_UNSUPPORTED for a missing
+		// key (404) versus E_FETCH for transport failure with no cache. Both are
+		// discovered here, so both are reported at the fetch phase (the JSON keeps
+		// the failing phase and error.failurePhase in agreement).
+		return nil, p.fail(PhaseFetch, false, asPipelineError(err, ErrFetch, "fetch constraints failed"))
+	}
+	p.markOK(PhaseFetch, fmt.Sprintf("source=%s fromCache=%v", c.SourceURL, c.FromCache))
+	return c, nil
+}
+
+// pyprojectPath returns the path to pyproject.toml in the project directory.
+func (p *Pipeline) pyprojectPath() string {
+	return filepath.Join(p.ProjectDir, pyprojectFile)
+}
+
+// backupPath returns the path to the canonical pyproject.toml backup file in dir.
+func backupPath(dir string) string {
+	return filepath.Join(dir, backupFile)
+}
+
+// timestampedBackupBase is the <dir>/pyproject.toml.<local timestamp> stem
+// a non-first backup name is built from.
+func (p *Pipeline) timestampedBackupBase(dir string) string {
+	return filepath.Join(dir, pyprojectFile+"."+p.clock().Format(backupTimestampLayout))
+}
+
+// backupCurrent writes content to a backup of the pyproject.toml in dir and
+// returns its path, never overwriting an existing backup (invariant 2). The canonical
+// pyproject.toml.bak is written once and kept as the pristine original; later
+// backups are pyproject.toml.<timestamp>.bak. mode is preserved onto the file.
+func (p *Pipeline) backupCurrent(dir string, content []byte, mode os.FileMode) (string, error) {
+	canonical := backupPath(dir)
+	switch err := writeNew(canonical, content, mode); {
+	case err == nil:
+		return canonical, nil
+	case !errors.Is(err, os.ErrExist):
+		return "", err
+	}
+
+	base := p.timestampedBackupBase(dir)
+	candidate := base + ".bak"
+	for i := 1; ; i++ {
+		// Only a name collision advances the suffix, so the loop terminates.
+		switch err := writeNew(candidate, content, mode); {
+		case err == nil:
+			return candidate, nil
+		case !errors.Is(err, os.ErrExist):
+			return "", err
+		}
+		candidate = fmt.Sprintf("%s-%d.bak", base, i)
+	}
+}
+
+// plannedBackupName previews the backup name a real run would create — canonical
+// .bak if none exists yet, else a timestamped name — for --dry-run only. Best-effort:
+// an unstattable .bak returns an error the caller treats as "nothing to report".
+func (p *Pipeline) plannedBackupName(dir string) (string, error) {
+	canonical := backupPath(dir)
+	_, statErr := os.Stat(canonical)
+	switch {
+	case errors.Is(statErr, os.ErrNotExist):
+		return canonical, nil
+	case statErr == nil:
+		return p.timestampedBackupBase(dir) + ".bak", nil
+	default:
+		return "", statErr
+	}
+}
+
+// mergePlan computes the merged pyproject.toml bytes (without writing to disk),
+// decides greenfield vs. existing, and builds the Plan (populated only under
+// --dry-run). opts selects which managed axes are written. envVersion is the
+// serverless environment version to write into [tool.databricks.environment], or
+// "" for a cluster target.
+func (p *Pipeline) mergePlan(_ context.Context, pyMinor string, c *Constraints, envVersion string, opts MergeOptions) (merged []byte, root *rootMerge, greenfield bool, err error) {
+	pyproject := p.pyprojectPath()
+
+	// The merge base is the live pyproject.toml, not the backup. MergeManaged
+	// rewrites only the three managed regions and preserves every other byte, and
+	// it is idempotent on its own output — so merging onto the current file yields
+	// managed regions identical to merging onto the pristine .bak, but without
+	// discarding edits the user made between syncs (add a dependency, then
+	// re-sync). The .bak stays a one-time safety copy of the pre-sync original, not
+	// the merge base.
+	var baseBytes []byte
+	data, rerr := os.ReadFile(pyproject)
+	switch {
+	case rerr == nil:
+		baseBytes = data
+	case !errors.Is(rerr, os.ErrNotExist):
+		// Only a genuine not-exist means greenfield. Any other read error on an
+		// existing pyproject.toml (permission change, transient I/O, delete race
+		// after detectManager saw it) must not be misread as greenfield — that
+		// would render a fresh file and overwrite the user's project with no
+		// backup. Fail instead of destroying unrecoverable state (invariant 2).
+		return nil, nil, false, p.fail(PhaseMerge, false, NewError(ErrMerge, rerr, "read pyproject.toml %s failed", filepath.ToSlash(pyproject)))
+	}
+	greenfield = baseBytes == nil
+
+	// envVersion (empty for cluster targets) is deliberately NOT gated by
+	// SkipDBConnect: unlike the databricks-connect pin (a managed *dependency* the
+	// mode opts out of), it records the resolved compute *target*, kept so VS Code
+	// and serverless Jobs can still discover it.
+	//
+	// The skip axes govern only what is *written*: provisioning still installs and
+	// validates the resolved Python (pyMinor), so a kept requires-python disjoint
+	// from the target surfaces as a normal E_PROVISION, not a guessed alternative.
+	effective := *c
+	effective.EnvironmentVersion = envVersion
+
+	var changedRegions []string
+	if greenfield {
+		// No existing pyproject.toml — render a fresh one. The project name comes
+		// from the directory name as a reasonable default. Only the regions actually
+		// rendered are reported (requires-python and tool.uv omitted under
+		// --no-constraints; databricks-connect omitted under --no-dbconnect).
+		merged = RenderFreshPyproject(projectName(p.ProjectDir), effective, opts)
+		if !opts.SkipConstraints {
+			changedRegions = append(changedRegions, regionRequiresPython, regionToolUv)
+		}
+		if !opts.SkipDBConnect && c.DatabricksConnect != "" {
+			changedRegions = append(changedRegions, regionDatabricksConnect)
+		}
+		if envVersion != "" {
+			changedRegions = append(changedRegions, regionDatabricksEnvironment)
+		}
+	} else {
+		merged, changedRegions, err = MergeManaged(baseBytes, effective, opts)
+		if err != nil {
+			return nil, nil, greenfield, p.fail(PhaseMerge, false, NewError(ErrMerge, err, "merge managed regions failed"))
+		}
+		// Surface merge-quality warnings (overridden, consolidated, or duplicated pins,
+		// conflicting user constraints) from the pre-merge file. Greenfield has nothing of
+		// the user's to override, so it is skipped. This runs for both dry-run and real
+		// runs so the --json consumer sees the same warnings either way. The databricks-connect
+		// edits come from the merge itself (planDBConnect), so a warning can never claim a
+		// rewrite or removal that did not happen.
+		p.res.Warnings = append(p.res.Warnings,
+			detectMergeWarnings(baseBytes, effective, planDBConnect(baseBytes, effective, opts), opts)...)
+	}
+
+	root, err = p.planRootMerge(c.ConstraintDeps, opts)
+	if err != nil {
+		return nil, nil, greenfield, err
+	}
+	if root != nil && root.changed {
+		changedRegions = append(changedRegions, regionWorkspaceToolUv)
+	}
+
+	// Under --dry-run, build the plan (with a diff) for reporting. A real run does
+	// not need the diff.
+	if p.Check {
+		diff := pyprojectDiff(pyprojectFile, baseBytes, merged, greenfield)
+		if root != nil {
+			diff += pyprojectDiff("uv workspace root "+pyprojectFile, root.base, root.merged, false)
+		}
+		plan := &Plan{
+			WouldWrite:         filepath.ToSlash(pyproject),
+			Diff:               diff,
+			ChangedRegions:     changedRegions,
+			WouldInstallPython: pyMinor,
+		}
+		// Report a backup only when the run would actually write one (i.e. it changes
+		// the file); a no-op re-run writes none.
+		if !greenfield && !bytes.Equal(merged, baseBytes) {
+			if backupName, statErr := p.plannedBackupName(filepath.Dir(pyproject)); statErr == nil {
+				plan.WouldBackup = filepath.ToSlash(backupName)
+			}
+		}
+		// Unlike the member file, the root is reported only when the run changes
+		// it; Result.UvWorkspaceRoot already names the root.
+		if root != nil && root.changed {
+			plan.WouldWriteUvWorkspace = filepath.ToSlash(root.path)
+			if backupName, statErr := p.plannedBackupName(p.workspaceRoot); statErr == nil {
+				plan.WouldBackupUvWorkspace = filepath.ToSlash(backupName)
+			}
+		}
+		p.res.Plan = plan
+	}
+	return merged, root, greenfield, nil
+}
+
+// rootMerge is the planned change to the workspace root pyproject.toml.
+type rootMerge struct {
+	path    string
+	base    []byte
+	merged  []byte
+	changed bool
+}
+
+// planRootMerge merges the constraint block into the workspace root
+// pyproject.toml. It returns nil when there is no workspace root or when
+// constraints are not managed (--no-constraints).
+func (p *Pipeline) planRootMerge(deps []string, opts MergeOptions) (*rootMerge, error) {
+	if p.workspaceRoot == "" || opts.SkipConstraints {
+		return nil, nil
+	}
+	path := filepath.Join(p.workspaceRoot, pyprojectFile)
+	base, err := os.ReadFile(path)
+	if err != nil {
+		return nil, p.fail(PhaseMerge, false, NewError(ErrMerge, err, "read workspace root pyproject.toml %s failed", filepath.ToSlash(path)))
+	}
+	merged, changed, replaced, err := MergeToolUvBlock(base, deps)
+	if err != nil {
+		return nil, p.fail(PhaseMerge, false, NewError(ErrMerge, err, "merge workspace root constraints failed"))
+	}
+	// Earlier pins are replaced, whether an earlier run (maybe for another
+	// bundle) wrote them or the user did, and the new ones apply to every member.
+	if replaced {
+		p.res.Warnings = append(p.res.Warnings, Warning{
+			Code:    WarnUvWorkspaceConstraintsReplaced,
+			Message: fmt.Sprintf("the constraint pins in %s are replaced; all members of this uv workspace share them", filepath.ToSlash(path)),
+		})
+	}
+	return &rootMerge{path: path, base: base, merged: merged, changed: changed}, nil
+}
+
+// pyprojectDiff renders the unified diff the --dry-run plan reports for one
+// pyproject.toml. label is the file name shown in the diff headers: an existing
+// file diffs label against label+".new"; a greenfield file has empty old content
+// and label in both headers.
+func pyprojectDiff(label string, base, merged []byte, greenfield bool) string {
+	oldStr := ""
+	newStr := string(merged)
+	oldName := label
+	newName := label
+	if !greenfield {
+		oldStr = string(base)
+		newName = label + ".new"
+	}
+	edits := myers.ComputeEdits(span.URIFromPath(oldName), oldStr, newStr)
+	return fmt.Sprint(gotextdiff.ToUnified(oldName, newName, oldStr, edits))
+}
+
+// applyMerge writes the merged bytes to disk, backing up the current
+// pyproject.toml first. From the backup copy onward, disk has been mutated.
+func (p *Pipeline) applyMerge(_ context.Context, mergedBytes []byte, root *rootMerge, greenfield bool) error {
+	backup, mutated, perr := p.writePyproject(p.pyprojectPath(), mergedBytes, greenfield)
+	// A backup written before a failed write is still reported, so the consumer
+	// can restore from it.
+	if backup != "" {
+		p.res.BackupPath = filepath.ToSlash(backup)
+	}
+	if perr != nil {
+		return p.fail(PhaseMerge, mutated, perr)
+	}
+	if root != nil && root.changed {
+		// The member is written first, so a root failure reports disk as mutated
+		// when either write changed it.
+		rootBackup, rootMutated, perr := p.writePyproject(root.path, root.merged, false)
+		if rootBackup != "" {
+			p.res.UvWorkspaceBackupPath = filepath.ToSlash(rootBackup)
+		}
+		if perr != nil {
+			perr.Msg = "uv workspace root: " + perr.Msg
+			return p.fail(PhaseMerge, mutated || rootMutated, perr)
+		}
+	}
+	return nil
+}
+
+// writePyproject writes merged over the pyproject.toml at path, backing up the
+// current file first (into the same folder) unless greenfield. A no-op merge
+// writes nothing and returns no backup. diskMutated reports whether disk changed,
+// on success and on failure; on failure the caller passes it to p.fail.
+func (p *Pipeline) writePyproject(path string, merged []byte, greenfield bool) (backup string, diskMutated bool, perr *PipelineError) {
+	if !greenfield {
+		// Stat+read up front: mode is preserved onto the backup, content is the
+		// no-op base and the backup source. Fail before any write (no mutation yet)
+		// rather than swallow a stat/read error on an existing pyproject.toml.
+		info, statErr := os.Stat(path)
+		if statErr != nil {
+			return "", false, NewError(ErrMerge, statErr, "stat pyproject.toml %s failed", filepath.ToSlash(path))
+		}
+		current, readErr := os.ReadFile(path)
+		if readErr != nil {
+			return "", false, NewError(ErrMerge, readErr, "read pyproject.toml %s failed", filepath.ToSlash(path))
+		}
+
+		// No-op: the merged output already matches disk. On an idempotent re-run
+		// mergePlan reproduces the current file byte for byte, so rewriting it would
+		// only advance the mtime — spuriously invalidating file watchers and uv.lock
+		// freshness checks — without changing content. Skip both the backup and the
+		// write, leaving disk (and every existing backup) exactly as it was.
+		if bytes.Equal(current, merged) {
+			return "", false, nil
+		}
+
+		// Back up before overwriting (invariant 2). A partial backup is possible
+		// mid-write, so report disk as mutated on error.
+		b, backupErr := p.backupCurrent(filepath.Dir(path), current, info.Mode().Perm())
+		if backupErr != nil {
+			return "", true, NewError(ErrMerge, backupErr, "backup pyproject.toml failed")
+		}
+		backup = b
+	}
+
+	if err := atomicfile.Write(path, merged, 0o644); err != nil {
+		code := ErrMerge
+		if greenfield {
+			code = ErrWrite
+		}
+		return backup, true, NewError(code, err, "write pyproject.toml failed")
+	}
+	return backup, true, nil
+}
+
+// provision ensures the required Python version is installed, runs uv sync, and
+// seeds pip. All three are reported under the provision phase.
+func (p *Pipeline) provision(ctx context.Context, pyMinor string) error {
+	selection, err := p.PM.EnsurePython(ctx, pyMinor)
+	if err != nil {
+		return p.fail(PhaseProvision, true, asPipelineError(err, ErrPythonInstall, "ensure python %s failed", pyMinor))
+	}
+	// Record how Python was resolved before sync: if provisioning fails after an
+	// installed fallback was selected, IDE consumers still need that categorical
+	// fact to offer the correct manual recovery without receiving the path.
+	p.res.PythonResolution = selection.Resolution
+	if selection.Resolution == PythonResolutionInstalledFallback {
+		// Only the fallback yields a concrete interpreter path; the normal path's
+		// Executable is just the minor request. The text summary names it (json:"-").
+		p.res.PythonInterpreter = selection.Executable
+	}
+	if err := p.PM.Provision(ctx, p.ProjectDir, selection.Executable); err != nil {
+		return p.fail(PhaseProvision, true, asPipelineError(err, ErrProvision, "provision failed"))
+	}
+	if err := p.PM.PostProvision(ctx, p.ProjectDir, p.venv); err != nil {
+		return p.fail(PhaseProvision, true, asPipelineError(err, ErrProvision, "post-provision failed"))
+	}
+	p.markOK(PhaseProvision, "")
+	return nil
+}
+
+// hasConstraintConflictWarning reports whether the merge phase recorded a provable
+// user/environment version conflict (W_USER_CONSTRAINT_CONFLICT). It reads the
+// warnings already accumulated on the Result, which the merge phase populates
+// before provision runs, so it is only meaningful once merge has completed.
+func (p *Pipeline) hasConstraintConflictWarning() bool {
+	for _, w := range p.res.Warnings {
+		if w.Code == WarnUserConstraintConflict {
+			return true
+		}
+	}
+	return false
+}
+
+// validate reads the Python and databricks-connect versions from the venv and
+// populates the venv path. dbcPin is the resolved databricks-connect pin; when it
+// is not managed (opts.SkipDBConnect) the databricks-connect assertion and version
+// reporting are skipped.
+func (p *Pipeline) validate(ctx context.Context, expectedPyMinor, dbcPin string, opts MergeOptions) error {
+	info, err := p.PM.Validate(ctx, p.ProjectDir, p.venv)
+	if err != nil {
+		return p.fail(PhaseValidate, true, asPipelineError(err, ErrValidate, "validation failed"))
+	}
+	pyVer, dbcVer := info.PythonMinor, info.DBConnect
+
+	// A standalone pyspark installed alongside databricks-connect collides only when the
+	// collision is *live*. databricks-connect vendors its own pyspark, so the two share
+	// the pyspark namespace and whichever install's files win the overwrite decide
+	// whether `import databricks.connect` works. When it does not, the environment
+	// genuinely cannot start a session (surfacing to users as an opaque Java or protobuf
+	// error), so fail here rather than report it ready. But a stale, orphaned pyspark
+	// dist-info left behind by an install databricks-connect's files won leaves the
+	// metadata probe reporting a pyspark version while the environment imports fine —
+	// failing on that would reject a working setup, so require an actual import failure.
+	if dbcVer != "" && info.Pyspark != "" && info.DBConnectImportErr != "" {
+		return p.fail(PhaseValidate, true, NewError(ErrValidate, nil,
+			"databricks-connect %s cannot be imported (%s) because a standalone pyspark %s is installed alongside it — they share the pyspark package and overwrite each other. Remove the standalone pyspark dependency from your project and re-run setup; if you need a local Spark session, keep it in a separate virtual environment",
+			dbcVer, info.DBConnectImportErr, info.Pyspark))
+	}
+
+	// Assert the installed Python minor matches the target.
+	if pyVer != expectedPyMinor {
+		return p.fail(PhaseValidate, true, NewError(ErrValidate, nil,
+			"python version mismatch: want %s, got %s", expectedPyMinor, pyVer))
+	}
+
+	// When databricks-connect is managed, assert the installed major matches the
+	// pin's major. dbcPin is e.g. "databricks-connect~=17.2.0"; dbcVer is "17.2.0".
+	if !opts.SkipDBConnect && dbcPin != "" {
+		pinMajor := dbcMajorFromPin(dbcPin)
+		if pinMajor == "" {
+			return p.fail(PhaseValidate, true, NewError(ErrValidate, nil,
+				"cannot determine databricks-connect major version from pin %q", dbcPin))
+		}
+		installedMajor := majorVersion(dbcVer)
+		if installedMajor == "" {
+			return p.fail(PhaseValidate, true, NewError(ErrValidate, nil,
+				"cannot determine installed databricks-connect major version from %q", dbcVer))
+		}
+		if pinMajor != installedMajor {
+			return p.fail(PhaseValidate, true, NewError(ErrValidate, nil,
+				"databricks-connect major version mismatch: want %s.x, got %s", pinMajor, dbcVer))
+		}
+	}
+
+	// Report the installed databricks-connect version only when it is a managed
+	// dependency, so the spec omits dbconnectVersion even if the package is present
+	// transitively.
+	managed := !opts.SkipDBConnect && dbcPin != ""
+
+	detail := "python=" + pyVer
+	if managed && dbcVer != "" {
+		detail += " databricks-connect=" + dbcVer
+	}
+	p.markOK(PhaseValidate, detail)
+
+	// venvPath is reported relative to the project root (spec §6.1): the VS Code
+	// consumer already knows the project root (it sets the working directory
+	// when it shells out). By default it is ".venv", or a path such as
+	// "../../.venv" for a workspace member (see discoverWorkspaceRoot); it is
+	// absolute only when UV_PROJECT_ENVIRONMENT is absolute.
+	p.res.VenvPath = filepath.ToSlash(p.venvRel)
+	if p.res.Resolved != nil {
+		if managed {
+			p.res.Resolved.DBConnectVersion = dbcVer
+		} else {
+			p.res.Resolved.DBConnectVersion = ""
+		}
+	}
+	return nil
+}
+
+// initialPhases returns the canonical phase list with every phase pending.
+func initialPhases() []PhaseStatus {
+	phases := make([]PhaseStatus, len(allPhases))
+	for i, name := range allPhases {
+		phases[i] = PhaseStatus{Phase: name, Status: StatusPending}
+	}
+	return phases
+}
+
+// report announces entry into a phase to the Progress reporter, if one is set,
+// and logs the transition at debug level so --debug keeps a phase-by-phase trail.
+func (p *Pipeline) report(ctx context.Context, name PhaseName) {
+	if p.Progress != nil {
+		p.Progress.PhaseStarted(name)
+	}
+	log.Debugf(ctx, CommandName+": entering phase %s", name)
+}
+
+// markOK marks a phase ok with an optional human-readable detail.
+func (p *Pipeline) markOK(name PhaseName, detail string) {
+	for i := range p.res.Phases {
+		if p.res.Phases[i].Phase == name {
+			p.res.Phases[i].Status = StatusOK
+			p.res.Phases[i].Detail = detail
+			return
+		}
+	}
+}
+
+// fail marks the given phase as errored, attaches the error (with its phase and
+// disk-mutation flag) to the Result, and returns it. Phases after the failing
+// one remain pending.
+func (p *Pipeline) fail(phase PhaseName, diskMutated bool, pe *PipelineError) error {
+	pe.FailurePhase = phase
+	pe.DiskMutated = diskMutated
+	for i := range p.res.Phases {
+		if p.res.Phases[i].Phase == phase {
+			p.res.Phases[i].Status = StatusError
+			p.res.Phases[i].Detail = pe.Error()
+			break
+		}
+	}
+	p.res.Error = pe
+	return pe
+}
+
+// syncFailureDetail re-copies the recorded error's text into its phase's Detail.
+// fail() sets Detail when the failure happens; a caller that rewrites the error
+// afterwards (Run's E_CANCELED reclassification) must call this so text output —
+// which prints Detail — keeps agreeing with the --json error object.
+func (p *Pipeline) syncFailureDetail() {
+	if p.res.Error == nil {
+		return
+	}
+	for i := range p.res.Phases {
+		if p.res.Phases[i].Phase == p.res.Error.FailurePhase {
+			p.res.Phases[i].Detail = p.res.Error.Error()
+			return
+		}
+	}
+}
+
+// asPipelineError returns err as a *PipelineError if it already is one, otherwise
+// wraps it with the fallback code and message.
+func asPipelineError(err error, fallback ErrorCode, format string, args ...any) *PipelineError {
+	if pe, ok := errors.AsType[*PipelineError](err); ok {
+		return pe
+	}
+	return NewError(fallback, err, format, args...)
+}
+
+// artifactSource maps the from-cache flag to the JSON artifactSource value.
+func artifactSource(fromCache bool) string {
+	if fromCache {
+		return artifactCache
+	}
+	return artifactNetwork
+}
+
+// versionFromPin extracts the bare version from a dependency pin such as
+// "databricks-connect~=17.2.0" → "17.2.0". Returns "" when pin is empty or has
+// no version component.
+func versionFromPin(pin string) string {
+	for i, c := range pin {
+		if c >= '0' && c <= '9' {
+			return pin[i:]
+		}
+	}
+	return ""
+}
+
+// dbcMajorFromPin extracts the major version number from a databricks-connect
+// pin string such as "databricks-connect~=17.2.0". Returns "" if unparseable.
+func dbcMajorFromPin(pin string) string {
+	return majorVersion(versionFromPin(pin))
+}
+
+// dbcVersionFromPin returns the pin's version only when it is a concrete
+// major.minor.patch, so a range-only pin like "~=17.0" (serverless pins by
+// major, databricks/environments#15) reports "" rather than the "17.0" floor
+// nothing installs. Gating only the reported version keeps dbcMajorFromPin's raw
+// versionFromPin extraction intact for the real-run major assertion in validate.
+func dbcVersionFromPin(pin string) string {
+	v := versionFromPin(pin)
+	if !isFullVersion(v) {
+		return ""
+	}
+	return v
+}
+
+// isFullVersion reports whether v has at least three numeric dot-separated
+// components, e.g. "17.3.0" but not "17.0". This is not a PEP 440 validator:
+// only the leading major.minor.patch must be digit-terminated, so suffixed forms
+// like "17.3.0.dev1" or "17.3.0.post1" pass through unchecked. That is fine here
+// because real pins are either major-only (~=17.0) or a concrete GA (~=17.3.0).
+func isFullVersion(v string) bool {
+	parts := strings.Split(v, ".")
+	if len(parts) < 3 {
+		return false
+	}
+	return isAllDigits(parts[0]) && isAllDigits(parts[1]) && isAllDigits(parts[2])
+}
+
+// majorVersion returns the major portion of a version string (digits before the
+// first dot), e.g. "17" from "17.2.0". A bare integer like "17" returns "17".
+// Returns "" for an empty string or a non-numeric major component, so the
+// validate phase rejects a malformed version rather than comparing arbitrary
+// strings as major versions.
+func majorVersion(v string) string {
+	if v == "" {
+		return ""
+	}
+	before, _, ok := strings.Cut(v, ".")
+	if !ok {
+		before = v
+	}
+	if before == "" || !isAllDigits(before) {
+		return ""
+	}
+	return before
+}
+
+// isAllDigits reports whether s is non-empty and every rune is an ASCII digit.
+func isAllDigits(s string) bool {
+	if s == "" {
+		return false
+	}
+	for _, c := range s {
+		if c < '0' || c > '9' {
+			return false
+		}
+	}
+	return true
+}
+
+// defaultProjectName is used for a fresh pyproject.toml when the project
+// directory yields no usable PEP 508 name (e.g. filesystem root).
+const defaultProjectName = "app"
+
+// projectName derives a PEP 508-valid project name from the project directory.
+// filepath.Base(".") / ("") is "." and Base("/") is "/", none of which are valid
+// [project].name values, so uv sync would reject the rendered file. Resolve to an
+// absolute path first so "." picks up the real directory name, then sanitize to a
+// valid identifier, falling back to defaultProjectName when nothing usable remains.
+func projectName(dir string) string {
+	base := filepath.Base(dir)
+	if base == "." || base == string(filepath.Separator) || base == "" {
+		if abs, err := filepath.Abs(dir); err == nil {
+			base = filepath.Base(abs)
+		}
+	}
+	return sanitizeProjectName(base)
+}
+
+// sanitizeProjectName maps an arbitrary directory name to a valid PEP 508 name:
+// runs of non-alphanumeric characters collapse to a single "-", and leading and
+// trailing separators are trimmed (a PEP 508 name must start and end with an
+// alphanumeric). Returns defaultProjectName when nothing usable remains.
+func sanitizeProjectName(name string) string {
+	var b strings.Builder
+	prevDash := false
+	for _, r := range name {
+		switch {
+		case (r >= 'a' && r <= 'z') || (r >= 'A' && r <= 'Z') || (r >= '0' && r <= '9'):
+			b.WriteRune(r)
+			prevDash = false
+		default:
+			if b.Len() > 0 && !prevDash {
+				b.WriteByte('-')
+				prevDash = true
+			}
+		}
+	}
+	out := strings.Trim(b.String(), "-")
+	if out == "" {
+		return defaultProjectName
+	}
+	return out
+}
+
+// writeNew creates path with content, failing (os.ErrExist) rather than
+// overwriting an existing file. This no-clobber guarantee (O_EXCL) is why a
+// backup can never destroy an earlier one. mode sets the new file's permission
+// bits, so a backup keeps a locked-down pyproject.toml's permissions.
+func writeNew(path string, content []byte, mode os.FileMode) error {
+	f, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_EXCL, mode)
+	if err != nil {
+		return err
+	}
+	_, werr := f.Write(content)
+	if err := errors.Join(werr, f.Close()); err != nil {
+		// Drop the partial file so it can't pose as a complete backup and, being
+		// O_EXCL-occupied, block a later run from reclaiming the name. Best-effort.
+		_ = os.Remove(path)
+		return err
+	}
+	return nil
+}
diff --git a/libs/localenv/pipeline_test.go b/libs/localenv/pipeline_test.go
new file mode 100644
index 00000000000..1627a76e8bc
--- /dev/null
+++ b/libs/localenv/pipeline_test.go
@@ -0,0 +1,1670 @@
+package localenv
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/databricks/cli/libs/env"
+	"github.com/databricks/cli/libs/process"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// cancelPMStderr is the stderr the interrupted uv sync emits. It stands in for a
+// real resolver diagnostic — the thing the cancellation reclassification must not
+// drop when it races with a Ctrl-C.
+const cancelPMStderr = "error: no solution found: databricks-connect==17.2 conflicts with pyspark==3.5"
+
+// fetchDelay is injected into the constraint fetch by the duration tests. It gives
+// each run a known minimum wall time, so the reported duration can be bounded from
+// below — a plain ">= 0" assertion would also hold for the unset field.
+const fetchDelay = 25 * time.Millisecond
+
+type fakePM struct {
+	py, dbc, pyspark, dbcImportErr string
+	// root and rootErr are what WorkspaceRoot reports; an empty root means the
+	// project is not a workspace member.
+	root    string
+	rootErr error
+}
+
+func (fakePM) Name() string                                    { return "fake" }
+func (fakePM) EnsureAvailable(context.Context) (string, error) { return "fake 1.0", nil }
+func (fakePM) EnsurePython(_ context.Context, minor string) (PythonSelection, error) {
+	return PythonSelection{Executable: minor, Resolution: PythonResolutionUVInstallSucceeded}, nil
+}
+
+func (f fakePM) WorkspaceRoot(_ context.Context, projectDir string) (string, error) {
+	if f.rootErr != nil {
+		return "", f.rootErr
+	}
+	if f.root != "" {
+		return f.root, nil
+	}
+	return projectDir, nil
+}
+
+func (fakePM) Provision(context.Context, string, string) error     { return nil }
+func (fakePM) PostProvision(context.Context, string, string) error { return nil }
+func (f fakePM) Validate(context.Context, string, string) (VenvInfo, error) {
+	return VenvInfo{PythonMinor: f.py, DBConnect: f.dbc, Pyspark: f.pyspark, DBConnectImportErr: f.dbcImportErr}, nil
+}
+
+// noProvisionPM fails any method that could touch the machine (install the
+// manager, install Python, sync, seed pip, validate). It asserts that --dry-run
+// never reaches those write-side operations.
+type noProvisionPM struct{}
+
+func (noProvisionPM) Name() string { return "noprov" }
+func (noProvisionPM) EnsureAvailable(context.Context) (string, error) {
+	return "", errors.New("EnsureAvailable must not be called under --dry-run")
+}
+
+func (noProvisionPM) EnsurePython(context.Context, string) (PythonSelection, error) {
+	return PythonSelection{}, errors.New("EnsurePython must not be called under --dry-run")
+}
+
+func (noProvisionPM) WorkspaceRoot(_ context.Context, projectDir string) (string, error) {
+	return projectDir, nil
+}
+
+func (noProvisionPM) Provision(context.Context, string, string) error {
+	return errors.New("Provision must not be called under --dry-run")
+}
+
+func (noProvisionPM) PostProvision(context.Context, string, string) error {
+	return errors.New("PostProvision must not be called under --dry-run")
+}
+
+func (noProvisionPM) Validate(context.Context, string, string) (VenvInfo, error) {
+	return VenvInfo{}, errors.New("Validate must not be called under --dry-run")
+}
+
+// uvMissingPM fails EnsureAvailable, simulating a machine where the package
+// manager binary is absent and cannot be installed. The remaining methods
+// inherit fakePM but must never be reached, since preflight aborts first.
+type uvMissingPM struct{ fakePM }
+
+func (uvMissingPM) EnsureAvailable(context.Context) (string, error) {
+	return "", errors.New("uv not found and install failed")
+}
+
+type recordingPM struct {
+	fakePM
+	minor           string
+	provisionPython string
+	provisionErr    error
+}
+
+func (p *recordingPM) EnsurePython(_ context.Context, minor string) (PythonSelection, error) {
+	p.minor = minor
+	return PythonSelection{
+		Executable: "/installed/python3.12",
+		Resolution: PythonResolutionInstalledFallback,
+	}, nil
+}
+
+func (p *recordingPM) Provision(_ context.Context, _, python string) error {
+	p.provisionPython = python
+	return p.provisionErr
+}
+
+// cancelPM simulates uv being interrupted: Provision closes entered (so the test
+// knows the pipeline reached this phase), blocks until the context is cancelled,
+// then returns a *process.ProcessError carrying uv's stderr (NOT context.Canceled),
+// exactly as a real `uv sync` does when it exits on SIGTERM mid-resolution. The
+// stderr is the real diagnostic; the pipeline's uvFailure folds it into the
+// PipelineError's Msg, which the cancellation reclassification must preserve.
+type cancelPM struct {
+	fakePM
+	entered chan struct{}
+}
+
+func (c cancelPM) Provision(ctx context.Context, _, _ string) error {
+	close(c.entered)
+	<-ctx.Done()
+	// Mirror uvManager.Provision's real return: a *PipelineError from uvFailure,
+	// which folds uv's stderr into Msg. Returning a bare ProcessError would not
+	// reproduce the stderr-in-Msg shape the reclassification must preserve.
+	return uvFailure(ErrProvision, &process.ProcessError{
+		Command: "uv sync",
+		Err:     errors.New("signal: terminated"),
+		Stderr:  cancelPMStderr,
+	}, "uv sync")
+}
+
+func writeProject(t *testing.T) string {
+	dir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "pyproject.toml"), []byte(`[project]
+name = "demo"
+requires-python = ">=3.10"
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0.0"]
+`), 0o644))
+	return dir
+}
+
+func TestPipelineProvisionsWithSelectedPython(t *testing.T) {
+	dir := writeProject(t)
+	srv := newTestServer(t)
+	defer srv.Close()
+	pm := &recordingPM{py: "3.12", dbc: "17.2.0"}
+	p := &Pipeline{
+		Mode: ModeDefault, ProjectDir: dir,
+		ConstraintBaseURL: srv.URL, CacheDir: t.TempDir(),
+		Flags: ComputeFlags{Serverless: "v4"}, Compute: stubCompute{}, PM: pm,
+	}
+
+	res, err := p.Run(t.Context())
+
+	require.NoError(t, err)
+	assert.Equal(t, "3.12", pm.minor)
+	assert.Equal(t, "/installed/python3.12", pm.provisionPython)
+	assert.Equal(t, PythonResolutionInstalledFallback, res.PythonResolution)
+	assert.Equal(t, "/installed/python3.12", res.PythonInterpreter)
+}
+
+func TestPipelineRetainsFallbackResolutionWhenProvisioningFails(t *testing.T) {
+	dir := writeProject(t)
+	srv := newTestServer(t)
+	defer srv.Close()
+	pm := &recordingPM{
+		py: "3.12", dbc: "17.2.0",
+		provisionErr: errors.New("sync failed"),
+	}
+	p := &Pipeline{
+		Mode: ModeDefault, ProjectDir: dir,
+		ConstraintBaseURL: srv.URL, CacheDir: t.TempDir(),
+		Flags: ComputeFlags{Serverless: "v4"}, Compute: stubCompute{}, PM: pm,
+	}
+
+	res, err := p.Run(t.Context())
+
+	require.Error(t, err)
+	assert.Equal(t, PythonResolutionInstalledFallback, res.PythonResolution)
+	require.NotNil(t, res.Error)
+	assert.Equal(t, ErrProvision, res.Error.Code)
+}
+
+func newTestServer(t *testing.T) *httptest.Server {
+	return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte(sampleToml))
+	}))
+}
+
+func TestPipelineRejectsConflictingComputeFlagsAtPreflight(t *testing.T) {
+	// Incompatible target flags are a usage error surfaced as E_USAGE at
+	// preflight, before any manager/writability/fetch work.
+	dir := writeProject(t)
+	p := &Pipeline{
+		Mode: ModeDefault, Check: true, ProjectDir: dir, CacheDir: t.TempDir(),
+		Flags:   ComputeFlags{Cluster: "abc", Serverless: "v4"},
+		Compute: stubCompute{}, PM: fakePM{py: "3.12", dbc: "17.2.0"},
+	}
+	res, err := p.Run(t.Context())
+	var pe *PipelineError
+	require.ErrorAs(t, err, &pe)
+	assert.Equal(t, ErrUsage, pe.Code)
+	assert.Equal(t, PhasePreflight, pe.FailurePhase)
+	assert.False(t, pe.DiskMutated)
+	require.NotNil(t, res.Error)
+	assert.Equal(t, ErrUsage, res.Error.Code)
+}
+
+func TestPipelineCheckMutatesNothing(t *testing.T) {
+	dir := writeProject(t)
+	before, _ := os.ReadFile(filepath.Join(dir, "pyproject.toml"))
+	cacheDir := t.TempDir()
+	srv := newTestServer(t)
+	defer srv.Close()
+
+	p := &Pipeline{
+		Mode: ModeDefault, Check: true, ProjectDir: dir,
+		ConstraintBaseURL: srv.URL, CacheDir: cacheDir,
+		Flags:   ComputeFlags{Serverless: "v4"},
+		Compute: stubCompute{}, PM: fakePM{py: "3.12", dbc: "17.2.0"},
+	}
+	res, err := p.Run(t.Context())
+	require.NoError(t, err)
+	assert.True(t, res.DryRun)
+	assert.True(t, res.OK)
+	require.NotNil(t, res.Plan)
+	assert.Contains(t, res.Plan.Diff, "==3.12.*")
+	after, _ := os.ReadFile(filepath.Join(dir, "pyproject.toml"))
+	assert.Equal(t, string(before), string(after)) // unchanged
+
+	// --dry-run must not populate the constraint cache either (no disk writes).
+	entries, err := os.ReadDir(cacheDir)
+	require.NoError(t, err)
+	assert.Empty(t, entries)
+}
+
+func TestPipelineSurfacesMergeWarnings(t *testing.T) {
+	// writeProject pins requires-python ">=3.10" and databricks-connect ~=16.0.0,
+	// while sampleToml pins "==3.12.*" and ~=17.2.0 — the merge overrides both, so the
+	// result must carry both override warnings.
+	dir := writeProject(t)
+	srv := newTestServer(t)
+	defer srv.Close()
+
+	p := &Pipeline{
+		Mode: ModeDefault, Check: true, ProjectDir: dir,
+		ConstraintBaseURL: srv.URL, CacheDir: t.TempDir(),
+		Flags:   ComputeFlags{Serverless: "v4"},
+		Compute: stubCompute{}, PM: fakePM{py: "3.12", dbc: "17.2.0"},
+	}
+	res, err := p.Run(t.Context())
+	require.NoError(t, err)
+	assert.Equal(t, []string{WarnRequiresPythonOverridden, WarnDBConnectPinOverridden}, codes(res.Warnings))
+}
+
+func TestPipelineGreenfieldHasNoWarnings(t *testing.T) {
+	// A greenfield project has nothing of the user's to override.
+	dir := t.TempDir()
+	srv := newTestServer(t)
+	defer srv.Close()
+
+	p := &Pipeline{
+		Mode: ModeDefault, Check: true, ProjectDir: dir,
+		ConstraintBaseURL: srv.URL, CacheDir: t.TempDir(),
+		Flags:   ComputeFlags{Serverless: "v4"},
+		Compute: stubCompute{}, PM: fakePM{py: "3.12", dbc: "17.2.0"},
+	}
+	res, err := p.Run(t.Context())
+	require.NoError(t, err)
+	assert.Empty(t, res.Warnings)
+	assert.True(t, res.Greenfield)
+}
+
+// newSlowServer serves the constraint artifact after fetchDelay, replying with
+// status so a caller can turn the fetch into a delayed failure.
+func newSlowServer(t *testing.T, status int) *httptest.Server {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		time.Sleep(fetchDelay)
+		w.WriteHeader(status)
+		_, _ = w.Write([]byte(sampleToml))
+	}))
+	t.Cleanup(srv.Close)
+	return srv
+}
+
+func TestPipelineReportsDuration(t *testing.T) {
+	// durationMs used to be hardcoded to 0, so a ">= 0" assertion would pass against
+	// the old behavior and prove nothing. Delay the constraint fetch instead: every
+	// run performs it, so the measured duration must exceed that delay while still
+	// fitting inside the wall time observed here.
+	dir := writeProject(t)
+	p := &Pipeline{
+		Mode: ModeDefault, Check: true, ProjectDir: dir,
+		ConstraintBaseURL: newSlowServer(t, http.StatusOK).URL, CacheDir: t.TempDir(),
+		Flags:   ComputeFlags{Serverless: "v4"},
+		Compute: stubCompute{}, PM: fakePM{py: "3.12", dbc: "17.2.0"},
+	}
+	before := time.Now()
+	res, err := p.Run(t.Context())
+	elapsed := time.Since(before)
+	require.NoError(t, err)
+	assert.GreaterOrEqual(t, res.DurationMs, fetchDelay.Milliseconds(),
+		"duration must cover the delayed fetch, not report 0")
+	assert.LessOrEqual(t, res.DurationMs, elapsed.Milliseconds(),
+		"duration must not exceed the run's observed wall time")
+}
+
+func TestPipelineReportsDurationOnFailure(t *testing.T) {
+	// The defer must cover the error paths too, so the --json consumer gets a
+	// duration even for a failed run. Fail *after* the delayed fetch rather than at
+	// preflight: a preflight error returns near-instantly, so its duration truncates
+	// to 0 and only a trivially-true bound would hold. A 500 with an empty cache is
+	// E_FETCH, which keeps a real lower bound on the failing path.
+	dir := writeProject(t)
+	p := &Pipeline{
+		Mode: ModeDefault, Check: true, ProjectDir: dir,
+		ConstraintBaseURL: newSlowServer(t, http.StatusInternalServerError).URL, CacheDir: t.TempDir(),
+		Flags:   ComputeFlags{Serverless: "v4"},
+		Compute: stubCompute{}, PM: fakePM{py: "3.12", dbc: "17.2.0"},
+	}
+	before := time.Now()
+	res, err := p.Run(t.Context())
+	elapsed := time.Since(before)
+
+	var pe *PipelineError
+	require.ErrorAs(t, err, &pe)
+	require.Equal(t, ErrFetch, pe.Code)
+	assert.GreaterOrEqual(t, res.DurationMs, fetchDelay.Milliseconds(),
+		"a failed run must still measure the work it did before failing, not report 0")
+	assert.LessOrEqual(t, res.DurationMs, elapsed.Milliseconds(),
+		"duration must not exceed the run's observed wall time")
+}
+
+func TestPipelineReportsCancellationNotProvisionFailure(t *testing.T) {
+	// When the context is cancelled mid-provision (a Ctrl-C / SIGTERM), the run
+	// must surface E_CANCELED, not E_PROVISION — the provision phase's own error
+	// ("signal: terminated") would otherwise imply something broke.
+	dir := writeProject(t)
+	srv := newTestServer(t)
+	defer srv.Close()
+
+	ctx, cancel := context.WithCancel(t.Context())
+	pm := cancelPM{py: "3.12", dbc: "17.2.0", entered: make(chan struct{})}
+	p := &Pipeline{
+		Mode: ModeDefault, Check: false, ProjectDir: dir,
+		ConstraintBaseURL: srv.URL, CacheDir: t.TempDir(),
+		Flags:   ComputeFlags{Serverless: "v4"},
+		Compute: stubCompute{}, PM: pm,
+	}
+
+	// Cancel once Provision is running, so the run unblocks and returns through the
+	// interrupt path (mirrors a Ctrl-C landing mid-`uv sync`).
+	go func() {
+		<-pm.entered
+		cancel()
+	}()
+
+	res, err := p.Run(ctx)
+	var pe *PipelineError
+	require.ErrorAs(t, err, &pe)
+	assert.Equal(t, ErrCanceled, pe.Code)
+	assert.Equal(t, PhaseProvision, pe.FailurePhase, "should still record where it stopped")
+	require.NotNil(t, res.Error)
+	assert.Equal(t, ErrCanceled, res.Error.Code)
+	assert.False(t, res.OK)
+	// The wrapped cause is the context error, so errors.Is works upstream.
+	assert.ErrorIs(t, pe, context.Canceled)
+
+	// The phase's own error is kept as a second cause, not discarded: a genuine
+	// failure can race with the signal, and its stderr is the only diagnostic
+	// there is. uvFailure folds that stderr into Msg, so preserving only the inner
+	// .Err would drop it — assert the actual resolver output survives.
+	assert.Contains(t, pe.Error(), "signal: terminated",
+		"the phase's cause must survive the reclassification")
+	assert.Contains(t, pe.Error(), cancelPMStderr,
+		"uv's stderr (the real diagnostic) must survive the cancellation reclassification")
+
+	// Text mode prints the errored phase's Detail while --json prints the error
+	// object; they must agree (see PipelineError.MarshalJSON). Detail is set when
+	// the phase fails, i.e. before the reclassification, so this catches a stale one.
+	var detail string
+	for _, ph := range res.Phases {
+		if ph.Phase == PhaseProvision {
+			detail = ph.Detail
+		}
+	}
+	assert.Equal(t, pe.Error(), detail, "text-mode phase detail must match the JSON error")
+	// A Ctrl-C must be *classified* as cancellation, not a provision failure: the
+	// message leads with "interrupted" (Code is E_CANCELED). The retained cause may
+	// still contain the phase's own "... failed" text — that is the preserved
+	// diagnostic, not the classification — so assert the prefix, not absence.
+	assert.True(t, strings.HasPrefix(detail, "interrupted"),
+		"a Ctrl-C must read as interrupted, not a provision failure: %q", detail)
+
+	// Both causes render on one line: a phase row is a single line of output.
+	assert.NotContains(t, pe.Error(), "\n", "the error must stay single-line")
+}
+
+func TestPipelineCheckReRunPlanMatchesRealRun(t *testing.T) {
+	// On a re-run where the .bak already exists and the live file already equals
+	// the merged output, --dry-run must report a plan a real run would perform: no
+	// backup (the .bak is kept, not rewritten) and an empty diff (nothing changes).
+	dir := writeProject(t)
+	srv := newTestServer(t)
+	defer srv.Close()
+
+	newPipe := func(check bool) *Pipeline {
+		return &Pipeline{
+			Mode: ModeDefault, Check: check, ProjectDir: dir,
+			ConstraintBaseURL: srv.URL, CacheDir: t.TempDir(),
+			Flags:   ComputeFlags{Serverless: "v4"},
+			Compute: stubCompute{}, PM: fakePM{py: "3.12", dbc: "17.2.0"},
+		}
+	}
+
+	// First a real sync: writes the merged file and creates the .bak.
+	_, err := newPipe(false).Run(t.Context())
+	require.NoError(t, err)
+	require.FileExists(t, filepath.Join(dir, "pyproject.toml.bak"))
+
+	// Now --dry-run on the already-synced project.
+	res, err := newPipe(true).Run(t.Context())
+	require.NoError(t, err)
+	require.NotNil(t, res.Plan)
+	assert.Empty(t, res.Plan.WouldBackup, "a re-run keeps the existing .bak, so --dry-run must not claim a backup")
+	assert.Empty(t, res.Plan.Diff, "the live file already equals the merged output; the diff must be empty")
+}
+
+func TestPipelineCheckDoesNotProvision(t *testing.T) {
+	// --dry-run must not call any PackageManager method that could mutate the
+	// machine (EnsureAvailable may install uv). noProvisionPM errors on all of
+	// them; the dry run must still succeed and produce a plan.
+	dir := writeProject(t)
+	srv := newTestServer(t)
+	defer srv.Close()
+
+	p := &Pipeline{
+		Mode: ModeDefault, Check: true, ProjectDir: dir,
+		ConstraintBaseURL: srv.URL, CacheDir: t.TempDir(),
+		Flags:   ComputeFlags{Serverless: "v4"},
+		Compute: stubCompute{}, PM: noProvisionPM{},
+	}
+	res, err := p.Run(t.Context())
+	require.NoError(t, err)
+	assert.True(t, res.OK)
+	require.NotNil(t, res.Plan)
+}
+
+func TestPipelineCheckWorksOnReadOnlyDir(t *testing.T) {
+	if runtime.GOOS == "windows" || os.Getuid() == 0 {
+		t.Skip("read-only-dir enforcement not available")
+	}
+	dir := writeProject(t)
+	srv := newTestServer(t)
+	defer srv.Close()
+
+	// Make the project dir read-only: --dry-run must still compute the plan without
+	// a writability probe (which would both mutate disk and fail here).
+	require.NoError(t, os.Chmod(dir, 0o555))
+	t.Cleanup(func() { _ = os.Chmod(dir, 0o755) })
+
+	p := &Pipeline{
+		Mode: ModeDefault, Check: true, ProjectDir: dir,
+		ConstraintBaseURL: srv.URL, CacheDir: t.TempDir(),
+		Flags:   ComputeFlags{Serverless: "v4"},
+		Compute: stubCompute{}, PM: fakePM{py: "3.12", dbc: "17.2.0"},
+	}
+	res, err := p.Run(t.Context())
+	require.NoError(t, err)
+	assert.True(t, res.OK)
+	require.NotNil(t, res.Plan)
+	// No writecheck temp file was left behind in the project dir.
+	entries, err := os.ReadDir(dir)
+	require.NoError(t, err)
+	for _, e := range entries {
+		assert.NotContains(t, e.Name(), "writecheck", "dry run must not create temp files")
+	}
+}
+
+func TestPipelineProvisionsAndValidatesExisting(t *testing.T) {
+	dir := writeProject(t)
+	srv := newTestServer(t)
+	defer srv.Close()
+
+	p := &Pipeline{
+		Mode: ModeDefault, ProjectDir: dir,
+		ConstraintBaseURL: srv.URL, CacheDir: t.TempDir(),
+		Flags:   ComputeFlags{Serverless: "v4"},
+		Compute: stubCompute{}, PM: fakePM{py: "3.12", dbc: "17.2.0"},
+	}
+	res, err := p.Run(t.Context())
+	require.NoError(t, err)
+	assert.True(t, res.OK)
+	assert.False(t, res.Greenfield)
+	require.NotNil(t, res.Resolved)
+	assert.Equal(t, "3.12", res.Resolved.PythonVersion)
+	assert.Equal(t, "17.2.0", res.Resolved.DBConnectVersion)
+	// venvPath is reported relative to the project root (spec §6.1), so it is
+	// exactly ".venv" — not an absolute path under the temp ProjectDir. Asserting
+	// the full value (not just filepath.Base) is what pins the relative contract.
+	assert.Equal(t, ".venv", res.VenvPath)
+	merged, _ := os.ReadFile(filepath.Join(dir, "pyproject.toml"))
+	assert.Contains(t, string(merged), `"databricks-connect~=17.2.0"`)
+	assert.FileExists(t, filepath.Join(dir, "pyproject.toml.bak"))
+}
+
+func TestPipelineFailsFastOnConstraintConflict(t *testing.T) {
+	// The user pins pip==24.0 while the environment's constraint-dependencies pin
+	// pip<24 — a provably disjoint range — so the merge records
+	// W_USER_CONSTRAINT_CONFLICT. uv sync would deterministically fail to resolve
+	// that, so the run reports E_PROVISION_CONFLICT right after the merge, at the
+	// provision phase, with disk already mutated — and never spends a Python install
+	// or sync (recordingPM records neither call).
+	dir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "pyproject.toml"), []byte(`[project]
+name = "demo"
+requires-python = ">=3.12"
+dependencies = ["pip==24.0"]
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0.0"]
+`), 0o644))
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte(`[project]
+requires-python = ">=3.12"
+
+[dependency-groups]
+dev = ["databricks-connect~=17.2.0"]
+
+[tool.uv]
+constraint-dependencies = ["pip<24"]
+`))
+	}))
+	defer srv.Close()
+
+	pm := &recordingPM{py: "3.12", dbc: "17.2.0"}
+	p := &Pipeline{
+		Mode: ModeDefault, ProjectDir: dir,
+		ConstraintBaseURL: srv.URL, CacheDir: t.TempDir(),
+		Flags:   ComputeFlags{Serverless: "v4"},
+		Compute: stubCompute{}, PM: pm,
+	}
+	res, err := p.Run(t.Context())
+	var pe *PipelineError
+	require.ErrorAs(t, err, &pe)
+	assert.Equal(t, ErrProvisionConflict, pe.Code)
+	assert.Equal(t, PhaseProvision, pe.FailurePhase)
+	assert.True(t, pe.DiskMutated, "the merge wrote the pins before the conflict was reported")
+	require.NotNil(t, res.Error)
+	assert.Equal(t, ErrProvisionConflict, res.Error.Code)
+	// The merge conflict warning that gates the code must be present.
+	assert.Contains(t, codes(res.Warnings), WarnUserConstraintConflict)
+	// Fail-fast: neither Python install nor sync was attempted.
+	assert.Empty(t, pm.minor, "EnsurePython must not run when the conflict is already proven")
+	assert.Empty(t, pm.provisionPython, "uv sync must not run when the conflict is already proven")
+}
+
+func TestPipelineCheckReportsConflictAsWarningNotError(t *testing.T) {
+	// --dry-run computes a plan and never evaluates provisioning, so the same
+	// provably-disjoint pins surface only as the W_USER_CONSTRAINT_CONFLICT warning
+	// with ok=true and no error — the conflict becomes E_PROVISION_CONFLICT only on a
+	// real run, which is the phase that attempts (and here would fail) provisioning.
+	// This pins that intended divergence so it cannot regress silently.
+	dir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "pyproject.toml"), []byte(`[project]
+name = "demo"
+requires-python = ">=3.12"
+dependencies = ["pip==24.0"]
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0.0"]
+`), 0o644))
+	before, _ := os.ReadFile(filepath.Join(dir, "pyproject.toml"))
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte(`[project]
+requires-python = ">=3.12"
+
+[dependency-groups]
+dev = ["databricks-connect~=17.2.0"]
+
+[tool.uv]
+constraint-dependencies = ["pip<24"]
+`))
+	}))
+	defer srv.Close()
+
+	p := &Pipeline{
+		Mode: ModeDefault, Check: true, ProjectDir: dir,
+		ConstraintBaseURL: srv.URL, CacheDir: t.TempDir(),
+		Flags:   ComputeFlags{Serverless: "v4"},
+		Compute: stubCompute{}, PM: fakePM{py: "3.12", dbc: "17.2.0"},
+	}
+	res, err := p.Run(t.Context())
+	require.NoError(t, err)
+	assert.True(t, res.OK)
+	assert.Nil(t, res.Error, "a dry run reports the conflict as a warning, not an error")
+	assert.Contains(t, codes(res.Warnings), WarnUserConstraintConflict)
+	// A dry run mutates nothing.
+	after, _ := os.ReadFile(filepath.Join(dir, "pyproject.toml"))
+	assert.Equal(t, string(before), string(after))
+	assert.NoFileExists(t, filepath.Join(dir, "pyproject.toml.bak"))
+}
+
+func TestPipelineDryRunOmitsFabricatedDBConnectVersion(t *testing.T) {
+	// A major-only pin like ~=17.0 (serverless, environments#15) is not a concrete
+	// version. Under --dry-run validate never corrects the reported value, so it
+	// must be empty rather than the fabricated "17.0".
+	dir := t.TempDir()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte(`[project]
+requires-python = "==3.12.*"
+
+[dependency-groups]
+dev = ["databricks-connect~=17.0"]
+`))
+	}))
+	defer srv.Close()
+
+	p := &Pipeline{
+		Mode: ModeDefault, Check: true, ProjectDir: dir,
+		ConstraintBaseURL: srv.URL, CacheDir: t.TempDir(),
+		Flags: ComputeFlags{Serverless: "v4"},
+		// No dbc value: Check mode stops before validate, so fakePM.Validate never
+		// runs — the reported version comes purely from the pin on the dry-run path.
+		Compute: stubCompute{}, PM: fakePM{py: "3.12"},
+	}
+	res, err := p.Run(t.Context())
+	require.NoError(t, err)
+	require.NotNil(t, res.Resolved)
+	assert.Empty(t, res.Resolved.DBConnectVersion,
+		"dry-run must not report a fabricated version for a major-only pin")
+}
+
+func TestPipelineGreenfieldCreatesNewPyproject(t *testing.T) {
+	dir := t.TempDir()
+	srv := newTestServer(t)
+	defer srv.Close()
+
+	p := &Pipeline{
+		Mode: ModeDefault, ProjectDir: dir,
+		ConstraintBaseURL: srv.URL, CacheDir: t.TempDir(),
+		Flags:   ComputeFlags{Serverless: "v4"},
+		Compute: stubCompute{}, PM: fakePM{py: "3.12", dbc: "17.2.0"},
+	}
+	res, err := p.Run(t.Context())
+	require.NoError(t, err)
+	assert.True(t, res.OK)
+	assert.True(t, res.Greenfield)
+	data, readErr := os.ReadFile(filepath.Join(dir, "pyproject.toml"))
+	require.NoError(t, readErr)
+	assert.Contains(t, string(data), `"databricks-connect~=17.2.0",`)
+	// A serverless target records the environment version so the same project
+	// also runs in serverless Jobs (DECO-27998).
+	assert.Contains(t, string(data), "[tool.databricks.environment]")
+	assert.Contains(t, string(data), `environment_version = "4"`)
+	// No backup created when pyproject.toml did not previously exist.
+	assert.NoFileExists(t, filepath.Join(dir, "pyproject.toml.bak"))
+}
+
+func TestProjectName(t *testing.T) {
+	// "." / "" / root resolve to the real directory name, not an invalid literal;
+	// non-alphanumeric runs collapse to "-"; unusable input falls back to a default.
+	cwd, err := filepath.Abs(".")
+	require.NoError(t, err)
+	assert.Equal(t, sanitizeProjectName(filepath.Base(cwd)), projectName("."))
+	assert.Equal(t, sanitizeProjectName(filepath.Base(cwd)), projectName(""))
+	assert.Equal(t, "my-proj", projectName("/tmp/my proj"))
+	assert.Equal(t, "my-proj", projectName("/tmp/.my.proj."))
+	assert.Equal(t, defaultProjectName, sanitizeProjectName("."))
+	assert.Equal(t, defaultProjectName, sanitizeProjectName("///"))
+}
+
+func TestPipelineGreenfieldFromDotDirRendersValidName(t *testing.T) {
+	// Running greenfield with ProjectDir="." must not render name = ".".
+	dir := t.TempDir()
+	srv := newTestServer(t)
+	defer srv.Close()
+
+	p := &Pipeline{
+		Mode: ModeDefault, ProjectDir: dir,
+		ConstraintBaseURL: srv.URL, CacheDir: t.TempDir(),
+		Flags:   ComputeFlags{Serverless: "v4"},
+		Compute: stubCompute{}, PM: fakePM{py: "3.12", dbc: "17.2.0"},
+	}
+	res, err := p.Run(t.Context())
+	require.NoError(t, err)
+	assert.True(t, res.Greenfield)
+	data, _ := os.ReadFile(filepath.Join(dir, "pyproject.toml"))
+	assert.NotContains(t, string(data), `name = "."`)
+	assert.Contains(t, string(data), `name = "`+sanitizeProjectName(filepath.Base(dir))+`"`)
+}
+
+func TestPipelineExistingBacksUp(t *testing.T) {
+	dir := writeProject(t)
+	srv := newTestServer(t)
+	defer srv.Close()
+
+	p := &Pipeline{
+		Mode: ModeDefault, ProjectDir: dir,
+		ConstraintBaseURL: srv.URL, CacheDir: t.TempDir(),
+		Flags:   ComputeFlags{Serverless: "v4"},
+		Compute: stubCompute{}, PM: fakePM{py: "3.12", dbc: "17.2.0"},
+	}
+	res, err := p.Run(t.Context())
+	require.NoError(t, err)
+	assert.True(t, res.OK)
+	assert.FileExists(t, filepath.Join(dir, "pyproject.toml.bak"))
+	assert.Equal(t, "pyproject.toml.bak", filepath.Base(res.BackupPath))
+}
+
+func TestPipelineReRunDoesNotRewriteUnchangedPyproject(t *testing.T) {
+	// An idempotent re-run reproduces the merged pyproject.toml byte for byte, so
+	// applyMerge must skip the write rather than advance the file's mtime (which
+	// would spuriously invalidate file watchers and uv.lock freshness checks).
+	dir := writeProject(t)
+	srv := newTestServer(t)
+	defer srv.Close()
+
+	newPipe := func() *Pipeline {
+		return &Pipeline{
+			Mode: ModeDefault, ProjectDir: dir,
+			ConstraintBaseURL: srv.URL, CacheDir: t.TempDir(),
+			Flags:   ComputeFlags{Serverless: "v4"},
+			Compute: stubCompute{}, PM: fakePM{py: "3.12", dbc: "17.2.0"},
+		}
+	}
+
+	pyproject := filepath.Join(dir, "pyproject.toml")
+	_, err := newPipe().Run(t.Context())
+	require.NoError(t, err)
+	firstContent, err := os.ReadFile(pyproject)
+	require.NoError(t, err)
+	firstInfo, err := os.Stat(pyproject)
+	require.NoError(t, err)
+
+	// A second run computes the same merged output; the file must be left as-is,
+	// content and mtime both unchanged.
+	_, err = newPipe().Run(t.Context())
+	require.NoError(t, err)
+	secondContent, err := os.ReadFile(pyproject)
+	require.NoError(t, err)
+	secondInfo, err := os.Stat(pyproject)
+	require.NoError(t, err)
+
+	assert.Equal(t, string(firstContent), string(secondContent), "content must be unchanged")
+	assert.Equal(t, firstInfo.ModTime(), secondInfo.ModTime(), "unchanged pyproject.toml must not be rewritten")
+}
+
+func TestWriteNewRefusesToOverwrite(t *testing.T) {
+	// writeNew is the no-clobber primitive backups rely on: it creates a file but
+	// must fail rather than overwrite an existing one, so an earlier backup is never
+	// destroyed (invariant 2) even if two runs pick the same name.
+	dir := t.TempDir()
+	dst := filepath.Join(dir, "pyproject.toml.bak")
+
+	require.NoError(t, writeNew(dst, []byte("first\n"), 0o644))
+	got, _ := os.ReadFile(dst)
+	require.Equal(t, "first\n", string(got))
+
+	err := writeNew(dst, []byte("second\n"), 0o644)
+	require.ErrorIs(t, err, os.ErrExist)
+	got, _ = os.ReadFile(dst)
+	assert.Equal(t, "first\n", string(got), "writeNew must never overwrite an existing file")
+}
+
+func TestWriteNewPreservesMode(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		// Windows does not honor Unix permission bits.
+		t.Skip("permission-bit preservation is Unix-only")
+	}
+	// A locked-down pyproject.toml (e.g. 0o600 because it carries a private index
+	// URL) must not be widened when copied to the backup.
+	dir := t.TempDir()
+	dst := filepath.Join(dir, "pyproject.toml.bak")
+	require.NoError(t, writeNew(dst, []byte("[project]\n"), 0o600))
+	info, err := os.Stat(dst)
+	require.NoError(t, err)
+	assert.Equal(t, os.FileMode(0o600), info.Mode().Perm())
+}
+
+// assertPreflightFailure checks the invariants shared by every preflight exit:
+// the run returns the error, preflight is attributed as the failing phase, no
+// disk mutation is claimed, and every later phase is left pending.
+func assertPreflightFailure(t *testing.T, res *Result, err error, wantCode ErrorCode) {
+	t.Helper()
+	var pe *PipelineError
+	require.ErrorAs(t, err, &pe)
+	assert.Equal(t, wantCode, pe.Code)
+	assert.Equal(t, PhasePreflight, pe.FailurePhase)
+	assert.False(t, pe.DiskMutated, "preflight fails before any write")
+	assert.False(t, res.OK)
+	for _, ph := range res.Phases {
+		switch ph.Phase {
+		case PhasePreflight:
+			assert.Equal(t, StatusError, ph.Status)
+		default:
+			assert.Equal(t, StatusPending, ph.Status, "phase %s must stay pending after a preflight failure", ph.Phase)
+		}
+	}
+}
+
+func TestPipelineManagerUnsupportedFailsAtPreflight(t *testing.T) {
+	// A non-uv project (environment.yml, no pyproject.toml) is detected as conda
+	// and must exit cleanly at preflight with E_MANAGER_UNSUPPORTED.
+	dir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "environment.yml"), []byte("name: demo\n"), 0o644))
+
+	p := &Pipeline{
+		Mode: ModeDefault, ProjectDir: dir, CacheDir: t.TempDir(),
+		Flags:   ComputeFlags{Serverless: "v4"},
+		Compute: stubCompute{}, PM: fakePM{py: "3.12", dbc: "17.2.0"},
+	}
+	res, err := p.Run(t.Context())
+	assertPreflightFailure(t, res, err, ErrManagerUnsupported)
+	// Detection is pure-fs; no pyproject.toml was created.
+	assert.NoFileExists(t, filepath.Join(dir, "pyproject.toml"))
+}
+
+func TestPipelineUvMissingFailsAtPreflight(t *testing.T) {
+	// When the package manager can't be made available, preflight exits with
+	// E_UV_MISSING before resolve/fetch/merge run.
+	dir := writeProject(t)
+
+	p := &Pipeline{
+		Mode: ModeDefault, ProjectDir: dir, CacheDir: t.TempDir(),
+		Flags:   ComputeFlags{Serverless: "v4"},
+		Compute: stubCompute{}, PM: uvMissingPM{},
+	}
+	res, err := p.Run(t.Context())
+	assertPreflightFailure(t, res, err, ErrUvMissing)
+}
+
+func TestApplyMergeFailsOnUnreadableDirWithoutOverwritingBackup(t *testing.T) {
+	if runtime.GOOS == "windows" || os.Getuid() == 0 {
+		// chmod-based stat blocking does not apply for root or on Windows.
+		t.Skip("stat-permission enforcement not available")
+	}
+	// The project dir is made unsearchable, so applyMerge's up-front stat of
+	// pyproject.toml fails with a permission error: the run must abort before any
+	// write, no disk mutation claimed, and the existing backup left untouched.
+	// applyMerge is called directly, bypassing the writability preflight.
+	dir := filepath.Join(t.TempDir(), "proj")
+	require.NoError(t, os.Mkdir(dir, 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "pyproject.toml"), []byte("[project]\n"), 0o644))
+	backup := filepath.Join(dir, "pyproject.toml.bak")
+	require.NoError(t, os.WriteFile(backup, []byte("ORIGINAL BACKUP\n"), 0o644))
+	require.NoError(t, os.Chmod(dir, 0o000))
+	t.Cleanup(func() { _ = os.Chmod(dir, 0o755) })
+
+	p := &Pipeline{ProjectDir: dir, res: &Result{Phases: initialPhases()}}
+	err := p.applyMerge(t.Context(), []byte("merged"), nil, false)
+	require.Error(t, err)
+	var pe *PipelineError
+	require.ErrorAs(t, err, &pe)
+	assert.Equal(t, PhaseMerge, pe.FailurePhase)
+	assert.False(t, pe.DiskMutated, "no write should have happened before the up-front stat")
+
+	// The original backup must be intact.
+	require.NoError(t, os.Chmod(dir, 0o755))
+	got, readErr := os.ReadFile(backup)
+	require.NoError(t, readErr)
+	assert.Equal(t, "ORIGINAL BACKUP\n", string(got), "the canonical backup must not be overwritten")
+}
+
+func TestPipelineConstraintsOnlyOmitsDBConnect(t *testing.T) {
+	dir := t.TempDir()
+	srv := newTestServer(t)
+	defer srv.Close()
+
+	// Even though databricks-connect is present in the venv (fakePM reports a
+	// version), constraints-only must not assert it, not write the pin, and not
+	// report dbconnectVersion (spec §6 omits it in this mode).
+	p := &Pipeline{
+		Mode: ModeConstraintsOnly, ProjectDir: dir,
+		ConstraintBaseURL: srv.URL, CacheDir: t.TempDir(),
+		Flags:   ComputeFlags{Serverless: "v4"},
+		Compute: stubCompute{}, PM: fakePM{py: "3.12", dbc: "17.2.0"},
+	}
+	res, err := p.Run(t.Context())
+	require.NoError(t, err)
+	assert.True(t, res.OK)
+	assert.Equal(t, "constraints-only", res.Mode)
+	require.NotNil(t, res.Resolved)
+	assert.Empty(t, res.Resolved.DBConnectVersion, "constraints-only must omit dbconnectVersion")
+	data, readErr := os.ReadFile(filepath.Join(dir, "pyproject.toml"))
+	require.NoError(t, readErr)
+	assert.NotContains(t, string(data), "databricks-connect")
+	// The dev group is emitted empty, not with a blank-string entry.
+	assert.Contains(t, string(data), "dev = []")
+	assert.NotContains(t, string(data), `""`)
+}
+
+func TestPipelineNoTarget(t *testing.T) {
+	dir := writeProject(t)
+	srv := newTestServer(t)
+	defer srv.Close()
+
+	p := &Pipeline{
+		Mode: ModeDefault, ProjectDir: dir,
+		ConstraintBaseURL: srv.URL, CacheDir: t.TempDir(),
+		Flags:   ComputeFlags{},
+		Compute: stubCompute{}, PM: fakePM{},
+	}
+	res, err := p.Run(t.Context())
+	require.Error(t, err)
+	require.NotNil(t, res)
+	require.NotNil(t, res.Error)
+	assert.False(t, res.OK)
+	assert.Equal(t, ErrNoTarget, res.Error.Code)
+	// No-target is detected during target resolution, so it is reported at the
+	// resolve phase (the failing phase in phases[] and error.failurePhase agree).
+	assert.Equal(t, PhaseResolve, res.Error.FailurePhase)
+	// Preflight succeeded, resolve errored, everything after stays pending.
+	assert.Equal(t, StatusOK, phaseStatus(res, PhasePreflight))
+	assert.Equal(t, StatusError, phaseStatus(res, PhaseResolve))
+	assert.Equal(t, StatusPending, phaseStatus(res, PhaseProvision))
+}
+
+func TestPipelineMergesOnLiveFileNotBackup(t *testing.T) {
+	dir := t.TempDir()
+	// A pre-existing .bak holds the pristine pre-sync original (no user edit).
+	original := []byte(`[project]
+name = "demo"
+requires-python = ">=3.9"
+
+[dependency-groups]
+dev = ["databricks-connect~=15.0.0"]
+`)
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "pyproject.toml.bak"), original, 0o644))
+	// The live pyproject.toml is a prior sync's output plus an edit the developer
+	// made afterwards: a non-managed dependency the .bak never saw.
+	live := []byte(`[project]
+name = "demo"
+requires-python = "==3.12.*"
+dependencies = ["rich"]
+
+[dependency-groups]
+dev = ["databricks-connect~=17.2.0"]
+`)
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "pyproject.toml"), live, 0o644))
+
+	srv := newTestServer(t)
+	defer srv.Close()
+
+	p := &Pipeline{
+		Mode: ModeDefault, ProjectDir: dir,
+		ConstraintBaseURL: srv.URL, CacheDir: t.TempDir(),
+		Flags:   ComputeFlags{Serverless: "v4"},
+		Compute: stubCompute{}, PM: fakePM{py: "3.12", dbc: "17.2.0"},
+	}
+	res, err := p.Run(t.Context())
+	require.NoError(t, err)
+	require.NotNil(t, res)
+	data, _ := os.ReadFile(filepath.Join(dir, "pyproject.toml"))
+	// The between-sync user edit survives: the merge based on the live file, not
+	// the stale .bak, which would have discarded it.
+	assert.Contains(t, string(data), `dependencies = ["rich"]`)
+	// Managed regions are still applied.
+	assert.Contains(t, string(data), `"databricks-connect~=17.2.0"`)
+	assert.Contains(t, string(data), `requires-python = "==3.12.*"`)
+	// The .bak is left as the one-time original safety copy, not overwritten.
+	bak, _ := os.ReadFile(filepath.Join(dir, "pyproject.toml.bak"))
+	assert.Equal(t, string(original), string(bak))
+}
+
+// listBackups returns the basenames of every pyproject.toml backup in dir — the
+// canonical .bak plus any timestamped ones — for count/identity assertions.
+func listBackups(t *testing.T, dir string) []string {
+	t.Helper()
+	matches, err := filepath.Glob(filepath.Join(dir, "pyproject.toml.*.bak"))
+	require.NoError(t, err)
+	// The canonical pyproject.toml.bak does not match the ".*." glob, so add it
+	// explicitly when present.
+	if _, statErr := os.Stat(filepath.Join(dir, "pyproject.toml.bak")); statErr == nil {
+		matches = append(matches, filepath.Join(dir, "pyproject.toml.bak"))
+	}
+	names := make([]string, 0, len(matches))
+	for _, m := range matches {
+		names = append(names, filepath.Base(m))
+	}
+	return names
+}
+
+func TestPipelineReRunWritesTimestampedBackupKeepingOriginal(t *testing.T) {
+	dir := t.TempDir()
+	// The canonical .bak already holds the pristine pre-first-sync original.
+	original := []byte(`[project]
+name = "demo"
+requires-python = ">=3.10"
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0.0"]
+`)
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "pyproject.toml.bak"), original, 0o644))
+	// The live file is a prior sync's output the developer then edited: they reset a
+	// managed region (requires-python), so the coming merge will rewrite it —
+	// making this a real change, not a no-op.
+	live := []byte(`[project]
+name = "demo"
+requires-python = ">=3.9"
+dependencies = ["rich"]
+
+[dependency-groups]
+dev = ["databricks-connect~=17.2.0"]
+`)
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "pyproject.toml"), live, 0o644))
+
+	srv := newTestServer(t)
+	defer srv.Close()
+
+	fixed := time.Date(2024, 1, 1, 15, 30, 0, 0, time.UTC)
+	p := &Pipeline{
+		Mode: ModeDefault, ProjectDir: dir,
+		ConstraintBaseURL: srv.URL, CacheDir: t.TempDir(),
+		Flags:   ComputeFlags{Serverless: "v4"},
+		Compute: stubCompute{}, PM: fakePM{py: "3.12", dbc: "17.2.0"},
+		nowFn: func() time.Time { return fixed },
+	}
+	res, err := p.Run(t.Context())
+	require.NoError(t, err)
+	require.True(t, res.OK)
+
+	// The canonical .bak is untouched — still the pristine original.
+	bak, _ := os.ReadFile(filepath.Join(dir, "pyproject.toml.bak"))
+	assert.Equal(t, string(original), string(bak), "the pristine .bak must not be overwritten on a re-run")
+
+	// A timestamped backup captured the pre-run live content the merge overwrote.
+	wantName := "pyproject.toml." + fixed.Format(backupTimestampLayout) + ".bak"
+	assert.Equal(t, wantName, filepath.Base(res.BackupPath))
+	tsContent, err := os.ReadFile(res.BackupPath)
+	require.NoError(t, err)
+	assert.Equal(t, string(live), string(tsContent), "the timestamped backup must hold the pre-run content")
+
+	// Both backups coexist; the managed region was applied to the live file.
+	assert.ElementsMatch(t, []string{"pyproject.toml.bak", wantName}, listBackups(t, dir))
+	merged, _ := os.ReadFile(filepath.Join(dir, "pyproject.toml"))
+	assert.Contains(t, string(merged), `requires-python = "==3.12.*"`)
+}
+
+func TestPipelineNoOpReRunWritesNoNewBackup(t *testing.T) {
+	dir := writeProject(t)
+	srv := newTestServer(t)
+	defer srv.Close()
+
+	newPipe := func() *Pipeline {
+		return &Pipeline{
+			Mode: ModeDefault, ProjectDir: dir,
+			ConstraintBaseURL: srv.URL, CacheDir: t.TempDir(),
+			Flags:   ComputeFlags{Serverless: "v4"},
+			Compute: stubCompute{}, PM: fakePM{py: "3.12", dbc: "17.2.0"},
+		}
+	}
+
+	// First sync creates exactly the canonical .bak.
+	_, err := newPipe().Run(t.Context())
+	require.NoError(t, err)
+	assert.ElementsMatch(t, []string{"pyproject.toml.bak"}, listBackups(t, dir))
+
+	// A second, idempotent run changes nothing, so it must not write another backup.
+	res, err := newPipe().Run(t.Context())
+	require.NoError(t, err)
+	assert.ElementsMatch(t, []string{"pyproject.toml.bak"}, listBackups(t, dir), "a no-op re-run must not write a new backup")
+	assert.Empty(t, res.BackupPath, "a no-op re-run created no backup")
+}
+
+func TestApplyMergeSameInstantBackupsGetUniqueNames(t *testing.T) {
+	dir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "pyproject.toml.bak"), []byte("ORIGINAL\n"), 0o644))
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "pyproject.toml"), []byte("current-1\n"), 0o644))
+
+	fixed := time.Date(2024, 1, 1, 15, 30, 0, 0, time.UTC)
+	p := &Pipeline{
+		ProjectDir: dir,
+		nowFn:      func() time.Time { return fixed },
+		res:        &Result{Phases: initialPhases()},
+	}
+
+	// First modifying apply: backs up "current-1" under a timestamped name.
+	require.NoError(t, p.applyMerge(t.Context(), []byte("merged-1\n"), nil, false))
+	first := p.res.BackupPath
+	require.NotEmpty(t, first)
+
+	// Second modifying apply at the SAME instant: backs up "merged-1" but must not
+	// collide with or overwrite the first timestamped backup.
+	require.NoError(t, p.applyMerge(t.Context(), []byte("merged-2\n"), nil, false))
+	second := p.res.BackupPath
+	require.NotEmpty(t, second)
+
+	assert.NotEqual(t, first, second, "same-instant backups must get distinct names")
+	c1, _ := os.ReadFile(first)
+	assert.Equal(t, "current-1\n", string(c1))
+	c2, _ := os.ReadFile(second)
+	assert.Equal(t, "merged-1\n", string(c2))
+	// The pristine .bak is still untouched.
+	bak, _ := os.ReadFile(filepath.Join(dir, "pyproject.toml.bak"))
+	assert.Equal(t, "ORIGINAL\n", string(bak))
+	// Three backups now coexist: the original plus two timestamped.
+	assert.Len(t, listBackups(t, dir), 3)
+}
+
+func TestPipelineCheckFirstRunPlansCanonicalBackup(t *testing.T) {
+	// A --dry-run on an existing project that has never been synced (no .bak yet)
+	// must plan the canonical pyproject.toml.bak — the first backup a real run
+	// would create — and must not actually write it.
+	dir := writeProject(t)
+	srv := newTestServer(t)
+	defer srv.Close()
+
+	p := &Pipeline{
+		Mode: ModeDefault, Check: true, ProjectDir: dir,
+		ConstraintBaseURL: srv.URL, CacheDir: t.TempDir(),
+		Flags:   ComputeFlags{Serverless: "v4"},
+		Compute: stubCompute{}, PM: fakePM{py: "3.12", dbc: "17.2.0"},
+	}
+	res, err := p.Run(t.Context())
+	require.NoError(t, err)
+	require.NotNil(t, res.Plan)
+	assert.Equal(t, "pyproject.toml.bak", filepath.Base(res.Plan.WouldBackup))
+	assert.NoFileExists(t, filepath.Join(dir, "pyproject.toml.bak"), "--dry-run must not create the backup")
+}
+
+func TestPipelineUnreadableExistingIsNotTreatedAsGreenfield(t *testing.T) {
+	if runtime.GOOS == "windows" || os.Getuid() == 0 {
+		// chmod 000 does not block reads for root or on Windows.
+		t.Skip("read-permission enforcement not available")
+	}
+	dir := t.TempDir()
+	pyproject := filepath.Join(dir, "pyproject.toml")
+	original := []byte(`[project]
+name = "demo"
+requires-python = ">=3.10"
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0.0"]
+`)
+	require.NoError(t, os.WriteFile(pyproject, original, 0o644))
+	// Make it unreadable so os.ReadFile fails with a non-not-exist error after
+	// detectManager has already seen the file exists.
+	require.NoError(t, os.Chmod(pyproject, 0o000))
+	t.Cleanup(func() { _ = os.Chmod(pyproject, 0o644) })
+
+	srv := newTestServer(t)
+	defer srv.Close()
+
+	p := &Pipeline{
+		Mode: ModeDefault, ProjectDir: dir,
+		ConstraintBaseURL: srv.URL, CacheDir: t.TempDir(),
+		Flags:   ComputeFlags{Serverless: "v4"},
+		Compute: stubCompute{}, PM: fakePM{py: "3.12", dbc: "17.2.0"},
+	}
+	res, err := p.Run(t.Context())
+	// The run must fail at merge rather than silently overwrite the user's file.
+	require.Error(t, err)
+	var pe *PipelineError
+	require.ErrorAs(t, err, &pe)
+	assert.Equal(t, ErrMerge, pe.Code)
+	assert.Equal(t, PhaseMerge, pe.FailurePhase)
+	assert.False(t, res.Greenfield, "an unreadable existing file must not be treated as greenfield")
+
+	// The original file must be untouched (still unreadable, not overwritten).
+	require.NoError(t, os.Chmod(pyproject, 0o644))
+	after, readErr := os.ReadFile(pyproject)
+	require.NoError(t, readErr)
+	assert.Equal(t, string(original), string(after), "the user's pyproject.toml must not be overwritten")
+}
+
+func TestPipelineResultPopulatesResolved(t *testing.T) {
+	dir := writeProject(t)
+	srv := newTestServer(t)
+	defer srv.Close()
+
+	p := &Pipeline{
+		Mode: ModeDefault, Check: true, ProjectDir: dir,
+		ConstraintBaseURL: srv.URL, CacheDir: t.TempDir(),
+		Flags:   ComputeFlags{Serverless: "v4"},
+		Compute: stubCompute{}, PM: fakePM{py: "3.12", dbc: "17.2.0"},
+	}
+	res, err := p.Run(t.Context())
+	require.NoError(t, err)
+	require.NotNil(t, res.Resolved)
+	assert.Equal(t, "3.12", res.Resolved.PythonVersion)
+	assert.Equal(t, "17.2.0", res.Resolved.DBConnectVersion)
+	assert.Equal(t, "network", res.Resolved.ArtifactSource)
+}
+
+// newServerWithDBC returns a test server that serves a constraints TOML with the
+// given databricks-connect pin value in the dev dependency group.
+func newServerWithDBC(t *testing.T, dbcPin string) *httptest.Server {
+	t.Helper()
+	body := `[project]
+requires-python = "==3.12.*"
+
+[dependency-groups]
+dev = ["` + dbcPin + `"]
+
+[tool.uv]
+constraint-dependencies = []
+`
+	return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte(body))
+	}))
+}
+
+func TestPipelineValidateRejectsUnparseablePin(t *testing.T) {
+	dir := writeProject(t)
+	// Serve a TOML whose dev group has a malformed databricks-connect entry
+	// (no version digits after the package name).
+	srv := newServerWithDBC(t, "databricks-connect")
+	defer srv.Close()
+
+	p := &Pipeline{
+		Mode: ModeDefault, ProjectDir: dir,
+		ConstraintBaseURL: srv.URL, CacheDir: t.TempDir(),
+		Flags:   ComputeFlags{Serverless: "v4"},
+		Compute: stubCompute{}, PM: fakePM{py: "3.12", dbc: "17.2.0"},
+	}
+	res, err := p.Run(t.Context())
+	require.Error(t, err)
+	require.NotNil(t, res.Error)
+	assert.Equal(t, ErrValidate, res.Error.Code)
+	assert.Equal(t, PhaseValidate, res.Error.FailurePhase)
+}
+
+func TestPipelineValidateRejectsStandalonePyspark(t *testing.T) {
+	// A LIVE collision: standalone pyspark installed alongside databricks-connect, and
+	// `import databricks.connect` fails as a result. The environment cannot start a
+	// session, so validate must fail with actionable guidance rather than report ready.
+	dir := writeProject(t)
+	srv := newTestServer(t)
+	defer srv.Close()
+
+	p := &Pipeline{
+		Mode: ModeDefault, ProjectDir: dir,
+		ConstraintBaseURL: srv.URL, CacheDir: t.TempDir(),
+		Flags:   ComputeFlags{Serverless: "v4"},
+		Compute: stubCompute{}, PM: fakePM{py: "3.12", dbc: "17.2.0", pyspark: "4.2.0", dbcImportErr: "ImportError"},
+	}
+	res, err := p.Run(t.Context())
+	require.Error(t, err)
+	require.NotNil(t, res.Error)
+	assert.Equal(t, ErrValidate, res.Error.Code)
+	assert.Equal(t, PhaseValidate, res.Error.FailurePhase)
+	assert.Contains(t, res.Error.Msg, "pyspark")
+	assert.Contains(t, res.Error.Msg, "databricks-connect")
+	assert.Contains(t, res.Error.Msg, "ImportError")
+}
+
+func TestPipelineValidateAllowsStalePysparkDistInfo(t *testing.T) {
+	// A standalone pyspark distribution is present in the metadata, but databricks-connect
+	// imports fine — its vendored files won the overwrite, leaving only an orphaned
+	// pyspark dist-info. The environment is functional, so validate must NOT hard-fail
+	// on the mere presence of pyspark metadata (regression guard for the false positive
+	// reported in review: install-order can leave a working env with a stale dist-info).
+	dir := writeProject(t)
+	srv := newTestServer(t)
+	defer srv.Close()
+
+	p := &Pipeline{
+		Mode: ModeDefault, ProjectDir: dir,
+		ConstraintBaseURL: srv.URL, CacheDir: t.TempDir(),
+		Flags: ComputeFlags{Serverless: "v4"},
+		// pyspark present in metadata, but the import succeeds (dbcImportErr == "").
+		Compute: stubCompute{}, PM: fakePM{py: "3.12", dbc: "17.2.0", pyspark: "4.2.0"},
+	}
+	res, err := p.Run(t.Context())
+	require.NoError(t, err)
+	assert.True(t, res.OK)
+}
+
+func TestPipelineValidateRejectsUnparseableInstalledVersion(t *testing.T) {
+	dir := writeProject(t)
+	// sampleToml has databricks-connect~=17.2.0 as the pin; use an empty installed
+	// version string to simulate an installed version that can't be parsed.
+	srv := newTestServer(t)
+	defer srv.Close()
+
+	p := &Pipeline{
+		Mode: ModeDefault, ProjectDir: dir,
+		ConstraintBaseURL: srv.URL, CacheDir: t.TempDir(),
+		Flags:   ComputeFlags{Serverless: "v4"},
+		Compute: stubCompute{}, PM: fakePM{py: "3.12", dbc: ""},
+	}
+	res, err := p.Run(t.Context())
+	require.Error(t, err)
+	require.NotNil(t, res.Error)
+	assert.Equal(t, ErrValidate, res.Error.Code)
+}
+
+func TestMajorVersion(t *testing.T) {
+	cases := []struct {
+		input string
+		want  string
+	}{
+		{"17.2.0", "17"},
+		{"17", "17"},
+		{"", ""},
+		{"3.12", "3"},
+		// Non-numeric major components are rejected (empty) so validation does
+		// not compare arbitrary strings as versions.
+		{"bad.version", ""},
+		{"v17.2", ""},
+		{"abc", ""},
+	}
+	for _, tc := range cases {
+		assert.Equal(t, tc.want, majorVersion(tc.input), "input=%q", tc.input)
+	}
+}
+
+func TestDBCVersionFromPin(t *testing.T) {
+	cases := []struct {
+		pin  string
+		want string
+	}{
+		{"databricks-connect~=17.3.0", "17.3.0"},
+		// An exact pin is the only genuinely concrete form; the helper accepts it.
+		{"databricks-connect==17.3.0", "17.3.0"},
+		// A range-only pin is not a concrete version: report nothing rather than a
+		// major.minor floor nothing installs. Serverless pins major-only across
+		// every env (~=16.0/~=17.0/~=18.0, environments#15).
+		{"databricks-connect~=16.0", ""},
+		{"databricks-connect~=17.0", ""},
+		{"databricks-connect~=18.0", ""},
+		{"databricks-connect~=17", ""},
+		{"", ""},
+	}
+	for _, tc := range cases {
+		assert.Equal(t, tc.want, dbcVersionFromPin(tc.pin), "pin=%q", tc.pin)
+	}
+}
+
+func TestDBCMajorFromPinHandlesMajorOnlyPin(t *testing.T) {
+	// The major-only pin that makes dbcVersionFromPin return "" must still yield a
+	// major for validate's real-run assertion — the two paths read the same pin.
+	assert.Equal(t, "17", dbcMajorFromPin("databricks-connect~=17.0"))
+	assert.Equal(t, "17", dbcMajorFromPin("databricks-connect~=17.3.0"))
+}
+
+// phaseStatus returns the status recorded for the named phase in res.
+func phaseStatus(res *Result, name PhaseName) string {
+	for _, ph := range res.Phases {
+		if ph.Phase == name {
+			return ph.Status
+		}
+	}
+	return ""
+}
+
+// recordingReporter captures PhaseStarted calls for assertions.
+type recordingReporter struct{ started []PhaseName }
+
+func (r *recordingReporter) PhaseStarted(name PhaseName) {
+	r.started = append(r.started, name)
+}
+
+func TestPipelineReportsPhaseStarts(t *testing.T) {
+	dir := writeProject(t)
+	srv := newTestServer(t)
+	defer srv.Close()
+
+	rep := &recordingReporter{}
+	p := &Pipeline{
+		Mode: ModeDefault, ProjectDir: dir,
+		ConstraintBaseURL: srv.URL, CacheDir: t.TempDir(),
+		Flags:   ComputeFlags{Serverless: "v4"},
+		Compute: stubCompute{}, PM: fakePM{py: "3.12", dbc: "17.2.0"},
+		Progress: rep,
+	}
+	_, err := p.Run(t.Context())
+	require.NoError(t, err)
+	// A full successful run enters every phase exactly once in canonical order.
+	assert.Equal(t, allPhases, rep.started)
+}
+
+func TestPipelineNoConstraintsLeavesExistingPinsUntouched(t *testing.T) {
+	dir := t.TempDir()
+	// An existing project with the user's own requires-python and no managed
+	// [tool.uv] constraint block.
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "pyproject.toml"), []byte(`[project]
+name = "demo"
+requires-python = ">=3.9"
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0.0"]
+`), 0o644))
+	srv := newTestServer(t)
+	defer srv.Close()
+
+	p := &Pipeline{
+		Mode: ModeDefault, SkipConstraints: true, ProjectDir: dir,
+		ConstraintBaseURL: srv.URL, CacheDir: t.TempDir(),
+		Flags:   ComputeFlags{Serverless: "v4"},
+		Compute: stubCompute{}, PM: fakePM{py: "3.12", dbc: "17.2.0"},
+	}
+	res, err := p.Run(t.Context())
+	require.NoError(t, err)
+	assert.True(t, res.OK)
+	data, _ := os.ReadFile(filepath.Join(dir, "pyproject.toml"))
+	s := string(data)
+	// requires-python keeps the user's value; the artifact's ==3.12.* is not written.
+	assert.Contains(t, s, `requires-python = ">=3.9"`)
+	assert.NotContains(t, s, "==3.12.*")
+	// No managed [tool.uv] constraint-dependencies block is written.
+	assert.NotContains(t, s, "constraint-dependencies")
+	// databricks-connect is still managed: --no-constraints is orthogonal to it.
+	assert.Contains(t, s, "databricks-connect~=17.2.0")
+}
+
+func TestPipelineNoConstraintsGreenfieldOmitsPins(t *testing.T) {
+	dir := t.TempDir()
+	srv := newTestServer(t)
+	defer srv.Close()
+
+	p := &Pipeline{
+		Mode: ModeDefault, SkipConstraints: true, ProjectDir: dir,
+		ConstraintBaseURL: srv.URL, CacheDir: t.TempDir(),
+		Flags:   ComputeFlags{Serverless: "v4"},
+		Compute: stubCompute{}, PM: fakePM{py: "3.12", dbc: "17.2.0"},
+	}
+	res, err := p.Run(t.Context())
+	require.NoError(t, err)
+	assert.True(t, res.OK)
+	assert.True(t, res.Greenfield)
+	data, _ := os.ReadFile(filepath.Join(dir, "pyproject.toml"))
+	s := string(data)
+	// The artifact's Python pin and constraint-dependencies are not written.
+	assert.NotContains(t, s, "==3.12.*")
+	assert.NotContains(t, s, "constraint-dependencies")
+	// databricks-connect (orthogonal) is still added.
+	assert.Contains(t, s, "databricks-connect~=17.2.0")
+}
+
+// newServerlessTestPipeline returns a pipeline for dir against a test artifact
+// server (serverless v4) that is closed when the test ends.
+func newServerlessTestPipeline(t *testing.T, dir string) *Pipeline {
+	srv := newTestServer(t)
+	t.Cleanup(srv.Close)
+	return &Pipeline{
+		Mode: ModeDefault, ProjectDir: dir,
+		ConstraintBaseURL: srv.URL, CacheDir: t.TempDir(),
+		Flags: ComputeFlags{Serverless: "v4"}, Compute: stubCompute{},
+		PM: fakePM{py: "3.12", dbc: "17.2.0"},
+	}
+}
+
+// venvRecordingPM records the folders the pipeline hands to PostProvision and
+// Validate.
+type venvRecordingPM struct {
+	fakePM
+	postProvisionDir, postProvisionVenv, validateDir, validateVenv string
+}
+
+func (f *venvRecordingPM) PostProvision(_ context.Context, projectDir, venv string) error {
+	f.postProvisionDir, f.postProvisionVenv = projectDir, venv
+	return nil
+}
+
+func (f *venvRecordingPM) Validate(ctx context.Context, projectDir, venv string) (VenvInfo, error) {
+	f.validateDir, f.validateVenv = projectDir, venv
+	return f.fakePM.Validate(ctx, projectDir, venv)
+}
+
+func TestPipelinePassesProjectVenvToPackageManager(t *testing.T) {
+	dir := writeProject(t)
+	pm := &venvRecordingPM{py: "3.12", dbc: "17.2.0"}
+	p := newServerlessTestPipeline(t, dir)
+	p.PM = pm
+
+	res, err := p.Run(t.Context())
+	require.NoError(t, err)
+	want := filepath.Join(dir, ".venv")
+	assert.Equal(t, dir, pm.postProvisionDir)
+	assert.Equal(t, want, pm.postProvisionVenv)
+	assert.Equal(t, dir, pm.validateDir)
+	assert.Equal(t, want, pm.validateVenv)
+	assert.Equal(t, ".venv", res.VenvPath)
+}
+
+func TestWritePyprojectNoOpWritesNothing(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, pyprojectFile)
+	content := []byte("[project]\nname = \"x\"\n")
+	require.NoError(t, os.WriteFile(path, content, 0o644))
+
+	p := &Pipeline{ProjectDir: dir}
+	backup, mutated, perr := p.writePyproject(path, content, false)
+	require.Nil(t, perr)
+	assert.Empty(t, backup)
+	assert.False(t, mutated)
+	assert.NoFileExists(t, filepath.Join(dir, backupFile))
+}
+
+func TestWritePyprojectBacksUpInItsOwnFolder(t *testing.T) {
+	project := t.TempDir()
+	other := t.TempDir()
+	path := filepath.Join(other, pyprojectFile)
+	require.NoError(t, os.WriteFile(path, []byte("[project]\nname = \"x\"\n"), 0o644))
+
+	p := &Pipeline{ProjectDir: project}
+	backup, mutated, perr := p.writePyproject(path, []byte("[project]\nname = \"y\"\n"), false)
+	require.Nil(t, perr)
+	assert.True(t, mutated)
+	assert.Equal(t, filepath.Join(other, backupFile), backup)
+	assert.NoFileExists(t, filepath.Join(project, backupFile))
+	got, err := os.ReadFile(path)
+	require.NoError(t, err)
+	assert.Equal(t, "[project]\nname = \"y\"\n", string(got))
+}
+
+func TestPyprojectDiffLabels(t *testing.T) {
+	d := pyprojectDiff("pyproject.toml", []byte("a\n"), []byte("b\n"), false)
+	assert.Contains(t, d, "--- pyproject.toml")
+	assert.Contains(t, d, "+++ pyproject.toml.new")
+	g := pyprojectDiff("pyproject.toml", nil, []byte("b\n"), true)
+	assert.Contains(t, g, "+++ pyproject.toml")
+	assert.NotContains(t, g, ".new")
+}
+
+// resolvedPath returns path with symlinks resolved (macOS temp folders live
+// under /var, a symlink to /private/var).
+func resolvedPath(t *testing.T, path string) string {
+	t.Helper()
+	resolved, err := filepath.EvalSymlinks(path)
+	require.NoError(t, err)
+	return resolved
+}
+
+// uvJoinBase returns the folder uv joins a relative UV_PROJECT_ENVIRONMENT to:
+// symlink-resolved on Unix, as given on Windows.
+func uvJoinBase(t *testing.T, base string) string {
+	t.Helper()
+	if runtime.GOOS == "windows" {
+		return base
+	}
+	return resolvedPath(t, base)
+}
+
+func TestPipelineUsesUvProjectEnvironment(t *testing.T) {
+	// uv puts the project environment at UV_PROJECT_ENVIRONMENT: an absolute
+	// path as is, a relative one against the (symlink-resolved) workspace root,
+	// or the project root outside a workspace.
+	abs := filepath.Join(t.TempDir(), "envs", "proj")
+	tests := []struct {
+		name string
+		// setup returns the project folder, the folder a relative value is
+		// joined to, and the fake package manager.
+		setup        func(t *testing.T) (projectDir, base string, pm fakePM)
+		value        string
+		wantVenv     func(t *testing.T, base string) string
+		wantVenvPath func(venv string) string
+	}{
+		{
+			name: "relative, standalone",
+			setup: func(t *testing.T) (string, string, fakePM) {
+				dir := writeProject(t)
+				return dir, dir, fakePM{py: "3.12", dbc: "17.2.0"}
+			},
+			value:        "custom-env",
+			wantVenv:     func(t *testing.T, base string) string { return filepath.Join(uvJoinBase(t, base), "custom-env") },
+			wantVenvPath: func(string) string { return "custom-env" },
+		},
+		{
+			name: "relative, workspace member",
+			setup: func(t *testing.T) (string, string, fakePM) {
+				root, member := memberLayout(t)
+				require.NoError(t, os.WriteFile(filepath.Join(member, pyprojectFile),
+					[]byte("[project]\nname = \"a\"\nversion = \"0.1.0\"\nrequires-python = \">=3.10\"\n"), 0o644))
+				return member, root, fakePM{py: "3.12", dbc: "17.2.0", root: root}
+			},
+			value:        "custom-env",
+			wantVenv:     func(t *testing.T, base string) string { return filepath.Join(uvJoinBase(t, base), "custom-env") },
+			wantVenvPath: func(string) string { return "../../custom-env" },
+		},
+		{
+			name: "relative with .. through a symlinked project",
+			setup: func(t *testing.T) (string, string, fakePM) {
+				if runtime.GOOS == "windows" {
+					t.Skip("symlinks need extra privileges on Windows")
+				}
+				real := writeProject(t)
+				link := filepath.Join(t.TempDir(), "link")
+				require.NoError(t, os.Symlink(real, link))
+				return link, real, fakePM{py: "3.12", dbc: "17.2.0"}
+			},
+			value: filepath.Join("..", "env"),
+			wantVenv: func(t *testing.T, base string) string {
+				return filepath.Join(filepath.Dir(resolvedPath(t, base)), "env")
+			},
+			wantVenvPath: func(string) string { return "../env" },
+		},
+		{
+			name: "relative with a trailing slash",
+			setup: func(t *testing.T) (string, string, fakePM) {
+				dir := writeProject(t)
+				return dir, dir, fakePM{py: "3.12", dbc: "17.2.0"}
+			},
+			value:        "custom-env/",
+			wantVenv:     func(t *testing.T, base string) string { return filepath.Join(uvJoinBase(t, base), "custom-env") },
+			wantVenvPath: func(string) string { return "custom-env" },
+		},
+		{
+			// On Windows a rooted path keeps the drive of the root, as in uv.
+			name: "rooted without a drive",
+			setup: func(t *testing.T) (string, string, fakePM) {
+				if runtime.GOOS != "windows" {
+					t.Skip("a rooted path without a drive exists only on Windows")
+				}
+				dir := writeProject(t)
+				return dir, dir, fakePM{py: "3.12", dbc: "17.2.0"}
+			},
+			value:    `\envs\x`,
+			wantVenv: func(t *testing.T, base string) string { return filepath.VolumeName(base) + `\envs\x` },
+			// The drive comes from the project.
+			wantVenvPath: filepath.ToSlash,
+		},
+		{
+			// A Windows drive-relative value such as C:envs\x names a folder on
+			// that drive; uv uses it as is, so does the CLI.
+			name: "drive-relative",
+			setup: func(t *testing.T) (string, string, fakePM) {
+				if runtime.GOOS != "windows" {
+					t.Skip("a drive-relative path exists only on Windows")
+				}
+				dir := writeProject(t)
+				return dir, dir, fakePM{py: "3.12", dbc: "17.2.0"}
+			},
+			value:        `C:envs\x`,
+			wantVenv:     func(*testing.T, string) string { return `C:envs\x` },
+			wantVenvPath: func(string) string { return "C:envs/x" },
+		},
+		{
+			name: "absolute",
+			setup: func(t *testing.T) (string, string, fakePM) {
+				dir := writeProject(t)
+				return dir, dir, fakePM{py: "3.12", dbc: "17.2.0"}
+			},
+			value:        abs,
+			wantVenv:     func(*testing.T, string) string { return abs },
+			wantVenvPath: func(string) string { return filepath.ToSlash(abs) },
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			projectDir, base, fake := tc.setup(t)
+			pm := &venvRecordingPM{fakePM: fake}
+			p := newServerlessTestPipeline(t, projectDir)
+			p.PM = pm
+
+			res, err := p.Run(env.Set(t.Context(), EnvUvProjectEnvironment, tc.value))
+			require.NoError(t, err)
+			want := tc.wantVenv(t, base)
+			assert.Equal(t, want, pm.postProvisionVenv)
+			assert.Equal(t, want, pm.validateVenv)
+			assert.Equal(t, tc.wantVenvPath(want), res.VenvPath)
+		})
+	}
+}
diff --git a/libs/localenv/pkgmanager.go b/libs/localenv/pkgmanager.go
new file mode 100644
index 00000000000..18c3767a2e4
--- /dev/null
+++ b/libs/localenv/pkgmanager.go
@@ -0,0 +1,81 @@
+package localenv
+
+import "context"
+
+// PackageManager manages the Python environment for a dbconnect project.
+type PackageManager interface {
+	// Name returns the name of the package manager (e.g. "uv").
+	Name() string
+
+	// EnsureAvailable ensures the package manager binary is present, installing
+	// it if necessary. It returns the version string on success.
+	EnsureAvailable(ctx context.Context) (version string, err error)
+
+	// EnsurePython first asks the package manager to install the requested minor.
+	// If that fails, it may select an already-installed interpreter for that
+	// minor. The returned executable is passed unchanged to Provision.
+	EnsurePython(ctx context.Context, minor string) (PythonSelection, error)
+
+	// WorkspaceRoot returns the absolute root of the workspace that the package
+	// manager uses for projectDir. For a project that is not a workspace member,
+	// this is projectDir itself.
+	WorkspaceRoot(ctx context.Context, projectDir string) (string, error)
+
+	// Provision installs the project dependencies inside projectDir, pinning the
+	// environment to python, which is either a minor request (e.g. "3.12") or an
+	// exact interpreter path selected by EnsurePython.
+	Provision(ctx context.Context, projectDir, python string) error
+
+	// PostProvision seeds pip into the virtual environment at venv (an absolute
+	// path to the venv folder), running in projectDir.
+	// This step is required because VS Code's ms-python.vscode-python-envs
+	// extension falls back to `python -m pip list` when its `uv --version`
+	// probe fails on the GUI PATH; uv venvs contain no pip; and `uv sync`
+	// strips pip, so seeding must run after every sync.
+	PostProvision(ctx context.Context, projectDir, venv string) error
+
+	// Validate inspects the provisioned virtual environment at venv, running in
+	// projectDir, and returns what it observed (see VenvInfo). The caller decides
+	// which observations are acceptable.
+	Validate(ctx context.Context, projectDir, venv string) (VenvInfo, error)
+}
+
+// PythonResolution records which preparation path supplied the interpreter.
+// It is deliberately categorical (never a path or version) so consumers can
+// branch on a stable value in the structured result.
+type PythonResolution string
+
+const (
+	PythonResolutionUnspecified        PythonResolution = ""
+	PythonResolutionUVInstallSucceeded PythonResolution = "uv_install_succeeded"
+	PythonResolutionInstalledFallback  PythonResolution = "installed_fallback"
+)
+
+// PythonSelection is the interpreter uv sync must use and its resolution path.
+type PythonSelection struct {
+	Executable string
+	Resolution PythonResolution
+}
+
+// VenvInfo is what the validate phase observed in the provisioned virtual environment.
+type VenvInfo struct {
+	// PythonMinor is the interpreter's "major.minor" (e.g. "3.12").
+	PythonMinor string
+	// DBConnect is the installed databricks-connect distribution version, "" if absent.
+	DBConnect string
+	// Pyspark is the installed standalone pyspark distribution version, "" if absent.
+	// databricks-connect vendors the pyspark package tree without registering a pyspark
+	// distribution, so a non-empty value means a separate pyspark distribution is
+	// installed on top of it.
+	Pyspark string
+	// DBConnectImportErr is the type name of the exception raised by `import
+	// databricks.connect` in the venv, or "" when the import succeeds. It is non-empty
+	// whenever the import raises — including ModuleNotFoundError when databricks-connect
+	// is not installed at all — so a reader must gate on DBConnect != "" before treating
+	// it as a collision signal. A *live* standalone-pyspark collision surfaces here as an
+	// ImportError, because the two share the pyspark namespace and the losing package's
+	// files are overwritten. A stale, orphaned pyspark dist-info left behind by an install
+	// that databricks-connect's files won does NOT set this — the import still succeeds —
+	// which is how the caller tells a broken collision from a harmless leftover.
+	DBConnectImportErr string
+}
diff --git a/libs/localenv/provision_integration_test.go b/libs/localenv/provision_integration_test.go
new file mode 100644
index 00000000000..ba26615b0ab
--- /dev/null
+++ b/libs/localenv/provision_integration_test.go
@@ -0,0 +1,245 @@
+package localenv
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strconv"
+	"testing"
+
+	"github.com/databricks/cli/libs/env"
+	"github.com/databricks/cli/libs/process"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// EnvTestProvision opts a machine into the real provision/validate integration
+// tests below. They are skipped by default because they run a real `uv sync`
+// (installing an interpreter and databricks-connect from a package index), which
+// needs uv on PATH and network access to a PyPI mirror — neither is guaranteed in
+// unit-test CI. The rest of the pipeline is covered hermetically by the unit and
+// acceptance suites (all of which use --dry-run or a fake PackageManager); this
+// file is the one place the real merge -> provision -> validate path is exercised.
+const EnvTestProvision = "DATABRICKS_LOCALENV_TEST_PROVISION"
+
+// requireRealProvision skips unless the machine opted in and uv is discoverable.
+func requireRealProvision(t *testing.T) {
+	t.Helper()
+	if env.Get(t.Context(), EnvTestProvision) == "" {
+		t.Skipf("%s is not set; skipping real uv provision integration test", EnvTestProvision)
+	}
+	if _, err := discoverUv(t.Context()); err != nil {
+		t.Skipf("uv not available (%v); skipping real uv provision integration test", err)
+	}
+}
+
+// realProvisionCtx allows uv to install itself and bridges the user's pip index
+// so `uv sync` can reach databricks-connect on networks where pypi.org is blocked
+// but a corporate mirror is declared in pip.conf.
+func realProvisionCtx(t *testing.T) context.Context {
+	ctx := env.Set(t.Context(), EnvAutoInstallUv, "1")
+	if idx := pipConfIndexURL(ctx); idx != "" {
+		ctx = env.Set(ctx, "UV_INDEX_URL", idx)
+	}
+	return ctx
+}
+
+// serverlessConstraintServer serves a per-env pyproject.toml for the serverless
+// target, mirroring what databricks/environments will publish.
+func serverlessConstraintServer(t *testing.T) *httptest.Server {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte(`[project]
+requires-python = ">=3.12"
+
+[dependency-groups]
+dev = ["databricks-connect~=17.2.0"]
+
+[tool.uv]
+constraint-dependencies = ["pyarrow<19"]
+`))
+	}))
+	t.Cleanup(srv.Close)
+	return srv
+}
+
+// TestProvisionCreatesAndValidatesVenv drives the full non-dry-run pipeline
+// (merge -> provision -> validate) against a stubbed constraint fetch and asserts
+// a real .venv is created and validated with the target's versions. This is the
+// only test that exercises a real uv provision; everything else is dry-run.
+func TestProvisionCreatesAndValidatesVenv(t *testing.T) {
+	requireRealProvision(t)
+	dir := t.TempDir() // greenfield: no pre-existing pyproject.toml
+	srv := serverlessConstraintServer(t)
+
+	p := &Pipeline{
+		Mode: ModeDefault, Check: false, ProjectDir: dir,
+		ConstraintBaseURL: srv.URL, CacheDir: t.TempDir(),
+		Flags:   ComputeFlags{Serverless: "5"},
+		Compute: stubCompute{}, PM: NewUvManager(),
+	}
+	res, err := p.Run(realProvisionCtx(t))
+	require.NoError(t, err)
+	require.NotNil(t, res)
+	assert.True(t, res.OK)
+	assert.False(t, res.DryRun)
+
+	// Every phase reached ok — including the real provision and validate.
+	for _, ph := range res.Phases {
+		assert.Equalf(t, StatusOK, ph.Status, "phase %s not ok", ph.Phase)
+	}
+
+	// A real interpreter exists in the created venv.
+	assert.FileExists(t, venvPython(filepath.Join(dir, venvDir)))
+
+	// pyproject.toml + uv.lock were written; the env-owned pin was applied.
+	pyproject, err := os.ReadFile(filepath.Join(dir, "pyproject.toml"))
+	require.NoError(t, err)
+	assert.Contains(t, string(pyproject), "databricks-connect")
+	assert.FileExists(t, filepath.Join(dir, "uv.lock"))
+
+	// Validate observed the real installed environment.
+	require.NotNil(t, res.Resolved)
+	assert.Equal(t, "3.12", res.Resolved.PythonVersion)
+	assert.Truef(t, hasMajorPrefix(res.Resolved.DBConnectVersion, "17"),
+		"expected databricks-connect major 17, got %q", res.Resolved.DBConnectVersion)
+}
+
+// requireUvWorkspaceDir skips unless uv has `uv workspace dir` (uv 0.9.9+).
+func requireUvWorkspaceDir(t *testing.T) {
+	t.Helper()
+	if _, err := process.Background(t.Context(), []string{mustUv(t, t.Context()), "workspace", "dir", "--help"}); err != nil {
+		t.Skipf("uv has no `workspace dir` command (added in uv 0.9.9): %v", err)
+	}
+}
+
+// writeUvWorkspace creates a uv workspace with members bundles/<name> and
+// returns its root.
+func writeUvWorkspace(t *testing.T, members ...string) string {
+	t.Helper()
+	root := t.TempDir()
+	for _, m := range members {
+		dir := filepath.Join(root, "bundles", m)
+		require.NoError(t, os.MkdirAll(dir, 0o755))
+		require.NoError(t, os.WriteFile(filepath.Join(dir, pyprojectFile),
+			[]byte("[project]\nname = \""+m+"\"\nversion = \"0.1.0\"\nrequires-python = \">=3.10\"\n"), 0o644))
+	}
+	require.NoError(t, os.WriteFile(filepath.Join(root, pyprojectFile),
+		[]byte("[project]\nname = \"root\"\nversion = \"0.1.0\"\nrequires-python = \">=3.10\"\n\n[tool.uv.workspace]\nmembers = [\"bundles/*\"]\n"), 0o644))
+	return root
+}
+
+// TestProvisionWorkspaceMember runs the real pipeline from a member of a uv
+// workspace with two members. uv sync creates the shared venv at the workspace
+// root, the constraint block lands in the root pyproject.toml, and uv applies it
+// (the lock honors the artifact's pyarrow<19 pin, a databricks-connect
+// dependency).
+func TestProvisionWorkspaceMember(t *testing.T) {
+	requireRealProvision(t)
+	requireUvWorkspaceDir(t)
+	root := writeUvWorkspace(t, "a", "b")
+	member := filepath.Join(root, "bundles", "a")
+	srv := serverlessConstraintServer(t)
+
+	p := &Pipeline{
+		Mode: ModeDefault, Check: false, ProjectDir: member,
+		ConstraintBaseURL: srv.URL, CacheDir: t.TempDir(),
+		Flags:   ComputeFlags{Serverless: "5"},
+		Compute: stubCompute{}, PM: NewUvManager(),
+	}
+	res, err := p.Run(realProvisionCtx(t))
+	require.NoError(t, err)
+	assert.Equal(t, "../../.venv", res.VenvPath)
+	assert.FileExists(t, venvPython(filepath.Join(root, venvDir)))
+	assert.NoDirExists(t, filepath.Join(member, venvDir))
+
+	rootPyproject, err := os.ReadFile(filepath.Join(root, pyprojectFile))
+	require.NoError(t, err)
+	assert.Contains(t, string(rootPyproject), `"pyarrow<19"`)
+
+	lock, err := os.ReadFile(filepath.Join(root, "uv.lock"))
+	require.NoError(t, err)
+	m := regexp.MustCompile(`name = "pyarrow"\nversion = "(\d+)\.`).FindSubmatch(lock)
+	require.NotNil(t, m, "uv.lock has no pyarrow entry")
+	major, err := strconv.Atoi(string(m[1]))
+	require.NoError(t, err)
+	assert.Less(t, major, 19, "the root constraint pyarrow<19 must apply")
+}
+
+// TestProvisionWorkspaceMemberProjectEnvironment runs the real pipeline from a
+// workspace member with a relative UV_PROJECT_ENVIRONMENT, which uv resolves
+// against the workspace root.
+func TestProvisionWorkspaceMemberProjectEnvironment(t *testing.T) {
+	requireRealProvision(t)
+	requireUvWorkspaceDir(t)
+	root := writeUvWorkspace(t, "a")
+	member := filepath.Join(root, "bundles", "a")
+	srv := serverlessConstraintServer(t)
+
+	p := &Pipeline{
+		Mode: ModeDefault, Check: false, ProjectDir: member,
+		ConstraintBaseURL: srv.URL, CacheDir: t.TempDir(),
+		Flags:   ComputeFlags{Serverless: "5"},
+		Compute: stubCompute{}, PM: NewUvManager(),
+	}
+	res, err := p.Run(env.Set(realProvisionCtx(t), EnvUvProjectEnvironment, "custom-env"))
+	require.NoError(t, err)
+	assert.Equal(t, "../../custom-env", res.VenvPath)
+	assert.FileExists(t, venvPython(filepath.Join(root, "custom-env")))
+	assert.NoDirExists(t, filepath.Join(root, venvDir))
+}
+
+// TestProvisionValidateIgnoresActiveVirtualEnv is the regression guard for the
+// validate fix: an active VIRTUAL_ENV pointing at a *real* interpreter of a
+// different version must not make validation read that interpreter instead of
+// the provisioned .venv. The bug only reproduces with a real, differently-
+// versioned active env — the pre-fix `uv run --no-project` reads it (verified:
+// reports 3.13), while invoking the .venv interpreter directly reads 3.12. A
+// bogus/non-existent VIRTUAL_ENV does NOT reproduce it (uv falls back), so this
+// test builds a real second venv on a different Python.
+func TestProvisionValidateIgnoresActiveVirtualEnv(t *testing.T) {
+	requireRealProvision(t)
+	baseCtx := realProvisionCtx(t)
+
+	// Build a real "active" venv on a different Python minor (3.13) than the
+	// target (3.12). Skip if that interpreter can't be provisioned here.
+	activeEnv := filepath.Join(t.TempDir(), "active-venv")
+	if _, err := process.Background(baseCtx,
+		[]string{mustUv(t, baseCtx), "venv", "--python", "3.13", activeEnv}); err != nil {
+		t.Skipf("could not create a 3.13 active venv for the negative control: %v", err)
+	}
+
+	dir := t.TempDir()
+	srv := serverlessConstraintServer(t)
+	// Activate the 3.13 env. Pre-fix, validation would report 3.13; post-fix it
+	// reads the provisioned 3.12 .venv directly and ignores this.
+	ctx := env.Set(baseCtx, "VIRTUAL_ENV", activeEnv)
+
+	p := &Pipeline{
+		Mode: ModeDefault, Check: false, ProjectDir: dir,
+		ConstraintBaseURL: srv.URL, CacheDir: t.TempDir(),
+		Flags:   ComputeFlags{Serverless: "5"},
+		Compute: stubCompute{}, PM: NewUvManager(),
+	}
+	res, err := p.Run(ctx)
+	require.NoError(t, err)
+	require.NotNil(t, res.Resolved)
+	assert.Equal(t, "3.12", res.Resolved.PythonVersion,
+		"validation must read the provisioned .venv (3.12), not the active VIRTUAL_ENV (3.13)")
+}
+
+// mustUv returns the discovered uv binary path, failing the test if uv is not
+// available (requireRealProvision has already gated on this).
+func mustUv(t *testing.T, ctx context.Context) string {
+	t.Helper()
+	bin, err := discoverUv(ctx)
+	require.NoError(t, err)
+	return bin
+}
+
+// hasMajorPrefix reports whether version starts with major + ".".
+func hasMajorPrefix(version, major string) bool {
+	return len(version) > len(major) && version[:len(major)+1] == major+"."
+}
diff --git a/libs/localenv/result.go b/libs/localenv/result.go
new file mode 100644
index 00000000000..caf4e123ffd
--- /dev/null
+++ b/libs/localenv/result.go
@@ -0,0 +1,363 @@
+package localenv
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+)
+
+// Command path components, defined once so a rename touches a single place
+// (spec §0 / invariant 8 / scenario 21). The verb is a subcommand of the
+// generated "environments" group; the --json "command" field uses CommandName.
+// No other string re-spells the command path.
+//
+// P0 is Python-only and takes no language selector: the verb is bare
+// "setup-local" (spec §naming). A language axis (setup-local python / scala) is
+// the preferred shape only if more languages are ever added, and nothing is
+// reserved for it here.
+const (
+	CommandGroup = "environments"
+	CommandVerb  = "setup-local"
+	CommandName  = CommandGroup + " " + CommandVerb
+
+	// SchemaVersion is the version of the --json output contract (spec §6).
+	// Bump it on any breaking change to the JSON shape.
+	SchemaVersion = 1
+)
+
+// Mode is the provisioning mode: a full environment (default) or the
+// constraints-only variant that omits the databricks-connect dependency.
+type Mode int
+
+const (
+	ModeDefault Mode = iota
+	ModeConstraintsOnly
+)
+
+// String returns the JSON/text spelling of the mode ("default" | "constraints-only").
+func (m Mode) String() string {
+	if m == ModeConstraintsOnly {
+		return "constraints-only"
+	}
+	return "default"
+}
+
+// PhaseName is a canonical execution phase (spec §3 / §6). The set is fixed and
+// ordered; the --json "phases" array reports every phase in this order.
+type PhaseName string
+
+const (
+	PhasePreflight PhaseName = "preflight"
+	PhaseResolve   PhaseName = "resolve"
+	PhaseFetch     PhaseName = "fetch"
+	PhaseMerge     PhaseName = "merge"
+	PhaseProvision PhaseName = "provision"
+	PhaseValidate  PhaseName = "validate"
+)
+
+// Reporter receives phase-start notifications during a run so a caller can show
+// live progress (e.g. a spinner). It is intentionally minimal: the pipeline owns
+// success/failure reporting via the Result, and Reporter only marks entry into a
+// phase. A nil Reporter disables progress.
+type Reporter interface {
+	PhaseStarted(name PhaseName)
+}
+
+// Phase status values (spec §6.2).
+const (
+	StatusOK      = "ok"
+	StatusError   = "error"
+	StatusPending = "pending"
+)
+
+// ErrorCode is a stable failure-class identifier surfaced in --json error.code
+// (spec §7). Values are compared via the ErrorCode constants, never by
+// string-matching messages, and are defined once here.
+//
+// This set is the source of truth for the spec's error-code table; each code is
+// annotated with the phase that emits it. Two codes from the spec are
+// intentionally not defined because the CLI never emits them: E_PYTHON_POLICY
+// (a policy-gated failure whose signal source does not yet exist) and E_AUTH
+// (the shared workspace-client preflight, MustWorkspaceClient, surfaces the
+// standard CLI auth error before a command JSON object is ever built).
+type ErrorCode string
+
+const (
+	ErrUsage              ErrorCode = "E_USAGE"               // preflight: incompatible flags; resolve: --job-task names a job but no task
+	ErrManagerUnsupported ErrorCode = "E_MANAGER_UNSUPPORTED" // preflight: manager is not uv
+	ErrNotWritable        ErrorCode = "E_NOT_WRITABLE"        // preflight: project dir not writable
+	ErrUvMissing          ErrorCode = "E_UV_MISSING"          // preflight: uv not found / install failed
+	ErrNoTarget           ErrorCode = "E_NO_TARGET"           // resolve: no target from any source
+	ErrResolve            ErrorCode = "E_RESOLVE"             // resolve: target read failed / ambiguous name
+	ErrEnvUnsupported     ErrorCode = "E_ENV_UNSUPPORTED"     // fetch: no published env key
+	ErrFetch              ErrorCode = "E_FETCH"               // fetch: repo unreachable, no usable cache
+	ErrWrite              ErrorCode = "E_WRITE"               // merge: greenfield write failed
+	ErrMerge              ErrorCode = "E_MERGE"               // merge: existing-project merge failed
+	ErrPythonInstall      ErrorCode = "E_PYTHON_INSTALL"      // provision: uv python install failed
+	ErrProvision          ErrorCode = "E_PROVISION"           // provision: uv sync failed (generic)
+	ErrProvisionConflict  ErrorCode = "E_PROVISION_CONFLICT"  // provision: unsatisfiable version conflict (merge-detected pin, or uv sync resolver failure)
+	ErrValidate           ErrorCode = "E_VALIDATE"            // validate: post-provision version mismatch
+
+	// ErrCanceled is not in the spec's error-code table: it reports a user/parent
+	// interrupt (SIGINT/SIGTERM cancels the context), not a failure of the phase
+	// it happened to be in. Without it an interrupt mid-`uv sync` surfaces as
+	// E_PROVISION with a "provision failed" message, implying something broke when
+	// the user simply pressed Ctrl-C. FailurePhase still records where it stopped.
+	ErrCanceled ErrorCode = "E_CANCELED" // any phase: interrupted by SIGINT/SIGTERM
+)
+
+// PipelineError is a failure carrying a stable code, the phase at which it
+// occurred, and whether disk was mutated before the failure. It marshals to the
+// --json error object (spec §6.2). Code and FailurePhase are the stable
+// contract; Err holds the wrapped cause for errors.Is/As and is not serialized
+// directly (its text is folded into the "message" field — see MarshalJSON).
+type PipelineError struct {
+	Code         ErrorCode `json:"code"`
+	FailurePhase PhaseName `json:"failurePhase"`
+	Msg          string    `json:"message"`
+	DiskMutated  bool      `json:"diskMutated"`
+	Err          error     `json:"-"`
+}
+
+func (e *PipelineError) Error() string {
+	if e.Err != nil {
+		return e.Msg + ": " + e.Err.Error()
+	}
+	return e.Msg
+}
+
+func (e *PipelineError) Unwrap() error {
+	return e.Err
+}
+
+// MarshalJSON serializes the full message (Error(), i.e. Msg plus any wrapped
+// cause) into the "message" field. Without this the --json error object would
+// carry only Msg and drop the cause (Err is json:"-"), so a JSON consumer would
+// get strictly less detail than the text output — e.g. "resolving cluster name"
+// without the "ambiguous"/"not found" reason. Text and JSON must agree.
+func (e *PipelineError) MarshalJSON() ([]byte, error) {
+	type alias PipelineError // avoid recursing into this method
+	return json.Marshal((*alias)(&PipelineError{
+		Code:         e.Code,
+		FailurePhase: e.FailurePhase,
+		Msg:          e.Error(),
+		DiskMutated:  e.DiskMutated,
+	}))
+}
+
+// NewError creates a PipelineError with a code and message. FailurePhase and
+// DiskMutated are filled in by the pipeline when it records the failure. The
+// message is formatted with fmt.Sprintf(format, args...); err may be nil.
+func NewError(code ErrorCode, err error, format string, args ...any) *PipelineError {
+	return &PipelineError{
+		Code: code,
+		Msg:  fmt.Sprintf(format, args...),
+		Err:  err,
+	}
+}
+
+// ComputeInfo is the resolved compute target, serialized as the result's
+// "compute" key (spec §6). Source records which precedence source was used
+// ("cluster", "serverless", "job", or "bundle"). SparkVersion is the raw cluster
+// runtime string the resolver read;
+// it is folded into EnvKey (dbr/<SparkVersion>) and is not part of the JSON
+// contract, kept only as intermediate resolver state.
+type ComputeInfo struct {
+	Source            string `json:"source"`
+	ClusterID         string `json:"clusterId,omitempty"`
+	ServerlessVersion string `json:"serverlessVersion,omitempty"`
+	EnvKey            string `json:"envKey"`
+
+	SparkVersion string `json:"-"`
+}
+
+// Label returns a short, human-readable name for the resolved compute target,
+// for display in the text summary (e.g. "serverless 4", "cluster 0101-abc",
+// "DBR 15.4.x-scala2.12"). The precise environment key is still available in
+// --output json and --debug.
+func (c *ComputeInfo) Label() string {
+	switch {
+	case c.ServerlessVersion != "":
+		// ServerlessVersion is normalized to "v4"; drop the "v" for display.
+		return "serverless " + c.ServerlessEnvironmentVersion()
+	case c.ClusterID != "":
+		return "cluster " + c.ClusterID
+	case c.SparkVersion != "":
+		// Classic compute resolved from a --job-task carries no ClusterID (only the
+		// task's runtime), so without this case Label would fall through and print
+		// the internal "dbr/..." env key — exactly the detail the summary hides.
+		// Show the runtime instead, matching the "DBR <version>" phrasing used in help.
+		return "DBR " + c.SparkVersion
+	default:
+		return c.EnvKey
+	}
+}
+
+// ServerlessEnvironmentVersion returns the bare serverless environment version
+// (e.g. "5") to write into [tool.databricks.environment].environment_version.
+// ServerlessVersion is normalized to "vN", so the leading "v" is dropped to
+// match the documented bare-number form. It is empty for a cluster target
+// (which leaves ServerlessVersion unset), where the section is not managed.
+func (c *ComputeInfo) ServerlessEnvironmentVersion() string {
+	return strings.TrimPrefix(c.ServerlessVersion, "v")
+}
+
+// ResolvedInfo is the resolved environment definition (spec §6 "resolved").
+// DBConnectVersion is omitted in constraints-only mode.
+type ResolvedInfo struct {
+	PythonVersion    string `json:"pythonVersion"`
+	DBConnectVersion string `json:"dbconnectVersion,omitempty"`
+	ArtifactSource   string `json:"artifactSource"`
+}
+
+// Plan describes the changes a --dry-run run would apply (spec §6.3).
+// ChangedRegions is retained for text output only and is not serialized.
+type Plan struct {
+	WouldWrite  string `json:"wouldWrite"`
+	WouldBackup string `json:"wouldBackup,omitempty"`
+	// WouldWriteUvWorkspace and WouldBackupUvWorkspace name the workspace root
+	// pyproject.toml and its planned backup, for a uv workspace member only.
+	WouldWriteUvWorkspace  string `json:"wouldWriteUvWorkspace,omitempty"`
+	WouldBackupUvWorkspace string `json:"wouldBackupUvWorkspace,omitempty"`
+	WouldInstallPython     string `json:"wouldInstallPython,omitempty"`
+	Diff                   string `json:"diff"`
+
+	ChangedRegions []string `json:"-"`
+}
+
+// PhaseStatus is one entry in the --json "phases" array (spec §6). Detail is
+// used for human-readable text output only and is not serialized.
+type PhaseStatus struct {
+	Phase  PhaseName `json:"phase"`
+	Status string    `json:"status"`
+
+	Detail string `json:"-"`
+}
+
+// Warning is a non-fatal advisory surfaced in --json "warnings" (spec §6). Code
+// is a stable, categorical identifier from the closed set below; Message is
+// human-readable text for the text renderer and is not part of the contract.
+type Warning struct {
+	Code    string `json:"code"`
+	Message string `json:"message"`
+}
+
+// Warning codes are the closed, categorical set surfaced in --json warnings[].
+// They let a consumer report a count and a code histogram (merge quality) without
+// parsing free-form text. All are emitted from the merge phase, where the fetched
+// env-owned pins can conflict with what the user already had.
+//
+// The messages are phrased in the present tense because the same detection runs
+// under --dry-run, where nothing has been written yet.
+const (
+	// WarnRequiresPythonOverridden: the user's [project].requires-python differs
+	// from the env's pin and is replaced by the managed value.
+	WarnRequiresPythonOverridden = "W_REQUIRES_PYTHON_OVERRIDDEN"
+	// WarnDBConnectPinOverridden: the user's databricks-connect pin sits directly in
+	// the dev group and is replaced by the managed value.
+	WarnDBConnectPinOverridden = "W_DBCONNECT_PIN_OVERRIDDEN"
+	// WarnDBConnectConsolidated: a databricks-connect pin the user had outside the
+	// managed dev entry — in [project].dependencies, an optional-dependency extra, or
+	// another dependency group — was disjoint from the environment's version and is
+	// removed, so what remains resolves. Only conflicting pins are removed; a pin that
+	// co-resolves, carries no version, or is marker-gated is left in place. Emitted once
+	// per removed pin. Informational: the merge makes the project resolvable.
+	WarnDBConnectConsolidated = "W_DBCONNECT_CONSOLIDATED"
+	// WarnDBConnectPinDuplicated: a databricks-connect pin of the user's is one the
+	// merge can neither rewrite nor remove — a spelling the line-based passes do not
+	// reach (a single-quoted element, a pin under a quoted TOML key, or an inline-table
+	// or dotted sub-table form) — so the managed pin lands in the dev group alongside
+	// it. Unlike an override this leaves two pins for one package and, where their
+	// ranges are disjoint, uv cannot resolve it — a distinct and worse outcome that
+	// needs a manual fix, so it carries its own code. It can accompany an override or a
+	// consolidation and persists across re-runs for as long as the survivor does.
+	WarnDBConnectPinDuplicated = "W_DBCONNECT_PIN_DUPLICATED"
+	// WarnUserConstraintConflict: a user dependency pins a package that the env's
+	// constraint-dependencies also constrains, to a provably non-overlapping version
+	// range (uv will fail to resolve). Every requirement uv locks is scanned —
+	// [project].dependencies, the optional-dependency extras, and all dependency
+	// groups — since constraint-dependencies applies to the whole resolution. Emitted
+	// only when the ranges are provably disjoint; ambiguous cases are not flagged.
+	WarnUserConstraintConflict = "W_USER_CONSTRAINT_CONFLICT"
+	// WarnStaleEnvironmentVersion: the target is a cluster, which does not manage the
+	// serverless environment section, but the file carries a [tool.databricks.environment]
+	// environment_version left over from an earlier serverless run. The value is not
+	// updated (cluster targets are a no-op there), so it now describes a target the
+	// project is no longer set up for — worth surfacing because VS Code and serverless
+	// Jobs read that section as a source of truth.
+	WarnStaleEnvironmentVersion = "W_STALE_ENVIRONMENT_VERSION"
+	// WarnStandalonePysparkConflict: the user declares a standalone pyspark dependency
+	// while the environment installs databricks-connect. databricks-connect vendors its
+	// own pyspark (it ships the pyspark/ package tree rather than depending on the
+	// standalone distribution), so a separately declared pyspark resolves into the same
+	// namespace and the two overwrite each other — the environment then fails to start a
+	// session. This is a coexistence conflict, not a version one, so it is reported
+	// independent of the pyspark version pinned. Emitted whenever databricks-connect
+	// ends up in the resolved environment — whether the env manages it (default mode) or
+	// the user's own pyproject pins it (constraints-only mode) — so it agrees with the
+	// validate hard-fail, which keys on the installed venv rather than the mode.
+	WarnStandalonePysparkConflict = "W_STANDALONE_PYSPARK_CONFLICT"
+	// WarnUvWorkspaceConstraintsReplaced: the project is a uv workspace member and
+	// the run replaced constraint pins the workspace root already had, from an
+	// earlier run (for example for another bundle) or written by the user. Every
+	// member of the workspace now resolves against the new pins.
+	WarnUvWorkspaceConstraintsReplaced = "W_UV_WORKSPACE_CONSTRAINTS_REPLACED"
+)
+
+// Result is the full outcome of a sync run and the root of the --json object
+// (spec §6). Field order matches the spec's schema so JSON key order is stable.
+//
+// Phases and Warnings are non-omitempty slices, so they must always be non-nil
+// before marshalling or the --json contract would emit "null" instead of "[]" —
+// a distinction that trips JSON consumers and golden diffs. Construct a Result
+// with NewResult (or otherwise seed both) rather than a bare Result{} literal.
+type Result struct {
+	SchemaVersion int           `json:"schemaVersion"`
+	Command       string        `json:"command"`
+	OK            bool          `json:"ok"`
+	Mode          string        `json:"mode"`
+	DryRun        bool          `json:"dryRun"`
+	Compute       *ComputeInfo  `json:"compute,omitempty"`
+	Resolved      *ResolvedInfo `json:"resolved,omitempty"`
+	Greenfield    bool          `json:"greenfield"`
+	Plan          *Plan         `json:"plan,omitempty"`
+	// VenvPath is the provisioned venv folder in slash form, relative to the
+	// project folder, or absolute when UV_PROJECT_ENVIRONMENT is absolute.
+	VenvPath string `json:"venvPath,omitempty"`
+	// UvWorkspaceRoot is the uv workspace root (absolute, slash form) when the
+	// project is a workspace member. The [tool.uv] constraint block and the venv
+	// live there. Empty for a standalone project.
+	UvWorkspaceRoot  string           `json:"uvWorkspaceRoot,omitempty"`
+	PythonResolution PythonResolution `json:"pythonResolution,omitempty"`
+	// PythonInterpreter is the exact interpreter chosen by the installed-Python
+	// fallback, named in the text summary so the user can tell which interpreter
+	// backs the venv. Not serialized: the structured result stays categorical via
+	// PythonResolution (a path would leak machine layout to JSON consumers).
+	PythonInterpreter string `json:"-"`
+	// SkipConstraints records whether --no-constraints was set. Not serialized: it
+	// is not part of the --output json contract, but the telemetry event reads it to
+	// distinguish a --no-constraints run from a plain one (Mode only records the
+	// databricks-connect axis).
+	SkipConstraints bool           `json:"-"`
+	Phases          []PhaseStatus  `json:"phases"`
+	Warnings        []Warning      `json:"warnings"`
+	Error           *PipelineError `json:"error"`
+	BackupPath      string         `json:"backupPath,omitempty"`
+	// UvWorkspaceBackupPath is the backup of the workspace root pyproject.toml, set
+	// only when the run changed that file.
+	UvWorkspaceBackupPath string `json:"uvWorkspaceBackupPath,omitempty"`
+	// DurationMs is the pipeline's wall time in milliseconds (spec §6). It covers the
+	// CLI pipeline only; the extension measures its own end-to-end latency (process
+	// spawn, interpreter adoption) separately.
+	DurationMs int64 `json:"durationMs"`
+}
+
+// NewResult returns a Result with the non-omitempty slice fields initialized to
+// empty (non-nil) slices, so the --json output always renders "phases": [] and
+// "warnings": [] rather than "null". Callers fill in the remaining fields.
+func NewResult() *Result {
+	return &Result{
+		Phases:   []PhaseStatus{},
+		Warnings: []Warning{},
+	}
+}
diff --git a/libs/localenv/result_test.go b/libs/localenv/result_test.go
new file mode 100644
index 00000000000..1f3f6aa6b8d
--- /dev/null
+++ b/libs/localenv/result_test.go
@@ -0,0 +1,92 @@
+package localenv
+
+import (
+	"encoding/json"
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestPipelineErrorWrapsAndExposesCode(t *testing.T) {
+	base := errors.New("boom")
+	err := NewError(ErrFetch, base, "fetch %s", "x")
+	assert.Equal(t, "fetch x: boom", err.Error())
+	assert.Equal(t, ErrFetch, err.Code)
+	assert.ErrorIs(t, err, base)
+}
+
+func TestModeString(t *testing.T) {
+	assert.Equal(t, "default", ModeDefault.String())
+	assert.Equal(t, "constraints-only", ModeConstraintsOnly.String())
+}
+
+func TestCommandName(t *testing.T) {
+	// The --json "command" field and all help text derive from these; the
+	// path must join to the full command a user types.
+	assert.Equal(t, "environments setup-local", CommandName)
+}
+
+func TestNewResultEmitsEmptyArraysNotNull(t *testing.T) {
+	// The --json contract requires phases/warnings to render as [] not null;
+	// NewResult seeds them so consumers and golden diffs see a stable shape.
+	b, err := json.Marshal(NewResult())
+	require.NoError(t, err)
+	s := string(b)
+	assert.Contains(t, s, `"phases":[]`)
+	assert.Contains(t, s, `"warnings":[]`)
+	assert.NotContains(t, s, `"phases":null`)
+	assert.NotContains(t, s, `"warnings":null`)
+	// A bare Result{} literal is the shape NewResult exists to avoid.
+	bare, err := json.Marshal(&Result{})
+	require.NoError(t, err)
+	assert.Contains(t, string(bare), `"phases":null`, "sanity: bare literal is the null case")
+}
+
+func TestResultEmitsPythonResolutionCategorically(t *testing.T) {
+	for _, resolution := range []PythonResolution{
+		PythonResolutionUVInstallSucceeded,
+		PythonResolutionInstalledFallback,
+	} {
+		t.Run(string(resolution), func(t *testing.T) {
+			result := NewResult()
+			result.PythonResolution = resolution
+
+			b, err := json.Marshal(result)
+
+			require.NoError(t, err)
+			assert.Contains(t, string(b), `"pythonResolution":"`+string(resolution)+`"`)
+			assert.NotContains(t, string(b), "python3.12")
+		})
+	}
+}
+
+func TestResultOmitsUnknownPythonResolution(t *testing.T) {
+	result := NewResult()
+	result.PythonResolution = PythonResolutionUnspecified
+	b, err := json.Marshal(result)
+	require.NoError(t, err)
+	assert.NotContains(t, string(b), "pythonResolution")
+}
+
+func TestComputeInfoLabel(t *testing.T) {
+	cases := []struct {
+		name string
+		info ComputeInfo
+		want string
+	}{
+		{"serverless", ComputeInfo{Source: "serverless", ServerlessVersion: "v4", EnvKey: "serverless/serverless-v4"}, "serverless 4"},
+		{"job serverless", ComputeInfo{Source: "job", ServerlessVersion: "v5", EnvKey: "serverless/serverless-v5"}, "serverless 5"},
+		{"cluster", ComputeInfo{Source: "cluster", ClusterID: "0101-abc", EnvKey: "dbr/15.4.x-scala2.12"}, "cluster 0101-abc"},
+		// A --job-task bound to classic compute carries only SparkVersion (no
+		// ClusterID), so it must render the runtime rather than leak the env key.
+		{"job classic", ComputeInfo{Source: "job", SparkVersion: "15.4.x-scala2.12", EnvKey: "dbr/15.4.x-scala2.12"}, "DBR 15.4.x-scala2.12"},
+		{"fallback", ComputeInfo{Source: "bundle", EnvKey: "dbr/15.4.x-scala2.12"}, "dbr/15.4.x-scala2.12"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, tc.info.Label())
+		})
+	}
+}
diff --git a/libs/localenv/uv.go b/libs/localenv/uv.go
new file mode 100644
index 00000000000..49d2eedc3ed
--- /dev/null
+++ b/libs/localenv/uv.go
@@ -0,0 +1,576 @@
+package localenv
+
+import (
+	"bufio"
+	"context"
+	"errors"
+	"net/url"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"regexp"
+	"runtime"
+	"strings"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/env"
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/process"
+)
+
+// EnvAutoInstallUv opts into installing uv without an interactive prompt. It
+// exists so non-interactive runs (CI, IDE integrations) can allow the install
+// that would otherwise be declined for lack of a TTY. Any truthy value enables it.
+const EnvAutoInstallUv = "DATABRICKS_LOCALENV_AUTO_INSTALL_UV"
+
+// EnvUvProjectEnvironment is uv's own setting for where `uv sync` puts the
+// project environment: an absolute path as is, a relative one against the
+// workspace root (or the project root outside a workspace).
+// https://docs.astral.sh/uv/reference/environment/#uv_project_environment
+const EnvUvProjectEnvironment = "UV_PROJECT_ENVIRONMENT"
+
+// uvManager implements PackageManager using the uv tool.
+// https://docs.astral.sh/uv/
+type uvManager struct {
+	bin string
+}
+
+// NewUvManager returns a PackageManager backed by the uv tool. The binary path
+// is resolved lazily via EnsureAvailable.
+func NewUvManager() PackageManager {
+	return &uvManager{}
+}
+
+// Name returns "uv".
+func (m *uvManager) Name() string {
+	return "uv"
+}
+
+// EnsureAvailable discovers or installs uv and records the binary path.
+// It runs the official installer when uv is not found on the PATH or in the
+// standard candidate locations.
+// https://docs.astral.sh/uv/getting-started/installation/
+func (m *uvManager) EnsureAvailable(ctx context.Context) (string, error) {
+	bin, err := discoverUv(ctx)
+	if err != nil {
+		if !confirmUvInstall(ctx) {
+			return "", NewError(ErrUvMissing, nil,
+				"uv is required but not installed; install it (https://docs.astral.sh/uv/getting-started/installation/) or set %s=1 to let this command install it for you", EnvAutoInstallUv)
+		}
+		if installErr := installUv(ctx); installErr != nil {
+			return "", NewError(ErrUvMissing, installErr, "uv installation failed")
+		}
+		bin, err = discoverUv(ctx)
+		if err != nil {
+			return "", err
+		}
+	}
+	log.Debugf(ctx, "uv: discovered binary at %s", bin)
+	m.bin = bin
+
+	// Use --version (not "version") to avoid project-scoped sub-command that requires pyproject.toml.
+	version, err := process.Background(ctx, []string{m.bin, "--version"}, process.WithProcessGroup())
+	if err != nil {
+		return "", uvFailure(ErrUvMissing, err, "uv version check")
+	}
+	return strings.TrimSpace(version), nil
+}
+
+// runUv runs the uv binary with args in dir, injecting UV_INDEX_URL from pip.conf
+// when appropriate. An empty dir runs in the current working directory
+// (process.WithDir("") is a no-op). The index-url is injected only when
+// resolveIndexURL returns non-empty; it returns "" when UV_INDEX_URL is already
+// set, so an explicit value in the environment is never clobbered.
+// WithProcessGroup is applied because uv fans out to its own subprocesses
+// (Python, build backends); on SIGINT/SIGTERM they must be reaped as a group
+// rather than left as orphans holding locks over a half-written .venv.
+func (m *uvManager) runUv(ctx context.Context, args []string, dir string) error {
+	_, err := m.runUvOutput(ctx, args, dir)
+	return err
+}
+
+// runUvOutput runs uv with the same directory, index-url bridge, and process
+// group behavior as runUv, returning stdout for commands with structured output.
+func (m *uvManager) runUvOutput(ctx context.Context, args []string, dir string) (string, error) {
+	if indexURL := m.resolveIndexURL(ctx); indexURL != "" {
+		return process.Background(ctx, args, process.WithDir(dir), process.WithEnv("UV_INDEX_URL", indexURL), process.WithProcessGroup())
+	}
+	return process.Background(ctx, args, process.WithDir(dir), process.WithProcessGroup())
+}
+
+// EnsurePython installs the requested Python minor via uv, falling back to a
+// compatible interpreter already on the machine when the download fails.
+func (m *uvManager) EnsurePython(ctx context.Context, minor string) (PythonSelection, error) {
+	args := append([]string{m.bin}, m.pythonInstallArgs(minor)...)
+	installErr := m.runUv(ctx, args, "")
+	if installErr == nil {
+		return PythonSelection{Executable: minor, Resolution: PythonResolutionUVInstallSucceeded}, nil
+	}
+	if ctx.Err() != nil {
+		return PythonSelection{}, uvFailure(ErrPythonInstall, installErr, "uv python install "+minor)
+	}
+	executable, findErr := m.findInstalledPython(ctx, minor)
+	if ctx.Err() != nil {
+		// Interrupted mid-search: report the cancellation, not a false "nothing
+		// found". errors.Join drops a nil findErr when the search had finished.
+		return PythonSelection{}, uvFailure(ErrPythonInstall, errors.Join(installErr, findErr), "uv python install "+minor)
+	}
+	if findErr != nil {
+		// The download and the installed-interpreter search are distinct commands.
+		// Attribute each stderr to its own clause ("found either: <find stderr>") so
+		// the find stderr doesn't read as if `python install` rejected an argument it
+		// never saw. Kept on one line: PipelineError.Error() appends the wrapped
+		// cause after Msg, so a newline here would strand that tail on the next line.
+		// Both process errors ride along in the joined cause for errors.As / --debug.
+		msg := "uv python install " + minor + " failed"
+		if stderr := uvStderr(installErr); stderr != "" {
+			msg += ": " + stderr
+		}
+		msg += "; no compatible installed Python found either"
+		if stderr := uvStderr(findErr); stderr != "" {
+			msg += ": " + stderr
+		}
+		return PythonSelection{}, NewError(ErrPythonInstall, errors.Join(installErr, findErr), "%s", msg)
+	}
+	log.Debugf(ctx, "uv: Python download failed (%s); using installed interpreter %s", uvStderr(installErr), executable)
+	return PythonSelection{Executable: executable, Resolution: PythonResolutionInstalledFallback}, nil
+}
+
+// findInstalledPython returns the path to an interpreter for the target minor
+// already present on the machine, or an error if none is. uv applies its own
+// managed-first preference and excludes project venvs; --system is required so an
+// active .venv is ignored, and --no-python-downloads keeps it from re-attempting
+// the download that just failed.
+// https://docs.astral.sh/uv/reference/cli/#uv-python-find
+func (m *uvManager) findInstalledPython(ctx context.Context, minor string) (string, error) {
+	args := append([]string{m.bin}, m.pythonFindArgs(minor)...)
+	out, err := m.runUvOutput(ctx, args, "")
+	if err != nil {
+		return "", err
+	}
+	return strings.TrimSpace(out), nil
+}
+
+// Provision runs `uv sync` inside projectDir to install project dependencies,
+// pinning the interpreter to python. Without --python, `uv sync` selects the
+// newest installed interpreter satisfying requires-python (e.g. 3.13 for a
+// ">=3.12" floor), which then fails pipeline validation against the 3.12 target.
+// The explicit request is either the minor just installed or the interpreter
+// path found by the installed-Python fallback.
+func (m *uvManager) Provision(ctx context.Context, projectDir, python string) error {
+	args := append([]string{m.bin}, m.syncArgs(python)...)
+	if err := m.runUv(ctx, args, projectDir); err != nil {
+		// A transitive dependency conflict is only discoverable by uv's resolver, so
+		// unlike a direct pin conflict (caught pre-sync as W_USER_CONSTRAINT_CONFLICT)
+		// it surfaces here. Report the same E_PROVISION_CONFLICT code so both conflict
+		// shapes are attributed alike; other sync failures stay generic E_PROVISION.
+		code := ErrProvision
+		if isUvResolutionConflict(uvStderr(err)) {
+			code = ErrProvisionConflict
+		}
+		return uvFailure(code, err, "uv sync")
+	}
+	return nil
+}
+
+// isUvResolutionConflict reports whether uv's stderr is a dependency-resolution
+// failure (uv's "No solution found" resolver header, with "unsatisfiable" as a
+// defensive fallback) rather than an unrelated failure such as a network error
+// or a wheel build failure, which uv reports with different wording.
+//
+// Transport/reachability failures (VPN block, unreachable index, DNS) fail
+// before the resolver with different wording ("Failed to fetch", "Connection
+// refused"), so they already stay E_PROVISION. The one exception is an offline
+// cache miss, which uv reports with the resolver banner AND a "network was
+// disabled" hint — that is a reachability problem, not a dependency conflict, so
+// exclude it explicitly.
+//
+// Remaining accepted imprecision: uv reuses the banner for a genuinely
+// nonexistent/typoed package and a requires-python mismatch, which are still
+// reported as E_PROVISION_CONFLICT. Accepted — both are user-actionable
+// dependency problems, and the error message carries uv's verbatim stderr, so
+// the code is only a coarse hint for consumers (telemetry, the extension's
+// recovery flow), never the sole diagnostic.
+// https://docs.astral.sh/uv/reference/resolver-internals/
+func isUvResolutionConflict(stderr string) bool {
+	s := strings.ToLower(stderr)
+	if strings.Contains(s, "network was disabled") {
+		return false // offline cache miss, not a dependency problem
+	}
+	return strings.Contains(s, "no solution found") || strings.Contains(s, "are unsatisfiable")
+}
+
+// venvPython returns the path to the Python interpreter of the virtualenv at venv,
+// accounting for the Windows (Scripts/python.exe) vs Unix (bin/python) layout.
+func venvPython(venv string) string {
+	if runtime.GOOS == "windows" {
+		return filepath.Join(venv, "Scripts", "python.exe")
+	}
+	return filepath.Join(venv, "bin", "python")
+}
+
+// PostProvision seeds pip into the virtual environment at venv.
+//
+// VS Code's ms-python.vscode-python-envs extension falls back to
+// `python -m pip list` when its `uv --version` probe fails on the GUI PATH.
+// uv virtual environments do not include pip by default, and `uv sync` strips
+// pip if it was previously present. Seeding pip after every sync ensures the
+// VS Code integration works correctly regardless of how the environment was
+// activated.
+func (m *uvManager) PostProvision(ctx context.Context, projectDir, venv string) error {
+	args := append([]string{m.bin}, m.pipSeedArgs(venvPython(venv))...)
+	if err := m.runUv(ctx, args, projectDir); err != nil {
+		return uvFailure(ErrProvision, err, "uv pip seed")
+	}
+	return nil
+}
+
+// Validate inspects the virtual environment at venv: the Python minor version, the
+// databricks-connect and standalone-pyspark distribution versions, and whether
+// databricks-connect actually imports. A missing databricks-connect or pyspark yields
+// an empty version rather than an error (PackageNotFoundError is caught), so the probe
+// never fails just because a package is absent; the caller decides what is acceptable.
+//
+// The version probes read distribution metadata, not the importable module:
+// databricks-connect vendors the pyspark package tree without registering a pyspark
+// distribution, so a resolvable pyspark version means a standalone pyspark is installed
+// on top of it. Metadata alone cannot tell a live collision from a stale dist-info that
+// no longer describes the importable module, so the probe also attempts `import
+// databricks.connect`: a live collision raises there, a harmless leftover does not.
+func (m *uvManager) Validate(ctx context.Context, projectDir, venv string) (VenvInfo, error) {
+	// Each value is printed with a unique prefix so parsing greps for the prefix rather
+	// than relying on line position: any stray line uv or the interpreter writes to
+	// stdout (e.g. a warning) would otherwise shift a positional parse.
+	pyCode := `import sys, importlib, importlib.metadata
+def _ver(name):
+    try:
+        return importlib.metadata.version(name)
+    except importlib.metadata.PackageNotFoundError:
+        return ""
+print(f"` + validatePyPrefix + `{sys.version_info.major}.{sys.version_info.minor}")
+print("` + validateDBCPrefix + `" + _ver("databricks-connect"))
+print("` + validatePysparkPrefix + `" + _ver("pyspark"))
+try:
+    importlib.import_module("databricks.connect")
+    print("` + validateDBCImportPrefix + `")
+except BaseException as e:
+    print("` + validateDBCImportPrefix + `" + type(e).__name__)`
+	// Invoke the venv interpreter directly rather than `uv run`: `uv run` resolves
+	// the interpreter from an active VIRTUAL_ENV / CONDA_PREFIX when one is set
+	// (even with --no-project), which would validate whatever env the caller has
+	// active instead of the .venv we just provisioned. The direct path is exactly
+	// what was installed, so validation observes the real target.
+	out, err := process.Background(ctx,
+		[]string{venvPython(venv), "-c", pyCode},
+		process.WithDir(projectDir),
+		process.WithProcessGroup(),
+	)
+	if err != nil {
+		return VenvInfo{}, uvFailure(ErrValidate, err, "venv python validation")
+	}
+	pyVer, ok := lineWithPrefix(out, validatePyPrefix)
+	if !ok || pyVer == "" {
+		return VenvInfo{}, NewError(ErrValidate, nil, "unexpected output from uv run: %q", out)
+	}
+	// databricks-connect / pyspark versions are empty when the package is not installed
+	// as a distribution of its own; the import-error line is empty when the import worked.
+	dbcVer, _ := lineWithPrefix(out, validateDBCPrefix)
+	pysparkVer, _ := lineWithPrefix(out, validatePysparkPrefix)
+	dbcImportErr, _ := lineWithPrefix(out, validateDBCImportPrefix)
+	return VenvInfo{
+		PythonMinor:        pyVer,
+		DBConnect:          dbcVer,
+		Pyspark:            pysparkVer,
+		DBConnectImportErr: dbcImportErr,
+	}, nil
+}
+
+// Validation output prefixes: uv run's stdout is grepped for these rather than
+// parsed positionally, so extra lines from uv or the interpreter don't break it.
+const (
+	validatePyPrefix        = "PYVER:"
+	validateDBCPrefix       = "DBCVER:"
+	validatePysparkPrefix   = "PYSPARKVER:"
+	validateDBCImportPrefix = "DBCIMPORT:"
+)
+
+// lineWithPrefix returns the trimmed remainder of the first line in out that
+// starts with prefix, and whether such a line was found.
+func lineWithPrefix(out, prefix string) (string, bool) {
+	for line := range strings.SplitSeq(out, "\n") {
+		line = strings.TrimSpace(line)
+		if after, ok := strings.CutPrefix(line, prefix); ok {
+			return strings.TrimSpace(after), true
+		}
+	}
+	return "", false
+}
+
+// WorkspaceRoot asks uv for the workspace root of projectDir (`uv workspace
+// dir`, added in uv 0.9.9). Under --dry-run EnsureAvailable has not run, so the
+// binary is discovered here without installing it.
+// https://docs.astral.sh/uv/reference/cli/#uv-workspace-dir
+func (m *uvManager) WorkspaceRoot(ctx context.Context, projectDir string) (string, error) {
+	bin := m.bin
+	if bin == "" {
+		found, err := discoverUv(ctx)
+		if err != nil {
+			return "", err
+		}
+		bin = found
+	}
+	out, err := m.runUvOutput(ctx, append([]string{bin}, m.workspaceDirArgs()...), projectDir)
+	if err != nil {
+		return "", err
+	}
+	return strings.TrimSpace(out), nil
+}
+
+// workspaceDirArgs returns the argument slice for `uv workspace dir`.
+func (m *uvManager) workspaceDirArgs() []string {
+	return []string{"workspace", "dir"}
+}
+
+// syncArgs returns the argument slice for `uv sync` (without the binary),
+// pinning the interpreter to python via --python.
+func (m *uvManager) syncArgs(python string) []string {
+	return []string{"sync", "--python", python}
+}
+
+// pythonInstallArgs returns the argument slice for `uv python install <minor>`.
+func (m *uvManager) pythonInstallArgs(minor string) []string {
+	return []string{"python", "install", minor}
+}
+
+// pythonFindArgs returns the arguments for locating an installed interpreter for
+// the target minor without downloading. --system ignores the project's own venv.
+// https://docs.astral.sh/uv/reference/cli/#uv-python-find
+func (m *uvManager) pythonFindArgs(minor string) []string {
+	return []string{"python", "find", "--system", "--no-python-downloads", "cpython@==" + minor + ".*"}
+}
+
+// pipSeedArgs returns the argument slice for seeding pip into the venv.
+func (m *uvManager) pipSeedArgs(venvPython string) []string {
+	return []string{"pip", "install", "pip", "--python", venvPython}
+}
+
+// pipIndexURLRe matches `index-url = <url>` lines in pip.conf.
+var pipIndexURLRe = regexp.MustCompile(`(?i)^\s*index-url\s*=\s*(\S+)`)
+
+// pipConfIndexURL reads the user's pip config and returns the index-url value.
+// uv ignores pip.conf; on Databricks-managed machines pypi.org is blocked and
+// the corporate PyPI proxy is declared via pip.conf. Bridging the value through
+// UV_INDEX_URL lets uv reach the proxy.
+//
+// pip stores its per-user config in OS-specific locations, so we probe them in
+// order and return the first index-url found.
+// https://pip.pypa.io/en/stable/topics/configuration/#location
+func pipConfIndexURL(ctx context.Context) string {
+	for _, confPath := range pipConfPaths(ctx) {
+		if url := indexURLFromFile(confPath); url != "" {
+			return url
+		}
+	}
+	return ""
+}
+
+// pipConfPaths returns the per-user pip config file locations to probe, in
+// precedence order, for the current OS. An empty home yields no paths.
+// https://pip.pypa.io/en/stable/topics/configuration/#location
+func pipConfPaths(ctx context.Context) []string {
+	home, err := env.UserHomeDir(ctx)
+	if err != nil || home == "" {
+		return nil
+	}
+	switch runtime.GOOS {
+	case "windows":
+		// pip reads %APPDATA%\pip\pip.ini; fall back to the home-relative path
+		// when APPDATA is unset.
+		if appData, ok := env.Lookup(ctx, "APPDATA"); ok && appData != "" {
+			return []string{filepath.Join(appData, "pip", "pip.ini")}
+		}
+		return []string{filepath.Join(home, "pip", "pip.ini")}
+	case "darwin":
+		return []string{
+			filepath.Join(home, "Library", "Application Support", "pip", "pip.conf"),
+			filepath.Join(home, ".config", "pip", "pip.conf"),
+			// Legacy per-user location pip still reads.
+			filepath.Join(home, ".pip", "pip.conf"),
+		}
+	default:
+		return []string{
+			filepath.Join(home, ".config", "pip", "pip.conf"),
+			// Legacy per-user location pip still reads.
+			filepath.Join(home, ".pip", "pip.conf"),
+		}
+	}
+}
+
+// indexURLFromFile returns the first index-url value in a pip config file, or ""
+// if the file is absent or has no index-url entry.
+func indexURLFromFile(confPath string) string {
+	f, err := os.Open(confPath)
+	if err != nil {
+		return ""
+	}
+	defer f.Close()
+
+	scanner := bufio.NewScanner(f)
+	for scanner.Scan() {
+		if m := pipIndexURLRe.FindStringSubmatch(scanner.Text()); m != nil {
+			return strings.TrimSpace(m[1])
+		}
+	}
+	return ""
+}
+
+// resolveIndexURL returns a UV_INDEX_URL value to inject, or "" when none is
+// needed. It returns "" when UV_INDEX_URL is already set in the context env
+// (so the caller's explicit value is never overridden) and also when pip.conf
+// has no index-url entry.
+func (m *uvManager) resolveIndexURL(ctx context.Context) string {
+	if _, ok := env.Lookup(ctx, "UV_INDEX_URL"); ok {
+		log.Debugf(ctx, "uv: UV_INDEX_URL already set in environment, not overriding")
+		return ""
+	}
+	url := pipConfIndexURL(ctx)
+	if url != "" {
+		// Redact any embedded credentials: private PyPI proxies often carry
+		// userinfo (https://user:pass@host/simple) that must not reach debug logs.
+		log.Debugf(ctx, "uv: using package index %s from pip.conf", redactURLCredentials(url))
+	} else {
+		log.Debugf(ctx, "uv: no UV_INDEX_URL and no index-url in pip.conf; uv will use its default index (pypi.org)")
+	}
+	return url
+}
+
+// redactURLCredentials strips userinfo from a URL so it is safe to log. A value
+// that does not parse as a URL is returned unchanged (it carries no parseable
+// userinfo to leak).
+func redactURLCredentials(raw string) string {
+	u, err := url.Parse(raw)
+	if err != nil || u.User == nil {
+		return raw
+	}
+	u.User = nil
+	return u.String()
+}
+
+// uvFailure builds a PipelineError from a failed uv invocation, appending uv's
+// stderr to the message so callers can see the actual failure reason (e.g.
+// "Connection refused") rather than just the exit code.
+func uvFailure(code ErrorCode, err error, action string) *PipelineError {
+	msg := action + " failed"
+	if stderr := uvStderr(err); stderr != "" {
+		msg = msg + ": " + stderr
+	}
+	return NewError(code, err, "%s", msg)
+}
+
+// uvStderr returns the trimmed stderr of a failed uv process, or "" when err is
+// not a process failure.
+func uvStderr(err error) string {
+	if perr, ok := errors.AsType[*process.ProcessError](err); ok {
+		return strings.TrimSpace(perr.Stderr)
+	}
+	return ""
+}
+
+// confirmUvInstall reports whether the caller has consented to installUv running
+// a remote installer that mutates the machine. The EnvAutoInstallUv opt-in wins
+// outright (for CI / IDE integrations); otherwise an interactive session is
+// prompted, and a non-interactive session without the opt-in declines rather than
+// silently downloading and executing an installer.
+func confirmUvInstall(ctx context.Context) bool {
+	if optIn, ok := env.GetBool(ctx, EnvAutoInstallUv); ok && optIn {
+		return true
+	}
+	// EnsureAvailable is a library entry point reachable with a context that has
+	// no cmdio (e.g. Pipeline built with context.Background()); IsPromptSupported
+	// would panic there. Treat a missing cmdio as non-interactive and decline.
+	if !cmdio.HasIO(ctx) || !cmdio.IsPromptSupported(ctx) {
+		return false
+	}
+	// Name the OS-specific installer URL that installUv will actually fetch, so
+	// the prompt is transparent about what runs (install.ps1 on Windows).
+	ok, err := cmdio.AskYesOrNo(ctx, "uv is not installed. Download and run the official uv installer ("+uvInstallerURL()+")?")
+	return err == nil && ok
+}
+
+// uvInstallerURL returns the URL of the official uv installer script that
+// installUv fetches for the current OS.
+func uvInstallerURL() string {
+	if runtime.GOOS == "windows" {
+		return "https://astral.sh/uv/install.ps1"
+	}
+	return "https://astral.sh/uv/install.sh"
+}
+
+// installUv runs the official uv installer for the current OS. Unix uses the
+// shell installer; Windows uses the PowerShell installer, because the Unix
+// `sh`/`curl` pipeline is not available in a default Windows shell.
+// https://docs.astral.sh/uv/getting-started/installation/
+func installUv(ctx context.Context) error {
+	var cmd []string
+	if runtime.GOOS == "windows" {
+		cmd = []string{"powershell", "-ExecutionPolicy", "ByPass", "-Command", "irm " + uvInstallerURL() + " | iex"}
+	} else {
+		cmd = []string{"sh", "-c", "curl -LsSf " + uvInstallerURL() + " | sh"}
+	}
+	// This downloads and runs a remote installer that mutates the user's machine
+	// (~/.local/bin), so record exactly what ran before it fires — visible under
+	// --debug for anyone auditing where uv came from.
+	log.Debugf(ctx, "uv: not found; running installer: %s", strings.Join(cmd, " "))
+	// The installer is a shell/PowerShell pipeline that spawns curl and the
+	// downloaded script; reap the whole group on cancellation so an interrupted
+	// install leaves no orphaned downloader behind.
+	_, err := process.Background(ctx, cmd, process.WithProcessGroup())
+	return err
+}
+
+// discoverUv searches for the uv binary on PATH and in well-known install
+// locations. It returns NewError(ErrUvMissing, ...) if uv is not found.
+//
+// Candidate locations follow the uv installer defaults:
+// https://docs.astral.sh/uv/getting-started/installation/
+// XDG_BIN_HOME is specified by the XDG Base Directory Specification:
+// https://specifications.freedesktop.org/basedir-spec/latest/
+func discoverUv(ctx context.Context) (string, error) {
+	// Prefer PATH lookup first; it respects user customisation. exec.LookPath
+	// applies PATHEXT on Windows, so "uv" resolves to uv.exe there.
+	if p, err := exec.LookPath("uv"); err == nil {
+		return p, nil
+	}
+
+	home, _ := env.UserHomeDir(ctx)
+
+	// XDG_BIN_HOME defaults to $HOME/.local/bin when unset.
+	xdgBinHome, _ := env.Lookup(ctx, "XDG_BIN_HOME")
+
+	// The installer writes uv.exe on Windows; os.Stat needs the exact name.
+	exe := "uv"
+	if runtime.GOOS == "windows" {
+		exe = "uv.exe"
+	}
+	candidates := []string{
+		filepath.Join(home, ".local", "bin", exe),
+		filepath.Join(xdgBinHome, exe),
+		"/opt/homebrew/bin/uv",
+		"/usr/local/bin/uv",
+	}
+
+	for _, c := range candidates {
+		// Skip relative paths produced when home or xdgBinHome is empty (e.g.
+		// filepath.Join("", "uv") == "uv"): os.Stat would resolve them against the
+		// CWD and could pick up a stray ./uv that is not the real binary.
+		if !filepath.IsAbs(c) {
+			continue
+		}
+		if _, err := os.Stat(c); err == nil {
+			return c, nil
+		}
+	}
+
+	return "", NewError(ErrUvMissing, nil,
+		"uv not found on PATH or in well-known locations (%s)", strings.Join(candidates, ", "))
+}
diff --git a/libs/localenv/uv_test.go b/libs/localenv/uv_test.go
new file mode 100644
index 00000000000..26f6786b421
--- /dev/null
+++ b/libs/localenv/uv_test.go
@@ -0,0 +1,533 @@
+package localenv
+
+import (
+	"context"
+	"errors"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"testing"
+
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/env"
+	"github.com/databricks/cli/libs/process"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const uvPythonInstall312Pattern = `^uv(?:\.exe)? python install 3\.12$`
+
+// writePipConf writes conf to the primary OS-specific pip config path under a
+// fresh temp home and returns a context rooted at that home. On Windows the
+// primary path is %APPDATA%\pip\pip.ini, so APPDATA is pointed inside the temp
+// home too; without this the file would land in a location pipConfPaths never
+// probes on that OS and the test would read an empty index-url.
+func writePipConf(t *testing.T, conf string) context.Context {
+	t.Helper()
+	tmp := t.TempDir()
+	ctx := env.WithUserHomeDir(t.Context(), tmp)
+	if runtime.GOOS == "windows" {
+		ctx = env.Set(ctx, "APPDATA", filepath.Join(tmp, "AppData", "Roaming"))
+	}
+	paths := pipConfPaths(ctx)
+	require.NotEmpty(t, paths)
+	primary := paths[0]
+	require.NoError(t, os.MkdirAll(filepath.Dir(primary), 0o755))
+	require.NoError(t, os.WriteFile(primary, []byte(conf), 0o644))
+	return ctx
+}
+
+// uvStubCommand returns the normalized command spelling produced by
+// processStub.Commands on the current platform.
+func uvStubCommand(args string) string {
+	bin := "uv"
+	if runtime.GOOS == "windows" {
+		bin = "uv.exe"
+	}
+	return bin + " " + args
+}
+
+func TestUvArgs(t *testing.T) {
+	m := &uvManager{bin: "uv"}
+	assert.Equal(t, []string{"sync", "--python", "3.12"}, m.syncArgs("3.12"))
+	assert.Equal(t, []string{"python", "install", "3.12"}, m.pythonInstallArgs("3.12"))
+	assert.Equal(t, []string{
+		"python", "find", "--system", "--no-python-downloads", "cpython@==3.12.*",
+	}, m.pythonFindArgs("3.12"))
+	assert.Equal(t, []string{"pip", "install", "pip", "--python", "/p/.venv/bin/python"}, m.pipSeedArgs("/p/.venv/bin/python"))
+	assert.Equal(t, []string{"workspace", "dir"}, m.workspaceDirArgs())
+}
+
+func TestWorkspaceRootRunsInProjectDirAndTrimsOutput(t *testing.T) {
+	project := filepath.Join("p", "proj")
+	ctx, stub := process.WithStub(t.Context())
+	var dir string
+	stub.WithCallback(func(cmd *exec.Cmd) error {
+		dir = cmd.Dir
+		_, err := cmd.Stdout.Write([]byte("/repo\n"))
+		return err
+	})
+	m := &uvManager{bin: "uv"}
+
+	root, err := m.WorkspaceRoot(ctx, project)
+	require.NoError(t, err)
+	assert.Equal(t, "/repo", root)
+	assert.Equal(t, project, dir)
+	assert.Equal(t, []string{uvStubCommand("workspace dir")}, stub.Commands())
+}
+
+func TestWorkspaceRootReturnsUvError(t *testing.T) {
+	ctx, stub := process.WithStub(t.Context())
+	stub.WithFailureFor(`workspace dir`, errors.New("exit status 2"))
+	m := &uvManager{bin: "uv"}
+
+	_, err := m.WorkspaceRoot(ctx, "proj")
+	assert.Error(t, err)
+}
+
+func TestEnsurePythonStopsAfterSuccessfulInstall(t *testing.T) {
+	ctx, stub := process.WithStub(t.Context())
+	stub.WithCallback(func(_ *exec.Cmd) error { return nil })
+	m := &uvManager{bin: "uv"}
+
+	selection, err := m.EnsurePython(ctx, "3.12")
+
+	require.NoError(t, err)
+	assert.Equal(t, PythonSelection{
+		Executable: "3.12",
+		Resolution: PythonResolutionUVInstallSucceeded,
+	}, selection)
+	assert.Equal(t, []string{uvStubCommand("python install 3.12")}, stub.Commands())
+}
+
+func TestEnsurePythonFallsBackToInstalledInterpreter(t *testing.T) {
+	ctx, stub := process.WithStub(t.Context())
+	stub.WithFailureFor(uvPythonInstall312Pattern, errors.New("download blocked"))
+	stub.WithStdoutFor(`python find`, "/system/python3.12\n")
+	m := &uvManager{bin: "uv"}
+
+	selection, err := m.EnsurePython(ctx, "3.12")
+
+	require.NoError(t, err)
+	assert.Equal(t, PythonSelection{
+		Executable: "/system/python3.12",
+		Resolution: PythonResolutionInstalledFallback,
+	}, selection)
+	assert.Equal(t, []string{
+		uvStubCommand("python install 3.12"),
+		uvStubCommand("python find --system --no-python-downloads cpython@==3.12.*"),
+	}, stub.Commands())
+}
+
+func TestEnsurePythonFallbackPreservesIndexURLBridge(t *testing.T) {
+	// CI sets UV_INDEX_URL. Remove it so this test exercises pip.conf bridging;
+	// t.Setenv registers cleanup that restores the original value.
+	t.Setenv("UV_INDEX_URL", "")
+	os.Unsetenv("UV_INDEX_URL")
+	ctx := writePipConf(t, "[global]\nindex-url = https://proxy.example/simple\n")
+	ctx, stub := process.WithStub(ctx)
+	stub.WithFailureFor(uvPythonInstall312Pattern, errors.New("download blocked"))
+	stub.WithStdoutFor(`python find`, "/system/python3.12\n")
+
+	selection, err := (&uvManager{bin: "uv"}).EnsurePython(ctx, "3.12")
+
+	require.NoError(t, err)
+	assert.Equal(t, "/system/python3.12", selection.Executable)
+	assert.Equal(t, "https://proxy.example/simple", stub.LookupEnv("UV_INDEX_URL"))
+}
+
+func TestEnsurePythonStopsFallbackWhenContextIsCanceled(t *testing.T) {
+	ctx, cancel := context.WithCancel(t.Context())
+	ctx, stub := process.WithStub(ctx)
+	stub.WithCallback(func(_ *exec.Cmd) error {
+		cancel()
+		return context.Canceled
+	})
+
+	_, err := (&uvManager{bin: "uv"}).EnsurePython(ctx, "3.12")
+
+	require.ErrorIs(t, err, context.Canceled)
+	assert.Equal(t, []string{uvStubCommand("python install 3.12")}, stub.Commands())
+}
+
+func TestEnsurePythonFallbackErrorSurfacesSearchStderr(t *testing.T) {
+	ctx, stub := process.WithStub(t.Context())
+	stub.WithStderrFor(uvPythonInstall312Pattern, "error: Connection refused")
+	stub.WithFailureFor(uvPythonInstall312Pattern, errors.New("exit status 1"))
+	stub.WithStderrFor(`python find`, "error: unexpected argument '--no-python-downloads'")
+	stub.WithFailureFor(`python find`, errors.New("exit status 2"))
+	m := &uvManager{bin: "uv"}
+
+	_, err := m.EnsurePython(ctx, "3.12")
+
+	require.Error(t, err)
+	var pe *PipelineError
+	require.ErrorAs(t, err, &pe)
+	// Each stderr must be attributed to its own command so the find stderr does
+	// not read as if `python install` rejected an argument it never saw. Assert on
+	// Error() — what the user sees — since PipelineError.Error() appends the wrapped
+	// cause after Msg.
+	rendered := pe.Error()
+	assert.Contains(t, rendered, "uv python install 3.12 failed: error: Connection refused")
+	assert.Contains(t, rendered, "no compatible installed Python found either: error: unexpected argument '--no-python-downloads'")
+}
+
+func TestEnsurePythonReportsCancellationDuringFallbackSearch(t *testing.T) {
+	ctx, cancel := context.WithCancel(t.Context())
+	ctx, stub := process.WithStub(ctx)
+	// Install fails normally (ctx still live), so the search runs; the search is
+	// then interrupted. The error must report the interruption, not claim that no
+	// interpreter is installed.
+	stub.WithFailureFor(uvPythonInstall312Pattern, errors.New("download blocked"))
+	stub.WithCallback(func(_ *exec.Cmd) error {
+		cancel()
+		return context.Canceled
+	})
+
+	_, err := (&uvManager{bin: "uv"}).EnsurePython(ctx, "3.12")
+
+	require.ErrorIs(t, err, context.Canceled)
+	var pe *PipelineError
+	require.ErrorAs(t, err, &pe)
+	assert.NotContains(t, pe.Msg, "no compatible installed Python found")
+	assert.Equal(t, []string{
+		uvStubCommand("python install 3.12"),
+		uvStubCommand("python find --system --no-python-downloads cpython@==3.12.*"),
+	}, stub.Commands())
+}
+
+func TestEnsurePythonFailsWhenFallbackFindsNothing(t *testing.T) {
+	ctx, stub := process.WithStub(t.Context())
+	stub.WithFailureFor(uvPythonInstall312Pattern, errors.New("download blocked"))
+	stub.WithFailureFor(`python find`, errors.New("No interpreter found"))
+	m := &uvManager{bin: "uv"}
+
+	selection, err := m.EnsurePython(ctx, "3.12")
+
+	require.Error(t, err)
+	assert.Empty(t, selection)
+	assert.Equal(t, []string{
+		uvStubCommand("python install 3.12"),
+		uvStubCommand("python find --system --no-python-downloads cpython@==3.12.*"),
+	}, stub.Commands())
+	var pe *PipelineError
+	require.ErrorAs(t, err, &pe)
+	assert.Equal(t, ErrPythonInstall, pe.Code)
+}
+
+func TestVenvPythonPath(t *testing.T) {
+	// Validate invokes this interpreter directly (not via `uv run`) so it observes
+	// exactly the .venv that was provisioned, ignoring any active VIRTUAL_ENV.
+	got := venvPython(filepath.Join("p", "proj", ".venv"))
+	var want string
+	if runtime.GOOS == "windows" {
+		want = filepath.Join("p", "proj", ".venv", "Scripts", "python.exe")
+	} else {
+		want = filepath.Join("p", "proj", ".venv", "bin", "python")
+	}
+	assert.Equal(t, want, got)
+}
+
+func TestDiscoverUvFindsBinOnPath(t *testing.T) {
+	dir := t.TempDir()
+	// exec.LookPath only resolves a bare "uv" to a file with a PATHEXT extension
+	// on Windows, so the on-PATH binary must be named uv.exe there.
+	exe := "uv"
+	if runtime.GOOS == "windows" {
+		exe = "uv.exe"
+	}
+	bin := filepath.Join(dir, exe)
+	require.NoError(t, os.WriteFile(bin, []byte("#!/bin/sh\n"), 0o755))
+	t.Setenv("PATH", dir)
+	got, err := discoverUv(t.Context())
+	require.NoError(t, err)
+	assert.Equal(t, bin, got)
+}
+
+func TestDiscoverUvFindsBinInLocalBin(t *testing.T) {
+	// The installer drops uv (uv.exe on Windows) under ~/.local/bin; discoverUv
+	// must find it there when it is not on PATH, using the OS-appropriate name.
+	home := t.TempDir()
+	binDir := filepath.Join(home, ".local", "bin")
+	require.NoError(t, os.MkdirAll(binDir, 0o755))
+	exe := "uv"
+	if runtime.GOOS == "windows" {
+		exe = "uv.exe"
+	}
+	bin := filepath.Join(binDir, exe)
+	require.NoError(t, os.WriteFile(bin, []byte("#!/bin/sh\n"), 0o755))
+
+	t.Setenv("PATH", t.TempDir()) // no uv on PATH
+	ctx := env.WithUserHomeDir(t.Context(), home)
+	ctx = env.Set(ctx, "XDG_BIN_HOME", "")
+	got, err := discoverUv(ctx)
+	require.NoError(t, err)
+	assert.Equal(t, bin, got)
+}
+
+func TestDiscoverUvSkipsRelativeCandidatesWhenHomeUnset(t *testing.T) {
+	// Regression: when HOME and XDG_BIN_HOME are unset the candidate paths
+	// collapse to relative "uv" / ".local/bin/uv". discoverUv must not os.Stat
+	// them against the CWD and return a stray ./uv as if it were the real binary.
+	dir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "uv"), []byte("#!/bin/sh\n"), 0o755))
+	t.Chdir(dir)
+	t.Setenv("PATH", t.TempDir()) // a PATH with no uv, so LookPath falls through
+
+	ctx := env.WithUserHomeDir(t.Context(), "")
+	ctx = env.Set(ctx, "XDG_BIN_HOME", "")
+	got, err := discoverUv(ctx)
+	if err == nil {
+		assert.True(t, filepath.IsAbs(got), "discoverUv must not return a relative path; got %q", got)
+	}
+}
+
+func TestPipConfIndexURLReadsOSSpecificPath(t *testing.T) {
+	// The primary pip config path for the current OS must be honored, not just
+	// the Linux/XDG ~/.config/pip/pip.conf location.
+	tmp := t.TempDir()
+	ctx := env.WithUserHomeDir(t.Context(), tmp)
+	if runtime.GOOS == "windows" {
+		ctx = env.Set(ctx, "APPDATA", filepath.Join(tmp, "AppData", "Roaming"))
+	}
+
+	paths := pipConfPaths(ctx)
+	require.NotEmpty(t, paths)
+	primary := paths[0]
+	require.NoError(t, os.MkdirAll(filepath.Dir(primary), 0o755))
+	require.NoError(t, os.WriteFile(primary, []byte("[global]\nindex-url = https://proxy.example/simple\n"), 0o644))
+
+	assert.Equal(t, "https://proxy.example/simple", pipConfIndexURL(ctx))
+}
+
+func TestRedactURLCredentials(t *testing.T) {
+	cases := []struct {
+		in   string
+		want string
+	}{
+		{"https://user:pass@proxy.example/simple", "https://proxy.example/simple"},
+		{"https://token@proxy.example/simple", "https://proxy.example/simple"},
+		{"https://proxy.example/simple", "https://proxy.example/simple"},
+		{"not a url", "not a url"},
+	}
+	for _, tc := range cases {
+		assert.Equal(t, tc.want, redactURLCredentials(tc.in))
+	}
+}
+
+func TestPipConfIndexURLReadsLegacyPath(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("legacy ~/.pip path is Unix/macOS only")
+	}
+	// The legacy ~/.pip/pip.conf location pip still reads must be honored when the
+	// newer per-user locations are absent.
+	tmp := t.TempDir()
+	legacy := filepath.Join(tmp, ".pip")
+	require.NoError(t, os.MkdirAll(legacy, 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(legacy, "pip.conf"), []byte("[global]\nindex-url = https://legacy.example/simple\n"), 0o644))
+
+	ctx := env.WithUserHomeDir(t.Context(), tmp)
+	assert.Equal(t, "https://legacy.example/simple", pipConfIndexURL(ctx))
+}
+
+func TestPipConfIndexURL(t *testing.T) {
+	t.Run("returns_url_from_pip_conf", func(t *testing.T) {
+		ctx := writePipConf(t, "[global]\nindex-url = https://proxy.example/simple\n")
+		got := pipConfIndexURL(ctx)
+		assert.Equal(t, "https://proxy.example/simple", got)
+	})
+
+	t.Run("returns_empty_when_no_pip_conf", func(t *testing.T) {
+		tmp := t.TempDir()
+		ctx := env.WithUserHomeDir(t.Context(), tmp)
+		got := pipConfIndexURL(ctx)
+		assert.Empty(t, got)
+	})
+
+	t.Run("returns_empty_when_no_index_url_in_conf", func(t *testing.T) {
+		ctx := writePipConf(t, "[global]\nextra-index-url = https://other.example/simple\n")
+		got := pipConfIndexURL(ctx)
+		assert.Empty(t, got)
+	})
+}
+
+func TestResolveIndexURLRespectsExistingEnv(t *testing.T) {
+	m := &uvManager{}
+
+	t.Run("returns_empty_when_UV_INDEX_URL_already_set", func(t *testing.T) {
+		// Set up a pip.conf that would otherwise be used.
+		ctx := writePipConf(t, "[global]\nindex-url = https://proxy.example/simple\n")
+		// When UV_INDEX_URL is in ctx, resolveIndexURL must not override it.
+		ctx = env.Set(ctx, "UV_INDEX_URL", "https://explicit.example/simple")
+
+		got := m.resolveIndexURL(ctx)
+		assert.Empty(t, got)
+	})
+
+	t.Run("returns_pip_conf_url_when_UV_INDEX_URL_unset", func(t *testing.T) {
+		// CI sets UV_INDEX_URL to a package mirror in the process environment, and
+		// env.Lookup falls back to os.LookupEnv, so it must actually be removed
+		// (setting it to "" still reports ok=true) for resolveIndexURL to fall
+		// through to pip.conf. t.Setenv registers the cleanup that restores it.
+		t.Setenv("UV_INDEX_URL", "")
+		os.Unsetenv("UV_INDEX_URL")
+
+		ctx := writePipConf(t, "[global]\nindex-url = https://proxy.example/simple\n")
+		got := m.resolveIndexURL(ctx)
+		assert.Equal(t, "https://proxy.example/simple", got)
+	})
+}
+
+func TestUvFailureIncludesStderr(t *testing.T) {
+	t.Run("includes_stderr_when_present", func(t *testing.T) {
+		underlying := &process.ProcessError{
+			Command: "uv sync",
+			Err:     errors.New("exit status 2"),
+			Stderr:  "error: Connection refused\n",
+		}
+		pe := uvFailure(ErrProvision, underlying, "uv sync")
+		assert.Equal(t, ErrProvision, pe.Code)
+		assert.Contains(t, pe.Msg, "Connection refused")
+		assert.NotEqual(t, '\n', pe.Msg[len(pe.Msg)-1], "Msg must not end with a newline")
+	})
+
+	t.Run("omits_stderr_suffix_when_empty", func(t *testing.T) {
+		underlying := &process.ProcessError{
+			Command: "uv sync",
+			Err:     errors.New("exit status 2"),
+			Stderr:  "",
+		}
+		pe := uvFailure(ErrProvision, underlying, "uv sync")
+		assert.Equal(t, ErrProvision, pe.Code)
+		assert.Equal(t, "uv sync failed", pe.Msg)
+	})
+
+	t.Run("non_process_error_uses_action_only", func(t *testing.T) {
+		pe := uvFailure(ErrProvision, errors.New("some other error"), "uv sync")
+		assert.Equal(t, ErrProvision, pe.Code)
+		assert.Equal(t, "uv sync failed", pe.Msg)
+	})
+}
+
+func TestIsUvResolutionConflict(t *testing.T) {
+	// Positive cases are uv's two resolver-failure headlines; negatives are
+	// unrelated sync failures that must stay E_PROVISION.
+	assert.True(t, isUvResolutionConflict("  × No solution found when resolving dependencies:\n  ╰─▶ Because ..."))
+	assert.True(t, isUvResolutionConflict("error: your project's requirements are unsatisfiable"))
+	assert.True(t, isUvResolutionConflict("NO SOLUTION FOUND"), "match is case-insensitive")
+	assert.False(t, isUvResolutionConflict("error: Connection refused"))
+	assert.False(t, isUvResolutionConflict("error: Failed to build `foo==1.0`"))
+	assert.False(t, isUvResolutionConflict("error: No interpreter found for Python 3.12"))
+	assert.False(t, isUvResolutionConflict(""))
+	// An offline cache miss carries the resolver banner ("... was not found in the
+	// cache ... No solution found") but is a reachability problem, not a dependency
+	// conflict; the "network was disabled" hint keeps it E_PROVISION.
+	assert.False(t, isUvResolutionConflict("× No solution found when resolving dependencies:\n  ╰─▶ Because foo was not found in the cache ...\nhint: Packages were unavailable because the network was disabled"))
+}
+
+func TestProvisionClassifiesResolutionConflict(t *testing.T) {
+	t.Run("resolver_failure_is_provision_conflict", func(t *testing.T) {
+		ctx, stub := process.WithStub(t.Context())
+		stub.WithStderrFor(`sync`, "  × No solution found when resolving dependencies:\n  ╰─▶ Because the requested pins are unsatisfiable.")
+		stub.WithFailureFor(`sync`, errors.New("exit status 1"))
+
+		err := (&uvManager{bin: "uv"}).Provision(ctx, t.TempDir(), "3.12")
+
+		var pe *PipelineError
+		require.ErrorAs(t, err, &pe)
+		assert.Equal(t, ErrProvisionConflict, pe.Code)
+		assert.Contains(t, pe.Msg, "No solution found")
+	})
+
+	t.Run("unrelated_failure_stays_provision", func(t *testing.T) {
+		ctx, stub := process.WithStub(t.Context())
+		stub.WithStderrFor(`sync`, "error: Connection refused")
+		stub.WithFailureFor(`sync`, errors.New("exit status 1"))
+
+		err := (&uvManager{bin: "uv"}).Provision(ctx, t.TempDir(), "3.12")
+
+		var pe *PipelineError
+		require.ErrorAs(t, err, &pe)
+		assert.Equal(t, ErrProvision, pe.Code)
+	})
+}
+
+func TestConfirmUvInstall(t *testing.T) {
+	t.Run("opt_in_env_var_consents_without_prompt", func(t *testing.T) {
+		// Non-interactive context, but the opt-in env var grants consent.
+		ctx := env.Set(t.Context(), EnvAutoInstallUv, "1")
+		assert.True(t, confirmUvInstall(ctx))
+	})
+
+	t.Run("non_interactive_without_opt_in_declines", func(t *testing.T) {
+		// SetupTest defaults to PromptSupported=false, i.e. non-interactive.
+		ctx, _ := cmdio.SetupTest(t.Context(), cmdio.TestOptions{})
+		assert.False(t, confirmUvInstall(ctx))
+	})
+
+	t.Run("missing_cmdio_declines_without_panic", func(t *testing.T) {
+		// A context with no cmdio (library entry point) must not panic in
+		// IsPromptSupported; it declines like any other non-interactive run.
+		assert.NotPanics(t, func() {
+			assert.False(t, confirmUvInstall(t.Context()))
+		})
+	})
+
+	t.Run("falsey_opt_in_does_not_consent_when_non_interactive", func(t *testing.T) {
+		ctx, _ := cmdio.SetupTest(t.Context(), cmdio.TestOptions{})
+		ctx = env.Set(ctx, EnvAutoInstallUv, "0")
+		assert.False(t, confirmUvInstall(ctx))
+	})
+}
+
+func TestLineWithPrefix(t *testing.T) {
+	// A stray leading line (as uv might emit) must not shift the parse: the
+	// value is located by prefix, not position.
+	out := "warning: something\nPYVER:3.12\nDBCVER:17.2.0\n"
+
+	pyVer, ok := lineWithPrefix(out, validatePyPrefix)
+	assert.True(t, ok)
+	assert.Equal(t, "3.12", pyVer)
+
+	dbcVer, ok := lineWithPrefix(out, validateDBCPrefix)
+	assert.True(t, ok)
+	assert.Equal(t, "17.2.0", dbcVer)
+
+	// An empty DBC value (databricks-connect absent) is found but blank.
+	empty, ok := lineWithPrefix("PYVER:3.12\nDBCVER:\n", validateDBCPrefix)
+	assert.True(t, ok)
+	assert.Empty(t, empty)
+
+	// A missing prefix reports not-found rather than a wrong line.
+	_, ok = lineWithPrefix("PYVER:3.12\n", validateDBCPrefix)
+	assert.False(t, ok)
+}
+
+func TestPostProvisionAndValidateRunInProjectDir(t *testing.T) {
+	// The venv can live outside the project (a uv workspace root), but uv and the
+	// probe interpreter still run in the project folder: uv reads its settings
+	// from there, and `python -c` puts the working folder first on sys.path.
+	project := filepath.Join("p", "proj")
+	venv := filepath.Join("p", ".venv")
+	ctx, stub := process.WithStub(t.Context())
+	var dirs []string
+	var args [][]string
+	stub.WithCallback(func(cmd *exec.Cmd) error {
+		dirs = append(dirs, cmd.Dir)
+		args = append(args, cmd.Args)
+		// The validate probe parses its prefixed lines from stdout.
+		_, err := cmd.Stdout.Write([]byte("PYVER:3.12\nDBCVER:\nPYSPARKVER:\nDBCIMPORT:\n"))
+		return err
+	})
+	m := &uvManager{bin: "uv"}
+
+	require.NoError(t, m.PostProvision(ctx, project, venv))
+	_, err := m.Validate(ctx, project, venv)
+	require.NoError(t, err)
+	assert.Equal(t, []string{project, project}, dirs)
+	// Both commands use the interpreter of the venv folder, not of the project.
+	require.Len(t, args, 2)
+	assert.Contains(t, args[0], venvPython(venv), "pip seed")
+	assert.Equal(t, venvPython(venv), args[1][0], "validate probe")
+}
diff --git a/libs/localenv/warnings.go b/libs/localenv/warnings.go
new file mode 100644
index 00000000000..b94ee3f2be1
--- /dev/null
+++ b/libs/localenv/warnings.go
@@ -0,0 +1,652 @@
+package localenv
+
+import (
+	"fmt"
+	"maps"
+	"regexp"
+	"slices"
+	"strconv"
+	"strings"
+
+	"github.com/BurntSushi/toml"
+)
+
+// depSpecRe splits a dependency string into its package name and the remainder
+// (e.g. "pyarrow~=19.0" -> "pyarrow", "~=19.0"). It stops the name at the first
+// PEP 508 separator; splitDepSpec handles the extras and markers that may lead the
+// remainder.
+var depSpecRe = regexp.MustCompile(`^([A-Za-z0-9._-]+)\s*(.*)$`)
+
+// singleClauseRe parses one version clause: an operator and a dotted numeric
+// release. A trailing "==X.Y.*" prefix wildcard is modeled by parseClause; pre/post/dev
+// suffixes are not — a clause we cannot parse this simply is treated as "unknown" and
+// never yields a conflict.
+var singleClauseRe = regexp.MustCompile(`^(>=|<=|==|~=|!=|<|>)?\s*([0-9]+(?:\.[0-9]+)*)`)
+
+// splitDepSpec returns the normalized package name and the version specifier
+// portion of a dependency string, with any extras stripped. ok is false when there
+// is no recognizable name, or when what follows the name carries an environment
+// marker (see below).
+func splitDepSpec(dep string) (name, spec string, ok bool) {
+	m := depSpecRe.FindStringSubmatch(strings.TrimSpace(dep))
+	if m == nil {
+		return "", "", false
+	}
+	// Extras select optional features and never narrow the version range, so drop
+	// them to expose the specifier underneath ("pkg[a,b]==1.0" -> "==1.0").
+	spec = strings.TrimSpace(m[2])
+	if strings.HasPrefix(spec, "[") {
+		if i := strings.Index(spec, "]"); i >= 0 {
+			spec = strings.TrimSpace(spec[i+1:])
+		}
+	}
+	// A marker gates the whole requirement on the resolving interpreter, which we do
+	// not evaluate, so a pin that may not apply must not be compared. Checking the
+	// remainder rather than the raw string scopes this to where a marker can actually
+	// appear, leaving an extras list that happens to contain ";" alone. A ";" inside
+	// a url requirement still lands here, which costs nothing: a url has no
+	// comparable version range and would be undecidable regardless.
+	if strings.Contains(spec, ";") {
+		return "", "", false
+	}
+	return normalizePackageName(m[1]), spec, true
+}
+
+// userPyprojectTOML is a permissive view of the fields detectMergeWarnings reads
+// from the *user's* pyproject.toml.
+//
+// It deliberately does not reuse pyprojectTOML: that struct decodes the
+// Databricks-owned constraint artifact, whose shape we control, whereas a user's
+// file may legitimately carry shapes a stricter struct rejects — a PEP 735 table
+// entry such as {include-group = "test"} beside requirement strings, a PEP 621
+// dependency table, or a group declared as a sub-table ([dependency-groups.docs],
+// the PDM/mkdocs style). BurntSushi reports a type mismatch on any single key as a
+// whole-document error, so one such shape anywhere would drop every warning,
+// including the ones that do not read the offending key. The container fields are
+// therefore typed as []any / map[string]any and narrowed at the point of use.
+// requires-python stays a string because PEP 621 specifies it as one; a non-string
+// there is malformed and uv rejects the file outright.
+type userPyprojectTOML struct {
+	Project struct {
+		RequiresPython string `toml:"requires-python"`
+		Dependencies   []any  `toml:"dependencies"`
+		// uv resolves extras alongside the base dependencies, so a pin here is
+		// subject to constraint-dependencies exactly like a [project] one.
+		OptionalDependencies map[string]any `toml:"optional-dependencies"`
+	} `toml:"project"`
+	// Every group is decoded, not just dev: uv locks all declared groups, so a pin in
+	// any of them is subject to constraint-dependencies (see resolutionRequirements).
+	DependencyGroups map[string]any `toml:"dependency-groups"`
+	// Tool.Databricks.Environment.EnvironmentVersion is the serverless version the
+	// merge manages; it is read here only to warn when it is left stale on a cluster
+	// target. A non-string value here is malformed and, like any decode error, yields
+	// no warnings rather than a crash.
+	Tool struct {
+		Databricks struct {
+			Environment struct {
+				EnvironmentVersion string `toml:"environment_version"`
+			} `toml:"environment"`
+		} `toml:"databricks"`
+	} `toml:"tool"`
+}
+
+// devGroup is the dependency group whose databricks-connect pin the merge manages.
+const devGroup = "dev"
+
+// stringEntries returns the requirement strings in a decoded dependency array,
+// skipping entries of any other shape (a PEP 735 include-group table, a PEP 621
+// dependency table). A value that is not an array at all yields nothing.
+func stringEntries(v any) []string {
+	entries, ok := v.([]any)
+	if !ok {
+		return nil
+	}
+	var out []string
+	for _, e := range entries {
+		if s, ok := e.(string); ok {
+			out = append(out, s)
+		}
+	}
+	return out
+}
+
+// retainedRequirements returns every requirement uv resolves that the merge leaves
+// in place: all of resolutionRequirements minus the single entry the merge rewrites,
+// identified by replacedPin.
+//
+// Deriving it by subtraction rather than by re-deciding which groups and spellings
+// the merge edits keeps the two from disagreeing: whatever the merge does not report
+// as replaced is, by definition, still in the file next to the managed pin. Only the
+// first occurrence is dropped, because the merge rewrites only the first element —
+// a second identical pin genuinely survives.
+func retainedRequirements(p userPyprojectTOML, replacedPin string) []string {
+	all := resolutionRequirements(p)
+	if replacedPin == "" {
+		return all
+	}
+	out := make([]string, 0, len(all))
+	dropped := false
+	for _, r := range all {
+		if !dropped && strings.TrimSpace(r) == strings.TrimSpace(replacedPin) {
+			dropped = true
+			continue
+		}
+		out = append(out, r)
+	}
+	return out
+}
+
+// resolutionRequirements returns every requirement string uv considers when it locks
+// the project, in a deterministic order: [project].dependencies, then each extra in
+// [project.optional-dependencies], then each dependency group — all of them, not
+// just dev.
+//
+// Scanning every group is what makes the conflict warning match uv's behaviour:
+// constraint-dependencies applies to the whole resolution, so a pin in any declared
+// group fails `uv sync` with "requirements are unsatisfiable" just as a [project]
+// one does. Restricting the scan to dev would stay silent on exactly that failure.
+// Every group is visited on its own, so a PEP 735 {include-group = "..."} reference
+// needs no traversal: the group it names is enumerated here regardless, and an
+// include-group cycle cannot cause recursion.
+func resolutionRequirements(p userPyprojectTOML) []string {
+	out := stringEntries(p.Project.Dependencies)
+	for _, extra := range slices.Sorted(maps.Keys(p.Project.OptionalDependencies)) {
+		out = append(out, stringEntries(p.Project.OptionalDependencies[extra])...)
+	}
+	for _, g := range slices.Sorted(maps.Keys(p.DependencyGroups)) {
+		out = append(out, stringEntries(p.DependencyGroups[g])...)
+	}
+	return out
+}
+
+// detectMergeWarnings compares a user's existing pyproject.toml against the
+// fetched env constraints and returns the categorical warnings the merge phase
+// surfaces (spec §6 warnings[]). It is a read-only comparison run alongside the
+// merge; MergeManaged still owns the actual byte edits.
+//
+// It is best-effort: unparseable input yields no warnings rather than an error,
+// because a warning is advisory and must never fail the run. The user's file is
+// decoded through userPyprojectTOML rather than the artifact's stricter
+// pyprojectTOML, so no shape a real pyproject.toml may legitimately carry can
+// suppress the checks that do not depend on it. Greenfield projects (no pre-existing
+// content) produce nothing — there is nothing of the user's to override. Warnings are
+// deterministic and ordered (requires-python, then databricks-connect, then the
+// standalone-pyspark collision, then constraint conflicts in the order uv would
+// encounter them) so goldens are stable.
+// opts suppresses the warnings for whichever axes are left unmanaged: a skipped
+// axis is not written, so there is nothing on it to warn about.
+func detectMergeWarnings(userPyproject []byte, c Constraints, plan dbconnectPlan, opts MergeOptions) []Warning {
+	if len(userPyproject) == 0 {
+		return nil
+	}
+	// A decode error is not fatal: userPyprojectTOML types its containers loosely so
+	// the shapes a user's file legitimately carries all decode, leaving genuine syntax
+	// errors as the only failure — and those yield no fields to compare anyway.
+	var p userPyprojectTOML
+	if err := toml.Unmarshal(userPyproject, &p); err != nil {
+		return nil
+	}
+
+	var warnings []Warning
+
+	// The user pinned a requires-python that differs from the env's pin; the merge
+	// replaces it with the managed value. Skipped under --no-constraints, where the
+	// merge leaves the user's requires-python untouched.
+	if up := strings.TrimSpace(p.Project.RequiresPython); !opts.SkipConstraints && up != "" && c.RequiresPython != "" && up != strings.TrimSpace(c.RequiresPython) {
+		warnings = append(warnings, Warning{
+			Code:    WarnRequiresPythonOverridden,
+			Message: fmt.Sprintf("requires-python %q is replaced by the environment's %q", up, c.RequiresPython),
+		})
+	}
+
+	// The requirements uv still resolves after the merge: everything minus the dev pin
+	// the merge rewrites (replacedDevPin) and the strays the consolidation pass removes.
+	// A conflict against an entry the merge discards describes a state that does not
+	// survive it, so excluding both keeps the conflict scan honest.
+	survivors := removeDBConnectPins(retainedRequirements(p, plan.replacedDevPin), plan.removed)
+
+	// The user's databricks-connect pins differ from the env's. Only meaningful when
+	// databricks-connect is managed: skipped under --no-dbconnect / --constraints-only,
+	// and a no-op when the artifact carries no pin.
+	managesDBConnect := !opts.SkipDBConnect && c.DatabricksConnect != ""
+	if managesDBConnect {
+		warnings = append(warnings, dbconnectWarnings(plan, survivors, c.DatabricksConnect)...)
+	}
+
+	// A standalone pyspark collides with databricks-connect's vendored pyspark whenever
+	// databricks-connect ends up in the environment — whether the env manages it (a pin
+	// is managed) or the user's own pyproject pins it (kept as-is when databricks-connect
+	// is skipped). Gate on its presence by either route, not on the mode, so this agrees
+	// with the validate hard-fail, which keys on the installed venv rather than the mode.
+	if managesDBConnect || len(dbconnectPins(survivors)) > 0 {
+		warnings = append(warnings, standalonePysparkWarnings(survivors)...)
+	}
+
+	// Skipped under --no-constraints: no constraint block is written, so the user's
+	// requirements cannot conflict with a managed one.
+	if !opts.SkipConstraints {
+		warnings = append(warnings, constraintConflicts(survivors, c.ConstraintDeps)...)
+	}
+
+	// A cluster target leaves c.EnvironmentVersion empty and does not manage the
+	// serverless environment section, so an environment_version left over from an
+	// earlier serverless run is neither refreshed nor removed. Warn that it is now
+	// stale rather than let it silently misdescribe the target to a downstream reader.
+	if c.EnvironmentVersion == "" {
+		if ev := strings.TrimSpace(p.Tool.Databricks.Environment.EnvironmentVersion); ev != "" {
+			warnings = append(warnings, Warning{
+				Code:    WarnStaleEnvironmentVersion,
+				Message: fmt.Sprintf("[tool.databricks.environment] environment_version %q is left from a serverless target but the current target is a cluster; it is not updated", ev),
+			})
+		}
+	}
+	return warnings
+}
+
+// removeDBConnectPins drops from reqs the requirements the consolidation pass deletes,
+// one occurrence per removed pin (mirroring retainedRequirements' subtraction of the
+// rewritten dev pin). The strays are removed by MergeManaged, so a warning about them
+// as if they survived would describe a state the merge does not produce.
+func removeDBConnectPins(reqs []string, removed []removedDBConnect) []string {
+	if len(removed) == 0 {
+		return reqs
+	}
+	counts := make(map[string]int, len(removed))
+	for _, r := range removed {
+		counts[strings.TrimSpace(r.pin)]++
+	}
+	out := make([]string, 0, len(reqs))
+	for _, r := range reqs {
+		t := strings.TrimSpace(r)
+		if counts[t] > 0 {
+			counts[t]--
+			continue
+		}
+		out = append(out, r)
+	}
+	return out
+}
+
+// dbconnectWarnings reports how the merge treats the user's databricks-connect pins,
+// distinguishing three outcomes that need different user actions. What the merge does
+// is not re-derived here — it comes from plan (see planDBConnect):
+//
+//   - replacedDevPin: the pin sitting directly in the dev group, rewritten in place to
+//     the env's version (WarnDBConnectPinOverridden).
+//   - removed: strays the consolidation pass deletes from [project].dependencies, an
+//     optional-dependency extra, or another group because their range is disjoint from
+//     the env pin — they would otherwise make uv unsatisfiable (WarnDBConnectConsolidated).
+//   - a databricks-connect pin the line-based merge cannot delete but uv still resolves
+//     — a spelling the passes do not reach (single-quoted element, quoted TOML key,
+//     inline-table or dotted sub-table form) — left beside the managed pin. Where its
+//     range is disjoint from the env's, uv cannot resolve at all
+//     (WarnDBConnectPinDuplicated), a distinct failure the user must fix by hand.
+//
+// The conditions are reported independently rather than as a first-match choice,
+// because a run can override the dev pin, consolidate strays, and still leave an
+// unresolvable survivor all at once.
+func dbconnectWarnings(plan dbconnectPlan, survivors []string, envPin string) []Warning {
+	var warnings []Warning
+
+	envPin = strings.TrimSpace(envPin)
+	if plan.replacedDevPin != "" && strings.TrimSpace(plan.replacedDevPin) != envPin {
+		warnings = append(warnings, Warning{
+			Code:    WarnDBConnectPinOverridden,
+			Message: fmt.Sprintf("databricks-connect %q is replaced by the environment's %q", strings.TrimSpace(plan.replacedDevPin), envPin),
+		})
+	}
+
+	// Every removed pin is disjoint from envPin (removeStrayDatabricksConnect only deletes
+	// those), so each is a real conflict the user should see — there is no equal-pin case
+	// to skip here.
+	for _, r := range plan.removed {
+		warnings = append(warnings, Warning{
+			Code: WarnDBConnectConsolidated,
+			Message: fmt.Sprintf("databricks-connect %q in %s conflicts with the environment's %q and is removed; it is managed in %q",
+				strings.TrimSpace(r.pin), r.location, envPin, devGroup),
+		})
+	}
+
+	_, envSpec, envOK := splitDepSpec(envPin)
+	for _, pin := range dbconnectPins(survivors) {
+		if pin == envPin {
+			// An identical pin needs no reconciliation: uv sees one requirement twice.
+			continue
+		}
+		// Two pins are only a problem when nothing satisfies both. ">=16" beside
+		// "~=17.2.0" resolves at 17.2.x, so there is nothing for the user to do, and
+		// claiming otherwise would send them after a non-existent conflict.
+		_, pinSpec, pinOK := splitDepSpec(pin)
+		if !envOK || !pinOK || !rangesDisjoint(pinSpec, envSpec) {
+			continue
+		}
+		warnings = append(warnings, Warning{
+			Code: WarnDBConnectPinDuplicated,
+			Message: fmt.Sprintf("databricks-connect %q is not rewritten by the merge; the environment's %q sits in %q alongside it, and no version satisfies both",
+				pin, envPin, devGroup),
+		})
+	}
+	return warnings
+}
+
+// dbconnectPins returns the trimmed databricks-connect requirements among entries,
+// in order.
+func dbconnectPins(entries []string) []string {
+	var out []string
+	for _, e := range entries {
+		if isDatabricksConnectDep(e) {
+			out = append(out, strings.TrimSpace(e))
+		}
+	}
+	return out
+}
+
+// standalonePysparkWarnings flags a standalone pyspark requirement among reqs. It is a
+// coexistence conflict, not a version one: databricks-connect vendors its own pyspark,
+// so any separately declared pyspark overwrites it in a shared environment regardless
+// of the version pinned. It is therefore reported without inspecting the specifier, and
+// once however many groups declare it — one collision to fix, and repeating it would
+// inflate the code histogram consumers build from warnings[]. The caller gates this on
+// databricks-connect being present in the resolved environment (by either route).
+func standalonePysparkWarnings(reqs []string) []Warning {
+	for _, r := range reqs {
+		if isPysparkDep(r) {
+			return []Warning{{
+				Code: WarnStandalonePysparkConflict,
+				Message: fmt.Sprintf("dependency %q collides with the pyspark bundled in databricks-connect; the two cannot share one environment — remove it, or install it in a separate environment for local Spark",
+					strings.TrimSpace(r)),
+			}}
+		}
+	}
+	return nil
+}
+
+// constraintConflicts flags each user dependency pin that the env's
+// constraint-dependencies also constrains to a provably non-overlapping version.
+// It is deliberately conservative — it only fires when the two ranges are provably
+// disjoint (see rangesDisjoint); an ambiguous pair yields nothing, so a false
+// "conflict" is never reported. Warnings come out in userDeps order, and one
+// requirement reported once however many places declare it: the same pin listed in
+// [project].dependencies and in a group is a single conflict to fix, and repeating it
+// would inflate the code histogram consumers build from warnings[].
+func constraintConflicts(userDeps, envConstraints []string) []Warning {
+	if len(userDeps) == 0 || len(envConstraints) == 0 {
+		return nil
+	}
+	// Index the env constraints by normalized package name. Multiple entries for one
+	// package compose as a conjunction, so they are joined with "," rather than
+	// letting the last one win, which would decide against an arbitrary subset of the
+	// clauses depending on artifact ordering. specInterval intersects the clauses, so
+	// the joined form is evaluated as the conjunction it is.
+	envByName := make(map[string]string, len(envConstraints))
+	for _, ec := range envConstraints {
+		name, spec, ok := splitDepSpec(ec)
+		if !ok || spec == "" {
+			continue
+		}
+		if prev, dup := envByName[name]; dup {
+			spec = prev + "," + spec
+		}
+		envByName[name] = spec
+	}
+	if len(envByName) == 0 {
+		return nil
+	}
+
+	var warnings []Warning
+	reported := make(map[string]bool)
+	for _, ud := range userDeps {
+		name, userSpec, ok := splitDepSpec(ud)
+		if !ok || userSpec == "" {
+			continue
+		}
+		envSpec, ok := envByName[name]
+		if !ok {
+			continue
+		}
+		if !rangesDisjoint(userSpec, envSpec) {
+			continue
+		}
+		// Keyed on the normalized name and the spec, so two spellings of one pin
+		// ("pyarrow==21" and "PyArrow ==21") collapse, while genuinely different
+		// conflicting pins for one package are each reported.
+		key := name + userSpec
+		if reported[key] {
+			continue
+		}
+		reported[key] = true
+		warnings = append(warnings, Warning{
+			Code:    WarnUserConstraintConflict,
+			Message: fmt.Sprintf("dependency %q conflicts with the environment constraint %q", strings.TrimSpace(ud), name+envSpec),
+		})
+	}
+	return warnings
+}
+
+// clause is a parsed single version clause: an operator and a numeric release.
+// wildcard marks a "==X.Y.*" prefix match, whose range is the segment held fixed
+// (see clause.interval).
+type clause struct {
+	op       string
+	rel      []int
+	wildcard bool
+}
+
+// parseClause parses one "<op><release>" clause. ok is false when the clause cannot
+// be parsed simply, which is treated as "unknown range" and never yields a conflict.
+func parseClause(spec string) (clause, bool) {
+	spec = strings.TrimSpace(spec)
+	if spec == "" {
+		return clause{}, false
+	}
+	m := singleClauseRe.FindStringSubmatch(spec)
+	if m == nil {
+		return clause{}, false
+	}
+	op := m[1]
+	if op == "" {
+		op = "==" // a bare version in dependencies means an exact pin
+	}
+	// A trailing ".*" is a PEP 440 prefix-match wildcard. It is only defined for "=="
+	// (and "!="); "==15.1.*" pins the 15.1 series. For any other operator ".*" is
+	// malformed, and "!=X.*" excludes a whole series — a non-contiguous set the
+	// interval model cannot represent — so both stay unknown. Any other trailing text
+	// (pre/post/dev tags) is out of scope and also refused, to avoid a false conflict.
+	wildcard := false
+	switch rest := strings.TrimSpace(spec[len(m[0]):]); {
+	case rest == "":
+	case rest == ".*" && op == "==":
+		wildcard = true
+	default:
+		return clause{}, false
+	}
+	var rel []int
+	for part := range strings.SplitSeq(m[2], ".") {
+		n, err := strconv.Atoi(part)
+		if err != nil {
+			return clause{}, false
+		}
+		rel = append(rel, n)
+	}
+	// PEP 440 requires at least two release segments after "~=" (it expands to
+	// ">=X.Y, ==X.*", which needs a segment to hold fixed). A single-segment base has
+	// no defined range, and clause.interval would index rel[:len(rel)-1] to build the
+	// ceiling — yielding an empty prefix and a nonsense bound. Refuse to parse it so
+	// it stays an unknown range rather than a wrong one.
+	if op == "~=" && len(rel) < 2 {
+		return clause{}, false
+	}
+	return clause{op: op, rel: rel, wildcard: wildcard}, true
+}
+
+// rangesDisjoint reports whether two version specifiers provably share no
+// satisfying version. It is intentionally partial: any pair it cannot decide — a
+// "!=", an unparseable release — returns false, so an uncertain case is never
+// reported as a conflict. uv remains the real resolver; this only surfaces the
+// provable clashes as an advisory.
+func rangesDisjoint(userSpec, envSpec string) bool {
+	a, aok := specInterval(userSpec)
+	b, bok := specInterval(envSpec)
+	if !aok || !bok {
+		return false
+	}
+	return !a.overlaps(b)
+}
+
+// specInterval reduces a whole PEP 440 specifier to the single release range it
+// admits. A comma-separated specifier is a conjunction, so the clauses are
+// intersected: ">=21,<22" is [21, 22). Compound ranges are the ordinary way to pin a
+// dependency, and treating the comma as undecidable would miss the conflicts they
+// cause — including the ones this detector creates for itself when it conjoins
+// duplicate constraint entries for one package.
+//
+// ok is false when any clause is undecidable, which keeps the whole specifier
+// undecidable rather than letting a partial reading of it decide a conflict.
+func specInterval(spec string) (interval, bool) {
+	if strings.TrimSpace(spec) == "" {
+		return interval{}, false
+	}
+	out := interval{}
+	for clauseSpec := range strings.SplitSeq(spec, ",") {
+		c, ok := parseClause(clauseSpec)
+		if !ok {
+			return interval{}, false
+		}
+		i, ok := c.interval()
+		if !ok {
+			return interval{}, false
+		}
+		out = out.intersect(i)
+	}
+	return out, true
+}
+
+// interval is the contiguous release range a clause admits, with each endpoint
+// marked inclusive or exclusive. A nil endpoint is unbounded in that direction.
+//
+// Modeling each clause as an interval decides every pair of the operators we parse
+// — including the opposite-direction bounds (">=20" vs "<19") and "~=" vs "~="
+// pairs the published constraint artifacts actually use — with one endpoint
+// comparison instead of a per-operator-pair table.
+//
+// Inclusivity is tracked explicitly rather than normalizing to a half-open range,
+// because releases have no well-defined successor: appending a component to make
+// ">3.12" into ">=3.12.1" would wrongly exclude 3.12.0.5, which does satisfy
+// ">3.12" (compareRelease zero-pads, so 3.12.0.5 > 3.12). Excluding a real member
+// shrinks the interval and would report an overlapping pair as disjoint.
+type interval struct {
+	lo     []int
+	loIncl bool
+	hi     []int
+	hiIncl bool
+}
+
+// interval converts a clause to its release range. ok is false for an operator
+// whose satisfying set is not contiguous ("!=", the complement of a point), since
+// disjointness cannot then be decided by comparing endpoints.
+func (c clause) interval() (interval, bool) {
+	switch c.op {
+	case "==":
+		if c.wildcard {
+			// "==X.Y.*" admits the whole X.Y series: floor X.Y inclusive, exclusive
+			// ceiling incrementing the last held segment ("==15.1.*" -> [15.1, 15.2)).
+			ceil := slices.Clone(c.rel)
+			ceil[len(ceil)-1]++
+			return interval{lo: c.rel, loIncl: true, hi: ceil}, true
+		}
+		// A single point. compareRelease zero-pads, so this also covers the spellings
+		// that denote the same release (3.12 and 3.12.0).
+		return interval{lo: c.rel, loIncl: true, hi: c.rel, hiIncl: true}, true
+	case ">=":
+		return interval{lo: c.rel, loIncl: true}, true
+	case ">":
+		return interval{lo: c.rel}, true
+	case "<=":
+		return interval{hi: c.rel, hiIncl: true}, true
+	case "<":
+		return interval{hi: c.rel}, true
+	case "~=":
+		// PEP 440: ~=X.Y expands to ">=X.Y, ==X.*" — the floor is the base, and the
+		// exclusive ceiling increments the second-to-last segment. parseClause
+		// guarantees at least two segments here.
+		ceil := make([]int, len(c.rel)-1)
+		copy(ceil, c.rel[:len(c.rel)-1])
+		ceil[len(ceil)-1]++
+		return interval{lo: c.rel, loIncl: true, hi: ceil}, true
+	}
+	return interval{}, false
+}
+
+// overlaps reports whether two intervals share any release. They intersect iff
+// each one starts at or before the other ends; an endpoint touching at equal
+// versions counts only when both sides include it.
+func (a interval) overlaps(b interval) bool {
+	return startsBeforeEnd(a.lo, a.loIncl, b.hi, b.hiIncl) &&
+		startsBeforeEnd(b.lo, b.loIncl, a.hi, a.hiIncl)
+}
+
+// intersect returns the range satisfying both a and b: the higher floor and the
+// lower ceiling, keeping an endpoint inclusive only where both sides do. The zero
+// interval is unbounded in both directions and so acts as the identity, which lets a
+// conjunction be folded over its clauses.
+//
+// An empty result (a floor above the ceiling) is not normalized to any canonical
+// form: overlaps compares endpoints, so an empty interval is already disjoint from
+// every interval including itself, which is the correct reading of a specifier no
+// version satisfies (">=22,<21").
+func (a interval) intersect(b interval) interval {
+	out := a
+	if a.lo == nil || (b.lo != nil && !startsBeforeEnd(b.lo, true, a.lo, true)) {
+		// b's floor is strictly higher, so it wins outright.
+		out.lo, out.loIncl = b.lo, b.loIncl
+	} else if b.lo != nil && compareRelease(a.lo, b.lo) == 0 {
+		// Equal floors: the stricter exclusivity applies.
+		out.loIncl = a.loIncl && b.loIncl
+	}
+	if a.hi == nil || (b.hi != nil && !startsBeforeEnd(a.hi, true, b.hi, true)) {
+		out.hi, out.hiIncl = b.hi, b.hiIncl
+	} else if b.hi != nil && compareRelease(a.hi, b.hi) == 0 {
+		out.hiIncl = a.hiIncl && b.hiIncl
+	}
+	return out
+}
+
+// startsBeforeEnd reports whether a range starting at lo does not begin after a
+// range ending at hi. A nil endpoint is unbounded, so the condition holds.
+func startsBeforeEnd(lo []int, loIncl bool, hi []int, hiIncl bool) bool {
+	if lo == nil || hi == nil {
+		return true
+	}
+	switch cmp := compareRelease(lo, hi); {
+	case cmp < 0:
+		return true
+	case cmp > 0:
+		return false
+	default:
+		// Equal endpoints meet at exactly one version, which belongs to both ranges
+		// only if neither excludes it.
+		return loIncl && hiIncl
+	}
+}
+
+// compareRelease compares two dotted numeric releases component-wise, treating a
+// missing trailing component as 0 (so 3.12 == 3.12.0). Returns -1, 0, or 1.
+func compareRelease(a, b []int) int {
+	n := max(len(a), len(b))
+	for i := range n {
+		var ai, bi int
+		if i < len(a) {
+			ai = a[i]
+		}
+		if i < len(b) {
+			bi = b[i]
+		}
+		if ai != bi {
+			if ai < bi {
+				return -1
+			}
+			return 1
+		}
+	}
+	return 0
+}
diff --git a/libs/localenv/warnings_test.go b/libs/localenv/warnings_test.go
new file mode 100644
index 00000000000..01bd35ac00b
--- /dev/null
+++ b/libs/localenv/warnings_test.go
@@ -0,0 +1,824 @@
+package localenv
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// detectWarnings runs the detector the way mergePlan does, taking the databricks-connect
+// plan from the merge itself rather than hand-supplied values. Tests must not assert
+// against a different notion of what the merge rewrites or removes than production uses —
+// that divergence is the bug this wiring exists to prevent.
+func detectWarnings(userPyproject []byte, c Constraints) []Warning {
+	return detectMergeWarnings(userPyproject, c, planDBConnect(userPyproject, c, MergeOptions{}), MergeOptions{})
+}
+
+// codes extracts the warning codes in order for concise assertions.
+func codes(ws []Warning) []string {
+	out := make([]string, 0, len(ws))
+	for _, w := range ws {
+		out = append(out, w.Code)
+	}
+	return out
+}
+
+func TestDetectMergeWarningsGreenfieldAndEmpty(t *testing.T) {
+	c := Constraints{RequiresPython: "==3.12.*", DatabricksConnect: "databricks-connect~=18.0.0"}
+	// No pre-existing file: nothing of the user's to override.
+	assert.Nil(t, detectWarnings(nil, c))
+	assert.Nil(t, detectWarnings([]byte{}, c))
+	// Unparseable TOML is best-effort: no warnings, no panic.
+	assert.Nil(t, detectWarnings([]byte("this is : not valid toml ["), c))
+}
+
+func TestDetectMergeWarningsOverriddenPins(t *testing.T) {
+	user := []byte(`[project]
+name = "demo"
+requires-python = ">=3.10"
+
+[dependency-groups]
+dev = ["databricks-connect~=16.1.0"]
+`)
+	c := Constraints{RequiresPython: "==3.12.*", DatabricksConnect: "databricks-connect~=18.0.0"}
+	got := detectWarnings(user, c)
+	assert.Equal(t, []string{WarnRequiresPythonOverridden, WarnDBConnectPinOverridden}, codes(got))
+}
+
+func TestDetectMergeWarningsSkipConstraintsSuppressesConstraintWarnings(t *testing.T) {
+	// Under --no-constraints the merge leaves requires-python and the constraint
+	// block unmanaged, so neither the requires-python-overridden warning nor a
+	// constraint conflict is reported — but the orthogonal databricks-connect
+	// override warning still is.
+	user := []byte(`[project]
+name = "demo"
+requires-python = ">=3.10"
+
+[dependency-groups]
+dev = ["databricks-connect~=16.1.0", "pydantic~=1.0"]
+`)
+	c := Constraints{
+		RequiresPython:    "==3.12.*",
+		DatabricksConnect: "databricks-connect~=18.0.0",
+		ConstraintDeps:    []string{"pydantic~=2.10.6"},
+	}
+	got := detectMergeWarnings(user, c, planDBConnect(user, c, MergeOptions{}), MergeOptions{SkipConstraints: true})
+	assert.Equal(t, []string{WarnDBConnectPinOverridden}, codes(got))
+}
+
+func TestDetectMergeWarningsSkipDBConnectSuppressesDBConnectWarning(t *testing.T) {
+	// Under --no-dbconnect the merge leaves the databricks-connect pin unmanaged, so
+	// no databricks-connect override warning is reported — but the orthogonal
+	// requires-python override still is.
+	user := []byte(`[project]
+name = "demo"
+requires-python = ">=3.10"
+
+[dependency-groups]
+dev = ["databricks-connect~=16.1.0"]
+`)
+	c := Constraints{
+		RequiresPython:    "==3.12.*",
+		DatabricksConnect: "databricks-connect~=18.0.0",
+	}
+	got := detectMergeWarnings(user, c, planDBConnect(user, c, MergeOptions{SkipDBConnect: true}), MergeOptions{SkipDBConnect: true})
+	assert.Equal(t, []string{WarnRequiresPythonOverridden}, codes(got))
+}
+
+func TestDetectMergeWarningsWithMultilineString(t *testing.T) {
+	user := []byte(`[project]
+requires-python = ">=3.10"
+description = """
+[dependency-groups]
+dev = ["databricks-connect==1.0.0"]
+"""
+
+[dependency-groups]
+dev = ["databricks-connect~=16.1.0"]
+`)
+	c := Constraints{RequiresPython: "==3.12.*", DatabricksConnect: "databricks-connect~=18.0.0"}
+	got := detectWarnings(user, c)
+	assert.Equal(t, []string{WarnRequiresPythonOverridden, WarnDBConnectPinOverridden}, codes(got))
+}
+
+func TestDetectMergeWarningsNoOverrideWhenMatching(t *testing.T) {
+	// User already matches the env pins exactly — the merge is a no-op, so no
+	// override warnings.
+	user := []byte(`[project]
+requires-python = "==3.12.*"
+
+[dependency-groups]
+dev = ["databricks-connect~=18.0.0"]
+`)
+	c := Constraints{RequiresPython: "==3.12.*", DatabricksConnect: "databricks-connect~=18.0.0"}
+	assert.Empty(t, detectWarnings(user, c))
+}
+
+func TestDetectMergeWarningsConstraintsOnlyIgnoresDBConnect(t *testing.T) {
+	// In constraints-only mode c.DatabricksConnect is empty; the user's dev pin is
+	// left untouched, so it must not produce an override warning.
+	user := []byte(`[project]
+requires-python = "==3.12.*"
+
+[dependency-groups]
+dev = ["databricks-connect~=16.1.0"]
+`)
+	c := Constraints{RequiresPython: "==3.12.*", DatabricksConnect: ""}
+	assert.Empty(t, detectWarnings(user, c))
+}
+
+func TestDetectMergeWarningsStaleEnvironmentVersionOnClusterTarget(t *testing.T) {
+	// A cluster target (c.EnvironmentVersion == "") that finds a leftover serverless
+	// environment_version warns that the value is now stale.
+	user := []byte(`[project]
+requires-python = "==3.12.*"
+
+[dependency-groups]
+dev = ["databricks-connect~=18.0.0"]
+
+[tool.databricks.environment]
+environment_version = "5"
+`)
+	c := Constraints{RequiresPython: "==3.12.*", DatabricksConnect: "databricks-connect~=18.0.0", EnvironmentVersion: ""}
+	got := detectWarnings(user, c)
+	assert.Equal(t, []string{WarnStaleEnvironmentVersion}, codes(got))
+	assert.Contains(t, got[0].Message, `"5"`)
+}
+
+func TestDetectMergeWarningsNoStaleWarningForServerlessTarget(t *testing.T) {
+	// A serverless target manages the section (refreshes it), so an existing value
+	// is not stale and must not warn.
+	user := []byte(`[project]
+requires-python = "==3.12.*"
+
+[dependency-groups]
+dev = ["databricks-connect~=18.0.0"]
+
+[tool.databricks.environment]
+environment_version = "4"
+`)
+	c := Constraints{RequiresPython: "==3.12.*", DatabricksConnect: "databricks-connect~=18.0.0", EnvironmentVersion: "5"}
+	assert.NotContains(t, codes(detectWarnings(user, c)), WarnStaleEnvironmentVersion)
+}
+
+func TestDetectMergeWarningsNoStaleWarningWhenSectionAbsent(t *testing.T) {
+	// A cluster target with no existing section has nothing to go stale.
+	user := []byte(`[project]
+requires-python = "==3.12.*"
+
+[dependency-groups]
+dev = ["databricks-connect~=18.0.0"]
+`)
+	c := Constraints{RequiresPython: "==3.12.*", DatabricksConnect: "databricks-connect~=18.0.0", EnvironmentVersion: ""}
+	assert.NotContains(t, codes(detectWarnings(user, c)), WarnStaleEnvironmentVersion)
+}
+
+func TestDetectMergeWarningsUserConstraintConflict(t *testing.T) {
+	user := []byte(`[project]
+requires-python = "==3.12.*"
+dependencies = ["pyarrow==21.0.0", "requests>=2.0"]
+`)
+	// The bound shape used here matches the acceptance fixtures, which is why it is
+	// worth covering — but note the published artifacts are entirely "~=" (every entry
+	// of serverless-v4 and -v5 at the time of writing), so "~=" is the shape that
+	// actually has to work. TestRangesDisjoint covers the "~=" pairs directly.
+	c := Constraints{
+		RequiresPython: "==3.12.*",
+		ConstraintDeps: []string{"pyarrow<19", "pandas<3"},
+	}
+	got := detectWarnings(user, c)
+	assert.Equal(t, []string{WarnUserConstraintConflict}, codes(got))
+	assert.Contains(t, got[0].Message, "pyarrow")
+
+	// The same conflict through the "~=" shape the artifacts really publish.
+	tilde := Constraints{RequiresPython: "==3.12.*", ConstraintDeps: []string{"pyarrow~=18.1.0"}}
+	assert.Equal(t, []string{WarnUserConstraintConflict}, codes(detectWarnings(user, tilde)))
+}
+
+func TestDetectMergeWarningsStandalonePysparkConflict(t *testing.T) {
+	// databricks-connect vendors its own pyspark, so a standalone pyspark the user
+	// declares collides with it in a shared environment. The warning fires whenever
+	// the env manages databricks-connect, independent of the pyspark version pinned,
+	// and sits after the databricks-connect warnings but before constraint conflicts.
+	user := []byte(`[project]
+requires-python = "==3.12.*"
+dependencies = ["pyspark>=3.5.0", "pyarrow==21.0.0"]
+
+[dependency-groups]
+dev = ["databricks-connect~=16.1.0"]
+`)
+	c := Constraints{
+		RequiresPython:    "==3.12.*",
+		DatabricksConnect: "databricks-connect~=18.0.0",
+		ConstraintDeps:    []string{"pyarrow<19"},
+	}
+	got := detectWarnings(user, c)
+	assert.Equal(t, []string{
+		WarnDBConnectPinOverridden,
+		WarnStandalonePysparkConflict,
+		WarnUserConstraintConflict,
+	}, codes(got))
+	assert.Contains(t, got[1].Message, "pyspark")
+	assert.Contains(t, got[1].Message, "databricks-connect")
+}
+
+func TestStandalonePysparkIgnoredInConstraintsOnly(t *testing.T) {
+	// In constraints-only mode the env does not install databricks-connect, so there
+	// is no vendored pyspark to collide with — a standalone pyspark is fine.
+	user := []byte(`[project]
+requires-python = "==3.12.*"
+dependencies = ["pyspark>=3.5.0"]
+`)
+	c := Constraints{RequiresPython: "==3.12.*", DatabricksConnect: ""}
+	assert.Empty(t, detectWarnings(user, c))
+}
+
+func TestStandalonePysparkReportedOnce(t *testing.T) {
+	// pyspark declared in both [project].dependencies and a dependency group is one
+	// collision to fix, reported once so it does not inflate the code histogram.
+	user := []byte(`[project]
+requires-python = "==3.12.*"
+dependencies = ["PySpark == 4.2.0"]
+
+[dependency-groups]
+dev = ["pyspark", "databricks-connect~=18.0.0"]
+`)
+	c := Constraints{RequiresPython: "==3.12.*", DatabricksConnect: "databricks-connect~=18.0.0"}
+	assert.Equal(t, []string{WarnStandalonePysparkConflict}, codes(detectWarnings(user, c)))
+}
+
+func TestStandalonePysparkFiresInConstraintsOnlyWhenUserPinsDBConnect(t *testing.T) {
+	// Constraints-only mode does not manage databricks-connect, but if the user's own
+	// pyproject pins it the merge leaves that pin in place (mergeDatabricksConnect is a
+	// no-op on an empty managed value), so uv still installs databricks-connect and a
+	// standalone pyspark still collides. The warning must fire — matching the validate
+	// hard-fail, which keys on the installed venv rather than the mode.
+	user := []byte(`[project]
+requires-python = "==3.12.*"
+dependencies = ["pyspark>=3.5.0", "databricks-connect~=18.0.0"]
+`)
+	c := Constraints{RequiresPython: "==3.12.*", DatabricksConnect: ""}
+	assert.Equal(t, []string{WarnStandalonePysparkConflict}, codes(detectWarnings(user, c)))
+}
+
+func TestDetectMergeWarningsNoConflictWhenCompatible(t *testing.T) {
+	user := []byte(`[project]
+requires-python = "==3.12.*"
+dependencies = ["pyarrow==18.1.0", "pandas==2.2.0"]
+`)
+	// Both pins sit inside the env's ceilings, so there is nothing to report.
+	c := Constraints{RequiresPython: "==3.12.*", ConstraintDeps: []string{"pyarrow<19", "pandas<3"}}
+	assert.Empty(t, detectWarnings(user, c))
+}
+
+func TestDetectMergeWarningsIncludeGroupDoesNotSuppress(t *testing.T) {
+	// A PEP 735 {include-group = ...} table is a legal dev-group entry that uv
+	// supports. It must not fail the decode and take every unrelated warning with
+	// it: the requires-python override and the pyarrow conflict below do not depend
+	// on the dev group at all, and MergeManaged rewrites all three regions anyway.
+	user := []byte(`[project]
+requires-python = ">=3.9"
+dependencies = ["pyarrow==19.0.0"]
+
+[dependency-groups]
+dev = ["databricks-connect~=16.1.0", {include-group = "test"}]
+test = []
+`)
+	c := Constraints{
+		RequiresPython:    "==3.12.*",
+		DatabricksConnect: "databricks-connect~=17.2.0",
+		ConstraintDeps:    []string{"pyarrow~=21.0.0"},
+	}
+	assert.Equal(t, []string{
+		WarnRequiresPythonOverridden,
+		WarnDBConnectPinOverridden,
+		WarnUserConstraintConflict,
+	}, codes(detectWarnings(user, c)))
+}
+
+func TestDetectMergeWarningsStrayPinsAreConsolidated(t *testing.T) {
+	// A databricks-connect pin in another group — reached through an include-group or
+	// held directly in a sibling group — is removed by the consolidation pass so the
+	// managed pin is the only one left. That is reported as consolidation, not as an
+	// override (nothing in dev was rewritten) and not as a duplicate (the pin does not
+	// survive the merge).
+	c := Constraints{RequiresPython: "==3.12.*", DatabricksConnect: "databricks-connect==17.0.0"}
+
+	indirect := []byte(`[project]
+requires-python = "==3.12.*"
+
+[dependency-groups]
+dev = [{include-group = "spark"}]
+spark = ["databricks-connect==16.1.0"]
+`)
+	got := detectWarnings(indirect, c)
+	assert.Equal(t, []string{WarnDBConnectConsolidated}, codes(got))
+	// The message must not claim a replacement that did not happen.
+	assert.NotContains(t, got[0].Message, "is replaced")
+
+	// A pin directly in dev *is* rewritten in place, so that stays an override.
+	direct := []byte(`[project]
+requires-python = "==3.12.*"
+
+[dependency-groups]
+dev = ["databricks-connect==16.1.0"]
+`)
+	assert.Equal(t, []string{WarnDBConnectPinOverridden}, codes(detectWarnings(direct, c)))
+
+	// With pins both in dev and behind an include-group, the merge rewrites dev's and
+	// removes the included one, so both an override and a consolidation are reported.
+	both := []byte(`[project]
+requires-python = "==3.12.*"
+
+[dependency-groups]
+dev = ["databricks-connect==16.1.0", {include-group = "spark"}]
+spark = ["databricks-connect==15.0.0"]
+`)
+	assert.Equal(t, []string{WarnDBConnectPinOverridden, WarnDBConnectConsolidated},
+		codes(detectWarnings(both, c)))
+
+	// Consolidation actually fixes the project: re-running on the merged file finds a
+	// single managed pin and nothing to warn about (the spark stray is gone).
+	merged, _, err := MergeManaged(both, c, MergeOptions{})
+	require.NoError(t, err)
+	assert.Empty(t, detectWarnings(merged, c))
+
+	// An include-group cycle must terminate rather than recurse forever, and the pin
+	// behind it is still removed.
+	cyclic := []byte(`[project]
+requires-python = "==3.12.*"
+
+[dependency-groups]
+dev = [{include-group = "a"}]
+a = [{include-group = "dev"}, "databricks-connect==16.1.0"]
+`)
+	assert.Equal(t, []string{WarnDBConnectConsolidated}, codes(detectWarnings(cyclic, c)))
+
+	// A quoted TOML group key is outside the line-based removal's reach, so the pin
+	// survives beside the managed one and is reported as a duplicate — uv still cannot
+	// resolve it, so the user must not lose the signal.
+	quotedKey := []byte(`[project]
+requires-python = "==3.12.*"
+
+[dependency-groups]
+dev = [{include-group = "my-spark-group"}]
+"my-spark-group" = ["databricks-connect==16.1.0"]
+`)
+	assert.Equal(t, []string{WarnDBConnectPinDuplicated}, codes(detectWarnings(quotedKey, c)))
+
+	// A stray pin that already matches the env is not disjoint from it, so the gate
+	// leaves it in place and there is nothing to warn about.
+	matching := []byte(`[project]
+requires-python = "==3.12.*"
+
+[dependency-groups]
+dev = [{include-group = "spark"}]
+spark = ["databricks-connect==17.0.0"]
+`)
+	assert.Empty(t, detectWarnings(matching, c))
+
+	// A dangling reference is not an error; there is simply no pin to compare.
+	dangling := []byte(`[project]
+requires-python = "==3.12.*"
+
+[dependency-groups]
+dev = [{include-group = "absent"}]
+`)
+	assert.Empty(t, detectWarnings(dangling, c))
+}
+
+func TestDetectMergeWarningsConflictInDependencyGroup(t *testing.T) {
+	// uv applies constraint-dependencies to the whole resolution, so a pin in the dev
+	// group breaks `uv sync` exactly like one in [project].dependencies. The dev group
+	// is where this command's audience keeps its pins, so it must be scanned too.
+	user := []byte(`[project]
+requires-python = "==3.12.*"
+
+[dependency-groups]
+dev = ["pyarrow==17.0.0"]
+`)
+	c := Constraints{RequiresPython: "==3.12.*", ConstraintDeps: []string{"pyarrow<19"}}
+	assert.Empty(t, detectWarnings(user, c), "17.0.0 satisfies <19 — no conflict")
+
+	conflicting := []byte(`[project]
+requires-python = "==3.12.*"
+
+[dependency-groups]
+dev = ["pyarrow==21.0.0"]
+`)
+	assert.Equal(t, []string{WarnUserConstraintConflict},
+		codes(detectWarnings(conflicting, c)), "21.0.0 is outside <19")
+
+	// A pin behind an include-group is part of the resolution too.
+	included := []byte(`[project]
+requires-python = "==3.12.*"
+
+[dependency-groups]
+dev = [{include-group = "data"}]
+data = ["pyarrow==21.0.0"]
+`)
+	assert.Equal(t, []string{WarnUserConstraintConflict}, codes(detectWarnings(included, c)))
+}
+
+func TestDetectMergeWarningsSurvivesUnrelatedTOMLShapes(t *testing.T) {
+	// BurntSushi reports a per-key type mismatch as a whole-document error. Each shape
+	// below is legal in a real pyproject.toml but does not fit a stricter struct, and
+	// none of them is read by the requires-python check — so dropping every warning on
+	// one of them would silently hide an override the merge does perform.
+	c := Constraints{RequiresPython: "==3.12.*", DatabricksConnect: "databricks-connect~=18.0.0"}
+	for name, body := range map[string]string{
+		// PDM/mkdocs style: a dependency group declared as a sub-table.
+		"group sub-table": `[project]
+requires-python = ">=3.9"
+
+[dependency-groups]
+dev = ["databricks-connect~=16.1.0"]
+
+[dependency-groups.docs]
+mkdocs = "*"
+`,
+		// PEP 621 permits a dependency to be a table in some tool dialects.
+		"table dependency": `[project]
+requires-python = ">=3.9"
+dependencies = ["pyarrow==21.0.0", {name = "x"}]
+
+[dependency-groups]
+dev = ["databricks-connect~=16.1.0"]
+`,
+		"group is a string": `[project]
+requires-python = ">=3.9"
+
+[dependency-groups]
+dev = "oops"
+`,
+	} {
+		got := codes(detectWarnings([]byte(body), c))
+		assert.Contains(t, got, WarnRequiresPythonOverridden, "%s: requires-python override must survive", name)
+	}
+
+	// A genuine syntax error still yields nothing: there are no fields to compare.
+	assert.Empty(t, detectWarnings([]byte("this is : not valid toml ["), c))
+}
+
+func TestDetectMergeWarningsScansEveryGroupUVLocks(t *testing.T) {
+	// uv applies constraint-dependencies to the whole resolution and locks every
+	// declared group, so a conflicting pin outside dev fails `uv sync` with
+	// "requirements are unsatisfiable" just as a [project] one does. Scanning only dev
+	// would stay silent on exactly that failure.
+	c := Constraints{RequiresPython: "==3.12.*", ConstraintDeps: []string{"pyarrow<19"}}
+
+	nonDevGroup := []byte(`[project]
+requires-python = "==3.12.*"
+
+[dependency-groups]
+qa = ["pyarrow==21.0.0"]
+`)
+	assert.Equal(t, []string{WarnUserConstraintConflict}, codes(detectWarnings(nonDevGroup, c)),
+		"a pin in a group uv locks conflicts even though the group is not dev")
+
+	optionalExtra := []byte(`[project]
+requires-python = "==3.12.*"
+
+[project.optional-dependencies]
+extra = ["pyarrow==21.0.0"]
+`)
+	assert.Equal(t, []string{WarnUserConstraintConflict}, codes(detectWarnings(optionalExtra, c)),
+		"uv resolves extras alongside the base dependencies")
+}
+
+func TestDetectMergeWarningsReportsOneConflictPerRequirement(t *testing.T) {
+	// The same pin may be declared in several places uv locks. It is one conflict to
+	// fix, and repeating it would inflate the histogram consumers build from the codes.
+	user := []byte(`[project]
+requires-python = "==3.12.*"
+dependencies = ["pyarrow==21.0.0"]
+
+[dependency-groups]
+dev = ["pyarrow==21.0.0", {include-group = "g"}]
+g = ["pyarrow==21.0.0"]
+`)
+	c := Constraints{RequiresPython: "==3.12.*", ConstraintDeps: []string{"pyarrow<19"}}
+	assert.Equal(t, []string{WarnUserConstraintConflict}, codes(detectWarnings(user, c)))
+
+	// Two genuinely different conflicting pins for one package are each reported.
+	two := []byte(`[project]
+requires-python = "==3.12.*"
+dependencies = ["pyarrow==21.0.0"]
+
+[dependency-groups]
+dev = ["pyarrow==22.0.0"]
+`)
+	assert.Equal(t, []string{WarnUserConstraintConflict, WarnUserConstraintConflict},
+		codes(detectWarnings(two, c)))
+}
+
+func TestDetectMergeWarningsIsDeterministic(t *testing.T) {
+	// Group names are read from a Go map. Two keys that normalize to the same PEP 735
+	// group, or several groups holding conflicting pins, must not let map iteration
+	// order decide which warning is reported.
+	c := Constraints{RequiresPython: "==3.12.*", ConstraintDeps: []string{"pyarrow<19", "numpy<2"}}
+	user := []byte(`[project]
+requires-python = "==3.12.*"
+
+[dependency-groups]
+dev = ["pyarrow==21.0.0"]
+Dev = ["numpy==9.9.9"]
+`)
+	want := codes(detectWarnings(user, c))
+	assert.Len(t, want, 2, "both groups are locked by uv, so both conflicts are reported")
+	for range 200 {
+		assert.Equal(t, want, codes(detectWarnings(user, c)))
+	}
+}
+
+func TestDetectMergeWarningsNonLiteralDevGroupIsConsolidated(t *testing.T) {
+	// MergeManaged finds the dev array with devKeyRe (`^\s*dev\s*=`), so a group spelled
+	// "Dev" is never rewritten: the merge adds its own dev key. The consolidation pass
+	// then removes the stray pin from "Dev", so it is reported as consolidated, not as
+	// an override (nothing was replaced in place).
+	c := Constraints{RequiresPython: "==3.12.*", DatabricksConnect: "databricks-connect==17.0.0"}
+	user := []byte(`[project]
+requires-python = "==3.12.*"
+
+[dependency-groups]
+Dev = ["databricks-connect==16.1.0"]
+`)
+	got := detectWarnings(user, c)
+	assert.Equal(t, []string{WarnDBConnectConsolidated}, codes(got))
+	assert.NotContains(t, got[0].Message, "is replaced")
+
+	merged, _, err := MergeManaged(user, c, MergeOptions{})
+	require.NoError(t, err)
+	assert.NotContains(t, string(merged), `databricks-connect==16.1.0`, "the stray pin is removed, not retained")
+}
+
+func TestDBConnectWarningsFollowWhatTheMergeDoes(t *testing.T) {
+	// The warnings must be driven by the merge's own answer, not by a second
+	// implementation of what it edits. The merge rewrites and removes only
+	// double-quoted elements the line-based passes reach, so a pin the passes cannot
+	// touch survives beside the managed pin and is a duplicate (uv cannot resolve),
+	// while a pin they can reach is consolidated away.
+	c := Constraints{RequiresPython: "==3.12.*", DatabricksConnect: "databricks-connect==17.0.0"}
+
+	// Pins the line-based passes cannot reach survive the merge — a duplicate.
+	survives := map[string]string{
+		// A TOML literal string is a string, but not one the double-quoted matcher sees.
+		"single-quoted element": `[project]
+requires-python = "==3.12.*"
+
+[dependency-groups]
+dev = ['databricks-connect==16.1.0']
+`,
+		// A dotted key defines the group outside a [dependency-groups] table header, so
+		// the line-based removal never scans it.
+		"top-level dotted key": `dependency-groups.dev = ["databricks-connect==16.1.0"]
+
+[project]
+requires-python = "==3.12.*"
+`,
+	}
+	for name, body := range survives {
+		got := detectWarnings([]byte(body), c)
+		assert.Equal(t, []string{WarnDBConnectPinDuplicated}, codes(got), name)
+		assert.NotContains(t, got[0].Message, "is replaced", name)
+
+		// The merged file really does carry both pins, which is what the code reports.
+		merged, _, err := MergeManaged([]byte(body), c, MergeOptions{})
+		require.NoError(t, err, name)
+		assert.Contains(t, string(merged), "databricks-connect==16.1.0", name)
+		assert.Contains(t, string(merged), "databricks-connect==17.0.0", name)
+	}
+
+	// A double-quoted pin in a normalization-equal group ("Dev") is reached by the
+	// removal pass, so it is consolidated away rather than left as a duplicate.
+	capitalized := []byte(`[project]
+requires-python = "==3.12.*"
+
+[dependency-groups]
+Dev = ["databricks-connect==16.1.0"]
+`)
+	got := detectWarnings(capitalized, c)
+	assert.Equal(t, []string{WarnDBConnectConsolidated}, codes(got))
+	merged, _, err := MergeManaged(capitalized, c, MergeOptions{})
+	require.NoError(t, err)
+	assert.NotContains(t, string(merged), "databricks-connect==16.1.0")
+	assert.Contains(t, string(merged), "databricks-connect==17.0.0")
+}
+
+func TestDBConnectDuplicateOnlyWhenRangesCannotBothHold(t *testing.T) {
+	// A pin the merge cannot remove (single-quoted, so the double-quoted-only passes do
+	// not reach it) survives beside the managed pin. Two pins for one package are only a
+	// problem when nothing satisfies both: uv resolves an overlapping pair without
+	// complaint, so there is nothing to reconcile and no warning to give.
+	c := Constraints{RequiresPython: "==3.12.*", DatabricksConnect: "databricks-connect~=17.2.0"}
+
+	overlapping := []byte(`[project]
+requires-python = "==3.12.*"
+
+[dependency-groups]
+dev = ['databricks-connect>=16']
+`)
+	assert.Empty(t, detectWarnings(overlapping, c), ">=16 and ~=17.2.0 both hold at 17.2.x")
+
+	disjoint := []byte(`[project]
+requires-python = "==3.12.*"
+
+[dependency-groups]
+dev = ['databricks-connect==15.0.0']
+`)
+	assert.Equal(t, []string{WarnDBConnectPinDuplicated}, codes(detectWarnings(disjoint, c)),
+		"==15.0.0 is outside ~=17.2.0, so uv cannot resolve")
+}
+
+func TestDBConnectWarningsSecondDirectPinIsConsolidated(t *testing.T) {
+	// MergeManaged rewrites only the first databricks-connect element in the dev array;
+	// the consolidation pass then removes any further one, so a second pin is reported
+	// as consolidated rather than left as a duplicate uv cannot resolve.
+	c := Constraints{RequiresPython: "==3.12.*", DatabricksConnect: "databricks-connect==17.0.0"}
+	user := []byte(`[project]
+requires-python = "==3.12.*"
+
+[dependency-groups]
+dev = ["databricks-connect==17.0.0", "databricks-connect==16.0.0"]
+`)
+	// The first pin already matches the env, so there is nothing to override; the second
+	// is removed and reported as consolidated.
+	assert.Equal(t, []string{WarnDBConnectConsolidated}, codes(detectWarnings(user, c)))
+}
+
+func TestConsolidatedWarningNamesLocationAndCoexistsWithOverride(t *testing.T) {
+	// A stray pin in [project].dependencies is consolidated, and the message names where
+	// it came from so the user can see what the merge edited.
+	c := Constraints{RequiresPython: "==3.12.*", DatabricksConnect: "databricks-connect~=17.2.0"}
+	projectDeps := []byte(`[project]
+requires-python = "==3.12.*"
+dependencies = ["databricks-connect==15.1.*"]
+`)
+	got := detectWarnings(projectDeps, c)
+	require.Equal(t, []string{WarnDBConnectConsolidated}, codes(got))
+	assert.Contains(t, got[0].Message, "[project].dependencies")
+
+	// An override in dev and consolidations across an optional extra and a sibling group
+	// coexist, in a deterministic order (override first, then removals in resolution
+	// order: optional-dependencies before dependency-groups).
+	mixed := []byte(`[project]
+requires-python = "==3.12.*"
+
+[project.optional-dependencies]
+extra = ["databricks-connect==14.0.0"]
+
+[dependency-groups]
+dev = ["databricks-connect==16.1.0"]
+docs = ["databricks-connect==15.0.0"]
+`)
+	want := codes(detectWarnings(mixed, c))
+	assert.Equal(t, []string{WarnDBConnectPinOverridden, WarnDBConnectConsolidated, WarnDBConnectConsolidated}, want)
+	// The order must be stable across runs (group names come from a Go map).
+	for range 200 {
+		assert.Equal(t, want, codes(detectWarnings(mixed, c)))
+	}
+}
+
+func TestConstraintsOnlyEmitsNoDBConnectWarnings(t *testing.T) {
+	// With an empty DatabricksConnect (constraints-only mode) databricks-connect is left
+	// untouched wherever it sits, so none of the db-connect warnings fire.
+	c := Constraints{RequiresPython: "==3.12.*", DatabricksConnect: ""}
+	user := []byte(`[project]
+requires-python = "==3.12.*"
+dependencies = ["databricks-connect==15.1.*"]
+
+[dependency-groups]
+dev = ["databricks-connect~=16.0"]
+docs = ["databricks-connect==15.0.0"]
+`)
+	assert.Empty(t, detectWarnings(user, c))
+}
+
+func TestUserConstraintConflictFiresForWildcardPin(t *testing.T) {
+	// A prefix-match wildcard pin ("==18.*") must be modeled so a conflict with the env's
+	// constraint-dependencies is reported rather than silently missed.
+	user := []byte(`[project]
+requires-python = "==3.12.*"
+dependencies = ["pyarrow==18.*"]
+`)
+	c := Constraints{RequiresPython: "==3.12.*", ConstraintDeps: []string{"pyarrow~=19.0"}}
+	got := detectWarnings(user, c)
+	assert.Equal(t, []string{WarnUserConstraintConflict}, codes(got))
+	assert.Contains(t, got[0].Message, "pyarrow")
+}
+
+func TestConstraintConflictsDuplicateEnvEntriesAreOrderIndependent(t *testing.T) {
+	// Constraint entries for one package compose as a conjunction, so they are
+	// intersected rather than letting one entry win. 19.0.0 is outside [20, 21)
+	// whichever order the artifact lists the bounds in.
+	user := []string{"pyarrow==19.0.0"}
+	assert.Equal(t, []string{WarnUserConstraintConflict},
+		codes(constraintConflicts(user, []string{"pyarrow<21", "pyarrow>=20"})))
+	assert.Equal(t, []string{WarnUserConstraintConflict},
+		codes(constraintConflicts(user, []string{"pyarrow>=20", "pyarrow<21"})))
+
+	// A pin inside the intersection is not a conflict, again either way round.
+	inside := []string{"pyarrow==20.5.0"}
+	assert.Empty(t, constraintConflicts(inside, []string{"pyarrow<21", "pyarrow>=20"}))
+	assert.Empty(t, constraintConflicts(inside, []string{"pyarrow>=20", "pyarrow<21"}))
+}
+
+func TestSplitDepSpecExtrasAndMarkers(t *testing.T) {
+	// Extras never narrow the version range, so they are stripped and the pin
+	// underneath is still compared.
+	name, spec, ok := splitDepSpec("pyarrow[compute,parquet]==17.0.0")
+	assert.True(t, ok)
+	assert.Equal(t, "pyarrow", name)
+	assert.Equal(t, "==17.0.0", spec)
+
+	// A marker makes the requirement conditional on the resolving interpreter,
+	// which we do not evaluate — so it is skipped rather than compared, with or
+	// without extras in front of it.
+	_, _, ok = splitDepSpec(`pyarrow==17.0.0; python_version < "3.12"`)
+	assert.False(t, ok)
+	_, _, ok = splitDepSpec(`pyarrow[compute]==17.0.0; python_version < "3.12"`)
+	assert.False(t, ok)
+
+	// PEP 503 normalization applies to the name on both sides of the lookup.
+	name, spec, ok = splitDepSpec("PyArrow_Extra ==1.0")
+	assert.True(t, ok)
+	assert.Equal(t, "pyarrow-extra", name)
+	assert.Equal(t, "==1.0", spec)
+}
+
+func TestDetectMergeWarningsConflictThroughExtras(t *testing.T) {
+	user := []byte(`[project]
+dependencies = ["pyarrow[compute]==17.0.0"]
+`)
+	c := Constraints{ConstraintDeps: []string{"pyarrow~=21.0.0"}}
+	got := detectWarnings(user, c)
+	assert.Equal(t, []string{WarnUserConstraintConflict}, codes(got))
+}
+
+func TestRangesDisjoint(t *testing.T) {
+	cases := []struct {
+		user, env string
+		disjoint  bool
+		why       string
+	}{
+		{"==17.0.0", "~=21.0.0", true, "exact pin below the compatible range"},
+		{"==21.0.3", "~=21.0.0", false, "exact pin inside ~=21.0.0 == >=21.0.0,==21.0.*"},
+		{"==21.5.0", "~=21.0.0", true, "~=21.0.0 fixes 21.0.*, so 21.5.0 is outside it"},
+		{"==22.0.0", "~=21.0.0", true, "exact pin above the compatible upper bound"},
+		{"==1.0", "==2.0", true, "two different exact pins"},
+		{"==2.0", "==2.0", false, "identical exact pins"},
+		{"==2", "==2.0.0", false, "trailing zeros denote the same release"},
+		{">=2.0", "==2.5", false, "2.5 is above the floor — overlapping"},
+		{"!=2.0", "==2.0", false, "!= is not modeled — never a conflict"},
+		{">=2.0,<3.0", "==5.0", true, "5.0 is above the compound range's ceiling"},
+		{"", "~=21.0.0", false, "no user spec — nothing to compare"},
+
+		// PEP 440 prefix-match wildcards ("==X.Y.*"). The clause admits the whole X.Y
+		// series: [X.Y, X.(Y+1)). Only "==" carries a wildcard; "!=X.*" and any other
+		// operator stay undecidable (parseClause refuses them), never a false conflict.
+		{"==15.1.*", "~=17.0", true, "the 15.1 series is entirely below [17.0, 18.0)"},
+		{"==17.0.*", "~=17.0", false, "the 17.0 series sits inside [17.0, 18.0)"},
+		{"==17.*", "~=17.2.0", false, "the 17.* series spans the ~=17.2.0 range"},
+		{"==2.*", "==3.0", true, "the 2.* series ends at 3, which the exact 3.0 exceeds"},
+		{"==2.*", "==2.0", false, "2.0 is inside the 2.* series [2, 3)"},
+		{"!=2.*", "==2.0", false, "!=X.* excludes a whole series — undecidable, never a conflict"},
+
+		// Opposite-direction bounds. This is the shape the published constraint
+		// artifacts use (pyarrow<19, pandas<3), so failing to decide it would make the
+		// warning miss the common case and under-report the metric silently.
+		{">=20", "<19", true, "floor above the ceiling"},
+		{">=4", "<3", true, "floor above the ceiling, single segment"},
+		{">=19", "<20", false, "ranges overlap on [19, 20)"},
+		{">2.0", "<2.0", true, "strict bounds meeting at one excluded point"},
+		{">=2.0", "<2.0", true, "inclusive floor at an exclusive ceiling"},
+		{">=2.0", "<=2.0", false, "both include the single shared version 2.0"},
+		{">2.0", "<=2.0", true, "the shared endpoint is excluded by the floor"},
+		{"<19", "<3", false, "same direction always shares the low end"},
+		{">=20", ">=3", false, "same direction always shares the high end"},
+
+		// ~= against a bound or another ~=. The ceiling depends on how many segments
+		// the base has: ~=21.0 expands to ">=21.0, ==21.*" -> [21.0, 22.0), whereas
+		// ~=21.0.0 expands to ">=21.0.0, ==21.0.*" -> [21.0.0, 21.1.0).
+		{"~=17.0", "~=21.0", true, "[17.0, 18.0) is entirely below [21.0, 22.0)"},
+		{"~=21.0", "~=21.1", false, "[21.1, 22.0) is a subset of [21.0, 22.0)"},
+		{"~=21.0.0", "~=21.1.0", true, "[21.0.0, 21.1.0) ends where [21.1.0, 21.2.0) begins"},
+		{"~=21.0", "~=21.0", false, "identical compatible ranges"},
+		{"~=17.0", "<19", false, "[17.0, 18.0) lies below the ceiling 19"},
+		{"~=21.0", "<19", true, "floor 21.0 is above the ceiling 19"},
+		{"~=21.0", ">=22", true, "ceiling 22.0 is exclusive, so it meets the floor 22"},
+		{"~=21.0", ">=21.5", false, "21.5 is inside [21.0, 22.0)"},
+		// PEP 440 requires two release segments after "~=", so a single-segment base
+		// has no defined range. It must stay undecidable rather than being read as a
+		// proof of disjointness: 2.0 and 2.31.0 both plainly satisfy any reading of ~=2.
+		{"~=2", "==2.0", false, "single-segment ~= is malformed — undecidable, not disjoint"},
+		{"==2.0", "~=2", false, "same, with the malformed base on the env side"},
+		{"~=2", "==2.31.0", false, "single-segment ~= never decides a conflict"},
+		{"~=2.0", "==2.31.0", false, "valid ~=2.0 admits 2.31.0 (>=2.0, ==2.*)"},
+		{"~=2.1", "==2.0.5", true, "valid ~=2.1 excludes 2.0.5 (below the floor)"},
+	}
+	for _, tc := range cases {
+		assert.Equalf(t, tc.disjoint, rangesDisjoint(tc.user, tc.env),
+			"rangesDisjoint(%q,%q): %s", tc.user, tc.env, tc.why)
+	}
+}
diff --git a/libs/localenv/workspace.go b/libs/localenv/workspace.go
new file mode 100644
index 00000000000..59ae59ac35c
--- /dev/null
+++ b/libs/localenv/workspace.go
@@ -0,0 +1,86 @@
+package localenv
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+
+	"github.com/databricks/cli/libs/log"
+)
+
+// discoverWorkspaceRoot returns the uv workspace root when ProjectDir is a
+// workspace member, and the root relative to ProjectDir (for example "../..").
+// It returns "" for both when ProjectDir is not a member: a standalone project,
+// the root itself, or a project uv cannot place.
+//
+// A folder with no pyproject.toml yet (greenfield) is not treated as a member.
+// When a members glob of a parent workspace matches it, the file this command
+// creates makes it a member: the first run then fails at provision (uv syncs
+// the root venv), and a re-run finds the member.
+//
+// A discovery failure (uv older than 0.9.9, uv not found under --dry-run, a
+// malformed workspace) keeps the standalone behavior. A malformed workspace
+// still fails later in uv sync, with uv's own message.
+func (p *Pipeline) discoverWorkspaceRoot(ctx context.Context) (root, rel string) {
+	if !fileExists(p.pyprojectPath()) {
+		return "", ""
+	}
+	root, err := p.PM.WorkspaceRoot(ctx, p.ProjectDir)
+	if err != nil {
+		log.Debugf(ctx, CommandName+": workspace discovery failed, using the project folder: %v: %s", err, uvStderr(err))
+		return "", ""
+	}
+	// uv prints the root with symlinks resolved and in the on-disk letter case,
+	// while ProjectDir keeps the form the shell gave (on macOS, /var vs
+	// /private/var, and any letter case). So compare folders by identity.
+	//
+	// The relative path is counted from the symlink-resolved ProjectDir, because
+	// that is where the OS resolves "..". The root is reported in ProjectDir's
+	// form when one of its parents is the root, so the paths the command reports
+	// match the folder the user ran it from; otherwise uv's form is used.
+	resolved, err := filepath.EvalSymlinks(p.ProjectDir)
+	if err != nil {
+		log.Debugf(ctx, CommandName+": cannot resolve the project folder: %v", err)
+		return "", ""
+	}
+	_, levels, ok := sameFolderAncestor(resolved, root)
+	if !ok {
+		log.Debugf(ctx, CommandName+": workspace root %s is not a parent of the project folder", filepath.ToSlash(root))
+		return "", ""
+	}
+	if levels == 0 {
+		return "", ""
+	}
+	if ancestor, _, ok := sameFolderAncestor(p.ProjectDir, root); ok {
+		return ancestor, upLevels(levels)
+	}
+	return root, upLevels(levels)
+}
+
+// sameFolderAncestor returns the first of dir and its parents that is the same
+// folder as target (by file identity, not by name), and how many levels above
+// dir it is.
+func sameFolderAncestor(dir, target string) (ancestor string, levels int, ok bool) {
+	targetInfo, err := os.Stat(target)
+	if err != nil {
+		return "", 0, false
+	}
+	for d := dir; ; d = filepath.Dir(d) {
+		if info, err := os.Stat(d); err == nil && os.SameFile(info, targetInfo) {
+			return d, levels, true
+		}
+		if filepath.Dir(d) == d {
+			return "", 0, false
+		}
+		levels++
+	}
+}
+
+// upLevels returns the relative path n folders up, for example "../.." for 2.
+func upLevels(n int) string {
+	parts := make([]string, n)
+	for i := range parts {
+		parts[i] = ".."
+	}
+	return filepath.Join(parts...)
+}
diff --git a/libs/localenv/workspace_test.go b/libs/localenv/workspace_test.go
new file mode 100644
index 00000000000..93550f22de4
--- /dev/null
+++ b/libs/localenv/workspace_test.go
@@ -0,0 +1,394 @@
+package localenv
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// memberLayout creates a uv workspace root with one member, bundles/a.
+func memberLayout(t *testing.T) (root, member string) {
+	t.Helper()
+	root = t.TempDir()
+	member = filepath.Join(root, "bundles", "a")
+	require.NoError(t, os.MkdirAll(member, 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(root, pyprojectFile), []byte("[tool.uv.workspace]\nmembers = [\"bundles/*\"]\n"), 0o644))
+	require.NoError(t, os.WriteFile(filepath.Join(member, pyprojectFile), []byte("[project]\nname = \"a\"\n"), 0o644))
+	return root, member
+}
+
+func TestDiscoverWorkspaceRoot(t *testing.T) {
+	root, member := memberLayout(t)
+	greenfield := filepath.Join(root, "new")
+	require.NoError(t, os.MkdirAll(greenfield, 0o755))
+
+	tests := []struct {
+		name       string
+		projectDir string
+		pm         fakePM
+		wantRoot   string
+		wantRel    string
+	}{
+		{"member", member, fakePM{root: root}, root, filepath.Join("..", "..")},
+		{"standalone", member, fakePM{root: member}, "", ""},
+		// The created pyproject.toml is not a member yet; see discoverWorkspaceRoot.
+		{"greenfield", greenfield, fakePM{root: root}, "", ""},
+		{"uv failure", member, fakePM{rootErr: errors.New("unrecognized subcommand 'workspace'")}, "", ""},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			p := &Pipeline{ProjectDir: tc.projectDir, PM: tc.pm}
+			gotRoot, gotRel := p.discoverWorkspaceRoot(t.Context())
+			assert.Equal(t, tc.wantRoot, gotRoot)
+			assert.Equal(t, tc.wantRel, gotRel)
+		})
+	}
+}
+
+func TestDiscoverWorkspaceRootSymlinkedSameDir(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("symlinks need extra privileges on Windows")
+	}
+	_, member := memberLayout(t)
+	link := filepath.Join(t.TempDir(), "link")
+	require.NoError(t, os.Symlink(member, link))
+	// uv prints the resolved path; ProjectDir is the symlinked one.
+	p := &Pipeline{ProjectDir: link, PM: fakePM{root: member}}
+	got, _ := p.discoverWorkspaceRoot(t.Context())
+	assert.Empty(t, got)
+}
+
+// caseFoldedPath returns path with its last element in upper case, and skips
+// the test on a case-sensitive file system, where that path does not exist.
+func caseFoldedPath(t *testing.T, path string) string {
+	t.Helper()
+	folded := filepath.Join(filepath.Dir(path), strings.ToUpper(filepath.Base(path)))
+	if _, err := os.Stat(folded); err != nil {
+		t.Skip("the file system is case-sensitive")
+	}
+	return folded
+}
+
+func TestDiscoverWorkspaceRootCaseMismatchStandalone(t *testing.T) {
+	// The shell keeps the letter case the user typed; uv prints the case on disk.
+	_, member := memberLayout(t)
+	p := &Pipeline{ProjectDir: caseFoldedPath(t, member), PM: fakePM{root: member}}
+	got, _ := p.discoverWorkspaceRoot(t.Context())
+	assert.Empty(t, got)
+}
+
+func TestDiscoverWorkspaceRootCaseMismatchMember(t *testing.T) {
+	root, _ := memberLayout(t)
+	foldedRoot := caseFoldedPath(t, root)
+	p := &Pipeline{ProjectDir: filepath.Join(foldedRoot, "bundles", "a"), PM: fakePM{root: root}}
+	gotRoot, gotRel := p.discoverWorkspaceRoot(t.Context())
+	assert.Equal(t, foldedRoot, gotRoot)
+	assert.Equal(t, filepath.Join("..", ".."), gotRel)
+}
+
+// newMemberPipeline returns a pipeline for the member of a memberLayout.
+func newMemberPipeline(t *testing.T) (p *Pipeline, root, member string) {
+	t.Helper()
+	root, member = memberLayout(t)
+	// The member needs requires-python so the existing merge accepts it.
+	require.NoError(t, os.WriteFile(filepath.Join(member, pyprojectFile),
+		[]byte("[project]\nname = \"a\"\nversion = \"0.1.0\"\nrequires-python = \">=3.10\"\n"), 0o644))
+	p = newServerlessTestPipeline(t, member)
+	p.PM = fakePM{py: "3.12", dbc: "17.2.0", root: root}
+	return p, root, member
+}
+
+func TestPipelineWorkspaceMember(t *testing.T) {
+	p, root, member := newMemberPipeline(t)
+	res, err := p.Run(t.Context())
+	require.NoError(t, err)
+
+	rootBytes, err := os.ReadFile(filepath.Join(root, pyprojectFile))
+	require.NoError(t, err)
+	memberBytes, err := os.ReadFile(filepath.Join(member, pyprojectFile))
+	require.NoError(t, err)
+	assert.Contains(t, string(rootBytes), "constraint-dependencies")
+	assert.Contains(t, string(rootBytes), "[tool.uv.workspace]")
+	assert.NotContains(t, string(memberBytes), "constraint-dependencies")
+	assert.Contains(t, string(memberBytes), "requires-python")
+	assert.Contains(t, string(memberBytes), `"databricks-connect~=17.2.0"`)
+
+	assert.Equal(t, "../../.venv", res.VenvPath)
+	assert.Equal(t, filepath.ToSlash(root), res.UvWorkspaceRoot)
+	assert.Equal(t, filepath.ToSlash(filepath.Join(root, backupFile)), res.UvWorkspaceBackupPath)
+	assert.Equal(t, filepath.ToSlash(filepath.Join(member, backupFile)), res.BackupPath)
+	assert.NotContains(t, codes(res.Warnings), WarnUvWorkspaceConstraintsReplaced, "first run must not warn")
+}
+
+func TestPipelineWorkspaceMemberIdempotent(t *testing.T) {
+	p, root, member := newMemberPipeline(t)
+	_, err := p.Run(t.Context())
+	require.NoError(t, err)
+	res, err := p.Run(t.Context())
+	require.NoError(t, err)
+	assert.Empty(t, res.BackupPath)
+	assert.Empty(t, res.UvWorkspaceBackupPath)
+	assert.NotContains(t, codes(res.Warnings), WarnUvWorkspaceConstraintsReplaced)
+	for _, dir := range []string{root, member} {
+		matches, err := filepath.Glob(filepath.Join(dir, "pyproject.toml.*.bak"))
+		require.NoError(t, err)
+		assert.Empty(t, matches, "no timestamped backup in %s", dir)
+	}
+}
+
+func TestPipelineWorkspaceConstraintsReplacedWarning(t *testing.T) {
+	p, root, _ := newMemberPipeline(t)
+	_, err := p.Run(t.Context())
+	require.NoError(t, err)
+	// Simulate another bundle's run: change the pins inside the managed block.
+	path := filepath.Join(root, pyprojectFile)
+	b, err := os.ReadFile(path)
+	require.NoError(t, err)
+	changed := strings.Replace(string(b), "constraint-dependencies = [", "constraint-dependencies = [\n    \"other==1.0\",", 1)
+	require.NoError(t, os.WriteFile(path, []byte(changed), 0o644))
+
+	res, err := p.Run(t.Context())
+	require.NoError(t, err)
+	assert.Contains(t, codes(res.Warnings), WarnUvWorkspaceConstraintsReplaced)
+}
+
+func TestPipelineWorkspaceMemberNoConstraints(t *testing.T) {
+	p, root, _ := newMemberPipeline(t)
+	p.SkipConstraints = true
+	before, err := os.ReadFile(filepath.Join(root, pyprojectFile))
+	require.NoError(t, err)
+	res, err := p.Run(t.Context())
+	require.NoError(t, err)
+	after, err := os.ReadFile(filepath.Join(root, pyprojectFile))
+	require.NoError(t, err)
+	assert.Equal(t, before, after)
+	assert.Empty(t, res.UvWorkspaceBackupPath)
+	assert.NoFileExists(t, filepath.Join(root, backupFile))
+}
+
+func TestPipelineWorkspaceMemberDryRun(t *testing.T) {
+	p, root, member := newMemberPipeline(t)
+	p.Check = true
+	before, err := os.ReadFile(filepath.Join(root, pyprojectFile))
+	require.NoError(t, err)
+	res, err := p.Run(t.Context())
+	require.NoError(t, err)
+	after, err := os.ReadFile(filepath.Join(root, pyprojectFile))
+	require.NoError(t, err)
+	assert.Equal(t, before, after)
+	require.NotNil(t, res.Plan)
+	assert.Equal(t, filepath.ToSlash(filepath.Join(member, pyprojectFile)), res.Plan.WouldWrite)
+	assert.Equal(t, filepath.ToSlash(filepath.Join(root, pyprojectFile)), res.Plan.WouldWriteUvWorkspace)
+	assert.Equal(t, filepath.ToSlash(filepath.Join(root, backupFile)), res.Plan.WouldBackupUvWorkspace)
+	assert.Contains(t, res.Plan.Diff, "workspace root")
+}
+
+func TestPipelineWorkspaceRootNotWritable(t *testing.T) {
+	if runtime.GOOS == "windows" || os.Getuid() == 0 {
+		t.Skip("directory permissions do not block writes on Windows or as root")
+	}
+	p, root, member := newMemberPipeline(t)
+	require.NoError(t, os.Chmod(root, 0o555))
+	t.Cleanup(func() { _ = os.Chmod(root, 0o755) })
+	memberBefore, err := os.ReadFile(filepath.Join(member, pyprojectFile))
+	require.NoError(t, err)
+
+	res, err := p.Run(t.Context())
+	require.Error(t, err)
+	require.NotNil(t, res.Error)
+	assert.Equal(t, ErrNotWritable, res.Error.Code)
+	assert.Contains(t, res.Error.Error(), filepath.ToSlash(root))
+	memberAfter, err := os.ReadFile(filepath.Join(member, pyprojectFile))
+	require.NoError(t, err)
+	assert.Equal(t, memberBefore, memberAfter)
+}
+
+func TestDiscoverWorkspaceRootKeepsProjectPathForm(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("symlinks need extra privileges on Windows")
+	}
+	root, _ := memberLayout(t)
+	link := filepath.Join(t.TempDir(), "link")
+	require.NoError(t, os.Symlink(root, link))
+	resolved, err := filepath.EvalSymlinks(root)
+	require.NoError(t, err)
+	// uv prints the symlink-resolved root; ProjectDir reaches the member through
+	// the link. The root must come back in ProjectDir's form so the venv path
+	// relative to the project stays "../../.venv".
+	p := &Pipeline{ProjectDir: filepath.Join(link, "bundles", "a"), PM: fakePM{root: resolved}}
+	got, _ := p.discoverWorkspaceRoot(t.Context())
+	assert.Equal(t, link, got)
+}
+
+// symlinkBelowRootLayout reaches the member through a link to the workspace's
+// bundles folder (link -> <root>/bundles), so the link sits below the root.
+func symlinkBelowRootLayout(t *testing.T) (resolvedRoot, projectDir string) {
+	t.Helper()
+	if runtime.GOOS == "windows" {
+		t.Skip("symlinks need extra privileges on Windows")
+	}
+	root, _ := memberLayout(t)
+	link := filepath.Join(t.TempDir(), "link")
+	require.NoError(t, os.Symlink(filepath.Join(root, "bundles"), link))
+	resolvedRoot, err := filepath.EvalSymlinks(root)
+	require.NoError(t, err)
+	return resolvedRoot, filepath.Join(link, "a")
+}
+
+func TestDiscoverWorkspaceRootSymlinkBelowRoot(t *testing.T) {
+	resolvedRoot, projectDir := symlinkBelowRootLayout(t)
+	// Joining "../.." onto the link path would give the link's parent, not the
+	// root; the root must still name the real workspace root.
+	p := &Pipeline{ProjectDir: projectDir, PM: fakePM{root: resolvedRoot}}
+	gotRoot, gotRel := p.discoverWorkspaceRoot(t.Context())
+	assert.Equal(t, resolvedRoot, gotRoot)
+	// Relative to the member's real folder (<root>/bundles/a).
+	assert.Equal(t, filepath.Join("..", ".."), gotRel)
+}
+
+func TestPipelineWorkspaceMemberVenvPathWithResolvedUvRoot(t *testing.T) {
+	// Real uv prints the symlink-resolved root (macOS /private/var).
+	p, root, _ := newMemberPipeline(t)
+	resolved, err := filepath.EvalSymlinks(root)
+	require.NoError(t, err)
+	p.PM = fakePM{py: "3.12", dbc: "17.2.0", root: resolved}
+	res, err := p.Run(t.Context())
+	require.NoError(t, err)
+	assert.Equal(t, "../../.venv", res.VenvPath)
+}
+
+func TestPipelineWorkspaceMemberSymlinkBelowRoot(t *testing.T) {
+	resolvedRoot, projectDir := symlinkBelowRootLayout(t)
+	require.NoError(t, os.WriteFile(filepath.Join(projectDir, pyprojectFile),
+		[]byte("[project]\nname = \"a\"\nversion = \"0.1.0\"\nrequires-python = \">=3.10\"\n"), 0o644))
+	p := newServerlessTestPipeline(t, projectDir)
+	p.PM = fakePM{py: "3.12", dbc: "17.2.0", root: resolvedRoot}
+	res, err := p.Run(t.Context())
+	require.NoError(t, err)
+	// Relative to the member's real folder (<root>/bundles/a), which is what the
+	// OS resolves a relative path against.
+	assert.Equal(t, "../../.venv", res.VenvPath)
+	rootBytes, err := os.ReadFile(filepath.Join(resolvedRoot, pyprojectFile))
+	require.NoError(t, err)
+	assert.Contains(t, string(rootBytes), "constraint-dependencies")
+}
+
+func TestPipelineWorkspaceReplacesUserRootPinsWithWarning(t *testing.T) {
+	p, root, _ := newMemberPipeline(t)
+	require.NoError(t, os.WriteFile(filepath.Join(root, pyprojectFile),
+		[]byte("[tool.uv.workspace]\nmembers = [\"bundles/*\"]\n\n[tool.uv]\nconstraint-dependencies = [\"urllib3<2\"]\n"), 0o644))
+
+	res, err := p.Run(t.Context())
+	require.NoError(t, err)
+	assert.Contains(t, codes(res.Warnings), WarnUvWorkspaceConstraintsReplaced)
+}
+
+func TestApplyMergeRootFailureBeforeAnyWriteIsNotDiskMutated(t *testing.T) {
+	// The member merge is a no-op and the root file cannot be read, so nothing on
+	// disk changed and the failure must say so.
+	_, member := memberLayout(t)
+	memberPath := filepath.Join(member, pyprojectFile)
+	current, err := os.ReadFile(memberPath)
+	require.NoError(t, err)
+	p := &Pipeline{ProjectDir: member, res: NewResult()}
+	p.res.Phases = initialPhases()
+	missing := filepath.Join(t.TempDir(), pyprojectFile)
+
+	err = p.applyMerge(t.Context(), current, &rootMerge{path: missing, merged: []byte("x"), changed: true}, false)
+	require.Error(t, err)
+	require.NotNil(t, p.res.Error)
+	assert.False(t, p.res.Error.DiskMutated)
+	assert.Contains(t, p.res.Error.Error(), "workspace root")
+}
+
+func TestApplyMergeSkipsUnchangedRoot(t *testing.T) {
+	// The plan already read the root and found no change, so applyMerge must not
+	// touch it again: a missing root file is not an error here.
+	_, member := memberLayout(t)
+	current, err := os.ReadFile(filepath.Join(member, pyprojectFile))
+	require.NoError(t, err)
+	p := &Pipeline{ProjectDir: member, res: NewResult()}
+	p.res.Phases = initialPhases()
+	missing := filepath.Join(t.TempDir(), pyprojectFile)
+
+	err = p.applyMerge(t.Context(), current, &rootMerge{path: missing, merged: []byte("x")}, false)
+	require.NoError(t, err)
+	assert.Empty(t, p.res.UvWorkspaceBackupPath)
+}
+
+func TestDiscoverWorkspaceRootSymlinkChangesDepth(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("symlinks need extra privileges on Windows")
+	}
+	// <root>/link -> <root>/deep/bundles: the logical path reaches the root in
+	// two levels, but the OS resolves a relative path from the real member folder
+	// (<root>/deep/bundles/a), three levels below the root.
+	root := t.TempDir()
+	real := filepath.Join(root, "deep", "bundles", "a")
+	require.NoError(t, os.MkdirAll(real, 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(real, pyprojectFile), []byte("[project]\nname = \"a\"\n"), 0o644))
+	require.NoError(t, os.Symlink(filepath.Join(root, "deep", "bundles"), filepath.Join(root, "link")))
+
+	p := &Pipeline{ProjectDir: filepath.Join(root, "link", "a"), PM: fakePM{root: root}}
+	gotRoot, gotRel := p.discoverWorkspaceRoot(t.Context())
+	assert.Equal(t, root, gotRoot)
+	assert.Equal(t, filepath.Join("..", "..", ".."), gotRel)
+}
+
+func TestPipelineWorkspaceMemberDryRunReRunPlansNoRootWrite(t *testing.T) {
+	p, _, _ := newMemberPipeline(t)
+	_, err := p.Run(t.Context())
+	require.NoError(t, err)
+
+	p.Check = true
+	res, err := p.Run(t.Context())
+	require.NoError(t, err)
+	require.NotNil(t, res.Plan)
+	assert.Empty(t, res.Plan.WouldWriteUvWorkspace)
+	assert.Empty(t, res.Plan.WouldBackupUvWorkspace)
+	assert.NotEmpty(t, res.UvWorkspaceRoot)
+}
+
+// cancelDiscoveryPM cancels the run while workspace discovery runs, like a
+// SIGINT that interrupts `uv workspace dir`.
+type cancelDiscoveryPM struct {
+	fakePM
+	cancel context.CancelFunc
+}
+
+func (f cancelDiscoveryPM) WorkspaceRoot(ctx context.Context, _ string) (string, error) {
+	f.cancel()
+	return "", ctx.Err()
+}
+
+func TestPipelineCancelDuringDiscoveryWritesNothing(t *testing.T) {
+	p, root, member := newMemberPipeline(t)
+	// A first run fills the constraint cache, so the canceled run below can
+	// still fetch; then the member file is reset so a merge would change it.
+	_, err := p.Run(t.Context())
+	require.NoError(t, err)
+	require.NoError(t, os.WriteFile(filepath.Join(member, pyprojectFile),
+		[]byte("[project]\nname = \"a\"\nversion = \"0.1.0\"\nrequires-python = \">=3.10\"\n"), 0o644))
+
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+	p.PM = cancelDiscoveryPM{py: "3.12", dbc: "17.2.0", root: root, cancel: cancel}
+	before, err := os.ReadFile(filepath.Join(member, pyprojectFile))
+	require.NoError(t, err)
+
+	res, err := p.Run(ctx)
+	require.Error(t, err)
+	require.NotNil(t, res.Error)
+	assert.Equal(t, ErrCanceled, res.Error.Code)
+	assert.False(t, res.Error.DiskMutated)
+	after, err := os.ReadFile(filepath.Join(member, pyprojectFile))
+	require.NoError(t, err)
+	assert.Equal(t, before, after)
+}
diff --git a/libs/locker/locker.go b/libs/locker/locker.go
index 4a094ba0280..857139c79b4 100644
--- a/libs/locker/locker.go
+++ b/libs/locker/locker.go
@@ -10,10 +10,11 @@ import (
 	"io/fs"
 	"slices"
 	"time"
+	"uuid"
 
 	"github.com/databricks/cli/libs/filer"
+	"github.com/databricks/cli/libs/retry"
 	"github.com/databricks/databricks-sdk-go"
-	"github.com/google/uuid"
 )
 
 type UnlockOption int
@@ -105,10 +106,16 @@ func (locker *Locker) assertLockHeld(ctx context.Context) error {
 		return err
 	}
 	if activeLockState.ID != locker.State.ID && !activeLockState.IsForced {
-		return fmt.Errorf("deploy lock acquired by %s at %v. Use --force-lock to override", activeLockState.User, activeLockState.AcquisitionTime)
+		return fmt.Errorf("deploy lock acquired by %s at %v.\n"+
+			"Another deployment may be in progress. Use --force-lock to override, but this may\n"+
+			"conflict with the other deployment if it is still active",
+			activeLockState.User, activeLockState.AcquisitionTime)
 	}
 	if activeLockState.ID != locker.State.ID && activeLockState.IsForced {
-		return fmt.Errorf("deploy lock force acquired by %s at %v. Use --force-lock to override", activeLockState.User, activeLockState.AcquisitionTime)
+		return fmt.Errorf("deploy lock force-acquired by %s at %v.\n"+
+			"Another deployment may be in progress. Use --force-lock to override, but this may\n"+
+			"conflict with the other deployment if it is still active",
+			activeLockState.User, activeLockState.AcquisitionTime)
 	}
 	return nil
 }
@@ -203,7 +210,7 @@ func CreateLocker(user, targetDir string, w *databricks.WorkspaceClient) (*Locke
 	}
 
 	locker := &Locker{
-		filer: filer,
+		filer: retry.Filer(filer),
 
 		TargetDir: targetDir,
 		Active:    false,
diff --git a/libs/log/context.go b/libs/log/context.go
index 5e3e8ccb652..457b918b149 100644
--- a/libs/log/context.go
+++ b/libs/log/context.go
@@ -9,6 +9,22 @@ type logger int
 
 var loggerKey logger
 
+type prefixKeyType struct{}
+
+// WithPrefix returns a context that prepends prefix to every log message emitted from it.
+// Calling WithPrefix on a context that already has a prefix appends with ": ".
+func WithPrefix(ctx context.Context, prefix string) context.Context {
+	if existing, _ := ctx.Value(prefixKeyType{}).(string); existing != "" {
+		prefix = existing + ": " + prefix
+	}
+	return context.WithValue(ctx, prefixKeyType{}, prefix)
+}
+
+func getPrefix(ctx context.Context) string {
+	prefix, _ := ctx.Value(prefixKeyType{}).(string)
+	return prefix
+}
+
 // NewContext returns a new Context that carries the specified logger.
 //
 // Discussion why this is not part of slog itself: https://github.com/golang/go/issues/58243.
diff --git a/libs/log/logger.go b/libs/log/logger.go
index 74347b1ab19..0687634ec73 100644
--- a/libs/log/logger.go
+++ b/libs/log/logger.go
@@ -20,6 +20,9 @@ func GetLogger(ctx context.Context) *slog.Logger {
 
 // helper function to abstract logging a string message.
 func log(ctx context.Context, logger *slog.Logger, level slog.Level, msg string) {
+	if prefix := getPrefix(ctx); prefix != "" {
+		msg = prefix + ": " + msg
+	}
 	var pcs [1]uintptr
 	// skip [runtime.Callers, this function, this function's caller].
 	runtime.Callers(3, pcs[:])
diff --git a/libs/logdiag/logdiag.go b/libs/logdiag/logdiag.go
index 896d105751b..28ed3b5ba21 100644
--- a/libs/logdiag/logdiag.go
+++ b/libs/logdiag/logdiag.go
@@ -48,6 +48,12 @@ func InitContext(ctx context.Context) context.Context {
 	if ok {
 		panic("internal error: must not call InitContext() twice")
 	}
+	return IsolatedContext(ctx)
+}
+
+// IsolatedContext returns a child context with a fresh diagnostics state;
+// diagnostics logged through it do not affect the parent's.
+func IsolatedContext(ctx context.Context) context.Context {
 	val := LogDiagData{
 		TargetSeverity: 255,
 		mu:             &sync.Mutex{},
diff --git a/libs/logdiag/logdiag_test.go b/libs/logdiag/logdiag_test.go
new file mode 100644
index 00000000000..ecf12ee78d1
--- /dev/null
+++ b/libs/logdiag/logdiag_test.go
@@ -0,0 +1,24 @@
+package logdiag_test
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/databricks/cli/libs/logdiag"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestIsolatedContext(t *testing.T) {
+	ctx := logdiag.InitContext(t.Context())
+	logdiag.SetCollect(ctx, true)
+
+	isolated := logdiag.IsolatedContext(ctx)
+	logdiag.SetCollect(isolated, true)
+	logdiag.LogError(isolated, errors.New("inner failure"))
+
+	assert.True(t, logdiag.HasError(isolated))
+	assert.Len(t, logdiag.FlushCollected(isolated), 1)
+
+	assert.False(t, logdiag.HasError(ctx))
+	assert.Empty(t, logdiag.FlushCollected(ctx))
+}
diff --git a/libs/notebook/detect.go b/libs/notebook/detect.go
index 579cc1de34c..d9be548a5c6 100644
--- a/libs/notebook/detect.go
+++ b/libs/notebook/detect.go
@@ -44,10 +44,10 @@ func (f file) close() error {
 	return f.f.Close()
 }
 
-func (f file) readHeader() (string, error) {
+func readHeader(r io.Reader) (string, error) {
 	// Scan header line with some padding.
 	buf := make([]byte, headerLength)
-	n, err := f.f.Read(buf)
+	n, err := r.Read(buf)
 	if err != nil && err != io.EOF {
 		return "", err
 	}
@@ -80,8 +80,6 @@ func (f file) getObjectInfo() (oi workspace.ObjectInfo, ok bool, err error) {
 // Detect returns whether the file at path is a Databricks notebook.
 // If it is, it returns the notebook language.
 func DetectWithFS(fsys fs.FS, name string) (notebook bool, language workspace.Language, err error) {
-	header := ""
-
 	f, err := openFile(fsys, name)
 	if err != nil {
 		return false, "", err
@@ -98,12 +96,39 @@ func DetectWithFS(fsys fs.FS, name string) (notebook bool, language workspace.La
 		return oi.ObjectType == workspace.ObjectTypeNotebook, oi.Language, nil
 	}
 
+	if strings.ToLower(filepath.Ext(name)) == ExtensionJupyter {
+		return DetectJupyterWithFS(fsys, name)
+	}
+
 	// Read the first line of the file.
-	fileHeader, err := f.readHeader()
+	fileHeader, err := readHeader(f.f)
+	if err != nil {
+		return false, "", err
+	}
+
+	notebook, language = detectSource(name, fileHeader)
+	return notebook, language, nil
+}
+
+// DetectBytes is like [DetectWithFS] for file content that is already in memory.
+func DetectBytes(name string, content []byte) (notebook bool, language workspace.Language, err error) {
+	if strings.ToLower(filepath.Ext(name)) == ExtensionJupyter {
+		return detectJupyter(name, bytes.NewReader(content))
+	}
+
+	fileHeader, err := readHeader(bytes.NewReader(content))
 	if err != nil {
 		return false, "", err
 	}
 
+	notebook, language = detectSource(name, fileHeader)
+	return notebook, language, nil
+}
+
+// detectSource reports whether a source file with the given name and first line is a notebook.
+func detectSource(name, fileHeader string) (notebook bool, language workspace.Language) {
+	header := ""
+
 	// Determine which header to expect based on filename extension.
 	ext := strings.ToLower(filepath.Ext(name))
 	switch ext {
@@ -119,17 +144,15 @@ func DetectWithFS(fsys fs.FS, name string) (notebook bool, language workspace.La
 	case ExtensionSql:
 		header = "-- Databricks notebook source"
 		language = workspace.LanguageSql
-	case ExtensionJupyter:
-		return DetectJupyterWithFS(fsys, name)
 	default:
-		return false, "", nil
+		return false, ""
 	}
 
 	if fileHeader != header {
-		return false, "", nil
+		return false, ""
 	}
 
-	return true, language, nil
+	return true, language
 }
 
 // Detect calls DetectWithFS with the local filesystem.
diff --git a/libs/notebook/detect_jupyter.go b/libs/notebook/detect_jupyter.go
index f631b58127b..45233414007 100644
--- a/libs/notebook/detect_jupyter.go
+++ b/libs/notebook/detect_jupyter.go
@@ -3,6 +3,7 @@ package notebook
 import (
 	"encoding/json"
 	"fmt"
+	"io"
 	"io/fs"
 	"os"
 	"path/filepath"
@@ -66,8 +67,12 @@ func DetectJupyterWithFS(fsys fs.FS, name string) (notebook bool, language works
 
 	defer f.Close()
 
+	return detectJupyter(name, f)
+}
+
+func detectJupyter(name string, r io.Reader) (notebook bool, language workspace.Language, err error) {
 	var nb jupyter
-	dec := json.NewDecoder(f)
+	dec := json.NewDecoder(r)
 	err = dec.Decode(&nb)
 	if err != nil {
 		return false, "", fmt.Errorf("%s: error loading Jupyter notebook file: %w", name, err)
diff --git a/libs/notebook/detect_test.go b/libs/notebook/detect_test.go
index 49a67d2d3ed..c774612c9bf 100644
--- a/libs/notebook/detect_test.go
+++ b/libs/notebook/detect_test.go
@@ -127,3 +127,30 @@ func TestDetectWithObjectInfo(t *testing.T) {
 	assert.True(t, nb)
 	assert.Equal(t, workspace.LanguagePython, lang)
 }
+
+func TestDetectBytes(t *testing.T) {
+	ipynb, err := os.ReadFile("testdata/py_ipynb.ipynb")
+	require.NoError(t, err)
+
+	tests := []struct {
+		name     string
+		content  []byte
+		notebook bool
+		language workspace.Language
+	}{
+		{"nb.py", []byte("# Databricks notebook source\nprint(1)\n"), true, workspace.LanguagePython},
+		{"nb.sql", []byte("-- Databricks notebook source\nSELECT 1\n"), true, workspace.LanguageSql},
+		{"nb.ipynb", ipynb, true, workspace.LanguagePython},
+		{"plain.py", []byte("print(1)\n"), false, ""},
+		{"space.geniespace.json", []byte("{}"), false, ""},
+		{"empty.py", nil, false, ""},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			nb, lang, err := DetectBytes(tc.name, tc.content)
+			require.NoError(t, err)
+			assert.Equal(t, tc.notebook, nb)
+			assert.Equal(t, tc.language, lang)
+		})
+	}
+}
diff --git a/libs/notebook/ext.go b/libs/notebook/ext.go
index bbffe23c2d2..69d6eab6c92 100644
--- a/libs/notebook/ext.go
+++ b/libs/notebook/ext.go
@@ -1,6 +1,11 @@
 package notebook
 
-import "github.com/databricks/databricks-sdk-go/service/workspace"
+import (
+	"path"
+	"strings"
+
+	"github.com/databricks/databricks-sdk-go/service/workspace"
+)
 
 const (
 	ExtensionNone    string = ""
@@ -9,8 +14,40 @@ const (
 	ExtensionScala   string = ".scala"
 	ExtensionSql     string = ".sql"
 	ExtensionJupyter string = ".ipynb"
+	// ExtensionDesigner is the compound suffix for Lakeflow Designer files.
+	// Unlike other notebook types, designer files keep this full suffix when
+	// imported into the workspace.
+	ExtensionDesigner string = ".designer.ipynb"
 )
 
+// ObjectTypeDesignerFile is the workspace object type for Lakeflow Designer
+// notebooks. The SDK does not define a constant for it.
+const ObjectTypeDesignerFile workspace.ObjectType = "DESIGNER_FILE"
+
+// StripExtension returns the workspace path for a local notebook file.
+// Designer files keep their full ".designer.ipynb" suffix in the workspace;
+// other notebook types lose their extension on import.
+func StripExtension(name string) string {
+	if strings.HasSuffix(name, ExtensionDesigner) {
+		return name
+	}
+	return strings.TrimSuffix(name, path.Ext(name))
+}
+
+// FixedExportFormat returns the export format an object type must be downloaded
+// in when get-status reports none for it. Lakeflow Designer files (DESIGNER_FILE)
+// carry their full extension in the workspace path and round-trip as Jupyter
+// notebooks. The boolean is false for object types that report their own export
+// format (e.g. regular notebooks).
+func FixedExportFormat(objectType workspace.ObjectType) (workspace.ExportFormat, bool) {
+	switch objectType {
+	case ObjectTypeDesignerFile:
+		return workspace.ExportFormatJupyter, true
+	default:
+		return "", false
+	}
+}
+
 // Extensions lists all notebook file extensions.
 var Extensions = []string{
 	ExtensionPython,
diff --git a/libs/notebook/ext_test.go b/libs/notebook/ext_test.go
new file mode 100644
index 00000000000..7ccd0d33af8
--- /dev/null
+++ b/libs/notebook/ext_test.go
@@ -0,0 +1,44 @@
+package notebook
+
+import (
+	"testing"
+
+	"github.com/databricks/databricks-sdk-go/service/workspace"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestStripExtension(t *testing.T) {
+	for _, tc := range []struct {
+		in   string
+		want string
+	}{
+		{"foo.py", "foo"},
+		{"foo.ipynb", "foo"},
+		{"foo.r", "foo"},
+		{"foo.scala", "foo"},
+		{"foo.sql", "foo"},
+		{"a/b/c.ipynb", "a/b/c"},
+
+		// Designer files keep their full ".designer.ipynb" suffix.
+		{"foo.designer.ipynb", "foo.designer.ipynb"},
+		{"a/b/c.designer.ipynb", "a/b/c.designer.ipynb"},
+
+		// Files without a known extension are passed through path.Ext;
+		// the last-segment extension is removed.
+		{"foo", "foo"},
+		{"foo.unknown", "foo"},
+	} {
+		assert.Equal(t, tc.want, StripExtension(tc.in), "input=%q", tc.in)
+	}
+}
+
+func TestFixedExportFormat(t *testing.T) {
+	// Designer files report no export format and must round-trip as Jupyter.
+	format, ok := FixedExportFormat(ObjectTypeDesignerFile)
+	assert.True(t, ok)
+	assert.Equal(t, workspace.ExportFormatJupyter, format)
+
+	// Regular notebooks report their own export format.
+	_, ok = FixedExportFormat(workspace.ObjectTypeNotebook)
+	assert.False(t, ok)
+}
diff --git a/libs/patchwheel/extras.go b/libs/patchwheel/extras.go
new file mode 100644
index 00000000000..ed41ab2857e
--- /dev/null
+++ b/libs/patchwheel/extras.go
@@ -0,0 +1,20 @@
+package patchwheel
+
+import (
+	"regexp"
+	"strings"
+)
+
+// Matches a pip extras suffix right after ".whl", e.g. "[train]" in "pkg.whl[train]".
+// Anchored so glob classes elsewhere (e.g. "pkg[12].whl") are left alone.
+var wheelExtrasRegex = regexp.MustCompile(`(?i)\.whl(\[[^\]]*\])$`)
+
+// SplitWheelExtras splits a wheel path into its base and pip extras suffix (e.g. "[train]").
+func SplitWheelExtras(path string) (string, string) {
+	m := wheelExtrasRegex.FindStringSubmatch(path)
+	if m == nil {
+		return path, ""
+	}
+	extras := m[1]
+	return strings.TrimSuffix(path, extras), extras
+}
diff --git a/libs/patchwheel/extras_test.go b/libs/patchwheel/extras_test.go
new file mode 100644
index 00000000000..93cbd9938a2
--- /dev/null
+++ b/libs/patchwheel/extras_test.go
@@ -0,0 +1,85 @@
+package patchwheel
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestSplitWheelExtras(t *testing.T) {
+	tests := []struct {
+		name       string
+		input      string
+		wantPath   string
+		wantExtras string
+	}{
+		{
+			name:       "basic extras",
+			input:      "./dist/foo.whl[train]",
+			wantPath:   "./dist/foo.whl",
+			wantExtras: "[train]",
+		},
+		{
+			name:       "multiple extras",
+			input:      "./dist/foo.whl[train,test]",
+			wantPath:   "./dist/foo.whl",
+			wantExtras: "[train,test]",
+		},
+		{
+			name:       "brackets in the middle are not extras",
+			input:      "./dist/foo[12].whl",
+			wantPath:   "./dist/foo[12].whl",
+			wantExtras: "",
+		},
+		{
+			name:       "brackets in the middle with trailing extras",
+			input:      "./dist/foo[12].whl[train]",
+			wantPath:   "./dist/foo[12].whl",
+			wantExtras: "[train]",
+		},
+		{
+			name:       "non-bracket suffix is not extras",
+			input:      "./dist/foo.whl.bak",
+			wantPath:   "./dist/foo.whl.bak",
+			wantExtras: "",
+		},
+		{
+			name:       "glob characters with extras",
+			input:      "./dist/*.whl[train]",
+			wantPath:   "./dist/*.whl",
+			wantExtras: "[train]",
+		},
+		{
+			name:       "no extras",
+			input:      "./dist/foo.whl",
+			wantPath:   "./dist/foo.whl",
+			wantExtras: "",
+		},
+		{
+			name:       "case insensitive extension",
+			input:      "./dist/foo.WHL[train]",
+			wantPath:   "./dist/foo.WHL",
+			wantExtras: "[train]",
+		},
+		{
+			name:       "empty extras",
+			input:      "./dist/foo.whl[]",
+			wantPath:   "./dist/foo.whl",
+			wantExtras: "[]",
+		},
+		{
+			name:       "unclosed bracket is not extras",
+			input:      "./dist/foo.whl[train",
+			wantPath:   "./dist/foo.whl[train",
+			wantExtras: "",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			path, extras := SplitWheelExtras(tt.input)
+			assert.Equal(t, tt.wantPath, path)
+			assert.Equal(t, tt.wantExtras, extras)
+		})
+	}
+}
diff --git a/libs/process/background.go b/libs/process/background.go
index 2649d0ef2c6..e1b20414aec 100644
--- a/libs/process/background.go
+++ b/libs/process/background.go
@@ -47,7 +47,11 @@ func Background(ctx context.Context, args []string, opts ...execOption) (string,
 			return "", err
 		}
 	}
-	if err := runCmd(ctx, cmd); err != nil {
+	err := runCmd(ctx, cmd)
+	// Sweep the process group (WithProcessGroup + cancelled context only) so a
+	// grandchild that outlived a SIGKILLed leader is not re-orphaned.
+	reapProcessGroup(ctx, cmd)
+	if err != nil {
 		return stdout.String(), &ProcessError{
 			Err:     err,
 			Command: commandStr,
diff --git a/libs/process/background_test.go b/libs/process/background_test.go
index ecc73c657d7..205c87b2f25 100644
--- a/libs/process/background_test.go
+++ b/libs/process/background_test.go
@@ -89,7 +89,7 @@ func TestBackgroundNoStdin(t *testing.T) {
 	ctx := t.Context()
 	res, err := Background(ctx, []string{"cat"})
 	assert.NoError(t, err)
-	assert.Equal(t, "", res)
+	assert.Empty(t, res)
 }
 
 func TestBackgroundFails(t *testing.T) {
diff --git a/libs/process/forwarded.go b/libs/process/forwarded.go
index 1d7fdb71e4d..91070f6c96b 100644
--- a/libs/process/forwarded.go
+++ b/libs/process/forwarded.go
@@ -34,5 +34,9 @@ func Forwarded(ctx context.Context, args []string, src io.Reader, outWriter, err
 		}
 	}
 
-	return runCmd(ctx, cmd)
+	err := runCmd(ctx, cmd)
+	// Sweep the process group (WithProcessGroup + cancelled context only) so a
+	// grandchild that outlived a SIGKILLed leader is not re-orphaned.
+	reapProcessGroup(ctx, cmd)
+	return err
 }
diff --git a/libs/process/group.go b/libs/process/group.go
new file mode 100644
index 00000000000..24b3e289dd0
--- /dev/null
+++ b/libs/process/group.go
@@ -0,0 +1,9 @@
+package process
+
+import "time"
+
+// processGroupGracePeriod bounds how long WithProcessGroup waits after the
+// context is cancelled before escalating to SIGKILL. It mirrors the 10s grace
+// period used elsewhere for subprocess termination (see experimental/ssh). It is
+// a var, not a const, only so the escalation test can shorten it.
+var processGroupGracePeriod = 10 * time.Second
diff --git a/libs/process/group_other.go b/libs/process/group_other.go
new file mode 100644
index 00000000000..29c1a1b8c33
--- /dev/null
+++ b/libs/process/group_other.go
@@ -0,0 +1,29 @@
+//go:build !unix
+
+package process
+
+import (
+	"context"
+	"os/exec"
+)
+
+// WithProcessGroup sets a WaitDelay so a cancelled command does not block
+// indefinitely on a stuck child.
+//
+// Unlike the Unix build, this does not reap the child's descendants: killing a
+// whole process tree on Windows requires a Job Object (CreateJobObject +
+// AssignProcessToJobObject with JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE), which is
+// out of scope here. The direct child is still terminated by the default
+// cancellation, and the caller's signal handler still fires; only grandchildren
+// spawned by the child may outlive it.
+func WithProcessGroup() execOption {
+	return func(_ context.Context, c *exec.Cmd) error {
+		c.WaitDelay = processGroupGracePeriod
+		return nil
+	}
+}
+
+// reapProcessGroup is a no-op on non-unix builds: there is no process group to
+// sweep (WithProcessGroup does not set Setpgid here). See the unix build for the
+// group-SIGKILL escalation this closes.
+func reapProcessGroup(_ context.Context, _ *exec.Cmd) {}
diff --git a/libs/process/group_unix.go b/libs/process/group_unix.go
new file mode 100644
index 00000000000..8f0adb225aa
--- /dev/null
+++ b/libs/process/group_unix.go
@@ -0,0 +1,71 @@
+//go:build unix
+
+package process
+
+import (
+	"context"
+	"errors"
+	"os"
+	"os/exec"
+	"syscall"
+)
+
+// WithProcessGroup makes the child the leader of a new process group and, when
+// the context is cancelled, signals the entire group rather than just the child.
+//
+// exec.CommandContext's default cancellation only SIGKILLs the direct child, so
+// a tool that fans out to its own subprocesses (e.g. `uv sync` spawning Python
+// and build backends) leaves those grandchildren running as orphans when the CLI
+// receives SIGINT/SIGTERM. Putting the child in its own group and signalling the
+// group (negative PID) delivers SIGTERM to every descendant at once, giving them
+// a chance to exit cleanly.
+//
+// Two backstops handle a member that ignores SIGTERM: WaitDelay bounds how long
+// Wait blocks on a hung leader (Go then SIGKILLs the leader and closes the pipes
+// so Wait returns), and reapProcessGroup sends a final group-wide SIGKILL after
+// Wait returns. The second is necessary because Go's WaitDelay escalation targets
+// the leader PID only, not the group — without it a grandchild that outlives a
+// SIGKILLed leader would be re-orphaned.
+func WithProcessGroup() execOption {
+	return func(_ context.Context, c *exec.Cmd) error {
+		if c.SysProcAttr == nil {
+			c.SysProcAttr = &syscall.SysProcAttr{}
+		}
+		c.SysProcAttr.Setpgid = true
+
+		c.WaitDelay = processGroupGracePeriod
+		c.Cancel = func() error {
+			// With Setpgid and Pgid unset, the child's group ID equals its PID;
+			// a negative PID targets the whole group. Map "no such process" to
+			// os.ErrProcessDone so a benign exit/cancel race is not surfaced as a
+			// Wait error.
+			err := syscall.Kill(-c.Process.Pid, syscall.SIGTERM)
+			if errors.Is(err, syscall.ESRCH) {
+				return os.ErrProcessDone
+			}
+			return err
+		}
+		return nil
+	}
+}
+
+// reapProcessGroup sends a final SIGKILL to the child's process group after the
+// command has been waited on, closing the gap left by Go's WaitDelay escalation
+// (which SIGKILLs only the leader PID). It runs only for a WithProcessGroup child
+// whose context was cancelled — the escalation path — so a normally-exited
+// command is never signalled.
+//
+// It is safe against PID reuse: this runs synchronously after Wait has returned
+// (the leader is reaped), not on a delayed timer. The group ID stays reserved by
+// the kernel while any member is alive, so kill(-pgid) hits surviving descendants
+// or returns ESRCH on an already-empty group; there is no 10s window in which the
+// PGID could be reused by an unrelated group before the signal is sent.
+func reapProcessGroup(ctx context.Context, c *exec.Cmd) {
+	if c.SysProcAttr == nil || !c.SysProcAttr.Setpgid {
+		return
+	}
+	if c.Process == nil || ctx.Err() == nil {
+		return
+	}
+	_ = syscall.Kill(-c.Process.Pid, syscall.SIGKILL)
+}
diff --git a/libs/process/group_unix_test.go b/libs/process/group_unix_test.go
new file mode 100644
index 00000000000..3db07a9bac9
--- /dev/null
+++ b/libs/process/group_unix_test.go
@@ -0,0 +1,109 @@
+//go:build unix
+
+package process
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestWithProcessGroupReapsGrandchild verifies that cancelling the context kills
+// the whole process group, not just the direct child. The shell (the group
+// leader) backgrounds a long sleep — a grandchild of the test process — and
+// records its PID; after cancellation that grandchild must be gone.
+func TestWithProcessGroupReapsGrandchild(t *testing.T) {
+	ctx, cancel := context.WithCancel(t.Context())
+
+	pidFile := filepath.Join(t.TempDir(), "grandchild.pid")
+	// $1 is pidFile: background a sleep, record its PID, then wait on it so the
+	// shell stays alive as the group leader until the group is signalled.
+	script := []string{"sh", "-c", `sleep 300 & echo $! > "$1"; wait`, "sh", pidFile}
+
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		_, _ = Background(ctx, script, WithProcessGroup())
+	}()
+
+	grandchildPid := waitForPid(t, pidFile)
+
+	cancel()
+
+	select {
+	case <-done:
+	case <-time.After(processGroupGracePeriod + 5*time.Second):
+		t.Fatal("Background did not return after context cancellation")
+	}
+
+	// The grandchild inherited the leader's group, so the group SIGTERM reaches
+	// it directly. Poll briefly to let the kernel deliver the signal and reap it.
+	assert.Eventually(t, func() bool {
+		return errors.Is(syscall.Kill(grandchildPid, 0), syscall.ESRCH)
+	}, 5*time.Second, 20*time.Millisecond, "grandchild %d was orphaned, not reaped", grandchildPid)
+}
+
+// TestWithProcessGroupReapsGrandchildAfterEscalation covers the SIGKILL
+// escalation path: a leader that ignores SIGTERM (trap ” TERM). The group
+// SIGTERM from Cancel does nothing, so WaitDelay expires and Go SIGKILLs the
+// leader PID only — leaving the grandchild that this option exists to reap. The
+// post-Wait group sweep (reapProcessGroup) must SIGKILL the whole group so the
+// grandchild does not survive.
+func TestWithProcessGroupReapsGrandchildAfterEscalation(t *testing.T) {
+	// Shorten the grace period so the WaitDelay escalation fires quickly.
+	orig := processGroupGracePeriod
+	processGroupGracePeriod = 500 * time.Millisecond
+	t.Cleanup(func() { processGroupGracePeriod = orig })
+
+	ctx, cancel := context.WithCancel(t.Context())
+
+	pidFile := filepath.Join(t.TempDir(), "grandchild.pid")
+	// The leader ignores SIGTERM, so only the escalation can stop it; the sleep
+	// grandchild inherits the group but not the trap.
+	script := []string{"sh", "-c", `trap '' TERM; sleep 300 & echo $! > "$1"; wait`, "sh", pidFile}
+
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		_, _ = Background(ctx, script, WithProcessGroup())
+	}()
+
+	grandchildPid := waitForPid(t, pidFile)
+
+	cancel()
+
+	select {
+	case <-done:
+	case <-time.After(processGroupGracePeriod + 10*time.Second):
+		t.Fatal("Background did not return after escalation")
+	}
+
+	assert.Eventually(t, func() bool {
+		return errors.Is(syscall.Kill(grandchildPid, 0), syscall.ESRCH)
+	}, 5*time.Second, 20*time.Millisecond,
+		"grandchild %d survived the SIGKILL escalation (re-orphaned)", grandchildPid)
+}
+
+// waitForPid waits for the shell to write the grandchild PID and returns it.
+func waitForPid(t *testing.T, pidFile string) int {
+	t.Helper()
+	var pid int
+	require.Eventually(t, func() bool {
+		b, err := os.ReadFile(pidFile)
+		if err != nil {
+			return false
+		}
+		pid, err = strconv.Atoi(strings.TrimSpace(string(b)))
+		return err == nil && pid > 0
+	}, 5*time.Second, 20*time.Millisecond, "grandchild PID was never recorded")
+	return pid
+}
diff --git a/libs/psql/connect.go b/libs/psql/connect.go
index 2cb89e95956..91ecada0f21 100644
--- a/libs/psql/connect.go
+++ b/libs/psql/connect.go
@@ -147,8 +147,7 @@ func attemptConnection(ctx context.Context, args, env []string) error {
 
 	err = cmd.Wait()
 	if err != nil {
-		var exitError *exec.ExitError
-		if errors.As(err, &exitError) {
+		if exitError, ok := errors.AsType[*exec.ExitError](err); ok {
 			// psql returns exit code 2 for fatal errors
 			if exitError.ExitCode() == 2 {
 				connErr := fmt.Errorf("connection failed: psql exited with code %d", exitError.ExitCode())
diff --git a/libs/python/pythontest/pythontest.go b/libs/python/pythontest/pythontest.go
deleted file mode 100644
index 89433714725..00000000000
--- a/libs/python/pythontest/pythontest.go
+++ /dev/null
@@ -1,108 +0,0 @@
-package pythontest
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"runtime"
-	"strings"
-	"testing"
-
-	"github.com/databricks/cli/internal/testutil"
-	"github.com/databricks/cli/libs/env"
-	"github.com/stretchr/testify/require"
-)
-
-type VenvOpts struct {
-	// input
-	PythonVersion    string
-	skipVersionCheck bool
-
-	// input/output
-	Dir  string
-	Name string
-
-	// output:
-	// Absolute path to venv
-	EnvPath string
-
-	// Absolute path to venv/bin or venv/Scripts, depending on OS
-	BinPath string
-
-	// Absolute path to python binary
-	PythonExe string
-}
-
-func CreatePythonEnv(opts *VenvOpts) error {
-	if opts == nil || opts.PythonVersion == "" {
-		return errors.New("PythonVersion must be provided")
-	}
-	if opts.Name == "" {
-		opts.Name = testutil.RandomName("test-venv-")
-	}
-
-	cmd := exec.Command("uv", "venv", opts.Name, "--python", opts.PythonVersion, "-q")
-	cmd.Stdout = os.Stdout
-	cmd.Stderr = os.Stderr
-	cmd.Dir = opts.Dir
-	err := cmd.Run()
-	if err != nil {
-		return err
-	}
-
-	opts.EnvPath, err = filepath.Abs(filepath.Join(opts.Dir, opts.Name))
-	if err != nil {
-		return err
-	}
-
-	_, err = os.Stat(opts.EnvPath)
-	if err != nil {
-		return fmt.Errorf("cannot stat EnvPath %s: %s", opts.EnvPath, err)
-	}
-
-	if runtime.GOOS == "windows" {
-		// https://github.com/pypa/virtualenv/commit/993ba1316a83b760370f5a3872b3f5ef4dd904c1
-		opts.BinPath = filepath.Join(opts.EnvPath, "Scripts")
-		opts.PythonExe = filepath.Join(opts.BinPath, "python.exe")
-	} else {
-		opts.BinPath = filepath.Join(opts.EnvPath, "bin")
-		opts.PythonExe = filepath.Join(opts.BinPath, "python3")
-	}
-
-	_, err = os.Stat(opts.BinPath)
-	if err != nil {
-		return fmt.Errorf("cannot stat BinPath %s: %s", opts.BinPath, err)
-	}
-
-	_, err = os.Stat(opts.PythonExe)
-	if err != nil {
-		return fmt.Errorf("cannot stat PythonExe %s: %s", opts.PythonExe, err)
-	}
-
-	if !opts.skipVersionCheck {
-		cmd := exec.Command(opts.PythonExe, "--version")
-		out, err := cmd.CombinedOutput()
-		if err != nil {
-			return fmt.Errorf("failed to run %s --version: %s", opts.PythonExe, err)
-		}
-		outString := string(out)
-		expectVersion := "Python " + opts.PythonVersion
-		if !strings.HasPrefix(outString, expectVersion) {
-			return fmt.Errorf("unexpected output from %s --version: %v (expected %v)", opts.PythonExe, outString, expectVersion)
-		}
-	}
-
-	return nil
-}
-
-func RequireActivatedPythonEnv(t *testing.T, ctx context.Context, opts *VenvOpts) {
-	err := CreatePythonEnv(opts)
-	require.NoError(t, err)
-	require.DirExists(t, opts.BinPath)
-
-	newPath := fmt.Sprintf("%s%c%s", opts.BinPath, os.PathListSeparator, env.Get(ctx, "PATH"))
-	t.Setenv("PATH", newPath)
-}
diff --git a/libs/python/pythontest/pythontest_test.go b/libs/python/pythontest/pythontest_test.go
deleted file mode 100644
index b4f270afff1..00000000000
--- a/libs/python/pythontest/pythontest_test.go
+++ /dev/null
@@ -1,42 +0,0 @@
-package pythontest
-
-import (
-	"os/exec"
-	"path/filepath"
-	"testing"
-
-	"github.com/databricks/cli/libs/python"
-	"github.com/stretchr/testify/require"
-)
-
-func TestVenvSuccess(t *testing.T) {
-	// Test at least two version to ensure we capture a case where venv version does not match system one
-	for _, pythonVersion := range []string{"3.11", "3.12"} {
-		t.Run(pythonVersion, func(t *testing.T) {
-			ctx := t.Context()
-			dir := t.TempDir()
-			opts := VenvOpts{
-				PythonVersion: pythonVersion,
-				Dir:           dir,
-			}
-			RequireActivatedPythonEnv(t, ctx, &opts)
-			require.DirExists(t, opts.EnvPath)
-			require.DirExists(t, opts.BinPath)
-			require.FileExists(t, opts.PythonExe)
-
-			pythonExe, err := exec.LookPath(python.GetExecutable())
-			require.NoError(t, err)
-			require.Equal(t, filepath.Dir(pythonExe), filepath.Dir(opts.PythonExe))
-			require.FileExists(t, pythonExe)
-		})
-	}
-}
-
-func TestWrongVersion(t *testing.T) {
-	require.Error(t, CreatePythonEnv(&VenvOpts{PythonVersion: "4.0"}))
-}
-
-func TestMissingVersion(t *testing.T) {
-	require.Error(t, CreatePythonEnv(nil))
-	require.Error(t, CreatePythonEnv(&VenvOpts{}))
-}
diff --git a/libs/retry/filer.go b/libs/retry/filer.go
new file mode 100644
index 00000000000..11b991b18fc
--- /dev/null
+++ b/libs/retry/filer.go
@@ -0,0 +1,91 @@
+package retry
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"io"
+	"io/fs"
+	"slices"
+
+	"github.com/databricks/cli/libs/filer"
+)
+
+// retryingFiler retries calls that fail with a transient server error and are safe to repeat.
+type retryingFiler struct {
+	filer.Filer
+}
+
+// Filer wraps f so that Write, Read, ReadDir, Stat and Delete retry on transient errors.
+// Only writes with [filer.OverwriteIfExists] are retried: they are idempotent, whereas repeating
+// a write that does not overwrite could fail on the file its own earlier attempt created.
+// A retried Delete treats a missing file as success, since the earlier attempt may have removed it.
+// Mkdir is passed through.
+func Filer(f filer.Filer) filer.Filer {
+	return &retryingFiler{Filer: f}
+}
+
+func (r *retryingFiler) Write(ctx context.Context, path string, reader io.Reader, mode ...filer.WriteMode) error {
+	if !slices.Contains(mode, filer.OverwriteIfExists) {
+		return r.Filer.Write(ctx, path, reader, mode...)
+	}
+
+	// Every attempt needs the full contents, so rewind the reader or buffer it.
+	rewind := func() (io.Reader, error) { return reader, nil }
+	if seeker, ok := reader.(io.ReadSeeker); ok {
+		start, err := seeker.Seek(0, io.SeekCurrent)
+		if err != nil {
+			return err
+		}
+		rewind = func() (io.Reader, error) {
+			_, err := seeker.Seek(start, io.SeekStart)
+			return reader, err
+		}
+	} else {
+		body, err := io.ReadAll(reader)
+		if err != nil {
+			return err
+		}
+		rewind = func() (io.Reader, error) { return bytes.NewReader(body), nil }
+	}
+
+	_, err := With(ctx, IsTransient, func() (struct{}, error) {
+		attempt, err := rewind()
+		if err != nil {
+			return struct{}{}, err
+		}
+		return struct{}{}, r.Filer.Write(ctx, path, attempt, mode...)
+	})
+	return err
+}
+
+func (r *retryingFiler) Read(ctx context.Context, path string) (io.ReadCloser, error) {
+	return With(ctx, IsTransientRead, func() (io.ReadCloser, error) {
+		return r.Filer.Read(ctx, path)
+	})
+}
+
+func (r *retryingFiler) ReadDir(ctx context.Context, path string) ([]fs.DirEntry, error) {
+	return With(ctx, IsTransientRead, func() ([]fs.DirEntry, error) {
+		return r.Filer.ReadDir(ctx, path)
+	})
+}
+
+func (r *retryingFiler) Stat(ctx context.Context, path string) (fs.FileInfo, error) {
+	return With(ctx, IsTransientRead, func() (fs.FileInfo, error) {
+		return r.Filer.Stat(ctx, path)
+	})
+}
+
+func (r *retryingFiler) Delete(ctx context.Context, path string, mode ...filer.DeleteMode) error {
+	retried := false
+	_, err := With(ctx, IsTransient, func() (struct{}, error) {
+		err := r.Filer.Delete(ctx, path, mode...)
+		if retried && errors.Is(err, fs.ErrNotExist) {
+			return struct{}{}, nil
+		}
+		retried = true
+		return struct{}{}, err
+	})
+	return err
+}
diff --git a/libs/retry/filer_test.go b/libs/retry/filer_test.go
new file mode 100644
index 00000000000..90e57faedb9
--- /dev/null
+++ b/libs/retry/filer_test.go
@@ -0,0 +1,168 @@
+package retry
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"io/fs"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/databricks/cli/libs/filer"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type flakyFiler struct {
+	filer.Filer
+	failures int
+	err      error
+	bodies   []string
+}
+
+func (f *flakyFiler) Write(ctx context.Context, path string, r io.Reader, mode ...filer.WriteMode) error {
+	b, err := io.ReadAll(r)
+	if err != nil {
+		return err
+	}
+	f.bodies = append(f.bodies, string(b))
+	if len(f.bodies) <= f.failures {
+		return f.err
+	}
+	return nil
+}
+
+var errTransient = &apierr.APIError{StatusCode: http.StatusGatewayTimeout, Message: "TEMPORARILY_UNAVAILABLE"}
+
+func TestFilerRetriesSeekableReader(t *testing.T) {
+	f := &flakyFiler{failures: 1, err: errTransient}
+	err := Filer(f).Write(testContext(t), "a", bytes.NewReader([]byte("hello")), filer.OverwriteIfExists)
+	require.NoError(t, err)
+	assert.Equal(t, []string{"hello", "hello"}, f.bodies)
+}
+
+func TestFilerRetriesNonSeekableReader(t *testing.T) {
+	f := &flakyFiler{failures: 1, err: errTransient}
+	// io.NopCloser hides the Seek method.
+	r := io.NopCloser(strings.NewReader("hello"))
+	err := Filer(f).Write(testContext(t), "a", r, filer.OverwriteIfExists)
+	require.NoError(t, err)
+	assert.Equal(t, []string{"hello", "hello"}, f.bodies)
+}
+
+func TestFilerRewindsToInitialReaderPosition(t *testing.T) {
+	f := &flakyFiler{failures: 1, err: errTransient}
+	r := strings.NewReader("xxhello")
+	_, err := r.Seek(2, io.SeekStart)
+	require.NoError(t, err)
+	err = Filer(f).Write(testContext(t), "a", r, filer.OverwriteIfExists)
+	require.NoError(t, err)
+	assert.Equal(t, []string{"hello", "hello"}, f.bodies)
+}
+
+func TestFilerGivesUp(t *testing.T) {
+	f := &flakyFiler{failures: 100, err: errTransient}
+	err := Filer(f).Write(testContext(t), "a", strings.NewReader("x"), filer.OverwriteIfExists)
+	require.Error(t, err)
+	assert.Len(t, f.bodies, MaxRetries+1)
+}
+
+func TestFilerDoesNotRetryOtherErrors(t *testing.T) {
+	f := &flakyFiler{failures: 100, err: &apierr.APIError{StatusCode: http.StatusForbidden}}
+	err := Filer(f).Write(testContext(t), "a", strings.NewReader("x"), filer.OverwriteIfExists)
+	require.Error(t, err)
+	assert.Len(t, f.bodies, 1)
+}
+
+func TestFilerDoesNotRetryWithoutOverwrite(t *testing.T) {
+	f := &flakyFiler{failures: 100, err: errTransient}
+	err := Filer(f).Write(testContext(t), "a", strings.NewReader("x"))
+	require.Error(t, err)
+	assert.Len(t, f.bodies, 1)
+}
+
+// readFiler fails the first `failures` calls of every read-side method with err.
+type readFiler struct {
+	filer.Filer
+	failures int
+	err      error
+	calls    int
+}
+
+func (f *readFiler) next() error {
+	f.calls++
+	if f.calls <= f.failures {
+		return f.err
+	}
+	return nil
+}
+
+func (f *readFiler) Read(ctx context.Context, path string) (io.ReadCloser, error) {
+	return io.NopCloser(strings.NewReader("x")), f.next()
+}
+
+func (f *readFiler) ReadDir(ctx context.Context, path string) ([]fs.DirEntry, error) {
+	return nil, f.next()
+}
+
+func (f *readFiler) Stat(ctx context.Context, path string) (fs.FileInfo, error) {
+	return nil, f.next()
+}
+
+func (f *readFiler) Delete(ctx context.Context, path string, mode ...filer.DeleteMode) error {
+	return f.next()
+}
+
+func TestFilerRetriesReads(t *testing.T) {
+	ctx := testContext(t)
+	calls := map[string]func(filer.Filer) error{
+		"Read":    func(f filer.Filer) error { _, err := f.Read(ctx, "a"); return err },
+		"ReadDir": func(f filer.Filer) error { _, err := f.ReadDir(ctx, "a"); return err },
+		"Stat":    func(f filer.Filer) error { _, err := f.Stat(ctx, "a"); return err },
+	}
+	for name, call := range calls {
+		t.Run(name, func(t *testing.T) {
+			f := &readFiler{failures: 1, err: errTransient}
+			require.NoError(t, call(Filer(f)))
+			assert.Equal(t, 2, f.calls)
+		})
+	}
+}
+
+func TestFilerDoesNotRetryNotExist(t *testing.T) {
+	f := &readFiler{failures: 1, err: fs.ErrNotExist}
+	_, err := Filer(f).Stat(testContext(t), "a")
+	require.ErrorIs(t, err, fs.ErrNotExist)
+	assert.Equal(t, 1, f.calls)
+}
+
+func TestFilerDeleteRetries(t *testing.T) {
+	f := &readFiler{failures: 1, err: errTransient}
+	require.NoError(t, Filer(f).Delete(testContext(t), "a"))
+	assert.Equal(t, 2, f.calls)
+}
+
+func TestFilerDeleteMissingAfterRetryIsSuccess(t *testing.T) {
+	// The first attempt hits a transient error, the retry finds the file gone.
+	f := &sequenceFiler{errs: []error{errTransient, fs.ErrNotExist}}
+	require.NoError(t, Filer(f).Delete(testContext(t), "a"))
+}
+
+func TestFilerDeleteMissingOnFirstAttemptIsError(t *testing.T) {
+	f := &sequenceFiler{errs: []error{fs.ErrNotExist}}
+	require.ErrorIs(t, Filer(f).Delete(testContext(t), "a"), fs.ErrNotExist)
+}
+
+// sequenceFiler returns errs from successive Delete calls.
+type sequenceFiler struct {
+	filer.Filer
+	errs []error
+}
+
+func (f *sequenceFiler) Delete(ctx context.Context, path string, mode ...filer.DeleteMode) error {
+	err := f.errs[0]
+	f.errs = f.errs[1:]
+	return err
+}
diff --git a/libs/retry/retry.go b/libs/retry/retry.go
new file mode 100644
index 00000000000..9a8a5e75db4
--- /dev/null
+++ b/libs/retry/retry.go
@@ -0,0 +1,120 @@
+// Package retry retries calls that fail with transient server errors the SDK does not retry itself.
+package retry
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/url"
+	"slices"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/databricks/cli/libs/env"
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/databricks-sdk-go/apierr"
+)
+
+// MaxRetries is the number of additional attempts made after the first one fails.
+const MaxRetries = 2
+
+// IntervalMsVariable names the environment variable that overrides the pause between attempts.
+const IntervalMsVariable = "DATABRICKS_BUNDLE_RETRY_INTERVAL_MS"
+
+// DisableWarningVariable names the environment variable that, when set to a non-empty value,
+// suppresses the warning logged before each retry.
+const DisableWarningVariable = "DATABRICKS_BUNDLE_RETRY_DISABLE_WARNING"
+
+const defaultInterval = 15 * time.Second
+
+// interval returns the pause between attempts: the override in milliseconds if set and valid, 15s otherwise.
+func interval(ctx context.Context) time.Duration {
+	v, ok := env.Lookup(ctx, IntervalMsVariable)
+	if !ok {
+		return defaultInterval
+	}
+	ms, err := strconv.Atoi(v)
+	if err != nil {
+		return defaultInterval
+	}
+	return time.Duration(ms) * time.Millisecond
+}
+
+// IsTransient returns true for 5xx and 408 errors that the SDK did not already retry.
+// The SDK retries 504s matching its allTransientErrors patterns (e.g. "deadline exceeded");
+// this covers the remaining 504s like TEMPORARILY_UNAVAILABLE.
+func IsTransient(ctx context.Context, err error) bool {
+	apiErr, ok := errors.AsType[*apierr.APIError](err)
+	if !ok {
+		return false
+	}
+	if apiErr.IsRetriable(ctx) {
+		// Already handled by SDK
+		return false
+	}
+	return apiErr.StatusCode >= 500 || apiErr.StatusCode == http.StatusRequestTimeout
+}
+
+// transientReadMessages are the transport errors, matched by message, that are worth retrying on a read:
+//   - REFUSED_STREAM, the HTTP/2 refusal in issue #6472, where the server refused the stream before
+//     processing the request.
+//   - unexpected EOF, where the connection was cut mid-response. Observed on GET /clusters/get.
+var transientReadMessages = []string{"REFUSED_STREAM", "unexpected EOF"}
+
+// IsTransientRead returns true for errors worth retrying on an idempotent read: the transient
+// server errors IsTransient covers, plus the transport errors in transientReadMessages. The SDK
+// already retries the transport errors it recognizes (connection reset/refused, i/o timeout,
+// TLS handshake) for its full RetryTimeout, so retrying every *url.Error would restart that
+// multi-minute loop; these are the gaps it leaves. net/http bundles unexported http2
+// types, so we match the message, as the SDK does for its own transient url errors.
+func IsTransientRead(ctx context.Context, err error) bool {
+	if IsTransient(ctx, err) {
+		return true
+	}
+	if _, ok := errors.AsType[*url.Error](err); !ok {
+		return false
+	}
+	return slices.ContainsFunc(transientReadMessages, func(m string) bool {
+		return strings.Contains(err.Error(), m)
+	})
+}
+
+// With retries fn while check returns true for the error, up to MaxRetries times.
+func With[T any](ctx context.Context, check func(context.Context, error) bool, fn func() (T, error)) (T, error) {
+	wait := interval(ctx)
+	for attempt := 0; ; attempt++ {
+		result, err := fn()
+		if err == nil || attempt >= MaxRetries || !check(ctx, err) {
+			return result, err
+		}
+		if env.Get(ctx, DisableWarningVariable) == "" {
+			log.Warnf(ctx, "%s", retryMessage(err))
+		}
+		select {
+		case <-ctx.Done():
+			var zero T
+			return zero, ctx.Err()
+		case <-time.After(wait):
+		}
+	}
+}
+
+// retryMessage describes the error that triggered a retry.
+func retryMessage(err error) string {
+	msg := "retrying"
+	if apiErr, ok := errors.AsType[*apierr.APIError](err); ok {
+		endpoint := ""
+		if rw := apiErr.ResponseWrapper; rw != nil && rw.Response != nil && rw.Response.Request != nil {
+			req := rw.Response.Request
+			endpoint = fmt.Sprintf(" from %s %s", req.Method, req.URL.Path)
+		}
+		msg = fmt.Sprintf("retrying after %d %s%s", apiErr.StatusCode, http.StatusText(apiErr.StatusCode), endpoint)
+		// Include the context the caller added to the error, e.g. the path of the file being written.
+		if err.Error() != apiErr.Error() {
+			msg += ": " + err.Error()
+		}
+	}
+	return msg
+}
diff --git a/libs/retry/retry_test.go b/libs/retry/retry_test.go
new file mode 100644
index 00000000000..0568fc82b09
--- /dev/null
+++ b/libs/retry/retry_test.go
@@ -0,0 +1,121 @@
+package retry
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"testing"
+	"time"
+
+	"github.com/databricks/cli/libs/env"
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestIsTransient(t *testing.T) {
+	ctx := t.Context()
+	assert.True(t, IsTransient(ctx, &apierr.APIError{StatusCode: http.StatusGatewayTimeout, Message: "TEMPORARILY_UNAVAILABLE"}))
+	assert.True(t, IsTransient(ctx, &apierr.APIError{StatusCode: http.StatusInternalServerError}))
+	assert.True(t, IsTransient(ctx, &apierr.APIError{StatusCode: http.StatusRequestTimeout}))
+	// Retried by the SDK already.
+	assert.False(t, IsTransient(ctx, &apierr.APIError{StatusCode: http.StatusServiceUnavailable}))
+	assert.False(t, IsTransient(ctx, &apierr.APIError{StatusCode: http.StatusGatewayTimeout, Message: "deadline exceeded"}))
+	assert.False(t, IsTransient(ctx, &apierr.APIError{StatusCode: http.StatusForbidden}))
+	assert.False(t, IsTransient(ctx, errors.New("boom")))
+}
+
+func TestIsTransientRead(t *testing.T) {
+	ctx := t.Context()
+	// Everything IsTransient covers is transient for a read too.
+	assert.True(t, IsTransientRead(ctx, &apierr.APIError{StatusCode: http.StatusInternalServerError}))
+	assert.True(t, IsTransientRead(ctx, &apierr.APIError{StatusCode: http.StatusRequestTimeout}))
+	// REFUSED_STREAM is the transport failure the SDK leaves unretried, so we replay the read (issue #6472).
+	refusedStream := &url.Error{Op: "Get", URL: "https://example.test/api/2.0/workspace/get-status", Err: errors.New("stream error: stream ID 1; REFUSED_STREAM; received from peer")}
+	assert.True(t, IsTransientRead(ctx, refusedStream))
+	// The connection cut mid-response, seen on GET /clusters/get.
+	unexpectedEOF := &url.Error{Op: "Get", URL: "https://example.test/api/2.1/clusters/get", Err: io.ErrUnexpectedEOF}
+	assert.True(t, IsTransientRead(ctx, unexpectedEOF))
+	// Transport errors the SDK already retries for its full RetryTimeout must not be retried again.
+	connRefused := &url.Error{Op: "Get", URL: "https://example.test/api/2.0/workspace/get-status", Err: errors.New("dial tcp 10.0.0.1:443: connect: connection refused")}
+	assert.False(t, IsTransientRead(ctx, connRefused))
+	// A cancelled request is a *url.Error too, but not REFUSED_STREAM, so it fails fast rather than logging a retry.
+	cancelled := &url.Error{Op: "Get", URL: "https://example.test/api/2.0/workspace/get-status", Err: context.Canceled}
+	assert.False(t, IsTransientRead(ctx, cancelled))
+	// Not transient: retried by the SDK, client errors, and plain non-url errors.
+	assert.False(t, IsTransientRead(ctx, &apierr.APIError{StatusCode: http.StatusServiceUnavailable}))
+	assert.False(t, IsTransientRead(ctx, &apierr.APIError{StatusCode: http.StatusNotFound}))
+	assert.False(t, IsTransientRead(ctx, &apierr.APIError{StatusCode: http.StatusForbidden}))
+	assert.False(t, IsTransientRead(ctx, errors.New("boom")))
+}
+
+// testContext shortens the pause between attempts.
+func testContext(t *testing.T) context.Context {
+	return env.Set(t.Context(), IntervalMsVariable, "1")
+}
+
+func TestInterval(t *testing.T) {
+	ctx := t.Context()
+	assert.Equal(t, 15*time.Second, interval(ctx))
+	assert.Equal(t, 100*time.Millisecond, interval(env.Set(ctx, IntervalMsVariable, "100")))
+	assert.Equal(t, 15*time.Second, interval(env.Set(ctx, IntervalMsVariable, "abc")))
+}
+
+func TestWithRetriesUntilSuccess(t *testing.T) {
+	ctx := testContext(t)
+	calls := 0
+	got, err := With(ctx, func(context.Context, error) bool { return true }, func() (int, error) {
+		calls++
+		if calls <= MaxRetries {
+			return 0, errors.New("fail")
+		}
+		return 42, nil
+	})
+	require.NoError(t, err)
+	assert.Equal(t, 42, got)
+	assert.Equal(t, MaxRetries+1, calls)
+}
+
+func TestWithGivesUp(t *testing.T) {
+	ctx := testContext(t)
+	calls := 0
+	_, err := With(ctx, func(context.Context, error) bool { return true }, func() (int, error) {
+		calls++
+		return 0, errors.New("fail")
+	})
+	require.EqualError(t, err, "fail")
+	assert.Equal(t, MaxRetries+1, calls)
+}
+
+func TestWithDoesNotRetryWhenCheckFails(t *testing.T) {
+	ctx := testContext(t)
+	calls := 0
+	_, err := With(ctx, func(context.Context, error) bool { return false }, func() (int, error) {
+		calls++
+		return 0, errors.New("fail")
+	})
+	require.Error(t, err)
+	assert.Equal(t, 1, calls)
+}
+
+func TestWithStopsOnContextCancel(t *testing.T) {
+	ctx, cancel := context.WithCancel(env.Set(t.Context(), IntervalMsVariable, "3600000"))
+	calls := 0
+	_, err := With(ctx, func(context.Context, error) bool { return true }, func() (int, error) {
+		calls++
+		cancel()
+		return 0, errors.New("fail")
+	})
+	require.ErrorIs(t, err, context.Canceled)
+	assert.Equal(t, 1, calls)
+}
+
+func TestRetryMessage(t *testing.T) {
+	apiErr := &apierr.APIError{StatusCode: http.StatusGatewayTimeout, Message: "boom"}
+	assert.Equal(t, "retrying", retryMessage(errors.New("x")))
+	assert.Equal(t, "retrying after 504 Gateway Timeout", retryMessage(apiErr))
+	assert.Equal(t, "retrying after 504 Gateway Timeout: failed to upload /a/b: boom", retryMessage(fmt.Errorf("failed to upload /a/b: %w", apiErr)))
+}
diff --git a/libs/shortid/shortid.go b/libs/shortid/shortid.go
new file mode 100644
index 00000000000..fdec3a8555a
--- /dev/null
+++ b/libs/shortid/shortid.go
@@ -0,0 +1,35 @@
+// Package shortid produces compact identifiers for the user agent and telemetry.
+//
+// An identifier is 64 bits encoded in base62 (0-9, A-Z, a-z), which is 11
+// characters long, about a third of a UUID. Plain alphanumerics avoid '-' and
+// '_', which read as separators in user agent and log values.
+package shortid
+
+import "crypto/sha256"
+
+const (
+	alphabet = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
+	numBytes = 8
+
+	// Length is fixed: 62^11 > 2^64, so every 64-bit value fits in 11 digits.
+	length = 11
+)
+
+func encode(b []byte) string {
+	var n uint64
+	for _, c := range b[:numBytes] {
+		n = n<<8 | uint64(c)
+	}
+	out := make([]byte, length)
+	for i := length - 1; i >= 0; i-- {
+		out[i] = alphabet[n%uint64(len(alphabet))]
+		n /= uint64(len(alphabet))
+	}
+	return string(out)
+}
+
+// Hash returns the identifier derived from the SHA-256 hash of s.
+func Hash(s string) string {
+	h := sha256.Sum256([]byte(s))
+	return encode(h[:])
+}
diff --git a/libs/shortid/shortid_test.go b/libs/shortid/shortid_test.go
new file mode 100644
index 00000000000..379d998ecb9
--- /dev/null
+++ b/libs/shortid/shortid_test.go
@@ -0,0 +1,18 @@
+package shortid
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestHash(t *testing.T) {
+	// First 8 bytes of sha256("abc") are ba 78 16 bf 8f 01 cf ea.
+	assert.Equal(t, "G0ZNUjK18Pa", Hash("abc"))
+	assert.NotEqual(t, Hash("abc"), Hash("abd"))
+}
+
+func TestEncodeBounds(t *testing.T) {
+	assert.Equal(t, "00000000000", encode([]byte{0, 0, 0, 0, 0, 0, 0, 0}))
+	assert.Equal(t, "LygHa16AHYF", encode([]byte{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff}))
+}
diff --git a/libs/snapshot/client.go b/libs/snapshot/client.go
new file mode 100644
index 00000000000..8539cf0bda5
--- /dev/null
+++ b/libs/snapshot/client.go
@@ -0,0 +1,134 @@
+package snapshot
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"mime/multipart"
+	"net/http"
+	"net/textproto"
+	"path"
+
+	"github.com/databricks/cli/libs/auth"
+	"github.com/databricks/databricks-sdk-go"
+	databricksclient "github.com/databricks/databricks-sdk-go/client"
+)
+
+// SnapshotInfo holds the result of a successful snapshot upload.
+type SnapshotInfo struct {
+	// Path is the immutable workspace path for the uploaded snapshot content.
+	Path string
+}
+
+// ACLEntry is one element of the access_control_list sent to the snapshot API.
+// All entries are granted CAN_READ; the snapshot API does not support other levels.
+type ACLEntry struct {
+	UserName             string `json:"user_name,omitempty"`
+	GroupName            string `json:"group_name,omitempty"`
+	ServicePrincipalName string `json:"service_principal_name,omitempty"`
+	PermissionLevel      string `json:"permission_level"`
+}
+
+// SnapshotClient implements the /api/2.0/repos/snapshots endpoint.
+type SnapshotClient struct {
+	workspaceClient *databricks.WorkspaceClient
+	client          *databricksclient.DatabricksClient
+}
+
+// snapshotUploadResponse mirrors the /api/2.0/repos/snapshots response body.
+type snapshotUploadResponse struct {
+	Snapshot struct {
+		Path string `json:"path"`
+	} `json:"snapshot"`
+}
+
+type snapshotRootPathResponse struct {
+	Path string `json:"path"`
+}
+
+// NewSnapshotClient creates a SnapshotClient backed by /api/2.0/repos/snapshots.
+func NewSnapshotClient(w *databricks.WorkspaceClient) (*SnapshotClient, error) {
+	c, err := databricksclient.New(w.Config)
+	if err != nil {
+		return nil, err
+	}
+	return &SnapshotClient{workspaceClient: w, client: c}, nil
+}
+
+// Upload uploads zipContent as an immutable snapshot. The server derives the
+// content-addressed path from the SHA-256 of the zip, and acl grants CAN_READ to
+// each listed principal. path is reserved for forthcoming API support for a
+// caller-specified upload location; it is not sent yet.
+func (c *SnapshotClient) Upload(ctx context.Context, path, bundleID string, acl []ACLEntry, zipContent []byte) (*SnapshotInfo, error) {
+	var body bytes.Buffer
+	mw := multipart.NewWriter(&body)
+
+	if err := mw.WriteField("snapshot_id", HashFromContent(zipContent)); err != nil {
+		return nil, fmt.Errorf("failed to write snapshot_id: %w", err)
+	}
+	if err := mw.WriteField("bundle_id", bundleID); err != nil {
+		return nil, fmt.Errorf("failed to write bundle_id: %w", err)
+	}
+
+	aclJSON, err := json.Marshal(acl)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal access_control_list: %w", err)
+	}
+	if err := mw.WriteField("access_control_list", string(aclJSON)); err != nil {
+		return nil, fmt.Errorf("failed to write access_control_list: %w", err)
+	}
+
+	// Attach the zip with an explicit content-type so the server treats it as binary.
+	fh := make(textproto.MIMEHeader)
+	fh.Set("Content-Disposition", `form-data; name="file"; filename="snapshot.zip"`)
+	fh.Set("Content-Type", "application/zip")
+	part, err := mw.CreatePart(fh)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create file part: %w", err)
+	}
+	if _, err := part.Write(zipContent); err != nil {
+		return nil, fmt.Errorf("failed to write zip content: %w", err)
+	}
+	if err := mw.Close(); err != nil {
+		return nil, fmt.Errorf("failed to finalize multipart body: %w", err)
+	}
+
+	// Workspace routing header is required so the server can locate the correct
+	// ASP (application service principal) that owns the snapshot directory.
+	headers := auth.WorkspaceIDHeaders(c.client.Config)
+	if headers == nil {
+		headers = make(map[string]string)
+	}
+	headers["Content-Type"] = mw.FormDataContentType()
+
+	var resp snapshotUploadResponse
+	err = c.client.Do(ctx, http.MethodPost, "/api/2.0/repos/snapshots", headers, nil, body.Bytes(), &resp)
+	if err != nil {
+		return nil, fmt.Errorf("snapshot upload: %w", err)
+	}
+
+	return &SnapshotInfo{Path: resp.Snapshot.Path}, nil
+}
+
+func (c *SnapshotClient) Get(ctx context.Context, snapshotRelativePath string) (*SnapshotInfo, error) {
+	rootPath, err := c.GetSnapshotRootPath(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get snapshot root path: %w", err)
+	}
+	snapshotPath := path.Join(rootPath, snapshotRelativePath)
+	resp, err := c.workspaceClient.Workspace.GetStatusByPath(ctx, snapshotPath)
+	if err != nil {
+		return nil, fmt.Errorf("snapshot get: %w", err)
+	}
+	return &SnapshotInfo{Path: resp.Path}, nil
+}
+
+func (c *SnapshotClient) GetSnapshotRootPath(ctx context.Context) (string, error) {
+	var resp snapshotRootPathResponse
+	err := c.client.Do(ctx, http.MethodGet, "/api/2.0/repos/snapshots/rootpath", auth.WorkspaceIDHeaders(c.client.Config), nil, nil, &resp)
+	if err != nil {
+		return "", fmt.Errorf("snapshot root path get: %w", err)
+	}
+	return path.Clean(resp.Path), nil
+}
diff --git a/libs/snapshot/hash.go b/libs/snapshot/hash.go
new file mode 100644
index 00000000000..104858896c3
--- /dev/null
+++ b/libs/snapshot/hash.go
@@ -0,0 +1,12 @@
+package snapshot
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+)
+
+// HashFromContent returns the SHA-256 hex digest of content.
+func HashFromContent(content []byte) string {
+	h := sha256.Sum256(content)
+	return hex.EncodeToString(h[:])
+}
diff --git a/libs/sqlexec/sqlexec.go b/libs/sqlexec/sqlexec.go
new file mode 100644
index 00000000000..0615c2c5e49
--- /dev/null
+++ b/libs/sqlexec/sqlexec.go
@@ -0,0 +1,355 @@
+// Package sqlexec runs SQL statements through the Databricks SQL Statement
+// Execution API. It is a general-purpose, non-interactive executor: it submits
+// statements, polls them to a terminal state, assembles paginated results, and
+// turns failures into typed errors. Programmatic callers such as bundle deploy
+// resources (metric views, which have no REST API and are managed via SQL DDL)
+// and the experimental aitools query commands share this engine instead of each
+// re-implementing the submit/poll/fetch loop.
+//
+// The engine speaks only the INLINE disposition with the JSON_ARRAY format,
+// which the API caps at 25 MiB per result set. That covers every caller today.
+// EXTERNAL_LINKS (presigned downloads for larger results, optionally Arrow or
+// CSV) is a separate concern and intentionally not implemented here.
+//
+// A Client holds no mutable state and is safe for concurrent use; aitools fans
+// many statements out through a single Client.
+package sqlexec
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/databricks/databricks-sdk-go/service/sql"
+)
+
+const (
+	// asyncWaitTimeout is the wait applied to Submit. "0s" makes ExecuteStatement
+	// return immediately with a statement ID (state PENDING) so callers can wire
+	// up cancellation before the statement has a chance to finish.
+	asyncWaitTimeout = "0s"
+
+	// defaultWaitTimeout is the synchronous wait Execute applies. Within this
+	// window ExecuteStatement blocks server-side, so fast statements (most DDL)
+	// return in a single round-trip and never enter the poll loop. The API
+	// accepts "0s" or 5s–50s; 10s keeps interactive deploys responsive while
+	// absorbing typical warehouse latency.
+	defaultWaitTimeout = "10s"
+
+	// defaultPollInterval and defaultPollMax bound the additive backoff Poll
+	// applies between GetStatement calls while a statement is PENDING or RUNNING.
+	defaultPollInterval = 1 * time.Second
+	defaultPollMax      = 5 * time.Second
+
+	// pollIntervalStep is how much the poll interval grows after each poll.
+	pollIntervalStep = 1 * time.Second
+)
+
+// Client executes SQL statements against a single SQL warehouse.
+type Client struct {
+	api         sql.StatementExecutionInterface
+	warehouseID string
+
+	waitTimeout  string
+	pollInterval time.Duration
+	pollMax      time.Duration
+}
+
+// Option configures a Client.
+type Option func(*Client)
+
+// WithWaitTimeout sets the synchronous wait Execute applies before falling back
+// to polling. Must be "0s" or "5s".."50s" per the API; values outside that range
+// are rejected by the backend at submit time.
+func WithWaitTimeout(d string) Option {
+	return func(c *Client) { c.waitTimeout = d }
+}
+
+// WithPollInterval sets the initial and maximum delay between status polls. The
+// delay grows additively from initial to max. Tests use a small interval to
+// avoid real sleeps.
+func WithPollInterval(initial, max time.Duration) Option {
+	return func(c *Client) {
+		c.pollInterval = initial
+		c.pollMax = max
+	}
+}
+
+// New returns a Client that runs statements on warehouseID via api.
+func New(api sql.StatementExecutionInterface, warehouseID string, opts ...Option) *Client {
+	c := &Client{
+		api:          api,
+		warehouseID:  warehouseID,
+		waitTimeout:  defaultWaitTimeout,
+		pollInterval: defaultPollInterval,
+		pollMax:      defaultPollMax,
+	}
+	for _, opt := range opts {
+		opt(c)
+	}
+	return c
+}
+
+// RequestOption mutates the ExecuteStatementRequest for a single submission.
+type RequestOption func(*sql.ExecuteStatementRequest)
+
+// WithParameters binds named parameters (`:name` markers) on the statement.
+// Parameter binding is server-side, so values need no manual quoting or
+// escaping; prefer it over string interpolation.
+func WithParameters(params []sql.StatementParameterListItem) RequestOption {
+	return func(req *sql.ExecuteStatementRequest) { req.Parameters = params }
+}
+
+// Statement is a handle to a submitted statement and its latest known state.
+type Statement struct {
+	ID    string
+	State sql.StatementState
+
+	// resp is the most recent response observed for the statement. It carries the
+	// manifest and first result chunk needed by Results.
+	resp *sql.StatementResponse
+}
+
+// newStatement wraps a response into a Statement handle.
+func newStatement(resp *sql.StatementResponse) *Statement {
+	s := &Statement{ID: resp.StatementId, resp: resp}
+	if resp.Status != nil {
+		s.State = resp.Status.State
+	}
+	return s
+}
+
+// Err returns a *StatementError if the statement is in a terminal non-success
+// state (FAILED, CANCELED, CLOSED) or carries no status, and nil otherwise.
+// Calling Err on a still-running statement returns nil.
+func (s *Statement) Err() error {
+	status := s.resp.Status
+	if status == nil {
+		// The API always populates status; a nil here means a malformed or
+		// partial response, which we surface rather than silently treat as empty.
+		return &StatementError{Message: "statement response had no status"}
+	}
+	switch status.State {
+	case sql.StatementStateFailed, sql.StatementStateCanceled, sql.StatementStateClosed:
+		return newStatementError(status)
+	default:
+		// SUCCEEDED, PENDING, RUNNING: no error.
+		return nil
+	}
+}
+
+// Columns returns the result column names from the statement's manifest. They
+// are known once the statement has succeeded, before any row chunk is fetched,
+// so callers can still report column metadata when a later chunk fetch fails.
+func (s *Statement) Columns() []string {
+	return columns(s.resp.Manifest)
+}
+
+// StatementError describes a statement that reached a terminal non-success
+// state. FAILED statuses carry a backend error code and message (and, in the
+// FAILED case, an SQLSTATE); CANCELED and CLOSED carry no error object, so the
+// message is synthesized from the state.
+type StatementError struct {
+	State    sql.StatementState
+	Code     sql.ServiceErrorCode
+	Message  string
+	SQLState string
+}
+
+// newStatementError builds a StatementError from a terminal non-success status.
+func newStatementError(status *sql.StatementStatus) *StatementError {
+	e := &StatementError{State: status.State, SQLState: status.SqlState}
+	if status.Error != nil {
+		e.Code = status.Error.ErrorCode
+		e.Message = status.Error.Message
+	} else {
+		e.Message = fmt.Sprintf("statement reached terminal state %s", status.State)
+	}
+	return e
+}
+
+func (e *StatementError) Error() string {
+	if e.Code != "" {
+		return fmt.Sprintf("statement failed: %s: %s", e.Code, e.Message)
+	}
+	return e.Message
+}
+
+// Result is the assembled result set of a statement: column names and every row
+// across all chunks. Statements that return no result set (DDL) yield empty
+// Columns and Rows.
+type Result struct {
+	Columns []string
+	// Rows holds every result row with each cell as a string. A SQL NULL and an
+	// empty string are indistinguishable here: the API wire format encodes NULL
+	// as JSON null (distinct from ""), but the SDK models cells as [][]string, so
+	// JSON null is decoded as "". The distinction is recoverable only with a
+	// null-aware cell type (e.g. [][]*string) or the ARROW_STREAM format; no
+	// caller needs it today, so we keep the simpler string rows.
+	Rows [][]string
+}
+
+// Scalar returns the top-left cell of the result, or "" when there are no rows.
+func (r *Result) Scalar() string {
+	if len(r.Rows) == 0 || len(r.Rows[0]) == 0 {
+		return ""
+	}
+	return r.Rows[0][0]
+}
+
+// Submit starts a statement asynchronously and returns immediately with its
+// handle (state PENDING). Use Poll to wait for completion and Cancel to stop it.
+func (c *Client) Submit(ctx context.Context, statement string, opts ...RequestOption) (*Statement, error) {
+	return c.submit(ctx, statement, asyncWaitTimeout, opts)
+}
+
+// submit issues ExecuteStatement with the given synchronous wait timeout.
+func (c *Client) submit(ctx context.Context, statement, waitTimeout string, opts []RequestOption) (*Statement, error) {
+	req := sql.ExecuteStatementRequest{
+		WarehouseId:   c.warehouseID,
+		Statement:     statement,
+		WaitTimeout:   waitTimeout,
+		OnWaitTimeout: sql.ExecuteStatementRequestOnWaitTimeoutContinue,
+		Disposition:   sql.DispositionInline,
+		Format:        sql.FormatJsonArray,
+	}
+	for _, opt := range opts {
+		opt(&req)
+	}
+
+	resp, err := c.api.ExecuteStatement(ctx, req)
+	if err != nil {
+		return nil, fmt.Errorf("execute statement: %w", err)
+	}
+	return newStatement(resp), nil
+}
+
+// Poll waits for a statement to reach a terminal state, returning the updated
+// handle. A statement that is already terminal is returned without an API call.
+//
+// On context cancellation Poll returns the context error WITHOUT cancelling the
+// statement server-side; callers that want server-side cancellation must call
+// Cancel explicitly. This keeps Poll usable both for "stop watching" (statement
+// get) and "stop the query" (interactive query) callers.
+func (c *Client) Poll(ctx context.Context, s *Statement) (*Statement, error) {
+	interval := c.pollInterval
+	for isPending(s.resp.Status) {
+		select {
+		case <-ctx.Done():
+			return nil, ctx.Err()
+		case <-time.After(interval):
+		}
+
+		resp, err := c.api.GetStatementByStatementId(ctx, s.ID)
+		if err != nil {
+			if ctx.Err() != nil {
+				return nil, ctx.Err()
+			}
+			return nil, fmt.Errorf("poll statement %s: %w", s.ID, err)
+		}
+		s = newStatement(resp)
+		interval = min(interval+pollIntervalStep, c.pollMax)
+	}
+	return s, nil
+}
+
+// Get returns the current state of a statement with a single GET, no polling.
+func (c *Client) Get(ctx context.Context, statementID string) (*Statement, error) {
+	resp, err := c.api.GetStatementByStatementId(ctx, statementID)
+	if err != nil {
+		return nil, fmt.Errorf("get statement %s: %w", statementID, err)
+	}
+	return newStatement(resp), nil
+}
+
+// Cancel requests server-side cancellation of a statement. A successful return
+// only means the request was accepted; the statement may have already finished.
+// Poll or Get to observe the resulting state.
+func (c *Client) Cancel(ctx context.Context, statementID string) error {
+	if err := c.api.CancelExecution(ctx, sql.CancelExecutionRequest{StatementId: statementID}); err != nil {
+		return fmt.Errorf("cancel statement %s: %w", statementID, err)
+	}
+	return nil
+}
+
+// Results assembles the full result set of a statement, fetching every chunk
+// beyond the first that the manifest reports. It does not check the statement
+// state; call Err first (or use Execute) to reject non-success statements.
+func (c *Client) Results(ctx context.Context, s *Statement) (*Result, error) {
+	r := &Result{Columns: columns(s.resp.Manifest)}
+	if s.resp.Result == nil {
+		return r, nil
+	}
+	r.Rows = append(r.Rows, s.resp.Result.DataArray...)
+
+	total := 0
+	if s.resp.Manifest != nil {
+		total = s.resp.Manifest.TotalChunkCount
+	}
+	// Chunk 0 is already in resp.Result; fetch the rest in order.
+	for chunk := 1; chunk < total; chunk++ {
+		data, err := c.api.GetStatementResultChunkNByStatementIdAndChunkIndex(ctx, s.ID, chunk)
+		if err != nil {
+			return nil, fmt.Errorf("fetch result chunk %d of statement %s: %w", chunk, s.ID, err)
+		}
+		r.Rows = append(r.Rows, data.DataArray...)
+	}
+	return r, nil
+}
+
+// Execute submits a statement synchronously, polls it to a terminal state, and
+// returns its assembled result. A terminal non-success state is returned as a
+// *StatementError.
+func (c *Client) Execute(ctx context.Context, statement string, opts ...RequestOption) (*Result, error) {
+	s, err := c.submit(ctx, statement, c.waitTimeout, opts)
+	if err != nil {
+		return nil, err
+	}
+	s, err = c.Poll(ctx, s)
+	if err != nil {
+		return nil, err
+	}
+	if err := s.Err(); err != nil {
+		return nil, err
+	}
+	return c.Results(ctx, s)
+}
+
+// ExecuteScalar runs a statement returning at most one row and one column and
+// returns that cell, or "" when there are no rows.
+func (c *Client) ExecuteScalar(ctx context.Context, statement string, opts ...RequestOption) (string, error) {
+	r, err := c.Execute(ctx, statement, opts...)
+	if err != nil {
+		return "", err
+	}
+	return r.Scalar(), nil
+}
+
+// isPending reports whether a statement is still PENDING or RUNNING, i.e. Poll
+// should keep waiting. A nil status (only possible from a malformed response) is
+// not pending, so Poll stops and Err surfaces the missing status to the caller
+// rather than looping forever.
+func isPending(status *sql.StatementStatus) bool {
+	if status == nil {
+		return false
+	}
+	switch status.State {
+	case sql.StatementStatePending, sql.StatementStateRunning:
+		return true
+	default:
+		return false
+	}
+}
+
+// columns returns the column names from a result manifest, or nil when the
+// manifest carries no schema (e.g. a statement with no result set).
+func columns(manifest *sql.ResultManifest) []string {
+	if manifest == nil || manifest.Schema == nil {
+		return nil
+	}
+	out := make([]string, len(manifest.Schema.Columns))
+	for i, col := range manifest.Schema.Columns {
+		out[i] = col.Name
+	}
+	return out
+}
diff --git a/libs/sqlexec/sqlexec_http_test.go b/libs/sqlexec/sqlexec_http_test.go
new file mode 100644
index 00000000000..4c88a045367
--- /dev/null
+++ b/libs/sqlexec/sqlexec_http_test.go
@@ -0,0 +1,109 @@
+package sqlexec_test
+
+import (
+	"testing"
+	"time"
+
+	"github.com/databricks/cli/libs/sqlexec"
+	"github.com/databricks/cli/libs/testserver"
+	"github.com/databricks/cli/libs/testserver/testsql"
+	"github.com/databricks/databricks-sdk-go"
+	"github.com/databricks/databricks-sdk-go/service/sql"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// These tests drive the engine through a real SDK client over HTTP against the
+// in-process testserver, with the statement-execution endpoints programmed per
+// test via server.HandleSQL matchers. Unlike the mock-interface unit tests they
+// exercise the full request/response JSON serialization, and unlike the
+// integration tests they are hermetic and run on every PR without a warehouse.
+// newServer returns a testserver with the default handlers installed, which is
+// where the SQL Statement Execution routes live (they delegate to the matchers
+// registered via server.HandleSQL).
+func newServer(t *testing.T) *testserver.Server {
+	t.Helper()
+	server := testserver.New(t)
+	testserver.AddDefaultHandlers(server)
+	return server
+}
+
+func httpClient(t *testing.T, server *testserver.Server) *sqlexec.Client {
+	t.Helper()
+	w, err := databricks.NewWorkspaceClient(&databricks.Config{Host: server.URL, Token: "token"})
+	require.NoError(t, err)
+	// Tiny poll interval so the polling tests don't sleep.
+	return sqlexec.New(w.StatementExecution, "wh-1", sqlexec.WithPollInterval(time.Millisecond, time.Millisecond))
+}
+
+func TestHTTPExecuteSuccess(t *testing.T) {
+	server := newServer(t)
+	server.HandleSQL("SELECT 1 AS a, 2 AS b", func(testsql.Request) testsql.Result {
+		return testsql.Result{Columns: []string{"a", "b"}, Rows: [][]string{{"1", "2"}}}
+	})
+
+	r, err := httpClient(t, server).Execute(t.Context(), "SELECT 1 AS a, 2 AS b")
+	require.NoError(t, err)
+	assert.Equal(t, []string{"a", "b"}, r.Columns)
+	assert.Equal(t, [][]string{{"1", "2"}}, r.Rows)
+}
+
+func TestHTTPExecutePolls(t *testing.T) {
+	server := newServer(t)
+	server.HandleSQL("SELECT 1", func(testsql.Request) testsql.Result {
+		return testsql.Result{Rows: [][]string{{"done"}}, Polls: 1}
+	})
+
+	got, err := httpClient(t, server).ExecuteScalar(t.Context(), "SELECT 1")
+	require.NoError(t, err)
+	assert.Equal(t, "done", got)
+}
+
+func TestHTTPExecutePaginatesChunks(t *testing.T) {
+	server := newServer(t)
+	server.HandleSQL("SELECT * FROM big", func(testsql.Request) testsql.Result {
+		return testsql.Result{Rows: [][]string{{"0"}, {"1"}, {"2"}}, Chunks: 3}
+	})
+
+	r, err := httpClient(t, server).Execute(t.Context(), "SELECT * FROM big")
+	require.NoError(t, err)
+	assert.Equal(t, [][]string{{"0"}, {"1"}, {"2"}}, r.Rows)
+}
+
+func TestHTTPExecuteFailedReturns200(t *testing.T) {
+	server := newServer(t)
+	// A failed statement comes back as HTTP 200 with state=FAILED, not an HTTP
+	// error; the engine must inspect the body and surface a *StatementError.
+	server.HandleSQL("SELECT * FROM nope", func(testsql.Request) testsql.Result {
+		return testsql.Result{Error: &testsql.Error{Code: sql.ServiceErrorCodeBadRequest, Message: "no such table", SQLState: "42P01"}}
+	})
+
+	_, err := httpClient(t, server).Execute(t.Context(), "SELECT * FROM nope")
+	var se *sqlexec.StatementError
+	require.ErrorAs(t, err, &se)
+	assert.Equal(t, sql.StatementStateFailed, se.State)
+	assert.Equal(t, sql.ServiceErrorCodeBadRequest, se.Code)
+	assert.Equal(t, "no such table", se.Message)
+	assert.Equal(t, "42P01", se.SQLState)
+}
+
+func TestHTTPSubmitAndCancel(t *testing.T) {
+	server := newServer(t)
+	server.HandleSQL("SELECT 1", func(testsql.Request) testsql.Result {
+		return testsql.Result{}
+	})
+
+	c := httpClient(t, server)
+	ctx := t.Context()
+
+	stmt, err := c.Submit(ctx, "SELECT 1")
+	require.NoError(t, err)
+	assert.Equal(t, "statement-1", stmt.ID)
+
+	require.NoError(t, c.Cancel(ctx, stmt.ID))
+
+	stmt, err = c.Poll(ctx, stmt)
+	require.NoError(t, err)
+	assert.Equal(t, sql.StatementStateCanceled, stmt.State)
+	require.Error(t, stmt.Err())
+}
diff --git a/libs/sqlexec/sqlexec_test.go b/libs/sqlexec/sqlexec_test.go
new file mode 100644
index 00000000000..ce170d1043e
--- /dev/null
+++ b/libs/sqlexec/sqlexec_test.go
@@ -0,0 +1,378 @@
+package sqlexec
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	mocksql "github.com/databricks/databricks-sdk-go/experimental/mocks/service/sql"
+	"github.com/databricks/databricks-sdk-go/service/sql"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+)
+
+// testClient returns a Client wired to a fresh mock with a near-zero poll
+// interval so polling tests don't sleep.
+func testClient(t *testing.T) (*Client, *mocksql.MockStatementExecutionInterface) {
+	api := mocksql.NewMockStatementExecutionInterface(t)
+	c := New(api, "wh-1", WithPollInterval(time.Millisecond, time.Millisecond))
+	return c, api
+}
+
+func statusResp(state sql.StatementState) *sql.StatementResponse {
+	return &sql.StatementResponse{StatementId: "stmt-1", Status: &sql.StatementStatus{State: state}}
+}
+
+func succeededResp(columns []string, dataArray [][]string) *sql.StatementResponse {
+	var schema *sql.ResultSchema
+	if columns != nil {
+		cols := make([]sql.ColumnInfo, len(columns))
+		for i, name := range columns {
+			cols[i] = sql.ColumnInfo{Name: name}
+		}
+		schema = &sql.ResultSchema{Columns: cols}
+	}
+	return &sql.StatementResponse{
+		StatementId: "stmt-1",
+		Status:      &sql.StatementStatus{State: sql.StatementStateSucceeded},
+		Manifest:    &sql.ResultManifest{Schema: schema},
+		Result:      &sql.ResultData{DataArray: dataArray},
+	}
+}
+
+func TestExecuteScalar(t *testing.T) {
+	tests := []struct {
+		name      string
+		resp      *sql.StatementResponse
+		want      string
+		errSubstr string
+	}{
+		{
+			name: "succeeded with cell",
+			resp: succeededResp([]string{"table_type"}, [][]string{{"METRIC_VIEW"}}),
+			want: "METRIC_VIEW",
+		},
+		{
+			name: "succeeded with no rows",
+			resp: succeededResp([]string{"table_type"}, nil),
+			want: "",
+		},
+		{
+			name: "failed surfaces backend code and message",
+			resp: &sql.StatementResponse{
+				StatementId: "stmt-1",
+				Status: &sql.StatementStatus{
+					State:    sql.StatementStateFailed,
+					SqlState: "42000",
+					Error:    &sql.ServiceError{ErrorCode: sql.ServiceErrorCodeBadRequest, Message: "boom"},
+				},
+			},
+			errSubstr: "boom",
+		},
+		{
+			name:      "canceled is not treated as success",
+			resp:      statusResp(sql.StatementStateCanceled),
+			errSubstr: "terminal state CANCELED",
+		},
+		{
+			name:      "closed is not treated as success",
+			resp:      statusResp(sql.StatementStateClosed),
+			errSubstr: "terminal state CLOSED",
+		},
+		{
+			name:      "missing status surfaces as error",
+			resp:      &sql.StatementResponse{StatementId: "stmt-1"},
+			errSubstr: "no status",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			c, api := testClient(t)
+			api.EXPECT().ExecuteStatement(mock.Anything, mock.Anything).Return(tt.resp, nil).Once()
+
+			got, err := c.ExecuteScalar(t.Context(), "SELECT 1")
+			if tt.errSubstr != "" {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), tt.errSubstr)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
+
+func TestExecuteDDLReturnsEmptyResult(t *testing.T) {
+	c, api := testClient(t)
+	// DDL responses carry a status but no manifest or result block.
+	api.EXPECT().ExecuteStatement(mock.Anything, mock.Anything).
+		Return(statusResp(sql.StatementStateSucceeded), nil).Once()
+
+	r, err := c.Execute(t.Context(), "CREATE VIEW v")
+	require.NoError(t, err)
+	assert.Empty(t, r.Columns)
+	assert.Empty(t, r.Rows)
+	assert.Empty(t, r.Scalar())
+}
+
+func TestExecuteSubmitTransportError(t *testing.T) {
+	c, api := testClient(t)
+	api.EXPECT().ExecuteStatement(mock.Anything, mock.Anything).
+		Return(nil, errors.New("network down")).Once()
+
+	_, err := c.Execute(t.Context(), "SELECT 1")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "execute statement")
+	assert.Contains(t, err.Error(), "network down")
+}
+
+func TestExecutePollsUntilTerminal(t *testing.T) {
+	c, api := testClient(t)
+	api.EXPECT().ExecuteStatement(mock.Anything, mock.Anything).
+		Return(statusResp(sql.StatementStatePending), nil).Once()
+	api.EXPECT().GetStatementByStatementId(mock.Anything, "stmt-1").
+		Return(statusResp(sql.StatementStateRunning), nil).Once()
+	api.EXPECT().GetStatementByStatementId(mock.Anything, "stmt-1").
+		Return(succeededResp([]string{"n"}, [][]string{{"polled"}}), nil).Once()
+
+	got, err := c.ExecuteScalar(t.Context(), "SELECT 1")
+	require.NoError(t, err)
+	assert.Equal(t, "polled", got)
+}
+
+func TestExecuteUsesSyncWaitTimeout(t *testing.T) {
+	api := mocksql.NewMockStatementExecutionInterface(t)
+	c := New(api, "wh-1", WithWaitTimeout("25s"))
+	api.EXPECT().ExecuteStatement(mock.Anything, mock.MatchedBy(func(req sql.ExecuteStatementRequest) bool {
+		return req.WaitTimeout == "25s" &&
+			req.OnWaitTimeout == sql.ExecuteStatementRequestOnWaitTimeoutContinue &&
+			req.Disposition == sql.DispositionInline &&
+			req.Format == sql.FormatJsonArray &&
+			req.WarehouseId == "wh-1"
+	})).Return(succeededResp(nil, nil), nil).Once()
+
+	_, err := c.Execute(t.Context(), "SELECT 1")
+	require.NoError(t, err)
+}
+
+func TestSubmitIsAsyncAndForwardsParameters(t *testing.T) {
+	c, api := testClient(t)
+	params := []sql.StatementParameterListItem{{Name: "since", Type: "DATE", Value: "2026-01-01"}}
+
+	api.EXPECT().ExecuteStatement(mock.Anything, mock.MatchedBy(func(req sql.ExecuteStatementRequest) bool {
+		return req.WaitTimeout == "0s" &&
+			req.OnWaitTimeout == sql.ExecuteStatementRequestOnWaitTimeoutContinue &&
+			assert.ObjectsAreEqual(params, req.Parameters)
+	})).Return(statusResp(sql.StatementStatePending), nil).Once()
+
+	s, err := c.Submit(t.Context(), "SELECT :since", WithParameters(params))
+	require.NoError(t, err)
+	assert.Equal(t, "stmt-1", s.ID)
+	assert.Equal(t, sql.StatementStatePending, s.State)
+}
+
+func TestPollImmediateTerminalDoesNotCallAPI(t *testing.T) {
+	c, _ := testClient(t)
+	// No GetStatement expectation: a terminal statement must not be polled.
+	s, err := c.Poll(t.Context(), newStatement(succeededResp(nil, nil)))
+	require.NoError(t, err)
+	assert.Equal(t, sql.StatementStateSucceeded, s.State)
+}
+
+func TestPollContextCancellationDoesNotCancelServerSide(t *testing.T) {
+	c, api := testClient(t)
+	_ = api // no CancelExecution expectation: Poll must not cancel server-side.
+
+	ctx, cancel := context.WithCancel(t.Context())
+	cancel()
+
+	_, err := c.Poll(ctx, newStatement(statusResp(sql.StatementStatePending)))
+	require.ErrorIs(t, err, context.Canceled)
+}
+
+func TestPollWrapsGetError(t *testing.T) {
+	c, api := testClient(t)
+	api.EXPECT().GetStatementByStatementId(mock.Anything, "stmt-1").
+		Return(nil, errors.New("boom")).Once()
+
+	_, err := c.Poll(t.Context(), newStatement(statusResp(sql.StatementStatePending)))
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "poll statement stmt-1")
+	assert.Contains(t, err.Error(), "boom")
+}
+
+func TestPollGetErrorAfterCancellationReturnsContextErr(t *testing.T) {
+	api := mocksql.NewMockStatementExecutionInterface(t)
+	c := New(api, "wh-1", WithPollInterval(time.Millisecond, time.Millisecond))
+
+	ctx, cancel := context.WithCancel(t.Context())
+	// Simulate the context being cancelled while the GET is in flight: the call
+	// fails, but Poll must surface the context error, not the transport error.
+	api.EXPECT().GetStatementByStatementId(mock.Anything, "stmt-1").
+		RunAndReturn(func(context.Context, string) (*sql.StatementResponse, error) {
+			cancel()
+			return nil, errors.New("cancelled mid-flight")
+		}).Once()
+
+	_, err := c.Poll(ctx, newStatement(statusResp(sql.StatementStatePending)))
+	require.ErrorIs(t, err, context.Canceled)
+}
+
+func TestExecuteReturnsPollError(t *testing.T) {
+	c, api := testClient(t)
+	api.EXPECT().ExecuteStatement(mock.Anything, mock.Anything).
+		Return(statusResp(sql.StatementStatePending), nil).Once()
+	api.EXPECT().GetStatementByStatementId(mock.Anything, "stmt-1").
+		Return(nil, errors.New("boom")).Once()
+
+	_, err := c.Execute(t.Context(), "SELECT 1")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "poll statement stmt-1")
+}
+
+func TestResultsPaginatesChunks(t *testing.T) {
+	c, api := testClient(t)
+	resp := succeededResp([]string{"n"}, [][]string{{"0"}})
+	resp.Manifest.TotalChunkCount = 3
+	api.EXPECT().GetStatementResultChunkNByStatementIdAndChunkIndex(mock.Anything, "stmt-1", 1).
+		Return(&sql.ResultData{DataArray: [][]string{{"1"}}}, nil).Once()
+	api.EXPECT().GetStatementResultChunkNByStatementIdAndChunkIndex(mock.Anything, "stmt-1", 2).
+		Return(&sql.ResultData{DataArray: [][]string{{"2"}}}, nil).Once()
+
+	r, err := c.Results(t.Context(), newStatement(resp))
+	require.NoError(t, err)
+	assert.Equal(t, []string{"n"}, r.Columns)
+	assert.Equal(t, [][]string{{"0"}, {"1"}, {"2"}}, r.Rows)
+}
+
+func TestResultsChunkFetchError(t *testing.T) {
+	c, api := testClient(t)
+	resp := succeededResp([]string{"n"}, [][]string{{"0"}})
+	resp.Manifest.TotalChunkCount = 2
+	api.EXPECT().GetStatementResultChunkNByStatementIdAndChunkIndex(mock.Anything, "stmt-1", 1).
+		Return(nil, errors.New("throttled")).Once()
+
+	_, err := c.Results(t.Context(), newStatement(resp))
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "fetch result chunk 1 of statement stmt-1")
+	assert.Contains(t, err.Error(), "throttled")
+}
+
+func TestResultsNoResultBlock(t *testing.T) {
+	c, _ := testClient(t)
+	r, err := c.Results(t.Context(), newStatement(statusResp(sql.StatementStateSucceeded)))
+	require.NoError(t, err)
+	assert.Nil(t, r.Columns)
+	assert.Nil(t, r.Rows)
+}
+
+func TestGet(t *testing.T) {
+	c, api := testClient(t)
+	api.EXPECT().GetStatementByStatementId(mock.Anything, "stmt-9").
+		Return(statusResp(sql.StatementStateRunning), nil).Once()
+
+	s, err := c.Get(t.Context(), "stmt-9")
+	require.NoError(t, err)
+	assert.Equal(t, sql.StatementStateRunning, s.State)
+}
+
+func TestGetWrapsError(t *testing.T) {
+	c, api := testClient(t)
+	api.EXPECT().GetStatementByStatementId(mock.Anything, "stmt-9").
+		Return(nil, errors.New("nope")).Once()
+
+	_, err := c.Get(t.Context(), "stmt-9")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "get statement stmt-9")
+}
+
+func TestCancel(t *testing.T) {
+	c, api := testClient(t)
+	api.EXPECT().CancelExecution(mock.Anything, sql.CancelExecutionRequest{StatementId: "stmt-1"}).
+		Return(nil).Once()
+	require.NoError(t, c.Cancel(t.Context(), "stmt-1"))
+}
+
+func TestCancelWrapsError(t *testing.T) {
+	c, api := testClient(t)
+	api.EXPECT().CancelExecution(mock.Anything, mock.Anything).Return(errors.New("gone")).Once()
+	err := c.Cancel(t.Context(), "stmt-1")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "cancel statement stmt-1")
+	assert.Contains(t, err.Error(), "gone")
+}
+
+func TestStatementErr(t *testing.T) {
+	tests := []struct {
+		name     string
+		resp     *sql.StatementResponse
+		wantErr  bool
+		wantCode sql.ServiceErrorCode
+		wantMsg  string
+	}{
+		{name: "succeeded", resp: statusResp(sql.StatementStateSucceeded)},
+		{name: "pending", resp: statusResp(sql.StatementStatePending)},
+		{name: "running", resp: statusResp(sql.StatementStateRunning)},
+		{
+			name: "failed with service error",
+			resp: &sql.StatementResponse{Status: &sql.StatementStatus{
+				State:    sql.StatementStateFailed,
+				SqlState: "42000",
+				Error:    &sql.ServiceError{ErrorCode: sql.ServiceErrorCodeBadRequest, Message: "bad"},
+			}},
+			wantErr:  true,
+			wantCode: sql.ServiceErrorCodeBadRequest,
+			wantMsg:  "bad",
+		},
+		{
+			name:    "canceled without error object",
+			resp:    statusResp(sql.StatementStateCanceled),
+			wantErr: true,
+			wantMsg: "statement reached terminal state CANCELED",
+		},
+		{
+			name:    "nil status",
+			resp:    &sql.StatementResponse{},
+			wantErr: true,
+			wantMsg: "statement response had no status",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := newStatement(tt.resp).Err()
+			if !tt.wantErr {
+				require.NoError(t, err)
+				return
+			}
+			require.Error(t, err)
+			var se *StatementError
+			require.ErrorAs(t, err, &se)
+			assert.Equal(t, tt.wantCode, se.Code)
+			assert.Equal(t, tt.wantMsg, se.Message)
+		})
+	}
+}
+
+func TestStatementErrorError(t *testing.T) {
+	withCode := &StatementError{Code: sql.ServiceErrorCodeBadRequest, Message: "bad"}
+	assert.Equal(t, "statement failed: BAD_REQUEST: bad", withCode.Error())
+
+	noCode := &StatementError{State: sql.StatementStateCanceled, Message: "statement reached terminal state CANCELED"}
+	assert.Equal(t, "statement reached terminal state CANCELED", noCode.Error())
+}
+
+func TestResultScalar(t *testing.T) {
+	assert.Empty(t, (&Result{}).Scalar())
+	assert.Empty(t, (&Result{Rows: [][]string{{}}}).Scalar())
+	assert.Equal(t, "x", (&Result{Rows: [][]string{{"x", "y"}}}).Scalar())
+}
+
+func TestStatementColumns(t *testing.T) {
+	assert.Equal(t, []string{"a", "b"}, newStatement(succeededResp([]string{"a", "b"}, nil)).Columns())
+	// No manifest (e.g. a DDL response): no columns.
+	assert.Nil(t, newStatement(statusResp(sql.StatementStateSucceeded)).Columns())
+}
diff --git a/libs/structs/structaccess/bundle_test.go b/libs/structs/structaccess/bundle_test.go
index 1d75afe0b10..4de21ede392 100644
--- a/libs/structs/structaccess/bundle_test.go
+++ b/libs/structs/structaccess/bundle_test.go
@@ -16,7 +16,8 @@ func TestGet_ConfigRoot_JobTagsAccess(t *testing.T) {
 		Resources: config.Resources{
 			Jobs: map[string]*resources.Job{
 				"my_job": {
-					BaseResource: resources.BaseResource{ID: "jobid", URL: "joburl"},
+					ID:           "jobid",
+					BaseResource: resources.BaseResource{URL: "joburl"},
 					JobSettings: jobs.JobSettings{
 						Name: "example",
 						Tasks: []jobs.Task{
@@ -76,3 +77,38 @@ func TestGet_ConfigRoot_JobTagsAccess(t *testing.T) {
 	require.Error(t, ValidateByString(reflect.TypeFor[config.Root](), "resources.apps.my_app.url.inner"))
 	require.Error(t, ValidateByString(reflect.TypeFor[config.Root](), "resources.apps.my_app.url1"))
 }
+
+// A bundle resource embeds a config struct that embeds the SDK request struct, so its
+// fields sit two levels down. Get, Set and ValidatePath all have to reach them, and
+// ForceSendFields belongs to the struct that declares the field -- not to the outer one
+// that shadows the name.
+func TestGetSet_DoublyEmbeddedField(t *testing.T) {
+	project := &resources.PostgresProject{} //exhaustruct:ignore
+	project.ProjectId = "p"
+
+	require.NoError(t, ValidateByString(reflect.TypeOf(project), "budget_policy_id"))
+
+	require.NoError(t, SetByString(project, "budget_policy_id", "abc"))
+	require.Equal(t, "abc", project.BudgetPolicyId)
+
+	value, err := GetByString(project, "budget_policy_id")
+	require.NoError(t, err)
+	require.Equal(t, "abc", value)
+
+	// An explicit empty value is recorded on ProjectSpec, which declares the field.
+	require.NoError(t, SetByString(project, "budget_policy_id", ""))
+	require.Contains(t, project.ProjectSpec.ForceSendFields, "BudgetPolicyId")
+	require.NotContains(t, project.ForceSendFields, "BudgetPolicyId")
+
+	value, err = GetByString(project, "budget_policy_id")
+	require.NoError(t, err)
+	// The empty string, not nil: that is what separates an explicit "" from an absent field.
+	require.Equal(t, any(""), value)
+
+	// And dropping it again leaves the field absent.
+	require.NoError(t, SetByString(project, "budget_policy_id", nil))
+	require.NotContains(t, project.ProjectSpec.ForceSendFields, "BudgetPolicyId")
+	value, err = GetByString(project, "budget_policy_id")
+	require.NoError(t, err)
+	require.Nil(t, value)
+}
diff --git a/libs/structs/structaccess/convert.go b/libs/structs/structaccess/convert.go
index 605877a1c1d..b3d0dc062aa 100644
--- a/libs/structs/structaccess/convert.go
+++ b/libs/structs/structaccess/convert.go
@@ -10,7 +10,7 @@ func ConvertToString(value any) (string, error) {
 
 	// Handle pointers by dereferencing them first
 	rv := reflect.ValueOf(value)
-	if rv.Kind() == reflect.Ptr {
+	if rv.Kind() == reflect.Pointer {
 		if rv.IsNil() {
 			return "", nil
 		}
diff --git a/libs/structs/structaccess/convert_test.go b/libs/structs/structaccess/convert_test.go
index 02fcfc700ab..d8c0bef8832 100644
--- a/libs/structs/structaccess/convert_test.go
+++ b/libs/structs/structaccess/convert_test.go
@@ -61,22 +61,22 @@ func TestConvertToString(t *testing.T) {
 		// Pointers
 		{
 			name:     "string pointer",
-			value:    stringPtr("test"),
+			value:    new("test"),
 			expected: "test",
 		},
 		{
 			name:     "int pointer",
-			value:    intPtr(123),
+			value:    new(123),
 			expected: "123",
 		},
 		{
 			name:     "float64 pointer",
-			value:    float64Ptr(2.5),
+			value:    new(2.5),
 			expected: "2.5",
 		},
 		{
 			name:     "bool pointer",
-			value:    boolPtr(true),
+			value:    new(true),
 			expected: "true",
 		},
 		{
@@ -138,7 +138,7 @@ func TestConvertToString(t *testing.T) {
 			if tt.errorMsg != "" {
 				require.Error(t, err)
 				assert.Equal(t, tt.errorMsg, err.Error())
-				assert.Equal(t, "", result)
+				assert.Empty(t, result)
 			} else {
 				require.NoError(t, err)
 				assert.Equal(t, tt.expected, result)
@@ -146,19 +146,3 @@ func TestConvertToString(t *testing.T) {
 		})
 	}
 }
-
-func stringPtr(s string) *string {
-	return &s
-}
-
-func intPtr(i int) *int {
-	return &i
-}
-
-func float64Ptr(f float64) *float64 {
-	return &f
-}
-
-func boolPtr(b bool) *bool {
-	return &b
-}
diff --git a/libs/structs/structaccess/get.go b/libs/structs/structaccess/get.go
index 259dc861565..9bd43bf4603 100644
--- a/libs/structs/structaccess/get.go
+++ b/libs/structs/structaccess/get.go
@@ -66,6 +66,11 @@ func getValue(v any, path *structpath.PathNode) (reflect.Value, error) {
 			}
 			kind := cur.Kind()
 			if kind != reflect.Slice && kind != reflect.Array {
+				// Terraform represents single-block fields as lists and uses [0] to access them.
+				// Treat [0] on a struct as a no-op so TF-style paths work against DABs structs.
+				if idx == 0 && kind == reflect.Struct {
+					continue
+				}
 				return reflect.Value{}, fmt.Errorf("%s: cannot index %s", node.String(), kind)
 			}
 			if idx < 0 || idx >= cur.Len() {
@@ -133,19 +138,13 @@ func Get(v any, path *structpath.PathNode) (any, error) {
 func accessKey(v reflect.Value, key string, path *structpath.PathNode) (reflect.Value, error) {
 	switch v.Kind() {
 	case reflect.Struct:
-		// Precalculate ForceSendFields mappings for this struct hierarchy
-		forceSendFieldsMap := getForceSendFieldsForFromTyped(v)
-
-		fv, sf, embeddedIndex, ok := findStructFieldByKey(v, key)
+		fv, sf, owner, ok := findStructFieldByKey(v, key)
 		if !ok {
 			return reflect.Value{}, fmt.Errorf("%s: field %q not found in %s", path.String(), key, v.Type())
 		}
 
-		// Check ForceSendFields using precalculated map
-		var force bool
-		if fields, exists := forceSendFieldsMap[embeddedIndex]; exists {
-			force = containsString(fields, sf.Name)
-		}
+		// ForceSendFields is only managed by the struct that declares the field.
+		force := forceSendFieldsContains(owner, sf.Name)
 
 		// Honor omitempty: if present and value is empty and not forced, treat as omitted (nil).
 		jsonTag := structtag.JSONTag(sf.Tag.Get("json"))
@@ -242,11 +241,11 @@ func findFieldInStruct(v reflect.Value, key string) (reflect.Value, reflect.Stru
 			continue
 		}
 
+		if IsSkippedField(sf) {
+			continue
+		}
 		// Read JSON tag using structtag helper
 		name := structtag.JSONTag(sf.Tag.Get("json")).Name()
-		if name == "-" {
-			name = ""
-		}
 
 		if sf.Name == EmbeddedSliceFieldName {
 			continue // EmbeddedSlice fields are not accessible by name
@@ -265,28 +264,50 @@ func findFieldInStruct(v reflect.Value, key string) (reflect.Value, reflect.Stru
 
 // findStructFieldByKey searches exported fields of struct v for a field matching key.
 // It matches json tag name (when present and not "-") only.
-// It also searches embedded anonymous structs (flattening semantics).
-// Returns: fieldValue, structField, embeddedIndex, found
-// embeddedIndex is -1 for direct fields, or the index of the embedded struct containing the field.
-func findStructFieldByKey(v reflect.Value, key string) (reflect.Value, reflect.StructField, int, bool) {
-	t := v.Type()
-
+// It also searches embedded anonymous structs recursively (flattening semantics), which
+// FindStructFieldByKeyType does too: a bundle resource embeds a config struct that embeds
+// the SDK request struct, so its fields sit two levels down.
+// Returns: fieldValue, structField, owner (the struct value declaring the field), found
+func findStructFieldByKey(v reflect.Value, key string) (reflect.Value, reflect.StructField, reflect.Value, bool) {
 	// First pass: direct fields
 	if fv, sf, found := findFieldInStruct(v, key); found {
-		return fv, sf, -1, true
+		return fv, sf, v, true
 	}
 
-	// Second pass: search embedded anonymous structs (flattening semantics)
+	// Second pass: search embedded anonymous structs (flattening semantics) breadth-first, one
+	// level of embedding at a time. Not depth-first: encoding/json resolves a name declared at
+	// two embedding depths in favour of the shallower one, so descending fully into the first
+	// embed could pick a field three levels down over the same name two levels down in a
+	// later one -- and then reading or writing the field would not be the field serialized
+	// under that name.
+	level := embeddedStructs(v)
+	for len(level) > 0 {
+		var next []reflect.Value
+		for _, fv := range level {
+			if out, sf, found := findFieldInStruct(fv, key); found {
+				return out, sf, fv, true
+			}
+			next = append(next, embeddedStructs(fv)...)
+		}
+		level = next
+	}
+
+	return reflect.Value{}, reflect.StructField{}, reflect.Value{}, false
+}
+
+// embeddedStructs returns the anonymous struct fields of v, dereferenced, skipping any that
+// cannot be descended into.
+func embeddedStructs(v reflect.Value) []reflect.Value {
+	var out []reflect.Value
+	t := v.Type()
 	for i := range t.NumField() {
-		sf := t.Field(i)
-		if !sf.Anonymous {
+		if !t.Field(i).Anonymous {
 			continue
 		}
 		fv := v.Field(i)
-		// Dereference pointer anonymous structs
 		for fv.Kind() == reflect.Pointer {
 			if fv.IsNil() {
-				// Not initialized; can't descend
+				// Not initialized; can't descend.
 				break
 			}
 			fv = fv.Elem()
@@ -294,59 +315,35 @@ func findStructFieldByKey(v reflect.Value, key string) (reflect.Value, reflect.S
 		if fv.Kind() != reflect.Struct {
 			continue
 		}
-		if out, osf, found := findFieldInStruct(fv, key); found {
-			return out, osf, i, true
-		}
+		out = append(out, fv)
 	}
-
-	return reflect.Value{}, reflect.StructField{}, -1, false
+	return out
 }
 
-// getForceSendFieldsForFromTyped collects ForceSendFields values for FromTyped operations
-// Returns map[structKey][]fieldName where structKey is -1 for direct fields, embedded index for embedded fields
-func getForceSendFieldsForFromTyped(v reflect.Value) map[int][]string {
-	if !v.IsValid() || v.Type().Kind() != reflect.Struct {
-		return make(map[int][]string)
+// forceSendFields returns the ForceSendFields slice a struct declares itself. A struct that
+// embeds another shadows it deliberately -- see resources.PostgresProjectConfig -- so only
+// the declaring struct tracks a field of its own.
+func forceSendFields(owner reflect.Value) reflect.Value {
+	if !owner.IsValid() || owner.Kind() != reflect.Struct {
+		return reflect.Value{}
 	}
-
-	result := make(map[int][]string)
-
-	for i := range v.Type().NumField() {
-		field := v.Type().Field(i)
-		fieldValue := v.Field(i)
-
+	for i := range owner.Type().NumField() {
+		field := owner.Type().Field(i)
 		if field.Name == "ForceSendFields" && !field.Anonymous {
-			// Direct ForceSendFields (structKey = -1)
-			if fields, ok := fieldValue.Interface().([]string); ok {
-				result[-1] = fields
-			}
-		} else if field.Anonymous {
-			// Embedded struct - check for ForceSendFields inside it
-			if embeddedStruct := getEmbeddedStructForReading(fieldValue); embeddedStruct.IsValid() {
-				if forceSendField := embeddedStruct.FieldByName("ForceSendFields"); forceSendField.IsValid() {
-					if fields, ok := forceSendField.Interface().([]string); ok {
-						result[i] = fields
-					}
-				}
-			}
+			return owner.Field(i)
 		}
 	}
-
-	return result
+	return reflect.Value{}
 }
 
-// Helper function for reading - doesn't create nil pointers
-func getEmbeddedStructForReading(fieldValue reflect.Value) reflect.Value {
-	if fieldValue.Kind() == reflect.Pointer {
-		if fieldValue.IsNil() {
-			return reflect.Value{} // Don't create, just return invalid
-		}
-		fieldValue = fieldValue.Elem()
-	}
-	if fieldValue.Kind() == reflect.Struct {
-		return fieldValue
+// forceSendFieldsContains reports whether a struct forces the named field to be sent.
+func forceSendFieldsContains(owner reflect.Value, name string) bool {
+	fsf := forceSendFields(owner)
+	if !fsf.IsValid() {
+		return false
 	}
-	return reflect.Value{}
+	fields, ok := reflect.TypeAssert[[]string](fsf)
+	return ok && containsString(fields, name)
 }
 
 // containsString checks if a slice contains a specific string
diff --git a/libs/structs/structaccess/get_test.go b/libs/structs/structaccess/get_test.go
index 1a6f8387901..2d7ae4d46b1 100644
--- a/libs/structs/structaccess/get_test.go
+++ b/libs/structs/structaccess/get_test.go
@@ -192,9 +192,21 @@ func runCommonTests(t *testing.T, obj any) {
 			errFmt: "connection.missing: field \"missing\" not found in structaccess.inner",
 		},
 		{
-			name:   "wrong index target",
-			path:   "connection[0]",
-			errFmt: "connection[0]: cannot index struct",
+			// [0] on a struct is a no-op (Terraform list-block syntax for single blocks)
+			name: "index [0] on struct is no-op",
+			path: "connection[0]",
+			want: inner{ID: "abc", Name: "x"},
+		},
+		{
+			name: "index [0] on struct then field",
+			path: "connection[0].id",
+			want: "abc",
+		},
+		{
+			// Non-zero index on a struct is still an error.
+			name:   "non-zero index on struct is error",
+			path:   "connection[1]",
+			errFmt: "connection[1]: cannot index struct",
 		},
 		{
 			name:     "out of range index",
@@ -402,7 +414,7 @@ func TestGet_Embedded_ValueAnonymousResolved(t *testing.T) {
 	type host struct {
 		embedded
 	}
-	in := host{embedded: embedded{Hidden: "x"}}
+	in := host{Hidden: "x"}
 	require.NoError(t, ValidateByString(reflect.TypeFor[host](), "hidden"))
 	testGet(t, in, "hidden", "x")
 }
@@ -441,7 +453,7 @@ func TestGet_BundleTag_SkipsPromoted(t *testing.T) {
 		embedded
 	}
 	// Promoted readonly field should be invisible
-	_, err := GetByString(host{embedded: embedded{Hidden: "x"}}, "hidden")
+	_, err := GetByString(host{Hidden: "x"}, "hidden")
 	require.EqualError(t, err, "hidden: field \"hidden\" not found in structaccess.host")
 	require.EqualError(t, ValidateByString(reflect.TypeFor[host](), "hidden"), "hidden: field \"hidden\" not found in structaccess.host")
 }
@@ -462,13 +474,11 @@ func TestGet_EmbeddedStructForceSendFields(t *testing.T) {
 	objWithOuterFSF := Outer{
 		OuterFieldOmit:   "",
 		OuterFieldNoOmit: "",
-		Inner: Inner{
-			InnerFieldOmit:   "",
-			InnerFieldNoOmit: "",
-			// Presence of "OuterFieldOmit" does not have any effect
-			// on OuterFieldOmit because it's in the wrong struct
-			ForceSendFields: []string{"OuterFieldOmit"},
-		},
+		InnerFieldOmit:   "",
+		InnerFieldNoOmit: "",
+		// Presence of "OuterFieldOmit" does not have any effect
+		// on OuterFieldOmit because it's in the wrong struct
+		ForceSendFields: []string{"OuterFieldOmit"},
 	}
 
 	testGet(t, objWithOuterFSF, "outer_field_omit", nil)
@@ -479,11 +489,9 @@ func TestGet_EmbeddedStructForceSendFields(t *testing.T) {
 	objWithInnerFSF := Outer{
 		OuterFieldOmit:   "",
 		OuterFieldNoOmit: "",
-		Inner: Inner{
-			InnerFieldOmit:   "",
-			InnerFieldNoOmit: "",
-			ForceSendFields:  []string{"InnerFieldOmit"},
-		},
+		InnerFieldOmit:   "",
+		InnerFieldNoOmit: "",
+		ForceSendFields:  []string{"InnerFieldOmit"},
 	}
 
 	testGet(t, objWithInnerFSF, "outer_field_omit", nil)
@@ -520,10 +528,8 @@ func TestGet_MultipleEmbeddedStructsForceSendFields(t *testing.T) {
 			FirstFieldNoOmit: "",
 			ForceSendFields:  []string{"FirstFieldOmit"},
 		},
-		Second: Second{
-			SecondFieldOmit:   "",
-			SecondFieldNoOmit: "",
-		},
+		SecondFieldOmit:   "",
+		SecondFieldNoOmit: "",
 	}
 
 	testGet(t, objWithFirstFSF, "outer_field_omit", nil)
@@ -536,10 +542,8 @@ func TestGet_MultipleEmbeddedStructsForceSendFields(t *testing.T) {
 	objWithSecondFSF := Outer{
 		OuterFieldOmit:   "",
 		OuterFieldNoOmit: "",
-		First: First{
-			FirstFieldOmit:   "",
-			FirstFieldNoOmit: "",
-		},
+		FirstFieldOmit:   "",
+		FirstFieldNoOmit: "",
 		Second: Second{
 			SecondFieldOmit:   "",
 			SecondFieldNoOmit: "",
@@ -576,17 +580,13 @@ func TestGet_MixedForceSendFields(t *testing.T) {
 	}
 
 	objWithOuterFSF := Outer{
-		OuterFieldOmit:   "",
-		OuterFieldNoOmit: "",
-		ForceSendFields:  []string{"OuterFieldOmit"},
-		First: First{
-			FirstFieldOmit:   "",
-			FirstFieldNoOmit: "",
-		},
-		Second: Second{
-			SecondFieldOmit:   "",
-			SecondFieldNoOmit: "",
-		},
+		OuterFieldOmit:    "",
+		OuterFieldNoOmit:  "",
+		ForceSendFields:   []string{"OuterFieldOmit"},
+		FirstFieldOmit:    "",
+		FirstFieldNoOmit:  "",
+		SecondFieldOmit:   "",
+		SecondFieldNoOmit: "",
 	}
 
 	testGet(t, objWithOuterFSF, "outer_field_omit", "")
@@ -599,10 +599,8 @@ func TestGet_MixedForceSendFields(t *testing.T) {
 	objWithSecondFSF := Outer{
 		OuterFieldOmit:   "",
 		OuterFieldNoOmit: "",
-		First: First{
-			FirstFieldOmit:   "",
-			FirstFieldNoOmit: "",
-		},
+		FirstFieldOmit:   "",
+		FirstFieldNoOmit: "",
 		Second: Second{
 			SecondFieldOmit:   "",
 			SecondFieldNoOmit: "",
@@ -636,13 +634,9 @@ func TestGet_FieldByNameBugRegressionTest(t *testing.T) {
 	}
 
 	objWithNameValue := Job{
-		BaseResource: BaseResource{
-			ID: "resource_id",
-		},
-		JobSettings: JobSettings{
-			Name:            "test-job",
-			ForceSendFields: []string{"Name"},
-		},
+		ID:                "resource_id",
+		Name:              "test-job",
+		ForceSendFields:   []string{"Name"},
 		PermissionsOmit:   []string{"read", "write"},
 		PermissionsNoOmit: []string{"read", "write"},
 	}
@@ -653,13 +647,9 @@ func TestGet_FieldByNameBugRegressionTest(t *testing.T) {
 	testGet(t, objWithNameValue, "permissions_no_omit", []string{"read", "write"})
 
 	objWithEmptyFields := Job{
-		BaseResource: BaseResource{
-			ID: "",
-		},
-		JobSettings: JobSettings{
-			Name:            "",
-			ForceSendFields: []string{"Name"},
-		},
+		ID:                "",
+		Name:              "",
+		ForceSendFields:   []string{"Name"},
 		PermissionsOmit:   []string{},
 		PermissionsNoOmit: []string{},
 	}
diff --git a/libs/structs/structaccess/set.go b/libs/structs/structaccess/set.go
index 2285d470fa9..02752e456ea 100644
--- a/libs/structs/structaccess/set.go
+++ b/libs/structs/structaccess/set.go
@@ -130,7 +130,7 @@ func setFieldOrMapValue(parentVal reflect.Value, key string, valueVal reflect.Va
 
 // setStructField sets a field in a struct and handles ForceSendFields
 func setStructField(parentVal reflect.Value, fieldName string, valueVal reflect.Value) error {
-	fv, sf, embeddedIndex, ok := findStructFieldByKey(parentVal, fieldName)
+	fv, sf, owner, ok := findStructFieldByKey(parentVal, fieldName)
 	if !ok {
 		return fmt.Errorf("field %q not found in %s", fieldName, parentVal.Type())
 	}
@@ -140,13 +140,24 @@ func setStructField(parentVal reflect.Value, fieldName string, valueVal reflect.
 		return fmt.Errorf("field %q cannot be set", sf.Name)
 	}
 
-	// Handle ForceSendFields: remove if setting nil, add if setting empty value
-	err := updateForceSendFields(parentVal, sf.Name, embeddedIndex, valueVal, sf)
+	// Assign first: a value that cannot be converted must leave the struct exactly as it was.
+	converted, err := convertValue(valueVal, fv.Type())
 	if err != nil {
 		return err
 	}
+	if err := assignValue(fv, converted); err != nil {
+		return err
+	}
 
-	return assignValue(fv, valueVal)
+	// ForceSendFields is decided from the converted value, not the caller's: setting an
+	// omitempty int64 from the string "0" stores 0, which is empty and must be forced, while
+	// the string "0" is not empty and would have left the field to be omitted.
+	if !valueVal.IsValid() {
+		// Setting nil: the field is being made absent, which convertValue renders as the zero
+		// value. Pass the invalid value through so it is removed from ForceSendFields.
+		return updateForceSendFields(owner, sf.Name, valueVal, sf)
+	}
+	return updateForceSendFields(owner, sf.Name, converted, sf)
 }
 
 // setMapValue sets a value in a map
@@ -303,7 +314,7 @@ func convertValue(valueVal reflect.Value, targetType reflect.Type) (reflect.Valu
 // - If setting nil: remove field from ForceSendFields
 // - If setting empty value: add field to ForceSendFields (if not already present)
 // Only applies to fields with omitempty tag
-func updateForceSendFields(parentVal reflect.Value, fieldName string, embeddedIndex int, valueVal reflect.Value, structField reflect.StructField) error {
+func updateForceSendFields(owner reflect.Value, fieldName string, valueVal reflect.Value, structField reflect.StructField) error {
 	isSettingNil := !valueVal.IsValid()
 	isSettingEmptyValue := valueVal.IsValid() && isEmptyForOmitEmpty(valueVal)
 
@@ -319,8 +330,8 @@ func updateForceSendFields(parentVal reflect.Value, fieldName string, embeddedIn
 		return nil
 	}
 
-	// Find the appropriate ForceSendFields slice to modify
-	forceSendFieldsSlice := findForceSendFieldsForSetting(parentVal, embeddedIndex)
+	// Only the struct that declares the field tracks it.
+	forceSendFieldsSlice := forceSendFields(owner)
 	if !forceSendFieldsSlice.IsValid() {
 		// No ForceSendFields to update
 		return nil
@@ -337,64 +348,10 @@ func updateForceSendFields(parentVal reflect.Value, fieldName string, embeddedIn
 	return nil
 }
 
-// findForceSendFieldsForSetting finds the correct ForceSendFields slice to modify
-// This should match the logic in get.go's getForceSendFieldsForFromTyped
-// Only the struct that contains the ForceSendFields can manage its own fields
-// embeddedIndex: -1 for direct fields, or the index of the embedded struct
-func findForceSendFieldsForSetting(parentVal reflect.Value, embeddedIndex int) reflect.Value {
-	if embeddedIndex == -1 {
-		// Direct field - check if parent struct has its own ForceSendFields
-		// We need to check the struct type directly, not through field promotion
-		parentType := parentVal.Type()
-		for i := range parentType.NumField() {
-			field := parentType.Field(i)
-			if field.Name == "ForceSendFields" && !field.Anonymous {
-				// Parent has direct ForceSendFields
-				return parentVal.Field(i)
-			}
-		}
-		// Parent struct has no direct ForceSendFields, so no management possible
-		return reflect.Value{}
-	} else {
-		// Embedded field - look for ForceSendFields in the embedded struct
-		embeddedField := parentVal.Field(embeddedIndex)
-		embeddedStruct := getEmbeddedStructForSetting(embeddedField)
-		if !embeddedStruct.IsValid() {
-			return reflect.Value{}
-		}
-		fsf := embeddedStruct.FieldByName("ForceSendFields")
-		if fsf.IsValid() {
-			return fsf
-		}
-		// Embedded struct has no ForceSendFields, so no management possible
-		return reflect.Value{}
-	}
-}
-
-// getEmbeddedStructForSetting gets the embedded struct for setting operations
-// Creates nil pointers if needed
-func getEmbeddedStructForSetting(fieldValue reflect.Value) reflect.Value {
-	if fieldValue.Kind() == reflect.Pointer {
-		if fieldValue.IsNil() {
-			// Create new instance if needed
-			if fieldValue.CanSet() {
-				fieldValue.Set(reflect.New(fieldValue.Type().Elem()))
-			} else {
-				return reflect.Value{}
-			}
-		}
-		fieldValue = fieldValue.Elem()
-	}
-	if fieldValue.Kind() == reflect.Struct {
-		return fieldValue
-	}
-	return reflect.Value{}
-}
-
 // removeFromForceSendFields removes fieldName from the ForceSendFields slice
 func removeFromForceSendFields(forceSendFieldsSlice reflect.Value, fieldName string) {
 	// Get the original []string slice
-	fields := forceSendFieldsSlice.Interface().([]string)
+	fields, _ := reflect.TypeAssert[[]string](forceSendFieldsSlice)
 
 	// Find the index of the field to remove
 	index := slices.Index(fields, fieldName)
@@ -410,7 +367,7 @@ func removeFromForceSendFields(forceSendFieldsSlice reflect.Value, fieldName str
 // addToForceSendFields adds fieldName to the ForceSendFields slice if not already present
 func addToForceSendFields(forceSendFieldsSlice reflect.Value, fieldName string) {
 	// Get the original []string slice
-	fields := forceSendFieldsSlice.Interface().([]string)
+	fields, _ := reflect.TypeAssert[[]string](forceSendFieldsSlice)
 
 	// Check if already present
 	if slices.Contains(fields, fieldName) {
diff --git a/libs/structs/structaccess/set_test.go b/libs/structs/structaccess/set_test.go
index 1b294494eca..e1829b8cf3c 100644
--- a/libs/structs/structaccess/set_test.go
+++ b/libs/structs/structaccess/set_test.go
@@ -1,6 +1,8 @@
 package structaccess_test
 
 import (
+	"encoding/json"
+	"reflect"
 	"testing"
 
 	"github.com/databricks/cli/libs/structs/structaccess"
@@ -595,11 +597,9 @@ func TestSet_EmbeddedStructForceSendFields(t *testing.T) {
 		obj := Outer{
 			OuterFieldOmit:   "outer_value",
 			OuterFieldNoOmit: "outer_no_omit",
-			Inner: Inner{
-				InnerFieldOmit:   "inner_value",
-				InnerFieldNoOmit: "inner_no_omit",
-				ForceSendFields:  []string{"OuterFieldOmit", "InnerFieldOmit"},
-			},
+			InnerFieldOmit:   "inner_value",
+			InnerFieldNoOmit: "inner_no_omit",
+			ForceSendFields:  []string{"OuterFieldOmit", "InnerFieldOmit"},
 		}
 
 		// Set nil value for outer field - roundtrip nil -> nil
@@ -630,11 +630,9 @@ func TestSet_EmbeddedStructForceSendFields(t *testing.T) {
 		obj := Outer{
 			OuterFieldOmit:   "outer_value",
 			OuterFieldNoOmit: "outer_no_omit",
-			Inner: Inner{
-				InnerFieldOmit:   "inner_value",
-				InnerFieldNoOmit: "inner_no_omit",
-				ForceSendFields:  []string{},
-			},
+			InnerFieldOmit:   "inner_value",
+			InnerFieldNoOmit: "inner_no_omit",
+			ForceSendFields:  []string{},
 		}
 
 		// Set empty string for outer field, but get nil back (omitempty, no ForceSendFields)
@@ -687,10 +685,8 @@ func TestSet_MixedForceSendFields(t *testing.T) {
 			OuterFieldOmit:   "outer_value",
 			OuterFieldNoOmit: "outer_no_omit",
 			ForceSendFields:  []string{"OuterFieldOmit", "FirstFieldOmit"},
-			First: First{
-				FirstFieldOmit:   "first_value",
-				FirstFieldNoOmit: "first_no_omit",
-			},
+			FirstFieldOmit:   "first_value",
+			FirstFieldNoOmit: "first_no_omit",
 			Second: Second{
 				SecondFieldOmit:   "second_value",
 				SecondFieldNoOmit: "second_no_omit",
@@ -742,10 +738,8 @@ func TestSet_MixedForceSendFields(t *testing.T) {
 			OuterFieldOmit:   "outer_value",
 			OuterFieldNoOmit: "outer_no_omit",
 			ForceSendFields:  []string{},
-			First: First{
-				FirstFieldOmit:   "first_value",
-				FirstFieldNoOmit: "first_no_omit",
-			},
+			FirstFieldOmit:   "first_value",
+			FirstFieldNoOmit: "first_no_omit",
 			Second: Second{
 				SecondFieldOmit:   "second_value",
 				SecondFieldNoOmit: "second_no_omit",
@@ -791,3 +785,120 @@ func TestSet_MixedForceSendFields(t *testing.T) {
 		assert.Equal(t, []string{"SecondFieldOmit"}, obj.Second.ForceSendFields) // no duplicates
 	})
 }
+
+// A value that cannot be converted must leave the struct untouched, ForceSendFields included.
+func TestSet_FailedConversionLeavesForceSendFields(t *testing.T) {
+	job := &jobs.JobSettings{Name: "n"} //exhaustruct:ignore
+
+	require.Error(t, structaccess.SetByString(job, "max_concurrent_runs", ""))
+	assert.Empty(t, job.ForceSendFields)
+	assert.Equal(t, "n", job.Name)
+}
+
+// ForceSendFields is decided from the value actually stored, not the one the caller passed:
+// setting an omitempty numeric field from the string "0" stores zero, which has to be forced
+// or the field marshals as absent.
+func TestSet_StringZeroIntoOmitemptyNumberIsForced(t *testing.T) {
+	job := &jobs.JobSettings{Name: "n"} //exhaustruct:ignore
+
+	require.NoError(t, structaccess.SetByString(job, "max_concurrent_runs", "0"))
+	assert.Equal(t, 0, job.MaxConcurrentRuns)
+	assert.Contains(t, job.ForceSendFields, "MaxConcurrentRuns")
+
+	blob, err := json.Marshal(job)
+	require.NoError(t, err)
+	assert.Contains(t, string(blob), `"max_concurrent_runs":0`)
+}
+
+// encoding/json resolves a name declared at two embedding depths in favour of the shallower
+// one. Get and Set have to agree with it, so the embedded search goes level by level: a
+// depth-first search would find Deep.Value first, since its embed is declared first.
+type deepValue struct {
+	Value string `json:"value"`
+}
+
+type deepEmbed struct {
+	deepValue
+}
+
+type shallowEmbed struct {
+	Value string `json:"value"`
+}
+
+type deeperEmbed struct {
+	deepEmbed
+}
+
+type embedDepths struct {
+	deepEmbed
+	shallowEmbed
+}
+
+// The same name three levels down in the first member, against two levels down in a later
+// one. json picks the shallower, so the search has to be breadth-first across the whole tree
+// rather than depth-first per member.
+type embedDepthsAcrossMembers struct {
+	deeperEmbed
+	deepEmbed
+}
+
+func TestSet_ShallowerEmbedWinsAcrossMembers(t *testing.T) {
+	target := &embedDepthsAcrossMembers{}
+
+	require.NoError(t, structaccess.SetByString(target, "value", "set"))
+	assert.Equal(t, "set", target.Value)
+	assert.Empty(t, target.deeperEmbed.Value)
+
+	require.NoError(t, structaccess.ValidateByString(reflect.TypeOf(target), "value"))
+
+	blob, err := json.Marshal(target)
+	require.NoError(t, err)
+	assert.JSONEq(t, `{"value":"set"}`, string(blob))
+}
+
+func TestSet_ShallowerEmbedWins(t *testing.T) {
+	target := &embedDepths{}
+
+	require.NoError(t, structaccess.SetByString(target, "value", "set"))
+	assert.Equal(t, "set", target.Value)
+	assert.Empty(t, target.deepEmbed.Value)
+
+	got, err := structaccess.GetByString(target, "value")
+	require.NoError(t, err)
+	assert.Equal(t, "set", got)
+
+	// The same field json.Marshal picks, which is the contract being matched.
+	blob, err := json.Marshal(target)
+	require.NoError(t, err)
+	assert.JSONEq(t, `{"value":"set"}`, string(blob))
+}
+
+// dashNamed exercises the json:"-" vs json:"-,omitempty" distinction.
+type dashNamed struct {
+	Skipped string `json:"-"`
+	Named   string `json:"-,omitempty"` //nolint:staticcheck // odd tag is the point
+	Kept    string `json:"kept,omitempty"`
+}
+
+// TestGetSet_DashIsAFieldNameWhenTheTagHasOptions codifies that encoding/json
+// treats json:"-" and json:"-,omitempty" differently, and that structaccess
+// agrees. The test uses json.Marshal as the oracle.
+func TestGetSet_DashIsAFieldNameWhenTheTagHasOptions(t *testing.T) {
+	target := &dashNamed{Skipped: "s", Named: "n", Kept: "k"}
+
+	// encoding/json oracle: exact json:"-" is omitted; json:"-,omitempty"
+	// names the field "-" and serializes it.
+	blob, err := json.Marshal(target)
+	require.NoError(t, err)
+	assert.JSONEq(t, `{"-":"n","kept":"k"}`, string(blob),
+		"encoding/json must emit '-' from Named and omit Skipped")
+
+	// structaccess must agree with the oracle.
+	value, err := structaccess.GetByString(target, "-")
+	require.NoError(t, err)
+	assert.Equal(t, "n", value, "Get must resolve \"-\" to Named")
+
+	require.NoError(t, structaccess.SetByString(target, "-", "set"))
+	assert.Equal(t, "set", target.Named, "Set must write to Named")
+	assert.Equal(t, "s", target.Skipped, "json:\"-\" field must stay out of reach")
+}
diff --git a/libs/structs/structaccess/typecheck.go b/libs/structs/structaccess/typecheck.go
index 2fa9a1f8d44..20b4bc75506 100644
--- a/libs/structs/structaccess/typecheck.go
+++ b/libs/structs/structaccess/typecheck.go
@@ -54,7 +54,7 @@ func validateNodeSlice(t reflect.Type, nodes []*structpath.PatternNode) error {
 		}
 
 		// Index access: slice/array
-		if _, isIndex := node.Index(); isIndex {
+		if idx, isIndex := node.Index(); isIndex {
 			if cur.Kind() == reflect.Struct {
 				if embedType := findEmbedFieldType(cur); embedType != nil {
 					cur = embedType
@@ -62,6 +62,11 @@ func validateNodeSlice(t reflect.Type, nodes []*structpath.PatternNode) error {
 			}
 			kind := cur.Kind()
 			if kind != reflect.Slice && kind != reflect.Array {
+				// Terraform represents single-block fields as lists and uses [0] to access them.
+				// Treat [0] on a struct as a no-op so TF-style paths work against DABs structs.
+				if idx == 0 && kind == reflect.Struct {
+					continue
+				}
 				return fmt.Errorf("%s: cannot index %s", node.String(), kind)
 			}
 			cur = cur.Elem()
@@ -142,28 +147,63 @@ func FindStructFieldByKeyType(t reflect.Type, key string) (reflect.StructField,
 	}
 
 	// First pass: direct fields
-	for i := range t.NumField() {
-		sf := t.Field(i)
+	if sf, ok := findDirectFieldByKeyType(t, key); ok {
+		return sf, t, true
+	}
+
+	// Second pass: search embedded anonymous structs breadth-first, mirroring findStructFieldByKey
+	// (get.go) so a path validates against the same field Get and Set resolve it to, which is
+	// the one encoding/json serializes: the shallower of two same-named fields.
+	level := embeddedStructTypes(t)
+	for len(level) > 0 {
+		var next []reflect.Type
+		for _, ft := range level {
+			if sf, ok := findDirectFieldByKeyType(ft, key); ok {
+				return sf, ft, true
+			}
+			next = append(next, embeddedStructTypes(ft)...)
+		}
+		level = next
+	}
+
+	return reflect.StructField{}, reflect.TypeOf(nil), false
+}
+
+// findDirectFieldByKeyType matches key against the struct's own fields, by json tag name.
+func findDirectFieldByKeyType(t reflect.Type, key string) (reflect.StructField, bool) {
+	for sf := range t.Fields() {
 		if sf.PkgPath != "" { // unexported
 			continue
 		}
+		if IsSkippedField(sf) || sf.Name == EmbeddedSliceFieldName {
+			continue
+		}
 		name := structtag.JSONTag(sf.Tag.Get("json")).Name()
-		if name == "-" || sf.Name == EmbeddedSliceFieldName {
-			name = ""
+		if name != key {
+			continue
 		}
-		if name != "" && name == key {
-			// Skip fields marked as internal/readonly
-			btag := structtag.BundleTag(sf.Tag.Get("bundle"))
-			if btag.Internal() || btag.ReadOnly() {
-				continue
-			}
-			return sf, t, true
+		// Skip fields marked as internal/readonly
+		btag := structtag.BundleTag(sf.Tag.Get("bundle"))
+		if btag.Internal() || btag.ReadOnly() {
+			continue
 		}
+		return sf, true
 	}
+	return reflect.StructField{}, false
+}
 
-	// Second pass: search embedded anonymous structs recursively (flattening semantics)
-	for i := range t.NumField() {
-		sf := t.Field(i)
+// IsSkippedField reports whether encoding/json omits the field entirely. Only
+// the exact tag `json:"-"` does that: `json:"-,"` and `json:"-,omitempty"`
+// name the field "-", which is a distinction structtag's parsed name cannot
+// carry (it reports "-" for both).
+func IsSkippedField(sf reflect.StructField) bool {
+	return sf.Tag.Get("json") == "-"
+}
+
+// embeddedStructTypes returns the anonymous struct fields of t, dereferenced.
+func embeddedStructTypes(t reflect.Type) []reflect.Type {
+	var out []reflect.Type
+	for sf := range t.Fields() {
 		if !sf.Anonymous {
 			continue
 		}
@@ -171,19 +211,29 @@ func FindStructFieldByKeyType(t reflect.Type, key string) (reflect.StructField,
 		for ft.Kind() == reflect.Pointer {
 			ft = ft.Elem()
 		}
-		if ft.Kind() != reflect.Struct {
-			continue
-		}
-		if osf, owner, ok := FindStructFieldByKeyType(ft, key); ok {
-			// Skip fields marked as internal/readonly
-			btag := structtag.BundleTag(osf.Tag.Get("bundle"))
-			if btag.Internal() || btag.ReadOnly() {
-				// Treat as not found and continue
-				continue
-			}
-			return osf, owner, true
+		if ft.Kind() == reflect.Struct {
+			out = append(out, ft)
 		}
 	}
+	return out
+}
 
-	return reflect.StructField{}, reflect.TypeOf(nil), false
+// IsFlattenedEmbed reports whether the field is an embed encoding/json flattens into the
+// outer object. An anonymous field that carries a json *name* is a named field instead: it
+// serializes as a nested object under that name. The name is what matters, not the presence
+// of a tag: `json:",omitempty"` leaves the name empty, so such a field is still flattened.
+func IsFlattenedEmbed(sf reflect.StructField) bool {
+	if !sf.Anonymous {
+		return false
+	}
+	if structtag.JSONTag(sf.Tag.Get("json")).Name() != "" {
+		return false
+	}
+	// Only an anonymous *struct* is promoted. An embedded scalar, slice or interface
+	// is a member named after its type, not a flattened embed.
+	ft := sf.Type
+	for ft.Kind() == reflect.Pointer {
+		ft = ft.Elem()
+	}
+	return ft.Kind() == reflect.Struct
 }
diff --git a/libs/structs/structdiff/bench_test.go b/libs/structs/structdiff/bench_test.go
index f0406047835..08b386416ef 100644
--- a/libs/structs/structdiff/bench_test.go
+++ b/libs/structs/structdiff/bench_test.go
@@ -17,15 +17,13 @@ func bench(b *testing.B, job1, job2 string) {
 
 	total := 0
 
-	b.ResetTimer()
-	for range b.N {
+	for b.Loop() {
 		changes, err := GetStructDiff(&x, &y, nil)
 		if err != nil {
 			b.Fatalf("error: %s", err)
 		}
 		total += len(changes)
 	}
-	b.StopTimer()
 
 	b.Logf("Total: %d / %d", total, b.N)
 }
diff --git a/libs/structs/structdiff/diff.go b/libs/structs/structdiff/diff.go
index a852d347e42..5e7a00cac4f 100644
--- a/libs/structs/structdiff/diff.go
+++ b/libs/structs/structdiff/diff.go
@@ -132,6 +132,17 @@ func diffValues(ctx *diffContext, path *structpath.PathNode, v1, v2 reflect.Valu
 		return nil
 	}
 
+	if IsOpaqueStruct(v1Type) {
+		equal, err := equalJSON(v1, v2)
+		if err != nil {
+			return err
+		}
+		if !equal {
+			*changes = append(*changes, Change{Path: path, Old: v1.Interface(), New: v2.Interface()})
+		}
+		return nil
+	}
+
 	kind := v1.Kind()
 
 	// Perform nil checks for nilable types.
@@ -198,8 +209,10 @@ func diffStruct(ctx *diffContext, path *structpath.PathNode, s1, s2 reflect.Valu
 			continue
 		}
 
-		// Continue traversing embedded structs. Do not add the key to the path though.
-		if sf.Anonymous {
+		// Continue traversing embedded structs. Do not add the key to the path though. An
+		// anonymous field carrying a json name is not one of these: encoding/json serializes it
+		// as a nested object, so it is handled as a named field below.
+		if structaccess.IsFlattenedEmbed(sf) {
 			if err := diffValues(ctx, path, s1.Field(i), s2.Field(i), changes); err != nil {
 				return err
 			}
@@ -259,13 +272,13 @@ func diffStruct(ctx *diffContext, path *structpath.PathNode, s1, s2 reflect.Valu
 func diffMapStringKey(ctx *diffContext, path *structpath.PathNode, m1, m2 reflect.Value, changes *[]Change) error {
 	keySet := map[string]reflect.Value{}
 	for _, k := range m1.MapKeys() {
-		// Key is always string at this point
-		ks := k.Interface().(string)
-		keySet[ks] = k
+		// Caller guarantees the key kind is String; use Value.String() rather
+		// than a .(string) assertion, which panics on a named string key type
+		// (e.g. `type ScriptHook string`) whose dynamic type is not string.
+		keySet[k.String()] = k
 	}
 	for _, k := range m2.MapKeys() {
-		ks := k.Interface().(string)
-		keySet[ks] = k
+		keySet[k.String()] = k
 	}
 
 	keys := slices.Sorted(maps.Keys(keySet))
@@ -290,7 +303,7 @@ func getForceSendFields(v reflect.Value) []string {
 	if !fsField.IsValid() || fsField.Kind() != reflect.Slice {
 		return nil
 	}
-	result, ok := fsField.Interface().([]string)
+	result, ok := reflect.TypeAssert[[]string](fsField)
 	if ok {
 		return result
 	}
diff --git a/libs/structs/structdiff/diff_test.go b/libs/structs/structdiff/diff_test.go
index 474694d5e61..15f90f076f6 100644
--- a/libs/structs/structdiff/diff_test.go
+++ b/libs/structs/structdiff/diff_test.go
@@ -1,10 +1,16 @@
 package structdiff
 
 import (
+	"encoding/json"
 	"reflect"
 	"testing"
+	"time"
 
+	"github.com/databricks/databricks-sdk-go/common/types/duration"
+	sdktime "github.com/databricks/databricks-sdk-go/common/types/time"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 type B struct{ S string }
@@ -42,6 +48,15 @@ type E struct {
 	Name      string `json:"name,omitempty"`
 }
 
+// O holds opaque struct fields: Duration and Timestamp keep their payload in an
+// unexported protobuf pointer, while Empty is a proto message that really is
+// empty.
+type O struct {
+	Duration  *duration.Duration         `json:"duration,omitempty"`
+	Timestamp *sdktime.Time              `json:"timestamp,omitempty"`
+	Empty     *jobs.ScheduleTriggerState `json:"empty,omitempty"`
+}
+
 // ResolvedChange represents a change with the field path as a string (like the old Change struct)
 type ResolvedChange struct {
 	Field string
@@ -69,6 +84,11 @@ func TestGetStructDiff(t *testing.T) {
 	b1 := &B{S: "one"}
 	b2 := &B{S: "two"}
 
+	dur300 := duration.New(300 * time.Second)
+	dur600 := duration.New(600 * time.Second)
+	ts1 := sdktime.New(time.Unix(1000, 0))
+	ts2 := sdktime.New(time.Unix(2000, 0))
+
 	// An *invalid* reflect.Value (IsValid() == false)
 	var invalidRV reflect.Value
 
@@ -394,6 +414,30 @@ func TestGetStructDiff(t *testing.T) {
 			b:    E{Name: "test"},
 			want: []ResolvedChange{{Field: "", Old: &Embedded{EmbeddedInt: 42}, New: (*Embedded)(nil)}},
 		},
+		{
+			name: "opaque duration changed",
+			a:    O{Duration: dur300},
+			b:    O{Duration: dur600},
+			want: []ResolvedChange{{Field: "duration", Old: *dur300, New: *dur600}},
+		},
+		{
+			name: "opaque duration unset to set",
+			a:    O{},
+			b:    O{Duration: dur600},
+			want: []ResolvedChange{{Field: "duration", Old: nil, New: *dur600}},
+		},
+		{
+			name: "opaque timestamp changed",
+			a:    O{Timestamp: ts1},
+			b:    O{Timestamp: ts2},
+			want: []ResolvedChange{{Field: "timestamp", Old: *ts1, New: *ts2}},
+		},
+		{
+			name: "empty proto message is not opaque",
+			a:    O{Empty: &jobs.ScheduleTriggerState{}},
+			b:    O{Empty: &jobs.ScheduleTriggerState{}},
+			want: nil,
+		},
 	}
 
 	for _, tt := range tests {
@@ -881,3 +925,112 @@ func TestGetStructDiffSliceKeysDuplicates(t *testing.T) {
 		})
 	}
 }
+
+// An anonymous field carrying a json name is a named field to encoding/json: it serializes as
+// a nested object, so a change inside it belongs at that nested path.
+type DiffEmbedLeaf struct {
+	Value string `json:"value,omitempty"`
+}
+
+type diffTaggedEmbed struct {
+	DiffEmbedLeaf `json:"leaf"`
+
+	Own string `json:"own,omitempty"`
+}
+
+func TestDiffTaggedEmbedIsReportedUnderItsName(t *testing.T) {
+	before := &diffTaggedEmbed{Value: "before", Own: "o"}
+	after := &diffTaggedEmbed{Value: "after", Own: "o"}
+
+	blob, err := json.Marshal(after)
+	require.NoError(t, err)
+	assert.JSONEq(t, `{"leaf":{"value":"after"},"own":"o"}`, string(blob))
+
+	changes, err := GetStructDiff(before, after, nil)
+	require.NoError(t, err)
+	require.Len(t, changes, 1)
+	assert.Equal(t, "leaf.value", changes[0].Path.String())
+}
+
+// namedMapKey is a defined string type used as a map key, like config's
+// ScriptHook (`type ScriptHook string`). Its kind is String but its dynamic
+// type is not string.
+type namedMapKey string
+
+type namedKeyMapHolder struct {
+	M map[namedMapKey]string `json:"m"`
+}
+
+// TestGetStructDiffNamedStringMapKey guards against a regression where
+// diffMapStringKey extracted keys with a `k.Interface().(string)` assertion,
+// which panics for a defined string key type (routing only checks the key's
+// Kind is String). Value.String() handles both string and named-string keys.
+func TestGetStructDiffNamedStringMapKey(t *testing.T) {
+	a := namedKeyMapHolder{M: map[namedMapKey]string{"pre": "a", "post": "x"}}
+	b := namedKeyMapHolder{M: map[namedMapKey]string{"pre": "b", "post": "x"}}
+
+	got, err := GetStructDiff(&a, &b, nil)
+	assert.NoError(t, err)
+	assert.Equal(t, []ResolvedChange{{Field: "m['pre']", Old: "a", New: "b"}}, resolveChanges(got))
+}
+
+// Types for the "whole block" tests below: two levels of nesting under an
+// optional pointer, mirroring a schema like Outer{Field *Mid{A *Inner{b,c}}}.
+type wbInner struct {
+	B string `json:"b,omitempty"`
+	C string `json:"c,omitempty"`
+}
+
+type wbMid struct {
+	A *wbInner `json:"a,omitempty"`
+}
+
+type wbOuter struct {
+	Field *wbMid `json:"field,omitempty"`
+}
+
+// TestGetStructDiffWholeBlock documents the "whole block" bug: when a nested
+// struct is nil on one side, the diff records a single change at the level where
+// the nil appears instead of descending to the differing leaves. The want values
+// below are the CURRENT (buggy) output; the commented "should be" lines are what
+// leaf-level decomposition must produce, and this test is expected to change when
+// the bug is fixed.
+func TestGetStructDiffWholeBlock(t *testing.T) {
+	tests := []struct {
+		name string
+		a, b any
+		want []ResolvedChange
+	}{
+		{
+			// Both sides populated: the diff descends to the leaf correctly.
+			name: "leaf change, both populated",
+			a:    wbOuter{Field: &wbMid{A: &wbInner{B: "old"}}},
+			b:    wbOuter{Field: &wbMid{A: &wbInner{B: "new"}}},
+			want: []ResolvedChange{{Field: "field.a.b", Old: "old", New: "new"}},
+		},
+		{
+			// Intermediate nil on the old side (a whole sub-block is added).
+			// BUG: one change at "field.a" carrying the whole struct.
+			// should be: field.a.b (nil->"old") and field.a.c (nil->"newc").
+			name: "intermediate nil, block added",
+			a:    wbOuter{Field: &wbMid{A: nil}},
+			b:    wbOuter{Field: &wbMid{A: &wbInner{B: "old", C: "newc"}}},
+			want: []ResolvedChange{{Field: "field.a", Old: nil, New: wbInner{B: "old", C: "newc"}}},
+		},
+		{
+			// Intermediate nil on the new side (a whole sub-block is removed).
+			name: "intermediate nil, block removed",
+			a:    wbOuter{Field: &wbMid{A: &wbInner{B: "old", C: "newc"}}},
+			b:    wbOuter{Field: &wbMid{A: nil}},
+			want: []ResolvedChange{{Field: "field.a", Old: wbInner{B: "old", C: "newc"}, New: nil}},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := GetStructDiff(tt.a, tt.b, nil)
+			assert.NoError(t, err)
+			assert.Equal(t, tt.want, resolveChanges(got))
+		})
+	}
+}
diff --git a/libs/structs/structdiff/equal.go b/libs/structs/structdiff/equal.go
index 7d4ec84a650..014f6f7af36 100644
--- a/libs/structs/structdiff/equal.go
+++ b/libs/structs/structdiff/equal.go
@@ -4,6 +4,7 @@ import (
 	"reflect"
 	"slices"
 
+	"github.com/databricks/cli/libs/structs/structaccess"
 	"github.com/databricks/cli/libs/structs/structtag"
 )
 
@@ -46,6 +47,13 @@ func equalValues(v1, v2 reflect.Value) bool {
 		return false
 	}
 
+	if IsOpaqueStruct(v1Type) {
+		// A marshaling failure is reported as "not equal" so the change surfaces
+		// rather than being silently dropped.
+		equal, err := equalJSON(v1, v2)
+		return err == nil && equal
+	}
+
 	kind := v1.Kind()
 
 	// Perform nil checks for nilable types.
@@ -100,8 +108,9 @@ func equalStruct(s1, s2 reflect.Value) bool {
 			continue
 		}
 
-		// Continue traversing embedded structs.
-		if sf.Anonymous {
+		// Continue traversing embedded structs. A tagged anonymous field is a named field to
+		// encoding/json, so it goes through the path below.
+		if structaccess.IsFlattenedEmbed(sf) {
 			if !equalValues(s1.Field(i), s2.Field(i)) {
 				return false
 			}
@@ -111,7 +120,7 @@ func equalStruct(s1, s2 reflect.Value) bool {
 		jsonTag := structtag.JSONTag(sf.Tag.Get("json"))
 
 		// Skip fields with json:"-"
-		if jsonTag.Name() == "-" {
+		if structaccess.IsSkippedField(sf) {
 			continue
 		}
 
diff --git a/libs/structs/structdiff/jobsettings_test.go b/libs/structs/structdiff/jobsettings_test.go
index 5d6044a5840..f5de67503a0 100644
--- a/libs/structs/structdiff/jobsettings_test.go
+++ b/libs/structs/structdiff/jobsettings_test.go
@@ -476,7 +476,7 @@ func TestJobDiff(t *testing.T) {
 	require.GreaterOrEqual(t, len(changes), 75)
 	assert.Equal(t, "budget_policy_id", changes[0].Path.String())
 	assert.Equal(t, "550e8400-e29b-41d4-a716-446655440000", changes[0].Old)
-	assert.Equal(t, "", changes[0].New)
+	assert.Empty(t, changes[0].New)
 	// Note: pause_status shows up as nil here because Continuous does not have ForceSendFields field
 	assert.Equal(t, "continuous.pause_status", changes[1].Path.String())
 	assert.Equal(t, jobs.PauseStatus("UNPAUSED"), changes[1].Old)
@@ -486,7 +486,7 @@ func TestJobDiff(t *testing.T) {
 	assert.Equal(t, jobs.JobDeploymentKind(""), changes[2].New)
 	assert.Equal(t, "deployment.metadata_file_path", changes[3].Path.String())
 	assert.Equal(t, "string", changes[3].Old)
-	assert.Equal(t, "", changes[3].New)
+	assert.Empty(t, changes[3].New)
 
 	changes, err = GetStructDiff(job, nils, nil)
 	require.NoError(t, err)
@@ -513,7 +513,7 @@ func TestJobDiff(t *testing.T) {
 	require.NoError(t, err)
 	assert.GreaterOrEqual(t, len(changes), 58)
 	assert.Equal(t, "budget_policy_id", changes[0].Path.String())
-	assert.Equal(t, "", changes[0].Old)
+	assert.Empty(t, changes[0].Old)
 	assert.Nil(t, changes[0].New)
 	assert.Equal(t, "continuous", changes[1].Path.String())
 	assert.Equal(t, jobs.Continuous{}, changes[1].Old)
@@ -522,6 +522,6 @@ func TestJobDiff(t *testing.T) {
 	// deployment.kind is "" in both
 
 	assert.Equal(t, "deployment.metadata_file_path", changes[2].Path.String())
-	assert.Equal(t, "", changes[2].Old)
+	assert.Empty(t, changes[2].Old)
 	assert.Nil(t, changes[2].New)
 }
diff --git a/libs/structs/structdiff/opaque.go b/libs/structs/structdiff/opaque.go
new file mode 100644
index 00000000000..fd7b26d2af2
--- /dev/null
+++ b/libs/structs/structdiff/opaque.go
@@ -0,0 +1,62 @@
+package structdiff
+
+import (
+	"bytes"
+	"encoding/json"
+	"reflect"
+	"sync"
+)
+
+var (
+	jsonMarshalerType = reflect.TypeFor[json.Marshaler]()
+
+	// Keyed by reflect.Type; IsOpaqueStruct is called for every struct visited
+	// during a diff, so the field scan is done once per type.
+	opaqueStructCache sync.Map
+)
+
+// IsOpaqueStruct reports whether t is a struct that diffStruct cannot see into
+// (no exported fields to walk) but that still carries a value, marshaling
+// itself through json.Marshaler. The SDK's duration.Duration and
+// common/types/time.Time are of this shape: each holds a single unexported
+// protobuf pointer. Without this, any two of their values compare equal.
+//
+// Genuinely empty proto messages (jobs.ScheduleTriggerState, and similar) have
+// no exported fields either, but they implement no marshaler and hold nothing,
+// so they are not opaque and keep comparing equal.
+func IsOpaqueStruct(t reflect.Type) bool {
+	if cached, ok := opaqueStructCache.Load(t); ok {
+		return cached.(bool)
+	}
+	result := isOpaqueStruct(t)
+	opaqueStructCache.Store(t, result)
+	return result
+}
+
+func isOpaqueStruct(t reflect.Type) bool {
+	if t.Kind() != reflect.Struct {
+		return false
+	}
+	for sf := range t.Fields() {
+		// ForceSendFields is skipped when walking fields, so a struct carrying
+		// only that is still invisible to the walk.
+		if sf.IsExported() && sf.Name != "ForceSendFields" {
+			return false
+		}
+	}
+	return t.Implements(jsonMarshalerType) || reflect.PointerTo(t).Implements(jsonMarshalerType)
+}
+
+// equalJSON compares two opaque values through their JSON form, which is the
+// only representation that exposes what they hold.
+func equalJSON(v1, v2 reflect.Value) (bool, error) {
+	b1, err := json.Marshal(v1.Interface())
+	if err != nil {
+		return false, err
+	}
+	b2, err := json.Marshal(v2.Interface())
+	if err != nil {
+		return false, err
+	}
+	return bytes.Equal(b1, b2), nil
+}
diff --git a/libs/structs/structdiff/opaque_test.go b/libs/structs/structdiff/opaque_test.go
new file mode 100644
index 00000000000..1ec4cb89abe
--- /dev/null
+++ b/libs/structs/structdiff/opaque_test.go
@@ -0,0 +1,74 @@
+package structdiff
+
+import (
+	"reflect"
+	"testing"
+	"time"
+
+	"github.com/databricks/databricks-sdk-go/common/types/duration"
+	"github.com/databricks/databricks-sdk-go/common/types/fieldmask"
+	sdktime "github.com/databricks/databricks-sdk-go/common/types/time"
+	"github.com/databricks/databricks-sdk-go/service/catalog"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/databricks/databricks-sdk-go/service/pipelines"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestIsOpaqueStruct(t *testing.T) {
+	tests := []struct {
+		typ  reflect.Type
+		want bool
+	}{
+		// Payload hidden in an unexported protobuf pointer.
+		{reflect.TypeFor[duration.Duration](), true},
+		{reflect.TypeFor[sdktime.Time](), true},
+
+		// Empty proto messages: no exported fields either, but nothing to hide
+		// and no marshaler of their own.
+		{reflect.TypeFor[catalog.MonitorSnapshot](), false},
+		{reflect.TypeFor[jobs.ModelTriggerState](), false},
+		{reflect.TypeFor[jobs.ScheduleTriggerState](), false},
+		{reflect.TypeFor[pipelines.ManualTrigger](), false},
+
+		// FieldMask marshals to a string but exposes Paths, so the walk sees it.
+		{reflect.TypeFor[fieldmask.FieldMask](), false},
+
+		{reflect.TypeFor[A](), false},
+		{reflect.TypeFor[string](), false},
+		{reflect.TypeFor[*duration.Duration](), false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.typ.String(), func(t *testing.T) {
+			assert.Equal(t, tt.want, IsOpaqueStruct(tt.typ))
+			// Second call goes through the cache.
+			assert.Equal(t, tt.want, IsOpaqueStruct(tt.typ))
+		})
+	}
+}
+
+// Opaque values compared at the root of the call, rather than reached through a
+// struct field. This is the shape the original bug was reported in: two
+// durations handed straight to GetStructDiff came back equal.
+func TestGetStructDiffOpaqueAtRoot(t *testing.T) {
+	a := duration.New(300 * time.Second)
+	b := duration.New(600 * time.Second)
+
+	for _, tt := range []struct {
+		name string
+		a, b any
+	}{
+		{"pointer", a, b},
+		{"value", *a, *b},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			changes, err := GetStructDiff(tt.a, tt.b, nil)
+			require.NoError(t, err)
+			require.Len(t, changes, 1)
+			assert.Empty(t, changes[0].Path.String())
+			assert.False(t, IsEqual(tt.a, tt.b))
+			assert.True(t, IsEqual(tt.a, tt.a))
+		})
+	}
+}
diff --git a/libs/structs/structpath/path.go b/libs/structs/structpath/path.go
index 5ae81019ee4..adf2be51331 100644
--- a/libs/structs/structpath/path.go
+++ b/libs/structs/structpath/path.go
@@ -3,13 +3,19 @@ package structpath
 import (
 	"errors"
 	"fmt"
+	"regexp"
 	"strconv"
 	"strings"
-
-	"github.com/databricks/cli/libs/dyn"
-	"github.com/databricks/cli/libs/dyn/dynvar"
 )
 
+// baseVarDef matches a path segment of a ${...} reference. It is the grammar of
+// dynvar.BaseVarDef, which structpath cannot import; TestPureReferenceMatchesDynvar
+// keeps them in agreement.
+const baseVarDef = `_*\p{L}+([-_]*[\p{L}\p{N}]+)*`
+
+// pureReference matches a string that is a single ${...} reference.
+var pureReference = regexp.MustCompile(`^\$\{(` + baseVarDef + `(\.` + baseVarDef + `(\[[0-9]+\])*)*(\[[0-9]+\])*)\}$`)
+
 const (
 	// Encodes wildcard after a dot: foo.*
 	tagDotStar = -2
@@ -163,6 +169,28 @@ func NewStringKey(prev *PathNode, fieldName string) *PathNode {
 	return NewBracketString(prev, fieldName)
 }
 
+// NewPath appends parts to prev: a string is a key (see [NewStringKey]) and an int is
+// an index. Other types panic.
+func NewPath(prev *PathNode, parts ...any) *PathNode {
+	for _, part := range parts {
+		switch v := part.(type) {
+		case string:
+			prev = NewStringKey(prev, v)
+		case int:
+			prev = NewIndex(prev, v)
+		default:
+			panic(fmt.Sprintf("structpath.NewPath: unsupported part %#v", part))
+		}
+	}
+	return prev
+}
+
+// NewPathSlice returns the path of parts from the root (see [NewPath]) as a one-element
+// slice, e.g. for diag.Diagnostic.Paths.
+func NewPathSlice(parts ...any) []*PathNode {
+	return []*PathNode{NewPath(nil, parts...)}
+}
+
 func NewKeyValue(prev *PathNode, key, value string) *PathNode {
 	return &PathNode{
 		prev:  prev,
@@ -637,6 +665,15 @@ func MustParsePath(s string) *PathNode {
 	return path
 }
 
+// MustParsePaths parses each of paths like [MustParsePath], e.g. for diag.Diagnostic.Paths.
+func MustParsePaths(paths ...string) []*PathNode {
+	out := make([]*PathNode, len(paths))
+	for i, s := range paths {
+		out[i] = MustParsePath(s)
+	}
+	return out
+}
+
 // isReservedFieldChar checks if character is reserved and cannot be used in field names
 func isReservedFieldChar(ch byte) bool {
 	switch ch {
@@ -677,16 +714,12 @@ func isValidField(s string) bool {
 // PureReferenceToPath returns a PathNode if s is a pure variable reference, otherwise false.
 // This function is similar to dynvar.PureReferenceToPath but returns a *PathNode instead of dyn.Path.
 func PureReferenceToPath(s string) (*PathNode, bool) {
-	ref, ok := dynvar.NewRef(dyn.V(s))
-	if !ok {
+	m := pureReference.FindStringSubmatch(s)
+	if m == nil {
 		return nil, false
 	}
 
-	if !ref.IsPure() {
-		return nil, false
-	}
-
-	pattern, err := parse(ref.References()[0], false)
+	pattern, err := parse(m[1], false)
 	if err != nil {
 		return nil, false
 	}
@@ -865,7 +898,8 @@ func (p *PathNode) HasPatternPrefix(prefix *PatternNode) bool {
 }
 
 // nodeMatchesPattern checks if a concrete path node matches a pattern node.
-// Wildcards (.* and [*]) match any node.
+// Wildcards (.* and [*]) match any node. A * inside a bracket map key matches
+// one dot-separated segment; a trailing * matches the remainder of the key.
 func nodeMatchesPattern(concrete *PathNode, pattern *PatternNode) bool {
 	if concrete == nil && pattern == nil {
 		return true
@@ -876,9 +910,37 @@ func nodeMatchesPattern(concrete *PathNode, pattern *PatternNode) bool {
 	if pattern.DotStar() || pattern.BracketStar() {
 		return true
 	}
+	patternKey, patternIsBracket := (*PathNode)(pattern).BracketString()
+	concreteKey, concreteIsBracket := concrete.BracketString()
+	if patternIsBracket && concreteIsBracket && strings.Contains(patternKey, "*") {
+		return matchDotSeparatedGlob(patternKey, concreteKey)
+	}
 	return nodesEqual(concrete, (*PathNode)(pattern))
 }
 
+// matchDotSeparatedGlob matches keys split on '.'. Each '*' consumes exactly one
+// segment unless it is the last pattern segment, in which case it absorbs the
+// remaining segments after the preceding '.'. That suffix must be present (a
+// key ending in '.' has an empty final segment and still matches), so the key
+// needs at least one segment beyond the '*'s position.
+func matchDotSeparatedGlob(pattern, key string) bool {
+	patternParts := strings.Split(pattern, ".")
+	keyParts := strings.Split(key, ".")
+	for i, p := range patternParts {
+		if p == "*" && i == len(patternParts)-1 {
+			return i < len(keyParts) // trailing '*' absorbs a non-empty suffix
+		}
+		if i >= len(keyParts) {
+			return false // pattern still has segments, key ran out
+		}
+		if p != "*" && p != keyParts[i] {
+			return false
+		}
+	}
+	// Pattern exhausted with no trailing '*': the key must be too.
+	return len(patternParts) == len(keyParts)
+}
+
 // MarshalYAML implements yaml.Marshaler for PathNode.
 func (p *PathNode) MarshalYAML() (any, error) {
 	return p.String(), nil
diff --git a/libs/structs/structpath/path_test.go b/libs/structs/structpath/path_test.go
index bf517c4adf4..40fc0282c2b 100644
--- a/libs/structs/structpath/path_test.go
+++ b/libs/structs/structpath/path_test.go
@@ -308,7 +308,7 @@ func TestPathAndPatternNode(t *testing.T) {
 
 				gotStringKey, isStringKey := tt.pathNode.StringKey()
 				if tt.StringKey == nil {
-					assert.Equal(t, "", gotStringKey)
+					assert.Empty(t, gotStringKey)
 					assert.False(t, isStringKey)
 				} else {
 					expected := tt.StringKey.(string)
@@ -319,8 +319,8 @@ func TestPathAndPatternNode(t *testing.T) {
 				// KeyValue
 				gotKey, gotValue, isKeyValue := tt.pathNode.KeyValue()
 				if tt.KeyValue == nil {
-					assert.Equal(t, "", gotKey)
-					assert.Equal(t, "", gotValue)
+					assert.Empty(t, gotKey)
+					assert.Empty(t, gotValue)
 					assert.False(t, isKeyValue)
 				} else {
 					assert.Equal(t, tt.KeyValue[0], gotKey)
@@ -988,6 +988,56 @@ func TestHasPatternPrefix(t *testing.T) {
 			pattern:  "a.x.c",
 			expected: false,
 		},
+
+		// Bracket map key globs
+		{
+			name:     "bracket map key glob matches managed delta property",
+			path:     "properties['unity.catalog.managed.delta.defaults.delta.enableRowTracking']",
+			pattern:  "properties['unity.catalog.managed.*.defaults.*']",
+			expected: true,
+		},
+		{
+			name:     "bracket map key glob matches managed iceberg property",
+			path:     "properties['unity.catalog.managed.iceberg.defaults.delta.feature.catalogManaged']",
+			pattern:  "properties['unity.catalog.managed.*.defaults.*']",
+			expected: true,
+		},
+		{
+			name:     "bracket map key glob rejects unrelated property",
+			path:     "properties['custom.remote_only']",
+			pattern:  "properties['unity.catalog.managed.*.defaults.*']",
+			expected: false,
+		},
+		{
+			name:     "bracket map key glob rejects mismatched non-wildcard segment",
+			path:     "properties['unity.catalog.managed.delta.other.delta.enableRowTracking']",
+			pattern:  "properties['unity.catalog.managed.*.defaults.*']",
+			expected: false,
+		},
+		{
+			// A trailing '*' matches the segment(s) after the preceding literal
+			// '.'; a key ending in '.' has an empty final segment, which matches.
+			name:     "bracket map key glob trailing star matches empty child",
+			path:     "properties['unity.catalog.managed.something.defaults.']",
+			pattern:  "properties['unity.catalog.managed.something.defaults.*']",
+			expected: true,
+		},
+		{
+			// A trailing '*' requires a child segment; a key ending at the
+			// preceding literal (no trailing '.') has nothing for '*' to match.
+			name:     "bracket map key glob trailing star requires a child segment",
+			path:     "properties['unity.catalog.managed.delta.defaults']",
+			pattern:  "properties['unity.catalog.managed.delta.defaults.*']",
+			expected: false,
+		},
+		{
+			// A non-trailing '*' consumes exactly one segment, so a key missing
+			// that segment does not match.
+			name:     "bracket map key glob middle star requires one segment",
+			path:     "properties['unity.catalog.managed.defaults.enableRowTracking']",
+			pattern:  "properties['unity.catalog.managed.*.defaults.enableRowTracking']",
+			expected: false,
+		},
 	}
 
 	for _, tt := range tests {
@@ -1224,3 +1274,26 @@ paths:
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "unexpected end of input")
 }
+
+func TestMustParsePaths(t *testing.T) {
+	paths := MustParsePaths("bundle.terraform", "resources.jobs.foo.tasks[0]")
+	require.Len(t, paths, 2)
+	assert.Equal(t, "bundle.terraform", paths[0].String())
+	assert.Equal(t, "resources.jobs.foo.tasks[0]", paths[1].String())
+	assert.Empty(t, MustParsePaths())
+}
+
+func TestNewPath(t *testing.T) {
+	assert.Equal(t, "a.b['c d']", NewPath(NewStringKey(nil, "a"), "b", "c d").String())
+	assert.Equal(t, "resources.jobs.j.tasks[2].job_cluster_key", NewPath(nil, "resources", "jobs", "j", "tasks", 2, "job_cluster_key").String())
+	assert.Nil(t, NewPath(nil))
+	assert.Equal(t, "a", NewPath(NewStringKey(nil, "a")).String())
+	assert.Panics(t, func() { NewPath(nil, int64(1)) })
+}
+
+func TestNewPathSlice(t *testing.T) {
+	paths := NewPathSlice("resources", "jobs", "${var.env}_job")
+	require.Len(t, paths, 1)
+	assert.Equal(t, "resources.jobs['${var.env}_job']", paths[0].String())
+	assert.Equal(t, "sync.paths[3]", NewPathSlice("sync", "paths", 3)[0].String())
+}
diff --git a/libs/structs/structpath/reference_test.go b/libs/structs/structpath/reference_test.go
new file mode 100644
index 00000000000..485b756c7fb
--- /dev/null
+++ b/libs/structs/structpath/reference_test.go
@@ -0,0 +1,30 @@
+package structpath_test
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/dyn/dynvar"
+	"github.com/databricks/cli/libs/structs/structpath"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestPureReferenceMatchesDynvar(t *testing.T) {
+	for _, s := range []string{
+		"${var.foo}",
+		"${resources.jobs.foo.tasks[1].env.key}",
+		"${var.résumé_2}",
+		"${_private.x}",
+		"${var.foo[0][1]}",
+		"${var.jobs['my_job']}",
+		"${var.-foo}",
+		"${var.foo-}",
+		"${var.foo}${var.bar}",
+		"prefix_${var.field}",
+		"$${var.escaped}",
+		"${}",
+		"plain_string",
+	} {
+		_, ok := structpath.PureReferenceToPath(s)
+		assert.Equal(t, dynvar.IsPureVariableReference(s), ok, s)
+	}
+}
diff --git a/libs/structs/structtag/jsontag_test.go b/libs/structs/structtag/jsontag_test.go
index b45fd566ea1..810d66851b7 100644
--- a/libs/structs/structtag/jsontag_test.go
+++ b/libs/structs/structtag/jsontag_test.go
@@ -59,7 +59,7 @@ var benchTags = []JSONTag{
 }
 
 func BenchmarkJSONTagName(b *testing.B) {
-	for range b.N {
+	for b.Loop() {
 		for _, tag := range benchTags {
 			tag.Name()
 		}
@@ -67,7 +67,7 @@ func BenchmarkJSONTagName(b *testing.B) {
 }
 
 func BenchmarkJSONTagOmitEmpty(b *testing.B) {
-	for range b.N {
+	for b.Loop() {
 		for _, tag := range benchTags {
 			tag.OmitEmpty()
 		}
diff --git a/libs/structs/structvar/structvar.go b/libs/structs/structvar/structvar.go
index b60f8c15ee7..cc894aced7f 100644
--- a/libs/structs/structvar/structvar.go
+++ b/libs/structs/structvar/structvar.go
@@ -102,15 +102,18 @@ func (sv *StructVar) ResolveRef(reference string, value any) error {
 			if err != nil {
 				return fmt.Errorf("cannot set %s to %T (%#v): %w", pathNode.String(), value, value, err)
 			}
-			newValue := strings.ReplaceAll(refValue, reference, valueStr)
 
-			// Set the updated string value
-			err = structaccess.Set(sv.Value, pathNode, newValue)
+			newValue := dynvar.ReplaceRef(refValue, reference, valueStr)
+
+			// The struct gets the unescaped form ("$${x}" -> "${x}"), since that is what
+			// is sent to the API. sv.Refs keeps the escaped form so the still-pending
+			// check below can tell a literal apart from a real reference.
+			err = structaccess.Set(sv.Value, pathNode, dynvar.Unescape(newValue))
 			if err != nil {
 				return fmt.Errorf("cannot update %s to string: %w", pathNode.String(), err)
 			}
 
-			// Check if fully resolved (no more ${} patterns)
+			// Check if fully resolved (no unescaped ${} patterns left)
 			if !dynvar.ContainsVariableReference(newValue) {
 				delete(sv.Refs, pathKey)
 			} else {
diff --git a/libs/structs/structvar/structvar_test.go b/libs/structs/structvar/structvar_test.go
index 99b5f549ada..9d4c2532ad6 100644
--- a/libs/structs/structvar/structvar_test.go
+++ b/libs/structs/structvar/structvar_test.go
@@ -169,6 +169,46 @@ func TestResolveRefMultiReference(t *testing.T) {
 	assert.Equal(t, map[string]string{}, sv.Refs) // fully resolved, reference removed
 }
 
+func TestResolveRefEscaped(t *testing.T) {
+	tests := []struct {
+		name     string
+		template string
+		want     string
+	}{
+		{
+			name:     "escaped placeholder beside a real reference",
+			template: "$${runtime} ${var.name}",
+			want:     "${runtime} Resolved",
+		},
+		{
+			name:     "same name escaped first must not be substituted",
+			template: "$${var.name} ${var.name}",
+			want:     "${var.name} Resolved",
+		},
+		{
+			name:     "same name real first",
+			template: "${var.name} $${var.name}",
+			want:     "Resolved ${var.name}",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			sv := structvar.NewStructVar(
+				&TestObj{Name: tt.template},
+				map[string]string{"name": tt.template},
+			)
+
+			require.NoError(t, sv.ResolveRef("${var.name}", "Resolved"))
+
+			// The struct holds the unescaped value that is sent to the API, and the
+			// entry is dropped because the only reference left is a literal.
+			assert.Equal(t, tt.want, sv.Value.(*TestObj).Name)
+			assert.Empty(t, sv.Refs)
+		})
+	}
+}
+
 func TestResolveRefJobSettings(t *testing.T) {
 	// Create a realistic JobSettings based on the provided YAML config
 	jobSettings := jobs.JobSettings{
diff --git a/libs/structs/structwalk/walk.go b/libs/structs/structwalk/walk.go
index 352f5f86cac..0a1186a4e81 100644
--- a/libs/structs/structwalk/walk.go
+++ b/libs/structs/structwalk/walk.go
@@ -115,15 +115,17 @@ func walkStruct(path *structpath.PathNode, s reflect.Value, visit VisitFunc) {
 			continue
 		}
 
-		// Directly walk into embedded structs without adding the key to the path.
-		if sf.Anonymous {
+		// Directly walk into embedded structs without adding the key to the path. An
+		// anonymous field carrying a json name is not one of these: encoding/json serializes it
+		// as a nested object, so it is walked as a named field below.
+		if structaccess.IsFlattenedEmbed(sf) {
 			walkValue(path, s.Field(i), &sf, visit)
 			continue
 		}
 
 		jsonTag := structtag.JSONTag(sf.Tag.Get("json"))
-		if jsonTag.Name() == "-" {
-			continue // skip fields without json name
+		if structaccess.IsSkippedField(sf) {
+			continue // encoding/json omits it entirely
 		}
 
 		// Resolve field name from JSON tag or fall back to Go field name
@@ -157,7 +159,7 @@ func getForceSendFields(v reflect.Value) []string {
 	if !fsField.IsValid() || fsField.Kind() != reflect.Slice {
 		return nil
 	}
-	result, ok := fsField.Interface().([]string)
+	result, ok := reflect.TypeAssert[[]string](fsField)
 	if ok {
 		return result
 	}
diff --git a/libs/structs/structwalk/walk_test.go b/libs/structs/structwalk/walk_test.go
index 57a7c96d504..e8a3bf7c09c 100644
--- a/libs/structs/structwalk/walk_test.go
+++ b/libs/structs/structwalk/walk_test.go
@@ -1,7 +1,9 @@
 package structwalk
 
 import (
+	"encoding/json"
 	"reflect"
+	"slices"
 	"testing"
 
 	"github.com/databricks/cli/libs/structs/structpath"
@@ -74,7 +76,7 @@ func TestValueTypesEmpty(t *testing.T) {
 	forcedResults := flatten(t, forced)
 
 	// Ensure forced fields are present with zero values
-	assert.Equal(t, "", forcedResults["omit_str"])
+	assert.Empty(t, forcedResults["omit_str"])
 	assert.Equal(t, false, forcedResults["omit_bool"])
 
 	// Non-forced omitempty zero field should remain absent
@@ -144,11 +146,9 @@ func TestEmbeddedStruct(t *testing.T) {
 	}
 
 	parent := Parent{
-		Embedded: Embedded{
-			EmbeddedField: "embedded_value",
-			EmbeddedInt:   42,
-		},
-		ParentField: "parent_value",
+		EmbeddedField: "embedded_value",
+		EmbeddedInt:   42,
+		ParentField:   "parent_value",
 	}
 
 	result := flatten(t, parent)
@@ -177,12 +177,8 @@ func TestNestedEmbeddedStructs(t *testing.T) {
 	}
 
 	obj := Level3{
-		Level2: Level2{
-			Level1: Level1{
-				Field1: "one",
-			},
-			Field2: "two",
-		},
+		Field1: "one",
+		Field2: "two",
 		Field3: "three",
 	}
 
@@ -264,11 +260,9 @@ func TestEmbeddedStructWithJSONTagDash(t *testing.T) {
 	}
 
 	parent := Parent{
-		Embedded: Embedded{
-			SkipField:    "should_not_appear",
-			IncludeField: "should_appear",
-		},
-		ParentField: "parent",
+		SkipField:    "should_not_appear",
+		IncludeField: "should_appear",
+		ParentField:  "parent",
 	}
 
 	assert.Equal(t, map[string]any{
@@ -276,3 +270,53 @@ func TestEmbeddedStructWithJSONTagDash(t *testing.T) {
 		"parent_field": "parent",
 	}, flatten(t, parent))
 }
+
+// An anonymous field carrying a json name is a named field to encoding/json: it serializes as
+// a nested object under that name rather than being flattened into the outer one. A field whose
+// tag sets only an option, leaving the name empty, is still flattened.
+type WalkEmbedLeaf struct {
+	Value string `json:"value,omitempty"`
+}
+
+type walkTaggedEmbed struct {
+	WalkEmbedLeaf `json:"leaf"`
+
+	Own string `json:"own,omitempty"`
+}
+
+type walkOptionOnlyEmbed struct {
+	WalkEmbedLeaf `json:",omitempty"`
+
+	Own string `json:"own,omitempty"`
+}
+
+func TestWalkTaggedEmbedIsANamedField(t *testing.T) {
+	value := &walkTaggedEmbed{Value: "v", Own: "o"}
+
+	blob, err := json.Marshal(value)
+	require.NoError(t, err)
+	assert.JSONEq(t, `{"leaf":{"value":"v"},"own":"o"}`, string(blob))
+
+	assert.Equal(t, []string{"leaf.value", "own"}, walkPaths(t, value))
+}
+
+func TestWalkOptionOnlyEmbedIsStillFlattened(t *testing.T) {
+	value := &walkOptionOnlyEmbed{Value: "v", Own: "o"}
+
+	blob, err := json.Marshal(value)
+	require.NoError(t, err)
+	assert.JSONEq(t, `{"value":"v","own":"o"}`, string(blob))
+
+	assert.Equal(t, []string{"own", "value"}, walkPaths(t, value))
+}
+
+// walkPaths returns the sorted paths Walk visits for v.
+func walkPaths(t *testing.T, value any) []string {
+	t.Helper()
+	var paths []string
+	require.NoError(t, Walk(value, func(path *structpath.PathNode, _ any, _ *reflect.StructField) {
+		paths = append(paths, path.String())
+	}))
+	slices.Sort(paths)
+	return paths
+}
diff --git a/libs/structs/structwalk/walktype.go b/libs/structs/structwalk/walktype.go
index 495a369d64a..4a485f2c1e9 100644
--- a/libs/structs/structwalk/walktype.go
+++ b/libs/structs/structwalk/walktype.go
@@ -104,24 +104,23 @@ func walkTypeValue(path *structpath.PatternNode, typ reflect.Type, field *reflec
 }
 
 func walkTypeStruct(path *structpath.PatternNode, st reflect.Type, visit VisitTypeFunc, visitedCount map[reflect.Type]int) {
-	for i := range st.NumField() {
-		sf := st.Field(i)
+	for sf := range st.Fields() {
 		if sf.PkgPath != "" {
 			continue // unexported
 		}
 
-		// Handle embedded structs (anonymous fields without json tags)
+		// Handle embedded structs that encoding/json flattens. The json *name* decides, not
+		// the presence of a tag: `json:",omitempty"` on an embed leaves the name empty and is
+		// still flattened, while a name makes it a nested object.
 		jsonTag := sf.Tag.Get("json")
-		if sf.Anonymous && jsonTag == "" {
-			// For embedded structs, walk the embedded type at the current path level
-			// This flattens the embedded struct's fields into the parent struct
+		if structaccess.IsFlattenedEmbed(sf) {
 			walkTypeValue(path, sf.Type, &sf, visit, visitedCount)
 			continue
 		}
 
 		// Skip fields marked as "-" in json tag
 		jsonTagName := structtag.JSONTag(jsonTag).Name()
-		if jsonTagName == "-" {
+		if structaccess.IsSkippedField(sf) {
 			continue
 		}
 
diff --git a/libs/structs/structwalk/walktype_bench_test.go b/libs/structs/structwalk/walktype_bench_test.go
index 5f4b05bf986..5947ba5ca47 100644
--- a/libs/structs/structwalk/walktype_bench_test.go
+++ b/libs/structs/structwalk/walktype_bench_test.go
@@ -21,8 +21,7 @@ func countFields(typ reflect.Type) (int, error) {
 func benchmarkWalkType(b *testing.B, tt reflect.Type) {
 	total := 0
 
-	b.ResetTimer()
-	for range b.N {
+	for b.Loop() {
 		count, err := countFields(tt)
 		if err != nil {
 			b.Fatalf("WalkType failed: %v", err)
@@ -30,7 +29,6 @@ func benchmarkWalkType(b *testing.B, tt reflect.Type) {
 		total += count
 	}
 
-	b.StopTimer()
 	// Root now correctly includes embedded struct fields, so it has many more fields than JobSettings
 	// (3,487 vs 533) because it contains JobSettings plus other resource types and config fields
 	b.Logf("Counted fields in %s: %d (%d/%d)", tt, total/b.N, total, b.N)
diff --git a/libs/structs/structwalk/walktype_test.go b/libs/structs/structwalk/walktype_test.go
index d77002982a9..937a5ecb1dc 100644
--- a/libs/structs/structwalk/walktype_test.go
+++ b/libs/structs/structwalk/walktype_test.go
@@ -55,6 +55,7 @@ func TestTypeScalar(t *testing.T) {
 
 func TestTypes(t *testing.T) {
 	assert.Equal(t, map[string]any{
+		"-":                  "",
 		"ArrayString[*]":     "",
 		"Array[*].X":         0,
 		"BoolField":          false,
@@ -91,11 +92,14 @@ func TestTypeSelf(t *testing.T) {
 	}, getScalarFields(t, reflect.TypeFor[Self]()))
 }
 
-func testStruct(t *testing.T, typ reflect.Type, minLen, maxLen int, present map[string]any, notPresent []string) {
+func testStruct(t *testing.T, typ reflect.Type, minLen int, present map[string]any, notPresent []string) {
 	results := getScalarFields(t, typ)
 
+	// Only assert a lower bound on the field count: SDK bumps regularly add fields,
+	// so an upper bound churns every few bumps without catching anything. A runaway
+	// walk (e.g. circular references failing to terminate) is caught precisely by the
+	// notPresent checks below instead.
 	assert.Greater(t, len(results), minLen, "Expected to find many fields in %s", typ)
-	assert.Less(t, len(results), maxLen, "Expected to find not so many fields in %s", typ)
 
 	for path, expectedValue := range present {
 		value, found := results[path]
@@ -112,8 +116,8 @@ func testStruct(t *testing.T, typ reflect.Type, minLen, maxLen int, present map[
 func TestTypeJobSettings(t *testing.T) {
 	testStruct(t,
 		reflect.TypeFor[jobs.JobSettings](),
-		// Verify we found a reasonable number of fields (it's 533 at the time of writing)
-		500, 600,
+		// Verify we found a reasonable number of fields (605 after SDK v0.136.0 bump)
+		500,
 		map[string]any{
 			"name":                "",
 			"timeout_seconds":     0,
@@ -136,7 +140,7 @@ func TestTypeJobSettings(t *testing.T) {
 func TestTypeRoot(t *testing.T) {
 	testStruct(t,
 		reflect.TypeFor[config.Root](),
-		5000, 5500, // 5213 after SDK v0.127.0 bump
+		5000,
 		map[string]any{
 			"bundle.target":                "",
 			`variables.*.lookup.dashboard`: "",
@@ -318,3 +322,39 @@ func TestWalkSkip(t *testing.T) {
 	require.NoError(t, err)
 	assert.Equal(t, []string{"A", "B", "Inner", "D"}, seen)
 }
+
+// TestWalkTypeSameDepthCollisionIsVisitedTwice codifies the contract that
+// WalkType is a *dumb* walker: when two anonymous embedded structs both declare
+// the same json name at the same embedding depth, WalkType visits the path
+// twice — once per embed. It makes no attempt to resolve ambiguity.
+//
+// This property is intentional: it lets callers (e.g. the shadow-collision
+// guard in bundle/config) detect same-depth conflicts simply by counting
+// visits per path.
+func TestWalkTypeSameDepthCollisionIsVisitedTwice(t *testing.T) {
+	// Two anonymous embeds that both carry json:"id" — same embedding depth,
+	// same json name. encoding/json calls this ambiguous and serializes neither.
+	type EmbedA struct {
+		ID string `json:"id,omitempty"`
+	}
+	type EmbedB struct {
+		ID string `json:"id,omitempty"` //nolint:govet // repeated tag is the point
+	}
+	type Root struct {
+		EmbedA
+		EmbedB //nolint:govet // same-depth collision is what this test demonstrates
+	}
+
+	visits := map[string]int{}
+	require.NoError(t, WalkType(reflect.TypeFor[Root](), func(path *structpath.PatternNode, _ reflect.Type, _ *reflect.StructField) bool {
+		if path != nil {
+			visits[path.String()]++
+		}
+		return true
+	}))
+
+	// "id" must be visited exactly twice — once from EmbedA and once from EmbedB.
+	assert.Equal(t, 2, visits["id"],
+		"WalkType must visit a same-depth collision once per declaring embed; "+
+			"encoding/json would serialize neither field")
+}
diff --git a/libs/sync/filelist.go b/libs/sync/filelist.go
new file mode 100644
index 00000000000..72946b4eeda
--- /dev/null
+++ b/libs/sync/filelist.go
@@ -0,0 +1,83 @@
+package sync
+
+import (
+	"context"
+
+	"github.com/databricks/cli/libs/fileset"
+	"github.com/databricks/cli/libs/git"
+	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/set"
+	"github.com/databricks/cli/libs/vfs"
+)
+
+// FileList enumerates the local files selected for sync: git-tracked files,
+// plus explicit includes, minus excludes. It is the "what would be synced"
+// listing concern, independent of the sync snapshot and remote upload.
+type FileList struct {
+	fileSet        *git.FileSet
+	includeFileSet *fileset.FileSet
+	excludeFileSet *fileset.FileSet
+}
+
+// NewFileList builds a FileList for the directory tree at root, located within
+// the Git worktree at worktreeRoot so gitignore rules are honored. paths selects
+// which entries under root to list; empty paths select nothing, so callers that
+// want the whole root must pass ["."] explicitly.
+func NewFileList(ctx context.Context, worktreeRoot, root vfs.Path, paths, include, exclude []string) (*FileList, error) {
+	fileSet, err := git.NewFileSet(ctx, worktreeRoot, root, paths)
+	if err != nil {
+		return nil, err
+	}
+
+	includeFileSet, err := fileset.NewGlobSet(root, include)
+	if err != nil {
+		return nil, err
+	}
+
+	excludeFileSet, err := fileset.NewGlobSet(root, exclude)
+	if err != nil {
+		return nil, err
+	}
+
+	return &FileList{
+		fileSet:        fileSet,
+		includeFileSet: includeFileSet,
+		excludeFileSet: excludeFileSet,
+	}, nil
+}
+
+// Files returns the deduped set of files (git ∪ include) − exclude.
+// Files are deduped by their relative path; the order is whatever the
+// underlying set yields.
+func (l *FileList) Files(ctx context.Context) ([]fileset.File, error) {
+	all := set.NewSetF(func(f fileset.File) string {
+		return f.Relative
+	})
+	gitFiles, err := l.fileSet.Files()
+	if err != nil {
+		log.Errorf(ctx, "cannot list files: %s", err)
+		return nil, err
+	}
+
+	all.Add(gitFiles...)
+
+	include, err := l.includeFileSet.Files()
+	if err != nil {
+		log.Errorf(ctx, "cannot list include files: %s", err)
+		return nil, err
+	}
+
+	all.Add(include...)
+
+	exclude, err := l.excludeFileSet.Files()
+	if err != nil {
+		log.Errorf(ctx, "cannot list exclude files: %s", err)
+		return nil, err
+	}
+
+	for _, f := range exclude {
+		all.Remove(f)
+	}
+
+	return all.Iter(), nil
+}
diff --git a/libs/sync/filelist_test.go b/libs/sync/filelist_test.go
new file mode 100644
index 00000000000..c8c7db63e10
--- /dev/null
+++ b/libs/sync/filelist_test.go
@@ -0,0 +1,137 @@
+package sync
+
+import (
+	"path/filepath"
+	"slices"
+	"testing"
+
+	"github.com/databricks/cli/internal/testutil"
+	"github.com/databricks/cli/libs/fileset"
+	"github.com/databricks/cli/libs/vfs"
+	"github.com/stretchr/testify/require"
+)
+
+func setupFiles(t *testing.T) string {
+	dir := t.TempDir()
+
+	for _, f := range []([]string){
+		[]string{dir, "a.go"},
+		[]string{dir, "b.go"},
+		[]string{dir, "ab.go"},
+		[]string{dir, "abc.go"},
+		[]string{dir, "c.go"},
+		[]string{dir, "d.go"},
+		[]string{dir, ".databricks", "e.go"},
+		[]string{dir, "test", "sub1", "f.go"},
+		[]string{dir, "test", "sub1", "sub2", "g.go"},
+		[]string{dir, "test", "sub1", "sub2", "h.txt"},
+	} {
+		testutil.Touch(t, f...)
+	}
+
+	return dir
+}
+
+func relativePaths(files []fileset.File) []string {
+	paths := make([]string, 0, len(files))
+	for _, f := range files {
+		paths = append(paths, f.Relative)
+	}
+	slices.Sort(paths)
+	return paths
+}
+
+func TestFileListFiles(t *testing.T) {
+	ctx := t.Context()
+
+	dir := setupFiles(t)
+	root := vfs.MustNew(dir)
+
+	l, err := NewFileList(ctx, root, root, []string{"."}, []string{}, []string{})
+	require.NoError(t, err)
+
+	fileList, err := l.Files(ctx)
+	require.NoError(t, err)
+	require.Len(t, fileList, 9)
+
+	l, err = NewFileList(ctx, root, root, []string{"."}, []string{}, []string{"*.go"})
+	require.NoError(t, err)
+
+	fileList, err = l.Files(ctx)
+	require.NoError(t, err)
+	require.Len(t, fileList, 1)
+
+	l, err = NewFileList(ctx, root, root, []string{"."}, []string{"./.databricks/*.go"}, []string{})
+	require.NoError(t, err)
+
+	fileList, err = l.Files(ctx)
+	require.NoError(t, err)
+	require.Len(t, fileList, 10)
+}
+
+func TestRecursiveExclude(t *testing.T) {
+	ctx := t.Context()
+
+	dir := setupFiles(t)
+	root := vfs.MustNew(dir)
+
+	l, err := NewFileList(ctx, root, root, []string{"."}, []string{}, []string{"test/**"})
+	require.NoError(t, err)
+
+	fileList, err := l.Files(ctx)
+	require.NoError(t, err)
+	require.Len(t, fileList, 6)
+}
+
+func TestNegateExclude(t *testing.T) {
+	ctx := t.Context()
+
+	dir := setupFiles(t)
+	root := vfs.MustNew(dir)
+
+	l, err := NewFileList(ctx, root, root, []string{"."}, []string{}, []string{"./*", "!*.txt"})
+	require.NoError(t, err)
+
+	fileList, err := l.Files(ctx)
+	require.NoError(t, err)
+	require.Len(t, fileList, 1)
+	require.Equal(t, "test/sub1/sub2/h.txt", fileList[0].Relative)
+}
+
+// TestFileListNestedRoot pins the two-root semantics: gitignore rules at the
+// worktree root must govern a sync root nested below it. If NewFileList treated
+// the sync root as the worktree root, the parent .gitignore would not be loaded
+// and ignored.go would leak into the listing.
+func TestFileListNestedRoot(t *testing.T) {
+	ctx := t.Context()
+
+	dir := t.TempDir()
+	testutil.WriteFile(t, filepath.Join(dir, ".gitignore"), "ignored.go\n")
+	testutil.Touch(t, dir, "sub", "keep.go")
+	testutil.Touch(t, dir, "sub", "ignored.go")
+
+	worktreeRoot := vfs.MustNew(dir)
+	syncRoot := vfs.MustNew(filepath.Join(dir, "sub"))
+
+	l, err := NewFileList(ctx, worktreeRoot, syncRoot, []string{"."}, nil, nil)
+	require.NoError(t, err)
+
+	fileList, err := l.Files(ctx)
+	require.NoError(t, err)
+	require.Equal(t, []string{"keep.go"}, relativePaths(fileList))
+}
+
+// TestFileListEmptyPathsIsNop pins that empty paths select no files: callers
+// that want the whole root must say so with ["."]. There is no implicit default.
+func TestFileListEmptyPathsIsNop(t *testing.T) {
+	ctx := t.Context()
+
+	dir := setupFiles(t)
+	root := vfs.MustNew(dir)
+
+	l, err := NewFileList(ctx, root, root, nil, nil, nil)
+	require.NoError(t, err)
+	files, err := l.Files(ctx)
+	require.NoError(t, err)
+	require.Empty(t, files)
+}
diff --git a/libs/sync/path.go b/libs/sync/path.go
index 3f86e8d3446..d85699cf55c 100644
--- a/libs/sync/path.go
+++ b/libs/sync/path.go
@@ -7,12 +7,22 @@ import (
 	"strings"
 
 	"github.com/databricks/cli/libs/log"
+	"github.com/databricks/cli/libs/retry"
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/apierr"
 	"github.com/databricks/databricks-sdk-go/service/iam"
 	"github.com/databricks/databricks-sdk-go/service/workspace"
 )
 
+// getStatusWithRetry returns the workspace object at remotePath, retrying transient failures.
+// The read has no side effects, so a transient server error or a refused HTTP/2 stream
+// (https://github.com/databricks/cli/issues/6472) is safe to replay instead of failing the sync.
+func getStatusWithRetry(ctx context.Context, wsc *databricks.WorkspaceClient, remotePath string) (*workspace.ObjectInfo, error) {
+	return retry.With(ctx, retry.IsTransientRead, func() (*workspace.ObjectInfo, error) {
+		return wsc.Workspace.GetStatusByPath(ctx, remotePath)
+	})
+}
+
 func repoPathForPath(me *iam.User, remotePath string) string {
 	base := path.Clean("/Repos/" + me.UserName)
 	remotePath = path.Clean(remotePath)
@@ -24,13 +34,14 @@ func repoPathForPath(me *iam.User, remotePath string) string {
 
 // EnsureRemotePathIsUsable checks if the specified path is nested under
 // expected base paths and if it is a directory or repository.
-func EnsureRemotePathIsUsable(ctx context.Context, wsc *databricks.WorkspaceClient, remotePath string, me *iam.User) error {
+// If dryRun is set, a missing remote directory is not created.
+func EnsureRemotePathIsUsable(ctx context.Context, wsc *databricks.WorkspaceClient, remotePath string, me *iam.User, dryRun bool) error {
 	var err error
 
 	// TODO: we should cache CurrentUser.Me at the SDK level
 	//      for now we let clients pass in any existing user they might already have
 	if me == nil {
-		me, err = wsc.CurrentUser.Me(ctx)
+		me, err = wsc.CurrentUser.Me(ctx, iam.MeRequest{})
 		if err != nil {
 			return err
 		}
@@ -39,7 +50,7 @@ func EnsureRemotePathIsUsable(ctx context.Context, wsc *databricks.WorkspaceClie
 	// Ensure that the remote path exists.
 	// If it is a repo, it has to exist.
 	// If it is a workspace path, it may not exist.
-	info, err := wsc.Workspace.GetStatusByPath(ctx, remotePath) //nolint:staticcheck // Deprecated in SDK v0.127.0. Migration to WorkspaceHierarchyService tracked separately.
+	info, err := getStatusWithRetry(ctx, wsc, remotePath)
 	if err != nil {
 		// We only deal with 404s below.
 		if !apierr.IsMissing(err) {
@@ -49,18 +60,23 @@ func EnsureRemotePathIsUsable(ctx context.Context, wsc *databricks.WorkspaceClie
 		// If the path is nested under a repo, the repo has to exist.
 		if strings.HasPrefix(remotePath, "/Repos/") {
 			repoPath := repoPathForPath(me, remotePath)
-			_, err = wsc.Workspace.GetStatusByPath(ctx, repoPath) //nolint:staticcheck // Deprecated in SDK v0.127.0. Migration to WorkspaceHierarchyService tracked separately.
+			_, err = getStatusWithRetry(ctx, wsc, repoPath)
 			if err != nil && apierr.IsMissing(err) {
 				return fmt.Errorf("%s does not exist; please create it first", repoPath)
 			}
 		}
 
+		// A dry run must not create the missing directory; nothing left to validate.
+		if dryRun {
+			return nil
+		}
+
 		// The workspace path doesn't exist. Create it and try again.
-		err = wsc.Workspace.MkdirsByPath(ctx, remotePath) //nolint:staticcheck // Deprecated in SDK v0.127.0. Migration to WorkspaceHierarchyService tracked separately.
+		err = wsc.Workspace.MkdirsByPath(ctx, remotePath)
 		if err != nil {
 			return fmt.Errorf("unable to create directory at %s: %w", remotePath, err)
 		}
-		info, err = wsc.Workspace.GetStatusByPath(ctx, remotePath) //nolint:staticcheck // Deprecated in SDK v0.127.0. Migration to WorkspaceHierarchyService tracked separately.
+		info, err = getStatusWithRetry(ctx, wsc, remotePath)
 		if err != nil {
 			return err
 		}
diff --git a/libs/sync/retry.go b/libs/sync/retry.go
deleted file mode 100644
index 7342a48cc4f..00000000000
--- a/libs/sync/retry.go
+++ /dev/null
@@ -1,50 +0,0 @@
-package sync
-
-import (
-	"context"
-	"errors"
-	"net/http"
-	"time"
-
-	"github.com/databricks/cli/libs/log"
-	"github.com/databricks/databricks-sdk-go/apierr"
-	"github.com/databricks/databricks-sdk-go/retries"
-)
-
-// DefaultRetryTimeout bounds how long the sync layer keeps retrying transient
-// gateway errors per filer call. The SDK only retries 429 and 504
-// (httpclient/errors.go DefaultErrorRetriable); 502 and 503 land here.
-const DefaultRetryTimeout = 30 * time.Second
-
-func isTransientGatewayError(err error) bool {
-	var aerr *apierr.APIError
-	if !errors.As(err, &aerr) {
-		return false
-	}
-	switch aerr.StatusCode {
-	case http.StatusBadGateway, http.StatusServiceUnavailable, http.StatusGatewayTimeout:
-		return true
-	}
-	return false
-}
-
-// retryOnTransient runs fn, retrying transient gateway errors
-// (HTTP 502/503/504) until timeout elapses. Backoff and jitter are provided
-// by retries.Poll.
-func retryOnTransient(ctx context.Context, timeout time.Duration, label string, fn func() error) error {
-	if timeout <= 0 {
-		return fn()
-	}
-	_, err := retries.Poll(ctx, timeout, func() (*struct{}, *retries.Err) {
-		err := fn()
-		if err == nil {
-			return nil, nil
-		}
-		if !isTransientGatewayError(err) {
-			return nil, retries.Halt(err)
-		}
-		log.Warnf(ctx, "sync %s: retrying after transient error: %s", label, err)
-		return nil, retries.Continue(err)
-	})
-	return err
-}
diff --git a/libs/sync/retry_test.go b/libs/sync/retry_test.go
deleted file mode 100644
index 25896bf3ed2..00000000000
--- a/libs/sync/retry_test.go
+++ /dev/null
@@ -1,86 +0,0 @@
-package sync
-
-import (
-	"context"
-	"errors"
-	"net/http"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"github.com/databricks/databricks-sdk-go/apierr"
-	"github.com/stretchr/testify/require"
-)
-
-func apiErr(status int) error {
-	return &apierr.APIError{StatusCode: status, Message: http.StatusText(status)}
-}
-
-func TestIsTransientGatewayError(t *testing.T) {
-	cases := map[error]bool{
-		nil:                                    false,
-		apiErr(http.StatusBadGateway):          true,
-		apiErr(http.StatusServiceUnavailable):  true,
-		apiErr(http.StatusGatewayTimeout):      true,
-		apiErr(http.StatusInternalServerError): false,
-		apiErr(http.StatusTooManyRequests):     false,
-		apiErr(http.StatusNotFound):            false,
-		errors.New("not an api error"):         false,
-	}
-	for err, want := range cases {
-		require.Equal(t, want, isTransientGatewayError(err), "%v", err)
-	}
-}
-
-func TestRetryOnTransient(t *testing.T) {
-	t.Run("succeeds after retries", func(t *testing.T) {
-		var calls atomic.Int32
-		err := retryOnTransient(t.Context(), 30*time.Second, "test", func() error {
-			if calls.Add(1) < 3 {
-				return apiErr(http.StatusBadGateway)
-			}
-			return nil
-		})
-		require.NoError(t, err)
-		require.Equal(t, int32(3), calls.Load())
-	})
-
-	t.Run("does not retry non-transient", func(t *testing.T) {
-		var calls atomic.Int32
-		err := retryOnTransient(t.Context(), 30*time.Second, "test", func() error {
-			calls.Add(1)
-			return apiErr(http.StatusNotFound)
-		})
-		require.Error(t, err)
-		require.Equal(t, int32(1), calls.Load())
-	})
-
-	t.Run("zero timeout disables retries", func(t *testing.T) {
-		var calls atomic.Int32
-		err := retryOnTransient(t.Context(), 0, "test", func() error {
-			calls.Add(1)
-			return apiErr(http.StatusBadGateway)
-		})
-		require.Error(t, err)
-		require.Equal(t, int32(1), calls.Load())
-	})
-
-	t.Run("times out on persistent transient error", func(t *testing.T) {
-		var calls atomic.Int32
-		err := retryOnTransient(t.Context(), 100*time.Millisecond, "test", func() error {
-			calls.Add(1)
-			return apiErr(http.StatusBadGateway)
-		})
-		require.Error(t, err)
-		require.GreaterOrEqual(t, calls.Load(), int32(1))
-	})
-
-	t.Run("honors context cancellation", func(t *testing.T) {
-		ctx, cancel := context.WithCancel(t.Context())
-		cancel()
-		err := retryOnTransient(ctx, 30*time.Second, "test", func() error {
-			return apiErr(http.StatusBadGateway)
-		})
-		require.Error(t, err)
-	})
-}
diff --git a/libs/sync/snapshot.go b/libs/sync/snapshot.go
index 1b338aab887..f936ae197d2 100644
--- a/libs/sync/snapshot.go
+++ b/libs/sync/snapshot.go
@@ -12,6 +12,7 @@ import (
 	"path/filepath"
 	"time"
 
+	"github.com/databricks/cli/libs/atomicfile"
 	"github.com/databricks/cli/libs/fileset"
 	"github.com/databricks/cli/libs/log"
 )
@@ -92,7 +93,7 @@ func SnapshotPath(opts *SyncOptions) (string, error) {
 	if _, err := os.Stat(snapshotDir); errors.Is(err, fs.ErrNotExist) {
 		err = os.MkdirAll(snapshotDir, 0o755)
 		if err != nil {
-			return "", fmt.Errorf("failed to create config directory: %s", err)
+			return "", fmt.Errorf("failed to create config directory: %w", err)
 		}
 	}
 	fileName := GetFileName(opts.Host, opts.RemotePath)
@@ -121,20 +122,13 @@ func newSnapshot(ctx context.Context, opts *SyncOptions) (*Snapshot, error) {
 }
 
 func (s *Snapshot) Save(ctx context.Context) error {
-	f, err := os.OpenFile(s.snapshotPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o644)
-	if err != nil {
-		return fmt.Errorf("failed to create/open persisted sync snapshot file: %s", err)
-	}
-	defer f.Close()
-
 	// persist snapshot to disk
 	bytes, err := json.MarshalIndent(s, "", "  ")
 	if err != nil {
-		return fmt.Errorf("failed to json marshal in-memory snapshot: %s", err)
+		return fmt.Errorf("failed to json marshal in-memory snapshot: %w", err)
 	}
-	_, err = f.Write(bytes)
-	if err != nil {
-		return fmt.Errorf("failed to write sync snapshot to disk: %s", err)
+	if err := atomicfile.Write(s.snapshotPath, bytes, 0o644); err != nil {
+		return fmt.Errorf("failed to write sync snapshot to disk: %v", err) //nolint:errorlint // files.Upload treats fs.ErrPermission as a workspace permission problem; this is a local file
 	}
 	return nil
 }
@@ -152,13 +146,13 @@ func loadOrNewSnapshot(ctx context.Context, opts *SyncOptions) (*Snapshot, error
 
 	bytes, err := os.ReadFile(snapshot.snapshotPath)
 	if err != nil {
-		return nil, fmt.Errorf("failed to read sync snapshot from disk: %s", err)
+		return nil, fmt.Errorf("failed to read sync snapshot from disk: %w", err)
 	}
 
 	var fromDisk Snapshot
 	err = json.Unmarshal(bytes, &fromDisk)
 	if err != nil {
-		return nil, fmt.Errorf("failed to json unmarshal persisted snapshot: %s", err)
+		return nil, fmt.Errorf("failed to json unmarshal persisted snapshot: %w", err)
 	}
 
 	// invalidate old snapshot with schema versions
@@ -170,7 +164,7 @@ func loadOrNewSnapshot(ctx context.Context, opts *SyncOptions) (*Snapshot, error
 	// unmarshal again over the existing snapshot instance
 	err = json.Unmarshal(bytes, &snapshot)
 	if err != nil {
-		return nil, fmt.Errorf("failed to json unmarshal persisted snapshot: %s", err)
+		return nil, fmt.Errorf("failed to json unmarshal persisted snapshot: %w", err)
 	}
 
 	// Ensure that all paths are slash-separated upon loading
diff --git a/libs/sync/snapshot_state.go b/libs/sync/snapshot_state.go
index 38ee2880748..61b24310272 100644
--- a/libs/sync/snapshot_state.go
+++ b/libs/sync/snapshot_state.go
@@ -2,12 +2,11 @@ package sync
 
 import (
 	"fmt"
-	"path"
 	"path/filepath"
-	"strings"
 	"time"
 
 	"github.com/databricks/cli/libs/fileset"
+	"github.com/databricks/cli/libs/notebook"
 )
 
 // SnapshotState keeps track of files on the local filesystem and their corresponding
@@ -57,8 +56,7 @@ func NewSnapshotState(localFiles []fileset.File) (*SnapshotState, error) {
 			continue
 		}
 		if isNotebook {
-			ext := path.Ext(remoteName)
-			remoteName = strings.TrimSuffix(remoteName, ext)
+			remoteName = notebook.StripExtension(remoteName)
 		}
 
 		// Add the file to snapshot state
diff --git a/libs/sync/snapshot_state_test.go b/libs/sync/snapshot_state_test.go
index 248e5832ca7..2c5591c4572 100644
--- a/libs/sync/snapshot_state_test.go
+++ b/libs/sync/snapshot_state_test.go
@@ -17,19 +17,21 @@ func TestSnapshotState(t *testing.T) {
 	require.NoError(t, err)
 
 	// Assert initial contents of the fileset
-	assert.Len(t, files, 4)
-	assert.Equal(t, "invalid-nb.ipynb", files[0].Relative)
-	assert.Equal(t, "my-nb.py", files[1].Relative)
-	assert.Equal(t, "my-script.py", files[2].Relative)
-	assert.Equal(t, "valid-nb.ipynb", files[3].Relative)
+	assert.Len(t, files, 5)
+	assert.Equal(t, "designer-nb.designer.ipynb", files[0].Relative)
+	assert.Equal(t, "invalid-nb.ipynb", files[1].Relative)
+	assert.Equal(t, "my-nb.py", files[2].Relative)
+	assert.Equal(t, "my-script.py", files[3].Relative)
+	assert.Equal(t, "valid-nb.ipynb", files[4].Relative)
 
 	// Assert snapshot state generated from the fileset. Note that the invalid notebook
-	// has been ignored.
+	// has been ignored. The Designer notebook keeps its full ".designer.ipynb" suffix
+	// in the remote name, while other notebooks have their extension stripped.
 	s, err := NewSnapshotState(files)
 	require.NoError(t, err)
-	assertKeysOfMap(t, s.LastModifiedTimes, []string{"valid-nb.ipynb", "my-nb.py", "my-script.py"})
-	assertKeysOfMap(t, s.LocalToRemoteNames, []string{"valid-nb.ipynb", "my-nb.py", "my-script.py"})
-	assertKeysOfMap(t, s.RemoteToLocalNames, []string{"valid-nb", "my-nb", "my-script.py"})
+	assertKeysOfMap(t, s.LastModifiedTimes, []string{"designer-nb.designer.ipynb", "valid-nb.ipynb", "my-nb.py", "my-script.py"})
+	assertKeysOfMap(t, s.LocalToRemoteNames, []string{"designer-nb.designer.ipynb", "valid-nb.ipynb", "my-nb.py", "my-script.py"})
+	assertKeysOfMap(t, s.RemoteToLocalNames, []string{"designer-nb.designer.ipynb", "valid-nb", "my-nb", "my-script.py"})
 	assert.NoError(t, s.validate())
 }
 
diff --git a/libs/sync/sync.go b/libs/sync/sync.go
index 3484335237e..1e31b85481f 100644
--- a/libs/sync/sync.go
+++ b/libs/sync/sync.go
@@ -9,9 +9,8 @@ import (
 
 	"github.com/databricks/cli/libs/filer"
 	"github.com/databricks/cli/libs/fileset"
-	"github.com/databricks/cli/libs/git"
 	"github.com/databricks/cli/libs/log"
-	"github.com/databricks/cli/libs/set"
+	"github.com/databricks/cli/libs/retry"
 	"github.com/databricks/cli/libs/vfs"
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/service/iam"
@@ -19,6 +18,14 @@ import (
 
 type OutputHandler func(context.Context, <-chan Event)
 
+// FileCounts reports how many files a sync run uploaded and deleted. A file
+// whose remote name changed (e.g. a script converted to a notebook) is counted
+// as both an upload and a delete, because that is what the sync performs.
+type FileCounts struct {
+	Uploaded int
+	Deleted  int
+}
+
 type SyncOptions struct {
 	WorktreeRoot vfs.Path
 	LocalRoot    vfs.Path
@@ -44,22 +51,13 @@ type SyncOptions struct {
 
 	DryRun bool
 
-	// Concurrency is the maximum number of in-flight filer requests during sync.
-	// Defaults to MaxRequestsInFlight when zero.
-	Concurrency int
-
-	// RetryTimeout bounds how long each filer call may keep retrying transient
-	// gateway errors (HTTP 502/503/504). Defaults to DefaultRetryTimeout when
-	// zero; a negative value disables sync-layer retries.
-	RetryTimeout time.Duration
+	NoValidateRemotePath bool
 }
 
 type Sync struct {
 	*SyncOptions
 
-	fileSet        *git.FileSet
-	includeFileSet *fileset.FileSet
-	excludeFileSet *fileset.FileSet
+	fileList *FileList
 
 	snapshot *Snapshot
 	filer    filer.Filer
@@ -68,6 +66,11 @@ type Sync struct {
 	notifier EventNotifier
 	seq      int
 
+	// fileCounts holds the counts from the most recent run. Kept here rather than
+	// derived from the event stream because the notifier is a no-op unless the
+	// caller supplies an OutputHandler.
+	fileCounts FileCounts
+
 	// WaitGroup is automatically created when an output handler is provided in the SyncOptions.
 	// Close call is required to ensure the output handler goroutine handles all events in time.
 	outputWaitGroup *stdsync.WaitGroup
@@ -75,27 +78,19 @@ type Sync struct {
 
 // New initializes and returns a new [Sync] instance.
 func New(ctx context.Context, opts SyncOptions) (*Sync, error) {
-	fileSet, err := git.NewFileSet(ctx, opts.WorktreeRoot, opts.LocalRoot, opts.Paths)
+	fileList, err := NewFileList(ctx, opts.WorktreeRoot, opts.LocalRoot, opts.Paths, opts.Include, opts.Exclude)
 	if err != nil {
 		return nil, err
 	}
 
 	WriteGitIgnore(ctx, opts.LocalRoot.Native())
 
-	includeFileSet, err := fileset.NewGlobSet(opts.LocalRoot, opts.Include)
-	if err != nil {
-		return nil, err
-	}
-
-	excludeFileSet, err := fileset.NewGlobSet(opts.LocalRoot, opts.Exclude)
-	if err != nil {
-		return nil, err
-	}
-
-	// Verify that the remote path we're about to synchronize to is valid and allowed.
-	err = EnsureRemotePathIsUsable(ctx, opts.WorkspaceClient, opts.RemotePath, opts.CurrentUser)
-	if err != nil {
-		return nil, err
+	if !opts.NoValidateRemotePath {
+		// Verify that the remote path we're about to synchronize to is valid and allowed.
+		err = EnsureRemotePathIsUsable(ctx, opts.WorkspaceClient, opts.RemotePath, opts.CurrentUser, opts.DryRun)
+		if err != nil {
+			return nil, err
+		}
 	}
 
 	// TODO: The host may be late-initialized in certain Azure setups where we
@@ -105,13 +100,6 @@ func New(ctx context.Context, opts SyncOptions) (*Sync, error) {
 		return nil, errors.New("failed to resolve host for snapshot")
 	}
 
-	if opts.Concurrency == 0 {
-		opts.Concurrency = MaxRequestsInFlight
-	}
-	if opts.RetryTimeout == 0 {
-		opts.RetryTimeout = DefaultRetryTimeout
-	}
-
 	// For full sync, we start with an empty snapshot.
 	// For incremental sync, we try to load an existing snapshot to start from.
 	var snapshot *Snapshot
@@ -127,15 +115,16 @@ func New(ctx context.Context, opts SyncOptions) (*Sync, error) {
 		}
 	}
 
-	filer, err := filer.NewWorkspaceFilesClient(opts.WorkspaceClient, opts.RemotePath)
+	workspaceFiler, err := filer.NewWorkspaceFilesClient(opts.WorkspaceClient, opts.RemotePath)
 	if err != nil {
 		return nil, err
 	}
+	filer := retry.Filer(workspaceFiler)
 
 	var notifier EventNotifier
 	outputWaitGroup := &stdsync.WaitGroup{}
 	if opts.OutputHandler != nil {
-		ch := make(chan Event, opts.Concurrency)
+		ch := make(chan Event, MaxRequestsInFlight)
 		notifier = &ChannelNotifier{ch}
 		outputWaitGroup.Go(func() {
 			opts.OutputHandler(ctx, ch)
@@ -147,9 +136,7 @@ func New(ctx context.Context, opts SyncOptions) (*Sync, error) {
 	return &Sync{
 		SyncOptions: &opts,
 
-		fileSet:         fileSet,
-		includeFileSet:  includeFileSet,
-		excludeFileSet:  excludeFileSet,
+		fileList:        fileList,
 		snapshot:        snapshot,
 		filer:           filer,
 		notifier:        notifier,
@@ -203,6 +190,7 @@ func (s *Sync) RunOnce(ctx context.Context) ([]fileset.File, error) {
 	if err != nil {
 		return files, err
 	}
+	s.fileCounts = FileCounts{Uploaded: len(change.put), Deleted: len(change.delete)}
 
 	s.notifyStart(ctx, change)
 	if change.IsEmpty() {
@@ -227,38 +215,14 @@ func (s *Sync) RunOnce(ctx context.Context) ([]fileset.File, error) {
 	return files, nil
 }
 
-func (s *Sync) GetFileList(ctx context.Context) ([]fileset.File, error) {
-	// tradeoff: doing portable monitoring only due to macOS max descriptor manual ulimit setting requirement
-	// https://github.com/gorakhargosh/watchdog/blob/master/src/watchdog/observers/kqueue.py#L394-L418
-	all := set.NewSetF(func(f fileset.File) string {
-		return f.Relative
-	})
-	gitFiles, err := s.fileSet.Files()
-	if err != nil {
-		log.Errorf(ctx, "cannot list files: %s", err)
-		return nil, err
-	}
-	all.Add(gitFiles...)
-
-	include, err := s.includeFileSet.Files()
-	if err != nil {
-		log.Errorf(ctx, "cannot list include files: %s", err)
-		return nil, err
-	}
-
-	all.Add(include...)
-
-	exclude, err := s.excludeFileSet.Files()
-	if err != nil {
-		log.Errorf(ctx, "cannot list exclude files: %s", err)
-		return nil, err
-	}
-
-	for _, f := range exclude {
-		all.Remove(f)
-	}
+// FileCounts returns the upload and delete counts from the most recent run.
+func (s *Sync) FileCounts() FileCounts {
+	return s.fileCounts
+}
 
-	return all.Iter(), nil
+// GetFileList returns the local files selected for sync, without syncing them.
+func (s *Sync) GetFileList(ctx context.Context) ([]fileset.File, error) {
+	return s.fileList.Files(ctx)
 }
 
 func (s *Sync) RunContinuous(ctx context.Context) error {
diff --git a/libs/sync/sync_test.go b/libs/sync/sync_test.go
deleted file mode 100644
index d146ffc07ff..00000000000
--- a/libs/sync/sync_test.go
+++ /dev/null
@@ -1,150 +0,0 @@
-package sync
-
-import (
-	"testing"
-
-	"github.com/databricks/cli/internal/testutil"
-	"github.com/databricks/cli/libs/fileset"
-	"github.com/databricks/cli/libs/git"
-	"github.com/databricks/cli/libs/vfs"
-	"github.com/stretchr/testify/require"
-)
-
-func setupFiles(t *testing.T) string {
-	dir := t.TempDir()
-
-	for _, f := range []([]string){
-		[]string{dir, "a.go"},
-		[]string{dir, "b.go"},
-		[]string{dir, "ab.go"},
-		[]string{dir, "abc.go"},
-		[]string{dir, "c.go"},
-		[]string{dir, "d.go"},
-		[]string{dir, ".databricks", "e.go"},
-		[]string{dir, "test", "sub1", "f.go"},
-		[]string{dir, "test", "sub1", "sub2", "g.go"},
-		[]string{dir, "test", "sub1", "sub2", "h.txt"},
-	} {
-		testutil.Touch(t, f...)
-	}
-
-	return dir
-}
-
-func TestGetFileSet(t *testing.T) {
-	ctx := t.Context()
-
-	dir := setupFiles(t)
-	root := vfs.MustNew(dir)
-	fileSet, err := git.NewFileSetAtRoot(ctx, root)
-	require.NoError(t, err)
-
-	inc, err := fileset.NewGlobSet(root, []string{})
-	require.NoError(t, err)
-
-	excl, err := fileset.NewGlobSet(root, []string{})
-	require.NoError(t, err)
-
-	s := &Sync{
-		SyncOptions: &SyncOptions{},
-
-		fileSet:        fileSet,
-		includeFileSet: inc,
-		excludeFileSet: excl,
-	}
-
-	fileList, err := s.GetFileList(ctx)
-	require.NoError(t, err)
-	require.Len(t, fileList, 9)
-
-	inc, err = fileset.NewGlobSet(root, []string{})
-	require.NoError(t, err)
-
-	excl, err = fileset.NewGlobSet(root, []string{"*.go"})
-	require.NoError(t, err)
-
-	s = &Sync{
-		SyncOptions: &SyncOptions{},
-
-		fileSet:        fileSet,
-		includeFileSet: inc,
-		excludeFileSet: excl,
-	}
-
-	fileList, err = s.GetFileList(ctx)
-	require.NoError(t, err)
-	require.Len(t, fileList, 1)
-
-	inc, err = fileset.NewGlobSet(root, []string{"./.databricks/*.go"})
-	require.NoError(t, err)
-
-	excl, err = fileset.NewGlobSet(root, []string{})
-	require.NoError(t, err)
-
-	s = &Sync{
-		SyncOptions: &SyncOptions{},
-
-		fileSet:        fileSet,
-		includeFileSet: inc,
-		excludeFileSet: excl,
-	}
-
-	fileList, err = s.GetFileList(ctx)
-	require.NoError(t, err)
-	require.Len(t, fileList, 10)
-}
-
-func TestRecursiveExclude(t *testing.T) {
-	ctx := t.Context()
-
-	dir := setupFiles(t)
-	root := vfs.MustNew(dir)
-	fileSet, err := git.NewFileSetAtRoot(ctx, root)
-	require.NoError(t, err)
-
-	inc, err := fileset.NewGlobSet(root, []string{})
-	require.NoError(t, err)
-
-	excl, err := fileset.NewGlobSet(root, []string{"test/**"})
-	require.NoError(t, err)
-
-	s := &Sync{
-		SyncOptions: &SyncOptions{},
-
-		fileSet:        fileSet,
-		includeFileSet: inc,
-		excludeFileSet: excl,
-	}
-
-	fileList, err := s.GetFileList(ctx)
-	require.NoError(t, err)
-	require.Len(t, fileList, 6)
-}
-
-func TestNegateExclude(t *testing.T) {
-	ctx := t.Context()
-
-	dir := setupFiles(t)
-	root := vfs.MustNew(dir)
-	fileSet, err := git.NewFileSetAtRoot(ctx, root)
-	require.NoError(t, err)
-
-	inc, err := fileset.NewGlobSet(root, []string{})
-	require.NoError(t, err)
-
-	excl, err := fileset.NewGlobSet(root, []string{"./*", "!*.txt"})
-	require.NoError(t, err)
-
-	s := &Sync{
-		SyncOptions: &SyncOptions{},
-
-		fileSet:        fileSet,
-		includeFileSet: inc,
-		excludeFileSet: excl,
-	}
-
-	fileList, err := s.GetFileList(ctx)
-	require.NoError(t, err)
-	require.Len(t, fileList, 1)
-	require.Equal(t, "test/sub1/sub2/h.txt", fileList[0].Relative)
-}
diff --git a/libs/sync/testdata/sync-fileset/designer-nb.designer.ipynb b/libs/sync/testdata/sync-fileset/designer-nb.designer.ipynb
new file mode 100644
index 00000000000..6254635ef32
--- /dev/null
+++ b/libs/sync/testdata/sync-fileset/designer-nb.designer.ipynb
@@ -0,0 +1,21 @@
+{
+ "cells": [
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "print(\"designer\")"
+   ]
+  }
+ ],
+ "metadata": {
+  "language_info": {
+   "name": "python"
+  },
+  "orig_nbformat": 4
+ },
+ "nbformat": 4,
+ "nbformat_minor": 2
+}
diff --git a/libs/sync/watchdog.go b/libs/sync/watchdog.go
index 4078dd6eacf..fa7ff0baceb 100644
--- a/libs/sync/watchdog.go
+++ b/libs/sync/watchdog.go
@@ -10,8 +10,10 @@ import (
 	"golang.org/x/sync/errgroup"
 )
 
-// Default maximum number of concurrent requests during sync. Override with
-// SyncOptions.Concurrency.
+// Maximum number of concurrent requests during sync. Chosen against the
+// per-endpoint rate limits documented at
+// https://docs.databricks.com/aws/en/resources/limits ("API rate limits" -
+// Workspace API), which sync stays within for the endpoints it calls.
 const MaxRequestsInFlight = 20
 
 // Delete the specified path.
@@ -19,9 +21,7 @@ func (s *Sync) applyDelete(ctx context.Context, remoteName string) error {
 	s.notifyProgress(ctx, EventActionDelete, remoteName, 0.0)
 
 	if !s.DryRun {
-		err := retryOnTransient(ctx, s.RetryTimeout, "delete "+remoteName, func() error {
-			return s.filer.Delete(ctx, remoteName)
-		})
+		err := s.filer.Delete(ctx, remoteName)
 		if err != nil && !errors.Is(err, fs.ErrNotExist) {
 			return err
 		}
@@ -36,9 +36,7 @@ func (s *Sync) applyRmdir(ctx context.Context, remoteName string) error {
 	s.notifyProgress(ctx, EventActionDelete, remoteName, 0.0)
 
 	if !s.DryRun {
-		err := retryOnTransient(ctx, s.RetryTimeout, "rmdir "+remoteName, func() error {
-			return s.filer.Delete(ctx, remoteName)
-		})
+		err := s.filer.Delete(ctx, remoteName)
 		if err != nil {
 			// Directory deletion is opportunistic, so we ignore errors.
 			log.Debugf(ctx, "error removing directory %s: %s", remoteName, err)
@@ -54,9 +52,7 @@ func (s *Sync) applyMkdir(ctx context.Context, localName string) error {
 	s.notifyProgress(ctx, EventActionPut, localName, 0.0)
 
 	if !s.DryRun {
-		err := retryOnTransient(ctx, s.RetryTimeout, "mkdir "+localName, func() error {
-			return s.filer.Mkdir(ctx, localName)
-		})
+		err := s.filer.Mkdir(ctx, localName)
 		if err != nil {
 			return err
 		}
@@ -70,24 +66,16 @@ func (s *Sync) applyMkdir(ctx context.Context, localName string) error {
 func (s *Sync) applyPut(ctx context.Context, localName string) error {
 	s.notifyProgress(ctx, EventActionPut, localName, 0.0)
 
-	// Surface a missing/unreadable local file even on dry-run.
-	f, err := s.LocalRoot.Open(localName)
-	if err != nil {
-		return err
-	}
-	f.Close()
-
 	if !s.DryRun {
+		localFile, err := s.LocalRoot.Open(localName)
+		if err != nil {
+			return err
+		}
+
+		defer localFile.Close()
+
 		opts := []filer.WriteMode{filer.CreateParentDirectories, filer.OverwriteIfExists}
-		err := retryOnTransient(ctx, s.RetryTimeout, "put "+localName, func() error {
-			// Re-open per attempt: filer.Write consumes the reader.
-			f, err := s.LocalRoot.Open(localName)
-			if err != nil {
-				return err
-			}
-			defer f.Close()
-			return s.filer.Write(ctx, localName, f, opts...)
-		})
+		err = s.filer.Write(ctx, localName, localFile, opts...)
 		if err != nil {
 			return err
 		}
@@ -111,9 +99,9 @@ func groupRunSingle(ctx context.Context, group *errgroup.Group, fn func(context.
 	})
 }
 
-func groupRunParallel(ctx context.Context, paths []string, limit int, fn func(context.Context, string) error) error {
+func groupRunParallel(ctx context.Context, paths []string, fn func(context.Context, string) error) error {
 	group, ctx := errgroup.WithContext(ctx)
-	group.SetLimit(limit)
+	group.SetLimit(MaxRequestsInFlight)
 
 	for _, path := range paths {
 		groupRunSingle(ctx, group, fn, path)
@@ -124,17 +112,17 @@ func groupRunParallel(ctx context.Context, paths []string, limit int, fn func(co
 }
 
 func (s *Sync) applyDiff(ctx context.Context, d diff) error {
-	limit := s.Concurrency
+	var err error
 
 	// Delete files in parallel.
-	err := groupRunParallel(ctx, d.delete, limit, s.applyDelete)
+	err = groupRunParallel(ctx, d.delete, s.applyDelete)
 	if err != nil {
 		return err
 	}
 
 	// Delete directories ordered by depth from leaf to root.
 	for _, group := range d.groupedRmdir() {
-		err = groupRunParallel(ctx, group, limit, s.applyRmdir)
+		err = groupRunParallel(ctx, group, s.applyRmdir)
 		if err != nil {
 			return err
 		}
@@ -142,12 +130,14 @@ func (s *Sync) applyDiff(ctx context.Context, d diff) error {
 
 	// Create directories (leafs only because intermediates are created automatically).
 	for _, group := range d.groupedMkdir() {
-		err = groupRunParallel(ctx, group, limit, s.applyMkdir)
+		err = groupRunParallel(ctx, group, s.applyMkdir)
 		if err != nil {
 			return err
 		}
 	}
 
 	// Put files in parallel.
-	return groupRunParallel(ctx, d.put, limit, s.applyPut)
+	err = groupRunParallel(ctx, d.put, s.applyPut)
+
+	return err
 }
diff --git a/libs/sync/watchdog_test.go b/libs/sync/watchdog_test.go
new file mode 100644
index 00000000000..91378017fbc
--- /dev/null
+++ b/libs/sync/watchdog_test.go
@@ -0,0 +1,22 @@
+package sync
+
+import (
+	"testing"
+
+	"github.com/databricks/cli/libs/vfs"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestApplyPutDryRunSkipsLocalRead(t *testing.T) {
+	s := &Sync{
+		SyncOptions: &SyncOptions{
+			LocalRoot: vfs.MustNew(t.TempDir()),
+			DryRun:    true,
+		},
+		notifier: &NopNotifier{},
+	}
+
+	// The missing file must not fail a dry run; the nil filer guarantees no write is attempted.
+	err := s.applyPut(t.Context(), "missing.txt")
+	assert.NoError(t, err)
+}
diff --git a/libs/tableview/tableview.go b/libs/tableview/tableview.go
index df47a29f85d..7d8e7b292d4 100644
--- a/libs/tableview/tableview.go
+++ b/libs/tableview/tableview.go
@@ -2,6 +2,7 @@
 package tableview
 
 import (
+	"context"
 	"fmt"
 	"io"
 	"strings"
@@ -10,6 +11,8 @@ import (
 	"github.com/charmbracelet/bubbles/viewport"
 	tea "github.com/charmbracelet/bubbletea"
 	"github.com/charmbracelet/lipgloss"
+
+	"github.com/databricks/cli/libs/cmdio"
 )
 
 const (
@@ -21,24 +24,22 @@ const (
 	headerLines = 2
 )
 
-var (
-	searchHighlightStyle = lipgloss.NewStyle().Background(lipgloss.Color("228")).Foreground(lipgloss.Color("0"))
-	cursorStyle          = lipgloss.NewStyle().Background(lipgloss.Color("57")).Foreground(lipgloss.Color("229"))
-	footerStyle          = lipgloss.NewStyle().Foreground(lipgloss.Color("241"))
-	searchStyle          = lipgloss.NewStyle().Foreground(lipgloss.Color("229"))
-)
-
 // Run displays tabular data in an interactive browser.
 // Writes to w (typically stdout). Blocks until user quits.
-func Run(w io.Writer, columns []string, rows [][]string) error {
+func Run(ctx context.Context, w io.Writer, columns []string, rows [][]string) error {
 	all := renderTableLines(columns, rows)
 	header := all[:headerLines]
 	dataLines := all[headerLines:]
 
+	r, _ := cmdio.NewRenderer(ctx, w)
 	m := model{
-		header: header,
-		lines:  dataLines,
-		cursor: 0,
+		header:               header,
+		lines:                dataLines,
+		cursor:               0,
+		searchHighlightStyle: r.NewStyle().Background(lipgloss.Color("228")).Foreground(lipgloss.Color("0")),
+		cursorStyle:          r.NewStyle().Background(lipgloss.Color("57")).Foreground(lipgloss.Color("229")),
+		footerStyle:          r.NewStyle().Foreground(lipgloss.Color("241")),
+		searchStyle:          r.NewStyle().Foreground(lipgloss.Color("229")),
 	}
 
 	p := tea.NewProgram(m, tea.WithOutput(w))
@@ -109,7 +110,7 @@ func findMatches(lines []string, query string) []int {
 }
 
 // highlightSearch applies search match highlighting to a single line.
-func highlightSearch(line, query string) string {
+func (m model) highlightSearch(line, query string) string {
 	if query == "" {
 		return line
 	}
@@ -126,7 +127,7 @@ func highlightSearch(line, query string) string {
 			break
 		}
 		b.WriteString(line[pos : pos+idx])
-		b.WriteString(searchHighlightStyle.Render(line[pos+idx : pos+idx+qLen]))
+		b.WriteString(m.searchHighlightStyle.Render(line[pos+idx : pos+idx+qLen]))
 		pos += idx + qLen
 	}
 	return b.String()
@@ -137,9 +138,9 @@ func highlightSearch(line, query string) string {
 func (m model) renderContent() string {
 	result := make([]string, len(m.lines))
 	for i, line := range m.lines {
-		rendered := highlightSearch(line, m.searchQuery)
+		rendered := m.highlightSearch(line, m.searchQuery)
 		if i == m.cursor {
-			rendered = cursorStyle.Render(rendered)
+			rendered = m.cursorStyle.Render(rendered)
 		}
 		result[i] = rendered
 	}
@@ -159,6 +160,12 @@ type model struct { //nolint:recvcheck // value receivers for tea.Model interfac
 	searchQuery string
 	matchLines  []int // indices into lines
 	matchIdx    int
+
+	// Styles, minted from a writer-scoped renderer in Run.
+	searchHighlightStyle lipgloss.Style
+	cursorStyle          lipgloss.Style
+	footerStyle          lipgloss.Style
+	searchStyle          lipgloss.Style
 }
 
 func (m model) dataRowCount() int {
@@ -324,8 +331,8 @@ func (m model) View() string {
 
 func (m model) renderFooter() string {
 	if m.searching {
-		prompt := searchStyle.Render("/ " + m.searchInput + "█")
-		return footerStyle.Render(fmt.Sprintf("%d rows", m.dataRowCount())) + "\n" + prompt
+		prompt := m.searchStyle.Render("/ " + m.searchInput + "█")
+		return m.footerStyle.Render(fmt.Sprintf("%d rows", m.dataRowCount())) + "\n" + prompt
 	}
 
 	parts := []string{fmt.Sprintf("%d rows", m.dataRowCount())}
@@ -342,5 +349,5 @@ func (m model) renderFooter() string {
 	pct := int(m.viewport.ScrollPercent() * 100)
 	parts = append(parts, fmt.Sprintf("%d%%", pct))
 
-	return footerStyle.Render(strings.Join(parts, " | "))
+	return m.footerStyle.Render(strings.Join(parts, " | "))
 }
diff --git a/libs/tableview/tableview_test.go b/libs/tableview/tableview_test.go
index d1fd2b964c2..7d542a365b9 100644
--- a/libs/tableview/tableview_test.go
+++ b/libs/tableview/tableview_test.go
@@ -58,18 +58,18 @@ func TestFindMatchesEmptyQuery(t *testing.T) {
 }
 
 func TestHighlightSearchEmptyQuery(t *testing.T) {
-	result := highlightSearch("hello alice", "")
+	result := model{}.highlightSearch("hello alice", "")
 	assert.Equal(t, "hello alice", result)
 }
 
 func TestHighlightSearchWithMatch(t *testing.T) {
-	result := highlightSearch("hello alice", "alice")
+	result := model{}.highlightSearch("hello alice", "alice")
 	assert.Contains(t, result, "alice")
 	assert.Contains(t, result, "hello")
 }
 
 func TestHighlightSearchNoMatch(t *testing.T) {
-	result := highlightSearch("hello bob", "alice")
+	result := model{}.highlightSearch("hello bob", "alice")
 	assert.Equal(t, "hello bob", result)
 }
 
diff --git a/libs/tarpack/tarpack.go b/libs/tarpack/tarpack.go
new file mode 100644
index 00000000000..963988c0858
--- /dev/null
+++ b/libs/tarpack/tarpack.go
@@ -0,0 +1,79 @@
+// Package tarpack writes files from the local filesystem into a tar archive in
+// Go, as a replacement for shelling out to the `tar` command. The caller
+// supplies the destination io.Writer, so compression stays its choice: wrap the
+// writer in compress/gzip or klauspost/pgzip (or nothing) — tarpack only emits
+// the tar stream.
+package tarpack
+
+import (
+	"archive/tar"
+	"fmt"
+	"io"
+	"io/fs"
+	"os"
+)
+
+// Entry is one file to add to the archive.
+type Entry struct {
+	// Name is the slash-separated name the entry is given in the archive.
+	Name string
+	// Path is the local filesystem path the content is read from.
+	Path string
+}
+
+// Write writes entries to w as a tar stream and finalizes it (writes the tar
+// footer). It does not close w, so the caller can close a wrapping gzip writer
+// afterward. Regular files are copied and symlinks are stored as symlink
+// entries; any other file type (e.g. a directory) is skipped, since directories
+// are implied by entry names. Each entry's mode and mtime are preserved, which
+// matches what `tar` stored for the same file.
+func Write(w io.Writer, entries []Entry) error {
+	tw := tar.NewWriter(w)
+	for _, e := range entries {
+		if err := writeEntry(tw, e); err != nil {
+			return err
+		}
+	}
+	return tw.Close()
+}
+
+func writeEntry(tw *tar.Writer, e Entry) error {
+	// Lstat, not Stat, so a symlink is archived as a link rather than followed.
+	info, err := os.Lstat(e.Path)
+	if err != nil {
+		return fmt.Errorf("stat %s: %w", e.Path, err)
+	}
+	mode := info.Mode()
+	if !mode.IsRegular() && mode&fs.ModeSymlink == 0 {
+		return nil
+	}
+
+	var link string
+	if mode&fs.ModeSymlink != 0 {
+		link, err = os.Readlink(e.Path)
+		if err != nil {
+			return fmt.Errorf("readlink %s: %w", e.Path, err)
+		}
+	}
+	hdr, err := tar.FileInfoHeader(info, link)
+	if err != nil {
+		return fmt.Errorf("tar header for %s: %w", e.Name, err)
+	}
+	hdr.Name = e.Name
+	if err := tw.WriteHeader(hdr); err != nil {
+		return fmt.Errorf("write header for %s: %w", e.Name, err)
+	}
+	if !mode.IsRegular() {
+		return nil
+	}
+
+	f, err := os.Open(e.Path)
+	if err != nil {
+		return fmt.Errorf("open %s: %w", e.Path, err)
+	}
+	defer f.Close()
+	if _, err := io.Copy(tw, f); err != nil {
+		return fmt.Errorf("write %s: %w", e.Name, err)
+	}
+	return nil
+}
diff --git a/libs/tarpack/tarpack_test.go b/libs/tarpack/tarpack_test.go
new file mode 100644
index 00000000000..3841e779ac0
--- /dev/null
+++ b/libs/tarpack/tarpack_test.go
@@ -0,0 +1,110 @@
+package tarpack
+
+import (
+	"archive/tar"
+	"bytes"
+	"errors"
+	"io"
+	"os"
+	"path/filepath"
+	"runtime"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type readEntry struct {
+	typeflag byte
+	mode     int64
+	linkname string
+	content  string
+}
+
+func readTar(t *testing.T, b []byte) map[string]readEntry {
+	t.Helper()
+	tr := tar.NewReader(bytes.NewReader(b))
+	out := map[string]readEntry{}
+	for {
+		hdr, err := tr.Next()
+		if errors.Is(err, io.EOF) {
+			break
+		}
+		require.NoError(t, err)
+		data, err := io.ReadAll(tr)
+		require.NoError(t, err)
+		out[hdr.Name] = readEntry{
+			typeflag: hdr.Typeflag,
+			mode:     hdr.Mode,
+			linkname: hdr.Linkname,
+			content:  string(data),
+		}
+	}
+	return out
+}
+
+func TestWriteRegularFiles(t *testing.T) {
+	dir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "a.txt"), []byte("alpha"), 0o644))
+	require.NoError(t, os.MkdirAll(filepath.Join(dir, "sub"), 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "sub", "b.txt"), []byte("beta"), 0o644))
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "run.sh"), []byte("#!/bin/sh\n"), 0o644))
+	// Chmod explicitly (not via the WriteFile mode arg) so the umask can't strip
+	// the bits we assert on below.
+	require.NoError(t, os.Chmod(filepath.Join(dir, "a.txt"), 0o644))
+	require.NoError(t, os.Chmod(filepath.Join(dir, "run.sh"), 0o755))
+
+	var buf bytes.Buffer
+	err := Write(&buf, []Entry{
+		{Name: "pkg/a.txt", Path: filepath.Join(dir, "a.txt")},
+		{Name: "pkg/sub/b.txt", Path: filepath.Join(dir, "sub", "b.txt")},
+		{Name: "pkg/run.sh", Path: filepath.Join(dir, "run.sh")},
+	})
+	require.NoError(t, err)
+
+	got := readTar(t, buf.Bytes())
+	require.Len(t, got, 3)
+	assert.Equal(t, "alpha", got["pkg/a.txt"].content)
+	assert.Equal(t, byte(tar.TypeReg), got["pkg/a.txt"].typeflag)
+	assert.Equal(t, "beta", got["pkg/sub/b.txt"].content)
+	// The owner execute bit is preserved (Windows has no execute bit).
+	if runtime.GOOS != "windows" {
+		assert.Equal(t, int64(0o755), got["pkg/run.sh"].mode&0o777)
+		assert.Equal(t, int64(0o644), got["pkg/a.txt"].mode&0o777)
+	}
+}
+
+func TestWriteSymlink(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("symlink creation needs privilege on Windows")
+	}
+	dir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "a.txt"), []byte("alpha"), 0o644))
+	require.NoError(t, os.Symlink("a.txt", filepath.Join(dir, "link")))
+
+	var buf bytes.Buffer
+	err := Write(&buf, []Entry{
+		{Name: "pkg/link", Path: filepath.Join(dir, "link")},
+	})
+	require.NoError(t, err)
+
+	got := readTar(t, buf.Bytes())
+	require.Len(t, got, 1)
+	// Stored as a symlink entry, not the dereferenced content.
+	assert.Equal(t, byte(tar.TypeSymlink), got["pkg/link"].typeflag)
+	assert.Equal(t, "a.txt", got["pkg/link"].linkname)
+	assert.Empty(t, got["pkg/link"].content)
+}
+
+func TestWriteSkipsIrregularAndMissingIsError(t *testing.T) {
+	dir := t.TempDir()
+
+	// A directory entry is skipped (directories are implied by entry names).
+	var buf bytes.Buffer
+	require.NoError(t, Write(&buf, []Entry{{Name: "pkg/sub", Path: dir}}))
+	assert.Empty(t, readTar(t, buf.Bytes()))
+
+	// A missing path is a hard error, not silently dropped.
+	err := Write(io.Discard, []Entry{{Name: "pkg/gone", Path: filepath.Join(dir, "gone")}})
+	assert.Error(t, err)
+}
diff --git a/libs/telemetry/context.go b/libs/telemetry/context.go
index e556e462cdf..f0eb6ad60e8 100644
--- a/libs/telemetry/context.go
+++ b/libs/telemetry/context.go
@@ -23,3 +23,11 @@ func fromContext(ctx context.Context) *logger {
 
 	return v.(*logger)
 }
+
+// loggerFromContext returns the telemetry logger, or false if none was
+// installed. Unlike fromContext it does not panic, so callers on paths that may
+// run without telemetry setup can drop events instead of crashing.
+func loggerFromContext(ctx context.Context) (*logger, bool) {
+	v, ok := ctx.Value(telemetryLoggerKey).(*logger)
+	return v, ok
+}
diff --git a/libs/telemetry/logger.go b/libs/telemetry/logger.go
index d56e087322e..509fdf65664 100644
--- a/libs/telemetry/logger.go
+++ b/libs/telemetry/logger.go
@@ -8,14 +8,15 @@ import (
 	"net/http"
 	"strconv"
 	"time"
+	"uuid"
 
+	"github.com/databricks/cli/libs/auth"
 	"github.com/databricks/cli/libs/cmdctx"
 	"github.com/databricks/cli/libs/env"
 	"github.com/databricks/cli/libs/log"
 	"github.com/databricks/cli/libs/telemetry/protos"
 	"github.com/databricks/databricks-sdk-go/apierr"
 	"github.com/databricks/databricks-sdk-go/client"
-	"github.com/google/uuid"
 )
 
 const (
@@ -28,11 +29,37 @@ const (
 )
 
 func Log(ctx context.Context, event protos.DatabricksCliLog) {
-	fromContext(ctx).log(event)
+	// A missing logger means telemetry was never initialized on this context
+	// (e.g. a command invoked outside the normal cmd/root setup). Dropping the
+	// event is the right call: telemetry is best-effort and must never crash a
+	// command.
+	l, ok := loggerFromContext(ctx)
+	if !ok {
+		log.Debugf(ctx, "telemetry logger not found in the context; dropping event")
+		return
+	}
+	l.log(event)
 }
 
 type logger struct {
-	logs []protos.FrontendLog
+	logs             []protos.FrontendLog
+	stateLineageHash string
+}
+
+// SetStateLineageHash records the hashed lineage of the bundle state the command read, so that
+// the command's execution context can report it. Like Log, it is a no-op without a logger.
+func SetStateLineageHash(ctx context.Context, hash string) {
+	if l, ok := loggerFromContext(ctx); ok {
+		l.stateLineageHash = hash
+	}
+}
+
+// StateLineageHash returns the value recorded by SetStateLineageHash, or "" if none was.
+func StateLineageHash(ctx context.Context) string {
+	if l, ok := loggerFromContext(ctx); ok {
+		return l.stateLineageHash
+	}
+	return ""
 }
 
 func (l *logger) log(event protos.DatabricksCliLog) {
@@ -71,7 +98,7 @@ func Upload(ctx context.Context, ec protos.ExecutionContext) error {
 	for i, log := range l.logs {
 		b, err := json.Marshal(log)
 		if err != nil {
-			return fmt.Errorf("failed to marshal log: %s", err)
+			return fmt.Errorf("failed to marshal log: %w", err)
 		}
 		protoLogs[i] = string(b)
 	}
@@ -153,8 +180,7 @@ func Upload(ctx context.Context, ec protos.ExecutionContext) error {
 		//
 		// The UI infra team (who owns the /telemetry-ext API) recommends retrying for
 		// all 5xx responses.
-		var apiErr *apierr.APIError
-		if errors.As(err, &apiErr) && apiErr.StatusCode >= 500 {
+		if apiErr, ok := errors.AsType[*apierr.APIError](err); ok && apiErr.StatusCode >= 500 {
 			log.Infof(ctx, "Attempt %d failed due to a server side error. Retrying status code: %d", i+1, apiErr.StatusCode)
 
 			remainingTime := time.Until(deadline)
@@ -171,23 +197,11 @@ func Upload(ctx context.Context, ec protos.ExecutionContext) error {
 	return errors.New("failed to upload telemetry logs after three attempts")
 }
 
-// orgIDHeaders returns headers with X-Databricks-Org-Id set if a workspace ID
-// is configured. SPOG hosts require this header to route requests to the
-// correct workspace; without it, telemetry is recorded in a central shard
-// instead of the correct workspace.
-func orgIDHeaders(apiClient *client.DatabricksClient) map[string]string {
-	wsID := apiClient.Config.WorkspaceID
-	if wsID == "" {
-		return nil
-	}
-	return map[string]string{
-		"X-Databricks-Org-Id": wsID,
-	}
-}
-
 func attempt(ctx context.Context, apiClient *client.DatabricksClient, protoLogs []string) (*ResponseBody, error) {
+	// Without the workspace routing header, telemetry on unified hosts is
+	// recorded in a central shard instead of the user's workspace.
 	resp := &ResponseBody{}
-	err := apiClient.Do(ctx, http.MethodPost, "/telemetry-ext", orgIDHeaders(apiClient), nil, RequestBody{
+	err := apiClient.Do(ctx, http.MethodPost, "/telemetry-ext", auth.WorkspaceIDHeaders(apiClient.Config), nil, RequestBody{
 		UploadTime: time.Now().UnixMilli(),
 		// There is a bug in the `/telemetry-ext` API which requires us to
 		// send an empty array for the `Items` field. Otherwise the API returns
diff --git a/libs/telemetry/logger_test.go b/libs/telemetry/logger_test.go
index 59633403b3d..abb7c198073 100644
--- a/libs/telemetry/logger_test.go
+++ b/libs/telemetry/logger_test.go
@@ -152,3 +152,27 @@ func TestTelemetryUploadMaxRetries(t *testing.T) {
 	assert.EqualError(t, err, "failed to upload telemetry logs after three attempts")
 	assert.Equal(t, 3, count)
 }
+
+func TestLogWithoutLoggerDropsEvent(t *testing.T) {
+	// A context without a telemetry logger must not panic; the event is dropped.
+	assert.NotPanics(t, func() {
+		Log(t.Context(), protos.DatabricksCliLog{
+			CliTestEvent: &protos.CliTestEvent{
+				Name: protos.DummyCliEnumValue1,
+			},
+		})
+	})
+}
+
+func TestStateLineageHash(t *testing.T) {
+	ctx := WithNewLogger(t.Context())
+	assert.Empty(t, StateLineageHash(ctx))
+
+	SetStateLineageHash(ctx, "G0ZNUjK18Pa")
+	assert.Equal(t, "G0ZNUjK18Pa", StateLineageHash(ctx))
+}
+
+func TestStateLineageHashWithoutLogger(t *testing.T) {
+	SetStateLineageHash(t.Context(), "G0ZNUjK18Pa")
+	assert.Empty(t, StateLineageHash(t.Context()))
+}
diff --git a/libs/telemetry/protos/README.md b/libs/telemetry/protos/README.md
index 7dcc75e17cd..67964fc89d2 100644
--- a/libs/telemetry/protos/README.md
+++ b/libs/telemetry/protos/README.md
@@ -1,2 +1,7 @@
 The types in this package are equivalent to the lumberjack protos defined in Universe.
 You can find all lumberjack protos for the Databricks CLI in the `proto/logs/frontend/databricks_cli` directory.
+
+`databricks air run` logs one `air_run_event` per submission: requested compute,
+which config options were set, the outcome and latency, and how long packaging and
+uploading the code snapshot took. It never includes code, paths, names, parameters,
+or image references. Set `DATABRICKS_CLI_DISABLE_TELEMETRY=1` to opt out.
diff --git a/libs/telemetry/protos/air_run.go b/libs/telemetry/protos/air_run.go
new file mode 100644
index 00000000000..b8f5d02a0fe
--- /dev/null
+++ b/libs/telemetry/protos/air_run.go
@@ -0,0 +1,37 @@
+package protos
+
+type AirPackagingMode string
+
+const (
+	AirPackagingModeGitArchive AirPackagingMode = "GIT_ARCHIVE"
+	AirPackagingModePlainTar   AirPackagingMode = "PLAIN_TAR"
+)
+
+// AirRunEvent describes an AIR submission, matching the workload measurements
+// collected by the Python AIR CLI. It contains no user-authored names or paths.
+type AirRunEvent struct {
+	// Canonical API accelerator type name, e.g. GPU_1xH100.
+	GPUType               string `json:"gpu_type,omitempty"`
+	NumGPUs               int    `json:"num_gpus"`
+	NumNodes              int    `json:"num_nodes"`
+	HasDockerImage        bool   `json:"has_docker_image"`
+	HasCodeSnapshot       bool   `json:"has_code_snapshot"`
+	HasRequirements       bool   `json:"has_requirements"`
+	HasParameters         bool   `json:"has_parameters"`
+	MaxRetries            int    `json:"max_retries"`
+	HasTimeout            bool   `json:"has_timeout"`
+	SubmittedSuccessfully bool   `json:"submitted_successfully"`
+	SubmitLatencyMs       int64  `json:"submit_latency_ms"`
+	JobRunID              string `json:"job_run_id,omitempty"`
+	CodeSourceUsesGit     *bool  `json:"code_source_uses_git,omitempty"`
+
+	// Compressed tarball bytes for a new upload. Absent on cache hits and
+	// when no archive was measured; a measured zero remains explicit.
+	CodeSourceSizeBytes *int64 `json:"code_source_size_bytes,omitempty"`
+
+	CodeSourcePackagingMode AirPackagingMode `json:"code_source_packaging_mode,omitempty"`
+	// Wall-clock milliseconds for archive creation and the tarball write,
+	// respectively. Zero on cache hits; absent if the phase was never attempted.
+	CodeSourcePackagingDurationMs *int64 `json:"code_source_packaging_duration_ms,omitempty"`
+	CodeSourceUploadDurationMs    *int64 `json:"code_source_upload_duration_ms,omitempty"`
+}
diff --git a/libs/telemetry/protos/aitools_install.go b/libs/telemetry/protos/aitools_install.go
new file mode 100644
index 00000000000..a90cc22d4df
--- /dev/null
+++ b/libs/telemetry/protos/aitools_install.go
@@ -0,0 +1,79 @@
+package protos
+
+// AitoolsAgentType mirrors AitoolsAgentType.Type in the databricks_cli
+// lumberjack proto. AitoolsAgentTypeUnspecified absorbs agents a newer CLI
+// knows about but the server proto does not yet.
+type AitoolsAgentType string
+
+const (
+	AitoolsAgentTypeUnspecified AitoolsAgentType = "TYPE_UNSPECIFIED"
+	AitoolsAgentTypeClaudeCode  AitoolsAgentType = "CLAUDE_CODE"
+	AitoolsAgentTypeCursor      AitoolsAgentType = "CURSOR"
+	AitoolsAgentTypeCodex       AitoolsAgentType = "CODEX"
+	AitoolsAgentTypeOpenCode    AitoolsAgentType = "OPENCODE"
+	AitoolsAgentTypeCopilot     AitoolsAgentType = "COPILOT"
+	AitoolsAgentTypeAntigravity AitoolsAgentType = "ANTIGRAVITY"
+	AitoolsAgentTypePi          AitoolsAgentType = "PI"
+	AitoolsAgentTypeGemini      AitoolsAgentType = "GEMINI_CLI"
+	AitoolsAgentTypeGoose       AitoolsAgentType = "GOOSE"
+	AitoolsAgentTypeKiro        AitoolsAgentType = "KIRO"
+)
+
+// AitoolsInstallScope mirrors AitoolsInstallScope.Type in the databricks_cli
+// lumberjack proto.
+type AitoolsInstallScope string
+
+const (
+	AitoolsInstallScopeUnspecified AitoolsInstallScope = "TYPE_UNSPECIFIED"
+	AitoolsInstallScopeGlobal      AitoolsInstallScope = "GLOBAL"
+	AitoolsInstallScopeProject     AitoolsInstallScope = "PROJECT"
+)
+
+// AitoolsErrorCategory classifies why an `aitools install` run, or one agent
+// within it, failed. It mirrors AitoolsErrorCategory.Type in the databricks_cli
+// lumberjack proto and lets us aggregate install failures without sending any
+// user-authored error text. AitoolsErrorCategoryUncategorized absorbs failures
+// a newer CLI has not classified yet.
+type AitoolsErrorCategory string
+
+const (
+	AitoolsErrorCategoryUnspecified         AitoolsErrorCategory = "TYPE_UNSPECIFIED"
+	AitoolsErrorCategoryVersionIncompatible AitoolsErrorCategory = "VERSION_INCOMPATIBLE"
+	AitoolsErrorCategorySkillNotFound       AitoolsErrorCategory = "SKILL_NOT_FOUND"
+	AitoolsErrorCategoryCLINotOnPath        AitoolsErrorCategory = "CLI_NOT_ON_PATH"
+	AitoolsErrorCategoryPluginInstallFailed AitoolsErrorCategory = "PLUGIN_INSTALL_FAILED"
+	AitoolsErrorCategoryUnsupportedScope    AitoolsErrorCategory = "UNSUPPORTED_SCOPE"
+	AitoolsErrorCategoryExperimentalSkill   AitoolsErrorCategory = "EXPERIMENTAL_SKILL"
+	AitoolsErrorCategoryUncategorized       AitoolsErrorCategory = "UNCATEGORIZED"
+)
+
+// AitoolsAgentResult records one agent's failed or skipped outcome within an
+// install run. Successful agents produce no entry, and Category never carries
+// user-authored text.
+type AitoolsAgentResult struct {
+	Agent         AitoolsAgentType     `json:"agent"`
+	ErrorCategory AitoolsErrorCategory `json:"error_category"`
+}
+
+// AitoolsInstallEvent is emitted on every execution of the `databricks aitools
+// install` command.
+type AitoolsInstallEvent struct {
+	// Agents the user targeted, deduplicated and sorted for stable output.
+	Agents []AitoolsAgentType `json:"agents,omitempty"`
+
+	// Scope the skills were installed into.
+	Scope AitoolsInstallScope `json:"scope,omitempty"`
+
+	// Whether the user passed --experimental to include experimental skills.
+	Experimental bool `json:"experimental,omitempty"`
+
+	// ErrorCategory is the top-level command outcome: the category of the error
+	// that failed the run, or Unspecified when the command succeeded. It captures
+	// failures that have no per-agent entry (e.g. a skills-group install failure).
+	// Always populated (Unspecified on success), so no omitempty.
+	ErrorCategory AitoolsErrorCategory `json:"error_category"`
+
+	// AgentResults records the per-agent failure/skip categories, one entry per
+	// non-successful agent. Empty when every targeted agent succeeded.
+	AgentResults []AitoolsAgentResult `json:"agent_results,omitempty"`
+}
diff --git a/libs/telemetry/protos/aitools_install_test.go b/libs/telemetry/protos/aitools_install_test.go
new file mode 100644
index 00000000000..19742ccb4c3
--- /dev/null
+++ b/libs/telemetry/protos/aitools_install_test.go
@@ -0,0 +1,37 @@
+package protos
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// The lumberjack proto keys these fields as snake_case error_category, both on
+// the event and on each agent_results entry. A hand-edit to a camelCase tag
+// marshals under the wrong key and is dropped silently on ingestion, so this
+// pins the wire payload for an event with one per-agent result.
+func TestAitoolsInstallEventEncodesErrorCategoryKeys(t *testing.T) {
+	b, err := json.Marshal(AitoolsInstallEvent{
+		Agents:        []AitoolsAgentType{AitoolsAgentTypeCodex},
+		Scope:         AitoolsInstallScopeGlobal,
+		ErrorCategory: AitoolsErrorCategoryPluginInstallFailed,
+		AgentResults: []AitoolsAgentResult{
+			{Agent: AitoolsAgentTypeCodex, ErrorCategory: AitoolsErrorCategoryPluginInstallFailed},
+		},
+	})
+	require.NoError(t, err)
+
+	var got map[string]any
+	require.NoError(t, json.Unmarshal(b, &got))
+
+	assert.Equal(t, "PLUGIN_INSTALL_FAILED", got["error_category"])
+
+	results, ok := got["agent_results"].([]any)
+	require.True(t, ok, "agent_results must be present")
+	require.Len(t, results, 1)
+	entry := results[0].(map[string]any)
+	assert.Equal(t, "CODEX", entry["agent"])
+	assert.Equal(t, "PLUGIN_INSTALL_FAILED", entry["error_category"])
+}
diff --git a/libs/telemetry/protos/bundle_config_remote_sync.go b/libs/telemetry/protos/bundle_config_remote_sync.go
new file mode 100644
index 00000000000..678198514bc
--- /dev/null
+++ b/libs/telemetry/protos/bundle_config_remote_sync.go
@@ -0,0 +1,142 @@
+package protos
+
+type BundleConfigRemoteSyncErrorCategory string
+
+const (
+	BundleConfigRemoteSyncErrorCategoryUnspecified         BundleConfigRemoteSyncErrorCategory = "TYPE_UNSPECIFIED"
+	BundleConfigRemoteSyncErrorCategoryBundleLoadFailed    BundleConfigRemoteSyncErrorCategory = "BUNDLE_LOAD_FAILED"
+	BundleConfigRemoteSyncErrorCategoryStateNotFound       BundleConfigRemoteSyncErrorCategory = "STATE_NOT_FOUND"
+	BundleConfigRemoteSyncErrorCategoryDetectChangesFailed BundleConfigRemoteSyncErrorCategory = "DETECT_CHANGES_FAILED"
+	BundleConfigRemoteSyncErrorCategoryResolveFailed       BundleConfigRemoteSyncErrorCategory = "RESOLVE_FAILED"
+	BundleConfigRemoteSyncErrorCategoryYamlApplyFailed     BundleConfigRemoteSyncErrorCategory = "YAML_APPLY_FAILED"
+	BundleConfigRemoteSyncErrorCategorySaveFailed          BundleConfigRemoteSyncErrorCategory = "SAVE_FAILED"
+	BundleConfigRemoteSyncErrorCategoryOutputFailed        BundleConfigRemoteSyncErrorCategory = "OUTPUT_FAILED"
+	BundleConfigRemoteSyncErrorCategoryResourceNotInConfig BundleConfigRemoteSyncErrorCategory = "RESOURCE_NOT_IN_CONFIG"
+)
+
+// BundleConfigRemoteSyncEvent is emitted on every execution of the
+// `databricks bundle config-remote-sync` command.
+//
+// All fields are aggregate counts, booleans, or system-defined categories.
+// No resource names, keys, field paths, file paths, or configuration values
+// are logged outside ErrorMessage.
+type BundleConfigRemoteSyncEvent struct {
+	// Whether the command was invoked with --save (config files written to
+	// disk) as opposed to diff-only mode.
+	Save bool `json:"save,omitempty"`
+
+	// Deployment engine the state was read from: "direct" or "terraform".
+	Engine string `json:"engine,omitempty"`
+
+	// Total number of field-level changes detected between the deployed state
+	// and the current remote state, across all resources.
+	ChangesTotal int64 `json:"changes_total,omitempty"`
+
+	// Number of detected changes by operation type.
+	AddCount     int64 `json:"add_count,omitempty"`
+	ReplaceCount int64 `json:"replace_count,omitempty"`
+	RemoveCount  int64 `json:"remove_count,omitempty"`
+
+	// Number of detected changes on fields the resource lifecycle metadata
+	// marks recreate_on_changes (immutable): syncing these into config means the
+	// next deploy will delete+recreate the resource (a data-loss risk).
+	RecreateForcingChanges int64 `json:"recreate_forcing_changes,omitempty"`
+
+	// Number of detected changes that overwrite a not-yet-deployed local config
+	// edit (the local value differs from the last-deployed state). Direct engine
+	// only; the terraform sync snapshot has no per-field base to compare against.
+	OverwrittenLocalEdits int64 `json:"overwritten_local_edits,omitempty"`
+
+	// One entry per resource type that has at least one detected change.
+	ResourceChanges []BundleConfigRemoteSyncResourceChanges `json:"resource_changes,omitempty"`
+
+	// Number of configuration files that would be modified by the detected
+	// changes, and the number actually written to disk (--save only).
+	FilesChangedCount int64 `json:"files_changed_count,omitempty"`
+	FilesWrittenCount int64 `json:"files_written_count,omitempty"`
+
+	// Number of detected changes that were not written back because they could
+	// not be attributed to a single source location (e.g. a sequence element
+	// defined in both a top-level block and a target override). These are
+	// counted in ChangesTotal: a nonzero value means the command reported
+	// changes it did not apply. Distinct from the "skip" operation filtered out
+	// during change detection, which never reaches ChangesTotal.
+	SkippedChangesCount int64 `json:"skipped_changes_count,omitempty"`
+
+	// Variable-reference restoration counts for the two mechanisms that can
+	// write a current-target-scoped reference into a shared file (the source of
+	// the cross-target "reference does not exist" failures).
+	RefsRetargeted   int64 `json:"refs_retargeted,omitempty"`
+	RefsFromSiblings int64 `json:"refs_from_siblings,omitempty"`
+
+	// Identity of the resource state this run read, so a selector that matched
+	// nothing can be attributed: a stale local cache, a different target's or
+	// bundle's state, and no state at all are otherwise indistinguishable.
+	//
+	// StateSerial is the state file's own monotonic counter.
+	StateSerial int64 `json:"state_serial,omitempty"`
+
+	// StateLineage is the state's lineage identifier. It cannot contain PII: it
+	// is an opaque random UUID minted by dstate.GetOrInitLineage and is never
+	// derived from a user, workspace, path, or resource name.
+	StateLineage string `json:"state_lineage,omitempty"`
+
+	// StateSource is "local" or "remote" — a closed, system-defined set of
+	// exactly two values assigned in CollectStateStats, never user input, so it
+	// cannot contain PII.
+	StateSource string `json:"state_source,omitempty"`
+
+	// No state paths and no target names are recorded: the target is
+	// user-authored configuration, and BundleDeployEvent likewise records only
+	// the target count.
+
+	// How many of the four candidate state files (direct/terraform x
+	// local/remote) were found. A pointer so that zero — the run proceeded
+	// against a synthesized empty state — is emitted rather than dropped by
+	// omitempty. Not derivable from StateResourceIDs: a state file holding no
+	// resources and no state file at all both yield an empty id set.
+	StatesAvailableCount *int64 `json:"states_available_count,omitempty"`
+
+	// IDs of the resources found in the deployment state this run read, and the
+	// IDs the run was asked to sync via --select-ids. Comparing the two is what
+	// classifies a selector miss; the counts are intentionally not sent
+	// separately since they are len() of these lists, and the matched set is
+	// their intersection.
+	StateResourceIDs    *BundleConfigRemoteSyncResourceIds `json:"state_resource_ids,omitempty"`
+	SelectedResourceIDs *BundleConfigRemoteSyncResourceIds `json:"selected_resource_ids,omitempty"`
+
+	// Scrubbed, truncated summary of the failure when the command exits with an
+	// error. Privileged free-text (DATA_LABEL_USER_COMMANDS_RESPONSE, LPP-5543);
+	// stays in-region and is stripped from centralized logfood. Unset on success.
+	ErrorMessage string `json:"error_message,omitempty"`
+
+	// Category of the failure when the command exits with an error.
+	// Unset on success.
+	ErrorCategory BundleConfigRemoteSyncErrorCategory `json:"error_category,omitempty"`
+}
+
+// BundleConfigRemoteSyncResourceIds holds resource IDs grouped by type. The
+// same shape is used for the state's IDs and for the selected IDs so the two
+// can be compared directly.
+//
+// IDs of resources managed by the bundle. Some resources like volumes or schemas
+// do not expose a numerical or UUID identifier and are tracked by name. Those
+// resources are not tracked here since the names are PII.
+type BundleConfigRemoteSyncResourceIds struct {
+	ResourceJobIDs       []string `json:"resource_job_ids,omitempty"`
+	ResourcePipelineIDs  []string `json:"resource_pipeline_ids,omitempty"`
+	ResourceClusterIDs   []string `json:"resource_cluster_ids,omitempty"`
+	ResourceDashboardIDs []string `json:"resource_dashboard_ids,omitempty"`
+}
+
+// BundleConfigRemoteSyncResourceChanges holds field-level change counts for a
+// single resource type within one config-remote-sync run.
+type BundleConfigRemoteSyncResourceChanges struct {
+	// Resource type name, e.g. "jobs", "pipelines", "dashboards".
+	ResourceType string `json:"resource_type,omitempty"`
+
+	ChangesCount int64 `json:"changes_count,omitempty"`
+	AddCount     int64 `json:"add_count,omitempty"`
+	ReplaceCount int64 `json:"replace_count,omitempty"`
+	RemoveCount  int64 `json:"remove_count,omitempty"`
+}
diff --git a/libs/telemetry/protos/bundle_deploy.go b/libs/telemetry/protos/bundle_deploy.go
index d9439437d9b..ed5a79690a3 100644
--- a/libs/telemetry/protos/bundle_deploy.go
+++ b/libs/telemetry/protos/bundle_deploy.go
@@ -10,6 +10,9 @@ type BundleDeployEvent struct {
 	// Error message encountered during the bundle deploy command, if any.
 	ErrorMessage string `json:"error_message,omitempty"`
 
+	// Deprecated: superseded by ResourcesMetadata.Resources[*].Count, which covers
+	// every resource type rather than this hand-maintained subset. Both are
+	// populated during the transition; do not add fields here for new types.
 	ResourceCount                     int64 `json:"resource_count"`
 	ResourceJobCount                  int64 `json:"resource_job_count"`
 	ResourcePipelineCount             int64 `json:"resource_pipeline_count"`
@@ -32,6 +35,9 @@ type BundleDeployEvent struct {
 	ResourceClusterIDs   []string `json:"resource_cluster_ids,omitempty"`
 	ResourceDashboardIDs []string `json:"resource_dashboard_ids,omitempty"`
 
+	// Per-resource-type metadata (counts and state-size statistics).
+	ResourcesMetadata *BundleResourcesMetadata `json:"resources_metadata,omitempty"`
+
 	Experimental *BundleDeployExperimental `json:"experimental,omitempty"`
 }
 
@@ -42,9 +48,6 @@ type BundleDeployExperimental struct {
 	// Number of configuration files in the bundle.
 	ConfigurationFileCount int64 `json:"configuration_file_count"`
 
-	// Size in bytes of the Terraform state file
-	TerraformStateSizeBytes int64 `json:"terraform_state_size_bytes,omitempty"`
-
 	// Number of variables in the bundle
 	VariableCount        int64 `json:"variable_count"`
 	ComplexVariableCount int64 `json:"complex_variable_count"`
@@ -84,10 +87,69 @@ type BundleDeployExperimental struct {
 	// Number of resource mutators declared at 'python/mutators' in databricks.yml
 	PythonResourceMutatorsCount int64 `json:"python_resource_mutators_count,omitempty"`
 
+	// Number of files in the synced source tree considered for upload: the full
+	// set, not the incremental delta actually transferred (an incremental deploy
+	// reports the full count even when nothing changed). The set is whatever the
+	// bundle's sync settings select (sync paths/include/exclude); artifacts
+	// (wheels/jars) upload via a separate path and are not counted.
+	UploadFileCount int64 `json:"upload_file_count"`
+
+	// Histogram of the sizes (in bytes) of the files uploaded to the workspace.
+	// Fixed-length and positional: entry i counts files whose size falls in
+	// [bound[i-1], bound[i]); the last entry counts files at least as large as
+	// the last bound. A histogram is sent instead of one entry per file to keep
+	// the event small for bundles with many files.
+	//
+	// Bucket upper bounds (exclusive), a power-of-2 ladder kept in sync with
+	// uploadFileSizeBucketBounds in bundle/phases/telemetry.go. Treat as frozen:
+	// changing them changes the meaning of every entry.
+	//   256 B, 512 B, 1 KiB, 2 KiB, 4 KiB, 8 KiB, 16 KiB, 32 KiB, 64 KiB, 128 KiB,
+	//   256 KiB, 512 KiB, 1 MiB, 2 MiB, 4 MiB, 8 MiB, 16 MiB, 32 MiB, 64 MiB
+	//   (the 20th bucket is >= 64 MiB)
+	UploadFileSizes []int64 `json:"upload_file_sizes,omitempty"`
+
 	// Local cache measurements in milliseconds (compute duration, potential savings, etc.)
 	LocalCacheMeasurementsMs []IntMapEntry `json:"local_cache_measurements_ms,omitempty"`
 }
 
+// BundleResourcesMetadata mirrors the universe proto. Per-resource-type counts
+// and state-size metadata for one bundle deployment.
+//
+// Counts cover all resources. Sizes are only reported for the direct engine: the direct engine stores each
+// resource's state as a JSON blob in resources.json, so a size is len(state) and
+// nothing is serialized at telemetry time. Entries from the removed Terraform engine (older CLI versions) carry counts only.
+type BundleResourcesMetadata struct {
+	// Engine that ran the deploy: "direct" or "terraform".
+	StateEngine string `json:"state_engine,omitempty"`
+
+	// Size in bytes of the direct engine's resources.json on disk.
+	StateFileSizeBytes int64 `json:"state_file_size_bytes,omitempty"`
+
+	// One entry per resource type declared in the configuration, plus types that
+	// exist only in state: sub-resources such as "jobs.permissions", and types
+	// being removed from the bundle.
+	Resources []ResourceMetadata `json:"resources,omitempty"`
+}
+
+// ResourceMetadata holds metadata about resources of a single type within one
+// bundle deployment.
+type ResourceMetadata struct {
+	// Resource type name: "jobs", "pipelines", "schemas", ...
+	ResourceType string `json:"resource_type,omitempty"`
+
+	// Number of resources of this type declared in the bundle configuration, or the
+	// number of state entries for a type that exists only in state. Replaces the
+	// deprecated BundleDeployEvent.Resource*Count fields.
+	Count int64 `json:"count,omitempty"`
+
+	// State-size statistics across resources of this type, each measured as
+	// len(state) of the JSON blob stored in resources.json. Zero when the type has
+	// no state: a terraform deploy, or a resource declared but not yet deployed.
+	StateSizeMaxBytes    int64 `json:"state_size_max_bytes,omitempty"`
+	StateSizeMeanBytes   int64 `json:"state_size_mean_bytes,omitempty"`
+	StateSizeMedianBytes int64 `json:"state_size_median_bytes,omitempty"`
+}
+
 type BoolMapEntry struct {
 	Key   string `json:"key,omitempty"`
 	Value bool   `json:"value"`
diff --git a/libs/telemetry/protos/bundle_init.go b/libs/telemetry/protos/bundle_init.go
index 47308a267b7..ad149d00c3e 100644
--- a/libs/telemetry/protos/bundle_init.go
+++ b/libs/telemetry/protos/bundle_init.go
@@ -9,6 +9,10 @@ type BundleInitEvent struct {
 	// Name of the template initialized when the user ran `databricks bundle init`
 	// This is only populated when the template is a first party template like
 	// mlops-stacks or default-python.
+	//
+	// Templates initialized from the first-party databricks/bundle-examples repo
+	// are recorded as "bundle-examples/<template-dir>" (or just "bundle-examples"
+	// when no template directory is given).
 	TemplateName string `json:"template_name,omitempty"`
 
 	// Arguments used by the user to initialize the template. Only enum
diff --git a/libs/telemetry/protos/databricks_cli_log.go b/libs/telemetry/protos/databricks_cli_log.go
index 64baa6b384a..8c5ec415c28 100644
--- a/libs/telemetry/protos/databricks_cli_log.go
+++ b/libs/telemetry/protos/databricks_cli_log.go
@@ -6,6 +6,11 @@ type ExecutionContext struct {
 	// with the http_access_log table.
 	CmdExecID string `json:"cmd_exec_id,omitempty"`
 
+	// Hash of the lineage of the bundle state the command read (see libs/shortid). This is
+	// also set in the HTTP user agent under the key "lineage". Unset for commands that do not
+	// read bundle state, and when the state has no lineage yet (nothing deployed).
+	StateLineageHash string `json:"state_lineage_hash,omitempty"`
+
 	// Version of the Databricks CLI used.
 	Version string `json:"version,omitempty"`
 
diff --git a/libs/telemetry/protos/frontend_log.go b/libs/telemetry/protos/frontend_log.go
index 7e6ab1012b7..197856bab05 100644
--- a/libs/telemetry/protos/frontend_log.go
+++ b/libs/telemetry/protos/frontend_log.go
@@ -16,7 +16,14 @@ type FrontendLogEntry struct {
 type DatabricksCliLog struct {
 	ExecutionContext *ExecutionContext `json:"execution_context,omitempty"`
 
-	CliTestEvent      *CliTestEvent      `json:"cli_test_event,omitempty"`
-	BundleInitEvent   *BundleInitEvent   `json:"bundle_init_event,omitempty"`
-	BundleDeployEvent *BundleDeployEvent `json:"bundle_deploy_event,omitempty"`
+	CliTestEvent                *CliTestEvent                `json:"cli_test_event,omitempty"`
+	BundleInitEvent             *BundleInitEvent             `json:"bundle_init_event,omitempty"`
+	BundleDeployEvent           *BundleDeployEvent           `json:"bundle_deploy_event,omitempty"`
+	SshTunnelEvent              *SshTunnelEvent              `json:"ssh_tunnel_event,omitempty"`
+	SshTunnelTeardownEvent      *SshTunnelTeardownEvent      `json:"ssh_tunnel_teardown_event,omitempty"`
+	SshAgentShimEvent           *SshAgentShimEvent           `json:"ssh_agent_shim_event,omitempty"`
+	BundleConfigRemoteSyncEvent *BundleConfigRemoteSyncEvent `json:"bundle_config_remote_sync_event,omitempty"`
+	AitoolsInstallEvent         *AitoolsInstallEvent         `json:"aitools_install_event,omitempty"`
+	SetupLocalEvent             *SetupLocalEvent             `json:"setup_local_event,omitempty"`
+	AirRunEvent                 *AirRunEvent                 `json:"air_run_event,omitempty"`
 }
diff --git a/libs/telemetry/protos/setup_local.go b/libs/telemetry/protos/setup_local.go
new file mode 100644
index 00000000000..e6eaf60275e
--- /dev/null
+++ b/libs/telemetry/protos/setup_local.go
@@ -0,0 +1,99 @@
+package protos
+
+// SetupLocalComputeSource mirrors SetupLocalComputeSource.Type in the
+// databricks_cli lumberjack proto. Unspecified absorbs a source a newer CLI
+// knows about but the server proto does not yet.
+type SetupLocalComputeSource string
+
+const (
+	SetupLocalComputeSourceUnspecified SetupLocalComputeSource = "TYPE_UNSPECIFIED"
+	SetupLocalComputeSourceCluster     SetupLocalComputeSource = "CLUSTER"
+	SetupLocalComputeSourceServerless  SetupLocalComputeSource = "SERVERLESS"
+	SetupLocalComputeSourceJob         SetupLocalComputeSource = "JOB"
+	SetupLocalComputeSourceBundle      SetupLocalComputeSource = "BUNDLE"
+)
+
+// SetupLocalMode mirrors SetupLocalMode.Type in the databricks_cli lumberjack proto.
+type SetupLocalMode string
+
+const (
+	SetupLocalModeUnspecified     SetupLocalMode = "TYPE_UNSPECIFIED"
+	SetupLocalModeDefault         SetupLocalMode = "DEFAULT"
+	SetupLocalModeConstraintsOnly SetupLocalMode = "CONSTRAINTS_ONLY"
+)
+
+// SetupLocalErrorCode mirrors SetupLocalErrorCode.Type in the databricks_cli
+// lumberjack proto. It carries the pipeline's stable failure class on a failed
+// run and is empty on success.
+type SetupLocalErrorCode string
+
+const (
+	SetupLocalErrorCodeUnspecified        SetupLocalErrorCode = "TYPE_UNSPECIFIED"
+	SetupLocalErrorCodeUsage              SetupLocalErrorCode = "E_USAGE"
+	SetupLocalErrorCodeManagerUnsupported SetupLocalErrorCode = "E_MANAGER_UNSUPPORTED"
+	SetupLocalErrorCodeNotWritable        SetupLocalErrorCode = "E_NOT_WRITABLE"
+	SetupLocalErrorCodeUvMissing          SetupLocalErrorCode = "E_UV_MISSING"
+	SetupLocalErrorCodeNoTarget           SetupLocalErrorCode = "E_NO_TARGET"
+	SetupLocalErrorCodeResolve            SetupLocalErrorCode = "E_RESOLVE"
+	SetupLocalErrorCodeEnvUnsupported     SetupLocalErrorCode = "E_ENV_UNSUPPORTED"
+	SetupLocalErrorCodeFetch              SetupLocalErrorCode = "E_FETCH"
+	SetupLocalErrorCodeWrite              SetupLocalErrorCode = "E_WRITE"
+	SetupLocalErrorCodeMerge              SetupLocalErrorCode = "E_MERGE"
+	SetupLocalErrorCodePythonInstall      SetupLocalErrorCode = "E_PYTHON_INSTALL"
+	SetupLocalErrorCodeProvision          SetupLocalErrorCode = "E_PROVISION"
+	SetupLocalErrorCodeProvisionConflict  SetupLocalErrorCode = "E_PROVISION_CONFLICT"
+	SetupLocalErrorCodeValidate           SetupLocalErrorCode = "E_VALIDATE"
+	SetupLocalErrorCodeCanceled           SetupLocalErrorCode = "E_CANCELED"
+)
+
+// SetupLocalPhase mirrors SetupLocalPhase.Type in the databricks_cli lumberjack
+// proto. On a failed run it records which phase failed; empty on success.
+type SetupLocalPhase string
+
+const (
+	SetupLocalPhaseUnspecified SetupLocalPhase = "TYPE_UNSPECIFIED"
+	SetupLocalPhasePreflight   SetupLocalPhase = "PREFLIGHT"
+	SetupLocalPhaseResolve     SetupLocalPhase = "RESOLVE"
+	SetupLocalPhaseFetch       SetupLocalPhase = "FETCH"
+	SetupLocalPhaseMerge       SetupLocalPhase = "MERGE"
+	SetupLocalPhaseProvision   SetupLocalPhase = "PROVISION"
+	SetupLocalPhaseValidate    SetupLocalPhase = "VALIDATE"
+)
+
+// SetupLocalEvent is emitted on every real (non-dry-run) execution of the
+// `databricks environments setup-local` command.
+type SetupLocalEvent struct {
+	// Whether the run completed successfully. Not omitempty: a genuine false
+	// must be distinguishable from an older CLI that did not report the field.
+	Success bool `json:"success"`
+
+	// Which precedence source supplied the compute target.
+	ComputeSource SetupLocalComputeSource `json:"compute_source,omitempty"`
+
+	// Provisioning mode: default or constraints-only.
+	Mode SetupLocalMode `json:"mode,omitempty"`
+
+	// Whether --no-constraints was set, leaving requires-python and the dependency
+	// constraints unmanaged. Orthogonal to Mode (which records the databricks-connect
+	// axis), so without this a --no-constraints run is indistinguishable from a plain
+	// run. Not omitempty for the same reason as Success.
+	SkipConstraints bool `json:"skip_constraints"`
+
+	// Whether pyproject.toml was created fresh (true) vs an existing project
+	// updated (false). Not omitempty for the same reason as Success.
+	Greenfield bool `json:"greenfield"`
+
+	// Published constraint catalog key, e.g. "dbr/16.4" or
+	// "serverless/serverless-v5". Not PII.
+	EnvKey string `json:"env_key,omitempty"`
+
+	// Stable failure class on a failed run; empty on success.
+	ErrorCode SetupLocalErrorCode `json:"error_code,omitempty"`
+
+	// Phase that failed on a failed run; empty on success.
+	FailurePhase SetupLocalPhase `json:"failure_phase,omitempty"`
+
+	// Whether a failure left the project's pyproject.toml partially written.
+	// Not omitempty so false is reported explicitly.
+	DiskMutated bool `json:"disk_mutated"`
+}
diff --git a/libs/telemetry/protos/ssh_agent_shim.go b/libs/telemetry/protos/ssh_agent_shim.go
new file mode 100644
index 00000000000..1a7b7a02521
--- /dev/null
+++ b/libs/telemetry/protos/ssh_agent_shim.go
@@ -0,0 +1,129 @@
+package protos
+
+// SshAgentShimErrorCategory classifies why an `ssh agent-shim <agent>` invocation failed
+// to launch the coding agent. The categories name the distinct failure sites of the launch
+// so a failure can be attributed without logging the error text, which carries workspace
+// hosts and paths. Unspecified is the value on a successful launch; Unknown absorbs a
+// failure the launch path did not attribute to any site.
+//
+// The GATEWAY_* categories mirror the outcomes the Unity AI Gateway preflight distinguishes,
+// and the *_INSTALL_FAILED categories name the individual toolchain components. Each family
+// keeps a coarse fallback (GATEWAY_UNAVAILABLE, TOOLCHAIN_SETUP_FAILED, AGENT_LAUNCH_FAILED)
+// for a failure in that stage the CLI did not sub-classify.
+type SshAgentShimErrorCategory string
+
+const (
+	SshAgentShimErrorCategoryUnspecified SshAgentShimErrorCategory = "TYPE_UNSPECIFIED"
+
+	// The requested agent is not one the shim supports. Unreachable through the CLI, which
+	// registers a subcommand only per supported agent, but RunAgentShim guards against it.
+	SshAgentShimErrorCategoryUnsupportedAgent SshAgentShimErrorCategory = "UNSUPPORTED_AGENT"
+
+	// The Unity AI Gateway preflight failed but the cause was not one of the specific
+	// GATEWAY_* outcomes below.
+	SshAgentShimErrorCategoryGatewayUnavailable SshAgentShimErrorCategory = "GATEWAY_UNAVAILABLE"
+
+	// The workspace rejected the access token during the preflight (HTTP 401 or a 400
+	// "invalid token"): re-authentication is needed.
+	SshAgentShimErrorCategoryGatewayAuthFailed SshAgentShimErrorCategory = "GATEWAY_AUTH_FAILED"
+
+	// The token is valid but missing an OAuth scope the AI Gateway APIs require (a 403 naming
+	// the required scopes): re-login mints a token with the scope.
+	SshAgentShimErrorCategoryGatewayScopeFailed SshAgentShimErrorCategory = "GATEWAY_SCOPE_FAILED"
+
+	// The caller lacks the workspace permissions to list the gateway's model services or
+	// legacy endpoints (a plain 403), as opposed to a scope problem.
+	SshAgentShimErrorCategoryGatewayPermissionDenied SshAgentShimErrorCategory = "GATEWAY_PERMISSION_DENIED"
+
+	// The preflight hit a transient error (rate limit, 5xx, or a network blip) and could not
+	// confirm the gateway either way: a retry may succeed.
+	SshAgentShimErrorCategoryGatewayTransientError SshAgentShimErrorCategory = "GATEWAY_TRANSIENT_ERROR"
+
+	// The gateway is reachable but not enabled on the workspace: neither model services nor
+	// legacy endpoints are available.
+	SshAgentShimErrorCategoryGatewayNotEnabled SshAgentShimErrorCategory = "GATEWAY_NOT_ENABLED"
+
+	// Preparing the toolchain failed for a reason other than a specific component install:
+	// resolving $HOME, taking the setup lock, or a PATH problem.
+	SshAgentShimErrorCategoryToolchainSetupFailed SshAgentShimErrorCategory = "TOOLCHAIN_SETUP_FAILED"
+
+	// Installing uv (download, checksum, or extraction) failed.
+	SshAgentShimErrorCategoryUvInstallFailed SshAgentShimErrorCategory = "UV_INSTALL_FAILED"
+
+	// Installing the Unity Gateway CLI (`ug`, via `uv tool install`) failed.
+	SshAgentShimErrorCategoryGatewayCLIInstallFailed SshAgentShimErrorCategory = "UNITY_GATEWAY_CLI_INSTALL_FAILED"
+
+	// Installing Node.js (download, checksum, or extraction) failed.
+	SshAgentShimErrorCategoryNodeInstallFailed SshAgentShimErrorCategory = "NODE_INSTALL_FAILED"
+
+	// The install steps reported success but the Unity Gateway CLI (`ug`) was still not on
+	// PATH when the shim went to launch the agent: a setup inconsistency, distinct from the
+	// install itself failing.
+	SshAgentShimErrorCategoryUnityGatewayCLINotFound SshAgentShimErrorCategory = "UNITY_GATEWAY_CLI_NOT_FOUND"
+
+	// Writing the Databricks system-context file the agent reads (the --append-system-prompt
+	// file, or the AGENTS.md instructions file) failed.
+	SshAgentShimErrorCategoryAgentContextSetupFailed SshAgentShimErrorCategory = "AGENT_CONTEXT_SETUP_FAILED"
+
+	// The launch stage failed for a reason other than the two above: the coarse fallback.
+	// The exec itself is deliberately not represented here. A successful execve replaces the
+	// shim's process with the agent, so the launch is recorded as successful just before the
+	// exec; neither a rare execve syscall failure nor a failure the agent hits at runtime can
+	// be observed afterwards (that would require running the agent as a child, which the shim
+	// intentionally does not do).
+	SshAgentShimErrorCategoryAgentLaunchFailed SshAgentShimErrorCategory = "AGENT_LAUNCH_FAILED"
+
+	// The configuration stage failed.
+	SshAgentShimErrorCategoryAgentConfigurationFailed SshAgentShimErrorCategory = "AGENT_CONFIGURATION_FAILED"
+
+	// The user interrupted setup (Ctrl-C or a termination signal) before the agent launched.
+	SshAgentShimErrorCategoryUserAborted SshAgentShimErrorCategory = "USER_ABORTED"
+
+	// A failure the launch path did not attribute to any category above. A rise here points
+	// at a CLI bug or a new failure mode that needs its own category.
+	SshAgentShimErrorCategoryUnknown SshAgentShimErrorCategory = "UNKNOWN"
+)
+
+// The agent for an `ssh agent-shim <agent>` command invocation. Values are in
+// screaming snake case to match what JSON->proto deserialization expects.
+type SshAgentShimAgent string
+
+const (
+	// Unknown agent was specified.
+	SshAgentShimAgentUnspecified SshAgentShimAgent = "TYPE_UNSPECIFIED"
+
+	// Claude Code CLI.
+	SshAgentShimAgentClaudeCode SshAgentShimAgent = "CLAUDE_CODE"
+
+	// Codex CLI.
+	SshAgentShimAgentCodex SshAgentShimAgent = "CODEX"
+)
+
+// SshAgentShimEvent is emitted when a user runs `ssh agent-shim <agent>` on the remote
+// driver to launch a coding agent against the Unity AI Gateway.
+//
+// Unlike most events, a successful launch replaces the CLI process with the agent via
+// execve, so cmd/root's end-of-command upload never runs; the success event is therefore
+// uploaded from the shim just before the exec. A failed launch returns normally and is
+// uploaded by cmd/root as usual.
+type SshAgentShimEvent struct {
+	//  The agent the user asked to launch, mapped to a string matching the proto enum
+	// (e.g. "CLAUDE_CODE", "CODEX", etc).
+	Agent SshAgentShimAgent `json:"agent"`
+
+	// Whether the agent was launched. False means setup failed before the agent ran.
+	// Populated on every event, so no omitempty: a genuine false must stay distinguishable
+	// from an older CLI that did not report the field.
+	IsSuccess bool `json:"is_success"`
+
+	// Why the launch failed, or TYPE_UNSPECIFIED on success. Deliberately without omitempty
+	// for the same reason as is_success: the field identifies a failure's cause, so an empty
+	// value must not collapse into an indistinguishable NULL. A failed launch always sets a
+	// category, falling back to UNKNOWN.
+	ErrorCategory SshAgentShimErrorCategory `json:"error_category"`
+
+	// Wall-clock time in milliseconds from command start to the agent launch, or to the
+	// failure that ended setup. Without omitempty so a real zero stays distinct from an older
+	// CLI that did not report the field.
+	SetupDurationMs int64 `json:"setup_duration_ms"`
+}
diff --git a/libs/telemetry/protos/ssh_agent_shim_test.go b/libs/telemetry/protos/ssh_agent_shim_test.go
new file mode 100644
index 00000000000..15f5fb1025a
--- /dev/null
+++ b/libs/telemetry/protos/ssh_agent_shim_test.go
@@ -0,0 +1,27 @@
+package protos
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// A failed launch is the zero value of the event, so omitempty would drop the result and
+// category and make the failure indistinguishable from an unreported one. This pins the
+// wire payload for that case.
+func TestSshAgentShimEventEncodesFailureExplicitly(t *testing.T) {
+	b, err := json.Marshal(SshAgentShimEvent{})
+	require.NoError(t, err)
+
+	var got map[string]any
+	require.NoError(t, json.Unmarshal(b, &got))
+
+	assert.Equal(t, false, got["is_success"], "is_success must be sent as false, not omitted")
+	// The remaining fields must appear in the payload at all: omitempty would drop the
+	// zero value and make a failure indistinguishable from an unreported one.
+	for _, field := range []string{"agent", "error_category", "setup_duration_ms"} {
+		assert.Contains(t, got, field, "%s must be sent, not omitted", field)
+	}
+}
diff --git a/libs/telemetry/protos/ssh_tunnel.go b/libs/telemetry/protos/ssh_tunnel.go
new file mode 100644
index 00000000000..708a453ac63
--- /dev/null
+++ b/libs/telemetry/protos/ssh_tunnel.go
@@ -0,0 +1,177 @@
+package protos
+
+type SshTunnelComputeType string
+
+const (
+	SshTunnelComputeTypeUnspecified SshTunnelComputeType = "TYPE_UNSPECIFIED"
+	SshTunnelComputeTypeDedicated   SshTunnelComputeType = "DEDICATED"
+	SshTunnelComputeTypeServerless  SshTunnelComputeType = "SERVERLESS"
+)
+
+type SshTunnelClientMode string
+
+const (
+	SshTunnelClientModeUnspecified SshTunnelClientMode = "TYPE_UNSPECIFIED"
+	SshTunnelClientModeSSH         SshTunnelClientMode = "SSH_CLIENT"
+	SshTunnelClientModeProxy       SshTunnelClientMode = "PROXY"
+	SshTunnelClientModeIDE         SshTunnelClientMode = "IDE"
+)
+
+// SshTunnelErrorCategory is a coarse classification of why a connection attempt failed.
+// The categories name the distinct early-return sites of the connect flow so a failure can
+// be attributed without logging the error text, which carries cluster names, paths and user
+// names.
+//
+// It also classifies how an established session ended, for the ends the CLI can attribute
+// (the WEBSOCKET_* and HANDOVER_* categories). Those rows carry is_success = true, because
+// the tunnel was established: use is_success to separate a failed connection attempt from a
+// session that connected and was later cut short, and this field for the cause of either.
+//
+// IDE_SSH_EXTENSION_MISSING was retired in favour of the four IDE_SSH_EXTENSION_* categories
+// below: it reported all four outcomes as one, and they call for different fixes. Rows written
+// before the split still carry it, so a query spanning that release has to accept both.
+type SshTunnelErrorCategory string
+
+const (
+	SshTunnelErrorCategoryUnspecified SshTunnelErrorCategory = "TYPE_UNSPECIFIED"
+
+	// The IDE's shell command ("code"/"cursor") is not on PATH. A permanent per-machine
+	// condition rather than a transient failure, so it is distinguished from the rest.
+	SshTunnelErrorCategoryIDECommandNotOnPath SshTunnelErrorCategory = "IDE_COMMAND_NOT_ON_PATH"
+
+	// The IDE's installed-extension list could not be read, so whether the Remote SSH
+	// extension was present is unknown. Distinct from the install failures below because it
+	// says nothing about the extension itself, only that the check could not run.
+	SshTunnelErrorCategoryIDESSHExtensionListFailed SshTunnelErrorCategory = "IDE_SSH_EXTENSION_LIST_FAILED"
+
+	// The Remote SSH extension was missing or too old, an install was attempted, and the IDE
+	// rejected it. Points at the marketplace or a policy that forbids the install rather than
+	// at anything the user chose: an install the user interrupted lands in USER_ABORTED.
+	SshTunnelErrorCategoryIDESSHExtensionInstallFailed SshTunnelErrorCategory = "IDE_SSH_EXTENSION_INSTALL_FAILED"
+
+	// The user was asked to install the Remote SSH extension and declined. Unreachable with
+	// --auto-approve, so absent from IDE-button traffic.
+	SshTunnelErrorCategoryIDESSHExtensionInstallDeclined SshTunnelErrorCategory = "IDE_SSH_EXTENSION_INSTALL_DECLINED"
+
+	// The Remote SSH extension was missing or too old and consent could not be obtained: no
+	// --auto-approve and no usable prompt. Also unreachable with --auto-approve.
+	SshTunnelErrorCategoryIDESSHExtensionInstallUnavailable SshTunnelErrorCategory = "IDE_SSH_EXTENSION_INSTALL_UNAVAILABLE"
+
+	// IDE settings had to be updated for serverless but the update failed and the user
+	// declined to continue (or --auto-approve turned the failure into an abort).
+	SshTunnelErrorCategoryIDESettingsUpdateDeclined SshTunnelErrorCategory = "IDE_SETTINGS_UPDATE_DECLINED"
+
+	// The cluster is not a dedicated single-user cluster, or it could not be inspected.
+	SshTunnelErrorCategoryClusterAccessDenied SshTunnelErrorCategory = "CLUSTER_ACCESS_DENIED"
+
+	// The cluster was not running and could not be started.
+	SshTunnelErrorCategoryClusterStartFailed SshTunnelErrorCategory = "CLUSTER_START_FAILED"
+
+	// Creating or reading the secret scope holding the SSH keys failed.
+	SshTunnelErrorCategorySecretScopeFailed SshTunnelErrorCategory = "SECRET_SCOPE_FAILED"
+
+	// Generating or persisting the local SSH key pair failed.
+	SshTunnelErrorCategoryKeyGenerationFailed SshTunnelErrorCategory = "KEY_GENERATION_FAILED"
+
+	// Uploading the SSH tunnel binaries to the workspace failed.
+	SshTunnelErrorCategoryBinaryUploadFailed SshTunnelErrorCategory = "BINARY_UPLOAD_FAILED"
+
+	// The SSH server never became reachable: the bootstrap job failed to start, died, or
+	// its metadata never appeared before the timeout.
+	SshTunnelErrorCategoryServerStartTimeout SshTunnelErrorCategory = "SERVER_START_TIMEOUT"
+
+	// An administrator turned off port forwarding to serverless compute
+	// (port_fwd_serverless_enabled), read from the setting before any compute was started.
+	SshTunnelErrorCategoryPortForwardingDisabled SshTunnelErrorCategory = "PORT_FORWARDING_DISABLED"
+
+	// The driver proxy refused a request to the SSH server with a 403, for a server that was
+	// already running or for one that this connection started. Usually port forwarding to
+	// serverless compute is off where the CLI cannot read that setting, but the 403 is not
+	// specific to it, so this names what happened rather than the likely cause.
+	SshTunnelErrorCategoryDriverProxyForbidden SshTunnelErrorCategory = "DRIVER_PROXY_FORBIDDEN"
+
+	// The user interrupted the connection (Ctrl-C or a termination signal). Takes precedence
+	// over the category of whichever step observed the interruption, including steps that shell
+	// out to the IDE and see only a killed child process.
+	SshTunnelErrorCategoryUserAborted SshTunnelErrorCategory = "USER_ABORTED"
+
+	// The proxy could not establish its websocket to the SSH server at all. Distinguished
+	// from WEBSOCKET_DROPPED so "never connected" is not counted as a mid-session drop.
+	SshTunnelErrorCategoryWebsocketConnectFailed SshTunnelErrorCategory = "WEBSOCKET_CONNECT_FAILED"
+
+	// An established proxy websocket stopped carrying traffic mid-session, ending the SSH
+	// session with it. Typically a TCP reset from somewhere on the path between the client
+	// and the workspace; the CLI cannot yet resume from it, so every occurrence is a
+	// user-visible dropped session.
+	SshTunnelErrorCategoryWebsocketDropped SshTunnelErrorCategory = "WEBSOCKET_DROPPED"
+
+	// The periodic auth handover failed in a way that ended the session. A handover that
+	// only failed to dial its replacement is not reported here: the session continues on
+	// its existing connection.
+	SshTunnelErrorCategoryHandoverFailed SshTunnelErrorCategory = "HANDOVER_FAILED"
+
+	// A failure that does not correspond to any of the categories above. The connect path
+	// attributes every per-environment blocker, so a rise here points at a CLI bug (or a new
+	// failure mode that needs its own category) rather than a user's setup.
+	SshTunnelErrorCategoryUnknown SshTunnelErrorCategory = "UNKNOWN"
+)
+
+// SshTunnelEvent is emitted when a user establishes an SSH tunnel connection
+// via the Databricks CLI.
+//
+// Every bool below is populated on every event, so none of them carry
+// omitempty: a genuine false must stay distinguishable from an older CLI that
+// did not report the field. Events sent before CLI v1.14.0 omitted false
+// entirely and land in the table as NULL, so queries spanning that cutover must
+// count NULL as false (e.g. a failed connection is `is_success IS NULL` for
+// pre-v1.14.0 rows and `is_success = false` after).
+type SshTunnelEvent struct {
+	// Type of compute: dedicated cluster or serverless.
+	ComputeType SshTunnelComputeType `json:"compute_type,omitempty"`
+
+	// GPU accelerator type for serverless compute.
+	AcceleratorType string `json:"accelerator_type,omitempty"`
+
+	// IDE that initiated the connection (e.g., "vscode", "cursor").
+	IdeType string `json:"ide_type,omitempty"`
+
+	// How the client is used: SSH client, proxy mode, or IDE mode.
+	ClientMode SshTunnelClientMode `json:"client_mode,omitempty"`
+
+	// Whether this is a reconnection to an existing session.
+	IsReconnect bool `json:"is_reconnect"`
+
+	// Whether the cluster was auto-started by the CLI.
+	AutoStartCluster bool `json:"auto_start_cluster"`
+
+	// Whether a custom base environment was set via --base-environment.
+	// Only the presence is recorded: the flag value can be an env.yaml path
+	// or display name carrying PII, so the value itself is not logged.
+	HasBaseEnvironment bool `json:"has_base_environment"`
+
+	// Time in milliseconds spent starting the SSH server.
+	// Zero if server was already running.
+	ServerStartTimeMs int64 `json:"server_start_time_ms"`
+
+	// Whether the connection was successful.
+	IsSuccess bool `json:"is_success"`
+
+	// Whether a serverless usage policy was set via --usage-policy-id.
+	// Only the presence is recorded, not the policy ID itself.
+	HasUsagePolicy bool `json:"has_usage_policy"`
+
+	// Whether the connection asked for detached processes (tmux, setsid, nohup) to
+	// outlive the server via --keep-detached-processes. Only the request is recorded, not
+	// the duration. Whether any such process actually existed at teardown is reported
+	// separately by the server, in SshTunnelTeardownEvent.
+	KeepDetachedRequested bool `json:"keep_detached_requested"`
+
+	// Why the connection attempt failed, how an established session ended, or
+	// TYPE_UNSPECIFIED when neither applies. Deliberately without omitempty: the field is
+	// what identifies a failure's cause, so an empty value must not be silently dropped into
+	// an indistinguishable NULL. Every failed connection attempt sets a category, falling
+	// back to UNKNOWN; an established session sets one only for the ends the CLI can
+	// attribute, since the ssh client and the user's own remote command also exit non-zero
+	// here and neither is a tunnel failure.
+	ErrorCategory SshTunnelErrorCategory `json:"error_category"`
+}
diff --git a/libs/telemetry/protos/ssh_tunnel_teardown.go b/libs/telemetry/protos/ssh_tunnel_teardown.go
new file mode 100644
index 00000000000..1c5c4fb48ea
--- /dev/null
+++ b/libs/telemetry/protos/ssh_tunnel_teardown.go
@@ -0,0 +1,28 @@
+package protos
+
+// SshTunnelTeardownEvent is emitted by the SSH tunnel server on the compute when it
+// shuts down after its idle timeout. It is a separate event from SshTunnelEvent
+// because it is not a connection attempt: folding it into that event would add rows
+// that every existing is_success query would count as connections.
+//
+// It exists to size the problem the --keep-detached-processes flag addresses: only the
+// server, running on the compute at teardown, can see whether the session left
+// detached processes behind, and by then the client that started it is long gone.
+//
+// The linger itself is deliberately not reported here. The bootstrap notebook is what
+// holds the run open, and it outlives every Go process in the session, so no CLI
+// process can observe when the linger ends; the run's own duration carries that.
+type SshTunnelTeardownEvent struct {
+	// Type of compute: dedicated cluster or serverless.
+	ComputeType SshTunnelComputeType `json:"compute_type,omitempty"`
+
+	// Whether the session asked for detached processes to be kept via
+	// --keep-detached-processes.
+	KeepDetachedRequested bool `json:"keep_detached_requested"`
+
+	// Whether processes the tunnel started, but that left its process group (tmux,
+	// setsid, nohup), were still running when the server shut down. Without
+	// --keep-detached-processes those processes do not survive the run, so this counts how
+	// often the tunnel destroys work a user meant to keep.
+	HadDetachedDescendantsAtTeardown bool `json:"had_detached_descendants_at_teardown"`
+}
diff --git a/libs/telemetry/protos/ssh_tunnel_test.go b/libs/telemetry/protos/ssh_tunnel_test.go
new file mode 100644
index 00000000000..503d961283b
--- /dev/null
+++ b/libs/telemetry/protos/ssh_tunnel_test.go
@@ -0,0 +1,67 @@
+package protos
+
+import (
+	"encoding/json"
+	"reflect"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// A failed connection is the zero value of every bool, so omitempty would drop
+// the fields entirely and make the failure indistinguishable from an unreported
+// one. This pins the wire payload for that case.
+func TestSshTunnelEventEncodesFailureExplicitly(t *testing.T) {
+	b, err := json.Marshal(SshTunnelEvent{})
+	require.NoError(t, err)
+
+	var got map[string]any
+	require.NoError(t, json.Unmarshal(b, &got))
+
+	for _, field := range []string{
+		"is_success",
+		"is_reconnect",
+		"auto_start_cluster",
+		"has_base_environment",
+		"has_usage_policy",
+		"keep_detached_requested",
+	} {
+		assert.Equal(t, false, got[field], "%s must be sent as false, not omitted", field)
+	}
+}
+
+// The teardown event's whole purpose is counting how often detached work is destroyed, so a
+// "nothing was left behind" teardown has to arrive as false rather than as an absent field.
+func TestSshTunnelTeardownEventEncodesFalseExplicitly(t *testing.T) {
+	b, err := json.Marshal(SshTunnelTeardownEvent{})
+	require.NoError(t, err)
+
+	var got map[string]any
+	require.NoError(t, json.Unmarshal(b, &got))
+
+	for _, field := range []string{
+		"keep_detached_requested",
+		"had_detached_descendants_at_teardown",
+	} {
+		assert.Equal(t, false, got[field], "%s must be sent as false, not omitted", field)
+	}
+}
+
+// Guards fields added later: a bool that can legitimately be false must not
+// carry omitempty, or its false case arrives as NULL and cannot be counted.
+func TestSshTunnelEventBoolFieldsOmitOmitempty(t *testing.T) {
+	for _, typ := range []reflect.Type{
+		reflect.TypeFor[SshTunnelEvent](),
+		reflect.TypeFor[SshTunnelTeardownEvent](),
+	} {
+		for field := range typ.Fields() {
+			if field.Type.Kind() != reflect.Bool {
+				continue
+			}
+			tag := field.Tag.Get("json")
+			assert.NotContains(t, tag, "omitempty",
+				"%s.%s has omitempty; a false value would be indistinguishable from not reported", typ.Name(), field.Name)
+		}
+	}
+}
diff --git a/libs/telemetry/scrub.go b/libs/telemetry/scrub.go
new file mode 100644
index 00000000000..582526b93a7
--- /dev/null
+++ b/libs/telemetry/scrub.go
@@ -0,0 +1,172 @@
+package telemetry
+
+import (
+	"path"
+	"regexp"
+	"strings"
+)
+
+// Maximum length of an error message included in telemetry.
+const maxErrorMessageLength = 500
+
+// ScrubErrorMessage scrubs sensitive paths and PII from an error message and
+// truncates it to maxErrorMessageLength, producing a value safe to attach to a
+// telemetry event. The result is still treated as privileged data in-region.
+func ScrubErrorMessage(msg string) string {
+	msg = scrubForTelemetry(msg)
+	if len(msg) > maxErrorMessageLength {
+		msg = msg[:maxErrorMessageLength]
+	}
+	return msg
+}
+
+// Scrub sensitive information from error messages before sending to telemetry.
+// Inspired by VS Code's telemetry path scrubbing and Sentry's @userpath pattern.
+//
+// Path regexes use [\s:,"'] as boundary characters to delimit where a path
+// ends. While these characters are technically valid in file paths, in error
+// messages they act as delimiters (e.g. "error: /path/to/file: not found",
+// or "failed to read '/some/path', skipping"). This is a practical tradeoff:
+// paths containing colons, commas, or quotes are extremely rare, and without
+// these boundaries the regexes would over-match into surrounding message text.
+//
+// References:
+// - VS Code: https://github.com/microsoft/vscode/blob/main/src/vs/platform/telemetry/common/telemetryUtils.ts
+// - Sentry: https://github.com/getsentry/relay (PII rule: @userpath)
+var (
+	// Matches Windows absolute paths with backslashes and at least two components
+	// (e.g., C:\foo\bar, D:\Users\project).
+	windowsBackslashPathRegexp = regexp.MustCompile(`[A-Za-z]:\\[^\s:,"'/\\]+\\[^\s:,"']+`)
+
+	// Matches Windows absolute paths with forward slashes and at least two components
+	// (e.g., C:/foo/bar, D:/Users/project).
+	windowsFwdslashPathRegexp = regexp.MustCompile(`[A-Za-z]:/[^\s:,"'/\\]+/[^\s:,"']+`)
+
+	// Matches Databricks workspace paths (/Workspace/...).
+	workspacePathRegexp = regexp.MustCompile(`(^|[\s:,"'])(/Workspace/[^\s:,"']+)`)
+
+	// Matches absolute Unix paths with at least two components
+	// (e.g., /home/user/..., /tmp/foo, ~/.config/databricks).
+	absPathRegexp = regexp.MustCompile(`(^|[\s:,"'])(~?/[^\s:,"'/]+/[^\s:,"']+)`)
+
+	// Matches relative paths:
+	// - Explicit: ./foo, ../foo
+	// - Dot-prefixed directories: .databricks/bundle/..., .cache/foo
+	explicitRelPathRegexp = regexp.MustCompile(`(^|[\s:,"'])((?:\.\.?|\.[a-zA-Z][^\s:,"'/]*)/[^\s:,"']+)`)
+
+	// Matches implicit relative paths: at least two path components where
+	// the last component has a file extension (e.g., "resources/job.yml",
+	// "bundle/dev/state.json").
+	implicitRelPathRegexp = regexp.MustCompile(`(^|[\s:,"'])([a-zA-Z0-9_][^\s:,"']*/[^\s:,"']*\.[a-zA-Z][^\s:,"']*)`)
+
+	// Matches email addresses. Workspace paths in Databricks often contain
+	// emails (e.g., /Workspace/Users/user@example.com/.bundle/dev).
+	emailRegexp = regexp.MustCompile(`[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}`)
+)
+
+// Known file extensions that are safe to retain in redacted paths.
+// These help understand usage patterns without capturing sensitive information.
+var knownExtensions = map[string]bool{
+	// Configuration and data formats
+	".yml":        true,
+	".yaml":       true,
+	".json":       true,
+	".toml":       true,
+	".cfg":        true,
+	".ini":        true,
+	".env":        true,
+	".xml":        true,
+	".properties": true,
+	".conf":       true,
+
+	// Notebook and script languages
+	".py":    true,
+	".r":     true,
+	".scala": true,
+	".sql":   true,
+	".ipynb": true,
+	".sh":    true,
+
+	// Web / Apps
+	".js":   true,
+	".ts":   true,
+	".jsx":  true,
+	".tsx":  true,
+	".html": true,
+	".css":  true,
+
+	// Terraform
+	".tf":      true,
+	".hcl":     true,
+	".tfstate": true,
+	".tfvars":  true,
+
+	// Build artifacts and archives
+	".whl": true,
+	".jar": true,
+	".egg": true,
+	".zip": true,
+	".tar": true,
+	".gz":  true,
+	".tgz": true,
+	".dbc": true,
+
+	// Data formats
+	".txt":     true,
+	".csv":     true,
+	".md":      true,
+	".parquet": true,
+	".avro":    true,
+
+	// Logs and locks
+	".log":  true,
+	".lock": true,
+
+	// Certificates and keys
+	".pem": true,
+	".crt": true,
+}
+
+// scrubForTelemetry is a best-effort scrubber that removes sensitive path and
+// PII information from error messages before they are sent to telemetry.
+// The error message is treated as PII by the logging infrastructure but we
+// scrub to avoid collecting more information than necessary.
+func scrubForTelemetry(msg string) string {
+	// Redact absolute paths.
+	msg = replacePathRegexp(msg, windowsBackslashPathRegexp, "[REDACTED_WIN_PATH]", false)
+	msg = replacePathRegexp(msg, windowsFwdslashPathRegexp, "[REDACTED_WIN_FPATH]", false)
+	msg = replacePathRegexp(msg, workspacePathRegexp, "[REDACTED_WORKSPACE_PATH]", true)
+	msg = replacePathRegexp(msg, absPathRegexp, "[REDACTED_PATH]", true)
+
+	// Redact relative paths.
+	msg = replacePathRegexp(msg, explicitRelPathRegexp, "[REDACTED_REL_PATH]", true)
+	msg = replacePathRegexp(msg, implicitRelPathRegexp, "[REDACTED_REL_PATH]", true)
+
+	// Redact email addresses.
+	msg = emailRegexp.ReplaceAllString(msg, "[REDACTED_EMAIL]")
+
+	return msg
+}
+
+// replacePathRegexp replaces path matches with the given label, retaining
+// known file extensions. When hasDelimiterGroup is true, the first character
+// of the match is preserved as a delimiter prefix.
+func replacePathRegexp(msg string, re *regexp.Regexp, label string, hasDelimiterGroup bool) string {
+	return re.ReplaceAllStringFunc(msg, func(match string) string {
+		prefix := ""
+		p := match
+		if hasDelimiterGroup && len(match) > 0 {
+			first := match[0]
+			if strings.ContainsRune(" \t\n:,\"'", rune(first)) {
+				prefix = match[:1]
+				p = match[1:]
+			}
+		}
+
+		ext := path.Ext(p)
+		if knownExtensions[ext] {
+			return prefix + label + "(" + ext[1:] + ")"
+		}
+		return prefix + label
+	})
+}
diff --git a/libs/telemetry/scrub_test.go b/libs/telemetry/scrub_test.go
new file mode 100644
index 00000000000..9ae21cad3ed
--- /dev/null
+++ b/libs/telemetry/scrub_test.go
@@ -0,0 +1,213 @@
+package telemetry
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestScrubForTelemetry_AbsolutePaths(t *testing.T) {
+	tests := []struct {
+		name     string
+		msg      string
+		expected string
+	}{
+		{
+			name:     "tmp path with known extension",
+			msg:      "failed to write /tmp/bundle-xyz/state.json",
+			expected: "failed to write [REDACTED_PATH](json)",
+		},
+		{
+			name:     "var folders path without extension",
+			msg:      "error reading /var/folders/7t/n_tz6x9d4xj91h48pf8md5zh0000gp/T/test123/file",
+			expected: "error reading [REDACTED_PATH]",
+		},
+		{
+			name:     "etc path with known extension",
+			msg:      "config at /etc/databricks/config.json not found",
+			expected: "config at [REDACTED_PATH](json) not found",
+		},
+		{
+			name:     "macOS home path with known extension",
+			msg:      "failed to read /Users/otheruser/some-project/file.yml",
+			expected: "failed to read [REDACTED_PATH](yml)",
+		},
+		{
+			name:     "Linux home path with known extension",
+			msg:      "failed to read /home/runner/work/project/file.yml",
+			expected: "failed to read [REDACTED_PATH](yml)",
+		},
+		{
+			name:     "absolute path after colon delimiter",
+			msg:      "error: /Users/jane/project/a.yml: not found, try again",
+			expected: "error: [REDACTED_PATH](yml): not found, try again",
+		},
+		{
+			name:     "multiple absolute paths",
+			msg:      "path /home/user/project/a.yml and /home/user/project/b.yml",
+			expected: "path [REDACTED_PATH](yml) and [REDACTED_PATH](yml)",
+		},
+		{
+			name:     "Windows path with backslashes",
+			msg:      `error at C:\Users\shreyas\project\file.yml`,
+			expected: "error at [REDACTED_WIN_PATH](yml)",
+		},
+		{
+			name:     "Windows path with forward slashes",
+			msg:      "error at C:/Users/shreyas/project/file.yml",
+			expected: "error at [REDACTED_WIN_FPATH](yml)",
+		},
+		{
+			name:     "Windows path with lowercase drive letter",
+			msg:      `error at c:\Users\shreyas\project\file.yml`,
+			expected: "error at [REDACTED_WIN_PATH](yml)",
+		},
+		{
+			name:     "volume path with known extension",
+			msg:      "artifact at /Volumes/catalog/schema/volume/artifact.whl",
+			expected: "artifact at [REDACTED_PATH](whl)",
+		},
+		{
+			name:     "dbfs path with known extension",
+			msg:      "state at /dbfs/mnt/data/state.json",
+			expected: "state at [REDACTED_PATH](json)",
+		},
+		{
+			name:     "path with unknown extension",
+			msg:      "error at /home/user/project/file.xyz",
+			expected: "error at [REDACTED_PATH]",
+		},
+		{
+			name:     "tilde home path with known extension",
+			msg:      "reading ~/.databricks/config.json failed",
+			expected: "reading [REDACTED_PATH](json) failed",
+		},
+		{
+			name:     "single component path is not matched",
+			msg:      "POST /telemetry-ext failed",
+			expected: "POST /telemetry-ext failed",
+		},
+		{
+			name:     "empty message",
+			msg:      "",
+			expected: "",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.expected, scrubForTelemetry(tt.msg))
+		})
+	}
+}
+
+func TestScrubForTelemetry_WorkspacePaths(t *testing.T) {
+	tests := []struct {
+		name     string
+		msg      string
+		expected string
+	}{
+		{
+			name:     "workspace user path without extension",
+			msg:      "uploading to /Workspace/Users/dev/.bundle/files",
+			expected: "uploading to [REDACTED_WORKSPACE_PATH]",
+		},
+		{
+			name:     "workspace path with email",
+			msg:      "error at /Workspace/Users/user@example.com/.bundle/dev",
+			expected: "error at [REDACTED_WORKSPACE_PATH]",
+		},
+		{
+			name:     "workspace shared path without extension",
+			msg:      "cannot access /Workspace/Shared/project/notebook",
+			expected: "cannot access [REDACTED_WORKSPACE_PATH]",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.expected, scrubForTelemetry(tt.msg))
+		})
+	}
+}
+
+func TestScrubForTelemetry_RelativePaths(t *testing.T) {
+	tests := []struct {
+		name     string
+		msg      string
+		expected string
+	}{
+		{
+			name:     "explicit relative path with ./",
+			msg:      "failed to load ./resources/job.yml",
+			expected: "failed to load [REDACTED_REL_PATH](yml)",
+		},
+		{
+			name:     "explicit relative path with ../",
+			msg:      "path ../parent/file.yml not allowed",
+			expected: "path [REDACTED_REL_PATH](yml) not allowed",
+		},
+		{
+			name:     "implicit relative path with extension",
+			msg:      "failed to read resources/pipeline.yml: not found",
+			expected: "failed to read [REDACTED_REL_PATH](yml): not found",
+		},
+		{
+			name:     "dot-prefixed directory path with extension",
+			msg:      "error reading .databricks/bundle/dev/variable-overrides.json",
+			expected: "error reading [REDACTED_REL_PATH](json)",
+		},
+		{
+			name:     "single filename without path separator is preserved",
+			msg:      "failed to load databricks.yml",
+			expected: "failed to load databricks.yml",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.expected, scrubForTelemetry(tt.msg))
+		})
+	}
+}
+
+func TestScrubForTelemetry_Emails(t *testing.T) {
+	tests := []struct {
+		name     string
+		msg      string
+		expected string
+	}{
+		{
+			name:     "email in message",
+			msg:      "access denied for user@example.com in workspace",
+			expected: "access denied for [REDACTED_EMAIL] in workspace",
+		},
+		{
+			name:     "no email present",
+			msg:      "some error without emails",
+			expected: "some error without emails",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.expected, scrubForTelemetry(tt.msg))
+		})
+	}
+}
+
+func TestScrubForTelemetry_Combined(t *testing.T) {
+	msg := "failed to load /Users/shreyas/myproject/databricks.yml: " +
+		"workspace /Workspace/Users/shreyas@databricks.com/.bundle is invalid, " +
+		"also tried /home/other/fallback/config.yml, " +
+		"temp at /tmp/bundle-cache/state.json, " +
+		"see .databricks/bundle/dev/variable-overrides.json"
+
+	expected := "failed to load [REDACTED_PATH](yml): " +
+		"workspace [REDACTED_WORKSPACE_PATH] is invalid, " +
+		"also tried [REDACTED_PATH](yml), " +
+		"temp at [REDACTED_PATH](json), " +
+		"see [REDACTED_REL_PATH](json)"
+
+	assert.Equal(t, expected, scrubForTelemetry(msg))
+}
diff --git a/libs/template/builtin.go b/libs/template/builtin.go
index 5b10534ef54..6a86fc5d545 100644
--- a/libs/template/builtin.go
+++ b/libs/template/builtin.go
@@ -8,6 +8,12 @@ import (
 //go:embed all:templates
 var builtinTemplates embed.FS
 
+// sharedLibraryDir holds definitions shared across templates; it has no schema, so builtin() excludes it.
+const sharedLibraryDir = "common"
+
+// sharedLibraryFS is parsed into every template's namespace by newRenderer.
+var sharedLibraryFS, _ = fs.Sub(builtinTemplates, "templates/"+sharedLibraryDir+"/"+libraryDirName)
+
 // builtinTemplate represents a template that is built into the CLI.
 type builtinTemplate struct {
 	Name string
@@ -32,6 +38,11 @@ func builtin() ([]builtinTemplate, error) {
 			continue
 		}
 
+		// The shared library dir is not a template; skip it.
+		if entry.Name() == sharedLibraryDir {
+			continue
+		}
+
 		templateFS, err := fs.Sub(templates, entry.Name())
 		if err != nil {
 			return nil, err
diff --git a/libs/template/config.go b/libs/template/config.go
index 95fd7c5caa1..dd91d1a3c18 100644
--- a/libs/template/config.go
+++ b/libs/template/config.go
@@ -7,6 +7,7 @@ import (
 	"io/fs"
 	"maps"
 	"slices"
+	"strings"
 
 	"github.com/databricks/cli/libs/cmdctx"
 	"github.com/databricks/cli/libs/cmdio"
@@ -213,10 +214,24 @@ func (c *config) promptOnce(property *jsonschema.Schema, name, defaultVal, descr
 		if err != nil {
 			return err
 		}
-		userInput, err = cmdio.AskSelect(c.ctx, description, options)
+		// RunSelect's Label is single-line, so render any preceding lines
+		// of the description separately.
+		label := description
+		if before, after, ok := strings.CutLast(description, "\n"); ok {
+			cmdio.LogString(c.ctx, before)
+			label = after
+		}
+		idx, err := cmdio.RunSelect(c.ctx, cmdio.SelectOptions{
+			Label:         label,
+			Items:         options,
+			HideHelp:      true,
+			LabelTemplate: "{{.}}: ",
+			Selected:      label + ": {{.}}",
+		})
 		if err != nil {
 			return err
 		}
+		userInput = options[idx]
 	} else {
 		var err error
 		userInput, err = cmdio.Ask(c.ctx, description, defaultVal)
@@ -285,7 +300,7 @@ func (c *config) promptForValues(r *renderer) error {
 			if err == nil {
 				break
 			}
-			if !errors.As(err, &retriableError{}) {
+			if _, ok := errors.AsType[retriableError](err); !ok {
 				return err
 			}
 		}
diff --git a/libs/template/config_test.go b/libs/template/config_test.go
index f141b6f17f6..ae91b95054a 100644
--- a/libs/template/config_test.go
+++ b/libs/template/config_test.go
@@ -213,33 +213,25 @@ func TestTemplateValidateSchema(t *testing.T) {
 func TestTemplateValidateSchemaVersion(t *testing.T) {
 	version := latestSchemaVersion
 	schema := jsonschema.Schema{
-		Extension: jsonschema.Extension{
-			Version: &version,
-		},
+		Version: &version,
 	}
 	assert.NoError(t, validateSchema(&schema))
 
 	version = latestSchemaVersion + 1
 	schema = jsonschema.Schema{
-		Extension: jsonschema.Extension{
-			Version: &version,
-		},
+		Version: &version,
 	}
 	assert.EqualError(t, validateSchema(&schema), fmt.Sprintf("template schema version %d is not supported by this version of the CLI. Please upgrade your CLI to the latest version", version))
 
 	version = 5000
 	schema = jsonschema.Schema{
-		Extension: jsonschema.Extension{
-			Version: &version,
-		},
+		Version: &version,
 	}
 	assert.EqualError(t, validateSchema(&schema), "template schema version 5000 is not supported by this version of the CLI. Please upgrade your CLI to the latest version")
 
 	version = 0
 	schema = jsonschema.Schema{
-		Extension: jsonschema.Extension{
-			Version: &version,
-		},
+		Version: &version,
 	}
 	assert.NoError(t, validateSchema(&schema))
 }
diff --git a/libs/template/helpers.go b/libs/template/helpers.go
index eefb79537ef..acf257d848c 100644
--- a/libs/template/helpers.go
+++ b/libs/template/helpers.go
@@ -11,13 +11,13 @@ import (
 	"slices"
 	"strings"
 	"text/template"
+	"uuid"
 
 	"github.com/databricks/cli/libs/cmdctx"
+	"github.com/databricks/cli/libs/env"
 	"github.com/databricks/cli/libs/iamutil"
 	"github.com/databricks/databricks-sdk-go/apierr"
 	"github.com/databricks/databricks-sdk-go/service/iam"
-
-	"github.com/google/uuid"
 )
 
 type ErrFail struct {
@@ -52,6 +52,14 @@ var metastoreDisabledErrorCodes = []string{
 // is run and can be used to attribute DBU revenue to bundle templates.
 var bundleUuid = uuid.New().String()
 
+// deploymentHistoryEnvVar makes the built-in templates set
+// experimental.deployment_history in the databricks.yml they generate. It is scoped to
+// `bundle init` because it persists the setting in the generated project rather than applying
+// it to the bundle being run.
+//
+// Temporary: remove it and its callers in the templates once this is the default.
+const deploymentHistoryEnvVar = "DATABRICKS_BUNDLE_INIT_DEPLOYMENT_HISTORY"
+
 func loadHelpers(ctx context.Context) template.FuncMap {
 	w := cmdctx.WorkspaceClient(ctx)
 	return template.FuncMap{
@@ -70,7 +78,7 @@ func loadHelpers(ctx context.Context) template.FuncMap {
 		"random_int": func(n int) int {
 			return rand.IntN(n)
 		},
-		// Alias for https://pkg.go.dev/github.com/google/uuid#New. Returns, as a string, a UUID which is a 128 bit (16 byte) Universal Unique IDentifier as defined in RFC 4122.
+		// Alias for https://pkg.go.dev/uuid#New. Returns, as a string, a UUID which is a 128 bit (16 byte) Universal Unique IDentifier as defined in RFC 9562.
 		"uuid": func() string {
 			return uuid.New().String()
 		},
@@ -120,7 +128,7 @@ func loadHelpers(ctx context.Context) template.FuncMap {
 		"user_name": func() (string, error) {
 			if cachedUser == nil {
 				var err error
-				cachedUser, err = w.CurrentUser.Me(ctx)
+				cachedUser, err = w.CurrentUser.Me(ctx, iam.MeRequest{})
 				if err != nil {
 					return "", err
 				}
@@ -134,7 +142,7 @@ func loadHelpers(ctx context.Context) template.FuncMap {
 		"short_name": func() (string, error) {
 			if cachedUser == nil {
 				var err error
-				cachedUser, err = w.CurrentUser.Me(ctx)
+				cachedUser, err = w.CurrentUser.Me(ctx, iam.MeRequest{})
 				if err != nil {
 					return "", err
 				}
@@ -147,8 +155,7 @@ func loadHelpers(ctx context.Context) template.FuncMap {
 			if cachedCatalog == nil {
 				metastore, err := w.Metastores.Current(ctx)
 				if err != nil {
-					var aerr *apierr.APIError
-					if errors.As(err, &aerr) && (slices.Contains(metastoreDisabledErrorCodes, aerr.ErrorCode) || aerr.Message == "Bad Target: /api/2.1/unity-catalog/current-metastore-assignment") {
+					if aerr, ok := errors.AsType[*apierr.APIError](err); ok && (slices.Contains(metastoreDisabledErrorCodes, aerr.ErrorCode) || aerr.Message == "Bad Target: /api/2.1/unity-catalog/current-metastore-assignment") {
 						// Ignore: access denied or workspace doesn't have a metastore assigned
 						empty_default := ""
 						cachedCatalog = &empty_default
@@ -166,7 +173,7 @@ func loadHelpers(ctx context.Context) template.FuncMap {
 			}
 			if cachedUser == nil {
 				var err error
-				cachedUser, err = w.CurrentUser.Me(ctx)
+				cachedUser, err = w.CurrentUser.Me(ctx, iam.MeRequest{})
 				if err != nil {
 					return false, err
 				}
@@ -175,6 +182,10 @@ func loadHelpers(ctx context.Context) template.FuncMap {
 			cachedIsServicePrincipal = &result
 			return result, nil
 		},
+		"deployment_history": func() bool {
+			v, _ := env.GetBool(ctx, deploymentHistoryEnvVar)
+			return v
+		},
 		"lower": func(s string) string {
 			return strings.ToLower(s)
 		},
diff --git a/libs/template/renderer.go b/libs/template/renderer.go
index c1403fa071c..cce0861c0d2 100644
--- a/libs/template/renderer.go
+++ b/libs/template/renderer.go
@@ -60,6 +60,11 @@ type renderer struct {
 	// an explicit {{skip}} directive for that directory in the template.
 	visitedDirs []string
 
+	// Slash-separated paths of the files persisted by persistToDisk, relative to
+	// the output directory. Only files that survived the skip patterns are
+	// recorded, so a file removed by a {{skip}} directive is not listed here.
+	persistedPaths []string
+
 	// [fs.FS] that holds the template's file tree.
 	srcFS fs.FS
 }
@@ -75,20 +80,16 @@ func newRenderer(
 	// Initialize new template, with helper functions loaded
 	tmpl := template.New("").Funcs(helpers)
 
-	// Find user-defined templates in the library directory
-	matches, err := fs.Glob(templateFS, path.Join(libraryDir, "*"))
+	// Parse the shared library before the template's own, so a same-named
+	// definition in the template's library takes precedence.
+	tmpl, err := parseLibrary(tmpl, sharedLibraryFS, "*")
 	if err != nil {
 		return nil, err
 	}
 
-	// Parse user-defined templates.
-	// Note: we do not call [ParseFS] with the glob directly because
-	// it returns an error if no files match the pattern.
-	if len(matches) != 0 {
-		tmpl, err = tmpl.ParseFS(templateFS, matches...)
-		if err != nil {
-			return nil, err
-		}
+	tmpl, err = parseLibrary(tmpl, templateFS, path.Join(libraryDir, "*"))
+	if err != nil {
+		return nil, err
 	}
 
 	srcFS, err := fs.Sub(templateFS, path.Clean(templateDir))
@@ -109,6 +110,19 @@ func newRenderer(
 	}, nil
 }
 
+// parseLibrary parses files in fsys matching pattern into tmpl, tolerating no matches
+// (unlike [template.Template.ParseFS], which errors when nothing matches).
+func parseLibrary(tmpl *template.Template, fsys fs.FS, pattern string) (*template.Template, error) {
+	matches, err := fs.Glob(fsys, pattern)
+	if err != nil {
+		return nil, err
+	}
+	if len(matches) == 0 {
+		return tmpl, nil
+	}
+	return tmpl.ParseFS(fsys, matches...)
+}
+
 // Executes the template by applying config on it. Returns the materialized template
 // as a string
 func (r *renderer) executeTemplate(templateDefinition string) (string, error) {
@@ -136,8 +150,7 @@ func (r *renderer) executeTemplate(templateDefinition string) (string, error) {
 	if err != nil {
 		// Parse and return a more readable error for missing values that are used
 		// by the template definition but are not provided in the passed config.
-		target := &template.ExecError{}
-		if errors.As(err, target) {
+		if target, ok := errors.AsType[template.ExecError](err); ok {
 			captureRegex := regexp.MustCompile(`map has no entry for key "(.*)"`)
 			matches := captureRegex.FindStringSubmatch(target.Err.Error())
 			if len(matches) != 2 {
@@ -200,7 +213,7 @@ func (r *renderer) computeFile(relPathTemplate string) (file, error) {
 	}
 	content, err := r.executeTemplate(string(contentTemplate))
 	// Capture errors caused by the "fail" helper function
-	if target := (&ErrFail{}); errors.As(err, target) {
+	if target, ok := errors.AsType[ErrFail](err); ok {
 		return nil, target
 	}
 	if err != nil {
@@ -345,6 +358,7 @@ func (r *renderer) persistToDisk(ctx context.Context, out filer.Filer) error {
 		if err != nil {
 			return err
 		}
+		r.persistedPaths = append(r.persistedPaths, file.RelPath())
 	}
 
 	// Ensure all visited directories exist, preserving the template's directory structure.
diff --git a/libs/template/renderer_test.go b/libs/template/renderer_test.go
index bb839628627..27fa44dc9ce 100644
--- a/libs/template/renderer_test.go
+++ b/libs/template/renderer_test.go
@@ -1,6 +1,7 @@
 package template
 
 import (
+	"bytes"
 	"context"
 	"io/fs"
 	"os"
@@ -134,6 +135,56 @@ func TestBuiltinDbtTemplateValid(t *testing.T) {
 	}
 }
 
+func TestDefaultScalaSparkVersionCombinesVersionMacros(t *testing.T) {
+	tmpl, err := template.New("root").ParseFS(builtinTemplates, "templates/default-scala/library/*")
+	require.NoError(t, err)
+
+	var dbrVersion bytes.Buffer
+	require.NoError(t, tmpl.ExecuteTemplate(&dbrVersion, "dbr_version", nil))
+	var scalaVersion bytes.Buffer
+	require.NoError(t, tmpl.ExecuteTemplate(&scalaVersion, "scala_major_minor_version", nil))
+	var sparkVersion bytes.Buffer
+	require.NoError(t, tmpl.ExecuteTemplate(&sparkVersion, "spark_version", nil))
+
+	assert.Equal(t, strings.TrimSpace(dbrVersion.String()), dbrVersion.String())
+	assert.Equal(t, strings.TrimSpace(scalaVersion.String()), scalaVersion.String())
+	assert.Equal(t, strings.TrimSpace(sparkVersion.String()), sparkVersion.String())
+	assert.Equal(t,
+		dbrVersion.String()+".x-scala"+scalaVersion.String(),
+		sparkVersion.String(),
+	)
+}
+
+func TestDefaultScalaRenderedVersionsUseMacros(t *testing.T) {
+	// Define every macro referenced by the two template files parsed below.
+	tmpl := template.Must(template.New("root").Parse(`
+{{define "dbr_version"}}99.9{{end}}
+{{define "scala_version"}}9.9.9{{end}}
+{{define "spark_version"}}99.9.x-scala9.9{{end}}
+{{define "organization"}}com.example{{end}}
+{{define "version"}}0.1{{end}}
+{{define "main_class_name"}}com.example.Main{{end}}
+`))
+	tmpl, err := tmpl.ParseFS(
+		builtinTemplates,
+		"templates/default-scala/template/{{.project_name}}/build.sbt.tmpl",
+		"templates/default-scala/template/{{.project_name}}/resources/{{.project_name}}.job.yml.tmpl",
+	)
+	require.NoError(t, err)
+
+	config := map[string]any{
+		"compute_type": "standard cluster",
+		"project_name": "my_project",
+	}
+	var buildFile bytes.Buffer
+	require.NoError(t, tmpl.ExecuteTemplate(&buildFile, "build.sbt.tmpl", config))
+	assert.Contains(t, buildFile.String(), `"databricks-connect" % "99.9.+"`)
+
+	var jobFile bytes.Buffer
+	require.NoError(t, tmpl.ExecuteTemplate(&jobFile, "{{.project_name}}.job.yml.tmpl", config))
+	assert.Contains(t, jobFile.String(), "spark_version: 99.9.x-scala9.9")
+}
+
 func TestRendererWithAssociatedTemplateInLibrary(t *testing.T) {
 	tmpDir := t.TempDir()
 
@@ -155,6 +206,37 @@ func TestRendererWithAssociatedTemplateInLibrary(t *testing.T) {
 	assert.Equal(t, "shreyas.goenka@databricks.com", strings.Trim(string(b), "\n\r"))
 }
 
+func TestRendererSharedLibraryAndOverride(t *testing.T) {
+	tmpDir := t.TempDir()
+
+	ctx := t.Context()
+	ctx = cmdctx.SetWorkspaceClient(ctx, nil)
+	helpers := loadHelpers(ctx)
+	r, err := newRenderer(ctx, nil, helpers, os.DirFS("."), "./testdata/library-override/template", "./testdata/library-override/library")
+	require.NoError(t, err)
+
+	err = r.walk()
+	require.NoError(t, err)
+	out, err := filer.NewLocalClient(tmpDir)
+	require.NoError(t, err)
+	err = r.persistToDisk(ctx, out)
+	require.NoError(t, err)
+
+	b, err := os.ReadFile(filepath.Join(tmpDir, "out"))
+	require.NoError(t, err)
+	got := string(b)
+
+	// agents_md is defined in both the shared library and this template's own
+	// library; the template's own definition must take precedence.
+	assert.Contains(t, got, "own: OWN WINS")
+
+	r, err = newRenderer(ctx, nil, helpers, os.DirFS("."), "./testdata/library-override/template", "./testdata/library-override/no-library")
+	require.NoError(t, err)
+	got, err = r.executeTemplate(`{{template "agents_md" .}}`)
+	require.NoError(t, err)
+	assert.Contains(t, got, "# Declarative Automation Bundles Project")
+}
+
 func TestRendererExecuteTemplate(t *testing.T) {
 	templateText := `"{{.count}} items are made of {{.Material}}".
 {{if eq .Animal "sheep" }}
diff --git a/libs/template/resolver.go b/libs/template/resolver.go
index b5a2fa8d881..d653551ab65 100644
--- a/libs/template/resolver.go
+++ b/libs/template/resolver.go
@@ -3,38 +3,165 @@ package template
 import (
 	"context"
 	"errors"
+	"fmt"
+	"net/url"
+	"path/filepath"
 	"strings"
 
 	"github.com/databricks/cli/libs/git"
 )
 
-var gitUrlPrefixes = []string{
-	"https://",
-	"git@",
+const (
+	// bundleExamplesRepoName is the display name we record in telemetry for
+	// template initializations from the bundle-examples repo.
+	bundleExamplesRepoName = "bundle-examples"
+
+	// bundleExamplesHost and bundleExamplesPath identify the Databricks
+	// bundle-examples repository. GitHub resolves the owner and repo
+	// case-insensitively, so isBundleExamplesRepo compares against these with
+	// EqualFold.
+	bundleExamplesHost = "github.com"
+	bundleExamplesPath = "databricks/" + bundleExamplesRepoName
+)
+
+type gitUrlPrefix struct {
+	prefix string
+
+	// invalid marks a prefix that git recognizes as a URL but that we refuse to
+	// clone from, so we can report an actionable error instead of falling through
+	// to the local-path reader.
+	invalid bool
+}
+
+// See https://git-scm.com/docs/git-clone#_git_urls for the set of Git URL forms.
+// We deliberately reject the deprecated/insecure transports (git, http, ftp[s]).
+var gitUrlPrefixes = []gitUrlPrefix{
+	{prefix: "https://"},
+	{prefix: "ssh://"},
+	// recognize git@ without ssh:// protocol because this is very common
+	{prefix: "git@"},
+	{prefix: "http://", invalid: true},
+	{prefix: "git://", invalid: true},
+	{prefix: "ftp://", invalid: true},
+	{prefix: "ftps://", invalid: true},
 }
 
-func IsRepoUrl(url string) bool {
-	result := false
-	for _, prefix := range gitUrlPrefixes {
-		if strings.HasPrefix(url, prefix) {
-			result = true
-			break
+// matchGitUrlPrefix returns the matching prefix entry, or nil if the input does
+// not look like a Git URL.
+func matchGitUrlPrefix(url string) *gitUrlPrefix {
+	for i := range gitUrlPrefixes {
+		if strings.HasPrefix(url, gitUrlPrefixes[i].prefix) {
+			return &gitUrlPrefixes[i]
 		}
 	}
-	return result
+	return nil
+}
+
+func IsGitRepoUrl(url string) bool {
+	p := matchGitUrlPrefix(url)
+	return p != nil && !p.invalid
+}
+
+// gitHostAndPath extracts the host and the "owner/repo" path from a Git URL. It
+// recognizes the same URL forms as matchGitUrlPrefix (scheme-based https:// and
+// ssh://, and scp-like git@host:owner/repo), so it agrees with the rest of the
+// resolver on what counts as a Git URL; ok is false for anything else (e.g. a
+// local path). Userinfo, port, a trailing ".git" and surrounding slashes are
+// stripped.
+//
+// For scheme URLs the host comes from the parsed authority rather than by
+// stripping to the last "@", so a path that embeds an "@" (e.g.
+// "https://attacker.example/foo@github.com/...") is not mistaken for the host.
+func gitHostAndPath(rawurl string) (host, path string, ok bool) {
+	prefix := matchGitUrlPrefix(rawurl)
+	if prefix == nil || prefix.invalid {
+		return "", "", false
+	}
+
+	if prefix.prefix == "git@" {
+		// scp-like syntax: git@host:owner/repo (no scheme; host and path are
+		// separated by a colon).
+		_, rest, _ := strings.Cut(rawurl, "@")
+		h, p, found := strings.Cut(rest, ":")
+		if !found {
+			return "", "", false
+		}
+		host, path = h, p
+	} else {
+		u, err := url.Parse(rawurl)
+		if err != nil {
+			return "", "", false
+		}
+		// Hostname strips any userinfo and port.
+		host, path = u.Hostname(), u.Path
+	}
+
+	path = strings.TrimSuffix(strings.Trim(path, "/"), ".git")
+	return host, path, host != "" && path != ""
+}
+
+// isBundleExamplesRepo reports whether a Git URL points at the Databricks
+// bundle-examples repository. Because that repo is first-party public content,
+// template initializations from it are safe to record in telemetry.
+func isBundleExamplesRepo(rawurl string) bool {
+	host, path, ok := gitHostAndPath(rawurl)
+	return ok && strings.EqualFold(host, bundleExamplesHost) && strings.EqualFold(path, bundleExamplesPath)
+}
+
+// customWriter returns the writer for a template that is not a registered
+// first-party template. Custom template definitions may contain PII, so we
+// record only minimal telemetry for them. The bundle-examples repo is the
+// exception: it is first-party, so we record verbose telemetry (the template
+// name and its enum args), qualifying the repo name with the template
+// subdirectory that identifies the specific template within the repo.
+//
+// The template directory must stay within the cloned repo. A directory that
+// escapes it (e.g. "../../local-template") would make the git reader load an
+// arbitrary local template whose definition may contain PII; such a template is
+// not first-party, so it falls back to the minimal writer.
+func customWriter(templatePathOrUrl, templateDir string, isGit bool) Writer {
+	if isGit && isBundleExamplesRepo(templatePathOrUrl) && (templateDir == "" || filepath.IsLocal(templateDir)) {
+		name := bundleExamplesRepoName
+		// Recording the template directory in telemetry is safe here even though
+		// it is user-supplied: LogTelemetry only runs after a successful
+		// materialize, so it always resolves to a public template in the
+		// first-party bundle-examples repo, not user-private data.
+		//
+		// Clean it so equivalent inputs ("contrib/x", "./contrib/x", "contrib/x/.")
+		// map to one identifier; a cleaned "." means the repo root.
+		if dir := filepath.ToSlash(filepath.Clean(templateDir)); dir != "." {
+			name += "/" + dir
+		}
+		return &writerWithFullTelemetry{name: TemplateName(name)}
+	}
+	return &defaultWriter{name: Custom}
 }
 
 // ResolveReader resolves a template path/URL to a Reader (built-in, git or local)
-func ResolveReader(templatePathOrUrl, templateDir, ref string) (Reader, bool) {
+func ResolveReader(templatePathOrUrl, templateDir, ref string) (Reader, bool, error) {
 	if tmpl := GetDatabricksTemplate(TemplateName(templatePathOrUrl)); tmpl != nil {
-		return tmpl.Reader, false
+		return tmpl.Reader, false, nil
 	}
 
-	if IsRepoUrl(templatePathOrUrl) {
-		return NewGitReader(templatePathOrUrl, ref, templateDir, git.Clone), true
+	if p := matchGitUrlPrefix(templatePathOrUrl); p != nil {
+		if p.invalid {
+			return nil, false, fmt.Errorf("unsupported protocol in Git URL %q: only %s URLs are supported", templatePathOrUrl, strings.Join(supportedGitUrlPrefixes(), ", "))
+		}
+		return NewGitReader(templatePathOrUrl, ref, templateDir, git.Clone), true, nil
 	}
 
-	return NewLocalReader(templatePathOrUrl), false
+	return NewLocalReader(templatePathOrUrl), false, nil
+}
+
+// supportedGitUrlPrefixes returns the valid (non-rejected) Git URL prefixes.
+func supportedGitUrlPrefixes() []string {
+	var prefixes []string
+	for i := range gitUrlPrefixes {
+		if !gitUrlPrefixes[i].invalid {
+			prefixes = append(prefixes, gitUrlPrefixes[i].prefix)
+		}
+	}
+	return prefixes
 }
 
 type Resolver struct {
@@ -105,14 +232,14 @@ func (r Resolver) Resolve(ctx context.Context) (*Template, error) {
 	//
 	// We resolve the appropriate reader according to the reference provided by the user.
 	if tmpl == nil {
-		reader, _ := ResolveReader(r.TemplatePathOrUrl, r.TemplateDir, ref)
+		reader, isGit, err := ResolveReader(r.TemplatePathOrUrl, r.TemplateDir, ref)
+		if err != nil {
+			return nil, err
+		}
 		tmpl = &Template{
 			name:   Custom,
 			Reader: reader,
-			// We use a writer that does not log verbose telemetry for custom templates.
-			// This is important because template definitions can contain PII that we
-			// do not want to centralize.
-			Writer: &defaultWriter{name: Custom},
+			Writer: customWriter(r.TemplatePathOrUrl, r.TemplateDir, isGit),
 		}
 	}
 	err = tmpl.Writer.Configure(ctx, r.ConfigFile, r.OutputDir)
diff --git a/libs/template/resolver_test.go b/libs/template/resolver_test.go
index 2174fe1afe9..36fa7cfc7c4 100644
--- a/libs/template/resolver_test.go
+++ b/libs/template/resolver_test.go
@@ -82,6 +82,92 @@ func TestTemplateResolverForCustomUrl(t *testing.T) {
 	assert.Equal(t, "/config/file", tmpl.Writer.(*defaultWriter).configPath)
 }
 
+func TestTemplateResolverForBundleExamples(t *testing.T) {
+	tests := []struct {
+		url         string
+		templateDir string
+		wantName    string
+	}{
+		{"https://github.com/databricks/bundle-examples", "contrib/templates/dbt-factory", "bundle-examples/contrib/templates/dbt-factory"},
+		// Equivalent template directories canonicalize to the same identifier.
+		{"https://github.com/databricks/bundle-examples", "./contrib/templates/dbt-factory", "bundle-examples/contrib/templates/dbt-factory"},
+		{"https://github.com/databricks/bundle-examples", "contrib/templates/dbt-factory/.", "bundle-examples/contrib/templates/dbt-factory"},
+		// Without a template directory we can only attribute the init to the repo.
+		{"https://github.com/databricks/bundle-examples", "", "bundle-examples"},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.url+"|"+tc.templateDir, func(t *testing.T) {
+			r := Resolver{
+				TemplatePathOrUrl: tc.url,
+				TemplateDir:       tc.templateDir,
+			}
+
+			tmpl, err := r.Resolve(t.Context())
+			require.NoError(t, err)
+
+			// bundle-examples is a first-party repo, so we record verbose telemetry
+			// (template name and enum args) for it.
+			w, ok := tmpl.Writer.(*writerWithFullTelemetry)
+			require.True(t, ok, "expected a full-telemetry writer")
+			assert.Equal(t, tc.wantName, string(w.name))
+			assert.Equal(t, tc.url, tmpl.Reader.(*gitReader).gitUrl)
+		})
+	}
+}
+
+func TestTemplateResolverForBundleExamplesRejectsEscapingTemplateDir(t *testing.T) {
+	// A template directory that escapes the cloned repo would load an arbitrary
+	// local template, so it must not be recorded as first-party.
+	for _, dir := range []string{
+		"../../../local-template",
+		// Starts inside the repo but escapes it after cleaning.
+		"./contrib/../../now-i-am-outside",
+		"/etc/local-template",
+	} {
+		t.Run(dir, func(t *testing.T) {
+			r := Resolver{
+				TemplatePathOrUrl: "https://github.com/databricks/bundle-examples",
+				TemplateDir:       dir,
+			}
+
+			tmpl, err := r.Resolve(t.Context())
+			require.NoError(t, err)
+			assert.IsType(t, &defaultWriter{}, tmpl.Writer)
+		})
+	}
+}
+
+func TestIsBundleExamplesRepo(t *testing.T) {
+	// Recognized across the common Git URL forms.
+	for _, url := range []string{
+		"https://github.com/databricks/bundle-examples",
+		"https://github.com/databricks/bundle-examples.git",
+		"https://github.com/databricks/bundle-examples/",
+		"git@github.com:databricks/bundle-examples.git",
+		"ssh://git@github.com/databricks/bundle-examples.git",
+		"ssh://git@github.com:22/databricks/bundle-examples.git",
+		// GitHub owner/repo names are case-insensitive.
+		"https://github.com/Databricks/Bundle-Examples",
+	} {
+		assert.True(t, isBundleExamplesRepo(url), url)
+	}
+
+	// Other repos, forks, hosts, owners and local paths must not match.
+	for _, url := range []string{
+		"https://github.com/databricks/cli",
+		"https://github.com/someone/bundle-examples",
+		"https://github.com/databricks/bundle-examples-fork",
+		"https://gitlab.com/databricks/bundle-examples",
+		"/local/bundle-examples",
+		// An "@" embedded in the path must not be mistaken for the host: this
+		// clones from attacker.example, not github.com.
+		"https://attacker.example/foo@github.com/databricks/bundle-examples",
+	} {
+		assert.False(t, isBundleExamplesRepo(url), url)
+	}
+}
+
 func TestTemplateResolverForCustomPath(t *testing.T) {
 	r := Resolver{
 		TemplatePathOrUrl: "/custom/path",
@@ -100,32 +186,63 @@ func TestTemplateResolverForCustomPath(t *testing.T) {
 	assert.Equal(t, "/config/file", tmpl.Writer.(*defaultWriter).configPath)
 }
 
-func TestBundleInitIsRepoUrl(t *testing.T) {
-	assert.True(t, IsRepoUrl("git@github.com:databricks/cli.git"))
-	assert.True(t, IsRepoUrl("https://github.com/databricks/cli.git"))
-
-	assert.False(t, IsRepoUrl("./local"))
-	assert.False(t, IsRepoUrl("foo"))
+func TestBundleInitIsGitRepoUrl(t *testing.T) {
+	// Supported
+	assert.True(t, IsGitRepoUrl("git@github.com:databricks/cli.git"))
+	assert.True(t, IsGitRepoUrl("https://github.com/databricks/cli.git"))
+	assert.True(t, IsGitRepoUrl("ssh://user@company.ghe.com/databricks/cli.git"))
+
+	// Unsupported
+	assert.False(t, IsGitRepoUrl("git://github.com/databricks/cli.git"))
+	assert.False(t, IsGitRepoUrl("http://github.com/databricks/cli.git"))
+	assert.False(t, IsGitRepoUrl("ftp://github.com/databricks/cli.git"))
+	assert.False(t, IsGitRepoUrl("ftps://github.com/databricks/cli.git"))
+
+	// Not git repos
+	assert.False(t, IsGitRepoUrl("./local"))
+	assert.False(t, IsGitRepoUrl("foo"))
+	assert.False(t, IsGitRepoUrl("github.com/databricks/cli.git"))
 }
 
 func TestResolveReader(t *testing.T) {
 	t.Run("builtin template", func(t *testing.T) {
-		reader, isGit := ResolveReader("default-python", "", "")
+		reader, isGit, err := ResolveReader("default-python", "", "")
+		require.NoError(t, err)
 		assert.False(t, isGit)
 		assert.Equal(t, &builtinReader{name: "default-python"}, reader)
 	})
 
-	t.Run("git URL", func(t *testing.T) {
-		reader, isGit := ResolveReader("https://github.com/example/repo", "/template", "v1.0")
-		assert.True(t, isGit)
-		gitReader := reader.(*gitReader)
-		assert.Equal(t, "https://github.com/example/repo", gitReader.gitUrl)
-		assert.Equal(t, "/template", gitReader.templateDir)
-		assert.Equal(t, "v1.0", gitReader.ref)
-	})
+	for _, url := range []string{
+		"https://github.com/example/repo",
+		"ssh://git@github.com/example/repo",
+		"git@github.com:example/repo",
+	} {
+		t.Run("git URL "+url, func(t *testing.T) {
+			reader, isGit, err := ResolveReader(url, "/template", "v1.0")
+			require.NoError(t, err)
+			assert.True(t, isGit)
+			gitReader := reader.(*gitReader)
+			assert.Equal(t, url, gitReader.gitUrl)
+			assert.Equal(t, "/template", gitReader.templateDir)
+			assert.Equal(t, "v1.0", gitReader.ref)
+		})
+	}
+
+	for _, url := range []string{
+		"http://github.com/example/repo",
+		"git://github.com/example/repo",
+		"ftp://github.com/example/repo",
+		"ftps://github.com/example/repo",
+	} {
+		t.Run("unsupported protocol "+url, func(t *testing.T) {
+			_, _, err := ResolveReader(url, "", "")
+			assert.ErrorContains(t, err, "unsupported protocol")
+		})
+	}
 
 	t.Run("local path", func(t *testing.T) {
-		reader, isGit := ResolveReader("/local/path", "", "")
+		reader, isGit, err := ResolveReader("/local/path", "", "")
+		require.NoError(t, err)
 		assert.False(t, isGit)
 		assert.Equal(t, "/local/path", reader.(*localReader).path)
 	})
diff --git a/libs/template/template.go b/libs/template/template.go
index dc30de4bd0c..be8e6a72cf2 100644
--- a/libs/template/template.go
+++ b/libs/template/template.go
@@ -30,73 +30,84 @@ const (
 	ExperimentalDefaultPython TemplateName = "experimental-default-python-vnext"
 	DefaultSql                TemplateName = "default-sql"
 	LakeflowPipelines         TemplateName = "lakeflow-pipelines"
+	LakeflowIntegrations      TemplateName = "lakeflow-integrations"
 	// CLIPipelines is deprecated. Use LakeflowPipelines instead
 	CLIPipelines TemplateName = "cli-pipelines"
 	DbtSql       TemplateName = "dbt-sql"
 	MlopsStacks  TemplateName = "mlops-stacks"
 	Pydabs       TemplateName = "pydabs"
+	AppKitApp    TemplateName = "app-appkit"
 	Custom       TemplateName = "custom"
 	Default      TemplateName = "default"
 )
 
+const appKitDescription = "Databricks App with AppKit (TypeScript)"
+
 var databricksTemplates = []Template{
 	{
 		name:        DefaultPython,
 		description: "The default Python template for Notebooks and Lakeflow",
 		Reader:      &builtinReader{name: string(DefaultPython)},
-		Writer:      &writerWithFullTelemetry{defaultWriter: defaultWriter{name: DefaultPython}},
+		Writer:      &writerWithFullTelemetry{name: DefaultPython},
 	},
 	{
 		name:        DefaultSql,
 		description: "The default SQL template for .sql files that run with Databricks SQL",
 		Reader:      &builtinReader{name: string(DefaultSql)},
-		Writer:      &writerWithFullTelemetry{defaultWriter: defaultWriter{name: DefaultSql}},
+		Writer:      &writerWithFullTelemetry{name: DefaultSql},
 	},
 	{
 		name:        DefaultMinimal,
 		description: "The minimal template, for advanced users",
+		aliases:     []string{"empty"},
 		Reader:      &builtinReader{name: string(DefaultMinimal)},
-		Writer:      &writerWithFullTelemetry{defaultWriter: defaultWriter{name: DefaultMinimal}},
+		Writer:      &writerWithFullTelemetry{name: DefaultMinimal},
 	},
 	{
 		name:        DefaultScala,
 		description: "The default Scala template for JAR jobs",
 		Reader:      &builtinReader{name: string(DefaultScala)},
-		Writer:      &writerWithFullTelemetry{defaultWriter: defaultWriter{name: DefaultScala}},
+		Writer:      &writerWithFullTelemetry{name: DefaultScala},
 	},
 	{
 		name:        LakeflowPipelines,
 		hidden:      true,
 		description: "The default template for Lakeflow Spark Declarative Pipelines",
 		Reader:      &builtinReader{name: string(LakeflowPipelines)},
-		Writer:      &writerWithFullTelemetry{defaultWriter: defaultWriter{name: LakeflowPipelines}},
+		Writer:      &writerWithFullTelemetry{name: LakeflowPipelines},
+	},
+	{
+		name:        LakeflowIntegrations,
+		description: "The template for Lakeflow integrations",
+		Reader:      &builtinReader{name: string(LakeflowIntegrations)},
+		Writer:      &writerWithFullTelemetry{name: LakeflowIntegrations},
 	},
 	{
 		name:        CLIPipelines,
 		hidden:      true,
 		description: "The default template for CLI pipelines",
 		Reader:      &builtinReader{name: string(LakeflowPipelines)},
-		Writer:      &writerWithFullTelemetry{defaultWriter: defaultWriter{name: CLIPipelines}},
+		Writer:      &writerWithFullTelemetry{name: CLIPipelines},
 	},
 	{
 		name:        DbtSql,
 		description: "The dbt SQL template (databricks.com/blog/delivering-cost-effective-data-real-time-dbt-and-databricks)",
 		Reader:      &builtinReader{name: string(DbtSql)},
-		Writer:      &writerWithFullTelemetry{defaultWriter: defaultWriter{name: DbtSql}},
+		Writer:      &writerWithFullTelemetry{name: DbtSql},
 	},
 	{
 		name:        MlopsStacks,
 		description: "The Databricks MLOps Stacks template (github.com/databricks/mlops-stacks)",
 		aliases:     []string{"mlops-stack"},
 		Reader:      &gitReader{gitUrl: "https://github.com/databricks/mlops-stacks", cloneFunc: git.Clone},
-		Writer:      &writerWithFullTelemetry{defaultWriter: defaultWriter{name: MlopsStacks}},
+		Writer:      &writerWithFullTelemetry{name: MlopsStacks},
 	},
 	{
 		name:        Pydabs,
 		hidden:      false,
 		description: "A variant of the 'default-python' template that defines resources in Python instead of YAML",
 		Reader:      &builtinReader{name: string(Pydabs)},
-		Writer:      &writerWithFullTelemetry{defaultWriter: defaultWriter{name: Pydabs}},
+		Writer:      &writerWithFullTelemetry{name: Pydabs},
 	},
 }
 
@@ -107,6 +118,7 @@ func HelpDescriptions() string {
 			lines = append(lines, fmt.Sprintf("- %s: %s", template.name, template.description))
 		}
 	}
+	lines = append(lines, fmt.Sprintf("- %s: %s", AppKitApp, appKitDescription))
 	return strings.Join(lines, "\n")
 }
 
@@ -124,6 +136,7 @@ func options() []cmdio.Tuple {
 		}
 		names = append(names, tuple)
 	}
+	names = append(names, cmdio.Tuple{Name: string(AppKitApp), Id: appKitDescription})
 
 	names = append(names, cmdio.Tuple{
 		Name: "custom...",
@@ -144,6 +157,9 @@ func SelectTemplate(ctx context.Context) (TemplateName, error) {
 	if description == customTemplateDescription {
 		return TemplateName(""), ErrCustomSelected
 	}
+	if description == appKitDescription {
+		return AppKitApp, nil
+	}
 
 	for _, template := range databricksTemplates {
 		if template.description == description {
diff --git a/libs/template/template_test.go b/libs/template/template_test.go
index 4692f0acb2a..728dd868d66 100644
--- a/libs/template/template_test.go
+++ b/libs/template/template_test.go
@@ -12,9 +12,11 @@ func TestTemplateHelpDescriptions(t *testing.T) {
 - default-sql: The default SQL template for .sql files that run with Databricks SQL
 - default-minimal: The minimal template, for advanced users
 - default-scala: The default Scala template for JAR jobs
+- lakeflow-integrations: The template for Lakeflow integrations
 - dbt-sql: The dbt SQL template (databricks.com/blog/delivering-cost-effective-data-real-time-dbt-and-databricks)
 - mlops-stacks: The Databricks MLOps Stacks template (github.com/databricks/mlops-stacks)
-- pydabs: A variant of the 'default-python' template that defines resources in Python instead of YAML`
+- pydabs: A variant of the 'default-python' template that defines resources in Python instead of YAML
+- app-appkit: Databricks App with AppKit (TypeScript)`
 	assert.Equal(t, expected, HelpDescriptions())
 }
 
@@ -24,9 +26,11 @@ func TestTemplateOptions(t *testing.T) {
 		{Name: "default-sql", Id: "The default SQL template for .sql files that run with Databricks SQL"},
 		{Name: "default-minimal", Id: "The minimal template, for advanced users"},
 		{Name: "default-scala", Id: "The default Scala template for JAR jobs"},
+		{Name: "lakeflow-integrations", Id: "The template for Lakeflow integrations"},
 		{Name: "dbt-sql", Id: "The dbt SQL template (databricks.com/blog/delivering-cost-effective-data-real-time-dbt-and-databricks)"},
 		{Name: "mlops-stacks", Id: "The Databricks MLOps Stacks template (github.com/databricks/mlops-stacks)"},
 		{Name: "pydabs", Id: "A variant of the 'default-python' template that defines resources in Python instead of YAML"},
+		{Name: "app-appkit", Id: "Databricks App with AppKit (TypeScript)"},
 		{Name: "custom...", Id: "Bring your own template"},
 	}
 	assert.Equal(t, expected, options())
@@ -84,4 +88,5 @@ func TestTemplateGetDatabricksTemplate(t *testing.T) {
 
 	// Assert aliases work.
 	assert.Equal(t, MlopsStacks, GetDatabricksTemplate(TemplateName("mlops-stack")).name)
+	assert.Equal(t, DefaultMinimal, GetDatabricksTemplate(TemplateName("empty")).name)
 }
diff --git a/libs/template/templates/common/library/agents.tmpl b/libs/template/templates/common/library/agents.tmpl
new file mode 100644
index 00000000000..bf3104f2ecb
--- /dev/null
+++ b/libs/template/templates/common/library/agents.tmpl
@@ -0,0 +1,36 @@
+{{- /*
+     * Template for the AGENTS.md file created in new projects.
+     *
+     * Goal for this file is to point agents to Databricks AI Tools for guidance.
+     * A secondary goal is to offer a placeholder to users to extend with their own instructions.
+     * It is a non-goal to inline all instructions.
+     *
+     */ -}}
+
+{{- define "agents_md" -}}
+# Declarative Automation Bundles Project
+
+This project uses Declarative Automation Bundles (DABs) for deployment. Add project-specific instructions below.
+
+## For AI Agents: Use Databricks AI Tools
+
+**BEFORE any other action, read the `databricks-core` skill.**
+
+It sets you up to work with this project reliably: CLI authentication, profile
+selection, data discovery, and the bundle deployment workflow. Without it,
+results are often slower and less accurate.
+
+If this skill is not available (Databricks AI Tools are not installed), you can install them for your coding agent in seconds:
+
+```bash
+databricks aitools install
+```
+
+If the CLI is not installed, see: https://docs.databricks.com/dev-tools/cli/install
+
+---
+
+## Project Instructions
+
+<!-- Add your project-specific instructions, coding conventions, or notes here -->
+{{- end -}}
diff --git a/libs/template/templates/common/library/experimental.tmpl b/libs/template/templates/common/library/experimental.tmpl
new file mode 100644
index 00000000000..2e08be2eb7c
--- /dev/null
+++ b/libs/template/templates/common/library/experimental.tmpl
@@ -0,0 +1,15 @@
+{{- /*
+     * Temporary opt-in for recording deployment history; remove once it is the default.
+     *
+     * The flag is passed in rather than read from the deployment_history helper here,
+     * because this shared library is parsed for every template, including by callers that
+     * register no helpers.
+     */ -}}
+
+{{- define "experimental_deployment_history" -}}
+{{- if .}}
+
+experimental:
+  deployment_history: true
+{{- end}}
+{{- end}}
diff --git a/libs/template/templates/dbt-sql/databricks_template_schema.json b/libs/template/templates/dbt-sql/databricks_template_schema.json
index c8212bdb1c2..17c93ca76e0 100644
--- a/libs/template/templates/dbt-sql/databricks_template_schema.json
+++ b/libs/template/templates/dbt-sql/databricks_template_schema.json
@@ -18,7 +18,7 @@
         "default_catalog": {
             "type": "string",
             "default": "{{default_catalog}}",
-            "pattern": "^\\w*$",
+            "pattern": "^(\\w[\\w-]*)?$",
             "pattern_match_failure_message": "Invalid catalog name.",
             "description": "\nPlease provide an initial catalog{{if eq (default_catalog) \"\"}} (leave blank when not using Unity Catalog){{end}}.\ndefault_catalog",
             "order": 3
@@ -43,7 +43,7 @@
             },
             "type": "string",
             "default": "default",
-            "pattern": "^\\w+$",
+            "pattern": "^\\w[\\w-]*$",
             "pattern_match_failure_message": "Invalid schema name.",
             "description": "\nPlease provide an initial schema during development.\ndefault_schema",
             "order": 5
diff --git a/libs/template/templates/dbt-sql/library/versions.tmpl b/libs/template/templates/dbt-sql/library/versions.tmpl
index cb393461f3f..69abefd83e2 100644
--- a/libs/template/templates/dbt-sql/library/versions.tmpl
+++ b/libs/template/templates/dbt-sql/library/versions.tmpl
@@ -1,14 +1,10 @@
 {{define "latest_lts_dbr_version" -}}
-  15.4.x-scala2.12
-{{- end}}
-
-{{define "latest_lts_db_connect_version_spec" -}}
-  >=15.4,<15.5
+  16.4.x-scala2.12
 {{- end}}
 
 {{/* The serverless environment version to use.
    * See https://docs.databricks.com/aws/en/release-notes/serverless/environment-version/
    */}}
 {{define "serverless_environment_version" -}}
-  4
+  5
 {{- end}}
diff --git a/libs/template/templates/dbt-sql/template/{{.project_name}}/AGENTS.md.tmpl b/libs/template/templates/dbt-sql/template/{{.project_name}}/AGENTS.md.tmpl
new file mode 100644
index 00000000000..4fdb4bba90c
--- /dev/null
+++ b/libs/template/templates/dbt-sql/template/{{.project_name}}/AGENTS.md.tmpl
@@ -0,0 +1 @@
+{{template "agents_md" .}}
diff --git a/libs/template/templates/dbt-sql/template/{{.project_name}}/databricks.yml.tmpl b/libs/template/templates/dbt-sql/template/{{.project_name}}/databricks.yml.tmpl
index 89e66ef929c..21c82234a83 100644
--- a/libs/template/templates/dbt-sql/template/{{.project_name}}/databricks.yml.tmpl
+++ b/libs/template/templates/dbt-sql/template/{{.project_name}}/databricks.yml.tmpl
@@ -4,6 +4,7 @@
 bundle:
   name: {{.project_name}}
   uuid: {{bundle_uuid}}
+{{- template "experimental_deployment_history" deployment_history}}
 
 include:
   - resources/*.yml
diff --git a/libs/template/templates/dbt-sql/template/{{.project_name}}/dbt_project.yml.tmpl b/libs/template/templates/dbt-sql/template/{{.project_name}}/dbt_project.yml.tmpl
index 91fb1be1b53..4d6fdbdcb92 100644
--- a/libs/template/templates/dbt-sql/template/{{.project_name}}/dbt_project.yml.tmpl
+++ b/libs/template/templates/dbt-sql/template/{{.project_name}}/dbt_project.yml.tmpl
@@ -6,7 +6,7 @@ config-version: 2
 profile: '{{.project_name}}'
 
 # These configurations specify where dbt should look for different types of files.
-# For Databricks asset bundles, we put everything in src, as you may have
+# For Declarative Automation Bundles, we put everything in src, as you may have
 # non-dbt resources in your project.
 model-paths: ["src/models"]
 analysis-paths: ["src/analyses"]
diff --git a/libs/template/templates/dbt-sql/template/{{.project_name}}/resources/{{.project_name}}.job.yml.tmpl b/libs/template/templates/dbt-sql/template/{{.project_name}}/resources/{{.project_name}}.job.yml.tmpl
index fede1892c73..41fe34fa4e3 100644
--- a/libs/template/templates/dbt-sql/template/{{.project_name}}/resources/{{.project_name}}.job.yml.tmpl
+++ b/libs/template/templates/dbt-sql/template/{{.project_name}}/resources/{{.project_name}}.job.yml.tmpl
@@ -46,7 +46,7 @@ resources:
           new_cluster:
             spark_version: {{template "latest_lts_dbr_version"}}
             node_type_id: {{smallest_node_type}}
-            data_security_mode: SINGLE_USER
+            data_security_mode: DATA_SECURITY_MODE_AUTO
             num_workers: 0
             spark_conf:
               spark.master: "local[*, 4]"
diff --git a/libs/template/templates/default-minimal/databricks_template_schema.json b/libs/template/templates/default-minimal/databricks_template_schema.json
index c6f5badc23a..0935684256b 100644
--- a/libs/template/templates/default-minimal/databricks_template_schema.json
+++ b/libs/template/templates/default-minimal/databricks_template_schema.json
@@ -1,6 +1,6 @@
 {
     "template_dir": "../default",
-    "welcome_message": "Welcome to the minimal Databricks Asset Bundle template!\n\nThis template creates a minimal project structure without sample code, ideal for advanced users.\n(For getting started with Python or SQL code, use the default-python or default-sql templates instead.)\n\nYour workspace at {{workspace_host}} is used for initialization.\n(See https://docs.databricks.com/dev-tools/cli/profiles.html for how to change your profile.)",
+    "welcome_message": "Welcome to the minimal Declarative Automation Bundle template!\n\nThis template creates a minimal project structure without sample code, ideal for advanced users.\n(For getting started with Python or SQL code, use the default-python or default-sql templates instead.)\n\nYour workspace at {{workspace_host}} is used for initialization.\n(See https://docs.databricks.com/dev-tools/cli/profiles.html for how to change your profile.)",
     "properties": {
         "template_name": {
             "//": "This property is always set to 'default-minimal'",
@@ -57,19 +57,21 @@
         "default_catalog": {
             "type": "string",
             "default": "{{if eq (default_catalog) \"\"}}hive_metastore{{else}}{{default_catalog}}{{end}}",
-            "pattern": "^\\w*$",
+            "pattern": "^(\\w[\\w-]*)?$",
             "pattern_match_failure_message": "Invalid catalog name.",
             "description": "Default catalog for any tables created by this project{{if eq (default_catalog) \"\"}} (leave blank when not using Unity Catalog){{end}}",
             "order": 6
         },
         "personal_schemas": {
+            "//": "Always 'yes' for default-minimal: development uses a personal schema based on the current user name",
+            "skip_prompt_if": {},
             "type": "string",
-            "description": "Use a personal schema for each user working on this project\n(this is recommended, your personal schema will be '{{.default_catalog}}.{{short_name}}')",
             "default": "yes",
             "enum": [
                 "yes",
                 "no, I will customize the schema configuration later in databricks.yml"
             ],
+            "description": "Use a personal schema for each user working on this project",
             "order": 7
         },
         "language_choice": {
@@ -79,15 +81,15 @@
             "enum": [
                 "python",
                 "sql",
-                "other"
+                "skip"
             ],
             "order": 8
         },
         "language": {
-            "//": "Derived from language_choice: for Python, pyproject.toml and tests are included; for others they are excluded",
+            "//": "Mirrors language_choice: 'python' includes pyproject.toml and tests, 'sql' includes SQL sources, 'skip' includes neither",
             "skip_prompt_if": {},
             "type": "string",
-            "default": "{{if eq .language_choice \"python\"}}python{{else}}sql{{end}}",
+            "default": "{{.language_choice}}",
             "description": "Derived language property for template logic",
             "order": 9
         },
diff --git a/libs/template/templates/default-python/databricks_template_schema.json b/libs/template/templates/default-python/databricks_template_schema.json
index 9099ceb4d89..d8d5e485ced 100644
--- a/libs/template/templates/default-python/databricks_template_schema.json
+++ b/libs/template/templates/default-python/databricks_template_schema.json
@@ -49,7 +49,7 @@
         "default_catalog": {
             "type": "string",
             "default": "{{if eq (default_catalog) \"\"}}hive_metastore{{else}}{{default_catalog}}{{end}}",
-            "pattern": "^\\w*$",
+            "pattern": "^(\\w[\\w-]*)?$",
             "pattern_match_failure_message": "Invalid catalog name.",
             "description": "Default catalog for any tables created by this project{{if eq (default_catalog) \"\"}} (leave blank when not using Unity Catalog){{end}}",
             "order": 6
diff --git a/libs/template/templates/default-scala/databricks_template_schema.json b/libs/template/templates/default-scala/databricks_template_schema.json
index ef46d2d0fa2..9501c56196d 100644
--- a/libs/template/templates/default-scala/databricks_template_schema.json
+++ b/libs/template/templates/default-scala/databricks_template_schema.json
@@ -26,7 +26,7 @@
     "default_catalog": {
       "type": "string",
       "default": "{{default_catalog}}",
-      "pattern": "^\\w*$",
+      "pattern": "^(\\w[\\w-]*)?$",
       "pattern_match_failure_message": "Invalid catalog name.",
       "description": "\nPlease provide an initial catalog{{if eq (default_catalog) \"\"}} (leave blank when not using Unity Catalog){{end}}.\ndefault_catalog",
       "order": 4
@@ -51,7 +51,7 @@
       },
       "type": "string",
       "default": "default",
-      "pattern": "^\\w+$",
+      "pattern": "^\\w[\\w-]*$",
       "pattern_match_failure_message": "Invalid schema name.",
       "description": "\nPlease provide an initial schema during development.\ndefault_schema",
       "order": 6
diff --git a/libs/template/templates/default-scala/library/template_variables.tmpl b/libs/template/templates/default-scala/library/template_variables.tmpl
index 136630ed0c7..497803e61d0 100644
--- a/libs/template/templates/default-scala/library/template_variables.tmpl
+++ b/libs/template/templates/default-scala/library/template_variables.tmpl
@@ -7,14 +7,23 @@
     0.241.0
 {{- end }}
 
+{{/* dbr_version selects the Databricks Connect client and DBR image.
+   */}}
 {{ define `dbr_version` -}}
-    17.0
+    17.3
 {{- end }}
 
 {{ define `scala_major_minor_version` -}}
     2.13
 {{- end }}
 
+{{/* DBR publishes version-specific Scala variants. Keep dbr_version and
+   * scala_major_minor_version compatible with the same DBR release.
+   */}}
+{{ define `spark_version` -}}
+    {{template `dbr_version` .}}.x-scala{{template `scala_major_minor_version` .}}
+{{- end }}
+
 {{ define `scala_version` -}}
     {{template `scala_major_minor_version` .}}.16
 {{- end}}
diff --git a/libs/template/templates/default-scala/template/{{.project_name}}/AGENTS.md.tmpl b/libs/template/templates/default-scala/template/{{.project_name}}/AGENTS.md.tmpl
new file mode 100644
index 00000000000..4fdb4bba90c
--- /dev/null
+++ b/libs/template/templates/default-scala/template/{{.project_name}}/AGENTS.md.tmpl
@@ -0,0 +1 @@
+{{template "agents_md" .}}
diff --git a/libs/template/templates/default-scala/template/{{.project_name}}/databricks.yml.tmpl b/libs/template/templates/default-scala/template/{{.project_name}}/databricks.yml.tmpl
index bfd50a1052d..749f2a4e993 100644
--- a/libs/template/templates/default-scala/template/{{.project_name}}/databricks.yml.tmpl
+++ b/libs/template/templates/default-scala/template/{{.project_name}}/databricks.yml.tmpl
@@ -1,8 +1,9 @@
-# This is a Databricks asset bundle definition for {{.project_name}}.
+# This is a Declarative Automation Bundle definition for {{.project_name}}.
 # See https://docs.databricks.com/dev-tools/bundles/index.html for documentation.
 bundle:
   name: {{.project_name}}
   uuid: {{bundle_uuid}}
+{{- template "experimental_deployment_history" deployment_history}}
 
 include:
   - resources/*.yml
diff --git a/libs/template/templates/default-scala/template/{{.project_name}}/resources/{{.project_name}}.job.yml.tmpl b/libs/template/templates/default-scala/template/{{.project_name}}/resources/{{.project_name}}.job.yml.tmpl
index 2fcd917be15..ed10b6f28f0 100644
--- a/libs/template/templates/default-scala/template/{{.project_name}}/resources/{{.project_name}}.job.yml.tmpl
+++ b/libs/template/templates/default-scala/template/{{.project_name}}/resources/{{.project_name}}.job.yml.tmpl
@@ -31,14 +31,14 @@ resources:
       environments:
         - environment_key: default
           spec:
-            environment_version: "4-scala-preview"
+            environment_version: "5"
             java_dependencies:
               - ${workspace.artifact_path}/.internal/{{.project_name}}-assembly-{{template `version` .}}.jar
 {{- else}}
       job_clusters:
         - job_cluster_key: job_cluster
           new_cluster:
-            spark_version: 17.3.x-scala2.13
+            spark_version: {{template `spark_version` .}}
             node_type_id: i3.xlarge
             autoscale:
               min_workers: 1
diff --git a/libs/template/templates/default-scala/template/{{.project_name}}/src/main/scala/com/examples/Main.scala b/libs/template/templates/default-scala/template/{{.project_name}}/src/main/scala/com/examples/Main.scala
index a0068937c55..e1433db22b1 100644
--- a/libs/template/templates/default-scala/template/{{.project_name}}/src/main/scala/com/examples/Main.scala
+++ b/libs/template/templates/default-scala/template/{{.project_name}}/src/main/scala/com/examples/Main.scala
@@ -21,12 +21,12 @@ object Main {
 
   private def setCatalogAndSchema(spark: SparkSession, args: Array[String]): Unit = {
     getFromArgs(args, "catalog").foreach { catalog =>
-      spark.sql(s"USE CATALOG $catalog")
+      spark.sql(s"USE CATALOG `$catalog`")
       println(s"Using catalog: $catalog")
     }
 
     getFromArgs(args, "schema").foreach { schema =>
-      spark.sql(s"USE SCHEMA $schema")
+      spark.sql(s"USE SCHEMA `$schema`")
       println(s"Using schema: $schema")
     }
   }
diff --git a/libs/template/templates/default-sql/databricks_template_schema.json b/libs/template/templates/default-sql/databricks_template_schema.json
index 35a7b972d30..c6f66d495a8 100644
--- a/libs/template/templates/default-sql/databricks_template_schema.json
+++ b/libs/template/templates/default-sql/databricks_template_schema.json
@@ -18,7 +18,7 @@
         "default_catalog": {
             "type": "string",
             "default": "{{if eq (default_catalog) \"\"}}hive_metastore{{else}}{{default_catalog}}{{end}}",
-            "pattern": "^\\w*$",
+            "pattern": "^(\\w[\\w-]*)?$",
             "pattern_match_failure_message": "Invalid catalog name.",
             "description": "\nPlease provide an initial catalog{{if eq (default_catalog) \"\"}} or metastore{{end}}.\ndefault_catalog",
             "order": 3
@@ -43,7 +43,7 @@
             },
             "type": "string",
             "default": "default",
-            "pattern": "^\\w+$",
+            "pattern": "^\\w[\\w-]*$",
             "pattern_match_failure_message": "Invalid schema name.",
             "description": "\nPlease provide an initial schema during development.\ndefault_schema",
             "order": 5
diff --git a/libs/template/templates/default-sql/library/versions.tmpl b/libs/template/templates/default-sql/library/versions.tmpl
deleted file mode 100644
index 7d0c88e7df4..00000000000
--- a/libs/template/templates/default-sql/library/versions.tmpl
+++ /dev/null
@@ -1,7 +0,0 @@
-{{define "latest_lts_dbr_version" -}}
-  15.4.x-scala2.12
-{{- end}}
-
-{{define "latest_lts_db_connect_version_spec" -}}
-  >=15.4,<15.5
-{{- end}}
diff --git a/libs/template/templates/default-sql/template/{{.project_name}}/AGENTS.md.tmpl b/libs/template/templates/default-sql/template/{{.project_name}}/AGENTS.md.tmpl
new file mode 100644
index 00000000000..4fdb4bba90c
--- /dev/null
+++ b/libs/template/templates/default-sql/template/{{.project_name}}/AGENTS.md.tmpl
@@ -0,0 +1 @@
+{{template "agents_md" .}}
diff --git a/libs/template/templates/default-sql/template/{{.project_name}}/databricks.yml.tmpl b/libs/template/templates/default-sql/template/{{.project_name}}/databricks.yml.tmpl
index 6acdf40e78e..0645de3dadf 100644
--- a/libs/template/templates/default-sql/template/{{.project_name}}/databricks.yml.tmpl
+++ b/libs/template/templates/default-sql/template/{{.project_name}}/databricks.yml.tmpl
@@ -1,8 +1,9 @@
-# This is a Databricks asset bundle definition for {{.project_name}}.
+# This is a Declarative Automation Bundle definition for {{.project_name}}.
 # See https://docs.databricks.com/dev-tools/bundles/index.html for documentation.
 bundle:
   name: {{.project_name}}
   uuid: {{bundle_uuid}}
+{{- template "experimental_deployment_history" deployment_history}}
 
 include:
   - resources/*.yml
diff --git a/libs/template/templates/default-sql/template/{{.project_name}}/src/orders_daily.sql.tmpl b/libs/template/templates/default-sql/template/{{.project_name}}/src/orders_daily.sql.tmpl
index 913f030f339..753440f3c8c 100644
--- a/libs/template/templates/default-sql/template/{{.project_name}}/src/orders_daily.sql.tmpl
+++ b/libs/template/templates/default-sql/template/{{.project_name}}/src/orders_daily.sql.tmpl
@@ -1,6 +1,6 @@
 -- This query is executed using Databricks Jobs (see resources/{{.project_name}}_sql.job.yml)
 
-USE CATALOG {{"{{"}}catalog{{"}}"}};
+USE CATALOG `{{"{{"}}catalog{{"}}"}}`;
 USE IDENTIFIER({{"{{"}}schema{{"}}"}});
 
 CREATE OR REPLACE MATERIALIZED VIEW
diff --git a/libs/template/templates/default-sql/template/{{.project_name}}/src/orders_raw.sql.tmpl b/libs/template/templates/default-sql/template/{{.project_name}}/src/orders_raw.sql.tmpl
index f95e11e20a8..4febf57fd34 100644
--- a/libs/template/templates/default-sql/template/{{.project_name}}/src/orders_raw.sql.tmpl
+++ b/libs/template/templates/default-sql/template/{{.project_name}}/src/orders_raw.sql.tmpl
@@ -3,7 +3,7 @@
 -- The streaming table below ingests all JSON files in /databricks-datasets/retail-org/sales_orders/
 -- See also https://docs.databricks.com/sql/language-manual/sql-ref-syntax-ddl-create-streaming-table.html
 
-USE CATALOG {{"{{"}}catalog{{"}}"}};
+USE CATALOG `{{"{{"}}catalog{{"}}"}}`;
 USE IDENTIFIER({{"{{"}}schema{{"}}"}});
 
 CREATE OR REFRESH STREAMING TABLE
diff --git a/libs/template/templates/default/library/versions.tmpl b/libs/template/templates/default/library/versions.tmpl
index d5b845c6a8c..8d1724c3e10 100644
--- a/libs/template/templates/default/library/versions.tmpl
+++ b/libs/template/templates/default/library/versions.tmpl
@@ -5,40 +5,41 @@
   16.4.x-scala2.12
 {{- end}}
 
-{{/* A safe version of DB Connect that is compatible with at least half the
-   * clusters running in production.
+{{/* A conservative version of DB Connect for local development.
    *
-   * We need to be very conservative in updating this, since a newer version can
-   * only connect to compute of that same version and higher. If the version is
-   * deemed too old, customers can update the version themselves after initializing
-   * the template.
+   * DB Connect is only forward-compatible: a client connects to compute of the
+   * same version and higher. We keep this conservative (low) so a freshly
+   * initialized project can reach the widest range of DBR versions; a high
+   * version would rule out customers on older DBR. Customers can move to a
+   * newer version themselves after initializing the template. This pin must
+   * stay compatible with python_version_spec and serverless_environment_version
+   * below.
    *
-   * See https://docs.databricks.com/dev-tools/databricks-connect/python/index.html#requirements
+   * See .agents/rules/template-versions.md before changing this, and
+   * https://docs.databricks.com/dev-tools/databricks-connect/python/index.html#requirements
    * for DB Connect release notes and version compatibility.
    */}}
 {{define "conservative_db_connect_version_spec" -}}
-  >=15.4,<15.5
+  >=16.4,<16.5
 {{- end}}
 
 {{/* The serverless environment version to use.
-   * See https://docs.databricks.com/release-notes/runtime/index.html for available versions.
+   * See https://docs.databricks.com/aws/en/release-notes/serverless/environment-version/
+   * for available versions.
    */}}
 {{define "serverless_environment_version" -}}
-  4
+  5
 {{- end}}
 
 {{/* Python version specification for the template.
    * This needs to be compatible with the version of DB Connect and the serverless_environment_version.
    *
-   * Serverless environment version 4 (and upcoming v5), DBR 16, and DBR 17 all use Python 3.12.
-   * DB Connect 15 supports all of these and is compatible with Python 3.10-3.12.
-   *
-   * We use >=3.10,<3.13 rather than pinning to 3.12 specifically because overly narrow pinning
-   * means users always need to use uv or similar tools to install the exact version. A broader
-   * range improves usability while maintaining compatibility with both DB Connect and serverless.
+   * Serverless environment versions 4 and 5, DBR 16, and DBR 17 all use Python 3.12.
+   * DB Connect 16.4 requires Python 3.12, so we pin the project to 3.12 to match both
+   * DB Connect and the serverless runtime.
    */}}
 {{define "python_version_spec" -}}
-  >=3.10,<3.13
+  >=3.12,<3.13
 {{- end}}
 
 {{/* The default Python version used in notebook metadata.
@@ -47,4 +48,4 @@
   3.12
 {{- end}}
 
-{{define "latest_databricks_bundles_version" -}}0.299.0{{- end}}
+{{define "latest_databricks_bundles_version" -}}1.22.1{{- end}}
diff --git a/libs/template/templates/default/template/__preamble.tmpl b/libs/template/templates/default/template/__preamble.tmpl
index b3f1d25039c..5bbdc888e2b 100644
--- a/libs/template/templates/default/template/__preamble.tmpl
+++ b/libs/template/templates/default/template/__preamble.tmpl
@@ -8,6 +8,7 @@ This file only contains template directives; it is skipped for the actual output
 {{$notebook_job := eq .include_job "yes"}}
 {{$python_package := eq .include_python "yes"}}
 {{$sql_language := eq .language "sql"}}
+{{$python_language := eq .language "python"}}
 {{$lakeflow_only := eq .lakeflow_only "yes"}}
 {{$pydabs := eq .enable_pydabs "yes"}}
 {{$has_python_package_dir := and (or $python_package $notebook_job $pipeline) (not $lakeflow_only)}}
@@ -35,15 +36,16 @@ This file only contains template directives; it is skipped for the actual output
   {{skip "{{.project_name}}/src/{{.project_name}}_etl/transformations/*.sql"}}
 {{end}}
 
-{{if or $sql_language $lakeflow_only}}
+{{if or (not $python_language) $lakeflow_only}}
   {{skip "{{.project_name}}/tests"}}
   {{skip "{{.project_name}}/fixtures"}}
 {{else if not (or $python_package $notebook_job $pipeline)}}
   {{skip "{{.project_name}}/tests/sample_*.py"}}
 {{end}}
 
-{{if $sql_language}}
+{{if not $python_language}}
   {{skip "{{.project_name}}/pyproject.toml"}}
+  {{skip "{{.project_name}}/.vscode/__builtins__.pyi"}}
 {{end}}
 
 {{if $pydabs}}
diff --git a/libs/template/templates/default/template/{{.project_name}}/.gitignore.tmpl b/libs/template/templates/default/template/{{.project_name}}/.gitignore.tmpl
index e566c51f740..e400f0256cc 100644
--- a/libs/template/templates/default/template/{{.project_name}}/.gitignore.tmpl
+++ b/libs/template/templates/default/template/{{.project_name}}/.gitignore.tmpl
@@ -1,9 +1,11 @@
 .databricks/
+{{- if eq .language "python"}}
 build/
 dist/
 __pycache__/
 *.egg-info
 .venv/
+{{- end}}
 scratch/**
 !scratch/README.md
 **/explorations/**
diff --git a/libs/template/templates/default/template/{{.project_name}}/.vscode/extensions.json b/libs/template/templates/default/template/{{.project_name}}/.vscode/extensions.json
deleted file mode 100644
index 5ba48e79c9b..00000000000
--- a/libs/template/templates/default/template/{{.project_name}}/.vscode/extensions.json
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-    "recommendations": [
-        "databricks.databricks",
-        "redhat.vscode-yaml",
-        "charliermarsh.ruff"
-    ]
-}
diff --git a/libs/template/templates/default/template/{{.project_name}}/.vscode/extensions.json.tmpl b/libs/template/templates/default/template/{{.project_name}}/.vscode/extensions.json.tmpl
new file mode 100644
index 00000000000..f1cf722e7fc
--- /dev/null
+++ b/libs/template/templates/default/template/{{.project_name}}/.vscode/extensions.json.tmpl
@@ -0,0 +1,9 @@
+{
+    "recommendations": [
+{{- if eq .language "python"}}
+        "charliermarsh.ruff",
+{{- end}}
+        "databricks.databricks",
+        "redhat.vscode-yaml"
+    ]
+}
diff --git a/libs/template/templates/default/template/{{.project_name}}/.vscode/settings.json b/libs/template/templates/default/template/{{.project_name}}/.vscode/settings.json
deleted file mode 100644
index d73c73b5705..00000000000
--- a/libs/template/templates/default/template/{{.project_name}}/.vscode/settings.json
+++ /dev/null
@@ -1,39 +0,0 @@
-{
-    "jupyter.interactiveWindow.cellMarker.codeRegex": "^# COMMAND ----------|^# Databricks notebook source|^(#\\s*%%|#\\s*\\<codecell\\>|#\\s*In\\[\\d*?\\]|#\\s*In\\[ \\])",
-    "jupyter.interactiveWindow.cellMarker.default": "# COMMAND ----------",
-    "python.testing.pytestArgs": [
-        "."
-    ],
-    "files.exclude": {
-        "**/*.egg-info": true,
-        "**/__pycache__": true,
-        ".pytest_cache": true,
-        "dist": true,
-    },
-    "files.associations": {
-        "**/.gitkeep": "markdown"
-    },
-
-    // Pylance settings (VS Code)
-    // Set typeCheckingMode to "basic" to enable type checking!
-    "python.analysis.typeCheckingMode": "off",
-    "python.analysis.extraPaths": ["src", "lib", "resources"],
-    "python.analysis.diagnosticMode": "workspace",
-    "python.analysis.stubPath": ".vscode",
-
-    // Pyright settings (Cursor)
-    // Set typeCheckingMode to "basic" to enable type checking!
-    "cursorpyright.analysis.typeCheckingMode": "off",
-    "cursorpyright.analysis.extraPaths": ["src", "lib", "resources"],
-    "cursorpyright.analysis.diagnosticMode": "workspace",
-    "cursorpyright.analysis.stubPath": ".vscode",
-
-    // General Python settings
-    "python.defaultInterpreterPath": "./.venv/bin/python",
-    "python.testing.unittestEnabled": false,
-    "python.testing.pytestEnabled": true,
-    "[python]": {
-        "editor.defaultFormatter": "charliermarsh.ruff",
-        "editor.formatOnSave": true,
-    },
-}
diff --git a/libs/template/templates/default/template/{{.project_name}}/.vscode/settings.json.tmpl b/libs/template/templates/default/template/{{.project_name}}/.vscode/settings.json.tmpl
new file mode 100644
index 00000000000..e1dae324628
--- /dev/null
+++ b/libs/template/templates/default/template/{{.project_name}}/.vscode/settings.json.tmpl
@@ -0,0 +1,43 @@
+{
+{{- if eq .language "python"}}
+    "jupyter.interactiveWindow.cellMarker.codeRegex": "^# COMMAND ----------|^# Databricks notebook source|^(#\\s*%%|#\\s*\\<codecell\\>|#\\s*In\\[\\d*?\\]|#\\s*In\\[ \\])",
+    "jupyter.interactiveWindow.cellMarker.default": "# COMMAND ----------",
+    "python.testing.pytestArgs": [
+        "."
+    ],
+    "files.exclude": {
+        "**/*.egg-info": true,
+        "**/__pycache__": true,
+        ".pytest_cache": true,
+        "dist": true,
+    },
+{{- end}}
+    "files.associations": {
+        "**/.gitkeep": "markdown"
+    },
+{{- if eq .language "python"}}
+
+    // Pylance settings (VS Code)
+    // Set typeCheckingMode to "basic" to enable type checking!
+    "python.analysis.typeCheckingMode": "off",
+    "python.analysis.extraPaths": ["src", "lib", "resources"],
+    "python.analysis.diagnosticMode": "workspace",
+    "python.analysis.stubPath": ".vscode",
+
+    // Pyright settings (Cursor)
+    // Set typeCheckingMode to "basic" to enable type checking!
+    "cursorpyright.analysis.typeCheckingMode": "off",
+    "cursorpyright.analysis.extraPaths": ["src", "lib", "resources"],
+    "cursorpyright.analysis.diagnosticMode": "workspace",
+    "cursorpyright.analysis.stubPath": ".vscode",
+
+    // General Python settings
+    "python.defaultInterpreterPath": "./.venv/bin/python",
+    "python.testing.unittestEnabled": false,
+    "python.testing.pytestEnabled": true,
+    "[python]": {
+        "editor.defaultFormatter": "charliermarsh.ruff",
+        "editor.formatOnSave": true,
+    },
+{{- end}}
+}
diff --git a/libs/template/templates/default/template/{{.project_name}}/AGENTS.md.tmpl b/libs/template/templates/default/template/{{.project_name}}/AGENTS.md.tmpl
new file mode 100644
index 00000000000..4fdb4bba90c
--- /dev/null
+++ b/libs/template/templates/default/template/{{.project_name}}/AGENTS.md.tmpl
@@ -0,0 +1 @@
+{{template "agents_md" .}}
diff --git a/libs/template/templates/default/template/{{.project_name}}/README.md.tmpl b/libs/template/templates/default/template/{{.project_name}}/README.md.tmpl
index bca68edc2fb..486df502f4e 100644
--- a/libs/template/templates/default/template/{{.project_name}}/README.md.tmpl
+++ b/libs/template/templates/default/template/{{.project_name}}/README.md.tmpl
@@ -1,12 +1,12 @@
 # {{.project_name}}
 
-{{- $skip_tests := or (eq .language "sql") (eq .lakeflow_only "yes")}}
+{{- $skip_tests := or (ne .language "python") (eq .lakeflow_only "yes")}}
 {{- $has_python_package_dir := and (or (eq .include_python "yes") (eq .include_job "yes") (eq .include_pipeline "yes")) (not (eq .lakeflow_only "yes"))}}
 {{- $is_lakeflow := eq .lakeflow_only "yes"}}
 
 The '{{.project_name}}' project was generated by using the {{.template_name}} template.
 
-* `src/`: {{if eq .language "sql"}}SQL{{else}}Python{{end}} source code for this project.
+* `src/`: {{if eq .language "sql"}}SQL{{else if eq .language "python"}}Python{{else}}Any{{end}} source code for this project.
 {{- if $has_python_package_dir}}
   * `src/{{.project_name}}/`: Shared Python code that can be used by jobs and pipelines.
 {{- end}}
@@ -28,7 +28,7 @@ Choose how you want to work on this project:
 
 (c) With command line tools, see https://docs.databricks.com/dev-tools/cli/databricks-cli.html
 
-{{- if not $is_lakeflow}}
+{{- if and (eq .language "python") (not $is_lakeflow)}}
 
 If you're developing with an IDE, dependencies for this project should be installed using uv:
 
diff --git a/libs/template/templates/default/template/{{.project_name}}/databricks.yml.tmpl b/libs/template/templates/default/template/{{.project_name}}/databricks.yml.tmpl
index 5849ae7a39a..73cddd42052 100644
--- a/libs/template/templates/default/template/{{.project_name}}/databricks.yml.tmpl
+++ b/libs/template/templates/default/template/{{.project_name}}/databricks.yml.tmpl
@@ -1,11 +1,12 @@
 {{$with_classic := (ne .serverless "yes") -}}
 {{$with_python := (eq .include_python "yes") -}}
 {{$with_pydabs := (eq .enable_pydabs "yes") -}}
-# This is a Databricks asset bundle definition for {{.project_name}}.
+# This is a Declarative Automation Bundle definition for {{.project_name}}.
 # See https://docs.databricks.com/dev-tools/bundles/index.html for documentation.
 bundle:
   name: {{.project_name}}
   uuid: {{bundle_uuid}}
+{{- template "experimental_deployment_history" deployment_history}}
 {{- if $with_pydabs }}
 
 python:
diff --git a/libs/template/templates/default/template/{{.project_name}}/resources/sample_job.job.yml.tmpl b/libs/template/templates/default/template/{{.project_name}}/resources/sample_job.job.yml.tmpl
index 2a80e04e87e..09c8a39e069 100644
--- a/libs/template/templates/default/template/{{.project_name}}/resources/sample_job.job.yml.tmpl
+++ b/libs/template/templates/default/template/{{.project_name}}/resources/sample_job.job.yml.tmpl
@@ -109,7 +109,7 @@ resources:
           new_cluster:
             spark_version: {{template "latest_lts_dbr_version"}}
             node_type_id: {{smallest_node_type}}
-            data_security_mode: SINGLE_USER
+            data_security_mode: DATA_SECURITY_MODE_AUTO
             autoscale:
               min_workers: 1
               max_workers: 4
diff --git a/libs/template/templates/default/template/{{.project_name}}/resources/sample_job.py.tmpl b/libs/template/templates/default/template/{{.project_name}}/resources/sample_job.py.tmpl
index ef80b974947..1bd9b80b968 100644
--- a/libs/template/templates/default/template/{{.project_name}}/resources/sample_job.py.tmpl
+++ b/libs/template/templates/default/template/{{.project_name}}/resources/sample_job.py.tmpl
@@ -135,7 +135,7 @@ sample_job = Job.from_dict(
                 "new_cluster": {
                     "spark_version": "{{template "latest_lts_dbr_version"}}",
                     "node_type_id": "{{smallest_node_type}}",
-                    "data_security_mode": "SINGLE_USER",
+                    "data_security_mode": "DATA_SECURITY_MODE_AUTO",
                     "autoscale": {
                         "min_workers": 1,
                         "max_workers": 4,
diff --git a/libs/template/templates/default/template/{{.project_name}}/src/sample_notebook.ipynb.tmpl b/libs/template/templates/default/template/{{.project_name}}/src/sample_notebook.ipynb.tmpl
index 63d00ba51a3..2ad2148574d 100644
--- a/libs/template/templates/default/template/{{.project_name}}/src/sample_notebook.ipynb.tmpl
+++ b/libs/template/templates/default/template/{{.project_name}}/src/sample_notebook.ipynb.tmpl
@@ -34,8 +34,8 @@
     "# Set default catalog and schema\n",
     "catalog = dbutils.widgets.get(\"catalog\")\n",
     "schema = dbutils.widgets.get(\"schema\")\n",
-    "spark.sql(f\"USE CATALOG {catalog}\")\n",
-    "spark.sql(f\"USE SCHEMA {schema}\")"
+    "spark.sql(f\"USE CATALOG `{catalog}`\")\n",
+    "spark.sql(f\"USE SCHEMA `{schema}`\")"
    ]
   },
   {
diff --git a/libs/template/templates/default/template/{{.project_name}}/src/{{.project_name}}/main.py.tmpl b/libs/template/templates/default/template/{{.project_name}}/src/{{.project_name}}/main.py.tmpl
index ce6475f26e1..d327f4b5064 100644
--- a/libs/template/templates/default/template/{{.project_name}}/src/{{.project_name}}/main.py.tmpl
+++ b/libs/template/templates/default/template/{{.project_name}}/src/{{.project_name}}/main.py.tmpl
@@ -13,8 +13,8 @@ def main():
     args = parser.parse_args()
 
     # Set the default catalog and schema
-    spark.sql(f"USE CATALOG {args.catalog}")
-    spark.sql(f"USE SCHEMA {args.schema}")
+    spark.sql(f"USE CATALOG `{args.catalog}`")
+    spark.sql(f"USE SCHEMA `{args.schema}`")
 
     # Example: just find all taxis from a sample catalog
     taxis.find_all_taxis().show(5)
diff --git a/libs/template/templates/default/template/{{.project_name}}/src/{{.project_name}}_etl/README.md.tmpl b/libs/template/templates/default/template/{{.project_name}}/src/{{.project_name}}_etl/README.md.tmpl
index dce58668879..6adc0a43d39 100644
--- a/libs/template/templates/default/template/{{.project_name}}/src/{{.project_name}}_etl/README.md.tmpl
+++ b/libs/template/templates/default/template/{{.project_name}}/src/{{.project_name}}_etl/README.md.tmpl
@@ -15,6 +15,6 @@ To get started, go to the `transformations` folder -- most of the relevant sourc
 * Take a look at the sample called "sample_trips_{{.project_name}}.py" to get familiar with the syntax.
   Read more about the syntax at https://docs.databricks.com/dlt/python-ref.html.
 * If you're using the workspace UI, use `Run file` to run and preview a single transformation.
-* If you're using the CLI, use `databricks bundle run {{.project_name}}_etl --select sample_trips_{{.project_name}}` to run a single transformation.
+* If you're using the CLI, use `databricks bundle run {{.project_name}}_etl --refresh sample_trips_{{.project_name}}` to run a single transformation.
 
 For more tutorials and reference material, see https://docs.databricks.com/dlt.
diff --git a/libs/template/templates/lakeflow-integrations/databricks_template_schema.json b/libs/template/templates/lakeflow-integrations/databricks_template_schema.json
new file mode 100644
index 00000000000..f2f047630b0
--- /dev/null
+++ b/libs/template/templates/lakeflow-integrations/databricks_template_schema.json
@@ -0,0 +1,22 @@
+{
+    "welcome_message": "Welcome to the Lakeflow integrations template!\n",
+    "properties": {
+        "template_name": {
+            "//": "This property is always set to 'lakeflow-integrations'",
+            "skip_prompt_if": {},
+            "type": "string",
+            "default": "lakeflow-integrations",
+            "description": "Template name for documentation",
+            "order": 0
+        },
+        "project_name": {
+            "type": "string",
+            "default": "my_project",
+            "description": "\nUnique name for this project",
+            "order": 1,
+            "pattern": "^[a-z0-9_]+$",
+            "pattern_match_failure_message": "Name must consist of lower case letters, numbers, and underscores."
+        }
+    },
+    "success_message": "\n✨ Your new project has been created in the '{{.project_name}}' directory!\n\nPlease refer to the README.md file for \"getting started\" instructions."
+}
diff --git a/libs/template/templates/lakeflow-integrations/template/{{.project_name}}/.gitignore.tmpl b/libs/template/templates/lakeflow-integrations/template/{{.project_name}}/.gitignore.tmpl
new file mode 100644
index 00000000000..4a0b67f112d
--- /dev/null
+++ b/libs/template/templates/lakeflow-integrations/template/{{.project_name}}/.gitignore.tmpl
@@ -0,0 +1,7 @@
+.databricks/
+build/
+dist/
+__pycache__/
+*.egg-info
+.venv/
+__generated__/
diff --git a/libs/template/templates/lakeflow-integrations/template/{{.project_name}}/README.md.tmpl b/libs/template/templates/lakeflow-integrations/template/{{.project_name}}/README.md.tmpl
new file mode 100644
index 00000000000..f1914db34d2
--- /dev/null
+++ b/libs/template/templates/lakeflow-integrations/template/{{.project_name}}/README.md.tmpl
@@ -0,0 +1,24 @@
+# {{.project_name}}
+
+A Declarative Automation Bundles project that extends Lakeflow Jobs with custom integrations.
+
+This bundle ships with runnable examples under `src/{{.project_name}}/examples/` and
+corresponding job definitions under `resources/`:
+
+| Example | Type | What it does |
+| --- | --- | --- |
+| `slack.send_slack_message` | Function | Posts a message to Slack through a Unity Catalog connection. |
+| `wait_for_run_sensor.WaitForRunSensor` | Sensor | Polls a job run until it reaches a terminal state. |
+
+## Getting started
+
+1. Open this bundle in a Databricks workspace.
+2. Click the **deployments rocket** 🚀 in the left sidebar to open the
+   **Deployments** panel, then click **Deploy**.
+3. To run a deployed job, hover over the resource in the **Deployments** panel
+   and click **Run**.
+
+## Documentation
+
+* [Declarative Automation Bundles](https://docs.databricks.com/aws/en/dev-tools/bundles/workspace-bundles)
+* [Declarative Automation Bundles configuration reference](https://docs.databricks.com/aws/en/dev-tools/bundles/reference)
diff --git a/libs/template/templates/lakeflow-integrations/template/{{.project_name}}/databricks.yml.tmpl b/libs/template/templates/lakeflow-integrations/template/{{.project_name}}/databricks.yml.tmpl
new file mode 100644
index 00000000000..8087d648d4d
--- /dev/null
+++ b/libs/template/templates/lakeflow-integrations/template/{{.project_name}}/databricks.yml.tmpl
@@ -0,0 +1,50 @@
+# This is a Declarative Automation Bundle definition for {{.project_name}}.
+# See https://docs.databricks.com/dev-tools/bundles/index.html for documentation.
+bundle:
+  name: {{.project_name}}
+  uuid: {{bundle_uuid}}
+  engine: direct
+{{- template "experimental_deployment_history" deployment_history}}
+
+include:
+  - resources/*.yml
+
+artifacts:
+  python_artifact:
+    type: whl
+    build: uv build --wheel
+  lakeflow_integrations_yaml:
+    # inlined Python so the build is portable across Linux/Mac/Windows
+    build: >
+      uv run python -c "import shutil;
+      shutil.rmtree('__generated__', ignore_errors=True);
+      from databricks.lakeflow.integrations.generator.generate import main;
+      main([
+        '--package-module', '{{.project_name}}',
+        '--output-dir', '__generated__',
+        '--environment-version', '5',
+        '--environment-key', '{{.project_name}}_environment',
+        '--dependency', '${workspace.artifact_path}/.internal/{{.project_name}}-0.0.1-py3-none-any.whl',
+      ])"
+    files:
+      - {"source": "__generated__/*.yml",}
+
+targets:
+  dev:
+    # The default target uses 'mode: development' to create a development copy.
+    # - Deployed resources get prefixed with '[dev my_user_name]'
+    # - Any job schedules and triggers are paused by default.
+    # See also https://docs.databricks.com/dev-tools/bundles/deployment-modes.html.
+    mode: development
+    default: true
+    workspace:
+      host: {{workspace_host}}
+  prod:
+    mode: production
+    workspace:
+      host: {{workspace_host}}
+      # We explicitly deploy to /Workspace/Users/{{user_name}} to make sure we only have a single copy.
+      root_path: /Workspace/Users/{{user_name}}/.bundle/${bundle.name}/${bundle.target}
+    permissions:
+      - {{if is_service_principal}}service_principal{{else}}user{{end}}_name: {{user_name}}
+        level: CAN_MANAGE
diff --git a/libs/template/templates/lakeflow-integrations/template/{{.project_name}}/pyproject.toml.tmpl b/libs/template/templates/lakeflow-integrations/template/{{.project_name}}/pyproject.toml.tmpl
new file mode 100644
index 00000000000..df79b0849be
--- /dev/null
+++ b/libs/template/templates/lakeflow-integrations/template/{{.project_name}}/pyproject.toml.tmpl
@@ -0,0 +1,29 @@
+[project]
+name = "{{.project_name}}"
+version = "0.0.1"
+authors = []
+requires-python = ">=3.12,<3.13"
+dependencies = [
+    # Any dependencies for jobs and pipelines in this project can be added here
+    # See also https://docs.databricks.com/dev-tools/bundles/library-dependencies
+    "databricks-lakeflow-integrations>=0.0.3,<0.1",
+]
+
+[tool.hatch.build.targets.wheel]
+packages = [
+    "src/{{.project_name}}",
+]
+
+[dependency-groups]
+dev = [
+    # libraries part of serverless environment
+    "requests",
+    "databricks-sdk"
+]
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.ruff]
+line-length = 120
diff --git a/libs/template/templates/lakeflow-integrations/template/{{.project_name}}/resources/send_slack_message.job.yml.tmpl b/libs/template/templates/lakeflow-integrations/template/{{.project_name}}/resources/send_slack_message.job.yml.tmpl
new file mode 100644
index 00000000000..e34209ec0c1
--- /dev/null
+++ b/libs/template/templates/lakeflow-integrations/template/{{.project_name}}/resources/send_slack_message.job.yml.tmpl
@@ -0,0 +1,24 @@
+resources:
+  jobs:
+    send_slack_message:
+      name: "[example] send_slack_message"
+
+      tasks:
+        - task_key: slack
+          environment_key: {{.project_name}}_environment
+          python_operator_task:
+            main: {{.project_name}}.examples.slack.send_slack_message
+            parameters:
+              - name: "conn_id"
+                value: "CHANGEME"
+              - name: "text"
+                value: "Hello, World"
+              - name: "channel"
+                value: "CHANGEME"
+
+      environments:
+        - environment_key: {{.project_name}}_environment
+          spec:
+            environment_version: "5"
+            dependencies:
+              - ../dist/*.whl
diff --git a/libs/template/templates/lakeflow-integrations/template/{{.project_name}}/resources/wait_for_run_sensor.job.yml.tmpl b/libs/template/templates/lakeflow-integrations/template/{{.project_name}}/resources/wait_for_run_sensor.job.yml.tmpl
new file mode 100644
index 00000000000..148c20d2135
--- /dev/null
+++ b/libs/template/templates/lakeflow-integrations/template/{{.project_name}}/resources/wait_for_run_sensor.job.yml.tmpl
@@ -0,0 +1,20 @@
+resources:
+  jobs:
+    wait_for_run_sensor:
+      name: "[example] wait_for_run_sensor"
+
+      tasks:
+        - task_key: wait_for_run_sensor
+          environment_key: {{.project_name}}_environment
+          python_operator_task:
+            main: {{.project_name}}.examples.wait_for_run_sensor.WaitForRunSensor
+            parameters:
+              - name: "run_id"
+                value: "CHANGEME"
+
+      environments:
+        - environment_key: {{.project_name}}_environment
+          spec:
+            environment_version: "5"
+            dependencies:
+              - ../dist/*.whl
diff --git a/libs/template/templates/lakeflow-integrations/template/{{.project_name}}/src/{{.project_name}}/__init__.py b/libs/template/templates/lakeflow-integrations/template/{{.project_name}}/src/{{.project_name}}/__init__.py
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/libs/template/templates/lakeflow-integrations/template/{{.project_name}}/src/{{.project_name}}/examples/__init__.py b/libs/template/templates/lakeflow-integrations/template/{{.project_name}}/src/{{.project_name}}/examples/__init__.py
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/libs/template/templates/lakeflow-integrations/template/{{.project_name}}/src/{{.project_name}}/examples/slack.py b/libs/template/templates/lakeflow-integrations/template/{{.project_name}}/src/{{.project_name}}/examples/slack.py
new file mode 100644
index 00000000000..8834a752e4f
--- /dev/null
+++ b/libs/template/templates/lakeflow-integrations/template/{{.project_name}}/src/{{.project_name}}/examples/slack.py
@@ -0,0 +1,27 @@
+import requests
+from databricks.sdk import WorkspaceClient
+from databricks.lakeflow.integrations import integration
+
+
+@integration(display_name="Send Slack message")
+def send_slack_message(
+    text: str,
+    conn_id: str,
+    channel: str,  # Example: "C0A874NCL8N"
+):
+    w = WorkspaceClient()
+
+    response = requests.post(
+        f"{w.config.host}/api/2.0/unity-catalog/connections/{conn_id}/proxy/chat.postMessage",
+        headers={
+            **w.config.authenticate(),
+            "Accept": "application/json",
+            "Content-Type": "application/json",
+            "Accept-Encoding": "identity",  # ask for no compression
+        },
+        json={
+            "channel": channel,
+            "text": text,
+        },
+    )
+    print(response.json())
diff --git a/libs/template/templates/lakeflow-integrations/template/{{.project_name}}/src/{{.project_name}}/examples/wait_for_run_sensor.py b/libs/template/templates/lakeflow-integrations/template/{{.project_name}}/src/{{.project_name}}/examples/wait_for_run_sensor.py
new file mode 100644
index 00000000000..35e2c945d4a
--- /dev/null
+++ b/libs/template/templates/lakeflow-integrations/template/{{.project_name}}/src/{{.project_name}}/examples/wait_for_run_sensor.py
@@ -0,0 +1,28 @@
+import datetime
+
+from databricks.lakeflow.integrations import integration, Context, Sensor, SensorResult
+from databricks.sdk import WorkspaceClient
+
+
+@integration(display_name="Wait for run")
+class WaitForRunSensor(Sensor):
+    run_id: str
+
+    def __init__(self, run_id: str):
+        self.run_id = run_id
+
+    def poll(self, ctx: Context) -> SensorResult:
+        from databricks.sdk.runtime import dbutils
+
+        w = WorkspaceClient()
+
+        run = w.jobs.get_run(run_id=int(self.run_id))
+        result_state = run.state.result_state if run.state else None
+
+        if result_state is not None:
+            dbutils.jobs.taskValues.set("result_state", result_state.name)
+            return SensorResult.completed()
+        else:
+            print("Running", run.run_page_url)
+            print("Waiting for a minute...")
+            return SensorResult.deferred(duration=datetime.timedelta(minutes=1))
diff --git a/libs/template/templates/lakeflow-pipelines/databricks_template_schema.json b/libs/template/templates/lakeflow-pipelines/databricks_template_schema.json
index 9ec27cd16d7..8639acc49e9 100644
--- a/libs/template/templates/lakeflow-pipelines/databricks_template_schema.json
+++ b/libs/template/templates/lakeflow-pipelines/databricks_template_schema.json
@@ -74,7 +74,7 @@
         "default_catalog": {
             "type": "string",
             "default": "{{if eq (default_catalog) \"\"}}hive_metastore{{else}}{{default_catalog}}{{end}}",
-            "pattern": "^\\w*$",
+            "pattern": "^(\\w[\\w-]*)?$",
             "pattern_match_failure_message": "Invalid catalog name.",
             "description": "Default catalog for any tables created by this project{{if eq (default_catalog) \"\"}} (leave blank when not using Unity Catalog){{end}}",
             "order": 7
diff --git a/libs/template/templates/pydabs/databricks_template_schema.json b/libs/template/templates/pydabs/databricks_template_schema.json
index 7ab9b8c4085..4819b5bb773 100644
--- a/libs/template/templates/pydabs/databricks_template_schema.json
+++ b/libs/template/templates/pydabs/databricks_template_schema.json
@@ -49,7 +49,7 @@
         "default_catalog": {
             "type": "string",
             "default": "{{if eq (default_catalog) \"\"}}hive_metastore{{else}}{{default_catalog}}{{end}}",
-            "pattern": "^\\w*$",
+            "pattern": "^(\\w[\\w-]*)?$",
             "pattern_match_failure_message": "Invalid catalog name.",
             "description": "Default catalog for any tables created by this project{{if eq (default_catalog) \"\"}} (leave blank when not using Unity Catalog){{end}}",
             "order": 6
diff --git a/libs/template/testdata/library-override/library/override.tmpl b/libs/template/testdata/library-override/library/override.tmpl
new file mode 100644
index 00000000000..5170d3ebb49
--- /dev/null
+++ b/libs/template/testdata/library-override/library/override.tmpl
@@ -0,0 +1 @@
+{{define "agents_md"}}OWN WINS{{end}}
diff --git a/libs/template/testdata/library-override/template/out.tmpl b/libs/template/testdata/library-override/template/out.tmpl
new file mode 100644
index 00000000000..7994e2a701b
--- /dev/null
+++ b/libs/template/testdata/library-override/template/out.tmpl
@@ -0,0 +1 @@
+own: {{template "agents_md" .}}
diff --git a/libs/template/writer.go b/libs/template/writer.go
index 358731f6a26..78bf610f213 100644
--- a/libs/template/writer.go
+++ b/libs/template/writer.go
@@ -3,6 +3,7 @@ package template
 import (
 	"cmp"
 	"context"
+	"fmt"
 	"path/filepath"
 	"slices"
 	"strconv"
@@ -23,6 +24,23 @@ const (
 	schemaFileName  = "databricks_template_schema.json"
 )
 
+// InitResult describes what a template materialized. It is reported by
+// `bundle init -o json`.
+//
+// The field names are part of the CLI's JSON output contract; renaming one is a
+// breaking change for callers. New fields must be additive so that consumers
+// tolerate older CLI versions that do not emit them.
+type InitResult struct {
+	// The files the template wrote, relative to the output directory,
+	// slash-separated and sorted. Files removed by a {{skip}} directive are not
+	// listed.
+	//
+	// The paths are relative rather than absolute, and slash-separated rather
+	// than OS-specific, so that the contract is identical for the local and
+	// workspace filers.
+	Outputs []string `json:"outputs"`
+}
+
 type Writer interface {
 	// Configure the writer with:
 	// 1. The path to the config file (if any) that contains input values for the
@@ -35,6 +53,10 @@ type Writer interface {
 
 	// Log telemetry for the template initialization event.
 	LogTelemetry(ctx context.Context)
+
+	// InitResult returns what the template materialized. It must be called after
+	// a successful Materialize.
+	InitResult() *InitResult
 }
 
 type defaultWriter struct {
@@ -160,6 +182,13 @@ func (tmpl *defaultWriter) Materialize(ctx context.Context, reader Reader) error
 	return tmpl.printSuccessMessage(ctx)
 }
 
+func (tmpl *defaultWriter) InitResult() *InitResult {
+	outputs := slices.Clone(tmpl.renderer.persistedPaths)
+	slices.Sort(outputs)
+
+	return &InitResult{Outputs: outputs}
+}
+
 func (tmpl *defaultWriter) LogTelemetry(ctx context.Context) {
 	telemetry.Log(ctx, protos.DatabricksCliLog{
 		BundleInitEvent: &protos.BundleInitEvent{
@@ -174,6 +203,18 @@ type writerWithFullTelemetry struct {
 }
 
 func (tmpl *writerWithFullTelemetry) LogTelemetry(ctx context.Context) {
+	telemetry.Log(ctx, protos.DatabricksCliLog{
+		BundleInitEvent: &protos.BundleInitEvent{
+			BundleUuid:       bundleUuid,
+			TemplateName:     string(tmpl.name),
+			TemplateEnumArgs: tmpl.templateEnumArgs(),
+		},
+	})
+}
+
+// templateEnumArgs returns the enum and boolean input values to report in
+// telemetry, sorted by key for deterministic output.
+func (tmpl *writerWithFullTelemetry) templateEnumArgs() []protos.BundleInitTemplateEnumArg {
 	var args []protos.BundleInitTemplateEnumArg
 	for k, v := range tmpl.config.values {
 		s := tmpl.config.schema.Properties[k]
@@ -186,9 +227,11 @@ func (tmpl *writerWithFullTelemetry) LogTelemetry(ctx context.Context) {
 			})
 
 		case len(s.Enum) > 0:
+			// Enum values may be strings, integers or numbers depending on the
+			// schema, so format by value rather than asserting a string type.
 			args = append(args, protos.BundleInitTemplateEnumArg{
 				Key:   k,
-				Value: v.(string),
+				Value: fmt.Sprint(v),
 			})
 
 		default:
@@ -203,11 +246,5 @@ func (tmpl *writerWithFullTelemetry) LogTelemetry(ctx context.Context) {
 		return cmp.Compare(a.Key, b.Key)
 	})
 
-	telemetry.Log(ctx, protos.DatabricksCliLog{
-		BundleInitEvent: &protos.BundleInitEvent{
-			BundleUuid:       bundleUuid,
-			TemplateName:     string(tmpl.name),
-			TemplateEnumArgs: args,
-		},
-	})
+	return args
 }
diff --git a/libs/template/writer_test.go b/libs/template/writer_test.go
index 33a3561cc0f..b9cadd65c93 100644
--- a/libs/template/writer_test.go
+++ b/libs/template/writer_test.go
@@ -7,6 +7,8 @@ import (
 	"github.com/databricks/cli/libs/cmdctx"
 	"github.com/databricks/cli/libs/dbr"
 	"github.com/databricks/cli/libs/filer"
+	"github.com/databricks/cli/libs/jsonschema"
+	"github.com/databricks/cli/libs/telemetry/protos"
 	"github.com/databricks/databricks-sdk-go"
 	workspaceConfig "github.com/databricks/databricks-sdk-go/config"
 	"github.com/stretchr/testify/assert"
@@ -42,6 +44,37 @@ func TestDefaultWriterConfigureOnDBR(t *testing.T) {
 	assert.IsType(t, &filer.WorkspaceFilesExtensionsClient{}, w.outputFiler)
 }
 
+func TestWriterWithFullTelemetryTemplateEnumArgs(t *testing.T) {
+	// Enum values can be strings, integers or numbers; booleans are always
+	// reported. Non-enum, non-boolean values are not reported.
+	w := &writerWithFullTelemetry{}
+	w.config = &config{
+		values: map[string]any{
+			"str_enum": "v2",
+			"int_enum": int64(2),
+			"num_enum": 1.5,
+			"flag":     true,
+			"freeform": "some-user-value",
+		},
+		schema: &jsonschema.Schema{
+			Properties: map[string]*jsonschema.Schema{
+				"str_enum": {Type: jsonschema.StringType, Enum: []any{"v1", "v2"}},
+				"int_enum": {Type: jsonschema.IntegerType, Enum: []any{int64(1), int64(2)}},
+				"num_enum": {Type: jsonschema.NumberType, Enum: []any{1.5, 2.5}},
+				"flag":     {Type: jsonschema.BooleanType},
+				"freeform": {Type: jsonschema.StringType},
+			},
+		},
+	}
+
+	assert.Equal(t, []protos.BundleInitTemplateEnumArg{
+		{Key: "flag", Value: "true"},
+		{Key: "int_enum", Value: "2"},
+		{Key: "num_enum", Value: "1.5"},
+		{Key: "str_enum", Value: "v2"},
+	}, w.templateEnumArgs())
+}
+
 func TestMaterializeForNonTemplateDirectory(t *testing.T) {
 	tmpDir1 := t.TempDir()
 	tmpDir2 := t.TempDir()
diff --git a/libs/testdiff/context.go b/libs/testdiff/context.go
deleted file mode 100644
index 7b6f5ff889c..00000000000
--- a/libs/testdiff/context.go
+++ /dev/null
@@ -1,34 +0,0 @@
-package testdiff
-
-import (
-	"context"
-)
-
-type key int
-
-const (
-	replacementsMapKey = key(1)
-)
-
-func WithReplacementsMap(ctx context.Context) (context.Context, *ReplacementsContext) {
-	value := ctx.Value(replacementsMapKey)
-	if value != nil {
-		if existingMap, ok := value.(*ReplacementsContext); ok {
-			return ctx, existingMap
-		}
-	}
-
-	newMap := &ReplacementsContext{}
-	ctx = context.WithValue(ctx, replacementsMapKey, newMap)
-	return ctx, newMap
-}
-
-func GetReplacementsMap(ctx context.Context) *ReplacementsContext {
-	value := ctx.Value(replacementsMapKey)
-	if value != nil {
-		if existingMap, ok := value.(*ReplacementsContext); ok {
-			return existingMap
-		}
-	}
-	return nil
-}
diff --git a/libs/testdiff/context_test.go b/libs/testdiff/context_test.go
deleted file mode 100644
index 41e0b0de1da..00000000000
--- a/libs/testdiff/context_test.go
+++ /dev/null
@@ -1,29 +0,0 @@
-package testdiff
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestGetReplacementsMap_Nil(t *testing.T) {
-	ctx := t.Context()
-	repls := GetReplacementsMap(ctx)
-	assert.Nil(t, repls)
-}
-
-func TestGetReplacementsMap_NotNil(t *testing.T) {
-	ctx := t.Context()
-	ctx, _ = WithReplacementsMap(ctx)
-	repls := GetReplacementsMap(ctx)
-	assert.NotNil(t, repls)
-}
-
-func TestWithReplacementsMap_UseExisting(t *testing.T) {
-	ctx := t.Context()
-	ctx, r1 := WithReplacementsMap(ctx)
-	ctx, r2 := WithReplacementsMap(ctx)
-	repls := GetReplacementsMap(ctx)
-	assert.Equal(t, r1, repls)
-	assert.Equal(t, r2, repls)
-}
diff --git a/libs/testdiff/replacement.go b/libs/testdiff/replacement.go
index e293e74edea..a8cc18b2fb4 100644
--- a/libs/testdiff/replacement.go
+++ b/libs/testdiff/replacement.go
@@ -22,15 +22,11 @@ const (
 )
 
 var (
-	uuidRegex        = regexp.MustCompile(`[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}`)
-	numIdRegex       = regexp.MustCompile(`[0-9]{3,}`)
-	privatePathRegex = regexp.MustCompile(`(/tmp|/private)(/.*)/([a-zA-Z0-9]+)`)
-	// Version could be v0.0.0-dev+21e1aacf518a, v0.0.0-dev-21e1aacf518a (the
-	// filesystem-sanitized form used in cache paths), or just v0.0.0-dev
-	// (currently the case on Windows).
-	devVersionRegex = regexp.MustCompile(`0\.0\.0-dev([-+][a-f0-9]{10,16})?`)
+	uuidRegex = regexp.MustCompile(`[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}`)
 	// Matches databricks-sdk-go/0.90.0
 	sdkVersionRegex = regexp.MustCompile(`databricks-sdk-go/[0-9]+\.[0-9]+\.[0-9]+`)
+	// Matches databricks-tf-provider/1.121.0
+	tfProviderVersionRegex = regexp.MustCompile(`databricks-tf-provider/[0-9]+\.[0-9]+\.[0-9]+`)
 )
 
 type Replacement struct {
@@ -236,24 +232,14 @@ func PrepareReplacementsUUID(t testutil.TestingT, r *ReplacementsContext) {
 	r.append(uuidRegex, "[UUID]", 0)
 }
 
-func PrepareReplacementsNumber(t testutil.TestingT, r *ReplacementsContext) {
-	t.Helper()
-	r.append(numIdRegex, "[NUMID]", 0)
-}
-
-func PrepareReplacementsTemporaryDirectory(t testutil.TestingT, r *ReplacementsContext) {
-	t.Helper()
-	r.append(privatePathRegex, "/tmp/.../$3", 0)
-}
-
-func PrepareReplacementsDevVersion(t testutil.TestingT, r *ReplacementsContext) {
+func PrepareReplacementSdkVersion(t testutil.TestingT, r *ReplacementsContext) {
 	t.Helper()
-	r.append(devVersionRegex, "[DEV_VERSION]", 0)
+	r.append(sdkVersionRegex, "databricks-sdk-go/[SDK_VERSION]", 0)
 }
 
-func PrepareReplacementSdkVersion(t testutil.TestingT, r *ReplacementsContext) {
+func PrepareReplacementTfProviderVersion(t testutil.TestingT, r *ReplacementsContext) {
 	t.Helper()
-	r.append(sdkVersionRegex, "databricks-sdk-go/[SDK_VERSION]", 0)
+	r.append(tfProviderVersionRegex, "databricks-tf-provider/[TF_PROVIDER_VERSION]", 0)
 }
 
 func goVersion() string {
diff --git a/libs/testdiff/replacement_test.go b/libs/testdiff/replacement_test.go
index ab45220bdd2..507774c8d40 100644
--- a/libs/testdiff/replacement_test.go
+++ b/libs/testdiff/replacement_test.go
@@ -29,15 +29,6 @@ func TestReplacement_UUID(t *testing.T) {
 	assert.Equal(t, "[UUID]", repls.Replace("123e4567-e89b-12d3-a456-426614174000"))
 }
 
-func TestReplacement_Number(t *testing.T) {
-	var repls ReplacementsContext
-
-	PrepareReplacementsNumber(t, &repls)
-
-	assert.Equal(t, "12", repls.Replace("12"))
-	assert.Equal(t, "[NUMID]", repls.Replace("123"))
-}
-
 func TestReplacement_Distinct(t *testing.T) {
 	rc := ReplacementsContext{Repls: []Replacement{
 		{Old: regexp.MustCompile(`\d+`), New: "[NUMBER]", Distinct: true},
@@ -56,14 +47,6 @@ func TestReplacement_DistinctSingleMatch(t *testing.T) {
 	assert.Equal(t, "[NUMBER]", got)
 }
 
-func TestReplacement_TemporaryDirectory(t *testing.T) {
-	var repls ReplacementsContext
-
-	PrepareReplacementsTemporaryDirectory(t, &repls)
-
-	assert.Equal(t, "/tmp/.../tail", repls.Replace("/tmp/foo/bar/qux/tail"))
-}
-
 func TestReplaceAppliesInOrder(t *testing.T) {
 	input := "A"
 
diff --git a/libs/testdiff/sortlines.go b/libs/testdiff/sortlines.go
new file mode 100644
index 00000000000..332a11f1c27
--- /dev/null
+++ b/libs/testdiff/sortlines.go
@@ -0,0 +1,33 @@
+package testdiff
+
+import (
+	"regexp"
+	"slices"
+	"strings"
+)
+
+// SortLineRuns sorts each run of consecutive lines matching pattern, leaving every
+// other line where it is. Use it for output whose line order is genuinely
+// nondeterministic — for example "bundle deploy" reporting resources as they are
+// applied, which happens in parallel — so that a test pins the set of lines without
+// pinning an order the command does not guarantee.
+func SortLineRuns(input string, pattern *regexp.Regexp) string {
+	lines := strings.Split(input, "\n")
+	start := -1
+	for i := range lines {
+		if pattern.MatchString(lines[i]) {
+			if start < 0 {
+				start = i
+			}
+			continue
+		}
+		if start >= 0 {
+			slices.Sort(lines[start:i])
+			start = -1
+		}
+	}
+	if start >= 0 {
+		slices.Sort(lines[start:])
+	}
+	return strings.Join(lines, "\n")
+}
diff --git a/libs/testdiff/sortlines_test.go b/libs/testdiff/sortlines_test.go
new file mode 100644
index 00000000000..951d8b3f617
--- /dev/null
+++ b/libs/testdiff/sortlines_test.go
@@ -0,0 +1,55 @@
+package testdiff
+
+import (
+	"regexp"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestSortLineRuns(t *testing.T) {
+	pattern := regexp.MustCompile(`^(Created|Updated|Deleted) `)
+
+	for _, tc := range []struct {
+		name  string
+		input string
+		want  string
+	}{
+		{
+			name:  "sorts a run and leaves surrounding lines alone",
+			input: "Uploading files...\nCreated volumes.v\nCreated jobs.a\nUpdated jobs.b\nFiles: 1 uploaded\n",
+			want:  "Uploading files...\nCreated jobs.a\nCreated volumes.v\nUpdated jobs.b\nFiles: 1 uploaded\n",
+		},
+		{
+			// Runs are sorted independently: a non-matching line between them is a
+			// boundary, so lines never move across it.
+			name:  "does not merge runs separated by other output",
+			input: "Created jobs.z\nError: boom\nCreated jobs.a\n",
+			want:  "Created jobs.z\nError: boom\nCreated jobs.a\n",
+		},
+		{
+			// Same, with runs long enough to sort: each is ordered on its own, and the
+			// second run stays below the boundary even though it sorts first overall.
+			name:  "sorts each run independently",
+			input: "Updated jobs.z\nUpdated jobs.y\nError: boom\nCreated jobs.b\nCreated jobs.a\n",
+			want:  "Updated jobs.y\nUpdated jobs.z\nError: boom\nCreated jobs.a\nCreated jobs.b\n",
+		},
+		{
+			name:  "sorts a run that ends the input",
+			input: ">>> deploy\nDeleted jobs.b\nDeleted jobs.a",
+			want:  ">>> deploy\nDeleted jobs.a\nDeleted jobs.b",
+		},
+		{
+			name:  "leaves input without matches untouched",
+			input: "Plan: 1 to add\n\nResources: 1 created\n",
+			want:  "Plan: 1 to add\n\nResources: 1 created\n",
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			got := SortLineRuns(tc.input, pattern)
+			assert.Equal(t, tc.want, got)
+			// Sorting is idempotent, so goldens stay stable when re-recorded.
+			assert.Equal(t, tc.want, SortLineRuns(got, pattern))
+		})
+	}
+}
diff --git a/libs/testdiff/testdiff_test.go b/libs/testdiff/testdiff_test.go
index 58e0aec39f2..cdcada99fbe 100644
--- a/libs/testdiff/testdiff_test.go
+++ b/libs/testdiff/testdiff_test.go
@@ -7,7 +7,7 @@ import (
 )
 
 func TestDiff(t *testing.T) {
-	assert.Equal(t, "", UnifiedDiff("a", "b", "", ""))
-	assert.Equal(t, "", UnifiedDiff("a", "b", "abc", "abc"))
+	assert.Empty(t, UnifiedDiff("a", "b", "", ""))
+	assert.Empty(t, UnifiedDiff("a", "b", "abc", "abc"))
 	assert.Equal(t, "--- a\n+++ b\n@@ -1 +1,2 @@\n abc\n+123\n", UnifiedDiff("a", "b", "abc\n", "abc\n123\n"))
 }
diff --git a/libs/testproxy/server.go b/libs/testproxy/server.go
index f3510d7adb0..be5bcfd4aa7 100644
--- a/libs/testproxy/server.go
+++ b/libs/testproxy/server.go
@@ -2,7 +2,6 @@ package testproxy
 
 import (
 	"bytes"
-	"encoding/json"
 	"errors"
 	"net/http"
 	"net/http/httptest"
@@ -26,7 +25,7 @@ type ProxyServer struct {
 	ResponseCallback func(request *testserver.Request, response *testserver.EncodedResponse)
 }
 
-// This creates a reverse proxy server that sits in front of a real Databricks
+// New creates a reverse proxy server that sits in front of the upstream
 // workspace. This is useful for recording API requests and responses in
 // integration tests.
 //
@@ -37,22 +36,20 @@ type ProxyServer struct {
 // OAuth endpoints based on the nature of the URL.
 // For reference, see:
 // https://github.com/databricks/databricks-sdk-go/blob/79e4b3a6e9b0b7dcb1af9ad4025deb447b01d933/common/environment/environments.go#L57
-func New(t testutil.TestingT) *ProxyServer {
+//
+// An upstream with no fields set resolves a real workspace and its auth from the
+// environment; an explicit host and token point at a testserver instead.
+func New(t testutil.TestingT, upstream *config.Config) *ProxyServer {
 	s := &ProxyServer{
 		t: t,
 	}
 
-	// Create an API client using the current authentication context.
-	// In CI test environments this would read the appropriate environment
-	// variables.
-	var err error
-	cfg := &config.Config{}
-	clientCfg, err := config.HTTPClientConfigFromConfig(cfg)
+	clientCfg, err := config.HTTPClientConfigFromConfig(upstream)
 	require.NoError(t, err)
 	s.apiClient = httpclient.NewApiClient(clientCfg)
 
 	// Set up the proxy handler as the default handler for all requests.
-	server := httptest.NewServer(http.HandlerFunc(s.proxyToCloud))
+	server := httptest.NewServer(http.HandlerFunc(s.proxyToUpstream))
 	t.Cleanup(server.Close)
 
 	s.Server = server
@@ -74,7 +71,7 @@ func (s *ProxyServer) reqBody(r testserver.Request) any {
 	return r.Body
 }
 
-func (s *ProxyServer) proxyToCloud(w http.ResponseWriter, r *http.Request) {
+func (s *ProxyServer) proxyToUpstream(w http.ResponseWriter, r *http.Request) {
 	request := testserver.NewRequest(s.t, r, nil)
 	if s.RequestCallback != nil {
 		s.RequestCallback(&request)
@@ -129,22 +126,30 @@ func (s *ProxyServer) proxyToCloud(w http.ResponseWriter, r *http.Request) {
 
 	var encodedResponse *testserver.EncodedResponse
 
-	// API errors from the SDK are expected to be of the type [apierr.APIError]. If we
-	// get an API error then parse the error and forward it back to the client
-	// in an appropriate format.
-	apiErr := &apierr.APIError{}
-	if errors.As(err, &apiErr) {
-		body := map[string]string{
-			"error_code": apiErr.ErrorCode,
-			"message":    apiErr.Message,
+	// API errors from the SDK are of type [apierr.APIError]. Forward the raw
+	// response bytes verbatim — including any error details — so callers see
+	// exactly what the workspace returned. Re-marshalling from the parsed
+	// APIError would drop fields the SDK doesn't surface (e.g. metadata in
+	// details[]) and silently break callers that inspect them.
+	if apiErr, ok := errors.AsType[*apierr.APIError](err); ok {
+		rw := apiErr.ResponseWrapper
+		if rw == nil {
+			// The SDK populates ResponseWrapper for every APIError produced
+			// from a real HTTP response. If this ever fires the SDK changed
+			// shape and we need to revisit how we forward error bodies.
+			panic("apierr.APIError has no ResponseWrapper")
 		}
-
-		b, err := json.Marshal(body)
-		assert.NoError(s.t, err)
-
 		encodedResponse = &testserver.EncodedResponse{
-			StatusCode: apiErr.StatusCode,
-			Body:       b,
+			StatusCode: rw.Response.StatusCode,
+			Body:       rw.DebugBytes,
+		}
+		// Visitors registered via WithResponseHeader are not invoked when
+		// the SDK returns an error, so populate the include list directly
+		// from the original response headers.
+		for _, header := range includeResponseHeaders {
+			if v := rw.Response.Header.Get(header); v != "" {
+				*responseHeaders[header] = v
+			}
 		}
 	}
 
diff --git a/libs/testserver/alerts.go b/libs/testserver/alerts.go
index c5163a056a4..48612ad539d 100644
--- a/libs/testserver/alerts.go
+++ b/libs/testserver/alerts.go
@@ -4,10 +4,152 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"path"
+	"slices"
+	"strconv"
+	"strings"
 
 	"github.com/databricks/databricks-sdk-go/service/sql"
+	"github.com/databricks/databricks-sdk-go/service/workspace"
 )
 
+// alertFile mirrors the schema of a .dbalert.json file. It is the inverse of
+// bundle/config/mutator/load_dbalert_files.go: API-only fields (display_name,
+// warehouse_id) are dropped and the joined query_text/custom_description are
+// split back into lines. The field order matches what the backend materializes.
+type alertFile struct {
+	CustomSummary          string                  `json:"custom_summary,omitempty"`
+	Evaluation             *materializedEvaluation `json:"evaluation,omitempty"`
+	Schedule               *sql.CronSchedule       `json:"schedule,omitempty"`
+	QueryLines             []string                `json:"query_lines,omitempty"`
+	CustomDescriptionLines []string                `json:"custom_description_lines,omitempty"`
+}
+
+// materializedEvaluation mirrors the field order the alerts backend uses when it
+// writes the .dbalert.json file, which differs from sql.AlertV2Evaluation: the
+// backend emits source before comparison_operator and always writes a
+// notification object (an empty {} when none is configured).
+type materializedEvaluation struct {
+	Source             sql.AlertV2OperandColumn `json:"source"`
+	ComparisonOperator sql.ComparisonOperator   `json:"comparison_operator"`
+	Threshold          *materializedOperand     `json:"threshold,omitempty"`
+	Notification       *sql.AlertV2Notification `json:"notification"`
+}
+
+// materializedOperand and materializedOperandValue mirror sql.AlertV2Operand but
+// format double_value via jsonFloat so it keeps its decimal point in the file.
+type materializedOperand struct {
+	Column *sql.AlertV2OperandColumn `json:"column,omitempty"`
+	Value  *materializedOperandValue `json:"value,omitempty"`
+}
+
+type materializedOperandValue struct {
+	BoolValue   bool       `json:"bool_value,omitempty"`
+	DoubleValue *jsonFloat `json:"double_value,omitempty"`
+	StringValue string     `json:"string_value,omitempty"`
+}
+
+// jsonFloat marshals a float64 the way the alerts backend serializes numeric
+// thresholds in .dbalert.json: always with a decimal point (0 -> "0.0"). Go's
+// encoding/json drops the fractional part for integer-valued floats.
+type jsonFloat float64
+
+func (f jsonFloat) MarshalJSON() ([]byte, error) {
+	s := strconv.FormatFloat(float64(f), 'f', -1, 64)
+	if !strings.ContainsRune(s, '.') {
+		s += ".0"
+	}
+	return []byte(s), nil
+}
+
+// materializeThreshold converts the SDK threshold into the file representation.
+// double_value is emitted whenever the source request set it explicitly (tracked
+// via ForceSendFields), even when it is the zero value.
+func materializeThreshold(t *sql.AlertV2Operand) *materializedOperand {
+	if t == nil {
+		return nil
+	}
+	out := &materializedOperand{Column: t.Column}
+	if v := t.Value; v != nil {
+		out.Value = &materializedOperandValue{
+			BoolValue:   v.BoolValue,
+			StringValue: v.StringValue,
+		}
+		if v.DoubleValue != 0 || slices.Contains(v.ForceSendFields, "DoubleValue") {
+			d := jsonFloat(v.DoubleValue)
+			out.Value.DoubleValue = &d
+		}
+	}
+	return out
+}
+
+// alertFilePath returns the workspace path of the .dbalert.json file the backend
+// materializes for an alert: <parent_path>/<display_name>.dbalert.json.
+func alertFilePath(alert sql.AlertV2) string {
+	return path.Join(alert.ParentPath, alert.DisplayName+".dbalert.json")
+}
+
+// splitLines reverses the line-joining done in load_dbalert_files.go: each line
+// is terminated by "\n", so splitting drops the trailing empty element.
+func splitLines(s string) []string {
+	if s == "" {
+		return nil
+	}
+	return strings.Split(strings.TrimSuffix(s, "\n"), "\n")
+}
+
+// writeAlertFile materializes the .dbalert.json file for an alert. On real cloud
+// the backend writes this file as a side effect of alert creation/update, which
+// the `workspace export` round-trip and `bundle generate alert` rely on.
+func (s *FakeWorkspace) writeAlertFile(alert sql.AlertV2) error {
+	if alert.ParentPath == "" || alert.DisplayName == "" {
+		return nil
+	}
+
+	notification := alert.Evaluation.Notification
+	if notification != nil {
+		// The backend always serializes notify_on_ok in the file, even when
+		// false; the SDK marshaler would otherwise drop the zero value.
+		n := *notification
+		n.ForceSendFields = append(n.ForceSendFields, "NotifyOnOk")
+		notification = &n
+	} else {
+		// The backend always writes a notification object, materializing an
+		// empty {} when the alert has no notification configured.
+		notification = &sql.AlertV2Notification{}
+	}
+
+	af := alertFile{
+		CustomSummary: alert.CustomSummary,
+		Evaluation: &materializedEvaluation{
+			Source:             alert.Evaluation.Source,
+			ComparisonOperator: alert.Evaluation.ComparisonOperator,
+			Threshold:          materializeThreshold(alert.Evaluation.Threshold),
+			Notification:       notification,
+		},
+		Schedule:               &alert.Schedule,
+		QueryLines:             splitLines(alert.QueryText),
+		CustomDescriptionLines: splitLines(alert.CustomDescription),
+	}
+
+	data, err := json.MarshalIndent(af, "", "  ")
+	if err != nil {
+		return err
+	}
+	data = append(data, '\n')
+
+	filePath := alertFilePath(alert)
+	s.files[filePath] = FileEntry{
+		Info: workspace.ObjectInfo{
+			ObjectType: "FILE",
+			Path:       filePath,
+			ObjectId:   nextTreenodeID(),
+		},
+		Data: data,
+	}
+	return nil
+}
+
 func (s *FakeWorkspace) AlertsUpsert(req Request, alertId string) Response {
 	var alert sql.AlertV2
 
@@ -35,6 +177,13 @@ func (s *FakeWorkspace) AlertsUpsert(req Request, alertId string) Response {
 	alert.LifecycleState = sql.AlertLifecycleStateActive
 	s.Alerts[alertId] = alert
 
+	if err := s.writeAlertFile(alert); err != nil {
+		return Response{
+			Body:       fmt.Sprintf("internal error: %s", err),
+			StatusCode: http.StatusInternalServerError,
+		}
+	}
+
 	return Response{
 		StatusCode: 200,
 		Body:       alert,
@@ -51,6 +200,8 @@ func (s *FakeWorkspace) AlertsDelete(alertId string, purge bool) Response {
 		}
 	}
 
+	delete(s.files, alertFilePath(alert))
+
 	if purge {
 		delete(s.Alerts, alertId)
 	} else {
diff --git a/libs/testserver/apps.go b/libs/testserver/apps.go
index b35632e27ad..c70115d060f 100644
--- a/libs/testserver/apps.go
+++ b/libs/testserver/apps.go
@@ -11,6 +11,23 @@ import (
 	"github.com/databricks/databricks-sdk-go/service/iam"
 )
 
+const (
+	appStatusRunningMessage     = "App has status: App is running"
+	appStatusUnavailableMessage = "App status is unavailable."
+)
+
+// setUcSecurableKinds mimics the platform computing an output-only
+// securable_kind (e.g. TABLE_DELTA) for UC TABLE securables. The client never
+// sends it, but the backend returns it on every read; VOLUME and other
+// securable types get none. See https://github.com/databricks/cli/issues/6342
+func setUcSecurableKinds(app *apps.App) {
+	for _, res := range app.Resources {
+		if res.UcSecurable != nil && res.UcSecurable.SecurableType == apps.AppResourceUcSecurableUcSecurableTypeTable {
+			res.UcSecurable.SecurableKind = "TABLE_DELTA"
+		}
+	}
+}
+
 func (s *FakeWorkspace) AppsCreateUpdate(req Request, name string) Response {
 	var updateReq apps.AsyncUpdateAppRequest
 	if err := json.Unmarshal(req.Body, &updateReq); err != nil {
@@ -20,6 +37,27 @@ func (s *FakeWorkspace) AppsCreateUpdate(req Request, name string) Response {
 		}
 	}
 
+	// The real API rejects source_code_path in the UpdateApp body at any value.
+	if updateReq.App != nil {
+		var rawBody struct {
+			App json.RawMessage `json:"app"`
+		}
+		if err := json.Unmarshal(req.Body, &rawBody); err == nil {
+			var appFields map[string]json.RawMessage
+			if err := json.Unmarshal(rawBody.App, &appFields); err == nil {
+				if _, ok := appFields["source_code_path"]; ok {
+					return Response{
+						StatusCode: http.StatusBadRequest,
+						Body: map[string]string{
+							"error_code": "INVALID_PARAMETER_VALUE",
+							"message":    "deployment_source.source_code_path cannot be set on UpdateApp.",
+						},
+					}
+				}
+			}
+		}
+	}
+
 	defer s.LockUnlock()()
 
 	existing, ok := s.Apps[name]
@@ -61,6 +99,7 @@ func (s *FakeWorkspace) AppsCreateUpdate(req Request, name string) Response {
 			return Response{Body: fmt.Sprintf("internal error: %s", err), StatusCode: http.StatusInternalServerError}
 		}
 	}
+	setUcSecurableKinds(&existing)
 	s.Apps[name] = existing
 
 	return Response{
@@ -118,18 +157,28 @@ func (s *FakeWorkspace) AppsCreateDeployment(req Request, name string) Response
 func (s *FakeWorkspace) AppsGetDeployment(_ Request, name, deploymentID string) Response {
 	defer s.LockUnlock()()
 
-	_, ok := s.Apps[name]
+	app, ok := s.Apps[name]
 	if !ok {
 		return Response{StatusCode: 404}
 	}
 
-	return Response{Body: apps.AppDeployment{
-		DeploymentId: deploymentID,
-		Status: &apps.AppDeploymentStatus{
-			State:   apps.AppDeploymentStateSucceeded,
-			Message: "Deployment succeeded",
-		},
-	}}
+	if app.ActiveDeployment == nil || app.ActiveDeployment.DeploymentId != deploymentID {
+		return Response{StatusCode: 404}
+	}
+
+	// Return a copy so the masking below does not mutate the stored deployment.
+	deployment := *app.ActiveDeployment
+
+	// The real GET response strips env var values, returning only the name of
+	// each variable. Reproduce that masking so the local golden matches
+	// recorded cloud behavior.
+	maskedEnvVars := make([]apps.EnvVar, len(deployment.EnvVars))
+	for i, ev := range deployment.EnvVars {
+		maskedEnvVars[i] = apps.EnvVar{Name: ev.Name}
+	}
+	deployment.EnvVars = maskedEnvVars
+
+	return Response{Body: deployment}
 }
 
 func (s *FakeWorkspace) AppsStart(_ Request, name string) Response {
@@ -144,6 +193,11 @@ func (s *FakeWorkspace) AppsStart(_ Request, name string) Response {
 		State:   apps.ComputeStateActive,
 		Message: "App compute is active.",
 	}
+	// Starting the compute brings the application up.
+	app.AppStatus = &apps.ApplicationStatus{
+		State:   "RUNNING",
+		Message: appStatusRunningMessage,
+	}
 	s.Apps[name] = app
 
 	return Response{Body: app}
@@ -159,13 +213,74 @@ func (s *FakeWorkspace) AppsStop(_ Request, name string) Response {
 
 	app.ComputeStatus = &apps.ComputeStatus{
 		State:   apps.ComputeStateStopped,
-		Message: "App compute is stopped.",
+		Message: "Start the app compute to deploy the app.",
+	}
+	// Stopping the compute takes the application down.
+	app.AppStatus = &apps.ApplicationStatus{
+		State:   "UNAVAILABLE",
+		Message: appStatusUnavailableMessage,
 	}
+	// The backend clears both deployments on stop for the apps these fixtures use,
+	// so the deploy-only fields read back empty. Match that so drift tests are realistic.
+	app.ActiveDeployment = nil
+	app.PendingDeployment = nil
 	s.Apps[name] = app
 
 	return Response{Body: app}
 }
 
+// AppsGet returns the app, keeping DELETING resources visible so callers can
+// observe transient state (matches the cloud DELETE lifecycle).
+func (s *FakeWorkspace) AppsGet(name string) Response {
+	defer s.LockUnlock()()
+
+	app, ok := s.Apps[name]
+	if !ok {
+		return Response{
+			StatusCode: 404,
+			Body:       map[string]string{"message": fmt.Sprintf("Resource apps.App not found: %v", name)},
+		}
+	}
+
+	return Response{Body: app}
+}
+
+// AppsDelete simulates the real Apps DELETE lifecycle: the first DELETE flips
+// the app into DELETING state (without removing it), and a second DELETE while
+// still in DELETING returns 400 with the exact cloud error message.
+func (s *FakeWorkspace) AppsDelete(name string) Response {
+	defer s.LockUnlock()()
+
+	app, ok := s.Apps[name]
+	if !ok {
+		return Response{StatusCode: 404}
+	}
+
+	if app.ComputeStatus != nil && app.ComputeStatus.State == apps.ComputeStateDeleting {
+		return Response{
+			StatusCode: http.StatusBadRequest,
+			Body: map[string]string{
+				"error_code": "BAD_REQUEST",
+				"message": fmt.Sprintf(
+					"Cannot delete app %s as it is not terminal with state DELETING, "+
+						"and was updated less than 20 minutes ago. Please wait before trying again.", name),
+			},
+		}
+	}
+
+	app.ComputeStatus = &apps.ComputeStatus{
+		State:   apps.ComputeStateDeleting,
+		Message: "App is being deleted.",
+	}
+	app.AppStatus = &apps.ApplicationStatus{
+		State:   "UNAVAILABLE",
+		Message: appStatusUnavailableMessage,
+	}
+	s.Apps[name] = app
+
+	return Response{}
+}
+
 func (s *FakeWorkspace) AppsUpsert(req Request, name string) Response {
 	var app apps.App
 
@@ -205,18 +320,22 @@ func (s *FakeWorkspace) AppsUpsert(req Request, name string) Response {
 		}
 	}
 
-	app.AppStatus = &apps.ApplicationStatus{
-		State:   "RUNNING",
-		Message: "Application is running.",
-	}
-
-	// Respect no_compute query param: if true, start the app in STOPPED state.
+	// A no_compute app is created without running compute, so on cloud it
+	// reports an UNAVAILABLE application status until it is started.
 	if req.URL.Query().Get("no_compute") == "true" {
+		app.AppStatus = &apps.ApplicationStatus{
+			State:   "UNAVAILABLE",
+			Message: appStatusUnavailableMessage,
+		}
 		app.ComputeStatus = &apps.ComputeStatus{
 			State:   apps.ComputeStateStopped,
 			Message: "App compute is stopped.",
 		}
 	} else {
+		app.AppStatus = &apps.ApplicationStatus{
+			State:   "RUNNING",
+			Message: "Application is running.",
+		}
 		app.ComputeStatus = &apps.ComputeStatus{
 			State:   "ACTIVE",
 			Message: "App compute is active.",
@@ -244,6 +363,10 @@ func (s *FakeWorkspace) AppsUpsert(req Request, name string) Response {
 		app.ComputeSize = "MEDIUM"
 	}
 
+	// The platform enables user access token forwarding regardless of what the
+	// request asked for, so the remote always reports true.
+	app.ForwardUserAccessToken = true
+
 	// Assign a service principal to the app, mimicking the real platform.
 	if app.ServicePrincipalClientId == "" {
 		app.ServicePrincipalClientId = nextUUID()
@@ -267,6 +390,8 @@ func (s *FakeWorkspace) AppsUpsert(req Request, name string) Response {
 		})
 	}
 
+	setUcSecurableKinds(&app)
+
 	s.Apps[name] = app
 	return Response{
 		Body: app,
diff --git a/libs/testserver/bundledeployments.go b/libs/testserver/bundledeployments.go
new file mode 100644
index 00000000000..d5c190750c9
--- /dev/null
+++ b/libs/testserver/bundledeployments.go
@@ -0,0 +1,729 @@
+package testserver
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"path"
+	"slices"
+	"strconv"
+	"strings"
+
+	"github.com/databricks/databricks-sdk-go/service/bundledeployments"
+	"github.com/databricks/databricks-sdk-go/service/workspace"
+)
+
+// Handlers for the Deployment Metadata Service (DMS) API under /api/2.0/bundle.
+
+// maxOperationsPerVersion mirrors the service's compiled-in default. A bundle past it cannot
+// be recorded, since the operation set is fixed when the version is created.
+const maxOperationsPerVersion = 800
+
+// operationStatusPending is what CreateVersion leaves on a staged operation. Declared here
+// because the SDK enum is generated from the OpenAPI spec, which trails the service proto.
+const operationStatusPending bundledeployments.OperationStatus = "OPERATION_STATUS_PENDING"
+
+// State is kept in FakeWorkspace.DmsDeployments, keyed by deployment ID.
+
+// dmsDeploymentNodeName is the workspace node name the service uses for deployments.
+// It must match DEPLOYMENT_NODE_NAME on the service side (DeploymentWhsClient).
+const dmsDeploymentNodeName = "resources.deployment.json"
+
+// dmsUpdatableOperationFields are the update_mask paths UpdateOperation accepts. Any
+// other path is rejected, and action_type in particular is fixed when the operation is
+// created.
+var dmsUpdatableOperationFields = []string{"state", "error_message", "resource_id", "status"}
+
+// dmsResourceTypes lists the resource_key prefixes accepted by DMS.
+// NOTE: When adding a type here, also add the corresponding enum in bundle/metadata-service/service.proto
+// and prefix mapping in parser/ResourceTypes.java in Universe.
+var dmsResourceTypes = []string{
+	"agent_services",
+	"alerts",
+	"apps",
+	"catalogs",
+	"cluster_policies",
+	"clusters",
+	"dashboards",
+	"database_catalogs",
+	"database_instances",
+	"experiments",
+	"external_locations",
+	"genie_spaces",
+	"instance_pools",
+	"internal_immutable_folders",
+	"internal_immutable_snapshots",
+	"job_runs",
+	"jobs",
+	"mcp_services",
+	"model_provider_services",
+	"model_services",
+	"model_serving_endpoints",
+	"models",
+	"pipelines",
+	"postgres_branches",
+	"postgres_catalogs",
+	"postgres_databases",
+	"postgres_endpoints",
+	"postgres_projects",
+	"postgres_roles",
+	"postgres_snapshot_schedules",
+	"postgres_synced_tables",
+	"quality_monitors",
+	"registered_models",
+	"schemas",
+	"secret_scopes",
+	"secrets",
+	"sql_warehouses",
+	"synced_database_tables",
+	"vector_search_endpoints",
+	"vector_search_indexes",
+	"volumes",
+}
+
+// DmsDeployment holds a deployment record together with the versions and
+// resources recorded under it, so the read APIs (ListVersions/ListResources)
+// can serve back what deploys wrote.
+type DmsDeployment struct {
+	Deployment bundledeployments.Deployment
+	Versions   map[string]*bundledeployments.Version
+	// resources is the latest resource state per resource key, updated as
+	// operations are recorded.
+	Resources map[string]bundledeployments.Resource
+	// operations holds the recorded operations by resource name. The service keeps
+	// one per resource per version, so a resource written twice in a version updates
+	// its operation rather than adding another.
+	Operations map[string]*bundledeployments.Operation
+	// lastSuccessfulVersionID is the highest version completed successfully.
+	// The read path treats a non-empty value as "DMS owns the state";
+	// the SDK Deployment struct does not yet carry this field.
+	LastSuccessfulVersionID string
+}
+
+func (s *FakeWorkspace) CreateDeployment(req Request) Response {
+	var dep bundledeployments.Deployment
+	if err := json.Unmarshal(req.Body, &dep); err != nil {
+		return Response{StatusCode: 400, Body: map[string]string{"message": err.Error()}}
+	}
+	if dep.InitialParentPath == "" {
+		return Response{
+			StatusCode: 400,
+			Body:       map[string]string{"error_code": "INVALID_PARAMETER_VALUE", "message": "initial_parent_path is required"},
+		}
+	}
+
+	defer s.LockUnlock()()
+
+	// The service registers the deployment as a workspace node under
+	// initial_parent_path and uses that node's ID as the deployment ID, so a
+	// get-status on the node path is how clients look the deployment back up.
+	nodePath := path.Join(dep.InitialParentPath, dmsDeploymentNodeName)
+	if resp, ok := s.requireParentDirectory(nodePath); !ok {
+		return resp
+	}
+	objectID := nextTreenodeID()
+	s.files[nodePath] = FileEntry{
+		Info: workspace.ObjectInfo{
+			// The service registers its own node type, which get-status reports back;
+			// a plain FILE is what the fake used to claim and the real API never returns.
+			ObjectType: "BUNDLE_DEPLOYMENT",
+			Path:       nodePath,
+			ObjectId:   objectID,
+		},
+	}
+
+	// The record carries no version yet; last_version_id stays empty until
+	// the first CreateVersion. A failed registration leaves a record with no versions.
+	deploymentID := strconv.FormatInt(objectID, 10)
+	s.DmsDeploymentNodes[deploymentID] = nodePath
+
+	if resp, ok := checkWorkspaceInfo(dep.WorkspaceInfo); !ok {
+		return resp
+	}
+
+	dep.Name = "deployments/" + deploymentID
+	dep.Status = bundledeployments.DeploymentStatusDeploymentStatusActive
+	s.DmsDeployments[deploymentID] = &DmsDeployment{
+		Deployment: dep,
+		Versions:   map[string]*bundledeployments.Version{},
+		Resources:  map[string]bundledeployments.Resource{},
+		Operations: map[string]*bundledeployments.Operation{},
+	}
+	return Response{Body: dep}
+}
+
+func (s *FakeWorkspace) GetDeployment(deploymentID string) Response {
+	defer s.LockUnlock()()
+
+	d, ok := s.DmsDeployments[deploymentID]
+	if !ok {
+		return dmsNotFound("deployment " + deploymentID)
+	}
+
+	body, err := deploymentBody(d)
+	if err != nil {
+		return Response{StatusCode: 500, Body: map[string]string{"message": err.Error()}}
+	}
+	return Response{Body: body}
+}
+
+// deploymentBody renders a deployment with last_successful_version_id, which
+// the SDK struct doesn't yet carry. Embedding in a wrapper won't work because
+// Deployment.MarshalJSON silently drops sibling fields.
+func deploymentBody(d *DmsDeployment) (map[string]any, error) {
+	raw, err := json.Marshal(d.Deployment)
+	if err != nil {
+		return nil, err
+	}
+
+	var body map[string]any
+	dec := json.NewDecoder(bytes.NewReader(raw))
+	dec.UseNumber()
+	if err := dec.Decode(&body); err != nil {
+		return nil, err
+	}
+
+	if d.LastSuccessfulVersionID != "" {
+		body["last_successful_version_id"] = d.LastSuccessfulVersionID
+	}
+
+	// The service emits these blocks in proto field order rather than the SDK's
+	// alphabetical order, and `databricks api` prints response keys verbatim.
+	if gi := d.Deployment.GitInfo; gi != nil {
+		body["git_info"] = dmsGitInfo{OriginUrl: gi.OriginUrl, Branch: gi.Branch, Commit: gi.Commit}
+	}
+	if wi := d.Deployment.WorkspaceInfo; wi != nil {
+		body["workspace_info"] = dmsWorkspaceInfo{
+			RootPath:       wi.RootPath,
+			FilePath:       wi.FilePath,
+			BundleRootPath: wi.BundleRootPath,
+			GitFolderPath:  wi.GitFolderPath,
+			SourceLinked:   wi.SourceLinked,
+		}
+	}
+	return body, nil
+}
+
+// dmsGitInfo mirrors bundledeployments.GitInfo with fields in the service's key order.
+type dmsGitInfo struct {
+	OriginUrl string `json:"origin_url,omitempty"`
+	Branch    string `json:"branch,omitempty"`
+	Commit    string `json:"commit,omitempty"`
+}
+
+// dmsWorkspaceInfo mirrors bundledeployments.WorkspaceInfo with fields in the service's
+// key order. Only root_path and file_path have been observed on cloud; the rest follow.
+type dmsWorkspaceInfo struct {
+	RootPath       string `json:"root_path,omitempty"`
+	FilePath       string `json:"file_path,omitempty"`
+	BundleRootPath string `json:"bundle_root_path,omitempty"`
+	GitFolderPath  string `json:"git_folder_path,omitempty"`
+	SourceLinked   bool   `json:"source_linked,omitempty"`
+}
+
+// dmsUpdatableDeploymentFields are the update_mask paths UpdateDeployment accepts.
+var dmsUpdatableDeploymentFields = []string{"display_name", "target_name", "deployment_mode", "workspace_info"}
+
+// checkWorkspaceInfo rejects a bundle_root_path without the git_folder_path it is relative to,
+// and a root_path or file_path that is not absolute, which is what the service does.
+func checkWorkspaceInfo(ws *bundledeployments.WorkspaceInfo) (Response, bool) {
+	if ws != nil {
+		if ws.RootPath != "" && !strings.HasPrefix(ws.RootPath, "/") {
+			return dmsInvalidArgument("workspace_info.root_path must be an absolute workspace path"), false
+		}
+		if ws.FilePath != "" && !strings.HasPrefix(ws.FilePath, "/") {
+			return dmsInvalidArgument("workspace_info.file_path must be an absolute workspace path"), false
+		}
+	}
+	if ws != nil && (ws.GitFolderPath == "") != (ws.BundleRootPath == "") {
+		return dmsInvalidArgument("workspace_info.git_folder_path and workspace_info.bundle_root_path must be set together"), false
+	}
+	return Response{}, true
+}
+
+func (s *FakeWorkspace) UpdateDeployment(req Request, deploymentID string) Response {
+	var raw map[string]json.RawMessage
+	if err := json.Unmarshal(req.Body, &raw); err != nil {
+		return Response{StatusCode: 400, Body: map[string]string{"message": err.Error()}}
+	}
+	var dep bundledeployments.Deployment
+	if err := json.Unmarshal(req.Body, &dep); err != nil {
+		return Response{StatusCode: 400, Body: map[string]string{"message": err.Error()}}
+	}
+
+	updateMask := req.URL.Query().Get("update_mask")
+	if updateMask == "" {
+		return dmsInvalidArgument("update_mask is required")
+	}
+	update := map[string]bool{}
+	for path := range strings.SplitSeq(updateMask, ",") {
+		path = strings.TrimSpace(path)
+		if !slices.Contains(dmsUpdatableDeploymentFields, path) {
+			return dmsInvalidArgument("update_mask path " + path + " is not updatable")
+		}
+		if _, sent := raw[path]; !sent {
+			// An empty value is how a field is cleared, so the field has to be there to say so.
+			return dmsInvalidArgument(path + " is required when '" + path + "' is in update_mask (an empty value clears it)")
+		}
+		update[path] = true
+	}
+
+	if resp, ok := checkWorkspaceInfo(dep.WorkspaceInfo); !ok {
+		return resp
+	}
+
+	defer s.LockUnlock()()
+
+	d, ok := s.DmsDeployments[deploymentID]
+	if !ok {
+		return dmsNotFound("deployment " + deploymentID)
+	}
+
+	// Only the masked paths are written; every other field of the body is ignored.
+	if update["display_name"] {
+		d.Deployment.DisplayName = dep.DisplayName
+	}
+	if update["target_name"] {
+		d.Deployment.TargetName = dep.TargetName
+	}
+	if update["deployment_mode"] {
+		d.Deployment.DeploymentMode = dep.DeploymentMode
+	}
+	if update["workspace_info"] {
+		d.Deployment.WorkspaceInfo = dep.WorkspaceInfo
+	}
+
+	body, err := deploymentBody(d)
+	if err != nil {
+		return Response{StatusCode: 500, Body: map[string]string{"message": err.Error()}}
+	}
+	return Response{Body: body}
+}
+
+func (s *FakeWorkspace) DeleteDeployment(deploymentID string) Response {
+	defer s.LockUnlock()()
+
+	// The service trashes the deployment's workspace node, so a later get-status
+	// on the node path reports the deployment as absent.
+	if nodePath, ok := s.DmsDeploymentNodes[deploymentID]; ok {
+		delete(s.files, nodePath)
+	}
+	delete(s.DmsDeploymentNodes, deploymentID)
+	delete(s.DmsDeployments, deploymentID)
+	return Response{Body: map[string]any{}}
+}
+
+func (s *FakeWorkspace) CreateVersion(req Request, deploymentID string) Response {
+	versionID := req.URL.Query().Get("version_id")
+
+	var version bundledeployments.Version
+	if err := json.Unmarshal(req.Body, &version); err != nil {
+		return Response{StatusCode: 400, Body: map[string]string{"message": err.Error()}}
+	}
+
+	// operations rides in the version body like every other field, but is absent from the
+	// generated struct while the field is at DEVELOPMENT stage, so it is read separately.
+	// Embedding Version instead would promote its own UnmarshalJSON and silently drop this
+	// field. It is input only, so it is read here and never returned.
+	var staged struct {
+		Operations []struct {
+			ResourceKey string                                `json:"resource_key"`
+			ActionType  bundledeployments.OperationActionType `json:"action_type"`
+		} `json:"operations"`
+	}
+	if err := json.Unmarshal(req.Body, &staged); err != nil {
+		return Response{StatusCode: 400, Body: map[string]string{"message": err.Error()}}
+	}
+
+	defer s.LockUnlock()()
+
+	d, ok := s.DmsDeployments[deploymentID]
+	if !ok {
+		return dmsNotFound("deployment " + deploymentID)
+	}
+
+	// version_id must be numerically greater than the most recent version,
+	// and previous_version_id must name that version to detect concurrent deploys.
+	next, err := strconv.ParseInt(versionID, 10, 64)
+	if err != nil || next < 1 {
+		return dmsInvalidArgument("version_id must be a positive integer, got " + versionID)
+	}
+	var last int64
+	if d.Deployment.LastVersionId != "" {
+		last, _ = strconv.ParseInt(d.Deployment.LastVersionId, 10, 64)
+	}
+	if next <= last {
+		return dmsInvalidArgument("version_id " + versionID + " must be greater than the most recent version " + d.Deployment.LastVersionId)
+	}
+	if version.PreviousVersionId != d.Deployment.LastVersionId {
+		return dmsAborted("previous_version_id is outdated; the deployment's most recent version is " + d.Deployment.LastVersionId)
+	}
+
+	// Note: deployment lock not modelled. Tests kill the CLI mid-apply, leaving
+	// the version in-progress forever, whereas the real service lets the lease expire.
+
+	// A version records its whole operation set up front; there is no API to add one later.
+	if len(staged.Operations) > maxOperationsPerVersion {
+		return Response{
+			StatusCode: 429,
+			Body: map[string]string{
+				"error_code": "RESOURCE_EXHAUSTED",
+				"message":    fmt.Sprintf("a version may stage at most %d operations, got %d", maxOperationsPerVersion, len(staged.Operations)),
+			},
+		}
+	}
+	seen := make(map[string]bool, len(staged.Operations))
+	for _, staged := range staged.Operations {
+		resourceType, _, hasPrefix := strings.Cut(staged.ResourceKey, ".")
+		switch {
+		case staged.ResourceKey == "":
+			return dmsInvalidArgument("operations.resource_key is required")
+		case !hasPrefix || !slices.Contains(dmsResourceTypes, resourceType):
+			return dmsInvalidArgument("operations.resource_key must have a known resource type prefix (e.g. 'jobs.', 'pipelines.'): " + staged.ResourceKey)
+		case staged.ActionType == "":
+			return dmsInvalidArgument("operations.action_type is required and must not be UNSPECIFIED for resource " + staged.ResourceKey)
+		case seen[staged.ResourceKey]:
+			return dmsInvalidArgument("operations must have distinct resource_keys; duplicate: " + staged.ResourceKey)
+		}
+		seen[staged.ResourceKey] = true
+	}
+
+	d.Deployment.LastVersionId = versionID
+	version.Name = "deployments/" + deploymentID + "/versions/" + versionID
+	version.VersionId = versionID
+	version.Status = bundledeployments.VersionStatusVersionStatusInProgress
+	d.Versions[versionID] = &version
+
+	// The deployment's git provenance is derived from the version that carried it; the rest of
+	// its metadata is written through CreateDeployment and UpdateDeployment.
+	d.Deployment.GitInfo = version.GitInfo
+
+	// Each staged operation starts pending at sequence 0, and the CLI fills in its outcome
+	// with UpdateOperation as the resource is applied.
+	for _, staged := range staged.Operations {
+		opName := "deployments/" + deploymentID + "/versions/" + versionID + "/operations/" + staged.ResourceKey
+		d.Operations[opName] = &bundledeployments.Operation{
+			Name:        opName,
+			ResourceKey: staged.ResourceKey,
+			ActionType:  staged.ActionType,
+			Status:      operationStatusPending,
+			SequenceId:  0,
+		}
+	}
+
+	return Response{Body: version}
+}
+
+func (s *FakeWorkspace) CompleteVersion(req Request, deploymentID, versionID string) Response {
+	var completeReq bundledeployments.CompleteVersionRequest
+	if err := json.Unmarshal(req.Body, &completeReq); err != nil {
+		return Response{StatusCode: 400, Body: map[string]string{"message": err.Error()}}
+	}
+
+	defer s.LockUnlock()()
+
+	d, ok := s.DmsDeployments[deploymentID]
+	if !ok {
+		return dmsNotFound("deployment " + deploymentID)
+	}
+	v, ok := d.Versions[versionID]
+	if !ok {
+		return dmsNotFound("version " + versionID)
+	}
+
+	v.Status = bundledeployments.VersionStatusVersionStatusCompleted
+	v.CompletionReason = completeReq.CompletionReason
+	if completeReq.CompletionReason == bundledeployments.VersionCompleteVersionCompleteSuccess {
+		d.LastSuccessfulVersionID = versionID
+	}
+	return Response{Body: *v}
+}
+
+func (s *FakeWorkspace) Heartbeat() Response {
+	return Response{Body: bundledeployments.HeartbeatResponse{}}
+}
+
+// operationBody renders sequence_id as a JSON string, like the real service.
+// The SDK reads that string back into its int64 field, so this matches prod.
+func operationBody(op *bundledeployments.Operation) (map[string]any, error) {
+	raw, err := json.Marshal(op)
+	if err != nil {
+		return nil, err
+	}
+
+	var body map[string]any
+	dec := json.NewDecoder(bytes.NewReader(raw))
+	dec.UseNumber()
+	if err := dec.Decode(&body); err != nil {
+		return nil, err
+	}
+
+	body["sequence_id"] = strconv.FormatInt(op.SequenceId, 10)
+	return body, nil
+}
+
+// UpdateOperation applies a later write for a resource already recorded in this
+// version. sequence_id is the concurrency precondition and increments on success.
+func (s *FakeWorkspace) UpdateOperation(req Request, deploymentID, versionID, resourceKey string) Response {
+	// raw tracks which fields the body sent. A masked field with no value means clear it.
+	var raw map[string]json.RawMessage
+	if err := json.Unmarshal(req.Body, &raw); err != nil {
+		return Response{StatusCode: 400, Body: map[string]string{"message": err.Error()}}
+	}
+	// sequence_id comes as a number (SDK) or a string (real service). Operation reads
+	// either into int64, so the whole body decodes in one shot.
+	var op bundledeployments.Operation
+	if err := json.Unmarshal(req.Body, &op); err != nil {
+		return Response{StatusCode: 400, Body: map[string]string{"message": err.Error()}}
+	}
+
+	updateMask := req.URL.Query().Get("update_mask")
+	if updateMask == "" {
+		return dmsInvalidArgument("update_mask is required")
+	}
+	// Only masked paths are written; other fields keep their values.
+	// Omitting state keeps the already-recorded state.
+	update := map[string]bool{}
+	for path := range strings.SplitSeq(updateMask, ",") {
+		path = strings.TrimSpace(path)
+		if !slices.Contains(dmsUpdatableOperationFields, path) {
+			return dmsInvalidArgument("update_mask path " + path + " is not updatable")
+		}
+		// state is the exception: masked with no value is how the service is told the resource
+		// is gone, which is what stops it being listed.
+		if _, sent := raw[path]; !sent && path != "state" {
+			// An empty value is how a field is cleared, so the field has to be there to say so.
+			return dmsInvalidArgument(path + " is required when '" + path + "' is in update_mask (an empty value clears it)")
+		}
+		update[path] = true
+	}
+
+	// The service parses the status as a proto enum, so a value outside the enum arrives as
+	// UNSPECIFIED and is refused. Checked here too: a status the API does not have otherwise
+	// passes every local test and fails only against a real workspace.
+	if update["status"] {
+		switch op.Status {
+		case bundledeployments.OperationStatusOperationStatusSucceeded,
+			bundledeployments.OperationStatusOperationStatusFailed,
+			operationStatusPending:
+		default:
+			return dmsInvalidArgument("status is required and must not be UNSPECIFIED when 'status' is in update_mask")
+		}
+	}
+
+	// The service counts only a state it was given as recording one, so these ask whether a
+	// value arrived rather than whether the mask names the field.
+	_, stateSent := raw["state"]
+	recordsState := update["state"] && stateSent
+
+	// A resource_id can be written but not cleared, and only alongside the state it belongs to.
+	if update["resource_id"] {
+		if op.ResourceId == "" {
+			return dmsInvalidArgument("resource_id is required when 'resource_id' is in update_mask")
+		}
+		if !recordsState {
+			return dmsInvalidArgument("state must be in update_mask when 'resource_id' is")
+		}
+	}
+
+	defer s.LockUnlock()()
+
+	d, ok := s.DmsDeployments[deploymentID]
+	if !ok {
+		return dmsNotFound("deployment " + deploymentID)
+	}
+
+	opName := "deployments/" + deploymentID + "/versions/" + versionID + "/operations/" + resourceKey
+	existing, ok := d.Operations[opName]
+	if !ok {
+		return dmsNotFound("operation " + opName)
+	}
+	if op.SequenceId != existing.SequenceId {
+		return dmsAborted("sequence_id is outdated; the operation is at " + strconv.FormatInt(existing.SequenceId, 10))
+	}
+
+	// Invariants check the operation after the update, not the request.
+	// The mask leaves unspecified fields unchanged.
+	after := *existing
+	if update["state"] {
+		after.State = op.State
+	}
+	if update["error_message"] {
+		after.ErrorMessage = op.ErrorMessage
+	}
+	if update["resource_id"] {
+		after.ResourceId = op.ResourceId
+	}
+	if update["status"] {
+		after.Status = op.Status
+	}
+
+	failed := after.Status == bundledeployments.OperationStatusOperationStatusFailed
+	if !failed && after.ErrorMessage != "" {
+		return dmsInvalidArgument("error_message is only allowed when status is OPERATION_STATUS_FAILED")
+	}
+
+	// A failure may leave no state only where nothing is left to describe: a create that never
+	// landed, or a recreate whose delete already went through.
+	if failed && after.State == "" && leavesLiveResource(after.ActionType) {
+		return dmsInvalidArgument("state is required for a " + string(after.ActionType) +
+			" operation, because it acts on a resource that already exists and cannot destroy it, even when it fails")
+	}
+
+	// An operation with state must identify its resource via resource_id,
+	// even for failed operations reporting prior state.
+	if after.State != "" && after.ResourceId == "" {
+		return dmsInvalidArgument("resource_id is required for an operation that records state")
+	}
+
+	// Only the masked fields change; action_type and resource_key stay as created.
+	if update["state"] {
+		existing.State = op.State
+	}
+	if update["error_message"] {
+		existing.ErrorMessage = op.ErrorMessage
+	}
+	if update["resource_id"] {
+		existing.ResourceId = op.ResourceId
+	}
+	if update["status"] {
+		existing.Status = op.Status
+	}
+	existing.SequenceId++
+
+	body, err := operationBody(existing)
+	if err != nil {
+		return Response{StatusCode: 500, Body: map[string]string{"message": err.Error()}}
+	}
+
+	// Only an update that names state moves the resource: naming it with no value clears
+	// it and removes the resource, and an update that leaves it out - a failure reporting
+	// its outcome - must not disturb what the deployment already holds. Every version
+	// stages its operations without state, so re-deriving this from the operation
+	// regardless of the mask would drop a resource whose deploy failed before writing.
+	if update["state"] {
+		if existing.State == "" {
+			delete(d.Resources, resourceKey)
+		} else {
+			d.Resources[resourceKey] = bundledeployments.Resource{
+				Name:           "deployments/" + deploymentID + "/resources/" + resourceKey,
+				ResourceKey:    resourceKey,
+				ResourceId:     existing.ResourceId,
+				ResourceType:   existing.ResourceType,
+				LastActionType: existing.ActionType,
+				LastVersionId:  versionID,
+				State:          existing.State,
+			}
+		}
+	} else if resource, projected := d.Resources[resourceKey]; projected && update["resource_id"] {
+		// resource_id is mirrored too, for a resource the deployment still holds.
+		resource.ResourceId = existing.ResourceId
+		d.Resources[resourceKey] = resource
+	}
+
+	return Response{Body: body}
+}
+
+func (s *FakeWorkspace) ListResources(deploymentID string) Response {
+	defer s.LockUnlock()()
+
+	d, ok := s.DmsDeployments[deploymentID]
+	if !ok {
+		return dmsNotFound("deployment " + deploymentID)
+	}
+
+	// Sort by resource key so the response order is deterministic.
+	keys := make([]string, 0, len(d.Resources))
+	for key := range d.Resources {
+		keys = append(keys, key)
+	}
+	slices.Sort(keys)
+
+	resources := make([]bundledeployments.Resource, 0, len(keys))
+	for _, key := range keys {
+		resources = append(resources, d.Resources[key])
+	}
+	return Response{Body: bundledeployments.ListResourcesResponse{Resources: resources}}
+}
+
+func (s *FakeWorkspace) ListOperations(deploymentID, versionID string) Response {
+	defer s.LockUnlock()()
+
+	d, ok := s.DmsDeployments[deploymentID]
+	if !ok {
+		return dmsNotFound("deployment " + deploymentID)
+	}
+
+	_, ok = d.Versions[versionID]
+	if !ok {
+		return dmsNotFound("version " + versionID)
+	}
+
+	// Collect operations for this version by filtering the operation name prefix.
+	// Operation names are: deployments/{deployment_id}/versions/{version_id}/operations/{resource_key}
+	versionPrefix := "deployments/" + deploymentID + "/versions/" + versionID + "/operations/"
+	var ops []*bundledeployments.Operation
+	for name, op := range d.Operations {
+		if strings.HasPrefix(name, versionPrefix) {
+			ops = append(ops, op)
+		}
+	}
+
+	// Sort by resource key so the response order is deterministic.
+	slices.SortFunc(ops, func(a, b *bundledeployments.Operation) int {
+		return strings.Compare(a.ResourceKey, b.ResourceKey)
+	})
+
+	response := bundledeployments.ListOperationsResponse{
+		Operations: make([]bundledeployments.Operation, len(ops)),
+	}
+	for i, op := range ops {
+		response.Operations[i] = *op
+	}
+	return Response{Body: response}
+}
+
+// leavesLiveResource reports whether a failed operation of this type leaves a resource behind
+// that it still has to describe. A create leaves nothing, and a recreate already deleted.
+func leavesLiveResource(action bundledeployments.OperationActionType) bool {
+	switch action {
+	case bundledeployments.OperationActionTypeOperationActionTypeCreate,
+		bundledeployments.OperationActionTypeOperationActionTypeRecreate:
+		return false
+	default:
+		return true
+	}
+}
+
+// dmsNotFound returns the RESOURCE_DOES_NOT_EXIST error shape the DMS API uses,
+// which the SDK maps to apierr.ErrNotFound.
+func dmsNotFound(what string) Response {
+	return Response{
+		StatusCode: 404,
+		// Content-Type is required for the SDK to parse the body into a typed error,
+		// which is what callers match against apierr.ErrResourceDoesNotExist.
+		Headers: map[string][]string{"Content-Type": {"application/json"}},
+		Body: map[string]string{
+			"error_code": "RESOURCE_DOES_NOT_EXIST",
+			"message":    what + " does not exist",
+		},
+	}
+}
+
+// dmsAborted returns the 409 ABORTED error the server uses for the version
+// optimistic-concurrency check.
+func dmsInvalidArgument(message string) Response {
+	return Response{
+		StatusCode: 400,
+		Headers:    map[string][]string{"Content-Type": {"application/json"}},
+		Body:       map[string]string{"error_code": "INVALID_PARAMETER_VALUE", "message": message},
+	}
+}
+
+func dmsAborted(message string) Response {
+	return Response{
+		StatusCode: 409,
+		Headers:    map[string][]string{"Content-Type": {"application/json"}},
+		Body:       map[string]string{"error_code": "ABORTED", "message": message},
+	}
+}
diff --git a/libs/testserver/catalogs.go b/libs/testserver/catalogs.go
index 859721ee73d..9759b4b1a19 100644
--- a/libs/testserver/catalogs.go
+++ b/libs/testserver/catalogs.go
@@ -4,10 +4,16 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"strings"
 
 	"github.com/databricks/databricks-sdk-go/service/catalog"
 )
 
+// catalogNameManagedDefaults scopes the managed-property injection to the
+// backend-default drift test, keeping unrelated tests free of it. Mirrors
+// schemaNameManagedDefaults.
+const catalogNameManagedDefaults = "catalog_managed_defaults"
+
 func (s *FakeWorkspace) CatalogsCreate(req Request) Response {
 	defer s.LockUnlock()()
 
@@ -19,10 +25,28 @@ func (s *FakeWorkspace) CatalogsCreate(req Request) Response {
 		}
 	}
 
+	// UC rejects an empty name; the fake would otherwise store a catalog under a key
+	// nothing can look up. Message is UC's canned error, which names more than we check.
+	if createRequest.Name == "" {
+		return Response{
+			StatusCode: http.StatusBadRequest,
+			Body: map[string]string{
+				"error_code": "INVALID_PARAMETER_VALUE",
+				"message":    `Invalid input: RPC CreateCatalog Field managedcatalog.CatalogInfo.name: name "" is not a valid name. Valid names cannot contain spaces, periods, forward slashes, or control characters.`,
+			},
+		}
+	}
+
+	// Echo back every field create accepts: a dropped one makes the next plan see a
+	// phantom change.
 	catalogInfo := catalog.CatalogInfo{
-		Name:         createRequest.Name,
-		Comment:      createRequest.Comment,
-		StorageRoot:  createRequest.StorageRoot,
+		Name:                      createRequest.Name,
+		Comment:                   createRequest.Comment,
+		ConnectionName:            createRequest.ConnectionName,
+		CustomMaxRetentionHours:   createRequest.CustomMaxRetentionHours,
+		ManagedEncryptionSettings: createRequest.ManagedEncryptionSettings,
+		// Strip trailing slash to mimic UC API normalization behavior (see volumes.go).
+		StorageRoot:  strings.TrimRight(createRequest.StorageRoot, "/"),
 		ProviderName: createRequest.ProviderName,
 		ShareName:    createRequest.ShareName,
 		Options:      createRequest.Options,
@@ -36,6 +60,18 @@ func (s *FakeWorkspace) CatalogsCreate(req Request) Response {
 		CatalogType:  catalog.CatalogTypeManagedCatalog,
 	}
 	catalogInfo.UpdatedAt = catalogInfo.CreatedAt
+	if catalogInfo.Properties == nil && createRequest.Name == catalogNameManagedDefaults {
+		// Mirror UC: managed system defaults are populated when the user sets none.
+		catalogInfo.Properties = map[string]string{
+			"unity.catalog.managed.delta.defaults.delta.enableRowTracking":                   "true",
+			"unity.catalog.managed.iceberg.defaults.delta.feature.catalogManaged":            "true",
+			"unity.catalog.managed.delta.defaults.defaultClusterByAuto":                      "true",
+			"unity.catalog.managed.delta.defaults.delta.checkpointPolicy":                    "v2",
+			"unity.catalog.managed.delta.defaults.delta.parquet.format.version":              "2.12.0",
+			"unity.catalog.managed.delta.defaults.delta.parquet.format.version.afe.internal": "2.12.0",
+			"unity.catalog.managed.delta.defaults.delta.feature.catalogManaged":              "supported",
+		}
+	}
 
 	s.Catalogs[createRequest.Name] = catalogInfo
 	return Response{
@@ -54,6 +90,11 @@ func (s *FakeWorkspace) CatalogsUpdate(req Request, name string) Response {
 		}
 	}
 
+	fields, errResponse := parseUCUpdate(req.Body, "UpdateCatalog")
+	if errResponse != nil {
+		return *errResponse
+	}
+
 	var updateRequest catalog.UpdateCatalog
 	if err := json.Unmarshal(req.Body, &updateRequest); err != nil {
 		return Response{
@@ -62,13 +103,7 @@ func (s *FakeWorkspace) CatalogsUpdate(req Request, name string) Response {
 		}
 	}
 
-	// Update only the fields that can be updated
-	if updateRequest.Comment != "" {
-		existing.Comment = updateRequest.Comment
-	}
-	if updateRequest.Owner != "" {
-		existing.Owner = updateRequest.Owner
-	}
+	applyUpdatedFields(&existing, updateRequest, fields)
 	if updateRequest.NewName != "" {
 		existing.Name = updateRequest.NewName
 		existing.FullName = updateRequest.NewName
diff --git a/libs/testserver/catalogs_test.go b/libs/testserver/catalogs_test.go
new file mode 100644
index 00000000000..aa98c477479
--- /dev/null
+++ b/libs/testserver/catalogs_test.go
@@ -0,0 +1,135 @@
+package testserver
+
+import (
+	"encoding/json"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/databricks/databricks-sdk-go/service/catalog"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestCatalogsCreate_RejectsEmptyName(t *testing.T) {
+	workspace := NewFakeWorkspace("http://test", "dbapi123")
+
+	response := workspace.CatalogsCreate(Request{Body: []byte(`{"name": ""}`)})
+	assert.Equal(t, 400, response.StatusCode)
+
+	// A stored-but-unreadable catalog under the empty key is the original bug. Asserted
+	// before the require below so it is still reported when the rejection is missing.
+	assert.Empty(t, workspace.Catalogs)
+
+	body, ok := response.Body.(map[string]string)
+	require.True(t, ok)
+	assert.Equal(t, "INVALID_PARAMETER_VALUE", body["error_code"])
+	assert.Contains(t, body["message"], "is not a valid name")
+}
+
+func TestCatalogsCreate_AllowsNonEmptyName(t *testing.T) {
+	workspace := NewFakeWorkspace("http://test", "dbapi123")
+
+	response := workspace.CatalogsCreate(Request{Body: []byte(`{"name": "my_catalog"}`)})
+	// StatusCode 0 gets converted to 200 by normalizeResponse in the server
+	require.Equal(t, 0, response.StatusCode)
+
+	// Read back through the same helper the GET route uses: a mis-keyed store must fail here.
+	getResponse := MapGet(workspace, workspace.Catalogs, "my_catalog")
+	require.Equal(t, 0, getResponse.StatusCode)
+
+	body, ok := getResponse.Body.(catalog.CatalogInfo)
+	require.True(t, ok)
+	assert.Equal(t, "my_catalog", body.Name)
+	assert.Equal(t, "my_catalog", body.FullName)
+}
+
+// createCatalogRequest sets every field CreateCatalog accepts. Tests below assert
+// the fake echoes all of them back and that the request stays exhaustive.
+const createCatalogRequest = `{
+	"name": "my_catalog",
+	"comment": "c",
+	"connection_name": "my_connection",
+	"custom_max_retention_hours": 48,
+	"managed_encryption_settings": {"customer_managed_key_id": "key-1"},
+	"options": {"opt": "1"},
+	"properties": {"prop": "2"},
+	"provider_name": "my_provider",
+	"share_name": "my_share",
+	"storage_root": "s3://bucket/root"
+}`
+
+// jsonFieldNames returns the wire names of the fields typ serializes.
+func jsonFieldNames(typ reflect.Type) []string {
+	var names []string
+	for field := range typ.Fields() {
+		name, _, _ := strings.Cut(field.Tag.Get("json"), ",")
+		if name == "" || name == "-" {
+			continue
+		}
+		names = append(names, name)
+	}
+	return names
+}
+
+func TestCatalogsCreate_EchoesEveryAcceptedField(t *testing.T) {
+	workspace := NewFakeWorkspace("http://test", "dbapi123")
+
+	response := workspace.CatalogsCreate(Request{Body: []byte(createCatalogRequest)})
+	assert.Equal(t, 0, response.StatusCode)
+
+	info, ok := response.Body.(catalog.CatalogInfo)
+	require.True(t, ok)
+
+	assert.Equal(t, "my_catalog", info.Name)
+	assert.Equal(t, "c", info.Comment)
+	assert.Equal(t, "my_connection", info.ConnectionName)
+	assert.Equal(t, int64(48), info.CustomMaxRetentionHours)
+	require.NotNil(t, info.ManagedEncryptionSettings)
+	assert.Equal(t, "key-1", info.ManagedEncryptionSettings.CustomerManagedKeyId)
+	assert.Equal(t, map[string]string{"opt": "1"}, info.Options)
+	assert.Equal(t, map[string]string{"prop": "2"}, info.Properties)
+	assert.Equal(t, "my_provider", info.ProviderName)
+	assert.Equal(t, "my_share", info.ShareName)
+	assert.Equal(t, "s3://bucket/root", info.StorageRoot)
+}
+
+// CatalogsCreate builds its response field by field, so a field the SDK adds to
+// CreateCatalog is silently dropped until someone extends the literal. Fail here
+// instead, where the message points at the field, rather than in a bundle test
+// that reports drift on a catalog it just created.
+func TestCatalogsCreate_RequestCoversEveryAcceptedField(t *testing.T) {
+	var sent map[string]any
+	require.NoError(t, json.Unmarshal([]byte(createCatalogRequest), &sent))
+
+	for _, name := range jsonFieldNames(reflect.TypeFor[catalog.CreateCatalog]()) {
+		assert.Contains(t, sent, name)
+	}
+}
+
+func TestCatalogsUpdate_AppliesUpdatableFields(t *testing.T) {
+	workspace := NewFakeWorkspace("http://test", "dbapi123")
+	require.Equal(t, 0, workspace.CatalogsCreate(Request{Body: []byte(createCatalogRequest)}).StatusCode)
+
+	// UpdateCatalog also accepts enable_predictive_optimization and isolation_mode,
+	// which DABs deliberately leaves unset (see dresources.ResourceCatalog.DoUpdate),
+	// so the fake does not model them.
+	response := workspace.CatalogsUpdate(Request{Body: []byte(`{
+		"comment": "updated",
+		"custom_max_retention_hours": 72,
+		"managed_encryption_settings": {"customer_managed_key_id": "key-2"},
+		"options": {"opt": "3"},
+		"properties": {"prop": "4"}
+	}`)}, "my_catalog")
+	assert.Equal(t, 0, response.StatusCode)
+
+	info, ok := response.Body.(catalog.CatalogInfo)
+	require.True(t, ok)
+
+	assert.Equal(t, "updated", info.Comment)
+	assert.Equal(t, int64(72), info.CustomMaxRetentionHours)
+	require.NotNil(t, info.ManagedEncryptionSettings)
+	assert.Equal(t, "key-2", info.ManagedEncryptionSettings.CustomerManagedKeyId)
+	assert.Equal(t, map[string]string{"opt": "3"}, info.Options)
+	assert.Equal(t, map[string]string{"prop": "4"}, info.Properties)
+}
diff --git a/libs/testserver/cluster_policies.go b/libs/testserver/cluster_policies.go
new file mode 100644
index 00000000000..ce29464a9e5
--- /dev/null
+++ b/libs/testserver/cluster_policies.go
@@ -0,0 +1,314 @@
+package testserver
+
+import (
+	"encoding/json"
+	"fmt"
+	"maps"
+	"reflect"
+	"slices"
+	"strings"
+
+	"github.com/databricks/databricks-sdk-go/service/compute"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+)
+
+// policyFamilyDefinition mimics the real backend: a policy created from a policy
+// family has its definition computed from the family and returned on read, even
+// though the config never sets definition. One fixed key is enough to reproduce a
+// non-empty server-computed definition so tests exercise the backend_defaults
+// suppression for definition (see cluster_policies.yml).
+func policyFamilyDefinition(familyID string) string {
+	return fmt.Sprintf(`{"policy_family":{"type":"fixed","value":%q}}`, familyID)
+}
+
+func (s *FakeWorkspace) ClusterPoliciesCreate(req Request) any {
+	// Unmarshal into the stored (GET) type directly: CreatePolicy and Policy
+	// share JSON field names, so every config field is carried over.
+	var policy compute.Policy
+	if err := json.Unmarshal(req.Body, &policy); err != nil {
+		return Response{StatusCode: 400, Body: fmt.Sprintf("request parsing error: %s", err)}
+	}
+
+	// The backend rejects definition and policy_family_id together.
+	if policy.Definition != "" && policy.PolicyFamilyId != "" {
+		return Response{
+			StatusCode: 400,
+			Body: map[string]string{
+				"error_code": "INVALID_PARAMETER_VALUE",
+				"message":    "policy_family_id and definition cannot be used together",
+			},
+		}
+	}
+
+	if policy.Definition == "" && policy.PolicyFamilyId != "" {
+		policy.Definition = policyFamilyDefinition(policy.PolicyFamilyId)
+	}
+
+	defer s.LockUnlock()()
+
+	id := nextUUID()
+	policy.PolicyId = id
+	s.ClusterPolicies[id] = policy
+
+	return Response{Body: compute.CreatePolicyResponse{PolicyId: id}}
+}
+
+func (s *FakeWorkspace) ClusterPoliciesList(req Request) any {
+	defer s.LockUnlock()()
+
+	ids := make([]string, 0, len(s.ClusterPolicies))
+	for id := range s.ClusterPolicies {
+		ids = append(ids, id)
+	}
+	slices.Sort(ids)
+
+	policies := make([]compute.Policy, 0, len(ids))
+	for _, id := range ids {
+		policies = append(policies, s.ClusterPolicies[id])
+	}
+
+	return Response{Body: compute.ListPoliciesResponse{Policies: policies}}
+}
+
+func (s *FakeWorkspace) ClusterPoliciesGet(req Request, policyId string) any {
+	defer s.LockUnlock()()
+
+	policy, ok := s.ClusterPolicies[policyId]
+	if !ok {
+		return Response{StatusCode: 404}
+	}
+
+	return Response{Body: policy}
+}
+
+func (s *FakeWorkspace) ClusterPoliciesEdit(req Request) any {
+	var request compute.EditPolicy
+	if err := json.Unmarshal(req.Body, &request); err != nil {
+		return Response{StatusCode: 400, Body: fmt.Sprintf("request parsing error: %s", err)}
+	}
+
+	defer s.LockUnlock()()
+
+	policy, ok := s.ClusterPolicies[request.PolicyId]
+	if !ok {
+		return Response{StatusCode: 404}
+	}
+
+	// Edit is a full replace of the writable fields; server-set fields
+	// (policy_id, created_at_timestamp, creator_user_name, is_default) are kept as stored.
+	policy.Name = request.Name
+	policy.Definition = request.Definition
+	policy.Description = request.Description
+	policy.Libraries = request.Libraries
+	policy.MaxClustersPerUser = request.MaxClustersPerUser
+	policy.PolicyFamilyDefinitionOverrides = request.PolicyFamilyDefinitionOverrides
+	policy.PolicyFamilyId = request.PolicyFamilyId
+	if policy.Definition == "" && policy.PolicyFamilyId != "" {
+		policy.Definition = policyFamilyDefinition(policy.PolicyFamilyId)
+	}
+	s.ClusterPolicies[request.PolicyId] = policy
+
+	return Response{}
+}
+
+func (s *FakeWorkspace) ClusterPoliciesDelete(req Request) any {
+	var request compute.DeletePolicy
+	if err := json.Unmarshal(req.Body, &request); err != nil {
+		return Response{StatusCode: 400, Body: fmt.Sprintf("request parsing error: %s", err)}
+	}
+
+	defer s.LockUnlock()()
+
+	if _, ok := s.ClusterPolicies[request.PolicyId]; !ok {
+		return Response{StatusCode: 404}
+	}
+
+	delete(s.ClusterPolicies, request.PolicyId)
+
+	return Response{}
+}
+
+// policyElement is the part of a cluster policy element the fake applies. The backend
+// supports more element types, but only these two fields materialize a value:
+// "fixed" elements set Value, every limiting type ("allowlist", "blocklist", "regex",
+// "range", "unlimited") may carry DefaultValue. "forbidden" only rejects and is ignored here.
+type policyElement struct {
+	Type         string `json:"type"`
+	Value        any    `json:"value"`
+	DefaultValue any    `json:"defaultValue"`
+}
+
+// effectiveValue returns the value this element materializes into a spec that omits the
+// attribute, or nil if it materializes none. Mirrors the backend: "fixed" applies whether
+// or not the request sets apply_policy_default_values, "defaultValue" only when it does.
+// Pinned against a real workspace by
+// acceptance/bundle/resources/jobs/cluster_policy (fixed_addition, default_flag).
+func (e policyElement) effectiveValue(applyDefaults bool) any {
+	if e.Type == "fixed" {
+		return e.Value
+	}
+	if applyDefaults {
+		return e.DefaultValue
+	}
+	return nil
+}
+
+// clusterPolicyValues returns the values the policy supplies, keyed by the policy's
+// attribute path (e.g. "spark_version", "custom_tags.CostCenter").
+func (s *FakeWorkspace) clusterPolicyValues(policyID string, applyDefaults bool) map[string]any {
+	policy, ok := s.ClusterPolicies[policyID]
+	if !ok {
+		return nil
+	}
+	var elements map[string]policyElement
+	if err := json.Unmarshal([]byte(policy.Definition), &elements); err != nil {
+		return nil
+	}
+	values := make(map[string]any, len(elements))
+	for path, element := range elements {
+		if value := element.effectiveValue(applyDefaults); value != nil {
+			values[path] = value
+		}
+	}
+	return values
+}
+
+// applyClusterPolicy fills in attributes the request omitted from the policy attached via
+// policyID. It returns the backend's validation message when a supplied value contradicts a
+// "fixed" element, or "" when the spec is acceptable; callers must hold the workspace lock and
+// surface a non-empty message as a 400.
+//
+// spec is a pointer to any struct with cluster-spec JSON tags (compute.ClusterDetails or
+// compute.ClusterSpec); the policy's attribute paths are applied against its JSON shape so
+// one implementation covers both.
+func (s *FakeWorkspace) applyClusterPolicy(spec any, policyID string, applyDefaults bool) string {
+	if policyID == "" {
+		return ""
+	}
+	values := s.clusterPolicyValues(policyID, applyDefaults)
+	if len(values) == 0 {
+		return ""
+	}
+
+	// spec came from a successful decode of the request, so re-encoding it cannot fail.
+	raw, err := json.Marshal(spec)
+	if err != nil {
+		return ""
+	}
+	// doc is only read, to test whether an attribute is already present; the spec itself is
+	// updated from patch below, so decoded numbers are never written back.
+	var doc map[string]any
+	if err := json.Unmarshal(raw, &doc); err != nil {
+		return ""
+	}
+
+	// Collect only the attributes the request omitted, then unmarshal just those back onto
+	// the spec. Unmarshaling the whole document instead would rebuild ForceSendFields from
+	// every key present, which makes fields the backend omits (e.g. the Jobs API dropping
+	// apply_policy_default_values) serialize as explicit zeros.
+	patch := map[string]any{}
+	for _, path := range slices.Sorted(maps.Keys(values)) {
+		value := values[path]
+		segments := strings.Split(path, ".")
+		if existing, ok := lookup(doc, segments); ok {
+			// A "fixed" element enforces its value as well as supplying it; anything else
+			// only supplies a default, which the request is free to override.
+			if s.isFixed(policyID, path) && !reflect.DeepEqual(existing, value) {
+				// Message shape copied from the real backend for a nested attribute
+				// ("custom_tags, CostCenter must be ..."); the wording for a top-level
+				// attribute has not been observed, so it is only approximated here.
+				return fmt.Sprintf("Cluster validation error: Validation failed for %s must be %v (is %q)",
+					strings.Join(segments, ", "), value, existing)
+			}
+			continue
+		}
+		setPatch(patch, segments, value)
+	}
+	if len(patch) == 0 {
+		return ""
+	}
+
+	if raw, err = json.Marshal(patch); err == nil {
+		_ = json.Unmarshal(raw, spec)
+	}
+	return ""
+}
+
+// isFixed reports whether the policy's element at path is a "fixed" element.
+func (s *FakeWorkspace) isFixed(policyID, path string) bool {
+	var elements map[string]policyElement
+	if err := json.Unmarshal([]byte(s.ClusterPolicies[policyID].Definition), &elements); err != nil {
+		return false
+	}
+	return elements[path].Type == "fixed"
+}
+
+// lookup returns the value at the given key path in doc.
+func lookup(doc map[string]any, path []string) (any, bool) {
+	for _, key := range path[:len(path)-1] {
+		child, ok := doc[key].(map[string]any)
+		if !ok {
+			return nil, false
+		}
+		doc = child
+	}
+	value, ok := doc[path[len(path)-1]]
+	return value, ok
+}
+
+// setPatch records value in patch at the given key path, creating intermediate maps.
+func setPatch(patch map[string]any, path []string, value any) {
+	for _, key := range path[:len(path)-1] {
+		next, ok := patch[key].(map[string]any)
+		if !ok {
+			next = map[string]any{}
+			patch[key] = next
+		}
+		patch = next
+	}
+	patch[path[len(path)-1]] = value
+}
+
+// applyPolicyDefaultValues reads apply_policy_default_values from a raw cluster request body.
+// compute.ClusterDetails has no such field, so it cannot be read off the decoded request.
+func applyPolicyDefaultValues(body []byte) bool {
+	var spec compute.ClusterSpec
+	if err := json.Unmarshal(body, &spec); err != nil {
+		return false
+	}
+	return spec.ApplyPolicyDefaultValues
+}
+
+// applyJobClusterPolicies applies attached cluster policies to every cluster spec a job can
+// carry. Callers must hold the workspace lock.
+//
+// The Pipelines API does not expand cluster policies into the stored spec: a pipeline cluster
+// with a policy_id reads back exactly as authored, verified against a real workspace by
+// acceptance/bundle/resources/pipelines/cluster_policy. So there is
+// deliberately no pipeline equivalent.
+func (s *FakeWorkspace) applyJobClusterPolicies(settings *jobs.JobSettings) string {
+	for i := range settings.JobClusters {
+		if msg := s.applyClusterSpecPolicy(settings.JobClusters[i].NewCluster); msg != "" {
+			return msg
+		}
+	}
+	for i := range settings.Tasks {
+		task := &settings.Tasks[i]
+		if msg := s.applyClusterSpecPolicy(task.NewCluster); msg != "" {
+			return msg
+		}
+		if task.ForEachTask != nil {
+			if msg := s.applyClusterSpecPolicy(task.ForEachTask.Task.NewCluster); msg != "" {
+				return msg
+			}
+		}
+	}
+	return ""
+}
+
+func (s *FakeWorkspace) applyClusterSpecPolicy(spec *compute.ClusterSpec) string {
+	if spec == nil {
+		return ""
+	}
+	return s.applyClusterPolicy(spec, spec.PolicyId, spec.ApplyPolicyDefaultValues)
+}
diff --git a/libs/testserver/cluster_policies_test.go b/libs/testserver/cluster_policies_test.go
new file mode 100644
index 00000000000..83ef663d3ed
--- /dev/null
+++ b/libs/testserver/cluster_policies_test.go
@@ -0,0 +1,110 @@
+package testserver
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/databricks/databricks-sdk-go/service/compute"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// A "fixed" element both supplies and enforces its value; a "defaultValue" element only
+// supplies one, and only when the request sets apply_policy_default_values.
+const testPolicyDefinition = `{
+	"spark_version": {"type": "fixed", "value": "policy-version"},
+	"custom_tags.Fixed": {"type": "fixed", "value": "f"},
+	"custom_tags.Default": {"type": "unlimited", "defaultValue": "d"},
+	"node_type_id": {"type": "unlimited", "defaultValue": "policy-node"}
+}`
+
+func policyWorkspace() *FakeWorkspace {
+	return &FakeWorkspace{ClusterPolicies: map[string]compute.Policy{
+		"p1": {PolicyId: "p1", Definition: testPolicyDefinition},
+	}}
+}
+
+func TestApplyClusterPolicy(t *testing.T) {
+	tests := []struct {
+		name          string
+		policyID      string
+		spec          compute.ClusterSpec
+		want          string
+		wantForceSend []string
+		wantErr       string
+	}{
+		{
+			name:          "fixed applies without apply_policy_default_values, defaultValue does not",
+			policyID:      "p1",
+			spec:          compute.ClusterSpec{PolicyId: "p1"},
+			want:          `{"custom_tags":{"Fixed":"f"},"policy_id":"p1","spark_version":"policy-version"}`,
+			wantForceSend: []string{"SparkVersion"},
+		},
+		{
+			name:          "defaultValue applies with apply_policy_default_values",
+			policyID:      "p1",
+			spec:          compute.ClusterSpec{PolicyId: "p1", ApplyPolicyDefaultValues: true},
+			want:          `{"apply_policy_default_values":true,"custom_tags":{"Default":"d","Fixed":"f"},"node_type_id":"policy-node","policy_id":"p1","spark_version":"policy-version"}`,
+			wantForceSend: []string{"NodeTypeId", "SparkVersion"},
+		},
+		{
+			name:          "a defaultValue does not override what the request supplied",
+			policyID:      "p1",
+			spec:          compute.ClusterSpec{PolicyId: "p1", ApplyPolicyDefaultValues: true, NodeTypeId: "user-node"},
+			want:          `{"apply_policy_default_values":true,"custom_tags":{"Default":"d","Fixed":"f"},"node_type_id":"user-node","policy_id":"p1","spark_version":"policy-version"}`,
+			wantForceSend: []string{"SparkVersion"},
+		},
+		{
+			name:          "policy tags merge into tags the request supplied",
+			policyID:      "p1",
+			spec:          compute.ClusterSpec{PolicyId: "p1", CustomTags: map[string]string{"Mine": "yes"}},
+			want:          `{"custom_tags":{"Fixed":"f","Mine":"yes"},"policy_id":"p1","spark_version":"policy-version"}`,
+			wantForceSend: []string{"SparkVersion"},
+		},
+		{
+			name:     "a value contradicting a fixed element is rejected",
+			policyID: "p1",
+			spec:     compute.ClusterSpec{PolicyId: "p1", SparkVersion: "user-version"},
+			wantErr:  `Cluster validation error: Validation failed for spark_version must be policy-version (is "user-version")`,
+		},
+		{
+			name:     "a tag contradicting a fixed element is rejected",
+			policyID: "p1",
+			spec:     compute.ClusterSpec{PolicyId: "p1", CustomTags: map[string]string{"Fixed": "mine"}},
+			wantErr:  `Cluster validation error: Validation failed for custom_tags, Fixed must be f (is "mine")`,
+		},
+		{
+			name:     "no policy attached leaves the spec untouched",
+			policyID: "",
+			spec:     compute.ClusterSpec{SparkVersion: "v"},
+			want:     `{"spark_version":"v"}`,
+		},
+		{
+			name:     "unknown policy leaves the spec untouched",
+			policyID: "missing",
+			spec:     compute.ClusterSpec{PolicyId: "missing", SparkVersion: "v"},
+			want:     `{"policy_id":"missing","spark_version":"v"}`,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			spec := tt.spec
+			msg := policyWorkspace().applyClusterPolicy(&spec, tt.policyID, spec.ApplyPolicyDefaultValues)
+
+			if tt.wantErr != "" {
+				assert.Equal(t, tt.wantErr, msg)
+				return
+			}
+			require.Empty(t, msg)
+
+			got, err := json.Marshal(&spec)
+			require.NoError(t, err)
+			assert.JSONEq(t, tt.want, string(got))
+			// Only attributes the policy actually supplied may become force-sent. Anything
+			// else would serialize as an explicit zero and break the fake's ability to model
+			// fields the real API drops (the Jobs API drops apply_policy_default_values).
+			assert.Equal(t, tt.wantForceSend, spec.ForceSendFields)
+		})
+	}
+}
diff --git a/libs/testserver/clusters.go b/libs/testserver/clusters.go
index c9a6ed67592..e0a046031e6 100644
--- a/libs/testserver/clusters.go
+++ b/libs/testserver/clusters.go
@@ -22,6 +22,8 @@ func (s *FakeWorkspace) ClustersCreate(req Request) any {
 
 	clusterId := nextUUID()
 	request.ClusterId = clusterId
+	// Clusters start in PENDING state when created; ClustersGet transitions them to RUNNING.
+	request.State = compute.StatePending
 
 	// Match cloud behavior: SINGLE_USER clusters automatically get single_user_name set
 	// to the current user. This enables terraform drift detection when the bundle config
@@ -30,8 +32,24 @@ func (s *FakeWorkspace) ClustersCreate(req Request) any {
 		request.SingleUserName = s.CurrentUser().UserName
 	}
 
+	// Apply the attached cluster policy before computing defaults, matching the backend:
+	// policy values feed the defaults below (e.g. driver_node_type_id from node_type_id).
+	if msg := s.applyClusterPolicy(&request, request.PolicyId, applyPolicyDefaultValues(req.Body)); msg != "" {
+		return Response{
+			StatusCode: 400,
+			Body: map[string]string{
+				"error_code": "INVALID_PARAMETER_VALUE",
+				"message":    msg,
+			},
+		}
+	}
 	clusterFixUps(&request)
 
+	// The cluster GET API returns apply_policy_default_values only under .spec, not at the top
+	// level (compute.ClusterDetails has no such field, so it is dropped by the unmarshal above).
+	// Snapshot it from the raw body so re-reads match cloud.
+	request.Spec = specSnapshot(req.Body)
+
 	s.Clusters[clusterId] = request
 
 	return Response{
@@ -41,6 +59,23 @@ func (s *FakeWorkspace) ClustersCreate(req Request) any {
 	}
 }
 
+// specSnapshot mirrors how the cluster GET API returns apply_policy_default_values under .spec
+// (it is absent from compute.ClusterDetails and thus invisible at the top level of a re-read).
+// Returns nil when the field is unset so re-reads of clusters that don't use it are unchanged;
+// a nil .spec reads back as false, which is what the field's absence means anyway.
+func specSnapshot(body []byte) *compute.ClusterSpec {
+	var spec compute.ClusterSpec
+	if err := json.Unmarshal(body, &spec); err != nil {
+		return nil
+	}
+	if !spec.ApplyPolicyDefaultValues {
+		return nil
+	}
+	return &compute.ClusterSpec{
+		ApplyPolicyDefaultValues: true,
+	}
+}
+
 func (s *FakeWorkspace) ClustersResize(req Request) any {
 	var request compute.ResizeCluster
 	if err := json.Unmarshal(req.Body, &request); err != nil {
@@ -56,6 +91,14 @@ func (s *FakeWorkspace) ClustersResize(req Request) any {
 		return Response{StatusCode: 404}
 	}
 
+	// Only running clusters can be resized; match the real API behavior.
+	if cluster.State != compute.StateRunning {
+		return Response{
+			StatusCode: 400,
+			Body:       map[string]string{"error_code": "INVALID_STATE", "message": "Cluster is not running"},
+		}
+	}
+
 	cluster.NumWorkers = request.NumWorkers
 	cluster.Autoscale = request.Autoscale
 	s.Clusters[request.ClusterId] = cluster
@@ -73,12 +116,28 @@ func (s *FakeWorkspace) ClustersEdit(req Request) any {
 	}
 
 	defer s.LockUnlock()()
-	_, ok := s.Clusters[request.ClusterId]
+	existing, ok := s.Clusters[request.ClusterId]
 	if !ok {
 		return Response{StatusCode: 404}
 	}
 
+	// Preserve runtime-only fields that the Edit API request doesn't include.
+	request.State = existing.State
+	request.ClusterId = existing.ClusterId
+	// Apply the attached cluster policy before computing defaults, matching the backend:
+	// policy values feed the defaults below (e.g. driver_node_type_id from node_type_id).
+	if msg := s.applyClusterPolicy(&request, request.PolicyId, applyPolicyDefaultValues(req.Body)); msg != "" {
+		return Response{
+			StatusCode: 400,
+			Body: map[string]string{
+				"error_code": "INVALID_PARAMETER_VALUE",
+				"message":    msg,
+			},
+		}
+	}
 	clusterFixUps(&request)
+	// Refresh the .spec snapshot from the new settings, matching cloud behavior on edit.
+	request.Spec = specSnapshot(req.Body)
 	s.Clusters[request.ClusterId] = request
 
 	// Clear venv cache when cluster is edited to match cloud behavior where
@@ -130,11 +189,40 @@ func (s *FakeWorkspace) ClustersGet(req Request, clusterId string) any {
 		return Response{StatusCode: 404}
 	}
 
+	// Simulate cluster startup: transition PENDING → RUNNING so that WaitGetClusterRunning
+	// resolves without hanging. Real clusters move through these states asynchronously.
+	if cluster.State == compute.StatePending {
+		cluster.State = compute.StateRunning
+		s.Clusters[clusterId] = cluster
+	}
+
 	return Response{
 		Body: cluster,
 	}
 }
 
+// ClustersDelete terminates a cluster (sets state to TERMINATED without removing it).
+func (s *FakeWorkspace) ClustersDelete(req Request) any {
+	var request compute.DeleteCluster
+	if err := json.Unmarshal(req.Body, &request); err != nil {
+		return Response{
+			StatusCode: 400,
+			Body:       fmt.Sprintf("request parsing error: %s", err),
+		}
+	}
+	defer s.LockUnlock()()
+
+	cluster, ok := s.Clusters[request.ClusterId]
+	if !ok {
+		return Response{StatusCode: 404}
+	}
+
+	cluster.State = compute.StateTerminated
+	s.Clusters[request.ClusterId] = cluster
+
+	return Response{}
+}
+
 func (s *FakeWorkspace) ClustersStart(req Request) any {
 	var request compute.StartCluster
 	if err := json.Unmarshal(req.Body, &request); err != nil {
diff --git a/libs/testserver/dashboards.go b/libs/testserver/dashboards.go
index eab45bdbdc1..098f790a229 100644
--- a/libs/testserver/dashboards.go
+++ b/libs/testserver/dashboards.go
@@ -8,7 +8,6 @@ import (
 	"path"
 	"strconv"
 	"strings"
-	"time"
 
 	"github.com/databricks/databricks-sdk-go/service/dashboards"
 	"github.com/databricks/databricks-sdk-go/service/workspace"
@@ -32,11 +31,15 @@ func transformSerializedDashboard(serializedDashboard, datasetCatalog, datasetSc
 		return serializedDashboard
 	}
 
+	// Track whether we modify the parsed content below.
+	mutated := false
+
 	// Add pageType to each page in the pages array (as of June 2025, this is an undocumented Lakeview API behaviour)
 	if pages, ok := dashboardContent["pages"].([]any); ok {
 		for _, page := range pages {
 			if pageMap, ok := page.(map[string]any); ok {
 				pageMap["pageType"] = "PAGE_TYPE_CANVAS"
+				mutated = true
 			}
 		}
 	}
@@ -47,21 +50,47 @@ func transformSerializedDashboard(serializedDashboard, datasetCatalog, datasetSc
 			if datasetMap, ok := dataset.(map[string]any); ok {
 				if datasetCatalog != "" {
 					datasetMap["catalog"] = datasetCatalog
+					mutated = true
 				}
 				if datasetSchema != "" {
 					datasetMap["schema"] = datasetSchema
+					mutated = true
 				}
 			}
 		}
 	}
 
-	updatedContent, err := json.Marshal(dashboardContent)
-	if err != nil {
-		return serializedDashboard
+	// Cloud returns the serialized dashboard verbatim, except it re-serializes
+	// the content when it injects the fields above and canonicalizes an empty
+	// object to "{}" (both verified against cloud). Marshaling the parsed content
+	// covers both: a mutated object re-serializes and an empty object yields "{}".
+	result := serializedDashboard
+	if mutated || len(dashboardContent) == 0 {
+		updatedContent, err := json.Marshal(dashboardContent)
+		if err != nil {
+			return serializedDashboard
+		}
+		result = string(updatedContent)
+	}
+
+	// Cloud always terminates the stored dashboard with a single trailing newline.
+	if !strings.HasSuffix(result, "\n") {
+		result += "\n"
 	}
+	return result
+}
+
+func (s *FakeWorkspace) DashboardGet(req Request) Response {
+	defer s.LockUnlock()()
 
-	// Add a newline to the end of the serialized dashboard.
-	return string(updatedContent) + "\n"
+	dashboardId := req.Vars["dashboard_id"]
+	// Read applies eventual consistency: the first GET after a create returns nil
+	// (404) to simulate propagation delay. Updates are immediately visible.
+	ptr, ok := s.Dashboards.Read(dashboardId)
+	if !ok || ptr == nil {
+		return Response{StatusCode: 404}
+	}
+	return Response{Body: *ptr}
 }
 
 func (s *FakeWorkspace) DashboardCreate(req Request) Response {
@@ -112,7 +141,7 @@ func (s *FakeWorkspace) DashboardCreate(req Request) Response {
 		dashboard.Path = dashboard.ParentPath + "/" + dashboard.DisplayName + ".lvdash.json"
 	}
 
-	dashboard.CreateTime = strings.TrimSuffix(time.Now().UTC().Format(time.RFC3339), "Z")
+	dashboard.CreateTime = nextTimestamp()
 	dashboard.UpdateTime = dashboard.CreateTime
 
 	inputSerializedDashboard := dashboard.SerializedDashboard
@@ -127,10 +156,12 @@ func (s *FakeWorkspace) DashboardCreate(req Request) Response {
 	}
 	dashboard.Etag = "80611980"
 
-	s.Dashboards[dashboard.DashboardId] = fakeDashboard{
+	// Write so that, when eventual consistency is enabled, the first GET after this
+	// create returns 404.
+	s.Dashboards.Write(dashboard.DashboardId, &fakeDashboard{
 		Dashboard:                dashboard,
 		InputSerializedDashboard: inputSerializedDashboard,
-	}
+	})
 
 	workspacePath := path.Join("/Workspace", dashboard.Path)
 	s.files[workspacePath] = FileEntry{
@@ -159,52 +190,54 @@ func (s *FakeWorkspace) DashboardUpdate(req Request) Response {
 	}
 
 	dashboardId := req.Vars["dashboard_id"]
-	dashboard, ok := s.Dashboards[dashboardId]
+	dashboard, ok := s.Dashboards.ReadStrong(dashboardId)
 	if !ok {
 		return Response{
 			StatusCode: 404,
 		}
 	}
+	updated := *dashboard
 
-	if updateReq.SerializedDashboard != dashboard.InputSerializedDashboard {
-		// Update etag.
-		prevEtag, err := strconv.Atoi(dashboard.Etag)
-		if err != nil {
-			return Response{
-				Body: map[string]string{
-					"message": "Invalid etag: " + dashboard.Etag,
-				},
-				StatusCode: 400,
-			}
+	// Bump etag on every write, matching cloud behavior.
+	prevEtag, err := strconv.Atoi(updated.Etag)
+	if err != nil {
+		return Response{
+			Body: map[string]string{
+				"message": "Invalid etag: " + updated.Etag,
+			},
+			StatusCode: 400,
 		}
-		nextEtag := prevEtag + 1
-		dashboard.Etag = strconv.Itoa(nextEtag)
+	}
+	updated.Etag = strconv.Itoa(prevEtag + 1)
 
-		// Update the input serialized dashboard.
-		dashboard.InputSerializedDashboard = updateReq.SerializedDashboard
+	if updateReq.SerializedDashboard != updated.InputSerializedDashboard {
+		updated.InputSerializedDashboard = updateReq.SerializedDashboard
 	}
 
 	// Update the dashboard.
-	dashboard.LifecycleState = dashboards.LifecycleStateActive
+	updated.LifecycleState = dashboards.LifecycleStateActive
 	if updateReq.DisplayName != "" {
-		dashboard.DisplayName = updateReq.DisplayName
-		dir := path.Dir(dashboard.Path)
+		updated.DisplayName = updateReq.DisplayName
+		dir := path.Dir(updated.Path)
 		base := updateReq.DisplayName + ".lvdash.json"
-		dashboard.Path = path.Join(dir, base)
+		updated.Path = path.Join(dir, base)
 	}
 	if updateReq.SerializedDashboard != "" {
 		// Extract dataset_catalog and dataset_schema from query parameters
 		datasetCatalog := req.URL.Query().Get("dataset_catalog")
 		datasetSchema := req.URL.Query().Get("dataset_schema")
-		dashboard.SerializedDashboard = transformSerializedDashboard(updateReq.SerializedDashboard, datasetCatalog, datasetSchema)
+		updated.SerializedDashboard = transformSerializedDashboard(updateReq.SerializedDashboard, datasetCatalog, datasetSchema)
 	}
-	dashboard.WarehouseId = updateReq.WarehouseId
-	dashboard.UpdateTime = time.Now().UTC().Format(time.RFC3339)
+	updated.WarehouseId = updateReq.WarehouseId
+	updated.UpdateTime = nextTimestamp()
 
-	s.Dashboards[dashboardId] = dashboard
+	// Write stages a stale value: like a real backend, the first read after an update
+	// returns the pre-update value. Tests that read right after an update wait for the
+	// new value with a content-aware retry (retry --until / --until-not).
+	s.Dashboards.Write(dashboardId, &updated)
 
 	return Response{
-		Body: dashboard,
+		Body: updated,
 	}
 }
 
@@ -219,7 +252,7 @@ func (s *FakeWorkspace) DashboardPublish(req Request) Response {
 	}
 
 	dashboardId := req.Vars["dashboard_id"]
-	dashboard, ok := s.Dashboards[dashboardId]
+	dashboard, ok := s.Dashboards.ReadStrong(dashboardId)
 	if !ok {
 		return Response{
 			StatusCode: 404,
@@ -230,7 +263,7 @@ func (s *FakeWorkspace) DashboardPublish(req Request) Response {
 		WarehouseId:        dashboard.WarehouseId,
 		DisplayName:        dashboard.DisplayName,
 		EmbedCredentials:   publishReq.EmbedCredentials,
-		RevisionCreateTime: time.Now().UTC().Format(time.RFC3339),
+		RevisionCreateTime: nextTimestamp(),
 		ForceSendFields:    []string{"EmbedCredentials"},
 	}
 
@@ -258,7 +291,7 @@ func (s *FakeWorkspace) DashboardTrash(req Request) Response {
 	defer s.LockUnlock()()
 
 	dashboardId := req.Vars["dashboard_id"]
-	dashboard, ok := s.Dashboards[dashboardId]
+	dashboard, ok := s.Dashboards.ReadStrong(dashboardId)
 	if !ok {
 		return Response{
 			StatusCode: 404,
@@ -266,20 +299,18 @@ func (s *FakeWorkspace) DashboardTrash(req Request) Response {
 	}
 
 	// The dashboard is marked as trashed and moved to the trash.
-	s.Dashboards[dashboardId] = fakeDashboard{
-		Dashboard: dashboards.Dashboard{
-			Etag:           dashboard.Etag,
-			DashboardId:    dashboardId,
-			LifecycleState: dashboards.LifecycleStateTrashed,
-			ParentPath:     path.Join("/Users", s.CurrentUser().UserName, "Trash"),
-		},
-	}
+	s.Dashboards.Put(dashboardId, &fakeDashboard{
+		Etag:           dashboard.Etag,
+		DashboardId:    dashboardId,
+		LifecycleState: dashboards.LifecycleStateTrashed,
+		ParentPath:     path.Join("/Users", s.CurrentUser().UserName, "Trash"),
+	})
 
 	// The published dashboard is deleted.
 	delete(s.PublishedDashboards, dashboardId)
 
 	return Response{
-		Body: dashboard,
+		Body: *dashboard,
 	}
 }
 
@@ -287,8 +318,7 @@ func (s *FakeWorkspace) DashboardUnpublish(req Request) Response {
 	defer s.LockUnlock()()
 
 	dashboardId := req.Vars["dashboard_id"]
-	_, ok := s.Dashboards[dashboardId]
-	if !ok {
+	if _, ok := s.Dashboards.ReadStrong(dashboardId); !ok {
 		return Response{
 			StatusCode: 404,
 		}
diff --git a/libs/testserver/database_catalogs.go b/libs/testserver/database_catalogs.go
index bd02a6442ff..d6dbdc49687 100644
--- a/libs/testserver/database_catalogs.go
+++ b/libs/testserver/database_catalogs.go
@@ -62,42 +62,16 @@ func (s *FakeWorkspace) DatabaseCatalogGet(name string) Response {
 	return Response{Body: result}
 }
 
+// DatabaseCatalogUpdate models the real Database API, which has no update
+// endpoint: PATCH /api/2.0/database/catalogs/{name} returns 501 NOT_IMPLEMENTED.
+// The direct engine recreates database_catalogs on any change and never calls
+// this; modeling the 501 guards against reintroducing an update path.
 func (s *FakeWorkspace) DatabaseCatalogUpdate(req Request, name string) Response {
-	defer s.LockUnlock()()
-
-	var updateRequest database.UpdateDatabaseCatalogRequest
-	err := json.Unmarshal(req.Body, &updateRequest)
-	if err != nil {
-		return Response{
-			Body:       fmt.Sprintf("cannot unmarshal request body: %v", err),
-			StatusCode: 400,
-		}
-	}
-
-	// Check if the catalog exists
-	existingCatalog, exists := s.DatabaseCatalogs[name]
-	if !exists {
-		return Response{
-			Body:       fmt.Sprintf("database catalog with name '%s' not found", name),
-			StatusCode: 404,
-		}
-	}
-
-	// Update the catalog with the new config
-	updatedCatalog := updateRequest.DatabaseCatalog
-	if updatedCatalog.Name == "" {
-		updatedCatalog.Name = existingCatalog.Name
-	}
-	if updatedCatalog.DatabaseInstanceName == "" {
-		updatedCatalog.DatabaseInstanceName = existingCatalog.DatabaseInstanceName
-	}
-	if updatedCatalog.DatabaseName == "" {
-		updatedCatalog.DatabaseName = existingCatalog.DatabaseName
-	}
-
-	s.DatabaseCatalogs[name] = updatedCatalog
-
 	return Response{
-		Body: updatedCatalog,
+		StatusCode: 501,
+		Body: map[string]string{
+			"error_code": "NOT_IMPLEMENTED",
+			"message":    "Update Database Catalog is not yet implemented",
+		},
 	}
 }
diff --git a/libs/testserver/dbutils.py b/libs/testserver/dbutils.py
index 71ea68683b4..409a880714d 100644
--- a/libs/testserver/dbutils.py
+++ b/libs/testserver/dbutils.py
@@ -17,7 +17,6 @@ class Library:
 
     def restartPython(self):
         """Mock restart - does nothing in local execution."""
-        pass
 
 
 class Notebook:
diff --git a/libs/testserver/eventual.go b/libs/testserver/eventual.go
new file mode 100644
index 00000000000..ee721d98ba5
--- /dev/null
+++ b/libs/testserver/eventual.go
@@ -0,0 +1,105 @@
+package testserver
+
+// EventualValue provides eventual-consistency read semantics for a single
+// value. After Write, the first Read returns the pre-write value; subsequent
+// Reads return the written value.
+//
+// Not safe for concurrent use; callers must hold the workspace lock.
+type EventualValue[T any] struct {
+	current T
+	stale   T
+	pending bool
+}
+
+// Write stages v as the new value. The pre-write value is returned by the
+// next ReadEventual call.
+func (e *EventualValue[T]) Write(v T) {
+	e.stale = e.current
+	e.current = v
+	e.pending = true
+}
+
+// ReadEventual returns the current value, applying eventual-consistency: the
+// first call after a Write returns the pre-write (stale) value.
+func (e *EventualValue[T]) ReadEventual() T {
+	if e.pending {
+		e.pending = false
+		return e.stale
+	}
+	return e.current
+}
+
+// ReadStrong returns the current value without consuming the pending stale
+// state. Use for write operations that need the latest committed value.
+func (e *EventualValue[T]) ReadStrong() T {
+	return e.current
+}
+
+// Put sets v as the current value immediately without staging a stale
+// version. Any pending stale state is discarded.
+func (e *EventualValue[T]) Put(v T) {
+	e.current = v
+	e.pending = false
+}
+
+// EventualMap is a keyed collection of EventualValues that share one
+// eventual-consistency mode. When eventualConsistency is enabled, the first Read
+// of a key after a Write returns the pre-write value (the zero value for a
+// freshly created key, e.g. a 404 for a not-yet-propagated resource).
+//
+// Not safe for concurrent use; callers must hold the workspace lock.
+type EventualMap[K comparable, V any] struct {
+	values              map[K]*EventualValue[V]
+	eventualConsistency bool
+}
+
+func NewEventualMap[K comparable, V any](eventualConsistency bool) *EventualMap[K, V] {
+	return &EventualMap[K, V]{
+		values:              map[K]*EventualValue[V]{},
+		eventualConsistency: eventualConsistency,
+	}
+}
+
+// Read returns the value for key, applying eventual consistency when enabled. ok
+// reports whether the key exists; value may be the zero value when a write to an
+// existing key has not propagated yet.
+func (m *EventualMap[K, V]) Read(key K) (value V, ok bool) {
+	ev, ok := m.values[key]
+	if !ok {
+		return value, false
+	}
+	if m.eventualConsistency {
+		return ev.ReadEventual(), true
+	}
+	return ev.ReadStrong(), true
+}
+
+// ReadStrong returns the current value for key without consuming stale state.
+// Use it from write handlers that need the latest committed value.
+func (m *EventualMap[K, V]) ReadStrong(key K) (value V, ok bool) {
+	ev, ok := m.values[key]
+	if !ok {
+		return value, false
+	}
+	return ev.ReadStrong(), true
+}
+
+// Write stages v for key; the next Read returns the pre-write value.
+func (m *EventualMap[K, V]) Write(key K, v V) {
+	ev := m.values[key]
+	if ev == nil {
+		ev = &EventualValue[V]{}
+		m.values[key] = ev
+	}
+	ev.Write(v)
+}
+
+// Put sets v for key immediately, discarding any pending stale state.
+func (m *EventualMap[K, V]) Put(key K, v V) {
+	ev := m.values[key]
+	if ev == nil {
+		ev = &EventualValue[V]{}
+		m.values[key] = ev
+	}
+	ev.Put(v)
+}
diff --git a/libs/testserver/experiments.go b/libs/testserver/experiments.go
index e35967deed1..c7c3fa6c77d 100644
--- a/libs/testserver/experiments.go
+++ b/libs/testserver/experiments.go
@@ -71,6 +71,8 @@ func (s *FakeWorkspace) ExperimentCreate(req Request) Response {
 		ArtifactLocation: experiment.ArtifactLocation,
 		Tags:             append(experiment.Tags, appendTags...),
 		LifecycleStage:   "active",
+		// Echo back like the real GetExperiment; omitting this immutable field triggers a spurious recreate.
+		TraceLocation: experiment.TraceLocation,
 	}
 
 	s.Experiments[experimentId] = ml.GetExperimentResponse{
diff --git a/libs/testserver/external_locations.go b/libs/testserver/external_locations.go
index b0000deb2ad..8fba059804b 100644
--- a/libs/testserver/external_locations.go
+++ b/libs/testserver/external_locations.go
@@ -61,6 +61,11 @@ func (s *FakeWorkspace) ExternalLocationsUpdate(req Request, name string) Respon
 		}
 	}
 
+	fields, errResponse := parseUpdateFields(req.Body)
+	if errResponse != nil {
+		return *errResponse
+	}
+
 	var updateRequest catalog.UpdateExternalLocation
 	if err := json.Unmarshal(req.Body, &updateRequest); err != nil {
 		return Response{
@@ -69,19 +74,10 @@ func (s *FakeWorkspace) ExternalLocationsUpdate(req Request, name string) Respon
 		}
 	}
 
-	// Update only the fields that can be updated
-	if updateRequest.Comment != "" {
-		existing.Comment = updateRequest.Comment
-	}
-	if updateRequest.Url != "" {
-		existing.Url = updateRequest.Url
-	}
-	if updateRequest.CredentialName != "" {
-		existing.CredentialName = updateRequest.CredentialName
-	}
-	if updateRequest.Owner != "" {
-		existing.Owner = updateRequest.Owner
-	}
+	applyUpdatedFields(&existing, updateRequest, fields)
+
+	// These three are always sent, so they track the request whether or not the payload
+	// names them (read_only=false and a dropped key mean the same thing here).
 	existing.ReadOnly = updateRequest.ReadOnly
 	existing.EnableFileEvents = updateRequest.EnableFileEvents
 	existing.Fallback = updateRequest.Fallback
diff --git a/libs/testserver/fake_workspace.go b/libs/testserver/fake_workspace.go
index 5430c68cbcc..78234c5ebfa 100644
--- a/libs/testserver/fake_workspace.go
+++ b/libs/testserver/fake_workspace.go
@@ -1,30 +1,40 @@
 package testserver
 
 import (
+	"archive/zip"
 	"bytes"
 	"encoding/binary"
 	"encoding/json"
 	"fmt"
+	"io"
+	"net/http"
 	"os"
 	"path"
 	"path/filepath"
+	"reflect"
+	"slices"
+	"strconv"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"time"
+	"uuid"
 
 	"github.com/databricks/databricks-sdk-go/service/compute"
 	"github.com/databricks/databricks-sdk-go/service/dashboards"
 	"github.com/databricks/databricks-sdk-go/service/database"
 	"github.com/databricks/databricks-sdk-go/service/postgres"
-	"github.com/google/uuid"
 
+	"github.com/databricks/cli/libs/structs/structtag"
 	"github.com/databricks/databricks-sdk-go/service/apps"
 	"github.com/databricks/databricks-sdk-go/service/catalog"
+	"github.com/databricks/databricks-sdk-go/service/files"
 	"github.com/databricks/databricks-sdk-go/service/iam"
 	"github.com/databricks/databricks-sdk-go/service/jobs"
 	"github.com/databricks/databricks-sdk-go/service/ml"
 	"github.com/databricks/databricks-sdk-go/service/pipelines"
 	"github.com/databricks/databricks-sdk-go/service/serving"
+	"github.com/databricks/databricks-sdk-go/service/settingsv2"
 	"github.com/databricks/databricks-sdk-go/service/sql"
 	"github.com/databricks/databricks-sdk-go/service/vectorsearch"
 	"github.com/databricks/databricks-sdk-go/service/workspace"
@@ -33,10 +43,19 @@ import (
 const (
 	UserNameTokenPrefix         = "dbapi0"
 	ServicePrincipalTokenPrefix = "dbapi1"
-	UserID                      = "1000012345"
-	TestDefaultClusterId        = "0123-456789-cluster0"
-	TestDefaultWarehouseId      = "8ec9edc1-db0c-40df-af8d-7580020fe61e"
-	TestDefaultInstancePoolId   = "0123-456789-pool0"
+	// GuestServicePrincipalTokenPrefix marks an as-test-sp guest sharing another
+	// identity's workspace, kept distinct from a test whose primary identity is
+	// itself a service principal.
+	GuestServicePrincipalTokenPrefix = "dbapi2"
+	// EventualConsistencyTokenPrefix identifies workspaces that simulate eventual
+	// consistency / propagation delays: the first GET after a create returns 404
+	// (not yet visible), and a deleted synced table stays in DELETING instead of
+	// disappearing (so the direct engine's post-delete poll has a teardown to wait out).
+	EventualConsistencyTokenPrefix = "dbapi3"
+	UserID                         = "1000012345"
+	TestDefaultClusterId           = "0123-456789-cluster0"
+	TestDefaultWarehouseId         = "8ec9edc1-db0c-40df-af8d-7580020fe61e"
+	TestDefaultInstancePoolId      = "0123-456789-pool0"
 )
 
 var TestUser = iam.User{
@@ -49,12 +68,48 @@ var TestUserSP = iam.User{
 	UserName: "aaaaaaaa-bbbb-4ccc-dddd-eeeeeeeeeeee",
 }
 
+// guestServicePrincipalDisplayName is reported on /Me for the as-test-sp guest,
+// matching the named SP used on cloud.
+const guestServicePrincipalDisplayName = "deco-test-spn"
+
+// isGuestToken reports whether a token is an as-test-sp guest. Job permission
+// checks apply only to guests; the primary identity is treated as an admin.
+func isGuestToken(token string) bool {
+	return strings.HasPrefix(token, GuestServicePrincipalTokenPrefix)
+}
+
+// userForToken returns the identity behind a token: any service-principal token
+// (primary or guest) is the SP, otherwise the user.
+func userForToken(token string) iam.User {
+	if strings.HasPrefix(token, ServicePrincipalTokenPrefix) || isGuestToken(token) {
+		return TestUserSP
+	}
+	return TestUser
+}
+
+// MeUser returns the /Me identity for a token. Only the guest SP carries a
+// display name, so single-identity SP tests are unaffected.
+func (s *FakeWorkspace) MeUser(token string) iam.User {
+	user := userForToken(token)
+	if isGuestToken(token) {
+		user.DisplayName = guestServicePrincipalDisplayName
+	}
+	return user
+}
+
 var (
 	idMutex      sync.Mutex
 	lastNowNano  int64
 	lastNowMilli int64
+	workspaceID  atomic.Int64
 )
 
+// nextTreenodeID starts above common version numbers and counts, which scripts
+// can otherwise mask when registering literal ID replacements.
+func nextTreenodeID() int64 {
+	return 1000 + workspaceID.Add(1)
+}
+
 // IDs are prefixed with 7 and padded to avoid matching regex 1[78]\d{14}
 func nextID() int64 {
 	// offset enough so that it does not match UNIX_TIME_NANO regex
@@ -91,12 +146,19 @@ func nowMilli() int64 {
 	return lastNowMilli
 }
 
+// nextTimestamp returns a strictly-increasing RFC3339 timestamp with nanosecond
+// precision. The sub-second component keeps distinct events ordered even within the
+// same wall-clock second, which the dashboard publish lifecycle relies on to compare
+// a draft's update_time against a published revision's revision_create_time.
+func nextTimestamp() string {
+	return time.Unix(0, nowNano()).UTC().Format(time.RFC3339Nano)
+}
+
 func nextUUID() string {
 	var b [16]byte
 	binary.BigEndian.PutUint64(b[0:8], uint64(nextID()))
 	binary.BigEndian.PutUint64(b[8:16], uint64(nextID()))
-	u := uuid.Must(uuid.FromBytes(b[:]))
-	return u.String()
+	return uuid.UUID(b).String()
 }
 
 func nextDashboardID() string {
@@ -125,6 +187,13 @@ type FakeWorkspace struct {
 	url                string
 	isServicePrincipal bool
 
+	// eventualConsistency simulates propagation delays (see EventualConsistencyTokenPrefix).
+	// For synced tables it makes deletion slow: a deleted table stays in DELETING and keeps
+	// being returned by GET, so the direct engine's post-delete poll (WaitAfterDelete) has a
+	// real teardown to wait out. Off by default, so the default path and terraform (which
+	// recreates without polling) keep immediate deletion.
+	eventualConsistency bool
+
 	directories  map[string]workspace.ObjectInfo
 	files        map[string]FileEntry
 	repoIdByPath map[string]int64
@@ -132,6 +201,7 @@ type FakeWorkspace struct {
 	Jobs                  map[int64]jobs.Job
 	JobRuns               map[int64]jobs.Run
 	JobRunOutputs         map[int64]jobs.RunOutput
+	JobRunIdempotency     map[string]int64
 	Pipelines             map[string]pipelines.GetPipelineResponse
 	PipelineUpdates       map[string]bool
 	Monitors              map[string]catalog.MonitorInfo
@@ -139,23 +209,42 @@ type FakeWorkspace struct {
 	Schemas               map[string]catalog.SchemaInfo
 	Grants                map[string][]catalog.PrivilegeAssignment
 	Volumes               map[string]catalog.VolumeInfo
-	Dashboards            map[string]fakeDashboard
+	Dashboards            *EventualMap[string, *fakeDashboard]
 	PublishedDashboards   map[string]dashboards.PublishedDashboard
+	GenieSpaces           map[string]dashboards.GenieSpace
 	SqlWarehouses         map[string]sql.GetWarehouseResponse
 	Alerts                map[string]sql.AlertV2
 	Experiments           map[string]ml.GetExperimentResponse
 	ModelRegistryModels   map[string]ml.Model
 	ModelRegistryModelIDs map[string]string // model name -> numeric ID
 	Clusters              map[string]compute.ClusterDetails
+	ClusterLibraries      map[string][]compute.Library // cluster id -> installed libraries
+	InstancePools         map[string]compute.GetInstancePool
+	ClusterPolicies       map[string]compute.Policy
 	Catalogs              map[string]catalog.CatalogInfo
 	ExternalLocations     map[string]catalog.ExternalLocationInfo
 	RegisteredModels      map[string]catalog.RegisteredModelInfo
+	ModelServices         map[string]catalog.ModelService
+	McpServices           map[string]catalog.McpService
+	ModelProviderServices map[string]catalog.ModelProviderService
+
+	Features              map[string]ml.Feature
 	ServingEndpoints      map[string]serving.ServingEndpointDetailed
 	VectorSearchEndpoints map[string]vectorsearch.EndpointInfo
+	VectorSearchIndexes   map[string]fakeVectorSearchIndex
+
+	// VectorSearchIndexesPendingDeletion counts how many further CREATEs an
+	// already-deleted index name must reject with "pending deletion". See
+	// VectorSearchIndexDelete.
+	VectorSearchIndexesPendingDeletion map[string]int
 
 	SecretScopes map[string]workspace.SecretScope
 	Secrets      map[string]map[string]string // scope -> key -> value
 	Acls         map[string][]workspace.AclItem
+	UCSecrets    map[string]catalog.Secret // full_name -> secret (Unity Catalog secrets)
+
+	// WorkspaceSettings holds settings written through the settings v2 public API, keyed by name.
+	WorkspaceSettings map[string]settingsv2.Setting
 
 	// Generic permissions storage: key is "{object_type}:{object_id}"
 	Permissions map[string]iam.ObjectPermissions
@@ -168,14 +257,42 @@ type FakeWorkspace struct {
 	DatabaseCatalogs     map[string]database.DatabaseCatalog
 	SyncedDatabaseTables map[string]database.SyncedDatabaseTable
 
-	PostgresProjects   map[string]postgres.Project
-	PostgresBranches   map[string]postgres.Branch
-	PostgresEndpoints  map[string]postgres.Endpoint
-	PostgresOperations map[string]postgres.Operation
+	PostgresProjects          map[string]postgres.Project
+	PostgresBranches          map[string]postgres.Branch
+	PostgresCatalogs          map[string]postgres.Catalog
+	PostgresDatabases         map[string]postgres.Database
+	PostgresEndpoints         map[string]postgres.Endpoint
+	PostgresRoles             map[string]postgres.Role
+	PostgresSyncedTables      map[string]postgres.SyncedTable
+	PostgresSnapshotSchedules map[string]postgres.SnapshotSchedule
+	PostgresOperations        map[string]postgres.Operation
+
+	// Branches and endpoints that the server provisioned implicitly together
+	// with their parent (e.g. the production branch on a new project, or the
+	// primary endpoint on a new branch). The real backend rejects independent
+	// deletion of these — they go away only when the parent is deleted.
+	postgresImplicitBranches  map[string]bool
+	postgresImplicitEndpoints map[string]bool
 
 	// clusterVenvs caches Python venvs per existing cluster ID,
 	// matching cloud behavior where libraries are cached on running clusters.
 	clusterVenvs map[string]*clusterEnv
+
+	// DmsDeployments holds Deployment Metadata Service (DMS) records, keyed by
+	// deployment ID. Each record carries its versions and latest resource state.
+	DmsDeployments map[string]*DmsDeployment
+
+	// DmsDeploymentNodes maps deployment ID to the workspace node CreateDeployment made for
+	// it. An ID appears here before DmsDeployments has a record, which its first version
+	// creates, so the node is what makes the ID valid in between.
+	DmsDeploymentNodes map[string]string
+
+	// sshTunnelHostKeyPEM is the SSH host key every sshd of this workspace's tunnel
+	// serves, generated on first use. See sshTunnelHostKey.
+	sshTunnelHostKeyPEM []byte
+	// sshTunnelHostPublicKey is sshTunnelHostKeyPEM in authorized-key form, published
+	// to the tunnel's secret scope so a client can pin it.
+	sshTunnelHostPublicKey []byte
 }
 
 func (s *FakeWorkspace) LockUnlock() func() {
@@ -186,6 +303,85 @@ func (s *FakeWorkspace) LockUnlock() func() {
 	return func() { s.mu.Unlock() }
 }
 
+// parseUpdateFields decodes an update payload into its raw fields, so a handler can tell
+// a field explicitly set to a zero value from one the caller omitted.
+func parseUpdateFields(body []byte) (map[string]json.RawMessage, *Response) {
+	var fields map[string]json.RawMessage
+
+	if err := json.Unmarshal(body, &fields); err != nil {
+		return nil, &Response{
+			Body:       fmt.Sprintf("internal error: %s", err),
+			StatusCode: http.StatusInternalServerError,
+		}
+	}
+	return fields, nil
+}
+
+// parseUCUpdate is parseUpdateFields for the UC APIs that reject a payload carrying no
+// field to act on, answering "<operation> Nothing to update." (400) rather than treating it
+// as a no-op. A key set to null does not count.
+//
+// Verified against a real workspace for schemas, volumes and catalogs: {} and
+// {"comment": null} are rejected, while {"comment": ""} and
+// {"custom_max_retention_hours": 0} are accepted. Registered models accept {} instead, so
+// they use parseUpdateFields.
+func parseUCUpdate(body []byte, operation string) (map[string]json.RawMessage, *Response) {
+	fields, errResponse := parseUpdateFields(body)
+	if errResponse != nil {
+		return nil, errResponse
+	}
+
+	for _, value := range fields {
+		if string(value) != "null" {
+			return fields, nil
+		}
+	}
+
+	return nil, &Response{
+		StatusCode: http.StatusBadRequest,
+		Body: map[string]string{
+			"error_code": "INVALID_PARAMETER_VALUE",
+			"message":    operation + " Nothing to update.",
+		},
+	}
+}
+
+// applyUpdatedFields copies every field the update payload names from update onto
+// existing, matched by JSON name, and marks it force-send so a zero value survives the
+// response encoding (the stored *Info types are all omitempty).
+//
+// Fields the payload omits are left untouched: a partial-update API changes only what the
+// caller names, and modelling that is the whole point of these fakes. Fields the payload
+// names but the stored type lacks (new_name, force) are skipped for the caller to handle.
+// existing must be a pointer; update is passed by value.
+func applyUpdatedFields(existing, update any, fields map[string]json.RawMessage) {
+	dst := reflect.ValueOf(existing).Elem()
+	src := reflect.ValueOf(update)
+
+	for i := range src.Type().NumField() {
+		name := structtag.JSONTag(src.Type().Field(i).Tag.Get("json")).Name()
+		if name == "" || name == "-" {
+			continue
+		}
+		if _, ok := fields[name]; !ok {
+			continue
+		}
+		dstField := dst.FieldByName(src.Type().Field(i).Name)
+		if !dstField.IsValid() || !dstField.CanSet() || dstField.Type() != src.Field(i).Type() {
+			continue
+		}
+		dstField.Set(src.Field(i))
+		forceSend := dst.FieldByName("ForceSendFields")
+		if forceSend.IsValid() && forceSend.CanSet() {
+			goName := src.Type().Field(i).Name
+			// Repeated updates would otherwise keep appending the same name.
+			if !slices.Contains(forceSend.Interface().([]string), goName) {
+				forceSend.Set(reflect.Append(forceSend, reflect.ValueOf(goName)))
+			}
+		}
+	}
+}
+
 // Generic functions to handle map operations
 func MapGet[T any](w *FakeWorkspace, collection map[string]T, key string) Response {
 	defer w.LockUnlock()()
@@ -202,6 +398,23 @@ func MapGet[T any](w *FakeWorkspace, collection map[string]T, key string) Respon
 	}
 }
 
+// MapGetUC is MapGet for Unity Catalog securables. The CLI surfaces the API's
+// message verbatim, and UC words it as "Volume 'main.s.v' does not exist."
+func MapGetUC[T any](w *FakeWorkspace, collection map[string]T, key, securable string) Response {
+	defer w.LockUnlock()()
+
+	value, ok := collection[key]
+	if !ok {
+		return Response{
+			StatusCode: 404,
+			Body:       map[string]string{"message": fmt.Sprintf("%s '%s' does not exist.", securable, key)},
+		}
+	}
+	return Response{
+		Body: value,
+	}
+}
+
 func MapList[K comparable, T any](w *FakeWorkspace, collection map[K]T, responseFieldName string) Response {
 	defer w.LockUnlock()()
 
@@ -235,49 +448,75 @@ func MapDelete[K comparable, V any](w *FakeWorkspace, collection map[K]V, key K)
 }
 
 func NewFakeWorkspace(url, token string) *FakeWorkspace {
+	eventualConsistency := strings.HasPrefix(token, EventualConsistencyTokenPrefix)
 	return &FakeWorkspace{
-		url:                url,
-		isServicePrincipal: strings.HasPrefix(token, ServicePrincipalTokenPrefix),
+		url:                 url,
+		isServicePrincipal:  strings.HasPrefix(token, ServicePrincipalTokenPrefix),
+		eventualConsistency: eventualConsistency,
 		directories: map[string]workspace.ObjectInfo{
 			"/Workspace": {
 				ObjectType: "DIRECTORY",
 				Path:       "/Workspace",
-				ObjectId:   nextID(),
+				ObjectId:   nextTreenodeID(),
 			},
 			"/Users": {
 				ObjectType: "DIRECTORY",
 				Path:       "/Users",
-				ObjectId:   nextID(),
+				ObjectId:   nextTreenodeID(),
 			},
 			"/Users/" + TestUser.UserName: {
 				ObjectType: "DIRECTORY",
 				Path:       "/Users/" + TestUser.UserName,
-				ObjectId:   nextID(),
+				ObjectId:   nextTreenodeID(),
 			},
 			"/Users/" + TestUserSP.UserName: {
 				ObjectType: "DIRECTORY",
 				Path:       "/Users/" + TestUserSP.UserName,
-				ObjectId:   nextID(),
+				ObjectId:   nextTreenodeID(),
+			},
+			// The user home also exists under the /Workspace alias on real
+			// workspaces, so model it here too. Imports require the parent
+			// directory to exist (see WorkspaceFilesImportFile).
+			"/Workspace/Users": {
+				ObjectType: "DIRECTORY",
+				Path:       "/Workspace/Users",
+				ObjectId:   nextTreenodeID(),
+			},
+			"/Workspace/Users/" + TestUser.UserName: {
+				ObjectType: "DIRECTORY",
+				Path:       "/Workspace/Users/" + TestUser.UserName,
+				ObjectId:   nextTreenodeID(),
+			},
+			"/Workspace/Users/" + TestUserSP.UserName: {
+				ObjectType: "DIRECTORY",
+				Path:       "/Workspace/Users/" + TestUserSP.UserName,
+				ObjectId:   nextTreenodeID(),
 			},
 		},
 		files:        make(map[string]FileEntry),
 		repoIdByPath: make(map[string]int64),
 
-		Jobs:                map[int64]jobs.Job{},
-		JobRuns:             map[int64]jobs.Run{},
-		JobRunOutputs:       map[int64]jobs.RunOutput{},
-		Grants:              map[string][]catalog.PrivilegeAssignment{},
-		Pipelines:           map[string]pipelines.GetPipelineResponse{},
-		PipelineUpdates:     map[string]bool{},
-		Monitors:            map[string]catalog.MonitorInfo{},
-		Apps:                map[string]apps.App{},
-		Catalogs:            map[string]catalog.CatalogInfo{},
-		ExternalLocations:   map[string]catalog.ExternalLocationInfo{},
-		Schemas:             map[string]catalog.SchemaInfo{},
-		RegisteredModels:    map[string]catalog.RegisteredModelInfo{},
-		Volumes:             map[string]catalog.VolumeInfo{},
-		Dashboards:          map[string]fakeDashboard{},
-		PublishedDashboards: map[string]dashboards.PublishedDashboard{},
+		Jobs:                  map[int64]jobs.Job{},
+		JobRuns:               map[int64]jobs.Run{},
+		JobRunOutputs:         map[int64]jobs.RunOutput{},
+		JobRunIdempotency:     map[string]int64{},
+		Grants:                map[string][]catalog.PrivilegeAssignment{},
+		Pipelines:             map[string]pipelines.GetPipelineResponse{},
+		PipelineUpdates:       map[string]bool{},
+		Monitors:              map[string]catalog.MonitorInfo{},
+		Apps:                  map[string]apps.App{},
+		Catalogs:              map[string]catalog.CatalogInfo{},
+		ExternalLocations:     map[string]catalog.ExternalLocationInfo{},
+		Schemas:               map[string]catalog.SchemaInfo{},
+		RegisteredModels:      map[string]catalog.RegisteredModelInfo{},
+		ModelServices:         map[string]catalog.ModelService{},
+		McpServices:           map[string]catalog.McpService{},
+		ModelProviderServices: map[string]catalog.ModelProviderService{},
+		Features:              map[string]ml.Feature{},
+		Volumes:               map[string]catalog.VolumeInfo{},
+		Dashboards:            NewEventualMap[string, *fakeDashboard](eventualConsistency),
+		PublishedDashboards:   map[string]dashboards.PublishedDashboard{},
+		GenieSpaces:           map[string]dashboards.GenieSpace{},
 		SqlWarehouses: map[string]sql.GetWarehouseResponse{
 			TestDefaultWarehouseId: {
 				Id:    TestDefaultWarehouseId,
@@ -285,32 +524,58 @@ func NewFakeWorkspace(url, token string) *FakeWorkspace {
 				State: sql.StateRunning,
 			},
 		},
-		ServingEndpoints:      map[string]serving.ServingEndpointDetailed{},
-		VectorSearchEndpoints: map[string]vectorsearch.EndpointInfo{},
-		Repos:                 map[string]workspace.RepoInfo{},
-		SecretScopes:          map[string]workspace.SecretScope{},
-		Secrets:               map[string]map[string]string{},
-		Acls:                  map[string][]workspace.AclItem{},
-		Permissions:           map[string]iam.ObjectPermissions{},
-		Groups:                map[string]iam.Group{},
-		DatabaseInstances:     map[string]database.DatabaseInstance{},
-		DatabaseCatalogs:      map[string]database.DatabaseCatalog{},
-		SyncedDatabaseTables:  map[string]database.SyncedDatabaseTable{},
-		PostgresProjects:      map[string]postgres.Project{},
-		PostgresBranches:      map[string]postgres.Branch{},
-		PostgresEndpoints:     map[string]postgres.Endpoint{},
-		PostgresOperations:    map[string]postgres.Operation{},
-		clusterVenvs:          map[string]*clusterEnv{},
-		Alerts:                map[string]sql.AlertV2{},
-		Experiments:           map[string]ml.GetExperimentResponse{},
-		ModelRegistryModels:   map[string]ml.Model{},
-		ModelRegistryModelIDs: map[string]string{},
+		ServingEndpoints:          map[string]serving.ServingEndpointDetailed{},
+		VectorSearchEndpoints:     map[string]vectorsearch.EndpointInfo{},
+		VectorSearchIndexes:       map[string]fakeVectorSearchIndex{},
+		Repos:                     map[string]workspace.RepoInfo{},
+		SecretScopes:              map[string]workspace.SecretScope{},
+		Secrets:                   map[string]map[string]string{},
+		Acls:                      map[string][]workspace.AclItem{},
+		WorkspaceSettings:         map[string]settingsv2.Setting{},
+		Permissions:               map[string]iam.ObjectPermissions{},
+		Groups:                    map[string]iam.Group{},
+		DatabaseInstances:         map[string]database.DatabaseInstance{},
+		DatabaseCatalogs:          map[string]database.DatabaseCatalog{},
+		SyncedDatabaseTables:      map[string]database.SyncedDatabaseTable{},
+		PostgresProjects:          map[string]postgres.Project{},
+		PostgresBranches:          map[string]postgres.Branch{},
+		PostgresCatalogs:          map[string]postgres.Catalog{},
+		PostgresDatabases:         map[string]postgres.Database{},
+		PostgresEndpoints:         map[string]postgres.Endpoint{},
+		PostgresRoles:             map[string]postgres.Role{},
+		PostgresSyncedTables:      map[string]postgres.SyncedTable{},
+		PostgresSnapshotSchedules: map[string]postgres.SnapshotSchedule{},
+		PostgresOperations:        map[string]postgres.Operation{},
+		postgresImplicitBranches:  map[string]bool{},
+		postgresImplicitEndpoints: map[string]bool{},
+		clusterVenvs:              map[string]*clusterEnv{},
+		DmsDeployments:            map[string]*DmsDeployment{},
+		DmsDeploymentNodes:        map[string]string{},
+		Alerts:                    map[string]sql.AlertV2{},
+		Experiments:               map[string]ml.GetExperimentResponse{},
+		ModelRegistryModels:       map[string]ml.Model{},
+		ModelRegistryModelIDs:     map[string]string{},
 		Clusters: map[string]compute.ClusterDetails{
+			// A running dedicated single-user cluster: the shape `ssh connect --cluster`
+			// requires (ValidateClusterAccess rejects anything else), matching the cloud
+			// TEST_DEFAULT_CLUSTER_ID this stands in for.
 			TestDefaultClusterId: {
-				ClusterId:   TestDefaultClusterId,
-				ClusterName: "DEFAULT Test Cluster",
+				ClusterId:        TestDefaultClusterId,
+				ClusterName:      "DEFAULT Test Cluster",
+				State:            compute.StateRunning,
+				DataSecurityMode: compute.DataSecurityModeSingleUser,
+				SingleUserName:   TestUser.UserName,
 			},
 		},
+		InstancePools:    map[string]compute.GetInstancePool{},
+		ClusterLibraries: map[string][]compute.Library{},
+		ClusterPolicies: map[string]compute.Policy{
+			// Seeded so the stateful list keeps backing the variable-lookup tests
+			// (e.g. acceptance/bundle/variables/env_overrides resolves these by name).
+			"5678": {PolicyId: "5678", Name: "wrong-cluster-policy"},
+			"9876": {PolicyId: "9876", Name: "some-test-cluster-policy"},
+		},
+		VectorSearchIndexesPendingDeletion: map[string]int{},
 	}
 }
 
@@ -322,50 +587,302 @@ func (s *FakeWorkspace) CurrentUser() iam.User {
 	}
 }
 
-func (s *FakeWorkspace) WorkspaceGetStatus(path string) Response {
+// gitInfoBlock is the git_info block get-status adds for return_git_info=true.
+// workspace.ObjectInfo does not model it (the field is undocumented), so it is
+// merged into the response separately, see withGitInfo.
+//
+// A Git folder that has Git CLI access does not store the git metadata on the
+// workspace object, so Branch, HeadCommitID and URL are empty for one; only a
+// standard Git folder reports them.
+type gitInfoBlock struct {
+	Branch       string `json:"branch,omitempty"`
+	HeadCommitID string `json:"head_commit_id,omitempty"`
+	ID           int64  `json:"id"`
+	Path         string `json:"path"`
+	URL          string `json:"url,omitempty"`
+}
+
+// withGitInfo returns info as an object with a git_info block added.
+//
+// It cannot be a struct embedding workspace.ObjectInfo: ObjectInfo declares
+// MarshalJSON, which gets promoted to the embedding struct, so the outer
+// git_info field would be dropped from the output without any error. The
+// intermediate map holds json.RawMessage rather than any, so that large ids do
+// not lose precision by passing through float64.
+func withGitInfo(info workspace.ObjectInfo, gi gitInfoBlock) (any, error) {
+	infoJSON, err := json.Marshal(info)
+	if err != nil {
+		return nil, err
+	}
+	out := map[string]json.RawMessage{}
+	if err := json.Unmarshal(infoJSON, &out); err != nil {
+		return nil, err
+	}
+	giJSON, err := json.Marshal(gi)
+	if err != nil {
+		return nil, err
+	}
+	out["git_info"] = giJSON
+	return out, nil
+}
+
+// gitFolderFor returns the Git folder containing objectPath, which is the
+// longest registered Git folder path that is a prefix of it. get-status reports
+// the containing folder's metadata for paths inside a Git folder, not just for
+// its root.
+func (s *FakeWorkspace) gitFolderFor(objectPath string) (workspace.RepoInfo, bool) {
+	longest := ""
+	for repoPath := range s.repoIdByPath {
+		if objectPath != repoPath && !strings.HasPrefix(objectPath, repoPath+"/") {
+			continue
+		}
+		if len(repoPath) > len(longest) {
+			longest = repoPath
+		}
+	}
+	if longest == "" {
+		return workspace.RepoInfo{}, false
+	}
+	return s.Repos[strconv.FormatInt(s.repoIdByPath[longest], 10)], true
+}
+
+// isGitCliFolder reports whether a Git folder at this path has Git CLI access.
+// Those are materialized as plain DIRECTORY nodes outside /Repos, while a
+// standard Git folder under /Repos keeps the REPO object type. The /Workspace
+// mount prefix is optional on a request, so it is not part of the distinction.
+func isGitCliFolder(repoPath string) bool {
+	return !strings.HasPrefix(strings.TrimPrefix(repoPath, "/Workspace"), "/Repos/")
+}
+
+func (s *FakeWorkspace) WorkspaceGetStatus(requestPath string, returnGitInfo bool) Response {
+	if !strings.HasPrefix(requestPath, "/") {
+		return Response{
+			StatusCode: 400,
+			Body:       map[string]string{"error_code": "INVALID_PARAMETER_VALUE", "message": fmt.Sprintf("Path (%s) doesn't start with '/'", requestPath)},
+		}
+	}
+
 	defer s.LockUnlock()()
 
-	if dirInfo, ok := s.directories[path]; ok {
+	// The real API collapses duplicate slashes, so look up the cleaned path.
+	cleaned := path.Clean(requestPath)
+
+	var info workspace.ObjectInfo
+	// A Git folder root is reported as the repo, before any directory entry for
+	// the same path: mkdirs of a path inside a Git folder seeds its ancestors,
+	// which would otherwise shadow the root and report the wrong object id.
+	if repoId, ok := s.repoIdByPath[cleaned]; ok {
+		// Control-plane repos (under /Repos) report the REPO object type, while
+		// Git-CLI-enabled folders elsewhere are materialized as plain DIRECTORY
+		// nodes. Both resolve to a valid repo ID via the repos API.
+		objectType := workspace.ObjectTypeRepo
+		if isGitCliFolder(cleaned) {
+			objectType = workspace.ObjectTypeDirectory
+		}
+		info = workspace.ObjectInfo{ObjectType: objectType, Path: cleaned, ObjectId: repoId}
+	} else if dirInfo, ok := s.directories[cleaned]; ok {
+		info = dirInfo
+	} else if entry, ok := s.files[cleaned]; ok {
+		info = entry.Info
+	} else {
+		// Match the real Workspace API wording, which echoes the requested path.
 		return Response{
-			Body: &dirInfo,
+			StatusCode: 404,
+			Body:       map[string]string{"message": fmt.Sprintf("Path (%s) doesn't exist.", requestPath)},
+		}
+	}
+
+	// A doubled leading slash ("//Workspace/...", which some tests use to avoid
+	// Windows path conversion) is sent to the backend verbatim, and it responds
+	// with the "/Workspace" mount stripped from the path. A normal single-slash
+	// "/Workspace/..." is preserved instead, so only strip the doubled form.
+	if strings.HasPrefix(requestPath, "//Workspace/") {
+		info.Path = strings.TrimPrefix(info.Path, "/Workspace")
+	}
+
+	if returnGitInfo {
+		if repo, ok := s.gitFolderFor(cleaned); ok {
+			// The real API reports the Git folder root without the /Workspace mount
+			// prefix, whichever spelling the folder was created with.
+			gi := gitInfoBlock{ID: repo.Id, Path: strings.TrimPrefix(repo.Path, "/Workspace")}
+			if isGitCliFolder(repo.Path) {
+				info.DirectoryInfo = &workspace.DirectoryInfo{IsGitFolder: true}
+			} else {
+				gi.Branch = repo.Branch
+				gi.HeadCommitID = repo.HeadCommitId
+				gi.URL = repo.Url
+			}
+			body, err := withGitInfo(info, gi)
+			if err != nil {
+				return Response{
+					StatusCode: 500,
+					Body:       fmt.Sprintf("internal error: %s", err),
+				}
+			}
+			return Response{Body: body}
 		}
-	} else if entry, ok := s.files[path]; ok {
+	}
+
+	return Response{Body: info}
+}
+
+func (s *FakeWorkspace) WorkspaceList(listPath string) Response {
+	defer s.LockUnlock()()
+
+	// The real API collapses duplicate slashes, so look up the cleaned path.
+	cleaned := path.Clean(listPath)
+
+	// The real API 404s on a missing path rather than reporting an empty directory.
+	// Repos are listable but tracked outside s.directories, so admit them too.
+	_, isDir := s.directories[cleaned]
+	_, isRepo := s.repoIdByPath[cleaned]
+	if !isDir && !isRepo {
 		return Response{
-			Body: entry.Info,
+			StatusCode: 404,
+			Body:       map[string]string{"message": fmt.Sprintf("Path (%s) doesn't exist.", listPath)},
 		}
-	} else if repoId, ok := s.repoIdByPath[path]; ok {
+	}
+
+	var objects []workspace.ObjectInfo
+
+	for filePath, entry := range s.files {
+		if path.Dir(filePath) == cleaned {
+			objects = append(objects, entry.Info)
+		}
+	}
+	for dirPath, dirInfo := range s.directories {
+		if dirPath != cleaned && path.Dir(dirPath) == cleaned {
+			objects = append(objects, dirInfo)
+		}
+	}
+
+	slices.SortFunc(objects, func(a, b workspace.ObjectInfo) int {
+		return strings.Compare(a.Path, b.Path)
+	})
+
+	return Response{
+		Body: workspace.ListResponse{Objects: objects},
+	}
+}
+
+// FsListDirectory implements GET /api/2.0/fs/directories/{path}. A path that is
+// not a directory, including one pointing at a file, is a 404, as it is for HEAD.
+func (s *FakeWorkspace) FsListDirectory(dirPath string) Response {
+	if !strings.HasPrefix(dirPath, "/") {
+		dirPath = "/" + dirPath
+	}
+
+	defer s.LockUnlock()()
+
+	if _, isDir := s.directories[dirPath]; !isDir {
 		return Response{
-			Body: workspace.ObjectInfo{
-				ObjectType: "REPO",
-				Path:       path,
-				ObjectId:   repoId,
-			},
+			StatusCode: 404,
+			Body:       map[string]string{"message": "directory does not exist"},
 		}
-	} else {
+	}
+
+	var contents []files.DirectoryEntry
+
+	for filePath, entry := range s.files {
+		if path.Dir(filePath) == dirPath {
+			contents = append(contents, files.DirectoryEntry{
+				Name:     path.Base(filePath),
+				Path:     filePath,
+				FileSize: int64(len(entry.Data)),
+			})
+		}
+	}
+	for childPath := range s.directories {
+		if childPath != dirPath && path.Dir(childPath) == dirPath {
+			contents = append(contents, files.DirectoryEntry{
+				Name:        path.Base(childPath),
+				Path:        childPath,
+				IsDirectory: true,
+			})
+		}
+	}
+
+	slices.SortFunc(contents, func(a, b files.DirectoryEntry) int {
+		return strings.Compare(a.Path, b.Path)
+	})
+
+	return Response{
+		Body: files.ListDirectoryResponse{Contents: contents},
+	}
+}
+
+// FsDeleteFile implements DELETE /api/2.0/fs/files/{path}.
+func (s *FakeWorkspace) FsDeleteFile(filePath string) Response {
+	if !strings.HasPrefix(filePath, "/") {
+		filePath = "/" + filePath
+	}
+
+	defer s.LockUnlock()()
+
+	if _, exists := s.files[filePath]; !exists {
 		return Response{
 			StatusCode: 404,
-			Body:       map[string]string{"message": "Workspace path not found"},
+			Body:       map[string]string{"message": "file does not exist"},
 		}
 	}
+
+	delete(s.files, filePath)
+	return Response{}
 }
 
 func (s *FakeWorkspace) WorkspaceMkdirs(request workspace.Mkdirs) {
 	defer s.LockUnlock()()
-	s.directories[request.Path] = workspace.ObjectInfo{
-		ObjectType: "DIRECTORY",
-		Path:       request.Path,
-		ObjectId:   nextID(),
+	// The real mkdirs API creates all intermediate directories ("mkdir -p"),
+	// so seed every ancestor up to the root.
+	for dir := request.Path; dir != "/" && dir != "" && dir != "."; dir = path.Dir(dir) {
+		if _, exists := s.directories[dir]; !exists {
+			s.directories[dir] = workspace.ObjectInfo{
+				ObjectType: "DIRECTORY",
+				Path:       dir,
+				ObjectId:   nextTreenodeID(),
+			}
+		}
 	}
 }
 
 func (s *FakeWorkspace) WorkspaceExport(path string) []byte {
 	defer s.LockUnlock()()
+	if _, isDir := s.directories[path]; isDir {
+		return exportDirectory(path)
+	}
 	return s.files[path].Data
 }
 
-func (s *FakeWorkspace) WorkspaceDelete(path string, recursive bool) {
+// exportDirectory mimics the real API, which exports a directory as a ZIP archive even with
+// direct_download=true. Only the directory's own entry is included: callers just need to see
+// that they got an archive rather than a file.
+func exportDirectory(dirPath string) []byte {
+	var buf bytes.Buffer
+	zw := zip.NewWriter(&buf)
+	if _, err := zw.Create(path.Base(dirPath) + "/"); err != nil {
+		panic(err)
+	}
+	if err := zw.Close(); err != nil {
+		panic(err)
+	}
+	return buf.Bytes()
+}
+
+// WorkspaceDelete implements POST /api/2.0/workspace/delete. As in the real API, a
+// non-recursive delete of a directory that still has children fails instead of removing
+// it, which is what lets a caller delete a directory only if it is empty.
+func (s *FakeWorkspace) WorkspaceDelete(path string, recursive bool) Response {
 	defer s.LockUnlock()()
 	if !recursive {
+		if _, isDir := s.directories[path]; isDir && s.hasChildren(path) {
+			return Response{
+				StatusCode: 400,
+				Body: map[string]string{
+					"error_code": "DIRECTORY_NOT_EMPTY",
+					"message":    "Folder (" + path + ") is not empty",
+				},
+			}
+		}
 		delete(s.files, path)
 		delete(s.directories, path)
 	} else {
@@ -380,9 +897,157 @@ func (s *FakeWorkspace) WorkspaceDelete(path string, recursive bool) {
 			}
 		}
 	}
+	return Response{}
+}
+
+// hasChildren reports whether any file or directory lives under dirPath. Callers must
+// hold the lock.
+func (s *FakeWorkspace) hasChildren(dirPath string) bool {
+	prefix := dirPath + "/"
+	for key := range s.files {
+		if strings.HasPrefix(key, prefix) {
+			return true
+		}
+	}
+	for key := range s.directories {
+		if strings.HasPrefix(key, prefix) {
+			return true
+		}
+	}
+	return false
+}
+
+// detectNotebookLanguage mirrors the real /workspace/import format=AUTO logic:
+// a file whose extension is .py / .sql / .scala / .r and whose content starts
+// with the language-appropriate "Databricks notebook source" line-comment is
+// stored as a NOTEBOOK with the corresponding language; otherwise it's a FILE.
+//
+// The extension is lowercased because the real endpoint matches it
+// case-insensitively, and ".R" is the conventional spelling for R sources.
+func detectNotebookLanguage(extension string, body []byte) (workspace.Language, bool) {
+	switch strings.ToLower(extension) {
+	case ".py":
+		if bytes.HasPrefix(body, []byte("# Databricks notebook source")) {
+			return workspace.LanguagePython, true
+		}
+	case ".sql":
+		if bytes.HasPrefix(body, []byte("-- Databricks notebook source")) {
+			return workspace.LanguageSql, true
+		}
+	case ".scala":
+		if bytes.HasPrefix(body, []byte("// Databricks notebook source")) {
+			return workspace.LanguageScala, true
+		}
+	case ".r":
+		if bytes.HasPrefix(body, []byte("# Databricks notebook source")) {
+			return workspace.LanguageR, true
+		}
+	}
+	return "", false
 }
 
 func (s *FakeWorkspace) WorkspaceFilesImportFile(filePath string, body []byte, overwrite bool) Response {
+	return s.importFile(filePath, body, overwrite, true)
+}
+
+// WorkspaceImportZipFolder mirrors /workspace/import with format=AUTO for a .zip path
+// (ZipImporter in universe): the archive is extracted into a new folder at the path
+// without its .zip extension. An existing object at that path is never overwritten.
+func (s *FakeWorkspace) WorkspaceImportZipFolder(zipPath string, body []byte, overwrite bool) Response {
+	if !strings.HasPrefix(zipPath, "/") {
+		zipPath = "/" + zipPath
+	}
+	targetDir := strings.TrimSuffix(zipPath, ".zip")
+
+	exists := func() bool {
+		defer s.LockUnlock()()
+		_, isDir := s.directories[targetDir]
+		_, isFile := s.files[targetDir]
+		return isDir || isFile
+	}()
+	if exists {
+		if overwrite {
+			return Response{
+				StatusCode: http.StatusBadRequest,
+				Body: map[string]string{
+					"error_code": "INVALID_PARAMETER_VALUE",
+					"message":    "Overwrite cannot be used for AUTO format when importing a folder.",
+				},
+			}
+		}
+		return importAlreadyExists(targetDir + " already exists. Please pass overwrite=true to overwrite it.")
+	}
+
+	zr, err := zip.NewReader(bytes.NewReader(body), int64(len(body)))
+	if err != nil {
+		return Response{
+			StatusCode: http.StatusBadRequest,
+			Body: map[string]string{
+				"error_code": "BAD_REQUEST",
+				"message":    "Failed to unzip with error: " + err.Error(),
+			},
+		}
+	}
+
+	var entries []*zip.File
+	roots := map[string]bool{}
+	for _, entry := range zr.File {
+		if strings.HasPrefix(entry.Name, "__MACOSX") || entry.Name == "manifest.mf" {
+			continue
+		}
+		entries = append(entries, entry)
+		if root, _, _ := strings.Cut(entry.Name, "/"); root != "" {
+			roots[root] = true
+		}
+	}
+
+	// With a single root the archive's top-level directory is renamed to the target
+	// directory; with several roots they are all placed inside it.
+	baseDir, dirName := path.Split(targetDir)
+	rebase := func(name string) string {
+		if len(roots) > 1 {
+			return dirName + "/" + name
+		}
+		if _, rest, ok := strings.Cut(name, "/"); ok {
+			return dirName + "/" + rest
+		}
+		return name
+	}
+
+	s.WorkspaceMkdirs(workspace.Mkdirs{Path: targetDir})
+	for _, entry := range entries {
+		entryPath := path.Join(baseDir, rebase(entry.Name))
+		if entry.FileInfo().IsDir() {
+			s.WorkspaceMkdirs(workspace.Mkdirs{Path: entryPath})
+			continue
+		}
+		data, err := readZipEntry(entry)
+		if err != nil {
+			return Response{StatusCode: http.StatusBadRequest, Body: map[string]string{"message": err.Error()}}
+		}
+		if resp := s.importFile(entryPath, data, false, true); resp.StatusCode != 0 {
+			return resp
+		}
+	}
+	return Response{}
+}
+
+func readZipEntry(entry *zip.File) ([]byte, error) {
+	rc, err := entry.Open()
+	if err != nil {
+		return nil, err
+	}
+	defer rc.Close()
+	return io.ReadAll(rc)
+}
+
+// WorkspaceImportRawFile stores body as a file without notebook detection, as
+// /workspace/import does for format=RAW.
+func (s *FakeWorkspace) WorkspaceImportRawFile(filePath string, body []byte, overwrite bool) Response {
+	return s.importFile(filePath, body, overwrite, false)
+}
+
+func (s *FakeWorkspace) importFile(filePath string, body []byte, overwrite, detectNotebooks bool) Response {
 	if !strings.HasPrefix(filePath, "/") {
 		filePath = "/" + filePath
 	}
@@ -391,6 +1056,10 @@ func (s *FakeWorkspace) WorkspaceFilesImportFile(filePath string, body []byte, o
 
 	workspacePath := filePath
 
+	if resp, ok := s.requireParentDirectory(workspacePath); !ok {
+		return resp
+	}
+
 	if !overwrite {
 		if _, exists := s.files[workspacePath]; exists {
 			return Response{
@@ -400,19 +1069,20 @@ func (s *FakeWorkspace) WorkspaceFilesImportFile(filePath string, body []byte, o
 		}
 	}
 
-	// Note: Files with .py, .scala, .r or .sql extension can
-	// be notebooks if they contain a magical "Databricks notebook source"
-	// header comment. We omit support non-python extensions for now for simplicity.
+	// Files with .py / .sql / .scala / .r extension can be notebooks if they
+	// carry the "Databricks notebook source" header comment in the language's
+	// line-comment syntax. Mirror the real workspace's auto-detection here so
+	// acceptance tests can assert the resulting object_type via /workspace/list.
 	extension := filepath.Ext(filePath)
-	if extension == ".py" && strings.HasPrefix(string(body), "# Databricks notebook source") {
+	if lang, isNotebook := detectNotebookLanguage(extension, body); detectNotebooks && isNotebook {
 		// Notebooks are stripped of their extension by the workspace import API.
 		workspacePath = strings.TrimSuffix(filePath, extension)
 		s.files[workspacePath] = FileEntry{
 			Info: workspace.ObjectInfo{
 				ObjectType: "NOTEBOOK",
 				Path:       workspacePath,
-				Language:   "PYTHON",
-				ObjectId:   nextID(),
+				Language:   lang,
+				ObjectId:   nextTreenodeID(),
 			},
 			Data: body,
 		}
@@ -424,23 +1094,69 @@ func (s *FakeWorkspace) WorkspaceFilesImportFile(filePath string, body []byte, o
 			Info: workspace.ObjectInfo{
 				ObjectType: "FILE",
 				Path:       workspacePath,
-				ObjectId:   nextID(),
+				ObjectId:   nextTreenodeID(),
 			},
 			Data: body,
 		}
 	}
 
-	// Add all directories in the path to the directories map
-	for dir := path.Dir(workspacePath); dir != "/"; dir = path.Dir(dir) {
-		if _, exists := s.directories[dir]; !exists {
-			s.directories[dir] = workspace.ObjectInfo{
-				ObjectType: "DIRECTORY",
-				Path:       dir,
-				ObjectId:   nextID(),
+	return Response{}
+}
+
+// requireParentDirectory returns a 404 response when objectPath's parent
+// directory does not exist. The real import API does not create missing parents;
+// callers get "mkdir -p" semantics only by first calling /workspace/mkdirs (see
+// WorkspaceFilesClient.Write, which mkdirs and retries on this 404). ok is false
+// when the returned response should be sent to the client. The caller must hold
+// the lock.
+func (s *FakeWorkspace) requireParentDirectory(objectPath string) (Response, bool) {
+	parent := path.Dir(objectPath)
+	if parent == "/" {
+		return Response{}, true
+	}
+	if _, exists := s.directories[parent]; !exists {
+		return Response{
+			StatusCode: 404,
+			Body:       map[string]string{"message": fmt.Sprintf("The parent folder (%s) does not exist.", parent)},
+		}, false
+	}
+	return Response{}, true
+}
+
+// WorkspaceImportNotebook stores a notebook imported with the SOURCE format.
+// Unlike AUTO format, SOURCE keeps the path as-is (no extension stripping) and
+// the notebook language is provided explicitly rather than sniffed from a
+// "# Databricks notebook source" header.
+func (s *FakeWorkspace) WorkspaceImportNotebook(filePath string, body []byte, language workspace.Language, overwrite bool) Response {
+	if !strings.HasPrefix(filePath, "/") {
+		filePath = "/" + filePath
+	}
+
+	defer s.LockUnlock()()
+
+	if resp, ok := s.requireParentDirectory(filePath); !ok {
+		return resp
+	}
+
+	if !overwrite {
+		if _, exists := s.files[filePath]; exists {
+			return Response{
+				StatusCode: 409,
+				Body:       map[string]string{"message": fmt.Sprintf("File already exists at (%s).", filePath)},
 			}
 		}
 	}
 
+	s.files[filePath] = FileEntry{
+		Info: workspace.ObjectInfo{
+			ObjectType: "NOTEBOOK",
+			Path:       filePath,
+			Language:   language,
+			ObjectId:   nextTreenodeID(),
+		},
+		Data: body,
+	}
+
 	return Response{}
 }
 
diff --git a/libs/testserver/fault.go b/libs/testserver/fault.go
new file mode 100644
index 00000000000..43d46f3f28c
--- /dev/null
+++ b/libs/testserver/fault.go
@@ -0,0 +1,134 @@
+package testserver
+
+import (
+	"bytes"
+	"encoding/json"
+	"strings"
+	"sync"
+)
+
+type faultRuleKey struct {
+	token   string
+	pattern string
+}
+
+// FaultRule describes a single injected fault: HTTP status, body, and remaining fire count.
+type FaultRule struct {
+	StatusCode int
+	Body       string
+	// AfterHandler keeps the handler's state change and replaces only its response.
+	AfterHandler bool
+	offset       int
+	times        int
+
+	// bodyContains, if non-empty, additionally requires the request body to
+	// contain this substring for the rule to fire. /workspace/import routes
+	// every upload through the same method+path, so the only way to target a
+	// single file's upload is by matching its multipart "path" form field.
+	bodyContains string
+}
+
+// FaultRules holds the active fault injection rules for a test server.
+type FaultRules struct {
+	mu    sync.Mutex
+	rules map[faultRuleKey]*FaultRule
+}
+
+// NewFaultRules returns an empty FaultRules.
+func NewFaultRules() *FaultRules {
+	return &FaultRules{rules: make(map[faultRuleKey]*FaultRule)}
+}
+
+// Set registers or replaces a fault rule for the given token and pattern.
+func (fr *FaultRules) Set(token, pattern string, statusCode int, body string, offset, times int, bodyContains string) {
+	fr.set(token, pattern, statusCode, body, offset, times, false, bodyContains)
+}
+
+// SetAfterHandler is like Set, but the handler runs first so its effect is kept.
+func (fr *FaultRules) SetAfterHandler(token, pattern string, statusCode int, body string, offset, times int, bodyContains string) {
+	fr.set(token, pattern, statusCode, body, offset, times, true, bodyContains)
+}
+
+func (fr *FaultRules) set(token, pattern string, statusCode int, body string, offset, times int, afterHandler bool, bodyContains string) {
+	fr.mu.Lock()
+	defer fr.mu.Unlock()
+	fr.rules[faultRuleKey{token: token, pattern: pattern}] = &FaultRule{
+		StatusCode:   statusCode,
+		Body:         body,
+		AfterHandler: afterHandler,
+		offset:       offset,
+		times:        times,
+		bodyContains: bodyContains,
+	}
+}
+
+// Check returns a matching fault rule and advances its counters, or nil if no rule matches.
+// Pattern supports a trailing "*" wildcard, e.g. "PUT /api/2.0/permissions/pipelines/*".
+// A rule with a non-empty bodyContains only matches when body contains that substring.
+func (fr *FaultRules) Check(method, path, token string, body []byte) *FaultRule {
+	requestPattern := method + " " + path
+
+	fr.mu.Lock()
+	defer fr.mu.Unlock()
+
+	for key, rule := range fr.rules {
+		if key.token != token {
+			continue
+		}
+		rulePattern := key.pattern
+		var matched bool
+		if strings.HasSuffix(rulePattern, "*") {
+			matched = strings.HasPrefix(requestPattern, rulePattern[:len(rulePattern)-1])
+		} else {
+			matched = requestPattern == rulePattern
+		}
+		if !matched {
+			continue
+		}
+		// A non-matching body must not consume the rule's offset/times budget,
+		// so this check precedes the counter updates below.
+		if rule.bodyContains != "" && !bytes.Contains(body, []byte(rule.bodyContains)) {
+			continue
+		}
+		if rule.offset > 0 {
+			rule.offset--
+			return nil
+		}
+		if rule.times <= 0 {
+			delete(fr.rules, key)
+			return nil
+		}
+		rule.times--
+		if rule.times == 0 {
+			delete(fr.rules, key)
+		}
+		result := *rule
+		return &result
+	}
+
+	return nil
+}
+
+// faultEndpointHandler handles POST /__testserver/fault.
+func faultEndpointHandler(fr *FaultRules) HandlerFunc {
+	return func(req Request) any {
+		var body struct {
+			Pattern      string `json:"pattern"`
+			StatusCode   int    `json:"status_code"`
+			Body         string `json:"body"`
+			Offset       int    `json:"offset"`
+			Times        int    `json:"times"`
+			AfterHandler bool   `json:"after_handler"`
+			BodyContains string `json:"body_contains"`
+		}
+		if err := json.Unmarshal(req.Body, &body); err != nil {
+			return Response{StatusCode: 400, Body: map[string]string{"error": err.Error()}}
+		}
+		if body.AfterHandler {
+			fr.SetAfterHandler(req.Token, body.Pattern, body.StatusCode, body.Body, body.Offset, body.Times, body.BodyContains)
+		} else {
+			fr.Set(req.Token, body.Pattern, body.StatusCode, body.Body, body.Offset, body.Times, body.BodyContains)
+		}
+		return Response{StatusCode: 200}
+	}
+}
diff --git a/libs/testserver/fault_test.go b/libs/testserver/fault_test.go
new file mode 100644
index 00000000000..ae27b954f93
--- /dev/null
+++ b/libs/testserver/fault_test.go
@@ -0,0 +1,110 @@
+package testserver_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"sync/atomic"
+	"testing"
+
+	"github.com/databricks/cli/libs/testserver"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestFaultRulesNoMatch(t *testing.T) {
+	fr := testserver.NewFaultRules()
+	fr.Set("tok", "GET /foo", 504, "body", 0, 1, "")
+
+	assert.Nil(t, fr.Check("POST", "/foo", "tok", nil))
+	assert.Nil(t, fr.Check("GET", "/bar", "tok", nil))
+	assert.Nil(t, fr.Check("GET", "/foo", "other", nil))
+}
+
+func TestFaultRulesExactMatch(t *testing.T) {
+	fr := testserver.NewFaultRules()
+	fr.Set("tok", "PUT /api/2.0/jobs/123", 504, "body", 0, 1, "")
+
+	rule := fr.Check("PUT", "/api/2.0/jobs/123", "tok", nil)
+	require.NotNil(t, rule)
+	assert.Equal(t, 504, rule.StatusCode)
+	assert.Equal(t, "body", rule.Body)
+}
+
+func TestFaultRulesWildcardMatch(t *testing.T) {
+	fr := testserver.NewFaultRules()
+	fr.Set("tok", "PUT /api/2.0/permissions/pipelines/*", 504, "body", 0, 2, "")
+
+	assert.NotNil(t, fr.Check("PUT", "/api/2.0/permissions/pipelines/abc", "tok", nil))
+	assert.NotNil(t, fr.Check("PUT", "/api/2.0/permissions/pipelines/xyz", "tok", nil))
+	assert.Nil(t, fr.Check("PUT", "/api/2.0/permissions/pipelines/xyz", "tok", nil)) // exhausted
+}
+
+func TestFaultRulesOffset(t *testing.T) {
+	fr := testserver.NewFaultRules()
+	fr.Set("tok", "GET /foo", 504, "body", 2, 1, "")
+
+	assert.Nil(t, fr.Check("GET", "/foo", "tok", nil))    // offset 2→1
+	assert.Nil(t, fr.Check("GET", "/foo", "tok", nil))    // offset 1→0
+	assert.NotNil(t, fr.Check("GET", "/foo", "tok", nil)) // fires
+	assert.Nil(t, fr.Check("GET", "/foo", "tok", nil))    // exhausted
+}
+
+func TestFaultRulesTimes(t *testing.T) {
+	fr := testserver.NewFaultRules()
+	fr.Set("tok", "GET /foo", 504, "body", 0, 3, "")
+
+	for range 3 {
+		assert.NotNil(t, fr.Check("GET", "/foo", "tok", nil))
+	}
+	assert.Nil(t, fr.Check("GET", "/foo", "tok", nil)) // exhausted
+}
+
+func TestFaultRulesBodyContains(t *testing.T) {
+	fr := testserver.NewFaultRules()
+	fr.Set("tok", "POST /api/2.0/workspace/import", 403, "body", 0, 1, "state/resources.json")
+
+	// Body without the substring must not match and must not consume the budget.
+	assert.Nil(t, fr.Check("POST", "/api/2.0/workspace/import", "tok", []byte("path=state/deploy.lock")))
+	// Body with the substring fires.
+	assert.NotNil(t, fr.Check("POST", "/api/2.0/workspace/import", "tok", []byte("path=state/resources.json")))
+	// Budget was only consumed by the matching request.
+	assert.Nil(t, fr.Check("POST", "/api/2.0/workspace/import", "tok", []byte("path=state/resources.json")))
+}
+
+func TestServerFaultAfterHandlerKeepsTheHandlersEffect(t *testing.T) {
+	var calls atomic.Int32
+	server := testserver.New(t)
+	server.Handle("POST", "/create", func(req testserver.Request) any {
+		calls.Add(1)
+		return map[string]string{"status": "created"}
+	})
+
+	body, err := json.Marshal(map[string]any{
+		"pattern":       "POST /create",
+		"status_code":   503,
+		"body":          `{"error_code": "INJECTED", "message": "Fault injected by test."}`,
+		"offset":        0,
+		"times":         1,
+		"after_handler": true,
+	})
+	require.NoError(t, err)
+
+	setReq, err := http.NewRequest(http.MethodPost, server.URL+"/__testserver/fault", bytes.NewReader(body))
+	require.NoError(t, err)
+	setReq.Header.Set("Authorization", "Bearer dbapi-fault-test")
+	setResp, err := http.DefaultClient.Do(setReq)
+	require.NoError(t, err)
+	require.Equal(t, 200, setResp.StatusCode)
+	setResp.Body.Close()
+
+	createReq, err := http.NewRequest(http.MethodPost, server.URL+"/create", bytes.NewReader([]byte("{}")))
+	require.NoError(t, err)
+	createReq.Header.Set("Authorization", "Bearer dbapi-fault-test")
+	createResp, err := http.DefaultClient.Do(createReq)
+	require.NoError(t, err)
+	assert.Equal(t, 503, createResp.StatusCode)
+	createResp.Body.Close()
+
+	assert.Equal(t, int32(1), calls.Load())
+}
diff --git a/libs/testserver/feature.go b/libs/testserver/feature.go
new file mode 100644
index 00000000000..fe3289e38d6
--- /dev/null
+++ b/libs/testserver/feature.go
@@ -0,0 +1,69 @@
+package testserver
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/databricks/databricks-sdk-go/service/ml"
+)
+
+// FeaturesCreate fakes POST /api/2.0/feature-engineering/features. The Feature body is sent
+// directly and the map is keyed by full_name, which is also the resource id. catalog_name,
+// schema_name and name are derived here because the backend derives them from full_name.
+func (s *FakeWorkspace) FeaturesCreate(req Request) Response {
+	defer s.LockUnlock()()
+
+	var feature ml.Feature
+	if err := json.Unmarshal(req.Body, &feature); err != nil {
+		return Response{
+			Body:       fmt.Sprintf("internal error: %s", err),
+			StatusCode: http.StatusInternalServerError,
+		}
+	}
+
+	parts := strings.Split(feature.FullName, ".")
+	if len(parts) != 3 {
+		return Response{
+			StatusCode: http.StatusBadRequest,
+			Body:       fmt.Sprintf("full_name must be a three-part name, got %q", feature.FullName),
+		}
+	}
+	feature.CatalogName, feature.SchemaName, feature.Name = parts[0], parts[1], parts[2]
+	feature.CreatedBy = s.CurrentUser().UserName
+
+	s.Features[feature.FullName] = feature
+	return Response{
+		Body: feature,
+	}
+}
+
+// FeaturesUpdate fakes PATCH /api/2.0/feature-engineering/features/{full_name}. Only description
+// is applied: it is the sole field the real update endpoint accepts.
+func (s *FakeWorkspace) FeaturesUpdate(req Request, fullName string) Response {
+	defer s.LockUnlock()()
+
+	existing, ok := s.Features[fullName]
+	if !ok {
+		return Response{
+			StatusCode: http.StatusNotFound,
+			Body:       fmt.Sprintf("feature %s not found", fullName),
+		}
+	}
+
+	var incoming ml.Feature
+	if err := json.Unmarshal(req.Body, &incoming); err != nil {
+		return Response{
+			Body:       fmt.Sprintf("internal error: %s", err),
+			StatusCode: http.StatusInternalServerError,
+		}
+	}
+
+	existing.Description = incoming.Description
+
+	s.Features[fullName] = existing
+	return Response{
+		Body: existing,
+	}
+}
diff --git a/libs/testserver/genie_spaces.go b/libs/testserver/genie_spaces.go
new file mode 100644
index 00000000000..1ca6118427e
--- /dev/null
+++ b/libs/testserver/genie_spaces.go
@@ -0,0 +1,240 @@
+package testserver
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"strconv"
+	"strings"
+
+	"github.com/databricks/databricks-sdk-go/service/dashboards"
+)
+
+// generateGenieSpaceId returns a random 32-character hex string.
+func generateGenieSpaceId() (string, error) {
+	randomBytes := make([]byte, 16)
+	_, err := rand.Read(randomBytes)
+	if err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(randomBytes), nil
+}
+
+// canonicalizeGenieSerializedSpace mimics the backend's schema migration: a
+// serialized_space authored at version 1 is upgraded to version 2 (gaining an
+// empty data_sources object) when written. Observed on aws-prod-ucws (2026-06):
+// a create with {"version":1} reads back from GET as
+// {"version":2,"data_sources":{}}. The local config keeps version 1, so the
+// remote-vs-local serialized_space differs permanently; the resource relies on
+// ignore_remote_changes (etag_based) to avoid spurious drift. Reproducing the
+// migration here lets that handling be exercised against the mock server.
+func canonicalizeGenieSerializedSpace(serialized string) string {
+	if serialized == "" {
+		return serialized
+	}
+	var m map[string]any
+	if err := json.Unmarshal([]byte(serialized), &m); err != nil {
+		// Not a JSON object we recognize; store verbatim.
+		return serialized
+	}
+	if v, ok := m["version"].(float64); !ok || v != 1 {
+		return serialized
+	}
+	m["version"] = 2
+	if _, ok := m["data_sources"]; !ok {
+		m["data_sources"] = map[string]any{}
+	}
+	b, err := json.Marshal(m)
+	if err != nil {
+		return serialized
+	}
+	return string(b)
+}
+
+func (s *FakeWorkspace) GenieSpaceCreate(req Request) Response {
+	defer s.LockUnlock()()
+
+	var createReq dashboards.GenieCreateSpaceRequest
+	if err := json.Unmarshal(req.Body, &createReq); err != nil {
+		return Response{
+			StatusCode: 400,
+			Body: map[string]string{
+				"message": "Invalid request body: " + err.Error(),
+			},
+		}
+	}
+
+	// Default to user's home directory if parent_path is not provided (matches cloud behavior)
+	if createReq.ParentPath == "" {
+		createReq.ParentPath = "/Users/" + s.CurrentUser().UserName
+	}
+
+	spaceId, err := generateGenieSpaceId()
+	if err != nil {
+		return Response{
+			StatusCode: 500,
+			Body: map[string]string{
+				"message": "Failed to generate genie space ID",
+			},
+		}
+	}
+
+	// Strip the /Workspace prefix from parent_path before storing. This matches
+	// the remote behavior: the GET API returns parent_path without the prefix,
+	// mirroring DashboardCreate.
+	if strings.HasPrefix(createReq.ParentPath, "/Workspace/") {
+		createReq.ParentPath = strings.TrimPrefix(createReq.ParentPath, "/Workspace")
+	}
+
+	genieSpace := dashboards.GenieSpace{
+		SpaceId:         spaceId,
+		Title:           createReq.Title,
+		Description:     createReq.Description,
+		ParentPath:      createReq.ParentPath,
+		WarehouseId:     createReq.WarehouseId,
+		SerializedSpace: canonicalizeGenieSerializedSpace(createReq.SerializedSpace),
+		// Mirror libs/testserver/dashboards.go: initialize etag to a numeric
+		// string so each subsequent update can bump it monotonically.
+		Etag: "1",
+	}
+
+	s.GenieSpaces[spaceId] = genieSpace
+
+	// Genie spaces are not exposed as workspace files ("dataRoom is not
+	// user-facing"), so unlike dashboards we do not register a workspace path
+	// entry — there is nothing to resolve via the Workspace API.
+
+	return Response{
+		Body: genieSpace,
+	}
+}
+
+func (s *FakeWorkspace) GenieSpaceGet(req Request) Response {
+	defer s.LockUnlock()()
+
+	spaceId := req.Vars["space_id"]
+	genieSpace, ok := s.GenieSpaces[spaceId]
+	if !ok {
+		return Response{
+			StatusCode: 404,
+			Body: map[string]string{
+				"message": "Genie space not found",
+			},
+		}
+	}
+
+	// The GET API only returns the etag when serialized_space is requested
+	// (include_serialized_space=true). genieSpace is a copy, so clearing the
+	// field here only affects the response.
+	if req.URL.Query().Get("include_serialized_space") != "true" {
+		genieSpace.Etag = ""
+	}
+
+	return Response{
+		Body: genieSpace,
+	}
+}
+
+func (s *FakeWorkspace) GenieSpaceUpdate(req Request) Response {
+	defer s.LockUnlock()()
+
+	spaceId := req.Vars["space_id"]
+	genieSpace, ok := s.GenieSpaces[spaceId]
+	if !ok {
+		return Response{
+			StatusCode: 404,
+			Body: map[string]string{
+				"message": "Genie space not found",
+			},
+		}
+	}
+
+	var updateReq dashboards.GenieUpdateSpaceRequest
+	if err := json.Unmarshal(req.Body, &updateReq); err != nil {
+		return Response{
+			StatusCode: 400,
+			Body: map[string]string{
+				"message": "Invalid request body: " + err.Error(),
+			},
+		}
+	}
+
+	// Which fields the caller actually sent, so an explicit "description": "" (the CLI
+	// force-sends it) clears the value instead of being treated as "not provided".
+	fields, _ := parseUpdateFields(req.Body)
+
+	// Optimistic concurrency: if the caller sent an etag, it must match the
+	// current one. Empty etag means apply unconditionally.
+	if updateReq.Etag != "" && updateReq.Etag != genieSpace.Etag {
+		return Response{
+			StatusCode: 409,
+			Body: map[string]string{
+				"message": "Etag mismatch: expected " + genieSpace.Etag + ", got " + updateReq.Etag,
+			},
+		}
+	}
+
+	prev := genieSpace
+	if updateReq.Title != "" {
+		genieSpace.Title = updateReq.Title
+	}
+	if _, ok := fields["description"]; ok {
+		genieSpace.Description = updateReq.Description
+	}
+	if updateReq.WarehouseId != "" {
+		genieSpace.WarehouseId = updateReq.WarehouseId
+	}
+	if updateReq.ParentPath != "" {
+		parentPath := updateReq.ParentPath
+		if strings.HasPrefix(parentPath, "/Workspace/") {
+			parentPath = strings.TrimPrefix(parentPath, "/Workspace")
+		}
+		genieSpace.ParentPath = parentPath
+	}
+	if updateReq.SerializedSpace != "" {
+		genieSpace.SerializedSpace = canonicalizeGenieSerializedSpace(updateReq.SerializedSpace)
+	}
+
+	// The backend bumps the etag only when serialized_space changes; updates to
+	// other fields (title, description, warehouse_id, parent_path) leave it
+	// unchanged. This mirrors the GET API, which only returns the etag
+	// alongside serialized_space.
+	if prev.SerializedSpace != genieSpace.SerializedSpace {
+		prevEtag, err := strconv.Atoi(genieSpace.Etag)
+		if err != nil {
+			return Response{
+				StatusCode: 500,
+				Body: map[string]string{
+					"message": "Invalid stored etag: " + genieSpace.Etag,
+				},
+			}
+		}
+		genieSpace.Etag = strconv.Itoa(prevEtag + 1)
+	}
+
+	s.GenieSpaces[spaceId] = genieSpace
+
+	return Response{
+		Body: genieSpace,
+	}
+}
+
+func (s *FakeWorkspace) GenieSpaceTrash(req Request) Response {
+	defer s.LockUnlock()()
+
+	spaceId := req.Vars["space_id"]
+	if _, ok := s.GenieSpaces[spaceId]; !ok {
+		return Response{
+			StatusCode: 404,
+			Body: map[string]string{
+				"message": "Genie space not found",
+			},
+		}
+	}
+
+	delete(s.GenieSpaces, spaceId)
+
+	return Response{
+		StatusCode: 200,
+	}
+}
diff --git a/libs/testserver/grants.go b/libs/testserver/grants.go
index 8a5be42ed91..380b0f80640 100644
--- a/libs/testserver/grants.go
+++ b/libs/testserver/grants.go
@@ -10,6 +10,15 @@ import (
 	"github.com/databricks/databricks-sdk-go/service/catalog"
 )
 
+// notImpliedByAllPrivileges are the privileges UC does not include in
+// ALL_PRIVILEGES, so granting or revoking ALL_PRIVILEGES never affects them.
+var notImpliedByAllPrivileges = map[catalog.Privilege]bool{
+	catalog.PrivilegeManage:              true,
+	catalog.PrivilegeReadMetadata:        true,
+	catalog.PrivilegeExternalUseSchema:   true,
+	catalog.PrivilegeExternalUseLocation: true,
+}
+
 func grantsKey(securableType, fullName string) string {
 	return strings.ToUpper(securableType) + ":" + fullName
 }
@@ -71,7 +80,16 @@ func (s *FakeWorkspace) GrantsUpdate(req Request, securableType, fullName string
 		// Remove privileges
 		for _, privilege := range change.Remove {
 			if privilege == catalog.PrivilegeAllPrivileges {
-				principalPrivs[change.Principal] = make(map[catalog.Privilege]bool)
+				// Removing ALL_PRIVILEGES clears every privilege it implies, but NOT
+				// the ones UC does not include in ALL_PRIVILEGES (MANAGE,
+				// READ_METADATA, EXTERNAL_USE_SCHEMA, EXTERNAL_USE_LOCATION). Those
+				// are granted independently and survive. See
+				// https://docs.databricks.com/aws/en/data-governance/unity-catalog/manage-privileges/privileges
+				for p := range principalPrivs[change.Principal] {
+					if !notImpliedByAllPrivileges[p] {
+						delete(principalPrivs[change.Principal], p)
+					}
+				}
 			} else {
 				delete(principalPrivs[change.Principal], privilege)
 			}
diff --git a/libs/testserver/handlers.go b/libs/testserver/handlers.go
index d98011fc7ba..e1a14b9800b 100644
--- a/libs/testserver/handlers.go
+++ b/libs/testserver/handlers.go
@@ -1,13 +1,20 @@
 package testserver
 
 import (
+	"bytes"
 	"encoding/base64"
 	"encoding/json"
+	"errors"
 	"fmt"
+	"io"
+	"mime"
+	"mime/multipart"
 	"net/http"
 	"path"
+	"strconv"
 	"strings"
 
+	"github.com/databricks/cli/libs/notebook"
 	"github.com/databricks/databricks-sdk-go/service/catalog"
 	"github.com/databricks/databricks-sdk-go/service/compute"
 	"github.com/databricks/databricks-sdk-go/service/jobs"
@@ -15,26 +22,154 @@ import (
 	"github.com/databricks/databricks-sdk-go/service/workspace"
 )
 
+// TestWorkspaceID is the id of the fake workspace.
+const TestWorkspaceID = 900800700600
+
 var TestMetastore = catalog.MetastoreAssignment{
 	DefaultCatalogName: "hive_metastore",
 	MetastoreId:        "120efa64-9b68-46ba-be38-f319458430d2",
-	WorkspaceId:        900800700600,
+	WorkspaceId:        TestWorkspaceID,
 }
 
-func AddDefaultHandlers(server *Server) {
-	server.Handle("GET", "/api/2.0/policies/clusters/list", func(req Request) any {
-		return compute.ListPoliciesResponse{
-			Policies: []compute.Policy{
-				{
-					PolicyId: "5678",
-					Name:     "wrong-cluster-policy",
+// Extensions that format=AUTO maps to workspace asset types /workspace/import
+// cannot create, so the real endpoint rejects such uploads. Source of truth is
+// workspace-hierarchy/config/AssetConfig.scala in universe.
+var autoImportReservedExtensions = []string{
+	".dbcluster.json",
+	".dbclusterpolicy.json",
+	".dbjob.json",
+	".dbpipeline.json",
+	".deployment.json",
+	".geniedoc.json",
+	".geniespace.json",
+	".lakebase.json",
+	".lakebridge.json",
+	".lwquery.ipynb",
+	".omnigentchildsession.json",
+	".omnigentsession.json",
+}
+
+// autoImportUnsupported returns the response for a format=AUTO upload of filePath
+// whose name the real endpoint maps to an asset type it cannot import.
+func autoImportUnsupported(filePath string) (Response, bool) {
+	name := strings.ToLower(filePath)
+	for _, ext := range autoImportReservedExtensions {
+		if strings.HasSuffix(name, ext) {
+			return Response{
+				StatusCode: http.StatusBadRequest,
+				Body: map[string]string{
+					"error_code": "INVALID_PARAMETER_VALUE",
+					"message":    "Requested node type [UNKNOWN] is not supported",
 				},
+			}, true
+		}
+	}
+	return Response{}, false
+}
+
+// workspaceImport serves POST /api/2.0/workspace/import for both its JSON and
+// multipart request bodies.
+func workspaceImport(w *FakeWorkspace, form ImportForm) Response {
+	var resp Response
+	switch form.Format {
+	case string(workspace.ImportFormatRaw):
+		resp = w.WorkspaceImportRawFile(form.Path, form.Content, form.Overwrite)
+	case string(workspace.ImportFormatSource):
+		resp = w.WorkspaceImportNotebook(form.Path, form.Content, workspace.Language(form.Language), form.Overwrite)
+	case string(workspace.ImportFormatJupyter):
+		// The real endpoint reads the language from the notebook metadata.
+		_, language, _ := notebook.DetectBytes(form.Path+notebook.ExtensionJupyter, form.Content)
+		resp = w.WorkspaceImportNotebook(form.Path, form.Content, language, form.Overwrite)
+	case string(workspace.ImportFormatAuto):
+		if strings.HasSuffix(strings.ToLower(form.Path), ".zip") {
+			return w.WorkspaceImportZipFolder(form.Path, form.Content, form.Overwrite)
+		}
+		if unsupported, ok := autoImportUnsupported(form.Path); ok {
+			return unsupported
+		}
+		resp = w.WorkspaceFilesImportFile(form.Path, form.Content, form.Overwrite)
+	default:
+		return Response{
+			Body:       fmt.Sprintf("internal error: The test server only supports AUTO, RAW, SOURCE and JUPYTER formats, got %q.", form.Format),
+			StatusCode: http.StatusInternalServerError,
+		}
+	}
+
+	// Translate any 409 from the shared fake into the 400 + errorCode
+	// RESOURCE_ALREADY_EXISTS shape returned by the real /workspace/import
+	// endpoint, including the AIP-193 ErrorInfo detail it attaches to path
+	// collisions (universe PR #2019174, WP-6031).
+	if resp.StatusCode == http.StatusConflict {
+		return importAlreadyExists(fmt.Sprintf("Path (%s) already exists.", form.Path))
+	}
+	return resp
+}
+
+// importAlreadyExists is the /workspace/import response for a path collision.
+func importAlreadyExists(message string) Response {
+	return Response{
+		StatusCode: http.StatusBadRequest,
+		Body: map[string]any{
+			"error_code": "RESOURCE_ALREADY_EXISTS",
+			"message":    message,
+			"details": []map[string]any{
 				{
-					PolicyId: "9876",
-					Name:     "some-test-cluster-policy",
+					"@type":  "type.googleapis.com/google.rpc.ErrorInfo",
+					"reason": "RESOURCE_ALREADY_EXISTS",
+					"domain": "workspace.databricks.com",
 				},
 			},
+		},
+	}
+}
+
+// ImportForm holds the fields of a multipart /workspace/import request.
+type ImportForm struct {
+	Path      string
+	Content   []byte
+	Format    string
+	Language  string
+	Overwrite bool
+}
+
+// ParseImportForm parses the multipart body of a /workspace/import request.
+func ParseImportForm(req Request) (ImportForm, error) {
+	var form ImportForm
+	_, params, err := mime.ParseMediaType(req.Headers.Get("Content-Type"))
+	if err != nil {
+		return form, err
+	}
+	mr := multipart.NewReader(bytes.NewReader(req.Body), params["boundary"])
+	for {
+		part, err := mr.NextPart()
+		if errors.Is(err, io.EOF) {
+			return form, nil
+		}
+		if err != nil {
+			return form, err
+		}
+		data, err := io.ReadAll(part)
+		if err != nil {
+			return form, err
 		}
+		switch part.FormName() {
+		case "path":
+			form.Path = string(data)
+		case "content":
+			form.Content = data
+		case "format":
+			form.Format = string(data)
+		case "language":
+			form.Language = string(data)
+		case "overwrite":
+			form.Overwrite = string(data) == "true"
+		}
+	}
+}
+
+func AddDefaultHandlers(server *Server) {
+	server.Handle("GET", "/api/2.0/policies/clusters/list", func(req Request) any {
+		return req.Workspace.ClusterPoliciesList(req)
 	})
 
 	server.Handle("GET", "/api/2.0/instance-pools/list", func(req Request) any {
@@ -51,6 +186,19 @@ func AddDefaultHandlers(server *Server) {
 			},
 		}
 	})
+	server.Handle("POST", "/api/2.0/instance-pools/create", func(req Request) any { return req.Workspace.InstancePoolsCreate(req) })
+	server.Handle("POST", "/api/2.0/instance-pools/edit", func(req Request) any { return req.Workspace.InstancePoolsEdit(req) })
+	server.Handle("POST", "/api/2.0/instance-pools/delete", func(req Request) any { return req.Workspace.InstancePoolsDelete(req) })
+	server.Handle("GET", "/api/2.0/instance-pools/get", func(req Request) any {
+		return req.Workspace.InstancePoolsGet(req, req.URL.Query().Get("instance_pool_id"))
+	})
+
+	server.Handle("POST", "/api/2.0/policies/clusters/create", func(req Request) any { return req.Workspace.ClusterPoliciesCreate(req) })
+	server.Handle("POST", "/api/2.0/policies/clusters/edit", func(req Request) any { return req.Workspace.ClusterPoliciesEdit(req) })
+	server.Handle("POST", "/api/2.0/policies/clusters/delete", func(req Request) any { return req.Workspace.ClusterPoliciesDelete(req) })
+	server.Handle("GET", "/api/2.0/policies/clusters/get", func(req Request) any {
+		return req.Workspace.ClusterPoliciesGet(req, req.URL.Query().Get("policy_id"))
+	})
 
 	server.Handle("GET", "/api/2.1/clusters/list", func(req Request) any {
 		return compute.ListClustersResponse{
@@ -69,14 +217,20 @@ func AddDefaultHandlers(server *Server) {
 
 	server.Handle("GET", "/api/2.0/preview/scim/v2/Me", func(req Request) any {
 		return Response{
-			Headers: map[string][]string{"X-Databricks-Org-Id": {"900800700600"}},
-			Body:    req.Workspace.CurrentUser(),
+			Headers: map[string][]string{"X-Databricks-Org-Id": {strconv.Itoa(TestWorkspaceID)}},
+			Body:    req.Workspace.MeUser(req.Token),
 		}
 	})
 
 	server.Handle("GET", "/api/2.0/workspace/get-status", func(req Request) any {
 		path := req.URL.Query().Get("path")
-		return req.Workspace.WorkspaceGetStatus(path)
+		returnGitInfo := req.URL.Query().Get("return_git_info") == "true"
+		return req.Workspace.WorkspaceGetStatus(path, returnGitInfo)
+	})
+
+	server.Handle("GET", "/api/2.0/workspace/list", func(req Request) any {
+		path := req.URL.Query().Get("path")
+		return req.Workspace.WorkspaceList(path)
 	})
 
 	server.Handle("POST", "/api/2.0/workspace/mkdirs", func(req Request) any {
@@ -94,7 +248,29 @@ func AddDefaultHandlers(server *Server) {
 
 	server.Handle("GET", "/api/2.0/workspace/export", func(req Request) any {
 		path := req.URL.Query().Get("path")
-		return req.Workspace.WorkspaceExport(path)
+		data := req.Workspace.WorkspaceExport(path)
+
+		// A missing object returns 404, matching the real API; returning the nil
+		// body otherwise trips the response normalizer.
+		if data == nil {
+			return Response{
+				StatusCode: 404,
+				Body:       map[string]string{"message": fmt.Sprintf("Path (%s) doesn't exist.", path)},
+			}
+		}
+
+		// The filer reads the raw object body via ?direct_download=true, while
+		// the SDK's Workspace.Export (used by `databricks workspace export`)
+		// requests JSON and expects the base64-encoded content field.
+		if req.URL.Query().Get("direct_download") == "true" {
+			return data
+		}
+
+		return Response{
+			Body: workspace.ExportResponse{
+				Content: base64.StdEncoding.EncodeToString(data),
+			},
+		}
 	})
 
 	server.Handle("POST", "/api/2.0/workspace/delete", func(req Request) any {
@@ -105,8 +281,7 @@ func AddDefaultHandlers(server *Server) {
 				StatusCode: 500,
 			}
 		}
-		req.Workspace.WorkspaceDelete(request.Path, request.Recursive)
-		return ""
+		return req.Workspace.WorkspaceDelete(request.Path, request.Recursive)
 	})
 
 	server.Handle("POST", "/api/2.0/workspace-files/import-file/{path...}", func(req Request) any {
@@ -116,6 +291,32 @@ func AddDefaultHandlers(server *Server) {
 	})
 
 	server.Handle("POST", "/api/2.0/workspace/import", func(req Request) any {
+		// /workspace/import accepts both a JSON body (matching workspace.Import) and a
+		// multipart form body. The multipart variant is what databricks-sdk-go's
+		// Workspace.Upload uses; the JSON variant is kept for back-compat with anything
+		// that still hits Workspace.Import directly.
+		mediaType, _, _ := mime.ParseMediaType(req.Headers.Get("Content-Type"))
+		if strings.HasPrefix(mediaType, "multipart/") {
+			form, err := ParseImportForm(req)
+			if err != nil {
+				return Response{
+					Body:       fmt.Sprintf("internal error: %s", err),
+					StatusCode: http.StatusInternalServerError,
+				}
+			}
+
+			// Require format explicitly: the real endpoint defaults to SOURCE, which
+			// would import every upload as a notebook, so a caller that drops the
+			// field is a bug rather than a request for the fake's usual behavior.
+			if form.Format == "" {
+				return Response{
+					Body:       "internal error: The test server requires an explicit format for multipart imports.",
+					StatusCode: http.StatusInternalServerError,
+				}
+			}
+			return workspaceImport(req.Workspace, form)
+		}
+
 		var request workspace.Import
 		err := json.Unmarshal(req.Body, &request)
 		if err != nil {
@@ -125,13 +326,6 @@ func AddDefaultHandlers(server *Server) {
 			}
 		}
 
-		if request.Format != workspace.ImportFormatAuto {
-			return Response{
-				Body:       "internal error: The test server only supports auto format.",
-				StatusCode: http.StatusInternalServerError,
-			}
-		}
-
 		// The /workspace/import endpoint expects the content as base64 encoded string.
 		// We need to decode it to get the actual content.
 		decoded, err := base64.StdEncoding.DecodeString(request.Content)
@@ -142,7 +336,19 @@ func AddDefaultHandlers(server *Server) {
 			}
 		}
 
-		return req.Workspace.WorkspaceFilesImportFile(request.Path, decoded, request.Overwrite)
+		// The CLI leaves the format empty for `databricks workspace import --language X`
+		// and treats empty as SOURCE (see cmd/workspace/workspace/overrides.go).
+		format := string(request.Format)
+		if format == "" {
+			format = string(workspace.ImportFormatSource)
+		}
+		return workspaceImport(req.Workspace, ImportForm{
+			Path:      request.Path,
+			Content:   decoded,
+			Format:    format,
+			Language:  string(request.Language),
+			Overwrite: request.Overwrite,
+		})
 	})
 
 	server.Handle("GET", "/api/2.0/workspace-files/{path...}", func(req Request) any {
@@ -165,6 +371,10 @@ func AddDefaultHandlers(server *Server) {
 		return Response{StatusCode: 404}
 	})
 
+	server.Handle("GET", "/api/2.0/fs/directories/{path...}", func(req Request) any {
+		return req.Workspace.FsListDirectory(req.Vars["path"])
+	})
+
 	server.Handle("HEAD", "/api/2.0/fs/files/{path...}", func(req Request) any {
 		path := req.Vars["path"]
 		if req.Workspace.FileExists(path) {
@@ -181,13 +391,22 @@ func AddDefaultHandlers(server *Server) {
 
 		defer req.Workspace.LockUnlock()()
 
+		// The API rejects creating a directory where a file already exists; it is
+		// idempotent only over directories. Mirror that so callers observe the 409.
+		if _, isFile := req.Workspace.files[dirPath]; isFile {
+			return Response{
+				StatusCode: 409,
+				Body:       map[string]string{"message": "The given path points to an existing file. This API does not support operations on files."},
+			}
+		}
+
 		// Create directory and all parent directories.
 		for dir := dirPath; dir != "/" && dir != ""; dir = path.Dir(dir) {
 			if _, exists := req.Workspace.directories[dir]; !exists {
 				req.Workspace.directories[dir] = workspace.ObjectInfo{
 					ObjectType: "DIRECTORY",
 					Path:       dir,
-					ObjectId:   nextID(),
+					ObjectId:   nextTreenodeID(),
 				}
 			}
 		}
@@ -200,6 +419,10 @@ func AddDefaultHandlers(server *Server) {
 		return req.Workspace.WorkspaceFilesImportFile(path, req.Body, overwrite)
 	})
 
+	server.Handle("DELETE", "/api/2.0/fs/files/{path...}", func(req Request) any {
+		return req.Workspace.FsDeleteFile(req.Vars["path"])
+	})
+
 	server.Handle("GET", "/api/2.0/fs/files/{path...}", func(req Request) any {
 		path := req.Vars["path"]
 		data := req.Workspace.WorkspaceFilesExportFile(path)
@@ -218,10 +441,49 @@ func AddDefaultHandlers(server *Server) {
 		return TestMetastore
 	})
 
+	server.Handle("GET", "/api/2.1/unity-catalog/metastore_summary", func(req Request) any {
+		return catalog.GetMetastoreSummaryResponse{
+			MetastoreId: TestMetastore.MetastoreId,
+			Region:      "us-west-2",
+		}
+	})
+
 	server.Handle("POST", "/api/2.2/jobs/create", func(req Request) any {
 		return req.Workspace.JobsCreate(req)
 	})
 
+	// Deployment Metadata Service (DMS) endpoints.
+	server.Handle("POST", "/api/2.0/bundle/deployments", func(req Request) any {
+		return req.Workspace.CreateDeployment(req)
+	})
+	server.Handle("GET", "/api/2.0/bundle/deployments/{deployment_id}", func(req Request) any {
+		return req.Workspace.GetDeployment(req.Vars["deployment_id"])
+	})
+	server.Handle("PATCH", "/api/2.0/bundle/deployments/{deployment_id}", func(req Request) any {
+		return req.Workspace.UpdateDeployment(req, req.Vars["deployment_id"])
+	})
+	server.Handle("DELETE", "/api/2.0/bundle/deployments/{deployment_id}", func(req Request) any {
+		return req.Workspace.DeleteDeployment(req.Vars["deployment_id"])
+	})
+	server.Handle("POST", "/api/2.0/bundle/deployments/{deployment_id}/versions", func(req Request) any {
+		return req.Workspace.CreateVersion(req, req.Vars["deployment_id"])
+	})
+	server.Handle("POST", "/api/2.0/bundle/deployments/{deployment_id}/versions/{version_id}/complete", func(req Request) any {
+		return req.Workspace.CompleteVersion(req, req.Vars["deployment_id"], req.Vars["version_id"])
+	})
+	server.Handle("POST", "/api/2.0/bundle/deployments/{deployment_id}/versions/{version_id}/heartbeat", func(req Request) any {
+		return req.Workspace.Heartbeat()
+	})
+	server.Handle("PATCH", "/api/2.0/bundle/deployments/{deployment_id}/versions/{version_id}/operations/{resource_key}", func(req Request) any {
+		return req.Workspace.UpdateOperation(req, req.Vars["deployment_id"], req.Vars["version_id"], req.Vars["resource_key"])
+	})
+	server.Handle("GET", "/api/2.0/bundle/deployments/{deployment_id}/resources", func(req Request) any {
+		return req.Workspace.ListResources(req.Vars["deployment_id"])
+	})
+	server.Handle("GET", "/api/2.0/bundle/deployments/{deployment_id}/versions/{version_id}/operations", func(req Request) any {
+		return req.Workspace.ListOperations(req.Vars["deployment_id"], req.Vars["version_id"])
+	})
+
 	server.Handle("POST", "/api/2.2/jobs/delete", func(req Request) any {
 		var request jobs.DeleteJob
 		if err := json.Unmarshal(req.Body, &request); err != nil {
@@ -230,7 +492,7 @@ func AddDefaultHandlers(server *Server) {
 				Body:       fmt.Sprintf("request parsing error: %s", err),
 			}
 		}
-		return MapDelete(req.Workspace, req.Workspace.Jobs, request.JobId)
+		return req.Workspace.JobsDelete(req, request.JobId)
 	})
 
 	server.Handle("POST", "/api/2.2/jobs/reset", func(req Request) any {
@@ -253,10 +515,22 @@ func AddDefaultHandlers(server *Server) {
 		return req.Workspace.JobsRunNow(req)
 	})
 
+	server.Handle("POST", "/api/2.2/jobs/runs/submit", func(req Request) any {
+		return req.Workspace.JobsSubmit(req)
+	})
+
 	server.Handle("GET", "/api/2.2/jobs/runs/get", func(req Request) any {
 		return req.Workspace.JobsGetRun(req)
 	})
 
+	server.Handle("POST", "/api/2.2/jobs/runs/cancel", func(req Request) any {
+		return req.Workspace.JobsCancelRun(req)
+	})
+
+	server.Handle("POST", "/api/2.2/jobs/runs/delete", func(req Request) any {
+		return req.Workspace.JobsDeleteRun(req)
+	})
+
 	server.Handle("GET", "/api/2.2/jobs/runs/get-output", func(req Request) any {
 		return req.Workspace.JobsGetRunOutput(req)
 	})
@@ -286,7 +560,7 @@ func AddDefaultHandlers(server *Server) {
 
 	// Dashboards:
 	server.Handle("GET", "/api/2.0/lakeview/dashboards/{dashboard_id}", func(req Request) any {
-		return MapGet(req.Workspace, req.Workspace.Dashboards, req.Vars["dashboard_id"])
+		return req.Workspace.DashboardGet(req)
 	})
 	server.Handle("POST", "/api/2.0/lakeview/dashboards", func(req Request) any {
 		return req.Workspace.DashboardCreate(req)
@@ -309,6 +583,20 @@ func AddDefaultHandlers(server *Server) {
 		return req.Workspace.DashboardUnpublish(req)
 	})
 
+	// Genie Spaces:
+	server.Handle("GET", "/api/2.0/genie/spaces/{space_id}", func(req Request) any {
+		return req.Workspace.GenieSpaceGet(req)
+	})
+	server.Handle("POST", "/api/2.0/genie/spaces", func(req Request) any {
+		return req.Workspace.GenieSpaceCreate(req)
+	})
+	server.Handle("PATCH", "/api/2.0/genie/spaces/{space_id}", func(req Request) any {
+		return req.Workspace.GenieSpaceUpdate(req)
+	})
+	server.Handle("DELETE", "/api/2.0/genie/spaces/{space_id}", func(req Request) any {
+		return req.Workspace.GenieSpaceTrash(req)
+	})
+
 	// Pipelines:
 
 	server.Handle("GET", "/api/2.0/pipelines/{pipeline_id}", func(req Request) any {
@@ -404,7 +692,7 @@ func AddDefaultHandlers(server *Server) {
 	})
 
 	server.Handle("GET", "/api/2.0/apps/{name}", func(req Request) any {
-		return MapGet(req.Workspace, req.Workspace.Apps, req.Vars["name"])
+		return req.Workspace.AppsGet(req.Vars["name"])
 	})
 
 	server.Handle("POST", "/api/2.0/apps", func(req Request) any {
@@ -416,13 +704,13 @@ func AddDefaultHandlers(server *Server) {
 	})
 
 	server.Handle("DELETE", "/api/2.0/apps/{name}", func(req Request) any {
-		return MapDelete(req.Workspace, req.Workspace.Apps, req.Vars["name"])
+		return req.Workspace.AppsDelete(req.Vars["name"])
 	})
 
 	// Schemas:
 
 	server.Handle("GET", "/api/2.1/unity-catalog/schemas/{full_name}", func(req Request) any {
-		return MapGet(req.Workspace, req.Workspace.Schemas, req.Vars["full_name"])
+		return MapGetUC(req.Workspace, req.Workspace.Schemas, req.Vars["full_name"], "Schema")
 	})
 
 	server.Handle("POST", "/api/2.1/unity-catalog/schemas", func(req Request) any {
@@ -483,6 +771,20 @@ func AddDefaultHandlers(server *Server) {
 		return MapDelete(req.Workspace, req.Workspace.ExternalLocations, req.Vars["name"])
 	})
 
+	// Storage Credentials:
+
+	server.Handle("GET", "/api/2.1/unity-catalog/storage-credentials", func(req Request) any {
+		return catalog.ListStorageCredentialsResponse{
+			StorageCredentials: []catalog.StorageCredentialInfo{
+				{
+					Name:        "some-test-credential",
+					Id:          "1234",
+					MetastoreId: "abcd",
+				},
+			},
+		}
+	})
+
 	// Registered Models:
 
 	server.Handle("GET", "/api/2.1/unity-catalog/models/{full_name}", func(req Request) any {
@@ -501,10 +803,76 @@ func AddDefaultHandlers(server *Server) {
 		return MapDelete(req.Workspace, req.Workspace.RegisteredModels, req.Vars["full_name"])
 	})
 
+	// Model Services (AI Gateway):
+
+	server.Handle("POST", "/api/2.1/unity-catalog/model-services", func(req Request) any {
+		return req.Workspace.ModelServicesCreate(req)
+	})
+
+	server.Handle("GET", "/api/2.1/unity-catalog/model-services/{name}", func(req Request) any {
+		return MapGet(req.Workspace, req.Workspace.ModelServices, req.Vars["name"])
+	})
+
+	server.Handle("PATCH", "/api/2.1/unity-catalog/model-services/{name}", func(req Request) any {
+		return req.Workspace.ModelServicesUpdate(req, req.Vars["name"])
+	})
+
+	server.Handle("DELETE", "/api/2.1/unity-catalog/model-services/{name}", func(req Request) any {
+		return MapDelete(req.Workspace, req.Workspace.ModelServices, req.Vars["name"])
+	})
+
+	server.Handle("POST", "/api/2.1/unity-catalog/mcp-services", func(req Request) any {
+		return req.Workspace.McpServicesCreate(req)
+	})
+
+	server.Handle("GET", "/api/2.1/unity-catalog/mcp-services/{name}", func(req Request) any {
+		return MapGet(req.Workspace, req.Workspace.McpServices, req.Vars["name"])
+	})
+
+	server.Handle("PATCH", "/api/2.1/unity-catalog/mcp-services/{name}", func(req Request) any {
+		return req.Workspace.McpServicesUpdate(req, req.Vars["name"])
+	})
+
+	server.Handle("DELETE", "/api/2.1/unity-catalog/mcp-services/{name}", func(req Request) any {
+		return MapDelete(req.Workspace, req.Workspace.McpServices, req.Vars["name"])
+	})
+
+	// Feature Engineering features:
+	server.Handle("POST", "/api/2.0/feature-engineering/features", func(req Request) any {
+		return req.Workspace.FeaturesCreate(req)
+	})
+	server.Handle("GET", "/api/2.0/feature-engineering/features/{full_name}", func(req Request) any {
+		return MapGet(req.Workspace, req.Workspace.Features, req.Vars["full_name"])
+	})
+	server.Handle("PATCH", "/api/2.0/feature-engineering/features/{full_name}", func(req Request) any {
+		return req.Workspace.FeaturesUpdate(req, req.Vars["full_name"])
+	})
+	server.Handle("DELETE", "/api/2.0/feature-engineering/features/{full_name}", func(req Request) any {
+		return MapDelete(req.Workspace, req.Workspace.Features, req.Vars["full_name"])
+	})
+
+	// Model Provider Services (AI Gateway):
+
+	server.Handle("POST", "/api/2.1/unity-catalog/model-provider-services", func(req Request) any {
+		return req.Workspace.ModelProviderServicesCreate(req)
+	})
+
+	server.Handle("GET", "/api/2.1/unity-catalog/model-provider-services/{name}", func(req Request) any {
+		return MapGet(req.Workspace, req.Workspace.ModelProviderServices, req.Vars["name"])
+	})
+
+	server.Handle("PATCH", "/api/2.1/unity-catalog/model-provider-services/{name}", func(req Request) any {
+		return req.Workspace.ModelProviderServicesUpdate(req, req.Vars["name"])
+	})
+
+	server.Handle("DELETE", "/api/2.1/unity-catalog/model-provider-services/{name}", func(req Request) any {
+		return MapDelete(req.Workspace, req.Workspace.ModelProviderServices, req.Vars["name"])
+	})
+
 	// Volumes:
 
 	server.Handle("GET", "/api/2.1/unity-catalog/volumes/{full_name}", func(req Request) any {
-		return MapGet(req.Workspace, req.Workspace.Volumes, req.Vars["full_name"])
+		return MapGetUC(req.Workspace, req.Workspace.Volumes, req.Vars["full_name"], "Volume")
 	})
 
 	server.Handle("POST", "/api/2.1/unity-catalog/volumes", func(req Request) any {
@@ -537,6 +905,52 @@ func AddDefaultHandlers(server *Server) {
 		return req.Workspace.ReposDelete(req)
 	})
 
+	server.Handle("GET", "/api/2.0/repos/snapshots/rootpath", func(req Request) any {
+		return map[string]any{
+			"path": "/Workspace/Users/" + TestUserSP.UserName + "/.snapshots/",
+		}
+	})
+
+	server.Handle("POST", "/api/2.0/repos/snapshots", func(req Request) any {
+		contentType := req.Headers.Get("Content-Type")
+		mediaType, params, err := mime.ParseMediaType(contentType)
+		if err != nil || !strings.HasPrefix(mediaType, "multipart/") {
+			return Response{StatusCode: http.StatusBadRequest}
+		}
+
+		mr := multipart.NewReader(bytes.NewReader(req.Body), params["boundary"])
+		var bundleID, snapshotID string
+		for {
+			p, err := mr.NextPart()
+			if errors.Is(err, io.EOF) {
+				break
+			}
+			if err != nil {
+				return Response{StatusCode: http.StatusInternalServerError}
+			}
+			data, err := io.ReadAll(p)
+			if err != nil {
+				return Response{StatusCode: http.StatusInternalServerError}
+			}
+			switch p.FormName() {
+			case "bundle_id":
+				bundleID = string(data)
+			case "snapshot_id":
+				snapshotID = string(data)
+			}
+		}
+
+		// The real API uses the workspace user UUID (not email) in the snapshot path,
+		// matching service-principal identities used in cloud acceptance tests.
+		snapshotPath := fmt.Sprintf("/Workspace/Users/%s/.snapshots/%s/%s", TestUserSP.UserName, bundleID, snapshotID)
+		req.Workspace.WorkspaceMkdirs(workspace.Mkdirs{Path: snapshotPath})
+		return map[string]any{
+			"snapshot": map[string]any{
+				"path": snapshotPath,
+			},
+		}
+	})
+
 	// SQL Warehouses:
 
 	server.Handle("GET", "/api/2.0/sql/warehouses/{warehouse_id}", func(req Request) any {
@@ -555,10 +969,29 @@ func AddDefaultHandlers(server *Server) {
 		return req.Workspace.SqlWarehousesUpsert(req, req.Vars["warehouse_id"])
 	})
 
+	server.Handle("POST", "/api/2.0/sql/warehouses/{warehouse_id}/start", func(req Request) any {
+		return req.Workspace.SqlWarehousesStart(req, req.Vars["warehouse_id"])
+	})
+
+	server.Handle("POST", "/api/2.0/sql/warehouses/{warehouse_id}/stop", func(req Request) any {
+		return req.Workspace.SqlWarehousesStop(req, req.Vars["warehouse_id"])
+	})
+
 	server.Handle("DELETE", "/api/2.0/sql/warehouses/{warehouse_id}", func(req Request) any {
 		return MapDelete(req.Workspace, req.Workspace.SqlWarehouses, req.Vars["warehouse_id"])
 	})
 
+	// SQL Statement Execution lifecycle. Tests program these by registering
+	// matchers via Server.HandleSQL / HandleSQLPattern (see statements.go).
+	// They live here, not in New, so they act as overridable defaults: a test
+	// that needs raw control over a SQL endpoint (malformed body, transport
+	// error, custom status) can register its own handler for the same pattern
+	// before calling AddDefaultHandlers, or stub it via test.toml in acceptance.
+	server.Handle("POST", "/api/2.0/sql/statements", server.sqlExecuteStatement)
+	server.Handle("GET", "/api/2.0/sql/statements/{statement_id}", server.sqlGetStatement)
+	server.Handle("GET", "/api/2.0/sql/statements/{statement_id}/result/chunks/{chunk_index}", server.sqlGetStatementResultChunk)
+	server.Handle("POST", "/api/2.0/sql/statements/{statement_id}/cancel", server.sqlCancelStatement)
+
 	server.Handle("GET", "/api/2.0/preview/sql/data_sources", func(req Request) any {
 		return req.Workspace.SqlDataSourcesList(req)
 	})
@@ -621,6 +1054,44 @@ func AddDefaultHandlers(server *Server) {
 		return req.Workspace.SecretsGet(req)
 	})
 
+	server.Handle("GET", "/api/2.0/secrets/list", func(req Request) any {
+		return req.Workspace.SecretsList(req)
+	})
+
+	// SSH tunnel server behind the driver proxy: /metadata returns the remote login
+	// user, /logs is a best-effort error tail, /ssh hijacks the connection for a
+	// websocket (so it's raw, not a JSON response).
+	server.Handle("GET", "/driver-proxy-api/o/{workspace_id}/{cluster_id}/{port}/metadata", func(req Request) any {
+		defer req.Workspace.LockUnlock()()
+		if req.Vars["cluster_id"] == sshTunnelClusterID && req.Workspace.portForwardingToServerlessDisabled() {
+			return Response{StatusCode: 403, Body: sshTunnelFeatureDisabledBody}
+		}
+		return Response{Body: sshTunnelRemoteUser()}
+	})
+
+	server.Handle("GET", "/driver-proxy-api/o/{workspace_id}/{cluster_id}/{port}/logs", func(req Request) any {
+		return Response{Body: ""}
+	})
+
+	// /capabilities reports which optional parts of the tunnel protocol the server speaks.
+	// This fake drives sshd directly over the websocket rather than running the CLI's own
+	// proxy server, so it has none of the session bookkeeping a resume needs and says so.
+	// The resume protocol itself is covered by the proxy package's tests, which run the
+	// real server implementation.
+	server.Handle("GET", "/driver-proxy-api/o/{workspace_id}/{cluster_id}/{port}/capabilities", func(req Request) any {
+		return Response{Body: map[string]bool{"resume": false}}
+	})
+
+	server.HandleRaw("GET", "/driver-proxy-api/o/{workspace_id}/{cluster_id}/{port}/ssh", server.sshTunnelHandler)
+
+	server.Handle("GET", "/api/2.1/settings/{name}", func(req Request) any {
+		return req.Workspace.WorkspaceSettingGet(req)
+	})
+
+	server.Handle("PATCH", "/api/2.1/settings/{name}", func(req Request) any {
+		return req.Workspace.WorkspaceSettingPatch(req)
+	})
+
 	// Secrets ACLs:
 	server.Handle("GET", "/api/2.0/secrets/acls/get", func(req Request) any {
 		return req.Workspace.SecretsAclsGet(req)
@@ -638,6 +1109,30 @@ func AddDefaultHandlers(server *Server) {
 		return req.Workspace.SecretsAclsDelete(req)
 	})
 
+	// Unity Catalog base endpoint (used for UC availability check):
+	server.Handle("GET", "/api/2.1/unity-catalog", func(req Request) any {
+		return map[string]any{
+			"metastore_id": "test-metastore-id",
+		}
+	})
+
+	// Unity Catalog Secrets:
+	server.Handle("POST", "/api/2.1/unity-catalog/secrets", func(req Request) any {
+		return req.Workspace.SecretsUcCreateSecret(req)
+	})
+
+	server.Handle("GET", "/api/2.1/unity-catalog/secrets/{full_name}", func(req Request) any {
+		return req.Workspace.SecretsUcGetSecret(req)
+	})
+
+	server.Handle("PATCH", "/api/2.1/unity-catalog/secrets/{full_name}", func(req Request) any {
+		return req.Workspace.SecretsUcUpdateSecret(req)
+	})
+
+	server.Handle("DELETE", "/api/2.1/unity-catalog/secrets/{full_name}", func(req Request) any {
+		return req.Workspace.SecretsUcDeleteSecret(req)
+	})
+
 	// Groups:
 	server.Handle("POST", "/api/2.0/preview/scim/v2/Groups", func(req Request) any {
 		return req.Workspace.GroupsCreate(req)
@@ -719,6 +1214,10 @@ func AddDefaultHandlers(server *Server) {
 		return req.Workspace.ClustersCreate(req)
 	})
 
+	server.Handle("POST", "/api/2.1/clusters/delete", func(req Request) any {
+		return req.Workspace.ClustersDelete(req)
+	})
+
 	server.Handle("POST", "/api/2.1/clusters/start", func(req Request) any {
 		return req.Workspace.ClustersStart(req)
 	})
@@ -727,6 +1226,19 @@ func AddDefaultHandlers(server *Server) {
 		return req.Workspace.ClustersPermanentDelete(req)
 	})
 
+	// Cluster libraries:
+	server.Handle("POST", "/api/2.0/libraries/install", func(req Request) any {
+		return req.Workspace.LibrariesInstall(req)
+	})
+
+	server.Handle("POST", "/api/2.0/libraries/uninstall", func(req Request) any {
+		return req.Workspace.LibrariesUninstall(req)
+	})
+
+	server.Handle("GET", "/api/2.0/libraries/cluster-status", func(req Request) any {
+		return req.Workspace.LibrariesClusterStatus(req, req.URL.Query().Get("cluster_id"))
+	})
+
 	// MLflow Experiments:
 	server.Handle("GET", "/api/2.0/mlflow/experiments/get", func(req Request) any {
 		experimentId := req.URL.Query().Get("experiment_id")
@@ -771,7 +1283,7 @@ func AddDefaultHandlers(server *Server) {
 
 	// Serving Endpoints:
 	server.Handle("GET", "/api/2.0/serving-endpoints/{name}", func(req Request) any {
-		return MapGet(req.Workspace, req.Workspace.ServingEndpoints, req.Vars["name"])
+		return req.Workspace.ServingEndpointGet(req.Vars["name"])
 	})
 
 	server.Handle("POST", "/api/2.0/serving-endpoints", func(req Request) any {
@@ -798,6 +1310,10 @@ func AddDefaultHandlers(server *Server) {
 		return req.Workspace.ServingEndpointPatchTags(req, req.Vars["name"])
 	})
 
+	server.Handle("PATCH", "/api/2.0/serving-endpoints/{name}/telemetry-config", func(req Request) any {
+		return req.Workspace.ServingEndpointPatchTelemetryConfig(req, req.Vars["name"])
+	})
+
 	// Vector Search Endpoints:
 
 	server.Handle("POST", "/api/2.0/vector-search/endpoints", func(req Request) any {
@@ -824,6 +1340,24 @@ func AddDefaultHandlers(server *Server) {
 		return req.Workspace.VectorSearchEndpointUpdateBudgetPolicy(req, req.Vars["endpoint_name"])
 	})
 
+	// Vector Search Indexes:
+
+	server.Handle("POST", "/api/2.0/vector-search/indexes", func(req Request) any {
+		return req.Workspace.VectorSearchIndexCreate(req)
+	})
+
+	server.Handle("GET", "/api/2.0/vector-search/indexes", func(req Request) any {
+		return MapList(req.Workspace, req.Workspace.VectorSearchIndexes, "vector_indexes")
+	})
+
+	server.Handle("GET", "/api/2.0/vector-search/indexes/{index_name}", func(req Request) any {
+		return MapGet(req.Workspace, req.Workspace.VectorSearchIndexes, req.Vars["index_name"])
+	})
+
+	server.Handle("DELETE", "/api/2.0/vector-search/indexes/{index_name}", func(req Request) any {
+		return req.Workspace.VectorSearchIndexDelete(req.Vars["index_name"])
+	})
+
 	// Generic permissions endpoints
 	server.Handle("GET", "/api/2.0/permissions/{object_type}/{object_id}", func(req Request) any {
 		return req.Workspace.GetPermissions(req)
@@ -857,6 +1391,21 @@ func AddDefaultHandlers(server *Server) {
 		return req.Workspace.PostgresOperationGet(name)
 	})
 
+	server.Handle("GET", "/api/2.0/postgres/projects/{project_id}/branches/{branch_id}/databases/{database_id}/operations/{operation_id}", func(req Request) any {
+		name := "projects/" + req.Vars["project_id"] + "/branches/" + req.Vars["branch_id"] + "/databases/" + req.Vars["database_id"] + "/operations/" + req.Vars["operation_id"]
+		return req.Workspace.PostgresOperationGet(name)
+	})
+
+	server.Handle("GET", "/api/2.0/postgres/projects/{project_id}/branches/{branch_id}/roles/{role_id}/operations/{operation_id}", func(req Request) any {
+		name := "projects/" + req.Vars["project_id"] + "/branches/" + req.Vars["branch_id"] + "/roles/" + req.Vars["role_id"] + "/operations/" + req.Vars["operation_id"]
+		return req.Workspace.PostgresOperationGet(name)
+	})
+
+	server.Handle("GET", "/api/2.0/postgres/projects/{project_id}/branches/{branch_id}/snapshot-schedule/operations/{operation_id}", func(req Request) any {
+		name := "projects/" + req.Vars["project_id"] + "/branches/" + req.Vars["branch_id"] + "/snapshot-schedule/operations/" + req.Vars["operation_id"]
+		return req.Workspace.PostgresOperationGet(name)
+	})
+
 	// Postgres Projects:
 	server.Handle("POST", "/api/2.0/postgres/projects", func(req Request) any {
 		projectID := req.URL.Query().Get("project_id")
@@ -886,7 +1435,8 @@ func AddDefaultHandlers(server *Server) {
 	server.Handle("POST", "/api/2.0/postgres/projects/{project_id}/branches", func(req Request) any {
 		parent := "projects/" + req.Vars["project_id"]
 		branchID := req.URL.Query().Get("branch_id")
-		return req.Workspace.PostgresBranchCreate(req, parent, branchID)
+		replaceExisting := req.URL.Query().Get("replace_existing") == "true"
+		return req.Workspace.PostgresBranchCreate(req, parent, branchID, replaceExisting)
 	})
 
 	server.Handle("GET", "/api/2.0/postgres/projects/{project_id}/branches", func(req Request) any {
@@ -909,11 +1459,23 @@ func AddDefaultHandlers(server *Server) {
 		return req.Workspace.PostgresBranchDelete(name)
 	})
 
+	// Postgres Snapshot Schedules (a per-branch singleton; no create/delete):
+	server.Handle("GET", "/api/2.0/postgres/projects/{project_id}/branches/{branch_id}/snapshot-schedule", func(req Request) any {
+		name := "projects/" + req.Vars["project_id"] + "/branches/" + req.Vars["branch_id"] + "/snapshot-schedule"
+		return req.Workspace.PostgresSnapshotScheduleGet(name)
+	})
+
+	server.Handle("PATCH", "/api/2.0/postgres/projects/{project_id}/branches/{branch_id}/snapshot-schedule", func(req Request) any {
+		name := "projects/" + req.Vars["project_id"] + "/branches/" + req.Vars["branch_id"] + "/snapshot-schedule"
+		return req.Workspace.PostgresSnapshotScheduleUpdate(req, name)
+	})
+
 	// Postgres Endpoints:
 	server.Handle("POST", "/api/2.0/postgres/projects/{project_id}/branches/{branch_id}/endpoints", func(req Request) any {
 		parent := "projects/" + req.Vars["project_id"] + "/branches/" + req.Vars["branch_id"]
 		endpointID := req.URL.Query().Get("endpoint_id")
-		return req.Workspace.PostgresEndpointCreate(req, parent, endpointID)
+		replaceExisting := req.URL.Query().Get("replace_existing") == "true"
+		return req.Workspace.PostgresEndpointCreate(req, parent, endpointID, replaceExisting)
 	})
 
 	server.Handle("GET", "/api/2.0/postgres/projects/{project_id}/branches/{branch_id}/endpoints", func(req Request) any {
@@ -936,6 +1498,134 @@ func AddDefaultHandlers(server *Server) {
 		return req.Workspace.PostgresEndpointDelete(name)
 	})
 
+	// Postgres Catalogs:
+	server.Handle("POST", "/api/2.0/postgres/catalogs", func(req Request) any {
+		catalogID := req.URL.Query().Get("catalog_id")
+		return req.Workspace.PostgresCatalogCreate(req, catalogID)
+	})
+
+	server.Handle("GET", "/api/2.0/postgres/catalogs/{id}", func(req Request) any {
+		return req.Workspace.PostgresCatalogGet("catalogs/" + req.Vars["id"])
+	})
+
+	server.Handle("DELETE", "/api/2.0/postgres/catalogs/{id}", func(req Request) any {
+		return req.Workspace.PostgresCatalogDelete("catalogs/" + req.Vars["id"])
+	})
+
+	// Operations for catalogs are nested under the resource. Matches the real
+	// API and what the SDK polls based on the operation.Name we return.
+	server.Handle("GET", "/api/2.0/postgres/catalogs/{id}/operations/{operation_id}", func(req Request) any {
+		name := "catalogs/" + req.Vars["id"] + "/operations/" + req.Vars["operation_id"]
+		return req.Workspace.PostgresOperationGet(name)
+	})
+
+	// Postgres Databases:
+	server.Handle("POST", "/api/2.0/postgres/projects/{project_id}/branches/{branch_id}/databases", func(req Request) any {
+		parent := "projects/" + req.Vars["project_id"] + "/branches/" + req.Vars["branch_id"]
+		databaseID := req.URL.Query().Get("database_id")
+		replaceExisting := req.URL.Query().Get("replace_existing") == "true"
+		return req.Workspace.PostgresDatabaseCreate(req, parent, databaseID, replaceExisting)
+	})
+
+	server.Handle("GET", "/api/2.0/postgres/projects/{project_id}/branches/{branch_id}/databases", func(req Request) any {
+		parent := "projects/" + req.Vars["project_id"] + "/branches/" + req.Vars["branch_id"]
+		return req.Workspace.PostgresDatabaseList(parent)
+	})
+
+	server.Handle("GET", "/api/2.0/postgres/projects/{project_id}/branches/{branch_id}/databases/{database_id}", func(req Request) any {
+		name := "projects/" + req.Vars["project_id"] + "/branches/" + req.Vars["branch_id"] + "/databases/" + req.Vars["database_id"]
+		return req.Workspace.PostgresDatabaseGet(name)
+	})
+
+	server.Handle("PATCH", "/api/2.0/postgres/projects/{project_id}/branches/{branch_id}/databases/{database_id}", func(req Request) any {
+		name := "projects/" + req.Vars["project_id"] + "/branches/" + req.Vars["branch_id"] + "/databases/" + req.Vars["database_id"]
+		return req.Workspace.PostgresDatabaseUpdate(req, name)
+	})
+
+	server.Handle("DELETE", "/api/2.0/postgres/projects/{project_id}/branches/{branch_id}/databases/{database_id}", func(req Request) any {
+		name := "projects/" + req.Vars["project_id"] + "/branches/" + req.Vars["branch_id"] + "/databases/" + req.Vars["database_id"]
+		return req.Workspace.PostgresDatabaseDelete(name)
+	})
+
+	// Postgres Roles:
+	server.Handle("POST", "/api/2.0/postgres/projects/{project_id}/branches/{branch_id}/roles", func(req Request) any {
+		parent := "projects/" + req.Vars["project_id"] + "/branches/" + req.Vars["branch_id"]
+		roleID := req.URL.Query().Get("role_id")
+		replaceExisting := req.URL.Query().Get("replace_existing") == "true"
+		return req.Workspace.PostgresRoleCreate(req, parent, roleID, replaceExisting)
+	})
+
+	server.Handle("GET", "/api/2.0/postgres/projects/{project_id}/branches/{branch_id}/roles", func(req Request) any {
+		parent := "projects/" + req.Vars["project_id"] + "/branches/" + req.Vars["branch_id"]
+		return req.Workspace.PostgresRoleList(parent)
+	})
+
+	server.Handle("GET", "/api/2.0/postgres/projects/{project_id}/branches/{branch_id}/roles/{role_id}", func(req Request) any {
+		name := "projects/" + req.Vars["project_id"] + "/branches/" + req.Vars["branch_id"] + "/roles/" + req.Vars["role_id"]
+		return req.Workspace.PostgresRoleGet(name)
+	})
+
+	server.Handle("PATCH", "/api/2.0/postgres/projects/{project_id}/branches/{branch_id}/roles/{role_id}", func(req Request) any {
+		name := "projects/" + req.Vars["project_id"] + "/branches/" + req.Vars["branch_id"] + "/roles/" + req.Vars["role_id"]
+		return req.Workspace.PostgresRoleUpdate(req, name)
+	})
+
+	server.Handle("DELETE", "/api/2.0/postgres/projects/{project_id}/branches/{branch_id}/roles/{role_id}", func(req Request) any {
+		name := "projects/" + req.Vars["project_id"] + "/branches/" + req.Vars["branch_id"] + "/roles/" + req.Vars["role_id"]
+		return req.Workspace.PostgresRoleDelete(name)
+	})
+
+	// Postgres Synced Tables:
+	server.Handle("POST", "/api/2.0/postgres/synced_tables", func(req Request) any {
+		syncedTableID := req.URL.Query().Get("synced_table_id")
+		return req.Workspace.PostgresSyncedTableCreate(req, syncedTableID)
+	})
+
+	server.Handle("GET", "/api/2.0/postgres/synced_tables/{id}", func(req Request) any {
+		return req.Workspace.PostgresSyncedTableGet("synced_tables/" + req.Vars["id"])
+	})
+
+	server.Handle("DELETE", "/api/2.0/postgres/synced_tables/{id}", func(req Request) any {
+		return req.Workspace.PostgresSyncedTableDelete("synced_tables/" + req.Vars["id"])
+	})
+
+	server.Handle("GET", "/api/2.0/postgres/synced_tables/{id}/operations/{operation_id}", func(req Request) any {
+		name := "synced_tables/" + req.Vars["id"] + "/operations/" + req.Vars["operation_id"]
+		return req.Workspace.PostgresOperationGet(name)
+	})
+
+	server.Handle("GET", "/api/2.0/postgres/operations/{operation_id}", func(req Request) any {
+		return req.Workspace.PostgresOperationGet("operations/" + req.Vars["operation_id"])
+	})
+
+	// Postgres Roles:
+	server.Handle("POST", "/api/2.0/postgres/projects/{project_id}/branches/{branch_id}/roles", func(req Request) any {
+		parent := "projects/" + req.Vars["project_id"] + "/branches/" + req.Vars["branch_id"]
+		roleID := req.URL.Query().Get("role_id")
+		replaceExisting := req.URL.Query().Get("replace_existing") == "true"
+		return req.Workspace.PostgresRoleCreate(req, parent, roleID, replaceExisting)
+	})
+
+	server.Handle("GET", "/api/2.0/postgres/projects/{project_id}/branches/{branch_id}/roles", func(req Request) any {
+		parent := "projects/" + req.Vars["project_id"] + "/branches/" + req.Vars["branch_id"]
+		return req.Workspace.PostgresRoleList(parent)
+	})
+
+	server.Handle("GET", "/api/2.0/postgres/projects/{project_id}/branches/{branch_id}/roles/{role_id}", func(req Request) any {
+		name := "projects/" + req.Vars["project_id"] + "/branches/" + req.Vars["branch_id"] + "/roles/" + req.Vars["role_id"]
+		return req.Workspace.PostgresRoleGet(name)
+	})
+
+	server.Handle("PATCH", "/api/2.0/postgres/projects/{project_id}/branches/{branch_id}/roles/{role_id}", func(req Request) any {
+		name := "projects/" + req.Vars["project_id"] + "/branches/" + req.Vars["branch_id"] + "/roles/" + req.Vars["role_id"]
+		return req.Workspace.PostgresRoleUpdate(req, name)
+	})
+
+	server.Handle("DELETE", "/api/2.0/postgres/projects/{project_id}/branches/{branch_id}/roles/{role_id}", func(req Request) any {
+		name := "projects/" + req.Vars["project_id"] + "/branches/" + req.Vars["branch_id"] + "/roles/" + req.Vars["role_id"]
+		return req.Workspace.PostgresRoleDelete(name)
+	})
+
 	// Catch-all handler for invalid postgres resource names.
 	// This handles cases like GET /api/2.0/postgres/1234 where "1234" is not a valid resource name.
 	server.Handle("GET", "/api/2.0/postgres/{name}", func(req Request) any {
diff --git a/libs/testserver/instance_pools.go b/libs/testserver/instance_pools.go
new file mode 100644
index 00000000000..f6279fbfc3f
--- /dev/null
+++ b/libs/testserver/instance_pools.go
@@ -0,0 +1,81 @@
+package testserver
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"github.com/databricks/databricks-sdk-go/service/compute"
+)
+
+func (s *FakeWorkspace) InstancePoolsCreate(req Request) any {
+	// Unmarshal into the stored (GET) type directly: CreateInstancePool and
+	// GetInstancePool share JSON field names, so every config field is carried over.
+	var pool compute.GetInstancePool
+	if err := json.Unmarshal(req.Body, &pool); err != nil {
+		return Response{StatusCode: 400, Body: fmt.Sprintf("request parsing error: %s", err)}
+	}
+
+	defer s.LockUnlock()()
+
+	id := nextUUID()
+	pool.InstancePoolId = id
+	s.InstancePools[id] = pool
+
+	return Response{Body: compute.CreateInstancePoolResponse{InstancePoolId: id}}
+}
+
+func (s *FakeWorkspace) InstancePoolsGet(req Request, instancePoolId string) any {
+	defer s.LockUnlock()()
+
+	pool, ok := s.InstancePools[instancePoolId]
+	if !ok {
+		return Response{StatusCode: 404}
+	}
+
+	return Response{Body: pool}
+}
+
+func (s *FakeWorkspace) InstancePoolsEdit(req Request) any {
+	var request compute.EditInstancePool
+	if err := json.Unmarshal(req.Body, &request); err != nil {
+		return Response{StatusCode: 400, Body: fmt.Sprintf("request parsing error: %s", err)}
+	}
+
+	defer s.LockUnlock()()
+
+	pool, ok := s.InstancePools[request.InstancePoolId]
+	if !ok {
+		return Response{StatusCode: 404}
+	}
+
+	// Edit only accepts a subset of fields; overwrite those and keep the rest
+	// (immutable fields like aws_attributes, disk_spec) as stored.
+	pool.InstancePoolName = request.InstancePoolName
+	pool.NodeTypeId = request.NodeTypeId
+	pool.MinIdleInstances = request.MinIdleInstances
+	pool.MaxCapacity = request.MaxCapacity
+	pool.IdleInstanceAutoterminationMinutes = request.IdleInstanceAutoterminationMinutes
+	pool.CustomTags = request.CustomTags
+	pool.RemoteDiskThroughput = request.RemoteDiskThroughput
+	pool.TotalInitialRemoteDiskSize = request.TotalInitialRemoteDiskSize
+	s.InstancePools[request.InstancePoolId] = pool
+
+	return Response{}
+}
+
+func (s *FakeWorkspace) InstancePoolsDelete(req Request) any {
+	var request compute.DeleteInstancePool
+	if err := json.Unmarshal(req.Body, &request); err != nil {
+		return Response{StatusCode: 400, Body: fmt.Sprintf("request parsing error: %s", err)}
+	}
+
+	defer s.LockUnlock()()
+
+	if _, ok := s.InstancePools[request.InstancePoolId]; !ok {
+		return Response{StatusCode: 404}
+	}
+
+	delete(s.InstancePools, request.InstancePoolId)
+
+	return Response{}
+}
diff --git a/libs/testserver/jobs.go b/libs/testserver/jobs.go
index 863a4dd3cc7..772d868cb14 100644
--- a/libs/testserver/jobs.go
+++ b/libs/testserver/jobs.go
@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"net/url"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -13,10 +14,44 @@ import (
 	"strconv"
 	"strings"
 
+	"github.com/databricks/cli/libs/patchwheel"
 	"github.com/databricks/databricks-sdk-go/service/compute"
 	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/databricks/databricks-sdk-go/service/workspace"
 )
 
+const missingJobGitProviderMessage = "git_source.git_provider must be one of: github,gitlab,bitbucketcloud,gitlabenterpriseedition,bitbucketserver,azuredevopsservices,githubenterprise,awscodecommit"
+
+// errNoCodeInWorkspace marks a task there is nothing to execute for, e.g. code
+// uploaded as a snapshot zip this server never unpacks. The gap is here, not in
+// the job, so the task succeeds.
+var errNoCodeInWorkspace = errors.New("task code is not in the workspace")
+
+// taskFailureMessage is what a real workspace reports for a task that failed: a
+// generic pointer at the run output, on both the task and the run. Measured on
+// serverless against a spark_python_task that raises. The run-level message wraps
+// it as "Task <key> failed with message: <this>." with a trailing period.
+const taskFailureMessage = "Workload failed, see run output for details"
+
+// taskFailure splits a failed task's output the way jobs/runs/get-output does:
+// error carries the exception, error_trace the traceback.
+type taskFailure struct {
+	message string
+	trace   string
+}
+
+func (e *taskFailure) Error() string {
+	return e.message
+}
+
+// newTaskFailure takes the exception from the last line of the task's output,
+// where a Python traceback ends, or err if the task wrote nothing.
+func newTaskFailure(err error, output string) *taskFailure {
+	trimmed := strings.TrimRight(output, "\r\n")
+	lastLine := strings.TrimSpace(trimmed[strings.LastIndex(trimmed, "\n")+1:])
+	return &taskFailure{message: cmp.Or(lastLine, err.Error()), trace: trimmed}
+}
+
 // venvPython returns the path to the Python executable in a venv.
 // On Unix: venv/bin/python
 // On Windows: venv\Scripts\python.exe
@@ -27,6 +62,68 @@ func venvPython(venvDir string) string {
 	return filepath.Join(venvDir, "bin", "python")
 }
 
+// validateJobGitSource mirrors Jobs API validation for git_source requests.
+func validateJobGitSource(gitSource *jobs.GitSource) *Response {
+	if gitSource == nil || gitSource.GitProvider != "" {
+		return nil
+	}
+
+	response := Response{
+		StatusCode: 400,
+		Body: map[string]string{
+			"error_code": "INVALID_PARAMETER_VALUE",
+			"message":    missingJobGitProviderMessage,
+		},
+	}
+	return &response
+}
+
+// validateSparkPythonTasks mirrors the Jobs API validation of
+// spark_python_task.python_file. The backend only treats a task as git-sourced
+// when source == GIT is set explicitly (it does not infer it from the job's
+// git_source), so a bare repo-relative python_file is rejected unless the
+// task's source is GIT.
+func validateSparkPythonTasks(tasks []jobs.Task) *Response {
+	for _, task := range tasks {
+		if response := validateSparkPythonTask(task.SparkPythonTask); response != nil {
+			return response
+		}
+		if task.ForEachTask != nil {
+			if response := validateSparkPythonTask(task.ForEachTask.Task.SparkPythonTask); response != nil {
+				return response
+			}
+		}
+	}
+	return nil
+}
+
+func validateSparkPythonTask(task *jobs.SparkPythonTask) *Response {
+	if task == nil || task.Source == jobs.SourceGit || !isRelativePythonFile(task.PythonFile) {
+		return nil
+	}
+	return &Response{
+		StatusCode: 400,
+		Body: map[string]string{
+			"error_code": "INVALID_PARAMETER_VALUE",
+			"message":    fmt.Sprintf("Invalid python file reference: %s. Please visit the Databricks user guide for supported python references", task.PythonFile),
+		},
+	}
+}
+
+// isRelativePythonFile reports whether path is a bare relative path, i.e. neither
+// an absolute workspace path (leading "/") nor a scheme-qualified URI (dbfs:/,
+// s3://, file://, ...). Those two shapes are the only ones the backend accepts
+// for a non-git spark_python_task.
+func isRelativePythonFile(path string) bool {
+	if path == "" || strings.HasPrefix(path, "/") {
+		return false
+	}
+	if u, err := url.Parse(path); err == nil && u.Scheme != "" {
+		return false
+	}
+	return true
+}
+
 func (s *FakeWorkspace) JobsCreate(req Request) Response {
 	var request jobs.CreateJob
 	if err := json.Unmarshal(req.Body, &request); err != nil {
@@ -35,6 +132,12 @@ func (s *FakeWorkspace) JobsCreate(req Request) Response {
 			Body:       fmt.Sprintf("request parsing error: %s", err),
 		}
 	}
+	if response := validateJobGitSource(request.GitSource); response != nil {
+		return *response
+	}
+	if response := validateSparkPythonTasks(request.Tasks); response != nil {
+		return *response
+	}
 
 	defer s.LockUnlock()()
 
@@ -48,15 +151,25 @@ func (s *FakeWorkspace) JobsCreate(req Request) Response {
 		}
 	}
 
+	if msg := s.applyJobClusterPolicies(&jobSettings); msg != "" {
+		return Response{
+			StatusCode: 400,
+			Body: map[string]string{
+				"error_code": "INVALID_PARAMETER_VALUE",
+				"message":    msg,
+			},
+		}
+	}
 	jobFixUps(&jobSettings)
 
 	// CreatorUserName field is used by TF to check if the resource exists or not. CreatorUserName should be non-empty for the resource to be considered as "exists"
 	// https://github.com/databricks/terraform-provider-databricks/blob/main/permissions/permission_definitions.go#L108
+	creator := userForToken(req.Token).UserName
 	s.Jobs[jobId] = jobs.Job{
 		JobId:           jobId,
 		Settings:        &jobSettings,
-		CreatorUserName: s.CurrentUser().UserName,
-		RunAsUserName:   s.CurrentUser().UserName,
+		CreatorUserName: creator,
+		RunAsUserName:   creator,
 		CreatedTime:     nowMilli(),
 	}
 	return Response{Body: jobs.CreateResponse{JobId: jobId}}
@@ -70,9 +183,24 @@ func (s *FakeWorkspace) JobsReset(req Request) Response {
 			Body:       fmt.Sprintf("request parsing error: %s", err),
 		}
 	}
+	if response := validateJobGitSource(request.NewSettings.GitSource); response != nil {
+		return *response
+	}
+	if response := validateSparkPythonTasks(request.NewSettings.Tasks); response != nil {
+		return *response
+	}
 
 	defer s.LockUnlock()()
 
+	if msg := s.applyJobClusterPolicies(&request.NewSettings); msg != "" {
+		return Response{
+			StatusCode: 400,
+			Body: map[string]string{
+				"error_code": "INVALID_PARAMETER_VALUE",
+				"message":    msg,
+			},
+		}
+	}
 	jobFixUps(&request.NewSettings)
 
 	jobId := request.JobId
@@ -81,6 +209,14 @@ func (s *FakeWorkspace) JobsReset(req Request) Response {
 		return Response{StatusCode: 403, Body: "{}"}
 	}
 
+	// Known cloud quirk (see the test's Badness note): jobs/reset is a full
+	// replace, but omitting run_as from new_settings does NOT clear it — cloud
+	// keeps the previously configured identity. Mirror that so the local
+	// testserver matches cloud against one golden.
+	if request.NewSettings.RunAs == nil {
+		request.NewSettings.RunAs = prevjob.Settings.RunAs
+	}
+
 	s.Jobs[jobId] = jobs.Job{
 		JobId:           jobId,
 		CreatorUserName: prevjob.CreatorUserName,
@@ -102,6 +238,12 @@ func jobFixUps(jobSettings *jobs.JobSettings) {
 
 	jobSettings.ForceSendFields = append(jobSettings.ForceSendFields, "TimeoutSeconds")
 
+	// The real Jobs API accepts trigger.table_update.condition on create/update but
+	// does not return it in GET responses; clear it so testserver matches cloud.
+	if jobSettings.Trigger != nil && jobSettings.Trigger.TableUpdate != nil {
+		jobSettings.Trigger.TableUpdate.Condition = ""
+	}
+
 	// Add task-level defaults that match AWS cloud behavior
 	for i := range jobSettings.Tasks {
 		task := &jobSettings.Tasks[i]
@@ -149,8 +291,35 @@ func jobFixUps(jobSettings *jobs.JobSettings) {
 
 			// Set enable_elastic_disk to false (server-side default)
 			task.NewCluster.ForceSendFields = append(task.NewCluster.ForceSendFields, "EnableElasticDisk")
+
+			// The real Jobs API consumes apply_policy_default_values but does not
+			// return it in GET responses; clear it so testserver matches cloud.
+			clearApplyPolicyDefaultValues(task.NewCluster)
+		}
+
+		// Handle for_each_task inner cluster.
+		if task.ForEachTask != nil && task.ForEachTask.Task.NewCluster != nil {
+			// Same as above: not returned in GET responses.
+			clearApplyPolicyDefaultValues(task.ForEachTask.Task.NewCluster)
 		}
 	}
+
+	// Handle job cluster new_clusters.
+	for i := range jobSettings.JobClusters {
+		// Same as above: not returned in GET responses.
+		clearApplyPolicyDefaultValues(jobSettings.JobClusters[i].NewCluster)
+	}
+}
+
+// clearApplyPolicyDefaultValues drops apply_policy_default_values from a job's cluster spec.
+// Zeroing the value alone is not enough: decoding the request populates ForceSendFields from
+// the keys it carried, so a request that set the flag would still serialize it as an explicit
+// false instead of omitting it the way the Jobs API does.
+func clearApplyPolicyDefaultValues(spec *compute.ClusterSpec) {
+	spec.ApplyPolicyDefaultValues = false
+	spec.ForceSendFields = slices.DeleteFunc(spec.ForceSendFields, func(field string) bool {
+		return field == "ApplyPolicyDefaultValues"
+	})
 }
 
 // jobsGetTasksPageSize matches the real Databricks API limit of 100 tasks per jobs.get response.
@@ -169,9 +338,19 @@ func (s *FakeWorkspace) JobsGet(req Request) Response {
 
 	defer s.LockUnlock()()
 
+	// The backend checks permissions before existence, so a guest without access
+	// gets a permission error rather than a 404, even after the job is deleted.
+	if isGuestToken(req.Token) && !s.guestHasJobAccess(jobIdInt, userForToken(req.Token).UserName) {
+		return jobReadPermissionDenied(userForToken(req.Token).UserName, jobIdInt)
+	}
+
 	job, ok := s.Jobs[jobIdInt]
 	if !ok {
-		return Response{StatusCode: 404}
+		// Match the real Jobs API, which echoes the job id in the error message.
+		return Response{
+			StatusCode: 404,
+			Body:       map[string]string{"message": fmt.Sprintf("Job %d does not exist.", jobIdInt)},
+		}
 	}
 
 	job = setSourceIfNotSet(job)
@@ -214,6 +393,45 @@ func (s *FakeWorkspace) JobsGet(req Request) Response {
 	return Response{Body: job}
 }
 
+// JobsDelete deletes a job. A guest without admin/owner access gets a permission
+// error, even after the job is gone (permission check precedes existence check).
+func (s *FakeWorkspace) JobsDelete(req Request, jobId int64) Response {
+	defer s.LockUnlock()()
+
+	if isGuestToken(req.Token) && !s.guestHasJobAccess(jobId, userForToken(req.Token).UserName) {
+		return jobDeletePermissionDenied(userForToken(req.Token).UserName, jobId)
+	}
+
+	if _, ok := s.Jobs[jobId]; !ok {
+		return Response{StatusCode: 404}
+	}
+	delete(s.Jobs, jobId)
+	return Response{}
+}
+
+const permissionDeniedErrorCode = "PERMISSION_DENIED"
+
+func jobPermissionDenied(message string) Response {
+	return Response{
+		StatusCode: 403,
+		Body:       map[string]string{"error_code": permissionDeniedErrorCode, "message": message},
+	}
+}
+
+// jobManagePermissionDenied is returned when reading a job's permissions without
+// Manage access. ElasticJobId mirrors the backend error's identifier shape.
+func jobManagePermissionDenied(principal string, jobId int64) Response {
+	return jobPermissionDenied(fmt.Sprintf("%s does not have Manage permissions on Job with ID: ElasticJobId(%d). Please contact the owner or an administrator for access.", principal, jobId))
+}
+
+func jobReadPermissionDenied(principal string, jobId int64) Response {
+	return jobPermissionDenied(fmt.Sprintf("User %s does not have View or Admin or Manage Run or Owner permissions on job %d", principal, jobId))
+}
+
+func jobDeletePermissionDenied(principal string, jobId int64) Response {
+	return jobPermissionDenied(fmt.Sprintf("User %s does not have Admin or Owner permissions on job %d", principal, jobId))
+}
+
 func (s *FakeWorkspace) JobsList() Response {
 	defer s.LockUnlock()()
 
@@ -234,6 +452,23 @@ func (s *FakeWorkspace) JobsList() Response {
 	return Response{Body: jobs.ListJobsResponse{Jobs: list}}
 }
 
+// installTaskLibrariesOnCluster records a task's libraries on its existing (all-purpose) cluster,
+// mirroring the Jobs service, which installs task libraries via the Libraries API when a run starts.
+// Cluster-status then reports them, matching cloud (where they are cluster-wide, so other jobs and
+// interactive sessions see them too). Callers must hold the workspace lock.
+func (s *FakeWorkspace) installTaskLibrariesOnCluster(task jobs.Task) {
+	if task.ExistingClusterId == "" || len(task.Libraries) == 0 {
+		return
+	}
+	installed := s.ClusterLibraries[task.ExistingClusterId]
+	for _, lib := range task.Libraries {
+		if !containsLibrary(installed, lib) {
+			installed = append(installed, lib)
+		}
+	}
+	s.ClusterLibraries[task.ExistingClusterId] = installed
+}
+
 func (s *FakeWorkspace) JobsRunNow(req Request) Response {
 	var request jobs.RunNow
 	if err := json.Unmarshal(req.Body, &request); err != nil {
@@ -250,6 +485,13 @@ func (s *FakeWorkspace) JobsRunNow(req Request) Response {
 		return Response{StatusCode: 404}
 	}
 
+	// A resent request with the same non-empty token returns the run that token started.
+	if request.IdempotencyToken != "" {
+		if runId, ok := s.JobRunIdempotency[request.IdempotencyToken]; ok {
+			return Response{Body: jobs.RunNowResponse{RunId: runId}}
+		}
+	}
+
 	runId := nextID()
 	runName := "run-name"
 	if job.Settings != nil && job.Settings.Name != "" {
@@ -261,6 +503,10 @@ func (s *FakeWorkspace) JobsRunNow(req Request) Response {
 	var tasks []jobs.RunTask
 	if job.Settings != nil {
 		for _, t := range job.Settings.Tasks {
+			// Mirror the Jobs service installing a task's libraries on its existing
+			// (all-purpose) cluster at run time, so cluster-status reports them like on cloud.
+			s.installTaskLibrariesOnCluster(t)
+
 			taskRunId := nextID()
 			taskRun := jobs.RunTask{
 				RunId:   taskRunId,
@@ -284,14 +530,24 @@ func (s *FakeWorkspace) JobsRunNow(req Request) Response {
 				logs, err = s.executePythonWheelTask(job.Settings, taskToExecute)
 			} else if t.NotebookTask != nil {
 				logs, err = s.executeNotebookTask(t, request.NotebookParams)
+			} else if t.SparkPythonTask != nil {
+				logs, err = s.executeSparkPythonTask(t)
 			}
 
-			if err != nil {
+			switch {
+			case errors.Is(err, errNoCodeInWorkspace):
+				// Nothing ran, so the task keeps its SUCCESS state.
+			case err != nil:
 				taskRun.State.ResultState = jobs.RunResultStateFailed
-				s.JobRunOutputs[taskRunId] = jobs.RunOutput{
-					Error: err.Error(),
+				taskRun.State.StateMessage = taskFailureMessage
+				runOutput := jobs.RunOutput{Error: err.Error()}
+				// A task this server could not even start (e.g. uv failed) has no
+				// traceback to report.
+				if failure, ok := errors.AsType[*taskFailure](err); ok {
+					runOutput.ErrorTrace = failure.trace
 				}
-			} else if logs != "" {
+				s.JobRunOutputs[taskRunId] = runOutput
+			case logs != "":
 				s.JobRunOutputs[taskRunId] = jobs.RunOutput{
 					Logs: logs,
 				}
@@ -299,17 +555,189 @@ func (s *FakeWorkspace) JobsRunNow(req Request) Response {
 		}
 	}
 
+	s.JobRuns[runId] = jobs.Run{
+		RunId:                runId,
+		JobId:                request.JobId,
+		State:                &jobs.RunState{LifeCycleState: jobs.RunLifeCycleStateRunning},
+		RunPageUrl:           fmt.Sprintf("%s/?o=%d#job/%d/run/%d", s.url, TestWorkspaceID, request.JobId, runId),
+		RunType:              jobs.RunTypeJobRun,
+		RunName:              runName,
+		Tasks:                tasks,
+		JobParameters:        runJobParameters(job.Settings, request.JobParameters),
+		OverridingParameters: runOverridingParameters(request),
+	}
+
+	if request.IdempotencyToken != "" {
+		s.JobRunIdempotency[request.IdempotencyToken] = runId
+	}
+
+	return Response{Body: jobs.RunNowResponse{RunId: runId}}
+}
+
+// runJobParameters mirrors how GetRun resolves job-level parameters: every
+// parameter the job defines, with the run's overrides applied on top, sorted by
+// name for deterministic output.
+func runJobParameters(settings *jobs.JobSettings, overrides map[string]string) []jobs.JobParameter {
+	resolved := map[string]jobs.JobParameter{}
+	if settings != nil {
+		for _, p := range settings.Parameters {
+			resolved[p.Name] = jobs.JobParameter{Name: p.Name, Default: p.Default, Value: p.Default}
+		}
+	}
+	for name, value := range overrides {
+		p := resolved[name]
+		p.Name = name
+		p.Value = value
+		resolved[name] = p
+	}
+	if len(resolved) == 0 {
+		return nil
+	}
+	result := make([]jobs.JobParameter, 0, len(resolved))
+	for _, p := range resolved {
+		result = append(result, p)
+	}
+	slices.SortFunc(result, func(a, b jobs.JobParameter) int {
+		return cmp.Compare(a.Name, b.Name)
+	})
+	return result
+}
+
+// runOverridingParameters mirrors how GetRun echoes the run's overriding
+// parameters. Returns nil when the request set none.
+func runOverridingParameters(request jobs.RunNow) *jobs.RunParameters {
+	p := jobs.RunParameters{
+		DbtCommands:       request.DbtCommands,
+		JarParams:         request.JarParams,
+		NotebookParams:    request.NotebookParams,
+		PipelineParams:    request.PipelineParams,
+		PythonNamedParams: request.PythonNamedParams,
+		PythonParams:      request.PythonParams,
+		SparkSubmitParams: request.SparkSubmitParams,
+		SqlParams:         request.SqlParams,
+	}
+	if len(p.DbtCommands) == 0 && len(p.JarParams) == 0 && len(p.NotebookParams) == 0 &&
+		p.PipelineParams == nil && len(p.PythonNamedParams) == 0 && len(p.PythonParams) == 0 &&
+		len(p.SparkSubmitParams) == 0 && len(p.SqlParams) == 0 {
+		return nil
+	}
+	return &p
+}
+
+// JobsSubmit handles jobs/runs/submit, the one-time run endpoint used by
+// `databricks ssh connect` (via client.Jobs.Submit) and the generic
+// `databricks jobs submit` command. It records the submitted spec and returns a
+// run ID so acceptance tests can assert the request body (e.g. the serverless
+// environments / base_environment) and poll runs/get for the resulting run.
+//
+// Unlike JobsRunNow, the submitted tasks are not executed locally: the SSH
+// bootstrap submits a notebook task that only exists in the workspace, and the
+// value of this handler for tests is the recorded request, not task output.
+func (s *FakeWorkspace) JobsSubmit(req Request) Response {
+	var request jobs.SubmitRun
+	if err := json.Unmarshal(req.Body, &request); err != nil {
+		return Response{
+			StatusCode: 400,
+			Body:       fmt.Sprintf("request parsing error: %s", err),
+		}
+	}
+	if response := validateJobGitSource(request.GitSource); response != nil {
+		return *response
+	}
+
+	defer s.LockUnlock()()
+
+	runId := nextID()
+
+	// The default run name for one-time runs is "Untitled" (Jobs API behavior).
+	runName := cmp.Or(request.RunName, "Untitled")
+
+	// Report each task as RUNNING in both the V1 (state) and V2 (status) shapes.
+	// The generic `jobs submit` waiter polls the V1 run-level state, which
+	// JobsGetRun drives to TERMINATED on the next poll, while `ssh connect`'s
+	// waitForJobToStart polls the V2 per-task status.
+	var tasks []jobs.RunTask
+	for _, t := range request.Tasks {
+		tasks = append(tasks, jobs.RunTask{
+			RunId:   nextID(),
+			TaskKey: t.TaskKey,
+			State: &jobs.RunState{
+				LifeCycleState: jobs.RunLifeCycleStateRunning,
+			},
+			Status: &jobs.RunStatus{
+				State: jobs.RunLifecycleStateV2StateRunning,
+			},
+		})
+	}
+
 	s.JobRuns[runId] = jobs.Run{
 		RunId:      runId,
-		JobId:      request.JobId,
 		State:      &jobs.RunState{LifeCycleState: jobs.RunLifeCycleStateRunning},
-		RunPageUrl: fmt.Sprintf("%s/?o=900800700600#job/%d/run/%d", s.url, request.JobId, runId),
-		RunType:    jobs.RunTypeJobRun,
+		RunPageUrl: fmt.Sprintf("%s/?o=%d#job/run/%d", s.url, TestWorkspaceID, runId),
+		RunType:    jobs.RunTypeSubmitRun,
 		RunName:    runName,
 		Tasks:      tasks,
 	}
 
-	return Response{Body: jobs.RunNowResponse{RunId: runId}}
+	// No tunnel server runs locally, so synthesize the metadata.json it would
+	// publish; `ssh connect` polls for it before connecting.
+	if strings.HasPrefix(runName, sshTunnelBootstrapRunPrefix) {
+		s.writeSSHTunnelMetadata(request)
+	}
+
+	return Response{Body: jobs.SubmitRunResponse{RunId: runId}}
+}
+
+const (
+	sshTunnelBootstrapRunPrefix = "ssh-server-bootstrap-"
+	sshTunnelBootstrapNotebook  = "ssh-server-bootstrap"
+	sshTunnelServerPort         = 7772
+	sshTunnelClusterID          = "1234-567890-serverless"
+
+	// sshTunnelFeatureDisabledBody is the driver proxy's refusal while port forwarding to
+	// serverless compute is disabled: a JSON string, not the usual error object.
+	sshTunnelFeatureDisabledBody = `"FEATURE_DISABLED: An administrator has disabled port forwarding to serverless compute ` +
+		"for this workspace, which includes the SSH tunnel used by `databricks ssh connect`\""
+)
+
+// writeSSHTunnelMetadata publishes the metadata.json a real tunnel server would
+// write next to the bootstrap notebook, and the host key it would publish to the
+// session's secret scope. Callers must hold the workspace lock.
+func (s *FakeWorkspace) writeSSHTunnelMetadata(request jobs.SubmitRun) {
+	for _, t := range request.Tasks {
+		if t.NotebookTask == nil {
+			continue
+		}
+		metadataPath := strings.TrimSuffix(t.NotebookTask.NotebookPath, sshTunnelBootstrapNotebook) + "metadata.json"
+		metadata, err := json.Marshal(map[string]any{
+			"port":       sshTunnelServerPort,
+			"cluster_id": sshTunnelClusterID,
+		})
+		if err != nil {
+			continue
+		}
+		s.files[metadataPath] = FileEntry{
+			Info: workspace.ObjectInfo{ObjectType: "FILE", Path: metadataPath},
+			Data: metadata,
+		}
+		s.publishSSHTunnelHostKey(t.NotebookTask.BaseParameters["secretScopeName"])
+	}
+}
+
+// publishSSHTunnelHostKey stores the tunnel host key's public half in the session's
+// secret scope, the way the real server does at startup, so the client can pin it.
+// Callers must hold the workspace lock.
+func (s *FakeWorkspace) publishSSHTunnelHostKey(scope string) {
+	if scope == "" {
+		return
+	}
+	if _, err := s.ensureSSHTunnelHostKey(); err != nil {
+		return
+	}
+	if s.Secrets[scope] == nil {
+		s.Secrets[scope] = make(map[string]string)
+	}
+	s.Secrets[scope][sshServerPublicKeySecretKey] = string(s.sshTunnelHostPublicKey)
 }
 
 // executePythonWheelTask runs a python wheel task locally using uv.
@@ -348,31 +776,36 @@ func (s *FakeWorkspace) executePythonWheelTask(jobSettings *jobs.JobSettings, ta
 	// matching cloud behavior where same library path is not reinstalled.
 	var newWhlPaths []string
 	for _, whlPath := range whlPaths {
-		if env.installedLibs[whlPath] {
+		// A dependency may carry a pip extras suffix (e.g. "foo.whl[train]").
+		// The uploaded file is stored under the bare name, so strip the suffix to
+		// locate it. We install the bare wheel; extras only affect which transitive
+		// deps cloud pulls, which this offline install does not model.
+		filePath, _ := patchwheel.SplitWheelExtras(whlPath)
+		if env.installedLibs[filePath] {
 			continue
 		}
-		data := s.files[whlPath].Data
+		data := s.files[filePath].Data
 		if len(data) == 0 {
-			return "", fmt.Errorf("wheel file not found in workspace: %s", whlPath)
+			return "", fmt.Errorf("%w: wheel file not found in workspace: %s", errNoCodeInWorkspace, filePath)
 		}
-		localPath := filepath.Join(env.dir, filepath.Base(whlPath))
+		localPath := filepath.Join(env.dir, filepath.Base(filePath))
 		if err := os.WriteFile(localPath, data, 0o644); err != nil {
 			return "", fmt.Errorf("failed to write wheel file: %w", err)
 		}
 		newWhlPaths = append(newWhlPaths, localPath)
-		env.installedLibs[whlPath] = true
+		env.installedLibs[filePath] = true
 	}
 
 	if len(newWhlPaths) > 0 {
 		installArgs := []string{"pip", "install", "-q", "--python", venvPython(env.venvDir)}
 		installArgs = append(installArgs, newWhlPaths...)
 		if out, err := exec.Command("uv", installArgs...).CombinedOutput(); err != nil {
-			return "", fmt.Errorf("uv pip install failed: %s\n%s", err, out)
+			return "", fmt.Errorf("uv pip install failed: %w\n%s", err, out)
 		}
 	}
 
 	if len(env.installedLibs) == 0 {
-		return "", errors.New("no wheel libraries found in task")
+		return "", fmt.Errorf("%w: no wheel libraries found in task", errNoCodeInWorkspace)
 	}
 
 	// Run the entry point using runpy with sys.argv[0] set to the package name,
@@ -392,7 +825,7 @@ func (s *FakeWorkspace) executePythonWheelTask(jobSettings *jobs.JobSettings, ta
 
 	output, err := cmd.CombinedOutput()
 	if err != nil {
-		return string(output), fmt.Errorf("wheel task execution failed: %s\n%s", err, output)
+		return string(output), newTaskFailure(err, string(output))
 	}
 
 	// Normalize trailing newlines to match cloud behavior (exactly one trailing newline)
@@ -418,7 +851,7 @@ func (s *FakeWorkspace) executeNotebookTask(task jobs.Task, notebookParams map[s
 		notebookData = s.files[notebookPath+".py"].Data
 	}
 	if len(notebookData) == 0 {
-		return "", fmt.Errorf("notebook not found in workspace: %s (also tried .py)", notebookPath)
+		return "", fmt.Errorf("%w: notebook not found in workspace: %s (also tried .py)", errNoCodeInWorkspace, notebookPath)
 	}
 
 	// Create a temporary Python environment for notebook execution
@@ -444,7 +877,7 @@ func (s *FakeWorkspace) executeNotebookTask(task jobs.Task, notebookParams map[s
 	venvDir := filepath.Join(tmpDir, ".venv")
 	uvArgs := []string{"venv", "-q", "--python", pythonVersion, venvDir}
 	if out, err := exec.Command("uv", uvArgs...).CombinedOutput(); err != nil {
-		return "", fmt.Errorf("uv venv failed: %s\n%s", err, out)
+		return "", fmt.Errorf("uv venv failed: %w\n%s", err, out)
 	}
 
 	// Install wheels from %pip commands
@@ -466,7 +899,7 @@ func (s *FakeWorkspace) executeNotebookTask(task jobs.Task, notebookParams map[s
 		installArgs := []string{"pip", "install", "-q", "--python", venvPython(venvDir)}
 		installArgs = append(installArgs, localWhlPaths...)
 		if out, err := exec.Command("uv", installArgs...).CombinedOutput(); err != nil {
-			return "", fmt.Errorf("uv pip install failed: %s\n%s", err, out)
+			return "", fmt.Errorf("uv pip install failed: %w\n%s", err, out)
 		}
 	}
 
@@ -480,7 +913,53 @@ func (s *FakeWorkspace) executeNotebookTask(task jobs.Task, notebookParams map[s
 
 	output, err := cmd.CombinedOutput()
 	if err != nil {
-		return string(output), fmt.Errorf("notebook task execution failed: %s\n%s", err, output)
+		return string(output), newTaskFailure(err, string(output))
+	}
+
+	// Normalize trailing newlines to match cloud behavior (exactly one trailing newline)
+	return strings.TrimRight(string(output), "\r\n") + "\n", nil
+}
+
+// executeSparkPythonTask runs a spark_python_task locally by reading the
+// python_file from the workspace and executing it in a uv-created venv.
+// For tasks using existing_cluster_id, the venv is cached per cluster to match
+// cloud behavior where libraries are cached on running clusters.
+func (s *FakeWorkspace) executeSparkPythonTask(task jobs.Task) (string, error) {
+	if task.SparkPythonTask == nil {
+		return "", errors.New("task has no spark_python_task")
+	}
+
+	// Read python file from workspace (lock already held by caller)
+	pythonPath := task.SparkPythonTask.PythonFile
+	if !strings.HasPrefix(pythonPath, "/") {
+		pythonPath = "/" + pythonPath
+	}
+
+	pythonData := s.files[pythonPath].Data
+	if len(pythonData) == 0 {
+		return "", fmt.Errorf("%w: python file not found in workspace: %s", errNoCodeInWorkspace, pythonPath)
+	}
+
+	env, cleanup, err := s.getOrCreateClusterEnv(task)
+	if err != nil {
+		return "", err
+	}
+	if cleanup != nil {
+		defer cleanup()
+	}
+
+	// Write python file into the cluster env so it can be executed by the venv.
+	pythonFile := filepath.Join(env.dir, filepath.Base(pythonPath))
+	if err := os.WriteFile(pythonFile, pythonData, 0o644); err != nil {
+		return "", fmt.Errorf("failed to write python file: %w", err)
+	}
+
+	runArgs := []string{pythonFile}
+	runArgs = append(runArgs, task.SparkPythonTask.Parameters...)
+
+	output, err := exec.Command(venvPython(env.venvDir), runArgs...).CombinedOutput()
+	if err != nil {
+		return string(output), newTaskFailure(err, string(output))
 	}
 
 	// Normalize trailing newlines to match cloud behavior (exactly one trailing newline)
@@ -510,7 +989,7 @@ func (s *FakeWorkspace) getOrCreateClusterEnv(task jobs.Task) (*clusterEnv, func
 	uvArgs := []string{"venv", "-q", "--python", pythonVersion, venvDir}
 	if out, err := exec.Command("uv", uvArgs...).CombinedOutput(); err != nil {
 		os.RemoveAll(tmpDir)
-		return nil, nil, fmt.Errorf("uv venv failed: %s\n%s", err, out)
+		return nil, nil, fmt.Errorf("uv venv failed: %w\n%s", err, out)
 	}
 
 	env := &clusterEnv{
@@ -556,6 +1035,33 @@ func sparkVersionToPython(task jobs.Task) string {
 	return "3.10"
 }
 
+// terminateRun completes the run, rolling task outcomes up into the run-level
+// state the way the Jobs API does: one failed task fails the whole run, and the
+// run reports INTERNAL_ERROR in the deprecated life_cycle_state even though its
+// tasks are TERMINATED (status.state is TERMINATED with RUN_EXECUTION_ERROR).
+func terminateRun(run *jobs.Run) {
+	for i := range run.Tasks {
+		// Tasks that were never executed (jobs/runs/submit) are still running.
+		if run.Tasks[i].State.LifeCycleState != jobs.RunLifeCycleStateTerminated {
+			run.Tasks[i].State.LifeCycleState = jobs.RunLifeCycleStateTerminated
+			run.Tasks[i].State.ResultState = jobs.RunResultStateSuccess
+		}
+	}
+
+	run.State = &jobs.RunState{
+		LifeCycleState: jobs.RunLifeCycleStateTerminated,
+		ResultState:    jobs.RunResultStateSuccess,
+	}
+	for _, task := range run.Tasks {
+		if task.State.ResultState != jobs.RunResultStateSuccess {
+			run.State.LifeCycleState = jobs.RunLifeCycleStateInternalError
+			run.State.ResultState = task.State.ResultState
+			run.State.StateMessage = fmt.Sprintf("Task %s failed with message: %s.", task.TaskKey, taskFailureMessage)
+			return
+		}
+	}
+}
+
 func (s *FakeWorkspace) JobsGetRun(req Request) Response {
 	runId := req.URL.Query().Get("run_id")
 	runIdInt, err := strconv.ParseInt(runId, 10, 64)
@@ -573,19 +1079,10 @@ func (s *FakeWorkspace) JobsGetRun(req Request) Response {
 		return Response{StatusCode: 404}
 	}
 
-	// Simulate cloud behavior: first poll returns RUNNING, next returns TERMINATED SUCCESS.
+	// Simulate cloud behavior: first poll returns RUNNING, next the terminal state.
 	if run.State.LifeCycleState == jobs.RunLifeCycleStateRunning {
 		// Transition stored state to TERMINATED for the next poll.
-		run.State = &jobs.RunState{
-			LifeCycleState: jobs.RunLifeCycleStateTerminated,
-			ResultState:    jobs.RunResultStateSuccess,
-		}
-		for i := range run.Tasks {
-			run.Tasks[i].State = &jobs.RunState{
-				LifeCycleState: jobs.RunLifeCycleStateTerminated,
-				ResultState:    jobs.RunResultStateSuccess,
-			}
-		}
+		terminateRun(&run)
 		s.JobRuns[runIdInt] = run
 
 		// Return RUNNING for this poll (before the transition).
@@ -599,6 +1096,47 @@ func (s *FakeWorkspace) JobsGetRun(req Request) Response {
 	return Response{Body: run}
 }
 
+// JobsCancelRun settles a run that is still going. The real API cancels
+// asynchronously; the caller polls runs/get either way.
+func (s *FakeWorkspace) JobsCancelRun(req Request) Response {
+	var request jobs.CancelRun
+	if err := json.Unmarshal(req.Body, &request); err != nil {
+		return Response{
+			StatusCode: 400,
+			Body:       fmt.Sprintf("request parsing error: %s", err),
+		}
+	}
+
+	defer s.LockUnlock()()
+
+	run, ok := s.JobRuns[request.RunId]
+	if !ok {
+		return Response{StatusCode: 404}
+	}
+
+	// A run that already finished keeps the outcome it reached.
+	if run.State.LifeCycleState == jobs.RunLifeCycleStateRunning {
+		run.State = &jobs.RunState{
+			LifeCycleState: jobs.RunLifeCycleStateTerminated,
+			ResultState:    jobs.RunResultStateCanceled,
+		}
+		s.JobRuns[request.RunId] = run
+	}
+
+	return Response{}
+}
+
+func (s *FakeWorkspace) JobsDeleteRun(req Request) Response {
+	var request jobs.DeleteRun
+	if err := json.Unmarshal(req.Body, &request); err != nil {
+		return Response{
+			StatusCode: 400,
+			Body:       fmt.Sprintf("request parsing error: %s", err),
+		}
+	}
+	return MapDelete(s, s.JobRuns, request.RunId)
+}
+
 func (s *FakeWorkspace) JobsGetRunOutput(req Request) Response {
 	runId := req.URL.Query().Get("run_id")
 	runIdInt, err := strconv.ParseInt(runId, 10, 64)
diff --git a/libs/testserver/jobs_test.go b/libs/testserver/jobs_test.go
new file mode 100644
index 00000000000..a5b04542deb
--- /dev/null
+++ b/libs/testserver/jobs_test.go
@@ -0,0 +1,260 @@
+package testserver
+
+import (
+	"encoding/json"
+	"errors"
+	"net/url"
+	"strconv"
+	"strings"
+	"testing"
+
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func submitRun(t *testing.T, workspace *FakeWorkspace, request jobs.SubmitRun) jobs.SubmitRunResponse {
+	t.Helper()
+	body, err := json.Marshal(request)
+	require.NoError(t, err)
+
+	response := workspace.JobsSubmit(Request{Body: body})
+	require.Equal(t, 0, response.StatusCode)
+
+	submitResponse, ok := response.Body.(jobs.SubmitRunResponse)
+	require.True(t, ok)
+	return submitResponse
+}
+
+func getRun(t *testing.T, workspace *FakeWorkspace, runID int64) jobs.Run {
+	t.Helper()
+	response := workspace.JobsGetRun(Request{
+		URL: &url.URL{RawQuery: "run_id=" + strconv.FormatInt(runID, 10)},
+	})
+	require.Equal(t, 0, response.StatusCode)
+
+	run, ok := response.Body.(jobs.Run)
+	require.True(t, ok)
+	return run
+}
+
+func TestJobsSubmit_RecordsRunAndReportsRunningTasks(t *testing.T) {
+	workspace := NewFakeWorkspace("http://test", "dbapi123")
+
+	submitResponse := submitRun(t, workspace, jobs.SubmitRun{
+		RunName: "ssh-tunnel",
+		Tasks: []jobs.SubmitTask{
+			{TaskKey: "main", EnvironmentKey: "default"},
+		},
+	})
+	require.NotZero(t, submitResponse.RunId)
+
+	run := getRun(t, workspace, submitResponse.RunId)
+	assert.Equal(t, "ssh-tunnel", run.RunName)
+	assert.Equal(t, jobs.RunTypeSubmitRun, run.RunType)
+
+	require.Len(t, run.Tasks, 1)
+	task := run.Tasks[0]
+	assert.Equal(t, "main", task.TaskKey)
+	// ssh connect's waitForJobToStart polls the V2 per-task status.
+	require.NotNil(t, task.Status)
+	assert.Equal(t, jobs.RunLifecycleStateV2StateRunning, task.Status.State)
+}
+
+func TestJobsSubmit_DefaultsRunNameToUntitled(t *testing.T) {
+	workspace := NewFakeWorkspace("http://test", "dbapi123")
+
+	submitResponse := submitRun(t, workspace, jobs.SubmitRun{
+		Tasks: []jobs.SubmitTask{{TaskKey: "main"}},
+	})
+
+	run := getRun(t, workspace, submitResponse.RunId)
+	assert.Equal(t, "Untitled", run.RunName)
+}
+
+func TestJobsSubmit_RunReachesTerminalStateOnPoll(t *testing.T) {
+	workspace := NewFakeWorkspace("http://test", "dbapi123")
+
+	submitResponse := submitRun(t, workspace, jobs.SubmitRun{
+		Tasks: []jobs.SubmitTask{{TaskKey: "main"}},
+	})
+
+	// The generic `jobs submit` waiter polls the V1 run-level state: RUNNING first,
+	// then TERMINATED/SUCCESS.
+	first := getRun(t, workspace, submitResponse.RunId)
+	assert.Equal(t, jobs.RunLifeCycleStateRunning, first.State.LifeCycleState)
+
+	second := getRun(t, workspace, submitResponse.RunId)
+	assert.Equal(t, jobs.RunLifeCycleStateTerminated, second.State.LifeCycleState)
+	assert.Equal(t, jobs.RunResultStateSuccess, second.State.ResultState)
+}
+
+func createJob(t *testing.T, workspace *FakeWorkspace, tasks ...jobs.Task) int64 {
+	t.Helper()
+	body, err := json.Marshal(jobs.CreateJob{Name: "my-job", Tasks: tasks})
+	require.NoError(t, err)
+
+	response := workspace.JobsCreate(Request{Body: body})
+	require.Equal(t, 0, response.StatusCode)
+	return response.Body.(jobs.CreateResponse).JobId
+}
+
+func runNow(t *testing.T, workspace *FakeWorkspace, request jobs.RunNow) Response {
+	t.Helper()
+	body, err := json.Marshal(request)
+	require.NoError(t, err)
+	return workspace.JobsRunNow(Request{Body: body})
+}
+
+func terminatedTask(taskKey string, result jobs.RunResultState) jobs.RunTask {
+	return jobs.RunTask{
+		TaskKey: taskKey,
+		State: &jobs.RunState{
+			LifeCycleState: jobs.RunLifeCycleStateTerminated,
+			ResultState:    result,
+		},
+	}
+}
+
+func TestTerminateRun_FailedTaskFailsTheRun(t *testing.T) {
+	run := jobs.Run{Tasks: []jobs.RunTask{
+		terminatedTask("first", jobs.RunResultStateSuccess),
+		terminatedTask("second", jobs.RunResultStateFailed),
+	}}
+
+	terminateRun(&run)
+
+	// A failed run reports INTERNAL_ERROR, not TERMINATED, in life_cycle_state.
+	assert.Equal(t, jobs.RunLifeCycleStateInternalError, run.State.LifeCycleState)
+	assert.Equal(t, jobs.RunResultStateFailed, run.State.ResultState)
+	assert.Equal(t, "Task second failed with message: Workload failed, see run output for details.", run.State.StateMessage)
+}
+
+func TestNewTaskFailure_ReportsTheExceptionAndTheTraceback(t *testing.T) {
+	output := "Traceback (most recent call last):\n  File \"fail.py\", line 1\nRuntimeError: intentional failure\n"
+
+	failure := newTaskFailure(errors.New("exit status 1"), output)
+
+	assert.Equal(t, "RuntimeError: intentional failure", failure.Error())
+	assert.Equal(t, strings.TrimRight(output, "\n"), failure.trace)
+}
+
+func TestNewTaskFailure_SingleLineOutputIsTheException(t *testing.T) {
+	failure := newTaskFailure(errors.New("exit status 1"), "RuntimeError: intentional failure\n")
+
+	assert.Equal(t, "RuntimeError: intentional failure", failure.Error())
+}
+
+// A task can exit non-zero without writing anything, e.g. sys.exit(1).
+func TestNewTaskFailure_SilentFailureIsReportedAsTheExitError(t *testing.T) {
+	failure := newTaskFailure(errors.New("exit status 1"), "")
+
+	assert.Equal(t, "exit status 1", failure.Error())
+}
+
+func TestTerminateRun_CompletesTasksThatAreStillRunning(t *testing.T) {
+	// jobs/runs/submit records its tasks as running: they are never executed.
+	run := jobs.Run{Tasks: []jobs.RunTask{
+		{TaskKey: "main", State: &jobs.RunState{LifeCycleState: jobs.RunLifeCycleStateRunning}},
+	}}
+
+	terminateRun(&run)
+
+	assert.Equal(t, jobs.RunResultStateSuccess, run.State.ResultState)
+	assert.Empty(t, run.State.StateMessage)
+	assert.Equal(t, jobs.RunResultStateSuccess, run.Tasks[0].State.ResultState)
+}
+
+// See errNoCodeInWorkspace: a missing notebook is this server's gap, not a
+// failure of the job.
+func TestJobsGetRun_TaskWithoutCodeDoesNotFailTheRun(t *testing.T) {
+	workspace := NewFakeWorkspace("http://test", "dbapi123")
+	jobID := createJob(t, workspace, jobs.Task{
+		TaskKey:      "main",
+		NotebookTask: &jobs.NotebookTask{NotebookPath: "/missing-notebook"},
+	})
+
+	response := runNow(t, workspace, jobs.RunNow{JobId: jobID})
+	require.Equal(t, 0, response.StatusCode)
+	runID := response.Body.(jobs.RunNowResponse).RunId
+
+	// The first poll reports RUNNING, the second the terminal state.
+	require.Equal(t, jobs.RunLifeCycleStateRunning, getRun(t, workspace, runID).State.LifeCycleState)
+	assert.Equal(t, jobs.RunResultStateSuccess, getRun(t, workspace, runID).State.ResultState)
+}
+
+func TestJobsRunNow_RepeatedTokenReturnsTheSameRun(t *testing.T) {
+	workspace := NewFakeWorkspace("http://test", "dbapi123")
+	jobID := createJob(t, workspace, jobs.Task{TaskKey: "main"})
+	request := jobs.RunNow{JobId: jobID, IdempotencyToken: "token"}
+
+	first := runNow(t, workspace, request).Body.(jobs.RunNowResponse).RunId
+	second := runNow(t, workspace, request).Body.(jobs.RunNowResponse).RunId
+
+	assert.Equal(t, first, second)
+	assert.Len(t, workspace.JobRuns, 1)
+}
+
+// Requests without a token are never deduped (`bundle run`, `jobs run-now`).
+func TestJobsRunNow_WithoutATokenIsNeverDeduped(t *testing.T) {
+	workspace := NewFakeWorkspace("http://test", "dbapi123")
+	jobID := createJob(t, workspace, jobs.Task{TaskKey: "main"})
+
+	first := runNow(t, workspace, jobs.RunNow{JobId: jobID}).Body.(jobs.RunNowResponse).RunId
+	second := runNow(t, workspace, jobs.RunNow{JobId: jobID}).Body.(jobs.RunNowResponse).RunId
+
+	assert.NotEqual(t, first, second)
+	assert.Len(t, workspace.JobRuns, 2)
+}
+
+// An interrupted deploy leaves the run going, and the CLI cancels it before
+// deleting it, since jobs/runs/delete rejects an active run.
+func TestJobsCancelRun_SettlesAnActiveRun(t *testing.T) {
+	workspace := NewFakeWorkspace("http://test", "dbapi123")
+	jobID := createJob(t, workspace, jobs.Task{
+		TaskKey:      "main",
+		NotebookTask: &jobs.NotebookTask{NotebookPath: "/missing-notebook"},
+	})
+	runID := runNow(t, workspace, jobs.RunNow{JobId: jobID}).Body.(jobs.RunNowResponse).RunId
+
+	body, err := json.Marshal(jobs.CancelRun{RunId: runID})
+	require.NoError(t, err)
+	require.Equal(t, 0, workspace.JobsCancelRun(Request{Body: body}).StatusCode)
+
+	run := getRun(t, workspace, runID)
+	assert.Equal(t, jobs.RunLifeCycleStateTerminated, run.State.LifeCycleState)
+	assert.Equal(t, jobs.RunResultStateCanceled, run.State.ResultState)
+}
+
+func TestJobsCancelRun_LeavesAFinishedRunAlone(t *testing.T) {
+	workspace := NewFakeWorkspace("http://test", "dbapi123")
+	jobID := createJob(t, workspace, jobs.Task{
+		TaskKey:      "main",
+		NotebookTask: &jobs.NotebookTask{NotebookPath: "/missing-notebook"},
+	})
+	runID := runNow(t, workspace, jobs.RunNow{JobId: jobID}).Body.(jobs.RunNowResponse).RunId
+
+	// The first poll settles the run, the way a completed deploy leaves it.
+	getRun(t, workspace, runID)
+	require.Equal(t, jobs.RunResultStateSuccess, getRun(t, workspace, runID).State.ResultState)
+
+	body, err := json.Marshal(jobs.CancelRun{RunId: runID})
+	require.NoError(t, err)
+	require.Equal(t, 0, workspace.JobsCancelRun(Request{Body: body}).StatusCode)
+
+	assert.Equal(t, jobs.RunResultStateSuccess, getRun(t, workspace, runID).State.ResultState)
+}
+
+func TestJobsSubmit_RejectsInvalidGitProvider(t *testing.T) {
+	workspace := NewFakeWorkspace("http://test", "dbapi123")
+
+	body, err := json.Marshal(jobs.SubmitRun{
+		GitSource: &jobs.GitSource{GitUrl: "https://example.com/repo"},
+		Tasks:     []jobs.SubmitTask{{TaskKey: "main"}},
+	})
+	require.NoError(t, err)
+
+	response := workspace.JobsSubmit(Request{Body: body})
+	assert.Equal(t, 400, response.StatusCode)
+	assert.Equal(t, missingJobGitProviderMessage, response.Body.(map[string]string)["message"])
+}
diff --git a/libs/testserver/kill.go b/libs/testserver/kill.go
new file mode 100644
index 00000000000..e24b13a0f11
--- /dev/null
+++ b/libs/testserver/kill.go
@@ -0,0 +1,108 @@
+package testserver
+
+import (
+	"encoding/json"
+	"net/http"
+	"os"
+	"sync"
+	"time"
+
+	"github.com/databricks/cli/internal/testutil"
+)
+
+type killRuleKey struct {
+	token   string
+	pattern string // "METHOD /path"
+}
+
+type killRule struct {
+	offset int
+	times  int
+}
+
+type killRules struct {
+	mu    sync.Mutex
+	rules map[killRuleKey]*killRule
+}
+
+func newKillRules() *killRules {
+	return &killRules{rules: make(map[killRuleKey]*killRule)}
+}
+
+func (kr *killRules) set(token, pattern string, offset, times int) {
+	kr.mu.Lock()
+	defer kr.mu.Unlock()
+	kr.rules[killRuleKey{token: token, pattern: pattern}] = &killRule{offset: offset, times: times}
+}
+
+// check returns true if the caller should be killed for this request.
+// It also performs the kill.
+func (kr *killRules) check(t testutil.TestingT, method, path, token string, headers http.Header) bool {
+	pattern := method + " " + path
+	key := killRuleKey{token: token, pattern: pattern}
+
+	kr.mu.Lock()
+	rule, ok := kr.rules[key]
+	if !ok {
+		kr.mu.Unlock()
+		return false
+	}
+	if rule.offset > 0 {
+		rule.offset--
+		kr.mu.Unlock()
+		return false
+	}
+	if rule.times <= 0 {
+		delete(kr.rules, key)
+		kr.mu.Unlock()
+		return false
+	}
+	rule.times--
+	if rule.times == 0 {
+		delete(kr.rules, key)
+	}
+	kr.mu.Unlock()
+
+	killProcess(t, pattern, headers)
+	return true
+}
+
+func killProcess(t testutil.TestingT, pattern string, headers http.Header) {
+	pid := ExtractPidFromHeaders(headers)
+	if pid == 0 {
+		t.Errorf("kill rule matched %q but test-pid not found in User-Agent", pattern)
+		return
+	}
+
+	process, err := os.FindProcess(pid)
+	if err != nil {
+		t.Errorf("Failed to find process %d: %s", pid, err)
+		return
+	}
+
+	if err := process.Kill(); err != nil {
+		t.Errorf("Failed to kill process %d: %s", pid, err)
+		return
+	}
+
+	if !waitForProcessExit(pid, 2*time.Second) {
+		t.Logf("kill: timed out waiting for PID %d to exit (pattern: %s)", pid, pattern)
+	}
+	t.Logf("kill: killed PID %d (pattern: %s)", pid, pattern)
+}
+
+// killEndpointHandler returns a HandlerFunc for POST /__testserver/kill.
+func killEndpointHandler(kr *killRules) HandlerFunc {
+	return func(req Request) any {
+		var body struct {
+			Pattern string `json:"pattern"`
+			Offset  int    `json:"offset"`
+			Times   int    `json:"times"`
+		}
+		if err := json.Unmarshal(req.Body, &body); err != nil {
+			return Response{StatusCode: 400, Body: map[string]string{"error": err.Error()}}
+		}
+		kr.set(req.Token, body.Pattern, body.Offset, body.Times)
+		return Response{StatusCode: 200}
+	}
+}
diff --git a/libs/testserver/libraries.go b/libs/testserver/libraries.go
new file mode 100644
index 00000000000..63042ca8e66
--- /dev/null
+++ b/libs/testserver/libraries.go
@@ -0,0 +1,87 @@
+package testserver
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"reflect"
+
+	"github.com/databricks/databricks-sdk-go/service/compute"
+)
+
+func (s *FakeWorkspace) LibrariesInstall(req Request) any {
+	var request compute.InstallLibraries
+	if err := json.Unmarshal(req.Body, &request); err != nil {
+		return Response{StatusCode: http.StatusBadRequest, Body: fmt.Sprintf("request parsing error: %s", err)}
+	}
+
+	defer s.LockUnlock()()
+
+	if _, ok := s.Clusters[request.ClusterId]; !ok {
+		return Response{StatusCode: http.StatusNotFound}
+	}
+
+	// Install is additive and idempotent: installing an already-present library is a no-op.
+	installed := s.ClusterLibraries[request.ClusterId]
+	for _, lib := range request.Libraries {
+		if !containsLibrary(installed, lib) {
+			installed = append(installed, lib)
+		}
+	}
+	s.ClusterLibraries[request.ClusterId] = installed
+
+	return Response{}
+}
+
+func (s *FakeWorkspace) LibrariesUninstall(req Request) any {
+	var request compute.UninstallLibraries
+	if err := json.Unmarshal(req.Body, &request); err != nil {
+		return Response{StatusCode: http.StatusBadRequest, Body: fmt.Sprintf("request parsing error: %s", err)}
+	}
+
+	defer s.LockUnlock()()
+
+	installed := s.ClusterLibraries[request.ClusterId]
+	remaining := make([]compute.Library, 0, len(installed))
+	for _, lib := range installed {
+		if !containsLibrary(request.Libraries, lib) {
+			remaining = append(remaining, lib)
+		}
+	}
+	s.ClusterLibraries[request.ClusterId] = remaining
+
+	return Response{}
+}
+
+func (s *FakeWorkspace) LibrariesClusterStatus(req Request, clusterId string) any {
+	defer s.LockUnlock()()
+
+	if _, ok := s.Clusters[clusterId]; !ok {
+		return Response{StatusCode: http.StatusNotFound}
+	}
+
+	installed := s.ClusterLibraries[clusterId]
+	statuses := make([]compute.LibraryFullStatus, 0, len(installed))
+	for i := range installed {
+		statuses = append(statuses, compute.LibraryFullStatus{
+			Library: &installed[i],
+			Status:  compute.LibraryInstallStatusInstalled,
+		})
+	}
+
+	return Response{
+		Body: compute.ClusterLibraryStatuses{
+			ClusterId:       clusterId,
+			LibraryStatuses: statuses,
+		},
+	}
+}
+
+func containsLibrary(libs []compute.Library, target compute.Library) bool {
+	for _, l := range libs {
+		if reflect.DeepEqual(l, target) {
+			return true
+		}
+	}
+	return false
+}
diff --git a/libs/testserver/mcp_services.go b/libs/testserver/mcp_services.go
new file mode 100644
index 00000000000..41200d06951
--- /dev/null
+++ b/libs/testserver/mcp_services.go
@@ -0,0 +1,69 @@
+package testserver
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/databricks/databricks-sdk-go/service/catalog"
+)
+
+// McpServicesCreate fakes POST /api/2.1/unity-catalog/mcp-services. See
+// ModelServicesCreate for the shape: the McpService body is sent directly,
+// parent and mcp_service_id are query parameters, and the map is keyed by the
+// {catalog}.{schema}.{mcp_service} path segment.
+func (s *FakeWorkspace) McpServicesCreate(req Request) Response {
+	defer s.LockUnlock()()
+
+	var ms catalog.McpService
+	if err := json.Unmarshal(req.Body, &ms); err != nil {
+		return Response{
+			Body:       fmt.Sprintf("internal error: %s", err),
+			StatusCode: http.StatusInternalServerError,
+		}
+	}
+
+	schema := strings.TrimPrefix(req.URL.Query().Get("parent"), "schemas/")
+	key := schema + "." + req.URL.Query().Get("mcp_service_id")
+
+	ms.Name = "mcp-services/" + key
+	ms.CreatedBy = s.CurrentUser().UserName
+	ms.UpdatedBy = s.CurrentUser().UserName
+	ms.EffectiveOwner = s.CurrentUser().UserName
+	ms.MetastoreId = nextUUID()
+
+	s.McpServices[key] = ms
+	return Response{
+		Body: ms,
+	}
+}
+
+func (s *FakeWorkspace) McpServicesUpdate(req Request, name string) Response {
+	defer s.LockUnlock()()
+
+	existing, ok := s.McpServices[name]
+	if !ok {
+		return Response{
+			StatusCode: http.StatusNotFound,
+			Body:       fmt.Sprintf("mcp service %s not found", name),
+		}
+	}
+
+	var incoming catalog.McpService
+	if err := json.Unmarshal(req.Body, &incoming); err != nil {
+		return Response{
+			Body:       fmt.Sprintf("internal error: %s", err),
+			StatusCode: http.StatusInternalServerError,
+		}
+	}
+
+	existing.Comment = incoming.Comment
+	existing.Config = incoming.Config
+	existing.UpdatedBy = s.CurrentUser().UserName
+
+	s.McpServices[name] = existing
+	return Response{
+		Body: existing,
+	}
+}
diff --git a/libs/testserver/model_provider_services.go b/libs/testserver/model_provider_services.go
new file mode 100644
index 00000000000..622bf75888c
--- /dev/null
+++ b/libs/testserver/model_provider_services.go
@@ -0,0 +1,70 @@
+package testserver
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/databricks/databricks-sdk-go/service/catalog"
+)
+
+// ModelProviderServicesCreate fakes POST
+// /api/2.1/unity-catalog/model-provider-services. See ModelServicesCreate for
+// the shape: the ModelProviderService body is sent directly, parent and
+// model_provider_service_id are query parameters, and the map is keyed by the
+// {catalog}.{schema}.{model_provider_service} path segment.
+func (s *FakeWorkspace) ModelProviderServicesCreate(req Request) Response {
+	defer s.LockUnlock()()
+
+	var ms catalog.ModelProviderService
+	if err := json.Unmarshal(req.Body, &ms); err != nil {
+		return Response{
+			Body:       fmt.Sprintf("internal error: %s", err),
+			StatusCode: http.StatusInternalServerError,
+		}
+	}
+
+	schema := strings.TrimPrefix(req.URL.Query().Get("parent"), "schemas/")
+	key := schema + "." + req.URL.Query().Get("model_provider_service_id")
+
+	ms.Name = "model-provider-services/" + key
+	ms.CreatedBy = s.CurrentUser().UserName
+	ms.UpdatedBy = s.CurrentUser().UserName
+	ms.EffectiveOwner = s.CurrentUser().UserName
+	ms.MetastoreId = nextUUID()
+
+	s.ModelProviderServices[key] = ms
+	return Response{
+		Body: ms,
+	}
+}
+
+func (s *FakeWorkspace) ModelProviderServicesUpdate(req Request, name string) Response {
+	defer s.LockUnlock()()
+
+	existing, ok := s.ModelProviderServices[name]
+	if !ok {
+		return Response{
+			StatusCode: http.StatusNotFound,
+			Body:       fmt.Sprintf("model provider service %s not found", name),
+		}
+	}
+
+	var incoming catalog.ModelProviderService
+	if err := json.Unmarshal(req.Body, &incoming); err != nil {
+		return Response{
+			Body:       fmt.Sprintf("internal error: %s", err),
+			StatusCode: http.StatusInternalServerError,
+		}
+	}
+
+	existing.Comment = incoming.Comment
+	existing.Config = incoming.Config
+	existing.UpdatedBy = s.CurrentUser().UserName
+
+	s.ModelProviderServices[name] = existing
+	return Response{
+		Body: existing,
+	}
+}
diff --git a/libs/testserver/model_services.go b/libs/testserver/model_services.go
new file mode 100644
index 00000000000..ce653543ac5
--- /dev/null
+++ b/libs/testserver/model_services.go
@@ -0,0 +1,77 @@
+package testserver
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/databricks/databricks-sdk-go/service/catalog"
+)
+
+// ModelServicesCreate fakes POST /api/2.1/unity-catalog/model-services.
+//
+// `parent` (schemas/{catalog}.{schema}) and `model_service_id` arrive as query
+// parameters; the ModelService body is sent directly (not wrapped in
+// "model_service"). The server derives the resource name
+// model-services/{catalog}.{schema}.{model_service}.
+// The map is keyed by the {catalog}.{schema}.{model_service} portion, which is
+// the path segment used on subsequent get/update/delete.
+func (s *FakeWorkspace) ModelServicesCreate(req Request) Response {
+	defer s.LockUnlock()()
+
+	// The SDK sends the ModelService body directly (not wrapped in
+	// "model_service"); parent and model_service_id are query parameters.
+	var ms catalog.ModelService
+	if err := json.Unmarshal(req.Body, &ms); err != nil {
+		return Response{
+			Body:       fmt.Sprintf("internal error: %s", err),
+			StatusCode: http.StatusInternalServerError,
+		}
+	}
+
+	schema := strings.TrimPrefix(req.URL.Query().Get("parent"), "schemas/")
+	key := schema + "." + req.URL.Query().Get("model_service_id")
+
+	ms.Name = "model-services/" + key
+	ms.CreatedBy = s.CurrentUser().UserName
+	ms.UpdatedBy = s.CurrentUser().UserName
+	ms.EffectiveOwner = s.CurrentUser().UserName
+	ms.MetastoreId = nextUUID()
+
+	s.ModelServices[key] = ms
+	return Response{
+		Body: ms,
+	}
+}
+
+func (s *FakeWorkspace) ModelServicesUpdate(req Request, name string) Response {
+	defer s.LockUnlock()()
+
+	existing, ok := s.ModelServices[name]
+	if !ok {
+		return Response{
+			StatusCode: http.StatusNotFound,
+			Body:       fmt.Sprintf("model service %s not found", name),
+		}
+	}
+
+	// The SDK sends the ModelService body directly; update_mask is a query param.
+	var incoming catalog.ModelService
+	if err := json.Unmarshal(req.Body, &incoming); err != nil {
+		return Response{
+			Body:       fmt.Sprintf("internal error: %s", err),
+			StatusCode: http.StatusInternalServerError,
+		}
+	}
+
+	// Apply the mutable fields carried in the update mask (comment, config).
+	existing.Comment = incoming.Comment
+	existing.Config = incoming.Config
+	existing.UpdatedBy = s.CurrentUser().UserName
+
+	s.ModelServices[name] = existing
+	return Response{
+		Body: existing,
+	}
+}
diff --git a/libs/testserver/models.go b/libs/testserver/models.go
index febfd8bf8a8..3314327d8a7 100644
--- a/libs/testserver/models.go
+++ b/libs/testserver/models.go
@@ -19,6 +19,18 @@ func (s *FakeWorkspace) ModelRegistryCreateModel(req Request) any {
 		}
 	}
 
+	// MLflow rejects an empty name; the fake would otherwise store a model under a key
+	// nothing can look up.
+	if request.Name == "" {
+		return Response{
+			StatusCode: 400,
+			Body: map[string]string{
+				"error_code": "INVALID_PARAMETER_VALUE",
+				"message":    "Got an invalid name ''. Registered Model names cannot be empty strings.",
+			},
+		}
+	}
+
 	// Create the model with a numeric ID (matching real API behavior)
 	modelId := strconv.FormatInt(nextID(), 10)
 	model := ml.Model{
diff --git a/libs/testserver/models_test.go b/libs/testserver/models_test.go
new file mode 100644
index 00000000000..e72d4930133
--- /dev/null
+++ b/libs/testserver/models_test.go
@@ -0,0 +1,48 @@
+package testserver
+
+import (
+	"net/url"
+	"testing"
+
+	"github.com/databricks/databricks-sdk-go/service/ml"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestModelRegistryCreateModel_RejectsEmptyName(t *testing.T) {
+	workspace := NewFakeWorkspace("http://test", "dbapi123")
+
+	response, ok := workspace.ModelRegistryCreateModel(Request{Body: []byte(`{"name": ""}`)}).(Response)
+	require.True(t, ok)
+	assert.Equal(t, 400, response.StatusCode)
+
+	// A stored-but-unreadable model is the original bug. Asserted before the
+	// require below so it is still reported when the rejection is missing.
+	assert.Empty(t, workspace.ModelRegistryModels)
+
+	body, ok := response.Body.(map[string]string)
+	require.True(t, ok)
+	assert.Equal(t, "INVALID_PARAMETER_VALUE", body["error_code"])
+	assert.Contains(t, body["message"], "cannot be empty strings")
+}
+
+func TestModelRegistryCreateModel_AllowsNonEmptyName(t *testing.T) {
+	workspace := NewFakeWorkspace("http://test", "dbapi123")
+
+	response, ok := workspace.ModelRegistryCreateModel(Request{Body: []byte(`{"name": "my_model"}`)}).(Response)
+	require.True(t, ok)
+	// StatusCode 0 gets converted to 200 by normalizeResponse in the server
+	require.Equal(t, 0, response.StatusCode)
+
+	// Read back through the GET handler: a mis-keyed store must fail here.
+	getResponse, ok := workspace.ModelRegistryGetModel(Request{
+		URL: &url.URL{RawQuery: "name=my_model"},
+	}).(Response)
+	require.True(t, ok)
+	require.Equal(t, 0, getResponse.StatusCode)
+
+	body, ok := getResponse.Body.(ml.GetModelResponse)
+	require.True(t, ok)
+	assert.Equal(t, "my_model", body.RegisteredModelDatabricks.Name)
+	assert.NotEmpty(t, body.RegisteredModelDatabricks.Id)
+}
diff --git a/libs/testserver/permissions.go b/libs/testserver/permissions.go
index e7983b1afa7..a3584c1d49a 100644
--- a/libs/testserver/permissions.go
+++ b/libs/testserver/permissions.go
@@ -3,6 +3,9 @@ package testserver
 import (
 	"encoding/json"
 	"fmt"
+	"slices"
+	"strconv"
+	"strings"
 
 	"github.com/databricks/databricks-sdk-go/service/iam"
 )
@@ -25,6 +28,7 @@ var requestObjectTypeToObjectType = map[string]string{
 	"sql/alerts":              "alert",
 	"sql/queries":             "query",
 	"dashboards":              "dashboard",
+	"genie":                   "genie-space",
 	"experiments":             "mlflowExperiment",
 	"registered-models":       "registered-model",
 	"serving-endpoints":       "serving-endpoint",
@@ -73,6 +77,39 @@ func (s *FakeWorkspace) upsertPermission(objectKey string, entry iam.AccessContr
 	s.Permissions[objectKey] = perms
 }
 
+// jobPrincipalHasAccess reports whether the principal has a direct ACL entry
+// (hasAccess) and whether the ACL names an explicit owner (hasOwner). hasOwner
+// lets callers grant the creator implicit access only until ownership moves.
+func jobPrincipalHasAccess(perms iam.ObjectPermissions, principal string) (hasAccess, hasOwner bool) {
+	for _, acl := range perms.AccessControlList {
+		for _, p := range acl.AllPermissions {
+			if p.PermissionLevel == "IS_OWNER" {
+				hasOwner = true
+			}
+		}
+		if len(acl.AllPermissions) > 0 && (acl.UserName == principal || acl.ServicePrincipalName == principal) {
+			hasAccess = true
+		}
+	}
+	return hasAccess, hasOwner
+}
+
+// guestHasJobAccess reports whether a guest may access a job: via a direct ACL
+// entry, or as the creator while no explicit owner is set. Call with s.mu held.
+func (s *FakeWorkspace) guestHasJobAccess(jobId int64, principal string) bool {
+	perms := s.Permissions[fmt.Sprintf("/jobs/%d", jobId)]
+	hasAccess, hasOwner := jobPrincipalHasAccess(perms, principal)
+	if hasAccess {
+		return true
+	}
+	if !hasOwner {
+		if job, ok := s.Jobs[jobId]; ok && job.CreatorUserName == principal {
+			return true
+		}
+	}
+	return false
+}
+
 // GetPermissions retrieves permissions for a given object type and ID
 func (s *FakeWorkspace) GetPermissions(req Request) any {
 	defer s.LockUnlock()()
@@ -84,6 +121,14 @@ func (s *FakeWorkspace) GetPermissions(req Request) any {
 		requestObjectType = prefix + "/" + requestObjectType
 	}
 
+	// A guest without manage access cannot read a job's permissions, mirroring
+	// the backend's pre-existence permission check.
+	if requestObjectType == "jobs" && isGuestToken(req.Token) {
+		if jobId, err := strconv.ParseInt(objectId, 10, 64); err == nil && !s.guestHasJobAccess(jobId, userForToken(req.Token).UserName) {
+			return jobManagePermissionDenied(userForToken(req.Token).UserName, jobId)
+		}
+	}
+
 	if requestObjectType == "" {
 		return Response{
 			StatusCode: 400,
@@ -193,6 +238,22 @@ func (s *FakeWorkspace) SetPermissions(req Request) any {
 		}
 	}
 
+	// Cluster policies only support CAN_USE; the real API rejects other levels
+	// with this exact message. Model it so deploys fail the same way on cloud.
+	if requestObjectType == "cluster-policies" {
+		for _, acl := range updateRequest.AccessControlList {
+			if acl.PermissionLevel != "" && acl.PermissionLevel != "CAN_USE" {
+				return Response{
+					StatusCode: 400,
+					Body: map[string]string{
+						"error_code": "INVALID_PARAMETER_VALUE",
+						"message":    fmt.Sprintf("Unknown Cluster Policy Permission Level: %s", acl.PermissionLevel),
+					},
+				}
+			}
+		}
+	}
+
 	responseObjectID := fmt.Sprintf("/%s/%s", requestObjectType, objectId)
 
 	// Get existing permissions or create new ones
@@ -269,32 +330,71 @@ func (s *FakeWorkspace) SetPermissions(req Request) any {
 		})
 	}
 
-	// Validate job ownership requirements
-	if requestObjectType == "jobs" {
-		hasOwner := false
+	// Jobs and pipelines require exactly one owner. The real Permissions API rejects
+	// a PUT with zero owners OR more than one owner (verified against the backend);
+	// both cases return "The <type> must have exactly one owner."
+	ownerNoun := map[string]string{"jobs": "job", "pipelines": "pipeline"}[requestObjectType]
+	if ownerNoun != "" {
+		owners := 0
 		for _, acl := range existingPermissions.AccessControlList {
 			for _, perm := range acl.AllPermissions {
 				if perm.PermissionLevel == "IS_OWNER" {
-					hasOwner = true
-					break
+					owners++
 				}
 			}
-			if hasOwner {
-				break
-			}
 		}
 
-		if !hasOwner {
+		if owners != 1 {
 			return Response{
 				StatusCode: 400,
-				Body:       map[string]string{"message": "The job must have exactly one owner."},
+				Body: map[string]string{
+					"error_code": "INVALID_PARAMETER_VALUE",
+					"message":    "The " + ownerNoun + " must have exactly one owner.",
+				},
 			}
 		}
 	}
 
 	s.Permissions[responseObjectID] = existingPermissions
 
+	// A directory under /Workspace/Users/<owner> grants the owner CAN_MANAGE
+	// (inherited), mirroring real workspaces where a user manages everything in their
+	// home folder. This holds regardless of what the request configured for them, so
+	// it overrides any lower level. SetPermissions replaces the direct ACL but this
+	// inherited access persists, so we add it to the response (not the stored value).
+	response := existingPermissions
+	if requestObjectType == "directories" {
+		if owner := s.directoryHomeOwner(objectId); owner != "" {
+			response.AccessControlList = slices.Clone(existingPermissions.AccessControlList)
+			upsertACL(&response, iam.AccessControlResponse{
+				UserName:       owner,
+				AllPermissions: []iam.Permission{{PermissionLevel: "CAN_MANAGE", Inherited: true}},
+			})
+		}
+	}
+
 	return Response{
-		Body: existingPermissions,
+		Body: response,
+	}
+}
+
+// directoryHomeOwner returns the home-directory owner for the directory with the
+// given object id, i.e. <owner> when its path is under /Workspace/Users/<owner>.
+// Returns an empty string otherwise.
+func (s *FakeWorkspace) directoryHomeOwner(objectId string) string {
+	const usersPrefix = "/Workspace/Users/"
+	for path, info := range s.directories {
+		if strconv.FormatInt(info.ObjectId, 10) != objectId {
+			continue
+		}
+		if !strings.HasPrefix(path, usersPrefix) {
+			return ""
+		}
+		rest := path[len(usersPrefix):]
+		if before, _, ok := strings.Cut(rest, "/"); ok {
+			return before
+		}
+		return rest
 	}
+	return ""
 }
diff --git a/libs/testserver/pipelines.go b/libs/testserver/pipelines.go
index 30e91021f23..0aedc44c5d3 100644
--- a/libs/testserver/pipelines.go
+++ b/libs/testserver/pipelines.go
@@ -3,6 +3,7 @@ package testserver
 import (
 	"encoding/json"
 	"fmt"
+	"strings"
 
 	"github.com/databricks/databricks-sdk-go/service/pipelines"
 )
@@ -34,14 +35,45 @@ func (s *FakeWorkspace) PipelineCreate(req Request) Response {
 		}
 	}
 
+	// Unity Catalog requires target_schema_name to be a single schema segment, so a
+	// dotted catalog.schema value is rejected; the catalog belongs in the separate
+	// catalog field. Only the dot trips this check, but the backend's canned error
+	// also lists dashes and other characters as invalid.
+	if strings.Contains(spec.Target, ".") {
+		return Response{
+			StatusCode: 400,
+			Body: map[string]string{
+				"error_code": "INVALID_PARAMETER_VALUE",
+				"message":    fmt.Sprintf("CreatePipeline target_schema_name %q is not a valid name. Valid names must contain only alphanumeric characters and underscores, and cannot contain spaces, periods, forward slashes, or control characters.", spec.Target),
+			},
+		}
+	}
+
 	var r pipelines.GetPipelineResponse
 	r.Spec = &spec
 
+	// parameters is not on PipelineSpec (only on CreatePipeline), so the decode above
+	// drops it. The backend echoes it on GetPipelineResponse.Parameters; mirror that
+	// here, else a re-read misses it and the CLI plans a perpetual update.
+	var create pipelines.CreatePipeline
+	if err := json.Unmarshal(req.Body, &create); err != nil {
+		return Response{
+			Body:       fmt.Sprintf("cannot unmarshal request body: %s", err),
+			StatusCode: 400,
+		}
+	}
+	r.Parameters = create.Parameters
+
 	pipelineId := nextUUID()
 	r.PipelineId = pipelineId
 	r.CreatorUserName = "tester@databricks.com"
 	r.LastModified = nowMilli()
 	r.Name = r.Spec.Name
+	// run_as is on CreatePipeline, not PipelineSpec, so the spec decode drops it. The backend
+	// echoes it top-level on GetPipelineResponse.RunAs; mirror that so a re-read is faithful.
+	if create.RunAs != nil {
+		r.RunAs = create.RunAs
+	}
 	r.RunAsUserName = "tester@databricks.com"
 	r.State = "IDLE"
 	r.EffectivePublishingMode = pipelines.PublishingModeDefaultPublishingMode
@@ -85,7 +117,26 @@ func (s *FakeWorkspace) PipelineUpdate(req Request, pipelineId string) Response
 		}
 	}
 
+	// parameters is on EditPipeline, not PipelineSpec; round-trip it like
+	// PipelineCreate does.
+	var edit pipelines.EditPipeline
+	if err := json.Unmarshal(req.Body, &edit); err != nil {
+		return Response{
+			Body:       fmt.Sprintf("internal error: %s", err),
+			StatusCode: 400,
+		}
+	}
+
 	item.Spec = &spec
+	item.Parameters = edit.Parameters
+	// The backend echoes the spec name on GetPipelineResponse.Name; mirror that so a
+	// rename is reflected on the next read.
+	item.Name = spec.Name
+	// run_as is on EditPipeline, not PipelineSpec; keep it in sync like Parameters so an edit
+	// that changes run_as is reflected on the next read (matches cloud top-level echo).
+	if edit.RunAs != nil {
+		item.RunAs = edit.RunAs
+	}
 	setSpecDefaults(&spec, pipelineId)
 	s.Pipelines[pipelineId] = item
 
diff --git a/libs/testserver/pipelines_test.go b/libs/testserver/pipelines_test.go
index a6368092ed1..39114714082 100644
--- a/libs/testserver/pipelines_test.go
+++ b/libs/testserver/pipelines_test.go
@@ -25,6 +25,29 @@ func createTestPipeline(t *testing.T, workspace *FakeWorkspace) string {
 	return createPipelineResponse.PipelineId
 }
 
+func TestPipelineCreate_RejectsDottedTargetSchemaName(t *testing.T) {
+	workspace := NewFakeWorkspace("http://test", "dbapi123")
+
+	response := workspace.PipelineCreate(Request{
+		Body: []byte(`{"name": "p", "catalog": "main", "target": "main.test_schema"}`),
+	})
+	assert.Equal(t, 400, response.StatusCode)
+
+	body, ok := response.Body.(map[string]string)
+	require.True(t, ok)
+	assert.Equal(t, "INVALID_PARAMETER_VALUE", body["error_code"])
+	assert.Contains(t, body["message"], `target_schema_name "main.test_schema"`)
+}
+
+func TestPipelineCreate_AllowsSingleSegmentTargetSchemaName(t *testing.T) {
+	workspace := NewFakeWorkspace("http://test", "dbapi123")
+
+	response := workspace.PipelineCreate(Request{
+		Body: []byte(`{"name": "p", "catalog": "main", "target": "test_schema"}`),
+	})
+	assert.Equal(t, 0, response.StatusCode)
+}
+
 func TestPipelineStartUpdate_HandlesNonExistentPipeline(t *testing.T) {
 	workspace := NewFakeWorkspace("http://test", "dbapi123")
 
diff --git a/libs/testserver/postgres.go b/libs/testserver/postgres.go
index 3242b6d85d6..2f59389aeb1 100644
--- a/libs/testserver/postgres.go
+++ b/libs/testserver/postgres.go
@@ -1,8 +1,12 @@
 package testserver
 
 import (
+	"crypto/rand"
+	"encoding/hex"
 	"encoding/json"
 	"fmt"
+	"regexp"
+	"slices"
 	"strings"
 	"time"
 
@@ -15,6 +19,23 @@ func nowTime() *sdktime.Time {
 	return sdktime.New(time.Now().UTC())
 }
 
+// nextTraceID returns a 32-hex-character id shaped like the trace ids the real API puts
+// in error messages, so acceptance goldens normalize local and cloud identically.
+func nextTraceID() string {
+	b := make([]byte, 16)
+	_, _ = rand.Read(b)
+	return hex.EncodeToString(b)
+}
+
+// Backend defaults applied to a project's status when the spec omits them.
+// These mirror the values the real API materializes on create.
+const (
+	defaultHistoryRetention      = 604800 * time.Second // 7 days
+	defaultSuspendTimeout        = 86400 * time.Second  // 1 day
+	defaultAutoscalingLimitMinCu = 1
+	defaultAutoscalingLimitMaxCu = 1
+)
+
 // postgresErrorResponse creates an error response with error code for postgres API.
 func postgresErrorResponse(statusCode int, errorCode, message string) Response {
 	return Response{
@@ -26,6 +47,36 @@ func postgresErrorResponse(statusCode int, errorCode, message string) Response {
 	}
 }
 
+// postgresManagedByParentErrorResponse creates a 400 BAD_REQUEST response that
+// mirrors the real backend's "managed by parent" payload — including the
+// details[].ErrorInfo.metadata.declarative_context=MANAGED_BY_PARENT marker
+// that declarative clients (TF provider, direct engine) use to disregard the
+// delete and rely on the parent to cascade.
+func postgresManagedByParentErrorResponse(message string) Response {
+	return Response{
+		StatusCode: 400,
+		Body: map[string]any{
+			"error_code": "BAD_REQUEST",
+			"message":    message,
+			"details": []any{
+				map[string]any{
+					"@type":  "type.googleapis.com/google.rpc.ErrorInfo",
+					"domain": "databricks.com",
+					"reason": "RESOURCE_CONFLICT",
+					"metadata": map[string]string{
+						"declarative_context": "MANAGED_BY_PARENT",
+					},
+				},
+				map[string]any{
+					"@type":        "type.googleapis.com/google.rpc.RequestInfo",
+					"request_id":   nextUUID(),
+					"serving_data": "",
+				},
+			},
+		},
+	}
+}
+
 // postgresNotFoundResponse creates a NOT_FOUND error response for a resource type.
 func postgresNotFoundResponse(resourceType string) Response {
 	// Include trace ID to match real API behavior for not found errors
@@ -67,28 +118,47 @@ func (s *FakeWorkspace) PostgresProjectCreate(req Request, projectID string) Res
 
 	now := nowTime()
 	project.Name = name
+	project.ProjectId = projectID
 	project.Uid = nextUUID()
 	project.CreateTime = now
 	project.UpdateTime = now
 
 	// Copy spec fields to status (API returns status as materialized view)
 	if project.Spec != nil {
+		// The backend materializes a default retention when the spec omits it.
+		historyRetention := project.Spec.HistoryRetentionDuration
+		if historyRetention == nil {
+			historyRetention = duration.New(defaultHistoryRetention)
+		}
+
 		project.Status = &postgres.ProjectStatus{
+			ProjectId:                   projectID,
 			DefaultBranch:               name + "/branches/production",
 			DisplayName:                 project.Spec.DisplayName,
 			PgVersion:                   project.Spec.PgVersion,
-			HistoryRetentionDuration:    project.Spec.HistoryRetentionDuration,
-			EnablePgNativeLogin:         true,
+			HistoryRetentionDuration:    historyRetention,
+			EnablePgNativeLogin:         false,
 			Owner:                       TestUser.UserName,
 			BranchLogicalSizeLimitBytes: 8796093022208, // 8 TB (real API default)
 			SyntheticStorageSizeBytes:   0,
-			ForceSendFields:             []string{"SyntheticStorageSizeBytes"},
+			ForceSendFields:             []string{"EnablePgNativeLogin", "SyntheticStorageSizeBytes"},
+		}
+
+		// The backend materializes default endpoint settings when the spec omits them.
+		project.Status.DefaultEndpointSettings = &postgres.ProjectDefaultEndpointSettings{
+			AutoscalingLimitMinCu:  defaultAutoscalingLimitMinCu,
+			AutoscalingLimitMaxCu:  defaultAutoscalingLimitMaxCu,
+			SuspendTimeoutDuration: duration.New(defaultSuspendTimeout),
 		}
 		if project.Spec.DefaultEndpointSettings != nil {
-			project.Status.DefaultEndpointSettings = &postgres.ProjectDefaultEndpointSettings{
-				AutoscalingLimitMinCu:  project.Spec.DefaultEndpointSettings.AutoscalingLimitMinCu,
-				AutoscalingLimitMaxCu:  project.Spec.DefaultEndpointSettings.AutoscalingLimitMaxCu,
-				SuspendTimeoutDuration: project.Spec.DefaultEndpointSettings.SuspendTimeoutDuration,
+			if project.Spec.DefaultEndpointSettings.AutoscalingLimitMinCu != 0 {
+				project.Status.DefaultEndpointSettings.AutoscalingLimitMinCu = project.Spec.DefaultEndpointSettings.AutoscalingLimitMinCu
+			}
+			if project.Spec.DefaultEndpointSettings.AutoscalingLimitMaxCu != 0 {
+				project.Status.DefaultEndpointSettings.AutoscalingLimitMaxCu = project.Spec.DefaultEndpointSettings.AutoscalingLimitMaxCu
+			}
+			if project.Spec.DefaultEndpointSettings.SuspendTimeoutDuration != nil {
+				project.Status.DefaultEndpointSettings.SuspendTimeoutDuration = project.Spec.DefaultEndpointSettings.SuspendTimeoutDuration
 			}
 		}
 		// Clear spec so it's not returned in response (API only returns status)
@@ -137,6 +207,10 @@ func (s *FakeWorkspace) PostgresProjectList() Response {
 
 // PostgresProjectUpdate updates a postgres project.
 func (s *FakeWorkspace) PostgresProjectUpdate(req Request, name string) Response {
+	if resp := validateUpdateMask(req, projectUpdateMaskPaths, projectOneofGroups); resp != nil {
+		return *resp
+	}
+
 	defer s.LockUnlock()()
 
 	project, exists := s.PostgresProjects[name]
@@ -162,6 +236,12 @@ func (s *FakeWorkspace) PostgresProjectUpdate(req Request, name string) Response
 		if updateProject.Spec.DisplayName != "" {
 			project.Status.DisplayName = updateProject.Spec.DisplayName
 		}
+		// Verified against a real workspace: dropping the field from config sends a
+		// mask naming it with no value in the body, and the API keeps the previous
+		// value rather than clearing it. So a removal never takes effect.
+		if updateProject.Spec.HistoryRetentionDuration != nil {
+			project.Status.HistoryRetentionDuration = updateProject.Spec.HistoryRetentionDuration
+		}
 		if updateProject.Spec.DefaultEndpointSettings != nil {
 			if project.Status.DefaultEndpointSettings == nil {
 				project.Status.DefaultEndpointSettings = &postgres.ProjectDefaultEndpointSettings{}
@@ -172,18 +252,38 @@ func (s *FakeWorkspace) PostgresProjectUpdate(req Request, name string) Response
 			if updateProject.Spec.DefaultEndpointSettings.AutoscalingLimitMaxCu != 0 {
 				project.Status.DefaultEndpointSettings.AutoscalingLimitMaxCu = updateProject.Spec.DefaultEndpointSettings.AutoscalingLimitMaxCu
 			}
+			if updateProject.Spec.DefaultEndpointSettings.SuspendTimeoutDuration != nil {
+				project.Status.DefaultEndpointSettings.SuspendTimeoutDuration = updateProject.Spec.DefaultEndpointSettings.SuspendTimeoutDuration
+			}
 		}
 	}
 
 	project.UpdateTime = nowTime()
 	s.PostgresProjects[name] = project
 
+	// Whole-spec mask + a body that omits default_endpoint_settings, while the stored
+	// settings are non-default, makes the real API 500 ("could not be processed"): it
+	// resets the message and the emptied autoscaling limits fail validation. The other
+	// masked fields are applied first, though — the failure is a partial write, so the
+	// mutation above is persisted and only this response reports the error. When the
+	// settings are already default, or the message is masked by its own path, the
+	// omission is tolerated. Probed against a real workspace 2026-09-21.
+	if wholeSpecMasked(req.URL.Query().Get("update_mask")) &&
+		(updateProject.Spec == nil || updateProject.Spec.DefaultEndpointSettings == nil) &&
+		project.Status != nil && isNonDefaultEndpointSettings(project.Status.DefaultEndpointSettings) {
+		return postgresErrorResponse(500, "INTERNAL_ERROR",
+			fmt.Sprintf("The request could not be processed. Please try again later and contact Databricks if the problem persists. [TraceId: %s]", nextTraceID()))
+	}
+
 	return Response{
 		Body: s.createOperationLocked(project.Name, project),
 	}
 }
 
-// PostgresProjectDelete deletes a postgres project.
+// PostgresProjectDelete deletes a postgres project. The `purge` query parameter
+// is ignored: acceptance tests assert on the recorded HTTP request rather than
+// on retention semantics, so a single "remove from map" action serves both
+// hard- and soft-delete paths.
 func (s *FakeWorkspace) PostgresProjectDelete(name string) Response {
 	defer s.LockUnlock()()
 
@@ -191,6 +291,22 @@ func (s *FakeWorkspace) PostgresProjectDelete(name string) Response {
 		return postgresNotFoundResponse("project")
 	}
 
+	// Deleting a project cascade-deletes all its branches and endpoints.
+	branchPrefix := name + "/branches/"
+	for brName := range s.PostgresBranches {
+		if strings.HasPrefix(brName, branchPrefix) {
+			delete(s.PostgresBranches, brName)
+			delete(s.postgresImplicitBranches, brName)
+			endpointPrefix := brName + "/endpoints/"
+			for epName := range s.PostgresEndpoints {
+				if strings.HasPrefix(epName, endpointPrefix) {
+					delete(s.PostgresEndpoints, epName)
+					delete(s.postgresImplicitEndpoints, epName)
+				}
+			}
+		}
+	}
+
 	delete(s.PostgresProjects, name)
 
 	return Response{
@@ -199,7 +315,11 @@ func (s *FakeWorkspace) PostgresProjectDelete(name string) Response {
 }
 
 // PostgresBranchCreate creates a new postgres branch.
-func (s *FakeWorkspace) PostgresBranchCreate(req Request, parent, branchID string) Response {
+//
+// When replaceExisting is true, an existing branch with the same ID is updated
+// in place instead of returning ALREADY_EXISTS. This mirrors the backend behavior
+// that lets users bring the implicitly-created production branch under management.
+func (s *FakeWorkspace) PostgresBranchCreate(req Request, parent, branchID string, replaceExisting bool) Response {
 	defer s.LockUnlock()()
 
 	// Validate that branch_id is provided
@@ -224,43 +344,53 @@ func (s *FakeWorkspace) PostgresBranchCreate(req Request, parent, branchID strin
 
 	name := fmt.Sprintf("%s/branches/%s", parent, branchID)
 
-	// Check for duplicate
-	if _, exists := s.PostgresBranches[name]; exists {
+	existing, exists := s.PostgresBranches[name]
+	if exists && !replaceExisting {
 		return postgresErrorResponse(409, "ALREADY_EXISTS", "branch with such id already exists")
 	}
 
 	now := nowTime()
-	branch.Name = name
-	branch.Parent = parent
-	branch.Uid = "br-" + nextUUID()[:20]
-	branch.CreateTime = now
-	branch.UpdateTime = now
-
-	// Find the default branch to use as source
-	var defaultBranch *postgres.Branch
-	prefix := parent + "/branches/"
-	for brName, br := range s.PostgresBranches {
-		if strings.HasPrefix(brName, prefix) && br.Status != nil && br.Status.Default {
-			defaultBranch = &br
-			break
+	branch.BranchId = branchID
+	if exists {
+		// Preserve identifying / output-only fields; apply incoming spec to status.
+		branch.Name = existing.Name
+		branch.Parent = existing.Parent
+		branch.Uid = existing.Uid
+		branch.CreateTime = existing.CreateTime
+		branch.UpdateTime = now
+		branch.Status = existing.Status
+	} else {
+		branch.Name = name
+		branch.Parent = parent
+		branch.Uid = "br-" + nextUUID()[:20]
+		branch.CreateTime = now
+		branch.UpdateTime = now
+		branch.Status = &postgres.BranchStatus{
+			BranchId:         branchID,
+			CurrentState:     postgres.BranchStatusStateReady,
+			StateChangeTime:  now,
+			Default:          false,
+			IsProtected:      false,
+			LogicalSizeBytes: 0,
+			ForceSendFields:  []string{"Default", "IsProtected", "LogicalSizeBytes"},
 		}
-	}
 
-	// Initialize status with all required fields
-	branch.Status = &postgres.BranchStatus{
-		CurrentState:     postgres.BranchStatusStateReady,
-		StateChangeTime:  now,
-		Default:          false,
-		IsProtected:      false,
-		LogicalSizeBytes: 0,
-		ForceSendFields:  []string{"Default", "IsProtected", "LogicalSizeBytes"},
+		// Set source branch info if a default branch exists.
+		prefix := parent + "/branches/"
+		for brName, br := range s.PostgresBranches {
+			if strings.HasPrefix(brName, prefix) && br.Status != nil && br.Status.Default {
+				branch.Status.SourceBranch = br.Name
+				branch.Status.SourceBranchLsn = "0/0"
+				branch.Status.SourceBranchTime = nowTime()
+				break
+			}
+		}
 	}
 
-	// Set source branch info if a default branch exists
-	if defaultBranch != nil {
-		branch.Status.SourceBranch = defaultBranch.Name
-		branch.Status.SourceBranchLsn = "0/0"
-		branch.Status.SourceBranchTime = nowTime()
+	// Apply user-provided spec fields to status (where input fields are surfaced).
+	if branch.Spec != nil {
+		branch.Status.IsProtected = branch.Spec.IsProtected
+		branch.Status.ExpireTime = branch.Spec.ExpireTime
 	}
 
 	// Clear spec - API only returns status
@@ -268,6 +398,12 @@ func (s *FakeWorkspace) PostgresBranchCreate(req Request, parent, branchID strin
 
 	s.PostgresBranches[name] = branch
 
+	// Each branch implicitly provisions a primary read-write endpoint. Only create
+	// it on first branch creation; on replace_existing the primary already exists.
+	if !exists {
+		s.createDefaultEndpointLocked(name)
+	}
+
 	return Response{
 		Body: s.createOperationLocked(branch.Name, branch),
 	}
@@ -322,6 +458,10 @@ func (s *FakeWorkspace) PostgresBranchList(parent string) Response {
 
 // PostgresBranchUpdate updates a postgres branch.
 func (s *FakeWorkspace) PostgresBranchUpdate(req Request, name string) Response {
+	if resp := validateUpdateMask(req, branchUpdateMaskPaths, branchOneofGroups); resp != nil {
+		return *resp
+	}
+
 	defer s.LockUnlock()()
 
 	branch, exists := s.PostgresBranches[name]
@@ -345,6 +485,9 @@ func (s *FakeWorkspace) PostgresBranchUpdate(req Request, name string) Response
 			branch.Status = &postgres.BranchStatus{}
 		}
 		branch.Status.IsProtected = updateBranch.Spec.IsProtected
+		if updateBranch.Spec.ExpireTime != nil {
+			branch.Status.ExpireTime = updateBranch.Spec.ExpireTime
+		}
 	}
 
 	branch.UpdateTime = nowTime()
@@ -355,7 +498,10 @@ func (s *FakeWorkspace) PostgresBranchUpdate(req Request, name string) Response
 	}
 }
 
-// PostgresBranchDelete deletes a postgres branch.
+// PostgresBranchDelete deletes a postgres branch. The `purge` query parameter
+// is ignored: acceptance tests assert on the recorded HTTP request rather than
+// on retention semantics, so a single "remove from map" action serves both
+// hard- and soft-delete paths.
 func (s *FakeWorkspace) PostgresBranchDelete(name string) Response {
 	defer s.LockUnlock()()
 
@@ -364,20 +510,109 @@ func (s *FakeWorkspace) PostgresBranchDelete(name string) Response {
 		return postgresNotFoundResponse("branch")
 	}
 
-	// Check if branch is protected
 	if branch.Status != nil && branch.Status.IsProtected {
 		return postgresErrorResponse(400, "BAD_REQUEST", "cannot delete protected branch")
 	}
 
+	// Branches the server provisioned implicitly (the project's root branch)
+	// cannot be deleted independently; they are removed when the project is
+	// deleted. Matches the real backend's error payload including the
+	// declarative_context=MANAGED_BY_PARENT marker.
+	if s.postgresImplicitBranches[name] {
+		return postgresManagedByParentErrorResponse(fmt.Sprintf("Cannot delete root branch '%s'. Root branches cannot be deleted independently.", name))
+	}
+
+	// Deleting a branch cascade-deletes its endpoints (including the implicit
+	// primary).
+	endpointPrefix := name + "/endpoints/"
+	for epName := range s.PostgresEndpoints {
+		if strings.HasPrefix(epName, endpointPrefix) {
+			delete(s.PostgresEndpoints, epName)
+			delete(s.postgresImplicitEndpoints, epName)
+		}
+	}
+
 	delete(s.PostgresBranches, name)
+	delete(s.postgresImplicitBranches, name)
 
 	return Response{
 		Body: s.createOperationLocked(name, nil),
 	}
 }
 
+var snapshotScheduleUpdateMaskPaths = []string{"schedule"}
+
+// PostgresSnapshotScheduleGet retrieves a branch's snapshot schedule. The
+// schedule is intrinsic to the branch: for a branch that never had one set, the
+// API returns an empty schedule rather than 404, so the fake mirrors that.
+func (s *FakeWorkspace) PostgresSnapshotScheduleGet(name string) Response {
+	defer s.LockUnlock()()
+
+	branchName := strings.TrimSuffix(name, "/snapshot-schedule")
+	if _, exists := s.PostgresBranches[branchName]; !exists {
+		return postgresNotFoundResponse("branch")
+	}
+
+	schedule, exists := s.PostgresSnapshotSchedules[name]
+	if !exists {
+		schedule = postgres.SnapshotSchedule{Name: name}
+	}
+
+	return Response{
+		Body: schedule,
+	}
+}
+
+// PostgresSnapshotScheduleUpdate sets a branch's snapshot schedule. There is no
+// create/delete endpoint; the schedule is managed entirely through this update.
+// An empty schedule set disables automatic snapshots.
+func (s *FakeWorkspace) PostgresSnapshotScheduleUpdate(req Request, name string) Response {
+	if resp := validateUpdateMask(req, snapshotScheduleUpdateMaskPaths, nil); resp != nil {
+		return *resp
+	}
+
+	defer s.LockUnlock()()
+
+	branchName := strings.TrimSuffix(name, "/snapshot-schedule")
+	branch, exists := s.PostgresBranches[branchName]
+	if !exists {
+		return postgresNotFoundResponse("branch")
+	}
+
+	// Snapshots are only allowed on the root (default) branch; the backend
+	// rejects a schedule on any branch created off another.
+	if branch.Status == nil || !branch.Status.Default {
+		return postgresErrorResponse(400, "BAD_REQUEST", "not allowed to snapshot non-root branch")
+	}
+
+	var updateSchedule postgres.SnapshotSchedule
+	if len(req.Body) > 0 {
+		if err := json.Unmarshal(req.Body, &updateSchedule); err != nil {
+			return Response{
+				StatusCode: 400,
+				Body:       fmt.Sprintf("cannot unmarshal request body: %v", err),
+			}
+		}
+	}
+
+	schedule := postgres.SnapshotSchedule{
+		Name:     name,
+		Schedule: updateSchedule.Schedule,
+	}
+	s.PostgresSnapshotSchedules[name] = schedule
+
+	return Response{
+		Body: s.createOperationLocked(name, schedule),
+	}
+}
+
 // PostgresEndpointCreate creates a new postgres endpoint.
-func (s *FakeWorkspace) PostgresEndpointCreate(req Request, parent, endpointID string) Response {
+//
+// When replaceExisting is true, an existing endpoint with the same ID is updated
+// in place instead of returning ALREADY_EXISTS. This mirrors the backend behavior
+// that lets users bring the implicitly-created primary read-write endpoint under
+// management.
+func (s *FakeWorkspace) PostgresEndpointCreate(req Request, parent, endpointID string, replaceExisting bool) Response {
 	defer s.LockUnlock()()
 
 	// Validate that endpoint_id is provided
@@ -403,36 +638,57 @@ func (s *FakeWorkspace) PostgresEndpointCreate(req Request, parent, endpointID s
 
 	name := fmt.Sprintf("%s/endpoints/%s", parent, endpointID)
 
-	// Check for duplicate
-	if _, exists := s.PostgresEndpoints[name]; exists {
+	existing, exists := s.PostgresEndpoints[name]
+	if exists && !replaceExisting {
 		return postgresErrorResponse(409, "ALREADY_EXISTS", "endpoint with such id already exists")
 	}
 
 	now := nowTime()
-	endpoint.Name = name
-	endpoint.Parent = parent
-	endpoint.Uid = "ep-" + nextUUID()[:20]
-	endpoint.CreateTime = now
-	endpoint.UpdateTime = now
-
-	// Get default suspend timeout from project
-	var defaultSuspendTimeout *duration.Duration
-	if project, ok := s.PostgresProjects[branch.Parent]; ok {
-		if project.Status != nil && project.Status.DefaultEndpointSettings != nil {
-			defaultSuspendTimeout = project.Status.DefaultEndpointSettings.SuspendTimeoutDuration
+	endpoint.EndpointId = endpointID
+	if exists {
+		endpoint.Name = existing.Name
+		endpoint.Parent = existing.Parent
+		endpoint.Uid = existing.Uid
+		endpoint.CreateTime = existing.CreateTime
+		endpoint.UpdateTime = now
+		endpoint.Status = existing.Status
+	} else {
+		endpoint.Name = name
+		endpoint.Parent = parent
+		endpoint.Uid = "ep-" + nextUUID()[:20]
+		endpoint.CreateTime = now
+		endpoint.UpdateTime = now
+
+		// Inherit suspend timeout default from the project.
+		var defaultSuspendTimeout *duration.Duration
+		if project, ok := s.PostgresProjects[branch.Parent]; ok {
+			if project.Status != nil && project.Status.DefaultEndpointSettings != nil {
+				defaultSuspendTimeout = project.Status.DefaultEndpointSettings.SuspendTimeoutDuration
+			}
+		}
+
+		endpoint.Status = &postgres.EndpointStatus{
+			EndpointId:             endpointID,
+			CurrentState:           postgres.EndpointStatusStateActive,
+			Disabled:               false,
+			Settings:               &postgres.EndpointSettings{},
+			SuspendTimeoutDuration: defaultSuspendTimeout,
+			ForceSendFields:        []string{"Disabled"},
 		}
-	}
 
-	// Initialize status with all required fields
-	endpoint.Status = &postgres.EndpointStatus{
-		CurrentState:           postgres.EndpointStatusStateActive,
-		Disabled:               false,
-		Settings:               &postgres.EndpointSettings{},
-		SuspendTimeoutDuration: defaultSuspendTimeout,
-		ForceSendFields:        []string{"Disabled"},
+		host := endpoint.Uid + ".database.us-east-1.cloud.databricks.com"
+		endpoint.Status.Hosts = &postgres.EndpointHosts{
+			Host:         host,
+			ReadOnlyHost: host,
+		}
+		endpoint.Status.Group = &postgres.EndpointGroupStatus{
+			EnableReadableSecondaries: true,
+			Max:                       1,
+			Min:                       1,
+		}
 	}
 
-	// Copy spec values to status
+	// Apply user-provided spec to status (where input fields are surfaced).
 	if endpoint.Spec != nil {
 		endpoint.Status.EndpointType = endpoint.Spec.EndpointType
 		endpoint.Status.AutoscalingLimitMinCu = endpoint.Spec.AutoscalingLimitMinCu
@@ -440,23 +696,7 @@ func (s *FakeWorkspace) PostgresEndpointCreate(req Request, parent, endpointID s
 		if endpoint.Spec.SuspendTimeoutDuration != nil {
 			endpoint.Status.SuspendTimeoutDuration = endpoint.Spec.SuspendTimeoutDuration
 		}
-		if endpoint.Spec.Disabled {
-			endpoint.Status.Disabled = true
-		}
-	}
-
-	// Generate fake hosts
-	host := endpoint.Uid + ".database.us-east-1.cloud.databricks.com"
-	endpoint.Status.Hosts = &postgres.EndpointHosts{
-		Host:         host,
-		ReadOnlyHost: host,
-	}
-
-	// Set default group status
-	endpoint.Status.Group = &postgres.EndpointGroupStatus{
-		EnableReadableSecondaries: true,
-		Max:                       1,
-		Min:                       1,
+		endpoint.Status.Disabled = endpoint.Spec.Disabled
 	}
 
 	// Clear spec - API only returns status
@@ -526,7 +766,311 @@ func (s *FakeWorkspace) PostgresEndpointList(parent string) Response {
 }
 
 // PostgresEndpointUpdate updates a postgres endpoint.
+// The update_mask paths each postgres Update accepts, as probed against the real
+// API. The backend rejects anything else with 400, most notably the members of a
+// oneof: it masks them together under the group name and refuses the individual
+// field names. Without these lists the fake accepts any mask and hides that class
+// of bug until a cloud run.
+var endpointUpdateMaskPaths = []string{
+	// The Terraform provider masks the whole spec and sends every field in the
+	// body; the API accepts that.
+	"spec",
+
+	"spec.autoscaling_limit_max_cu",
+	"spec.autoscaling_limit_min_cu",
+	"spec.disabled",
+	"spec.group.enable_readable_secondaries",
+	"spec.group.max",
+	"spec.group.min",
+
+	// A message is maskable on its own, which is how a bundle that adds a whole
+	// settings block reaches the API. Probed on a real endpoint 2026-08-31: both
+	// spec.settings and spec.settings.pg_settings get past mask validation.
+	"spec.settings",
+	"spec.settings.pg_settings",
+
+	"spec.suspension",
+}
+
+var branchUpdateMaskPaths = []string{
+	// The Terraform provider masks the whole spec.
+	"spec",
+
+	"spec.is_protected",
+
+	// expire_time, no_expiry and ttl are three sides of one oneof.
+	"spec.expiration",
+}
+
+var projectUpdateMaskPaths = []string{
+	// The Terraform provider masks the whole spec plus both initial_* specs.
+	"spec",
+	"initial_branch_spec",
+	"initial_endpoint_spec",
+
+	"spec.budget_policy_id",
+	"spec.custom_tags",
+	"spec.default_branch",
+	"spec.default_endpoint_settings",
+	"spec.default_endpoint_settings.autoscaling_limit_max_cu",
+	"spec.default_endpoint_settings.autoscaling_limit_min_cu",
+	"spec.default_endpoint_settings.pg_settings",
+	"spec.display_name",
+	"spec.enable_pg_native_login",
+	"spec.history_retention_duration",
+
+	// default_endpoint_settings.no_suspension and .suspend_timeout_duration are
+	// two sides of one oneof.
+	"spec.default_endpoint_settings.suspension",
+}
+
+// The oneof groups under each spec, mapped to the body fields that can populate them.
+// A mask that names a message expands to the oneof groups beneath it, and each of those
+// must be populated in the request body, even though a plain optional field beneath the
+// same message may be omitted. Probed against a real workspace on 2026-08-31:
+// update_mask=spec.default_endpoint_settings with a body carrying only the autoscaling
+// limits is rejected with "Field 'spec.default_endpoint_settings.suspension' is in
+// update_mask but not provided in request", while the equally absent pg_settings under
+// the same message is tolerated.
+var endpointOneofGroups = map[string][]string{
+	"spec.suspension": {"spec.no_suspension", "spec.suspend_timeout_duration"},
+}
+
+var branchOneofGroups = map[string][]string{
+	"spec.expiration": {"spec.expire_time", "spec.no_expiry", "spec.ttl"},
+}
+
+var projectOneofGroups = map[string][]string{
+	"spec.default_endpoint_settings.suspension": {
+		"spec.default_endpoint_settings.no_suspension",
+		"spec.default_endpoint_settings.suspend_timeout_duration",
+	},
+}
+
+// unpopulatedOneofGroup returns the first oneof group the mask covers but the body does
+// not populate.
+//
+// Only two mask shapes are known to require a group: the group itself, and the nested
+// message directly enclosing it. Masking the top-level spec does not, at either depth.
+// All three were probed against a real workspace on 2026-08-31:
+//
+//	spec.default_endpoint_settings           rejects a body without a suspension field
+//	spec (project, one level above that)     accepts it
+//	spec (endpoint, suspension right below)  accepts it
+//
+// So the rule is not "every group under the mask" and not "every group one level under
+// the mask" either. Rather than guess at the real shape, this only reproduces what was
+// measured; widen it when there is a probe to back the wider rule.
+func unpopulatedOneofGroup(mask string, body map[string]any, groups map[string][]string) string {
+	for group, members := range groups {
+		if !maskCovers(mask, group) {
+			continue
+		}
+		populated := false
+		for _, member := range members {
+			if bodyHasPath(body, strings.Split(member, ".")) {
+				populated = true
+				break
+			}
+		}
+		if !populated {
+			return group
+		}
+	}
+	return ""
+}
+
+func maskCovers(mask, path string) bool {
+	for entry := range strings.SplitSeq(mask, ",") {
+		entry = strings.TrimSpace(entry)
+		// A nested message only: masking the top-level spec does not pull in groups.
+		if entry == path || (entry == parentPath(path) && strings.Contains(entry, ".")) {
+			return true
+		}
+	}
+	return false
+}
+
+// parentPath returns path with its last segment removed, or "" when it has only one.
+func parentPath(path string) string {
+	before, _, ok := strings.CutLast(path, ".")
+	if !ok {
+		return ""
+	}
+	return before
+}
+
+// missingMaskedField returns the first update_mask path the API would reject
+// because the mask names it but the request body carries no value for it, which is
+// how a removal from bundle config reaches the API. Verified against a real
+// workspace: "Field 'spec.history_retention_duration' is in update_mask but not
+// provided in request".
+func missingMaskedField(req Request, oneofGroups map[string][]string) string {
+	mask := req.URL.Query().Get("update_mask")
+	if mask == "" || len(req.Body) == 0 {
+		return ""
+	}
+	var body map[string]any
+	if err := json.Unmarshal(req.Body, &body); err != nil {
+		return ""
+	}
+	for path := range strings.SplitSeq(mask, ",") {
+		path = strings.TrimSpace(path)
+		if _, ok := oneofGroups[path]; ok {
+			// A group is not a body field of its own; a member populates it instead, which
+			// unpopulatedOneofGroup checks.
+			continue
+		}
+		parts := strings.Split(path, ".")
+		if path == "" || path == "*" || len(parts) < 2 {
+			// A whole message the request omits is tolerated: the Terraform provider
+			// masks initial_branch_spec and initial_endpoint_spec without sending
+			// either, and the API accepts that.
+			continue
+		}
+		// Only a field whose parent the request does carry must itself be present.
+		if bodyHasPath(body, parts[:len(parts)-1]) && !bodyHasPath(body, parts) {
+			return path
+		}
+	}
+	return ""
+}
+
+func bodyHasPath(node any, parts []string) bool {
+	for _, part := range parts {
+		m, ok := node.(map[string]any)
+		if !ok {
+			return false
+		}
+		node, ok = m[part]
+		if !ok {
+			return false
+		}
+	}
+	return true
+}
+
+func missingMaskedFieldResponse(path string) Response {
+	return postgresErrorResponse(400, "INVALID_PARAMETER_VALUE", fmt.Sprintf("Field '%s' is in update_mask but not provided in request", path))
+}
+
+// validateUpdateMask mirrors the API's rejection of unknown update_mask paths.
+// Returns nil when every path is accepted.
+func validateUpdateMask(req Request, allowed []string, oneofGroups map[string][]string) *Response {
+	mask := req.URL.Query().Get("update_mask")
+	if mask == "" {
+		return nil
+	}
+	wildcard := false
+	for path := range strings.SplitSeq(mask, ",") {
+		path = strings.TrimSpace(path)
+		if path == "*" {
+			// The API accepts the wildcard, then requires every field populated;
+			// see wildcardMissingField.
+			wildcard = true
+			continue
+		}
+		if path == "" || slices.Contains(allowed, path) {
+			continue
+		}
+		resp := postgresErrorResponse(400, "INVALID_PARAMETER_VALUE", fmt.Sprintf("Unknown field path in update_mask: '%s'", path))
+		return &resp
+	}
+	var body map[string]any
+	_ = json.Unmarshal(req.Body, &body)
+	if wildcard {
+		if path := wildcardMissingField(body, allowed, oneofGroups); path != "" {
+			resp := missingMaskedFieldResponse(path)
+			return &resp
+		}
+		return nil
+	}
+	// An unknown path is reported ahead of a missing one, matching the API.
+	if path := missingMaskedField(req, oneofGroups); path != "" {
+		resp := missingMaskedFieldResponse(path)
+		return &resp
+	}
+	if group := unpopulatedOneofGroup(mask, body, oneofGroups); group != "" {
+		resp := missingMaskedFieldResponse(group)
+		return &resp
+	}
+	return nil
+}
+
+// wholeSpecMasked reports whether the update_mask names the whole spec message (a bare
+// "spec" path), as the Terraform provider does.
+func wholeSpecMasked(mask string) bool {
+	for path := range strings.SplitSeq(mask, ",") {
+		if strings.TrimSpace(path) == "spec" {
+			return true
+		}
+	}
+	return false
+}
+
+// isNonDefaultEndpointSettings reports whether the settings differ from what create
+// materializes by default (autoscaling 1..1, 86400s suspend).
+func isNonDefaultEndpointSettings(s *postgres.ProjectDefaultEndpointSettings) bool {
+	if s == nil {
+		return false
+	}
+	if s.AutoscalingLimitMinCu != defaultAutoscalingLimitMinCu || s.AutoscalingLimitMaxCu != defaultAutoscalingLimitMaxCu {
+		return true
+	}
+	return s.SuspendTimeoutDuration != nil && s.SuspendTimeoutDuration.AsDuration() != defaultSuspendTimeout
+}
+
+// wildcardMissingField returns the first spec field that update_mask=* requires but the
+// body does not carry. The wildcard expands to every settable leaf, and — unlike a bare
+// message mask — the API then demands each one be present (probed against a real
+// workspace: * with a create-shaped body is rejected field by field). The required set is
+// the leaf paths of `allowed`: an entry with no more-specific entry beneath it, a oneof
+// group counting as satisfied by any of its members.
+func wildcardMissingField(body map[string]any, allowed []string, oneofGroups map[string][]string) string {
+	var required []string
+	for _, p := range allowed {
+		if !strings.HasPrefix(p, "spec.") {
+			// "spec" itself and the initial_* specs are not spec leaves.
+			continue
+		}
+		isParent := false
+		for _, q := range allowed {
+			if q != p && strings.HasPrefix(q, p+".") {
+				isParent = true
+				break
+			}
+		}
+		if !isParent {
+			required = append(required, p)
+		}
+	}
+	slices.Sort(required)
+	for _, p := range required {
+		if members, ok := oneofGroups[p]; ok {
+			satisfied := false
+			for _, m := range members {
+				if bodyHasPath(body, strings.Split(m, ".")) {
+					satisfied = true
+					break
+				}
+			}
+			if !satisfied {
+				return p
+			}
+			continue
+		}
+		if !bodyHasPath(body, strings.Split(p, ".")) {
+			return p
+		}
+	}
+	return ""
+}
+
 func (s *FakeWorkspace) PostgresEndpointUpdate(req Request, name string) Response {
+	if resp := validateUpdateMask(req, endpointUpdateMaskPaths, endpointOneofGroups); resp != nil {
+		return *resp
+	}
+
 	defer s.LockUnlock()()
 
 	endpoint, exists := s.PostgresEndpoints[name]
@@ -577,7 +1121,589 @@ func (s *FakeWorkspace) PostgresEndpointDelete(name string) Response {
 		return postgresNotFoundResponse("endpoint")
 	}
 
+	// Endpoints the server provisioned implicitly (the primary read-write
+	// endpoint on every branch) cannot be deleted independently; they are
+	// removed when the parent branch is deleted. Matches the real backend's
+	// error payload including the declarative_context=MANAGED_BY_PARENT marker.
+	if s.postgresImplicitEndpoints[name] {
+		return postgresManagedByParentErrorResponse(fmt.Sprintf("Cannot delete read-write endpoint '%s'. Read-write endpoints cannot be deleted.", name))
+	}
+
 	delete(s.PostgresEndpoints, name)
+	delete(s.postgresImplicitEndpoints, name)
+
+	return Response{
+		Body: s.createOperationLocked(name, nil),
+	}
+}
+
+// PostgresDatabaseCreate creates a new postgres database.
+//
+// When replaceExisting is true, an existing database with the same ID is updated
+// in place instead of returning ALREADY_EXISTS. This mirrors the backend behavior
+// that lets users bring an already-existing database under management.
+func (s *FakeWorkspace) PostgresDatabaseCreate(req Request, parent, databaseID string, replaceExisting bool) Response {
+	defer s.LockUnlock()()
+
+	if databaseID == "" {
+		return postgresErrorResponse(400, "INVALID_PARAMETER_VALUE", `Field 'database_id' is required, expected non-default value (not "")!`)
+	}
+
+	// Check if parent branch exists
+	if _, exists := s.PostgresBranches[parent]; !exists {
+		return postgresNotFoundResponse("branch")
+	}
+
+	var database postgres.Database
+	if len(req.Body) > 0 {
+		if err := json.Unmarshal(req.Body, &database); err != nil {
+			return Response{
+				StatusCode: 400,
+				Body:       fmt.Sprintf("cannot unmarshal request body: %v", err),
+			}
+		}
+	}
+
+	// The real Lakebase API requires the owning role on create and rejects an empty
+	// one with this exact error (verified on aws-ucws 2026-07-13). The fake does
+	// not synthesize a default, matching that behavior.
+	if database.Spec == nil || database.Spec.Role == "" {
+		return postgresErrorResponse(400, "INVALID_PARAMETER_VALUE", `Field 'database.spec.role' is required, expected non-default value (not "")!`)
+	}
+
+	name := fmt.Sprintf("%s/databases/%s", parent, databaseID)
+
+	existing, exists := s.PostgresDatabases[name]
+	if exists && !replaceExisting {
+		// The real Lakebase API returns 400 BAD_REQUEST (not 409) for a duplicate
+		// create, the same as postgres_roles. Match it so the conflict a bundle hits
+		// on a pre-existing database looks the same.
+		return postgresErrorResponse(400, "BAD_REQUEST", "database with that name already exists")
+	}
+
+	now := nowTime()
+	if exists {
+		// Preserve identifying / output-only fields; apply incoming spec to status.
+		status := &postgres.DatabaseDatabaseStatus{
+			DatabaseId:       databaseID,
+			PostgresDatabase: database.Spec.PostgresDatabase,
+			Role:             database.Spec.Role,
+		}
+		existing.UpdateTime = now
+		existing.Status = status
+		existing.Spec = nil
+		s.PostgresDatabases[name] = existing
+
+		return Response{
+			Body: s.createOperationLocked(existing.Name, existing),
+		}
+	}
+
+	database.Name = name
+	database.DatabaseId = databaseID
+	database.Parent = parent
+	database.CreateTime = now
+	database.UpdateTime = now
+
+	// Mirror spec onto status; the real API only echoes Status on GET.
+	status := &postgres.DatabaseDatabaseStatus{
+		DatabaseId:       databaseID,
+		PostgresDatabase: database.Spec.PostgresDatabase,
+		Role:             database.Spec.Role,
+	}
+	database.Status = status
+	database.Spec = nil
+
+	s.PostgresDatabases[name] = database
+
+	return Response{
+		Body: s.createOperationLocked(database.Name, database),
+	}
+}
+
+// PostgresDatabaseGet retrieves a postgres database by name.
+func (s *FakeWorkspace) PostgresDatabaseGet(name string) Response {
+	defer s.LockUnlock()()
+
+	// Extract project and branch names from database name
+	// Format: projects/{project}/branches/{branch}/databases/{database}
+	parts := strings.Split(name, "/branches/")
+	if len(parts) == 2 {
+		projectName := parts[0]
+		if _, exists := s.PostgresProjects[projectName]; !exists {
+			return postgresNotFoundResponse("project")
+		}
+		branchParts := strings.Split(parts[1], "/databases/")
+		if len(branchParts) == 2 {
+			branchName := projectName + "/branches/" + branchParts[0]
+			if _, exists := s.PostgresBranches[branchName]; !exists {
+				return postgresNotFoundResponse("branch")
+			}
+		}
+	}
+
+	database, exists := s.PostgresDatabases[name]
+	if !exists {
+		return postgresNotFoundResponse("database")
+	}
+
+	return Response{
+		Body: database,
+	}
+}
+
+// PostgresDatabaseList lists all postgres databases for a branch.
+func (s *FakeWorkspace) PostgresDatabaseList(parent string) Response {
+	defer s.LockUnlock()()
+
+	if _, exists := s.PostgresBranches[parent]; !exists {
+		return postgresNotFoundResponse("branch")
+	}
+
+	var databases []postgres.Database
+	prefix := parent + "/databases/"
+	for name, d := range s.PostgresDatabases {
+		if strings.HasPrefix(name, prefix) {
+			databases = append(databases, d)
+		}
+	}
+
+	return Response{
+		Body: postgres.ListDatabasesResponse{
+			Databases: databases,
+		},
+	}
+}
+
+// PostgresDatabaseUpdate updates a postgres database.
+func (s *FakeWorkspace) PostgresDatabaseUpdate(req Request, name string) Response {
+	defer s.LockUnlock()()
+
+	database, exists := s.PostgresDatabases[name]
+	if !exists {
+		return postgresNotFoundResponse("database")
+	}
+
+	var updateDatabase postgres.Database
+	if len(req.Body) > 0 {
+		if err := json.Unmarshal(req.Body, &updateDatabase); err != nil {
+			return Response{
+				StatusCode: 400,
+				Body:       fmt.Sprintf("cannot unmarshal request body: %v", err),
+			}
+		}
+	}
+
+	if updateDatabase.Spec != nil {
+		// Preserve database_id which is derived from the resource name.
+		databaseID := ""
+		if database.Status != nil {
+			databaseID = database.Status.DatabaseId
+		}
+		var paths []string
+		if mask := req.URL.Query().Get("update_mask"); mask != "" {
+			paths = strings.Split(mask, ",")
+		}
+		database.Status = applyDatabaseSpecMask(database.Status, databaseStatusFromSpec(updateDatabase.Spec), paths)
+		database.Status.DatabaseId = databaseID
+	}
+
+	database.UpdateTime = nowTime()
+	s.PostgresDatabases[name] = database
+
+	return Response{
+		Body: s.createOperationLocked(database.Name, database),
+	}
+}
+
+// databaseStatusFromSpec mirrors the real Postgres Database server's behavior of
+// echoing the spec onto Status while leaving Spec=nil on GET responses.
+func databaseStatusFromSpec(spec *postgres.DatabaseDatabaseSpec) *postgres.DatabaseDatabaseStatus {
+	status := &postgres.DatabaseDatabaseStatus{}
+	if spec == nil {
+		return status
+	}
+	status.PostgresDatabase = spec.PostgresDatabase
+	status.Role = spec.Role
+	return status
+}
+
+// applyDatabaseSpecMask applies the fields named in paths (the update_mask) from
+// desired onto existing. Paths are relative to the Database and "spec."-prefixed;
+// the bare path "spec" replaces the whole subtree, and an empty paths slice
+// replaces everything. Same shape as applyRoleSpecMask.
+func applyDatabaseSpecMask(existing, desired *postgres.DatabaseDatabaseStatus, paths []string) *postgres.DatabaseDatabaseStatus {
+	if len(paths) == 0 || existing == nil {
+		return desired
+	}
+	result := *existing
+	for _, p := range paths {
+		field, _, _ := strings.Cut(strings.TrimPrefix(p, "spec."), ".")
+		switch field {
+		case "spec":
+			result = *desired
+		case "postgres_database":
+			result.PostgresDatabase = desired.PostgresDatabase
+		case "role":
+			result.Role = desired.Role
+		}
+	}
+	return &result
+}
+
+// PostgresDatabaseDelete deletes a postgres database.
+func (s *FakeWorkspace) PostgresDatabaseDelete(name string) Response {
+	defer s.LockUnlock()()
+
+	if _, exists := s.PostgresDatabases[name]; !exists {
+		return postgresNotFoundResponse("database")
+	}
+
+	delete(s.PostgresDatabases, name)
+
+	return Response{
+		Body: s.createOperationLocked(name, nil),
+	}
+}
+
+// PostgresCatalogCreate creates a new postgres catalog.
+func (s *FakeWorkspace) PostgresCatalogCreate(req Request, catalogID string) Response {
+	defer s.LockUnlock()()
+
+	if catalogID == "" {
+		return postgresErrorResponse(400, "INVALID_PARAMETER_VALUE", `Field 'catalog_id' is required, expected non-default value (not "")!`)
+	}
+
+	// The SDK sends request.Catalog (the inner struct) as the body — NOT a
+	// {"catalog": ...} wrapper. Unmarshal directly into postgres.Catalog.
+	var catalog postgres.Catalog
+	if len(req.Body) > 0 {
+		if err := json.Unmarshal(req.Body, &catalog); err != nil {
+			return Response{
+				StatusCode: 400,
+				Body:       fmt.Sprintf("cannot unmarshal request body: %v", err),
+			}
+		}
+	}
+
+	name := "catalogs/" + catalogID
+
+	if _, exists := s.PostgresCatalogs[name]; exists {
+		return postgresErrorResponse(409, "ALREADY_EXISTS", "catalog with such id already exists")
+	}
+
+	now := nowTime()
+	catalog.Name = name
+	catalog.CatalogId = catalogID
+	catalog.Uid = nextUUID()
+	catalog.CreateTime = now
+	catalog.UpdateTime = now
+
+	status := &postgres.CatalogCatalogStatus{}
+	if catalog.Spec != nil {
+		status.Branch = catalog.Spec.Branch
+		status.PostgresDatabase = catalog.Spec.PostgresDatabase
+		// Project portion of the status is "projects/{project_id}", derived
+		// from the branch name "projects/{project_id}/branches/{branch_id}".
+		if idx := strings.Index(catalog.Spec.Branch, "/branches/"); idx > 0 {
+			status.Project = catalog.Spec.Branch[:idx]
+		}
+	}
+	catalog.Status = status
+
+	// Real API only returns status on GET (no spec). Match that to keep
+	// acceptance test output stable between local and cloud.
+	catalog.Spec = nil
+
+	s.PostgresCatalogs[name] = catalog
+
+	return Response{Body: s.createOperationLocked(name, catalog)}
+}
+
+// PostgresCatalogGet retrieves a postgres catalog by name.
+func (s *FakeWorkspace) PostgresCatalogGet(name string) Response {
+	defer s.LockUnlock()()
+
+	catalog, exists := s.PostgresCatalogs[name]
+	if !exists {
+		return postgresNotFoundResponse("catalog")
+	}
+	return Response{Body: catalog}
+}
+
+// PostgresCatalogDelete deletes a postgres catalog.
+func (s *FakeWorkspace) PostgresCatalogDelete(name string) Response {
+	defer s.LockUnlock()()
+
+	if _, exists := s.PostgresCatalogs[name]; !exists {
+		return postgresNotFoundResponse("catalog")
+	}
+	delete(s.PostgresCatalogs, name)
+	return Response{Body: s.createOperationLocked(name, nil)}
+}
+
+// roleIDPattern matches a valid postgres role_id per RFC 1123: lowercase letters,
+// numbers and hyphens; 4-63 chars; must start with a letter.
+var roleIDPattern = regexp.MustCompile(`^[a-z][a-z0-9-]{3,62}$`)
+
+// roleStatusFromSpec mirrors the real Postgres Role server's behavior of echoing
+// the spec onto Status (plus default-deriving fields the user did not specify)
+// while leaving Spec=nil on GET responses.
+func roleStatusFromSpec(spec *postgres.RoleRoleSpec) *postgres.RoleRoleStatus {
+	status := &postgres.RoleRoleStatus{}
+	if spec == nil {
+		return status
+	}
+	status.PostgresRole = spec.PostgresRole
+	status.MembershipRoles = spec.MembershipRoles
+	status.IdentityType = spec.IdentityType
+	if status.IdentityType == "" {
+		// Server returns IDENTITY_TYPE_UNSPECIFIED for plain Postgres roles.
+		status.IdentityType = "IDENTITY_TYPE_UNSPECIFIED"
+	}
+	status.AuthMethod = spec.AuthMethod
+	if status.AuthMethod == "" {
+		// Server derives auth_method from identity_type when the user omits it:
+		// see SDK comment on postgres.RoleRoleSpec.AuthMethod.
+		switch spec.IdentityType {
+		case postgres.RoleIdentityTypeGroup:
+			status.AuthMethod = postgres.RoleAuthMethodNoLogin
+		case postgres.RoleIdentityTypeUser, postgres.RoleIdentityTypeServicePrincipal:
+			status.AuthMethod = postgres.RoleAuthMethodLakebaseOauthV1
+		default:
+			status.AuthMethod = postgres.RoleAuthMethodPgPasswordScramSha256
+		}
+	}
+	// Real server always echoes an attributes block (all-false when unspecified).
+	attrs := &postgres.RoleAttributes{
+		ForceSendFields: []string{"Bypassrls", "Createdb", "Createrole"},
+	}
+	if spec.Attributes != nil {
+		attrs.Bypassrls = spec.Attributes.Bypassrls
+		attrs.Createdb = spec.Attributes.Createdb
+		attrs.Createrole = spec.Attributes.Createrole
+	}
+	status.Attributes = attrs
+	return status
+}
+
+// PostgresRoleCreate creates a new postgres role.
+//
+// When replaceExisting is true, an existing role with the same ID is updated in
+// place instead of returning ALREADY_EXISTS. This mirrors the backend behavior
+// that lets users bring an inherited/pre-existing role under management.
+func (s *FakeWorkspace) PostgresRoleCreate(req Request, parent, roleID string, replaceExisting bool) Response {
+	defer s.LockUnlock()()
+
+	// Check if parent branch exists
+	if _, exists := s.PostgresBranches[parent]; !exists {
+		return postgresNotFoundResponse("branch")
+	}
+
+	// When role_id is empty the real API generates one; mirror that here so the
+	// CLI's "let the server pick" path is exercised by tests.
+	if roleID == "" {
+		roleID = "role-" + nextUUID()[:8]
+	}
+	if !roleIDPattern.MatchString(roleID) {
+		return postgresErrorResponse(400, "INVALID_PARAMETER_VALUE",
+			`Field 'role_id' must be 4-63 characters, start with a lowercase letter, and contain only lowercase letters, numbers and hyphens (RFC 1123).`)
+	}
+
+	var role postgres.Role
+	if len(req.Body) > 0 {
+		if err := json.Unmarshal(req.Body, &role); err != nil {
+			return Response{
+				StatusCode: 400,
+				Body:       fmt.Sprintf("cannot unmarshal request body: %v", err),
+			}
+		}
+	}
+
+	name := fmt.Sprintf("%s/roles/%s", parent, roleID)
+
+	existing, exists := s.PostgresRoles[name]
+	if exists && !replaceExisting {
+		// The real Lakebase API returns 400 BAD_REQUEST (not 409) for a duplicate
+		// role, with this message (verified on dogfood 2026-06-10). Match it so the
+		// conflict a bundle hits on an inherited/pre-existing role looks the same.
+		return postgresErrorResponse(400, "BAD_REQUEST", "role with that name already exists")
+	}
+
+	now := nowTime()
+	if exists {
+		// Preserve identifying / output-only fields; apply incoming spec to status.
+		existing.UpdateTime = now
+		existing.Status = roleStatusFromSpec(role.Spec)
+		existing.Status.RoleId = roleID
+		existing.Spec = nil
+		s.PostgresRoles[name] = existing
+
+		return Response{
+			Body: s.createOperationLocked(existing.Name, existing),
+		}
+	}
+
+	role.Name = name
+	role.RoleId = roleID
+	role.Parent = parent
+	role.CreateTime = now
+	role.UpdateTime = now
+
+	role.Status = roleStatusFromSpec(role.Spec)
+	role.Status.RoleId = roleID
+	role.Spec = nil
+
+	s.PostgresRoles[name] = role
+
+	return Response{
+		Body: s.createOperationLocked(role.Name, role),
+	}
+}
+
+// PostgresRoleGet retrieves a postgres role by name.
+func (s *FakeWorkspace) PostgresRoleGet(name string) Response {
+	defer s.LockUnlock()()
+
+	// Extract project and branch names from role name
+	// Format: projects/{project}/branches/{branch}/roles/{role}
+	parts := strings.Split(name, "/branches/")
+	if len(parts) == 2 {
+		projectName := parts[0]
+		if _, exists := s.PostgresProjects[projectName]; !exists {
+			return postgresNotFoundResponse("project")
+		}
+		branchParts := strings.Split(parts[1], "/roles/")
+		if len(branchParts) == 2 {
+			branchName := projectName + "/branches/" + branchParts[0]
+			if _, exists := s.PostgresBranches[branchName]; !exists {
+				return postgresNotFoundResponse("branch")
+			}
+		}
+	}
+
+	role, exists := s.PostgresRoles[name]
+	if !exists {
+		return postgresNotFoundResponse("role")
+	}
+
+	return Response{
+		Body: role,
+	}
+}
+
+// PostgresRoleList lists all postgres roles for a branch.
+func (s *FakeWorkspace) PostgresRoleList(parent string) Response {
+	defer s.LockUnlock()()
+
+	if _, exists := s.PostgresBranches[parent]; !exists {
+		return postgresNotFoundResponse("branch")
+	}
+
+	var roles []postgres.Role
+	prefix := parent + "/roles/"
+	for name, r := range s.PostgresRoles {
+		if strings.HasPrefix(name, prefix) {
+			roles = append(roles, r)
+		}
+	}
+
+	return Response{
+		Body: postgres.ListRolesResponse{
+			Roles: roles,
+		},
+	}
+}
+
+// PostgresRoleUpdate updates a postgres role. The update_mask query parameter
+// selects which spec fields to apply; the request body always carries the full
+// desired spec. An empty update_mask updates all fields, matching the API
+// ("if unspecified, all fields will be updated when possible").
+func (s *FakeWorkspace) PostgresRoleUpdate(req Request, name string) Response {
+	defer s.LockUnlock()()
+
+	role, exists := s.PostgresRoles[name]
+	if !exists {
+		return postgresNotFoundResponse("role")
+	}
+
+	var updateRole postgres.Role
+	if len(req.Body) > 0 {
+		if err := json.Unmarshal(req.Body, &updateRole); err != nil {
+			return Response{
+				StatusCode: 400,
+				Body:       fmt.Sprintf("cannot unmarshal request body: %v", err),
+			}
+		}
+	}
+
+	if updateRole.Spec != nil {
+		// Preserve role_id which is derived from the resource name.
+		roleID := ""
+		if role.Status != nil {
+			roleID = role.Status.RoleId
+		}
+		var paths []string
+		if mask := req.URL.Query().Get("update_mask"); mask != "" {
+			paths = strings.Split(mask, ",")
+		}
+		role.Status = applyRoleSpecMask(role.Status, roleStatusFromSpec(updateRole.Spec), paths)
+		role.Status.RoleId = roleID
+	}
+
+	role.UpdateTime = nowTime()
+	s.PostgresRoles[name] = role
+
+	return Response{
+		Body: s.createOperationLocked(role.Name, role),
+	}
+}
+
+// applyRoleSpecMask applies the fields named in paths (the update_mask) from
+// desired onto existing. Paths are relative to the Role and "spec."-prefixed; the
+// bare path "spec" replaces the whole subtree, and an empty paths slice replaces
+// everything.
+//
+// A nested path such as "spec.attributes.createdb" is collapsed to its top-level
+// field ("attributes"), and that whole field is taken from desired. This is a
+// simplification: the real backend masks at the individual leaf (verified on
+// dogfood 2026-06-16 — update_mask=spec.attributes.createdb leaves the sibling
+// attributes untouched), but the direct engine always sends the full spec in the
+// request body, so the collapsed result is identical for the requests it makes.
+func applyRoleSpecMask(existing, desired *postgres.RoleRoleStatus, paths []string) *postgres.RoleRoleStatus {
+	if len(paths) == 0 || existing == nil {
+		return desired
+	}
+	result := *existing
+	for _, p := range paths {
+		field, _, _ := strings.Cut(strings.TrimPrefix(p, "spec."), ".")
+		switch field {
+		case "spec":
+			result = *desired
+		case "postgres_role":
+			result.PostgresRole = desired.PostgresRole
+		case "auth_method":
+			result.AuthMethod = desired.AuthMethod
+		case "identity_type":
+			result.IdentityType = desired.IdentityType
+		case "membership_roles":
+			result.MembershipRoles = desired.MembershipRoles
+		case "attributes":
+			result.Attributes = desired.Attributes
+		}
+	}
+	return &result
+}
+
+// PostgresRoleDelete deletes a postgres role.
+func (s *FakeWorkspace) PostgresRoleDelete(name string) Response {
+	defer s.LockUnlock()()
+
+	if _, exists := s.PostgresRoles[name]; !exists {
+		return postgresNotFoundResponse("role")
+	}
+
+	delete(s.PostgresRoles, name)
 
 	return Response{
 		Body: s.createOperationLocked(name, nil),
@@ -603,11 +1729,24 @@ func (s *FakeWorkspace) createOperationLocked(resourceName string, response any)
 	operationID := nextUUID()
 	operationName := resourceName + "/operations/" + operationID
 
-	// Determine resource type from name for metadata @type
+	// Determine resource type from name for metadata @type.
+	// Check the more specific suffixes first since database/role/endpoint names
+	// also contain "/branches/".
 	resourceType := "Project"
-	if strings.Contains(resourceName, "/endpoints/") {
+	switch {
+	case strings.HasPrefix(resourceName, "catalogs/"):
+		resourceType = "Catalog"
+	case strings.HasPrefix(resourceName, "synced_tables/"):
+		resourceType = "SyncedTable"
+	case strings.HasSuffix(resourceName, "/snapshot-schedule"):
+		resourceType = "SnapshotSchedule"
+	case strings.Contains(resourceName, "/endpoints/"):
 		resourceType = "Endpoint"
-	} else if strings.Contains(resourceName, "/branches/") {
+	case strings.Contains(resourceName, "/databases/"):
+		resourceType = "Database"
+	case strings.Contains(resourceName, "/roles/"):
+		resourceType = "Role"
+	case strings.Contains(resourceName, "/branches/"):
 		resourceType = "Branch"
 	}
 
@@ -628,6 +1767,85 @@ func (s *FakeWorkspace) createOperationLocked(resourceName string, response any)
 	return op
 }
 
+// PostgresSyncedTableCreate creates a new postgres synced table.
+func (s *FakeWorkspace) PostgresSyncedTableCreate(req Request, syncedTableID string) Response {
+	defer s.LockUnlock()()
+
+	if syncedTableID == "" {
+		return postgresErrorResponse(400, "INVALID_PARAMETER_VALUE", `Field 'synced_table_id' is required, expected non-default value (not "")!`)
+	}
+
+	var table postgres.SyncedTable
+	if len(req.Body) > 0 {
+		if err := json.Unmarshal(req.Body, &table); err != nil {
+			return Response{
+				StatusCode: 400,
+				Body:       fmt.Sprintf("cannot unmarshal request body: %v", err),
+			}
+		}
+	}
+
+	name := "synced_tables/" + syncedTableID
+
+	if _, exists := s.PostgresSyncedTables[name]; exists {
+		return postgresErrorResponse(409, "ALREADY_EXISTS", "synced table with such id already exists")
+	}
+	table.Name = name
+	table.Uid = nextUUID()
+	table.CreateTime = nowTime()
+
+	// GET on the real API returns only status; clear spec to match.
+	table.Spec = nil
+	table.Status = &postgres.SyncedTableSyncedTableStatus{
+		DetailedState:                 postgres.SyncedTableStateSyncedTableOnline,
+		UnityCatalogProvisioningState: postgres.ProvisioningInfoStateActive,
+	}
+
+	s.PostgresSyncedTables[name] = table
+
+	return Response{Body: s.createOperationLocked(name, table)}
+}
+
+// PostgresSyncedTableGet retrieves a postgres synced table by name.
+func (s *FakeWorkspace) PostgresSyncedTableGet(name string) Response {
+	defer s.LockUnlock()()
+
+	table, exists := s.PostgresSyncedTables[name]
+	if !exists {
+		return postgresNotFoundResponse("synced table")
+	}
+	return Response{Body: table}
+}
+
+// PostgresSyncedTableDelete deletes a postgres synced table. When the workspace
+// simulates eventual consistency, deletion is asynchronous and slow: the record is
+// not removed but left in DELETING, so GET keeps returning it and a create for the
+// same name keeps hitting 409 — the stuck-teardown race WaitAfterDelete waits out.
+// Otherwise (the default, and terraform, which recreates without polling) it is
+// removed immediately.
+func (s *FakeWorkspace) PostgresSyncedTableDelete(name string) Response {
+	defer s.LockUnlock()()
+
+	table, exists := s.PostgresSyncedTables[name]
+	if !exists {
+		return postgresNotFoundResponse("synced table")
+	}
+
+	if !s.eventualConsistency {
+		delete(s.PostgresSyncedTables, name)
+		return Response{Body: s.createOperationLocked(name, nil)}
+	}
+
+	if table.Status == nil {
+		table.Status = &postgres.SyncedTableSyncedTableStatus{}
+	}
+	table.Status.DetailedState = postgres.SyncedTableStateSyncedTableOffline
+	table.Status.UnityCatalogProvisioningState = postgres.ProvisioningInfoStateDeleting
+	s.PostgresSyncedTables[name] = table
+
+	return Response{Body: s.createOperationLocked(name, nil)}
+}
+
 // createDefaultBranchLocked creates a default branch for a project (caller must hold lock).
 // The default branch is named "production" to match cloud API behavior.
 func (s *FakeWorkspace) createDefaultBranchLocked(projectName string) {
@@ -637,11 +1855,13 @@ func (s *FakeWorkspace) createDefaultBranchLocked(projectName string) {
 
 	defaultBranch := postgres.Branch{
 		Name:       branchName,
+		BranchId:   "production",
 		Parent:     projectName,
 		Uid:        branchUID,
 		CreateTime: now,
 		UpdateTime: now,
 		Status: &postgres.BranchStatus{
+			BranchId:         "production",
 			CurrentState:     postgres.BranchStatusStateReady,
 			StateChangeTime:  now,
 			Default:          true,
@@ -652,4 +1872,62 @@ func (s *FakeWorkspace) createDefaultBranchLocked(projectName string) {
 	}
 
 	s.PostgresBranches[branchName] = defaultBranch
+	s.postgresImplicitBranches[branchName] = true
+
+	// Each branch implicitly provisions a primary read-write endpoint.
+	s.createDefaultEndpointLocked(branchName)
+}
+
+// createDefaultEndpointLocked creates the implicit primary read-write endpoint for
+// a branch (caller must hold lock). The endpoint is named "primary" to match cloud
+// API behavior.
+func (s *FakeWorkspace) createDefaultEndpointLocked(branchName string) {
+	now := nowTime()
+	endpointName := branchName + "/endpoints/primary"
+
+	// Inherit default endpoint settings from the project where available.
+	var (
+		minCu, maxCu   float64
+		suspendTimeout *duration.Duration
+		projectName    = strings.Split(branchName, "/branches/")[0]
+	)
+	if project, ok := s.PostgresProjects[projectName]; ok {
+		if project.Status != nil && project.Status.DefaultEndpointSettings != nil {
+			minCu = project.Status.DefaultEndpointSettings.AutoscalingLimitMinCu
+			maxCu = project.Status.DefaultEndpointSettings.AutoscalingLimitMaxCu
+			suspendTimeout = project.Status.DefaultEndpointSettings.SuspendTimeoutDuration
+		}
+	}
+
+	endpointUID := "ep-" + nextUUID()[:20]
+	host := endpointUID + ".database.us-east-1.cloud.databricks.com"
+
+	s.PostgresEndpoints[endpointName] = postgres.Endpoint{
+		Name:       endpointName,
+		EndpointId: "primary",
+		Parent:     branchName,
+		Uid:        endpointUID,
+		CreateTime: now,
+		UpdateTime: now,
+		Status: &postgres.EndpointStatus{
+			EndpointId:             "primary",
+			EndpointType:           postgres.EndpointTypeEndpointTypeReadWrite,
+			CurrentState:           postgres.EndpointStatusStateActive,
+			Disabled:               false,
+			Settings:               &postgres.EndpointSettings{},
+			AutoscalingLimitMinCu:  minCu,
+			AutoscalingLimitMaxCu:  maxCu,
+			SuspendTimeoutDuration: suspendTimeout,
+			// Primary read-write endpoint exposes only the read-write host;
+			// read_only_host is set on read-only endpoints created later.
+			Hosts: &postgres.EndpointHosts{Host: host},
+			Group: &postgres.EndpointGroupStatus{
+				Max:             1,
+				Min:             1,
+				ForceSendFields: []string{"EnableReadableSecondaries"},
+			},
+			ForceSendFields: []string{"Disabled"},
+		},
+	}
+	s.postgresImplicitEndpoints[endpointName] = true
 }
diff --git a/libs/testserver/postgres_test.go b/libs/testserver/postgres_test.go
index d421212ed9c..1a414cf6762 100644
--- a/libs/testserver/postgres_test.go
+++ b/libs/testserver/postgres_test.go
@@ -3,6 +3,7 @@ package testserver_test
 import (
 	"encoding/json"
 	"net/http"
+	"strings"
 	"testing"
 
 	"github.com/databricks/cli/libs/testserver"
@@ -234,9 +235,11 @@ func TestPostgresEndpointCRUD(t *testing.T) {
 	require.NoError(t, err)
 	assert.Equal(t, 200, listEpResp.StatusCode)
 
+	// Each branch implicitly provisions a "primary" RW endpoint in addition to
+	// the explicitly-created "rw-endpoint".
 	var listEndpoints postgres.ListEndpointsResponse
 	require.NoError(t, json.NewDecoder(listEpResp.Body).Decode(&listEndpoints))
-	assert.Len(t, listEndpoints.Endpoints, 1)
+	assert.Len(t, listEndpoints.Endpoints, 2)
 	listEpResp.Body.Close()
 
 	// Delete endpoint
@@ -248,6 +251,195 @@ func TestPostgresEndpointCRUD(t *testing.T) {
 	deleteEpResp.Body.Close()
 }
 
+func TestPostgresDatabaseCRUD(t *testing.T) {
+	server := testserver.New(t)
+	testserver.AddDefaultHandlers(server)
+
+	client := &http.Client{}
+	baseURL := server.URL
+
+	// Create project first
+	createProjReq, _ := http.NewRequest(http.MethodPost, baseURL+"/api/2.0/postgres/projects?project_id=database-test-project", nil)
+	createProjReq.Header.Set("Authorization", "Bearer test-token")
+	createProjResp, err := client.Do(createProjReq)
+	require.NoError(t, err)
+	assert.Equal(t, 200, createProjResp.StatusCode)
+	createProjResp.Body.Close()
+
+	// Create branch
+	createBranchReq, _ := http.NewRequest(http.MethodPost, baseURL+"/api/2.0/postgres/projects/database-test-project/branches?branch_id=main", nil)
+	createBranchReq.Header.Set("Authorization", "Bearer test-token")
+	createBranchResp, err := client.Do(createBranchReq)
+	require.NoError(t, err)
+	assert.Equal(t, 200, createBranchResp.StatusCode)
+	createBranchResp.Body.Close()
+
+	// Create database
+	createDbBody := `{"spec":{"postgres_database":"my_db","role":"projects/database-test-project/branches/main/roles/owner"}}`
+	createDbReq, _ := http.NewRequest(http.MethodPost, baseURL+"/api/2.0/postgres/projects/database-test-project/branches/main/databases?database_id=my-db", strings.NewReader(createDbBody))
+	createDbReq.Header.Set("Authorization", "Bearer test-token")
+	createDbReq.Header.Set("Content-Type", "application/json")
+	createDbResp, err := client.Do(createDbReq)
+	require.NoError(t, err)
+	assert.Equal(t, 200, createDbResp.StatusCode)
+	createDbResp.Body.Close()
+
+	// Get database
+	getDbReq, _ := http.NewRequest(http.MethodGet, baseURL+"/api/2.0/postgres/projects/database-test-project/branches/main/databases/my-db", nil)
+	getDbReq.Header.Set("Authorization", "Bearer test-token")
+	getDbResp, err := client.Do(getDbReq)
+	require.NoError(t, err)
+	assert.Equal(t, 200, getDbResp.StatusCode)
+
+	var database postgres.Database
+	require.NoError(t, json.NewDecoder(getDbResp.Body).Decode(&database))
+	assert.Equal(t, "projects/database-test-project/branches/main/databases/my-db", database.Name)
+	assert.Equal(t, "projects/database-test-project/branches/main", database.Parent)
+	require.NotNil(t, database.Status)
+	assert.Equal(t, "my_db", database.Status.PostgresDatabase)
+	assert.NotEmpty(t, database.Status.Role)
+	getDbResp.Body.Close()
+
+	// List databases
+	listDbReq, _ := http.NewRequest(http.MethodGet, baseURL+"/api/2.0/postgres/projects/database-test-project/branches/main/databases", nil)
+	listDbReq.Header.Set("Authorization", "Bearer test-token")
+	listDbResp, err := client.Do(listDbReq)
+	require.NoError(t, err)
+	assert.Equal(t, 200, listDbResp.StatusCode)
+
+	var listDatabases postgres.ListDatabasesResponse
+	require.NoError(t, json.NewDecoder(listDbResp.Body).Decode(&listDatabases))
+	assert.Len(t, listDatabases.Databases, 1)
+	listDbResp.Body.Close()
+
+	// Update database (rename via spec.postgres_database)
+	updateDbBody := `{"spec":{"postgres_database":"my_db_renamed"}}`
+	updateDbReq, _ := http.NewRequest(http.MethodPatch, baseURL+"/api/2.0/postgres/projects/database-test-project/branches/main/databases/my-db?update_mask=spec.postgres_database", strings.NewReader(updateDbBody))
+	updateDbReq.Header.Set("Authorization", "Bearer test-token")
+	updateDbReq.Header.Set("Content-Type", "application/json")
+	updateDbResp, err := client.Do(updateDbReq)
+	require.NoError(t, err)
+	assert.Equal(t, 200, updateDbResp.StatusCode)
+	updateDbResp.Body.Close()
+
+	// Verify rename was applied
+	getDbReq2, _ := http.NewRequest(http.MethodGet, baseURL+"/api/2.0/postgres/projects/database-test-project/branches/main/databases/my-db", nil)
+	getDbReq2.Header.Set("Authorization", "Bearer test-token")
+	getDbResp2, err := client.Do(getDbReq2)
+	require.NoError(t, err)
+	assert.Equal(t, 200, getDbResp2.StatusCode)
+	var database2 postgres.Database
+	require.NoError(t, json.NewDecoder(getDbResp2.Body).Decode(&database2))
+	require.NotNil(t, database2.Status)
+	assert.Equal(t, "my_db_renamed", database2.Status.PostgresDatabase)
+	getDbResp2.Body.Close()
+
+	// Delete database
+	deleteDbReq, _ := http.NewRequest(http.MethodDelete, baseURL+"/api/2.0/postgres/projects/database-test-project/branches/main/databases/my-db", nil)
+	deleteDbReq.Header.Set("Authorization", "Bearer test-token")
+	deleteDbResp, err := client.Do(deleteDbReq)
+	require.NoError(t, err)
+	assert.Equal(t, 200, deleteDbResp.StatusCode)
+	deleteDbResp.Body.Close()
+}
+
+func TestPostgresDatabaseNotFoundWhenBranchNotExists(t *testing.T) {
+	server := testserver.New(t)
+	testserver.AddDefaultHandlers(server)
+
+	client := &http.Client{}
+	baseURL := server.URL
+
+	// Create project first
+	createProjReq, _ := http.NewRequest(http.MethodPost, baseURL+"/api/2.0/postgres/projects?project_id=db-test-project", nil)
+	createProjReq.Header.Set("Authorization", "Bearer test-token")
+	createProjResp, err := client.Do(createProjReq)
+	require.NoError(t, err)
+	assert.Equal(t, 200, createProjResp.StatusCode)
+	createProjResp.Body.Close()
+
+	// Try to create database without branch
+	createDbReq, _ := http.NewRequest(http.MethodPost, baseURL+"/api/2.0/postgres/projects/db-test-project/branches/nonexistent/databases?database_id=my-db", nil)
+	createDbReq.Header.Set("Authorization", "Bearer test-token")
+	createDbResp, err := client.Do(createDbReq)
+	require.NoError(t, err)
+	assert.Equal(t, 404, createDbResp.StatusCode)
+	createDbResp.Body.Close()
+}
+
+func TestPostgresDatabaseUpdateMaskPreservesUnmaskedFields(t *testing.T) {
+	server := testserver.New(t)
+	testserver.AddDefaultHandlers(server)
+
+	client := &http.Client{}
+	baseURL := server.URL
+
+	do := func(method, url, body string) *http.Response {
+		req, err := http.NewRequest(method, baseURL+url, strings.NewReader(body))
+		require.NoError(t, err)
+		req.Header.Set("Authorization", "Bearer test-token")
+		req.Header.Set("Content-Type", "application/json")
+		resp, err := client.Do(req)
+		require.NoError(t, err)
+		return resp
+	}
+
+	do(http.MethodPost, "/api/2.0/postgres/projects?project_id=mask-db-project", "").Body.Close()
+	do(http.MethodPost, "/api/2.0/postgres/projects/mask-db-project/branches?branch_id=main", "").Body.Close()
+
+	createBody := `{"spec":{"postgres_database":"app_db","role":"projects/mask-db-project/branches/main/roles/owner"}}`
+	createResp := do(http.MethodPost, "/api/2.0/postgres/projects/mask-db-project/branches/main/databases?database_id=appdb", createBody)
+	require.Equal(t, 200, createResp.StatusCode)
+	createResp.Body.Close()
+
+	// Update only spec.postgres_database. The body also carries a different role,
+	// which must be ignored because it is not named in update_mask.
+	patchBody := `{"spec":{"postgres_database":"renamed_db","role":"projects/mask-db-project/branches/main/roles/other"}}`
+	patchResp := do(http.MethodPatch, "/api/2.0/postgres/projects/mask-db-project/branches/main/databases/appdb?update_mask=spec.postgres_database", patchBody)
+	assert.Equal(t, 200, patchResp.StatusCode)
+	patchResp.Body.Close()
+
+	getResp := do(http.MethodGet, "/api/2.0/postgres/projects/mask-db-project/branches/main/databases/appdb", "")
+	var database postgres.Database
+	require.NoError(t, json.NewDecoder(getResp.Body).Decode(&database))
+	getResp.Body.Close()
+
+	require.NotNil(t, database.Status)
+	assert.Equal(t, "renamed_db", database.Status.PostgresDatabase, "masked field should be updated")
+	assert.Equal(t, "projects/mask-db-project/branches/main/roles/owner", database.Status.Role, "field absent from update_mask should be preserved")
+}
+
+func TestPostgresDatabaseCreateDuplicateReturns400(t *testing.T) {
+	server := testserver.New(t)
+	testserver.AddDefaultHandlers(server)
+
+	client := &http.Client{}
+	baseURL := server.URL
+
+	do := func(method, url, body string) *http.Response {
+		req, err := http.NewRequest(method, baseURL+url, strings.NewReader(body))
+		require.NoError(t, err)
+		req.Header.Set("Authorization", "Bearer test-token")
+		req.Header.Set("Content-Type", "application/json")
+		resp, err := client.Do(req)
+		require.NoError(t, err)
+		return resp
+	}
+
+	do(http.MethodPost, "/api/2.0/postgres/projects?project_id=dup-db-project", "").Body.Close()
+	do(http.MethodPost, "/api/2.0/postgres/projects/dup-db-project/branches?branch_id=main", "").Body.Close()
+
+	createBody := `{"spec":{"postgres_database":"app_db","role":"projects/dup-db-project/branches/main/roles/owner"}}`
+	first := do(http.MethodPost, "/api/2.0/postgres/projects/dup-db-project/branches/main/databases?database_id=appdb", createBody)
+	require.Equal(t, 200, first.StatusCode)
+	first.Body.Close()
+
+	// Creating the same database again fails the way the real API does: 400, not 409.
+	second := do(http.MethodPost, "/api/2.0/postgres/projects/dup-db-project/branches/main/databases?database_id=appdb", createBody)
+	assert.Equal(t, 400, second.StatusCode)
+	second.Body.Close()
+}
+
 func TestPostgresEndpointNotFoundWhenBranchNotExists(t *testing.T) {
 	server := testserver.New(t)
 	testserver.AddDefaultHandlers(server)
@@ -271,3 +463,192 @@ func TestPostgresEndpointNotFoundWhenBranchNotExists(t *testing.T) {
 	assert.Equal(t, 404, createEpResp.StatusCode)
 	createEpResp.Body.Close()
 }
+
+func TestPostgresRoleCRUD(t *testing.T) {
+	server := testserver.New(t)
+	testserver.AddDefaultHandlers(server)
+
+	client := &http.Client{}
+	baseURL := server.URL
+
+	// Create project first
+	createProjReq, _ := http.NewRequest(http.MethodPost, baseURL+"/api/2.0/postgres/projects?project_id=role-test-project", nil)
+	createProjReq.Header.Set("Authorization", "Bearer test-token")
+	createProjResp, err := client.Do(createProjReq)
+	require.NoError(t, err)
+	assert.Equal(t, 200, createProjResp.StatusCode)
+	createProjResp.Body.Close()
+
+	// Create branch
+	createBranchReq, _ := http.NewRequest(http.MethodPost, baseURL+"/api/2.0/postgres/projects/role-test-project/branches?branch_id=main", nil)
+	createBranchReq.Header.Set("Authorization", "Bearer test-token")
+	createBranchResp, err := client.Do(createBranchReq)
+	require.NoError(t, err)
+	assert.Equal(t, 200, createBranchResp.StatusCode)
+	createBranchResp.Body.Close()
+
+	// Create role
+	createRoleBody := `{"spec":{"postgres_role":"my_role"}}`
+	createRoleReq, _ := http.NewRequest(http.MethodPost, baseURL+"/api/2.0/postgres/projects/role-test-project/branches/main/roles?role_id=my-role", strings.NewReader(createRoleBody))
+	createRoleReq.Header.Set("Authorization", "Bearer test-token")
+	createRoleReq.Header.Set("Content-Type", "application/json")
+	createRoleResp, err := client.Do(createRoleReq)
+	require.NoError(t, err)
+	assert.Equal(t, 200, createRoleResp.StatusCode)
+	createRoleResp.Body.Close()
+
+	// Get role
+	getRoleReq, _ := http.NewRequest(http.MethodGet, baseURL+"/api/2.0/postgres/projects/role-test-project/branches/main/roles/my-role", nil)
+	getRoleReq.Header.Set("Authorization", "Bearer test-token")
+	getRoleResp, err := client.Do(getRoleReq)
+	require.NoError(t, err)
+	assert.Equal(t, 200, getRoleResp.StatusCode)
+
+	var role postgres.Role
+	require.NoError(t, json.NewDecoder(getRoleResp.Body).Decode(&role))
+	assert.Equal(t, "projects/role-test-project/branches/main/roles/my-role", role.Name)
+	assert.Equal(t, "projects/role-test-project/branches/main", role.Parent)
+	require.NotNil(t, role.Status)
+	assert.Equal(t, "my_role", role.Status.PostgresRole)
+	getRoleResp.Body.Close()
+
+	// List roles
+	listRoleReq, _ := http.NewRequest(http.MethodGet, baseURL+"/api/2.0/postgres/projects/role-test-project/branches/main/roles", nil)
+	listRoleReq.Header.Set("Authorization", "Bearer test-token")
+	listRoleResp, err := client.Do(listRoleReq)
+	require.NoError(t, err)
+	assert.Equal(t, 200, listRoleResp.StatusCode)
+
+	var listRoles postgres.ListRolesResponse
+	require.NoError(t, json.NewDecoder(listRoleResp.Body).Decode(&listRoles))
+	assert.Len(t, listRoles.Roles, 1)
+	listRoleResp.Body.Close()
+
+	// Update role (rename via spec.postgres_role)
+	updateRoleBody := `{"spec":{"postgres_role":"my_role_renamed"}}`
+	updateRoleReq, _ := http.NewRequest(http.MethodPatch, baseURL+"/api/2.0/postgres/projects/role-test-project/branches/main/roles/my-role", strings.NewReader(updateRoleBody))
+	updateRoleReq.Header.Set("Authorization", "Bearer test-token")
+	updateRoleReq.Header.Set("Content-Type", "application/json")
+	updateRoleResp, err := client.Do(updateRoleReq)
+	require.NoError(t, err)
+	assert.Equal(t, 200, updateRoleResp.StatusCode)
+	updateRoleResp.Body.Close()
+
+	// Verify rename was applied
+	getRoleReq2, _ := http.NewRequest(http.MethodGet, baseURL+"/api/2.0/postgres/projects/role-test-project/branches/main/roles/my-role", nil)
+	getRoleReq2.Header.Set("Authorization", "Bearer test-token")
+	getRoleResp2, err := client.Do(getRoleReq2)
+	require.NoError(t, err)
+	assert.Equal(t, 200, getRoleResp2.StatusCode)
+	var role2 postgres.Role
+	require.NoError(t, json.NewDecoder(getRoleResp2.Body).Decode(&role2))
+	require.NotNil(t, role2.Status)
+	assert.Equal(t, "my_role_renamed", role2.Status.PostgresRole)
+	getRoleResp2.Body.Close()
+
+	// Delete role
+	deleteRoleReq, _ := http.NewRequest(http.MethodDelete, baseURL+"/api/2.0/postgres/projects/role-test-project/branches/main/roles/my-role", nil)
+	deleteRoleReq.Header.Set("Authorization", "Bearer test-token")
+	deleteRoleResp, err := client.Do(deleteRoleReq)
+	require.NoError(t, err)
+	assert.Equal(t, 200, deleteRoleResp.StatusCode)
+	deleteRoleResp.Body.Close()
+}
+
+func TestPostgresRoleUpdateMaskPreservesUnmaskedFields(t *testing.T) {
+	server := testserver.New(t)
+	testserver.AddDefaultHandlers(server)
+
+	client := &http.Client{}
+	baseURL := server.URL
+
+	do := func(method, url, body string) *http.Response {
+		req, err := http.NewRequest(method, baseURL+url, strings.NewReader(body))
+		require.NoError(t, err)
+		req.Header.Set("Authorization", "Bearer test-token")
+		req.Header.Set("Content-Type", "application/json")
+		resp, err := client.Do(req)
+		require.NoError(t, err)
+		return resp
+	}
+
+	do(http.MethodPost, "/api/2.0/postgres/projects?project_id=mask-project", "").Body.Close()
+	do(http.MethodPost, "/api/2.0/postgres/projects/mask-project/branches?branch_id=main", "").Body.Close()
+
+	createBody := `{"spec":{"postgres_role":"app_role","attributes":{"createdb":false}}}`
+	createResp := do(http.MethodPost, "/api/2.0/postgres/projects/mask-project/branches/main/roles?role_id=approle", createBody)
+	require.Equal(t, 200, createResp.StatusCode)
+	createResp.Body.Close()
+
+	// Update only spec.attributes.createdb. The body also carries a different
+	// postgres_role, which must be ignored because it is not named in update_mask.
+	patchBody := `{"spec":{"postgres_role":"renamed","attributes":{"createdb":true}}}`
+	patchResp := do(http.MethodPatch, "/api/2.0/postgres/projects/mask-project/branches/main/roles/approle?update_mask=spec.attributes.createdb", patchBody)
+	assert.Equal(t, 200, patchResp.StatusCode)
+	patchResp.Body.Close()
+
+	getResp := do(http.MethodGet, "/api/2.0/postgres/projects/mask-project/branches/main/roles/approle", "")
+	var role postgres.Role
+	require.NoError(t, json.NewDecoder(getResp.Body).Decode(&role))
+	getResp.Body.Close()
+
+	require.NotNil(t, role.Status)
+	require.NotNil(t, role.Status.Attributes)
+	assert.True(t, role.Status.Attributes.Createdb, "masked field should be updated")
+	assert.Equal(t, "app_role", role.Status.PostgresRole, "field absent from update_mask should be preserved")
+}
+
+func TestPostgresRoleNotFoundWhenBranchNotExists(t *testing.T) {
+	server := testserver.New(t)
+	testserver.AddDefaultHandlers(server)
+
+	client := &http.Client{}
+	baseURL := server.URL
+
+	// Create project first
+	createProjReq, _ := http.NewRequest(http.MethodPost, baseURL+"/api/2.0/postgres/projects?project_id=role-no-branch-project", nil)
+	createProjReq.Header.Set("Authorization", "Bearer test-token")
+	createProjResp, err := client.Do(createProjReq)
+	require.NoError(t, err)
+	assert.Equal(t, 200, createProjResp.StatusCode)
+	createProjResp.Body.Close()
+
+	// Try to create role without branch
+	createRoleReq, _ := http.NewRequest(http.MethodPost, baseURL+"/api/2.0/postgres/projects/role-no-branch-project/branches/nonexistent/roles?role_id=my-role", nil)
+	createRoleReq.Header.Set("Authorization", "Bearer test-token")
+	createRoleResp, err := client.Do(createRoleReq)
+	require.NoError(t, err)
+	assert.Equal(t, 404, createRoleResp.StatusCode)
+	createRoleResp.Body.Close()
+}
+
+func TestPostgresRoleCreateDuplicateReturns400(t *testing.T) {
+	server := testserver.New(t)
+	testserver.AddDefaultHandlers(server)
+
+	client := &http.Client{}
+	baseURL := server.URL
+
+	do := func(method, url, body string) *http.Response {
+		req, err := http.NewRequest(method, baseURL+url, strings.NewReader(body))
+		require.NoError(t, err)
+		req.Header.Set("Authorization", "Bearer test-token")
+		req.Header.Set("Content-Type", "application/json")
+		resp, err := client.Do(req)
+		require.NoError(t, err)
+		return resp
+	}
+
+	do(http.MethodPost, "/api/2.0/postgres/projects?project_id=dup-role-project", "").Body.Close()
+	do(http.MethodPost, "/api/2.0/postgres/projects/dup-role-project/branches?branch_id=main", "").Body.Close()
+
+	createBody := `{"spec":{"postgres_role":"app_role"}}`
+	first := do(http.MethodPost, "/api/2.0/postgres/projects/dup-role-project/branches/main/roles?role_id=approle", createBody)
+	require.Equal(t, 200, first.StatusCode)
+	first.Body.Close()
+
+	// Creating the same role again fails the way the real API does: 400, not 409.
+	second := do(http.MethodPost, "/api/2.0/postgres/projects/dup-role-project/branches/main/roles?role_id=approle", createBody)
+	assert.Equal(t, 400, second.StatusCode)
+	second.Body.Close()
+}
diff --git a/acceptance/internal/process_unix.go b/libs/testserver/process_unix.go
similarity index 94%
rename from acceptance/internal/process_unix.go
rename to libs/testserver/process_unix.go
index 1e0b0ead3e1..8b82187580e 100644
--- a/acceptance/internal/process_unix.go
+++ b/libs/testserver/process_unix.go
@@ -1,6 +1,6 @@
 //go:build linux || darwin
 
-package internal
+package testserver
 
 import (
 	"syscall"
diff --git a/acceptance/internal/process_windows.go b/libs/testserver/process_windows.go
similarity index 96%
rename from acceptance/internal/process_windows.go
rename to libs/testserver/process_windows.go
index fdad8b4f5e2..2a32fe4ede0 100644
--- a/acceptance/internal/process_windows.go
+++ b/libs/testserver/process_windows.go
@@ -1,6 +1,6 @@
 //go:build windows
 
-package internal
+package testserver
 
 import (
 	"time"
diff --git a/libs/testserver/registered_models.go b/libs/testserver/registered_models.go
index e3723a95e9e..b6fb800a623 100644
--- a/libs/testserver/registered_models.go
+++ b/libs/testserver/registered_models.go
@@ -8,6 +8,10 @@ import (
 	"github.com/databricks/databricks-sdk-go/service/catalog"
 )
 
+// modelNameBrowseOnly scopes the computed browse_only flag to the browse_only
+// drift test, keeping unrelated tests free of it.
+const modelNameBrowseOnly = "model_browse_only"
+
 func (s *FakeWorkspace) RegisteredModelsCreate(req Request) Response {
 	defer s.LockUnlock()()
 
@@ -36,6 +40,10 @@ func (s *FakeWorkspace) RegisteredModelsCreate(req Request) Response {
 		Owner:           s.CurrentUser().UserName,
 	}
 	registeredModel.UpdatedAt = registeredModel.CreatedAt
+	if createRequest.Name == modelNameBrowseOnly {
+		// Mirror UC, which computes browse_only and echoes it on GET.
+		registeredModel.BrowseOnly = true
+	}
 
 	s.RegisteredModels[fullName] = registeredModel
 	return Response{
@@ -54,6 +62,11 @@ func (s *FakeWorkspace) RegisteredModelsUpdate(req Request, fullName string) Res
 		}
 	}
 
+	fields, errResponse := parseUpdateFields(req.Body)
+	if errResponse != nil {
+		return *errResponse
+	}
+
 	var updateRequest catalog.UpdateRegisteredModelRequest
 	if err := json.Unmarshal(req.Body, &updateRequest); err != nil {
 		return Response{
@@ -62,13 +75,8 @@ func (s *FakeWorkspace) RegisteredModelsUpdate(req Request, fullName string) Res
 		}
 	}
 
-	// Update only the fields that can be updated
-	if updateRequest.Comment != "" {
-		existing.Comment = updateRequest.Comment
-	}
-	if updateRequest.Owner != "" {
-		existing.Owner = updateRequest.Owner
-	}
+	applyUpdatedFields(&existing, updateRequest, fields)
+
 	if updateRequest.NewName != "" {
 		existing.Name = updateRequest.NewName
 
diff --git a/libs/testserver/repos.go b/libs/testserver/repos.go
index 7f1b959a096..30c090b5b41 100644
--- a/libs/testserver/repos.go
+++ b/libs/testserver/repos.go
@@ -9,6 +9,11 @@ import (
 	"github.com/databricks/databricks-sdk-go/service/workspace"
 )
 
+// fakeHeadCommitID is the commit the fake reports a clone is checked out to.
+// Nothing is cloned here, so the remote's real HEAD is unknowable. The counting
+// prefix marks it as synthetic, so it is not mistaken for a real sha.
+const fakeHeadCommitID = "0a1b2c3d4e5f6a7b8e7dadd73e50a69d8ba47d8f"
+
 func (s *FakeWorkspace) ReposCreate(req Request) Response {
 	defer s.LockUnlock()()
 
@@ -21,15 +26,16 @@ func (s *FakeWorkspace) ReposCreate(req Request) Response {
 		}
 	}
 
-	repoId := nextID()
+	repoId := nextTreenodeID()
 	id := strconv.FormatInt(repoId, 10)
 
 	repoInfo := workspace.RepoInfo{
-		Id:       repoId,
-		Path:     repoReq.Path,
-		Provider: repoReq.Provider,
-		Url:      repoReq.Url,
-		Branch:   "main",
+		Id:           repoId,
+		Path:         repoReq.Path,
+		Provider:     repoReq.Provider,
+		Url:          repoReq.Url,
+		Branch:       "main",
+		HeadCommitId: fakeHeadCommitID,
 	}
 
 	s.Repos[id] = repoInfo
diff --git a/libs/testserver/router.go b/libs/testserver/router.go
index 00381eae6a9..bcf5493b347 100644
--- a/libs/testserver/router.go
+++ b/libs/testserver/router.go
@@ -93,6 +93,18 @@ func (r *Router) Handle(method, path string, handler HandlerFunc) {
 	})
 }
 
+// HandleRaw registers a handler with the raw ResponseWriter and Request, bypassing
+// the JSON serve() pipeline, for endpoints that take over the connection (e.g. a
+// websocket upgrade). First registration wins; only wildcard patterns are supported.
+func (r *Router) HandleRaw(method, path string, handler http.HandlerFunc) {
+	pattern := method + " " + path
+	if r.wildcard[pattern] {
+		return
+	}
+	r.wildcard[pattern] = true
+	r.mux.HandleFunc(pattern, handler)
+}
+
 // ServeHTTP routes a request to the registered handler, falling back to
 // NotFound if no route matches.
 func (r *Router) ServeHTTP(w http.ResponseWriter, req *http.Request) {
diff --git a/libs/testserver/schemas.go b/libs/testserver/schemas.go
index 1d4dc79e7ac..8094c93acc6 100644
--- a/libs/testserver/schemas.go
+++ b/libs/testserver/schemas.go
@@ -4,13 +4,19 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"strings"
 
-	"dario.cat/mergo"
 	"github.com/databricks/databricks-sdk-go/service/catalog"
 )
 
 const testMetastoreName = "deco-uc-prod-isolated-aws-us-east-1"
 
+// schemaNameManagedDefaults is the schema name the backend-default drift test uses
+// to opt into UC's managed-property simulation. Scoping the injection to this name
+// keeps unrelated schema tests free of the property, which terraform would otherwise
+// report as drift on redeploy.
+const schemaNameManagedDefaults = "schema_managed_defaults"
+
 func (s *FakeWorkspace) SchemasCreate(req Request) Response {
 	defer s.LockUnlock()()
 
@@ -23,6 +29,10 @@ func (s *FakeWorkspace) SchemasCreate(req Request) Response {
 		}
 	}
 
+	// UC normalizes schema names to lowercase.
+	schema.Name = strings.ToLower(schema.Name)
+	// Strip trailing slash to mimic UC API normalization behavior (see volumes.go).
+	schema.StorageRoot = strings.TrimRight(schema.StorageRoot, "/")
 	schema.FullName = schema.CatalogName + "." + schema.Name
 	schema.ForceSendFields = []string{"BrowseOnly"}
 	schema.CatalogType = "MANAGED_CATALOG"
@@ -33,12 +43,27 @@ func (s *FakeWorkspace) SchemasCreate(req Request) Response {
 	schema.EffectivePredictiveOptimizationFlag = &catalog.EffectivePredictiveOptimizationFlag{
 		InheritedFromName: testMetastoreName,
 		InheritedFromType: catalog.EffectivePredictiveOptimizationFlagInheritedFromType("METASTORE"),
-		Value:             catalog.EnablePredictiveOptimizationEnable,
+		// Mirror the real test metastore, which inherits ENABLE, so a single
+		// golden stays valid for both local and cloud runs.
+		Value: catalog.EnablePredictiveOptimizationEnable,
 	}
 	schema.EnablePredictiveOptimization = catalog.EnablePredictiveOptimizationInherit
 	schema.MetastoreId = TestMetastore.MetastoreId
 	schema.Owner = s.CurrentUser().UserName
 	schema.SchemaId = nextUUID()
+	if schema.Properties == nil && schema.Name == schemaNameManagedDefaults {
+		// Mirror UC behavior: managed system defaults are populated when the user
+		// doesn't specify any properties. Required to cover backend-default drift.
+		schema.Properties = map[string]string{
+			"unity.catalog.managed.delta.defaults.delta.enableRowTracking":                   "true",
+			"unity.catalog.managed.iceberg.defaults.delta.feature.catalogManaged":            "true",
+			"unity.catalog.managed.delta.defaults.defaultClusterByAuto":                      "true",
+			"unity.catalog.managed.delta.defaults.delta.checkpointPolicy":                    "v2",
+			"unity.catalog.managed.delta.defaults.delta.parquet.format.version":              "2.12.0",
+			"unity.catalog.managed.delta.defaults.delta.parquet.format.version.afe.internal": "2.12.0",
+			"unity.catalog.managed.delta.defaults.delta.feature.catalogManaged":              "supported",
+		}
+	}
 	s.Schemas[schema.FullName] = schema
 
 	return Response{
@@ -56,6 +81,11 @@ func (s *FakeWorkspace) SchemasUpdate(req Request, name string) Response {
 		}
 	}
 
+	fields, errResponse := parseUCUpdate(req.Body, "UpdateSchema")
+	if errResponse != nil {
+		return *errResponse
+	}
+
 	var schemaUpdate catalog.SchemaInfo
 
 	if err := json.Unmarshal(req.Body, &schemaUpdate); err != nil {
@@ -65,13 +95,7 @@ func (s *FakeWorkspace) SchemasUpdate(req Request, name string) Response {
 		}
 	}
 
-	err := mergo.Merge(&existing, schemaUpdate, mergo.WithOverride)
-	if err != nil {
-		return Response{
-			Body:       fmt.Sprintf("mergo error: %s", err),
-			StatusCode: http.StatusInternalServerError,
-		}
-	}
+	applyUpdatedFields(&existing, schemaUpdate, fields)
 
 	existing.UpdatedAt = nowMilli()
 	existing.UpdatedBy = s.CurrentUser().UserName
diff --git a/libs/testserver/secrets.go b/libs/testserver/secrets.go
index 1f298ea9f0c..c86122c54ec 100644
--- a/libs/testserver/secrets.go
+++ b/libs/testserver/secrets.go
@@ -4,6 +4,7 @@ import (
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
+	"slices"
 
 	"github.com/databricks/databricks-sdk-go/service/workspace"
 )
@@ -34,12 +35,57 @@ func (s *FakeWorkspace) SecretsPut(req Request) Response {
 		s.Secrets[request.Scope] = make(map[string]string)
 	}
 
-	// Store the secret value
-	s.Secrets[request.Scope][request.Key] = request.StringValue
+	// Exactly one of string_value / bytes_value is set. bytes_value arrives
+	// already base64-encoded, and GET returns whatever was stored re-encoded,
+	// so decode it here to keep the stored form the raw secret in both cases.
+	value := request.StringValue
+	if request.BytesValue != "" {
+		decoded, err := base64.StdEncoding.DecodeString(request.BytesValue)
+		if err != nil {
+			return Response{
+				StatusCode: 400,
+				Body:       map[string]string{"error_code": "INVALID_PARAMETER_VALUE", "message": "bytes_value must be base64-encoded"},
+			}
+		}
+		value = string(decoded)
+	}
+	s.Secrets[request.Scope][request.Key] = value
 
 	return Response{}
 }
 
+// SecretsList models GET /api/2.0/secrets/list. A missing scope must return
+// RESOURCE_DOES_NOT_EXIST so callers can branch on apierr.ErrResourceDoesNotExist.
+func (s *FakeWorkspace) SecretsList(req Request) Response {
+	defer s.LockUnlock()()
+
+	scope := req.URL.Query().Get("scope")
+
+	if _, exists := s.SecretScopes[scope]; !exists {
+		return Response{
+			StatusCode: 404,
+			Body:       map[string]string{"error_code": "RESOURCE_DOES_NOT_EXIST", "message": fmt.Sprintf("Scope %s does not exist", scope)},
+		}
+	}
+
+	keys := make([]string, 0, len(s.Secrets[scope]))
+	for key := range s.Secrets[scope] {
+		keys = append(keys, key)
+	}
+	slices.Sort(keys)
+
+	secrets := make([]workspace.SecretMetadata, 0, len(keys))
+	for _, key := range keys {
+		secrets = append(secrets, workspace.SecretMetadata{Key: key})
+	}
+
+	return Response{
+		Body: workspace.ListSecretsResponse{
+			Secrets: secrets,
+		},
+	}
+}
+
 func (s *FakeWorkspace) SecretsGet(req Request) Response {
 	defer s.LockUnlock()()
 
diff --git a/libs/testserver/server.go b/libs/testserver/server.go
index 40556e55294..5170b318818 100644
--- a/libs/testserver/server.go
+++ b/libs/testserver/server.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"io"
 	"maps"
+	"net"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
@@ -17,12 +18,31 @@ import (
 	"sync"
 
 	"github.com/databricks/cli/internal/testutil"
+	"github.com/databricks/cli/libs/testserver/testsql"
 )
 
 const testPidKey = "test-pid"
 
 var testPidRegex = regexp.MustCompile(testPidKey + `/(\d+)`)
 
+// IsLocalhostProbe reports whether r is an external port-classification probe
+// rather than traffic from the CLI-under-test or its helper scripts.
+//
+// Some Databricks-internal development environments run a port watcher that
+// auto-forwards every new localhost listener and probes it to decide whether it
+// speaks HTTP or HTTPS, connecting back and sending `HEAD / HTTP/1.0` with
+// `Host: localhost`. All legitimate test traffic is configured against
+// 127.0.0.1:PORT, so the Host is the reliable discriminator: a request whose
+// host is bare "localhost" never originates from the test. The method and path
+// checks keep the match tight so a genuinely misdirected request still surfaces.
+func IsLocalhostProbe(r *http.Request) bool {
+	host := r.Host
+	if h, _, err := net.SplitHostPort(host); err == nil {
+		host = h
+	}
+	return host == "localhost" && r.Method == http.MethodHead && r.URL.Path == "/"
+}
+
 func ExtractPidFromHeaders(headers http.Header) int {
 	ua := headers.Get("User-Agent")
 	matches := testPidRegex.FindStringSubmatch(ua)
@@ -46,6 +66,11 @@ type Server struct {
 	fakeOidc       *FakeOidc
 	mu             sync.Mutex
 
+	kills  *killRules
+	faults *FaultRules
+
+	sqlHandler *testsql.Handler
+
 	RequestCallback  func(request *Request)
 	ResponseCallback func(request *Request, response *EncodedResponse)
 }
@@ -58,6 +83,7 @@ type Request struct {
 	Vars      map[string]string
 	Workspace *FakeWorkspace
 	Context   context.Context
+	Token     string
 }
 
 type Response struct {
@@ -200,7 +226,20 @@ func getHeaders(value []byte) http.Header {
 
 func New(t testutil.TestingT) *Server {
 	router := NewRouter()
-	server := httptest.NewServer(router)
+	kills := newKillRules()
+	faults := NewFaultRules()
+
+	// Wrap the router so kill rules fire for ALL requests, including those with
+	// no registered handler that would otherwise bypass serve() entirely.
+	killMiddleware := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		token := getToken(r)
+		if kills.check(t, r.Method, r.URL.Path, token, r.Header) {
+			return
+		}
+		router.ServeHTTP(w, r)
+	})
+
+	server := httptest.NewServer(killMiddleware)
 	t.Cleanup(server.Close)
 
 	s := &Server{
@@ -209,6 +248,9 @@ func New(t testutil.TestingT) *Server {
 		t:              t,
 		fakeWorkspaces: map[string]*FakeWorkspace{},
 		fakeOidc:       &FakeOidc{url: server.URL},
+		kills:          kills,
+		faults:         faults,
+		sqlHandler:     testsql.New(),
 	}
 	router.Dispatch = s.serve
 
@@ -220,6 +262,13 @@ func New(t testutil.TestingT) *Server {
 
 	// Set up the not found handler as fallback
 	notFoundFunc := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Answer external port-classification probes benignly instead of failing
+		// the test with a spurious "No handler" error. See IsLocalhostProbe.
+		if IsLocalhostProbe(r) {
+			w.WriteHeader(http.StatusOK)
+			return
+		}
+
 		pattern := r.Method + " " + r.URL.Path
 		bodyBytes, err := io.ReadAll(r.Body)
 		var body string
@@ -258,6 +307,10 @@ Response.Body = '<response body here>'
 	})
 	router.NotFound = notFoundFunc
 
+	// Register test-only endpoints for setting up kill and fault rules from scripts.
+	s.Handle("POST", "/__testserver/kill", killEndpointHandler(s.kills))
+	s.Handle("POST", "/__testserver/fault", faultEndpointHandler(s.faults))
+
 	// Register a default handler for the SDK's host metadata discovery endpoint.
 	// The SDK resolves this during config initialization (as of v0.126.0) to
 	// determine workspace/account IDs, cloud, and OIDC endpoints. Without this
@@ -266,35 +319,52 @@ Response.Body = '<response body here>'
 	s.Handle("GET", "/.well-known/databricks-config", func(_ Request) any {
 		return map[string]any{
 			"oidc_endpoint": server.URL + "/oidc",
-			"workspace_id":  "900800700600",
+			"workspace_id":  strconv.Itoa(TestWorkspaceID),
 		}
 	})
 
 	return s
 }
 
+// workspaceKeyForToken strips the identity prefix so a test's user, primary SP,
+// and guest tokens resolve to the same FakeWorkspace and share state. The uuid
+// suffix keeps distinct tests isolated.
+func workspaceKeyForToken(token string) string {
+	for _, prefix := range []string{UserNameTokenPrefix, ServicePrincipalTokenPrefix, GuestServicePrincipalTokenPrefix} {
+		if s, ok := strings.CutPrefix(token, prefix); ok {
+			return s
+		}
+	}
+	return token
+}
+
 func (s *Server) getWorkspaceForToken(token string) *FakeWorkspace {
 	if token == "" {
 		return nil
 	}
 
+	key := workspaceKeyForToken(token)
+
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
-	if _, ok := s.fakeWorkspaces[token]; !ok {
-		s.fakeWorkspaces[token] = NewFakeWorkspace(s.URL, token)
+	if _, ok := s.fakeWorkspaces[key]; !ok {
+		s.fakeWorkspaces[key] = NewFakeWorkspace(s.URL, token)
 	}
 
-	return s.fakeWorkspaces[token]
+	return s.fakeWorkspaces[key]
 }
 
 func (s *Server) serve(w http.ResponseWriter, r *http.Request, handler HandlerFunc, vars map[string]string) {
+	token := getToken(r)
+
 	// Each test uses unique DATABRICKS_TOKEN, we simulate each token having
 	// it's own fake fakeWorkspace to avoid interference between tests.
-	fakeWorkspace := s.getWorkspaceForToken(getToken(r))
+	fakeWorkspace := s.getWorkspaceForToken(token)
 
 	request := NewRequest(s.t, r, fakeWorkspace)
 	request.Vars = vars
+	request.Token = token
 
 	if s.RequestCallback != nil {
 		s.RequestCallback(&request)
@@ -302,17 +372,29 @@ func (s *Server) serve(w http.ResponseWriter, r *http.Request, handler HandlerFu
 
 	var resp EncodedResponse
 
-	if bytes.Contains(request.Body, []byte("INJECT_ERROR")) {
-		resp = EncodedResponse{
-			StatusCode: 500,
-			Body:       []byte("INJECTED"),
+	fault := s.faults.Check(r.Method, r.URL.Path, token, request.Body)
+
+	if fault == nil || fault.AfterHandler {
+		if bytes.Contains(request.Body, []byte("INJECT_ERROR")) {
+			resp = EncodedResponse{
+				StatusCode: 500,
+				Body:       []byte("INJECTED"),
+			}
+		} else {
+			respAny := handler(request)
+			if respAny == nil && request.Context.Err() != nil {
+				return
+			}
+			resp = normalizeResponse(s.t, respAny)
 		}
-	} else {
-		respAny := handler(request)
-		if respAny == nil && request.Context.Err() != nil {
-			return
+	}
+
+	if fault != nil {
+		resp = EncodedResponse{
+			StatusCode: fault.StatusCode,
+			Body:       []byte(fault.Body),
+			Headers:    getJsonHeaders(),
 		}
-		resp = normalizeResponse(s.t, respAny)
 	}
 
 	maps.Copy(w.Header(), resp.Headers)
@@ -346,7 +428,7 @@ func isNil(i any) bool {
 	}
 	v := reflect.ValueOf(i)
 	switch v.Kind() {
-	case reflect.Chan, reflect.Func, reflect.Map, reflect.Ptr, reflect.Interface, reflect.Slice:
+	case reflect.Chan, reflect.Func, reflect.Map, reflect.Pointer, reflect.Interface, reflect.Slice:
 		return v.IsNil()
 	default:
 		return false
diff --git a/libs/testserver/server_test.go b/libs/testserver/server_test.go
new file mode 100644
index 00000000000..6c6dfe8c160
--- /dev/null
+++ b/libs/testserver/server_test.go
@@ -0,0 +1,35 @@
+package testserver_test
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/databricks/cli/libs/testserver"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestIsLocalhostProbe(t *testing.T) {
+	tests := []struct {
+		name   string
+		method string
+		target string
+		host   string
+		want   bool
+	}{
+		{"localhost probe", http.MethodHead, "/", "localhost", true},
+		{"localhost probe with port", http.MethodHead, "/", "localhost:8080", true},
+		{"cli request to loopback ip", http.MethodGet, "/api/2.0/jobs/list", "127.0.0.1:12345", false},
+		{"head to loopback ip", http.MethodHead, "/", "127.0.0.1:12345", false},
+		{"get to localhost root", http.MethodGet, "/", "localhost", false},
+		{"head to localhost non-root", http.MethodHead, "/api/2.0/jobs/list", "localhost", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r := httptest.NewRequest(tt.method, tt.target, nil)
+			r.Host = tt.host
+			assert.Equal(t, tt.want, testserver.IsLocalhostProbe(r))
+		})
+	}
+}
diff --git a/libs/testserver/serving_endpoints.go b/libs/testserver/serving_endpoints.go
index cfe59e448ed..efa10d47463 100644
--- a/libs/testserver/serving_endpoints.go
+++ b/libs/testserver/serving_endpoints.go
@@ -12,11 +12,13 @@ import (
 func servedEntitiesInputToOutput(input []serving.ServedEntityInput) []serving.ServedEntityOutput {
 	entities := make([]serving.ServedEntityOutput, len(input))
 	for i, entity := range input {
+		// Mirror the backend: burst_scaling_enabled is not echoed on GET (not
+		// copied here) and external_model secrets are never returned in plaintext.
 		entities[i] = serving.ServedEntityOutput{
 			EntityName:                entity.EntityName,
 			EntityVersion:             entity.EntityVersion,
 			EnvironmentVars:           entity.EnvironmentVars,
-			ExternalModel:             entity.ExternalModel,
+			ExternalModel:             clearExternalModelSecrets(entity.ExternalModel),
 			InstanceProfileArn:        entity.InstanceProfileArn,
 			MaxProvisionedConcurrency: entity.MaxProvisionedConcurrency,
 			MaxProvisionedThroughput:  entity.MaxProvisionedThroughput,
@@ -33,6 +35,111 @@ func servedEntitiesInputToOutput(input []serving.ServedEntityInput) []serving.Se
 	return entities
 }
 
+// applyTelemetryConfig consumes table_names and discards configs that identify no profile.
+func applyTelemetryConfig(previous, config *serving.TelemetryConfig) *serving.TelemetryConfig {
+	if config == nil {
+		return nil
+	}
+	if config.TableNames == nil && config.TelemetryProfileId == "" {
+		return previous
+	}
+
+	applied := serving.TelemetryConfig{TelemetryProfileId: config.TelemetryProfileId}
+	if applied.TelemetryProfileId == "" {
+		// Do not reuse previous: table_names provisions a new profile.
+		applied.TelemetryProfileId = nextUUID()
+	}
+	if config.InferenceTableConfig != nil {
+		inferenceTable := *config.InferenceTableConfig
+		// The backend names the payload table after the logs table it was given.
+		if config.TableNames != nil {
+			inferenceTable.Name = config.TableNames.LogsTable + "_payload"
+		}
+		applied.InferenceTableConfig = &inferenceTable
+	}
+
+	return &applied
+}
+
+// telemetrySupported returns the unsupported endpoint type when telemetry cannot be applied.
+func telemetrySupported(endpoint serving.ServingEndpointDetailed) (string, bool) {
+	if endpoint.Config == nil || len(endpoint.Config.ServedEntities) == 0 {
+		return "NO_CONFIG", false
+	}
+	for _, entity := range endpoint.Config.ServedEntities {
+		if entity.ExternalModel == nil && entity.EntityName != "" {
+			return "", true
+		}
+	}
+	return "EXTERNAL_MODELS", false
+}
+
+// clearExternalModelSecrets mirrors the backend, which persists the *_plaintext
+// API keys as secrets and never returns them on GET.
+func clearExternalModelSecrets(em *serving.ExternalModel) *serving.ExternalModel {
+	if em == nil {
+		return nil
+	}
+	out := *em
+	if c := out.Ai21labsConfig; c != nil {
+		cc := *c
+		cc.Ai21labsApiKeyPlaintext = ""
+		out.Ai21labsConfig = &cc
+	}
+	if c := out.AmazonBedrockConfig; c != nil {
+		cc := *c
+		cc.AwsAccessKeyIdPlaintext = ""
+		cc.AwsSecretAccessKeyPlaintext = ""
+		out.AmazonBedrockConfig = &cc
+	}
+	if c := out.AnthropicConfig; c != nil {
+		cc := *c
+		cc.AnthropicApiKeyPlaintext = ""
+		out.AnthropicConfig = &cc
+	}
+	if c := out.CohereConfig; c != nil {
+		cc := *c
+		cc.CohereApiKeyPlaintext = ""
+		out.CohereConfig = &cc
+	}
+	if c := out.CustomProviderConfig; c != nil {
+		cc := *c
+		if a := cc.ApiKeyAuth; a != nil {
+			aa := *a
+			aa.ValuePlaintext = ""
+			cc.ApiKeyAuth = &aa
+		}
+		if b := cc.BearerTokenAuth; b != nil {
+			bb := *b
+			bb.TokenPlaintext = ""
+			cc.BearerTokenAuth = &bb
+		}
+		out.CustomProviderConfig = &cc
+	}
+	if c := out.DatabricksModelServingConfig; c != nil {
+		cc := *c
+		cc.DatabricksApiTokenPlaintext = ""
+		out.DatabricksModelServingConfig = &cc
+	}
+	if c := out.GoogleCloudVertexAiConfig; c != nil {
+		cc := *c
+		cc.PrivateKeyPlaintext = ""
+		out.GoogleCloudVertexAiConfig = &cc
+	}
+	if c := out.OpenaiConfig; c != nil {
+		cc := *c
+		cc.OpenaiApiKeyPlaintext = ""
+		cc.MicrosoftEntraClientSecretPlaintext = ""
+		out.OpenaiConfig = &cc
+	}
+	if c := out.PalmConfig; c != nil {
+		cc := *c
+		cc.PalmApiKeyPlaintext = ""
+		out.PalmConfig = &cc
+	}
+	return &out
+}
+
 func servedModelsInputToOutput(input []serving.ServedModelInput) []serving.ServedModelOutput {
 	models := make([]serving.ServedModelOutput, len(input))
 	for i, model := range input {
@@ -53,6 +160,40 @@ func servedModelsInputToOutput(input []serving.ServedModelInput) []serving.Serve
 	return models
 }
 
+// defaultTrafficConfig mirrors the backend: when the user does not specify a
+// traffic_config, the endpoint defaults to routing 100% of traffic to its single
+// served entity, and this default is echoed back on GET. This is what makes
+// traffic_config a backend-managed field the bundle must not treat as drift; the
+// fake has to reproduce it or the persistent-drift regression is invisible locally.
+func defaultTrafficConfig(config *serving.EndpointCoreConfigOutput) {
+	if config == nil || config.TrafficConfig != nil {
+		return
+	}
+	var names []string
+	for _, e := range config.ServedEntities {
+		names = append(names, e.Name)
+	}
+	for _, m := range config.ServedModels {
+		names = append(names, m.Name)
+	}
+	// The backend requires an explicit traffic_config when there is more than one
+	// served entity, so only the single-entity default is well-defined here.
+	if len(names) != 1 {
+		return
+	}
+	config.TrafficConfig = &serving.TrafficConfig{
+		Routes: []serving.Route{{
+			ServedEntityName:  names[0],
+			ServedModelName:   names[0],
+			TrafficPercentage: 100,
+		}},
+	}
+}
+
+// AutoCaptureConfig is the legacy inference-table API; testserver mirrors
+// the production conversion until callers migrate to AI Gateway inference tables.
+//
+//nolint:staticcheck // SA1019: deprecated AutoCaptureConfig{Input,Output} kept for bundle config compatibility
 func autoCaptureConfigInputToOutput(input *serving.AutoCaptureConfigInput) *serving.AutoCaptureConfigOutput {
 	return &serving.AutoCaptureConfigOutput{
 		CatalogName:     input.CatalogName,
@@ -104,25 +245,38 @@ func (s *FakeWorkspace) ServingEndpointCreate(req Request) Response {
 		if createReq.Config.AutoCaptureConfig != nil {
 			config.AutoCaptureConfig = autoCaptureConfigInputToOutput(createReq.Config.AutoCaptureConfig)
 		}
+
+		defaultTrafficConfig(config)
 	}
 
+	now := nowMilli()
 	endpoint := serving.ServingEndpointDetailed{
-		AiGateway:          createReq.AiGateway,
-		BudgetPolicyId:     createReq.BudgetPolicyId,
-		Config:             config,
-		Creator:            s.CurrentUser().UserName,
-		Description:        createReq.Description,
-		EmailNotifications: createReq.EmailNotifications,
-		Id:                 nextUUID(),
-		Name:               createReq.Name,
-		PermissionLevel:    serving.ServingEndpointDetailedPermissionLevelCanManage,
-		RouteOptimized:     createReq.RouteOptimized,
-		Tags:               createReq.Tags,
+		AiGateway:            createReq.AiGateway,
+		BudgetPolicyId:       createReq.BudgetPolicyId,
+		Config:               config,
+		CreationTimestamp:    now,
+		Creator:              s.CurrentUser().UserName,
+		Description:          createReq.Description,
+		EmailNotifications:   createReq.EmailNotifications,
+		Id:                   nextUUID(),
+		LastUpdatedTimestamp: now,
+		Name:                 createReq.Name,
+		PermissionLevel:      serving.ServingEndpointDetailedPermissionLevelCanManage,
+		RouteOptimized:       createReq.RouteOptimized,
+		Tags:                 createReq.Tags,
+		TelemetryConfig:      applyTelemetryConfig(nil, createReq.TelemetryConfig),
 		State: &serving.EndpointState{
 			ConfigUpdate: serving.EndpointStateConfigUpdateNotUpdating,
 			Ready:        serving.EndpointStateReadyNotReady,
 		},
-		ForceSendFields: append(createReq.ForceSendFields, "PermissionLevel", "RouteOptimized"),
+		// Force-send Description so an empty value serializes as "", matching the
+		// real backend which always echoes the field back on GET.
+		ForceSendFields: append(createReq.ForceSendFields, "PermissionLevel", "RouteOptimized", "Description"),
+	}
+
+	// Create drops unsupported telemetry, while the telemetry API rejects it.
+	if _, ok := telemetrySupported(endpoint); !ok {
+		endpoint.TelemetryConfig = nil
 	}
 
 	s.ServingEndpoints[createReq.Name] = endpoint
@@ -132,6 +286,36 @@ func (s *FakeWorkspace) ServingEndpointCreate(req Request) Response {
 	}
 }
 
+// ServingEndpointGet reports an in-progress update once before settling it.
+func (s *FakeWorkspace) ServingEndpointGet(name string) Response {
+	defer s.LockUnlock()()
+
+	endpoint, exists := s.ServingEndpoints[name]
+	if !exists {
+		return Response{
+			StatusCode: 404,
+			Body:       map[string]string{"message": fmt.Sprintf("Resource %T not found: %v", endpoint, name)},
+		}
+	}
+
+	if endpointUpdating(endpoint) {
+		// This response stays IN_PROGRESS; settle the stored copy for the next read.
+		settled := endpoint
+		settled.State = &serving.EndpointState{
+			ConfigUpdate: serving.EndpointStateConfigUpdateNotUpdating,
+			Ready:        endpoint.State.Ready,
+		}
+		s.ServingEndpoints[name] = settled
+	}
+
+	return Response{Body: endpoint}
+}
+
+// endpointUpdating reports whether a config update is in progress.
+func endpointUpdating(endpoint serving.ServingEndpointDetailed) bool {
+	return endpoint.State != nil && endpoint.State.ConfigUpdate == serving.EndpointStateConfigUpdateInProgress
+}
+
 func (s *FakeWorkspace) ServingEndpointUpdate(req Request, name string) Response {
 	defer s.LockUnlock()()
 
@@ -173,11 +357,15 @@ func (s *FakeWorkspace) ServingEndpointUpdate(req Request, name string) Response
 		if updateReq.AutoCaptureConfig != nil {
 			config.AutoCaptureConfig = autoCaptureConfigInputToOutput(updateReq.AutoCaptureConfig)
 		}
+
+		defaultTrafficConfig(config)
 	}
 
 	endpoint.Config = config
+	endpoint.LastUpdatedTimestamp = nowMilli()
+	// Keep the update in progress until GET observes it.
 	endpoint.State = &serving.EndpointState{
-		ConfigUpdate: serving.EndpointStateConfigUpdateNotUpdating,
+		ConfigUpdate: serving.EndpointStateConfigUpdateInProgress,
 		Ready:        serving.EndpointStateReadyNotReady,
 	}
 
@@ -257,6 +445,58 @@ func (s *FakeWorkspace) ServingEndpointUpdateNotifications(req Request, name str
 	}
 }
 
+// ServingEndpointPatchTelemetryConfig applies telemetry after validating endpoint state.
+func (s *FakeWorkspace) ServingEndpointPatchTelemetryConfig(req Request, name string) Response {
+	defer s.LockUnlock()()
+
+	var patchReq serving.PatchTelemetryConfigRequest
+	err := json.Unmarshal(req.Body, &patchReq)
+	if err != nil {
+		return Response{
+			Body:       fmt.Sprintf("cannot unmarshal request body: %s", err),
+			StatusCode: 400,
+		}
+	}
+
+	endpoint, exists := s.ServingEndpoints[name]
+	if !exists {
+		return Response{
+			StatusCode: 404,
+			Body:       map[string]string{"error_code": "RESOURCE_DOES_NOT_EXIST", "message": fmt.Sprintf("Serving endpoint with name %s not found", name)},
+		}
+	}
+
+	if endpointType, ok := telemetrySupported(endpoint); !ok {
+		return Response{
+			StatusCode: 400,
+			Body: map[string]string{
+				"error_code": "INVALID_PARAMETER_VALUE",
+				"message":    fmt.Sprintf("Telemetry configuration is not supported for endpoint type '%s'. This API only supports endpoints with custom served models.", endpointType),
+			},
+		}
+	}
+
+	// The telemetry API returns 409 while another update is in progress.
+	if endpointUpdating(endpoint) {
+		return Response{
+			StatusCode: 409,
+			Body: map[string]string{
+				"error_code": "RESOURCE_CONFLICT",
+				"message":    fmt.Sprintf("Endpoint %s is currently updating. Wait for the update to complete before updating its telemetry configuration.", name),
+			},
+		}
+	}
+
+	// An omitted telemetry_config removes the configuration from the endpoint.
+	endpoint.TelemetryConfig = applyTelemetryConfig(endpoint.TelemetryConfig, patchReq.TelemetryConfig)
+	endpoint.LastUpdatedTimestamp = nowMilli()
+	s.ServingEndpoints[name] = endpoint
+
+	return Response{
+		Body: endpoint,
+	}
+}
+
 func (s *FakeWorkspace) ServingEndpointPatchTags(req Request, name string) Response {
 	defer s.LockUnlock()()
 
diff --git a/libs/testserver/settings.go b/libs/testserver/settings.go
new file mode 100644
index 00000000000..958f0626f0b
--- /dev/null
+++ b/libs/testserver/settings.go
@@ -0,0 +1,67 @@
+package testserver
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"github.com/databricks/databricks-sdk-go/service/settingsv2"
+)
+
+// portFwdServerlessSetting lets an administrator disable port forwarding to serverless compute,
+// which the driver proxy enforces for the SSH tunnel.
+const portFwdServerlessSetting = "port_fwd_serverless_enabled"
+
+func (s *FakeWorkspace) WorkspaceSettingGet(req Request) Response {
+	defer s.LockUnlock()()
+
+	name := req.Vars["name"]
+	if setting, ok := s.WorkspaceSettings[name]; ok {
+		return Response{Body: setting}
+	}
+	// The setting's own default is true: port forwarding stays on until an administrator turns it off.
+	if name == portFwdServerlessSetting {
+		enabled := &settingsv2.BooleanMessage{Value: true}
+		return Response{Body: settingsv2.Setting{Name: name, EffectiveBooleanVal: enabled}}
+	}
+	return Response{
+		StatusCode: 404,
+		Body:       map[string]string{"error_code": "RESOURCE_DOES_NOT_EXIST", "message": fmt.Sprintf("Setting %s does not exist", name)},
+	}
+}
+
+func (s *FakeWorkspace) WorkspaceSettingPatch(req Request) Response {
+	var setting settingsv2.Setting
+	if err := json.Unmarshal(req.Body, &setting); err != nil {
+		return Response{
+			StatusCode: 400,
+			Body:       fmt.Sprintf("request parsing error: %s", err),
+		}
+	}
+
+	// The backend decodes the body as a protobuf message, in which false is the default value, so a
+	// body that carries only {"boolean_val": {"value": false}} arrives empty and is rejected.
+	if setting.Name == "" && (setting.BooleanVal == nil || !setting.BooleanVal.Value) {
+		return Response{
+			StatusCode: 400,
+			Body: map[string]string{
+				"error_code": "INVALID_PARAMETER_VALUE",
+				"message":    "Field 'setting' is required and must contain at least one subfield with a non-default value!",
+			},
+		}
+	}
+
+	defer s.LockUnlock()()
+
+	setting.Name = req.Vars["name"]
+	// Account-level values are not modelled, so the workspace value is the effective one.
+	setting.EffectiveBooleanVal = setting.BooleanVal
+	s.WorkspaceSettings[setting.Name] = setting
+	return Response{Body: setting}
+}
+
+// portForwardingToServerlessDisabled reports whether port_fwd_serverless_enabled was set to false.
+// Callers must hold the workspace lock.
+func (s *FakeWorkspace) portForwardingToServerlessDisabled() bool {
+	setting, ok := s.WorkspaceSettings[portFwdServerlessSetting]
+	return ok && setting.EffectiveBooleanVal != nil && !setting.EffectiveBooleanVal.Value
+}
diff --git a/libs/testserver/settings_test.go b/libs/testserver/settings_test.go
new file mode 100644
index 00000000000..781c5326051
--- /dev/null
+++ b/libs/testserver/settings_test.go
@@ -0,0 +1,66 @@
+package testserver
+
+import (
+	"testing"
+
+	"github.com/databricks/databricks-sdk-go/service/settingsv2"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func patchSetting(workspace *FakeWorkspace, body string) Response {
+	return workspace.WorkspaceSettingPatch(Request{
+		Body: []byte(body),
+		Vars: map[string]string{"name": portFwdServerlessSetting},
+	})
+}
+
+func TestWorkspaceSettingPatchRejectsBodyWithOnlyDefaults(t *testing.T) {
+	workspace := NewFakeWorkspace("http://test.test", "token")
+
+	response := patchSetting(workspace, `{"boolean_val": {"value": false}}`)
+
+	assert.Equal(t, 400, response.StatusCode)
+	assert.False(t, workspace.portForwardingToServerlessDisabled())
+}
+
+func TestWorkspaceSettingPatchDisablesPortForwarding(t *testing.T) {
+	workspace := NewFakeWorkspace("http://test.test", "token")
+
+	response := patchSetting(workspace, `{"name": "port_fwd_serverless_enabled", "boolean_val": {"value": false}}`)
+
+	assert.Equal(t, 0, response.StatusCode)
+	assert.True(t, workspace.portForwardingToServerlessDisabled())
+}
+
+func TestWorkspaceSettingGetDefaultsPortForwardingToEnabled(t *testing.T) {
+	workspace := NewFakeWorkspace("http://test.test", "token")
+
+	response := workspace.WorkspaceSettingGet(Request{Vars: map[string]string{"name": portFwdServerlessSetting}})
+
+	assert.Equal(t, 0, response.StatusCode)
+	setting, ok := response.Body.(settingsv2.Setting)
+	require.True(t, ok)
+	require.NotNil(t, setting.EffectiveBooleanVal)
+	assert.True(t, setting.EffectiveBooleanVal.Value)
+}
+
+func TestWorkspaceSettingGetReturnsPatchedValue(t *testing.T) {
+	workspace := NewFakeWorkspace("http://test.test", "token")
+	patchSetting(workspace, `{"name": "port_fwd_serverless_enabled", "boolean_val": {"value": false}}`)
+
+	response := workspace.WorkspaceSettingGet(Request{Vars: map[string]string{"name": portFwdServerlessSetting}})
+
+	setting, ok := response.Body.(settingsv2.Setting)
+	require.True(t, ok)
+	require.NotNil(t, setting.EffectiveBooleanVal)
+	assert.False(t, setting.EffectiveBooleanVal.Value)
+}
+
+func TestWorkspaceSettingGetUnknownSetting(t *testing.T) {
+	workspace := NewFakeWorkspace("http://test.test", "token")
+
+	response := workspace.WorkspaceSettingGet(Request{Vars: map[string]string{"name": "no_such_setting"}})
+
+	assert.Equal(t, 404, response.StatusCode)
+}
diff --git a/libs/testserver/sql_warehouses.go b/libs/testserver/sql_warehouses.go
index 6e7fd3a2f91..7f36ace72fc 100644
--- a/libs/testserver/sql_warehouses.go
+++ b/libs/testserver/sql_warehouses.go
@@ -59,6 +59,34 @@ func (s *FakeWorkspace) SqlWarehousesUpsert(req Request, warehouseId string) Res
 	}
 }
 
+func (s *FakeWorkspace) SqlWarehousesStart(req Request, warehouseId string) Response {
+	defer s.LockUnlock()()
+
+	warehouse, ok := s.SqlWarehouses[warehouseId]
+	if !ok {
+		return Response{StatusCode: 404}
+	}
+
+	warehouse.State = sql.StateRunning
+	s.SqlWarehouses[warehouseId] = warehouse
+
+	return Response{}
+}
+
+func (s *FakeWorkspace) SqlWarehousesStop(req Request, warehouseId string) Response {
+	defer s.LockUnlock()()
+
+	warehouse, ok := s.SqlWarehouses[warehouseId]
+	if !ok {
+		return Response{StatusCode: 404}
+	}
+
+	warehouse.State = sql.StateStopped
+	s.SqlWarehouses[warehouseId] = warehouse
+
+	return Response{}
+}
+
 func (s *FakeWorkspace) SqlWarehousesList(req Request) Response {
 	var warehouses []sql.EndpointInfo
 	for _, warehouse := range s.SqlWarehouses {
diff --git a/libs/testserver/ssh.go b/libs/testserver/ssh.go
new file mode 100644
index 00000000000..8efdaa3a851
--- /dev/null
+++ b/libs/testserver/ssh.go
@@ -0,0 +1,244 @@
+package testserver
+
+import (
+	"context"
+	"crypto/ed25519"
+	"crypto/rand"
+	"encoding/pem"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"os/exec"
+	"os/user"
+	"path/filepath"
+	"sync"
+	"time"
+
+	"github.com/gorilla/websocket"
+	"golang.org/x/crypto/ssh"
+)
+
+// sshTunnelRemoteUser is the login user /metadata reports. It must be the OS user
+// the local sshd runs as, so `ssh -l <user>` matches; the real server reports the same.
+func sshTunnelRemoteUser() string {
+	if u, err := user.Current(); err == nil {
+		return u.Username
+	}
+	return ""
+}
+
+// sshClientPublicKeySecretKey is the secret the CLI stores its authorized public key
+// under (mirrors clientPublicKeyName in experimental/ssh); sshd authorizes it below.
+const sshClientPublicKeySecretKey = "client-public-key"
+
+// sshServerPublicKeySecretKey is the secret the tunnel server publishes its host key
+// under (mirrors serverPublicKeyName in experimental/ssh); the client reads it to pin
+// the host key before connecting.
+const sshServerPublicKeySecretKey = "server-public-key"
+
+var sshTunnelUpgrader = websocket.Upgrader{}
+
+// sshdTerminationTimeout caps how long Cmd.Wait blocks on a stuck sshd once the tunnel closes.
+const sshdTerminationTimeout = 10 * time.Second
+
+// findSSHD returns the sshd path, or "" if absent. LookPath misses it in sbin, so also
+// probe the usual locations. Mirrors the acceptance test's probe.
+func findSSHD() string {
+	if p, err := exec.LookPath("sshd"); err == nil {
+		return p
+	}
+	for _, p := range []string{"/usr/sbin/sshd", "/usr/local/sbin/sshd", "/sbin/sshd"} {
+		if _, err := os.Stat(p); err == nil {
+			return p
+		}
+	}
+	return ""
+}
+
+// sshClientAuthorizedKey returns the public key the CLI uploaded via secrets/put, or nil.
+// Scans all scopes since the scope name embeds the session and current user.
+func (s *FakeWorkspace) sshClientAuthorizedKey() []byte {
+	defer s.LockUnlock()()
+	for _, scope := range s.Secrets {
+		if v, ok := scope[sshClientPublicKeySecretKey]; ok {
+			return []byte(v)
+		}
+	}
+	return nil
+}
+
+// sshTunnelHostKey returns the host key in PEM form that every sshd of this workspace
+// serves, generating it on first use. The real tunnel server generates its host key once,
+// stores it in the session's secret scope and reuses it for every sshd it launches, so one
+// key per workspace is what a client sees across connections.
+func (s *FakeWorkspace) sshTunnelHostKey() ([]byte, error) {
+	defer s.LockUnlock()()
+	return s.ensureSSHTunnelHostKey()
+}
+
+// ensureSSHTunnelHostKey generates the workspace's tunnel host key if it has none.
+// Callers must hold the workspace lock.
+func (s *FakeWorkspace) ensureSSHTunnelHostKey() ([]byte, error) {
+	if s.sshTunnelHostKeyPEM != nil {
+		return s.sshTunnelHostKeyPEM, nil
+	}
+	pub, priv, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		return nil, err
+	}
+	block, err := ssh.MarshalPrivateKey(priv, "")
+	if err != nil {
+		return nil, err
+	}
+	sshPub, err := ssh.NewPublicKey(pub)
+	if err != nil {
+		return nil, err
+	}
+	s.sshTunnelHostKeyPEM = pem.EncodeToMemory(block)
+	s.sshTunnelHostPublicKey = ssh.MarshalAuthorizedKey(sshPub)
+	return s.sshTunnelHostKeyPEM, nil
+}
+
+// sshTunnelHandler stands in for a cluster's tunnel server: it upgrades /ssh to a
+// websocket and drives a real `sshd -i` over it, so `ssh connect` runs a full handshake,
+// auth, and remote exec locally. Requires sshd; the acceptance test skips when it's absent
+// and is pinned to Linux, where sshd -i as a non-root user is reliable.
+func (s *Server) sshTunnelHandler(w http.ResponseWriter, r *http.Request) {
+	conn, err := sshTunnelUpgrader.Upgrade(w, r, nil)
+	if err != nil {
+		s.t.Logf("ssh tunnel: websocket upgrade failed: %s", err)
+		return
+	}
+	defer conn.Close()
+
+	sshdPath := findSSHD()
+	if sshdPath == "" {
+		s.t.Logf("ssh tunnel: sshd not found; tunnel cannot start")
+		return
+	}
+
+	// The ws dial carries the CLI's bearer token, so this token-scoped workspace is the
+	// one that stored the uploaded public key.
+	ws := s.getWorkspaceForToken(getToken(r))
+	authorizedKey := ws.sshClientAuthorizedKey()
+	if authorizedKey == nil {
+		s.t.Logf("ssh tunnel: client public key secret %q not found", sshClientPublicKeySecretKey)
+		return
+	}
+
+	hostKey, err := ws.sshTunnelHostKey()
+	if err != nil {
+		s.t.Logf("ssh tunnel: host key: %s", err)
+		return
+	}
+
+	dir, err := os.MkdirTemp("", "testserver-sshd-")
+	if err != nil {
+		s.t.Logf("ssh tunnel: temp dir: %s", err)
+		return
+	}
+	defer os.RemoveAll(dir)
+
+	configPath, err := writeSSHDFiles(dir, authorizedKey, hostKey)
+	if err != nil {
+		s.t.Logf("ssh tunnel: write sshd files: %s", err)
+		return
+	}
+
+	ctx, cancel := context.WithCancel(r.Context())
+	defer cancel()
+
+	cmd := exec.CommandContext(ctx, sshdPath, "-f", configPath, "-i", "-e")
+	cmd.WaitDelay = sshdTerminationTimeout
+	cmd.Stderr = io.Discard
+	sshdStdin, err := cmd.StdinPipe()
+	if err != nil {
+		s.t.Logf("ssh tunnel: stdin pipe: %s", err)
+		return
+	}
+	sshdStdout, err := cmd.StdoutPipe()
+	if err != nil {
+		s.t.Logf("ssh tunnel: stdout pipe: %s", err)
+		return
+	}
+	if err := cmd.Start(); err != nil {
+		s.t.Logf("ssh tunnel: start sshd: %s", err)
+		return
+	}
+
+	closeConn := sync.OnceFunc(func() { _ = conn.Close() })
+
+	var wg sync.WaitGroup
+
+	// sshd stdout -> websocket binary frames.
+	wg.Go(func() {
+		buf := make([]byte, 4096)
+		for {
+			n, readErr := sshdStdout.Read(buf)
+			if n > 0 {
+				if writeErr := conn.WriteMessage(websocket.BinaryMessage, buf[:n]); writeErr != nil {
+					break
+				}
+			}
+			if readErr != nil {
+				break
+			}
+		}
+		// sshd exited (or the client is gone): unblock the reader below.
+		closeConn()
+	})
+
+	// websocket binary frames -> sshd stdin.
+	wg.Go(func() {
+		for {
+			messageType, data, readErr := conn.ReadMessage()
+			if readErr != nil {
+				break
+			}
+			if messageType != websocket.BinaryMessage {
+				continue
+			}
+			if _, writeErr := sshdStdin.Write(data); writeErr != nil {
+				break
+			}
+		}
+		// The client closed its side (ssh session ended): EOF sshd's stdin so it exits.
+		_ = sshdStdin.Close()
+	})
+
+	wg.Wait()
+	cancel()
+	_ = cmd.Wait()
+}
+
+// writeSSHDFiles writes the host key, authorized_keys, and a minimal sshd_config,
+// returning the config path. StrictModes/UsePAM are off so sshd accepts the temp-dir keys
+// and doesn't try to switch users when run non-root in inetd mode (-i).
+func writeSSHDFiles(dir string, authorizedKey, hostKeyPEM []byte) (string, error) {
+	hostKeyPath := filepath.Join(dir, "host_key")
+	if err := os.WriteFile(hostKeyPath, hostKeyPEM, 0o600); err != nil {
+		return "", err
+	}
+
+	authKeysPath := filepath.Join(dir, "authorized_keys")
+	if err := os.WriteFile(authKeysPath, authorizedKey, 0o600); err != nil {
+		return "", err
+	}
+
+	cfg := fmt.Sprintf(
+		"HostKey %s\n"+
+			"AuthorizedKeysFile %s\n"+
+			"PidFile none\n"+
+			"StrictModes no\n"+
+			"UsePAM no\n"+
+			"PubkeyAuthentication yes\n"+
+			"PasswordAuthentication no\n"+
+			"LogLevel ERROR\n",
+		hostKeyPath, authKeysPath)
+	configPath := filepath.Join(dir, "sshd_config")
+	if err := os.WriteFile(configPath, []byte(cfg), 0o600); err != nil {
+		return "", err
+	}
+	return configPath, nil
+}
diff --git a/libs/testserver/statements.go b/libs/testserver/statements.go
new file mode 100644
index 00000000000..6389e693a8b
--- /dev/null
+++ b/libs/testserver/statements.go
@@ -0,0 +1,64 @@
+package testserver
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"regexp"
+	"strconv"
+
+	"github.com/databricks/cli/libs/testserver/testsql"
+	"github.com/databricks/databricks-sdk-go/service/sql"
+)
+
+// HandleSQL registers a matcher that runs fn when a submitted statement equals
+// statement exactly (after trimming).
+func (s *Server) HandleSQL(statement string, fn func(testsql.Request) testsql.Result) {
+	s.sqlHandler.Handle(statement, fn)
+}
+
+// HandleSQLPattern registers a matcher that runs fn when re matches a submitted
+// statement, passing the submatches through as Request.Match.
+func (s *Server) HandleSQLPattern(re *regexp.Regexp, fn func(testsql.Request) testsql.Result) {
+	s.sqlHandler.HandlePattern(re, fn)
+}
+
+// sqlExecuteStatement handles POST /api/2.0/sql/statements. A statement that
+// terminates as FAILED comes back as HTTP 200 with state=FAILED; the engine
+// builds that response and this HTTP layer is just transport.
+func (s *Server) sqlExecuteStatement(req Request) any {
+	var r sql.ExecuteStatementRequest
+	if err := json.Unmarshal(req.Body, &r); err != nil {
+		return Response{StatusCode: http.StatusBadRequest, Body: fmt.Sprintf("invalid execute statement request: %s", err)}
+	}
+	return s.sqlHandler.Submit(r.Statement, r.WaitTimeout, r.Parameters)
+}
+
+// sqlGetStatement handles GET /api/2.0/sql/statements/{statement_id}.
+func (s *Server) sqlGetStatement(req Request) any {
+	resp := s.sqlHandler.Get(req.Vars["statement_id"])
+	if resp == nil {
+		return Response{StatusCode: http.StatusNotFound}
+	}
+	return resp
+}
+
+// sqlGetStatementResultChunk handles GET
+// /api/2.0/sql/statements/{statement_id}/result/chunks/{chunk_index}.
+func (s *Server) sqlGetStatementResultChunk(req Request) any {
+	idx, err := strconv.Atoi(req.Vars["chunk_index"])
+	if err != nil {
+		return Response{StatusCode: http.StatusBadRequest, Body: fmt.Sprintf("invalid chunk index: %s", err)}
+	}
+	data := s.sqlHandler.Chunk(req.Vars["statement_id"], idx)
+	if data == nil {
+		return Response{StatusCode: http.StatusNotFound}
+	}
+	return data
+}
+
+// sqlCancelStatement handles POST /api/2.0/sql/statements/{statement_id}/cancel.
+func (s *Server) sqlCancelStatement(req Request) any {
+	s.sqlHandler.Cancel(req.Vars["statement_id"])
+	return map[string]any{}
+}
diff --git a/libs/testserver/statements_test.go b/libs/testserver/statements_test.go
new file mode 100644
index 00000000000..5552f64f558
--- /dev/null
+++ b/libs/testserver/statements_test.go
@@ -0,0 +1,51 @@
+package testserver
+
+import (
+	"encoding/json"
+	"regexp"
+	"testing"
+
+	"github.com/databricks/cli/libs/testserver/testsql"
+	"github.com/databricks/databricks-sdk-go/service/sql"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// submitSQL runs a statement through the POST handler and returns the response.
+func submitSQL(t *testing.T, server *Server, statement string) *sql.StatementResponse {
+	t.Helper()
+	body, err := json.Marshal(sql.ExecuteStatementRequest{Statement: statement, WaitTimeout: "10s"})
+	require.NoError(t, err)
+	resp, ok := server.sqlExecuteStatement(Request{Body: body}).(*sql.StatementResponse)
+	require.True(t, ok)
+	return resp
+}
+
+func TestHandleSQL(t *testing.T) {
+	server := New(t)
+	server.HandleSQL("SELECT 1 AS a", func(r testsql.Request) testsql.Result {
+		assert.Equal(t, []string{"SELECT 1 AS a"}, r.Match)
+		return testsql.Result{Columns: []string{"a"}, Rows: [][]string{{"1"}}}
+	})
+
+	resp := submitSQL(t, server, "SELECT 1 AS a")
+	require.NotNil(t, resp.Status)
+	assert.Equal(t, sql.StatementStateSucceeded, resp.Status.State)
+	require.NotNil(t, resp.Result)
+	assert.Equal(t, [][]string{{"1"}}, resp.Result.DataArray)
+}
+
+func TestHandleSQLPattern(t *testing.T) {
+	server := New(t)
+	// A regex matcher echoes back a captured submatch, exercising both the
+	// HandleSQLPattern registration and Request.Match.
+	server.HandleSQLPattern(regexp.MustCompile(`^SELECT (\d+)$`), func(r testsql.Request) testsql.Result {
+		return testsql.Result{Columns: []string{"n"}, Rows: [][]string{{r.Match[1]}}}
+	})
+
+	resp := submitSQL(t, server, "SELECT 42")
+	require.NotNil(t, resp.Status)
+	assert.Equal(t, sql.StatementStateSucceeded, resp.Status.State)
+	require.NotNil(t, resp.Result)
+	assert.Equal(t, [][]string{{"42"}}, resp.Result.DataArray)
+}
diff --git a/libs/testserver/synced_database_tables.go b/libs/testserver/synced_database_tables.go
index 9ac81483945..13c81539909 100644
--- a/libs/testserver/synced_database_tables.go
+++ b/libs/testserver/synced_database_tables.go
@@ -43,33 +43,17 @@ func (s *FakeWorkspace) SyncedDatabaseTableCreate(req Request) Response {
 	}
 }
 
+// SyncedDatabaseTableUpdate models the real Database API, which has no update
+// endpoint: PATCH /api/2.0/database/synced_tables/{name} returns 501
+// NOT_IMPLEMENTED. The direct engine recreates synced_database_tables on any
+// change and never calls this; modeling the 501 guards against reintroducing an
+// update path.
 func (s *FakeWorkspace) SyncedDatabaseTableUpdate(req Request, name string) Response {
-	defer s.LockUnlock()()
-
-	var updateReq database.UpdateSyncedDatabaseTableRequest
-	if err := json.Unmarshal(req.Body, &updateReq); err != nil {
-		return Response{
-			Body:       fmt.Sprintf("cannot unmarshal request body: %v", err),
-			StatusCode: 400,
-		}
-	}
-
-	// Ensure the resource exists
-	existing, ok := s.SyncedDatabaseTables[name]
-	if !ok {
-		return Response{
-			Body:       fmt.Sprintf("synced database table with name '%s' not found", name),
-			StatusCode: 404,
-		}
-	}
-
-	// Apply updates: shallow replace with provided struct while preserving name
-	updated := updateReq.SyncedTable
-	if updated.Name == "" {
-		updated.Name = existing.Name
+	return Response{
+		StatusCode: 501,
+		Body: map[string]string{
+			"error_code": "NOT_IMPLEMENTED",
+			"message":    "Update Synced Database Table is not yet implemented.",
+		},
 	}
-
-	s.SyncedDatabaseTables[name] = updated
-
-	return Response{Body: updated}
 }
diff --git a/libs/testserver/testsql/testsql.go b/libs/testserver/testsql/testsql.go
new file mode 100644
index 00000000000..0d28785f40f
--- /dev/null
+++ b/libs/testserver/testsql/testsql.go
@@ -0,0 +1,287 @@
+// Package testsql is a fake of the Databricks SQL Statement Execution API for
+// the testserver. It is NOT a SQL engine: tests register matchers that map a
+// submitted statement to a declarative Result (columns, rows, an optional
+// error, a poll count, and a chunk count). On submit the handler routes the
+// statement to the first matching matcher, runs that matcher exactly once to
+// capture a plan, stores the plan under a deterministic statement ID, and then
+// replays it across the statement lifecycle (poll -> chunk pagination ->
+// cancel).
+//
+// Because the matcher runs only once per Submit, a matcher may close over
+// mutable state (e.g. a map) and have its side effects persist across
+// statements, which lets tests model stateful resources (create then read
+// back) without a real backend.
+package testsql
+
+import (
+	"fmt"
+	"regexp"
+	"strings"
+	"sync"
+
+	"github.com/databricks/databricks-sdk-go/service/sql"
+)
+
+// asyncWaitTimeout is the WaitTimeout value that callers send to submit a
+// statement asynchronously. The real API returns immediately with state
+// PENDING in this case so the caller can wire up cancellation before the
+// statement finishes, so the fake mirrors that and never returns a terminal
+// state for "0s" regardless of the matcher's poll count.
+const asyncWaitTimeout = "0s"
+
+// Request is what a matcher sees for one submitted statement.
+type Request struct {
+	// Statement is the trimmed statement text.
+	Statement string
+	// Match holds regex submatches for a HandlePattern matcher; for an exact
+	// Handle matcher it is []string{Statement}.
+	Match []string
+	// Parameters are the bound :name parameters from the submit request.
+	Parameters []sql.StatementParameterListItem
+}
+
+// Result is the declarative plan a matcher returns. The zero value is a
+// terminal SUCCEEDED statement with no columns and no rows in a single inline
+// chunk.
+type Result struct {
+	Columns []string
+	Rows    [][]string
+	// Error, when non-nil, makes the statement terminate as FAILED (which the
+	// real API reports over HTTP 200, not an HTTP error).
+	Error *Error
+	// Polls is the number of non-terminal GET responses returned before the
+	// statement reaches a terminal state.
+	Polls int
+	// Chunks splits Rows across this many chunk fetches. 0 or 1 means a single
+	// inline chunk.
+	Chunks int
+}
+
+// Error describes a terminal FAILED statement.
+type Error struct {
+	Code     sql.ServiceErrorCode
+	Message  string
+	SQLState string
+}
+
+// matcher pairs a predicate against a statement with the plan-producing fn.
+type matcher struct {
+	// match returns the submatches to pass to fn, or nil when the statement
+	// does not match this matcher.
+	match func(stmt string) []string
+	fn    func(Request) Result
+}
+
+// statement is the captured plan for one submitted statement, replayed across
+// its lifecycle.
+type statement struct {
+	id      string
+	columns []string
+	// chunks holds the result split into fetchable chunks. A statement with rows
+	// has at least one chunk (chunk 0 carries the inline data returned with the
+	// terminal response); a statement with no rows has zero chunks.
+	chunks         [][][]string
+	err            *Error
+	remainingPolls int
+	canceled       bool
+}
+
+// Handler routes submitted statements to matchers and replays their captured
+// plans across the statement lifecycle.
+type Handler struct {
+	mu         sync.Mutex
+	matchers   []matcher
+	statements map[string]*statement
+	nextID     int
+}
+
+// New returns a Handler with no matchers registered.
+func New() *Handler {
+	return &Handler{statements: map[string]*statement{}}
+}
+
+// Handle registers a matcher that runs fn when a submitted statement equals
+// statement exactly (after trimming). The first registered matching matcher
+// wins. The matcher's Request.Match is []string{statement}.
+func (h *Handler) Handle(statement string, fn func(Request) Result) {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	h.matchers = append(h.matchers, matcher{
+		match: func(stmt string) []string {
+			if stmt == statement {
+				return []string{stmt}
+			}
+			return nil
+		},
+		fn: fn,
+	})
+}
+
+// HandlePattern registers a matcher that runs fn when re matches a submitted
+// statement. The first registered matching matcher wins. The matcher's
+// Request.Match is re.FindStringSubmatch(stmt).
+func (h *Handler) HandlePattern(re *regexp.Regexp, fn func(Request) Result) {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	h.matchers = append(h.matchers, matcher{
+		match: func(stmt string) []string {
+			return re.FindStringSubmatch(stmt)
+		},
+		fn: fn,
+	})
+}
+
+// Submit matches the statement, runs the matcher once to capture its plan,
+// stores it under a new deterministic ID ("statement-1", "statement-2", ...),
+// and returns the first lifecycle response. A "0s" wait timeout always yields
+// PENDING; otherwise the response is terminal when the plan has no remaining
+// polls and PENDING otherwise.
+func (h *Handler) Submit(statement, waitTimeout string, params []sql.StatementParameterListItem) *sql.StatementResponse {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+
+	stmt := h.plan(strings.TrimSpace(statement), params)
+	h.nextID++
+	stmt.id = fmt.Sprintf("statement-%d", h.nextID)
+	h.statements[stmt.id] = stmt
+
+	if waitTimeout == asyncWaitTimeout || stmt.remainingPolls > 0 {
+		return &sql.StatementResponse{
+			StatementId: stmt.id,
+			Status:      &sql.StatementStatus{State: sql.StatementStatePending},
+		}
+	}
+	return stmt.terminalResponse()
+}
+
+// Get returns the current state of the statement. A canceled statement reports
+// CANCELED (this takes precedence over remaining polls). Otherwise a statement
+// with remaining polls decrements its counter and reports RUNNING; a statement
+// with no remaining polls reports its terminal state with manifest and chunk 0.
+// An unknown id returns nil.
+func (h *Handler) Get(statementID string) *sql.StatementResponse {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+
+	stmt := h.statements[statementID]
+	if stmt == nil {
+		return nil
+	}
+	if stmt.canceled {
+		return &sql.StatementResponse{
+			StatementId: stmt.id,
+			Status:      &sql.StatementStatus{State: sql.StatementStateCanceled},
+		}
+	}
+	if stmt.remainingPolls > 0 {
+		stmt.remainingPolls--
+		return &sql.StatementResponse{
+			StatementId: stmt.id,
+			Status:      &sql.StatementStatus{State: sql.StatementStateRunning},
+		}
+	}
+	return stmt.terminalResponse()
+}
+
+// Chunk returns the rows of chunk chunkIndex for the statement. An unknown id
+// or out-of-range index returns nil.
+func (h *Handler) Chunk(statementID string, chunkIndex int) *sql.ResultData {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+
+	stmt := h.statements[statementID]
+	if stmt == nil || chunkIndex < 0 || chunkIndex >= len(stmt.chunks) {
+		return nil
+	}
+	return &sql.ResultData{DataArray: stmt.chunks[chunkIndex]}
+}
+
+// Cancel marks the statement canceled. An unknown id is a no-op.
+func (h *Handler) Cancel(statementID string) {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+
+	if stmt := h.statements[statementID]; stmt != nil {
+		stmt.canceled = true
+	}
+}
+
+// plan runs the first matching matcher once and turns its Result into a stored
+// statement. With no matching matcher the statement terminates as FAILED with
+// an "unsupported statement" error, mirroring how the real backend rejects a
+// statement it cannot run.
+func (h *Handler) plan(stmt string, params []sql.StatementParameterListItem) *statement {
+	res := Result{Error: &Error{
+		Code:    sql.ServiceErrorCodeBadRequest,
+		Message: "unsupported statement: " + stmt,
+	}}
+	for _, m := range h.matchers {
+		groups := m.match(stmt)
+		if groups == nil {
+			continue
+		}
+		res = m.fn(Request{Statement: stmt, Match: groups, Parameters: params})
+		break
+	}
+	return &statement{
+		columns:        res.Columns,
+		chunks:         splitChunks(res.Rows, res.Chunks),
+		err:            res.Error,
+		remainingPolls: res.Polls,
+	}
+}
+
+// terminalResponse builds the terminal response for a statement: FAILED when it
+// carries an error, otherwise SUCCEEDED with the manifest and inline chunk 0.
+func (s *statement) terminalResponse() *sql.StatementResponse {
+	if s.err != nil {
+		return &sql.StatementResponse{
+			StatementId: s.id,
+			Status: &sql.StatementStatus{
+				State:    sql.StatementStateFailed,
+				SqlState: s.err.SQLState,
+				Error:    &sql.ServiceError{ErrorCode: s.err.Code, Message: s.err.Message},
+			},
+		}
+	}
+
+	manifest := &sql.ResultManifest{TotalChunkCount: len(s.chunks)}
+	if len(s.columns) > 0 {
+		cols := make([]sql.ColumnInfo, len(s.columns))
+		for i, name := range s.columns {
+			cols[i] = sql.ColumnInfo{Name: name}
+		}
+		manifest.Schema = &sql.ResultSchema{Columns: cols}
+	}
+	// A no-row statement reports an empty result (matching the real API, which
+	// returns "result": {} with no data_array); otherwise chunk 0 is inlined.
+	result := &sql.ResultData{}
+	if len(s.chunks) > 0 {
+		result.DataArray = s.chunks[0]
+	}
+	return &sql.StatementResponse{
+		StatementId: s.id,
+		Status:      &sql.StatementStatus{State: sql.StatementStateSucceeded},
+		Manifest:    manifest,
+		Result:      result,
+	}
+}
+
+// splitChunks divides rows into max(1, chunks) chunks as evenly as possible by
+// ceil division. A statement with no rows yields zero chunks (TotalChunkCount=0
+// and an empty result), matching the real API's response to a 0-row SELECT or a
+// no-result-set DDL statement.
+func splitChunks(rows [][]string, chunks int) [][][]string {
+	if len(rows) == 0 {
+		return nil
+	}
+	n := max(1, chunks)
+	out := make([][][]string, n)
+	size := (len(rows) + n - 1) / n
+	for i := range n {
+		start := min(i*size, len(rows))
+		end := min(start+size, len(rows))
+		out[i] = rows[start:end]
+	}
+	return out
+}
diff --git a/libs/testserver/testsql/testsql_test.go b/libs/testserver/testsql/testsql_test.go
new file mode 100644
index 00000000000..7c70d038218
--- /dev/null
+++ b/libs/testserver/testsql/testsql_test.go
@@ -0,0 +1,240 @@
+package testsql_test
+
+import (
+	"regexp"
+	"testing"
+
+	"github.com/databricks/cli/libs/testserver/testsql"
+	"github.com/databricks/databricks-sdk-go/service/sql"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestExactDispatch(t *testing.T) {
+	e := testsql.New()
+	var seen testsql.Request
+	e.Handle("SELECT 1", func(r testsql.Request) testsql.Result {
+		seen = r
+		return testsql.Result{Columns: []string{"a"}, Rows: [][]string{{"1"}}}
+	})
+
+	// Statement is trimmed before matching.
+	resp := e.Submit("  SELECT 1  ", "10s", nil)
+	require.NotNil(t, resp.Status)
+	assert.Equal(t, sql.StatementStateSucceeded, resp.Status.State)
+	assert.Equal(t, "SELECT 1", seen.Statement)
+	assert.Equal(t, []string{"SELECT 1"}, seen.Match)
+	assert.Equal(t, []string{"a"}, columnNames(resp))
+	assert.Equal(t, [][]string{{"1"}}, resp.Result.DataArray)
+}
+
+func TestPatternDispatchSubmatches(t *testing.T) {
+	e := testsql.New()
+	re := regexp.MustCompile(`^CREATE TABLE (\w+)$`)
+	var seen testsql.Request
+	e.HandlePattern(re, func(r testsql.Request) testsql.Result {
+		seen = r
+		return testsql.Result{}
+	})
+
+	resp := e.Submit("CREATE TABLE foo", "10s", nil)
+	assert.Equal(t, sql.StatementStateSucceeded, resp.Status.State)
+	assert.Equal(t, []string{"CREATE TABLE foo", "foo"}, seen.Match)
+}
+
+func TestFirstMatchWins(t *testing.T) {
+	e := testsql.New()
+	e.HandlePattern(regexp.MustCompile(`SELECT`), func(testsql.Request) testsql.Result {
+		return testsql.Result{Columns: []string{"first"}}
+	})
+	e.Handle("SELECT 1", func(testsql.Request) testsql.Result {
+		return testsql.Result{Columns: []string{"second"}}
+	})
+
+	resp := e.Submit("SELECT 1", "10s", nil)
+	assert.Equal(t, []string{"first"}, columnNames(resp))
+}
+
+func TestUnsupportedStatement(t *testing.T) {
+	e := testsql.New()
+	resp := e.Submit("SELECT 1", "10s", nil)
+	require.NotNil(t, resp.Status)
+	assert.Equal(t, sql.StatementStateFailed, resp.Status.State)
+	require.NotNil(t, resp.Status.Error)
+	assert.Equal(t, sql.ServiceErrorCodeBadRequest, resp.Status.Error.ErrorCode)
+	assert.Contains(t, resp.Status.Error.Message, "unsupported statement")
+	assert.Contains(t, resp.Status.Error.Message, "SELECT 1")
+}
+
+func TestWaitTimeout(t *testing.T) {
+	tests := []struct {
+		name        string
+		waitTimeout string
+		want        sql.StatementState
+	}{
+		{"async stays pending even without polls", "0s", sql.StatementStatePending},
+		{"sync with no polls terminates", "10s", sql.StatementStateSucceeded},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			e := testsql.New()
+			e.Handle("SELECT 1", func(testsql.Request) testsql.Result {
+				return testsql.Result{Rows: [][]string{{"x"}}}
+			})
+			resp := e.Submit("SELECT 1", tc.waitTimeout, nil)
+			assert.Equal(t, tc.want, resp.Status.State)
+		})
+	}
+}
+
+func TestPollCountdown(t *testing.T) {
+	e := testsql.New()
+	e.Handle("SELECT 1", func(testsql.Request) testsql.Result {
+		return testsql.Result{Rows: [][]string{{"done"}}, Polls: 2}
+	})
+
+	resp := e.Submit("SELECT 1", "10s", nil)
+	require.Equal(t, sql.StatementStatePending, resp.Status.State)
+
+	got := e.Get(resp.StatementId)
+	assert.Equal(t, sql.StatementStateRunning, got.Status.State)
+	got = e.Get(resp.StatementId)
+	assert.Equal(t, sql.StatementStateRunning, got.Status.State)
+
+	got = e.Get(resp.StatementId)
+	require.Equal(t, sql.StatementStateSucceeded, got.Status.State)
+	assert.Equal(t, [][]string{{"done"}}, got.Result.DataArray)
+}
+
+func TestChunkSplitting(t *testing.T) {
+	e := testsql.New()
+	rows := [][]string{{"0"}, {"1"}, {"2"}}
+	e.Handle("SELECT * FROM big", func(testsql.Request) testsql.Result {
+		return testsql.Result{Rows: rows, Chunks: 3}
+	})
+
+	resp := e.Submit("SELECT * FROM big", "10s", nil)
+	require.Equal(t, sql.StatementStateSucceeded, resp.Status.State)
+	require.NotNil(t, resp.Manifest)
+	assert.Equal(t, 3, resp.Manifest.TotalChunkCount)
+
+	var all [][]string
+	all = append(all, resp.Result.DataArray...)
+	for i := 1; i < resp.Manifest.TotalChunkCount; i++ {
+		chunk := e.Chunk(resp.StatementId, i)
+		require.NotNil(t, chunk)
+		all = append(all, chunk.DataArray...)
+	}
+	assert.Equal(t, rows, all)
+	assert.Equal(t, [][]string{{"0"}}, resp.Result.DataArray)
+	assert.Equal(t, [][]string{{"1"}}, e.Chunk(resp.StatementId, 1).DataArray)
+	assert.Equal(t, [][]string{{"2"}}, e.Chunk(resp.StatementId, 2).DataArray)
+}
+
+func TestNoRowsZeroChunks(t *testing.T) {
+	e := testsql.New()
+	e.Handle("CREATE TABLE foo", func(testsql.Request) testsql.Result {
+		return testsql.Result{}
+	})
+
+	// A no-row statement reports zero chunks and an empty result, matching the
+	// real API (a 0-row SELECT or a no-result-set DDL returns total_chunk_count=0).
+	resp := e.Submit("CREATE TABLE foo", "10s", nil)
+	require.Equal(t, sql.StatementStateSucceeded, resp.Status.State)
+	require.NotNil(t, resp.Manifest)
+	assert.Equal(t, 0, resp.Manifest.TotalChunkCount)
+	assert.Nil(t, resp.Manifest.Schema)
+	require.NotNil(t, resp.Result)
+	assert.Empty(t, resp.Result.DataArray)
+}
+
+func TestErrorResult(t *testing.T) {
+	e := testsql.New()
+	e.Handle("SELECT 1", func(testsql.Request) testsql.Result {
+		return testsql.Result{Error: &testsql.Error{
+			Code:     sql.ServiceErrorCodeBadRequest,
+			Message:  "no such table",
+			SQLState: "42P01",
+		}}
+	})
+
+	resp := e.Submit("SELECT 1", "10s", nil)
+	require.Equal(t, sql.StatementStateFailed, resp.Status.State)
+	assert.Equal(t, "42P01", resp.Status.SqlState)
+	require.NotNil(t, resp.Status.Error)
+	assert.Equal(t, sql.ServiceErrorCodeBadRequest, resp.Status.Error.ErrorCode)
+	assert.Equal(t, "no such table", resp.Status.Error.Message)
+	assert.Nil(t, resp.Manifest)
+	assert.Nil(t, resp.Result)
+}
+
+func TestCancelPrecedence(t *testing.T) {
+	e := testsql.New()
+	e.Handle("SELECT 1", func(testsql.Request) testsql.Result {
+		return testsql.Result{Polls: 5}
+	})
+
+	resp := e.Submit("SELECT 1", "0s", nil)
+	require.Equal(t, sql.StatementStatePending, resp.Status.State)
+
+	e.Cancel(resp.StatementId)
+
+	// Cancel takes precedence over the remaining polls.
+	got := e.Get(resp.StatementId)
+	assert.Equal(t, sql.StatementStateCanceled, got.Status.State)
+	assert.Nil(t, got.Manifest)
+	assert.Nil(t, got.Result)
+}
+
+func TestUnknownStatement(t *testing.T) {
+	e := testsql.New()
+	assert.Nil(t, e.Get("statement-99"))
+	assert.Nil(t, e.Chunk("statement-99", 0))
+	e.Cancel("statement-99") // no-op, must not panic
+}
+
+func TestDeterministicIDs(t *testing.T) {
+	e := testsql.New()
+	e.Handle("SELECT 1", func(testsql.Request) testsql.Result { return testsql.Result{} })
+	assert.Equal(t, "statement-1", e.Submit("SELECT 1", "10s", nil).StatementId)
+	assert.Equal(t, "statement-2", e.Submit("SELECT 1", "10s", nil).StatementId)
+}
+
+// TestStatefulMatcher proves the matcher runs exactly once per Submit and that
+// side effects persist across statements: a create matcher stores a body keyed
+// by a regex submatch, and a separate select matcher reads it back.
+func TestStatefulMatcher(t *testing.T) {
+	e := testsql.New()
+	store := map[string]string{}
+	calls := 0
+
+	e.HandlePattern(regexp.MustCompile(`^CREATE (\w+) AS (.+)$`), func(r testsql.Request) testsql.Result {
+		calls++
+		store[r.Match[1]] = r.Match[2]
+		return testsql.Result{}
+	})
+	e.HandlePattern(regexp.MustCompile(`^READ (\w+)$`), func(r testsql.Request) testsql.Result {
+		return testsql.Result{Columns: []string{"def"}, Rows: [][]string{{store[r.Match[1]]}}}
+	})
+
+	create := e.Submit("CREATE v AS body", "10s", nil)
+	require.Equal(t, sql.StatementStateSucceeded, create.Status.State)
+	assert.Equal(t, 1, calls, "matcher must run exactly once per Submit")
+
+	read := e.Submit("READ v", "10s", nil)
+	require.Equal(t, sql.StatementStateSucceeded, read.Status.State)
+	assert.Equal(t, [][]string{{"body"}}, read.Result.DataArray)
+	assert.Equal(t, 1, calls, "create matcher must not run again")
+}
+
+// columnNames mirrors how libs/sqlexec reads column names off the manifest.
+func columnNames(resp *sql.StatementResponse) []string {
+	if resp.Manifest == nil || resp.Manifest.Schema == nil {
+		return nil
+	}
+	out := make([]string, len(resp.Manifest.Schema.Columns))
+	for i, c := range resp.Manifest.Schema.Columns {
+		out[i] = c.Name
+	}
+	return out
+}
diff --git a/libs/testserver/uc_secrets.go b/libs/testserver/uc_secrets.go
new file mode 100644
index 00000000000..28bacf1fbed
--- /dev/null
+++ b/libs/testserver/uc_secrets.go
@@ -0,0 +1,206 @@
+package testserver
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+	"time"
+
+	sdktime "github.com/databricks/databricks-sdk-go/common/types/time"
+	"github.com/databricks/databricks-sdk-go/service/catalog"
+)
+
+// SecretsUcCreateSecret handles POST /api/2.1/unity-catalog/secrets
+func (s *FakeWorkspace) SecretsUcCreateSecret(req Request) Response {
+	defer s.LockUnlock()()
+
+	// The API accepts flat fields, not wrapped in a "secret" object
+	var inputSecret catalog.Secret
+	if err := json.Unmarshal(req.Body, &inputSecret); err != nil {
+		return Response{
+			StatusCode: 400,
+			Body:       map[string]string{"message": fmt.Sprintf("Failed to parse request: %s", err)},
+		}
+	}
+
+	if s.UCSecrets == nil {
+		s.UCSecrets = make(map[string]catalog.Secret)
+	}
+
+	fullName := fmt.Sprintf("%s.%s.%s",
+		inputSecret.CatalogName,
+		inputSecret.SchemaName,
+		inputSecret.Name)
+
+	// Check if secret already exists
+	if _, exists := s.UCSecrets[fullName]; exists {
+		return Response{
+			StatusCode: 409,
+			Body: map[string]any{
+				"error_code": "RESOURCE_ALREADY_EXISTS",
+				"message":    fmt.Sprintf("Secret %s already exists", fullName),
+			},
+		}
+	}
+
+	now := sdktime.New(time.Now())
+	secret := catalog.Secret{
+		CatalogName:    inputSecret.CatalogName,
+		SchemaName:     inputSecret.SchemaName,
+		Name:           inputSecret.Name,
+		FullName:       fullName,
+		Value:          inputSecret.Value,
+		EffectiveValue: inputSecret.Value,
+		Comment:        inputSecret.Comment,
+		Owner:          inputSecret.Owner,
+		ExpireTime:     inputSecret.ExpireTime,
+		CreateTime:     now,
+		UpdateTime:     now,
+		CreatedBy:      s.CurrentUser().UserName,
+		UpdatedBy:      s.CurrentUser().UserName,
+		EffectiveOwner: inputSecret.Owner,
+		MetastoreId:    "test-metastore-id",
+	}
+
+	if secret.Owner == "" {
+		secret.Owner = s.CurrentUser().UserName
+		secret.EffectiveOwner = s.CurrentUser().UserName
+	}
+
+	s.UCSecrets[fullName] = secret
+
+	return Response{
+		Body: secret,
+	}
+}
+
+// SecretsUcGetSecret handles GET /api/2.1/unity-catalog/secrets/{full_name}
+func (s *FakeWorkspace) SecretsUcGetSecret(req Request) Response {
+	defer s.LockUnlock()()
+
+	// Extract full_name from path parameter
+	fullName := req.Vars["full_name"]
+	if fullName == "" {
+		// Fallback: extract from path
+		parts := strings.Split(req.URL.Path, "/")
+		if len(parts) >= 6 {
+			fullName = parts[5]
+		}
+	}
+
+	secret, exists := s.UCSecrets[fullName]
+	if !exists {
+		return Response{
+			StatusCode: 404,
+			Body: map[string]any{
+				"error_code": "RESOURCE_DOES_NOT_EXIST",
+				"message":    fmt.Sprintf("Secret %s not found", fullName),
+			},
+		}
+	}
+
+	// Return secret without the actual value (only metadata)
+	// The real API doesn't return the value unless specifically requested
+	returnSecret := secret
+	returnSecret.EffectiveValue = secret.Value
+	returnSecret.Value = ""
+
+	return Response{
+		Body: returnSecret,
+	}
+}
+
+// SecretsUcUpdateSecret handles PATCH /api/2.1/unity-catalog/secrets/{full_name}
+func (s *FakeWorkspace) SecretsUcUpdateSecret(req Request) Response {
+	defer s.LockUnlock()()
+
+	// Extract full_name from path parameter
+	fullName := req.Vars["full_name"]
+	if fullName == "" {
+		// Fallback: extract from path
+		parts := strings.Split(req.URL.Path, "/")
+		if len(parts) >= 6 {
+			fullName = parts[5]
+		}
+	}
+
+	// The API accepts flat fields
+	var updateSecret catalog.Secret
+	if err := json.Unmarshal(req.Body, &updateSecret); err != nil {
+		return Response{
+			StatusCode: 400,
+			Body:       map[string]string{"message": fmt.Sprintf("Failed to parse request: %s", err)},
+		}
+	}
+
+	// Which fields the caller actually sent, so an explicit "comment": "" (the CLI force-sends it
+	// under update_mask=*) clears the value instead of being treated as "not provided".
+	fields, _ := parseUpdateFields(req.Body)
+
+	secret, exists := s.UCSecrets[fullName]
+	if !exists {
+		return Response{
+			StatusCode: 404,
+			Body: map[string]any{
+				"error_code": "RESOURCE_DOES_NOT_EXIST",
+				"message":    fmt.Sprintf("Secret %s not found", fullName),
+			},
+		}
+	}
+
+	// Update fields based on update mask
+	if updateSecret.Value != "" {
+		secret.Value = updateSecret.Value
+	}
+	if _, ok := fields["comment"]; ok {
+		secret.Comment = updateSecret.Comment
+	}
+	if updateSecret.Owner != "" {
+		secret.Owner = updateSecret.Owner
+		secret.EffectiveOwner = updateSecret.Owner
+	}
+	// Verified against a real workspace: even with update_mask=*, an absent
+	// expire_time leaves the existing one in place rather than clearing it, so a
+	// removal never takes effect and the next plan asks for it again.
+	if updateSecret.ExpireTime != nil {
+		secret.ExpireTime = updateSecret.ExpireTime
+	}
+
+	secret.UpdateTime = sdktime.New(time.Now())
+	secret.UpdatedBy = s.CurrentUser().UserName
+
+	s.UCSecrets[fullName] = secret
+
+	return Response{
+		Body: secret,
+	}
+}
+
+// SecretsUcDeleteSecret handles DELETE /api/2.1/unity-catalog/secrets/{full_name}
+func (s *FakeWorkspace) SecretsUcDeleteSecret(req Request) Response {
+	defer s.LockUnlock()()
+
+	// Extract full_name from path parameter
+	fullName := req.Vars["full_name"]
+	if fullName == "" {
+		// Fallback: extract from path
+		parts := strings.Split(req.URL.Path, "/")
+		if len(parts) >= 6 {
+			fullName = parts[5]
+		}
+	}
+
+	if _, exists := s.UCSecrets[fullName]; !exists {
+		return Response{
+			StatusCode: 404,
+			Body: map[string]any{
+				"error_code": "RESOURCE_DOES_NOT_EXIST",
+				"message":    fmt.Sprintf("Secret %s not found", fullName),
+			},
+		}
+	}
+
+	delete(s.UCSecrets, fullName)
+
+	return Response{}
+}
diff --git a/libs/testserver/vector_search_endpoints.go b/libs/testserver/vector_search_endpoints.go
index 99b980c6386..c051d599ccc 100644
--- a/libs/testserver/vector_search_endpoints.go
+++ b/libs/testserver/vector_search_endpoints.go
@@ -39,7 +39,7 @@ func (s *FakeWorkspace) VectorSearchEndpointCreate(req Request) Response {
 			State: vectorsearch.EndpointStatusStateOnline, // initial create is no-op, returns ONLINE immediately
 		},
 		ScalingInfo: &vectorsearch.EndpointScalingInfo{
-			RequestedMinQps: createReq.MinQps,
+			RequestedTargetQps: createReq.TargetQps,
 		},
 	}
 	endpoint.LastUpdatedTimestamp = endpoint.CreationTimestamp
@@ -106,7 +106,7 @@ func (s *FakeWorkspace) VectorSearchEndpointUpdate(req Request, endpointName str
 	if endpoint.ScalingInfo == nil {
 		endpoint.ScalingInfo = &vectorsearch.EndpointScalingInfo{}
 	}
-	endpoint.ScalingInfo.RequestedMinQps = patchReq.MinQps
+	endpoint.ScalingInfo.RequestedTargetQps = patchReq.TargetQps
 	endpoint.LastUpdatedTimestamp = nowMilli()
 	endpoint.LastUpdatedUser = s.CurrentUser().UserName
 
diff --git a/libs/testserver/vector_search_indexes.go b/libs/testserver/vector_search_indexes.go
new file mode 100644
index 00000000000..3e437c4d444
--- /dev/null
+++ b/libs/testserver/vector_search_indexes.go
@@ -0,0 +1,221 @@
+package testserver
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"regexp"
+	"strings"
+
+	"github.com/databricks/databricks-sdk-go/service/vectorsearch"
+)
+
+// indexNamePart matches each catalog.schema.table component the real backend
+// accepts: only alphanumerics and underscores.
+var indexNamePart = regexp.MustCompile(`^[A-Za-z0-9_]+$`)
+
+// indexNamePendingDeletion scopes the two-phase deletion simulation to the
+// pending-deletion recreate test. On the real backend every delete goes through
+// both phases, but the second phase usually completes before the CLI gets to
+// CREATE, so modelling it unconditionally would add a spurious retry to every
+// recreate test. Mirrors catalogNameManagedDefaults.
+const indexNamePendingDeletion = "vs_index_pending_deletion"
+
+// fakeVectorSearchIndex captures the endpoint's UUID at index creation time.
+// On the real backend an index is bound to a specific endpoint instance, not
+// just the name: deleting and recreating an endpoint with the same name yields
+// a different UUID, and the existing index keeps pointing at the OLD UUID
+// (i.e. is orphaned). Tracking this here lets tests reason about that drift.
+// The field is omitted from JSON responses since the real API doesn't return
+// it on the index path; the CLI looks it up via GetEndpointByEndpointName.
+type fakeVectorSearchIndex struct {
+	vectorsearch.VectorIndex
+	EndpointUuid string `json:"-"`
+}
+
+func (s *FakeWorkspace) VectorSearchIndexCreate(req Request) Response {
+	defer s.LockUnlock()()
+
+	var createReq vectorsearch.CreateVectorIndexRequest
+	if err := json.Unmarshal(req.Body, &createReq); err != nil {
+		return Response{
+			Body:       fmt.Sprintf("cannot unmarshal request body: %s", err),
+			StatusCode: http.StatusBadRequest,
+		}
+	}
+
+	if !isValidIndexName(createReq.Name) {
+		return Response{
+			StatusCode: http.StatusBadRequest,
+			Body: map[string]string{
+				"error_code": "INVALID_PARAMETER_VALUE",
+				"message":    "Invalid index name. Must specify the full index name <catalog>.<schema>.<table>. Only alphanumerics and underscores are allowed.",
+			},
+		}
+	}
+
+	if _, exists := s.VectorSearchIndexes[createReq.Name]; exists {
+		return Response{
+			StatusCode: http.StatusConflict,
+			Body:       map[string]string{"error_code": "RESOURCE_ALREADY_EXISTS", "message": fmt.Sprintf("Vector search index with name %s already exists", createReq.Name)},
+		}
+	}
+	if s.VectorSearchIndexesPendingDeletion[createReq.Name] > 0 {
+		s.VectorSearchIndexesPendingDeletion[createReq.Name]--
+		return Response{
+			StatusCode: http.StatusBadRequest,
+			Body: map[string]string{
+				"error_code": "INVALID_PARAMETER_VALUE",
+				"message":    fmt.Sprintf("Index %s is currently pending deletion. Operations on the index are not permitted while the index is being deleted.", createReq.Name),
+			},
+		}
+	}
+	endpoint, exists := s.VectorSearchEndpoints[createReq.EndpointName]
+	if !exists {
+		return Response{
+			StatusCode: http.StatusNotFound,
+			Body: map[string]string{
+				"error_code": "RESOURCE_DOES_NOT_EXIST",
+				"message":    fmt.Sprintf("Vector search endpoint %s not found", createReq.EndpointName),
+			},
+		}
+	}
+
+	// The backend assigns index_subtype when the request omits it (HYBRID by default)
+	indexSubtype := createReq.IndexSubtype
+	if indexSubtype == "" {
+		indexSubtype = vectorsearch.IndexSubtypeHybrid
+	}
+
+	// The backend rewrites schema_json on create: user-facing type names are
+	// stored as Spark type names (e.g. "integer" -> "int") and the columns are
+	// returned in sorted key order rather than the user's original order.
+	// Mirror that here so the create -> get round-trip matches the real API.
+	if createReq.DirectAccessIndexSpec != nil {
+		createReq.DirectAccessIndexSpec.SchemaJson = normalizeSchemaJSON(createReq.DirectAccessIndexSpec.SchemaJson)
+	}
+
+	index := fakeVectorSearchIndex{
+		Creator:               s.CurrentUser().UserName,
+		EndpointName:          createReq.EndpointName,
+		IndexType:             createReq.IndexType,
+		IndexSubtype:          indexSubtype,
+		Name:                  createReq.Name,
+		PrimaryKey:            createReq.PrimaryKey,
+		DeltaSyncIndexSpec:    remapDeltaSyncSpec(createReq.DeltaSyncIndexSpec),
+		DirectAccessIndexSpec: createReq.DirectAccessIndexSpec,
+		Status: &vectorsearch.VectorIndexStatus{
+			Ready: true,
+		},
+		EndpointUuid: endpoint.Id,
+	}
+
+	s.VectorSearchIndexes[createReq.Name] = index
+
+	return Response{
+		Body: index,
+	}
+}
+
+// VectorSearchIndexDelete removes the index and, for the pending-deletion test
+// name, records that the next CREATE for the same name must still be rejected.
+// The real backend releases the name only after the index has already stopped
+// being visible on GET, so a CLI that polls GET for absence can observe the
+// index as gone and still lose the race on CREATE.
+func (s *FakeWorkspace) VectorSearchIndexDelete(indexName string) Response {
+	defer s.LockUnlock()()
+
+	if _, ok := s.VectorSearchIndexes[indexName]; !ok {
+		return Response{StatusCode: http.StatusNotFound}
+	}
+	delete(s.VectorSearchIndexes, indexName)
+	if strings.Contains(indexName, indexNamePendingDeletion) {
+		s.VectorSearchIndexesPendingDeletion[indexName] = 1
+	}
+	return Response{}
+}
+
+// isValidIndexName checks that name is in catalog.schema.table form with
+// only alphanumerics and underscores per UC, mirroring the backend's
+// validation rejection at create time.
+func isValidIndexName(name string) bool {
+	parts := strings.Split(name, ".")
+	if len(parts) != 3 {
+		return false
+	}
+	for _, p := range parts {
+		if !indexNamePart.MatchString(p) {
+			return false
+		}
+	}
+	return true
+}
+
+// normalizeSchemaJSON rewrites a schema_json document the way the backend
+// stores it: user-facing column type names are folded to Spark type names and
+// the columns are re-serialized in sorted key order (encoding/json sorts map
+// keys, matching the backend). Returns the input unchanged when it isn't the
+// expected {"column":"type"} JSON object.
+func normalizeSchemaJSON(schemaJSON string) string {
+	if schemaJSON == "" {
+		return schemaJSON
+	}
+	var schema map[string]string
+	if err := json.Unmarshal([]byte(schemaJSON), &schema); err != nil {
+		return schemaJSON
+	}
+	for column, columnType := range schema {
+		schema[column] = normalizeColumnType(columnType)
+	}
+	// Disable HTML escaping so array<...> keeps its angle brackets verbatim
+	// rather than being rewritten to < / >.
+	var buf bytes.Buffer
+	enc := json.NewEncoder(&buf)
+	enc.SetEscapeHTML(false)
+	if err := enc.Encode(schema); err != nil {
+		return schemaJSON
+	}
+	return strings.TrimRight(buf.String(), "\n")
+}
+
+// normalizeColumnType maps the user-facing column type names the Vector
+// Search API accepts ("integer", "long", "short", "byte") to the Spark type
+// names Unity Catalog stores and GET returns, recursing into array element
+// types. Types whose user-facing and Spark spellings coincide ("float",
+// "string", ...) pass through unchanged.
+func normalizeColumnType(columnType string) string {
+	if inner, ok := strings.CutPrefix(columnType, "array<"); ok {
+		if elem, ok := strings.CutSuffix(inner, ">"); ok {
+			return "array<" + normalizeColumnType(elem) + ">"
+		}
+	}
+	switch columnType {
+	case "integer":
+		return "int"
+	case "long":
+		return "bigint"
+	case "short":
+		return "smallint"
+	case "byte":
+		return "tinyint"
+	default:
+		return columnType
+	}
+}
+
+// remapDeltaSyncSpec converts a request spec to a response spec.
+func remapDeltaSyncSpec(req *vectorsearch.DeltaSyncVectorIndexSpecRequest) *vectorsearch.DeltaSyncVectorIndexSpecResponse {
+	if req == nil {
+		return nil
+	}
+	return &vectorsearch.DeltaSyncVectorIndexSpecResponse{
+		ColumnsToIndex:          req.ColumnsToIndex,
+		ColumnsToSync:           req.ColumnsToSync,
+		EmbeddingSourceColumns:  req.EmbeddingSourceColumns,
+		EmbeddingVectorColumns:  req.EmbeddingVectorColumns,
+		EmbeddingWritebackTable: req.EmbeddingWritebackTable,
+		PipelineType:            req.PipelineType,
+		SourceTable:             req.SourceTable,
+	}
+}
diff --git a/libs/testserver/vector_search_indexes_test.go b/libs/testserver/vector_search_indexes_test.go
new file mode 100644
index 00000000000..6df73895fde
--- /dev/null
+++ b/libs/testserver/vector_search_indexes_test.go
@@ -0,0 +1,51 @@
+package testserver
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestNormalizeSchemaJSON(t *testing.T) {
+	tests := []struct {
+		name string
+		in   string
+		want string
+	}{
+		{
+			name: "user-facing type stored as Spark type name",
+			in:   `{"id":"integer","vector":"array<float>"}`,
+			want: `{"id":"int","vector":"array<float>"}`,
+		},
+		{
+			name: "all integer-family names",
+			in:   `{"a":"long","b":"short","c":"byte"}`,
+			want: `{"a":"bigint","b":"smallint","c":"tinyint"}`,
+		},
+		{
+			name: "array element type is mapped",
+			in:   `{"tags":"array<integer>"}`,
+			want: `{"tags":"array<int>"}`,
+		},
+		{
+			name: "matching spellings pass through and keys are sorted",
+			in:   `{"y":"float","x":"string","z":"int"}`,
+			want: `{"x":"string","y":"float","z":"int"}`,
+		},
+		{
+			name: "empty input",
+			in:   "",
+			want: "",
+		},
+		{
+			name: "non-object input is returned unchanged",
+			in:   "not json",
+			want: "not json",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, normalizeSchemaJSON(tt.in))
+		})
+	}
+}
diff --git a/libs/testserver/volumes.go b/libs/testserver/volumes.go
index 76b5fdf3e5f..91f29a94e4e 100644
--- a/libs/testserver/volumes.go
+++ b/libs/testserver/volumes.go
@@ -20,6 +20,9 @@ func (s *FakeWorkspace) VolumesCreate(req Request) Response {
 		}
 	}
 
+	// UC normalizes schema and volume names to lowercase.
+	volume.SchemaName = strings.ToLower(volume.SchemaName)
+	volume.Name = strings.ToLower(volume.Name)
 	volume.FullName = volume.CatalogName + "." + volume.SchemaName + "." + volume.Name
 
 	if volume.StorageLocation != "" && volume.VolumeType != catalog.VolumeTypeExternal {
@@ -73,6 +76,11 @@ func (s *FakeWorkspace) VolumesUpdate(req Request, fullname string) Response {
 		}
 	}
 
+	fields, errResponse := parseUCUpdate(req.Body, "UpdateVolume")
+	if errResponse != nil {
+		return *errResponse
+	}
+
 	var request catalog.UpdateVolumeRequestContent
 
 	if err := json.Unmarshal(req.Body, &request); err != nil {
@@ -82,13 +90,7 @@ func (s *FakeWorkspace) VolumesUpdate(req Request, fullname string) Response {
 		}
 	}
 
-	if request.Comment != "" {
-		existing.Comment = request.Comment
-	}
-
-	if request.Owner != "" {
-		existing.Owner = request.Owner
-	}
+	applyUpdatedFields(&existing, request, fields)
 
 	if request.NewName != "" {
 		delete(s.Volumes, fullname)
diff --git a/libs/testserver/workspace_test.go b/libs/testserver/workspace_test.go
new file mode 100644
index 00000000000..401758c6648
--- /dev/null
+++ b/libs/testserver/workspace_test.go
@@ -0,0 +1,196 @@
+package testserver_test
+
+import (
+	"encoding/json"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/databricks/cli/libs/testserver"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func importFile(t *testing.T, baseURL, path, body string) int {
+	t.Helper()
+	req, _ := http.NewRequest(http.MethodPost, baseURL+"/api/2.0/workspace-files/import-file/"+strings.TrimPrefix(path, "/")+"?overwrite=true", strings.NewReader(body))
+	req.Header.Set("Authorization", "Bearer test-token")
+	resp, err := http.DefaultClient.Do(req)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	return resp.StatusCode
+}
+
+func mkdirs(t *testing.T, baseURL, path string) {
+	t.Helper()
+	req, _ := http.NewRequest(http.MethodPost, baseURL+"/api/2.0/workspace/mkdirs", strings.NewReader(`{"path":"`+path+`"}`))
+	req.Header.Set("Authorization", "Bearer test-token")
+	resp, err := http.DefaultClient.Do(req)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	require.Equal(t, 200, resp.StatusCode)
+}
+
+func workspaceDelete(t *testing.T, baseURL, path string, recursive bool) int {
+	t.Helper()
+	body, err := json.Marshal(map[string]any{"path": path, "recursive": recursive})
+	require.NoError(t, err)
+	req, _ := http.NewRequest(http.MethodPost, baseURL+"/api/2.0/workspace/delete", strings.NewReader(string(body)))
+	req.Header.Set("Authorization", "Bearer test-token")
+	resp, err := http.DefaultClient.Do(req)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	return resp.StatusCode
+}
+
+func getStatus(t *testing.T, baseURL, path string) int {
+	t.Helper()
+	req, _ := http.NewRequest(http.MethodGet, baseURL+"/api/2.0/workspace/get-status?path="+path, nil)
+	req.Header.Set("Authorization", "Bearer test-token")
+	resp, err := http.DefaultClient.Do(req)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	return resp.StatusCode
+}
+
+// The real import API returns a 404 when the parent directory does not exist; it
+// does not create it. Callers get "mkdir -p" semantics only by calling mkdirs first.
+func TestWorkspaceImportRejectsMissingParent(t *testing.T) {
+	server := testserver.New(t)
+	testserver.AddDefaultHandlers(server)
+
+	assert.Equal(t, 404, importFile(t, server.URL, "/test-dir/file.py", "content"))
+
+	mkdirs(t, server.URL, "/test-dir")
+	assert.Equal(t, 200, importFile(t, server.URL, "/test-dir/file.py", "content"))
+}
+
+// A non-recursive delete only removes a directory that is truly empty, which is what
+// lets a caller clean up a parent directory without touching one still in use.
+func TestWorkspaceDeleteNonRecursiveRequiresEmptyDirectory(t *testing.T) {
+	server := testserver.New(t)
+	testserver.AddDefaultHandlers(server)
+
+	// A subdirectory keeps the parent.
+	mkdirs(t, server.URL, "/a/b/c")
+	assert.Equal(t, 400, workspaceDelete(t, server.URL, "/a/b", false))
+	assert.Equal(t, 200, getStatus(t, server.URL, "/a/b"))
+
+	// So does a file.
+	mkdirs(t, server.URL, "/f/dir")
+	require.Equal(t, 200, importFile(t, server.URL, "/f/dir/file.py", "content"))
+	assert.Equal(t, 400, workspaceDelete(t, server.URL, "/f/dir", false))
+	assert.Equal(t, 200, getStatus(t, server.URL, "/f/dir"))
+
+	// Emptied out, both go.
+	assert.Equal(t, 200, workspaceDelete(t, server.URL, "/a/b/c", false))
+	assert.Equal(t, 200, workspaceDelete(t, server.URL, "/a/b", false))
+	assert.Equal(t, 404, getStatus(t, server.URL, "/a/b"))
+}
+
+// format=AUTO matches the extension case-insensitively, so ".R" — the
+// conventional spelling for R sources — is detected as a notebook just like
+// ".r". Notebooks are stored with the extension stripped.
+func TestWorkspaceImportDetectsNotebookExtensionCaseInsensitively(t *testing.T) {
+	server := testserver.New(t)
+	testserver.AddDefaultHandlers(server)
+
+	mkdirs(t, server.URL, "/test-dir")
+
+	for _, name := range []string{"lower.r", "upper.R"} {
+		require.Equal(t, 200, importFile(t, server.URL, "/test-dir/"+name, "# Databricks notebook source\n"), name)
+	}
+
+	// Both land at the extension-stripped path, which only happens for notebooks.
+	assert.Equal(t, 200, getStatus(t, server.URL, "/test-dir/lower"))
+	assert.Equal(t, 200, getStatus(t, server.URL, "/test-dir/upper"))
+}
+
+// mkdirs creates all intermediate directories, matching "mkdir -p".
+func TestWorkspaceMkdirsRecursive(t *testing.T) {
+	server := testserver.New(t)
+	testserver.AddDefaultHandlers(server)
+
+	mkdirs(t, server.URL, "/a/b/c")
+
+	for _, dir := range []string{"/a", "/a/b", "/a/b/c"} {
+		assert.Equal(t, 200, getStatus(t, server.URL, dir), dir)
+	}
+}
+
+func createRepo(t *testing.T, baseURL, path string) {
+	t.Helper()
+	body := `{"url":"https://github.com/databricks/cli","provider":"gitHub","path":"` + path + `"}`
+	req, _ := http.NewRequest(http.MethodPost, baseURL+"/api/2.0/repos", strings.NewReader(body))
+	req.Header.Set("Authorization", "Bearer test-token")
+	resp, err := http.DefaultClient.Do(req)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	require.Equal(t, 200, resp.StatusCode)
+}
+
+func getStatusBody(t *testing.T, baseURL, path string, returnGitInfo bool) map[string]any {
+	t.Helper()
+	url := baseURL + "/api/2.0/workspace/get-status?path=" + path
+	if returnGitInfo {
+		url += "&return_git_info=true"
+	}
+	req, _ := http.NewRequest(http.MethodGet, url, nil)
+	req.Header.Set("Authorization", "Bearer test-token")
+	resp, err := http.DefaultClient.Do(req)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	require.Equal(t, 200, resp.StatusCode)
+
+	var out map[string]any
+	require.NoError(t, json.NewDecoder(resp.Body).Decode(&out))
+	return out
+}
+
+// How a Git folder is described on the wire: the object type, directory_info and
+// the presence of git_info. The acceptance tests read the resolved metadata
+// rather than the response, so these fields are only pinned here.
+
+// A standard Git folder keeps the REPO object type and reports the full metadata,
+// and only when it is asked for.
+func TestWorkspaceGetStatusGitInfoForRepo(t *testing.T) {
+	server := testserver.New(t)
+	testserver.AddDefaultHandlers(server)
+
+	createRepo(t, server.URL, "/Repos/me/myrepo")
+
+	assert.NotContains(t, getStatusBody(t, server.URL, "/Repos/me/myrepo", false), "git_info")
+
+	body := getStatusBody(t, server.URL, "/Repos/me/myrepo", true)
+	assert.Equal(t, "REPO", body["object_type"])
+	assert.NotContains(t, body, "directory_info")
+
+	gitInfo, ok := body["git_info"].(map[string]any)
+	require.True(t, ok, "expected git_info in %v", body)
+	assert.Equal(t, "main", gitInfo["branch"])
+	assert.NotEmpty(t, gitInfo["head_commit_id"])
+	assert.Equal(t, "https://github.com/databricks/cli", gitInfo["url"])
+}
+
+// A Git folder with Git CLI access is a DIRECTORY that marks itself through
+// directory_info, and reports only the id and path.
+func TestWorkspaceGetStatusGitInfoForGitCliFolder(t *testing.T) {
+	server := testserver.New(t)
+	testserver.AddDefaultHandlers(server)
+
+	createRepo(t, server.URL, "/Workspace/Users/me/gitfolder")
+	body := getStatusBody(t, server.URL, "/Workspace/Users/me/gitfolder", true)
+
+	assert.Equal(t, "DIRECTORY", body["object_type"])
+	dirInfo, ok := body["directory_info"].(map[string]any)
+	require.True(t, ok, "expected directory_info in %v", body)
+	assert.Equal(t, true, dirInfo["is_git_folder"])
+
+	gitInfo, ok := body["git_info"].(map[string]any)
+	require.True(t, ok, "expected git_info in %v", body)
+	assert.Equal(t, "/Users/me/gitfolder", gitInfo["path"])
+	assert.NotEmpty(t, gitInfo["id"])
+	assert.NotContains(t, gitInfo, "branch")
+	assert.NotContains(t, gitInfo, "head_commit_id")
+	assert.NotContains(t, gitInfo, "url")
+}
diff --git a/libs/vendored_py_packages/databricks_lakeflow_integrations-0.0.3-py3-none-any.whl b/libs/vendored_py_packages/databricks_lakeflow_integrations-0.0.3-py3-none-any.whl
new file mode 100644
index 00000000000..d3179c0096e
Binary files /dev/null and b/libs/vendored_py_packages/databricks_lakeflow_integrations-0.0.3-py3-none-any.whl differ
diff --git a/libs/vendored_py_packages/editables-0.6-py3-none-any.whl b/libs/vendored_py_packages/editables-0.6-py3-none-any.whl
new file mode 100644
index 00000000000..ecf5eae40e7
Binary files /dev/null and b/libs/vendored_py_packages/editables-0.6-py3-none-any.whl differ
diff --git a/libs/versioncheck/notice.go b/libs/versioncheck/notice.go
new file mode 100644
index 00000000000..dc3a9d5c864
--- /dev/null
+++ b/libs/versioncheck/notice.go
@@ -0,0 +1,286 @@
+package versioncheck
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"time"
+
+	"github.com/databricks/cli/internal/build"
+	"github.com/databricks/cli/libs/cache"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/dbr"
+	"github.com/databricks/cli/libs/env"
+	"github.com/databricks/cli/libs/log"
+	"github.com/spf13/cobra"
+)
+
+const (
+	// cacheComponent names the on-disk cache bucket (under the bundle file
+	// cache). cacheTTL drives both the once-per-day network check and the
+	// once-per-day display: the file cache treats an entry older than the TTL
+	// as a miss, so the latest version is refetched and the user is nudged at
+	// most once per day. The cache is namespaced by CLI version, so it resets
+	// automatically after an upgrade.
+	cacheComponent = "update-check"
+	cacheTTL       = 24 * time.Hour
+
+	// backgroundTimeout bounds the background fetch so an abandoned goroutine
+	// doesn't linger when GitHub is slow or unreachable.
+	backgroundTimeout = 3 * time.Second
+
+	latestFingerprint   = "latest-release"
+	notifiedFingerprint = "notified"
+
+	// disableEnv is an explicit opt-out for the passive notice.
+	disableEnv = "DATABRICKS_CLI_DISABLE_UPDATE_CHECK"
+
+	// cacheEnabledEnv mirrors libs/cache's env knob. We read it directly to
+	// skip the check entirely when caching is turned off: with the cache in
+	// measurement-only mode, every command would otherwise refetch.
+	cacheEnabledEnv = "DATABRICKS_CACHE_ENABLED"
+
+	// ciEnv: virtually all CI providers set this, so suppress the notice there
+	// even when a pseudo-TTY is allocated.
+	// https://docs.github.com/actions/learn-github-actions/variables
+	ciEnv = "CI"
+
+	// refreshLockName is the single-flight sentinel: across many concurrent CLI
+	// processes only the one that creates it fetches, so a fleet starting at
+	// once sends at most one request to GitHub per machine.
+	refreshLockName = "databricks-cli-update-check.lock"
+	// lockStaleAfter reclaims a lock left behind when the process exited while
+	// the background goroutine was still fetching, so its deferred release never
+	// ran. It must comfortably exceed backgroundTimeout so a live fetch is never
+	// mistaken for an abandoned lock.
+	lockStaleAfter = 30 * time.Second
+)
+
+// StartBackgroundRefresh fetches the latest release in the background (at most
+// once per day) and stores it in the cache, so a later command can show the
+// notice without a blocking network call. It is a no-op when the notice would
+// be suppressed anyway. Safe to call on every invocation.
+//
+//deadcode:allow Passive update notice paused for 1.4.0: unwired from cmd/root while we settle how to target long-lived, outdated environments without nagging fresh installs. Re-enable by restoring the root command calls.
+func StartBackgroundRefresh(ctx context.Context, cmd *cobra.Command) {
+	if !notifyEnabled(ctx, cmd) {
+		return
+	}
+	go func() {
+		// A panic in this best-effort goroutine must never crash the CLI.
+		defer func() {
+			if r := recover(); r != nil {
+				log.Debugf(ctx, "version check: background refresh panic: %v", r)
+			}
+		}()
+		ctx, cancel := context.WithTimeout(ctx, backgroundTimeout)
+		defer cancel()
+		if err := refreshLatest(ctx); err != nil {
+			log.Debugf(ctx, "version check: background refresh failed: %v", err)
+		}
+	}()
+}
+
+// refreshLatest fetches and caches the latest release, but only when the cached
+// value is older than cacheTTL (or absent), and only one process at a time per
+// machine performs the fetch.
+func refreshLatest(ctx context.Context) error {
+	c := cache.NewCache(ctx, cacheComponent, cacheTTL, nil)
+
+	// Common path: a fresh entry means no fetch and no lock churn.
+	if _, fresh := cache.Get[latestRelease](ctx, c, latestFingerprint); fresh {
+		return nil
+	}
+
+	// Single-flight across processes so a fleet of CLIs doesn't stampede GitHub.
+	release, ok := tryAcquireRefreshLock(ctx)
+	if !ok {
+		return nil
+	}
+	defer release()
+
+	// GetOrCompute re-checks freshness under the lock, so a process that lost
+	// the race reads the just-written value instead of fetching again.
+	_, err := cache.GetOrCompute(ctx, c, latestFingerprint, fetchLatestRelease)
+	if err != nil {
+		// Cache the failure too: an offline or airgapped machine should not
+		// retry GitHub on every command. The empty entry reads as "no update
+		// available" and expires with the normal TTL.
+		cache.Put(ctx, c, latestFingerprint, latestRelease{})
+	}
+	return err
+}
+
+// tryAcquireRefreshLock claims a best-effort, machine-wide single-flight lock
+// via an O_EXCL sentinel file. It returns (release, true) when the caller may
+// fetch, or (nil, false) when another process holds a fresh lock or the lock
+// can't be created. A lock older than lockStaleAfter is treated as abandoned
+// (the holder crashed) and stolen. This is best-effort coordination to prevent
+// a thundering herd, not a correctness-critical lock; a dedicated flock library
+// would avoid the staleness heuristic but isn't a dependency here.
+func tryAcquireRefreshLock(ctx context.Context) (func(), bool) {
+	// The lock lives in the cache root: per-user, so another user's stale lock
+	// on a shared machine can never block (or be stolen by) this one. The
+	// directory exists by the time this runs because refreshLatest constructs
+	// the cache first; if that failed, failing to lock here is the right call.
+	dir, err := cache.BaseDir(ctx)
+	if err != nil {
+		return nil, false
+	}
+	lockPath := filepath.Join(dir, refreshLockName)
+
+	for range 2 {
+		f, err := os.OpenFile(lockPath, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0o600)
+		if err == nil {
+			_ = f.Close()
+			return func() { _ = os.Remove(lockPath) }, true
+		}
+		if !errors.Is(err, fs.ErrExist) {
+			return nil, false
+		}
+		info, statErr := os.Stat(lockPath)
+		if statErr != nil || time.Since(info.ModTime()) <= lockStaleAfter {
+			return nil, false
+		}
+		_ = os.Remove(lockPath) // stale; steal it and retry once
+	}
+	return nil, false
+}
+
+// Notice returns a "new release available" message to print after a command, or
+// an empty string when nothing should be shown. runErr is the command's result;
+// the notice is suppressed when it is non-nil so a hint never stacks on an error.
+func Notice(ctx context.Context, cmd *cobra.Command, runErr error) (msg string) {
+	// A failure here must never affect the user's command, which has already
+	// completed by the time this runs.
+	defer func() {
+		if r := recover(); r != nil {
+			log.Debugf(ctx, "version check: notice panic: %v", r)
+			msg = ""
+		}
+	}()
+
+	if runErr != nil || !notifyEnabled(ctx, cmd) {
+		return ""
+	}
+	return noticeMessage(ctx)
+}
+
+// noticeMessage renders the advisory from the cached latest release, or returns
+// "" when the CLI is current, the cache is cold, or the once-per-day nudge has
+// already fired. It reads the cache only, never the network.
+func noticeMessage(ctx context.Context) string {
+	c := cache.NewCache(ctx, cacheComponent, cacheTTL, nil)
+	latest, ok := cache.Get[latestRelease](ctx, c, latestFingerprint)
+	if !ok {
+		// Not refreshed yet (cold or stale cache); a background refresh will
+		// warm it for a later command.
+		return ""
+	}
+
+	current := build.GetInfo().Version
+	if !isNewer(current, latest.Version) {
+		return ""
+	}
+
+	// Nudge at most once per cacheTTL: a fresh "notified" marker means we
+	// already showed the notice today.
+	if _, notified := cache.Get[bool](ctx, c, notifiedFingerprint); notified {
+		return ""
+	}
+	cache.Put(ctx, c, notifiedFingerprint, true)
+
+	_, command := DetectInstallMethod(ctx)
+	return noticeText(ctx, current, latest, command)
+}
+
+// noticeText formats the advisory: the version delta, a link to the release for
+// the changelog, and the upgrade command for the detected install method.
+func noticeText(ctx context.Context, current string, latest latestRelease, upgradeCommand string) string {
+	msg := fmt.Sprintf("A new release of the Databricks CLI is available: %s → %s", current, latest.Version)
+	if latest.URL != "" {
+		msg += "\n" + latest.URL
+	}
+	if upgradeCommand != "" {
+		msg += "\nTo upgrade, run: " + upgradeCommand
+	} else {
+		msg += "\nSee https://github.com/databricks/cli/releases to upgrade."
+	}
+	return cmdio.Yellow(ctx, msg)
+}
+
+// notifyConditions captures the environment inputs for the passive-notice
+// decision, keeping the policy (shouldNotify) a pure, table-testable function.
+type notifyConditions struct {
+	developmentBuild bool // dev/snapshot build: nothing to upgrade to
+	cacheDisabled    bool // file cache off: nothing to store or read
+	optedOut         bool // DATABRICKS_CLI_DISABLE_UPDATE_CHECK
+	onRuntime        bool // Databricks Runtime: version is platform-managed
+	ci               bool // continuous integration
+	nonInteractive   bool // no usable terminal (pipes, cron, redirected)
+	jsonOutput       bool // machine-readable output kept clean for scripts
+	exemptCommand    bool // version/completion/help: notice would be noise
+}
+
+// shouldNotify reports whether the passive notice should run for the given
+// conditions. It errs toward silence: any single reason suppresses it.
+func shouldNotify(c notifyConditions) bool {
+	switch {
+	case c.developmentBuild, c.cacheDisabled, c.optedOut, c.onRuntime,
+		c.ci, c.nonInteractive, c.jsonOutput, c.exemptCommand:
+		return false
+	}
+	return true
+}
+
+// notifyEnabled gathers the current conditions and applies the policy.
+func notifyEnabled(ctx context.Context, cmd *cobra.Command) bool {
+	return shouldNotify(gatherConditions(ctx, cmd))
+}
+
+func gatherConditions(ctx context.Context, cmd *cobra.Command) notifyConditions {
+	optedOut, _ := env.GetBool(ctx, disableEnv)
+	ci, _ := env.GetBool(ctx, ciEnv)
+	cacheDisabled := false
+	if enabled, ok := env.GetBool(ctx, cacheEnabledEnv); ok && !enabled {
+		cacheDisabled = true
+	}
+	// Both probes below panic on a context that skipped the usual command
+	// setup, which legitimately happens here: cobra resolves --help and bare
+	// invocations before PersistentPreRunE installs cmdio, and tests execute
+	// commands without root.Execute's dbr detection. Missing IO means we have
+	// no terminal to print to (suppress); unknown runtime means not DBR.
+	nonInteractive := !cmdio.HasIO(ctx) || cmdio.GetInteractiveMode(ctx) == cmdio.InteractiveModeNone
+	onRuntime := dbr.HasDetection(ctx) && dbr.RunsOnRuntime(ctx)
+	return notifyConditions{
+		developmentBuild: build.GetInfo().IsDevelopment(),
+		cacheDisabled:    cacheDisabled,
+		optedOut:         optedOut,
+		onRuntime:        onRuntime,
+		ci:               ci,
+		nonInteractive:   nonInteractive,
+		jsonOutput:       isJSONOutput(cmd),
+		exemptCommand:    isExemptCommand(cmd),
+	}
+}
+
+func isJSONOutput(cmd *cobra.Command) bool {
+	f := cmd.Flag("output")
+	return f != nil && f.Value.String() == "json"
+}
+
+// isExemptCommand suppresses the notice for commands where it would be noise or
+// would corrupt machine-readable output: the version commands themselves, shell
+// completion, and help.
+func isExemptCommand(cmd *cobra.Command) bool {
+	for c := cmd; c != nil; c = c.Parent() {
+		switch c.Name() {
+		case "version", "completion", "help", cobra.ShellCompRequestCmd, cobra.ShellCompNoDescRequestCmd:
+			return true
+		}
+	}
+	return false
+}
diff --git a/libs/versioncheck/notice_test.go b/libs/versioncheck/notice_test.go
new file mode 100644
index 00000000000..eadd50c707c
--- /dev/null
+++ b/libs/versioncheck/notice_test.go
@@ -0,0 +1,245 @@
+package versioncheck
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/databricks/cli/internal/build"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/dbr"
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// cacheDirEnv relocates the file cache, and with it the refresh lock, so tests
+// never touch the user's real cache.
+const cacheDirEnv = "DATABRICKS_CACHE_DIR"
+
+func startReleaseServer(t *testing.T, tag, htmlURL string) string {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte(`{"tag_name":"` + tag + `","html_url":"` + htmlURL + `"}`))
+	}))
+	t.Cleanup(srv.Close)
+	return srv.URL
+}
+
+func interactiveContext(t *testing.T) context.Context {
+	ctx := cmdio.InContext(t.Context(), cmdio.NewTestIO(strings.NewReader(""), io.Discard, io.Discard))
+	// gatherConditions reads dbr.RunsOnRuntime, which requires a detected context.
+	return dbr.MockRuntime(ctx, dbr.Environment{})
+}
+
+func regularCmd(t *testing.T) *cobra.Command {
+	c := &cobra.Command{Use: "deploy"}
+	c.Flags().String("output", "text", "")
+	return c
+}
+
+func TestShouldNotify(t *testing.T) {
+	tests := []struct {
+		name string
+		c    notifyConditions
+		want bool
+	}{
+		{"all clear", notifyConditions{}, true},
+		{"development build", notifyConditions{developmentBuild: true}, false},
+		{"cache disabled", notifyConditions{cacheDisabled: true}, false},
+		{"opted out", notifyConditions{optedOut: true}, false},
+		{"on databricks runtime", notifyConditions{onRuntime: true}, false},
+		{"ci", notifyConditions{ci: true}, false},
+		{"non-interactive", notifyConditions{nonInteractive: true}, false},
+		{"json output", notifyConditions{jsonOutput: true}, false},
+		{"exempt command", notifyConditions{exemptCommand: true}, false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, shouldNotify(tt.c))
+		})
+	}
+}
+
+func TestGatherConditions(t *testing.T) {
+	original := build.GetInfo().Version
+	t.Cleanup(func() { build.SetBuildVersion(original) })
+	build.SetBuildVersion("0.240.0")
+
+	t.Run("all clear for an interactive release build", func(t *testing.T) {
+		t.Setenv(ciEnv, "false")
+		t.Setenv(disableEnv, "false")
+		assert.True(t, shouldNotify(gatherConditions(interactiveContext(t), regularCmd(t))))
+	})
+
+	t.Run("CI env", func(t *testing.T) {
+		t.Setenv(ciEnv, "true")
+		t.Setenv(disableEnv, "false")
+		assert.True(t, gatherConditions(interactiveContext(t), regularCmd(t)).ci)
+	})
+
+	t.Run("opt-out env", func(t *testing.T) {
+		t.Setenv(ciEnv, "false")
+		t.Setenv(disableEnv, "true")
+		assert.True(t, gatherConditions(interactiveContext(t), regularCmd(t)).optedOut)
+	})
+
+	t.Run("cache disabled", func(t *testing.T) {
+		t.Setenv(ciEnv, "false")
+		t.Setenv(disableEnv, "false")
+		t.Setenv(cacheEnabledEnv, "false")
+		assert.True(t, gatherConditions(interactiveContext(t), regularCmd(t)).cacheDisabled)
+	})
+
+	t.Run("json output", func(t *testing.T) {
+		t.Setenv(ciEnv, "false")
+		t.Setenv(disableEnv, "false")
+		c := regularCmd(t)
+		require.NoError(t, c.Flags().Set("output", "json"))
+		assert.True(t, gatherConditions(interactiveContext(t), c).jsonOutput)
+	})
+
+	t.Run("non-interactive", func(t *testing.T) {
+		t.Setenv(ciEnv, "false")
+		t.Setenv(disableEnv, "false")
+		ctx, _ := cmdio.NewTestContextWithStdout(t.Context())
+		ctx = dbr.MockRuntime(ctx, dbr.Environment{})
+		assert.True(t, gatherConditions(ctx, regularCmd(t)).nonInteractive)
+	})
+
+	t.Run("bare context without cmdio or dbr detection", func(t *testing.T) {
+		// Help invocations skip PersistentPreRunE (no cmdio) and tests execute
+		// commands without root.Execute (no dbr detection); neither may panic.
+		t.Setenv(ciEnv, "false")
+		t.Setenv(disableEnv, "false")
+		c := gatherConditions(t.Context(), regularCmd(t))
+		assert.True(t, c.nonInteractive)
+		assert.False(t, c.onRuntime)
+	})
+}
+
+func TestIsExemptCommand(t *testing.T) {
+	withParent := func(parent, child string) *cobra.Command {
+		p := &cobra.Command{Use: parent}
+		c := &cobra.Command{Use: child}
+		p.AddCommand(c)
+		return c
+	}
+
+	tests := []struct {
+		name string
+		cmd  *cobra.Command
+		want bool
+	}{
+		{"version", &cobra.Command{Use: "version"}, true},
+		{"completion subcommand", withParent("completion", "zsh"), true},
+		{"completion", &cobra.Command{Use: "completion"}, true},
+		{"help", &cobra.Command{Use: "help"}, true},
+		{"shell completion request", &cobra.Command{Use: cobra.ShellCompRequestCmd}, true},
+		{"regular command", &cobra.Command{Use: "bundle"}, false},
+		{"regular subcommand", withParent("bundle", "deploy"), false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, isExemptCommand(tt.cmd))
+		})
+	}
+}
+
+func TestNoticeMessage(t *testing.T) {
+	original := build.GetInfo().Version
+	t.Cleanup(func() { build.SetBuildVersion(original) })
+
+	warm := func(t *testing.T, current, latestTag, latestURL string) {
+		t.Setenv(cacheDirEnv, t.TempDir())
+		t.Setenv(gitHubAPIURLEnv, startReleaseServer(t, latestTag, latestURL))
+		build.SetBuildVersion(current)
+		require.NoError(t, refreshLatest(t.Context()))
+	}
+
+	t.Run("update available, nudged at most once per day", func(t *testing.T) {
+		warm(t, "0.240.0", "v0.245.0", "https://example.test/releases/tag/v0.245.0")
+
+		msg := noticeMessage(t.Context())
+		assert.Contains(t, msg, "0.240.0 → 0.245.0")
+		assert.Contains(t, msg, "https://example.test/releases/tag/v0.245.0")
+
+		// Throttled the second time the same day.
+		assert.Empty(t, noticeMessage(t.Context()))
+	})
+
+	t.Run("no notice when up to date", func(t *testing.T) {
+		warm(t, "0.245.0", "v0.245.0", "https://example.test/x")
+		assert.Empty(t, noticeMessage(t.Context()))
+	})
+
+	t.Run("no notice when cache is cold", func(t *testing.T) {
+		t.Setenv(cacheDirEnv, t.TempDir())
+		build.SetBuildVersion("0.240.0")
+		assert.Empty(t, noticeMessage(t.Context()))
+	})
+}
+
+func TestNoticeSuppressedOnError(t *testing.T) {
+	assert.Empty(t, Notice(t.Context(), &cobra.Command{Use: "deploy"}, errors.New("boom")))
+}
+
+func TestRefreshLatestCachesFailure(t *testing.T) {
+	original := build.GetInfo().Version
+	t.Cleanup(func() { build.SetBuildVersion(original) })
+	build.SetBuildVersion("0.240.0")
+	t.Setenv(cacheDirEnv, t.TempDir())
+
+	var hits atomic.Int32
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		hits.Add(1)
+		w.WriteHeader(http.StatusInternalServerError)
+	}))
+	t.Cleanup(srv.Close)
+	t.Setenv(gitHubAPIURLEnv, srv.URL)
+
+	require.Error(t, refreshLatest(t.Context()))
+	require.Equal(t, int32(1), hits.Load())
+
+	// The failure is cached: the next command neither retries the fetch nor
+	// shows a notice until the entry expires.
+	require.NoError(t, refreshLatest(t.Context()))
+	assert.Equal(t, int32(1), hits.Load())
+	assert.Empty(t, noticeMessage(t.Context()))
+}
+
+func TestTryAcquireRefreshLock(t *testing.T) {
+	dir := t.TempDir()
+	t.Setenv(cacheDirEnv, dir)
+	ctx := t.Context()
+
+	release, ok := tryAcquireRefreshLock(ctx)
+	require.True(t, ok)
+
+	// A second caller is locked out while the first holds the lock.
+	_, ok2 := tryAcquireRefreshLock(ctx)
+	assert.False(t, ok2)
+
+	// After release, the lock can be acquired again.
+	release()
+	release2, ok3 := tryAcquireRefreshLock(ctx)
+	require.True(t, ok3)
+	release2()
+
+	// A lock left behind by a crashed holder (old mtime, never released) is
+	// reclaimed once it is older than lockStaleAfter.
+	lockPath := filepath.Join(dir, refreshLockName)
+	require.NoError(t, os.WriteFile(lockPath, nil, 0o600))
+	old := time.Now().Add(-2 * lockStaleAfter)
+	require.NoError(t, os.Chtimes(lockPath, old, old))
+	release3, ok4 := tryAcquireRefreshLock(ctx)
+	require.True(t, ok4)
+	release3()
+}
diff --git a/libs/versioncheck/versioncheck.go b/libs/versioncheck/versioncheck.go
new file mode 100644
index 00000000000..0a78cf35192
--- /dev/null
+++ b/libs/versioncheck/versioncheck.go
@@ -0,0 +1,221 @@
+// Package versioncheck reports whether a newer Databricks CLI release is
+// available and, based on how the running binary was installed, how to upgrade.
+package versioncheck
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"time"
+
+	"github.com/databricks/cli/internal/build"
+	"github.com/databricks/cli/libs/env"
+	"github.com/databricks/cli/libs/log"
+	"golang.org/x/mod/semver"
+)
+
+const (
+	// GitHub returns the latest non-prerelease, non-draft release here, which is
+	// exactly the "latest stable" the CLI ships from.
+	// https://docs.github.com/en/rest/releases/releases#get-the-latest-release
+	defaultGitHubAPIURL = "https://api.github.com"
+	latestReleasePath   = "/repos/databricks/cli/releases/latest"
+
+	// gitHubAPIURLEnv overrides the GitHub API base URL. It lets acceptance
+	// tests point the lookup at the mock server (and gives airgapped setups an
+	// escape hatch); it is not a documented, user-facing setting.
+	gitHubAPIURLEnv = "DATABRICKS_CLI_GITHUB_API_URL"
+
+	// fetchTimeout bounds the release lookup. The explicit `version --check`
+	// waits on it, so keep it short: a quick "couldn't reach GitHub" beats a hang.
+	fetchTimeout = 2 * time.Second
+)
+
+// Upgrade commands per install method, matching the documented install flows:
+// https://docs.databricks.com/dev-tools/cli/install.html
+const (
+	upgradeHomebrew   = "brew upgrade databricks"
+	upgradeWinget     = "winget upgrade Databricks.DatabricksCLI"
+	upgradeChocolatey = "choco upgrade databricks-cli"
+	upgradeScript     = "curl -fsSL https://raw.githubusercontent.com/databricks/setup-cli/main/install.sh | sh"
+)
+
+// InstallMethod identifies how the running binary was installed, which
+// determines the command a user runs to upgrade.
+type InstallMethod string
+
+const (
+	InstallHomebrew   InstallMethod = "homebrew"
+	InstallWinget     InstallMethod = "winget"
+	InstallChocolatey InstallMethod = "chocolatey"
+	InstallScript     InstallMethod = "script" // the curl | sh installer
+	InstallUnknown    InstallMethod = "unknown"
+)
+
+// Result is the outcome of an update check.
+type Result struct {
+	CurrentVersion   string `json:"current_version"`
+	LatestVersion    string `json:"latest_version,omitempty"`
+	UpdateAvailable  bool   `json:"update_available"`
+	DevelopmentBuild bool   `json:"development_build,omitempty"`
+	// CheckFailed is set when the latest version couldn't be fetched (offline,
+	// timeout, rate-limited). The command reports this gently instead of erroring.
+	CheckFailed    bool          `json:"check_failed,omitempty"`
+	InstallMethod  InstallMethod `json:"install_method,omitempty"`
+	UpgradeCommand string        `json:"upgrade_command,omitempty"`
+}
+
+// Check fetches the latest released version and compares it with the running
+// build, reporting how to upgrade based on the detected install method. It
+// never fails: lookup errors are reported via Result.CheckFailed.
+//
+// Development and snapshot builds have no meaningful released version to
+// compare against, so they short-circuit without a network call.
+func Check(ctx context.Context) *Result {
+	info := build.GetInfo()
+	if info.IsDevelopment() {
+		return &Result{
+			CurrentVersion:   info.Version,
+			DevelopmentBuild: true,
+		}
+	}
+
+	method, command := DetectInstallMethod(ctx)
+
+	ctx, cancel := context.WithTimeout(ctx, fetchTimeout)
+	defer cancel()
+	latest, err := fetchLatestVersion(ctx)
+	if err != nil {
+		// Fail gently: a failed lookup shouldn't fail the command. The caller
+		// renders a "couldn't reach GitHub" message instead.
+		log.Debugf(ctx, "version check: %v", err)
+		return &Result{
+			CurrentVersion: info.Version,
+			CheckFailed:    true,
+		}
+	}
+
+	return &Result{
+		CurrentVersion:  info.Version,
+		LatestVersion:   latest,
+		UpdateAvailable: isNewer(info.Version, latest),
+		InstallMethod:   method,
+		UpgradeCommand:  command,
+	}
+}
+
+// isNewer reports whether latest is a higher semver than current. Both are
+// bare versions without a leading "v".
+func isNewer(current, latest string) bool {
+	cv := "v" + current
+	lv := "v" + latest
+	if !semver.IsValid(cv) || !semver.IsValid(lv) {
+		return false
+	}
+	return semver.Compare(lv, cv) > 0
+}
+
+// latestRelease is the subset of a GitHub release we cache and display.
+type latestRelease struct {
+	Version string `json:"version"`
+	URL     string `json:"url"`
+}
+
+func fetchLatestRelease(ctx context.Context) (latestRelease, error) {
+	base := env.Get(ctx, gitHubAPIURLEnv)
+	if base == "" {
+		base = defaultGitHubAPIURL
+	}
+
+	url := base + latestReleasePath
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	if err != nil {
+		return latestRelease{}, err
+	}
+	// GitHub rejects requests without a User-Agent and recommends pinning the
+	// API version. https://docs.github.com/en/rest/using-the-rest-api
+	req.Header.Set("User-Agent", "databricks-cli/"+build.GetInfo().Version)
+	req.Header.Set("Accept", "application/vnd.github+json")
+	req.Header.Set("X-GitHub-Api-Version", "2022-11-28")
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return latestRelease{}, fmt.Errorf("fetch latest release: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return latestRelease{}, fmt.Errorf("fetch latest release: unexpected status %s", resp.Status)
+	}
+
+	var rel struct {
+		TagName string `json:"tag_name"`
+		HTMLURL string `json:"html_url"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&rel); err != nil {
+		return latestRelease{}, fmt.Errorf("parse latest release: %w", err)
+	}
+
+	version := strings.TrimPrefix(rel.TagName, "v")
+	if version == "" {
+		return latestRelease{}, errors.New("latest release has an empty tag_name")
+	}
+	return latestRelease{Version: version, URL: rel.HTMLURL}, nil
+}
+
+// fetchLatestVersion returns just the latest version, for the explicit check.
+func fetchLatestVersion(ctx context.Context) (string, error) {
+	rel, err := fetchLatestRelease(ctx)
+	return rel.Version, err
+}
+
+// DetectInstallMethod inspects the running executable's path to infer how the
+// CLI was installed and the command to upgrade it. It returns InstallUnknown
+// with an empty command when the install method can't be determined.
+func DetectInstallMethod(ctx context.Context) (InstallMethod, string) {
+	exe, err := os.Executable()
+	if err != nil {
+		log.Debugf(ctx, "version check: cannot determine executable path: %v", err)
+		return InstallUnknown, ""
+	}
+	// Resolve symlinks so a Homebrew shim (e.g. /usr/local/bin/databricks ->
+	// ../Cellar/...) is classified by its real location rather than the shim.
+	if resolved, err := filepath.EvalSymlinks(exe); err == nil {
+		exe = resolved
+	}
+	return detectInstallMethod(runtime.GOOS, exe)
+}
+
+func detectInstallMethod(goos, execPath string) (InstallMethod, string) {
+	// Normalize separators independently of the host OS (not filepath.ToSlash,
+	// which only swaps the host's separator) so the goos parameter fully
+	// determines classification and the logic is testable cross-platform.
+	p := strings.ReplaceAll(execPath, `\`, "/")
+	if goos == "windows" {
+		lower := strings.ToLower(p)
+		switch {
+		case strings.Contains(lower, "/winget/"):
+			return InstallWinget, upgradeWinget
+		case strings.Contains(lower, "/chocolatey/"):
+			return InstallChocolatey, upgradeChocolatey
+		case lower == "c:/windows/databricks.exe":
+			return InstallScript, upgradeScript
+		}
+		return InstallUnknown, ""
+	}
+
+	// macOS and Linux.
+	switch {
+	case strings.Contains(p, "/Cellar/"), strings.Contains(p, "/homebrew/"), strings.Contains(p, "/linuxbrew/"):
+		return InstallHomebrew, upgradeHomebrew
+	case p == "/usr/local/bin/databricks":
+		return InstallScript, upgradeScript
+	}
+	return InstallUnknown, ""
+}
diff --git a/libs/versioncheck/versioncheck_test.go b/libs/versioncheck/versioncheck_test.go
new file mode 100644
index 00000000000..84089e53171
--- /dev/null
+++ b/libs/versioncheck/versioncheck_test.go
@@ -0,0 +1,133 @@
+package versioncheck
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/databricks/cli/internal/build"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestDetectInstallMethod(t *testing.T) {
+	tests := []struct {
+		name       string
+		goos       string
+		execPath   string
+		wantMethod InstallMethod
+		wantCmd    string
+	}{
+		{"homebrew apple silicon", "darwin", "/opt/homebrew/Cellar/databricks/0.240.0/bin/databricks", InstallHomebrew, upgradeHomebrew},
+		{"homebrew intel", "darwin", "/usr/local/Cellar/databricks/0.240.0/bin/databricks", InstallHomebrew, upgradeHomebrew},
+		{"homebrew linux", "linux", "/home/linuxbrew/.linuxbrew/Cellar/databricks/0.240.0/bin/databricks", InstallHomebrew, upgradeHomebrew},
+		{"script unix", "linux", "/usr/local/bin/databricks", InstallScript, upgradeScript},
+		{"script macos", "darwin", "/usr/local/bin/databricks", InstallScript, upgradeScript},
+		{"unknown unix", "linux", "/home/me/bin/databricks", InstallUnknown, ""},
+		{"winget", "windows", `C:\Users\me\AppData\Local\Microsoft\WinGet\Packages\Databricks.DatabricksCLI_X\databricks.exe`, InstallWinget, upgradeWinget},
+		{"chocolatey", "windows", `C:\ProgramData\chocolatey\bin\databricks.exe`, InstallChocolatey, upgradeChocolatey},
+		{"script windows", "windows", `C:\Windows\databricks.exe`, InstallScript, upgradeScript},
+		{"unknown windows", "windows", `C:\tools\databricks.exe`, InstallUnknown, ""},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			method, cmd := detectInstallMethod(tt.goos, tt.execPath)
+			assert.Equal(t, tt.wantMethod, method)
+			assert.Equal(t, tt.wantCmd, cmd)
+		})
+	}
+}
+
+func TestIsNewer(t *testing.T) {
+	tests := []struct {
+		current string
+		latest  string
+		want    bool
+	}{
+		{"0.240.0", "0.245.0", true},
+		{"0.245.0", "0.245.0", false},
+		{"0.245.0", "0.240.0", false},
+		{"0.245.0", "1.0.0", true},
+		{"1.0.0", "0.245.0", false},
+		{"0.240.0", "not-a-version", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.current+"_vs_"+tt.latest, func(t *testing.T) {
+			assert.Equal(t, tt.want, isNewer(tt.current, tt.latest))
+		})
+	}
+}
+
+func TestCheck(t *testing.T) {
+	// Check reads the running build version via package-global state; restore it
+	// so the mutation doesn't leak into other tests in this binary.
+	original := build.GetInfo().Version
+	t.Cleanup(func() { build.SetBuildVersion(original) })
+
+	newReleaseServer := func(t *testing.T, status int, tag string) *httptest.Server {
+		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			assert.Equal(t, latestReleasePath, r.URL.Path)
+			w.WriteHeader(status)
+			if tag != "" {
+				_, _ = w.Write([]byte(`{"tag_name":"` + tag + `"}`))
+			}
+		}))
+		t.Cleanup(srv.Close)
+		return srv
+	}
+
+	t.Run("update available", func(t *testing.T) {
+		build.SetBuildVersion("0.240.0")
+		srv := newReleaseServer(t, http.StatusOK, "v0.245.0")
+		t.Setenv(gitHubAPIURLEnv, srv.URL)
+
+		result := Check(t.Context())
+		assert.Equal(t, "0.240.0", result.CurrentVersion)
+		assert.Equal(t, "0.245.0", result.LatestVersion)
+		assert.True(t, result.UpdateAvailable)
+		assert.False(t, result.DevelopmentBuild)
+	})
+
+	t.Run("up to date", func(t *testing.T) {
+		build.SetBuildVersion("0.245.0")
+		srv := newReleaseServer(t, http.StatusOK, "v0.245.0")
+		t.Setenv(gitHubAPIURLEnv, srv.URL)
+
+		result := Check(t.Context())
+		assert.False(t, result.UpdateAvailable)
+		assert.Equal(t, "0.245.0", result.LatestVersion)
+	})
+
+	t.Run("development build skips the network call", func(t *testing.T) {
+		build.SetBuildVersion("0.0.0-dev+abc123")
+		// No server env set: a network call here would fail, proving we skip it.
+		result := Check(t.Context())
+		assert.True(t, result.DevelopmentBuild)
+		assert.False(t, result.UpdateAvailable)
+		assert.Empty(t, result.LatestVersion)
+	})
+
+	t.Run("server error fails gently", func(t *testing.T) {
+		build.SetBuildVersion("0.240.0")
+		srv := newReleaseServer(t, http.StatusInternalServerError, "")
+		t.Setenv(gitHubAPIURLEnv, srv.URL)
+
+		result := Check(t.Context())
+		assert.True(t, result.CheckFailed)
+		assert.False(t, result.UpdateAvailable)
+		assert.Empty(t, result.LatestVersion)
+	})
+
+	t.Run("unreachable GitHub fails gently", func(t *testing.T) {
+		build.SetBuildVersion("0.240.0")
+		// A server closed immediately gives a definitely-refused port.
+		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {}))
+		url := srv.URL
+		srv.Close()
+		t.Setenv(gitHubAPIURLEnv, url)
+
+		result := Check(t.Context())
+		assert.True(t, result.CheckFailed)
+	})
+}
diff --git a/libs/workspaceurls/urls.go b/libs/workspaceurls/urls.go
index c6ac8fdd7cd..0c31a7a0071 100644
--- a/libs/workspaceurls/urls.go
+++ b/libs/workspaceurls/urls.go
@@ -11,17 +11,36 @@ import (
 var resourceURLPatterns = map[string]string{
 	"alerts":                  "sql/alerts-v2/%s",
 	"apps":                    "apps/%s",
+	"catalogs":                "explore/data/%s",
+	"cluster_policies":        "compute/policies/%s",
 	"clusters":                "compute/clusters/%s",
 	"dashboards":              "dashboardsv3/%s/published",
+	"database_catalogs":       "explore/data/%s",
+	"database_instances":      "compute/database-instances/%s",
 	"experiments":             "ml/experiments/%s",
+	"features":                "explore/data/features/%s",
+	"genie_spaces":            "genie/rooms/%s",
 	"jobs":                    "jobs/%s",
+	"mcp_services":            "explore/data/mcp-services/%s",
 	"models":                  "ml/models/%s",
 	"model_serving_endpoints": "ml/endpoints/%s",
+	"model_services":          "explore/data/model-services/%s",
+	"model_provider_services": "explore/data/model-provider-services/%s",
 	"notebooks":               "#notebook/%s",
 	"pipelines":               "pipelines/%s",
+	"postgres_catalogs":       "explore/data/%s",
+	"postgres_synced_tables":  "explore/data/%s",
+	"quality_monitors":        "explore/data/%s",
 	"queries":                 "sql/editor/%s",
 	"registered_models":       "explore/data/models/%s",
+	"schemas":                 "explore/data/%s",
+	"secrets":                 "explore/data/%s",
+	"synced_database_tables":  "explore/data/%s",
+	"vector_search_endpoints": "compute/vector-search/%s",
+	"vector_search_indexes":   "explore/data/%s",
+	"volumes":                 "explore/data/volumes/%s",
 	"warehouses":              "sql/warehouses/%s",
+	"instance_pools":          "compute/instance-pools/%s",
 }
 
 // resourceAliases lets callers use bundle-config plural names as synonyms for
@@ -37,7 +56,18 @@ var resourceAliases = map[string]string{
 // provided as a dot-separated name (e.g. "catalog.schema.model") but the URL
 // requires slash-separated segments.
 var dotSeparatedResources = map[string]bool{
-	"registered_models": true,
+	"catalogs":                true,
+	"features":                true,
+	"mcp_services":            true,
+	"model_services":          true,
+	"model_provider_services": true,
+	"postgres_synced_tables":  true,
+	"quality_monitors":        true,
+	"registered_models":       true,
+	"schemas":                 true,
+	"secrets":                 true,
+	"vector_search_indexes":   true,
+	"volumes":                 true,
 }
 
 // ResourceTypes returns a sorted list of all supported resource type names.
@@ -50,6 +80,83 @@ func ResourceTypes() []string {
 	return names
 }
 
+// DeploymentURL returns the workspace URL for a bundle deployment:
+// <host>/deployments/<deploymentID>?version=<version>. Version pins the page to the deploy that produced it.
+func DeploymentURL(baseURL url.URL, deploymentID string, version int) string {
+	if deploymentID == "" {
+		return ""
+	}
+
+	baseURL.Path = "deployments/" + deploymentID
+	if version > 0 {
+		values := baseURL.Query()
+		values.Set("version", strconv.Itoa(version))
+		baseURL.RawQuery = values.Encode()
+	}
+	return baseURL.String()
+}
+
+// JobRunPath returns the modern workspace path for a job run, of the form
+//
+//	jobs/<jobID>/runs/<runID>
+//
+// Callers join this onto a workspace base URL. It exists because the Jobs API
+// returns a legacy fragment URL (#job/<jobID>/run/<runID>) that relies on
+// client-side redirection that only resolves for workspace admins; non-admin
+// users with CAN_VIEW are sent to the workspace homepage instead. The modern
+// path form resolves for any user permitted to view the run.
+// See https://github.com/databricks/cli/issues/5142.
+func JobRunPath(jobID, runID string) string {
+	return fmt.Sprintf("jobs/%s/runs/%s", jobID, runID)
+}
+
+// JobRunURL constructs a workspace URL for a job run. Unlike ResourceURL it takes
+// two IDs (parent job and run), so it can't be a single entry in
+// resourceURLPatterns.
+func JobRunURL(baseURL url.URL, jobID, runID string) string {
+	baseURL.Path = JobRunPath(jobID, runID)
+	return baseURL.String()
+}
+
+// ModernizeJobRunPageURL converts the legacy run URL returned by the Jobs API
+//
+//	https://<host>/?o=<id>#job/<jobID>/run/<runID>
+//
+// into the modern path form
+//
+//	https://<host>/jobs/<jobID>/runs/<runID>?o=<id>
+//
+// so that non-admin users permitted to view the run are not redirected to the
+// workspace homepage. See https://github.com/databricks/cli/issues/5142. The
+// workspace selector query param (o) is preserved as-is. The conversion is
+// cosmetic, so the original URL is returned on the rare chance the format is
+// unexpected.
+func ModernizeJobRunPageURL(raw string) string {
+	u, err := url.Parse(raw)
+	if err != nil {
+		return raw
+	}
+
+	jobID, runID, ok := parseLegacyRunFragment(u.Fragment)
+	if !ok {
+		return raw
+	}
+
+	u.Fragment = ""
+	u.Path = "/" + JobRunPath(jobID, runID)
+	return u.String()
+}
+
+// parseLegacyRunFragment extracts the job and run IDs from a legacy run URL
+// fragment of the form "job/<jobID>/run/<runID>".
+func parseLegacyRunFragment(fragment string) (jobID, runID string, ok bool) {
+	parts := strings.Split(fragment, "/")
+	if len(parts) != 4 || parts[0] != "job" || parts[2] != "run" || parts[1] == "" || parts[3] == "" {
+		return "", "", false
+	}
+	return parts[1], parts[3], true
+}
+
 // ResourceURL constructs a workspace URL for a named resource type and ID.
 func ResourceURL(baseURL url.URL, resourceType, id string) string {
 	resourceType = resolveAlias(resourceType)
@@ -62,9 +169,11 @@ func ResourceURL(baseURL url.URL, resourceType, id string) string {
 }
 
 // BuildResourceURL constructs a full workspace URL from a host string, resource
-// type name, ID, and workspace ID. It parses the host, appends ?o=<workspace-id>
-// when needed, and formats the resource path.
-func BuildResourceURL(host, resourceType, id string, workspaceID int64) (string, error) {
+// type name, ID, and workspace ID. It parses the host, appends ?w=<workspace-id>
+// when needed, and formats the resource path. An empty workspaceID skips the
+// query parameter (use when the workspace ID is unknown or already encoded in
+// the hostname).
+func BuildResourceURL(host, resourceType, id, workspaceID string) (string, error) {
 	baseURL, err := workspaceBaseURL(host, workspaceID)
 	if err != nil {
 		return "", err
@@ -84,23 +193,22 @@ func resolveAlias(resourceType string) string {
 	return resourceType
 }
 
-func workspaceBaseURL(host string, workspaceID int64) (*url.URL, error) {
+func workspaceBaseURL(host, workspaceID string) (*url.URL, error) {
 	baseURL, err := url.Parse(host)
 	if err != nil {
 		return nil, fmt.Errorf("invalid workspace host %q: %w", host, err)
 	}
 
-	if workspaceID == 0 {
+	if workspaceID == "" {
 		return baseURL, nil
 	}
 
-	orgID := strconv.FormatInt(workspaceID, 10)
-	if hasWorkspaceIDInHostname(baseURL.Hostname(), orgID) {
+	if hasWorkspaceIDInHostname(baseURL.Hostname(), workspaceID) {
 		return baseURL, nil
 	}
 
 	values := baseURL.Query()
-	values.Add("o", orgID)
+	values.Add("w", workspaceID)
 	baseURL.RawQuery = values.Encode()
 
 	return baseURL, nil
diff --git a/libs/workspaceurls/urls_test.go b/libs/workspaceurls/urls_test.go
index fd28ff44c2d..4667cd7bb3e 100644
--- a/libs/workspaceurls/urls_test.go
+++ b/libs/workspaceurls/urls_test.go
@@ -31,6 +31,18 @@ func TestNormalizeDotSeparatedID(t *testing.T) {
 	}
 }
 
+func TestJobRunPath(t *testing.T) {
+	assert.Equal(t, "jobs/123/runs/456", JobRunPath("123", "456"))
+}
+
+func TestJobRunURL(t *testing.T) {
+	base := url.URL{Scheme: "https", Host: "host.com"}
+	assert.Equal(t, "https://host.com/jobs/123/runs/456", JobRunURL(base, "123", "456"))
+
+	withWorkspace := url.URL{Scheme: "https", Host: "host.com", RawQuery: "w=789"}
+	assert.Equal(t, "https://host.com/jobs/123/runs/456?w=789", JobRunURL(withWorkspace, "123", "456"))
+}
+
 func TestResourceTypes(t *testing.T) {
 	types := ResourceTypes()
 	assert.NotEmpty(t, types)
@@ -45,15 +57,16 @@ func TestWorkspaceBaseURL(t *testing.T) {
 	tests := []struct {
 		name        string
 		host        string
-		workspaceID int64
+		workspaceID string
 		expected    string
 	}{
-		{"no workspace ID", "https://myworkspace.databricks.com", 0, "https://myworkspace.databricks.com"},
-		{"with workspace ID", "https://myworkspace.databricks.com", 123456, "https://myworkspace.databricks.com?o=123456"},
-		{"trailing slash stripped", "https://myworkspace.databricks.com/", 0, "https://myworkspace.databricks.com/"},
-		{"trailing slash with workspace ID", "https://myworkspace.databricks.com/", 789, "https://myworkspace.databricks.com/?o=789"},
-		{"adb hostname skips query param", "https://adb-123456.azuredatabricks.net", 123456, "https://adb-123456.azuredatabricks.net"},
-		{"adb hostname mismatch adds param", "https://adb-999.azuredatabricks.net", 123456, "https://adb-999.azuredatabricks.net?o=123456"},
+		{"no workspace ID", "https://myworkspace.databricks.com", "", "https://myworkspace.databricks.com"},
+		{"with workspace ID", "https://myworkspace.databricks.com", "123456", "https://myworkspace.databricks.com?w=123456"},
+		{"trailing slash stripped", "https://myworkspace.databricks.com/", "", "https://myworkspace.databricks.com/"},
+		{"trailing slash with workspace ID", "https://myworkspace.databricks.com/", "789", "https://myworkspace.databricks.com/?w=789"},
+		{"adb hostname skips query param", "https://adb-123456.azuredatabricks.net", "123456", "https://adb-123456.azuredatabricks.net"},
+		{"adb hostname mismatch adds param", "https://adb-999.azuredatabricks.net", "123456", "https://adb-999.azuredatabricks.net?w=123456"},
+		{"connection-id-style workspace ID passes through", "https://spog.example.com", "123e4567-e89b-12d3-a456-426614174000", "https://spog.example.com?w=123e4567-e89b-12d3-a456-426614174000"},
 	}
 
 	for _, tt := range tests {
@@ -66,7 +79,7 @@ func TestWorkspaceBaseURL(t *testing.T) {
 }
 
 func TestWorkspaceBaseURLInvalidHost(t *testing.T) {
-	_, err := workspaceBaseURL("://invalid", 0)
+	_, err := workspaceBaseURL("://invalid", "")
 	assert.ErrorContains(t, err, "invalid workspace host")
 }
 
@@ -76,14 +89,14 @@ func TestBuildResourceURL(t *testing.T) {
 		host         string
 		resourceType string
 		id           string
-		workspaceID  int64
+		workspaceID  string
 		expected     string
 	}{
-		{"simple path", "https://host.com", "jobs", "123", 0, "https://host.com/jobs/123"},
-		{"path with workspace ID", "https://host.com", "jobs", "123", 456, "https://host.com/jobs/123?o=456"},
-		{"fragment pattern", "https://host.com", "notebooks", "12345", 0, "https://host.com/#notebook/12345"},
-		{"fragment with workspace ID", "https://host.com", "notebooks", "12345", 789, "https://host.com/?o=789#notebook/12345"},
-		{"registered model normalizes dots", "https://host.com", "registered_models", "catalog.schema.model", 0, "https://host.com/explore/data/models/catalog/schema/model"},
+		{"simple path", "https://host.com", "jobs", "123", "", "https://host.com/jobs/123"},
+		{"path with workspace ID", "https://host.com", "jobs", "123", "456", "https://host.com/jobs/123?w=456"},
+		{"fragment pattern", "https://host.com", "notebooks", "12345", "", "https://host.com/#notebook/12345"},
+		{"fragment with workspace ID", "https://host.com", "notebooks", "12345", "789", "https://host.com/?w=789#notebook/12345"},
+		{"registered model normalizes dots", "https://host.com", "registered_models", "catalog.schema.model", "", "https://host.com/explore/data/models/catalog/schema/model"},
 	}
 
 	for _, tt := range tests {
@@ -96,7 +109,7 @@ func TestBuildResourceURL(t *testing.T) {
 }
 
 func TestBuildResourceURLUnknownType(t *testing.T) {
-	_, err := BuildResourceURL("https://host.com", "unknown", "123", 0)
+	_, err := BuildResourceURL("https://host.com", "unknown", "123", "")
 	assert.ErrorContains(t, err, "unknown resource type")
 }
 
@@ -110,6 +123,7 @@ func TestResourceURL(t *testing.T) {
 		{"jobs", "jobs", "123", "https://host.com/jobs/123"},
 		{"experiments", "experiments", "exp-1", "https://host.com/ml/experiments/exp-1"},
 		{"dashboards", "dashboards", "d-1", "https://host.com/dashboardsv3/d-1/published"},
+		{"genie_spaces", "genie_spaces", "space-1", "https://host.com/genie/rooms/space-1"},
 		{"notebooks", "notebooks", "12345", "https://host.com/#notebook/12345"},
 		{"notebooks with path", "notebooks", "/Users/u/nb", "https://host.com/#notebook//Users/u/nb"},
 		{"registered_models normalizes dots", "registered_models", "cat.sch.model", "https://host.com/explore/data/models/cat/sch/model"},
@@ -127,6 +141,55 @@ func TestResourceURL(t *testing.T) {
 	}
 }
 
+func TestDeploymentURL(t *testing.T) {
+	tests := []struct {
+		name         string
+		deploymentID string
+		version      int
+		base         url.URL
+		expected     string
+	}{
+		{
+			name:         "id and version",
+			deploymentID: "996980114684409",
+			version:      2,
+			base:         url.URL{Scheme: "https", Host: "host.com"},
+			expected:     "https://host.com/deployments/996980114684409?version=2",
+		},
+		{
+			// The version is only known once CreateVersion has run, so link to the
+			// deployment itself rather than emitting version=0.
+			name:         "zero version omits the query",
+			deploymentID: "996980114684409",
+			version:      0,
+			base:         url.URL{Scheme: "https", Host: "host.com"},
+			expected:     "https://host.com/deployments/996980114684409",
+		},
+		{
+			// A base URL carrying ?w=<workspace id> keeps it, so a vanity or legacy
+			// host still addresses the right workspace.
+			name:         "preserves an existing query",
+			deploymentID: "42",
+			version:      7,
+			base:         url.URL{Scheme: "https", Host: "host.com", RawQuery: "w=123"},
+			expected:     "https://host.com/deployments/42?version=7&w=123",
+		},
+		{
+			name:         "empty id returns empty",
+			deploymentID: "",
+			version:      1,
+			base:         url.URL{Scheme: "https", Host: "host.com"},
+			expected:     "",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.expected, DeploymentURL(tt.base, tt.deploymentID, tt.version))
+		})
+	}
+}
+
 func TestHasWorkspaceIDInHostname(t *testing.T) {
 	tests := []struct {
 		name        string
@@ -152,3 +215,49 @@ func TestHasWorkspaceIDInHostname(t *testing.T) {
 		})
 	}
 }
+
+func TestModernizeJobRunPageURL(t *testing.T) {
+	tests := []struct {
+		name     string
+		raw      string
+		expected string
+	}{
+		{
+			"legacy fragment form preserves workspace selector",
+			"https://myworkspace.databricks.test/?o=900800700600#job/123/run/456",
+			"https://myworkspace.databricks.test/jobs/123/runs/456?o=900800700600",
+		},
+		{
+			"no workspace selector",
+			"https://myworkspace.databricks.test/#job/123/run/456",
+			"https://myworkspace.databricks.test/jobs/123/runs/456",
+		},
+		{
+			"http host with port",
+			"http://127.0.0.1:8080/?o=900800700600#job/1/run/2",
+			"http://127.0.0.1:8080/jobs/1/runs/2?o=900800700600",
+		},
+		// The conversion is cosmetic, so any other format passes through unchanged.
+		{
+			"already modern path is left as-is",
+			"https://myworkspace.databricks.test/jobs/123/runs/456?o=900800700600",
+			"https://myworkspace.databricks.test/jobs/123/runs/456?o=900800700600",
+		},
+		{
+			"incomplete fragment is left as-is",
+			"https://myworkspace.databricks.test/?o=900800700600#job/123",
+			"https://myworkspace.databricks.test/?o=900800700600#job/123",
+		},
+		{
+			"empty job id is left as-is",
+			"https://myworkspace.databricks.test/?o=900800700600#job//run/456",
+			"https://myworkspace.databricks.test/?o=900800700600#job//run/456",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.expected, ModernizeJobRunPageURL(tt.raw))
+		})
+	}
+}
diff --git a/main.go b/main.go
index e81dde6946b..6c4dddd40b6 100644
--- a/main.go
+++ b/main.go
@@ -3,6 +3,7 @@ package main
 import (
 	"context"
 	"os"
+	"path/filepath"
 
 	"github.com/databricks/cli/cmd"
 	"github.com/databricks/cli/cmd/root"
@@ -13,6 +14,16 @@ import (
 )
 
 func main() {
+	// Configure DATABRICKS_CLI_PATH only if our caller intends to use this specific version of this binary.
+	// Otherwise, if it is equal to its basename, processes can find it in $PATH.
+	// This runs in main rather than in a package init so that importing CLI
+	// packages (e.g. from test binaries or generators) does not mutate the
+	// process environment.
+	arg0 := os.Args[0]
+	if arg0 != filepath.Base(arg0) {
+		os.Setenv("DATABRICKS_CLI_PATH", arg0)
+	}
+
 	ctx := context.Background()
 	err := root.Execute(ctx, cmd.New(ctx))
 	if err != nil {
diff --git a/main_test.go b/main_test.go
index ba40c19746e..0f93f0236bd 100644
--- a/main_test.go
+++ b/main_test.go
@@ -2,12 +2,14 @@ package main
 
 import (
 	"io/fs"
+	"os"
 	"path/filepath"
 	"testing"
 
 	"github.com/databricks/cli/cmd"
 	"github.com/spf13/cobra"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	"golang.org/x/mod/module"
 )
 
@@ -26,6 +28,14 @@ func TestCommandsDontUseUnderscoreInName(t *testing.T) {
 	}
 }
 
+func TestImportDoesNotSetCliPathEnv(t *testing.T) {
+	// Test binaries run by their absolute path, which is exactly the condition
+	// under which main exports DATABRICKS_CLI_PATH; an import-time export would
+	// therefore have set it to this test binary's path by now.
+	require.NotEqual(t, filepath.Base(os.Args[0]), os.Args[0])
+	assert.NotEqual(t, os.Args[0], os.Getenv("DATABRICKS_CLI_PATH"))
+}
+
 func TestFilePath(t *testing.T) {
 	// To import this repository as a library, all files must match the
 	// file path constraints made by Go. This test ensures that all files
diff --git a/python/README.md b/python/README.md
index 980260e1776..462d352e896 100644
--- a/python/README.md
+++ b/python/README.md
@@ -13,7 +13,7 @@ Reference documentation is available at https://databricks.github.io/cli/python/
 
 To use `databricks-bundles`, you must first:
 
-1. Install the [Databricks CLI](https://github.com/databricks/cli), version 0.299.0 or above
+1. Install the [Databricks CLI](https://github.com/databricks/cli), version 1.22.1 or above
 2. Authenticate to your Databricks workspace if you have not done so already:
 
    ```bash
diff --git a/python/Taskfile.yml b/python/Taskfile.yml
index 3923f647797..137b567050a 100644
--- a/python/Taskfile.yml
+++ b/python/Taskfile.yml
@@ -16,6 +16,7 @@ tasks:
     desc: Run pydabs tests
     sources:
       - "**/*.py"
+      - ../libs/dyn/dynvar/testdata/reference_vectors.json
       - pyproject.toml
       - uv.lock
       - README.md
@@ -24,7 +25,7 @@ tasks:
       - "uv run python -m pytest databricks_tests --cov=databricks.bundles --cov-report html -vv"
 
   pydabs-lint:
-    desc: Run pydabs lint checks
+    desc: Run pydabs type checks (ruff lint/format is global, see root `lint-python` / `fmt-python`)
     sources:
       - "**/*.py"
       - pyproject.toml
@@ -33,18 +34,18 @@ tasks:
       - LICENSE
     cmds:
       - "uv lock --check"
-      - "uv run ruff check databricks databricks_tests"
       - "uv run pyright"
-      - "uv run ruff format --diff databricks databricks_tests"
 
   pydabs-fmt:
-    desc: Format pydabs code
+    desc: Lint-fix and format pydabs code with the global ruff
     sources:
       - "**/*.py"
       - pyproject.toml
     cmds:
-      - uv run ruff check --fix databricks databricks_tests || true
-      - uv run ruff format
+      # Pinned to match the global ruff version (see root Taskfile fmt-python and
+      # .github/workflows/check.yml). ruff config lives in ../ruff.toml.
+      - uvx ruff@0.15.17 check --fix databricks databricks_tests || true
+      - uvx ruff@0.15.17 format
 
   pydabs-docs:
     desc: Generate pydabs documentation
@@ -58,7 +59,7 @@ tasks:
     generates:
       - docs/_output/**
     cmds:
-      - "uv run --python 3.12 sphinx-build docs docs/_output --show-traceback --nitpicky --fresh-env --keep-going"
+      - "uv run --python 3.12 sphinx-build docs docs/_output --show-traceback --nitpicky --fresh-env --keep-going -W"
 
   pydabs-codegen:
     desc: Run pydabs codegen
@@ -69,16 +70,27 @@ tasks:
       - ../bundle/schema/jsonschema.json
     generates:
       - databricks/bundles/**
+      - docs/index.rst
+      - docs/databricks.bundles.*.rst
     cmds:
       - |
         find databricks/bundles -type d -mindepth 1 -maxdepth 1 \
           ! -path databricks/bundles/core \
-          ! -path databricks/bundles/resources \
           -exec rm -rf {} \;
+      # core/ is hand-written except for the generated wiring under _generated/.
+      - rm -rf databricks/bundles/core/_generated
+      # test_resources.py is hand-written except for the generated TestCase data.
+      - rm -rf databricks_tests/core/_generated
       - cd codegen && uv run -m pytest codegen_tests
       - cd codegen && uv run -m codegen.main --output ..
-      - uv run ruff check --fix databricks databricks_tests || true
-      - uv run ruff format
+      # Generated code is fixed and formatted by the global ruff (see ../ruff.toml).
+      - uvx ruff@0.15.17 check --fix databricks databricks_tests || true
+      - uvx ruff@0.15.17 format
+      # The `uv run` invocations above rewrite the lockfiles with the internal
+      # *.databricks.com PyPI proxy URL when uv/pip is proxy-configured (locally
+      # or via setup-jfrog in CI). That is environment noise, not codegen output;
+      # revert it so the committed locks stay on pypi.org.
+      - git checkout -- uv.lock codegen/uv.lock
 
   pydabs-build:
     desc: Build pydabs wheel
diff --git a/python/codegen/codegen/.gitattributes b/python/codegen/codegen/.gitattributes
new file mode 100644
index 00000000000..b656adbf2b0
--- /dev/null
+++ b/python/codegen/codegen/.gitattributes
@@ -0,0 +1,2 @@
+# Render the wiring templates as Python on GitHub.
+*.py.tmpl linguist-language=Python
diff --git a/python/codegen/codegen/core_init.py.tmpl b/python/codegen/codegen/core_init.py.tmpl
new file mode 100644
index 00000000000..dcc012115c5
--- /dev/null
+++ b/python/codegen/codegen/core_init.py.tmpl
@@ -0,0 +1,31 @@
+__all__ = [
+${all_block}
+]
+
+from databricks.bundles.core._bundle import Bundle
+from databricks.bundles.core._diagnostics import (
+    Diagnostic,
+    Diagnostics,
+    Severity,
+)
+from databricks.bundles.core._load import (
+    load_resources_from_current_package_module,
+    load_resources_from_module,
+    load_resources_from_modules,
+    load_resources_from_package_module,
+)
+from databricks.bundles.core._location import Location
+from databricks.bundles.core._resource import Resource
+from databricks.bundles.core._resource_mutator import ResourceMutator
+from databricks.bundles.core._resources import Resources
+from databricks.bundles.core._variable import (
+    Variable,
+    VariableOr,
+    VariableOrDict,
+    VariableOrList,
+    VariableOrOptional,
+    variables,
+)
+from databricks.bundles.core._generated import (
+${mutator_imports},
+)
diff --git a/python/codegen/codegen/doc_index.rst.tmpl b/python/codegen/codegen/doc_index.rst.tmpl
new file mode 100644
index 00000000000..ae3ea94bb03
--- /dev/null
+++ b/python/codegen/codegen/doc_index.rst.tmpl
@@ -0,0 +1,12 @@
+databricks-bundles
+--------------------------------
+
+`databricks-bundles` package implements Python support for Declarative Automation Bundles.
+
+See `Bundle configuration in Python <https://docs.databricks.com/aws/en/dev-tools/bundles/python>`_.
+
+
+.. toctree::
+   :maxdepth: 7
+
+${toctree}
diff --git a/python/codegen/codegen/doc_page.rst.tmpl b/python/codegen/codegen/doc_page.rst.tmpl
new file mode 100644
index 00000000000..3278ef09c30
--- /dev/null
+++ b/python/codegen/codegen/doc_page.rst.tmpl
@@ -0,0 +1,11 @@
+${title}
+===============================
+
+.. currentmodule:: ${module}
+
+**Package:** ``${module}``
+
+Classes
+---------------
+
+.. automodule:: ${module}
diff --git a/python/codegen/codegen/generated_dataclass.py b/python/codegen/codegen/generated_dataclass.py
index 9070a1e38c2..2c36bba1cf8 100644
--- a/python/codegen/codegen/generated_dataclass.py
+++ b/python/codegen/codegen/generated_dataclass.py
@@ -1,12 +1,12 @@
-from dataclasses import dataclass
-from typing import Optional, TYPE_CHECKING
+from dataclasses import dataclass, replace
+from typing import TYPE_CHECKING, Optional
 
 if TYPE_CHECKING:
     from typing_extensions import Self
 
 import codegen.packages as packages
 from codegen.code_builder import CodeBuilder
-from codegen.jsonschema import Property, Schema, Stage
+from codegen.jsonschema import Property, Schema, is_experimental_stage
 from codegen.packages import is_resource
 
 
@@ -65,14 +65,6 @@ class GeneratedField:
     The type of the field in TypedDict, e.g., GeneratedType(name="TaskParam", ...)
     """
 
-    create_func_type_name: GeneratedType
-    """
-    Type type of the field in static "create" function, e.g., GeneratedType(name="TaskParam", ...)
-
-    It can be different from param_type_name because lists are made optional in "create" function
-    to avoid problems with mutable default arguments.
-    """
-
     description: Optional[str]
     """
     The description of the field to be included into a docstring.
@@ -83,14 +75,6 @@ class GeneratedField:
     The default value of the field, e.g., "None"
     """
 
-    create_func_default: Optional[str]
-    """
-    The default value of the field in "create" function.
-
-    It can be different from default because lists are made optional in "create" function
-    to avoid problems with mutable default arguments.
-    """
-
     default_factory: Optional[str]
     """
     Factory method for creating a default value, used for lists and dicts.
@@ -151,66 +135,27 @@ def generate_field(
     field_type = variable_or_type(field_type, is_required=is_required)
     param_type = variable_or_type(param_type, is_required=is_required)
 
+    # Base is the optional-scalar shape (default None). Collections instead use an
+    # empty-container factory, and required fields carry no default.
+    field = GeneratedField(
+        field_name=field_name,
+        type_name=field_type,
+        param_type_name=param_type,
+        description=prop.description,
+        default="None",
+        default_factory=None,
+        experimental=is_experimental_stage(prop.stage),
+        deprecated=prop.deprecated or False,
+    )
+
     if field_type.name == "VariableOrDict":
-        return GeneratedField(
-            field_name=field_name,
-            type_name=field_type,
-            param_type_name=param_type,
-            create_func_type_name=optional_type(param_type),
-            description=prop.description,
-            default=None,
-            default_factory="dict",
-            create_func_default="None",
-            experimental=prop.stage == Stage.PRIVATE,
-            deprecated=prop.deprecated or False,
-        )
+        return replace(field, default=None, default_factory="dict")
     elif field_type.name == "VariableOrList":
-        return GeneratedField(
-            field_name=field_name,
-            type_name=field_type,
-            param_type_name=param_type,
-            create_func_type_name=optional_type(param_type),
-            description=prop.description,
-            default=None,
-            default_factory="list",
-            create_func_default="None",
-            experimental=prop.stage == Stage.PRIVATE,
-            deprecated=prop.deprecated or False,
-        )
+        return replace(field, default=None, default_factory="list")
     elif is_required:
-        return GeneratedField(
-            field_name=field_name,
-            type_name=field_type,
-            param_type_name=param_type,
-            create_func_type_name=param_type,
-            description=prop.description,
-            default=None,
-            default_factory=None,
-            create_func_default=None,
-            experimental=prop.stage == Stage.PRIVATE,
-            deprecated=prop.deprecated or False,
-        )
-    else:
-        return GeneratedField(
-            field_name=field_name,
-            type_name=field_type,
-            param_type_name=param_type,
-            create_func_type_name=param_type,
-            description=prop.description,
-            default="None",
-            default_factory=None,
-            create_func_default="None",
-            experimental=prop.stage == Stage.PRIVATE,
-            deprecated=prop.deprecated or False,
-        )
+        return replace(field, default=None)
 
-
-def optional_type(generated: GeneratedType) -> GeneratedType:
-    return GeneratedType(
-        name="Optional",
-        package="typing",
-        parameters=[generated],
-    )
+    return field
 
 
 def str_type() -> GeneratedType:
@@ -281,7 +226,12 @@ def generate_type(namespace: str, ref: str, is_param: bool) -> GeneratedType:
             parameters=[element_type],
         )
 
-    if ref == "#/$defs/map/string":
+    if ref.startswith("#/$defs/map/"):
+        # Only dict[str, str] is modelled today; anything else (e.g. map/int,
+        # map/<object>) fails loudly instead.
+        if ref != "#/$defs/map/string":
+            raise ValueError(f"Unsupported map ref: {ref}")
+
         return dict_type()
 
     class_name = packages.get_class_name(ref)
@@ -335,16 +285,14 @@ def generate_dataclass(
         description=schema.description,
         fields=fields,
         extends=extends,
-        experimental=schema.stage == Stage.PRIVATE,
+        experimental=is_experimental_stage(schema.stage),
         deprecated=schema.deprecated or False,
     )
 
 
 def _get_type_code(generated: GeneratedType, quote: bool = True) -> str:
     if generated.parameters:
-        parameters = ", ".join(
-            map(lambda x: _get_type_code(x, quote), generated.parameters)
-        )
+        parameters = ", ".join((_get_type_code(x, quote) for x in generated.parameters))
 
         return f"{generated.name}[{parameters}]"
     else:
diff --git a/python/codegen/codegen/generated_docs.py b/python/codegen/codegen/generated_docs.py
new file mode 100644
index 00000000000..3ae866a09d3
--- /dev/null
+++ b/python/codegen/codegen/generated_docs.py
@@ -0,0 +1,61 @@
+#!/usr/bin/env python3
+"""Generate the Sphinx .rst pages from the resource module dirs under
+databricks/bundles/, so the documented resource list can never drift from the
+generated code. Driven by scanning the output tree, not RESOURCE_NAMESPACE.
+
+The doc structure lives in the *.rst.tmpl templates so it can be reviewed
+separately from this code: doc_page.rst.tmpl (one page per resource) and
+doc_index.rst.tmpl (the index prose header + generated toctree)."""
+
+from pathlib import Path
+from string import Template
+
+import codegen.packages as packages
+
+# .title() mangles acronyms; override those namespaces.
+_TITLE_OVERRIDES = {
+    "sql_warehouses": "SQL Warehouses",
+    "mcp_services": "MCP Services",
+}
+
+
+def _load_template(name: str) -> Template:
+    return Template((Path(__file__).parent / name).read_text())
+
+
+_PAGE_TEMPLATE = _load_template("doc_page.rst.tmpl")
+_INDEX_TEMPLATE = _load_template("doc_index.rst.tmpl")
+
+
+def _title(namespace: str) -> str:
+    return _TITLE_OVERRIDES.get(namespace, namespace.replace("_", " ").title())
+
+
+def write_docs(output: str):
+    docs = Path(output) / "docs"
+    bundles = Path(output) / "databricks" / "bundles"
+
+    # core is hand-written; every other package dir gets a generated page.
+    namespaces = sorted(
+        p.name
+        for p in bundles.iterdir()
+        if p.name != "core" and (p / "__init__.py").exists()
+    )
+
+    # Drop stale pages so a removed resource loses its page; keep core.rst.
+    for rst in docs.glob("databricks.bundles.*.rst"):
+        if rst.name != "databricks.bundles.core.rst":
+            rst.unlink()
+
+    for namespace in namespaces:
+        module = packages.get_root_package(namespace)
+        page = _PAGE_TEMPLATE.substitute(title=_title(namespace), module=module)
+        (docs / f"databricks.bundles.{namespace}.rst").write_text(page)
+
+    entries = ["databricks.bundles.core"] + [
+        packages.get_root_package(ns) for ns in namespaces
+    ]
+    toctree = "\n".join(f"   {entry}" for entry in entries)
+    (docs / "index.rst").write_text(_INDEX_TEMPLATE.substitute(toctree=toctree))
+
+    print(f"Writing {len(namespaces) + 1} doc pages into {docs}")
diff --git a/python/codegen/codegen/generated_enum.py b/python/codegen/codegen/generated_enum.py
index f2eecf82e46..a9a551a26a1 100644
--- a/python/codegen/codegen/generated_enum.py
+++ b/python/codegen/codegen/generated_enum.py
@@ -5,7 +5,7 @@
 import codegen.packages as packages
 from codegen.code_builder import CodeBuilder
 from codegen.generated_dataclass import _append_description
-from codegen.jsonschema import Schema, Stage
+from codegen.jsonschema import Schema, is_experimental_stage
 
 
 @dataclass(kw_only=True)
@@ -28,14 +28,20 @@ def generate_enum(namespace: str, schema_name: str, schema: Schema) -> Generated
     assert package
 
     for value in schema.enum:
-        values[_camel_to_upper_snake(value)] = value
+        name = _camel_to_upper_snake(value)
+        # Distinct values must not collapse to the same member (e.g. "a-b" and "a_b").
+        if name in values:
+            raise ValueError(
+                f"{schema_name}: enum values {values[name]!r} and {value!r} both map to member {name!r}"
+            )
+        values[name] = value
 
     return GeneratedEnum(
         class_name=class_name,
         package=package,
         values=values,
         description=schema.description,
-        experimental=schema.stage == Stage.PRIVATE,
+        experimental=is_experimental_stage(schema.stage),
         deprecated=schema.deprecated or False,
     )
 
@@ -81,5 +87,6 @@ def get_code(generated: GeneratedEnum) -> str:
 
 def _camel_to_upper_snake(value):
     s1 = re.sub("(.)([A-Z][a-z]+)", r"\1_\2", value)
-
-    return re.sub("([a-z0-9])([A-Z])", r"\1_\2", s1).upper()
+    s1 = re.sub("([a-z0-9])([A-Z])", r"\1_\2", s1)
+    # Non-identifier chars (e.g. "-" in "amazon-bedrock") become "_".
+    return re.sub(r"[^0-9a-zA-Z]+", "_", s1).upper()
diff --git a/python/codegen/codegen/generated_imports.py b/python/codegen/codegen/generated_imports.py
index 527764ed394..9bf1ff5aa2c 100644
--- a/python/codegen/codegen/generated_imports.py
+++ b/python/codegen/codegen/generated_imports.py
@@ -1,6 +1,3 @@
-from textwrap import dedent
-
-import codegen.packages as packages
 from codegen.code_builder import CodeBuilder
 from codegen.generated_dataclass import GeneratedDataclass
 from codegen.generated_enum import GeneratedEnum
@@ -47,7 +44,7 @@ def get_code(
     b = CodeBuilder()
 
     b.append(
-        "from typing import Literal, Optional, TypedDict, ClassVar, TYPE_CHECKING\n"
+        "from typing import Any, Literal, Optional, TypedDict, ClassVar, TYPE_CHECKING\n"
     )
     b.append("from enum import Enum\n")
     b.append("from dataclasses import dataclass, replace, field\n")
diff --git a/python/codegen/codegen/generated_init.py.tmpl b/python/codegen/codegen/generated_init.py.tmpl
new file mode 100644
index 00000000000..ee955fe7a95
--- /dev/null
+++ b/python/codegen/codegen/generated_init.py.tmpl
@@ -0,0 +1,26 @@
+from typing import TYPE_CHECKING
+
+${imports}
+
+if TYPE_CHECKING:
+    from databricks.bundles.core._resource_type import _ResourceType
+
+__all__ = [
+${all_block}
+]
+
+
+class _GeneratedResources(
+${mixins}
+):
+    pass
+
+
+def _all_resource_types() -> "tuple[_ResourceType, ...]":
+    from databricks.bundles.core._generated import (
+${module_imports}
+    )
+
+    return (
+${type_entries}
+    )
diff --git a/python/codegen/codegen/generated_test_cases.py b/python/codegen/codegen/generated_test_cases.py
new file mode 100644
index 00000000000..9422937d964
--- /dev/null
+++ b/python/codegen/codegen/generated_test_cases.py
@@ -0,0 +1,358 @@
+"""
+Generates the per-resource ResourceTestCase data driving databricks_tests/core/test_resources.py.
+
+For every wired resource a file _generated/<plural>.py is written (rendered from
+test_case.py.tmpl) exposing _test_case() -> (ResourceTestCase, _ResourceType). The generated
+_generated/__init__.py collects them into `test_cases`, which test_resources.py imports
+and parametrizes its per-resource tests off.
+
+dict_example and dataclass_example are synthesized from one value tree and rendered two
+independent ways -- a dict literal and a constructor expression -- so the dict->dataclass
+_transform assertion in test_resources.py stays meaningful (the two forms don't share the
+runtime transform path).
+
+Field policy: all required fields (fully expanded), plus optional composite fields
+(nested dataclass / list / map / enum) on the resource itself; nested objects contribute
+only their required fields, which keeps examples bounded and avoids recursive schemas
+(e.g. jobs Task -> ForEachTask -> Task, reachable only through an optional field). Optional
+scalar, deprecated, and experimental fields are omitted.
+"""
+
+from dataclasses import dataclass
+from pathlib import Path
+from string import Template
+from typing import Union
+
+import codegen.jsonschema as openapi
+import codegen.packages as packages
+from codegen.generated_enum import _camel_to_upper_snake
+from codegen.generated_wiring import _wired_resources, _WiredResource
+
+HEADER = "# Code generated by pydabs-codegen. DO NOT EDIT.\n\n"
+
+_TEST_CASE_TEMPLATE = Template(
+    (Path(__file__).parent / "test_case.py.tmpl").read_text()
+)
+
+# Launch-stage maturity, mirroring internal/clijson/launchstage.go:
+# GA < PUBLIC_PREVIEW < PUBLIC_BETA < PRIVATE_PREVIEW; absent stage = GA.
+_STAGE_RANK = {
+    None: 0,
+    openapi.LaunchStage.GA: 0,
+    openapi.LaunchStage.PUBLIC_PREVIEW: 1,
+    openapi.LaunchStage.PUBLIC_BETA: 2,
+    openapi.LaunchStage.PRIVATE_PREVIEW: 3,
+}
+
+
+# Synthesized value tree. Each node renders both as a dict literal (dict_example)
+# and as a constructor expression (dataclass_example).
+
+
+@dataclass
+class _Scalar:
+    dict_src: str
+    dataclass_src: str
+
+
+@dataclass
+class _Enum:
+    value: str
+    class_name: str
+    module: str
+    member: str
+
+
+@dataclass
+class _Object:
+    class_name: str
+    module: str
+    fields: "list[tuple[str, _Value]]"
+
+
+@dataclass
+class _List:
+    item: "_Value"
+
+
+@dataclass
+class _Map:
+    key: str
+    value: "_Value"
+
+
+_Value = Union[_Scalar, _Enum, _Object, _List, _Map]
+
+
+def _ref_name(ref: str) -> str:
+    """Last path segment of a JSON-schema ref -- the schema name.
+
+    :param ref: a JSON-schema reference, e.g. "#/$defs/.../jobs.Task" or "#/$defs/string".
+    """
+    return ref.split("/")[-1]
+
+
+def _is_composite(ref: str) -> bool:
+    """Whether a ref is a composite type (list, map, object, or enum) rather than a scalar.
+
+    :param ref: the JSON-schema reference of a field's type.
+    """
+    if ref.startswith(("#/$defs/slice/", "#/$defs/map/")):
+        return True
+
+    return _ref_name(ref) not in packages.PRIMITIVES
+
+
+def _synth_scalar(name: str, hint: str) -> _Scalar:
+    """Placeholder value for a primitive (str -> hint, int -> 0, float -> 0.0, bool -> True, time.Time -> RFC3339 string).
+
+    :param name: the primitive's schema name, e.g. "string", "int", "boolean".
+    :param hint: enclosing field name, used as the string placeholder so examples read meaningfully.
+    """
+    if name == "string":
+        return _Scalar(f'"{hint}"', f'"{hint}"')
+    if name in ("integer", "int", "int64"):
+        return _Scalar("0", "0")
+    if name in ("number", "float", "float64"):
+        return _Scalar("0.0", "0.0")
+    if name in ("boolean", "bool"):
+        return _Scalar("True", "True")
+    # time.Time is generated as a str (see packages.RENAMES); serialized as RFC3339.
+    if name == "time.Time":
+        return _Scalar('"2020-01-01T00:00:00Z"', '"2020-01-01T00:00:00Z"')
+    # duration.Duration is generated as a str; serialized as a seconds string.
+    if name == "duration.Duration":
+        return _Scalar('"3600s"', '"3600s"')
+    # interface{} is generated as Any; there is no schema to sample, so use a
+    # fixed inline dict. Both render paths use the same literal.
+    if name == "interface":
+        return _Scalar('{"key": "value"}', '{"key": "value"}')
+
+    raise ValueError(f"Unknown primitive: {name}")
+
+
+def _synth_ref(
+    namespace: str,
+    ref: str,
+    hint: str,
+    schemas: dict[str, openapi.Schema],
+    visiting: set[str],
+) -> _Value:
+    """Synthesize a value node for whatever type a ref points at: list, map, scalar, enum, or nested object.
+
+    :param namespace: the resource's namespace (e.g. "jobs"); selects the module a referenced type is generated into.
+    :param ref: the JSON-schema reference of the type to synthesize.
+    :param hint: enclosing field name, passed through as the string placeholder.
+    :param schemas: all post-patch schemas keyed by schema name, for looking up nested/enum types.
+    :param visiting: ancestor object names on the current path, used to detect required cycles.
+    """
+    if ref.startswith("#/$defs/slice/"):
+        element_ref = ref.replace("#/$defs/slice/", "#/$defs/")
+
+        return _List(_synth_ref(namespace, element_ref, hint, schemas, visiting))
+
+    if ref.startswith("#/$defs/map/"):
+        # generate_type only ever produces dict[str, str] maps (map/string).
+        if ref != "#/$defs/map/string":
+            raise ValueError(f"Unsupported map ref: {ref}")
+
+        return _Map("key", _Scalar('"value"', '"value"'))
+
+    name = _ref_name(ref)
+    if name in packages.PRIMITIVES:
+        return _synth_scalar(name, hint)
+
+    schema = schemas[name]
+    class_name = packages.get_class_name(ref)
+    module = _module_of(namespace, ref)
+
+    if schema.type == openapi.SchemaType.STRING:
+        value = schema.enum[0]
+
+        return _Enum(value, class_name, module, _camel_to_upper_snake(value))
+
+    # Only reachable through required fields at this depth (see _synth_object); a
+    # required cycle has no finite value, so fail loudly instead of looping.
+    if name in visiting:
+        raise ValueError(f"Required-field cycle through '{name}'")
+
+    return _synth_object(namespace, name, schema, schemas, visiting, top_level=False)
+
+
+def _synth_object(
+    namespace: str,
+    schema_name: str,
+    schema: openapi.Schema,
+    schemas: dict[str, openapi.Schema],
+    visiting: set[str],
+    top_level: bool,
+) -> _Object:
+    """Synthesize an object value, choosing fields by policy: all required fields, plus (only at the resource top level) stable optional composite fields.
+
+    :param namespace: the resource's namespace, threaded through to resolve nested types' modules.
+    :param schema_name: this object's schema name (e.g. "resources.Alert").
+    :param schema: the Schema for this object -- its properties and required list.
+    :param schemas: all post-patch schemas, for recursing into nested types.
+    :param visiting: ancestor object names on the current path (cycle guard).
+    :param top_level: True only for the resource itself; when False, all optional fields are dropped.
+    """
+    visiting = visiting | {schema_name}
+    fields: list[tuple[str, _Value]] = []
+
+    for field_name, prop in schema.properties.items():
+        required = field_name in schema.required
+
+        if not required:
+            # Nested objects contribute only required fields; on the resource
+            # itself, also include stable optional composite fields.
+            if not top_level:
+                continue
+            if not _is_composite(prop.ref):
+                continue
+            if (
+                prop.deprecated
+                or _STAGE_RANK.get(prop.stage, 0)
+                > _STAGE_RANK[openapi.LaunchStage.PUBLIC_PREVIEW]
+            ):
+                continue
+
+        value = _synth_ref(namespace, prop.ref, field_name, schemas, visiting)
+        fields.append((field_name, value))
+
+    return _Object(
+        packages.get_class_name(schema_name), _module_of(namespace, schema_name), fields
+    )
+
+
+def _module_of(namespace: str, schema_name: str) -> str:
+    """Python module a (non-primitive) schema's generated class lives in; asserts it exists.
+
+    :param namespace: the resource's namespace; the type is generated under databricks.bundles.<namespace>._models.
+    :param schema_name: the object/enum schema name to resolve.
+    """
+    module = packages.get_package(namespace, schema_name)
+    assert module
+
+    return module
+
+
+def _render_dict(value: _Value) -> str:
+    """Render a synthesized value as a dict-literal source string (the dict_example form).
+
+    :param value: the synthesized value node to render.
+    """
+    if isinstance(value, _Scalar):
+        return value.dict_src
+    if isinstance(value, _Enum):
+        return f'"{value.value}"'
+    if isinstance(value, _List):
+        return f"[{_render_dict(value.item)}]"
+    if isinstance(value, _Map):
+        return "{" + f'"{value.key}": {_render_dict(value.value)}' + "}"
+
+    fields = ", ".join(
+        f'"{name}": {_render_dict(child)}' for name, child in value.fields
+    )
+
+    return "{" + fields + "}"
+
+
+def _render_dataclass(value: _Value) -> str:
+    """Render a synthesized value as a constructor-expression source string (the dataclass_example form).
+
+    :param value: the synthesized value node to render.
+    """
+    if isinstance(value, _Scalar):
+        return value.dataclass_src
+    if isinstance(value, _Enum):
+        return f"{value.class_name}.{value.member}"
+    if isinstance(value, _List):
+        return f"[{_render_dataclass(value.item)}]"
+    if isinstance(value, _Map):
+        return "{" + f'"{value.key}": {_render_dataclass(value.value)}' + "}"
+
+    fields = ", ".join(
+        f"{name}={_render_dataclass(child)}" for name, child in value.fields
+    )
+
+    return f"{value.class_name}({fields})"
+
+
+def _collect_imports(value: _Value, out: set[tuple[str, str]]) -> None:
+    """Collect (module, class_name) pairs the dataclass_example needs, walking nested objects/enums.
+
+    :param value: the synthesized value node to walk.
+    :param out: set accumulating the (module, class_name) import pairs; mutated in place.
+    """
+    if isinstance(value, _Enum):
+        out.add((value.module, value.class_name))
+    elif isinstance(value, _Object):
+        out.add((value.module, value.class_name))
+        for _, child in value.fields:
+            _collect_imports(child, out)
+    elif isinstance(value, _List):
+        _collect_imports(value.item, out)
+    elif isinstance(value, _Map):
+        _collect_imports(value.value, out)
+
+
+def write_test_cases(output: str, schemas: dict[str, openapi.Schema]):
+    """Write one _generated/<resource_plural>.py per wired resource plus the collector __init__.py.
+
+    :param output: codegen output root (the python/ directory); files land under databricks_tests/core/_generated.
+    :param schemas: all post-patch schemas, used to synthesize each resource's dict/dataclass examples.
+    """
+    resources = _wired_resources()
+
+    generated_path = Path(output) / "databricks_tests" / "core" / "_generated"
+    generated_path.mkdir(parents=True, exist_ok=True)
+
+    plural_to_ref = {ns: ref for ref, ns in packages.RESOURCE_NAMESPACE.items()}
+
+    for r in resources:
+        resource_ref = plural_to_ref[r.plural_name]
+        schema = schemas[resource_ref]
+
+        example = _synth_object(
+            r.plural_name, resource_ref, schema, schemas, set(), top_level=True
+        )
+
+        imports: set[tuple[str, str]] = set()
+        _collect_imports(example, imports)
+        model_imports = "\n".join(
+            f"from {module} import {class_name}"
+            for module, class_name in sorted(imports)
+        )
+
+        code = _TEST_CASE_TEMPLATE.substitute(
+            singular=r.singular_name,
+            plural=r.plural_name,
+            model_imports=model_imports,
+            dict_example=_render_dict(example),
+            dataclass_example=_render_dataclass(example),
+        )
+        (generated_path / f"{r.plural_name}.py").write_text(HEADER + code)
+
+    (generated_path / "__init__.py").write_text(HEADER + _collector_code(resources))
+
+    print(f"Writing test cases into {generated_path}")
+
+
+def _collector_code(resources: list[_WiredResource]) -> str:
+    """Source for _generated/__init__.py: imports the per-resource modules and assembles `test_cases`.
+
+    :param resources: the wired resources, in the order their test cases are collected.
+    """
+    module_imports = "\n".join(f"    {r.plural_name}," for r in resources)
+    entries = "\n".join(f"    {r.plural_name}._test_case()," for r in resources)
+
+    return f"""from databricks_tests.core._generated import (
+{module_imports}
+)
+
+__all__ = ["test_cases"]
+
+test_cases = [
+{entries}
+]
+"""
diff --git a/python/codegen/codegen/generated_wiring.py b/python/codegen/codegen/generated_wiring.py
new file mode 100644
index 00000000000..b5caa80c62b
--- /dev/null
+++ b/python/codegen/codegen/generated_wiring.py
@@ -0,0 +1,160 @@
+"""
+Generates the per-resource wiring in databricks.bundles.core that used to be
+hand-written. All output is rendered from the *.py.tmpl templates in this
+directory.
+
+Each wired resource gets its own file _generated/<plural>.py (rendered from
+wiring_resource.py.tmpl): the add_* method + collection property mixin, the
+*_mutator decorator, and the _ResourceType entry. The generated
+_generated/__init__.py (generated_init.py.tmpl) collects them into
+_GeneratedResources (mixed into Resources), _all_resource_types(), and the
+mutator re-exports. The core package __init__ (core_init.py.tmpl) is generated
+too (static exports plus the generated mutators).
+"""
+
+from dataclasses import dataclass
+from pathlib import Path
+from string import Template
+
+import codegen.packages as packages
+
+HEADER = "# Code generated by pydabs-codegen. DO NOT EDIT.\n\n"
+
+
+def _load_template(name: str) -> Template:
+    return Template((Path(__file__).parent / name).read_text())
+
+
+_RESOURCE_TEMPLATE = _load_template("wiring_resource.py.tmpl")
+_GENERATED_INIT_TEMPLATE = _load_template("generated_init.py.tmpl")
+_CORE_INIT_TEMPLATE = _load_template("core_init.py.tmpl")
+
+
+@dataclass(frozen=True)
+class _WiredResource:
+    class_name: str
+    """Resource dataclass name, e.g. "Job"."""
+
+    singular_name: str
+    """Singular name used in methods and messages, e.g. "job"."""
+
+    plural_name: str
+    """Plural name, the same as the "resources" bundle section, e.g. "jobs"."""
+
+    model_module: str
+    """Module the resource dataclass lives in, e.g. "databricks.bundles.jobs._models.job"."""
+
+
+def _wired_resources() -> list[_WiredResource]:
+    # Every namespaced resource is wired. RESOURCE_NAMESPACE is the single source
+    # of truth for both model generation and wiring.
+    resources = []
+
+    for ref, namespace in packages.RESOURCE_NAMESPACE.items():
+        class_name = packages.get_class_name(ref)
+
+        resources.append(
+            _WiredResource(
+                class_name=class_name,
+                singular_name=packages.to_snake_case(class_name),
+                plural_name=namespace,
+                model_module=packages.get_package(namespace, ref),
+            )
+        )
+
+    resources.sort(key=lambda r: r.plural_name)
+
+    return resources
+
+
+def write_wiring(output: str):
+    resources = _wired_resources()
+
+    core_path = Path(output) / "databricks" / "bundles" / "core"
+    generated_path = core_path / "_generated"
+    generated_path.mkdir(parents=True, exist_ok=True)
+
+    for r in resources:
+        code = _RESOURCE_TEMPLATE.substitute(
+            {
+                "class": r.class_name,
+                "singular": r.singular_name,
+                "plural": r.plural_name,
+                "model_module": r.model_module,
+            }
+        )
+        (generated_path / f"{r.plural_name}.py").write_text(HEADER + code)
+
+    (generated_path / "__init__.py").write_text(HEADER + _collector_code(resources))
+    (core_path / "__init__.py").write_text(HEADER + _core_init_code(resources))
+
+    print(f"Writing wiring into {generated_path}")
+
+
+def _collector_code(resources: list[_WiredResource]) -> str:
+    imports = "\n".join(
+        f"from databricks.bundles.core._generated.{r.plural_name} import "
+        f"_{r.class_name}Resources, {r.singular_name}_mutator"
+        for r in resources
+    )
+
+    mutator_names = [f"{r.singular_name}_mutator" for r in resources]
+    exports = sorted(["_GeneratedResources", "_all_resource_types", *mutator_names])
+    all_block = "\n".join(f'    "{name}",' for name in exports)
+
+    mixins = "\n".join(f"    _{r.class_name}Resources," for r in resources)
+    module_imports = "\n".join(f"        {r.plural_name}," for r in resources)
+    type_entries = "\n".join(
+        f"        {r.plural_name}._resource_type()," for r in resources
+    )
+
+    return _GENERATED_INIT_TEMPLATE.substitute(
+        {
+            "imports": imports,
+            "all_block": all_block,
+            "mixins": mixins,
+            "module_imports": module_imports,
+            "type_entries": type_entries,
+        }
+    )
+
+
+# Static, non-resource exports of databricks.bundles.core, used to build the
+# sorted __all__ (the resource mutators are appended). Must stay in sync with the
+# import statements in core_init.py.tmpl.
+_CORE_INIT_STATIC_EXPORTS = [
+    "Bundle",
+    "Diagnostic",
+    "Diagnostics",
+    "Location",
+    "Resource",
+    "ResourceMutator",
+    "Resources",
+    "Severity",
+    "Variable",
+    "VariableOr",
+    "VariableOrDict",
+    "VariableOrList",
+    "VariableOrOptional",
+    "load_resources_from_current_package_module",
+    "load_resources_from_module",
+    "load_resources_from_modules",
+    "load_resources_from_package_module",
+    "variables",
+]
+
+
+def _core_init_code(resources: list[_WiredResource]) -> str:
+    mutator_names = [f"{r.singular_name}_mutator" for r in resources]
+
+    all_exports = sorted(_CORE_INIT_STATIC_EXPORTS + mutator_names)
+    all_block = "\n".join(f'    "{name}",' for name in all_exports)
+
+    mutator_imports = ",\n".join(f"    {name}" for name in sorted(mutator_names))
+
+    return _CORE_INIT_TEMPLATE.substitute(
+        {
+            "all_block": all_block,
+            "mutator_imports": mutator_imports,
+        }
+    )
diff --git a/python/codegen/codegen/jsonschema.py b/python/codegen/codegen/jsonschema.py
index ceed9203e7a..9ad7191a55c 100644
--- a/python/codegen/codegen/jsonschema.py
+++ b/python/codegen/codegen/jsonschema.py
@@ -1,14 +1,25 @@
 import json
-from pathlib import Path
 from dataclasses import dataclass, field
 from enum import Enum
+from pathlib import Path
 from typing import Optional
 
 import codegen.packages as packages
 
 
-class Stage:
-    PRIVATE = "PRIVATE"
+class LaunchStage:
+    # Mirrors clijson.LaunchStage in the Go code.
+    GA = "GA"
+    PUBLIC_PREVIEW = "PUBLIC_PREVIEW"
+    PUBLIC_BETA = "PUBLIC_BETA"
+    PRIVATE_PREVIEW = "PRIVATE_PREVIEW"
+
+
+def is_experimental_stage(stage: Optional[str]) -> bool:
+    # Beta and private preview may still change; GA and public preview are frozen.
+    # Since PyDABs is typed so field behavior can change in experimental stages,
+    # this can lead to breaking changes hence these fields are declared experimental.
+    return stage in (LaunchStage.PUBLIC_BETA, LaunchStage.PRIVATE_PREVIEW)
 
 
 @dataclass
@@ -101,7 +112,7 @@ def _parse_bool(value) -> Optional[bool]:
             ref=v["$ref"],
             description=v.get("description"),
             deprecated=_parse_bool(v.get("deprecated")),
-            stage=v.get("x-databricks-preview"),
+            stage=v.get("x-databricks-launch-stage"),
         )
 
         properties[k] = prop
@@ -118,7 +129,7 @@ def _parse_bool(value) -> Optional[bool]:
         required=schema.get("required", []),
         description=schema.get("description"),
         deprecated=_parse_bool(schema.get("deprecated")),
-        stage=schema.get("x-databricks-preview"),
+        stage=schema.get("x-databricks-launch-stage"),
     )
 
 
@@ -147,13 +158,15 @@ def get_schemas():
         ["$defs", "github.com", "databricks", "cli", "bundle", "config"],
     )
 
-    # we don't need all spec, only get supported types
     flat_spec = {**sdk_types_spec, **resource_types_spec}
-    flat_spec = {
-        key: value for key, value in flat_spec.items() if packages.should_load_ref(key)
-    }
+
+    # Load only types reachable from the root resources, following $refs.
+    reachable = _collect_reachable_refs(packages.RESOURCE_TYPES, flat_spec)
 
     for name, schema in flat_spec.items():
+        if name not in reachable:
+            continue
+
         try:
             output[name] = _parse_schema(schema)
         except Exception as e:
@@ -162,6 +175,39 @@ def get_schemas():
     return output
 
 
+def _refs_in_raw_schema(schema: dict) -> list[str]:
+    schema = _unwrap_variable(schema) or schema
+
+    return [
+        prop["$ref"].split("/")[-1]
+        for prop in schema.get("properties", {}).values()
+        if prop.get("$ref")
+    ]
+
+
+def _collect_reachable_refs(roots: list[str], flat_spec: dict) -> set[str]:
+    reachable: set[str] = set()
+    stack = list(roots)
+
+    while stack:
+        current = stack.pop()
+        if current in reachable:
+            continue
+
+        reachable.add(current)
+
+        schema = flat_spec.get(current)
+        if schema is None:
+            # primitives and types outside the loaded subtrees are terminal
+            continue
+
+        for ref in _refs_in_raw_schema(schema):
+            if ref not in reachable:
+                stack.append(ref)
+
+    return reachable
+
+
 def _get_spec_path(spec: dict, path: list[str]) -> dict:
     for key in path:
         spec = spec[key]
diff --git a/python/codegen/codegen/jsonschema_patch.py b/python/codegen/codegen/jsonschema_patch.py
index 81267393637..052995c51b5 100644
--- a/python/codegen/codegen/jsonschema_patch.py
+++ b/python/codegen/codegen/jsonschema_patch.py
@@ -18,6 +18,22 @@
     "jobs.SparkJarTask": ["main_class_name"],
 }
 
+# Burn-down list of upstream property descriptions that aren't valid
+# reStructuredText and break the Sphinx docs build. We can't render them and don't
+# want to maintain a hand-copied RST version, so drop the description entirely
+# until the proto comment is fixed upstream. Keyed by schema name, then the field
+# names whose descriptions to drop. drop_field_descriptions flags entries that
+# upstream has already fixed (the description is now empty).
+#
+# jobs.DeploymentSpec.command_path: embeds a Markdown ```bash code fence, which
+# docutils parses as an unterminated inline literal.
+# compute.InstancePoolGcpAttributes.gcp_availability: the final bullet wraps onto
+# an unindented continuation line, which docutils rejects as an unexpected unindent.
+DROP_FIELD_DESCRIPTIONS: dict[str, list[str]] = {
+    "jobs.DeploymentSpec": ["command_path"],
+    "compute.InstancePoolGcpAttributes": ["gcp_availability"],
+}
+
 
 def add_extra_required_fields(schemas: dict[str, Schema]):
     output = {}
@@ -41,6 +57,37 @@ def add_extra_required_fields(schemas: dict[str, Schema]):
     return output
 
 
+def drop_field_descriptions(schemas: dict[str, Schema]):
+    if missing := DROP_FIELD_DESCRIPTIONS.keys() - schemas.keys():
+        raise ValueError(
+            f"Cannot drop field descriptions for unknown schemas: {missing}"
+        )
+
+    output = {}
+    for name, schema in schemas.items():
+        if drop_fields := DROP_FIELD_DESCRIPTIONS.get(name):
+            if unknown := set(drop_fields) - schema.properties.keys():
+                raise ValueError(
+                    f"Cannot drop description for unknown fields {unknown} in schema {name}"
+                )
+
+            new_properties = dict(schema.properties)
+            for field_name in drop_fields:
+                prop = new_properties[field_name]
+                if not prop.description:
+                    raise ValueError(
+                        f"Field description drop for {name}.{field_name} is a no-op; "
+                        "the upstream description is already empty, so remove the entry"
+                    )
+                new_properties[field_name] = replace(prop, description=None)
+
+            output[name] = replace(schema, properties=new_properties)
+        else:
+            output[name] = schema
+
+    return output
+
+
 def remove_unsupported_fields(schemas: dict[str, Schema]):
     output = {}
 
diff --git a/python/codegen/codegen/main.py b/python/codegen/codegen/main.py
index d8764775c5a..83735b8dc4c 100644
--- a/python/codegen/codegen/main.py
+++ b/python/codegen/codegen/main.py
@@ -6,21 +6,26 @@
 import codegen.aliases_patch as aliases_patch
 import codegen.generated_dataclass as generated_dataclass
 import codegen.generated_dataclass_patch as generated_dataclass_patch
+import codegen.generated_docs as generated_docs
 import codegen.generated_enum as generated_enum
 import codegen.generated_imports as generated_imports
+import codegen.generated_test_cases as generated_test_cases
+import codegen.generated_wiring as generated_wiring
 import codegen.jsonschema as openapi
 import codegen.jsonschema_patch as openapi_patch
 import codegen.packages as packages
-
 from codegen.code_builder import CodeBuilder
 from codegen.generated_dataclass import GeneratedDataclass, GeneratedType
 from codegen.generated_enum import GeneratedEnum
 
+HEADER = "# Code generated by pydabs-codegen. DO NOT EDIT.\n\n"
+
 
 def main(output: str):
     schemas = openapi.get_schemas()
     schemas = openapi_patch.add_extra_required_fields(schemas)
     schemas = openapi_patch.remove_unsupported_fields(schemas)
+    schemas = openapi_patch.drop_field_descriptions(schemas)
 
     schemas = _transitively_mark_deprecated_and_private(
         packages.RESOURCE_TYPES, schemas
@@ -45,6 +50,18 @@ def main(output: str):
 
         _write_exports(namespace, dataclasses, enums, output)
 
+    # Generate the per-resource wiring in databricks.bundles.core (the
+    # _ResourceType registry, Resources add_*/property methods, *_mutator
+    # decorators, and the core package __init__).
+    generated_wiring.write_wiring(output)
+
+    # Generate the per-resource ResourceTestCase data driving test_resources.py.
+    generated_test_cases.write_test_cases(output, schemas)
+
+    # Generate the Sphinx .rst pages so the documented resource list stays in
+    # sync with the generated modules.
+    generated_docs.write_docs(output)
+
 
 def _transitively_mark_deprecated_and_private(
     roots: list[str],
@@ -65,7 +82,7 @@ def _transitively_mark_deprecated_and_private(
 
     for schema_name, schema in schemas.items():
         if schema_name not in not_private:
-            schema.stage = openapi.Stage.PRIVATE
+            schema.stage = openapi.LaunchStage.PRIVATE_PREVIEW
 
         if schema_name not in not_deprecated:
             schema.deprecated = True
@@ -88,7 +105,10 @@ def _remove_deprecated_fields(
         if schema.type == openapi.SchemaType.OBJECT:
             new_properties = {}
             for field_name, field in schema.properties.items():
-                if field.deprecated and field.stage == openapi.Stage.PRIVATE:
+                if (
+                    field.deprecated
+                    and field.stage == openapi.LaunchStage.PRIVATE_PREVIEW
+                ):
                     continue
 
                 new_properties[field_name] = field
@@ -174,7 +194,7 @@ def _write_exports(
 
     source_path = Path(output) / package_path / "__init__.py"
     source_path.parent.mkdir(exist_ok=True, parents=True)
-    source_path.write_text(b.build())
+    source_path.write_text(HEADER + b.build())
 
     print(f"Writing exports into {source_path}")
 
@@ -254,7 +274,10 @@ def _collect_reachable_schemas(
                 if field.ref:
                     name = field.ref.split("/")[-1]
 
-                    if not include_private and field.stage == openapi.Stage.PRIVATE:
+                    if (
+                        not include_private
+                        and field.stage == openapi.LaunchStage.PRIVATE_PREVIEW
+                    ):
                         continue
 
                     if not include_deprecated and field.deprecated:
@@ -288,7 +311,7 @@ def _write_code(
     package_code = {}
     typechecking_imports = {}
 
-    for schema_name, generated in dataclasses.items():
+    for _schema_name, generated in dataclasses.items():
         package = generated.package
         code = generated_dataclass.get_code(generated)
 
@@ -298,7 +321,7 @@ def _write_code(
         package_code[package] = package_code.get(package, "")
         package_code[package] += "\n" + code
 
-    for schema_name, generated in enums.items():
+    for _schema_name, generated in enums.items():
         package = generated.package
         code = generated_enum.get_code(generated)
 
@@ -322,7 +345,7 @@ def _write_code(
         source_path = Path(output) / (package_path + ".py")
 
         source_path.parent.mkdir(exist_ok=True, parents=True)
-        source_path.write_text(code)
+        source_path.write_text(HEADER + code)
 
 
 if __name__ == "__main__":
diff --git a/python/codegen/codegen/packages.py b/python/codegen/codegen/packages.py
index 9774911feb9..46674518dca 100644
--- a/python/codegen/codegen/packages.py
+++ b/python/codegen/codegen/packages.py
@@ -1,29 +1,72 @@
+import json
 import re
+from pathlib import Path
 from typing import Optional
 
-# All supported resource types and their namespace
-RESOURCE_NAMESPACE = {
-    "resources.Job": "jobs",
-    "resources.Pipeline": "pipelines",
-    "resources.Catalog": "catalogs",
-    "resources.Schema": "schemas",
-    "resources.Volume": "volumes",
-}
+# Resources with a field type the generator can't model yet are parked here and
+# excluded from generation until support for that type is added. Empty now, but
+# kept as the escape hatch for future resources that hit an unmodellable type.
+RESOURCE_DENYLIST: set[str] = set()
 
-RESOURCE_TYPES = list(RESOURCE_NAMESPACE.keys())
+# Only GA and public-preview resources are generated; later stages may still change.
+_EXCLUDED_RESOURCE_STAGES = {"PUBLIC_BETA", "PRIVATE_PREVIEW"}
+
+
+def _resource_stage(config: dict, type_name: str) -> Optional[str]:
+    node = config.get(type_name, {})
+    if "x-databricks-launch-stage" in node:
+        return node["x-databricks-launch-stage"]
+    for option in node.get("oneOf", []):
+        if "x-databricks-launch-stage" in option:
+            return option["x-databricks-launch-stage"]
+    return None
+
+
+def _load_resource_namespace() -> dict[str, str]:
+    """Map each generated resource type to its bundle section (plural) name.
+
+    Derived from the Resources struct in the bundle schema so it stays in sync
+    with the Go source, minus denylisted and non-public resources.
+    """
+    path = Path(__file__).parent / ".." / ".." / ".." / "bundle/schema/jsonschema.json"
+    bundle = json.load(path.open())["$defs"]["github.com"]["databricks"]["cli"][
+        "bundle"
+    ]
+    config = bundle["config"]
+    properties = bundle["config.Resources"]["oneOf"][0]["properties"]
+
+    namespace = {}
+    for plural, prop in properties.items():
+        ref = prop.get("$ref")
+        if ref is None:
+            options = prop.get("oneOf", []) + prop.get("anyOf", [])
+            ref = next(o["$ref"] for o in options if o.get("$ref"))
+        type_name = ref.split("/")[-1]
+
+        if type_name in RESOURCE_DENYLIST:
+            continue
+        if _resource_stage(config, type_name) in _EXCLUDED_RESOURCE_STAGES:
+            continue
+
+        namespace[type_name] = plural
+
+    return namespace
 
-# Namespaces to load from OpenAPI spec.
-#
-# We can't load all types because of errors while loading some of them.
-LOADED_NAMESPACES = [
-    "compute",
-    "jobs",
-    "pipelines",
-    "resources",
-    "catalog",
-]
+
+# All supported resource types and their namespace.
+RESOURCE_NAMESPACE = _load_resource_namespace()
+
+RESOURCE_TYPES = list(RESOURCE_NAMESPACE.keys())
 
 RENAMES = {
+    # interface{} carries no schema, so it is modelled as Any: JSON/YAML values
+    # pass through untyped. The Go config mutators validate the value.
+    "interface": "Any",
+    # time.Time is a scalar serialized as an RFC3339 string; the Go side models
+    # it as a string too (see libs/dyn/convert/sdk_native_types.go).
+    "time.Time": "str",
+    # duration.Duration is a scalar serialized as a seconds string (e.g. "3600s").
+    "duration.Duration": "str",
     "string": "str",
     "boolean": "bool",
     "integer": "int",
@@ -33,6 +76,9 @@
 }
 
 PRIMITIVES = [
+    # Treated as str
+    "time.Time",
+    "duration.Duration",
     "string",
     "boolean",
     "integer",
@@ -41,28 +87,29 @@
     "int",
     "int64",
     "float64",
+    # Treated as Any (see RENAMES); terminal, like a scalar, so it never recurses.
+    "interface",
 ]
 
 
 def get_class_name(ref: str) -> str:
     name = ref.split("/")[-1]
-    name = name.split(".")[-1]
 
-    return RENAMES.get(name, name)
+    if name in RENAMES:
+        return RENAMES[name]
 
+    name = name.split(".")[-1]
 
-def is_resource(ref: str) -> bool:
-    return ref in RESOURCE_TYPES
+    return RENAMES.get(name, name)
 
 
-def should_load_ref(ref: str) -> bool:
-    name = ref.split("/")[-1]
+def to_snake_case(name: str) -> str:
+    # "VectorSearchIndex" -> "vector_search_index"
+    return re.sub(r"(?<!^)(?=[A-Z])", "_", name).lower()
 
-    for namespace in LOADED_NAMESPACES:
-        if name.startswith(f"{namespace}."):
-            return True
 
-    return name in PRIMITIVES
+def is_resource(ref: str) -> bool:
+    return ref in RESOURCE_TYPES
 
 
 def get_root_package(namespace: str) -> str:
diff --git a/python/codegen/codegen/test_case.py.tmpl b/python/codegen/codegen/test_case.py.tmpl
new file mode 100644
index 00000000000..87cc49f8e8a
--- /dev/null
+++ b/python/codegen/codegen/test_case.py.tmpl
@@ -0,0 +1,16 @@
+from databricks.bundles.core import Resources, ${singular}_mutator
+from databricks.bundles.core._generated.${plural} import _resource_type
+from databricks_tests.core._resource_test_case import ResourceTestCase
+$model_imports
+
+
+def _test_case():
+    return (
+        ResourceTestCase(
+            add_resource=Resources.add_${singular},
+            dict_example=$dict_example,
+            dataclass_example=$dataclass_example,
+            mutator=${singular}_mutator,
+        ),
+        _resource_type(),
+    )
diff --git a/python/codegen/codegen/wiring_resource.py.tmpl b/python/codegen/codegen/wiring_resource.py.tmpl
new file mode 100644
index 00000000000..90a2ea0f157
--- /dev/null
+++ b/python/codegen/codegen/wiring_resource.py.tmpl
@@ -0,0 +1,113 @@
+from collections.abc import Callable
+from typing import TYPE_CHECKING, Optional, overload
+
+from databricks.bundles.core._bundle import Bundle
+from databricks.bundles.core._location import Location
+from databricks.bundles.core._resource_mutator import ResourceMutator
+from databricks.bundles.core._transform import _transform
+
+if TYPE_CHECKING:
+    from databricks.bundles.core._resource_type import _ResourceType
+    from ${model_module} import ${class}, ${class}Param
+
+
+def _resource_type() -> "_ResourceType":
+    from databricks.bundles.core._resource_type import _ResourceType
+    from ${model_module} import ${class}
+
+    return _ResourceType(
+        resource_type=${class},
+        singular_name="${singular}",
+        plural_name="${plural}",
+    )
+
+
+class _${class}Resources:
+    """
+    Generated ${singular} accessors, mixed into Resources.
+    """
+
+    # Provided by the Resources subclass; declared here so the generated methods
+    # below type-check.
+    _resources: dict[str, dict]
+
+    if TYPE_CHECKING:
+
+        def add_location(self, path: tuple[str, ...], location: Location) -> None: ...
+
+        def add_diagnostic_error(
+            self,
+            msg: str,
+            *,
+            detail: Optional[str] = None,
+            path: Optional[tuple[str, ...]] = None,
+            location: Optional[Location] = None,
+        ) -> None: ...
+
+    @property
+    def ${plural}(self) -> dict[str, "${class}"]:
+        return self._resources["${plural}"]
+
+    def add_${singular}(
+        self,
+        resource_name: str,
+        ${singular}: "${class}Param",
+        *,
+        location: Optional[Location] = None,
+    ) -> None:
+        """
+        Adds the resource ${singular} to the collection of resources. Resource name must be unique across all ${plural}.
+
+        :param resource_name: unique identifier for the ${singular}
+        :param ${singular}: the ${singular} to add, can be ${class} or dict
+        :param location: optional location of the ${singular} in the source code
+        """
+        from ${model_module} import ${class}
+
+        ${singular} = _transform(${class}, ${singular})
+        path = ("resources", "${plural}", resource_name)
+        location = location or Location.from_stack_frame(depth=1)
+
+        if self._resources["${plural}"].get(resource_name):
+            self.add_diagnostic_error(
+                msg=f"Duplicate resource name '{resource_name}' for resource '${singular}'. Resource names must be unique.",
+                location=location,
+                path=path,
+            )
+        else:
+            if location:
+                self.add_location(path, location)
+
+            self._resources["${plural}"][resource_name] = ${singular}
+
+
+@overload
+def ${singular}_mutator(
+    function: Callable[[Bundle, "${class}"], "${class}"],
+) -> ResourceMutator["${class}"]: ...
+
+
+@overload
+def ${singular}_mutator(
+    function: Callable[["${class}"], "${class}"],
+) -> ResourceMutator["${class}"]: ...
+
+
+def ${singular}_mutator(function: Callable) -> ResourceMutator["${class}"]:
+    """
+    Decorator for defining mutator for ${plural}. Function should return a new instance of the ${singular}
+    with the desired changes, instead of mutating the input ${singular}.
+
+    Example:
+
+    .. code-block:: python
+
+        @${singular}_mutator
+        def my_${singular}_mutator(bundle: Bundle, ${singular}: ${class}) -> ${class}:
+            return replace(${singular}, ...)
+
+    :param function: Function that mutates ${plural}.
+    """
+    from ${model_module} import ${class}
+
+    return ResourceMutator(resource_type=${class}, function=function)
diff --git a/python/codegen/codegen_tests/test_generated_dataclass.py b/python/codegen/codegen_tests/test_generated_dataclass.py
index 22de11b074c..93ae26c5205 100644
--- a/python/codegen/codegen_tests/test_generated_dataclass.py
+++ b/python/codegen/codegen_tests/test_generated_dataclass.py
@@ -2,10 +2,10 @@
 from codegen.generated_dataclass import (
     GeneratedDataclass,
     GeneratedField,
+    GeneratedType,
     dict_type,
     generate_dataclass,
     generate_type,
-    GeneratedType,
     str_type,
     variable_or_type,
 )
@@ -60,8 +60,6 @@ def test_generate_dataclass():
         extends=[],
         fields=[
             GeneratedField(
-                create_func_default=None,
-                create_func_type_name=variable_or_type(str_type(), is_required=True),
                 default=None,
                 default_factory=None,
                 description="task_key description",
diff --git a/python/codegen/codegen_tests/test_generated_test_cases.py b/python/codegen/codegen_tests/test_generated_test_cases.py
new file mode 100644
index 00000000000..03b9936595a
--- /dev/null
+++ b/python/codegen/codegen_tests/test_generated_test_cases.py
@@ -0,0 +1,351 @@
+"""Tests for generated_test_cases.py, the codegen that builds example resource
+values for the generated pydabs test suite.
+
+For the unfamiliar: the generator reads a resource's JSON schema and synthesizes
+one placeholder "value tree", then renders it two ways -- as a Python dict literal
+and as a dataclass constructor call. Downstream tests use the pair to check that
+converting the dict form yields the dataclass form. These tests cover the pieces
+of that pipeline: parsing schema refs, synthesizing the value tree (and the rules
+for which fields it includes), the two renderers, collecting the imports the
+rendered code needs, and the source of the collector module that gathers it all.
+"""
+
+import codegen.jsonschema as openapi
+import pytest
+from codegen.generated_test_cases import (
+    _collect_imports,
+    _collector_code,
+    _Enum,
+    _is_composite,
+    _List,
+    _Map,
+    _Object,
+    _ref_name,
+    _render_dataclass,
+    _render_dict,
+    _Scalar,
+    _synth_object,
+    _synth_ref,
+    _synth_scalar,
+)
+from codegen.generated_wiring import _WiredResource
+from codegen.jsonschema import Property, Schema, SchemaType
+
+# Full $refs as they appear in jsonschema.json; only the last segment is
+# significant to the code under test, but keeping the SDK prefix makes the
+# fixtures read like the real spec.
+_SDK = "#/$defs/github.com/databricks/databricks-sdk-go/service"
+_COND_REF = f"{_SDK}/sql.AlertCondition"
+_OP_REF = f"{_SDK}/sql.ComparisonOperator"
+
+
+# _ref_name pulls the type name (the last path segment) out of a schema $ref.
+def test_ref_name():
+    assert _ref_name(_COND_REF) == "sql.AlertCondition"
+    assert _ref_name("#/$defs/string") == "string"
+
+
+# _is_composite separates refs that need recursive synthesis (list/map/object/enum)
+# from plain scalar refs (string, int, ...).
+def test_is_composite():
+    assert _is_composite("#/$defs/slice/string")
+    assert _is_composite("#/$defs/map/string")
+    assert _is_composite(_COND_REF)
+    assert not _is_composite("#/$defs/string")
+    assert not _is_composite("#/$defs/int64")
+
+
+# Each primitive type maps to a fixed placeholder value (a string uses the field
+# name; numbers/bools use 0 / 0.0 / True).
+@pytest.mark.parametrize(
+    "name,expected",
+    [
+        ("string", _Scalar('"hint"', '"hint"')),
+        ("integer", _Scalar("0", "0")),
+        ("int", _Scalar("0", "0")),
+        ("int64", _Scalar("0", "0")),
+        ("number", _Scalar("0.0", "0.0")),
+        ("float64", _Scalar("0.0", "0.0")),
+        ("boolean", _Scalar("True", "True")),
+        ("bool", _Scalar("True", "True")),
+        ("time.Time", _Scalar('"2020-01-01T00:00:00Z"', '"2020-01-01T00:00:00Z"')),
+    ],
+)
+def test_synth_scalar(name, expected):
+    assert _synth_scalar(name, "hint") == expected
+
+
+# An unrecognized primitive means the schema has a type the generator doesn't
+# model, so it fails loudly rather than emitting a bad value.
+def test_synth_scalar_unknown_raises():
+    with pytest.raises(ValueError, match="Unknown primitive: duration"):
+        _synth_scalar("duration", "hint")
+
+
+# A scalar ref uses the enclosing field's name as its string placeholder, so the
+# generated example reads like "name" rather than a generic token.
+def test_synth_ref_scalar_uses_field_name_as_hint():
+    assert _synth_ref("jobs", "#/$defs/string", "name", {}, set()) == _Scalar(
+        '"name"', '"name"'
+    )
+
+
+# A list ref becomes a one-element list whose single item is synthesized from the
+# element type.
+def test_synth_ref_list_recurses_on_element():
+    assert _synth_ref("jobs", "#/$defs/slice/string", "tags", {}, set()) == _List(
+        _Scalar('"tags"', '"tags"')
+    )
+
+
+# A map ref becomes one {"key": "value"} entry -- the generator only ever emits
+# string-keyed, string-valued maps.
+def test_synth_ref_map_is_always_string_keyed():
+    assert _synth_ref("jobs", "#/$defs/map/string", "labels", {}, set()) == _Map(
+        "key", _Scalar('"value"', '"value"')
+    )
+
+
+# Any other kind of map is never produced, so hitting one fails loudly.
+def test_synth_ref_non_string_map_raises():
+    with pytest.raises(ValueError, match="Unsupported map ref"):
+        _synth_ref("jobs", "#/$defs/map/integer", "labels", {}, set())
+
+
+# An enum ref becomes an _Enum node carrying the chosen value plus the class name,
+# module, and member the generated code will reference.
+def test_synth_ref_enum():
+    schemas = {
+        "sql.ComparisonOperator": Schema(type=SchemaType.STRING, enum=["greaterThan"]),
+    }
+
+    assert _synth_ref("alerts", _OP_REF, "op", schemas, set()) == _Enum(
+        value="greaterThan",
+        class_name="ComparisonOperator",
+        module="databricks.bundles.alerts._models.comparison_operator",
+        member="GREATER_THAN",
+    )
+
+
+# A type that (transitively) requires itself has no finite example, so synthesis
+# must detect the cycle and stop instead of recursing forever.
+def test_synth_ref_required_cycle_raises():
+    schemas = {"sql.AlertCondition": Schema(type=SchemaType.OBJECT)}
+
+    # The referenced object is already on the current path: a required cycle has
+    # no finite value, so synthesis must fail rather than recurse forever.
+    with pytest.raises(
+        ValueError, match=r"Required-field cycle through 'sql.AlertCondition'"
+    ):
+        _synth_ref("alerts", _COND_REF, "condition", schemas, {"sql.AlertCondition"})
+
+
+# Which properties land in a resource's example: the field-selection policy.
+def test_synth_object_field_policy():
+    # A top-level resource keeps: all required fields (scalar + composite), and
+    # stable optional composite fields. It drops optional scalars.
+    schemas = {
+        "resources.Alert": Schema(
+            type=SchemaType.OBJECT,
+            properties={
+                "display_name": Property(ref="#/$defs/string"),
+                "condition": Property(ref=_COND_REF),
+                "seconds_to_retrigger": Property(ref="#/$defs/int"),
+                "tags": Property(ref="#/$defs/slice/string"),
+            },
+            required=["display_name", "condition"],
+        ),
+        "sql.AlertCondition": Schema(
+            type=SchemaType.OBJECT,
+            properties={
+                "op": Property(ref="#/$defs/string"),
+                "threshold": Property(ref="#/$defs/slice/string"),
+            },
+            required=["op"],
+        ),
+    }
+
+    example = _synth_object(
+        "alerts",
+        "resources.Alert",
+        schemas["resources.Alert"],
+        schemas,
+        set(),
+        top_level=True,
+    )
+
+    assert example == _Object(
+        class_name="Alert",
+        module="databricks.bundles.alerts._models.alert",
+        fields=[
+            ("display_name", _Scalar('"display_name"', '"display_name"')),
+            # Nested object contributes only its required field (op); the nested
+            # optional composite (threshold) is dropped because top_level is False.
+            (
+                "condition",
+                _Object(
+                    class_name="AlertCondition",
+                    module="databricks.bundles.alerts._models.alert_condition",
+                    fields=[("op", _Scalar('"op"', '"op"'))],
+                ),
+            ),
+            # seconds_to_retrigger (optional scalar) is dropped.
+            ("tags", _List(_Scalar('"tags"', '"tags"'))),
+        ],
+    )
+
+
+# An optional field is only included if it is "stable": deprecated fields and
+# ones still in beta / private preview are left out (absent stage counts as GA).
+@pytest.mark.parametrize(
+    "deprecated,stage,kept",
+    [
+        (None, None, True),
+        (None, openapi.LaunchStage.PUBLIC_PREVIEW, True),
+        (True, None, False),
+        (None, openapi.LaunchStage.PUBLIC_BETA, False),
+        (None, openapi.LaunchStage.PRIVATE_PREVIEW, False),
+    ],
+)
+def test_synth_object_optional_composite_stability(deprecated, stage, kept):
+    schemas = {
+        "resources.Alert": Schema(
+            type=SchemaType.OBJECT,
+            properties={
+                "tags": Property(
+                    ref="#/$defs/slice/string", deprecated=deprecated, stage=stage
+                ),
+            },
+            required=[],
+        ),
+    }
+
+    example = _synth_object(
+        "alerts",
+        "resources.Alert",
+        schemas["resources.Alert"],
+        schemas,
+        set(),
+        top_level=True,
+    )
+
+    assert bool(example.fields) == kept
+
+
+# Inside a nested object (anything that isn't the resource itself) only required
+# fields are kept, which keeps examples bounded.
+def test_synth_object_nested_drops_all_optional():
+    schemas = {
+        "sql.AlertCondition": Schema(
+            type=SchemaType.OBJECT,
+            properties={
+                "op": Property(ref="#/$defs/string"),
+                "operand": Property(ref="#/$defs/slice/string"),
+            },
+            required=["op"],
+        ),
+    }
+
+    example = _synth_object(
+        "alerts",
+        "sql.AlertCondition",
+        schemas["sql.AlertCondition"],
+        schemas,
+        set(),
+        top_level=False,
+    )
+
+    assert [name for name, _ in example.fields] == ["op"]
+
+
+# --- rendering -------------------------------------------------------------
+
+_VALUE_TREE = _Object(
+    class_name="Alert",
+    module="databricks.bundles.alerts._models.alert",
+    fields=[
+        ("display_name", _Scalar('"display_name"', '"display_name"')),
+        (
+            "op",
+            _Enum(
+                value="greaterThan",
+                class_name="ComparisonOperator",
+                module="databricks.bundles.alerts._models.comparison_operator",
+                member="GREATER_THAN",
+            ),
+        ),
+        ("tags", _List(_Scalar('"tags"', '"tags"'))),
+        ("labels", _Map("key", _Scalar('"value"', '"value"'))),
+    ],
+)
+
+
+# Rendering a value tree as a Python dict-literal string (the "dict_example" form).
+def test_render_dict():
+    assert _render_dict(_VALUE_TREE) == (
+        '{"display_name": "display_name", "op": "greaterThan", '
+        '"tags": ["tags"], "labels": {"key": "value"}}'
+    )
+
+
+# Rendering the same tree as a dataclass-constructor string (the "dataclass_example"
+# form); the two renderers must agree on structure but differ on enums.
+def test_render_dataclass():
+    # Enums render as a class member reference, unlike the dict form's raw string.
+    assert _render_dataclass(_VALUE_TREE) == (
+        'Alert(display_name="display_name", op=ComparisonOperator.GREATER_THAN, '
+        'tags=["tags"], labels={"key": "value"})'
+    )
+
+
+# The dataclass example references object and enum classes; this collects the
+# (module, class) imports it needs, reaching into lists and maps to find them.
+def test_collect_imports_gathers_objects_and_enums_through_containers():
+    out: set[tuple[str, str]] = set()
+    _collect_imports(_VALUE_TREE, out)
+
+    assert out == {
+        ("databricks.bundles.alerts._models.alert", "Alert"),
+        ("databricks.bundles.alerts._models.comparison_operator", "ComparisonOperator"),
+    }
+
+
+# A tree of only primitives references no classes, so it needs no imports.
+def test_collect_imports_scalar_only_tree_is_empty():
+    out: set[tuple[str, str]] = set()
+    _collect_imports(_Scalar('"x"', '"x"'), out)
+
+    assert out == set()
+
+
+# Source of the _generated/__init__.py that imports each resource's module and
+# gathers their test cases into a single `test_cases` list.
+def test_collector_code():
+    resources = [
+        _WiredResource(
+            class_name="Alert",
+            singular_name="alert",
+            plural_name="alerts",
+            model_module="databricks.bundles.alerts._models.alert",
+        ),
+        _WiredResource(
+            class_name="Job",
+            singular_name="job",
+            plural_name="jobs",
+            model_module="databricks.bundles.jobs._models.job",
+        ),
+    ]
+
+    assert _collector_code(resources) == (
+        "from databricks_tests.core._generated import (\n"
+        "    alerts,\n"
+        "    jobs,\n"
+        ")\n"
+        "\n"
+        '__all__ = ["test_cases"]\n'
+        "\n"
+        "test_cases = [\n"
+        "    alerts._test_case(),\n"
+        "    jobs._test_case(),\n"
+        "]\n"
+    )
diff --git a/python/databricks/bundles/.gitattributes b/python/databricks/bundles/.gitattributes
new file mode 100644
index 00000000000..658274265f1
--- /dev/null
+++ b/python/databricks/bundles/.gitattributes
@@ -0,0 +1,6 @@
+# Generated by pydabs-codegen (see python/codegen). Each generated namespace
+# has a _models/ tree and an __init__.py. In core/, only the _generated/ tree
+# and the package __init__.py are generated; the rest is hand-written.
+*/_models/** linguist-generated=true
+*/__init__.py linguist-generated=true
+core/_generated/** linguist-generated=true
diff --git a/python/databricks/bundles/alerts/__init__.py b/python/databricks/bundles/alerts/__init__.py
new file mode 100644
index 00000000000..3d8987ba271
--- /dev/null
+++ b/python/databricks/bundles/alerts/__init__.py
@@ -0,0 +1,131 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+__all__ = [
+    "Aggregation",
+    "AggregationParam",
+    "Alert",
+    "AlertDict",
+    "AlertEvaluationState",
+    "AlertEvaluationStateParam",
+    "AlertParam",
+    "AlertStatementParameter",
+    "AlertStatementParameterDict",
+    "AlertStatementParameterParam",
+    "AlertV2Evaluation",
+    "AlertV2EvaluationDict",
+    "AlertV2EvaluationParam",
+    "AlertV2Notification",
+    "AlertV2NotificationDict",
+    "AlertV2NotificationParam",
+    "AlertV2Operand",
+    "AlertV2OperandColumn",
+    "AlertV2OperandColumnDict",
+    "AlertV2OperandColumnParam",
+    "AlertV2OperandDict",
+    "AlertV2OperandParam",
+    "AlertV2OperandValue",
+    "AlertV2OperandValueDict",
+    "AlertV2OperandValueParam",
+    "AlertV2RunAs",
+    "AlertV2RunAsDict",
+    "AlertV2RunAsParam",
+    "AlertV2Subscription",
+    "AlertV2SubscriptionDict",
+    "AlertV2SubscriptionParam",
+    "ComparisonOperator",
+    "ComparisonOperatorParam",
+    "CronSchedule",
+    "CronScheduleDict",
+    "CronScheduleParam",
+    "CustomTemplateFormat",
+    "CustomTemplateFormatParam",
+    "Lifecycle",
+    "LifecycleDict",
+    "LifecycleParam",
+    "Permission",
+    "PermissionDict",
+    "PermissionLevel",
+    "PermissionLevelParam",
+    "PermissionParam",
+    "SchedulePauseStatus",
+    "SchedulePauseStatusParam",
+]
+
+
+from databricks.bundles.alerts._models.aggregation import Aggregation, AggregationParam
+from databricks.bundles.alerts._models.alert import Alert, AlertDict, AlertParam
+from databricks.bundles.alerts._models.alert_evaluation_state import (
+    AlertEvaluationState,
+    AlertEvaluationStateParam,
+)
+from databricks.bundles.alerts._models.alert_statement_parameter import (
+    AlertStatementParameter,
+    AlertStatementParameterDict,
+    AlertStatementParameterParam,
+)
+from databricks.bundles.alerts._models.alert_v2_evaluation import (
+    AlertV2Evaluation,
+    AlertV2EvaluationDict,
+    AlertV2EvaluationParam,
+)
+from databricks.bundles.alerts._models.alert_v2_notification import (
+    AlertV2Notification,
+    AlertV2NotificationDict,
+    AlertV2NotificationParam,
+)
+from databricks.bundles.alerts._models.alert_v2_operand import (
+    AlertV2Operand,
+    AlertV2OperandDict,
+    AlertV2OperandParam,
+)
+from databricks.bundles.alerts._models.alert_v2_operand_column import (
+    AlertV2OperandColumn,
+    AlertV2OperandColumnDict,
+    AlertV2OperandColumnParam,
+)
+from databricks.bundles.alerts._models.alert_v2_operand_value import (
+    AlertV2OperandValue,
+    AlertV2OperandValueDict,
+    AlertV2OperandValueParam,
+)
+from databricks.bundles.alerts._models.alert_v2_run_as import (
+    AlertV2RunAs,
+    AlertV2RunAsDict,
+    AlertV2RunAsParam,
+)
+from databricks.bundles.alerts._models.alert_v2_subscription import (
+    AlertV2Subscription,
+    AlertV2SubscriptionDict,
+    AlertV2SubscriptionParam,
+)
+from databricks.bundles.alerts._models.comparison_operator import (
+    ComparisonOperator,
+    ComparisonOperatorParam,
+)
+from databricks.bundles.alerts._models.cron_schedule import (
+    CronSchedule,
+    CronScheduleDict,
+    CronScheduleParam,
+)
+from databricks.bundles.alerts._models.custom_template_format import (
+    CustomTemplateFormat,
+    CustomTemplateFormatParam,
+)
+from databricks.bundles.alerts._models.lifecycle import (
+    Lifecycle,
+    LifecycleDict,
+    LifecycleParam,
+)
+from databricks.bundles.alerts._models.permission import (
+    Permission,
+    PermissionDict,
+    PermissionParam,
+)
+from databricks.bundles.alerts._models.permission_level import (
+    PermissionLevel,
+    PermissionLevelParam,
+)
+from databricks.bundles.alerts._models.schedule_pause_status import (
+    SchedulePauseStatus,
+    SchedulePauseStatusParam,
+)
diff --git a/python/databricks/bundles/alerts/_models/aggregation.py b/python/databricks/bundles/alerts/_models/aggregation.py
new file mode 100644
index 00000000000..ff9efddf6e9
--- /dev/null
+++ b/python/databricks/bundles/alerts/_models/aggregation.py
@@ -0,0 +1,21 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class Aggregation(Enum):
+    SUM = "SUM"
+    COUNT = "COUNT"
+    COUNT_DISTINCT = "COUNT_DISTINCT"
+    AVG = "AVG"
+    MEDIAN = "MEDIAN"
+    MIN = "MIN"
+    MAX = "MAX"
+    STDDEV = "STDDEV"
+
+
+AggregationParam = (
+    Literal["SUM", "COUNT", "COUNT_DISTINCT", "AVG", "MEDIAN", "MIN", "MAX", "STDDEV"]
+    | Aggregation
+)
diff --git a/python/databricks/bundles/alerts/_models/alert.py b/python/databricks/bundles/alerts/_models/alert.py
new file mode 100644
index 00000000000..2a66b1d169c
--- /dev/null
+++ b/python/databricks/bundles/alerts/_models/alert.py
@@ -0,0 +1,245 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.alerts._models.alert_statement_parameter import (
+    AlertStatementParameter,
+    AlertStatementParameterParam,
+)
+from databricks.bundles.alerts._models.alert_v2_evaluation import (
+    AlertV2Evaluation,
+    AlertV2EvaluationParam,
+)
+from databricks.bundles.alerts._models.alert_v2_run_as import (
+    AlertV2RunAs,
+    AlertV2RunAsParam,
+)
+from databricks.bundles.alerts._models.cron_schedule import (
+    CronSchedule,
+    CronScheduleParam,
+)
+from databricks.bundles.alerts._models.custom_template_format import (
+    CustomTemplateFormat,
+    CustomTemplateFormatParam,
+)
+from databricks.bundles.alerts._models.lifecycle import Lifecycle, LifecycleParam
+from databricks.bundles.alerts._models.permission import Permission, PermissionParam
+from databricks.bundles.core._resource import Resource
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import (
+    VariableOr,
+    VariableOrList,
+    VariableOrOptional,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class Alert(Resource):
+    """"""
+
+    display_name: VariableOr[str]
+    """
+    The display name of the alert.
+    """
+
+    evaluation: VariableOr[AlertV2Evaluation]
+
+    query_text: VariableOr[str]
+    """
+    Text of the query to be run.
+    """
+
+    schedule: VariableOr[CronSchedule]
+
+    warehouse_id: VariableOr[str]
+    """
+    ID of the SQL warehouse attached to the alert.
+    """
+
+    custom_description: VariableOrOptional[str] = None
+    """
+    Custom description for the alert. support mustache template.
+    """
+
+    custom_summary: VariableOrOptional[str] = None
+    """
+    Custom summary for the alert. support mustache template.
+    """
+
+    custom_template_format: VariableOrOptional[CustomTemplateFormat] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The format used to interpret the `custom_summary` and `custom_description` templates.
+    
+    `HTML` treats both templates as HTML with Mustache `{{VARIABLE_NAME}}` placeholders.
+    `MARKDOWN` treats them as Markdown with allowlisted `@VARIABLE_NAME` placeholders and converts
+    them to the format each notification destination expects, so a single template renders
+    correctly in email, Slack, and Microsoft Teams.
+    
+    When unset, the API applies no default. Responses omit the field unless a format is stored,
+    and a template with no format is rendered as HTML.
+    """
+
+    file_path: VariableOrOptional[str] = None
+
+    lifecycle: VariableOrOptional[Lifecycle] = None
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+    parameters: VariableOrList[AlertStatementParameter] = field(default_factory=list)
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] A list of parameters to pass into the alert SQL query statement containing parameter markers. Static values only.
+    
+    Reference a parameter in the query text as `:name`. Each parameter must have a unique, non-empty name.
+    Each parameter consists of a name, a value, and optionally a type. To represent a NULL
+    value, the `value` field may be omitted or set to `null` explicitly. If the `type` field
+    is omitted, the value is interpreted as a string.
+    
+    If the type is given, parameters will be checked for type correctness according
+    to the given type. A value is correct if the provided string can be converted to
+    the requested type using the `cast` function. The exact semantics are described in
+    the section [`cast` function](https://docs.databricks.com/sql/language-manual/functions/cast.html) of the SQL language reference.
+    """
+
+    parent_path: VariableOrOptional[str] = None
+    """
+    The workspace path of the folder containing the alert. Can only be set on create, and cannot be updated.
+    """
+
+    permissions: VariableOrList[Permission] = field(default_factory=list)
+    """
+    The permissions to apply to this resource.
+    """
+
+    run_as: VariableOrOptional[AlertV2RunAs] = None
+    """
+    Specifies the identity that will be used to run the alert.
+    This field allows you to configure alerts to run as a specific user or service principal.
+    - For user identity: Set `user_name` to the email of an active workspace user. Users can only set this to their own email.
+    - For service principal: Set `service_principal_name` to the application ID. Requires the `servicePrincipal/user` role.
+    If not specified, the alert will run as the request user.
+    """
+
+    run_as_user_name: VariableOrOptional[str] = None
+    """
+    [DEPRECATED] The run as username or application ID of service principal.
+    On Create and Update, this field can be set to application ID of an active service principal. Setting this field requires the servicePrincipal/user role.
+    Deprecated: Use `run_as` field instead. This field will be removed in a future release.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "AlertDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AlertDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AlertDict(TypedDict, total=False):
+    """"""
+
+    display_name: VariableOr[str]
+    """
+    The display name of the alert.
+    """
+
+    evaluation: VariableOr[AlertV2EvaluationParam]
+
+    query_text: VariableOr[str]
+    """
+    Text of the query to be run.
+    """
+
+    schedule: VariableOr[CronScheduleParam]
+
+    warehouse_id: VariableOr[str]
+    """
+    ID of the SQL warehouse attached to the alert.
+    """
+
+    custom_description: VariableOrOptional[str]
+    """
+    Custom description for the alert. support mustache template.
+    """
+
+    custom_summary: VariableOrOptional[str]
+    """
+    Custom summary for the alert. support mustache template.
+    """
+
+    custom_template_format: VariableOrOptional[CustomTemplateFormatParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The format used to interpret the `custom_summary` and `custom_description` templates.
+    
+    `HTML` treats both templates as HTML with Mustache `{{VARIABLE_NAME}}` placeholders.
+    `MARKDOWN` treats them as Markdown with allowlisted `@VARIABLE_NAME` placeholders and converts
+    them to the format each notification destination expects, so a single template renders
+    correctly in email, Slack, and Microsoft Teams.
+    
+    When unset, the API applies no default. Responses omit the field unless a format is stored,
+    and a template with no format is rendered as HTML.
+    """
+
+    file_path: VariableOrOptional[str]
+
+    lifecycle: VariableOrOptional[LifecycleParam]
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+    parameters: VariableOrList[AlertStatementParameterParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] A list of parameters to pass into the alert SQL query statement containing parameter markers. Static values only.
+    
+    Reference a parameter in the query text as `:name`. Each parameter must have a unique, non-empty name.
+    Each parameter consists of a name, a value, and optionally a type. To represent a NULL
+    value, the `value` field may be omitted or set to `null` explicitly. If the `type` field
+    is omitted, the value is interpreted as a string.
+    
+    If the type is given, parameters will be checked for type correctness according
+    to the given type. A value is correct if the provided string can be converted to
+    the requested type using the `cast` function. The exact semantics are described in
+    the section [`cast` function](https://docs.databricks.com/sql/language-manual/functions/cast.html) of the SQL language reference.
+    """
+
+    parent_path: VariableOrOptional[str]
+    """
+    The workspace path of the folder containing the alert. Can only be set on create, and cannot be updated.
+    """
+
+    permissions: VariableOrList[PermissionParam]
+    """
+    The permissions to apply to this resource.
+    """
+
+    run_as: VariableOrOptional[AlertV2RunAsParam]
+    """
+    Specifies the identity that will be used to run the alert.
+    This field allows you to configure alerts to run as a specific user or service principal.
+    - For user identity: Set `user_name` to the email of an active workspace user. Users can only set this to their own email.
+    - For service principal: Set `service_principal_name` to the application ID. Requires the `servicePrincipal/user` role.
+    If not specified, the alert will run as the request user.
+    """
+
+    run_as_user_name: VariableOrOptional[str]
+    """
+    [DEPRECATED] The run as username or application ID of service principal.
+    On Create and Update, this field can be set to application ID of an active service principal. Setting this field requires the servicePrincipal/user role.
+    Deprecated: Use `run_as` field instead. This field will be removed in a future release.
+    """
+
+
+AlertParam = AlertDict | Alert
diff --git a/python/databricks/bundles/alerts/_models/alert_evaluation_state.py b/python/databricks/bundles/alerts/_models/alert_evaluation_state.py
new file mode 100644
index 00000000000..abee35a5a4a
--- /dev/null
+++ b/python/databricks/bundles/alerts/_models/alert_evaluation_state.py
@@ -0,0 +1,24 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class AlertEvaluationState(Enum):
+    """
+    UNSPECIFIED - default unspecify value for proto enum, do not use it in the code
+    UNKNOWN - alert not yet evaluated
+    TRIGGERED - alert is triggered
+    OK - alert is not triggered
+    ERROR - alert evaluation failed
+    """
+
+    UNKNOWN = "UNKNOWN"
+    TRIGGERED = "TRIGGERED"
+    OK = "OK"
+    ERROR = "ERROR"
+
+
+AlertEvaluationStateParam = (
+    Literal["UNKNOWN", "TRIGGERED", "OK", "ERROR"] | AlertEvaluationState
+)
diff --git a/python/databricks/bundles/alerts/_models/alert_statement_parameter.py b/python/databricks/bundles/alerts/_models/alert_statement_parameter.py
new file mode 100644
index 00000000000..def206d148d
--- /dev/null
+++ b/python/databricks/bundles/alerts/_models/alert_statement_parameter.py
@@ -0,0 +1,81 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AlertStatementParameter:
+    """
+    :meta private: [EXPERIMENTAL]
+
+    A named parameter bound to the alert query. Only flat, named scalar parameters are
+    supported; complex types such as ARRAY, MAP, and STRUCT are not.
+    """
+
+    name: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The name of the parameter. Reference it in the query text as `:name`. Required, must be
+    non-empty, and must be unique across the alert's parameters.
+    """
+
+    type: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The SQL data type of the parameter, for example `STRING`, `INT`, or `DECIMAL(10, 2)`. If no type is given
+    the type is assumed to be `STRING`. Complex types such as `ARRAY`, `MAP`, and `STRUCT` are not supported.
+    """
+
+    value: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The value bound to the parameter, represented as a string. If omitted, the value is interpreted as NULL.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "AlertStatementParameterDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AlertStatementParameterDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AlertStatementParameterDict(TypedDict, total=False):
+    """"""
+
+    name: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The name of the parameter. Reference it in the query text as `:name`. Required, must be
+    non-empty, and must be unique across the alert's parameters.
+    """
+
+    type: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The SQL data type of the parameter, for example `STRING`, `INT`, or `DECIMAL(10, 2)`. If no type is given
+    the type is assumed to be `STRING`. Complex types such as `ARRAY`, `MAP`, and `STRUCT` are not supported.
+    """
+
+    value: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The value bound to the parameter, represented as a string. If omitted, the value is interpreted as NULL.
+    """
+
+
+AlertStatementParameterParam = AlertStatementParameterDict | AlertStatementParameter
diff --git a/python/databricks/bundles/alerts/_models/alert_v2_evaluation.py b/python/databricks/bundles/alerts/_models/alert_v2_evaluation.py
new file mode 100644
index 00000000000..4d599872ccb
--- /dev/null
+++ b/python/databricks/bundles/alerts/_models/alert_v2_evaluation.py
@@ -0,0 +1,100 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.alerts._models.alert_evaluation_state import (
+    AlertEvaluationState,
+    AlertEvaluationStateParam,
+)
+from databricks.bundles.alerts._models.alert_v2_notification import (
+    AlertV2Notification,
+    AlertV2NotificationParam,
+)
+from databricks.bundles.alerts._models.alert_v2_operand import (
+    AlertV2Operand,
+    AlertV2OperandParam,
+)
+from databricks.bundles.alerts._models.alert_v2_operand_column import (
+    AlertV2OperandColumn,
+    AlertV2OperandColumnParam,
+)
+from databricks.bundles.alerts._models.comparison_operator import (
+    ComparisonOperator,
+    ComparisonOperatorParam,
+)
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AlertV2Evaluation:
+    """"""
+
+    comparison_operator: VariableOr[ComparisonOperator]
+    """
+    Operator used for comparison in alert evaluation.
+    """
+
+    source: VariableOr[AlertV2OperandColumn]
+    """
+    Source column from result to use to evaluate alert
+    """
+
+    empty_result_state: VariableOrOptional[AlertEvaluationState] = None
+    """
+    Alert state if result is empty. Please avoid setting this field to be `UNKNOWN` because `UNKNOWN` state is planned to be deprecated.
+    """
+
+    notification: VariableOrOptional[AlertV2Notification] = None
+    """
+    User or Notification Destination to notify when alert is triggered.
+    """
+
+    threshold: VariableOrOptional[AlertV2Operand] = None
+    """
+    Threshold to user for alert evaluation, can be a column or a value.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "AlertV2EvaluationDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AlertV2EvaluationDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AlertV2EvaluationDict(TypedDict, total=False):
+    """"""
+
+    comparison_operator: VariableOr[ComparisonOperatorParam]
+    """
+    Operator used for comparison in alert evaluation.
+    """
+
+    source: VariableOr[AlertV2OperandColumnParam]
+    """
+    Source column from result to use to evaluate alert
+    """
+
+    empty_result_state: VariableOrOptional[AlertEvaluationStateParam]
+    """
+    Alert state if result is empty. Please avoid setting this field to be `UNKNOWN` because `UNKNOWN` state is planned to be deprecated.
+    """
+
+    notification: VariableOrOptional[AlertV2NotificationParam]
+    """
+    User or Notification Destination to notify when alert is triggered.
+    """
+
+    threshold: VariableOrOptional[AlertV2OperandParam]
+    """
+    Threshold to user for alert evaluation, can be a column or a value.
+    """
+
+
+AlertV2EvaluationParam = AlertV2EvaluationDict | AlertV2Evaluation
diff --git a/python/databricks/bundles/alerts/_models/alert_v2_notification.py b/python/databricks/bundles/alerts/_models/alert_v2_notification.py
new file mode 100644
index 00000000000..81c892f1d90
--- /dev/null
+++ b/python/databricks/bundles/alerts/_models/alert_v2_notification.py
@@ -0,0 +1,62 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.alerts._models.alert_v2_subscription import (
+    AlertV2Subscription,
+    AlertV2SubscriptionParam,
+)
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AlertV2Notification:
+    """"""
+
+    notify_on_ok: VariableOrOptional[bool] = None
+    """
+    Whether to notify alert subscribers when alert returns back to normal.
+    """
+
+    retrigger_seconds: VariableOrOptional[int] = None
+    """
+    Number of seconds an alert waits after being triggered before it is allowed to send another notification.
+    If set to 0 or omitted, the alert will not send any further notifications after the first trigger
+    Setting this value to 1 allows the alert to send a notification on every evaluation where the condition is met, effectively making it always retrigger for notification purposes.
+    """
+
+    subscriptions: VariableOrList[AlertV2Subscription] = field(default_factory=list)
+
+    @classmethod
+    def from_dict(cls, value: "AlertV2NotificationDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AlertV2NotificationDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AlertV2NotificationDict(TypedDict, total=False):
+    """"""
+
+    notify_on_ok: VariableOrOptional[bool]
+    """
+    Whether to notify alert subscribers when alert returns back to normal.
+    """
+
+    retrigger_seconds: VariableOrOptional[int]
+    """
+    Number of seconds an alert waits after being triggered before it is allowed to send another notification.
+    If set to 0 or omitted, the alert will not send any further notifications after the first trigger
+    Setting this value to 1 allows the alert to send a notification on every evaluation where the condition is met, effectively making it always retrigger for notification purposes.
+    """
+
+    subscriptions: VariableOrList[AlertV2SubscriptionParam]
+
+
+AlertV2NotificationParam = AlertV2NotificationDict | AlertV2Notification
diff --git a/python/databricks/bundles/alerts/_models/alert_v2_operand.py b/python/databricks/bundles/alerts/_models/alert_v2_operand.py
new file mode 100644
index 00000000000..5e39c938860
--- /dev/null
+++ b/python/databricks/bundles/alerts/_models/alert_v2_operand.py
@@ -0,0 +1,46 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.alerts._models.alert_v2_operand_column import (
+    AlertV2OperandColumn,
+    AlertV2OperandColumnParam,
+)
+from databricks.bundles.alerts._models.alert_v2_operand_value import (
+    AlertV2OperandValue,
+    AlertV2OperandValueParam,
+)
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AlertV2Operand:
+    """"""
+
+    column: VariableOrOptional[AlertV2OperandColumn] = None
+
+    value: VariableOrOptional[AlertV2OperandValue] = None
+
+    @classmethod
+    def from_dict(cls, value: "AlertV2OperandDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AlertV2OperandDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AlertV2OperandDict(TypedDict, total=False):
+    """"""
+
+    column: VariableOrOptional[AlertV2OperandColumnParam]
+
+    value: VariableOrOptional[AlertV2OperandValueParam]
+
+
+AlertV2OperandParam = AlertV2OperandDict | AlertV2Operand
diff --git a/python/databricks/bundles/alerts/_models/alert_v2_operand_column.py b/python/databricks/bundles/alerts/_models/alert_v2_operand_column.py
new file mode 100644
index 00000000000..da2f90107e8
--- /dev/null
+++ b/python/databricks/bundles/alerts/_models/alert_v2_operand_column.py
@@ -0,0 +1,49 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.alerts._models.aggregation import Aggregation, AggregationParam
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AlertV2OperandColumn:
+    """"""
+
+    name: VariableOr[str]
+
+    aggregation: VariableOrOptional[Aggregation] = None
+    """
+    If not set, the behavior is equivalent to using `First row` in the UI.
+    """
+
+    display: VariableOrOptional[str] = None
+
+    @classmethod
+    def from_dict(cls, value: "AlertV2OperandColumnDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AlertV2OperandColumnDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AlertV2OperandColumnDict(TypedDict, total=False):
+    """"""
+
+    name: VariableOr[str]
+
+    aggregation: VariableOrOptional[AggregationParam]
+    """
+    If not set, the behavior is equivalent to using `First row` in the UI.
+    """
+
+    display: VariableOrOptional[str]
+
+
+AlertV2OperandColumnParam = AlertV2OperandColumnDict | AlertV2OperandColumn
diff --git a/python/databricks/bundles/alerts/_models/alert_v2_operand_value.py b/python/databricks/bundles/alerts/_models/alert_v2_operand_value.py
new file mode 100644
index 00000000000..5abc7f386ee
--- /dev/null
+++ b/python/databricks/bundles/alerts/_models/alert_v2_operand_value.py
@@ -0,0 +1,42 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AlertV2OperandValue:
+    """"""
+
+    bool_value: VariableOrOptional[bool] = None
+
+    double_value: VariableOrOptional[float] = None
+
+    string_value: VariableOrOptional[str] = None
+
+    @classmethod
+    def from_dict(cls, value: "AlertV2OperandValueDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AlertV2OperandValueDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AlertV2OperandValueDict(TypedDict, total=False):
+    """"""
+
+    bool_value: VariableOrOptional[bool]
+
+    double_value: VariableOrOptional[float]
+
+    string_value: VariableOrOptional[str]
+
+
+AlertV2OperandValueParam = AlertV2OperandValueDict | AlertV2OperandValue
diff --git a/python/databricks/bundles/alerts/_models/alert_v2_run_as.py b/python/databricks/bundles/alerts/_models/alert_v2_run_as.py
new file mode 100644
index 00000000000..164318184ab
--- /dev/null
+++ b/python/databricks/bundles/alerts/_models/alert_v2_run_as.py
@@ -0,0 +1,50 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AlertV2RunAs:
+    """"""
+
+    service_principal_name: VariableOrOptional[str] = None
+    """
+    Application ID of an active service principal. Setting this field requires the `servicePrincipal/user` role.
+    """
+
+    user_name: VariableOrOptional[str] = None
+    """
+    The email of an active workspace user. Can only set this field to their own email.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "AlertV2RunAsDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AlertV2RunAsDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AlertV2RunAsDict(TypedDict, total=False):
+    """"""
+
+    service_principal_name: VariableOrOptional[str]
+    """
+    Application ID of an active service principal. Setting this field requires the `servicePrincipal/user` role.
+    """
+
+    user_name: VariableOrOptional[str]
+    """
+    The email of an active workspace user. Can only set this field to their own email.
+    """
+
+
+AlertV2RunAsParam = AlertV2RunAsDict | AlertV2RunAs
diff --git a/python/databricks/bundles/alerts/_models/alert_v2_subscription.py b/python/databricks/bundles/alerts/_models/alert_v2_subscription.py
new file mode 100644
index 00000000000..8d379a1ced7
--- /dev/null
+++ b/python/databricks/bundles/alerts/_models/alert_v2_subscription.py
@@ -0,0 +1,38 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AlertV2Subscription:
+    """"""
+
+    destination_id: VariableOrOptional[str] = None
+
+    user_email: VariableOrOptional[str] = None
+
+    @classmethod
+    def from_dict(cls, value: "AlertV2SubscriptionDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AlertV2SubscriptionDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AlertV2SubscriptionDict(TypedDict, total=False):
+    """"""
+
+    destination_id: VariableOrOptional[str]
+
+    user_email: VariableOrOptional[str]
+
+
+AlertV2SubscriptionParam = AlertV2SubscriptionDict | AlertV2Subscription
diff --git a/python/databricks/bundles/alerts/_models/comparison_operator.py b/python/databricks/bundles/alerts/_models/comparison_operator.py
new file mode 100644
index 00000000000..95dc77260a0
--- /dev/null
+++ b/python/databricks/bundles/alerts/_models/comparison_operator.py
@@ -0,0 +1,30 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class ComparisonOperator(Enum):
+    LESS_THAN = "LESS_THAN"
+    GREATER_THAN = "GREATER_THAN"
+    EQUAL = "EQUAL"
+    NOT_EQUAL = "NOT_EQUAL"
+    GREATER_THAN_OR_EQUAL = "GREATER_THAN_OR_EQUAL"
+    LESS_THAN_OR_EQUAL = "LESS_THAN_OR_EQUAL"
+    IS_NULL = "IS_NULL"
+    IS_NOT_NULL = "IS_NOT_NULL"
+
+
+ComparisonOperatorParam = (
+    Literal[
+        "LESS_THAN",
+        "GREATER_THAN",
+        "EQUAL",
+        "NOT_EQUAL",
+        "GREATER_THAN_OR_EQUAL",
+        "LESS_THAN_OR_EQUAL",
+        "IS_NULL",
+        "IS_NOT_NULL",
+    ]
+    | ComparisonOperator
+)
diff --git a/python/databricks/bundles/alerts/_models/cron_schedule.py b/python/databricks/bundles/alerts/_models/cron_schedule.py
new file mode 100644
index 00000000000..987a9a1056b
--- /dev/null
+++ b/python/databricks/bundles/alerts/_models/cron_schedule.py
@@ -0,0 +1,70 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.alerts._models.schedule_pause_status import (
+    SchedulePauseStatus,
+    SchedulePauseStatusParam,
+)
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class CronSchedule:
+    """"""
+
+    quartz_cron_schedule: VariableOr[str]
+    """
+    A cron expression using quartz syntax that specifies the schedule for this pipeline.
+    Should use the quartz format described here: http://www.quartz-scheduler.org/documentation/quartz-2.1.7/tutorials/tutorial-lesson-06.html
+    """
+
+    timezone_id: VariableOr[str]
+    """
+    A Java timezone id. The schedule will be resolved using this timezone.
+    This will be combined with the quartz_cron_schedule to determine the schedule.
+    See https://docs.databricks.com/sql/language-manual/sql-ref-syntax-aux-conf-mgmt-set-timezone.html for details.
+    """
+
+    pause_status: VariableOrOptional[SchedulePauseStatus] = None
+    """
+    Indicate whether this schedule is paused or not.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "CronScheduleDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "CronScheduleDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class CronScheduleDict(TypedDict, total=False):
+    """"""
+
+    quartz_cron_schedule: VariableOr[str]
+    """
+    A cron expression using quartz syntax that specifies the schedule for this pipeline.
+    Should use the quartz format described here: http://www.quartz-scheduler.org/documentation/quartz-2.1.7/tutorials/tutorial-lesson-06.html
+    """
+
+    timezone_id: VariableOr[str]
+    """
+    A Java timezone id. The schedule will be resolved using this timezone.
+    This will be combined with the quartz_cron_schedule to determine the schedule.
+    See https://docs.databricks.com/sql/language-manual/sql-ref-syntax-aux-conf-mgmt-set-timezone.html for details.
+    """
+
+    pause_status: VariableOrOptional[SchedulePauseStatusParam]
+    """
+    Indicate whether this schedule is paused or not.
+    """
+
+
+CronScheduleParam = CronScheduleDict | CronSchedule
diff --git a/python/databricks/bundles/alerts/_models/custom_template_format.py b/python/databricks/bundles/alerts/_models/custom_template_format.py
new file mode 100644
index 00000000000..fbddaecfc0e
--- /dev/null
+++ b/python/databricks/bundles/alerts/_models/custom_template_format.py
@@ -0,0 +1,18 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class CustomTemplateFormat(Enum):
+    """
+    :meta private: [EXPERIMENTAL]
+
+    Rendering format for the `custom_summary` and `custom_description` templates.
+    """
+
+    HTML = "HTML"
+    MARKDOWN = "MARKDOWN"
+
+
+CustomTemplateFormatParam = Literal["HTML", "MARKDOWN"] | CustomTemplateFormat
diff --git a/python/databricks/bundles/alerts/_models/lifecycle.py b/python/databricks/bundles/alerts/_models/lifecycle.py
new file mode 100644
index 00000000000..697776a198e
--- /dev/null
+++ b/python/databricks/bundles/alerts/_models/lifecycle.py
@@ -0,0 +1,40 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class Lifecycle:
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool] = None
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "LifecycleDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "LifecycleDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class LifecycleDict(TypedDict, total=False):
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool]
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+
+LifecycleParam = LifecycleDict | Lifecycle
diff --git a/python/databricks/bundles/alerts/_models/permission.py b/python/databricks/bundles/alerts/_models/permission.py
new file mode 100644
index 00000000000..e4091c6d061
--- /dev/null
+++ b/python/databricks/bundles/alerts/_models/permission.py
@@ -0,0 +1,74 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.alerts._models.permission_level import (
+    PermissionLevel,
+    PermissionLevelParam,
+)
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class Permission:
+    """"""
+
+    level: VariableOr[PermissionLevel]
+    """
+    The permission level to apply. The allowed levels depend on the resource type.
+    """
+
+    group_name: VariableOrOptional[str] = None
+    """
+    The name of the group granted the permission level.
+    """
+
+    service_principal_name: VariableOrOptional[str] = None
+    """
+    The name of the service principal granted the permission level.
+    """
+
+    user_name: VariableOrOptional[str] = None
+    """
+    The name of the user granted the permission level.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "PermissionDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "PermissionDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class PermissionDict(TypedDict, total=False):
+    """"""
+
+    level: VariableOr[PermissionLevelParam]
+    """
+    The permission level to apply. The allowed levels depend on the resource type.
+    """
+
+    group_name: VariableOrOptional[str]
+    """
+    The name of the group granted the permission level.
+    """
+
+    service_principal_name: VariableOrOptional[str]
+    """
+    The name of the service principal granted the permission level.
+    """
+
+    user_name: VariableOrOptional[str]
+    """
+    The name of the user granted the permission level.
+    """
+
+
+PermissionParam = PermissionDict | Permission
diff --git a/python/databricks/bundles/alerts/_models/permission_level.py b/python/databricks/bundles/alerts/_models/permission_level.py
new file mode 100644
index 00000000000..c6111911b29
--- /dev/null
+++ b/python/databricks/bundles/alerts/_models/permission_level.py
@@ -0,0 +1,58 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class PermissionLevel(Enum):
+    """
+    Permission level
+    """
+
+    CAN_MANAGE = "CAN_MANAGE"
+    CAN_RESTART = "CAN_RESTART"
+    CAN_ATTACH_TO = "CAN_ATTACH_TO"
+    IS_OWNER = "IS_OWNER"
+    CAN_MANAGE_RUN = "CAN_MANAGE_RUN"
+    CAN_VIEW = "CAN_VIEW"
+    CAN_READ = "CAN_READ"
+    CAN_RUN = "CAN_RUN"
+    CAN_EDIT = "CAN_EDIT"
+    CAN_USE = "CAN_USE"
+    CAN_MANAGE_STAGING_VERSIONS = "CAN_MANAGE_STAGING_VERSIONS"
+    CAN_MANAGE_PRODUCTION_VERSIONS = "CAN_MANAGE_PRODUCTION_VERSIONS"
+    CAN_EDIT_METADATA = "CAN_EDIT_METADATA"
+    CAN_VIEW_METADATA = "CAN_VIEW_METADATA"
+    CAN_BIND = "CAN_BIND"
+    CAN_QUERY = "CAN_QUERY"
+    CAN_MONITOR = "CAN_MONITOR"
+    CAN_CREATE = "CAN_CREATE"
+    CAN_MONITOR_ONLY = "CAN_MONITOR_ONLY"
+    CAN_CREATE_APP = "CAN_CREATE_APP"
+
+
+PermissionLevelParam = (
+    Literal[
+        "CAN_MANAGE",
+        "CAN_RESTART",
+        "CAN_ATTACH_TO",
+        "IS_OWNER",
+        "CAN_MANAGE_RUN",
+        "CAN_VIEW",
+        "CAN_READ",
+        "CAN_RUN",
+        "CAN_EDIT",
+        "CAN_USE",
+        "CAN_MANAGE_STAGING_VERSIONS",
+        "CAN_MANAGE_PRODUCTION_VERSIONS",
+        "CAN_EDIT_METADATA",
+        "CAN_VIEW_METADATA",
+        "CAN_BIND",
+        "CAN_QUERY",
+        "CAN_MONITOR",
+        "CAN_CREATE",
+        "CAN_MONITOR_ONLY",
+        "CAN_CREATE_APP",
+    ]
+    | PermissionLevel
+)
diff --git a/python/databricks/bundles/alerts/_models/schedule_pause_status.py b/python/databricks/bundles/alerts/_models/schedule_pause_status.py
new file mode 100644
index 00000000000..ab05367f8c1
--- /dev/null
+++ b/python/databricks/bundles/alerts/_models/schedule_pause_status.py
@@ -0,0 +1,12 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class SchedulePauseStatus(Enum):
+    UNPAUSED = "UNPAUSED"
+    PAUSED = "PAUSED"
+
+
+SchedulePauseStatusParam = Literal["UNPAUSED", "PAUSED"] | SchedulePauseStatus
diff --git a/python/databricks/bundles/apps/__init__.py b/python/databricks/bundles/apps/__init__.py
new file mode 100644
index 00000000000..7b92e6d61bb
--- /dev/null
+++ b/python/databricks/bundles/apps/__init__.py
@@ -0,0 +1,237 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+__all__ = [
+    "App",
+    "AppConfig",
+    "AppConfigDict",
+    "AppConfigParam",
+    "AppDict",
+    "AppEnvVar",
+    "AppEnvVarDict",
+    "AppEnvVarParam",
+    "AppParam",
+    "AppPermission",
+    "AppPermissionDict",
+    "AppPermissionLevel",
+    "AppPermissionLevelParam",
+    "AppPermissionParam",
+    "AppResource",
+    "AppResourceApp",
+    "AppResourceAppAppPermission",
+    "AppResourceAppAppPermissionParam",
+    "AppResourceAppDict",
+    "AppResourceAppParam",
+    "AppResourceDatabase",
+    "AppResourceDatabaseDatabasePermission",
+    "AppResourceDatabaseDatabasePermissionParam",
+    "AppResourceDatabaseDict",
+    "AppResourceDatabaseParam",
+    "AppResourceDict",
+    "AppResourceExperiment",
+    "AppResourceExperimentDict",
+    "AppResourceExperimentExperimentPermission",
+    "AppResourceExperimentExperimentPermissionParam",
+    "AppResourceExperimentParam",
+    "AppResourceGenieSpace",
+    "AppResourceGenieSpaceDict",
+    "AppResourceGenieSpaceGenieSpacePermission",
+    "AppResourceGenieSpaceGenieSpacePermissionParam",
+    "AppResourceGenieSpaceParam",
+    "AppResourceJob",
+    "AppResourceJobDict",
+    "AppResourceJobJobPermission",
+    "AppResourceJobJobPermissionParam",
+    "AppResourceJobParam",
+    "AppResourceParam",
+    "AppResourcePostgres",
+    "AppResourcePostgresDict",
+    "AppResourcePostgresParam",
+    "AppResourcePostgresPostgresPermission",
+    "AppResourcePostgresPostgresPermissionParam",
+    "AppResourceSecret",
+    "AppResourceSecretDict",
+    "AppResourceSecretParam",
+    "AppResourceSecretSecretPermission",
+    "AppResourceSecretSecretPermissionParam",
+    "AppResourceServingEndpoint",
+    "AppResourceServingEndpointDict",
+    "AppResourceServingEndpointParam",
+    "AppResourceServingEndpointServingEndpointPermission",
+    "AppResourceServingEndpointServingEndpointPermissionParam",
+    "AppResourceSqlWarehouse",
+    "AppResourceSqlWarehouseDict",
+    "AppResourceSqlWarehouseParam",
+    "AppResourceSqlWarehouseSqlWarehousePermission",
+    "AppResourceSqlWarehouseSqlWarehousePermissionParam",
+    "AppResourceUcSecurable",
+    "AppResourceUcSecurableDict",
+    "AppResourceUcSecurableParam",
+    "AppResourceUcSecurableUcSecurablePermission",
+    "AppResourceUcSecurableUcSecurablePermissionParam",
+    "AppResourceUcSecurableUcSecurableType",
+    "AppResourceUcSecurableUcSecurableTypeParam",
+    "ComputeSize",
+    "ComputeSizeParam",
+    "GitRepository",
+    "GitRepositoryDict",
+    "GitRepositoryParam",
+    "GitSource",
+    "GitSourceDict",
+    "GitSourceParam",
+    "LifecycleWithStarted",
+    "LifecycleWithStartedDict",
+    "LifecycleWithStartedParam",
+    "TelemetryExportDestination",
+    "TelemetryExportDestinationDict",
+    "TelemetryExportDestinationParam",
+    "UnityCatalog",
+    "UnityCatalogDict",
+    "UnityCatalogParam",
+]
+
+
+from databricks.bundles.apps._models.app import App, AppDict, AppParam
+from databricks.bundles.apps._models.app_config import (
+    AppConfig,
+    AppConfigDict,
+    AppConfigParam,
+)
+from databricks.bundles.apps._models.app_env_var import (
+    AppEnvVar,
+    AppEnvVarDict,
+    AppEnvVarParam,
+)
+from databricks.bundles.apps._models.app_permission import (
+    AppPermission,
+    AppPermissionDict,
+    AppPermissionParam,
+)
+from databricks.bundles.apps._models.app_permission_level import (
+    AppPermissionLevel,
+    AppPermissionLevelParam,
+)
+from databricks.bundles.apps._models.app_resource import (
+    AppResource,
+    AppResourceDict,
+    AppResourceParam,
+)
+from databricks.bundles.apps._models.app_resource_app import (
+    AppResourceApp,
+    AppResourceAppDict,
+    AppResourceAppParam,
+)
+from databricks.bundles.apps._models.app_resource_app_app_permission import (
+    AppResourceAppAppPermission,
+    AppResourceAppAppPermissionParam,
+)
+from databricks.bundles.apps._models.app_resource_database import (
+    AppResourceDatabase,
+    AppResourceDatabaseDict,
+    AppResourceDatabaseParam,
+)
+from databricks.bundles.apps._models.app_resource_database_database_permission import (
+    AppResourceDatabaseDatabasePermission,
+    AppResourceDatabaseDatabasePermissionParam,
+)
+from databricks.bundles.apps._models.app_resource_experiment import (
+    AppResourceExperiment,
+    AppResourceExperimentDict,
+    AppResourceExperimentParam,
+)
+from databricks.bundles.apps._models.app_resource_experiment_experiment_permission import (
+    AppResourceExperimentExperimentPermission,
+    AppResourceExperimentExperimentPermissionParam,
+)
+from databricks.bundles.apps._models.app_resource_genie_space import (
+    AppResourceGenieSpace,
+    AppResourceGenieSpaceDict,
+    AppResourceGenieSpaceParam,
+)
+from databricks.bundles.apps._models.app_resource_genie_space_genie_space_permission import (
+    AppResourceGenieSpaceGenieSpacePermission,
+    AppResourceGenieSpaceGenieSpacePermissionParam,
+)
+from databricks.bundles.apps._models.app_resource_job import (
+    AppResourceJob,
+    AppResourceJobDict,
+    AppResourceJobParam,
+)
+from databricks.bundles.apps._models.app_resource_job_job_permission import (
+    AppResourceJobJobPermission,
+    AppResourceJobJobPermissionParam,
+)
+from databricks.bundles.apps._models.app_resource_postgres import (
+    AppResourcePostgres,
+    AppResourcePostgresDict,
+    AppResourcePostgresParam,
+)
+from databricks.bundles.apps._models.app_resource_postgres_postgres_permission import (
+    AppResourcePostgresPostgresPermission,
+    AppResourcePostgresPostgresPermissionParam,
+)
+from databricks.bundles.apps._models.app_resource_secret import (
+    AppResourceSecret,
+    AppResourceSecretDict,
+    AppResourceSecretParam,
+)
+from databricks.bundles.apps._models.app_resource_secret_secret_permission import (
+    AppResourceSecretSecretPermission,
+    AppResourceSecretSecretPermissionParam,
+)
+from databricks.bundles.apps._models.app_resource_serving_endpoint import (
+    AppResourceServingEndpoint,
+    AppResourceServingEndpointDict,
+    AppResourceServingEndpointParam,
+)
+from databricks.bundles.apps._models.app_resource_serving_endpoint_serving_endpoint_permission import (
+    AppResourceServingEndpointServingEndpointPermission,
+    AppResourceServingEndpointServingEndpointPermissionParam,
+)
+from databricks.bundles.apps._models.app_resource_sql_warehouse import (
+    AppResourceSqlWarehouse,
+    AppResourceSqlWarehouseDict,
+    AppResourceSqlWarehouseParam,
+)
+from databricks.bundles.apps._models.app_resource_sql_warehouse_sql_warehouse_permission import (
+    AppResourceSqlWarehouseSqlWarehousePermission,
+    AppResourceSqlWarehouseSqlWarehousePermissionParam,
+)
+from databricks.bundles.apps._models.app_resource_uc_securable import (
+    AppResourceUcSecurable,
+    AppResourceUcSecurableDict,
+    AppResourceUcSecurableParam,
+)
+from databricks.bundles.apps._models.app_resource_uc_securable_uc_securable_permission import (
+    AppResourceUcSecurableUcSecurablePermission,
+    AppResourceUcSecurableUcSecurablePermissionParam,
+)
+from databricks.bundles.apps._models.app_resource_uc_securable_uc_securable_type import (
+    AppResourceUcSecurableUcSecurableType,
+    AppResourceUcSecurableUcSecurableTypeParam,
+)
+from databricks.bundles.apps._models.compute_size import ComputeSize, ComputeSizeParam
+from databricks.bundles.apps._models.git_repository import (
+    GitRepository,
+    GitRepositoryDict,
+    GitRepositoryParam,
+)
+from databricks.bundles.apps._models.git_source import (
+    GitSource,
+    GitSourceDict,
+    GitSourceParam,
+)
+from databricks.bundles.apps._models.lifecycle_with_started import (
+    LifecycleWithStarted,
+    LifecycleWithStartedDict,
+    LifecycleWithStartedParam,
+)
+from databricks.bundles.apps._models.telemetry_export_destination import (
+    TelemetryExportDestination,
+    TelemetryExportDestinationDict,
+    TelemetryExportDestinationParam,
+)
+from databricks.bundles.apps._models.unity_catalog import (
+    UnityCatalog,
+    UnityCatalogDict,
+    UnityCatalogParam,
+)
diff --git a/python/databricks/bundles/apps/_models/app.py b/python/databricks/bundles/apps/_models/app.py
new file mode 100644
index 00000000000..533172ae6b2
--- /dev/null
+++ b/python/databricks/bundles/apps/_models/app.py
@@ -0,0 +1,232 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.apps._models.app_config import (
+    AppConfig,
+    AppConfigParam,
+)
+from databricks.bundles.apps._models.app_permission import (
+    AppPermission,
+    AppPermissionParam,
+)
+from databricks.bundles.apps._models.app_resource import AppResource, AppResourceParam
+from databricks.bundles.apps._models.compute_size import ComputeSize, ComputeSizeParam
+from databricks.bundles.apps._models.git_repository import (
+    GitRepository,
+    GitRepositoryParam,
+)
+from databricks.bundles.apps._models.git_source import GitSource, GitSourceParam
+from databricks.bundles.apps._models.lifecycle_with_started import (
+    LifecycleWithStarted,
+    LifecycleWithStartedParam,
+)
+from databricks.bundles.apps._models.telemetry_export_destination import (
+    TelemetryExportDestination,
+    TelemetryExportDestinationParam,
+)
+from databricks.bundles.core._resource import Resource
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import (
+    VariableOr,
+    VariableOrList,
+    VariableOrOptional,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class App(Resource):
+    """"""
+
+    name: VariableOr[str]
+    """
+    The name of the app. The name must contain only lowercase alphanumeric characters and hyphens.
+    It must be unique within the workspace.
+    """
+
+    budget_policy_id: VariableOrOptional[str] = None
+    """
+    [Public Preview]
+    """
+
+    compute_max_instances: VariableOrOptional[int] = None
+    """
+    Maximum number of app instances the app is configured to run. Must be set together with `compute_min_instances`.
+    """
+
+    compute_min_instances: VariableOrOptional[int] = None
+    """
+    Minimum number of app instances the app is configured to run. Must be set together with `compute_max_instances`.
+    """
+
+    compute_size: VariableOrOptional[ComputeSize] = None
+
+    config: VariableOrOptional[AppConfig] = None
+
+    description: VariableOrOptional[str] = None
+    """
+    The description of the app.
+    """
+
+    forward_user_access_token: VariableOrOptional[bool] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Forward the user's access token to the app. Requires stopping and starting app compute to take effect.
+    """
+
+    git_repository: VariableOrOptional[GitRepository] = None
+    """
+    Git repository configuration for app deployments. When specified, deployments can
+    reference code from this repository by providing only the git reference (branch, tag, or commit).
+    """
+
+    git_source: VariableOrOptional[GitSource] = None
+    """
+    Git source configuration for app deployments. Specifies which git reference (branch, tag, or commit)
+    to use when deploying the app. Used in conjunction with git_repository to deploy code directly from git.
+    The source_code_path within git_source specifies the relative path to the app code within the repository.
+    """
+
+    lifecycle: VariableOrOptional[LifecycleWithStarted] = None
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+    permissions: VariableOrList[AppPermission] = field(default_factory=list)
+    """
+    The permissions to apply to this resource.
+    """
+
+    resources: VariableOrList[AppResource] = field(default_factory=list)
+    """
+    Resources for the app.
+    """
+
+    source_code_path: VariableOrOptional[str] = None
+
+    space: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Name of the space this app belongs to.
+    """
+
+    telemetry_export_destinations: VariableOrList[TelemetryExportDestination] = field(
+        default_factory=list
+    )
+
+    usage_policy_id: VariableOrOptional[str] = None
+    """
+    [Public Preview]
+    """
+
+    user_api_scopes: VariableOrList[str] = field(default_factory=list)
+    """
+    [Public Preview]
+    """
+
+    @classmethod
+    def from_dict(cls, value: "AppDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AppDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AppDict(TypedDict, total=False):
+    """"""
+
+    name: VariableOr[str]
+    """
+    The name of the app. The name must contain only lowercase alphanumeric characters and hyphens.
+    It must be unique within the workspace.
+    """
+
+    budget_policy_id: VariableOrOptional[str]
+    """
+    [Public Preview]
+    """
+
+    compute_max_instances: VariableOrOptional[int]
+    """
+    Maximum number of app instances the app is configured to run. Must be set together with `compute_min_instances`.
+    """
+
+    compute_min_instances: VariableOrOptional[int]
+    """
+    Minimum number of app instances the app is configured to run. Must be set together with `compute_max_instances`.
+    """
+
+    compute_size: VariableOrOptional[ComputeSizeParam]
+
+    config: VariableOrOptional[AppConfigParam]
+
+    description: VariableOrOptional[str]
+    """
+    The description of the app.
+    """
+
+    forward_user_access_token: VariableOrOptional[bool]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Forward the user's access token to the app. Requires stopping and starting app compute to take effect.
+    """
+
+    git_repository: VariableOrOptional[GitRepositoryParam]
+    """
+    Git repository configuration for app deployments. When specified, deployments can
+    reference code from this repository by providing only the git reference (branch, tag, or commit).
+    """
+
+    git_source: VariableOrOptional[GitSourceParam]
+    """
+    Git source configuration for app deployments. Specifies which git reference (branch, tag, or commit)
+    to use when deploying the app. Used in conjunction with git_repository to deploy code directly from git.
+    The source_code_path within git_source specifies the relative path to the app code within the repository.
+    """
+
+    lifecycle: VariableOrOptional[LifecycleWithStartedParam]
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+    permissions: VariableOrList[AppPermissionParam]
+    """
+    The permissions to apply to this resource.
+    """
+
+    resources: VariableOrList[AppResourceParam]
+    """
+    Resources for the app.
+    """
+
+    source_code_path: VariableOrOptional[str]
+
+    space: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Name of the space this app belongs to.
+    """
+
+    telemetry_export_destinations: VariableOrList[TelemetryExportDestinationParam]
+
+    usage_policy_id: VariableOrOptional[str]
+    """
+    [Public Preview]
+    """
+
+    user_api_scopes: VariableOrList[str]
+    """
+    [Public Preview]
+    """
+
+
+AppParam = AppDict | App
diff --git a/python/databricks/bundles/apps/_models/app_config.py b/python/databricks/bundles/apps/_models/app_config.py
new file mode 100644
index 00000000000..e8a8f5fd70e
--- /dev/null
+++ b/python/databricks/bundles/apps/_models/app_config.py
@@ -0,0 +1,39 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.apps._models.app_env_var import AppEnvVar, AppEnvVarParam
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AppConfig:
+    """"""
+
+    command: VariableOrList[str] = field(default_factory=list)
+
+    env: VariableOrList[AppEnvVar] = field(default_factory=list)
+
+    @classmethod
+    def from_dict(cls, value: "AppConfigDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AppConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AppConfigDict(TypedDict, total=False):
+    """"""
+
+    command: VariableOrList[str]
+
+    env: VariableOrList[AppEnvVarParam]
+
+
+AppConfigParam = AppConfigDict | AppConfig
diff --git a/python/databricks/bundles/apps/_models/app_env_var.py b/python/databricks/bundles/apps/_models/app_env_var.py
new file mode 100644
index 00000000000..a0afec4223a
--- /dev/null
+++ b/python/databricks/bundles/apps/_models/app_env_var.py
@@ -0,0 +1,42 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AppEnvVar:
+    """"""
+
+    name: VariableOr[str]
+
+    value: VariableOrOptional[str] = None
+
+    value_from: VariableOrOptional[str] = None
+
+    @classmethod
+    def from_dict(cls, value: "AppEnvVarDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AppEnvVarDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AppEnvVarDict(TypedDict, total=False):
+    """"""
+
+    name: VariableOr[str]
+
+    value: VariableOrOptional[str]
+
+    value_from: VariableOrOptional[str]
+
+
+AppEnvVarParam = AppEnvVarDict | AppEnvVar
diff --git a/python/databricks/bundles/apps/_models/app_permission.py b/python/databricks/bundles/apps/_models/app_permission.py
new file mode 100644
index 00000000000..f04638d0df2
--- /dev/null
+++ b/python/databricks/bundles/apps/_models/app_permission.py
@@ -0,0 +1,74 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.apps._models.app_permission_level import (
+    AppPermissionLevel,
+    AppPermissionLevelParam,
+)
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AppPermission:
+    """"""
+
+    level: VariableOr[AppPermissionLevel]
+    """
+    The permission level to apply. The allowed levels depend on the resource type.
+    """
+
+    group_name: VariableOrOptional[str] = None
+    """
+    The name of the group granted the permission level.
+    """
+
+    service_principal_name: VariableOrOptional[str] = None
+    """
+    The name of the service principal granted the permission level.
+    """
+
+    user_name: VariableOrOptional[str] = None
+    """
+    The name of the user granted the permission level.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "AppPermissionDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AppPermissionDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AppPermissionDict(TypedDict, total=False):
+    """"""
+
+    level: VariableOr[AppPermissionLevelParam]
+    """
+    The permission level to apply. The allowed levels depend on the resource type.
+    """
+
+    group_name: VariableOrOptional[str]
+    """
+    The name of the group granted the permission level.
+    """
+
+    service_principal_name: VariableOrOptional[str]
+    """
+    The name of the service principal granted the permission level.
+    """
+
+    user_name: VariableOrOptional[str]
+    """
+    The name of the user granted the permission level.
+    """
+
+
+AppPermissionParam = AppPermissionDict | AppPermission
diff --git a/python/databricks/bundles/apps/_models/app_permission_level.py b/python/databricks/bundles/apps/_models/app_permission_level.py
new file mode 100644
index 00000000000..a951c137ea7
--- /dev/null
+++ b/python/databricks/bundles/apps/_models/app_permission_level.py
@@ -0,0 +1,16 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class AppPermissionLevel(Enum):
+    """
+    Permission level
+    """
+
+    CAN_MANAGE = "CAN_MANAGE"
+    CAN_USE = "CAN_USE"
+
+
+AppPermissionLevelParam = Literal["CAN_MANAGE", "CAN_USE"] | AppPermissionLevel
diff --git a/python/databricks/bundles/apps/_models/app_resource.py b/python/databricks/bundles/apps/_models/app_resource.py
new file mode 100644
index 00000000000..cc96b083c2c
--- /dev/null
+++ b/python/databricks/bundles/apps/_models/app_resource.py
@@ -0,0 +1,130 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.apps._models.app_resource_app import (
+    AppResourceApp,
+    AppResourceAppParam,
+)
+from databricks.bundles.apps._models.app_resource_database import (
+    AppResourceDatabase,
+    AppResourceDatabaseParam,
+)
+from databricks.bundles.apps._models.app_resource_experiment import (
+    AppResourceExperiment,
+    AppResourceExperimentParam,
+)
+from databricks.bundles.apps._models.app_resource_genie_space import (
+    AppResourceGenieSpace,
+    AppResourceGenieSpaceParam,
+)
+from databricks.bundles.apps._models.app_resource_job import (
+    AppResourceJob,
+    AppResourceJobParam,
+)
+from databricks.bundles.apps._models.app_resource_postgres import (
+    AppResourcePostgres,
+    AppResourcePostgresParam,
+)
+from databricks.bundles.apps._models.app_resource_secret import (
+    AppResourceSecret,
+    AppResourceSecretParam,
+)
+from databricks.bundles.apps._models.app_resource_serving_endpoint import (
+    AppResourceServingEndpoint,
+    AppResourceServingEndpointParam,
+)
+from databricks.bundles.apps._models.app_resource_sql_warehouse import (
+    AppResourceSqlWarehouse,
+    AppResourceSqlWarehouseParam,
+)
+from databricks.bundles.apps._models.app_resource_uc_securable import (
+    AppResourceUcSecurable,
+    AppResourceUcSecurableParam,
+)
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AppResource:
+    """"""
+
+    name: VariableOr[str]
+    """
+    Name of the App Resource.
+    """
+
+    app: VariableOrOptional[AppResourceApp] = None
+
+    database: VariableOrOptional[AppResourceDatabase] = None
+
+    description: VariableOrOptional[str] = None
+    """
+    Description of the App Resource.
+    """
+
+    experiment: VariableOrOptional[AppResourceExperiment] = None
+
+    genie_space: VariableOrOptional[AppResourceGenieSpace] = None
+
+    job: VariableOrOptional[AppResourceJob] = None
+
+    postgres: VariableOrOptional[AppResourcePostgres] = None
+
+    secret: VariableOrOptional[AppResourceSecret] = None
+
+    serving_endpoint: VariableOrOptional[AppResourceServingEndpoint] = None
+
+    sql_warehouse: VariableOrOptional[AppResourceSqlWarehouse] = None
+
+    uc_securable: VariableOrOptional[AppResourceUcSecurable] = None
+
+    @classmethod
+    def from_dict(cls, value: "AppResourceDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AppResourceDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AppResourceDict(TypedDict, total=False):
+    """"""
+
+    name: VariableOr[str]
+    """
+    Name of the App Resource.
+    """
+
+    app: VariableOrOptional[AppResourceAppParam]
+
+    database: VariableOrOptional[AppResourceDatabaseParam]
+
+    description: VariableOrOptional[str]
+    """
+    Description of the App Resource.
+    """
+
+    experiment: VariableOrOptional[AppResourceExperimentParam]
+
+    genie_space: VariableOrOptional[AppResourceGenieSpaceParam]
+
+    job: VariableOrOptional[AppResourceJobParam]
+
+    postgres: VariableOrOptional[AppResourcePostgresParam]
+
+    secret: VariableOrOptional[AppResourceSecretParam]
+
+    serving_endpoint: VariableOrOptional[AppResourceServingEndpointParam]
+
+    sql_warehouse: VariableOrOptional[AppResourceSqlWarehouseParam]
+
+    uc_securable: VariableOrOptional[AppResourceUcSecurableParam]
+
+
+AppResourceParam = AppResourceDict | AppResource
diff --git a/python/databricks/bundles/apps/_models/app_resource_app.py b/python/databricks/bundles/apps/_models/app_resource_app.py
new file mode 100644
index 00000000000..a7a05689c2e
--- /dev/null
+++ b/python/databricks/bundles/apps/_models/app_resource_app.py
@@ -0,0 +1,42 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.apps._models.app_resource_app_app_permission import (
+    AppResourceAppAppPermission,
+    AppResourceAppAppPermissionParam,
+)
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AppResourceApp:
+    """"""
+
+    name: VariableOrOptional[str] = None
+
+    permission: VariableOrOptional[AppResourceAppAppPermission] = None
+
+    @classmethod
+    def from_dict(cls, value: "AppResourceAppDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AppResourceAppDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AppResourceAppDict(TypedDict, total=False):
+    """"""
+
+    name: VariableOrOptional[str]
+
+    permission: VariableOrOptional[AppResourceAppAppPermissionParam]
+
+
+AppResourceAppParam = AppResourceAppDict | AppResourceApp
diff --git a/python/databricks/bundles/apps/_models/app_resource_app_app_permission.py b/python/databricks/bundles/apps/_models/app_resource_app_app_permission.py
new file mode 100644
index 00000000000..a58dca414e4
--- /dev/null
+++ b/python/databricks/bundles/apps/_models/app_resource_app_app_permission.py
@@ -0,0 +1,11 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class AppResourceAppAppPermission(Enum):
+    CAN_USE = "CAN_USE"
+
+
+AppResourceAppAppPermissionParam = Literal["CAN_USE"] | AppResourceAppAppPermission
diff --git a/python/databricks/bundles/apps/_models/app_resource_database.py b/python/databricks/bundles/apps/_models/app_resource_database.py
new file mode 100644
index 00000000000..b29ce973105
--- /dev/null
+++ b/python/databricks/bundles/apps/_models/app_resource_database.py
@@ -0,0 +1,46 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.apps._models.app_resource_database_database_permission import (
+    AppResourceDatabaseDatabasePermission,
+    AppResourceDatabaseDatabasePermissionParam,
+)
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AppResourceDatabase:
+    """"""
+
+    database_name: VariableOr[str]
+
+    instance_name: VariableOr[str]
+
+    permission: VariableOr[AppResourceDatabaseDatabasePermission]
+
+    @classmethod
+    def from_dict(cls, value: "AppResourceDatabaseDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AppResourceDatabaseDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AppResourceDatabaseDict(TypedDict, total=False):
+    """"""
+
+    database_name: VariableOr[str]
+
+    instance_name: VariableOr[str]
+
+    permission: VariableOr[AppResourceDatabaseDatabasePermissionParam]
+
+
+AppResourceDatabaseParam = AppResourceDatabaseDict | AppResourceDatabase
diff --git a/python/databricks/bundles/apps/_models/app_resource_database_database_permission.py b/python/databricks/bundles/apps/_models/app_resource_database_database_permission.py
new file mode 100644
index 00000000000..447d015a1c2
--- /dev/null
+++ b/python/databricks/bundles/apps/_models/app_resource_database_database_permission.py
@@ -0,0 +1,13 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class AppResourceDatabaseDatabasePermission(Enum):
+    CAN_CONNECT_AND_CREATE = "CAN_CONNECT_AND_CREATE"
+
+
+AppResourceDatabaseDatabasePermissionParam = (
+    Literal["CAN_CONNECT_AND_CREATE"] | AppResourceDatabaseDatabasePermission
+)
diff --git a/python/databricks/bundles/apps/_models/app_resource_experiment.py b/python/databricks/bundles/apps/_models/app_resource_experiment.py
new file mode 100644
index 00000000000..e69d4be1a17
--- /dev/null
+++ b/python/databricks/bundles/apps/_models/app_resource_experiment.py
@@ -0,0 +1,42 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.apps._models.app_resource_experiment_experiment_permission import (
+    AppResourceExperimentExperimentPermission,
+    AppResourceExperimentExperimentPermissionParam,
+)
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AppResourceExperiment:
+    """"""
+
+    experiment_id: VariableOr[str]
+
+    permission: VariableOr[AppResourceExperimentExperimentPermission]
+
+    @classmethod
+    def from_dict(cls, value: "AppResourceExperimentDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AppResourceExperimentDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AppResourceExperimentDict(TypedDict, total=False):
+    """"""
+
+    experiment_id: VariableOr[str]
+
+    permission: VariableOr[AppResourceExperimentExperimentPermissionParam]
+
+
+AppResourceExperimentParam = AppResourceExperimentDict | AppResourceExperiment
diff --git a/python/databricks/bundles/apps/_models/app_resource_experiment_experiment_permission.py b/python/databricks/bundles/apps/_models/app_resource_experiment_experiment_permission.py
new file mode 100644
index 00000000000..230b8d5c06e
--- /dev/null
+++ b/python/databricks/bundles/apps/_models/app_resource_experiment_experiment_permission.py
@@ -0,0 +1,16 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class AppResourceExperimentExperimentPermission(Enum):
+    CAN_MANAGE = "CAN_MANAGE"
+    CAN_EDIT = "CAN_EDIT"
+    CAN_READ = "CAN_READ"
+
+
+AppResourceExperimentExperimentPermissionParam = (
+    Literal["CAN_MANAGE", "CAN_EDIT", "CAN_READ"]
+    | AppResourceExperimentExperimentPermission
+)
diff --git a/python/databricks/bundles/apps/_models/app_resource_genie_space.py b/python/databricks/bundles/apps/_models/app_resource_genie_space.py
new file mode 100644
index 00000000000..0cfdaf316f4
--- /dev/null
+++ b/python/databricks/bundles/apps/_models/app_resource_genie_space.py
@@ -0,0 +1,46 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.apps._models.app_resource_genie_space_genie_space_permission import (
+    AppResourceGenieSpaceGenieSpacePermission,
+    AppResourceGenieSpaceGenieSpacePermissionParam,
+)
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AppResourceGenieSpace:
+    """"""
+
+    name: VariableOr[str]
+
+    permission: VariableOr[AppResourceGenieSpaceGenieSpacePermission]
+
+    space_id: VariableOr[str]
+
+    @classmethod
+    def from_dict(cls, value: "AppResourceGenieSpaceDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AppResourceGenieSpaceDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AppResourceGenieSpaceDict(TypedDict, total=False):
+    """"""
+
+    name: VariableOr[str]
+
+    permission: VariableOr[AppResourceGenieSpaceGenieSpacePermissionParam]
+
+    space_id: VariableOr[str]
+
+
+AppResourceGenieSpaceParam = AppResourceGenieSpaceDict | AppResourceGenieSpace
diff --git a/python/databricks/bundles/apps/_models/app_resource_genie_space_genie_space_permission.py b/python/databricks/bundles/apps/_models/app_resource_genie_space_genie_space_permission.py
new file mode 100644
index 00000000000..312897a8cce
--- /dev/null
+++ b/python/databricks/bundles/apps/_models/app_resource_genie_space_genie_space_permission.py
@@ -0,0 +1,17 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class AppResourceGenieSpaceGenieSpacePermission(Enum):
+    CAN_MANAGE = "CAN_MANAGE"
+    CAN_EDIT = "CAN_EDIT"
+    CAN_RUN = "CAN_RUN"
+    CAN_VIEW = "CAN_VIEW"
+
+
+AppResourceGenieSpaceGenieSpacePermissionParam = (
+    Literal["CAN_MANAGE", "CAN_EDIT", "CAN_RUN", "CAN_VIEW"]
+    | AppResourceGenieSpaceGenieSpacePermission
+)
diff --git a/python/databricks/bundles/apps/_models/app_resource_job.py b/python/databricks/bundles/apps/_models/app_resource_job.py
new file mode 100644
index 00000000000..08ca1be6cfc
--- /dev/null
+++ b/python/databricks/bundles/apps/_models/app_resource_job.py
@@ -0,0 +1,54 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.apps._models.app_resource_job_job_permission import (
+    AppResourceJobJobPermission,
+    AppResourceJobJobPermissionParam,
+)
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AppResourceJob:
+    """"""
+
+    id: VariableOr[str]
+    """
+    Id of the job to grant permission on.
+    """
+
+    permission: VariableOr[AppResourceJobJobPermission]
+    """
+    Permissions to grant on the Job. Supported permissions are: "CAN_MANAGE", "IS_OWNER", "CAN_MANAGE_RUN", "CAN_VIEW".
+    """
+
+    @classmethod
+    def from_dict(cls, value: "AppResourceJobDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AppResourceJobDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AppResourceJobDict(TypedDict, total=False):
+    """"""
+
+    id: VariableOr[str]
+    """
+    Id of the job to grant permission on.
+    """
+
+    permission: VariableOr[AppResourceJobJobPermissionParam]
+    """
+    Permissions to grant on the Job. Supported permissions are: "CAN_MANAGE", "IS_OWNER", "CAN_MANAGE_RUN", "CAN_VIEW".
+    """
+
+
+AppResourceJobParam = AppResourceJobDict | AppResourceJob
diff --git a/python/databricks/bundles/apps/_models/app_resource_job_job_permission.py b/python/databricks/bundles/apps/_models/app_resource_job_job_permission.py
new file mode 100644
index 00000000000..29f08d0aab1
--- /dev/null
+++ b/python/databricks/bundles/apps/_models/app_resource_job_job_permission.py
@@ -0,0 +1,17 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class AppResourceJobJobPermission(Enum):
+    CAN_MANAGE = "CAN_MANAGE"
+    IS_OWNER = "IS_OWNER"
+    CAN_MANAGE_RUN = "CAN_MANAGE_RUN"
+    CAN_VIEW = "CAN_VIEW"
+
+
+AppResourceJobJobPermissionParam = (
+    Literal["CAN_MANAGE", "IS_OWNER", "CAN_MANAGE_RUN", "CAN_VIEW"]
+    | AppResourceJobJobPermission
+)
diff --git a/python/databricks/bundles/apps/_models/app_resource_postgres.py b/python/databricks/bundles/apps/_models/app_resource_postgres.py
new file mode 100644
index 00000000000..0d3b6e39b17
--- /dev/null
+++ b/python/databricks/bundles/apps/_models/app_resource_postgres.py
@@ -0,0 +1,46 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.apps._models.app_resource_postgres_postgres_permission import (
+    AppResourcePostgresPostgresPermission,
+    AppResourcePostgresPostgresPermissionParam,
+)
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AppResourcePostgres:
+    """"""
+
+    branch: VariableOrOptional[str] = None
+
+    database: VariableOrOptional[str] = None
+
+    permission: VariableOrOptional[AppResourcePostgresPostgresPermission] = None
+
+    @classmethod
+    def from_dict(cls, value: "AppResourcePostgresDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AppResourcePostgresDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AppResourcePostgresDict(TypedDict, total=False):
+    """"""
+
+    branch: VariableOrOptional[str]
+
+    database: VariableOrOptional[str]
+
+    permission: VariableOrOptional[AppResourcePostgresPostgresPermissionParam]
+
+
+AppResourcePostgresParam = AppResourcePostgresDict | AppResourcePostgres
diff --git a/python/databricks/bundles/apps/_models/app_resource_postgres_postgres_permission.py b/python/databricks/bundles/apps/_models/app_resource_postgres_postgres_permission.py
new file mode 100644
index 00000000000..85657edfc35
--- /dev/null
+++ b/python/databricks/bundles/apps/_models/app_resource_postgres_postgres_permission.py
@@ -0,0 +1,13 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class AppResourcePostgresPostgresPermission(Enum):
+    CAN_CONNECT_AND_CREATE = "CAN_CONNECT_AND_CREATE"
+
+
+AppResourcePostgresPostgresPermissionParam = (
+    Literal["CAN_CONNECT_AND_CREATE"] | AppResourcePostgresPostgresPermission
+)
diff --git a/python/databricks/bundles/apps/_models/app_resource_secret.py b/python/databricks/bundles/apps/_models/app_resource_secret.py
new file mode 100644
index 00000000000..3ecca5e2199
--- /dev/null
+++ b/python/databricks/bundles/apps/_models/app_resource_secret.py
@@ -0,0 +1,64 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.apps._models.app_resource_secret_secret_permission import (
+    AppResourceSecretSecretPermission,
+    AppResourceSecretSecretPermissionParam,
+)
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AppResourceSecret:
+    """"""
+
+    key: VariableOr[str]
+    """
+    Key of the secret to grant permission on.
+    """
+
+    permission: VariableOr[AppResourceSecretSecretPermission]
+    """
+    Permission to grant on the secret scope. For secrets, only one permission is allowed. Permission must be one of: "READ", "WRITE", "MANAGE".
+    """
+
+    scope: VariableOr[str]
+    """
+    Scope of the secret to grant permission on.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "AppResourceSecretDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AppResourceSecretDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AppResourceSecretDict(TypedDict, total=False):
+    """"""
+
+    key: VariableOr[str]
+    """
+    Key of the secret to grant permission on.
+    """
+
+    permission: VariableOr[AppResourceSecretSecretPermissionParam]
+    """
+    Permission to grant on the secret scope. For secrets, only one permission is allowed. Permission must be one of: "READ", "WRITE", "MANAGE".
+    """
+
+    scope: VariableOr[str]
+    """
+    Scope of the secret to grant permission on.
+    """
+
+
+AppResourceSecretParam = AppResourceSecretDict | AppResourceSecret
diff --git a/python/databricks/bundles/apps/_models/app_resource_secret_secret_permission.py b/python/databricks/bundles/apps/_models/app_resource_secret_secret_permission.py
new file mode 100644
index 00000000000..c30b6d977ff
--- /dev/null
+++ b/python/databricks/bundles/apps/_models/app_resource_secret_secret_permission.py
@@ -0,0 +1,19 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class AppResourceSecretSecretPermission(Enum):
+    """
+    Permission to grant on the secret scope. Supported permissions are: "READ", "WRITE", "MANAGE".
+    """
+
+    READ = "READ"
+    WRITE = "WRITE"
+    MANAGE = "MANAGE"
+
+
+AppResourceSecretSecretPermissionParam = (
+    Literal["READ", "WRITE", "MANAGE"] | AppResourceSecretSecretPermission
+)
diff --git a/python/databricks/bundles/apps/_models/app_resource_serving_endpoint.py b/python/databricks/bundles/apps/_models/app_resource_serving_endpoint.py
new file mode 100644
index 00000000000..ee444cd7692
--- /dev/null
+++ b/python/databricks/bundles/apps/_models/app_resource_serving_endpoint.py
@@ -0,0 +1,56 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.apps._models.app_resource_serving_endpoint_serving_endpoint_permission import (
+    AppResourceServingEndpointServingEndpointPermission,
+    AppResourceServingEndpointServingEndpointPermissionParam,
+)
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AppResourceServingEndpoint:
+    """"""
+
+    name: VariableOr[str]
+    """
+    Name of the serving endpoint to grant permission on.
+    """
+
+    permission: VariableOr[AppResourceServingEndpointServingEndpointPermission]
+    """
+    Permission to grant on the serving endpoint. Supported permissions are: "CAN_MANAGE", "CAN_QUERY", "CAN_VIEW".
+    """
+
+    @classmethod
+    def from_dict(cls, value: "AppResourceServingEndpointDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AppResourceServingEndpointDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AppResourceServingEndpointDict(TypedDict, total=False):
+    """"""
+
+    name: VariableOr[str]
+    """
+    Name of the serving endpoint to grant permission on.
+    """
+
+    permission: VariableOr[AppResourceServingEndpointServingEndpointPermissionParam]
+    """
+    Permission to grant on the serving endpoint. Supported permissions are: "CAN_MANAGE", "CAN_QUERY", "CAN_VIEW".
+    """
+
+
+AppResourceServingEndpointParam = (
+    AppResourceServingEndpointDict | AppResourceServingEndpoint
+)
diff --git a/python/databricks/bundles/apps/_models/app_resource_serving_endpoint_serving_endpoint_permission.py b/python/databricks/bundles/apps/_models/app_resource_serving_endpoint_serving_endpoint_permission.py
new file mode 100644
index 00000000000..abfe5e63be0
--- /dev/null
+++ b/python/databricks/bundles/apps/_models/app_resource_serving_endpoint_serving_endpoint_permission.py
@@ -0,0 +1,16 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class AppResourceServingEndpointServingEndpointPermission(Enum):
+    CAN_MANAGE = "CAN_MANAGE"
+    CAN_QUERY = "CAN_QUERY"
+    CAN_VIEW = "CAN_VIEW"
+
+
+AppResourceServingEndpointServingEndpointPermissionParam = (
+    Literal["CAN_MANAGE", "CAN_QUERY", "CAN_VIEW"]
+    | AppResourceServingEndpointServingEndpointPermission
+)
diff --git a/python/databricks/bundles/apps/_models/app_resource_sql_warehouse.py b/python/databricks/bundles/apps/_models/app_resource_sql_warehouse.py
new file mode 100644
index 00000000000..691528a0450
--- /dev/null
+++ b/python/databricks/bundles/apps/_models/app_resource_sql_warehouse.py
@@ -0,0 +1,54 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.apps._models.app_resource_sql_warehouse_sql_warehouse_permission import (
+    AppResourceSqlWarehouseSqlWarehousePermission,
+    AppResourceSqlWarehouseSqlWarehousePermissionParam,
+)
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AppResourceSqlWarehouse:
+    """"""
+
+    id: VariableOr[str]
+    """
+    Id of the SQL warehouse to grant permission on.
+    """
+
+    permission: VariableOr[AppResourceSqlWarehouseSqlWarehousePermission]
+    """
+    Permission to grant on the SQL warehouse. Supported permissions are: "CAN_MANAGE", "CAN_USE", "IS_OWNER".
+    """
+
+    @classmethod
+    def from_dict(cls, value: "AppResourceSqlWarehouseDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AppResourceSqlWarehouseDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AppResourceSqlWarehouseDict(TypedDict, total=False):
+    """"""
+
+    id: VariableOr[str]
+    """
+    Id of the SQL warehouse to grant permission on.
+    """
+
+    permission: VariableOr[AppResourceSqlWarehouseSqlWarehousePermissionParam]
+    """
+    Permission to grant on the SQL warehouse. Supported permissions are: "CAN_MANAGE", "CAN_USE", "IS_OWNER".
+    """
+
+
+AppResourceSqlWarehouseParam = AppResourceSqlWarehouseDict | AppResourceSqlWarehouse
diff --git a/python/databricks/bundles/apps/_models/app_resource_sql_warehouse_sql_warehouse_permission.py b/python/databricks/bundles/apps/_models/app_resource_sql_warehouse_sql_warehouse_permission.py
new file mode 100644
index 00000000000..ceb417a6edb
--- /dev/null
+++ b/python/databricks/bundles/apps/_models/app_resource_sql_warehouse_sql_warehouse_permission.py
@@ -0,0 +1,16 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class AppResourceSqlWarehouseSqlWarehousePermission(Enum):
+    CAN_MANAGE = "CAN_MANAGE"
+    CAN_USE = "CAN_USE"
+    IS_OWNER = "IS_OWNER"
+
+
+AppResourceSqlWarehouseSqlWarehousePermissionParam = (
+    Literal["CAN_MANAGE", "CAN_USE", "IS_OWNER"]
+    | AppResourceSqlWarehouseSqlWarehousePermission
+)
diff --git a/python/databricks/bundles/apps/_models/app_resource_uc_securable.py b/python/databricks/bundles/apps/_models/app_resource_uc_securable.py
new file mode 100644
index 00000000000..196b2396592
--- /dev/null
+++ b/python/databricks/bundles/apps/_models/app_resource_uc_securable.py
@@ -0,0 +1,50 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.apps._models.app_resource_uc_securable_uc_securable_permission import (
+    AppResourceUcSecurableUcSecurablePermission,
+    AppResourceUcSecurableUcSecurablePermissionParam,
+)
+from databricks.bundles.apps._models.app_resource_uc_securable_uc_securable_type import (
+    AppResourceUcSecurableUcSecurableType,
+    AppResourceUcSecurableUcSecurableTypeParam,
+)
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AppResourceUcSecurable:
+    """"""
+
+    permission: VariableOr[AppResourceUcSecurableUcSecurablePermission]
+
+    securable_full_name: VariableOr[str]
+
+    securable_type: VariableOr[AppResourceUcSecurableUcSecurableType]
+
+    @classmethod
+    def from_dict(cls, value: "AppResourceUcSecurableDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AppResourceUcSecurableDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AppResourceUcSecurableDict(TypedDict, total=False):
+    """"""
+
+    permission: VariableOr[AppResourceUcSecurableUcSecurablePermissionParam]
+
+    securable_full_name: VariableOr[str]
+
+    securable_type: VariableOr[AppResourceUcSecurableUcSecurableTypeParam]
+
+
+AppResourceUcSecurableParam = AppResourceUcSecurableDict | AppResourceUcSecurable
diff --git a/python/databricks/bundles/apps/_models/app_resource_uc_securable_uc_securable_permission.py b/python/databricks/bundles/apps/_models/app_resource_uc_securable_uc_securable_permission.py
new file mode 100644
index 00000000000..bd4ed5005db
--- /dev/null
+++ b/python/databricks/bundles/apps/_models/app_resource_uc_securable_uc_securable_permission.py
@@ -0,0 +1,21 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class AppResourceUcSecurableUcSecurablePermission(Enum):
+    READ_VOLUME = "READ_VOLUME"
+    WRITE_VOLUME = "WRITE_VOLUME"
+    SELECT = "SELECT"
+    EXECUTE = "EXECUTE"
+    USE_CONNECTION = "USE_CONNECTION"
+    MODIFY = "MODIFY"
+
+
+AppResourceUcSecurableUcSecurablePermissionParam = (
+    Literal[
+        "READ_VOLUME", "WRITE_VOLUME", "SELECT", "EXECUTE", "USE_CONNECTION", "MODIFY"
+    ]
+    | AppResourceUcSecurableUcSecurablePermission
+)
diff --git a/python/databricks/bundles/apps/_models/app_resource_uc_securable_uc_securable_type.py b/python/databricks/bundles/apps/_models/app_resource_uc_securable_uc_securable_type.py
new file mode 100644
index 00000000000..46fc5390e24
--- /dev/null
+++ b/python/databricks/bundles/apps/_models/app_resource_uc_securable_uc_securable_type.py
@@ -0,0 +1,18 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class AppResourceUcSecurableUcSecurableType(Enum):
+    VOLUME = "VOLUME"
+    TABLE = "TABLE"
+    FUNCTION = "FUNCTION"
+    CONNECTION = "CONNECTION"
+    MODEL_SERVICE = "MODEL_SERVICE"
+
+
+AppResourceUcSecurableUcSecurableTypeParam = (
+    Literal["VOLUME", "TABLE", "FUNCTION", "CONNECTION", "MODEL_SERVICE"]
+    | AppResourceUcSecurableUcSecurableType
+)
diff --git a/python/databricks/bundles/apps/_models/compute_size.py b/python/databricks/bundles/apps/_models/compute_size.py
new file mode 100644
index 00000000000..4881d034935
--- /dev/null
+++ b/python/databricks/bundles/apps/_models/compute_size.py
@@ -0,0 +1,13 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class ComputeSize(Enum):
+    MEDIUM = "MEDIUM"
+    LARGE = "LARGE"
+    XLARGE = "XLARGE"
+
+
+ComputeSizeParam = Literal["MEDIUM", "LARGE", "XLARGE"] | ComputeSize
diff --git a/python/databricks/bundles/apps/_models/git_repository.py b/python/databricks/bundles/apps/_models/git_repository.py
new file mode 100644
index 00000000000..d13ae5b2a56
--- /dev/null
+++ b/python/databricks/bundles/apps/_models/git_repository.py
@@ -0,0 +1,78 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class GitRepository:
+    """
+    Git repository configuration specifying the location of the repository.
+    """
+
+    provider: VariableOr[str]
+    """
+    Git provider. Case insensitive. Supported values: gitHub, gitHubEnterprise, bitbucketCloud,
+    bitbucketServer, azureDevOpsServices, gitLab, gitLabEnterpriseEdition, awsCodeCommit.
+    """
+
+    url: VariableOr[str]
+    """
+    URL of the Git repository.
+    """
+
+    auto_deploy: VariableOrOptional[bool] = None
+    """
+    When true, automatically deploys the app on push events to the branch configured in
+    the app's deployment_source.git_source.
+    """
+
+    caller_credential_id: VariableOrOptional[int] = None
+    """
+    ID of a personal access token Git credential owned by the caller, used to
+    grant the app's service principal access to this repository.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "GitRepositoryDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "GitRepositoryDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class GitRepositoryDict(TypedDict, total=False):
+    """"""
+
+    provider: VariableOr[str]
+    """
+    Git provider. Case insensitive. Supported values: gitHub, gitHubEnterprise, bitbucketCloud,
+    bitbucketServer, azureDevOpsServices, gitLab, gitLabEnterpriseEdition, awsCodeCommit.
+    """
+
+    url: VariableOr[str]
+    """
+    URL of the Git repository.
+    """
+
+    auto_deploy: VariableOrOptional[bool]
+    """
+    When true, automatically deploys the app on push events to the branch configured in
+    the app's deployment_source.git_source.
+    """
+
+    caller_credential_id: VariableOrOptional[int]
+    """
+    ID of a personal access token Git credential owned by the caller, used to
+    grant the app's service principal access to this repository.
+    """
+
+
+GitRepositoryParam = GitRepositoryDict | GitRepository
diff --git a/python/databricks/bundles/apps/_models/git_source.py b/python/databricks/bundles/apps/_models/git_source.py
new file mode 100644
index 00000000000..93bd61f5aa4
--- /dev/null
+++ b/python/databricks/bundles/apps/_models/git_source.py
@@ -0,0 +1,74 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class GitSource:
+    """
+    Complete git source specification including repository location and reference.
+    """
+
+    branch: VariableOrOptional[str] = None
+    """
+    Git branch to checkout.
+    """
+
+    commit: VariableOrOptional[str] = None
+    """
+    Git commit SHA to checkout.
+    """
+
+    source_code_path: VariableOrOptional[str] = None
+    """
+    Relative path to the app source code within the Git repository. If not specified, the root
+    of the repository is used.
+    """
+
+    tag: VariableOrOptional[str] = None
+    """
+    Git tag to checkout.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "GitSourceDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "GitSourceDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class GitSourceDict(TypedDict, total=False):
+    """"""
+
+    branch: VariableOrOptional[str]
+    """
+    Git branch to checkout.
+    """
+
+    commit: VariableOrOptional[str]
+    """
+    Git commit SHA to checkout.
+    """
+
+    source_code_path: VariableOrOptional[str]
+    """
+    Relative path to the app source code within the Git repository. If not specified, the root
+    of the repository is used.
+    """
+
+    tag: VariableOrOptional[str]
+    """
+    Git tag to checkout.
+    """
+
+
+GitSourceParam = GitSourceDict | GitSource
diff --git a/python/databricks/bundles/apps/_models/lifecycle_with_started.py b/python/databricks/bundles/apps/_models/lifecycle_with_started.py
new file mode 100644
index 00000000000..f9cb9b8d49c
--- /dev/null
+++ b/python/databricks/bundles/apps/_models/lifecycle_with_started.py
@@ -0,0 +1,50 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class LifecycleWithStarted:
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool] = None
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+    started: VariableOrOptional[bool] = None
+    """
+    Lifecycle setting to deploy the resource in started mode. Only supported for apps, clusters, and sql_warehouses.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "LifecycleWithStartedDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "LifecycleWithStartedDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class LifecycleWithStartedDict(TypedDict, total=False):
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool]
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+    started: VariableOrOptional[bool]
+    """
+    Lifecycle setting to deploy the resource in started mode. Only supported for apps, clusters, and sql_warehouses.
+    """
+
+
+LifecycleWithStartedParam = LifecycleWithStartedDict | LifecycleWithStarted
diff --git a/python/databricks/bundles/apps/_models/telemetry_export_destination.py b/python/databricks/bundles/apps/_models/telemetry_export_destination.py
new file mode 100644
index 00000000000..edf9108c8a1
--- /dev/null
+++ b/python/databricks/bundles/apps/_models/telemetry_export_destination.py
@@ -0,0 +1,48 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.apps._models.unity_catalog import (
+    UnityCatalog,
+    UnityCatalogParam,
+)
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class TelemetryExportDestination:
+    """
+    A single telemetry export destination with its configuration and status.
+    """
+
+    unity_catalog: VariableOrOptional[UnityCatalog] = None
+    """
+    Unity Catalog Destinations for OTEL telemetry export.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "TelemetryExportDestinationDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "TelemetryExportDestinationDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class TelemetryExportDestinationDict(TypedDict, total=False):
+    """"""
+
+    unity_catalog: VariableOrOptional[UnityCatalogParam]
+    """
+    Unity Catalog Destinations for OTEL telemetry export.
+    """
+
+
+TelemetryExportDestinationParam = (
+    TelemetryExportDestinationDict | TelemetryExportDestination
+)
diff --git a/python/databricks/bundles/apps/_models/unity_catalog.py b/python/databricks/bundles/apps/_models/unity_catalog.py
new file mode 100644
index 00000000000..f20d1c373f3
--- /dev/null
+++ b/python/databricks/bundles/apps/_models/unity_catalog.py
@@ -0,0 +1,62 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class UnityCatalog:
+    """
+    Unity Catalog Destinations for OTEL telemetry export.
+    """
+
+    logs_table: VariableOr[str]
+    """
+    Unity Catalog table for OTEL logs.
+    """
+
+    metrics_table: VariableOr[str]
+    """
+    Unity Catalog table for OTEL metrics.
+    """
+
+    traces_table: VariableOr[str]
+    """
+    Unity Catalog table for OTEL traces (spans).
+    """
+
+    @classmethod
+    def from_dict(cls, value: "UnityCatalogDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "UnityCatalogDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class UnityCatalogDict(TypedDict, total=False):
+    """"""
+
+    logs_table: VariableOr[str]
+    """
+    Unity Catalog table for OTEL logs.
+    """
+
+    metrics_table: VariableOr[str]
+    """
+    Unity Catalog table for OTEL metrics.
+    """
+
+    traces_table: VariableOr[str]
+    """
+    Unity Catalog table for OTEL traces (spans).
+    """
+
+
+UnityCatalogParam = UnityCatalogDict | UnityCatalog
diff --git a/python/databricks/bundles/build.py b/python/databricks/bundles/build.py
index 8f7166128ea..1c3de3f223d 100644
--- a/python/databricks/bundles/build.py
+++ b/python/databricks/bundles/build.py
@@ -20,6 +20,8 @@
 
 __all__ = []
 
+logger = logging.getLogger(__name__)
+
 
 @dataclass
 class _Args:
@@ -43,7 +45,7 @@ def from_dict(cls, d: dict) -> "_Conf":
         unknown_keys = d.keys() - known_keys
 
         if unknown_keys:
-            logging.warning(f"Unknown configuration keys: {unknown_keys}")
+            logger.warning(f"Unknown configuration keys: {unknown_keys}")
 
         return _transform(cls, {k: v for k, v in d.items() if k in known_keys})
 
@@ -482,7 +484,7 @@ def main(argv: list[str]) -> int:
     args = _parse_args(argv[1:])
 
     if args.unknown_args:
-        logging.warning(f"Unknown arguments: {args.unknown_args}")
+        logger.warning(f"Unknown arguments: {args.unknown_args}")
 
     logging.basicConfig(level=logging.DEBUG, stream=sys.stderr)
     new_bundle, locations, diagnostics = python_mutator(args)
diff --git a/python/databricks/bundles/catalogs/__init__.py b/python/databricks/bundles/catalogs/__init__.py
index af3df5a2c86..f36750b4816 100644
--- a/python/databricks/bundles/catalogs/__init__.py
+++ b/python/databricks/bundles/catalogs/__init__.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 __all__ = [
     "AzureEncryptionSettings",
     "AzureEncryptionSettingsDict",
diff --git a/python/databricks/bundles/catalogs/_models/azure_encryption_settings.py b/python/databricks/bundles/catalogs/_models/azure_encryption_settings.py
index 9c2042d135c..d68ba739a24 100644
--- a/python/databricks/bundles/catalogs/_models/azure_encryption_settings.py
+++ b/python/databricks/bundles/catalogs/_models/azure_encryption_settings.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -11,9 +13,7 @@
 
 @dataclass(kw_only=True)
 class AzureEncryptionSettings:
-    """
-    :meta private: [EXPERIMENTAL]
-    """
+    """"""
 
     azure_tenant_id: VariableOr[str]
 
diff --git a/python/databricks/bundles/catalogs/_models/catalog.py b/python/databricks/bundles/catalogs/_models/catalog.py
index 9795277408b..bdb397b0cb0 100644
--- a/python/databricks/bundles/catalogs/_models/catalog.py
+++ b/python/databricks/bundles/catalogs/_models/catalog.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
@@ -29,31 +31,66 @@ class Catalog(Resource):
     """"""
 
     name: VariableOr[str]
+    """
+    Name of catalog.
+    """
 
     comment: VariableOrOptional[str] = None
+    """
+    User-provided free-form text description.
+    """
 
     connection_name: VariableOrOptional[str] = None
+    """
+    The name of the connection to an external data source.
+    """
+
+    custom_max_retention_hours: VariableOrOptional[int] = None
+    """
+    [Public Preview] Custom maximum retention period in hours for the catalog
+    """
 
     grants: VariableOrList[PrivilegeAssignment] = field(default_factory=list)
+    """
+    The Unity Catalog privileges to grant to principals on this securable.
+    """
 
     lifecycle: VariableOrOptional[Lifecycle] = None
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
 
     managed_encryption_settings: VariableOrOptional[EncryptionSettings] = None
     """
-    :meta private: [EXPERIMENTAL]
-    
     Control CMK encryption for managed catalog data
     """
 
     options: VariableOrDict[str] = field(default_factory=dict)
+    """
+    A map of key-value properties attached to the securable.
+    """
 
     properties: VariableOrDict[str] = field(default_factory=dict)
+    """
+    A map of key-value properties attached to the securable.
+    """
 
     provider_name: VariableOrOptional[str] = None
+    """
+    The name of delta sharing provider.
+    
+    A Delta Sharing catalog is a catalog that is based on a Delta share on a remote sharing server.
+    """
 
     share_name: VariableOrOptional[str] = None
+    """
+    The name of the share under the share provider.
+    """
 
     storage_root: VariableOrOptional[str] = None
+    """
+    Storage root URL for managed tables within catalog.
+    """
 
     @classmethod
     def from_dict(cls, value: "CatalogDict") -> "Self":
@@ -67,31 +104,66 @@ class CatalogDict(TypedDict, total=False):
     """"""
 
     name: VariableOr[str]
+    """
+    Name of catalog.
+    """
 
     comment: VariableOrOptional[str]
+    """
+    User-provided free-form text description.
+    """
 
     connection_name: VariableOrOptional[str]
+    """
+    The name of the connection to an external data source.
+    """
+
+    custom_max_retention_hours: VariableOrOptional[int]
+    """
+    [Public Preview] Custom maximum retention period in hours for the catalog
+    """
 
     grants: VariableOrList[PrivilegeAssignmentParam]
+    """
+    The Unity Catalog privileges to grant to principals on this securable.
+    """
 
     lifecycle: VariableOrOptional[LifecycleParam]
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
 
     managed_encryption_settings: VariableOrOptional[EncryptionSettingsParam]
     """
-    :meta private: [EXPERIMENTAL]
-    
     Control CMK encryption for managed catalog data
     """
 
     options: VariableOrDict[str]
+    """
+    A map of key-value properties attached to the securable.
+    """
 
     properties: VariableOrDict[str]
+    """
+    A map of key-value properties attached to the securable.
+    """
 
     provider_name: VariableOrOptional[str]
+    """
+    The name of delta sharing provider.
+    
+    A Delta Sharing catalog is a catalog that is based on a Delta share on a remote sharing server.
+    """
 
     share_name: VariableOrOptional[str]
+    """
+    The name of the share under the share provider.
+    """
 
     storage_root: VariableOrOptional[str]
+    """
+    Storage root URL for managed tables within catalog.
+    """
 
 
 CatalogParam = CatalogDict | Catalog
diff --git a/python/databricks/bundles/catalogs/_models/encryption_settings.py b/python/databricks/bundles/catalogs/_models/encryption_settings.py
index 1c8bf991fdb..dfb53029dbe 100644
--- a/python/databricks/bundles/catalogs/_models/encryption_settings.py
+++ b/python/databricks/bundles/catalogs/_models/encryption_settings.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -16,8 +18,6 @@
 @dataclass(kw_only=True)
 class EncryptionSettings:
     """
-    :meta private: [EXPERIMENTAL]
-
     Encryption Settings are used to carry metadata for securable encryption at rest.
     Currently used for catalogs, we can use the information supplied here to interact with a CMK.
     """
diff --git a/python/databricks/bundles/catalogs/_models/lifecycle.py b/python/databricks/bundles/catalogs/_models/lifecycle.py
index c934967f37e..697776a198e 100644
--- a/python/databricks/bundles/catalogs/_models/lifecycle.py
+++ b/python/databricks/bundles/catalogs/_models/lifecycle.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/catalogs/_models/privilege.py b/python/databricks/bundles/catalogs/_models/privilege.py
index 20f4e1f5573..df45211a76a 100644
--- a/python/databricks/bundles/catalogs/_models/privilege.py
+++ b/python/databricks/bundles/catalogs/_models/privilege.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
@@ -53,6 +55,8 @@ class Privilege(Enum):
     MODIFY_CLEAN_ROOM = "MODIFY_CLEAN_ROOM"
     EXECUTE_CLEAN_ROOM_TASK = "EXECUTE_CLEAN_ROOM_TASK"
     EXTERNAL_USE_SCHEMA = "EXTERNAL_USE_SCHEMA"
+    READ_METADATA = "READ_METADATA"
+    EXTERNAL_USE_LOCATION = "EXTERNAL_USE_LOCATION"
 
 
 PrivilegeParam = (
@@ -107,6 +111,8 @@ class Privilege(Enum):
         "MODIFY_CLEAN_ROOM",
         "EXECUTE_CLEAN_ROOM_TASK",
         "EXTERNAL_USE_SCHEMA",
+        "READ_METADATA",
+        "EXTERNAL_USE_LOCATION",
     ]
     | Privilege
 )
diff --git a/python/databricks/bundles/catalogs/_models/privilege_assignment.py b/python/databricks/bundles/catalogs/_models/privilege_assignment.py
index f3b67558216..a85471c5931 100644
--- a/python/databricks/bundles/catalogs/_models/privilege_assignment.py
+++ b/python/databricks/bundles/catalogs/_models/privilege_assignment.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/cluster_policies/__init__.py b/python/databricks/bundles/cluster_policies/__init__.py
new file mode 100644
index 00000000000..531fa17821a
--- /dev/null
+++ b/python/databricks/bundles/cluster_policies/__init__.py
@@ -0,0 +1,68 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+__all__ = [
+    "ClusterPolicy",
+    "ClusterPolicyDict",
+    "ClusterPolicyParam",
+    "ClusterPolicyPermission",
+    "ClusterPolicyPermissionDict",
+    "ClusterPolicyPermissionLevel",
+    "ClusterPolicyPermissionLevelParam",
+    "ClusterPolicyPermissionParam",
+    "Library",
+    "LibraryDict",
+    "LibraryParam",
+    "Lifecycle",
+    "LifecycleDict",
+    "LifecycleParam",
+    "MavenLibrary",
+    "MavenLibraryDict",
+    "MavenLibraryParam",
+    "PythonPyPiLibrary",
+    "PythonPyPiLibraryDict",
+    "PythonPyPiLibraryParam",
+    "RCranLibrary",
+    "RCranLibraryDict",
+    "RCranLibraryParam",
+]
+
+
+from databricks.bundles.cluster_policies._models.cluster_policy import (
+    ClusterPolicy,
+    ClusterPolicyDict,
+    ClusterPolicyParam,
+)
+from databricks.bundles.cluster_policies._models.cluster_policy_permission import (
+    ClusterPolicyPermission,
+    ClusterPolicyPermissionDict,
+    ClusterPolicyPermissionParam,
+)
+from databricks.bundles.cluster_policies._models.cluster_policy_permission_level import (
+    ClusterPolicyPermissionLevel,
+    ClusterPolicyPermissionLevelParam,
+)
+from databricks.bundles.cluster_policies._models.library import (
+    Library,
+    LibraryDict,
+    LibraryParam,
+)
+from databricks.bundles.cluster_policies._models.lifecycle import (
+    Lifecycle,
+    LifecycleDict,
+    LifecycleParam,
+)
+from databricks.bundles.cluster_policies._models.maven_library import (
+    MavenLibrary,
+    MavenLibraryDict,
+    MavenLibraryParam,
+)
+from databricks.bundles.cluster_policies._models.python_py_pi_library import (
+    PythonPyPiLibrary,
+    PythonPyPiLibraryDict,
+    PythonPyPiLibraryParam,
+)
+from databricks.bundles.cluster_policies._models.r_cran_library import (
+    RCranLibrary,
+    RCranLibraryDict,
+    RCranLibraryParam,
+)
diff --git a/python/databricks/bundles/cluster_policies/_models/cluster_policy.py b/python/databricks/bundles/cluster_policies/_models/cluster_policy.py
new file mode 100644
index 00000000000..d8033d95728
--- /dev/null
+++ b/python/databricks/bundles/cluster_policies/_models/cluster_policy.py
@@ -0,0 +1,142 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, Any, TypedDict
+
+from databricks.bundles.cluster_policies._models.cluster_policy_permission import (
+    ClusterPolicyPermission,
+    ClusterPolicyPermissionParam,
+)
+from databricks.bundles.cluster_policies._models.library import Library, LibraryParam
+from databricks.bundles.cluster_policies._models.lifecycle import (
+    Lifecycle,
+    LifecycleParam,
+)
+from databricks.bundles.core._resource import Resource
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ClusterPolicy(Resource):
+    """"""
+
+    definition: VariableOrOptional[Any] = None
+    """
+    Policy definition document expressed in [Databricks Cluster Policy Definition Language](https://docs.databricks.com/administration-guide/clusters/policy-definition.html).
+    """
+
+    description: VariableOrOptional[str] = None
+    """
+    Additional human-readable description of the cluster policy.
+    """
+
+    libraries: VariableOrList[Library] = field(default_factory=list)
+    """
+    A list of libraries to be installed on the next cluster restart that uses this policy. The maximum number of libraries is 500.
+    """
+
+    lifecycle: VariableOrOptional[Lifecycle] = None
+
+    max_clusters_per_user: VariableOrOptional[int] = None
+    """
+    Max number of clusters per user that can be active using this policy. If not present, there is no max limit.
+    """
+
+    name: VariableOrOptional[str] = None
+    """
+    Cluster Policy name requested by the user. This has to be unique. Length must be between 1 and 100
+    characters.
+    """
+
+    permissions: VariableOrList[ClusterPolicyPermission] = field(default_factory=list)
+    """
+    The permissions to apply to this resource.
+    """
+
+    policy_family_definition_overrides: VariableOrOptional[Any] = None
+    """
+    Policy definition JSON document expressed in [Databricks Policy Definition Language](https://docs.databricks.com/administration-guide/clusters/policy-definition.html).
+    The JSON document must be passed as a string and cannot be embedded in the requests.
+    
+    You can use this to customize the policy definition inherited from the policy family.
+    Policy rules specified here are merged into the inherited policy definition.
+    """
+
+    policy_family_id: VariableOrOptional[str] = None
+    """
+    ID of the policy family. The cluster policy's policy definition inherits the policy
+    family's policy definition.
+    
+    Cannot be used with `definition`. Use `policy_family_definition_overrides` instead to
+    customize the policy definition.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "ClusterPolicyDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ClusterPolicyDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ClusterPolicyDict(TypedDict, total=False):
+    """"""
+
+    definition: VariableOrOptional[Any]
+    """
+    Policy definition document expressed in [Databricks Cluster Policy Definition Language](https://docs.databricks.com/administration-guide/clusters/policy-definition.html).
+    """
+
+    description: VariableOrOptional[str]
+    """
+    Additional human-readable description of the cluster policy.
+    """
+
+    libraries: VariableOrList[LibraryParam]
+    """
+    A list of libraries to be installed on the next cluster restart that uses this policy. The maximum number of libraries is 500.
+    """
+
+    lifecycle: VariableOrOptional[LifecycleParam]
+
+    max_clusters_per_user: VariableOrOptional[int]
+    """
+    Max number of clusters per user that can be active using this policy. If not present, there is no max limit.
+    """
+
+    name: VariableOrOptional[str]
+    """
+    Cluster Policy name requested by the user. This has to be unique. Length must be between 1 and 100
+    characters.
+    """
+
+    permissions: VariableOrList[ClusterPolicyPermissionParam]
+    """
+    The permissions to apply to this resource.
+    """
+
+    policy_family_definition_overrides: VariableOrOptional[Any]
+    """
+    Policy definition JSON document expressed in [Databricks Policy Definition Language](https://docs.databricks.com/administration-guide/clusters/policy-definition.html).
+    The JSON document must be passed as a string and cannot be embedded in the requests.
+    
+    You can use this to customize the policy definition inherited from the policy family.
+    Policy rules specified here are merged into the inherited policy definition.
+    """
+
+    policy_family_id: VariableOrOptional[str]
+    """
+    ID of the policy family. The cluster policy's policy definition inherits the policy
+    family's policy definition.
+    
+    Cannot be used with `definition`. Use `policy_family_definition_overrides` instead to
+    customize the policy definition.
+    """
+
+
+ClusterPolicyParam = ClusterPolicyDict | ClusterPolicy
diff --git a/python/databricks/bundles/cluster_policies/_models/cluster_policy_permission.py b/python/databricks/bundles/cluster_policies/_models/cluster_policy_permission.py
new file mode 100644
index 00000000000..de9e59b93a4
--- /dev/null
+++ b/python/databricks/bundles/cluster_policies/_models/cluster_policy_permission.py
@@ -0,0 +1,74 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.cluster_policies._models.cluster_policy_permission_level import (
+    ClusterPolicyPermissionLevel,
+    ClusterPolicyPermissionLevelParam,
+)
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ClusterPolicyPermission:
+    """"""
+
+    level: VariableOr[ClusterPolicyPermissionLevel]
+    """
+    The permission level to apply. Cluster policies only support `CAN_USE`.
+    """
+
+    group_name: VariableOrOptional[str] = None
+    """
+    The name of the group granted the permission level.
+    """
+
+    service_principal_name: VariableOrOptional[str] = None
+    """
+    The name of the service principal granted the permission level.
+    """
+
+    user_name: VariableOrOptional[str] = None
+    """
+    The name of the user granted the permission level.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "ClusterPolicyPermissionDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ClusterPolicyPermissionDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ClusterPolicyPermissionDict(TypedDict, total=False):
+    """"""
+
+    level: VariableOr[ClusterPolicyPermissionLevelParam]
+    """
+    The permission level to apply. Cluster policies only support `CAN_USE`.
+    """
+
+    group_name: VariableOrOptional[str]
+    """
+    The name of the group granted the permission level.
+    """
+
+    service_principal_name: VariableOrOptional[str]
+    """
+    The name of the service principal granted the permission level.
+    """
+
+    user_name: VariableOrOptional[str]
+    """
+    The name of the user granted the permission level.
+    """
+
+
+ClusterPolicyPermissionParam = ClusterPolicyPermissionDict | ClusterPolicyPermission
diff --git a/python/databricks/bundles/cluster_policies/_models/cluster_policy_permission_level.py b/python/databricks/bundles/cluster_policies/_models/cluster_policy_permission_level.py
new file mode 100644
index 00000000000..2773971dce1
--- /dev/null
+++ b/python/databricks/bundles/cluster_policies/_models/cluster_policy_permission_level.py
@@ -0,0 +1,15 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class ClusterPolicyPermissionLevel(Enum):
+    """
+    Permission level
+    """
+
+    CAN_USE = "CAN_USE"
+
+
+ClusterPolicyPermissionLevelParam = Literal["CAN_USE"] | ClusterPolicyPermissionLevel
diff --git a/python/databricks/bundles/cluster_policies/_models/library.py b/python/databricks/bundles/cluster_policies/_models/library.py
new file mode 100644
index 00000000000..42781f4ccb5
--- /dev/null
+++ b/python/databricks/bundles/cluster_policies/_models/library.py
@@ -0,0 +1,134 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.cluster_policies._models.maven_library import (
+    MavenLibrary,
+    MavenLibraryParam,
+)
+from databricks.bundles.cluster_policies._models.python_py_pi_library import (
+    PythonPyPiLibrary,
+    PythonPyPiLibraryParam,
+)
+from databricks.bundles.cluster_policies._models.r_cran_library import (
+    RCranLibrary,
+    RCranLibraryParam,
+)
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class Library:
+    """"""
+
+    cran: VariableOrOptional[RCranLibrary] = None
+    """
+    Specification of a CRAN library to be installed as part of the library
+    """
+
+    egg: VariableOrOptional[str] = None
+    """
+    [DEPRECATED] Deprecated. URI of the egg library to install. Installing Python egg files is deprecated and is not supported in Databricks Runtime 14.0 and above.
+    """
+
+    jar: VariableOrOptional[str] = None
+    """
+    URI of the JAR library to install. Supported URIs include Workspace paths, Unity Catalog Volumes paths, and S3 URIs.
+    For example: `{ "jar": "/Workspace/path/to/library.jar" }`, `{ "jar" : "/Volumes/path/to/library.jar" }` or
+    `{ "jar": "s3://my-bucket/library.jar" }`.
+    If S3 is used, please make sure the cluster has read access on the library. You may need to
+    launch the cluster with an IAM role to access the S3 URI.
+    """
+
+    maven: VariableOrOptional[MavenLibrary] = None
+    """
+    Specification of a maven library to be installed. For example:
+    `{ "coordinates": "org.jsoup:jsoup:1.7.2" }`
+    """
+
+    pypi: VariableOrOptional[PythonPyPiLibrary] = None
+    """
+    Specification of a PyPi library to be installed. For example:
+    `{ "package": "simplejson" }`
+    """
+
+    requirements: VariableOrOptional[str] = None
+    """
+    URI of the requirements.txt file to install. Only Workspace paths and Unity Catalog Volumes paths are supported.
+    For example: `{ "requirements": "/Workspace/path/to/requirements.txt" }` or `{ "requirements" : "/Volumes/path/to/requirements.txt" }`
+    """
+
+    whl: VariableOrOptional[str] = None
+    """
+    URI of the wheel library to install. Supported URIs include Workspace paths, Unity Catalog Volumes paths, and S3 URIs.
+    For example: `{ "whl": "/Workspace/path/to/library.whl" }`, `{ "whl" : "/Volumes/path/to/library.whl" }` or
+    `{ "whl": "s3://my-bucket/library.whl" }`.
+    If S3 is used, please make sure the cluster has read access on the library. You may need to
+    launch the cluster with an IAM role to access the S3 URI.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "LibraryDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "LibraryDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class LibraryDict(TypedDict, total=False):
+    """"""
+
+    cran: VariableOrOptional[RCranLibraryParam]
+    """
+    Specification of a CRAN library to be installed as part of the library
+    """
+
+    egg: VariableOrOptional[str]
+    """
+    [DEPRECATED] Deprecated. URI of the egg library to install. Installing Python egg files is deprecated and is not supported in Databricks Runtime 14.0 and above.
+    """
+
+    jar: VariableOrOptional[str]
+    """
+    URI of the JAR library to install. Supported URIs include Workspace paths, Unity Catalog Volumes paths, and S3 URIs.
+    For example: `{ "jar": "/Workspace/path/to/library.jar" }`, `{ "jar" : "/Volumes/path/to/library.jar" }` or
+    `{ "jar": "s3://my-bucket/library.jar" }`.
+    If S3 is used, please make sure the cluster has read access on the library. You may need to
+    launch the cluster with an IAM role to access the S3 URI.
+    """
+
+    maven: VariableOrOptional[MavenLibraryParam]
+    """
+    Specification of a maven library to be installed. For example:
+    `{ "coordinates": "org.jsoup:jsoup:1.7.2" }`
+    """
+
+    pypi: VariableOrOptional[PythonPyPiLibraryParam]
+    """
+    Specification of a PyPi library to be installed. For example:
+    `{ "package": "simplejson" }`
+    """
+
+    requirements: VariableOrOptional[str]
+    """
+    URI of the requirements.txt file to install. Only Workspace paths and Unity Catalog Volumes paths are supported.
+    For example: `{ "requirements": "/Workspace/path/to/requirements.txt" }` or `{ "requirements" : "/Volumes/path/to/requirements.txt" }`
+    """
+
+    whl: VariableOrOptional[str]
+    """
+    URI of the wheel library to install. Supported URIs include Workspace paths, Unity Catalog Volumes paths, and S3 URIs.
+    For example: `{ "whl": "/Workspace/path/to/library.whl" }`, `{ "whl" : "/Volumes/path/to/library.whl" }` or
+    `{ "whl": "s3://my-bucket/library.whl" }`.
+    If S3 is used, please make sure the cluster has read access on the library. You may need to
+    launch the cluster with an IAM role to access the S3 URI.
+    """
+
+
+LibraryParam = LibraryDict | Library
diff --git a/python/databricks/bundles/cluster_policies/_models/lifecycle.py b/python/databricks/bundles/cluster_policies/_models/lifecycle.py
new file mode 100644
index 00000000000..697776a198e
--- /dev/null
+++ b/python/databricks/bundles/cluster_policies/_models/lifecycle.py
@@ -0,0 +1,40 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class Lifecycle:
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool] = None
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "LifecycleDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "LifecycleDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class LifecycleDict(TypedDict, total=False):
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool]
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+
+LifecycleParam = LifecycleDict | Lifecycle
diff --git a/python/databricks/bundles/cluster_policies/_models/maven_library.py b/python/databricks/bundles/cluster_policies/_models/maven_library.py
new file mode 100644
index 00000000000..25be1599c28
--- /dev/null
+++ b/python/databricks/bundles/cluster_policies/_models/maven_library.py
@@ -0,0 +1,72 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import (
+    VariableOr,
+    VariableOrList,
+    VariableOrOptional,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class MavenLibrary:
+    """"""
+
+    coordinates: VariableOr[str]
+    """
+    Gradle-style maven coordinates. For example: "org.jsoup:jsoup:1.7.2".
+    """
+
+    exclusions: VariableOrList[str] = field(default_factory=list)
+    """
+    List of dependences to exclude. For example: `["slf4j:slf4j", "*:hadoop-client"]`.
+    
+    Maven dependency exclusions:
+    https://maven.apache.org/guides/introduction/introduction-to-optional-and-excludes-dependencies.html.
+    """
+
+    repo: VariableOrOptional[str] = None
+    """
+    Maven repo to install the Maven package from. If omitted, both Maven Central Repository
+    and Spark Packages are searched.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "MavenLibraryDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "MavenLibraryDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class MavenLibraryDict(TypedDict, total=False):
+    """"""
+
+    coordinates: VariableOr[str]
+    """
+    Gradle-style maven coordinates. For example: "org.jsoup:jsoup:1.7.2".
+    """
+
+    exclusions: VariableOrList[str]
+    """
+    List of dependences to exclude. For example: `["slf4j:slf4j", "*:hadoop-client"]`.
+    
+    Maven dependency exclusions:
+    https://maven.apache.org/guides/introduction/introduction-to-optional-and-excludes-dependencies.html.
+    """
+
+    repo: VariableOrOptional[str]
+    """
+    Maven repo to install the Maven package from. If omitted, both Maven Central Repository
+    and Spark Packages are searched.
+    """
+
+
+MavenLibraryParam = MavenLibraryDict | MavenLibrary
diff --git a/python/databricks/bundles/cluster_policies/_models/python_py_pi_library.py b/python/databricks/bundles/cluster_policies/_models/python_py_pi_library.py
new file mode 100644
index 00000000000..037c2029f50
--- /dev/null
+++ b/python/databricks/bundles/cluster_policies/_models/python_py_pi_library.py
@@ -0,0 +1,54 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class PythonPyPiLibrary:
+    """"""
+
+    package: VariableOr[str]
+    """
+    The name of the pypi package to install. An optional exact version specification is also
+    supported. Examples: "simplejson" and "simplejson==3.8.0".
+    """
+
+    repo: VariableOrOptional[str] = None
+    """
+    The repository where the package can be found. If not specified, the default pip index is
+    used.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "PythonPyPiLibraryDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "PythonPyPiLibraryDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class PythonPyPiLibraryDict(TypedDict, total=False):
+    """"""
+
+    package: VariableOr[str]
+    """
+    The name of the pypi package to install. An optional exact version specification is also
+    supported. Examples: "simplejson" and "simplejson==3.8.0".
+    """
+
+    repo: VariableOrOptional[str]
+    """
+    The repository where the package can be found. If not specified, the default pip index is
+    used.
+    """
+
+
+PythonPyPiLibraryParam = PythonPyPiLibraryDict | PythonPyPiLibrary
diff --git a/python/databricks/bundles/cluster_policies/_models/r_cran_library.py b/python/databricks/bundles/cluster_policies/_models/r_cran_library.py
new file mode 100644
index 00000000000..0bd2c4d5296
--- /dev/null
+++ b/python/databricks/bundles/cluster_policies/_models/r_cran_library.py
@@ -0,0 +1,50 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class RCranLibrary:
+    """"""
+
+    package: VariableOr[str]
+    """
+    The name of the CRAN package to install.
+    """
+
+    repo: VariableOrOptional[str] = None
+    """
+    The repository where the package can be found. If not specified, the default CRAN repo is used.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "RCranLibraryDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "RCranLibraryDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class RCranLibraryDict(TypedDict, total=False):
+    """"""
+
+    package: VariableOr[str]
+    """
+    The name of the CRAN package to install.
+    """
+
+    repo: VariableOrOptional[str]
+    """
+    The repository where the package can be found. If not specified, the default CRAN repo is used.
+    """
+
+
+RCranLibraryParam = RCranLibraryDict | RCranLibrary
diff --git a/python/databricks/bundles/clusters/__init__.py b/python/databricks/bundles/clusters/__init__.py
new file mode 100644
index 00000000000..0ccecb208b0
--- /dev/null
+++ b/python/databricks/bundles/clusters/__init__.py
@@ -0,0 +1,271 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+__all__ = [
+    "Adlsgen2Info",
+    "Adlsgen2InfoDict",
+    "Adlsgen2InfoParam",
+    "AutoScale",
+    "AutoScaleDict",
+    "AutoScaleParam",
+    "AwsAttributes",
+    "AwsAttributesDict",
+    "AwsAttributesParam",
+    "AwsAvailability",
+    "AwsAvailabilityParam",
+    "AzureAttributes",
+    "AzureAttributesDict",
+    "AzureAttributesParam",
+    "AzureAvailability",
+    "AzureAvailabilityParam",
+    "ClientsTypes",
+    "ClientsTypesDict",
+    "ClientsTypesParam",
+    "Cluster",
+    "ClusterDict",
+    "ClusterLogConf",
+    "ClusterLogConfDict",
+    "ClusterLogConfParam",
+    "ClusterParam",
+    "ClusterPermission",
+    "ClusterPermissionDict",
+    "ClusterPermissionLevel",
+    "ClusterPermissionLevelParam",
+    "ClusterPermissionParam",
+    "ConfidentialComputeType",
+    "ConfidentialComputeTypeParam",
+    "DataSecurityMode",
+    "DataSecurityModeParam",
+    "DbfsStorageInfo",
+    "DbfsStorageInfoDict",
+    "DbfsStorageInfoParam",
+    "DependencyMode",
+    "DependencyModeParam",
+    "DockerBasicAuth",
+    "DockerBasicAuthDict",
+    "DockerBasicAuthParam",
+    "DockerImage",
+    "DockerImageDict",
+    "DockerImageParam",
+    "EbsVolumeType",
+    "EbsVolumeTypeParam",
+    "GcpAttributes",
+    "GcpAttributesDict",
+    "GcpAttributesParam",
+    "GcpAvailability",
+    "GcpAvailabilityParam",
+    "GcsStorageInfo",
+    "GcsStorageInfoDict",
+    "GcsStorageInfoParam",
+    "InitScriptInfo",
+    "InitScriptInfoDict",
+    "InitScriptInfoParam",
+    "Kind",
+    "KindParam",
+    "Library",
+    "LibraryDict",
+    "LibraryParam",
+    "LifecycleWithStarted",
+    "LifecycleWithStartedDict",
+    "LifecycleWithStartedParam",
+    "LocalFileInfo",
+    "LocalFileInfoDict",
+    "LocalFileInfoParam",
+    "LogAnalyticsInfo",
+    "LogAnalyticsInfoDict",
+    "LogAnalyticsInfoParam",
+    "MavenLibrary",
+    "MavenLibraryDict",
+    "MavenLibraryParam",
+    "NodeTypeFlexibility",
+    "NodeTypeFlexibilityDict",
+    "NodeTypeFlexibilityParam",
+    "PythonPyPiLibrary",
+    "PythonPyPiLibraryDict",
+    "PythonPyPiLibraryParam",
+    "RCranLibrary",
+    "RCranLibraryDict",
+    "RCranLibraryParam",
+    "RuntimeEngine",
+    "RuntimeEngineParam",
+    "S3StorageInfo",
+    "S3StorageInfoDict",
+    "S3StorageInfoParam",
+    "VolumesStorageInfo",
+    "VolumesStorageInfoDict",
+    "VolumesStorageInfoParam",
+    "WorkloadType",
+    "WorkloadTypeDict",
+    "WorkloadTypeParam",
+    "WorkspaceStorageInfo",
+    "WorkspaceStorageInfoDict",
+    "WorkspaceStorageInfoParam",
+]
+
+
+from databricks.bundles.clusters._models.adlsgen2_info import (
+    Adlsgen2Info,
+    Adlsgen2InfoDict,
+    Adlsgen2InfoParam,
+)
+from databricks.bundles.clusters._models.auto_scale import (
+    AutoScale,
+    AutoScaleDict,
+    AutoScaleParam,
+)
+from databricks.bundles.clusters._models.aws_attributes import (
+    AwsAttributes,
+    AwsAttributesDict,
+    AwsAttributesParam,
+)
+from databricks.bundles.clusters._models.aws_availability import (
+    AwsAvailability,
+    AwsAvailabilityParam,
+)
+from databricks.bundles.clusters._models.azure_attributes import (
+    AzureAttributes,
+    AzureAttributesDict,
+    AzureAttributesParam,
+)
+from databricks.bundles.clusters._models.azure_availability import (
+    AzureAvailability,
+    AzureAvailabilityParam,
+)
+from databricks.bundles.clusters._models.clients_types import (
+    ClientsTypes,
+    ClientsTypesDict,
+    ClientsTypesParam,
+)
+from databricks.bundles.clusters._models.cluster import (
+    Cluster,
+    ClusterDict,
+    ClusterParam,
+)
+from databricks.bundles.clusters._models.cluster_log_conf import (
+    ClusterLogConf,
+    ClusterLogConfDict,
+    ClusterLogConfParam,
+)
+from databricks.bundles.clusters._models.cluster_permission import (
+    ClusterPermission,
+    ClusterPermissionDict,
+    ClusterPermissionParam,
+)
+from databricks.bundles.clusters._models.cluster_permission_level import (
+    ClusterPermissionLevel,
+    ClusterPermissionLevelParam,
+)
+from databricks.bundles.clusters._models.confidential_compute_type import (
+    ConfidentialComputeType,
+    ConfidentialComputeTypeParam,
+)
+from databricks.bundles.clusters._models.data_security_mode import (
+    DataSecurityMode,
+    DataSecurityModeParam,
+)
+from databricks.bundles.clusters._models.dbfs_storage_info import (
+    DbfsStorageInfo,
+    DbfsStorageInfoDict,
+    DbfsStorageInfoParam,
+)
+from databricks.bundles.clusters._models.dependency_mode import (
+    DependencyMode,
+    DependencyModeParam,
+)
+from databricks.bundles.clusters._models.docker_basic_auth import (
+    DockerBasicAuth,
+    DockerBasicAuthDict,
+    DockerBasicAuthParam,
+)
+from databricks.bundles.clusters._models.docker_image import (
+    DockerImage,
+    DockerImageDict,
+    DockerImageParam,
+)
+from databricks.bundles.clusters._models.ebs_volume_type import (
+    EbsVolumeType,
+    EbsVolumeTypeParam,
+)
+from databricks.bundles.clusters._models.gcp_attributes import (
+    GcpAttributes,
+    GcpAttributesDict,
+    GcpAttributesParam,
+)
+from databricks.bundles.clusters._models.gcp_availability import (
+    GcpAvailability,
+    GcpAvailabilityParam,
+)
+from databricks.bundles.clusters._models.gcs_storage_info import (
+    GcsStorageInfo,
+    GcsStorageInfoDict,
+    GcsStorageInfoParam,
+)
+from databricks.bundles.clusters._models.init_script_info import (
+    InitScriptInfo,
+    InitScriptInfoDict,
+    InitScriptInfoParam,
+)
+from databricks.bundles.clusters._models.kind import Kind, KindParam
+from databricks.bundles.clusters._models.library import (
+    Library,
+    LibraryDict,
+    LibraryParam,
+)
+from databricks.bundles.clusters._models.lifecycle_with_started import (
+    LifecycleWithStarted,
+    LifecycleWithStartedDict,
+    LifecycleWithStartedParam,
+)
+from databricks.bundles.clusters._models.local_file_info import (
+    LocalFileInfo,
+    LocalFileInfoDict,
+    LocalFileInfoParam,
+)
+from databricks.bundles.clusters._models.log_analytics_info import (
+    LogAnalyticsInfo,
+    LogAnalyticsInfoDict,
+    LogAnalyticsInfoParam,
+)
+from databricks.bundles.clusters._models.maven_library import (
+    MavenLibrary,
+    MavenLibraryDict,
+    MavenLibraryParam,
+)
+from databricks.bundles.clusters._models.node_type_flexibility import (
+    NodeTypeFlexibility,
+    NodeTypeFlexibilityDict,
+    NodeTypeFlexibilityParam,
+)
+from databricks.bundles.clusters._models.python_py_pi_library import (
+    PythonPyPiLibrary,
+    PythonPyPiLibraryDict,
+    PythonPyPiLibraryParam,
+)
+from databricks.bundles.clusters._models.r_cran_library import (
+    RCranLibrary,
+    RCranLibraryDict,
+    RCranLibraryParam,
+)
+from databricks.bundles.clusters._models.runtime_engine import (
+    RuntimeEngine,
+    RuntimeEngineParam,
+)
+from databricks.bundles.clusters._models.s3_storage_info import (
+    S3StorageInfo,
+    S3StorageInfoDict,
+    S3StorageInfoParam,
+)
+from databricks.bundles.clusters._models.volumes_storage_info import (
+    VolumesStorageInfo,
+    VolumesStorageInfoDict,
+    VolumesStorageInfoParam,
+)
+from databricks.bundles.clusters._models.workload_type import (
+    WorkloadType,
+    WorkloadTypeDict,
+    WorkloadTypeParam,
+)
+from databricks.bundles.clusters._models.workspace_storage_info import (
+    WorkspaceStorageInfo,
+    WorkspaceStorageInfoDict,
+    WorkspaceStorageInfoParam,
+)
diff --git a/python/databricks/bundles/clusters/_models/adlsgen2_info.py b/python/databricks/bundles/clusters/_models/adlsgen2_info.py
new file mode 100644
index 00000000000..87c883adeb9
--- /dev/null
+++ b/python/databricks/bundles/clusters/_models/adlsgen2_info.py
@@ -0,0 +1,42 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class Adlsgen2Info:
+    """
+    A storage location in Adls Gen2
+    """
+
+    destination: VariableOr[str]
+    """
+    abfss destination, e.g. `abfss://<container-name>@<storage-account-name>.dfs.core.windows.net/<directory-name>`.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "Adlsgen2InfoDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "Adlsgen2InfoDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class Adlsgen2InfoDict(TypedDict, total=False):
+    """"""
+
+    destination: VariableOr[str]
+    """
+    abfss destination, e.g. `abfss://<container-name>@<storage-account-name>.dfs.core.windows.net/<directory-name>`.
+    """
+
+
+Adlsgen2InfoParam = Adlsgen2InfoDict | Adlsgen2Info
diff --git a/python/databricks/bundles/clusters/_models/auto_scale.py b/python/databricks/bundles/clusters/_models/auto_scale.py
new file mode 100644
index 00000000000..10ca50c26d7
--- /dev/null
+++ b/python/databricks/bundles/clusters/_models/auto_scale.py
@@ -0,0 +1,54 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AutoScale:
+    """"""
+
+    max_workers: VariableOrOptional[int] = None
+    """
+    The maximum number of workers to which the cluster can scale up when overloaded.
+    Note that `max_workers` must be strictly greater than `min_workers`.
+    """
+
+    min_workers: VariableOrOptional[int] = None
+    """
+    The minimum number of workers to which the cluster can scale down when underutilized.
+    It is also the initial number of workers the cluster will have after creation.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "AutoScaleDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AutoScaleDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AutoScaleDict(TypedDict, total=False):
+    """"""
+
+    max_workers: VariableOrOptional[int]
+    """
+    The maximum number of workers to which the cluster can scale up when overloaded.
+    Note that `max_workers` must be strictly greater than `min_workers`.
+    """
+
+    min_workers: VariableOrOptional[int]
+    """
+    The minimum number of workers to which the cluster can scale down when underutilized.
+    It is also the initial number of workers the cluster will have after creation.
+    """
+
+
+AutoScaleParam = AutoScaleDict | AutoScale
diff --git a/python/databricks/bundles/clusters/_models/aws_attributes.py b/python/databricks/bundles/clusters/_models/aws_attributes.py
new file mode 100644
index 00000000000..2ff19359882
--- /dev/null
+++ b/python/databricks/bundles/clusters/_models/aws_attributes.py
@@ -0,0 +1,234 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.clusters._models.aws_availability import (
+    AwsAvailability,
+    AwsAvailabilityParam,
+)
+from databricks.bundles.clusters._models.ebs_volume_type import (
+    EbsVolumeType,
+    EbsVolumeTypeParam,
+)
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AwsAttributes:
+    """
+    Attributes set during cluster creation which are related to Amazon Web Services.
+    """
+
+    availability: VariableOrOptional[AwsAvailability] = None
+    """
+    Availability type used for all subsequent nodes past the `first_on_demand` ones.
+    
+    Note: If `first_on_demand` is zero, this availability type will be used for the entire cluster.
+    """
+
+    ebs_volume_count: VariableOrOptional[int] = None
+    """
+    The number of volumes launched for each instance. Users can choose up to 10 volumes.
+    This feature is only enabled for supported node types. Legacy node types cannot specify
+    custom EBS volumes.
+    For node types with no instance store, at least one EBS volume needs to be specified;
+    otherwise, cluster creation will fail.
+    
+    These EBS volumes will be mounted at `/ebs0`, `/ebs1`, and etc.
+    Instance store volumes will be mounted at `/local_disk0`, `/local_disk1`, and etc.
+    
+    If EBS volumes are attached, Databricks will configure Spark to use only the EBS volumes for
+    scratch storage because heterogenously sized scratch devices can lead to inefficient disk
+    utilization. If no EBS volumes are attached, Databricks will configure Spark to use instance
+    store volumes.
+    
+    Please note that if EBS volumes are specified, then the Spark configuration `spark.local.dir`
+    will be overridden.
+    """
+
+    ebs_volume_iops: VariableOrOptional[int] = None
+    """
+    If using gp3 volumes, what IOPS to use for the disk. If this is not set, the maximum performance of a gp2 volume with the same volume size will be used.
+    """
+
+    ebs_volume_size: VariableOrOptional[int] = None
+    """
+    The size of each EBS volume (in GiB) launched for each instance. For general purpose
+    SSD, this value must be within the range 100 - 4096. For throughput optimized HDD,
+    this value must be within the range 500 - 4096.
+    """
+
+    ebs_volume_throughput: VariableOrOptional[int] = None
+    """
+    If using gp3 volumes, what throughput to use for the disk. If this is not set, the maximum performance of a gp2 volume with the same volume size will be used.
+    """
+
+    ebs_volume_type: VariableOrOptional[EbsVolumeType] = None
+    """
+    The type of EBS volumes that will be launched with this cluster.
+    """
+
+    first_on_demand: VariableOrOptional[int] = None
+    """
+    The first `first_on_demand` nodes of the cluster will be placed on on-demand instances.
+    If this value is greater than 0, the cluster driver node in particular will be placed on an
+    on-demand instance. If this value is greater than or equal to the current cluster size, all
+    nodes will be placed on on-demand instances. If this value is less than the current cluster
+    size, `first_on_demand` nodes will be placed on on-demand instances and the remainder will
+    be placed on `availability` instances. Note that this value does not affect
+    cluster size and cannot currently be mutated over the lifetime of a cluster.
+    """
+
+    instance_profile_arn: VariableOrOptional[str] = None
+    """
+    Nodes for this cluster will only be placed on AWS instances with this instance profile. If
+    ommitted, nodes will be placed on instances without an IAM instance profile. The instance
+    profile must have previously been added to the Databricks environment by an account
+    administrator.
+    
+    This feature may only be available to certain customer plans.
+    """
+
+    spot_bid_price_percent: VariableOrOptional[int] = None
+    """
+    The bid price for AWS spot instances, as a percentage of the corresponding instance type's
+    on-demand price.
+    For example, if this field is set to 50, and the cluster needs a new `r3.xlarge` spot
+    instance, then the bid price is half of the price of
+    on-demand `r3.xlarge` instances. Similarly, if this field is set to 200, the bid price is twice
+    the price of on-demand `r3.xlarge` instances. If not specified, the default value is 100.
+    When spot instances are requested for this cluster, only spot instances whose bid price
+    percentage matches this field will be considered.
+    Note that, for safety, we enforce this field to be no more than 10000.
+    """
+
+    zone_id: VariableOrOptional[str] = None
+    """
+    Identifier for the availability zone/datacenter in which the cluster resides.
+    This string will be of a form like "us-west-2a". The provided availability
+    zone must be in the same region as the Databricks deployment. For example, "us-west-2a"
+    is not a valid zone id if the Databricks deployment resides in the "us-east-1" region.
+    This is an optional field at cluster creation, and if not specified, the zone "auto" will be used.
+    If the zone specified is "auto", will try to place cluster in a zone with high availability,
+    and will retry placement in a different AZ if there is not enough capacity.
+    
+    The list of available zones as well as the default value can be found by using the
+    `List Zones` method.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "AwsAttributesDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AwsAttributesDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AwsAttributesDict(TypedDict, total=False):
+    """"""
+
+    availability: VariableOrOptional[AwsAvailabilityParam]
+    """
+    Availability type used for all subsequent nodes past the `first_on_demand` ones.
+    
+    Note: If `first_on_demand` is zero, this availability type will be used for the entire cluster.
+    """
+
+    ebs_volume_count: VariableOrOptional[int]
+    """
+    The number of volumes launched for each instance. Users can choose up to 10 volumes.
+    This feature is only enabled for supported node types. Legacy node types cannot specify
+    custom EBS volumes.
+    For node types with no instance store, at least one EBS volume needs to be specified;
+    otherwise, cluster creation will fail.
+    
+    These EBS volumes will be mounted at `/ebs0`, `/ebs1`, and etc.
+    Instance store volumes will be mounted at `/local_disk0`, `/local_disk1`, and etc.
+    
+    If EBS volumes are attached, Databricks will configure Spark to use only the EBS volumes for
+    scratch storage because heterogenously sized scratch devices can lead to inefficient disk
+    utilization. If no EBS volumes are attached, Databricks will configure Spark to use instance
+    store volumes.
+    
+    Please note that if EBS volumes are specified, then the Spark configuration `spark.local.dir`
+    will be overridden.
+    """
+
+    ebs_volume_iops: VariableOrOptional[int]
+    """
+    If using gp3 volumes, what IOPS to use for the disk. If this is not set, the maximum performance of a gp2 volume with the same volume size will be used.
+    """
+
+    ebs_volume_size: VariableOrOptional[int]
+    """
+    The size of each EBS volume (in GiB) launched for each instance. For general purpose
+    SSD, this value must be within the range 100 - 4096. For throughput optimized HDD,
+    this value must be within the range 500 - 4096.
+    """
+
+    ebs_volume_throughput: VariableOrOptional[int]
+    """
+    If using gp3 volumes, what throughput to use for the disk. If this is not set, the maximum performance of a gp2 volume with the same volume size will be used.
+    """
+
+    ebs_volume_type: VariableOrOptional[EbsVolumeTypeParam]
+    """
+    The type of EBS volumes that will be launched with this cluster.
+    """
+
+    first_on_demand: VariableOrOptional[int]
+    """
+    The first `first_on_demand` nodes of the cluster will be placed on on-demand instances.
+    If this value is greater than 0, the cluster driver node in particular will be placed on an
+    on-demand instance. If this value is greater than or equal to the current cluster size, all
+    nodes will be placed on on-demand instances. If this value is less than the current cluster
+    size, `first_on_demand` nodes will be placed on on-demand instances and the remainder will
+    be placed on `availability` instances. Note that this value does not affect
+    cluster size and cannot currently be mutated over the lifetime of a cluster.
+    """
+
+    instance_profile_arn: VariableOrOptional[str]
+    """
+    Nodes for this cluster will only be placed on AWS instances with this instance profile. If
+    ommitted, nodes will be placed on instances without an IAM instance profile. The instance
+    profile must have previously been added to the Databricks environment by an account
+    administrator.
+    
+    This feature may only be available to certain customer plans.
+    """
+
+    spot_bid_price_percent: VariableOrOptional[int]
+    """
+    The bid price for AWS spot instances, as a percentage of the corresponding instance type's
+    on-demand price.
+    For example, if this field is set to 50, and the cluster needs a new `r3.xlarge` spot
+    instance, then the bid price is half of the price of
+    on-demand `r3.xlarge` instances. Similarly, if this field is set to 200, the bid price is twice
+    the price of on-demand `r3.xlarge` instances. If not specified, the default value is 100.
+    When spot instances are requested for this cluster, only spot instances whose bid price
+    percentage matches this field will be considered.
+    Note that, for safety, we enforce this field to be no more than 10000.
+    """
+
+    zone_id: VariableOrOptional[str]
+    """
+    Identifier for the availability zone/datacenter in which the cluster resides.
+    This string will be of a form like "us-west-2a". The provided availability
+    zone must be in the same region as the Databricks deployment. For example, "us-west-2a"
+    is not a valid zone id if the Databricks deployment resides in the "us-east-1" region.
+    This is an optional field at cluster creation, and if not specified, the zone "auto" will be used.
+    If the zone specified is "auto", will try to place cluster in a zone with high availability,
+    and will retry placement in a different AZ if there is not enough capacity.
+    
+    The list of available zones as well as the default value can be found by using the
+    `List Zones` method.
+    """
+
+
+AwsAttributesParam = AwsAttributesDict | AwsAttributes
diff --git a/python/databricks/bundles/clusters/_models/aws_availability.py b/python/databricks/bundles/clusters/_models/aws_availability.py
new file mode 100644
index 00000000000..4c3810f067e
--- /dev/null
+++ b/python/databricks/bundles/clusters/_models/aws_availability.py
@@ -0,0 +1,21 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class AwsAvailability(Enum):
+    """
+    Availability type used for all subsequent nodes past the `first_on_demand` ones.
+
+    Note: If `first_on_demand` is zero, this availability type will be used for the entire cluster.
+    """
+
+    SPOT = "SPOT"
+    ON_DEMAND = "ON_DEMAND"
+    SPOT_WITH_FALLBACK = "SPOT_WITH_FALLBACK"
+
+
+AwsAvailabilityParam = (
+    Literal["SPOT", "ON_DEMAND", "SPOT_WITH_FALLBACK"] | AwsAvailability
+)
diff --git a/python/databricks/bundles/clusters/_models/azure_attributes.py b/python/databricks/bundles/clusters/_models/azure_attributes.py
new file mode 100644
index 00000000000..f5c5cbee36d
--- /dev/null
+++ b/python/databricks/bundles/clusters/_models/azure_attributes.py
@@ -0,0 +1,132 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.clusters._models.azure_availability import (
+    AzureAvailability,
+    AzureAvailabilityParam,
+)
+from databricks.bundles.clusters._models.log_analytics_info import (
+    LogAnalyticsInfo,
+    LogAnalyticsInfoParam,
+)
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AzureAttributes:
+    """
+    Attributes set during cluster creation which are related to Microsoft Azure.
+    """
+
+    availability: VariableOrOptional[AzureAvailability] = None
+    """
+    Availability type used for all subsequent nodes past the `first_on_demand` ones.
+    Note: If `first_on_demand` is zero, this availability
+    type will be used for the entire cluster.
+    """
+
+    capacity_reservation_group: VariableOrOptional[str] = None
+    """
+    The Azure capacity reservation group resource ID to use for launching VMs.
+    When specified, VMs will be launched using the provided capacity reservation.
+    
+    Capacity reservations can only be specified when the workspace uses injected vnet (i.e. customer defined vnet not
+    managed by databricks). Ensure the databricks-login-prod Enterprise Application is granted the following four permissions:
+    1. Microsoft.Compute/capacityReservationGroups/read
+    2. Microsoft.Compute/capacityReservationGroups/deploy/action
+    3. Microsoft.Compute/capacityReservationGroups/capacityReservations/read
+    4. Microsoft.Compute/capacityReservationGroups/capacityReservations/deploy/action
+    
+    Format: `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/capacityReservationGroups/{capacityReservationGroupName}`
+    """
+
+    first_on_demand: VariableOrOptional[int] = None
+    """
+    The first `first_on_demand` nodes of the cluster will be placed on on-demand instances.
+    This value should be greater than 0, to make sure the cluster driver node is placed on an
+    on-demand instance. If this value is greater than or equal to the current cluster size, all
+    nodes will be placed on on-demand instances. If this value is less than the current cluster
+    size, `first_on_demand` nodes will be placed on on-demand instances and the remainder will
+    be placed on `availability` instances. Note that this value does not affect
+    cluster size and cannot currently be mutated over the lifetime of a cluster.
+    """
+
+    log_analytics_info: VariableOrOptional[LogAnalyticsInfo] = None
+    """
+    Defines values necessary to configure and run Azure Log Analytics agent
+    """
+
+    spot_bid_max_price: VariableOrOptional[float] = None
+    """
+    The max bid price to be used for Azure spot instances.
+    The Max price for the bid cannot be higher than the on-demand price of the instance.
+    If not specified, the default value is -1, which specifies that the instance cannot be evicted
+    on the basis of price, and only on the basis of availability. Further, the value should > 0 or -1.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "AzureAttributesDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AzureAttributesDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AzureAttributesDict(TypedDict, total=False):
+    """"""
+
+    availability: VariableOrOptional[AzureAvailabilityParam]
+    """
+    Availability type used for all subsequent nodes past the `first_on_demand` ones.
+    Note: If `first_on_demand` is zero, this availability
+    type will be used for the entire cluster.
+    """
+
+    capacity_reservation_group: VariableOrOptional[str]
+    """
+    The Azure capacity reservation group resource ID to use for launching VMs.
+    When specified, VMs will be launched using the provided capacity reservation.
+    
+    Capacity reservations can only be specified when the workspace uses injected vnet (i.e. customer defined vnet not
+    managed by databricks). Ensure the databricks-login-prod Enterprise Application is granted the following four permissions:
+    1. Microsoft.Compute/capacityReservationGroups/read
+    2. Microsoft.Compute/capacityReservationGroups/deploy/action
+    3. Microsoft.Compute/capacityReservationGroups/capacityReservations/read
+    4. Microsoft.Compute/capacityReservationGroups/capacityReservations/deploy/action
+    
+    Format: `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/capacityReservationGroups/{capacityReservationGroupName}`
+    """
+
+    first_on_demand: VariableOrOptional[int]
+    """
+    The first `first_on_demand` nodes of the cluster will be placed on on-demand instances.
+    This value should be greater than 0, to make sure the cluster driver node is placed on an
+    on-demand instance. If this value is greater than or equal to the current cluster size, all
+    nodes will be placed on on-demand instances. If this value is less than the current cluster
+    size, `first_on_demand` nodes will be placed on on-demand instances and the remainder will
+    be placed on `availability` instances. Note that this value does not affect
+    cluster size and cannot currently be mutated over the lifetime of a cluster.
+    """
+
+    log_analytics_info: VariableOrOptional[LogAnalyticsInfoParam]
+    """
+    Defines values necessary to configure and run Azure Log Analytics agent
+    """
+
+    spot_bid_max_price: VariableOrOptional[float]
+    """
+    The max bid price to be used for Azure spot instances.
+    The Max price for the bid cannot be higher than the on-demand price of the instance.
+    If not specified, the default value is -1, which specifies that the instance cannot be evicted
+    on the basis of price, and only on the basis of availability. Further, the value should > 0 or -1.
+    """
+
+
+AzureAttributesParam = AzureAttributesDict | AzureAttributes
diff --git a/python/databricks/bundles/clusters/_models/azure_availability.py b/python/databricks/bundles/clusters/_models/azure_availability.py
new file mode 100644
index 00000000000..a03cb1fdddf
--- /dev/null
+++ b/python/databricks/bundles/clusters/_models/azure_availability.py
@@ -0,0 +1,21 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class AzureAvailability(Enum):
+    """
+    Availability type used for all subsequent nodes past the `first_on_demand` ones.
+    Note: If `first_on_demand` is zero, this availability type will be used for the entire cluster.
+    """
+
+    SPOT_AZURE = "SPOT_AZURE"
+    ON_DEMAND_AZURE = "ON_DEMAND_AZURE"
+    SPOT_WITH_FALLBACK_AZURE = "SPOT_WITH_FALLBACK_AZURE"
+
+
+AzureAvailabilityParam = (
+    Literal["SPOT_AZURE", "ON_DEMAND_AZURE", "SPOT_WITH_FALLBACK_AZURE"]
+    | AzureAvailability
+)
diff --git a/python/databricks/bundles/clusters/_models/clients_types.py b/python/databricks/bundles/clusters/_models/clients_types.py
new file mode 100644
index 00000000000..87f92446ba5
--- /dev/null
+++ b/python/databricks/bundles/clusters/_models/clients_types.py
@@ -0,0 +1,50 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ClientsTypes:
+    """"""
+
+    jobs: VariableOrOptional[bool] = None
+    """
+    With jobs set, the cluster can be used for jobs
+    """
+
+    notebooks: VariableOrOptional[bool] = None
+    """
+    With notebooks set, this cluster can be used for notebooks
+    """
+
+    @classmethod
+    def from_dict(cls, value: "ClientsTypesDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ClientsTypesDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ClientsTypesDict(TypedDict, total=False):
+    """"""
+
+    jobs: VariableOrOptional[bool]
+    """
+    With jobs set, the cluster can be used for jobs
+    """
+
+    notebooks: VariableOrOptional[bool]
+    """
+    With notebooks set, this cluster can be used for notebooks
+    """
+
+
+ClientsTypesParam = ClientsTypesDict | ClientsTypes
diff --git a/python/databricks/bundles/clusters/_models/cluster.py b/python/databricks/bundles/clusters/_models/cluster.py
new file mode 100644
index 00000000000..cc3e9fcde04
--- /dev/null
+++ b/python/databricks/bundles/clusters/_models/cluster.py
@@ -0,0 +1,653 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.clusters._models.auto_scale import (
+    AutoScale,
+    AutoScaleParam,
+)
+from databricks.bundles.clusters._models.aws_attributes import (
+    AwsAttributes,
+    AwsAttributesParam,
+)
+from databricks.bundles.clusters._models.azure_attributes import (
+    AzureAttributes,
+    AzureAttributesParam,
+)
+from databricks.bundles.clusters._models.cluster_log_conf import (
+    ClusterLogConf,
+    ClusterLogConfParam,
+)
+from databricks.bundles.clusters._models.cluster_permission import (
+    ClusterPermission,
+    ClusterPermissionParam,
+)
+from databricks.bundles.clusters._models.data_security_mode import (
+    DataSecurityMode,
+    DataSecurityModeParam,
+)
+from databricks.bundles.clusters._models.dependency_mode import (
+    DependencyMode,
+    DependencyModeParam,
+)
+from databricks.bundles.clusters._models.docker_image import (
+    DockerImage,
+    DockerImageParam,
+)
+from databricks.bundles.clusters._models.gcp_attributes import (
+    GcpAttributes,
+    GcpAttributesParam,
+)
+from databricks.bundles.clusters._models.init_script_info import (
+    InitScriptInfo,
+    InitScriptInfoParam,
+)
+from databricks.bundles.clusters._models.kind import Kind, KindParam
+from databricks.bundles.clusters._models.library import Library, LibraryParam
+from databricks.bundles.clusters._models.lifecycle_with_started import (
+    LifecycleWithStarted,
+    LifecycleWithStartedParam,
+)
+from databricks.bundles.clusters._models.node_type_flexibility import (
+    NodeTypeFlexibility,
+    NodeTypeFlexibilityParam,
+)
+from databricks.bundles.clusters._models.runtime_engine import (
+    RuntimeEngine,
+    RuntimeEngineParam,
+)
+from databricks.bundles.clusters._models.workload_type import (
+    WorkloadType,
+    WorkloadTypeParam,
+)
+from databricks.bundles.core._resource import Resource
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import (
+    VariableOrDict,
+    VariableOrList,
+    VariableOrOptional,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class Cluster(Resource):
+    """
+    Contains a snapshot of the latest user specified settings that were used to create/edit the cluster.
+    """
+
+    apply_policy_default_values: VariableOrOptional[bool] = None
+    """
+    When set to true, fixed and default values from the policy will be used for fields that are omitted. When set to false, only fixed values from the policy will be applied.
+    """
+
+    autoscale: VariableOrOptional[AutoScale] = None
+    """
+    Parameters needed in order to automatically scale clusters up and down based on load.
+    Note: autoscaling works best with DB runtime versions 3.0 or later.
+    """
+
+    autotermination_minutes: VariableOrOptional[int] = None
+    """
+    Automatically terminates the cluster after it is inactive for this time in minutes. If not set,
+    this cluster will not be automatically terminated. If specified, the threshold must be between
+    10 and 10000 minutes.
+    Users can also set this value to 0 to explicitly disable automatic termination.
+    """
+
+    aws_attributes: VariableOrOptional[AwsAttributes] = None
+    """
+    Attributes related to clusters running on Amazon Web Services.
+    If not specified at cluster creation, a set of default values will be used.
+    """
+
+    azure_attributes: VariableOrOptional[AzureAttributes] = None
+    """
+    Attributes related to clusters running on Microsoft Azure.
+    If not specified at cluster creation, a set of default values will be used.
+    """
+
+    cluster_log_conf: VariableOrOptional[ClusterLogConf] = None
+    """
+    The configuration for delivering spark logs to a long-term storage destination.
+    Three kinds of destinations (DBFS, S3 and Unity Catalog volumes) are supported. Only one destination can be specified
+    for one cluster. If the conf is given, the logs will be delivered to the destination every
+    `5 mins`. The destination of driver logs is `$destination/$clusterId/driver`, while
+    the destination of executor logs is `$destination/$clusterId/executor`.
+    """
+
+    cluster_name: VariableOrOptional[str] = None
+    """
+    Cluster name requested by the user. This doesn't have to be unique.
+    If not specified at creation, the cluster name will be an empty string.
+    For job clusters, the cluster name is automatically set based on the job and job run IDs.
+    """
+
+    custom_tags: VariableOrDict[str] = field(default_factory=dict)
+    """
+    Additional tags for cluster resources. Databricks will tag all cluster resources (e.g., AWS
+    instances and EBS volumes) with these tags in addition to `default_tags`. Notes:
+    
+    - Currently, Databricks allows at most 45 custom tags
+    
+    - Clusters can only reuse cloud resources if the resources' tags are a subset of the cluster tags
+    """
+
+    data_security_mode: VariableOrOptional[DataSecurityMode] = None
+    """
+    Data security mode decides what data governance model to use when accessing data
+    from a cluster.
+    
+    * `DATA_SECURITY_MODE_AUTO`: Databricks will choose the most appropriate access mode depending on your compute configuration.
+    * `DATA_SECURITY_MODE_STANDARD`: A secure cluster that can be shared by multiple users. Cluster users are fully isolated so that they cannot see each other’s data and credentials. Most data governance features are supported in this mode. But programming languages and cluster features might be limited.
+    * `DATA_SECURITY_MODE_DEDICATED`: A secure cluster that can only be exclusively used by a single user specified in `single_user_name`. Most programming languages, cluster features and data governance features are available in this mode.
+    
+    The following modes are legacy aliases for the above modes:
+    
+    * `USER_ISOLATION`: Legacy alias for `DATA_SECURITY_MODE_STANDARD`.
+    * `SINGLE_USER`: Legacy alias for `DATA_SECURITY_MODE_DEDICATED`.
+    
+    The following modes are deprecated starting with Databricks Runtime 15.0 and
+    will be removed for future Databricks Runtime versions:
+    
+    * `LEGACY_TABLE_ACL`: This mode is for users migrating from legacy Table ACL clusters.
+    * `LEGACY_PASSTHROUGH`: This mode is for users migrating from legacy Passthrough on high concurrency clusters.
+    * `LEGACY_SINGLE_USER`: This mode is for users migrating from legacy Passthrough on standard clusters.
+    * `LEGACY_SINGLE_USER_STANDARD`: This mode provides a way that doesn’t have UC nor passthrough enabled.
+    """
+
+    dependency_mode: VariableOrOptional[DependencyMode] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Controls dependency configuration for the cluster.
+    """
+
+    docker_image: VariableOrOptional[DockerImage] = None
+    """
+    Custom docker image BYOC
+    """
+
+    driver_instance_pool_id: VariableOrOptional[str] = None
+    """
+    The optional ID of the instance pool for the driver of the cluster belongs.
+    The pool cluster uses the instance pool with id (instance_pool_id) if the driver pool is not
+    assigned.
+    """
+
+    driver_node_type_flexibility: VariableOrOptional[NodeTypeFlexibility] = None
+    """
+    Flexible node type configuration for the driver node.
+    """
+
+    driver_node_type_id: VariableOrOptional[str] = None
+    """
+    The node type of the Spark driver.
+    Note that this field is optional; if unset, the driver node type will be set as the same value
+    as `node_type_id` defined above.
+    """
+
+    enable_elastic_disk: VariableOrOptional[bool] = None
+    """
+    Autoscaling Local Storage: when enabled, this cluster will dynamically acquire additional disk
+    space when its Spark workers are running low on disk space.
+    """
+
+    enable_local_disk_encryption: VariableOrOptional[bool] = None
+    """
+    Whether to enable LUKS on cluster VMs' local disks
+    """
+
+    gcp_attributes: VariableOrOptional[GcpAttributes] = None
+    """
+    Attributes related to clusters running on Google Cloud Platform.
+    If not specified at cluster creation, a set of default values will be used.
+    """
+
+    init_scripts: VariableOrList[InitScriptInfo] = field(default_factory=list)
+    """
+    The configuration for storing init scripts. Any number of destinations can be specified.
+    The scripts are executed sequentially in the order provided.
+    If `cluster_log_conf` is specified, init script logs are sent to `<destination>/<cluster-ID>/init_scripts`.
+    """
+
+    instance_pool_id: VariableOrOptional[str] = None
+    """
+    The optional ID of the instance pool to which the cluster belongs.
+    """
+
+    is_single_node: VariableOrOptional[bool] = None
+    """
+    This field can only be used when `kind = CLASSIC_PREVIEW`.
+    
+    When set to true, Databricks will automatically set single node related `custom_tags`, `spark_conf`, and `num_workers`
+    """
+
+    kind: VariableOrOptional[Kind] = None
+    """
+    The kind of compute described by this compute specification.
+    
+    Depending on `kind`, different validations and default values will be applied.
+    
+    Clusters with `kind = CLASSIC_PREVIEW` support the following fields, whereas clusters with no specified `kind` do not.
+    * [is_single_node](/api/workspace/clusters/create#is_single_node)
+    * [use_ml_runtime](/api/workspace/clusters/create#use_ml_runtime)
+    
+    By using the [simple form](https://docs.databricks.com/compute/simple-form.html), your clusters are automatically using `kind = CLASSIC_PREVIEW`.
+    """
+
+    libraries: VariableOrList[Library] = field(default_factory=list)
+    """
+    A list of libraries to install on the cluster. Installed via the Libraries API after the cluster is created.
+    """
+
+    lifecycle: VariableOrOptional[LifecycleWithStarted] = None
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+    node_type_id: VariableOrOptional[str] = None
+    """
+    This field encodes, through a single value, the resources available to each of
+    the Spark nodes in this cluster. For example, the Spark nodes can be provisioned
+    and optimized for memory or compute intensive workloads. A list of available node
+    types can be retrieved by using the [clusters/listNodeTypes](https://docs.databricks.com/api/workspace/clusters/listnodetypes) API call.
+    """
+
+    num_workers: VariableOrOptional[int] = None
+    """
+    Number of worker nodes that this cluster should have. A cluster has one Spark Driver
+    and `num_workers` Executors for a total of `num_workers` + 1 Spark nodes.
+    
+    Note: When reading the properties of a cluster, this field reflects the desired number
+    of workers rather than the actual current number of workers. For instance, if a cluster
+    is resized from 5 to 10 workers, this field will immediately be updated to reflect
+    the target size of 10 workers, whereas the workers listed in `spark_info` will gradually
+    increase from 5 to 10 as the new nodes are provisioned.
+    """
+
+    permissions: VariableOrList[ClusterPermission] = field(default_factory=list)
+    """
+    The permissions to apply to this resource.
+    """
+
+    policy_id: VariableOrOptional[str] = None
+    """
+    The ID of the cluster policy used to create the cluster if applicable.
+    """
+
+    remote_disk_throughput: VariableOrOptional[int] = None
+    """
+    If set, what the configurable throughput (in Mb/s) for the remote disk is. Currently only supported for GCP HYPERDISK_BALANCED disks.
+    """
+
+    runtime_engine: VariableOrOptional[RuntimeEngine] = None
+    """
+    Determines the cluster's runtime engine, either standard or Photon.
+    
+    This field is not compatible with legacy `spark_version` values that contain `-photon-`.
+    Remove `-photon-` from the `spark_version` and set `runtime_engine` to `PHOTON`.
+    
+    If left unspecified, the runtime engine defaults to standard unless the spark_version
+    contains -photon-, in which case Photon will be used.
+    """
+
+    single_user_name: VariableOrOptional[str] = None
+    """
+    Single user name if data_security_mode is `SINGLE_USER`
+    """
+
+    spark_conf: VariableOrDict[str] = field(default_factory=dict)
+    """
+    An object containing a set of optional, user-specified Spark configuration key-value pairs.
+    Users can also pass in a string of extra JVM options to the driver and the executors via
+    `spark.driver.extraJavaOptions` and `spark.executor.extraJavaOptions` respectively.
+    """
+
+    spark_env_vars: VariableOrDict[str] = field(default_factory=dict)
+    """
+    An object containing a set of optional, user-specified environment variable key-value pairs.
+    Please note that key-value pair of the form (X,Y) will be exported as is (i.e.,
+    `export X='Y'`) while launching the driver and workers.
+    
+    In order to specify an additional set of `SPARK_DAEMON_JAVA_OPTS`, we recommend appending
+    them to `$SPARK_DAEMON_JAVA_OPTS` as shown in the example below. This ensures that all
+    default databricks managed environmental variables are included as well.
+    
+    Example Spark environment variables:
+    `{"SPARK_WORKER_MEMORY": "28000m", "SPARK_LOCAL_DIRS": "/local_disk0"}` or
+    `{"SPARK_DAEMON_JAVA_OPTS": "$SPARK_DAEMON_JAVA_OPTS -Dspark.shuffle.service.enabled=true"}`
+    """
+
+    spark_version: VariableOrOptional[str] = None
+    """
+    The Spark version of the cluster, e.g. `3.3.x-scala2.11`.
+    A list of available Spark versions can be retrieved by using
+    the [clusters/sparkVersions](https://docs.databricks.com/api/workspace/clusters/sparkversions) API call.
+    """
+
+    ssh_public_keys: VariableOrList[str] = field(default_factory=list)
+    """
+    SSH public key contents that will be added to each Spark node in this cluster. The
+    corresponding private keys can be used to login with the user name `ubuntu` on port `2200`.
+    Up to 10 keys can be specified.
+    """
+
+    total_initial_remote_disk_size: VariableOrOptional[int] = None
+    """
+    If set, what the total initial volume size (in GB) of the remote disks should be. Supported for GCP.
+    """
+
+    use_ml_runtime: VariableOrOptional[bool] = None
+    """
+    This field can only be used when `kind = CLASSIC_PREVIEW`.
+    
+    `effective_spark_version` is determined by `spark_version` (DBR release), this field `use_ml_runtime`, and whether `node_type_id` is gpu node or not.
+    """
+
+    worker_node_type_flexibility: VariableOrOptional[NodeTypeFlexibility] = None
+    """
+    Flexible node type configuration for worker nodes.
+    """
+
+    workload_type: VariableOrOptional[WorkloadType] = None
+    """
+    Cluster Attributes showing for clusters workload types.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "ClusterDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ClusterDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ClusterDict(TypedDict, total=False):
+    """"""
+
+    apply_policy_default_values: VariableOrOptional[bool]
+    """
+    When set to true, fixed and default values from the policy will be used for fields that are omitted. When set to false, only fixed values from the policy will be applied.
+    """
+
+    autoscale: VariableOrOptional[AutoScaleParam]
+    """
+    Parameters needed in order to automatically scale clusters up and down based on load.
+    Note: autoscaling works best with DB runtime versions 3.0 or later.
+    """
+
+    autotermination_minutes: VariableOrOptional[int]
+    """
+    Automatically terminates the cluster after it is inactive for this time in minutes. If not set,
+    this cluster will not be automatically terminated. If specified, the threshold must be between
+    10 and 10000 minutes.
+    Users can also set this value to 0 to explicitly disable automatic termination.
+    """
+
+    aws_attributes: VariableOrOptional[AwsAttributesParam]
+    """
+    Attributes related to clusters running on Amazon Web Services.
+    If not specified at cluster creation, a set of default values will be used.
+    """
+
+    azure_attributes: VariableOrOptional[AzureAttributesParam]
+    """
+    Attributes related to clusters running on Microsoft Azure.
+    If not specified at cluster creation, a set of default values will be used.
+    """
+
+    cluster_log_conf: VariableOrOptional[ClusterLogConfParam]
+    """
+    The configuration for delivering spark logs to a long-term storage destination.
+    Three kinds of destinations (DBFS, S3 and Unity Catalog volumes) are supported. Only one destination can be specified
+    for one cluster. If the conf is given, the logs will be delivered to the destination every
+    `5 mins`. The destination of driver logs is `$destination/$clusterId/driver`, while
+    the destination of executor logs is `$destination/$clusterId/executor`.
+    """
+
+    cluster_name: VariableOrOptional[str]
+    """
+    Cluster name requested by the user. This doesn't have to be unique.
+    If not specified at creation, the cluster name will be an empty string.
+    For job clusters, the cluster name is automatically set based on the job and job run IDs.
+    """
+
+    custom_tags: VariableOrDict[str]
+    """
+    Additional tags for cluster resources. Databricks will tag all cluster resources (e.g., AWS
+    instances and EBS volumes) with these tags in addition to `default_tags`. Notes:
+    
+    - Currently, Databricks allows at most 45 custom tags
+    
+    - Clusters can only reuse cloud resources if the resources' tags are a subset of the cluster tags
+    """
+
+    data_security_mode: VariableOrOptional[DataSecurityModeParam]
+    """
+    Data security mode decides what data governance model to use when accessing data
+    from a cluster.
+    
+    * `DATA_SECURITY_MODE_AUTO`: Databricks will choose the most appropriate access mode depending on your compute configuration.
+    * `DATA_SECURITY_MODE_STANDARD`: A secure cluster that can be shared by multiple users. Cluster users are fully isolated so that they cannot see each other’s data and credentials. Most data governance features are supported in this mode. But programming languages and cluster features might be limited.
+    * `DATA_SECURITY_MODE_DEDICATED`: A secure cluster that can only be exclusively used by a single user specified in `single_user_name`. Most programming languages, cluster features and data governance features are available in this mode.
+    
+    The following modes are legacy aliases for the above modes:
+    
+    * `USER_ISOLATION`: Legacy alias for `DATA_SECURITY_MODE_STANDARD`.
+    * `SINGLE_USER`: Legacy alias for `DATA_SECURITY_MODE_DEDICATED`.
+    
+    The following modes are deprecated starting with Databricks Runtime 15.0 and
+    will be removed for future Databricks Runtime versions:
+    
+    * `LEGACY_TABLE_ACL`: This mode is for users migrating from legacy Table ACL clusters.
+    * `LEGACY_PASSTHROUGH`: This mode is for users migrating from legacy Passthrough on high concurrency clusters.
+    * `LEGACY_SINGLE_USER`: This mode is for users migrating from legacy Passthrough on standard clusters.
+    * `LEGACY_SINGLE_USER_STANDARD`: This mode provides a way that doesn’t have UC nor passthrough enabled.
+    """
+
+    dependency_mode: VariableOrOptional[DependencyModeParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Controls dependency configuration for the cluster.
+    """
+
+    docker_image: VariableOrOptional[DockerImageParam]
+    """
+    Custom docker image BYOC
+    """
+
+    driver_instance_pool_id: VariableOrOptional[str]
+    """
+    The optional ID of the instance pool for the driver of the cluster belongs.
+    The pool cluster uses the instance pool with id (instance_pool_id) if the driver pool is not
+    assigned.
+    """
+
+    driver_node_type_flexibility: VariableOrOptional[NodeTypeFlexibilityParam]
+    """
+    Flexible node type configuration for the driver node.
+    """
+
+    driver_node_type_id: VariableOrOptional[str]
+    """
+    The node type of the Spark driver.
+    Note that this field is optional; if unset, the driver node type will be set as the same value
+    as `node_type_id` defined above.
+    """
+
+    enable_elastic_disk: VariableOrOptional[bool]
+    """
+    Autoscaling Local Storage: when enabled, this cluster will dynamically acquire additional disk
+    space when its Spark workers are running low on disk space.
+    """
+
+    enable_local_disk_encryption: VariableOrOptional[bool]
+    """
+    Whether to enable LUKS on cluster VMs' local disks
+    """
+
+    gcp_attributes: VariableOrOptional[GcpAttributesParam]
+    """
+    Attributes related to clusters running on Google Cloud Platform.
+    If not specified at cluster creation, a set of default values will be used.
+    """
+
+    init_scripts: VariableOrList[InitScriptInfoParam]
+    """
+    The configuration for storing init scripts. Any number of destinations can be specified.
+    The scripts are executed sequentially in the order provided.
+    If `cluster_log_conf` is specified, init script logs are sent to `<destination>/<cluster-ID>/init_scripts`.
+    """
+
+    instance_pool_id: VariableOrOptional[str]
+    """
+    The optional ID of the instance pool to which the cluster belongs.
+    """
+
+    is_single_node: VariableOrOptional[bool]
+    """
+    This field can only be used when `kind = CLASSIC_PREVIEW`.
+    
+    When set to true, Databricks will automatically set single node related `custom_tags`, `spark_conf`, and `num_workers`
+    """
+
+    kind: VariableOrOptional[KindParam]
+    """
+    The kind of compute described by this compute specification.
+    
+    Depending on `kind`, different validations and default values will be applied.
+    
+    Clusters with `kind = CLASSIC_PREVIEW` support the following fields, whereas clusters with no specified `kind` do not.
+    * [is_single_node](/api/workspace/clusters/create#is_single_node)
+    * [use_ml_runtime](/api/workspace/clusters/create#use_ml_runtime)
+    
+    By using the [simple form](https://docs.databricks.com/compute/simple-form.html), your clusters are automatically using `kind = CLASSIC_PREVIEW`.
+    """
+
+    libraries: VariableOrList[LibraryParam]
+    """
+    A list of libraries to install on the cluster. Installed via the Libraries API after the cluster is created.
+    """
+
+    lifecycle: VariableOrOptional[LifecycleWithStartedParam]
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+    node_type_id: VariableOrOptional[str]
+    """
+    This field encodes, through a single value, the resources available to each of
+    the Spark nodes in this cluster. For example, the Spark nodes can be provisioned
+    and optimized for memory or compute intensive workloads. A list of available node
+    types can be retrieved by using the [clusters/listNodeTypes](https://docs.databricks.com/api/workspace/clusters/listnodetypes) API call.
+    """
+
+    num_workers: VariableOrOptional[int]
+    """
+    Number of worker nodes that this cluster should have. A cluster has one Spark Driver
+    and `num_workers` Executors for a total of `num_workers` + 1 Spark nodes.
+    
+    Note: When reading the properties of a cluster, this field reflects the desired number
+    of workers rather than the actual current number of workers. For instance, if a cluster
+    is resized from 5 to 10 workers, this field will immediately be updated to reflect
+    the target size of 10 workers, whereas the workers listed in `spark_info` will gradually
+    increase from 5 to 10 as the new nodes are provisioned.
+    """
+
+    permissions: VariableOrList[ClusterPermissionParam]
+    """
+    The permissions to apply to this resource.
+    """
+
+    policy_id: VariableOrOptional[str]
+    """
+    The ID of the cluster policy used to create the cluster if applicable.
+    """
+
+    remote_disk_throughput: VariableOrOptional[int]
+    """
+    If set, what the configurable throughput (in Mb/s) for the remote disk is. Currently only supported for GCP HYPERDISK_BALANCED disks.
+    """
+
+    runtime_engine: VariableOrOptional[RuntimeEngineParam]
+    """
+    Determines the cluster's runtime engine, either standard or Photon.
+    
+    This field is not compatible with legacy `spark_version` values that contain `-photon-`.
+    Remove `-photon-` from the `spark_version` and set `runtime_engine` to `PHOTON`.
+    
+    If left unspecified, the runtime engine defaults to standard unless the spark_version
+    contains -photon-, in which case Photon will be used.
+    """
+
+    single_user_name: VariableOrOptional[str]
+    """
+    Single user name if data_security_mode is `SINGLE_USER`
+    """
+
+    spark_conf: VariableOrDict[str]
+    """
+    An object containing a set of optional, user-specified Spark configuration key-value pairs.
+    Users can also pass in a string of extra JVM options to the driver and the executors via
+    `spark.driver.extraJavaOptions` and `spark.executor.extraJavaOptions` respectively.
+    """
+
+    spark_env_vars: VariableOrDict[str]
+    """
+    An object containing a set of optional, user-specified environment variable key-value pairs.
+    Please note that key-value pair of the form (X,Y) will be exported as is (i.e.,
+    `export X='Y'`) while launching the driver and workers.
+    
+    In order to specify an additional set of `SPARK_DAEMON_JAVA_OPTS`, we recommend appending
+    them to `$SPARK_DAEMON_JAVA_OPTS` as shown in the example below. This ensures that all
+    default databricks managed environmental variables are included as well.
+    
+    Example Spark environment variables:
+    `{"SPARK_WORKER_MEMORY": "28000m", "SPARK_LOCAL_DIRS": "/local_disk0"}` or
+    `{"SPARK_DAEMON_JAVA_OPTS": "$SPARK_DAEMON_JAVA_OPTS -Dspark.shuffle.service.enabled=true"}`
+    """
+
+    spark_version: VariableOrOptional[str]
+    """
+    The Spark version of the cluster, e.g. `3.3.x-scala2.11`.
+    A list of available Spark versions can be retrieved by using
+    the [clusters/sparkVersions](https://docs.databricks.com/api/workspace/clusters/sparkversions) API call.
+    """
+
+    ssh_public_keys: VariableOrList[str]
+    """
+    SSH public key contents that will be added to each Spark node in this cluster. The
+    corresponding private keys can be used to login with the user name `ubuntu` on port `2200`.
+    Up to 10 keys can be specified.
+    """
+
+    total_initial_remote_disk_size: VariableOrOptional[int]
+    """
+    If set, what the total initial volume size (in GB) of the remote disks should be. Supported for GCP.
+    """
+
+    use_ml_runtime: VariableOrOptional[bool]
+    """
+    This field can only be used when `kind = CLASSIC_PREVIEW`.
+    
+    `effective_spark_version` is determined by `spark_version` (DBR release), this field `use_ml_runtime`, and whether `node_type_id` is gpu node or not.
+    """
+
+    worker_node_type_flexibility: VariableOrOptional[NodeTypeFlexibilityParam]
+    """
+    Flexible node type configuration for worker nodes.
+    """
+
+    workload_type: VariableOrOptional[WorkloadTypeParam]
+    """
+    Cluster Attributes showing for clusters workload types.
+    """
+
+
+ClusterParam = ClusterDict | Cluster
diff --git a/python/databricks/bundles/clusters/_models/cluster_log_conf.py b/python/databricks/bundles/clusters/_models/cluster_log_conf.py
new file mode 100644
index 00000000000..c087a2ad463
--- /dev/null
+++ b/python/databricks/bundles/clusters/_models/cluster_log_conf.py
@@ -0,0 +1,84 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.clusters._models.dbfs_storage_info import (
+    DbfsStorageInfo,
+    DbfsStorageInfoParam,
+)
+from databricks.bundles.clusters._models.s3_storage_info import (
+    S3StorageInfo,
+    S3StorageInfoParam,
+)
+from databricks.bundles.clusters._models.volumes_storage_info import (
+    VolumesStorageInfo,
+    VolumesStorageInfoParam,
+)
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ClusterLogConf:
+    """
+    Cluster log delivery config
+    """
+
+    dbfs: VariableOrOptional[DbfsStorageInfo] = None
+    """
+    destination needs to be provided. e.g.
+    `{ "dbfs" : { "destination" : "dbfs:/home/cluster_log" } }`
+    """
+
+    s3: VariableOrOptional[S3StorageInfo] = None
+    """
+    destination and either the region or endpoint need to be provided. e.g.
+    `{ "s3": { "destination" : "s3://cluster_log_bucket/prefix", "region" : "us-west-2" } }`
+    Cluster iam role is used to access s3, please make sure the cluster iam role in
+    `instance_profile_arn` has permission to write data to the s3 destination.
+    """
+
+    volumes: VariableOrOptional[VolumesStorageInfo] = None
+    """
+    destination needs to be provided, e.g.
+    `{ "volumes": { "destination": "/Volumes/catalog/schema/volume/cluster_log" } }`
+    """
+
+    @classmethod
+    def from_dict(cls, value: "ClusterLogConfDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ClusterLogConfDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ClusterLogConfDict(TypedDict, total=False):
+    """"""
+
+    dbfs: VariableOrOptional[DbfsStorageInfoParam]
+    """
+    destination needs to be provided. e.g.
+    `{ "dbfs" : { "destination" : "dbfs:/home/cluster_log" } }`
+    """
+
+    s3: VariableOrOptional[S3StorageInfoParam]
+    """
+    destination and either the region or endpoint need to be provided. e.g.
+    `{ "s3": { "destination" : "s3://cluster_log_bucket/prefix", "region" : "us-west-2" } }`
+    Cluster iam role is used to access s3, please make sure the cluster iam role in
+    `instance_profile_arn` has permission to write data to the s3 destination.
+    """
+
+    volumes: VariableOrOptional[VolumesStorageInfoParam]
+    """
+    destination needs to be provided, e.g.
+    `{ "volumes": { "destination": "/Volumes/catalog/schema/volume/cluster_log" } }`
+    """
+
+
+ClusterLogConfParam = ClusterLogConfDict | ClusterLogConf
diff --git a/python/databricks/bundles/clusters/_models/cluster_permission.py b/python/databricks/bundles/clusters/_models/cluster_permission.py
new file mode 100644
index 00000000000..537e136780a
--- /dev/null
+++ b/python/databricks/bundles/clusters/_models/cluster_permission.py
@@ -0,0 +1,74 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.clusters._models.cluster_permission_level import (
+    ClusterPermissionLevel,
+    ClusterPermissionLevelParam,
+)
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ClusterPermission:
+    """"""
+
+    level: VariableOr[ClusterPermissionLevel]
+    """
+    The permission level to apply. The allowed levels depend on the resource type.
+    """
+
+    group_name: VariableOrOptional[str] = None
+    """
+    The name of the group granted the permission level.
+    """
+
+    service_principal_name: VariableOrOptional[str] = None
+    """
+    The name of the service principal granted the permission level.
+    """
+
+    user_name: VariableOrOptional[str] = None
+    """
+    The name of the user granted the permission level.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "ClusterPermissionDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ClusterPermissionDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ClusterPermissionDict(TypedDict, total=False):
+    """"""
+
+    level: VariableOr[ClusterPermissionLevelParam]
+    """
+    The permission level to apply. The allowed levels depend on the resource type.
+    """
+
+    group_name: VariableOrOptional[str]
+    """
+    The name of the group granted the permission level.
+    """
+
+    service_principal_name: VariableOrOptional[str]
+    """
+    The name of the service principal granted the permission level.
+    """
+
+    user_name: VariableOrOptional[str]
+    """
+    The name of the user granted the permission level.
+    """
+
+
+ClusterPermissionParam = ClusterPermissionDict | ClusterPermission
diff --git a/python/databricks/bundles/clusters/_models/cluster_permission_level.py b/python/databricks/bundles/clusters/_models/cluster_permission_level.py
new file mode 100644
index 00000000000..bb8b1347d92
--- /dev/null
+++ b/python/databricks/bundles/clusters/_models/cluster_permission_level.py
@@ -0,0 +1,19 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class ClusterPermissionLevel(Enum):
+    """
+    Permission level
+    """
+
+    CAN_MANAGE = "CAN_MANAGE"
+    CAN_RESTART = "CAN_RESTART"
+    CAN_ATTACH_TO = "CAN_ATTACH_TO"
+
+
+ClusterPermissionLevelParam = (
+    Literal["CAN_MANAGE", "CAN_RESTART", "CAN_ATTACH_TO"] | ClusterPermissionLevel
+)
diff --git a/python/databricks/bundles/clusters/_models/confidential_compute_type.py b/python/databricks/bundles/clusters/_models/confidential_compute_type.py
new file mode 100644
index 00000000000..e881295bd47
--- /dev/null
+++ b/python/databricks/bundles/clusters/_models/confidential_compute_type.py
@@ -0,0 +1,23 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class ConfidentialComputeType(Enum):
+    """
+    :meta private: [EXPERIMENTAL]
+
+    Confidential computing technology for GCP instances.
+    Aligns with gcloud's --confidential-compute-type flag and the REST API's
+    confidentialInstanceConfig.confidentialInstanceType field.
+    See: https://cloud.google.com/confidential-computing/confidential-vm/docs/create-a-confidential-vm-instance
+    """
+
+    CONFIDENTIAL_COMPUTE_TYPE_NONE = "CONFIDENTIAL_COMPUTE_TYPE_NONE"
+    SEV_SNP = "SEV_SNP"
+
+
+ConfidentialComputeTypeParam = (
+    Literal["CONFIDENTIAL_COMPUTE_TYPE_NONE", "SEV_SNP"] | ConfidentialComputeType
+)
diff --git a/python/databricks/bundles/clusters/_models/data_security_mode.py b/python/databricks/bundles/clusters/_models/data_security_mode.py
new file mode 100644
index 00000000000..ae1aafcf085
--- /dev/null
+++ b/python/databricks/bundles/clusters/_models/data_security_mode.py
@@ -0,0 +1,56 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class DataSecurityMode(Enum):
+    """
+    Data security mode decides what data governance model to use when accessing data
+    from a cluster.
+
+    * `DATA_SECURITY_MODE_AUTO`: Databricks will choose the most appropriate access mode depending on your compute configuration.
+    * `DATA_SECURITY_MODE_STANDARD`: A secure cluster that can be shared by multiple users. Cluster users are fully isolated so that they cannot see each other’s data and credentials. Most data governance features are supported in this mode. But programming languages and cluster features might be limited.
+    * `DATA_SECURITY_MODE_DEDICATED`: A secure cluster that can only be exclusively used by a single user specified in `single_user_name`. Most programming languages, cluster features and data governance features are available in this mode.
+
+    The following modes are legacy aliases for the above modes:
+
+    * `USER_ISOLATION`: Legacy alias for `DATA_SECURITY_MODE_STANDARD`.
+    * `SINGLE_USER`: Legacy alias for `DATA_SECURITY_MODE_DEDICATED`.
+
+    The following modes are deprecated starting with Databricks Runtime 15.0 and
+    will be removed for future Databricks Runtime versions:
+
+    * `LEGACY_TABLE_ACL`: This mode is for users migrating from legacy Table ACL clusters.
+    * `LEGACY_PASSTHROUGH`: This mode is for users migrating from legacy Passthrough on high concurrency clusters.
+    * `LEGACY_SINGLE_USER`: This mode is for users migrating from legacy Passthrough on standard clusters.
+    * `LEGACY_SINGLE_USER_STANDARD`: This mode provides a way that doesn’t have UC nor passthrough enabled.
+    """
+
+    NONE = "NONE"
+    SINGLE_USER = "SINGLE_USER"
+    USER_ISOLATION = "USER_ISOLATION"
+    LEGACY_TABLE_ACL = "LEGACY_TABLE_ACL"
+    LEGACY_PASSTHROUGH = "LEGACY_PASSTHROUGH"
+    LEGACY_SINGLE_USER = "LEGACY_SINGLE_USER"
+    LEGACY_SINGLE_USER_STANDARD = "LEGACY_SINGLE_USER_STANDARD"
+    DATA_SECURITY_MODE_STANDARD = "DATA_SECURITY_MODE_STANDARD"
+    DATA_SECURITY_MODE_DEDICATED = "DATA_SECURITY_MODE_DEDICATED"
+    DATA_SECURITY_MODE_AUTO = "DATA_SECURITY_MODE_AUTO"
+
+
+DataSecurityModeParam = (
+    Literal[
+        "NONE",
+        "SINGLE_USER",
+        "USER_ISOLATION",
+        "LEGACY_TABLE_ACL",
+        "LEGACY_PASSTHROUGH",
+        "LEGACY_SINGLE_USER",
+        "LEGACY_SINGLE_USER_STANDARD",
+        "DATA_SECURITY_MODE_STANDARD",
+        "DATA_SECURITY_MODE_DEDICATED",
+        "DATA_SECURITY_MODE_AUTO",
+    ]
+    | DataSecurityMode
+)
diff --git a/python/databricks/bundles/clusters/_models/dbfs_storage_info.py b/python/databricks/bundles/clusters/_models/dbfs_storage_info.py
new file mode 100644
index 00000000000..29744acf26a
--- /dev/null
+++ b/python/databricks/bundles/clusters/_models/dbfs_storage_info.py
@@ -0,0 +1,42 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class DbfsStorageInfo:
+    """
+    A storage location in DBFS
+    """
+
+    destination: VariableOr[str]
+    """
+    dbfs destination, e.g. `dbfs:/my/path`
+    """
+
+    @classmethod
+    def from_dict(cls, value: "DbfsStorageInfoDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "DbfsStorageInfoDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class DbfsStorageInfoDict(TypedDict, total=False):
+    """"""
+
+    destination: VariableOr[str]
+    """
+    dbfs destination, e.g. `dbfs:/my/path`
+    """
+
+
+DbfsStorageInfoParam = DbfsStorageInfoDict | DbfsStorageInfo
diff --git a/python/databricks/bundles/clusters/_models/dependency_mode.py b/python/databricks/bundles/clusters/_models/dependency_mode.py
new file mode 100644
index 00000000000..1fdc22cfa4c
--- /dev/null
+++ b/python/databricks/bundles/clusters/_models/dependency_mode.py
@@ -0,0 +1,28 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class DependencyMode(Enum):
+    """
+    Controls dependency configuration for the cluster.
+
+    * `DEPENDENCY_MODE_AUTO`: Databricks will choose the most appropriate dependency mode based on your compute configuration.
+    * `DEPENDENCY_MODE_ENVIRONMENTS`: Enables a unified dependency management experience across classic and serverless, resulting in increased stability and performance. Supported only on DBR 19+ in Standard access mode.
+    * `DEPENDENCY_MODE_CLUSTER_LIBRARIES`: Legacy mode: dependencies come from cluster libraries and init scripts.
+    """
+
+    DEPENDENCY_MODE_ENVIRONMENTS = "DEPENDENCY_MODE_ENVIRONMENTS"
+    DEPENDENCY_MODE_CLUSTER_LIBRARIES = "DEPENDENCY_MODE_CLUSTER_LIBRARIES"
+    DEPENDENCY_MODE_AUTO = "DEPENDENCY_MODE_AUTO"
+
+
+DependencyModeParam = (
+    Literal[
+        "DEPENDENCY_MODE_ENVIRONMENTS",
+        "DEPENDENCY_MODE_CLUSTER_LIBRARIES",
+        "DEPENDENCY_MODE_AUTO",
+    ]
+    | DependencyMode
+)
diff --git a/python/databricks/bundles/clusters/_models/docker_basic_auth.py b/python/databricks/bundles/clusters/_models/docker_basic_auth.py
new file mode 100644
index 00000000000..552ea90a83b
--- /dev/null
+++ b/python/databricks/bundles/clusters/_models/docker_basic_auth.py
@@ -0,0 +1,50 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class DockerBasicAuth:
+    """"""
+
+    password: VariableOrOptional[str] = None
+    """
+    Password of the user
+    """
+
+    username: VariableOrOptional[str] = None
+    """
+    Name of the user
+    """
+
+    @classmethod
+    def from_dict(cls, value: "DockerBasicAuthDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "DockerBasicAuthDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class DockerBasicAuthDict(TypedDict, total=False):
+    """"""
+
+    password: VariableOrOptional[str]
+    """
+    Password of the user
+    """
+
+    username: VariableOrOptional[str]
+    """
+    Name of the user
+    """
+
+
+DockerBasicAuthParam = DockerBasicAuthDict | DockerBasicAuth
diff --git a/python/databricks/bundles/clusters/_models/docker_image.py b/python/databricks/bundles/clusters/_models/docker_image.py
new file mode 100644
index 00000000000..f7c47633e07
--- /dev/null
+++ b/python/databricks/bundles/clusters/_models/docker_image.py
@@ -0,0 +1,54 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.clusters._models.docker_basic_auth import (
+    DockerBasicAuth,
+    DockerBasicAuthParam,
+)
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class DockerImage:
+    """"""
+
+    basic_auth: VariableOrOptional[DockerBasicAuth] = None
+    """
+    Basic auth with username and password
+    """
+
+    url: VariableOrOptional[str] = None
+    """
+    URL of the docker image.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "DockerImageDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "DockerImageDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class DockerImageDict(TypedDict, total=False):
+    """"""
+
+    basic_auth: VariableOrOptional[DockerBasicAuthParam]
+    """
+    Basic auth with username and password
+    """
+
+    url: VariableOrOptional[str]
+    """
+    URL of the docker image.
+    """
+
+
+DockerImageParam = DockerImageDict | DockerImage
diff --git a/python/databricks/bundles/clusters/_models/ebs_volume_type.py b/python/databricks/bundles/clusters/_models/ebs_volume_type.py
new file mode 100644
index 00000000000..d8f3ef13f89
--- /dev/null
+++ b/python/databricks/bundles/clusters/_models/ebs_volume_type.py
@@ -0,0 +1,19 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class EbsVolumeType(Enum):
+    """
+    All EBS volume types that Databricks supports.
+    See https://aws.amazon.com/ebs/details/ for details.
+    """
+
+    GENERAL_PURPOSE_SSD = "GENERAL_PURPOSE_SSD"
+    THROUGHPUT_OPTIMIZED_HDD = "THROUGHPUT_OPTIMIZED_HDD"
+
+
+EbsVolumeTypeParam = (
+    Literal["GENERAL_PURPOSE_SSD", "THROUGHPUT_OPTIMIZED_HDD"] | EbsVolumeType
+)
diff --git a/python/databricks/bundles/clusters/_models/gcp_attributes.py b/python/databricks/bundles/clusters/_models/gcp_attributes.py
new file mode 100644
index 00000000000..e31188d405e
--- /dev/null
+++ b/python/databricks/bundles/clusters/_models/gcp_attributes.py
@@ -0,0 +1,170 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.clusters._models.confidential_compute_type import (
+    ConfidentialComputeType,
+    ConfidentialComputeTypeParam,
+)
+from databricks.bundles.clusters._models.gcp_availability import (
+    GcpAvailability,
+    GcpAvailabilityParam,
+)
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class GcpAttributes:
+    """
+    Attributes set during cluster creation which are related to GCP.
+    """
+
+    availability: VariableOrOptional[GcpAvailability] = None
+    """
+    This field determines whether the spark executors will be scheduled to run on preemptible
+    VMs, on-demand VMs, or preemptible VMs with a fallback to on-demand VMs if the former is unavailable.
+    """
+
+    boot_disk_size: VariableOrOptional[int] = None
+    """
+    Boot disk size in GB
+    """
+
+    confidential_compute_type: VariableOrOptional[ConfidentialComputeType] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The confidential computing technology for this cluster's instances.
+    Currently only SEV_SNP is supported, and only on N2D instance types.
+    When not set, no confidential computing is applied.
+    """
+
+    first_on_demand: VariableOrOptional[int] = None
+    """
+    The first `first_on_demand` nodes of the cluster will be placed on on-demand instances.
+    This value should be greater than 0, to make sure the cluster driver node is placed on an
+    on-demand instance. If this value is greater than or equal to the current cluster size, all
+    nodes will be placed on on-demand instances. If this value is less than the current cluster
+    size, `first_on_demand` nodes will be placed on on-demand instances and the remainder will
+    be placed on `availability` instances. Note that this value does not affect
+    cluster size and cannot currently be mutated over the lifetime of a cluster.
+    """
+
+    google_service_account: VariableOrOptional[str] = None
+    """
+    If provided, the cluster will impersonate the google service account when accessing
+    gcloud services (like GCS). The google service account
+    must have previously been added to the Databricks environment by an account
+    administrator.
+    """
+
+    local_ssd_count: VariableOrOptional[int] = None
+    """
+    If provided, each node (workers and driver) in the cluster will have this number of local SSDs attached.
+    Each local SSD is 375GB in size.
+    Refer to [GCP documentation](https://cloud.google.com/compute/docs/disks/local-ssd#choose_number_local_ssds)
+    for the supported number of local SSDs for each instance type.
+    """
+
+    use_preemptible_executors: VariableOrOptional[bool] = None
+    """
+    [DEPRECATED] This field determines whether the spark executors will be scheduled to run on preemptible
+    VMs (when set to true) versus standard compute engine VMs (when set to false; default).
+    Note: Soon to be deprecated, use the 'availability' field instead.
+    """
+
+    zone_id: VariableOrOptional[str] = None
+    """
+    Identifier for the availability zone in which the cluster resides.
+    This can be one of the following:
+    - "HA" => High availability, spread nodes across availability zones for a
+    Databricks deployment region [default].
+    - "AUTO" => Databricks picks an availability zone to schedule the cluster on.
+    - A GCP availability zone => Pick One of the available zones for (machine type + region) from
+    https://cloud.google.com/compute/docs/regions-zones.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "GcpAttributesDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "GcpAttributesDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class GcpAttributesDict(TypedDict, total=False):
+    """"""
+
+    availability: VariableOrOptional[GcpAvailabilityParam]
+    """
+    This field determines whether the spark executors will be scheduled to run on preemptible
+    VMs, on-demand VMs, or preemptible VMs with a fallback to on-demand VMs if the former is unavailable.
+    """
+
+    boot_disk_size: VariableOrOptional[int]
+    """
+    Boot disk size in GB
+    """
+
+    confidential_compute_type: VariableOrOptional[ConfidentialComputeTypeParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The confidential computing technology for this cluster's instances.
+    Currently only SEV_SNP is supported, and only on N2D instance types.
+    When not set, no confidential computing is applied.
+    """
+
+    first_on_demand: VariableOrOptional[int]
+    """
+    The first `first_on_demand` nodes of the cluster will be placed on on-demand instances.
+    This value should be greater than 0, to make sure the cluster driver node is placed on an
+    on-demand instance. If this value is greater than or equal to the current cluster size, all
+    nodes will be placed on on-demand instances. If this value is less than the current cluster
+    size, `first_on_demand` nodes will be placed on on-demand instances and the remainder will
+    be placed on `availability` instances. Note that this value does not affect
+    cluster size and cannot currently be mutated over the lifetime of a cluster.
+    """
+
+    google_service_account: VariableOrOptional[str]
+    """
+    If provided, the cluster will impersonate the google service account when accessing
+    gcloud services (like GCS). The google service account
+    must have previously been added to the Databricks environment by an account
+    administrator.
+    """
+
+    local_ssd_count: VariableOrOptional[int]
+    """
+    If provided, each node (workers and driver) in the cluster will have this number of local SSDs attached.
+    Each local SSD is 375GB in size.
+    Refer to [GCP documentation](https://cloud.google.com/compute/docs/disks/local-ssd#choose_number_local_ssds)
+    for the supported number of local SSDs for each instance type.
+    """
+
+    use_preemptible_executors: VariableOrOptional[bool]
+    """
+    [DEPRECATED] This field determines whether the spark executors will be scheduled to run on preemptible
+    VMs (when set to true) versus standard compute engine VMs (when set to false; default).
+    Note: Soon to be deprecated, use the 'availability' field instead.
+    """
+
+    zone_id: VariableOrOptional[str]
+    """
+    Identifier for the availability zone in which the cluster resides.
+    This can be one of the following:
+    - "HA" => High availability, spread nodes across availability zones for a
+    Databricks deployment region [default].
+    - "AUTO" => Databricks picks an availability zone to schedule the cluster on.
+    - A GCP availability zone => Pick One of the available zones for (machine type + region) from
+    https://cloud.google.com/compute/docs/regions-zones.
+    """
+
+
+GcpAttributesParam = GcpAttributesDict | GcpAttributes
diff --git a/python/databricks/bundles/clusters/_models/gcp_availability.py b/python/databricks/bundles/clusters/_models/gcp_availability.py
new file mode 100644
index 00000000000..0d391b87fe3
--- /dev/null
+++ b/python/databricks/bundles/clusters/_models/gcp_availability.py
@@ -0,0 +1,21 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class GcpAvailability(Enum):
+    """
+    This field determines whether the instance pool will contain preemptible
+    VMs, on-demand VMs, or preemptible VMs with a fallback to on-demand VMs if the former is unavailable.
+    """
+
+    PREEMPTIBLE_GCP = "PREEMPTIBLE_GCP"
+    ON_DEMAND_GCP = "ON_DEMAND_GCP"
+    PREEMPTIBLE_WITH_FALLBACK_GCP = "PREEMPTIBLE_WITH_FALLBACK_GCP"
+
+
+GcpAvailabilityParam = (
+    Literal["PREEMPTIBLE_GCP", "ON_DEMAND_GCP", "PREEMPTIBLE_WITH_FALLBACK_GCP"]
+    | GcpAvailability
+)
diff --git a/python/databricks/bundles/clusters/_models/gcs_storage_info.py b/python/databricks/bundles/clusters/_models/gcs_storage_info.py
new file mode 100644
index 00000000000..e8f1059373b
--- /dev/null
+++ b/python/databricks/bundles/clusters/_models/gcs_storage_info.py
@@ -0,0 +1,42 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class GcsStorageInfo:
+    """
+    A storage location in Google Cloud Platform's GCS
+    """
+
+    destination: VariableOr[str]
+    """
+    GCS destination/URI, e.g. `gs://my-bucket/some-prefix`
+    """
+
+    @classmethod
+    def from_dict(cls, value: "GcsStorageInfoDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "GcsStorageInfoDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class GcsStorageInfoDict(TypedDict, total=False):
+    """"""
+
+    destination: VariableOr[str]
+    """
+    GCS destination/URI, e.g. `gs://my-bucket/some-prefix`
+    """
+
+
+GcsStorageInfoParam = GcsStorageInfoDict | GcsStorageInfo
diff --git a/python/databricks/bundles/clusters/_models/init_script_info.py b/python/databricks/bundles/clusters/_models/init_script_info.py
new file mode 100644
index 00000000000..6d78d16bf92
--- /dev/null
+++ b/python/databricks/bundles/clusters/_models/init_script_info.py
@@ -0,0 +1,146 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.clusters._models.adlsgen2_info import (
+    Adlsgen2Info,
+    Adlsgen2InfoParam,
+)
+from databricks.bundles.clusters._models.dbfs_storage_info import (
+    DbfsStorageInfo,
+    DbfsStorageInfoParam,
+)
+from databricks.bundles.clusters._models.gcs_storage_info import (
+    GcsStorageInfo,
+    GcsStorageInfoParam,
+)
+from databricks.bundles.clusters._models.local_file_info import (
+    LocalFileInfo,
+    LocalFileInfoParam,
+)
+from databricks.bundles.clusters._models.s3_storage_info import (
+    S3StorageInfo,
+    S3StorageInfoParam,
+)
+from databricks.bundles.clusters._models.volumes_storage_info import (
+    VolumesStorageInfo,
+    VolumesStorageInfoParam,
+)
+from databricks.bundles.clusters._models.workspace_storage_info import (
+    WorkspaceStorageInfo,
+    WorkspaceStorageInfoParam,
+)
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class InitScriptInfo:
+    """
+    Config for an individual init script
+    """
+
+    abfss: VariableOrOptional[Adlsgen2Info] = None
+    """
+    Contains the Azure Data Lake Storage destination path
+    """
+
+    dbfs: VariableOrOptional[DbfsStorageInfo] = None
+    """
+    [DEPRECATED] destination needs to be provided. e.g.
+    `{ "dbfs": { "destination" : "dbfs:/home/cluster_log" } }`
+    """
+
+    file: VariableOrOptional[LocalFileInfo] = None
+    """
+    destination needs to be provided, e.g.
+    `{ "file": { "destination": "file:/my/local/file.sh" } }`
+    """
+
+    gcs: VariableOrOptional[GcsStorageInfo] = None
+    """
+    destination needs to be provided, e.g.
+    `{ "gcs": { "destination": "gs://my-bucket/file.sh" } }`
+    """
+
+    s3: VariableOrOptional[S3StorageInfo] = None
+    """
+    destination and either the region or endpoint need to be provided. e.g.
+    `{ \"s3\": { \"destination\": \"s3://cluster_log_bucket/prefix\", \"region\": \"us-west-2\" } }`
+    Cluster iam role is used to access s3, please make sure the cluster iam role in
+    `instance_profile_arn` has permission to write data to the s3 destination.
+    """
+
+    volumes: VariableOrOptional[VolumesStorageInfo] = None
+    """
+    destination needs to be provided. e.g.
+    `{ \"volumes\" : { \"destination\" : \"/Volumes/my-init.sh\" } }`
+    """
+
+    workspace: VariableOrOptional[WorkspaceStorageInfo] = None
+    """
+    destination needs to be provided, e.g.
+    `{ "workspace": { "destination": "/cluster-init-scripts/setup-datadog.sh" } }`
+    """
+
+    @classmethod
+    def from_dict(cls, value: "InitScriptInfoDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "InitScriptInfoDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class InitScriptInfoDict(TypedDict, total=False):
+    """"""
+
+    abfss: VariableOrOptional[Adlsgen2InfoParam]
+    """
+    Contains the Azure Data Lake Storage destination path
+    """
+
+    dbfs: VariableOrOptional[DbfsStorageInfoParam]
+    """
+    [DEPRECATED] destination needs to be provided. e.g.
+    `{ "dbfs": { "destination" : "dbfs:/home/cluster_log" } }`
+    """
+
+    file: VariableOrOptional[LocalFileInfoParam]
+    """
+    destination needs to be provided, e.g.
+    `{ "file": { "destination": "file:/my/local/file.sh" } }`
+    """
+
+    gcs: VariableOrOptional[GcsStorageInfoParam]
+    """
+    destination needs to be provided, e.g.
+    `{ "gcs": { "destination": "gs://my-bucket/file.sh" } }`
+    """
+
+    s3: VariableOrOptional[S3StorageInfoParam]
+    """
+    destination and either the region or endpoint need to be provided. e.g.
+    `{ \"s3\": { \"destination\": \"s3://cluster_log_bucket/prefix\", \"region\": \"us-west-2\" } }`
+    Cluster iam role is used to access s3, please make sure the cluster iam role in
+    `instance_profile_arn` has permission to write data to the s3 destination.
+    """
+
+    volumes: VariableOrOptional[VolumesStorageInfoParam]
+    """
+    destination needs to be provided. e.g.
+    `{ \"volumes\" : { \"destination\" : \"/Volumes/my-init.sh\" } }`
+    """
+
+    workspace: VariableOrOptional[WorkspaceStorageInfoParam]
+    """
+    destination needs to be provided, e.g.
+    `{ "workspace": { "destination": "/cluster-init-scripts/setup-datadog.sh" } }`
+    """
+
+
+InitScriptInfoParam = InitScriptInfoDict | InitScriptInfo
diff --git a/python/databricks/bundles/clusters/_models/kind.py b/python/databricks/bundles/clusters/_models/kind.py
new file mode 100644
index 00000000000..8614e25dd52
--- /dev/null
+++ b/python/databricks/bundles/clusters/_models/kind.py
@@ -0,0 +1,23 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class Kind(Enum):
+    """
+    The kind of compute described by this compute specification.
+
+    Depending on `kind`, different validations and default values will be applied.
+
+    Clusters with `kind = CLASSIC_PREVIEW` support the following fields, whereas clusters with no specified `kind` do not.
+    * [is_single_node](/api/workspace/clusters/create#is_single_node)
+    * [use_ml_runtime](/api/workspace/clusters/create#use_ml_runtime)
+
+    By using the [simple form](https://docs.databricks.com/compute/simple-form.html), your clusters are automatically using `kind = CLASSIC_PREVIEW`.
+    """
+
+    CLASSIC_PREVIEW = "CLASSIC_PREVIEW"
+
+
+KindParam = Literal["CLASSIC_PREVIEW"] | Kind
diff --git a/python/databricks/bundles/clusters/_models/library.py b/python/databricks/bundles/clusters/_models/library.py
new file mode 100644
index 00000000000..8961f8fe744
--- /dev/null
+++ b/python/databricks/bundles/clusters/_models/library.py
@@ -0,0 +1,134 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.clusters._models.maven_library import (
+    MavenLibrary,
+    MavenLibraryParam,
+)
+from databricks.bundles.clusters._models.python_py_pi_library import (
+    PythonPyPiLibrary,
+    PythonPyPiLibraryParam,
+)
+from databricks.bundles.clusters._models.r_cran_library import (
+    RCranLibrary,
+    RCranLibraryParam,
+)
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class Library:
+    """"""
+
+    cran: VariableOrOptional[RCranLibrary] = None
+    """
+    Specification of a CRAN library to be installed as part of the library
+    """
+
+    egg: VariableOrOptional[str] = None
+    """
+    [DEPRECATED] Deprecated. URI of the egg library to install. Installing Python egg files is deprecated and is not supported in Databricks Runtime 14.0 and above.
+    """
+
+    jar: VariableOrOptional[str] = None
+    """
+    URI of the JAR library to install. Supported URIs include Workspace paths, Unity Catalog Volumes paths, and S3 URIs.
+    For example: `{ "jar": "/Workspace/path/to/library.jar" }`, `{ "jar" : "/Volumes/path/to/library.jar" }` or
+    `{ "jar": "s3://my-bucket/library.jar" }`.
+    If S3 is used, please make sure the cluster has read access on the library. You may need to
+    launch the cluster with an IAM role to access the S3 URI.
+    """
+
+    maven: VariableOrOptional[MavenLibrary] = None
+    """
+    Specification of a maven library to be installed. For example:
+    `{ "coordinates": "org.jsoup:jsoup:1.7.2" }`
+    """
+
+    pypi: VariableOrOptional[PythonPyPiLibrary] = None
+    """
+    Specification of a PyPi library to be installed. For example:
+    `{ "package": "simplejson" }`
+    """
+
+    requirements: VariableOrOptional[str] = None
+    """
+    URI of the requirements.txt file to install. Only Workspace paths and Unity Catalog Volumes paths are supported.
+    For example: `{ "requirements": "/Workspace/path/to/requirements.txt" }` or `{ "requirements" : "/Volumes/path/to/requirements.txt" }`
+    """
+
+    whl: VariableOrOptional[str] = None
+    """
+    URI of the wheel library to install. Supported URIs include Workspace paths, Unity Catalog Volumes paths, and S3 URIs.
+    For example: `{ "whl": "/Workspace/path/to/library.whl" }`, `{ "whl" : "/Volumes/path/to/library.whl" }` or
+    `{ "whl": "s3://my-bucket/library.whl" }`.
+    If S3 is used, please make sure the cluster has read access on the library. You may need to
+    launch the cluster with an IAM role to access the S3 URI.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "LibraryDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "LibraryDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class LibraryDict(TypedDict, total=False):
+    """"""
+
+    cran: VariableOrOptional[RCranLibraryParam]
+    """
+    Specification of a CRAN library to be installed as part of the library
+    """
+
+    egg: VariableOrOptional[str]
+    """
+    [DEPRECATED] Deprecated. URI of the egg library to install. Installing Python egg files is deprecated and is not supported in Databricks Runtime 14.0 and above.
+    """
+
+    jar: VariableOrOptional[str]
+    """
+    URI of the JAR library to install. Supported URIs include Workspace paths, Unity Catalog Volumes paths, and S3 URIs.
+    For example: `{ "jar": "/Workspace/path/to/library.jar" }`, `{ "jar" : "/Volumes/path/to/library.jar" }` or
+    `{ "jar": "s3://my-bucket/library.jar" }`.
+    If S3 is used, please make sure the cluster has read access on the library. You may need to
+    launch the cluster with an IAM role to access the S3 URI.
+    """
+
+    maven: VariableOrOptional[MavenLibraryParam]
+    """
+    Specification of a maven library to be installed. For example:
+    `{ "coordinates": "org.jsoup:jsoup:1.7.2" }`
+    """
+
+    pypi: VariableOrOptional[PythonPyPiLibraryParam]
+    """
+    Specification of a PyPi library to be installed. For example:
+    `{ "package": "simplejson" }`
+    """
+
+    requirements: VariableOrOptional[str]
+    """
+    URI of the requirements.txt file to install. Only Workspace paths and Unity Catalog Volumes paths are supported.
+    For example: `{ "requirements": "/Workspace/path/to/requirements.txt" }` or `{ "requirements" : "/Volumes/path/to/requirements.txt" }`
+    """
+
+    whl: VariableOrOptional[str]
+    """
+    URI of the wheel library to install. Supported URIs include Workspace paths, Unity Catalog Volumes paths, and S3 URIs.
+    For example: `{ "whl": "/Workspace/path/to/library.whl" }`, `{ "whl" : "/Volumes/path/to/library.whl" }` or
+    `{ "whl": "s3://my-bucket/library.whl" }`.
+    If S3 is used, please make sure the cluster has read access on the library. You may need to
+    launch the cluster with an IAM role to access the S3 URI.
+    """
+
+
+LibraryParam = LibraryDict | Library
diff --git a/python/databricks/bundles/clusters/_models/lifecycle_with_started.py b/python/databricks/bundles/clusters/_models/lifecycle_with_started.py
new file mode 100644
index 00000000000..f9cb9b8d49c
--- /dev/null
+++ b/python/databricks/bundles/clusters/_models/lifecycle_with_started.py
@@ -0,0 +1,50 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class LifecycleWithStarted:
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool] = None
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+    started: VariableOrOptional[bool] = None
+    """
+    Lifecycle setting to deploy the resource in started mode. Only supported for apps, clusters, and sql_warehouses.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "LifecycleWithStartedDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "LifecycleWithStartedDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class LifecycleWithStartedDict(TypedDict, total=False):
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool]
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+    started: VariableOrOptional[bool]
+    """
+    Lifecycle setting to deploy the resource in started mode. Only supported for apps, clusters, and sql_warehouses.
+    """
+
+
+LifecycleWithStartedParam = LifecycleWithStartedDict | LifecycleWithStarted
diff --git a/python/databricks/bundles/clusters/_models/local_file_info.py b/python/databricks/bundles/clusters/_models/local_file_info.py
new file mode 100644
index 00000000000..875f2fe8353
--- /dev/null
+++ b/python/databricks/bundles/clusters/_models/local_file_info.py
@@ -0,0 +1,40 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class LocalFileInfo:
+    """"""
+
+    destination: VariableOr[str]
+    """
+    local file destination, e.g. `file:/my/local/file.sh`
+    """
+
+    @classmethod
+    def from_dict(cls, value: "LocalFileInfoDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "LocalFileInfoDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class LocalFileInfoDict(TypedDict, total=False):
+    """"""
+
+    destination: VariableOr[str]
+    """
+    local file destination, e.g. `file:/my/local/file.sh`
+    """
+
+
+LocalFileInfoParam = LocalFileInfoDict | LocalFileInfo
diff --git a/python/databricks/bundles/clusters/_models/log_analytics_info.py b/python/databricks/bundles/clusters/_models/log_analytics_info.py
new file mode 100644
index 00000000000..67cdf85b2b9
--- /dev/null
+++ b/python/databricks/bundles/clusters/_models/log_analytics_info.py
@@ -0,0 +1,50 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class LogAnalyticsInfo:
+    """"""
+
+    log_analytics_primary_key: VariableOrOptional[str] = None
+    """
+    The primary key for the Azure Log Analytics agent configuration
+    """
+
+    log_analytics_workspace_id: VariableOrOptional[str] = None
+    """
+    The workspace ID for the Azure Log Analytics agent configuration
+    """
+
+    @classmethod
+    def from_dict(cls, value: "LogAnalyticsInfoDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "LogAnalyticsInfoDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class LogAnalyticsInfoDict(TypedDict, total=False):
+    """"""
+
+    log_analytics_primary_key: VariableOrOptional[str]
+    """
+    The primary key for the Azure Log Analytics agent configuration
+    """
+
+    log_analytics_workspace_id: VariableOrOptional[str]
+    """
+    The workspace ID for the Azure Log Analytics agent configuration
+    """
+
+
+LogAnalyticsInfoParam = LogAnalyticsInfoDict | LogAnalyticsInfo
diff --git a/python/databricks/bundles/clusters/_models/maven_library.py b/python/databricks/bundles/clusters/_models/maven_library.py
new file mode 100644
index 00000000000..25be1599c28
--- /dev/null
+++ b/python/databricks/bundles/clusters/_models/maven_library.py
@@ -0,0 +1,72 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import (
+    VariableOr,
+    VariableOrList,
+    VariableOrOptional,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class MavenLibrary:
+    """"""
+
+    coordinates: VariableOr[str]
+    """
+    Gradle-style maven coordinates. For example: "org.jsoup:jsoup:1.7.2".
+    """
+
+    exclusions: VariableOrList[str] = field(default_factory=list)
+    """
+    List of dependences to exclude. For example: `["slf4j:slf4j", "*:hadoop-client"]`.
+    
+    Maven dependency exclusions:
+    https://maven.apache.org/guides/introduction/introduction-to-optional-and-excludes-dependencies.html.
+    """
+
+    repo: VariableOrOptional[str] = None
+    """
+    Maven repo to install the Maven package from. If omitted, both Maven Central Repository
+    and Spark Packages are searched.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "MavenLibraryDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "MavenLibraryDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class MavenLibraryDict(TypedDict, total=False):
+    """"""
+
+    coordinates: VariableOr[str]
+    """
+    Gradle-style maven coordinates. For example: "org.jsoup:jsoup:1.7.2".
+    """
+
+    exclusions: VariableOrList[str]
+    """
+    List of dependences to exclude. For example: `["slf4j:slf4j", "*:hadoop-client"]`.
+    
+    Maven dependency exclusions:
+    https://maven.apache.org/guides/introduction/introduction-to-optional-and-excludes-dependencies.html.
+    """
+
+    repo: VariableOrOptional[str]
+    """
+    Maven repo to install the Maven package from. If omitted, both Maven Central Repository
+    and Spark Packages are searched.
+    """
+
+
+MavenLibraryParam = MavenLibraryDict | MavenLibrary
diff --git a/python/databricks/bundles/clusters/_models/node_type_flexibility.py b/python/databricks/bundles/clusters/_models/node_type_flexibility.py
new file mode 100644
index 00000000000..418ea9337bd
--- /dev/null
+++ b/python/databricks/bundles/clusters/_models/node_type_flexibility.py
@@ -0,0 +1,54 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class NodeTypeFlexibility:
+    """
+    Configuration for flexible node types, allowing fallback to alternate node types during cluster launch and upscale.
+    """
+
+    alternate_node_type_ids: VariableOrList[str] = field(default_factory=list)
+    """
+    A list of node type IDs to use as fallbacks when the primary node type is unavailable.
+    """
+
+    aws_context_id: VariableOrOptional[str] = None
+    """
+    The AWS Context ID for EC2 Fleet.
+    When set (non-empty), the value is passed to AWS CreateFleet API to create the EC2 Fleet.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "NodeTypeFlexibilityDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "NodeTypeFlexibilityDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class NodeTypeFlexibilityDict(TypedDict, total=False):
+    """"""
+
+    alternate_node_type_ids: VariableOrList[str]
+    """
+    A list of node type IDs to use as fallbacks when the primary node type is unavailable.
+    """
+
+    aws_context_id: VariableOrOptional[str]
+    """
+    The AWS Context ID for EC2 Fleet.
+    When set (non-empty), the value is passed to AWS CreateFleet API to create the EC2 Fleet.
+    """
+
+
+NodeTypeFlexibilityParam = NodeTypeFlexibilityDict | NodeTypeFlexibility
diff --git a/python/databricks/bundles/clusters/_models/python_py_pi_library.py b/python/databricks/bundles/clusters/_models/python_py_pi_library.py
new file mode 100644
index 00000000000..037c2029f50
--- /dev/null
+++ b/python/databricks/bundles/clusters/_models/python_py_pi_library.py
@@ -0,0 +1,54 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class PythonPyPiLibrary:
+    """"""
+
+    package: VariableOr[str]
+    """
+    The name of the pypi package to install. An optional exact version specification is also
+    supported. Examples: "simplejson" and "simplejson==3.8.0".
+    """
+
+    repo: VariableOrOptional[str] = None
+    """
+    The repository where the package can be found. If not specified, the default pip index is
+    used.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "PythonPyPiLibraryDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "PythonPyPiLibraryDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class PythonPyPiLibraryDict(TypedDict, total=False):
+    """"""
+
+    package: VariableOr[str]
+    """
+    The name of the pypi package to install. An optional exact version specification is also
+    supported. Examples: "simplejson" and "simplejson==3.8.0".
+    """
+
+    repo: VariableOrOptional[str]
+    """
+    The repository where the package can be found. If not specified, the default pip index is
+    used.
+    """
+
+
+PythonPyPiLibraryParam = PythonPyPiLibraryDict | PythonPyPiLibrary
diff --git a/python/databricks/bundles/clusters/_models/r_cran_library.py b/python/databricks/bundles/clusters/_models/r_cran_library.py
new file mode 100644
index 00000000000..0bd2c4d5296
--- /dev/null
+++ b/python/databricks/bundles/clusters/_models/r_cran_library.py
@@ -0,0 +1,50 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class RCranLibrary:
+    """"""
+
+    package: VariableOr[str]
+    """
+    The name of the CRAN package to install.
+    """
+
+    repo: VariableOrOptional[str] = None
+    """
+    The repository where the package can be found. If not specified, the default CRAN repo is used.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "RCranLibraryDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "RCranLibraryDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class RCranLibraryDict(TypedDict, total=False):
+    """"""
+
+    package: VariableOr[str]
+    """
+    The name of the CRAN package to install.
+    """
+
+    repo: VariableOrOptional[str]
+    """
+    The repository where the package can be found. If not specified, the default CRAN repo is used.
+    """
+
+
+RCranLibraryParam = RCranLibraryDict | RCranLibrary
diff --git a/python/databricks/bundles/clusters/_models/runtime_engine.py b/python/databricks/bundles/clusters/_models/runtime_engine.py
new file mode 100644
index 00000000000..2e1559fa801
--- /dev/null
+++ b/python/databricks/bundles/clusters/_models/runtime_engine.py
@@ -0,0 +1,13 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class RuntimeEngine(Enum):
+    NULL = "NULL"
+    STANDARD = "STANDARD"
+    PHOTON = "PHOTON"
+
+
+RuntimeEngineParam = Literal["NULL", "STANDARD", "PHOTON"] | RuntimeEngine
diff --git a/python/databricks/bundles/clusters/_models/s3_storage_info.py b/python/databricks/bundles/clusters/_models/s3_storage_info.py
new file mode 100644
index 00000000000..071abd5b6f3
--- /dev/null
+++ b/python/databricks/bundles/clusters/_models/s3_storage_info.py
@@ -0,0 +1,124 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class S3StorageInfo:
+    """
+    A storage location in Amazon S3
+    """
+
+    destination: VariableOr[str]
+    """
+    S3 destination, e.g. `s3://my-bucket/some-prefix` Note that logs will be delivered using
+    cluster iam role, please make sure you set cluster iam role and the role has write access to the
+    destination. Please also note that you cannot use AWS keys to deliver logs.
+    """
+
+    canned_acl: VariableOrOptional[str] = None
+    """
+    (Optional) Set canned access control list for the logs, e.g. `bucket-owner-full-control`.
+    If `canned_cal` is set, please make sure the cluster iam role has `s3:PutObjectAcl` permission on
+    the destination bucket and prefix. The full list of possible canned acl can be found at
+    http://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl.
+    Please also note that by default only the object owner gets full controls. If you are using cross account
+    role for writing data, you may want to set `bucket-owner-full-control` to make bucket owner able to
+    read the logs.
+    """
+
+    enable_encryption: VariableOrOptional[bool] = None
+    """
+    (Optional) Flag to enable server side encryption, `false` by default.
+    """
+
+    encryption_type: VariableOrOptional[str] = None
+    """
+    (Optional) The encryption type, it could be `sse-s3` or `sse-kms`. It will be used only when
+    encryption is enabled and the default type is `sse-s3`.
+    """
+
+    endpoint: VariableOrOptional[str] = None
+    """
+    S3 endpoint, e.g. `https://s3-us-west-2.amazonaws.com`. Either region or endpoint needs to be set.
+    If both are set, endpoint will be used.
+    """
+
+    kms_key: VariableOrOptional[str] = None
+    """
+    (Optional) Kms key which will be used if encryption is enabled and encryption type is set to `sse-kms`.
+    """
+
+    region: VariableOrOptional[str] = None
+    """
+    S3 region, e.g. `us-west-2`. Either region or endpoint needs to be set. If both are set,
+    endpoint will be used.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "S3StorageInfoDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "S3StorageInfoDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class S3StorageInfoDict(TypedDict, total=False):
+    """"""
+
+    destination: VariableOr[str]
+    """
+    S3 destination, e.g. `s3://my-bucket/some-prefix` Note that logs will be delivered using
+    cluster iam role, please make sure you set cluster iam role and the role has write access to the
+    destination. Please also note that you cannot use AWS keys to deliver logs.
+    """
+
+    canned_acl: VariableOrOptional[str]
+    """
+    (Optional) Set canned access control list for the logs, e.g. `bucket-owner-full-control`.
+    If `canned_cal` is set, please make sure the cluster iam role has `s3:PutObjectAcl` permission on
+    the destination bucket and prefix. The full list of possible canned acl can be found at
+    http://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl.
+    Please also note that by default only the object owner gets full controls. If you are using cross account
+    role for writing data, you may want to set `bucket-owner-full-control` to make bucket owner able to
+    read the logs.
+    """
+
+    enable_encryption: VariableOrOptional[bool]
+    """
+    (Optional) Flag to enable server side encryption, `false` by default.
+    """
+
+    encryption_type: VariableOrOptional[str]
+    """
+    (Optional) The encryption type, it could be `sse-s3` or `sse-kms`. It will be used only when
+    encryption is enabled and the default type is `sse-s3`.
+    """
+
+    endpoint: VariableOrOptional[str]
+    """
+    S3 endpoint, e.g. `https://s3-us-west-2.amazonaws.com`. Either region or endpoint needs to be set.
+    If both are set, endpoint will be used.
+    """
+
+    kms_key: VariableOrOptional[str]
+    """
+    (Optional) Kms key which will be used if encryption is enabled and encryption type is set to `sse-kms`.
+    """
+
+    region: VariableOrOptional[str]
+    """
+    S3 region, e.g. `us-west-2`. Either region or endpoint needs to be set. If both are set,
+    endpoint will be used.
+    """
+
+
+S3StorageInfoParam = S3StorageInfoDict | S3StorageInfo
diff --git a/python/databricks/bundles/clusters/_models/volumes_storage_info.py b/python/databricks/bundles/clusters/_models/volumes_storage_info.py
new file mode 100644
index 00000000000..1eb4fff7bc2
--- /dev/null
+++ b/python/databricks/bundles/clusters/_models/volumes_storage_info.py
@@ -0,0 +1,44 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class VolumesStorageInfo:
+    """
+    A storage location back by UC Volumes.
+    """
+
+    destination: VariableOr[str]
+    """
+    UC Volumes destination, e.g. `/Volumes/catalog/schema/vol1/init-scripts/setup-datadog.sh`
+    or `dbfs:/Volumes/catalog/schema/vol1/init-scripts/setup-datadog.sh`
+    """
+
+    @classmethod
+    def from_dict(cls, value: "VolumesStorageInfoDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "VolumesStorageInfoDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class VolumesStorageInfoDict(TypedDict, total=False):
+    """"""
+
+    destination: VariableOr[str]
+    """
+    UC Volumes destination, e.g. `/Volumes/catalog/schema/vol1/init-scripts/setup-datadog.sh`
+    or `dbfs:/Volumes/catalog/schema/vol1/init-scripts/setup-datadog.sh`
+    """
+
+
+VolumesStorageInfoParam = VolumesStorageInfoDict | VolumesStorageInfo
diff --git a/python/databricks/bundles/clusters/_models/workload_type.py b/python/databricks/bundles/clusters/_models/workload_type.py
new file mode 100644
index 00000000000..6760e7d7edd
--- /dev/null
+++ b/python/databricks/bundles/clusters/_models/workload_type.py
@@ -0,0 +1,46 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.clusters._models.clients_types import (
+    ClientsTypes,
+    ClientsTypesParam,
+)
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class WorkloadType:
+    """
+    Cluster Attributes showing for clusters workload types.
+    """
+
+    clients: VariableOr[ClientsTypes]
+    """
+    defined what type of clients can use the cluster. E.g. Notebooks, Jobs
+    """
+
+    @classmethod
+    def from_dict(cls, value: "WorkloadTypeDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "WorkloadTypeDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class WorkloadTypeDict(TypedDict, total=False):
+    """"""
+
+    clients: VariableOr[ClientsTypesParam]
+    """
+    defined what type of clients can use the cluster. E.g. Notebooks, Jobs
+    """
+
+
+WorkloadTypeParam = WorkloadTypeDict | WorkloadType
diff --git a/python/databricks/bundles/clusters/_models/workspace_storage_info.py b/python/databricks/bundles/clusters/_models/workspace_storage_info.py
new file mode 100644
index 00000000000..49aef9256c8
--- /dev/null
+++ b/python/databricks/bundles/clusters/_models/workspace_storage_info.py
@@ -0,0 +1,42 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class WorkspaceStorageInfo:
+    """
+    A storage location in Workspace Filesystem (WSFS)
+    """
+
+    destination: VariableOr[str]
+    """
+    wsfs destination, e.g. `workspace:/cluster-init-scripts/setup-datadog.sh`
+    """
+
+    @classmethod
+    def from_dict(cls, value: "WorkspaceStorageInfoDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "WorkspaceStorageInfoDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class WorkspaceStorageInfoDict(TypedDict, total=False):
+    """"""
+
+    destination: VariableOr[str]
+    """
+    wsfs destination, e.g. `workspace:/cluster-init-scripts/setup-datadog.sh`
+    """
+
+
+WorkspaceStorageInfoParam = WorkspaceStorageInfoDict | WorkspaceStorageInfo
diff --git a/python/databricks/bundles/core/__init__.py b/python/databricks/bundles/core/__init__.py
index 5c525861ac8..b40cb9f9684 100644
--- a/python/databricks/bundles/core/__init__.py
+++ b/python/databricks/bundles/core/__init__.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 __all__ = [
     "Bundle",
     "Diagnostic",
@@ -12,14 +14,41 @@
     "VariableOrDict",
     "VariableOrList",
     "VariableOrOptional",
+    "alert_mutator",
+    "app_mutator",
+    "catalog_mutator",
+    "cluster_mutator",
+    "cluster_policy_mutator",
+    "dashboard_mutator",
+    "database_catalog_mutator",
+    "database_instance_mutator",
+    "external_location_mutator",
+    "feature_mutator",
+    "genie_space_mutator",
+    "instance_pool_mutator",
     "job_mutator",
+    "job_run_mutator",
     "load_resources_from_current_package_module",
     "load_resources_from_module",
     "load_resources_from_modules",
     "load_resources_from_package_module",
+    "mcp_service_mutator",
+    "mlflow_experiment_mutator",
+    "mlflow_model_mutator",
+    "model_provider_service_mutator",
+    "model_service_mutator",
+    "model_serving_endpoint_mutator",
     "pipeline_mutator",
+    "quality_monitor_mutator",
+    "registered_model_mutator",
     "schema_mutator",
+    "secret_mutator",
+    "secret_scope_mutator",
+    "sql_warehouse_mutator",
+    "synced_database_table_mutator",
     "variables",
+    "vector_search_endpoint_mutator",
+    "vector_search_index_mutator",
     "volume_mutator",
 ]
 
@@ -29,6 +58,39 @@
     Diagnostics,
     Severity,
 )
+from databricks.bundles.core._generated import (
+    alert_mutator,
+    app_mutator,
+    catalog_mutator,
+    cluster_mutator,
+    cluster_policy_mutator,
+    dashboard_mutator,
+    database_catalog_mutator,
+    database_instance_mutator,
+    external_location_mutator,
+    feature_mutator,
+    genie_space_mutator,
+    instance_pool_mutator,
+    job_mutator,
+    job_run_mutator,
+    mcp_service_mutator,
+    mlflow_experiment_mutator,
+    mlflow_model_mutator,
+    model_provider_service_mutator,
+    model_service_mutator,
+    model_serving_endpoint_mutator,
+    pipeline_mutator,
+    quality_monitor_mutator,
+    registered_model_mutator,
+    schema_mutator,
+    secret_mutator,
+    secret_scope_mutator,
+    sql_warehouse_mutator,
+    synced_database_table_mutator,
+    vector_search_endpoint_mutator,
+    vector_search_index_mutator,
+    volume_mutator,
+)
 from databricks.bundles.core._load import (
     load_resources_from_current_package_module,
     load_resources_from_module,
@@ -37,13 +99,7 @@
 )
 from databricks.bundles.core._location import Location
 from databricks.bundles.core._resource import Resource
-from databricks.bundles.core._resource_mutator import (
-    ResourceMutator,
-    job_mutator,
-    pipeline_mutator,
-    schema_mutator,
-    volume_mutator,
-)
+from databricks.bundles.core._resource_mutator import ResourceMutator
 from databricks.bundles.core._resources import Resources
 from databricks.bundles.core._variable import (
     Variable,
diff --git a/python/databricks/bundles/core/_generated/__init__.py b/python/databricks/bundles/core/_generated/__init__.py
new file mode 100644
index 00000000000..6a56d2eb856
--- /dev/null
+++ b/python/databricks/bundles/core/_generated/__init__.py
@@ -0,0 +1,255 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from typing import TYPE_CHECKING
+
+from databricks.bundles.core._generated.alerts import _AlertResources, alert_mutator
+from databricks.bundles.core._generated.apps import _AppResources, app_mutator
+from databricks.bundles.core._generated.catalogs import (
+    _CatalogResources,
+    catalog_mutator,
+)
+from databricks.bundles.core._generated.cluster_policies import (
+    _ClusterPolicyResources,
+    cluster_policy_mutator,
+)
+from databricks.bundles.core._generated.clusters import (
+    _ClusterResources,
+    cluster_mutator,
+)
+from databricks.bundles.core._generated.dashboards import (
+    _DashboardResources,
+    dashboard_mutator,
+)
+from databricks.bundles.core._generated.database_catalogs import (
+    _DatabaseCatalogResources,
+    database_catalog_mutator,
+)
+from databricks.bundles.core._generated.database_instances import (
+    _DatabaseInstanceResources,
+    database_instance_mutator,
+)
+from databricks.bundles.core._generated.experiments import (
+    _MlflowExperimentResources,
+    mlflow_experiment_mutator,
+)
+from databricks.bundles.core._generated.external_locations import (
+    _ExternalLocationResources,
+    external_location_mutator,
+)
+from databricks.bundles.core._generated.features import (
+    _FeatureResources,
+    feature_mutator,
+)
+from databricks.bundles.core._generated.genie_spaces import (
+    _GenieSpaceResources,
+    genie_space_mutator,
+)
+from databricks.bundles.core._generated.instance_pools import (
+    _InstancePoolResources,
+    instance_pool_mutator,
+)
+from databricks.bundles.core._generated.job_runs import (
+    _JobRunResources,
+    job_run_mutator,
+)
+from databricks.bundles.core._generated.jobs import _JobResources, job_mutator
+from databricks.bundles.core._generated.mcp_services import (
+    _McpServiceResources,
+    mcp_service_mutator,
+)
+from databricks.bundles.core._generated.model_provider_services import (
+    _ModelProviderServiceResources,
+    model_provider_service_mutator,
+)
+from databricks.bundles.core._generated.model_services import (
+    _ModelServiceResources,
+    model_service_mutator,
+)
+from databricks.bundles.core._generated.model_serving_endpoints import (
+    _ModelServingEndpointResources,
+    model_serving_endpoint_mutator,
+)
+from databricks.bundles.core._generated.models import (
+    _MlflowModelResources,
+    mlflow_model_mutator,
+)
+from databricks.bundles.core._generated.pipelines import (
+    _PipelineResources,
+    pipeline_mutator,
+)
+from databricks.bundles.core._generated.quality_monitors import (
+    _QualityMonitorResources,
+    quality_monitor_mutator,
+)
+from databricks.bundles.core._generated.registered_models import (
+    _RegisteredModelResources,
+    registered_model_mutator,
+)
+from databricks.bundles.core._generated.schemas import _SchemaResources, schema_mutator
+from databricks.bundles.core._generated.secret_scopes import (
+    _SecretScopeResources,
+    secret_scope_mutator,
+)
+from databricks.bundles.core._generated.secrets import _SecretResources, secret_mutator
+from databricks.bundles.core._generated.sql_warehouses import (
+    _SqlWarehouseResources,
+    sql_warehouse_mutator,
+)
+from databricks.bundles.core._generated.synced_database_tables import (
+    _SyncedDatabaseTableResources,
+    synced_database_table_mutator,
+)
+from databricks.bundles.core._generated.vector_search_endpoints import (
+    _VectorSearchEndpointResources,
+    vector_search_endpoint_mutator,
+)
+from databricks.bundles.core._generated.vector_search_indexes import (
+    _VectorSearchIndexResources,
+    vector_search_index_mutator,
+)
+from databricks.bundles.core._generated.volumes import _VolumeResources, volume_mutator
+
+if TYPE_CHECKING:
+    from databricks.bundles.core._resource_type import _ResourceType
+
+__all__ = [
+    "_GeneratedResources",
+    "_all_resource_types",
+    "alert_mutator",
+    "app_mutator",
+    "catalog_mutator",
+    "cluster_mutator",
+    "cluster_policy_mutator",
+    "dashboard_mutator",
+    "database_catalog_mutator",
+    "database_instance_mutator",
+    "external_location_mutator",
+    "feature_mutator",
+    "genie_space_mutator",
+    "instance_pool_mutator",
+    "job_mutator",
+    "job_run_mutator",
+    "mcp_service_mutator",
+    "mlflow_experiment_mutator",
+    "mlflow_model_mutator",
+    "model_provider_service_mutator",
+    "model_service_mutator",
+    "model_serving_endpoint_mutator",
+    "pipeline_mutator",
+    "quality_monitor_mutator",
+    "registered_model_mutator",
+    "schema_mutator",
+    "secret_mutator",
+    "secret_scope_mutator",
+    "sql_warehouse_mutator",
+    "synced_database_table_mutator",
+    "vector_search_endpoint_mutator",
+    "vector_search_index_mutator",
+    "volume_mutator",
+]
+
+
+class _GeneratedResources(
+    _AlertResources,
+    _AppResources,
+    _CatalogResources,
+    _ClusterPolicyResources,
+    _ClusterResources,
+    _DashboardResources,
+    _DatabaseCatalogResources,
+    _DatabaseInstanceResources,
+    _MlflowExperimentResources,
+    _ExternalLocationResources,
+    _FeatureResources,
+    _GenieSpaceResources,
+    _InstancePoolResources,
+    _JobRunResources,
+    _JobResources,
+    _McpServiceResources,
+    _ModelProviderServiceResources,
+    _ModelServiceResources,
+    _ModelServingEndpointResources,
+    _MlflowModelResources,
+    _PipelineResources,
+    _QualityMonitorResources,
+    _RegisteredModelResources,
+    _SchemaResources,
+    _SecretScopeResources,
+    _SecretResources,
+    _SqlWarehouseResources,
+    _SyncedDatabaseTableResources,
+    _VectorSearchEndpointResources,
+    _VectorSearchIndexResources,
+    _VolumeResources,
+):
+    pass
+
+
+def _all_resource_types() -> "tuple[_ResourceType, ...]":
+    from databricks.bundles.core._generated import (
+        alerts,
+        apps,
+        catalogs,
+        cluster_policies,
+        clusters,
+        dashboards,
+        database_catalogs,
+        database_instances,
+        experiments,
+        external_locations,
+        features,
+        genie_spaces,
+        instance_pools,
+        job_runs,
+        jobs,
+        mcp_services,
+        model_provider_services,
+        model_services,
+        model_serving_endpoints,
+        models,
+        pipelines,
+        quality_monitors,
+        registered_models,
+        schemas,
+        secret_scopes,
+        secrets,
+        sql_warehouses,
+        synced_database_tables,
+        vector_search_endpoints,
+        vector_search_indexes,
+        volumes,
+    )
+
+    return (
+        alerts._resource_type(),
+        apps._resource_type(),
+        catalogs._resource_type(),
+        cluster_policies._resource_type(),
+        clusters._resource_type(),
+        dashboards._resource_type(),
+        database_catalogs._resource_type(),
+        database_instances._resource_type(),
+        experiments._resource_type(),
+        external_locations._resource_type(),
+        features._resource_type(),
+        genie_spaces._resource_type(),
+        instance_pools._resource_type(),
+        job_runs._resource_type(),
+        jobs._resource_type(),
+        mcp_services._resource_type(),
+        model_provider_services._resource_type(),
+        model_services._resource_type(),
+        model_serving_endpoints._resource_type(),
+        models._resource_type(),
+        pipelines._resource_type(),
+        quality_monitors._resource_type(),
+        registered_models._resource_type(),
+        schemas._resource_type(),
+        secret_scopes._resource_type(),
+        secrets._resource_type(),
+        sql_warehouses._resource_type(),
+        synced_database_tables._resource_type(),
+        vector_search_endpoints._resource_type(),
+        vector_search_indexes._resource_type(),
+        volumes._resource_type(),
+    )
diff --git a/python/databricks/bundles/core/_generated/alerts.py b/python/databricks/bundles/core/_generated/alerts.py
new file mode 100644
index 00000000000..94e4af9a136
--- /dev/null
+++ b/python/databricks/bundles/core/_generated/alerts.py
@@ -0,0 +1,115 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from collections.abc import Callable
+from typing import TYPE_CHECKING, Optional, overload
+
+from databricks.bundles.core._bundle import Bundle
+from databricks.bundles.core._location import Location
+from databricks.bundles.core._resource_mutator import ResourceMutator
+from databricks.bundles.core._transform import _transform
+
+if TYPE_CHECKING:
+    from databricks.bundles.alerts._models.alert import Alert, AlertParam
+    from databricks.bundles.core._resource_type import _ResourceType
+
+
+def _resource_type() -> "_ResourceType":
+    from databricks.bundles.alerts._models.alert import Alert
+    from databricks.bundles.core._resource_type import _ResourceType
+
+    return _ResourceType(
+        resource_type=Alert,
+        singular_name="alert",
+        plural_name="alerts",
+    )
+
+
+class _AlertResources:
+    """
+    Generated alert accessors, mixed into Resources.
+    """
+
+    # Provided by the Resources subclass; declared here so the generated methods
+    # below type-check.
+    _resources: dict[str, dict]
+
+    if TYPE_CHECKING:
+
+        def add_location(self, path: tuple[str, ...], location: Location) -> None: ...
+
+        def add_diagnostic_error(
+            self,
+            msg: str,
+            *,
+            detail: Optional[str] = None,
+            path: Optional[tuple[str, ...]] = None,
+            location: Optional[Location] = None,
+        ) -> None: ...
+
+    @property
+    def alerts(self) -> dict[str, "Alert"]:
+        return self._resources["alerts"]
+
+    def add_alert(
+        self,
+        resource_name: str,
+        alert: "AlertParam",
+        *,
+        location: Optional[Location] = None,
+    ) -> None:
+        """
+        Adds the resource alert to the collection of resources. Resource name must be unique across all alerts.
+
+        :param resource_name: unique identifier for the alert
+        :param alert: the alert to add, can be Alert or dict
+        :param location: optional location of the alert in the source code
+        """
+        from databricks.bundles.alerts._models.alert import Alert
+
+        alert = _transform(Alert, alert)
+        path = ("resources", "alerts", resource_name)
+        location = location or Location.from_stack_frame(depth=1)
+
+        if self._resources["alerts"].get(resource_name):
+            self.add_diagnostic_error(
+                msg=f"Duplicate resource name '{resource_name}' for resource 'alert'. Resource names must be unique.",
+                location=location,
+                path=path,
+            )
+        else:
+            if location:
+                self.add_location(path, location)
+
+            self._resources["alerts"][resource_name] = alert
+
+
+@overload
+def alert_mutator(
+    function: Callable[[Bundle, "Alert"], "Alert"],
+) -> ResourceMutator["Alert"]: ...
+
+
+@overload
+def alert_mutator(
+    function: Callable[["Alert"], "Alert"],
+) -> ResourceMutator["Alert"]: ...
+
+
+def alert_mutator(function: Callable) -> ResourceMutator["Alert"]:
+    """
+    Decorator for defining mutator for alerts. Function should return a new instance of the alert
+    with the desired changes, instead of mutating the input alert.
+
+    Example:
+
+    .. code-block:: python
+
+        @alert_mutator
+        def my_alert_mutator(bundle: Bundle, alert: Alert) -> Alert:
+            return replace(alert, ...)
+
+    :param function: Function that mutates alerts.
+    """
+    from databricks.bundles.alerts._models.alert import Alert
+
+    return ResourceMutator(resource_type=Alert, function=function)
diff --git a/python/databricks/bundles/core/_generated/apps.py b/python/databricks/bundles/core/_generated/apps.py
new file mode 100644
index 00000000000..51d14e2c602
--- /dev/null
+++ b/python/databricks/bundles/core/_generated/apps.py
@@ -0,0 +1,115 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from collections.abc import Callable
+from typing import TYPE_CHECKING, Optional, overload
+
+from databricks.bundles.core._bundle import Bundle
+from databricks.bundles.core._location import Location
+from databricks.bundles.core._resource_mutator import ResourceMutator
+from databricks.bundles.core._transform import _transform
+
+if TYPE_CHECKING:
+    from databricks.bundles.apps._models.app import App, AppParam
+    from databricks.bundles.core._resource_type import _ResourceType
+
+
+def _resource_type() -> "_ResourceType":
+    from databricks.bundles.apps._models.app import App
+    from databricks.bundles.core._resource_type import _ResourceType
+
+    return _ResourceType(
+        resource_type=App,
+        singular_name="app",
+        plural_name="apps",
+    )
+
+
+class _AppResources:
+    """
+    Generated app accessors, mixed into Resources.
+    """
+
+    # Provided by the Resources subclass; declared here so the generated methods
+    # below type-check.
+    _resources: dict[str, dict]
+
+    if TYPE_CHECKING:
+
+        def add_location(self, path: tuple[str, ...], location: Location) -> None: ...
+
+        def add_diagnostic_error(
+            self,
+            msg: str,
+            *,
+            detail: Optional[str] = None,
+            path: Optional[tuple[str, ...]] = None,
+            location: Optional[Location] = None,
+        ) -> None: ...
+
+    @property
+    def apps(self) -> dict[str, "App"]:
+        return self._resources["apps"]
+
+    def add_app(
+        self,
+        resource_name: str,
+        app: "AppParam",
+        *,
+        location: Optional[Location] = None,
+    ) -> None:
+        """
+        Adds the resource app to the collection of resources. Resource name must be unique across all apps.
+
+        :param resource_name: unique identifier for the app
+        :param app: the app to add, can be App or dict
+        :param location: optional location of the app in the source code
+        """
+        from databricks.bundles.apps._models.app import App
+
+        app = _transform(App, app)
+        path = ("resources", "apps", resource_name)
+        location = location or Location.from_stack_frame(depth=1)
+
+        if self._resources["apps"].get(resource_name):
+            self.add_diagnostic_error(
+                msg=f"Duplicate resource name '{resource_name}' for resource 'app'. Resource names must be unique.",
+                location=location,
+                path=path,
+            )
+        else:
+            if location:
+                self.add_location(path, location)
+
+            self._resources["apps"][resource_name] = app
+
+
+@overload
+def app_mutator(
+    function: Callable[[Bundle, "App"], "App"],
+) -> ResourceMutator["App"]: ...
+
+
+@overload
+def app_mutator(
+    function: Callable[["App"], "App"],
+) -> ResourceMutator["App"]: ...
+
+
+def app_mutator(function: Callable) -> ResourceMutator["App"]:
+    """
+    Decorator for defining mutator for apps. Function should return a new instance of the app
+    with the desired changes, instead of mutating the input app.
+
+    Example:
+
+    .. code-block:: python
+
+        @app_mutator
+        def my_app_mutator(bundle: Bundle, app: App) -> App:
+            return replace(app, ...)
+
+    :param function: Function that mutates apps.
+    """
+    from databricks.bundles.apps._models.app import App
+
+    return ResourceMutator(resource_type=App, function=function)
diff --git a/python/databricks/bundles/core/_generated/catalogs.py b/python/databricks/bundles/core/_generated/catalogs.py
new file mode 100644
index 00000000000..55d6bbcd310
--- /dev/null
+++ b/python/databricks/bundles/core/_generated/catalogs.py
@@ -0,0 +1,115 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from collections.abc import Callable
+from typing import TYPE_CHECKING, Optional, overload
+
+from databricks.bundles.core._bundle import Bundle
+from databricks.bundles.core._location import Location
+from databricks.bundles.core._resource_mutator import ResourceMutator
+from databricks.bundles.core._transform import _transform
+
+if TYPE_CHECKING:
+    from databricks.bundles.catalogs._models.catalog import Catalog, CatalogParam
+    from databricks.bundles.core._resource_type import _ResourceType
+
+
+def _resource_type() -> "_ResourceType":
+    from databricks.bundles.catalogs._models.catalog import Catalog
+    from databricks.bundles.core._resource_type import _ResourceType
+
+    return _ResourceType(
+        resource_type=Catalog,
+        singular_name="catalog",
+        plural_name="catalogs",
+    )
+
+
+class _CatalogResources:
+    """
+    Generated catalog accessors, mixed into Resources.
+    """
+
+    # Provided by the Resources subclass; declared here so the generated methods
+    # below type-check.
+    _resources: dict[str, dict]
+
+    if TYPE_CHECKING:
+
+        def add_location(self, path: tuple[str, ...], location: Location) -> None: ...
+
+        def add_diagnostic_error(
+            self,
+            msg: str,
+            *,
+            detail: Optional[str] = None,
+            path: Optional[tuple[str, ...]] = None,
+            location: Optional[Location] = None,
+        ) -> None: ...
+
+    @property
+    def catalogs(self) -> dict[str, "Catalog"]:
+        return self._resources["catalogs"]
+
+    def add_catalog(
+        self,
+        resource_name: str,
+        catalog: "CatalogParam",
+        *,
+        location: Optional[Location] = None,
+    ) -> None:
+        """
+        Adds the resource catalog to the collection of resources. Resource name must be unique across all catalogs.
+
+        :param resource_name: unique identifier for the catalog
+        :param catalog: the catalog to add, can be Catalog or dict
+        :param location: optional location of the catalog in the source code
+        """
+        from databricks.bundles.catalogs._models.catalog import Catalog
+
+        catalog = _transform(Catalog, catalog)
+        path = ("resources", "catalogs", resource_name)
+        location = location or Location.from_stack_frame(depth=1)
+
+        if self._resources["catalogs"].get(resource_name):
+            self.add_diagnostic_error(
+                msg=f"Duplicate resource name '{resource_name}' for resource 'catalog'. Resource names must be unique.",
+                location=location,
+                path=path,
+            )
+        else:
+            if location:
+                self.add_location(path, location)
+
+            self._resources["catalogs"][resource_name] = catalog
+
+
+@overload
+def catalog_mutator(
+    function: Callable[[Bundle, "Catalog"], "Catalog"],
+) -> ResourceMutator["Catalog"]: ...
+
+
+@overload
+def catalog_mutator(
+    function: Callable[["Catalog"], "Catalog"],
+) -> ResourceMutator["Catalog"]: ...
+
+
+def catalog_mutator(function: Callable) -> ResourceMutator["Catalog"]:
+    """
+    Decorator for defining mutator for catalogs. Function should return a new instance of the catalog
+    with the desired changes, instead of mutating the input catalog.
+
+    Example:
+
+    .. code-block:: python
+
+        @catalog_mutator
+        def my_catalog_mutator(bundle: Bundle, catalog: Catalog) -> Catalog:
+            return replace(catalog, ...)
+
+    :param function: Function that mutates catalogs.
+    """
+    from databricks.bundles.catalogs._models.catalog import Catalog
+
+    return ResourceMutator(resource_type=Catalog, function=function)
diff --git a/python/databricks/bundles/core/_generated/cluster_policies.py b/python/databricks/bundles/core/_generated/cluster_policies.py
new file mode 100644
index 00000000000..82da760997b
--- /dev/null
+++ b/python/databricks/bundles/core/_generated/cluster_policies.py
@@ -0,0 +1,120 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from collections.abc import Callable
+from typing import TYPE_CHECKING, Optional, overload
+
+from databricks.bundles.core._bundle import Bundle
+from databricks.bundles.core._location import Location
+from databricks.bundles.core._resource_mutator import ResourceMutator
+from databricks.bundles.core._transform import _transform
+
+if TYPE_CHECKING:
+    from databricks.bundles.cluster_policies._models.cluster_policy import (
+        ClusterPolicy,
+        ClusterPolicyParam,
+    )
+    from databricks.bundles.core._resource_type import _ResourceType
+
+
+def _resource_type() -> "_ResourceType":
+    from databricks.bundles.cluster_policies._models.cluster_policy import ClusterPolicy
+    from databricks.bundles.core._resource_type import _ResourceType
+
+    return _ResourceType(
+        resource_type=ClusterPolicy,
+        singular_name="cluster_policy",
+        plural_name="cluster_policies",
+    )
+
+
+class _ClusterPolicyResources:
+    """
+    Generated cluster_policy accessors, mixed into Resources.
+    """
+
+    # Provided by the Resources subclass; declared here so the generated methods
+    # below type-check.
+    _resources: dict[str, dict]
+
+    if TYPE_CHECKING:
+
+        def add_location(self, path: tuple[str, ...], location: Location) -> None: ...
+
+        def add_diagnostic_error(
+            self,
+            msg: str,
+            *,
+            detail: Optional[str] = None,
+            path: Optional[tuple[str, ...]] = None,
+            location: Optional[Location] = None,
+        ) -> None: ...
+
+    @property
+    def cluster_policies(self) -> dict[str, "ClusterPolicy"]:
+        return self._resources["cluster_policies"]
+
+    def add_cluster_policy(
+        self,
+        resource_name: str,
+        cluster_policy: "ClusterPolicyParam",
+        *,
+        location: Optional[Location] = None,
+    ) -> None:
+        """
+        Adds the resource cluster_policy to the collection of resources. Resource name must be unique across all cluster_policies.
+
+        :param resource_name: unique identifier for the cluster_policy
+        :param cluster_policy: the cluster_policy to add, can be ClusterPolicy or dict
+        :param location: optional location of the cluster_policy in the source code
+        """
+        from databricks.bundles.cluster_policies._models.cluster_policy import (
+            ClusterPolicy,
+        )
+
+        cluster_policy = _transform(ClusterPolicy, cluster_policy)
+        path = ("resources", "cluster_policies", resource_name)
+        location = location or Location.from_stack_frame(depth=1)
+
+        if self._resources["cluster_policies"].get(resource_name):
+            self.add_diagnostic_error(
+                msg=f"Duplicate resource name '{resource_name}' for resource 'cluster_policy'. Resource names must be unique.",
+                location=location,
+                path=path,
+            )
+        else:
+            if location:
+                self.add_location(path, location)
+
+            self._resources["cluster_policies"][resource_name] = cluster_policy
+
+
+@overload
+def cluster_policy_mutator(
+    function: Callable[[Bundle, "ClusterPolicy"], "ClusterPolicy"],
+) -> ResourceMutator["ClusterPolicy"]: ...
+
+
+@overload
+def cluster_policy_mutator(
+    function: Callable[["ClusterPolicy"], "ClusterPolicy"],
+) -> ResourceMutator["ClusterPolicy"]: ...
+
+
+def cluster_policy_mutator(function: Callable) -> ResourceMutator["ClusterPolicy"]:
+    """
+    Decorator for defining mutator for cluster_policies. Function should return a new instance of the cluster_policy
+    with the desired changes, instead of mutating the input cluster_policy.
+
+    Example:
+
+    .. code-block:: python
+
+        @cluster_policy_mutator
+        def my_cluster_policy_mutator(bundle: Bundle, cluster_policy: ClusterPolicy) -> ClusterPolicy:
+            return replace(cluster_policy, ...)
+
+    :param function: Function that mutates cluster_policies.
+    """
+    from databricks.bundles.cluster_policies._models.cluster_policy import ClusterPolicy
+
+    return ResourceMutator(resource_type=ClusterPolicy, function=function)
diff --git a/python/databricks/bundles/core/_generated/clusters.py b/python/databricks/bundles/core/_generated/clusters.py
new file mode 100644
index 00000000000..44c94108ac4
--- /dev/null
+++ b/python/databricks/bundles/core/_generated/clusters.py
@@ -0,0 +1,115 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from collections.abc import Callable
+from typing import TYPE_CHECKING, Optional, overload
+
+from databricks.bundles.core._bundle import Bundle
+from databricks.bundles.core._location import Location
+from databricks.bundles.core._resource_mutator import ResourceMutator
+from databricks.bundles.core._transform import _transform
+
+if TYPE_CHECKING:
+    from databricks.bundles.clusters._models.cluster import Cluster, ClusterParam
+    from databricks.bundles.core._resource_type import _ResourceType
+
+
+def _resource_type() -> "_ResourceType":
+    from databricks.bundles.clusters._models.cluster import Cluster
+    from databricks.bundles.core._resource_type import _ResourceType
+
+    return _ResourceType(
+        resource_type=Cluster,
+        singular_name="cluster",
+        plural_name="clusters",
+    )
+
+
+class _ClusterResources:
+    """
+    Generated cluster accessors, mixed into Resources.
+    """
+
+    # Provided by the Resources subclass; declared here so the generated methods
+    # below type-check.
+    _resources: dict[str, dict]
+
+    if TYPE_CHECKING:
+
+        def add_location(self, path: tuple[str, ...], location: Location) -> None: ...
+
+        def add_diagnostic_error(
+            self,
+            msg: str,
+            *,
+            detail: Optional[str] = None,
+            path: Optional[tuple[str, ...]] = None,
+            location: Optional[Location] = None,
+        ) -> None: ...
+
+    @property
+    def clusters(self) -> dict[str, "Cluster"]:
+        return self._resources["clusters"]
+
+    def add_cluster(
+        self,
+        resource_name: str,
+        cluster: "ClusterParam",
+        *,
+        location: Optional[Location] = None,
+    ) -> None:
+        """
+        Adds the resource cluster to the collection of resources. Resource name must be unique across all clusters.
+
+        :param resource_name: unique identifier for the cluster
+        :param cluster: the cluster to add, can be Cluster or dict
+        :param location: optional location of the cluster in the source code
+        """
+        from databricks.bundles.clusters._models.cluster import Cluster
+
+        cluster = _transform(Cluster, cluster)
+        path = ("resources", "clusters", resource_name)
+        location = location or Location.from_stack_frame(depth=1)
+
+        if self._resources["clusters"].get(resource_name):
+            self.add_diagnostic_error(
+                msg=f"Duplicate resource name '{resource_name}' for resource 'cluster'. Resource names must be unique.",
+                location=location,
+                path=path,
+            )
+        else:
+            if location:
+                self.add_location(path, location)
+
+            self._resources["clusters"][resource_name] = cluster
+
+
+@overload
+def cluster_mutator(
+    function: Callable[[Bundle, "Cluster"], "Cluster"],
+) -> ResourceMutator["Cluster"]: ...
+
+
+@overload
+def cluster_mutator(
+    function: Callable[["Cluster"], "Cluster"],
+) -> ResourceMutator["Cluster"]: ...
+
+
+def cluster_mutator(function: Callable) -> ResourceMutator["Cluster"]:
+    """
+    Decorator for defining mutator for clusters. Function should return a new instance of the cluster
+    with the desired changes, instead of mutating the input cluster.
+
+    Example:
+
+    .. code-block:: python
+
+        @cluster_mutator
+        def my_cluster_mutator(bundle: Bundle, cluster: Cluster) -> Cluster:
+            return replace(cluster, ...)
+
+    :param function: Function that mutates clusters.
+    """
+    from databricks.bundles.clusters._models.cluster import Cluster
+
+    return ResourceMutator(resource_type=Cluster, function=function)
diff --git a/python/databricks/bundles/core/_generated/dashboards.py b/python/databricks/bundles/core/_generated/dashboards.py
new file mode 100644
index 00000000000..75cbb368354
--- /dev/null
+++ b/python/databricks/bundles/core/_generated/dashboards.py
@@ -0,0 +1,118 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from collections.abc import Callable
+from typing import TYPE_CHECKING, Optional, overload
+
+from databricks.bundles.core._bundle import Bundle
+from databricks.bundles.core._location import Location
+from databricks.bundles.core._resource_mutator import ResourceMutator
+from databricks.bundles.core._transform import _transform
+
+if TYPE_CHECKING:
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.dashboards._models.dashboard import (
+        Dashboard,
+        DashboardParam,
+    )
+
+
+def _resource_type() -> "_ResourceType":
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.dashboards._models.dashboard import Dashboard
+
+    return _ResourceType(
+        resource_type=Dashboard,
+        singular_name="dashboard",
+        plural_name="dashboards",
+    )
+
+
+class _DashboardResources:
+    """
+    Generated dashboard accessors, mixed into Resources.
+    """
+
+    # Provided by the Resources subclass; declared here so the generated methods
+    # below type-check.
+    _resources: dict[str, dict]
+
+    if TYPE_CHECKING:
+
+        def add_location(self, path: tuple[str, ...], location: Location) -> None: ...
+
+        def add_diagnostic_error(
+            self,
+            msg: str,
+            *,
+            detail: Optional[str] = None,
+            path: Optional[tuple[str, ...]] = None,
+            location: Optional[Location] = None,
+        ) -> None: ...
+
+    @property
+    def dashboards(self) -> dict[str, "Dashboard"]:
+        return self._resources["dashboards"]
+
+    def add_dashboard(
+        self,
+        resource_name: str,
+        dashboard: "DashboardParam",
+        *,
+        location: Optional[Location] = None,
+    ) -> None:
+        """
+        Adds the resource dashboard to the collection of resources. Resource name must be unique across all dashboards.
+
+        :param resource_name: unique identifier for the dashboard
+        :param dashboard: the dashboard to add, can be Dashboard or dict
+        :param location: optional location of the dashboard in the source code
+        """
+        from databricks.bundles.dashboards._models.dashboard import Dashboard
+
+        dashboard = _transform(Dashboard, dashboard)
+        path = ("resources", "dashboards", resource_name)
+        location = location or Location.from_stack_frame(depth=1)
+
+        if self._resources["dashboards"].get(resource_name):
+            self.add_diagnostic_error(
+                msg=f"Duplicate resource name '{resource_name}' for resource 'dashboard'. Resource names must be unique.",
+                location=location,
+                path=path,
+            )
+        else:
+            if location:
+                self.add_location(path, location)
+
+            self._resources["dashboards"][resource_name] = dashboard
+
+
+@overload
+def dashboard_mutator(
+    function: Callable[[Bundle, "Dashboard"], "Dashboard"],
+) -> ResourceMutator["Dashboard"]: ...
+
+
+@overload
+def dashboard_mutator(
+    function: Callable[["Dashboard"], "Dashboard"],
+) -> ResourceMutator["Dashboard"]: ...
+
+
+def dashboard_mutator(function: Callable) -> ResourceMutator["Dashboard"]:
+    """
+    Decorator for defining mutator for dashboards. Function should return a new instance of the dashboard
+    with the desired changes, instead of mutating the input dashboard.
+
+    Example:
+
+    .. code-block:: python
+
+        @dashboard_mutator
+        def my_dashboard_mutator(bundle: Bundle, dashboard: Dashboard) -> Dashboard:
+            return replace(dashboard, ...)
+
+    :param function: Function that mutates dashboards.
+    """
+    from databricks.bundles.dashboards._models.dashboard import Dashboard
+
+    return ResourceMutator(resource_type=Dashboard, function=function)
diff --git a/python/databricks/bundles/core/_generated/database_catalogs.py b/python/databricks/bundles/core/_generated/database_catalogs.py
new file mode 100644
index 00000000000..a11e165b17f
--- /dev/null
+++ b/python/databricks/bundles/core/_generated/database_catalogs.py
@@ -0,0 +1,124 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from collections.abc import Callable
+from typing import TYPE_CHECKING, Optional, overload
+
+from databricks.bundles.core._bundle import Bundle
+from databricks.bundles.core._location import Location
+from databricks.bundles.core._resource_mutator import ResourceMutator
+from databricks.bundles.core._transform import _transform
+
+if TYPE_CHECKING:
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.database_catalogs._models.database_catalog import (
+        DatabaseCatalog,
+        DatabaseCatalogParam,
+    )
+
+
+def _resource_type() -> "_ResourceType":
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.database_catalogs._models.database_catalog import (
+        DatabaseCatalog,
+    )
+
+    return _ResourceType(
+        resource_type=DatabaseCatalog,
+        singular_name="database_catalog",
+        plural_name="database_catalogs",
+    )
+
+
+class _DatabaseCatalogResources:
+    """
+    Generated database_catalog accessors, mixed into Resources.
+    """
+
+    # Provided by the Resources subclass; declared here so the generated methods
+    # below type-check.
+    _resources: dict[str, dict]
+
+    if TYPE_CHECKING:
+
+        def add_location(self, path: tuple[str, ...], location: Location) -> None: ...
+
+        def add_diagnostic_error(
+            self,
+            msg: str,
+            *,
+            detail: Optional[str] = None,
+            path: Optional[tuple[str, ...]] = None,
+            location: Optional[Location] = None,
+        ) -> None: ...
+
+    @property
+    def database_catalogs(self) -> dict[str, "DatabaseCatalog"]:
+        return self._resources["database_catalogs"]
+
+    def add_database_catalog(
+        self,
+        resource_name: str,
+        database_catalog: "DatabaseCatalogParam",
+        *,
+        location: Optional[Location] = None,
+    ) -> None:
+        """
+        Adds the resource database_catalog to the collection of resources. Resource name must be unique across all database_catalogs.
+
+        :param resource_name: unique identifier for the database_catalog
+        :param database_catalog: the database_catalog to add, can be DatabaseCatalog or dict
+        :param location: optional location of the database_catalog in the source code
+        """
+        from databricks.bundles.database_catalogs._models.database_catalog import (
+            DatabaseCatalog,
+        )
+
+        database_catalog = _transform(DatabaseCatalog, database_catalog)
+        path = ("resources", "database_catalogs", resource_name)
+        location = location or Location.from_stack_frame(depth=1)
+
+        if self._resources["database_catalogs"].get(resource_name):
+            self.add_diagnostic_error(
+                msg=f"Duplicate resource name '{resource_name}' for resource 'database_catalog'. Resource names must be unique.",
+                location=location,
+                path=path,
+            )
+        else:
+            if location:
+                self.add_location(path, location)
+
+            self._resources["database_catalogs"][resource_name] = database_catalog
+
+
+@overload
+def database_catalog_mutator(
+    function: Callable[[Bundle, "DatabaseCatalog"], "DatabaseCatalog"],
+) -> ResourceMutator["DatabaseCatalog"]: ...
+
+
+@overload
+def database_catalog_mutator(
+    function: Callable[["DatabaseCatalog"], "DatabaseCatalog"],
+) -> ResourceMutator["DatabaseCatalog"]: ...
+
+
+def database_catalog_mutator(function: Callable) -> ResourceMutator["DatabaseCatalog"]:
+    """
+    Decorator for defining mutator for database_catalogs. Function should return a new instance of the database_catalog
+    with the desired changes, instead of mutating the input database_catalog.
+
+    Example:
+
+    .. code-block:: python
+
+        @database_catalog_mutator
+        def my_database_catalog_mutator(bundle: Bundle, database_catalog: DatabaseCatalog) -> DatabaseCatalog:
+            return replace(database_catalog, ...)
+
+    :param function: Function that mutates database_catalogs.
+    """
+    from databricks.bundles.database_catalogs._models.database_catalog import (
+        DatabaseCatalog,
+    )
+
+    return ResourceMutator(resource_type=DatabaseCatalog, function=function)
diff --git a/python/databricks/bundles/core/_generated/database_instances.py b/python/databricks/bundles/core/_generated/database_instances.py
new file mode 100644
index 00000000000..9352ce5a37f
--- /dev/null
+++ b/python/databricks/bundles/core/_generated/database_instances.py
@@ -0,0 +1,126 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from collections.abc import Callable
+from typing import TYPE_CHECKING, Optional, overload
+
+from databricks.bundles.core._bundle import Bundle
+from databricks.bundles.core._location import Location
+from databricks.bundles.core._resource_mutator import ResourceMutator
+from databricks.bundles.core._transform import _transform
+
+if TYPE_CHECKING:
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.database_instances._models.database_instance import (
+        DatabaseInstance,
+        DatabaseInstanceParam,
+    )
+
+
+def _resource_type() -> "_ResourceType":
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.database_instances._models.database_instance import (
+        DatabaseInstance,
+    )
+
+    return _ResourceType(
+        resource_type=DatabaseInstance,
+        singular_name="database_instance",
+        plural_name="database_instances",
+    )
+
+
+class _DatabaseInstanceResources:
+    """
+    Generated database_instance accessors, mixed into Resources.
+    """
+
+    # Provided by the Resources subclass; declared here so the generated methods
+    # below type-check.
+    _resources: dict[str, dict]
+
+    if TYPE_CHECKING:
+
+        def add_location(self, path: tuple[str, ...], location: Location) -> None: ...
+
+        def add_diagnostic_error(
+            self,
+            msg: str,
+            *,
+            detail: Optional[str] = None,
+            path: Optional[tuple[str, ...]] = None,
+            location: Optional[Location] = None,
+        ) -> None: ...
+
+    @property
+    def database_instances(self) -> dict[str, "DatabaseInstance"]:
+        return self._resources["database_instances"]
+
+    def add_database_instance(
+        self,
+        resource_name: str,
+        database_instance: "DatabaseInstanceParam",
+        *,
+        location: Optional[Location] = None,
+    ) -> None:
+        """
+        Adds the resource database_instance to the collection of resources. Resource name must be unique across all database_instances.
+
+        :param resource_name: unique identifier for the database_instance
+        :param database_instance: the database_instance to add, can be DatabaseInstance or dict
+        :param location: optional location of the database_instance in the source code
+        """
+        from databricks.bundles.database_instances._models.database_instance import (
+            DatabaseInstance,
+        )
+
+        database_instance = _transform(DatabaseInstance, database_instance)
+        path = ("resources", "database_instances", resource_name)
+        location = location or Location.from_stack_frame(depth=1)
+
+        if self._resources["database_instances"].get(resource_name):
+            self.add_diagnostic_error(
+                msg=f"Duplicate resource name '{resource_name}' for resource 'database_instance'. Resource names must be unique.",
+                location=location,
+                path=path,
+            )
+        else:
+            if location:
+                self.add_location(path, location)
+
+            self._resources["database_instances"][resource_name] = database_instance
+
+
+@overload
+def database_instance_mutator(
+    function: Callable[[Bundle, "DatabaseInstance"], "DatabaseInstance"],
+) -> ResourceMutator["DatabaseInstance"]: ...
+
+
+@overload
+def database_instance_mutator(
+    function: Callable[["DatabaseInstance"], "DatabaseInstance"],
+) -> ResourceMutator["DatabaseInstance"]: ...
+
+
+def database_instance_mutator(
+    function: Callable,
+) -> ResourceMutator["DatabaseInstance"]:
+    """
+    Decorator for defining mutator for database_instances. Function should return a new instance of the database_instance
+    with the desired changes, instead of mutating the input database_instance.
+
+    Example:
+
+    .. code-block:: python
+
+        @database_instance_mutator
+        def my_database_instance_mutator(bundle: Bundle, database_instance: DatabaseInstance) -> DatabaseInstance:
+            return replace(database_instance, ...)
+
+    :param function: Function that mutates database_instances.
+    """
+    from databricks.bundles.database_instances._models.database_instance import (
+        DatabaseInstance,
+    )
+
+    return ResourceMutator(resource_type=DatabaseInstance, function=function)
diff --git a/python/databricks/bundles/core/_generated/experiments.py b/python/databricks/bundles/core/_generated/experiments.py
new file mode 100644
index 00000000000..ca0860f3155
--- /dev/null
+++ b/python/databricks/bundles/core/_generated/experiments.py
@@ -0,0 +1,126 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from collections.abc import Callable
+from typing import TYPE_CHECKING, Optional, overload
+
+from databricks.bundles.core._bundle import Bundle
+from databricks.bundles.core._location import Location
+from databricks.bundles.core._resource_mutator import ResourceMutator
+from databricks.bundles.core._transform import _transform
+
+if TYPE_CHECKING:
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.experiments._models.mlflow_experiment import (
+        MlflowExperiment,
+        MlflowExperimentParam,
+    )
+
+
+def _resource_type() -> "_ResourceType":
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.experiments._models.mlflow_experiment import (
+        MlflowExperiment,
+    )
+
+    return _ResourceType(
+        resource_type=MlflowExperiment,
+        singular_name="mlflow_experiment",
+        plural_name="experiments",
+    )
+
+
+class _MlflowExperimentResources:
+    """
+    Generated mlflow_experiment accessors, mixed into Resources.
+    """
+
+    # Provided by the Resources subclass; declared here so the generated methods
+    # below type-check.
+    _resources: dict[str, dict]
+
+    if TYPE_CHECKING:
+
+        def add_location(self, path: tuple[str, ...], location: Location) -> None: ...
+
+        def add_diagnostic_error(
+            self,
+            msg: str,
+            *,
+            detail: Optional[str] = None,
+            path: Optional[tuple[str, ...]] = None,
+            location: Optional[Location] = None,
+        ) -> None: ...
+
+    @property
+    def experiments(self) -> dict[str, "MlflowExperiment"]:
+        return self._resources["experiments"]
+
+    def add_mlflow_experiment(
+        self,
+        resource_name: str,
+        mlflow_experiment: "MlflowExperimentParam",
+        *,
+        location: Optional[Location] = None,
+    ) -> None:
+        """
+        Adds the resource mlflow_experiment to the collection of resources. Resource name must be unique across all experiments.
+
+        :param resource_name: unique identifier for the mlflow_experiment
+        :param mlflow_experiment: the mlflow_experiment to add, can be MlflowExperiment or dict
+        :param location: optional location of the mlflow_experiment in the source code
+        """
+        from databricks.bundles.experiments._models.mlflow_experiment import (
+            MlflowExperiment,
+        )
+
+        mlflow_experiment = _transform(MlflowExperiment, mlflow_experiment)
+        path = ("resources", "experiments", resource_name)
+        location = location or Location.from_stack_frame(depth=1)
+
+        if self._resources["experiments"].get(resource_name):
+            self.add_diagnostic_error(
+                msg=f"Duplicate resource name '{resource_name}' for resource 'mlflow_experiment'. Resource names must be unique.",
+                location=location,
+                path=path,
+            )
+        else:
+            if location:
+                self.add_location(path, location)
+
+            self._resources["experiments"][resource_name] = mlflow_experiment
+
+
+@overload
+def mlflow_experiment_mutator(
+    function: Callable[[Bundle, "MlflowExperiment"], "MlflowExperiment"],
+) -> ResourceMutator["MlflowExperiment"]: ...
+
+
+@overload
+def mlflow_experiment_mutator(
+    function: Callable[["MlflowExperiment"], "MlflowExperiment"],
+) -> ResourceMutator["MlflowExperiment"]: ...
+
+
+def mlflow_experiment_mutator(
+    function: Callable,
+) -> ResourceMutator["MlflowExperiment"]:
+    """
+    Decorator for defining mutator for experiments. Function should return a new instance of the mlflow_experiment
+    with the desired changes, instead of mutating the input mlflow_experiment.
+
+    Example:
+
+    .. code-block:: python
+
+        @mlflow_experiment_mutator
+        def my_mlflow_experiment_mutator(bundle: Bundle, mlflow_experiment: MlflowExperiment) -> MlflowExperiment:
+            return replace(mlflow_experiment, ...)
+
+    :param function: Function that mutates experiments.
+    """
+    from databricks.bundles.experiments._models.mlflow_experiment import (
+        MlflowExperiment,
+    )
+
+    return ResourceMutator(resource_type=MlflowExperiment, function=function)
diff --git a/python/databricks/bundles/core/_generated/external_locations.py b/python/databricks/bundles/core/_generated/external_locations.py
new file mode 100644
index 00000000000..d30243989a2
--- /dev/null
+++ b/python/databricks/bundles/core/_generated/external_locations.py
@@ -0,0 +1,126 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from collections.abc import Callable
+from typing import TYPE_CHECKING, Optional, overload
+
+from databricks.bundles.core._bundle import Bundle
+from databricks.bundles.core._location import Location
+from databricks.bundles.core._resource_mutator import ResourceMutator
+from databricks.bundles.core._transform import _transform
+
+if TYPE_CHECKING:
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.external_locations._models.external_location import (
+        ExternalLocation,
+        ExternalLocationParam,
+    )
+
+
+def _resource_type() -> "_ResourceType":
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.external_locations._models.external_location import (
+        ExternalLocation,
+    )
+
+    return _ResourceType(
+        resource_type=ExternalLocation,
+        singular_name="external_location",
+        plural_name="external_locations",
+    )
+
+
+class _ExternalLocationResources:
+    """
+    Generated external_location accessors, mixed into Resources.
+    """
+
+    # Provided by the Resources subclass; declared here so the generated methods
+    # below type-check.
+    _resources: dict[str, dict]
+
+    if TYPE_CHECKING:
+
+        def add_location(self, path: tuple[str, ...], location: Location) -> None: ...
+
+        def add_diagnostic_error(
+            self,
+            msg: str,
+            *,
+            detail: Optional[str] = None,
+            path: Optional[tuple[str, ...]] = None,
+            location: Optional[Location] = None,
+        ) -> None: ...
+
+    @property
+    def external_locations(self) -> dict[str, "ExternalLocation"]:
+        return self._resources["external_locations"]
+
+    def add_external_location(
+        self,
+        resource_name: str,
+        external_location: "ExternalLocationParam",
+        *,
+        location: Optional[Location] = None,
+    ) -> None:
+        """
+        Adds the resource external_location to the collection of resources. Resource name must be unique across all external_locations.
+
+        :param resource_name: unique identifier for the external_location
+        :param external_location: the external_location to add, can be ExternalLocation or dict
+        :param location: optional location of the external_location in the source code
+        """
+        from databricks.bundles.external_locations._models.external_location import (
+            ExternalLocation,
+        )
+
+        external_location = _transform(ExternalLocation, external_location)
+        path = ("resources", "external_locations", resource_name)
+        location = location or Location.from_stack_frame(depth=1)
+
+        if self._resources["external_locations"].get(resource_name):
+            self.add_diagnostic_error(
+                msg=f"Duplicate resource name '{resource_name}' for resource 'external_location'. Resource names must be unique.",
+                location=location,
+                path=path,
+            )
+        else:
+            if location:
+                self.add_location(path, location)
+
+            self._resources["external_locations"][resource_name] = external_location
+
+
+@overload
+def external_location_mutator(
+    function: Callable[[Bundle, "ExternalLocation"], "ExternalLocation"],
+) -> ResourceMutator["ExternalLocation"]: ...
+
+
+@overload
+def external_location_mutator(
+    function: Callable[["ExternalLocation"], "ExternalLocation"],
+) -> ResourceMutator["ExternalLocation"]: ...
+
+
+def external_location_mutator(
+    function: Callable,
+) -> ResourceMutator["ExternalLocation"]:
+    """
+    Decorator for defining mutator for external_locations. Function should return a new instance of the external_location
+    with the desired changes, instead of mutating the input external_location.
+
+    Example:
+
+    .. code-block:: python
+
+        @external_location_mutator
+        def my_external_location_mutator(bundle: Bundle, external_location: ExternalLocation) -> ExternalLocation:
+            return replace(external_location, ...)
+
+    :param function: Function that mutates external_locations.
+    """
+    from databricks.bundles.external_locations._models.external_location import (
+        ExternalLocation,
+    )
+
+    return ResourceMutator(resource_type=ExternalLocation, function=function)
diff --git a/python/databricks/bundles/core/_generated/features.py b/python/databricks/bundles/core/_generated/features.py
new file mode 100644
index 00000000000..e9c4d96d179
--- /dev/null
+++ b/python/databricks/bundles/core/_generated/features.py
@@ -0,0 +1,115 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from collections.abc import Callable
+from typing import TYPE_CHECKING, Optional, overload
+
+from databricks.bundles.core._bundle import Bundle
+from databricks.bundles.core._location import Location
+from databricks.bundles.core._resource_mutator import ResourceMutator
+from databricks.bundles.core._transform import _transform
+
+if TYPE_CHECKING:
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.features._models.feature import Feature, FeatureParam
+
+
+def _resource_type() -> "_ResourceType":
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.features._models.feature import Feature
+
+    return _ResourceType(
+        resource_type=Feature,
+        singular_name="feature",
+        plural_name="features",
+    )
+
+
+class _FeatureResources:
+    """
+    Generated feature accessors, mixed into Resources.
+    """
+
+    # Provided by the Resources subclass; declared here so the generated methods
+    # below type-check.
+    _resources: dict[str, dict]
+
+    if TYPE_CHECKING:
+
+        def add_location(self, path: tuple[str, ...], location: Location) -> None: ...
+
+        def add_diagnostic_error(
+            self,
+            msg: str,
+            *,
+            detail: Optional[str] = None,
+            path: Optional[tuple[str, ...]] = None,
+            location: Optional[Location] = None,
+        ) -> None: ...
+
+    @property
+    def features(self) -> dict[str, "Feature"]:
+        return self._resources["features"]
+
+    def add_feature(
+        self,
+        resource_name: str,
+        feature: "FeatureParam",
+        *,
+        location: Optional[Location] = None,
+    ) -> None:
+        """
+        Adds the resource feature to the collection of resources. Resource name must be unique across all features.
+
+        :param resource_name: unique identifier for the feature
+        :param feature: the feature to add, can be Feature or dict
+        :param location: optional location of the feature in the source code
+        """
+        from databricks.bundles.features._models.feature import Feature
+
+        feature = _transform(Feature, feature)
+        path = ("resources", "features", resource_name)
+        location = location or Location.from_stack_frame(depth=1)
+
+        if self._resources["features"].get(resource_name):
+            self.add_diagnostic_error(
+                msg=f"Duplicate resource name '{resource_name}' for resource 'feature'. Resource names must be unique.",
+                location=location,
+                path=path,
+            )
+        else:
+            if location:
+                self.add_location(path, location)
+
+            self._resources["features"][resource_name] = feature
+
+
+@overload
+def feature_mutator(
+    function: Callable[[Bundle, "Feature"], "Feature"],
+) -> ResourceMutator["Feature"]: ...
+
+
+@overload
+def feature_mutator(
+    function: Callable[["Feature"], "Feature"],
+) -> ResourceMutator["Feature"]: ...
+
+
+def feature_mutator(function: Callable) -> ResourceMutator["Feature"]:
+    """
+    Decorator for defining mutator for features. Function should return a new instance of the feature
+    with the desired changes, instead of mutating the input feature.
+
+    Example:
+
+    .. code-block:: python
+
+        @feature_mutator
+        def my_feature_mutator(bundle: Bundle, feature: Feature) -> Feature:
+            return replace(feature, ...)
+
+    :param function: Function that mutates features.
+    """
+    from databricks.bundles.features._models.feature import Feature
+
+    return ResourceMutator(resource_type=Feature, function=function)
diff --git a/python/databricks/bundles/core/_generated/genie_spaces.py b/python/databricks/bundles/core/_generated/genie_spaces.py
new file mode 100644
index 00000000000..37fd6cad561
--- /dev/null
+++ b/python/databricks/bundles/core/_generated/genie_spaces.py
@@ -0,0 +1,118 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from collections.abc import Callable
+from typing import TYPE_CHECKING, Optional, overload
+
+from databricks.bundles.core._bundle import Bundle
+from databricks.bundles.core._location import Location
+from databricks.bundles.core._resource_mutator import ResourceMutator
+from databricks.bundles.core._transform import _transform
+
+if TYPE_CHECKING:
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.genie_spaces._models.genie_space import (
+        GenieSpace,
+        GenieSpaceParam,
+    )
+
+
+def _resource_type() -> "_ResourceType":
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.genie_spaces._models.genie_space import GenieSpace
+
+    return _ResourceType(
+        resource_type=GenieSpace,
+        singular_name="genie_space",
+        plural_name="genie_spaces",
+    )
+
+
+class _GenieSpaceResources:
+    """
+    Generated genie_space accessors, mixed into Resources.
+    """
+
+    # Provided by the Resources subclass; declared here so the generated methods
+    # below type-check.
+    _resources: dict[str, dict]
+
+    if TYPE_CHECKING:
+
+        def add_location(self, path: tuple[str, ...], location: Location) -> None: ...
+
+        def add_diagnostic_error(
+            self,
+            msg: str,
+            *,
+            detail: Optional[str] = None,
+            path: Optional[tuple[str, ...]] = None,
+            location: Optional[Location] = None,
+        ) -> None: ...
+
+    @property
+    def genie_spaces(self) -> dict[str, "GenieSpace"]:
+        return self._resources["genie_spaces"]
+
+    def add_genie_space(
+        self,
+        resource_name: str,
+        genie_space: "GenieSpaceParam",
+        *,
+        location: Optional[Location] = None,
+    ) -> None:
+        """
+        Adds the resource genie_space to the collection of resources. Resource name must be unique across all genie_spaces.
+
+        :param resource_name: unique identifier for the genie_space
+        :param genie_space: the genie_space to add, can be GenieSpace or dict
+        :param location: optional location of the genie_space in the source code
+        """
+        from databricks.bundles.genie_spaces._models.genie_space import GenieSpace
+
+        genie_space = _transform(GenieSpace, genie_space)
+        path = ("resources", "genie_spaces", resource_name)
+        location = location or Location.from_stack_frame(depth=1)
+
+        if self._resources["genie_spaces"].get(resource_name):
+            self.add_diagnostic_error(
+                msg=f"Duplicate resource name '{resource_name}' for resource 'genie_space'. Resource names must be unique.",
+                location=location,
+                path=path,
+            )
+        else:
+            if location:
+                self.add_location(path, location)
+
+            self._resources["genie_spaces"][resource_name] = genie_space
+
+
+@overload
+def genie_space_mutator(
+    function: Callable[[Bundle, "GenieSpace"], "GenieSpace"],
+) -> ResourceMutator["GenieSpace"]: ...
+
+
+@overload
+def genie_space_mutator(
+    function: Callable[["GenieSpace"], "GenieSpace"],
+) -> ResourceMutator["GenieSpace"]: ...
+
+
+def genie_space_mutator(function: Callable) -> ResourceMutator["GenieSpace"]:
+    """
+    Decorator for defining mutator for genie_spaces. Function should return a new instance of the genie_space
+    with the desired changes, instead of mutating the input genie_space.
+
+    Example:
+
+    .. code-block:: python
+
+        @genie_space_mutator
+        def my_genie_space_mutator(bundle: Bundle, genie_space: GenieSpace) -> GenieSpace:
+            return replace(genie_space, ...)
+
+    :param function: Function that mutates genie_spaces.
+    """
+    from databricks.bundles.genie_spaces._models.genie_space import GenieSpace
+
+    return ResourceMutator(resource_type=GenieSpace, function=function)
diff --git a/python/databricks/bundles/core/_generated/instance_pools.py b/python/databricks/bundles/core/_generated/instance_pools.py
new file mode 100644
index 00000000000..0ce75fc3d2e
--- /dev/null
+++ b/python/databricks/bundles/core/_generated/instance_pools.py
@@ -0,0 +1,118 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from collections.abc import Callable
+from typing import TYPE_CHECKING, Optional, overload
+
+from databricks.bundles.core._bundle import Bundle
+from databricks.bundles.core._location import Location
+from databricks.bundles.core._resource_mutator import ResourceMutator
+from databricks.bundles.core._transform import _transform
+
+if TYPE_CHECKING:
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.instance_pools._models.instance_pool import (
+        InstancePool,
+        InstancePoolParam,
+    )
+
+
+def _resource_type() -> "_ResourceType":
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.instance_pools._models.instance_pool import InstancePool
+
+    return _ResourceType(
+        resource_type=InstancePool,
+        singular_name="instance_pool",
+        plural_name="instance_pools",
+    )
+
+
+class _InstancePoolResources:
+    """
+    Generated instance_pool accessors, mixed into Resources.
+    """
+
+    # Provided by the Resources subclass; declared here so the generated methods
+    # below type-check.
+    _resources: dict[str, dict]
+
+    if TYPE_CHECKING:
+
+        def add_location(self, path: tuple[str, ...], location: Location) -> None: ...
+
+        def add_diagnostic_error(
+            self,
+            msg: str,
+            *,
+            detail: Optional[str] = None,
+            path: Optional[tuple[str, ...]] = None,
+            location: Optional[Location] = None,
+        ) -> None: ...
+
+    @property
+    def instance_pools(self) -> dict[str, "InstancePool"]:
+        return self._resources["instance_pools"]
+
+    def add_instance_pool(
+        self,
+        resource_name: str,
+        instance_pool: "InstancePoolParam",
+        *,
+        location: Optional[Location] = None,
+    ) -> None:
+        """
+        Adds the resource instance_pool to the collection of resources. Resource name must be unique across all instance_pools.
+
+        :param resource_name: unique identifier for the instance_pool
+        :param instance_pool: the instance_pool to add, can be InstancePool or dict
+        :param location: optional location of the instance_pool in the source code
+        """
+        from databricks.bundles.instance_pools._models.instance_pool import InstancePool
+
+        instance_pool = _transform(InstancePool, instance_pool)
+        path = ("resources", "instance_pools", resource_name)
+        location = location or Location.from_stack_frame(depth=1)
+
+        if self._resources["instance_pools"].get(resource_name):
+            self.add_diagnostic_error(
+                msg=f"Duplicate resource name '{resource_name}' for resource 'instance_pool'. Resource names must be unique.",
+                location=location,
+                path=path,
+            )
+        else:
+            if location:
+                self.add_location(path, location)
+
+            self._resources["instance_pools"][resource_name] = instance_pool
+
+
+@overload
+def instance_pool_mutator(
+    function: Callable[[Bundle, "InstancePool"], "InstancePool"],
+) -> ResourceMutator["InstancePool"]: ...
+
+
+@overload
+def instance_pool_mutator(
+    function: Callable[["InstancePool"], "InstancePool"],
+) -> ResourceMutator["InstancePool"]: ...
+
+
+def instance_pool_mutator(function: Callable) -> ResourceMutator["InstancePool"]:
+    """
+    Decorator for defining mutator for instance_pools. Function should return a new instance of the instance_pool
+    with the desired changes, instead of mutating the input instance_pool.
+
+    Example:
+
+    .. code-block:: python
+
+        @instance_pool_mutator
+        def my_instance_pool_mutator(bundle: Bundle, instance_pool: InstancePool) -> InstancePool:
+            return replace(instance_pool, ...)
+
+    :param function: Function that mutates instance_pools.
+    """
+    from databricks.bundles.instance_pools._models.instance_pool import InstancePool
+
+    return ResourceMutator(resource_type=InstancePool, function=function)
diff --git a/python/databricks/bundles/core/_generated/job_runs.py b/python/databricks/bundles/core/_generated/job_runs.py
new file mode 100644
index 00000000000..243a27a931f
--- /dev/null
+++ b/python/databricks/bundles/core/_generated/job_runs.py
@@ -0,0 +1,115 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from collections.abc import Callable
+from typing import TYPE_CHECKING, Optional, overload
+
+from databricks.bundles.core._bundle import Bundle
+from databricks.bundles.core._location import Location
+from databricks.bundles.core._resource_mutator import ResourceMutator
+from databricks.bundles.core._transform import _transform
+
+if TYPE_CHECKING:
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.job_runs._models.job_run import JobRun, JobRunParam
+
+
+def _resource_type() -> "_ResourceType":
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.job_runs._models.job_run import JobRun
+
+    return _ResourceType(
+        resource_type=JobRun,
+        singular_name="job_run",
+        plural_name="job_runs",
+    )
+
+
+class _JobRunResources:
+    """
+    Generated job_run accessors, mixed into Resources.
+    """
+
+    # Provided by the Resources subclass; declared here so the generated methods
+    # below type-check.
+    _resources: dict[str, dict]
+
+    if TYPE_CHECKING:
+
+        def add_location(self, path: tuple[str, ...], location: Location) -> None: ...
+
+        def add_diagnostic_error(
+            self,
+            msg: str,
+            *,
+            detail: Optional[str] = None,
+            path: Optional[tuple[str, ...]] = None,
+            location: Optional[Location] = None,
+        ) -> None: ...
+
+    @property
+    def job_runs(self) -> dict[str, "JobRun"]:
+        return self._resources["job_runs"]
+
+    def add_job_run(
+        self,
+        resource_name: str,
+        job_run: "JobRunParam",
+        *,
+        location: Optional[Location] = None,
+    ) -> None:
+        """
+        Adds the resource job_run to the collection of resources. Resource name must be unique across all job_runs.
+
+        :param resource_name: unique identifier for the job_run
+        :param job_run: the job_run to add, can be JobRun or dict
+        :param location: optional location of the job_run in the source code
+        """
+        from databricks.bundles.job_runs._models.job_run import JobRun
+
+        job_run = _transform(JobRun, job_run)
+        path = ("resources", "job_runs", resource_name)
+        location = location or Location.from_stack_frame(depth=1)
+
+        if self._resources["job_runs"].get(resource_name):
+            self.add_diagnostic_error(
+                msg=f"Duplicate resource name '{resource_name}' for resource 'job_run'. Resource names must be unique.",
+                location=location,
+                path=path,
+            )
+        else:
+            if location:
+                self.add_location(path, location)
+
+            self._resources["job_runs"][resource_name] = job_run
+
+
+@overload
+def job_run_mutator(
+    function: Callable[[Bundle, "JobRun"], "JobRun"],
+) -> ResourceMutator["JobRun"]: ...
+
+
+@overload
+def job_run_mutator(
+    function: Callable[["JobRun"], "JobRun"],
+) -> ResourceMutator["JobRun"]: ...
+
+
+def job_run_mutator(function: Callable) -> ResourceMutator["JobRun"]:
+    """
+    Decorator for defining mutator for job_runs. Function should return a new instance of the job_run
+    with the desired changes, instead of mutating the input job_run.
+
+    Example:
+
+    .. code-block:: python
+
+        @job_run_mutator
+        def my_job_run_mutator(bundle: Bundle, job_run: JobRun) -> JobRun:
+            return replace(job_run, ...)
+
+    :param function: Function that mutates job_runs.
+    """
+    from databricks.bundles.job_runs._models.job_run import JobRun
+
+    return ResourceMutator(resource_type=JobRun, function=function)
diff --git a/python/databricks/bundles/core/_generated/jobs.py b/python/databricks/bundles/core/_generated/jobs.py
new file mode 100644
index 00000000000..8653c55055d
--- /dev/null
+++ b/python/databricks/bundles/core/_generated/jobs.py
@@ -0,0 +1,115 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from collections.abc import Callable
+from typing import TYPE_CHECKING, Optional, overload
+
+from databricks.bundles.core._bundle import Bundle
+from databricks.bundles.core._location import Location
+from databricks.bundles.core._resource_mutator import ResourceMutator
+from databricks.bundles.core._transform import _transform
+
+if TYPE_CHECKING:
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.jobs._models.job import Job, JobParam
+
+
+def _resource_type() -> "_ResourceType":
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.jobs._models.job import Job
+
+    return _ResourceType(
+        resource_type=Job,
+        singular_name="job",
+        plural_name="jobs",
+    )
+
+
+class _JobResources:
+    """
+    Generated job accessors, mixed into Resources.
+    """
+
+    # Provided by the Resources subclass; declared here so the generated methods
+    # below type-check.
+    _resources: dict[str, dict]
+
+    if TYPE_CHECKING:
+
+        def add_location(self, path: tuple[str, ...], location: Location) -> None: ...
+
+        def add_diagnostic_error(
+            self,
+            msg: str,
+            *,
+            detail: Optional[str] = None,
+            path: Optional[tuple[str, ...]] = None,
+            location: Optional[Location] = None,
+        ) -> None: ...
+
+    @property
+    def jobs(self) -> dict[str, "Job"]:
+        return self._resources["jobs"]
+
+    def add_job(
+        self,
+        resource_name: str,
+        job: "JobParam",
+        *,
+        location: Optional[Location] = None,
+    ) -> None:
+        """
+        Adds the resource job to the collection of resources. Resource name must be unique across all jobs.
+
+        :param resource_name: unique identifier for the job
+        :param job: the job to add, can be Job or dict
+        :param location: optional location of the job in the source code
+        """
+        from databricks.bundles.jobs._models.job import Job
+
+        job = _transform(Job, job)
+        path = ("resources", "jobs", resource_name)
+        location = location or Location.from_stack_frame(depth=1)
+
+        if self._resources["jobs"].get(resource_name):
+            self.add_diagnostic_error(
+                msg=f"Duplicate resource name '{resource_name}' for resource 'job'. Resource names must be unique.",
+                location=location,
+                path=path,
+            )
+        else:
+            if location:
+                self.add_location(path, location)
+
+            self._resources["jobs"][resource_name] = job
+
+
+@overload
+def job_mutator(
+    function: Callable[[Bundle, "Job"], "Job"],
+) -> ResourceMutator["Job"]: ...
+
+
+@overload
+def job_mutator(
+    function: Callable[["Job"], "Job"],
+) -> ResourceMutator["Job"]: ...
+
+
+def job_mutator(function: Callable) -> ResourceMutator["Job"]:
+    """
+    Decorator for defining mutator for jobs. Function should return a new instance of the job
+    with the desired changes, instead of mutating the input job.
+
+    Example:
+
+    .. code-block:: python
+
+        @job_mutator
+        def my_job_mutator(bundle: Bundle, job: Job) -> Job:
+            return replace(job, ...)
+
+    :param function: Function that mutates jobs.
+    """
+    from databricks.bundles.jobs._models.job import Job
+
+    return ResourceMutator(resource_type=Job, function=function)
diff --git a/python/databricks/bundles/core/_generated/mcp_services.py b/python/databricks/bundles/core/_generated/mcp_services.py
new file mode 100644
index 00000000000..5e5bf32ae08
--- /dev/null
+++ b/python/databricks/bundles/core/_generated/mcp_services.py
@@ -0,0 +1,118 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from collections.abc import Callable
+from typing import TYPE_CHECKING, Optional, overload
+
+from databricks.bundles.core._bundle import Bundle
+from databricks.bundles.core._location import Location
+from databricks.bundles.core._resource_mutator import ResourceMutator
+from databricks.bundles.core._transform import _transform
+
+if TYPE_CHECKING:
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.mcp_services._models.mcp_service import (
+        McpService,
+        McpServiceParam,
+    )
+
+
+def _resource_type() -> "_ResourceType":
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.mcp_services._models.mcp_service import McpService
+
+    return _ResourceType(
+        resource_type=McpService,
+        singular_name="mcp_service",
+        plural_name="mcp_services",
+    )
+
+
+class _McpServiceResources:
+    """
+    Generated mcp_service accessors, mixed into Resources.
+    """
+
+    # Provided by the Resources subclass; declared here so the generated methods
+    # below type-check.
+    _resources: dict[str, dict]
+
+    if TYPE_CHECKING:
+
+        def add_location(self, path: tuple[str, ...], location: Location) -> None: ...
+
+        def add_diagnostic_error(
+            self,
+            msg: str,
+            *,
+            detail: Optional[str] = None,
+            path: Optional[tuple[str, ...]] = None,
+            location: Optional[Location] = None,
+        ) -> None: ...
+
+    @property
+    def mcp_services(self) -> dict[str, "McpService"]:
+        return self._resources["mcp_services"]
+
+    def add_mcp_service(
+        self,
+        resource_name: str,
+        mcp_service: "McpServiceParam",
+        *,
+        location: Optional[Location] = None,
+    ) -> None:
+        """
+        Adds the resource mcp_service to the collection of resources. Resource name must be unique across all mcp_services.
+
+        :param resource_name: unique identifier for the mcp_service
+        :param mcp_service: the mcp_service to add, can be McpService or dict
+        :param location: optional location of the mcp_service in the source code
+        """
+        from databricks.bundles.mcp_services._models.mcp_service import McpService
+
+        mcp_service = _transform(McpService, mcp_service)
+        path = ("resources", "mcp_services", resource_name)
+        location = location or Location.from_stack_frame(depth=1)
+
+        if self._resources["mcp_services"].get(resource_name):
+            self.add_diagnostic_error(
+                msg=f"Duplicate resource name '{resource_name}' for resource 'mcp_service'. Resource names must be unique.",
+                location=location,
+                path=path,
+            )
+        else:
+            if location:
+                self.add_location(path, location)
+
+            self._resources["mcp_services"][resource_name] = mcp_service
+
+
+@overload
+def mcp_service_mutator(
+    function: Callable[[Bundle, "McpService"], "McpService"],
+) -> ResourceMutator["McpService"]: ...
+
+
+@overload
+def mcp_service_mutator(
+    function: Callable[["McpService"], "McpService"],
+) -> ResourceMutator["McpService"]: ...
+
+
+def mcp_service_mutator(function: Callable) -> ResourceMutator["McpService"]:
+    """
+    Decorator for defining mutator for mcp_services. Function should return a new instance of the mcp_service
+    with the desired changes, instead of mutating the input mcp_service.
+
+    Example:
+
+    .. code-block:: python
+
+        @mcp_service_mutator
+        def my_mcp_service_mutator(bundle: Bundle, mcp_service: McpService) -> McpService:
+            return replace(mcp_service, ...)
+
+    :param function: Function that mutates mcp_services.
+    """
+    from databricks.bundles.mcp_services._models.mcp_service import McpService
+
+    return ResourceMutator(resource_type=McpService, function=function)
diff --git a/python/databricks/bundles/core/_generated/model_provider_services.py b/python/databricks/bundles/core/_generated/model_provider_services.py
new file mode 100644
index 00000000000..89f5b631fcc
--- /dev/null
+++ b/python/databricks/bundles/core/_generated/model_provider_services.py
@@ -0,0 +1,130 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from collections.abc import Callable
+from typing import TYPE_CHECKING, Optional, overload
+
+from databricks.bundles.core._bundle import Bundle
+from databricks.bundles.core._location import Location
+from databricks.bundles.core._resource_mutator import ResourceMutator
+from databricks.bundles.core._transform import _transform
+
+if TYPE_CHECKING:
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.model_provider_services._models.model_provider_service import (
+        ModelProviderService,
+        ModelProviderServiceParam,
+    )
+
+
+def _resource_type() -> "_ResourceType":
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.model_provider_services._models.model_provider_service import (
+        ModelProviderService,
+    )
+
+    return _ResourceType(
+        resource_type=ModelProviderService,
+        singular_name="model_provider_service",
+        plural_name="model_provider_services",
+    )
+
+
+class _ModelProviderServiceResources:
+    """
+    Generated model_provider_service accessors, mixed into Resources.
+    """
+
+    # Provided by the Resources subclass; declared here so the generated methods
+    # below type-check.
+    _resources: dict[str, dict]
+
+    if TYPE_CHECKING:
+
+        def add_location(self, path: tuple[str, ...], location: Location) -> None: ...
+
+        def add_diagnostic_error(
+            self,
+            msg: str,
+            *,
+            detail: Optional[str] = None,
+            path: Optional[tuple[str, ...]] = None,
+            location: Optional[Location] = None,
+        ) -> None: ...
+
+    @property
+    def model_provider_services(self) -> dict[str, "ModelProviderService"]:
+        return self._resources["model_provider_services"]
+
+    def add_model_provider_service(
+        self,
+        resource_name: str,
+        model_provider_service: "ModelProviderServiceParam",
+        *,
+        location: Optional[Location] = None,
+    ) -> None:
+        """
+        Adds the resource model_provider_service to the collection of resources. Resource name must be unique across all model_provider_services.
+
+        :param resource_name: unique identifier for the model_provider_service
+        :param model_provider_service: the model_provider_service to add, can be ModelProviderService or dict
+        :param location: optional location of the model_provider_service in the source code
+        """
+        from databricks.bundles.model_provider_services._models.model_provider_service import (
+            ModelProviderService,
+        )
+
+        model_provider_service = _transform(
+            ModelProviderService, model_provider_service
+        )
+        path = ("resources", "model_provider_services", resource_name)
+        location = location or Location.from_stack_frame(depth=1)
+
+        if self._resources["model_provider_services"].get(resource_name):
+            self.add_diagnostic_error(
+                msg=f"Duplicate resource name '{resource_name}' for resource 'model_provider_service'. Resource names must be unique.",
+                location=location,
+                path=path,
+            )
+        else:
+            if location:
+                self.add_location(path, location)
+
+            self._resources["model_provider_services"][resource_name] = (
+                model_provider_service
+            )
+
+
+@overload
+def model_provider_service_mutator(
+    function: Callable[[Bundle, "ModelProviderService"], "ModelProviderService"],
+) -> ResourceMutator["ModelProviderService"]: ...
+
+
+@overload
+def model_provider_service_mutator(
+    function: Callable[["ModelProviderService"], "ModelProviderService"],
+) -> ResourceMutator["ModelProviderService"]: ...
+
+
+def model_provider_service_mutator(
+    function: Callable,
+) -> ResourceMutator["ModelProviderService"]:
+    """
+    Decorator for defining mutator for model_provider_services. Function should return a new instance of the model_provider_service
+    with the desired changes, instead of mutating the input model_provider_service.
+
+    Example:
+
+    .. code-block:: python
+
+        @model_provider_service_mutator
+        def my_model_provider_service_mutator(bundle: Bundle, model_provider_service: ModelProviderService) -> ModelProviderService:
+            return replace(model_provider_service, ...)
+
+    :param function: Function that mutates model_provider_services.
+    """
+    from databricks.bundles.model_provider_services._models.model_provider_service import (
+        ModelProviderService,
+    )
+
+    return ResourceMutator(resource_type=ModelProviderService, function=function)
diff --git a/python/databricks/bundles/core/_generated/model_services.py b/python/databricks/bundles/core/_generated/model_services.py
new file mode 100644
index 00000000000..2b37ebe7d6b
--- /dev/null
+++ b/python/databricks/bundles/core/_generated/model_services.py
@@ -0,0 +1,118 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from collections.abc import Callable
+from typing import TYPE_CHECKING, Optional, overload
+
+from databricks.bundles.core._bundle import Bundle
+from databricks.bundles.core._location import Location
+from databricks.bundles.core._resource_mutator import ResourceMutator
+from databricks.bundles.core._transform import _transform
+
+if TYPE_CHECKING:
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.model_services._models.model_service import (
+        ModelService,
+        ModelServiceParam,
+    )
+
+
+def _resource_type() -> "_ResourceType":
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.model_services._models.model_service import ModelService
+
+    return _ResourceType(
+        resource_type=ModelService,
+        singular_name="model_service",
+        plural_name="model_services",
+    )
+
+
+class _ModelServiceResources:
+    """
+    Generated model_service accessors, mixed into Resources.
+    """
+
+    # Provided by the Resources subclass; declared here so the generated methods
+    # below type-check.
+    _resources: dict[str, dict]
+
+    if TYPE_CHECKING:
+
+        def add_location(self, path: tuple[str, ...], location: Location) -> None: ...
+
+        def add_diagnostic_error(
+            self,
+            msg: str,
+            *,
+            detail: Optional[str] = None,
+            path: Optional[tuple[str, ...]] = None,
+            location: Optional[Location] = None,
+        ) -> None: ...
+
+    @property
+    def model_services(self) -> dict[str, "ModelService"]:
+        return self._resources["model_services"]
+
+    def add_model_service(
+        self,
+        resource_name: str,
+        model_service: "ModelServiceParam",
+        *,
+        location: Optional[Location] = None,
+    ) -> None:
+        """
+        Adds the resource model_service to the collection of resources. Resource name must be unique across all model_services.
+
+        :param resource_name: unique identifier for the model_service
+        :param model_service: the model_service to add, can be ModelService or dict
+        :param location: optional location of the model_service in the source code
+        """
+        from databricks.bundles.model_services._models.model_service import ModelService
+
+        model_service = _transform(ModelService, model_service)
+        path = ("resources", "model_services", resource_name)
+        location = location or Location.from_stack_frame(depth=1)
+
+        if self._resources["model_services"].get(resource_name):
+            self.add_diagnostic_error(
+                msg=f"Duplicate resource name '{resource_name}' for resource 'model_service'. Resource names must be unique.",
+                location=location,
+                path=path,
+            )
+        else:
+            if location:
+                self.add_location(path, location)
+
+            self._resources["model_services"][resource_name] = model_service
+
+
+@overload
+def model_service_mutator(
+    function: Callable[[Bundle, "ModelService"], "ModelService"],
+) -> ResourceMutator["ModelService"]: ...
+
+
+@overload
+def model_service_mutator(
+    function: Callable[["ModelService"], "ModelService"],
+) -> ResourceMutator["ModelService"]: ...
+
+
+def model_service_mutator(function: Callable) -> ResourceMutator["ModelService"]:
+    """
+    Decorator for defining mutator for model_services. Function should return a new instance of the model_service
+    with the desired changes, instead of mutating the input model_service.
+
+    Example:
+
+    .. code-block:: python
+
+        @model_service_mutator
+        def my_model_service_mutator(bundle: Bundle, model_service: ModelService) -> ModelService:
+            return replace(model_service, ...)
+
+    :param function: Function that mutates model_services.
+    """
+    from databricks.bundles.model_services._models.model_service import ModelService
+
+    return ResourceMutator(resource_type=ModelService, function=function)
diff --git a/python/databricks/bundles/core/_generated/model_serving_endpoints.py b/python/databricks/bundles/core/_generated/model_serving_endpoints.py
new file mode 100644
index 00000000000..56a9ecde661
--- /dev/null
+++ b/python/databricks/bundles/core/_generated/model_serving_endpoints.py
@@ -0,0 +1,130 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from collections.abc import Callable
+from typing import TYPE_CHECKING, Optional, overload
+
+from databricks.bundles.core._bundle import Bundle
+from databricks.bundles.core._location import Location
+from databricks.bundles.core._resource_mutator import ResourceMutator
+from databricks.bundles.core._transform import _transform
+
+if TYPE_CHECKING:
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.model_serving_endpoints._models.model_serving_endpoint import (
+        ModelServingEndpoint,
+        ModelServingEndpointParam,
+    )
+
+
+def _resource_type() -> "_ResourceType":
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.model_serving_endpoints._models.model_serving_endpoint import (
+        ModelServingEndpoint,
+    )
+
+    return _ResourceType(
+        resource_type=ModelServingEndpoint,
+        singular_name="model_serving_endpoint",
+        plural_name="model_serving_endpoints",
+    )
+
+
+class _ModelServingEndpointResources:
+    """
+    Generated model_serving_endpoint accessors, mixed into Resources.
+    """
+
+    # Provided by the Resources subclass; declared here so the generated methods
+    # below type-check.
+    _resources: dict[str, dict]
+
+    if TYPE_CHECKING:
+
+        def add_location(self, path: tuple[str, ...], location: Location) -> None: ...
+
+        def add_diagnostic_error(
+            self,
+            msg: str,
+            *,
+            detail: Optional[str] = None,
+            path: Optional[tuple[str, ...]] = None,
+            location: Optional[Location] = None,
+        ) -> None: ...
+
+    @property
+    def model_serving_endpoints(self) -> dict[str, "ModelServingEndpoint"]:
+        return self._resources["model_serving_endpoints"]
+
+    def add_model_serving_endpoint(
+        self,
+        resource_name: str,
+        model_serving_endpoint: "ModelServingEndpointParam",
+        *,
+        location: Optional[Location] = None,
+    ) -> None:
+        """
+        Adds the resource model_serving_endpoint to the collection of resources. Resource name must be unique across all model_serving_endpoints.
+
+        :param resource_name: unique identifier for the model_serving_endpoint
+        :param model_serving_endpoint: the model_serving_endpoint to add, can be ModelServingEndpoint or dict
+        :param location: optional location of the model_serving_endpoint in the source code
+        """
+        from databricks.bundles.model_serving_endpoints._models.model_serving_endpoint import (
+            ModelServingEndpoint,
+        )
+
+        model_serving_endpoint = _transform(
+            ModelServingEndpoint, model_serving_endpoint
+        )
+        path = ("resources", "model_serving_endpoints", resource_name)
+        location = location or Location.from_stack_frame(depth=1)
+
+        if self._resources["model_serving_endpoints"].get(resource_name):
+            self.add_diagnostic_error(
+                msg=f"Duplicate resource name '{resource_name}' for resource 'model_serving_endpoint'. Resource names must be unique.",
+                location=location,
+                path=path,
+            )
+        else:
+            if location:
+                self.add_location(path, location)
+
+            self._resources["model_serving_endpoints"][resource_name] = (
+                model_serving_endpoint
+            )
+
+
+@overload
+def model_serving_endpoint_mutator(
+    function: Callable[[Bundle, "ModelServingEndpoint"], "ModelServingEndpoint"],
+) -> ResourceMutator["ModelServingEndpoint"]: ...
+
+
+@overload
+def model_serving_endpoint_mutator(
+    function: Callable[["ModelServingEndpoint"], "ModelServingEndpoint"],
+) -> ResourceMutator["ModelServingEndpoint"]: ...
+
+
+def model_serving_endpoint_mutator(
+    function: Callable,
+) -> ResourceMutator["ModelServingEndpoint"]:
+    """
+    Decorator for defining mutator for model_serving_endpoints. Function should return a new instance of the model_serving_endpoint
+    with the desired changes, instead of mutating the input model_serving_endpoint.
+
+    Example:
+
+    .. code-block:: python
+
+        @model_serving_endpoint_mutator
+        def my_model_serving_endpoint_mutator(bundle: Bundle, model_serving_endpoint: ModelServingEndpoint) -> ModelServingEndpoint:
+            return replace(model_serving_endpoint, ...)
+
+    :param function: Function that mutates model_serving_endpoints.
+    """
+    from databricks.bundles.model_serving_endpoints._models.model_serving_endpoint import (
+        ModelServingEndpoint,
+    )
+
+    return ResourceMutator(resource_type=ModelServingEndpoint, function=function)
diff --git a/python/databricks/bundles/core/_generated/models.py b/python/databricks/bundles/core/_generated/models.py
new file mode 100644
index 00000000000..df7a4c6d6a3
--- /dev/null
+++ b/python/databricks/bundles/core/_generated/models.py
@@ -0,0 +1,118 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from collections.abc import Callable
+from typing import TYPE_CHECKING, Optional, overload
+
+from databricks.bundles.core._bundle import Bundle
+from databricks.bundles.core._location import Location
+from databricks.bundles.core._resource_mutator import ResourceMutator
+from databricks.bundles.core._transform import _transform
+
+if TYPE_CHECKING:
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.models._models.mlflow_model import (
+        MlflowModel,
+        MlflowModelParam,
+    )
+
+
+def _resource_type() -> "_ResourceType":
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.models._models.mlflow_model import MlflowModel
+
+    return _ResourceType(
+        resource_type=MlflowModel,
+        singular_name="mlflow_model",
+        plural_name="models",
+    )
+
+
+class _MlflowModelResources:
+    """
+    Generated mlflow_model accessors, mixed into Resources.
+    """
+
+    # Provided by the Resources subclass; declared here so the generated methods
+    # below type-check.
+    _resources: dict[str, dict]
+
+    if TYPE_CHECKING:
+
+        def add_location(self, path: tuple[str, ...], location: Location) -> None: ...
+
+        def add_diagnostic_error(
+            self,
+            msg: str,
+            *,
+            detail: Optional[str] = None,
+            path: Optional[tuple[str, ...]] = None,
+            location: Optional[Location] = None,
+        ) -> None: ...
+
+    @property
+    def models(self) -> dict[str, "MlflowModel"]:
+        return self._resources["models"]
+
+    def add_mlflow_model(
+        self,
+        resource_name: str,
+        mlflow_model: "MlflowModelParam",
+        *,
+        location: Optional[Location] = None,
+    ) -> None:
+        """
+        Adds the resource mlflow_model to the collection of resources. Resource name must be unique across all models.
+
+        :param resource_name: unique identifier for the mlflow_model
+        :param mlflow_model: the mlflow_model to add, can be MlflowModel or dict
+        :param location: optional location of the mlflow_model in the source code
+        """
+        from databricks.bundles.models._models.mlflow_model import MlflowModel
+
+        mlflow_model = _transform(MlflowModel, mlflow_model)
+        path = ("resources", "models", resource_name)
+        location = location or Location.from_stack_frame(depth=1)
+
+        if self._resources["models"].get(resource_name):
+            self.add_diagnostic_error(
+                msg=f"Duplicate resource name '{resource_name}' for resource 'mlflow_model'. Resource names must be unique.",
+                location=location,
+                path=path,
+            )
+        else:
+            if location:
+                self.add_location(path, location)
+
+            self._resources["models"][resource_name] = mlflow_model
+
+
+@overload
+def mlflow_model_mutator(
+    function: Callable[[Bundle, "MlflowModel"], "MlflowModel"],
+) -> ResourceMutator["MlflowModel"]: ...
+
+
+@overload
+def mlflow_model_mutator(
+    function: Callable[["MlflowModel"], "MlflowModel"],
+) -> ResourceMutator["MlflowModel"]: ...
+
+
+def mlflow_model_mutator(function: Callable) -> ResourceMutator["MlflowModel"]:
+    """
+    Decorator for defining mutator for models. Function should return a new instance of the mlflow_model
+    with the desired changes, instead of mutating the input mlflow_model.
+
+    Example:
+
+    .. code-block:: python
+
+        @mlflow_model_mutator
+        def my_mlflow_model_mutator(bundle: Bundle, mlflow_model: MlflowModel) -> MlflowModel:
+            return replace(mlflow_model, ...)
+
+    :param function: Function that mutates models.
+    """
+    from databricks.bundles.models._models.mlflow_model import MlflowModel
+
+    return ResourceMutator(resource_type=MlflowModel, function=function)
diff --git a/python/databricks/bundles/core/_generated/pipelines.py b/python/databricks/bundles/core/_generated/pipelines.py
new file mode 100644
index 00000000000..961070a6e4b
--- /dev/null
+++ b/python/databricks/bundles/core/_generated/pipelines.py
@@ -0,0 +1,115 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from collections.abc import Callable
+from typing import TYPE_CHECKING, Optional, overload
+
+from databricks.bundles.core._bundle import Bundle
+from databricks.bundles.core._location import Location
+from databricks.bundles.core._resource_mutator import ResourceMutator
+from databricks.bundles.core._transform import _transform
+
+if TYPE_CHECKING:
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.pipelines._models.pipeline import Pipeline, PipelineParam
+
+
+def _resource_type() -> "_ResourceType":
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.pipelines._models.pipeline import Pipeline
+
+    return _ResourceType(
+        resource_type=Pipeline,
+        singular_name="pipeline",
+        plural_name="pipelines",
+    )
+
+
+class _PipelineResources:
+    """
+    Generated pipeline accessors, mixed into Resources.
+    """
+
+    # Provided by the Resources subclass; declared here so the generated methods
+    # below type-check.
+    _resources: dict[str, dict]
+
+    if TYPE_CHECKING:
+
+        def add_location(self, path: tuple[str, ...], location: Location) -> None: ...
+
+        def add_diagnostic_error(
+            self,
+            msg: str,
+            *,
+            detail: Optional[str] = None,
+            path: Optional[tuple[str, ...]] = None,
+            location: Optional[Location] = None,
+        ) -> None: ...
+
+    @property
+    def pipelines(self) -> dict[str, "Pipeline"]:
+        return self._resources["pipelines"]
+
+    def add_pipeline(
+        self,
+        resource_name: str,
+        pipeline: "PipelineParam",
+        *,
+        location: Optional[Location] = None,
+    ) -> None:
+        """
+        Adds the resource pipeline to the collection of resources. Resource name must be unique across all pipelines.
+
+        :param resource_name: unique identifier for the pipeline
+        :param pipeline: the pipeline to add, can be Pipeline or dict
+        :param location: optional location of the pipeline in the source code
+        """
+        from databricks.bundles.pipelines._models.pipeline import Pipeline
+
+        pipeline = _transform(Pipeline, pipeline)
+        path = ("resources", "pipelines", resource_name)
+        location = location or Location.from_stack_frame(depth=1)
+
+        if self._resources["pipelines"].get(resource_name):
+            self.add_diagnostic_error(
+                msg=f"Duplicate resource name '{resource_name}' for resource 'pipeline'. Resource names must be unique.",
+                location=location,
+                path=path,
+            )
+        else:
+            if location:
+                self.add_location(path, location)
+
+            self._resources["pipelines"][resource_name] = pipeline
+
+
+@overload
+def pipeline_mutator(
+    function: Callable[[Bundle, "Pipeline"], "Pipeline"],
+) -> ResourceMutator["Pipeline"]: ...
+
+
+@overload
+def pipeline_mutator(
+    function: Callable[["Pipeline"], "Pipeline"],
+) -> ResourceMutator["Pipeline"]: ...
+
+
+def pipeline_mutator(function: Callable) -> ResourceMutator["Pipeline"]:
+    """
+    Decorator for defining mutator for pipelines. Function should return a new instance of the pipeline
+    with the desired changes, instead of mutating the input pipeline.
+
+    Example:
+
+    .. code-block:: python
+
+        @pipeline_mutator
+        def my_pipeline_mutator(bundle: Bundle, pipeline: Pipeline) -> Pipeline:
+            return replace(pipeline, ...)
+
+    :param function: Function that mutates pipelines.
+    """
+    from databricks.bundles.pipelines._models.pipeline import Pipeline
+
+    return ResourceMutator(resource_type=Pipeline, function=function)
diff --git a/python/databricks/bundles/core/_generated/quality_monitors.py b/python/databricks/bundles/core/_generated/quality_monitors.py
new file mode 100644
index 00000000000..ba3f52a75ae
--- /dev/null
+++ b/python/databricks/bundles/core/_generated/quality_monitors.py
@@ -0,0 +1,124 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from collections.abc import Callable
+from typing import TYPE_CHECKING, Optional, overload
+
+from databricks.bundles.core._bundle import Bundle
+from databricks.bundles.core._location import Location
+from databricks.bundles.core._resource_mutator import ResourceMutator
+from databricks.bundles.core._transform import _transform
+
+if TYPE_CHECKING:
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.quality_monitors._models.quality_monitor import (
+        QualityMonitor,
+        QualityMonitorParam,
+    )
+
+
+def _resource_type() -> "_ResourceType":
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.quality_monitors._models.quality_monitor import (
+        QualityMonitor,
+    )
+
+    return _ResourceType(
+        resource_type=QualityMonitor,
+        singular_name="quality_monitor",
+        plural_name="quality_monitors",
+    )
+
+
+class _QualityMonitorResources:
+    """
+    Generated quality_monitor accessors, mixed into Resources.
+    """
+
+    # Provided by the Resources subclass; declared here so the generated methods
+    # below type-check.
+    _resources: dict[str, dict]
+
+    if TYPE_CHECKING:
+
+        def add_location(self, path: tuple[str, ...], location: Location) -> None: ...
+
+        def add_diagnostic_error(
+            self,
+            msg: str,
+            *,
+            detail: Optional[str] = None,
+            path: Optional[tuple[str, ...]] = None,
+            location: Optional[Location] = None,
+        ) -> None: ...
+
+    @property
+    def quality_monitors(self) -> dict[str, "QualityMonitor"]:
+        return self._resources["quality_monitors"]
+
+    def add_quality_monitor(
+        self,
+        resource_name: str,
+        quality_monitor: "QualityMonitorParam",
+        *,
+        location: Optional[Location] = None,
+    ) -> None:
+        """
+        Adds the resource quality_monitor to the collection of resources. Resource name must be unique across all quality_monitors.
+
+        :param resource_name: unique identifier for the quality_monitor
+        :param quality_monitor: the quality_monitor to add, can be QualityMonitor or dict
+        :param location: optional location of the quality_monitor in the source code
+        """
+        from databricks.bundles.quality_monitors._models.quality_monitor import (
+            QualityMonitor,
+        )
+
+        quality_monitor = _transform(QualityMonitor, quality_monitor)
+        path = ("resources", "quality_monitors", resource_name)
+        location = location or Location.from_stack_frame(depth=1)
+
+        if self._resources["quality_monitors"].get(resource_name):
+            self.add_diagnostic_error(
+                msg=f"Duplicate resource name '{resource_name}' for resource 'quality_monitor'. Resource names must be unique.",
+                location=location,
+                path=path,
+            )
+        else:
+            if location:
+                self.add_location(path, location)
+
+            self._resources["quality_monitors"][resource_name] = quality_monitor
+
+
+@overload
+def quality_monitor_mutator(
+    function: Callable[[Bundle, "QualityMonitor"], "QualityMonitor"],
+) -> ResourceMutator["QualityMonitor"]: ...
+
+
+@overload
+def quality_monitor_mutator(
+    function: Callable[["QualityMonitor"], "QualityMonitor"],
+) -> ResourceMutator["QualityMonitor"]: ...
+
+
+def quality_monitor_mutator(function: Callable) -> ResourceMutator["QualityMonitor"]:
+    """
+    Decorator for defining mutator for quality_monitors. Function should return a new instance of the quality_monitor
+    with the desired changes, instead of mutating the input quality_monitor.
+
+    Example:
+
+    .. code-block:: python
+
+        @quality_monitor_mutator
+        def my_quality_monitor_mutator(bundle: Bundle, quality_monitor: QualityMonitor) -> QualityMonitor:
+            return replace(quality_monitor, ...)
+
+    :param function: Function that mutates quality_monitors.
+    """
+    from databricks.bundles.quality_monitors._models.quality_monitor import (
+        QualityMonitor,
+    )
+
+    return ResourceMutator(resource_type=QualityMonitor, function=function)
diff --git a/python/databricks/bundles/core/_generated/registered_models.py b/python/databricks/bundles/core/_generated/registered_models.py
new file mode 100644
index 00000000000..cdc492beeb3
--- /dev/null
+++ b/python/databricks/bundles/core/_generated/registered_models.py
@@ -0,0 +1,124 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from collections.abc import Callable
+from typing import TYPE_CHECKING, Optional, overload
+
+from databricks.bundles.core._bundle import Bundle
+from databricks.bundles.core._location import Location
+from databricks.bundles.core._resource_mutator import ResourceMutator
+from databricks.bundles.core._transform import _transform
+
+if TYPE_CHECKING:
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.registered_models._models.registered_model import (
+        RegisteredModel,
+        RegisteredModelParam,
+    )
+
+
+def _resource_type() -> "_ResourceType":
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.registered_models._models.registered_model import (
+        RegisteredModel,
+    )
+
+    return _ResourceType(
+        resource_type=RegisteredModel,
+        singular_name="registered_model",
+        plural_name="registered_models",
+    )
+
+
+class _RegisteredModelResources:
+    """
+    Generated registered_model accessors, mixed into Resources.
+    """
+
+    # Provided by the Resources subclass; declared here so the generated methods
+    # below type-check.
+    _resources: dict[str, dict]
+
+    if TYPE_CHECKING:
+
+        def add_location(self, path: tuple[str, ...], location: Location) -> None: ...
+
+        def add_diagnostic_error(
+            self,
+            msg: str,
+            *,
+            detail: Optional[str] = None,
+            path: Optional[tuple[str, ...]] = None,
+            location: Optional[Location] = None,
+        ) -> None: ...
+
+    @property
+    def registered_models(self) -> dict[str, "RegisteredModel"]:
+        return self._resources["registered_models"]
+
+    def add_registered_model(
+        self,
+        resource_name: str,
+        registered_model: "RegisteredModelParam",
+        *,
+        location: Optional[Location] = None,
+    ) -> None:
+        """
+        Adds the resource registered_model to the collection of resources. Resource name must be unique across all registered_models.
+
+        :param resource_name: unique identifier for the registered_model
+        :param registered_model: the registered_model to add, can be RegisteredModel or dict
+        :param location: optional location of the registered_model in the source code
+        """
+        from databricks.bundles.registered_models._models.registered_model import (
+            RegisteredModel,
+        )
+
+        registered_model = _transform(RegisteredModel, registered_model)
+        path = ("resources", "registered_models", resource_name)
+        location = location or Location.from_stack_frame(depth=1)
+
+        if self._resources["registered_models"].get(resource_name):
+            self.add_diagnostic_error(
+                msg=f"Duplicate resource name '{resource_name}' for resource 'registered_model'. Resource names must be unique.",
+                location=location,
+                path=path,
+            )
+        else:
+            if location:
+                self.add_location(path, location)
+
+            self._resources["registered_models"][resource_name] = registered_model
+
+
+@overload
+def registered_model_mutator(
+    function: Callable[[Bundle, "RegisteredModel"], "RegisteredModel"],
+) -> ResourceMutator["RegisteredModel"]: ...
+
+
+@overload
+def registered_model_mutator(
+    function: Callable[["RegisteredModel"], "RegisteredModel"],
+) -> ResourceMutator["RegisteredModel"]: ...
+
+
+def registered_model_mutator(function: Callable) -> ResourceMutator["RegisteredModel"]:
+    """
+    Decorator for defining mutator for registered_models. Function should return a new instance of the registered_model
+    with the desired changes, instead of mutating the input registered_model.
+
+    Example:
+
+    .. code-block:: python
+
+        @registered_model_mutator
+        def my_registered_model_mutator(bundle: Bundle, registered_model: RegisteredModel) -> RegisteredModel:
+            return replace(registered_model, ...)
+
+    :param function: Function that mutates registered_models.
+    """
+    from databricks.bundles.registered_models._models.registered_model import (
+        RegisteredModel,
+    )
+
+    return ResourceMutator(resource_type=RegisteredModel, function=function)
diff --git a/python/databricks/bundles/core/_generated/schemas.py b/python/databricks/bundles/core/_generated/schemas.py
new file mode 100644
index 00000000000..e83fe02c415
--- /dev/null
+++ b/python/databricks/bundles/core/_generated/schemas.py
@@ -0,0 +1,115 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from collections.abc import Callable
+from typing import TYPE_CHECKING, Optional, overload
+
+from databricks.bundles.core._bundle import Bundle
+from databricks.bundles.core._location import Location
+from databricks.bundles.core._resource_mutator import ResourceMutator
+from databricks.bundles.core._transform import _transform
+
+if TYPE_CHECKING:
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.schemas._models.schema import Schema, SchemaParam
+
+
+def _resource_type() -> "_ResourceType":
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.schemas._models.schema import Schema
+
+    return _ResourceType(
+        resource_type=Schema,
+        singular_name="schema",
+        plural_name="schemas",
+    )
+
+
+class _SchemaResources:
+    """
+    Generated schema accessors, mixed into Resources.
+    """
+
+    # Provided by the Resources subclass; declared here so the generated methods
+    # below type-check.
+    _resources: dict[str, dict]
+
+    if TYPE_CHECKING:
+
+        def add_location(self, path: tuple[str, ...], location: Location) -> None: ...
+
+        def add_diagnostic_error(
+            self,
+            msg: str,
+            *,
+            detail: Optional[str] = None,
+            path: Optional[tuple[str, ...]] = None,
+            location: Optional[Location] = None,
+        ) -> None: ...
+
+    @property
+    def schemas(self) -> dict[str, "Schema"]:
+        return self._resources["schemas"]
+
+    def add_schema(
+        self,
+        resource_name: str,
+        schema: "SchemaParam",
+        *,
+        location: Optional[Location] = None,
+    ) -> None:
+        """
+        Adds the resource schema to the collection of resources. Resource name must be unique across all schemas.
+
+        :param resource_name: unique identifier for the schema
+        :param schema: the schema to add, can be Schema or dict
+        :param location: optional location of the schema in the source code
+        """
+        from databricks.bundles.schemas._models.schema import Schema
+
+        schema = _transform(Schema, schema)
+        path = ("resources", "schemas", resource_name)
+        location = location or Location.from_stack_frame(depth=1)
+
+        if self._resources["schemas"].get(resource_name):
+            self.add_diagnostic_error(
+                msg=f"Duplicate resource name '{resource_name}' for resource 'schema'. Resource names must be unique.",
+                location=location,
+                path=path,
+            )
+        else:
+            if location:
+                self.add_location(path, location)
+
+            self._resources["schemas"][resource_name] = schema
+
+
+@overload
+def schema_mutator(
+    function: Callable[[Bundle, "Schema"], "Schema"],
+) -> ResourceMutator["Schema"]: ...
+
+
+@overload
+def schema_mutator(
+    function: Callable[["Schema"], "Schema"],
+) -> ResourceMutator["Schema"]: ...
+
+
+def schema_mutator(function: Callable) -> ResourceMutator["Schema"]:
+    """
+    Decorator for defining mutator for schemas. Function should return a new instance of the schema
+    with the desired changes, instead of mutating the input schema.
+
+    Example:
+
+    .. code-block:: python
+
+        @schema_mutator
+        def my_schema_mutator(bundle: Bundle, schema: Schema) -> Schema:
+            return replace(schema, ...)
+
+    :param function: Function that mutates schemas.
+    """
+    from databricks.bundles.schemas._models.schema import Schema
+
+    return ResourceMutator(resource_type=Schema, function=function)
diff --git a/python/databricks/bundles/core/_generated/secret_scopes.py b/python/databricks/bundles/core/_generated/secret_scopes.py
new file mode 100644
index 00000000000..a8be3660a6a
--- /dev/null
+++ b/python/databricks/bundles/core/_generated/secret_scopes.py
@@ -0,0 +1,118 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from collections.abc import Callable
+from typing import TYPE_CHECKING, Optional, overload
+
+from databricks.bundles.core._bundle import Bundle
+from databricks.bundles.core._location import Location
+from databricks.bundles.core._resource_mutator import ResourceMutator
+from databricks.bundles.core._transform import _transform
+
+if TYPE_CHECKING:
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.secret_scopes._models.secret_scope import (
+        SecretScope,
+        SecretScopeParam,
+    )
+
+
+def _resource_type() -> "_ResourceType":
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.secret_scopes._models.secret_scope import SecretScope
+
+    return _ResourceType(
+        resource_type=SecretScope,
+        singular_name="secret_scope",
+        plural_name="secret_scopes",
+    )
+
+
+class _SecretScopeResources:
+    """
+    Generated secret_scope accessors, mixed into Resources.
+    """
+
+    # Provided by the Resources subclass; declared here so the generated methods
+    # below type-check.
+    _resources: dict[str, dict]
+
+    if TYPE_CHECKING:
+
+        def add_location(self, path: tuple[str, ...], location: Location) -> None: ...
+
+        def add_diagnostic_error(
+            self,
+            msg: str,
+            *,
+            detail: Optional[str] = None,
+            path: Optional[tuple[str, ...]] = None,
+            location: Optional[Location] = None,
+        ) -> None: ...
+
+    @property
+    def secret_scopes(self) -> dict[str, "SecretScope"]:
+        return self._resources["secret_scopes"]
+
+    def add_secret_scope(
+        self,
+        resource_name: str,
+        secret_scope: "SecretScopeParam",
+        *,
+        location: Optional[Location] = None,
+    ) -> None:
+        """
+        Adds the resource secret_scope to the collection of resources. Resource name must be unique across all secret_scopes.
+
+        :param resource_name: unique identifier for the secret_scope
+        :param secret_scope: the secret_scope to add, can be SecretScope or dict
+        :param location: optional location of the secret_scope in the source code
+        """
+        from databricks.bundles.secret_scopes._models.secret_scope import SecretScope
+
+        secret_scope = _transform(SecretScope, secret_scope)
+        path = ("resources", "secret_scopes", resource_name)
+        location = location or Location.from_stack_frame(depth=1)
+
+        if self._resources["secret_scopes"].get(resource_name):
+            self.add_diagnostic_error(
+                msg=f"Duplicate resource name '{resource_name}' for resource 'secret_scope'. Resource names must be unique.",
+                location=location,
+                path=path,
+            )
+        else:
+            if location:
+                self.add_location(path, location)
+
+            self._resources["secret_scopes"][resource_name] = secret_scope
+
+
+@overload
+def secret_scope_mutator(
+    function: Callable[[Bundle, "SecretScope"], "SecretScope"],
+) -> ResourceMutator["SecretScope"]: ...
+
+
+@overload
+def secret_scope_mutator(
+    function: Callable[["SecretScope"], "SecretScope"],
+) -> ResourceMutator["SecretScope"]: ...
+
+
+def secret_scope_mutator(function: Callable) -> ResourceMutator["SecretScope"]:
+    """
+    Decorator for defining mutator for secret_scopes. Function should return a new instance of the secret_scope
+    with the desired changes, instead of mutating the input secret_scope.
+
+    Example:
+
+    .. code-block:: python
+
+        @secret_scope_mutator
+        def my_secret_scope_mutator(bundle: Bundle, secret_scope: SecretScope) -> SecretScope:
+            return replace(secret_scope, ...)
+
+    :param function: Function that mutates secret_scopes.
+    """
+    from databricks.bundles.secret_scopes._models.secret_scope import SecretScope
+
+    return ResourceMutator(resource_type=SecretScope, function=function)
diff --git a/python/databricks/bundles/core/_generated/secrets.py b/python/databricks/bundles/core/_generated/secrets.py
new file mode 100644
index 00000000000..fd99332628d
--- /dev/null
+++ b/python/databricks/bundles/core/_generated/secrets.py
@@ -0,0 +1,115 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from collections.abc import Callable
+from typing import TYPE_CHECKING, Optional, overload
+
+from databricks.bundles.core._bundle import Bundle
+from databricks.bundles.core._location import Location
+from databricks.bundles.core._resource_mutator import ResourceMutator
+from databricks.bundles.core._transform import _transform
+
+if TYPE_CHECKING:
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.secrets._models.secret import Secret, SecretParam
+
+
+def _resource_type() -> "_ResourceType":
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.secrets._models.secret import Secret
+
+    return _ResourceType(
+        resource_type=Secret,
+        singular_name="secret",
+        plural_name="secrets",
+    )
+
+
+class _SecretResources:
+    """
+    Generated secret accessors, mixed into Resources.
+    """
+
+    # Provided by the Resources subclass; declared here so the generated methods
+    # below type-check.
+    _resources: dict[str, dict]
+
+    if TYPE_CHECKING:
+
+        def add_location(self, path: tuple[str, ...], location: Location) -> None: ...
+
+        def add_diagnostic_error(
+            self,
+            msg: str,
+            *,
+            detail: Optional[str] = None,
+            path: Optional[tuple[str, ...]] = None,
+            location: Optional[Location] = None,
+        ) -> None: ...
+
+    @property
+    def secrets(self) -> dict[str, "Secret"]:
+        return self._resources["secrets"]
+
+    def add_secret(
+        self,
+        resource_name: str,
+        secret: "SecretParam",
+        *,
+        location: Optional[Location] = None,
+    ) -> None:
+        """
+        Adds the resource secret to the collection of resources. Resource name must be unique across all secrets.
+
+        :param resource_name: unique identifier for the secret
+        :param secret: the secret to add, can be Secret or dict
+        :param location: optional location of the secret in the source code
+        """
+        from databricks.bundles.secrets._models.secret import Secret
+
+        secret = _transform(Secret, secret)
+        path = ("resources", "secrets", resource_name)
+        location = location or Location.from_stack_frame(depth=1)
+
+        if self._resources["secrets"].get(resource_name):
+            self.add_diagnostic_error(
+                msg=f"Duplicate resource name '{resource_name}' for resource 'secret'. Resource names must be unique.",
+                location=location,
+                path=path,
+            )
+        else:
+            if location:
+                self.add_location(path, location)
+
+            self._resources["secrets"][resource_name] = secret
+
+
+@overload
+def secret_mutator(
+    function: Callable[[Bundle, "Secret"], "Secret"],
+) -> ResourceMutator["Secret"]: ...
+
+
+@overload
+def secret_mutator(
+    function: Callable[["Secret"], "Secret"],
+) -> ResourceMutator["Secret"]: ...
+
+
+def secret_mutator(function: Callable) -> ResourceMutator["Secret"]:
+    """
+    Decorator for defining mutator for secrets. Function should return a new instance of the secret
+    with the desired changes, instead of mutating the input secret.
+
+    Example:
+
+    .. code-block:: python
+
+        @secret_mutator
+        def my_secret_mutator(bundle: Bundle, secret: Secret) -> Secret:
+            return replace(secret, ...)
+
+    :param function: Function that mutates secrets.
+    """
+    from databricks.bundles.secrets._models.secret import Secret
+
+    return ResourceMutator(resource_type=Secret, function=function)
diff --git a/python/databricks/bundles/core/_generated/sql_warehouses.py b/python/databricks/bundles/core/_generated/sql_warehouses.py
new file mode 100644
index 00000000000..05f8bb0cf76
--- /dev/null
+++ b/python/databricks/bundles/core/_generated/sql_warehouses.py
@@ -0,0 +1,118 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from collections.abc import Callable
+from typing import TYPE_CHECKING, Optional, overload
+
+from databricks.bundles.core._bundle import Bundle
+from databricks.bundles.core._location import Location
+from databricks.bundles.core._resource_mutator import ResourceMutator
+from databricks.bundles.core._transform import _transform
+
+if TYPE_CHECKING:
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.sql_warehouses._models.sql_warehouse import (
+        SqlWarehouse,
+        SqlWarehouseParam,
+    )
+
+
+def _resource_type() -> "_ResourceType":
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.sql_warehouses._models.sql_warehouse import SqlWarehouse
+
+    return _ResourceType(
+        resource_type=SqlWarehouse,
+        singular_name="sql_warehouse",
+        plural_name="sql_warehouses",
+    )
+
+
+class _SqlWarehouseResources:
+    """
+    Generated sql_warehouse accessors, mixed into Resources.
+    """
+
+    # Provided by the Resources subclass; declared here so the generated methods
+    # below type-check.
+    _resources: dict[str, dict]
+
+    if TYPE_CHECKING:
+
+        def add_location(self, path: tuple[str, ...], location: Location) -> None: ...
+
+        def add_diagnostic_error(
+            self,
+            msg: str,
+            *,
+            detail: Optional[str] = None,
+            path: Optional[tuple[str, ...]] = None,
+            location: Optional[Location] = None,
+        ) -> None: ...
+
+    @property
+    def sql_warehouses(self) -> dict[str, "SqlWarehouse"]:
+        return self._resources["sql_warehouses"]
+
+    def add_sql_warehouse(
+        self,
+        resource_name: str,
+        sql_warehouse: "SqlWarehouseParam",
+        *,
+        location: Optional[Location] = None,
+    ) -> None:
+        """
+        Adds the resource sql_warehouse to the collection of resources. Resource name must be unique across all sql_warehouses.
+
+        :param resource_name: unique identifier for the sql_warehouse
+        :param sql_warehouse: the sql_warehouse to add, can be SqlWarehouse or dict
+        :param location: optional location of the sql_warehouse in the source code
+        """
+        from databricks.bundles.sql_warehouses._models.sql_warehouse import SqlWarehouse
+
+        sql_warehouse = _transform(SqlWarehouse, sql_warehouse)
+        path = ("resources", "sql_warehouses", resource_name)
+        location = location or Location.from_stack_frame(depth=1)
+
+        if self._resources["sql_warehouses"].get(resource_name):
+            self.add_diagnostic_error(
+                msg=f"Duplicate resource name '{resource_name}' for resource 'sql_warehouse'. Resource names must be unique.",
+                location=location,
+                path=path,
+            )
+        else:
+            if location:
+                self.add_location(path, location)
+
+            self._resources["sql_warehouses"][resource_name] = sql_warehouse
+
+
+@overload
+def sql_warehouse_mutator(
+    function: Callable[[Bundle, "SqlWarehouse"], "SqlWarehouse"],
+) -> ResourceMutator["SqlWarehouse"]: ...
+
+
+@overload
+def sql_warehouse_mutator(
+    function: Callable[["SqlWarehouse"], "SqlWarehouse"],
+) -> ResourceMutator["SqlWarehouse"]: ...
+
+
+def sql_warehouse_mutator(function: Callable) -> ResourceMutator["SqlWarehouse"]:
+    """
+    Decorator for defining mutator for sql_warehouses. Function should return a new instance of the sql_warehouse
+    with the desired changes, instead of mutating the input sql_warehouse.
+
+    Example:
+
+    .. code-block:: python
+
+        @sql_warehouse_mutator
+        def my_sql_warehouse_mutator(bundle: Bundle, sql_warehouse: SqlWarehouse) -> SqlWarehouse:
+            return replace(sql_warehouse, ...)
+
+    :param function: Function that mutates sql_warehouses.
+    """
+    from databricks.bundles.sql_warehouses._models.sql_warehouse import SqlWarehouse
+
+    return ResourceMutator(resource_type=SqlWarehouse, function=function)
diff --git a/python/databricks/bundles/core/_generated/synced_database_tables.py b/python/databricks/bundles/core/_generated/synced_database_tables.py
new file mode 100644
index 00000000000..2d0c7e598c0
--- /dev/null
+++ b/python/databricks/bundles/core/_generated/synced_database_tables.py
@@ -0,0 +1,128 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from collections.abc import Callable
+from typing import TYPE_CHECKING, Optional, overload
+
+from databricks.bundles.core._bundle import Bundle
+from databricks.bundles.core._location import Location
+from databricks.bundles.core._resource_mutator import ResourceMutator
+from databricks.bundles.core._transform import _transform
+
+if TYPE_CHECKING:
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.synced_database_tables._models.synced_database_table import (
+        SyncedDatabaseTable,
+        SyncedDatabaseTableParam,
+    )
+
+
+def _resource_type() -> "_ResourceType":
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.synced_database_tables._models.synced_database_table import (
+        SyncedDatabaseTable,
+    )
+
+    return _ResourceType(
+        resource_type=SyncedDatabaseTable,
+        singular_name="synced_database_table",
+        plural_name="synced_database_tables",
+    )
+
+
+class _SyncedDatabaseTableResources:
+    """
+    Generated synced_database_table accessors, mixed into Resources.
+    """
+
+    # Provided by the Resources subclass; declared here so the generated methods
+    # below type-check.
+    _resources: dict[str, dict]
+
+    if TYPE_CHECKING:
+
+        def add_location(self, path: tuple[str, ...], location: Location) -> None: ...
+
+        def add_diagnostic_error(
+            self,
+            msg: str,
+            *,
+            detail: Optional[str] = None,
+            path: Optional[tuple[str, ...]] = None,
+            location: Optional[Location] = None,
+        ) -> None: ...
+
+    @property
+    def synced_database_tables(self) -> dict[str, "SyncedDatabaseTable"]:
+        return self._resources["synced_database_tables"]
+
+    def add_synced_database_table(
+        self,
+        resource_name: str,
+        synced_database_table: "SyncedDatabaseTableParam",
+        *,
+        location: Optional[Location] = None,
+    ) -> None:
+        """
+        Adds the resource synced_database_table to the collection of resources. Resource name must be unique across all synced_database_tables.
+
+        :param resource_name: unique identifier for the synced_database_table
+        :param synced_database_table: the synced_database_table to add, can be SyncedDatabaseTable or dict
+        :param location: optional location of the synced_database_table in the source code
+        """
+        from databricks.bundles.synced_database_tables._models.synced_database_table import (
+            SyncedDatabaseTable,
+        )
+
+        synced_database_table = _transform(SyncedDatabaseTable, synced_database_table)
+        path = ("resources", "synced_database_tables", resource_name)
+        location = location or Location.from_stack_frame(depth=1)
+
+        if self._resources["synced_database_tables"].get(resource_name):
+            self.add_diagnostic_error(
+                msg=f"Duplicate resource name '{resource_name}' for resource 'synced_database_table'. Resource names must be unique.",
+                location=location,
+                path=path,
+            )
+        else:
+            if location:
+                self.add_location(path, location)
+
+            self._resources["synced_database_tables"][resource_name] = (
+                synced_database_table
+            )
+
+
+@overload
+def synced_database_table_mutator(
+    function: Callable[[Bundle, "SyncedDatabaseTable"], "SyncedDatabaseTable"],
+) -> ResourceMutator["SyncedDatabaseTable"]: ...
+
+
+@overload
+def synced_database_table_mutator(
+    function: Callable[["SyncedDatabaseTable"], "SyncedDatabaseTable"],
+) -> ResourceMutator["SyncedDatabaseTable"]: ...
+
+
+def synced_database_table_mutator(
+    function: Callable,
+) -> ResourceMutator["SyncedDatabaseTable"]:
+    """
+    Decorator for defining mutator for synced_database_tables. Function should return a new instance of the synced_database_table
+    with the desired changes, instead of mutating the input synced_database_table.
+
+    Example:
+
+    .. code-block:: python
+
+        @synced_database_table_mutator
+        def my_synced_database_table_mutator(bundle: Bundle, synced_database_table: SyncedDatabaseTable) -> SyncedDatabaseTable:
+            return replace(synced_database_table, ...)
+
+    :param function: Function that mutates synced_database_tables.
+    """
+    from databricks.bundles.synced_database_tables._models.synced_database_table import (
+        SyncedDatabaseTable,
+    )
+
+    return ResourceMutator(resource_type=SyncedDatabaseTable, function=function)
diff --git a/python/databricks/bundles/core/_generated/vector_search_endpoints.py b/python/databricks/bundles/core/_generated/vector_search_endpoints.py
new file mode 100644
index 00000000000..839831dafc6
--- /dev/null
+++ b/python/databricks/bundles/core/_generated/vector_search_endpoints.py
@@ -0,0 +1,130 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from collections.abc import Callable
+from typing import TYPE_CHECKING, Optional, overload
+
+from databricks.bundles.core._bundle import Bundle
+from databricks.bundles.core._location import Location
+from databricks.bundles.core._resource_mutator import ResourceMutator
+from databricks.bundles.core._transform import _transform
+
+if TYPE_CHECKING:
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.vector_search_endpoints._models.vector_search_endpoint import (
+        VectorSearchEndpoint,
+        VectorSearchEndpointParam,
+    )
+
+
+def _resource_type() -> "_ResourceType":
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.vector_search_endpoints._models.vector_search_endpoint import (
+        VectorSearchEndpoint,
+    )
+
+    return _ResourceType(
+        resource_type=VectorSearchEndpoint,
+        singular_name="vector_search_endpoint",
+        plural_name="vector_search_endpoints",
+    )
+
+
+class _VectorSearchEndpointResources:
+    """
+    Generated vector_search_endpoint accessors, mixed into Resources.
+    """
+
+    # Provided by the Resources subclass; declared here so the generated methods
+    # below type-check.
+    _resources: dict[str, dict]
+
+    if TYPE_CHECKING:
+
+        def add_location(self, path: tuple[str, ...], location: Location) -> None: ...
+
+        def add_diagnostic_error(
+            self,
+            msg: str,
+            *,
+            detail: Optional[str] = None,
+            path: Optional[tuple[str, ...]] = None,
+            location: Optional[Location] = None,
+        ) -> None: ...
+
+    @property
+    def vector_search_endpoints(self) -> dict[str, "VectorSearchEndpoint"]:
+        return self._resources["vector_search_endpoints"]
+
+    def add_vector_search_endpoint(
+        self,
+        resource_name: str,
+        vector_search_endpoint: "VectorSearchEndpointParam",
+        *,
+        location: Optional[Location] = None,
+    ) -> None:
+        """
+        Adds the resource vector_search_endpoint to the collection of resources. Resource name must be unique across all vector_search_endpoints.
+
+        :param resource_name: unique identifier for the vector_search_endpoint
+        :param vector_search_endpoint: the vector_search_endpoint to add, can be VectorSearchEndpoint or dict
+        :param location: optional location of the vector_search_endpoint in the source code
+        """
+        from databricks.bundles.vector_search_endpoints._models.vector_search_endpoint import (
+            VectorSearchEndpoint,
+        )
+
+        vector_search_endpoint = _transform(
+            VectorSearchEndpoint, vector_search_endpoint
+        )
+        path = ("resources", "vector_search_endpoints", resource_name)
+        location = location or Location.from_stack_frame(depth=1)
+
+        if self._resources["vector_search_endpoints"].get(resource_name):
+            self.add_diagnostic_error(
+                msg=f"Duplicate resource name '{resource_name}' for resource 'vector_search_endpoint'. Resource names must be unique.",
+                location=location,
+                path=path,
+            )
+        else:
+            if location:
+                self.add_location(path, location)
+
+            self._resources["vector_search_endpoints"][resource_name] = (
+                vector_search_endpoint
+            )
+
+
+@overload
+def vector_search_endpoint_mutator(
+    function: Callable[[Bundle, "VectorSearchEndpoint"], "VectorSearchEndpoint"],
+) -> ResourceMutator["VectorSearchEndpoint"]: ...
+
+
+@overload
+def vector_search_endpoint_mutator(
+    function: Callable[["VectorSearchEndpoint"], "VectorSearchEndpoint"],
+) -> ResourceMutator["VectorSearchEndpoint"]: ...
+
+
+def vector_search_endpoint_mutator(
+    function: Callable,
+) -> ResourceMutator["VectorSearchEndpoint"]:
+    """
+    Decorator for defining mutator for vector_search_endpoints. Function should return a new instance of the vector_search_endpoint
+    with the desired changes, instead of mutating the input vector_search_endpoint.
+
+    Example:
+
+    .. code-block:: python
+
+        @vector_search_endpoint_mutator
+        def my_vector_search_endpoint_mutator(bundle: Bundle, vector_search_endpoint: VectorSearchEndpoint) -> VectorSearchEndpoint:
+            return replace(vector_search_endpoint, ...)
+
+    :param function: Function that mutates vector_search_endpoints.
+    """
+    from databricks.bundles.vector_search_endpoints._models.vector_search_endpoint import (
+        VectorSearchEndpoint,
+    )
+
+    return ResourceMutator(resource_type=VectorSearchEndpoint, function=function)
diff --git a/python/databricks/bundles/core/_generated/vector_search_indexes.py b/python/databricks/bundles/core/_generated/vector_search_indexes.py
new file mode 100644
index 00000000000..7c84a0d00c8
--- /dev/null
+++ b/python/databricks/bundles/core/_generated/vector_search_indexes.py
@@ -0,0 +1,128 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from collections.abc import Callable
+from typing import TYPE_CHECKING, Optional, overload
+
+from databricks.bundles.core._bundle import Bundle
+from databricks.bundles.core._location import Location
+from databricks.bundles.core._resource_mutator import ResourceMutator
+from databricks.bundles.core._transform import _transform
+
+if TYPE_CHECKING:
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.vector_search_indexes._models.vector_search_index import (
+        VectorSearchIndex,
+        VectorSearchIndexParam,
+    )
+
+
+def _resource_type() -> "_ResourceType":
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.vector_search_indexes._models.vector_search_index import (
+        VectorSearchIndex,
+    )
+
+    return _ResourceType(
+        resource_type=VectorSearchIndex,
+        singular_name="vector_search_index",
+        plural_name="vector_search_indexes",
+    )
+
+
+class _VectorSearchIndexResources:
+    """
+    Generated vector_search_index accessors, mixed into Resources.
+    """
+
+    # Provided by the Resources subclass; declared here so the generated methods
+    # below type-check.
+    _resources: dict[str, dict]
+
+    if TYPE_CHECKING:
+
+        def add_location(self, path: tuple[str, ...], location: Location) -> None: ...
+
+        def add_diagnostic_error(
+            self,
+            msg: str,
+            *,
+            detail: Optional[str] = None,
+            path: Optional[tuple[str, ...]] = None,
+            location: Optional[Location] = None,
+        ) -> None: ...
+
+    @property
+    def vector_search_indexes(self) -> dict[str, "VectorSearchIndex"]:
+        return self._resources["vector_search_indexes"]
+
+    def add_vector_search_index(
+        self,
+        resource_name: str,
+        vector_search_index: "VectorSearchIndexParam",
+        *,
+        location: Optional[Location] = None,
+    ) -> None:
+        """
+        Adds the resource vector_search_index to the collection of resources. Resource name must be unique across all vector_search_indexes.
+
+        :param resource_name: unique identifier for the vector_search_index
+        :param vector_search_index: the vector_search_index to add, can be VectorSearchIndex or dict
+        :param location: optional location of the vector_search_index in the source code
+        """
+        from databricks.bundles.vector_search_indexes._models.vector_search_index import (
+            VectorSearchIndex,
+        )
+
+        vector_search_index = _transform(VectorSearchIndex, vector_search_index)
+        path = ("resources", "vector_search_indexes", resource_name)
+        location = location or Location.from_stack_frame(depth=1)
+
+        if self._resources["vector_search_indexes"].get(resource_name):
+            self.add_diagnostic_error(
+                msg=f"Duplicate resource name '{resource_name}' for resource 'vector_search_index'. Resource names must be unique.",
+                location=location,
+                path=path,
+            )
+        else:
+            if location:
+                self.add_location(path, location)
+
+            self._resources["vector_search_indexes"][resource_name] = (
+                vector_search_index
+            )
+
+
+@overload
+def vector_search_index_mutator(
+    function: Callable[[Bundle, "VectorSearchIndex"], "VectorSearchIndex"],
+) -> ResourceMutator["VectorSearchIndex"]: ...
+
+
+@overload
+def vector_search_index_mutator(
+    function: Callable[["VectorSearchIndex"], "VectorSearchIndex"],
+) -> ResourceMutator["VectorSearchIndex"]: ...
+
+
+def vector_search_index_mutator(
+    function: Callable,
+) -> ResourceMutator["VectorSearchIndex"]:
+    """
+    Decorator for defining mutator for vector_search_indexes. Function should return a new instance of the vector_search_index
+    with the desired changes, instead of mutating the input vector_search_index.
+
+    Example:
+
+    .. code-block:: python
+
+        @vector_search_index_mutator
+        def my_vector_search_index_mutator(bundle: Bundle, vector_search_index: VectorSearchIndex) -> VectorSearchIndex:
+            return replace(vector_search_index, ...)
+
+    :param function: Function that mutates vector_search_indexes.
+    """
+    from databricks.bundles.vector_search_indexes._models.vector_search_index import (
+        VectorSearchIndex,
+    )
+
+    return ResourceMutator(resource_type=VectorSearchIndex, function=function)
diff --git a/python/databricks/bundles/core/_generated/volumes.py b/python/databricks/bundles/core/_generated/volumes.py
new file mode 100644
index 00000000000..fe56e45ce30
--- /dev/null
+++ b/python/databricks/bundles/core/_generated/volumes.py
@@ -0,0 +1,115 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from collections.abc import Callable
+from typing import TYPE_CHECKING, Optional, overload
+
+from databricks.bundles.core._bundle import Bundle
+from databricks.bundles.core._location import Location
+from databricks.bundles.core._resource_mutator import ResourceMutator
+from databricks.bundles.core._transform import _transform
+
+if TYPE_CHECKING:
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.volumes._models.volume import Volume, VolumeParam
+
+
+def _resource_type() -> "_ResourceType":
+    from databricks.bundles.core._resource_type import _ResourceType
+    from databricks.bundles.volumes._models.volume import Volume
+
+    return _ResourceType(
+        resource_type=Volume,
+        singular_name="volume",
+        plural_name="volumes",
+    )
+
+
+class _VolumeResources:
+    """
+    Generated volume accessors, mixed into Resources.
+    """
+
+    # Provided by the Resources subclass; declared here so the generated methods
+    # below type-check.
+    _resources: dict[str, dict]
+
+    if TYPE_CHECKING:
+
+        def add_location(self, path: tuple[str, ...], location: Location) -> None: ...
+
+        def add_diagnostic_error(
+            self,
+            msg: str,
+            *,
+            detail: Optional[str] = None,
+            path: Optional[tuple[str, ...]] = None,
+            location: Optional[Location] = None,
+        ) -> None: ...
+
+    @property
+    def volumes(self) -> dict[str, "Volume"]:
+        return self._resources["volumes"]
+
+    def add_volume(
+        self,
+        resource_name: str,
+        volume: "VolumeParam",
+        *,
+        location: Optional[Location] = None,
+    ) -> None:
+        """
+        Adds the resource volume to the collection of resources. Resource name must be unique across all volumes.
+
+        :param resource_name: unique identifier for the volume
+        :param volume: the volume to add, can be Volume or dict
+        :param location: optional location of the volume in the source code
+        """
+        from databricks.bundles.volumes._models.volume import Volume
+
+        volume = _transform(Volume, volume)
+        path = ("resources", "volumes", resource_name)
+        location = location or Location.from_stack_frame(depth=1)
+
+        if self._resources["volumes"].get(resource_name):
+            self.add_diagnostic_error(
+                msg=f"Duplicate resource name '{resource_name}' for resource 'volume'. Resource names must be unique.",
+                location=location,
+                path=path,
+            )
+        else:
+            if location:
+                self.add_location(path, location)
+
+            self._resources["volumes"][resource_name] = volume
+
+
+@overload
+def volume_mutator(
+    function: Callable[[Bundle, "Volume"], "Volume"],
+) -> ResourceMutator["Volume"]: ...
+
+
+@overload
+def volume_mutator(
+    function: Callable[["Volume"], "Volume"],
+) -> ResourceMutator["Volume"]: ...
+
+
+def volume_mutator(function: Callable) -> ResourceMutator["Volume"]:
+    """
+    Decorator for defining mutator for volumes. Function should return a new instance of the volume
+    with the desired changes, instead of mutating the input volume.
+
+    Example:
+
+    .. code-block:: python
+
+        @volume_mutator
+        def my_volume_mutator(bundle: Bundle, volume: Volume) -> Volume:
+            return replace(volume, ...)
+
+    :param function: Function that mutates volumes.
+    """
+    from databricks.bundles.volumes._models.volume import Volume
+
+    return ResourceMutator(resource_type=Volume, function=function)
diff --git a/python/databricks/bundles/core/_load.py b/python/databricks/bundles/core/_load.py
index 08db27e3423..b74128b8a91 100644
--- a/python/databricks/bundles/core/_load.py
+++ b/python/databricks/bundles/core/_load.py
@@ -64,7 +64,9 @@ def load_resources_from_package_module(
 
         prefix = package_spec.name + "."
 
-        for loader, module_name, is_pkg in pkgutil.walk_packages(package_paths, prefix):
+        for _loader, module_name, _is_pkg in pkgutil.walk_packages(
+            package_paths, prefix
+        ):
             module_names.append(module_name)
 
     module_names.sort()  # create deterministic order
diff --git a/python/databricks/bundles/core/_location.py b/python/databricks/bundles/core/_location.py
index 7e7d47a6527..82a4f3fc67e 100644
--- a/python/databricks/bundles/core/_location.py
+++ b/python/databricks/bundles/core/_location.py
@@ -36,7 +36,7 @@ def from_callable(fn: Callable) -> Optional["Location"]:
         diagnostics of decorated functions.
         """
 
-        code = hasattr(fn, "__code__") and getattr(fn, "__code__")
+        code = hasattr(fn, "__code__") and fn.__code__
 
         if not code:
             return None
diff --git a/python/databricks/bundles/core/_resource_mutator.py b/python/databricks/bundles/core/_resource_mutator.py
index 90e8987216f..22ea17cfc51 100644
--- a/python/databricks/bundles/core/_resource_mutator.py
+++ b/python/databricks/bundles/core/_resource_mutator.py
@@ -1,16 +1,9 @@
 from collections.abc import Callable
 from dataclasses import dataclass
-from typing import TYPE_CHECKING, Generic, Type, TypeVar, overload
+from typing import Generic, Type, TypeVar
 
-from databricks.bundles.core._bundle import Bundle
 from databricks.bundles.core._resource import Resource
 
-if TYPE_CHECKING:
-    from databricks.bundles.jobs._models.job import Job
-    from databricks.bundles.pipelines._models.pipeline import Pipeline
-    from databricks.bundles.schemas._models.schema import Schema
-    from databricks.bundles.volumes._models.volume import Volume
-
 _T = TypeVar("_T", bound=Resource)
 
 
@@ -55,8 +48,9 @@ def my_job_mutator(bundle: Bundle, job: Job) -> Job:
     """
 
 
-# Below, we define decorators for each resource type. This approach allows us
-# to implement mutators that are only applied for specific resource types.
+# A decorator is generated for each resource type (see
+# _generated/_resource_mutators.py). This approach allows us to implement
+# mutators that are only applied for specific resource types.
 #
 # Alternative approaches considered and rejected during design:
 #
@@ -67,129 +61,3 @@ def my_job_mutator(bundle: Bundle, job: Job) -> Job:
 # - Using a universal @mutator decorator.
 #   Rationale: Determining whether a mutator is invoked based solely on type annotations
 #   was deemed overly implicit and potentially confusing.
-
-
-@overload
-def job_mutator(
-    function: Callable[[Bundle, "Job"], "Job"],
-) -> ResourceMutator["Job"]: ...
-
-
-@overload
-def job_mutator(function: Callable[["Job"], "Job"]) -> ResourceMutator["Job"]: ...
-
-
-def job_mutator(function: Callable) -> ResourceMutator["Job"]:
-    """
-    Decorator for defining a job mutator. Function should return a new instance of the job with the desired changes,
-    instead of mutating the input job.
-
-    Example:
-
-    .. code-block:: python
-
-        @job_mutator
-        def my_job_mutator(bundle: Bundle, job: Job) -> Job:
-            return replace(job, name="my_job")
-
-    :param function: Function that mutates a job.
-    """
-    from databricks.bundles.jobs._models.job import Job
-
-    return ResourceMutator(resource_type=Job, function=function)
-
-
-@overload
-def pipeline_mutator(
-    function: Callable[[Bundle, "Pipeline"], "Pipeline"],
-) -> ResourceMutator["Pipeline"]: ...
-
-
-@overload
-def pipeline_mutator(
-    function: Callable[["Pipeline"], "Pipeline"],
-) -> ResourceMutator["Pipeline"]: ...
-
-
-def pipeline_mutator(function: Callable) -> ResourceMutator["Pipeline"]:
-    """
-    Decorator for defining a pipeline mutator. Function should return a new instance of the pipeline with the desired changes,
-    instead of mutating the input pipeline.
-
-    Example:
-
-    .. code-block:: python
-
-        @pipeline_mutator
-        def my_pipeline_mutator(bundle: Bundle, pipeline: Pipeline) -> Pipeline:
-            return replace(pipeline, name="my_job")
-
-    :param function: Function that mutates a pipeline.
-    """
-    from databricks.bundles.pipelines._models.pipeline import Pipeline
-
-    return ResourceMutator(resource_type=Pipeline, function=function)
-
-
-@overload
-def schema_mutator(
-    function: Callable[[Bundle, "Schema"], "Schema"],
-) -> ResourceMutator["Schema"]: ...
-
-
-@overload
-def schema_mutator(
-    function: Callable[["Schema"], "Schema"],
-) -> ResourceMutator["Schema"]: ...
-
-
-def schema_mutator(function: Callable) -> ResourceMutator["Schema"]:
-    """
-    Decorator for defining a schema mutator. Function should return a new instance of the schema with the desired changes,
-    instead of mutating the input schema.
-
-    Example:
-
-    .. code-block:: python
-
-        @schema_mutator
-        def my_schema_mutator(bundle: Bundle, schema: Schema) -> Schema:
-            return replace(schema, name="my_schema")
-
-    :param function: Function that mutates a schema.
-    """
-    from databricks.bundles.schemas._models.schema import Schema
-
-    return ResourceMutator(resource_type=Schema, function=function)
-
-
-@overload
-def volume_mutator(
-    function: Callable[[Bundle, "Volume"], "Volume"],
-) -> ResourceMutator["Volume"]: ...
-
-
-@overload
-def volume_mutator(
-    function: Callable[["Volume"], "Volume"],
-) -> ResourceMutator["Volume"]: ...
-
-
-def volume_mutator(function: Callable) -> ResourceMutator["Volume"]:
-    """
-    Decorator for defining a volume mutator. Function should return a new instance of the volume with the desired changes,
-    instead of mutating the input volume.
-
-    Example:
-
-    .. code-block:: python
-
-        @volume_mutator
-        def my_volume_mutator(bundle: Bundle, volume: Volume) -> Volume:
-            return replace(volume, name="my_volume")
-
-    :param function: Function that mutates a volume.
-    """
-    from databricks.bundles.volumes._models.volume import Volume
-
-    return ResourceMutator(resource_type=Volume, function=function)
diff --git a/python/databricks/bundles/core/_resource_type.py b/python/databricks/bundles/core/_resource_type.py
index 9e9bb1bdf89..53fd17c169b 100644
--- a/python/databricks/bundles/core/_resource_type.py
+++ b/python/databricks/bundles/core/_resource_type.py
@@ -27,34 +27,6 @@ def all(cls) -> tuple["_ResourceType", ...]:
         """
         Returns all supported resource types.
         """
+        from databricks.bundles.core._generated import _all_resource_types
 
-        # intentionally lazily load all resource types to avoid imports from databricks.bundles.core to
-        # be imported in databricks.bundles.<resource_type>
-
-        from databricks.bundles.jobs._models.job import Job
-        from databricks.bundles.pipelines._models.pipeline import Pipeline
-        from databricks.bundles.schemas._models.schema import Schema
-        from databricks.bundles.volumes._models.volume import Volume
-
-        return (
-            _ResourceType(
-                resource_type=Job,
-                singular_name="job",
-                plural_name="jobs",
-            ),
-            _ResourceType(
-                resource_type=Pipeline,
-                plural_name="pipelines",
-                singular_name="pipeline",
-            ),
-            _ResourceType(
-                resource_type=Volume,
-                plural_name="volumes",
-                singular_name="volume",
-            ),
-            _ResourceType(
-                resource_type=Schema,
-                plural_name="schemas",
-                singular_name="schema",
-            ),
-        )
+        return _all_resource_types()
diff --git a/python/databricks/bundles/core/_resources.py b/python/databricks/bundles/core/_resources.py
index 9be121718e0..74f186c3714 100644
--- a/python/databricks/bundles/core/_resources.py
+++ b/python/databricks/bundles/core/_resources.py
@@ -1,20 +1,15 @@
-from typing import TYPE_CHECKING, Optional
+from typing import Optional
 
 from databricks.bundles.core._diagnostics import Diagnostics
+from databricks.bundles.core._generated import _GeneratedResources
 from databricks.bundles.core._location import Location
 from databricks.bundles.core._resource import Resource
-from databricks.bundles.core._transform import _transform
-
-if TYPE_CHECKING:
-    from databricks.bundles.jobs._models.job import Job, JobParam
-    from databricks.bundles.pipelines._models.pipeline import Pipeline, PipelineParam
-    from databricks.bundles.schemas._models.schema import Schema, SchemaParam
-    from databricks.bundles.volumes._models.volume import Volume, VolumeParam
+from databricks.bundles.core._resource_type import _ResourceType
 
 __all__ = ["Resources"]
 
 
-class Resources:
+class Resources(_GeneratedResources):
     """
     Resources is a collection of resources in a bundle.
 
@@ -38,7 +33,7 @@ class Resources:
     - :meth:`load_resources_from_modules`
     - :meth:`load_resources_from_module`
 
-    Programmatic construction of resources is supported using :meth:`add_resource` and :meth:`add_job` methods.
+    Programmatic construction of resources is supported using :meth:`add_resource` and ``add_<resource>`` methods.
 
     Example:
 
@@ -56,29 +51,12 @@ def load_resources(bundle: Bundle) -> Resources:
     """
 
     def __init__(self):
-        self._jobs = dict[str, "Job"]()
-        self._pipelines = dict[str, "Pipeline"]()
-        self._schemas = dict[str, "Schema"]()
-        self._volumes = dict[str, "Volume"]()
+        self._resources: dict[str, dict] = {
+            resource_type.plural_name: {} for resource_type in _ResourceType.all()
+        }
         self._locations = dict[tuple[str, ...], Location]()
         self._diagnostics = Diagnostics()
 
-    @property
-    def jobs(self) -> dict[str, "Job"]:
-        return self._jobs
-
-    @property
-    def pipelines(self) -> dict[str, "Pipeline"]:
-        return self._pipelines
-
-    @property
-    def schemas(self) -> dict[str, "Schema"]:
-        return self._schemas
-
-    @property
-    def volumes(self) -> dict[str, "Volume"]:
-        return self._volumes
-
     @property
     def diagnostics(self) -> Diagnostics:
         """
@@ -102,152 +80,15 @@ def add_resource(
         :param location: optional location of the resource in the source code
         """
 
-        from databricks.bundles.jobs import Job
-        from databricks.bundles.pipelines import Pipeline
-        from databricks.bundles.schemas import Schema
-        from databricks.bundles.volumes import Volume
-
-        location = location or Location.from_stack_frame(depth=1)
-
-        match resource:
-            case Job():
-                self.add_job(resource_name, resource, location=location)
-            case Pipeline():
-                self.add_pipeline(resource_name, resource, location=location)
-            case Schema():
-                self.add_schema(resource_name, resource, location=location)
-            case Volume():
-                self.add_volume(resource_name, resource, location=location)
-            case _:
-                raise ValueError(f"Unsupported resource type: {type(resource)}")
-
-    def add_job(
-        self,
-        resource_name: str,
-        job: "JobParam",
-        *,
-        location: Optional[Location] = None,
-    ) -> None:
-        """
-        Adds a job to the collection of resources. Resource name must be unique across all jobs.
-
-        :param resource_name: unique identifier for the job
-        :param job: the job to add, can be Job or dict
-        :param location: optional location of the job in the source code
-        """
-        from databricks.bundles.jobs import Job
-
-        job = _transform(Job, job)
-        path = ("resources", "jobs", resource_name)
         location = location or Location.from_stack_frame(depth=1)
 
-        if self._jobs.get(resource_name):
-            self.add_diagnostic_error(
-                msg=f"Duplicate resource name '{resource_name}' for a job. Resource names must be unique.",
-                location=location,
-                path=path,
-            )
-        else:
-            if location:
-                self.add_location(path, location)
+        for resource_type in _ResourceType.all():
+            if isinstance(resource, resource_type.resource_type):
+                add_method = getattr(self, f"add_{resource_type.singular_name}")
+                add_method(resource_name, resource, location=location)
+                return
 
-            self._jobs[resource_name] = job
-
-    def add_pipeline(
-        self,
-        resource_name: str,
-        pipeline: "PipelineParam",
-        *,
-        location: Optional[Location] = None,
-    ) -> None:
-        """
-        Adds a pipeline to the collection of resources. Resource name must be unique across all pipelines.
-
-        :param resource_name: unique identifier for the pipeline
-        :param pipeline: the pipeline to add, can be Pipeline or dict
-        :param location: optional location of the pipeline in the source code
-        """
-        from databricks.bundles.pipelines import Pipeline
-
-        pipeline = _transform(Pipeline, pipeline)
-        path = ("resources", "pipelines", resource_name)
-        location = location or Location.from_stack_frame(depth=1)
-
-        if self._pipelines.get(resource_name):
-            self.add_diagnostic_error(
-                msg=f"Duplicate resource name '{resource_name}' for a pipeline. Resource names must be unique.",
-                location=location,
-                path=path,
-            )
-        else:
-            if location:
-                self.add_location(path, location)
-
-            self._pipelines[resource_name] = pipeline
-
-    def add_schema(
-        self,
-        resource_name: str,
-        schema: "SchemaParam",
-        *,
-        location: Optional[Location] = None,
-    ) -> None:
-        """
-        Adds a schema to the collection of resources. Resource name must be unique across all schemas.
-
-        :param resource_name: unique identifier for the schema
-        :param schema: the schema to add, can be Schema or dict
-        :param location: optional location of the schema in the source code
-        """
-        from databricks.bundles.schemas import Schema
-
-        schema = _transform(Schema, schema)
-        path = ("resources", "schemas", resource_name)
-        location = location or Location.from_stack_frame(depth=1)
-
-        if self._schemas.get(resource_name):
-            self.add_diagnostic_error(
-                msg=f"Duplicate resource name '{resource_name}' for a schema. Resource names must be unique.",
-                location=location,
-                path=path,
-            )
-        else:
-            if location:
-                self.add_location(path, location)
-
-            self._schemas[resource_name] = schema
-
-    def add_volume(
-        self,
-        resource_name: str,
-        volume: "VolumeParam",
-        *,
-        location: Optional[Location] = None,
-    ) -> None:
-        """
-        Adds a volume to the collection of resources. Resource name must be unique across all volumes.
-
-        :param resource_name: unique identifier for the volume
-        :param volume: the volume to add, can be Volume or dict
-        :param location: optional location of the volume in the source code
-        """
-        from databricks.bundles.volumes import Volume
-
-        volume = _transform(Volume, volume)
-        path = ("resources", "volumes", resource_name)
-        location = location or Location.from_stack_frame(depth=1)
-
-        if self._volumes.get(resource_name):
-            self.add_diagnostic_error(
-                msg=f"Duplicate resource name '{resource_name}' for a volume. Resource names must be unique.",
-                location=location,
-                path=path,
-            )
-        else:
-            if location:
-                self.add_location(path, location)
-
-            self._volumes[resource_name] = volume
+        raise ValueError(f"Unsupported resource type: {type(resource)}")
 
     def add_location(self, path: tuple[str, ...], location: Location) -> None:
         """
@@ -319,17 +160,10 @@ def add_resources(self, other: "Resources") -> None:
 
         Adds error to diagnostics if there are duplicate resource names.
         """
-        for name, job in other.jobs.items():
-            self.add_job(name, job)
-
-        for name, pipeline in other.pipelines.items():
-            self.add_pipeline(name, pipeline)
-
-        for name, schema in other.schemas.items():
-            self.add_schema(name, schema)
-
-        for name, volume in other.volumes.items():
-            self.add_volume(name, volume)
+        for resource_type in _ResourceType.all():
+            add_method = getattr(self, f"add_{resource_type.singular_name}")
+            for name, resource in getattr(other, resource_type.plural_name).items():
+                add_method(name, resource)
 
         for path, location in other._locations.items():
             self.add_location(path, location)
diff --git a/python/databricks/bundles/core/_transform.py b/python/databricks/bundles/core/_transform.py
index 8cf639c2c12..8e3b4a6ec12 100644
--- a/python/databricks/bundles/core/_transform.py
+++ b/python/databricks/bundles/core/_transform.py
@@ -19,6 +19,35 @@
 
 _T = TypeVar("_T")
 
+# Same strings as normalizeBool in libs/dyn/convert/normalize.go.
+# See https://yaml.org/type/bool.html.
+_TRUE_STRINGS = [
+    "true",
+    "True",
+    "TRUE",
+    "y",
+    "Y",
+    "yes",
+    "Yes",
+    "YES",
+    "on",
+    "On",
+    "ON",
+]
+_FALSE_STRINGS = [
+    "false",
+    "False",
+    "FALSE",
+    "n",
+    "N",
+    "no",
+    "No",
+    "NO",
+    "off",
+    "Off",
+    "OFF",
+]
+
 
 def _find_union_arg(value: Any, tpe: type) -> Optional[type]:
     """
@@ -137,6 +166,12 @@ def _transform_field(cls: Type[_T], field: Field, value: Any) -> _T:
 def _transform(cls: Type[_T], value: Any) -> _T:
     origin = get_origin(cls)
 
+    # interface{} fields are generated as `Any`: there is no schema to normalize
+    # against, so pass the value through unchanged. The bundle config mutators
+    # validate it (string or map) on the Go side.
+    if cls is Any:
+        return value  # type:ignore
+
     if is_dataclass(cls) and isinstance(value, cls):  # type:ignore
         return value
 
@@ -201,8 +236,10 @@ def _transform(cls: Type[_T], value: Any) -> _T:
         if isinstance(value, bool):
             return value  # type:ignore
 
-        if value in ["true", "false"]:
-            return value == "true"  # type:ignore
+        if value in _TRUE_STRINGS:
+            return True  # type:ignore
+        if value in _FALSE_STRINGS:
+            return False  # type:ignore
 
         raise ValueError(f"Unexpected type: {cls} for '{value}'")
     elif issubclass(origin or cls, Enum):
@@ -274,15 +311,20 @@ def _unwrap_variable(tpe: type) -> Optional[type]:
 
 # Regex for string corresponding to variables.
 #
-# The source of truth is regex in libs/dyn/dynvar/ref.go
+# The source of truth is regex in libs/dyn/dynvar/ref.go.
+# Behavioral parity is enforced by libs/dyn/dynvar/testdata/reference_vectors.json.
+#
+# The (?<!\$) lookbehind skips references escaped by a preceding "$": "$${a.b}" is a
+# literal "${a.b}" for the Databricks runtime, not a bundle reference.
 #
 # Example:
 #   - "${a.b}"
 #   - "${a.b.c}"
 #   - "${a.b[0].c}"
-_base_var_def = r"[a-zA-Z]+([-_]*[a-zA-Z0-9]+)*"
+_base_var_def = r"_*[^\W\d_]+([-_]*[^\W_]+)*"
 _variable_regex = re.compile(
-    r"\$\{(%s(\.%s(\[[0-9]+\])*)*(\[[0-9]+\])*)\}" % (_base_var_def, _base_var_def)
+    r"(?<!\$)\$\{(%s(\.%s(\[[0-9]+\])*)*(\[[0-9]+\])*)\}"
+    % (_base_var_def, _base_var_def)
 )
 
 
diff --git a/python/databricks/bundles/dashboards/__init__.py b/python/databricks/bundles/dashboards/__init__.py
new file mode 100644
index 00000000000..126427fcca6
--- /dev/null
+++ b/python/databricks/bundles/dashboards/__init__.py
@@ -0,0 +1,42 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+__all__ = [
+    "Dashboard",
+    "DashboardDict",
+    "DashboardParam",
+    "Lifecycle",
+    "LifecycleDict",
+    "LifecycleParam",
+    "LifecycleState",
+    "LifecycleStateParam",
+    "Permission",
+    "PermissionDict",
+    "PermissionLevel",
+    "PermissionLevelParam",
+    "PermissionParam",
+]
+
+
+from databricks.bundles.dashboards._models.dashboard import (
+    Dashboard,
+    DashboardDict,
+    DashboardParam,
+)
+from databricks.bundles.dashboards._models.lifecycle import (
+    Lifecycle,
+    LifecycleDict,
+    LifecycleParam,
+)
+from databricks.bundles.dashboards._models.lifecycle_state import (
+    LifecycleState,
+    LifecycleStateParam,
+)
+from databricks.bundles.dashboards._models.permission import (
+    Permission,
+    PermissionDict,
+    PermissionParam,
+)
+from databricks.bundles.dashboards._models.permission_level import (
+    PermissionLevel,
+    PermissionLevelParam,
+)
diff --git a/python/databricks/bundles/dashboards/_models/dashboard.py b/python/databricks/bundles/dashboards/_models/dashboard.py
new file mode 100644
index 00000000000..2a3e5f03364
--- /dev/null
+++ b/python/databricks/bundles/dashboards/_models/dashboard.py
@@ -0,0 +1,209 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, Any, TypedDict
+
+from databricks.bundles.core._resource import Resource
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
+from databricks.bundles.dashboards._models.lifecycle import Lifecycle, LifecycleParam
+from databricks.bundles.dashboards._models.lifecycle_state import (
+    LifecycleState,
+    LifecycleStateParam,
+)
+from databricks.bundles.dashboards._models.permission import Permission, PermissionParam
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class Dashboard(Resource):
+    """"""
+
+    create_time: VariableOrOptional[str] = None
+    """
+    The timestamp of when the dashboard was created.
+    """
+
+    dashboard_id: VariableOrOptional[str] = None
+    """
+    UUID identifying the dashboard.
+    """
+
+    dataset_catalog: VariableOrOptional[str] = None
+    """
+    Sets the default catalog for all datasets in this dashboard. When set, this overrides the catalog specified in individual dataset definitions.
+    """
+
+    dataset_schema: VariableOrOptional[str] = None
+    """
+    Sets the default schema for all datasets in this dashboard. When set, this overrides the schema specified in individual dataset definitions.
+    """
+
+    display_name: VariableOrOptional[str] = None
+    """
+    The display name of the dashboard.
+    """
+
+    embed_credentials: VariableOrOptional[bool] = None
+
+    etag: VariableOrOptional[str] = None
+    """
+    The etag for the dashboard. Can be optionally provided on updates to ensure that the dashboard
+    has not been modified since the last read.
+    This field is excluded in List Dashboards responses.
+    """
+
+    file_path: VariableOrOptional[str] = None
+
+    lifecycle: VariableOrOptional[Lifecycle] = None
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+    lifecycle_state: VariableOrOptional[LifecycleState] = None
+    """
+    The state of the dashboard resource. Used for tracking trashed status.
+    """
+
+    parent_path: VariableOrOptional[str] = None
+    """
+    The workspace path of the folder containing the dashboard. Includes leading slash and no
+    trailing slash.
+    This field is excluded in List Dashboards responses.
+    """
+
+    path: VariableOrOptional[str] = None
+    """
+    The workspace path of the dashboard asset, including the file name.
+    Exported dashboards always have the file extension `.lvdash.json`.
+    This field is excluded in List Dashboards responses.
+    """
+
+    permissions: VariableOrList[Permission] = field(default_factory=list)
+    """
+    The permissions to apply to this resource.
+    """
+
+    serialized_dashboard: VariableOrOptional[Any] = None
+    """
+    The contents of the dashboard in serialized string form.
+    This field is excluded in List Dashboards responses.
+    Use the [get dashboard API](https://docs.databricks.com/api/workspace/lakeview/get)
+    to retrieve an example response, which includes the `serialized_dashboard` field.
+    This field provides the structure of the JSON string that represents the dashboard's
+    layout and components.
+    """
+
+    update_time: VariableOrOptional[str] = None
+    """
+    The timestamp of when the dashboard was last updated by the user.
+    This field is excluded in List Dashboards responses.
+    """
+
+    warehouse_id: VariableOrOptional[str] = None
+    """
+    The warehouse ID used to run the dashboard.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "DashboardDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "DashboardDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class DashboardDict(TypedDict, total=False):
+    """"""
+
+    create_time: VariableOrOptional[str]
+    """
+    The timestamp of when the dashboard was created.
+    """
+
+    dashboard_id: VariableOrOptional[str]
+    """
+    UUID identifying the dashboard.
+    """
+
+    dataset_catalog: VariableOrOptional[str]
+    """
+    Sets the default catalog for all datasets in this dashboard. When set, this overrides the catalog specified in individual dataset definitions.
+    """
+
+    dataset_schema: VariableOrOptional[str]
+    """
+    Sets the default schema for all datasets in this dashboard. When set, this overrides the schema specified in individual dataset definitions.
+    """
+
+    display_name: VariableOrOptional[str]
+    """
+    The display name of the dashboard.
+    """
+
+    embed_credentials: VariableOrOptional[bool]
+
+    etag: VariableOrOptional[str]
+    """
+    The etag for the dashboard. Can be optionally provided on updates to ensure that the dashboard
+    has not been modified since the last read.
+    This field is excluded in List Dashboards responses.
+    """
+
+    file_path: VariableOrOptional[str]
+
+    lifecycle: VariableOrOptional[LifecycleParam]
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+    lifecycle_state: VariableOrOptional[LifecycleStateParam]
+    """
+    The state of the dashboard resource. Used for tracking trashed status.
+    """
+
+    parent_path: VariableOrOptional[str]
+    """
+    The workspace path of the folder containing the dashboard. Includes leading slash and no
+    trailing slash.
+    This field is excluded in List Dashboards responses.
+    """
+
+    path: VariableOrOptional[str]
+    """
+    The workspace path of the dashboard asset, including the file name.
+    Exported dashboards always have the file extension `.lvdash.json`.
+    This field is excluded in List Dashboards responses.
+    """
+
+    permissions: VariableOrList[PermissionParam]
+    """
+    The permissions to apply to this resource.
+    """
+
+    serialized_dashboard: VariableOrOptional[Any]
+    """
+    The contents of the dashboard in serialized string form.
+    This field is excluded in List Dashboards responses.
+    Use the [get dashboard API](https://docs.databricks.com/api/workspace/lakeview/get)
+    to retrieve an example response, which includes the `serialized_dashboard` field.
+    This field provides the structure of the JSON string that represents the dashboard's
+    layout and components.
+    """
+
+    update_time: VariableOrOptional[str]
+    """
+    The timestamp of when the dashboard was last updated by the user.
+    This field is excluded in List Dashboards responses.
+    """
+
+    warehouse_id: VariableOrOptional[str]
+    """
+    The warehouse ID used to run the dashboard.
+    """
+
+
+DashboardParam = DashboardDict | Dashboard
diff --git a/python/databricks/bundles/dashboards/_models/lifecycle.py b/python/databricks/bundles/dashboards/_models/lifecycle.py
new file mode 100644
index 00000000000..697776a198e
--- /dev/null
+++ b/python/databricks/bundles/dashboards/_models/lifecycle.py
@@ -0,0 +1,40 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class Lifecycle:
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool] = None
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "LifecycleDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "LifecycleDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class LifecycleDict(TypedDict, total=False):
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool]
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+
+LifecycleParam = LifecycleDict | Lifecycle
diff --git a/python/databricks/bundles/dashboards/_models/lifecycle_state.py b/python/databricks/bundles/dashboards/_models/lifecycle_state.py
new file mode 100644
index 00000000000..15654e77a1f
--- /dev/null
+++ b/python/databricks/bundles/dashboards/_models/lifecycle_state.py
@@ -0,0 +1,12 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class LifecycleState(Enum):
+    ACTIVE = "ACTIVE"
+    TRASHED = "TRASHED"
+
+
+LifecycleStateParam = Literal["ACTIVE", "TRASHED"] | LifecycleState
diff --git a/python/databricks/bundles/dashboards/_models/permission.py b/python/databricks/bundles/dashboards/_models/permission.py
new file mode 100644
index 00000000000..fb4ea994f6d
--- /dev/null
+++ b/python/databricks/bundles/dashboards/_models/permission.py
@@ -0,0 +1,74 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+from databricks.bundles.dashboards._models.permission_level import (
+    PermissionLevel,
+    PermissionLevelParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class Permission:
+    """"""
+
+    level: VariableOr[PermissionLevel]
+    """
+    The permission level to apply. The allowed levels depend on the resource type.
+    """
+
+    group_name: VariableOrOptional[str] = None
+    """
+    The name of the group granted the permission level.
+    """
+
+    service_principal_name: VariableOrOptional[str] = None
+    """
+    The name of the service principal granted the permission level.
+    """
+
+    user_name: VariableOrOptional[str] = None
+    """
+    The name of the user granted the permission level.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "PermissionDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "PermissionDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class PermissionDict(TypedDict, total=False):
+    """"""
+
+    level: VariableOr[PermissionLevelParam]
+    """
+    The permission level to apply. The allowed levels depend on the resource type.
+    """
+
+    group_name: VariableOrOptional[str]
+    """
+    The name of the group granted the permission level.
+    """
+
+    service_principal_name: VariableOrOptional[str]
+    """
+    The name of the service principal granted the permission level.
+    """
+
+    user_name: VariableOrOptional[str]
+    """
+    The name of the user granted the permission level.
+    """
+
+
+PermissionParam = PermissionDict | Permission
diff --git a/python/databricks/bundles/dashboards/_models/permission_level.py b/python/databricks/bundles/dashboards/_models/permission_level.py
new file mode 100644
index 00000000000..c6111911b29
--- /dev/null
+++ b/python/databricks/bundles/dashboards/_models/permission_level.py
@@ -0,0 +1,58 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class PermissionLevel(Enum):
+    """
+    Permission level
+    """
+
+    CAN_MANAGE = "CAN_MANAGE"
+    CAN_RESTART = "CAN_RESTART"
+    CAN_ATTACH_TO = "CAN_ATTACH_TO"
+    IS_OWNER = "IS_OWNER"
+    CAN_MANAGE_RUN = "CAN_MANAGE_RUN"
+    CAN_VIEW = "CAN_VIEW"
+    CAN_READ = "CAN_READ"
+    CAN_RUN = "CAN_RUN"
+    CAN_EDIT = "CAN_EDIT"
+    CAN_USE = "CAN_USE"
+    CAN_MANAGE_STAGING_VERSIONS = "CAN_MANAGE_STAGING_VERSIONS"
+    CAN_MANAGE_PRODUCTION_VERSIONS = "CAN_MANAGE_PRODUCTION_VERSIONS"
+    CAN_EDIT_METADATA = "CAN_EDIT_METADATA"
+    CAN_VIEW_METADATA = "CAN_VIEW_METADATA"
+    CAN_BIND = "CAN_BIND"
+    CAN_QUERY = "CAN_QUERY"
+    CAN_MONITOR = "CAN_MONITOR"
+    CAN_CREATE = "CAN_CREATE"
+    CAN_MONITOR_ONLY = "CAN_MONITOR_ONLY"
+    CAN_CREATE_APP = "CAN_CREATE_APP"
+
+
+PermissionLevelParam = (
+    Literal[
+        "CAN_MANAGE",
+        "CAN_RESTART",
+        "CAN_ATTACH_TO",
+        "IS_OWNER",
+        "CAN_MANAGE_RUN",
+        "CAN_VIEW",
+        "CAN_READ",
+        "CAN_RUN",
+        "CAN_EDIT",
+        "CAN_USE",
+        "CAN_MANAGE_STAGING_VERSIONS",
+        "CAN_MANAGE_PRODUCTION_VERSIONS",
+        "CAN_EDIT_METADATA",
+        "CAN_VIEW_METADATA",
+        "CAN_BIND",
+        "CAN_QUERY",
+        "CAN_MONITOR",
+        "CAN_CREATE",
+        "CAN_MONITOR_ONLY",
+        "CAN_CREATE_APP",
+    ]
+    | PermissionLevel
+)
diff --git a/python/databricks/bundles/database_catalogs/__init__.py b/python/databricks/bundles/database_catalogs/__init__.py
new file mode 100644
index 00000000000..fdd1d167302
--- /dev/null
+++ b/python/databricks/bundles/database_catalogs/__init__.py
@@ -0,0 +1,22 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+__all__ = [
+    "DatabaseCatalog",
+    "DatabaseCatalogDict",
+    "DatabaseCatalogParam",
+    "Lifecycle",
+    "LifecycleDict",
+    "LifecycleParam",
+]
+
+
+from databricks.bundles.database_catalogs._models.database_catalog import (
+    DatabaseCatalog,
+    DatabaseCatalogDict,
+    DatabaseCatalogParam,
+)
+from databricks.bundles.database_catalogs._models.lifecycle import (
+    Lifecycle,
+    LifecycleDict,
+    LifecycleParam,
+)
diff --git a/python/databricks/bundles/database_catalogs/_models/database_catalog.py b/python/databricks/bundles/database_catalogs/_models/database_catalog.py
new file mode 100644
index 00000000000..a224ac7a316
--- /dev/null
+++ b/python/databricks/bundles/database_catalogs/_models/database_catalog.py
@@ -0,0 +1,85 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._resource import Resource
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+from databricks.bundles.database_catalogs._models.lifecycle import (
+    Lifecycle,
+    LifecycleParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class DatabaseCatalog(Resource):
+    """"""
+
+    database_instance_name: VariableOr[str]
+    """
+    [Public Preview] The name of the DatabaseInstance housing the database.
+    """
+
+    database_name: VariableOr[str]
+    """
+    [Public Preview] The name of the database (in an instance) associated with the catalog.
+    """
+
+    name: VariableOr[str]
+    """
+    [Public Preview] The name of the catalog in UC.
+    """
+
+    create_database_if_not_exists: VariableOrOptional[bool] = None
+    """
+    [Public Preview]
+    """
+
+    lifecycle: VariableOrOptional[Lifecycle] = None
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "DatabaseCatalogDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "DatabaseCatalogDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class DatabaseCatalogDict(TypedDict, total=False):
+    """"""
+
+    database_instance_name: VariableOr[str]
+    """
+    [Public Preview] The name of the DatabaseInstance housing the database.
+    """
+
+    database_name: VariableOr[str]
+    """
+    [Public Preview] The name of the database (in an instance) associated with the catalog.
+    """
+
+    name: VariableOr[str]
+    """
+    [Public Preview] The name of the catalog in UC.
+    """
+
+    create_database_if_not_exists: VariableOrOptional[bool]
+    """
+    [Public Preview]
+    """
+
+    lifecycle: VariableOrOptional[LifecycleParam]
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+
+DatabaseCatalogParam = DatabaseCatalogDict | DatabaseCatalog
diff --git a/python/databricks/bundles/database_catalogs/_models/lifecycle.py b/python/databricks/bundles/database_catalogs/_models/lifecycle.py
new file mode 100644
index 00000000000..697776a198e
--- /dev/null
+++ b/python/databricks/bundles/database_catalogs/_models/lifecycle.py
@@ -0,0 +1,40 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class Lifecycle:
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool] = None
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "LifecycleDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "LifecycleDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class LifecycleDict(TypedDict, total=False):
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool]
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+
+LifecycleParam = LifecycleDict | Lifecycle
diff --git a/python/databricks/bundles/database_instances/__init__.py b/python/databricks/bundles/database_instances/__init__.py
new file mode 100644
index 00000000000..13674b646a5
--- /dev/null
+++ b/python/databricks/bundles/database_instances/__init__.py
@@ -0,0 +1,52 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+__all__ = [
+    "CustomTag",
+    "CustomTagDict",
+    "CustomTagParam",
+    "DatabaseInstance",
+    "DatabaseInstanceDict",
+    "DatabaseInstanceParam",
+    "DatabaseInstanceRef",
+    "DatabaseInstanceRefDict",
+    "DatabaseInstanceRefParam",
+    "Lifecycle",
+    "LifecycleDict",
+    "LifecycleParam",
+    "Permission",
+    "PermissionDict",
+    "PermissionLevel",
+    "PermissionLevelParam",
+    "PermissionParam",
+]
+
+
+from databricks.bundles.database_instances._models.custom_tag import (
+    CustomTag,
+    CustomTagDict,
+    CustomTagParam,
+)
+from databricks.bundles.database_instances._models.database_instance import (
+    DatabaseInstance,
+    DatabaseInstanceDict,
+    DatabaseInstanceParam,
+)
+from databricks.bundles.database_instances._models.database_instance_ref import (
+    DatabaseInstanceRef,
+    DatabaseInstanceRefDict,
+    DatabaseInstanceRefParam,
+)
+from databricks.bundles.database_instances._models.lifecycle import (
+    Lifecycle,
+    LifecycleDict,
+    LifecycleParam,
+)
+from databricks.bundles.database_instances._models.permission import (
+    Permission,
+    PermissionDict,
+    PermissionParam,
+)
+from databricks.bundles.database_instances._models.permission_level import (
+    PermissionLevel,
+    PermissionLevelParam,
+)
diff --git a/python/databricks/bundles/database_instances/_models/custom_tag.py b/python/databricks/bundles/database_instances/_models/custom_tag.py
new file mode 100644
index 00000000000..e08eb459bf7
--- /dev/null
+++ b/python/databricks/bundles/database_instances/_models/custom_tag.py
@@ -0,0 +1,58 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class CustomTag:
+    """"""
+
+    key: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] The key of the custom tag.
+    """
+
+    value: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] The value of the custom tag.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "CustomTagDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "CustomTagDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class CustomTagDict(TypedDict, total=False):
+    """"""
+
+    key: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] The key of the custom tag.
+    """
+
+    value: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] The value of the custom tag.
+    """
+
+
+CustomTagParam = CustomTagDict | CustomTag
diff --git a/python/databricks/bundles/database_instances/_models/database_instance.py b/python/databricks/bundles/database_instances/_models/database_instance.py
new file mode 100644
index 00000000000..beea60bfd1f
--- /dev/null
+++ b/python/databricks/bundles/database_instances/_models/database_instance.py
@@ -0,0 +1,193 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._resource import Resource
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import (
+    VariableOr,
+    VariableOrList,
+    VariableOrOptional,
+)
+from databricks.bundles.database_instances._models.custom_tag import (
+    CustomTag,
+    CustomTagParam,
+)
+from databricks.bundles.database_instances._models.database_instance_ref import (
+    DatabaseInstanceRef,
+    DatabaseInstanceRefParam,
+)
+from databricks.bundles.database_instances._models.lifecycle import (
+    Lifecycle,
+    LifecycleParam,
+)
+from databricks.bundles.database_instances._models.permission import (
+    Permission,
+    PermissionParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class DatabaseInstance(Resource):
+    """
+    A DatabaseInstance represents a logical Postgres instance, comprised of both compute and storage.
+    """
+
+    name: VariableOr[str]
+    """
+    [Public Preview] The name of the instance. This is the unique identifier for the instance.
+    """
+
+    capacity: VariableOrOptional[str] = None
+    """
+    [Public Preview] The sku of the instance. Valid values are "CU_1", "CU_2", "CU_4", "CU_8".
+    """
+
+    custom_tags: VariableOrList[CustomTag] = field(default_factory=list)
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Custom tags associated with the instance. This field is only included on create and update responses.
+    """
+
+    enable_pg_native_login: VariableOrOptional[bool] = None
+    """
+    [Public Preview] Whether to enable PG native password login on the instance. Defaults to false.
+    """
+
+    enable_readable_secondaries: VariableOrOptional[bool] = None
+    """
+    [Public Preview] Whether to enable secondaries to serve read-only traffic. Defaults to false.
+    """
+
+    lifecycle: VariableOrOptional[Lifecycle] = None
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+    node_count: VariableOrOptional[int] = None
+    """
+    [Public Preview] The number of nodes in the instance, composed of 1 primary and 0 or more secondaries. Defaults to
+    1 primary and 0 secondaries. This field is input only, see effective_node_count for the output.
+    """
+
+    parent_instance_ref: VariableOrOptional[DatabaseInstanceRef] = None
+    """
+    [Public Preview] The ref of the parent instance. This is only available if the instance is
+    child instance.
+    Input: For specifying the parent instance to create a child instance. Optional.
+    Output: Only populated if provided as input to create a child instance.
+    """
+
+    permissions: VariableOrList[Permission] = field(default_factory=list)
+    """
+    The permissions to apply to this resource.
+    """
+
+    retention_window_in_days: VariableOrOptional[int] = None
+    """
+    [Public Preview] The retention window for the instance. This is the time window in days
+    for which the historical data is retained. The default value is 7 days.
+    Valid values are 2 to 35 days.
+    """
+
+    stopped: VariableOrOptional[bool] = None
+    """
+    [Public Preview] Whether to stop the instance. An input only param, see effective_stopped for the output.
+    """
+
+    usage_policy_id: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] The desired usage policy to associate with the instance.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "DatabaseInstanceDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "DatabaseInstanceDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class DatabaseInstanceDict(TypedDict, total=False):
+    """"""
+
+    name: VariableOr[str]
+    """
+    [Public Preview] The name of the instance. This is the unique identifier for the instance.
+    """
+
+    capacity: VariableOrOptional[str]
+    """
+    [Public Preview] The sku of the instance. Valid values are "CU_1", "CU_2", "CU_4", "CU_8".
+    """
+
+    custom_tags: VariableOrList[CustomTagParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Custom tags associated with the instance. This field is only included on create and update responses.
+    """
+
+    enable_pg_native_login: VariableOrOptional[bool]
+    """
+    [Public Preview] Whether to enable PG native password login on the instance. Defaults to false.
+    """
+
+    enable_readable_secondaries: VariableOrOptional[bool]
+    """
+    [Public Preview] Whether to enable secondaries to serve read-only traffic. Defaults to false.
+    """
+
+    lifecycle: VariableOrOptional[LifecycleParam]
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+    node_count: VariableOrOptional[int]
+    """
+    [Public Preview] The number of nodes in the instance, composed of 1 primary and 0 or more secondaries. Defaults to
+    1 primary and 0 secondaries. This field is input only, see effective_node_count for the output.
+    """
+
+    parent_instance_ref: VariableOrOptional[DatabaseInstanceRefParam]
+    """
+    [Public Preview] The ref of the parent instance. This is only available if the instance is
+    child instance.
+    Input: For specifying the parent instance to create a child instance. Optional.
+    Output: Only populated if provided as input to create a child instance.
+    """
+
+    permissions: VariableOrList[PermissionParam]
+    """
+    The permissions to apply to this resource.
+    """
+
+    retention_window_in_days: VariableOrOptional[int]
+    """
+    [Public Preview] The retention window for the instance. This is the time window in days
+    for which the historical data is retained. The default value is 7 days.
+    Valid values are 2 to 35 days.
+    """
+
+    stopped: VariableOrOptional[bool]
+    """
+    [Public Preview] Whether to stop the instance. An input only param, see effective_stopped for the output.
+    """
+
+    usage_policy_id: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] The desired usage policy to associate with the instance.
+    """
+
+
+DatabaseInstanceParam = DatabaseInstanceDict | DatabaseInstance
diff --git a/python/databricks/bundles/database_instances/_models/database_instance_ref.py b/python/databricks/bundles/database_instances/_models/database_instance_ref.py
new file mode 100644
index 00000000000..8c3e582f280
--- /dev/null
+++ b/python/databricks/bundles/database_instances/_models/database_instance_ref.py
@@ -0,0 +1,87 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class DatabaseInstanceRef:
+    """
+    DatabaseInstanceRef is a reference to a database instance. It is used in the
+    DatabaseInstance object to refer to the parent instance of an instance and
+    to refer the child instances of an instance.
+    To specify as a parent instance during creation of an instance,
+    the lsn and branch_time fields are optional. If not specified, the child
+    instance will be created from the latest lsn of the parent.
+    If both lsn and branch_time are specified, the lsn will be used to create
+    the child instance.
+    """
+
+    branch_time: VariableOrOptional[str] = None
+    """
+    [Public Preview] Branch time of the ref database instance.
+    For a parent ref instance, this is the point in time on the parent instance from which the
+    instance was created.
+    For a child ref instance, this is the point in time on the instance from which the child
+    instance was created.
+    Input: For specifying the point in time to create a child instance. Optional.
+    Output: Only populated if provided as input to create a child instance.
+    """
+
+    lsn: VariableOrOptional[str] = None
+    """
+    [Public Preview] User-specified WAL LSN of the ref database instance.
+    
+    Input: For specifying the WAL LSN to create a child instance. Optional.
+    Output: Only populated if provided as input to create a child instance.
+    """
+
+    name: VariableOrOptional[str] = None
+    """
+    [Public Preview] Name of the ref database instance.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "DatabaseInstanceRefDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "DatabaseInstanceRefDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class DatabaseInstanceRefDict(TypedDict, total=False):
+    """"""
+
+    branch_time: VariableOrOptional[str]
+    """
+    [Public Preview] Branch time of the ref database instance.
+    For a parent ref instance, this is the point in time on the parent instance from which the
+    instance was created.
+    For a child ref instance, this is the point in time on the instance from which the child
+    instance was created.
+    Input: For specifying the point in time to create a child instance. Optional.
+    Output: Only populated if provided as input to create a child instance.
+    """
+
+    lsn: VariableOrOptional[str]
+    """
+    [Public Preview] User-specified WAL LSN of the ref database instance.
+    
+    Input: For specifying the WAL LSN to create a child instance. Optional.
+    Output: Only populated if provided as input to create a child instance.
+    """
+
+    name: VariableOrOptional[str]
+    """
+    [Public Preview] Name of the ref database instance.
+    """
+
+
+DatabaseInstanceRefParam = DatabaseInstanceRefDict | DatabaseInstanceRef
diff --git a/python/databricks/bundles/database_instances/_models/lifecycle.py b/python/databricks/bundles/database_instances/_models/lifecycle.py
new file mode 100644
index 00000000000..697776a198e
--- /dev/null
+++ b/python/databricks/bundles/database_instances/_models/lifecycle.py
@@ -0,0 +1,40 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class Lifecycle:
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool] = None
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "LifecycleDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "LifecycleDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class LifecycleDict(TypedDict, total=False):
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool]
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+
+LifecycleParam = LifecycleDict | Lifecycle
diff --git a/python/databricks/bundles/database_instances/_models/permission.py b/python/databricks/bundles/database_instances/_models/permission.py
new file mode 100644
index 00000000000..da0f1e44ad2
--- /dev/null
+++ b/python/databricks/bundles/database_instances/_models/permission.py
@@ -0,0 +1,74 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+from databricks.bundles.database_instances._models.permission_level import (
+    PermissionLevel,
+    PermissionLevelParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class Permission:
+    """"""
+
+    level: VariableOr[PermissionLevel]
+    """
+    The permission level to apply. The allowed levels depend on the resource type.
+    """
+
+    group_name: VariableOrOptional[str] = None
+    """
+    The name of the group granted the permission level.
+    """
+
+    service_principal_name: VariableOrOptional[str] = None
+    """
+    The name of the service principal granted the permission level.
+    """
+
+    user_name: VariableOrOptional[str] = None
+    """
+    The name of the user granted the permission level.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "PermissionDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "PermissionDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class PermissionDict(TypedDict, total=False):
+    """"""
+
+    level: VariableOr[PermissionLevelParam]
+    """
+    The permission level to apply. The allowed levels depend on the resource type.
+    """
+
+    group_name: VariableOrOptional[str]
+    """
+    The name of the group granted the permission level.
+    """
+
+    service_principal_name: VariableOrOptional[str]
+    """
+    The name of the service principal granted the permission level.
+    """
+
+    user_name: VariableOrOptional[str]
+    """
+    The name of the user granted the permission level.
+    """
+
+
+PermissionParam = PermissionDict | Permission
diff --git a/python/databricks/bundles/database_instances/_models/permission_level.py b/python/databricks/bundles/database_instances/_models/permission_level.py
new file mode 100644
index 00000000000..c6111911b29
--- /dev/null
+++ b/python/databricks/bundles/database_instances/_models/permission_level.py
@@ -0,0 +1,58 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class PermissionLevel(Enum):
+    """
+    Permission level
+    """
+
+    CAN_MANAGE = "CAN_MANAGE"
+    CAN_RESTART = "CAN_RESTART"
+    CAN_ATTACH_TO = "CAN_ATTACH_TO"
+    IS_OWNER = "IS_OWNER"
+    CAN_MANAGE_RUN = "CAN_MANAGE_RUN"
+    CAN_VIEW = "CAN_VIEW"
+    CAN_READ = "CAN_READ"
+    CAN_RUN = "CAN_RUN"
+    CAN_EDIT = "CAN_EDIT"
+    CAN_USE = "CAN_USE"
+    CAN_MANAGE_STAGING_VERSIONS = "CAN_MANAGE_STAGING_VERSIONS"
+    CAN_MANAGE_PRODUCTION_VERSIONS = "CAN_MANAGE_PRODUCTION_VERSIONS"
+    CAN_EDIT_METADATA = "CAN_EDIT_METADATA"
+    CAN_VIEW_METADATA = "CAN_VIEW_METADATA"
+    CAN_BIND = "CAN_BIND"
+    CAN_QUERY = "CAN_QUERY"
+    CAN_MONITOR = "CAN_MONITOR"
+    CAN_CREATE = "CAN_CREATE"
+    CAN_MONITOR_ONLY = "CAN_MONITOR_ONLY"
+    CAN_CREATE_APP = "CAN_CREATE_APP"
+
+
+PermissionLevelParam = (
+    Literal[
+        "CAN_MANAGE",
+        "CAN_RESTART",
+        "CAN_ATTACH_TO",
+        "IS_OWNER",
+        "CAN_MANAGE_RUN",
+        "CAN_VIEW",
+        "CAN_READ",
+        "CAN_RUN",
+        "CAN_EDIT",
+        "CAN_USE",
+        "CAN_MANAGE_STAGING_VERSIONS",
+        "CAN_MANAGE_PRODUCTION_VERSIONS",
+        "CAN_EDIT_METADATA",
+        "CAN_VIEW_METADATA",
+        "CAN_BIND",
+        "CAN_QUERY",
+        "CAN_MONITOR",
+        "CAN_CREATE",
+        "CAN_MONITOR_ONLY",
+        "CAN_CREATE_APP",
+    ]
+    | PermissionLevel
+)
diff --git a/python/databricks/bundles/experiments/__init__.py b/python/databricks/bundles/experiments/__init__.py
new file mode 100644
index 00000000000..e1ae26cc521
--- /dev/null
+++ b/python/databricks/bundles/experiments/__init__.py
@@ -0,0 +1,60 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+__all__ = [
+    "ExperimentPermissionLevel",
+    "ExperimentPermissionLevelParam",
+    "ExperimentTag",
+    "ExperimentTagDict",
+    "ExperimentTagParam",
+    "ExperimentTraceLocation",
+    "ExperimentTraceLocationDict",
+    "ExperimentTraceLocationParam",
+    "Lifecycle",
+    "LifecycleDict",
+    "LifecycleParam",
+    "MlflowExperiment",
+    "MlflowExperimentDict",
+    "MlflowExperimentParam",
+    "MlflowExperimentPermission",
+    "MlflowExperimentPermissionDict",
+    "MlflowExperimentPermissionParam",
+    "UcTraceLocation",
+    "UcTraceLocationDict",
+    "UcTraceLocationParam",
+]
+
+
+from databricks.bundles.experiments._models.experiment_permission_level import (
+    ExperimentPermissionLevel,
+    ExperimentPermissionLevelParam,
+)
+from databricks.bundles.experiments._models.experiment_tag import (
+    ExperimentTag,
+    ExperimentTagDict,
+    ExperimentTagParam,
+)
+from databricks.bundles.experiments._models.experiment_trace_location import (
+    ExperimentTraceLocation,
+    ExperimentTraceLocationDict,
+    ExperimentTraceLocationParam,
+)
+from databricks.bundles.experiments._models.lifecycle import (
+    Lifecycle,
+    LifecycleDict,
+    LifecycleParam,
+)
+from databricks.bundles.experiments._models.mlflow_experiment import (
+    MlflowExperiment,
+    MlflowExperimentDict,
+    MlflowExperimentParam,
+)
+from databricks.bundles.experiments._models.mlflow_experiment_permission import (
+    MlflowExperimentPermission,
+    MlflowExperimentPermissionDict,
+    MlflowExperimentPermissionParam,
+)
+from databricks.bundles.experiments._models.uc_trace_location import (
+    UcTraceLocation,
+    UcTraceLocationDict,
+    UcTraceLocationParam,
+)
diff --git a/python/databricks/bundles/experiments/_models/experiment_permission_level.py b/python/databricks/bundles/experiments/_models/experiment_permission_level.py
new file mode 100644
index 00000000000..056727ac92c
--- /dev/null
+++ b/python/databricks/bundles/experiments/_models/experiment_permission_level.py
@@ -0,0 +1,19 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class ExperimentPermissionLevel(Enum):
+    """
+    Permission level
+    """
+
+    CAN_MANAGE = "CAN_MANAGE"
+    CAN_EDIT = "CAN_EDIT"
+    CAN_READ = "CAN_READ"
+
+
+ExperimentPermissionLevelParam = (
+    Literal["CAN_MANAGE", "CAN_EDIT", "CAN_READ"] | ExperimentPermissionLevel
+)
diff --git a/python/databricks/bundles/experiments/_models/experiment_tag.py b/python/databricks/bundles/experiments/_models/experiment_tag.py
new file mode 100644
index 00000000000..2c78a181b17
--- /dev/null
+++ b/python/databricks/bundles/experiments/_models/experiment_tag.py
@@ -0,0 +1,52 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ExperimentTag:
+    """
+    A tag for an experiment.
+    """
+
+    key: VariableOrOptional[str] = None
+    """
+    The tag key.
+    """
+
+    value: VariableOrOptional[str] = None
+    """
+    The tag value.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "ExperimentTagDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ExperimentTagDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ExperimentTagDict(TypedDict, total=False):
+    """"""
+
+    key: VariableOrOptional[str]
+    """
+    The tag key.
+    """
+
+    value: VariableOrOptional[str]
+    """
+    The tag value.
+    """
+
+
+ExperimentTagParam = ExperimentTagDict | ExperimentTag
diff --git a/python/databricks/bundles/experiments/_models/experiment_trace_location.py b/python/databricks/bundles/experiments/_models/experiment_trace_location.py
new file mode 100644
index 00000000000..cbc9dffb6cf
--- /dev/null
+++ b/python/databricks/bundles/experiments/_models/experiment_trace_location.py
@@ -0,0 +1,54 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.experiments._models.uc_trace_location import (
+    UcTraceLocation,
+    UcTraceLocationParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ExperimentTraceLocation:
+    """
+    :meta private: [EXPERIMENTAL]
+
+    The storage location for an experiment's traces.
+    """
+
+    uc_trace_location: VariableOrOptional[UcTraceLocation] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] A Unity Catalog schema where the experiment's traces are stored as
+    Delta tables.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "ExperimentTraceLocationDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ExperimentTraceLocationDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ExperimentTraceLocationDict(TypedDict, total=False):
+    """"""
+
+    uc_trace_location: VariableOrOptional[UcTraceLocationParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] A Unity Catalog schema where the experiment's traces are stored as
+    Delta tables.
+    """
+
+
+ExperimentTraceLocationParam = ExperimentTraceLocationDict | ExperimentTraceLocation
diff --git a/python/databricks/bundles/experiments/_models/lifecycle.py b/python/databricks/bundles/experiments/_models/lifecycle.py
new file mode 100644
index 00000000000..697776a198e
--- /dev/null
+++ b/python/databricks/bundles/experiments/_models/lifecycle.py
@@ -0,0 +1,40 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class Lifecycle:
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool] = None
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "LifecycleDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "LifecycleDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class LifecycleDict(TypedDict, total=False):
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool]
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+
+LifecycleParam = LifecycleDict | Lifecycle
diff --git a/python/databricks/bundles/experiments/_models/mlflow_experiment.py b/python/databricks/bundles/experiments/_models/mlflow_experiment.py
new file mode 100644
index 00000000000..8a9d5368e99
--- /dev/null
+++ b/python/databricks/bundles/experiments/_models/mlflow_experiment.py
@@ -0,0 +1,131 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._resource import Resource
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import (
+    VariableOr,
+    VariableOrList,
+    VariableOrOptional,
+)
+from databricks.bundles.experiments._models.experiment_tag import (
+    ExperimentTag,
+    ExperimentTagParam,
+)
+from databricks.bundles.experiments._models.experiment_trace_location import (
+    ExperimentTraceLocation,
+    ExperimentTraceLocationParam,
+)
+from databricks.bundles.experiments._models.lifecycle import (
+    Lifecycle,
+    LifecycleParam,
+)
+from databricks.bundles.experiments._models.mlflow_experiment_permission import (
+    MlflowExperimentPermission,
+    MlflowExperimentPermissionParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class MlflowExperiment(Resource):
+    """"""
+
+    name: VariableOr[str]
+    """
+    Experiment name.
+    """
+
+    artifact_location: VariableOrOptional[str] = None
+    """
+    Location where all artifacts for the experiment are stored.
+    If not provided, the remote server will select an appropriate default.
+    """
+
+    lifecycle: VariableOrOptional[Lifecycle] = None
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+    permissions: VariableOrList[MlflowExperimentPermission] = field(
+        default_factory=list
+    )
+    """
+    The permissions to apply to this resource.
+    """
+
+    tags: VariableOrList[ExperimentTag] = field(default_factory=list)
+    """
+    A collection of tags to set on the experiment. Maximum tag size and number of tags per request
+    depends on the storage backend. All storage backends are guaranteed to support tag keys up
+    to 250 bytes in size and tag values up to 5000 bytes in size. All storage backends are also
+    guaranteed to support up to 20 tags per request.
+    """
+
+    trace_location: VariableOrOptional[ExperimentTraceLocation] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The location where the experiment's traces are stored. When set, the
+    underlying storage is provisioned and the experiment's traces are routed
+    to it. When unset, traces are stored in the default MLflow backend. This
+    field cannot be updated after the experiment is created.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "MlflowExperimentDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "MlflowExperimentDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class MlflowExperimentDict(TypedDict, total=False):
+    """"""
+
+    name: VariableOr[str]
+    """
+    Experiment name.
+    """
+
+    artifact_location: VariableOrOptional[str]
+    """
+    Location where all artifacts for the experiment are stored.
+    If not provided, the remote server will select an appropriate default.
+    """
+
+    lifecycle: VariableOrOptional[LifecycleParam]
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+    permissions: VariableOrList[MlflowExperimentPermissionParam]
+    """
+    The permissions to apply to this resource.
+    """
+
+    tags: VariableOrList[ExperimentTagParam]
+    """
+    A collection of tags to set on the experiment. Maximum tag size and number of tags per request
+    depends on the storage backend. All storage backends are guaranteed to support tag keys up
+    to 250 bytes in size and tag values up to 5000 bytes in size. All storage backends are also
+    guaranteed to support up to 20 tags per request.
+    """
+
+    trace_location: VariableOrOptional[ExperimentTraceLocationParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The location where the experiment's traces are stored. When set, the
+    underlying storage is provisioned and the experiment's traces are routed
+    to it. When unset, traces are stored in the default MLflow backend. This
+    field cannot be updated after the experiment is created.
+    """
+
+
+MlflowExperimentParam = MlflowExperimentDict | MlflowExperiment
diff --git a/python/databricks/bundles/experiments/_models/mlflow_experiment_permission.py b/python/databricks/bundles/experiments/_models/mlflow_experiment_permission.py
new file mode 100644
index 00000000000..041b02d91b3
--- /dev/null
+++ b/python/databricks/bundles/experiments/_models/mlflow_experiment_permission.py
@@ -0,0 +1,76 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+from databricks.bundles.experiments._models.experiment_permission_level import (
+    ExperimentPermissionLevel,
+    ExperimentPermissionLevelParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class MlflowExperimentPermission:
+    """"""
+
+    level: VariableOr[ExperimentPermissionLevel]
+    """
+    The permission level to apply. The allowed levels depend on the resource type.
+    """
+
+    group_name: VariableOrOptional[str] = None
+    """
+    The name of the group granted the permission level.
+    """
+
+    service_principal_name: VariableOrOptional[str] = None
+    """
+    The name of the service principal granted the permission level.
+    """
+
+    user_name: VariableOrOptional[str] = None
+    """
+    The name of the user granted the permission level.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "MlflowExperimentPermissionDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "MlflowExperimentPermissionDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class MlflowExperimentPermissionDict(TypedDict, total=False):
+    """"""
+
+    level: VariableOr[ExperimentPermissionLevelParam]
+    """
+    The permission level to apply. The allowed levels depend on the resource type.
+    """
+
+    group_name: VariableOrOptional[str]
+    """
+    The name of the group granted the permission level.
+    """
+
+    service_principal_name: VariableOrOptional[str]
+    """
+    The name of the service principal granted the permission level.
+    """
+
+    user_name: VariableOrOptional[str]
+    """
+    The name of the user granted the permission level.
+    """
+
+
+MlflowExperimentPermissionParam = (
+    MlflowExperimentPermissionDict | MlflowExperimentPermission
+)
diff --git a/python/databricks/bundles/experiments/_models/uc_trace_location.py b/python/databricks/bundles/experiments/_models/uc_trace_location.py
new file mode 100644
index 00000000000..b7b8148823e
--- /dev/null
+++ b/python/databricks/bundles/experiments/_models/uc_trace_location.py
@@ -0,0 +1,87 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class UcTraceLocation:
+    """
+    :meta private: [EXPERIMENTAL]
+
+    A Unity Catalog trace storage location. Traces are stored as Delta tables
+    in the specified catalog and schema.
+    """
+
+    catalog: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The name of the Unity Catalog catalog.
+    """
+
+    schema: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The name of the Unity Catalog schema within `catalog`.
+    """
+
+    table_prefix: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The prefix for the trace tables, which are named
+    `{catalog}.{schema}.{table_prefix}_otel_*`. May only contain letters,
+    digits, and underscores, and may be at most 238 characters. When unset, a
+    server-generated prefix derived from the experiment ID is used and this
+    field stays empty on read; the resolved value is always available in
+    `effective_table_prefix`.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "UcTraceLocationDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "UcTraceLocationDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class UcTraceLocationDict(TypedDict, total=False):
+    """"""
+
+    catalog: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The name of the Unity Catalog catalog.
+    """
+
+    schema: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The name of the Unity Catalog schema within `catalog`.
+    """
+
+    table_prefix: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The prefix for the trace tables, which are named
+    `{catalog}.{schema}.{table_prefix}_otel_*`. May only contain letters,
+    digits, and underscores, and may be at most 238 characters. When unset, a
+    server-generated prefix derived from the experiment ID is used and this
+    field stays empty on read; the resolved value is always available in
+    `effective_table_prefix`.
+    """
+
+
+UcTraceLocationParam = UcTraceLocationDict | UcTraceLocation
diff --git a/python/databricks/bundles/external_locations/__init__.py b/python/databricks/bundles/external_locations/__init__.py
new file mode 100644
index 00000000000..d6aa3bf908c
--- /dev/null
+++ b/python/databricks/bundles/external_locations/__init__.py
@@ -0,0 +1,90 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+__all__ = [
+    "AwsSqsQueue",
+    "AwsSqsQueueDict",
+    "AwsSqsQueueParam",
+    "AzureQueueStorage",
+    "AzureQueueStorageDict",
+    "AzureQueueStorageParam",
+    "EncryptionDetails",
+    "EncryptionDetailsDict",
+    "EncryptionDetailsParam",
+    "ExternalLocation",
+    "ExternalLocationDict",
+    "ExternalLocationParam",
+    "FileEventQueue",
+    "FileEventQueueDict",
+    "FileEventQueueParam",
+    "GcpPubsub",
+    "GcpPubsubDict",
+    "GcpPubsubParam",
+    "Lifecycle",
+    "LifecycleDict",
+    "LifecycleParam",
+    "Privilege",
+    "PrivilegeAssignment",
+    "PrivilegeAssignmentDict",
+    "PrivilegeAssignmentParam",
+    "PrivilegeParam",
+    "SseEncryptionDetails",
+    "SseEncryptionDetailsAlgorithm",
+    "SseEncryptionDetailsAlgorithmParam",
+    "SseEncryptionDetailsDict",
+    "SseEncryptionDetailsParam",
+]
+
+
+from databricks.bundles.external_locations._models.aws_sqs_queue import (
+    AwsSqsQueue,
+    AwsSqsQueueDict,
+    AwsSqsQueueParam,
+)
+from databricks.bundles.external_locations._models.azure_queue_storage import (
+    AzureQueueStorage,
+    AzureQueueStorageDict,
+    AzureQueueStorageParam,
+)
+from databricks.bundles.external_locations._models.encryption_details import (
+    EncryptionDetails,
+    EncryptionDetailsDict,
+    EncryptionDetailsParam,
+)
+from databricks.bundles.external_locations._models.external_location import (
+    ExternalLocation,
+    ExternalLocationDict,
+    ExternalLocationParam,
+)
+from databricks.bundles.external_locations._models.file_event_queue import (
+    FileEventQueue,
+    FileEventQueueDict,
+    FileEventQueueParam,
+)
+from databricks.bundles.external_locations._models.gcp_pubsub import (
+    GcpPubsub,
+    GcpPubsubDict,
+    GcpPubsubParam,
+)
+from databricks.bundles.external_locations._models.lifecycle import (
+    Lifecycle,
+    LifecycleDict,
+    LifecycleParam,
+)
+from databricks.bundles.external_locations._models.privilege import (
+    Privilege,
+    PrivilegeParam,
+)
+from databricks.bundles.external_locations._models.privilege_assignment import (
+    PrivilegeAssignment,
+    PrivilegeAssignmentDict,
+    PrivilegeAssignmentParam,
+)
+from databricks.bundles.external_locations._models.sse_encryption_details import (
+    SseEncryptionDetails,
+    SseEncryptionDetailsDict,
+    SseEncryptionDetailsParam,
+)
+from databricks.bundles.external_locations._models.sse_encryption_details_algorithm import (
+    SseEncryptionDetailsAlgorithm,
+    SseEncryptionDetailsAlgorithmParam,
+)
diff --git a/python/databricks/bundles/external_locations/_models/aws_sqs_queue.py b/python/databricks/bundles/external_locations/_models/aws_sqs_queue.py
new file mode 100644
index 00000000000..53c7a0b7062
--- /dev/null
+++ b/python/databricks/bundles/external_locations/_models/aws_sqs_queue.py
@@ -0,0 +1,42 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AwsSqsQueue:
+    """"""
+
+    queue_url: VariableOrOptional[str] = None
+    """
+    The AQS queue url in the format https://sqs.{region}.amazonaws.com/{account id}/{queue name}.
+    Only required for provided_sqs.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "AwsSqsQueueDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AwsSqsQueueDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AwsSqsQueueDict(TypedDict, total=False):
+    """"""
+
+    queue_url: VariableOrOptional[str]
+    """
+    The AQS queue url in the format https://sqs.{region}.amazonaws.com/{account id}/{queue name}.
+    Only required for provided_sqs.
+    """
+
+
+AwsSqsQueueParam = AwsSqsQueueDict | AwsSqsQueue
diff --git a/python/databricks/bundles/external_locations/_models/azure_queue_storage.py b/python/databricks/bundles/external_locations/_models/azure_queue_storage.py
new file mode 100644
index 00000000000..a8d182421f7
--- /dev/null
+++ b/python/databricks/bundles/external_locations/_models/azure_queue_storage.py
@@ -0,0 +1,70 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AzureQueueStorage:
+    """"""
+
+    queue_url: VariableOrOptional[str] = None
+    """
+    The AQS queue url in the format https://{storage account}.queue.core.windows.net/{queue name}
+    Only required for provided_aqs.
+    """
+
+    resource_group: VariableOrOptional[str] = None
+    """
+    Optional resource group for the queue, event grid subscription, and external location storage
+    account.
+    Only required for locations with a service principal storage credential
+    """
+
+    subscription_id: VariableOrOptional[str] = None
+    """
+    Optional subscription id for the queue, event grid subscription, and external location storage
+    account.
+    Required for locations with a service principal storage credential
+    """
+
+    @classmethod
+    def from_dict(cls, value: "AzureQueueStorageDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AzureQueueStorageDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AzureQueueStorageDict(TypedDict, total=False):
+    """"""
+
+    queue_url: VariableOrOptional[str]
+    """
+    The AQS queue url in the format https://{storage account}.queue.core.windows.net/{queue name}
+    Only required for provided_aqs.
+    """
+
+    resource_group: VariableOrOptional[str]
+    """
+    Optional resource group for the queue, event grid subscription, and external location storage
+    account.
+    Only required for locations with a service principal storage credential
+    """
+
+    subscription_id: VariableOrOptional[str]
+    """
+    Optional subscription id for the queue, event grid subscription, and external location storage
+    account.
+    Required for locations with a service principal storage credential
+    """
+
+
+AzureQueueStorageParam = AzureQueueStorageDict | AzureQueueStorage
diff --git a/python/databricks/bundles/external_locations/_models/encryption_details.py b/python/databricks/bundles/external_locations/_models/encryption_details.py
new file mode 100644
index 00000000000..d1b67fa76bd
--- /dev/null
+++ b/python/databricks/bundles/external_locations/_models/encryption_details.py
@@ -0,0 +1,46 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.external_locations._models.sse_encryption_details import (
+    SseEncryptionDetails,
+    SseEncryptionDetailsParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class EncryptionDetails:
+    """
+    Encryption options that apply to clients connecting to cloud storage.
+    """
+
+    sse_encryption_details: VariableOrOptional[SseEncryptionDetails] = None
+    """
+    Server-Side Encryption properties for clients communicating with AWS s3.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "EncryptionDetailsDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "EncryptionDetailsDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class EncryptionDetailsDict(TypedDict, total=False):
+    """"""
+
+    sse_encryption_details: VariableOrOptional[SseEncryptionDetailsParam]
+    """
+    Server-Side Encryption properties for clients communicating with AWS s3.
+    """
+
+
+EncryptionDetailsParam = EncryptionDetailsDict | EncryptionDetails
diff --git a/python/databricks/bundles/external_locations/_models/external_location.py b/python/databricks/bundles/external_locations/_models/external_location.py
new file mode 100644
index 00000000000..ea72a5da3dd
--- /dev/null
+++ b/python/databricks/bundles/external_locations/_models/external_location.py
@@ -0,0 +1,173 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._resource import Resource
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import (
+    VariableOr,
+    VariableOrList,
+    VariableOrOptional,
+)
+from databricks.bundles.external_locations._models.encryption_details import (
+    EncryptionDetails,
+    EncryptionDetailsParam,
+)
+from databricks.bundles.external_locations._models.file_event_queue import (
+    FileEventQueue,
+    FileEventQueueParam,
+)
+from databricks.bundles.external_locations._models.lifecycle import (
+    Lifecycle,
+    LifecycleParam,
+)
+from databricks.bundles.external_locations._models.privilege_assignment import (
+    PrivilegeAssignment,
+    PrivilegeAssignmentParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ExternalLocation(Resource):
+    """"""
+
+    credential_name: VariableOr[str]
+    """
+    Name of the storage credential used with this location.
+    """
+
+    name: VariableOr[str]
+    """
+    Name of the external location.
+    """
+
+    url: VariableOr[str]
+    """
+    Path URL of the external location.
+    """
+
+    comment: VariableOrOptional[str] = None
+    """
+    User-provided free-form text description.
+    """
+
+    enable_file_events: VariableOrOptional[bool] = None
+    """
+    Whether to enable file events on this external location. Default to `true`. Set to `false` to disable file events.
+    The actual applied value may differ due to server-side defaults; check `effective_enable_file_events` for the effective state.
+    """
+
+    encryption_details: VariableOrOptional[EncryptionDetails] = None
+    """
+    Encryption options that apply to clients connecting to cloud storage.
+    """
+
+    fallback: VariableOrOptional[bool] = None
+    """
+    Indicates whether fallback mode is enabled for this external location. When fallback mode is enabled, the access to the location falls back to cluster credentials if UC credentials are not sufficient.
+    """
+
+    file_event_queue: VariableOrOptional[FileEventQueue] = None
+    """
+    File event queue settings. If `enable_file_events` is not `false`, must be defined and have exactly one of the documented properties.
+    """
+
+    grants: VariableOrList[PrivilegeAssignment] = field(default_factory=list)
+    """
+    The Unity Catalog privileges to grant to principals on this securable.
+    """
+
+    lifecycle: VariableOrOptional[Lifecycle] = None
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+    read_only: VariableOrOptional[bool] = None
+    """
+    Indicates whether the external location is read-only.
+    """
+
+    skip_validation: VariableOrOptional[bool] = None
+    """
+    Skips validation of the storage credential associated with the external location.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "ExternalLocationDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ExternalLocationDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ExternalLocationDict(TypedDict, total=False):
+    """"""
+
+    credential_name: VariableOr[str]
+    """
+    Name of the storage credential used with this location.
+    """
+
+    name: VariableOr[str]
+    """
+    Name of the external location.
+    """
+
+    url: VariableOr[str]
+    """
+    Path URL of the external location.
+    """
+
+    comment: VariableOrOptional[str]
+    """
+    User-provided free-form text description.
+    """
+
+    enable_file_events: VariableOrOptional[bool]
+    """
+    Whether to enable file events on this external location. Default to `true`. Set to `false` to disable file events.
+    The actual applied value may differ due to server-side defaults; check `effective_enable_file_events` for the effective state.
+    """
+
+    encryption_details: VariableOrOptional[EncryptionDetailsParam]
+    """
+    Encryption options that apply to clients connecting to cloud storage.
+    """
+
+    fallback: VariableOrOptional[bool]
+    """
+    Indicates whether fallback mode is enabled for this external location. When fallback mode is enabled, the access to the location falls back to cluster credentials if UC credentials are not sufficient.
+    """
+
+    file_event_queue: VariableOrOptional[FileEventQueueParam]
+    """
+    File event queue settings. If `enable_file_events` is not `false`, must be defined and have exactly one of the documented properties.
+    """
+
+    grants: VariableOrList[PrivilegeAssignmentParam]
+    """
+    The Unity Catalog privileges to grant to principals on this securable.
+    """
+
+    lifecycle: VariableOrOptional[LifecycleParam]
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+    read_only: VariableOrOptional[bool]
+    """
+    Indicates whether the external location is read-only.
+    """
+
+    skip_validation: VariableOrOptional[bool]
+    """
+    Skips validation of the storage credential associated with the external location.
+    """
+
+
+ExternalLocationParam = ExternalLocationDict | ExternalLocation
diff --git a/python/databricks/bundles/external_locations/_models/file_event_queue.py b/python/databricks/bundles/external_locations/_models/file_event_queue.py
new file mode 100644
index 00000000000..78a791766cd
--- /dev/null
+++ b/python/databricks/bundles/external_locations/_models/file_event_queue.py
@@ -0,0 +1,66 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.external_locations._models.aws_sqs_queue import (
+    AwsSqsQueue,
+    AwsSqsQueueParam,
+)
+from databricks.bundles.external_locations._models.azure_queue_storage import (
+    AzureQueueStorage,
+    AzureQueueStorageParam,
+)
+from databricks.bundles.external_locations._models.gcp_pubsub import (
+    GcpPubsub,
+    GcpPubsubParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class FileEventQueue:
+    """"""
+
+    managed_aqs: VariableOrOptional[AzureQueueStorage] = None
+
+    managed_pubsub: VariableOrOptional[GcpPubsub] = None
+
+    managed_sqs: VariableOrOptional[AwsSqsQueue] = None
+
+    provided_aqs: VariableOrOptional[AzureQueueStorage] = None
+
+    provided_pubsub: VariableOrOptional[GcpPubsub] = None
+
+    provided_sqs: VariableOrOptional[AwsSqsQueue] = None
+
+    @classmethod
+    def from_dict(cls, value: "FileEventQueueDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "FileEventQueueDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class FileEventQueueDict(TypedDict, total=False):
+    """"""
+
+    managed_aqs: VariableOrOptional[AzureQueueStorageParam]
+
+    managed_pubsub: VariableOrOptional[GcpPubsubParam]
+
+    managed_sqs: VariableOrOptional[AwsSqsQueueParam]
+
+    provided_aqs: VariableOrOptional[AzureQueueStorageParam]
+
+    provided_pubsub: VariableOrOptional[GcpPubsubParam]
+
+    provided_sqs: VariableOrOptional[AwsSqsQueueParam]
+
+
+FileEventQueueParam = FileEventQueueDict | FileEventQueue
diff --git a/python/databricks/bundles/external_locations/_models/gcp_pubsub.py b/python/databricks/bundles/external_locations/_models/gcp_pubsub.py
new file mode 100644
index 00000000000..926b27d2a55
--- /dev/null
+++ b/python/databricks/bundles/external_locations/_models/gcp_pubsub.py
@@ -0,0 +1,42 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class GcpPubsub:
+    """"""
+
+    subscription_name: VariableOrOptional[str] = None
+    """
+    The Pub/Sub subscription name in the format projects/{project}/subscriptions/{subscription name}.
+    Only required for provided_pubsub.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "GcpPubsubDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "GcpPubsubDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class GcpPubsubDict(TypedDict, total=False):
+    """"""
+
+    subscription_name: VariableOrOptional[str]
+    """
+    The Pub/Sub subscription name in the format projects/{project}/subscriptions/{subscription name}.
+    Only required for provided_pubsub.
+    """
+
+
+GcpPubsubParam = GcpPubsubDict | GcpPubsub
diff --git a/python/databricks/bundles/external_locations/_models/lifecycle.py b/python/databricks/bundles/external_locations/_models/lifecycle.py
new file mode 100644
index 00000000000..697776a198e
--- /dev/null
+++ b/python/databricks/bundles/external_locations/_models/lifecycle.py
@@ -0,0 +1,40 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class Lifecycle:
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool] = None
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "LifecycleDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "LifecycleDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class LifecycleDict(TypedDict, total=False):
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool]
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+
+LifecycleParam = LifecycleDict | Lifecycle
diff --git a/python/databricks/bundles/external_locations/_models/privilege.py b/python/databricks/bundles/external_locations/_models/privilege.py
new file mode 100644
index 00000000000..df45211a76a
--- /dev/null
+++ b/python/databricks/bundles/external_locations/_models/privilege.py
@@ -0,0 +1,118 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class Privilege(Enum):
+    SELECT = "SELECT"
+    READ_PRIVATE_FILES = "READ_PRIVATE_FILES"
+    WRITE_PRIVATE_FILES = "WRITE_PRIVATE_FILES"
+    CREATE = "CREATE"
+    USAGE = "USAGE"
+    USE_CATALOG = "USE_CATALOG"
+    USE_SCHEMA = "USE_SCHEMA"
+    CREATE_SCHEMA = "CREATE_SCHEMA"
+    CREATE_VIEW = "CREATE_VIEW"
+    CREATE_EXTERNAL_TABLE = "CREATE_EXTERNAL_TABLE"
+    CREATE_MATERIALIZED_VIEW = "CREATE_MATERIALIZED_VIEW"
+    CREATE_FUNCTION = "CREATE_FUNCTION"
+    CREATE_MODEL = "CREATE_MODEL"
+    CREATE_CATALOG = "CREATE_CATALOG"
+    CREATE_MANAGED_STORAGE = "CREATE_MANAGED_STORAGE"
+    CREATE_EXTERNAL_LOCATION = "CREATE_EXTERNAL_LOCATION"
+    CREATE_STORAGE_CREDENTIAL = "CREATE_STORAGE_CREDENTIAL"
+    CREATE_SERVICE_CREDENTIAL = "CREATE_SERVICE_CREDENTIAL"
+    ACCESS = "ACCESS"
+    CREATE_SHARE = "CREATE_SHARE"
+    CREATE_RECIPIENT = "CREATE_RECIPIENT"
+    CREATE_PROVIDER = "CREATE_PROVIDER"
+    USE_SHARE = "USE_SHARE"
+    USE_RECIPIENT = "USE_RECIPIENT"
+    USE_PROVIDER = "USE_PROVIDER"
+    USE_MARKETPLACE_ASSETS = "USE_MARKETPLACE_ASSETS"
+    SET_SHARE_PERMISSION = "SET_SHARE_PERMISSION"
+    MODIFY = "MODIFY"
+    REFRESH = "REFRESH"
+    EXECUTE = "EXECUTE"
+    READ_FILES = "READ_FILES"
+    WRITE_FILES = "WRITE_FILES"
+    CREATE_TABLE = "CREATE_TABLE"
+    ALL_PRIVILEGES = "ALL_PRIVILEGES"
+    CREATE_CONNECTION = "CREATE_CONNECTION"
+    USE_CONNECTION = "USE_CONNECTION"
+    APPLY_TAG = "APPLY_TAG"
+    CREATE_FOREIGN_CATALOG = "CREATE_FOREIGN_CATALOG"
+    CREATE_FOREIGN_SECURABLE = "CREATE_FOREIGN_SECURABLE"
+    MANAGE_ALLOWLIST = "MANAGE_ALLOWLIST"
+    CREATE_VOLUME = "CREATE_VOLUME"
+    CREATE_EXTERNAL_VOLUME = "CREATE_EXTERNAL_VOLUME"
+    READ_VOLUME = "READ_VOLUME"
+    WRITE_VOLUME = "WRITE_VOLUME"
+    MANAGE = "MANAGE"
+    BROWSE = "BROWSE"
+    CREATE_CLEAN_ROOM = "CREATE_CLEAN_ROOM"
+    MODIFY_CLEAN_ROOM = "MODIFY_CLEAN_ROOM"
+    EXECUTE_CLEAN_ROOM_TASK = "EXECUTE_CLEAN_ROOM_TASK"
+    EXTERNAL_USE_SCHEMA = "EXTERNAL_USE_SCHEMA"
+    READ_METADATA = "READ_METADATA"
+    EXTERNAL_USE_LOCATION = "EXTERNAL_USE_LOCATION"
+
+
+PrivilegeParam = (
+    Literal[
+        "SELECT",
+        "READ_PRIVATE_FILES",
+        "WRITE_PRIVATE_FILES",
+        "CREATE",
+        "USAGE",
+        "USE_CATALOG",
+        "USE_SCHEMA",
+        "CREATE_SCHEMA",
+        "CREATE_VIEW",
+        "CREATE_EXTERNAL_TABLE",
+        "CREATE_MATERIALIZED_VIEW",
+        "CREATE_FUNCTION",
+        "CREATE_MODEL",
+        "CREATE_CATALOG",
+        "CREATE_MANAGED_STORAGE",
+        "CREATE_EXTERNAL_LOCATION",
+        "CREATE_STORAGE_CREDENTIAL",
+        "CREATE_SERVICE_CREDENTIAL",
+        "ACCESS",
+        "CREATE_SHARE",
+        "CREATE_RECIPIENT",
+        "CREATE_PROVIDER",
+        "USE_SHARE",
+        "USE_RECIPIENT",
+        "USE_PROVIDER",
+        "USE_MARKETPLACE_ASSETS",
+        "SET_SHARE_PERMISSION",
+        "MODIFY",
+        "REFRESH",
+        "EXECUTE",
+        "READ_FILES",
+        "WRITE_FILES",
+        "CREATE_TABLE",
+        "ALL_PRIVILEGES",
+        "CREATE_CONNECTION",
+        "USE_CONNECTION",
+        "APPLY_TAG",
+        "CREATE_FOREIGN_CATALOG",
+        "CREATE_FOREIGN_SECURABLE",
+        "MANAGE_ALLOWLIST",
+        "CREATE_VOLUME",
+        "CREATE_EXTERNAL_VOLUME",
+        "READ_VOLUME",
+        "WRITE_VOLUME",
+        "MANAGE",
+        "BROWSE",
+        "CREATE_CLEAN_ROOM",
+        "MODIFY_CLEAN_ROOM",
+        "EXECUTE_CLEAN_ROOM_TASK",
+        "EXTERNAL_USE_SCHEMA",
+        "READ_METADATA",
+        "EXTERNAL_USE_LOCATION",
+    ]
+    | Privilege
+)
diff --git a/python/databricks/bundles/external_locations/_models/privilege_assignment.py b/python/databricks/bundles/external_locations/_models/privilege_assignment.py
new file mode 100644
index 00000000000..f48f9511ac0
--- /dev/null
+++ b/python/databricks/bundles/external_locations/_models/privilege_assignment.py
@@ -0,0 +1,56 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
+from databricks.bundles.external_locations._models.privilege import (
+    Privilege,
+    PrivilegeParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class PrivilegeAssignment:
+    """"""
+
+    principal: VariableOrOptional[str] = None
+    """
+    The principal (user email address or group name).
+    For deleted principals, `principal` is empty while `principal_id` is populated.
+    """
+
+    privileges: VariableOrList[Privilege] = field(default_factory=list)
+    """
+    The privileges assigned to the principal.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "PrivilegeAssignmentDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "PrivilegeAssignmentDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class PrivilegeAssignmentDict(TypedDict, total=False):
+    """"""
+
+    principal: VariableOrOptional[str]
+    """
+    The principal (user email address or group name).
+    For deleted principals, `principal` is empty while `principal_id` is populated.
+    """
+
+    privileges: VariableOrList[PrivilegeParam]
+    """
+    The privileges assigned to the principal.
+    """
+
+
+PrivilegeAssignmentParam = PrivilegeAssignmentDict | PrivilegeAssignment
diff --git a/python/databricks/bundles/external_locations/_models/sse_encryption_details.py b/python/databricks/bundles/external_locations/_models/sse_encryption_details.py
new file mode 100644
index 00000000000..339b98b8b26
--- /dev/null
+++ b/python/databricks/bundles/external_locations/_models/sse_encryption_details.py
@@ -0,0 +1,58 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.external_locations._models.sse_encryption_details_algorithm import (
+    SseEncryptionDetailsAlgorithm,
+    SseEncryptionDetailsAlgorithmParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class SseEncryptionDetails:
+    """
+    Server-Side Encryption properties for clients communicating with AWS s3.
+    """
+
+    algorithm: VariableOrOptional[SseEncryptionDetailsAlgorithm] = None
+    """
+    Sets the value of the 'x-amz-server-side-encryption' header in S3 request.
+    """
+
+    aws_kms_key_arn: VariableOrOptional[str] = None
+    """
+    Optional. The ARN of the SSE-KMS key used with the S3 location, when algorithm = "SSE-KMS".
+    Sets the value of the 'x-amz-server-side-encryption-aws-kms-key-id' header.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "SseEncryptionDetailsDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "SseEncryptionDetailsDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class SseEncryptionDetailsDict(TypedDict, total=False):
+    """"""
+
+    algorithm: VariableOrOptional[SseEncryptionDetailsAlgorithmParam]
+    """
+    Sets the value of the 'x-amz-server-side-encryption' header in S3 request.
+    """
+
+    aws_kms_key_arn: VariableOrOptional[str]
+    """
+    Optional. The ARN of the SSE-KMS key used with the S3 location, when algorithm = "SSE-KMS".
+    Sets the value of the 'x-amz-server-side-encryption-aws-kms-key-id' header.
+    """
+
+
+SseEncryptionDetailsParam = SseEncryptionDetailsDict | SseEncryptionDetails
diff --git a/python/databricks/bundles/external_locations/_models/sse_encryption_details_algorithm.py b/python/databricks/bundles/external_locations/_models/sse_encryption_details_algorithm.py
new file mode 100644
index 00000000000..d5d63383a74
--- /dev/null
+++ b/python/databricks/bundles/external_locations/_models/sse_encryption_details_algorithm.py
@@ -0,0 +1,18 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class SseEncryptionDetailsAlgorithm(Enum):
+    """
+    SSE algorithm to use for encrypting S3 objects
+    """
+
+    AWS_SSE_S3 = "AWS_SSE_S3"
+    AWS_SSE_KMS = "AWS_SSE_KMS"
+
+
+SseEncryptionDetailsAlgorithmParam = (
+    Literal["AWS_SSE_S3", "AWS_SSE_KMS"] | SseEncryptionDetailsAlgorithm
+)
diff --git a/python/databricks/bundles/features/__init__.py b/python/databricks/bundles/features/__init__.py
new file mode 100644
index 00000000000..24e3f143d65
--- /dev/null
+++ b/python/databricks/bundles/features/__init__.py
@@ -0,0 +1,356 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+__all__ = [
+    "AggregationFunction",
+    "AggregationFunctionDict",
+    "AggregationFunctionParam",
+    "ApproxCountDistinctFunction",
+    "ApproxCountDistinctFunctionDict",
+    "ApproxCountDistinctFunctionParam",
+    "ApproxPercentileFunction",
+    "ApproxPercentileFunctionDict",
+    "ApproxPercentileFunctionParam",
+    "AvgFunction",
+    "AvgFunctionDict",
+    "AvgFunctionParam",
+    "ColumnSelection",
+    "ColumnSelectionDict",
+    "ColumnSelectionParam",
+    "CountFunction",
+    "CountFunctionDict",
+    "CountFunctionParam",
+    "CustomUdf",
+    "CustomUdfDict",
+    "CustomUdfParam",
+    "DataSource",
+    "DataSourceDict",
+    "DataSourceParam",
+    "DeltaTableSource",
+    "DeltaTableSourceDict",
+    "DeltaTableSourceParam",
+    "EntityColumn",
+    "EntityColumnDict",
+    "EntityColumnParam",
+    "Feature",
+    "FeatureDict",
+    "FeatureParam",
+    "FeatureReference",
+    "FeatureReferenceDict",
+    "FeatureReferenceParam",
+    "FeatureViewSource",
+    "FeatureViewSourceDict",
+    "FeatureViewSourceParam",
+    "FieldDefinition",
+    "FieldDefinitionDict",
+    "FieldDefinitionParam",
+    "FirstDistinctFunction",
+    "FirstDistinctFunctionDict",
+    "FirstDistinctFunctionParam",
+    "FirstFunction",
+    "FirstFunctionDict",
+    "FirstFunctionParam",
+    "FirstNFunction",
+    "FirstNFunctionDict",
+    "FirstNFunctionParam",
+    "FlatSchema",
+    "FlatSchemaDict",
+    "FlatSchemaParam",
+    "Function",
+    "FunctionDict",
+    "FunctionParam",
+    "InputBinding",
+    "InputBindingDict",
+    "InputBindingParam",
+    "JobContext",
+    "JobContextDict",
+    "JobContextParam",
+    "KafkaSource",
+    "KafkaSourceDict",
+    "KafkaSourceParam",
+    "LastDistinctFunction",
+    "LastDistinctFunctionDict",
+    "LastDistinctFunctionParam",
+    "LastFunction",
+    "LastFunctionDict",
+    "LastFunctionParam",
+    "LastNFunction",
+    "LastNFunctionDict",
+    "LastNFunctionParam",
+    "Lifecycle",
+    "LifecycleDict",
+    "LifecycleParam",
+    "LineageContext",
+    "LineageContextDict",
+    "LineageContextParam",
+    "MaxFunction",
+    "MaxFunctionDict",
+    "MaxFunctionParam",
+    "MinFunction",
+    "MinFunctionDict",
+    "MinFunctionParam",
+    "RequestSource",
+    "RequestSourceDict",
+    "RequestSourceParam",
+    "RollingWindow",
+    "RollingWindowDict",
+    "RollingWindowParam",
+    "SawtoothWindow",
+    "SawtoothWindowDict",
+    "SawtoothWindowParam",
+    "ScalarDataType",
+    "ScalarDataTypeParam",
+    "SlidingWindow",
+    "SlidingWindowDict",
+    "SlidingWindowParam",
+    "SourceLateness",
+    "SourceLatenessDict",
+    "SourceLatenessParam",
+    "StddevPopFunction",
+    "StddevPopFunctionDict",
+    "StddevPopFunctionParam",
+    "StddevSampFunction",
+    "StddevSampFunctionDict",
+    "StddevSampFunctionParam",
+    "StreamSource",
+    "StreamSourceDict",
+    "StreamSourceParam",
+    "SumFunction",
+    "SumFunctionDict",
+    "SumFunctionParam",
+    "TimeWindow",
+    "TimeWindowDict",
+    "TimeWindowParam",
+    "TimeseriesColumn",
+    "TimeseriesColumnDict",
+    "TimeseriesColumnParam",
+    "TumblingWindow",
+    "TumblingWindowDict",
+    "TumblingWindowParam",
+    "VarPopFunction",
+    "VarPopFunctionDict",
+    "VarPopFunctionParam",
+    "VarSampFunction",
+    "VarSampFunctionDict",
+    "VarSampFunctionParam",
+]
+
+
+from databricks.bundles.features._models.aggregation_function import (
+    AggregationFunction,
+    AggregationFunctionDict,
+    AggregationFunctionParam,
+)
+from databricks.bundles.features._models.approx_count_distinct_function import (
+    ApproxCountDistinctFunction,
+    ApproxCountDistinctFunctionDict,
+    ApproxCountDistinctFunctionParam,
+)
+from databricks.bundles.features._models.approx_percentile_function import (
+    ApproxPercentileFunction,
+    ApproxPercentileFunctionDict,
+    ApproxPercentileFunctionParam,
+)
+from databricks.bundles.features._models.avg_function import (
+    AvgFunction,
+    AvgFunctionDict,
+    AvgFunctionParam,
+)
+from databricks.bundles.features._models.column_selection import (
+    ColumnSelection,
+    ColumnSelectionDict,
+    ColumnSelectionParam,
+)
+from databricks.bundles.features._models.count_function import (
+    CountFunction,
+    CountFunctionDict,
+    CountFunctionParam,
+)
+from databricks.bundles.features._models.custom_udf import (
+    CustomUdf,
+    CustomUdfDict,
+    CustomUdfParam,
+)
+from databricks.bundles.features._models.data_source import (
+    DataSource,
+    DataSourceDict,
+    DataSourceParam,
+)
+from databricks.bundles.features._models.delta_table_source import (
+    DeltaTableSource,
+    DeltaTableSourceDict,
+    DeltaTableSourceParam,
+)
+from databricks.bundles.features._models.entity_column import (
+    EntityColumn,
+    EntityColumnDict,
+    EntityColumnParam,
+)
+from databricks.bundles.features._models.feature import (
+    Feature,
+    FeatureDict,
+    FeatureParam,
+)
+from databricks.bundles.features._models.feature_reference import (
+    FeatureReference,
+    FeatureReferenceDict,
+    FeatureReferenceParam,
+)
+from databricks.bundles.features._models.feature_view_source import (
+    FeatureViewSource,
+    FeatureViewSourceDict,
+    FeatureViewSourceParam,
+)
+from databricks.bundles.features._models.field_definition import (
+    FieldDefinition,
+    FieldDefinitionDict,
+    FieldDefinitionParam,
+)
+from databricks.bundles.features._models.first_distinct_function import (
+    FirstDistinctFunction,
+    FirstDistinctFunctionDict,
+    FirstDistinctFunctionParam,
+)
+from databricks.bundles.features._models.first_function import (
+    FirstFunction,
+    FirstFunctionDict,
+    FirstFunctionParam,
+)
+from databricks.bundles.features._models.first_n_function import (
+    FirstNFunction,
+    FirstNFunctionDict,
+    FirstNFunctionParam,
+)
+from databricks.bundles.features._models.flat_schema import (
+    FlatSchema,
+    FlatSchemaDict,
+    FlatSchemaParam,
+)
+from databricks.bundles.features._models.function import (
+    Function,
+    FunctionDict,
+    FunctionParam,
+)
+from databricks.bundles.features._models.input_binding import (
+    InputBinding,
+    InputBindingDict,
+    InputBindingParam,
+)
+from databricks.bundles.features._models.job_context import (
+    JobContext,
+    JobContextDict,
+    JobContextParam,
+)
+from databricks.bundles.features._models.kafka_source import (
+    KafkaSource,
+    KafkaSourceDict,
+    KafkaSourceParam,
+)
+from databricks.bundles.features._models.last_distinct_function import (
+    LastDistinctFunction,
+    LastDistinctFunctionDict,
+    LastDistinctFunctionParam,
+)
+from databricks.bundles.features._models.last_function import (
+    LastFunction,
+    LastFunctionDict,
+    LastFunctionParam,
+)
+from databricks.bundles.features._models.last_n_function import (
+    LastNFunction,
+    LastNFunctionDict,
+    LastNFunctionParam,
+)
+from databricks.bundles.features._models.lifecycle import (
+    Lifecycle,
+    LifecycleDict,
+    LifecycleParam,
+)
+from databricks.bundles.features._models.lineage_context import (
+    LineageContext,
+    LineageContextDict,
+    LineageContextParam,
+)
+from databricks.bundles.features._models.max_function import (
+    MaxFunction,
+    MaxFunctionDict,
+    MaxFunctionParam,
+)
+from databricks.bundles.features._models.min_function import (
+    MinFunction,
+    MinFunctionDict,
+    MinFunctionParam,
+)
+from databricks.bundles.features._models.request_source import (
+    RequestSource,
+    RequestSourceDict,
+    RequestSourceParam,
+)
+from databricks.bundles.features._models.rolling_window import (
+    RollingWindow,
+    RollingWindowDict,
+    RollingWindowParam,
+)
+from databricks.bundles.features._models.sawtooth_window import (
+    SawtoothWindow,
+    SawtoothWindowDict,
+    SawtoothWindowParam,
+)
+from databricks.bundles.features._models.scalar_data_type import (
+    ScalarDataType,
+    ScalarDataTypeParam,
+)
+from databricks.bundles.features._models.sliding_window import (
+    SlidingWindow,
+    SlidingWindowDict,
+    SlidingWindowParam,
+)
+from databricks.bundles.features._models.source_lateness import (
+    SourceLateness,
+    SourceLatenessDict,
+    SourceLatenessParam,
+)
+from databricks.bundles.features._models.stddev_pop_function import (
+    StddevPopFunction,
+    StddevPopFunctionDict,
+    StddevPopFunctionParam,
+)
+from databricks.bundles.features._models.stddev_samp_function import (
+    StddevSampFunction,
+    StddevSampFunctionDict,
+    StddevSampFunctionParam,
+)
+from databricks.bundles.features._models.stream_source import (
+    StreamSource,
+    StreamSourceDict,
+    StreamSourceParam,
+)
+from databricks.bundles.features._models.sum_function import (
+    SumFunction,
+    SumFunctionDict,
+    SumFunctionParam,
+)
+from databricks.bundles.features._models.time_window import (
+    TimeWindow,
+    TimeWindowDict,
+    TimeWindowParam,
+)
+from databricks.bundles.features._models.timeseries_column import (
+    TimeseriesColumn,
+    TimeseriesColumnDict,
+    TimeseriesColumnParam,
+)
+from databricks.bundles.features._models.tumbling_window import (
+    TumblingWindow,
+    TumblingWindowDict,
+    TumblingWindowParam,
+)
+from databricks.bundles.features._models.var_pop_function import (
+    VarPopFunction,
+    VarPopFunctionDict,
+    VarPopFunctionParam,
+)
+from databricks.bundles.features._models.var_samp_function import (
+    VarSampFunction,
+    VarSampFunctionDict,
+    VarSampFunctionParam,
+)
diff --git a/python/databricks/bundles/features/_models/aggregation_function.py b/python/databricks/bundles/features/_models/aggregation_function.py
new file mode 100644
index 00000000000..292f03909fa
--- /dev/null
+++ b/python/databricks/bundles/features/_models/aggregation_function.py
@@ -0,0 +1,297 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.features._models.approx_count_distinct_function import (
+    ApproxCountDistinctFunction,
+    ApproxCountDistinctFunctionParam,
+)
+from databricks.bundles.features._models.approx_percentile_function import (
+    ApproxPercentileFunction,
+    ApproxPercentileFunctionParam,
+)
+from databricks.bundles.features._models.avg_function import (
+    AvgFunction,
+    AvgFunctionParam,
+)
+from databricks.bundles.features._models.count_function import (
+    CountFunction,
+    CountFunctionParam,
+)
+from databricks.bundles.features._models.first_distinct_function import (
+    FirstDistinctFunction,
+    FirstDistinctFunctionParam,
+)
+from databricks.bundles.features._models.first_function import (
+    FirstFunction,
+    FirstFunctionParam,
+)
+from databricks.bundles.features._models.first_n_function import (
+    FirstNFunction,
+    FirstNFunctionParam,
+)
+from databricks.bundles.features._models.last_distinct_function import (
+    LastDistinctFunction,
+    LastDistinctFunctionParam,
+)
+from databricks.bundles.features._models.last_function import (
+    LastFunction,
+    LastFunctionParam,
+)
+from databricks.bundles.features._models.last_n_function import (
+    LastNFunction,
+    LastNFunctionParam,
+)
+from databricks.bundles.features._models.max_function import (
+    MaxFunction,
+    MaxFunctionParam,
+)
+from databricks.bundles.features._models.min_function import (
+    MinFunction,
+    MinFunctionParam,
+)
+from databricks.bundles.features._models.stddev_pop_function import (
+    StddevPopFunction,
+    StddevPopFunctionParam,
+)
+from databricks.bundles.features._models.stddev_samp_function import (
+    StddevSampFunction,
+    StddevSampFunctionParam,
+)
+from databricks.bundles.features._models.sum_function import (
+    SumFunction,
+    SumFunctionParam,
+)
+from databricks.bundles.features._models.time_window import TimeWindow, TimeWindowParam
+from databricks.bundles.features._models.var_pop_function import (
+    VarPopFunction,
+    VarPopFunctionParam,
+)
+from databricks.bundles.features._models.var_samp_function import (
+    VarSampFunction,
+    VarSampFunctionParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AggregationFunction:
+    """
+    An aggregation function applied over a time window.
+    """
+
+    approx_count_distinct: VariableOrOptional[ApproxCountDistinctFunction] = None
+    """
+    Computes the approximate count of distinct values.
+    """
+
+    approx_percentile: VariableOrOptional[ApproxPercentileFunction] = None
+    """
+    Computes the approximate percentile of values.
+    """
+
+    avg: VariableOrOptional[AvgFunction] = None
+    """
+    Computes the average of values.
+    """
+
+    count_function: VariableOrOptional[CountFunction] = None
+    """
+    Computes the count of values.
+    """
+
+    first: VariableOrOptional[FirstFunction] = None
+    """
+    Returns the first value.
+    """
+
+    first_distinct: VariableOrOptional[FirstDistinctFunction] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Returns the first N distinct values, ordered by the feature's timeseries column.
+    """
+
+    first_n: VariableOrOptional[FirstNFunction] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Returns the first N values, ordered by the feature's timeseries column.
+    """
+
+    last: VariableOrOptional[LastFunction] = None
+    """
+    Returns the last value.
+    """
+
+    last_distinct: VariableOrOptional[LastDistinctFunction] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Returns the last N distinct values, ordered by the feature's timeseries column.
+    """
+
+    last_n: VariableOrOptional[LastNFunction] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Returns the last N values, ordered by the feature's timeseries column.
+    """
+
+    max: VariableOrOptional[MaxFunction] = None
+    """
+    Computes the maximum value.
+    """
+
+    min: VariableOrOptional[MinFunction] = None
+    """
+    Computes the minimum value.
+    """
+
+    stddev_pop: VariableOrOptional[StddevPopFunction] = None
+    """
+    Computes the population standard deviation.
+    """
+
+    stddev_samp: VariableOrOptional[StddevSampFunction] = None
+    """
+    Computes the sample standard deviation.
+    """
+
+    sum: VariableOrOptional[SumFunction] = None
+    """
+    Computes the sum of values.
+    """
+
+    time_window: VariableOrOptional[TimeWindow] = None
+    """
+    The time window over which the aggregation is computed.
+    """
+
+    var_pop: VariableOrOptional[VarPopFunction] = None
+    """
+    Computes the population variance.
+    """
+
+    var_samp: VariableOrOptional[VarSampFunction] = None
+    """
+    Computes the sample variance.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "AggregationFunctionDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AggregationFunctionDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AggregationFunctionDict(TypedDict, total=False):
+    """"""
+
+    approx_count_distinct: VariableOrOptional[ApproxCountDistinctFunctionParam]
+    """
+    Computes the approximate count of distinct values.
+    """
+
+    approx_percentile: VariableOrOptional[ApproxPercentileFunctionParam]
+    """
+    Computes the approximate percentile of values.
+    """
+
+    avg: VariableOrOptional[AvgFunctionParam]
+    """
+    Computes the average of values.
+    """
+
+    count_function: VariableOrOptional[CountFunctionParam]
+    """
+    Computes the count of values.
+    """
+
+    first: VariableOrOptional[FirstFunctionParam]
+    """
+    Returns the first value.
+    """
+
+    first_distinct: VariableOrOptional[FirstDistinctFunctionParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Returns the first N distinct values, ordered by the feature's timeseries column.
+    """
+
+    first_n: VariableOrOptional[FirstNFunctionParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Returns the first N values, ordered by the feature's timeseries column.
+    """
+
+    last: VariableOrOptional[LastFunctionParam]
+    """
+    Returns the last value.
+    """
+
+    last_distinct: VariableOrOptional[LastDistinctFunctionParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Returns the last N distinct values, ordered by the feature's timeseries column.
+    """
+
+    last_n: VariableOrOptional[LastNFunctionParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Returns the last N values, ordered by the feature's timeseries column.
+    """
+
+    max: VariableOrOptional[MaxFunctionParam]
+    """
+    Computes the maximum value.
+    """
+
+    min: VariableOrOptional[MinFunctionParam]
+    """
+    Computes the minimum value.
+    """
+
+    stddev_pop: VariableOrOptional[StddevPopFunctionParam]
+    """
+    Computes the population standard deviation.
+    """
+
+    stddev_samp: VariableOrOptional[StddevSampFunctionParam]
+    """
+    Computes the sample standard deviation.
+    """
+
+    sum: VariableOrOptional[SumFunctionParam]
+    """
+    Computes the sum of values.
+    """
+
+    time_window: VariableOrOptional[TimeWindowParam]
+    """
+    The time window over which the aggregation is computed.
+    """
+
+    var_pop: VariableOrOptional[VarPopFunctionParam]
+    """
+    Computes the population variance.
+    """
+
+    var_samp: VariableOrOptional[VarSampFunctionParam]
+    """
+    Computes the sample variance.
+    """
+
+
+AggregationFunctionParam = AggregationFunctionDict | AggregationFunction
diff --git a/python/databricks/bundles/features/_models/approx_count_distinct_function.py b/python/databricks/bundles/features/_models/approx_count_distinct_function.py
new file mode 100644
index 00000000000..6244d5a431c
--- /dev/null
+++ b/python/databricks/bundles/features/_models/approx_count_distinct_function.py
@@ -0,0 +1,54 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ApproxCountDistinctFunction:
+    """
+    Computes the approximate count of distinct values.
+    """
+
+    input: VariableOr[str]
+    """
+    The input column from which the approximate count of distinct values is computed.
+    """
+
+    relative_sd: VariableOrOptional[float] = None
+    """
+    The maximum relative standard deviation allowed (default defined by Spark).
+    """
+
+    @classmethod
+    def from_dict(cls, value: "ApproxCountDistinctFunctionDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ApproxCountDistinctFunctionDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ApproxCountDistinctFunctionDict(TypedDict, total=False):
+    """"""
+
+    input: VariableOr[str]
+    """
+    The input column from which the approximate count of distinct values is computed.
+    """
+
+    relative_sd: VariableOrOptional[float]
+    """
+    The maximum relative standard deviation allowed (default defined by Spark).
+    """
+
+
+ApproxCountDistinctFunctionParam = (
+    ApproxCountDistinctFunctionDict | ApproxCountDistinctFunction
+)
diff --git a/python/databricks/bundles/features/_models/approx_percentile_function.py b/python/databricks/bundles/features/_models/approx_percentile_function.py
new file mode 100644
index 00000000000..b4648e41209
--- /dev/null
+++ b/python/databricks/bundles/features/_models/approx_percentile_function.py
@@ -0,0 +1,62 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ApproxPercentileFunction:
+    """
+    Computes the approximate percentile of values.
+    """
+
+    input: VariableOr[str]
+    """
+    The input column from which the approximate percentile is computed.
+    """
+
+    percentile: VariableOr[float]
+    """
+    The percentile value to compute (between 0 and 1).
+    """
+
+    accuracy: VariableOrOptional[int] = None
+    """
+    The accuracy parameter (higher is more accurate but slower).
+    """
+
+    @classmethod
+    def from_dict(cls, value: "ApproxPercentileFunctionDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ApproxPercentileFunctionDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ApproxPercentileFunctionDict(TypedDict, total=False):
+    """"""
+
+    input: VariableOr[str]
+    """
+    The input column from which the approximate percentile is computed.
+    """
+
+    percentile: VariableOr[float]
+    """
+    The percentile value to compute (between 0 and 1).
+    """
+
+    accuracy: VariableOrOptional[int]
+    """
+    The accuracy parameter (higher is more accurate but slower).
+    """
+
+
+ApproxPercentileFunctionParam = ApproxPercentileFunctionDict | ApproxPercentileFunction
diff --git a/python/databricks/bundles/features/_models/avg_function.py b/python/databricks/bundles/features/_models/avg_function.py
new file mode 100644
index 00000000000..5ecf0cc486b
--- /dev/null
+++ b/python/databricks/bundles/features/_models/avg_function.py
@@ -0,0 +1,48 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AvgFunction:
+    """
+    Computes the average of values.
+    """
+
+    input: VariableOr[str]
+    """
+    The input column from which the average is computed. For Kafka sources, use dot-prefixed path
+    notation (e.g., "value.amount"). For nested fields, the leaf node name is used.
+    Colon-prefixed notation (e.g., "value:amount") is supported for backwards
+    compatibility but is deprecated; migrate to dot notation.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "AvgFunctionDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AvgFunctionDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AvgFunctionDict(TypedDict, total=False):
+    """"""
+
+    input: VariableOr[str]
+    """
+    The input column from which the average is computed. For Kafka sources, use dot-prefixed path
+    notation (e.g., "value.amount"). For nested fields, the leaf node name is used.
+    Colon-prefixed notation (e.g., "value:amount") is supported for backwards
+    compatibility but is deprecated; migrate to dot notation.
+    """
+
+
+AvgFunctionParam = AvgFunctionDict | AvgFunction
diff --git a/python/databricks/bundles/features/_models/column_selection.py b/python/databricks/bundles/features/_models/column_selection.py
new file mode 100644
index 00000000000..d09726cd190
--- /dev/null
+++ b/python/databricks/bundles/features/_models/column_selection.py
@@ -0,0 +1,42 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ColumnSelection:
+    """
+    A ColumnSelection function, equivalent to the LAST() record of an entity over a lifetime window
+    """
+
+    column: VariableOr[str]
+    """
+    Column name from source to select as the feature value.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "ColumnSelectionDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ColumnSelectionDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ColumnSelectionDict(TypedDict, total=False):
+    """"""
+
+    column: VariableOr[str]
+    """
+    Column name from source to select as the feature value.
+    """
+
+
+ColumnSelectionParam = ColumnSelectionDict | ColumnSelection
diff --git a/python/databricks/bundles/features/_models/count_function.py b/python/databricks/bundles/features/_models/count_function.py
new file mode 100644
index 00000000000..6cd86a68132
--- /dev/null
+++ b/python/databricks/bundles/features/_models/count_function.py
@@ -0,0 +1,48 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class CountFunction:
+    """
+    Computes the count of values.
+    """
+
+    input: VariableOr[str]
+    """
+    The input column from which the count is computed. For Kafka sources, use dot-prefixed path
+    notation (e.g., "value.amount"). For nested fields, the leaf node name is used.
+    Colon-prefixed notation (e.g., "value:amount") is supported for backwards
+    compatibility but is deprecated; migrate to dot notation.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "CountFunctionDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "CountFunctionDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class CountFunctionDict(TypedDict, total=False):
+    """"""
+
+    input: VariableOr[str]
+    """
+    The input column from which the count is computed. For Kafka sources, use dot-prefixed path
+    notation (e.g., "value.amount"). For nested fields, the leaf node name is used.
+    Colon-prefixed notation (e.g., "value:amount") is supported for backwards
+    compatibility but is deprecated; migrate to dot notation.
+    """
+
+
+CountFunctionParam = CountFunctionDict | CountFunction
diff --git a/python/databricks/bundles/features/_models/custom_udf.py b/python/databricks/bundles/features/_models/custom_udf.py
new file mode 100644
index 00000000000..7130a8e59cb
--- /dev/null
+++ b/python/databricks/bundles/features/_models/custom_udf.py
@@ -0,0 +1,69 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrList
+from databricks.bundles.features._models.input_binding import (
+    InputBinding,
+    InputBindingParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class CustomUdf:
+    """
+    :meta private: [EXPERIMENTAL]
+
+    A CustomUdf function applies a registered Unity Catalog function row-wise to
+    source columns, producing a single output column per row.
+    """
+
+    function_path: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Fully qualified 3-part Unity Catalog path of the function to apply.
+    """
+
+    input_bindings: VariableOrList[InputBinding] = field(default_factory=list)
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Binds each UC function parameter to a source column.
+    May be empty for zero-argument functions (e.g. a timestamp generator).
+    """
+
+    @classmethod
+    def from_dict(cls, value: "CustomUdfDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "CustomUdfDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class CustomUdfDict(TypedDict, total=False):
+    """"""
+
+    function_path: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Fully qualified 3-part Unity Catalog path of the function to apply.
+    """
+
+    input_bindings: VariableOrList[InputBindingParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Binds each UC function parameter to a source column.
+    May be empty for zero-argument functions (e.g. a timestamp generator).
+    """
+
+
+CustomUdfParam = CustomUdfDict | CustomUdf
diff --git a/python/databricks/bundles/features/_models/data_source.py b/python/databricks/bundles/features/_models/data_source.py
new file mode 100644
index 00000000000..b4a22c0276c
--- /dev/null
+++ b/python/databricks/bundles/features/_models/data_source.py
@@ -0,0 +1,126 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.features._models.delta_table_source import (
+    DeltaTableSource,
+    DeltaTableSourceParam,
+)
+from databricks.bundles.features._models.feature_view_source import (
+    FeatureViewSource,
+    FeatureViewSourceParam,
+)
+from databricks.bundles.features._models.kafka_source import (
+    KafkaSource,
+    KafkaSourceParam,
+)
+from databricks.bundles.features._models.request_source import (
+    RequestSource,
+    RequestSourceParam,
+)
+from databricks.bundles.features._models.source_lateness import (
+    SourceLateness,
+    SourceLatenessParam,
+)
+from databricks.bundles.features._models.stream_source import (
+    StreamSource,
+    StreamSourceParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class DataSource:
+    """
+    Specifies the data source backing a feature. Exactly one source type must be set.
+    """
+
+    delta_table_source: VariableOrOptional[DeltaTableSource] = None
+    """
+    A Delta table data source.
+    """
+
+    feature_view_source: VariableOrOptional[FeatureViewSource] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] A data source composed from registered upstream Features.
+    """
+
+    kafka_source: VariableOrOptional[KafkaSource] = None
+    """
+    A Kafka stream data source.
+    """
+
+    lateness: VariableOrOptional[SourceLateness] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Completeness timing for this Feature's use of the source. This configuration is part of the
+    Feature definition; it does not modify the underlying table or stream.
+    """
+
+    request_source: VariableOrOptional[RequestSource] = None
+    """
+    A request-time data source.
+    """
+
+    stream_source: VariableOrOptional[StreamSource] = None
+    """
+    A Stream data source.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "DataSourceDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "DataSourceDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class DataSourceDict(TypedDict, total=False):
+    """"""
+
+    delta_table_source: VariableOrOptional[DeltaTableSourceParam]
+    """
+    A Delta table data source.
+    """
+
+    feature_view_source: VariableOrOptional[FeatureViewSourceParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] A data source composed from registered upstream Features.
+    """
+
+    kafka_source: VariableOrOptional[KafkaSourceParam]
+    """
+    A Kafka stream data source.
+    """
+
+    lateness: VariableOrOptional[SourceLatenessParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Completeness timing for this Feature's use of the source. This configuration is part of the
+    Feature definition; it does not modify the underlying table or stream.
+    """
+
+    request_source: VariableOrOptional[RequestSourceParam]
+    """
+    A request-time data source.
+    """
+
+    stream_source: VariableOrOptional[StreamSourceParam]
+    """
+    A Stream data source.
+    """
+
+
+DataSourceParam = DataSourceDict | DataSource
diff --git a/python/databricks/bundles/features/_models/delta_table_source.py b/python/databricks/bundles/features/_models/delta_table_source.py
new file mode 100644
index 00000000000..3caedb40fa6
--- /dev/null
+++ b/python/databricks/bundles/features/_models/delta_table_source.py
@@ -0,0 +1,78 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class DeltaTableSource:
+    """"""
+
+    full_name: VariableOr[str]
+    """
+    The full three-part (catalog, schema, table) name of the Delta table.
+    """
+
+    dataframe_schema: VariableOrOptional[str] = None
+    """
+    Schema of the resulting dataframe after transformations, in Spark StructType JSON format (from df.schema.json()).
+    Required if transformation_sql is specified.
+    Example: {"type":"struct","fields":[{"name":"col_a","type":"integer","nullable":true,"metadata":{}},{"name":"col_c","type":"integer","nullable":true,"metadata":{}}]}
+    """
+
+    filter_condition: VariableOrOptional[str] = None
+    """
+    Single WHERE clause to filter delta table before applying transformations. Will be row-wise evaluated, so should only include conditionals and projections.
+    """
+
+    transformation_sql: VariableOrOptional[str] = None
+    """
+    A single SQL SELECT expression applied after filter_condition.
+    Should contains all the columns needed (eg. "SELECT *, col_a + col_b AS col_c FROM x.y.z WHERE col_a > 0" would have `transformation_sql` "*, col_a + col_b AS col_c")
+    If transformation_sql is not provided, all columns of the delta table are present in the DataSource dataframe.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "DeltaTableSourceDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "DeltaTableSourceDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class DeltaTableSourceDict(TypedDict, total=False):
+    """"""
+
+    full_name: VariableOr[str]
+    """
+    The full three-part (catalog, schema, table) name of the Delta table.
+    """
+
+    dataframe_schema: VariableOrOptional[str]
+    """
+    Schema of the resulting dataframe after transformations, in Spark StructType JSON format (from df.schema.json()).
+    Required if transformation_sql is specified.
+    Example: {"type":"struct","fields":[{"name":"col_a","type":"integer","nullable":true,"metadata":{}},{"name":"col_c","type":"integer","nullable":true,"metadata":{}}]}
+    """
+
+    filter_condition: VariableOrOptional[str]
+    """
+    Single WHERE clause to filter delta table before applying transformations. Will be row-wise evaluated, so should only include conditionals and projections.
+    """
+
+    transformation_sql: VariableOrOptional[str]
+    """
+    A single SQL SELECT expression applied after filter_condition.
+    Should contains all the columns needed (eg. "SELECT *, col_a + col_b AS col_c FROM x.y.z WHERE col_a > 0" would have `transformation_sql` "*, col_a + col_b AS col_c")
+    If transformation_sql is not provided, all columns of the delta table are present in the DataSource dataframe.
+    """
+
+
+DeltaTableSourceParam = DeltaTableSourceDict | DeltaTableSource
diff --git a/python/databricks/bundles/features/_models/entity_column.py b/python/databricks/bundles/features/_models/entity_column.py
new file mode 100644
index 00000000000..d460e9ef4e2
--- /dev/null
+++ b/python/databricks/bundles/features/_models/entity_column.py
@@ -0,0 +1,50 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class EntityColumn:
+    """"""
+
+    name: VariableOr[str]
+    """
+    The name of the entity column. For Kafka sources, use dot-prefixed path notation to reference
+    fields within the key or value schema (e.g., "value.user_id", "key.partition_key"). For nested
+    fields, the leaf node name (e.g., "user_id" from "value.trip_details.user_id") is what will
+    be present in materialized tables and expected to match at query time.
+    Colon-prefixed notation (e.g., "value:user_id") is supported for backwards
+    compatibility but is deprecated; migrate to dot notation.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "EntityColumnDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "EntityColumnDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class EntityColumnDict(TypedDict, total=False):
+    """"""
+
+    name: VariableOr[str]
+    """
+    The name of the entity column. For Kafka sources, use dot-prefixed path notation to reference
+    fields within the key or value schema (e.g., "value.user_id", "key.partition_key"). For nested
+    fields, the leaf node name (e.g., "user_id" from "value.trip_details.user_id") is what will
+    be present in materialized tables and expected to match at query time.
+    Colon-prefixed notation (e.g., "value:user_id") is supported for backwards
+    compatibility but is deprecated; migrate to dot notation.
+    """
+
+
+EntityColumnParam = EntityColumnDict | EntityColumn
diff --git a/python/databricks/bundles/features/_models/feature.py b/python/databricks/bundles/features/_models/feature.py
new file mode 100644
index 00000000000..d00ed799f92
--- /dev/null
+++ b/python/databricks/bundles/features/_models/feature.py
@@ -0,0 +1,151 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._resource import Resource
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import (
+    VariableOr,
+    VariableOrList,
+    VariableOrOptional,
+)
+from databricks.bundles.features._models.data_source import (
+    DataSource,
+    DataSourceParam,
+)
+from databricks.bundles.features._models.entity_column import (
+    EntityColumn,
+    EntityColumnParam,
+)
+from databricks.bundles.features._models.function import (
+    Function,
+    FunctionParam,
+)
+from databricks.bundles.features._models.lifecycle import (
+    Lifecycle,
+    LifecycleParam,
+)
+from databricks.bundles.features._models.lineage_context import (
+    LineageContext,
+    LineageContextParam,
+)
+from databricks.bundles.features._models.timeseries_column import (
+    TimeseriesColumn,
+    TimeseriesColumnParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class Feature(Resource):
+    """"""
+
+    full_name: VariableOr[str]
+    """
+    The full three-part name (catalog, schema, name) of the feature.
+    """
+
+    function: VariableOr[Function]
+    """
+    The function by which the feature is computed.
+    """
+
+    source: VariableOr[DataSource]
+    """
+    The data source of the feature.
+    """
+
+    description: VariableOrOptional[str] = None
+    """
+    The description of the feature.
+    """
+
+    entities: VariableOrList[EntityColumn] = field(default_factory=list)
+    """
+    The entity columns for the feature, used as aggregation keys and for query-time lookup.
+    Optional since entities are not set for RequestSource features or on-demand calculated features.
+    """
+
+    lifecycle: VariableOrOptional[Lifecycle] = None
+
+    lineage_context: VariableOrOptional[LineageContext] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Lineage context information for this feature.
+    WARNING: This field is primarily intended for internal use by Databricks systems and
+    is automatically populated when features are created through Databricks notebooks or jobs.
+    Users should not manually set this field as incorrect values may lead to inaccurate lineage tracking or unexpected behavior.
+    This field will be set by feature-engineering client and should be left unset by SDK and terraform users.
+    """
+
+    timeseries_column: VariableOrOptional[TimeseriesColumn] = None
+    """
+    Column recording time, used for point-in-time joins, backfills, and aggregations.
+    Optional since a timeseries column is not set for RequestSource features or on-demand
+    calculated features.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "FeatureDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "FeatureDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class FeatureDict(TypedDict, total=False):
+    """"""
+
+    full_name: VariableOr[str]
+    """
+    The full three-part name (catalog, schema, name) of the feature.
+    """
+
+    function: VariableOr[FunctionParam]
+    """
+    The function by which the feature is computed.
+    """
+
+    source: VariableOr[DataSourceParam]
+    """
+    The data source of the feature.
+    """
+
+    description: VariableOrOptional[str]
+    """
+    The description of the feature.
+    """
+
+    entities: VariableOrList[EntityColumnParam]
+    """
+    The entity columns for the feature, used as aggregation keys and for query-time lookup.
+    Optional since entities are not set for RequestSource features or on-demand calculated features.
+    """
+
+    lifecycle: VariableOrOptional[LifecycleParam]
+
+    lineage_context: VariableOrOptional[LineageContextParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Lineage context information for this feature.
+    WARNING: This field is primarily intended for internal use by Databricks systems and
+    is automatically populated when features are created through Databricks notebooks or jobs.
+    Users should not manually set this field as incorrect values may lead to inaccurate lineage tracking or unexpected behavior.
+    This field will be set by feature-engineering client and should be left unset by SDK and terraform users.
+    """
+
+    timeseries_column: VariableOrOptional[TimeseriesColumnParam]
+    """
+    Column recording time, used for point-in-time joins, backfills, and aggregations.
+    Optional since a timeseries column is not set for RequestSource features or on-demand
+    calculated features.
+    """
+
+
+FeatureParam = FeatureDict | Feature
diff --git a/python/databricks/bundles/features/_models/feature_reference.py b/python/databricks/bundles/features/_models/feature_reference.py
new file mode 100644
index 00000000000..21decdf1547
--- /dev/null
+++ b/python/databricks/bundles/features/_models/feature_reference.py
@@ -0,0 +1,49 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class FeatureReference:
+    """
+    :meta private: [EXPERIMENTAL]
+
+    A reference to one registered upstream Feature. A message rather than a bare name so an
+    upstream can later be pinned more precisely (e.g. by version) without a breaking type change.
+    """
+
+    feature: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The three-part full name of the upstream Feature.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "FeatureReferenceDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "FeatureReferenceDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class FeatureReferenceDict(TypedDict, total=False):
+    """"""
+
+    feature: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The three-part full name of the upstream Feature.
+    """
+
+
+FeatureReferenceParam = FeatureReferenceDict | FeatureReference
diff --git a/python/databricks/bundles/features/_models/feature_view_source.py b/python/databricks/bundles/features/_models/feature_view_source.py
new file mode 100644
index 00000000000..bca40ffcafa
--- /dev/null
+++ b/python/databricks/bundles/features/_models/feature_view_source.py
@@ -0,0 +1,52 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList
+from databricks.bundles.features._models.feature_reference import (
+    FeatureReference,
+    FeatureReferenceParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class FeatureViewSource:
+    """
+    :meta private: [EXPERIMENTAL]
+
+    A data source composed from registered upstream Features.
+    """
+
+    feature_references: VariableOrList[FeatureReference] = field(default_factory=list)
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The upstream Features this source reads. Must include at least one feature.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "FeatureViewSourceDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "FeatureViewSourceDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class FeatureViewSourceDict(TypedDict, total=False):
+    """"""
+
+    feature_references: VariableOrList[FeatureReferenceParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The upstream Features this source reads. Must include at least one feature.
+    """
+
+
+FeatureViewSourceParam = FeatureViewSourceDict | FeatureViewSource
diff --git a/python/databricks/bundles/features/_models/field_definition.py b/python/databricks/bundles/features/_models/field_definition.py
new file mode 100644
index 00000000000..3087c757232
--- /dev/null
+++ b/python/databricks/bundles/features/_models/field_definition.py
@@ -0,0 +1,57 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+from databricks.bundles.features._models.scalar_data_type import (
+    ScalarDataType,
+    ScalarDataTypeParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class FieldDefinition:
+    """
+    A single field definition within a FlatSchema, specifying the field name and its scalar data type.
+    Does not support nested or complex types (arrays, maps, structs).
+    """
+
+    data_type: VariableOr[ScalarDataType]
+    """
+    The scalar data type of the field.
+    """
+
+    name: VariableOr[str]
+    """
+    The name of the field.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "FieldDefinitionDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "FieldDefinitionDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class FieldDefinitionDict(TypedDict, total=False):
+    """"""
+
+    data_type: VariableOr[ScalarDataTypeParam]
+    """
+    The scalar data type of the field.
+    """
+
+    name: VariableOr[str]
+    """
+    The name of the field.
+    """
+
+
+FieldDefinitionParam = FieldDefinitionDict | FieldDefinition
diff --git a/python/databricks/bundles/features/_models/first_distinct_function.py b/python/databricks/bundles/features/_models/first_distinct_function.py
new file mode 100644
index 00000000000..87d460fa228
--- /dev/null
+++ b/python/databricks/bundles/features/_models/first_distinct_function.py
@@ -0,0 +1,62 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class FirstDistinctFunction:
+    """
+    :meta private: [EXPERIMENTAL]
+
+    Returns the first N distinct values, ordered by the feature's timeseries column.
+    """
+
+    input: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The input column from which the first N distinct values are returned.
+    """
+
+    n: VariableOr[int]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The number of distinct values to return.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "FirstDistinctFunctionDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "FirstDistinctFunctionDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class FirstDistinctFunctionDict(TypedDict, total=False):
+    """"""
+
+    input: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The input column from which the first N distinct values are returned.
+    """
+
+    n: VariableOr[int]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The number of distinct values to return.
+    """
+
+
+FirstDistinctFunctionParam = FirstDistinctFunctionDict | FirstDistinctFunction
diff --git a/python/databricks/bundles/features/_models/first_function.py b/python/databricks/bundles/features/_models/first_function.py
new file mode 100644
index 00000000000..eb4ea4f1d2d
--- /dev/null
+++ b/python/databricks/bundles/features/_models/first_function.py
@@ -0,0 +1,42 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class FirstFunction:
+    """
+    Returns the first value.
+    """
+
+    input: VariableOr[str]
+    """
+    The input column from which the first value is returned.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "FirstFunctionDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "FirstFunctionDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class FirstFunctionDict(TypedDict, total=False):
+    """"""
+
+    input: VariableOr[str]
+    """
+    The input column from which the first value is returned.
+    """
+
+
+FirstFunctionParam = FirstFunctionDict | FirstFunction
diff --git a/python/databricks/bundles/features/_models/first_n_function.py b/python/databricks/bundles/features/_models/first_n_function.py
new file mode 100644
index 00000000000..3368c234f68
--- /dev/null
+++ b/python/databricks/bundles/features/_models/first_n_function.py
@@ -0,0 +1,62 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class FirstNFunction:
+    """
+    :meta private: [EXPERIMENTAL]
+
+    Returns the first N values, ordered by the feature's timeseries column.
+    """
+
+    input: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The input column from which the first N values are returned.
+    """
+
+    n: VariableOr[int]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The number of values to return.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "FirstNFunctionDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "FirstNFunctionDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class FirstNFunctionDict(TypedDict, total=False):
+    """"""
+
+    input: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The input column from which the first N values are returned.
+    """
+
+    n: VariableOr[int]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The number of values to return.
+    """
+
+
+FirstNFunctionParam = FirstNFunctionDict | FirstNFunction
diff --git a/python/databricks/bundles/features/_models/flat_schema.py b/python/databricks/bundles/features/_models/flat_schema.py
new file mode 100644
index 00000000000..0535274cc83
--- /dev/null
+++ b/python/databricks/bundles/features/_models/flat_schema.py
@@ -0,0 +1,47 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList
+from databricks.bundles.features._models.field_definition import (
+    FieldDefinition,
+    FieldDefinitionParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class FlatSchema:
+    """
+    A flat (non-nested) schema for request-time fields, defined as an ordered list of field definitions.
+    This schema only supports scalar types.
+    """
+
+    fields: VariableOrList[FieldDefinition] = field(default_factory=list)
+    """
+    The list of fields in this schema.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "FlatSchemaDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "FlatSchemaDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class FlatSchemaDict(TypedDict, total=False):
+    """"""
+
+    fields: VariableOrList[FieldDefinitionParam]
+    """
+    The list of fields in this schema.
+    """
+
+
+FlatSchemaParam = FlatSchemaDict | FlatSchema
diff --git a/python/databricks/bundles/features/_models/function.py b/python/databricks/bundles/features/_models/function.py
new file mode 100644
index 00000000000..c68a8cd0db2
--- /dev/null
+++ b/python/databricks/bundles/features/_models/function.py
@@ -0,0 +1,76 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.features._models.aggregation_function import (
+    AggregationFunction,
+    AggregationFunctionParam,
+)
+from databricks.bundles.features._models.column_selection import (
+    ColumnSelection,
+    ColumnSelectionParam,
+)
+from databricks.bundles.features._models.custom_udf import (
+    CustomUdf,
+    CustomUdfParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class Function:
+    """"""
+
+    aggregation_function: VariableOrOptional[AggregationFunction] = None
+    """
+    An aggregation function applied over a time window.
+    """
+
+    column_selection: VariableOrOptional[ColumnSelection] = None
+    """
+    Selects the latest value of a single column in a data source
+    """
+
+    custom_udf: VariableOrOptional[CustomUdf] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Applies a registered Unity Catalog function row-wise to source columns.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "FunctionDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "FunctionDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class FunctionDict(TypedDict, total=False):
+    """"""
+
+    aggregation_function: VariableOrOptional[AggregationFunctionParam]
+    """
+    An aggregation function applied over a time window.
+    """
+
+    column_selection: VariableOrOptional[ColumnSelectionParam]
+    """
+    Selects the latest value of a single column in a data source
+    """
+
+    custom_udf: VariableOrOptional[CustomUdfParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Applies a registered Unity Catalog function row-wise to source columns.
+    """
+
+
+FunctionParam = FunctionDict | Function
diff --git a/python/databricks/bundles/features/_models/input_binding.py b/python/databricks/bundles/features/_models/input_binding.py
new file mode 100644
index 00000000000..7ade8c9405e
--- /dev/null
+++ b/python/databricks/bundles/features/_models/input_binding.py
@@ -0,0 +1,62 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class InputBinding:
+    """
+    :meta private: [EXPERIMENTAL]
+
+    Binds a single UC function parameter to a source column.
+    """
+
+    column: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Source column whose value is passed for this parameter at execution time.
+    """
+
+    parameter: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Name of the UC function parameter.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "InputBindingDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "InputBindingDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class InputBindingDict(TypedDict, total=False):
+    """"""
+
+    column: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Source column whose value is passed for this parameter at execution time.
+    """
+
+    parameter: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Name of the UC function parameter.
+    """
+
+
+InputBindingParam = InputBindingDict | InputBinding
diff --git a/python/databricks/bundles/features/_models/job_context.py b/python/databricks/bundles/features/_models/job_context.py
new file mode 100644
index 00000000000..e2d70d0a0bf
--- /dev/null
+++ b/python/databricks/bundles/features/_models/job_context.py
@@ -0,0 +1,60 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class JobContext:
+    """
+    :meta private: [EXPERIMENTAL]
+    """
+
+    job_id: VariableOrOptional[int] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The job ID where this API invoked.
+    """
+
+    job_run_id: VariableOrOptional[int] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The job run ID where this API was invoked.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "JobContextDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "JobContextDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class JobContextDict(TypedDict, total=False):
+    """"""
+
+    job_id: VariableOrOptional[int]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The job ID where this API invoked.
+    """
+
+    job_run_id: VariableOrOptional[int]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The job run ID where this API was invoked.
+    """
+
+
+JobContextParam = JobContextDict | JobContext
diff --git a/python/databricks/bundles/features/_models/kafka_source.py b/python/databricks/bundles/features/_models/kafka_source.py
new file mode 100644
index 00000000000..a7142a7cacb
--- /dev/null
+++ b/python/databricks/bundles/features/_models/kafka_source.py
@@ -0,0 +1,50 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class KafkaSource:
+    """"""
+
+    name: VariableOr[str]
+    """
+    Name of the Kafka source, used to identify it. This is used to look up the corresponding KafkaConfig object. Can be distinct from topic name.
+    """
+
+    filter_condition: VariableOrOptional[str] = None
+    """
+    The filter condition applied to the source data before aggregation.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "KafkaSourceDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "KafkaSourceDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class KafkaSourceDict(TypedDict, total=False):
+    """"""
+
+    name: VariableOr[str]
+    """
+    Name of the Kafka source, used to identify it. This is used to look up the corresponding KafkaConfig object. Can be distinct from topic name.
+    """
+
+    filter_condition: VariableOrOptional[str]
+    """
+    The filter condition applied to the source data before aggregation.
+    """
+
+
+KafkaSourceParam = KafkaSourceDict | KafkaSource
diff --git a/python/databricks/bundles/features/_models/last_distinct_function.py b/python/databricks/bundles/features/_models/last_distinct_function.py
new file mode 100644
index 00000000000..f0ed97454a1
--- /dev/null
+++ b/python/databricks/bundles/features/_models/last_distinct_function.py
@@ -0,0 +1,62 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class LastDistinctFunction:
+    """
+    :meta private: [EXPERIMENTAL]
+
+    Returns the last N distinct values, ordered by the feature's timeseries column.
+    """
+
+    input: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The input column from which the last N distinct values are returned.
+    """
+
+    n: VariableOr[int]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The number of distinct values to return.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "LastDistinctFunctionDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "LastDistinctFunctionDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class LastDistinctFunctionDict(TypedDict, total=False):
+    """"""
+
+    input: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The input column from which the last N distinct values are returned.
+    """
+
+    n: VariableOr[int]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The number of distinct values to return.
+    """
+
+
+LastDistinctFunctionParam = LastDistinctFunctionDict | LastDistinctFunction
diff --git a/python/databricks/bundles/features/_models/last_function.py b/python/databricks/bundles/features/_models/last_function.py
new file mode 100644
index 00000000000..56cd70a231d
--- /dev/null
+++ b/python/databricks/bundles/features/_models/last_function.py
@@ -0,0 +1,42 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class LastFunction:
+    """
+    Returns the last value.
+    """
+
+    input: VariableOr[str]
+    """
+    The input column from which the last value is returned.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "LastFunctionDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "LastFunctionDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class LastFunctionDict(TypedDict, total=False):
+    """"""
+
+    input: VariableOr[str]
+    """
+    The input column from which the last value is returned.
+    """
+
+
+LastFunctionParam = LastFunctionDict | LastFunction
diff --git a/python/databricks/bundles/features/_models/last_n_function.py b/python/databricks/bundles/features/_models/last_n_function.py
new file mode 100644
index 00000000000..03131e3182f
--- /dev/null
+++ b/python/databricks/bundles/features/_models/last_n_function.py
@@ -0,0 +1,62 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class LastNFunction:
+    """
+    :meta private: [EXPERIMENTAL]
+
+    Returns the last N values, ordered by the feature's timeseries column.
+    """
+
+    input: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The input column from which the last N values are returned.
+    """
+
+    n: VariableOr[int]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The number of values to return.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "LastNFunctionDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "LastNFunctionDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class LastNFunctionDict(TypedDict, total=False):
+    """"""
+
+    input: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The input column from which the last N values are returned.
+    """
+
+    n: VariableOr[int]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The number of values to return.
+    """
+
+
+LastNFunctionParam = LastNFunctionDict | LastNFunction
diff --git a/python/databricks/bundles/features/_models/lifecycle.py b/python/databricks/bundles/features/_models/lifecycle.py
new file mode 100644
index 00000000000..697776a198e
--- /dev/null
+++ b/python/databricks/bundles/features/_models/lifecycle.py
@@ -0,0 +1,40 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class Lifecycle:
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool] = None
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "LifecycleDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "LifecycleDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class LifecycleDict(TypedDict, total=False):
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool]
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+
+LifecycleParam = LifecycleDict | Lifecycle
diff --git a/python/databricks/bundles/features/_models/lineage_context.py b/python/databricks/bundles/features/_models/lineage_context.py
new file mode 100644
index 00000000000..d11cb8082d6
--- /dev/null
+++ b/python/databricks/bundles/features/_models/lineage_context.py
@@ -0,0 +1,66 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.features._models.job_context import (
+    JobContext,
+    JobContextParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class LineageContext:
+    """
+    :meta private: [EXPERIMENTAL]
+
+    Lineage context information for tracking where an API was invoked. This will allow us to track lineage, which currently uses caller entity information for use across the Lineage Client and Observability in Lumberjack.
+    """
+
+    job_context: VariableOrOptional[JobContext] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Job context information including job ID and run ID.
+    """
+
+    notebook_id: VariableOrOptional[int] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The notebook ID where this API was invoked.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "LineageContextDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "LineageContextDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class LineageContextDict(TypedDict, total=False):
+    """"""
+
+    job_context: VariableOrOptional[JobContextParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Job context information including job ID and run ID.
+    """
+
+    notebook_id: VariableOrOptional[int]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The notebook ID where this API was invoked.
+    """
+
+
+LineageContextParam = LineageContextDict | LineageContext
diff --git a/python/databricks/bundles/features/_models/max_function.py b/python/databricks/bundles/features/_models/max_function.py
new file mode 100644
index 00000000000..dbc7c7f8f81
--- /dev/null
+++ b/python/databricks/bundles/features/_models/max_function.py
@@ -0,0 +1,42 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class MaxFunction:
+    """
+    Computes the maximum value.
+    """
+
+    input: VariableOr[str]
+    """
+    The input column from which the maximum is computed.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "MaxFunctionDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "MaxFunctionDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class MaxFunctionDict(TypedDict, total=False):
+    """"""
+
+    input: VariableOr[str]
+    """
+    The input column from which the maximum is computed.
+    """
+
+
+MaxFunctionParam = MaxFunctionDict | MaxFunction
diff --git a/python/databricks/bundles/features/_models/min_function.py b/python/databricks/bundles/features/_models/min_function.py
new file mode 100644
index 00000000000..17bebfdbc41
--- /dev/null
+++ b/python/databricks/bundles/features/_models/min_function.py
@@ -0,0 +1,42 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class MinFunction:
+    """
+    Computes the minimum value.
+    """
+
+    input: VariableOr[str]
+    """
+    The input column from which the minimum is computed.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "MinFunctionDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "MinFunctionDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class MinFunctionDict(TypedDict, total=False):
+    """"""
+
+    input: VariableOr[str]
+    """
+    The input column from which the minimum is computed.
+    """
+
+
+MinFunctionParam = MinFunctionDict | MinFunction
diff --git a/python/databricks/bundles/features/_models/request_source.py b/python/databricks/bundles/features/_models/request_source.py
new file mode 100644
index 00000000000..2ad0c4a0225
--- /dev/null
+++ b/python/databricks/bundles/features/_models/request_source.py
@@ -0,0 +1,59 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.features._models.flat_schema import FlatSchema, FlatSchemaParam
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class RequestSource:
+    """
+    A request-time data source whose value is provided at inference time: offline batch scoring or online serving endpoint
+    """
+
+    dataframe_schema: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] A schema containing scalar or nested fields, in Spark StructType JSON format
+    (from df.schema.json()). This preserves field, array-element, and map-value nullability.
+    """
+
+    flat_schema: VariableOrOptional[FlatSchema] = None
+    """
+    A flat schema with scalar-typed fields only.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "RequestSourceDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "RequestSourceDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class RequestSourceDict(TypedDict, total=False):
+    """"""
+
+    dataframe_schema: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] A schema containing scalar or nested fields, in Spark StructType JSON format
+    (from df.schema.json()). This preserves field, array-element, and map-value nullability.
+    """
+
+    flat_schema: VariableOrOptional[FlatSchemaParam]
+    """
+    A flat schema with scalar-typed fields only.
+    """
+
+
+RequestSourceParam = RequestSourceDict | RequestSource
diff --git a/python/databricks/bundles/features/_models/rolling_window.py b/python/databricks/bundles/features/_models/rolling_window.py
new file mode 100644
index 00000000000..9cbdd0b7c2f
--- /dev/null
+++ b/python/databricks/bundles/features/_models/rolling_window.py
@@ -0,0 +1,58 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class RollingWindow:
+    """
+    A rolling time window with an optional non-negative delay.
+    """
+
+    delay: VariableOrOptional[str] = None
+    """
+    Non-negative analytic lag that evaluates the window this far in the past. Use this for timing
+    variations unrelated to source lateness, such as a 30-day count as of one week ago. If unset,
+    the analytic lag is zero. It composes with source.lateness when both are set.
+    """
+
+    window_duration: VariableOrOptional[str] = None
+    """
+    The duration of the rolling window. Must be positive when set; absent means lifetime
+    (aggregate over the entity's entire history).
+    """
+
+    @classmethod
+    def from_dict(cls, value: "RollingWindowDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "RollingWindowDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class RollingWindowDict(TypedDict, total=False):
+    """"""
+
+    delay: VariableOrOptional[str]
+    """
+    Non-negative analytic lag that evaluates the window this far in the past. Use this for timing
+    variations unrelated to source lateness, such as a 30-day count as of one week ago. If unset,
+    the analytic lag is zero. It composes with source.lateness when both are set.
+    """
+
+    window_duration: VariableOrOptional[str]
+    """
+    The duration of the rolling window. Must be positive when set; absent means lifetime
+    (aggregate over the entity's entire history).
+    """
+
+
+RollingWindowParam = RollingWindowDict | RollingWindow
diff --git a/python/databricks/bundles/features/_models/sawtooth_window.py b/python/databricks/bundles/features/_models/sawtooth_window.py
new file mode 100644
index 00000000000..303ab073d46
--- /dev/null
+++ b/python/databricks/bundles/features/_models/sawtooth_window.py
@@ -0,0 +1,72 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class SawtoothWindow:
+    """
+    :meta private: [EXPERIMENTAL]
+
+    A sawtooth window served via the hybrid batch + streaming path. The batch pipeline maintains
+    daily partial aggregates for the bulk of the window while the streaming pipeline maintains the
+    most recent day(s), and serving merges them on read. Same field shape as RollingWindow, but a
+    distinct type so the control plane can explicitly identify hybrid (sawtooth) features rather
+    than inferring hybrid behavior from window_duration.
+    """
+
+    delay: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Delay is not currently supported for Sawtooth windows.
+    """
+
+    window_duration: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The duration of the window. Must be positive and span more than two days when set, so that both
+    the batch (N-1 day) and stale-path (N-2 day) partial aggregates are well defined. The duration
+    need not be a whole number of days (e.g. 3 days 15 minutes is allowed). Absent means lifetime
+    (aggregate over the entity's entire history).
+    """
+
+    @classmethod
+    def from_dict(cls, value: "SawtoothWindowDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "SawtoothWindowDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class SawtoothWindowDict(TypedDict, total=False):
+    """"""
+
+    delay: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Delay is not currently supported for Sawtooth windows.
+    """
+
+    window_duration: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The duration of the window. Must be positive and span more than two days when set, so that both
+    the batch (N-1 day) and stale-path (N-2 day) partial aggregates are well defined. The duration
+    need not be a whole number of days (e.g. 3 days 15 minutes is allowed). Absent means lifetime
+    (aggregate over the entity's entire history).
+    """
+
+
+SawtoothWindowParam = SawtoothWindowDict | SawtoothWindow
diff --git a/python/databricks/bundles/features/_models/scalar_data_type.py b/python/databricks/bundles/features/_models/scalar_data_type.py
new file mode 100644
index 00000000000..5c115502b0a
--- /dev/null
+++ b/python/databricks/bundles/features/_models/scalar_data_type.py
@@ -0,0 +1,41 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class ScalarDataType(Enum):
+    """
+    Scalar data types for request-time field definitions.
+    Only flat (non-nested) types are supported.
+    """
+
+    INTEGER = "INTEGER"
+    FLOAT = "FLOAT"
+    BOOLEAN = "BOOLEAN"
+    STRING = "STRING"
+    DOUBLE = "DOUBLE"
+    LONG = "LONG"
+    TIMESTAMP = "TIMESTAMP"
+    DATE = "DATE"
+    SHORT = "SHORT"
+    BINARY = "BINARY"
+    DECIMAL = "DECIMAL"
+
+
+ScalarDataTypeParam = (
+    Literal[
+        "INTEGER",
+        "FLOAT",
+        "BOOLEAN",
+        "STRING",
+        "DOUBLE",
+        "LONG",
+        "TIMESTAMP",
+        "DATE",
+        "SHORT",
+        "BINARY",
+        "DECIMAL",
+    ]
+    | ScalarDataType
+)
diff --git a/python/databricks/bundles/features/_models/sliding_window.py b/python/databricks/bundles/features/_models/sliding_window.py
new file mode 100644
index 00000000000..cdf67ed2af0
--- /dev/null
+++ b/python/databricks/bundles/features/_models/sliding_window.py
@@ -0,0 +1,90 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class SlidingWindow:
+    """"""
+
+    slide_duration: VariableOr[str]
+    """
+    The slide duration (interval by which windows advance, must be positive and less than duration).
+    """
+
+    delay: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Non-negative analytic lag that evaluates the window this far in the past. Use this for timing
+    variations unrelated to source lateness, such as a 30-day count as of one week ago. If unset,
+    the analytic lag is zero. It composes with source.lateness when both are set.
+    """
+
+    offset: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Non-negative phase shift from the default midnight UTC alignment. For example, offset=22h on
+    a 24h slide produces boundaries at 22:00 UTC (17:00 New York in standard time) instead of
+    midnight UTC. If unset, the offset is zero. Must be shorter than slide_duration (and therefore
+    window_duration).
+    """
+
+    window_duration: VariableOrOptional[str] = None
+    """
+    The duration of the sliding window. Must be positive when set; absent means lifetime
+    (aggregate over the entity's entire history).
+    """
+
+    @classmethod
+    def from_dict(cls, value: "SlidingWindowDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "SlidingWindowDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class SlidingWindowDict(TypedDict, total=False):
+    """"""
+
+    slide_duration: VariableOr[str]
+    """
+    The slide duration (interval by which windows advance, must be positive and less than duration).
+    """
+
+    delay: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Non-negative analytic lag that evaluates the window this far in the past. Use this for timing
+    variations unrelated to source lateness, such as a 30-day count as of one week ago. If unset,
+    the analytic lag is zero. It composes with source.lateness when both are set.
+    """
+
+    offset: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Non-negative phase shift from the default midnight UTC alignment. For example, offset=22h on
+    a 24h slide produces boundaries at 22:00 UTC (17:00 New York in standard time) instead of
+    midnight UTC. If unset, the offset is zero. Must be shorter than slide_duration (and therefore
+    window_duration).
+    """
+
+    window_duration: VariableOrOptional[str]
+    """
+    The duration of the sliding window. Must be positive when set; absent means lifetime
+    (aggregate over the entity's entire history).
+    """
+
+
+SlidingWindowParam = SlidingWindowDict | SlidingWindow
diff --git a/python/databricks/bundles/features/_models/source_lateness.py b/python/databricks/bundles/features/_models/source_lateness.py
new file mode 100644
index 00000000000..757eac320e8
--- /dev/null
+++ b/python/databricks/bundles/features/_models/source_lateness.py
@@ -0,0 +1,54 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class SourceLateness:
+    """
+    :meta private: [EXPERIMENTAL]
+
+    Configures when event-time data from this source is considered complete for a Feature.
+    """
+
+    settling_delay: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Non-negative time to wait after a window ends before treating its source data as complete.
+    Training shifts the eligible evaluation time backwards by this duration so it does not join
+    data that would still have been settling online. Materialization waits for the duration to
+    elapse before publishing the window. If unset, source data is considered settled immediately.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "SourceLatenessDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "SourceLatenessDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class SourceLatenessDict(TypedDict, total=False):
+    """"""
+
+    settling_delay: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Non-negative time to wait after a window ends before treating its source data as complete.
+    Training shifts the eligible evaluation time backwards by this duration so it does not join
+    data that would still have been settling online. Materialization waits for the duration to
+    elapse before publishing the window. If unset, source data is considered settled immediately.
+    """
+
+
+SourceLatenessParam = SourceLatenessDict | SourceLateness
diff --git a/python/databricks/bundles/features/_models/stddev_pop_function.py b/python/databricks/bundles/features/_models/stddev_pop_function.py
new file mode 100644
index 00000000000..edd63b11b93
--- /dev/null
+++ b/python/databricks/bundles/features/_models/stddev_pop_function.py
@@ -0,0 +1,48 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class StddevPopFunction:
+    """
+    Computes the population standard deviation.
+    """
+
+    input: VariableOr[str]
+    """
+    The input column from which the population standard deviation is computed. For Kafka sources,
+    use dot-prefixed path notation (e.g., "value.amount"). For nested fields, the leaf node name is used.
+    Colon-prefixed notation (e.g., "value:amount") is supported for backwards
+    compatibility but is deprecated; migrate to dot notation.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "StddevPopFunctionDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "StddevPopFunctionDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class StddevPopFunctionDict(TypedDict, total=False):
+    """"""
+
+    input: VariableOr[str]
+    """
+    The input column from which the population standard deviation is computed. For Kafka sources,
+    use dot-prefixed path notation (e.g., "value.amount"). For nested fields, the leaf node name is used.
+    Colon-prefixed notation (e.g., "value:amount") is supported for backwards
+    compatibility but is deprecated; migrate to dot notation.
+    """
+
+
+StddevPopFunctionParam = StddevPopFunctionDict | StddevPopFunction
diff --git a/python/databricks/bundles/features/_models/stddev_samp_function.py b/python/databricks/bundles/features/_models/stddev_samp_function.py
new file mode 100644
index 00000000000..ca253c92315
--- /dev/null
+++ b/python/databricks/bundles/features/_models/stddev_samp_function.py
@@ -0,0 +1,42 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class StddevSampFunction:
+    """
+    Computes the sample standard deviation.
+    """
+
+    input: VariableOr[str]
+    """
+    The input column from which the sample standard deviation is computed.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "StddevSampFunctionDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "StddevSampFunctionDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class StddevSampFunctionDict(TypedDict, total=False):
+    """"""
+
+    input: VariableOr[str]
+    """
+    The input column from which the sample standard deviation is computed.
+    """
+
+
+StddevSampFunctionParam = StddevSampFunctionDict | StddevSampFunction
diff --git a/python/databricks/bundles/features/_models/stream_source.py b/python/databricks/bundles/features/_models/stream_source.py
new file mode 100644
index 00000000000..7b591576426
--- /dev/null
+++ b/python/databricks/bundles/features/_models/stream_source.py
@@ -0,0 +1,86 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class StreamSource:
+    """
+    A Stream entity used as a data source for a feature.
+    """
+
+    full_name: VariableOr[str]
+    """
+    Three-part full name of the Stream (catalog.schema.stream).
+    """
+
+    dataframe_schema: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Schema of the resulting dataframe after transformations, in Spark StructType
+    JSON format (from df.schema.json()).
+    Any subsequent functions operate against this dataframe.
+    """
+
+    filter_condition: VariableOrOptional[str] = None
+    """
+    The filter condition applied to the source data before aggregation.
+    """
+
+    transformation_sql: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The pipeline runs these SQL statements immediately after conversion into
+    the schema specified on the Stream object.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "StreamSourceDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "StreamSourceDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class StreamSourceDict(TypedDict, total=False):
+    """"""
+
+    full_name: VariableOr[str]
+    """
+    Three-part full name of the Stream (catalog.schema.stream).
+    """
+
+    dataframe_schema: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Schema of the resulting dataframe after transformations, in Spark StructType
+    JSON format (from df.schema.json()).
+    Any subsequent functions operate against this dataframe.
+    """
+
+    filter_condition: VariableOrOptional[str]
+    """
+    The filter condition applied to the source data before aggregation.
+    """
+
+    transformation_sql: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The pipeline runs these SQL statements immediately after conversion into
+    the schema specified on the Stream object.
+    """
+
+
+StreamSourceParam = StreamSourceDict | StreamSource
diff --git a/python/databricks/bundles/features/_models/sum_function.py b/python/databricks/bundles/features/_models/sum_function.py
new file mode 100644
index 00000000000..f74c3e8a6ac
--- /dev/null
+++ b/python/databricks/bundles/features/_models/sum_function.py
@@ -0,0 +1,48 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class SumFunction:
+    """
+    Computes the sum of values.
+    """
+
+    input: VariableOr[str]
+    """
+    The input column from which the sum is computed. For Kafka sources, use dot-prefixed path
+    notation (e.g., "value.amount"). For nested fields, the leaf node name is used.
+    Colon-prefixed notation (e.g., "value:amount") is supported for backwards
+    compatibility but is deprecated; migrate to dot notation.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "SumFunctionDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "SumFunctionDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class SumFunctionDict(TypedDict, total=False):
+    """"""
+
+    input: VariableOr[str]
+    """
+    The input column from which the sum is computed. For Kafka sources, use dot-prefixed path
+    notation (e.g., "value.amount"). For nested fields, the leaf node name is used.
+    Colon-prefixed notation (e.g., "value:amount") is supported for backwards
+    compatibility but is deprecated; migrate to dot notation.
+    """
+
+
+SumFunctionParam = SumFunctionDict | SumFunction
diff --git a/python/databricks/bundles/features/_models/time_window.py b/python/databricks/bundles/features/_models/time_window.py
new file mode 100644
index 00000000000..85bd6a488dd
--- /dev/null
+++ b/python/databricks/bundles/features/_models/time_window.py
@@ -0,0 +1,106 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.features._models.rolling_window import (
+    RollingWindow,
+    RollingWindowParam,
+)
+from databricks.bundles.features._models.sawtooth_window import (
+    SawtoothWindow,
+    SawtoothWindowParam,
+)
+from databricks.bundles.features._models.sliding_window import (
+    SlidingWindow,
+    SlidingWindowParam,
+)
+from databricks.bundles.features._models.tumbling_window import (
+    TumblingWindow,
+    TumblingWindowParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class TimeWindow:
+    """"""
+
+    rolling: VariableOrOptional[RollingWindow] = None
+    """
+    A rolling time window with an optional non-negative delay.
+    """
+
+    sawtooth: VariableOrOptional[SawtoothWindow] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] A sawtooth window served via the hybrid batch + streaming path.
+    """
+
+    sliding: VariableOrOptional[SlidingWindow] = None
+
+    start_time: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Earliest event-time boundary at which the Feature may emit an output. This gates outputs, not
+    the historical inputs read by a window. For example, a 365-day window with
+    start_time=2026-01-01 begins emitting partial-window values on that date instead of waiting
+    for 365 days of data; a lifetime window produces no output before start_time. If unset,
+    tumbling and fixed-duration sliding windows first emit at an offset-aligned boundary after a
+    full window can be formed. If unset, lifetime sliding windows and rolling windows emit as soon as
+    eligible source data exists.
+    Not currently supported for sawtooth windows or for Features with a stream source.
+    """
+
+    tumbling: VariableOrOptional[TumblingWindow] = None
+
+    @classmethod
+    def from_dict(cls, value: "TimeWindowDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "TimeWindowDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class TimeWindowDict(TypedDict, total=False):
+    """"""
+
+    rolling: VariableOrOptional[RollingWindowParam]
+    """
+    A rolling time window with an optional non-negative delay.
+    """
+
+    sawtooth: VariableOrOptional[SawtoothWindowParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] A sawtooth window served via the hybrid batch + streaming path.
+    """
+
+    sliding: VariableOrOptional[SlidingWindowParam]
+
+    start_time: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Earliest event-time boundary at which the Feature may emit an output. This gates outputs, not
+    the historical inputs read by a window. For example, a 365-day window with
+    start_time=2026-01-01 begins emitting partial-window values on that date instead of waiting
+    for 365 days of data; a lifetime window produces no output before start_time. If unset,
+    tumbling and fixed-duration sliding windows first emit at an offset-aligned boundary after a
+    full window can be formed. If unset, lifetime sliding windows and rolling windows emit as soon as
+    eligible source data exists.
+    Not currently supported for sawtooth windows or for Features with a stream source.
+    """
+
+    tumbling: VariableOrOptional[TumblingWindowParam]
+
+
+TimeWindowParam = TimeWindowDict | TimeWindow
diff --git a/python/databricks/bundles/features/_models/timeseries_column.py b/python/databricks/bundles/features/_models/timeseries_column.py
new file mode 100644
index 00000000000..be19cf7dad0
--- /dev/null
+++ b/python/databricks/bundles/features/_models/timeseries_column.py
@@ -0,0 +1,50 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class TimeseriesColumn:
+    """"""
+
+    name: VariableOr[str]
+    """
+    The name of the timeseries column. For Kafka sources, use dot-prefixed path notation to
+    reference fields within the key or value schema (e.g., "value.event_timestamp"). For nested
+    fields, the leaf node name (e.g., "event_timestamp" from "value.event_details.event_timestamp")
+    is what will be present in materialized tables and expected to match at query time.
+    Colon-prefixed notation (e.g., "value:event_timestamp") is supported for
+    backwards compatibility but is deprecated; migrate to dot notation.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "TimeseriesColumnDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "TimeseriesColumnDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class TimeseriesColumnDict(TypedDict, total=False):
+    """"""
+
+    name: VariableOr[str]
+    """
+    The name of the timeseries column. For Kafka sources, use dot-prefixed path notation to
+    reference fields within the key or value schema (e.g., "value.event_timestamp"). For nested
+    fields, the leaf node name (e.g., "event_timestamp" from "value.event_details.event_timestamp")
+    is what will be present in materialized tables and expected to match at query time.
+    Colon-prefixed notation (e.g., "value:event_timestamp") is supported for
+    backwards compatibility but is deprecated; migrate to dot notation.
+    """
+
+
+TimeseriesColumnParam = TimeseriesColumnDict | TimeseriesColumn
diff --git a/python/databricks/bundles/features/_models/tumbling_window.py b/python/databricks/bundles/features/_models/tumbling_window.py
new file mode 100644
index 00000000000..38a873fa5cd
--- /dev/null
+++ b/python/databricks/bundles/features/_models/tumbling_window.py
@@ -0,0 +1,76 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class TumblingWindow:
+    """"""
+
+    window_duration: VariableOr[str]
+    """
+    The duration of each tumbling window (non-overlapping, fixed-duration windows).
+    """
+
+    delay: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Non-negative analytic lag that evaluates the window this far in the past. Use this for timing
+    variations unrelated to source lateness, such as a 30-day count as of one week ago. If unset,
+    the analytic lag is zero. It composes with source.lateness when both are set.
+    """
+
+    offset: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Non-negative phase shift from the default midnight UTC alignment. For example, offset=22h on
+    a 24h window produces boundaries at 22:00 UTC (17:00 New York in standard time) instead of
+    midnight UTC. If unset, the offset is zero. Must be shorter than window_duration.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "TumblingWindowDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "TumblingWindowDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class TumblingWindowDict(TypedDict, total=False):
+    """"""
+
+    window_duration: VariableOr[str]
+    """
+    The duration of each tumbling window (non-overlapping, fixed-duration windows).
+    """
+
+    delay: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Non-negative analytic lag that evaluates the window this far in the past. Use this for timing
+    variations unrelated to source lateness, such as a 30-day count as of one week ago. If unset,
+    the analytic lag is zero. It composes with source.lateness when both are set.
+    """
+
+    offset: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Non-negative phase shift from the default midnight UTC alignment. For example, offset=22h on
+    a 24h window produces boundaries at 22:00 UTC (17:00 New York in standard time) instead of
+    midnight UTC. If unset, the offset is zero. Must be shorter than window_duration.
+    """
+
+
+TumblingWindowParam = TumblingWindowDict | TumblingWindow
diff --git a/python/databricks/bundles/features/_models/var_pop_function.py b/python/databricks/bundles/features/_models/var_pop_function.py
new file mode 100644
index 00000000000..79b6dc5f425
--- /dev/null
+++ b/python/databricks/bundles/features/_models/var_pop_function.py
@@ -0,0 +1,42 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class VarPopFunction:
+    """
+    Computes the population variance.
+    """
+
+    input: VariableOr[str]
+    """
+    The input column from which the population variance is computed.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "VarPopFunctionDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "VarPopFunctionDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class VarPopFunctionDict(TypedDict, total=False):
+    """"""
+
+    input: VariableOr[str]
+    """
+    The input column from which the population variance is computed.
+    """
+
+
+VarPopFunctionParam = VarPopFunctionDict | VarPopFunction
diff --git a/python/databricks/bundles/features/_models/var_samp_function.py b/python/databricks/bundles/features/_models/var_samp_function.py
new file mode 100644
index 00000000000..8f0ee87ce77
--- /dev/null
+++ b/python/databricks/bundles/features/_models/var_samp_function.py
@@ -0,0 +1,42 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class VarSampFunction:
+    """
+    Computes the sample variance.
+    """
+
+    input: VariableOr[str]
+    """
+    The input column from which the sample variance is computed.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "VarSampFunctionDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "VarSampFunctionDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class VarSampFunctionDict(TypedDict, total=False):
+    """"""
+
+    input: VariableOr[str]
+    """
+    The input column from which the sample variance is computed.
+    """
+
+
+VarSampFunctionParam = VarSampFunctionDict | VarSampFunction
diff --git a/python/databricks/bundles/genie_spaces/__init__.py b/python/databricks/bundles/genie_spaces/__init__.py
new file mode 100644
index 00000000000..a56af37c716
--- /dev/null
+++ b/python/databricks/bundles/genie_spaces/__init__.py
@@ -0,0 +1,36 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+__all__ = [
+    "GenieSpace",
+    "GenieSpaceDict",
+    "GenieSpaceParam",
+    "Lifecycle",
+    "LifecycleDict",
+    "LifecycleParam",
+    "Permission",
+    "PermissionDict",
+    "PermissionLevel",
+    "PermissionLevelParam",
+    "PermissionParam",
+]
+
+
+from databricks.bundles.genie_spaces._models.genie_space import (
+    GenieSpace,
+    GenieSpaceDict,
+    GenieSpaceParam,
+)
+from databricks.bundles.genie_spaces._models.lifecycle import (
+    Lifecycle,
+    LifecycleDict,
+    LifecycleParam,
+)
+from databricks.bundles.genie_spaces._models.permission import (
+    Permission,
+    PermissionDict,
+    PermissionParam,
+)
+from databricks.bundles.genie_spaces._models.permission_level import (
+    PermissionLevel,
+    PermissionLevelParam,
+)
diff --git a/python/databricks/bundles/genie_spaces/_models/genie_space.py b/python/databricks/bundles/genie_spaces/_models/genie_space.py
new file mode 100644
index 00000000000..bb1ec94c8df
--- /dev/null
+++ b/python/databricks/bundles/genie_spaces/_models/genie_space.py
@@ -0,0 +1,120 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, Any, TypedDict
+
+from databricks.bundles.core._resource import Resource
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
+from databricks.bundles.genie_spaces._models.lifecycle import Lifecycle, LifecycleParam
+from databricks.bundles.genie_spaces._models.permission import (
+    Permission,
+    PermissionParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class GenieSpace(Resource):
+    """"""
+
+    description: VariableOrOptional[str] = None
+    """
+    Description of the Genie space shown alongside the title in the Databricks UI.
+    """
+
+    etag: VariableOrOptional[str] = None
+
+    file_path: VariableOrOptional[str] = None
+    """
+    Local path to a `.geniespace.json` file holding the serialized Genie space definition. The contents are inlined into `serialized_space` at deploy time. Mutually exclusive with an inline `serialized_space`.
+    """
+
+    lifecycle: VariableOrOptional[Lifecycle] = None
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+    parent_path: VariableOrOptional[str] = None
+    """
+    Workspace folder under which to create the Genie space. Immutable: changing this field recreates the resource.
+    """
+
+    permissions: VariableOrList[Permission] = field(default_factory=list)
+    """
+    The permissions to apply to this resource.
+    """
+
+    serialized_space: VariableOrOptional[Any] = None
+    """
+    Serialized Genie space body. May be provided inline as a JSON string (or YAML that will be marshalled to JSON) or referenced via `file_path`. To round-trip an existing space into a bundle, use `databricks bundle generate genie-space`.
+    """
+
+    title: VariableOrOptional[str] = None
+    """
+    Title of the Genie space shown in the Databricks UI.
+    """
+
+    warehouse_id: VariableOrOptional[str] = None
+    """
+    ID of the SQL warehouse used to run queries for this Genie space.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "GenieSpaceDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "GenieSpaceDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class GenieSpaceDict(TypedDict, total=False):
+    """"""
+
+    description: VariableOrOptional[str]
+    """
+    Description of the Genie space shown alongside the title in the Databricks UI.
+    """
+
+    etag: VariableOrOptional[str]
+
+    file_path: VariableOrOptional[str]
+    """
+    Local path to a `.geniespace.json` file holding the serialized Genie space definition. The contents are inlined into `serialized_space` at deploy time. Mutually exclusive with an inline `serialized_space`.
+    """
+
+    lifecycle: VariableOrOptional[LifecycleParam]
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+    parent_path: VariableOrOptional[str]
+    """
+    Workspace folder under which to create the Genie space. Immutable: changing this field recreates the resource.
+    """
+
+    permissions: VariableOrList[PermissionParam]
+    """
+    The permissions to apply to this resource.
+    """
+
+    serialized_space: VariableOrOptional[Any]
+    """
+    Serialized Genie space body. May be provided inline as a JSON string (or YAML that will be marshalled to JSON) or referenced via `file_path`. To round-trip an existing space into a bundle, use `databricks bundle generate genie-space`.
+    """
+
+    title: VariableOrOptional[str]
+    """
+    Title of the Genie space shown in the Databricks UI.
+    """
+
+    warehouse_id: VariableOrOptional[str]
+    """
+    ID of the SQL warehouse used to run queries for this Genie space.
+    """
+
+
+GenieSpaceParam = GenieSpaceDict | GenieSpace
diff --git a/python/databricks/bundles/genie_spaces/_models/lifecycle.py b/python/databricks/bundles/genie_spaces/_models/lifecycle.py
new file mode 100644
index 00000000000..697776a198e
--- /dev/null
+++ b/python/databricks/bundles/genie_spaces/_models/lifecycle.py
@@ -0,0 +1,40 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class Lifecycle:
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool] = None
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "LifecycleDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "LifecycleDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class LifecycleDict(TypedDict, total=False):
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool]
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+
+LifecycleParam = LifecycleDict | Lifecycle
diff --git a/python/databricks/bundles/genie_spaces/_models/permission.py b/python/databricks/bundles/genie_spaces/_models/permission.py
new file mode 100644
index 00000000000..372f063d547
--- /dev/null
+++ b/python/databricks/bundles/genie_spaces/_models/permission.py
@@ -0,0 +1,74 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+from databricks.bundles.genie_spaces._models.permission_level import (
+    PermissionLevel,
+    PermissionLevelParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class Permission:
+    """"""
+
+    level: VariableOr[PermissionLevel]
+    """
+    The permission level to apply. The allowed levels depend on the resource type.
+    """
+
+    group_name: VariableOrOptional[str] = None
+    """
+    The name of the group granted the permission level.
+    """
+
+    service_principal_name: VariableOrOptional[str] = None
+    """
+    The name of the service principal granted the permission level.
+    """
+
+    user_name: VariableOrOptional[str] = None
+    """
+    The name of the user granted the permission level.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "PermissionDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "PermissionDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class PermissionDict(TypedDict, total=False):
+    """"""
+
+    level: VariableOr[PermissionLevelParam]
+    """
+    The permission level to apply. The allowed levels depend on the resource type.
+    """
+
+    group_name: VariableOrOptional[str]
+    """
+    The name of the group granted the permission level.
+    """
+
+    service_principal_name: VariableOrOptional[str]
+    """
+    The name of the service principal granted the permission level.
+    """
+
+    user_name: VariableOrOptional[str]
+    """
+    The name of the user granted the permission level.
+    """
+
+
+PermissionParam = PermissionDict | Permission
diff --git a/python/databricks/bundles/genie_spaces/_models/permission_level.py b/python/databricks/bundles/genie_spaces/_models/permission_level.py
new file mode 100644
index 00000000000..c6111911b29
--- /dev/null
+++ b/python/databricks/bundles/genie_spaces/_models/permission_level.py
@@ -0,0 +1,58 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class PermissionLevel(Enum):
+    """
+    Permission level
+    """
+
+    CAN_MANAGE = "CAN_MANAGE"
+    CAN_RESTART = "CAN_RESTART"
+    CAN_ATTACH_TO = "CAN_ATTACH_TO"
+    IS_OWNER = "IS_OWNER"
+    CAN_MANAGE_RUN = "CAN_MANAGE_RUN"
+    CAN_VIEW = "CAN_VIEW"
+    CAN_READ = "CAN_READ"
+    CAN_RUN = "CAN_RUN"
+    CAN_EDIT = "CAN_EDIT"
+    CAN_USE = "CAN_USE"
+    CAN_MANAGE_STAGING_VERSIONS = "CAN_MANAGE_STAGING_VERSIONS"
+    CAN_MANAGE_PRODUCTION_VERSIONS = "CAN_MANAGE_PRODUCTION_VERSIONS"
+    CAN_EDIT_METADATA = "CAN_EDIT_METADATA"
+    CAN_VIEW_METADATA = "CAN_VIEW_METADATA"
+    CAN_BIND = "CAN_BIND"
+    CAN_QUERY = "CAN_QUERY"
+    CAN_MONITOR = "CAN_MONITOR"
+    CAN_CREATE = "CAN_CREATE"
+    CAN_MONITOR_ONLY = "CAN_MONITOR_ONLY"
+    CAN_CREATE_APP = "CAN_CREATE_APP"
+
+
+PermissionLevelParam = (
+    Literal[
+        "CAN_MANAGE",
+        "CAN_RESTART",
+        "CAN_ATTACH_TO",
+        "IS_OWNER",
+        "CAN_MANAGE_RUN",
+        "CAN_VIEW",
+        "CAN_READ",
+        "CAN_RUN",
+        "CAN_EDIT",
+        "CAN_USE",
+        "CAN_MANAGE_STAGING_VERSIONS",
+        "CAN_MANAGE_PRODUCTION_VERSIONS",
+        "CAN_EDIT_METADATA",
+        "CAN_VIEW_METADATA",
+        "CAN_BIND",
+        "CAN_QUERY",
+        "CAN_MONITOR",
+        "CAN_CREATE",
+        "CAN_MONITOR_ONLY",
+        "CAN_CREATE_APP",
+    ]
+    | PermissionLevel
+)
diff --git a/python/databricks/bundles/instance_pools/__init__.py b/python/databricks/bundles/instance_pools/__init__.py
new file mode 100644
index 00000000000..2c5a0e1c4eb
--- /dev/null
+++ b/python/databricks/bundles/instance_pools/__init__.py
@@ -0,0 +1,130 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+__all__ = [
+    "DiskSpec",
+    "DiskSpecDict",
+    "DiskSpecParam",
+    "DiskType",
+    "DiskTypeAzureDiskVolumeType",
+    "DiskTypeAzureDiskVolumeTypeParam",
+    "DiskTypeDict",
+    "DiskTypeEbsVolumeType",
+    "DiskTypeEbsVolumeTypeParam",
+    "DiskTypeParam",
+    "DockerBasicAuth",
+    "DockerBasicAuthDict",
+    "DockerBasicAuthParam",
+    "DockerImage",
+    "DockerImageDict",
+    "DockerImageParam",
+    "GcpAvailability",
+    "GcpAvailabilityParam",
+    "InstancePool",
+    "InstancePoolAwsAttributes",
+    "InstancePoolAwsAttributesAvailability",
+    "InstancePoolAwsAttributesAvailabilityParam",
+    "InstancePoolAwsAttributesDict",
+    "InstancePoolAwsAttributesParam",
+    "InstancePoolAzureAttributes",
+    "InstancePoolAzureAttributesAvailability",
+    "InstancePoolAzureAttributesAvailabilityParam",
+    "InstancePoolAzureAttributesDict",
+    "InstancePoolAzureAttributesParam",
+    "InstancePoolDict",
+    "InstancePoolGcpAttributes",
+    "InstancePoolGcpAttributesDict",
+    "InstancePoolGcpAttributesParam",
+    "InstancePoolParam",
+    "InstancePoolPermission",
+    "InstancePoolPermissionDict",
+    "InstancePoolPermissionLevel",
+    "InstancePoolPermissionLevelParam",
+    "InstancePoolPermissionParam",
+    "Lifecycle",
+    "LifecycleDict",
+    "LifecycleParam",
+    "NodeTypeFlexibility",
+    "NodeTypeFlexibilityDict",
+    "NodeTypeFlexibilityParam",
+]
+
+
+from databricks.bundles.instance_pools._models.disk_spec import (
+    DiskSpec,
+    DiskSpecDict,
+    DiskSpecParam,
+)
+from databricks.bundles.instance_pools._models.disk_type import (
+    DiskType,
+    DiskTypeDict,
+    DiskTypeParam,
+)
+from databricks.bundles.instance_pools._models.disk_type_azure_disk_volume_type import (
+    DiskTypeAzureDiskVolumeType,
+    DiskTypeAzureDiskVolumeTypeParam,
+)
+from databricks.bundles.instance_pools._models.disk_type_ebs_volume_type import (
+    DiskTypeEbsVolumeType,
+    DiskTypeEbsVolumeTypeParam,
+)
+from databricks.bundles.instance_pools._models.docker_basic_auth import (
+    DockerBasicAuth,
+    DockerBasicAuthDict,
+    DockerBasicAuthParam,
+)
+from databricks.bundles.instance_pools._models.docker_image import (
+    DockerImage,
+    DockerImageDict,
+    DockerImageParam,
+)
+from databricks.bundles.instance_pools._models.gcp_availability import (
+    GcpAvailability,
+    GcpAvailabilityParam,
+)
+from databricks.bundles.instance_pools._models.instance_pool import (
+    InstancePool,
+    InstancePoolDict,
+    InstancePoolParam,
+)
+from databricks.bundles.instance_pools._models.instance_pool_aws_attributes import (
+    InstancePoolAwsAttributes,
+    InstancePoolAwsAttributesDict,
+    InstancePoolAwsAttributesParam,
+)
+from databricks.bundles.instance_pools._models.instance_pool_aws_attributes_availability import (
+    InstancePoolAwsAttributesAvailability,
+    InstancePoolAwsAttributesAvailabilityParam,
+)
+from databricks.bundles.instance_pools._models.instance_pool_azure_attributes import (
+    InstancePoolAzureAttributes,
+    InstancePoolAzureAttributesDict,
+    InstancePoolAzureAttributesParam,
+)
+from databricks.bundles.instance_pools._models.instance_pool_azure_attributes_availability import (
+    InstancePoolAzureAttributesAvailability,
+    InstancePoolAzureAttributesAvailabilityParam,
+)
+from databricks.bundles.instance_pools._models.instance_pool_gcp_attributes import (
+    InstancePoolGcpAttributes,
+    InstancePoolGcpAttributesDict,
+    InstancePoolGcpAttributesParam,
+)
+from databricks.bundles.instance_pools._models.instance_pool_permission import (
+    InstancePoolPermission,
+    InstancePoolPermissionDict,
+    InstancePoolPermissionParam,
+)
+from databricks.bundles.instance_pools._models.instance_pool_permission_level import (
+    InstancePoolPermissionLevel,
+    InstancePoolPermissionLevelParam,
+)
+from databricks.bundles.instance_pools._models.lifecycle import (
+    Lifecycle,
+    LifecycleDict,
+    LifecycleParam,
+)
+from databricks.bundles.instance_pools._models.node_type_flexibility import (
+    NodeTypeFlexibility,
+    NodeTypeFlexibilityDict,
+    NodeTypeFlexibilityParam,
+)
diff --git a/python/databricks/bundles/instance_pools/_models/disk_spec.py b/python/databricks/bundles/instance_pools/_models/disk_spec.py
new file mode 100644
index 00000000000..b9edbb5d4e8
--- /dev/null
+++ b/python/databricks/bundles/instance_pools/_models/disk_spec.py
@@ -0,0 +1,136 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.instance_pools._models.disk_type import DiskType, DiskTypeParam
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class DiskSpec:
+    """
+    Describes the disks that are launched for each instance in the spark cluster.
+    For example, if the cluster has 3 instances, each instance is configured to launch
+    2 disks, 100 GiB each, then Databricks will launch a total of 6 disks,
+    100 GiB each, for this cluster.
+    """
+
+    disk_count: VariableOrOptional[int] = None
+    """
+    The number of disks launched for each instance:
+    - This feature is only enabled for supported node types.
+    - Users can choose up to the limit of the disks supported by the node type.
+    - For node types with no OS disk, at least one disk must be specified;
+    otherwise, cluster creation will fail.
+    
+    If disks are attached, Databricks will configure Spark to use only the disks for
+    scratch storage, because heterogenously sized scratch devices can lead to inefficient disk
+    utilization. If no disks are attached, Databricks will configure Spark to use
+    instance store disks.
+    
+    Note: If disks are specified, then the Spark configuration
+    `spark.local.dir` will be overridden.
+    
+    Disks will be mounted at:
+    - For AWS: `/ebs0`, `/ebs1`, and etc.
+    - For Azure: `/remote_volume0`, `/remote_volume1`, and etc.
+    """
+
+    disk_iops: VariableOrOptional[int] = None
+    """
+    The number of IOPS to provision for each attached disk.
+    """
+
+    disk_size: VariableOrOptional[int] = None
+    """
+    The size of each disk (in GiB) launched for each instance.
+    Values must fall into the supported range for a particular instance type.
+    
+    For AWS:
+    - General Purpose SSD: 100 - 4096 GiB
+    - Throughput Optimized HDD: 500 - 4096 GiB
+    
+    For Azure:
+    - Premium LRS (SSD): 1 - 1023 GiB
+    - Standard LRS (HDD): 1- 1023 GiB
+    """
+
+    disk_throughput: VariableOrOptional[int] = None
+    """
+    The disk throughput to provision for each attached disk, in MB per second.
+    """
+
+    disk_type: VariableOrOptional[DiskType] = None
+    """
+    The type of disks that will be launched with this cluster.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "DiskSpecDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "DiskSpecDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class DiskSpecDict(TypedDict, total=False):
+    """"""
+
+    disk_count: VariableOrOptional[int]
+    """
+    The number of disks launched for each instance:
+    - This feature is only enabled for supported node types.
+    - Users can choose up to the limit of the disks supported by the node type.
+    - For node types with no OS disk, at least one disk must be specified;
+    otherwise, cluster creation will fail.
+    
+    If disks are attached, Databricks will configure Spark to use only the disks for
+    scratch storage, because heterogenously sized scratch devices can lead to inefficient disk
+    utilization. If no disks are attached, Databricks will configure Spark to use
+    instance store disks.
+    
+    Note: If disks are specified, then the Spark configuration
+    `spark.local.dir` will be overridden.
+    
+    Disks will be mounted at:
+    - For AWS: `/ebs0`, `/ebs1`, and etc.
+    - For Azure: `/remote_volume0`, `/remote_volume1`, and etc.
+    """
+
+    disk_iops: VariableOrOptional[int]
+    """
+    The number of IOPS to provision for each attached disk.
+    """
+
+    disk_size: VariableOrOptional[int]
+    """
+    The size of each disk (in GiB) launched for each instance.
+    Values must fall into the supported range for a particular instance type.
+    
+    For AWS:
+    - General Purpose SSD: 100 - 4096 GiB
+    - Throughput Optimized HDD: 500 - 4096 GiB
+    
+    For Azure:
+    - Premium LRS (SSD): 1 - 1023 GiB
+    - Standard LRS (HDD): 1- 1023 GiB
+    """
+
+    disk_throughput: VariableOrOptional[int]
+    """
+    The disk throughput to provision for each attached disk, in MB per second.
+    """
+
+    disk_type: VariableOrOptional[DiskTypeParam]
+    """
+    The type of disks that will be launched with this cluster.
+    """
+
+
+DiskSpecParam = DiskSpecDict | DiskSpec
diff --git a/python/databricks/bundles/instance_pools/_models/disk_type.py b/python/databricks/bundles/instance_pools/_models/disk_type.py
new file mode 100644
index 00000000000..752bf75bf78
--- /dev/null
+++ b/python/databricks/bundles/instance_pools/_models/disk_type.py
@@ -0,0 +1,64 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.instance_pools._models.disk_type_azure_disk_volume_type import (
+    DiskTypeAzureDiskVolumeType,
+    DiskTypeAzureDiskVolumeTypeParam,
+)
+from databricks.bundles.instance_pools._models.disk_type_ebs_volume_type import (
+    DiskTypeEbsVolumeType,
+    DiskTypeEbsVolumeTypeParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class DiskType:
+    """
+    Describes the disk type.
+    """
+
+    azure_disk_volume_type: VariableOrOptional[DiskTypeAzureDiskVolumeType] = None
+    """
+    All Azure Disk types that Databricks supports.
+    See https://docs.microsoft.com/en-us/azure/storage/storage-about-disks-and-vhds-linux#types-of-disks
+    """
+
+    ebs_volume_type: VariableOrOptional[DiskTypeEbsVolumeType] = None
+    """
+    All EBS volume types that Databricks supports.
+    See https://aws.amazon.com/ebs/details/ for details.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "DiskTypeDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "DiskTypeDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class DiskTypeDict(TypedDict, total=False):
+    """"""
+
+    azure_disk_volume_type: VariableOrOptional[DiskTypeAzureDiskVolumeTypeParam]
+    """
+    All Azure Disk types that Databricks supports.
+    See https://docs.microsoft.com/en-us/azure/storage/storage-about-disks-and-vhds-linux#types-of-disks
+    """
+
+    ebs_volume_type: VariableOrOptional[DiskTypeEbsVolumeTypeParam]
+    """
+    All EBS volume types that Databricks supports.
+    See https://aws.amazon.com/ebs/details/ for details.
+    """
+
+
+DiskTypeParam = DiskTypeDict | DiskType
diff --git a/python/databricks/bundles/instance_pools/_models/disk_type_azure_disk_volume_type.py b/python/databricks/bundles/instance_pools/_models/disk_type_azure_disk_volume_type.py
new file mode 100644
index 00000000000..740ab2dd245
--- /dev/null
+++ b/python/databricks/bundles/instance_pools/_models/disk_type_azure_disk_volume_type.py
@@ -0,0 +1,19 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class DiskTypeAzureDiskVolumeType(Enum):
+    """
+    All Azure Disk types that Databricks supports.
+    See https://docs.microsoft.com/en-us/azure/storage/storage-about-disks-and-vhds-linux#types-of-disks
+    """
+
+    PREMIUM_LRS = "PREMIUM_LRS"
+    STANDARD_LRS = "STANDARD_LRS"
+
+
+DiskTypeAzureDiskVolumeTypeParam = (
+    Literal["PREMIUM_LRS", "STANDARD_LRS"] | DiskTypeAzureDiskVolumeType
+)
diff --git a/python/databricks/bundles/instance_pools/_models/disk_type_ebs_volume_type.py b/python/databricks/bundles/instance_pools/_models/disk_type_ebs_volume_type.py
new file mode 100644
index 00000000000..cb5ae6b7a05
--- /dev/null
+++ b/python/databricks/bundles/instance_pools/_models/disk_type_ebs_volume_type.py
@@ -0,0 +1,19 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class DiskTypeEbsVolumeType(Enum):
+    """
+    All EBS volume types that Databricks supports.
+    See https://aws.amazon.com/ebs/details/ for details.
+    """
+
+    GENERAL_PURPOSE_SSD = "GENERAL_PURPOSE_SSD"
+    THROUGHPUT_OPTIMIZED_HDD = "THROUGHPUT_OPTIMIZED_HDD"
+
+
+DiskTypeEbsVolumeTypeParam = (
+    Literal["GENERAL_PURPOSE_SSD", "THROUGHPUT_OPTIMIZED_HDD"] | DiskTypeEbsVolumeType
+)
diff --git a/python/databricks/bundles/instance_pools/_models/docker_basic_auth.py b/python/databricks/bundles/instance_pools/_models/docker_basic_auth.py
new file mode 100644
index 00000000000..552ea90a83b
--- /dev/null
+++ b/python/databricks/bundles/instance_pools/_models/docker_basic_auth.py
@@ -0,0 +1,50 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class DockerBasicAuth:
+    """"""
+
+    password: VariableOrOptional[str] = None
+    """
+    Password of the user
+    """
+
+    username: VariableOrOptional[str] = None
+    """
+    Name of the user
+    """
+
+    @classmethod
+    def from_dict(cls, value: "DockerBasicAuthDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "DockerBasicAuthDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class DockerBasicAuthDict(TypedDict, total=False):
+    """"""
+
+    password: VariableOrOptional[str]
+    """
+    Password of the user
+    """
+
+    username: VariableOrOptional[str]
+    """
+    Name of the user
+    """
+
+
+DockerBasicAuthParam = DockerBasicAuthDict | DockerBasicAuth
diff --git a/python/databricks/bundles/instance_pools/_models/docker_image.py b/python/databricks/bundles/instance_pools/_models/docker_image.py
new file mode 100644
index 00000000000..15b43d46554
--- /dev/null
+++ b/python/databricks/bundles/instance_pools/_models/docker_image.py
@@ -0,0 +1,54 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.instance_pools._models.docker_basic_auth import (
+    DockerBasicAuth,
+    DockerBasicAuthParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class DockerImage:
+    """"""
+
+    basic_auth: VariableOrOptional[DockerBasicAuth] = None
+    """
+    Basic auth with username and password
+    """
+
+    url: VariableOrOptional[str] = None
+    """
+    URL of the docker image.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "DockerImageDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "DockerImageDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class DockerImageDict(TypedDict, total=False):
+    """"""
+
+    basic_auth: VariableOrOptional[DockerBasicAuthParam]
+    """
+    Basic auth with username and password
+    """
+
+    url: VariableOrOptional[str]
+    """
+    URL of the docker image.
+    """
+
+
+DockerImageParam = DockerImageDict | DockerImage
diff --git a/python/databricks/bundles/instance_pools/_models/gcp_availability.py b/python/databricks/bundles/instance_pools/_models/gcp_availability.py
new file mode 100644
index 00000000000..0d391b87fe3
--- /dev/null
+++ b/python/databricks/bundles/instance_pools/_models/gcp_availability.py
@@ -0,0 +1,21 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class GcpAvailability(Enum):
+    """
+    This field determines whether the instance pool will contain preemptible
+    VMs, on-demand VMs, or preemptible VMs with a fallback to on-demand VMs if the former is unavailable.
+    """
+
+    PREEMPTIBLE_GCP = "PREEMPTIBLE_GCP"
+    ON_DEMAND_GCP = "ON_DEMAND_GCP"
+    PREEMPTIBLE_WITH_FALLBACK_GCP = "PREEMPTIBLE_WITH_FALLBACK_GCP"
+
+
+GcpAvailabilityParam = (
+    Literal["PREEMPTIBLE_GCP", "ON_DEMAND_GCP", "PREEMPTIBLE_WITH_FALLBACK_GCP"]
+    | GcpAvailability
+)
diff --git a/python/databricks/bundles/instance_pools/_models/instance_pool.py b/python/databricks/bundles/instance_pools/_models/instance_pool.py
new file mode 100644
index 00000000000..2b10f210284
--- /dev/null
+++ b/python/databricks/bundles/instance_pools/_models/instance_pool.py
@@ -0,0 +1,289 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._resource import Resource
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import (
+    VariableOr,
+    VariableOrDict,
+    VariableOrList,
+    VariableOrOptional,
+)
+from databricks.bundles.instance_pools._models.disk_spec import DiskSpec, DiskSpecParam
+from databricks.bundles.instance_pools._models.docker_image import (
+    DockerImage,
+    DockerImageParam,
+)
+from databricks.bundles.instance_pools._models.instance_pool_aws_attributes import (
+    InstancePoolAwsAttributes,
+    InstancePoolAwsAttributesParam,
+)
+from databricks.bundles.instance_pools._models.instance_pool_azure_attributes import (
+    InstancePoolAzureAttributes,
+    InstancePoolAzureAttributesParam,
+)
+from databricks.bundles.instance_pools._models.instance_pool_gcp_attributes import (
+    InstancePoolGcpAttributes,
+    InstancePoolGcpAttributesParam,
+)
+from databricks.bundles.instance_pools._models.instance_pool_permission import (
+    InstancePoolPermission,
+    InstancePoolPermissionParam,
+)
+from databricks.bundles.instance_pools._models.lifecycle import (
+    Lifecycle,
+    LifecycleParam,
+)
+from databricks.bundles.instance_pools._models.node_type_flexibility import (
+    NodeTypeFlexibility,
+    NodeTypeFlexibilityParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class InstancePool(Resource):
+    """"""
+
+    instance_pool_name: VariableOr[str]
+    """
+    Pool name requested by the user. Pool name must be unique. Length must be between 1 and 100
+    characters.
+    """
+
+    node_type_id: VariableOr[str]
+    """
+    This field encodes, through a single value, the resources available to each of
+    the Spark nodes in this cluster. For example, the Spark nodes can be provisioned
+    and optimized for memory or compute intensive workloads. A list of available node
+    types can be retrieved by using the [clusters/listNodeTypes](https://docs.databricks.com/api/workspace/clusters/listnodetypes) API call.
+    """
+
+    aws_attributes: VariableOrOptional[InstancePoolAwsAttributes] = None
+    """
+    Attributes related to instance pools running on Amazon Web Services.
+    If not specified at pool creation, a set of default values will be used.
+    """
+
+    azure_attributes: VariableOrOptional[InstancePoolAzureAttributes] = None
+    """
+    Attributes related to instance pools running on Azure.
+    If not specified at pool creation, a set of default values will be used.
+    """
+
+    custom_tags: VariableOrDict[str] = field(default_factory=dict)
+    """
+    Additional tags for pool resources. Databricks will tag all pool resources (e.g., AWS
+    instances and EBS volumes) with these tags in addition to `default_tags`. Notes:
+    
+    - Currently, Databricks allows at most 45 custom tags
+    """
+
+    disk_spec: VariableOrOptional[DiskSpec] = None
+    """
+    Defines the specification of the disks that will be attached to all spark containers.
+    """
+
+    enable_elastic_disk: VariableOrOptional[bool] = None
+    """
+    Autoscaling Local Storage: when enabled, this instances in this pool will dynamically acquire
+    additional disk space when its Spark workers are running low on disk space. In AWS, this
+    feature requires specific AWS permissions to function correctly - refer to the User Guide for
+    more details.
+    """
+
+    gcp_attributes: VariableOrOptional[InstancePoolGcpAttributes] = None
+    """
+    Attributes related to instance pools running on Google Cloud Platform.
+    If not specified at pool creation, a set of default values will be used.
+    """
+
+    idle_instance_autotermination_minutes: VariableOrOptional[int] = None
+    """
+    Automatically terminates the extra instances in the pool cache after they are inactive for this
+    time in minutes if min_idle_instances requirement is already met. If not set, the extra pool
+    instances will be automatically terminated after a default timeout. If specified, the
+    threshold must be between 0 and 10000 minutes.
+    Users can also set this value to 0 to instantly remove idle instances from the cache if
+    min cache size could still hold.
+    """
+
+    lifecycle: VariableOrOptional[Lifecycle] = None
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+    max_capacity: VariableOrOptional[int] = None
+    """
+    Maximum number of outstanding instances to keep in the pool, including both instances used by
+    clusters and idle instances. Clusters that require further instance provisioning will fail during
+    upsize requests.
+    """
+
+    min_idle_instances: VariableOrOptional[int] = None
+    """
+    Minimum number of idle instances to keep in the instance pool
+    """
+
+    node_type_flexibility: VariableOrOptional[NodeTypeFlexibility] = None
+    """
+    Flexible node type configuration for the pool.
+    """
+
+    permissions: VariableOrList[InstancePoolPermission] = field(default_factory=list)
+    """
+    The permissions to apply to this resource.
+    """
+
+    preloaded_docker_images: VariableOrList[DockerImage] = field(default_factory=list)
+    """
+    Custom Docker Image BYOC
+    """
+
+    preloaded_spark_versions: VariableOrList[str] = field(default_factory=list)
+    """
+    A list containing at most one preloaded Spark image version for the pool. Pool-backed clusters started
+    with the preloaded Spark version will start faster. A list of available Spark versions
+    can be retrieved by using the [clusters/sparkVersions](https://docs.databricks.com/api/workspace/clusters/sparkversions) API call.
+    """
+
+    remote_disk_throughput: VariableOrOptional[int] = None
+    """
+    If set, what the configurable throughput (in Mb/s) for the remote disk is. Currently only supported for GCP HYPERDISK_BALANCED types.
+    """
+
+    total_initial_remote_disk_size: VariableOrOptional[int] = None
+    """
+    If set, what the total initial volume size (in GB) of the remote disks should be. Currently only supported for GCP HYPERDISK_BALANCED types.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "InstancePoolDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "InstancePoolDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class InstancePoolDict(TypedDict, total=False):
+    """"""
+
+    instance_pool_name: VariableOr[str]
+    """
+    Pool name requested by the user. Pool name must be unique. Length must be between 1 and 100
+    characters.
+    """
+
+    node_type_id: VariableOr[str]
+    """
+    This field encodes, through a single value, the resources available to each of
+    the Spark nodes in this cluster. For example, the Spark nodes can be provisioned
+    and optimized for memory or compute intensive workloads. A list of available node
+    types can be retrieved by using the [clusters/listNodeTypes](https://docs.databricks.com/api/workspace/clusters/listnodetypes) API call.
+    """
+
+    aws_attributes: VariableOrOptional[InstancePoolAwsAttributesParam]
+    """
+    Attributes related to instance pools running on Amazon Web Services.
+    If not specified at pool creation, a set of default values will be used.
+    """
+
+    azure_attributes: VariableOrOptional[InstancePoolAzureAttributesParam]
+    """
+    Attributes related to instance pools running on Azure.
+    If not specified at pool creation, a set of default values will be used.
+    """
+
+    custom_tags: VariableOrDict[str]
+    """
+    Additional tags for pool resources. Databricks will tag all pool resources (e.g., AWS
+    instances and EBS volumes) with these tags in addition to `default_tags`. Notes:
+    
+    - Currently, Databricks allows at most 45 custom tags
+    """
+
+    disk_spec: VariableOrOptional[DiskSpecParam]
+    """
+    Defines the specification of the disks that will be attached to all spark containers.
+    """
+
+    enable_elastic_disk: VariableOrOptional[bool]
+    """
+    Autoscaling Local Storage: when enabled, this instances in this pool will dynamically acquire
+    additional disk space when its Spark workers are running low on disk space. In AWS, this
+    feature requires specific AWS permissions to function correctly - refer to the User Guide for
+    more details.
+    """
+
+    gcp_attributes: VariableOrOptional[InstancePoolGcpAttributesParam]
+    """
+    Attributes related to instance pools running on Google Cloud Platform.
+    If not specified at pool creation, a set of default values will be used.
+    """
+
+    idle_instance_autotermination_minutes: VariableOrOptional[int]
+    """
+    Automatically terminates the extra instances in the pool cache after they are inactive for this
+    time in minutes if min_idle_instances requirement is already met. If not set, the extra pool
+    instances will be automatically terminated after a default timeout. If specified, the
+    threshold must be between 0 and 10000 minutes.
+    Users can also set this value to 0 to instantly remove idle instances from the cache if
+    min cache size could still hold.
+    """
+
+    lifecycle: VariableOrOptional[LifecycleParam]
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+    max_capacity: VariableOrOptional[int]
+    """
+    Maximum number of outstanding instances to keep in the pool, including both instances used by
+    clusters and idle instances. Clusters that require further instance provisioning will fail during
+    upsize requests.
+    """
+
+    min_idle_instances: VariableOrOptional[int]
+    """
+    Minimum number of idle instances to keep in the instance pool
+    """
+
+    node_type_flexibility: VariableOrOptional[NodeTypeFlexibilityParam]
+    """
+    Flexible node type configuration for the pool.
+    """
+
+    permissions: VariableOrList[InstancePoolPermissionParam]
+    """
+    The permissions to apply to this resource.
+    """
+
+    preloaded_docker_images: VariableOrList[DockerImageParam]
+    """
+    Custom Docker Image BYOC
+    """
+
+    preloaded_spark_versions: VariableOrList[str]
+    """
+    A list containing at most one preloaded Spark image version for the pool. Pool-backed clusters started
+    with the preloaded Spark version will start faster. A list of available Spark versions
+    can be retrieved by using the [clusters/sparkVersions](https://docs.databricks.com/api/workspace/clusters/sparkversions) API call.
+    """
+
+    remote_disk_throughput: VariableOrOptional[int]
+    """
+    If set, what the configurable throughput (in Mb/s) for the remote disk is. Currently only supported for GCP HYPERDISK_BALANCED types.
+    """
+
+    total_initial_remote_disk_size: VariableOrOptional[int]
+    """
+    If set, what the total initial volume size (in GB) of the remote disks should be. Currently only supported for GCP HYPERDISK_BALANCED types.
+    """
+
+
+InstancePoolParam = InstancePoolDict | InstancePool
diff --git a/python/databricks/bundles/instance_pools/_models/instance_pool_aws_attributes.py b/python/databricks/bundles/instance_pools/_models/instance_pool_aws_attributes.py
new file mode 100644
index 00000000000..25fe305787e
--- /dev/null
+++ b/python/databricks/bundles/instance_pools/_models/instance_pool_aws_attributes.py
@@ -0,0 +1,154 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.instance_pools._models.instance_pool_aws_attributes_availability import (
+    InstancePoolAwsAttributesAvailability,
+    InstancePoolAwsAttributesAvailabilityParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class InstancePoolAwsAttributes:
+    """
+    Attributes set during instance pool creation which are related to Amazon Web Services.
+    """
+
+    availability: VariableOrOptional[InstancePoolAwsAttributesAvailability] = None
+    """
+    Availability type used for the instances in the pool. Supports on-demand, spot, and
+    spot-with-fallback (the pool acquires spot instances first, and falls back to on-demand
+    instances when spot capacity is unavailable).
+    
+    You can change this value on an existing pool. New clusters use the updated availability, and
+    existing clusters keep the availability they launched with.
+    """
+
+    instance_profile_arn: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] All AWS instances belonging to the instance pool will have this instance profile. If omitted, instances
+    will initially be launched with the workspace's default instance profile. If defined, clusters that use the
+    pool will inherit the instance profile, and must not specify their own instance profile on cluster creation or
+    update. If the pool does not specify an instance profile, clusters using the pool may specify any instance profile.
+    The instance profile must have previously been added to the Databricks environment by an account administrator.
+    
+    This feature may only be available to certain customer plans.
+    """
+
+    spot_bid_price_percent: VariableOrOptional[int] = None
+    """
+    Calculates the bid price for AWS spot instances, as a percentage of the corresponding instance type's
+    on-demand price.
+    For example, if this field is set to 50, and the cluster needs a new `r3.xlarge` spot
+    instance, then the bid price is half of the price of
+    on-demand `r3.xlarge` instances. Similarly, if this field is set to 200, the bid price is twice
+    the price of on-demand `r3.xlarge` instances. If not specified, the default value is 100.
+    When spot instances are requested for this cluster, only spot instances whose bid price
+    percentage matches this field will be considered.
+    Note that, for safety, we enforce this field to be no more than 10000.
+    
+    You can change this value on an existing pool. New clusters use the updated bid price, and
+    existing clusters keep the bid price they launched with.
+    """
+
+    zone_id: VariableOrOptional[str] = None
+    """
+    Identifier for the availability zone/datacenter in which the cluster resides.
+    This string will be of a form like "us-west-2a". The provided availability
+    zone must be in the same region as the Databricks deployment. For example, "us-west-2a"
+    is not a valid zone id if the Databricks deployment resides in the "us-east-1" region.
+    This is an optional field at cluster creation, and if not specified, a default zone will be used.
+    The list of available zones as well as the default value can be found by using the
+    `List Zones` method.
+    
+    Set this field to "auto" to enable Auto-AZ, in which case Databricks selects the availability
+    zone for each cluster independently when the cluster launches, and retries another zone if the
+    cluster can't be fulfilled because of insufficient capacity or quota. All nodes in a cluster
+    land in the same zone, and different clusters backed by the pool can run in different zones.
+    
+    You can change the zone on an existing pool. New clusters use the updated zone, and existing
+    clusters keep the zone they launched with.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "InstancePoolAwsAttributesDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "InstancePoolAwsAttributesDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class InstancePoolAwsAttributesDict(TypedDict, total=False):
+    """"""
+
+    availability: VariableOrOptional[InstancePoolAwsAttributesAvailabilityParam]
+    """
+    Availability type used for the instances in the pool. Supports on-demand, spot, and
+    spot-with-fallback (the pool acquires spot instances first, and falls back to on-demand
+    instances when spot capacity is unavailable).
+    
+    You can change this value on an existing pool. New clusters use the updated availability, and
+    existing clusters keep the availability they launched with.
+    """
+
+    instance_profile_arn: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] All AWS instances belonging to the instance pool will have this instance profile. If omitted, instances
+    will initially be launched with the workspace's default instance profile. If defined, clusters that use the
+    pool will inherit the instance profile, and must not specify their own instance profile on cluster creation or
+    update. If the pool does not specify an instance profile, clusters using the pool may specify any instance profile.
+    The instance profile must have previously been added to the Databricks environment by an account administrator.
+    
+    This feature may only be available to certain customer plans.
+    """
+
+    spot_bid_price_percent: VariableOrOptional[int]
+    """
+    Calculates the bid price for AWS spot instances, as a percentage of the corresponding instance type's
+    on-demand price.
+    For example, if this field is set to 50, and the cluster needs a new `r3.xlarge` spot
+    instance, then the bid price is half of the price of
+    on-demand `r3.xlarge` instances. Similarly, if this field is set to 200, the bid price is twice
+    the price of on-demand `r3.xlarge` instances. If not specified, the default value is 100.
+    When spot instances are requested for this cluster, only spot instances whose bid price
+    percentage matches this field will be considered.
+    Note that, for safety, we enforce this field to be no more than 10000.
+    
+    You can change this value on an existing pool. New clusters use the updated bid price, and
+    existing clusters keep the bid price they launched with.
+    """
+
+    zone_id: VariableOrOptional[str]
+    """
+    Identifier for the availability zone/datacenter in which the cluster resides.
+    This string will be of a form like "us-west-2a". The provided availability
+    zone must be in the same region as the Databricks deployment. For example, "us-west-2a"
+    is not a valid zone id if the Databricks deployment resides in the "us-east-1" region.
+    This is an optional field at cluster creation, and if not specified, a default zone will be used.
+    The list of available zones as well as the default value can be found by using the
+    `List Zones` method.
+    
+    Set this field to "auto" to enable Auto-AZ, in which case Databricks selects the availability
+    zone for each cluster independently when the cluster launches, and retries another zone if the
+    cluster can't be fulfilled because of insufficient capacity or quota. All nodes in a cluster
+    land in the same zone, and different clusters backed by the pool can run in different zones.
+    
+    You can change the zone on an existing pool. New clusters use the updated zone, and existing
+    clusters keep the zone they launched with.
+    """
+
+
+InstancePoolAwsAttributesParam = (
+    InstancePoolAwsAttributesDict | InstancePoolAwsAttributes
+)
diff --git a/python/databricks/bundles/instance_pools/_models/instance_pool_aws_attributes_availability.py b/python/databricks/bundles/instance_pools/_models/instance_pool_aws_attributes_availability.py
new file mode 100644
index 00000000000..5bc8a0350fa
--- /dev/null
+++ b/python/databricks/bundles/instance_pools/_models/instance_pool_aws_attributes_availability.py
@@ -0,0 +1,18 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class InstancePoolAwsAttributesAvailability(Enum):
+    """
+    The set of AWS availability types supported when setting up nodes for a cluster.
+    """
+
+    SPOT = "SPOT"
+    ON_DEMAND = "ON_DEMAND"
+
+
+InstancePoolAwsAttributesAvailabilityParam = (
+    Literal["SPOT", "ON_DEMAND"] | InstancePoolAwsAttributesAvailability
+)
diff --git a/python/databricks/bundles/instance_pools/_models/instance_pool_azure_attributes.py b/python/databricks/bundles/instance_pools/_models/instance_pool_azure_attributes.py
new file mode 100644
index 00000000000..80833993289
--- /dev/null
+++ b/python/databricks/bundles/instance_pools/_models/instance_pool_azure_attributes.py
@@ -0,0 +1,116 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.instance_pools._models.instance_pool_azure_attributes_availability import (
+    InstancePoolAzureAttributesAvailability,
+    InstancePoolAzureAttributesAvailabilityParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class InstancePoolAzureAttributes:
+    """
+    Attributes set during instance pool creation which are related to Azure.
+    """
+
+    availability: VariableOrOptional[InstancePoolAzureAttributesAvailability] = None
+    """
+    Availability type used for the instances in the pool. Supports on-demand, spot, and
+    spot-with-fallback (the pool acquires spot instances first, and falls back to on-demand
+    instances when spot capacity is unavailable).
+    
+    You can change this value on an existing pool. New clusters use the updated availability, and
+    existing clusters keep the availability they launched with.
+    """
+
+    capacity_reservation_group: VariableOrOptional[str] = None
+    """
+    The Azure capacity reservation group resource ID to use for launching VMs in this pool.
+    When specified, VMs will be launched using the provided capacity reservation.
+    
+    NOTE: Omitting this field will clear any existing configured capacity reservation group on the pool.
+    
+    Capacity reservations can only be specified when the workspace uses injected vnet (i.e. customer defined vnet not
+    managed by databricks). Ensure the databricks-login-prod Enterprise Application is granted the following four permissions:
+    1. Microsoft.Compute/capacityReservationGroups/read
+    2. Microsoft.Compute/capacityReservationGroups/deploy/action
+    3. Microsoft.Compute/capacityReservationGroups/capacityReservations/read
+    4. Microsoft.Compute/capacityReservationGroups/capacityReservations/deploy/action
+    
+    Format: `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/capacityReservationGroups/{capacityReservationGroupName}`
+    """
+
+    spot_bid_max_price: VariableOrOptional[float] = None
+    """
+    With variable pricing, you have option to set a max price, in US dollars (USD)
+    For example, the value 2 would be a max price of $2.00 USD per hour.
+    If you set the max price to be -1, the VM won't be evicted based on price.
+    The price for the VM will be the current price for spot or the price for a standard VM,
+    which ever is less, as long as there is capacity and quota available.
+    
+    You can change this value on an existing pool. New clusters use the updated max price, and
+    existing clusters keep the max price they launched with.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "InstancePoolAzureAttributesDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "InstancePoolAzureAttributesDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class InstancePoolAzureAttributesDict(TypedDict, total=False):
+    """"""
+
+    availability: VariableOrOptional[InstancePoolAzureAttributesAvailabilityParam]
+    """
+    Availability type used for the instances in the pool. Supports on-demand, spot, and
+    spot-with-fallback (the pool acquires spot instances first, and falls back to on-demand
+    instances when spot capacity is unavailable).
+    
+    You can change this value on an existing pool. New clusters use the updated availability, and
+    existing clusters keep the availability they launched with.
+    """
+
+    capacity_reservation_group: VariableOrOptional[str]
+    """
+    The Azure capacity reservation group resource ID to use for launching VMs in this pool.
+    When specified, VMs will be launched using the provided capacity reservation.
+    
+    NOTE: Omitting this field will clear any existing configured capacity reservation group on the pool.
+    
+    Capacity reservations can only be specified when the workspace uses injected vnet (i.e. customer defined vnet not
+    managed by databricks). Ensure the databricks-login-prod Enterprise Application is granted the following four permissions:
+    1. Microsoft.Compute/capacityReservationGroups/read
+    2. Microsoft.Compute/capacityReservationGroups/deploy/action
+    3. Microsoft.Compute/capacityReservationGroups/capacityReservations/read
+    4. Microsoft.Compute/capacityReservationGroups/capacityReservations/deploy/action
+    
+    Format: `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/capacityReservationGroups/{capacityReservationGroupName}`
+    """
+
+    spot_bid_max_price: VariableOrOptional[float]
+    """
+    With variable pricing, you have option to set a max price, in US dollars (USD)
+    For example, the value 2 would be a max price of $2.00 USD per hour.
+    If you set the max price to be -1, the VM won't be evicted based on price.
+    The price for the VM will be the current price for spot or the price for a standard VM,
+    which ever is less, as long as there is capacity and quota available.
+    
+    You can change this value on an existing pool. New clusters use the updated max price, and
+    existing clusters keep the max price they launched with.
+    """
+
+
+InstancePoolAzureAttributesParam = (
+    InstancePoolAzureAttributesDict | InstancePoolAzureAttributes
+)
diff --git a/python/databricks/bundles/instance_pools/_models/instance_pool_azure_attributes_availability.py b/python/databricks/bundles/instance_pools/_models/instance_pool_azure_attributes_availability.py
new file mode 100644
index 00000000000..6d41fe997dd
--- /dev/null
+++ b/python/databricks/bundles/instance_pools/_models/instance_pool_azure_attributes_availability.py
@@ -0,0 +1,18 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class InstancePoolAzureAttributesAvailability(Enum):
+    """
+    The set of Azure availability types supported when setting up nodes for a cluster.
+    """
+
+    SPOT_AZURE = "SPOT_AZURE"
+    ON_DEMAND_AZURE = "ON_DEMAND_AZURE"
+
+
+InstancePoolAzureAttributesAvailabilityParam = (
+    Literal["SPOT_AZURE", "ON_DEMAND_AZURE"] | InstancePoolAzureAttributesAvailability
+)
diff --git a/python/databricks/bundles/instance_pools/_models/instance_pool_gcp_attributes.py b/python/databricks/bundles/instance_pools/_models/instance_pool_gcp_attributes.py
new file mode 100644
index 00000000000..244158a007d
--- /dev/null
+++ b/python/databricks/bundles/instance_pools/_models/instance_pool_gcp_attributes.py
@@ -0,0 +1,94 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.instance_pools._models.gcp_availability import (
+    GcpAvailability,
+    GcpAvailabilityParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class InstancePoolGcpAttributes:
+    """
+    Attributes set during instance pool creation which are related to GCP.
+    """
+
+    gcp_availability: VariableOrOptional[GcpAvailability] = None
+
+    local_ssd_count: VariableOrOptional[int] = None
+    """
+    If provided, each node in the instance pool will have this number of local SSDs attached.
+    Each local SSD is 375GB in size. Refer to [GCP documentation](https://cloud.google.com/compute/docs/disks/local-ssd#choose_number_local_ssds)
+    for the supported number of local SSDs for each instance type.
+    """
+
+    zone_id: VariableOrOptional[str] = None
+    """
+    Identifier for the availability zone/datacenter in which the cluster resides.
+    This string will be of a form like "us-west1-a". The provided availability
+    zone must be in the same region as the Databricks workspace. For example, "us-west1-a"
+    is not a valid zone id if the Databricks workspace resides in the "us-east1" region.
+    This is an optional field at instance pool creation, and if not specified, a default zone will be used.
+    
+    This field can be one of the following:
+    - "HA" => High availability, spread nodes across availability zones for a Databricks deployment region
+    - "auto" => Auto-AZ. Databricks selects the availability zone for each cluster independently when the cluster launches, and retries another zone if the cluster can't be fulfilled because of insufficient capacity or quota. All nodes in a cluster land in the same zone, and different clusters backed by the pool can run in different zones.
+    - A GCP availability zone => Pick One of the available zones for (machine type + region) from https://cloud.google.com/compute/docs/regions-zones (e.g. "us-west1-a").
+    
+    If empty, Databricks picks an availability zone to schedule the cluster on.
+    
+    You can change the zone on an existing pool. New clusters use the updated zone, and existing
+    clusters keep the zone they launched with.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "InstancePoolGcpAttributesDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "InstancePoolGcpAttributesDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class InstancePoolGcpAttributesDict(TypedDict, total=False):
+    """"""
+
+    gcp_availability: VariableOrOptional[GcpAvailabilityParam]
+
+    local_ssd_count: VariableOrOptional[int]
+    """
+    If provided, each node in the instance pool will have this number of local SSDs attached.
+    Each local SSD is 375GB in size. Refer to [GCP documentation](https://cloud.google.com/compute/docs/disks/local-ssd#choose_number_local_ssds)
+    for the supported number of local SSDs for each instance type.
+    """
+
+    zone_id: VariableOrOptional[str]
+    """
+    Identifier for the availability zone/datacenter in which the cluster resides.
+    This string will be of a form like "us-west1-a". The provided availability
+    zone must be in the same region as the Databricks workspace. For example, "us-west1-a"
+    is not a valid zone id if the Databricks workspace resides in the "us-east1" region.
+    This is an optional field at instance pool creation, and if not specified, a default zone will be used.
+    
+    This field can be one of the following:
+    - "HA" => High availability, spread nodes across availability zones for a Databricks deployment region
+    - "auto" => Auto-AZ. Databricks selects the availability zone for each cluster independently when the cluster launches, and retries another zone if the cluster can't be fulfilled because of insufficient capacity or quota. All nodes in a cluster land in the same zone, and different clusters backed by the pool can run in different zones.
+    - A GCP availability zone => Pick One of the available zones for (machine type + region) from https://cloud.google.com/compute/docs/regions-zones (e.g. "us-west1-a").
+    
+    If empty, Databricks picks an availability zone to schedule the cluster on.
+    
+    You can change the zone on an existing pool. New clusters use the updated zone, and existing
+    clusters keep the zone they launched with.
+    """
+
+
+InstancePoolGcpAttributesParam = (
+    InstancePoolGcpAttributesDict | InstancePoolGcpAttributes
+)
diff --git a/python/databricks/bundles/instance_pools/_models/instance_pool_permission.py b/python/databricks/bundles/instance_pools/_models/instance_pool_permission.py
new file mode 100644
index 00000000000..a81c2602aa6
--- /dev/null
+++ b/python/databricks/bundles/instance_pools/_models/instance_pool_permission.py
@@ -0,0 +1,74 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+from databricks.bundles.instance_pools._models.instance_pool_permission_level import (
+    InstancePoolPermissionLevel,
+    InstancePoolPermissionLevelParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class InstancePoolPermission:
+    """"""
+
+    level: VariableOr[InstancePoolPermissionLevel]
+    """
+    The permission level to apply. The allowed levels depend on the resource type.
+    """
+
+    group_name: VariableOrOptional[str] = None
+    """
+    The name of the group granted the permission level.
+    """
+
+    service_principal_name: VariableOrOptional[str] = None
+    """
+    The name of the service principal granted the permission level.
+    """
+
+    user_name: VariableOrOptional[str] = None
+    """
+    The name of the user granted the permission level.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "InstancePoolPermissionDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "InstancePoolPermissionDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class InstancePoolPermissionDict(TypedDict, total=False):
+    """"""
+
+    level: VariableOr[InstancePoolPermissionLevelParam]
+    """
+    The permission level to apply. The allowed levels depend on the resource type.
+    """
+
+    group_name: VariableOrOptional[str]
+    """
+    The name of the group granted the permission level.
+    """
+
+    service_principal_name: VariableOrOptional[str]
+    """
+    The name of the service principal granted the permission level.
+    """
+
+    user_name: VariableOrOptional[str]
+    """
+    The name of the user granted the permission level.
+    """
+
+
+InstancePoolPermissionParam = InstancePoolPermissionDict | InstancePoolPermission
diff --git a/python/databricks/bundles/instance_pools/_models/instance_pool_permission_level.py b/python/databricks/bundles/instance_pools/_models/instance_pool_permission_level.py
new file mode 100644
index 00000000000..bb0468b742c
--- /dev/null
+++ b/python/databricks/bundles/instance_pools/_models/instance_pool_permission_level.py
@@ -0,0 +1,18 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class InstancePoolPermissionLevel(Enum):
+    """
+    Permission level
+    """
+
+    CAN_MANAGE = "CAN_MANAGE"
+    CAN_ATTACH_TO = "CAN_ATTACH_TO"
+
+
+InstancePoolPermissionLevelParam = (
+    Literal["CAN_MANAGE", "CAN_ATTACH_TO"] | InstancePoolPermissionLevel
+)
diff --git a/python/databricks/bundles/instance_pools/_models/lifecycle.py b/python/databricks/bundles/instance_pools/_models/lifecycle.py
new file mode 100644
index 00000000000..697776a198e
--- /dev/null
+++ b/python/databricks/bundles/instance_pools/_models/lifecycle.py
@@ -0,0 +1,40 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class Lifecycle:
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool] = None
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "LifecycleDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "LifecycleDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class LifecycleDict(TypedDict, total=False):
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool]
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+
+LifecycleParam = LifecycleDict | Lifecycle
diff --git a/python/databricks/bundles/instance_pools/_models/node_type_flexibility.py b/python/databricks/bundles/instance_pools/_models/node_type_flexibility.py
new file mode 100644
index 00000000000..418ea9337bd
--- /dev/null
+++ b/python/databricks/bundles/instance_pools/_models/node_type_flexibility.py
@@ -0,0 +1,54 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class NodeTypeFlexibility:
+    """
+    Configuration for flexible node types, allowing fallback to alternate node types during cluster launch and upscale.
+    """
+
+    alternate_node_type_ids: VariableOrList[str] = field(default_factory=list)
+    """
+    A list of node type IDs to use as fallbacks when the primary node type is unavailable.
+    """
+
+    aws_context_id: VariableOrOptional[str] = None
+    """
+    The AWS Context ID for EC2 Fleet.
+    When set (non-empty), the value is passed to AWS CreateFleet API to create the EC2 Fleet.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "NodeTypeFlexibilityDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "NodeTypeFlexibilityDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class NodeTypeFlexibilityDict(TypedDict, total=False):
+    """"""
+
+    alternate_node_type_ids: VariableOrList[str]
+    """
+    A list of node type IDs to use as fallbacks when the primary node type is unavailable.
+    """
+
+    aws_context_id: VariableOrOptional[str]
+    """
+    The AWS Context ID for EC2 Fleet.
+    When set (non-empty), the value is passed to AWS CreateFleet API to create the EC2 Fleet.
+    """
+
+
+NodeTypeFlexibilityParam = NodeTypeFlexibilityDict | NodeTypeFlexibility
diff --git a/python/databricks/bundles/job_runs/__init__.py b/python/databricks/bundles/job_runs/__init__.py
new file mode 100644
index 00000000000..093f2201409
--- /dev/null
+++ b/python/databricks/bundles/job_runs/__init__.py
@@ -0,0 +1,48 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+__all__ = [
+    "JobRun",
+    "JobRunDict",
+    "JobRunLifecycle",
+    "JobRunLifecycleDict",
+    "JobRunLifecycleParam",
+    "JobRunParam",
+    "JobRunTrigger",
+    "JobRunTriggerDict",
+    "JobRunTriggerParam",
+    "PerformanceTarget",
+    "PerformanceTargetParam",
+    "PipelineParams",
+    "PipelineParamsDict",
+    "PipelineParamsParam",
+    "QueueSettings",
+    "QueueSettingsDict",
+    "QueueSettingsParam",
+]
+
+
+from databricks.bundles.job_runs._models.job_run import JobRun, JobRunDict, JobRunParam
+from databricks.bundles.job_runs._models.job_run_lifecycle import (
+    JobRunLifecycle,
+    JobRunLifecycleDict,
+    JobRunLifecycleParam,
+)
+from databricks.bundles.job_runs._models.job_run_trigger import (
+    JobRunTrigger,
+    JobRunTriggerDict,
+    JobRunTriggerParam,
+)
+from databricks.bundles.job_runs._models.performance_target import (
+    PerformanceTarget,
+    PerformanceTargetParam,
+)
+from databricks.bundles.job_runs._models.pipeline_params import (
+    PipelineParams,
+    PipelineParamsDict,
+    PipelineParamsParam,
+)
+from databricks.bundles.job_runs._models.queue_settings import (
+    QueueSettings,
+    QueueSettingsDict,
+    QueueSettingsParam,
+)
diff --git a/python/databricks/bundles/job_runs/_models/job_run.py b/python/databricks/bundles/job_runs/_models/job_run.py
new file mode 100644
index 00000000000..e7f5a0b3f71
--- /dev/null
+++ b/python/databricks/bundles/job_runs/_models/job_run.py
@@ -0,0 +1,158 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._resource import Resource
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import (
+    VariableOr,
+    VariableOrDict,
+    VariableOrList,
+    VariableOrOptional,
+)
+from databricks.bundles.job_runs._models.job_run_lifecycle import (
+    JobRunLifecycle,
+    JobRunLifecycleParam,
+)
+from databricks.bundles.job_runs._models.performance_target import (
+    PerformanceTarget,
+    PerformanceTargetParam,
+)
+from databricks.bundles.job_runs._models.pipeline_params import (
+    PipelineParams,
+    PipelineParamsParam,
+)
+from databricks.bundles.job_runs._models.queue_settings import (
+    QueueSettings,
+    QueueSettingsParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class JobRun(Resource):
+    """"""
+
+    job_id: VariableOr[int]
+    """
+    The ID of the job to be executed
+    """
+
+    duration_target: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The window the run aims to finish within, in hours, for a Cost-optimized serverless run.
+    Required only when `performance_target` is `COST_OPTIMIZED`. Must be one of the
+    supported values: `NO_FLEXIBILITY`, `4h`, `12h`, `24h`, `72h`. `NO_FLEXIBILITY` means the run
+    uses the default cost-optimized performance level without additional cost-saving optimizations.
+    """
+
+    job_parameters: VariableOrDict[str] = field(default_factory=dict)
+    """
+    Job-level parameters used in the run. for example `"param": "overriding_val"`
+    """
+
+    lifecycle: VariableOrOptional[JobRunLifecycle] = None
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed and when the run re-fires.
+    """
+
+    only: VariableOrList[str] = field(default_factory=list)
+    """
+    A list of task keys to run inside of the job. If this field is not provided, all tasks in the job will be run.
+    
+    Prefix a task key with `+` to also run its upstream tasks, or suffix it with `+` to also run its downstream tasks.
+    For example, `+my_task` runs `my_task` and everything upstream of it, `my_task+` runs `my_task` and everything
+    downstream of it, and `+my_task+` runs both. A task key with no `+` runs only that task.
+    """
+
+    performance_target: VariableOrOptional[PerformanceTarget] = None
+    """
+    The performance mode on a serverless job. The performance target determines the level of compute performance or cost-efficiency for the run. This field overrides the performance target defined on the job level.
+    
+    * `PERFORMANCE_OPTIMIZED`: Prioritizes fast startup and execution times through rapid scaling and optimized cluster performance.
+    * `STANDARD`: Enables cost-efficient execution of serverless workloads.
+    * `COST_OPTIMIZED`: Enables lower job costs by optimizing compute for your selected target duration time. Must provide a duration target.
+    """
+
+    pipeline_params: VariableOrOptional[PipelineParams] = None
+    """
+    Controls whether the pipeline should perform a full refresh
+    """
+
+    queue: VariableOrOptional[QueueSettings] = None
+    """
+    The queue settings of the run.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "JobRunDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "JobRunDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class JobRunDict(TypedDict, total=False):
+    """"""
+
+    job_id: VariableOr[int]
+    """
+    The ID of the job to be executed
+    """
+
+    duration_target: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The window the run aims to finish within, in hours, for a Cost-optimized serverless run.
+    Required only when `performance_target` is `COST_OPTIMIZED`. Must be one of the
+    supported values: `NO_FLEXIBILITY`, `4h`, `12h`, `24h`, `72h`. `NO_FLEXIBILITY` means the run
+    uses the default cost-optimized performance level without additional cost-saving optimizations.
+    """
+
+    job_parameters: VariableOrDict[str]
+    """
+    Job-level parameters used in the run. for example `"param": "overriding_val"`
+    """
+
+    lifecycle: VariableOrOptional[JobRunLifecycleParam]
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed and when the run re-fires.
+    """
+
+    only: VariableOrList[str]
+    """
+    A list of task keys to run inside of the job. If this field is not provided, all tasks in the job will be run.
+    
+    Prefix a task key with `+` to also run its upstream tasks, or suffix it with `+` to also run its downstream tasks.
+    For example, `+my_task` runs `my_task` and everything upstream of it, `my_task+` runs `my_task` and everything
+    downstream of it, and `+my_task+` runs both. A task key with no `+` runs only that task.
+    """
+
+    performance_target: VariableOrOptional[PerformanceTargetParam]
+    """
+    The performance mode on a serverless job. The performance target determines the level of compute performance or cost-efficiency for the run. This field overrides the performance target defined on the job level.
+    
+    * `PERFORMANCE_OPTIMIZED`: Prioritizes fast startup and execution times through rapid scaling and optimized cluster performance.
+    * `STANDARD`: Enables cost-efficient execution of serverless workloads.
+    * `COST_OPTIMIZED`: Enables lower job costs by optimizing compute for your selected target duration time. Must provide a duration target.
+    """
+
+    pipeline_params: VariableOrOptional[PipelineParamsParam]
+    """
+    Controls whether the pipeline should perform a full refresh
+    """
+
+    queue: VariableOrOptional[QueueSettingsParam]
+    """
+    The queue settings of the run.
+    """
+
+
+JobRunParam = JobRunDict | JobRun
diff --git a/python/databricks/bundles/job_runs/_models/job_run_lifecycle.py b/python/databricks/bundles/job_runs/_models/job_run_lifecycle.py
new file mode 100644
index 00000000000..cb673b0245d
--- /dev/null
+++ b/python/databricks/bundles/job_runs/_models/job_run_lifecycle.py
@@ -0,0 +1,54 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
+from databricks.bundles.job_runs._models.job_run_trigger import (
+    JobRunTrigger,
+    JobRunTriggerParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class JobRunLifecycle:
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool] = None
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+    triggers: VariableOrList[JobRunTrigger] = field(default_factory=list)
+    """
+    Conditions that re-fire this job run (in addition to configuration changes).
+    """
+
+    @classmethod
+    def from_dict(cls, value: "JobRunLifecycleDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "JobRunLifecycleDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class JobRunLifecycleDict(TypedDict, total=False):
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool]
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+    triggers: VariableOrList[JobRunTriggerParam]
+    """
+    Conditions that re-fire this job run (in addition to configuration changes).
+    """
+
+
+JobRunLifecycleParam = JobRunLifecycleDict | JobRunLifecycle
diff --git a/python/databricks/bundles/job_runs/_models/job_run_trigger.py b/python/databricks/bundles/job_runs/_models/job_run_trigger.py
new file mode 100644
index 00000000000..75bdf970a4e
--- /dev/null
+++ b/python/databricks/bundles/job_runs/_models/job_run_trigger.py
@@ -0,0 +1,50 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class JobRunTrigger:
+    """"""
+
+    on_bundle_deploy: VariableOrOptional[bool] = None
+    """
+    If true, re-fire the run on every bundle deploy.
+    """
+
+    on_file_change: VariableOrOptional[str] = None
+    """
+    Path or glob relative to the defining YAML file. It must resolve under the sync root. Re-fire the run when a matched file's content hash changes, or when the set of matches appears or disappears. Only files the bundle syncs are hashed, so .gitignore and sync.exclude apply. Use * to match a single directory level; ** is not supported.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "JobRunTriggerDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "JobRunTriggerDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class JobRunTriggerDict(TypedDict, total=False):
+    """"""
+
+    on_bundle_deploy: VariableOrOptional[bool]
+    """
+    If true, re-fire the run on every bundle deploy.
+    """
+
+    on_file_change: VariableOrOptional[str]
+    """
+    Path or glob relative to the defining YAML file. It must resolve under the sync root. Re-fire the run when a matched file's content hash changes, or when the set of matches appears or disappears. Only files the bundle syncs are hashed, so .gitignore and sync.exclude apply. Use * to match a single directory level; ** is not supported.
+    """
+
+
+JobRunTriggerParam = JobRunTriggerDict | JobRunTrigger
diff --git a/python/databricks/bundles/job_runs/_models/performance_target.py b/python/databricks/bundles/job_runs/_models/performance_target.py
new file mode 100644
index 00000000000..8dbe7e4a435
--- /dev/null
+++ b/python/databricks/bundles/job_runs/_models/performance_target.py
@@ -0,0 +1,20 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class PerformanceTarget(Enum):
+    """
+    PerformanceTarget defines how performant (lower latency) or cost efficient the execution of run on serverless compute should be.
+    The performance mode on the job or pipeline should map to a performance setting that is passed to Cluster Manager
+    (see cluster-common PerformanceTarget).
+    """
+
+    PERFORMANCE_OPTIMIZED = "PERFORMANCE_OPTIMIZED"
+    STANDARD = "STANDARD"
+
+
+PerformanceTargetParam = (
+    Literal["PERFORMANCE_OPTIMIZED", "STANDARD"] | PerformanceTarget
+)
diff --git a/python/databricks/bundles/job_runs/_models/pipeline_params.py b/python/databricks/bundles/job_runs/_models/pipeline_params.py
new file mode 100644
index 00000000000..98550f271fb
--- /dev/null
+++ b/python/databricks/bundles/job_runs/_models/pipeline_params.py
@@ -0,0 +1,82 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class PipelineParams:
+    """"""
+
+    full_refresh: VariableOrOptional[bool] = None
+    """
+    If true, triggers a full refresh on the spark declarative pipeline.
+    """
+
+    full_refresh_selection: VariableOrList[str] = field(default_factory=list)
+    """
+    A list of tables to update with fullRefresh.
+    """
+
+    refresh_flow_selection: VariableOrList[str] = field(default_factory=list)
+    """
+    Flow names to selectively refresh. These are unioned with other selective refresh
+    options (refresh_selection, full_refresh_selection) to determine the final set of flows to refresh.
+    """
+
+    refresh_selection: VariableOrList[str] = field(default_factory=list)
+    """
+    A list of tables to update without fullRefresh.
+    """
+
+    reset_checkpoint_selection: VariableOrList[str] = field(default_factory=list)
+    """
+    A list of streaming flows to reset checkpoints without clearing data.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "PipelineParamsDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "PipelineParamsDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class PipelineParamsDict(TypedDict, total=False):
+    """"""
+
+    full_refresh: VariableOrOptional[bool]
+    """
+    If true, triggers a full refresh on the spark declarative pipeline.
+    """
+
+    full_refresh_selection: VariableOrList[str]
+    """
+    A list of tables to update with fullRefresh.
+    """
+
+    refresh_flow_selection: VariableOrList[str]
+    """
+    Flow names to selectively refresh. These are unioned with other selective refresh
+    options (refresh_selection, full_refresh_selection) to determine the final set of flows to refresh.
+    """
+
+    refresh_selection: VariableOrList[str]
+    """
+    A list of tables to update without fullRefresh.
+    """
+
+    reset_checkpoint_selection: VariableOrList[str]
+    """
+    A list of streaming flows to reset checkpoints without clearing data.
+    """
+
+
+PipelineParamsParam = PipelineParamsDict | PipelineParams
diff --git a/python/databricks/bundles/job_runs/_models/queue_settings.py b/python/databricks/bundles/job_runs/_models/queue_settings.py
new file mode 100644
index 00000000000..a72921aed96
--- /dev/null
+++ b/python/databricks/bundles/job_runs/_models/queue_settings.py
@@ -0,0 +1,40 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class QueueSettings:
+    """"""
+
+    enabled: VariableOr[bool]
+    """
+    If true, enable queueing for the job. This is a required field.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "QueueSettingsDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "QueueSettingsDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class QueueSettingsDict(TypedDict, total=False):
+    """"""
+
+    enabled: VariableOr[bool]
+    """
+    If true, enable queueing for the job. This is a required field.
+    """
+
+
+QueueSettingsParam = QueueSettingsDict | QueueSettings
diff --git a/python/databricks/bundles/jobs/__init__.py b/python/databricks/bundles/jobs/__init__.py
index 4b9bd26d8b6..1df8be62977 100644
--- a/python/databricks/bundles/jobs/__init__.py
+++ b/python/databricks/bundles/jobs/__init__.py
@@ -1,7 +1,14 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 __all__ = [
     "Adlsgen2Info",
     "Adlsgen2InfoDict",
     "Adlsgen2InfoParam",
+    "AiRuntimeTask",
+    "AiRuntimeTaskDict",
+    "AiRuntimeTaskParam",
+    "AiRuntimeTaskPriorityClass",
+    "AiRuntimeTaskPriorityClassParam",
     "AlertTask",
     "AlertTaskDict",
     "AlertTaskParam",
@@ -41,6 +48,11 @@
     "ComputeConfigParam",
     "ComputeDict",
     "ComputeParam",
+    "ComputeSpec",
+    "ComputeSpecAcceleratorType",
+    "ComputeSpecAcceleratorTypeParam",
+    "ComputeSpecDict",
+    "ComputeSpecParam",
     "Condition",
     "ConditionParam",
     "ConditionTask",
@@ -48,17 +60,27 @@
     "ConditionTaskOp",
     "ConditionTaskOpParam",
     "ConditionTaskParam",
+    "ConfidentialComputeType",
+    "ConfidentialComputeTypeParam",
     "Continuous",
     "ContinuousDict",
     "ContinuousParam",
+    "ContinuousTriggerConfiguration",
+    "ContinuousTriggerConfigurationDict",
+    "ContinuousTriggerConfigurationParam",
     "CronSchedule",
     "CronScheduleDict",
     "CronScheduleParam",
+    "CronTriggerConfiguration",
+    "CronTriggerConfigurationDict",
+    "CronTriggerConfigurationParam",
     "DashboardTask",
     "DashboardTaskDict",
     "DashboardTaskParam",
     "DataSecurityMode",
     "DataSecurityModeParam",
+    "DayOfWeek",
+    "DayOfWeekParam",
     "DbfsStorageInfo",
     "DbfsStorageInfoDict",
     "DbfsStorageInfoParam",
@@ -68,6 +90,11 @@
     "DbtTask",
     "DbtTaskDict",
     "DbtTaskParam",
+    "DependencyMode",
+    "DependencyModeParam",
+    "DeploymentSpec",
+    "DeploymentSpecDict",
+    "DeploymentSpecParam",
     "DockerBasicAuth",
     "DockerBasicAuthDict",
     "DockerBasicAuthParam",
@@ -117,6 +144,12 @@
     "JobEnvironment",
     "JobEnvironmentDict",
     "JobEnvironmentParam",
+    "JobEnvironmentVariables",
+    "JobEnvironmentVariablesDict",
+    "JobEnvironmentVariablesParam",
+    "JobEnvironmentVariablesSpec",
+    "JobEnvironmentVariablesSpecDict",
+    "JobEnvironmentVariablesSpecParam",
     "JobNotificationSettings",
     "JobNotificationSettingsDict",
     "JobNotificationSettingsParam",
@@ -156,6 +189,9 @@
     "LogAnalyticsInfo",
     "LogAnalyticsInfoDict",
     "LogAnalyticsInfoParam",
+    "MaintenanceWindow",
+    "MaintenanceWindowDict",
+    "MaintenanceWindowParam",
     "MavenLibrary",
     "MavenLibraryDict",
     "MavenLibraryParam",
@@ -194,6 +230,12 @@
     "PowerBiTask",
     "PowerBiTaskDict",
     "PowerBiTaskParam",
+    "PythonOperatorTask",
+    "PythonOperatorTaskDict",
+    "PythonOperatorTaskParam",
+    "PythonOperatorTaskParameter",
+    "PythonOperatorTaskParameterDict",
+    "PythonOperatorTaskParameterParam",
     "PythonPyPiLibrary",
     "PythonPyPiLibraryDict",
     "PythonPyPiLibraryParam",
@@ -230,6 +272,11 @@
     "SparseCheckout",
     "SparseCheckoutDict",
     "SparseCheckoutParam",
+    "SqlConditionConfiguration",
+    "SqlConditionConfigurationDict",
+    "SqlConditionConfigurationParam",
+    "SqlConditionTriggerMode",
+    "SqlConditionTriggerModeParam",
     "SqlTask",
     "SqlTaskAlert",
     "SqlTaskAlertDict",
@@ -251,6 +298,22 @@
     "StorageMode",
     "StorageModeParam",
     "Subscription",
+    "SubscriptionAttachment",
+    "SubscriptionAttachmentDataAttachment",
+    "SubscriptionAttachmentDataAttachmentDict",
+    "SubscriptionAttachmentDataAttachmentFileFormat",
+    "SubscriptionAttachmentDataAttachmentFileFormatParam",
+    "SubscriptionAttachmentDataAttachmentParam",
+    "SubscriptionAttachmentDataAttachmentWidget",
+    "SubscriptionAttachmentDataAttachmentWidgetDict",
+    "SubscriptionAttachmentDataAttachmentWidgetParam",
+    "SubscriptionAttachmentDict",
+    "SubscriptionAttachmentPageAttachment",
+    "SubscriptionAttachmentPageAttachmentDict",
+    "SubscriptionAttachmentPageAttachmentPageSelection",
+    "SubscriptionAttachmentPageAttachmentPageSelectionParam",
+    "SubscriptionAttachmentPageAttachmentParam",
+    "SubscriptionAttachmentParam",
     "SubscriptionDict",
     "SubscriptionParam",
     "SubscriptionSubscriber",
@@ -273,6 +336,9 @@
     "TaskParam",
     "TaskRetryMode",
     "TaskRetryModeParam",
+    "TriggerConfiguration",
+    "TriggerConfigurationDict",
+    "TriggerConfigurationParam",
     "TriggerSettings",
     "TriggerSettingsDict",
     "TriggerSettingsParam",
@@ -299,6 +365,15 @@
     Adlsgen2InfoDict,
     Adlsgen2InfoParam,
 )
+from databricks.bundles.jobs._models.ai_runtime_task import (
+    AiRuntimeTask,
+    AiRuntimeTaskDict,
+    AiRuntimeTaskParam,
+)
+from databricks.bundles.jobs._models.ai_runtime_task_priority_class import (
+    AiRuntimeTaskPriorityClass,
+    AiRuntimeTaskPriorityClassParam,
+)
 from databricks.bundles.jobs._models.alert_task import (
     AlertTask,
     AlertTaskDict,
@@ -362,6 +437,15 @@
     ComputeConfigDict,
     ComputeConfigParam,
 )
+from databricks.bundles.jobs._models.compute_spec import (
+    ComputeSpec,
+    ComputeSpecDict,
+    ComputeSpecParam,
+)
+from databricks.bundles.jobs._models.compute_spec_accelerator_type import (
+    ComputeSpecAcceleratorType,
+    ComputeSpecAcceleratorTypeParam,
+)
 from databricks.bundles.jobs._models.condition import Condition, ConditionParam
 from databricks.bundles.jobs._models.condition_task import (
     ConditionTask,
@@ -372,16 +456,30 @@
     ConditionTaskOp,
     ConditionTaskOpParam,
 )
+from databricks.bundles.jobs._models.confidential_compute_type import (
+    ConfidentialComputeType,
+    ConfidentialComputeTypeParam,
+)
 from databricks.bundles.jobs._models.continuous import (
     Continuous,
     ContinuousDict,
     ContinuousParam,
 )
+from databricks.bundles.jobs._models.continuous_trigger_configuration import (
+    ContinuousTriggerConfiguration,
+    ContinuousTriggerConfigurationDict,
+    ContinuousTriggerConfigurationParam,
+)
 from databricks.bundles.jobs._models.cron_schedule import (
     CronSchedule,
     CronScheduleDict,
     CronScheduleParam,
 )
+from databricks.bundles.jobs._models.cron_trigger_configuration import (
+    CronTriggerConfiguration,
+    CronTriggerConfigurationDict,
+    CronTriggerConfigurationParam,
+)
 from databricks.bundles.jobs._models.dashboard_task import (
     DashboardTask,
     DashboardTaskDict,
@@ -391,6 +489,7 @@
     DataSecurityMode,
     DataSecurityModeParam,
 )
+from databricks.bundles.jobs._models.day_of_week import DayOfWeek, DayOfWeekParam
 from databricks.bundles.jobs._models.dbfs_storage_info import (
     DbfsStorageInfo,
     DbfsStorageInfoDict,
@@ -402,6 +501,15 @@
     DbtPlatformTaskParam,
 )
 from databricks.bundles.jobs._models.dbt_task import DbtTask, DbtTaskDict, DbtTaskParam
+from databricks.bundles.jobs._models.dependency_mode import (
+    DependencyMode,
+    DependencyModeParam,
+)
+from databricks.bundles.jobs._models.deployment_spec import (
+    DeploymentSpec,
+    DeploymentSpecDict,
+    DeploymentSpecParam,
+)
 from databricks.bundles.jobs._models.docker_basic_auth import (
     DockerBasicAuth,
     DockerBasicAuthDict,
@@ -481,6 +589,16 @@
     JobEnvironmentDict,
     JobEnvironmentParam,
 )
+from databricks.bundles.jobs._models.job_environment_variables import (
+    JobEnvironmentVariables,
+    JobEnvironmentVariablesDict,
+    JobEnvironmentVariablesParam,
+)
+from databricks.bundles.jobs._models.job_environment_variables_spec import (
+    JobEnvironmentVariablesSpec,
+    JobEnvironmentVariablesSpecDict,
+    JobEnvironmentVariablesSpecParam,
+)
 from databricks.bundles.jobs._models.job_notification_settings import (
     JobNotificationSettings,
     JobNotificationSettingsDict,
@@ -540,6 +658,11 @@
     LogAnalyticsInfoDict,
     LogAnalyticsInfoParam,
 )
+from databricks.bundles.jobs._models.maintenance_window import (
+    MaintenanceWindow,
+    MaintenanceWindowDict,
+    MaintenanceWindowParam,
+)
 from databricks.bundles.jobs._models.maven_library import (
     MavenLibrary,
     MavenLibraryDict,
@@ -603,6 +726,16 @@
     PowerBiTaskDict,
     PowerBiTaskParam,
 )
+from databricks.bundles.jobs._models.python_operator_task import (
+    PythonOperatorTask,
+    PythonOperatorTaskDict,
+    PythonOperatorTaskParam,
+)
+from databricks.bundles.jobs._models.python_operator_task_parameter import (
+    PythonOperatorTaskParameter,
+    PythonOperatorTaskParameterDict,
+    PythonOperatorTaskParameterParam,
+)
 from databricks.bundles.jobs._models.python_py_pi_library import (
     PythonPyPiLibrary,
     PythonPyPiLibraryDict,
@@ -659,6 +792,15 @@
     SparseCheckoutDict,
     SparseCheckoutParam,
 )
+from databricks.bundles.jobs._models.sql_condition_configuration import (
+    SqlConditionConfiguration,
+    SqlConditionConfigurationDict,
+    SqlConditionConfigurationParam,
+)
+from databricks.bundles.jobs._models.sql_condition_trigger_mode import (
+    SqlConditionTriggerMode,
+    SqlConditionTriggerModeParam,
+)
 from databricks.bundles.jobs._models.sql_task import SqlTask, SqlTaskDict, SqlTaskParam
 from databricks.bundles.jobs._models.sql_task_alert import (
     SqlTaskAlert,
@@ -691,6 +833,34 @@
     SubscriptionDict,
     SubscriptionParam,
 )
+from databricks.bundles.jobs._models.subscription_attachment import (
+    SubscriptionAttachment,
+    SubscriptionAttachmentDict,
+    SubscriptionAttachmentParam,
+)
+from databricks.bundles.jobs._models.subscription_attachment_data_attachment import (
+    SubscriptionAttachmentDataAttachment,
+    SubscriptionAttachmentDataAttachmentDict,
+    SubscriptionAttachmentDataAttachmentParam,
+)
+from databricks.bundles.jobs._models.subscription_attachment_data_attachment_file_format import (
+    SubscriptionAttachmentDataAttachmentFileFormat,
+    SubscriptionAttachmentDataAttachmentFileFormatParam,
+)
+from databricks.bundles.jobs._models.subscription_attachment_data_attachment_widget import (
+    SubscriptionAttachmentDataAttachmentWidget,
+    SubscriptionAttachmentDataAttachmentWidgetDict,
+    SubscriptionAttachmentDataAttachmentWidgetParam,
+)
+from databricks.bundles.jobs._models.subscription_attachment_page_attachment import (
+    SubscriptionAttachmentPageAttachment,
+    SubscriptionAttachmentPageAttachmentDict,
+    SubscriptionAttachmentPageAttachmentParam,
+)
+from databricks.bundles.jobs._models.subscription_attachment_page_attachment_page_selection import (
+    SubscriptionAttachmentPageAttachmentPageSelection,
+    SubscriptionAttachmentPageAttachmentPageSelectionParam,
+)
 from databricks.bundles.jobs._models.subscription_subscriber import (
     SubscriptionSubscriber,
     SubscriptionSubscriberDict,
@@ -721,6 +891,11 @@
     TaskRetryMode,
     TaskRetryModeParam,
 )
+from databricks.bundles.jobs._models.trigger_configuration import (
+    TriggerConfiguration,
+    TriggerConfigurationDict,
+    TriggerConfigurationParam,
+)
 from databricks.bundles.jobs._models.trigger_settings import (
     TriggerSettings,
     TriggerSettingsDict,
diff --git a/python/databricks/bundles/jobs/_models/adlsgen2_info.py b/python/databricks/bundles/jobs/_models/adlsgen2_info.py
index 206c8b676ec..87c883adeb9 100644
--- a/python/databricks/bundles/jobs/_models/adlsgen2_info.py
+++ b/python/databricks/bundles/jobs/_models/adlsgen2_info.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/ai_runtime_task.py b/python/databricks/bundles/jobs/_models/ai_runtime_task.py
new file mode 100644
index 00000000000..09144f23c83
--- /dev/null
+++ b/python/databricks/bundles/jobs/_models/ai_runtime_task.py
@@ -0,0 +1,217 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import (
+    VariableOr,
+    VariableOrList,
+    VariableOrOptional,
+)
+from databricks.bundles.jobs._models.ai_runtime_task_priority_class import (
+    AiRuntimeTaskPriorityClass,
+    AiRuntimeTaskPriorityClassParam,
+)
+from databricks.bundles.jobs._models.deployment_spec import (
+    DeploymentSpec,
+    DeploymentSpecParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AiRuntimeTask:
+    """
+    AiRuntimeTask: multi-node GPU compute task definition for Databricks AI
+    Runtime workloads.
+
+    Jobs-framework-level concepts (retries, per-task timeout, idempotency
+    token, usage/budget policy, permissions) live on the surrounding
+    TaskSettings / run-submit request and are intentionally NOT duplicated
+    here. Users compose `ai_runtime_task` with the standard Jobs/DABs task
+    wrapper to get those.
+    """
+
+    experiment: VariableOr[str]
+    """
+    [Public Preview] MLflow experiment name for this run. If an experiment with this name
+    already exists under the calling user, the run is appended to it;
+    otherwise a new experiment is created. To target a specific MLflow
+    storage location (for example, when running as a service principal), set
+    `mlflow_experiment_directory`.
+    """
+
+    code_source_path: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Workspace or UC volume path of the code-source archive, unpacked on
+    each node and exposed through `$CODE_SOURCE`. Set by first-party
+    tooling; not for direct callers.
+    """
+
+    deployments: VariableOrList[DeploymentSpec] = field(default_factory=list)
+    """
+    [Public Preview] Deployment specs for this task. Exactly one deployment is currently
+    supported (a single entry where every node runs the same command); this
+    is a current-Preview constraint. Role-split workloads (driver + worker,
+    parameter server, separate eval node, etc.) with multiple entries are the
+    eventual intent but not yet supported.
+    """
+
+    docker_image_url: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Optional Docker image URL for a custom container image. When set,
+    the task runs on the specified container image instead of the default
+    Databricks client image. Format:
+    `{organization}/{repository}:{tag}`
+    """
+
+    mlflow_artifact_location: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Optional root location for MLflow artifacts logged by the run.
+    If this field isn't specified the default artifact location will be in dbfs
+    i.e. `dbfs:/databricks/mlflow-tracking/<experiment_id>/...`
+    If dbfs access is restricted or UC is preferred this can be a custom location in UC:
+    `dbfs:/Volumes/<catalog>/<schema>/<volume>/...`
+    The location should be unique for each experiment.
+    """
+
+    mlflow_experiment_directory: VariableOrOptional[str] = None
+    """
+    [Public Preview] Optional workspace directory under which the MLflow experiment named in
+    `experiment` is created. Must start with `/Workspace`. Set this when
+    running as a service principal that has no default user directory; for
+    regular users the experiment defaults to the user's home directory.
+    """
+
+    mlflow_run: VariableOrOptional[str] = None
+    """
+    [Public Preview] Optional display name for the MLflow run created under `experiment`. If
+    omitted, MLflow generates a default name.
+    """
+
+    priority_class: VariableOrOptional[AiRuntimeTaskPriorityClass] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Scheduling priority class for the workload. May only be set together with
+    a pre-provisioned capacity reservation (a deployment's
+    `compute.provisioned_capacity_id`); it is rejected on a workload that runs
+    on on-demand capacity.
+    """
+
+    unity_catalog_image_path: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Optional Unity Catalog path for a custom container image. When set,
+    the task runs on the specified container image instead of the default
+    Databricks client image. Format:
+    `{catalog}.{schema}.{image_name}:{tag}`
+    """
+
+    @classmethod
+    def from_dict(cls, value: "AiRuntimeTaskDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AiRuntimeTaskDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AiRuntimeTaskDict(TypedDict, total=False):
+    """"""
+
+    experiment: VariableOr[str]
+    """
+    [Public Preview] MLflow experiment name for this run. If an experiment with this name
+    already exists under the calling user, the run is appended to it;
+    otherwise a new experiment is created. To target a specific MLflow
+    storage location (for example, when running as a service principal), set
+    `mlflow_experiment_directory`.
+    """
+
+    code_source_path: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Workspace or UC volume path of the code-source archive, unpacked on
+    each node and exposed through `$CODE_SOURCE`. Set by first-party
+    tooling; not for direct callers.
+    """
+
+    deployments: VariableOrList[DeploymentSpecParam]
+    """
+    [Public Preview] Deployment specs for this task. Exactly one deployment is currently
+    supported (a single entry where every node runs the same command); this
+    is a current-Preview constraint. Role-split workloads (driver + worker,
+    parameter server, separate eval node, etc.) with multiple entries are the
+    eventual intent but not yet supported.
+    """
+
+    docker_image_url: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Optional Docker image URL for a custom container image. When set,
+    the task runs on the specified container image instead of the default
+    Databricks client image. Format:
+    `{organization}/{repository}:{tag}`
+    """
+
+    mlflow_artifact_location: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Optional root location for MLflow artifacts logged by the run.
+    If this field isn't specified the default artifact location will be in dbfs
+    i.e. `dbfs:/databricks/mlflow-tracking/<experiment_id>/...`
+    If dbfs access is restricted or UC is preferred this can be a custom location in UC:
+    `dbfs:/Volumes/<catalog>/<schema>/<volume>/...`
+    The location should be unique for each experiment.
+    """
+
+    mlflow_experiment_directory: VariableOrOptional[str]
+    """
+    [Public Preview] Optional workspace directory under which the MLflow experiment named in
+    `experiment` is created. Must start with `/Workspace`. Set this when
+    running as a service principal that has no default user directory; for
+    regular users the experiment defaults to the user's home directory.
+    """
+
+    mlflow_run: VariableOrOptional[str]
+    """
+    [Public Preview] Optional display name for the MLflow run created under `experiment`. If
+    omitted, MLflow generates a default name.
+    """
+
+    priority_class: VariableOrOptional[AiRuntimeTaskPriorityClassParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Scheduling priority class for the workload. May only be set together with
+    a pre-provisioned capacity reservation (a deployment's
+    `compute.provisioned_capacity_id`); it is rejected on a workload that runs
+    on on-demand capacity.
+    """
+
+    unity_catalog_image_path: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Optional Unity Catalog path for a custom container image. When set,
+    the task runs on the specified container image instead of the default
+    Databricks client image. Format:
+    `{catalog}.{schema}.{image_name}:{tag}`
+    """
+
+
+AiRuntimeTaskParam = AiRuntimeTaskDict | AiRuntimeTask
diff --git a/python/databricks/bundles/jobs/_models/ai_runtime_task_priority_class.py b/python/databricks/bundles/jobs/_models/ai_runtime_task_priority_class.py
new file mode 100644
index 00000000000..1dd09afd131
--- /dev/null
+++ b/python/databricks/bundles/jobs/_models/ai_runtime_task_priority_class.py
@@ -0,0 +1,22 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class AiRuntimeTaskPriorityClass(Enum):
+    """
+    :meta private: [EXPERIMENTAL]
+
+    Scheduling priority class for a workload — its priority and preemptability
+    when the scheduler ranks pending work.
+    """
+
+    BEST_EFFORT = "BEST_EFFORT"
+    NORMAL = "NORMAL"
+    CRITICAL = "CRITICAL"
+
+
+AiRuntimeTaskPriorityClassParam = (
+    Literal["BEST_EFFORT", "NORMAL", "CRITICAL"] | AiRuntimeTaskPriorityClass
+)
diff --git a/python/databricks/bundles/jobs/_models/alert_task.py b/python/databricks/bundles/jobs/_models/alert_task.py
index b044b797780..4f3b0d97611 100644
--- a/python/databricks/bundles/jobs/_models/alert_task.py
+++ b/python/databricks/bundles/jobs/_models/alert_task.py
@@ -1,9 +1,15 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
 from databricks.bundles.core._transform import _transform
 from databricks.bundles.core._transform_to_json import _transform_to_json_value
-from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
+from databricks.bundles.core._variable import (
+    VariableOrDict,
+    VariableOrList,
+    VariableOrOptional,
+)
 from databricks.bundles.jobs._models.alert_task_subscriber import (
     AlertTaskSubscriber,
     AlertTaskSubscriberParam,
@@ -19,23 +25,35 @@ class AlertTask:
 
     alert_id: VariableOrOptional[str] = None
     """
-    The alert_id is the canonical identifier of the alert.
+    [Public Preview] The alert_id is the canonical identifier of the alert.
+    """
+
+    parameters: VariableOrDict[str] = field(default_factory=dict)
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Per-run parameter overrides, keyed by parameter name, applied onto the alert's stored
+    query parameters before the query is executed. Only scalar values are supported. Values
+    may reference job parameters with `{{job.parameters.*}}`, which are resolved before the
+    task runs. An override whose key does not match a stored parameter fails the task run.
+    Limited to 10000 characters when serialized as JSON; keys must be 1-100 characters and
+    contain only letters, digits, underscores, dashes, and periods.
     """
 
     subscribers: VariableOrList[AlertTaskSubscriber] = field(default_factory=list)
     """
-    The subscribers receive alert evaluation result notifications after the alert task is completed.
+    [Public Preview] The subscribers receive alert evaluation result notifications after the alert task is completed.
     The number of subscriptions is limited to 100.
     """
 
     warehouse_id: VariableOrOptional[str] = None
     """
-    The warehouse_id identifies the warehouse settings used by the alert task.
+    [Public Preview] The warehouse_id identifies the warehouse settings used by the alert task.
     """
 
     workspace_path: VariableOrOptional[str] = None
     """
-    The workspace_path is the path to the alert file in the workspace. The path:
+    [Public Preview] The workspace_path is the path to the alert file in the workspace. The path:
     * must start with "/Workspace"
     * must be a normalized path.
     User has to select only one of alert_id or workspace_path to identify the alert.
@@ -54,23 +72,35 @@ class AlertTaskDict(TypedDict, total=False):
 
     alert_id: VariableOrOptional[str]
     """
-    The alert_id is the canonical identifier of the alert.
+    [Public Preview] The alert_id is the canonical identifier of the alert.
+    """
+
+    parameters: VariableOrDict[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Per-run parameter overrides, keyed by parameter name, applied onto the alert's stored
+    query parameters before the query is executed. Only scalar values are supported. Values
+    may reference job parameters with `{{job.parameters.*}}`, which are resolved before the
+    task runs. An override whose key does not match a stored parameter fails the task run.
+    Limited to 10000 characters when serialized as JSON; keys must be 1-100 characters and
+    contain only letters, digits, underscores, dashes, and periods.
     """
 
     subscribers: VariableOrList[AlertTaskSubscriberParam]
     """
-    The subscribers receive alert evaluation result notifications after the alert task is completed.
+    [Public Preview] The subscribers receive alert evaluation result notifications after the alert task is completed.
     The number of subscriptions is limited to 100.
     """
 
     warehouse_id: VariableOrOptional[str]
     """
-    The warehouse_id identifies the warehouse settings used by the alert task.
+    [Public Preview] The warehouse_id identifies the warehouse settings used by the alert task.
     """
 
     workspace_path: VariableOrOptional[str]
     """
-    The workspace_path is the path to the alert file in the workspace. The path:
+    [Public Preview] The workspace_path is the path to the alert file in the workspace. The path:
     * must start with "/Workspace"
     * must be a normalized path.
     User has to select only one of alert_id or workspace_path to identify the alert.
diff --git a/python/databricks/bundles/jobs/_models/alert_task_subscriber.py b/python/databricks/bundles/jobs/_models/alert_task_subscriber.py
index a66936f9b40..3805069edcf 100644
--- a/python/databricks/bundles/jobs/_models/alert_task_subscriber.py
+++ b/python/databricks/bundles/jobs/_models/alert_task_subscriber.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -17,10 +19,13 @@ class AlertTaskSubscriber:
     """
 
     destination_id: VariableOrOptional[str] = None
+    """
+    [Public Preview]
+    """
 
     user_name: VariableOrOptional[str] = None
     """
-    A valid workspace email address.
+    [Public Preview] A valid workspace email address.
     """
 
     @classmethod
@@ -35,10 +40,13 @@ class AlertTaskSubscriberDict(TypedDict, total=False):
     """"""
 
     destination_id: VariableOrOptional[str]
+    """
+    [Public Preview]
+    """
 
     user_name: VariableOrOptional[str]
     """
-    A valid workspace email address.
+    [Public Preview] A valid workspace email address.
     """
 
 
diff --git a/python/databricks/bundles/jobs/_models/authentication_method.py b/python/databricks/bundles/jobs/_models/authentication_method.py
index 68be0e62184..ba7b603d8d5 100644
--- a/python/databricks/bundles/jobs/_models/authentication_method.py
+++ b/python/databricks/bundles/jobs/_models/authentication_method.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
diff --git a/python/databricks/bundles/jobs/_models/auto_scale.py b/python/databricks/bundles/jobs/_models/auto_scale.py
index 6a07ee8b0b1..10ca50c26d7 100644
--- a/python/databricks/bundles/jobs/_models/auto_scale.py
+++ b/python/databricks/bundles/jobs/_models/auto_scale.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/aws_attributes.py b/python/databricks/bundles/jobs/_models/aws_attributes.py
index 62ddf7a7653..5eaf7acbed8 100644
--- a/python/databricks/bundles/jobs/_models/aws_attributes.py
+++ b/python/databricks/bundles/jobs/_models/aws_attributes.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -24,6 +26,11 @@ class AwsAttributes:
     """
 
     availability: VariableOrOptional[AwsAvailability] = None
+    """
+    Availability type used for all subsequent nodes past the `first_on_demand` ones.
+    
+    Note: If `first_on_demand` is zero, this availability type will be used for the entire cluster.
+    """
 
     ebs_volume_count: VariableOrOptional[int] = None
     """
@@ -63,6 +70,9 @@ class AwsAttributes:
     """
 
     ebs_volume_type: VariableOrOptional[EbsVolumeType] = None
+    """
+    The type of EBS volumes that will be launched with this cluster.
+    """
 
     first_on_demand: VariableOrOptional[int] = None
     """
@@ -124,6 +134,11 @@ class AwsAttributesDict(TypedDict, total=False):
     """"""
 
     availability: VariableOrOptional[AwsAvailabilityParam]
+    """
+    Availability type used for all subsequent nodes past the `first_on_demand` ones.
+    
+    Note: If `first_on_demand` is zero, this availability type will be used for the entire cluster.
+    """
 
     ebs_volume_count: VariableOrOptional[int]
     """
@@ -163,6 +178,9 @@ class AwsAttributesDict(TypedDict, total=False):
     """
 
     ebs_volume_type: VariableOrOptional[EbsVolumeTypeParam]
+    """
+    The type of EBS volumes that will be launched with this cluster.
+    """
 
     first_on_demand: VariableOrOptional[int]
     """
diff --git a/python/databricks/bundles/jobs/_models/aws_availability.py b/python/databricks/bundles/jobs/_models/aws_availability.py
index 5d87ffafbac..4c3810f067e 100644
--- a/python/databricks/bundles/jobs/_models/aws_availability.py
+++ b/python/databricks/bundles/jobs/_models/aws_availability.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
diff --git a/python/databricks/bundles/jobs/_models/azure_attributes.py b/python/databricks/bundles/jobs/_models/azure_attributes.py
index f82a0698aa6..64509dcd040 100644
--- a/python/databricks/bundles/jobs/_models/azure_attributes.py
+++ b/python/databricks/bundles/jobs/_models/azure_attributes.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -24,6 +26,26 @@ class AzureAttributes:
     """
 
     availability: VariableOrOptional[AzureAvailability] = None
+    """
+    Availability type used for all subsequent nodes past the `first_on_demand` ones.
+    Note: If `first_on_demand` is zero, this availability
+    type will be used for the entire cluster.
+    """
+
+    capacity_reservation_group: VariableOrOptional[str] = None
+    """
+    The Azure capacity reservation group resource ID to use for launching VMs.
+    When specified, VMs will be launched using the provided capacity reservation.
+    
+    Capacity reservations can only be specified when the workspace uses injected vnet (i.e. customer defined vnet not
+    managed by databricks). Ensure the databricks-login-prod Enterprise Application is granted the following four permissions:
+    1. Microsoft.Compute/capacityReservationGroups/read
+    2. Microsoft.Compute/capacityReservationGroups/deploy/action
+    3. Microsoft.Compute/capacityReservationGroups/capacityReservations/read
+    4. Microsoft.Compute/capacityReservationGroups/capacityReservations/deploy/action
+    
+    Format: `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/capacityReservationGroups/{capacityReservationGroupName}`
+    """
 
     first_on_demand: VariableOrOptional[int] = None
     """
@@ -61,6 +83,26 @@ class AzureAttributesDict(TypedDict, total=False):
     """"""
 
     availability: VariableOrOptional[AzureAvailabilityParam]
+    """
+    Availability type used for all subsequent nodes past the `first_on_demand` ones.
+    Note: If `first_on_demand` is zero, this availability
+    type will be used for the entire cluster.
+    """
+
+    capacity_reservation_group: VariableOrOptional[str]
+    """
+    The Azure capacity reservation group resource ID to use for launching VMs.
+    When specified, VMs will be launched using the provided capacity reservation.
+    
+    Capacity reservations can only be specified when the workspace uses injected vnet (i.e. customer defined vnet not
+    managed by databricks). Ensure the databricks-login-prod Enterprise Application is granted the following four permissions:
+    1. Microsoft.Compute/capacityReservationGroups/read
+    2. Microsoft.Compute/capacityReservationGroups/deploy/action
+    3. Microsoft.Compute/capacityReservationGroups/capacityReservations/read
+    4. Microsoft.Compute/capacityReservationGroups/capacityReservations/deploy/action
+    
+    Format: `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/capacityReservationGroups/{capacityReservationGroupName}`
+    """
 
     first_on_demand: VariableOrOptional[int]
     """
diff --git a/python/databricks/bundles/jobs/_models/azure_availability.py b/python/databricks/bundles/jobs/_models/azure_availability.py
index 72d461d5d71..a03cb1fdddf 100644
--- a/python/databricks/bundles/jobs/_models/azure_availability.py
+++ b/python/databricks/bundles/jobs/_models/azure_availability.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
diff --git a/python/databricks/bundles/jobs/_models/clean_rooms_notebook_task.py b/python/databricks/bundles/jobs/_models/clean_rooms_notebook_task.py
index d0281f144ce..52845928fe1 100644
--- a/python/databricks/bundles/jobs/_models/clean_rooms_notebook_task.py
+++ b/python/databricks/bundles/jobs/_models/clean_rooms_notebook_task.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/clients_types.py b/python/databricks/bundles/jobs/_models/clients_types.py
index 6891497e55c..87f92446ba5 100644
--- a/python/databricks/bundles/jobs/_models/clients_types.py
+++ b/python/databricks/bundles/jobs/_models/clients_types.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/cluster_log_conf.py b/python/databricks/bundles/jobs/_models/cluster_log_conf.py
index be698246720..a5ff3dd34f8 100644
--- a/python/databricks/bundles/jobs/_models/cluster_log_conf.py
+++ b/python/databricks/bundles/jobs/_models/cluster_log_conf.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/cluster_spec.py b/python/databricks/bundles/jobs/_models/cluster_spec.py
index a2662c5ca85..2afee23b3ca 100644
--- a/python/databricks/bundles/jobs/_models/cluster_spec.py
+++ b/python/databricks/bundles/jobs/_models/cluster_spec.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
@@ -28,6 +30,10 @@
     DataSecurityMode,
     DataSecurityModeParam,
 )
+from databricks.bundles.jobs._models.dependency_mode import (
+    DependencyMode,
+    DependencyModeParam,
+)
 from databricks.bundles.jobs._models.docker_image import DockerImage, DockerImageParam
 from databricks.bundles.jobs._models.gcp_attributes import (
     GcpAttributes,
@@ -119,8 +125,39 @@ class ClusterSpec:
     """
 
     data_security_mode: VariableOrOptional[DataSecurityMode] = None
+    """
+    Data security mode decides what data governance model to use when accessing data
+    from a cluster.
+    
+    * `DATA_SECURITY_MODE_AUTO`: Databricks will choose the most appropriate access mode depending on your compute configuration.
+    * `DATA_SECURITY_MODE_STANDARD`: A secure cluster that can be shared by multiple users. Cluster users are fully isolated so that they cannot see each other’s data and credentials. Most data governance features are supported in this mode. But programming languages and cluster features might be limited.
+    * `DATA_SECURITY_MODE_DEDICATED`: A secure cluster that can only be exclusively used by a single user specified in `single_user_name`. Most programming languages, cluster features and data governance features are available in this mode.
+    
+    The following modes are legacy aliases for the above modes:
+    
+    * `USER_ISOLATION`: Legacy alias for `DATA_SECURITY_MODE_STANDARD`.
+    * `SINGLE_USER`: Legacy alias for `DATA_SECURITY_MODE_DEDICATED`.
+    
+    The following modes are deprecated starting with Databricks Runtime 15.0 and
+    will be removed for future Databricks Runtime versions:
+    
+    * `LEGACY_TABLE_ACL`: This mode is for users migrating from legacy Table ACL clusters.
+    * `LEGACY_PASSTHROUGH`: This mode is for users migrating from legacy Passthrough on high concurrency clusters.
+    * `LEGACY_SINGLE_USER`: This mode is for users migrating from legacy Passthrough on standard clusters.
+    * `LEGACY_SINGLE_USER_STANDARD`: This mode provides a way that doesn’t have UC nor passthrough enabled.
+    """
+
+    dependency_mode: VariableOrOptional[DependencyMode] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Controls dependency configuration for the cluster.
+    """
 
     docker_image: VariableOrOptional[DockerImage] = None
+    """
+    Custom docker image BYOC
+    """
 
     driver_instance_pool_id: VariableOrOptional[str] = None
     """
@@ -139,9 +176,6 @@ class ClusterSpec:
     The node type of the Spark driver.
     Note that this field is optional; if unset, the driver node type will be set as the same value
     as `node_type_id` defined above.
-    
-    This field, along with node_type_id, should not be set if virtual_cluster_size is set.
-    If both driver_node_type_id, node_type_id, and virtual_cluster_size are specified, driver_node_type_id and node_type_id take precedence.
     """
 
     enable_elastic_disk: VariableOrOptional[bool] = None
@@ -181,13 +215,24 @@ class ClusterSpec:
     """
 
     kind: VariableOrOptional[Kind] = None
+    """
+    The kind of compute described by this compute specification.
+    
+    Depending on `kind`, different validations and default values will be applied.
+    
+    Clusters with `kind = CLASSIC_PREVIEW` support the following fields, whereas clusters with no specified `kind` do not.
+    * [is_single_node](/api/workspace/clusters/create#is_single_node)
+    * [use_ml_runtime](/api/workspace/clusters/create#use_ml_runtime)
+    
+    By using the [simple form](https://docs.databricks.com/compute/simple-form.html), your clusters are automatically using `kind = CLASSIC_PREVIEW`.
+    """
 
     node_type_id: VariableOrOptional[str] = None
     """
     This field encodes, through a single value, the resources available to each of
     the Spark nodes in this cluster. For example, the Spark nodes can be provisioned
     and optimized for memory or compute intensive workloads. A list of available node
-    types can be retrieved by using the :method:clusters/listNodeTypes API call.
+    types can be retrieved by using the [clusters/listNodeTypes](https://docs.databricks.com/api/workspace/clusters/listnodetypes) API call.
     """
 
     num_workers: VariableOrOptional[int] = None
@@ -213,6 +258,15 @@ class ClusterSpec:
     """
 
     runtime_engine: VariableOrOptional[RuntimeEngine] = None
+    """
+    Determines the cluster's runtime engine, either standard or Photon.
+    
+    This field is not compatible with legacy `spark_version` values that contain `-photon-`.
+    Remove `-photon-` from the `spark_version` and set `runtime_engine` to `PHOTON`.
+    
+    If left unspecified, the runtime engine defaults to standard unless the spark_version
+    contains -photon-, in which case Photon will be used.
+    """
 
     single_user_name: VariableOrOptional[str] = None
     """
@@ -245,7 +299,7 @@ class ClusterSpec:
     """
     The Spark version of the cluster, e.g. `3.3.x-scala2.11`.
     A list of available Spark versions can be retrieved by using
-    the :method:clusters/sparkVersions API call.
+    the [clusters/sparkVersions](https://docs.databricks.com/api/workspace/clusters/sparkversions) API call.
     """
 
     ssh_public_keys: VariableOrList[str] = field(default_factory=list)
@@ -257,7 +311,7 @@ class ClusterSpec:
 
     total_initial_remote_disk_size: VariableOrOptional[int] = None
     """
-    If set, what the total initial volume size (in GB) of the remote disks should be. Currently only supported for GCP HYPERDISK_BALANCED disks.
+    If set, what the total initial volume size (in GB) of the remote disks should be. Supported for GCP.
     """
 
     use_ml_runtime: VariableOrOptional[bool] = None
@@ -273,6 +327,9 @@ class ClusterSpec:
     """
 
     workload_type: VariableOrOptional[WorkloadType] = None
+    """
+    Cluster Attributes showing for clusters workload types.
+    """
 
     @classmethod
     def from_dict(cls, value: "ClusterSpecDict") -> "Self":
@@ -343,8 +400,39 @@ class ClusterSpecDict(TypedDict, total=False):
     """
 
     data_security_mode: VariableOrOptional[DataSecurityModeParam]
+    """
+    Data security mode decides what data governance model to use when accessing data
+    from a cluster.
+    
+    * `DATA_SECURITY_MODE_AUTO`: Databricks will choose the most appropriate access mode depending on your compute configuration.
+    * `DATA_SECURITY_MODE_STANDARD`: A secure cluster that can be shared by multiple users. Cluster users are fully isolated so that they cannot see each other’s data and credentials. Most data governance features are supported in this mode. But programming languages and cluster features might be limited.
+    * `DATA_SECURITY_MODE_DEDICATED`: A secure cluster that can only be exclusively used by a single user specified in `single_user_name`. Most programming languages, cluster features and data governance features are available in this mode.
+    
+    The following modes are legacy aliases for the above modes:
+    
+    * `USER_ISOLATION`: Legacy alias for `DATA_SECURITY_MODE_STANDARD`.
+    * `SINGLE_USER`: Legacy alias for `DATA_SECURITY_MODE_DEDICATED`.
+    
+    The following modes are deprecated starting with Databricks Runtime 15.0 and
+    will be removed for future Databricks Runtime versions:
+    
+    * `LEGACY_TABLE_ACL`: This mode is for users migrating from legacy Table ACL clusters.
+    * `LEGACY_PASSTHROUGH`: This mode is for users migrating from legacy Passthrough on high concurrency clusters.
+    * `LEGACY_SINGLE_USER`: This mode is for users migrating from legacy Passthrough on standard clusters.
+    * `LEGACY_SINGLE_USER_STANDARD`: This mode provides a way that doesn’t have UC nor passthrough enabled.
+    """
+
+    dependency_mode: VariableOrOptional[DependencyModeParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Controls dependency configuration for the cluster.
+    """
 
     docker_image: VariableOrOptional[DockerImageParam]
+    """
+    Custom docker image BYOC
+    """
 
     driver_instance_pool_id: VariableOrOptional[str]
     """
@@ -363,9 +451,6 @@ class ClusterSpecDict(TypedDict, total=False):
     The node type of the Spark driver.
     Note that this field is optional; if unset, the driver node type will be set as the same value
     as `node_type_id` defined above.
-    
-    This field, along with node_type_id, should not be set if virtual_cluster_size is set.
-    If both driver_node_type_id, node_type_id, and virtual_cluster_size are specified, driver_node_type_id and node_type_id take precedence.
     """
 
     enable_elastic_disk: VariableOrOptional[bool]
@@ -405,13 +490,24 @@ class ClusterSpecDict(TypedDict, total=False):
     """
 
     kind: VariableOrOptional[KindParam]
+    """
+    The kind of compute described by this compute specification.
+    
+    Depending on `kind`, different validations and default values will be applied.
+    
+    Clusters with `kind = CLASSIC_PREVIEW` support the following fields, whereas clusters with no specified `kind` do not.
+    * [is_single_node](/api/workspace/clusters/create#is_single_node)
+    * [use_ml_runtime](/api/workspace/clusters/create#use_ml_runtime)
+    
+    By using the [simple form](https://docs.databricks.com/compute/simple-form.html), your clusters are automatically using `kind = CLASSIC_PREVIEW`.
+    """
 
     node_type_id: VariableOrOptional[str]
     """
     This field encodes, through a single value, the resources available to each of
     the Spark nodes in this cluster. For example, the Spark nodes can be provisioned
     and optimized for memory or compute intensive workloads. A list of available node
-    types can be retrieved by using the :method:clusters/listNodeTypes API call.
+    types can be retrieved by using the [clusters/listNodeTypes](https://docs.databricks.com/api/workspace/clusters/listnodetypes) API call.
     """
 
     num_workers: VariableOrOptional[int]
@@ -437,6 +533,15 @@ class ClusterSpecDict(TypedDict, total=False):
     """
 
     runtime_engine: VariableOrOptional[RuntimeEngineParam]
+    """
+    Determines the cluster's runtime engine, either standard or Photon.
+    
+    This field is not compatible with legacy `spark_version` values that contain `-photon-`.
+    Remove `-photon-` from the `spark_version` and set `runtime_engine` to `PHOTON`.
+    
+    If left unspecified, the runtime engine defaults to standard unless the spark_version
+    contains -photon-, in which case Photon will be used.
+    """
 
     single_user_name: VariableOrOptional[str]
     """
@@ -469,7 +574,7 @@ class ClusterSpecDict(TypedDict, total=False):
     """
     The Spark version of the cluster, e.g. `3.3.x-scala2.11`.
     A list of available Spark versions can be retrieved by using
-    the :method:clusters/sparkVersions API call.
+    the [clusters/sparkVersions](https://docs.databricks.com/api/workspace/clusters/sparkversions) API call.
     """
 
     ssh_public_keys: VariableOrList[str]
@@ -481,7 +586,7 @@ class ClusterSpecDict(TypedDict, total=False):
 
     total_initial_remote_disk_size: VariableOrOptional[int]
     """
-    If set, what the total initial volume size (in GB) of the remote disks should be. Currently only supported for GCP HYPERDISK_BALANCED disks.
+    If set, what the total initial volume size (in GB) of the remote disks should be. Supported for GCP.
     """
 
     use_ml_runtime: VariableOrOptional[bool]
@@ -497,6 +602,9 @@ class ClusterSpecDict(TypedDict, total=False):
     """
 
     workload_type: VariableOrOptional[WorkloadTypeParam]
+    """
+    Cluster Attributes showing for clusters workload types.
+    """
 
 
 ClusterSpecParam = ClusterSpecDict | ClusterSpec
diff --git a/python/databricks/bundles/jobs/_models/compute.py b/python/databricks/bundles/jobs/_models/compute.py
index d5803f81302..51cfac4566c 100644
--- a/python/databricks/bundles/jobs/_models/compute.py
+++ b/python/databricks/bundles/jobs/_models/compute.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -19,7 +21,7 @@ class Compute:
 
     hardware_accelerator: VariableOrOptional[HardwareAcceleratorType] = None
     """
-    Hardware accelerator configuration for Serverless GPU workloads.
+    [Public Preview] Hardware accelerator configuration for Serverless GPU workloads.
     """
 
     @classmethod
@@ -35,7 +37,7 @@ class ComputeDict(TypedDict, total=False):
 
     hardware_accelerator: VariableOrOptional[HardwareAcceleratorTypeParam]
     """
-    Hardware accelerator configuration for Serverless GPU workloads.
+    [Public Preview] Hardware accelerator configuration for Serverless GPU workloads.
     """
 
 
diff --git a/python/databricks/bundles/jobs/_models/compute_config.py b/python/databricks/bundles/jobs/_models/compute_config.py
index b1194a80cde..cac29578ce0 100644
--- a/python/databricks/bundles/jobs/_models/compute_config.py
+++ b/python/databricks/bundles/jobs/_models/compute_config.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -17,17 +19,23 @@ class ComputeConfig:
 
     num_gpus: VariableOr[int]
     """
-    Number of GPUs.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Number of GPUs.
     """
 
     gpu_node_pool_id: VariableOrOptional[str] = None
     """
-    IDof the GPU pool to use.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] IDof the GPU pool to use.
     """
 
     gpu_type: VariableOrOptional[str] = None
     """
-    GPU type.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] GPU type.
     """
 
     @classmethod
@@ -43,17 +51,23 @@ class ComputeConfigDict(TypedDict, total=False):
 
     num_gpus: VariableOr[int]
     """
-    Number of GPUs.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Number of GPUs.
     """
 
     gpu_node_pool_id: VariableOrOptional[str]
     """
-    IDof the GPU pool to use.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] IDof the GPU pool to use.
     """
 
     gpu_type: VariableOrOptional[str]
     """
-    GPU type.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] GPU type.
     """
 
 
diff --git a/python/databricks/bundles/jobs/_models/compute_spec.py b/python/databricks/bundles/jobs/_models/compute_spec.py
new file mode 100644
index 00000000000..404c4eb6b37
--- /dev/null
+++ b/python/databricks/bundles/jobs/_models/compute_spec.py
@@ -0,0 +1,87 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+from databricks.bundles.jobs._models.compute_spec_accelerator_type import (
+    ComputeSpecAcceleratorType,
+    ComputeSpecAcceleratorTypeParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ComputeSpec:
+    """
+    ComputeSpec: compute configuration — accelerator type and total
+    accelerator count across all nodes.
+    """
+
+    accelerator_count: VariableOr[int]
+    """
+    [Public Preview] Total number of accelerators across all nodes. Must be a positive
+    multiple of the per-node accelerator count encoded in `accelerator_type`.
+    For example, `GPU_8xH100` with `accelerator_count: 16` allocates 2 nodes
+    (8 GPUs per node).
+    """
+
+    accelerator_type: VariableOr[ComputeSpecAcceleratorType]
+    """
+    [Public Preview] Hardware accelerator type (for example, `GPU_1xA10` or `GPU_8xH100`).
+    The number of accelerators per node is encoded in the enum value —
+    `GPU_8xH100` means 8 H100 GPUs per node.
+    """
+
+    provisioned_capacity_id: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Optional ID of a pre-provisioned accelerator capacity reservation to run
+    this AI Runtime workload on. When set, the workload is scheduled onto the
+    referenced reserved capacity instead of the on-demand capacity shared among
+    all Databricks customers.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "ComputeSpecDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ComputeSpecDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ComputeSpecDict(TypedDict, total=False):
+    """"""
+
+    accelerator_count: VariableOr[int]
+    """
+    [Public Preview] Total number of accelerators across all nodes. Must be a positive
+    multiple of the per-node accelerator count encoded in `accelerator_type`.
+    For example, `GPU_8xH100` with `accelerator_count: 16` allocates 2 nodes
+    (8 GPUs per node).
+    """
+
+    accelerator_type: VariableOr[ComputeSpecAcceleratorTypeParam]
+    """
+    [Public Preview] Hardware accelerator type (for example, `GPU_1xA10` or `GPU_8xH100`).
+    The number of accelerators per node is encoded in the enum value —
+    `GPU_8xH100` means 8 H100 GPUs per node.
+    """
+
+    provisioned_capacity_id: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Optional ID of a pre-provisioned accelerator capacity reservation to run
+    this AI Runtime workload on. When set, the workload is scheduled onto the
+    referenced reserved capacity instead of the on-demand capacity shared among
+    all Databricks customers.
+    """
+
+
+ComputeSpecParam = ComputeSpecDict | ComputeSpec
diff --git a/python/databricks/bundles/jobs/_models/compute_spec_accelerator_type.py b/python/databricks/bundles/jobs/_models/compute_spec_accelerator_type.py
new file mode 100644
index 00000000000..218cce4766f
--- /dev/null
+++ b/python/databricks/bundles/jobs/_models/compute_spec_accelerator_type.py
@@ -0,0 +1,23 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class ComputeSpecAcceleratorType(Enum):
+    """
+    Hardware accelerator type for the AiRuntime workload. Per-node
+    accelerator count is encoded in the value name (e.g. `GPU_8xH100` means
+    8 H100s per node).
+    """
+
+    GPU_1X_A10 = "GPU_1xA10"
+    GPU_1X_H100 = "GPU_1xH100"
+    GPU_8X_H100 = "GPU_8xH100"
+    GPU_8X_B300 = "GPU_8xB300"
+
+
+ComputeSpecAcceleratorTypeParam = (
+    Literal["GPU_1xA10", "GPU_1xH100", "GPU_8xH100", "GPU_8xB300"]
+    | ComputeSpecAcceleratorType
+)
diff --git a/python/databricks/bundles/jobs/_models/condition.py b/python/databricks/bundles/jobs/_models/condition.py
index d7c1b25bc74..7c242ae9dbf 100644
--- a/python/databricks/bundles/jobs/_models/condition.py
+++ b/python/databricks/bundles/jobs/_models/condition.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
diff --git a/python/databricks/bundles/jobs/_models/condition_task.py b/python/databricks/bundles/jobs/_models/condition_task.py
index 4934c16b025..478ca88de11 100644
--- a/python/databricks/bundles/jobs/_models/condition_task.py
+++ b/python/databricks/bundles/jobs/_models/condition_task.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/condition_task_op.py b/python/databricks/bundles/jobs/_models/condition_task_op.py
index 099413271ca..615a7ea995c 100644
--- a/python/databricks/bundles/jobs/_models/condition_task_op.py
+++ b/python/databricks/bundles/jobs/_models/condition_task_op.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
diff --git a/python/databricks/bundles/jobs/_models/confidential_compute_type.py b/python/databricks/bundles/jobs/_models/confidential_compute_type.py
new file mode 100644
index 00000000000..e881295bd47
--- /dev/null
+++ b/python/databricks/bundles/jobs/_models/confidential_compute_type.py
@@ -0,0 +1,23 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class ConfidentialComputeType(Enum):
+    """
+    :meta private: [EXPERIMENTAL]
+
+    Confidential computing technology for GCP instances.
+    Aligns with gcloud's --confidential-compute-type flag and the REST API's
+    confidentialInstanceConfig.confidentialInstanceType field.
+    See: https://cloud.google.com/confidential-computing/confidential-vm/docs/create-a-confidential-vm-instance
+    """
+
+    CONFIDENTIAL_COMPUTE_TYPE_NONE = "CONFIDENTIAL_COMPUTE_TYPE_NONE"
+    SEV_SNP = "SEV_SNP"
+
+
+ConfidentialComputeTypeParam = (
+    Literal["CONFIDENTIAL_COMPUTE_TYPE_NONE", "SEV_SNP"] | ConfidentialComputeType
+)
diff --git a/python/databricks/bundles/jobs/_models/continuous.py b/python/databricks/bundles/jobs/_models/continuous.py
index 43268661c13..e707bb377f7 100644
--- a/python/databricks/bundles/jobs/_models/continuous.py
+++ b/python/databricks/bundles/jobs/_models/continuous.py
@@ -1,9 +1,15 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
 from databricks.bundles.core._transform import _transform
 from databricks.bundles.core._transform_to_json import _transform_to_json_value
 from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.jobs._models.maintenance_window import (
+    MaintenanceWindow,
+    MaintenanceWindowParam,
+)
 from databricks.bundles.jobs._models.pause_status import PauseStatus, PauseStatusParam
 from databricks.bundles.jobs._models.task_retry_mode import (
     TaskRetryMode,
@@ -18,6 +24,11 @@
 class Continuous:
     """"""
 
+    maintenance_window: VariableOrOptional[MaintenanceWindow] = None
+    """
+    Defines when platform-initiated maintenance may run for this job. If unspecified, maintenance may run at any time.
+    """
+
     pause_status: VariableOrOptional[PauseStatus] = None
     """
     Indicate whether the continuous execution of the job is paused or not. Defaults to UNPAUSED.
@@ -39,6 +50,11 @@ def as_dict(self) -> "ContinuousDict":
 class ContinuousDict(TypedDict, total=False):
     """"""
 
+    maintenance_window: VariableOrOptional[MaintenanceWindowParam]
+    """
+    Defines when platform-initiated maintenance may run for this job. If unspecified, maintenance may run at any time.
+    """
+
     pause_status: VariableOrOptional[PauseStatusParam]
     """
     Indicate whether the continuous execution of the job is paused or not. Defaults to UNPAUSED.
diff --git a/python/databricks/bundles/jobs/_models/continuous_trigger_configuration.py b/python/databricks/bundles/jobs/_models/continuous_trigger_configuration.py
new file mode 100644
index 00000000000..421e630a548
--- /dev/null
+++ b/python/databricks/bundles/jobs/_models/continuous_trigger_configuration.py
@@ -0,0 +1,73 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.jobs._models.maintenance_window import (
+    MaintenanceWindow,
+    MaintenanceWindowParam,
+)
+from databricks.bundles.jobs._models.task_retry_mode import (
+    TaskRetryMode,
+    TaskRetryModeParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ContinuousTriggerConfiguration:
+    """
+    Continuous trigger. Stripped-down counterpart to `ContinuousSettings`: `pause_status` is owned by the enclosing
+    `TriggerConfiguration` and intentionally omitted here.
+    """
+
+    maintenance_window: VariableOrOptional[MaintenanceWindow] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Defines when platform-initiated maintenance may run for this trigger. If unspecified,
+    maintenance may run at any time.
+    """
+
+    task_retry_mode: VariableOrOptional[TaskRetryMode] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Whether the continuous job applies task-level retries. Defaults to NEVER.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "ContinuousTriggerConfigurationDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ContinuousTriggerConfigurationDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ContinuousTriggerConfigurationDict(TypedDict, total=False):
+    """"""
+
+    maintenance_window: VariableOrOptional[MaintenanceWindowParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Defines when platform-initiated maintenance may run for this trigger. If unspecified,
+    maintenance may run at any time.
+    """
+
+    task_retry_mode: VariableOrOptional[TaskRetryModeParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Whether the continuous job applies task-level retries. Defaults to NEVER.
+    """
+
+
+ContinuousTriggerConfigurationParam = (
+    ContinuousTriggerConfigurationDict | ContinuousTriggerConfiguration
+)
diff --git a/python/databricks/bundles/jobs/_models/cron_schedule.py b/python/databricks/bundles/jobs/_models/cron_schedule.py
index 43fb3306b94..3c8a37992af 100644
--- a/python/databricks/bundles/jobs/_models/cron_schedule.py
+++ b/python/databricks/bundles/jobs/_models/cron_schedule.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -5,6 +7,10 @@
 from databricks.bundles.core._transform_to_json import _transform_to_json_value
 from databricks.bundles.core._variable import VariableOr, VariableOrOptional
 from databricks.bundles.jobs._models.pause_status import PauseStatus, PauseStatusParam
+from databricks.bundles.jobs._models.sql_condition_configuration import (
+    SqlConditionConfiguration,
+    SqlConditionConfigurationParam,
+)
 
 if TYPE_CHECKING:
     from typing_extensions import Self
@@ -29,6 +35,14 @@ class CronSchedule:
     Indicate whether this schedule is paused or not.
     """
 
+    sql_condition: VariableOrOptional[SqlConditionConfiguration] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] SQL condition that must be satisfied before a scheduled run is triggered. The condition is evaluated
+    after the cron expression fires and must return a truthy result for the run to proceed.
+    """
+
     @classmethod
     def from_dict(cls, value: "CronScheduleDict") -> "Self":
         return _transform(cls, value)
@@ -55,5 +69,13 @@ class CronScheduleDict(TypedDict, total=False):
     Indicate whether this schedule is paused or not.
     """
 
+    sql_condition: VariableOrOptional[SqlConditionConfigurationParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] SQL condition that must be satisfied before a scheduled run is triggered. The condition is evaluated
+    after the cron expression fires and must return a truthy result for the run to proceed.
+    """
+
 
 CronScheduleParam = CronScheduleDict | CronSchedule
diff --git a/python/databricks/bundles/jobs/_models/cron_trigger_configuration.py b/python/databricks/bundles/jobs/_models/cron_trigger_configuration.py
new file mode 100644
index 00000000000..9e083514b15
--- /dev/null
+++ b/python/databricks/bundles/jobs/_models/cron_trigger_configuration.py
@@ -0,0 +1,65 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class CronTriggerConfiguration:
+    """
+    Cron schedule trigger. Stripped-down counterpart to `CronSchedule`: `pause_status` and `sql_condition` are owned
+    by the enclosing `TriggerConfiguration` and intentionally omitted here.
+    """
+
+    quartz_cron_expression: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] A Cron expression using Quartz syntax that describes the schedule for this trigger. See
+    [Cron Trigger](http://www.quartz-scheduler.org/documentation/quartz-2.3.0/tutorials/crontrigger.html) for details.
+    """
+
+    timezone_id: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] A Java timezone ID. The schedule is resolved with respect to this timezone. See
+    [Java TimeZone](https://docs.oracle.com/javase/7/docs/api/java/util/TimeZone.html) for details.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "CronTriggerConfigurationDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "CronTriggerConfigurationDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class CronTriggerConfigurationDict(TypedDict, total=False):
+    """"""
+
+    quartz_cron_expression: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] A Cron expression using Quartz syntax that describes the schedule for this trigger. See
+    [Cron Trigger](http://www.quartz-scheduler.org/documentation/quartz-2.3.0/tutorials/crontrigger.html) for details.
+    """
+
+    timezone_id: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] A Java timezone ID. The schedule is resolved with respect to this timezone. See
+    [Java TimeZone](https://docs.oracle.com/javase/7/docs/api/java/util/TimeZone.html) for details.
+    """
+
+
+CronTriggerConfigurationParam = CronTriggerConfigurationDict | CronTriggerConfiguration
diff --git a/python/databricks/bundles/jobs/_models/dashboard_task.py b/python/databricks/bundles/jobs/_models/dashboard_task.py
index 4f9cd829a1a..7d07ea50175 100644
--- a/python/databricks/bundles/jobs/_models/dashboard_task.py
+++ b/python/databricks/bundles/jobs/_models/dashboard_task.py
@@ -1,10 +1,15 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
 from databricks.bundles.core._transform import _transform
 from databricks.bundles.core._transform_to_json import _transform_to_json_value
 from databricks.bundles.core._variable import VariableOrDict, VariableOrOptional
-from databricks.bundles.jobs._models.subscription import Subscription, SubscriptionParam
+from databricks.bundles.jobs._models.subscription import (
+    Subscription,
+    SubscriptionParam,
+)
 
 if TYPE_CHECKING:
     from typing_extensions import Self
@@ -17,11 +22,12 @@ class DashboardTask:
     """
 
     dashboard_id: VariableOrOptional[str] = None
+    """
+    The identifier of the dashboard to refresh.
+    """
 
     filters: VariableOrDict[str] = field(default_factory=dict)
     """
-    :meta private: [EXPERIMENTAL]
-    
     Dashboard task parameters. Used to apply dashboard filter values during dashboard task execution. Parameter values get applied to any dashboard filters that have a matching URL identifier as the parameter key.
     The parameter value format is dependent on the filter type:
     - For text and single-select filters, provide a single value (e.g. `"value"`)
@@ -31,6 +37,9 @@ class DashboardTask:
     """
 
     subscription: VariableOrOptional[Subscription] = None
+    """
+    Optional: subscription configuration for sending the dashboard snapshot.
+    """
 
     warehouse_id: VariableOrOptional[str] = None
     """
@@ -50,11 +59,12 @@ class DashboardTaskDict(TypedDict, total=False):
     """"""
 
     dashboard_id: VariableOrOptional[str]
+    """
+    The identifier of the dashboard to refresh.
+    """
 
     filters: VariableOrDict[str]
     """
-    :meta private: [EXPERIMENTAL]
-    
     Dashboard task parameters. Used to apply dashboard filter values during dashboard task execution. Parameter values get applied to any dashboard filters that have a matching URL identifier as the parameter key.
     The parameter value format is dependent on the filter type:
     - For text and single-select filters, provide a single value (e.g. `"value"`)
@@ -64,6 +74,9 @@ class DashboardTaskDict(TypedDict, total=False):
     """
 
     subscription: VariableOrOptional[SubscriptionParam]
+    """
+    Optional: subscription configuration for sending the dashboard snapshot.
+    """
 
     warehouse_id: VariableOrOptional[str]
     """
diff --git a/python/databricks/bundles/jobs/_models/data_security_mode.py b/python/databricks/bundles/jobs/_models/data_security_mode.py
index e195d0cfc8d..ae1aafcf085 100644
--- a/python/databricks/bundles/jobs/_models/data_security_mode.py
+++ b/python/databricks/bundles/jobs/_models/data_security_mode.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
@@ -7,15 +9,14 @@ class DataSecurityMode(Enum):
     Data security mode decides what data governance model to use when accessing data
     from a cluster.
 
-    The following modes can only be used when `kind = CLASSIC_PREVIEW`.
     * `DATA_SECURITY_MODE_AUTO`: Databricks will choose the most appropriate access mode depending on your compute configuration.
-    * `DATA_SECURITY_MODE_STANDARD`: Alias for `USER_ISOLATION`.
-    * `DATA_SECURITY_MODE_DEDICATED`: Alias for `SINGLE_USER`.
+    * `DATA_SECURITY_MODE_STANDARD`: A secure cluster that can be shared by multiple users. Cluster users are fully isolated so that they cannot see each other’s data and credentials. Most data governance features are supported in this mode. But programming languages and cluster features might be limited.
+    * `DATA_SECURITY_MODE_DEDICATED`: A secure cluster that can only be exclusively used by a single user specified in `single_user_name`. Most programming languages, cluster features and data governance features are available in this mode.
+
+    The following modes are legacy aliases for the above modes:
 
-    The following modes can be used regardless of `kind`.
-    * `NONE`: No security isolation for multiple users sharing the cluster. Data governance features are not available in this mode.
-    * `SINGLE_USER`: A secure cluster that can only be exclusively used by a single user specified in `single_user_name`. Most programming languages, cluster features and data governance features are available in this mode.
-    * `USER_ISOLATION`: A secure cluster that can be shared by multiple users. Cluster users are fully isolated so that they cannot see each other's data and credentials. Most data governance features are supported in this mode. But programming languages and cluster features might be limited.
+    * `USER_ISOLATION`: Legacy alias for `DATA_SECURITY_MODE_STANDARD`.
+    * `SINGLE_USER`: Legacy alias for `DATA_SECURITY_MODE_DEDICATED`.
 
     The following modes are deprecated starting with Databricks Runtime 15.0 and
     will be removed for future Databricks Runtime versions:
diff --git a/python/databricks/bundles/jobs/_models/day_of_week.py b/python/databricks/bundles/jobs/_models/day_of_week.py
new file mode 100644
index 00000000000..e5874108dd6
--- /dev/null
+++ b/python/databricks/bundles/jobs/_models/day_of_week.py
@@ -0,0 +1,26 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class DayOfWeek(Enum):
+    """
+    Days of week that can be referenced by Jobs scheduling settings.
+    """
+
+    MONDAY = "MONDAY"
+    TUESDAY = "TUESDAY"
+    WEDNESDAY = "WEDNESDAY"
+    THURSDAY = "THURSDAY"
+    FRIDAY = "FRIDAY"
+    SATURDAY = "SATURDAY"
+    SUNDAY = "SUNDAY"
+
+
+DayOfWeekParam = (
+    Literal[
+        "MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY", "SATURDAY", "SUNDAY"
+    ]
+    | DayOfWeek
+)
diff --git a/python/databricks/bundles/jobs/_models/dbfs_storage_info.py b/python/databricks/bundles/jobs/_models/dbfs_storage_info.py
index 81fe319a65e..29744acf26a 100644
--- a/python/databricks/bundles/jobs/_models/dbfs_storage_info.py
+++ b/python/databricks/bundles/jobs/_models/dbfs_storage_info.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/dbt_platform_task.py b/python/databricks/bundles/jobs/_models/dbt_platform_task.py
index 92cf53ac861..61128b71634 100644
--- a/python/databricks/bundles/jobs/_models/dbt_platform_task.py
+++ b/python/databricks/bundles/jobs/_models/dbt_platform_task.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -17,12 +19,16 @@ class DbtPlatformTask:
 
     connection_resource_name: VariableOrOptional[str] = None
     """
-    The resource name of the UC connection that authenticates the dbt platform for this task
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The resource name of the UC connection that authenticates the dbt platform for this task
     """
 
     dbt_platform_job_id: VariableOrOptional[str] = None
     """
-    Id of the dbt platform job to be triggered. Specified as a string for maximum compatibility with clients.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Id of the dbt platform job to be triggered. Specified as a string for maximum compatibility with clients.
     """
 
     @classmethod
@@ -38,12 +44,16 @@ class DbtPlatformTaskDict(TypedDict, total=False):
 
     connection_resource_name: VariableOrOptional[str]
     """
-    The resource name of the UC connection that authenticates the dbt platform for this task
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The resource name of the UC connection that authenticates the dbt platform for this task
     """
 
     dbt_platform_job_id: VariableOrOptional[str]
     """
-    Id of the dbt platform job to be triggered. Specified as a string for maximum compatibility with clients.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Id of the dbt platform job to be triggered. Specified as a string for maximum compatibility with clients.
     """
 
 
diff --git a/python/databricks/bundles/jobs/_models/dbt_task.py b/python/databricks/bundles/jobs/_models/dbt_task.py
index 52ae3cfa46e..d8c92391e30 100644
--- a/python/databricks/bundles/jobs/_models/dbt_task.py
+++ b/python/databricks/bundles/jobs/_models/dbt_task.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/dependency_mode.py b/python/databricks/bundles/jobs/_models/dependency_mode.py
new file mode 100644
index 00000000000..1fdc22cfa4c
--- /dev/null
+++ b/python/databricks/bundles/jobs/_models/dependency_mode.py
@@ -0,0 +1,28 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class DependencyMode(Enum):
+    """
+    Controls dependency configuration for the cluster.
+
+    * `DEPENDENCY_MODE_AUTO`: Databricks will choose the most appropriate dependency mode based on your compute configuration.
+    * `DEPENDENCY_MODE_ENVIRONMENTS`: Enables a unified dependency management experience across classic and serverless, resulting in increased stability and performance. Supported only on DBR 19+ in Standard access mode.
+    * `DEPENDENCY_MODE_CLUSTER_LIBRARIES`: Legacy mode: dependencies come from cluster libraries and init scripts.
+    """
+
+    DEPENDENCY_MODE_ENVIRONMENTS = "DEPENDENCY_MODE_ENVIRONMENTS"
+    DEPENDENCY_MODE_CLUSTER_LIBRARIES = "DEPENDENCY_MODE_CLUSTER_LIBRARIES"
+    DEPENDENCY_MODE_AUTO = "DEPENDENCY_MODE_AUTO"
+
+
+DependencyModeParam = (
+    Literal[
+        "DEPENDENCY_MODE_ENVIRONMENTS",
+        "DEPENDENCY_MODE_CLUSTER_LIBRARIES",
+        "DEPENDENCY_MODE_AUTO",
+    ]
+    | DependencyMode
+)
diff --git a/python/databricks/bundles/jobs/_models/deployment_spec.py b/python/databricks/bundles/jobs/_models/deployment_spec.py
new file mode 100644
index 00000000000..3c0d8d77a6f
--- /dev/null
+++ b/python/databricks/bundles/jobs/_models/deployment_spec.py
@@ -0,0 +1,71 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+from databricks.bundles.jobs._models.compute_spec import (
+    ComputeSpec,
+    ComputeSpecParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class DeploymentSpec:
+    """
+    DeploymentSpec: configuration for one deployment within an AiRuntimeTask.
+    Each entry in `AiRuntimeTask.deployments` describes a group of nodes that
+    share the same command and compute. Many single-program training
+    algorithms use a single entry where every node runs the same command;
+    role-split workloads (driver + worker, parameter server, separate eval
+    node, etc.) use multiple entries.
+    """
+
+    compute: VariableOr[ComputeSpec]
+    """
+    [Public Preview] Compute resources allocated to each node in this deployment.
+    """
+
+    command_path: VariableOrOptional[str] = None
+
+    name: VariableOrOptional[str] = None
+    """
+    [Public Preview] Optional human-readable name for this deployment (for example, `driver`,
+    `worker`, `param_server`). Used for log and UI display. Distinct names
+    are recommended so deployments can be told apart, but uniqueness is not
+    enforced.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "DeploymentSpecDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "DeploymentSpecDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class DeploymentSpecDict(TypedDict, total=False):
+    """"""
+
+    compute: VariableOr[ComputeSpecParam]
+    """
+    [Public Preview] Compute resources allocated to each node in this deployment.
+    """
+
+    command_path: VariableOrOptional[str]
+
+    name: VariableOrOptional[str]
+    """
+    [Public Preview] Optional human-readable name for this deployment (for example, `driver`,
+    `worker`, `param_server`). Used for log and UI display. Distinct names
+    are recommended so deployments can be told apart, but uniqueness is not
+    enforced.
+    """
+
+
+DeploymentSpecParam = DeploymentSpecDict | DeploymentSpec
diff --git a/python/databricks/bundles/jobs/_models/docker_basic_auth.py b/python/databricks/bundles/jobs/_models/docker_basic_auth.py
index 21edca52b71..552ea90a83b 100644
--- a/python/databricks/bundles/jobs/_models/docker_basic_auth.py
+++ b/python/databricks/bundles/jobs/_models/docker_basic_auth.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/docker_image.py b/python/databricks/bundles/jobs/_models/docker_image.py
index 3a76b2bbf38..9dca00df1e2 100644
--- a/python/databricks/bundles/jobs/_models/docker_image.py
+++ b/python/databricks/bundles/jobs/_models/docker_image.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -18,6 +20,9 @@ class DockerImage:
     """"""
 
     basic_auth: VariableOrOptional[DockerBasicAuth] = None
+    """
+    Basic auth with username and password
+    """
 
     url: VariableOrOptional[str] = None
     """
@@ -36,6 +41,9 @@ class DockerImageDict(TypedDict, total=False):
     """"""
 
     basic_auth: VariableOrOptional[DockerBasicAuthParam]
+    """
+    Basic auth with username and password
+    """
 
     url: VariableOrOptional[str]
     """
diff --git a/python/databricks/bundles/jobs/_models/ebs_volume_type.py b/python/databricks/bundles/jobs/_models/ebs_volume_type.py
index b67853f8cb8..d8f3ef13f89 100644
--- a/python/databricks/bundles/jobs/_models/ebs_volume_type.py
+++ b/python/databricks/bundles/jobs/_models/ebs_volume_type.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
diff --git a/python/databricks/bundles/jobs/_models/environment.py b/python/databricks/bundles/jobs/_models/environment.py
index 5ad70e3a2e3..850a1cf3098 100644
--- a/python/databricks/bundles/jobs/_models/environment.py
+++ b/python/databricks/bundles/jobs/_models/environment.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
@@ -12,7 +14,7 @@
 @dataclass(kw_only=True)
 class Environment:
     """
-    The environment entity used to preserve serverless environment side panel, jobs' environment for non-notebook task, and DLT's environment for classic and serverless pipelines.
+    The environment entity used to preserve serverless environment side panel, jobs' environment for non-notebook task, and SDP's environment for classic and serverless pipelines.
     In this minimal environment spec, only pip and java dependencies are supported.
     """
 
@@ -23,7 +25,10 @@ class Environment:
     (e.g., `/Workspace/path/to/env.yaml`). Support for a Databricks-provided base environment ID
     (e.g., `workspace-base-environments/databricks_ai_v4`) and workspace base environment ID
     (e.g., `workspace-base-environments/dbe_b849b66e-b31a-4cb5-b161-1f2b10877fb7`) is in Beta.
-    Either `environment_version` or `base_environment` can be provided.  For more information, see
+    Either `environment_version` or `base_environment` can be provided.
+    For more information about Databricks-provided base environments, see the
+    [list workspace base environments](:method:Environments/ListWorkspaceBaseEnvironments) API.
+    For more information, see
     """
 
     client: VariableOrOptional[str] = None
@@ -44,6 +49,16 @@ class Environment:
     """
 
     java_dependencies: VariableOrList[str] = field(default_factory=list)
+    """
+    List of java dependencies. Each dependency is a string representing a java library path. For example: `/Volumes/path/to/test.jar`.
+    """
+
+    project_environment: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] File path of pyproject.toml file that defines the project-scoped environment.
+    """
 
     @classmethod
     def from_dict(cls, value: "EnvironmentDict") -> "Self":
@@ -63,7 +78,10 @@ class EnvironmentDict(TypedDict, total=False):
     (e.g., `/Workspace/path/to/env.yaml`). Support for a Databricks-provided base environment ID
     (e.g., `workspace-base-environments/databricks_ai_v4`) and workspace base environment ID
     (e.g., `workspace-base-environments/dbe_b849b66e-b31a-4cb5-b161-1f2b10877fb7`) is in Beta.
-    Either `environment_version` or `base_environment` can be provided.  For more information, see
+    Either `environment_version` or `base_environment` can be provided.
+    For more information about Databricks-provided base environments, see the
+    [list workspace base environments](:method:Environments/ListWorkspaceBaseEnvironments) API.
+    For more information, see
     """
 
     client: VariableOrOptional[str]
@@ -84,6 +102,16 @@ class EnvironmentDict(TypedDict, total=False):
     """
 
     java_dependencies: VariableOrList[str]
+    """
+    List of java dependencies. Each dependency is a string representing a java library path. For example: `/Volumes/path/to/test.jar`.
+    """
+
+    project_environment: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] File path of pyproject.toml file that defines the project-scoped environment.
+    """
 
 
 EnvironmentParam = EnvironmentDict | Environment
diff --git a/python/databricks/bundles/jobs/_models/file_arrival_trigger_configuration.py b/python/databricks/bundles/jobs/_models/file_arrival_trigger_configuration.py
index cf4ae748cf7..7e31a4b6946 100644
--- a/python/databricks/bundles/jobs/_models/file_arrival_trigger_configuration.py
+++ b/python/databricks/bundles/jobs/_models/file_arrival_trigger_configuration.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/for_each_task.py b/python/databricks/bundles/jobs/_models/for_each_task.py
index db353a28851..c8ac1625ff6 100644
--- a/python/databricks/bundles/jobs/_models/for_each_task.py
+++ b/python/databricks/bundles/jobs/_models/for_each_task.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/gcp_attributes.py b/python/databricks/bundles/jobs/_models/gcp_attributes.py
index 6f390c1cf8b..2874f9da8e4 100644
--- a/python/databricks/bundles/jobs/_models/gcp_attributes.py
+++ b/python/databricks/bundles/jobs/_models/gcp_attributes.py
@@ -1,9 +1,15 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
 from databricks.bundles.core._transform import _transform
 from databricks.bundles.core._transform_to_json import _transform_to_json_value
 from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.jobs._models.confidential_compute_type import (
+    ConfidentialComputeType,
+    ConfidentialComputeTypeParam,
+)
 from databricks.bundles.jobs._models.gcp_availability import (
     GcpAvailability,
     GcpAvailabilityParam,
@@ -20,12 +26,25 @@ class GcpAttributes:
     """
 
     availability: VariableOrOptional[GcpAvailability] = None
+    """
+    This field determines whether the spark executors will be scheduled to run on preemptible
+    VMs, on-demand VMs, or preemptible VMs with a fallback to on-demand VMs if the former is unavailable.
+    """
 
     boot_disk_size: VariableOrOptional[int] = None
     """
     Boot disk size in GB
     """
 
+    confidential_compute_type: VariableOrOptional[ConfidentialComputeType] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The confidential computing technology for this cluster's instances.
+    Currently only SEV_SNP is supported, and only on N2D instance types.
+    When not set, no confidential computing is applied.
+    """
+
     first_on_demand: VariableOrOptional[int] = None
     """
     The first `first_on_demand` nodes of the cluster will be placed on on-demand instances.
@@ -64,7 +83,8 @@ class GcpAttributes:
     """
     Identifier for the availability zone in which the cluster resides.
     This can be one of the following:
-    - "HA" => High availability, spread nodes across availability zones for a Databricks deployment region [default].
+    - "HA" => High availability, spread nodes across availability zones for a
+    Databricks deployment region [default].
     - "AUTO" => Databricks picks an availability zone to schedule the cluster on.
     - A GCP availability zone => Pick One of the available zones for (machine type + region) from
     https://cloud.google.com/compute/docs/regions-zones.
@@ -82,12 +102,25 @@ class GcpAttributesDict(TypedDict, total=False):
     """"""
 
     availability: VariableOrOptional[GcpAvailabilityParam]
+    """
+    This field determines whether the spark executors will be scheduled to run on preemptible
+    VMs, on-demand VMs, or preemptible VMs with a fallback to on-demand VMs if the former is unavailable.
+    """
 
     boot_disk_size: VariableOrOptional[int]
     """
     Boot disk size in GB
     """
 
+    confidential_compute_type: VariableOrOptional[ConfidentialComputeTypeParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The confidential computing technology for this cluster's instances.
+    Currently only SEV_SNP is supported, and only on N2D instance types.
+    When not set, no confidential computing is applied.
+    """
+
     first_on_demand: VariableOrOptional[int]
     """
     The first `first_on_demand` nodes of the cluster will be placed on on-demand instances.
@@ -126,7 +159,8 @@ class GcpAttributesDict(TypedDict, total=False):
     """
     Identifier for the availability zone in which the cluster resides.
     This can be one of the following:
-    - "HA" => High availability, spread nodes across availability zones for a Databricks deployment region [default].
+    - "HA" => High availability, spread nodes across availability zones for a
+    Databricks deployment region [default].
     - "AUTO" => Databricks picks an availability zone to schedule the cluster on.
     - A GCP availability zone => Pick One of the available zones for (machine type + region) from
     https://cloud.google.com/compute/docs/regions-zones.
diff --git a/python/databricks/bundles/jobs/_models/gcp_availability.py b/python/databricks/bundles/jobs/_models/gcp_availability.py
index aa8e785a71f..0d391b87fe3 100644
--- a/python/databricks/bundles/jobs/_models/gcp_availability.py
+++ b/python/databricks/bundles/jobs/_models/gcp_availability.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
diff --git a/python/databricks/bundles/jobs/_models/gcs_storage_info.py b/python/databricks/bundles/jobs/_models/gcs_storage_info.py
index a5e6d51e6ee..e8f1059373b 100644
--- a/python/databricks/bundles/jobs/_models/gcs_storage_info.py
+++ b/python/databricks/bundles/jobs/_models/gcs_storage_info.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/gen_ai_compute_task.py b/python/databricks/bundles/jobs/_models/gen_ai_compute_task.py
index 4d2c4b972c8..4e42c50f81d 100644
--- a/python/databricks/bundles/jobs/_models/gen_ai_compute_task.py
+++ b/python/databricks/bundles/jobs/_models/gen_ai_compute_task.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -18,29 +20,49 @@
 class GenAiComputeTask:
     """
     :meta private: [EXPERIMENTAL]
+
+    DEPRECATED — use `AiRuntimeTask` for all new BYOT multi-node GPU
+    workloads (see ai_runtime_task.proto). `AiRuntimeTask` is the only
+    supported BYOT task type for new workloads; this proto is retained only
+    for AIR CLI (fka SGCLI) pywheel backwards compatibility and will be
+    removed once the pywheel → databricks-cli migration completes (post-
+    PuPr).
     """
 
     dl_runtime_image: VariableOr[str]
     """
-    Runtime image
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Runtime image
     """
 
     command: VariableOrOptional[str] = None
     """
-    Command launcher to run the actual script, e.g. bash, python etc.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Command launcher to run the actual script, e.g. bash, python etc.
     """
 
     compute: VariableOrOptional[ComputeConfig] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview]
+    """
 
     mlflow_experiment_name: VariableOrOptional[str] = None
     """
-    Optional string containing the name of the MLflow experiment to log the run to. If name is not
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Optional string containing the name of the MLflow experiment to log the run to. If name is not
     found, backend will create the mlflow experiment using the name.
     """
 
     source: VariableOrOptional[Source] = None
     """
-    Optional location type of the training script. When set to `WORKSPACE`, the script will be retrieved from the local Databricks workspace. When set to `GIT`, the script will be retrieved from a Git repository
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Optional location type of the training script. When set to `WORKSPACE`, the script will be retrieved from the local Databricks workspace. When set to `GIT`, the script will be retrieved from a Git repository
     defined in `git_source`. If the value is empty, the task will use `GIT` if `git_source` is defined and `WORKSPACE` otherwise.
     * `WORKSPACE`: Script is located in Databricks workspace.
     * `GIT`: Script is located in cloud Git provider.
@@ -48,18 +70,24 @@ class GenAiComputeTask:
 
     training_script_path: VariableOrOptional[str] = None
     """
-    The training script file path to be executed. Cloud file URIs (such as dbfs:/, s3:/, adls:/, gcs:/) and workspace paths are supported. For python files stored in the Databricks workspace, the path must be absolute and begin with `/`. For files stored in a remote repository, the path must be relative. This field is required.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The training script file path to be executed. Cloud file URIs (such as dbfs:/, s3:/, adls:/, gcs:/) and workspace paths are supported. For python files stored in the Databricks workspace, the path must be absolute and begin with `/`. For files stored in a remote repository, the path must be relative. This field is required.
     """
 
     yaml_parameters: VariableOrOptional[str] = None
     """
-    Optional string containing model parameters passed to the training script in yaml format.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Optional string containing model parameters passed to the training script in yaml format.
     If present, then the content in yaml_parameters_file_path will be ignored.
     """
 
     yaml_parameters_file_path: VariableOrOptional[str] = None
     """
-    Optional path to a YAML file containing model parameters passed to the training script.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Optional path to a YAML file containing model parameters passed to the training script.
     """
 
     @classmethod
@@ -75,25 +103,38 @@ class GenAiComputeTaskDict(TypedDict, total=False):
 
     dl_runtime_image: VariableOr[str]
     """
-    Runtime image
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Runtime image
     """
 
     command: VariableOrOptional[str]
     """
-    Command launcher to run the actual script, e.g. bash, python etc.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Command launcher to run the actual script, e.g. bash, python etc.
     """
 
     compute: VariableOrOptional[ComputeConfigParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview]
+    """
 
     mlflow_experiment_name: VariableOrOptional[str]
     """
-    Optional string containing the name of the MLflow experiment to log the run to. If name is not
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Optional string containing the name of the MLflow experiment to log the run to. If name is not
     found, backend will create the mlflow experiment using the name.
     """
 
     source: VariableOrOptional[SourceParam]
     """
-    Optional location type of the training script. When set to `WORKSPACE`, the script will be retrieved from the local Databricks workspace. When set to `GIT`, the script will be retrieved from a Git repository
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Optional location type of the training script. When set to `WORKSPACE`, the script will be retrieved from the local Databricks workspace. When set to `GIT`, the script will be retrieved from a Git repository
     defined in `git_source`. If the value is empty, the task will use `GIT` if `git_source` is defined and `WORKSPACE` otherwise.
     * `WORKSPACE`: Script is located in Databricks workspace.
     * `GIT`: Script is located in cloud Git provider.
@@ -101,18 +142,24 @@ class GenAiComputeTaskDict(TypedDict, total=False):
 
     training_script_path: VariableOrOptional[str]
     """
-    The training script file path to be executed. Cloud file URIs (such as dbfs:/, s3:/, adls:/, gcs:/) and workspace paths are supported. For python files stored in the Databricks workspace, the path must be absolute and begin with `/`. For files stored in a remote repository, the path must be relative. This field is required.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The training script file path to be executed. Cloud file URIs (such as dbfs:/, s3:/, adls:/, gcs:/) and workspace paths are supported. For python files stored in the Databricks workspace, the path must be absolute and begin with `/`. For files stored in a remote repository, the path must be relative. This field is required.
     """
 
     yaml_parameters: VariableOrOptional[str]
     """
-    Optional string containing model parameters passed to the training script in yaml format.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Optional string containing model parameters passed to the training script in yaml format.
     If present, then the content in yaml_parameters_file_path will be ignored.
     """
 
     yaml_parameters_file_path: VariableOrOptional[str]
     """
-    Optional path to a YAML file containing model parameters passed to the training script.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Optional path to a YAML file containing model parameters passed to the training script.
     """
 
 
diff --git a/python/databricks/bundles/jobs/_models/git_provider.py b/python/databricks/bundles/jobs/_models/git_provider.py
index b3f8a73a376..165f77de5cb 100644
--- a/python/databricks/bundles/jobs/_models/git_provider.py
+++ b/python/databricks/bundles/jobs/_models/git_provider.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
diff --git a/python/databricks/bundles/jobs/_models/git_source.py b/python/databricks/bundles/jobs/_models/git_source.py
index a2c09691985..4ddd1d83764 100644
--- a/python/databricks/bundles/jobs/_models/git_source.py
+++ b/python/databricks/bundles/jobs/_models/git_source.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/hardware_accelerator_type.py b/python/databricks/bundles/jobs/_models/hardware_accelerator_type.py
index feb9f498cef..3d77c62b727 100644
--- a/python/databricks/bundles/jobs/_models/hardware_accelerator_type.py
+++ b/python/databricks/bundles/jobs/_models/hardware_accelerator_type.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
@@ -11,8 +13,11 @@ class HardwareAcceleratorType(Enum):
 
     GPU_1X_A10 = "GPU_1xA10"
     GPU_8X_H100 = "GPU_8xH100"
+    GPU_1X_H100 = "GPU_1xH100"
+    GPU_8X_B300 = "GPU_8xB300"
 
 
 HardwareAcceleratorTypeParam = (
-    Literal["GPU_1xA10", "GPU_8xH100"] | HardwareAcceleratorType
+    Literal["GPU_1xA10", "GPU_8xH100", "GPU_1xH100", "GPU_8xB300"]
+    | HardwareAcceleratorType
 )
diff --git a/python/databricks/bundles/jobs/_models/init_script_info.py b/python/databricks/bundles/jobs/_models/init_script_info.py
index f14f1854879..a7c5800a594 100644
--- a/python/databricks/bundles/jobs/_models/init_script_info.py
+++ b/python/databricks/bundles/jobs/_models/init_script_info.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -41,7 +43,6 @@
 class InitScriptInfo:
     """
     Config for an individual init script
-    Next ID: 11
     """
 
     abfss: VariableOrOptional[Adlsgen2Info] = None
diff --git a/python/databricks/bundles/jobs/_models/job.py b/python/databricks/bundles/jobs/_models/job.py
index e836d4c9a89..e38305c7d02 100644
--- a/python/databricks/bundles/jobs/_models/job.py
+++ b/python/databricks/bundles/jobs/_models/job.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
@@ -27,6 +29,10 @@
     JobEnvironment,
     JobEnvironmentParam,
 )
+from databricks.bundles.jobs._models.job_environment_variables import (
+    JobEnvironmentVariables,
+    JobEnvironmentVariablesParam,
+)
 from databricks.bundles.jobs._models.job_notification_settings import (
     JobNotificationSettings,
     JobNotificationSettingsParam,
@@ -54,6 +60,10 @@
     QueueSettingsParam,
 )
 from databricks.bundles.jobs._models.task import Task, TaskParam
+from databricks.bundles.jobs._models.trigger_configuration import (
+    TriggerConfiguration,
+    TriggerConfigurationParam,
+)
 from databricks.bundles.jobs._models.trigger_settings import (
     TriggerSettings,
     TriggerSettingsParam,
@@ -73,7 +83,7 @@ class Job(Resource):
 
     budget_policy_id: VariableOrOptional[str] = None
     """
-    The id of the user specified budget policy to use for this job.
+    [Public Preview] The id of the user specified budget policy to use for this job.
     If not specified, a default budget policy may be applied when creating or modifying the job.
     See `effective_budget_policy_id` for the budget policy used by this workload.
     """
@@ -81,6 +91,8 @@ class Job(Resource):
     continuous: VariableOrOptional[Continuous] = None
     """
     An optional continuous property for this job. The continuous property will ensure that there is always one run executing. Only one of `schedule` and `continuous` can be used.
+    
+    Pipelines started by a continuous job also run continuously, regardless of their own pipeline mode setting.
     """
 
     description: VariableOrOptional[str] = None
@@ -88,16 +100,39 @@ class Job(Resource):
     An optional description for the job. The maximum length is 27700 characters in UTF-8 encoding.
     """
 
+    duration_target: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The window the run aims to finish within, in hours, for a Cost-optimized serverless run.
+    Required only when `performance_target` is `COST_OPTIMIZED`. Must be one of the
+    supported values: `NO_FLEXIBILITY`, `4h`, `12h`, `24h`, `72h`. `NO_FLEXIBILITY` means the run
+    uses the default cost-optimized performance level without additional cost-saving optimizations.
+    """
+
     email_notifications: VariableOrOptional[JobEmailNotifications] = None
     """
     An optional set of email addresses that is notified when runs of this job begin or complete as well as when this job is deleted.
     """
 
+    environment_variables: VariableOrList[JobEnvironmentVariables] = field(
+        default_factory=list
+    )
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Named environment-variable entries that tasks can reference by key from
+    `TaskSettings.environment_variables_key`. Each entry's `spec` holds inline
+    `variables` and optional `.env` `files`. Maximum 10 entries per job. A task
+    can reference at most one entry from this list.
+    """
+
     environments: VariableOrList[JobEnvironment] = field(default_factory=list)
     """
-    A list of task execution environment specifications that can be referenced by serverless tasks of this job.
-    For serverless notebook tasks, if the environment_key is not specified, the notebook environment will be used if present. If a jobs environment is specified, it will override the notebook environment.
-    For other serverless tasks, the task environment is required to be specified using environment_key in the task settings.
+    A list of task execution environment specifications that can be referenced by tasks that use serverless compute or a compute resource that uses Environments mode.
+    
+    For notebook tasks that use serverless compute or a compute resource that uses Environments mode, if the environment_key is not specified, the notebook environment will be used if present. If a jobs environment is specified, it will override the notebook environment.
+    For other tasks that use serverless compute or a compute resource that uses Environments mode, the task environment is required to be specified using environment_key in the task settings.
     """
 
     git_source: VariableOrOptional[GitSource] = None
@@ -110,6 +145,9 @@ class Job(Resource):
     """
 
     health: VariableOrOptional[JobsHealthRules] = None
+    """
+    An optional set of health rules that can be defined for this job.
+    """
 
     job_clusters: VariableOrList[JobCluster] = field(default_factory=list)
     """
@@ -118,7 +156,7 @@ class Job(Resource):
 
     lifecycle: VariableOrOptional[Lifecycle] = None
     """
-    Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
     """
 
     max_concurrent_runs: VariableOrOptional[int] = None
@@ -146,16 +184,27 @@ class Job(Resource):
     Job-level parameter definitions
     """
 
+    parent_path: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Path of the job parent folder in workspace file tree. If absent, the job doesn't have a workspace object.
+    """
+
     performance_target: VariableOrOptional[PerformanceTarget] = None
     """
     The performance mode on a serverless job. This field determines the level of compute performance or cost-efficiency for the run.
     The performance target does not apply to tasks that run on Serverless GPU compute.
     
-    * `STANDARD`: Enables cost-efficient execution of serverless workloads.
     * `PERFORMANCE_OPTIMIZED`: Prioritizes fast startup and execution times through rapid scaling and optimized cluster performance.
+    * `STANDARD`: Enables cost-efficient execution of serverless workloads.
+    * `COST_OPTIMIZED`: Enables lower job costs by optimizing compute for your selected target duration time. Must provide a duration target.
     """
 
     permissions: VariableOrList[JobPermission] = field(default_factory=list)
+    """
+    The permissions to apply to this resource.
+    """
 
     queue: VariableOrOptional[QueueSettings] = None
     """
@@ -163,6 +212,11 @@ class Job(Resource):
     """
 
     run_as: VariableOrOptional[JobRunAs] = None
+    """
+    The user or service principal that the job runs as, if specified in the request.
+    This field indicates the explicit configuration of `run_as` for the job.
+    To find the value in all cases, explicit or implicit, use `run_as_user_name`.
+    """
 
     schedule: VariableOrOptional[CronSchedule] = None
     """
@@ -191,11 +245,19 @@ class Job(Resource):
     A configuration to trigger a run when certain conditions are met. The default behavior is that the job runs only when triggered by clicking “Run Now” in the Jobs UI or sending an API request to `runNow`.
     """
 
+    triggers: VariableOrList[TriggerConfiguration] = field(default_factory=list)
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] List of triggers attached to this job. A run starts when any active trigger evaluates to true. Cannot be set in
+    the same request as the legacy `schedule`, `trigger`, or `continuous` fields. Gated behind the "Multiple Triggers" feature preview.
+    """
+
     usage_policy_id: VariableOrOptional[str] = None
     """
     :meta private: [EXPERIMENTAL]
     
-    The id of the user specified usage policy to use for this job.
+    [Private Preview] The id of the user specified usage policy to use for this job.
     If not specified, a default usage policy may be applied when creating or modifying the job.
     See `effective_usage_policy_id` for the usage policy used by this workload.
     """
@@ -218,7 +280,7 @@ class JobDict(TypedDict, total=False):
 
     budget_policy_id: VariableOrOptional[str]
     """
-    The id of the user specified budget policy to use for this job.
+    [Public Preview] The id of the user specified budget policy to use for this job.
     If not specified, a default budget policy may be applied when creating or modifying the job.
     See `effective_budget_policy_id` for the budget policy used by this workload.
     """
@@ -226,6 +288,8 @@ class JobDict(TypedDict, total=False):
     continuous: VariableOrOptional[ContinuousParam]
     """
     An optional continuous property for this job. The continuous property will ensure that there is always one run executing. Only one of `schedule` and `continuous` can be used.
+    
+    Pipelines started by a continuous job also run continuously, regardless of their own pipeline mode setting.
     """
 
     description: VariableOrOptional[str]
@@ -233,16 +297,37 @@ class JobDict(TypedDict, total=False):
     An optional description for the job. The maximum length is 27700 characters in UTF-8 encoding.
     """
 
+    duration_target: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The window the run aims to finish within, in hours, for a Cost-optimized serverless run.
+    Required only when `performance_target` is `COST_OPTIMIZED`. Must be one of the
+    supported values: `NO_FLEXIBILITY`, `4h`, `12h`, `24h`, `72h`. `NO_FLEXIBILITY` means the run
+    uses the default cost-optimized performance level without additional cost-saving optimizations.
+    """
+
     email_notifications: VariableOrOptional[JobEmailNotificationsParam]
     """
     An optional set of email addresses that is notified when runs of this job begin or complete as well as when this job is deleted.
     """
 
+    environment_variables: VariableOrList[JobEnvironmentVariablesParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Named environment-variable entries that tasks can reference by key from
+    `TaskSettings.environment_variables_key`. Each entry's `spec` holds inline
+    `variables` and optional `.env` `files`. Maximum 10 entries per job. A task
+    can reference at most one entry from this list.
+    """
+
     environments: VariableOrList[JobEnvironmentParam]
     """
-    A list of task execution environment specifications that can be referenced by serverless tasks of this job.
-    For serverless notebook tasks, if the environment_key is not specified, the notebook environment will be used if present. If a jobs environment is specified, it will override the notebook environment.
-    For other serverless tasks, the task environment is required to be specified using environment_key in the task settings.
+    A list of task execution environment specifications that can be referenced by tasks that use serverless compute or a compute resource that uses Environments mode.
+    
+    For notebook tasks that use serverless compute or a compute resource that uses Environments mode, if the environment_key is not specified, the notebook environment will be used if present. If a jobs environment is specified, it will override the notebook environment.
+    For other tasks that use serverless compute or a compute resource that uses Environments mode, the task environment is required to be specified using environment_key in the task settings.
     """
 
     git_source: VariableOrOptional[GitSourceParam]
@@ -255,6 +340,9 @@ class JobDict(TypedDict, total=False):
     """
 
     health: VariableOrOptional[JobsHealthRulesParam]
+    """
+    An optional set of health rules that can be defined for this job.
+    """
 
     job_clusters: VariableOrList[JobClusterParam]
     """
@@ -263,7 +351,7 @@ class JobDict(TypedDict, total=False):
 
     lifecycle: VariableOrOptional[LifecycleParam]
     """
-    Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
     """
 
     max_concurrent_runs: VariableOrOptional[int]
@@ -291,16 +379,27 @@ class JobDict(TypedDict, total=False):
     Job-level parameter definitions
     """
 
+    parent_path: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Path of the job parent folder in workspace file tree. If absent, the job doesn't have a workspace object.
+    """
+
     performance_target: VariableOrOptional[PerformanceTargetParam]
     """
     The performance mode on a serverless job. This field determines the level of compute performance or cost-efficiency for the run.
     The performance target does not apply to tasks that run on Serverless GPU compute.
     
-    * `STANDARD`: Enables cost-efficient execution of serverless workloads.
     * `PERFORMANCE_OPTIMIZED`: Prioritizes fast startup and execution times through rapid scaling and optimized cluster performance.
+    * `STANDARD`: Enables cost-efficient execution of serverless workloads.
+    * `COST_OPTIMIZED`: Enables lower job costs by optimizing compute for your selected target duration time. Must provide a duration target.
     """
 
     permissions: VariableOrList[JobPermissionParam]
+    """
+    The permissions to apply to this resource.
+    """
 
     queue: VariableOrOptional[QueueSettingsParam]
     """
@@ -308,6 +407,11 @@ class JobDict(TypedDict, total=False):
     """
 
     run_as: VariableOrOptional[JobRunAsParam]
+    """
+    The user or service principal that the job runs as, if specified in the request.
+    This field indicates the explicit configuration of `run_as` for the job.
+    To find the value in all cases, explicit or implicit, use `run_as_user_name`.
+    """
 
     schedule: VariableOrOptional[CronScheduleParam]
     """
@@ -336,11 +440,19 @@ class JobDict(TypedDict, total=False):
     A configuration to trigger a run when certain conditions are met. The default behavior is that the job runs only when triggered by clicking “Run Now” in the Jobs UI or sending an API request to `runNow`.
     """
 
+    triggers: VariableOrList[TriggerConfigurationParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] List of triggers attached to this job. A run starts when any active trigger evaluates to true. Cannot be set in
+    the same request as the legacy `schedule`, `trigger`, or `continuous` fields. Gated behind the "Multiple Triggers" feature preview.
+    """
+
     usage_policy_id: VariableOrOptional[str]
     """
     :meta private: [EXPERIMENTAL]
     
-    The id of the user specified usage policy to use for this job.
+    [Private Preview] The id of the user specified usage policy to use for this job.
     If not specified, a default usage policy may be applied when creating or modifying the job.
     See `effective_usage_policy_id` for the usage policy used by this workload.
     """
diff --git a/python/databricks/bundles/jobs/_models/job_cluster.py b/python/databricks/bundles/jobs/_models/job_cluster.py
index a23bb51f99f..8c3390db857 100644
--- a/python/databricks/bundles/jobs/_models/job_cluster.py
+++ b/python/databricks/bundles/jobs/_models/job_cluster.py
@@ -1,9 +1,11 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
 from databricks.bundles.core._transform import _transform
 from databricks.bundles.core._transform_to_json import _transform_to_json_value
-from databricks.bundles.core._variable import VariableOr
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
 from databricks.bundles.jobs._models.cluster_spec import ClusterSpec, ClusterSpecParam
 
 if TYPE_CHECKING:
@@ -20,11 +22,20 @@ class JobCluster:
     `JobTaskSettings` may refer to this field to determine which cluster to launch for the task execution.
     """
 
-    new_cluster: VariableOr[ClusterSpec]
+    new_cluster: VariableOrOptional[ClusterSpec] = None
     """
     If new_cluster, a description of a cluster that is created for each task.
     """
 
+    serverless_compute_id: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The ID of the serverless compute object to bind this cluster to. At most one
+    JobCluster per job may set this field; the rate limit defined on the referenced
+    serverless compute applies across all tasks bound to this cluster.
+    """
+
     @classmethod
     def from_dict(cls, value: "JobClusterDict") -> "Self":
         return _transform(cls, value)
@@ -42,10 +53,19 @@ class JobClusterDict(TypedDict, total=False):
     `JobTaskSettings` may refer to this field to determine which cluster to launch for the task execution.
     """
 
-    new_cluster: VariableOr[ClusterSpecParam]
+    new_cluster: VariableOrOptional[ClusterSpecParam]
     """
     If new_cluster, a description of a cluster that is created for each task.
     """
 
+    serverless_compute_id: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The ID of the serverless compute object to bind this cluster to. At most one
+    JobCluster per job may set this field; the rate limit defined on the referenced
+    serverless compute applies across all tasks bound to this cluster.
+    """
+
 
 JobClusterParam = JobClusterDict | JobCluster
diff --git a/python/databricks/bundles/jobs/_models/job_email_notifications.py b/python/databricks/bundles/jobs/_models/job_email_notifications.py
index b97648f4dce..f6bb6fdd548 100644
--- a/python/databricks/bundles/jobs/_models/job_email_notifications.py
+++ b/python/databricks/bundles/jobs/_models/job_email_notifications.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
@@ -31,6 +33,16 @@ class JobEmailNotifications:
     A list of email addresses to be notified when a run unsuccessfully completes. A run is considered to have completed unsuccessfully if it ends with an `INTERNAL_ERROR` `life_cycle_state` or a `FAILED`, or `TIMED_OUT` result_state. If this is not specified on job creation, reset, or update the list is empty, and notifications are not sent.
     """
 
+    on_maintenance_complete: VariableOrList[str] = field(default_factory=list)
+    """
+    A list of email addresses to notify when platform-initiated maintenance completes for a continuous job.
+    """
+
+    on_maintenance_start: VariableOrList[str] = field(default_factory=list)
+    """
+    A list of email addresses to notify when platform-initiated maintenance starts for a continuous job.
+    """
+
     on_start: VariableOrList[str] = field(default_factory=list)
     """
     A list of email addresses to be notified when a run begins. If not specified on job creation, reset, or update, the list is empty, and notifications are not sent.
@@ -38,7 +50,7 @@ class JobEmailNotifications:
 
     on_streaming_backlog_exceeded: VariableOrList[str] = field(default_factory=list)
     """
-    A list of email addresses to notify when any streaming backlog thresholds are exceeded for any stream.
+    [Public Preview] A list of email addresses to notify when any streaming backlog thresholds are exceeded for any stream.
     Streaming backlog thresholds can be set in the `health` field using the following metrics: `STREAMING_BACKLOG_BYTES`, `STREAMING_BACKLOG_RECORDS`, `STREAMING_BACKLOG_SECONDS`, or `STREAMING_BACKLOG_FILES`.
     Alerting is based on the 10-minute average of these metrics. If the issue persists, notifications are resent every 30 minutes.
     """
@@ -75,6 +87,16 @@ class JobEmailNotificationsDict(TypedDict, total=False):
     A list of email addresses to be notified when a run unsuccessfully completes. A run is considered to have completed unsuccessfully if it ends with an `INTERNAL_ERROR` `life_cycle_state` or a `FAILED`, or `TIMED_OUT` result_state. If this is not specified on job creation, reset, or update the list is empty, and notifications are not sent.
     """
 
+    on_maintenance_complete: VariableOrList[str]
+    """
+    A list of email addresses to notify when platform-initiated maintenance completes for a continuous job.
+    """
+
+    on_maintenance_start: VariableOrList[str]
+    """
+    A list of email addresses to notify when platform-initiated maintenance starts for a continuous job.
+    """
+
     on_start: VariableOrList[str]
     """
     A list of email addresses to be notified when a run begins. If not specified on job creation, reset, or update, the list is empty, and notifications are not sent.
@@ -82,7 +104,7 @@ class JobEmailNotificationsDict(TypedDict, total=False):
 
     on_streaming_backlog_exceeded: VariableOrList[str]
     """
-    A list of email addresses to notify when any streaming backlog thresholds are exceeded for any stream.
+    [Public Preview] A list of email addresses to notify when any streaming backlog thresholds are exceeded for any stream.
     Streaming backlog thresholds can be set in the `health` field using the following metrics: `STREAMING_BACKLOG_BYTES`, `STREAMING_BACKLOG_RECORDS`, `STREAMING_BACKLOG_SECONDS`, or `STREAMING_BACKLOG_FILES`.
     Alerting is based on the 10-minute average of these metrics. If the issue persists, notifications are resent every 30 minutes.
     """
diff --git a/python/databricks/bundles/jobs/_models/job_environment.py b/python/databricks/bundles/jobs/_models/job_environment.py
index 798685f4c68..c71ee45dbd6 100644
--- a/python/databricks/bundles/jobs/_models/job_environment.py
+++ b/python/databricks/bundles/jobs/_models/job_environment.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -20,6 +22,10 @@ class JobEnvironment:
     """
 
     spec: VariableOrOptional[Environment] = None
+    """
+    The environment entity used to preserve serverless environment side panel, jobs' environment for non-notebook task, and SDP's environment for classic and serverless pipelines.
+    In this minimal environment spec, only pip and java dependencies are supported.
+    """
 
     @classmethod
     def from_dict(cls, value: "JobEnvironmentDict") -> "Self":
@@ -38,6 +44,10 @@ class JobEnvironmentDict(TypedDict, total=False):
     """
 
     spec: VariableOrOptional[EnvironmentParam]
+    """
+    The environment entity used to preserve serverless environment side panel, jobs' environment for non-notebook task, and SDP's environment for classic and serverless pipelines.
+    In this minimal environment spec, only pip and java dependencies are supported.
+    """
 
 
 JobEnvironmentParam = JobEnvironmentDict | JobEnvironment
diff --git a/python/databricks/bundles/jobs/_models/job_environment_variables.py b/python/databricks/bundles/jobs/_models/job_environment_variables.py
new file mode 100644
index 00000000000..aca6fd61d7d
--- /dev/null
+++ b/python/databricks/bundles/jobs/_models/job_environment_variables.py
@@ -0,0 +1,71 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+from databricks.bundles.jobs._models.job_environment_variables_spec import (
+    JobEnvironmentVariablesSpec,
+    JobEnvironmentVariablesSpecParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class JobEnvironmentVariables:
+    """
+    A named environment-variable entry, defined once at the job level and
+    referenced by key from one or more tasks. Entries live on
+    `JobSettings.environment_variables`, and tasks select one via
+    `TaskSettings.environment_variables_key`.
+    """
+
+    environment_variables_key: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Identifier for this entry. Must be unique within
+    `JobSettings.environment_variables`. Tasks reference it from
+    `TaskSettings.environment_variables_key`.
+    """
+
+    spec: VariableOrOptional[JobEnvironmentVariablesSpec] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] The environment variable specification.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "JobEnvironmentVariablesDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "JobEnvironmentVariablesDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class JobEnvironmentVariablesDict(TypedDict, total=False):
+    """"""
+
+    environment_variables_key: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Identifier for this entry. Must be unique within
+    `JobSettings.environment_variables`. Tasks reference it from
+    `TaskSettings.environment_variables_key`.
+    """
+
+    spec: VariableOrOptional[JobEnvironmentVariablesSpecParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] The environment variable specification.
+    """
+
+
+JobEnvironmentVariablesParam = JobEnvironmentVariablesDict | JobEnvironmentVariables
diff --git a/python/databricks/bundles/jobs/_models/job_environment_variables_spec.py b/python/databricks/bundles/jobs/_models/job_environment_variables_spec.py
new file mode 100644
index 00000000000..907d2914d57
--- /dev/null
+++ b/python/databricks/bundles/jobs/_models/job_environment_variables_spec.py
@@ -0,0 +1,112 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrDict, VariableOrList
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class JobEnvironmentVariablesSpec:
+    """
+    The environment variables and files associated with a job environment
+    variable entry. Runtime environment variables override inline `variables`,
+    which override values from `files`, on duplicate keys.
+    """
+
+    files: VariableOrList[str] = field(default_factory=list)
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Workspace (`/Workspace/...`) or UC Volumes (`/Volumes/...`) paths to
+    `.env` files. Maximum 5 files. Files are read, parsed, and merged at
+    task execution time, not at job creation or update API call time.
+    
+    File format: each line containing a variable must be exactly `KEY=VALUE`.
+    Empty and whitespace-only lines, and lines beginning with `#`, are ignored.
+    Keys must match the same regex as inlined variable names
+    (`^[A-Za-z_][A-Za-z0-9_]*$`); the value continues to the end of the line.
+    No other syntax is supported — no inline comments, no quoted values, no
+    escape sequences, no variable interpolation. Any other line that does not
+    match the `KEY=VALUE` shape fails the run.
+    
+    Size limits: maximum 32,768 bytes (32 KiB) per file on disk;
+    maximum 1,024 bytes (1 KiB) per `KEY=VALUE` line combined.
+    Files or lines exceeding these limits fail the run.
+    
+    On a duplicate key, the later file wins; `variables` override values
+    from any file.
+    """
+
+    variables: VariableOrDict[str] = field(default_factory=dict)
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Environment variables specified directly as key/value pairs. Maximum 20
+    entries.
+    
+    Each key must be 1 to 256 characters and match
+    `^[A-Za-z_][A-Za-z0-9_]*$`: it must start with an ASCII letter or
+    underscore and contain only ASCII letters, digits, and underscores. Each
+    value can be any Unicode string of up to 512 characters, including an
+    empty string.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "JobEnvironmentVariablesSpecDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "JobEnvironmentVariablesSpecDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class JobEnvironmentVariablesSpecDict(TypedDict, total=False):
+    """"""
+
+    files: VariableOrList[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Workspace (`/Workspace/...`) or UC Volumes (`/Volumes/...`) paths to
+    `.env` files. Maximum 5 files. Files are read, parsed, and merged at
+    task execution time, not at job creation or update API call time.
+    
+    File format: each line containing a variable must be exactly `KEY=VALUE`.
+    Empty and whitespace-only lines, and lines beginning with `#`, are ignored.
+    Keys must match the same regex as inlined variable names
+    (`^[A-Za-z_][A-Za-z0-9_]*$`); the value continues to the end of the line.
+    No other syntax is supported — no inline comments, no quoted values, no
+    escape sequences, no variable interpolation. Any other line that does not
+    match the `KEY=VALUE` shape fails the run.
+    
+    Size limits: maximum 32,768 bytes (32 KiB) per file on disk;
+    maximum 1,024 bytes (1 KiB) per `KEY=VALUE` line combined.
+    Files or lines exceeding these limits fail the run.
+    
+    On a duplicate key, the later file wins; `variables` override values
+    from any file.
+    """
+
+    variables: VariableOrDict[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Environment variables specified directly as key/value pairs. Maximum 20
+    entries.
+    
+    Each key must be 1 to 256 characters and match
+    `^[A-Za-z_][A-Za-z0-9_]*$`: it must start with an ASCII letter or
+    underscore and contain only ASCII letters, digits, and underscores. Each
+    value can be any Unicode string of up to 512 characters, including an
+    empty string.
+    """
+
+
+JobEnvironmentVariablesSpecParam = (
+    JobEnvironmentVariablesSpecDict | JobEnvironmentVariablesSpec
+)
diff --git a/python/databricks/bundles/jobs/_models/job_notification_settings.py b/python/databricks/bundles/jobs/_models/job_notification_settings.py
index a311536fbd9..eb6ca454186 100644
--- a/python/databricks/bundles/jobs/_models/job_notification_settings.py
+++ b/python/databricks/bundles/jobs/_models/job_notification_settings.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/job_parameter_definition.py b/python/databricks/bundles/jobs/_models/job_parameter_definition.py
index 8cd8fb9b5f7..3e81a538218 100644
--- a/python/databricks/bundles/jobs/_models/job_parameter_definition.py
+++ b/python/databricks/bundles/jobs/_models/job_parameter_definition.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/job_permission.py b/python/databricks/bundles/jobs/_models/job_permission.py
index b2ab73cee05..6864bf99e23 100644
--- a/python/databricks/bundles/jobs/_models/job_permission.py
+++ b/python/databricks/bundles/jobs/_models/job_permission.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -18,12 +20,24 @@ class JobPermission:
     """"""
 
     level: VariableOr[JobPermissionLevel]
+    """
+    The permission level to apply. The allowed levels depend on the resource type.
+    """
 
     group_name: VariableOrOptional[str] = None
+    """
+    The name of the group granted the permission level.
+    """
 
     service_principal_name: VariableOrOptional[str] = None
+    """
+    The name of the service principal granted the permission level.
+    """
 
     user_name: VariableOrOptional[str] = None
+    """
+    The name of the user granted the permission level.
+    """
 
     @classmethod
     def from_dict(cls, value: "JobPermissionDict") -> "Self":
@@ -37,12 +51,24 @@ class JobPermissionDict(TypedDict, total=False):
     """"""
 
     level: VariableOr[JobPermissionLevelParam]
+    """
+    The permission level to apply. The allowed levels depend on the resource type.
+    """
 
     group_name: VariableOrOptional[str]
+    """
+    The name of the group granted the permission level.
+    """
 
     service_principal_name: VariableOrOptional[str]
+    """
+    The name of the service principal granted the permission level.
+    """
 
     user_name: VariableOrOptional[str]
+    """
+    The name of the user granted the permission level.
+    """
 
 
 JobPermissionParam = JobPermissionDict | JobPermission
diff --git a/python/databricks/bundles/jobs/_models/job_permission_level.py b/python/databricks/bundles/jobs/_models/job_permission_level.py
index c3ed76bd593..e56c96b09d2 100644
--- a/python/databricks/bundles/jobs/_models/job_permission_level.py
+++ b/python/databricks/bundles/jobs/_models/job_permission_level.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
diff --git a/python/databricks/bundles/jobs/_models/job_run_as.py b/python/databricks/bundles/jobs/_models/job_run_as.py
index ac980cfc75b..6242eafad59 100644
--- a/python/databricks/bundles/jobs/_models/job_run_as.py
+++ b/python/databricks/bundles/jobs/_models/job_run_as.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -12,16 +14,14 @@
 @dataclass(kw_only=True)
 class JobRunAs:
     """
-    Write-only setting. Specifies the user or service principal that the job runs as. If not specified, the job runs as the user who created the job.
+    Write-only setting. Specifies the user, service principal, or group that the job runs as. If not specified, the job runs as the user who created the job.
 
-    Either `user_name` or `service_principal_name` should be specified. If not, an error is thrown.
+    One of `user_name`, `service_principal_name`, or `group_name` should be specified. If not, an error is thrown.
     """
 
     group_name: VariableOrOptional[str] = None
     """
-    :meta private: [EXPERIMENTAL]
-    
-    Group name of an account group assigned to the workspace. Setting this field requires being a member of the group.
+    Group name of an account group assigned to the workspace. When set, all tasks run as the group and the group's permissions are used for data access. Setting this field requires being a member of the group, or having the `Assume` permission on the group.
     """
 
     service_principal_name: VariableOrOptional[str] = None
@@ -47,9 +47,7 @@ class JobRunAsDict(TypedDict, total=False):
 
     group_name: VariableOrOptional[str]
     """
-    :meta private: [EXPERIMENTAL]
-    
-    Group name of an account group assigned to the workspace. Setting this field requires being a member of the group.
+    Group name of an account group assigned to the workspace. When set, all tasks run as the group and the group's permissions are used for data access. Setting this field requires being a member of the group, or having the `Assume` permission on the group.
     """
 
     service_principal_name: VariableOrOptional[str]
diff --git a/python/databricks/bundles/jobs/_models/jobs_health_metric.py b/python/databricks/bundles/jobs/_models/jobs_health_metric.py
index fcc894a5577..b662439d3ef 100644
--- a/python/databricks/bundles/jobs/_models/jobs_health_metric.py
+++ b/python/databricks/bundles/jobs/_models/jobs_health_metric.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
diff --git a/python/databricks/bundles/jobs/_models/jobs_health_operator.py b/python/databricks/bundles/jobs/_models/jobs_health_operator.py
index 2d949ff07ad..3de343a8b6a 100644
--- a/python/databricks/bundles/jobs/_models/jobs_health_operator.py
+++ b/python/databricks/bundles/jobs/_models/jobs_health_operator.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
diff --git a/python/databricks/bundles/jobs/_models/jobs_health_rule.py b/python/databricks/bundles/jobs/_models/jobs_health_rule.py
index 149265c86a9..59447874eda 100644
--- a/python/databricks/bundles/jobs/_models/jobs_health_rule.py
+++ b/python/databricks/bundles/jobs/_models/jobs_health_rule.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -22,8 +24,20 @@ class JobsHealthRule:
     """"""
 
     metric: VariableOr[JobsHealthMetric]
+    """
+    Specifies the health metric that is being evaluated for a particular health rule.
+    
+    * `RUN_DURATION_SECONDS`: Expected total time for a run in seconds.
+    * `STREAMING_BACKLOG_BYTES`: An estimate of the maximum bytes of data waiting to be consumed across all streams. This metric is in Public Preview.
+    * `STREAMING_BACKLOG_RECORDS`: An estimate of the maximum offset lag across all streams. This metric is in Public Preview.
+    * `STREAMING_BACKLOG_SECONDS`: An estimate of the maximum consumer delay across all streams. This metric is in Public Preview.
+    * `STREAMING_BACKLOG_FILES`: An estimate of the maximum number of outstanding files across all streams. This metric is in Public Preview.
+    """
 
     op: VariableOr[JobsHealthOperator]
+    """
+    Specifies the operator used to compare the health metric value with the specified threshold.
+    """
 
     value: VariableOr[int]
     """
@@ -42,8 +56,20 @@ class JobsHealthRuleDict(TypedDict, total=False):
     """"""
 
     metric: VariableOr[JobsHealthMetricParam]
+    """
+    Specifies the health metric that is being evaluated for a particular health rule.
+    
+    * `RUN_DURATION_SECONDS`: Expected total time for a run in seconds.
+    * `STREAMING_BACKLOG_BYTES`: An estimate of the maximum bytes of data waiting to be consumed across all streams. This metric is in Public Preview.
+    * `STREAMING_BACKLOG_RECORDS`: An estimate of the maximum offset lag across all streams. This metric is in Public Preview.
+    * `STREAMING_BACKLOG_SECONDS`: An estimate of the maximum consumer delay across all streams. This metric is in Public Preview.
+    * `STREAMING_BACKLOG_FILES`: An estimate of the maximum number of outstanding files across all streams. This metric is in Public Preview.
+    """
 
     op: VariableOr[JobsHealthOperatorParam]
+    """
+    Specifies the operator used to compare the health metric value with the specified threshold.
+    """
 
     value: VariableOr[int]
     """
diff --git a/python/databricks/bundles/jobs/_models/jobs_health_rules.py b/python/databricks/bundles/jobs/_models/jobs_health_rules.py
index 4f251368d1b..daf613406b5 100644
--- a/python/databricks/bundles/jobs/_models/jobs_health_rules.py
+++ b/python/databricks/bundles/jobs/_models/jobs_health_rules.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/kind.py b/python/databricks/bundles/jobs/_models/kind.py
index 33a487a90e7..8614e25dd52 100644
--- a/python/databricks/bundles/jobs/_models/kind.py
+++ b/python/databricks/bundles/jobs/_models/kind.py
@@ -1,8 +1,22 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
 
 class Kind(Enum):
+    """
+    The kind of compute described by this compute specification.
+
+    Depending on `kind`, different validations and default values will be applied.
+
+    Clusters with `kind = CLASSIC_PREVIEW` support the following fields, whereas clusters with no specified `kind` do not.
+    * [is_single_node](/api/workspace/clusters/create#is_single_node)
+    * [use_ml_runtime](/api/workspace/clusters/create#use_ml_runtime)
+
+    By using the [simple form](https://docs.databricks.com/compute/simple-form.html), your clusters are automatically using `kind = CLASSIC_PREVIEW`.
+    """
+
     CLASSIC_PREVIEW = "CLASSIC_PREVIEW"
 
 
diff --git a/python/databricks/bundles/jobs/_models/library.py b/python/databricks/bundles/jobs/_models/library.py
index c8d4b5f5b5e..29d4c5b1fdd 100644
--- a/python/databricks/bundles/jobs/_models/library.py
+++ b/python/databricks/bundles/jobs/_models/library.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/lifecycle.py b/python/databricks/bundles/jobs/_models/lifecycle.py
index c934967f37e..697776a198e 100644
--- a/python/databricks/bundles/jobs/_models/lifecycle.py
+++ b/python/databricks/bundles/jobs/_models/lifecycle.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/local_file_info.py b/python/databricks/bundles/jobs/_models/local_file_info.py
index 70d6f258200..875f2fe8353 100644
--- a/python/databricks/bundles/jobs/_models/local_file_info.py
+++ b/python/databricks/bundles/jobs/_models/local_file_info.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/log_analytics_info.py b/python/databricks/bundles/jobs/_models/log_analytics_info.py
index 5eced870a1e..67cdf85b2b9 100644
--- a/python/databricks/bundles/jobs/_models/log_analytics_info.py
+++ b/python/databricks/bundles/jobs/_models/log_analytics_info.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/maintenance_window.py b/python/databricks/bundles/jobs/_models/maintenance_window.py
new file mode 100644
index 00000000000..180c65e75cc
--- /dev/null
+++ b/python/databricks/bundles/jobs/_models/maintenance_window.py
@@ -0,0 +1,68 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+from databricks.bundles.jobs._models.day_of_week import DayOfWeek, DayOfWeekParam
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class MaintenanceWindow:
+    """
+    A recurring weekly time window during which platform-initiated maintenance is
+    allowed to run for a continuous job.
+    """
+
+    day_of_week: VariableOr[DayOfWeek]
+    """
+    The day of week on which maintenance is allowed to happen. This field is required.
+    """
+
+    start_hour: VariableOr[int]
+    """
+    An integer between 0 and 23 denoting the start hour for the maintenance window in the 24-hour day.
+    Platform-initiated maintenance is triggered only within a one-hour window starting at this hour.
+    This field is required.
+    """
+
+    timezone_id: VariableOr[str]
+    """
+    A Java timezone ID. The maintenance window is resolved with respect to this timezone. See [Java TimeZone](https://docs.oracle.com/javase/7/docs/api/java/util/TimeZone.html) for details. This field is required.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "MaintenanceWindowDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "MaintenanceWindowDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class MaintenanceWindowDict(TypedDict, total=False):
+    """"""
+
+    day_of_week: VariableOr[DayOfWeekParam]
+    """
+    The day of week on which maintenance is allowed to happen. This field is required.
+    """
+
+    start_hour: VariableOr[int]
+    """
+    An integer between 0 and 23 denoting the start hour for the maintenance window in the 24-hour day.
+    Platform-initiated maintenance is triggered only within a one-hour window starting at this hour.
+    This field is required.
+    """
+
+    timezone_id: VariableOr[str]
+    """
+    A Java timezone ID. The maintenance window is resolved with respect to this timezone. See [Java TimeZone](https://docs.oracle.com/javase/7/docs/api/java/util/TimeZone.html) for details. This field is required.
+    """
+
+
+MaintenanceWindowParam = MaintenanceWindowDict | MaintenanceWindow
diff --git a/python/databricks/bundles/jobs/_models/maven_library.py b/python/databricks/bundles/jobs/_models/maven_library.py
index 45925700b82..25be1599c28 100644
--- a/python/databricks/bundles/jobs/_models/maven_library.py
+++ b/python/databricks/bundles/jobs/_models/maven_library.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/model_trigger_configuration.py b/python/databricks/bundles/jobs/_models/model_trigger_configuration.py
index 140e7e09ec9..29ba7ed1479 100644
--- a/python/databricks/bundles/jobs/_models/model_trigger_configuration.py
+++ b/python/databricks/bundles/jobs/_models/model_trigger_configuration.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
@@ -25,29 +27,39 @@ class ModelTriggerConfiguration:
 
     condition: VariableOr[ModelTriggerConfigurationCondition]
     """
-    The condition based on which to trigger a job run.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The condition based on which to trigger a job run.
     """
 
     aliases: VariableOrList[str] = field(default_factory=list)
     """
-    Aliases of the model versions to monitor. Can only be used in conjunction with condition MODEL_ALIAS_SET.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Aliases of the model versions to monitor. Can only be used in conjunction with condition MODEL_ALIAS_SET.
     """
 
     min_time_between_triggers_seconds: VariableOrOptional[int] = None
     """
-    If set, the trigger starts a run only after the specified amount of time has passed since
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] If set, the trigger starts a run only after the specified amount of time has passed since
     the last time the trigger fired. The minimum allowed value is 60 seconds.
     """
 
     securable_name: VariableOrOptional[str] = None
     """
-    Name of the securable to monitor ("mycatalog.myschema.mymodel" in the case of model-level triggers,
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Name of the securable to monitor ("mycatalog.myschema.mymodel" in the case of model-level triggers,
     "mycatalog.myschema" in the case of schema-level triggers) or empty in the case of metastore-level triggers.
     """
 
     wait_after_last_change_seconds: VariableOrOptional[int] = None
     """
-    If set, the trigger starts a run only after no model updates have occurred for the specified time
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] If set, the trigger starts a run only after no model updates have occurred for the specified time
     and can be used to wait for a series of model updates before triggering a run. The
     minimum allowed value is 60 seconds.
     """
@@ -65,29 +77,39 @@ class ModelTriggerConfigurationDict(TypedDict, total=False):
 
     condition: VariableOr[ModelTriggerConfigurationConditionParam]
     """
-    The condition based on which to trigger a job run.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The condition based on which to trigger a job run.
     """
 
     aliases: VariableOrList[str]
     """
-    Aliases of the model versions to monitor. Can only be used in conjunction with condition MODEL_ALIAS_SET.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Aliases of the model versions to monitor. Can only be used in conjunction with condition MODEL_ALIAS_SET.
     """
 
     min_time_between_triggers_seconds: VariableOrOptional[int]
     """
-    If set, the trigger starts a run only after the specified amount of time has passed since
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] If set, the trigger starts a run only after the specified amount of time has passed since
     the last time the trigger fired. The minimum allowed value is 60 seconds.
     """
 
     securable_name: VariableOrOptional[str]
     """
-    Name of the securable to monitor ("mycatalog.myschema.mymodel" in the case of model-level triggers,
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Name of the securable to monitor ("mycatalog.myschema.mymodel" in the case of model-level triggers,
     "mycatalog.myschema" in the case of schema-level triggers) or empty in the case of metastore-level triggers.
     """
 
     wait_after_last_change_seconds: VariableOrOptional[int]
     """
-    If set, the trigger starts a run only after no model updates have occurred for the specified time
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] If set, the trigger starts a run only after no model updates have occurred for the specified time
     and can be used to wait for a series of model updates before triggering a run. The
     minimum allowed value is 60 seconds.
     """
diff --git a/python/databricks/bundles/jobs/_models/model_trigger_configuration_condition.py b/python/databricks/bundles/jobs/_models/model_trigger_configuration_condition.py
index 60d942a2c57..013f413303b 100644
--- a/python/databricks/bundles/jobs/_models/model_trigger_configuration_condition.py
+++ b/python/databricks/bundles/jobs/_models/model_trigger_configuration_condition.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
diff --git a/python/databricks/bundles/jobs/_models/node_type_flexibility.py b/python/databricks/bundles/jobs/_models/node_type_flexibility.py
index 1f6dade3569..418ea9337bd 100644
--- a/python/databricks/bundles/jobs/_models/node_type_flexibility.py
+++ b/python/databricks/bundles/jobs/_models/node_type_flexibility.py
@@ -1,9 +1,11 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
 from databricks.bundles.core._transform import _transform
 from databricks.bundles.core._transform_to_json import _transform_to_json_value
-from databricks.bundles.core._variable import VariableOrList
+from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
 
 if TYPE_CHECKING:
     from typing_extensions import Self
@@ -20,6 +22,12 @@ class NodeTypeFlexibility:
     A list of node type IDs to use as fallbacks when the primary node type is unavailable.
     """
 
+    aws_context_id: VariableOrOptional[str] = None
+    """
+    The AWS Context ID for EC2 Fleet.
+    When set (non-empty), the value is passed to AWS CreateFleet API to create the EC2 Fleet.
+    """
+
     @classmethod
     def from_dict(cls, value: "NodeTypeFlexibilityDict") -> "Self":
         return _transform(cls, value)
@@ -36,5 +44,11 @@ class NodeTypeFlexibilityDict(TypedDict, total=False):
     A list of node type IDs to use as fallbacks when the primary node type is unavailable.
     """
 
+    aws_context_id: VariableOrOptional[str]
+    """
+    The AWS Context ID for EC2 Fleet.
+    When set (non-empty), the value is passed to AWS CreateFleet API to create the EC2 Fleet.
+    """
+
 
 NodeTypeFlexibilityParam = NodeTypeFlexibilityDict | NodeTypeFlexibility
diff --git a/python/databricks/bundles/jobs/_models/notebook_task.py b/python/databricks/bundles/jobs/_models/notebook_task.py
index 3585a849419..7b4329392db 100644
--- a/python/databricks/bundles/jobs/_models/notebook_task.py
+++ b/python/databricks/bundles/jobs/_models/notebook_task.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/pause_status.py b/python/databricks/bundles/jobs/_models/pause_status.py
index ee701fa10c9..9e5044fb880 100644
--- a/python/databricks/bundles/jobs/_models/pause_status.py
+++ b/python/databricks/bundles/jobs/_models/pause_status.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
diff --git a/python/databricks/bundles/jobs/_models/performance_target.py b/python/databricks/bundles/jobs/_models/performance_target.py
index 5e7b83ae616..8dbe7e4a435 100644
--- a/python/databricks/bundles/jobs/_models/performance_target.py
+++ b/python/databricks/bundles/jobs/_models/performance_target.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
diff --git a/python/databricks/bundles/jobs/_models/periodic_trigger_configuration.py b/python/databricks/bundles/jobs/_models/periodic_trigger_configuration.py
index 5ff5479a886..2e7215aad06 100644
--- a/python/databricks/bundles/jobs/_models/periodic_trigger_configuration.py
+++ b/python/databricks/bundles/jobs/_models/periodic_trigger_configuration.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/periodic_trigger_configuration_time_unit.py b/python/databricks/bundles/jobs/_models/periodic_trigger_configuration_time_unit.py
index a24d023a78e..e035958b12c 100644
--- a/python/databricks/bundles/jobs/_models/periodic_trigger_configuration_time_unit.py
+++ b/python/databricks/bundles/jobs/_models/periodic_trigger_configuration_time_unit.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
@@ -6,8 +8,9 @@ class PeriodicTriggerConfigurationTimeUnit(Enum):
     HOURS = "HOURS"
     DAYS = "DAYS"
     WEEKS = "WEEKS"
+    MINUTES = "MINUTES"
 
 
 PeriodicTriggerConfigurationTimeUnitParam = (
-    Literal["HOURS", "DAYS", "WEEKS"] | PeriodicTriggerConfigurationTimeUnit
+    Literal["HOURS", "DAYS", "WEEKS", "MINUTES"] | PeriodicTriggerConfigurationTimeUnit
 )
diff --git a/python/databricks/bundles/jobs/_models/pipeline_params.py b/python/databricks/bundles/jobs/_models/pipeline_params.py
index 0aa552e2e64..98550f271fb 100644
--- a/python/databricks/bundles/jobs/_models/pipeline_params.py
+++ b/python/databricks/bundles/jobs/_models/pipeline_params.py
@@ -1,9 +1,11 @@
-from dataclasses import dataclass
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
 from databricks.bundles.core._transform import _transform
 from databricks.bundles.core._transform_to_json import _transform_to_json_value
-from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
 
 if TYPE_CHECKING:
     from typing_extensions import Self
@@ -15,7 +17,28 @@ class PipelineParams:
 
     full_refresh: VariableOrOptional[bool] = None
     """
-    If true, triggers a full refresh on the delta live table.
+    If true, triggers a full refresh on the spark declarative pipeline.
+    """
+
+    full_refresh_selection: VariableOrList[str] = field(default_factory=list)
+    """
+    A list of tables to update with fullRefresh.
+    """
+
+    refresh_flow_selection: VariableOrList[str] = field(default_factory=list)
+    """
+    Flow names to selectively refresh. These are unioned with other selective refresh
+    options (refresh_selection, full_refresh_selection) to determine the final set of flows to refresh.
+    """
+
+    refresh_selection: VariableOrList[str] = field(default_factory=list)
+    """
+    A list of tables to update without fullRefresh.
+    """
+
+    reset_checkpoint_selection: VariableOrList[str] = field(default_factory=list)
+    """
+    A list of streaming flows to reset checkpoints without clearing data.
     """
 
     @classmethod
@@ -31,7 +54,28 @@ class PipelineParamsDict(TypedDict, total=False):
 
     full_refresh: VariableOrOptional[bool]
     """
-    If true, triggers a full refresh on the delta live table.
+    If true, triggers a full refresh on the spark declarative pipeline.
+    """
+
+    full_refresh_selection: VariableOrList[str]
+    """
+    A list of tables to update with fullRefresh.
+    """
+
+    refresh_flow_selection: VariableOrList[str]
+    """
+    Flow names to selectively refresh. These are unioned with other selective refresh
+    options (refresh_selection, full_refresh_selection) to determine the final set of flows to refresh.
+    """
+
+    refresh_selection: VariableOrList[str]
+    """
+    A list of tables to update without fullRefresh.
+    """
+
+    reset_checkpoint_selection: VariableOrList[str]
+    """
+    A list of streaming flows to reset checkpoints without clearing data.
     """
 
 
diff --git a/python/databricks/bundles/jobs/_models/pipeline_task.py b/python/databricks/bundles/jobs/_models/pipeline_task.py
index 81126a8ed42..87d720fcd69 100644
--- a/python/databricks/bundles/jobs/_models/pipeline_task.py
+++ b/python/databricks/bundles/jobs/_models/pipeline_task.py
@@ -1,9 +1,16 @@
-from dataclasses import dataclass
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
 from databricks.bundles.core._transform import _transform
 from databricks.bundles.core._transform_to_json import _transform_to_json_value
-from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+from databricks.bundles.core._variable import (
+    VariableOr,
+    VariableOrDict,
+    VariableOrList,
+    VariableOrOptional,
+)
 
 if TYPE_CHECKING:
     from typing_extensions import Self
@@ -20,7 +27,36 @@ class PipelineTask:
 
     full_refresh: VariableOrOptional[bool] = None
     """
-    If true, triggers a full refresh on the delta live table.
+    If true, triggers a full refresh on the spark declarative pipeline.
+    """
+
+    full_refresh_selection: VariableOrList[str] = field(default_factory=list)
+    """
+    A list of tables to update with fullRefresh.
+    """
+
+    parameters: VariableOrDict[str] = field(default_factory=dict)
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Key/value-map of parameters passed to the pipeline execution.
+    Limited to 10k characters in total.
+    """
+
+    refresh_flow_selection: VariableOrList[str] = field(default_factory=list)
+    """
+    Flow names to selectively refresh. These are unioned with other selective refresh
+    options (refresh_selection, full_refresh_selection) to determine the final set of flows to refresh.
+    """
+
+    refresh_selection: VariableOrList[str] = field(default_factory=list)
+    """
+    A list of tables to update without fullRefresh.
+    """
+
+    reset_checkpoint_selection: VariableOrList[str] = field(default_factory=list)
+    """
+    A list of streaming flows to reset checkpoints without clearing data.
     """
 
     @classmethod
@@ -41,7 +77,36 @@ class PipelineTaskDict(TypedDict, total=False):
 
     full_refresh: VariableOrOptional[bool]
     """
-    If true, triggers a full refresh on the delta live table.
+    If true, triggers a full refresh on the spark declarative pipeline.
+    """
+
+    full_refresh_selection: VariableOrList[str]
+    """
+    A list of tables to update with fullRefresh.
+    """
+
+    parameters: VariableOrDict[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Key/value-map of parameters passed to the pipeline execution.
+    Limited to 10k characters in total.
+    """
+
+    refresh_flow_selection: VariableOrList[str]
+    """
+    Flow names to selectively refresh. These are unioned with other selective refresh
+    options (refresh_selection, full_refresh_selection) to determine the final set of flows to refresh.
+    """
+
+    refresh_selection: VariableOrList[str]
+    """
+    A list of tables to update without fullRefresh.
+    """
+
+    reset_checkpoint_selection: VariableOrList[str]
+    """
+    A list of streaming flows to reset checkpoints without clearing data.
     """
 
 
diff --git a/python/databricks/bundles/jobs/_models/power_bi_model.py b/python/databricks/bundles/jobs/_models/power_bi_model.py
index b31c5735abb..f791b1901a8 100644
--- a/python/databricks/bundles/jobs/_models/power_bi_model.py
+++ b/python/databricks/bundles/jobs/_models/power_bi_model.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -20,27 +22,27 @@ class PowerBiModel:
 
     authentication_method: VariableOrOptional[AuthenticationMethod] = None
     """
-    How the published Power BI model authenticates to Databricks
+    [Public Preview] How the published Power BI model authenticates to Databricks
     """
 
     model_name: VariableOrOptional[str] = None
     """
-    The name of the Power BI model
+    [Public Preview] The name of the Power BI model
     """
 
     overwrite_existing: VariableOrOptional[bool] = None
     """
-    Whether to overwrite existing Power BI models
+    [Public Preview] Whether to overwrite existing Power BI models
     """
 
     storage_mode: VariableOrOptional[StorageMode] = None
     """
-    The default storage mode of the Power BI model
+    [Public Preview] The default storage mode of the Power BI model
     """
 
     workspace_name: VariableOrOptional[str] = None
     """
-    The name of the Power BI workspace of the model
+    [Public Preview] The name of the Power BI workspace of the model
     """
 
     @classmethod
@@ -56,27 +58,27 @@ class PowerBiModelDict(TypedDict, total=False):
 
     authentication_method: VariableOrOptional[AuthenticationMethodParam]
     """
-    How the published Power BI model authenticates to Databricks
+    [Public Preview] How the published Power BI model authenticates to Databricks
     """
 
     model_name: VariableOrOptional[str]
     """
-    The name of the Power BI model
+    [Public Preview] The name of the Power BI model
     """
 
     overwrite_existing: VariableOrOptional[bool]
     """
-    Whether to overwrite existing Power BI models
+    [Public Preview] Whether to overwrite existing Power BI models
     """
 
     storage_mode: VariableOrOptional[StorageModeParam]
     """
-    The default storage mode of the Power BI model
+    [Public Preview] The default storage mode of the Power BI model
     """
 
     workspace_name: VariableOrOptional[str]
     """
-    The name of the Power BI workspace of the model
+    [Public Preview] The name of the Power BI workspace of the model
     """
 
 
diff --git a/python/databricks/bundles/jobs/_models/power_bi_table.py b/python/databricks/bundles/jobs/_models/power_bi_table.py
index 83e433da6d8..368f432c45d 100644
--- a/python/databricks/bundles/jobs/_models/power_bi_table.py
+++ b/python/databricks/bundles/jobs/_models/power_bi_table.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -16,22 +18,22 @@ class PowerBiTable:
 
     catalog: VariableOrOptional[str] = None
     """
-    The catalog name in Databricks
+    [Public Preview] The catalog name in Databricks
     """
 
     name: VariableOrOptional[str] = None
     """
-    The table name in Databricks
+    [Public Preview] The table name in Databricks
     """
 
     schema: VariableOrOptional[str] = None
     """
-    The schema name in Databricks
+    [Public Preview] The schema name in Databricks
     """
 
     storage_mode: VariableOrOptional[StorageMode] = None
     """
-    The Power BI storage mode of the table
+    [Public Preview] The Power BI storage mode of the table
     """
 
     @classmethod
@@ -47,22 +49,22 @@ class PowerBiTableDict(TypedDict, total=False):
 
     catalog: VariableOrOptional[str]
     """
-    The catalog name in Databricks
+    [Public Preview] The catalog name in Databricks
     """
 
     name: VariableOrOptional[str]
     """
-    The table name in Databricks
+    [Public Preview] The table name in Databricks
     """
 
     schema: VariableOrOptional[str]
     """
-    The schema name in Databricks
+    [Public Preview] The schema name in Databricks
     """
 
     storage_mode: VariableOrOptional[StorageModeParam]
     """
-    The Power BI storage mode of the table
+    [Public Preview] The Power BI storage mode of the table
     """
 
 
diff --git a/python/databricks/bundles/jobs/_models/power_bi_task.py b/python/databricks/bundles/jobs/_models/power_bi_task.py
index ceea220ed89..cd6246cbca8 100644
--- a/python/databricks/bundles/jobs/_models/power_bi_task.py
+++ b/python/databricks/bundles/jobs/_models/power_bi_task.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
@@ -23,27 +25,27 @@ class PowerBiTask:
 
     connection_resource_name: VariableOrOptional[str] = None
     """
-    The resource name of the UC connection to authenticate from Databricks to Power BI
+    [Public Preview] The resource name of the UC connection to authenticate from Databricks to Power BI
     """
 
     power_bi_model: VariableOrOptional[PowerBiModel] = None
     """
-    The semantic model to update
+    [Public Preview] The semantic model to update
     """
 
     refresh_after_update: VariableOrOptional[bool] = None
     """
-    Whether the model should be refreshed after the update
+    [Public Preview] Whether the model should be refreshed after the update
     """
 
     tables: VariableOrList[PowerBiTable] = field(default_factory=list)
     """
-    The tables to be exported to Power BI
+    [Public Preview] The tables to be exported to Power BI
     """
 
     warehouse_id: VariableOrOptional[str] = None
     """
-    The SQL warehouse ID to use as the Power BI data source
+    [Public Preview] The SQL warehouse ID to use as the Power BI data source
     """
 
     @classmethod
@@ -59,27 +61,27 @@ class PowerBiTaskDict(TypedDict, total=False):
 
     connection_resource_name: VariableOrOptional[str]
     """
-    The resource name of the UC connection to authenticate from Databricks to Power BI
+    [Public Preview] The resource name of the UC connection to authenticate from Databricks to Power BI
     """
 
     power_bi_model: VariableOrOptional[PowerBiModelParam]
     """
-    The semantic model to update
+    [Public Preview] The semantic model to update
     """
 
     refresh_after_update: VariableOrOptional[bool]
     """
-    Whether the model should be refreshed after the update
+    [Public Preview] Whether the model should be refreshed after the update
     """
 
     tables: VariableOrList[PowerBiTableParam]
     """
-    The tables to be exported to Power BI
+    [Public Preview] The tables to be exported to Power BI
     """
 
     warehouse_id: VariableOrOptional[str]
     """
-    The SQL warehouse ID to use as the Power BI data source
+    [Public Preview] The SQL warehouse ID to use as the Power BI data source
     """
 
 
diff --git a/python/databricks/bundles/jobs/_models/python_operator_task.py b/python/databricks/bundles/jobs/_models/python_operator_task.py
new file mode 100644
index 00000000000..a2ca2be4c3b
--- /dev/null
+++ b/python/databricks/bundles/jobs/_models/python_operator_task.py
@@ -0,0 +1,70 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
+from databricks.bundles.jobs._models.python_operator_task_parameter import (
+    PythonOperatorTaskParameter,
+    PythonOperatorTaskParameterParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class PythonOperatorTask:
+    """
+    :meta private: [EXPERIMENTAL]
+    """
+
+    main: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Fully qualified name of the main class or function.
+    For example, `my_project.my_function` or `my_project.MyOperator`.
+    """
+
+    parameters: VariableOrList[PythonOperatorTaskParameter] = field(
+        default_factory=list
+    )
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] An ordered list of task parameters.
+    TODO(JOBS-30885): Add limits for parameters.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "PythonOperatorTaskDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "PythonOperatorTaskDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class PythonOperatorTaskDict(TypedDict, total=False):
+    """"""
+
+    main: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Fully qualified name of the main class or function.
+    For example, `my_project.my_function` or `my_project.MyOperator`.
+    """
+
+    parameters: VariableOrList[PythonOperatorTaskParameterParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] An ordered list of task parameters.
+    TODO(JOBS-30885): Add limits for parameters.
+    """
+
+
+PythonOperatorTaskParam = PythonOperatorTaskDict | PythonOperatorTask
diff --git a/python/databricks/bundles/jobs/_models/python_operator_task_parameter.py b/python/databricks/bundles/jobs/_models/python_operator_task_parameter.py
new file mode 100644
index 00000000000..867dff0db64
--- /dev/null
+++ b/python/databricks/bundles/jobs/_models/python_operator_task_parameter.py
@@ -0,0 +1,62 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class PythonOperatorTaskParameter:
+    """
+    :meta private: [EXPERIMENTAL]
+    """
+
+    name: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview]
+    """
+
+    value: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview]
+    """
+
+    @classmethod
+    def from_dict(cls, value: "PythonOperatorTaskParameterDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "PythonOperatorTaskParameterDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class PythonOperatorTaskParameterDict(TypedDict, total=False):
+    """"""
+
+    name: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview]
+    """
+
+    value: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview]
+    """
+
+
+PythonOperatorTaskParameterParam = (
+    PythonOperatorTaskParameterDict | PythonOperatorTaskParameter
+)
diff --git a/python/databricks/bundles/jobs/_models/python_py_pi_library.py b/python/databricks/bundles/jobs/_models/python_py_pi_library.py
index 58db37caf5b..037c2029f50 100644
--- a/python/databricks/bundles/jobs/_models/python_py_pi_library.py
+++ b/python/databricks/bundles/jobs/_models/python_py_pi_library.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/python_wheel_task.py b/python/databricks/bundles/jobs/_models/python_wheel_task.py
index 07a230d8f59..ce2dea3ea15 100644
--- a/python/databricks/bundles/jobs/_models/python_wheel_task.py
+++ b/python/databricks/bundles/jobs/_models/python_wheel_task.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/queue_settings.py b/python/databricks/bundles/jobs/_models/queue_settings.py
index c0c2b5af346..a72921aed96 100644
--- a/python/databricks/bundles/jobs/_models/queue_settings.py
+++ b/python/databricks/bundles/jobs/_models/queue_settings.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/r_cran_library.py b/python/databricks/bundles/jobs/_models/r_cran_library.py
index 0770f2265aa..0bd2c4d5296 100644
--- a/python/databricks/bundles/jobs/_models/r_cran_library.py
+++ b/python/databricks/bundles/jobs/_models/r_cran_library.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/run_if.py b/python/databricks/bundles/jobs/_models/run_if.py
index d61bf51eac3..fdbf95b1bc2 100644
--- a/python/databricks/bundles/jobs/_models/run_if.py
+++ b/python/databricks/bundles/jobs/_models/run_if.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
diff --git a/python/databricks/bundles/jobs/_models/run_job_task.py b/python/databricks/bundles/jobs/_models/run_job_task.py
index c7b88ee5eaa..24d0246a8a7 100644
--- a/python/databricks/bundles/jobs/_models/run_job_task.py
+++ b/python/databricks/bundles/jobs/_models/run_job_task.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/runtime_engine.py b/python/databricks/bundles/jobs/_models/runtime_engine.py
index 1829c507e7e..2e1559fa801 100644
--- a/python/databricks/bundles/jobs/_models/runtime_engine.py
+++ b/python/databricks/bundles/jobs/_models/runtime_engine.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
diff --git a/python/databricks/bundles/jobs/_models/s3_storage_info.py b/python/databricks/bundles/jobs/_models/s3_storage_info.py
index b5e09063e51..071abd5b6f3 100644
--- a/python/databricks/bundles/jobs/_models/s3_storage_info.py
+++ b/python/databricks/bundles/jobs/_models/s3_storage_info.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/source.py b/python/databricks/bundles/jobs/_models/source.py
index c9e02d4a437..380ab711022 100644
--- a/python/databricks/bundles/jobs/_models/source.py
+++ b/python/databricks/bundles/jobs/_models/source.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
diff --git a/python/databricks/bundles/jobs/_models/spark_jar_task.py b/python/databricks/bundles/jobs/_models/spark_jar_task.py
index 9b727384377..d782da867f3 100644
--- a/python/databricks/bundles/jobs/_models/spark_jar_task.py
+++ b/python/databricks/bundles/jobs/_models/spark_jar_task.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/spark_python_task.py b/python/databricks/bundles/jobs/_models/spark_python_task.py
index fe5a3fcce3e..001d9287b1c 100644
--- a/python/databricks/bundles/jobs/_models/spark_python_task.py
+++ b/python/databricks/bundles/jobs/_models/spark_python_task.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/spark_submit_task.py b/python/databricks/bundles/jobs/_models/spark_submit_task.py
index c809dbe7211..2acc389b91b 100644
--- a/python/databricks/bundles/jobs/_models/spark_submit_task.py
+++ b/python/databricks/bundles/jobs/_models/spark_submit_task.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/sparse_checkout.py b/python/databricks/bundles/jobs/_models/sparse_checkout.py
index 47e41f54bb8..a42a78e49f1 100644
--- a/python/databricks/bundles/jobs/_models/sparse_checkout.py
+++ b/python/databricks/bundles/jobs/_models/sparse_checkout.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/sql_condition_configuration.py b/python/databricks/bundles/jobs/_models/sql_condition_configuration.py
new file mode 100644
index 00000000000..f6b2da80685
--- /dev/null
+++ b/python/databricks/bundles/jobs/_models/sql_condition_configuration.py
@@ -0,0 +1,88 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+from databricks.bundles.jobs._models.sql_condition_trigger_mode import (
+    SqlConditionTriggerMode,
+    SqlConditionTriggerModeParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class SqlConditionConfiguration:
+    """
+    :meta private: [EXPERIMENTAL]
+    """
+
+    sql_query_id: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The ID of the SQL query to evaluate as the trigger condition.
+    """
+
+    warehouse_id: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The canonical identifier of the SQL warehouse to run the condition query against.
+    """
+
+    trigger_mode: VariableOrOptional[SqlConditionTriggerMode] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Determines how the SQL query result is interpreted to decide whether the condition fires.
+    Must be set to a recognized value when provided.
+    When unset on an existing serialized configuration, the server preserves the original
+    semantics by interpreting it as `QUERY_RETURNS_ROWS`. New configurations should set this
+    explicitly — explicit `SQL_CONDITION_TRIGGER_MODE_UNSPECIFIED` is rejected at validation.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "SqlConditionConfigurationDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "SqlConditionConfigurationDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class SqlConditionConfigurationDict(TypedDict, total=False):
+    """"""
+
+    sql_query_id: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The ID of the SQL query to evaluate as the trigger condition.
+    """
+
+    warehouse_id: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The canonical identifier of the SQL warehouse to run the condition query against.
+    """
+
+    trigger_mode: VariableOrOptional[SqlConditionTriggerModeParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Determines how the SQL query result is interpreted to decide whether the condition fires.
+    Must be set to a recognized value when provided.
+    When unset on an existing serialized configuration, the server preserves the original
+    semantics by interpreting it as `QUERY_RETURNS_ROWS`. New configurations should set this
+    explicitly — explicit `SQL_CONDITION_TRIGGER_MODE_UNSPECIFIED` is rejected at validation.
+    """
+
+
+SqlConditionConfigurationParam = (
+    SqlConditionConfigurationDict | SqlConditionConfiguration
+)
diff --git a/python/databricks/bundles/jobs/_models/sql_condition_trigger_mode.py b/python/databricks/bundles/jobs/_models/sql_condition_trigger_mode.py
new file mode 100644
index 00000000000..c2b8472faea
--- /dev/null
+++ b/python/databricks/bundles/jobs/_models/sql_condition_trigger_mode.py
@@ -0,0 +1,29 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class SqlConditionTriggerMode(Enum):
+    """
+    :meta private: [EXPERIMENTAL]
+
+    The strategy used to evaluate a SQL condition trigger against a query result set.
+
+    * `SQL_CONDITION_TRIGGER_MODE_UNSPECIFIED`: Sentinel zero-value. Not a valid input — the
+    validator rejects this when sent explicitly. Internally treated as `QUERY_RETURNS_ROWS`
+    when reading legacy data that predates this field.
+    * `QUERY_RETURNS_ROWS`: Fires whenever the result set has at least one row. Zero rows means
+    the condition is not met. This is the original SQL condition behavior.
+    * `RESULT_VALUE_CHANGES`: Fires whenever the query's single result value differs from the
+    previous evaluation. The first evaluation always fires. Queries must return exactly one
+    cell (one row, one column).
+    """
+
+    QUERY_RETURNS_ROWS = "QUERY_RETURNS_ROWS"
+    RESULT_VALUE_CHANGES = "RESULT_VALUE_CHANGES"
+
+
+SqlConditionTriggerModeParam = (
+    Literal["QUERY_RETURNS_ROWS", "RESULT_VALUE_CHANGES"] | SqlConditionTriggerMode
+)
diff --git a/python/databricks/bundles/jobs/_models/sql_task.py b/python/databricks/bundles/jobs/_models/sql_task.py
index f404a5b7a91..dd731928af0 100644
--- a/python/databricks/bundles/jobs/_models/sql_task.py
+++ b/python/databricks/bundles/jobs/_models/sql_task.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/sql_task_alert.py b/python/databricks/bundles/jobs/_models/sql_task_alert.py
index 513eecd7104..6db18d1c876 100644
--- a/python/databricks/bundles/jobs/_models/sql_task_alert.py
+++ b/python/databricks/bundles/jobs/_models/sql_task_alert.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/sql_task_dashboard.py b/python/databricks/bundles/jobs/_models/sql_task_dashboard.py
index bc0a9b831fe..98e544e5aa0 100644
--- a/python/databricks/bundles/jobs/_models/sql_task_dashboard.py
+++ b/python/databricks/bundles/jobs/_models/sql_task_dashboard.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/sql_task_file.py b/python/databricks/bundles/jobs/_models/sql_task_file.py
index a0c02a2ca1a..8a49f54c7b7 100644
--- a/python/databricks/bundles/jobs/_models/sql_task_file.py
+++ b/python/databricks/bundles/jobs/_models/sql_task_file.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/sql_task_query.py b/python/databricks/bundles/jobs/_models/sql_task_query.py
index c367bff828b..2682c425112 100644
--- a/python/databricks/bundles/jobs/_models/sql_task_query.py
+++ b/python/databricks/bundles/jobs/_models/sql_task_query.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/sql_task_subscription.py b/python/databricks/bundles/jobs/_models/sql_task_subscription.py
index e58319b5386..d5f2a65ddf5 100644
--- a/python/databricks/bundles/jobs/_models/sql_task_subscription.py
+++ b/python/databricks/bundles/jobs/_models/sql_task_subscription.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/storage_mode.py b/python/databricks/bundles/jobs/_models/storage_mode.py
index 764e2e7d54a..f15a94689d6 100644
--- a/python/databricks/bundles/jobs/_models/storage_mode.py
+++ b/python/databricks/bundles/jobs/_models/storage_mode.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
diff --git a/python/databricks/bundles/jobs/_models/subscription.py b/python/databricks/bundles/jobs/_models/subscription.py
index 2d639902450..3c8d872f2f2 100644
--- a/python/databricks/bundles/jobs/_models/subscription.py
+++ b/python/databricks/bundles/jobs/_models/subscription.py
@@ -1,9 +1,15 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
 from databricks.bundles.core._transform import _transform
 from databricks.bundles.core._transform_to_json import _transform_to_json_value
 from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
+from databricks.bundles.jobs._models.subscription_attachment import (
+    SubscriptionAttachment,
+    SubscriptionAttachmentParam,
+)
 from databricks.bundles.jobs._models.subscription_subscriber import (
     SubscriptionSubscriber,
     SubscriptionSubscriberParam,
@@ -17,6 +23,16 @@
 class Subscription:
     """"""
 
+    attachment: VariableOrOptional[SubscriptionAttachment] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Optional: The configuration for the files attached to the dashboard snapshot notification. It
+    controls the underlying data of dashboard widgets that is attached as data files and which
+    pages are included in the attached PDF. If not specified, the notification is sent with only
+    the default snapshot.
+    """
+
     custom_subject: VariableOrOptional[str] = None
     """
     Optional: Allows users to specify a custom subject line on the email sent
@@ -29,6 +45,9 @@ class Subscription:
     """
 
     subscribers: VariableOrList[SubscriptionSubscriber] = field(default_factory=list)
+    """
+    The list of subscribers to send the snapshot of the dashboard to.
+    """
 
     @classmethod
     def from_dict(cls, value: "SubscriptionDict") -> "Self":
@@ -41,6 +60,16 @@ def as_dict(self) -> "SubscriptionDict":
 class SubscriptionDict(TypedDict, total=False):
     """"""
 
+    attachment: VariableOrOptional[SubscriptionAttachmentParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Optional: The configuration for the files attached to the dashboard snapshot notification. It
+    controls the underlying data of dashboard widgets that is attached as data files and which
+    pages are included in the attached PDF. If not specified, the notification is sent with only
+    the default snapshot.
+    """
+
     custom_subject: VariableOrOptional[str]
     """
     Optional: Allows users to specify a custom subject line on the email sent
@@ -53,6 +82,9 @@ class SubscriptionDict(TypedDict, total=False):
     """
 
     subscribers: VariableOrList[SubscriptionSubscriberParam]
+    """
+    The list of subscribers to send the snapshot of the dashboard to.
+    """
 
 
 SubscriptionParam = SubscriptionDict | Subscription
diff --git a/python/databricks/bundles/jobs/_models/subscription_attachment.py b/python/databricks/bundles/jobs/_models/subscription_attachment.py
new file mode 100644
index 00000000000..4b51ea04602
--- /dev/null
+++ b/python/databricks/bundles/jobs/_models/subscription_attachment.py
@@ -0,0 +1,77 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.jobs._models.subscription_attachment_data_attachment import (
+    SubscriptionAttachmentDataAttachment,
+    SubscriptionAttachmentDataAttachmentParam,
+)
+from databricks.bundles.jobs._models.subscription_attachment_page_attachment import (
+    SubscriptionAttachmentPageAttachment,
+    SubscriptionAttachmentPageAttachmentParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class SubscriptionAttachment:
+    """
+    :meta private: [EXPERIMENTAL]
+
+    The configuration for the files attached to the dashboard snapshot notification sent to
+    subscribers. `data_attachment` describes the underlying data of dashboard widgets attached
+    as data files, and `page_attachment` describes which dashboard pages are included in the
+    attached PDF.
+    """
+
+    data_attachment: VariableOrOptional[SubscriptionAttachmentDataAttachment] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Optional: The configuration for the underlying data of dashboard widgets attached as tabular
+    data files. If not specified, no tabular data is attached.
+    """
+
+    page_attachment: VariableOrOptional[SubscriptionAttachmentPageAttachment] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Optional: The selection of dashboard pages included in the attached PDF. If not specified,
+    only the first page is included.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "SubscriptionAttachmentDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "SubscriptionAttachmentDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class SubscriptionAttachmentDict(TypedDict, total=False):
+    """"""
+
+    data_attachment: VariableOrOptional[SubscriptionAttachmentDataAttachmentParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Optional: The configuration for the underlying data of dashboard widgets attached as tabular
+    data files. If not specified, no tabular data is attached.
+    """
+
+    page_attachment: VariableOrOptional[SubscriptionAttachmentPageAttachmentParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Optional: The selection of dashboard pages included in the attached PDF. If not specified,
+    only the first page is included.
+    """
+
+
+SubscriptionAttachmentParam = SubscriptionAttachmentDict | SubscriptionAttachment
diff --git a/python/databricks/bundles/jobs/_models/subscription_attachment_data_attachment.py b/python/databricks/bundles/jobs/_models/subscription_attachment_data_attachment.py
new file mode 100644
index 00000000000..b1cb52362b1
--- /dev/null
+++ b/python/databricks/bundles/jobs/_models/subscription_attachment_data_attachment.py
@@ -0,0 +1,96 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import (
+    VariableOr,
+    VariableOrList,
+    VariableOrOptional,
+)
+from databricks.bundles.jobs._models.subscription_attachment_data_attachment_file_format import (
+    SubscriptionAttachmentDataAttachmentFileFormat,
+    SubscriptionAttachmentDataAttachmentFileFormatParam,
+)
+from databricks.bundles.jobs._models.subscription_attachment_data_attachment_widget import (
+    SubscriptionAttachmentDataAttachmentWidget,
+    SubscriptionAttachmentDataAttachmentWidgetParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class SubscriptionAttachmentDataAttachment:
+    """
+    :meta private: [EXPERIMENTAL]
+
+    The configuration for the tabular data files attached to the dashboard snapshot. `widgets`
+    lists the widgets whose data is exported and `file_format` is the output format; each
+    referenced widget's data is exported as a separate file.
+    """
+
+    file_format: VariableOr[SubscriptionAttachmentDataAttachmentFileFormat]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The file format of the exported tabular data files.
+    """
+
+    include_applied_filters: VariableOrOptional[bool] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] When true, the dashboard's applied filter values are included alongside the tabular data as
+    an additional attached file.
+    """
+
+    widgets: VariableOrList[SubscriptionAttachmentDataAttachmentWidget] = field(
+        default_factory=list
+    )
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The widgets whose underlying data is exported. At least one widget must be referenced.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "SubscriptionAttachmentDataAttachmentDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "SubscriptionAttachmentDataAttachmentDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class SubscriptionAttachmentDataAttachmentDict(TypedDict, total=False):
+    """"""
+
+    file_format: VariableOr[SubscriptionAttachmentDataAttachmentFileFormatParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The file format of the exported tabular data files.
+    """
+
+    include_applied_filters: VariableOrOptional[bool]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] When true, the dashboard's applied filter values are included alongside the tabular data as
+    an additional attached file.
+    """
+
+    widgets: VariableOrList[SubscriptionAttachmentDataAttachmentWidgetParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The widgets whose underlying data is exported. At least one widget must be referenced.
+    """
+
+
+SubscriptionAttachmentDataAttachmentParam = (
+    SubscriptionAttachmentDataAttachmentDict | SubscriptionAttachmentDataAttachment
+)
diff --git a/python/databricks/bundles/jobs/_models/subscription_attachment_data_attachment_file_format.py b/python/databricks/bundles/jobs/_models/subscription_attachment_data_attachment_file_format.py
new file mode 100644
index 00000000000..659ff905aab
--- /dev/null
+++ b/python/databricks/bundles/jobs/_models/subscription_attachment_data_attachment_file_format.py
@@ -0,0 +1,23 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class SubscriptionAttachmentDataAttachmentFileFormat(Enum):
+    """
+    :meta private: [EXPERIMENTAL]
+
+    The output format of an exported tabular data file. Must be set to a value other than
+    `FILE_FORMAT_UNSPECIFIED`.
+    """
+
+    FILE_FORMAT_CSV = "FILE_FORMAT_CSV"
+    FILE_FORMAT_TSV = "FILE_FORMAT_TSV"
+    FILE_FORMAT_EXCEL = "FILE_FORMAT_EXCEL"
+
+
+SubscriptionAttachmentDataAttachmentFileFormatParam = (
+    Literal["FILE_FORMAT_CSV", "FILE_FORMAT_TSV", "FILE_FORMAT_EXCEL"]
+    | SubscriptionAttachmentDataAttachmentFileFormat
+)
diff --git a/python/databricks/bundles/jobs/_models/subscription_attachment_data_attachment_widget.py b/python/databricks/bundles/jobs/_models/subscription_attachment_data_attachment_widget.py
new file mode 100644
index 00000000000..eeb0c29213c
--- /dev/null
+++ b/python/databricks/bundles/jobs/_models/subscription_attachment_data_attachment_widget.py
@@ -0,0 +1,77 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class SubscriptionAttachmentDataAttachmentWidget:
+    """
+    :meta private: [EXPERIMENTAL]
+
+    Identifies a dashboard widget whose data to attach. `page_id` and `widget_id` are
+    the URL identifiers from the dashboard's serialized definition returned by the Get dashboard
+    API (`serialized_dashboard`), and together they uniquely identify the widget.
+    """
+
+    page_id: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The URL identifier of the page containing the widget. This is the value of the `name`
+    field of the corresponding entry under `pages` in the serialized dashboard definition.
+    Format: alphanumeric, hyphen, and underscore characters allowed, max length 63.
+    """
+
+    widget_id: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The URL identifier of the widget. This is the value of the `name` field of the
+    corresponding widget under that page's `layout` in the serialized dashboard definition.
+    Format: alphanumeric, hyphen, and underscore characters allowed, max length 63.
+    """
+
+    @classmethod
+    def from_dict(
+        cls, value: "SubscriptionAttachmentDataAttachmentWidgetDict"
+    ) -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "SubscriptionAttachmentDataAttachmentWidgetDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class SubscriptionAttachmentDataAttachmentWidgetDict(TypedDict, total=False):
+    """"""
+
+    page_id: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The URL identifier of the page containing the widget. This is the value of the `name`
+    field of the corresponding entry under `pages` in the serialized dashboard definition.
+    Format: alphanumeric, hyphen, and underscore characters allowed, max length 63.
+    """
+
+    widget_id: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The URL identifier of the widget. This is the value of the `name` field of the
+    corresponding widget under that page's `layout` in the serialized dashboard definition.
+    Format: alphanumeric, hyphen, and underscore characters allowed, max length 63.
+    """
+
+
+SubscriptionAttachmentDataAttachmentWidgetParam = (
+    SubscriptionAttachmentDataAttachmentWidgetDict
+    | SubscriptionAttachmentDataAttachmentWidget
+)
diff --git a/python/databricks/bundles/jobs/_models/subscription_attachment_page_attachment.py b/python/databricks/bundles/jobs/_models/subscription_attachment_page_attachment.py
new file mode 100644
index 00000000000..1d80e46e067
--- /dev/null
+++ b/python/databricks/bundles/jobs/_models/subscription_attachment_page_attachment.py
@@ -0,0 +1,83 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
+from databricks.bundles.jobs._models.subscription_attachment_page_attachment_page_selection import (
+    SubscriptionAttachmentPageAttachmentPageSelection,
+    SubscriptionAttachmentPageAttachmentPageSelectionParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class SubscriptionAttachmentPageAttachment:
+    """
+    :meta private: [EXPERIMENTAL]
+
+    The selection of dashboard pages included in the attached PDF. `page_selection` chooses
+    between all pages, the first page only, or an explicit subset listed in `page_ids`.
+    """
+
+    page_ids: VariableOrList[str] = field(default_factory=list)
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The identifiers of the pages to include in the PDF. Only specified when `page_selection` is
+    `PAGE_SELECTION_SUBSET`. Each value is the identifier of a page in the dashboard's
+    serialized definition returned by the Get dashboard API (`serialized_dashboard`): the value
+    of the `name` field of an entry under `pages`.
+    Format: alphanumeric, hyphen, and underscore characters allowed, max length 63.
+    """
+
+    page_selection: VariableOrOptional[
+        SubscriptionAttachmentPageAttachmentPageSelection
+    ] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] How the attached pages are selected. When set to `PAGE_SELECTION_SUBSET`, the pages to
+    include are listed in `page_ids`.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "SubscriptionAttachmentPageAttachmentDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "SubscriptionAttachmentPageAttachmentDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class SubscriptionAttachmentPageAttachmentDict(TypedDict, total=False):
+    """"""
+
+    page_ids: VariableOrList[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The identifiers of the pages to include in the PDF. Only specified when `page_selection` is
+    `PAGE_SELECTION_SUBSET`. Each value is the identifier of a page in the dashboard's
+    serialized definition returned by the Get dashboard API (`serialized_dashboard`): the value
+    of the `name` field of an entry under `pages`.
+    Format: alphanumeric, hyphen, and underscore characters allowed, max length 63.
+    """
+
+    page_selection: VariableOrOptional[
+        SubscriptionAttachmentPageAttachmentPageSelectionParam
+    ]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] How the attached pages are selected. When set to `PAGE_SELECTION_SUBSET`, the pages to
+    include are listed in `page_ids`.
+    """
+
+
+SubscriptionAttachmentPageAttachmentParam = (
+    SubscriptionAttachmentPageAttachmentDict | SubscriptionAttachmentPageAttachment
+)
diff --git a/python/databricks/bundles/jobs/_models/subscription_attachment_page_attachment_page_selection.py b/python/databricks/bundles/jobs/_models/subscription_attachment_page_attachment_page_selection.py
new file mode 100644
index 00000000000..0d21a769bb4
--- /dev/null
+++ b/python/databricks/bundles/jobs/_models/subscription_attachment_page_attachment_page_selection.py
@@ -0,0 +1,21 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class SubscriptionAttachmentPageAttachmentPageSelection(Enum):
+    """
+    :meta private: [EXPERIMENTAL]
+
+    Determines which dashboard pages are attached to the notification.
+    """
+
+    PAGE_SELECTION_ALL = "PAGE_SELECTION_ALL"
+    PAGE_SELECTION_SUBSET = "PAGE_SELECTION_SUBSET"
+
+
+SubscriptionAttachmentPageAttachmentPageSelectionParam = (
+    Literal["PAGE_SELECTION_ALL", "PAGE_SELECTION_SUBSET"]
+    | SubscriptionAttachmentPageAttachmentPageSelection
+)
diff --git a/python/databricks/bundles/jobs/_models/subscription_subscriber.py b/python/databricks/bundles/jobs/_models/subscription_subscriber.py
index eddc8fc7aaf..d03875f1ab2 100644
--- a/python/databricks/bundles/jobs/_models/subscription_subscriber.py
+++ b/python/databricks/bundles/jobs/_models/subscription_subscriber.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -14,8 +16,14 @@ class SubscriptionSubscriber:
     """"""
 
     destination_id: VariableOrOptional[str] = None
+    """
+    A snapshot of the dashboard will be sent to the destination when the `destination_id` field is present.
+    """
 
     user_name: VariableOrOptional[str] = None
+    """
+    A snapshot of the dashboard will be sent to the user's email when the `user_name` field is present.
+    """
 
     @classmethod
     def from_dict(cls, value: "SubscriptionSubscriberDict") -> "Self":
@@ -29,8 +37,14 @@ class SubscriptionSubscriberDict(TypedDict, total=False):
     """"""
 
     destination_id: VariableOrOptional[str]
+    """
+    A snapshot of the dashboard will be sent to the destination when the `destination_id` field is present.
+    """
 
     user_name: VariableOrOptional[str]
+    """
+    A snapshot of the dashboard will be sent to the user's email when the `user_name` field is present.
+    """
 
 
 SubscriptionSubscriberParam = SubscriptionSubscriberDict | SubscriptionSubscriber
diff --git a/python/databricks/bundles/jobs/_models/table_update_trigger_configuration.py b/python/databricks/bundles/jobs/_models/table_update_trigger_configuration.py
index c824a724999..24cf1301154 100644
--- a/python/databricks/bundles/jobs/_models/table_update_trigger_configuration.py
+++ b/python/databricks/bundles/jobs/_models/table_update_trigger_configuration.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/task.py b/python/databricks/bundles/jobs/_models/task.py
index cfac99bc571..c459192ba2b 100644
--- a/python/databricks/bundles/jobs/_models/task.py
+++ b/python/databricks/bundles/jobs/_models/task.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
@@ -8,6 +10,10 @@
     VariableOrList,
     VariableOrOptional,
 )
+from databricks.bundles.jobs._models.ai_runtime_task import (
+    AiRuntimeTask,
+    AiRuntimeTaskParam,
+)
 from databricks.bundles.jobs._models.alert_task import AlertTask, AlertTaskParam
 from databricks.bundles.jobs._models.clean_rooms_notebook_task import (
     CleanRoomsNotebookTask,
@@ -28,10 +34,7 @@
     DbtPlatformTaskParam,
 )
 from databricks.bundles.jobs._models.dbt_task import DbtTask, DbtTaskParam
-from databricks.bundles.jobs._models.for_each_task import (
-    ForEachTask,
-    ForEachTaskParam,
-)
+from databricks.bundles.jobs._models.for_each_task import ForEachTask, ForEachTaskParam
 from databricks.bundles.jobs._models.gen_ai_compute_task import (
     GenAiComputeTask,
     GenAiComputeTaskParam,
@@ -50,6 +53,10 @@
     PipelineTaskParam,
 )
 from databricks.bundles.jobs._models.power_bi_task import PowerBiTask, PowerBiTaskParam
+from databricks.bundles.jobs._models.python_operator_task import (
+    PythonOperatorTask,
+    PythonOperatorTaskParam,
+)
 from databricks.bundles.jobs._models.python_wheel_task import (
     PythonWheelTask,
     PythonWheelTaskParam,
@@ -104,9 +111,16 @@ class Task:
     On Update or Reset, this field is used to reference the tasks to be updated or reset.
     """
 
+    ai_runtime_task: VariableOrOptional[AiRuntimeTask] = None
+    """
+    [Public Preview] The task runs a multi-gpu compute workload on Databricks AI Runtime. Specify
+    the accelerator type and count, the command to run, and where the workload's
+    code and MLflow output are stored.
+    """
+
     alert_task: VariableOrOptional[AlertTask] = None
     """
-    The task evaluates a Databricks alert and sends notifications to subscribers
+    [Public Preview] The task evaluates a Databricks alert and sends notifications to subscribers
     when the `alert_task` field is present.
     """
 
@@ -118,7 +132,7 @@ class Task:
 
     compute: VariableOrOptional[Compute] = None
     """
-    Task level compute configuration.
+    [Public Preview] Task level compute configuration.
     """
 
     condition_task: VariableOrOptional[ConditionTask] = None
@@ -135,6 +149,8 @@ class Task:
     dbt_platform_task: VariableOrOptional[DbtPlatformTask] = None
     """
     :meta private: [EXPERIMENTAL]
+    
+    [Private Preview]
     """
 
     dbt_task: VariableOrOptional[DbtTask] = None
@@ -160,8 +176,6 @@ class Task:
 
     disabled: VariableOrOptional[bool] = None
     """
-    :meta private: [EXPERIMENTAL]
-    
     An optional flag to disable the task. If set to true, the task will not run even if it is part of a job.
     """
 
@@ -172,7 +186,17 @@ class Task:
 
     environment_key: VariableOrOptional[str] = None
     """
-    The key that references an environment spec in a job. This field is required for Python script, Python wheel and dbt tasks when using serverless compute.
+    The key that references an environment spec in a job. This field is required for Python script, Python wheel and dbt tasks when using serverless compute or a compute resource that uses Environments mode.
+    """
+
+    environment_variables_key: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Reference to a `JobEnvironmentVariables` entry defined in
+    `JobSettings.environment_variables`. The selected entry's variables are
+    applied to this task at execution time. This field supports serverless
+    tasks using environment version 5 or later.
     """
 
     existing_cluster_id: VariableOrOptional[str] = None
@@ -191,9 +215,19 @@ class Task:
     gen_ai_compute_task: VariableOrOptional[GenAiComputeTask] = None
     """
     :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] DEPRECATED — use `AiRuntimeTask` for all new BYOT multi-node GPU
+    workloads (see ai_runtime_task.proto). `AiRuntimeTask` is the only
+    supported BYOT task type for new workloads; this proto is retained only
+    for AIR CLI (fka SGCLI) pywheel backwards compatibility and will be
+    removed once the pywheel → databricks-cli migration completes (post-
+    PuPr).
     """
 
     health: VariableOrOptional[JobsHealthRules] = None
+    """
+    An optional set of health rules that can be defined for this job.
+    """
 
     job_cluster_key: VariableOrOptional[str] = None
     """
@@ -238,7 +272,14 @@ class Task:
 
     power_bi_task: VariableOrOptional[PowerBiTask] = None
     """
-    The task triggers a Power BI semantic model update when the `power_bi_task` field is present.
+    [Public Preview] The task triggers a Power BI semantic model update when the `power_bi_task` field is present.
+    """
+
+    python_operator_task: VariableOrOptional[PythonOperatorTask] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The task runs a Python operator task.
     """
 
     python_wheel_task: VariableOrOptional[PythonWheelTask] = None
@@ -317,9 +358,16 @@ class TaskDict(TypedDict, total=False):
     On Update or Reset, this field is used to reference the tasks to be updated or reset.
     """
 
+    ai_runtime_task: VariableOrOptional[AiRuntimeTaskParam]
+    """
+    [Public Preview] The task runs a multi-gpu compute workload on Databricks AI Runtime. Specify
+    the accelerator type and count, the command to run, and where the workload's
+    code and MLflow output are stored.
+    """
+
     alert_task: VariableOrOptional[AlertTaskParam]
     """
-    The task evaluates a Databricks alert and sends notifications to subscribers
+    [Public Preview] The task evaluates a Databricks alert and sends notifications to subscribers
     when the `alert_task` field is present.
     """
 
@@ -331,7 +379,7 @@ class TaskDict(TypedDict, total=False):
 
     compute: VariableOrOptional[ComputeParam]
     """
-    Task level compute configuration.
+    [Public Preview] Task level compute configuration.
     """
 
     condition_task: VariableOrOptional[ConditionTaskParam]
@@ -348,6 +396,8 @@ class TaskDict(TypedDict, total=False):
     dbt_platform_task: VariableOrOptional[DbtPlatformTaskParam]
     """
     :meta private: [EXPERIMENTAL]
+    
+    [Private Preview]
     """
 
     dbt_task: VariableOrOptional[DbtTaskParam]
@@ -373,8 +423,6 @@ class TaskDict(TypedDict, total=False):
 
     disabled: VariableOrOptional[bool]
     """
-    :meta private: [EXPERIMENTAL]
-    
     An optional flag to disable the task. If set to true, the task will not run even if it is part of a job.
     """
 
@@ -385,7 +433,17 @@ class TaskDict(TypedDict, total=False):
 
     environment_key: VariableOrOptional[str]
     """
-    The key that references an environment spec in a job. This field is required for Python script, Python wheel and dbt tasks when using serverless compute.
+    The key that references an environment spec in a job. This field is required for Python script, Python wheel and dbt tasks when using serverless compute or a compute resource that uses Environments mode.
+    """
+
+    environment_variables_key: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Reference to a `JobEnvironmentVariables` entry defined in
+    `JobSettings.environment_variables`. The selected entry's variables are
+    applied to this task at execution time. This field supports serverless
+    tasks using environment version 5 or later.
     """
 
     existing_cluster_id: VariableOrOptional[str]
@@ -404,9 +462,19 @@ class TaskDict(TypedDict, total=False):
     gen_ai_compute_task: VariableOrOptional[GenAiComputeTaskParam]
     """
     :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] DEPRECATED — use `AiRuntimeTask` for all new BYOT multi-node GPU
+    workloads (see ai_runtime_task.proto). `AiRuntimeTask` is the only
+    supported BYOT task type for new workloads; this proto is retained only
+    for AIR CLI (fka SGCLI) pywheel backwards compatibility and will be
+    removed once the pywheel → databricks-cli migration completes (post-
+    PuPr).
     """
 
     health: VariableOrOptional[JobsHealthRulesParam]
+    """
+    An optional set of health rules that can be defined for this job.
+    """
 
     job_cluster_key: VariableOrOptional[str]
     """
@@ -451,7 +519,14 @@ class TaskDict(TypedDict, total=False):
 
     power_bi_task: VariableOrOptional[PowerBiTaskParam]
     """
-    The task triggers a Power BI semantic model update when the `power_bi_task` field is present.
+    [Public Preview] The task triggers a Power BI semantic model update when the `power_bi_task` field is present.
+    """
+
+    python_operator_task: VariableOrOptional[PythonOperatorTaskParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The task runs a Python operator task.
     """
 
     python_wheel_task: VariableOrOptional[PythonWheelTaskParam]
diff --git a/python/databricks/bundles/jobs/_models/task_dependency.py b/python/databricks/bundles/jobs/_models/task_dependency.py
index 5f8fd3e6074..a1e18f0bb59 100644
--- a/python/databricks/bundles/jobs/_models/task_dependency.py
+++ b/python/databricks/bundles/jobs/_models/task_dependency.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/task_email_notifications.py b/python/databricks/bundles/jobs/_models/task_email_notifications.py
index 35837985156..cdf0dee5fdf 100644
--- a/python/databricks/bundles/jobs/_models/task_email_notifications.py
+++ b/python/databricks/bundles/jobs/_models/task_email_notifications.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
@@ -31,6 +33,16 @@ class TaskEmailNotifications:
     A list of email addresses to be notified when a run unsuccessfully completes. A run is considered to have completed unsuccessfully if it ends with an `INTERNAL_ERROR` `life_cycle_state` or a `FAILED`, or `TIMED_OUT` result_state. If this is not specified on job creation, reset, or update the list is empty, and notifications are not sent.
     """
 
+    on_maintenance_complete: VariableOrList[str] = field(default_factory=list)
+    """
+    A list of email addresses to notify when platform-initiated maintenance completes for a continuous job.
+    """
+
+    on_maintenance_start: VariableOrList[str] = field(default_factory=list)
+    """
+    A list of email addresses to notify when platform-initiated maintenance starts for a continuous job.
+    """
+
     on_start: VariableOrList[str] = field(default_factory=list)
     """
     A list of email addresses to be notified when a run begins. If not specified on job creation, reset, or update, the list is empty, and notifications are not sent.
@@ -38,7 +50,7 @@ class TaskEmailNotifications:
 
     on_streaming_backlog_exceeded: VariableOrList[str] = field(default_factory=list)
     """
-    A list of email addresses to notify when any streaming backlog thresholds are exceeded for any stream.
+    [Public Preview] A list of email addresses to notify when any streaming backlog thresholds are exceeded for any stream.
     Streaming backlog thresholds can be set in the `health` field using the following metrics: `STREAMING_BACKLOG_BYTES`, `STREAMING_BACKLOG_RECORDS`, `STREAMING_BACKLOG_SECONDS`, or `STREAMING_BACKLOG_FILES`.
     Alerting is based on the 10-minute average of these metrics. If the issue persists, notifications are resent every 30 minutes.
     """
@@ -75,6 +87,16 @@ class TaskEmailNotificationsDict(TypedDict, total=False):
     A list of email addresses to be notified when a run unsuccessfully completes. A run is considered to have completed unsuccessfully if it ends with an `INTERNAL_ERROR` `life_cycle_state` or a `FAILED`, or `TIMED_OUT` result_state. If this is not specified on job creation, reset, or update the list is empty, and notifications are not sent.
     """
 
+    on_maintenance_complete: VariableOrList[str]
+    """
+    A list of email addresses to notify when platform-initiated maintenance completes for a continuous job.
+    """
+
+    on_maintenance_start: VariableOrList[str]
+    """
+    A list of email addresses to notify when platform-initiated maintenance starts for a continuous job.
+    """
+
     on_start: VariableOrList[str]
     """
     A list of email addresses to be notified when a run begins. If not specified on job creation, reset, or update, the list is empty, and notifications are not sent.
@@ -82,7 +104,7 @@ class TaskEmailNotificationsDict(TypedDict, total=False):
 
     on_streaming_backlog_exceeded: VariableOrList[str]
     """
-    A list of email addresses to notify when any streaming backlog thresholds are exceeded for any stream.
+    [Public Preview] A list of email addresses to notify when any streaming backlog thresholds are exceeded for any stream.
     Streaming backlog thresholds can be set in the `health` field using the following metrics: `STREAMING_BACKLOG_BYTES`, `STREAMING_BACKLOG_RECORDS`, `STREAMING_BACKLOG_SECONDS`, or `STREAMING_BACKLOG_FILES`.
     Alerting is based on the 10-minute average of these metrics. If the issue persists, notifications are resent every 30 minutes.
     """
diff --git a/python/databricks/bundles/jobs/_models/task_notification_settings.py b/python/databricks/bundles/jobs/_models/task_notification_settings.py
index 87ca47ac9c3..346f4463b9a 100644
--- a/python/databricks/bundles/jobs/_models/task_notification_settings.py
+++ b/python/databricks/bundles/jobs/_models/task_notification_settings.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/task_retry_mode.py b/python/databricks/bundles/jobs/_models/task_retry_mode.py
index ce5ccaa6878..f0642b54f2c 100644
--- a/python/databricks/bundles/jobs/_models/task_retry_mode.py
+++ b/python/databricks/bundles/jobs/_models/task_retry_mode.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
diff --git a/python/databricks/bundles/jobs/_models/trigger_configuration.py b/python/databricks/bundles/jobs/_models/trigger_configuration.py
new file mode 100644
index 00000000000..b9663effddc
--- /dev/null
+++ b/python/databricks/bundles/jobs/_models/trigger_configuration.py
@@ -0,0 +1,178 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.jobs._models.continuous_trigger_configuration import (
+    ContinuousTriggerConfiguration,
+    ContinuousTriggerConfigurationParam,
+)
+from databricks.bundles.jobs._models.cron_trigger_configuration import (
+    CronTriggerConfiguration,
+    CronTriggerConfigurationParam,
+)
+from databricks.bundles.jobs._models.file_arrival_trigger_configuration import (
+    FileArrivalTriggerConfiguration,
+    FileArrivalTriggerConfigurationParam,
+)
+from databricks.bundles.jobs._models.model_trigger_configuration import (
+    ModelTriggerConfiguration,
+    ModelTriggerConfigurationParam,
+)
+from databricks.bundles.jobs._models.pause_status import PauseStatus, PauseStatusParam
+from databricks.bundles.jobs._models.periodic_trigger_configuration import (
+    PeriodicTriggerConfiguration,
+    PeriodicTriggerConfigurationParam,
+)
+from databricks.bundles.jobs._models.sql_condition_configuration import (
+    SqlConditionConfiguration,
+    SqlConditionConfigurationParam,
+)
+from databricks.bundles.jobs._models.table_update_trigger_configuration import (
+    TableUpdateTriggerConfiguration,
+    TableUpdateTriggerConfigurationParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class TriggerConfiguration:
+    """
+    A single trigger attached to a job via `JobSettings.triggers`. Exactly one of the trigger-type fields
+    (`periodic`, `schedule`, `continuous`, `file_arrival`, `table_update`, `model`, `job_completion`) must be set;
+    mutual exclusivity is enforced in the API handler rather than via `oneof` so that codegen, validation, and JSON
+    serialization across SDKs and Terraform behave consistently.
+    """
+
+    continuous: VariableOrOptional[ContinuousTriggerConfiguration] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Continuous trigger configuration.
+    """
+
+    file_arrival: VariableOrOptional[FileArrivalTriggerConfiguration] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] File arrival trigger configuration.
+    """
+
+    model: VariableOrOptional[ModelTriggerConfiguration] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Model trigger configuration.
+    """
+
+    pause_status: VariableOrOptional[PauseStatus] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Whether this trigger is paused. Defaults to UNPAUSED when unset; the server always returns an explicit value on read.
+    """
+
+    periodic: VariableOrOptional[PeriodicTriggerConfiguration] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Trigger type: exactly one must be set; mutual exclusivity is enforced in the API handler
+    Periodic trigger configuration.
+    """
+
+    schedule: VariableOrOptional[CronTriggerConfiguration] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Cron schedule trigger configuration.
+    """
+
+    sql_condition: VariableOrOptional[SqlConditionConfiguration] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Optional SQL condition that gates whether this trigger fires.
+    """
+
+    table_update: VariableOrOptional[TableUpdateTriggerConfiguration] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Table update trigger configuration.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "TriggerConfigurationDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "TriggerConfigurationDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class TriggerConfigurationDict(TypedDict, total=False):
+    """"""
+
+    continuous: VariableOrOptional[ContinuousTriggerConfigurationParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Continuous trigger configuration.
+    """
+
+    file_arrival: VariableOrOptional[FileArrivalTriggerConfigurationParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] File arrival trigger configuration.
+    """
+
+    model: VariableOrOptional[ModelTriggerConfigurationParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Model trigger configuration.
+    """
+
+    pause_status: VariableOrOptional[PauseStatusParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Whether this trigger is paused. Defaults to UNPAUSED when unset; the server always returns an explicit value on read.
+    """
+
+    periodic: VariableOrOptional[PeriodicTriggerConfigurationParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Trigger type: exactly one must be set; mutual exclusivity is enforced in the API handler
+    Periodic trigger configuration.
+    """
+
+    schedule: VariableOrOptional[CronTriggerConfigurationParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Cron schedule trigger configuration.
+    """
+
+    sql_condition: VariableOrOptional[SqlConditionConfigurationParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Optional SQL condition that gates whether this trigger fires.
+    """
+
+    table_update: VariableOrOptional[TableUpdateTriggerConfigurationParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Table update trigger configuration.
+    """
+
+
+TriggerConfigurationParam = TriggerConfigurationDict | TriggerConfiguration
diff --git a/python/databricks/bundles/jobs/_models/trigger_settings.py b/python/databricks/bundles/jobs/_models/trigger_settings.py
index 67b3a4def74..878f45732fa 100644
--- a/python/databricks/bundles/jobs/_models/trigger_settings.py
+++ b/python/databricks/bundles/jobs/_models/trigger_settings.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -17,6 +19,10 @@
     PeriodicTriggerConfiguration,
     PeriodicTriggerConfigurationParam,
 )
+from databricks.bundles.jobs._models.sql_condition_configuration import (
+    SqlConditionConfiguration,
+    SqlConditionConfigurationParam,
+)
 from databricks.bundles.jobs._models.table_update_trigger_configuration import (
     TableUpdateTriggerConfiguration,
     TableUpdateTriggerConfigurationParam,
@@ -38,6 +44,8 @@ class TriggerSettings:
     model: VariableOrOptional[ModelTriggerConfiguration] = None
     """
     :meta private: [EXPERIMENTAL]
+    
+    [Private Preview]
     """
 
     pause_status: VariableOrOptional[PauseStatus] = None
@@ -50,6 +58,14 @@ class TriggerSettings:
     Periodic trigger settings.
     """
 
+    sql_condition: VariableOrOptional[SqlConditionConfiguration] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] SQL condition that must be satisfied for the trigger to fire. Can be used in combination with other trigger types and
+    runs *after* other trigger types conditions are evaluated.
+    """
+
     table_update: VariableOrOptional[TableUpdateTriggerConfiguration] = None
 
     @classmethod
@@ -71,6 +87,8 @@ class TriggerSettingsDict(TypedDict, total=False):
     model: VariableOrOptional[ModelTriggerConfigurationParam]
     """
     :meta private: [EXPERIMENTAL]
+    
+    [Private Preview]
     """
 
     pause_status: VariableOrOptional[PauseStatusParam]
@@ -83,6 +101,14 @@ class TriggerSettingsDict(TypedDict, total=False):
     Periodic trigger settings.
     """
 
+    sql_condition: VariableOrOptional[SqlConditionConfigurationParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] SQL condition that must be satisfied for the trigger to fire. Can be used in combination with other trigger types and
+    runs *after* other trigger types conditions are evaluated.
+    """
+
     table_update: VariableOrOptional[TableUpdateTriggerConfigurationParam]
 
 
diff --git a/python/databricks/bundles/jobs/_models/volumes_storage_info.py b/python/databricks/bundles/jobs/_models/volumes_storage_info.py
index cbe74758fc7..1eb4fff7bc2 100644
--- a/python/databricks/bundles/jobs/_models/volumes_storage_info.py
+++ b/python/databricks/bundles/jobs/_models/volumes_storage_info.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/webhook.py b/python/databricks/bundles/jobs/_models/webhook.py
index 5e47d57f83a..17a391ac2c2 100644
--- a/python/databricks/bundles/jobs/_models/webhook.py
+++ b/python/databricks/bundles/jobs/_models/webhook.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/webhook_notifications.py b/python/databricks/bundles/jobs/_models/webhook_notifications.py
index c0f3edf0887..0eed809f68b 100644
--- a/python/databricks/bundles/jobs/_models/webhook_notifications.py
+++ b/python/databricks/bundles/jobs/_models/webhook_notifications.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
@@ -26,6 +28,18 @@ class WebhookNotifications:
     An optional list of system notification IDs to call when the run fails. A maximum of 3 destinations can be specified for the `on_failure` property.
     """
 
+    on_maintenance_complete: VariableOrList[Webhook] = field(default_factory=list)
+    """
+    An optional list of system notification IDs to call when platform-initiated maintenance completes for a continuous job.
+    A maximum of 3 destinations can be specified for the `on_maintenance_complete` property.
+    """
+
+    on_maintenance_start: VariableOrList[Webhook] = field(default_factory=list)
+    """
+    An optional list of system notification IDs to call when platform-initiated maintenance starts for a continuous job.
+    A maximum of 3 destinations can be specified for the `on_maintenance_start` property.
+    """
+
     on_start: VariableOrList[Webhook] = field(default_factory=list)
     """
     An optional list of system notification IDs to call when the run starts. A maximum of 3 destinations can be specified for the `on_start` property.
@@ -33,7 +47,7 @@ class WebhookNotifications:
 
     on_streaming_backlog_exceeded: VariableOrList[Webhook] = field(default_factory=list)
     """
-    An optional list of system notification IDs to call when any streaming backlog thresholds are exceeded for any stream.
+    [Public Preview] An optional list of system notification IDs to call when any streaming backlog thresholds are exceeded for any stream.
     Streaming backlog thresholds can be set in the `health` field using the following metrics: `STREAMING_BACKLOG_BYTES`, `STREAMING_BACKLOG_RECORDS`, `STREAMING_BACKLOG_SECONDS`, or `STREAMING_BACKLOG_FILES`.
     Alerting is based on the 10-minute average of these metrics. If the issue persists, notifications are resent every 30 minutes.
     A maximum of 3 destinations can be specified for the `on_streaming_backlog_exceeded` property.
@@ -65,6 +79,18 @@ class WebhookNotificationsDict(TypedDict, total=False):
     An optional list of system notification IDs to call when the run fails. A maximum of 3 destinations can be specified for the `on_failure` property.
     """
 
+    on_maintenance_complete: VariableOrList[WebhookParam]
+    """
+    An optional list of system notification IDs to call when platform-initiated maintenance completes for a continuous job.
+    A maximum of 3 destinations can be specified for the `on_maintenance_complete` property.
+    """
+
+    on_maintenance_start: VariableOrList[WebhookParam]
+    """
+    An optional list of system notification IDs to call when platform-initiated maintenance starts for a continuous job.
+    A maximum of 3 destinations can be specified for the `on_maintenance_start` property.
+    """
+
     on_start: VariableOrList[WebhookParam]
     """
     An optional list of system notification IDs to call when the run starts. A maximum of 3 destinations can be specified for the `on_start` property.
@@ -72,7 +98,7 @@ class WebhookNotificationsDict(TypedDict, total=False):
 
     on_streaming_backlog_exceeded: VariableOrList[WebhookParam]
     """
-    An optional list of system notification IDs to call when any streaming backlog thresholds are exceeded for any stream.
+    [Public Preview] An optional list of system notification IDs to call when any streaming backlog thresholds are exceeded for any stream.
     Streaming backlog thresholds can be set in the `health` field using the following metrics: `STREAMING_BACKLOG_BYTES`, `STREAMING_BACKLOG_RECORDS`, `STREAMING_BACKLOG_SECONDS`, or `STREAMING_BACKLOG_FILES`.
     Alerting is based on the 10-minute average of these metrics. If the issue persists, notifications are resent every 30 minutes.
     A maximum of 3 destinations can be specified for the `on_streaming_backlog_exceeded` property.
diff --git a/python/databricks/bundles/jobs/_models/workload_type.py b/python/databricks/bundles/jobs/_models/workload_type.py
index db40f98df0a..033590c3949 100644
--- a/python/databricks/bundles/jobs/_models/workload_type.py
+++ b/python/databricks/bundles/jobs/_models/workload_type.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/jobs/_models/workspace_storage_info.py b/python/databricks/bundles/jobs/_models/workspace_storage_info.py
index 29c075ac2f3..49aef9256c8 100644
--- a/python/databricks/bundles/jobs/_models/workspace_storage_info.py
+++ b/python/databricks/bundles/jobs/_models/workspace_storage_info.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/mcp_services/__init__.py b/python/databricks/bundles/mcp_services/__init__.py
new file mode 100644
index 00000000000..a4fe01b5199
--- /dev/null
+++ b/python/databricks/bundles/mcp_services/__init__.py
@@ -0,0 +1,69 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+__all__ = [
+    "Lifecycle",
+    "LifecycleDict",
+    "LifecycleParam",
+    "McpService",
+    "McpServiceConfig",
+    "McpServiceConfigDict",
+    "McpServiceConfigParam",
+    "McpServiceConfigSourceConnection",
+    "McpServiceConfigSourceConnectionDict",
+    "McpServiceConfigSourceConnectionParam",
+    "McpServiceDict",
+    "McpServiceParam",
+    "Privilege",
+    "PrivilegeAssignment",
+    "PrivilegeAssignmentDict",
+    "PrivilegeAssignmentParam",
+    "PrivilegeParam",
+    "RateLimit",
+    "RateLimitDict",
+    "RateLimitParam",
+    "RateLimitRateLimitKey",
+    "RateLimitRateLimitKeyParam",
+    "RateLimitRateLimitRenewalPeriod",
+    "RateLimitRateLimitRenewalPeriodParam",
+]
+
+
+from databricks.bundles.mcp_services._models.lifecycle import (
+    Lifecycle,
+    LifecycleDict,
+    LifecycleParam,
+)
+from databricks.bundles.mcp_services._models.mcp_service import (
+    McpService,
+    McpServiceDict,
+    McpServiceParam,
+)
+from databricks.bundles.mcp_services._models.mcp_service_config import (
+    McpServiceConfig,
+    McpServiceConfigDict,
+    McpServiceConfigParam,
+)
+from databricks.bundles.mcp_services._models.mcp_service_config_source_connection import (
+    McpServiceConfigSourceConnection,
+    McpServiceConfigSourceConnectionDict,
+    McpServiceConfigSourceConnectionParam,
+)
+from databricks.bundles.mcp_services._models.privilege import Privilege, PrivilegeParam
+from databricks.bundles.mcp_services._models.privilege_assignment import (
+    PrivilegeAssignment,
+    PrivilegeAssignmentDict,
+    PrivilegeAssignmentParam,
+)
+from databricks.bundles.mcp_services._models.rate_limit import (
+    RateLimit,
+    RateLimitDict,
+    RateLimitParam,
+)
+from databricks.bundles.mcp_services._models.rate_limit_rate_limit_key import (
+    RateLimitRateLimitKey,
+    RateLimitRateLimitKeyParam,
+)
+from databricks.bundles.mcp_services._models.rate_limit_rate_limit_renewal_period import (
+    RateLimitRateLimitRenewalPeriod,
+    RateLimitRateLimitRenewalPeriodParam,
+)
diff --git a/python/databricks/bundles/mcp_services/_models/lifecycle.py b/python/databricks/bundles/mcp_services/_models/lifecycle.py
new file mode 100644
index 00000000000..697776a198e
--- /dev/null
+++ b/python/databricks/bundles/mcp_services/_models/lifecycle.py
@@ -0,0 +1,40 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class Lifecycle:
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool] = None
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "LifecycleDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "LifecycleDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class LifecycleDict(TypedDict, total=False):
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool]
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+
+LifecycleParam = LifecycleDict | Lifecycle
diff --git a/python/databricks/bundles/mcp_services/_models/mcp_service.py b/python/databricks/bundles/mcp_services/_models/mcp_service.py
new file mode 100644
index 00000000000..1050e5153f4
--- /dev/null
+++ b/python/databricks/bundles/mcp_services/_models/mcp_service.py
@@ -0,0 +1,71 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._resource import Resource
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import (
+    VariableOr,
+    VariableOrList,
+    VariableOrOptional,
+)
+from databricks.bundles.mcp_services._models.lifecycle import (
+    Lifecycle,
+    LifecycleParam,
+)
+from databricks.bundles.mcp_services._models.mcp_service_config import (
+    McpServiceConfig,
+    McpServiceConfigParam,
+)
+from databricks.bundles.mcp_services._models.privilege_assignment import (
+    PrivilegeAssignment,
+    PrivilegeAssignmentParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class McpService(Resource):
+    """"""
+
+    mcp_service_id: VariableOr[str]
+
+    parent: VariableOr[str]
+
+    comment: VariableOrOptional[str] = None
+
+    config: VariableOrOptional[McpServiceConfig] = None
+
+    grants: VariableOrList[PrivilegeAssignment] = field(default_factory=list)
+
+    lifecycle: VariableOrOptional[Lifecycle] = None
+
+    @classmethod
+    def from_dict(cls, value: "McpServiceDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "McpServiceDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class McpServiceDict(TypedDict, total=False):
+    """"""
+
+    mcp_service_id: VariableOr[str]
+
+    parent: VariableOr[str]
+
+    comment: VariableOrOptional[str]
+
+    config: VariableOrOptional[McpServiceConfigParam]
+
+    grants: VariableOrList[PrivilegeAssignmentParam]
+
+    lifecycle: VariableOrOptional[LifecycleParam]
+
+
+McpServiceParam = McpServiceDict | McpService
diff --git a/python/databricks/bundles/mcp_services/_models/mcp_service_config.py b/python/databricks/bundles/mcp_services/_models/mcp_service_config.py
new file mode 100644
index 00000000000..5a9a984bf01
--- /dev/null
+++ b/python/databricks/bundles/mcp_services/_models/mcp_service_config.py
@@ -0,0 +1,82 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
+from databricks.bundles.mcp_services._models.mcp_service_config_source_connection import (
+    McpServiceConfigSourceConnection,
+    McpServiceConfigSourceConnectionParam,
+)
+from databricks.bundles.mcp_services._models.rate_limit import (
+    RateLimit,
+    RateLimitParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class McpServiceConfig:
+    """
+    Operational configuration for an MCP service. Groups the source reference,
+    tool selectors, and rate limits -- the fields that configure how the MCP
+    service behaves at invocation time.
+    """
+
+    include_tool_selectors: VariableOrList[str] = field(default_factory=list)
+    """
+    Tool names or prefix patterns to expose from the MCP server. Use exact
+    tool names or prefix patterns such as `read_*`. An empty list exposes all
+    tools. At most 1,024 selectors are allowed, and each selector can contain
+    at most 256 characters.
+    """
+
+    rate_limits: VariableOrList[RateLimit] = field(default_factory=list)
+    """
+    Rate limits for tool invocations. Supported scopes are user, group, service
+    principal, the service as a whole, and each user by default. Request and
+    token limits are supported. Empty when no rate limit is configured.
+    """
+
+    source_connection: VariableOrOptional[McpServiceConfigSourceConnection] = None
+    """
+    Unity Catalog connection referencing the MCP server. Required on Create.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "McpServiceConfigDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "McpServiceConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class McpServiceConfigDict(TypedDict, total=False):
+    """"""
+
+    include_tool_selectors: VariableOrList[str]
+    """
+    Tool names or prefix patterns to expose from the MCP server. Use exact
+    tool names or prefix patterns such as `read_*`. An empty list exposes all
+    tools. At most 1,024 selectors are allowed, and each selector can contain
+    at most 256 characters.
+    """
+
+    rate_limits: VariableOrList[RateLimitParam]
+    """
+    Rate limits for tool invocations. Supported scopes are user, group, service
+    principal, the service as a whole, and each user by default. Request and
+    token limits are supported. Empty when no rate limit is configured.
+    """
+
+    source_connection: VariableOrOptional[McpServiceConfigSourceConnectionParam]
+    """
+    Unity Catalog connection referencing the MCP server. Required on Create.
+    """
+
+
+McpServiceConfigParam = McpServiceConfigDict | McpServiceConfig
diff --git a/python/databricks/bundles/mcp_services/_models/mcp_service_config_source_connection.py b/python/databricks/bundles/mcp_services/_models/mcp_service_config_source_connection.py
new file mode 100644
index 00000000000..4da924fcd38
--- /dev/null
+++ b/python/databricks/bundles/mcp_services/_models/mcp_service_config_source_connection.py
@@ -0,0 +1,50 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class McpServiceConfigSourceConnection:
+    """
+    Unity Catalog connection that points to the MCP server. On Create, provide
+    `name` in the schema-scoped form
+    `connections/{catalog}.{schema}.{connection}`. On read, the service
+    populates the resolved connection metadata. If the connection is deleted,
+    its reference remains visible so you can identify the broken dependency.
+    """
+
+    name: VariableOr[str]
+    """
+    Resource name of the Unity Catalog connection used to access the MCP
+    server, in the form `connections/{catalog}.{schema}.{connection}`.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "McpServiceConfigSourceConnectionDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "McpServiceConfigSourceConnectionDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class McpServiceConfigSourceConnectionDict(TypedDict, total=False):
+    """"""
+
+    name: VariableOr[str]
+    """
+    Resource name of the Unity Catalog connection used to access the MCP
+    server, in the form `connections/{catalog}.{schema}.{connection}`.
+    """
+
+
+McpServiceConfigSourceConnectionParam = (
+    McpServiceConfigSourceConnectionDict | McpServiceConfigSourceConnection
+)
diff --git a/python/databricks/bundles/mcp_services/_models/privilege.py b/python/databricks/bundles/mcp_services/_models/privilege.py
new file mode 100644
index 00000000000..df45211a76a
--- /dev/null
+++ b/python/databricks/bundles/mcp_services/_models/privilege.py
@@ -0,0 +1,118 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class Privilege(Enum):
+    SELECT = "SELECT"
+    READ_PRIVATE_FILES = "READ_PRIVATE_FILES"
+    WRITE_PRIVATE_FILES = "WRITE_PRIVATE_FILES"
+    CREATE = "CREATE"
+    USAGE = "USAGE"
+    USE_CATALOG = "USE_CATALOG"
+    USE_SCHEMA = "USE_SCHEMA"
+    CREATE_SCHEMA = "CREATE_SCHEMA"
+    CREATE_VIEW = "CREATE_VIEW"
+    CREATE_EXTERNAL_TABLE = "CREATE_EXTERNAL_TABLE"
+    CREATE_MATERIALIZED_VIEW = "CREATE_MATERIALIZED_VIEW"
+    CREATE_FUNCTION = "CREATE_FUNCTION"
+    CREATE_MODEL = "CREATE_MODEL"
+    CREATE_CATALOG = "CREATE_CATALOG"
+    CREATE_MANAGED_STORAGE = "CREATE_MANAGED_STORAGE"
+    CREATE_EXTERNAL_LOCATION = "CREATE_EXTERNAL_LOCATION"
+    CREATE_STORAGE_CREDENTIAL = "CREATE_STORAGE_CREDENTIAL"
+    CREATE_SERVICE_CREDENTIAL = "CREATE_SERVICE_CREDENTIAL"
+    ACCESS = "ACCESS"
+    CREATE_SHARE = "CREATE_SHARE"
+    CREATE_RECIPIENT = "CREATE_RECIPIENT"
+    CREATE_PROVIDER = "CREATE_PROVIDER"
+    USE_SHARE = "USE_SHARE"
+    USE_RECIPIENT = "USE_RECIPIENT"
+    USE_PROVIDER = "USE_PROVIDER"
+    USE_MARKETPLACE_ASSETS = "USE_MARKETPLACE_ASSETS"
+    SET_SHARE_PERMISSION = "SET_SHARE_PERMISSION"
+    MODIFY = "MODIFY"
+    REFRESH = "REFRESH"
+    EXECUTE = "EXECUTE"
+    READ_FILES = "READ_FILES"
+    WRITE_FILES = "WRITE_FILES"
+    CREATE_TABLE = "CREATE_TABLE"
+    ALL_PRIVILEGES = "ALL_PRIVILEGES"
+    CREATE_CONNECTION = "CREATE_CONNECTION"
+    USE_CONNECTION = "USE_CONNECTION"
+    APPLY_TAG = "APPLY_TAG"
+    CREATE_FOREIGN_CATALOG = "CREATE_FOREIGN_CATALOG"
+    CREATE_FOREIGN_SECURABLE = "CREATE_FOREIGN_SECURABLE"
+    MANAGE_ALLOWLIST = "MANAGE_ALLOWLIST"
+    CREATE_VOLUME = "CREATE_VOLUME"
+    CREATE_EXTERNAL_VOLUME = "CREATE_EXTERNAL_VOLUME"
+    READ_VOLUME = "READ_VOLUME"
+    WRITE_VOLUME = "WRITE_VOLUME"
+    MANAGE = "MANAGE"
+    BROWSE = "BROWSE"
+    CREATE_CLEAN_ROOM = "CREATE_CLEAN_ROOM"
+    MODIFY_CLEAN_ROOM = "MODIFY_CLEAN_ROOM"
+    EXECUTE_CLEAN_ROOM_TASK = "EXECUTE_CLEAN_ROOM_TASK"
+    EXTERNAL_USE_SCHEMA = "EXTERNAL_USE_SCHEMA"
+    READ_METADATA = "READ_METADATA"
+    EXTERNAL_USE_LOCATION = "EXTERNAL_USE_LOCATION"
+
+
+PrivilegeParam = (
+    Literal[
+        "SELECT",
+        "READ_PRIVATE_FILES",
+        "WRITE_PRIVATE_FILES",
+        "CREATE",
+        "USAGE",
+        "USE_CATALOG",
+        "USE_SCHEMA",
+        "CREATE_SCHEMA",
+        "CREATE_VIEW",
+        "CREATE_EXTERNAL_TABLE",
+        "CREATE_MATERIALIZED_VIEW",
+        "CREATE_FUNCTION",
+        "CREATE_MODEL",
+        "CREATE_CATALOG",
+        "CREATE_MANAGED_STORAGE",
+        "CREATE_EXTERNAL_LOCATION",
+        "CREATE_STORAGE_CREDENTIAL",
+        "CREATE_SERVICE_CREDENTIAL",
+        "ACCESS",
+        "CREATE_SHARE",
+        "CREATE_RECIPIENT",
+        "CREATE_PROVIDER",
+        "USE_SHARE",
+        "USE_RECIPIENT",
+        "USE_PROVIDER",
+        "USE_MARKETPLACE_ASSETS",
+        "SET_SHARE_PERMISSION",
+        "MODIFY",
+        "REFRESH",
+        "EXECUTE",
+        "READ_FILES",
+        "WRITE_FILES",
+        "CREATE_TABLE",
+        "ALL_PRIVILEGES",
+        "CREATE_CONNECTION",
+        "USE_CONNECTION",
+        "APPLY_TAG",
+        "CREATE_FOREIGN_CATALOG",
+        "CREATE_FOREIGN_SECURABLE",
+        "MANAGE_ALLOWLIST",
+        "CREATE_VOLUME",
+        "CREATE_EXTERNAL_VOLUME",
+        "READ_VOLUME",
+        "WRITE_VOLUME",
+        "MANAGE",
+        "BROWSE",
+        "CREATE_CLEAN_ROOM",
+        "MODIFY_CLEAN_ROOM",
+        "EXECUTE_CLEAN_ROOM_TASK",
+        "EXTERNAL_USE_SCHEMA",
+        "READ_METADATA",
+        "EXTERNAL_USE_LOCATION",
+    ]
+    | Privilege
+)
diff --git a/python/databricks/bundles/mcp_services/_models/privilege_assignment.py b/python/databricks/bundles/mcp_services/_models/privilege_assignment.py
new file mode 100644
index 00000000000..cdaba80f76a
--- /dev/null
+++ b/python/databricks/bundles/mcp_services/_models/privilege_assignment.py
@@ -0,0 +1,53 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
+from databricks.bundles.mcp_services._models.privilege import Privilege, PrivilegeParam
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class PrivilegeAssignment:
+    """"""
+
+    principal: VariableOrOptional[str] = None
+    """
+    The principal (user email address or group name).
+    For deleted principals, `principal` is empty while `principal_id` is populated.
+    """
+
+    privileges: VariableOrList[Privilege] = field(default_factory=list)
+    """
+    The privileges assigned to the principal.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "PrivilegeAssignmentDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "PrivilegeAssignmentDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class PrivilegeAssignmentDict(TypedDict, total=False):
+    """"""
+
+    principal: VariableOrOptional[str]
+    """
+    The principal (user email address or group name).
+    For deleted principals, `principal` is empty while `principal_id` is populated.
+    """
+
+    privileges: VariableOrList[PrivilegeParam]
+    """
+    The privileges assigned to the principal.
+    """
+
+
+PrivilegeAssignmentParam = PrivilegeAssignmentDict | PrivilegeAssignment
diff --git a/python/databricks/bundles/mcp_services/_models/rate_limit.py b/python/databricks/bundles/mcp_services/_models/rate_limit.py
new file mode 100644
index 00000000000..cba7fed7056
--- /dev/null
+++ b/python/databricks/bundles/mcp_services/_models/rate_limit.py
@@ -0,0 +1,102 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+from databricks.bundles.mcp_services._models.rate_limit_rate_limit_key import (
+    RateLimitRateLimitKey,
+    RateLimitRateLimitKeyParam,
+)
+from databricks.bundles.mcp_services._models.rate_limit_rate_limit_renewal_period import (
+    RateLimitRateLimitRenewalPeriod,
+    RateLimitRateLimitRenewalPeriodParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class RateLimit:
+    """
+    A rate limit applied to service requests. Leave `requests` or `tokens`
+    unset to impose no limit on that dimension; set a value to cap that dimension
+    within the renewal period.
+    """
+
+    key: VariableOr[RateLimitRateLimitKey]
+    """
+    Scope of the rate limit. Depending on this value, the limit applies to a
+    principal, the service as a whole, or each user by default.
+    """
+
+    renewal_period: VariableOr[RateLimitRateLimitRenewalPeriod]
+    """
+    Renewal period.
+    """
+
+    principal: VariableOrOptional[str] = None
+    """
+    Principal this limit applies to: user email, group name, or service
+    principal application ID. Required when `key` applies to a user, group, or
+    service principal; otherwise it must be unset.
+    """
+
+    requests: VariableOrOptional[int] = None
+    """
+    Maximum requests allowed in one renewal period. Leave unset for no request
+    limit. Set to `0` to deny all requests.
+    """
+
+    tokens: VariableOrOptional[int] = None
+    """
+    Maximum tokens allowed in one renewal period. Leave unset for no token
+    limit. Set to `0` to deny all requests.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "RateLimitDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "RateLimitDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class RateLimitDict(TypedDict, total=False):
+    """"""
+
+    key: VariableOr[RateLimitRateLimitKeyParam]
+    """
+    Scope of the rate limit. Depending on this value, the limit applies to a
+    principal, the service as a whole, or each user by default.
+    """
+
+    renewal_period: VariableOr[RateLimitRateLimitRenewalPeriodParam]
+    """
+    Renewal period.
+    """
+
+    principal: VariableOrOptional[str]
+    """
+    Principal this limit applies to: user email, group name, or service
+    principal application ID. Required when `key` applies to a user, group, or
+    service principal; otherwise it must be unset.
+    """
+
+    requests: VariableOrOptional[int]
+    """
+    Maximum requests allowed in one renewal period. Leave unset for no request
+    limit. Set to `0` to deny all requests.
+    """
+
+    tokens: VariableOrOptional[int]
+    """
+    Maximum tokens allowed in one renewal period. Leave unset for no token
+    limit. Set to `0` to deny all requests.
+    """
+
+
+RateLimitParam = RateLimitDict | RateLimit
diff --git a/python/databricks/bundles/mcp_services/_models/rate_limit_rate_limit_key.py b/python/databricks/bundles/mcp_services/_models/rate_limit_rate_limit_key.py
new file mode 100644
index 00000000000..fb907da810f
--- /dev/null
+++ b/python/databricks/bundles/mcp_services/_models/rate_limit_rate_limit_key.py
@@ -0,0 +1,28 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class RateLimitRateLimitKey(Enum):
+    """
+    Scope key for a rate limit.
+    """
+
+    RATE_LIMIT_KEY_USER = "RATE_LIMIT_KEY_USER"
+    RATE_LIMIT_KEY_USER_GROUP = "RATE_LIMIT_KEY_USER_GROUP"
+    RATE_LIMIT_KEY_SERVICE_PRINCIPAL = "RATE_LIMIT_KEY_SERVICE_PRINCIPAL"
+    RATE_LIMIT_KEY_SERVICE = "RATE_LIMIT_KEY_SERVICE"
+    RATE_LIMIT_KEY_USER_DEFAULT = "RATE_LIMIT_KEY_USER_DEFAULT"
+
+
+RateLimitRateLimitKeyParam = (
+    Literal[
+        "RATE_LIMIT_KEY_USER",
+        "RATE_LIMIT_KEY_USER_GROUP",
+        "RATE_LIMIT_KEY_SERVICE_PRINCIPAL",
+        "RATE_LIMIT_KEY_SERVICE",
+        "RATE_LIMIT_KEY_USER_DEFAULT",
+    ]
+    | RateLimitRateLimitKey
+)
diff --git a/python/databricks/bundles/mcp_services/_models/rate_limit_rate_limit_renewal_period.py b/python/databricks/bundles/mcp_services/_models/rate_limit_rate_limit_renewal_period.py
new file mode 100644
index 00000000000..58636c784c0
--- /dev/null
+++ b/python/databricks/bundles/mcp_services/_models/rate_limit_rate_limit_renewal_period.py
@@ -0,0 +1,19 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class RateLimitRateLimitRenewalPeriod(Enum):
+    """
+    Renewal period for a rate limit.
+    """
+
+    RATE_LIMIT_RENEWAL_PERIOD_MINUTE = "RATE_LIMIT_RENEWAL_PERIOD_MINUTE"
+    RATE_LIMIT_RENEWAL_PERIOD_HOUR = "RATE_LIMIT_RENEWAL_PERIOD_HOUR"
+
+
+RateLimitRateLimitRenewalPeriodParam = (
+    Literal["RATE_LIMIT_RENEWAL_PERIOD_MINUTE", "RATE_LIMIT_RENEWAL_PERIOD_HOUR"]
+    | RateLimitRateLimitRenewalPeriod
+)
diff --git a/python/databricks/bundles/model_provider_services/__init__.py b/python/databricks/bundles/model_provider_services/__init__.py
new file mode 100644
index 00000000000..e7b2a5b13f7
--- /dev/null
+++ b/python/databricks/bundles/model_provider_services/__init__.py
@@ -0,0 +1,262 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+__all__ = [
+    "InferenceTableConfig",
+    "InferenceTableConfigDict",
+    "InferenceTableConfigParam",
+    "Lifecycle",
+    "LifecycleDict",
+    "LifecycleParam",
+    "ModelProviderService",
+    "ModelProviderServiceConfig",
+    "ModelProviderServiceConfigAmazonBedrockProviderConfig",
+    "ModelProviderServiceConfigAmazonBedrockProviderConfigDict",
+    "ModelProviderServiceConfigAmazonBedrockProviderConfigParam",
+    "ModelProviderServiceConfigAmazonBedrockProviderDirectConfig",
+    "ModelProviderServiceConfigAmazonBedrockProviderDirectConfigDict",
+    "ModelProviderServiceConfigAmazonBedrockProviderDirectConfigParam",
+    "ModelProviderServiceConfigAnthropicProviderConfig",
+    "ModelProviderServiceConfigAnthropicProviderConfigDict",
+    "ModelProviderServiceConfigAnthropicProviderConfigParam",
+    "ModelProviderServiceConfigAnthropicProviderDirectConfig",
+    "ModelProviderServiceConfigAnthropicProviderDirectConfigDict",
+    "ModelProviderServiceConfigAnthropicProviderDirectConfigParam",
+    "ModelProviderServiceConfigAnthropicProviderRelayedConfig",
+    "ModelProviderServiceConfigAnthropicProviderRelayedConfigDict",
+    "ModelProviderServiceConfigAnthropicProviderRelayedConfigParam",
+    "ModelProviderServiceConfigAwsAccessKey",
+    "ModelProviderServiceConfigAwsAccessKeyDict",
+    "ModelProviderServiceConfigAwsAccessKeyParam",
+    "ModelProviderServiceConfigAzureOpenAiProviderConfig",
+    "ModelProviderServiceConfigAzureOpenAiProviderConfigDict",
+    "ModelProviderServiceConfigAzureOpenAiProviderConfigParam",
+    "ModelProviderServiceConfigAzureOpenAiProviderDirectConfig",
+    "ModelProviderServiceConfigAzureOpenAiProviderDirectConfigDict",
+    "ModelProviderServiceConfigAzureOpenAiProviderDirectConfigParam",
+    "ModelProviderServiceConfigCustomProviderApiKeyHeaderAuth",
+    "ModelProviderServiceConfigCustomProviderApiKeyHeaderAuthDict",
+    "ModelProviderServiceConfigCustomProviderApiKeyHeaderAuthParam",
+    "ModelProviderServiceConfigCustomProviderConfig",
+    "ModelProviderServiceConfigCustomProviderConfigDict",
+    "ModelProviderServiceConfigCustomProviderConfigParam",
+    "ModelProviderServiceConfigCustomProviderDirectConfig",
+    "ModelProviderServiceConfigCustomProviderDirectConfigDict",
+    "ModelProviderServiceConfigCustomProviderDirectConfigParam",
+    "ModelProviderServiceConfigDict",
+    "ModelProviderServiceConfigEntraServicePrincipal",
+    "ModelProviderServiceConfigEntraServicePrincipalDict",
+    "ModelProviderServiceConfigEntraServicePrincipalParam",
+    "ModelProviderServiceConfigExternalModelProviderType",
+    "ModelProviderServiceConfigExternalModelProviderTypeParam",
+    "ModelProviderServiceConfigGeminiEnterpriseProviderConfig",
+    "ModelProviderServiceConfigGeminiEnterpriseProviderConfigDict",
+    "ModelProviderServiceConfigGeminiEnterpriseProviderConfigParam",
+    "ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfig",
+    "ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfigDict",
+    "ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfigParam",
+    "ModelProviderServiceConfigMicrosoftFoundryProviderConfig",
+    "ModelProviderServiceConfigMicrosoftFoundryProviderConfigDict",
+    "ModelProviderServiceConfigMicrosoftFoundryProviderConfigParam",
+    "ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfig",
+    "ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfigDict",
+    "ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfigParam",
+    "ModelProviderServiceConfigModelTargetConfig",
+    "ModelProviderServiceConfigModelTargetConfigDict",
+    "ModelProviderServiceConfigModelTargetConfigParam",
+    "ModelProviderServiceConfigOpenAiProviderConfig",
+    "ModelProviderServiceConfigOpenAiProviderConfigDict",
+    "ModelProviderServiceConfigOpenAiProviderConfigParam",
+    "ModelProviderServiceConfigOpenAiProviderDirectConfig",
+    "ModelProviderServiceConfigOpenAiProviderDirectConfigDict",
+    "ModelProviderServiceConfigOpenAiProviderDirectConfigParam",
+    "ModelProviderServiceConfigParam",
+    "ModelProviderServiceConfigProviderPricingConfig",
+    "ModelProviderServiceConfigProviderPricingConfigDict",
+    "ModelProviderServiceConfigProviderPricingConfigParam",
+    "ModelProviderServiceConfigProviderSecret",
+    "ModelProviderServiceConfigProviderSecretDict",
+    "ModelProviderServiceConfigProviderSecretParam",
+    "ModelProviderServiceConfigSecretReference",
+    "ModelProviderServiceConfigSecretReferenceDict",
+    "ModelProviderServiceConfigSecretReferenceParam",
+    "ModelProviderServiceConfigServiceCredential",
+    "ModelProviderServiceConfigServiceCredentialDict",
+    "ModelProviderServiceConfigServiceCredentialParam",
+    "ModelProviderServiceDict",
+    "ModelProviderServiceParam",
+    "Privilege",
+    "PrivilegeAssignment",
+    "PrivilegeAssignmentDict",
+    "PrivilegeAssignmentParam",
+    "PrivilegeParam",
+    "RateLimit",
+    "RateLimitDict",
+    "RateLimitParam",
+    "RateLimitRateLimitKey",
+    "RateLimitRateLimitKeyParam",
+    "RateLimitRateLimitRenewalPeriod",
+    "RateLimitRateLimitRenewalPeriodParam",
+]
+
+
+from databricks.bundles.model_provider_services._models.inference_table_config import (
+    InferenceTableConfig,
+    InferenceTableConfigDict,
+    InferenceTableConfigParam,
+)
+from databricks.bundles.model_provider_services._models.lifecycle import (
+    Lifecycle,
+    LifecycleDict,
+    LifecycleParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service import (
+    ModelProviderService,
+    ModelProviderServiceDict,
+    ModelProviderServiceParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config import (
+    ModelProviderServiceConfig,
+    ModelProviderServiceConfigDict,
+    ModelProviderServiceConfigParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_amazon_bedrock_provider_config import (
+    ModelProviderServiceConfigAmazonBedrockProviderConfig,
+    ModelProviderServiceConfigAmazonBedrockProviderConfigDict,
+    ModelProviderServiceConfigAmazonBedrockProviderConfigParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_amazon_bedrock_provider_direct_config import (
+    ModelProviderServiceConfigAmazonBedrockProviderDirectConfig,
+    ModelProviderServiceConfigAmazonBedrockProviderDirectConfigDict,
+    ModelProviderServiceConfigAmazonBedrockProviderDirectConfigParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_anthropic_provider_config import (
+    ModelProviderServiceConfigAnthropicProviderConfig,
+    ModelProviderServiceConfigAnthropicProviderConfigDict,
+    ModelProviderServiceConfigAnthropicProviderConfigParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_anthropic_provider_direct_config import (
+    ModelProviderServiceConfigAnthropicProviderDirectConfig,
+    ModelProviderServiceConfigAnthropicProviderDirectConfigDict,
+    ModelProviderServiceConfigAnthropicProviderDirectConfigParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_anthropic_provider_relayed_config import (
+    ModelProviderServiceConfigAnthropicProviderRelayedConfig,
+    ModelProviderServiceConfigAnthropicProviderRelayedConfigDict,
+    ModelProviderServiceConfigAnthropicProviderRelayedConfigParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_aws_access_key import (
+    ModelProviderServiceConfigAwsAccessKey,
+    ModelProviderServiceConfigAwsAccessKeyDict,
+    ModelProviderServiceConfigAwsAccessKeyParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_azure_open_ai_provider_config import (
+    ModelProviderServiceConfigAzureOpenAiProviderConfig,
+    ModelProviderServiceConfigAzureOpenAiProviderConfigDict,
+    ModelProviderServiceConfigAzureOpenAiProviderConfigParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_azure_open_ai_provider_direct_config import (
+    ModelProviderServiceConfigAzureOpenAiProviderDirectConfig,
+    ModelProviderServiceConfigAzureOpenAiProviderDirectConfigDict,
+    ModelProviderServiceConfigAzureOpenAiProviderDirectConfigParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_custom_provider_api_key_header_auth import (
+    ModelProviderServiceConfigCustomProviderApiKeyHeaderAuth,
+    ModelProviderServiceConfigCustomProviderApiKeyHeaderAuthDict,
+    ModelProviderServiceConfigCustomProviderApiKeyHeaderAuthParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_custom_provider_config import (
+    ModelProviderServiceConfigCustomProviderConfig,
+    ModelProviderServiceConfigCustomProviderConfigDict,
+    ModelProviderServiceConfigCustomProviderConfigParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_custom_provider_direct_config import (
+    ModelProviderServiceConfigCustomProviderDirectConfig,
+    ModelProviderServiceConfigCustomProviderDirectConfigDict,
+    ModelProviderServiceConfigCustomProviderDirectConfigParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_entra_service_principal import (
+    ModelProviderServiceConfigEntraServicePrincipal,
+    ModelProviderServiceConfigEntraServicePrincipalDict,
+    ModelProviderServiceConfigEntraServicePrincipalParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_external_model_provider_type import (
+    ModelProviderServiceConfigExternalModelProviderType,
+    ModelProviderServiceConfigExternalModelProviderTypeParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_gemini_enterprise_provider_config import (
+    ModelProviderServiceConfigGeminiEnterpriseProviderConfig,
+    ModelProviderServiceConfigGeminiEnterpriseProviderConfigDict,
+    ModelProviderServiceConfigGeminiEnterpriseProviderConfigParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_gemini_enterprise_provider_direct_config import (
+    ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfig,
+    ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfigDict,
+    ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfigParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_microsoft_foundry_provider_config import (
+    ModelProviderServiceConfigMicrosoftFoundryProviderConfig,
+    ModelProviderServiceConfigMicrosoftFoundryProviderConfigDict,
+    ModelProviderServiceConfigMicrosoftFoundryProviderConfigParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_microsoft_foundry_provider_direct_config import (
+    ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfig,
+    ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfigDict,
+    ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfigParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_model_target_config import (
+    ModelProviderServiceConfigModelTargetConfig,
+    ModelProviderServiceConfigModelTargetConfigDict,
+    ModelProviderServiceConfigModelTargetConfigParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_open_ai_provider_config import (
+    ModelProviderServiceConfigOpenAiProviderConfig,
+    ModelProviderServiceConfigOpenAiProviderConfigDict,
+    ModelProviderServiceConfigOpenAiProviderConfigParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_open_ai_provider_direct_config import (
+    ModelProviderServiceConfigOpenAiProviderDirectConfig,
+    ModelProviderServiceConfigOpenAiProviderDirectConfigDict,
+    ModelProviderServiceConfigOpenAiProviderDirectConfigParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_provider_pricing_config import (
+    ModelProviderServiceConfigProviderPricingConfig,
+    ModelProviderServiceConfigProviderPricingConfigDict,
+    ModelProviderServiceConfigProviderPricingConfigParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_provider_secret import (
+    ModelProviderServiceConfigProviderSecret,
+    ModelProviderServiceConfigProviderSecretDict,
+    ModelProviderServiceConfigProviderSecretParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_secret_reference import (
+    ModelProviderServiceConfigSecretReference,
+    ModelProviderServiceConfigSecretReferenceDict,
+    ModelProviderServiceConfigSecretReferenceParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_service_credential import (
+    ModelProviderServiceConfigServiceCredential,
+    ModelProviderServiceConfigServiceCredentialDict,
+    ModelProviderServiceConfigServiceCredentialParam,
+)
+from databricks.bundles.model_provider_services._models.privilege import (
+    Privilege,
+    PrivilegeParam,
+)
+from databricks.bundles.model_provider_services._models.privilege_assignment import (
+    PrivilegeAssignment,
+    PrivilegeAssignmentDict,
+    PrivilegeAssignmentParam,
+)
+from databricks.bundles.model_provider_services._models.rate_limit import (
+    RateLimit,
+    RateLimitDict,
+    RateLimitParam,
+)
+from databricks.bundles.model_provider_services._models.rate_limit_rate_limit_key import (
+    RateLimitRateLimitKey,
+    RateLimitRateLimitKeyParam,
+)
+from databricks.bundles.model_provider_services._models.rate_limit_rate_limit_renewal_period import (
+    RateLimitRateLimitRenewalPeriod,
+    RateLimitRateLimitRenewalPeriodParam,
+)
diff --git a/python/databricks/bundles/model_provider_services/_models/inference_table_config.py b/python/databricks/bundles/model_provider_services/_models/inference_table_config.py
new file mode 100644
index 00000000000..45165416e17
--- /dev/null
+++ b/python/databricks/bundles/model_provider_services/_models/inference_table_config.py
@@ -0,0 +1,66 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class InferenceTableConfig:
+    """
+    Configuration for logging request and response payloads to a Unity Catalog
+    inference table. When this configuration is present, payload logging is
+    enabled by default.
+    """
+
+    parent: VariableOr[str]
+    """
+    Parent Unity Catalog schema where the inference table is created, in the
+    form `schemas/{catalog}.{schema}`. Required when configuring an inference
+    table. After the inference table is created, this field cannot be changed.
+    """
+
+    table_name_prefix: VariableOrOptional[str] = None
+    """
+    Prefix used to form the inference table's registered name. AI Gateway
+    appends `_payload`; for example, `table_name_prefix = "orders"` creates
+    `orders_payload`. If unset, the prefix defaults to the service name. Read
+    `table` from the response for the resulting resource name. After the
+    inference table is created, this field cannot be changed.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "InferenceTableConfigDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "InferenceTableConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class InferenceTableConfigDict(TypedDict, total=False):
+    """"""
+
+    parent: VariableOr[str]
+    """
+    Parent Unity Catalog schema where the inference table is created, in the
+    form `schemas/{catalog}.{schema}`. Required when configuring an inference
+    table. After the inference table is created, this field cannot be changed.
+    """
+
+    table_name_prefix: VariableOrOptional[str]
+    """
+    Prefix used to form the inference table's registered name. AI Gateway
+    appends `_payload`; for example, `table_name_prefix = "orders"` creates
+    `orders_payload`. If unset, the prefix defaults to the service name. Read
+    `table` from the response for the resulting resource name. After the
+    inference table is created, this field cannot be changed.
+    """
+
+
+InferenceTableConfigParam = InferenceTableConfigDict | InferenceTableConfig
diff --git a/python/databricks/bundles/model_provider_services/_models/lifecycle.py b/python/databricks/bundles/model_provider_services/_models/lifecycle.py
new file mode 100644
index 00000000000..697776a198e
--- /dev/null
+++ b/python/databricks/bundles/model_provider_services/_models/lifecycle.py
@@ -0,0 +1,40 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class Lifecycle:
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool] = None
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "LifecycleDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "LifecycleDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class LifecycleDict(TypedDict, total=False):
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool]
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+
+LifecycleParam = LifecycleDict | Lifecycle
diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service.py
new file mode 100644
index 00000000000..41a21652ac8
--- /dev/null
+++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service.py
@@ -0,0 +1,71 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._resource import Resource
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import (
+    VariableOr,
+    VariableOrList,
+    VariableOrOptional,
+)
+from databricks.bundles.model_provider_services._models.lifecycle import (
+    Lifecycle,
+    LifecycleParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config import (
+    ModelProviderServiceConfig,
+    ModelProviderServiceConfigParam,
+)
+from databricks.bundles.model_provider_services._models.privilege_assignment import (
+    PrivilegeAssignment,
+    PrivilegeAssignmentParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ModelProviderService(Resource):
+    """"""
+
+    model_provider_service_id: VariableOr[str]
+
+    parent: VariableOr[str]
+
+    comment: VariableOrOptional[str] = None
+
+    config: VariableOrOptional[ModelProviderServiceConfig] = None
+
+    grants: VariableOrList[PrivilegeAssignment] = field(default_factory=list)
+
+    lifecycle: VariableOrOptional[Lifecycle] = None
+
+    @classmethod
+    def from_dict(cls, value: "ModelProviderServiceDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ModelProviderServiceDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ModelProviderServiceDict(TypedDict, total=False):
+    """"""
+
+    model_provider_service_id: VariableOr[str]
+
+    parent: VariableOr[str]
+
+    comment: VariableOrOptional[str]
+
+    config: VariableOrOptional[ModelProviderServiceConfigParam]
+
+    grants: VariableOrList[PrivilegeAssignmentParam]
+
+    lifecycle: VariableOrOptional[LifecycleParam]
+
+
+ModelProviderServiceParam = ModelProviderServiceDict | ModelProviderService
diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config.py
new file mode 100644
index 00000000000..57ff32a4bc9
--- /dev/null
+++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config.py
@@ -0,0 +1,338 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
+from databricks.bundles.model_provider_services._models.inference_table_config import (
+    InferenceTableConfig,
+    InferenceTableConfigParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_amazon_bedrock_provider_config import (
+    ModelProviderServiceConfigAmazonBedrockProviderConfig,
+    ModelProviderServiceConfigAmazonBedrockProviderConfigParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_anthropic_provider_config import (
+    ModelProviderServiceConfigAnthropicProviderConfig,
+    ModelProviderServiceConfigAnthropicProviderConfigParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_azure_open_ai_provider_config import (
+    ModelProviderServiceConfigAzureOpenAiProviderConfig,
+    ModelProviderServiceConfigAzureOpenAiProviderConfigParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_custom_provider_config import (
+    ModelProviderServiceConfigCustomProviderConfig,
+    ModelProviderServiceConfigCustomProviderConfigParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_external_model_provider_type import (
+    ModelProviderServiceConfigExternalModelProviderType,
+    ModelProviderServiceConfigExternalModelProviderTypeParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_gemini_enterprise_provider_config import (
+    ModelProviderServiceConfigGeminiEnterpriseProviderConfig,
+    ModelProviderServiceConfigGeminiEnterpriseProviderConfigParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_microsoft_foundry_provider_config import (
+    ModelProviderServiceConfigMicrosoftFoundryProviderConfig,
+    ModelProviderServiceConfigMicrosoftFoundryProviderConfigParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_model_target_config import (
+    ModelProviderServiceConfigModelTargetConfig,
+    ModelProviderServiceConfigModelTargetConfigParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_open_ai_provider_config import (
+    ModelProviderServiceConfigOpenAiProviderConfig,
+    ModelProviderServiceConfigOpenAiProviderConfigParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_provider_pricing_config import (
+    ModelProviderServiceConfigProviderPricingConfig,
+    ModelProviderServiceConfigProviderPricingConfigParam,
+)
+from databricks.bundles.model_provider_services._models.rate_limit import (
+    RateLimit,
+    RateLimitParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ModelProviderServiceConfig:
+    """
+    Behavioral configuration for a ModelProviderService: provider authentication
+    and provider-specific fields, the catalog of models this provider
+    service can route to, and the passthrough policy that governs how request
+    headers, query parameters, and unmanaged subpaths cross the trust boundary
+    to the upstream provider.
+    """
+
+    allow_all_targets: VariableOrOptional[bool] = None
+    """
+    When true, accepts any model exposed by the upstream provider; `targets`
+    is not required and does not restrict routability. When false, only
+    models listed in `targets` are routable. Defaults to false.
+    """
+
+    amazon_bedrock: VariableOrOptional[
+        ModelProviderServiceConfigAmazonBedrockProviderConfig
+    ] = None
+    """
+    Amazon Bedrock provider configuration.
+    """
+
+    anthropic: VariableOrOptional[ModelProviderServiceConfigAnthropicProviderConfig] = (
+        None
+    )
+    """
+    Anthropic provider configuration. Exactly one of `direct` or `relayed` must
+    be set on Create; the two are mutually exclusive.
+    """
+
+    azure_openai: VariableOrOptional[
+        ModelProviderServiceConfigAzureOpenAiProviderConfig
+    ] = None
+    """
+    Azure OpenAI provider configuration.
+    """
+
+    bedrock_mantle: VariableOrOptional[
+        ModelProviderServiceConfigAmazonBedrockProviderConfig
+    ] = None
+    """
+    Amazon Bedrock provider configuration.
+    """
+
+    custom: VariableOrOptional[ModelProviderServiceConfigCustomProviderConfig] = None
+    """
+    Custom OpenAI-compatible provider configuration with bearer-token
+    authentication.
+    """
+
+    forward_headers: VariableOrOptional[bool] = None
+    """
+    Whether to forward incoming HTTP headers to the upstream provider. Defaults
+    to false and is configured for the entire provider service, not per request.
+    Upstream authentication is configured separately in the provider-specific
+    configuration.
+    """
+
+    forward_query_parameters: VariableOrOptional[bool] = None
+    """
+    Whether to forward incoming query parameters to the upstream provider.
+    Defaults to false and is configured for the entire provider service, not
+    per request.
+    """
+
+    forward_unmanaged_paths: VariableOrOptional[bool] = None
+    """
+    Whether to proxy paths that AI Gateway does not recognize as configured
+    provider-native API types. Defaults to false. When true, these paths are
+    forwarded unchanged to the upstream provider. When false, only
+    recognized API paths are served. Enabling this broadens the upstream API
+    surface exposed through the provider service. AI Gateway cannot evaluate
+    Service Policies on opaque unmanaged requests, so unmanaged requests are
+    rejected whenever Service Policies are attached to this securable.
+    """
+
+    gemini_enterprise: VariableOrOptional[
+        ModelProviderServiceConfigGeminiEnterpriseProviderConfig
+    ] = None
+    """
+    Gemini Enterprise provider configuration.
+    """
+
+    inference_table: VariableOrOptional[InferenceTableConfig] = None
+    """
+    Payload logging configuration for requests sent directly to this provider
+    service. Requests routed through a model service are captured by that model
+    service's inference table instead.
+    """
+
+    microsoft_foundry: VariableOrOptional[
+        ModelProviderServiceConfigMicrosoftFoundryProviderConfig
+    ] = None
+    """
+    Microsoft Foundry provider configuration.
+    """
+
+    openai: VariableOrOptional[ModelProviderServiceConfigOpenAiProviderConfig] = None
+    """
+    OpenAI provider configuration.
+    """
+
+    pricing: VariableOrOptional[ModelProviderServiceConfigProviderPricingConfig] = None
+    """
+    Pricing configuration for this provider service. An explicitly empty
+    configuration is retained on Create and Update and applies no adjustment.
+    """
+
+    provider_type: VariableOrOptional[
+        ModelProviderServiceConfigExternalModelProviderType
+    ] = None
+    """
+    External model provider. Required on Create and immutable thereafter. Set
+    the matching provider-specific configuration, such as `openai`,
+    `azure_openai`, or `amazon_bedrock`.
+    """
+
+    rate_limits: VariableOrList[RateLimit] = field(default_factory=list)
+    """
+    Rate limits for requests sent directly to this provider service. Requests
+    routed through a model service use that model service's rate limits instead.
+    """
+
+    targets: VariableOrList[ModelProviderServiceConfigModelTargetConfig] = field(
+        default_factory=list
+    )
+    """
+    Models and provider-native API types exposed by this provider service. Each
+    entry must include at least one `native_api_types` value. When
+    `allow_all_targets` is false, at least one entry is required and model
+    service destinations can reference only listed models. When
+    `allow_all_targets` is true, any upstream model is routable; entries in
+    this list provide API-type metadata without restricting other models.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "ModelProviderServiceConfigDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ModelProviderServiceConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ModelProviderServiceConfigDict(TypedDict, total=False):
+    """"""
+
+    allow_all_targets: VariableOrOptional[bool]
+    """
+    When true, accepts any model exposed by the upstream provider; `targets`
+    is not required and does not restrict routability. When false, only
+    models listed in `targets` are routable. Defaults to false.
+    """
+
+    amazon_bedrock: VariableOrOptional[
+        ModelProviderServiceConfigAmazonBedrockProviderConfigParam
+    ]
+    """
+    Amazon Bedrock provider configuration.
+    """
+
+    anthropic: VariableOrOptional[
+        ModelProviderServiceConfigAnthropicProviderConfigParam
+    ]
+    """
+    Anthropic provider configuration. Exactly one of `direct` or `relayed` must
+    be set on Create; the two are mutually exclusive.
+    """
+
+    azure_openai: VariableOrOptional[
+        ModelProviderServiceConfigAzureOpenAiProviderConfigParam
+    ]
+    """
+    Azure OpenAI provider configuration.
+    """
+
+    bedrock_mantle: VariableOrOptional[
+        ModelProviderServiceConfigAmazonBedrockProviderConfigParam
+    ]
+    """
+    Amazon Bedrock provider configuration.
+    """
+
+    custom: VariableOrOptional[ModelProviderServiceConfigCustomProviderConfigParam]
+    """
+    Custom OpenAI-compatible provider configuration with bearer-token
+    authentication.
+    """
+
+    forward_headers: VariableOrOptional[bool]
+    """
+    Whether to forward incoming HTTP headers to the upstream provider. Defaults
+    to false and is configured for the entire provider service, not per request.
+    Upstream authentication is configured separately in the provider-specific
+    configuration.
+    """
+
+    forward_query_parameters: VariableOrOptional[bool]
+    """
+    Whether to forward incoming query parameters to the upstream provider.
+    Defaults to false and is configured for the entire provider service, not
+    per request.
+    """
+
+    forward_unmanaged_paths: VariableOrOptional[bool]
+    """
+    Whether to proxy paths that AI Gateway does not recognize as configured
+    provider-native API types. Defaults to false. When true, these paths are
+    forwarded unchanged to the upstream provider. When false, only
+    recognized API paths are served. Enabling this broadens the upstream API
+    surface exposed through the provider service. AI Gateway cannot evaluate
+    Service Policies on opaque unmanaged requests, so unmanaged requests are
+    rejected whenever Service Policies are attached to this securable.
+    """
+
+    gemini_enterprise: VariableOrOptional[
+        ModelProviderServiceConfigGeminiEnterpriseProviderConfigParam
+    ]
+    """
+    Gemini Enterprise provider configuration.
+    """
+
+    inference_table: VariableOrOptional[InferenceTableConfigParam]
+    """
+    Payload logging configuration for requests sent directly to this provider
+    service. Requests routed through a model service are captured by that model
+    service's inference table instead.
+    """
+
+    microsoft_foundry: VariableOrOptional[
+        ModelProviderServiceConfigMicrosoftFoundryProviderConfigParam
+    ]
+    """
+    Microsoft Foundry provider configuration.
+    """
+
+    openai: VariableOrOptional[ModelProviderServiceConfigOpenAiProviderConfigParam]
+    """
+    OpenAI provider configuration.
+    """
+
+    pricing: VariableOrOptional[ModelProviderServiceConfigProviderPricingConfigParam]
+    """
+    Pricing configuration for this provider service. An explicitly empty
+    configuration is retained on Create and Update and applies no adjustment.
+    """
+
+    provider_type: VariableOrOptional[
+        ModelProviderServiceConfigExternalModelProviderTypeParam
+    ]
+    """
+    External model provider. Required on Create and immutable thereafter. Set
+    the matching provider-specific configuration, such as `openai`,
+    `azure_openai`, or `amazon_bedrock`.
+    """
+
+    rate_limits: VariableOrList[RateLimitParam]
+    """
+    Rate limits for requests sent directly to this provider service. Requests
+    routed through a model service use that model service's rate limits instead.
+    """
+
+    targets: VariableOrList[ModelProviderServiceConfigModelTargetConfigParam]
+    """
+    Models and provider-native API types exposed by this provider service. Each
+    entry must include at least one `native_api_types` value. When
+    `allow_all_targets` is false, at least one entry is required and model
+    service destinations can reference only listed models. When
+    `allow_all_targets` is true, any upstream model is routable; entries in
+    this list provide API-type metadata without restricting other models.
+    """
+
+
+ModelProviderServiceConfigParam = (
+    ModelProviderServiceConfigDict | ModelProviderServiceConfig
+)
diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_amazon_bedrock_provider_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_amazon_bedrock_provider_config.py
new file mode 100644
index 00000000000..cf6015f13c5
--- /dev/null
+++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_amazon_bedrock_provider_config.py
@@ -0,0 +1,55 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.model_provider_services._models.model_provider_service_config_amazon_bedrock_provider_direct_config import (
+    ModelProviderServiceConfigAmazonBedrockProviderDirectConfig,
+    ModelProviderServiceConfigAmazonBedrockProviderDirectConfigParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ModelProviderServiceConfigAmazonBedrockProviderConfig:
+    """
+    Amazon Bedrock provider configuration.
+    """
+
+    direct: VariableOrOptional[
+        ModelProviderServiceConfigAmazonBedrockProviderDirectConfig
+    ] = None
+    """
+    Amazon Bedrock region and authentication configuration.
+    """
+
+    @classmethod
+    def from_dict(
+        cls, value: "ModelProviderServiceConfigAmazonBedrockProviderConfigDict"
+    ) -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ModelProviderServiceConfigAmazonBedrockProviderConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ModelProviderServiceConfigAmazonBedrockProviderConfigDict(TypedDict, total=False):
+    """"""
+
+    direct: VariableOrOptional[
+        ModelProviderServiceConfigAmazonBedrockProviderDirectConfigParam
+    ]
+    """
+    Amazon Bedrock region and authentication configuration.
+    """
+
+
+ModelProviderServiceConfigAmazonBedrockProviderConfigParam = (
+    ModelProviderServiceConfigAmazonBedrockProviderConfigDict
+    | ModelProviderServiceConfigAmazonBedrockProviderConfig
+)
diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_amazon_bedrock_provider_direct_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_amazon_bedrock_provider_direct_config.py
new file mode 100644
index 00000000000..911338ad79e
--- /dev/null
+++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_amazon_bedrock_provider_direct_config.py
@@ -0,0 +1,108 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.model_provider_services._models.model_provider_service_config_aws_access_key import (
+    ModelProviderServiceConfigAwsAccessKey,
+    ModelProviderServiceConfigAwsAccessKeyParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_service_credential import (
+    ModelProviderServiceConfigServiceCredential,
+    ModelProviderServiceConfigServiceCredentialParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ModelProviderServiceConfigAmazonBedrockProviderDirectConfig:
+    """
+    Direct form of Amazon Bedrock provider config.
+
+    Authentication is one of two mutually exclusive modes, exactly one of which
+    must be supplied on Create:
+    - Access keys: set `aws_access_key`, leave `service_credential` unset.
+    - Unity Catalog service credential: set `service_credential.name` to the
+    resource name `credentials/{name}`, leave `aws_access_key` unset. The
+    credential value lives in Unity Catalog and is referenced by name, not
+    held on this message.
+    Setting more than one mode is rejected.
+    """
+
+    aws_access_key: VariableOrOptional[ModelProviderServiceConfigAwsAccessKey] = None
+    """
+    AWS access-key-pair authentication. Set `access_key_id` and
+    `secret_access_key.plaintext`. Mutually exclusive with
+    `service_credential`.
+    """
+
+    region: VariableOrOptional[str] = None
+    """
+    AWS region where the Bedrock endpoint is hosted (e.g., `us-east-1`).
+    Required on Create.
+    """
+
+    service_credential: VariableOrOptional[
+        ModelProviderServiceConfigServiceCredential
+    ] = None
+    """
+    Reference to a Unity Catalog service credential authorizing Bedrock
+    requests. On Create, supply `service_credential.name` in the form
+    `credentials/{name}`. Required on Create when using service-credential
+    authentication; mutually exclusive with `aws_access_key`. The credential
+    is referenced by name; its value is not carried here. Only
+    supported on AWS-hosted workspaces.
+    """
+
+    @classmethod
+    def from_dict(
+        cls, value: "ModelProviderServiceConfigAmazonBedrockProviderDirectConfigDict"
+    ) -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(
+        self,
+    ) -> "ModelProviderServiceConfigAmazonBedrockProviderDirectConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ModelProviderServiceConfigAmazonBedrockProviderDirectConfigDict(
+    TypedDict, total=False
+):
+    """"""
+
+    aws_access_key: VariableOrOptional[ModelProviderServiceConfigAwsAccessKeyParam]
+    """
+    AWS access-key-pair authentication. Set `access_key_id` and
+    `secret_access_key.plaintext`. Mutually exclusive with
+    `service_credential`.
+    """
+
+    region: VariableOrOptional[str]
+    """
+    AWS region where the Bedrock endpoint is hosted (e.g., `us-east-1`).
+    Required on Create.
+    """
+
+    service_credential: VariableOrOptional[
+        ModelProviderServiceConfigServiceCredentialParam
+    ]
+    """
+    Reference to a Unity Catalog service credential authorizing Bedrock
+    requests. On Create, supply `service_credential.name` in the form
+    `credentials/{name}`. Required on Create when using service-credential
+    authentication; mutually exclusive with `aws_access_key`. The credential
+    is referenced by name; its value is not carried here. Only
+    supported on AWS-hosted workspaces.
+    """
+
+
+ModelProviderServiceConfigAmazonBedrockProviderDirectConfigParam = (
+    ModelProviderServiceConfigAmazonBedrockProviderDirectConfigDict
+    | ModelProviderServiceConfigAmazonBedrockProviderDirectConfig
+)
diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_config.py
new file mode 100644
index 00000000000..c7b3311ca93
--- /dev/null
+++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_config.py
@@ -0,0 +1,80 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.model_provider_services._models.model_provider_service_config_anthropic_provider_direct_config import (
+    ModelProviderServiceConfigAnthropicProviderDirectConfig,
+    ModelProviderServiceConfigAnthropicProviderDirectConfigParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_anthropic_provider_relayed_config import (
+    ModelProviderServiceConfigAnthropicProviderRelayedConfig,
+    ModelProviderServiceConfigAnthropicProviderRelayedConfigParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ModelProviderServiceConfigAnthropicProviderConfig:
+    """
+    Anthropic provider configuration. Exactly one of `direct` or `relayed` must
+    be set on Create; the two are mutually exclusive.
+    """
+
+    direct: VariableOrOptional[
+        ModelProviderServiceConfigAnthropicProviderDirectConfig
+    ] = None
+    """
+    Direct authentication with an API key supplied in
+    `direct.api_key.plaintext`. Required unless `relayed` is set.
+    """
+
+    relayed: VariableOrOptional[
+        ModelProviderServiceConfigAnthropicProviderRelayedConfig
+    ] = None
+    """
+    Relayed authentication. Each inference request supplies the caller's
+    OAuth token, which is forwarded to Anthropic. No Anthropic credential is
+    stored. Mutually exclusive with `direct`.
+    """
+
+    @classmethod
+    def from_dict(
+        cls, value: "ModelProviderServiceConfigAnthropicProviderConfigDict"
+    ) -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ModelProviderServiceConfigAnthropicProviderConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ModelProviderServiceConfigAnthropicProviderConfigDict(TypedDict, total=False):
+    """"""
+
+    direct: VariableOrOptional[
+        ModelProviderServiceConfigAnthropicProviderDirectConfigParam
+    ]
+    """
+    Direct authentication with an API key supplied in
+    `direct.api_key.plaintext`. Required unless `relayed` is set.
+    """
+
+    relayed: VariableOrOptional[
+        ModelProviderServiceConfigAnthropicProviderRelayedConfigParam
+    ]
+    """
+    Relayed authentication. Each inference request supplies the caller's
+    OAuth token, which is forwarded to Anthropic. No Anthropic credential is
+    stored. Mutually exclusive with `direct`.
+    """
+
+
+ModelProviderServiceConfigAnthropicProviderConfigParam = (
+    ModelProviderServiceConfigAnthropicProviderConfigDict
+    | ModelProviderServiceConfigAnthropicProviderConfig
+)
diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_direct_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_direct_config.py
new file mode 100644
index 00000000000..d03a79d596d
--- /dev/null
+++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_direct_config.py
@@ -0,0 +1,55 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.model_provider_services._models.model_provider_service_config_provider_secret import (
+    ModelProviderServiceConfigProviderSecret,
+    ModelProviderServiceConfigProviderSecretParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ModelProviderServiceConfigAnthropicProviderDirectConfig:
+    """
+    Direct form of Anthropic provider config.
+    """
+
+    api_key: VariableOrOptional[ModelProviderServiceConfigProviderSecret] = None
+    """
+    Anthropic API key. Required when creating the service. Supply the value
+    in `api_key.plaintext`.
+    """
+
+    @classmethod
+    def from_dict(
+        cls, value: "ModelProviderServiceConfigAnthropicProviderDirectConfigDict"
+    ) -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ModelProviderServiceConfigAnthropicProviderDirectConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ModelProviderServiceConfigAnthropicProviderDirectConfigDict(
+    TypedDict, total=False
+):
+    """"""
+
+    api_key: VariableOrOptional[ModelProviderServiceConfigProviderSecretParam]
+    """
+    Anthropic API key. Required when creating the service. Supply the value
+    in `api_key.plaintext`.
+    """
+
+
+ModelProviderServiceConfigAnthropicProviderDirectConfigParam = (
+    ModelProviderServiceConfigAnthropicProviderDirectConfigDict
+    | ModelProviderServiceConfigAnthropicProviderDirectConfig
+)
diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_relayed_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_relayed_config.py
new file mode 100644
index 00000000000..7754ff58862
--- /dev/null
+++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_anthropic_provider_relayed_config.py
@@ -0,0 +1,40 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ModelProviderServiceConfigAnthropicProviderRelayedConfig:
+    """
+    Relayed Anthropic provider configuration. Each inference request supplies
+    the caller's OAuth token, which is forwarded to Anthropic. No Anthropic
+    credential is stored.
+    """
+
+    @classmethod
+    def from_dict(
+        cls, value: "ModelProviderServiceConfigAnthropicProviderRelayedConfigDict"
+    ) -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ModelProviderServiceConfigAnthropicProviderRelayedConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ModelProviderServiceConfigAnthropicProviderRelayedConfigDict(
+    TypedDict, total=False
+):
+    """"""
+
+
+ModelProviderServiceConfigAnthropicProviderRelayedConfigParam = (
+    ModelProviderServiceConfigAnthropicProviderRelayedConfigDict
+    | ModelProviderServiceConfigAnthropicProviderRelayedConfig
+)
diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_aws_access_key.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_aws_access_key.py
new file mode 100644
index 00000000000..6c57b6912d8
--- /dev/null
+++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_aws_access_key.py
@@ -0,0 +1,68 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.model_provider_services._models.model_provider_service_config_provider_secret import (
+    ModelProviderServiceConfigProviderSecret,
+    ModelProviderServiceConfigProviderSecretParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ModelProviderServiceConfigAwsAccessKey:
+    """
+    AWS access-key-pair auth for Amazon Bedrock: a SigV4-signing key pair.
+    """
+
+    access_key_id: VariableOrOptional[str] = None
+    """
+    AWS access key ID. Required on Create when using access-key auth. Treated as
+    username-equivalent (not a secret value): round-trips on reads and is
+    scrubbed from audit logs.
+    """
+
+    secret_access_key: VariableOrOptional[ModelProviderServiceConfigProviderSecret] = (
+        None
+    )
+    """
+    AWS secret access key paired with `access_key_id`. Required when creating
+    a service with access-key authentication. Supply the value in
+    `secret_access_key.plaintext`.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "ModelProviderServiceConfigAwsAccessKeyDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ModelProviderServiceConfigAwsAccessKeyDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ModelProviderServiceConfigAwsAccessKeyDict(TypedDict, total=False):
+    """"""
+
+    access_key_id: VariableOrOptional[str]
+    """
+    AWS access key ID. Required on Create when using access-key auth. Treated as
+    username-equivalent (not a secret value): round-trips on reads and is
+    scrubbed from audit logs.
+    """
+
+    secret_access_key: VariableOrOptional[ModelProviderServiceConfigProviderSecretParam]
+    """
+    AWS secret access key paired with `access_key_id`. Required when creating
+    a service with access-key authentication. Supply the value in
+    `secret_access_key.plaintext`.
+    """
+
+
+ModelProviderServiceConfigAwsAccessKeyParam = (
+    ModelProviderServiceConfigAwsAccessKeyDict | ModelProviderServiceConfigAwsAccessKey
+)
diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_azure_open_ai_provider_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_azure_open_ai_provider_config.py
new file mode 100644
index 00000000000..60726eeffed
--- /dev/null
+++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_azure_open_ai_provider_config.py
@@ -0,0 +1,55 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.model_provider_services._models.model_provider_service_config_azure_open_ai_provider_direct_config import (
+    ModelProviderServiceConfigAzureOpenAiProviderDirectConfig,
+    ModelProviderServiceConfigAzureOpenAiProviderDirectConfigParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ModelProviderServiceConfigAzureOpenAiProviderConfig:
+    """
+    Azure OpenAI provider configuration.
+    """
+
+    direct: VariableOrOptional[
+        ModelProviderServiceConfigAzureOpenAiProviderDirectConfig
+    ] = None
+    """
+    Azure OpenAI endpoint and authentication configuration.
+    """
+
+    @classmethod
+    def from_dict(
+        cls, value: "ModelProviderServiceConfigAzureOpenAiProviderConfigDict"
+    ) -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ModelProviderServiceConfigAzureOpenAiProviderConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ModelProviderServiceConfigAzureOpenAiProviderConfigDict(TypedDict, total=False):
+    """"""
+
+    direct: VariableOrOptional[
+        ModelProviderServiceConfigAzureOpenAiProviderDirectConfigParam
+    ]
+    """
+    Azure OpenAI endpoint and authentication configuration.
+    """
+
+
+ModelProviderServiceConfigAzureOpenAiProviderConfigParam = (
+    ModelProviderServiceConfigAzureOpenAiProviderConfigDict
+    | ModelProviderServiceConfigAzureOpenAiProviderConfig
+)
diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_azure_open_ai_provider_direct_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_azure_open_ai_provider_direct_config.py
new file mode 100644
index 00000000000..9ba84e99974
--- /dev/null
+++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_azure_open_ai_provider_direct_config.py
@@ -0,0 +1,132 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.model_provider_services._models.model_provider_service_config_entra_service_principal import (
+    ModelProviderServiceConfigEntraServicePrincipal,
+    ModelProviderServiceConfigEntraServicePrincipalParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_provider_secret import (
+    ModelProviderServiceConfigProviderSecret,
+    ModelProviderServiceConfigProviderSecretParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_service_credential import (
+    ModelProviderServiceConfigServiceCredential,
+    ModelProviderServiceConfigServiceCredentialParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ModelProviderServiceConfigAzureOpenAiProviderDirectConfig:
+    """
+    Direct form of Azure OpenAI provider config. Exactly one of three
+    mutually-exclusive auth modes must be supplied on Create:
+    - API key: set `api_key`, leave `entra_service_principal` and
+    `service_credential` unset.
+    - Entra ID (service principal): set `entra_service_principal`, leave
+    `api_key` and `service_credential` unset.
+    - Unity Catalog service credential: set `service_credential.name` to the
+    resource name `credentials/{name}`, leave `api_key` and
+    `entra_service_principal` unset. The credential value lives in Unity
+    Catalog and is referenced by name, not held on this message. Only
+    supported on Azure-hosted workspaces.
+    Setting more than one mode is rejected.
+    """
+
+    api_key: VariableOrOptional[ModelProviderServiceConfigProviderSecret] = None
+    """
+    Azure OpenAI API key. Supply the value in `api_key.plaintext`. Mutually
+    exclusive with Entra ID and Unity Catalog service credential
+    authentication.
+    """
+
+    base_url: VariableOrOptional[str] = None
+    """
+    Full Azure OpenAI endpoint base URL, e.g.
+    `https://myresource.openai.azure.com`. Required on Create.
+    """
+
+    entra_service_principal: VariableOrOptional[
+        ModelProviderServiceConfigEntraServicePrincipal
+    ] = None
+    """
+    Entra ID service-principal authentication. Set `tenant_id`, `client_id`,
+    and `client_secret.plaintext`. Mutually exclusive with `api_key` and
+    `service_credential`.
+    """
+
+    service_credential: VariableOrOptional[
+        ModelProviderServiceConfigServiceCredential
+    ] = None
+    """
+    Reference to a Unity Catalog service credential authorizing Azure OpenAI
+    requests. On Create, supply `service_credential.name` in the form
+    `credentials/{name}`. Required on Create when using service-credential
+    authentication; mutually exclusive with `api_key` and
+    `entra_service_principal`. The credential is referenced by name; its value
+    is not carried here. Only supported on Azure-hosted workspaces.
+    """
+
+    @classmethod
+    def from_dict(
+        cls, value: "ModelProviderServiceConfigAzureOpenAiProviderDirectConfigDict"
+    ) -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(
+        self,
+    ) -> "ModelProviderServiceConfigAzureOpenAiProviderDirectConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ModelProviderServiceConfigAzureOpenAiProviderDirectConfigDict(
+    TypedDict, total=False
+):
+    """"""
+
+    api_key: VariableOrOptional[ModelProviderServiceConfigProviderSecretParam]
+    """
+    Azure OpenAI API key. Supply the value in `api_key.plaintext`. Mutually
+    exclusive with Entra ID and Unity Catalog service credential
+    authentication.
+    """
+
+    base_url: VariableOrOptional[str]
+    """
+    Full Azure OpenAI endpoint base URL, e.g.
+    `https://myresource.openai.azure.com`. Required on Create.
+    """
+
+    entra_service_principal: VariableOrOptional[
+        ModelProviderServiceConfigEntraServicePrincipalParam
+    ]
+    """
+    Entra ID service-principal authentication. Set `tenant_id`, `client_id`,
+    and `client_secret.plaintext`. Mutually exclusive with `api_key` and
+    `service_credential`.
+    """
+
+    service_credential: VariableOrOptional[
+        ModelProviderServiceConfigServiceCredentialParam
+    ]
+    """
+    Reference to a Unity Catalog service credential authorizing Azure OpenAI
+    requests. On Create, supply `service_credential.name` in the form
+    `credentials/{name}`. Required on Create when using service-credential
+    authentication; mutually exclusive with `api_key` and
+    `entra_service_principal`. The credential is referenced by name; its value
+    is not carried here. Only supported on Azure-hosted workspaces.
+    """
+
+
+ModelProviderServiceConfigAzureOpenAiProviderDirectConfigParam = (
+    ModelProviderServiceConfigAzureOpenAiProviderDirectConfigDict
+    | ModelProviderServiceConfigAzureOpenAiProviderDirectConfig
+)
diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_custom_provider_api_key_header_auth.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_custom_provider_api_key_header_auth.py
new file mode 100644
index 00000000000..78865d1c8f2
--- /dev/null
+++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_custom_provider_api_key_header_auth.py
@@ -0,0 +1,71 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.model_provider_services._models.model_provider_service_config_provider_secret import (
+    ModelProviderServiceConfigProviderSecret,
+    ModelProviderServiceConfigProviderSecretParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ModelProviderServiceConfigCustomProviderApiKeyHeaderAuth:
+    """
+    Header-based API-key authentication for a custom provider: the secret is
+    forwarded on outbound requests under a caller-chosen HTTP header, as
+    `<api_key_name>: <api_key_value>`.
+    """
+
+    api_key_name: VariableOrOptional[str] = None
+    """
+    HTTP header name that carries the API key on outbound requests (e.g.,
+    `Ocp-Apim-Subscription-Key`). The value forwarded under this header is
+    supplied via `api_key_value`.
+    """
+
+    api_key_value: VariableOrOptional[ModelProviderServiceConfigProviderSecret] = None
+    """
+    Secret value forwarded under the `api_key_name` header on outbound
+    requests. Supplied as inline plaintext via `ProviderSecret.plaintext`.
+    """
+
+    @classmethod
+    def from_dict(
+        cls, value: "ModelProviderServiceConfigCustomProviderApiKeyHeaderAuthDict"
+    ) -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ModelProviderServiceConfigCustomProviderApiKeyHeaderAuthDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ModelProviderServiceConfigCustomProviderApiKeyHeaderAuthDict(
+    TypedDict, total=False
+):
+    """"""
+
+    api_key_name: VariableOrOptional[str]
+    """
+    HTTP header name that carries the API key on outbound requests (e.g.,
+    `Ocp-Apim-Subscription-Key`). The value forwarded under this header is
+    supplied via `api_key_value`.
+    """
+
+    api_key_value: VariableOrOptional[ModelProviderServiceConfigProviderSecretParam]
+    """
+    Secret value forwarded under the `api_key_name` header on outbound
+    requests. Supplied as inline plaintext via `ProviderSecret.plaintext`.
+    """
+
+
+ModelProviderServiceConfigCustomProviderApiKeyHeaderAuthParam = (
+    ModelProviderServiceConfigCustomProviderApiKeyHeaderAuthDict
+    | ModelProviderServiceConfigCustomProviderApiKeyHeaderAuth
+)
diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_custom_provider_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_custom_provider_config.py
new file mode 100644
index 00000000000..e10c0335481
--- /dev/null
+++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_custom_provider_config.py
@@ -0,0 +1,56 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.model_provider_services._models.model_provider_service_config_custom_provider_direct_config import (
+    ModelProviderServiceConfigCustomProviderDirectConfig,
+    ModelProviderServiceConfigCustomProviderDirectConfigParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ModelProviderServiceConfigCustomProviderConfig:
+    """
+    Custom OpenAI-compatible provider configuration with bearer-token
+    authentication.
+    """
+
+    direct: VariableOrOptional[ModelProviderServiceConfigCustomProviderDirectConfig] = (
+        None
+    )
+    """
+    Endpoint and authentication configuration for the custom provider.
+    """
+
+    @classmethod
+    def from_dict(
+        cls, value: "ModelProviderServiceConfigCustomProviderConfigDict"
+    ) -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ModelProviderServiceConfigCustomProviderConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ModelProviderServiceConfigCustomProviderConfigDict(TypedDict, total=False):
+    """"""
+
+    direct: VariableOrOptional[
+        ModelProviderServiceConfigCustomProviderDirectConfigParam
+    ]
+    """
+    Endpoint and authentication configuration for the custom provider.
+    """
+
+
+ModelProviderServiceConfigCustomProviderConfigParam = (
+    ModelProviderServiceConfigCustomProviderConfigDict
+    | ModelProviderServiceConfigCustomProviderConfig
+)
diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_custom_provider_direct_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_custom_provider_direct_config.py
new file mode 100644
index 00000000000..42e4d350a24
--- /dev/null
+++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_custom_provider_direct_config.py
@@ -0,0 +1,89 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.model_provider_services._models.model_provider_service_config_custom_provider_api_key_header_auth import (
+    ModelProviderServiceConfigCustomProviderApiKeyHeaderAuth,
+    ModelProviderServiceConfigCustomProviderApiKeyHeaderAuthParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_provider_secret import (
+    ModelProviderServiceConfigProviderSecret,
+    ModelProviderServiceConfigProviderSecretParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ModelProviderServiceConfigCustomProviderDirectConfig:
+    """
+    Direct form of a custom provider configuration. Set `api_key` to send the
+    secret as an `Authorization` bearer token, or `header_auth` to forward it
+    under a caller-chosen HTTP header.
+    """
+
+    api_key: VariableOrOptional[ModelProviderServiceConfigProviderSecret] = None
+    """
+    Bearer token forwarded in the `Authorization` header. Supply the value
+    in `api_key.plaintext`.
+    """
+
+    base_url: VariableOrOptional[str] = None
+    """
+    Endpoint URL of the OpenAI-compatible service (e.g.,
+    `https://api.example.com/v1`). Required on Create.
+    """
+
+    header_auth: VariableOrOptional[
+        ModelProviderServiceConfigCustomProviderApiKeyHeaderAuth
+    ] = None
+    """
+    Header-based API-key auth: the secret is forwarded on outbound requests
+    under a caller-chosen HTTP header rather than as an `Authorization`
+    bearer token. Set this instead of `api_key` for header auth.
+    """
+
+    @classmethod
+    def from_dict(
+        cls, value: "ModelProviderServiceConfigCustomProviderDirectConfigDict"
+    ) -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ModelProviderServiceConfigCustomProviderDirectConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ModelProviderServiceConfigCustomProviderDirectConfigDict(TypedDict, total=False):
+    """"""
+
+    api_key: VariableOrOptional[ModelProviderServiceConfigProviderSecretParam]
+    """
+    Bearer token forwarded in the `Authorization` header. Supply the value
+    in `api_key.plaintext`.
+    """
+
+    base_url: VariableOrOptional[str]
+    """
+    Endpoint URL of the OpenAI-compatible service (e.g.,
+    `https://api.example.com/v1`). Required on Create.
+    """
+
+    header_auth: VariableOrOptional[
+        ModelProviderServiceConfigCustomProviderApiKeyHeaderAuthParam
+    ]
+    """
+    Header-based API-key auth: the secret is forwarded on outbound requests
+    under a caller-chosen HTTP header rather than as an `Authorization`
+    bearer token. Set this instead of `api_key` for header auth.
+    """
+
+
+ModelProviderServiceConfigCustomProviderDirectConfigParam = (
+    ModelProviderServiceConfigCustomProviderDirectConfigDict
+    | ModelProviderServiceConfigCustomProviderDirectConfig
+)
diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_entra_service_principal.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_entra_service_principal.py
new file mode 100644
index 00000000000..cf5fcefd569
--- /dev/null
+++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_entra_service_principal.py
@@ -0,0 +1,74 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.model_provider_services._models.model_provider_service_config_provider_secret import (
+    ModelProviderServiceConfigProviderSecret,
+    ModelProviderServiceConfigProviderSecretParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ModelProviderServiceConfigEntraServicePrincipal:
+    """
+    Entra ID (Azure AD) service-principal authentication. The `tenant_id` and
+    `client_id` identify the service principal, and `client_secret` authenticates
+    it. AI Gateway exchanges these credentials for an Entra bearer token for
+    requests to Azure OpenAI or Microsoft Foundry.
+    """
+
+    client_id: VariableOrOptional[str] = None
+    """
+    Entra ID client (application) ID. Required on Create.
+    """
+
+    client_secret: VariableOrOptional[ModelProviderServiceConfigProviderSecret] = None
+    """
+    Entra ID client secret. Supply the value in `client_secret.plaintext`.
+    """
+
+    tenant_id: VariableOrOptional[str] = None
+    """
+    Entra ID (Azure AD) tenant ID. Required on Create.
+    """
+
+    @classmethod
+    def from_dict(
+        cls, value: "ModelProviderServiceConfigEntraServicePrincipalDict"
+    ) -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ModelProviderServiceConfigEntraServicePrincipalDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ModelProviderServiceConfigEntraServicePrincipalDict(TypedDict, total=False):
+    """"""
+
+    client_id: VariableOrOptional[str]
+    """
+    Entra ID client (application) ID. Required on Create.
+    """
+
+    client_secret: VariableOrOptional[ModelProviderServiceConfigProviderSecretParam]
+    """
+    Entra ID client secret. Supply the value in `client_secret.plaintext`.
+    """
+
+    tenant_id: VariableOrOptional[str]
+    """
+    Entra ID (Azure AD) tenant ID. Required on Create.
+    """
+
+
+ModelProviderServiceConfigEntraServicePrincipalParam = (
+    ModelProviderServiceConfigEntraServicePrincipalDict
+    | ModelProviderServiceConfigEntraServicePrincipal
+)
diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_external_model_provider_type.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_external_model_provider_type.py
new file mode 100644
index 00000000000..f3a79bd6cdf
--- /dev/null
+++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_external_model_provider_type.py
@@ -0,0 +1,44 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class ModelProviderServiceConfigExternalModelProviderType(Enum):
+    """
+    External LLM provider for an EXTERNAL_FOUNDATION_MODEL destination.
+    """
+
+    EXTERNAL_MODEL_PROVIDER_TYPE_OPENAI = "EXTERNAL_MODEL_PROVIDER_TYPE_OPENAI"
+    EXTERNAL_MODEL_PROVIDER_TYPE_AZURE_OPENAI = (
+        "EXTERNAL_MODEL_PROVIDER_TYPE_AZURE_OPENAI"
+    )
+    EXTERNAL_MODEL_PROVIDER_TYPE_ANTHROPIC = "EXTERNAL_MODEL_PROVIDER_TYPE_ANTHROPIC"
+    EXTERNAL_MODEL_PROVIDER_TYPE_AMAZON_BEDROCK = (
+        "EXTERNAL_MODEL_PROVIDER_TYPE_AMAZON_BEDROCK"
+    )
+    EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM = "EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM"
+    EXTERNAL_MODEL_PROVIDER_TYPE_MICROSOFT_FOUNDRY = (
+        "EXTERNAL_MODEL_PROVIDER_TYPE_MICROSOFT_FOUNDRY"
+    )
+    EXTERNAL_MODEL_PROVIDER_TYPE_GEMINI_ENTERPRISE = (
+        "EXTERNAL_MODEL_PROVIDER_TYPE_GEMINI_ENTERPRISE"
+    )
+    EXTERNAL_MODEL_PROVIDER_TYPE_BEDROCK_MANTLE = (
+        "EXTERNAL_MODEL_PROVIDER_TYPE_BEDROCK_MANTLE"
+    )
+
+
+ModelProviderServiceConfigExternalModelProviderTypeParam = (
+    Literal[
+        "EXTERNAL_MODEL_PROVIDER_TYPE_OPENAI",
+        "EXTERNAL_MODEL_PROVIDER_TYPE_AZURE_OPENAI",
+        "EXTERNAL_MODEL_PROVIDER_TYPE_ANTHROPIC",
+        "EXTERNAL_MODEL_PROVIDER_TYPE_AMAZON_BEDROCK",
+        "EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM",
+        "EXTERNAL_MODEL_PROVIDER_TYPE_MICROSOFT_FOUNDRY",
+        "EXTERNAL_MODEL_PROVIDER_TYPE_GEMINI_ENTERPRISE",
+        "EXTERNAL_MODEL_PROVIDER_TYPE_BEDROCK_MANTLE",
+    ]
+    | ModelProviderServiceConfigExternalModelProviderType
+)
diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_gemini_enterprise_provider_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_gemini_enterprise_provider_config.py
new file mode 100644
index 00000000000..38f005ad002
--- /dev/null
+++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_gemini_enterprise_provider_config.py
@@ -0,0 +1,57 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.model_provider_services._models.model_provider_service_config_gemini_enterprise_provider_direct_config import (
+    ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfig,
+    ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfigParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ModelProviderServiceConfigGeminiEnterpriseProviderConfig:
+    """
+    Gemini Enterprise provider configuration.
+    """
+
+    direct: VariableOrOptional[
+        ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfig
+    ] = None
+    """
+    Gemini Enterprise project, region, and authentication configuration.
+    """
+
+    @classmethod
+    def from_dict(
+        cls, value: "ModelProviderServiceConfigGeminiEnterpriseProviderConfigDict"
+    ) -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ModelProviderServiceConfigGeminiEnterpriseProviderConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ModelProviderServiceConfigGeminiEnterpriseProviderConfigDict(
+    TypedDict, total=False
+):
+    """"""
+
+    direct: VariableOrOptional[
+        ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfigParam
+    ]
+    """
+    Gemini Enterprise project, region, and authentication configuration.
+    """
+
+
+ModelProviderServiceConfigGeminiEnterpriseProviderConfigParam = (
+    ModelProviderServiceConfigGeminiEnterpriseProviderConfigDict
+    | ModelProviderServiceConfigGeminiEnterpriseProviderConfig
+)
diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_gemini_enterprise_provider_direct_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_gemini_enterprise_provider_direct_config.py
new file mode 100644
index 00000000000..157ef00adfd
--- /dev/null
+++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_gemini_enterprise_provider_direct_config.py
@@ -0,0 +1,110 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.model_provider_services._models.model_provider_service_config_provider_secret import (
+    ModelProviderServiceConfigProviderSecret,
+    ModelProviderServiceConfigProviderSecretParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_service_credential import (
+    ModelProviderServiceConfigServiceCredential,
+    ModelProviderServiceConfigServiceCredentialParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfig:
+    """
+    Direct Gemini Enterprise provider configuration. An API key is required
+    when creating the service.
+    """
+
+    api_key: VariableOrOptional[ModelProviderServiceConfigProviderSecret] = None
+    """
+    Google Gemini Enterprise API key. Required when creating the service.
+    Supply the value in `api_key.plaintext`.
+    """
+
+    project_id: VariableOrOptional[str] = None
+    """
+    GCP project ID hosting the Gemini Enterprise endpoint. Required on Create.
+    """
+
+    region: VariableOrOptional[str] = None
+    """
+    GCP region of the Gemini Enterprise endpoint (e.g., `us-central1`).
+    Required on Create.
+    """
+
+    service_credential: VariableOrOptional[
+        ModelProviderServiceConfigServiceCredential
+    ] = None
+    """
+    Reference to a Unity Catalog service credential authorizing Gemini
+    Enterprise requests. On Create, supply `service_credential.name` as
+    `credentials/{name}`; required when using service-credential
+    authentication and mutually exclusive with `api_key`. The credential is
+    referenced by name; its value is not carried here. On read, the resolved
+    `id` and `is_deleted` are also populated. Supported only on GCP-hosted
+    workspaces.
+    """
+
+    @classmethod
+    def from_dict(
+        cls, value: "ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfigDict"
+    ) -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(
+        self,
+    ) -> "ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfigDict(
+    TypedDict, total=False
+):
+    """"""
+
+    api_key: VariableOrOptional[ModelProviderServiceConfigProviderSecretParam]
+    """
+    Google Gemini Enterprise API key. Required when creating the service.
+    Supply the value in `api_key.plaintext`.
+    """
+
+    project_id: VariableOrOptional[str]
+    """
+    GCP project ID hosting the Gemini Enterprise endpoint. Required on Create.
+    """
+
+    region: VariableOrOptional[str]
+    """
+    GCP region of the Gemini Enterprise endpoint (e.g., `us-central1`).
+    Required on Create.
+    """
+
+    service_credential: VariableOrOptional[
+        ModelProviderServiceConfigServiceCredentialParam
+    ]
+    """
+    Reference to a Unity Catalog service credential authorizing Gemini
+    Enterprise requests. On Create, supply `service_credential.name` as
+    `credentials/{name}`; required when using service-credential
+    authentication and mutually exclusive with `api_key`. The credential is
+    referenced by name; its value is not carried here. On read, the resolved
+    `id` and `is_deleted` are also populated. Supported only on GCP-hosted
+    workspaces.
+    """
+
+
+ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfigParam = (
+    ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfigDict
+    | ModelProviderServiceConfigGeminiEnterpriseProviderDirectConfig
+)
diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_microsoft_foundry_provider_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_microsoft_foundry_provider_config.py
new file mode 100644
index 00000000000..c63fe203888
--- /dev/null
+++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_microsoft_foundry_provider_config.py
@@ -0,0 +1,57 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.model_provider_services._models.model_provider_service_config_microsoft_foundry_provider_direct_config import (
+    ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfig,
+    ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfigParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ModelProviderServiceConfigMicrosoftFoundryProviderConfig:
+    """
+    Microsoft Foundry provider configuration.
+    """
+
+    direct: VariableOrOptional[
+        ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfig
+    ] = None
+    """
+    Microsoft Foundry endpoint and authentication configuration.
+    """
+
+    @classmethod
+    def from_dict(
+        cls, value: "ModelProviderServiceConfigMicrosoftFoundryProviderConfigDict"
+    ) -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ModelProviderServiceConfigMicrosoftFoundryProviderConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ModelProviderServiceConfigMicrosoftFoundryProviderConfigDict(
+    TypedDict, total=False
+):
+    """"""
+
+    direct: VariableOrOptional[
+        ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfigParam
+    ]
+    """
+    Microsoft Foundry endpoint and authentication configuration.
+    """
+
+
+ModelProviderServiceConfigMicrosoftFoundryProviderConfigParam = (
+    ModelProviderServiceConfigMicrosoftFoundryProviderConfigDict
+    | ModelProviderServiceConfigMicrosoftFoundryProviderConfig
+)
diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_microsoft_foundry_provider_direct_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_microsoft_foundry_provider_direct_config.py
new file mode 100644
index 00000000000..5caad765601
--- /dev/null
+++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_microsoft_foundry_provider_direct_config.py
@@ -0,0 +1,134 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.model_provider_services._models.model_provider_service_config_entra_service_principal import (
+    ModelProviderServiceConfigEntraServicePrincipal,
+    ModelProviderServiceConfigEntraServicePrincipalParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_provider_secret import (
+    ModelProviderServiceConfigProviderSecret,
+    ModelProviderServiceConfigProviderSecretParam,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config_service_credential import (
+    ModelProviderServiceConfigServiceCredential,
+    ModelProviderServiceConfigServiceCredentialParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfig:
+    """
+    Direct form of Microsoft Foundry provider config.
+
+    Authentication is one of three mutually exclusive modes, exactly one of which
+    must be supplied on Create:
+    - API key: set `api_key`, leave `entra_service_principal` and
+    `service_credential` unset.
+    - Entra ID (service principal): set `entra_service_principal`, leave
+    `api_key` and `service_credential` unset. AI Gateway exchanges these for
+    an Entra bearer token on outbound requests via the OAuth2
+    client-credentials grant.
+    - Unity Catalog service credential: set `service_credential.name` to the
+    resource name `credentials/{name}`, leave `api_key` and
+    `entra_service_principal` unset. The credential value lives in Unity
+    Catalog and is referenced by name, not held on this message. Only
+    supported on Azure-hosted workspaces.
+    Setting more than one mode is rejected.
+    """
+
+    api_key: VariableOrOptional[ModelProviderServiceConfigProviderSecret] = None
+    """
+    Microsoft Foundry API key. Supply the value in `api_key.plaintext`.
+    Mutually exclusive with Entra ID and Unity Catalog service credential
+    authentication.
+    """
+
+    base_url: VariableOrOptional[str] = None
+    """
+    Microsoft Foundry endpoint URL. Required on Create.
+    """
+
+    entra_service_principal: VariableOrOptional[
+        ModelProviderServiceConfigEntraServicePrincipal
+    ] = None
+    """
+    Entra ID service-principal authentication. Set `tenant_id`, `client_id`,
+    and `client_secret.plaintext`. Mutually exclusive with `api_key` and
+    `service_credential`.
+    """
+
+    service_credential: VariableOrOptional[
+        ModelProviderServiceConfigServiceCredential
+    ] = None
+    """
+    Reference to a Unity Catalog service credential authorizing Microsoft
+    Foundry requests. On Create, supply `service_credential.name` in the form
+    `credentials/{name}`. Required on Create when using service-credential
+    authentication; mutually exclusive with `api_key` and
+    `entra_service_principal`. The credential is referenced by name; its value
+    is not carried here. Only supported on Azure-hosted workspaces.
+    """
+
+    @classmethod
+    def from_dict(
+        cls, value: "ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfigDict"
+    ) -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(
+        self,
+    ) -> "ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfigDict(
+    TypedDict, total=False
+):
+    """"""
+
+    api_key: VariableOrOptional[ModelProviderServiceConfigProviderSecretParam]
+    """
+    Microsoft Foundry API key. Supply the value in `api_key.plaintext`.
+    Mutually exclusive with Entra ID and Unity Catalog service credential
+    authentication.
+    """
+
+    base_url: VariableOrOptional[str]
+    """
+    Microsoft Foundry endpoint URL. Required on Create.
+    """
+
+    entra_service_principal: VariableOrOptional[
+        ModelProviderServiceConfigEntraServicePrincipalParam
+    ]
+    """
+    Entra ID service-principal authentication. Set `tenant_id`, `client_id`,
+    and `client_secret.plaintext`. Mutually exclusive with `api_key` and
+    `service_credential`.
+    """
+
+    service_credential: VariableOrOptional[
+        ModelProviderServiceConfigServiceCredentialParam
+    ]
+    """
+    Reference to a Unity Catalog service credential authorizing Microsoft
+    Foundry requests. On Create, supply `service_credential.name` in the form
+    `credentials/{name}`. Required on Create when using service-credential
+    authentication; mutually exclusive with `api_key` and
+    `entra_service_principal`. The credential is referenced by name; its value
+    is not carried here. Only supported on Azure-hosted workspaces.
+    """
+
+
+ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfigParam = (
+    ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfigDict
+    | ModelProviderServiceConfigMicrosoftFoundryProviderDirectConfig
+)
diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_model_target_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_model_target_config.py
new file mode 100644
index 00000000000..671c9eb4490
--- /dev/null
+++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_model_target_config.py
@@ -0,0 +1,94 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import (
+    VariableOr,
+    VariableOrList,
+    VariableOrOptional,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ModelProviderServiceConfigModelTargetConfig:
+    """
+    Model target configuration shared by model provider service targets and
+    external model destinations on model services.
+    """
+
+    model: VariableOr[str]
+    """
+    Provider-side model identifier, such as `gpt-5` or `claude-opus-4-7`.
+    This identifies a model at the upstream provider; it is not a Unity
+    Catalog model resource.
+    """
+
+    endpoint_route: VariableOrOptional[str] = None
+    """
+    Relative path appended to a custom provider's `base_url` for this model,
+    such as `serve/openai/chat`. Nonempty values are only supported for
+    custom model provider service targets; other provider types reject them.
+    Model service destinations do not support this field. Do not include
+    URI templates, queries, or fragments. When empty, `base_url` is used unchanged.
+    """
+
+    native_api_types: VariableOrList[str] = field(default_factory=list)
+    """
+    Provider-native API types supported by this model, such as
+    `openai/v1/chat/completions`. A model provider service target requires at
+    least one value. A model service destination may omit the list to use the
+    matching provider service target's types when available. AI Gateway uses
+    the selected types for translation. At most 64 entries of 256 characters
+    each are allowed.
+    """
+
+    @classmethod
+    def from_dict(
+        cls, value: "ModelProviderServiceConfigModelTargetConfigDict"
+    ) -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ModelProviderServiceConfigModelTargetConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ModelProviderServiceConfigModelTargetConfigDict(TypedDict, total=False):
+    """"""
+
+    model: VariableOr[str]
+    """
+    Provider-side model identifier, such as `gpt-5` or `claude-opus-4-7`.
+    This identifies a model at the upstream provider; it is not a Unity
+    Catalog model resource.
+    """
+
+    endpoint_route: VariableOrOptional[str]
+    """
+    Relative path appended to a custom provider's `base_url` for this model,
+    such as `serve/openai/chat`. Nonempty values are only supported for
+    custom model provider service targets; other provider types reject them.
+    Model service destinations do not support this field. Do not include
+    URI templates, queries, or fragments. When empty, `base_url` is used unchanged.
+    """
+
+    native_api_types: VariableOrList[str]
+    """
+    Provider-native API types supported by this model, such as
+    `openai/v1/chat/completions`. A model provider service target requires at
+    least one value. A model service destination may omit the list to use the
+    matching provider service target's types when available. AI Gateway uses
+    the selected types for translation. At most 64 entries of 256 characters
+    each are allowed.
+    """
+
+
+ModelProviderServiceConfigModelTargetConfigParam = (
+    ModelProviderServiceConfigModelTargetConfigDict
+    | ModelProviderServiceConfigModelTargetConfig
+)
diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_open_ai_provider_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_open_ai_provider_config.py
new file mode 100644
index 00000000000..70200550381
--- /dev/null
+++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_open_ai_provider_config.py
@@ -0,0 +1,55 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.model_provider_services._models.model_provider_service_config_open_ai_provider_direct_config import (
+    ModelProviderServiceConfigOpenAiProviderDirectConfig,
+    ModelProviderServiceConfigOpenAiProviderDirectConfigParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ModelProviderServiceConfigOpenAiProviderConfig:
+    """
+    OpenAI provider configuration.
+    """
+
+    direct: VariableOrOptional[ModelProviderServiceConfigOpenAiProviderDirectConfig] = (
+        None
+    )
+    """
+    OpenAI configuration with an API key supplied in the request.
+    """
+
+    @classmethod
+    def from_dict(
+        cls, value: "ModelProviderServiceConfigOpenAiProviderConfigDict"
+    ) -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ModelProviderServiceConfigOpenAiProviderConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ModelProviderServiceConfigOpenAiProviderConfigDict(TypedDict, total=False):
+    """"""
+
+    direct: VariableOrOptional[
+        ModelProviderServiceConfigOpenAiProviderDirectConfigParam
+    ]
+    """
+    OpenAI configuration with an API key supplied in the request.
+    """
+
+
+ModelProviderServiceConfigOpenAiProviderConfigParam = (
+    ModelProviderServiceConfigOpenAiProviderConfigDict
+    | ModelProviderServiceConfigOpenAiProviderConfig
+)
diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_open_ai_provider_direct_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_open_ai_provider_direct_config.py
new file mode 100644
index 00000000000..128ce50e14e
--- /dev/null
+++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_open_ai_provider_direct_config.py
@@ -0,0 +1,77 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.model_provider_services._models.model_provider_service_config_provider_secret import (
+    ModelProviderServiceConfigProviderSecret,
+    ModelProviderServiceConfigProviderSecretParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ModelProviderServiceConfigOpenAiProviderDirectConfig:
+    """
+    Direct (inline-credentials) form of the OpenAI provider config.
+    """
+
+    api_key: VariableOrOptional[ModelProviderServiceConfigProviderSecret] = None
+    """
+    OpenAI API key. Required when creating the service. Supply the value in
+    `api_key.plaintext`.
+    """
+
+    base_url: VariableOrOptional[str] = None
+    """
+    Optional custom base URL. Defaults to `https://api.openai.com/v1`. Use for
+    OpenAI-API-compatible third-party endpoints or in-network proxies.
+    """
+
+    organization: VariableOrOptional[str] = None
+    """
+    Optional OpenAI organization ID. When set, the platform forwards it as
+    the `OpenAI-Organization` header.
+    """
+
+    @classmethod
+    def from_dict(
+        cls, value: "ModelProviderServiceConfigOpenAiProviderDirectConfigDict"
+    ) -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ModelProviderServiceConfigOpenAiProviderDirectConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ModelProviderServiceConfigOpenAiProviderDirectConfigDict(TypedDict, total=False):
+    """"""
+
+    api_key: VariableOrOptional[ModelProviderServiceConfigProviderSecretParam]
+    """
+    OpenAI API key. Required when creating the service. Supply the value in
+    `api_key.plaintext`.
+    """
+
+    base_url: VariableOrOptional[str]
+    """
+    Optional custom base URL. Defaults to `https://api.openai.com/v1`. Use for
+    OpenAI-API-compatible third-party endpoints or in-network proxies.
+    """
+
+    organization: VariableOrOptional[str]
+    """
+    Optional OpenAI organization ID. When set, the platform forwards it as
+    the `OpenAI-Organization` header.
+    """
+
+
+ModelProviderServiceConfigOpenAiProviderDirectConfigParam = (
+    ModelProviderServiceConfigOpenAiProviderDirectConfigDict
+    | ModelProviderServiceConfigOpenAiProviderDirectConfig
+)
diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_provider_pricing_config.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_provider_pricing_config.py
new file mode 100644
index 00000000000..88e0d02484c
--- /dev/null
+++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_provider_pricing_config.py
@@ -0,0 +1,54 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ModelProviderServiceConfigProviderPricingConfig:
+    """
+    Pricing adjustments applied to this provider service's external-model spend
+    estimates.
+    """
+
+    default_discount_basis_points: VariableOrOptional[int] = None
+    """
+    Provider-wide adjustment to external-model spend estimates in basis points:
+    2000 = 20% off; -2000 = a 20% markup. Negative values have no lower bound
+    beyond the int32 range. Values cannot exceed 10000 (100% off). An omitted
+    value or zero leaves the estimate unchanged.
+    """
+
+    @classmethod
+    def from_dict(
+        cls, value: "ModelProviderServiceConfigProviderPricingConfigDict"
+    ) -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ModelProviderServiceConfigProviderPricingConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ModelProviderServiceConfigProviderPricingConfigDict(TypedDict, total=False):
+    """"""
+
+    default_discount_basis_points: VariableOrOptional[int]
+    """
+    Provider-wide adjustment to external-model spend estimates in basis points:
+    2000 = 20% off; -2000 = a 20% markup. Negative values have no lower bound
+    beyond the int32 range. Values cannot exceed 10000 (100% off). An omitted
+    value or zero leaves the estimate unchanged.
+    """
+
+
+ModelProviderServiceConfigProviderPricingConfigParam = (
+    ModelProviderServiceConfigProviderPricingConfigDict
+    | ModelProviderServiceConfigProviderPricingConfig
+)
diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_provider_secret.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_provider_secret.py
new file mode 100644
index 00000000000..fd6cef72cf8
--- /dev/null
+++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_provider_secret.py
@@ -0,0 +1,78 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.model_provider_services._models.model_provider_service_config_secret_reference import (
+    ModelProviderServiceConfigSecretReference,
+    ModelProviderServiceConfigSecretReferenceParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ModelProviderServiceConfigProviderSecret:
+    """
+    A secret value supplied as part of an inline provider config. The caller
+    supplies the value as inline `plaintext` on writes; the platform stores it
+    encrypted. The `plaintext` field is `INPUT_ONLY` and never round-trips on
+    reads.
+    """
+
+    plaintext: VariableOrOptional[str] = None
+    """
+    Inline plaintext credential. INPUT_ONLY: the value never round-trips on
+    reads. Get and List responses omit `plaintext`; the enclosing secret
+    object remains present to indicate that a secret is configured.
+    """
+
+    secret_reference: VariableOrOptional[ModelProviderServiceConfigSecretReference] = (
+        None
+    )
+    """
+    Reference to a customer-owned UC Secret that carries this secret value.
+    The value is read at invoke time under the model provider service
+    owner's access and is never copied onto the model provider service, so
+    rotating the UC Secret takes effect with no change to the model provider
+    service. On Create, supply `secret_reference.name` as
+    `secrets/{catalog}.{schema}.{secret}`.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "ModelProviderServiceConfigProviderSecretDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ModelProviderServiceConfigProviderSecretDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ModelProviderServiceConfigProviderSecretDict(TypedDict, total=False):
+    """"""
+
+    plaintext: VariableOrOptional[str]
+    """
+    Inline plaintext credential. INPUT_ONLY: the value never round-trips on
+    reads. Get and List responses omit `plaintext`; the enclosing secret
+    object remains present to indicate that a secret is configured.
+    """
+
+    secret_reference: VariableOrOptional[ModelProviderServiceConfigSecretReferenceParam]
+    """
+    Reference to a customer-owned UC Secret that carries this secret value.
+    The value is read at invoke time under the model provider service
+    owner's access and is never copied onto the model provider service, so
+    rotating the UC Secret takes effect with no change to the model provider
+    service. On Create, supply `secret_reference.name` as
+    `secrets/{catalog}.{schema}.{secret}`.
+    """
+
+
+ModelProviderServiceConfigProviderSecretParam = (
+    ModelProviderServiceConfigProviderSecretDict
+    | ModelProviderServiceConfigProviderSecret
+)
diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_secret_reference.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_secret_reference.py
new file mode 100644
index 00000000000..9c7e95309ff
--- /dev/null
+++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_secret_reference.py
@@ -0,0 +1,52 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ModelProviderServiceConfigSecretReference:
+    """
+    Reference to a customer-owned UC Secret backing a secret-bearing provider
+    field, in the `ProviderSecret.secret_reference` arm.
+    """
+
+    name: VariableOr[str]
+    """
+    Resource name of the bound UC Secret, in the form
+    `secrets/{catalog}.{schema}.{secret}`. On Create the caller supplies the
+    name here. On read it reflects the secret's current name at read time.
+    """
+
+    @classmethod
+    def from_dict(
+        cls, value: "ModelProviderServiceConfigSecretReferenceDict"
+    ) -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ModelProviderServiceConfigSecretReferenceDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ModelProviderServiceConfigSecretReferenceDict(TypedDict, total=False):
+    """"""
+
+    name: VariableOr[str]
+    """
+    Resource name of the bound UC Secret, in the form
+    `secrets/{catalog}.{schema}.{secret}`. On Create the caller supplies the
+    name here. On read it reflects the secret's current name at read time.
+    """
+
+
+ModelProviderServiceConfigSecretReferenceParam = (
+    ModelProviderServiceConfigSecretReferenceDict
+    | ModelProviderServiceConfigSecretReference
+)
diff --git a/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_service_credential.py b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_service_credential.py
new file mode 100644
index 00000000000..12753ea2865
--- /dev/null
+++ b/python/databricks/bundles/model_provider_services/_models/model_provider_service_config_service_credential.py
@@ -0,0 +1,54 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ModelProviderServiceConfigServiceCredential:
+    """
+    The customer-owned Unity Catalog service credential a model provider service
+    uses to authenticate to its provider, referenced by name.
+    """
+
+    name: VariableOr[str]
+    """
+    Resource name of the bound Unity Catalog service credential, in the form
+    `credentials/{name}`. Supply this field when creating the service or
+    rebinding its credential. On read, it reflects the credential's current
+    name.
+    """
+
+    @classmethod
+    def from_dict(
+        cls, value: "ModelProviderServiceConfigServiceCredentialDict"
+    ) -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ModelProviderServiceConfigServiceCredentialDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ModelProviderServiceConfigServiceCredentialDict(TypedDict, total=False):
+    """"""
+
+    name: VariableOr[str]
+    """
+    Resource name of the bound Unity Catalog service credential, in the form
+    `credentials/{name}`. Supply this field when creating the service or
+    rebinding its credential. On read, it reflects the credential's current
+    name.
+    """
+
+
+ModelProviderServiceConfigServiceCredentialParam = (
+    ModelProviderServiceConfigServiceCredentialDict
+    | ModelProviderServiceConfigServiceCredential
+)
diff --git a/python/databricks/bundles/model_provider_services/_models/privilege.py b/python/databricks/bundles/model_provider_services/_models/privilege.py
new file mode 100644
index 00000000000..df45211a76a
--- /dev/null
+++ b/python/databricks/bundles/model_provider_services/_models/privilege.py
@@ -0,0 +1,118 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class Privilege(Enum):
+    SELECT = "SELECT"
+    READ_PRIVATE_FILES = "READ_PRIVATE_FILES"
+    WRITE_PRIVATE_FILES = "WRITE_PRIVATE_FILES"
+    CREATE = "CREATE"
+    USAGE = "USAGE"
+    USE_CATALOG = "USE_CATALOG"
+    USE_SCHEMA = "USE_SCHEMA"
+    CREATE_SCHEMA = "CREATE_SCHEMA"
+    CREATE_VIEW = "CREATE_VIEW"
+    CREATE_EXTERNAL_TABLE = "CREATE_EXTERNAL_TABLE"
+    CREATE_MATERIALIZED_VIEW = "CREATE_MATERIALIZED_VIEW"
+    CREATE_FUNCTION = "CREATE_FUNCTION"
+    CREATE_MODEL = "CREATE_MODEL"
+    CREATE_CATALOG = "CREATE_CATALOG"
+    CREATE_MANAGED_STORAGE = "CREATE_MANAGED_STORAGE"
+    CREATE_EXTERNAL_LOCATION = "CREATE_EXTERNAL_LOCATION"
+    CREATE_STORAGE_CREDENTIAL = "CREATE_STORAGE_CREDENTIAL"
+    CREATE_SERVICE_CREDENTIAL = "CREATE_SERVICE_CREDENTIAL"
+    ACCESS = "ACCESS"
+    CREATE_SHARE = "CREATE_SHARE"
+    CREATE_RECIPIENT = "CREATE_RECIPIENT"
+    CREATE_PROVIDER = "CREATE_PROVIDER"
+    USE_SHARE = "USE_SHARE"
+    USE_RECIPIENT = "USE_RECIPIENT"
+    USE_PROVIDER = "USE_PROVIDER"
+    USE_MARKETPLACE_ASSETS = "USE_MARKETPLACE_ASSETS"
+    SET_SHARE_PERMISSION = "SET_SHARE_PERMISSION"
+    MODIFY = "MODIFY"
+    REFRESH = "REFRESH"
+    EXECUTE = "EXECUTE"
+    READ_FILES = "READ_FILES"
+    WRITE_FILES = "WRITE_FILES"
+    CREATE_TABLE = "CREATE_TABLE"
+    ALL_PRIVILEGES = "ALL_PRIVILEGES"
+    CREATE_CONNECTION = "CREATE_CONNECTION"
+    USE_CONNECTION = "USE_CONNECTION"
+    APPLY_TAG = "APPLY_TAG"
+    CREATE_FOREIGN_CATALOG = "CREATE_FOREIGN_CATALOG"
+    CREATE_FOREIGN_SECURABLE = "CREATE_FOREIGN_SECURABLE"
+    MANAGE_ALLOWLIST = "MANAGE_ALLOWLIST"
+    CREATE_VOLUME = "CREATE_VOLUME"
+    CREATE_EXTERNAL_VOLUME = "CREATE_EXTERNAL_VOLUME"
+    READ_VOLUME = "READ_VOLUME"
+    WRITE_VOLUME = "WRITE_VOLUME"
+    MANAGE = "MANAGE"
+    BROWSE = "BROWSE"
+    CREATE_CLEAN_ROOM = "CREATE_CLEAN_ROOM"
+    MODIFY_CLEAN_ROOM = "MODIFY_CLEAN_ROOM"
+    EXECUTE_CLEAN_ROOM_TASK = "EXECUTE_CLEAN_ROOM_TASK"
+    EXTERNAL_USE_SCHEMA = "EXTERNAL_USE_SCHEMA"
+    READ_METADATA = "READ_METADATA"
+    EXTERNAL_USE_LOCATION = "EXTERNAL_USE_LOCATION"
+
+
+PrivilegeParam = (
+    Literal[
+        "SELECT",
+        "READ_PRIVATE_FILES",
+        "WRITE_PRIVATE_FILES",
+        "CREATE",
+        "USAGE",
+        "USE_CATALOG",
+        "USE_SCHEMA",
+        "CREATE_SCHEMA",
+        "CREATE_VIEW",
+        "CREATE_EXTERNAL_TABLE",
+        "CREATE_MATERIALIZED_VIEW",
+        "CREATE_FUNCTION",
+        "CREATE_MODEL",
+        "CREATE_CATALOG",
+        "CREATE_MANAGED_STORAGE",
+        "CREATE_EXTERNAL_LOCATION",
+        "CREATE_STORAGE_CREDENTIAL",
+        "CREATE_SERVICE_CREDENTIAL",
+        "ACCESS",
+        "CREATE_SHARE",
+        "CREATE_RECIPIENT",
+        "CREATE_PROVIDER",
+        "USE_SHARE",
+        "USE_RECIPIENT",
+        "USE_PROVIDER",
+        "USE_MARKETPLACE_ASSETS",
+        "SET_SHARE_PERMISSION",
+        "MODIFY",
+        "REFRESH",
+        "EXECUTE",
+        "READ_FILES",
+        "WRITE_FILES",
+        "CREATE_TABLE",
+        "ALL_PRIVILEGES",
+        "CREATE_CONNECTION",
+        "USE_CONNECTION",
+        "APPLY_TAG",
+        "CREATE_FOREIGN_CATALOG",
+        "CREATE_FOREIGN_SECURABLE",
+        "MANAGE_ALLOWLIST",
+        "CREATE_VOLUME",
+        "CREATE_EXTERNAL_VOLUME",
+        "READ_VOLUME",
+        "WRITE_VOLUME",
+        "MANAGE",
+        "BROWSE",
+        "CREATE_CLEAN_ROOM",
+        "MODIFY_CLEAN_ROOM",
+        "EXECUTE_CLEAN_ROOM_TASK",
+        "EXTERNAL_USE_SCHEMA",
+        "READ_METADATA",
+        "EXTERNAL_USE_LOCATION",
+    ]
+    | Privilege
+)
diff --git a/python/databricks/bundles/model_provider_services/_models/privilege_assignment.py b/python/databricks/bundles/model_provider_services/_models/privilege_assignment.py
new file mode 100644
index 00000000000..810d4ebb627
--- /dev/null
+++ b/python/databricks/bundles/model_provider_services/_models/privilege_assignment.py
@@ -0,0 +1,56 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
+from databricks.bundles.model_provider_services._models.privilege import (
+    Privilege,
+    PrivilegeParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class PrivilegeAssignment:
+    """"""
+
+    principal: VariableOrOptional[str] = None
+    """
+    The principal (user email address or group name).
+    For deleted principals, `principal` is empty while `principal_id` is populated.
+    """
+
+    privileges: VariableOrList[Privilege] = field(default_factory=list)
+    """
+    The privileges assigned to the principal.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "PrivilegeAssignmentDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "PrivilegeAssignmentDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class PrivilegeAssignmentDict(TypedDict, total=False):
+    """"""
+
+    principal: VariableOrOptional[str]
+    """
+    The principal (user email address or group name).
+    For deleted principals, `principal` is empty while `principal_id` is populated.
+    """
+
+    privileges: VariableOrList[PrivilegeParam]
+    """
+    The privileges assigned to the principal.
+    """
+
+
+PrivilegeAssignmentParam = PrivilegeAssignmentDict | PrivilegeAssignment
diff --git a/python/databricks/bundles/model_provider_services/_models/rate_limit.py b/python/databricks/bundles/model_provider_services/_models/rate_limit.py
new file mode 100644
index 00000000000..5bbb533157a
--- /dev/null
+++ b/python/databricks/bundles/model_provider_services/_models/rate_limit.py
@@ -0,0 +1,102 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+from databricks.bundles.model_provider_services._models.rate_limit_rate_limit_key import (
+    RateLimitRateLimitKey,
+    RateLimitRateLimitKeyParam,
+)
+from databricks.bundles.model_provider_services._models.rate_limit_rate_limit_renewal_period import (
+    RateLimitRateLimitRenewalPeriod,
+    RateLimitRateLimitRenewalPeriodParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class RateLimit:
+    """
+    A rate limit applied to service requests. Leave `requests` or `tokens`
+    unset to impose no limit on that dimension; set a value to cap that dimension
+    within the renewal period.
+    """
+
+    key: VariableOr[RateLimitRateLimitKey]
+    """
+    Scope of the rate limit. Depending on this value, the limit applies to a
+    principal, the service as a whole, or each user by default.
+    """
+
+    renewal_period: VariableOr[RateLimitRateLimitRenewalPeriod]
+    """
+    Renewal period.
+    """
+
+    principal: VariableOrOptional[str] = None
+    """
+    Principal this limit applies to: user email, group name, or service
+    principal application ID. Required when `key` applies to a user, group, or
+    service principal; otherwise it must be unset.
+    """
+
+    requests: VariableOrOptional[int] = None
+    """
+    Maximum requests allowed in one renewal period. Leave unset for no request
+    limit. Set to `0` to deny all requests.
+    """
+
+    tokens: VariableOrOptional[int] = None
+    """
+    Maximum tokens allowed in one renewal period. Leave unset for no token
+    limit. Set to `0` to deny all requests.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "RateLimitDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "RateLimitDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class RateLimitDict(TypedDict, total=False):
+    """"""
+
+    key: VariableOr[RateLimitRateLimitKeyParam]
+    """
+    Scope of the rate limit. Depending on this value, the limit applies to a
+    principal, the service as a whole, or each user by default.
+    """
+
+    renewal_period: VariableOr[RateLimitRateLimitRenewalPeriodParam]
+    """
+    Renewal period.
+    """
+
+    principal: VariableOrOptional[str]
+    """
+    Principal this limit applies to: user email, group name, or service
+    principal application ID. Required when `key` applies to a user, group, or
+    service principal; otherwise it must be unset.
+    """
+
+    requests: VariableOrOptional[int]
+    """
+    Maximum requests allowed in one renewal period. Leave unset for no request
+    limit. Set to `0` to deny all requests.
+    """
+
+    tokens: VariableOrOptional[int]
+    """
+    Maximum tokens allowed in one renewal period. Leave unset for no token
+    limit. Set to `0` to deny all requests.
+    """
+
+
+RateLimitParam = RateLimitDict | RateLimit
diff --git a/python/databricks/bundles/model_provider_services/_models/rate_limit_rate_limit_key.py b/python/databricks/bundles/model_provider_services/_models/rate_limit_rate_limit_key.py
new file mode 100644
index 00000000000..fb907da810f
--- /dev/null
+++ b/python/databricks/bundles/model_provider_services/_models/rate_limit_rate_limit_key.py
@@ -0,0 +1,28 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class RateLimitRateLimitKey(Enum):
+    """
+    Scope key for a rate limit.
+    """
+
+    RATE_LIMIT_KEY_USER = "RATE_LIMIT_KEY_USER"
+    RATE_LIMIT_KEY_USER_GROUP = "RATE_LIMIT_KEY_USER_GROUP"
+    RATE_LIMIT_KEY_SERVICE_PRINCIPAL = "RATE_LIMIT_KEY_SERVICE_PRINCIPAL"
+    RATE_LIMIT_KEY_SERVICE = "RATE_LIMIT_KEY_SERVICE"
+    RATE_LIMIT_KEY_USER_DEFAULT = "RATE_LIMIT_KEY_USER_DEFAULT"
+
+
+RateLimitRateLimitKeyParam = (
+    Literal[
+        "RATE_LIMIT_KEY_USER",
+        "RATE_LIMIT_KEY_USER_GROUP",
+        "RATE_LIMIT_KEY_SERVICE_PRINCIPAL",
+        "RATE_LIMIT_KEY_SERVICE",
+        "RATE_LIMIT_KEY_USER_DEFAULT",
+    ]
+    | RateLimitRateLimitKey
+)
diff --git a/python/databricks/bundles/model_provider_services/_models/rate_limit_rate_limit_renewal_period.py b/python/databricks/bundles/model_provider_services/_models/rate_limit_rate_limit_renewal_period.py
new file mode 100644
index 00000000000..58636c784c0
--- /dev/null
+++ b/python/databricks/bundles/model_provider_services/_models/rate_limit_rate_limit_renewal_period.py
@@ -0,0 +1,19 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class RateLimitRateLimitRenewalPeriod(Enum):
+    """
+    Renewal period for a rate limit.
+    """
+
+    RATE_LIMIT_RENEWAL_PERIOD_MINUTE = "RATE_LIMIT_RENEWAL_PERIOD_MINUTE"
+    RATE_LIMIT_RENEWAL_PERIOD_HOUR = "RATE_LIMIT_RENEWAL_PERIOD_HOUR"
+
+
+RateLimitRateLimitRenewalPeriodParam = (
+    Literal["RATE_LIMIT_RENEWAL_PERIOD_MINUTE", "RATE_LIMIT_RENEWAL_PERIOD_HOUR"]
+    | RateLimitRateLimitRenewalPeriod
+)
diff --git a/python/databricks/bundles/model_services/__init__.py b/python/databricks/bundles/model_services/__init__.py
new file mode 100644
index 00000000000..9e10e6df19c
--- /dev/null
+++ b/python/databricks/bundles/model_services/__init__.py
@@ -0,0 +1,134 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+__all__ = [
+    "InferenceTableConfig",
+    "InferenceTableConfigDict",
+    "InferenceTableConfigParam",
+    "Lifecycle",
+    "LifecycleDict",
+    "LifecycleParam",
+    "ModelProviderServiceConfigModelTargetConfig",
+    "ModelProviderServiceConfigModelTargetConfigDict",
+    "ModelProviderServiceConfigModelTargetConfigParam",
+    "ModelService",
+    "ModelServiceConfig",
+    "ModelServiceConfigDestinationConfig",
+    "ModelServiceConfigDestinationConfigDestinationType",
+    "ModelServiceConfigDestinationConfigDestinationTypeParam",
+    "ModelServiceConfigDestinationConfigDict",
+    "ModelServiceConfigDestinationConfigParam",
+    "ModelServiceConfigDict",
+    "ModelServiceConfigExternalModelConfig",
+    "ModelServiceConfigExternalModelConfigDict",
+    "ModelServiceConfigExternalModelConfigParam",
+    "ModelServiceConfigFallbackConfig",
+    "ModelServiceConfigFallbackConfigDict",
+    "ModelServiceConfigFallbackConfigParam",
+    "ModelServiceConfigParam",
+    "ModelServiceConfigPayPerTokenConfig",
+    "ModelServiceConfigPayPerTokenConfigDict",
+    "ModelServiceConfigPayPerTokenConfigParam",
+    "ModelServiceConfigProvisionedThroughputConfig",
+    "ModelServiceConfigProvisionedThroughputConfigDict",
+    "ModelServiceConfigProvisionedThroughputConfigParam",
+    "ModelServiceConfigRoutingConfig",
+    "ModelServiceConfigRoutingConfigDict",
+    "ModelServiceConfigRoutingConfigParam",
+    "ModelServiceDict",
+    "ModelServiceParam",
+    "Privilege",
+    "PrivilegeAssignment",
+    "PrivilegeAssignmentDict",
+    "PrivilegeAssignmentParam",
+    "PrivilegeParam",
+    "RateLimit",
+    "RateLimitDict",
+    "RateLimitParam",
+    "RateLimitRateLimitKey",
+    "RateLimitRateLimitKeyParam",
+    "RateLimitRateLimitRenewalPeriod",
+    "RateLimitRateLimitRenewalPeriodParam",
+]
+
+
+from databricks.bundles.model_services._models.inference_table_config import (
+    InferenceTableConfig,
+    InferenceTableConfigDict,
+    InferenceTableConfigParam,
+)
+from databricks.bundles.model_services._models.lifecycle import (
+    Lifecycle,
+    LifecycleDict,
+    LifecycleParam,
+)
+from databricks.bundles.model_services._models.model_provider_service_config_model_target_config import (
+    ModelProviderServiceConfigModelTargetConfig,
+    ModelProviderServiceConfigModelTargetConfigDict,
+    ModelProviderServiceConfigModelTargetConfigParam,
+)
+from databricks.bundles.model_services._models.model_service import (
+    ModelService,
+    ModelServiceDict,
+    ModelServiceParam,
+)
+from databricks.bundles.model_services._models.model_service_config import (
+    ModelServiceConfig,
+    ModelServiceConfigDict,
+    ModelServiceConfigParam,
+)
+from databricks.bundles.model_services._models.model_service_config_destination_config import (
+    ModelServiceConfigDestinationConfig,
+    ModelServiceConfigDestinationConfigDict,
+    ModelServiceConfigDestinationConfigParam,
+)
+from databricks.bundles.model_services._models.model_service_config_destination_config_destination_type import (
+    ModelServiceConfigDestinationConfigDestinationType,
+    ModelServiceConfigDestinationConfigDestinationTypeParam,
+)
+from databricks.bundles.model_services._models.model_service_config_external_model_config import (
+    ModelServiceConfigExternalModelConfig,
+    ModelServiceConfigExternalModelConfigDict,
+    ModelServiceConfigExternalModelConfigParam,
+)
+from databricks.bundles.model_services._models.model_service_config_fallback_config import (
+    ModelServiceConfigFallbackConfig,
+    ModelServiceConfigFallbackConfigDict,
+    ModelServiceConfigFallbackConfigParam,
+)
+from databricks.bundles.model_services._models.model_service_config_pay_per_token_config import (
+    ModelServiceConfigPayPerTokenConfig,
+    ModelServiceConfigPayPerTokenConfigDict,
+    ModelServiceConfigPayPerTokenConfigParam,
+)
+from databricks.bundles.model_services._models.model_service_config_provisioned_throughput_config import (
+    ModelServiceConfigProvisionedThroughputConfig,
+    ModelServiceConfigProvisionedThroughputConfigDict,
+    ModelServiceConfigProvisionedThroughputConfigParam,
+)
+from databricks.bundles.model_services._models.model_service_config_routing_config import (
+    ModelServiceConfigRoutingConfig,
+    ModelServiceConfigRoutingConfigDict,
+    ModelServiceConfigRoutingConfigParam,
+)
+from databricks.bundles.model_services._models.privilege import (
+    Privilege,
+    PrivilegeParam,
+)
+from databricks.bundles.model_services._models.privilege_assignment import (
+    PrivilegeAssignment,
+    PrivilegeAssignmentDict,
+    PrivilegeAssignmentParam,
+)
+from databricks.bundles.model_services._models.rate_limit import (
+    RateLimit,
+    RateLimitDict,
+    RateLimitParam,
+)
+from databricks.bundles.model_services._models.rate_limit_rate_limit_key import (
+    RateLimitRateLimitKey,
+    RateLimitRateLimitKeyParam,
+)
+from databricks.bundles.model_services._models.rate_limit_rate_limit_renewal_period import (
+    RateLimitRateLimitRenewalPeriod,
+    RateLimitRateLimitRenewalPeriodParam,
+)
diff --git a/python/databricks/bundles/model_services/_models/inference_table_config.py b/python/databricks/bundles/model_services/_models/inference_table_config.py
new file mode 100644
index 00000000000..45165416e17
--- /dev/null
+++ b/python/databricks/bundles/model_services/_models/inference_table_config.py
@@ -0,0 +1,66 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class InferenceTableConfig:
+    """
+    Configuration for logging request and response payloads to a Unity Catalog
+    inference table. When this configuration is present, payload logging is
+    enabled by default.
+    """
+
+    parent: VariableOr[str]
+    """
+    Parent Unity Catalog schema where the inference table is created, in the
+    form `schemas/{catalog}.{schema}`. Required when configuring an inference
+    table. After the inference table is created, this field cannot be changed.
+    """
+
+    table_name_prefix: VariableOrOptional[str] = None
+    """
+    Prefix used to form the inference table's registered name. AI Gateway
+    appends `_payload`; for example, `table_name_prefix = "orders"` creates
+    `orders_payload`. If unset, the prefix defaults to the service name. Read
+    `table` from the response for the resulting resource name. After the
+    inference table is created, this field cannot be changed.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "InferenceTableConfigDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "InferenceTableConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class InferenceTableConfigDict(TypedDict, total=False):
+    """"""
+
+    parent: VariableOr[str]
+    """
+    Parent Unity Catalog schema where the inference table is created, in the
+    form `schemas/{catalog}.{schema}`. Required when configuring an inference
+    table. After the inference table is created, this field cannot be changed.
+    """
+
+    table_name_prefix: VariableOrOptional[str]
+    """
+    Prefix used to form the inference table's registered name. AI Gateway
+    appends `_payload`; for example, `table_name_prefix = "orders"` creates
+    `orders_payload`. If unset, the prefix defaults to the service name. Read
+    `table` from the response for the resulting resource name. After the
+    inference table is created, this field cannot be changed.
+    """
+
+
+InferenceTableConfigParam = InferenceTableConfigDict | InferenceTableConfig
diff --git a/python/databricks/bundles/model_services/_models/lifecycle.py b/python/databricks/bundles/model_services/_models/lifecycle.py
new file mode 100644
index 00000000000..697776a198e
--- /dev/null
+++ b/python/databricks/bundles/model_services/_models/lifecycle.py
@@ -0,0 +1,40 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class Lifecycle:
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool] = None
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "LifecycleDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "LifecycleDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class LifecycleDict(TypedDict, total=False):
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool]
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+
+LifecycleParam = LifecycleDict | Lifecycle
diff --git a/python/databricks/bundles/model_services/_models/model_provider_service_config_model_target_config.py b/python/databricks/bundles/model_services/_models/model_provider_service_config_model_target_config.py
new file mode 100644
index 00000000000..671c9eb4490
--- /dev/null
+++ b/python/databricks/bundles/model_services/_models/model_provider_service_config_model_target_config.py
@@ -0,0 +1,94 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import (
+    VariableOr,
+    VariableOrList,
+    VariableOrOptional,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ModelProviderServiceConfigModelTargetConfig:
+    """
+    Model target configuration shared by model provider service targets and
+    external model destinations on model services.
+    """
+
+    model: VariableOr[str]
+    """
+    Provider-side model identifier, such as `gpt-5` or `claude-opus-4-7`.
+    This identifies a model at the upstream provider; it is not a Unity
+    Catalog model resource.
+    """
+
+    endpoint_route: VariableOrOptional[str] = None
+    """
+    Relative path appended to a custom provider's `base_url` for this model,
+    such as `serve/openai/chat`. Nonempty values are only supported for
+    custom model provider service targets; other provider types reject them.
+    Model service destinations do not support this field. Do not include
+    URI templates, queries, or fragments. When empty, `base_url` is used unchanged.
+    """
+
+    native_api_types: VariableOrList[str] = field(default_factory=list)
+    """
+    Provider-native API types supported by this model, such as
+    `openai/v1/chat/completions`. A model provider service target requires at
+    least one value. A model service destination may omit the list to use the
+    matching provider service target's types when available. AI Gateway uses
+    the selected types for translation. At most 64 entries of 256 characters
+    each are allowed.
+    """
+
+    @classmethod
+    def from_dict(
+        cls, value: "ModelProviderServiceConfigModelTargetConfigDict"
+    ) -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ModelProviderServiceConfigModelTargetConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ModelProviderServiceConfigModelTargetConfigDict(TypedDict, total=False):
+    """"""
+
+    model: VariableOr[str]
+    """
+    Provider-side model identifier, such as `gpt-5` or `claude-opus-4-7`.
+    This identifies a model at the upstream provider; it is not a Unity
+    Catalog model resource.
+    """
+
+    endpoint_route: VariableOrOptional[str]
+    """
+    Relative path appended to a custom provider's `base_url` for this model,
+    such as `serve/openai/chat`. Nonempty values are only supported for
+    custom model provider service targets; other provider types reject them.
+    Model service destinations do not support this field. Do not include
+    URI templates, queries, or fragments. When empty, `base_url` is used unchanged.
+    """
+
+    native_api_types: VariableOrList[str]
+    """
+    Provider-native API types supported by this model, such as
+    `openai/v1/chat/completions`. A model provider service target requires at
+    least one value. A model service destination may omit the list to use the
+    matching provider service target's types when available. AI Gateway uses
+    the selected types for translation. At most 64 entries of 256 characters
+    each are allowed.
+    """
+
+
+ModelProviderServiceConfigModelTargetConfigParam = (
+    ModelProviderServiceConfigModelTargetConfigDict
+    | ModelProviderServiceConfigModelTargetConfig
+)
diff --git a/python/databricks/bundles/model_services/_models/model_service.py b/python/databricks/bundles/model_services/_models/model_service.py
new file mode 100644
index 00000000000..88f9d8cdeb7
--- /dev/null
+++ b/python/databricks/bundles/model_services/_models/model_service.py
@@ -0,0 +1,71 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._resource import Resource
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import (
+    VariableOr,
+    VariableOrList,
+    VariableOrOptional,
+)
+from databricks.bundles.model_services._models.lifecycle import (
+    Lifecycle,
+    LifecycleParam,
+)
+from databricks.bundles.model_services._models.model_service_config import (
+    ModelServiceConfig,
+    ModelServiceConfigParam,
+)
+from databricks.bundles.model_services._models.privilege_assignment import (
+    PrivilegeAssignment,
+    PrivilegeAssignmentParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ModelService(Resource):
+    """"""
+
+    model_service_id: VariableOr[str]
+
+    parent: VariableOr[str]
+
+    comment: VariableOrOptional[str] = None
+
+    config: VariableOrOptional[ModelServiceConfig] = None
+
+    grants: VariableOrList[PrivilegeAssignment] = field(default_factory=list)
+
+    lifecycle: VariableOrOptional[Lifecycle] = None
+
+    @classmethod
+    def from_dict(cls, value: "ModelServiceDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ModelServiceDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ModelServiceDict(TypedDict, total=False):
+    """"""
+
+    model_service_id: VariableOr[str]
+
+    parent: VariableOr[str]
+
+    comment: VariableOrOptional[str]
+
+    config: VariableOrOptional[ModelServiceConfigParam]
+
+    grants: VariableOrList[PrivilegeAssignmentParam]
+
+    lifecycle: VariableOrOptional[LifecycleParam]
+
+
+ModelServiceParam = ModelServiceDict | ModelService
diff --git a/python/databricks/bundles/model_services/_models/model_service_config.py b/python/databricks/bundles/model_services/_models/model_service_config.py
new file mode 100644
index 00000000000..88fb652d3ce
--- /dev/null
+++ b/python/databricks/bundles/model_services/_models/model_service_config.py
@@ -0,0 +1,74 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
+from databricks.bundles.model_services._models.inference_table_config import (
+    InferenceTableConfig,
+    InferenceTableConfigParam,
+)
+from databricks.bundles.model_services._models.model_service_config_routing_config import (
+    ModelServiceConfigRoutingConfig,
+    ModelServiceConfigRoutingConfigParam,
+)
+from databricks.bundles.model_services._models.rate_limit import (
+    RateLimit,
+    RateLimitParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ModelServiceConfig:
+    """
+    Operational configuration wrapped around the ModelService resource.
+    """
+
+    inference_table: VariableOrOptional[InferenceTableConfig] = None
+    """
+    Inference table configuration for payload logging.
+    """
+
+    rate_limits: VariableOrList[RateLimit] = field(default_factory=list)
+    """
+    Rate limits applied to requests routed through this model service.
+    """
+
+    routing: VariableOrOptional[ModelServiceConfigRoutingConfig] = None
+    """
+    Routing configuration: destinations and fallback.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "ModelServiceConfigDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ModelServiceConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ModelServiceConfigDict(TypedDict, total=False):
+    """"""
+
+    inference_table: VariableOrOptional[InferenceTableConfigParam]
+    """
+    Inference table configuration for payload logging.
+    """
+
+    rate_limits: VariableOrList[RateLimitParam]
+    """
+    Rate limits applied to requests routed through this model service.
+    """
+
+    routing: VariableOrOptional[ModelServiceConfigRoutingConfigParam]
+    """
+    Routing configuration: destinations and fallback.
+    """
+
+
+ModelServiceConfigParam = ModelServiceConfigDict | ModelServiceConfig
diff --git a/python/databricks/bundles/model_services/_models/model_service_config_destination_config.py b/python/databricks/bundles/model_services/_models/model_service_config_destination_config.py
new file mode 100644
index 00000000000..e4277476e5f
--- /dev/null
+++ b/python/databricks/bundles/model_services/_models/model_service_config_destination_config.py
@@ -0,0 +1,130 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+from databricks.bundles.model_services._models.model_service_config_destination_config_destination_type import (
+    ModelServiceConfigDestinationConfigDestinationType,
+    ModelServiceConfigDestinationConfigDestinationTypeParam,
+)
+from databricks.bundles.model_services._models.model_service_config_external_model_config import (
+    ModelServiceConfigExternalModelConfig,
+    ModelServiceConfigExternalModelConfigParam,
+)
+from databricks.bundles.model_services._models.model_service_config_pay_per_token_config import (
+    ModelServiceConfigPayPerTokenConfig,
+    ModelServiceConfigPayPerTokenConfigParam,
+)
+from databricks.bundles.model_services._models.model_service_config_provisioned_throughput_config import (
+    ModelServiceConfigProvisionedThroughputConfig,
+    ModelServiceConfigProvisionedThroughputConfigParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ModelServiceConfigDestinationConfig:
+    """
+    A destination the model service can route traffic to. Exactly one of the
+    per-type configs inside `type_config` must be set, and it must match
+    `destination_type`.
+    """
+
+    destination_type: VariableOr[ModelServiceConfigDestinationConfigDestinationType]
+    """
+    Backing-model category. Provide the matching type-specific configuration
+    and leave the other type-specific configurations unset.
+    """
+
+    name: VariableOr[str]
+    """
+    User-facing label for this destination, used in routing references.
+    """
+
+    external_model_config: VariableOrOptional[ModelServiceConfigExternalModelConfig] = (
+        None
+    )
+    """
+    Configuration for an external model reached through a model provider service.
+    """
+
+    pay_per_token_config: VariableOrOptional[ModelServiceConfigPayPerTokenConfig] = None
+    """
+    Configuration for a pay-per-token Databricks foundation model.
+    """
+
+    provisioned_throughput_config: VariableOrOptional[
+        ModelServiceConfigProvisionedThroughputConfig
+    ] = None
+    """
+    Configuration for a provisioned-throughput Databricks foundation model.
+    """
+
+    traffic_percentage: VariableOrOptional[int] = None
+    """
+    Percentage of primary traffic sent to this destination, from 0 to 100.
+    Required when there is more than one primary destination, in which case the
+    primary percentages must sum to 100; a single primary destination receives
+    all traffic. Fallback destinations are ordered and do not use this field.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "ModelServiceConfigDestinationConfigDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ModelServiceConfigDestinationConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ModelServiceConfigDestinationConfigDict(TypedDict, total=False):
+    """"""
+
+    destination_type: VariableOr[
+        ModelServiceConfigDestinationConfigDestinationTypeParam
+    ]
+    """
+    Backing-model category. Provide the matching type-specific configuration
+    and leave the other type-specific configurations unset.
+    """
+
+    name: VariableOr[str]
+    """
+    User-facing label for this destination, used in routing references.
+    """
+
+    external_model_config: VariableOrOptional[
+        ModelServiceConfigExternalModelConfigParam
+    ]
+    """
+    Configuration for an external model reached through a model provider service.
+    """
+
+    pay_per_token_config: VariableOrOptional[ModelServiceConfigPayPerTokenConfigParam]
+    """
+    Configuration for a pay-per-token Databricks foundation model.
+    """
+
+    provisioned_throughput_config: VariableOrOptional[
+        ModelServiceConfigProvisionedThroughputConfigParam
+    ]
+    """
+    Configuration for a provisioned-throughput Databricks foundation model.
+    """
+
+    traffic_percentage: VariableOrOptional[int]
+    """
+    Percentage of primary traffic sent to this destination, from 0 to 100.
+    Required when there is more than one primary destination, in which case the
+    primary percentages must sum to 100; a single primary destination receives
+    all traffic. Fallback destinations are ordered and do not use this field.
+    """
+
+
+ModelServiceConfigDestinationConfigParam = (
+    ModelServiceConfigDestinationConfigDict | ModelServiceConfigDestinationConfig
+)
diff --git a/python/databricks/bundles/model_services/_models/model_service_config_destination_config_destination_type.py b/python/databricks/bundles/model_services/_models/model_service_config_destination_config_destination_type.py
new file mode 100644
index 00000000000..a98c2ca8161
--- /dev/null
+++ b/python/databricks/bundles/model_services/_models/model_service_config_destination_config_destination_type.py
@@ -0,0 +1,30 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class ModelServiceConfigDestinationConfigDestinationType(Enum):
+    """
+    Backing-model category for a model service destination.
+    """
+
+    DESTINATION_TYPE_PAY_PER_TOKEN_FOUNDATION_MODEL = (
+        "DESTINATION_TYPE_PAY_PER_TOKEN_FOUNDATION_MODEL"
+    )
+    DESTINATION_TYPE_PROVISIONED_THROUGHPUT_FOUNDATION_MODEL = (
+        "DESTINATION_TYPE_PROVISIONED_THROUGHPUT_FOUNDATION_MODEL"
+    )
+    DESTINATION_TYPE_EXTERNAL_FOUNDATION_MODEL = (
+        "DESTINATION_TYPE_EXTERNAL_FOUNDATION_MODEL"
+    )
+
+
+ModelServiceConfigDestinationConfigDestinationTypeParam = (
+    Literal[
+        "DESTINATION_TYPE_PAY_PER_TOKEN_FOUNDATION_MODEL",
+        "DESTINATION_TYPE_PROVISIONED_THROUGHPUT_FOUNDATION_MODEL",
+        "DESTINATION_TYPE_EXTERNAL_FOUNDATION_MODEL",
+    ]
+    | ModelServiceConfigDestinationConfigDestinationType
+)
diff --git a/python/databricks/bundles/model_services/_models/model_service_config_external_model_config.py b/python/databricks/bundles/model_services/_models/model_service_config_external_model_config.py
new file mode 100644
index 00000000000..d82c7ad7d19
--- /dev/null
+++ b/python/databricks/bundles/model_services/_models/model_service_config_external_model_config.py
@@ -0,0 +1,75 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+from databricks.bundles.model_services._models.model_provider_service_config_model_target_config import (
+    ModelProviderServiceConfigModelTargetConfig,
+    ModelProviderServiceConfigModelTargetConfigParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ModelServiceConfigExternalModelConfig:
+    """
+    Configuration for an external-foundation-model destination. Provider auth
+    and provider-specific cloud configuration are owned by a separate, governed
+    ModelProviderService entity referenced via `model_provider_service`; the
+    platform resolves the provider at invocation time.
+    """
+
+    model_provider_service: VariableOr[str]
+    """
+    Resource name of the governed ModelProviderService that owns provider
+    auth and provider-specific configuration. The referenced
+    ModelProviderService also carries the provider type, so this message
+    does not surface it directly.
+    Format: `model-provider-services/{catalog}.{schema}.{model_provider_service}`.
+    Each `{...}` component is capped at 255 characters individually.
+    """
+
+    target: VariableOr[ModelProviderServiceConfigModelTargetConfig]
+    """
+    Routing target for the destination: the provider-side model selected from
+    the referenced ModelProviderService's `targets` catalog, plus the unified
+    API types the platform should translate to/from at request time.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "ModelServiceConfigExternalModelConfigDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ModelServiceConfigExternalModelConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ModelServiceConfigExternalModelConfigDict(TypedDict, total=False):
+    """"""
+
+    model_provider_service: VariableOr[str]
+    """
+    Resource name of the governed ModelProviderService that owns provider
+    auth and provider-specific configuration. The referenced
+    ModelProviderService also carries the provider type, so this message
+    does not surface it directly.
+    Format: `model-provider-services/{catalog}.{schema}.{model_provider_service}`.
+    Each `{...}` component is capped at 255 characters individually.
+    """
+
+    target: VariableOr[ModelProviderServiceConfigModelTargetConfigParam]
+    """
+    Routing target for the destination: the provider-side model selected from
+    the referenced ModelProviderService's `targets` catalog, plus the unified
+    API types the platform should translate to/from at request time.
+    """
+
+
+ModelServiceConfigExternalModelConfigParam = (
+    ModelServiceConfigExternalModelConfigDict | ModelServiceConfigExternalModelConfig
+)
diff --git a/python/databricks/bundles/model_services/_models/model_service_config_fallback_config.py b/python/databricks/bundles/model_services/_models/model_service_config_fallback_config.py
new file mode 100644
index 00000000000..e450152f88d
--- /dev/null
+++ b/python/databricks/bundles/model_services/_models/model_service_config_fallback_config.py
@@ -0,0 +1,51 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList
+from databricks.bundles.model_services._models.model_service_config_destination_config import (
+    ModelServiceConfigDestinationConfig,
+    ModelServiceConfigDestinationConfigParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ModelServiceConfigFallbackConfig:
+    """
+    Fallback routing applied after a primary destination fails. Fallback
+    destinations are tried in the listed order.
+    """
+
+    destinations: VariableOrList[ModelServiceConfigDestinationConfig] = field(
+        default_factory=list
+    )
+    """
+    Fallback destinations, tried in the listed order. At most 5 are allowed.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "ModelServiceConfigFallbackConfigDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ModelServiceConfigFallbackConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ModelServiceConfigFallbackConfigDict(TypedDict, total=False):
+    """"""
+
+    destinations: VariableOrList[ModelServiceConfigDestinationConfigParam]
+    """
+    Fallback destinations, tried in the listed order. At most 5 are allowed.
+    """
+
+
+ModelServiceConfigFallbackConfigParam = (
+    ModelServiceConfigFallbackConfigDict | ModelServiceConfigFallbackConfig
+)
diff --git a/python/databricks/bundles/model_services/_models/model_service_config_pay_per_token_config.py b/python/databricks/bundles/model_services/_models/model_service_config_pay_per_token_config.py
new file mode 100644
index 00000000000..a42bbed4465
--- /dev/null
+++ b/python/databricks/bundles/model_services/_models/model_service_config_pay_per_token_config.py
@@ -0,0 +1,48 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ModelServiceConfigPayPerTokenConfig:
+    """
+    Configuration for a pay-per-token foundation-model destination. Identifies
+    the foundation model by its UC resource name; the platform resolves it to a
+    Model Serving endpoint at request time.
+    """
+
+    model: VariableOr[str]
+    """
+    Resource name of the Unity Catalog model.
+    Format: `models/{catalog}.{schema}.{model}`.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "ModelServiceConfigPayPerTokenConfigDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ModelServiceConfigPayPerTokenConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ModelServiceConfigPayPerTokenConfigDict(TypedDict, total=False):
+    """"""
+
+    model: VariableOr[str]
+    """
+    Resource name of the Unity Catalog model.
+    Format: `models/{catalog}.{schema}.{model}`.
+    """
+
+
+ModelServiceConfigPayPerTokenConfigParam = (
+    ModelServiceConfigPayPerTokenConfigDict | ModelServiceConfigPayPerTokenConfig
+)
diff --git a/python/databricks/bundles/model_services/_models/model_service_config_provisioned_throughput_config.py b/python/databricks/bundles/model_services/_models/model_service_config_provisioned_throughput_config.py
new file mode 100644
index 00000000000..d8a0c63cc3d
--- /dev/null
+++ b/python/databricks/bundles/model_services/_models/model_service_config_provisioned_throughput_config.py
@@ -0,0 +1,60 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ModelServiceConfigProvisionedThroughputConfig:
+    """
+    Configuration for a provisioned-throughput foundation-model destination.
+    References a pre-existing Model Serving endpoint that serves the model;
+    sizing (provisioned throughput, burst scaling, model version) is owned by
+    the Model Serving endpoint itself, not by this message.
+    """
+
+    model_serving_endpoint: VariableOr[str]
+    """
+    Name of the backing Model Serving endpoint serving the provisioned-
+    throughput foundation model, in the form `serving-endpoints/{name}`. The
+    same Unity Catalog model can be served on multiple Model Serving endpoints
+    with different throughput, regions, or configurations. The caller selects
+    the endpoint to which this destination routes. The endpoint must exist at
+    create time.
+    """
+
+    @classmethod
+    def from_dict(
+        cls, value: "ModelServiceConfigProvisionedThroughputConfigDict"
+    ) -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ModelServiceConfigProvisionedThroughputConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ModelServiceConfigProvisionedThroughputConfigDict(TypedDict, total=False):
+    """"""
+
+    model_serving_endpoint: VariableOr[str]
+    """
+    Name of the backing Model Serving endpoint serving the provisioned-
+    throughput foundation model, in the form `serving-endpoints/{name}`. The
+    same Unity Catalog model can be served on multiple Model Serving endpoints
+    with different throughput, regions, or configurations. The caller selects
+    the endpoint to which this destination routes. The endpoint must exist at
+    create time.
+    """
+
+
+ModelServiceConfigProvisionedThroughputConfigParam = (
+    ModelServiceConfigProvisionedThroughputConfigDict
+    | ModelServiceConfigProvisionedThroughputConfig
+)
diff --git a/python/databricks/bundles/model_services/_models/model_service_config_routing_config.py b/python/databricks/bundles/model_services/_models/model_service_config_routing_config.py
new file mode 100644
index 00000000000..36b547f806f
--- /dev/null
+++ b/python/databricks/bundles/model_services/_models/model_service_config_routing_config.py
@@ -0,0 +1,75 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
+from databricks.bundles.model_services._models.model_service_config_destination_config import (
+    ModelServiceConfigDestinationConfig,
+    ModelServiceConfigDestinationConfigParam,
+)
+from databricks.bundles.model_services._models.model_service_config_fallback_config import (
+    ModelServiceConfigFallbackConfig,
+    ModelServiceConfigFallbackConfigParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ModelServiceConfigRoutingConfig:
+    """
+    Routing configuration for a model service, nesting destinations and
+    fallback under a single sub-message.
+    """
+
+    destinations: VariableOrList[ModelServiceConfigDestinationConfig] = field(
+        default_factory=list
+    )
+    """
+    Primary routing destinations. At most 10 are allowed. At least one is
+    required on Create. On Update, provide this list when replacing the full
+    `config` or updating `config.routing.destinations`; other granular routing
+    updates do not require resending destinations. The intermediate
+    `config.routing` mask path is not supported.
+    """
+
+    fallback: VariableOrOptional[ModelServiceConfigFallbackConfig] = None
+    """
+    Fallback routing applied after a primary destination fails. Fallback
+    destinations are tried in the listed order.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "ModelServiceConfigRoutingConfigDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ModelServiceConfigRoutingConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ModelServiceConfigRoutingConfigDict(TypedDict, total=False):
+    """"""
+
+    destinations: VariableOrList[ModelServiceConfigDestinationConfigParam]
+    """
+    Primary routing destinations. At most 10 are allowed. At least one is
+    required on Create. On Update, provide this list when replacing the full
+    `config` or updating `config.routing.destinations`; other granular routing
+    updates do not require resending destinations. The intermediate
+    `config.routing` mask path is not supported.
+    """
+
+    fallback: VariableOrOptional[ModelServiceConfigFallbackConfigParam]
+    """
+    Fallback routing applied after a primary destination fails. Fallback
+    destinations are tried in the listed order.
+    """
+
+
+ModelServiceConfigRoutingConfigParam = (
+    ModelServiceConfigRoutingConfigDict | ModelServiceConfigRoutingConfig
+)
diff --git a/python/databricks/bundles/model_services/_models/privilege.py b/python/databricks/bundles/model_services/_models/privilege.py
new file mode 100644
index 00000000000..df45211a76a
--- /dev/null
+++ b/python/databricks/bundles/model_services/_models/privilege.py
@@ -0,0 +1,118 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class Privilege(Enum):
+    SELECT = "SELECT"
+    READ_PRIVATE_FILES = "READ_PRIVATE_FILES"
+    WRITE_PRIVATE_FILES = "WRITE_PRIVATE_FILES"
+    CREATE = "CREATE"
+    USAGE = "USAGE"
+    USE_CATALOG = "USE_CATALOG"
+    USE_SCHEMA = "USE_SCHEMA"
+    CREATE_SCHEMA = "CREATE_SCHEMA"
+    CREATE_VIEW = "CREATE_VIEW"
+    CREATE_EXTERNAL_TABLE = "CREATE_EXTERNAL_TABLE"
+    CREATE_MATERIALIZED_VIEW = "CREATE_MATERIALIZED_VIEW"
+    CREATE_FUNCTION = "CREATE_FUNCTION"
+    CREATE_MODEL = "CREATE_MODEL"
+    CREATE_CATALOG = "CREATE_CATALOG"
+    CREATE_MANAGED_STORAGE = "CREATE_MANAGED_STORAGE"
+    CREATE_EXTERNAL_LOCATION = "CREATE_EXTERNAL_LOCATION"
+    CREATE_STORAGE_CREDENTIAL = "CREATE_STORAGE_CREDENTIAL"
+    CREATE_SERVICE_CREDENTIAL = "CREATE_SERVICE_CREDENTIAL"
+    ACCESS = "ACCESS"
+    CREATE_SHARE = "CREATE_SHARE"
+    CREATE_RECIPIENT = "CREATE_RECIPIENT"
+    CREATE_PROVIDER = "CREATE_PROVIDER"
+    USE_SHARE = "USE_SHARE"
+    USE_RECIPIENT = "USE_RECIPIENT"
+    USE_PROVIDER = "USE_PROVIDER"
+    USE_MARKETPLACE_ASSETS = "USE_MARKETPLACE_ASSETS"
+    SET_SHARE_PERMISSION = "SET_SHARE_PERMISSION"
+    MODIFY = "MODIFY"
+    REFRESH = "REFRESH"
+    EXECUTE = "EXECUTE"
+    READ_FILES = "READ_FILES"
+    WRITE_FILES = "WRITE_FILES"
+    CREATE_TABLE = "CREATE_TABLE"
+    ALL_PRIVILEGES = "ALL_PRIVILEGES"
+    CREATE_CONNECTION = "CREATE_CONNECTION"
+    USE_CONNECTION = "USE_CONNECTION"
+    APPLY_TAG = "APPLY_TAG"
+    CREATE_FOREIGN_CATALOG = "CREATE_FOREIGN_CATALOG"
+    CREATE_FOREIGN_SECURABLE = "CREATE_FOREIGN_SECURABLE"
+    MANAGE_ALLOWLIST = "MANAGE_ALLOWLIST"
+    CREATE_VOLUME = "CREATE_VOLUME"
+    CREATE_EXTERNAL_VOLUME = "CREATE_EXTERNAL_VOLUME"
+    READ_VOLUME = "READ_VOLUME"
+    WRITE_VOLUME = "WRITE_VOLUME"
+    MANAGE = "MANAGE"
+    BROWSE = "BROWSE"
+    CREATE_CLEAN_ROOM = "CREATE_CLEAN_ROOM"
+    MODIFY_CLEAN_ROOM = "MODIFY_CLEAN_ROOM"
+    EXECUTE_CLEAN_ROOM_TASK = "EXECUTE_CLEAN_ROOM_TASK"
+    EXTERNAL_USE_SCHEMA = "EXTERNAL_USE_SCHEMA"
+    READ_METADATA = "READ_METADATA"
+    EXTERNAL_USE_LOCATION = "EXTERNAL_USE_LOCATION"
+
+
+PrivilegeParam = (
+    Literal[
+        "SELECT",
+        "READ_PRIVATE_FILES",
+        "WRITE_PRIVATE_FILES",
+        "CREATE",
+        "USAGE",
+        "USE_CATALOG",
+        "USE_SCHEMA",
+        "CREATE_SCHEMA",
+        "CREATE_VIEW",
+        "CREATE_EXTERNAL_TABLE",
+        "CREATE_MATERIALIZED_VIEW",
+        "CREATE_FUNCTION",
+        "CREATE_MODEL",
+        "CREATE_CATALOG",
+        "CREATE_MANAGED_STORAGE",
+        "CREATE_EXTERNAL_LOCATION",
+        "CREATE_STORAGE_CREDENTIAL",
+        "CREATE_SERVICE_CREDENTIAL",
+        "ACCESS",
+        "CREATE_SHARE",
+        "CREATE_RECIPIENT",
+        "CREATE_PROVIDER",
+        "USE_SHARE",
+        "USE_RECIPIENT",
+        "USE_PROVIDER",
+        "USE_MARKETPLACE_ASSETS",
+        "SET_SHARE_PERMISSION",
+        "MODIFY",
+        "REFRESH",
+        "EXECUTE",
+        "READ_FILES",
+        "WRITE_FILES",
+        "CREATE_TABLE",
+        "ALL_PRIVILEGES",
+        "CREATE_CONNECTION",
+        "USE_CONNECTION",
+        "APPLY_TAG",
+        "CREATE_FOREIGN_CATALOG",
+        "CREATE_FOREIGN_SECURABLE",
+        "MANAGE_ALLOWLIST",
+        "CREATE_VOLUME",
+        "CREATE_EXTERNAL_VOLUME",
+        "READ_VOLUME",
+        "WRITE_VOLUME",
+        "MANAGE",
+        "BROWSE",
+        "CREATE_CLEAN_ROOM",
+        "MODIFY_CLEAN_ROOM",
+        "EXECUTE_CLEAN_ROOM_TASK",
+        "EXTERNAL_USE_SCHEMA",
+        "READ_METADATA",
+        "EXTERNAL_USE_LOCATION",
+    ]
+    | Privilege
+)
diff --git a/python/databricks/bundles/model_services/_models/privilege_assignment.py b/python/databricks/bundles/model_services/_models/privilege_assignment.py
new file mode 100644
index 00000000000..7bbd0ac80ee
--- /dev/null
+++ b/python/databricks/bundles/model_services/_models/privilege_assignment.py
@@ -0,0 +1,56 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
+from databricks.bundles.model_services._models.privilege import (
+    Privilege,
+    PrivilegeParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class PrivilegeAssignment:
+    """"""
+
+    principal: VariableOrOptional[str] = None
+    """
+    The principal (user email address or group name).
+    For deleted principals, `principal` is empty while `principal_id` is populated.
+    """
+
+    privileges: VariableOrList[Privilege] = field(default_factory=list)
+    """
+    The privileges assigned to the principal.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "PrivilegeAssignmentDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "PrivilegeAssignmentDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class PrivilegeAssignmentDict(TypedDict, total=False):
+    """"""
+
+    principal: VariableOrOptional[str]
+    """
+    The principal (user email address or group name).
+    For deleted principals, `principal` is empty while `principal_id` is populated.
+    """
+
+    privileges: VariableOrList[PrivilegeParam]
+    """
+    The privileges assigned to the principal.
+    """
+
+
+PrivilegeAssignmentParam = PrivilegeAssignmentDict | PrivilegeAssignment
diff --git a/python/databricks/bundles/model_services/_models/rate_limit.py b/python/databricks/bundles/model_services/_models/rate_limit.py
new file mode 100644
index 00000000000..355414bc28c
--- /dev/null
+++ b/python/databricks/bundles/model_services/_models/rate_limit.py
@@ -0,0 +1,102 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+from databricks.bundles.model_services._models.rate_limit_rate_limit_key import (
+    RateLimitRateLimitKey,
+    RateLimitRateLimitKeyParam,
+)
+from databricks.bundles.model_services._models.rate_limit_rate_limit_renewal_period import (
+    RateLimitRateLimitRenewalPeriod,
+    RateLimitRateLimitRenewalPeriodParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class RateLimit:
+    """
+    A rate limit applied to service requests. Leave `requests` or `tokens`
+    unset to impose no limit on that dimension; set a value to cap that dimension
+    within the renewal period.
+    """
+
+    key: VariableOr[RateLimitRateLimitKey]
+    """
+    Scope of the rate limit. Depending on this value, the limit applies to a
+    principal, the service as a whole, or each user by default.
+    """
+
+    renewal_period: VariableOr[RateLimitRateLimitRenewalPeriod]
+    """
+    Renewal period.
+    """
+
+    principal: VariableOrOptional[str] = None
+    """
+    Principal this limit applies to: user email, group name, or service
+    principal application ID. Required when `key` applies to a user, group, or
+    service principal; otherwise it must be unset.
+    """
+
+    requests: VariableOrOptional[int] = None
+    """
+    Maximum requests allowed in one renewal period. Leave unset for no request
+    limit. Set to `0` to deny all requests.
+    """
+
+    tokens: VariableOrOptional[int] = None
+    """
+    Maximum tokens allowed in one renewal period. Leave unset for no token
+    limit. Set to `0` to deny all requests.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "RateLimitDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "RateLimitDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class RateLimitDict(TypedDict, total=False):
+    """"""
+
+    key: VariableOr[RateLimitRateLimitKeyParam]
+    """
+    Scope of the rate limit. Depending on this value, the limit applies to a
+    principal, the service as a whole, or each user by default.
+    """
+
+    renewal_period: VariableOr[RateLimitRateLimitRenewalPeriodParam]
+    """
+    Renewal period.
+    """
+
+    principal: VariableOrOptional[str]
+    """
+    Principal this limit applies to: user email, group name, or service
+    principal application ID. Required when `key` applies to a user, group, or
+    service principal; otherwise it must be unset.
+    """
+
+    requests: VariableOrOptional[int]
+    """
+    Maximum requests allowed in one renewal period. Leave unset for no request
+    limit. Set to `0` to deny all requests.
+    """
+
+    tokens: VariableOrOptional[int]
+    """
+    Maximum tokens allowed in one renewal period. Leave unset for no token
+    limit. Set to `0` to deny all requests.
+    """
+
+
+RateLimitParam = RateLimitDict | RateLimit
diff --git a/python/databricks/bundles/model_services/_models/rate_limit_rate_limit_key.py b/python/databricks/bundles/model_services/_models/rate_limit_rate_limit_key.py
new file mode 100644
index 00000000000..fb907da810f
--- /dev/null
+++ b/python/databricks/bundles/model_services/_models/rate_limit_rate_limit_key.py
@@ -0,0 +1,28 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class RateLimitRateLimitKey(Enum):
+    """
+    Scope key for a rate limit.
+    """
+
+    RATE_LIMIT_KEY_USER = "RATE_LIMIT_KEY_USER"
+    RATE_LIMIT_KEY_USER_GROUP = "RATE_LIMIT_KEY_USER_GROUP"
+    RATE_LIMIT_KEY_SERVICE_PRINCIPAL = "RATE_LIMIT_KEY_SERVICE_PRINCIPAL"
+    RATE_LIMIT_KEY_SERVICE = "RATE_LIMIT_KEY_SERVICE"
+    RATE_LIMIT_KEY_USER_DEFAULT = "RATE_LIMIT_KEY_USER_DEFAULT"
+
+
+RateLimitRateLimitKeyParam = (
+    Literal[
+        "RATE_LIMIT_KEY_USER",
+        "RATE_LIMIT_KEY_USER_GROUP",
+        "RATE_LIMIT_KEY_SERVICE_PRINCIPAL",
+        "RATE_LIMIT_KEY_SERVICE",
+        "RATE_LIMIT_KEY_USER_DEFAULT",
+    ]
+    | RateLimitRateLimitKey
+)
diff --git a/python/databricks/bundles/model_services/_models/rate_limit_rate_limit_renewal_period.py b/python/databricks/bundles/model_services/_models/rate_limit_rate_limit_renewal_period.py
new file mode 100644
index 00000000000..58636c784c0
--- /dev/null
+++ b/python/databricks/bundles/model_services/_models/rate_limit_rate_limit_renewal_period.py
@@ -0,0 +1,19 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class RateLimitRateLimitRenewalPeriod(Enum):
+    """
+    Renewal period for a rate limit.
+    """
+
+    RATE_LIMIT_RENEWAL_PERIOD_MINUTE = "RATE_LIMIT_RENEWAL_PERIOD_MINUTE"
+    RATE_LIMIT_RENEWAL_PERIOD_HOUR = "RATE_LIMIT_RENEWAL_PERIOD_HOUR"
+
+
+RateLimitRateLimitRenewalPeriodParam = (
+    Literal["RATE_LIMIT_RENEWAL_PERIOD_MINUTE", "RATE_LIMIT_RENEWAL_PERIOD_HOUR"]
+    | RateLimitRateLimitRenewalPeriod
+)
diff --git a/python/databricks/bundles/model_serving_endpoints/__init__.py b/python/databricks/bundles/model_serving_endpoints/__init__.py
new file mode 100644
index 00000000000..0137c5e76b9
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/__init__.py
@@ -0,0 +1,352 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+__all__ = [
+    "Ai21LabsConfig",
+    "Ai21LabsConfigDict",
+    "Ai21LabsConfigParam",
+    "AiGatewayConfig",
+    "AiGatewayConfigDict",
+    "AiGatewayConfigParam",
+    "AiGatewayGuardrailParameters",
+    "AiGatewayGuardrailParametersDict",
+    "AiGatewayGuardrailParametersParam",
+    "AiGatewayGuardrailPiiBehavior",
+    "AiGatewayGuardrailPiiBehaviorBehavior",
+    "AiGatewayGuardrailPiiBehaviorBehaviorParam",
+    "AiGatewayGuardrailPiiBehaviorDict",
+    "AiGatewayGuardrailPiiBehaviorParam",
+    "AiGatewayGuardrails",
+    "AiGatewayGuardrailsDict",
+    "AiGatewayGuardrailsParam",
+    "AiGatewayInferenceTableConfig",
+    "AiGatewayInferenceTableConfigDict",
+    "AiGatewayInferenceTableConfigParam",
+    "AiGatewayRateLimit",
+    "AiGatewayRateLimitDict",
+    "AiGatewayRateLimitKey",
+    "AiGatewayRateLimitKeyParam",
+    "AiGatewayRateLimitParam",
+    "AiGatewayRateLimitRenewalPeriod",
+    "AiGatewayRateLimitRenewalPeriodParam",
+    "AiGatewayUsageTrackingConfig",
+    "AiGatewayUsageTrackingConfigDict",
+    "AiGatewayUsageTrackingConfigParam",
+    "AmazonBedrockConfig",
+    "AmazonBedrockConfigBedrockProvider",
+    "AmazonBedrockConfigBedrockProviderParam",
+    "AmazonBedrockConfigDict",
+    "AmazonBedrockConfigParam",
+    "AnthropicConfig",
+    "AnthropicConfigDict",
+    "AnthropicConfigParam",
+    "ApiKeyAuth",
+    "ApiKeyAuthDict",
+    "ApiKeyAuthParam",
+    "AutoCaptureConfigInput",
+    "AutoCaptureConfigInputDict",
+    "AutoCaptureConfigInputParam",
+    "BearerTokenAuth",
+    "BearerTokenAuthDict",
+    "BearerTokenAuthParam",
+    "CohereConfig",
+    "CohereConfigDict",
+    "CohereConfigParam",
+    "CustomProviderConfig",
+    "CustomProviderConfigDict",
+    "CustomProviderConfigParam",
+    "DatabricksModelServingConfig",
+    "DatabricksModelServingConfigDict",
+    "DatabricksModelServingConfigParam",
+    "EmailNotifications",
+    "EmailNotificationsDict",
+    "EmailNotificationsParam",
+    "EndpointCoreConfigInput",
+    "EndpointCoreConfigInputDict",
+    "EndpointCoreConfigInputParam",
+    "EndpointTag",
+    "EndpointTagDict",
+    "EndpointTagParam",
+    "ExternalModel",
+    "ExternalModelDict",
+    "ExternalModelParam",
+    "ExternalModelProvider",
+    "ExternalModelProviderParam",
+    "FallbackConfig",
+    "FallbackConfigDict",
+    "FallbackConfigParam",
+    "GoogleCloudVertexAiConfig",
+    "GoogleCloudVertexAiConfigDict",
+    "GoogleCloudVertexAiConfigParam",
+    "Lifecycle",
+    "LifecycleDict",
+    "LifecycleParam",
+    "ModelServingEndpoint",
+    "ModelServingEndpointDict",
+    "ModelServingEndpointParam",
+    "ModelServingEndpointPermission",
+    "ModelServingEndpointPermissionDict",
+    "ModelServingEndpointPermissionParam",
+    "OpenAiConfig",
+    "OpenAiConfigDict",
+    "OpenAiConfigParam",
+    "PaLmConfig",
+    "PaLmConfigDict",
+    "PaLmConfigParam",
+    "RateLimit",
+    "RateLimitDict",
+    "RateLimitKey",
+    "RateLimitKeyParam",
+    "RateLimitParam",
+    "RateLimitRenewalPeriod",
+    "RateLimitRenewalPeriodParam",
+    "Route",
+    "RouteDict",
+    "RouteParam",
+    "ServedEntityInput",
+    "ServedEntityInputDict",
+    "ServedEntityInputParam",
+    "ServedModelInput",
+    "ServedModelInputDict",
+    "ServedModelInputParam",
+    "ServedModelInputWorkloadType",
+    "ServedModelInputWorkloadTypeParam",
+    "ServingEndpointPermissionLevel",
+    "ServingEndpointPermissionLevelParam",
+    "ServingModelWorkloadType",
+    "ServingModelWorkloadTypeParam",
+    "TelemetryConfig",
+    "TelemetryConfigDict",
+    "TelemetryConfigParam",
+    "TelemetryFeature",
+    "TelemetryFeatureParam",
+    "TelemetryInferenceTableConfig",
+    "TelemetryInferenceTableConfigDict",
+    "TelemetryInferenceTableConfigParam",
+    "TrafficConfig",
+    "TrafficConfigDict",
+    "TrafficConfigParam",
+    "UnityCatalogTableNames",
+    "UnityCatalogTableNamesDict",
+    "UnityCatalogTableNamesParam",
+]
+
+
+from databricks.bundles.model_serving_endpoints._models.ai21_labs_config import (
+    Ai21LabsConfig,
+    Ai21LabsConfigDict,
+    Ai21LabsConfigParam,
+)
+from databricks.bundles.model_serving_endpoints._models.ai_gateway_config import (
+    AiGatewayConfig,
+    AiGatewayConfigDict,
+    AiGatewayConfigParam,
+)
+from databricks.bundles.model_serving_endpoints._models.ai_gateway_guardrail_parameters import (
+    AiGatewayGuardrailParameters,
+    AiGatewayGuardrailParametersDict,
+    AiGatewayGuardrailParametersParam,
+)
+from databricks.bundles.model_serving_endpoints._models.ai_gateway_guardrail_pii_behavior import (
+    AiGatewayGuardrailPiiBehavior,
+    AiGatewayGuardrailPiiBehaviorDict,
+    AiGatewayGuardrailPiiBehaviorParam,
+)
+from databricks.bundles.model_serving_endpoints._models.ai_gateway_guardrail_pii_behavior_behavior import (
+    AiGatewayGuardrailPiiBehaviorBehavior,
+    AiGatewayGuardrailPiiBehaviorBehaviorParam,
+)
+from databricks.bundles.model_serving_endpoints._models.ai_gateway_guardrails import (
+    AiGatewayGuardrails,
+    AiGatewayGuardrailsDict,
+    AiGatewayGuardrailsParam,
+)
+from databricks.bundles.model_serving_endpoints._models.ai_gateway_inference_table_config import (
+    AiGatewayInferenceTableConfig,
+    AiGatewayInferenceTableConfigDict,
+    AiGatewayInferenceTableConfigParam,
+)
+from databricks.bundles.model_serving_endpoints._models.ai_gateway_rate_limit import (
+    AiGatewayRateLimit,
+    AiGatewayRateLimitDict,
+    AiGatewayRateLimitParam,
+)
+from databricks.bundles.model_serving_endpoints._models.ai_gateway_rate_limit_key import (
+    AiGatewayRateLimitKey,
+    AiGatewayRateLimitKeyParam,
+)
+from databricks.bundles.model_serving_endpoints._models.ai_gateway_rate_limit_renewal_period import (
+    AiGatewayRateLimitRenewalPeriod,
+    AiGatewayRateLimitRenewalPeriodParam,
+)
+from databricks.bundles.model_serving_endpoints._models.ai_gateway_usage_tracking_config import (
+    AiGatewayUsageTrackingConfig,
+    AiGatewayUsageTrackingConfigDict,
+    AiGatewayUsageTrackingConfigParam,
+)
+from databricks.bundles.model_serving_endpoints._models.amazon_bedrock_config import (
+    AmazonBedrockConfig,
+    AmazonBedrockConfigDict,
+    AmazonBedrockConfigParam,
+)
+from databricks.bundles.model_serving_endpoints._models.amazon_bedrock_config_bedrock_provider import (
+    AmazonBedrockConfigBedrockProvider,
+    AmazonBedrockConfigBedrockProviderParam,
+)
+from databricks.bundles.model_serving_endpoints._models.anthropic_config import (
+    AnthropicConfig,
+    AnthropicConfigDict,
+    AnthropicConfigParam,
+)
+from databricks.bundles.model_serving_endpoints._models.api_key_auth import (
+    ApiKeyAuth,
+    ApiKeyAuthDict,
+    ApiKeyAuthParam,
+)
+from databricks.bundles.model_serving_endpoints._models.auto_capture_config_input import (
+    AutoCaptureConfigInput,
+    AutoCaptureConfigInputDict,
+    AutoCaptureConfigInputParam,
+)
+from databricks.bundles.model_serving_endpoints._models.bearer_token_auth import (
+    BearerTokenAuth,
+    BearerTokenAuthDict,
+    BearerTokenAuthParam,
+)
+from databricks.bundles.model_serving_endpoints._models.cohere_config import (
+    CohereConfig,
+    CohereConfigDict,
+    CohereConfigParam,
+)
+from databricks.bundles.model_serving_endpoints._models.custom_provider_config import (
+    CustomProviderConfig,
+    CustomProviderConfigDict,
+    CustomProviderConfigParam,
+)
+from databricks.bundles.model_serving_endpoints._models.databricks_model_serving_config import (
+    DatabricksModelServingConfig,
+    DatabricksModelServingConfigDict,
+    DatabricksModelServingConfigParam,
+)
+from databricks.bundles.model_serving_endpoints._models.email_notifications import (
+    EmailNotifications,
+    EmailNotificationsDict,
+    EmailNotificationsParam,
+)
+from databricks.bundles.model_serving_endpoints._models.endpoint_core_config_input import (
+    EndpointCoreConfigInput,
+    EndpointCoreConfigInputDict,
+    EndpointCoreConfigInputParam,
+)
+from databricks.bundles.model_serving_endpoints._models.endpoint_tag import (
+    EndpointTag,
+    EndpointTagDict,
+    EndpointTagParam,
+)
+from databricks.bundles.model_serving_endpoints._models.external_model import (
+    ExternalModel,
+    ExternalModelDict,
+    ExternalModelParam,
+)
+from databricks.bundles.model_serving_endpoints._models.external_model_provider import (
+    ExternalModelProvider,
+    ExternalModelProviderParam,
+)
+from databricks.bundles.model_serving_endpoints._models.fallback_config import (
+    FallbackConfig,
+    FallbackConfigDict,
+    FallbackConfigParam,
+)
+from databricks.bundles.model_serving_endpoints._models.google_cloud_vertex_ai_config import (
+    GoogleCloudVertexAiConfig,
+    GoogleCloudVertexAiConfigDict,
+    GoogleCloudVertexAiConfigParam,
+)
+from databricks.bundles.model_serving_endpoints._models.lifecycle import (
+    Lifecycle,
+    LifecycleDict,
+    LifecycleParam,
+)
+from databricks.bundles.model_serving_endpoints._models.model_serving_endpoint import (
+    ModelServingEndpoint,
+    ModelServingEndpointDict,
+    ModelServingEndpointParam,
+)
+from databricks.bundles.model_serving_endpoints._models.model_serving_endpoint_permission import (
+    ModelServingEndpointPermission,
+    ModelServingEndpointPermissionDict,
+    ModelServingEndpointPermissionParam,
+)
+from databricks.bundles.model_serving_endpoints._models.open_ai_config import (
+    OpenAiConfig,
+    OpenAiConfigDict,
+    OpenAiConfigParam,
+)
+from databricks.bundles.model_serving_endpoints._models.pa_lm_config import (
+    PaLmConfig,
+    PaLmConfigDict,
+    PaLmConfigParam,
+)
+from databricks.bundles.model_serving_endpoints._models.rate_limit import (
+    RateLimit,
+    RateLimitDict,
+    RateLimitParam,
+)
+from databricks.bundles.model_serving_endpoints._models.rate_limit_key import (
+    RateLimitKey,
+    RateLimitKeyParam,
+)
+from databricks.bundles.model_serving_endpoints._models.rate_limit_renewal_period import (
+    RateLimitRenewalPeriod,
+    RateLimitRenewalPeriodParam,
+)
+from databricks.bundles.model_serving_endpoints._models.route import (
+    Route,
+    RouteDict,
+    RouteParam,
+)
+from databricks.bundles.model_serving_endpoints._models.served_entity_input import (
+    ServedEntityInput,
+    ServedEntityInputDict,
+    ServedEntityInputParam,
+)
+from databricks.bundles.model_serving_endpoints._models.served_model_input import (
+    ServedModelInput,
+    ServedModelInputDict,
+    ServedModelInputParam,
+)
+from databricks.bundles.model_serving_endpoints._models.served_model_input_workload_type import (
+    ServedModelInputWorkloadType,
+    ServedModelInputWorkloadTypeParam,
+)
+from databricks.bundles.model_serving_endpoints._models.serving_endpoint_permission_level import (
+    ServingEndpointPermissionLevel,
+    ServingEndpointPermissionLevelParam,
+)
+from databricks.bundles.model_serving_endpoints._models.serving_model_workload_type import (
+    ServingModelWorkloadType,
+    ServingModelWorkloadTypeParam,
+)
+from databricks.bundles.model_serving_endpoints._models.telemetry_config import (
+    TelemetryConfig,
+    TelemetryConfigDict,
+    TelemetryConfigParam,
+)
+from databricks.bundles.model_serving_endpoints._models.telemetry_feature import (
+    TelemetryFeature,
+    TelemetryFeatureParam,
+)
+from databricks.bundles.model_serving_endpoints._models.telemetry_inference_table_config import (
+    TelemetryInferenceTableConfig,
+    TelemetryInferenceTableConfigDict,
+    TelemetryInferenceTableConfigParam,
+)
+from databricks.bundles.model_serving_endpoints._models.traffic_config import (
+    TrafficConfig,
+    TrafficConfigDict,
+    TrafficConfigParam,
+)
+from databricks.bundles.model_serving_endpoints._models.unity_catalog_table_names import (
+    UnityCatalogTableNames,
+    UnityCatalogTableNamesDict,
+    UnityCatalogTableNamesParam,
+)
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/ai21_labs_config.py b/python/databricks/bundles/model_serving_endpoints/_models/ai21_labs_config.py
new file mode 100644
index 00000000000..af06b6f6f1e
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/ai21_labs_config.py
@@ -0,0 +1,62 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class Ai21LabsConfig:
+    """"""
+
+    ai21labs_api_key: VariableOrOptional[str] = None
+    """
+    The Databricks secret key reference for an AI21 Labs API key. If you
+    prefer to paste your API key directly, see `ai21labs_api_key_plaintext`.
+    You must provide an API key using one of the following fields:
+    `ai21labs_api_key` or `ai21labs_api_key_plaintext`.
+    """
+
+    ai21labs_api_key_plaintext: VariableOrOptional[str] = None
+    """
+    An AI21 Labs API key provided as a plaintext string. If you prefer to
+    reference your key using Databricks Secrets, see `ai21labs_api_key`. You
+    must provide an API key using one of the following fields:
+    `ai21labs_api_key` or `ai21labs_api_key_plaintext`.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "Ai21LabsConfigDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "Ai21LabsConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class Ai21LabsConfigDict(TypedDict, total=False):
+    """"""
+
+    ai21labs_api_key: VariableOrOptional[str]
+    """
+    The Databricks secret key reference for an AI21 Labs API key. If you
+    prefer to paste your API key directly, see `ai21labs_api_key_plaintext`.
+    You must provide an API key using one of the following fields:
+    `ai21labs_api_key` or `ai21labs_api_key_plaintext`.
+    """
+
+    ai21labs_api_key_plaintext: VariableOrOptional[str]
+    """
+    An AI21 Labs API key provided as a plaintext string. If you prefer to
+    reference your key using Databricks Secrets, see `ai21labs_api_key`. You
+    must provide an API key using one of the following fields:
+    `ai21labs_api_key` or `ai21labs_api_key_plaintext`.
+    """
+
+
+Ai21LabsConfigParam = Ai21LabsConfigDict | Ai21LabsConfig
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/ai_gateway_config.py b/python/databricks/bundles/model_serving_endpoints/_models/ai_gateway_config.py
new file mode 100644
index 00000000000..24a4a967599
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/ai_gateway_config.py
@@ -0,0 +1,106 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
+from databricks.bundles.model_serving_endpoints._models.ai_gateway_guardrails import (
+    AiGatewayGuardrails,
+    AiGatewayGuardrailsParam,
+)
+from databricks.bundles.model_serving_endpoints._models.ai_gateway_inference_table_config import (
+    AiGatewayInferenceTableConfig,
+    AiGatewayInferenceTableConfigParam,
+)
+from databricks.bundles.model_serving_endpoints._models.ai_gateway_rate_limit import (
+    AiGatewayRateLimit,
+    AiGatewayRateLimitParam,
+)
+from databricks.bundles.model_serving_endpoints._models.ai_gateway_usage_tracking_config import (
+    AiGatewayUsageTrackingConfig,
+    AiGatewayUsageTrackingConfigParam,
+)
+from databricks.bundles.model_serving_endpoints._models.fallback_config import (
+    FallbackConfig,
+    FallbackConfigParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AiGatewayConfig:
+    """"""
+
+    fallback_config: VariableOrOptional[FallbackConfig] = None
+    """
+    Configuration for traffic fallback which auto fallbacks to other served entities if the request to a served
+    entity fails with certain error codes, to increase availability.
+    """
+
+    guardrails: VariableOrOptional[AiGatewayGuardrails] = None
+    """
+    [Public Preview] Configuration for AI Guardrails to prevent unwanted data and unsafe data in requests and responses.
+    """
+
+    inference_table_config: VariableOrOptional[AiGatewayInferenceTableConfig] = None
+    """
+    Configuration for payload logging using inference tables.
+    Use these tables to monitor and audit data being sent to and received from model APIs and to improve model quality.
+    """
+
+    rate_limits: VariableOrList[AiGatewayRateLimit] = field(default_factory=list)
+    """
+    Configuration for rate limits which can be set to limit endpoint traffic.
+    """
+
+    usage_tracking_config: VariableOrOptional[AiGatewayUsageTrackingConfig] = None
+    """
+    Configuration to enable usage tracking using system tables.
+    These tables allow you to monitor operational usage on endpoints and their associated costs.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "AiGatewayConfigDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AiGatewayConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AiGatewayConfigDict(TypedDict, total=False):
+    """"""
+
+    fallback_config: VariableOrOptional[FallbackConfigParam]
+    """
+    Configuration for traffic fallback which auto fallbacks to other served entities if the request to a served
+    entity fails with certain error codes, to increase availability.
+    """
+
+    guardrails: VariableOrOptional[AiGatewayGuardrailsParam]
+    """
+    [Public Preview] Configuration for AI Guardrails to prevent unwanted data and unsafe data in requests and responses.
+    """
+
+    inference_table_config: VariableOrOptional[AiGatewayInferenceTableConfigParam]
+    """
+    Configuration for payload logging using inference tables.
+    Use these tables to monitor and audit data being sent to and received from model APIs and to improve model quality.
+    """
+
+    rate_limits: VariableOrList[AiGatewayRateLimitParam]
+    """
+    Configuration for rate limits which can be set to limit endpoint traffic.
+    """
+
+    usage_tracking_config: VariableOrOptional[AiGatewayUsageTrackingConfigParam]
+    """
+    Configuration to enable usage tracking using system tables.
+    These tables allow you to monitor operational usage on endpoints and their associated costs.
+    """
+
+
+AiGatewayConfigParam = AiGatewayConfigDict | AiGatewayConfig
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/ai_gateway_guardrail_parameters.py b/python/databricks/bundles/model_serving_endpoints/_models/ai_gateway_guardrail_parameters.py
new file mode 100644
index 00000000000..55b70a82669
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/ai_gateway_guardrail_parameters.py
@@ -0,0 +1,80 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
+from databricks.bundles.model_serving_endpoints._models.ai_gateway_guardrail_pii_behavior import (
+    AiGatewayGuardrailPiiBehavior,
+    AiGatewayGuardrailPiiBehaviorParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AiGatewayGuardrailParameters:
+    """"""
+
+    invalid_keywords: VariableOrList[str] = field(default_factory=list)
+    """
+    [DEPRECATED] [Public Preview] List of invalid keywords.
+    AI guardrail uses keyword or string matching to decide if the keyword exists in the request or response content.
+    """
+
+    pii: VariableOrOptional[AiGatewayGuardrailPiiBehavior] = None
+    """
+    [Public Preview] Configuration for guardrail PII filter.
+    """
+
+    safety: VariableOrOptional[bool] = None
+    """
+    [Public Preview] Indicates whether the safety filter is enabled.
+    """
+
+    valid_topics: VariableOrList[str] = field(default_factory=list)
+    """
+    [DEPRECATED] [Public Preview] The list of allowed topics.
+    Given a chat request, this guardrail flags the request if its topic is not in the allowed topics.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "AiGatewayGuardrailParametersDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AiGatewayGuardrailParametersDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AiGatewayGuardrailParametersDict(TypedDict, total=False):
+    """"""
+
+    invalid_keywords: VariableOrList[str]
+    """
+    [DEPRECATED] [Public Preview] List of invalid keywords.
+    AI guardrail uses keyword or string matching to decide if the keyword exists in the request or response content.
+    """
+
+    pii: VariableOrOptional[AiGatewayGuardrailPiiBehaviorParam]
+    """
+    [Public Preview] Configuration for guardrail PII filter.
+    """
+
+    safety: VariableOrOptional[bool]
+    """
+    [Public Preview] Indicates whether the safety filter is enabled.
+    """
+
+    valid_topics: VariableOrList[str]
+    """
+    [DEPRECATED] [Public Preview] The list of allowed topics.
+    Given a chat request, this guardrail flags the request if its topic is not in the allowed topics.
+    """
+
+
+AiGatewayGuardrailParametersParam = (
+    AiGatewayGuardrailParametersDict | AiGatewayGuardrailParameters
+)
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/ai_gateway_guardrail_pii_behavior.py b/python/databricks/bundles/model_serving_endpoints/_models/ai_gateway_guardrail_pii_behavior.py
new file mode 100644
index 00000000000..577af194a55
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/ai_gateway_guardrail_pii_behavior.py
@@ -0,0 +1,46 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.model_serving_endpoints._models.ai_gateway_guardrail_pii_behavior_behavior import (
+    AiGatewayGuardrailPiiBehaviorBehavior,
+    AiGatewayGuardrailPiiBehaviorBehaviorParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AiGatewayGuardrailPiiBehavior:
+    """"""
+
+    behavior: VariableOrOptional[AiGatewayGuardrailPiiBehaviorBehavior] = None
+    """
+    [Public Preview] Configuration for input guardrail filters.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "AiGatewayGuardrailPiiBehaviorDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AiGatewayGuardrailPiiBehaviorDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AiGatewayGuardrailPiiBehaviorDict(TypedDict, total=False):
+    """"""
+
+    behavior: VariableOrOptional[AiGatewayGuardrailPiiBehaviorBehaviorParam]
+    """
+    [Public Preview] Configuration for input guardrail filters.
+    """
+
+
+AiGatewayGuardrailPiiBehaviorParam = (
+    AiGatewayGuardrailPiiBehaviorDict | AiGatewayGuardrailPiiBehavior
+)
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/ai_gateway_guardrail_pii_behavior_behavior.py b/python/databricks/bundles/model_serving_endpoints/_models/ai_gateway_guardrail_pii_behavior_behavior.py
new file mode 100644
index 00000000000..bf9bf86fc68
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/ai_gateway_guardrail_pii_behavior_behavior.py
@@ -0,0 +1,15 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class AiGatewayGuardrailPiiBehaviorBehavior(Enum):
+    NONE = "NONE"
+    BLOCK = "BLOCK"
+    MASK = "MASK"
+
+
+AiGatewayGuardrailPiiBehaviorBehaviorParam = (
+    Literal["NONE", "BLOCK", "MASK"] | AiGatewayGuardrailPiiBehaviorBehavior
+)
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/ai_gateway_guardrails.py b/python/databricks/bundles/model_serving_endpoints/_models/ai_gateway_guardrails.py
new file mode 100644
index 00000000000..299859aa015
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/ai_gateway_guardrails.py
@@ -0,0 +1,54 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.model_serving_endpoints._models.ai_gateway_guardrail_parameters import (
+    AiGatewayGuardrailParameters,
+    AiGatewayGuardrailParametersParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AiGatewayGuardrails:
+    """"""
+
+    input: VariableOrOptional[AiGatewayGuardrailParameters] = None
+    """
+    [Public Preview] Configuration for input guardrail filters.
+    """
+
+    output: VariableOrOptional[AiGatewayGuardrailParameters] = None
+    """
+    [Public Preview] Configuration for output guardrail filters.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "AiGatewayGuardrailsDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AiGatewayGuardrailsDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AiGatewayGuardrailsDict(TypedDict, total=False):
+    """"""
+
+    input: VariableOrOptional[AiGatewayGuardrailParametersParam]
+    """
+    [Public Preview] Configuration for input guardrail filters.
+    """
+
+    output: VariableOrOptional[AiGatewayGuardrailParametersParam]
+    """
+    [Public Preview] Configuration for output guardrail filters.
+    """
+
+
+AiGatewayGuardrailsParam = AiGatewayGuardrailsDict | AiGatewayGuardrails
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/ai_gateway_inference_table_config.py b/python/databricks/bundles/model_serving_endpoints/_models/ai_gateway_inference_table_config.py
new file mode 100644
index 00000000000..a4d748dee3a
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/ai_gateway_inference_table_config.py
@@ -0,0 +1,78 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AiGatewayInferenceTableConfig:
+    """"""
+
+    catalog_name: VariableOrOptional[str] = None
+    """
+    The name of the catalog in Unity Catalog. Required when enabling inference tables.
+    NOTE: On update, you have to disable inference table first in order to change the catalog name.
+    """
+
+    enabled: VariableOrOptional[bool] = None
+    """
+    Indicates whether the inference table is enabled.
+    """
+
+    schema_name: VariableOrOptional[str] = None
+    """
+    The name of the schema in Unity Catalog. Required when enabling inference tables.
+    NOTE: On update, you have to disable inference table first in order to change the schema name.
+    """
+
+    table_name_prefix: VariableOrOptional[str] = None
+    """
+    The prefix of the table in Unity Catalog.
+    NOTE: On update, you have to disable inference table first in order to change the prefix name.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "AiGatewayInferenceTableConfigDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AiGatewayInferenceTableConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AiGatewayInferenceTableConfigDict(TypedDict, total=False):
+    """"""
+
+    catalog_name: VariableOrOptional[str]
+    """
+    The name of the catalog in Unity Catalog. Required when enabling inference tables.
+    NOTE: On update, you have to disable inference table first in order to change the catalog name.
+    """
+
+    enabled: VariableOrOptional[bool]
+    """
+    Indicates whether the inference table is enabled.
+    """
+
+    schema_name: VariableOrOptional[str]
+    """
+    The name of the schema in Unity Catalog. Required when enabling inference tables.
+    NOTE: On update, you have to disable inference table first in order to change the schema name.
+    """
+
+    table_name_prefix: VariableOrOptional[str]
+    """
+    The prefix of the table in Unity Catalog.
+    NOTE: On update, you have to disable inference table first in order to change the prefix name.
+    """
+
+
+AiGatewayInferenceTableConfigParam = (
+    AiGatewayInferenceTableConfigDict | AiGatewayInferenceTableConfig
+)
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/ai_gateway_rate_limit.py b/python/databricks/bundles/model_serving_endpoints/_models/ai_gateway_rate_limit.py
new file mode 100644
index 00000000000..5848e04f895
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/ai_gateway_rate_limit.py
@@ -0,0 +1,90 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+from databricks.bundles.model_serving_endpoints._models.ai_gateway_rate_limit_key import (
+    AiGatewayRateLimitKey,
+    AiGatewayRateLimitKeyParam,
+)
+from databricks.bundles.model_serving_endpoints._models.ai_gateway_rate_limit_renewal_period import (
+    AiGatewayRateLimitRenewalPeriod,
+    AiGatewayRateLimitRenewalPeriodParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AiGatewayRateLimit:
+    """"""
+
+    renewal_period: VariableOr[AiGatewayRateLimitRenewalPeriod]
+    """
+    Renewal period field for a rate limit. Currently, only 'minute' is supported.
+    """
+
+    calls: VariableOrOptional[int] = None
+    """
+    Used to specify how many calls are allowed for a key within the renewal_period.
+    """
+
+    key: VariableOrOptional[AiGatewayRateLimitKey] = None
+    """
+    Key field for a rate limit. Currently, 'user', 'user_group, 'service_principal', and 'endpoint' are supported,
+    with 'endpoint' being the default if not specified.
+    """
+
+    principal: VariableOrOptional[str] = None
+    """
+    Principal field for a user, user group, or service principal to apply rate limiting to. Accepts a user email, group name, or service principal application ID.
+    """
+
+    tokens: VariableOrOptional[int] = None
+    """
+    Used to specify how many tokens are allowed for a key within the renewal_period.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "AiGatewayRateLimitDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AiGatewayRateLimitDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AiGatewayRateLimitDict(TypedDict, total=False):
+    """"""
+
+    renewal_period: VariableOr[AiGatewayRateLimitRenewalPeriodParam]
+    """
+    Renewal period field for a rate limit. Currently, only 'minute' is supported.
+    """
+
+    calls: VariableOrOptional[int]
+    """
+    Used to specify how many calls are allowed for a key within the renewal_period.
+    """
+
+    key: VariableOrOptional[AiGatewayRateLimitKeyParam]
+    """
+    Key field for a rate limit. Currently, 'user', 'user_group, 'service_principal', and 'endpoint' are supported,
+    with 'endpoint' being the default if not specified.
+    """
+
+    principal: VariableOrOptional[str]
+    """
+    Principal field for a user, user group, or service principal to apply rate limiting to. Accepts a user email, group name, or service principal application ID.
+    """
+
+    tokens: VariableOrOptional[int]
+    """
+    Used to specify how many tokens are allowed for a key within the renewal_period.
+    """
+
+
+AiGatewayRateLimitParam = AiGatewayRateLimitDict | AiGatewayRateLimit
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/ai_gateway_rate_limit_key.py b/python/databricks/bundles/model_serving_endpoints/_models/ai_gateway_rate_limit_key.py
new file mode 100644
index 00000000000..f166207b7e7
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/ai_gateway_rate_limit_key.py
@@ -0,0 +1,17 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class AiGatewayRateLimitKey(Enum):
+    USER = "user"
+    ENDPOINT = "endpoint"
+    USER_GROUP = "user_group"
+    SERVICE_PRINCIPAL = "service_principal"
+
+
+AiGatewayRateLimitKeyParam = (
+    Literal["user", "endpoint", "user_group", "service_principal"]
+    | AiGatewayRateLimitKey
+)
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/ai_gateway_rate_limit_renewal_period.py b/python/databricks/bundles/model_serving_endpoints/_models/ai_gateway_rate_limit_renewal_period.py
new file mode 100644
index 00000000000..e315d878c83
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/ai_gateway_rate_limit_renewal_period.py
@@ -0,0 +1,13 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class AiGatewayRateLimitRenewalPeriod(Enum):
+    MINUTE = "minute"
+
+
+AiGatewayRateLimitRenewalPeriodParam = (
+    Literal["minute"] | AiGatewayRateLimitRenewalPeriod
+)
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/ai_gateway_usage_tracking_config.py b/python/databricks/bundles/model_serving_endpoints/_models/ai_gateway_usage_tracking_config.py
new file mode 100644
index 00000000000..bd5b5dd2806
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/ai_gateway_usage_tracking_config.py
@@ -0,0 +1,42 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AiGatewayUsageTrackingConfig:
+    """"""
+
+    enabled: VariableOrOptional[bool] = None
+    """
+    Whether to enable usage tracking.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "AiGatewayUsageTrackingConfigDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AiGatewayUsageTrackingConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AiGatewayUsageTrackingConfigDict(TypedDict, total=False):
+    """"""
+
+    enabled: VariableOrOptional[bool]
+    """
+    Whether to enable usage tracking.
+    """
+
+
+AiGatewayUsageTrackingConfigParam = (
+    AiGatewayUsageTrackingConfigDict | AiGatewayUsageTrackingConfig
+)
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/amazon_bedrock_config.py b/python/databricks/bundles/model_serving_endpoints/_models/amazon_bedrock_config.py
new file mode 100644
index 00000000000..0a51df09ba8
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/amazon_bedrock_config.py
@@ -0,0 +1,160 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+from databricks.bundles.model_serving_endpoints._models.amazon_bedrock_config_bedrock_provider import (
+    AmazonBedrockConfigBedrockProvider,
+    AmazonBedrockConfigBedrockProviderParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AmazonBedrockConfig:
+    """"""
+
+    aws_region: VariableOr[str]
+    """
+    The AWS region to use. Bedrock has to be enabled there.
+    """
+
+    bedrock_provider: VariableOr[AmazonBedrockConfigBedrockProvider]
+    """
+    The underlying provider in Amazon Bedrock. Supported values (case
+    insensitive) include: Anthropic, Cohere, AI21Labs, Amazon.
+    """
+
+    aws_access_key_id: VariableOrOptional[str] = None
+    """
+    The Databricks secret key reference for an AWS access key ID with
+    permissions to interact with Bedrock services. If you prefer to paste
+    your API key directly, see `aws_access_key_id_plaintext`. You must provide an API
+    key using one of the following fields: `aws_access_key_id` or
+    `aws_access_key_id_plaintext`.
+    """
+
+    aws_access_key_id_plaintext: VariableOrOptional[str] = None
+    """
+    An AWS access key ID with permissions to interact with Bedrock services
+    provided as a plaintext string. If you prefer to reference your key using
+    Databricks Secrets, see `aws_access_key_id`. You must provide an API key
+    using one of the following fields: `aws_access_key_id` or
+    `aws_access_key_id_plaintext`.
+    """
+
+    aws_secret_access_key: VariableOrOptional[str] = None
+    """
+    The Databricks secret key reference for an AWS secret access key paired
+    with the access key ID, with permissions to interact with Bedrock
+    services. If you prefer to paste your API key directly, see
+    `aws_secret_access_key_plaintext`. You must provide an API key using one
+    of the following fields: `aws_secret_access_key` or
+    `aws_secret_access_key_plaintext`.
+    """
+
+    aws_secret_access_key_plaintext: VariableOrOptional[str] = None
+    """
+    An AWS secret access key paired with the access key ID, with permissions
+    to interact with Bedrock services provided as a plaintext string. If you
+    prefer to reference your key using Databricks Secrets, see
+    `aws_secret_access_key`. You must provide an API key using one of the
+    following fields: `aws_secret_access_key` or
+    `aws_secret_access_key_plaintext`.
+    """
+
+    instance_profile_arn: VariableOrOptional[str] = None
+    """
+    ARN of the instance profile that the external model will use to access AWS resources.
+    You must authenticate using an instance profile or access keys.
+    If you prefer to authenticate using access keys, see `aws_access_key_id`,
+    `aws_access_key_id_plaintext`, `aws_secret_access_key` and `aws_secret_access_key_plaintext`.
+    """
+
+    uc_service_credential_name: VariableOrOptional[str] = None
+    """
+    [Public Preview] The name of the Unity Catalog service credential that the external model uses to access AWS
+    resources.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "AmazonBedrockConfigDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AmazonBedrockConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AmazonBedrockConfigDict(TypedDict, total=False):
+    """"""
+
+    aws_region: VariableOr[str]
+    """
+    The AWS region to use. Bedrock has to be enabled there.
+    """
+
+    bedrock_provider: VariableOr[AmazonBedrockConfigBedrockProviderParam]
+    """
+    The underlying provider in Amazon Bedrock. Supported values (case
+    insensitive) include: Anthropic, Cohere, AI21Labs, Amazon.
+    """
+
+    aws_access_key_id: VariableOrOptional[str]
+    """
+    The Databricks secret key reference for an AWS access key ID with
+    permissions to interact with Bedrock services. If you prefer to paste
+    your API key directly, see `aws_access_key_id_plaintext`. You must provide an API
+    key using one of the following fields: `aws_access_key_id` or
+    `aws_access_key_id_plaintext`.
+    """
+
+    aws_access_key_id_plaintext: VariableOrOptional[str]
+    """
+    An AWS access key ID with permissions to interact with Bedrock services
+    provided as a plaintext string. If you prefer to reference your key using
+    Databricks Secrets, see `aws_access_key_id`. You must provide an API key
+    using one of the following fields: `aws_access_key_id` or
+    `aws_access_key_id_plaintext`.
+    """
+
+    aws_secret_access_key: VariableOrOptional[str]
+    """
+    The Databricks secret key reference for an AWS secret access key paired
+    with the access key ID, with permissions to interact with Bedrock
+    services. If you prefer to paste your API key directly, see
+    `aws_secret_access_key_plaintext`. You must provide an API key using one
+    of the following fields: `aws_secret_access_key` or
+    `aws_secret_access_key_plaintext`.
+    """
+
+    aws_secret_access_key_plaintext: VariableOrOptional[str]
+    """
+    An AWS secret access key paired with the access key ID, with permissions
+    to interact with Bedrock services provided as a plaintext string. If you
+    prefer to reference your key using Databricks Secrets, see
+    `aws_secret_access_key`. You must provide an API key using one of the
+    following fields: `aws_secret_access_key` or
+    `aws_secret_access_key_plaintext`.
+    """
+
+    instance_profile_arn: VariableOrOptional[str]
+    """
+    ARN of the instance profile that the external model will use to access AWS resources.
+    You must authenticate using an instance profile or access keys.
+    If you prefer to authenticate using access keys, see `aws_access_key_id`,
+    `aws_access_key_id_plaintext`, `aws_secret_access_key` and `aws_secret_access_key_plaintext`.
+    """
+
+    uc_service_credential_name: VariableOrOptional[str]
+    """
+    [Public Preview] The name of the Unity Catalog service credential that the external model uses to access AWS
+    resources.
+    """
+
+
+AmazonBedrockConfigParam = AmazonBedrockConfigDict | AmazonBedrockConfig
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/amazon_bedrock_config_bedrock_provider.py b/python/databricks/bundles/model_serving_endpoints/_models/amazon_bedrock_config_bedrock_provider.py
new file mode 100644
index 00000000000..bc3de02a2e0
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/amazon_bedrock_config_bedrock_provider.py
@@ -0,0 +1,17 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class AmazonBedrockConfigBedrockProvider(Enum):
+    ANTHROPIC = "anthropic"
+    COHERE = "cohere"
+    AI21LABS = "ai21labs"
+    AMAZON = "amazon"
+
+
+AmazonBedrockConfigBedrockProviderParam = (
+    Literal["anthropic", "cohere", "ai21labs", "amazon"]
+    | AmazonBedrockConfigBedrockProvider
+)
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/anthropic_config.py b/python/databricks/bundles/model_serving_endpoints/_models/anthropic_config.py
new file mode 100644
index 00000000000..97ab29711b0
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/anthropic_config.py
@@ -0,0 +1,62 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AnthropicConfig:
+    """"""
+
+    anthropic_api_key: VariableOrOptional[str] = None
+    """
+    The Databricks secret key reference for an Anthropic API key. If you
+    prefer to paste your API key directly, see `anthropic_api_key_plaintext`.
+    You must provide an API key using one of the following fields:
+    `anthropic_api_key` or `anthropic_api_key_plaintext`.
+    """
+
+    anthropic_api_key_plaintext: VariableOrOptional[str] = None
+    """
+    The Anthropic API key provided as a plaintext string. If you prefer to
+    reference your key using Databricks Secrets, see `anthropic_api_key`. You
+    must provide an API key using one of the following fields:
+    `anthropic_api_key` or `anthropic_api_key_plaintext`.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "AnthropicConfigDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AnthropicConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AnthropicConfigDict(TypedDict, total=False):
+    """"""
+
+    anthropic_api_key: VariableOrOptional[str]
+    """
+    The Databricks secret key reference for an Anthropic API key. If you
+    prefer to paste your API key directly, see `anthropic_api_key_plaintext`.
+    You must provide an API key using one of the following fields:
+    `anthropic_api_key` or `anthropic_api_key_plaintext`.
+    """
+
+    anthropic_api_key_plaintext: VariableOrOptional[str]
+    """
+    The Anthropic API key provided as a plaintext string. If you prefer to
+    reference your key using Databricks Secrets, see `anthropic_api_key`. You
+    must provide an API key using one of the following fields:
+    `anthropic_api_key` or `anthropic_api_key_plaintext`.
+    """
+
+
+AnthropicConfigParam = AnthropicConfigDict | AnthropicConfig
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/api_key_auth.py b/python/databricks/bundles/model_serving_endpoints/_models/api_key_auth.py
new file mode 100644
index 00000000000..a5a33f0aad5
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/api_key_auth.py
@@ -0,0 +1,64 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ApiKeyAuth:
+    """"""
+
+    key: VariableOr[str]
+    """
+    The name of the API key parameter used for authentication.
+    """
+
+    value: VariableOrOptional[str] = None
+    """
+    The Databricks secret key reference for an API Key.
+    If you prefer to paste your token directly, see `value_plaintext`.
+    """
+
+    value_plaintext: VariableOrOptional[str] = None
+    """
+    The API Key provided as a plaintext string. If you prefer to reference your
+    token using Databricks Secrets, see `value`.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "ApiKeyAuthDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ApiKeyAuthDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ApiKeyAuthDict(TypedDict, total=False):
+    """"""
+
+    key: VariableOr[str]
+    """
+    The name of the API key parameter used for authentication.
+    """
+
+    value: VariableOrOptional[str]
+    """
+    The Databricks secret key reference for an API Key.
+    If you prefer to paste your token directly, see `value_plaintext`.
+    """
+
+    value_plaintext: VariableOrOptional[str]
+    """
+    The API Key provided as a plaintext string. If you prefer to reference your
+    token using Databricks Secrets, see `value`.
+    """
+
+
+ApiKeyAuthParam = ApiKeyAuthDict | ApiKeyAuth
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/auto_capture_config_input.py b/python/databricks/bundles/model_serving_endpoints/_models/auto_capture_config_input.py
new file mode 100644
index 00000000000..b7e3a5820bb
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/auto_capture_config_input.py
@@ -0,0 +1,73 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AutoCaptureConfigInput:
+    """
+    [DEPRECATED] Deprecated: legacy inference table configuration. Please use AI Gateway inference tables instead.
+    See https://docs.databricks.com/aws/en/ai-gateway/inference-tables.
+    """
+
+    catalog_name: VariableOrOptional[str] = None
+    """
+    The name of the catalog in Unity Catalog. NOTE: On update, you cannot change the catalog name if the inference table is already enabled.
+    """
+
+    enabled: VariableOrOptional[bool] = None
+    """
+    Indicates whether the inference table is enabled.
+    """
+
+    schema_name: VariableOrOptional[str] = None
+    """
+    The name of the schema in Unity Catalog. NOTE: On update, you cannot change the schema name if the inference table is already enabled.
+    """
+
+    table_name_prefix: VariableOrOptional[str] = None
+    """
+    The prefix of the table in Unity Catalog. NOTE: On update, you cannot change the prefix name if the inference table is already enabled.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "AutoCaptureConfigInputDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AutoCaptureConfigInputDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AutoCaptureConfigInputDict(TypedDict, total=False):
+    """"""
+
+    catalog_name: VariableOrOptional[str]
+    """
+    The name of the catalog in Unity Catalog. NOTE: On update, you cannot change the catalog name if the inference table is already enabled.
+    """
+
+    enabled: VariableOrOptional[bool]
+    """
+    Indicates whether the inference table is enabled.
+    """
+
+    schema_name: VariableOrOptional[str]
+    """
+    The name of the schema in Unity Catalog. NOTE: On update, you cannot change the schema name if the inference table is already enabled.
+    """
+
+    table_name_prefix: VariableOrOptional[str]
+    """
+    The prefix of the table in Unity Catalog. NOTE: On update, you cannot change the prefix name if the inference table is already enabled.
+    """
+
+
+AutoCaptureConfigInputParam = AutoCaptureConfigInputDict | AutoCaptureConfigInput
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/bearer_token_auth.py b/python/databricks/bundles/model_serving_endpoints/_models/bearer_token_auth.py
new file mode 100644
index 00000000000..dc05f6c53c2
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/bearer_token_auth.py
@@ -0,0 +1,54 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class BearerTokenAuth:
+    """"""
+
+    token: VariableOrOptional[str] = None
+    """
+    The Databricks secret key reference for a token.
+    If you prefer to paste your token directly, see `token_plaintext`.
+    """
+
+    token_plaintext: VariableOrOptional[str] = None
+    """
+    The token provided as a plaintext string. If you prefer to reference your
+    token using Databricks Secrets, see `token`.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "BearerTokenAuthDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "BearerTokenAuthDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class BearerTokenAuthDict(TypedDict, total=False):
+    """"""
+
+    token: VariableOrOptional[str]
+    """
+    The Databricks secret key reference for a token.
+    If you prefer to paste your token directly, see `token_plaintext`.
+    """
+
+    token_plaintext: VariableOrOptional[str]
+    """
+    The token provided as a plaintext string. If you prefer to reference your
+    token using Databricks Secrets, see `token`.
+    """
+
+
+BearerTokenAuthParam = BearerTokenAuthDict | BearerTokenAuth
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/cohere_config.py b/python/databricks/bundles/model_serving_endpoints/_models/cohere_config.py
new file mode 100644
index 00000000000..e70c767e9c2
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/cohere_config.py
@@ -0,0 +1,74 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class CohereConfig:
+    """"""
+
+    cohere_api_base: VariableOrOptional[str] = None
+    """
+    This is an optional field to provide a customized base URL for the Cohere
+    API. If left unspecified, the standard Cohere base URL is used.
+    """
+
+    cohere_api_key: VariableOrOptional[str] = None
+    """
+    The Databricks secret key reference for a Cohere API key. If you prefer
+    to paste your API key directly, see `cohere_api_key_plaintext`. You must
+    provide an API key using one of the following fields: `cohere_api_key` or
+    `cohere_api_key_plaintext`.
+    """
+
+    cohere_api_key_plaintext: VariableOrOptional[str] = None
+    """
+    The Cohere API key provided as a plaintext string. If you prefer to
+    reference your key using Databricks Secrets, see `cohere_api_key`. You
+    must provide an API key using one of the following fields:
+    `cohere_api_key` or `cohere_api_key_plaintext`.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "CohereConfigDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "CohereConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class CohereConfigDict(TypedDict, total=False):
+    """"""
+
+    cohere_api_base: VariableOrOptional[str]
+    """
+    This is an optional field to provide a customized base URL for the Cohere
+    API. If left unspecified, the standard Cohere base URL is used.
+    """
+
+    cohere_api_key: VariableOrOptional[str]
+    """
+    The Databricks secret key reference for a Cohere API key. If you prefer
+    to paste your API key directly, see `cohere_api_key_plaintext`. You must
+    provide an API key using one of the following fields: `cohere_api_key` or
+    `cohere_api_key_plaintext`.
+    """
+
+    cohere_api_key_plaintext: VariableOrOptional[str]
+    """
+    The Cohere API key provided as a plaintext string. If you prefer to
+    reference your key using Databricks Secrets, see `cohere_api_key`. You
+    must provide an API key using one of the following fields:
+    `cohere_api_key` or `cohere_api_key_plaintext`.
+    """
+
+
+CohereConfigParam = CohereConfigDict | CohereConfig
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/custom_provider_config.py b/python/databricks/bundles/model_serving_endpoints/_models/custom_provider_config.py
new file mode 100644
index 00000000000..e50b61d00ff
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/custom_provider_config.py
@@ -0,0 +1,74 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+from databricks.bundles.model_serving_endpoints._models.api_key_auth import (
+    ApiKeyAuth,
+    ApiKeyAuthParam,
+)
+from databricks.bundles.model_serving_endpoints._models.bearer_token_auth import (
+    BearerTokenAuth,
+    BearerTokenAuthParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class CustomProviderConfig:
+    """
+    Configs needed to create a custom provider model route.
+    """
+
+    custom_provider_url: VariableOr[str]
+    """
+    This is a field to provide the URL of the custom provider API.
+    """
+
+    api_key_auth: VariableOrOptional[ApiKeyAuth] = None
+    """
+    This is a field to provide API key authentication for the custom provider API.
+    You can only specify one authentication method.
+    """
+
+    bearer_token_auth: VariableOrOptional[BearerTokenAuth] = None
+    """
+    This is a field to provide bearer token authentication for the custom provider API.
+    You can only specify one authentication method.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "CustomProviderConfigDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "CustomProviderConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class CustomProviderConfigDict(TypedDict, total=False):
+    """"""
+
+    custom_provider_url: VariableOr[str]
+    """
+    This is a field to provide the URL of the custom provider API.
+    """
+
+    api_key_auth: VariableOrOptional[ApiKeyAuthParam]
+    """
+    This is a field to provide API key authentication for the custom provider API.
+    You can only specify one authentication method.
+    """
+
+    bearer_token_auth: VariableOrOptional[BearerTokenAuthParam]
+    """
+    This is a field to provide bearer token authentication for the custom provider API.
+    You can only specify one authentication method.
+    """
+
+
+CustomProviderConfigParam = CustomProviderConfigDict | CustomProviderConfig
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/databricks_model_serving_config.py b/python/databricks/bundles/model_serving_endpoints/_models/databricks_model_serving_config.py
new file mode 100644
index 00000000000..72f17e7c5de
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/databricks_model_serving_config.py
@@ -0,0 +1,84 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class DatabricksModelServingConfig:
+    """"""
+
+    databricks_workspace_url: VariableOr[str]
+    """
+    The URL of the Databricks workspace containing the model serving endpoint
+    pointed to by this external model.
+    """
+
+    databricks_api_token: VariableOrOptional[str] = None
+    """
+    The Databricks secret key reference for a Databricks API token that
+    corresponds to a user or service principal with Can Query access to the
+    model serving endpoint pointed to by this external model. If you prefer
+    to paste your API key directly, see `databricks_api_token_plaintext`. You
+    must provide an API key using one of the following fields:
+    `databricks_api_token` or `databricks_api_token_plaintext`.
+    """
+
+    databricks_api_token_plaintext: VariableOrOptional[str] = None
+    """
+    The Databricks API token that corresponds to a user or service principal
+    with Can Query access to the model serving endpoint pointed to by this
+    external model provided as a plaintext string. If you prefer to reference
+    your key using Databricks Secrets, see `databricks_api_token`. You must
+    provide an API key using one of the following fields:
+    `databricks_api_token` or `databricks_api_token_plaintext`.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "DatabricksModelServingConfigDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "DatabricksModelServingConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class DatabricksModelServingConfigDict(TypedDict, total=False):
+    """"""
+
+    databricks_workspace_url: VariableOr[str]
+    """
+    The URL of the Databricks workspace containing the model serving endpoint
+    pointed to by this external model.
+    """
+
+    databricks_api_token: VariableOrOptional[str]
+    """
+    The Databricks secret key reference for a Databricks API token that
+    corresponds to a user or service principal with Can Query access to the
+    model serving endpoint pointed to by this external model. If you prefer
+    to paste your API key directly, see `databricks_api_token_plaintext`. You
+    must provide an API key using one of the following fields:
+    `databricks_api_token` or `databricks_api_token_plaintext`.
+    """
+
+    databricks_api_token_plaintext: VariableOrOptional[str]
+    """
+    The Databricks API token that corresponds to a user or service principal
+    with Can Query access to the model serving endpoint pointed to by this
+    external model provided as a plaintext string. If you prefer to reference
+    your key using Databricks Secrets, see `databricks_api_token`. You must
+    provide an API key using one of the following fields:
+    `databricks_api_token` or `databricks_api_token_plaintext`.
+    """
+
+
+DatabricksModelServingConfigParam = (
+    DatabricksModelServingConfigDict | DatabricksModelServingConfig
+)
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/email_notifications.py b/python/databricks/bundles/model_serving_endpoints/_models/email_notifications.py
new file mode 100644
index 00000000000..3eaeb0a8358
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/email_notifications.py
@@ -0,0 +1,50 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class EmailNotifications:
+    """"""
+
+    on_update_failure: VariableOrList[str] = field(default_factory=list)
+    """
+    A list of email addresses to be notified when an endpoint fails to update its configuration or state.
+    """
+
+    on_update_success: VariableOrList[str] = field(default_factory=list)
+    """
+    A list of email addresses to be notified when an endpoint successfully updates its configuration or state.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "EmailNotificationsDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "EmailNotificationsDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class EmailNotificationsDict(TypedDict, total=False):
+    """"""
+
+    on_update_failure: VariableOrList[str]
+    """
+    A list of email addresses to be notified when an endpoint fails to update its configuration or state.
+    """
+
+    on_update_success: VariableOrList[str]
+    """
+    A list of email addresses to be notified when an endpoint successfully updates its configuration or state.
+    """
+
+
+EmailNotificationsParam = EmailNotificationsDict | EmailNotifications
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/endpoint_core_config_input.py b/python/databricks/bundles/model_serving_endpoints/_models/endpoint_core_config_input.py
new file mode 100644
index 00000000000..b74a53e067d
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/endpoint_core_config_input.py
@@ -0,0 +1,92 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
+from databricks.bundles.model_serving_endpoints._models.auto_capture_config_input import (
+    AutoCaptureConfigInput,
+    AutoCaptureConfigInputParam,
+)
+from databricks.bundles.model_serving_endpoints._models.served_entity_input import (
+    ServedEntityInput,
+    ServedEntityInputParam,
+)
+from databricks.bundles.model_serving_endpoints._models.served_model_input import (
+    ServedModelInput,
+    ServedModelInputParam,
+)
+from databricks.bundles.model_serving_endpoints._models.traffic_config import (
+    TrafficConfig,
+    TrafficConfigParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class EndpointCoreConfigInput:
+    """"""
+
+    auto_capture_config: VariableOrOptional[AutoCaptureConfigInput] = None
+    """
+    [DEPRECATED] Configuration for legacy Inference Tables which automatically log requests and responses to Unity
+    Catalog.
+    Deprecated: please use AI Gateway inference tables instead. See
+    https://docs.databricks.com/aws/en/ai-gateway/inference-tables.
+    """
+
+    served_entities: VariableOrList[ServedEntityInput] = field(default_factory=list)
+    """
+    The list of served entities under the serving endpoint config.
+    """
+
+    served_models: VariableOrList[ServedModelInput] = field(default_factory=list)
+    """
+    (Deprecated, use served_entities instead) The list of served models under the serving endpoint config.
+    """
+
+    traffic_config: VariableOrOptional[TrafficConfig] = None
+    """
+    The traffic configuration associated with the serving endpoint config.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "EndpointCoreConfigInputDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "EndpointCoreConfigInputDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class EndpointCoreConfigInputDict(TypedDict, total=False):
+    """"""
+
+    auto_capture_config: VariableOrOptional[AutoCaptureConfigInputParam]
+    """
+    [DEPRECATED] Configuration for legacy Inference Tables which automatically log requests and responses to Unity
+    Catalog.
+    Deprecated: please use AI Gateway inference tables instead. See
+    https://docs.databricks.com/aws/en/ai-gateway/inference-tables.
+    """
+
+    served_entities: VariableOrList[ServedEntityInputParam]
+    """
+    The list of served entities under the serving endpoint config.
+    """
+
+    served_models: VariableOrList[ServedModelInputParam]
+    """
+    (Deprecated, use served_entities instead) The list of served models under the serving endpoint config.
+    """
+
+    traffic_config: VariableOrOptional[TrafficConfigParam]
+    """
+    The traffic configuration associated with the serving endpoint config.
+    """
+
+
+EndpointCoreConfigInputParam = EndpointCoreConfigInputDict | EndpointCoreConfigInput
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/endpoint_tag.py b/python/databricks/bundles/model_serving_endpoints/_models/endpoint_tag.py
new file mode 100644
index 00000000000..ee2bc8943d1
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/endpoint_tag.py
@@ -0,0 +1,50 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class EndpointTag:
+    """"""
+
+    key: VariableOr[str]
+    """
+    Key field for a serving endpoint tag.
+    """
+
+    value: VariableOrOptional[str] = None
+    """
+    Optional value field for a serving endpoint tag.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "EndpointTagDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "EndpointTagDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class EndpointTagDict(TypedDict, total=False):
+    """"""
+
+    key: VariableOr[str]
+    """
+    Key field for a serving endpoint tag.
+    """
+
+    value: VariableOrOptional[str]
+    """
+    Optional value field for a serving endpoint tag.
+    """
+
+
+EndpointTagParam = EndpointTagDict | EndpointTag
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/external_model.py b/python/databricks/bundles/model_serving_endpoints/_models/external_model.py
new file mode 100644
index 00000000000..0f2fe2a6224
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/external_model.py
@@ -0,0 +1,194 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+from databricks.bundles.model_serving_endpoints._models.ai21_labs_config import (
+    Ai21LabsConfig,
+    Ai21LabsConfigParam,
+)
+from databricks.bundles.model_serving_endpoints._models.amazon_bedrock_config import (
+    AmazonBedrockConfig,
+    AmazonBedrockConfigParam,
+)
+from databricks.bundles.model_serving_endpoints._models.anthropic_config import (
+    AnthropicConfig,
+    AnthropicConfigParam,
+)
+from databricks.bundles.model_serving_endpoints._models.cohere_config import (
+    CohereConfig,
+    CohereConfigParam,
+)
+from databricks.bundles.model_serving_endpoints._models.custom_provider_config import (
+    CustomProviderConfig,
+    CustomProviderConfigParam,
+)
+from databricks.bundles.model_serving_endpoints._models.databricks_model_serving_config import (
+    DatabricksModelServingConfig,
+    DatabricksModelServingConfigParam,
+)
+from databricks.bundles.model_serving_endpoints._models.external_model_provider import (
+    ExternalModelProvider,
+    ExternalModelProviderParam,
+)
+from databricks.bundles.model_serving_endpoints._models.google_cloud_vertex_ai_config import (
+    GoogleCloudVertexAiConfig,
+    GoogleCloudVertexAiConfigParam,
+)
+from databricks.bundles.model_serving_endpoints._models.open_ai_config import (
+    OpenAiConfig,
+    OpenAiConfigParam,
+)
+from databricks.bundles.model_serving_endpoints._models.pa_lm_config import (
+    PaLmConfig,
+    PaLmConfigParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ExternalModel:
+    """"""
+
+    name: VariableOr[str]
+    """
+    The name of the external model.
+    """
+
+    provider: VariableOr[ExternalModelProvider]
+    """
+    The name of the provider for the external model. Currently, the supported providers are 'ai21labs', 'anthropic', 'amazon-bedrock', 'cohere', 'databricks-model-serving', 'google-cloud-vertex-ai', 'openai', 'palm', and 'custom'.
+    """
+
+    task: VariableOr[str]
+    """
+    The task type of the external model.
+    """
+
+    ai21labs_config: VariableOrOptional[Ai21LabsConfig] = None
+    """
+    AI21Labs Config. Only required if the provider is 'ai21labs'.
+    """
+
+    amazon_bedrock_config: VariableOrOptional[AmazonBedrockConfig] = None
+    """
+    Amazon Bedrock Config. Only required if the provider is 'amazon-bedrock'.
+    """
+
+    anthropic_config: VariableOrOptional[AnthropicConfig] = None
+    """
+    Anthropic Config. Only required if the provider is 'anthropic'.
+    """
+
+    cohere_config: VariableOrOptional[CohereConfig] = None
+    """
+    Cohere Config. Only required if the provider is 'cohere'.
+    """
+
+    custom_provider_config: VariableOrOptional[CustomProviderConfig] = None
+    """
+    Custom Provider Config. Only required if the provider is 'custom'.
+    """
+
+    databricks_model_serving_config: VariableOrOptional[
+        DatabricksModelServingConfig
+    ] = None
+    """
+    Databricks Model Serving Config. Only required if the provider is 'databricks-model-serving'.
+    """
+
+    google_cloud_vertex_ai_config: VariableOrOptional[GoogleCloudVertexAiConfig] = None
+    """
+    Google Cloud Vertex AI Config. Only required if the provider is 'google-cloud-vertex-ai'.
+    """
+
+    openai_config: VariableOrOptional[OpenAiConfig] = None
+    """
+    OpenAI Config. Only required if the provider is 'openai'.
+    """
+
+    palm_config: VariableOrOptional[PaLmConfig] = None
+    """
+    PaLM Config. Only required if the provider is 'palm'.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "ExternalModelDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ExternalModelDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ExternalModelDict(TypedDict, total=False):
+    """"""
+
+    name: VariableOr[str]
+    """
+    The name of the external model.
+    """
+
+    provider: VariableOr[ExternalModelProviderParam]
+    """
+    The name of the provider for the external model. Currently, the supported providers are 'ai21labs', 'anthropic', 'amazon-bedrock', 'cohere', 'databricks-model-serving', 'google-cloud-vertex-ai', 'openai', 'palm', and 'custom'.
+    """
+
+    task: VariableOr[str]
+    """
+    The task type of the external model.
+    """
+
+    ai21labs_config: VariableOrOptional[Ai21LabsConfigParam]
+    """
+    AI21Labs Config. Only required if the provider is 'ai21labs'.
+    """
+
+    amazon_bedrock_config: VariableOrOptional[AmazonBedrockConfigParam]
+    """
+    Amazon Bedrock Config. Only required if the provider is 'amazon-bedrock'.
+    """
+
+    anthropic_config: VariableOrOptional[AnthropicConfigParam]
+    """
+    Anthropic Config. Only required if the provider is 'anthropic'.
+    """
+
+    cohere_config: VariableOrOptional[CohereConfigParam]
+    """
+    Cohere Config. Only required if the provider is 'cohere'.
+    """
+
+    custom_provider_config: VariableOrOptional[CustomProviderConfigParam]
+    """
+    Custom Provider Config. Only required if the provider is 'custom'.
+    """
+
+    databricks_model_serving_config: VariableOrOptional[
+        DatabricksModelServingConfigParam
+    ]
+    """
+    Databricks Model Serving Config. Only required if the provider is 'databricks-model-serving'.
+    """
+
+    google_cloud_vertex_ai_config: VariableOrOptional[GoogleCloudVertexAiConfigParam]
+    """
+    Google Cloud Vertex AI Config. Only required if the provider is 'google-cloud-vertex-ai'.
+    """
+
+    openai_config: VariableOrOptional[OpenAiConfigParam]
+    """
+    OpenAI Config. Only required if the provider is 'openai'.
+    """
+
+    palm_config: VariableOrOptional[PaLmConfigParam]
+    """
+    PaLM Config. Only required if the provider is 'palm'.
+    """
+
+
+ExternalModelParam = ExternalModelDict | ExternalModel
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/external_model_provider.py b/python/databricks/bundles/model_serving_endpoints/_models/external_model_provider.py
new file mode 100644
index 00000000000..ee3ef3e0c08
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/external_model_provider.py
@@ -0,0 +1,32 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class ExternalModelProvider(Enum):
+    AI21LABS = "ai21labs"
+    ANTHROPIC = "anthropic"
+    AMAZON_BEDROCK = "amazon-bedrock"
+    COHERE = "cohere"
+    DATABRICKS_MODEL_SERVING = "databricks-model-serving"
+    GOOGLE_CLOUD_VERTEX_AI = "google-cloud-vertex-ai"
+    OPENAI = "openai"
+    PALM = "palm"
+    CUSTOM = "custom"
+
+
+ExternalModelProviderParam = (
+    Literal[
+        "ai21labs",
+        "anthropic",
+        "amazon-bedrock",
+        "cohere",
+        "databricks-model-serving",
+        "google-cloud-vertex-ai",
+        "openai",
+        "palm",
+        "custom",
+    ]
+    | ExternalModelProvider
+)
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/fallback_config.py b/python/databricks/bundles/model_serving_endpoints/_models/fallback_config.py
new file mode 100644
index 00000000000..c96493b0982
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/fallback_config.py
@@ -0,0 +1,46 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class FallbackConfig:
+    """"""
+
+    enabled: VariableOr[bool]
+    """
+    Whether to enable traffic fallback. When a served entity in the serving endpoint returns specific error
+    codes (e.g. 500), the request will automatically be round-robin attempted with other served entities in the same
+    endpoint, following the order of served entity list, until a successful response is returned.
+    If all attempts fail, return the last response with the error code.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "FallbackConfigDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "FallbackConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class FallbackConfigDict(TypedDict, total=False):
+    """"""
+
+    enabled: VariableOr[bool]
+    """
+    Whether to enable traffic fallback. When a served entity in the serving endpoint returns specific error
+    codes (e.g. 500), the request will automatically be round-robin attempted with other served entities in the same
+    endpoint, following the order of served entity list, until a successful response is returned.
+    If all attempts fail, return the last response with the error code.
+    """
+
+
+FallbackConfigParam = FallbackConfigDict | FallbackConfig
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/google_cloud_vertex_ai_config.py b/python/databricks/bundles/model_serving_endpoints/_models/google_cloud_vertex_ai_config.py
new file mode 100644
index 00000000000..5b8e3030f56
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/google_cloud_vertex_ai_config.py
@@ -0,0 +1,110 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class GoogleCloudVertexAiConfig:
+    """"""
+
+    project_id: VariableOr[str]
+    """
+    This is the Google Cloud project id that the service account is
+    associated with.
+    """
+
+    region: VariableOr[str]
+    """
+    This is the region for the Google Cloud Vertex AI Service. See [supported
+    regions] for more details. Some models are only available in specific
+    regions.
+    
+    [supported regions]: https://cloud.google.com/vertex-ai/docs/general/locations
+    """
+
+    private_key: VariableOrOptional[str] = None
+    """
+    The Databricks secret key reference for a private key for the service
+    account which has access to the Google Cloud Vertex AI Service. See [Best
+    practices for managing service account keys]. If you prefer to paste your
+    API key directly, see `private_key_plaintext`. You must provide an API
+    key using one of the following fields: `private_key` or
+    `private_key_plaintext`
+    
+    [Best practices for managing service account keys]: https://cloud.google.com/iam/docs/best-practices-for-managing-service-account-keys
+    """
+
+    private_key_plaintext: VariableOrOptional[str] = None
+    """
+    The private key for the service account which has access to the Google
+    Cloud Vertex AI Service provided as a plaintext secret. See [Best
+    practices for managing service account keys]. If you prefer to reference
+    your key using Databricks Secrets, see `private_key`. You must provide an
+    API key using one of the following fields: `private_key` or
+    `private_key_plaintext`.
+    
+    [Best practices for managing service account keys]: https://cloud.google.com/iam/docs/best-practices-for-managing-service-account-keys
+    """
+
+    @classmethod
+    def from_dict(cls, value: "GoogleCloudVertexAiConfigDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "GoogleCloudVertexAiConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class GoogleCloudVertexAiConfigDict(TypedDict, total=False):
+    """"""
+
+    project_id: VariableOr[str]
+    """
+    This is the Google Cloud project id that the service account is
+    associated with.
+    """
+
+    region: VariableOr[str]
+    """
+    This is the region for the Google Cloud Vertex AI Service. See [supported
+    regions] for more details. Some models are only available in specific
+    regions.
+    
+    [supported regions]: https://cloud.google.com/vertex-ai/docs/general/locations
+    """
+
+    private_key: VariableOrOptional[str]
+    """
+    The Databricks secret key reference for a private key for the service
+    account which has access to the Google Cloud Vertex AI Service. See [Best
+    practices for managing service account keys]. If you prefer to paste your
+    API key directly, see `private_key_plaintext`. You must provide an API
+    key using one of the following fields: `private_key` or
+    `private_key_plaintext`
+    
+    [Best practices for managing service account keys]: https://cloud.google.com/iam/docs/best-practices-for-managing-service-account-keys
+    """
+
+    private_key_plaintext: VariableOrOptional[str]
+    """
+    The private key for the service account which has access to the Google
+    Cloud Vertex AI Service provided as a plaintext secret. See [Best
+    practices for managing service account keys]. If you prefer to reference
+    your key using Databricks Secrets, see `private_key`. You must provide an
+    API key using one of the following fields: `private_key` or
+    `private_key_plaintext`.
+    
+    [Best practices for managing service account keys]: https://cloud.google.com/iam/docs/best-practices-for-managing-service-account-keys
+    """
+
+
+GoogleCloudVertexAiConfigParam = (
+    GoogleCloudVertexAiConfigDict | GoogleCloudVertexAiConfig
+)
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/lifecycle.py b/python/databricks/bundles/model_serving_endpoints/_models/lifecycle.py
new file mode 100644
index 00000000000..697776a198e
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/lifecycle.py
@@ -0,0 +1,40 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class Lifecycle:
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool] = None
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "LifecycleDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "LifecycleDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class LifecycleDict(TypedDict, total=False):
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool]
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+
+LifecycleParam = LifecycleDict | Lifecycle
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/model_serving_endpoint.py b/python/databricks/bundles/model_serving_endpoints/_models/model_serving_endpoint.py
new file mode 100644
index 00000000000..64ecfbd87d1
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/model_serving_endpoint.py
@@ -0,0 +1,185 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._resource import Resource
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import (
+    VariableOr,
+    VariableOrList,
+    VariableOrOptional,
+)
+from databricks.bundles.model_serving_endpoints._models.ai_gateway_config import (
+    AiGatewayConfig,
+    AiGatewayConfigParam,
+)
+from databricks.bundles.model_serving_endpoints._models.email_notifications import (
+    EmailNotifications,
+    EmailNotificationsParam,
+)
+from databricks.bundles.model_serving_endpoints._models.endpoint_core_config_input import (
+    EndpointCoreConfigInput,
+    EndpointCoreConfigInputParam,
+)
+from databricks.bundles.model_serving_endpoints._models.endpoint_tag import (
+    EndpointTag,
+    EndpointTagParam,
+)
+from databricks.bundles.model_serving_endpoints._models.lifecycle import (
+    Lifecycle,
+    LifecycleParam,
+)
+from databricks.bundles.model_serving_endpoints._models.model_serving_endpoint_permission import (
+    ModelServingEndpointPermission,
+    ModelServingEndpointPermissionParam,
+)
+from databricks.bundles.model_serving_endpoints._models.rate_limit import (
+    RateLimit,
+    RateLimitParam,
+)
+from databricks.bundles.model_serving_endpoints._models.telemetry_config import (
+    TelemetryConfig,
+    TelemetryConfigParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ModelServingEndpoint(Resource):
+    """"""
+
+    name: VariableOr[str]
+    """
+    The name of the serving endpoint. This field is required and must be unique across a Databricks workspace.
+    An endpoint name can consist of alphanumeric characters, dashes, and underscores.
+    """
+
+    ai_gateway: VariableOrOptional[AiGatewayConfig] = None
+    """
+    The AI Gateway configuration for the serving endpoint. NOTE: External model, provisioned throughput, and pay-per-token endpoints are fully supported; agent endpoints currently only support inference tables.
+    """
+
+    budget_policy_id: VariableOrOptional[str] = None
+    """
+    The budget policy to be applied to the serving endpoint.
+    """
+
+    config: VariableOrOptional[EndpointCoreConfigInput] = None
+    """
+    The core config of the serving endpoint.
+    """
+
+    description: VariableOrOptional[str] = None
+
+    email_notifications: VariableOrOptional[EmailNotifications] = None
+    """
+    Email notification settings.
+    """
+
+    lifecycle: VariableOrOptional[Lifecycle] = None
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+    permissions: VariableOrList[ModelServingEndpointPermission] = field(
+        default_factory=list
+    )
+    """
+    The permissions to apply to this resource.
+    """
+
+    rate_limits: VariableOrList[RateLimit] = field(default_factory=list)
+    """
+    [DEPRECATED] Rate limits to be applied to the serving endpoint. NOTE: this field is deprecated, please use AI Gateway to manage rate limits.
+    """
+
+    route_optimized: VariableOrOptional[bool] = None
+    """
+    Enable route optimization for the serving endpoint.
+    """
+
+    tags: VariableOrList[EndpointTag] = field(default_factory=list)
+    """
+    Tags to be attached to the serving endpoint and automatically propagated to billing logs.
+    """
+
+    telemetry_config: VariableOrOptional[TelemetryConfig] = None
+    """
+    [Public Preview] Configuration for persisting endpoint telemetry (logs, traces, and metrics) to Unity Catalog tables.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "ModelServingEndpointDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ModelServingEndpointDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ModelServingEndpointDict(TypedDict, total=False):
+    """"""
+
+    name: VariableOr[str]
+    """
+    The name of the serving endpoint. This field is required and must be unique across a Databricks workspace.
+    An endpoint name can consist of alphanumeric characters, dashes, and underscores.
+    """
+
+    ai_gateway: VariableOrOptional[AiGatewayConfigParam]
+    """
+    The AI Gateway configuration for the serving endpoint. NOTE: External model, provisioned throughput, and pay-per-token endpoints are fully supported; agent endpoints currently only support inference tables.
+    """
+
+    budget_policy_id: VariableOrOptional[str]
+    """
+    The budget policy to be applied to the serving endpoint.
+    """
+
+    config: VariableOrOptional[EndpointCoreConfigInputParam]
+    """
+    The core config of the serving endpoint.
+    """
+
+    description: VariableOrOptional[str]
+
+    email_notifications: VariableOrOptional[EmailNotificationsParam]
+    """
+    Email notification settings.
+    """
+
+    lifecycle: VariableOrOptional[LifecycleParam]
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+    permissions: VariableOrList[ModelServingEndpointPermissionParam]
+    """
+    The permissions to apply to this resource.
+    """
+
+    rate_limits: VariableOrList[RateLimitParam]
+    """
+    [DEPRECATED] Rate limits to be applied to the serving endpoint. NOTE: this field is deprecated, please use AI Gateway to manage rate limits.
+    """
+
+    route_optimized: VariableOrOptional[bool]
+    """
+    Enable route optimization for the serving endpoint.
+    """
+
+    tags: VariableOrList[EndpointTagParam]
+    """
+    Tags to be attached to the serving endpoint and automatically propagated to billing logs.
+    """
+
+    telemetry_config: VariableOrOptional[TelemetryConfigParam]
+    """
+    [Public Preview] Configuration for persisting endpoint telemetry (logs, traces, and metrics) to Unity Catalog tables.
+    """
+
+
+ModelServingEndpointParam = ModelServingEndpointDict | ModelServingEndpoint
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/model_serving_endpoint_permission.py b/python/databricks/bundles/model_serving_endpoints/_models/model_serving_endpoint_permission.py
new file mode 100644
index 00000000000..82e2fdc054a
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/model_serving_endpoint_permission.py
@@ -0,0 +1,76 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+from databricks.bundles.model_serving_endpoints._models.serving_endpoint_permission_level import (
+    ServingEndpointPermissionLevel,
+    ServingEndpointPermissionLevelParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ModelServingEndpointPermission:
+    """"""
+
+    level: VariableOr[ServingEndpointPermissionLevel]
+    """
+    The permission level to apply. The allowed levels depend on the resource type.
+    """
+
+    group_name: VariableOrOptional[str] = None
+    """
+    The name of the group granted the permission level.
+    """
+
+    service_principal_name: VariableOrOptional[str] = None
+    """
+    The name of the service principal granted the permission level.
+    """
+
+    user_name: VariableOrOptional[str] = None
+    """
+    The name of the user granted the permission level.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "ModelServingEndpointPermissionDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ModelServingEndpointPermissionDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ModelServingEndpointPermissionDict(TypedDict, total=False):
+    """"""
+
+    level: VariableOr[ServingEndpointPermissionLevelParam]
+    """
+    The permission level to apply. The allowed levels depend on the resource type.
+    """
+
+    group_name: VariableOrOptional[str]
+    """
+    The name of the group granted the permission level.
+    """
+
+    service_principal_name: VariableOrOptional[str]
+    """
+    The name of the service principal granted the permission level.
+    """
+
+    user_name: VariableOrOptional[str]
+    """
+    The name of the user granted the permission level.
+    """
+
+
+ModelServingEndpointPermissionParam = (
+    ModelServingEndpointPermissionDict | ModelServingEndpointPermission
+)
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/open_ai_config.py b/python/databricks/bundles/model_serving_endpoints/_models/open_ai_config.py
new file mode 100644
index 00000000000..e19a4eac665
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/open_ai_config.py
@@ -0,0 +1,200 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class OpenAiConfig:
+    """
+    Configs needed to create an OpenAI model route.
+    """
+
+    microsoft_entra_client_id: VariableOrOptional[str] = None
+    """
+    This field is only required for Azure AD OpenAI and is the Microsoft
+    Entra Client ID.
+    """
+
+    microsoft_entra_client_secret: VariableOrOptional[str] = None
+    """
+    The Databricks secret key reference for a client secret used for
+    Microsoft Entra ID authentication. If you prefer to paste your client
+    secret directly, see `microsoft_entra_client_secret_plaintext`. You must
+    provide an API key using one of the following fields:
+    `microsoft_entra_client_secret` or
+    `microsoft_entra_client_secret_plaintext`.
+    """
+
+    microsoft_entra_client_secret_plaintext: VariableOrOptional[str] = None
+    """
+    The client secret used for Microsoft Entra ID authentication provided as
+    a plaintext string. If you prefer to reference your key using Databricks
+    Secrets, see `microsoft_entra_client_secret`. You must provide an API key
+    using one of the following fields: `microsoft_entra_client_secret` or
+    `microsoft_entra_client_secret_plaintext`.
+    """
+
+    microsoft_entra_tenant_id: VariableOrOptional[str] = None
+    """
+    This field is only required for Azure AD OpenAI and is the Microsoft
+    Entra Tenant ID.
+    """
+
+    openai_api_base: VariableOrOptional[str] = None
+    """
+    This is a field to provide a customized base URl for the OpenAI API. For
+    Azure OpenAI, this field is required, and is the base URL for the Azure
+    OpenAI API service provided by Azure. For other OpenAI API types, this
+    field is optional, and if left unspecified, the standard OpenAI base URL
+    is used.
+    """
+
+    openai_api_key: VariableOrOptional[str] = None
+    """
+    The Databricks secret key reference for an OpenAI API key using the
+    OpenAI or Azure service. If you prefer to paste your API key directly,
+    see `openai_api_key_plaintext`. You must provide an API key using one of
+    the following fields: `openai_api_key` or `openai_api_key_plaintext`.
+    """
+
+    openai_api_key_plaintext: VariableOrOptional[str] = None
+    """
+    The OpenAI API key using the OpenAI or Azure service provided as a
+    plaintext string. If you prefer to reference your key using Databricks
+    Secrets, see `openai_api_key`. You must provide an API key using one of
+    the following fields: `openai_api_key` or `openai_api_key_plaintext`.
+    """
+
+    openai_api_type: VariableOrOptional[str] = None
+    """
+    This is an optional field to specify the type of OpenAI API to use. For
+    Azure OpenAI, this field is required, and adjust this parameter to
+    represent the preferred security access validation protocol. For access
+    token validation, use azure. For authentication using Azure Active
+    Directory (Azure AD) use, azuread.
+    """
+
+    openai_api_version: VariableOrOptional[str] = None
+    """
+    This is an optional field to specify the OpenAI API version. For Azure
+    OpenAI, this field is required, and is the version of the Azure OpenAI
+    service to utilize, specified by a date.
+    """
+
+    openai_deployment_name: VariableOrOptional[str] = None
+    """
+    This field is only required for Azure OpenAI and is the name of the
+    deployment resource for the Azure OpenAI service.
+    """
+
+    openai_organization: VariableOrOptional[str] = None
+    """
+    This is an optional field to specify the organization in OpenAI or Azure
+    OpenAI.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "OpenAiConfigDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "OpenAiConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class OpenAiConfigDict(TypedDict, total=False):
+    """"""
+
+    microsoft_entra_client_id: VariableOrOptional[str]
+    """
+    This field is only required for Azure AD OpenAI and is the Microsoft
+    Entra Client ID.
+    """
+
+    microsoft_entra_client_secret: VariableOrOptional[str]
+    """
+    The Databricks secret key reference for a client secret used for
+    Microsoft Entra ID authentication. If you prefer to paste your client
+    secret directly, see `microsoft_entra_client_secret_plaintext`. You must
+    provide an API key using one of the following fields:
+    `microsoft_entra_client_secret` or
+    `microsoft_entra_client_secret_plaintext`.
+    """
+
+    microsoft_entra_client_secret_plaintext: VariableOrOptional[str]
+    """
+    The client secret used for Microsoft Entra ID authentication provided as
+    a plaintext string. If you prefer to reference your key using Databricks
+    Secrets, see `microsoft_entra_client_secret`. You must provide an API key
+    using one of the following fields: `microsoft_entra_client_secret` or
+    `microsoft_entra_client_secret_plaintext`.
+    """
+
+    microsoft_entra_tenant_id: VariableOrOptional[str]
+    """
+    This field is only required for Azure AD OpenAI and is the Microsoft
+    Entra Tenant ID.
+    """
+
+    openai_api_base: VariableOrOptional[str]
+    """
+    This is a field to provide a customized base URl for the OpenAI API. For
+    Azure OpenAI, this field is required, and is the base URL for the Azure
+    OpenAI API service provided by Azure. For other OpenAI API types, this
+    field is optional, and if left unspecified, the standard OpenAI base URL
+    is used.
+    """
+
+    openai_api_key: VariableOrOptional[str]
+    """
+    The Databricks secret key reference for an OpenAI API key using the
+    OpenAI or Azure service. If you prefer to paste your API key directly,
+    see `openai_api_key_plaintext`. You must provide an API key using one of
+    the following fields: `openai_api_key` or `openai_api_key_plaintext`.
+    """
+
+    openai_api_key_plaintext: VariableOrOptional[str]
+    """
+    The OpenAI API key using the OpenAI or Azure service provided as a
+    plaintext string. If you prefer to reference your key using Databricks
+    Secrets, see `openai_api_key`. You must provide an API key using one of
+    the following fields: `openai_api_key` or `openai_api_key_plaintext`.
+    """
+
+    openai_api_type: VariableOrOptional[str]
+    """
+    This is an optional field to specify the type of OpenAI API to use. For
+    Azure OpenAI, this field is required, and adjust this parameter to
+    represent the preferred security access validation protocol. For access
+    token validation, use azure. For authentication using Azure Active
+    Directory (Azure AD) use, azuread.
+    """
+
+    openai_api_version: VariableOrOptional[str]
+    """
+    This is an optional field to specify the OpenAI API version. For Azure
+    OpenAI, this field is required, and is the version of the Azure OpenAI
+    service to utilize, specified by a date.
+    """
+
+    openai_deployment_name: VariableOrOptional[str]
+    """
+    This field is only required for Azure OpenAI and is the name of the
+    deployment resource for the Azure OpenAI service.
+    """
+
+    openai_organization: VariableOrOptional[str]
+    """
+    This is an optional field to specify the organization in OpenAI or Azure
+    OpenAI.
+    """
+
+
+OpenAiConfigParam = OpenAiConfigDict | OpenAiConfig
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/pa_lm_config.py b/python/databricks/bundles/model_serving_endpoints/_models/pa_lm_config.py
new file mode 100644
index 00000000000..98e5c572687
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/pa_lm_config.py
@@ -0,0 +1,62 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class PaLmConfig:
+    """"""
+
+    palm_api_key: VariableOrOptional[str] = None
+    """
+    The Databricks secret key reference for a PaLM API key. If you prefer to
+    paste your API key directly, see `palm_api_key_plaintext`. You must
+    provide an API key using one of the following fields: `palm_api_key` or
+    `palm_api_key_plaintext`.
+    """
+
+    palm_api_key_plaintext: VariableOrOptional[str] = None
+    """
+    The PaLM API key provided as a plaintext string. If you prefer to
+    reference your key using Databricks Secrets, see `palm_api_key`. You must
+    provide an API key using one of the following fields: `palm_api_key` or
+    `palm_api_key_plaintext`.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "PaLmConfigDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "PaLmConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class PaLmConfigDict(TypedDict, total=False):
+    """"""
+
+    palm_api_key: VariableOrOptional[str]
+    """
+    The Databricks secret key reference for a PaLM API key. If you prefer to
+    paste your API key directly, see `palm_api_key_plaintext`. You must
+    provide an API key using one of the following fields: `palm_api_key` or
+    `palm_api_key_plaintext`.
+    """
+
+    palm_api_key_plaintext: VariableOrOptional[str]
+    """
+    The PaLM API key provided as a plaintext string. If you prefer to
+    reference your key using Databricks Secrets, see `palm_api_key`. You must
+    provide an API key using one of the following fields: `palm_api_key` or
+    `palm_api_key_plaintext`.
+    """
+
+
+PaLmConfigParam = PaLmConfigDict | PaLmConfig
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/rate_limit.py b/python/databricks/bundles/model_serving_endpoints/_models/rate_limit.py
new file mode 100644
index 00000000000..5a0192df8ce
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/rate_limit.py
@@ -0,0 +1,70 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+from databricks.bundles.model_serving_endpoints._models.rate_limit_key import (
+    RateLimitKey,
+    RateLimitKeyParam,
+)
+from databricks.bundles.model_serving_endpoints._models.rate_limit_renewal_period import (
+    RateLimitRenewalPeriod,
+    RateLimitRenewalPeriodParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class RateLimit:
+    """
+    [DEPRECATED]
+    """
+
+    calls: VariableOr[int]
+    """
+    Used to specify how many calls are allowed for a key within the renewal_period.
+    """
+
+    renewal_period: VariableOr[RateLimitRenewalPeriod]
+    """
+    Renewal period field for a serving endpoint rate limit. Currently, only 'minute' is supported.
+    """
+
+    key: VariableOrOptional[RateLimitKey] = None
+    """
+    Key field for a serving endpoint rate limit. Currently, only 'user' and 'endpoint' are supported, with 'endpoint' being the default if not specified.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "RateLimitDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "RateLimitDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class RateLimitDict(TypedDict, total=False):
+    """"""
+
+    calls: VariableOr[int]
+    """
+    Used to specify how many calls are allowed for a key within the renewal_period.
+    """
+
+    renewal_period: VariableOr[RateLimitRenewalPeriodParam]
+    """
+    Renewal period field for a serving endpoint rate limit. Currently, only 'minute' is supported.
+    """
+
+    key: VariableOrOptional[RateLimitKeyParam]
+    """
+    Key field for a serving endpoint rate limit. Currently, only 'user' and 'endpoint' are supported, with 'endpoint' being the default if not specified.
+    """
+
+
+RateLimitParam = RateLimitDict | RateLimit
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/rate_limit_key.py b/python/databricks/bundles/model_serving_endpoints/_models/rate_limit_key.py
new file mode 100644
index 00000000000..b6ebe9db1c4
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/rate_limit_key.py
@@ -0,0 +1,16 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class RateLimitKey(Enum):
+    """
+    [DEPRECATED]
+    """
+
+    USER = "user"
+    ENDPOINT = "endpoint"
+
+
+RateLimitKeyParam = Literal["user", "endpoint"] | RateLimitKey
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/rate_limit_renewal_period.py b/python/databricks/bundles/model_serving_endpoints/_models/rate_limit_renewal_period.py
new file mode 100644
index 00000000000..81f900bf39f
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/rate_limit_renewal_period.py
@@ -0,0 +1,15 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class RateLimitRenewalPeriod(Enum):
+    """
+    [DEPRECATED]
+    """
+
+    MINUTE = "minute"
+
+
+RateLimitRenewalPeriodParam = Literal["minute"] | RateLimitRenewalPeriod
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/route.py b/python/databricks/bundles/model_serving_endpoints/_models/route.py
new file mode 100644
index 00000000000..eba4336b0fc
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/route.py
@@ -0,0 +1,54 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class Route:
+    """"""
+
+    traffic_percentage: VariableOr[int]
+    """
+    The percentage of endpoint traffic to send to this route. It must be an integer between 0 and 100 inclusive.
+    """
+
+    served_entity_name: VariableOrOptional[str] = None
+
+    served_model_name: VariableOrOptional[str] = None
+    """
+    The name of the served model this route configures traffic for.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "RouteDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "RouteDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class RouteDict(TypedDict, total=False):
+    """"""
+
+    traffic_percentage: VariableOr[int]
+    """
+    The percentage of endpoint traffic to send to this route. It must be an integer between 0 and 100 inclusive.
+    """
+
+    served_entity_name: VariableOrOptional[str]
+
+    served_model_name: VariableOrOptional[str]
+    """
+    The name of the served model this route configures traffic for.
+    """
+
+
+RouteParam = RouteDict | Route
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/served_entity_input.py b/python/databricks/bundles/model_serving_endpoints/_models/served_entity_input.py
new file mode 100644
index 00000000000..e40050ca3e6
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/served_entity_input.py
@@ -0,0 +1,186 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrDict, VariableOrOptional
+from databricks.bundles.model_serving_endpoints._models.external_model import (
+    ExternalModel,
+    ExternalModelParam,
+)
+from databricks.bundles.model_serving_endpoints._models.serving_model_workload_type import (
+    ServingModelWorkloadType,
+    ServingModelWorkloadTypeParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ServedEntityInput:
+    """"""
+
+    burst_scaling_enabled: VariableOrOptional[bool] = None
+    """
+    [Public Preview] Whether burst scaling is enabled. When enabled (default), the endpoint can automatically
+    scale up beyond provisioned capacity to handle traffic spikes. When disabled, the endpoint
+    maintains fixed capacity at provisioned_model_units.
+    """
+
+    entity_name: VariableOrOptional[str] = None
+    """
+    The name of the entity to be served. The entity may be a model in the Databricks Model Registry, a model in the Unity Catalog (UC), or a function of type FEATURE_SPEC in the UC. If it is a UC object, the full name of the object should be given in the form of **catalog_name.schema_name.model_name**.
+    """
+
+    entity_version: VariableOrOptional[str] = None
+
+    environment_vars: VariableOrDict[str] = field(default_factory=dict)
+    """
+    An object containing a set of optional, user-specified environment variable key-value pairs used for serving this entity. Note: this is an experimental feature and subject to change. Example entity environment variables that refer to Databricks secrets: `{"OPENAI_API_KEY": "{{secrets/my_scope/my_key}}", "DATABRICKS_TOKEN": "{{secrets/my_scope2/my_key2}}"}`
+    """
+
+    external_model: VariableOrOptional[ExternalModel] = None
+    """
+    The external model to be served. NOTE: Only one of external_model and (entity_name, entity_version, workload_size, workload_type, and scale_to_zero_enabled) can be specified with the latter set being used for custom model serving for a Databricks registered model. For an existing endpoint with external_model, it cannot be updated to an endpoint without external_model. If the endpoint is created without external_model, users cannot update it to add external_model later. The task type of all external models within an endpoint must be the same.
+    """
+
+    instance_profile_arn: VariableOrOptional[str] = None
+    """
+    [Public Preview] ARN of the instance profile that the served entity uses to access AWS resources.
+    """
+
+    max_provisioned_concurrency: VariableOrOptional[int] = None
+    """
+    The maximum provisioned concurrency that the endpoint can scale up to. Do not use if workload_size is specified.
+    """
+
+    max_provisioned_throughput: VariableOrOptional[int] = None
+    """
+    The maximum tokens per second that the endpoint can scale up to.
+    """
+
+    min_provisioned_concurrency: VariableOrOptional[int] = None
+    """
+    The minimum provisioned concurrency that the endpoint can scale down to. Do not use if workload_size is specified.
+    """
+
+    min_provisioned_throughput: VariableOrOptional[int] = None
+    """
+    The minimum tokens per second that the endpoint can scale down to.
+    """
+
+    name: VariableOrOptional[str] = None
+    """
+    The name of a served entity. It must be unique across an endpoint. A served entity name can consist of alphanumeric characters, dashes, and underscores. If not specified for an external model, this field defaults to external_model.name, with '.' and ':' replaced with '-', and if not specified for other entities, it defaults to entity_name-entity_version.
+    """
+
+    provisioned_model_units: VariableOrOptional[int] = None
+    """
+    [Public Preview] The number of model units provisioned.
+    """
+
+    scale_to_zero_enabled: VariableOrOptional[bool] = None
+    """
+    Whether the compute resources for the served entity should scale down to zero.
+    """
+
+    workload_size: VariableOrOptional[str] = None
+    """
+    The workload size of the served entity. The workload size corresponds to a range of provisioned concurrency that the compute autoscales between. A single unit of provisioned concurrency can process one request at a time. Valid workload sizes are "Small" (4 - 4 provisioned concurrency), "Medium" (8 - 16 provisioned concurrency), and "Large" (16 - 64 provisioned concurrency). Additional custom workload sizes can also be used when available in the workspace. If scale-to-zero is enabled, the lower bound of the provisioned concurrency for each workload size is 0. Do not use if min_provisioned_concurrency and max_provisioned_concurrency are specified.
+    """
+
+    workload_type: VariableOrOptional[ServingModelWorkloadType] = None
+    """
+    The workload type of the served entity. The workload type selects which type of compute to use in the endpoint. The default value for this parameter is "CPU". For deep learning workloads, GPU acceleration is available by selecting workload types like GPU_SMALL and others. See the available [GPU types](https://docs.databricks.com/en/machine-learning/model-serving/create-manage-serving-endpoints.html#gpu-workload-types).
+    """
+
+    @classmethod
+    def from_dict(cls, value: "ServedEntityInputDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ServedEntityInputDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ServedEntityInputDict(TypedDict, total=False):
+    """"""
+
+    burst_scaling_enabled: VariableOrOptional[bool]
+    """
+    [Public Preview] Whether burst scaling is enabled. When enabled (default), the endpoint can automatically
+    scale up beyond provisioned capacity to handle traffic spikes. When disabled, the endpoint
+    maintains fixed capacity at provisioned_model_units.
+    """
+
+    entity_name: VariableOrOptional[str]
+    """
+    The name of the entity to be served. The entity may be a model in the Databricks Model Registry, a model in the Unity Catalog (UC), or a function of type FEATURE_SPEC in the UC. If it is a UC object, the full name of the object should be given in the form of **catalog_name.schema_name.model_name**.
+    """
+
+    entity_version: VariableOrOptional[str]
+
+    environment_vars: VariableOrDict[str]
+    """
+    An object containing a set of optional, user-specified environment variable key-value pairs used for serving this entity. Note: this is an experimental feature and subject to change. Example entity environment variables that refer to Databricks secrets: `{"OPENAI_API_KEY": "{{secrets/my_scope/my_key}}", "DATABRICKS_TOKEN": "{{secrets/my_scope2/my_key2}}"}`
+    """
+
+    external_model: VariableOrOptional[ExternalModelParam]
+    """
+    The external model to be served. NOTE: Only one of external_model and (entity_name, entity_version, workload_size, workload_type, and scale_to_zero_enabled) can be specified with the latter set being used for custom model serving for a Databricks registered model. For an existing endpoint with external_model, it cannot be updated to an endpoint without external_model. If the endpoint is created without external_model, users cannot update it to add external_model later. The task type of all external models within an endpoint must be the same.
+    """
+
+    instance_profile_arn: VariableOrOptional[str]
+    """
+    [Public Preview] ARN of the instance profile that the served entity uses to access AWS resources.
+    """
+
+    max_provisioned_concurrency: VariableOrOptional[int]
+    """
+    The maximum provisioned concurrency that the endpoint can scale up to. Do not use if workload_size is specified.
+    """
+
+    max_provisioned_throughput: VariableOrOptional[int]
+    """
+    The maximum tokens per second that the endpoint can scale up to.
+    """
+
+    min_provisioned_concurrency: VariableOrOptional[int]
+    """
+    The minimum provisioned concurrency that the endpoint can scale down to. Do not use if workload_size is specified.
+    """
+
+    min_provisioned_throughput: VariableOrOptional[int]
+    """
+    The minimum tokens per second that the endpoint can scale down to.
+    """
+
+    name: VariableOrOptional[str]
+    """
+    The name of a served entity. It must be unique across an endpoint. A served entity name can consist of alphanumeric characters, dashes, and underscores. If not specified for an external model, this field defaults to external_model.name, with '.' and ':' replaced with '-', and if not specified for other entities, it defaults to entity_name-entity_version.
+    """
+
+    provisioned_model_units: VariableOrOptional[int]
+    """
+    [Public Preview] The number of model units provisioned.
+    """
+
+    scale_to_zero_enabled: VariableOrOptional[bool]
+    """
+    Whether the compute resources for the served entity should scale down to zero.
+    """
+
+    workload_size: VariableOrOptional[str]
+    """
+    The workload size of the served entity. The workload size corresponds to a range of provisioned concurrency that the compute autoscales between. A single unit of provisioned concurrency can process one request at a time. Valid workload sizes are "Small" (4 - 4 provisioned concurrency), "Medium" (8 - 16 provisioned concurrency), and "Large" (16 - 64 provisioned concurrency). Additional custom workload sizes can also be used when available in the workspace. If scale-to-zero is enabled, the lower bound of the provisioned concurrency for each workload size is 0. Do not use if min_provisioned_concurrency and max_provisioned_concurrency are specified.
+    """
+
+    workload_type: VariableOrOptional[ServingModelWorkloadTypeParam]
+    """
+    The workload type of the served entity. The workload type selects which type of compute to use in the endpoint. The default value for this parameter is "CPU". For deep learning workloads, GPU acceleration is available by selecting workload types like GPU_SMALL and others. See the available [GPU types](https://docs.databricks.com/en/machine-learning/model-serving/create-manage-serving-endpoints.html#gpu-workload-types).
+    """
+
+
+ServedEntityInputParam = ServedEntityInputDict | ServedEntityInput
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/served_model_input.py b/python/databricks/bundles/model_serving_endpoints/_models/served_model_input.py
new file mode 100644
index 00000000000..90c98757af5
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/served_model_input.py
@@ -0,0 +1,170 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import (
+    VariableOr,
+    VariableOrDict,
+    VariableOrOptional,
+)
+from databricks.bundles.model_serving_endpoints._models.served_model_input_workload_type import (
+    ServedModelInputWorkloadType,
+    ServedModelInputWorkloadTypeParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ServedModelInput:
+    """"""
+
+    model_name: VariableOr[str]
+
+    model_version: VariableOr[str]
+
+    scale_to_zero_enabled: VariableOr[bool]
+    """
+    Whether the compute resources for the served entity should scale down to zero.
+    """
+
+    burst_scaling_enabled: VariableOrOptional[bool] = None
+    """
+    [Public Preview] Whether burst scaling is enabled. When enabled (default), the endpoint can automatically
+    scale up beyond provisioned capacity to handle traffic spikes. When disabled, the endpoint
+    maintains fixed capacity at provisioned_model_units.
+    """
+
+    environment_vars: VariableOrDict[str] = field(default_factory=dict)
+    """
+    An object containing a set of optional, user-specified environment variable key-value pairs used for serving this entity. Note: this is an experimental feature and subject to change. Example entity environment variables that refer to Databricks secrets: `{"OPENAI_API_KEY": "{{secrets/my_scope/my_key}}", "DATABRICKS_TOKEN": "{{secrets/my_scope2/my_key2}}"}`
+    """
+
+    instance_profile_arn: VariableOrOptional[str] = None
+    """
+    [Public Preview] ARN of the instance profile that the served entity uses to access AWS resources.
+    """
+
+    max_provisioned_concurrency: VariableOrOptional[int] = None
+    """
+    The maximum provisioned concurrency that the endpoint can scale up to. Do not use if workload_size is specified.
+    """
+
+    max_provisioned_throughput: VariableOrOptional[int] = None
+    """
+    The maximum tokens per second that the endpoint can scale up to.
+    """
+
+    min_provisioned_concurrency: VariableOrOptional[int] = None
+    """
+    The minimum provisioned concurrency that the endpoint can scale down to. Do not use if workload_size is specified.
+    """
+
+    min_provisioned_throughput: VariableOrOptional[int] = None
+    """
+    The minimum tokens per second that the endpoint can scale down to.
+    """
+
+    name: VariableOrOptional[str] = None
+    """
+    The name of a served entity. It must be unique across an endpoint. A served entity name can consist of alphanumeric characters, dashes, and underscores. If not specified for an external model, this field defaults to external_model.name, with '.' and ':' replaced with '-', and if not specified for other entities, it defaults to entity_name-entity_version.
+    """
+
+    provisioned_model_units: VariableOrOptional[int] = None
+    """
+    [Public Preview] The number of model units provisioned.
+    """
+
+    workload_size: VariableOrOptional[str] = None
+    """
+    The workload size of the served entity. The workload size corresponds to a range of provisioned concurrency that the compute autoscales between. A single unit of provisioned concurrency can process one request at a time. Valid workload sizes are "Small" (4 - 4 provisioned concurrency), "Medium" (8 - 16 provisioned concurrency), and "Large" (16 - 64 provisioned concurrency). Additional custom workload sizes can also be used when available in the workspace. If scale-to-zero is enabled, the lower bound of the provisioned concurrency for each workload size is 0. Do not use if min_provisioned_concurrency and max_provisioned_concurrency are specified.
+    """
+
+    workload_type: VariableOrOptional[ServedModelInputWorkloadType] = None
+    """
+    The workload type of the served entity. The workload type selects which type of compute to use in the endpoint. The default value for this parameter is "CPU". For deep learning workloads, GPU acceleration is available by selecting workload types like GPU_SMALL and others. See the available [GPU types](https://docs.databricks.com/en/machine-learning/model-serving/create-manage-serving-endpoints.html#gpu-workload-types).
+    """
+
+    @classmethod
+    def from_dict(cls, value: "ServedModelInputDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ServedModelInputDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ServedModelInputDict(TypedDict, total=False):
+    """"""
+
+    model_name: VariableOr[str]
+
+    model_version: VariableOr[str]
+
+    scale_to_zero_enabled: VariableOr[bool]
+    """
+    Whether the compute resources for the served entity should scale down to zero.
+    """
+
+    burst_scaling_enabled: VariableOrOptional[bool]
+    """
+    [Public Preview] Whether burst scaling is enabled. When enabled (default), the endpoint can automatically
+    scale up beyond provisioned capacity to handle traffic spikes. When disabled, the endpoint
+    maintains fixed capacity at provisioned_model_units.
+    """
+
+    environment_vars: VariableOrDict[str]
+    """
+    An object containing a set of optional, user-specified environment variable key-value pairs used for serving this entity. Note: this is an experimental feature and subject to change. Example entity environment variables that refer to Databricks secrets: `{"OPENAI_API_KEY": "{{secrets/my_scope/my_key}}", "DATABRICKS_TOKEN": "{{secrets/my_scope2/my_key2}}"}`
+    """
+
+    instance_profile_arn: VariableOrOptional[str]
+    """
+    [Public Preview] ARN of the instance profile that the served entity uses to access AWS resources.
+    """
+
+    max_provisioned_concurrency: VariableOrOptional[int]
+    """
+    The maximum provisioned concurrency that the endpoint can scale up to. Do not use if workload_size is specified.
+    """
+
+    max_provisioned_throughput: VariableOrOptional[int]
+    """
+    The maximum tokens per second that the endpoint can scale up to.
+    """
+
+    min_provisioned_concurrency: VariableOrOptional[int]
+    """
+    The minimum provisioned concurrency that the endpoint can scale down to. Do not use if workload_size is specified.
+    """
+
+    min_provisioned_throughput: VariableOrOptional[int]
+    """
+    The minimum tokens per second that the endpoint can scale down to.
+    """
+
+    name: VariableOrOptional[str]
+    """
+    The name of a served entity. It must be unique across an endpoint. A served entity name can consist of alphanumeric characters, dashes, and underscores. If not specified for an external model, this field defaults to external_model.name, with '.' and ':' replaced with '-', and if not specified for other entities, it defaults to entity_name-entity_version.
+    """
+
+    provisioned_model_units: VariableOrOptional[int]
+    """
+    [Public Preview] The number of model units provisioned.
+    """
+
+    workload_size: VariableOrOptional[str]
+    """
+    The workload size of the served entity. The workload size corresponds to a range of provisioned concurrency that the compute autoscales between. A single unit of provisioned concurrency can process one request at a time. Valid workload sizes are "Small" (4 - 4 provisioned concurrency), "Medium" (8 - 16 provisioned concurrency), and "Large" (16 - 64 provisioned concurrency). Additional custom workload sizes can also be used when available in the workspace. If scale-to-zero is enabled, the lower bound of the provisioned concurrency for each workload size is 0. Do not use if min_provisioned_concurrency and max_provisioned_concurrency are specified.
+    """
+
+    workload_type: VariableOrOptional[ServedModelInputWorkloadTypeParam]
+    """
+    The workload type of the served entity. The workload type selects which type of compute to use in the endpoint. The default value for this parameter is "CPU". For deep learning workloads, GPU acceleration is available by selecting workload types like GPU_SMALL and others. See the available [GPU types](https://docs.databricks.com/en/machine-learning/model-serving/create-manage-serving-endpoints.html#gpu-workload-types).
+    """
+
+
+ServedModelInputParam = ServedModelInputDict | ServedModelInput
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/served_model_input_workload_type.py b/python/databricks/bundles/model_serving_endpoints/_models/served_model_input_workload_type.py
new file mode 100644
index 00000000000..87f62c41e34
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/served_model_input_workload_type.py
@@ -0,0 +1,36 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class ServedModelInputWorkloadType(Enum):
+    """
+    Please keep this in sync with workload types in InferenceEndpointEntities.scala.
+    """
+
+    CPU = "CPU"
+    GPU_MEDIUM = "GPU_MEDIUM"
+    GPU_SMALL = "GPU_SMALL"
+    GPU_LARGE = "GPU_LARGE"
+    MULTIGPU_MEDIUM = "MULTIGPU_MEDIUM"
+    CPU_LARGE = "CPU_LARGE"
+    GPU_XLARGE_8 = "GPU_XLARGE_8"
+    GPU_XLARGE = "GPU_XLARGE"
+    CPU_MEDIUM = "CPU_MEDIUM"
+
+
+ServedModelInputWorkloadTypeParam = (
+    Literal[
+        "CPU",
+        "GPU_MEDIUM",
+        "GPU_SMALL",
+        "GPU_LARGE",
+        "MULTIGPU_MEDIUM",
+        "CPU_LARGE",
+        "GPU_XLARGE_8",
+        "GPU_XLARGE",
+        "CPU_MEDIUM",
+    ]
+    | ServedModelInputWorkloadType
+)
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/serving_endpoint_permission_level.py b/python/databricks/bundles/model_serving_endpoints/_models/serving_endpoint_permission_level.py
new file mode 100644
index 00000000000..d9d75992c54
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/serving_endpoint_permission_level.py
@@ -0,0 +1,19 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class ServingEndpointPermissionLevel(Enum):
+    """
+    Permission level
+    """
+
+    CAN_MANAGE = "CAN_MANAGE"
+    CAN_QUERY = "CAN_QUERY"
+    CAN_VIEW = "CAN_VIEW"
+
+
+ServingEndpointPermissionLevelParam = (
+    Literal["CAN_MANAGE", "CAN_QUERY", "CAN_VIEW"] | ServingEndpointPermissionLevel
+)
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/serving_model_workload_type.py b/python/databricks/bundles/model_serving_endpoints/_models/serving_model_workload_type.py
new file mode 100644
index 00000000000..04b513e77a7
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/serving_model_workload_type.py
@@ -0,0 +1,36 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class ServingModelWorkloadType(Enum):
+    """
+    Please keep this in sync with workload types in InferenceEndpointEntities.scala.
+    """
+
+    CPU = "CPU"
+    GPU_MEDIUM = "GPU_MEDIUM"
+    GPU_SMALL = "GPU_SMALL"
+    GPU_LARGE = "GPU_LARGE"
+    MULTIGPU_MEDIUM = "MULTIGPU_MEDIUM"
+    CPU_LARGE = "CPU_LARGE"
+    GPU_XLARGE_8 = "GPU_XLARGE_8"
+    GPU_XLARGE = "GPU_XLARGE"
+    CPU_MEDIUM = "CPU_MEDIUM"
+
+
+ServingModelWorkloadTypeParam = (
+    Literal[
+        "CPU",
+        "GPU_MEDIUM",
+        "GPU_SMALL",
+        "GPU_LARGE",
+        "MULTIGPU_MEDIUM",
+        "CPU_LARGE",
+        "GPU_XLARGE_8",
+        "GPU_XLARGE",
+        "CPU_MEDIUM",
+    ]
+    | ServingModelWorkloadType
+)
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/telemetry_config.py b/python/databricks/bundles/model_serving_endpoints/_models/telemetry_config.py
new file mode 100644
index 00000000000..cffb10c2642
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/telemetry_config.py
@@ -0,0 +1,90 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
+from databricks.bundles.model_serving_endpoints._models.telemetry_feature import (
+    TelemetryFeature,
+    TelemetryFeatureParam,
+)
+from databricks.bundles.model_serving_endpoints._models.telemetry_inference_table_config import (
+    TelemetryInferenceTableConfig,
+    TelemetryInferenceTableConfigParam,
+)
+from databricks.bundles.model_serving_endpoints._models.unity_catalog_table_names import (
+    UnityCatalogTableNames,
+    UnityCatalogTableNamesParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class TelemetryConfig:
+    """"""
+
+    enabled_telemetry_features: VariableOrList[TelemetryFeature] = field(
+        default_factory=list
+    )
+    """
+    [Public Preview] The telemetry signals to enable for this endpoint. If empty or omitted, all signals are
+    enabled; otherwise only the listed signals are enabled.
+    """
+
+    inference_table_config: VariableOrOptional[TelemetryInferenceTableConfig] = None
+    """
+    [Public Preview] Configuration for inference table payload logging, including sampling.
+    """
+
+    table_names: VariableOrOptional[UnityCatalogTableNames] = None
+    """
+    [Public Preview] The Unity Catalog tables to which endpoint telemetry (logs, traces, and metrics) is exported.
+    Provide this to create a new telemetry profile for the endpoint from the given tables.
+    """
+
+    telemetry_profile_id: VariableOrOptional[str] = None
+    """
+    [Public Preview] The ID of an existing telemetry profile to apply to this endpoint. Provide this to reuse a
+    telemetry profile that has already been created, instead of specifying table_names.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "TelemetryConfigDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "TelemetryConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class TelemetryConfigDict(TypedDict, total=False):
+    """"""
+
+    enabled_telemetry_features: VariableOrList[TelemetryFeatureParam]
+    """
+    [Public Preview] The telemetry signals to enable for this endpoint. If empty or omitted, all signals are
+    enabled; otherwise only the listed signals are enabled.
+    """
+
+    inference_table_config: VariableOrOptional[TelemetryInferenceTableConfigParam]
+    """
+    [Public Preview] Configuration for inference table payload logging, including sampling.
+    """
+
+    table_names: VariableOrOptional[UnityCatalogTableNamesParam]
+    """
+    [Public Preview] The Unity Catalog tables to which endpoint telemetry (logs, traces, and metrics) is exported.
+    Provide this to create a new telemetry profile for the endpoint from the given tables.
+    """
+
+    telemetry_profile_id: VariableOrOptional[str]
+    """
+    [Public Preview] The ID of an existing telemetry profile to apply to this endpoint. Provide this to reuse a
+    telemetry profile that has already been created, instead of specifying table_names.
+    """
+
+
+TelemetryConfigParam = TelemetryConfigDict | TelemetryConfig
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/telemetry_feature.py b/python/databricks/bundles/model_serving_endpoints/_models/telemetry_feature.py
new file mode 100644
index 00000000000..2d74f666c07
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/telemetry_feature.py
@@ -0,0 +1,27 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class TelemetryFeature(Enum):
+    """
+    A telemetry signal that a serving endpoint can export to Unity Catalog. Use these values to
+    select which signals the endpoint exports.
+    """
+
+    TELEMETRY_FEATURE_LOGS = "TELEMETRY_FEATURE_LOGS"
+    TELEMETRY_FEATURE_TRACES = "TELEMETRY_FEATURE_TRACES"
+    TELEMETRY_FEATURE_METRICS = "TELEMETRY_FEATURE_METRICS"
+    TELEMETRY_FEATURE_INFERENCE_TABLE = "TELEMETRY_FEATURE_INFERENCE_TABLE"
+
+
+TelemetryFeatureParam = (
+    Literal[
+        "TELEMETRY_FEATURE_LOGS",
+        "TELEMETRY_FEATURE_TRACES",
+        "TELEMETRY_FEATURE_METRICS",
+        "TELEMETRY_FEATURE_INFERENCE_TABLE",
+    ]
+    | TelemetryFeature
+)
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/telemetry_inference_table_config.py b/python/databricks/bundles/model_serving_endpoints/_models/telemetry_inference_table_config.py
new file mode 100644
index 00000000000..9153a4c49ac
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/telemetry_inference_table_config.py
@@ -0,0 +1,44 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class TelemetryInferenceTableConfig:
+    """
+    Inference table payload logging configuration
+    """
+
+    sampling_fraction: VariableOrOptional[float] = None
+    """
+    [Public Preview] Fraction of requests sampled for payload logging, in the range [0.0, 1.0], where 1.0 logs all requests.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "TelemetryInferenceTableConfigDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "TelemetryInferenceTableConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class TelemetryInferenceTableConfigDict(TypedDict, total=False):
+    """"""
+
+    sampling_fraction: VariableOrOptional[float]
+    """
+    [Public Preview] Fraction of requests sampled for payload logging, in the range [0.0, 1.0], where 1.0 logs all requests.
+    """
+
+
+TelemetryInferenceTableConfigParam = (
+    TelemetryInferenceTableConfigDict | TelemetryInferenceTableConfig
+)
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/traffic_config.py b/python/databricks/bundles/model_serving_endpoints/_models/traffic_config.py
new file mode 100644
index 00000000000..d25a5c87fef
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/traffic_config.py
@@ -0,0 +1,44 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList
+from databricks.bundles.model_serving_endpoints._models.route import (
+    Route,
+    RouteParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class TrafficConfig:
+    """"""
+
+    routes: VariableOrList[Route] = field(default_factory=list)
+    """
+    The list of routes that define traffic to each served entity.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "TrafficConfigDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "TrafficConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class TrafficConfigDict(TypedDict, total=False):
+    """"""
+
+    routes: VariableOrList[RouteParam]
+    """
+    The list of routes that define traffic to each served entity.
+    """
+
+
+TrafficConfigParam = TrafficConfigDict | TrafficConfig
diff --git a/python/databricks/bundles/model_serving_endpoints/_models/unity_catalog_table_names.py b/python/databricks/bundles/model_serving_endpoints/_models/unity_catalog_table_names.py
new file mode 100644
index 00000000000..5cf8a32d821
--- /dev/null
+++ b/python/databricks/bundles/model_serving_endpoints/_models/unity_catalog_table_names.py
@@ -0,0 +1,78 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class UnityCatalogTableNames:
+    """"""
+
+    annotations_table: VariableOrOptional[str] = None
+    """
+    [Public Preview] The full three-level Unity Catalog name (catalog.schema.table) of the table that receives
+    exported annotations.
+    """
+
+    logs_table: VariableOrOptional[str] = None
+    """
+    [Public Preview] The full three-level Unity Catalog name (catalog.schema.table) of the table that receives
+    exported logs.
+    """
+
+    metrics_table: VariableOrOptional[str] = None
+    """
+    [Public Preview] The full three-level Unity Catalog name (catalog.schema.table) of the table that receives
+    exported metrics.
+    """
+
+    traces_table: VariableOrOptional[str] = None
+    """
+    [Public Preview] The full three-level Unity Catalog name (catalog.schema.table) of the table that receives
+    exported traces (spans).
+    """
+
+    @classmethod
+    def from_dict(cls, value: "UnityCatalogTableNamesDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "UnityCatalogTableNamesDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class UnityCatalogTableNamesDict(TypedDict, total=False):
+    """"""
+
+    annotations_table: VariableOrOptional[str]
+    """
+    [Public Preview] The full three-level Unity Catalog name (catalog.schema.table) of the table that receives
+    exported annotations.
+    """
+
+    logs_table: VariableOrOptional[str]
+    """
+    [Public Preview] The full three-level Unity Catalog name (catalog.schema.table) of the table that receives
+    exported logs.
+    """
+
+    metrics_table: VariableOrOptional[str]
+    """
+    [Public Preview] The full three-level Unity Catalog name (catalog.schema.table) of the table that receives
+    exported metrics.
+    """
+
+    traces_table: VariableOrOptional[str]
+    """
+    [Public Preview] The full three-level Unity Catalog name (catalog.schema.table) of the table that receives
+    exported traces (spans).
+    """
+
+
+UnityCatalogTableNamesParam = UnityCatalogTableNamesDict | UnityCatalogTableNames
diff --git a/python/databricks/bundles/models/__init__.py b/python/databricks/bundles/models/__init__.py
new file mode 100644
index 00000000000..a3469f1689e
--- /dev/null
+++ b/python/databricks/bundles/models/__init__.py
@@ -0,0 +1,44 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+__all__ = [
+    "Lifecycle",
+    "LifecycleDict",
+    "LifecycleParam",
+    "MlflowModel",
+    "MlflowModelDict",
+    "MlflowModelParam",
+    "MlflowModelPermission",
+    "MlflowModelPermissionDict",
+    "MlflowModelPermissionParam",
+    "ModelTag",
+    "ModelTagDict",
+    "ModelTagParam",
+    "RegisteredModelPermissionLevel",
+    "RegisteredModelPermissionLevelParam",
+]
+
+
+from databricks.bundles.models._models.lifecycle import (
+    Lifecycle,
+    LifecycleDict,
+    LifecycleParam,
+)
+from databricks.bundles.models._models.mlflow_model import (
+    MlflowModel,
+    MlflowModelDict,
+    MlflowModelParam,
+)
+from databricks.bundles.models._models.mlflow_model_permission import (
+    MlflowModelPermission,
+    MlflowModelPermissionDict,
+    MlflowModelPermissionParam,
+)
+from databricks.bundles.models._models.model_tag import (
+    ModelTag,
+    ModelTagDict,
+    ModelTagParam,
+)
+from databricks.bundles.models._models.registered_model_permission_level import (
+    RegisteredModelPermissionLevel,
+    RegisteredModelPermissionLevelParam,
+)
diff --git a/python/databricks/bundles/models/_models/lifecycle.py b/python/databricks/bundles/models/_models/lifecycle.py
new file mode 100644
index 00000000000..697776a198e
--- /dev/null
+++ b/python/databricks/bundles/models/_models/lifecycle.py
@@ -0,0 +1,40 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class Lifecycle:
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool] = None
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "LifecycleDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "LifecycleDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class LifecycleDict(TypedDict, total=False):
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool]
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+
+LifecycleParam = LifecycleDict | Lifecycle
diff --git a/python/databricks/bundles/models/_models/mlflow_model.py b/python/databricks/bundles/models/_models/mlflow_model.py
new file mode 100644
index 00000000000..390f1155f2c
--- /dev/null
+++ b/python/databricks/bundles/models/_models/mlflow_model.py
@@ -0,0 +1,91 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._resource import Resource
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import (
+    VariableOr,
+    VariableOrList,
+    VariableOrOptional,
+)
+from databricks.bundles.models._models.lifecycle import Lifecycle, LifecycleParam
+from databricks.bundles.models._models.mlflow_model_permission import (
+    MlflowModelPermission,
+    MlflowModelPermissionParam,
+)
+from databricks.bundles.models._models.model_tag import ModelTag, ModelTagParam
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class MlflowModel(Resource):
+    """"""
+
+    name: VariableOr[str]
+    """
+    Register models under this name
+    """
+
+    description: VariableOrOptional[str] = None
+    """
+    Optional description for registered model.
+    """
+
+    lifecycle: VariableOrOptional[Lifecycle] = None
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+    permissions: VariableOrList[MlflowModelPermission] = field(default_factory=list)
+    """
+    The permissions to apply to this resource.
+    """
+
+    tags: VariableOrList[ModelTag] = field(default_factory=list)
+    """
+    Additional metadata for registered model.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "MlflowModelDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "MlflowModelDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class MlflowModelDict(TypedDict, total=False):
+    """"""
+
+    name: VariableOr[str]
+    """
+    Register models under this name
+    """
+
+    description: VariableOrOptional[str]
+    """
+    Optional description for registered model.
+    """
+
+    lifecycle: VariableOrOptional[LifecycleParam]
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+    permissions: VariableOrList[MlflowModelPermissionParam]
+    """
+    The permissions to apply to this resource.
+    """
+
+    tags: VariableOrList[ModelTagParam]
+    """
+    Additional metadata for registered model.
+    """
+
+
+MlflowModelParam = MlflowModelDict | MlflowModel
diff --git a/python/databricks/bundles/models/_models/mlflow_model_permission.py b/python/databricks/bundles/models/_models/mlflow_model_permission.py
new file mode 100644
index 00000000000..367cbfd4a3a
--- /dev/null
+++ b/python/databricks/bundles/models/_models/mlflow_model_permission.py
@@ -0,0 +1,74 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+from databricks.bundles.models._models.registered_model_permission_level import (
+    RegisteredModelPermissionLevel,
+    RegisteredModelPermissionLevelParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class MlflowModelPermission:
+    """"""
+
+    level: VariableOr[RegisteredModelPermissionLevel]
+    """
+    The permission level to apply. The allowed levels depend on the resource type.
+    """
+
+    group_name: VariableOrOptional[str] = None
+    """
+    The name of the group granted the permission level.
+    """
+
+    service_principal_name: VariableOrOptional[str] = None
+    """
+    The name of the service principal granted the permission level.
+    """
+
+    user_name: VariableOrOptional[str] = None
+    """
+    The name of the user granted the permission level.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "MlflowModelPermissionDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "MlflowModelPermissionDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class MlflowModelPermissionDict(TypedDict, total=False):
+    """"""
+
+    level: VariableOr[RegisteredModelPermissionLevelParam]
+    """
+    The permission level to apply. The allowed levels depend on the resource type.
+    """
+
+    group_name: VariableOrOptional[str]
+    """
+    The name of the group granted the permission level.
+    """
+
+    service_principal_name: VariableOrOptional[str]
+    """
+    The name of the service principal granted the permission level.
+    """
+
+    user_name: VariableOrOptional[str]
+    """
+    The name of the user granted the permission level.
+    """
+
+
+MlflowModelPermissionParam = MlflowModelPermissionDict | MlflowModelPermission
diff --git a/python/databricks/bundles/models/_models/model_tag.py b/python/databricks/bundles/models/_models/model_tag.py
new file mode 100644
index 00000000000..b434ad05552
--- /dev/null
+++ b/python/databricks/bundles/models/_models/model_tag.py
@@ -0,0 +1,52 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ModelTag:
+    """
+    Tag for a registered model
+    """
+
+    key: VariableOrOptional[str] = None
+    """
+    The tag key.
+    """
+
+    value: VariableOrOptional[str] = None
+    """
+    The tag value.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "ModelTagDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ModelTagDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ModelTagDict(TypedDict, total=False):
+    """"""
+
+    key: VariableOrOptional[str]
+    """
+    The tag key.
+    """
+
+    value: VariableOrOptional[str]
+    """
+    The tag value.
+    """
+
+
+ModelTagParam = ModelTagDict | ModelTag
diff --git a/python/databricks/bundles/models/_models/registered_model_permission_level.py b/python/databricks/bundles/models/_models/registered_model_permission_level.py
new file mode 100644
index 00000000000..1344b5d5e48
--- /dev/null
+++ b/python/databricks/bundles/models/_models/registered_model_permission_level.py
@@ -0,0 +1,28 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class RegisteredModelPermissionLevel(Enum):
+    """
+    Permission level
+    """
+
+    CAN_MANAGE = "CAN_MANAGE"
+    CAN_MANAGE_PRODUCTION_VERSIONS = "CAN_MANAGE_PRODUCTION_VERSIONS"
+    CAN_MANAGE_STAGING_VERSIONS = "CAN_MANAGE_STAGING_VERSIONS"
+    CAN_EDIT = "CAN_EDIT"
+    CAN_READ = "CAN_READ"
+
+
+RegisteredModelPermissionLevelParam = (
+    Literal[
+        "CAN_MANAGE",
+        "CAN_MANAGE_PRODUCTION_VERSIONS",
+        "CAN_MANAGE_STAGING_VERSIONS",
+        "CAN_EDIT",
+        "CAN_READ",
+    ]
+    | RegisteredModelPermissionLevel
+)
diff --git a/python/databricks/bundles/pipelines/__init__.py b/python/databricks/bundles/pipelines/__init__.py
index dad21eca069..2b66e4f795c 100644
--- a/python/databricks/bundles/pipelines/__init__.py
+++ b/python/databricks/bundles/pipelines/__init__.py
@@ -1,10 +1,21 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 __all__ = [
     "Adlsgen2Info",
     "Adlsgen2InfoDict",
     "Adlsgen2InfoParam",
+    "ApiSourceConnectorConfig",
+    "ApiSourceConnectorConfigDict",
+    "ApiSourceConnectorConfigParam",
+    "ApiSourceConnectorOptions",
+    "ApiSourceConnectorOptionsDict",
+    "ApiSourceConnectorOptionsParam",
     "AutoFullRefreshPolicy",
     "AutoFullRefreshPolicyDict",
     "AutoFullRefreshPolicyParam",
+    "AvroTransformerOptions",
+    "AvroTransformerOptionsDict",
+    "AvroTransformerOptionsParam",
     "AwsAttributes",
     "AwsAttributesDict",
     "AwsAttributesParam",
@@ -18,6 +29,14 @@
     "ClusterLogConf",
     "ClusterLogConfDict",
     "ClusterLogConfParam",
+    "ConfidentialComputeType",
+    "ConfidentialComputeTypeParam",
+    "ConfluenceConnectorOptions",
+    "ConfluenceConnectorOptionsDict",
+    "ConfluenceConnectorOptionsParam",
+    "ConfluentSchemaRegistryOptions",
+    "ConfluentSchemaRegistryOptionsDict",
+    "ConfluentSchemaRegistryOptionsParam",
     "ConnectionParameters",
     "ConnectionParametersDict",
     "ConnectionParametersParam",
@@ -63,6 +82,12 @@
     "GcsStorageInfo",
     "GcsStorageInfoDict",
     "GcsStorageInfoParam",
+    "GoogleAdsConfig",
+    "GoogleAdsConfigDict",
+    "GoogleAdsConfigParam",
+    "GoogleAdsCustomReportOptions",
+    "GoogleAdsCustomReportOptionsDict",
+    "GoogleAdsCustomReportOptionsParam",
     "GoogleAdsOptions",
     "GoogleAdsOptionsDict",
     "GoogleAdsOptionsParam",
@@ -79,6 +104,9 @@
     "IngestionGatewayPipelineDefinitionParam",
     "IngestionPipelineDefinition",
     "IngestionPipelineDefinitionDict",
+    "IngestionPipelineDefinitionFanoutOptions",
+    "IngestionPipelineDefinitionFanoutOptionsDict",
+    "IngestionPipelineDefinitionFanoutOptionsParam",
     "IngestionPipelineDefinitionParam",
     "IngestionPipelineDefinitionTableSpecificConfigQueryBasedConnectorConfig",
     "IngestionPipelineDefinitionTableSpecificConfigQueryBasedConnectorConfigDict",
@@ -86,24 +114,51 @@
     "IngestionPipelineDefinitionWorkdayReportParameters",
     "IngestionPipelineDefinitionWorkdayReportParametersDict",
     "IngestionPipelineDefinitionWorkdayReportParametersParam",
-    "IngestionPipelineDefinitionWorkdayReportParametersQueryKeyValue",
-    "IngestionPipelineDefinitionWorkdayReportParametersQueryKeyValueDict",
-    "IngestionPipelineDefinitionWorkdayReportParametersQueryKeyValueParam",
     "InitScriptInfo",
     "InitScriptInfoDict",
     "InitScriptInfoParam",
+    "JiraConnectorOptions",
+    "JiraConnectorOptionsDict",
+    "JiraConnectorOptionsParam",
+    "JsonTransformerOptions",
+    "JsonTransformerOptionsDict",
+    "JsonTransformerOptionsParam",
+    "KafkaOptions",
+    "KafkaOptionsDict",
+    "KafkaOptionsParam",
     "Lifecycle",
     "LifecycleDict",
     "LifecycleParam",
+    "LinkedInAdsOptions",
+    "LinkedInAdsOptionsDict",
+    "LinkedInAdsOptionsLinkedInAdsCustomReportOptions",
+    "LinkedInAdsOptionsLinkedInAdsCustomReportOptionsDict",
+    "LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsEntityGranularity",
+    "LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsEntityGranularityParam",
+    "LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsFinder",
+    "LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsFinderParam",
+    "LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsTimeGranularity",
+    "LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsTimeGranularityParam",
+    "LinkedInAdsOptionsLinkedInAdsCustomReportOptionsParam",
+    "LinkedInAdsOptionsParam",
     "LocalFileInfo",
     "LocalFileInfoDict",
     "LocalFileInfoParam",
     "LogAnalyticsInfo",
     "LogAnalyticsInfoDict",
     "LogAnalyticsInfoParam",
+    "MarketoOptions",
+    "MarketoOptionsDict",
+    "MarketoOptionsParam",
     "MavenLibrary",
     "MavenLibraryDict",
     "MavenLibraryParam",
+    "MetaMarketingOptions",
+    "MetaMarketingOptionsDict",
+    "MetaMarketingOptionsMetaMarketingCustomReportOptions",
+    "MetaMarketingOptionsMetaMarketingCustomReportOptionsDict",
+    "MetaMarketingOptionsMetaMarketingCustomReportOptionsParam",
+    "MetaMarketingOptionsParam",
     "NotebookLibrary",
     "NotebookLibraryDict",
     "NotebookLibraryParam",
@@ -113,6 +168,15 @@
     "OperationTimeWindow",
     "OperationTimeWindowDict",
     "OperationTimeWindowParam",
+    "OutlookAttachmentMode",
+    "OutlookAttachmentModeParam",
+    "OutlookBodyFormat",
+    "OutlookBodyFormatParam",
+    "OutlookOptions",
+    "OutlookOptionsDict",
+    "OutlookOptionsParam",
+    "ParseMode",
+    "ParseModeParam",
     "PathPattern",
     "PathPatternDict",
     "PathPatternParam",
@@ -144,6 +208,18 @@
     "PostgresSlotConfig",
     "PostgresSlotConfigDict",
     "PostgresSlotConfigParam",
+    "ProtobufTransformerOptions",
+    "ProtobufTransformerOptionsDict",
+    "ProtobufTransformerOptionsParam",
+    "RabbitmqOptions",
+    "RabbitmqOptionsDict",
+    "RabbitmqOptionsParam",
+    "RedditAdsOptions",
+    "RedditAdsOptionsDict",
+    "RedditAdsOptionsParam",
+    "RedditAdsOptionsRedditAdsCustomReportOptions",
+    "RedditAdsOptionsRedditAdsCustomReportOptionsDict",
+    "RedditAdsOptionsRedditAdsCustomReportOptionsParam",
     "ReportSpec",
     "ReportSpecDict",
     "ReportSpecParam",
@@ -156,6 +232,9 @@
     "S3StorageInfo",
     "S3StorageInfoDict",
     "S3StorageInfoParam",
+    "SchemaRegistryConfig",
+    "SchemaRegistryConfigDict",
+    "SchemaRegistryConfigParam",
     "SchemaSpec",
     "SchemaSpecDict",
     "SchemaSpecParam",
@@ -164,6 +243,9 @@
     "SharepointOptionsParam",
     "SharepointOptionsSharepointEntityType",
     "SharepointOptionsSharepointEntityTypeParam",
+    "SmartsheetOptions",
+    "SmartsheetOptionsDict",
+    "SmartsheetOptionsParam",
     "SourceCatalogConfig",
     "SourceCatalogConfigDict",
     "SourceCatalogConfigParam",
@@ -181,16 +263,27 @@
     "TikTokAdsOptions",
     "TikTokAdsOptionsDict",
     "TikTokAdsOptionsParam",
+    "TikTokAdsOptionsTikTokAdsCustomReportOptions",
+    "TikTokAdsOptionsTikTokAdsCustomReportOptionsDict",
+    "TikTokAdsOptionsTikTokAdsCustomReportOptionsParam",
     "TikTokAdsOptionsTikTokDataLevel",
     "TikTokAdsOptionsTikTokDataLevelParam",
     "TikTokAdsOptionsTikTokReportType",
     "TikTokAdsOptionsTikTokReportTypeParam",
+    "Transformer",
+    "TransformerDict",
+    "TransformerFormat",
+    "TransformerFormatParam",
+    "TransformerParam",
     "VolumesStorageInfo",
     "VolumesStorageInfoDict",
     "VolumesStorageInfoParam",
     "WorkspaceStorageInfo",
     "WorkspaceStorageInfoDict",
     "WorkspaceStorageInfoParam",
+    "ZendeskSupportOptions",
+    "ZendeskSupportOptionsDict",
+    "ZendeskSupportOptionsParam",
 ]
 
 
@@ -199,11 +292,26 @@
     Adlsgen2InfoDict,
     Adlsgen2InfoParam,
 )
+from databricks.bundles.pipelines._models.api_source_connector_config import (
+    ApiSourceConnectorConfig,
+    ApiSourceConnectorConfigDict,
+    ApiSourceConnectorConfigParam,
+)
+from databricks.bundles.pipelines._models.api_source_connector_options import (
+    ApiSourceConnectorOptions,
+    ApiSourceConnectorOptionsDict,
+    ApiSourceConnectorOptionsParam,
+)
 from databricks.bundles.pipelines._models.auto_full_refresh_policy import (
     AutoFullRefreshPolicy,
     AutoFullRefreshPolicyDict,
     AutoFullRefreshPolicyParam,
 )
+from databricks.bundles.pipelines._models.avro_transformer_options import (
+    AvroTransformerOptions,
+    AvroTransformerOptionsDict,
+    AvroTransformerOptionsParam,
+)
 from databricks.bundles.pipelines._models.aws_attributes import (
     AwsAttributes,
     AwsAttributesDict,
@@ -227,6 +335,20 @@
     ClusterLogConfDict,
     ClusterLogConfParam,
 )
+from databricks.bundles.pipelines._models.confidential_compute_type import (
+    ConfidentialComputeType,
+    ConfidentialComputeTypeParam,
+)
+from databricks.bundles.pipelines._models.confluence_connector_options import (
+    ConfluenceConnectorOptions,
+    ConfluenceConnectorOptionsDict,
+    ConfluenceConnectorOptionsParam,
+)
+from databricks.bundles.pipelines._models.confluent_schema_registry_options import (
+    ConfluentSchemaRegistryOptions,
+    ConfluentSchemaRegistryOptionsDict,
+    ConfluentSchemaRegistryOptionsParam,
+)
 from databricks.bundles.pipelines._models.connection_parameters import (
     ConnectionParameters,
     ConnectionParametersDict,
@@ -303,6 +425,16 @@
     GcsStorageInfoDict,
     GcsStorageInfoParam,
 )
+from databricks.bundles.pipelines._models.google_ads_config import (
+    GoogleAdsConfig,
+    GoogleAdsConfigDict,
+    GoogleAdsConfigParam,
+)
+from databricks.bundles.pipelines._models.google_ads_custom_report_options import (
+    GoogleAdsCustomReportOptions,
+    GoogleAdsCustomReportOptionsDict,
+    GoogleAdsCustomReportOptionsParam,
+)
 from databricks.bundles.pipelines._models.google_ads_options import (
     GoogleAdsOptions,
     GoogleAdsOptionsDict,
@@ -332,6 +464,11 @@
     IngestionPipelineDefinitionDict,
     IngestionPipelineDefinitionParam,
 )
+from databricks.bundles.pipelines._models.ingestion_pipeline_definition_fanout_options import (
+    IngestionPipelineDefinitionFanoutOptions,
+    IngestionPipelineDefinitionFanoutOptionsDict,
+    IngestionPipelineDefinitionFanoutOptionsParam,
+)
 from databricks.bundles.pipelines._models.ingestion_pipeline_definition_table_specific_config_query_based_connector_config import (
     IngestionPipelineDefinitionTableSpecificConfigQueryBasedConnectorConfig,
     IngestionPipelineDefinitionTableSpecificConfigQueryBasedConnectorConfigDict,
@@ -342,21 +479,53 @@
     IngestionPipelineDefinitionWorkdayReportParametersDict,
     IngestionPipelineDefinitionWorkdayReportParametersParam,
 )
-from databricks.bundles.pipelines._models.ingestion_pipeline_definition_workday_report_parameters_query_key_value import (
-    IngestionPipelineDefinitionWorkdayReportParametersQueryKeyValue,
-    IngestionPipelineDefinitionWorkdayReportParametersQueryKeyValueDict,
-    IngestionPipelineDefinitionWorkdayReportParametersQueryKeyValueParam,
-)
 from databricks.bundles.pipelines._models.init_script_info import (
     InitScriptInfo,
     InitScriptInfoDict,
     InitScriptInfoParam,
 )
+from databricks.bundles.pipelines._models.jira_connector_options import (
+    JiraConnectorOptions,
+    JiraConnectorOptionsDict,
+    JiraConnectorOptionsParam,
+)
+from databricks.bundles.pipelines._models.json_transformer_options import (
+    JsonTransformerOptions,
+    JsonTransformerOptionsDict,
+    JsonTransformerOptionsParam,
+)
+from databricks.bundles.pipelines._models.kafka_options import (
+    KafkaOptions,
+    KafkaOptionsDict,
+    KafkaOptionsParam,
+)
 from databricks.bundles.pipelines._models.lifecycle import (
     Lifecycle,
     LifecycleDict,
     LifecycleParam,
 )
+from databricks.bundles.pipelines._models.linked_in_ads_options import (
+    LinkedInAdsOptions,
+    LinkedInAdsOptionsDict,
+    LinkedInAdsOptionsParam,
+)
+from databricks.bundles.pipelines._models.linked_in_ads_options_linked_in_ads_custom_report_options import (
+    LinkedInAdsOptionsLinkedInAdsCustomReportOptions,
+    LinkedInAdsOptionsLinkedInAdsCustomReportOptionsDict,
+    LinkedInAdsOptionsLinkedInAdsCustomReportOptionsParam,
+)
+from databricks.bundles.pipelines._models.linked_in_ads_options_linked_in_ads_custom_report_options_linked_in_ads_entity_granularity import (
+    LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsEntityGranularity,
+    LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsEntityGranularityParam,
+)
+from databricks.bundles.pipelines._models.linked_in_ads_options_linked_in_ads_custom_report_options_linked_in_ads_finder import (
+    LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsFinder,
+    LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsFinderParam,
+)
+from databricks.bundles.pipelines._models.linked_in_ads_options_linked_in_ads_custom_report_options_linked_in_ads_time_granularity import (
+    LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsTimeGranularity,
+    LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsTimeGranularityParam,
+)
 from databricks.bundles.pipelines._models.local_file_info import (
     LocalFileInfo,
     LocalFileInfoDict,
@@ -367,11 +536,26 @@
     LogAnalyticsInfoDict,
     LogAnalyticsInfoParam,
 )
+from databricks.bundles.pipelines._models.marketo_options import (
+    MarketoOptions,
+    MarketoOptionsDict,
+    MarketoOptionsParam,
+)
 from databricks.bundles.pipelines._models.maven_library import (
     MavenLibrary,
     MavenLibraryDict,
     MavenLibraryParam,
 )
+from databricks.bundles.pipelines._models.meta_marketing_options import (
+    MetaMarketingOptions,
+    MetaMarketingOptionsDict,
+    MetaMarketingOptionsParam,
+)
+from databricks.bundles.pipelines._models.meta_marketing_options_meta_marketing_custom_report_options import (
+    MetaMarketingOptionsMetaMarketingCustomReportOptions,
+    MetaMarketingOptionsMetaMarketingCustomReportOptionsDict,
+    MetaMarketingOptionsMetaMarketingCustomReportOptionsParam,
+)
 from databricks.bundles.pipelines._models.notebook_library import (
     NotebookLibrary,
     NotebookLibraryDict,
@@ -387,6 +571,20 @@
     OperationTimeWindowDict,
     OperationTimeWindowParam,
 )
+from databricks.bundles.pipelines._models.outlook_attachment_mode import (
+    OutlookAttachmentMode,
+    OutlookAttachmentModeParam,
+)
+from databricks.bundles.pipelines._models.outlook_body_format import (
+    OutlookBodyFormat,
+    OutlookBodyFormatParam,
+)
+from databricks.bundles.pipelines._models.outlook_options import (
+    OutlookOptions,
+    OutlookOptionsDict,
+    OutlookOptionsParam,
+)
+from databricks.bundles.pipelines._models.parse_mode import ParseMode, ParseModeParam
 from databricks.bundles.pipelines._models.path_pattern import (
     PathPattern,
     PathPatternDict,
@@ -440,6 +638,26 @@
     PostgresSlotConfigDict,
     PostgresSlotConfigParam,
 )
+from databricks.bundles.pipelines._models.protobuf_transformer_options import (
+    ProtobufTransformerOptions,
+    ProtobufTransformerOptionsDict,
+    ProtobufTransformerOptionsParam,
+)
+from databricks.bundles.pipelines._models.rabbitmq_options import (
+    RabbitmqOptions,
+    RabbitmqOptionsDict,
+    RabbitmqOptionsParam,
+)
+from databricks.bundles.pipelines._models.reddit_ads_options import (
+    RedditAdsOptions,
+    RedditAdsOptionsDict,
+    RedditAdsOptionsParam,
+)
+from databricks.bundles.pipelines._models.reddit_ads_options_reddit_ads_custom_report_options import (
+    RedditAdsOptionsRedditAdsCustomReportOptions,
+    RedditAdsOptionsRedditAdsCustomReportOptionsDict,
+    RedditAdsOptionsRedditAdsCustomReportOptionsParam,
+)
 from databricks.bundles.pipelines._models.report_spec import (
     ReportSpec,
     ReportSpecDict,
@@ -456,6 +674,11 @@
     S3StorageInfoDict,
     S3StorageInfoParam,
 )
+from databricks.bundles.pipelines._models.schema_registry_config import (
+    SchemaRegistryConfig,
+    SchemaRegistryConfigDict,
+    SchemaRegistryConfigParam,
+)
 from databricks.bundles.pipelines._models.schema_spec import (
     SchemaSpec,
     SchemaSpecDict,
@@ -470,6 +693,11 @@
     SharepointOptionsSharepointEntityType,
     SharepointOptionsSharepointEntityTypeParam,
 )
+from databricks.bundles.pipelines._models.smartsheet_options import (
+    SmartsheetOptions,
+    SmartsheetOptionsDict,
+    SmartsheetOptionsParam,
+)
 from databricks.bundles.pipelines._models.source_catalog_config import (
     SourceCatalogConfig,
     SourceCatalogConfigDict,
@@ -499,6 +727,11 @@
     TikTokAdsOptionsDict,
     TikTokAdsOptionsParam,
 )
+from databricks.bundles.pipelines._models.tik_tok_ads_options_tik_tok_ads_custom_report_options import (
+    TikTokAdsOptionsTikTokAdsCustomReportOptions,
+    TikTokAdsOptionsTikTokAdsCustomReportOptionsDict,
+    TikTokAdsOptionsTikTokAdsCustomReportOptionsParam,
+)
 from databricks.bundles.pipelines._models.tik_tok_ads_options_tik_tok_data_level import (
     TikTokAdsOptionsTikTokDataLevel,
     TikTokAdsOptionsTikTokDataLevelParam,
@@ -507,6 +740,15 @@
     TikTokAdsOptionsTikTokReportType,
     TikTokAdsOptionsTikTokReportTypeParam,
 )
+from databricks.bundles.pipelines._models.transformer import (
+    Transformer,
+    TransformerDict,
+    TransformerParam,
+)
+from databricks.bundles.pipelines._models.transformer_format import (
+    TransformerFormat,
+    TransformerFormatParam,
+)
 from databricks.bundles.pipelines._models.volumes_storage_info import (
     VolumesStorageInfo,
     VolumesStorageInfoDict,
@@ -517,3 +759,8 @@
     WorkspaceStorageInfoDict,
     WorkspaceStorageInfoParam,
 )
+from databricks.bundles.pipelines._models.zendesk_support_options import (
+    ZendeskSupportOptions,
+    ZendeskSupportOptionsDict,
+    ZendeskSupportOptionsParam,
+)
diff --git a/python/databricks/bundles/pipelines/_models/adlsgen2_info.py b/python/databricks/bundles/pipelines/_models/adlsgen2_info.py
index 206c8b676ec..87c883adeb9 100644
--- a/python/databricks/bundles/pipelines/_models/adlsgen2_info.py
+++ b/python/databricks/bundles/pipelines/_models/adlsgen2_info.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/pipelines/_models/api_source_connector_config.py b/python/databricks/bundles/pipelines/_models/api_source_connector_config.py
new file mode 100644
index 00000000000..2ab533ab32f
--- /dev/null
+++ b/python/databricks/bundles/pipelines/_models/api_source_connector_config.py
@@ -0,0 +1,48 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrDict
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ApiSourceConnectorConfig:
+    """
+    :meta private: [EXPERIMENTAL]
+
+    Top-level configuration for API Source connectors with arbitrary configuration.
+    """
+
+    configs: VariableOrDict[str] = field(default_factory=dict)
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Arbitrary key-value configuration values for the API Source connector.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "ApiSourceConnectorConfigDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ApiSourceConnectorConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ApiSourceConnectorConfigDict(TypedDict, total=False):
+    """"""
+
+    configs: VariableOrDict[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Arbitrary key-value configuration values for the API Source connector.
+    """
+
+
+ApiSourceConnectorConfigParam = ApiSourceConnectorConfigDict | ApiSourceConnectorConfig
diff --git a/python/databricks/bundles/pipelines/_models/api_source_connector_options.py b/python/databricks/bundles/pipelines/_models/api_source_connector_options.py
new file mode 100644
index 00000000000..2e0f23c0f03
--- /dev/null
+++ b/python/databricks/bundles/pipelines/_models/api_source_connector_options.py
@@ -0,0 +1,50 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrDict
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ApiSourceConnectorOptions:
+    """
+    :meta private: [EXPERIMENTAL]
+
+    Options for API Source connectors with arbitrary configuration.
+    """
+
+    options: VariableOrDict[str] = field(default_factory=dict)
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Arbitrary key-value configuration options for the API Source connector.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "ApiSourceConnectorOptionsDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ApiSourceConnectorOptionsDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ApiSourceConnectorOptionsDict(TypedDict, total=False):
+    """"""
+
+    options: VariableOrDict[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Arbitrary key-value configuration options for the API Source connector.
+    """
+
+
+ApiSourceConnectorOptionsParam = (
+    ApiSourceConnectorOptionsDict | ApiSourceConnectorOptions
+)
diff --git a/python/databricks/bundles/pipelines/_models/auto_full_refresh_policy.py b/python/databricks/bundles/pipelines/_models/auto_full_refresh_policy.py
index e8b5b69de33..2ee3ed2382a 100644
--- a/python/databricks/bundles/pipelines/_models/auto_full_refresh_policy.py
+++ b/python/databricks/bundles/pipelines/_models/auto_full_refresh_policy.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -17,12 +19,12 @@ class AutoFullRefreshPolicy:
 
     enabled: VariableOr[bool]
     """
-    (Required, Mutable) Whether to enable auto full refresh or not.
+    [Public Preview] (Required, Mutable) Whether to enable auto full refresh or not.
     """
 
     min_interval_hours: VariableOrOptional[int] = None
     """
-    (Optional, Mutable) Specify the minimum interval in hours between the timestamp
+    [Public Preview] (Optional, Mutable) Specify the minimum interval in hours between the timestamp
     at which a table was last full refreshed and the current timestamp for triggering auto full
     If unspecified and autoFullRefresh is enabled then by default min_interval_hours is 24 hours.
     """
@@ -40,12 +42,12 @@ class AutoFullRefreshPolicyDict(TypedDict, total=False):
 
     enabled: VariableOr[bool]
     """
-    (Required, Mutable) Whether to enable auto full refresh or not.
+    [Public Preview] (Required, Mutable) Whether to enable auto full refresh or not.
     """
 
     min_interval_hours: VariableOrOptional[int]
     """
-    (Optional, Mutable) Specify the minimum interval in hours between the timestamp
+    [Public Preview] (Optional, Mutable) Specify the minimum interval in hours between the timestamp
     at which a table was last full refreshed and the current timestamp for triggering auto full
     If unspecified and autoFullRefresh is enabled then by default min_interval_hours is 24 hours.
     """
diff --git a/python/databricks/bundles/pipelines/_models/avro_transformer_options.py b/python/databricks/bundles/pipelines/_models/avro_transformer_options.py
new file mode 100644
index 00000000000..3dbfd7cf72b
--- /dev/null
+++ b/python/databricks/bundles/pipelines/_models/avro_transformer_options.py
@@ -0,0 +1,95 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.pipelines._models.parse_mode import ParseMode, ParseModeParam
+from databricks.bundles.pipelines._models.schema_registry_config import (
+    SchemaRegistryConfig,
+    SchemaRegistryConfigParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AvroTransformerOptions:
+    """"""
+
+    parse_mode: VariableOrOptional[ParseMode] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] (Optional) Parse mode for Avro data.
+    Valid values: FAILFAST, PERMISSIVE. Defaults to PERMISSIVE.
+    """
+
+    schema: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Inline Avro JSON schema string.
+    """
+
+    schema_file_path: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Path to a schema file (.avsc).
+    """
+
+    schema_registry: VariableOrOptional[SchemaRegistryConfig] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] (Optional) Schema registry to resolve the Avro schema at runtime instead of
+    providing it inline or via a file path.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "AvroTransformerOptionsDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AvroTransformerOptionsDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AvroTransformerOptionsDict(TypedDict, total=False):
+    """"""
+
+    parse_mode: VariableOrOptional[ParseModeParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] (Optional) Parse mode for Avro data.
+    Valid values: FAILFAST, PERMISSIVE. Defaults to PERMISSIVE.
+    """
+
+    schema: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Inline Avro JSON schema string.
+    """
+
+    schema_file_path: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Path to a schema file (.avsc).
+    """
+
+    schema_registry: VariableOrOptional[SchemaRegistryConfigParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] (Optional) Schema registry to resolve the Avro schema at runtime instead of
+    providing it inline or via a file path.
+    """
+
+
+AvroTransformerOptionsParam = AvroTransformerOptionsDict | AvroTransformerOptions
diff --git a/python/databricks/bundles/pipelines/_models/aws_attributes.py b/python/databricks/bundles/pipelines/_models/aws_attributes.py
index 47bc0b97ce1..3308f3c6e96 100644
--- a/python/databricks/bundles/pipelines/_models/aws_attributes.py
+++ b/python/databricks/bundles/pipelines/_models/aws_attributes.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -24,6 +26,11 @@ class AwsAttributes:
     """
 
     availability: VariableOrOptional[AwsAvailability] = None
+    """
+    Availability type used for all subsequent nodes past the `first_on_demand` ones.
+    
+    Note: If `first_on_demand` is zero, this availability type will be used for the entire cluster.
+    """
 
     ebs_volume_count: VariableOrOptional[int] = None
     """
@@ -63,6 +70,9 @@ class AwsAttributes:
     """
 
     ebs_volume_type: VariableOrOptional[EbsVolumeType] = None
+    """
+    The type of EBS volumes that will be launched with this cluster.
+    """
 
     first_on_demand: VariableOrOptional[int] = None
     """
@@ -124,6 +134,11 @@ class AwsAttributesDict(TypedDict, total=False):
     """"""
 
     availability: VariableOrOptional[AwsAvailabilityParam]
+    """
+    Availability type used for all subsequent nodes past the `first_on_demand` ones.
+    
+    Note: If `first_on_demand` is zero, this availability type will be used for the entire cluster.
+    """
 
     ebs_volume_count: VariableOrOptional[int]
     """
@@ -163,6 +178,9 @@ class AwsAttributesDict(TypedDict, total=False):
     """
 
     ebs_volume_type: VariableOrOptional[EbsVolumeTypeParam]
+    """
+    The type of EBS volumes that will be launched with this cluster.
+    """
 
     first_on_demand: VariableOrOptional[int]
     """
diff --git a/python/databricks/bundles/pipelines/_models/aws_availability.py b/python/databricks/bundles/pipelines/_models/aws_availability.py
index 5d87ffafbac..4c3810f067e 100644
--- a/python/databricks/bundles/pipelines/_models/aws_availability.py
+++ b/python/databricks/bundles/pipelines/_models/aws_availability.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
diff --git a/python/databricks/bundles/pipelines/_models/azure_attributes.py b/python/databricks/bundles/pipelines/_models/azure_attributes.py
index f06f84e9c9f..7caff90e481 100644
--- a/python/databricks/bundles/pipelines/_models/azure_attributes.py
+++ b/python/databricks/bundles/pipelines/_models/azure_attributes.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -24,6 +26,26 @@ class AzureAttributes:
     """
 
     availability: VariableOrOptional[AzureAvailability] = None
+    """
+    Availability type used for all subsequent nodes past the `first_on_demand` ones.
+    Note: If `first_on_demand` is zero, this availability
+    type will be used for the entire cluster.
+    """
+
+    capacity_reservation_group: VariableOrOptional[str] = None
+    """
+    The Azure capacity reservation group resource ID to use for launching VMs.
+    When specified, VMs will be launched using the provided capacity reservation.
+    
+    Capacity reservations can only be specified when the workspace uses injected vnet (i.e. customer defined vnet not
+    managed by databricks). Ensure the databricks-login-prod Enterprise Application is granted the following four permissions:
+    1. Microsoft.Compute/capacityReservationGroups/read
+    2. Microsoft.Compute/capacityReservationGroups/deploy/action
+    3. Microsoft.Compute/capacityReservationGroups/capacityReservations/read
+    4. Microsoft.Compute/capacityReservationGroups/capacityReservations/deploy/action
+    
+    Format: `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/capacityReservationGroups/{capacityReservationGroupName}`
+    """
 
     first_on_demand: VariableOrOptional[int] = None
     """
@@ -61,6 +83,26 @@ class AzureAttributesDict(TypedDict, total=False):
     """"""
 
     availability: VariableOrOptional[AzureAvailabilityParam]
+    """
+    Availability type used for all subsequent nodes past the `first_on_demand` ones.
+    Note: If `first_on_demand` is zero, this availability
+    type will be used for the entire cluster.
+    """
+
+    capacity_reservation_group: VariableOrOptional[str]
+    """
+    The Azure capacity reservation group resource ID to use for launching VMs.
+    When specified, VMs will be launched using the provided capacity reservation.
+    
+    Capacity reservations can only be specified when the workspace uses injected vnet (i.e. customer defined vnet not
+    managed by databricks). Ensure the databricks-login-prod Enterprise Application is granted the following four permissions:
+    1. Microsoft.Compute/capacityReservationGroups/read
+    2. Microsoft.Compute/capacityReservationGroups/deploy/action
+    3. Microsoft.Compute/capacityReservationGroups/capacityReservations/read
+    4. Microsoft.Compute/capacityReservationGroups/capacityReservations/deploy/action
+    
+    Format: `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/capacityReservationGroups/{capacityReservationGroupName}`
+    """
 
     first_on_demand: VariableOrOptional[int]
     """
diff --git a/python/databricks/bundles/pipelines/_models/azure_availability.py b/python/databricks/bundles/pipelines/_models/azure_availability.py
index 72d461d5d71..a03cb1fdddf 100644
--- a/python/databricks/bundles/pipelines/_models/azure_availability.py
+++ b/python/databricks/bundles/pipelines/_models/azure_availability.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
diff --git a/python/databricks/bundles/pipelines/_models/cluster_log_conf.py b/python/databricks/bundles/pipelines/_models/cluster_log_conf.py
index f0b4f985455..74c9dd37df4 100644
--- a/python/databricks/bundles/pipelines/_models/cluster_log_conf.py
+++ b/python/databricks/bundles/pipelines/_models/cluster_log_conf.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/pipelines/_models/confidential_compute_type.py b/python/databricks/bundles/pipelines/_models/confidential_compute_type.py
new file mode 100644
index 00000000000..e881295bd47
--- /dev/null
+++ b/python/databricks/bundles/pipelines/_models/confidential_compute_type.py
@@ -0,0 +1,23 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class ConfidentialComputeType(Enum):
+    """
+    :meta private: [EXPERIMENTAL]
+
+    Confidential computing technology for GCP instances.
+    Aligns with gcloud's --confidential-compute-type flag and the REST API's
+    confidentialInstanceConfig.confidentialInstanceType field.
+    See: https://cloud.google.com/confidential-computing/confidential-vm/docs/create-a-confidential-vm-instance
+    """
+
+    CONFIDENTIAL_COMPUTE_TYPE_NONE = "CONFIDENTIAL_COMPUTE_TYPE_NONE"
+    SEV_SNP = "SEV_SNP"
+
+
+ConfidentialComputeTypeParam = (
+    Literal["CONFIDENTIAL_COMPUTE_TYPE_NONE", "SEV_SNP"] | ConfidentialComputeType
+)
diff --git a/python/databricks/bundles/pipelines/_models/confluence_connector_options.py b/python/databricks/bundles/pipelines/_models/confluence_connector_options.py
new file mode 100644
index 00000000000..39f414edbd2
--- /dev/null
+++ b/python/databricks/bundles/pipelines/_models/confluence_connector_options.py
@@ -0,0 +1,44 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ConfluenceConnectorOptions:
+    """
+    Confluence specific options for ingestion
+    """
+
+    include_confluence_spaces: VariableOrList[str] = field(default_factory=list)
+    """
+    [Public Preview] (Optional) Spaces to filter Confluence data on
+    """
+
+    @classmethod
+    def from_dict(cls, value: "ConfluenceConnectorOptionsDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ConfluenceConnectorOptionsDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ConfluenceConnectorOptionsDict(TypedDict, total=False):
+    """"""
+
+    include_confluence_spaces: VariableOrList[str]
+    """
+    [Public Preview] (Optional) Spaces to filter Confluence data on
+    """
+
+
+ConfluenceConnectorOptionsParam = (
+    ConfluenceConnectorOptionsDict | ConfluenceConnectorOptions
+)
diff --git a/python/databricks/bundles/pipelines/_models/confluent_schema_registry_options.py b/python/databricks/bundles/pipelines/_models/confluent_schema_registry_options.py
new file mode 100644
index 00000000000..af82614ea7a
--- /dev/null
+++ b/python/databricks/bundles/pipelines/_models/confluent_schema_registry_options.py
@@ -0,0 +1,46 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ConfluentSchemaRegistryOptions:
+    """"""
+
+    subject: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Required: subject name to resolve in the registry.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "ConfluentSchemaRegistryOptionsDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ConfluentSchemaRegistryOptionsDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ConfluentSchemaRegistryOptionsDict(TypedDict, total=False):
+    """"""
+
+    subject: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Required: subject name to resolve in the registry.
+    """
+
+
+ConfluentSchemaRegistryOptionsParam = (
+    ConfluentSchemaRegistryOptionsDict | ConfluentSchemaRegistryOptions
+)
diff --git a/python/databricks/bundles/pipelines/_models/connection_parameters.py b/python/databricks/bundles/pipelines/_models/connection_parameters.py
index 98ed0dbcda0..bb13f406413 100644
--- a/python/databricks/bundles/pipelines/_models/connection_parameters.py
+++ b/python/databricks/bundles/pipelines/_models/connection_parameters.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -19,7 +21,7 @@ class ConnectionParameters:
     """
     :meta private: [EXPERIMENTAL]
     
-    Source catalog for initial connection.
+    [Private Preview] Source catalog for initial connection.
     This is necessary for schema exploration in some database systems like Oracle, and optional but nice-to-have
     in some other database systems like Postgres.
     For Oracle databases, this maps to a service name.
@@ -40,7 +42,7 @@ class ConnectionParametersDict(TypedDict, total=False):
     """
     :meta private: [EXPERIMENTAL]
     
-    Source catalog for initial connection.
+    [Private Preview] Source catalog for initial connection.
     This is necessary for schema exploration in some database systems like Oracle, and optional but nice-to-have
     in some other database systems like Postgres.
     For Oracle databases, this maps to a service name.
diff --git a/python/databricks/bundles/pipelines/_models/connector_options.py b/python/databricks/bundles/pipelines/_models/connector_options.py
index dfda4f6c133..945a5bab56a 100644
--- a/python/databricks/bundles/pipelines/_models/connector_options.py
+++ b/python/databricks/bundles/pipelines/_models/connector_options.py
@@ -1,9 +1,19 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
 from databricks.bundles.core._transform import _transform
 from databricks.bundles.core._transform_to_json import _transform_to_json_value
 from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.pipelines._models.api_source_connector_options import (
+    ApiSourceConnectorOptions,
+    ApiSourceConnectorOptionsParam,
+)
+from databricks.bundles.pipelines._models.confluence_connector_options import (
+    ConfluenceConnectorOptions,
+    ConfluenceConnectorOptionsParam,
+)
 from databricks.bundles.pipelines._models.google_ads_options import (
     GoogleAdsOptions,
     GoogleAdsOptionsParam,
@@ -12,14 +22,54 @@
     GoogleDriveOptions,
     GoogleDriveOptionsParam,
 )
+from databricks.bundles.pipelines._models.jira_connector_options import (
+    JiraConnectorOptions,
+    JiraConnectorOptionsParam,
+)
+from databricks.bundles.pipelines._models.kafka_options import (
+    KafkaOptions,
+    KafkaOptionsParam,
+)
+from databricks.bundles.pipelines._models.linked_in_ads_options import (
+    LinkedInAdsOptions,
+    LinkedInAdsOptionsParam,
+)
+from databricks.bundles.pipelines._models.marketo_options import (
+    MarketoOptions,
+    MarketoOptionsParam,
+)
+from databricks.bundles.pipelines._models.meta_marketing_options import (
+    MetaMarketingOptions,
+    MetaMarketingOptionsParam,
+)
+from databricks.bundles.pipelines._models.outlook_options import (
+    OutlookOptions,
+    OutlookOptionsParam,
+)
+from databricks.bundles.pipelines._models.rabbitmq_options import (
+    RabbitmqOptions,
+    RabbitmqOptionsParam,
+)
+from databricks.bundles.pipelines._models.reddit_ads_options import (
+    RedditAdsOptions,
+    RedditAdsOptionsParam,
+)
 from databricks.bundles.pipelines._models.sharepoint_options import (
     SharepointOptions,
     SharepointOptionsParam,
 )
+from databricks.bundles.pipelines._models.smartsheet_options import (
+    SmartsheetOptions,
+    SmartsheetOptionsParam,
+)
 from databricks.bundles.pipelines._models.tik_tok_ads_options import (
     TikTokAdsOptions,
     TikTokAdsOptionsParam,
 )
+from databricks.bundles.pipelines._models.zendesk_support_options import (
+    ZendeskSupportOptions,
+    ZendeskSupportOptionsParam,
+)
 
 if TYPE_CHECKING:
     from typing_extensions import Self
@@ -27,36 +77,122 @@
 
 @dataclass(kw_only=True)
 class ConnectorOptions:
+    """
+    Wrapper message for source-specific options to support multiple connector types
+    """
+
+    api_source_connector_options: VariableOrOptional[ApiSourceConnectorOptions] = None
     """
     :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Connector-specific options for API Source connectors.
+    """
 
-    Wrapper message for source-specific options to support multiple connector types
+    confluence_options: VariableOrOptional[ConfluenceConnectorOptions] = None
+    """
+    [Public Preview] Confluence specific options for ingestion
     """
 
     gdrive_options: VariableOrOptional[GoogleDriveOptions] = None
     """
     :meta private: [EXPERIMENTAL]
+    
+    [Private Preview]
     """
 
     google_ads_options: VariableOrOptional[GoogleAdsOptions] = None
     """
     :meta private: [EXPERIMENTAL]
     
-    Google Ads specific options for ingestion (object-level).
+    [Private Preview] Google Ads specific options for ingestion (object-level).
     When set, these values override the corresponding fields in GoogleAdsConfig
     (source_configurations).
     """
 
+    jira_options: VariableOrOptional[JiraConnectorOptions] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Jira specific options for ingestion
+    """
+
+    kafka_options: VariableOrOptional[KafkaOptions] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta]
+    """
+
+    linkedin_ads_options: VariableOrOptional[LinkedInAdsOptions] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] LinkedIn Ads specific options for ingestion.
+    sync_start_date and lookback_window_days apply to both the prebuilt analytics
+    tables and custom reports. custom_report_options defines a custom (user-defined)
+    adAnalytics report and is only valid on a table object.
+    """
+
+    marketo_options: VariableOrOptional[MarketoOptions] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Marketo specific options for ingestion
+    """
+
+    meta_ads_options: VariableOrOptional[MetaMarketingOptions] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Meta Marketing (Meta Ads) specific options for ingestion
+    """
+
+    outlook_options: VariableOrOptional[OutlookOptions] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Outlook specific options for ingestion
+    """
+
+    rabbitmq_options: VariableOrOptional[RabbitmqOptions] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] RabbitMQ specific options for ingestion.
+    Performance tuning options (consumers_per_task, max_messages_per_fetch, etc.)
+    are intentionally not exposed in the public API. The managed connector uses
+    sensible defaults internally. These can be added later if user demand arises.
+    """
+
+    reddit_ads_options: VariableOrOptional[RedditAdsOptions] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Reddit Ads specific options for ingestion
+    """
+
     sharepoint_options: VariableOrOptional[SharepointOptions] = None
     """
     :meta private: [EXPERIMENTAL]
+    
+    [Private Preview]
+    """
+
+    smartsheet_options: VariableOrOptional[SmartsheetOptions] = None
+    """
+    [Public Preview] Smartsheet specific options for ingestion
     """
 
     tiktok_ads_options: VariableOrOptional[TikTokAdsOptions] = None
     """
     :meta private: [EXPERIMENTAL]
     
-    TikTok Ads specific options for ingestion
+    [Beta] TikTok Ads specific options for ingestion
+    """
+
+    zendesk_support_options: VariableOrOptional[ZendeskSupportOptions] = None
+    """
+    [Public Preview] Zendesk Support specific options for ingestion
     """
 
     @classmethod
@@ -70,30 +206,118 @@ def as_dict(self) -> "ConnectorOptionsDict":
 class ConnectorOptionsDict(TypedDict, total=False):
     """"""
 
+    api_source_connector_options: VariableOrOptional[ApiSourceConnectorOptionsParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Connector-specific options for API Source connectors.
+    """
+
+    confluence_options: VariableOrOptional[ConfluenceConnectorOptionsParam]
+    """
+    [Public Preview] Confluence specific options for ingestion
+    """
+
     gdrive_options: VariableOrOptional[GoogleDriveOptionsParam]
     """
     :meta private: [EXPERIMENTAL]
+    
+    [Private Preview]
     """
 
     google_ads_options: VariableOrOptional[GoogleAdsOptionsParam]
     """
     :meta private: [EXPERIMENTAL]
     
-    Google Ads specific options for ingestion (object-level).
+    [Private Preview] Google Ads specific options for ingestion (object-level).
     When set, these values override the corresponding fields in GoogleAdsConfig
     (source_configurations).
     """
 
+    jira_options: VariableOrOptional[JiraConnectorOptionsParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Jira specific options for ingestion
+    """
+
+    kafka_options: VariableOrOptional[KafkaOptionsParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta]
+    """
+
+    linkedin_ads_options: VariableOrOptional[LinkedInAdsOptionsParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] LinkedIn Ads specific options for ingestion.
+    sync_start_date and lookback_window_days apply to both the prebuilt analytics
+    tables and custom reports. custom_report_options defines a custom (user-defined)
+    adAnalytics report and is only valid on a table object.
+    """
+
+    marketo_options: VariableOrOptional[MarketoOptionsParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Marketo specific options for ingestion
+    """
+
+    meta_ads_options: VariableOrOptional[MetaMarketingOptionsParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Meta Marketing (Meta Ads) specific options for ingestion
+    """
+
+    outlook_options: VariableOrOptional[OutlookOptionsParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Outlook specific options for ingestion
+    """
+
+    rabbitmq_options: VariableOrOptional[RabbitmqOptionsParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] RabbitMQ specific options for ingestion.
+    Performance tuning options (consumers_per_task, max_messages_per_fetch, etc.)
+    are intentionally not exposed in the public API. The managed connector uses
+    sensible defaults internally. These can be added later if user demand arises.
+    """
+
+    reddit_ads_options: VariableOrOptional[RedditAdsOptionsParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Reddit Ads specific options for ingestion
+    """
+
     sharepoint_options: VariableOrOptional[SharepointOptionsParam]
     """
     :meta private: [EXPERIMENTAL]
+    
+    [Private Preview]
+    """
+
+    smartsheet_options: VariableOrOptional[SmartsheetOptionsParam]
+    """
+    [Public Preview] Smartsheet specific options for ingestion
     """
 
     tiktok_ads_options: VariableOrOptional[TikTokAdsOptionsParam]
     """
     :meta private: [EXPERIMENTAL]
     
-    TikTok Ads specific options for ingestion
+    [Beta] TikTok Ads specific options for ingestion
+    """
+
+    zendesk_support_options: VariableOrOptional[ZendeskSupportOptionsParam]
+    """
+    [Public Preview] Zendesk Support specific options for ingestion
     """
 
 
diff --git a/python/databricks/bundles/pipelines/_models/connector_type.py b/python/databricks/bundles/pipelines/_models/connector_type.py
index 1b2a2054198..e8c7fb15931 100644
--- a/python/databricks/bundles/pipelines/_models/connector_type.py
+++ b/python/databricks/bundles/pipelines/_models/connector_type.py
@@ -1,11 +1,11 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
 
 class ConnectorType(Enum):
     """
-    :meta private: [EXPERIMENTAL]
-
     For certain database sources LakeFlow Connect offers both query based and cdc
     ingestion, ConnectorType can bse used to convey the type of ingestion.
     If connection_name is provided for database sources, we default to Query Based ingestion
diff --git a/python/databricks/bundles/pipelines/_models/data_staging_options.py b/python/databricks/bundles/pipelines/_models/data_staging_options.py
index 7a3ec208c30..62672108bbd 100644
--- a/python/databricks/bundles/pipelines/_models/data_staging_options.py
+++ b/python/databricks/bundles/pipelines/_models/data_staging_options.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -12,24 +14,22 @@
 @dataclass(kw_only=True)
 class DataStagingOptions:
     """
-    :meta private: [EXPERIMENTAL]
-
     Location of staged data storage
     """
 
     catalog_name: VariableOr[str]
     """
-    (Required, Immutable) The name of the catalog for the connector's staging storage location.
+    [Public Preview] (Required, Immutable) The name of the catalog for the connector's staging storage location.
     """
 
     schema_name: VariableOr[str]
     """
-    (Required, Immutable) The name of the schema for the connector's staging storage location.
+    [Public Preview] (Required, Immutable) The name of the schema for the connector's staging storage location.
     """
 
     volume_name: VariableOrOptional[str] = None
     """
-    (Optional) The Unity Catalog-compatible name for the storage location.
+    [Public Preview] (Optional) The Unity Catalog-compatible name for the storage location.
     This is the volume to use for the data that is extracted by the connector.
     Spark Declarative Pipelines system will automatically create the volume under the catalog and schema.
     For Combined Cdc Managed Ingestion pipelines default name for the volume would be :
@@ -49,17 +49,17 @@ class DataStagingOptionsDict(TypedDict, total=False):
 
     catalog_name: VariableOr[str]
     """
-    (Required, Immutable) The name of the catalog for the connector's staging storage location.
+    [Public Preview] (Required, Immutable) The name of the catalog for the connector's staging storage location.
     """
 
     schema_name: VariableOr[str]
     """
-    (Required, Immutable) The name of the schema for the connector's staging storage location.
+    [Public Preview] (Required, Immutable) The name of the schema for the connector's staging storage location.
     """
 
     volume_name: VariableOrOptional[str]
     """
-    (Optional) The Unity Catalog-compatible name for the storage location.
+    [Public Preview] (Optional) The Unity Catalog-compatible name for the storage location.
     This is the volume to use for the data that is extracted by the connector.
     Spark Declarative Pipelines system will automatically create the volume under the catalog and schema.
     For Combined Cdc Managed Ingestion pipelines default name for the volume would be :
diff --git a/python/databricks/bundles/pipelines/_models/day_of_week.py b/python/databricks/bundles/pipelines/_models/day_of_week.py
index 648acf7f795..8ba5a7c1ab6 100644
--- a/python/databricks/bundles/pipelines/_models/day_of_week.py
+++ b/python/databricks/bundles/pipelines/_models/day_of_week.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
diff --git a/python/databricks/bundles/pipelines/_models/dbfs_storage_info.py b/python/databricks/bundles/pipelines/_models/dbfs_storage_info.py
index 81fe319a65e..29744acf26a 100644
--- a/python/databricks/bundles/pipelines/_models/dbfs_storage_info.py
+++ b/python/databricks/bundles/pipelines/_models/dbfs_storage_info.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/pipelines/_models/ebs_volume_type.py b/python/databricks/bundles/pipelines/_models/ebs_volume_type.py
index b67853f8cb8..d8f3ef13f89 100644
--- a/python/databricks/bundles/pipelines/_models/ebs_volume_type.py
+++ b/python/databricks/bundles/pipelines/_models/ebs_volume_type.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
diff --git a/python/databricks/bundles/pipelines/_models/event_log_spec.py b/python/databricks/bundles/pipelines/_models/event_log_spec.py
index 9b7f5dcdcca..d415ee83246 100644
--- a/python/databricks/bundles/pipelines/_models/event_log_spec.py
+++ b/python/databricks/bundles/pipelines/_models/event_log_spec.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/pipelines/_models/file_filter.py b/python/databricks/bundles/pipelines/_models/file_filter.py
index 497c43acd45..7e80f319c0f 100644
--- a/python/databricks/bundles/pipelines/_models/file_filter.py
+++ b/python/databricks/bundles/pipelines/_models/file_filter.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -17,21 +19,27 @@ class FileFilter:
 
     modified_after: VariableOrOptional[str] = None
     """
-    Include files with modification times occurring after the specified time.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Include files with modification times occurring after the specified time.
     Timestamp format: YYYY-MM-DDTHH:mm:ss (e.g. 2020-06-01T13:00:00)
     Based on https://spark.apache.org/docs/latest/sql-data-sources-generic-options.html#modification-time-path-filters
     """
 
     modified_before: VariableOrOptional[str] = None
     """
-    Include files with modification times occurring before the specified time.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Include files with modification times occurring before the specified time.
     Timestamp format: YYYY-MM-DDTHH:mm:ss (e.g. 2020-06-01T13:00:00)
     Based on https://spark.apache.org/docs/latest/sql-data-sources-generic-options.html#modification-time-path-filters
     """
 
     path_filter: VariableOrOptional[str] = None
     """
-    Include files with file names matching the pattern
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Include files with file names matching the pattern
     Based on https://spark.apache.org/docs/latest/sql-data-sources-generic-options.html#path-glob-filter
     """
 
@@ -48,21 +56,27 @@ class FileFilterDict(TypedDict, total=False):
 
     modified_after: VariableOrOptional[str]
     """
-    Include files with modification times occurring after the specified time.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Include files with modification times occurring after the specified time.
     Timestamp format: YYYY-MM-DDTHH:mm:ss (e.g. 2020-06-01T13:00:00)
     Based on https://spark.apache.org/docs/latest/sql-data-sources-generic-options.html#modification-time-path-filters
     """
 
     modified_before: VariableOrOptional[str]
     """
-    Include files with modification times occurring before the specified time.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Include files with modification times occurring before the specified time.
     Timestamp format: YYYY-MM-DDTHH:mm:ss (e.g. 2020-06-01T13:00:00)
     Based on https://spark.apache.org/docs/latest/sql-data-sources-generic-options.html#modification-time-path-filters
     """
 
     path_filter: VariableOrOptional[str]
     """
-    Include files with file names matching the pattern
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Include files with file names matching the pattern
     Based on https://spark.apache.org/docs/latest/sql-data-sources-generic-options.html#path-glob-filter
     """
 
diff --git a/python/databricks/bundles/pipelines/_models/file_ingestion_options.py b/python/databricks/bundles/pipelines/_models/file_ingestion_options.py
index 514e19ad77f..0e6d82d6684 100644
--- a/python/databricks/bundles/pipelines/_models/file_ingestion_options.py
+++ b/python/databricks/bundles/pipelines/_models/file_ingestion_options.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
@@ -8,10 +10,7 @@
     VariableOrList,
     VariableOrOptional,
 )
-from databricks.bundles.pipelines._models.file_filter import (
-    FileFilter,
-    FileFilterParam,
-)
+from databricks.bundles.pipelines._models.file_filter import FileFilter, FileFilterParam
 from databricks.bundles.pipelines._models.file_ingestion_options_file_format import (
     FileIngestionOptionsFileFormat,
     FileIngestionOptionsFileFormatParam,
@@ -32,49 +31,86 @@ class FileIngestionOptions:
     """
 
     corrupt_record_column: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview]
+    """
 
     file_filters: VariableOrList[FileFilter] = field(default_factory=list)
     """
-    Generic options
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Generic options
     """
 
     format: VariableOrOptional[FileIngestionOptionsFileFormat] = None
     """
-    required for TableSpec
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] required for TableSpec
     """
 
     format_options: VariableOrDict[str] = field(default_factory=dict)
     """
-    Format-specific options
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Format-specific options
     Based on https://docs.databricks.com/aws/en/ingestion/cloud-object-storage/auto-loader/options#file-format-options
     """
 
     ignore_corrupt_files: VariableOrOptional[bool] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview]
+    """
 
     infer_column_types: VariableOrOptional[bool] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview]
+    """
 
     reader_case_sensitive: VariableOrOptional[bool] = None
     """
-    Column name case sensitivity
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Column name case sensitivity
     https://docs.databricks.com/aws/en/ingestion/cloud-object-storage/auto-loader/schema#change-case-sensitive-behavior
     """
 
     rescued_data_column: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview]
+    """
 
     schema_evolution_mode: VariableOrOptional[
         FileIngestionOptionsSchemaEvolutionMode
     ] = None
     """
-    Based on https://docs.databricks.com/aws/en/ingestion/cloud-object-storage/auto-loader/schema#how-does-auto-loader-schema-evolution-work
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Based on https://docs.databricks.com/aws/en/ingestion/cloud-object-storage/auto-loader/schema#how-does-auto-loader-schema-evolution-work
     """
 
     schema_hints: VariableOrOptional[str] = None
     """
-    Override inferred schema of specific columns
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Override inferred schema of specific columns
     Based on https://docs.databricks.com/aws/en/ingestion/cloud-object-storage/auto-loader/schema#override-schema-inference-with-schema-hints
     """
 
     single_variant_column: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview]
+    """
 
     @classmethod
     def from_dict(cls, value: "FileIngestionOptionsDict") -> "Self":
@@ -88,49 +124,86 @@ class FileIngestionOptionsDict(TypedDict, total=False):
     """"""
 
     corrupt_record_column: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview]
+    """
 
     file_filters: VariableOrList[FileFilterParam]
     """
-    Generic options
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Generic options
     """
 
     format: VariableOrOptional[FileIngestionOptionsFileFormatParam]
     """
-    required for TableSpec
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] required for TableSpec
     """
 
     format_options: VariableOrDict[str]
     """
-    Format-specific options
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Format-specific options
     Based on https://docs.databricks.com/aws/en/ingestion/cloud-object-storage/auto-loader/options#file-format-options
     """
 
     ignore_corrupt_files: VariableOrOptional[bool]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview]
+    """
 
     infer_column_types: VariableOrOptional[bool]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview]
+    """
 
     reader_case_sensitive: VariableOrOptional[bool]
     """
-    Column name case sensitivity
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Column name case sensitivity
     https://docs.databricks.com/aws/en/ingestion/cloud-object-storage/auto-loader/schema#change-case-sensitive-behavior
     """
 
     rescued_data_column: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview]
+    """
 
     schema_evolution_mode: VariableOrOptional[
         FileIngestionOptionsSchemaEvolutionModeParam
     ]
     """
-    Based on https://docs.databricks.com/aws/en/ingestion/cloud-object-storage/auto-loader/schema#how-does-auto-loader-schema-evolution-work
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Based on https://docs.databricks.com/aws/en/ingestion/cloud-object-storage/auto-loader/schema#how-does-auto-loader-schema-evolution-work
     """
 
     schema_hints: VariableOrOptional[str]
     """
-    Override inferred schema of specific columns
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Override inferred schema of specific columns
     Based on https://docs.databricks.com/aws/en/ingestion/cloud-object-storage/auto-loader/schema#override-schema-inference-with-schema-hints
     """
 
     single_variant_column: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview]
+    """
 
 
 FileIngestionOptionsParam = FileIngestionOptionsDict | FileIngestionOptions
diff --git a/python/databricks/bundles/pipelines/_models/file_ingestion_options_file_format.py b/python/databricks/bundles/pipelines/_models/file_ingestion_options_file_format.py
index bf5838c8701..25838583512 100644
--- a/python/databricks/bundles/pipelines/_models/file_ingestion_options_file_format.py
+++ b/python/databricks/bundles/pipelines/_models/file_ingestion_options_file_format.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
diff --git a/python/databricks/bundles/pipelines/_models/file_ingestion_options_schema_evolution_mode.py b/python/databricks/bundles/pipelines/_models/file_ingestion_options_schema_evolution_mode.py
index ac29b94d0cb..6d136255c5f 100644
--- a/python/databricks/bundles/pipelines/_models/file_ingestion_options_schema_evolution_mode.py
+++ b/python/databricks/bundles/pipelines/_models/file_ingestion_options_schema_evolution_mode.py
@@ -1,11 +1,11 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
 
 class FileIngestionOptionsSchemaEvolutionMode(Enum):
     """
-    :meta private: [EXPERIMENTAL]
-
     Based on https://docs.databricks.com/aws/en/ingestion/cloud-object-storage/auto-loader/schema#how-does-auto-loader-schema-evolution-work
     """
 
diff --git a/python/databricks/bundles/pipelines/_models/file_library.py b/python/databricks/bundles/pipelines/_models/file_library.py
index 612c1e05bd3..4fbf2a564af 100644
--- a/python/databricks/bundles/pipelines/_models/file_library.py
+++ b/python/databricks/bundles/pipelines/_models/file_library.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/pipelines/_models/filters.py b/python/databricks/bundles/pipelines/_models/filters.py
index 13f29eeb491..c9dc61c8c0c 100644
--- a/python/databricks/bundles/pipelines/_models/filters.py
+++ b/python/databricks/bundles/pipelines/_models/filters.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/pipelines/_models/gcp_attributes.py b/python/databricks/bundles/pipelines/_models/gcp_attributes.py
index 1deae0c124e..70768dd4921 100644
--- a/python/databricks/bundles/pipelines/_models/gcp_attributes.py
+++ b/python/databricks/bundles/pipelines/_models/gcp_attributes.py
@@ -1,9 +1,15 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
 from databricks.bundles.core._transform import _transform
 from databricks.bundles.core._transform_to_json import _transform_to_json_value
 from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.pipelines._models.confidential_compute_type import (
+    ConfidentialComputeType,
+    ConfidentialComputeTypeParam,
+)
 from databricks.bundles.pipelines._models.gcp_availability import (
     GcpAvailability,
     GcpAvailabilityParam,
@@ -20,12 +26,25 @@ class GcpAttributes:
     """
 
     availability: VariableOrOptional[GcpAvailability] = None
+    """
+    This field determines whether the spark executors will be scheduled to run on preemptible
+    VMs, on-demand VMs, or preemptible VMs with a fallback to on-demand VMs if the former is unavailable.
+    """
 
     boot_disk_size: VariableOrOptional[int] = None
     """
     Boot disk size in GB
     """
 
+    confidential_compute_type: VariableOrOptional[ConfidentialComputeType] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The confidential computing technology for this cluster's instances.
+    Currently only SEV_SNP is supported, and only on N2D instance types.
+    When not set, no confidential computing is applied.
+    """
+
     first_on_demand: VariableOrOptional[int] = None
     """
     The first `first_on_demand` nodes of the cluster will be placed on on-demand instances.
@@ -64,7 +83,8 @@ class GcpAttributes:
     """
     Identifier for the availability zone in which the cluster resides.
     This can be one of the following:
-    - "HA" => High availability, spread nodes across availability zones for a Databricks deployment region [default].
+    - "HA" => High availability, spread nodes across availability zones for a
+    Databricks deployment region [default].
     - "AUTO" => Databricks picks an availability zone to schedule the cluster on.
     - A GCP availability zone => Pick One of the available zones for (machine type + region) from
     https://cloud.google.com/compute/docs/regions-zones.
@@ -82,12 +102,25 @@ class GcpAttributesDict(TypedDict, total=False):
     """"""
 
     availability: VariableOrOptional[GcpAvailabilityParam]
+    """
+    This field determines whether the spark executors will be scheduled to run on preemptible
+    VMs, on-demand VMs, or preemptible VMs with a fallback to on-demand VMs if the former is unavailable.
+    """
 
     boot_disk_size: VariableOrOptional[int]
     """
     Boot disk size in GB
     """
 
+    confidential_compute_type: VariableOrOptional[ConfidentialComputeTypeParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The confidential computing technology for this cluster's instances.
+    Currently only SEV_SNP is supported, and only on N2D instance types.
+    When not set, no confidential computing is applied.
+    """
+
     first_on_demand: VariableOrOptional[int]
     """
     The first `first_on_demand` nodes of the cluster will be placed on on-demand instances.
@@ -126,7 +159,8 @@ class GcpAttributesDict(TypedDict, total=False):
     """
     Identifier for the availability zone in which the cluster resides.
     This can be one of the following:
-    - "HA" => High availability, spread nodes across availability zones for a Databricks deployment region [default].
+    - "HA" => High availability, spread nodes across availability zones for a
+    Databricks deployment region [default].
     - "AUTO" => Databricks picks an availability zone to schedule the cluster on.
     - A GCP availability zone => Pick One of the available zones for (machine type + region) from
     https://cloud.google.com/compute/docs/regions-zones.
diff --git a/python/databricks/bundles/pipelines/_models/gcp_availability.py b/python/databricks/bundles/pipelines/_models/gcp_availability.py
index aa8e785a71f..0d391b87fe3 100644
--- a/python/databricks/bundles/pipelines/_models/gcp_availability.py
+++ b/python/databricks/bundles/pipelines/_models/gcp_availability.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
diff --git a/python/databricks/bundles/pipelines/_models/gcs_storage_info.py b/python/databricks/bundles/pipelines/_models/gcs_storage_info.py
index a5e6d51e6ee..e8f1059373b 100644
--- a/python/databricks/bundles/pipelines/_models/gcs_storage_info.py
+++ b/python/databricks/bundles/pipelines/_models/gcs_storage_info.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/pipelines/_models/google_ads_config.py b/python/databricks/bundles/pipelines/_models/google_ads_config.py
new file mode 100644
index 00000000000..3ddb52b9667
--- /dev/null
+++ b/python/databricks/bundles/pipelines/_models/google_ads_config.py
@@ -0,0 +1,54 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class GoogleAdsConfig:
+    """
+    :meta private: [EXPERIMENTAL]
+    """
+
+    manager_account_id: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Required) Manager Account ID (also called MCC Account ID) used to list and access
+    customer accounts under this manager account. This is required for fetching the list
+    of customer accounts during source selection.
+    If the same field is also set in the object-level GoogleAdsOptions (connector_options),
+    the object-level value takes precedence over this top-level config.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "GoogleAdsConfigDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "GoogleAdsConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class GoogleAdsConfigDict(TypedDict, total=False):
+    """"""
+
+    manager_account_id: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Required) Manager Account ID (also called MCC Account ID) used to list and access
+    customer accounts under this manager account. This is required for fetching the list
+    of customer accounts during source selection.
+    If the same field is also set in the object-level GoogleAdsOptions (connector_options),
+    the object-level value takes precedence over this top-level config.
+    """
+
+
+GoogleAdsConfigParam = GoogleAdsConfigDict | GoogleAdsConfig
diff --git a/python/databricks/bundles/pipelines/_models/google_ads_custom_report_options.py b/python/databricks/bundles/pipelines/_models/google_ads_custom_report_options.py
new file mode 100644
index 00000000000..441a8947342
--- /dev/null
+++ b/python/databricks/bundles/pipelines/_models/google_ads_custom_report_options.py
@@ -0,0 +1,119 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrList
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class GoogleAdsCustomReportOptions:
+    """
+    :meta private: [EXPERIMENTAL]
+
+    User-defined custom report for the Google Ads connector. Mirrors the
+    resource + fields + segments + metrics model that Google Ads GAQL exposes.
+    The customer account this report runs against is supplied by the source
+    schema (namespace), not by this message. The whole message is gated by
+    the parent GoogleAdsOptions.custom_report_options stage; per-field stage
+    annotations are intentionally omitted.
+    Only supported on table-type objects: a custom report requires a
+    destination table, so it cannot be specified at the schema/source level.
+    """
+
+    resource: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Required) Google Ads resource to query (e.g. "ad_group_ad",
+    "keyword_view", "search_term_view"). Must be a resource that has
+    metrics. Values are validated against Google Ads' field-service
+    catalog at pipeline plan time.
+    """
+
+    metrics: VariableOrList[str] = field(default_factory=list)
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Metric fields to select (e.g. "metrics.clicks",
+    "metrics.cost_micros"). Multiple values are joined into the GAQL
+    SELECT clause.
+    """
+
+    resource_fields: VariableOrList[str] = field(default_factory=list)
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Resource fields to select, in fully-qualified GAQL form
+    (e.g. "ad_group_ad.ad.id", "ad_group_ad.status"). Multiple values are
+    joined into the GAQL SELECT clause.
+    """
+
+    segments: VariableOrList[str] = field(default_factory=list)
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Segment fields to select (e.g. "segments.date",
+    "segments.device"). Must include at least one of segments.date,
+    segments.week, or segments.month — that segment is used as the
+    incremental cursor for the table.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "GoogleAdsCustomReportOptionsDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "GoogleAdsCustomReportOptionsDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class GoogleAdsCustomReportOptionsDict(TypedDict, total=False):
+    """"""
+
+    resource: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Required) Google Ads resource to query (e.g. "ad_group_ad",
+    "keyword_view", "search_term_view"). Must be a resource that has
+    metrics. Values are validated against Google Ads' field-service
+    catalog at pipeline plan time.
+    """
+
+    metrics: VariableOrList[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Metric fields to select (e.g. "metrics.clicks",
+    "metrics.cost_micros"). Multiple values are joined into the GAQL
+    SELECT clause.
+    """
+
+    resource_fields: VariableOrList[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Resource fields to select, in fully-qualified GAQL form
+    (e.g. "ad_group_ad.ad.id", "ad_group_ad.status"). Multiple values are
+    joined into the GAQL SELECT clause.
+    """
+
+    segments: VariableOrList[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Segment fields to select (e.g. "segments.date",
+    "segments.device"). Must include at least one of segments.date,
+    segments.week, or segments.month — that segment is used as the
+    incremental cursor for the table.
+    """
+
+
+GoogleAdsCustomReportOptionsParam = (
+    GoogleAdsCustomReportOptionsDict | GoogleAdsCustomReportOptions
+)
diff --git a/python/databricks/bundles/pipelines/_models/google_ads_options.py b/python/databricks/bundles/pipelines/_models/google_ads_options.py
index faa76baae42..33d94383803 100644
--- a/python/databricks/bundles/pipelines/_models/google_ads_options.py
+++ b/python/databricks/bundles/pipelines/_models/google_ads_options.py
@@ -1,9 +1,15 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
 from databricks.bundles.core._transform import _transform
 from databricks.bundles.core._transform_to_json import _transform_to_json_value
 from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+from databricks.bundles.pipelines._models.google_ads_custom_report_options import (
+    GoogleAdsCustomReportOptions,
+    GoogleAdsCustomReportOptionsParam,
+)
 
 if TYPE_CHECKING:
     from typing_extensions import Self
@@ -21,20 +27,36 @@ class GoogleAdsOptions:
 
     manager_account_id: VariableOr[str]
     """
-    (Optional at this level) Manager Account ID (also called MCC Account ID) used to list
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional at this level) Manager Account ID (also called MCC Account ID) used to list
     and access customer accounts under this manager account.
     Overrides GoogleAdsConfig.manager_account_id from source_configurations when set.
     """
 
+    custom_report_options: VariableOrOptional[GoogleAdsCustomReportOptions] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Custom report definition. When set, the table is treated as a
+    user-defined Google Ads custom report: the connector synthesizes a GAQL
+    query from the resource, fields, segments, and metrics specified here.
+    When unset, the table must match one of the connector's prebuilt sources.
+    """
+
     lookback_window_days: VariableOrOptional[int] = None
     """
-    (Optional) Number of days to look back for report tables to capture late-arriving data.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Number of days to look back for report tables to capture late-arriving data.
     If not specified, defaults to 30 days.
     """
 
     sync_start_date: VariableOrOptional[str] = None
     """
-    (Optional) Start date for the initial sync of report tables in YYYY-MM-DD format.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Start date for the initial sync of report tables in YYYY-MM-DD format.
     This determines the earliest date from which to sync historical data.
     If not specified, defaults to 2 years of historical data.
     """
@@ -52,20 +74,36 @@ class GoogleAdsOptionsDict(TypedDict, total=False):
 
     manager_account_id: VariableOr[str]
     """
-    (Optional at this level) Manager Account ID (also called MCC Account ID) used to list
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional at this level) Manager Account ID (also called MCC Account ID) used to list
     and access customer accounts under this manager account.
     Overrides GoogleAdsConfig.manager_account_id from source_configurations when set.
     """
 
+    custom_report_options: VariableOrOptional[GoogleAdsCustomReportOptionsParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Custom report definition. When set, the table is treated as a
+    user-defined Google Ads custom report: the connector synthesizes a GAQL
+    query from the resource, fields, segments, and metrics specified here.
+    When unset, the table must match one of the connector's prebuilt sources.
+    """
+
     lookback_window_days: VariableOrOptional[int]
     """
-    (Optional) Number of days to look back for report tables to capture late-arriving data.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Number of days to look back for report tables to capture late-arriving data.
     If not specified, defaults to 30 days.
     """
 
     sync_start_date: VariableOrOptional[str]
     """
-    (Optional) Start date for the initial sync of report tables in YYYY-MM-DD format.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Start date for the initial sync of report tables in YYYY-MM-DD format.
     This determines the earliest date from which to sync historical data.
     If not specified, defaults to 2 years of historical data.
     """
diff --git a/python/databricks/bundles/pipelines/_models/google_drive_options.py b/python/databricks/bundles/pipelines/_models/google_drive_options.py
index 05c7c2aaa26..e11b5048555 100644
--- a/python/databricks/bundles/pipelines/_models/google_drive_options.py
+++ b/python/databricks/bundles/pipelines/_models/google_drive_options.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -24,12 +26,24 @@ class GoogleDriveOptions:
     """
 
     entity_type: VariableOrOptional[GoogleDriveOptionsGoogleDriveEntityType] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview]
+    """
 
     file_ingestion_options: VariableOrOptional[FileIngestionOptions] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview]
+    """
 
     url: VariableOrOptional[str] = None
     """
-    Google Drive URL.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Google Drive URL.
     """
 
     @classmethod
@@ -44,12 +58,24 @@ class GoogleDriveOptionsDict(TypedDict, total=False):
     """"""
 
     entity_type: VariableOrOptional[GoogleDriveOptionsGoogleDriveEntityTypeParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview]
+    """
 
     file_ingestion_options: VariableOrOptional[FileIngestionOptionsParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview]
+    """
 
     url: VariableOrOptional[str]
     """
-    Google Drive URL.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Google Drive URL.
     """
 
 
diff --git a/python/databricks/bundles/pipelines/_models/google_drive_options_google_drive_entity_type.py b/python/databricks/bundles/pipelines/_models/google_drive_options_google_drive_entity_type.py
index 136b3aff953..b3b9847c550 100644
--- a/python/databricks/bundles/pipelines/_models/google_drive_options_google_drive_entity_type.py
+++ b/python/databricks/bundles/pipelines/_models/google_drive_options_google_drive_entity_type.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
diff --git a/python/databricks/bundles/pipelines/_models/ingestion_config.py b/python/databricks/bundles/pipelines/_models/ingestion_config.py
index 34b5b7d2d7e..1d5a14cceef 100644
--- a/python/databricks/bundles/pipelines/_models/ingestion_config.py
+++ b/python/databricks/bundles/pipelines/_models/ingestion_config.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -5,11 +7,11 @@
 from databricks.bundles.core._transform_to_json import _transform_to_json_value
 from databricks.bundles.core._variable import VariableOrOptional
 from databricks.bundles.pipelines._models.report_spec import ReportSpec, ReportSpecParam
-from databricks.bundles.pipelines._models.schema_spec import SchemaSpec, SchemaSpecParam
-from databricks.bundles.pipelines._models.table_spec import (
-    TableSpec,
-    TableSpecParam,
+from databricks.bundles.pipelines._models.schema_spec import (
+    SchemaSpec,
+    SchemaSpecParam,
 )
+from databricks.bundles.pipelines._models.table_spec import TableSpec, TableSpecParam
 
 if TYPE_CHECKING:
     from typing_extensions import Self
@@ -21,17 +23,17 @@ class IngestionConfig:
 
     report: VariableOrOptional[ReportSpec] = None
     """
-    Select a specific source report.
+    [Public Preview] Select a specific source report.
     """
 
     schema: VariableOrOptional[SchemaSpec] = None
     """
-    Select all tables from a specific source schema.
+    [Public Preview] Select all tables from a specific source schema.
     """
 
     table: VariableOrOptional[TableSpec] = None
     """
-    Select a specific source table.
+    [Public Preview] Select a specific source table.
     """
 
     @classmethod
@@ -47,17 +49,17 @@ class IngestionConfigDict(TypedDict, total=False):
 
     report: VariableOrOptional[ReportSpecParam]
     """
-    Select a specific source report.
+    [Public Preview] Select a specific source report.
     """
 
     schema: VariableOrOptional[SchemaSpecParam]
     """
-    Select all tables from a specific source schema.
+    [Public Preview] Select all tables from a specific source schema.
     """
 
     table: VariableOrOptional[TableSpecParam]
     """
-    Select a specific source table.
+    [Public Preview] Select a specific source table.
     """
 
 
diff --git a/python/databricks/bundles/pipelines/_models/ingestion_gateway_pipeline_definition.py b/python/databricks/bundles/pipelines/_models/ingestion_gateway_pipeline_definition.py
index abe37602e5b..56282a61fea 100644
--- a/python/databricks/bundles/pipelines/_models/ingestion_gateway_pipeline_definition.py
+++ b/python/databricks/bundles/pipelines/_models/ingestion_gateway_pipeline_definition.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -21,34 +23,37 @@ class IngestionGatewayPipelineDefinition:
 
     connection_name: VariableOr[str]
     """
-    Immutable. The Unity Catalog connection that this gateway pipeline uses to communicate with the source.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Immutable. The Unity Catalog connection that this gateway pipeline uses to communicate with the source.
     """
 
     gateway_storage_catalog: VariableOr[str]
     """
-    Required, Immutable. The name of the catalog for the gateway pipeline's storage location.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Required, Immutable. The name of the catalog for the gateway pipeline's storage location.
     """
 
     gateway_storage_schema: VariableOr[str]
     """
-    Required, Immutable. The name of the schema for the gateway pipelines's storage location.
-    """
-
-    connection_id: VariableOrOptional[str] = None
-    """
-    [DEPRECATED] [Deprecated, use connection_name instead] Immutable. The Unity Catalog connection that this gateway pipeline uses to communicate with the source.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Required, Immutable. The name of the schema for the gateway pipelines's storage location.
     """
 
     connection_parameters: VariableOrOptional[ConnectionParameters] = None
     """
     :meta private: [EXPERIMENTAL]
     
-    Optional, Internal. Parameters required to establish an initial connection with the source.
+    [Private Preview] Optional, Internal. Parameters required to establish an initial connection with the source.
     """
 
     gateway_storage_name: VariableOrOptional[str] = None
     """
-    Optional. The Unity Catalog-compatible name for the gateway storage location.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Optional. The Unity Catalog-compatible name for the gateway storage location.
     This is the destination to use for the data that is extracted by the gateway.
     Spark Declarative Pipelines system will automatically create the storage location under the catalog and schema.
     """
@@ -66,34 +71,37 @@ class IngestionGatewayPipelineDefinitionDict(TypedDict, total=False):
 
     connection_name: VariableOr[str]
     """
-    Immutable. The Unity Catalog connection that this gateway pipeline uses to communicate with the source.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Immutable. The Unity Catalog connection that this gateway pipeline uses to communicate with the source.
     """
 
     gateway_storage_catalog: VariableOr[str]
     """
-    Required, Immutable. The name of the catalog for the gateway pipeline's storage location.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Required, Immutable. The name of the catalog for the gateway pipeline's storage location.
     """
 
     gateway_storage_schema: VariableOr[str]
     """
-    Required, Immutable. The name of the schema for the gateway pipelines's storage location.
-    """
-
-    connection_id: VariableOrOptional[str]
-    """
-    [DEPRECATED] [Deprecated, use connection_name instead] Immutable. The Unity Catalog connection that this gateway pipeline uses to communicate with the source.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Required, Immutable. The name of the schema for the gateway pipelines's storage location.
     """
 
     connection_parameters: VariableOrOptional[ConnectionParametersParam]
     """
     :meta private: [EXPERIMENTAL]
     
-    Optional, Internal. Parameters required to establish an initial connection with the source.
+    [Private Preview] Optional, Internal. Parameters required to establish an initial connection with the source.
     """
 
     gateway_storage_name: VariableOrOptional[str]
     """
-    Optional. The Unity Catalog-compatible name for the gateway storage location.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Optional. The Unity Catalog-compatible name for the gateway storage location.
     This is the destination to use for the data that is extracted by the gateway.
     Spark Declarative Pipelines system will automatically create the storage location under the catalog and schema.
     """
diff --git a/python/databricks/bundles/pipelines/_models/ingestion_pipeline_definition.py b/python/databricks/bundles/pipelines/_models/ingestion_pipeline_definition.py
index d7c98400311..605a119255e 100644
--- a/python/databricks/bundles/pipelines/_models/ingestion_pipeline_definition.py
+++ b/python/databricks/bundles/pipelines/_models/ingestion_pipeline_definition.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
@@ -39,7 +41,7 @@ class IngestionPipelineDefinition:
 
     connection_name: VariableOrOptional[str] = None
     """
-    The Unity Catalog connection that this ingestion pipeline uses to communicate with the source. This is used with
+    [Public Preview] The Unity Catalog connection that this ingestion pipeline uses to communicate with the source. This is used with
     both connectors for applications like Salesforce, Workday, and so on, and also database connectors like Oracle,
     (connector_type = QUERY_BASED OR connector_type = CDC).
     If connection name corresponds to database connectors like Oracle, and connector_type is not provided then
@@ -51,16 +53,12 @@ class IngestionPipelineDefinition:
 
     connector_type: VariableOrOptional[ConnectorType] = None
     """
-    :meta private: [EXPERIMENTAL]
-    
-    (Optional) Connector Type for sources. Ex: CDC, Query Based.
+    [Public Preview] (Optional) Connector Type for sources. Ex: CDC, Query Based.
     """
 
     data_staging_options: VariableOrOptional[DataStagingOptions] = None
     """
-    :meta private: [EXPERIMENTAL]
-    
-    (Optional) Location of staged data storage. This is required for migration from Cdc Managed Ingestion Pipeline
+    [Public Preview] (Optional) Location of staged data storage. This is required for migration from Cdc Managed Ingestion Pipeline
     with Gateway pipeline to Combined Cdc Managed Ingestion Pipeline.
     If not specified, the volume for staged data will be created in catalog and schema/target specified in the
     top level pipeline definition.
@@ -68,14 +66,12 @@ class IngestionPipelineDefinition:
 
     full_refresh_window: VariableOrOptional[OperationTimeWindow] = None
     """
-    (Optional) A window that specifies a set of time ranges for snapshot queries in CDC.
+    [Public Preview] (Optional) A window that specifies a set of time ranges for snapshot queries in CDC.
     """
 
     ingest_from_uc_foreign_catalog: VariableOrOptional[bool] = None
     """
-    :meta private: [EXPERIMENTAL]
-    
-    Immutable. If set to true, the pipeline will ingest tables from the
+    [Public Preview] Immutable. If set to true, the pipeline will ingest tables from the
     UC foreign catalogs directly without the need to specify a UC connection or ingestion gateway.
     The `source_catalog` fields in objects of IngestionConfig are interpreted as
     the UC foreign catalogs to ingest from.
@@ -83,7 +79,7 @@ class IngestionPipelineDefinition:
 
     ingestion_gateway_id: VariableOrOptional[str] = None
     """
-    Identifier for the gateway that is used by this ingestion pipeline to communicate with the source database.
+    [Public Preview] Identifier for the gateway that is used by this ingestion pipeline to communicate with the source database.
     This is used with CDC connectors to databases like SQL Server using a gateway pipeline (connector_type = CDC).
     Under certain conditions, this can be replaced with connection_name to change the connector to Combined Cdc
     Managed Ingestion Pipeline.
@@ -92,21 +88,25 @@ class IngestionPipelineDefinition:
     netsuite_jar_path: VariableOrOptional[str] = None
     """
     :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Netsuite only configuration. When the field is set for a netsuite connector,
+    the jar stored in the field will be validated and added to the classpath of
+    pipeline's cluster.
     """
 
     objects: VariableOrList[IngestionConfig] = field(default_factory=list)
     """
-    Required. Settings specifying tables to replicate and the destination for the replicated tables.
+    [Public Preview] Required. Settings specifying tables to replicate and the destination for the replicated tables.
     """
 
     source_configurations: VariableOrList[SourceConfig] = field(default_factory=list)
     """
-    Top-level source configurations
+    [Public Preview] Top-level source configurations
     """
 
     table_configuration: VariableOrOptional[TableSpecificConfig] = None
     """
-    Configuration settings to control the ingestion of tables. These settings are applied to all tables in the pipeline.
+    [Public Preview] Configuration settings to control the ingestion of tables. These settings are applied to all tables in the pipeline.
     """
 
     @classmethod
@@ -122,7 +122,7 @@ class IngestionPipelineDefinitionDict(TypedDict, total=False):
 
     connection_name: VariableOrOptional[str]
     """
-    The Unity Catalog connection that this ingestion pipeline uses to communicate with the source. This is used with
+    [Public Preview] The Unity Catalog connection that this ingestion pipeline uses to communicate with the source. This is used with
     both connectors for applications like Salesforce, Workday, and so on, and also database connectors like Oracle,
     (connector_type = QUERY_BASED OR connector_type = CDC).
     If connection name corresponds to database connectors like Oracle, and connector_type is not provided then
@@ -134,16 +134,12 @@ class IngestionPipelineDefinitionDict(TypedDict, total=False):
 
     connector_type: VariableOrOptional[ConnectorTypeParam]
     """
-    :meta private: [EXPERIMENTAL]
-    
-    (Optional) Connector Type for sources. Ex: CDC, Query Based.
+    [Public Preview] (Optional) Connector Type for sources. Ex: CDC, Query Based.
     """
 
     data_staging_options: VariableOrOptional[DataStagingOptionsParam]
     """
-    :meta private: [EXPERIMENTAL]
-    
-    (Optional) Location of staged data storage. This is required for migration from Cdc Managed Ingestion Pipeline
+    [Public Preview] (Optional) Location of staged data storage. This is required for migration from Cdc Managed Ingestion Pipeline
     with Gateway pipeline to Combined Cdc Managed Ingestion Pipeline.
     If not specified, the volume for staged data will be created in catalog and schema/target specified in the
     top level pipeline definition.
@@ -151,14 +147,12 @@ class IngestionPipelineDefinitionDict(TypedDict, total=False):
 
     full_refresh_window: VariableOrOptional[OperationTimeWindowParam]
     """
-    (Optional) A window that specifies a set of time ranges for snapshot queries in CDC.
+    [Public Preview] (Optional) A window that specifies a set of time ranges for snapshot queries in CDC.
     """
 
     ingest_from_uc_foreign_catalog: VariableOrOptional[bool]
     """
-    :meta private: [EXPERIMENTAL]
-    
-    Immutable. If set to true, the pipeline will ingest tables from the
+    [Public Preview] Immutable. If set to true, the pipeline will ingest tables from the
     UC foreign catalogs directly without the need to specify a UC connection or ingestion gateway.
     The `source_catalog` fields in objects of IngestionConfig are interpreted as
     the UC foreign catalogs to ingest from.
@@ -166,7 +160,7 @@ class IngestionPipelineDefinitionDict(TypedDict, total=False):
 
     ingestion_gateway_id: VariableOrOptional[str]
     """
-    Identifier for the gateway that is used by this ingestion pipeline to communicate with the source database.
+    [Public Preview] Identifier for the gateway that is used by this ingestion pipeline to communicate with the source database.
     This is used with CDC connectors to databases like SQL Server using a gateway pipeline (connector_type = CDC).
     Under certain conditions, this can be replaced with connection_name to change the connector to Combined Cdc
     Managed Ingestion Pipeline.
@@ -175,21 +169,25 @@ class IngestionPipelineDefinitionDict(TypedDict, total=False):
     netsuite_jar_path: VariableOrOptional[str]
     """
     :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Netsuite only configuration. When the field is set for a netsuite connector,
+    the jar stored in the field will be validated and added to the classpath of
+    pipeline's cluster.
     """
 
     objects: VariableOrList[IngestionConfigParam]
     """
-    Required. Settings specifying tables to replicate and the destination for the replicated tables.
+    [Public Preview] Required. Settings specifying tables to replicate and the destination for the replicated tables.
     """
 
     source_configurations: VariableOrList[SourceConfigParam]
     """
-    Top-level source configurations
+    [Public Preview] Top-level source configurations
     """
 
     table_configuration: VariableOrOptional[TableSpecificConfigParam]
     """
-    Configuration settings to control the ingestion of tables. These settings are applied to all tables in the pipeline.
+    [Public Preview] Configuration settings to control the ingestion of tables. These settings are applied to all tables in the pipeline.
     """
 
 
diff --git a/python/databricks/bundles/pipelines/_models/ingestion_pipeline_definition_fanout_options.py b/python/databricks/bundles/pipelines/_models/ingestion_pipeline_definition_fanout_options.py
new file mode 100644
index 00000000000..092b91581ed
--- /dev/null
+++ b/python/databricks/bundles/pipelines/_models/ingestion_pipeline_definition_fanout_options.py
@@ -0,0 +1,76 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
+from databricks.bundles.pipelines._models.transformer import (
+    Transformer,
+    TransformerParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class IngestionPipelineDefinitionFanoutOptions:
+    """
+    Fanout configuration for multi-table routing from streaming sources.
+    Routes each input record to a destination table based on a routing
+    key derived from the record. The key value becomes the table name
+    suffix: {destination_catalog}.{destination_schema}.{key_value}.
+    """
+
+    fanout_by: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Column path or SQL expression whose value determines the destination table.
+    Supports dotted paths (e.g. "value.event_name") and expressions
+    (e.g. "value:event_name::string").
+    """
+
+    transforms: VariableOrList[Transformer] = field(default_factory=list)
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Optional transforms applied to each route's DataFrame before writing
+    to the destination table.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "IngestionPipelineDefinitionFanoutOptionsDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "IngestionPipelineDefinitionFanoutOptionsDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class IngestionPipelineDefinitionFanoutOptionsDict(TypedDict, total=False):
+    """"""
+
+    fanout_by: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Column path or SQL expression whose value determines the destination table.
+    Supports dotted paths (e.g. "value.event_name") and expressions
+    (e.g. "value:event_name::string").
+    """
+
+    transforms: VariableOrList[TransformerParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Optional transforms applied to each route's DataFrame before writing
+    to the destination table.
+    """
+
+
+IngestionPipelineDefinitionFanoutOptionsParam = (
+    IngestionPipelineDefinitionFanoutOptionsDict
+    | IngestionPipelineDefinitionFanoutOptions
+)
diff --git a/python/databricks/bundles/pipelines/_models/ingestion_pipeline_definition_table_specific_config_query_based_connector_config.py b/python/databricks/bundles/pipelines/_models/ingestion_pipeline_definition_table_specific_config_query_based_connector_config.py
index 50f3cc1f57d..a784bb6e8b4 100644
--- a/python/databricks/bundles/pipelines/_models/ingestion_pipeline_definition_table_specific_config_query_based_connector_config.py
+++ b/python/databricks/bundles/pipelines/_models/ingestion_pipeline_definition_table_specific_config_query_based_connector_config.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
@@ -12,16 +14,12 @@
 @dataclass(kw_only=True)
 class IngestionPipelineDefinitionTableSpecificConfigQueryBasedConnectorConfig:
     """
-    :meta private: [EXPERIMENTAL]
-
     Configurations that are only applicable for query-based ingestion connectors.
     """
 
     cursor_columns: VariableOrList[str] = field(default_factory=list)
     """
-    :meta private: [EXPERIMENTAL]
-    
-    The names of the monotonically increasing columns in the source table that are used to enable
+    [Public Preview] The names of the monotonically increasing columns in the source table that are used to enable
     the table to be read and ingested incrementally through structured streaming.
     The columns are allowed to have repeated values but have to be non-decreasing.
     If the source data is merged into the destination (e.g., using SCD Type 1 or Type 2), these
@@ -31,9 +29,7 @@ class IngestionPipelineDefinitionTableSpecificConfigQueryBasedConnectorConfig:
 
     deletion_condition: VariableOrOptional[str] = None
     """
-    :meta private: [EXPERIMENTAL]
-    
-    Specifies a SQL WHERE condition that specifies that the source row has been deleted.
+    [Public Preview] Specifies a SQL WHERE condition that specifies that the source row has been deleted.
     This is sometimes referred to as "soft-deletes".
     For example: "Operation = 'DELETE'" or "is_deleted = true".
     This field is orthogonal to `hard_deletion_sync_interval_in_seconds`,
@@ -46,7 +42,7 @@ class IngestionPipelineDefinitionTableSpecificConfigQueryBasedConnectorConfig:
     """
     :meta private: [EXPERIMENTAL]
     
-    Specifies the minimum interval (in seconds) between snapshots on primary keys
+    [Beta] Specifies the minimum interval (in seconds) between snapshots on primary keys
     for detecting and synchronizing hard deletions—i.e., rows that have been
     physically removed from the source table.
     This interval acts as a lower bound. If ingestion runs less frequently than
@@ -76,9 +72,7 @@ class IngestionPipelineDefinitionTableSpecificConfigQueryBasedConnectorConfigDic
 
     cursor_columns: VariableOrList[str]
     """
-    :meta private: [EXPERIMENTAL]
-    
-    The names of the monotonically increasing columns in the source table that are used to enable
+    [Public Preview] The names of the monotonically increasing columns in the source table that are used to enable
     the table to be read and ingested incrementally through structured streaming.
     The columns are allowed to have repeated values but have to be non-decreasing.
     If the source data is merged into the destination (e.g., using SCD Type 1 or Type 2), these
@@ -88,9 +82,7 @@ class IngestionPipelineDefinitionTableSpecificConfigQueryBasedConnectorConfigDic
 
     deletion_condition: VariableOrOptional[str]
     """
-    :meta private: [EXPERIMENTAL]
-    
-    Specifies a SQL WHERE condition that specifies that the source row has been deleted.
+    [Public Preview] Specifies a SQL WHERE condition that specifies that the source row has been deleted.
     This is sometimes referred to as "soft-deletes".
     For example: "Operation = 'DELETE'" or "is_deleted = true".
     This field is orthogonal to `hard_deletion_sync_interval_in_seconds`,
@@ -103,7 +95,7 @@ class IngestionPipelineDefinitionTableSpecificConfigQueryBasedConnectorConfigDic
     """
     :meta private: [EXPERIMENTAL]
     
-    Specifies the minimum interval (in seconds) between snapshots on primary keys
+    [Beta] Specifies the minimum interval (in seconds) between snapshots on primary keys
     for detecting and synchronizing hard deletions—i.e., rows that have been
     physically removed from the source table.
     This interval acts as a lower bound. If ingestion runs less frequently than
diff --git a/python/databricks/bundles/pipelines/_models/ingestion_pipeline_definition_workday_report_parameters.py b/python/databricks/bundles/pipelines/_models/ingestion_pipeline_definition_workday_report_parameters.py
index d48d68495df..a819adcf236 100644
--- a/python/databricks/bundles/pipelines/_models/ingestion_pipeline_definition_workday_report_parameters.py
+++ b/python/databricks/bundles/pipelines/_models/ingestion_pipeline_definition_workday_report_parameters.py
@@ -1,17 +1,11 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
 from databricks.bundles.core._transform import _transform
 from databricks.bundles.core._transform_to_json import _transform_to_json_value
-from databricks.bundles.core._variable import (
-    VariableOrDict,
-    VariableOrList,
-    VariableOrOptional,
-)
-from databricks.bundles.pipelines._models.ingestion_pipeline_definition_workday_report_parameters_query_key_value import (
-    IngestionPipelineDefinitionWorkdayReportParametersQueryKeyValue,
-    IngestionPipelineDefinitionWorkdayReportParametersQueryKeyValueParam,
-)
+from databricks.bundles.core._variable import VariableOrDict
 
 if TYPE_CHECKING:
     from typing_extensions import Self
@@ -23,16 +17,11 @@ class IngestionPipelineDefinitionWorkdayReportParameters:
     :meta private: [EXPERIMENTAL]
     """
 
-    incremental: VariableOrOptional[bool] = None
-    """
-    [DEPRECATED] (Optional) Marks the report as incremental.
-    This field is deprecated and should not be used. Use `parameters` instead. The incremental behavior is now
-    controlled by the `parameters` field.
-    """
-
     parameters: VariableOrDict[str] = field(default_factory=dict)
     """
-    Parameters for the Workday report. Each key represents the parameter name (e.g., "start_date", "end_date"),
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Parameters for the Workday report. Each key represents the parameter name (e.g., "start_date", "end_date"),
     and the corresponding value is a SQL-like expression used to compute the parameter value at runtime.
     Example:
     {
@@ -41,14 +30,6 @@ class IngestionPipelineDefinitionWorkdayReportParameters:
     }
     """
 
-    report_parameters: VariableOrList[
-        IngestionPipelineDefinitionWorkdayReportParametersQueryKeyValue
-    ] = field(default_factory=list)
-    """
-    [DEPRECATED] (Optional) Additional custom parameters for Workday Report
-    This field is deprecated and should not be used. Use `parameters` instead.
-    """
-
     @classmethod
     def from_dict(
         cls, value: "IngestionPipelineDefinitionWorkdayReportParametersDict"
@@ -62,16 +43,11 @@ def as_dict(self) -> "IngestionPipelineDefinitionWorkdayReportParametersDict":
 class IngestionPipelineDefinitionWorkdayReportParametersDict(TypedDict, total=False):
     """"""
 
-    incremental: VariableOrOptional[bool]
-    """
-    [DEPRECATED] (Optional) Marks the report as incremental.
-    This field is deprecated and should not be used. Use `parameters` instead. The incremental behavior is now
-    controlled by the `parameters` field.
-    """
-
     parameters: VariableOrDict[str]
     """
-    Parameters for the Workday report. Each key represents the parameter name (e.g., "start_date", "end_date"),
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Parameters for the Workday report. Each key represents the parameter name (e.g., "start_date", "end_date"),
     and the corresponding value is a SQL-like expression used to compute the parameter value at runtime.
     Example:
     {
@@ -80,14 +56,6 @@ class IngestionPipelineDefinitionWorkdayReportParametersDict(TypedDict, total=Fa
     }
     """
 
-    report_parameters: VariableOrList[
-        IngestionPipelineDefinitionWorkdayReportParametersQueryKeyValueParam
-    ]
-    """
-    [DEPRECATED] (Optional) Additional custom parameters for Workday Report
-    This field is deprecated and should not be used. Use `parameters` instead.
-    """
-
 
 IngestionPipelineDefinitionWorkdayReportParametersParam = (
     IngestionPipelineDefinitionWorkdayReportParametersDict
diff --git a/python/databricks/bundles/pipelines/_models/ingestion_pipeline_definition_workday_report_parameters_query_key_value.py b/python/databricks/bundles/pipelines/_models/ingestion_pipeline_definition_workday_report_parameters_query_key_value.py
deleted file mode 100644
index 2a24858d66e..00000000000
--- a/python/databricks/bundles/pipelines/_models/ingestion_pipeline_definition_workday_report_parameters_query_key_value.py
+++ /dev/null
@@ -1,70 +0,0 @@
-from dataclasses import dataclass
-from typing import TYPE_CHECKING, TypedDict
-
-from databricks.bundles.core._transform import _transform
-from databricks.bundles.core._transform_to_json import _transform_to_json_value
-from databricks.bundles.core._variable import VariableOrOptional
-
-if TYPE_CHECKING:
-    from typing_extensions import Self
-
-
-@dataclass(kw_only=True)
-class IngestionPipelineDefinitionWorkdayReportParametersQueryKeyValue:
-    """
-    :meta private: [EXPERIMENTAL]
-
-    [DEPRECATED]
-    """
-
-    key: VariableOrOptional[str] = None
-    """
-    Key for the report parameter, can be a column name or other metadata
-    """
-
-    value: VariableOrOptional[str] = None
-    """
-    Value for the report parameter.
-    Possible values it can take are these sql functions:
-    1. coalesce(current_offset(), date("YYYY-MM-DD")) -> if current_offset() is null, then the passed date, else current_offset()
-    2. current_date()
-    3. date_sub(current_date(), x) -> subtract x (some non-negative integer) days from current date
-    """
-
-    @classmethod
-    def from_dict(
-        cls,
-        value: "IngestionPipelineDefinitionWorkdayReportParametersQueryKeyValueDict",
-    ) -> "Self":
-        return _transform(cls, value)
-
-    def as_dict(
-        self,
-    ) -> "IngestionPipelineDefinitionWorkdayReportParametersQueryKeyValueDict":
-        return _transform_to_json_value(self)  # type:ignore
-
-
-class IngestionPipelineDefinitionWorkdayReportParametersQueryKeyValueDict(
-    TypedDict, total=False
-):
-    """"""
-
-    key: VariableOrOptional[str]
-    """
-    Key for the report parameter, can be a column name or other metadata
-    """
-
-    value: VariableOrOptional[str]
-    """
-    Value for the report parameter.
-    Possible values it can take are these sql functions:
-    1. coalesce(current_offset(), date("YYYY-MM-DD")) -> if current_offset() is null, then the passed date, else current_offset()
-    2. current_date()
-    3. date_sub(current_date(), x) -> subtract x (some non-negative integer) days from current date
-    """
-
-
-IngestionPipelineDefinitionWorkdayReportParametersQueryKeyValueParam = (
-    IngestionPipelineDefinitionWorkdayReportParametersQueryKeyValueDict
-    | IngestionPipelineDefinitionWorkdayReportParametersQueryKeyValue
-)
diff --git a/python/databricks/bundles/pipelines/_models/init_script_info.py b/python/databricks/bundles/pipelines/_models/init_script_info.py
index 6a6297a30bf..f6c696d11bd 100644
--- a/python/databricks/bundles/pipelines/_models/init_script_info.py
+++ b/python/databricks/bundles/pipelines/_models/init_script_info.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -41,7 +43,6 @@
 class InitScriptInfo:
     """
     Config for an individual init script
-    Next ID: 11
     """
 
     abfss: VariableOrOptional[Adlsgen2Info] = None
diff --git a/python/databricks/bundles/pipelines/_models/jira_connector_options.py b/python/databricks/bundles/pipelines/_models/jira_connector_options.py
new file mode 100644
index 00000000000..ef7ba677587
--- /dev/null
+++ b/python/databricks/bundles/pipelines/_models/jira_connector_options.py
@@ -0,0 +1,46 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class JiraConnectorOptions:
+    """
+    Jira specific options for ingestion
+    """
+
+    include_jira_spaces: VariableOrList[str] = field(default_factory=list)
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] (Optional) Projects to filter Jira data on
+    """
+
+    @classmethod
+    def from_dict(cls, value: "JiraConnectorOptionsDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "JiraConnectorOptionsDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class JiraConnectorOptionsDict(TypedDict, total=False):
+    """"""
+
+    include_jira_spaces: VariableOrList[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] (Optional) Projects to filter Jira data on
+    """
+
+
+JiraConnectorOptionsParam = JiraConnectorOptionsDict | JiraConnectorOptions
diff --git a/python/databricks/bundles/pipelines/_models/json_transformer_options.py b/python/databricks/bundles/pipelines/_models/json_transformer_options.py
new file mode 100644
index 00000000000..8359f564eb2
--- /dev/null
+++ b/python/databricks/bundles/pipelines/_models/json_transformer_options.py
@@ -0,0 +1,108 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.pipelines._models.file_ingestion_options_schema_evolution_mode import (
+    FileIngestionOptionsSchemaEvolutionMode,
+    FileIngestionOptionsSchemaEvolutionModeParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class JsonTransformerOptions:
+    """"""
+
+    as_variant: VariableOrOptional[bool] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Parse the entire value as a single Variant column.
+    """
+
+    schema: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Inline schema string for JSON parsing (Spark DDL format).
+    """
+
+    schema_evolution_mode: VariableOrOptional[
+        FileIngestionOptionsSchemaEvolutionMode
+    ] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] (Optional) Schema evolution mode for schema inference.
+    """
+
+    schema_file_path: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Path to a schema file (.ddl).
+    """
+
+    schema_hints: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] (Optional) Schema hints as a comma-separated string of "column_name type" pairs.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "JsonTransformerOptionsDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "JsonTransformerOptionsDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class JsonTransformerOptionsDict(TypedDict, total=False):
+    """"""
+
+    as_variant: VariableOrOptional[bool]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Parse the entire value as a single Variant column.
+    """
+
+    schema: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Inline schema string for JSON parsing (Spark DDL format).
+    """
+
+    schema_evolution_mode: VariableOrOptional[
+        FileIngestionOptionsSchemaEvolutionModeParam
+    ]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] (Optional) Schema evolution mode for schema inference.
+    """
+
+    schema_file_path: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Path to a schema file (.ddl).
+    """
+
+    schema_hints: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] (Optional) Schema hints as a comma-separated string of "column_name type" pairs.
+    """
+
+
+JsonTransformerOptionsParam = JsonTransformerOptionsDict | JsonTransformerOptions
diff --git a/python/databricks/bundles/pipelines/_models/kafka_options.py b/python/databricks/bundles/pipelines/_models/kafka_options.py
new file mode 100644
index 00000000000..d42b585624d
--- /dev/null
+++ b/python/databricks/bundles/pipelines/_models/kafka_options.py
@@ -0,0 +1,150 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import (
+    VariableOrDict,
+    VariableOrList,
+    VariableOrOptional,
+)
+from databricks.bundles.pipelines._models.transformer import (
+    Transformer,
+    TransformerParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class KafkaOptions:
+    """"""
+
+    client_config: VariableOrDict[str] = field(default_factory=dict)
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Undocumented backdoor mechanism for overriding parameters
+    to pass to the Kafka client.
+    This is not supported and may break at any time.
+    """
+
+    key_transformer: VariableOrOptional[Transformer] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] (Optional) Transformer for the message key.
+    If not specified, the key is left as raw bytes.
+    """
+
+    max_offsets_per_trigger: VariableOrOptional[int] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Internal option to control the maximum number of offsets to process per trigger.
+    """
+
+    starting_offset: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] (Optional) Where to begin reading when no checkpoint exists.
+    Valid values: "latest" and "earliest". Defaults to "latest".
+    """
+
+    topic_pattern: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Java regex pattern to subscribe to matching topics.
+    Only one of topics or topic_pattern must be specified.
+    """
+
+    topics: VariableOrList[str] = field(default_factory=list)
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Topics to subscribe to.
+    Only one of topics or topic_pattern must be specified.
+    """
+
+    value_transformer: VariableOrOptional[Transformer] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] (Optional) Transformer for the message value.
+    If not specified, the value is left as raw bytes.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "KafkaOptionsDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "KafkaOptionsDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class KafkaOptionsDict(TypedDict, total=False):
+    """"""
+
+    client_config: VariableOrDict[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Undocumented backdoor mechanism for overriding parameters
+    to pass to the Kafka client.
+    This is not supported and may break at any time.
+    """
+
+    key_transformer: VariableOrOptional[TransformerParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] (Optional) Transformer for the message key.
+    If not specified, the key is left as raw bytes.
+    """
+
+    max_offsets_per_trigger: VariableOrOptional[int]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Internal option to control the maximum number of offsets to process per trigger.
+    """
+
+    starting_offset: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] (Optional) Where to begin reading when no checkpoint exists.
+    Valid values: "latest" and "earliest". Defaults to "latest".
+    """
+
+    topic_pattern: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Java regex pattern to subscribe to matching topics.
+    Only one of topics or topic_pattern must be specified.
+    """
+
+    topics: VariableOrList[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Topics to subscribe to.
+    Only one of topics or topic_pattern must be specified.
+    """
+
+    value_transformer: VariableOrOptional[TransformerParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] (Optional) Transformer for the message value.
+    If not specified, the value is left as raw bytes.
+    """
+
+
+KafkaOptionsParam = KafkaOptionsDict | KafkaOptions
diff --git a/python/databricks/bundles/pipelines/_models/lifecycle.py b/python/databricks/bundles/pipelines/_models/lifecycle.py
index c934967f37e..697776a198e 100644
--- a/python/databricks/bundles/pipelines/_models/lifecycle.py
+++ b/python/databricks/bundles/pipelines/_models/lifecycle.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/pipelines/_models/linked_in_ads_options.py b/python/databricks/bundles/pipelines/_models/linked_in_ads_options.py
new file mode 100644
index 00000000000..1d997abc919
--- /dev/null
+++ b/python/databricks/bundles/pipelines/_models/linked_in_ads_options.py
@@ -0,0 +1,103 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.pipelines._models.linked_in_ads_options_linked_in_ads_custom_report_options import (
+    LinkedInAdsOptionsLinkedInAdsCustomReportOptions,
+    LinkedInAdsOptionsLinkedInAdsCustomReportOptionsParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class LinkedInAdsOptions:
+    """
+    :meta private: [EXPERIMENTAL]
+
+    LinkedIn Ads specific options for ingestion.
+    sync_start_date and lookback_window_days apply to both the prebuilt analytics
+    tables and custom reports. custom_report_options defines a custom (user-defined)
+    adAnalytics report and is only valid on a table object.
+    """
+
+    custom_report_options: VariableOrOptional[
+        LinkedInAdsOptionsLinkedInAdsCustomReportOptions
+    ] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Custom report definition. Only valid on a table object. When set,
+    the table is synthesized from /rest/adAnalytics using the finder, pivots,
+    time granularity and metrics here. When unset, the table must match one of
+    the connector's prebuilt sources.
+    """
+
+    lookback_window_days: VariableOrOptional[int] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Days to look back during incremental sync for late-arriving data.
+    If not specified, defaults to 30 days.
+    """
+
+    sync_start_date: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Start date for the initial sync of report tables, YYYY-MM-DD.
+    Earliest date from which to sync historical data; overrides the default
+    when set. For finder attributedRevenueMetrics, this must be between 30 and
+    366 days before today.
+    If not specified, defaults to 1 year of history.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "LinkedInAdsOptionsDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "LinkedInAdsOptionsDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class LinkedInAdsOptionsDict(TypedDict, total=False):
+    """"""
+
+    custom_report_options: VariableOrOptional[
+        LinkedInAdsOptionsLinkedInAdsCustomReportOptionsParam
+    ]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Custom report definition. Only valid on a table object. When set,
+    the table is synthesized from /rest/adAnalytics using the finder, pivots,
+    time granularity and metrics here. When unset, the table must match one of
+    the connector's prebuilt sources.
+    """
+
+    lookback_window_days: VariableOrOptional[int]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Days to look back during incremental sync for late-arriving data.
+    If not specified, defaults to 30 days.
+    """
+
+    sync_start_date: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Start date for the initial sync of report tables, YYYY-MM-DD.
+    Earliest date from which to sync historical data; overrides the default
+    when set. For finder attributedRevenueMetrics, this must be between 30 and
+    366 days before today.
+    If not specified, defaults to 1 year of history.
+    """
+
+
+LinkedInAdsOptionsParam = LinkedInAdsOptionsDict | LinkedInAdsOptions
diff --git a/python/databricks/bundles/pipelines/_models/linked_in_ads_options_linked_in_ads_custom_report_options.py b/python/databricks/bundles/pipelines/_models/linked_in_ads_options_linked_in_ads_custom_report_options.py
new file mode 100644
index 00000000000..1420eb50d50
--- /dev/null
+++ b/python/databricks/bundles/pipelines/_models/linked_in_ads_options_linked_in_ads_custom_report_options.py
@@ -0,0 +1,140 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import (
+    VariableOr,
+    VariableOrList,
+    VariableOrOptional,
+)
+from databricks.bundles.pipelines._models.linked_in_ads_options_linked_in_ads_custom_report_options_linked_in_ads_entity_granularity import (
+    LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsEntityGranularity,
+    LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsEntityGranularityParam,
+)
+from databricks.bundles.pipelines._models.linked_in_ads_options_linked_in_ads_custom_report_options_linked_in_ads_finder import (
+    LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsFinder,
+    LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsFinderParam,
+)
+from databricks.bundles.pipelines._models.linked_in_ads_options_linked_in_ads_custom_report_options_linked_in_ads_time_granularity import (
+    LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsTimeGranularity,
+    LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsTimeGranularityParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class LinkedInAdsOptionsLinkedInAdsCustomReportOptions:
+    """
+    :meta private: [EXPERIMENTAL]
+
+    User-defined custom report for the LinkedIn Ads connector. The destination
+    table name comes from the enclosing TableSpec.destination_table, the start
+    date from the enclosing LinkedInAdsOptions.sync_start_date, and the account
+    it runs against from the source schema (namespace) -- none are repeated here.
+    """
+
+    finder: VariableOr[
+        LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsFinder
+    ]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Required) adAnalytics finder. See LinkedInAdsFinder.
+    """
+
+    entity_granularity: VariableOrList[
+        LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsEntityGranularity
+    ] = field(default_factory=list)
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Required) Entity pivots to group by; count/constraints depend on finder.
+    """
+
+    metrics: VariableOrList[str] = field(default_factory=list)
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) LinkedIn metric names for the report. Open vocabulary (not an
+    enum): the valid set is large (~100) and evolves with the LinkedIn
+    adAnalytics API, so values are passed through verbatim. If empty, a
+    pivot-safe default core set is ingested: impressions, clicks,
+    costInLocalCurrency, externalWebsiteConversions (valid for every pivot).
+    Ignored for attributedRevenueMetrics (always returns the full
+    RevenueAttributionMetrics struct).
+    """
+
+    time_granularity: VariableOrOptional[
+        LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsTimeGranularity
+    ] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Time aggregation. Defaults to DAILY when unspecified. Used by
+    analytics/statistics; ignored for attributedRevenueMetrics.
+    """
+
+    @classmethod
+    def from_dict(
+        cls, value: "LinkedInAdsOptionsLinkedInAdsCustomReportOptionsDict"
+    ) -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "LinkedInAdsOptionsLinkedInAdsCustomReportOptionsDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class LinkedInAdsOptionsLinkedInAdsCustomReportOptionsDict(TypedDict, total=False):
+    """"""
+
+    finder: VariableOr[
+        LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsFinderParam
+    ]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Required) adAnalytics finder. See LinkedInAdsFinder.
+    """
+
+    entity_granularity: VariableOrList[
+        LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsEntityGranularityParam
+    ]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Required) Entity pivots to group by; count/constraints depend on finder.
+    """
+
+    metrics: VariableOrList[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) LinkedIn metric names for the report. Open vocabulary (not an
+    enum): the valid set is large (~100) and evolves with the LinkedIn
+    adAnalytics API, so values are passed through verbatim. If empty, a
+    pivot-safe default core set is ingested: impressions, clicks,
+    costInLocalCurrency, externalWebsiteConversions (valid for every pivot).
+    Ignored for attributedRevenueMetrics (always returns the full
+    RevenueAttributionMetrics struct).
+    """
+
+    time_granularity: VariableOrOptional[
+        LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsTimeGranularityParam
+    ]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Time aggregation. Defaults to DAILY when unspecified. Used by
+    analytics/statistics; ignored for attributedRevenueMetrics.
+    """
+
+
+LinkedInAdsOptionsLinkedInAdsCustomReportOptionsParam = (
+    LinkedInAdsOptionsLinkedInAdsCustomReportOptionsDict
+    | LinkedInAdsOptionsLinkedInAdsCustomReportOptions
+)
diff --git a/python/databricks/bundles/pipelines/_models/linked_in_ads_options_linked_in_ads_custom_report_options_linked_in_ads_entity_granularity.py b/python/databricks/bundles/pipelines/_models/linked_in_ads_options_linked_in_ads_custom_report_options_linked_in_ads_entity_granularity.py
new file mode 100644
index 00000000000..ae32b0b83a4
--- /dev/null
+++ b/python/databricks/bundles/pipelines/_models/linked_in_ads_options_linked_in_ads_custom_report_options_linked_in_ads_entity_granularity.py
@@ -0,0 +1,24 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsEntityGranularity(
+    Enum
+):
+    """
+    :meta private: [EXPERIMENTAL]
+
+    Entity pivot to group by.
+    """
+
+    CAMPAIGN = "CAMPAIGN"
+    CREATIVE = "CREATIVE"
+    CAMPAIGN_GROUP = "CAMPAIGN_GROUP"
+
+
+LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsEntityGranularityParam = (
+    Literal["CAMPAIGN", "CREATIVE", "CAMPAIGN_GROUP"]
+    | LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsEntityGranularity
+)
diff --git a/python/databricks/bundles/pipelines/_models/linked_in_ads_options_linked_in_ads_custom_report_options_linked_in_ads_finder.py b/python/databricks/bundles/pipelines/_models/linked_in_ads_options_linked_in_ads_custom_report_options_linked_in_ads_finder.py
new file mode 100644
index 00000000000..9abf3e9d7be
--- /dev/null
+++ b/python/databricks/bundles/pipelines/_models/linked_in_ads_options_linked_in_ads_custom_report_options_linked_in_ads_finder.py
@@ -0,0 +1,23 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsFinder(Enum):
+    """
+    :meta private: [EXPERIMENTAL]
+
+    adAnalytics finder. Determines call shape, valid pivots, and metric
+    requirements.
+    """
+
+    ANALYTICS = "ANALYTICS"
+    STATISTICS = "STATISTICS"
+    ATTRIBUTED_REVENUE_METRICS = "ATTRIBUTED_REVENUE_METRICS"
+
+
+LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsFinderParam = (
+    Literal["ANALYTICS", "STATISTICS", "ATTRIBUTED_REVENUE_METRICS"]
+    | LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsFinder
+)
diff --git a/python/databricks/bundles/pipelines/_models/linked_in_ads_options_linked_in_ads_custom_report_options_linked_in_ads_time_granularity.py b/python/databricks/bundles/pipelines/_models/linked_in_ads_options_linked_in_ads_custom_report_options_linked_in_ads_time_granularity.py
new file mode 100644
index 00000000000..256974843ea
--- /dev/null
+++ b/python/databricks/bundles/pipelines/_models/linked_in_ads_options_linked_in_ads_custom_report_options_linked_in_ads_time_granularity.py
@@ -0,0 +1,24 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsTimeGranularity(Enum):
+    """
+    :meta private: [EXPERIMENTAL]
+
+    Time aggregation. Used by analytics/statistics; ignored for
+    attributedRevenueMetrics. Defaults to DAILY when unspecified.
+    """
+
+    ALL = "ALL"
+    DAILY = "DAILY"
+    MONTHLY = "MONTHLY"
+    YEARLY = "YEARLY"
+
+
+LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsTimeGranularityParam = (
+    Literal["ALL", "DAILY", "MONTHLY", "YEARLY"]
+    | LinkedInAdsOptionsLinkedInAdsCustomReportOptionsLinkedInAdsTimeGranularity
+)
diff --git a/python/databricks/bundles/pipelines/_models/local_file_info.py b/python/databricks/bundles/pipelines/_models/local_file_info.py
index 70d6f258200..875f2fe8353 100644
--- a/python/databricks/bundles/pipelines/_models/local_file_info.py
+++ b/python/databricks/bundles/pipelines/_models/local_file_info.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/pipelines/_models/log_analytics_info.py b/python/databricks/bundles/pipelines/_models/log_analytics_info.py
index 5eced870a1e..67cdf85b2b9 100644
--- a/python/databricks/bundles/pipelines/_models/log_analytics_info.py
+++ b/python/databricks/bundles/pipelines/_models/log_analytics_info.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/pipelines/_models/marketo_options.py b/python/databricks/bundles/pipelines/_models/marketo_options.py
new file mode 100644
index 00000000000..943dba4ff7b
--- /dev/null
+++ b/python/databricks/bundles/pipelines/_models/marketo_options.py
@@ -0,0 +1,52 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class MarketoOptions:
+    """
+    :meta private: [EXPERIMENTAL]
+
+    Marketo specific options for ingestion
+    """
+
+    sync_start_date: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Start date for the initial sync in YYYY-MM-DD format.
+    This determines the earliest date from which to sync historical data.
+    If not specified, complete history is ingested.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "MarketoOptionsDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "MarketoOptionsDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class MarketoOptionsDict(TypedDict, total=False):
+    """"""
+
+    sync_start_date: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Start date for the initial sync in YYYY-MM-DD format.
+    This determines the earliest date from which to sync historical data.
+    If not specified, complete history is ingested.
+    """
+
+
+MarketoOptionsParam = MarketoOptionsDict | MarketoOptions
diff --git a/python/databricks/bundles/pipelines/_models/maven_library.py b/python/databricks/bundles/pipelines/_models/maven_library.py
index 45925700b82..25be1599c28 100644
--- a/python/databricks/bundles/pipelines/_models/maven_library.py
+++ b/python/databricks/bundles/pipelines/_models/maven_library.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/pipelines/_models/meta_marketing_options.py b/python/databricks/bundles/pipelines/_models/meta_marketing_options.py
new file mode 100644
index 00000000000..9a9f657bf5f
--- /dev/null
+++ b/python/databricks/bundles/pipelines/_models/meta_marketing_options.py
@@ -0,0 +1,182 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
+from databricks.bundles.pipelines._models.meta_marketing_options_meta_marketing_custom_report_options import (
+    MetaMarketingOptionsMetaMarketingCustomReportOptions,
+    MetaMarketingOptionsMetaMarketingCustomReportOptionsParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class MetaMarketingOptions:
+    """
+    Meta Marketing (Meta Ads) specific options for ingestion
+    """
+
+    action_attribution_windows: VariableOrList[str] = field(default_factory=list)
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [DEPRECATED] [Beta] (Optional, DEPRECATED — use custom_report_options.action_attribution_windows) Action attribution
+    windows for insights reporting (e.g. "28d_click", "1d_view")
+    """
+
+    action_breakdowns: VariableOrList[str] = field(default_factory=list)
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [DEPRECATED] [Beta] (Optional, DEPRECATED — use custom_report_options.action_breakdowns) Action breakdowns
+    """
+
+    action_report_time: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [DEPRECATED] [Beta] (Optional, DEPRECATED — use custom_report_options.action_report_time) Timing used to report
+    action statistics (impression, conversion, mixed, or lifetime)
+    """
+
+    breakdowns: VariableOrList[str] = field(default_factory=list)
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [DEPRECATED] [Beta] (Optional, DEPRECATED — use custom_report_options.breakdowns) Breakdowns to configure
+    """
+
+    custom_insights_lookback_window: VariableOrOptional[int] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] (Optional) Window in days to revisit data during sync to capture
+    updated conversion data from the API, shared by prebuilt and custom reports.
+    """
+
+    custom_report_options: VariableOrOptional[
+        MetaMarketingOptionsMetaMarketingCustomReportOptions
+    ] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Per-table custom report definition. When set, defines the shape of the insights
+    call for this table (level/fields/breakdowns/action_breakdowns/etc.). Supersedes the deprecated
+    flat report-shape fields above.
+    """
+
+    level: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [DEPRECATED] [Beta] (Optional, DEPRECATED — use custom_report_options.level) Granularity of data to pull
+    (account, ad, adset, campaign)
+    """
+
+    start_date: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] (Optional) Start date in yyyy-MM-dd format (e.g. 2025-01-15). Data added
+    after this date will be ingested, shared by prebuilt and custom reports.
+    """
+
+    time_increment: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [DEPRECATED] [Beta] (Optional, DEPRECATED — use custom_report_options.time_increment) Value in string by which to
+    aggregate statistics (can take all_days, monthly or number of days)
+    """
+
+    @classmethod
+    def from_dict(cls, value: "MetaMarketingOptionsDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "MetaMarketingOptionsDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class MetaMarketingOptionsDict(TypedDict, total=False):
+    """"""
+
+    action_attribution_windows: VariableOrList[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [DEPRECATED] [Beta] (Optional, DEPRECATED — use custom_report_options.action_attribution_windows) Action attribution
+    windows for insights reporting (e.g. "28d_click", "1d_view")
+    """
+
+    action_breakdowns: VariableOrList[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [DEPRECATED] [Beta] (Optional, DEPRECATED — use custom_report_options.action_breakdowns) Action breakdowns
+    """
+
+    action_report_time: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [DEPRECATED] [Beta] (Optional, DEPRECATED — use custom_report_options.action_report_time) Timing used to report
+    action statistics (impression, conversion, mixed, or lifetime)
+    """
+
+    breakdowns: VariableOrList[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [DEPRECATED] [Beta] (Optional, DEPRECATED — use custom_report_options.breakdowns) Breakdowns to configure
+    """
+
+    custom_insights_lookback_window: VariableOrOptional[int]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] (Optional) Window in days to revisit data during sync to capture
+    updated conversion data from the API, shared by prebuilt and custom reports.
+    """
+
+    custom_report_options: VariableOrOptional[
+        MetaMarketingOptionsMetaMarketingCustomReportOptionsParam
+    ]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Per-table custom report definition. When set, defines the shape of the insights
+    call for this table (level/fields/breakdowns/action_breakdowns/etc.). Supersedes the deprecated
+    flat report-shape fields above.
+    """
+
+    level: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [DEPRECATED] [Beta] (Optional, DEPRECATED — use custom_report_options.level) Granularity of data to pull
+    (account, ad, adset, campaign)
+    """
+
+    start_date: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] (Optional) Start date in yyyy-MM-dd format (e.g. 2025-01-15). Data added
+    after this date will be ingested, shared by prebuilt and custom reports.
+    """
+
+    time_increment: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [DEPRECATED] [Beta] (Optional, DEPRECATED — use custom_report_options.time_increment) Value in string by which to
+    aggregate statistics (can take all_days, monthly or number of days)
+    """
+
+
+MetaMarketingOptionsParam = MetaMarketingOptionsDict | MetaMarketingOptions
diff --git a/python/databricks/bundles/pipelines/_models/meta_marketing_options_meta_marketing_custom_report_options.py b/python/databricks/bundles/pipelines/_models/meta_marketing_options_meta_marketing_custom_report_options.py
new file mode 100644
index 00000000000..a01a24ec45b
--- /dev/null
+++ b/python/databricks/bundles/pipelines/_models/meta_marketing_options_meta_marketing_custom_report_options.py
@@ -0,0 +1,125 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class MetaMarketingOptionsMetaMarketingCustomReportOptions:
+    """
+    :meta private: [EXPERIMENTAL]
+
+    Defines the shape of a single Meta Ads custom report (one /insights call shape).
+    start_date, custom_insights_lookback_window live on MetaMarketingOptions, not here.
+    Metrics are not customer-selectable; the connector returns a fixed standard metric set.
+    """
+
+    action_attribution_windows: VariableOrList[str] = field(default_factory=list)
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Action attribution windows for insights reporting (e.g. "28d_click", "1d_view")
+    """
+
+    action_breakdowns: VariableOrList[str] = field(default_factory=list)
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Action breakdowns to configure for data aggregation
+    """
+
+    action_report_time: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Timing used to report action statistics (impression, conversion, mixed, or lifetime)
+    """
+
+    breakdowns: VariableOrList[str] = field(default_factory=list)
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Breakdowns to configure for data aggregation
+    """
+
+    level: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Granularity of data to pull (account, ad, adset, campaign)
+    """
+
+    time_increment: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Value in string by which to aggregate statistics (all_days, monthly or number of days)
+    """
+
+    @classmethod
+    def from_dict(
+        cls, value: "MetaMarketingOptionsMetaMarketingCustomReportOptionsDict"
+    ) -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "MetaMarketingOptionsMetaMarketingCustomReportOptionsDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class MetaMarketingOptionsMetaMarketingCustomReportOptionsDict(TypedDict, total=False):
+    """"""
+
+    action_attribution_windows: VariableOrList[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Action attribution windows for insights reporting (e.g. "28d_click", "1d_view")
+    """
+
+    action_breakdowns: VariableOrList[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Action breakdowns to configure for data aggregation
+    """
+
+    action_report_time: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Timing used to report action statistics (impression, conversion, mixed, or lifetime)
+    """
+
+    breakdowns: VariableOrList[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Breakdowns to configure for data aggregation
+    """
+
+    level: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Granularity of data to pull (account, ad, adset, campaign)
+    """
+
+    time_increment: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Value in string by which to aggregate statistics (all_days, monthly or number of days)
+    """
+
+
+MetaMarketingOptionsMetaMarketingCustomReportOptionsParam = (
+    MetaMarketingOptionsMetaMarketingCustomReportOptionsDict
+    | MetaMarketingOptionsMetaMarketingCustomReportOptions
+)
diff --git a/python/databricks/bundles/pipelines/_models/notebook_library.py b/python/databricks/bundles/pipelines/_models/notebook_library.py
index 5cc6ae9ee34..72ded094151 100644
--- a/python/databricks/bundles/pipelines/_models/notebook_library.py
+++ b/python/databricks/bundles/pipelines/_models/notebook_library.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/pipelines/_models/notifications.py b/python/databricks/bundles/pipelines/_models/notifications.py
index 22dbec8d709..271bb4c1fdb 100644
--- a/python/databricks/bundles/pipelines/_models/notifications.py
+++ b/python/databricks/bundles/pipelines/_models/notifications.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/pipelines/_models/operation_time_window.py b/python/databricks/bundles/pipelines/_models/operation_time_window.py
index 85720ab6c1a..cc3c315d6de 100644
--- a/python/databricks/bundles/pipelines/_models/operation_time_window.py
+++ b/python/databricks/bundles/pipelines/_models/operation_time_window.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
@@ -22,18 +24,18 @@ class OperationTimeWindow:
 
     start_hour: VariableOr[int]
     """
-    An integer between 0 and 23 denoting the start hour for the window in the 24-hour day.
+    [Public Preview] An integer between 0 and 23 denoting the start hour for the window in the 24-hour day.
     """
 
     days_of_week: VariableOrList[DayOfWeek] = field(default_factory=list)
     """
-    Days of week in which the window is allowed to happen
+    [Public Preview] Days of week in which the window is allowed to happen
     If not specified all days of the week will be used.
     """
 
     time_zone_id: VariableOrOptional[str] = None
     """
-    Time zone id of window. See https://docs.databricks.com/sql/language-manual/sql-ref-syntax-aux-conf-mgmt-set-timezone.html for details.
+    [Public Preview] Time zone id of window. See https://docs.databricks.com/sql/language-manual/sql-ref-syntax-aux-conf-mgmt-set-timezone.html for details.
     If not specified, UTC will be used.
     """
 
@@ -50,18 +52,18 @@ class OperationTimeWindowDict(TypedDict, total=False):
 
     start_hour: VariableOr[int]
     """
-    An integer between 0 and 23 denoting the start hour for the window in the 24-hour day.
+    [Public Preview] An integer between 0 and 23 denoting the start hour for the window in the 24-hour day.
     """
 
     days_of_week: VariableOrList[DayOfWeekParam]
     """
-    Days of week in which the window is allowed to happen
+    [Public Preview] Days of week in which the window is allowed to happen
     If not specified all days of the week will be used.
     """
 
     time_zone_id: VariableOrOptional[str]
     """
-    Time zone id of window. See https://docs.databricks.com/sql/language-manual/sql-ref-syntax-aux-conf-mgmt-set-timezone.html for details.
+    [Public Preview] Time zone id of window. See https://docs.databricks.com/sql/language-manual/sql-ref-syntax-aux-conf-mgmt-set-timezone.html for details.
     If not specified, UTC will be used.
     """
 
diff --git a/python/databricks/bundles/pipelines/_models/outlook_attachment_mode.py b/python/databricks/bundles/pipelines/_models/outlook_attachment_mode.py
new file mode 100644
index 00000000000..5d3c5fa042f
--- /dev/null
+++ b/python/databricks/bundles/pipelines/_models/outlook_attachment_mode.py
@@ -0,0 +1,22 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class OutlookAttachmentMode(Enum):
+    """
+    :meta private: [EXPERIMENTAL]
+
+    Attachment behavior mode for Outlook ingestion
+    """
+
+    ALL = "ALL"
+    NON_INLINE_ONLY = "NON_INLINE_ONLY"
+    INLINE_ONLY = "INLINE_ONLY"
+    NONE = "NONE"
+
+
+OutlookAttachmentModeParam = (
+    Literal["ALL", "NON_INLINE_ONLY", "INLINE_ONLY", "NONE"] | OutlookAttachmentMode
+)
diff --git a/python/databricks/bundles/pipelines/_models/outlook_body_format.py b/python/databricks/bundles/pipelines/_models/outlook_body_format.py
new file mode 100644
index 00000000000..e5f409e0412
--- /dev/null
+++ b/python/databricks/bundles/pipelines/_models/outlook_body_format.py
@@ -0,0 +1,18 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class OutlookBodyFormat(Enum):
+    """
+    :meta private: [EXPERIMENTAL]
+
+    Body format for Outlook email content
+    """
+
+    TEXT_HTML = "TEXT_HTML"
+    TEXT_PLAIN = "TEXT_PLAIN"
+
+
+OutlookBodyFormatParam = Literal["TEXT_HTML", "TEXT_PLAIN"] | OutlookBodyFormat
diff --git a/python/databricks/bundles/pipelines/_models/outlook_options.py b/python/databricks/bundles/pipelines/_models/outlook_options.py
new file mode 100644
index 00000000000..98e93a16a69
--- /dev/null
+++ b/python/databricks/bundles/pipelines/_models/outlook_options.py
@@ -0,0 +1,176 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
+from databricks.bundles.pipelines._models.outlook_attachment_mode import (
+    OutlookAttachmentMode,
+    OutlookAttachmentModeParam,
+)
+from databricks.bundles.pipelines._models.outlook_body_format import (
+    OutlookBodyFormat,
+    OutlookBodyFormatParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class OutlookOptions:
+    """
+    :meta private: [EXPERIMENTAL]
+
+    Outlook specific options for ingestion
+    """
+
+    attachment_mode: VariableOrOptional[OutlookAttachmentMode] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Controls which attachments to ingest.
+    If not specified, defaults to ALL.
+    """
+
+    body_format: VariableOrOptional[OutlookBodyFormat] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Defines how the body_content column is populated.
+    TEXT_HTML: Preserves full formatting, links, and styling.
+    TEXT_PLAIN: Converts body to plain text. Recommended for AI/RAG pipelines to reduce token usage and noise.
+    """
+
+    include_folders: VariableOrList[str] = field(default_factory=list)
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Filter mail folders to include in the sync.
+    If not specified, all folders will be synced.
+    Examples: Inbox, Sent Items, Custom_Folder
+    Filter semantics: OR between different folders.
+    """
+
+    include_mailboxes: VariableOrList[str] = field(default_factory=list)
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) List of mailboxes to sync (e.g. mailbox email addresses or identifiers).
+    If not specified, all accessible mailboxes are ingested.
+    Filter semantics: OR between different mailboxes.
+    """
+
+    include_senders: VariableOrList[str] = field(default_factory=list)
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Filter emails by sender address. Uses exact email match.
+    Examples: user@vendor.com, alerts@system.io, noreply@company.com
+    If not specified, emails from all senders will be synced.
+    Filter semantics: OR between different senders.
+    """
+
+    include_subjects: VariableOrList[str] = field(default_factory=list)
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Filter emails by subject line. Values ending with "*" use prefix match (subject starts with
+    the part before "*"); otherwise substring match (subject contains the value).
+    Examples: "Invoice" (substring), "Re:*" (prefix), "Support Ticket", "URGENT*"
+    If not specified, emails with all subjects will be synced.
+    Filter semantics: OR between different subjects.
+    """
+
+    start_date: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Start date for the initial sync in YYYY-MM-DD format.
+    Format: YYYY-MM-DD (e.g., 2024-01-01)
+    This determines the earliest date from which to sync historical data.
+    If not specified, complete history is ingested.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "OutlookOptionsDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "OutlookOptionsDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class OutlookOptionsDict(TypedDict, total=False):
+    """"""
+
+    attachment_mode: VariableOrOptional[OutlookAttachmentModeParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Controls which attachments to ingest.
+    If not specified, defaults to ALL.
+    """
+
+    body_format: VariableOrOptional[OutlookBodyFormatParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Defines how the body_content column is populated.
+    TEXT_HTML: Preserves full formatting, links, and styling.
+    TEXT_PLAIN: Converts body to plain text. Recommended for AI/RAG pipelines to reduce token usage and noise.
+    """
+
+    include_folders: VariableOrList[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Filter mail folders to include in the sync.
+    If not specified, all folders will be synced.
+    Examples: Inbox, Sent Items, Custom_Folder
+    Filter semantics: OR between different folders.
+    """
+
+    include_mailboxes: VariableOrList[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) List of mailboxes to sync (e.g. mailbox email addresses or identifiers).
+    If not specified, all accessible mailboxes are ingested.
+    Filter semantics: OR between different mailboxes.
+    """
+
+    include_senders: VariableOrList[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Filter emails by sender address. Uses exact email match.
+    Examples: user@vendor.com, alerts@system.io, noreply@company.com
+    If not specified, emails from all senders will be synced.
+    Filter semantics: OR between different senders.
+    """
+
+    include_subjects: VariableOrList[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Filter emails by subject line. Values ending with "*" use prefix match (subject starts with
+    the part before "*"); otherwise substring match (subject contains the value).
+    Examples: "Invoice" (substring), "Re:*" (prefix), "Support Ticket", "URGENT*"
+    If not specified, emails with all subjects will be synced.
+    Filter semantics: OR between different subjects.
+    """
+
+    start_date: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Start date for the initial sync in YYYY-MM-DD format.
+    Format: YYYY-MM-DD (e.g., 2024-01-01)
+    This determines the earliest date from which to sync historical data.
+    If not specified, complete history is ingested.
+    """
+
+
+OutlookOptionsParam = OutlookOptionsDict | OutlookOptions
diff --git a/python/databricks/bundles/pipelines/_models/parse_mode.py b/python/databricks/bundles/pipelines/_models/parse_mode.py
new file mode 100644
index 00000000000..2e55f31226d
--- /dev/null
+++ b/python/databricks/bundles/pipelines/_models/parse_mode.py
@@ -0,0 +1,16 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class ParseMode(Enum):
+    """
+    Determines how errors encountered while deserializing records are handled.
+    """
+
+    FAILFAST = "FAILFAST"
+    PERMISSIVE = "PERMISSIVE"
+
+
+ParseModeParam = Literal["FAILFAST", "PERMISSIVE"] | ParseMode
diff --git a/python/databricks/bundles/pipelines/_models/path_pattern.py b/python/databricks/bundles/pipelines/_models/path_pattern.py
index e8e04fd949a..6df8c4c5a3f 100644
--- a/python/databricks/bundles/pipelines/_models/path_pattern.py
+++ b/python/databricks/bundles/pipelines/_models/path_pattern.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -15,7 +17,7 @@ class PathPattern:
 
     include: VariableOrOptional[str] = None
     """
-    The source code to include for pipelines
+    [Public Preview] The source code to include for pipelines
     """
 
     @classmethod
@@ -31,7 +33,7 @@ class PathPatternDict(TypedDict, total=False):
 
     include: VariableOrOptional[str]
     """
-    The source code to include for pipelines
+    [Public Preview] The source code to include for pipelines
     """
 
 
diff --git a/python/databricks/bundles/pipelines/_models/pipeline.py b/python/databricks/bundles/pipelines/_models/pipeline.py
index 2b4bbed23b5..5e4b04bb726 100644
--- a/python/databricks/bundles/pipelines/_models/pipeline.py
+++ b/python/databricks/bundles/pipelines/_models/pipeline.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
@@ -25,10 +27,7 @@
     IngestionPipelineDefinition,
     IngestionPipelineDefinitionParam,
 )
-from databricks.bundles.pipelines._models.lifecycle import (
-    Lifecycle,
-    LifecycleParam,
-)
+from databricks.bundles.pipelines._models.lifecycle import Lifecycle, LifecycleParam
 from databricks.bundles.pipelines._models.notifications import (
     Notifications,
     NotificationsParam,
@@ -70,7 +69,12 @@ class Pipeline(Resource):
 
     budget_policy_id: VariableOrOptional[str] = None
     """
-    Budget policy of this pipeline.
+    [Public Preview] Budget policy of this pipeline.
+    """
+
+    cascade_on_destroy: VariableOrOptional[bool] = None
+    """
+    Whether destroying the pipeline also deletes its datasets (MVs, STs, Views). Defaults to true (the server default). Set to false to retain the datasets when the pipeline is deleted. Only affects the delete operation.
     """
 
     catalog: VariableOrOptional[str] = None
@@ -80,12 +84,13 @@ class Pipeline(Resource):
 
     channel: VariableOrOptional[str] = None
     """
-    DLT Release Channel that specifies which version to use.
+    SDP Release Channel that specifies which version to use.
     """
 
     clusters: VariableOrList[PipelineCluster] = field(default_factory=list)
     """
-    Cluster settings for this pipeline deployment.
+    Cluster settings for this pipeline deployment. Applies to classic
+    (non-serverless) pipelines. Omit this field when `serverless` is `true`.
     """
 
     configuration: VariableOrDict[str] = field(default_factory=dict)
@@ -95,12 +100,18 @@ class Pipeline(Resource):
 
     continuous: VariableOrOptional[bool] = None
     """
-    Whether the pipeline is continuous or triggered. This replaces `trigger`.
+    [DEPRECATED] Whether the pipeline is continuous or triggered. This replaces `trigger`.
+    
+    Deprecated: wrap the pipeline in a continuous job instead, which also lets you take advantage
+    of job-level settings such as performance mode. When the pipeline is started by a continuous
+    job, the job's setting takes precedence and this field is ignored.
     """
 
     development: VariableOrOptional[bool] = None
     """
-    Whether the pipeline is in Development mode. Defaults to false.
+    [DEPRECATED] Whether the pipeline is in Development mode. Defaults to false.
+    
+    Deprecated: set development mode for each update instead.
     """
 
     edition: VariableOrOptional[str] = None
@@ -110,7 +121,7 @@ class Pipeline(Resource):
 
     environment: VariableOrOptional[PipelinesEnvironment] = None
     """
-    Environment specification for this pipeline used to install dependencies.
+    [Public Preview] Environment specification for this pipeline used to install dependencies.
     """
 
     event_log: VariableOrOptional[EventLogSpec] = None
@@ -127,7 +138,7 @@ class Pipeline(Resource):
     """
     :meta private: [EXPERIMENTAL]
     
-    The definition of a gateway pipeline to support change data capture.
+    [Private Preview] The definition of a gateway pipeline to support change data capture.
     """
 
     id: VariableOrOptional[str] = None
@@ -137,7 +148,7 @@ class Pipeline(Resource):
 
     ingestion_definition: VariableOrOptional[IngestionPipelineDefinition] = None
     """
-    The configuration for a managed ingestion pipeline. These settings cannot be used with the 'libraries', 'schema', 'target', or 'catalog' settings.
+    [Public Preview] The configuration for a managed ingestion pipeline. These settings cannot be used with the 'libraries', 'schema', 'target', or 'catalog' settings.
     """
 
     libraries: VariableOrList[PipelineLibrary] = field(default_factory=list)
@@ -147,7 +158,7 @@ class Pipeline(Resource):
 
     lifecycle: VariableOrOptional[Lifecycle] = None
     """
-    Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
     """
 
     name: VariableOrOptional[str] = None
@@ -160,7 +171,27 @@ class Pipeline(Resource):
     List of notification settings for this pipeline.
     """
 
+    parameters: VariableOrDict[str] = field(default_factory=dict)
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Key/value map of default parameters to use for pipeline execution.
+    Maximum total size: 10k characters (JSON format)
+    """
+
+    parent_path: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Path of the pipeline parent folder in workspace file tree.
+    
+    If absent, the pipeline doesn't have a workspace object.
+    """
+
     permissions: VariableOrList[PipelinePermission] = field(default_factory=list)
+    """
+    The permissions to apply to this resource.
+    """
 
     photon: VariableOrOptional[bool] = None
     """
@@ -171,17 +202,22 @@ class Pipeline(Resource):
     """
     :meta private: [EXPERIMENTAL]
     
-    Restart window of this pipeline.
+    [Private Preview] Restart window of this pipeline.
     """
 
     root_path: VariableOrOptional[str] = None
     """
-    Root path for this pipeline.
+    [Public Preview] Root path for this pipeline.
     This is used as the root directory when editing the pipeline in the Databricks user interface and it is
     added to sys.path when executing Python sources during pipeline execution.
     """
 
     run_as: VariableOrOptional[RunAs] = None
+    """
+    Write-only setting, available only in Create/Update calls. Specifies the user or service principal that the pipeline runs as. If not specified, the pipeline runs as the user who created the pipeline.
+    
+    Only `user_name` or `service_principal_name` can be specified. If both are specified, an error is thrown.
+    """
 
     schema: VariableOrOptional[str] = None
     """
@@ -190,7 +226,18 @@ class Pipeline(Resource):
 
     serverless: VariableOrOptional[bool] = None
     """
-    Whether serverless compute is enabled for this pipeline.
+    Whether serverless compute is enabled for this pipeline. Serverless is the
+    recommended compute for new pipelines; set this to `true` to run the pipeline
+    on serverless. For notebook/file pipelines, omitting this field uses classic
+    compute configured through the `clusters` field. When `true`, omit `clusters`;
+    Photon is always enabled.
+    """
+
+    serverless_compute_id: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Serverless compute ID specified by the user for serverless pipelines.
     """
 
     storage: VariableOrOptional[str] = None
@@ -214,7 +261,7 @@ class Pipeline(Resource):
     """
     :meta private: [EXPERIMENTAL]
     
-    Usage policy of this pipeline.
+    [Private Preview] Usage policy of this pipeline.
     """
 
     @classmethod
@@ -235,7 +282,12 @@ class PipelineDict(TypedDict, total=False):
 
     budget_policy_id: VariableOrOptional[str]
     """
-    Budget policy of this pipeline.
+    [Public Preview] Budget policy of this pipeline.
+    """
+
+    cascade_on_destroy: VariableOrOptional[bool]
+    """
+    Whether destroying the pipeline also deletes its datasets (MVs, STs, Views). Defaults to true (the server default). Set to false to retain the datasets when the pipeline is deleted. Only affects the delete operation.
     """
 
     catalog: VariableOrOptional[str]
@@ -245,12 +297,13 @@ class PipelineDict(TypedDict, total=False):
 
     channel: VariableOrOptional[str]
     """
-    DLT Release Channel that specifies which version to use.
+    SDP Release Channel that specifies which version to use.
     """
 
     clusters: VariableOrList[PipelineClusterParam]
     """
-    Cluster settings for this pipeline deployment.
+    Cluster settings for this pipeline deployment. Applies to classic
+    (non-serverless) pipelines. Omit this field when `serverless` is `true`.
     """
 
     configuration: VariableOrDict[str]
@@ -260,12 +313,18 @@ class PipelineDict(TypedDict, total=False):
 
     continuous: VariableOrOptional[bool]
     """
-    Whether the pipeline is continuous or triggered. This replaces `trigger`.
+    [DEPRECATED] Whether the pipeline is continuous or triggered. This replaces `trigger`.
+    
+    Deprecated: wrap the pipeline in a continuous job instead, which also lets you take advantage
+    of job-level settings such as performance mode. When the pipeline is started by a continuous
+    job, the job's setting takes precedence and this field is ignored.
     """
 
     development: VariableOrOptional[bool]
     """
-    Whether the pipeline is in Development mode. Defaults to false.
+    [DEPRECATED] Whether the pipeline is in Development mode. Defaults to false.
+    
+    Deprecated: set development mode for each update instead.
     """
 
     edition: VariableOrOptional[str]
@@ -275,7 +334,7 @@ class PipelineDict(TypedDict, total=False):
 
     environment: VariableOrOptional[PipelinesEnvironmentParam]
     """
-    Environment specification for this pipeline used to install dependencies.
+    [Public Preview] Environment specification for this pipeline used to install dependencies.
     """
 
     event_log: VariableOrOptional[EventLogSpecParam]
@@ -292,7 +351,7 @@ class PipelineDict(TypedDict, total=False):
     """
     :meta private: [EXPERIMENTAL]
     
-    The definition of a gateway pipeline to support change data capture.
+    [Private Preview] The definition of a gateway pipeline to support change data capture.
     """
 
     id: VariableOrOptional[str]
@@ -302,7 +361,7 @@ class PipelineDict(TypedDict, total=False):
 
     ingestion_definition: VariableOrOptional[IngestionPipelineDefinitionParam]
     """
-    The configuration for a managed ingestion pipeline. These settings cannot be used with the 'libraries', 'schema', 'target', or 'catalog' settings.
+    [Public Preview] The configuration for a managed ingestion pipeline. These settings cannot be used with the 'libraries', 'schema', 'target', or 'catalog' settings.
     """
 
     libraries: VariableOrList[PipelineLibraryParam]
@@ -312,7 +371,7 @@ class PipelineDict(TypedDict, total=False):
 
     lifecycle: VariableOrOptional[LifecycleParam]
     """
-    Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
     """
 
     name: VariableOrOptional[str]
@@ -325,7 +384,27 @@ class PipelineDict(TypedDict, total=False):
     List of notification settings for this pipeline.
     """
 
+    parameters: VariableOrDict[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Key/value map of default parameters to use for pipeline execution.
+    Maximum total size: 10k characters (JSON format)
+    """
+
+    parent_path: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Path of the pipeline parent folder in workspace file tree.
+    
+    If absent, the pipeline doesn't have a workspace object.
+    """
+
     permissions: VariableOrList[PipelinePermissionParam]
+    """
+    The permissions to apply to this resource.
+    """
 
     photon: VariableOrOptional[bool]
     """
@@ -336,17 +415,22 @@ class PipelineDict(TypedDict, total=False):
     """
     :meta private: [EXPERIMENTAL]
     
-    Restart window of this pipeline.
+    [Private Preview] Restart window of this pipeline.
     """
 
     root_path: VariableOrOptional[str]
     """
-    Root path for this pipeline.
+    [Public Preview] Root path for this pipeline.
     This is used as the root directory when editing the pipeline in the Databricks user interface and it is
     added to sys.path when executing Python sources during pipeline execution.
     """
 
     run_as: VariableOrOptional[RunAsParam]
+    """
+    Write-only setting, available only in Create/Update calls. Specifies the user or service principal that the pipeline runs as. If not specified, the pipeline runs as the user who created the pipeline.
+    
+    Only `user_name` or `service_principal_name` can be specified. If both are specified, an error is thrown.
+    """
 
     schema: VariableOrOptional[str]
     """
@@ -355,7 +439,18 @@ class PipelineDict(TypedDict, total=False):
 
     serverless: VariableOrOptional[bool]
     """
-    Whether serverless compute is enabled for this pipeline.
+    Whether serverless compute is enabled for this pipeline. Serverless is the
+    recommended compute for new pipelines; set this to `true` to run the pipeline
+    on serverless. For notebook/file pipelines, omitting this field uses classic
+    compute configured through the `clusters` field. When `true`, omit `clusters`;
+    Photon is always enabled.
+    """
+
+    serverless_compute_id: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Serverless compute ID specified by the user for serverless pipelines.
     """
 
     storage: VariableOrOptional[str]
@@ -379,7 +474,7 @@ class PipelineDict(TypedDict, total=False):
     """
     :meta private: [EXPERIMENTAL]
     
-    Usage policy of this pipeline.
+    [Private Preview] Usage policy of this pipeline.
     """
 
 
diff --git a/python/databricks/bundles/pipelines/_models/pipeline_cluster.py b/python/databricks/bundles/pipelines/_models/pipeline_cluster.py
index 01563f6a850..6eda9e865a0 100644
--- a/python/databricks/bundles/pipelines/_models/pipeline_cluster.py
+++ b/python/databricks/bundles/pipelines/_models/pipeline_cluster.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
@@ -120,7 +122,7 @@ class PipelineCluster:
 
     label: VariableOrOptional[str] = None
     """
-    A label for the cluster specification, either `default` to configure the default cluster, or `maintenance` to configure the maintenance cluster. This field is optional. The default value is `default`.
+    A label for the cluster specification, either `default` to configure the default cluster settings applied to both the update and maintenance clusters, `updates` to configure the update cluster, or `maintenance` to configure the maintenance cluster. This field is optional. The default value is `default`.
     """
 
     node_type_id: VariableOrOptional[str] = None
@@ -266,7 +268,7 @@ class PipelineClusterDict(TypedDict, total=False):
 
     label: VariableOrOptional[str]
     """
-    A label for the cluster specification, either `default` to configure the default cluster, or `maintenance` to configure the maintenance cluster. This field is optional. The default value is `default`.
+    A label for the cluster specification, either `default` to configure the default cluster settings applied to both the update and maintenance clusters, `updates` to configure the update cluster, or `maintenance` to configure the maintenance cluster. This field is optional. The default value is `default`.
     """
 
     node_type_id: VariableOrOptional[str]
diff --git a/python/databricks/bundles/pipelines/_models/pipeline_cluster_autoscale.py b/python/databricks/bundles/pipelines/_models/pipeline_cluster_autoscale.py
index 58afdbefabe..d5ba9da3665 100644
--- a/python/databricks/bundles/pipelines/_models/pipeline_cluster_autoscale.py
+++ b/python/databricks/bundles/pipelines/_models/pipeline_cluster_autoscale.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/pipelines/_models/pipeline_cluster_autoscale_mode.py b/python/databricks/bundles/pipelines/_models/pipeline_cluster_autoscale_mode.py
index 21d2e054cb1..52afa7d09d1 100644
--- a/python/databricks/bundles/pipelines/_models/pipeline_cluster_autoscale_mode.py
+++ b/python/databricks/bundles/pipelines/_models/pipeline_cluster_autoscale_mode.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
diff --git a/python/databricks/bundles/pipelines/_models/pipeline_library.py b/python/databricks/bundles/pipelines/_models/pipeline_library.py
index fa5b9e09e1c..5639f57fb2f 100644
--- a/python/databricks/bundles/pipelines/_models/pipeline_library.py
+++ b/python/databricks/bundles/pipelines/_models/pipeline_library.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -36,7 +38,7 @@ class PipelineLibrary:
 
     glob: VariableOrOptional[PathPattern] = None
     """
-    The unified field to include source codes.
+    [Public Preview] The unified field to include source codes.
     Each entry can be a notebook path, a file path, or a folder path that ends `/**`.
     This field cannot be used together with `notebook` or `file`.
     """
@@ -45,14 +47,14 @@ class PipelineLibrary:
     """
     :meta private: [EXPERIMENTAL]
     
-    URI of the jar to be installed. Currently only DBFS is supported.
+    [Private Preview] URI of the jar to be installed. Currently only DBFS is supported.
     """
 
     maven: VariableOrOptional[MavenLibrary] = None
     """
     :meta private: [EXPERIMENTAL]
     
-    Specification of a maven library to be installed.
+    [Private Preview] Specification of a maven library to be installed.
     """
 
     notebook: VariableOrOptional[NotebookLibrary] = None
@@ -78,7 +80,7 @@ class PipelineLibraryDict(TypedDict, total=False):
 
     glob: VariableOrOptional[PathPatternParam]
     """
-    The unified field to include source codes.
+    [Public Preview] The unified field to include source codes.
     Each entry can be a notebook path, a file path, or a folder path that ends `/**`.
     This field cannot be used together with `notebook` or `file`.
     """
@@ -87,14 +89,14 @@ class PipelineLibraryDict(TypedDict, total=False):
     """
     :meta private: [EXPERIMENTAL]
     
-    URI of the jar to be installed. Currently only DBFS is supported.
+    [Private Preview] URI of the jar to be installed. Currently only DBFS is supported.
     """
 
     maven: VariableOrOptional[MavenLibraryParam]
     """
     :meta private: [EXPERIMENTAL]
     
-    Specification of a maven library to be installed.
+    [Private Preview] Specification of a maven library to be installed.
     """
 
     notebook: VariableOrOptional[NotebookLibraryParam]
diff --git a/python/databricks/bundles/pipelines/_models/pipeline_permission.py b/python/databricks/bundles/pipelines/_models/pipeline_permission.py
index 0a3ed955386..e7b9c90f94e 100644
--- a/python/databricks/bundles/pipelines/_models/pipeline_permission.py
+++ b/python/databricks/bundles/pipelines/_models/pipeline_permission.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -18,12 +20,24 @@ class PipelinePermission:
     """"""
 
     level: VariableOr[PipelinePermissionLevel]
+    """
+    The permission level to apply. The allowed levels depend on the resource type.
+    """
 
     group_name: VariableOrOptional[str] = None
+    """
+    The name of the group granted the permission level.
+    """
 
     service_principal_name: VariableOrOptional[str] = None
+    """
+    The name of the service principal granted the permission level.
+    """
 
     user_name: VariableOrOptional[str] = None
+    """
+    The name of the user granted the permission level.
+    """
 
     @classmethod
     def from_dict(cls, value: "PipelinePermissionDict") -> "Self":
@@ -37,12 +51,24 @@ class PipelinePermissionDict(TypedDict, total=False):
     """"""
 
     level: VariableOr[PipelinePermissionLevelParam]
+    """
+    The permission level to apply. The allowed levels depend on the resource type.
+    """
 
     group_name: VariableOrOptional[str]
+    """
+    The name of the group granted the permission level.
+    """
 
     service_principal_name: VariableOrOptional[str]
+    """
+    The name of the service principal granted the permission level.
+    """
 
     user_name: VariableOrOptional[str]
+    """
+    The name of the user granted the permission level.
+    """
 
 
 PipelinePermissionParam = PipelinePermissionDict | PipelinePermission
diff --git a/python/databricks/bundles/pipelines/_models/pipeline_permission_level.py b/python/databricks/bundles/pipelines/_models/pipeline_permission_level.py
index 746bedc51ab..5c2d68bfe57 100644
--- a/python/databricks/bundles/pipelines/_models/pipeline_permission_level.py
+++ b/python/databricks/bundles/pipelines/_models/pipeline_permission_level.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
diff --git a/python/databricks/bundles/pipelines/_models/pipelines_environment.py b/python/databricks/bundles/pipelines/_models/pipelines_environment.py
index 8c6ef19a0dc..0493c5d4fa7 100644
--- a/python/databricks/bundles/pipelines/_models/pipelines_environment.py
+++ b/python/databricks/bundles/pipelines/_models/pipelines_environment.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
@@ -12,22 +14,20 @@
 @dataclass(kw_only=True)
 class PipelinesEnvironment:
     """
-    The environment entity used to preserve serverless environment side panel, jobs' environment for non-notebook task, and DLT's environment for classic and serverless pipelines.
+    The environment entity used to preserve serverless environment side panel, jobs' environment for non-notebook task, and SDP's environment for classic and serverless pipelines.
     In this minimal environment spec, only pip dependencies are supported.
     """
 
     dependencies: VariableOrList[str] = field(default_factory=list)
     """
-    List of pip dependencies, as supported by the version of pip in this environment.
+    [Public Preview] List of pip dependencies, as supported by the version of pip in this environment.
     Each dependency is a pip requirement file line https://pip.pypa.io/en/stable/reference/requirements-file-format/
     Allowed dependency could be <requirement specifier>, <archive url/path>, <local project path>(WSFS or Volumes in Databricks), <vcs project url>
     """
 
     environment_version: VariableOrOptional[str] = None
     """
-    :meta private: [EXPERIMENTAL]
-    
-    The environment version of the serverless Python environment used to execute
+    [Public Preview] The environment version of the serverless Python environment used to execute
     customer Python code. Each environment version includes a specific Python
     version and a curated set of pre-installed libraries with defined versions,
     providing a stable and reproducible execution environment.
@@ -52,16 +52,14 @@ class PipelinesEnvironmentDict(TypedDict, total=False):
 
     dependencies: VariableOrList[str]
     """
-    List of pip dependencies, as supported by the version of pip in this environment.
+    [Public Preview] List of pip dependencies, as supported by the version of pip in this environment.
     Each dependency is a pip requirement file line https://pip.pypa.io/en/stable/reference/requirements-file-format/
     Allowed dependency could be <requirement specifier>, <archive url/path>, <local project path>(WSFS or Volumes in Databricks), <vcs project url>
     """
 
     environment_version: VariableOrOptional[str]
     """
-    :meta private: [EXPERIMENTAL]
-    
-    The environment version of the serverless Python environment used to execute
+    [Public Preview] The environment version of the serverless Python environment used to execute
     customer Python code. Each environment version includes a specific Python
     version and a curated set of pre-installed libraries with defined versions,
     providing a stable and reproducible execution environment.
diff --git a/python/databricks/bundles/pipelines/_models/postgres_catalog_config.py b/python/databricks/bundles/pipelines/_models/postgres_catalog_config.py
index 87092e7d7a7..0bc642e8a5a 100644
--- a/python/databricks/bundles/pipelines/_models/postgres_catalog_config.py
+++ b/python/databricks/bundles/pipelines/_models/postgres_catalog_config.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -21,7 +23,7 @@ class PostgresCatalogConfig:
 
     slot_config: VariableOrOptional[PostgresSlotConfig] = None
     """
-    Optional. The Postgres slot configuration to use for logical replication
+    [Public Preview] Optional. The Postgres slot configuration to use for logical replication
     """
 
     @classmethod
@@ -37,7 +39,7 @@ class PostgresCatalogConfigDict(TypedDict, total=False):
 
     slot_config: VariableOrOptional[PostgresSlotConfigParam]
     """
-    Optional. The Postgres slot configuration to use for logical replication
+    [Public Preview] Optional. The Postgres slot configuration to use for logical replication
     """
 
 
diff --git a/python/databricks/bundles/pipelines/_models/postgres_slot_config.py b/python/databricks/bundles/pipelines/_models/postgres_slot_config.py
index 3c392c2d330..d6eaeacbb08 100644
--- a/python/databricks/bundles/pipelines/_models/postgres_slot_config.py
+++ b/python/databricks/bundles/pipelines/_models/postgres_slot_config.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -17,12 +19,12 @@ class PostgresSlotConfig:
 
     publication_name: VariableOrOptional[str] = None
     """
-    The name of the publication to use for the Postgres source
+    [Public Preview] The name of the publication to use for the Postgres source
     """
 
     slot_name: VariableOrOptional[str] = None
     """
-    The name of the logical replication slot to use for the Postgres source
+    [Public Preview] The name of the logical replication slot to use for the Postgres source
     """
 
     @classmethod
@@ -38,12 +40,12 @@ class PostgresSlotConfigDict(TypedDict, total=False):
 
     publication_name: VariableOrOptional[str]
     """
-    The name of the publication to use for the Postgres source
+    [Public Preview] The name of the publication to use for the Postgres source
     """
 
     slot_name: VariableOrOptional[str]
     """
-    The name of the logical replication slot to use for the Postgres source
+    [Public Preview] The name of the logical replication slot to use for the Postgres source
     """
 
 
diff --git a/python/databricks/bundles/pipelines/_models/protobuf_transformer_options.py b/python/databricks/bundles/pipelines/_models/protobuf_transformer_options.py
new file mode 100644
index 00000000000..cace688c4c9
--- /dev/null
+++ b/python/databricks/bundles/pipelines/_models/protobuf_transformer_options.py
@@ -0,0 +1,117 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.pipelines._models.parse_mode import ParseMode, ParseModeParam
+from databricks.bundles.pipelines._models.schema_registry_config import (
+    SchemaRegistryConfig,
+    SchemaRegistryConfigParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ProtobufTransformerOptions:
+    """"""
+
+    desc_file_path: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Required: path to the .desc file (dbfs:/... or /Volumes/...).
+    """
+
+    message_name: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Required: fully-qualified message type name.
+    """
+
+    parse_mode: VariableOrOptional[ParseMode] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] (Optional) Parse mode for Protobuf data.
+    Valid values: FAILFAST, PERMISSIVE. Defaults to PERMISSIVE.
+    """
+
+    recursive_fields_max_depth: VariableOrOptional[int] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] (Optional) Maximum expansion depth for recursive protobuf fields.
+    Spark SQL does not natively support recursive types, so recursive
+    fields are expanded up to this depth and truncated beyond it.
+    Valid values: -1 (disallow recursive fields), 0 (drop), 1-10.
+    """
+
+    schema_registry: VariableOrOptional[SchemaRegistryConfig] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] (Optional) Schema registry to resolve the Protobuf schema at runtime instead
+    of providing it via desc_file_path.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "ProtobufTransformerOptionsDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ProtobufTransformerOptionsDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ProtobufTransformerOptionsDict(TypedDict, total=False):
+    """"""
+
+    desc_file_path: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Required: path to the .desc file (dbfs:/... or /Volumes/...).
+    """
+
+    message_name: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Required: fully-qualified message type name.
+    """
+
+    parse_mode: VariableOrOptional[ParseModeParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] (Optional) Parse mode for Protobuf data.
+    Valid values: FAILFAST, PERMISSIVE. Defaults to PERMISSIVE.
+    """
+
+    recursive_fields_max_depth: VariableOrOptional[int]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] (Optional) Maximum expansion depth for recursive protobuf fields.
+    Spark SQL does not natively support recursive types, so recursive
+    fields are expanded up to this depth and truncated beyond it.
+    Valid values: -1 (disallow recursive fields), 0 (drop), 1-10.
+    """
+
+    schema_registry: VariableOrOptional[SchemaRegistryConfigParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] (Optional) Schema registry to resolve the Protobuf schema at runtime instead
+    of providing it via desc_file_path.
+    """
+
+
+ProtobufTransformerOptionsParam = (
+    ProtobufTransformerOptionsDict | ProtobufTransformerOptions
+)
diff --git a/python/databricks/bundles/pipelines/_models/rabbitmq_options.py b/python/databricks/bundles/pipelines/_models/rabbitmq_options.py
new file mode 100644
index 00000000000..a08a4a0613a
--- /dev/null
+++ b/python/databricks/bundles/pipelines/_models/rabbitmq_options.py
@@ -0,0 +1,49 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class RabbitmqOptions:
+    """
+    RabbitMQ specific options for ingestion.
+    Performance tuning options (consumers_per_task, max_messages_per_fetch, etc.)
+    are intentionally not exposed in the public API. The managed connector uses
+    sensible defaults internally. These can be added later if user demand arises.
+    """
+
+    queue: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] (Required) RabbitMQ queue name to consume from.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "RabbitmqOptionsDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "RabbitmqOptionsDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class RabbitmqOptionsDict(TypedDict, total=False):
+    """"""
+
+    queue: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] (Required) RabbitMQ queue name to consume from.
+    """
+
+
+RabbitmqOptionsParam = RabbitmqOptionsDict | RabbitmqOptions
diff --git a/python/databricks/bundles/pipelines/_models/reddit_ads_options.py b/python/databricks/bundles/pipelines/_models/reddit_ads_options.py
new file mode 100644
index 00000000000..3e39958b026
--- /dev/null
+++ b/python/databricks/bundles/pipelines/_models/reddit_ads_options.py
@@ -0,0 +1,96 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.pipelines._models.reddit_ads_options_reddit_ads_custom_report_options import (
+    RedditAdsOptionsRedditAdsCustomReportOptions,
+    RedditAdsOptionsRedditAdsCustomReportOptionsParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class RedditAdsOptions:
+    """
+    :meta private: [EXPERIMENTAL]
+
+    Reddit Ads specific options for ingestion
+    """
+
+    custom_report_options: VariableOrOptional[
+        RedditAdsOptionsRedditAdsCustomReportOptions
+    ] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Custom report definition. When set, the table is treated as a
+    user-defined Reddit Ads custom report. When unset, the table must match
+    one of the connector's prebuilt sources.
+    """
+
+    lookback_window_days: VariableOrOptional[int] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Number of days to look back for report tables during incremental sync
+    to capture late-arriving conversions and attribution data.
+    If not specified, defaults to 30 days.
+    """
+
+    sync_start_date: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Start date for the initial sync of report tables in YYYY-MM-DD format.
+    This determines the earliest date from which to sync historical data.
+    If not specified, defaults to 2 years ago.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "RedditAdsOptionsDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "RedditAdsOptionsDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class RedditAdsOptionsDict(TypedDict, total=False):
+    """"""
+
+    custom_report_options: VariableOrOptional[
+        RedditAdsOptionsRedditAdsCustomReportOptionsParam
+    ]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Custom report definition. When set, the table is treated as a
+    user-defined Reddit Ads custom report. When unset, the table must match
+    one of the connector's prebuilt sources.
+    """
+
+    lookback_window_days: VariableOrOptional[int]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Number of days to look back for report tables during incremental sync
+    to capture late-arriving conversions and attribution data.
+    If not specified, defaults to 30 days.
+    """
+
+    sync_start_date: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Start date for the initial sync of report tables in YYYY-MM-DD format.
+    This determines the earliest date from which to sync historical data.
+    If not specified, defaults to 2 years ago.
+    """
+
+
+RedditAdsOptionsParam = RedditAdsOptionsDict | RedditAdsOptions
diff --git a/python/databricks/bundles/pipelines/_models/reddit_ads_options_reddit_ads_custom_report_options.py b/python/databricks/bundles/pipelines/_models/reddit_ads_options_reddit_ads_custom_report_options.py
new file mode 100644
index 00000000000..78063a7dcaf
--- /dev/null
+++ b/python/databricks/bundles/pipelines/_models/reddit_ads_options_reddit_ads_custom_report_options.py
@@ -0,0 +1,74 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class RedditAdsOptionsRedditAdsCustomReportOptions:
+    """
+    :meta private: [EXPERIMENTAL]
+
+    User-defined custom report for the Reddit Ads connector.
+    Applies only to the custom_report table — prebuilt tables ignore this.
+    """
+
+    breakdowns: VariableOrList[str] = field(default_factory=list)
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Breakdown dimensions to group report data by.
+    Examples: CAMPAIGN_ID, DATE, COUNTRY, REGION, AD_ID.
+    Must include at least one time dimension (DATE or HOUR).
+    """
+
+    fields: VariableOrList[str] = field(default_factory=list)
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Fields to include in the report (maps to the Reddit Ads API `fields` parameter).
+    Examples: IMPRESSIONS, CLICKS, SPEND, CPC, CTR.
+    """
+
+    @classmethod
+    def from_dict(
+        cls, value: "RedditAdsOptionsRedditAdsCustomReportOptionsDict"
+    ) -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "RedditAdsOptionsRedditAdsCustomReportOptionsDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class RedditAdsOptionsRedditAdsCustomReportOptionsDict(TypedDict, total=False):
+    """"""
+
+    breakdowns: VariableOrList[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Breakdown dimensions to group report data by.
+    Examples: CAMPAIGN_ID, DATE, COUNTRY, REGION, AD_ID.
+    Must include at least one time dimension (DATE or HOUR).
+    """
+
+    fields: VariableOrList[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Fields to include in the report (maps to the Reddit Ads API `fields` parameter).
+    Examples: IMPRESSIONS, CLICKS, SPEND, CPC, CTR.
+    """
+
+
+RedditAdsOptionsRedditAdsCustomReportOptionsParam = (
+    RedditAdsOptionsRedditAdsCustomReportOptionsDict
+    | RedditAdsOptionsRedditAdsCustomReportOptions
+)
diff --git a/python/databricks/bundles/pipelines/_models/report_spec.py b/python/databricks/bundles/pipelines/_models/report_spec.py
index 02d4a8760af..c1ae97d014b 100644
--- a/python/databricks/bundles/pipelines/_models/report_spec.py
+++ b/python/databricks/bundles/pipelines/_models/report_spec.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -19,27 +21,27 @@ class ReportSpec:
 
     destination_catalog: VariableOr[str]
     """
-    Required. Destination catalog to store table.
+    [Public Preview] Required. Destination catalog to store table.
     """
 
     destination_schema: VariableOr[str]
     """
-    Required. Destination schema to store table.
+    [Public Preview] Required. Destination schema to store table.
     """
 
     source_url: VariableOr[str]
     """
-    Required. Report URL in the source system.
+    [Public Preview] Required. Report URL in the source system.
     """
 
     destination_table: VariableOrOptional[str] = None
     """
-    Required. Destination table name. The pipeline fails if a table with that name already exists.
+    [Public Preview] Required. Destination table name. The pipeline fails if a table with that name already exists.
     """
 
     table_configuration: VariableOrOptional[TableSpecificConfig] = None
     """
-    Configuration settings to control the ingestion of tables. These settings override the table_configuration defined in the IngestionPipelineDefinition object.
+    [Public Preview] Configuration settings to control the ingestion of tables. These settings override the table_configuration defined in the IngestionPipelineDefinition object.
     """
 
     @classmethod
@@ -55,27 +57,27 @@ class ReportSpecDict(TypedDict, total=False):
 
     destination_catalog: VariableOr[str]
     """
-    Required. Destination catalog to store table.
+    [Public Preview] Required. Destination catalog to store table.
     """
 
     destination_schema: VariableOr[str]
     """
-    Required. Destination schema to store table.
+    [Public Preview] Required. Destination schema to store table.
     """
 
     source_url: VariableOr[str]
     """
-    Required. Report URL in the source system.
+    [Public Preview] Required. Report URL in the source system.
     """
 
     destination_table: VariableOrOptional[str]
     """
-    Required. Destination table name. The pipeline fails if a table with that name already exists.
+    [Public Preview] Required. Destination table name. The pipeline fails if a table with that name already exists.
     """
 
     table_configuration: VariableOrOptional[TableSpecificConfigParam]
     """
-    Configuration settings to control the ingestion of tables. These settings override the table_configuration defined in the IngestionPipelineDefinition object.
+    [Public Preview] Configuration settings to control the ingestion of tables. These settings override the table_configuration defined in the IngestionPipelineDefinition object.
     """
 
 
diff --git a/python/databricks/bundles/pipelines/_models/restart_window.py b/python/databricks/bundles/pipelines/_models/restart_window.py
index 2385a32c7ab..9987bbe8ec7 100644
--- a/python/databricks/bundles/pipelines/_models/restart_window.py
+++ b/python/databricks/bundles/pipelines/_models/restart_window.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
@@ -22,19 +24,25 @@ class RestartWindow:
 
     start_hour: VariableOr[int]
     """
-    An integer between 0 and 23 denoting the start hour for the restart window in the 24-hour day.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] An integer between 0 and 23 denoting the start hour for the restart window in the 24-hour day.
     Continuous pipeline restart is triggered only within a five-hour window starting at this hour.
     """
 
     days_of_week: VariableOrList[DayOfWeek] = field(default_factory=list)
     """
-    Days of week in which the restart is allowed to happen (within a five-hour window starting at start_hour).
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Days of week in which the restart is allowed to happen (within a five-hour window starting at start_hour).
     If not specified all days of the week will be used.
     """
 
     time_zone_id: VariableOrOptional[str] = None
     """
-    Time zone id of restart window. See https://docs.databricks.com/sql/language-manual/sql-ref-syntax-aux-conf-mgmt-set-timezone.html for details.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Time zone id of restart window. See https://docs.databricks.com/sql/language-manual/sql-ref-syntax-aux-conf-mgmt-set-timezone.html for details.
     If not specified, UTC will be used.
     """
 
@@ -51,19 +59,25 @@ class RestartWindowDict(TypedDict, total=False):
 
     start_hour: VariableOr[int]
     """
-    An integer between 0 and 23 denoting the start hour for the restart window in the 24-hour day.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] An integer between 0 and 23 denoting the start hour for the restart window in the 24-hour day.
     Continuous pipeline restart is triggered only within a five-hour window starting at this hour.
     """
 
     days_of_week: VariableOrList[DayOfWeekParam]
     """
-    Days of week in which the restart is allowed to happen (within a five-hour window starting at start_hour).
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Days of week in which the restart is allowed to happen (within a five-hour window starting at start_hour).
     If not specified all days of the week will be used.
     """
 
     time_zone_id: VariableOrOptional[str]
     """
-    Time zone id of restart window. See https://docs.databricks.com/sql/language-manual/sql-ref-syntax-aux-conf-mgmt-set-timezone.html for details.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Time zone id of restart window. See https://docs.databricks.com/sql/language-manual/sql-ref-syntax-aux-conf-mgmt-set-timezone.html for details.
     If not specified, UTC will be used.
     """
 
diff --git a/python/databricks/bundles/pipelines/_models/run_as.py b/python/databricks/bundles/pipelines/_models/run_as.py
index b4d52af00a1..50967e4e1e5 100644
--- a/python/databricks/bundles/pipelines/_models/run_as.py
+++ b/python/databricks/bundles/pipelines/_models/run_as.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -17,6 +19,13 @@ class RunAs:
     Only `user_name` or `service_principal_name` can be specified. If both are specified, an error is thrown.
     """
 
+    group_name: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Group name of an account group assigned to the workspace. When set, the pipeline runs as the group and the group's permissions are used for data access. Setting this field requires being a member of the group, or having the `Assume` permission on the group.
+    """
+
     service_principal_name: VariableOrOptional[str] = None
     """
     Application ID of an active service principal. Setting this field requires the `servicePrincipal/user` role.
@@ -38,6 +47,13 @@ def as_dict(self) -> "RunAsDict":
 class RunAsDict(TypedDict, total=False):
     """"""
 
+    group_name: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Group name of an account group assigned to the workspace. When set, the pipeline runs as the group and the group's permissions are used for data access. Setting this field requires being a member of the group, or having the `Assume` permission on the group.
+    """
+
     service_principal_name: VariableOrOptional[str]
     """
     Application ID of an active service principal. Setting this field requires the `servicePrincipal/user` role.
diff --git a/python/databricks/bundles/pipelines/_models/s3_storage_info.py b/python/databricks/bundles/pipelines/_models/s3_storage_info.py
index b5e09063e51..071abd5b6f3 100644
--- a/python/databricks/bundles/pipelines/_models/s3_storage_info.py
+++ b/python/databricks/bundles/pipelines/_models/s3_storage_info.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/pipelines/_models/schema_registry_config.py b/python/databricks/bundles/pipelines/_models/schema_registry_config.py
new file mode 100644
index 00000000000..d2617560d7a
--- /dev/null
+++ b/python/databricks/bundles/pipelines/_models/schema_registry_config.py
@@ -0,0 +1,82 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.pipelines._models.confluent_schema_registry_options import (
+    ConfluentSchemaRegistryOptions,
+    ConfluentSchemaRegistryOptionsParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class SchemaRegistryConfig:
+    """"""
+
+    confluent_options: VariableOrOptional[ConfluentSchemaRegistryOptions] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Required: Confluent-compatible schema registry options.
+    """
+
+    connection_name: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] (Optional) UC connection for registry authentication.
+    Specify if different from the top-level source connection.
+    """
+
+    protobuf_message_name: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] (Optional, Protobuf only) Selects a specific message from a schema that
+    defines multiple Protobuf messages. Simple ("Location") or fully-qualified
+    ("com.example.protos.Location"). Defaults to the first message.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "SchemaRegistryConfigDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "SchemaRegistryConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class SchemaRegistryConfigDict(TypedDict, total=False):
+    """"""
+
+    confluent_options: VariableOrOptional[ConfluentSchemaRegistryOptionsParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Required: Confluent-compatible schema registry options.
+    """
+
+    connection_name: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] (Optional) UC connection for registry authentication.
+    Specify if different from the top-level source connection.
+    """
+
+    protobuf_message_name: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] (Optional, Protobuf only) Selects a specific message from a schema that
+    defines multiple Protobuf messages. Simple ("Location") or fully-qualified
+    ("com.example.protos.Location"). Defaults to the first message.
+    """
+
+
+SchemaRegistryConfigParam = SchemaRegistryConfigDict | SchemaRegistryConfig
diff --git a/python/databricks/bundles/pipelines/_models/schema_spec.py b/python/databricks/bundles/pipelines/_models/schema_spec.py
index d113f2376c8..d40e976ddcd 100644
--- a/python/databricks/bundles/pipelines/_models/schema_spec.py
+++ b/python/databricks/bundles/pipelines/_models/schema_spec.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -8,6 +10,10 @@
     ConnectorOptions,
     ConnectorOptionsParam,
 )
+from databricks.bundles.pipelines._models.ingestion_pipeline_definition_fanout_options import (
+    IngestionPipelineDefinitionFanoutOptions,
+    IngestionPipelineDefinitionFanoutOptionsParam,
+)
 from databricks.bundles.pipelines._models.table_specific_config import (
     TableSpecificConfig,
     TableSpecificConfigParam,
@@ -23,34 +29,44 @@ class SchemaSpec:
 
     destination_catalog: VariableOr[str]
     """
-    Required. Destination catalog to store tables.
+    [Public Preview] Required. Destination catalog to store tables.
     """
 
     destination_schema: VariableOr[str]
     """
-    Required. Destination schema to store tables in. Tables with the same name as the source tables are created in this destination schema. The pipeline fails If a table with the same name already exists.
+    [Public Preview] Required. Destination schema to store tables in. Tables with the same name as the source tables are created in this destination schema. The pipeline fails If a table with the same name already exists.
     """
 
-    source_schema: VariableOr[str]
+    connector_options: VariableOrOptional[ConnectorOptions] = None
     """
-    Required. Schema name in the source database.
+    [Public Preview] (Optional) Source Specific Connector Options
     """
 
-    connector_options: VariableOrOptional[ConnectorOptions] = None
+    fanout_options: VariableOrOptional[IngestionPipelineDefinitionFanoutOptions] = None
     """
     :meta private: [EXPERIMENTAL]
     
-    (Optional) Source Specific Connector Options
+    [Beta] Fanout options for multi-table routing from streaming sources.
+    When set, records are routed to destination tables based on a
+    per-record routing key. The key value becomes the table name:
+    {destination_catalog}.{destination_schema}.{key_value}.
     """
 
     source_catalog: VariableOrOptional[str] = None
     """
-    The source catalog name. Might be optional depending on the type of source.
+    [Public Preview] The source catalog name. Might be optional depending on the type of source.
+    """
+
+    source_schema: VariableOrOptional[str] = None
+    """
+    [Public Preview] Schema name in the source database. Optional: some source types (for example streaming or
+    message-bus connectors) do not use it, so it may be absent from a pipeline's definition.
+    Clients that assume it is always present should handle its absence.
     """
 
     table_configuration: VariableOrOptional[TableSpecificConfig] = None
     """
-    Configuration settings to control the ingestion of tables. These settings are applied to all tables in this schema and override the table_configuration defined in the IngestionPipelineDefinition object.
+    [Public Preview] Configuration settings to control the ingestion of tables. These settings are applied to all tables in this schema and override the table_configuration defined in the IngestionPipelineDefinition object.
     """
 
     @classmethod
@@ -66,34 +82,44 @@ class SchemaSpecDict(TypedDict, total=False):
 
     destination_catalog: VariableOr[str]
     """
-    Required. Destination catalog to store tables.
+    [Public Preview] Required. Destination catalog to store tables.
     """
 
     destination_schema: VariableOr[str]
     """
-    Required. Destination schema to store tables in. Tables with the same name as the source tables are created in this destination schema. The pipeline fails If a table with the same name already exists.
+    [Public Preview] Required. Destination schema to store tables in. Tables with the same name as the source tables are created in this destination schema. The pipeline fails If a table with the same name already exists.
     """
 
-    source_schema: VariableOr[str]
+    connector_options: VariableOrOptional[ConnectorOptionsParam]
     """
-    Required. Schema name in the source database.
+    [Public Preview] (Optional) Source Specific Connector Options
     """
 
-    connector_options: VariableOrOptional[ConnectorOptionsParam]
+    fanout_options: VariableOrOptional[IngestionPipelineDefinitionFanoutOptionsParam]
     """
     :meta private: [EXPERIMENTAL]
     
-    (Optional) Source Specific Connector Options
+    [Beta] Fanout options for multi-table routing from streaming sources.
+    When set, records are routed to destination tables based on a
+    per-record routing key. The key value becomes the table name:
+    {destination_catalog}.{destination_schema}.{key_value}.
     """
 
     source_catalog: VariableOrOptional[str]
     """
-    The source catalog name. Might be optional depending on the type of source.
+    [Public Preview] The source catalog name. Might be optional depending on the type of source.
+    """
+
+    source_schema: VariableOrOptional[str]
+    """
+    [Public Preview] Schema name in the source database. Optional: some source types (for example streaming or
+    message-bus connectors) do not use it, so it may be absent from a pipeline's definition.
+    Clients that assume it is always present should handle its absence.
     """
 
     table_configuration: VariableOrOptional[TableSpecificConfigParam]
     """
-    Configuration settings to control the ingestion of tables. These settings are applied to all tables in this schema and override the table_configuration defined in the IngestionPipelineDefinition object.
+    [Public Preview] Configuration settings to control the ingestion of tables. These settings are applied to all tables in this schema and override the table_configuration defined in the IngestionPipelineDefinition object.
     """
 
 
diff --git a/python/databricks/bundles/pipelines/_models/sharepoint_options.py b/python/databricks/bundles/pipelines/_models/sharepoint_options.py
index 72fe41e11e1..4da2754ee21 100644
--- a/python/databricks/bundles/pipelines/_models/sharepoint_options.py
+++ b/python/databricks/bundles/pipelines/_models/sharepoint_options.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -25,18 +27,24 @@ class SharepointOptions:
 
     entity_type: VariableOrOptional[SharepointOptionsSharepointEntityType] = None
     """
-    (Optional) The type of SharePoint entity to ingest.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) The type of SharePoint entity to ingest.
     If not specified, defaults to FILE.
     """
 
     file_ingestion_options: VariableOrOptional[FileIngestionOptions] = None
     """
-    (Optional) File ingestion options for processing files.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) File ingestion options for processing files.
     """
 
     url: VariableOrOptional[str] = None
     """
-    Required. The SharePoint URL.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Required. The SharePoint URL.
     """
 
     @classmethod
@@ -52,18 +60,24 @@ class SharepointOptionsDict(TypedDict, total=False):
 
     entity_type: VariableOrOptional[SharepointOptionsSharepointEntityTypeParam]
     """
-    (Optional) The type of SharePoint entity to ingest.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) The type of SharePoint entity to ingest.
     If not specified, defaults to FILE.
     """
 
     file_ingestion_options: VariableOrOptional[FileIngestionOptionsParam]
     """
-    (Optional) File ingestion options for processing files.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) File ingestion options for processing files.
     """
 
     url: VariableOrOptional[str]
     """
-    Required. The SharePoint URL.
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Required. The SharePoint URL.
     """
 
 
diff --git a/python/databricks/bundles/pipelines/_models/sharepoint_options_sharepoint_entity_type.py b/python/databricks/bundles/pipelines/_models/sharepoint_options_sharepoint_entity_type.py
index 46e15fff79d..3b0f8bf6403 100644
--- a/python/databricks/bundles/pipelines/_models/sharepoint_options_sharepoint_entity_type.py
+++ b/python/databricks/bundles/pipelines/_models/sharepoint_options_sharepoint_entity_type.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
diff --git a/python/databricks/bundles/pipelines/_models/smartsheet_options.py b/python/databricks/bundles/pipelines/_models/smartsheet_options.py
new file mode 100644
index 00000000000..73691be256b
--- /dev/null
+++ b/python/databricks/bundles/pipelines/_models/smartsheet_options.py
@@ -0,0 +1,50 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class SmartsheetOptions:
+    """
+    Smartsheet specific options for ingestion
+    """
+
+    enforce_schema: VariableOrOptional[bool] = None
+    """
+    [Public Preview] (Optional) When true, maps each column to its Smartsheet-declared type (Text/Number/Date/
+    Checkbox/etc.). Cells that do not conform to the declared type are set to NULL.
+    When false, all columns land as STRING. Use false for sheets with irregular data or columns
+    that frequently violate their own declared type.
+    If not specified, defaults to true.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "SmartsheetOptionsDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "SmartsheetOptionsDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class SmartsheetOptionsDict(TypedDict, total=False):
+    """"""
+
+    enforce_schema: VariableOrOptional[bool]
+    """
+    [Public Preview] (Optional) When true, maps each column to its Smartsheet-declared type (Text/Number/Date/
+    Checkbox/etc.). Cells that do not conform to the declared type are set to NULL.
+    When false, all columns land as STRING. Use false for sheets with irregular data or columns
+    that frequently violate their own declared type.
+    If not specified, defaults to true.
+    """
+
+
+SmartsheetOptionsParam = SmartsheetOptionsDict | SmartsheetOptions
diff --git a/python/databricks/bundles/pipelines/_models/source_catalog_config.py b/python/databricks/bundles/pipelines/_models/source_catalog_config.py
index 246079cee0f..096c7e971d7 100644
--- a/python/databricks/bundles/pipelines/_models/source_catalog_config.py
+++ b/python/databricks/bundles/pipelines/_models/source_catalog_config.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -21,12 +23,12 @@ class SourceCatalogConfig:
 
     postgres: VariableOrOptional[PostgresCatalogConfig] = None
     """
-    Postgres-specific catalog-level configuration parameters
+    [Public Preview] Postgres-specific catalog-level configuration parameters
     """
 
     source_catalog: VariableOrOptional[str] = None
     """
-    Source catalog name
+    [Public Preview] Source catalog name
     """
 
     @classmethod
@@ -42,12 +44,12 @@ class SourceCatalogConfigDict(TypedDict, total=False):
 
     postgres: VariableOrOptional[PostgresCatalogConfigParam]
     """
-    Postgres-specific catalog-level configuration parameters
+    [Public Preview] Postgres-specific catalog-level configuration parameters
     """
 
     source_catalog: VariableOrOptional[str]
     """
-    Source catalog name
+    [Public Preview] Source catalog name
     """
 
 
diff --git a/python/databricks/bundles/pipelines/_models/source_config.py b/python/databricks/bundles/pipelines/_models/source_config.py
index 876fb460a75..4695b153b40 100644
--- a/python/databricks/bundles/pipelines/_models/source_config.py
+++ b/python/databricks/bundles/pipelines/_models/source_config.py
@@ -1,9 +1,19 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
 from databricks.bundles.core._transform import _transform
 from databricks.bundles.core._transform_to_json import _transform_to_json_value
 from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.pipelines._models.api_source_connector_config import (
+    ApiSourceConnectorConfig,
+    ApiSourceConnectorConfigParam,
+)
+from databricks.bundles.pipelines._models.google_ads_config import (
+    GoogleAdsConfig,
+    GoogleAdsConfigParam,
+)
 from databricks.bundles.pipelines._models.source_catalog_config import (
     SourceCatalogConfig,
     SourceCatalogConfigParam,
@@ -17,9 +27,23 @@
 class SourceConfig:
     """"""
 
+    api_source_connector_config: VariableOrOptional[ApiSourceConnectorConfig] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Connector-specific top-level configuration for API Source connectors.
+    """
+
     catalog: VariableOrOptional[SourceCatalogConfig] = None
     """
-    Catalog-level source configuration parameters
+    [Public Preview] Catalog-level source configuration parameters
+    """
+
+    google_ads_config: VariableOrOptional[GoogleAdsConfig] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview]
     """
 
     @classmethod
@@ -33,9 +57,23 @@ def as_dict(self) -> "SourceConfigDict":
 class SourceConfigDict(TypedDict, total=False):
     """"""
 
+    api_source_connector_config: VariableOrOptional[ApiSourceConnectorConfigParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Connector-specific top-level configuration for API Source connectors.
+    """
+
     catalog: VariableOrOptional[SourceCatalogConfigParam]
     """
-    Catalog-level source configuration parameters
+    [Public Preview] Catalog-level source configuration parameters
+    """
+
+    google_ads_config: VariableOrOptional[GoogleAdsConfigParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview]
     """
 
 
diff --git a/python/databricks/bundles/pipelines/_models/table_spec.py b/python/databricks/bundles/pipelines/_models/table_spec.py
index 08e26241bf8..dc75d872c71 100644
--- a/python/databricks/bundles/pipelines/_models/table_spec.py
+++ b/python/databricks/bundles/pipelines/_models/table_spec.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
@@ -23,44 +25,44 @@ class TableSpec:
 
     destination_catalog: VariableOr[str]
     """
-    Required. Destination catalog to store table.
+    [Public Preview] Required. Destination catalog to store table.
     """
 
     destination_schema: VariableOr[str]
     """
-    Required. Destination schema to store table.
-    """
-
-    source_table: VariableOr[str]
-    """
-    Required. Table name in the source database.
+    [Public Preview] Required. Destination schema to store table.
     """
 
     connector_options: VariableOrOptional[ConnectorOptions] = None
     """
-    :meta private: [EXPERIMENTAL]
-    
-    (Optional) Source Specific Connector Options
+    [Public Preview] (Optional) Source Specific Connector Options
     """
 
     destination_table: VariableOrOptional[str] = None
     """
-    Optional. Destination table name. The pipeline fails if a table with that name already exists. If not set, the source table name is used.
+    [Public Preview] Optional. Destination table name. The pipeline fails if a table with that name already exists. If not set, the source table name is used.
     """
 
     source_catalog: VariableOrOptional[str] = None
     """
-    Source catalog name. Might be optional depending on the type of source.
+    [Public Preview] Source catalog name. Might be optional depending on the type of source.
     """
 
     source_schema: VariableOrOptional[str] = None
     """
-    Schema name in the source database. Might be optional depending on the type of source.
+    [Public Preview] Schema name in the source database. Might be optional depending on the type of source.
+    """
+
+    source_table: VariableOrOptional[str] = None
+    """
+    [Public Preview] Table name in the source database. Optional: some source types (for example streaming or
+    message-bus connectors) do not use it, so it may be absent from a pipeline's definition.
+    Clients that assume it is always present should handle its absence.
     """
 
     table_configuration: VariableOrOptional[TableSpecificConfig] = None
     """
-    Configuration settings to control the ingestion of tables. These settings override the table_configuration defined in the IngestionPipelineDefinition object and the SchemaSpec.
+    [Public Preview] Configuration settings to control the ingestion of tables. These settings override the table_configuration defined in the IngestionPipelineDefinition object and the SchemaSpec.
     """
 
     @classmethod
@@ -76,44 +78,44 @@ class TableSpecDict(TypedDict, total=False):
 
     destination_catalog: VariableOr[str]
     """
-    Required. Destination catalog to store table.
+    [Public Preview] Required. Destination catalog to store table.
     """
 
     destination_schema: VariableOr[str]
     """
-    Required. Destination schema to store table.
-    """
-
-    source_table: VariableOr[str]
-    """
-    Required. Table name in the source database.
+    [Public Preview] Required. Destination schema to store table.
     """
 
     connector_options: VariableOrOptional[ConnectorOptionsParam]
     """
-    :meta private: [EXPERIMENTAL]
-    
-    (Optional) Source Specific Connector Options
+    [Public Preview] (Optional) Source Specific Connector Options
     """
 
     destination_table: VariableOrOptional[str]
     """
-    Optional. Destination table name. The pipeline fails if a table with that name already exists. If not set, the source table name is used.
+    [Public Preview] Optional. Destination table name. The pipeline fails if a table with that name already exists. If not set, the source table name is used.
     """
 
     source_catalog: VariableOrOptional[str]
     """
-    Source catalog name. Might be optional depending on the type of source.
+    [Public Preview] Source catalog name. Might be optional depending on the type of source.
     """
 
     source_schema: VariableOrOptional[str]
     """
-    Schema name in the source database. Might be optional depending on the type of source.
+    [Public Preview] Schema name in the source database. Might be optional depending on the type of source.
+    """
+
+    source_table: VariableOrOptional[str]
+    """
+    [Public Preview] Table name in the source database. Optional: some source types (for example streaming or
+    message-bus connectors) do not use it, so it may be absent from a pipeline's definition.
+    Clients that assume it is always present should handle its absence.
     """
 
     table_configuration: VariableOrOptional[TableSpecificConfigParam]
     """
-    Configuration settings to control the ingestion of tables. These settings override the table_configuration defined in the IngestionPipelineDefinition object and the SchemaSpec.
+    [Public Preview] Configuration settings to control the ingestion of tables. These settings override the table_configuration defined in the IngestionPipelineDefinition object and the SchemaSpec.
     """
 
 
diff --git a/python/databricks/bundles/pipelines/_models/table_specific_config.py b/python/databricks/bundles/pipelines/_models/table_specific_config.py
index aa5ab57602f..42773ae759e 100644
--- a/python/databricks/bundles/pipelines/_models/table_specific_config.py
+++ b/python/databricks/bundles/pipelines/_models/table_specific_config.py
@@ -1,9 +1,15 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
 from databricks.bundles.core._transform import _transform
 from databricks.bundles.core._transform_to_json import _transform_to_json_value
-from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
+from databricks.bundles.core._variable import (
+    VariableOrDict,
+    VariableOrList,
+    VariableOrOptional,
+)
 from databricks.bundles.pipelines._models.auto_full_refresh_policy import (
     AutoFullRefreshPolicy,
     AutoFullRefreshPolicyParam,
@@ -31,7 +37,7 @@ class TableSpecificConfig:
 
     auto_full_refresh_policy: VariableOrOptional[AutoFullRefreshPolicy] = None
     """
-    (Optional, Mutable) Policy for auto full refresh, if enabled pipeline will automatically try
+    [Public Preview] (Optional, Mutable) Policy for auto full refresh, if enabled pipeline will automatically try
     to fix issues by doing a full refresh on the table in the retry run. auto_full_refresh_policy
     in table configuration will override the above level auto_full_refresh_policy.
     For example,
@@ -44,9 +50,33 @@ class TableSpecificConfig:
     If unspecified, auto full refresh is disabled.
     """
 
+    clustering_columns: VariableOrList[str] = field(default_factory=list)
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] List of column names to use for clustering the destination table.
+    When specified, the destination Delta table will be clustered by these columns.
+    This can improve query performance when filtering on these columns.
+    Note: clustering_columns in table specific configuration will override the pipeline definition.
+    Note: we can only provide enable_auto_clustering or clustering_columns,
+    added as separate fields as we cannot have repeated field in oneof.
+    """
+
+    enable_auto_clustering: VariableOrOptional[bool] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Whether to enable auto clustering on the destination table.
+    When enabled, Delta will automatically optimize the data layout
+    based on the clustering columns for improved query performance.
+    Note: enable_auto_clustering in table specific configuration will override the pipeline definition.
+    Note: we can only provide enable_auto_clustering or clustering_columns,
+    added as separate fields as we cannot have repeated field in oneof.
+    """
+
     exclude_columns: VariableOrList[str] = field(default_factory=list)
     """
-    A list of column names to be excluded for the ingestion.
+    [Public Preview] A list of column names to be excluded for the ingestion.
     When not specified, include_columns fully controls what columns to be ingested.
     When specified, all other columns including future ones will be automatically included for ingestion.
     This field in mutually exclusive with `include_columns`.
@@ -54,7 +84,7 @@ class TableSpecificConfig:
 
     include_columns: VariableOrList[str] = field(default_factory=list)
     """
-    A list of column names to be included for the ingestion.
+    [Public Preview] A list of column names to be included for the ingestion.
     When not specified, all columns except ones in exclude_columns will be included. Future
     columns will be automatically included.
     When specified, all other future columns will be automatically excluded from ingestion.
@@ -63,23 +93,19 @@ class TableSpecificConfig:
 
     primary_keys: VariableOrList[str] = field(default_factory=list)
     """
-    The primary key of the table used to apply changes.
+    [Public Preview] The primary key of the table used to apply changes.
     """
 
     query_based_connector_config: VariableOrOptional[
         IngestionPipelineDefinitionTableSpecificConfigQueryBasedConnectorConfig
     ] = None
     """
-    :meta private: [EXPERIMENTAL]
-    
-    Configurations that are only applicable for query-based ingestion connectors.
+    [Public Preview] Configurations that are only applicable for query-based ingestion connectors.
     """
 
     row_filter: VariableOrOptional[str] = None
     """
-    :meta private: [EXPERIMENTAL]
-    
-    (Optional, Immutable) The row filter condition to be applied to the table.
+    [Public Preview] (Optional, Immutable) The row filter condition to be applied to the table.
     It must not contain the WHERE keyword, only the actual filter condition.
     It must be in DBSQL format.
     """
@@ -88,19 +114,35 @@ class TableSpecificConfig:
     """
     :meta private: [EXPERIMENTAL]
     
-    If true, formula fields defined in the table are included in the ingestion. This setting is only valid for the Salesforce connector
+    [Private Preview] If true, formula fields defined in the table are included in the ingestion. This setting is only valid for the Salesforce connector
     """
 
     scd_type: VariableOrOptional[TableSpecificConfigScdType] = None
     """
+    [Public Preview] The SCD type to use to ingest the table.
+    """
+
+    sequence_by: VariableOrList[str] = field(default_factory=list)
+    """
+    [Public Preview] The column names specifying the logical order of events in the source data. Spark Declarative Pipelines uses this sequencing to handle change events that arrive out of order.
+    """
+
+    source_metadata_column: VariableOrOptional[str] = None
+    """
     :meta private: [EXPERIMENTAL]
     
-    The SCD type to use to ingest the table.
+    [Beta] (Optional) Name of the struct column added to each ingested record to hold per row source
+    metadata.
     """
 
-    sequence_by: VariableOrList[str] = field(default_factory=list)
+    table_properties: VariableOrDict[str] = field(default_factory=dict)
     """
-    The column names specifying the logical order of events in the source data. Spark Declarative Pipelines uses this sequencing to handle change events that arrive out of order.
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Table properties to set on the destination table.
+    These are key-value pairs that configure various Delta table behaviors or any user defined properties.
+    Example: {"delta.feature.variantType": "supported", "delta.enableTypeWidening": "true"}
+    Note: table_properties in table specific configuration will override the table_properties of the pipeline definition.
     """
 
     workday_report_parameters: VariableOrOptional[
@@ -108,6 +150,8 @@ class TableSpecificConfig:
     ] = None
     """
     :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Additional custom parameters for Workday Report
     """
 
     @classmethod
@@ -123,7 +167,7 @@ class TableSpecificConfigDict(TypedDict, total=False):
 
     auto_full_refresh_policy: VariableOrOptional[AutoFullRefreshPolicyParam]
     """
-    (Optional, Mutable) Policy for auto full refresh, if enabled pipeline will automatically try
+    [Public Preview] (Optional, Mutable) Policy for auto full refresh, if enabled pipeline will automatically try
     to fix issues by doing a full refresh on the table in the retry run. auto_full_refresh_policy
     in table configuration will override the above level auto_full_refresh_policy.
     For example,
@@ -136,9 +180,33 @@ class TableSpecificConfigDict(TypedDict, total=False):
     If unspecified, auto full refresh is disabled.
     """
 
+    clustering_columns: VariableOrList[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] List of column names to use for clustering the destination table.
+    When specified, the destination Delta table will be clustered by these columns.
+    This can improve query performance when filtering on these columns.
+    Note: clustering_columns in table specific configuration will override the pipeline definition.
+    Note: we can only provide enable_auto_clustering or clustering_columns,
+    added as separate fields as we cannot have repeated field in oneof.
+    """
+
+    enable_auto_clustering: VariableOrOptional[bool]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Whether to enable auto clustering on the destination table.
+    When enabled, Delta will automatically optimize the data layout
+    based on the clustering columns for improved query performance.
+    Note: enable_auto_clustering in table specific configuration will override the pipeline definition.
+    Note: we can only provide enable_auto_clustering or clustering_columns,
+    added as separate fields as we cannot have repeated field in oneof.
+    """
+
     exclude_columns: VariableOrList[str]
     """
-    A list of column names to be excluded for the ingestion.
+    [Public Preview] A list of column names to be excluded for the ingestion.
     When not specified, include_columns fully controls what columns to be ingested.
     When specified, all other columns including future ones will be automatically included for ingestion.
     This field in mutually exclusive with `include_columns`.
@@ -146,7 +214,7 @@ class TableSpecificConfigDict(TypedDict, total=False):
 
     include_columns: VariableOrList[str]
     """
-    A list of column names to be included for the ingestion.
+    [Public Preview] A list of column names to be included for the ingestion.
     When not specified, all columns except ones in exclude_columns will be included. Future
     columns will be automatically included.
     When specified, all other future columns will be automatically excluded from ingestion.
@@ -155,23 +223,19 @@ class TableSpecificConfigDict(TypedDict, total=False):
 
     primary_keys: VariableOrList[str]
     """
-    The primary key of the table used to apply changes.
+    [Public Preview] The primary key of the table used to apply changes.
     """
 
     query_based_connector_config: VariableOrOptional[
         IngestionPipelineDefinitionTableSpecificConfigQueryBasedConnectorConfigParam
     ]
     """
-    :meta private: [EXPERIMENTAL]
-    
-    Configurations that are only applicable for query-based ingestion connectors.
+    [Public Preview] Configurations that are only applicable for query-based ingestion connectors.
     """
 
     row_filter: VariableOrOptional[str]
     """
-    :meta private: [EXPERIMENTAL]
-    
-    (Optional, Immutable) The row filter condition to be applied to the table.
+    [Public Preview] (Optional, Immutable) The row filter condition to be applied to the table.
     It must not contain the WHERE keyword, only the actual filter condition.
     It must be in DBSQL format.
     """
@@ -180,19 +244,35 @@ class TableSpecificConfigDict(TypedDict, total=False):
     """
     :meta private: [EXPERIMENTAL]
     
-    If true, formula fields defined in the table are included in the ingestion. This setting is only valid for the Salesforce connector
+    [Private Preview] If true, formula fields defined in the table are included in the ingestion. This setting is only valid for the Salesforce connector
     """
 
     scd_type: VariableOrOptional[TableSpecificConfigScdTypeParam]
     """
+    [Public Preview] The SCD type to use to ingest the table.
+    """
+
+    sequence_by: VariableOrList[str]
+    """
+    [Public Preview] The column names specifying the logical order of events in the source data. Spark Declarative Pipelines uses this sequencing to handle change events that arrive out of order.
+    """
+
+    source_metadata_column: VariableOrOptional[str]
+    """
     :meta private: [EXPERIMENTAL]
     
-    The SCD type to use to ingest the table.
+    [Beta] (Optional) Name of the struct column added to each ingested record to hold per row source
+    metadata.
     """
 
-    sequence_by: VariableOrList[str]
+    table_properties: VariableOrDict[str]
     """
-    The column names specifying the logical order of events in the source data. Spark Declarative Pipelines uses this sequencing to handle change events that arrive out of order.
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Table properties to set on the destination table.
+    These are key-value pairs that configure various Delta table behaviors or any user defined properties.
+    Example: {"delta.feature.variantType": "supported", "delta.enableTypeWidening": "true"}
+    Note: table_properties in table specific configuration will override the table_properties of the pipeline definition.
     """
 
     workday_report_parameters: VariableOrOptional[
@@ -200,6 +280,8 @@ class TableSpecificConfigDict(TypedDict, total=False):
     ]
     """
     :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Additional custom parameters for Workday Report
     """
 
 
diff --git a/python/databricks/bundles/pipelines/_models/table_specific_config_scd_type.py b/python/databricks/bundles/pipelines/_models/table_specific_config_scd_type.py
index 6d138b78087..2d650e17111 100644
--- a/python/databricks/bundles/pipelines/_models/table_specific_config_scd_type.py
+++ b/python/databricks/bundles/pipelines/_models/table_specific_config_scd_type.py
@@ -1,11 +1,11 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
 
 class TableSpecificConfigScdType(Enum):
     """
-    :meta private: [EXPERIMENTAL]
-
     The SCD type to use to ingest the table.
     """
 
diff --git a/python/databricks/bundles/pipelines/_models/tik_tok_ads_options.py b/python/databricks/bundles/pipelines/_models/tik_tok_ads_options.py
index 8c304eb5614..531f06cd434 100644
--- a/python/databricks/bundles/pipelines/_models/tik_tok_ads_options.py
+++ b/python/databricks/bundles/pipelines/_models/tik_tok_ads_options.py
@@ -1,9 +1,15 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
 from databricks.bundles.core._transform import _transform
 from databricks.bundles.core._transform_to_json import _transform_to_json_value
 from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
+from databricks.bundles.pipelines._models.tik_tok_ads_options_tik_tok_ads_custom_report_options import (
+    TikTokAdsOptionsTikTokAdsCustomReportOptions,
+    TikTokAdsOptionsTikTokAdsCustomReportOptionsParam,
+)
 from databricks.bundles.pipelines._models.tik_tok_ads_options_tik_tok_data_level import (
     TikTokAdsOptionsTikTokDataLevel,
     TikTokAdsOptionsTikTokDataLevelParam,
@@ -20,57 +26,71 @@
 @dataclass(kw_only=True)
 class TikTokAdsOptions:
     """
-    :meta private: [EXPERIMENTAL]
-
     TikTok Ads specific options for ingestion
     """
 
+    custom_report_options: VariableOrOptional[
+        TikTokAdsOptionsTikTokAdsCustomReportOptions
+    ] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Custom report definition. When set, the table is treated as a
+    user-defined TikTok Ads custom report: the connector synthesizes a report
+    request from the dimensions, metrics, report type, and data level specified
+    here. Supersedes the deprecated top-level dimensions/metrics/report_type/
+    data_level/query_lifetime fields above.
+    """
+
     data_level: VariableOrOptional[TikTokAdsOptionsTikTokDataLevel] = None
     """
-    (Optional) Data level for the report.
-    If not specified, defaults to AUCTION_CAMPAIGN.
+    :meta private: [EXPERIMENTAL]
+    
+    [DEPRECATED] [Beta] Deprecated. Use custom_report_options.data_level instead.
     """
 
     dimensions: VariableOrList[str] = field(default_factory=list)
     """
-    (Optional) Dimensions to include in the report.
-    Examples: "campaign_id", "adgroup_id", "ad_id", "stat_time_day", "stat_time_hour"
-    If not specified, defaults to campaign_id.
+    :meta private: [EXPERIMENTAL]
+    
+    [DEPRECATED] [Beta] Deprecated. Use custom_report_options.dimensions instead.
     """
 
     lookback_window_days: VariableOrOptional[int] = None
     """
-    (Optional) Number of days to look back for report tables during incremental sync
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] (Optional) Number of days to look back for report tables during incremental sync
     to capture late-arriving conversions and attribution data.
-    If not specified, defaults to 7 days.
     """
 
     metrics: VariableOrList[str] = field(default_factory=list)
     """
-    (Optional) Metrics to include in the report.
-    Examples: "spend", "impressions", "clicks", "conversion", "cpc"
-    If not specified, defaults to basic metrics (spend, impressions, clicks, etc.)
+    :meta private: [EXPERIMENTAL]
+    
+    [DEPRECATED] [Beta] Deprecated. Use custom_report_options.metrics instead.
     """
 
     query_lifetime: VariableOrOptional[bool] = None
     """
-    (Optional) Whether to request lifetime metrics (all-time aggregated data).
-    When true, the report returns all-time data.
-    If not specified, defaults to false.
+    :meta private: [EXPERIMENTAL]
+    
+    [DEPRECATED] [Beta] Deprecated. Use custom_report_options.query_lifetime instead.
     """
 
     report_type: VariableOrOptional[TikTokAdsOptionsTikTokReportType] = None
     """
-    (Optional) Report type for the TikTok Ads API.
-    If not specified, defaults to BASIC.
+    :meta private: [EXPERIMENTAL]
+    
+    [DEPRECATED] [Beta] Deprecated. Use custom_report_options.report_type instead.
     """
 
     sync_start_date: VariableOrOptional[str] = None
     """
-    (Optional) Start date for the initial sync of report tables in YYYY-MM-DD format.
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] (Optional) Start date for the initial sync of report tables in YYYY-MM-DD format.
     This determines the earliest date from which to sync historical data.
-    If not specified, defaults to 1 year of historical data for daily reports
-    and 30 days for hourly reports.
     """
 
     @classmethod
@@ -84,52 +104,68 @@ def as_dict(self) -> "TikTokAdsOptionsDict":
 class TikTokAdsOptionsDict(TypedDict, total=False):
     """"""
 
+    custom_report_options: VariableOrOptional[
+        TikTokAdsOptionsTikTokAdsCustomReportOptionsParam
+    ]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Custom report definition. When set, the table is treated as a
+    user-defined TikTok Ads custom report: the connector synthesizes a report
+    request from the dimensions, metrics, report type, and data level specified
+    here. Supersedes the deprecated top-level dimensions/metrics/report_type/
+    data_level/query_lifetime fields above.
+    """
+
     data_level: VariableOrOptional[TikTokAdsOptionsTikTokDataLevelParam]
     """
-    (Optional) Data level for the report.
-    If not specified, defaults to AUCTION_CAMPAIGN.
+    :meta private: [EXPERIMENTAL]
+    
+    [DEPRECATED] [Beta] Deprecated. Use custom_report_options.data_level instead.
     """
 
     dimensions: VariableOrList[str]
     """
-    (Optional) Dimensions to include in the report.
-    Examples: "campaign_id", "adgroup_id", "ad_id", "stat_time_day", "stat_time_hour"
-    If not specified, defaults to campaign_id.
+    :meta private: [EXPERIMENTAL]
+    
+    [DEPRECATED] [Beta] Deprecated. Use custom_report_options.dimensions instead.
     """
 
     lookback_window_days: VariableOrOptional[int]
     """
-    (Optional) Number of days to look back for report tables during incremental sync
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] (Optional) Number of days to look back for report tables during incremental sync
     to capture late-arriving conversions and attribution data.
-    If not specified, defaults to 7 days.
     """
 
     metrics: VariableOrList[str]
     """
-    (Optional) Metrics to include in the report.
-    Examples: "spend", "impressions", "clicks", "conversion", "cpc"
-    If not specified, defaults to basic metrics (spend, impressions, clicks, etc.)
+    :meta private: [EXPERIMENTAL]
+    
+    [DEPRECATED] [Beta] Deprecated. Use custom_report_options.metrics instead.
     """
 
     query_lifetime: VariableOrOptional[bool]
     """
-    (Optional) Whether to request lifetime metrics (all-time aggregated data).
-    When true, the report returns all-time data.
-    If not specified, defaults to false.
+    :meta private: [EXPERIMENTAL]
+    
+    [DEPRECATED] [Beta] Deprecated. Use custom_report_options.query_lifetime instead.
     """
 
     report_type: VariableOrOptional[TikTokAdsOptionsTikTokReportTypeParam]
     """
-    (Optional) Report type for the TikTok Ads API.
-    If not specified, defaults to BASIC.
+    :meta private: [EXPERIMENTAL]
+    
+    [DEPRECATED] [Beta] Deprecated. Use custom_report_options.report_type instead.
     """
 
     sync_start_date: VariableOrOptional[str]
     """
-    (Optional) Start date for the initial sync of report tables in YYYY-MM-DD format.
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] (Optional) Start date for the initial sync of report tables in YYYY-MM-DD format.
     This determines the earliest date from which to sync historical data.
-    If not specified, defaults to 1 year of historical data for daily reports
-    and 30 days for hourly reports.
     """
 
 
diff --git a/python/databricks/bundles/pipelines/_models/tik_tok_ads_options_tik_tok_ads_custom_report_options.py b/python/databricks/bundles/pipelines/_models/tik_tok_ads_options_tik_tok_ads_custom_report_options.py
new file mode 100644
index 00000000000..6c2820a3bc2
--- /dev/null
+++ b/python/databricks/bundles/pipelines/_models/tik_tok_ads_options_tik_tok_ads_custom_report_options.py
@@ -0,0 +1,131 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
+from databricks.bundles.pipelines._models.tik_tok_ads_options_tik_tok_data_level import (
+    TikTokAdsOptionsTikTokDataLevel,
+    TikTokAdsOptionsTikTokDataLevelParam,
+)
+from databricks.bundles.pipelines._models.tik_tok_ads_options_tik_tok_report_type import (
+    TikTokAdsOptionsTikTokReportType,
+    TikTokAdsOptionsTikTokReportTypeParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class TikTokAdsOptionsTikTokAdsCustomReportOptions:
+    """
+    :meta private: [EXPERIMENTAL]
+
+    User-defined custom report for the TikTok Ads connector. Groups the
+    dimensions + metrics + report type + data level that define a TikTok Ads
+    custom report request.
+    """
+
+    data_level: VariableOrOptional[TikTokAdsOptionsTikTokDataLevel] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Data level for the report.
+    If not specified, defaults to AUCTION_CAMPAIGN.
+    """
+
+    dimensions: VariableOrList[str] = field(default_factory=list)
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Dimensions to include in the report (e.g. "campaign_id",
+    "adgroup_id", "ad_id", "stat_time_day", "stat_time_hour").
+    """
+
+    metrics: VariableOrList[str] = field(default_factory=list)
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Metrics to include in the report (e.g. "spend", "impressions",
+    "clicks", "conversion", "cpc").
+    """
+
+    query_lifetime: VariableOrOptional[bool] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Whether to request lifetime metrics (all-time aggregated data).
+    When true, the report returns all-time data.
+    If not specified, defaults to false.
+    """
+
+    report_type: VariableOrOptional[TikTokAdsOptionsTikTokReportType] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Report type for the TikTok Ads API.
+    If not specified, defaults to BASIC.
+    """
+
+    @classmethod
+    def from_dict(
+        cls, value: "TikTokAdsOptionsTikTokAdsCustomReportOptionsDict"
+    ) -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "TikTokAdsOptionsTikTokAdsCustomReportOptionsDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class TikTokAdsOptionsTikTokAdsCustomReportOptionsDict(TypedDict, total=False):
+    """"""
+
+    data_level: VariableOrOptional[TikTokAdsOptionsTikTokDataLevelParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Data level for the report.
+    If not specified, defaults to AUCTION_CAMPAIGN.
+    """
+
+    dimensions: VariableOrList[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Dimensions to include in the report (e.g. "campaign_id",
+    "adgroup_id", "ad_id", "stat_time_day", "stat_time_hour").
+    """
+
+    metrics: VariableOrList[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Metrics to include in the report (e.g. "spend", "impressions",
+    "clicks", "conversion", "cpc").
+    """
+
+    query_lifetime: VariableOrOptional[bool]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Whether to request lifetime metrics (all-time aggregated data).
+    When true, the report returns all-time data.
+    If not specified, defaults to false.
+    """
+
+    report_type: VariableOrOptional[TikTokAdsOptionsTikTokReportTypeParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] (Optional) Report type for the TikTok Ads API.
+    If not specified, defaults to BASIC.
+    """
+
+
+TikTokAdsOptionsTikTokAdsCustomReportOptionsParam = (
+    TikTokAdsOptionsTikTokAdsCustomReportOptionsDict
+    | TikTokAdsOptionsTikTokAdsCustomReportOptions
+)
diff --git a/python/databricks/bundles/pipelines/_models/tik_tok_ads_options_tik_tok_data_level.py b/python/databricks/bundles/pipelines/_models/tik_tok_ads_options_tik_tok_data_level.py
index 11f6159bcf8..7795cd821b6 100644
--- a/python/databricks/bundles/pipelines/_models/tik_tok_ads_options_tik_tok_data_level.py
+++ b/python/databricks/bundles/pipelines/_models/tik_tok_ads_options_tik_tok_data_level.py
@@ -1,11 +1,11 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
 
 class TikTokAdsOptionsTikTokDataLevel(Enum):
     """
-    :meta private: [EXPERIMENTAL]
-
     Data level for TikTok Ads report aggregation.
     """
 
diff --git a/python/databricks/bundles/pipelines/_models/tik_tok_ads_options_tik_tok_report_type.py b/python/databricks/bundles/pipelines/_models/tik_tok_ads_options_tik_tok_report_type.py
index 272d36ff0c0..c97e2ee93a5 100644
--- a/python/databricks/bundles/pipelines/_models/tik_tok_ads_options_tik_tok_report_type.py
+++ b/python/databricks/bundles/pipelines/_models/tik_tok_ads_options_tik_tok_report_type.py
@@ -1,11 +1,11 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
 
 class TikTokAdsOptionsTikTokReportType(Enum):
     """
-    :meta private: [EXPERIMENTAL]
-
     Report type for TikTok Ads API.
     """
 
diff --git a/python/databricks/bundles/pipelines/_models/transformer.py b/python/databricks/bundles/pipelines/_models/transformer.py
new file mode 100644
index 00000000000..b42fcef66f9
--- /dev/null
+++ b/python/databricks/bundles/pipelines/_models/transformer.py
@@ -0,0 +1,136 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.pipelines._models.avro_transformer_options import (
+    AvroTransformerOptions,
+    AvroTransformerOptionsParam,
+)
+from databricks.bundles.pipelines._models.json_transformer_options import (
+    JsonTransformerOptions,
+    JsonTransformerOptionsParam,
+)
+from databricks.bundles.pipelines._models.protobuf_transformer_options import (
+    ProtobufTransformerOptions,
+    ProtobufTransformerOptionsParam,
+)
+from databricks.bundles.pipelines._models.transformer_format import (
+    TransformerFormat,
+    TransformerFormatParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class Transformer:
+    """
+    Specifies how to transform binary data into structured data.
+    """
+
+    avro_options: VariableOrOptional[AvroTransformerOptions] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta]
+    """
+
+    format: VariableOrOptional[TransformerFormat] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Required: the wire format of the data.
+    """
+
+    input_column: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Optional input column to transform. When set, the transformer reads
+    from this column instead of the default source column.
+    """
+
+    json_options: VariableOrOptional[JsonTransformerOptions] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta]
+    """
+
+    output_column: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Optional output column name. When set, the transformed result is
+    written to this column instead of replacing the input column.
+    """
+
+    protobuf_options: VariableOrOptional[ProtobufTransformerOptions] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta]
+    """
+
+    @classmethod
+    def from_dict(cls, value: "TransformerDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "TransformerDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class TransformerDict(TypedDict, total=False):
+    """"""
+
+    avro_options: VariableOrOptional[AvroTransformerOptionsParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta]
+    """
+
+    format: VariableOrOptional[TransformerFormatParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Required: the wire format of the data.
+    """
+
+    input_column: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Optional input column to transform. When set, the transformer reads
+    from this column instead of the default source column.
+    """
+
+    json_options: VariableOrOptional[JsonTransformerOptionsParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta]
+    """
+
+    output_column: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Optional output column name. When set, the transformed result is
+    written to this column instead of replacing the input column.
+    """
+
+    protobuf_options: VariableOrOptional[ProtobufTransformerOptionsParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta]
+    """
+
+
+TransformerParam = TransformerDict | Transformer
diff --git a/python/databricks/bundles/pipelines/_models/transformer_format.py b/python/databricks/bundles/pipelines/_models/transformer_format.py
new file mode 100644
index 00000000000..006855705ca
--- /dev/null
+++ b/python/databricks/bundles/pipelines/_models/transformer_format.py
@@ -0,0 +1,16 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class TransformerFormat(Enum):
+    STRING = "STRING"
+    JSON = "JSON"
+    AVRO = "AVRO"
+    PROTOBUF = "PROTOBUF"
+
+
+TransformerFormatParam = (
+    Literal["STRING", "JSON", "AVRO", "PROTOBUF"] | TransformerFormat
+)
diff --git a/python/databricks/bundles/pipelines/_models/volumes_storage_info.py b/python/databricks/bundles/pipelines/_models/volumes_storage_info.py
index cbe74758fc7..1eb4fff7bc2 100644
--- a/python/databricks/bundles/pipelines/_models/volumes_storage_info.py
+++ b/python/databricks/bundles/pipelines/_models/volumes_storage_info.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/pipelines/_models/workspace_storage_info.py b/python/databricks/bundles/pipelines/_models/workspace_storage_info.py
index 29c075ac2f3..49aef9256c8 100644
--- a/python/databricks/bundles/pipelines/_models/workspace_storage_info.py
+++ b/python/databricks/bundles/pipelines/_models/workspace_storage_info.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/pipelines/_models/zendesk_support_options.py b/python/databricks/bundles/pipelines/_models/zendesk_support_options.py
new file mode 100644
index 00000000000..23a03e8eab8
--- /dev/null
+++ b/python/databricks/bundles/pipelines/_models/zendesk_support_options.py
@@ -0,0 +1,44 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class ZendeskSupportOptions:
+    """
+    Zendesk Support specific options for ingestion
+    """
+
+    start_date: VariableOrOptional[str] = None
+    """
+    [Public Preview] (Optional) Start date in YYYY-MM-DD format for the initial sync.
+    This determines the earliest date from which to sync historical data.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "ZendeskSupportOptionsDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ZendeskSupportOptionsDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ZendeskSupportOptionsDict(TypedDict, total=False):
+    """"""
+
+    start_date: VariableOrOptional[str]
+    """
+    [Public Preview] (Optional) Start date in YYYY-MM-DD format for the initial sync.
+    This determines the earliest date from which to sync historical data.
+    """
+
+
+ZendeskSupportOptionsParam = ZendeskSupportOptionsDict | ZendeskSupportOptions
diff --git a/python/databricks/bundles/quality_monitors/__init__.py b/python/databricks/bundles/quality_monitors/__init__.py
new file mode 100644
index 00000000000..ad0902bfcf6
--- /dev/null
+++ b/python/databricks/bundles/quality_monitors/__init__.py
@@ -0,0 +1,104 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+__all__ = [
+    "Lifecycle",
+    "LifecycleDict",
+    "LifecycleParam",
+    "MonitorCronSchedule",
+    "MonitorCronScheduleDict",
+    "MonitorCronScheduleParam",
+    "MonitorCronSchedulePauseStatus",
+    "MonitorCronSchedulePauseStatusParam",
+    "MonitorDataClassificationConfig",
+    "MonitorDataClassificationConfigDict",
+    "MonitorDataClassificationConfigParam",
+    "MonitorDestination",
+    "MonitorDestinationDict",
+    "MonitorDestinationParam",
+    "MonitorInferenceLog",
+    "MonitorInferenceLogDict",
+    "MonitorInferenceLogParam",
+    "MonitorInferenceLogProblemType",
+    "MonitorInferenceLogProblemTypeParam",
+    "MonitorMetric",
+    "MonitorMetricDict",
+    "MonitorMetricParam",
+    "MonitorMetricType",
+    "MonitorMetricTypeParam",
+    "MonitorNotifications",
+    "MonitorNotificationsDict",
+    "MonitorNotificationsParam",
+    "MonitorSnapshot",
+    "MonitorSnapshotDict",
+    "MonitorSnapshotParam",
+    "MonitorTimeSeries",
+    "MonitorTimeSeriesDict",
+    "MonitorTimeSeriesParam",
+    "QualityMonitor",
+    "QualityMonitorDict",
+    "QualityMonitorParam",
+]
+
+
+from databricks.bundles.quality_monitors._models.lifecycle import (
+    Lifecycle,
+    LifecycleDict,
+    LifecycleParam,
+)
+from databricks.bundles.quality_monitors._models.monitor_cron_schedule import (
+    MonitorCronSchedule,
+    MonitorCronScheduleDict,
+    MonitorCronScheduleParam,
+)
+from databricks.bundles.quality_monitors._models.monitor_cron_schedule_pause_status import (
+    MonitorCronSchedulePauseStatus,
+    MonitorCronSchedulePauseStatusParam,
+)
+from databricks.bundles.quality_monitors._models.monitor_data_classification_config import (
+    MonitorDataClassificationConfig,
+    MonitorDataClassificationConfigDict,
+    MonitorDataClassificationConfigParam,
+)
+from databricks.bundles.quality_monitors._models.monitor_destination import (
+    MonitorDestination,
+    MonitorDestinationDict,
+    MonitorDestinationParam,
+)
+from databricks.bundles.quality_monitors._models.monitor_inference_log import (
+    MonitorInferenceLog,
+    MonitorInferenceLogDict,
+    MonitorInferenceLogParam,
+)
+from databricks.bundles.quality_monitors._models.monitor_inference_log_problem_type import (
+    MonitorInferenceLogProblemType,
+    MonitorInferenceLogProblemTypeParam,
+)
+from databricks.bundles.quality_monitors._models.monitor_metric import (
+    MonitorMetric,
+    MonitorMetricDict,
+    MonitorMetricParam,
+)
+from databricks.bundles.quality_monitors._models.monitor_metric_type import (
+    MonitorMetricType,
+    MonitorMetricTypeParam,
+)
+from databricks.bundles.quality_monitors._models.monitor_notifications import (
+    MonitorNotifications,
+    MonitorNotificationsDict,
+    MonitorNotificationsParam,
+)
+from databricks.bundles.quality_monitors._models.monitor_snapshot import (
+    MonitorSnapshot,
+    MonitorSnapshotDict,
+    MonitorSnapshotParam,
+)
+from databricks.bundles.quality_monitors._models.monitor_time_series import (
+    MonitorTimeSeries,
+    MonitorTimeSeriesDict,
+    MonitorTimeSeriesParam,
+)
+from databricks.bundles.quality_monitors._models.quality_monitor import (
+    QualityMonitor,
+    QualityMonitorDict,
+    QualityMonitorParam,
+)
diff --git a/python/databricks/bundles/quality_monitors/_models/lifecycle.py b/python/databricks/bundles/quality_monitors/_models/lifecycle.py
new file mode 100644
index 00000000000..697776a198e
--- /dev/null
+++ b/python/databricks/bundles/quality_monitors/_models/lifecycle.py
@@ -0,0 +1,40 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class Lifecycle:
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool] = None
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "LifecycleDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "LifecycleDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class LifecycleDict(TypedDict, total=False):
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool]
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+
+LifecycleParam = LifecycleDict | Lifecycle
diff --git a/python/databricks/bundles/quality_monitors/_models/monitor_cron_schedule.py b/python/databricks/bundles/quality_monitors/_models/monitor_cron_schedule.py
new file mode 100644
index 00000000000..02a8de80077
--- /dev/null
+++ b/python/databricks/bundles/quality_monitors/_models/monitor_cron_schedule.py
@@ -0,0 +1,64 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+from databricks.bundles.quality_monitors._models.monitor_cron_schedule_pause_status import (
+    MonitorCronSchedulePauseStatus,
+    MonitorCronSchedulePauseStatusParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class MonitorCronSchedule:
+    """"""
+
+    quartz_cron_expression: VariableOr[str]
+    """
+    The expression that determines when to run the monitor. See [examples](https://www.quartz-scheduler.org/documentation/quartz-2.3.0/tutorials/crontrigger.html).
+    """
+
+    timezone_id: VariableOr[str]
+    """
+    The timezone id (e.g., ``PST``) in which to evaluate the quartz expression.
+    """
+
+    pause_status: VariableOrOptional[MonitorCronSchedulePauseStatus] = None
+    """
+    Read only field that indicates whether a schedule is paused or not.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "MonitorCronScheduleDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "MonitorCronScheduleDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class MonitorCronScheduleDict(TypedDict, total=False):
+    """"""
+
+    quartz_cron_expression: VariableOr[str]
+    """
+    The expression that determines when to run the monitor. See [examples](https://www.quartz-scheduler.org/documentation/quartz-2.3.0/tutorials/crontrigger.html).
+    """
+
+    timezone_id: VariableOr[str]
+    """
+    The timezone id (e.g., ``PST``) in which to evaluate the quartz expression.
+    """
+
+    pause_status: VariableOrOptional[MonitorCronSchedulePauseStatusParam]
+    """
+    Read only field that indicates whether a schedule is paused or not.
+    """
+
+
+MonitorCronScheduleParam = MonitorCronScheduleDict | MonitorCronSchedule
diff --git a/python/databricks/bundles/quality_monitors/_models/monitor_cron_schedule_pause_status.py b/python/databricks/bundles/quality_monitors/_models/monitor_cron_schedule_pause_status.py
new file mode 100644
index 00000000000..69b5dd3666b
--- /dev/null
+++ b/python/databricks/bundles/quality_monitors/_models/monitor_cron_schedule_pause_status.py
@@ -0,0 +1,20 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class MonitorCronSchedulePauseStatus(Enum):
+    """
+    Source link: https://src.dev.databricks.com/databricks/universe/-/blob/elastic-spark-common/api/messages/schedule.proto
+    Monitoring workflow schedule pause status.
+    """
+
+    UNSPECIFIED = "UNSPECIFIED"
+    UNPAUSED = "UNPAUSED"
+    PAUSED = "PAUSED"
+
+
+MonitorCronSchedulePauseStatusParam = (
+    Literal["UNSPECIFIED", "UNPAUSED", "PAUSED"] | MonitorCronSchedulePauseStatus
+)
diff --git a/python/databricks/bundles/quality_monitors/_models/monitor_data_classification_config.py b/python/databricks/bundles/quality_monitors/_models/monitor_data_classification_config.py
new file mode 100644
index 00000000000..cda4e643683
--- /dev/null
+++ b/python/databricks/bundles/quality_monitors/_models/monitor_data_classification_config.py
@@ -0,0 +1,50 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class MonitorDataClassificationConfig:
+    """
+    :meta private: [EXPERIMENTAL]
+
+    Data classification related configuration.
+    """
+
+    enabled: VariableOrOptional[bool] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Whether to enable data classification.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "MonitorDataClassificationConfigDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "MonitorDataClassificationConfigDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class MonitorDataClassificationConfigDict(TypedDict, total=False):
+    """"""
+
+    enabled: VariableOrOptional[bool]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Whether to enable data classification.
+    """
+
+
+MonitorDataClassificationConfigParam = (
+    MonitorDataClassificationConfigDict | MonitorDataClassificationConfig
+)
diff --git a/python/databricks/bundles/quality_monitors/_models/monitor_destination.py b/python/databricks/bundles/quality_monitors/_models/monitor_destination.py
new file mode 100644
index 00000000000..2f4f5b1d37f
--- /dev/null
+++ b/python/databricks/bundles/quality_monitors/_models/monitor_destination.py
@@ -0,0 +1,40 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class MonitorDestination:
+    """"""
+
+    email_addresses: VariableOrList[str] = field(default_factory=list)
+    """
+    The list of email addresses to send the notification to. A maximum of 5 email addresses is supported.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "MonitorDestinationDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "MonitorDestinationDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class MonitorDestinationDict(TypedDict, total=False):
+    """"""
+
+    email_addresses: VariableOrList[str]
+    """
+    The list of email addresses to send the notification to. A maximum of 5 email addresses is supported.
+    """
+
+
+MonitorDestinationParam = MonitorDestinationDict | MonitorDestination
diff --git a/python/databricks/bundles/quality_monitors/_models/monitor_inference_log.py b/python/databricks/bundles/quality_monitors/_models/monitor_inference_log.py
new file mode 100644
index 00000000000..24b6ea70e87
--- /dev/null
+++ b/python/databricks/bundles/quality_monitors/_models/monitor_inference_log.py
@@ -0,0 +1,108 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import (
+    VariableOr,
+    VariableOrList,
+    VariableOrOptional,
+)
+from databricks.bundles.quality_monitors._models.monitor_inference_log_problem_type import (
+    MonitorInferenceLogProblemType,
+    MonitorInferenceLogProblemTypeParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class MonitorInferenceLog:
+    """"""
+
+    model_id_col: VariableOr[str]
+    """
+    Column for the model identifier.
+    """
+
+    prediction_col: VariableOr[str]
+    """
+    Column for the prediction.
+    """
+
+    problem_type: VariableOr[MonitorInferenceLogProblemType]
+    """
+    Problem type the model aims to solve.
+    """
+
+    timestamp_col: VariableOr[str]
+    """
+    Column for the timestamp.
+    """
+
+    granularities: VariableOrList[str] = field(default_factory=list)
+    """
+    Granularities for aggregating data into time windows based on their timestamp. Valid values are 5 minutes, 30 minutes, 1 hour, 1 day, n weeks, 1 month, or 1 year.
+    """
+
+    label_col: VariableOrOptional[str] = None
+    """
+    Column for the label.
+    """
+
+    prediction_proba_col: VariableOrOptional[str] = None
+    """
+    Column for prediction probabilities
+    """
+
+    @classmethod
+    def from_dict(cls, value: "MonitorInferenceLogDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "MonitorInferenceLogDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class MonitorInferenceLogDict(TypedDict, total=False):
+    """"""
+
+    model_id_col: VariableOr[str]
+    """
+    Column for the model identifier.
+    """
+
+    prediction_col: VariableOr[str]
+    """
+    Column for the prediction.
+    """
+
+    problem_type: VariableOr[MonitorInferenceLogProblemTypeParam]
+    """
+    Problem type the model aims to solve.
+    """
+
+    timestamp_col: VariableOr[str]
+    """
+    Column for the timestamp.
+    """
+
+    granularities: VariableOrList[str]
+    """
+    Granularities for aggregating data into time windows based on their timestamp. Valid values are 5 minutes, 30 minutes, 1 hour, 1 day, n weeks, 1 month, or 1 year.
+    """
+
+    label_col: VariableOrOptional[str]
+    """
+    Column for the label.
+    """
+
+    prediction_proba_col: VariableOrOptional[str]
+    """
+    Column for prediction probabilities
+    """
+
+
+MonitorInferenceLogParam = MonitorInferenceLogDict | MonitorInferenceLog
diff --git a/python/databricks/bundles/quality_monitors/_models/monitor_inference_log_problem_type.py b/python/databricks/bundles/quality_monitors/_models/monitor_inference_log_problem_type.py
new file mode 100644
index 00000000000..42d8569619b
--- /dev/null
+++ b/python/databricks/bundles/quality_monitors/_models/monitor_inference_log_problem_type.py
@@ -0,0 +1,15 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class MonitorInferenceLogProblemType(Enum):
+    PROBLEM_TYPE_CLASSIFICATION = "PROBLEM_TYPE_CLASSIFICATION"
+    PROBLEM_TYPE_REGRESSION = "PROBLEM_TYPE_REGRESSION"
+
+
+MonitorInferenceLogProblemTypeParam = (
+    Literal["PROBLEM_TYPE_CLASSIFICATION", "PROBLEM_TYPE_REGRESSION"]
+    | MonitorInferenceLogProblemType
+)
diff --git a/python/databricks/bundles/quality_monitors/_models/monitor_metric.py b/python/databricks/bundles/quality_monitors/_models/monitor_metric.py
new file mode 100644
index 00000000000..cb7f876dae8
--- /dev/null
+++ b/python/databricks/bundles/quality_monitors/_models/monitor_metric.py
@@ -0,0 +1,100 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrList
+from databricks.bundles.quality_monitors._models.monitor_metric_type import (
+    MonitorMetricType,
+    MonitorMetricTypeParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class MonitorMetric:
+    """
+    Custom metric definition.
+    """
+
+    definition: VariableOr[str]
+    """
+    Jinja template for a SQL expression that specifies how to compute the metric. See [create metric definition](https://docs.databricks.com/en/lakehouse-monitoring/custom-metrics.html#create-definition).
+    """
+
+    name: VariableOr[str]
+    """
+    Name of the metric in the output tables.
+    """
+
+    output_data_type: VariableOr[str]
+    """
+    The output type of the custom metric.
+    """
+
+    type: VariableOr[MonitorMetricType]
+    """
+    Can only be one of ``"CUSTOM_METRIC_TYPE_AGGREGATE"``, ``"CUSTOM_METRIC_TYPE_DERIVED"``, or ``"CUSTOM_METRIC_TYPE_DRIFT"``.
+    The ``"CUSTOM_METRIC_TYPE_AGGREGATE"`` and ``"CUSTOM_METRIC_TYPE_DERIVED"`` metrics
+    are computed on a single table, whereas the ``"CUSTOM_METRIC_TYPE_DRIFT"`` compare metrics across
+    baseline and input table, or across the two consecutive time windows.
+    - CUSTOM_METRIC_TYPE_AGGREGATE: only depend on the existing columns in your table
+    - CUSTOM_METRIC_TYPE_DERIVED: depend on previously computed aggregate metrics
+    - CUSTOM_METRIC_TYPE_DRIFT:  depend on previously computed aggregate or derived metrics
+    """
+
+    input_columns: VariableOrList[str] = field(default_factory=list)
+    """
+    A list of column names in the input table the metric should be computed for.
+    Can use ``":table"`` to indicate that the metric needs information from multiple columns.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "MonitorMetricDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "MonitorMetricDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class MonitorMetricDict(TypedDict, total=False):
+    """"""
+
+    definition: VariableOr[str]
+    """
+    Jinja template for a SQL expression that specifies how to compute the metric. See [create metric definition](https://docs.databricks.com/en/lakehouse-monitoring/custom-metrics.html#create-definition).
+    """
+
+    name: VariableOr[str]
+    """
+    Name of the metric in the output tables.
+    """
+
+    output_data_type: VariableOr[str]
+    """
+    The output type of the custom metric.
+    """
+
+    type: VariableOr[MonitorMetricTypeParam]
+    """
+    Can only be one of ``"CUSTOM_METRIC_TYPE_AGGREGATE"``, ``"CUSTOM_METRIC_TYPE_DERIVED"``, or ``"CUSTOM_METRIC_TYPE_DRIFT"``.
+    The ``"CUSTOM_METRIC_TYPE_AGGREGATE"`` and ``"CUSTOM_METRIC_TYPE_DERIVED"`` metrics
+    are computed on a single table, whereas the ``"CUSTOM_METRIC_TYPE_DRIFT"`` compare metrics across
+    baseline and input table, or across the two consecutive time windows.
+    - CUSTOM_METRIC_TYPE_AGGREGATE: only depend on the existing columns in your table
+    - CUSTOM_METRIC_TYPE_DERIVED: depend on previously computed aggregate metrics
+    - CUSTOM_METRIC_TYPE_DRIFT:  depend on previously computed aggregate or derived metrics
+    """
+
+    input_columns: VariableOrList[str]
+    """
+    A list of column names in the input table the metric should be computed for.
+    Can use ``":table"`` to indicate that the metric needs information from multiple columns.
+    """
+
+
+MonitorMetricParam = MonitorMetricDict | MonitorMetric
diff --git a/python/databricks/bundles/quality_monitors/_models/monitor_metric_type.py b/python/databricks/bundles/quality_monitors/_models/monitor_metric_type.py
new file mode 100644
index 00000000000..4c70c089a0f
--- /dev/null
+++ b/python/databricks/bundles/quality_monitors/_models/monitor_metric_type.py
@@ -0,0 +1,30 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class MonitorMetricType(Enum):
+    """
+    Can only be one of ``\"CUSTOM_METRIC_TYPE_AGGREGATE\"``, ``\"CUSTOM_METRIC_TYPE_DERIVED\"``, or ``\"CUSTOM_METRIC_TYPE_DRIFT\"``.
+    The ``\"CUSTOM_METRIC_TYPE_AGGREGATE\"`` and ``\"CUSTOM_METRIC_TYPE_DERIVED\"`` metrics
+    are computed on a single table, whereas the ``\"CUSTOM_METRIC_TYPE_DRIFT\"`` compare metrics across
+    baseline and input table, or across the two consecutive time windows.
+    - CUSTOM_METRIC_TYPE_AGGREGATE: only depend on the existing columns in your table
+    - CUSTOM_METRIC_TYPE_DERIVED: depend on previously computed aggregate metrics
+    - CUSTOM_METRIC_TYPE_DRIFT:  depend on previously computed aggregate or derived metrics
+    """
+
+    CUSTOM_METRIC_TYPE_AGGREGATE = "CUSTOM_METRIC_TYPE_AGGREGATE"
+    CUSTOM_METRIC_TYPE_DERIVED = "CUSTOM_METRIC_TYPE_DERIVED"
+    CUSTOM_METRIC_TYPE_DRIFT = "CUSTOM_METRIC_TYPE_DRIFT"
+
+
+MonitorMetricTypeParam = (
+    Literal[
+        "CUSTOM_METRIC_TYPE_AGGREGATE",
+        "CUSTOM_METRIC_TYPE_DERIVED",
+        "CUSTOM_METRIC_TYPE_DRIFT",
+    ]
+    | MonitorMetricType
+)
diff --git a/python/databricks/bundles/quality_monitors/_models/monitor_notifications.py b/python/databricks/bundles/quality_monitors/_models/monitor_notifications.py
new file mode 100644
index 00000000000..007b3ae64e4
--- /dev/null
+++ b/python/databricks/bundles/quality_monitors/_models/monitor_notifications.py
@@ -0,0 +1,58 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.quality_monitors._models.monitor_destination import (
+    MonitorDestination,
+    MonitorDestinationParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class MonitorNotifications:
+    """"""
+
+    on_failure: VariableOrOptional[MonitorDestination] = None
+    """
+    Destinations to send notifications on failure/timeout.
+    """
+
+    on_new_classification_tag_detected: VariableOrOptional[MonitorDestination] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Destinations to send notifications on new classification tag detected.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "MonitorNotificationsDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "MonitorNotificationsDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class MonitorNotificationsDict(TypedDict, total=False):
+    """"""
+
+    on_failure: VariableOrOptional[MonitorDestinationParam]
+    """
+    Destinations to send notifications on failure/timeout.
+    """
+
+    on_new_classification_tag_detected: VariableOrOptional[MonitorDestinationParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Destinations to send notifications on new classification tag detected.
+    """
+
+
+MonitorNotificationsParam = MonitorNotificationsDict | MonitorNotifications
diff --git a/python/databricks/bundles/quality_monitors/_models/monitor_snapshot.py b/python/databricks/bundles/quality_monitors/_models/monitor_snapshot.py
new file mode 100644
index 00000000000..4cc39dcb9d0
--- /dev/null
+++ b/python/databricks/bundles/quality_monitors/_models/monitor_snapshot.py
@@ -0,0 +1,31 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class MonitorSnapshot:
+    """
+    Snapshot analysis configuration
+    """
+
+    @classmethod
+    def from_dict(cls, value: "MonitorSnapshotDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "MonitorSnapshotDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class MonitorSnapshotDict(TypedDict, total=False):
+    """"""
+
+
+MonitorSnapshotParam = MonitorSnapshotDict | MonitorSnapshot
diff --git a/python/databricks/bundles/quality_monitors/_models/monitor_time_series.py b/python/databricks/bundles/quality_monitors/_models/monitor_time_series.py
new file mode 100644
index 00000000000..29f3b950a0e
--- /dev/null
+++ b/python/databricks/bundles/quality_monitors/_models/monitor_time_series.py
@@ -0,0 +1,52 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrList
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class MonitorTimeSeries:
+    """
+    Time series analysis configuration.
+    """
+
+    timestamp_col: VariableOr[str]
+    """
+    Column for the timestamp.
+    """
+
+    granularities: VariableOrList[str] = field(default_factory=list)
+    """
+    Granularities for aggregating data into time windows based on their timestamp. Valid values are 5 minutes, 30 minutes, 1 hour, 1 day, n weeks, 1 month, or 1 year.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "MonitorTimeSeriesDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "MonitorTimeSeriesDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class MonitorTimeSeriesDict(TypedDict, total=False):
+    """"""
+
+    timestamp_col: VariableOr[str]
+    """
+    Column for the timestamp.
+    """
+
+    granularities: VariableOrList[str]
+    """
+    Granularities for aggregating data into time windows based on their timestamp. Valid values are 5 minutes, 30 minutes, 1 hour, 1 day, n weeks, 1 month, or 1 year.
+    """
+
+
+MonitorTimeSeriesParam = MonitorTimeSeriesDict | MonitorTimeSeries
diff --git a/python/databricks/bundles/quality_monitors/_models/quality_monitor.py b/python/databricks/bundles/quality_monitors/_models/quality_monitor.py
new file mode 100644
index 00000000000..d2c22518503
--- /dev/null
+++ b/python/databricks/bundles/quality_monitors/_models/quality_monitor.py
@@ -0,0 +1,239 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._resource import Resource
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import (
+    VariableOr,
+    VariableOrList,
+    VariableOrOptional,
+)
+from databricks.bundles.quality_monitors._models.lifecycle import (
+    Lifecycle,
+    LifecycleParam,
+)
+from databricks.bundles.quality_monitors._models.monitor_cron_schedule import (
+    MonitorCronSchedule,
+    MonitorCronScheduleParam,
+)
+from databricks.bundles.quality_monitors._models.monitor_data_classification_config import (
+    MonitorDataClassificationConfig,
+    MonitorDataClassificationConfigParam,
+)
+from databricks.bundles.quality_monitors._models.monitor_inference_log import (
+    MonitorInferenceLog,
+    MonitorInferenceLogParam,
+)
+from databricks.bundles.quality_monitors._models.monitor_metric import (
+    MonitorMetric,
+    MonitorMetricParam,
+)
+from databricks.bundles.quality_monitors._models.monitor_notifications import (
+    MonitorNotifications,
+    MonitorNotificationsParam,
+)
+from databricks.bundles.quality_monitors._models.monitor_snapshot import (
+    MonitorSnapshot,
+    MonitorSnapshotParam,
+)
+from databricks.bundles.quality_monitors._models.monitor_time_series import (
+    MonitorTimeSeries,
+    MonitorTimeSeriesParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class QualityMonitor(Resource):
+    """"""
+
+    assets_dir: VariableOr[str]
+    """
+    [Create:REQ Update:IGN] Field for specifying the absolute path to a custom directory to store data-monitoring
+    assets. Normally prepopulated to a default user location via UI and Python APIs.
+    """
+
+    output_schema_name: VariableOr[str]
+    """
+    [Create:REQ Update:REQ] Schema where output tables are created. Needs to be in 2-level format {catalog}.{schema}
+    """
+
+    table_name: VariableOr[str]
+
+    baseline_table_name: VariableOrOptional[str] = None
+    """
+    [Create:OPT Update:OPT] Baseline table name.
+    Baseline data is used to compute drift from the data in the monitored `table_name`.
+    The baseline table and the monitored table shall have the same schema.
+    """
+
+    custom_metrics: VariableOrList[MonitorMetric] = field(default_factory=list)
+    """
+    [Create:OPT Update:OPT] Custom metrics.
+    """
+
+    data_classification_config: VariableOrOptional[MonitorDataClassificationConfig] = (
+        None
+    )
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] [Create:OPT Update:OPT] Data classification related config.
+    """
+
+    inference_log: VariableOrOptional[MonitorInferenceLog] = None
+
+    latest_monitor_failure_msg: VariableOrOptional[str] = None
+    """
+    [Create:ERR Update:IGN] The latest error message for a monitor failure.
+    """
+
+    lifecycle: VariableOrOptional[Lifecycle] = None
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+    notifications: VariableOrOptional[MonitorNotifications] = None
+    """
+    [Create:OPT Update:OPT] Field for specifying notification settings.
+    """
+
+    schedule: VariableOrOptional[MonitorCronSchedule] = None
+    """
+    [Create:OPT Update:OPT] The monitor schedule.
+    """
+
+    skip_builtin_dashboard: VariableOrOptional[bool] = None
+    """
+    Whether to skip creating a default dashboard summarizing data quality metrics.
+    """
+
+    slicing_exprs: VariableOrList[str] = field(default_factory=list)
+    """
+    [Create:OPT Update:OPT] List of column expressions to slice data with for targeted analysis. The data is grouped by
+    each expression independently, resulting in a separate slice for each predicate and its
+    complements. For example `slicing_exprs=[“col_1”, “col_2 > 10”]` will generate the following
+    slices: two slices for `col_2 > 10` (True and False), and one slice per unique value in
+    `col1`. For high-cardinality columns, only the top 100 unique values by frequency will
+    generate slices.
+    """
+
+    snapshot: VariableOrOptional[MonitorSnapshot] = None
+    """
+    Configuration for monitoring snapshot tables.
+    """
+
+    time_series: VariableOrOptional[MonitorTimeSeries] = None
+    """
+    Configuration for monitoring time series tables.
+    """
+
+    warehouse_id: VariableOrOptional[str] = None
+    """
+    Optional argument to specify the warehouse for dashboard creation. If not specified, the first running
+    warehouse will be used.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "QualityMonitorDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "QualityMonitorDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class QualityMonitorDict(TypedDict, total=False):
+    """"""
+
+    assets_dir: VariableOr[str]
+    """
+    [Create:REQ Update:IGN] Field for specifying the absolute path to a custom directory to store data-monitoring
+    assets. Normally prepopulated to a default user location via UI and Python APIs.
+    """
+
+    output_schema_name: VariableOr[str]
+    """
+    [Create:REQ Update:REQ] Schema where output tables are created. Needs to be in 2-level format {catalog}.{schema}
+    """
+
+    table_name: VariableOr[str]
+
+    baseline_table_name: VariableOrOptional[str]
+    """
+    [Create:OPT Update:OPT] Baseline table name.
+    Baseline data is used to compute drift from the data in the monitored `table_name`.
+    The baseline table and the monitored table shall have the same schema.
+    """
+
+    custom_metrics: VariableOrList[MonitorMetricParam]
+    """
+    [Create:OPT Update:OPT] Custom metrics.
+    """
+
+    data_classification_config: VariableOrOptional[MonitorDataClassificationConfigParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] [Create:OPT Update:OPT] Data classification related config.
+    """
+
+    inference_log: VariableOrOptional[MonitorInferenceLogParam]
+
+    latest_monitor_failure_msg: VariableOrOptional[str]
+    """
+    [Create:ERR Update:IGN] The latest error message for a monitor failure.
+    """
+
+    lifecycle: VariableOrOptional[LifecycleParam]
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+    notifications: VariableOrOptional[MonitorNotificationsParam]
+    """
+    [Create:OPT Update:OPT] Field for specifying notification settings.
+    """
+
+    schedule: VariableOrOptional[MonitorCronScheduleParam]
+    """
+    [Create:OPT Update:OPT] The monitor schedule.
+    """
+
+    skip_builtin_dashboard: VariableOrOptional[bool]
+    """
+    Whether to skip creating a default dashboard summarizing data quality metrics.
+    """
+
+    slicing_exprs: VariableOrList[str]
+    """
+    [Create:OPT Update:OPT] List of column expressions to slice data with for targeted analysis. The data is grouped by
+    each expression independently, resulting in a separate slice for each predicate and its
+    complements. For example `slicing_exprs=[“col_1”, “col_2 > 10”]` will generate the following
+    slices: two slices for `col_2 > 10` (True and False), and one slice per unique value in
+    `col1`. For high-cardinality columns, only the top 100 unique values by frequency will
+    generate slices.
+    """
+
+    snapshot: VariableOrOptional[MonitorSnapshotParam]
+    """
+    Configuration for monitoring snapshot tables.
+    """
+
+    time_series: VariableOrOptional[MonitorTimeSeriesParam]
+    """
+    Configuration for monitoring time series tables.
+    """
+
+    warehouse_id: VariableOrOptional[str]
+    """
+    Optional argument to specify the warehouse for dashboard creation. If not specified, the first running
+    warehouse will be used.
+    """
+
+
+QualityMonitorParam = QualityMonitorDict | QualityMonitor
diff --git a/python/databricks/bundles/registered_models/__init__.py b/python/databricks/bundles/registered_models/__init__.py
new file mode 100644
index 00000000000..a7ae3ba9ef3
--- /dev/null
+++ b/python/databricks/bundles/registered_models/__init__.py
@@ -0,0 +1,44 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+__all__ = [
+    "Lifecycle",
+    "LifecycleDict",
+    "LifecycleParam",
+    "Privilege",
+    "PrivilegeAssignment",
+    "PrivilegeAssignmentDict",
+    "PrivilegeAssignmentParam",
+    "PrivilegeParam",
+    "RegisteredModel",
+    "RegisteredModelAlias",
+    "RegisteredModelAliasDict",
+    "RegisteredModelAliasParam",
+    "RegisteredModelDict",
+    "RegisteredModelParam",
+]
+
+
+from databricks.bundles.registered_models._models.lifecycle import (
+    Lifecycle,
+    LifecycleDict,
+    LifecycleParam,
+)
+from databricks.bundles.registered_models._models.privilege import (
+    Privilege,
+    PrivilegeParam,
+)
+from databricks.bundles.registered_models._models.privilege_assignment import (
+    PrivilegeAssignment,
+    PrivilegeAssignmentDict,
+    PrivilegeAssignmentParam,
+)
+from databricks.bundles.registered_models._models.registered_model import (
+    RegisteredModel,
+    RegisteredModelDict,
+    RegisteredModelParam,
+)
+from databricks.bundles.registered_models._models.registered_model_alias import (
+    RegisteredModelAlias,
+    RegisteredModelAliasDict,
+    RegisteredModelAliasParam,
+)
diff --git a/python/databricks/bundles/registered_models/_models/lifecycle.py b/python/databricks/bundles/registered_models/_models/lifecycle.py
new file mode 100644
index 00000000000..697776a198e
--- /dev/null
+++ b/python/databricks/bundles/registered_models/_models/lifecycle.py
@@ -0,0 +1,40 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class Lifecycle:
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool] = None
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "LifecycleDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "LifecycleDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class LifecycleDict(TypedDict, total=False):
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool]
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+
+LifecycleParam = LifecycleDict | Lifecycle
diff --git a/python/databricks/bundles/registered_models/_models/privilege.py b/python/databricks/bundles/registered_models/_models/privilege.py
new file mode 100644
index 00000000000..df45211a76a
--- /dev/null
+++ b/python/databricks/bundles/registered_models/_models/privilege.py
@@ -0,0 +1,118 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class Privilege(Enum):
+    SELECT = "SELECT"
+    READ_PRIVATE_FILES = "READ_PRIVATE_FILES"
+    WRITE_PRIVATE_FILES = "WRITE_PRIVATE_FILES"
+    CREATE = "CREATE"
+    USAGE = "USAGE"
+    USE_CATALOG = "USE_CATALOG"
+    USE_SCHEMA = "USE_SCHEMA"
+    CREATE_SCHEMA = "CREATE_SCHEMA"
+    CREATE_VIEW = "CREATE_VIEW"
+    CREATE_EXTERNAL_TABLE = "CREATE_EXTERNAL_TABLE"
+    CREATE_MATERIALIZED_VIEW = "CREATE_MATERIALIZED_VIEW"
+    CREATE_FUNCTION = "CREATE_FUNCTION"
+    CREATE_MODEL = "CREATE_MODEL"
+    CREATE_CATALOG = "CREATE_CATALOG"
+    CREATE_MANAGED_STORAGE = "CREATE_MANAGED_STORAGE"
+    CREATE_EXTERNAL_LOCATION = "CREATE_EXTERNAL_LOCATION"
+    CREATE_STORAGE_CREDENTIAL = "CREATE_STORAGE_CREDENTIAL"
+    CREATE_SERVICE_CREDENTIAL = "CREATE_SERVICE_CREDENTIAL"
+    ACCESS = "ACCESS"
+    CREATE_SHARE = "CREATE_SHARE"
+    CREATE_RECIPIENT = "CREATE_RECIPIENT"
+    CREATE_PROVIDER = "CREATE_PROVIDER"
+    USE_SHARE = "USE_SHARE"
+    USE_RECIPIENT = "USE_RECIPIENT"
+    USE_PROVIDER = "USE_PROVIDER"
+    USE_MARKETPLACE_ASSETS = "USE_MARKETPLACE_ASSETS"
+    SET_SHARE_PERMISSION = "SET_SHARE_PERMISSION"
+    MODIFY = "MODIFY"
+    REFRESH = "REFRESH"
+    EXECUTE = "EXECUTE"
+    READ_FILES = "READ_FILES"
+    WRITE_FILES = "WRITE_FILES"
+    CREATE_TABLE = "CREATE_TABLE"
+    ALL_PRIVILEGES = "ALL_PRIVILEGES"
+    CREATE_CONNECTION = "CREATE_CONNECTION"
+    USE_CONNECTION = "USE_CONNECTION"
+    APPLY_TAG = "APPLY_TAG"
+    CREATE_FOREIGN_CATALOG = "CREATE_FOREIGN_CATALOG"
+    CREATE_FOREIGN_SECURABLE = "CREATE_FOREIGN_SECURABLE"
+    MANAGE_ALLOWLIST = "MANAGE_ALLOWLIST"
+    CREATE_VOLUME = "CREATE_VOLUME"
+    CREATE_EXTERNAL_VOLUME = "CREATE_EXTERNAL_VOLUME"
+    READ_VOLUME = "READ_VOLUME"
+    WRITE_VOLUME = "WRITE_VOLUME"
+    MANAGE = "MANAGE"
+    BROWSE = "BROWSE"
+    CREATE_CLEAN_ROOM = "CREATE_CLEAN_ROOM"
+    MODIFY_CLEAN_ROOM = "MODIFY_CLEAN_ROOM"
+    EXECUTE_CLEAN_ROOM_TASK = "EXECUTE_CLEAN_ROOM_TASK"
+    EXTERNAL_USE_SCHEMA = "EXTERNAL_USE_SCHEMA"
+    READ_METADATA = "READ_METADATA"
+    EXTERNAL_USE_LOCATION = "EXTERNAL_USE_LOCATION"
+
+
+PrivilegeParam = (
+    Literal[
+        "SELECT",
+        "READ_PRIVATE_FILES",
+        "WRITE_PRIVATE_FILES",
+        "CREATE",
+        "USAGE",
+        "USE_CATALOG",
+        "USE_SCHEMA",
+        "CREATE_SCHEMA",
+        "CREATE_VIEW",
+        "CREATE_EXTERNAL_TABLE",
+        "CREATE_MATERIALIZED_VIEW",
+        "CREATE_FUNCTION",
+        "CREATE_MODEL",
+        "CREATE_CATALOG",
+        "CREATE_MANAGED_STORAGE",
+        "CREATE_EXTERNAL_LOCATION",
+        "CREATE_STORAGE_CREDENTIAL",
+        "CREATE_SERVICE_CREDENTIAL",
+        "ACCESS",
+        "CREATE_SHARE",
+        "CREATE_RECIPIENT",
+        "CREATE_PROVIDER",
+        "USE_SHARE",
+        "USE_RECIPIENT",
+        "USE_PROVIDER",
+        "USE_MARKETPLACE_ASSETS",
+        "SET_SHARE_PERMISSION",
+        "MODIFY",
+        "REFRESH",
+        "EXECUTE",
+        "READ_FILES",
+        "WRITE_FILES",
+        "CREATE_TABLE",
+        "ALL_PRIVILEGES",
+        "CREATE_CONNECTION",
+        "USE_CONNECTION",
+        "APPLY_TAG",
+        "CREATE_FOREIGN_CATALOG",
+        "CREATE_FOREIGN_SECURABLE",
+        "MANAGE_ALLOWLIST",
+        "CREATE_VOLUME",
+        "CREATE_EXTERNAL_VOLUME",
+        "READ_VOLUME",
+        "WRITE_VOLUME",
+        "MANAGE",
+        "BROWSE",
+        "CREATE_CLEAN_ROOM",
+        "MODIFY_CLEAN_ROOM",
+        "EXECUTE_CLEAN_ROOM_TASK",
+        "EXTERNAL_USE_SCHEMA",
+        "READ_METADATA",
+        "EXTERNAL_USE_LOCATION",
+    ]
+    | Privilege
+)
diff --git a/python/databricks/bundles/registered_models/_models/privilege_assignment.py b/python/databricks/bundles/registered_models/_models/privilege_assignment.py
new file mode 100644
index 00000000000..10ef2d094f8
--- /dev/null
+++ b/python/databricks/bundles/registered_models/_models/privilege_assignment.py
@@ -0,0 +1,56 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
+from databricks.bundles.registered_models._models.privilege import (
+    Privilege,
+    PrivilegeParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class PrivilegeAssignment:
+    """"""
+
+    principal: VariableOrOptional[str] = None
+    """
+    The principal (user email address or group name).
+    For deleted principals, `principal` is empty while `principal_id` is populated.
+    """
+
+    privileges: VariableOrList[Privilege] = field(default_factory=list)
+    """
+    The privileges assigned to the principal.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "PrivilegeAssignmentDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "PrivilegeAssignmentDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class PrivilegeAssignmentDict(TypedDict, total=False):
+    """"""
+
+    principal: VariableOrOptional[str]
+    """
+    The principal (user email address or group name).
+    For deleted principals, `principal` is empty while `principal_id` is populated.
+    """
+
+    privileges: VariableOrList[PrivilegeParam]
+    """
+    The privileges assigned to the principal.
+    """
+
+
+PrivilegeAssignmentParam = PrivilegeAssignmentDict | PrivilegeAssignment
diff --git a/python/databricks/bundles/registered_models/_models/registered_model.py b/python/databricks/bundles/registered_models/_models/registered_model.py
new file mode 100644
index 00000000000..08cf2ea45ae
--- /dev/null
+++ b/python/databricks/bundles/registered_models/_models/registered_model.py
@@ -0,0 +1,193 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._resource import Resource
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
+from databricks.bundles.registered_models._models.lifecycle import (
+    Lifecycle,
+    LifecycleParam,
+)
+from databricks.bundles.registered_models._models.privilege_assignment import (
+    PrivilegeAssignment,
+    PrivilegeAssignmentParam,
+)
+from databricks.bundles.registered_models._models.registered_model_alias import (
+    RegisteredModelAlias,
+    RegisteredModelAliasParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class RegisteredModel(Resource):
+    """"""
+
+    aliases: VariableOrList[RegisteredModelAlias] = field(default_factory=list)
+    """
+    List of aliases associated with the registered model
+    """
+
+    catalog_name: VariableOrOptional[str] = None
+    """
+    The name of the catalog where the schema and the registered model reside
+    """
+
+    comment: VariableOrOptional[str] = None
+    """
+    The comment attached to the registered model
+    """
+
+    created_at: VariableOrOptional[int] = None
+    """
+    Creation timestamp of the registered model in milliseconds since the Unix epoch
+    """
+
+    created_by: VariableOrOptional[str] = None
+    """
+    The identifier of the user who created the registered model
+    """
+
+    full_name: VariableOrOptional[str] = None
+    """
+    The three-level (fully qualified) name of the registered model
+    """
+
+    grants: VariableOrList[PrivilegeAssignment] = field(default_factory=list)
+    """
+    The Unity Catalog privileges to grant to principals on this securable.
+    """
+
+    lifecycle: VariableOrOptional[Lifecycle] = None
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+    metastore_id: VariableOrOptional[str] = None
+    """
+    The unique identifier of the metastore
+    """
+
+    name: VariableOrOptional[str] = None
+    """
+    The name of the registered model
+    """
+
+    owner: VariableOrOptional[str] = None
+    """
+    The identifier of the user who owns the registered model
+    """
+
+    schema_name: VariableOrOptional[str] = None
+    """
+    The name of the schema where the registered model resides
+    """
+
+    storage_location: VariableOrOptional[str] = None
+    """
+    The storage location on the cloud under which model version data files are stored
+    """
+
+    updated_at: VariableOrOptional[int] = None
+    """
+    Last-update timestamp of the registered model in milliseconds since the Unix epoch
+    """
+
+    updated_by: VariableOrOptional[str] = None
+    """
+    The identifier of the user who updated the registered model last time
+    """
+
+    @classmethod
+    def from_dict(cls, value: "RegisteredModelDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "RegisteredModelDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class RegisteredModelDict(TypedDict, total=False):
+    """"""
+
+    aliases: VariableOrList[RegisteredModelAliasParam]
+    """
+    List of aliases associated with the registered model
+    """
+
+    catalog_name: VariableOrOptional[str]
+    """
+    The name of the catalog where the schema and the registered model reside
+    """
+
+    comment: VariableOrOptional[str]
+    """
+    The comment attached to the registered model
+    """
+
+    created_at: VariableOrOptional[int]
+    """
+    Creation timestamp of the registered model in milliseconds since the Unix epoch
+    """
+
+    created_by: VariableOrOptional[str]
+    """
+    The identifier of the user who created the registered model
+    """
+
+    full_name: VariableOrOptional[str]
+    """
+    The three-level (fully qualified) name of the registered model
+    """
+
+    grants: VariableOrList[PrivilegeAssignmentParam]
+    """
+    The Unity Catalog privileges to grant to principals on this securable.
+    """
+
+    lifecycle: VariableOrOptional[LifecycleParam]
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+    metastore_id: VariableOrOptional[str]
+    """
+    The unique identifier of the metastore
+    """
+
+    name: VariableOrOptional[str]
+    """
+    The name of the registered model
+    """
+
+    owner: VariableOrOptional[str]
+    """
+    The identifier of the user who owns the registered model
+    """
+
+    schema_name: VariableOrOptional[str]
+    """
+    The name of the schema where the registered model resides
+    """
+
+    storage_location: VariableOrOptional[str]
+    """
+    The storage location on the cloud under which model version data files are stored
+    """
+
+    updated_at: VariableOrOptional[int]
+    """
+    Last-update timestamp of the registered model in milliseconds since the Unix epoch
+    """
+
+    updated_by: VariableOrOptional[str]
+    """
+    The identifier of the user who updated the registered model last time
+    """
+
+
+RegisteredModelParam = RegisteredModelDict | RegisteredModel
diff --git a/python/databricks/bundles/registered_models/_models/registered_model_alias.py b/python/databricks/bundles/registered_models/_models/registered_model_alias.py
new file mode 100644
index 00000000000..f4ea570a9a6
--- /dev/null
+++ b/python/databricks/bundles/registered_models/_models/registered_model_alias.py
@@ -0,0 +1,90 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class RegisteredModelAlias:
+    """"""
+
+    alias_name: VariableOrOptional[str] = None
+    """
+    Name of the alias, e.g. 'champion' or 'latest_stable'
+    """
+
+    catalog_name: VariableOrOptional[str] = None
+    """
+    The name of the catalog containing the model version
+    """
+
+    id: VariableOrOptional[str] = None
+    """
+    The unique identifier of the alias
+    """
+
+    model_name: VariableOrOptional[str] = None
+    """
+    The name of the parent registered model of the model version, relative to parent schema
+    """
+
+    schema_name: VariableOrOptional[str] = None
+    """
+    The name of the schema containing the model version, relative to parent catalog
+    """
+
+    version_num: VariableOrOptional[int] = None
+    """
+    Integer version number of the model version to which this alias points.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "RegisteredModelAliasDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "RegisteredModelAliasDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class RegisteredModelAliasDict(TypedDict, total=False):
+    """"""
+
+    alias_name: VariableOrOptional[str]
+    """
+    Name of the alias, e.g. 'champion' or 'latest_stable'
+    """
+
+    catalog_name: VariableOrOptional[str]
+    """
+    The name of the catalog containing the model version
+    """
+
+    id: VariableOrOptional[str]
+    """
+    The unique identifier of the alias
+    """
+
+    model_name: VariableOrOptional[str]
+    """
+    The name of the parent registered model of the model version, relative to parent schema
+    """
+
+    schema_name: VariableOrOptional[str]
+    """
+    The name of the schema containing the model version, relative to parent catalog
+    """
+
+    version_num: VariableOrOptional[int]
+    """
+    Integer version number of the model version to which this alias points.
+    """
+
+
+RegisteredModelAliasParam = RegisteredModelAliasDict | RegisteredModelAlias
diff --git a/python/databricks/bundles/schemas/__init__.py b/python/databricks/bundles/schemas/__init__.py
index 11517faaab9..e891669012c 100644
--- a/python/databricks/bundles/schemas/__init__.py
+++ b/python/databricks/bundles/schemas/__init__.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 __all__ = [
     "Lifecycle",
     "LifecycleDict",
diff --git a/python/databricks/bundles/schemas/_models/lifecycle.py b/python/databricks/bundles/schemas/_models/lifecycle.py
index c934967f37e..697776a198e 100644
--- a/python/databricks/bundles/schemas/_models/lifecycle.py
+++ b/python/databricks/bundles/schemas/_models/lifecycle.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/schemas/_models/privilege.py b/python/databricks/bundles/schemas/_models/privilege.py
index 20f4e1f5573..df45211a76a 100644
--- a/python/databricks/bundles/schemas/_models/privilege.py
+++ b/python/databricks/bundles/schemas/_models/privilege.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
@@ -53,6 +55,8 @@ class Privilege(Enum):
     MODIFY_CLEAN_ROOM = "MODIFY_CLEAN_ROOM"
     EXECUTE_CLEAN_ROOM_TASK = "EXECUTE_CLEAN_ROOM_TASK"
     EXTERNAL_USE_SCHEMA = "EXTERNAL_USE_SCHEMA"
+    READ_METADATA = "READ_METADATA"
+    EXTERNAL_USE_LOCATION = "EXTERNAL_USE_LOCATION"
 
 
 PrivilegeParam = (
@@ -107,6 +111,8 @@ class Privilege(Enum):
         "MODIFY_CLEAN_ROOM",
         "EXECUTE_CLEAN_ROOM_TASK",
         "EXTERNAL_USE_SCHEMA",
+        "READ_METADATA",
+        "EXTERNAL_USE_LOCATION",
     ]
     | Privilege
 )
diff --git a/python/databricks/bundles/schemas/_models/privilege_assignment.py b/python/databricks/bundles/schemas/_models/privilege_assignment.py
index c60d5a82ecc..012fe5b3b59 100644
--- a/python/databricks/bundles/schemas/_models/privilege_assignment.py
+++ b/python/databricks/bundles/schemas/_models/privilege_assignment.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/schemas/_models/schema.py b/python/databricks/bundles/schemas/_models/schema.py
index d12385e3953..32ff22c8227 100644
--- a/python/databricks/bundles/schemas/_models/schema.py
+++ b/python/databricks/bundles/schemas/_models/schema.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
@@ -39,14 +41,25 @@ class Schema(Resource):
     User-provided free-form text description.
     """
 
+    custom_max_retention_hours: VariableOrOptional[int] = None
+    """
+    [Public Preview] Custom maximum retention period in hours for the schema.
+    """
+
     grants: VariableOrList[PrivilegeAssignment] = field(default_factory=list)
+    """
+    The Unity Catalog privileges to grant to principals on this securable.
+    """
 
     lifecycle: VariableOrOptional[Lifecycle] = None
     """
-    Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
     """
 
     properties: VariableOrDict[str] = field(default_factory=dict)
+    """
+    A map of key-value properties attached to the securable.
+    """
 
     storage_root: VariableOrOptional[str] = None
     """
@@ -79,14 +92,25 @@ class SchemaDict(TypedDict, total=False):
     User-provided free-form text description.
     """
 
+    custom_max_retention_hours: VariableOrOptional[int]
+    """
+    [Public Preview] Custom maximum retention period in hours for the schema.
+    """
+
     grants: VariableOrList[PrivilegeAssignmentParam]
+    """
+    The Unity Catalog privileges to grant to principals on this securable.
+    """
 
     lifecycle: VariableOrOptional[LifecycleParam]
     """
-    Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
     """
 
     properties: VariableOrDict[str]
+    """
+    A map of key-value properties attached to the securable.
+    """
 
     storage_root: VariableOrOptional[str]
     """
diff --git a/python/databricks/bundles/secret_scopes/__init__.py b/python/databricks/bundles/secret_scopes/__init__.py
new file mode 100644
index 00000000000..1f3d9c9555d
--- /dev/null
+++ b/python/databricks/bundles/secret_scopes/__init__.py
@@ -0,0 +1,50 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+__all__ = [
+    "AzureKeyVaultSecretScopeMetadata",
+    "AzureKeyVaultSecretScopeMetadataDict",
+    "AzureKeyVaultSecretScopeMetadataParam",
+    "Lifecycle",
+    "LifecycleDict",
+    "LifecycleParam",
+    "ScopeBackendType",
+    "ScopeBackendTypeParam",
+    "SecretScope",
+    "SecretScopeDict",
+    "SecretScopeParam",
+    "SecretScopePermission",
+    "SecretScopePermissionDict",
+    "SecretScopePermissionLevel",
+    "SecretScopePermissionLevelParam",
+    "SecretScopePermissionParam",
+]
+
+
+from databricks.bundles.secret_scopes._models.azure_key_vault_secret_scope_metadata import (
+    AzureKeyVaultSecretScopeMetadata,
+    AzureKeyVaultSecretScopeMetadataDict,
+    AzureKeyVaultSecretScopeMetadataParam,
+)
+from databricks.bundles.secret_scopes._models.lifecycle import (
+    Lifecycle,
+    LifecycleDict,
+    LifecycleParam,
+)
+from databricks.bundles.secret_scopes._models.scope_backend_type import (
+    ScopeBackendType,
+    ScopeBackendTypeParam,
+)
+from databricks.bundles.secret_scopes._models.secret_scope import (
+    SecretScope,
+    SecretScopeDict,
+    SecretScopeParam,
+)
+from databricks.bundles.secret_scopes._models.secret_scope_permission import (
+    SecretScopePermission,
+    SecretScopePermissionDict,
+    SecretScopePermissionParam,
+)
+from databricks.bundles.secret_scopes._models.secret_scope_permission_level import (
+    SecretScopePermissionLevel,
+    SecretScopePermissionLevelParam,
+)
diff --git a/python/databricks/bundles/secret_scopes/_models/azure_key_vault_secret_scope_metadata.py b/python/databricks/bundles/secret_scopes/_models/azure_key_vault_secret_scope_metadata.py
new file mode 100644
index 00000000000..ceedb8b2ec4
--- /dev/null
+++ b/python/databricks/bundles/secret_scopes/_models/azure_key_vault_secret_scope_metadata.py
@@ -0,0 +1,54 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class AzureKeyVaultSecretScopeMetadata:
+    """
+    The metadata of the Azure KeyVault for a secret scope of type `AZURE_KEYVAULT`
+    """
+
+    dns_name: VariableOr[str]
+    """
+    The DNS of the KeyVault
+    """
+
+    resource_id: VariableOr[str]
+    """
+    The resource id of the azure KeyVault that user wants to associate the scope with.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "AzureKeyVaultSecretScopeMetadataDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "AzureKeyVaultSecretScopeMetadataDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class AzureKeyVaultSecretScopeMetadataDict(TypedDict, total=False):
+    """"""
+
+    dns_name: VariableOr[str]
+    """
+    The DNS of the KeyVault
+    """
+
+    resource_id: VariableOr[str]
+    """
+    The resource id of the azure KeyVault that user wants to associate the scope with.
+    """
+
+
+AzureKeyVaultSecretScopeMetadataParam = (
+    AzureKeyVaultSecretScopeMetadataDict | AzureKeyVaultSecretScopeMetadata
+)
diff --git a/python/databricks/bundles/secret_scopes/_models/lifecycle.py b/python/databricks/bundles/secret_scopes/_models/lifecycle.py
new file mode 100644
index 00000000000..697776a198e
--- /dev/null
+++ b/python/databricks/bundles/secret_scopes/_models/lifecycle.py
@@ -0,0 +1,40 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class Lifecycle:
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool] = None
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "LifecycleDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "LifecycleDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class LifecycleDict(TypedDict, total=False):
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool]
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+
+LifecycleParam = LifecycleDict | Lifecycle
diff --git a/python/databricks/bundles/secret_scopes/_models/scope_backend_type.py b/python/databricks/bundles/secret_scopes/_models/scope_backend_type.py
new file mode 100644
index 00000000000..d95f7022d33
--- /dev/null
+++ b/python/databricks/bundles/secret_scopes/_models/scope_backend_type.py
@@ -0,0 +1,17 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class ScopeBackendType(Enum):
+    """
+    The types of secret scope backends in the Secret Manager. Azure KeyVault backed secret scopes
+    will be supported in a later release.
+    """
+
+    DATABRICKS = "DATABRICKS"
+    AZURE_KEYVAULT = "AZURE_KEYVAULT"
+
+
+ScopeBackendTypeParam = Literal["DATABRICKS", "AZURE_KEYVAULT"] | ScopeBackendType
diff --git a/python/databricks/bundles/secret_scopes/_models/secret_scope.py b/python/databricks/bundles/secret_scopes/_models/secret_scope.py
new file mode 100644
index 00000000000..5e436f1d247
--- /dev/null
+++ b/python/databricks/bundles/secret_scopes/_models/secret_scope.py
@@ -0,0 +1,98 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._resource import Resource
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import (
+    VariableOr,
+    VariableOrList,
+    VariableOrOptional,
+)
+from databricks.bundles.secret_scopes._models.azure_key_vault_secret_scope_metadata import (
+    AzureKeyVaultSecretScopeMetadata,
+    AzureKeyVaultSecretScopeMetadataParam,
+)
+from databricks.bundles.secret_scopes._models.lifecycle import Lifecycle, LifecycleParam
+from databricks.bundles.secret_scopes._models.scope_backend_type import (
+    ScopeBackendType,
+    ScopeBackendTypeParam,
+)
+from databricks.bundles.secret_scopes._models.secret_scope_permission import (
+    SecretScopePermission,
+    SecretScopePermissionParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class SecretScope(Resource):
+    """"""
+
+    name: VariableOr[str]
+    """
+    Scope name requested by the user. Scope names are unique.
+    """
+
+    backend_type: VariableOrOptional[ScopeBackendType] = None
+    """
+    The backend type the scope will be created with. If not specified, will default to `DATABRICKS`
+    """
+
+    keyvault_metadata: VariableOrOptional[AzureKeyVaultSecretScopeMetadata] = None
+    """
+    The metadata for the secret scope if the `backend_type` is `AZURE_KEYVAULT`
+    """
+
+    lifecycle: VariableOrOptional[Lifecycle] = None
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+    permissions: VariableOrList[SecretScopePermission] = field(default_factory=list)
+    """
+    The permissions to apply to the secret scope. Permissions are managed via secret scope ACLs.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "SecretScopeDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "SecretScopeDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class SecretScopeDict(TypedDict, total=False):
+    """"""
+
+    name: VariableOr[str]
+    """
+    Scope name requested by the user. Scope names are unique.
+    """
+
+    backend_type: VariableOrOptional[ScopeBackendTypeParam]
+    """
+    The backend type the scope will be created with. If not specified, will default to `DATABRICKS`
+    """
+
+    keyvault_metadata: VariableOrOptional[AzureKeyVaultSecretScopeMetadataParam]
+    """
+    The metadata for the secret scope if the `backend_type` is `AZURE_KEYVAULT`
+    """
+
+    lifecycle: VariableOrOptional[LifecycleParam]
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+    permissions: VariableOrList[SecretScopePermissionParam]
+    """
+    The permissions to apply to the secret scope. Permissions are managed via secret scope ACLs.
+    """
+
+
+SecretScopeParam = SecretScopeDict | SecretScope
diff --git a/python/databricks/bundles/secret_scopes/_models/secret_scope_permission.py b/python/databricks/bundles/secret_scopes/_models/secret_scope_permission.py
new file mode 100644
index 00000000000..3715039c411
--- /dev/null
+++ b/python/databricks/bundles/secret_scopes/_models/secret_scope_permission.py
@@ -0,0 +1,74 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+from databricks.bundles.secret_scopes._models.secret_scope_permission_level import (
+    SecretScopePermissionLevel,
+    SecretScopePermissionLevelParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class SecretScopePermission:
+    """"""
+
+    level: VariableOr[SecretScopePermissionLevel]
+    """
+    The permission level to apply. The allowed levels depend on the resource type.
+    """
+
+    group_name: VariableOrOptional[str] = None
+    """
+    The name of the group granted the permission level. This field translates to a `principal` field in secret scope ACL.
+    """
+
+    service_principal_name: VariableOrOptional[str] = None
+    """
+    The application ID of an active service principal. This field translates to a `principal` field in secret scope ACL.
+    """
+
+    user_name: VariableOrOptional[str] = None
+    """
+    The name of the user granted the permission level. This field translates to a `principal` field in secret scope ACL.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "SecretScopePermissionDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "SecretScopePermissionDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class SecretScopePermissionDict(TypedDict, total=False):
+    """"""
+
+    level: VariableOr[SecretScopePermissionLevelParam]
+    """
+    The permission level to apply. The allowed levels depend on the resource type.
+    """
+
+    group_name: VariableOrOptional[str]
+    """
+    The name of the group granted the permission level. This field translates to a `principal` field in secret scope ACL.
+    """
+
+    service_principal_name: VariableOrOptional[str]
+    """
+    The application ID of an active service principal. This field translates to a `principal` field in secret scope ACL.
+    """
+
+    user_name: VariableOrOptional[str]
+    """
+    The name of the user granted the permission level. This field translates to a `principal` field in secret scope ACL.
+    """
+
+
+SecretScopePermissionParam = SecretScopePermissionDict | SecretScopePermission
diff --git a/python/databricks/bundles/secret_scopes/_models/secret_scope_permission_level.py b/python/databricks/bundles/secret_scopes/_models/secret_scope_permission_level.py
new file mode 100644
index 00000000000..d7d84cd5854
--- /dev/null
+++ b/python/databricks/bundles/secret_scopes/_models/secret_scope_permission_level.py
@@ -0,0 +1,15 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class SecretScopePermissionLevel(Enum):
+    READ = "READ"
+    WRITE = "WRITE"
+    MANAGE = "MANAGE"
+
+
+SecretScopePermissionLevelParam = (
+    Literal["READ", "WRITE", "MANAGE"] | SecretScopePermissionLevel
+)
diff --git a/python/databricks/bundles/secrets/__init__.py b/python/databricks/bundles/secrets/__init__.py
new file mode 100644
index 00000000000..6bc14c2a19d
--- /dev/null
+++ b/python/databricks/bundles/secrets/__init__.py
@@ -0,0 +1,29 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+__all__ = [
+    "Lifecycle",
+    "LifecycleDict",
+    "LifecycleParam",
+    "Privilege",
+    "PrivilegeAssignment",
+    "PrivilegeAssignmentDict",
+    "PrivilegeAssignmentParam",
+    "PrivilegeParam",
+    "Secret",
+    "SecretDict",
+    "SecretParam",
+]
+
+
+from databricks.bundles.secrets._models.lifecycle import (
+    Lifecycle,
+    LifecycleDict,
+    LifecycleParam,
+)
+from databricks.bundles.secrets._models.privilege import Privilege, PrivilegeParam
+from databricks.bundles.secrets._models.privilege_assignment import (
+    PrivilegeAssignment,
+    PrivilegeAssignmentDict,
+    PrivilegeAssignmentParam,
+)
+from databricks.bundles.secrets._models.secret import Secret, SecretDict, SecretParam
diff --git a/python/databricks/bundles/secrets/_models/lifecycle.py b/python/databricks/bundles/secrets/_models/lifecycle.py
new file mode 100644
index 00000000000..697776a198e
--- /dev/null
+++ b/python/databricks/bundles/secrets/_models/lifecycle.py
@@ -0,0 +1,40 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class Lifecycle:
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool] = None
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "LifecycleDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "LifecycleDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class LifecycleDict(TypedDict, total=False):
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool]
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+
+LifecycleParam = LifecycleDict | Lifecycle
diff --git a/python/databricks/bundles/secrets/_models/privilege.py b/python/databricks/bundles/secrets/_models/privilege.py
new file mode 100644
index 00000000000..df45211a76a
--- /dev/null
+++ b/python/databricks/bundles/secrets/_models/privilege.py
@@ -0,0 +1,118 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class Privilege(Enum):
+    SELECT = "SELECT"
+    READ_PRIVATE_FILES = "READ_PRIVATE_FILES"
+    WRITE_PRIVATE_FILES = "WRITE_PRIVATE_FILES"
+    CREATE = "CREATE"
+    USAGE = "USAGE"
+    USE_CATALOG = "USE_CATALOG"
+    USE_SCHEMA = "USE_SCHEMA"
+    CREATE_SCHEMA = "CREATE_SCHEMA"
+    CREATE_VIEW = "CREATE_VIEW"
+    CREATE_EXTERNAL_TABLE = "CREATE_EXTERNAL_TABLE"
+    CREATE_MATERIALIZED_VIEW = "CREATE_MATERIALIZED_VIEW"
+    CREATE_FUNCTION = "CREATE_FUNCTION"
+    CREATE_MODEL = "CREATE_MODEL"
+    CREATE_CATALOG = "CREATE_CATALOG"
+    CREATE_MANAGED_STORAGE = "CREATE_MANAGED_STORAGE"
+    CREATE_EXTERNAL_LOCATION = "CREATE_EXTERNAL_LOCATION"
+    CREATE_STORAGE_CREDENTIAL = "CREATE_STORAGE_CREDENTIAL"
+    CREATE_SERVICE_CREDENTIAL = "CREATE_SERVICE_CREDENTIAL"
+    ACCESS = "ACCESS"
+    CREATE_SHARE = "CREATE_SHARE"
+    CREATE_RECIPIENT = "CREATE_RECIPIENT"
+    CREATE_PROVIDER = "CREATE_PROVIDER"
+    USE_SHARE = "USE_SHARE"
+    USE_RECIPIENT = "USE_RECIPIENT"
+    USE_PROVIDER = "USE_PROVIDER"
+    USE_MARKETPLACE_ASSETS = "USE_MARKETPLACE_ASSETS"
+    SET_SHARE_PERMISSION = "SET_SHARE_PERMISSION"
+    MODIFY = "MODIFY"
+    REFRESH = "REFRESH"
+    EXECUTE = "EXECUTE"
+    READ_FILES = "READ_FILES"
+    WRITE_FILES = "WRITE_FILES"
+    CREATE_TABLE = "CREATE_TABLE"
+    ALL_PRIVILEGES = "ALL_PRIVILEGES"
+    CREATE_CONNECTION = "CREATE_CONNECTION"
+    USE_CONNECTION = "USE_CONNECTION"
+    APPLY_TAG = "APPLY_TAG"
+    CREATE_FOREIGN_CATALOG = "CREATE_FOREIGN_CATALOG"
+    CREATE_FOREIGN_SECURABLE = "CREATE_FOREIGN_SECURABLE"
+    MANAGE_ALLOWLIST = "MANAGE_ALLOWLIST"
+    CREATE_VOLUME = "CREATE_VOLUME"
+    CREATE_EXTERNAL_VOLUME = "CREATE_EXTERNAL_VOLUME"
+    READ_VOLUME = "READ_VOLUME"
+    WRITE_VOLUME = "WRITE_VOLUME"
+    MANAGE = "MANAGE"
+    BROWSE = "BROWSE"
+    CREATE_CLEAN_ROOM = "CREATE_CLEAN_ROOM"
+    MODIFY_CLEAN_ROOM = "MODIFY_CLEAN_ROOM"
+    EXECUTE_CLEAN_ROOM_TASK = "EXECUTE_CLEAN_ROOM_TASK"
+    EXTERNAL_USE_SCHEMA = "EXTERNAL_USE_SCHEMA"
+    READ_METADATA = "READ_METADATA"
+    EXTERNAL_USE_LOCATION = "EXTERNAL_USE_LOCATION"
+
+
+PrivilegeParam = (
+    Literal[
+        "SELECT",
+        "READ_PRIVATE_FILES",
+        "WRITE_PRIVATE_FILES",
+        "CREATE",
+        "USAGE",
+        "USE_CATALOG",
+        "USE_SCHEMA",
+        "CREATE_SCHEMA",
+        "CREATE_VIEW",
+        "CREATE_EXTERNAL_TABLE",
+        "CREATE_MATERIALIZED_VIEW",
+        "CREATE_FUNCTION",
+        "CREATE_MODEL",
+        "CREATE_CATALOG",
+        "CREATE_MANAGED_STORAGE",
+        "CREATE_EXTERNAL_LOCATION",
+        "CREATE_STORAGE_CREDENTIAL",
+        "CREATE_SERVICE_CREDENTIAL",
+        "ACCESS",
+        "CREATE_SHARE",
+        "CREATE_RECIPIENT",
+        "CREATE_PROVIDER",
+        "USE_SHARE",
+        "USE_RECIPIENT",
+        "USE_PROVIDER",
+        "USE_MARKETPLACE_ASSETS",
+        "SET_SHARE_PERMISSION",
+        "MODIFY",
+        "REFRESH",
+        "EXECUTE",
+        "READ_FILES",
+        "WRITE_FILES",
+        "CREATE_TABLE",
+        "ALL_PRIVILEGES",
+        "CREATE_CONNECTION",
+        "USE_CONNECTION",
+        "APPLY_TAG",
+        "CREATE_FOREIGN_CATALOG",
+        "CREATE_FOREIGN_SECURABLE",
+        "MANAGE_ALLOWLIST",
+        "CREATE_VOLUME",
+        "CREATE_EXTERNAL_VOLUME",
+        "READ_VOLUME",
+        "WRITE_VOLUME",
+        "MANAGE",
+        "BROWSE",
+        "CREATE_CLEAN_ROOM",
+        "MODIFY_CLEAN_ROOM",
+        "EXECUTE_CLEAN_ROOM_TASK",
+        "EXTERNAL_USE_SCHEMA",
+        "READ_METADATA",
+        "EXTERNAL_USE_LOCATION",
+    ]
+    | Privilege
+)
diff --git a/python/databricks/bundles/secrets/_models/privilege_assignment.py b/python/databricks/bundles/secrets/_models/privilege_assignment.py
new file mode 100644
index 00000000000..443fa0120c7
--- /dev/null
+++ b/python/databricks/bundles/secrets/_models/privilege_assignment.py
@@ -0,0 +1,53 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
+from databricks.bundles.secrets._models.privilege import Privilege, PrivilegeParam
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class PrivilegeAssignment:
+    """"""
+
+    principal: VariableOrOptional[str] = None
+    """
+    The principal (user email address or group name).
+    For deleted principals, `principal` is empty while `principal_id` is populated.
+    """
+
+    privileges: VariableOrList[Privilege] = field(default_factory=list)
+    """
+    The privileges assigned to the principal.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "PrivilegeAssignmentDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "PrivilegeAssignmentDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class PrivilegeAssignmentDict(TypedDict, total=False):
+    """"""
+
+    principal: VariableOrOptional[str]
+    """
+    The principal (user email address or group name).
+    For deleted principals, `principal` is empty while `principal_id` is populated.
+    """
+
+    privileges: VariableOrList[PrivilegeParam]
+    """
+    The privileges assigned to the principal.
+    """
+
+
+PrivilegeAssignmentParam = PrivilegeAssignmentDict | PrivilegeAssignment
diff --git a/python/databricks/bundles/secrets/_models/secret.py b/python/databricks/bundles/secrets/_models/secret.py
new file mode 100644
index 00000000000..b0db4c03ada
--- /dev/null
+++ b/python/databricks/bundles/secrets/_models/secret.py
@@ -0,0 +1,136 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._resource import Resource
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import (
+    VariableOr,
+    VariableOrList,
+    VariableOrOptional,
+)
+from databricks.bundles.secrets._models.lifecycle import Lifecycle, LifecycleParam
+from databricks.bundles.secrets._models.privilege_assignment import (
+    PrivilegeAssignment,
+    PrivilegeAssignmentParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class Secret(Resource):
+    """
+    A secret stored in Unity Catalog. Secrets are three-level namespace objects
+    (catalog.schema.secret) that securely store sensitive credential data such as
+    passwords, tokens, and keys.
+    """
+
+    catalog_name: VariableOr[str]
+    """
+    The name of the catalog where the schema and the secret reside.
+    """
+
+    name: VariableOr[str]
+    """
+    The name of the secret, relative to its parent schema.
+    """
+
+    schema_name: VariableOr[str]
+    """
+    The name of the schema where the secret resides.
+    """
+
+    value: VariableOr[str]
+    """
+    The secret value to store. Must be a variable reference (e.g. ${var.my_secret}) to prevent plain-text secrets in configuration files.
+    """
+
+    comment: VariableOrOptional[str] = None
+    """
+    User-provided free-form text description of the secret.
+    """
+
+    expire_time: VariableOrOptional[str] = None
+    """
+    User-provided expiration time of the secret. Purely informational; does not trigger automatic actions.
+    """
+
+    grants: VariableOrList[PrivilegeAssignment] = field(default_factory=list)
+    """
+    The grants to apply on this secret.
+    """
+
+    lifecycle: VariableOrOptional[Lifecycle] = None
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+    owner: VariableOrOptional[str] = None
+    """
+    The owner of the secret. Defaults to the creating principal on creation. Can be updated to
+    transfer ownership of the secret to another principal.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "SecretDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "SecretDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class SecretDict(TypedDict, total=False):
+    """"""
+
+    catalog_name: VariableOr[str]
+    """
+    The name of the catalog where the schema and the secret reside.
+    """
+
+    name: VariableOr[str]
+    """
+    The name of the secret, relative to its parent schema.
+    """
+
+    schema_name: VariableOr[str]
+    """
+    The name of the schema where the secret resides.
+    """
+
+    value: VariableOr[str]
+    """
+    The secret value to store. Must be a variable reference (e.g. ${var.my_secret}) to prevent plain-text secrets in configuration files.
+    """
+
+    comment: VariableOrOptional[str]
+    """
+    User-provided free-form text description of the secret.
+    """
+
+    expire_time: VariableOrOptional[str]
+    """
+    User-provided expiration time of the secret. Purely informational; does not trigger automatic actions.
+    """
+
+    grants: VariableOrList[PrivilegeAssignmentParam]
+    """
+    The grants to apply on this secret.
+    """
+
+    lifecycle: VariableOrOptional[LifecycleParam]
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+    owner: VariableOrOptional[str]
+    """
+    The owner of the secret. Defaults to the creating principal on creation. Can be updated to
+    transfer ownership of the secret to another principal.
+    """
+
+
+SecretParam = SecretDict | Secret
diff --git a/python/databricks/bundles/sql_warehouses/__init__.py b/python/databricks/bundles/sql_warehouses/__init__.py
new file mode 100644
index 00000000000..4866d2ca86e
--- /dev/null
+++ b/python/databricks/bundles/sql_warehouses/__init__.py
@@ -0,0 +1,78 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+__all__ = [
+    "Channel",
+    "ChannelDict",
+    "ChannelName",
+    "ChannelNameParam",
+    "ChannelParam",
+    "CreateWarehouseRequestWarehouseType",
+    "CreateWarehouseRequestWarehouseTypeParam",
+    "EndpointTagPair",
+    "EndpointTagPairDict",
+    "EndpointTagPairParam",
+    "EndpointTags",
+    "EndpointTagsDict",
+    "EndpointTagsParam",
+    "LifecycleWithStarted",
+    "LifecycleWithStartedDict",
+    "LifecycleWithStartedParam",
+    "SpotInstancePolicy",
+    "SpotInstancePolicyParam",
+    "SqlWarehouse",
+    "SqlWarehouseDict",
+    "SqlWarehouseParam",
+    "SqlWarehousePermission",
+    "SqlWarehousePermissionDict",
+    "SqlWarehousePermissionParam",
+    "WarehousePermissionLevel",
+    "WarehousePermissionLevelParam",
+]
+
+
+from databricks.bundles.sql_warehouses._models.channel import (
+    Channel,
+    ChannelDict,
+    ChannelParam,
+)
+from databricks.bundles.sql_warehouses._models.channel_name import (
+    ChannelName,
+    ChannelNameParam,
+)
+from databricks.bundles.sql_warehouses._models.create_warehouse_request_warehouse_type import (
+    CreateWarehouseRequestWarehouseType,
+    CreateWarehouseRequestWarehouseTypeParam,
+)
+from databricks.bundles.sql_warehouses._models.endpoint_tag_pair import (
+    EndpointTagPair,
+    EndpointTagPairDict,
+    EndpointTagPairParam,
+)
+from databricks.bundles.sql_warehouses._models.endpoint_tags import (
+    EndpointTags,
+    EndpointTagsDict,
+    EndpointTagsParam,
+)
+from databricks.bundles.sql_warehouses._models.lifecycle_with_started import (
+    LifecycleWithStarted,
+    LifecycleWithStartedDict,
+    LifecycleWithStartedParam,
+)
+from databricks.bundles.sql_warehouses._models.spot_instance_policy import (
+    SpotInstancePolicy,
+    SpotInstancePolicyParam,
+)
+from databricks.bundles.sql_warehouses._models.sql_warehouse import (
+    SqlWarehouse,
+    SqlWarehouseDict,
+    SqlWarehouseParam,
+)
+from databricks.bundles.sql_warehouses._models.sql_warehouse_permission import (
+    SqlWarehousePermission,
+    SqlWarehousePermissionDict,
+    SqlWarehousePermissionParam,
+)
+from databricks.bundles.sql_warehouses._models.warehouse_permission_level import (
+    WarehousePermissionLevel,
+    WarehousePermissionLevelParam,
+)
diff --git a/python/databricks/bundles/sql_warehouses/_models/channel.py b/python/databricks/bundles/sql_warehouses/_models/channel.py
new file mode 100644
index 00000000000..f5893d7273f
--- /dev/null
+++ b/python/databricks/bundles/sql_warehouses/_models/channel.py
@@ -0,0 +1,44 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+from databricks.bundles.sql_warehouses._models.channel_name import (
+    ChannelName,
+    ChannelNameParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class Channel:
+    """
+    Configures the channel name and DBSQL version of the warehouse. CHANNEL_NAME_CUSTOM should be chosen only when `dbsql_version` is specified.
+    """
+
+    dbsql_version: VariableOrOptional[str] = None
+
+    name: VariableOrOptional[ChannelName] = None
+
+    @classmethod
+    def from_dict(cls, value: "ChannelDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "ChannelDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class ChannelDict(TypedDict, total=False):
+    """"""
+
+    dbsql_version: VariableOrOptional[str]
+
+    name: VariableOrOptional[ChannelNameParam]
+
+
+ChannelParam = ChannelDict | Channel
diff --git a/python/databricks/bundles/sql_warehouses/_models/channel_name.py b/python/databricks/bundles/sql_warehouses/_models/channel_name.py
new file mode 100644
index 00000000000..a47e1c890f4
--- /dev/null
+++ b/python/databricks/bundles/sql_warehouses/_models/channel_name.py
@@ -0,0 +1,22 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class ChannelName(Enum):
+    CHANNEL_NAME_PREVIEW = "CHANNEL_NAME_PREVIEW"
+    CHANNEL_NAME_CURRENT = "CHANNEL_NAME_CURRENT"
+    CHANNEL_NAME_PREVIOUS = "CHANNEL_NAME_PREVIOUS"
+    CHANNEL_NAME_CUSTOM = "CHANNEL_NAME_CUSTOM"
+
+
+ChannelNameParam = (
+    Literal[
+        "CHANNEL_NAME_PREVIEW",
+        "CHANNEL_NAME_CURRENT",
+        "CHANNEL_NAME_PREVIOUS",
+        "CHANNEL_NAME_CUSTOM",
+    ]
+    | ChannelName
+)
diff --git a/python/databricks/bundles/sql_warehouses/_models/create_warehouse_request_warehouse_type.py b/python/databricks/bundles/sql_warehouses/_models/create_warehouse_request_warehouse_type.py
new file mode 100644
index 00000000000..feb20fbbbee
--- /dev/null
+++ b/python/databricks/bundles/sql_warehouses/_models/create_warehouse_request_warehouse_type.py
@@ -0,0 +1,17 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class CreateWarehouseRequestWarehouseType(Enum):
+    TYPE_UNSPECIFIED = "TYPE_UNSPECIFIED"
+    CLASSIC = "CLASSIC"
+    PRO = "PRO"
+    REALTIME = "REALTIME"
+
+
+CreateWarehouseRequestWarehouseTypeParam = (
+    Literal["TYPE_UNSPECIFIED", "CLASSIC", "PRO", "REALTIME"]
+    | CreateWarehouseRequestWarehouseType
+)
diff --git a/python/databricks/bundles/sql_warehouses/_models/endpoint_tag_pair.py b/python/databricks/bundles/sql_warehouses/_models/endpoint_tag_pair.py
new file mode 100644
index 00000000000..45f4d904d1e
--- /dev/null
+++ b/python/databricks/bundles/sql_warehouses/_models/endpoint_tag_pair.py
@@ -0,0 +1,38 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class EndpointTagPair:
+    """"""
+
+    key: VariableOrOptional[str] = None
+
+    value: VariableOrOptional[str] = None
+
+    @classmethod
+    def from_dict(cls, value: "EndpointTagPairDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "EndpointTagPairDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class EndpointTagPairDict(TypedDict, total=False):
+    """"""
+
+    key: VariableOrOptional[str]
+
+    value: VariableOrOptional[str]
+
+
+EndpointTagPairParam = EndpointTagPairDict | EndpointTagPair
diff --git a/python/databricks/bundles/sql_warehouses/_models/endpoint_tags.py b/python/databricks/bundles/sql_warehouses/_models/endpoint_tags.py
new file mode 100644
index 00000000000..7d70c86199d
--- /dev/null
+++ b/python/databricks/bundles/sql_warehouses/_models/endpoint_tags.py
@@ -0,0 +1,38 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList
+from databricks.bundles.sql_warehouses._models.endpoint_tag_pair import (
+    EndpointTagPair,
+    EndpointTagPairParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class EndpointTags:
+    """"""
+
+    custom_tags: VariableOrList[EndpointTagPair] = field(default_factory=list)
+
+    @classmethod
+    def from_dict(cls, value: "EndpointTagsDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "EndpointTagsDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class EndpointTagsDict(TypedDict, total=False):
+    """"""
+
+    custom_tags: VariableOrList[EndpointTagPairParam]
+
+
+EndpointTagsParam = EndpointTagsDict | EndpointTags
diff --git a/python/databricks/bundles/sql_warehouses/_models/lifecycle_with_started.py b/python/databricks/bundles/sql_warehouses/_models/lifecycle_with_started.py
new file mode 100644
index 00000000000..f9cb9b8d49c
--- /dev/null
+++ b/python/databricks/bundles/sql_warehouses/_models/lifecycle_with_started.py
@@ -0,0 +1,50 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class LifecycleWithStarted:
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool] = None
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+    started: VariableOrOptional[bool] = None
+    """
+    Lifecycle setting to deploy the resource in started mode. Only supported for apps, clusters, and sql_warehouses.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "LifecycleWithStartedDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "LifecycleWithStartedDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class LifecycleWithStartedDict(TypedDict, total=False):
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool]
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+    started: VariableOrOptional[bool]
+    """
+    Lifecycle setting to deploy the resource in started mode. Only supported for apps, clusters, and sql_warehouses.
+    """
+
+
+LifecycleWithStartedParam = LifecycleWithStartedDict | LifecycleWithStarted
diff --git a/python/databricks/bundles/sql_warehouses/_models/spot_instance_policy.py b/python/databricks/bundles/sql_warehouses/_models/spot_instance_policy.py
new file mode 100644
index 00000000000..e0d5105a95f
--- /dev/null
+++ b/python/databricks/bundles/sql_warehouses/_models/spot_instance_policy.py
@@ -0,0 +1,29 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class SpotInstancePolicy(Enum):
+    """
+    EndpointSpotInstancePolicy configures whether the endpoint should use spot
+    instances.
+
+    The breakdown of how the EndpointSpotInstancePolicy converts to per cloud
+    configurations is:
+
+    - AWS, COST_OPTIMIZED: On Demand Driver with Spot Executors.
+    - AWS, RELIABILITY_OPTIMIZED: On Demand Driver and Executors.
+    - AZURE, COST_OPTIMIZED: On Demand Driver and Executors.
+    - AZURE, RELIABILITY_OPTIMIZED: On Demand Driver and Executors.
+    """
+
+    POLICY_UNSPECIFIED = "POLICY_UNSPECIFIED"
+    COST_OPTIMIZED = "COST_OPTIMIZED"
+    RELIABILITY_OPTIMIZED = "RELIABILITY_OPTIMIZED"
+
+
+SpotInstancePolicyParam = (
+    Literal["POLICY_UNSPECIFIED", "COST_OPTIMIZED", "RELIABILITY_OPTIMIZED"]
+    | SpotInstancePolicy
+)
diff --git a/python/databricks/bundles/sql_warehouses/_models/sql_warehouse.py b/python/databricks/bundles/sql_warehouses/_models/sql_warehouse.py
new file mode 100644
index 00000000000..3fe07aeadbe
--- /dev/null
+++ b/python/databricks/bundles/sql_warehouses/_models/sql_warehouse.py
@@ -0,0 +1,318 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._resource import Resource
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
+from databricks.bundles.sql_warehouses._models.channel import Channel, ChannelParam
+from databricks.bundles.sql_warehouses._models.create_warehouse_request_warehouse_type import (
+    CreateWarehouseRequestWarehouseType,
+    CreateWarehouseRequestWarehouseTypeParam,
+)
+from databricks.bundles.sql_warehouses._models.endpoint_tags import (
+    EndpointTags,
+    EndpointTagsParam,
+)
+from databricks.bundles.sql_warehouses._models.lifecycle_with_started import (
+    LifecycleWithStarted,
+    LifecycleWithStartedParam,
+)
+from databricks.bundles.sql_warehouses._models.spot_instance_policy import (
+    SpotInstancePolicy,
+    SpotInstancePolicyParam,
+)
+from databricks.bundles.sql_warehouses._models.sql_warehouse_permission import (
+    SqlWarehousePermission,
+    SqlWarehousePermissionParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class SqlWarehouse(Resource):
+    """
+    Creates a new SQL warehouse.
+    """
+
+    auto_stop_mins: VariableOrOptional[int] = None
+    """
+    The amount of time in minutes that a SQL warehouse must be idle (i.e., no
+    RUNNING queries) before it is automatically stopped.
+    
+    Supported values:
+    - Must be == 0 or >= 10 mins
+    - 0 indicates no autostop.
+    
+    Defaults to 120 mins
+    """
+
+    channel: VariableOrOptional[Channel] = None
+    """
+    Channel Details
+    """
+
+    cluster_size: VariableOrOptional[str] = None
+    """
+    Size of the clusters allocated for this warehouse.
+    Increasing the size of a spark cluster allows you to run larger queries on
+    it. If you want to increase the number of concurrent queries, please tune
+    max_num_clusters.
+    
+    Supported values:
+    - 2X-Small
+    - X-Small
+    - Small
+    - Medium
+    - Large
+    - X-Large
+    - 2X-Large
+    - 3X-Large
+    - 4X-Large
+    - 5X-Large
+    """
+
+    creator_name: VariableOrOptional[str] = None
+    """
+    warehouse creator name
+    """
+
+    enable_photon: VariableOrOptional[bool] = None
+    """
+    Configures whether the warehouse should use Photon optimized clusters.
+    
+    Defaults to true.
+    """
+
+    enable_serverless_compute: VariableOrOptional[bool] = None
+    """
+    Configures whether the warehouse should use serverless compute
+    """
+
+    instance_profile_arn: VariableOrOptional[str] = None
+    """
+    [DEPRECATED] Deprecated. Instance profile used to pass IAM role to the cluster
+    """
+
+    lifecycle: VariableOrOptional[LifecycleWithStarted] = None
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+    max_num_clusters: VariableOrOptional[int] = None
+    """
+    Maximum number of clusters that the autoscaler will create to handle
+    concurrent queries.
+    
+    Supported values:
+    - Must be >= min_num_clusters
+    - Must be <= 40.
+    
+    Defaults to min_clusters if unset.
+    """
+
+    min_num_clusters: VariableOrOptional[int] = None
+    """
+    Minimum number of available clusters that will be maintained for this SQL
+    warehouse. Increasing this will ensure that a larger number of clusters are
+    always running and therefore may reduce the cold start time for new
+    queries. This is similar to reserved vs. revocable cores in a resource
+    manager.
+    
+    Supported values:
+    - Must be > 0
+    - Must be <= min(max_num_clusters, 30)
+    
+    Defaults to 1
+    """
+
+    name: VariableOrOptional[str] = None
+    """
+    Logical name for the cluster.
+    
+    Supported values:
+    - Must be unique within an org.
+    - Must be less than 100 characters.
+    """
+
+    permissions: VariableOrList[SqlWarehousePermission] = field(default_factory=list)
+    """
+    The permissions to apply to this resource.
+    """
+
+    spot_instance_policy: VariableOrOptional[SpotInstancePolicy] = None
+    """
+    Configurations whether the endpoint should use spot instances.
+    """
+
+    statement_timeout: VariableOrOptional[int] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Warehouse statement timeout in seconds.
+    """
+
+    tags: VariableOrOptional[EndpointTags] = None
+    """
+    A set of key-value pairs that will be tagged on all resources (e.g., AWS instances and EBS volumes) associated
+    with this SQL warehouse.
+    
+    Supported values:
+    - Number of tags < 45.
+    """
+
+    warehouse_type: VariableOrOptional[CreateWarehouseRequestWarehouseType] = None
+    """
+    Warehouse type: `PRO` or `CLASSIC`. If you want to use serverless compute,
+    you must set to `PRO` and also set the field `enable_serverless_compute` to `true`.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "SqlWarehouseDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "SqlWarehouseDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class SqlWarehouseDict(TypedDict, total=False):
+    """"""
+
+    auto_stop_mins: VariableOrOptional[int]
+    """
+    The amount of time in minutes that a SQL warehouse must be idle (i.e., no
+    RUNNING queries) before it is automatically stopped.
+    
+    Supported values:
+    - Must be == 0 or >= 10 mins
+    - 0 indicates no autostop.
+    
+    Defaults to 120 mins
+    """
+
+    channel: VariableOrOptional[ChannelParam]
+    """
+    Channel Details
+    """
+
+    cluster_size: VariableOrOptional[str]
+    """
+    Size of the clusters allocated for this warehouse.
+    Increasing the size of a spark cluster allows you to run larger queries on
+    it. If you want to increase the number of concurrent queries, please tune
+    max_num_clusters.
+    
+    Supported values:
+    - 2X-Small
+    - X-Small
+    - Small
+    - Medium
+    - Large
+    - X-Large
+    - 2X-Large
+    - 3X-Large
+    - 4X-Large
+    - 5X-Large
+    """
+
+    creator_name: VariableOrOptional[str]
+    """
+    warehouse creator name
+    """
+
+    enable_photon: VariableOrOptional[bool]
+    """
+    Configures whether the warehouse should use Photon optimized clusters.
+    
+    Defaults to true.
+    """
+
+    enable_serverless_compute: VariableOrOptional[bool]
+    """
+    Configures whether the warehouse should use serverless compute
+    """
+
+    instance_profile_arn: VariableOrOptional[str]
+    """
+    [DEPRECATED] Deprecated. Instance profile used to pass IAM role to the cluster
+    """
+
+    lifecycle: VariableOrOptional[LifecycleWithStartedParam]
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+    max_num_clusters: VariableOrOptional[int]
+    """
+    Maximum number of clusters that the autoscaler will create to handle
+    concurrent queries.
+    
+    Supported values:
+    - Must be >= min_num_clusters
+    - Must be <= 40.
+    
+    Defaults to min_clusters if unset.
+    """
+
+    min_num_clusters: VariableOrOptional[int]
+    """
+    Minimum number of available clusters that will be maintained for this SQL
+    warehouse. Increasing this will ensure that a larger number of clusters are
+    always running and therefore may reduce the cold start time for new
+    queries. This is similar to reserved vs. revocable cores in a resource
+    manager.
+    
+    Supported values:
+    - Must be > 0
+    - Must be <= min(max_num_clusters, 30)
+    
+    Defaults to 1
+    """
+
+    name: VariableOrOptional[str]
+    """
+    Logical name for the cluster.
+    
+    Supported values:
+    - Must be unique within an org.
+    - Must be less than 100 characters.
+    """
+
+    permissions: VariableOrList[SqlWarehousePermissionParam]
+    """
+    The permissions to apply to this resource.
+    """
+
+    spot_instance_policy: VariableOrOptional[SpotInstancePolicyParam]
+    """
+    Configurations whether the endpoint should use spot instances.
+    """
+
+    statement_timeout: VariableOrOptional[int]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Warehouse statement timeout in seconds.
+    """
+
+    tags: VariableOrOptional[EndpointTagsParam]
+    """
+    A set of key-value pairs that will be tagged on all resources (e.g., AWS instances and EBS volumes) associated
+    with this SQL warehouse.
+    
+    Supported values:
+    - Number of tags < 45.
+    """
+
+    warehouse_type: VariableOrOptional[CreateWarehouseRequestWarehouseTypeParam]
+    """
+    Warehouse type: `PRO` or `CLASSIC`. If you want to use serverless compute,
+    you must set to `PRO` and also set the field `enable_serverless_compute` to `true`.
+    """
+
+
+SqlWarehouseParam = SqlWarehouseDict | SqlWarehouse
diff --git a/python/databricks/bundles/sql_warehouses/_models/sql_warehouse_permission.py b/python/databricks/bundles/sql_warehouses/_models/sql_warehouse_permission.py
new file mode 100644
index 00000000000..2c9f284a2c0
--- /dev/null
+++ b/python/databricks/bundles/sql_warehouses/_models/sql_warehouse_permission.py
@@ -0,0 +1,74 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+from databricks.bundles.sql_warehouses._models.warehouse_permission_level import (
+    WarehousePermissionLevel,
+    WarehousePermissionLevelParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class SqlWarehousePermission:
+    """"""
+
+    level: VariableOr[WarehousePermissionLevel]
+    """
+    The permission level to apply. The allowed levels depend on the resource type.
+    """
+
+    group_name: VariableOrOptional[str] = None
+    """
+    The name of the group granted the permission level.
+    """
+
+    service_principal_name: VariableOrOptional[str] = None
+    """
+    The name of the service principal granted the permission level.
+    """
+
+    user_name: VariableOrOptional[str] = None
+    """
+    The name of the user granted the permission level.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "SqlWarehousePermissionDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "SqlWarehousePermissionDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class SqlWarehousePermissionDict(TypedDict, total=False):
+    """"""
+
+    level: VariableOr[WarehousePermissionLevelParam]
+    """
+    The permission level to apply. The allowed levels depend on the resource type.
+    """
+
+    group_name: VariableOrOptional[str]
+    """
+    The name of the group granted the permission level.
+    """
+
+    service_principal_name: VariableOrOptional[str]
+    """
+    The name of the service principal granted the permission level.
+    """
+
+    user_name: VariableOrOptional[str]
+    """
+    The name of the user granted the permission level.
+    """
+
+
+SqlWarehousePermissionParam = SqlWarehousePermissionDict | SqlWarehousePermission
diff --git a/python/databricks/bundles/sql_warehouses/_models/warehouse_permission_level.py b/python/databricks/bundles/sql_warehouses/_models/warehouse_permission_level.py
new file mode 100644
index 00000000000..5728daa0d12
--- /dev/null
+++ b/python/databricks/bundles/sql_warehouses/_models/warehouse_permission_level.py
@@ -0,0 +1,22 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class WarehousePermissionLevel(Enum):
+    """
+    Permission level
+    """
+
+    CAN_MANAGE = "CAN_MANAGE"
+    IS_OWNER = "IS_OWNER"
+    CAN_USE = "CAN_USE"
+    CAN_MONITOR = "CAN_MONITOR"
+    CAN_VIEW = "CAN_VIEW"
+
+
+WarehousePermissionLevelParam = (
+    Literal["CAN_MANAGE", "IS_OWNER", "CAN_USE", "CAN_MONITOR", "CAN_VIEW"]
+    | WarehousePermissionLevel
+)
diff --git a/python/databricks/bundles/synced_database_tables/__init__.py b/python/databricks/bundles/synced_database_tables/__init__.py
new file mode 100644
index 00000000000..0b3a240e460
--- /dev/null
+++ b/python/databricks/bundles/synced_database_tables/__init__.py
@@ -0,0 +1,58 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+__all__ = [
+    "Lifecycle",
+    "LifecycleDict",
+    "LifecycleParam",
+    "NewPipelineSpec",
+    "NewPipelineSpecDict",
+    "NewPipelineSpecParam",
+    "SyncedDatabaseTable",
+    "SyncedDatabaseTableDict",
+    "SyncedDatabaseTableParam",
+    "SyncedTableSchedulingPolicy",
+    "SyncedTableSchedulingPolicyParam",
+    "SyncedTableSpec",
+    "SyncedTableSpecDict",
+    "SyncedTableSpecParam",
+    "SyncedTableSpecPgSpecificType",
+    "SyncedTableSpecPgSpecificTypeParam",
+    "SyncedTableSpecTypeOverride",
+    "SyncedTableSpecTypeOverrideDict",
+    "SyncedTableSpecTypeOverrideParam",
+]
+
+
+from databricks.bundles.synced_database_tables._models.lifecycle import (
+    Lifecycle,
+    LifecycleDict,
+    LifecycleParam,
+)
+from databricks.bundles.synced_database_tables._models.new_pipeline_spec import (
+    NewPipelineSpec,
+    NewPipelineSpecDict,
+    NewPipelineSpecParam,
+)
+from databricks.bundles.synced_database_tables._models.synced_database_table import (
+    SyncedDatabaseTable,
+    SyncedDatabaseTableDict,
+    SyncedDatabaseTableParam,
+)
+from databricks.bundles.synced_database_tables._models.synced_table_scheduling_policy import (
+    SyncedTableSchedulingPolicy,
+    SyncedTableSchedulingPolicyParam,
+)
+from databricks.bundles.synced_database_tables._models.synced_table_spec import (
+    SyncedTableSpec,
+    SyncedTableSpecDict,
+    SyncedTableSpecParam,
+)
+from databricks.bundles.synced_database_tables._models.synced_table_spec_pg_specific_type import (
+    SyncedTableSpecPgSpecificType,
+    SyncedTableSpecPgSpecificTypeParam,
+)
+from databricks.bundles.synced_database_tables._models.synced_table_spec_type_override import (
+    SyncedTableSpecTypeOverride,
+    SyncedTableSpecTypeOverrideDict,
+    SyncedTableSpecTypeOverrideParam,
+)
diff --git a/python/databricks/bundles/synced_database_tables/_models/lifecycle.py b/python/databricks/bundles/synced_database_tables/_models/lifecycle.py
new file mode 100644
index 00000000000..697776a198e
--- /dev/null
+++ b/python/databricks/bundles/synced_database_tables/_models/lifecycle.py
@@ -0,0 +1,40 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class Lifecycle:
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool] = None
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "LifecycleDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "LifecycleDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class LifecycleDict(TypedDict, total=False):
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool]
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+
+LifecycleParam = LifecycleDict | Lifecycle
diff --git a/python/databricks/bundles/synced_database_tables/_models/new_pipeline_spec.py b/python/databricks/bundles/synced_database_tables/_models/new_pipeline_spec.py
new file mode 100644
index 00000000000..9a47da58441
--- /dev/null
+++ b/python/databricks/bundles/synced_database_tables/_models/new_pipeline_spec.py
@@ -0,0 +1,79 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class NewPipelineSpec:
+    """
+    Custom fields that user can set for pipeline while creating SyncedDatabaseTable.
+    Note that other fields of pipeline are still inferred by table def internally
+    """
+
+    budget_policy_id: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Budget policy to set on the newly created pipeline.
+    """
+
+    storage_catalog: VariableOrOptional[str] = None
+    """
+    [Public Preview] This field needs to be specified if the destination catalog is a managed postgres catalog.
+    
+    UC catalog for the pipeline to store intermediate files (checkpoints, event logs etc).
+    This needs to be a standard catalog where the user has permissions to create Delta tables.
+    """
+
+    storage_schema: VariableOrOptional[str] = None
+    """
+    [Public Preview] This field needs to be specified if the destination catalog is a managed postgres catalog.
+    
+    UC schema for the pipeline to store intermediate files (checkpoints, event logs etc).
+    This needs to be in the standard catalog where the user has permissions to create Delta tables.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "NewPipelineSpecDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "NewPipelineSpecDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class NewPipelineSpecDict(TypedDict, total=False):
+    """"""
+
+    budget_policy_id: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] Budget policy to set on the newly created pipeline.
+    """
+
+    storage_catalog: VariableOrOptional[str]
+    """
+    [Public Preview] This field needs to be specified if the destination catalog is a managed postgres catalog.
+    
+    UC catalog for the pipeline to store intermediate files (checkpoints, event logs etc).
+    This needs to be a standard catalog where the user has permissions to create Delta tables.
+    """
+
+    storage_schema: VariableOrOptional[str]
+    """
+    [Public Preview] This field needs to be specified if the destination catalog is a managed postgres catalog.
+    
+    UC schema for the pipeline to store intermediate files (checkpoints, event logs etc).
+    This needs to be in the standard catalog where the user has permissions to create Delta tables.
+    """
+
+
+NewPipelineSpecParam = NewPipelineSpecDict | NewPipelineSpec
diff --git a/python/databricks/bundles/synced_database_tables/_models/synced_database_table.py b/python/databricks/bundles/synced_database_tables/_models/synced_database_table.py
new file mode 100644
index 00000000000..c98b869b76e
--- /dev/null
+++ b/python/databricks/bundles/synced_database_tables/_models/synced_database_table.py
@@ -0,0 +1,113 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._resource import Resource
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+from databricks.bundles.synced_database_tables._models.lifecycle import (
+    Lifecycle,
+    LifecycleParam,
+)
+from databricks.bundles.synced_database_tables._models.synced_table_spec import (
+    SyncedTableSpec,
+    SyncedTableSpecParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class SyncedDatabaseTable(Resource):
+    """"""
+
+    name: VariableOr[str]
+    """
+    [Public Preview] Full three-part (catalog, schema, table) name of the table.
+    """
+
+    database_instance_name: VariableOrOptional[str] = None
+    """
+    [Public Preview] Name of the target database instance. This is required when creating synced database tables in standard catalogs.
+    This is optional when creating synced database tables in registered catalogs. If this field is specified
+    when creating synced database tables in registered catalogs, the database instance name MUST
+    match that of the registered catalog (or the request will be rejected).
+    """
+
+    lifecycle: VariableOrOptional[Lifecycle] = None
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+    logical_database_name: VariableOrOptional[str] = None
+    """
+    [Public Preview] Target Postgres database object (logical database) name for this table.
+    
+    When creating a synced table in a registered Postgres catalog, the
+    target Postgres database name is inferred to be that of the registered catalog.
+    If this field is specified in this scenario, the Postgres database name MUST
+    match that of the registered catalog (or the request will be rejected).
+    
+    When creating a synced table in a standard catalog, this field is required.
+    In this scenario, specifying this field will allow targeting an arbitrary postgres database.
+    Note that this has implications for the `create_database_objects_is_missing` field in `spec`.
+    """
+
+    spec: VariableOrOptional[SyncedTableSpec] = None
+    """
+    [Public Preview] Specification of a synced database table.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "SyncedDatabaseTableDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "SyncedDatabaseTableDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class SyncedDatabaseTableDict(TypedDict, total=False):
+    """"""
+
+    name: VariableOr[str]
+    """
+    [Public Preview] Full three-part (catalog, schema, table) name of the table.
+    """
+
+    database_instance_name: VariableOrOptional[str]
+    """
+    [Public Preview] Name of the target database instance. This is required when creating synced database tables in standard catalogs.
+    This is optional when creating synced database tables in registered catalogs. If this field is specified
+    when creating synced database tables in registered catalogs, the database instance name MUST
+    match that of the registered catalog (or the request will be rejected).
+    """
+
+    lifecycle: VariableOrOptional[LifecycleParam]
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+    logical_database_name: VariableOrOptional[str]
+    """
+    [Public Preview] Target Postgres database object (logical database) name for this table.
+    
+    When creating a synced table in a registered Postgres catalog, the
+    target Postgres database name is inferred to be that of the registered catalog.
+    If this field is specified in this scenario, the Postgres database name MUST
+    match that of the registered catalog (or the request will be rejected).
+    
+    When creating a synced table in a standard catalog, this field is required.
+    In this scenario, specifying this field will allow targeting an arbitrary postgres database.
+    Note that this has implications for the `create_database_objects_is_missing` field in `spec`.
+    """
+
+    spec: VariableOrOptional[SyncedTableSpecParam]
+    """
+    [Public Preview] Specification of a synced database table.
+    """
+
+
+SyncedDatabaseTableParam = SyncedDatabaseTableDict | SyncedDatabaseTable
diff --git a/python/databricks/bundles/synced_database_tables/_models/synced_table_scheduling_policy.py b/python/databricks/bundles/synced_database_tables/_models/synced_table_scheduling_policy.py
new file mode 100644
index 00000000000..379d61c2c17
--- /dev/null
+++ b/python/databricks/bundles/synced_database_tables/_models/synced_table_scheduling_policy.py
@@ -0,0 +1,15 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class SyncedTableSchedulingPolicy(Enum):
+    CONTINUOUS = "CONTINUOUS"
+    TRIGGERED = "TRIGGERED"
+    SNAPSHOT = "SNAPSHOT"
+
+
+SyncedTableSchedulingPolicyParam = (
+    Literal["CONTINUOUS", "TRIGGERED", "SNAPSHOT"] | SyncedTableSchedulingPolicy
+)
diff --git a/python/databricks/bundles/synced_database_tables/_models/synced_table_spec.py b/python/databricks/bundles/synced_database_tables/_models/synced_table_spec.py
new file mode 100644
index 00000000000..c6be97882ae
--- /dev/null
+++ b/python/databricks/bundles/synced_database_tables/_models/synced_table_spec.py
@@ -0,0 +1,170 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
+from databricks.bundles.synced_database_tables._models.new_pipeline_spec import (
+    NewPipelineSpec,
+    NewPipelineSpecParam,
+)
+from databricks.bundles.synced_database_tables._models.synced_table_scheduling_policy import (
+    SyncedTableSchedulingPolicy,
+    SyncedTableSchedulingPolicyParam,
+)
+from databricks.bundles.synced_database_tables._models.synced_table_spec_type_override import (
+    SyncedTableSpecTypeOverride,
+    SyncedTableSpecTypeOverrideParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class SyncedTableSpec:
+    """
+    Specification of a synced database table.
+    """
+
+    accelerated_sync: VariableOrOptional[bool] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] When true, enables accelerated sync mode for the initial data load.
+    This significantly improves performance for large tables.
+    Requires workspace-level enablement.
+    """
+
+    create_database_objects_if_missing: VariableOrOptional[bool] = None
+    """
+    [Public Preview] If true, the synced table's logical database and schema resources in PG
+    will be created if they do not already exist.
+    """
+
+    existing_pipeline_id: VariableOrOptional[str] = None
+    """
+    [Public Preview] At most one of existing_pipeline_id and new_pipeline_spec should be defined.
+    
+    If existing_pipeline_id is defined, the synced table will be bin packed into the existing pipeline
+    referenced. This avoids creating a new pipeline and allows sharing existing compute.
+    In this case, the scheduling_policy of this synced table must match the scheduling policy of the existing pipeline.
+    """
+
+    new_pipeline_spec: VariableOrOptional[NewPipelineSpec] = None
+    """
+    [Public Preview] At most one of existing_pipeline_id and new_pipeline_spec should be defined.
+    
+    If new_pipeline_spec is defined, a new pipeline is created for this synced table. The location pointed to is used
+    to store intermediate files (checkpoints, event logs etc). The caller must have write permissions to create Delta
+    tables in the specified catalog and schema. Again, note this requires write permissions, whereas the source table
+    only requires read permissions.
+    """
+
+    primary_key_columns: VariableOrList[str] = field(default_factory=list)
+    """
+    [Public Preview] Primary Key columns to be used for data insert/update in the destination.
+    """
+
+    scheduling_policy: VariableOrOptional[SyncedTableSchedulingPolicy] = None
+    """
+    [Public Preview] Scheduling policy of the underlying pipeline.
+    """
+
+    source_table_full_name: VariableOrOptional[str] = None
+    """
+    [Public Preview] Three-part (catalog, schema, table) name of the source Delta table.
+    """
+
+    timeseries_key: VariableOrOptional[str] = None
+    """
+    [Public Preview] Time series key to deduplicate (tie-break) rows with the same primary key.
+    """
+
+    type_overrides: VariableOrList[SyncedTableSpecTypeOverride] = field(
+        default_factory=list
+    )
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Override the default Delta->PG type mapping for specific columns.
+    A TypeOverride with PG_SPECIFIC_TYPE_UNSPECIFIED is rejected; a valid pg_type must be set.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "SyncedTableSpecDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "SyncedTableSpecDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class SyncedTableSpecDict(TypedDict, total=False):
+    """"""
+
+    accelerated_sync: VariableOrOptional[bool]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] When true, enables accelerated sync mode for the initial data load.
+    This significantly improves performance for large tables.
+    Requires workspace-level enablement.
+    """
+
+    create_database_objects_if_missing: VariableOrOptional[bool]
+    """
+    [Public Preview] If true, the synced table's logical database and schema resources in PG
+    will be created if they do not already exist.
+    """
+
+    existing_pipeline_id: VariableOrOptional[str]
+    """
+    [Public Preview] At most one of existing_pipeline_id and new_pipeline_spec should be defined.
+    
+    If existing_pipeline_id is defined, the synced table will be bin packed into the existing pipeline
+    referenced. This avoids creating a new pipeline and allows sharing existing compute.
+    In this case, the scheduling_policy of this synced table must match the scheduling policy of the existing pipeline.
+    """
+
+    new_pipeline_spec: VariableOrOptional[NewPipelineSpecParam]
+    """
+    [Public Preview] At most one of existing_pipeline_id and new_pipeline_spec should be defined.
+    
+    If new_pipeline_spec is defined, a new pipeline is created for this synced table. The location pointed to is used
+    to store intermediate files (checkpoints, event logs etc). The caller must have write permissions to create Delta
+    tables in the specified catalog and schema. Again, note this requires write permissions, whereas the source table
+    only requires read permissions.
+    """
+
+    primary_key_columns: VariableOrList[str]
+    """
+    [Public Preview] Primary Key columns to be used for data insert/update in the destination.
+    """
+
+    scheduling_policy: VariableOrOptional[SyncedTableSchedulingPolicyParam]
+    """
+    [Public Preview] Scheduling policy of the underlying pipeline.
+    """
+
+    source_table_full_name: VariableOrOptional[str]
+    """
+    [Public Preview] Three-part (catalog, schema, table) name of the source Delta table.
+    """
+
+    timeseries_key: VariableOrOptional[str]
+    """
+    [Public Preview] Time series key to deduplicate (tie-break) rows with the same primary key.
+    """
+
+    type_overrides: VariableOrList[SyncedTableSpecTypeOverrideParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Override the default Delta->PG type mapping for specific columns.
+    A TypeOverride with PG_SPECIFIC_TYPE_UNSPECIFIED is rejected; a valid pg_type must be set.
+    """
+
+
+SyncedTableSpecParam = SyncedTableSpecDict | SyncedTableSpec
diff --git a/python/databricks/bundles/synced_database_tables/_models/synced_table_spec_pg_specific_type.py b/python/databricks/bundles/synced_database_tables/_models/synced_table_spec_pg_specific_type.py
new file mode 100644
index 00000000000..52c3b8dbe9a
--- /dev/null
+++ b/python/databricks/bundles/synced_database_tables/_models/synced_table_spec_pg_specific_type.py
@@ -0,0 +1,26 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class SyncedTableSpecPgSpecificType(Enum):
+    """
+    :meta private: [EXPERIMENTAL]
+
+    PostgreSQL-specific target types that can override the default Delta-to-PG mapping.
+    """
+
+    PG_SPECIFIC_TYPE_VECTOR = "PG_SPECIFIC_TYPE_VECTOR"
+    PG_SPECIFIC_TYPE_HALFVEC = "PG_SPECIFIC_TYPE_HALFVEC"
+    PG_SPECIFIC_TYPE_VARCHAR = "PG_SPECIFIC_TYPE_VARCHAR"
+
+
+SyncedTableSpecPgSpecificTypeParam = (
+    Literal[
+        "PG_SPECIFIC_TYPE_VECTOR",
+        "PG_SPECIFIC_TYPE_HALFVEC",
+        "PG_SPECIFIC_TYPE_VARCHAR",
+    ]
+    | SyncedTableSpecPgSpecificType
+)
diff --git a/python/databricks/bundles/synced_database_tables/_models/synced_table_spec_type_override.py b/python/databricks/bundles/synced_database_tables/_models/synced_table_spec_type_override.py
new file mode 100644
index 00000000000..5cc3fa72720
--- /dev/null
+++ b/python/databricks/bundles/synced_database_tables/_models/synced_table_spec_type_override.py
@@ -0,0 +1,84 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+from databricks.bundles.synced_database_tables._models.synced_table_spec_pg_specific_type import (
+    SyncedTableSpecPgSpecificType,
+    SyncedTableSpecPgSpecificTypeParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class SyncedTableSpecTypeOverride:
+    """
+    :meta private: [EXPERIMENTAL]
+
+    Overrides the default Delta-to-PostgreSQL type mapping for a single column.
+    """
+
+    column_name: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Name of the source column whose target PostgreSQL type should be overridden.
+    """
+
+    pg_type: VariableOr[SyncedTableSpecPgSpecificType]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] PostgreSQL-specific target type to use for the column.
+    """
+
+    size: VariableOrOptional[int] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Size parameter for the target type, for types that take one (e.g. vector
+    dimension, varchar length). Required when the chosen pg_type needs a size.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "SyncedTableSpecTypeOverrideDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "SyncedTableSpecTypeOverrideDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class SyncedTableSpecTypeOverrideDict(TypedDict, total=False):
+    """"""
+
+    column_name: VariableOr[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Name of the source column whose target PostgreSQL type should be overridden.
+    """
+
+    pg_type: VariableOr[SyncedTableSpecPgSpecificTypeParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] PostgreSQL-specific target type to use for the column.
+    """
+
+    size: VariableOrOptional[int]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] Size parameter for the target type, for types that take one (e.g. vector
+    dimension, varchar length). Required when the chosen pg_type needs a size.
+    """
+
+
+SyncedTableSpecTypeOverrideParam = (
+    SyncedTableSpecTypeOverrideDict | SyncedTableSpecTypeOverride
+)
diff --git a/python/databricks/bundles/vector_search_endpoints/__init__.py b/python/databricks/bundles/vector_search_endpoints/__init__.py
new file mode 100644
index 00000000000..aabc0081f5d
--- /dev/null
+++ b/python/databricks/bundles/vector_search_endpoints/__init__.py
@@ -0,0 +1,42 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+__all__ = [
+    "EndpointType",
+    "EndpointTypeParam",
+    "Lifecycle",
+    "LifecycleDict",
+    "LifecycleParam",
+    "VectorSearchEndpoint",
+    "VectorSearchEndpointDict",
+    "VectorSearchEndpointParam",
+    "VectorSearchEndpointPermission",
+    "VectorSearchEndpointPermissionDict",
+    "VectorSearchEndpointPermissionLevel",
+    "VectorSearchEndpointPermissionLevelParam",
+    "VectorSearchEndpointPermissionParam",
+]
+
+
+from databricks.bundles.vector_search_endpoints._models.endpoint_type import (
+    EndpointType,
+    EndpointTypeParam,
+)
+from databricks.bundles.vector_search_endpoints._models.lifecycle import (
+    Lifecycle,
+    LifecycleDict,
+    LifecycleParam,
+)
+from databricks.bundles.vector_search_endpoints._models.vector_search_endpoint import (
+    VectorSearchEndpoint,
+    VectorSearchEndpointDict,
+    VectorSearchEndpointParam,
+)
+from databricks.bundles.vector_search_endpoints._models.vector_search_endpoint_permission import (
+    VectorSearchEndpointPermission,
+    VectorSearchEndpointPermissionDict,
+    VectorSearchEndpointPermissionParam,
+)
+from databricks.bundles.vector_search_endpoints._models.vector_search_endpoint_permission_level import (
+    VectorSearchEndpointPermissionLevel,
+    VectorSearchEndpointPermissionLevelParam,
+)
diff --git a/python/databricks/bundles/vector_search_endpoints/_models/endpoint_type.py b/python/databricks/bundles/vector_search_endpoints/_models/endpoint_type.py
new file mode 100644
index 00000000000..476295df34b
--- /dev/null
+++ b/python/databricks/bundles/vector_search_endpoints/_models/endpoint_type.py
@@ -0,0 +1,16 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class EndpointType(Enum):
+    """
+    Type of endpoint.
+    """
+
+    STORAGE_OPTIMIZED = "STORAGE_OPTIMIZED"
+    STANDARD = "STANDARD"
+
+
+EndpointTypeParam = Literal["STORAGE_OPTIMIZED", "STANDARD"] | EndpointType
diff --git a/python/databricks/bundles/vector_search_endpoints/_models/lifecycle.py b/python/databricks/bundles/vector_search_endpoints/_models/lifecycle.py
new file mode 100644
index 00000000000..697776a198e
--- /dev/null
+++ b/python/databricks/bundles/vector_search_endpoints/_models/lifecycle.py
@@ -0,0 +1,40 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class Lifecycle:
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool] = None
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "LifecycleDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "LifecycleDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class LifecycleDict(TypedDict, total=False):
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool]
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+
+LifecycleParam = LifecycleDict | Lifecycle
diff --git a/python/databricks/bundles/vector_search_endpoints/_models/vector_search_endpoint.py b/python/databricks/bundles/vector_search_endpoints/_models/vector_search_endpoint.py
new file mode 100644
index 00000000000..8072329f47b
--- /dev/null
+++ b/python/databricks/bundles/vector_search_endpoints/_models/vector_search_endpoint.py
@@ -0,0 +1,127 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._resource import Resource
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import (
+    VariableOr,
+    VariableOrList,
+    VariableOrOptional,
+)
+from databricks.bundles.vector_search_endpoints._models.endpoint_type import (
+    EndpointType,
+    EndpointTypeParam,
+)
+from databricks.bundles.vector_search_endpoints._models.lifecycle import (
+    Lifecycle,
+    LifecycleParam,
+)
+from databricks.bundles.vector_search_endpoints._models.vector_search_endpoint_permission import (
+    VectorSearchEndpointPermission,
+    VectorSearchEndpointPermissionParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class VectorSearchEndpoint(Resource):
+    """"""
+
+    endpoint_type: VariableOr[EndpointType]
+    """
+    Type of endpoint
+    """
+
+    name: VariableOr[str]
+    """
+    Name of the AI Search endpoint
+    """
+
+    budget_policy_id: VariableOrOptional[str] = None
+    """
+    [Public Preview] The budget policy id to be applied
+    """
+
+    lifecycle: VariableOrOptional[Lifecycle] = None
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+    permissions: VariableOrList[VectorSearchEndpointPermission] = field(
+        default_factory=list
+    )
+    """
+    The permissions to apply to this resource.
+    """
+
+    target_qps: VariableOrOptional[int] = None
+    """
+    Target QPS for the endpoint. Mutually exclusive with num_replicas.
+    The actual replica count is calculated at index creation/sync time based on this value.
+    Best-effort target; the system does not guarantee this QPS will be achieved.
+    """
+
+    usage_policy_id: VariableOrOptional[str] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The usage policy id to be applied once we've migrated to usage policies
+    """
+
+    @classmethod
+    def from_dict(cls, value: "VectorSearchEndpointDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "VectorSearchEndpointDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class VectorSearchEndpointDict(TypedDict, total=False):
+    """"""
+
+    endpoint_type: VariableOr[EndpointTypeParam]
+    """
+    Type of endpoint
+    """
+
+    name: VariableOr[str]
+    """
+    Name of the AI Search endpoint
+    """
+
+    budget_policy_id: VariableOrOptional[str]
+    """
+    [Public Preview] The budget policy id to be applied
+    """
+
+    lifecycle: VariableOrOptional[LifecycleParam]
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+    permissions: VariableOrList[VectorSearchEndpointPermissionParam]
+    """
+    The permissions to apply to this resource.
+    """
+
+    target_qps: VariableOrOptional[int]
+    """
+    Target QPS for the endpoint. Mutually exclusive with num_replicas.
+    The actual replica count is calculated at index creation/sync time based on this value.
+    Best-effort target; the system does not guarantee this QPS will be achieved.
+    """
+
+    usage_policy_id: VariableOrOptional[str]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Private Preview] The usage policy id to be applied once we've migrated to usage policies
+    """
+
+
+VectorSearchEndpointParam = VectorSearchEndpointDict | VectorSearchEndpoint
diff --git a/python/databricks/bundles/vector_search_endpoints/_models/vector_search_endpoint_permission.py b/python/databricks/bundles/vector_search_endpoints/_models/vector_search_endpoint_permission.py
new file mode 100644
index 00000000000..cfbdc1e31d6
--- /dev/null
+++ b/python/databricks/bundles/vector_search_endpoints/_models/vector_search_endpoint_permission.py
@@ -0,0 +1,52 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOr, VariableOrOptional
+from databricks.bundles.vector_search_endpoints._models.vector_search_endpoint_permission_level import (
+    VectorSearchEndpointPermissionLevel,
+    VectorSearchEndpointPermissionLevelParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class VectorSearchEndpointPermission:
+    """"""
+
+    level: VariableOr[VectorSearchEndpointPermissionLevel]
+
+    group_name: VariableOrOptional[str] = None
+
+    service_principal_name: VariableOrOptional[str] = None
+
+    user_name: VariableOrOptional[str] = None
+
+    @classmethod
+    def from_dict(cls, value: "VectorSearchEndpointPermissionDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "VectorSearchEndpointPermissionDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class VectorSearchEndpointPermissionDict(TypedDict, total=False):
+    """"""
+
+    level: VariableOr[VectorSearchEndpointPermissionLevelParam]
+
+    group_name: VariableOrOptional[str]
+
+    service_principal_name: VariableOrOptional[str]
+
+    user_name: VariableOrOptional[str]
+
+
+VectorSearchEndpointPermissionParam = (
+    VectorSearchEndpointPermissionDict | VectorSearchEndpointPermission
+)
diff --git a/python/databricks/bundles/vector_search_endpoints/_models/vector_search_endpoint_permission_level.py b/python/databricks/bundles/vector_search_endpoints/_models/vector_search_endpoint_permission_level.py
new file mode 100644
index 00000000000..d2618d39126
--- /dev/null
+++ b/python/databricks/bundles/vector_search_endpoints/_models/vector_search_endpoint_permission_level.py
@@ -0,0 +1,19 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class VectorSearchEndpointPermissionLevel(Enum):
+    """
+    Permission level
+    """
+
+    CAN_CREATE = "CAN_CREATE"
+    CAN_MANAGE = "CAN_MANAGE"
+    CAN_USE = "CAN_USE"
+
+
+VectorSearchEndpointPermissionLevelParam = (
+    Literal["CAN_CREATE", "CAN_MANAGE", "CAN_USE"] | VectorSearchEndpointPermissionLevel
+)
diff --git a/python/databricks/bundles/vector_search_indexes/__init__.py b/python/databricks/bundles/vector_search_indexes/__init__.py
new file mode 100644
index 00000000000..8e3c88eb018
--- /dev/null
+++ b/python/databricks/bundles/vector_search_indexes/__init__.py
@@ -0,0 +1,86 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+__all__ = [
+    "DeltaSyncVectorIndexSpecRequest",
+    "DeltaSyncVectorIndexSpecRequestDict",
+    "DeltaSyncVectorIndexSpecRequestParam",
+    "DirectAccessVectorIndexSpec",
+    "DirectAccessVectorIndexSpecDict",
+    "DirectAccessVectorIndexSpecParam",
+    "EmbeddingSourceColumn",
+    "EmbeddingSourceColumnDict",
+    "EmbeddingSourceColumnParam",
+    "EmbeddingVectorColumn",
+    "EmbeddingVectorColumnDict",
+    "EmbeddingVectorColumnParam",
+    "IndexSubtype",
+    "IndexSubtypeParam",
+    "Lifecycle",
+    "LifecycleDict",
+    "LifecycleParam",
+    "PipelineType",
+    "PipelineTypeParam",
+    "Privilege",
+    "PrivilegeAssignment",
+    "PrivilegeAssignmentDict",
+    "PrivilegeAssignmentParam",
+    "PrivilegeParam",
+    "VectorIndexType",
+    "VectorIndexTypeParam",
+    "VectorSearchIndex",
+    "VectorSearchIndexDict",
+    "VectorSearchIndexParam",
+]
+
+
+from databricks.bundles.vector_search_indexes._models.delta_sync_vector_index_spec_request import (
+    DeltaSyncVectorIndexSpecRequest,
+    DeltaSyncVectorIndexSpecRequestDict,
+    DeltaSyncVectorIndexSpecRequestParam,
+)
+from databricks.bundles.vector_search_indexes._models.direct_access_vector_index_spec import (
+    DirectAccessVectorIndexSpec,
+    DirectAccessVectorIndexSpecDict,
+    DirectAccessVectorIndexSpecParam,
+)
+from databricks.bundles.vector_search_indexes._models.embedding_source_column import (
+    EmbeddingSourceColumn,
+    EmbeddingSourceColumnDict,
+    EmbeddingSourceColumnParam,
+)
+from databricks.bundles.vector_search_indexes._models.embedding_vector_column import (
+    EmbeddingVectorColumn,
+    EmbeddingVectorColumnDict,
+    EmbeddingVectorColumnParam,
+)
+from databricks.bundles.vector_search_indexes._models.index_subtype import (
+    IndexSubtype,
+    IndexSubtypeParam,
+)
+from databricks.bundles.vector_search_indexes._models.lifecycle import (
+    Lifecycle,
+    LifecycleDict,
+    LifecycleParam,
+)
+from databricks.bundles.vector_search_indexes._models.pipeline_type import (
+    PipelineType,
+    PipelineTypeParam,
+)
+from databricks.bundles.vector_search_indexes._models.privilege import (
+    Privilege,
+    PrivilegeParam,
+)
+from databricks.bundles.vector_search_indexes._models.privilege_assignment import (
+    PrivilegeAssignment,
+    PrivilegeAssignmentDict,
+    PrivilegeAssignmentParam,
+)
+from databricks.bundles.vector_search_indexes._models.vector_index_type import (
+    VectorIndexType,
+    VectorIndexTypeParam,
+)
+from databricks.bundles.vector_search_indexes._models.vector_search_index import (
+    VectorSearchIndex,
+    VectorSearchIndexDict,
+    VectorSearchIndexParam,
+)
diff --git a/python/databricks/bundles/vector_search_indexes/_models/delta_sync_vector_index_spec_request.py b/python/databricks/bundles/vector_search_indexes/_models/delta_sync_vector_index_spec_request.py
new file mode 100644
index 00000000000..b7af851711b
--- /dev/null
+++ b/python/databricks/bundles/vector_search_indexes/_models/delta_sync_vector_index_spec_request.py
@@ -0,0 +1,132 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
+from databricks.bundles.vector_search_indexes._models.embedding_source_column import (
+    EmbeddingSourceColumn,
+    EmbeddingSourceColumnParam,
+)
+from databricks.bundles.vector_search_indexes._models.embedding_vector_column import (
+    EmbeddingVectorColumn,
+    EmbeddingVectorColumnParam,
+)
+from databricks.bundles.vector_search_indexes._models.pipeline_type import (
+    PipelineType,
+    PipelineTypeParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class DeltaSyncVectorIndexSpecRequest:
+    """"""
+
+    columns_to_index: VariableOrList[str] = field(default_factory=list)
+    """
+    [Optional] Alias for columns_to_sync. Select the columns to include in the vector index.
+    If you leave this field blank, all columns from the source table are included.
+    The primary key column and embedding source column or embedding vector column are always included.
+    Only one of columns_to_sync or columns_to_index may be specified.
+    """
+
+    columns_to_sync: VariableOrList[str] = field(default_factory=list)
+    """
+    [Optional] Select the columns to sync with the vector index. If you leave this field blank, all columns
+    from the source table are synced with the index. The primary key column and embedding source column or
+    embedding vector column are always synced.
+    """
+
+    embedding_source_columns: VariableOrList[EmbeddingSourceColumn] = field(
+        default_factory=list
+    )
+    """
+    The columns that contain the embedding source.
+    """
+
+    embedding_vector_columns: VariableOrList[EmbeddingVectorColumn] = field(
+        default_factory=list
+    )
+    """
+    The columns that contain the embedding vectors.
+    """
+
+    embedding_writeback_table: VariableOrOptional[str] = None
+    """
+    [Optional] Name of the Delta table to sync the vector index contents and computed embeddings to.
+    """
+
+    pipeline_type: VariableOrOptional[PipelineType] = None
+    """
+    Pipeline execution mode.
+    - `TRIGGERED`: If the pipeline uses the triggered execution mode, the system stops processing after successfully refreshing the source table in the pipeline once, ensuring the table is updated based on the data available when the update started.
+    - `CONTINUOUS`: If the pipeline uses continuous execution, the pipeline processes new data as it arrives in the source table to keep vector index fresh.
+    """
+
+    source_table: VariableOrOptional[str] = None
+    """
+    The name of the source table.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "DeltaSyncVectorIndexSpecRequestDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "DeltaSyncVectorIndexSpecRequestDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class DeltaSyncVectorIndexSpecRequestDict(TypedDict, total=False):
+    """"""
+
+    columns_to_index: VariableOrList[str]
+    """
+    [Optional] Alias for columns_to_sync. Select the columns to include in the vector index.
+    If you leave this field blank, all columns from the source table are included.
+    The primary key column and embedding source column or embedding vector column are always included.
+    Only one of columns_to_sync or columns_to_index may be specified.
+    """
+
+    columns_to_sync: VariableOrList[str]
+    """
+    [Optional] Select the columns to sync with the vector index. If you leave this field blank, all columns
+    from the source table are synced with the index. The primary key column and embedding source column or
+    embedding vector column are always synced.
+    """
+
+    embedding_source_columns: VariableOrList[EmbeddingSourceColumnParam]
+    """
+    The columns that contain the embedding source.
+    """
+
+    embedding_vector_columns: VariableOrList[EmbeddingVectorColumnParam]
+    """
+    The columns that contain the embedding vectors.
+    """
+
+    embedding_writeback_table: VariableOrOptional[str]
+    """
+    [Optional] Name of the Delta table to sync the vector index contents and computed embeddings to.
+    """
+
+    pipeline_type: VariableOrOptional[PipelineTypeParam]
+    """
+    Pipeline execution mode.
+    - `TRIGGERED`: If the pipeline uses the triggered execution mode, the system stops processing after successfully refreshing the source table in the pipeline once, ensuring the table is updated based on the data available when the update started.
+    - `CONTINUOUS`: If the pipeline uses continuous execution, the pipeline processes new data as it arrives in the source table to keep vector index fresh.
+    """
+
+    source_table: VariableOrOptional[str]
+    """
+    The name of the source table.
+    """
+
+
+DeltaSyncVectorIndexSpecRequestParam = (
+    DeltaSyncVectorIndexSpecRequestDict | DeltaSyncVectorIndexSpecRequest
+)
diff --git a/python/databricks/bundles/vector_search_indexes/_models/direct_access_vector_index_spec.py b/python/databricks/bundles/vector_search_indexes/_models/direct_access_vector_index_spec.py
new file mode 100644
index 00000000000..76ef31b4b30
--- /dev/null
+++ b/python/databricks/bundles/vector_search_indexes/_models/direct_access_vector_index_spec.py
@@ -0,0 +1,78 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
+from databricks.bundles.vector_search_indexes._models.embedding_source_column import (
+    EmbeddingSourceColumn,
+    EmbeddingSourceColumnParam,
+)
+from databricks.bundles.vector_search_indexes._models.embedding_vector_column import (
+    EmbeddingVectorColumn,
+    EmbeddingVectorColumnParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class DirectAccessVectorIndexSpec:
+    """"""
+
+    embedding_source_columns: VariableOrList[EmbeddingSourceColumn] = field(
+        default_factory=list
+    )
+    """
+    The columns that contain the embedding source. The format should be array[double].
+    """
+
+    embedding_vector_columns: VariableOrList[EmbeddingVectorColumn] = field(
+        default_factory=list
+    )
+    """
+    The columns that contain the embedding vectors. The format should be array[double].
+    """
+
+    schema_json: VariableOrOptional[str] = None
+    """
+    The schema of the index in JSON format.
+    Supported types are `integer`, `long`, `float`, `double`, `boolean`, `string`, `date`, `timestamp`.
+    Supported types for vector column: `array<float>`, `array<double>`,`.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "DirectAccessVectorIndexSpecDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "DirectAccessVectorIndexSpecDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class DirectAccessVectorIndexSpecDict(TypedDict, total=False):
+    """"""
+
+    embedding_source_columns: VariableOrList[EmbeddingSourceColumnParam]
+    """
+    The columns that contain the embedding source. The format should be array[double].
+    """
+
+    embedding_vector_columns: VariableOrList[EmbeddingVectorColumnParam]
+    """
+    The columns that contain the embedding vectors. The format should be array[double].
+    """
+
+    schema_json: VariableOrOptional[str]
+    """
+    The schema of the index in JSON format.
+    Supported types are `integer`, `long`, `float`, `double`, `boolean`, `string`, `date`, `timestamp`.
+    Supported types for vector column: `array<float>`, `array<double>`,`.
+    """
+
+
+DirectAccessVectorIndexSpecParam = (
+    DirectAccessVectorIndexSpecDict | DirectAccessVectorIndexSpec
+)
diff --git a/python/databricks/bundles/vector_search_indexes/_models/embedding_source_column.py b/python/databricks/bundles/vector_search_indexes/_models/embedding_source_column.py
new file mode 100644
index 00000000000..7debdc3f104
--- /dev/null
+++ b/python/databricks/bundles/vector_search_indexes/_models/embedding_source_column.py
@@ -0,0 +1,60 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class EmbeddingSourceColumn:
+    """"""
+
+    embedding_model_endpoint_name: VariableOrOptional[str] = None
+    """
+    Name of the embedding model endpoint, used by default for both ingestion and querying.
+    """
+
+    model_endpoint_name_for_query: VariableOrOptional[str] = None
+    """
+    Name of the embedding model endpoint which, if specified, is used for querying (not ingestion).
+    """
+
+    name: VariableOrOptional[str] = None
+    """
+    Name of the column
+    """
+
+    @classmethod
+    def from_dict(cls, value: "EmbeddingSourceColumnDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "EmbeddingSourceColumnDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class EmbeddingSourceColumnDict(TypedDict, total=False):
+    """"""
+
+    embedding_model_endpoint_name: VariableOrOptional[str]
+    """
+    Name of the embedding model endpoint, used by default for both ingestion and querying.
+    """
+
+    model_endpoint_name_for_query: VariableOrOptional[str]
+    """
+    Name of the embedding model endpoint which, if specified, is used for querying (not ingestion).
+    """
+
+    name: VariableOrOptional[str]
+    """
+    Name of the column
+    """
+
+
+EmbeddingSourceColumnParam = EmbeddingSourceColumnDict | EmbeddingSourceColumn
diff --git a/python/databricks/bundles/vector_search_indexes/_models/embedding_vector_column.py b/python/databricks/bundles/vector_search_indexes/_models/embedding_vector_column.py
new file mode 100644
index 00000000000..b8efd6b4f0c
--- /dev/null
+++ b/python/databricks/bundles/vector_search_indexes/_models/embedding_vector_column.py
@@ -0,0 +1,50 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class EmbeddingVectorColumn:
+    """"""
+
+    embedding_dimension: VariableOrOptional[int] = None
+    """
+    Dimension of the embedding vector
+    """
+
+    name: VariableOrOptional[str] = None
+    """
+    Name of the column
+    """
+
+    @classmethod
+    def from_dict(cls, value: "EmbeddingVectorColumnDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "EmbeddingVectorColumnDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class EmbeddingVectorColumnDict(TypedDict, total=False):
+    """"""
+
+    embedding_dimension: VariableOrOptional[int]
+    """
+    Dimension of the embedding vector
+    """
+
+    name: VariableOrOptional[str]
+    """
+    Name of the column
+    """
+
+
+EmbeddingVectorColumnParam = EmbeddingVectorColumnDict | EmbeddingVectorColumn
diff --git a/python/databricks/bundles/vector_search_indexes/_models/index_subtype.py b/python/databricks/bundles/vector_search_indexes/_models/index_subtype.py
new file mode 100644
index 00000000000..5485754d1e6
--- /dev/null
+++ b/python/databricks/bundles/vector_search_indexes/_models/index_subtype.py
@@ -0,0 +1,20 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class IndexSubtype(Enum):
+    """
+    The subtype of the AI Search index, determining the indexing and retrieval strategy.
+    - `VECTOR`: Not supported. Use `HYBRID` instead.
+    - `FULL_TEXT`: An index that uses full-text search without vector embeddings.
+    - `HYBRID`: An index that uses vector embeddings for similarity search and hybrid search.
+    """
+
+    VECTOR = "VECTOR"
+    FULL_TEXT = "FULL_TEXT"
+    HYBRID = "HYBRID"
+
+
+IndexSubtypeParam = Literal["VECTOR", "FULL_TEXT", "HYBRID"] | IndexSubtype
diff --git a/python/databricks/bundles/vector_search_indexes/_models/lifecycle.py b/python/databricks/bundles/vector_search_indexes/_models/lifecycle.py
new file mode 100644
index 00000000000..697776a198e
--- /dev/null
+++ b/python/databricks/bundles/vector_search_indexes/_models/lifecycle.py
@@ -0,0 +1,40 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrOptional
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class Lifecycle:
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool] = None
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "LifecycleDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "LifecycleDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class LifecycleDict(TypedDict, total=False):
+    """"""
+
+    prevent_destroy: VariableOrOptional[bool]
+    """
+    Lifecycle setting to prevent the resource from being destroyed.
+    """
+
+
+LifecycleParam = LifecycleDict | Lifecycle
diff --git a/python/databricks/bundles/vector_search_indexes/_models/pipeline_type.py b/python/databricks/bundles/vector_search_indexes/_models/pipeline_type.py
new file mode 100644
index 00000000000..6821dec812e
--- /dev/null
+++ b/python/databricks/bundles/vector_search_indexes/_models/pipeline_type.py
@@ -0,0 +1,18 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class PipelineType(Enum):
+    """
+    Pipeline execution mode.
+    - `TRIGGERED`: If the pipeline uses the triggered execution mode, the system stops processing after successfully refreshing the source table in the pipeline once, ensuring the table is updated based on the data available when the update started.
+    - `CONTINUOUS`: If the pipeline uses continuous execution, the pipeline processes new data as it arrives in the source table to keep vector index fresh.
+    """
+
+    TRIGGERED = "TRIGGERED"
+    CONTINUOUS = "CONTINUOUS"
+
+
+PipelineTypeParam = Literal["TRIGGERED", "CONTINUOUS"] | PipelineType
diff --git a/python/databricks/bundles/vector_search_indexes/_models/privilege.py b/python/databricks/bundles/vector_search_indexes/_models/privilege.py
new file mode 100644
index 00000000000..df45211a76a
--- /dev/null
+++ b/python/databricks/bundles/vector_search_indexes/_models/privilege.py
@@ -0,0 +1,118 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class Privilege(Enum):
+    SELECT = "SELECT"
+    READ_PRIVATE_FILES = "READ_PRIVATE_FILES"
+    WRITE_PRIVATE_FILES = "WRITE_PRIVATE_FILES"
+    CREATE = "CREATE"
+    USAGE = "USAGE"
+    USE_CATALOG = "USE_CATALOG"
+    USE_SCHEMA = "USE_SCHEMA"
+    CREATE_SCHEMA = "CREATE_SCHEMA"
+    CREATE_VIEW = "CREATE_VIEW"
+    CREATE_EXTERNAL_TABLE = "CREATE_EXTERNAL_TABLE"
+    CREATE_MATERIALIZED_VIEW = "CREATE_MATERIALIZED_VIEW"
+    CREATE_FUNCTION = "CREATE_FUNCTION"
+    CREATE_MODEL = "CREATE_MODEL"
+    CREATE_CATALOG = "CREATE_CATALOG"
+    CREATE_MANAGED_STORAGE = "CREATE_MANAGED_STORAGE"
+    CREATE_EXTERNAL_LOCATION = "CREATE_EXTERNAL_LOCATION"
+    CREATE_STORAGE_CREDENTIAL = "CREATE_STORAGE_CREDENTIAL"
+    CREATE_SERVICE_CREDENTIAL = "CREATE_SERVICE_CREDENTIAL"
+    ACCESS = "ACCESS"
+    CREATE_SHARE = "CREATE_SHARE"
+    CREATE_RECIPIENT = "CREATE_RECIPIENT"
+    CREATE_PROVIDER = "CREATE_PROVIDER"
+    USE_SHARE = "USE_SHARE"
+    USE_RECIPIENT = "USE_RECIPIENT"
+    USE_PROVIDER = "USE_PROVIDER"
+    USE_MARKETPLACE_ASSETS = "USE_MARKETPLACE_ASSETS"
+    SET_SHARE_PERMISSION = "SET_SHARE_PERMISSION"
+    MODIFY = "MODIFY"
+    REFRESH = "REFRESH"
+    EXECUTE = "EXECUTE"
+    READ_FILES = "READ_FILES"
+    WRITE_FILES = "WRITE_FILES"
+    CREATE_TABLE = "CREATE_TABLE"
+    ALL_PRIVILEGES = "ALL_PRIVILEGES"
+    CREATE_CONNECTION = "CREATE_CONNECTION"
+    USE_CONNECTION = "USE_CONNECTION"
+    APPLY_TAG = "APPLY_TAG"
+    CREATE_FOREIGN_CATALOG = "CREATE_FOREIGN_CATALOG"
+    CREATE_FOREIGN_SECURABLE = "CREATE_FOREIGN_SECURABLE"
+    MANAGE_ALLOWLIST = "MANAGE_ALLOWLIST"
+    CREATE_VOLUME = "CREATE_VOLUME"
+    CREATE_EXTERNAL_VOLUME = "CREATE_EXTERNAL_VOLUME"
+    READ_VOLUME = "READ_VOLUME"
+    WRITE_VOLUME = "WRITE_VOLUME"
+    MANAGE = "MANAGE"
+    BROWSE = "BROWSE"
+    CREATE_CLEAN_ROOM = "CREATE_CLEAN_ROOM"
+    MODIFY_CLEAN_ROOM = "MODIFY_CLEAN_ROOM"
+    EXECUTE_CLEAN_ROOM_TASK = "EXECUTE_CLEAN_ROOM_TASK"
+    EXTERNAL_USE_SCHEMA = "EXTERNAL_USE_SCHEMA"
+    READ_METADATA = "READ_METADATA"
+    EXTERNAL_USE_LOCATION = "EXTERNAL_USE_LOCATION"
+
+
+PrivilegeParam = (
+    Literal[
+        "SELECT",
+        "READ_PRIVATE_FILES",
+        "WRITE_PRIVATE_FILES",
+        "CREATE",
+        "USAGE",
+        "USE_CATALOG",
+        "USE_SCHEMA",
+        "CREATE_SCHEMA",
+        "CREATE_VIEW",
+        "CREATE_EXTERNAL_TABLE",
+        "CREATE_MATERIALIZED_VIEW",
+        "CREATE_FUNCTION",
+        "CREATE_MODEL",
+        "CREATE_CATALOG",
+        "CREATE_MANAGED_STORAGE",
+        "CREATE_EXTERNAL_LOCATION",
+        "CREATE_STORAGE_CREDENTIAL",
+        "CREATE_SERVICE_CREDENTIAL",
+        "ACCESS",
+        "CREATE_SHARE",
+        "CREATE_RECIPIENT",
+        "CREATE_PROVIDER",
+        "USE_SHARE",
+        "USE_RECIPIENT",
+        "USE_PROVIDER",
+        "USE_MARKETPLACE_ASSETS",
+        "SET_SHARE_PERMISSION",
+        "MODIFY",
+        "REFRESH",
+        "EXECUTE",
+        "READ_FILES",
+        "WRITE_FILES",
+        "CREATE_TABLE",
+        "ALL_PRIVILEGES",
+        "CREATE_CONNECTION",
+        "USE_CONNECTION",
+        "APPLY_TAG",
+        "CREATE_FOREIGN_CATALOG",
+        "CREATE_FOREIGN_SECURABLE",
+        "MANAGE_ALLOWLIST",
+        "CREATE_VOLUME",
+        "CREATE_EXTERNAL_VOLUME",
+        "READ_VOLUME",
+        "WRITE_VOLUME",
+        "MANAGE",
+        "BROWSE",
+        "CREATE_CLEAN_ROOM",
+        "MODIFY_CLEAN_ROOM",
+        "EXECUTE_CLEAN_ROOM_TASK",
+        "EXTERNAL_USE_SCHEMA",
+        "READ_METADATA",
+        "EXTERNAL_USE_LOCATION",
+    ]
+    | Privilege
+)
diff --git a/python/databricks/bundles/vector_search_indexes/_models/privilege_assignment.py b/python/databricks/bundles/vector_search_indexes/_models/privilege_assignment.py
new file mode 100644
index 00000000000..55100240cc4
--- /dev/null
+++ b/python/databricks/bundles/vector_search_indexes/_models/privilege_assignment.py
@@ -0,0 +1,56 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import VariableOrList, VariableOrOptional
+from databricks.bundles.vector_search_indexes._models.privilege import (
+    Privilege,
+    PrivilegeParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class PrivilegeAssignment:
+    """"""
+
+    principal: VariableOrOptional[str] = None
+    """
+    The principal (user email address or group name).
+    For deleted principals, `principal` is empty while `principal_id` is populated.
+    """
+
+    privileges: VariableOrList[Privilege] = field(default_factory=list)
+    """
+    The privileges assigned to the principal.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "PrivilegeAssignmentDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "PrivilegeAssignmentDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class PrivilegeAssignmentDict(TypedDict, total=False):
+    """"""
+
+    principal: VariableOrOptional[str]
+    """
+    The principal (user email address or group name).
+    For deleted principals, `principal` is empty while `principal_id` is populated.
+    """
+
+    privileges: VariableOrList[PrivilegeParam]
+    """
+    The privileges assigned to the principal.
+    """
+
+
+PrivilegeAssignmentParam = PrivilegeAssignmentDict | PrivilegeAssignment
diff --git a/python/databricks/bundles/vector_search_indexes/_models/vector_index_type.py b/python/databricks/bundles/vector_search_indexes/_models/vector_index_type.py
new file mode 100644
index 00000000000..43b8550c8b2
--- /dev/null
+++ b/python/databricks/bundles/vector_search_indexes/_models/vector_index_type.py
@@ -0,0 +1,18 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from enum import Enum
+from typing import Literal
+
+
+class VectorIndexType(Enum):
+    """
+    There are 2 types of AI Search indexes:
+    - `DELTA_SYNC`: An index that automatically syncs with a source Delta Table, automatically and incrementally updating the index as the underlying data in the Delta Table changes.
+    - `DIRECT_ACCESS`: An index that supports direct read and write of vectors and metadata through our REST and SDK APIs. With this model, the user manages index updates.
+    """
+
+    DELTA_SYNC = "DELTA_SYNC"
+    DIRECT_ACCESS = "DIRECT_ACCESS"
+
+
+VectorIndexTypeParam = Literal["DELTA_SYNC", "DIRECT_ACCESS"] | VectorIndexType
diff --git a/python/databricks/bundles/vector_search_indexes/_models/vector_search_index.py b/python/databricks/bundles/vector_search_indexes/_models/vector_search_index.py
new file mode 100644
index 00000000000..dba21478b1f
--- /dev/null
+++ b/python/databricks/bundles/vector_search_indexes/_models/vector_search_index.py
@@ -0,0 +1,157 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, TypedDict
+
+from databricks.bundles.core._resource import Resource
+from databricks.bundles.core._transform import _transform
+from databricks.bundles.core._transform_to_json import _transform_to_json_value
+from databricks.bundles.core._variable import (
+    VariableOr,
+    VariableOrList,
+    VariableOrOptional,
+)
+from databricks.bundles.vector_search_indexes._models.delta_sync_vector_index_spec_request import (
+    DeltaSyncVectorIndexSpecRequest,
+    DeltaSyncVectorIndexSpecRequestParam,
+)
+from databricks.bundles.vector_search_indexes._models.direct_access_vector_index_spec import (
+    DirectAccessVectorIndexSpec,
+    DirectAccessVectorIndexSpecParam,
+)
+from databricks.bundles.vector_search_indexes._models.index_subtype import (
+    IndexSubtype,
+    IndexSubtypeParam,
+)
+from databricks.bundles.vector_search_indexes._models.lifecycle import (
+    Lifecycle,
+    LifecycleParam,
+)
+from databricks.bundles.vector_search_indexes._models.privilege_assignment import (
+    PrivilegeAssignment,
+    PrivilegeAssignmentParam,
+)
+from databricks.bundles.vector_search_indexes._models.vector_index_type import (
+    VectorIndexType,
+    VectorIndexTypeParam,
+)
+
+if TYPE_CHECKING:
+    from typing_extensions import Self
+
+
+@dataclass(kw_only=True)
+class VectorSearchIndex(Resource):
+    """"""
+
+    endpoint_name: VariableOr[str]
+    """
+    Name of the endpoint to be used for serving the index
+    """
+
+    index_type: VariableOr[VectorIndexType]
+    """
+    There are 2 types of AI Search indexes:
+    - `DELTA_SYNC`: An index that automatically syncs with a source Delta Table, automatically and incrementally updating the index as the underlying data in the Delta Table changes.
+    - `DIRECT_ACCESS`: An index that supports direct read and write of vectors and metadata through our REST and SDK APIs. With this model, the user manages index updates.
+    """
+
+    name: VariableOr[str]
+    """
+    Name of the index
+    """
+
+    primary_key: VariableOr[str]
+    """
+    Primary key of the index
+    """
+
+    delta_sync_index_spec: VariableOrOptional[DeltaSyncVectorIndexSpecRequest] = None
+    """
+    Specification for Delta Sync Index. Required if `index_type` is `DELTA_SYNC`.
+    """
+
+    direct_access_index_spec: VariableOrOptional[DirectAccessVectorIndexSpec] = None
+    """
+    Specification for Direct Vector Access Index. Required if `index_type` is `DIRECT_ACCESS`.
+    """
+
+    grants: VariableOrList[PrivilegeAssignment] = field(default_factory=list)
+    """
+    The Unity Catalog privileges to grant to principals on this securable.
+    """
+
+    index_subtype: VariableOrOptional[IndexSubtype] = None
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] The subtype of the index. Use `HYBRID` or `FULL_TEXT`. `VECTOR` is not supported.
+    """
+
+    lifecycle: VariableOrOptional[Lifecycle] = None
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+    @classmethod
+    def from_dict(cls, value: "VectorSearchIndexDict") -> "Self":
+        return _transform(cls, value)
+
+    def as_dict(self) -> "VectorSearchIndexDict":
+        return _transform_to_json_value(self)  # type:ignore
+
+
+class VectorSearchIndexDict(TypedDict, total=False):
+    """"""
+
+    endpoint_name: VariableOr[str]
+    """
+    Name of the endpoint to be used for serving the index
+    """
+
+    index_type: VariableOr[VectorIndexTypeParam]
+    """
+    There are 2 types of AI Search indexes:
+    - `DELTA_SYNC`: An index that automatically syncs with a source Delta Table, automatically and incrementally updating the index as the underlying data in the Delta Table changes.
+    - `DIRECT_ACCESS`: An index that supports direct read and write of vectors and metadata through our REST and SDK APIs. With this model, the user manages index updates.
+    """
+
+    name: VariableOr[str]
+    """
+    Name of the index
+    """
+
+    primary_key: VariableOr[str]
+    """
+    Primary key of the index
+    """
+
+    delta_sync_index_spec: VariableOrOptional[DeltaSyncVectorIndexSpecRequestParam]
+    """
+    Specification for Delta Sync Index. Required if `index_type` is `DELTA_SYNC`.
+    """
+
+    direct_access_index_spec: VariableOrOptional[DirectAccessVectorIndexSpecParam]
+    """
+    Specification for Direct Vector Access Index. Required if `index_type` is `DIRECT_ACCESS`.
+    """
+
+    grants: VariableOrList[PrivilegeAssignmentParam]
+    """
+    The Unity Catalog privileges to grant to principals on this securable.
+    """
+
+    index_subtype: VariableOrOptional[IndexSubtypeParam]
+    """
+    :meta private: [EXPERIMENTAL]
+    
+    [Beta] The subtype of the index. Use `HYBRID` or `FULL_TEXT`. `VECTOR` is not supported.
+    """
+
+    lifecycle: VariableOrOptional[LifecycleParam]
+    """
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
+    """
+
+
+VectorSearchIndexParam = VectorSearchIndexDict | VectorSearchIndex
diff --git a/python/databricks/bundles/version.py b/python/databricks/bundles/version.py
index 1fabcd33802..d91b7180968 100644
--- a/python/databricks/bundles/version.py
+++ b/python/databricks/bundles/version.py
@@ -1 +1 @@
-__version__ = "0.299.0"
+__version__ = "1.22.1"
diff --git a/python/databricks/bundles/volumes/__init__.py b/python/databricks/bundles/volumes/__init__.py
index 57cf0f1e909..97bc1d54bd7 100644
--- a/python/databricks/bundles/volumes/__init__.py
+++ b/python/databricks/bundles/volumes/__init__.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 __all__ = [
     "Lifecycle",
     "LifecycleDict",
diff --git a/python/databricks/bundles/volumes/_models/lifecycle.py b/python/databricks/bundles/volumes/_models/lifecycle.py
index c934967f37e..697776a198e 100644
--- a/python/databricks/bundles/volumes/_models/lifecycle.py
+++ b/python/databricks/bundles/volumes/_models/lifecycle.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/volumes/_models/privilege.py b/python/databricks/bundles/volumes/_models/privilege.py
index 20f4e1f5573..df45211a76a 100644
--- a/python/databricks/bundles/volumes/_models/privilege.py
+++ b/python/databricks/bundles/volumes/_models/privilege.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
@@ -53,6 +55,8 @@ class Privilege(Enum):
     MODIFY_CLEAN_ROOM = "MODIFY_CLEAN_ROOM"
     EXECUTE_CLEAN_ROOM_TASK = "EXECUTE_CLEAN_ROOM_TASK"
     EXTERNAL_USE_SCHEMA = "EXTERNAL_USE_SCHEMA"
+    READ_METADATA = "READ_METADATA"
+    EXTERNAL_USE_LOCATION = "EXTERNAL_USE_LOCATION"
 
 
 PrivilegeParam = (
@@ -107,6 +111,8 @@ class Privilege(Enum):
         "MODIFY_CLEAN_ROOM",
         "EXECUTE_CLEAN_ROOM_TASK",
         "EXTERNAL_USE_SCHEMA",
+        "READ_METADATA",
+        "EXTERNAL_USE_LOCATION",
     ]
     | Privilege
 )
diff --git a/python/databricks/bundles/volumes/_models/privilege_assignment.py b/python/databricks/bundles/volumes/_models/privilege_assignment.py
index 35b695e10db..612e9d85eb0 100644
--- a/python/databricks/bundles/volumes/_models/privilege_assignment.py
+++ b/python/databricks/bundles/volumes/_models/privilege_assignment.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
diff --git a/python/databricks/bundles/volumes/_models/volume.py b/python/databricks/bundles/volumes/_models/volume.py
index bf77c831d65..db248fbba94 100644
--- a/python/databricks/bundles/volumes/_models/volume.py
+++ b/python/databricks/bundles/volumes/_models/volume.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, TypedDict
 
@@ -45,10 +47,13 @@ class Volume(Resource):
     """
 
     grants: VariableOrList[PrivilegeAssignment] = field(default_factory=list)
+    """
+    The Unity Catalog privileges to grant to principals on this securable.
+    """
 
     lifecycle: VariableOrOptional[Lifecycle] = None
     """
-    Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
     """
 
     storage_location: VariableOrOptional[str] = None
@@ -57,6 +62,11 @@ class Volume(Resource):
     """
 
     volume_type: VariableOrOptional[VolumeType] = None
+    """
+    The type of the volume. An external volume is located in the specified external location.
+    A managed volume is located in the default location which is specified by the parent schema, or the parent catalog, or the Metastore.
+    [Learn more](https://docs.databricks.com/aws/en/volumes/managed-vs-external)
+    """
 
     @classmethod
     def from_dict(cls, value: "VolumeDict") -> "Self":
@@ -90,10 +100,13 @@ class VolumeDict(TypedDict, total=False):
     """
 
     grants: VariableOrList[PrivilegeAssignmentParam]
+    """
+    The Unity Catalog privileges to grant to principals on this securable.
+    """
 
     lifecycle: VariableOrOptional[LifecycleParam]
     """
-    Lifecycle is a struct that contains the lifecycle settings for a resource. It controls the behavior of the resource when it is deployed or destroyed.
+    Settings that control the deployment lifecycle of the resource, such as preventing it from being destroyed.
     """
 
     storage_location: VariableOrOptional[str]
@@ -102,6 +115,11 @@ class VolumeDict(TypedDict, total=False):
     """
 
     volume_type: VariableOrOptional[VolumeTypeParam]
+    """
+    The type of the volume. An external volume is located in the specified external location.
+    A managed volume is located in the default location which is specified by the parent schema, or the parent catalog, or the Metastore.
+    [Learn more](https://docs.databricks.com/aws/en/volumes/managed-vs-external)
+    """
 
 
 VolumeParam = VolumeDict | Volume
diff --git a/python/databricks/bundles/volumes/_models/volume_type.py b/python/databricks/bundles/volumes/_models/volume_type.py
index 5c96db8fde9..0caf77b1c33 100644
--- a/python/databricks/bundles/volumes/_models/volume_type.py
+++ b/python/databricks/bundles/volumes/_models/volume_type.py
@@ -1,3 +1,5 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
 from enum import Enum
 from typing import Literal
 
diff --git a/python/databricks_tests/.gitattributes b/python/databricks_tests/.gitattributes
new file mode 100644
index 00000000000..810eb0c20ec
--- /dev/null
+++ b/python/databricks_tests/.gitattributes
@@ -0,0 +1,4 @@
+# Generated by pydabs-codegen (see python/codegen). The per-resource TestCase
+# data under core/_generated/ drives the parametrized tests in test_resources.py;
+# the rest of databricks_tests/ is hand-written.
+core/_generated/** linguist-generated=true
diff --git a/python/databricks_tests/core/_generated/__init__.py b/python/databricks_tests/core/_generated/__init__.py
new file mode 100644
index 00000000000..e1e07830307
--- /dev/null
+++ b/python/databricks_tests/core/_generated/__init__.py
@@ -0,0 +1,71 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from databricks_tests.core._generated import (
+    alerts,
+    apps,
+    catalogs,
+    cluster_policies,
+    clusters,
+    dashboards,
+    database_catalogs,
+    database_instances,
+    experiments,
+    external_locations,
+    features,
+    genie_spaces,
+    instance_pools,
+    job_runs,
+    jobs,
+    mcp_services,
+    model_provider_services,
+    model_services,
+    model_serving_endpoints,
+    models,
+    pipelines,
+    quality_monitors,
+    registered_models,
+    schemas,
+    secret_scopes,
+    secrets,
+    sql_warehouses,
+    synced_database_tables,
+    vector_search_endpoints,
+    vector_search_indexes,
+    volumes,
+)
+
+__all__ = ["test_cases"]
+
+test_cases = [
+    alerts._test_case(),
+    apps._test_case(),
+    catalogs._test_case(),
+    cluster_policies._test_case(),
+    clusters._test_case(),
+    dashboards._test_case(),
+    database_catalogs._test_case(),
+    database_instances._test_case(),
+    experiments._test_case(),
+    external_locations._test_case(),
+    features._test_case(),
+    genie_spaces._test_case(),
+    instance_pools._test_case(),
+    job_runs._test_case(),
+    jobs._test_case(),
+    mcp_services._test_case(),
+    model_provider_services._test_case(),
+    model_services._test_case(),
+    model_serving_endpoints._test_case(),
+    models._test_case(),
+    pipelines._test_case(),
+    quality_monitors._test_case(),
+    registered_models._test_case(),
+    schemas._test_case(),
+    secret_scopes._test_case(),
+    secrets._test_case(),
+    sql_warehouses._test_case(),
+    synced_database_tables._test_case(),
+    vector_search_endpoints._test_case(),
+    vector_search_indexes._test_case(),
+    volumes._test_case(),
+]
diff --git a/python/databricks_tests/core/_generated/alerts.py b/python/databricks_tests/core/_generated/alerts.py
new file mode 100644
index 00000000000..2d8e117c99c
--- /dev/null
+++ b/python/databricks_tests/core/_generated/alerts.py
@@ -0,0 +1,58 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from databricks.bundles.alerts._models.alert import Alert
+from databricks.bundles.alerts._models.alert_v2_evaluation import AlertV2Evaluation
+from databricks.bundles.alerts._models.alert_v2_operand_column import (
+    AlertV2OperandColumn,
+)
+from databricks.bundles.alerts._models.alert_v2_run_as import AlertV2RunAs
+from databricks.bundles.alerts._models.comparison_operator import ComparisonOperator
+from databricks.bundles.alerts._models.cron_schedule import CronSchedule
+from databricks.bundles.alerts._models.lifecycle import Lifecycle
+from databricks.bundles.alerts._models.permission import Permission
+from databricks.bundles.alerts._models.permission_level import PermissionLevel
+from databricks.bundles.core import Resources, alert_mutator
+from databricks.bundles.core._generated.alerts import _resource_type
+from databricks_tests.core._resource_test_case import ResourceTestCase
+
+
+def _test_case():
+    return (
+        ResourceTestCase(
+            add_resource=Resources.add_alert,
+            dict_example={
+                "display_name": "display_name",
+                "evaluation": {
+                    "comparison_operator": "LESS_THAN",
+                    "source": {"name": "name"},
+                },
+                "lifecycle": {},
+                "permissions": [{"level": "CAN_MANAGE"}],
+                "query_text": "query_text",
+                "run_as": {},
+                "schedule": {
+                    "quartz_cron_schedule": "quartz_cron_schedule",
+                    "timezone_id": "timezone_id",
+                },
+                "warehouse_id": "warehouse_id",
+            },
+            dataclass_example=Alert(
+                display_name="display_name",
+                evaluation=AlertV2Evaluation(
+                    comparison_operator=ComparisonOperator.LESS_THAN,
+                    source=AlertV2OperandColumn(name="name"),
+                ),
+                lifecycle=Lifecycle(),
+                permissions=[Permission(level=PermissionLevel.CAN_MANAGE)],
+                query_text="query_text",
+                run_as=AlertV2RunAs(),
+                schedule=CronSchedule(
+                    quartz_cron_schedule="quartz_cron_schedule",
+                    timezone_id="timezone_id",
+                ),
+                warehouse_id="warehouse_id",
+            ),
+            mutator=alert_mutator,
+        ),
+        _resource_type(),
+    )
diff --git a/python/databricks_tests/core/_generated/apps.py b/python/databricks_tests/core/_generated/apps.py
new file mode 100644
index 00000000000..41518c8c2e5
--- /dev/null
+++ b/python/databricks_tests/core/_generated/apps.py
@@ -0,0 +1,51 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from databricks.bundles.apps._models.app import App
+from databricks.bundles.apps._models.app_config import AppConfig
+from databricks.bundles.apps._models.app_permission import AppPermission
+from databricks.bundles.apps._models.app_permission_level import AppPermissionLevel
+from databricks.bundles.apps._models.app_resource import AppResource
+from databricks.bundles.apps._models.compute_size import ComputeSize
+from databricks.bundles.apps._models.git_repository import GitRepository
+from databricks.bundles.apps._models.git_source import GitSource
+from databricks.bundles.apps._models.lifecycle_with_started import LifecycleWithStarted
+from databricks.bundles.apps._models.telemetry_export_destination import (
+    TelemetryExportDestination,
+)
+from databricks.bundles.core import Resources, app_mutator
+from databricks.bundles.core._generated.apps import _resource_type
+from databricks_tests.core._resource_test_case import ResourceTestCase
+
+
+def _test_case():
+    return (
+        ResourceTestCase(
+            add_resource=Resources.add_app,
+            dict_example={
+                "compute_size": "MEDIUM",
+                "config": {},
+                "git_repository": {"provider": "provider", "url": "url"},
+                "git_source": {},
+                "lifecycle": {},
+                "name": "name",
+                "permissions": [{"level": "CAN_MANAGE"}],
+                "resources": [{"name": "name"}],
+                "telemetry_export_destinations": [{}],
+                "user_api_scopes": ["user_api_scopes"],
+            },
+            dataclass_example=App(
+                compute_size=ComputeSize.MEDIUM,
+                config=AppConfig(),
+                git_repository=GitRepository(provider="provider", url="url"),
+                git_source=GitSource(),
+                lifecycle=LifecycleWithStarted(),
+                name="name",
+                permissions=[AppPermission(level=AppPermissionLevel.CAN_MANAGE)],
+                resources=[AppResource(name="name")],
+                telemetry_export_destinations=[TelemetryExportDestination()],
+                user_api_scopes=["user_api_scopes"],
+            ),
+            mutator=app_mutator,
+        ),
+        _resource_type(),
+    )
diff --git a/python/databricks_tests/core/_generated/catalogs.py b/python/databricks_tests/core/_generated/catalogs.py
new file mode 100644
index 00000000000..117d964071c
--- /dev/null
+++ b/python/databricks_tests/core/_generated/catalogs.py
@@ -0,0 +1,35 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from databricks.bundles.catalogs._models.catalog import Catalog
+from databricks.bundles.catalogs._models.encryption_settings import EncryptionSettings
+from databricks.bundles.catalogs._models.lifecycle import Lifecycle
+from databricks.bundles.catalogs._models.privilege_assignment import PrivilegeAssignment
+from databricks.bundles.core import Resources, catalog_mutator
+from databricks.bundles.core._generated.catalogs import _resource_type
+from databricks_tests.core._resource_test_case import ResourceTestCase
+
+
+def _test_case():
+    return (
+        ResourceTestCase(
+            add_resource=Resources.add_catalog,
+            dict_example={
+                "grants": [{}],
+                "lifecycle": {},
+                "managed_encryption_settings": {},
+                "name": "name",
+                "options": {"key": "value"},
+                "properties": {"key": "value"},
+            },
+            dataclass_example=Catalog(
+                grants=[PrivilegeAssignment()],
+                lifecycle=Lifecycle(),
+                managed_encryption_settings=EncryptionSettings(),
+                name="name",
+                options={"key": "value"},
+                properties={"key": "value"},
+            ),
+            mutator=catalog_mutator,
+        ),
+        _resource_type(),
+    )
diff --git a/python/databricks_tests/core/_generated/cluster_policies.py b/python/databricks_tests/core/_generated/cluster_policies.py
new file mode 100644
index 00000000000..72fd868be8a
--- /dev/null
+++ b/python/databricks_tests/core/_generated/cluster_policies.py
@@ -0,0 +1,36 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from databricks.bundles.cluster_policies._models.cluster_policy import ClusterPolicy
+from databricks.bundles.cluster_policies._models.cluster_policy_permission import (
+    ClusterPolicyPermission,
+)
+from databricks.bundles.cluster_policies._models.cluster_policy_permission_level import (
+    ClusterPolicyPermissionLevel,
+)
+from databricks.bundles.cluster_policies._models.library import Library
+from databricks.bundles.cluster_policies._models.lifecycle import Lifecycle
+from databricks.bundles.core import Resources, cluster_policy_mutator
+from databricks.bundles.core._generated.cluster_policies import _resource_type
+from databricks_tests.core._resource_test_case import ResourceTestCase
+
+
+def _test_case():
+    return (
+        ResourceTestCase(
+            add_resource=Resources.add_cluster_policy,
+            dict_example={
+                "libraries": [{}],
+                "lifecycle": {},
+                "permissions": [{"level": "CAN_USE"}],
+            },
+            dataclass_example=ClusterPolicy(
+                libraries=[Library()],
+                lifecycle=Lifecycle(),
+                permissions=[
+                    ClusterPolicyPermission(level=ClusterPolicyPermissionLevel.CAN_USE)
+                ],
+            ),
+            mutator=cluster_policy_mutator,
+        ),
+        _resource_type(),
+    )
diff --git a/python/databricks_tests/core/_generated/clusters.py b/python/databricks_tests/core/_generated/clusters.py
new file mode 100644
index 00000000000..2de29367b86
--- /dev/null
+++ b/python/databricks_tests/core/_generated/clusters.py
@@ -0,0 +1,85 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from databricks.bundles.clusters._models.auto_scale import AutoScale
+from databricks.bundles.clusters._models.aws_attributes import AwsAttributes
+from databricks.bundles.clusters._models.azure_attributes import AzureAttributes
+from databricks.bundles.clusters._models.clients_types import ClientsTypes
+from databricks.bundles.clusters._models.cluster import Cluster
+from databricks.bundles.clusters._models.cluster_log_conf import ClusterLogConf
+from databricks.bundles.clusters._models.cluster_permission import ClusterPermission
+from databricks.bundles.clusters._models.cluster_permission_level import (
+    ClusterPermissionLevel,
+)
+from databricks.bundles.clusters._models.data_security_mode import DataSecurityMode
+from databricks.bundles.clusters._models.docker_image import DockerImage
+from databricks.bundles.clusters._models.gcp_attributes import GcpAttributes
+from databricks.bundles.clusters._models.init_script_info import InitScriptInfo
+from databricks.bundles.clusters._models.kind import Kind
+from databricks.bundles.clusters._models.library import Library
+from databricks.bundles.clusters._models.lifecycle_with_started import (
+    LifecycleWithStarted,
+)
+from databricks.bundles.clusters._models.node_type_flexibility import (
+    NodeTypeFlexibility,
+)
+from databricks.bundles.clusters._models.runtime_engine import RuntimeEngine
+from databricks.bundles.clusters._models.workload_type import WorkloadType
+from databricks.bundles.core import Resources, cluster_mutator
+from databricks.bundles.core._generated.clusters import _resource_type
+from databricks_tests.core._resource_test_case import ResourceTestCase
+
+
+def _test_case():
+    return (
+        ResourceTestCase(
+            add_resource=Resources.add_cluster,
+            dict_example={
+                "autoscale": {},
+                "aws_attributes": {},
+                "azure_attributes": {},
+                "cluster_log_conf": {},
+                "custom_tags": {"key": "value"},
+                "data_security_mode": "NONE",
+                "docker_image": {},
+                "driver_node_type_flexibility": {},
+                "gcp_attributes": {},
+                "init_scripts": [{}],
+                "kind": "CLASSIC_PREVIEW",
+                "libraries": [{}],
+                "lifecycle": {},
+                "permissions": [{"level": "CAN_MANAGE"}],
+                "runtime_engine": "NULL",
+                "spark_conf": {"key": "value"},
+                "spark_env_vars": {"key": "value"},
+                "ssh_public_keys": ["ssh_public_keys"],
+                "worker_node_type_flexibility": {},
+                "workload_type": {"clients": {}},
+            },
+            dataclass_example=Cluster(
+                autoscale=AutoScale(),
+                aws_attributes=AwsAttributes(),
+                azure_attributes=AzureAttributes(),
+                cluster_log_conf=ClusterLogConf(),
+                custom_tags={"key": "value"},
+                data_security_mode=DataSecurityMode.NONE,
+                docker_image=DockerImage(),
+                driver_node_type_flexibility=NodeTypeFlexibility(),
+                gcp_attributes=GcpAttributes(),
+                init_scripts=[InitScriptInfo()],
+                kind=Kind.CLASSIC_PREVIEW,
+                libraries=[Library()],
+                lifecycle=LifecycleWithStarted(),
+                permissions=[
+                    ClusterPermission(level=ClusterPermissionLevel.CAN_MANAGE)
+                ],
+                runtime_engine=RuntimeEngine.NULL,
+                spark_conf={"key": "value"},
+                spark_env_vars={"key": "value"},
+                ssh_public_keys=["ssh_public_keys"],
+                worker_node_type_flexibility=NodeTypeFlexibility(),
+                workload_type=WorkloadType(clients=ClientsTypes()),
+            ),
+            mutator=cluster_mutator,
+        ),
+        _resource_type(),
+    )
diff --git a/python/databricks_tests/core/_generated/dashboards.py b/python/databricks_tests/core/_generated/dashboards.py
new file mode 100644
index 00000000000..3ec459fb4ba
--- /dev/null
+++ b/python/databricks_tests/core/_generated/dashboards.py
@@ -0,0 +1,30 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from databricks.bundles.core import Resources, dashboard_mutator
+from databricks.bundles.core._generated.dashboards import _resource_type
+from databricks.bundles.dashboards._models.dashboard import Dashboard
+from databricks.bundles.dashboards._models.lifecycle import Lifecycle
+from databricks.bundles.dashboards._models.lifecycle_state import LifecycleState
+from databricks.bundles.dashboards._models.permission import Permission
+from databricks.bundles.dashboards._models.permission_level import PermissionLevel
+from databricks_tests.core._resource_test_case import ResourceTestCase
+
+
+def _test_case():
+    return (
+        ResourceTestCase(
+            add_resource=Resources.add_dashboard,
+            dict_example={
+                "lifecycle": {},
+                "lifecycle_state": "ACTIVE",
+                "permissions": [{"level": "CAN_MANAGE"}],
+            },
+            dataclass_example=Dashboard(
+                lifecycle=Lifecycle(),
+                lifecycle_state=LifecycleState.ACTIVE,
+                permissions=[Permission(level=PermissionLevel.CAN_MANAGE)],
+            ),
+            mutator=dashboard_mutator,
+        ),
+        _resource_type(),
+    )
diff --git a/python/databricks_tests/core/_generated/database_catalogs.py b/python/databricks_tests/core/_generated/database_catalogs.py
new file mode 100644
index 00000000000..43919e9c7d9
--- /dev/null
+++ b/python/databricks_tests/core/_generated/database_catalogs.py
@@ -0,0 +1,31 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from databricks.bundles.core import Resources, database_catalog_mutator
+from databricks.bundles.core._generated.database_catalogs import _resource_type
+from databricks.bundles.database_catalogs._models.database_catalog import (
+    DatabaseCatalog,
+)
+from databricks.bundles.database_catalogs._models.lifecycle import Lifecycle
+from databricks_tests.core._resource_test_case import ResourceTestCase
+
+
+def _test_case():
+    return (
+        ResourceTestCase(
+            add_resource=Resources.add_database_catalog,
+            dict_example={
+                "database_instance_name": "database_instance_name",
+                "database_name": "database_name",
+                "lifecycle": {},
+                "name": "name",
+            },
+            dataclass_example=DatabaseCatalog(
+                database_instance_name="database_instance_name",
+                database_name="database_name",
+                lifecycle=Lifecycle(),
+                name="name",
+            ),
+            mutator=database_catalog_mutator,
+        ),
+        _resource_type(),
+    )
diff --git a/python/databricks_tests/core/_generated/database_instances.py b/python/databricks_tests/core/_generated/database_instances.py
new file mode 100644
index 00000000000..9fb8c2d6962
--- /dev/null
+++ b/python/databricks_tests/core/_generated/database_instances.py
@@ -0,0 +1,38 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from databricks.bundles.core import Resources, database_instance_mutator
+from databricks.bundles.core._generated.database_instances import _resource_type
+from databricks.bundles.database_instances._models.database_instance import (
+    DatabaseInstance,
+)
+from databricks.bundles.database_instances._models.database_instance_ref import (
+    DatabaseInstanceRef,
+)
+from databricks.bundles.database_instances._models.lifecycle import Lifecycle
+from databricks.bundles.database_instances._models.permission import Permission
+from databricks.bundles.database_instances._models.permission_level import (
+    PermissionLevel,
+)
+from databricks_tests.core._resource_test_case import ResourceTestCase
+
+
+def _test_case():
+    return (
+        ResourceTestCase(
+            add_resource=Resources.add_database_instance,
+            dict_example={
+                "lifecycle": {},
+                "name": "name",
+                "parent_instance_ref": {},
+                "permissions": [{"level": "CAN_MANAGE"}],
+            },
+            dataclass_example=DatabaseInstance(
+                lifecycle=Lifecycle(),
+                name="name",
+                parent_instance_ref=DatabaseInstanceRef(),
+                permissions=[Permission(level=PermissionLevel.CAN_MANAGE)],
+            ),
+            mutator=database_instance_mutator,
+        ),
+        _resource_type(),
+    )
diff --git a/python/databricks_tests/core/_generated/experiments.py b/python/databricks_tests/core/_generated/experiments.py
new file mode 100644
index 00000000000..229dec55646
--- /dev/null
+++ b/python/databricks_tests/core/_generated/experiments.py
@@ -0,0 +1,40 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from databricks.bundles.core import Resources, mlflow_experiment_mutator
+from databricks.bundles.core._generated.experiments import _resource_type
+from databricks.bundles.experiments._models.experiment_permission_level import (
+    ExperimentPermissionLevel,
+)
+from databricks.bundles.experiments._models.experiment_tag import ExperimentTag
+from databricks.bundles.experiments._models.lifecycle import Lifecycle
+from databricks.bundles.experiments._models.mlflow_experiment import MlflowExperiment
+from databricks.bundles.experiments._models.mlflow_experiment_permission import (
+    MlflowExperimentPermission,
+)
+from databricks_tests.core._resource_test_case import ResourceTestCase
+
+
+def _test_case():
+    return (
+        ResourceTestCase(
+            add_resource=Resources.add_mlflow_experiment,
+            dict_example={
+                "lifecycle": {},
+                "name": "name",
+                "permissions": [{"level": "CAN_MANAGE"}],
+                "tags": [{}],
+            },
+            dataclass_example=MlflowExperiment(
+                lifecycle=Lifecycle(),
+                name="name",
+                permissions=[
+                    MlflowExperimentPermission(
+                        level=ExperimentPermissionLevel.CAN_MANAGE
+                    )
+                ],
+                tags=[ExperimentTag()],
+            ),
+            mutator=mlflow_experiment_mutator,
+        ),
+        _resource_type(),
+    )
diff --git a/python/databricks_tests/core/_generated/external_locations.py b/python/databricks_tests/core/_generated/external_locations.py
new file mode 100644
index 00000000000..d2bb07e0644
--- /dev/null
+++ b/python/databricks_tests/core/_generated/external_locations.py
@@ -0,0 +1,46 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from databricks.bundles.core import Resources, external_location_mutator
+from databricks.bundles.core._generated.external_locations import _resource_type
+from databricks.bundles.external_locations._models.encryption_details import (
+    EncryptionDetails,
+)
+from databricks.bundles.external_locations._models.external_location import (
+    ExternalLocation,
+)
+from databricks.bundles.external_locations._models.file_event_queue import (
+    FileEventQueue,
+)
+from databricks.bundles.external_locations._models.lifecycle import Lifecycle
+from databricks.bundles.external_locations._models.privilege_assignment import (
+    PrivilegeAssignment,
+)
+from databricks_tests.core._resource_test_case import ResourceTestCase
+
+
+def _test_case():
+    return (
+        ResourceTestCase(
+            add_resource=Resources.add_external_location,
+            dict_example={
+                "credential_name": "credential_name",
+                "encryption_details": {},
+                "file_event_queue": {},
+                "grants": [{}],
+                "lifecycle": {},
+                "name": "name",
+                "url": "url",
+            },
+            dataclass_example=ExternalLocation(
+                credential_name="credential_name",
+                encryption_details=EncryptionDetails(),
+                file_event_queue=FileEventQueue(),
+                grants=[PrivilegeAssignment()],
+                lifecycle=Lifecycle(),
+                name="name",
+                url="url",
+            ),
+            mutator=external_location_mutator,
+        ),
+        _resource_type(),
+    )
diff --git a/python/databricks_tests/core/_generated/features.py b/python/databricks_tests/core/_generated/features.py
new file mode 100644
index 00000000000..19344ab0e56
--- /dev/null
+++ b/python/databricks_tests/core/_generated/features.py
@@ -0,0 +1,37 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from databricks.bundles.core import Resources, feature_mutator
+from databricks.bundles.core._generated.features import _resource_type
+from databricks.bundles.features._models.data_source import DataSource
+from databricks.bundles.features._models.entity_column import EntityColumn
+from databricks.bundles.features._models.feature import Feature
+from databricks.bundles.features._models.function import Function
+from databricks.bundles.features._models.lifecycle import Lifecycle
+from databricks.bundles.features._models.timeseries_column import TimeseriesColumn
+from databricks_tests.core._resource_test_case import ResourceTestCase
+
+
+def _test_case():
+    return (
+        ResourceTestCase(
+            add_resource=Resources.add_feature,
+            dict_example={
+                "entities": [{"name": "name"}],
+                "full_name": "full_name",
+                "function": {},
+                "lifecycle": {},
+                "source": {},
+                "timeseries_column": {"name": "name"},
+            },
+            dataclass_example=Feature(
+                entities=[EntityColumn(name="name")],
+                full_name="full_name",
+                function=Function(),
+                lifecycle=Lifecycle(),
+                source=DataSource(),
+                timeseries_column=TimeseriesColumn(name="name"),
+            ),
+            mutator=feature_mutator,
+        ),
+        _resource_type(),
+    )
diff --git a/python/databricks_tests/core/_generated/genie_spaces.py b/python/databricks_tests/core/_generated/genie_spaces.py
new file mode 100644
index 00000000000..c219a22cda4
--- /dev/null
+++ b/python/databricks_tests/core/_generated/genie_spaces.py
@@ -0,0 +1,24 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from databricks.bundles.core import Resources, genie_space_mutator
+from databricks.bundles.core._generated.genie_spaces import _resource_type
+from databricks.bundles.genie_spaces._models.genie_space import GenieSpace
+from databricks.bundles.genie_spaces._models.lifecycle import Lifecycle
+from databricks.bundles.genie_spaces._models.permission import Permission
+from databricks.bundles.genie_spaces._models.permission_level import PermissionLevel
+from databricks_tests.core._resource_test_case import ResourceTestCase
+
+
+def _test_case():
+    return (
+        ResourceTestCase(
+            add_resource=Resources.add_genie_space,
+            dict_example={"lifecycle": {}, "permissions": [{"level": "CAN_MANAGE"}]},
+            dataclass_example=GenieSpace(
+                lifecycle=Lifecycle(),
+                permissions=[Permission(level=PermissionLevel.CAN_MANAGE)],
+            ),
+            mutator=genie_space_mutator,
+        ),
+        _resource_type(),
+    )
diff --git a/python/databricks_tests/core/_generated/instance_pools.py b/python/databricks_tests/core/_generated/instance_pools.py
new file mode 100644
index 00000000000..585cdfaec8e
--- /dev/null
+++ b/python/databricks_tests/core/_generated/instance_pools.py
@@ -0,0 +1,67 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from databricks.bundles.core import Resources, instance_pool_mutator
+from databricks.bundles.core._generated.instance_pools import _resource_type
+from databricks.bundles.instance_pools._models.disk_spec import DiskSpec
+from databricks.bundles.instance_pools._models.docker_image import DockerImage
+from databricks.bundles.instance_pools._models.instance_pool import InstancePool
+from databricks.bundles.instance_pools._models.instance_pool_aws_attributes import (
+    InstancePoolAwsAttributes,
+)
+from databricks.bundles.instance_pools._models.instance_pool_azure_attributes import (
+    InstancePoolAzureAttributes,
+)
+from databricks.bundles.instance_pools._models.instance_pool_gcp_attributes import (
+    InstancePoolGcpAttributes,
+)
+from databricks.bundles.instance_pools._models.instance_pool_permission import (
+    InstancePoolPermission,
+)
+from databricks.bundles.instance_pools._models.instance_pool_permission_level import (
+    InstancePoolPermissionLevel,
+)
+from databricks.bundles.instance_pools._models.lifecycle import Lifecycle
+from databricks.bundles.instance_pools._models.node_type_flexibility import (
+    NodeTypeFlexibility,
+)
+from databricks_tests.core._resource_test_case import ResourceTestCase
+
+
+def _test_case():
+    return (
+        ResourceTestCase(
+            add_resource=Resources.add_instance_pool,
+            dict_example={
+                "aws_attributes": {},
+                "azure_attributes": {},
+                "custom_tags": {"key": "value"},
+                "disk_spec": {},
+                "gcp_attributes": {},
+                "instance_pool_name": "instance_pool_name",
+                "lifecycle": {},
+                "node_type_flexibility": {},
+                "node_type_id": "node_type_id",
+                "permissions": [{"level": "CAN_MANAGE"}],
+                "preloaded_docker_images": [{}],
+                "preloaded_spark_versions": ["preloaded_spark_versions"],
+            },
+            dataclass_example=InstancePool(
+                aws_attributes=InstancePoolAwsAttributes(),
+                azure_attributes=InstancePoolAzureAttributes(),
+                custom_tags={"key": "value"},
+                disk_spec=DiskSpec(),
+                gcp_attributes=InstancePoolGcpAttributes(),
+                instance_pool_name="instance_pool_name",
+                lifecycle=Lifecycle(),
+                node_type_flexibility=NodeTypeFlexibility(),
+                node_type_id="node_type_id",
+                permissions=[
+                    InstancePoolPermission(level=InstancePoolPermissionLevel.CAN_MANAGE)
+                ],
+                preloaded_docker_images=[DockerImage()],
+                preloaded_spark_versions=["preloaded_spark_versions"],
+            ),
+            mutator=instance_pool_mutator,
+        ),
+        _resource_type(),
+    )
diff --git a/python/databricks_tests/core/_generated/job_runs.py b/python/databricks_tests/core/_generated/job_runs.py
new file mode 100644
index 00000000000..09b1c10f6eb
--- /dev/null
+++ b/python/databricks_tests/core/_generated/job_runs.py
@@ -0,0 +1,38 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from databricks.bundles.core import Resources, job_run_mutator
+from databricks.bundles.core._generated.job_runs import _resource_type
+from databricks.bundles.job_runs._models.job_run import JobRun
+from databricks.bundles.job_runs._models.job_run_lifecycle import JobRunLifecycle
+from databricks.bundles.job_runs._models.performance_target import PerformanceTarget
+from databricks.bundles.job_runs._models.pipeline_params import PipelineParams
+from databricks.bundles.job_runs._models.queue_settings import QueueSettings
+from databricks_tests.core._resource_test_case import ResourceTestCase
+
+
+def _test_case():
+    return (
+        ResourceTestCase(
+            add_resource=Resources.add_job_run,
+            dict_example={
+                "job_id": 0,
+                "job_parameters": {"key": "value"},
+                "lifecycle": {},
+                "only": ["only"],
+                "performance_target": "PERFORMANCE_OPTIMIZED",
+                "pipeline_params": {},
+                "queue": {"enabled": True},
+            },
+            dataclass_example=JobRun(
+                job_id=0,
+                job_parameters={"key": "value"},
+                lifecycle=JobRunLifecycle(),
+                only=["only"],
+                performance_target=PerformanceTarget.PERFORMANCE_OPTIMIZED,
+                pipeline_params=PipelineParams(),
+                queue=QueueSettings(enabled=True),
+            ),
+            mutator=job_run_mutator,
+        ),
+        _resource_type(),
+    )
diff --git a/python/databricks_tests/core/_generated/jobs.py b/python/databricks_tests/core/_generated/jobs.py
new file mode 100644
index 00000000000..3ed344b3811
--- /dev/null
+++ b/python/databricks_tests/core/_generated/jobs.py
@@ -0,0 +1,89 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from databricks.bundles.core import Resources, job_mutator
+from databricks.bundles.core._generated.jobs import _resource_type
+from databricks.bundles.jobs._models.continuous import Continuous
+from databricks.bundles.jobs._models.cron_schedule import CronSchedule
+from databricks.bundles.jobs._models.git_provider import GitProvider
+from databricks.bundles.jobs._models.git_source import GitSource
+from databricks.bundles.jobs._models.job import Job
+from databricks.bundles.jobs._models.job_cluster import JobCluster
+from databricks.bundles.jobs._models.job_email_notifications import (
+    JobEmailNotifications,
+)
+from databricks.bundles.jobs._models.job_environment import JobEnvironment
+from databricks.bundles.jobs._models.job_notification_settings import (
+    JobNotificationSettings,
+)
+from databricks.bundles.jobs._models.job_parameter_definition import (
+    JobParameterDefinition,
+)
+from databricks.bundles.jobs._models.job_permission import JobPermission
+from databricks.bundles.jobs._models.job_permission_level import JobPermissionLevel
+from databricks.bundles.jobs._models.job_run_as import JobRunAs
+from databricks.bundles.jobs._models.jobs_health_rules import JobsHealthRules
+from databricks.bundles.jobs._models.lifecycle import Lifecycle
+from databricks.bundles.jobs._models.performance_target import PerformanceTarget
+from databricks.bundles.jobs._models.queue_settings import QueueSettings
+from databricks.bundles.jobs._models.task import Task
+from databricks.bundles.jobs._models.trigger_settings import TriggerSettings
+from databricks.bundles.jobs._models.webhook_notifications import WebhookNotifications
+from databricks_tests.core._resource_test_case import ResourceTestCase
+
+
+def _test_case():
+    return (
+        ResourceTestCase(
+            add_resource=Resources.add_job,
+            dict_example={
+                "continuous": {},
+                "email_notifications": {},
+                "environments": [{"environment_key": "environment_key"}],
+                "git_source": {"git_provider": "gitHub", "git_url": "git_url"},
+                "health": {},
+                "job_clusters": [{"job_cluster_key": "job_cluster_key"}],
+                "lifecycle": {},
+                "notification_settings": {},
+                "parameters": [{"default": "default", "name": "name"}],
+                "performance_target": "PERFORMANCE_OPTIMIZED",
+                "permissions": [{"level": "CAN_MANAGE"}],
+                "queue": {"enabled": True},
+                "run_as": {},
+                "schedule": {
+                    "quartz_cron_expression": "quartz_cron_expression",
+                    "timezone_id": "timezone_id",
+                },
+                "tags": {"key": "value"},
+                "tasks": [{"task_key": "task_key"}],
+                "trigger": {},
+                "webhook_notifications": {},
+            },
+            dataclass_example=Job(
+                continuous=Continuous(),
+                email_notifications=JobEmailNotifications(),
+                environments=[JobEnvironment(environment_key="environment_key")],
+                git_source=GitSource(
+                    git_provider=GitProvider.GIT_HUB, git_url="git_url"
+                ),
+                health=JobsHealthRules(),
+                job_clusters=[JobCluster(job_cluster_key="job_cluster_key")],
+                lifecycle=Lifecycle(),
+                notification_settings=JobNotificationSettings(),
+                parameters=[JobParameterDefinition(default="default", name="name")],
+                performance_target=PerformanceTarget.PERFORMANCE_OPTIMIZED,
+                permissions=[JobPermission(level=JobPermissionLevel.CAN_MANAGE)],
+                queue=QueueSettings(enabled=True),
+                run_as=JobRunAs(),
+                schedule=CronSchedule(
+                    quartz_cron_expression="quartz_cron_expression",
+                    timezone_id="timezone_id",
+                ),
+                tags={"key": "value"},
+                tasks=[Task(task_key="task_key")],
+                trigger=TriggerSettings(),
+                webhook_notifications=WebhookNotifications(),
+            ),
+            mutator=job_mutator,
+        ),
+        _resource_type(),
+    )
diff --git a/python/databricks_tests/core/_generated/mcp_services.py b/python/databricks_tests/core/_generated/mcp_services.py
new file mode 100644
index 00000000000..ca1247a300d
--- /dev/null
+++ b/python/databricks_tests/core/_generated/mcp_services.py
@@ -0,0 +1,35 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from databricks.bundles.core import Resources, mcp_service_mutator
+from databricks.bundles.core._generated.mcp_services import _resource_type
+from databricks.bundles.mcp_services._models.lifecycle import Lifecycle
+from databricks.bundles.mcp_services._models.mcp_service import McpService
+from databricks.bundles.mcp_services._models.mcp_service_config import McpServiceConfig
+from databricks.bundles.mcp_services._models.privilege_assignment import (
+    PrivilegeAssignment,
+)
+from databricks_tests.core._resource_test_case import ResourceTestCase
+
+
+def _test_case():
+    return (
+        ResourceTestCase(
+            add_resource=Resources.add_mcp_service,
+            dict_example={
+                "config": {},
+                "grants": [{}],
+                "lifecycle": {},
+                "mcp_service_id": "mcp_service_id",
+                "parent": "parent",
+            },
+            dataclass_example=McpService(
+                config=McpServiceConfig(),
+                grants=[PrivilegeAssignment()],
+                lifecycle=Lifecycle(),
+                mcp_service_id="mcp_service_id",
+                parent="parent",
+            ),
+            mutator=mcp_service_mutator,
+        ),
+        _resource_type(),
+    )
diff --git a/python/databricks_tests/core/_generated/model_provider_services.py b/python/databricks_tests/core/_generated/model_provider_services.py
new file mode 100644
index 00000000000..994624aeee8
--- /dev/null
+++ b/python/databricks_tests/core/_generated/model_provider_services.py
@@ -0,0 +1,39 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from databricks.bundles.core import Resources, model_provider_service_mutator
+from databricks.bundles.core._generated.model_provider_services import _resource_type
+from databricks.bundles.model_provider_services._models.lifecycle import Lifecycle
+from databricks.bundles.model_provider_services._models.model_provider_service import (
+    ModelProviderService,
+)
+from databricks.bundles.model_provider_services._models.model_provider_service_config import (
+    ModelProviderServiceConfig,
+)
+from databricks.bundles.model_provider_services._models.privilege_assignment import (
+    PrivilegeAssignment,
+)
+from databricks_tests.core._resource_test_case import ResourceTestCase
+
+
+def _test_case():
+    return (
+        ResourceTestCase(
+            add_resource=Resources.add_model_provider_service,
+            dict_example={
+                "config": {},
+                "grants": [{}],
+                "lifecycle": {},
+                "model_provider_service_id": "model_provider_service_id",
+                "parent": "parent",
+            },
+            dataclass_example=ModelProviderService(
+                config=ModelProviderServiceConfig(),
+                grants=[PrivilegeAssignment()],
+                lifecycle=Lifecycle(),
+                model_provider_service_id="model_provider_service_id",
+                parent="parent",
+            ),
+            mutator=model_provider_service_mutator,
+        ),
+        _resource_type(),
+    )
diff --git a/python/databricks_tests/core/_generated/model_services.py b/python/databricks_tests/core/_generated/model_services.py
new file mode 100644
index 00000000000..5d301ae0203
--- /dev/null
+++ b/python/databricks_tests/core/_generated/model_services.py
@@ -0,0 +1,37 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from databricks.bundles.core import Resources, model_service_mutator
+from databricks.bundles.core._generated.model_services import _resource_type
+from databricks.bundles.model_services._models.lifecycle import Lifecycle
+from databricks.bundles.model_services._models.model_service import ModelService
+from databricks.bundles.model_services._models.model_service_config import (
+    ModelServiceConfig,
+)
+from databricks.bundles.model_services._models.privilege_assignment import (
+    PrivilegeAssignment,
+)
+from databricks_tests.core._resource_test_case import ResourceTestCase
+
+
+def _test_case():
+    return (
+        ResourceTestCase(
+            add_resource=Resources.add_model_service,
+            dict_example={
+                "config": {},
+                "grants": [{}],
+                "lifecycle": {},
+                "model_service_id": "model_service_id",
+                "parent": "parent",
+            },
+            dataclass_example=ModelService(
+                config=ModelServiceConfig(),
+                grants=[PrivilegeAssignment()],
+                lifecycle=Lifecycle(),
+                model_service_id="model_service_id",
+                parent="parent",
+            ),
+            mutator=model_service_mutator,
+        ),
+        _resource_type(),
+    )
diff --git a/python/databricks_tests/core/_generated/model_serving_endpoints.py b/python/databricks_tests/core/_generated/model_serving_endpoints.py
new file mode 100644
index 00000000000..f658d74e899
--- /dev/null
+++ b/python/databricks_tests/core/_generated/model_serving_endpoints.py
@@ -0,0 +1,62 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from databricks.bundles.core import Resources, model_serving_endpoint_mutator
+from databricks.bundles.core._generated.model_serving_endpoints import _resource_type
+from databricks.bundles.model_serving_endpoints._models.ai_gateway_config import (
+    AiGatewayConfig,
+)
+from databricks.bundles.model_serving_endpoints._models.email_notifications import (
+    EmailNotifications,
+)
+from databricks.bundles.model_serving_endpoints._models.endpoint_core_config_input import (
+    EndpointCoreConfigInput,
+)
+from databricks.bundles.model_serving_endpoints._models.endpoint_tag import EndpointTag
+from databricks.bundles.model_serving_endpoints._models.lifecycle import Lifecycle
+from databricks.bundles.model_serving_endpoints._models.model_serving_endpoint import (
+    ModelServingEndpoint,
+)
+from databricks.bundles.model_serving_endpoints._models.model_serving_endpoint_permission import (
+    ModelServingEndpointPermission,
+)
+from databricks.bundles.model_serving_endpoints._models.serving_endpoint_permission_level import (
+    ServingEndpointPermissionLevel,
+)
+from databricks.bundles.model_serving_endpoints._models.telemetry_config import (
+    TelemetryConfig,
+)
+from databricks_tests.core._resource_test_case import ResourceTestCase
+
+
+def _test_case():
+    return (
+        ResourceTestCase(
+            add_resource=Resources.add_model_serving_endpoint,
+            dict_example={
+                "ai_gateway": {},
+                "config": {},
+                "email_notifications": {},
+                "lifecycle": {},
+                "name": "name",
+                "permissions": [{"level": "CAN_MANAGE"}],
+                "tags": [{"key": "key"}],
+                "telemetry_config": {},
+            },
+            dataclass_example=ModelServingEndpoint(
+                ai_gateway=AiGatewayConfig(),
+                config=EndpointCoreConfigInput(),
+                email_notifications=EmailNotifications(),
+                lifecycle=Lifecycle(),
+                name="name",
+                permissions=[
+                    ModelServingEndpointPermission(
+                        level=ServingEndpointPermissionLevel.CAN_MANAGE
+                    )
+                ],
+                tags=[EndpointTag(key="key")],
+                telemetry_config=TelemetryConfig(),
+            ),
+            mutator=model_serving_endpoint_mutator,
+        ),
+        _resource_type(),
+    )
diff --git a/python/databricks_tests/core/_generated/models.py b/python/databricks_tests/core/_generated/models.py
new file mode 100644
index 00000000000..e1c3c16deea
--- /dev/null
+++ b/python/databricks_tests/core/_generated/models.py
@@ -0,0 +1,40 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from databricks.bundles.core import Resources, mlflow_model_mutator
+from databricks.bundles.core._generated.models import _resource_type
+from databricks.bundles.models._models.lifecycle import Lifecycle
+from databricks.bundles.models._models.mlflow_model import MlflowModel
+from databricks.bundles.models._models.mlflow_model_permission import (
+    MlflowModelPermission,
+)
+from databricks.bundles.models._models.model_tag import ModelTag
+from databricks.bundles.models._models.registered_model_permission_level import (
+    RegisteredModelPermissionLevel,
+)
+from databricks_tests.core._resource_test_case import ResourceTestCase
+
+
+def _test_case():
+    return (
+        ResourceTestCase(
+            add_resource=Resources.add_mlflow_model,
+            dict_example={
+                "lifecycle": {},
+                "name": "name",
+                "permissions": [{"level": "CAN_MANAGE"}],
+                "tags": [{}],
+            },
+            dataclass_example=MlflowModel(
+                lifecycle=Lifecycle(),
+                name="name",
+                permissions=[
+                    MlflowModelPermission(
+                        level=RegisteredModelPermissionLevel.CAN_MANAGE
+                    )
+                ],
+                tags=[ModelTag()],
+            ),
+            mutator=mlflow_model_mutator,
+        ),
+        _resource_type(),
+    )
diff --git a/python/databricks_tests/core/_generated/pipelines.py b/python/databricks_tests/core/_generated/pipelines.py
new file mode 100644
index 00000000000..46ecc044b1f
--- /dev/null
+++ b/python/databricks_tests/core/_generated/pipelines.py
@@ -0,0 +1,63 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from databricks.bundles.core import Resources, pipeline_mutator
+from databricks.bundles.core._generated.pipelines import _resource_type
+from databricks.bundles.pipelines._models.event_log_spec import EventLogSpec
+from databricks.bundles.pipelines._models.filters import Filters
+from databricks.bundles.pipelines._models.ingestion_pipeline_definition import (
+    IngestionPipelineDefinition,
+)
+from databricks.bundles.pipelines._models.lifecycle import Lifecycle
+from databricks.bundles.pipelines._models.notifications import Notifications
+from databricks.bundles.pipelines._models.pipeline import Pipeline
+from databricks.bundles.pipelines._models.pipeline_cluster import PipelineCluster
+from databricks.bundles.pipelines._models.pipeline_library import PipelineLibrary
+from databricks.bundles.pipelines._models.pipeline_permission import PipelinePermission
+from databricks.bundles.pipelines._models.pipeline_permission_level import (
+    PipelinePermissionLevel,
+)
+from databricks.bundles.pipelines._models.pipelines_environment import (
+    PipelinesEnvironment,
+)
+from databricks.bundles.pipelines._models.run_as import RunAs
+from databricks_tests.core._resource_test_case import ResourceTestCase
+
+
+def _test_case():
+    return (
+        ResourceTestCase(
+            add_resource=Resources.add_pipeline,
+            dict_example={
+                "clusters": [{}],
+                "configuration": {"key": "value"},
+                "environment": {},
+                "event_log": {},
+                "filters": {},
+                "ingestion_definition": {},
+                "libraries": [{}],
+                "lifecycle": {},
+                "notifications": [{}],
+                "permissions": [{"level": "CAN_MANAGE"}],
+                "run_as": {},
+                "tags": {"key": "value"},
+            },
+            dataclass_example=Pipeline(
+                clusters=[PipelineCluster()],
+                configuration={"key": "value"},
+                environment=PipelinesEnvironment(),
+                event_log=EventLogSpec(),
+                filters=Filters(),
+                ingestion_definition=IngestionPipelineDefinition(),
+                libraries=[PipelineLibrary()],
+                lifecycle=Lifecycle(),
+                notifications=[Notifications()],
+                permissions=[
+                    PipelinePermission(level=PipelinePermissionLevel.CAN_MANAGE)
+                ],
+                run_as=RunAs(),
+                tags={"key": "value"},
+            ),
+            mutator=pipeline_mutator,
+        ),
+        _resource_type(),
+    )
diff --git a/python/databricks_tests/core/_generated/quality_monitors.py b/python/databricks_tests/core/_generated/quality_monitors.py
new file mode 100644
index 00000000000..4e244d7cdd5
--- /dev/null
+++ b/python/databricks_tests/core/_generated/quality_monitors.py
@@ -0,0 +1,102 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from databricks.bundles.core import Resources, quality_monitor_mutator
+from databricks.bundles.core._generated.quality_monitors import _resource_type
+from databricks.bundles.quality_monitors._models.lifecycle import Lifecycle
+from databricks.bundles.quality_monitors._models.monitor_cron_schedule import (
+    MonitorCronSchedule,
+)
+from databricks.bundles.quality_monitors._models.monitor_inference_log import (
+    MonitorInferenceLog,
+)
+from databricks.bundles.quality_monitors._models.monitor_inference_log_problem_type import (
+    MonitorInferenceLogProblemType,
+)
+from databricks.bundles.quality_monitors._models.monitor_metric import MonitorMetric
+from databricks.bundles.quality_monitors._models.monitor_metric_type import (
+    MonitorMetricType,
+)
+from databricks.bundles.quality_monitors._models.monitor_notifications import (
+    MonitorNotifications,
+)
+from databricks.bundles.quality_monitors._models.monitor_snapshot import MonitorSnapshot
+from databricks.bundles.quality_monitors._models.monitor_time_series import (
+    MonitorTimeSeries,
+)
+from databricks.bundles.quality_monitors._models.quality_monitor import QualityMonitor
+from databricks_tests.core._resource_test_case import ResourceTestCase
+
+
+def _test_case():
+    return (
+        ResourceTestCase(
+            add_resource=Resources.add_quality_monitor,
+            dict_example={
+                "assets_dir": "assets_dir",
+                "custom_metrics": [
+                    {
+                        "definition": "definition",
+                        "input_columns": ["input_columns"],
+                        "name": "name",
+                        "output_data_type": "output_data_type",
+                        "type": "CUSTOM_METRIC_TYPE_AGGREGATE",
+                    }
+                ],
+                "inference_log": {
+                    "granularities": ["granularities"],
+                    "model_id_col": "model_id_col",
+                    "prediction_col": "prediction_col",
+                    "problem_type": "PROBLEM_TYPE_CLASSIFICATION",
+                    "timestamp_col": "timestamp_col",
+                },
+                "lifecycle": {},
+                "notifications": {},
+                "output_schema_name": "output_schema_name",
+                "schedule": {
+                    "quartz_cron_expression": "quartz_cron_expression",
+                    "timezone_id": "timezone_id",
+                },
+                "slicing_exprs": ["slicing_exprs"],
+                "snapshot": {},
+                "table_name": "table_name",
+                "time_series": {
+                    "granularities": ["granularities"],
+                    "timestamp_col": "timestamp_col",
+                },
+            },
+            dataclass_example=QualityMonitor(
+                assets_dir="assets_dir",
+                custom_metrics=[
+                    MonitorMetric(
+                        definition="definition",
+                        input_columns=["input_columns"],
+                        name="name",
+                        output_data_type="output_data_type",
+                        type=MonitorMetricType.CUSTOM_METRIC_TYPE_AGGREGATE,
+                    )
+                ],
+                inference_log=MonitorInferenceLog(
+                    granularities=["granularities"],
+                    model_id_col="model_id_col",
+                    prediction_col="prediction_col",
+                    problem_type=MonitorInferenceLogProblemType.PROBLEM_TYPE_CLASSIFICATION,
+                    timestamp_col="timestamp_col",
+                ),
+                lifecycle=Lifecycle(),
+                notifications=MonitorNotifications(),
+                output_schema_name="output_schema_name",
+                schedule=MonitorCronSchedule(
+                    quartz_cron_expression="quartz_cron_expression",
+                    timezone_id="timezone_id",
+                ),
+                slicing_exprs=["slicing_exprs"],
+                snapshot=MonitorSnapshot(),
+                table_name="table_name",
+                time_series=MonitorTimeSeries(
+                    granularities=["granularities"], timestamp_col="timestamp_col"
+                ),
+            ),
+            mutator=quality_monitor_mutator,
+        ),
+        _resource_type(),
+    )
diff --git a/python/databricks_tests/core/_generated/registered_models.py b/python/databricks_tests/core/_generated/registered_models.py
new file mode 100644
index 00000000000..81d5f2d7ed4
--- /dev/null
+++ b/python/databricks_tests/core/_generated/registered_models.py
@@ -0,0 +1,31 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from databricks.bundles.core import Resources, registered_model_mutator
+from databricks.bundles.core._generated.registered_models import _resource_type
+from databricks.bundles.registered_models._models.lifecycle import Lifecycle
+from databricks.bundles.registered_models._models.privilege_assignment import (
+    PrivilegeAssignment,
+)
+from databricks.bundles.registered_models._models.registered_model import (
+    RegisteredModel,
+)
+from databricks.bundles.registered_models._models.registered_model_alias import (
+    RegisteredModelAlias,
+)
+from databricks_tests.core._resource_test_case import ResourceTestCase
+
+
+def _test_case():
+    return (
+        ResourceTestCase(
+            add_resource=Resources.add_registered_model,
+            dict_example={"aliases": [{}], "grants": [{}], "lifecycle": {}},
+            dataclass_example=RegisteredModel(
+                aliases=[RegisteredModelAlias()],
+                grants=[PrivilegeAssignment()],
+                lifecycle=Lifecycle(),
+            ),
+            mutator=registered_model_mutator,
+        ),
+        _resource_type(),
+    )
diff --git a/python/databricks_tests/core/_generated/schemas.py b/python/databricks_tests/core/_generated/schemas.py
new file mode 100644
index 00000000000..576b0c7d3cd
--- /dev/null
+++ b/python/databricks_tests/core/_generated/schemas.py
@@ -0,0 +1,32 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from databricks.bundles.core import Resources, schema_mutator
+from databricks.bundles.core._generated.schemas import _resource_type
+from databricks.bundles.schemas._models.lifecycle import Lifecycle
+from databricks.bundles.schemas._models.privilege_assignment import PrivilegeAssignment
+from databricks.bundles.schemas._models.schema import Schema
+from databricks_tests.core._resource_test_case import ResourceTestCase
+
+
+def _test_case():
+    return (
+        ResourceTestCase(
+            add_resource=Resources.add_schema,
+            dict_example={
+                "catalog_name": "catalog_name",
+                "grants": [{}],
+                "lifecycle": {},
+                "name": "name",
+                "properties": {"key": "value"},
+            },
+            dataclass_example=Schema(
+                catalog_name="catalog_name",
+                grants=[PrivilegeAssignment()],
+                lifecycle=Lifecycle(),
+                name="name",
+                properties={"key": "value"},
+            ),
+            mutator=schema_mutator,
+        ),
+        _resource_type(),
+    )
diff --git a/python/databricks_tests/core/_generated/secret_scopes.py b/python/databricks_tests/core/_generated/secret_scopes.py
new file mode 100644
index 00000000000..8edc6ce6e1b
--- /dev/null
+++ b/python/databricks_tests/core/_generated/secret_scopes.py
@@ -0,0 +1,48 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from databricks.bundles.core import Resources, secret_scope_mutator
+from databricks.bundles.core._generated.secret_scopes import _resource_type
+from databricks.bundles.secret_scopes._models.azure_key_vault_secret_scope_metadata import (
+    AzureKeyVaultSecretScopeMetadata,
+)
+from databricks.bundles.secret_scopes._models.lifecycle import Lifecycle
+from databricks.bundles.secret_scopes._models.scope_backend_type import ScopeBackendType
+from databricks.bundles.secret_scopes._models.secret_scope import SecretScope
+from databricks.bundles.secret_scopes._models.secret_scope_permission import (
+    SecretScopePermission,
+)
+from databricks.bundles.secret_scopes._models.secret_scope_permission_level import (
+    SecretScopePermissionLevel,
+)
+from databricks_tests.core._resource_test_case import ResourceTestCase
+
+
+def _test_case():
+    return (
+        ResourceTestCase(
+            add_resource=Resources.add_secret_scope,
+            dict_example={
+                "backend_type": "DATABRICKS",
+                "keyvault_metadata": {
+                    "dns_name": "dns_name",
+                    "resource_id": "resource_id",
+                },
+                "lifecycle": {},
+                "name": "name",
+                "permissions": [{"level": "READ"}],
+            },
+            dataclass_example=SecretScope(
+                backend_type=ScopeBackendType.DATABRICKS,
+                keyvault_metadata=AzureKeyVaultSecretScopeMetadata(
+                    dns_name="dns_name", resource_id="resource_id"
+                ),
+                lifecycle=Lifecycle(),
+                name="name",
+                permissions=[
+                    SecretScopePermission(level=SecretScopePermissionLevel.READ)
+                ],
+            ),
+            mutator=secret_scope_mutator,
+        ),
+        _resource_type(),
+    )
diff --git a/python/databricks_tests/core/_generated/secrets.py b/python/databricks_tests/core/_generated/secrets.py
new file mode 100644
index 00000000000..65e782459d3
--- /dev/null
+++ b/python/databricks_tests/core/_generated/secrets.py
@@ -0,0 +1,34 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from databricks.bundles.core import Resources, secret_mutator
+from databricks.bundles.core._generated.secrets import _resource_type
+from databricks.bundles.secrets._models.lifecycle import Lifecycle
+from databricks.bundles.secrets._models.privilege_assignment import PrivilegeAssignment
+from databricks.bundles.secrets._models.secret import Secret
+from databricks_tests.core._resource_test_case import ResourceTestCase
+
+
+def _test_case():
+    return (
+        ResourceTestCase(
+            add_resource=Resources.add_secret,
+            dict_example={
+                "catalog_name": "catalog_name",
+                "grants": [{}],
+                "lifecycle": {},
+                "name": "name",
+                "schema_name": "schema_name",
+                "value": "value",
+            },
+            dataclass_example=Secret(
+                catalog_name="catalog_name",
+                grants=[PrivilegeAssignment()],
+                lifecycle=Lifecycle(),
+                name="name",
+                schema_name="schema_name",
+                value="value",
+            ),
+            mutator=secret_mutator,
+        ),
+        _resource_type(),
+    )
diff --git a/python/databricks_tests/core/_generated/sql_warehouses.py b/python/databricks_tests/core/_generated/sql_warehouses.py
new file mode 100644
index 00000000000..e6810ecd57c
--- /dev/null
+++ b/python/databricks_tests/core/_generated/sql_warehouses.py
@@ -0,0 +1,51 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from databricks.bundles.core import Resources, sql_warehouse_mutator
+from databricks.bundles.core._generated.sql_warehouses import _resource_type
+from databricks.bundles.sql_warehouses._models.channel import Channel
+from databricks.bundles.sql_warehouses._models.create_warehouse_request_warehouse_type import (
+    CreateWarehouseRequestWarehouseType,
+)
+from databricks.bundles.sql_warehouses._models.endpoint_tags import EndpointTags
+from databricks.bundles.sql_warehouses._models.lifecycle_with_started import (
+    LifecycleWithStarted,
+)
+from databricks.bundles.sql_warehouses._models.spot_instance_policy import (
+    SpotInstancePolicy,
+)
+from databricks.bundles.sql_warehouses._models.sql_warehouse import SqlWarehouse
+from databricks.bundles.sql_warehouses._models.sql_warehouse_permission import (
+    SqlWarehousePermission,
+)
+from databricks.bundles.sql_warehouses._models.warehouse_permission_level import (
+    WarehousePermissionLevel,
+)
+from databricks_tests.core._resource_test_case import ResourceTestCase
+
+
+def _test_case():
+    return (
+        ResourceTestCase(
+            add_resource=Resources.add_sql_warehouse,
+            dict_example={
+                "channel": {},
+                "lifecycle": {},
+                "permissions": [{"level": "CAN_MANAGE"}],
+                "spot_instance_policy": "POLICY_UNSPECIFIED",
+                "tags": {},
+                "warehouse_type": "TYPE_UNSPECIFIED",
+            },
+            dataclass_example=SqlWarehouse(
+                channel=Channel(),
+                lifecycle=LifecycleWithStarted(),
+                permissions=[
+                    SqlWarehousePermission(level=WarehousePermissionLevel.CAN_MANAGE)
+                ],
+                spot_instance_policy=SpotInstancePolicy.POLICY_UNSPECIFIED,
+                tags=EndpointTags(),
+                warehouse_type=CreateWarehouseRequestWarehouseType.TYPE_UNSPECIFIED,
+            ),
+            mutator=sql_warehouse_mutator,
+        ),
+        _resource_type(),
+    )
diff --git a/python/databricks_tests/core/_generated/synced_database_tables.py b/python/databricks_tests/core/_generated/synced_database_tables.py
new file mode 100644
index 00000000000..dea7172089a
--- /dev/null
+++ b/python/databricks_tests/core/_generated/synced_database_tables.py
@@ -0,0 +1,26 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from databricks.bundles.core import Resources, synced_database_table_mutator
+from databricks.bundles.core._generated.synced_database_tables import _resource_type
+from databricks.bundles.synced_database_tables._models.lifecycle import Lifecycle
+from databricks.bundles.synced_database_tables._models.synced_database_table import (
+    SyncedDatabaseTable,
+)
+from databricks.bundles.synced_database_tables._models.synced_table_spec import (
+    SyncedTableSpec,
+)
+from databricks_tests.core._resource_test_case import ResourceTestCase
+
+
+def _test_case():
+    return (
+        ResourceTestCase(
+            add_resource=Resources.add_synced_database_table,
+            dict_example={"lifecycle": {}, "name": "name", "spec": {}},
+            dataclass_example=SyncedDatabaseTable(
+                lifecycle=Lifecycle(), name="name", spec=SyncedTableSpec()
+            ),
+            mutator=synced_database_table_mutator,
+        ),
+        _resource_type(),
+    )
diff --git a/python/databricks_tests/core/_generated/vector_search_endpoints.py b/python/databricks_tests/core/_generated/vector_search_endpoints.py
new file mode 100644
index 00000000000..30bdb70e91e
--- /dev/null
+++ b/python/databricks_tests/core/_generated/vector_search_endpoints.py
@@ -0,0 +1,44 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from databricks.bundles.core import Resources, vector_search_endpoint_mutator
+from databricks.bundles.core._generated.vector_search_endpoints import _resource_type
+from databricks.bundles.vector_search_endpoints._models.endpoint_type import (
+    EndpointType,
+)
+from databricks.bundles.vector_search_endpoints._models.lifecycle import Lifecycle
+from databricks.bundles.vector_search_endpoints._models.vector_search_endpoint import (
+    VectorSearchEndpoint,
+)
+from databricks.bundles.vector_search_endpoints._models.vector_search_endpoint_permission import (
+    VectorSearchEndpointPermission,
+)
+from databricks.bundles.vector_search_endpoints._models.vector_search_endpoint_permission_level import (
+    VectorSearchEndpointPermissionLevel,
+)
+from databricks_tests.core._resource_test_case import ResourceTestCase
+
+
+def _test_case():
+    return (
+        ResourceTestCase(
+            add_resource=Resources.add_vector_search_endpoint,
+            dict_example={
+                "endpoint_type": "STORAGE_OPTIMIZED",
+                "lifecycle": {},
+                "name": "name",
+                "permissions": [{"level": "CAN_CREATE"}],
+            },
+            dataclass_example=VectorSearchEndpoint(
+                endpoint_type=EndpointType.STORAGE_OPTIMIZED,
+                lifecycle=Lifecycle(),
+                name="name",
+                permissions=[
+                    VectorSearchEndpointPermission(
+                        level=VectorSearchEndpointPermissionLevel.CAN_CREATE
+                    )
+                ],
+            ),
+            mutator=vector_search_endpoint_mutator,
+        ),
+        _resource_type(),
+    )
diff --git a/python/databricks_tests/core/_generated/vector_search_indexes.py b/python/databricks_tests/core/_generated/vector_search_indexes.py
new file mode 100644
index 00000000000..d72ed337f55
--- /dev/null
+++ b/python/databricks_tests/core/_generated/vector_search_indexes.py
@@ -0,0 +1,51 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from databricks.bundles.core import Resources, vector_search_index_mutator
+from databricks.bundles.core._generated.vector_search_indexes import _resource_type
+from databricks.bundles.vector_search_indexes._models.delta_sync_vector_index_spec_request import (
+    DeltaSyncVectorIndexSpecRequest,
+)
+from databricks.bundles.vector_search_indexes._models.direct_access_vector_index_spec import (
+    DirectAccessVectorIndexSpec,
+)
+from databricks.bundles.vector_search_indexes._models.lifecycle import Lifecycle
+from databricks.bundles.vector_search_indexes._models.privilege_assignment import (
+    PrivilegeAssignment,
+)
+from databricks.bundles.vector_search_indexes._models.vector_index_type import (
+    VectorIndexType,
+)
+from databricks.bundles.vector_search_indexes._models.vector_search_index import (
+    VectorSearchIndex,
+)
+from databricks_tests.core._resource_test_case import ResourceTestCase
+
+
+def _test_case():
+    return (
+        ResourceTestCase(
+            add_resource=Resources.add_vector_search_index,
+            dict_example={
+                "delta_sync_index_spec": {},
+                "direct_access_index_spec": {},
+                "endpoint_name": "endpoint_name",
+                "grants": [{}],
+                "index_type": "DELTA_SYNC",
+                "lifecycle": {},
+                "name": "name",
+                "primary_key": "primary_key",
+            },
+            dataclass_example=VectorSearchIndex(
+                delta_sync_index_spec=DeltaSyncVectorIndexSpecRequest(),
+                direct_access_index_spec=DirectAccessVectorIndexSpec(),
+                endpoint_name="endpoint_name",
+                grants=[PrivilegeAssignment()],
+                index_type=VectorIndexType.DELTA_SYNC,
+                lifecycle=Lifecycle(),
+                name="name",
+                primary_key="primary_key",
+            ),
+            mutator=vector_search_index_mutator,
+        ),
+        _resource_type(),
+    )
diff --git a/python/databricks_tests/core/_generated/volumes.py b/python/databricks_tests/core/_generated/volumes.py
new file mode 100644
index 00000000000..58d1b9a4459
--- /dev/null
+++ b/python/databricks_tests/core/_generated/volumes.py
@@ -0,0 +1,35 @@
+# Code generated by pydabs-codegen. DO NOT EDIT.
+
+from databricks.bundles.core import Resources, volume_mutator
+from databricks.bundles.core._generated.volumes import _resource_type
+from databricks.bundles.volumes._models.lifecycle import Lifecycle
+from databricks.bundles.volumes._models.privilege_assignment import PrivilegeAssignment
+from databricks.bundles.volumes._models.volume import Volume
+from databricks.bundles.volumes._models.volume_type import VolumeType
+from databricks_tests.core._resource_test_case import ResourceTestCase
+
+
+def _test_case():
+    return (
+        ResourceTestCase(
+            add_resource=Resources.add_volume,
+            dict_example={
+                "catalog_name": "catalog_name",
+                "grants": [{}],
+                "lifecycle": {},
+                "name": "name",
+                "schema_name": "schema_name",
+                "volume_type": "MANAGED",
+            },
+            dataclass_example=Volume(
+                catalog_name="catalog_name",
+                grants=[PrivilegeAssignment()],
+                lifecycle=Lifecycle(),
+                name="name",
+                schema_name="schema_name",
+                volume_type=VolumeType.MANAGED,
+            ),
+            mutator=volume_mutator,
+        ),
+        _resource_type(),
+    )
diff --git a/python/databricks_tests/core/_resource_test_case.py b/python/databricks_tests/core/_resource_test_case.py
new file mode 100644
index 00000000000..2c9c8220f64
--- /dev/null
+++ b/python/databricks_tests/core/_resource_test_case.py
@@ -0,0 +1,12 @@
+from dataclasses import dataclass
+from typing import Callable
+
+from databricks.bundles.core._resource import Resource
+
+
+@dataclass(kw_only=True)
+class ResourceTestCase:
+    add_resource: Callable
+    dict_example: dict
+    dataclass_example: Resource
+    mutator: Callable
diff --git a/python/databricks_tests/core/public_api.txt b/python/databricks_tests/core/public_api.txt
new file mode 100644
index 00000000000..3c34aac5aa2
--- /dev/null
+++ b/python/databricks_tests/core/public_api.txt
@@ -0,0 +1,345 @@
+== module databricks.bundles.core ==
+__all__ = [
+    Bundle,
+    Diagnostic,
+    Diagnostics,
+    Location,
+    Resource,
+    ResourceMutator,
+    Resources,
+    Severity,
+    Variable,
+    VariableOr,
+    VariableOrDict,
+    VariableOrList,
+    VariableOrOptional,
+    alert_mutator,
+    app_mutator,
+    catalog_mutator,
+    cluster_mutator,
+    cluster_policy_mutator,
+    dashboard_mutator,
+    database_catalog_mutator,
+    database_instance_mutator,
+    external_location_mutator,
+    feature_mutator,
+    genie_space_mutator,
+    instance_pool_mutator,
+    job_mutator,
+    job_run_mutator,
+    load_resources_from_current_package_module,
+    load_resources_from_module,
+    load_resources_from_modules,
+    load_resources_from_package_module,
+    mcp_service_mutator,
+    mlflow_experiment_mutator,
+    mlflow_model_mutator,
+    model_provider_service_mutator,
+    model_service_mutator,
+    model_serving_endpoint_mutator,
+    pipeline_mutator,
+    quality_monitor_mutator,
+    registered_model_mutator,
+    schema_mutator,
+    secret_mutator,
+    secret_scope_mutator,
+    sql_warehouse_mutator,
+    synced_database_table_mutator,
+    variables,
+    vector_search_endpoint_mutator,
+    vector_search_index_mutator,
+    volume_mutator,
+]
+
+class Bundle:
+    target: str
+    variables: dict[str, Any] = <factory>
+    def resolve_variable(self, variable: Union[Variable[_T], _T]) -> _T
+    def resolve_variable_list(self, variable: Union[Variable[list[Union[Variable[_T], _T]]], list[Union[Variable[_T], _T]]]) -> list[_T]
+
+class Diagnostic:
+    severity: Severity
+    summary: str
+    detail: Union[str, None] = None
+    path: Union[tuple[str, ...], None] = None
+    location: Union[Location, None] = None
+    def as_dict(self) -> dict
+
+class Diagnostics:
+    items: tuple[Diagnostic, ...] = <factory>
+    @classmethod def create_error(msg: str, *, detail: Union[str, None] = None, location: Union[Location, None] = None, path: Union[tuple[str, ...], None] = None) -> Self
+    @classmethod def create_warning(msg: str, *, detail: Union[str, None] = None, location: Union[Location, None] = None, path: Union[tuple[str, ...], None] = None) -> Self
+    @classmethod def from_exception(exc: Exception, *, summary: str, location: Union[Location, None] = None, path: Union[tuple[str, ...], None] = None, explanation: Union[str, None] = None) -> Self
+    def extend(self, diagnostics: Self) -> Self
+    def extend_tuple(self, pair: tuple[_T, Self]) -> tuple[_T, Self]
+    def has_error(self) -> bool
+    def has_warning(self) -> bool
+
+class Location:
+    file: str
+    line: Union[int, None] = None
+    column: Union[int, None] = None
+    def as_dict(self) -> dict
+    def from_callable(fn: Callable) -> Union[Location, None]
+    def from_stack_frame(depth: int = 0) -> Location
+
+class Resource:
+
+class ResourceMutator(Generic):
+    resource_type: type[_T]
+    function: Callable
+
+class Resources:
+    def add_alert(self, resource_name: str, alert: AlertParam, *, location: Union[Location, None] = None) -> None
+    def add_app(self, resource_name: str, app: AppParam, *, location: Union[Location, None] = None) -> None
+    def add_catalog(self, resource_name: str, catalog: CatalogParam, *, location: Union[Location, None] = None) -> None
+    def add_cluster(self, resource_name: str, cluster: ClusterParam, *, location: Union[Location, None] = None) -> None
+    def add_cluster_policy(self, resource_name: str, cluster_policy: ClusterPolicyParam, *, location: Union[Location, None] = None) -> None
+    def add_dashboard(self, resource_name: str, dashboard: DashboardParam, *, location: Union[Location, None] = None) -> None
+    def add_database_catalog(self, resource_name: str, database_catalog: DatabaseCatalogParam, *, location: Union[Location, None] = None) -> None
+    def add_database_instance(self, resource_name: str, database_instance: DatabaseInstanceParam, *, location: Union[Location, None] = None) -> None
+    def add_diagnostic_error(self, msg: str, *, detail: Union[str, None] = None, path: Union[tuple[str, ...], None] = None, location: Union[Location, None] = None) -> None
+    def add_diagnostic_warning(self, msg: str, *, detail: Union[str, None] = None, path: Union[tuple[str, ...], None] = None, location: Union[Location, None] = None) -> None
+    def add_diagnostics(self, other: Diagnostics) -> None
+    def add_external_location(self, resource_name: str, external_location: ExternalLocationParam, *, location: Union[Location, None] = None) -> None
+    def add_feature(self, resource_name: str, feature: FeatureParam, *, location: Union[Location, None] = None) -> None
+    def add_genie_space(self, resource_name: str, genie_space: GenieSpaceParam, *, location: Union[Location, None] = None) -> None
+    def add_instance_pool(self, resource_name: str, instance_pool: InstancePoolParam, *, location: Union[Location, None] = None) -> None
+    def add_job(self, resource_name: str, job: JobParam, *, location: Union[Location, None] = None) -> None
+    def add_job_run(self, resource_name: str, job_run: JobRunParam, *, location: Union[Location, None] = None) -> None
+    def add_location(self, path: tuple[str, ...], location: Location) -> None
+    def add_mcp_service(self, resource_name: str, mcp_service: McpServiceParam, *, location: Union[Location, None] = None) -> None
+    def add_mlflow_experiment(self, resource_name: str, mlflow_experiment: MlflowExperimentParam, *, location: Union[Location, None] = None) -> None
+    def add_mlflow_model(self, resource_name: str, mlflow_model: MlflowModelParam, *, location: Union[Location, None] = None) -> None
+    def add_model_provider_service(self, resource_name: str, model_provider_service: ModelProviderServiceParam, *, location: Union[Location, None] = None) -> None
+    def add_model_service(self, resource_name: str, model_service: ModelServiceParam, *, location: Union[Location, None] = None) -> None
+    def add_model_serving_endpoint(self, resource_name: str, model_serving_endpoint: ModelServingEndpointParam, *, location: Union[Location, None] = None) -> None
+    def add_pipeline(self, resource_name: str, pipeline: PipelineParam, *, location: Union[Location, None] = None) -> None
+    def add_quality_monitor(self, resource_name: str, quality_monitor: QualityMonitorParam, *, location: Union[Location, None] = None) -> None
+    def add_registered_model(self, resource_name: str, registered_model: RegisteredModelParam, *, location: Union[Location, None] = None) -> None
+    def add_resource(self, resource_name: str, resource: Resource, *, location: Union[Location, None] = None) -> None
+    def add_resources(self, other: Resources) -> None
+    def add_schema(self, resource_name: str, schema: SchemaParam, *, location: Union[Location, None] = None) -> None
+    def add_secret(self, resource_name: str, secret: SecretParam, *, location: Union[Location, None] = None) -> None
+    def add_secret_scope(self, resource_name: str, secret_scope: SecretScopeParam, *, location: Union[Location, None] = None) -> None
+    def add_sql_warehouse(self, resource_name: str, sql_warehouse: SqlWarehouseParam, *, location: Union[Location, None] = None) -> None
+    def add_synced_database_table(self, resource_name: str, synced_database_table: SyncedDatabaseTableParam, *, location: Union[Location, None] = None) -> None
+    def add_vector_search_endpoint(self, resource_name: str, vector_search_endpoint: VectorSearchEndpointParam, *, location: Union[Location, None] = None) -> None
+    def add_vector_search_index(self, resource_name: str, vector_search_index: VectorSearchIndexParam, *, location: Union[Location, None] = None) -> None
+    def add_volume(self, resource_name: str, volume: VolumeParam, *, location: Union[Location, None] = None) -> None
+    @property alerts -> dict[str, Alert]
+    @property apps -> dict[str, App]
+    @property catalogs -> dict[str, Catalog]
+    @property cluster_policies -> dict[str, ClusterPolicy]
+    @property clusters -> dict[str, Cluster]
+    @property dashboards -> dict[str, Dashboard]
+    @property database_catalogs -> dict[str, DatabaseCatalog]
+    @property database_instances -> dict[str, DatabaseInstance]
+    @property diagnostics -> Diagnostics
+    @property experiments -> dict[str, MlflowExperiment]
+    @property external_locations -> dict[str, ExternalLocation]
+    @property features -> dict[str, Feature]
+    @property genie_spaces -> dict[str, GenieSpace]
+    @property instance_pools -> dict[str, InstancePool]
+    @property job_runs -> dict[str, JobRun]
+    @property jobs -> dict[str, Job]
+    @property mcp_services -> dict[str, McpService]
+    @property model_provider_services -> dict[str, ModelProviderService]
+    @property model_services -> dict[str, ModelService]
+    @property model_serving_endpoints -> dict[str, ModelServingEndpoint]
+    @property models -> dict[str, MlflowModel]
+    @property pipelines -> dict[str, Pipeline]
+    @property quality_monitors -> dict[str, QualityMonitor]
+    @property registered_models -> dict[str, RegisteredModel]
+    @property schemas -> dict[str, Schema]
+    @property secret_scopes -> dict[str, SecretScope]
+    @property secrets -> dict[str, Secret]
+    @property sql_warehouses -> dict[str, SqlWarehouse]
+    @property synced_database_tables -> dict[str, SyncedDatabaseTable]
+    @property vector_search_endpoints -> dict[str, VectorSearchEndpoint]
+    @property vector_search_indexes -> dict[str, VectorSearchIndex]
+    @property volumes -> dict[str, Volume]
+
+class Severity(Enum):
+    WARNING = 'warning'
+    ERROR = 'error'
+
+class Variable(Generic):
+    path: str
+    type: type[_T]
+    @property value -> str
+
+VariableOr = Union[Variable[_T], _T]
+
+VariableOrDict = Union[Variable[dict[str, Union[Variable[_T], _T]]], dict[str, Union[Variable[_T], _T]]]
+
+VariableOrList = Union[Variable[list[Union[Variable[_T], _T]]], list[Union[Variable[_T], _T]]]
+
+VariableOrOptional = Union[Variable[_T], _T, None]
+
+@overload def alert_mutator(function: Callable[[Bundle, Alert], Alert]) -> ResourceMutator[Alert]
+@overload def alert_mutator(function: Callable[[Alert], Alert]) -> ResourceMutator[Alert]
+def alert_mutator(function: Callable) -> ResourceMutator[Alert]
+
+@overload def app_mutator(function: Callable[[Bundle, App], App]) -> ResourceMutator[App]
+@overload def app_mutator(function: Callable[[App], App]) -> ResourceMutator[App]
+def app_mutator(function: Callable) -> ResourceMutator[App]
+
+@overload def catalog_mutator(function: Callable[[Bundle, Catalog], Catalog]) -> ResourceMutator[Catalog]
+@overload def catalog_mutator(function: Callable[[Catalog], Catalog]) -> ResourceMutator[Catalog]
+def catalog_mutator(function: Callable) -> ResourceMutator[Catalog]
+
+@overload def cluster_mutator(function: Callable[[Bundle, Cluster], Cluster]) -> ResourceMutator[Cluster]
+@overload def cluster_mutator(function: Callable[[Cluster], Cluster]) -> ResourceMutator[Cluster]
+def cluster_mutator(function: Callable) -> ResourceMutator[Cluster]
+
+@overload def cluster_policy_mutator(function: Callable[[Bundle, ClusterPolicy], ClusterPolicy]) -> ResourceMutator[ClusterPolicy]
+@overload def cluster_policy_mutator(function: Callable[[ClusterPolicy], ClusterPolicy]) -> ResourceMutator[ClusterPolicy]
+def cluster_policy_mutator(function: Callable) -> ResourceMutator[ClusterPolicy]
+
+@overload def dashboard_mutator(function: Callable[[Bundle, Dashboard], Dashboard]) -> ResourceMutator[Dashboard]
+@overload def dashboard_mutator(function: Callable[[Dashboard], Dashboard]) -> ResourceMutator[Dashboard]
+def dashboard_mutator(function: Callable) -> ResourceMutator[Dashboard]
+
+@overload def database_catalog_mutator(function: Callable[[Bundle, DatabaseCatalog], DatabaseCatalog]) -> ResourceMutator[DatabaseCatalog]
+@overload def database_catalog_mutator(function: Callable[[DatabaseCatalog], DatabaseCatalog]) -> ResourceMutator[DatabaseCatalog]
+def database_catalog_mutator(function: Callable) -> ResourceMutator[DatabaseCatalog]
+
+@overload def database_instance_mutator(function: Callable[[Bundle, DatabaseInstance], DatabaseInstance]) -> ResourceMutator[DatabaseInstance]
+@overload def database_instance_mutator(function: Callable[[DatabaseInstance], DatabaseInstance]) -> ResourceMutator[DatabaseInstance]
+def database_instance_mutator(function: Callable) -> ResourceMutator[DatabaseInstance]
+
+@overload def external_location_mutator(function: Callable[[Bundle, ExternalLocation], ExternalLocation]) -> ResourceMutator[ExternalLocation]
+@overload def external_location_mutator(function: Callable[[ExternalLocation], ExternalLocation]) -> ResourceMutator[ExternalLocation]
+def external_location_mutator(function: Callable) -> ResourceMutator[ExternalLocation]
+
+@overload def feature_mutator(function: Callable[[Bundle, Feature], Feature]) -> ResourceMutator[Feature]
+@overload def feature_mutator(function: Callable[[Feature], Feature]) -> ResourceMutator[Feature]
+def feature_mutator(function: Callable) -> ResourceMutator[Feature]
+
+@overload def genie_space_mutator(function: Callable[[Bundle, GenieSpace], GenieSpace]) -> ResourceMutator[GenieSpace]
+@overload def genie_space_mutator(function: Callable[[GenieSpace], GenieSpace]) -> ResourceMutator[GenieSpace]
+def genie_space_mutator(function: Callable) -> ResourceMutator[GenieSpace]
+
+@overload def instance_pool_mutator(function: Callable[[Bundle, InstancePool], InstancePool]) -> ResourceMutator[InstancePool]
+@overload def instance_pool_mutator(function: Callable[[InstancePool], InstancePool]) -> ResourceMutator[InstancePool]
+def instance_pool_mutator(function: Callable) -> ResourceMutator[InstancePool]
+
+@overload def job_mutator(function: Callable[[Bundle, Job], Job]) -> ResourceMutator[Job]
+@overload def job_mutator(function: Callable[[Job], Job]) -> ResourceMutator[Job]
+def job_mutator(function: Callable) -> ResourceMutator[Job]
+
+@overload def job_run_mutator(function: Callable[[Bundle, JobRun], JobRun]) -> ResourceMutator[JobRun]
+@overload def job_run_mutator(function: Callable[[JobRun], JobRun]) -> ResourceMutator[JobRun]
+def job_run_mutator(function: Callable) -> ResourceMutator[JobRun]
+
+def load_resources_from_current_package_module() -> Resources
+
+def load_resources_from_module(module: module) -> Resources
+
+def load_resources_from_modules(modules: Iterable[module]) -> Resources
+
+def load_resources_from_package_module(package_module: module) -> Resources
+
+@overload def mcp_service_mutator(function: Callable[[Bundle, McpService], McpService]) -> ResourceMutator[McpService]
+@overload def mcp_service_mutator(function: Callable[[McpService], McpService]) -> ResourceMutator[McpService]
+def mcp_service_mutator(function: Callable) -> ResourceMutator[McpService]
+
+@overload def mlflow_experiment_mutator(function: Callable[[Bundle, MlflowExperiment], MlflowExperiment]) -> ResourceMutator[MlflowExperiment]
+@overload def mlflow_experiment_mutator(function: Callable[[MlflowExperiment], MlflowExperiment]) -> ResourceMutator[MlflowExperiment]
+def mlflow_experiment_mutator(function: Callable) -> ResourceMutator[MlflowExperiment]
+
+@overload def mlflow_model_mutator(function: Callable[[Bundle, MlflowModel], MlflowModel]) -> ResourceMutator[MlflowModel]
+@overload def mlflow_model_mutator(function: Callable[[MlflowModel], MlflowModel]) -> ResourceMutator[MlflowModel]
+def mlflow_model_mutator(function: Callable) -> ResourceMutator[MlflowModel]
+
+@overload def model_provider_service_mutator(function: Callable[[Bundle, ModelProviderService], ModelProviderService]) -> ResourceMutator[ModelProviderService]
+@overload def model_provider_service_mutator(function: Callable[[ModelProviderService], ModelProviderService]) -> ResourceMutator[ModelProviderService]
+def model_provider_service_mutator(function: Callable) -> ResourceMutator[ModelProviderService]
+
+@overload def model_service_mutator(function: Callable[[Bundle, ModelService], ModelService]) -> ResourceMutator[ModelService]
+@overload def model_service_mutator(function: Callable[[ModelService], ModelService]) -> ResourceMutator[ModelService]
+def model_service_mutator(function: Callable) -> ResourceMutator[ModelService]
+
+@overload def model_serving_endpoint_mutator(function: Callable[[Bundle, ModelServingEndpoint], ModelServingEndpoint]) -> ResourceMutator[ModelServingEndpoint]
+@overload def model_serving_endpoint_mutator(function: Callable[[ModelServingEndpoint], ModelServingEndpoint]) -> ResourceMutator[ModelServingEndpoint]
+def model_serving_endpoint_mutator(function: Callable) -> ResourceMutator[ModelServingEndpoint]
+
+@overload def pipeline_mutator(function: Callable[[Bundle, Pipeline], Pipeline]) -> ResourceMutator[Pipeline]
+@overload def pipeline_mutator(function: Callable[[Pipeline], Pipeline]) -> ResourceMutator[Pipeline]
+def pipeline_mutator(function: Callable) -> ResourceMutator[Pipeline]
+
+@overload def quality_monitor_mutator(function: Callable[[Bundle, QualityMonitor], QualityMonitor]) -> ResourceMutator[QualityMonitor]
+@overload def quality_monitor_mutator(function: Callable[[QualityMonitor], QualityMonitor]) -> ResourceMutator[QualityMonitor]
+def quality_monitor_mutator(function: Callable) -> ResourceMutator[QualityMonitor]
+
+@overload def registered_model_mutator(function: Callable[[Bundle, RegisteredModel], RegisteredModel]) -> ResourceMutator[RegisteredModel]
+@overload def registered_model_mutator(function: Callable[[RegisteredModel], RegisteredModel]) -> ResourceMutator[RegisteredModel]
+def registered_model_mutator(function: Callable) -> ResourceMutator[RegisteredModel]
+
+@overload def schema_mutator(function: Callable[[Bundle, Schema], Schema]) -> ResourceMutator[Schema]
+@overload def schema_mutator(function: Callable[[Schema], Schema]) -> ResourceMutator[Schema]
+def schema_mutator(function: Callable) -> ResourceMutator[Schema]
+
+@overload def secret_mutator(function: Callable[[Bundle, Secret], Secret]) -> ResourceMutator[Secret]
+@overload def secret_mutator(function: Callable[[Secret], Secret]) -> ResourceMutator[Secret]
+def secret_mutator(function: Callable) -> ResourceMutator[Secret]
+
+@overload def secret_scope_mutator(function: Callable[[Bundle, SecretScope], SecretScope]) -> ResourceMutator[SecretScope]
+@overload def secret_scope_mutator(function: Callable[[SecretScope], SecretScope]) -> ResourceMutator[SecretScope]
+def secret_scope_mutator(function: Callable) -> ResourceMutator[SecretScope]
+
+@overload def sql_warehouse_mutator(function: Callable[[Bundle, SqlWarehouse], SqlWarehouse]) -> ResourceMutator[SqlWarehouse]
+@overload def sql_warehouse_mutator(function: Callable[[SqlWarehouse], SqlWarehouse]) -> ResourceMutator[SqlWarehouse]
+def sql_warehouse_mutator(function: Callable) -> ResourceMutator[SqlWarehouse]
+
+@overload def synced_database_table_mutator(function: Callable[[Bundle, SyncedDatabaseTable], SyncedDatabaseTable]) -> ResourceMutator[SyncedDatabaseTable]
+@overload def synced_database_table_mutator(function: Callable[[SyncedDatabaseTable], SyncedDatabaseTable]) -> ResourceMutator[SyncedDatabaseTable]
+def synced_database_table_mutator(function: Callable) -> ResourceMutator[SyncedDatabaseTable]
+
+def variables(cls: type[_T]) -> type[_T]
+
+@overload def vector_search_endpoint_mutator(function: Callable[[Bundle, VectorSearchEndpoint], VectorSearchEndpoint]) -> ResourceMutator[VectorSearchEndpoint]
+@overload def vector_search_endpoint_mutator(function: Callable[[VectorSearchEndpoint], VectorSearchEndpoint]) -> ResourceMutator[VectorSearchEndpoint]
+def vector_search_endpoint_mutator(function: Callable) -> ResourceMutator[VectorSearchEndpoint]
+
+@overload def vector_search_index_mutator(function: Callable[[Bundle, VectorSearchIndex], VectorSearchIndex]) -> ResourceMutator[VectorSearchIndex]
+@overload def vector_search_index_mutator(function: Callable[[VectorSearchIndex], VectorSearchIndex]) -> ResourceMutator[VectorSearchIndex]
+def vector_search_index_mutator(function: Callable) -> ResourceMutator[VectorSearchIndex]
+
+@overload def volume_mutator(function: Callable[[Bundle, Volume], Volume]) -> ResourceMutator[Volume]
+@overload def volume_mutator(function: Callable[[Volume], Volume]) -> ResourceMutator[Volume]
+def volume_mutator(function: Callable) -> ResourceMutator[Volume]
+
+== _ResourceType.all() registry ==
+singular_name=alert plural_name=alerts resource_type=Alert
+singular_name=app plural_name=apps resource_type=App
+singular_name=catalog plural_name=catalogs resource_type=Catalog
+singular_name=cluster plural_name=clusters resource_type=Cluster
+singular_name=cluster_policy plural_name=cluster_policies resource_type=ClusterPolicy
+singular_name=dashboard plural_name=dashboards resource_type=Dashboard
+singular_name=database_catalog plural_name=database_catalogs resource_type=DatabaseCatalog
+singular_name=database_instance plural_name=database_instances resource_type=DatabaseInstance
+singular_name=external_location plural_name=external_locations resource_type=ExternalLocation
+singular_name=feature plural_name=features resource_type=Feature
+singular_name=genie_space plural_name=genie_spaces resource_type=GenieSpace
+singular_name=instance_pool plural_name=instance_pools resource_type=InstancePool
+singular_name=job plural_name=jobs resource_type=Job
+singular_name=job_run plural_name=job_runs resource_type=JobRun
+singular_name=mcp_service plural_name=mcp_services resource_type=McpService
+singular_name=mlflow_experiment plural_name=experiments resource_type=MlflowExperiment
+singular_name=mlflow_model plural_name=models resource_type=MlflowModel
+singular_name=model_provider_service plural_name=model_provider_services resource_type=ModelProviderService
+singular_name=model_service plural_name=model_services resource_type=ModelService
+singular_name=model_serving_endpoint plural_name=model_serving_endpoints resource_type=ModelServingEndpoint
+singular_name=pipeline plural_name=pipelines resource_type=Pipeline
+singular_name=quality_monitor plural_name=quality_monitors resource_type=QualityMonitor
+singular_name=registered_model plural_name=registered_models resource_type=RegisteredModel
+singular_name=schema plural_name=schemas resource_type=Schema
+singular_name=secret plural_name=secrets resource_type=Secret
+singular_name=secret_scope plural_name=secret_scopes resource_type=SecretScope
+singular_name=sql_warehouse plural_name=sql_warehouses resource_type=SqlWarehouse
+singular_name=synced_database_table plural_name=synced_database_tables resource_type=SyncedDatabaseTable
+singular_name=vector_search_endpoint plural_name=vector_search_endpoints resource_type=VectorSearchEndpoint
+singular_name=vector_search_index plural_name=vector_search_indexes resource_type=VectorSearchIndex
+singular_name=volume plural_name=volumes resource_type=Volume
diff --git a/python/databricks_tests/core/test_public_api.py b/python/databricks_tests/core/test_public_api.py
new file mode 100644
index 00000000000..3ef35c24be4
--- /dev/null
+++ b/python/databricks_tests/core/test_public_api.py
@@ -0,0 +1,233 @@
+"""Regression guard for the typed public API surface of databricks.bundles.core.
+
+The core wiring — Resources, the *_mutator functions, the _ResourceType registry,
+__all__ — is hand-written (the resource namespaces are pydabs-codegen output, already
+guarded by generate-check). This snapshots the core public surface to a golden file so a
+refactor can't silently drop a type hint, move a `*` marker, rename a method, or change
+the export set.
+
+Regenerate the golden after an intended public-API change:
+
+    UPDATE_SNAPSHOTS=1 uv run pytest databricks_tests/core/test_public_api.py
+
+Determinism / version notes:
+  * Types are rendered by their PUBLIC SHORT NAME (`Variable[str]`, `Location`, `None`)
+    rather than repr's fully-qualified internal module path — so moving an internal
+    `_`-module doesn't perturb the golden; only a real public-API change does.
+  * Signatures are reconstructed from inspect.Signature so `/`, `*`, `*args`, `**kwargs`
+    markers render explicitly and stably.
+  * Requires Python >= 3.11 for typing.get_overloads (the *_mutator overloads). Output is
+    identical on 3.11/3.12/3.13, so the single golden holds across those versions.
+"""
+
+import collections.abc
+import dataclasses
+import enum
+import inspect
+import os
+import sys
+import types
+import typing
+from pathlib import Path
+
+import pytest
+
+import databricks.bundles.core as core
+
+_GOLDEN = Path(__file__).parent / "public_api.txt"
+
+
+def _short_name(t) -> str:
+    return getattr(t, "__name__", None) or getattr(t, "_name", None) or str(t)
+
+
+def render_type(t) -> str:
+    """Render a type annotation by public short name, module-location independent."""
+    if t is None or t is type(None):
+        return "None"
+    if t is Ellipsis:
+        return "..."
+    if isinstance(t, str):
+        # A forward-ref written as a string literal in the source (e.g. "JobParam").
+        return t
+    if isinstance(t, typing.ForwardRef):
+        return t.__forward_arg__
+    if isinstance(t, typing.TypeVar):
+        return t.__name__
+
+    origin = typing.get_origin(t)
+    args = typing.get_args(t)
+
+    if origin is not None:
+        if origin is typing.Union or origin is types.UnionType:
+            return "Union[" + ", ".join(render_type(a) for a in args) + "]"
+        if origin is typing.Literal:
+            return "Literal[" + ", ".join(repr(a) for a in args) + "]"
+        if origin is collections.abc.Callable:
+            if not args:
+                return "Callable"
+            # get_args(Callable[[int], str]) == ([int], str); [0] is the arg list.
+            params, ret = args[0], args[-1]
+            params_str = (
+                "..."
+                if params is Ellipsis
+                else "[" + ", ".join(render_type(a) for a in params) + "]"
+            )
+            return "Callable[" + params_str + ", " + render_type(ret) + "]"
+        name = _short_name(origin)
+        if args:
+            return name + "[" + ", ".join(render_type(a) for a in args) + "]"
+        return name
+
+    return _short_name(t)
+
+
+def render_signature(func) -> str:
+    """Reconstruct a signature string with explicit / * ** markers and short types."""
+    sig = inspect.signature(func)
+    parts = []
+    last_kind = None
+    emitted_star = False
+    for p in sig.parameters.values():
+        if (
+            last_kind == inspect.Parameter.POSITIONAL_ONLY
+            and p.kind != inspect.Parameter.POSITIONAL_ONLY
+        ):
+            parts.append("/")
+        if p.kind == inspect.Parameter.KEYWORD_ONLY and not emitted_star:
+            parts.append("*")
+            emitted_star = True
+
+        s = p.name
+        if p.kind == inspect.Parameter.VAR_POSITIONAL:
+            s = "*" + s
+            emitted_star = True
+        elif p.kind == inspect.Parameter.VAR_KEYWORD:
+            s = "**" + s
+
+        if p.annotation is not inspect.Parameter.empty:
+            s += ": " + render_type(p.annotation)
+        if p.default is not inspect.Parameter.empty:
+            sep = " = " if p.annotation is not inspect.Parameter.empty else "="
+            s += sep + repr(p.default)
+        parts.append(s)
+        last_kind = p.kind
+
+    if last_kind == inspect.Parameter.POSITIONAL_ONLY:
+        parts.append("/")
+
+    ret = ""
+    if sig.return_annotation is not inspect.Signature.empty:
+        ret = " -> " + render_type(sig.return_annotation)
+    return "(" + ", ".join(parts) + ")" + ret
+
+
+def _bases(cls) -> str:
+    # Skip object and private (underscore) bases, mirroring _members(): a generated private
+    # base like _GeneratedResources is an implementation detail, not the public contract.
+    names = [
+        b.__name__
+        for b in cls.__bases__
+        if b is not object and not b.__name__.startswith("_")
+    ]
+    return "(" + ", ".join(names) + ")" if names else ""
+
+
+def _members(cls, predicate):
+    return sorted(
+        (name, obj)
+        for name, obj in inspect.getmembers(cls, predicate)
+        if not name.startswith("_")
+    )
+
+
+def render_class(name, cls, out: list[str]) -> None:
+    if isinstance(cls, type) and issubclass(cls, enum.Enum):
+        out.append(f"class {name}(Enum):")
+        for member in cls:
+            out.append(f"    {member.name} = {member.value!r}")
+        out.append("")
+        return
+
+    out.append(f"class {name}{_bases(cls)}:")
+    if dataclasses.is_dataclass(cls):
+        for f in dataclasses.fields(cls):
+            line = f"    {f.name}: {render_type(f.type)}"
+            if f.default is not dataclasses.MISSING:
+                line += f" = {f.default!r}"
+            elif f.default_factory is not dataclasses.MISSING:
+                line += " = <factory>"
+            out.append(line)
+
+    # classmethods (e.g. create_error) surface as bound methods, not plain functions.
+    for m_name, m in _members(cls, inspect.ismethod):
+        out.append(f"    @classmethod def {m_name}{render_signature(m)}")
+    for m_name, m in _members(cls, inspect.isfunction):
+        out.append(f"    def {m_name}{render_signature(m)}")
+    for p_name, prop in _members(cls, lambda x: isinstance(x, property)):
+        ret = ""
+        if prop.fget is not None:
+            r = inspect.signature(prop.fget).return_annotation
+            if r is not inspect.Signature.empty:
+                ret = " -> " + render_type(r)
+        out.append(f"    @property {p_name}{ret}")
+    out.append("")
+
+
+def render_symbol(name, obj, out: list[str]) -> None:
+    if inspect.isclass(obj):
+        render_class(name, obj, out)
+    elif inspect.isfunction(obj):
+        # typing.get_overloads is 3.11+; the test is skipped below on older versions.
+        overloads = typing.get_overloads(obj) if sys.version_info >= (3, 11) else []
+        for ov in overloads:
+            out.append(f"@overload def {name}{render_signature(ov)}")
+        out.append(f"def {name}{render_signature(obj)}")
+        out.append("")
+    else:
+        # Type aliases (VariableOr*), rendered by structure.
+        out.append(f"{name} = {render_type(obj)}")
+        out.append("")
+
+
+def render_registry(out: list[str]) -> None:
+    # _ResourceType is intentionally not exported from core, but the registry it builds is
+    # part of the wiring a refactor regenerates, so snapshot it too.
+    from databricks.bundles.core._resource_type import _ResourceType
+
+    out.append("== _ResourceType.all() registry ==")
+    for rt in sorted(_ResourceType.all(), key=lambda rt: rt.singular_name):
+        out.append(
+            f"singular_name={rt.singular_name} plural_name={rt.plural_name} resource_type={rt.resource_type.__name__}"
+        )
+    out.append("")
+
+
+def dump_core_public_api() -> str:
+    out = ["== module databricks.bundles.core =="]
+    out.append("__all__ = [")
+    for name in sorted(core.__all__):
+        out.append(f"    {name},")
+    out.append("]")
+    out.append("")
+
+    for name in sorted(core.__all__):
+        render_symbol(name, getattr(core, name), out)
+
+    render_registry(out)
+
+    # Single trailing newline, no blank last line (the whitespace linter strips it).
+    return "\n".join(out).rstrip("\n") + "\n"
+
+
+@pytest.mark.skipif(
+    sys.version_info < (3, 11), reason="typing.get_overloads requires Python 3.11+"
+)
+def test_core_public_api():
+    actual = dump_core_public_api()
+    if os.environ.get("UPDATE_SNAPSHOTS"):
+        _GOLDEN.write_text(actual)
+    assert actual == _GOLDEN.read_text(), (
+        "databricks.bundles.core public API changed. If intended, regenerate with "
+        "UPDATE_SNAPSHOTS=1 uv run pytest databricks_tests/core/test_public_api.py"
+    )
diff --git a/python/databricks_tests/core/test_python_support.py b/python/databricks_tests/core/test_python_support.py
new file mode 100644
index 00000000000..0cbe8fb3b4a
--- /dev/null
+++ b/python/databricks_tests/core/test_python_support.py
@@ -0,0 +1,26 @@
+"""Coverage guard: every PyDABs resource must have an acceptance fixture.
+
+Asserts each resource in the _ResourceType registry has an
+acceptance/bundle/python/<plural>-support/ fixture (see that directory's README.md for
+how to author one); this fails CI until it exists.
+"""
+
+from pathlib import Path
+
+import pytest
+
+from databricks.bundles.core._resource_type import _ResourceType
+
+_ACCEPTANCE_DIR = Path(__file__).parents[3] / "acceptance" / "bundle" / "python"
+
+_PLURALS = sorted(t.plural_name for t in _ResourceType.all())
+
+
+@pytest.mark.parametrize("plural", _PLURALS)
+def test_python_support_coverage(plural: str):
+    covered = (_ACCEPTANCE_DIR / f"{plural}-support" / "databricks.yml").exists()
+
+    assert covered, (
+        f"no acceptance/bundle/python/{plural}-support/ fixture for {plural!r}; "
+        "add one (see acceptance/bundle/python/README.md)"
+    )
diff --git a/python/databricks_tests/core/test_resources.py b/python/databricks_tests/core/test_resources.py
index ccdd7f1d864..83cf911510d 100644
--- a/python/databricks_tests/core/test_resources.py
+++ b/python/databricks_tests/core/test_resources.py
@@ -1,80 +1,15 @@
-from dataclasses import dataclass, replace
-from typing import Callable
+from dataclasses import replace
 
 import pytest
 
 from databricks.bundles.core import Location, Resources, Severity
 from databricks.bundles.core._bundle import Bundle
-from databricks.bundles.core._resource import Resource
-from databricks.bundles.core._resource_mutator import (
-    ResourceMutator,
-    job_mutator,
-    pipeline_mutator,
-    schema_mutator,
-    volume_mutator,
-)
+from databricks.bundles.core._resource_mutator import ResourceMutator
 from databricks.bundles.core._resource_type import _ResourceType
 from databricks.bundles.jobs._models.job import Job
-from databricks.bundles.pipelines._models.pipeline import Pipeline
-from databricks.bundles.schemas._models.schema import Schema
-from databricks.bundles.volumes._models.volume import Volume
-
-
-@dataclass(kw_only=True)
-class TestCase:
-    add_resource: Callable
-    dict_example: dict
-    dataclass_example: Resource
-    mutator: Callable
-
-
-resource_types = {tpe.resource_type: tpe for tpe in _ResourceType.all()}
-test_cases = [
-    (
-        TestCase(
-            add_resource=Resources.add_job,
-            dict_example={"name": "My job"},
-            dataclass_example=Job(name="My job"),
-            mutator=job_mutator,
-        ),
-        resource_types[Job],
-    ),
-    (
-        TestCase(
-            add_resource=Resources.add_pipeline,
-            dict_example={"name": "My pipeline"},
-            dataclass_example=Pipeline(name="My pipeline"),
-            mutator=pipeline_mutator,
-        ),
-        resource_types[Pipeline],
-    ),
-    (
-        TestCase(
-            add_resource=Resources.add_volume,
-            dict_example={
-                "name": "My Volume",
-                "catalog_name": "my_catalog",
-                "schema_name": "my_schema",
-            },
-            dataclass_example=Volume(
-                catalog_name="my_catalog",
-                name="My Volume",
-                schema_name="my_schema",
-            ),
-            mutator=volume_mutator,
-        ),
-        resource_types[Volume],
-    ),
-    (
-        TestCase(
-            add_resource=Resources.add_schema,
-            dict_example={"catalog_name": "my_catalog", "name": "my_schema"},
-            dataclass_example=Schema(catalog_name="my_catalog", name="my_schema"),
-            mutator=schema_mutator,
-        ),
-        resource_types[Schema],
-    ),
-]
+from databricks_tests.core._generated import test_cases
+from databricks_tests.core._resource_test_case import ResourceTestCase
+
 test_case_ids = [tpe.plural_name for _, tpe in test_cases]
 
 
@@ -102,14 +37,14 @@ def test_add_job():
 
 
 @pytest.mark.parametrize("tc,tpe", test_cases, ids=test_case_ids)
-def test_add_resource_type(tc: TestCase, tpe: _ResourceType):
+def test_add_resource_type(tc: ResourceTestCase, tpe: _ResourceType):
     resources = Resources()
 
     tc.add_resource(
         resources,
         **{
             "resource_name": "my_resource",
-            tpe.singular_name: tc.dict_example,
+            tpe.singular_name: tc.dataclass_example,
         },
     )
 
@@ -126,7 +61,7 @@ def test_add_job_dict():
 
 
 @pytest.mark.parametrize("tc,tpe", test_cases, ids=test_case_ids)
-def test_add_resource_type_dict(tc: TestCase, tpe: _ResourceType):
+def test_add_resource_type_dict(tc: ResourceTestCase, tpe: _ResourceType):
     resources = Resources()
 
     tc.add_resource(
@@ -151,7 +86,7 @@ def test_add_job_location():
 
 
 @pytest.mark.parametrize("tc,tpe", test_cases, ids=test_case_ids)
-def test_add_resource_type_location(tc: TestCase, tpe: _ResourceType):
+def test_add_resource_type_location(tc: ResourceTestCase, tpe: _ResourceType):
     resources = Resources()
     location = Location(file="my_file", line=1, column=2)
 
@@ -183,7 +118,7 @@ def test_add_job_location_automatic():
 
 
 @pytest.mark.parametrize("tc,tpe", test_cases, ids=test_case_ids)
-def test_add_resource_type_location_automatic(tc: TestCase, tpe: _ResourceType):
+def test_add_resource_type_location_automatic(tc: ResourceTestCase, tpe: _ResourceType):
     resources = Resources()
 
     tc.add_resource(
@@ -205,7 +140,7 @@ def test_add_resource_type_location_automatic(tc: TestCase, tpe: _ResourceType):
 
 
 @pytest.mark.parametrize("tc,tpe", test_cases, ids=test_case_ids)
-def test_add_resource(tc: TestCase, tpe: _ResourceType):
+def test_add_resource(tc: ResourceTestCase, tpe: _ResourceType):
     resources = Resources()
 
     resources.add_resource("my_resource", tc.dataclass_example)
@@ -215,7 +150,7 @@ def test_add_resource(tc: TestCase, tpe: _ResourceType):
 
 
 @pytest.mark.parametrize("tc,tpe", test_cases, ids=test_case_ids)
-def test_add_resources(tc: TestCase, tpe: _ResourceType):
+def test_add_resources(tc: ResourceTestCase, tpe: _ResourceType):
     resources_1 = Resources()
     resources_2 = Resources()
 
@@ -227,7 +162,7 @@ def test_add_resources(tc: TestCase, tpe: _ResourceType):
 
 
 @pytest.mark.parametrize("tc,tpe", test_cases, ids=test_case_ids)
-def test_mutator(tc: TestCase, tpe: _ResourceType):
+def test_mutator(tc: ResourceTestCase, tpe: _ResourceType):
     @tc.mutator
     def my_func(bundle, resource):
         return resource
@@ -241,7 +176,7 @@ def my_func(bundle, resource):
 
 
 @pytest.mark.parametrize("tc,tpe", test_cases, ids=test_case_ids)
-def test_mutator_export(tc: TestCase, tpe: _ResourceType):
+def test_mutator_export(tc: ResourceTestCase, tpe: _ResourceType):
     import databricks.bundles.core
 
     assert tc.mutator.__name__ in databricks.bundles.core.__all__, (
@@ -250,7 +185,7 @@ def test_mutator_export(tc: TestCase, tpe: _ResourceType):
 
 
 @pytest.mark.parametrize("tc,tpe", test_cases, ids=test_case_ids)
-def test_add_duplicate_resource(tc: TestCase, tpe: _ResourceType):
+def test_add_duplicate_resource(tc: ResourceTestCase, tpe: _ResourceType):
     resources = Resources()
 
     copy_1 = replace(tc.dataclass_example)
@@ -270,7 +205,7 @@ def test_add_duplicate_resource(tc: TestCase, tpe: _ResourceType):
     assert item.severity == Severity.ERROR
     assert (
         item.summary
-        == f"Duplicate resource name 'my_resource' for a {tpe.singular_name}. Resource names must be unique."
+        == f"Duplicate resource name 'my_resource' for resource '{tpe.singular_name}'. Resource names must be unique."
     )
 
 
diff --git a/python/databricks_tests/core/test_transform.py b/python/databricks_tests/core/test_transform.py
index b437d010c3a..c350fe2b7b8 100644
--- a/python/databricks_tests/core/test_transform.py
+++ b/python/databricks_tests/core/test_transform.py
@@ -1,7 +1,7 @@
 import math
 from dataclasses import dataclass
 from enum import Enum
-from typing import Optional
+from typing import Any, Optional
 
 import pytest
 
@@ -54,6 +54,37 @@ class Fake:
     assert out == Fake(field=False)
 
 
+@pytest.mark.parametrize(
+    "value,expected",
+    [
+        ("True", True),
+        ("FALSE", False),
+        ("yes", True),
+        ("N", False),
+        ("On", True),
+        ("off", False),
+    ],
+)
+def test_transform_bool_from_string(value, expected):
+    @dataclass
+    class Fake:
+        field: Optional[bool] = None
+
+    out = _transform(Fake, {"field": value})
+
+    assert out == Fake(field=expected)
+
+
+@pytest.mark.parametrize("value", ["tRuE", "1", ""])
+def test_transform_bool_invalid(value):
+    @dataclass
+    class Fake:
+        field: Optional[bool] = None
+
+    with pytest.raises(ValueError, match="Unexpected type"):
+        _transform(Fake, {"field": value})
+
+
 def test_transform_str():
     @dataclass
     class Fake:
@@ -64,6 +95,35 @@ class Fake:
     assert out == Fake(field="test")
 
 
+def test_transform_any_passthrough():
+    # interface{} fields are generated as Any and pass through untransformed.
+    value = {"a": 1, "b": ["c", "d"]}
+
+    assert _transform(Any, value) is value  # type: ignore
+    assert _transform(Any, "raw string") == "raw string"  # type: ignore
+
+
+def test_transform_any_field():
+    @dataclass
+    class Fake:
+        field: VariableOrOptional[Any] = None
+
+    value = {"a": 1, "b": ["c", "d"]}
+    out = _transform(Fake, {"field": value})
+
+    assert out == Fake(field=value)
+
+
+def test_transform_any_field_variable():
+    @dataclass
+    class Fake:
+        field: VariableOrOptional[Any] = None
+
+    out = _transform(Fake, {"field": "${var.x}"})
+
+    assert out == Fake(field=Variable(path="var.x", type=Any))  # type: ignore
+
+
 def test_transform_str_list():
     @dataclass
     class Fake:
diff --git a/python/databricks_tests/core/test_variable.py b/python/databricks_tests/core/test_variable.py
index aadff53b72b..e222075829b 100644
--- a/python/databricks_tests/core/test_variable.py
+++ b/python/databricks_tests/core/test_variable.py
@@ -28,7 +28,7 @@ def test_my_variables_untyped():
     with pytest.raises(ValueError) as exc_info:
 
         @variables
-        class UntypedVariables:  # noqa
+        class UntypedVariables:
             foo: Variable
 
     [msg] = exc_info.value.args
@@ -40,7 +40,7 @@ def test_bad_type():
     with pytest.raises(ValueError) as exc_info:
 
         @variables
-        class BadType:  # noqa
+        class BadType:
             foo: str
 
     [msg] = exc_info.value.args
diff --git a/python/databricks_tests/core/test_variable_reference_vectors.py b/python/databricks_tests/core/test_variable_reference_vectors.py
new file mode 100644
index 00000000000..c7a61cf59cd
--- /dev/null
+++ b/python/databricks_tests/core/test_variable_reference_vectors.py
@@ -0,0 +1,53 @@
+import json
+from pathlib import Path
+from typing import Any, Optional
+
+import pytest
+
+from databricks.bundles.core._transform import (
+    _unwrap_variable_path,
+    _variable_regex,
+)
+
+_REFERENCE_VECTORS = (
+    Path(__file__).resolve().parents[3]
+    / "libs/dyn/dynvar/testdata/reference_vectors.json"
+)
+
+
+def _load_reference_vectors() -> list[dict[str, Any]]:
+    with _REFERENCE_VECTORS.open(encoding="utf-8") as f:
+        data = json.load(f)
+    vectors = data["vectors"]
+    assert vectors
+    return vectors
+
+
+def _find_references(value: str) -> list[str]:
+    return [match.group(1) for match in _variable_regex.finditer(value)]
+
+
+def _matches(value: str) -> bool:
+    return bool(_find_references(value))
+
+
+@pytest.mark.parametrize("vector", _load_reference_vectors(), ids=lambda v: v["id"])
+def test_reference_vectors(vector: dict[str, Any]) -> None:
+    value: str = vector["input"]
+    assert _matches(value) == vector["match"], "regex match"
+
+    if vector["match"] and "references" in vector:
+        assert _find_references(value) == vector["references"], "references"
+
+    if "pure" in vector:
+        unwrap_path: Optional[str] = _unwrap_variable_path(value)
+        if vector["pure"]:
+            assert unwrap_path is not None, "unwrap path for pure reference"
+        else:
+            assert unwrap_path is None, "unwrap path for impure reference"
+
+    if "path" in vector:
+        unwrap_path = _unwrap_variable_path(value)
+        assert unwrap_path == vector["path"], "PureReferenceToPath equivalent"
+    elif vector.get("path_ok") is False:
+        assert _unwrap_variable_path(value) is None, "PureReferenceToPath equivalent"
diff --git a/python/databricks_tests/test_build.py b/python/databricks_tests/test_build.py
index 65d9683e922..14fce619757 100644
--- a/python/databricks_tests/test_build.py
+++ b/python/databricks_tests/test_build.py
@@ -28,8 +28,8 @@
     Resources,
     Severity,
     job_mutator,
+    pipeline_mutator,
 )
-from databricks.bundles.core._resource_mutator import pipeline_mutator
 from databricks.bundles.jobs import Job
 from databricks.bundles.pipelines._models.pipeline import Pipeline
 
diff --git a/python/docs/.gitattributes b/python/docs/.gitattributes
new file mode 100644
index 00000000000..78f39ec3e9d
--- /dev/null
+++ b/python/docs/.gitattributes
@@ -0,0 +1,5 @@
+# Generated by pydabs-codegen (see python/codegen/codegen/generated_docs.py).
+# databricks.bundles.core.rst is hand-written.
+index.rst linguist-generated=true
+databricks.bundles.*.rst linguist-generated=true
+databricks.bundles.core.rst linguist-generated=false
diff --git a/python/docs/conf.py b/python/docs/conf.py
index 4559d39b23b..e836c2b44d5 100644
--- a/python/docs/conf.py
+++ b/python/docs/conf.py
@@ -6,8 +6,8 @@
 # -- Project information -----------------------------------------------------
 # https://www.sphinx-doc.org/en/master/usage/configuration.html#project-information
 
-import sys
 import os
+import sys
 
 sys.path.append(os.path.abspath(".."))
 sys.path.append(os.path.abspath("ext"))
diff --git a/python/docs/databricks.bundles.alerts.rst b/python/docs/databricks.bundles.alerts.rst
new file mode 100644
index 00000000000..08a621c813d
--- /dev/null
+++ b/python/docs/databricks.bundles.alerts.rst
@@ -0,0 +1,11 @@
+Alerts
+===============================
+
+.. currentmodule:: databricks.bundles.alerts
+
+**Package:** ``databricks.bundles.alerts``
+
+Classes
+---------------
+
+.. automodule:: databricks.bundles.alerts
diff --git a/python/docs/databricks.bundles.apps.rst b/python/docs/databricks.bundles.apps.rst
new file mode 100644
index 00000000000..a1ccd11ac58
--- /dev/null
+++ b/python/docs/databricks.bundles.apps.rst
@@ -0,0 +1,11 @@
+Apps
+===============================
+
+.. currentmodule:: databricks.bundles.apps
+
+**Package:** ``databricks.bundles.apps``
+
+Classes
+---------------
+
+.. automodule:: databricks.bundles.apps
diff --git a/python/docs/databricks.bundles.catalogs.rst b/python/docs/databricks.bundles.catalogs.rst
new file mode 100644
index 00000000000..bbd9054723d
--- /dev/null
+++ b/python/docs/databricks.bundles.catalogs.rst
@@ -0,0 +1,11 @@
+Catalogs
+===============================
+
+.. currentmodule:: databricks.bundles.catalogs
+
+**Package:** ``databricks.bundles.catalogs``
+
+Classes
+---------------
+
+.. automodule:: databricks.bundles.catalogs
diff --git a/python/docs/databricks.bundles.cluster_policies.rst b/python/docs/databricks.bundles.cluster_policies.rst
new file mode 100644
index 00000000000..a82cbec3e36
--- /dev/null
+++ b/python/docs/databricks.bundles.cluster_policies.rst
@@ -0,0 +1,11 @@
+Cluster Policies
+===============================
+
+.. currentmodule:: databricks.bundles.cluster_policies
+
+**Package:** ``databricks.bundles.cluster_policies``
+
+Classes
+---------------
+
+.. automodule:: databricks.bundles.cluster_policies
diff --git a/python/docs/databricks.bundles.clusters.rst b/python/docs/databricks.bundles.clusters.rst
new file mode 100644
index 00000000000..0babd19d3aa
--- /dev/null
+++ b/python/docs/databricks.bundles.clusters.rst
@@ -0,0 +1,11 @@
+Clusters
+===============================
+
+.. currentmodule:: databricks.bundles.clusters
+
+**Package:** ``databricks.bundles.clusters``
+
+Classes
+---------------
+
+.. automodule:: databricks.bundles.clusters
diff --git a/python/docs/databricks.bundles.dashboards.rst b/python/docs/databricks.bundles.dashboards.rst
new file mode 100644
index 00000000000..70f7d1539af
--- /dev/null
+++ b/python/docs/databricks.bundles.dashboards.rst
@@ -0,0 +1,11 @@
+Dashboards
+===============================
+
+.. currentmodule:: databricks.bundles.dashboards
+
+**Package:** ``databricks.bundles.dashboards``
+
+Classes
+---------------
+
+.. automodule:: databricks.bundles.dashboards
diff --git a/python/docs/databricks.bundles.database_catalogs.rst b/python/docs/databricks.bundles.database_catalogs.rst
new file mode 100644
index 00000000000..005aae777cf
--- /dev/null
+++ b/python/docs/databricks.bundles.database_catalogs.rst
@@ -0,0 +1,11 @@
+Database Catalogs
+===============================
+
+.. currentmodule:: databricks.bundles.database_catalogs
+
+**Package:** ``databricks.bundles.database_catalogs``
+
+Classes
+---------------
+
+.. automodule:: databricks.bundles.database_catalogs
diff --git a/python/docs/databricks.bundles.database_instances.rst b/python/docs/databricks.bundles.database_instances.rst
new file mode 100644
index 00000000000..eea7a14d4b3
--- /dev/null
+++ b/python/docs/databricks.bundles.database_instances.rst
@@ -0,0 +1,11 @@
+Database Instances
+===============================
+
+.. currentmodule:: databricks.bundles.database_instances
+
+**Package:** ``databricks.bundles.database_instances``
+
+Classes
+---------------
+
+.. automodule:: databricks.bundles.database_instances
diff --git a/python/docs/databricks.bundles.experiments.rst b/python/docs/databricks.bundles.experiments.rst
new file mode 100644
index 00000000000..b2ed4d21ef0
--- /dev/null
+++ b/python/docs/databricks.bundles.experiments.rst
@@ -0,0 +1,11 @@
+Experiments
+===============================
+
+.. currentmodule:: databricks.bundles.experiments
+
+**Package:** ``databricks.bundles.experiments``
+
+Classes
+---------------
+
+.. automodule:: databricks.bundles.experiments
diff --git a/python/docs/databricks.bundles.external_locations.rst b/python/docs/databricks.bundles.external_locations.rst
new file mode 100644
index 00000000000..0044ce58e66
--- /dev/null
+++ b/python/docs/databricks.bundles.external_locations.rst
@@ -0,0 +1,11 @@
+External Locations
+===============================
+
+.. currentmodule:: databricks.bundles.external_locations
+
+**Package:** ``databricks.bundles.external_locations``
+
+Classes
+---------------
+
+.. automodule:: databricks.bundles.external_locations
diff --git a/python/docs/databricks.bundles.features.rst b/python/docs/databricks.bundles.features.rst
new file mode 100644
index 00000000000..277c3b7339b
--- /dev/null
+++ b/python/docs/databricks.bundles.features.rst
@@ -0,0 +1,11 @@
+Features
+===============================
+
+.. currentmodule:: databricks.bundles.features
+
+**Package:** ``databricks.bundles.features``
+
+Classes
+---------------
+
+.. automodule:: databricks.bundles.features
diff --git a/python/docs/databricks.bundles.genie_spaces.rst b/python/docs/databricks.bundles.genie_spaces.rst
new file mode 100644
index 00000000000..0e7b8e13b77
--- /dev/null
+++ b/python/docs/databricks.bundles.genie_spaces.rst
@@ -0,0 +1,11 @@
+Genie Spaces
+===============================
+
+.. currentmodule:: databricks.bundles.genie_spaces
+
+**Package:** ``databricks.bundles.genie_spaces``
+
+Classes
+---------------
+
+.. automodule:: databricks.bundles.genie_spaces
diff --git a/python/docs/databricks.bundles.instance_pools.rst b/python/docs/databricks.bundles.instance_pools.rst
new file mode 100644
index 00000000000..57fc6543340
--- /dev/null
+++ b/python/docs/databricks.bundles.instance_pools.rst
@@ -0,0 +1,11 @@
+Instance Pools
+===============================
+
+.. currentmodule:: databricks.bundles.instance_pools
+
+**Package:** ``databricks.bundles.instance_pools``
+
+Classes
+---------------
+
+.. automodule:: databricks.bundles.instance_pools
diff --git a/python/docs/databricks.bundles.job_runs.rst b/python/docs/databricks.bundles.job_runs.rst
new file mode 100644
index 00000000000..1cd97700c53
--- /dev/null
+++ b/python/docs/databricks.bundles.job_runs.rst
@@ -0,0 +1,11 @@
+Job Runs
+===============================
+
+.. currentmodule:: databricks.bundles.job_runs
+
+**Package:** ``databricks.bundles.job_runs``
+
+Classes
+---------------
+
+.. automodule:: databricks.bundles.job_runs
diff --git a/python/docs/databricks.bundles.mcp_services.rst b/python/docs/databricks.bundles.mcp_services.rst
new file mode 100644
index 00000000000..d13fd3f7956
--- /dev/null
+++ b/python/docs/databricks.bundles.mcp_services.rst
@@ -0,0 +1,11 @@
+MCP Services
+===============================
+
+.. currentmodule:: databricks.bundles.mcp_services
+
+**Package:** ``databricks.bundles.mcp_services``
+
+Classes
+---------------
+
+.. automodule:: databricks.bundles.mcp_services
diff --git a/python/docs/databricks.bundles.model_provider_services.rst b/python/docs/databricks.bundles.model_provider_services.rst
new file mode 100644
index 00000000000..657522bacc8
--- /dev/null
+++ b/python/docs/databricks.bundles.model_provider_services.rst
@@ -0,0 +1,11 @@
+Model Provider Services
+===============================
+
+.. currentmodule:: databricks.bundles.model_provider_services
+
+**Package:** ``databricks.bundles.model_provider_services``
+
+Classes
+---------------
+
+.. automodule:: databricks.bundles.model_provider_services
diff --git a/python/docs/databricks.bundles.model_services.rst b/python/docs/databricks.bundles.model_services.rst
new file mode 100644
index 00000000000..38d4ebdff1a
--- /dev/null
+++ b/python/docs/databricks.bundles.model_services.rst
@@ -0,0 +1,11 @@
+Model Services
+===============================
+
+.. currentmodule:: databricks.bundles.model_services
+
+**Package:** ``databricks.bundles.model_services``
+
+Classes
+---------------
+
+.. automodule:: databricks.bundles.model_services
diff --git a/python/docs/databricks.bundles.model_serving_endpoints.rst b/python/docs/databricks.bundles.model_serving_endpoints.rst
new file mode 100644
index 00000000000..842dc7e722c
--- /dev/null
+++ b/python/docs/databricks.bundles.model_serving_endpoints.rst
@@ -0,0 +1,11 @@
+Model Serving Endpoints
+===============================
+
+.. currentmodule:: databricks.bundles.model_serving_endpoints
+
+**Package:** ``databricks.bundles.model_serving_endpoints``
+
+Classes
+---------------
+
+.. automodule:: databricks.bundles.model_serving_endpoints
diff --git a/python/docs/databricks.bundles.models.rst b/python/docs/databricks.bundles.models.rst
new file mode 100644
index 00000000000..d0c71bc68ba
--- /dev/null
+++ b/python/docs/databricks.bundles.models.rst
@@ -0,0 +1,11 @@
+Models
+===============================
+
+.. currentmodule:: databricks.bundles.models
+
+**Package:** ``databricks.bundles.models``
+
+Classes
+---------------
+
+.. automodule:: databricks.bundles.models
diff --git a/python/docs/databricks.bundles.quality_monitors.rst b/python/docs/databricks.bundles.quality_monitors.rst
new file mode 100644
index 00000000000..069916c1f1a
--- /dev/null
+++ b/python/docs/databricks.bundles.quality_monitors.rst
@@ -0,0 +1,11 @@
+Quality Monitors
+===============================
+
+.. currentmodule:: databricks.bundles.quality_monitors
+
+**Package:** ``databricks.bundles.quality_monitors``
+
+Classes
+---------------
+
+.. automodule:: databricks.bundles.quality_monitors
diff --git a/python/docs/databricks.bundles.registered_models.rst b/python/docs/databricks.bundles.registered_models.rst
new file mode 100644
index 00000000000..8389050f4cd
--- /dev/null
+++ b/python/docs/databricks.bundles.registered_models.rst
@@ -0,0 +1,11 @@
+Registered Models
+===============================
+
+.. currentmodule:: databricks.bundles.registered_models
+
+**Package:** ``databricks.bundles.registered_models``
+
+Classes
+---------------
+
+.. automodule:: databricks.bundles.registered_models
diff --git a/python/docs/databricks.bundles.secret_scopes.rst b/python/docs/databricks.bundles.secret_scopes.rst
new file mode 100644
index 00000000000..088b6902283
--- /dev/null
+++ b/python/docs/databricks.bundles.secret_scopes.rst
@@ -0,0 +1,11 @@
+Secret Scopes
+===============================
+
+.. currentmodule:: databricks.bundles.secret_scopes
+
+**Package:** ``databricks.bundles.secret_scopes``
+
+Classes
+---------------
+
+.. automodule:: databricks.bundles.secret_scopes
diff --git a/python/docs/databricks.bundles.secrets.rst b/python/docs/databricks.bundles.secrets.rst
new file mode 100644
index 00000000000..64ff4ad70b3
--- /dev/null
+++ b/python/docs/databricks.bundles.secrets.rst
@@ -0,0 +1,11 @@
+Secrets
+===============================
+
+.. currentmodule:: databricks.bundles.secrets
+
+**Package:** ``databricks.bundles.secrets``
+
+Classes
+---------------
+
+.. automodule:: databricks.bundles.secrets
diff --git a/python/docs/databricks.bundles.sql_warehouses.rst b/python/docs/databricks.bundles.sql_warehouses.rst
new file mode 100644
index 00000000000..774ec65cf3f
--- /dev/null
+++ b/python/docs/databricks.bundles.sql_warehouses.rst
@@ -0,0 +1,11 @@
+SQL Warehouses
+===============================
+
+.. currentmodule:: databricks.bundles.sql_warehouses
+
+**Package:** ``databricks.bundles.sql_warehouses``
+
+Classes
+---------------
+
+.. automodule:: databricks.bundles.sql_warehouses
diff --git a/python/docs/databricks.bundles.synced_database_tables.rst b/python/docs/databricks.bundles.synced_database_tables.rst
new file mode 100644
index 00000000000..5d63776b076
--- /dev/null
+++ b/python/docs/databricks.bundles.synced_database_tables.rst
@@ -0,0 +1,11 @@
+Synced Database Tables
+===============================
+
+.. currentmodule:: databricks.bundles.synced_database_tables
+
+**Package:** ``databricks.bundles.synced_database_tables``
+
+Classes
+---------------
+
+.. automodule:: databricks.bundles.synced_database_tables
diff --git a/python/docs/databricks.bundles.vector_search_endpoints.rst b/python/docs/databricks.bundles.vector_search_endpoints.rst
new file mode 100644
index 00000000000..48a6f792783
--- /dev/null
+++ b/python/docs/databricks.bundles.vector_search_endpoints.rst
@@ -0,0 +1,11 @@
+Vector Search Endpoints
+===============================
+
+.. currentmodule:: databricks.bundles.vector_search_endpoints
+
+**Package:** ``databricks.bundles.vector_search_endpoints``
+
+Classes
+---------------
+
+.. automodule:: databricks.bundles.vector_search_endpoints
diff --git a/python/docs/databricks.bundles.vector_search_indexes.rst b/python/docs/databricks.bundles.vector_search_indexes.rst
new file mode 100644
index 00000000000..0766cb57517
--- /dev/null
+++ b/python/docs/databricks.bundles.vector_search_indexes.rst
@@ -0,0 +1,11 @@
+Vector Search Indexes
+===============================
+
+.. currentmodule:: databricks.bundles.vector_search_indexes
+
+**Package:** ``databricks.bundles.vector_search_indexes``
+
+Classes
+---------------
+
+.. automodule:: databricks.bundles.vector_search_indexes
diff --git a/python/docs/ext/autodoc_databricks_bundles.py b/python/docs/ext/autodoc_databricks_bundles.py
index 8a6335a58d0..a6cbd91cd19 100644
--- a/python/docs/ext/autodoc_databricks_bundles.py
+++ b/python/docs/ext/autodoc_databricks_bundles.py
@@ -1,20 +1,19 @@
 import inspect
 import re
 import typing
-from dataclasses import is_dataclass, fields
+from dataclasses import fields, is_dataclass
 from inspect import Signature
 from types import NoneType, UnionType
-from typing import get_origin, Union, get_args
+from typing import Union, get_args, get_origin
 
 import sphinx.util.inspect as sphinx_inspect
 from sphinx.addnodes import pending_xref
-
 from sphinx.application import Sphinx
 from sphinx.util.inspect import stringify_signature
 from sphinx.util.typing import ExtensionMetadata
 
 from databricks.bundles.core._resource_type import _ResourceType
-from databricks.bundles.core._transform import _unwrap_variable, _unwrap_optional
+from databricks.bundles.core._transform import _unwrap_optional, _unwrap_variable
 
 
 def get_arg_name(arg):
@@ -73,12 +72,12 @@ def simplify_type(type, unwrap_variable=True):
 
     origin = get_origin(type)
 
-    if origin == list:
+    if origin is list:
         arg = simplify_type(get_args(type)[0], unwrap_variable=unwrap_variable)
         arg = _unwrap_optional(arg) or arg
 
         return list[arg]
-    elif origin == dict:
+    elif origin is dict:
         arg0 = simplify_type(get_args(type)[0], unwrap_variable=unwrap_variable)
         arg1 = simplify_type(get_args(type)[1], unwrap_variable=unwrap_variable)
 
@@ -109,9 +108,10 @@ def stringify_annotation(annotation, mode: str = "fully-qualified-except-typing"
 def resolve_forward_ref(obj, sig):
     # resolve forward references, because some types are recursive
 
+    import typing_extensions
+
     import databricks.bundles.core
     import databricks.bundles.jobs._models.task
-    import typing_extensions
 
     hints = typing.get_type_hints(
         obj,
@@ -303,8 +303,8 @@ def skip_member(app, what, name, obj, skip, options):
 
 
 def setup(app: Sphinx) -> ExtensionMetadata:
-    import databricks.bundles.jobs
     import databricks.bundles.core
+    import databricks.bundles.jobs
 
     # disable support for overloads, because Sphinx doesn't handle them well
     disable_sphinx_overloads()
diff --git a/python/docs/index.rst b/python/docs/index.rst
index 96eada6fdd4..5ca4bda8ede 100644
--- a/python/docs/index.rst
+++ b/python/docs/index.rst
@@ -3,14 +3,41 @@ databricks-bundles
 
 `databricks-bundles` package implements Python support for Declarative Automation Bundles.
 
-See `What is Python support for Declarative Automation Bundles? (TBD) <#>`_.
+See `Bundle configuration in Python <https://docs.databricks.com/aws/en/dev-tools/bundles/python>`_.
 
 
 .. toctree::
    :maxdepth: 7
 
    databricks.bundles.core
+   databricks.bundles.alerts
+   databricks.bundles.apps
+   databricks.bundles.catalogs
+   databricks.bundles.cluster_policies
+   databricks.bundles.clusters
+   databricks.bundles.dashboards
+   databricks.bundles.database_catalogs
+   databricks.bundles.database_instances
+   databricks.bundles.experiments
+   databricks.bundles.external_locations
+   databricks.bundles.features
+   databricks.bundles.genie_spaces
+   databricks.bundles.instance_pools
+   databricks.bundles.job_runs
    databricks.bundles.jobs
+   databricks.bundles.mcp_services
+   databricks.bundles.model_provider_services
+   databricks.bundles.model_services
+   databricks.bundles.model_serving_endpoints
+   databricks.bundles.models
    databricks.bundles.pipelines
+   databricks.bundles.quality_monitors
+   databricks.bundles.registered_models
    databricks.bundles.schemas
+   databricks.bundles.secret_scopes
+   databricks.bundles.secrets
+   databricks.bundles.sql_warehouses
+   databricks.bundles.synced_database_tables
+   databricks.bundles.vector_search_endpoints
+   databricks.bundles.vector_search_indexes
    databricks.bundles.volumes
diff --git a/python/pyproject.toml b/python/pyproject.toml
index 70bb6b2ad64..2be1092e73c 100644
--- a/python/pyproject.toml
+++ b/python/pyproject.toml
@@ -1,7 +1,7 @@
 [project]
 name = "databricks-bundles"
 description = "Python support for Declarative Automation Bundles"
-version = "0.299.0"
+version = "1.22.1"
 
 authors = [
     { name = "Gleb Kanterov", email = "gleb.kanterov@databricks.com" },
@@ -23,7 +23,6 @@ dev = [
   "pyright==1.1.380",
   "pytest-cov==5.0.0",
   "pytest==9.0.3",
-  "ruff==0.9.1",
   "sphinx==8.0.2",
   "typing_extensions==4.12.2",
 ]
@@ -58,15 +57,3 @@ executionEnvironments = [
 
 venvPath = "."
 venv = ".venv"
-
-[tool.ruff]
-# See https://docs.astral.sh/ruff/rules/
-lint.select = [
-    "E4",
-    "E7",
-    "E9",
-    "N", # pep8-naming
-    "F", # flake8
-    "I", # isort
-    "RUF022", # sort __all__, see: https://docs.astral.sh/ruff/rules/unsorted-dunder-all/
-]
diff --git a/python/ruff.toml b/python/ruff.toml
new file mode 100644
index 00000000000..bbd9c004f4d
--- /dev/null
+++ b/python/ruff.toml
@@ -0,0 +1,2 @@
+extend = "../ruff.toml"
+line-length = 88
diff --git a/python/uv.lock b/python/uv.lock
index 0bad92ba65b..8b796624f67 100644
--- a/python/uv.lock
+++ b/python/uv.lock
@@ -22,11 +22,11 @@ wheels = [
 
 [[package]]
 name = "certifi"
-version = "2025.1.31"
+version = "2026.10.19"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/1c/ab/c9f1e32b7b1bf505bf26f0ef697775960db7932abeb7b516de930ba2705f/certifi-2025.1.31.tar.gz", hash = "sha256:3d5da6925056f6f18f119200434a4780a94263f10d1c21d032a6f6b2baa20651", size = 167577, upload-time = "2025-01-31T02:16:47.166Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598, upload-time = "2026-10-20T02:24:16.604Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/38/fc/bce832fd4fd99766c04d1ee0eead6b0ec6486fb100ae5e74c1d91292b982/certifi-2025.1.31-py3-none-any.whl", hash = "sha256:ca78db4565a652026a4db2bcdf68f2fb589ea80d0be70e03929ed730746b84fe", size = 166393, upload-time = "2025-01-31T02:16:45.015Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" },
 ]
 
 [[package]]
@@ -166,7 +166,7 @@ toml = [
 
 [[package]]
 name = "databricks-bundles"
-version = "0.299.0"
+version = "1.22.1"
 source = { editable = "." }
 
 [package.dev-dependencies]
@@ -174,7 +174,6 @@ dev = [
     { name = "pyright" },
     { name = "pytest" },
     { name = "pytest-cov" },
-    { name = "ruff" },
     { name = "sphinx" },
     { name = "typing-extensions" },
 ]
@@ -186,7 +185,6 @@ dev = [
     { name = "pyright", specifier = "==1.1.380" },
     { name = "pytest", specifier = "==9.0.3" },
     { name = "pytest-cov", specifier = "==5.0.0" },
-    { name = "ruff", specifier = "==0.9.1" },
     { name = "sphinx", specifier = "==8.0.2" },
     { name = "typing-extensions", specifier = "==4.12.2" },
 ]
@@ -211,11 +209,11 @@ wheels = [
 
 [[package]]
 name = "idna"
-version = "3.10"
+version = "3.15"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/f1/70/7703c29685631f5a7590aa73f1f1d3fa9a380e654b86af429e0934a32f7d/idna-3.10.tar.gz", hash = "sha256:12f65c9b470abda6dc35cf8e63cc574b1c52b11df2c86030af0ac09b01b13ea9", size = 190490, upload-time = "2024-09-15T18:07:39.745Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/82/77/7b3966d0b9d1d31a36ddf1746926a11dface89a83409bf1483f0237aa758/idna-3.15.tar.gz", hash = "sha256:ca962446ea538f7092a95e057da437618e886f4d349216d2b1e294abfdb65fdc", size = 199245, upload-time = "2026-05-12T22:45:57.011Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/76/c6/c88e154df9c4e1a2a66ccf0005a88dfb2650c1dffb6f5ce603dfbd452ce3/idna-3.10-py3-none-any.whl", hash = "sha256:946d195a0d259cbba61165e88e65941f16e9b36ea6ddb97f00452bae8b1287d3", size = 70442, upload-time = "2024-09-15T18:07:37.964Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/23/408243171aa9aaba178d3e2559159c24c1171a641aa83b67bdd3394ead8e/idna-3.15-py3-none-any.whl", hash = "sha256:048adeaf8c2d788c40fee287673ccaa74c24ffd8dcf09ffa555a2fbb59f10ac8", size = 72340, upload-time = "2026-05-12T22:45:55.733Z" },
 ]
 
 [[package]]
@@ -400,31 +398,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/56/5d/c814546c2333ceea4ba42262d8c4d55763003e767fa169adc693bd524478/requests-2.33.0-py3-none-any.whl", hash = "sha256:3324635456fa185245e24865e810cecec7b4caf933d7eb133dcde67d48cee69b", size = 65017, upload-time = "2026-03-25T15:10:40.382Z" },
 ]
 
-[[package]]
-name = "ruff"
-version = "0.9.1"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/67/3e/e89f736f01aa9517a97e2e7e0ce8d34a4d8207087b3cfdec95133fee13b5/ruff-0.9.1.tar.gz", hash = "sha256:fd2b25ecaf907d6458fa842675382c8597b3c746a2dde6717fe3415425df0c17", size = 3498844, upload-time = "2025-01-10T18:57:53.896Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/dc/05/c3a2e0feb3d5d394cdfd552de01df9d3ec8a3a3771bbff247fab7e668653/ruff-0.9.1-py3-none-linux_armv6l.whl", hash = "sha256:84330dda7abcc270e6055551aca93fdde1b0685fc4fd358f26410f9349cf1743", size = 10645241, upload-time = "2025-01-10T18:56:45.897Z" },
-    { url = "https://files.pythonhosted.org/packages/dd/da/59f0a40e5f88ee5c054ad175caaa2319fc96571e1d29ab4730728f2aad4f/ruff-0.9.1-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:3cae39ba5d137054b0e5b472aee3b78a7c884e61591b100aeb544bcd1fc38d4f", size = 10391066, upload-time = "2025-01-10T18:56:52.224Z" },
-    { url = "https://files.pythonhosted.org/packages/b7/fe/85e1c1acf0ba04a3f2d54ae61073da030f7a5dc386194f96f3c6ca444a78/ruff-0.9.1-py3-none-macosx_11_0_arm64.whl", hash = "sha256:50c647ff96f4ba288db0ad87048257753733763b409b2faf2ea78b45c8bb7fcb", size = 10012308, upload-time = "2025-01-10T18:56:55.426Z" },
-    { url = "https://files.pythonhosted.org/packages/6f/9b/780aa5d4bdca8dcea4309264b8faa304bac30e1ce0bcc910422bfcadd203/ruff-0.9.1-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:f0c8b149e9c7353cace7d698e1656ffcf1e36e50f8ea3b5d5f7f87ff9986a7ca", size = 10881960, upload-time = "2025-01-10T18:56:59.539Z" },
-    { url = "https://files.pythonhosted.org/packages/12/f4/dac4361afbfe520afa7186439e8094e4884ae3b15c8fc75fb2e759c1f267/ruff-0.9.1-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:beb3298604540c884d8b282fe7625651378e1986c25df51dec5b2f60cafc31ce", size = 10414803, upload-time = "2025-01-10T18:57:04.919Z" },
-    { url = "https://files.pythonhosted.org/packages/f0/a2/057a3cb7999513cb78d6cb33a7d1cc6401c82d7332583786e4dad9e38e44/ruff-0.9.1-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:39d0174ccc45c439093971cc06ed3ac4dc545f5e8bdacf9f067adf879544d969", size = 11464929, upload-time = "2025-01-10T18:57:08.146Z" },
-    { url = "https://files.pythonhosted.org/packages/eb/c6/1ccfcc209bee465ced4874dcfeaadc88aafcc1ea9c9f31ef66f063c187f0/ruff-0.9.1-py3-none-manylinux_2_17_ppc64.manylinux2014_ppc64.whl", hash = "sha256:69572926c0f0c9912288915214ca9b2809525ea263603370b9e00bed2ba56dbd", size = 12170717, upload-time = "2025-01-10T18:57:12.564Z" },
-    { url = "https://files.pythonhosted.org/packages/84/97/4a524027518525c7cf6931e9fd3b2382be5e4b75b2b61bec02681a7685a5/ruff-0.9.1-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:937267afce0c9170d6d29f01fcd1f4378172dec6760a9f4dface48cdabf9610a", size = 11708921, upload-time = "2025-01-10T18:57:17.216Z" },
-    { url = "https://files.pythonhosted.org/packages/a6/a4/4e77cf6065c700d5593b25fca6cf725b1ab6d70674904f876254d0112ed0/ruff-0.9.1-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:186c2313de946f2c22bdf5954b8dd083e124bcfb685732cfb0beae0c47233d9b", size = 13058074, upload-time = "2025-01-10T18:57:20.57Z" },
-    { url = "https://files.pythonhosted.org/packages/f9/d6/fcb78e0531e863d0a952c4c5600cc5cd317437f0e5f031cd2288b117bb37/ruff-0.9.1-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:3f94942a3bb767675d9a051867c036655fe9f6c8a491539156a6f7e6b5f31831", size = 11281093, upload-time = "2025-01-10T18:57:25.526Z" },
-    { url = "https://files.pythonhosted.org/packages/e4/3b/7235bbeff00c95dc2d073cfdbf2b871b5bbf476754c5d277815d286b4328/ruff-0.9.1-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:728d791b769cc28c05f12c280f99e8896932e9833fef1dd8756a6af2261fd1ab", size = 10882610, upload-time = "2025-01-10T18:57:28.855Z" },
-    { url = "https://files.pythonhosted.org/packages/2a/66/5599d23257c61cf038137f82999ca8f9d0080d9d5134440a461bef85b461/ruff-0.9.1-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:2f312c86fb40c5c02b44a29a750ee3b21002bd813b5233facdaf63a51d9a85e1", size = 10489273, upload-time = "2025-01-10T18:57:32.219Z" },
-    { url = "https://files.pythonhosted.org/packages/78/85/de4aa057e2532db0f9761e2c2c13834991e087787b93e4aeb5f1cb10d2df/ruff-0.9.1-py3-none-musllinux_1_2_i686.whl", hash = "sha256:ae017c3a29bee341ba584f3823f805abbe5fe9cd97f87ed07ecbf533c4c88366", size = 11003314, upload-time = "2025-01-10T18:57:35.431Z" },
-    { url = "https://files.pythonhosted.org/packages/00/42/afedcaa089116d81447347f76041ff46025849fedb0ed2b187d24cf70fca/ruff-0.9.1-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:5dc40a378a0e21b4cfe2b8a0f1812a6572fc7b230ef12cd9fac9161aa91d807f", size = 11342982, upload-time = "2025-01-10T18:57:38.642Z" },
-    { url = "https://files.pythonhosted.org/packages/39/c6/fe45f3eb27e3948b41a305d8b768e949bf6a39310e9df73f6c576d7f1d9f/ruff-0.9.1-py3-none-win32.whl", hash = "sha256:46ebf5cc106cf7e7378ca3c28ce4293b61b449cd121b98699be727d40b79ba72", size = 8819750, upload-time = "2025-01-10T18:57:41.93Z" },
-    { url = "https://files.pythonhosted.org/packages/38/8d/580db77c3b9d5c3d9479e55b0b832d279c30c8f00ab0190d4cd8fc67831c/ruff-0.9.1-py3-none-win_amd64.whl", hash = "sha256:342a824b46ddbcdddd3abfbb332fa7fcaac5488bf18073e841236aadf4ad5c19", size = 9701331, upload-time = "2025-01-10T18:57:46.334Z" },
-    { url = "https://files.pythonhosted.org/packages/b2/94/0498cdb7316ed67a1928300dd87d659c933479f44dec51b4f62bfd1f8028/ruff-0.9.1-py3-none-win_arm64.whl", hash = "sha256:1cd76c7f9c679e6e8f2af8f778367dca82b95009bc7b1a85a47f1521ae524fa7", size = 9145708, upload-time = "2025-01-10T18:57:51.308Z" },
-]
-
 [[package]]
 name = "snowballstemmer"
 version = "2.2.0"
@@ -566,9 +539,9 @@ wheels = [
 
 [[package]]
 name = "urllib3"
-version = "2.6.3"
+version = "2.8.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/c7/24/5f1b3bdffd70275f6661c76461e25f024d5a38a46f04aaca912426a2b1d3/urllib3-2.6.3.tar.gz", hash = "sha256:1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed", size = 435556, upload-time = "2026-01-07T16:24:43.925Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/e3/05/b17359e1cefb4f909b5e40b1b90a496d987258916dbbf88e842c729f510e/urllib3-2.8.0.tar.gz", hash = "sha256:63bf2ead4c879426ebf22ef2a781eeb4aa3b4ae798a0435506f8687fd5bb9b63", size = 458972, upload-time = "2026-09-15T19:29:36.253Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/39/08/aaaad47bc4e9dc8c725e68f9d04865dbcb2052843ff09c97b08904852d84/urllib3-2.6.3-py3-none-any.whl", hash = "sha256:bf272323e553dfb2e87d9bfd225ca7b0f467b919d7bbd355436d3fd37cb0acd4", size = 131584, upload-time = "2026-01-07T16:24:42.685Z" },
+    { url = "https://files.pythonhosted.org/packages/92/9d/c4e665119135114480843e7ab388fa94d8480650450e6f8e26b70d323a4c/urllib3-2.8.0-py3-none-any.whl", hash = "sha256:0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3", size = 135717, upload-time = "2026-09-15T19:29:34.577Z" },
 ]
diff --git a/ruff.toml b/ruff.toml
index b3f7f35d3d6..db6ffa98604 100644
--- a/ruff.toml
+++ b/ruff.toml
@@ -1,6 +1,68 @@
 line-length = 120
 
 
+# Excluded from BOTH linting and formatting. These must be pruned during
+# directory traversal (not lint-only) because they either follow different rules
+# entirely (tagging.py is synced from universe) or live under their own nested
+# ruff config that a root-level lint exclude cannot reach: the instantiated
+# `bundle init` projects (acceptance/**/output) carry their own pyproject
+# [tool.ruff], and some testdata carries its own .ruff.toml. Formatting these is
+# unnecessary anyway — they are generated outputs and intentionally-varied test
+# inputs. extend-exclude (not exclude) keeps ruff's built-in defaults.
+extend-exclude = [
+    "tagging.py",
+    "acceptance/**/output",
+    # default-sql carries its own .ruff.toml above output/, which re-roots
+    # traversal and shields output/ from the acceptance/**/output prune above.
+    "acceptance/bundle/templates/default-sql",
+    "**/testdata",
+]
+
+[lint]
+select = [
+    "E4",   # pycodestyle: import formatting (E501 line-length is left to the formatter)
+    "E7",   # pycodestyle: statement errors (e.g. `== None`, type comparisons)
+    "E9",   # pycodestyle: syntax / runtime errors
+    "F",    # pyflakes: undefined names, unused imports/variables, f-strings
+    "I",    # isort: import ordering
+    "B",    # flake8-bugbear: likely bugs (mutable defaults, zip without strict, ...)
+    "C4",   # flake8-comprehensions: simpler/clearer comprehensions
+    "PIE",  # flake8-pie: misc lints (unnecessary placeholders, dict literals, ...)
+    "FLY",  # flynt: prefer f-strings over str.join on literals
+    "FURB", # refurb: modernizations that don't change the target Python version
+    "LOG",  # flake8-logging: logging API misuse
+    "ISC",  # flake8-implicit-str-concat
+    "RUF",  # ruff-specific rules (RUF022 sorts __all__, RUF100 flags stale noqa, ...)
+]
+
+ignore = [
+    # ISC001/ISC002 are handled by the formatter; enabling them as lint rules
+    # conflicts with `ruff format`.
+    "ISC001",
+    "ISC002",
+    # The generated SDK docstrings carry non-ASCII characters copied verbatim
+    # from the OpenAPI spec; flagging them as ambiguous is a false positive.
+    "RUF001",
+    "RUF002",
+    "RUF003",
+]
+
+# Excluded from LINTING only — these are still formatted (whole-repo `ruff
+# format` coverage is unchanged). They are acceptance fixtures and template
+# sources that intentionally don't satisfy the lint rules: Databricks notebooks
+# using the injected `spark`/`dbutils` globals, sample wheels, bundle input
+# scripts, and `.py.tmpl` template sources. The /** glob is required (a bare dir
+# name only prunes via the top-level exclude, not here).
 exclude = [
-    "tagging.py" # tagging.py is synced from universe in the `openapi/tagging` directory and follows different format rules.
+    ".vscode/**",                 # Pylance __builtins__.pyi stub uses a star-import by design
+    "acceptance/bundle/**",       # acceptance fixtures
+    "acceptance/pipelines/**",    # acceptance fixtures
+    "acceptance/cmd/**",          # acceptance fixtures
+    "libs/template/templates/**", # template sources (.py.tmpl + fixture .py)
 ]
+
+[lint.per-file-ignores]
+# dbutils and spark are injected into the global namespace by the Databricks
+# runtime where these scripts execute; they are never imported.
+"experimental/ssh/internal/client/ssh-server-bootstrap.py" = ["F821"]
+"acceptance/dbr_runner.py" = ["F821"]
diff --git a/tools/bench_parse.py b/tools/bench_parse.py
old mode 100755
new mode 100644
index 6c600f323e5..467e4c237fe
--- a/tools/bench_parse.py
+++ b/tools/bench_parse.py
@@ -3,9 +3,9 @@
 Parses output of benchmark runs (e.g. "./task bench-100") and prints a summary table.
 """
 
-import sys
 import re
 import statistics
+import sys
 from collections import defaultdict
 
 
@@ -14,6 +14,26 @@ def parse_key_values(text):
 
     >>> parse_key_values("wall=10.316  ru_utime=19.207  ru_stime=0.505  ru_maxrss=573079552")
     {'wall': 10.316, 'ru_utime': 19.207, 'ru_stime': 0.505, 'ru_maxrss': 573079552.0}
+
+    Empty string returns empty dict:
+
+    >>> parse_key_values("")
+    {}
+
+    Single pair:
+
+    >>> parse_key_values("key=42")
+    {'key': 42.0}
+
+    Non-numeric values are kept as strings:
+
+    >>> parse_key_values("name=test  count=5")
+    {'name': 'test', 'count': 5.0}
+
+    Pairs without equals sign are skipped:
+
+    >>> parse_key_values("valid=1  invalid  also_valid=2")
+    {'valid': 1.0, 'also_valid': 2.0}
     """
     result = {}
     for kv_pair in text.split():
@@ -53,7 +73,24 @@ def parse_bench_output(file_path):
 
 
 def calculate_means(results):
-    """Calculate mean values for each metric."""
+    """Calculate mean values for each metric.
+
+    >>> calculate_means({"test1": {"wall": [10, 20]}})
+    {'test1': {'wall': 15}}
+
+    >>> calculate_means({"test1": {"wall": [1.5, 2.5, 3.0]}})  # doctest: +ELLIPSIS
+    {'test1': {'wall': 2.33...}}
+
+    Multiple tests and metrics:
+
+    >>> sorted(calculate_means({"t1": {"m1": [2, 4], "m2": [100]}, "t2": {"m1": [3]}}).items())
+    [('t1', {'m1': 3, 'm2': 100}), ('t2', {'m1': 3})]
+
+    Empty metrics list returns zero:
+
+    >>> calculate_means({"test": {"metric": []}})
+    {'test': {'metric': 0}}
+    """
     means = {}
     for test_name, metrics in results.items():
         means[test_name] = {metric: statistics.mean(values) if values else 0 for metric, values in metrics.items()}
diff --git a/tools/bump_mlops_stacks.py b/tools/bump_mlops_stacks.py
new file mode 100644
index 00000000000..a37174f10c0
--- /dev/null
+++ b/tools/bump_mlops_stacks.py
@@ -0,0 +1,160 @@
+#!/usr/bin/env python3
+"""Refresh the vendored mlops-stacks acceptance template to upstream HEAD.
+
+The local test leg inits from the vendored copy; the cloud leg clones upstream.
+Only the files the template renders for this test's config are vendored, and that
+set is recomputed on every bump by rendering upstream, so an upstream rename is
+picked up without a hand-maintained file list.
+"""
+
+import json
+import os
+import shutil
+import subprocess
+import tempfile
+from pathlib import Path
+from string import Template
+
+REPO_URL = "https://github.com/databricks/mlops-stacks"
+
+TEST_DIR = Path("acceptance/bundle/deploy/mlops-stacks")
+TEMPLATE_DIR = TEST_DIR / "template"
+REVISION_FILE = TEST_DIR / "template.REVISION"
+
+# Upstream's project dir name is an illegal Go module path, so we vendor it renamed.
+# The project name is lowercase-alphanumeric, so the transform is a no-op and the
+# rendered output is unchanged.
+UPSTREAM_PROJECT_DIR = "{{template `project_name_alphanumeric_underscore` .}}"
+VENDORED_PROJECT_DIR = "{{.input_project_name}}"
+
+# The test's config.json.tmpl is envsubst'd by the script; substitute the values the
+# local leg gets. CLOUD_ENV is unset locally, which acceptance_test.go maps to "aws".
+RENDER_ENV = {"UNIQUE_NAME": "x", "CLOUD_ENV_BASE": "aws"}
+
+# Everything under template/ but outside the generated project is template machinery
+# (run_validations, update_layout). It renders no output of its own, so it cannot be
+# discovered from the rendered tree and is always kept.
+PROJECT_ROOT_SEG = "{{.input_root_dir}}"
+
+
+def render_path(rel_path, config):
+    r"""Map a path under the upstream template/ dir to its path in the rendered project.
+
+    The result carries the OS path separator, so the examples normalize it with
+    ``.replace("\\", "/")`` to read the same on POSIX and Windows.
+
+    >>> render_path(Path("template/{{.input_root_dir}}/job.yml"), {"input_root_dir": "src", "input_project_name": "myproj"}).replace("\\", "/")
+    'template/src/job.yml'
+
+    >>> render_path(Path("template/{{.input_project_name}}/config.json.tmpl"), {"input_root_dir": "src", "input_project_name": "myproj"}).replace("\\", "/")
+    'template/myproj/config.json'
+
+    Handles both vendor and upstream project directory patterns:
+    >>> cfg = {"input_root_dir": ".", "input_project_name": "proj"}
+    >>> render_path(Path("template/{{.input_root_dir}}/{{template `project_name_alphanumeric_underscore` .}}/file"), cfg).replace("\\", "/")
+    'template/./proj/file'
+
+    Removes .tmpl suffix:
+    >>> render_path(Path("template/README.md.tmpl"), {"input_root_dir": ".", "input_project_name": "p"}).replace("\\", "/")
+    'template/README.md'
+    """
+    subs = {
+        PROJECT_ROOT_SEG: config["input_root_dir"],
+        VENDORED_PROJECT_DIR: config["input_project_name"],
+        UPSTREAM_PROJECT_DIR: config["input_project_name"],
+    }
+    rendered = str(rel_path)
+    for old, new in subs.items():
+        rendered = rendered.replace(old, new)
+    return rendered.removesuffix(".tmpl")
+
+
+def render(cli, clone_dir, config_file, out_dir):
+    empty_cfg = out_dir.parent / "empty.databrickscfg"
+    empty_cfg.touch()
+    # bundle init authenticates before rendering, so drop the caller's Databricks
+    # environment and point it at a non-resolving host with an empty config file.
+    env = {k: v for k, v in os.environ.items() if not k.startswith("DATABRICKS_")}
+    env |= {
+        "DATABRICKS_HOST": "https://bump-mlops-stacks.test",
+        "DATABRICKS_TOKEN": "dummy",
+        "DATABRICKS_CONFIG_FILE": str(empty_cfg),
+    }
+    subprocess.run(
+        [str(cli), "bundle", "init", str(clone_dir), "--config-file", str(config_file)],
+        check=True,
+        cwd=out_dir,
+        stdout=subprocess.DEVNULL,
+        env=env,
+    )
+
+
+def keep_set(clone_dir, out_dir, config):
+    """List the upstream files needed to render this test's project, relative to the repo root."""
+    keep = [Path("databricks_template_schema.json")]
+    keep += sorted(p.relative_to(clone_dir) for p in (clone_dir / "library").rglob("*") if p.is_file())
+    for path in sorted((clone_dir / "template").rglob("*")):
+        if not path.is_file():
+            continue
+        rel = path.relative_to(clone_dir)
+        in_project = rel.parts[1:2] == (PROJECT_ROOT_SEG,)
+        if not in_project or (out_dir / render_path(rel.relative_to("template"), config)).exists():
+            keep.append(rel)
+    return keep
+
+
+def vendored_path(rel_path):
+    """Replace upstream project directory pattern with vendored pattern.
+
+    Returns a Path; the examples call ``.as_posix()`` so the separator (and the
+    Posix/Windows repr) reads the same on both platforms.
+
+    >>> vendored_path(Path("template/{{template `project_name_alphanumeric_underscore` .}}/config")).as_posix()
+    'template/{{.input_project_name}}/config'
+
+    >>> vendored_path(Path("library/helpers.py")).as_posix()
+    'library/helpers.py'
+
+    >>> vendored_path(Path("a/{{template `project_name_alphanumeric_underscore` .}}/b/{{template `project_name_alphanumeric_underscore` .}}/c")).as_posix()
+    'a/{{.input_project_name}}/b/{{.input_project_name}}/c'
+    """
+    return Path(*[VENDORED_PROJECT_DIR if p == UPSTREAM_PROJECT_DIR else p for p in rel_path.parts])
+
+
+def main():
+    root = Path(__file__).resolve().parent.parent
+    config = Template((root / TEST_DIR / "config.json.tmpl").read_text()).substitute(RENDER_ENV)
+
+    with tempfile.TemporaryDirectory(prefix="mlops-stacks-") as tmp:
+        tmp = Path(tmp)
+        clone_dir, out_dir, cli = tmp / "upstream", tmp / "rendered", tmp / "cli"
+        out_dir.mkdir()
+        subprocess.run(["go", "build", "-o", str(cli), "."], check=True, cwd=root)
+        config_file = tmp / "config.json"
+        config_file.write_text(config)
+
+        subprocess.run(["git", "clone", "--depth", "1", "--quiet", REPO_URL, str(clone_dir)], check=True)
+        sha = subprocess.run(
+            ["git", "-C", str(clone_dir), "rev-parse", "HEAD"],
+            check=True,
+            capture_output=True,
+            text=True,
+        ).stdout.strip()
+
+        render(cli, clone_dir, config_file, out_dir)
+        keep = keep_set(clone_dir, out_dir, json.loads(config))
+
+        template_dir = root / TEMPLATE_DIR
+        shutil.rmtree(template_dir)
+        for rel in keep:
+            dst = template_dir / vendored_path(rel)
+            dst.parent.mkdir(parents=True, exist_ok=True)
+            shutil.copyfile(clone_dir / rel, dst)
+
+    (root / REVISION_FILE).write_text(sha + "\n")
+
+    print(f"Vendored {len(keep)} files from {REPO_URL} @ {sha}")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/check_deadcode.py b/tools/check_deadcode.py
old mode 100755
new mode 100644
index 5c37f1f4750..d36197f0c1f
--- a/tools/check_deadcode.py
+++ b/tools/check_deadcode.py
@@ -41,12 +41,48 @@
 # of the file path in deadcode output.
 EXCLUDED_DIRS = [
     "libs/gorules/",  # Lint rule definitions loaded by golangci-lint's ruleguard
-    "bundle/internal/tf/schema/",  # Generated from Terraform provider schema
 ]
 
 ALLOW_COMMENT = "//deadcode:allow"
 
 
+def should_exclude_line(line, excluded_dirs):
+    """Check if a deadcode output line refers to an excluded directory.
+
+    >>> should_exclude_line("libs/gorules/myrule.go:10:5: func", ["libs/gorules/"])
+    True
+
+    >>> should_exclude_line("cmd/bundle/deploy.go:10:5: func", ["libs/gorules/"])
+    False
+
+    A directory anywhere in the path (not only a prefix) excludes the line:
+
+    >>> should_exclude_line("x/libs/gorules/gen.go:10:5: func", ["libs/gorules/"])
+    True
+    """
+    return any(line.startswith(d) or ("/" + d) in line for d in excluded_dirs)
+
+
+def parse_deadcode_line(line):
+    """Parse a deadcode output line into (filepath, lineno) or return None if unparseable.
+
+    Typical deadcode format: path/to/file.go:123:45: message
+
+    >>> parse_deadcode_line("cmd/main.go:42:3: func Foo")
+    ('cmd/main.go', 42)
+
+    A line that doesn't match the "file:line:col:" shape returns None:
+
+    >>> parse_deadcode_line("invalid line format")
+
+    >>> parse_deadcode_line("")
+    """
+    match = re.match(r"(.+?):(\d+):\d+:", line)
+    if not match:
+        return None
+    return (match.group(1), int(match.group(2)))
+
+
 def main():
     result = subprocess.run(
         ["go", "tool", "-modfile=tools/go.mod", "deadcode", "-test", "./..."],
@@ -67,16 +103,15 @@ def main():
     violations = []
 
     for line in lines:
-        if any(line.startswith(d) or ("/" + d) in line for d in EXCLUDED_DIRS):
+        if should_exclude_line(line, EXCLUDED_DIRS):
             continue
 
-        match = re.match(r"(.+?):(\d+):\d+:", line)
-        if not match:
+        parsed = parse_deadcode_line(line)
+        if not parsed:
             violations.append(line)
             continue
 
-        filepath = match.group(1)
-        lineno = int(match.group(2))
+        filepath, lineno = parsed
 
         try:
             with open(filepath) as f:
diff --git a/tools/gh_parse.py b/tools/gh_parse.py
old mode 100755
new mode 100644
index 3425aa3e797..166f4b29b40
--- a/tools/gh_parse.py
+++ b/tools/gh_parse.py
@@ -6,9 +6,9 @@
 Analyze downloaded GH logs and print a report. Use gh_report.py instead of this script directly.
 """
 
-import sys
-import json
 import argparse
+import json
+import sys
 from collections import Counter
 from pathlib import Path
 
@@ -38,7 +38,7 @@
 # The order is important - in case of ambiguity, earlier one gets preference.
 # For examples, each environment gets a summary icon which is earliest action in this list among all tests.
 INTERESTING_ACTIONS = (PANIC, BUG, FAIL, KNOWN_FAILURE, MISSING, FLAKY, RECOVERED, KNOWN_SKIP)
-ACTIONS_WITH_ICON = INTERESTING_ACTIONS + (PASS, SKIP)
+ACTIONS_WITH_ICON = (*INTERESTING_ACTIONS, PASS, SKIP)
 
 # Minimum elapsed time for test to be in slowest tests table.
 SLOWEST_MIN_MINUTES = 2
@@ -91,6 +91,28 @@ def matches(self, package_name, test_name):
             return test_name == self.test_pattern or self._matches_path_prefix(self.test_pattern, test_name)
 
     def _matches_path_prefix(self, s, pattern):
+        """
+        Check if string s matches pattern as a path prefix.
+
+        Matches if pattern is empty (wildcard), s equals pattern exactly,
+        or s starts with pattern followed by a "/".
+
+        >>> rule = KnownFailuresRule("", "", False, False, "")
+        >>> rule._matches_path_prefix("bundle", "")
+        True
+
+        >>> rule._matches_path_prefix("bundle", "bundle")
+        True
+
+        >>> rule._matches_path_prefix("libs/auth", "libs")
+        True
+
+        >>> rule._matches_path_prefix("libsother", "libs")
+        False
+
+        >>> rule._matches_path_prefix("bundle", "bundle/subtest")
+        False
+        """
         if pattern == "":
             return True
         if s == pattern:
@@ -105,7 +127,7 @@ def parse_known_failures(content):
     >>> _test_parse_known_failures()
     """
     rules = []
-    for line_num, line in enumerate(content.splitlines(), 1):
+    for _line_num, line in enumerate(content.splitlines(), 1):
         line = line.strip()
         if not line or line.startswith("#"):
             continue
@@ -131,6 +153,24 @@ def parse_known_failures(content):
 
 
 def _parse_pattern(pattern):
+    """
+    Parse a pattern string, extracting the base and a prefix flag.
+
+    Returns (base, is_prefix) where is_prefix indicates if the pattern
+    ended with "/" (directory prefix match) or was "*" (wildcard).
+
+    >>> _parse_pattern("bundle")
+    ('bundle', False)
+
+    >>> _parse_pattern("*")
+    ('', True)
+
+    >>> _parse_pattern("libs/")
+    ('libs', True)
+
+    >>> _parse_pattern("foo/bar/")
+    ('foo/bar', True)
+    """
     if pattern == "*":
         return "", True
     if pattern.endswith("/"):
@@ -245,12 +285,15 @@ def load_known_failures():
 
 def cleanup_env(name):
     """
-    >>> cleanup_env("test-output-aws-prod-is-linux-ubuntu-latest")
+    >>> cleanup_env("test-output-aws-cli-is-linux-ubuntu-latest")
     'aws linux'
 
-    >>> cleanup_env("test-output-gcp-prod-is-windows-server-latest")
+    >>> cleanup_env("test-output-gcp-cli-is-windows-server-latest")
     'gcp windows'
 
+    >>> cleanup_env("test-output-aws-prod-is-linux-ubuntu-latest")
+    'aws linux'
+
     >>> cleanup_env("test-output-azure-prod-ucws-is-linux-ubuntu-latest")
     'azure-ucws linux'
     """
@@ -259,6 +302,7 @@ def cleanup_env(name):
     name = name.removeprefix("test-output-")
     name = name.replace("-prod-ucws-is-", "-ucws-")
     name = name.replace("-prod-is-", "-")
+    name = name.replace("-cli-is-", "-")
     name = name.replace("-linux-ubuntu-latest", " linux")
     name = name.replace("-windows-server-latest", " windows")
     return name
@@ -269,7 +313,7 @@ def iter_path(filename):
     if p.is_file():
         yield filename
         return
-    for dirpath, dirnames, filenames in p.walk():
+    for dirpath, _dirnames, filenames in p.walk():
         for f in filenames:
             yield dirpath / f
 
@@ -339,7 +383,25 @@ def parse_file(path, filter):
 
 
 def mark_known_failures(results, known_failures_config):
-    """Mark tests as KNOWN_FAILURE or RECOVERED based on known failures config."""
+    """Mark tests as KNOWN_FAILURE or RECOVERED based on known failures config.
+
+    A ``None`` config leaves every result unchanged:
+
+    >>> mark_known_failures({("pkg", "TestA"): FAIL}, None) == {("pkg", "TestA"): FAIL}
+    True
+
+    A matching rule remaps FAIL/PASS/SKIP to their known variants; non-matching
+    tests are left as-is:
+
+    >>> cfg = parse_known_failures("pkg TestA")
+    >>> mark_known_failures({("pkg", "TestA"): FAIL, ("pkg", "TestB"): FAIL}, cfg) == {
+    ...     ("pkg", "TestA"): KNOWN_FAILURE,
+    ...     ("pkg", "TestB"): FAIL,
+    ... }
+    True
+    >>> mark_known_failures({("pkg", "TestA"): PASS}, cfg) == {("pkg", "TestA"): RECOVERED}
+    True
+    """
     marked_results = {}
     for test_key, action in results.items():
         package_name, testname = test_key
@@ -408,7 +470,7 @@ def is_bug(test_results):
             # incomplete results
             return False
         count = 0
-        for e, env_results in test_results.items():
+        for _e, env_results in test_results.items():
             if PASS in env_results:
                 return False
             if FLAKY in env_results:
@@ -423,7 +485,7 @@ def is_bug(test_results):
         test_results = per_test_per_env_stats.get(test_key, {})
         if not is_bug(test_results):
             continue
-        for e, env_results in sorted(test_results.items()):
+        for _e, env_results in sorted(test_results.items()):
             if env_results[FAIL] > 0:
                 env_results[FAIL] -= 1
                 if not env_results[FAIL]:
@@ -431,7 +493,7 @@ def is_bug(test_results):
                 env_results[BUG] += 1
 
     per_env_stats = {}  # env -> action -> count
-    for test_key, items in per_test_per_env_stats.items():
+    for _test_key, items in per_test_per_env_stats.items():
         for env, stats in items.items():
             per_env_stats.setdefault(env, Counter()).update(stats)
 
@@ -527,7 +589,7 @@ def key(column):
                 status, info = action[:2], action[2:]
                 summary[info] = summary.get(info, 0) + 1
                 break
-        items_proc = dict((k, short_action(v)) for (k, v) in items.items())
+        items_proc = {k: short_action(v) for (k, v) in items.items()}
         table.append(
             {
                 " ": status,
@@ -555,7 +617,7 @@ def key(column):
 
     if top_slowest:
         slowest_table = []
-        for env, package_name, testname, duration in top_slowest:
+        for env, _package_name, testname, duration in top_slowest:
             slowest_table.append({"duration": format_duration(duration), "env": env, "testname": testname})
 
         slowest_table_txt = format_table(slowest_table, columns=["duration", "env", "testname"], markdown=markdown)
@@ -588,6 +650,21 @@ def key(column):
 
 
 def make_summary_message(table, summary):
+    """
+    Create a summary message from test results.
+
+    Formats as "N interesting tests: count1 info1, count2 info2, ..."
+    with results sorted by count (highest first).
+
+    >>> make_summary_message([{}, {}, {}], {"failed": 2, "flaky": 1})
+    '3 interesting tests: 2 failed, 1 flaky'
+
+    >>> make_summary_message([{}], {"panic": 5})
+    '1 interesting tests: 5 panic'
+
+    >>> make_summary_message([], {})
+    '0 interesting tests: '
+    """
     items = list(summary.items())
     items.sort(key=lambda x: x[1], reverse=True)
     items = ", ".join(f"{count} {info}" for (info, count) in items)
@@ -597,6 +674,25 @@ def make_summary_message(table, summary):
 # For test table, use shorter version of action.
 # We have full action name in env table, so that is used as agenda.
 def short_action(action):
+    """
+    Return short version of action for table display.
+
+    If the action has a zero-width space at position 1 (emoji format),
+    return first 3 characters (emoji + zero-width space + first letter).
+    Otherwise return the action unchanged.
+
+    >>> short_action("\u274c\\u200bFAIL")
+    '\u274c\\u200bF'
+
+    >>> short_action("\u2705\\u200bpass")
+    '\u2705\\u200bp'
+
+    >>> short_action("regular_text")
+    'regular_text'
+
+    >>> short_action("AB")
+    'AB'
+    """
     if len(action) >= 4 and action[1] == "\u200b":
         # include first non-emoji letter in case emoji rendering is broken
         return action[:3]
@@ -611,6 +707,23 @@ def format_table(table, columns=None, markdown=False):
         table (list[dict]): the data rows
         columns (list[str]): header names & column order
         markdown (bool): whether to output in markdown format
+
+    Columns are padded to a common width (``.splitlines()`` keeps the alignment
+    padding out of this file's own trailing whitespace):
+
+    >>> format_table([{"a": "1", "b": "hello"}], columns=["a", "b"]).splitlines()
+    ['a    b  ', '1  hello']
+
+    >>> print(format_table([{"Env": "aws", "x": "1"}], columns=["Env", "x"], markdown=True))
+    | Env | x |
+    | --- | - |
+    | aws | 1 |
+    <BLANKLINE>
+
+    An empty table yields an empty list rather than a string:
+
+    >>> format_table([])
+    []
     """
     if not table:
         return []
@@ -636,15 +749,17 @@ def format_table(table, columns=None, markdown=False):
 
     if markdown:
         # Header
-        write("| " + " | ".join(autojust(str(col), w) for col, w in zip(columns, widths)) + " |")
+        write("| " + " | ".join(autojust(str(col), w) for col, w in zip(columns, widths, strict=False)) + " |")
         # Separator
         write("| " + " | ".join("-" * w for w in widths) + " |")
         # Data rows
         for row in table:
-            write("| " + " | ".join(autojust(row.get(col, ""), w) for col, w in zip(columns, widths)) + " |")
+            write(
+                "| " + " | ".join(autojust(row.get(col, ""), w) for col, w in zip(columns, widths, strict=False)) + " |"
+            )
     else:
         write(fmt(columns, widths))
-        for ind, row in enumerate(table):
+        for _ind, row in enumerate(table):
             write(fmt([row.get(col, "") for col in columns], widths))
 
     write("")
@@ -653,10 +768,45 @@ def format_table(table, columns=None, markdown=False):
 
 
 def fmt(cells, widths):
-    return "  ".join(autojust(cell, w) for cell, w in zip(cells, widths))
+    """
+    Format cells as a single table row with specified column widths.
+
+    Joins cells with two spaces, applying autojust to each cell.
+
+    >>> fmt(["Name", "123", "Status"], [8, 5, 6])
+    'Name       123   Status'
+
+    >>> fmt(["A", "B"], [3, 3])
+    ' A    B '
+
+    >>> fmt([], [])
+    ''
+    """
+    return "  ".join(autojust(cell, w) for cell, w in zip(cells, widths, strict=False))
 
 
 def autojust(value, width):
+    """
+    Right-align numeric and short values, left-align longer text.
+
+    For terminal display: numeric strings and values with 3 or fewer
+    characters are centered. Longer strings are left-justified.
+
+    >>> autojust("123", 5)
+    ' 123 '
+
+    >>> autojust("test", 6)
+    'test  '
+
+    >>> autojust("AB", 4)
+    ' AB '
+
+    >>> autojust("", 3)
+    '   '
+
+    >>> autojust(0, 3)
+    ' 0 '
+    """
     # Note, this has no effect on how markdown is rendered, only relevant for terminal output
     value = str(value)
     if value.isdigit():
@@ -667,11 +817,39 @@ def autojust(value, width):
 
 
 def wrap_in_details(txt, summary):
+    r"""Wrap ``txt`` in a collapsible GitHub-markdown ``<details>`` block.
+
+    >>> wrap_in_details("BODY", "3 interesting tests")
+    '<details><summary>3 interesting tests</summary>\n\nBODY\n\n</details>'
+    """
     return f"<details><summary>{summary}</summary>\n\n{txt}\n\n</details>"
 
 
 def format_duration(seconds):
-    """Format duration from seconds to MM:SS format."""
+    """
+    Format duration from seconds to MM:SS format.
+
+    Returns empty string for None input. Handles fractional seconds
+    by truncating to integers.
+
+    >>> format_duration(65)
+    '1:05'
+
+    >>> format_duration(3661)
+    '61:01'
+
+    >>> format_duration(0)
+    '0:00'
+
+    >>> format_duration(59)
+    '0:59'
+
+    >>> format_duration(None)
+    ''
+
+    >>> format_duration(3.7)
+    '0:03'
+    """
     if seconds is None:
         return ""
     minutes = int(seconds // 60)
diff --git a/tools/gh_report.py b/tools/gh_report.py
old mode 100755
new mode 100644
index 368dc8bc908..ef7a245ec4e
--- a/tools/gh_report.py
+++ b/tools/gh_report.py
@@ -8,18 +8,17 @@
 If neither --commit nor --run are passed, will use either current PR or HEAD.
 """
 
-import sys
-import os
-import subprocess
 import argparse
 import json
+import os
 import pprint
+import subprocess
+import sys
+import threading
 import time
 import urllib.request
-import threading
 from pathlib import Path
 
-
 CLI_REPO = "databricks/cli"
 DECO_REPO = os.environ.get("DECO_REPO") or os.environ.get("GITHUB_REPOSITORY")
 DECO_TESTS_PREFIX = "https://go/deco-tests/"
@@ -39,6 +38,123 @@ def run(cmd, shell=False):
     return subprocess.run(cmd, check=True, shell=False)
 
 
+# The check-run API rejects output.text over 65535 characters, and the update-check
+# action in eng-dev-ecosystem passes the report to `gh` as a single argument, which
+# fails exec() above 128KB. Keep the markdown report safely under both limits.
+MAX_MARKDOWN_SIZE = 60_000
+
+
+def find_tables(lines):
+    """Return (start, end) line ranges of consecutive markdown table lines.
+
+    >>> find_tables(["intro", "| a |", "| - |", "| 1 |", "", "| b |"])
+    [(1, 4), (5, 6)]
+
+    Empty input returns no tables:
+    >>> find_tables([])
+    []
+
+    Single table spans entire input:
+    >>> find_tables(["| a |", "| - |", "| 1 |"])
+    [(0, 3)]
+
+    Table at start:
+    >>> find_tables(["| x |", "| - |", "text"])
+    [(0, 2)]
+
+    Table at end:
+    >>> find_tables(["text", "| y |", "| - |"])
+    [(1, 3)]
+
+    No tables returns empty:
+    >>> find_tables(["line1", "line2", "line3"])
+    []
+    """
+    tables = []
+    start = None
+    for i, line in enumerate([*lines, ""]):
+        if line.startswith("|"):
+            if start is None:
+                start = i
+        elif start is not None:
+            tables.append((start, i))
+            start = None
+    return tables
+
+
+def trim_tables(text, limit=MAX_MARKDOWN_SIZE):
+    r"""Drop rows from the end of the largest markdown table until the report fits in limit bytes.
+
+    Reports under the limit are returned unchanged:
+
+    >>> trim_tables("| a |\n| b |", limit=100)
+    '| a |\n| b |'
+
+    Oversized reports lose trailing table rows and gain a note about it:
+
+    >>> rows = [f"| row {i:02d} |" for i in range(1, 21)]
+    >>> report = "\n".join(["intro"] + rows + ["outro"])
+    >>> len(report.encode())
+    231
+    >>> print(trim_tables(report, limit=180))
+    intro
+    | row 01 |
+    | row 02 |
+    | row 03 |
+    | row 04 |
+    | row 05 |
+    | row 06 |
+    outro
+    (14 table rows omitted to keep the report under 180 bytes)
+
+    Empty text fits any limit:
+    >>> trim_tables("", limit=10)
+    ''
+
+    Text with no tables (below limit) is unchanged:
+    >>> trim_tables("just text", limit=100)
+    'just text'
+
+    Trimming prioritizes the largest table:
+    >>> big_table = "\n".join(["| row |"] * 15)
+    >>> small_table = "\n".join(["| x |"] * 2)
+    >>> report = big_table + "\n" + small_table
+    >>> result = trim_tables(report, limit=50)
+    >>> "table rows omitted" in result
+    True
+    >>> "| row |" in result  # big table partially preserved
+    True
+
+    Header and separator rows are always kept:
+    >>> table = "| Header |\n| --- |\n| row 1 |\n| row 2 |\n| row 3 |"
+    >>> result = trim_tables(table, limit=40)
+    >>> "| --- |" in result  # separator always present
+    True
+    >>> "| Header |" in result  # header always present
+    True
+    """
+    size = len(text.encode())
+    if size <= limit:
+        return text
+    lines = text.split("\n")
+    budget = limit - 100  # reserve room for the omission note
+    omitted = 0
+    while size > budget:
+        # Keep at least header, separator and one data row per table.
+        tables = [(s, e) for (s, e) in find_tables(lines) if e - s > 3]
+        if not tables:
+            break
+        start, end = max(tables, key=lambda t: t[1] - t[0])
+        while end - start > 3 and size > budget:
+            end -= 1
+            size -= len(lines[end].encode()) + 1
+            del lines[end]
+            omitted += 1
+    if omitted:
+        lines.append(f"({omitted} table rows omitted to keep the report under {limit} bytes)")
+    return "\n".join(lines)
+
+
 def run_text(cmd, print_command=False):
     if print_command:
         sys.stderr.write("+ " + " ".join(cmd) + "\n")
@@ -170,6 +286,9 @@ def main():
     parser.add_argument("--filter-env", help="Filter results by env name (substring match)")
     parser.add_argument("--output", help="Show output for failing tests", action="store_true")
     parser.add_argument("--markdown", help="Output in GitHub-flavored markdown format", action="store_true")
+    parser.add_argument(
+        "--notrim", help=f"Do not trim markdown report to {MAX_MARKDOWN_SIZE} bytes", action="store_true"
+    )
     parser.add_argument(
         "--omit-repl",
         help="Omit lines starting with 'REPL' and containing 'Available replacements:'",
@@ -218,7 +337,10 @@ def main():
     if args.omit_repl:
         cmd.append("--omit-repl")
     cmd.append(f"{target_dir}")
-    run(cmd, shell=True)
+    report = run_text(cmd, print_command=True)
+    if args.markdown and not args.notrim:
+        report = trim_tables(report)
+    print(report)
 
 
 if __name__ == "__main__":
diff --git a/tools/go.mod b/tools/go.mod
index 4abe5f0d47c..908ed616b92 100644
--- a/tools/go.mod
+++ b/tools/go.mod
@@ -1,78 +1,84 @@
 module github.com/databricks/cli/tools
 
-go 1.25.0
+go 1.27.0
 
-toolchain go1.25.9
+toolchain go1.27.3
 
-require github.com/stretchr/testify v1.11.1
-
-require gopkg.in/yaml.v3 v3.0.1
+require (
+	github.com/stretchr/testify v1.12.1
+	golang.org/x/mod v0.41.0
+	gopkg.in/yaml.v3 v3.0.1
+)
 
 require (
-	4d63.com/gocheckcompilerdirectives v1.3.0 // indirect
+	4d63.com/gocheckcompilerdirectives v1.4.0 // indirect
 	4d63.com/gochecknoglobals v0.2.2 // indirect
-	codeberg.org/chavacava/garif v0.2.0 // indirect
+	charm.land/lipgloss/v2 v2.0.6 // indirect
+	codeberg.org/chavacava/garif v0.2.1 // indirect
 	codeberg.org/polyfloyd/go-errorlint v1.9.0 // indirect
 	dev.gaijin.team/go/exhaustruct/v4 v4.0.0 // indirect
-	dev.gaijin.team/go/golib v0.6.0 // indirect
-	github.com/4meepo/tagalign v1.4.3 // indirect
-	github.com/Abirdcfly/dupword v0.1.7 // indirect
+	dev.gaijin.team/go/exhaustruct/v5 v5.2.0 // indirect
+	dev.gaijin.team/go/golib v0.8.1 // indirect
+	github.com/4meepo/tagalign v1.4.4 // indirect
+	github.com/Abirdcfly/dupword v0.1.8 // indirect
 	github.com/AdminBenni/iota-mixing v1.0.0 // indirect
-	github.com/AlwxSin/noinlineerr v1.0.5 // indirect
-	github.com/Antonboom/errname v1.1.1 // indirect
-	github.com/Antonboom/nilnil v1.1.1 // indirect
+	github.com/AlwxSin/noinlineerr v1.0.6 // indirect
+	github.com/Antonboom/errname v1.1.2 // indirect
+	github.com/Antonboom/nilnil v1.1.2 // indirect
 	github.com/Antonboom/testifylint v1.6.4 // indirect
 	github.com/BurntSushi/toml v1.6.0 // indirect
+	github.com/ClickHouse/clickhouse-go-linter v1.2.1 // indirect
 	github.com/Djarvur/go-err113 v0.1.1 // indirect
-	github.com/Masterminds/semver/v3 v3.4.0 // indirect
+	github.com/Masterminds/semver/v3 v3.5.0 // indirect
 	github.com/MirrexOne/unqueryvet v1.5.4 // indirect
 	github.com/OpenPeeDeeP/depguard/v2 v2.2.1 // indirect
-	github.com/alecthomas/chroma/v2 v2.23.1 // indirect
-	github.com/alecthomas/go-check-sumtype v0.3.1 // indirect
+	github.com/alecthomas/chroma/v2 v2.27.0 // indirect
+	github.com/alecthomas/go-check-sumtype v0.5.1-0.20260828200218-ae6904d28606 // indirect
 	github.com/alexkohler/nakedret/v2 v2.0.6 // indirect
 	github.com/alexkohler/prealloc v1.1.0 // indirect
 	github.com/alfatraining/structtag v1.0.0 // indirect
 	github.com/alingse/asasalint v0.0.11 // indirect
 	github.com/alingse/nilnesserr v0.2.0 // indirect
-	github.com/ashanbrown/forbidigo/v2 v2.3.0 // indirect
-	github.com/ashanbrown/makezero/v2 v2.1.0 // indirect
-	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
+	github.com/ashanbrown/forbidigo/v2 v2.3.1 // indirect
+	github.com/ashanbrown/makezero/v2 v2.2.1 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bitfield/gotestdox v0.2.2 // indirect
 	github.com/bkielbasa/cyclop v1.2.3 // indirect
 	github.com/blizzy78/varnamelen v0.8.0 // indirect
 	github.com/bmatcuk/doublestar/v4 v4.7.1 // indirect
 	github.com/bombsimon/wsl/v4 v4.7.0 // indirect
-	github.com/bombsimon/wsl/v5 v5.6.0 // indirect
+	github.com/bombsimon/wsl/v5 v5.9.0 // indirect
 	github.com/breml/bidichk v0.3.3 // indirect
 	github.com/breml/errchkjson v0.4.1 // indirect
-	github.com/butuzov/ireturn v0.4.0 // indirect
-	github.com/butuzov/mirror v1.3.0 // indirect
+	github.com/butuzov/ireturn v0.4.1 // indirect
+	github.com/butuzov/mirror v1.3.3 // indirect
 	github.com/catenacyber/perfsprint v0.10.1 // indirect
 	github.com/ccojocar/zxcvbn-go v1.0.4 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/charithe/durationcheck v0.0.11 // indirect
-	github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc // indirect
-	github.com/charmbracelet/lipgloss v1.1.0 // indirect
-	github.com/charmbracelet/x/ansi v0.10.1 // indirect
-	github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd // indirect
-	github.com/charmbracelet/x/term v0.2.1 // indirect
+	github.com/charmbracelet/colorprofile v0.4.3 // indirect
+	github.com/charmbracelet/ultraviolet v0.0.0-20260811164956-006e29f97886 // indirect
+	github.com/charmbracelet/x/ansi v0.11.8 // indirect
+	github.com/charmbracelet/x/term v0.2.2 // indirect
+	github.com/charmbracelet/x/termios v0.1.1 // indirect
+	github.com/charmbracelet/x/windows v0.2.2 // indirect
 	github.com/ckaznocha/intrange v0.3.1 // indirect
+	github.com/clipperhouse/displaywidth v0.11.0 // indirect
+	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
 	github.com/curioswitch/go-reassign v0.3.0 // indirect
 	github.com/daixiang0/gci v0.13.7 // indirect
 	github.com/dave/dst v0.27.3 // indirect
-	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/denis-tingaikin/go-header v0.5.0 // indirect
-	github.com/dlclark/regexp2 v1.11.5 // indirect
+	github.com/dlclark/regexp2/v2 v2.2.1 // indirect
 	github.com/dnephin/pflag v1.0.7 // indirect
 	github.com/ettle/strcase v0.2.0 // indirect
 	github.com/fatih/color v1.19.0 // indirect
 	github.com/fatih/structtag v1.2.0 // indirect
-	github.com/firefart/nonamedreturns v1.0.6 // indirect
-	github.com/fsnotify/fsnotify v1.8.0 // indirect
+	github.com/firefart/nonamedreturns v1.0.8 // indirect
+	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/fzipp/gocyclo v0.6.0 // indirect
-	github.com/ghostiam/protogetter v0.3.20 // indirect
-	github.com/go-critic/go-critic v0.14.3 // indirect
+	github.com/ghostiam/protogetter v1.0.1 // indirect
+	github.com/go-critic/go-critic v0.15.0 // indirect
 	github.com/go-toolsmith/astcast v1.1.0 // indirect
 	github.com/go-toolsmith/astcopy v1.1.0 // indirect
 	github.com/go-toolsmith/astequal v1.2.0 // indirect
@@ -83,18 +89,20 @@ require (
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
 	github.com/go-xmlfmt/xmlfmt v1.1.3 // indirect
 	github.com/gobwas/glob v0.2.3 // indirect
-	github.com/godoc-lint/godoc-lint v0.11.2 // indirect
-	github.com/gofrs/flock v0.13.0 // indirect
+	github.com/godoc-lint/godoc-lint v0.11.4 // indirect
+	github.com/gofrs/flock v0.13.1 // indirect
 	github.com/golang/protobuf v1.5.3 // indirect
 	github.com/golangci/asciicheck v0.5.0 // indirect
-	github.com/golangci/dupl v0.0.0-20250308024227-f665c8d69b32 // indirect
+	github.com/golangci/canonicalheader v0.0.0-20260827115959-a25c71c521f6 // indirect
+	github.com/golangci/dupl v0.0.0-20260401084720-c99c5cf5c202 // indirect
 	github.com/golangci/go-printf-func-name v0.1.1 // indirect
-	github.com/golangci/gofmt v0.0.0-20250106114630-d62b90e6713d // indirect
-	github.com/golangci/golangci-lint/v2 v2.11.4 // indirect
+	github.com/golangci/gofmt v0.0.0-20260820135601-e84e05053792 // indirect
+	github.com/golangci/golangci-lint/v2 v2.14.0 // indirect
 	github.com/golangci/golines v0.15.0 // indirect
 	github.com/golangci/misspell v0.8.0 // indirect
 	github.com/golangci/plugin-module-register v0.1.2 // indirect
 	github.com/golangci/revgrep v0.8.0 // indirect
+	github.com/golangci/rowserrcheck v0.0.0-20260419091836-c5f79b8a11ba // indirect
 	github.com/golangci/swaggoswag v0.0.0-20250504205917-77f2aca3143e // indirect
 	github.com/golangci/unconvert v0.0.0-20250410112200-a129a6e6413e // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
@@ -106,52 +114,49 @@ require (
 	github.com/gostaticanalysis/forcetypeassert v0.2.0 // indirect
 	github.com/gostaticanalysis/nilerr v0.1.2 // indirect
 	github.com/hashicorp/go-immutable-radix/v2 v2.1.0 // indirect
-	github.com/hashicorp/go-version v1.8.0 // indirect
+	github.com/hashicorp/go-version v1.9.0 // indirect
 	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/hexops/gotextdiff v1.0.3 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/jgautheron/goconst v1.8.2 // indirect
-	github.com/jingyugao/rowserrcheck v1.1.1 // indirect
+	github.com/jgautheron/goconst v1.11.0 // indirect
 	github.com/jjti/go-spancheck v0.6.5 // indirect
 	github.com/julz/importas v0.2.0 // indirect
 	github.com/karamaru-alpha/copyloopvar v1.2.2 // indirect
-	github.com/kisielk/errcheck v1.10.0 // indirect
+	github.com/kisielk/errcheck v1.20.0 // indirect
 	github.com/kkHAIKE/contextcheck v1.1.6 // indirect
 	github.com/kulti/thelper v0.7.1 // indirect
 	github.com/kunwardeep/paralleltest v1.0.15 // indirect
-	github.com/lasiar/canonicalheader v1.1.2 // indirect
 	github.com/ldez/exptostd v0.4.5 // indirect
-	github.com/ldez/gomoddirectives v0.8.0 // indirect
+	github.com/ldez/gomoddirectives v0.10.0 // indirect
 	github.com/ldez/grignotin v0.10.1 // indirect
 	github.com/ldez/structtags v0.6.1 // indirect
-	github.com/ldez/tagliatelle v0.7.2 // indirect
+	github.com/ldez/tagliatelle v0.8.0 // indirect
 	github.com/ldez/usetesting v0.5.0 // indirect
 	github.com/leonklingele/grouper v1.1.2 // indirect
-	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
+	github.com/lucasb-eyer/go-colorful v1.4.1 // indirect
 	github.com/macabu/inamedparam v0.2.0 // indirect
 	github.com/magiconair/properties v1.8.6 // indirect
 	github.com/manuelarte/embeddedstructfieldcheck v0.4.0 // indirect
-	github.com/manuelarte/funcorder v0.5.0 // indirect
+	github.com/manuelarte/funcorder v0.6.0 // indirect
 	github.com/maratori/testableexamples v1.0.1 // indirect
 	github.com/maratori/testpackage v1.1.2 // indirect
 	github.com/matoous/godox v1.1.0 // indirect
-	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/mattn/go-runewidth v0.0.16 // indirect
+	github.com/mattn/go-colorable v0.1.15 // indirect
+	github.com/mattn/go-isatty v0.0.22 // indirect
+	github.com/mattn/go-runewidth v0.0.24 // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect
-	github.com/mgechev/revive v1.15.0 // indirect
+	github.com/mgechev/revive v1.17.0 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/moricho/tparallel v0.3.2 // indirect
-	github.com/muesli/termenv v0.16.0 // indirect
+	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/nakabonne/nestif v0.3.1 // indirect
-	github.com/nishanths/exhaustive v0.12.0 // indirect
+	github.com/nishanths/exhaustive v0.13.0 // indirect
 	github.com/nishanths/predeclared v0.2.2 // indirect
-	github.com/nunnatsa/ginkgolinter v0.23.0 // indirect
+	github.com/nunnatsa/ginkgolinter v0.24.0 // indirect
 	github.com/pelletier/go-toml v1.9.5 // indirect
-	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
-	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/pelletier/go-toml/v2 v2.4.3 // indirect
 	github.com/prometheus/client_golang v1.12.1 // indirect
 	github.com/prometheus/client_model v0.2.0 // indirect
 	github.com/prometheus/common v0.32.1 // indirect
@@ -161,21 +166,22 @@ require (
 	github.com/quasilyte/gogrep v0.5.0 // indirect
 	github.com/quasilyte/regex/syntax v0.0.0-20210819130434-b3f0c404a727 // indirect
 	github.com/quasilyte/stdinfo v0.0.0-20220114132959-f7386bf02567 // indirect
-	github.com/raeperd/recvcheck v0.2.0 // indirect
+	github.com/raeperd/recvcheck v0.3.1 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
-	github.com/rogpeppe/go-internal v1.14.1 // indirect
+	github.com/rogpeppe/go-internal v1.16.0 // indirect
 	github.com/ryancurrah/gomodguard v1.4.1 // indirect
+	github.com/ryancurrah/gomodguard/v2 v2.1.3 // indirect
 	github.com/ryanrolds/sqlclosecheck v0.6.0 // indirect
 	github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 // indirect
 	github.com/sanposhiho/wastedassign/v2 v2.1.0 // indirect
-	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 // indirect
 	github.com/sashamelentyev/interfacebloat v1.1.0 // indirect
 	github.com/sashamelentyev/usestdlibvars v1.29.0 // indirect
-	github.com/securego/gosec/v2 v2.24.8-0.20260309165252-619ce2117e08 // indirect
-	github.com/sirupsen/logrus v1.9.4 // indirect
+	github.com/securego/gosec/v2 v2.29.0 // indirect
+	github.com/sirupsen/logrus v1.10.2 // indirect
 	github.com/sivchari/containedctx v1.0.3 // indirect
 	github.com/sonatard/noctx v0.5.1 // indirect
-	github.com/sourcegraph/go-diff v0.7.0 // indirect
+	github.com/sourcegraph/go-diff v0.9.0 // indirect
 	github.com/spf13/afero v1.15.0 // indirect
 	github.com/spf13/cast v1.5.0 // indirect
 	github.com/spf13/cobra v1.10.2 // indirect
@@ -184,50 +190,51 @@ require (
 	github.com/spf13/viper v1.12.0 // indirect
 	github.com/ssgreg/nlreturn/v2 v2.2.1 // indirect
 	github.com/stbenjam/no-sprintf-host-port v0.3.1 // indirect
-	github.com/stretchr/objx v0.5.2 // indirect
+	github.com/stretchr/objx v0.5.3 // indirect
 	github.com/subosito/gotenv v1.4.1 // indirect
-	github.com/tetafro/godot v1.5.4 // indirect
-	github.com/timakin/bodyclose v0.0.0-20241222091800-1db5c5ca4d67 // indirect
-	github.com/timonwong/loggercheck v0.11.0 // indirect
+	github.com/tetafro/godot v1.5.6 // indirect
+	github.com/timakin/bodyclose v0.0.0-20260723120731-857993a2939c // indirect
+	github.com/timonwong/loggercheck v0.12.0 // indirect
 	github.com/tomarrell/wrapcheck/v2 v2.12.0 // indirect
 	github.com/tommy-muehle/go-mnd/v2 v2.5.1 // indirect
 	github.com/ultraware/funlen v0.2.0 // indirect
 	github.com/ultraware/whitespace v0.2.0 // indirect
 	github.com/uudashr/gocognit v1.2.1 // indirect
-	github.com/uudashr/iface v1.4.1 // indirect
+	github.com/uudashr/iface v1.5.1 // indirect
 	github.com/xen0n/gosmopolitan v1.3.0 // indirect
-	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
+	github.com/xo/terminfo v1.0.0 // indirect
 	github.com/yagipy/maintidx v1.0.0 // indirect
 	github.com/yeya24/promlinter v0.3.0 // indirect
 	github.com/ykadowak/zerologlint v0.1.5 // indirect
 	gitlab.com/bosi/decorder v0.4.2 // indirect
 	go-simpler.org/musttag v0.14.0 // indirect
-	go-simpler.org/sloglint v0.11.1 // indirect
+	go-simpler.org/sloglint v0.12.0 // indirect
 	go.augendre.info/arangolint v0.4.0 // indirect
-	go.augendre.info/fatcontext v0.9.0 // indirect
+	go.augendre.info/fatcontext v0.10.1 // indirect
 	go.uber.org/multierr v1.10.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
-	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/exp/typeparams v0.0.0-20260209203927-2842357ff358 // indirect
-	golang.org/x/mod v0.34.0 // indirect
-	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/sys v0.42.0 // indirect
-	golang.org/x/telemetry v0.0.0-20260311193753-579e4da9a98c // indirect
+	go.yaml.in/yaml/v3 v3.0.5 // indirect
+	golang.org/x/exp/typeparams v0.0.0-20260811152304-ee035b5b010f // indirect
+	golang.org/x/sync v0.23.0 // indirect
+	golang.org/x/sys v0.48.0 // indirect
+	golang.org/x/telemetry v0.0.0-20260908163034-4bcc4b2ee518 // indirect
 	golang.org/x/term v0.39.0 // indirect
-	golang.org/x/text v0.34.0 // indirect
-	golang.org/x/tools v0.43.0 // indirect
-	google.golang.org/protobuf v1.36.8 // indirect
+	golang.org/x/text v0.41.0 // indirect
+	golang.org/x/tools v0.50.0 // indirect
+	golang.org/x/vuln v1.3.0 // indirect
+	google.golang.org/protobuf v1.36.12 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gotest.tools/gotestsum v1.12.1 // indirect
-	honnef.co/go/tools v0.7.0 // indirect
-	mvdan.cc/gofumpt v0.9.2 // indirect
-	mvdan.cc/unparam v0.0.0-20251027182757-5beb8c8f8f15 // indirect
+	honnef.co/go/tools v0.8.1 // indirect
+	mvdan.cc/gofumpt v0.12.0 // indirect
+	mvdan.cc/unparam v0.0.0-20260823230713-2fa3d841b0c8 // indirect
 )
 
 tool (
 	github.com/golangci/golangci-lint/v2/cmd/golangci-lint
 	github.com/google/yamlfmt/cmd/yamlfmt
 	golang.org/x/tools/cmd/deadcode
+	golang.org/x/vuln/cmd/govulncheck
 	gotest.tools/gotestsum
 )
diff --git a/tools/go.sum b/tools/go.sum
index 3cfffdc38cd..0aa259e3315 100644
--- a/tools/go.sum
+++ b/tools/go.sum
@@ -1,7 +1,9 @@
-4d63.com/gocheckcompilerdirectives v1.3.0 h1:Ew5y5CtcAAQeTVKUVFrE7EwHMrTO6BggtEj8BZSjZ3A=
-4d63.com/gocheckcompilerdirectives v1.3.0/go.mod h1:ofsJ4zx2QAuIP/NO/NAh1ig6R1Fb18/GI7RVMwz7kAY=
+4d63.com/gocheckcompilerdirectives v1.4.0 h1:ZLq62rbGWVmQhiZ8kuNVIT/M09xCSTdJz9K3xOdT/CY=
+4d63.com/gocheckcompilerdirectives v1.4.0/go.mod h1:9ZOAiMOjqC/nRwci2fcUXVHUNLG/cH6r6rhUh+jTFtQ=
 4d63.com/gochecknoglobals v0.2.2 h1:H1vdnwnMaZdQW/N+NrkT1SZMTBmcwHe9Vq8lJcYYTtU=
 4d63.com/gochecknoglobals v0.2.2/go.mod h1:lLxwTQjL5eIesRbvnzIP3jZtG140FnTdz+AlMa+ogt0=
+charm.land/lipgloss/v2 v2.0.6 h1:EaGKeuA8FvF+v2BT5VmZd2LoYLaMZJXA5n34th8nCIQ=
+charm.land/lipgloss/v2 v2.0.6/go.mod h1:ipDDJNSGa1hlwDtSfW1s2/xR8Vdhbut4PXh2zEKZd0Q=
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
@@ -34,47 +36,51 @@ cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0Zeo
 cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
 cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
 cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
-codeberg.org/chavacava/garif v0.2.0 h1:F0tVjhYbuOCnvNcU3YSpO6b3Waw6Bimy4K0mM8y6MfY=
-codeberg.org/chavacava/garif v0.2.0/go.mod h1:P2BPbVbT4QcvLZrORc2T29szK3xEOlnl0GiPTJmEqBQ=
+codeberg.org/chavacava/garif v0.2.1 h1:K9oYxSlvlXrHXyW26Z4q61bTpJDo1wbvXcYKar/F/LM=
+codeberg.org/chavacava/garif v0.2.1/go.mod h1:oHnDSmc0f9K1MeE+MQD/yjkiIB5Xsn5y3S9Dg96Xk84=
 codeberg.org/polyfloyd/go-errorlint v1.9.0 h1:VkdEEmA1VBpH6ecQoMR4LdphVI3fA4RrCh2an7YmodI=
 codeberg.org/polyfloyd/go-errorlint v1.9.0/go.mod h1:GPRRu2LzVijNn4YkrZYJfatQIdS+TrcK8rL5Xs24qw8=
 dev.gaijin.team/go/exhaustruct/v4 v4.0.0 h1:873r7aNneqoBB3IaFIzhvt2RFYTuHgmMjoKfwODoI1Y=
 dev.gaijin.team/go/exhaustruct/v4 v4.0.0/go.mod h1:aZ/k2o4Y05aMJtiux15x8iXaumE88YdiB0Ai4fXOzPI=
-dev.gaijin.team/go/golib v0.6.0 h1:v6nnznFTs4bppib/NyU1PQxobwDHwCXXl15P7DV5Zgo=
-dev.gaijin.team/go/golib v0.6.0/go.mod h1:uY1mShx8Z/aNHWDyAkZTkX+uCi5PdX7KsG1eDQa2AVE=
+dev.gaijin.team/go/exhaustruct/v5 v5.2.0 h1:HZB49Fshn8qHJCi9VzYtrcnR1jbLteRHXfnQz8Adams=
+dev.gaijin.team/go/exhaustruct/v5 v5.2.0/go.mod h1:5IshpqhgGdKIrF8lBmi3M6YKmI7T3hMzAL9nrflko88=
+dev.gaijin.team/go/golib v0.8.1 h1:JYju4x9BSo+QD/AYeHULVDcvEhiFg8wOi6pT0IaZF5E=
+dev.gaijin.team/go/golib v0.8.1/go.mod h1:c5fu7t1RSGMxSQgcUYO1sODbzsYnOCXJLmHeNG1Eb+0=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
-github.com/4meepo/tagalign v1.4.3 h1:Bnu7jGWwbfpAie2vyl63Zup5KuRv21olsPIha53BJr8=
-github.com/4meepo/tagalign v1.4.3/go.mod h1:00WwRjiuSbrRJnSVeGWPLp2epS5Q/l4UEy0apLLS37c=
-github.com/Abirdcfly/dupword v0.1.7 h1:2j8sInznrje4I0CMisSL6ipEBkeJUJAmK1/lfoNGWrQ=
-github.com/Abirdcfly/dupword v0.1.7/go.mod h1:K0DkBeOebJ4VyOICFdppB23Q0YMOgVafM0zYW0n9lF4=
+github.com/4meepo/tagalign v1.4.4 h1:052JDGj2pBORc6NkD30dDXpsUpoYszDeUwr9/5YZuVA=
+github.com/4meepo/tagalign v1.4.4/go.mod h1:00WwRjiuSbrRJnSVeGWPLp2epS5Q/l4UEy0apLLS37c=
+github.com/Abirdcfly/dupword v0.1.8 h1:SrhcUuGsROBuChFxHALRYzyyPODWn9zwghmzPvD9Cd8=
+github.com/Abirdcfly/dupword v0.1.8/go.mod h1:XZrhVnI7YGpsTiWZANSQaBJ4QpL/Tq5vIEdKJJAs9WI=
 github.com/AdminBenni/iota-mixing v1.0.0 h1:Os6lpjG2dp/AE5fYBPAA1zfa2qMdCAWwPMCgpwKq7wo=
 github.com/AdminBenni/iota-mixing v1.0.0/go.mod h1:i4+tpAaB+qMVIV9OK3m4/DAynOd5bQFaOu+2AhtBCNY=
-github.com/AlwxSin/noinlineerr v1.0.5 h1:RUjt63wk1AYWTXtVXbSqemlbVTb23JOSRiNsshj7TbY=
-github.com/AlwxSin/noinlineerr v1.0.5/go.mod h1:+QgkkoYrMH7RHvcdxdlI7vYYEdgeoFOVjU9sUhw/rQc=
-github.com/Antonboom/errname v1.1.1 h1:bllB7mlIbTVzO9jmSWVWLjxTEbGBVQ1Ff/ClQgtPw9Q=
-github.com/Antonboom/errname v1.1.1/go.mod h1:gjhe24xoxXp0ScLtHzjiXp0Exi1RFLKJb0bVBtWKCWQ=
-github.com/Antonboom/nilnil v1.1.1 h1:9Mdr6BYd8WHCDngQnNVV0b554xyisFioEKi30sksufQ=
-github.com/Antonboom/nilnil v1.1.1/go.mod h1:yCyAmSw3doopbOWhJlVci+HuyNRuHJKIv6V2oYQa8II=
+github.com/AlwxSin/noinlineerr v1.0.6 h1:KAvuxunTe9QxvqrFB7nZTdb/7Wzas4AvifslTnG0Ld8=
+github.com/AlwxSin/noinlineerr v1.0.6/go.mod h1:+QgkkoYrMH7RHvcdxdlI7vYYEdgeoFOVjU9sUhw/rQc=
+github.com/Antonboom/errname v1.1.2 h1:dxwONZJua3VB8Xh/VaCjqAcqF645sWWv7xj26zy7tdQ=
+github.com/Antonboom/errname v1.1.2/go.mod h1:YeZIpgLMxT+SNkruGgYkLhzq/9vs3fsolTZegKaKDZI=
+github.com/Antonboom/nilnil v1.1.2 h1:aNlFuJhaEseXe4fHO3xbjXlSeEiQVYa2lEkWD2s2hAY=
+github.com/Antonboom/nilnil v1.1.2/go.mod h1:0ynwvphOLmAuMwTNDyBnDZmSwZoDpcFXmUHmzoHH2WA=
 github.com/Antonboom/testifylint v1.6.4 h1:gs9fUEy+egzxkEbq9P4cpcMB6/G0DYdMeiFS87UiqmQ=
 github.com/Antonboom/testifylint v1.6.4/go.mod h1:YO33FROXX2OoUfwjz8g+gUxQXio5i9qpVy7nXGbxDD4=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=
 github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
+github.com/ClickHouse/clickhouse-go-linter v1.2.1 h1:zGEKIyd5YL08ieWG/LOUmlau2DxbxPVOfAeo+4Jz3ck=
+github.com/ClickHouse/clickhouse-go-linter v1.2.1/go.mod h1:pLorS7ffPTfuUV9M0SJgfHA/h/WQPQUk2FWG9x74cQ4=
 github.com/Djarvur/go-err113 v0.1.1 h1:eHfopDqXRwAi+YmCUas75ZE0+hoBHJ2GQNLYRSxao4g=
 github.com/Djarvur/go-err113 v0.1.1/go.mod h1:IaWJdYFLg76t2ihfflPZnM1LIQszWOsFDh2hhhAVF6k=
-github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
-github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
+github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE=
+github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/MirrexOne/unqueryvet v1.5.4 h1:38QOxShO7JmMWT+eCdDMbcUgGCOeJphVkzzRgyLJgsQ=
 github.com/MirrexOne/unqueryvet v1.5.4/go.mod h1:fs9Zq6eh1LRIhsDIsxf9PONVUjYdFHdtkHIgZdJnyPU=
 github.com/OpenPeeDeeP/depguard/v2 v2.2.1 h1:vckeWVESWp6Qog7UZSARNqfu/cZqvki8zsuj3piCMx4=
 github.com/OpenPeeDeeP/depguard/v2 v2.2.1/go.mod h1:q4DKzC4UcVaAvcfd41CZh0PWpGgzrVxUYBlgKNGquUo=
 github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=
 github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
-github.com/alecthomas/chroma/v2 v2.23.1 h1:nv2AVZdTyClGbVQkIzlDm/rnhk1E9bU9nXwmZ/Vk/iY=
-github.com/alecthomas/chroma/v2 v2.23.1/go.mod h1:NqVhfBR0lte5Ouh3DcthuUCTUpDC9cxBOfyMbMQPs3o=
-github.com/alecthomas/go-check-sumtype v0.3.1 h1:u9aUvbGINJxLVXiFvHUlPEaD7VDULsrxJb4Aq31NLkU=
-github.com/alecthomas/go-check-sumtype v0.3.1/go.mod h1:A8TSiN3UPRw3laIgWEUOHHLPa6/r9MtoigdlP5h3K/E=
+github.com/alecthomas/chroma/v2 v2.27.0 h1:FodwmyOBgJULFYmDqibcp9pvfDLWdtPRh9v/r5BXYZs=
+github.com/alecthomas/chroma/v2 v2.27.0/go.mod h1:NjJ3ciIgrqBNeIkWZ4e46nseoLDslxU1LmfCoL+wcY8=
+github.com/alecthomas/go-check-sumtype v0.5.1-0.20260828200218-ae6904d28606 h1:dXPJ+uOJLWb8rjlAuLX7JPiRJtZKw/53Ol+WxdDJ1Eo=
+github.com/alecthomas/go-check-sumtype v0.5.1-0.20260828200218-ae6904d28606/go.mod h1:ZH31IJyNpxpStxP2ayCcPQz+3T2G/OnxIQqe4LWvSDw=
 github.com/alecthomas/repr v0.5.2 h1:SU73FTI9D1P5UNtvseffFSGmdNci/O6RsqzeXJtP0Qs=
 github.com/alecthomas/repr v0.5.2/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
 github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
@@ -92,12 +98,10 @@ github.com/alingse/asasalint v0.0.11 h1:SFwnQXJ49Kx/1GghOFz1XGqHYKp21Kq1nHad/0WQ
 github.com/alingse/asasalint v0.0.11/go.mod h1:nCaoMhw7a9kSJObvQyVzNTPBDbNpdocqrSP7t/cW5+I=
 github.com/alingse/nilnesserr v0.2.0 h1:raLem5KG7EFVb4UIDAXgrv3N2JIaffeKNtcEXkEWd/w=
 github.com/alingse/nilnesserr v0.2.0/go.mod h1:1xJPrXonEtX7wyTq8Dytns5P2hNzoWymVUIaKm4HNFg=
-github.com/ashanbrown/forbidigo/v2 v2.3.0 h1:OZZDOchCgsX5gvToVtEBoV2UWbFfI6RKQTir2UZzSxo=
-github.com/ashanbrown/forbidigo/v2 v2.3.0/go.mod h1:5p6VmsG5/1xx3E785W9fouMxIOkvY2rRV9nMdWadd6c=
-github.com/ashanbrown/makezero/v2 v2.1.0 h1:snuKYMbqosNokUKm+R6/+vOPs8yVAi46La7Ck6QYSaE=
-github.com/ashanbrown/makezero/v2 v2.1.0/go.mod h1:aEGT/9q3S8DHeE57C88z2a6xydvgx8J5hgXIGWgo0MY=
-github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=
-github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
+github.com/ashanbrown/forbidigo/v2 v2.3.1 h1:KAZijvQ7zeIBKbhikT4jCm0TLYXC4u78bTiLh/8JROI=
+github.com/ashanbrown/forbidigo/v2 v2.3.1/go.mod h1:2QDkLTzU6TV937eFROamXrW92M3paehdae4HCDCOZCM=
+github.com/ashanbrown/makezero/v2 v2.2.1 h1:A7uU8dgB1PA9aelTxHMfHIQ8Qev8AB3JLxJUBUsejqM=
+github.com/ashanbrown/makezero/v2 v2.2.1/go.mod h1:aEGT/9q3S8DHeE57C88z2a6xydvgx8J5hgXIGWgo0MY=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
@@ -112,16 +116,16 @@ github.com/bmatcuk/doublestar/v4 v4.7.1 h1:fdDeAqgT47acgwd9bd9HxJRDmc9UAmPpc+2m0
 github.com/bmatcuk/doublestar/v4 v4.7.1/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/bombsimon/wsl/v4 v4.7.0 h1:1Ilm9JBPRczjyUs6hvOPKvd7VL1Q++PL8M0SXBDf+jQ=
 github.com/bombsimon/wsl/v4 v4.7.0/go.mod h1:uV/+6BkffuzSAVYD+yGyld1AChO7/EuLrCF/8xTiapg=
-github.com/bombsimon/wsl/v5 v5.6.0 h1:4z+/sBqC5vUmSp1O0mS+czxwH9+LKXtCWtHH9rZGQL8=
-github.com/bombsimon/wsl/v5 v5.6.0/go.mod h1:Uqt2EfrMj2NV8UGoN1f1Y3m0NpUVCsUdrNCdet+8LvU=
+github.com/bombsimon/wsl/v5 v5.9.0 h1:WCrgZ7RQnZO5oEwbVTlYgBdU3wL294kR1BSWV8vTfsU=
+github.com/bombsimon/wsl/v5 v5.9.0/go.mod h1:kjo4HiAV5FDkHC8/uzJq9mBffEEd6WT/nvN7DoMovDM=
 github.com/breml/bidichk v0.3.3 h1:WSM67ztRusf1sMoqH6/c4OBCUlRVTKq+CbSeo0R17sE=
 github.com/breml/bidichk v0.3.3/go.mod h1:ISbsut8OnjB367j5NseXEGGgO/th206dVa427kR8YTE=
 github.com/breml/errchkjson v0.4.1 h1:keFSS8D7A2T0haP9kzZTi7o26r7kE3vymjZNeNDRDwg=
 github.com/breml/errchkjson v0.4.1/go.mod h1:a23OvR6Qvcl7DG/Z4o0el6BRAjKnaReoPQFciAl9U3s=
-github.com/butuzov/ireturn v0.4.0 h1:+s76bF/PfeKEdbG8b54aCocxXmi0wvYdOVsWxVO7n8E=
-github.com/butuzov/ireturn v0.4.0/go.mod h1:ghI0FrCmap8pDWZwfPisFD1vEc56VKH4NpQUxDHta70=
-github.com/butuzov/mirror v1.3.0 h1:HdWCXzmwlQHdVhwvsfBb2Au0r3HyINry3bDWLYXiKoc=
-github.com/butuzov/mirror v1.3.0/go.mod h1:AEij0Z8YMALaq4yQj9CPPVYOyJQyiexpQEQgihajRfI=
+github.com/butuzov/ireturn v0.4.1 h1:vWb3NO4t77iku/sjCQ/2pHTQeOmxEhjIriJqRLg1Y+I=
+github.com/butuzov/ireturn v0.4.1/go.mod h1:q+DXKzTDV5guNuXLnIab9fKXizTn2miZHLhxH7V/GB4=
+github.com/butuzov/mirror v1.3.3 h1:v0RsWBhfFc1RQqE/f3sHpSttKDtodFn0gFmtYyD4/hA=
+github.com/butuzov/mirror v1.3.3/go.mod h1:h9BzzwYnTiHO0GzgvaTqIg7VSsOUhdIv51cHFFBmX1w=
 github.com/catenacyber/perfsprint v0.10.1 h1:u7Riei30bk46XsG8nknMhKLXG9BcXz3+3tl/WpKm0PQ=
 github.com/catenacyber/perfsprint v0.10.1/go.mod h1:DJTGsi/Zufpuus6XPGJyKOTMELe347o6akPvWG9Zcsc=
 github.com/ccojocar/zxcvbn-go v1.0.4 h1:FWnCIRMXPj43ukfX000kvBZvV6raSxakYr1nzyNrUcc=
@@ -133,22 +137,28 @@ github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UF
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/charithe/durationcheck v0.0.11 h1:g1/EX1eIiKS57NTWsYtHDZ/APfeXKhye1DidBcABctk=
 github.com/charithe/durationcheck v0.0.11/go.mod h1:x5iZaixRNl8ctbM+3B2RrPG5t856TxRyVQEnbIEM2X4=
-github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc h1:4pZI35227imm7yK2bGPcfpFEmuY1gc2YSTShr4iJBfs=
-github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc/go.mod h1:X4/0JoqgTIPSFcRA/P6INZzIuyqdFY5rm8tb41s9okk=
-github.com/charmbracelet/lipgloss v1.1.0 h1:vYXsiLHVkK7fp74RkV7b2kq9+zDLoEU4MZoFqR/noCY=
-github.com/charmbracelet/lipgloss v1.1.0/go.mod h1:/6Q8FR2o+kj8rz4Dq0zQc3vYf7X+B0binUUBwA0aL30=
-github.com/charmbracelet/x/ansi v0.10.1 h1:rL3Koar5XvX0pHGfovN03f5cxLbCF2YvLeyz7D2jVDQ=
-github.com/charmbracelet/x/ansi v0.10.1/go.mod h1:3RQDQ6lDnROptfpWuUVIUG64bD2g2BgntdxH0Ya5TeE=
-github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd h1:vy0GVL4jeHEwG5YOXDmi86oYw2yuYUGqz6a8sLwg0X8=
-github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd/go.mod h1:xe0nKWGd3eJgtqZRaN9RjMtK7xUYchjzPr7q6kcvCCs=
-github.com/charmbracelet/x/term v0.2.1 h1:AQeHeLZ1OqSXhrAWpYUtZyX1T3zVxfpZuEQMIQaGIAQ=
-github.com/charmbracelet/x/term v0.2.1/go.mod h1:oQ4enTYFV7QN4m0i9mzHrViD7TQKvNEEkHUMCmsxdUg=
+github.com/charmbracelet/colorprofile v0.4.3 h1:QPa1IWkYI+AOB+fE+mg/5/4HRMZcaXex9t5KX76i20Q=
+github.com/charmbracelet/colorprofile v0.4.3/go.mod h1:/zT4BhpD5aGFpqQQqw7a+VtHCzu+zrQtt1zhMt9mR4Q=
+github.com/charmbracelet/ultraviolet v0.0.0-20260811164956-006e29f97886 h1:rdnVWKgJpTVXKuKuJyxDJ+NFJdUaUqGvyGy61OcvlbA=
+github.com/charmbracelet/ultraviolet v0.0.0-20260811164956-006e29f97886/go.mod h1:nAw0d9PhFp1qdzi2xhQU5YOu5sVpDIHWlaW2Uz/bCro=
+github.com/charmbracelet/x/ansi v0.11.8 h1:JMFwp0CgDC2+jcOB162HH5k7I3FVbgFSMMYg7dSPBQQ=
+github.com/charmbracelet/x/ansi v0.11.8/go.mod h1:ZNN+3mXny/516oTQPLMPIBeSINvNJJQ8uQXDgbeJxY0=
+github.com/charmbracelet/x/term v0.2.2 h1:xVRT/S2ZcKdhhOuSP4t5cLi5o+JxklsoEObBSgfgZRk=
+github.com/charmbracelet/x/term v0.2.2/go.mod h1:kF8CY5RddLWrsgVwpw4kAa6TESp6EB5y3uxGLeCqzAI=
+github.com/charmbracelet/x/termios v0.1.1 h1:o3Q2bT8eqzGnGPOYheoYS8eEleT5ZVNYNy8JawjaNZY=
+github.com/charmbracelet/x/termios v0.1.1/go.mod h1:rB7fnv1TgOPOyyKRJ9o+AsTU/vK5WHJ2ivHeut/Pcwo=
+github.com/charmbracelet/x/windows v0.2.2 h1:IofanmuvaxnKHuV04sC0eBy/smG6kIKrWG2/jYn2GuM=
+github.com/charmbracelet/x/windows v0.2.2/go.mod h1:/8XtdKZzedat74NQFn0NGlGL4soHB0YQZrETF96h75k=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
 github.com/ckaznocha/intrange v0.3.1 h1:j1onQyXvHUsPWujDH6WIjhyH26gkRt/txNlV7LspvJs=
 github.com/ckaznocha/intrange v0.3.1/go.mod h1:QVepyz1AkUoFQkpEqksSYpNpUo3c5W7nWh/s6SHIJJk=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/clipperhouse/displaywidth v0.11.0 h1:lBc6kY44VFw+TDx4I8opi/EtL9m20WSEFgwIwO+UVM8=
+github.com/clipperhouse/displaywidth v0.11.0/go.mod h1:bkrFNkf81G8HyVqmKGxsPufD3JhNl3dSqnGhOoSD/o0=
+github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=
+github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/curioswitch/go-reassign v0.3.0 h1:dh3kpQHuADL3cobV/sSGETA8DOv457dwl+fbBAhrQPs=
@@ -164,8 +174,10 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/denis-tingaikin/go-header v0.5.0 h1:SRdnP5ZKvcO9KKRP1KJrhFR3RrlGuD+42t4429eC9k8=
 github.com/denis-tingaikin/go-header v0.5.0/go.mod h1:mMenU5bWrok6Wl2UsZjy+1okegmwQ3UgWl4V1D8gjlY=
-github.com/dlclark/regexp2 v1.11.5 h1:Q/sSnsKerHeCkc/jSTNq1oCm7KiVgUMZRDUoRu0JQZQ=
-github.com/dlclark/regexp2 v1.11.5/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
+github.com/dlclark/regexp2 v1.12.0 h1:0j4c5qQmnC6XOWNjP3PIXURXN2gWx76rd3KvgdPkCz8=
+github.com/dlclark/regexp2 v1.12.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
+github.com/dlclark/regexp2/v2 v2.2.1 h1:mf4KkFUj0gJuarK8P+LgiS+Lit7m9N1yAwEfPbee7R0=
+github.com/dlclark/regexp2/v2 v2.2.1/go.mod h1:avUrQvPaLz2DrFNHJF0taWAFFX2C1GMSSoeiqFjcBmU=
 github.com/dnephin/pflag v1.0.7 h1:oxONGlWxhmUct0YzKTgrpQv9AUA1wtPBn7zuSjJqptk=
 github.com/dnephin/pflag v1.0.7/go.mod h1:uxE91IoWURlOiTUIA8Mq5ZZkAv3dPUfZNaT80Zm7OQE=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
@@ -178,18 +190,18 @@ github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/fatih/structtag v1.2.0 h1:/OdNE99OxoI/PqaW/SuSK9uxxT3f/tcSZgon/ssNSx4=
 github.com/fatih/structtag v1.2.0/go.mod h1:mBJUNpUnHmRKrKlQQlmCrh5PuhftFbNv8Ys4/aAZl94=
-github.com/firefart/nonamedreturns v1.0.6 h1:vmiBcKV/3EqKY3ZiPxCINmpS431OcE1S47AQUwhrg8E=
-github.com/firefart/nonamedreturns v1.0.6/go.mod h1:R8NisJnSIpvPWheCq0mNRXJok6D8h7fagJTF8EMEwCo=
+github.com/firefart/nonamedreturns v1.0.8 h1:iB32Dl17zJl1zlVEj/WlUWgx0HiRyQ85OUw1WHa4/II=
+github.com/firefart/nonamedreturns v1.0.8/go.mod h1:vxFNvm5AfP/8rgAKFzYmnqx0yp1HjrYsErZ9pHPTznA=
 github.com/frankban/quicktest v1.14.3 h1:FJKSZTDHjyhriyC81FLQ0LY93eSai0ZyR/ZIkd3ZUKE=
 github.com/frankban/quicktest v1.14.3/go.mod h1:mgiwOwqx65TmIk1wJ6Q7wvnVMocbUorkibMOrVTHZps=
-github.com/fsnotify/fsnotify v1.8.0 h1:dAwr6QBTBZIkG8roQaJjGof0pp0EeF+tNV7YBP3F/8M=
-github.com/fsnotify/fsnotify v1.8.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
+github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
+github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
 github.com/fzipp/gocyclo v0.6.0 h1:lsblElZG7d3ALtGMx9fmxeTKZaLLpU8mET09yN4BBLo=
 github.com/fzipp/gocyclo v0.6.0/go.mod h1:rXPyn8fnlpa0R2csP/31uerbiVBugk5whMdlyaLkLoA=
-github.com/ghostiam/protogetter v0.3.20 h1:oW7OPFit2FxZOpmMRPP9FffU4uUpfeE/rEdE1f+MzD0=
-github.com/ghostiam/protogetter v0.3.20/go.mod h1:FjIu5Yfs6FT391m+Fjp3fbAYJ6rkL/J6ySpZBfnODuI=
-github.com/go-critic/go-critic v0.14.3 h1:5R1qH2iFeo4I/RJU8vTezdqs08Egi4u5p6vOESA0pog=
-github.com/go-critic/go-critic v0.14.3/go.mod h1:xwntfW6SYAd7h1OqDzmN6hBX/JxsEKl5up/Y2bsxgVQ=
+github.com/ghostiam/protogetter v1.0.1 h1:q4LLTx2KJHJpxrfO3BniUDWoFkoqWD/UlHhClBlUlLM=
+github.com/ghostiam/protogetter v1.0.1/go.mod h1:50Fh5yZfs6SFGrd1FlmT04NcguyEOxyjNK5zGD6/EvM=
+github.com/go-critic/go-critic v0.15.0 h1:MDUZIQKytIl+vPEc0Igw51m4uLTdi1ZGz2jatEqNs1g=
+github.com/go-critic/go-critic v0.15.0/go.mod h1:3BPrw8nHATGm3o2n37cssOmJzpySGKCdY8JWkCzxgKQ=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@@ -199,10 +211,10 @@ github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vb
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
-github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
-github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
-github.com/go-quicktest/qt v1.101.0 h1:O1K29Txy5P2OK0dGo59b7b0LR6wKfIhttaAhHUyn7eI=
-github.com/go-quicktest/qt v1.101.0/go.mod h1:14Bz/f7NwaXPtdYEgzsx46kqSxVwTbzVZsDC26tQJow=
+github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
+github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-quicktest/qt v1.102.0 h1:HSQxCeh5YZH3EL3W39ixjtyaEhcWSXQHtHnMBzSs474=
+github.com/go-quicktest/qt v1.102.0/go.mod h1:p4lGIVX+8Wa6ZPNDvqcxq36XpUDLh42FLetFU7odllI=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
@@ -231,10 +243,10 @@ github.com/go-xmlfmt/xmlfmt v1.1.3 h1:t8Ey3Uy7jDSEisW2K3somuMKIpzktkWptA0iFCnRUW
 github.com/go-xmlfmt/xmlfmt v1.1.3/go.mod h1:aUCEOzzezBEjDBbFBoSiya/gduyIiWYRP6CnSFIV8AM=
 github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
 github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
-github.com/godoc-lint/godoc-lint v0.11.2 h1:Bp0FkJWoSdNsBikdNgIcgtaoo+xz6I/Y9s5WSBQUeeM=
-github.com/godoc-lint/godoc-lint v0.11.2/go.mod h1:iVpGdL1JCikNH2gGeAn3Hh+AgN5Gx/I/cxV+91L41jo=
-github.com/gofrs/flock v0.13.0 h1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ/A8dRYMzw=
-github.com/gofrs/flock v0.13.0/go.mod h1:jxeyy9R1auM5S6JYDBhDt+E2TCo7DkratH4Pgi8P+Z0=
+github.com/godoc-lint/godoc-lint v0.11.4 h1:N9zUYVJ/OkznBbrBsU/zODvua64EUplMBLQWStO3+1M=
+github.com/godoc-lint/godoc-lint v0.11.4/go.mod h1:7usTXoxS0QYIi5usTSCPwR0w/6xLjcz450shXjLn3t4=
+github.com/gofrs/flock v0.13.1 h1:jjREztyBeSKBZYAC+mgc1laB+xsgy4kYMf3FbKF2UBo=
+github.com/gofrs/flock v0.13.1/go.mod h1:sf4BFiHwnvgxa25DlQoDqXQnwRMEOwqxRq37P6MzzmE=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -267,14 +279,16 @@ github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg
 github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/golangci/asciicheck v0.5.0 h1:jczN/BorERZwK8oiFBOGvlGPknhvq0bjnysTj4nUfo0=
 github.com/golangci/asciicheck v0.5.0/go.mod h1:5RMNAInbNFw2krqN6ibBxN/zfRFa9S6tA1nPdM0l8qQ=
-github.com/golangci/dupl v0.0.0-20250308024227-f665c8d69b32 h1:WUvBfQL6EW/40l6OmeSBYQJNSif4O11+bmWEz+C7FYw=
-github.com/golangci/dupl v0.0.0-20250308024227-f665c8d69b32/go.mod h1:NUw9Zr2Sy7+HxzdjIULge71wI6yEg1lWQr7Evcu8K0E=
+github.com/golangci/canonicalheader v0.0.0-20260827115959-a25c71c521f6 h1:fVLolA3dG6s0brGetsiDAtcnpMSwVa2LqXJEw/9RJG4=
+github.com/golangci/canonicalheader v0.0.0-20260827115959-a25c71c521f6/go.mod h1:1xo+NFW5S+bEf2DKXhaxuzvcDN5AR6o/KMwvqC5Mkpo=
+github.com/golangci/dupl v0.0.0-20260401084720-c99c5cf5c202 h1:CbTB8KpqnViI6lIXxp03Oclc4VFHi3K4BWC1TacsZ+A=
+github.com/golangci/dupl v0.0.0-20260401084720-c99c5cf5c202/go.mod h1:NUw9Zr2Sy7+HxzdjIULge71wI6yEg1lWQr7Evcu8K0E=
 github.com/golangci/go-printf-func-name v0.1.1 h1:hIYTFJqAGp1iwoIfsNTpoq1xZAarogrvjO9AfiW3B4U=
 github.com/golangci/go-printf-func-name v0.1.1/go.mod h1:Es64MpWEZbh0UBtTAICOZiB+miW53w/K9Or/4QogJss=
-github.com/golangci/gofmt v0.0.0-20250106114630-d62b90e6713d h1:viFft9sS/dxoYY0aiOTsLKO2aZQAPT4nlQCsimGcSGE=
-github.com/golangci/gofmt v0.0.0-20250106114630-d62b90e6713d/go.mod h1:ivJ9QDg0XucIkmwhzCDsqcnxxlDStoTl89jDMIoNxKY=
-github.com/golangci/golangci-lint/v2 v2.11.4 h1:GK+UlZBN5y7rh2PBnHA93XLSX6RaF7uhzJQ3JwU1wuA=
-github.com/golangci/golangci-lint/v2 v2.11.4/go.mod h1:ODQDCASMA3VqfZYIbbQLpTRTzV7O/vjmIRF6u8NyFwI=
+github.com/golangci/gofmt v0.0.0-20260820135601-e84e05053792 h1:WL8YKrt3UbOBqSRU7GpP5BTtQTMWtVtj+mfPijgZeIg=
+github.com/golangci/gofmt v0.0.0-20260820135601-e84e05053792/go.mod h1:te5hX0dW4C5r6YbXs+6ysNr8Q5UTmdIqGbb+mlFiYmA=
+github.com/golangci/golangci-lint/v2 v2.14.0 h1:ot8QffRa4LzAAEgtvNYrVs9esxQ7xoTwoAv6uhp4ngA=
+github.com/golangci/golangci-lint/v2 v2.14.0/go.mod h1:amHimCzNDP1GfVno3hIiNssjvqXmuW+CPZAHOdR4cIc=
 github.com/golangci/golines v0.15.0 h1:Qnph25g8Y1c5fdo1X7GaRDGgnMHgnxh4Gk4VfPTtRx0=
 github.com/golangci/golines v0.15.0/go.mod h1:AZjXd23tbHMpowhtnGlj9KCNsysj72aeZVVHnVcZx10=
 github.com/golangci/misspell v0.8.0 h1:qvxQhiE2/5z+BVRo1kwYA8yGz+lOlu5Jfvtx2b04Jbg=
@@ -283,12 +297,16 @@ github.com/golangci/plugin-module-register v0.1.2 h1:e5WM6PO6NIAEcij3B053CohVp3H
 github.com/golangci/plugin-module-register v0.1.2/go.mod h1:1+QGTsKBvAIvPvoY/os+G5eoqxWn70HYDm2uvUyGuVw=
 github.com/golangci/revgrep v0.8.0 h1:EZBctwbVd0aMeRnNUsFogoyayvKHyxlV3CdUA46FX2s=
 github.com/golangci/revgrep v0.8.0/go.mod h1:U4R/s9dlXZsg8uJmaR1GrloUr14D7qDl8gi2iPXJH8k=
+github.com/golangci/rowserrcheck v0.0.0-20260419091836-c5f79b8a11ba h1:lqtcnSMDuuJdu/LrKWi5RJzpSNLOJXYe/nzQutTI5kg=
+github.com/golangci/rowserrcheck v0.0.0-20260419091836-c5f79b8a11ba/go.mod h1:sCBNcpRmhJCtbFGz49+IM3ETTFf7QdJ30AeYCd43NKk=
 github.com/golangci/swaggoswag v0.0.0-20250504205917-77f2aca3143e h1:ai0EfmVYE2bRA5htgAG9r7s3tHsfjIhN98WshBTJ9jM=
 github.com/golangci/swaggoswag v0.0.0-20250504205917-77f2aca3143e/go.mod h1:Vrn4B5oR9qRwM+f54koyeH3yzphlecwERs0el27Fr/s=
 github.com/golangci/unconvert v0.0.0-20250410112200-a129a6e6413e h1:gD6P7NEo7Eqtt0ssnqSJNNndxe69DOQ24A5h7+i3KpM=
 github.com/golangci/unconvert v0.0.0-20250410112200-a129a6e6413e/go.mod h1:h+wZwLjUTJnm/P2rwlbJdRPZXOzaT36/FwnPnY2inzc=
 github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
+github.com/google/go-cmdtest v0.4.1-0.20220921163831-55ab3332a786 h1:rcv+Ippz6RAtvaGgKxc+8FQIpxHgsF+HBzPyYL2cyVU=
+github.com/google/go-cmdtest v0.4.1-0.20220921163831-55ab3332a786/go.mod h1:apVn/GCasLZUVpAJ6oWAuyP7Ne7CEsQbTnc0plM3m+o=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
@@ -312,8 +330,9 @@ github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hf
 github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
 github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
 github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83 h1:z2ogiKUYzX5Is6zr/vP9vJGqPwcdqsWjOt+V8J7+bTc=
-github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
+github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 h1:LMLX+LgTNWpfvCBdFebv6EsYotImrt/Ppc5cXIriCSo=
+github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk=
+github.com/google/renameio v0.1.0 h1:GOZbcHa3HfsPKPlmyPyN2KEohoMXOhdMbHrvbpl2QaA=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
@@ -340,8 +359,8 @@ github.com/hashicorp/go-immutable-radix/v2 v2.1.0/go.mod h1:hgdqLXA4f6NIjRVisM1T
 github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
 github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-version v1.2.1/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
-github.com/hashicorp/go-version v1.8.0 h1:KAkNb1HAiZd1ukkxDFGmokVZe1Xy9HG6NUp+bPle2i4=
-github.com/hashicorp/go-version v1.8.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
+github.com/hashicorp/go-version v1.9.0 h1:CeOIz6k+LoN3qX9Z0tyQrPtiB1DFYRPfCIBtaXPSCnA=
+github.com/hashicorp/go-version v1.9.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
@@ -353,10 +372,8 @@ github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSo
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/jgautheron/goconst v1.8.2 h1:y0XF7X8CikZ93fSNT6WBTb/NElBu9IjaY7CCYQrCMX4=
-github.com/jgautheron/goconst v1.8.2/go.mod h1:A0oxgBCHy55NQn6sYpO7UdnA9p+h7cPtoOZUmvNIako=
-github.com/jingyugao/rowserrcheck v1.1.1 h1:zibz55j/MJtLsjP1OF4bSdgXxwL1b+Vn7Tjzq7gFzUs=
-github.com/jingyugao/rowserrcheck v1.1.1/go.mod h1:4yvlZSDb3IyDTUZJUmpZfm2Hwok+Dtp+nu2qOq+er9c=
+github.com/jgautheron/goconst v1.11.0 h1:KgN90z5qXt5f0Uzf3cWXev3hfMMFUyNeKdpkSBRvLDk=
+github.com/jgautheron/goconst v1.11.0/go.mod h1:0p+wv1lFOiUr0IlNNT1nrm6+8DB8u2sU6KHGzFRXHDc=
 github.com/jjti/go-spancheck v0.6.5 h1:lmi7pKxa37oKYIMScialXUK6hP3iY5F1gu+mLBPgYB8=
 github.com/jjti/go-spancheck v0.6.5/go.mod h1:aEogkeatBrbYsyW6y5TgDfihCulDYciL1B7rG2vSsrU=
 github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
@@ -372,8 +389,8 @@ github.com/julz/importas v0.2.0 h1:y+MJN/UdL63QbFJHws9BVC5RpA2iq0kpjrFajTGivjQ=
 github.com/julz/importas v0.2.0/go.mod h1:pThlt589EnCYtMnmhmRYY/qn9lCf/frPOK+WMx3xiJY=
 github.com/karamaru-alpha/copyloopvar v1.2.2 h1:yfNQvP9YaGQR7VaWLYcfZUlRP2eo2vhExWKxD/fP6q0=
 github.com/karamaru-alpha/copyloopvar v1.2.2/go.mod h1:oY4rGZqZ879JkJMtX3RRkcXRkmUvH0x35ykgaKgsgJY=
-github.com/kisielk/errcheck v1.10.0 h1:Lvs/YAHP24YKg08LA8oDw2z9fJVme090RAXd90S+rrw=
-github.com/kisielk/errcheck v1.10.0/go.mod h1:kQxWMMVZgIkDq7U8xtG/n2juOjbLgZtedi0D+/VL/i8=
+github.com/kisielk/errcheck v1.20.0 h1:9rwHBNKzd4wkDWcROy3DvFGNqEPlkxBg305rvk7HabI=
+github.com/kisielk/errcheck v1.20.0/go.mod h1:O+f80MKNwX8Oor2jwgpeQ9An7uJm+hRSgT+h22knRJU=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/kkHAIKE/contextcheck v1.1.6 h1:7HIyRcnyzxL9Lz06NGhiKvenXq7Zw6Q0UQu/ttjfJCE=
 github.com/kkHAIKE/contextcheck v1.1.6/go.mod h1:3dDbMRNBFaq8HFXWC1JyvDSPm43CmE6IuHam8Wr0rkg=
@@ -391,32 +408,30 @@ github.com/kulti/thelper v0.7.1 h1:fI8QITAoFVLx+y+vSyuLBP+rcVIB8jKooNSCT2EiI98=
 github.com/kulti/thelper v0.7.1/go.mod h1:NsMjfQEy6sd+9Kfw8kCP61W1I0nerGSYSFnGaxQkcbs=
 github.com/kunwardeep/paralleltest v1.0.15 h1:ZMk4Qt306tHIgKISHWFJAO1IDQJLc6uDyJMLyncOb6w=
 github.com/kunwardeep/paralleltest v1.0.15/go.mod h1:di4moFqtfz3ToSKxhNjhOZL+696QtJGCFe132CbBLGk=
-github.com/lasiar/canonicalheader v1.1.2 h1:vZ5uqwvDbyJCnMhmFYimgMZnJMjwljN5VGY0VKbMXb4=
-github.com/lasiar/canonicalheader v1.1.2/go.mod h1:qJCeLFS0G/QlLQ506T+Fk/fWMa2VmBUiEI2cuMK4djI=
 github.com/ldez/exptostd v0.4.5 h1:kv2ZGUVI6VwRfp/+bcQ6Nbx0ghFWcGIKInkG/oFn1aQ=
 github.com/ldez/exptostd v0.4.5/go.mod h1:QRjHRMXJrCTIm9WxVNH6VW7oN7KrGSht69bIRwvdFsM=
-github.com/ldez/gomoddirectives v0.8.0 h1:JqIuTtgvFC2RdH1s357vrE23WJF2cpDCPFgA/TWDGpk=
-github.com/ldez/gomoddirectives v0.8.0/go.mod h1:jutzamvZR4XYJLr0d5Honycp4Gy6GEg2mS9+2YX3F1Q=
+github.com/ldez/gomoddirectives v0.10.0 h1:Zb23rfMMkG21B6pZ9OfESzemByP5Qr7YvWcXQZE/S3Q=
+github.com/ldez/gomoddirectives v0.10.0/go.mod h1:W9uh0721Vc7aaVoiMXTpKIveLmtHC9uaOSiHM4OK5a8=
 github.com/ldez/grignotin v0.10.1 h1:keYi9rYsgbvqAZGI1liek5c+jv9UUjbvdj3Tbn5fn4o=
 github.com/ldez/grignotin v0.10.1/go.mod h1:UlDbXFCARrXbWGNGP3S5vsysNXAPhnSuBufpTEbwOas=
 github.com/ldez/structtags v0.6.1 h1:bUooFLbXx41tW8SvkfwfFkkjPYvFFs59AAMgVg6DUBk=
 github.com/ldez/structtags v0.6.1/go.mod h1:YDxVSgDy/MON6ariaxLF2X09bh19qL7MtGBN5MrvbdY=
-github.com/ldez/tagliatelle v0.7.2 h1:KuOlL70/fu9paxuxbeqlicJnCspCRjH0x8FW+NfgYUk=
-github.com/ldez/tagliatelle v0.7.2/go.mod h1:PtGgm163ZplJfZMZ2sf5nhUT170rSuPgBimoyYtdaSI=
+github.com/ldez/tagliatelle v0.8.0 h1:QczqVPa22JdT40p3m5JTTVmPMv5wDORqdomJn6/Pnn0=
+github.com/ldez/tagliatelle v0.8.0/go.mod h1:K9n83Wv0wyVq3JYF9WI28BX8xXhDBVP3thHJ0ENuiEs=
 github.com/ldez/usetesting v0.5.0 h1:3/QtzZObBKLy1F4F8jLuKJiKBjjVFi1IavpoWbmqLwc=
 github.com/ldez/usetesting v0.5.0/go.mod h1:Spnb4Qppf8JTuRgblLrEWb7IE6rDmUpGvxY3iRrzvDQ=
 github.com/leonklingele/grouper v1.1.2 h1:o1ARBDLOmmasUaNDesWqWCIFH3u7hoFlM84YrjT3mIY=
 github.com/leonklingele/grouper v1.1.2/go.mod h1:6D0M/HVkhs2yRKRFZUoGjeDy7EZTfFBE9gl4kjmIGkA=
-github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69Aj6K7nkY=
-github.com/lucasb-eyer/go-colorful v1.2.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
+github.com/lucasb-eyer/go-colorful v1.4.1 h1:1EO+WB73+EH8EVbzlrG3KLAfEypQWVHIBqlTf+2hNss=
+github.com/lucasb-eyer/go-colorful v1.4.1/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
 github.com/macabu/inamedparam v0.2.0 h1:VyPYpOc10nkhI2qeNUdh3Zket4fcZjEWe35poddBCpE=
 github.com/macabu/inamedparam v0.2.0/go.mod h1:+Pee9/YfGe5LJ62pYXqB89lJ+0k5bsR8Wgz/C0Zlq3U=
 github.com/magiconair/properties v1.8.6 h1:5ibWZ6iY0NctNGWo87LalDlEZ6R41TqbbDamhfG/Qzo=
 github.com/magiconair/properties v1.8.6/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
 github.com/manuelarte/embeddedstructfieldcheck v0.4.0 h1:3mAIyaGRtjK6EO9E73JlXLtiy7ha80b2ZVGyacxgfww=
 github.com/manuelarte/embeddedstructfieldcheck v0.4.0/go.mod h1:z8dFSyXqp+fC6NLDSljRJeNQJJDWnY7RoWFzV3PC6UM=
-github.com/manuelarte/funcorder v0.5.0 h1:llMuHXXbg7tD0i/LNw8vGnkDTHFpTnWqKPI85Rknc+8=
-github.com/manuelarte/funcorder v0.5.0/go.mod h1:Yt3CiUQthSBMBxjShjdXMexmzpP8YGvGLjrxJNkO2hA=
+github.com/manuelarte/funcorder v0.6.0 h1:0hBngc4fa1IgNiI65A7sFGkMvoMCc878RjqB5V7rWP0=
+github.com/manuelarte/funcorder v0.6.0/go.mod h1:id3NDhXdQBmeqXH7eVC6Z89xS6JxvZ8kF9xUxpArU/g=
 github.com/maratori/testableexamples v1.0.1 h1:HfOQXs+XgfeRBJ+Wz0XfH+FHnoY9TVqL6Fcevpzy4q8=
 github.com/maratori/testableexamples v1.0.1/go.mod h1:XE2F/nQs7B9N08JgyRmdGjYVGqxWwClLPCGSQhXQSrQ=
 github.com/maratori/testpackage v1.1.2 h1:ffDSh+AgqluCLMXhM19f/cpvQAKygKAJXFl9aUjmbqs=
@@ -425,16 +440,16 @@ github.com/matoous/godox v1.1.0 h1:W5mqwbyWrwZv6OQ5Z1a/DHGMOvXYCBP3+Ht7KMoJhq4=
 github.com/matoous/godox v1.1.0/go.mod h1:jgE/3fUXiTurkdHOLT5WEkThTSuE7yxHv5iWPa80afs=
 github.com/matryer/is v1.4.0 h1:sosSmIWwkYITGrxZ25ULNDeKiMNzFSr4V/eqBQP0PeE=
 github.com/matryer/is v1.4.0/go.mod h1:8I/i5uYgLzgsgEloJE1U6xx5HkBQpAZvepWuujKwMRU=
-github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
-github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc=
-github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
+github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY=
+github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4=
+github.com/mattn/go-isatty v0.0.22/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4=
+github.com/mattn/go-runewidth v0.0.24 h1:cpokDiIn0MGnhdHwuWnJBITySJ20QyNGnY2kR/ay2DU=
+github.com/mattn/go-runewidth v0.0.24/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
 github.com/matttproud/golang_protobuf_extensions v1.0.1 h1:4hp9jkHxhMHkqkrB3Ix0jegS5sx/RkqARlsWZ6pIwiU=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
-github.com/mgechev/revive v1.15.0 h1:vJ0HzSBzfNyPbHKolgiFjHxLek9KUijhqh42yGoqZ8Q=
-github.com/mgechev/revive v1.15.0/go.mod h1:LlAKO3QQe9OJ0pVZzI2GPa8CbXGZ/9lNpCGvK4T/a8A=
+github.com/mgechev/revive v1.17.0 h1:hwTTVC3svSv9X2FA2hiYT17Uws+lfxDWhPxzBZZCREg=
+github.com/mgechev/revive v1.17.0/go.mod h1:uiVNUF8ruVh4WHm/aPs7kKEeuo+m6oO3tuOfniyzP/g=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
@@ -446,22 +461,22 @@ github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3Rllmb
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/moricho/tparallel v0.3.2 h1:odr8aZVFA3NZrNybggMkYO3rgPRcqjeQUlBBFVxKHTI=
 github.com/moricho/tparallel v0.3.2/go.mod h1:OQ+K3b4Ln3l2TZveGCywybl68glfLEwFGqvnjok8b+U=
-github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc=
-github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk=
+github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA=
+github.com/muesli/cancelreader v0.2.2/go.mod h1:3XuTXfFS2VjM+HTLZY9Ak0l6eUKfijIfMUZ4EgX0QYo=
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/nakabonne/nestif v0.3.1 h1:wm28nZjhQY5HyYPx+weN3Q65k6ilSBxDb8v5S81B81U=
 github.com/nakabonne/nestif v0.3.1/go.mod h1:9EtoZochLn5iUprVDmDjqGKPofoUEBL8U4Ngq6aY7OE=
-github.com/nishanths/exhaustive v0.12.0 h1:vIY9sALmw6T/yxiASewa4TQcFsVYZQQRUQJhKRf3Swg=
-github.com/nishanths/exhaustive v0.12.0/go.mod h1:mEZ95wPIZW+x8kC4TgC+9YCUgiST7ecevsVDTgc2obs=
+github.com/nishanths/exhaustive v0.13.0 h1:Rof0axOSNQaaPaPmLK5RxcRrJV2Vcv+vfUmuRy+2EAM=
+github.com/nishanths/exhaustive v0.13.0/go.mod h1:3/adQjJgvD/UFHHSYBjpK9Wbz8DOvf0FBtzx+zI0Rlo=
 github.com/nishanths/predeclared v0.2.2 h1:V2EPdZPliZymNAn79T8RkNApBjMmVKh5XRpLm/w98Vk=
 github.com/nishanths/predeclared v0.2.2/go.mod h1:RROzoN6TnGQupbC+lqggsOlcgysk3LMK/HI84Mp280c=
-github.com/nunnatsa/ginkgolinter v0.23.0 h1:x3o4DGYOWbBMP/VdNQKgSj+25aJKx2Pe6lHr8gBcgf8=
-github.com/nunnatsa/ginkgolinter v0.23.0/go.mod h1:9qN1+0akwXEccwV1CAcCDfcoBlWXHB+ML9884pL4SZ4=
-github.com/onsi/ginkgo/v2 v2.28.1 h1:S4hj+HbZp40fNKuLUQOYLDgZLwNUVn19N3Atb98NCyI=
-github.com/onsi/ginkgo/v2 v2.28.1/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE=
-github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28=
-github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg=
+github.com/nunnatsa/ginkgolinter v0.24.0 h1:Mp0EagluLFP98JatP6nqp/gGEoljNG97uf9AcxcBVy8=
+github.com/nunnatsa/ginkgolinter v0.24.0/go.mod h1:2ZMRuzX6+3XXyY6UZOwb6n+MCocVGbkIsDBC4vuWz5c=
+github.com/onsi/ginkgo/v2 v2.32.1 h1:6tlvcDm/3sE8lGJbZ4+d4mO3RLy24/tQWOFzVSQNIfw=
+github.com/onsi/ginkgo/v2 v2.32.1/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=
+github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
+github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
 github.com/otiai10/copy v1.2.0/go.mod h1:rrF5dJ5F0t/EWSYODDu4j9/vEeYHMkc8jt0zJChqQWw=
 github.com/otiai10/copy v1.14.0 h1:dCI/t1iTdYGtkvCuBG2BgR6KZa83PTclw4U5n2wAllU=
 github.com/otiai10/copy v1.14.0/go.mod h1:ECfuL02W+/FkTWZWgQqXPWZgW9oeKCSQ5qVfSc4qc4w=
@@ -471,12 +486,11 @@ github.com/otiai10/mint v1.3.0/go.mod h1:F5AjcsTsWUqX+Na9fpHb52P8pcRX2CI6A3ctIT9
 github.com/otiai10/mint v1.3.1/go.mod h1:/yxELlJQ0ufhjUwhshSj+wFjZ78CnZ48/1wtmBH1OTc=
 github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
 github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
-github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
-github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
+github.com/pelletier/go-toml/v2 v2.4.3 h1:GTRvJQutkOSftxIFD5xw9aepkYNuPWmVJpffdDPYVpY=
+github.com/pelletier/go-toml/v2 v2.4.3/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
@@ -510,46 +524,45 @@ github.com/quasilyte/regex/syntax v0.0.0-20210819130434-b3f0c404a727 h1:TCg2WBOl
 github.com/quasilyte/regex/syntax v0.0.0-20210819130434-b3f0c404a727/go.mod h1:rlzQ04UMyJXu/aOvhd8qT+hvDrFpiwqp8MRXDY9szc0=
 github.com/quasilyte/stdinfo v0.0.0-20220114132959-f7386bf02567 h1:M8mH9eK4OUR4lu7Gd+PU1fV2/qnDNfzT635KRSObncs=
 github.com/quasilyte/stdinfo v0.0.0-20220114132959-f7386bf02567/go.mod h1:DWNGW8A4Y+GyBgPuaQJuWiy0XYftx4Xm/y5Jqk9I6VQ=
-github.com/raeperd/recvcheck v0.2.0 h1:GnU+NsbiCqdC2XX5+vMZzP+jAJC5fht7rcVTAhX74UI=
-github.com/raeperd/recvcheck v0.2.0/go.mod h1:n04eYkwIR0JbgD73wT8wL4JjPC3wm0nFtzBnWNocnYU=
-github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
+github.com/raeperd/recvcheck v0.3.1 h1:p7nZMxiCWkdUtY2i3o+pv1h4fJCR5gpvqAXr9326hEY=
+github.com/raeperd/recvcheck v0.3.1/go.mod h1:CbE7iRocQ4uc71JwpW/CPSh4BShnkre4A9Gb508RypU=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
-github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
-github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/rogpeppe/go-internal v1.16.0 h1:O9DK+vNMDVGLr2BeZqmpLeMjiMNkuXfcqntWbZV6S5g=
+github.com/rogpeppe/go-internal v1.16.0/go.mod h1:DrUVZyrJU+txYW5/1kwtXQSMFio52ZOxX7yM1VHvnxs=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/ryancurrah/gomodguard v1.4.1 h1:eWC8eUMNZ/wM/PWuZBv7JxxqT5fiIKSIyTvjb7Elr+g=
 github.com/ryancurrah/gomodguard v1.4.1/go.mod h1:qnMJwV1hX9m+YJseXEBhd2s90+1Xn6x9dLz11ualI1I=
+github.com/ryancurrah/gomodguard/v2 v2.1.3 h1:E7sz3PJwE9Ba1reVxSpF6XLCPJZ74Kfw/LabTNM4GIA=
+github.com/ryancurrah/gomodguard/v2 v2.1.3/go.mod h1:CQicdLGatWMxLX53JzoBjYlsNZhHbmLv2AVa0s2aivU=
 github.com/ryanrolds/sqlclosecheck v0.6.0 h1:pEyL9okISdg1F1SEpJNlrEotkTGerv5BMk7U4AG0eVg=
 github.com/ryanrolds/sqlclosecheck v0.6.0/go.mod h1:xyX16hsDaCMXHrMJ3JMzGf5OpDfHTOTTQrT7HOFUmeU=
 github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 h1:OkMGxebDjyw0ULyrTYWeN0UNCCkmCWfjPnIA2W6oviI=
 github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06/go.mod h1:+ePHsJ1keEjQtpvf9HHw0f4ZeJ0TLRsxhunSI2hYJSs=
 github.com/sanposhiho/wastedassign/v2 v2.1.0 h1:crurBF7fJKIORrV85u9UUpePDYGWnwvv3+A96WvwXT0=
 github.com/sanposhiho/wastedassign/v2 v2.1.0/go.mod h1:+oSmSC+9bQ+VUAxA66nBb0Z7N8CK7mscKTDYC6aIek4=
-github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=
-github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 h1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls/28=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.3/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
 github.com/sashamelentyev/interfacebloat v1.1.0 h1:xdRdJp0irL086OyW1H/RTZTr1h/tMEOsumirXcOJqAw=
 github.com/sashamelentyev/interfacebloat v1.1.0/go.mod h1:+Y9yU5YdTkrNvoX0xHc84dxiN1iBi9+G8zZIhPVoNjQ=
 github.com/sashamelentyev/usestdlibvars v1.29.0 h1:8J0MoRrw4/NAXtjQqTHrbW9NN+3iMf7Knkq057v4XOQ=
 github.com/sashamelentyev/usestdlibvars v1.29.0/go.mod h1:8PpnjHMk5VdeWlVb4wCdrB8PNbLqZ3wBZTZWkrpZZL8=
-github.com/securego/gosec/v2 v2.24.8-0.20260309165252-619ce2117e08 h1:AoLtJX4WUtZkhhUUMFy3GgecAALp/Mb4S1iyQOA2s0U=
-github.com/securego/gosec/v2 v2.24.8-0.20260309165252-619ce2117e08/go.mod h1:+XLCJiRE95ga77XInNELh2M6zQP+PdqiT9Zpm0D9Wpk=
+github.com/securego/gosec/v2 v2.29.0 h1:pF2HSLcnY5voqpxQumEe0O5YAAbvF4Syu4qeIewpLyc=
+github.com/securego/gosec/v2 v2.29.0/go.mod h1:47C7ej+L2bC1NOxteU2aCGnCi4cZaoKzRt5y9plIvuY=
 github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
 github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
-github.com/shurcooL/go v0.0.0-20180423040247-9e1955d9fb6e/go.mod h1:TDJrrUr11Vxrven61rcy3hJMUqaf/CLWYhHNPmT14Lk=
-github.com/shurcooL/go-goon v0.0.0-20170922171312-37c2f522c041/go.mod h1:N5mDOmsrJOB+vfqUK+7DmDyjhSLIIBnXo9lvZJj3MWQ=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
-github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
-github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
+github.com/sirupsen/logrus v1.10.2 h1:G2SED73/qrAu6YwbdxOD6peLkCBI3z7L+ykJFTXJBBo=
+github.com/sirupsen/logrus v1.10.2/go.mod h1:SLEg8TqYulVKKfIGHldVp2K2aYz2DKSVBq4g/H5bR7Q=
 github.com/sivchari/containedctx v1.0.3 h1:x+etemjbsh2fB5ewm5FeLNi5bUjK0V8n0RB+Wwfd0XE=
 github.com/sivchari/containedctx v1.0.3/go.mod h1:c1RDvCbnJLtH4lLcYD/GqwiBSSf4F5Qk0xld2rBqzJ4=
 github.com/sonatard/noctx v0.5.1 h1:wklWg9c9ZYugOAk7qG4yP4PBrlQsmSLPTvW1K4PRQMs=
 github.com/sonatard/noctx v0.5.1/go.mod h1:64XdbzFb18XL4LporKXp8poqZtPKbCrqQ402CV+kJas=
-github.com/sourcegraph/go-diff v0.7.0 h1:9uLlrd5T46OXs5qpp8L/MTltk0zikUGi0sNNyCpA8G0=
-github.com/sourcegraph/go-diff v0.7.0/go.mod h1:iBszgVvyxdc8SFZ7gm69go2KDdt3ag071iBaWPF6cjs=
+github.com/sourcegraph/go-diff v0.9.0 h1:7xcVsayWHhvxZGrqt1o89vvBApCa4nyCgO7tNxDHJ+Q=
+github.com/sourcegraph/go-diff v0.9.0/go.mod h1:hWlcO7Al+UZStZAP8rBumHpCK5ZHQ5BXsMls8p4+F5E=
 github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
 github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
 github.com/spf13/cast v1.5.0 h1:rj3WzYc11XZaIZMPKmwP96zkFEnnAmV8s6XbB2aY32w=
@@ -570,26 +583,26 @@ github.com/stbenjam/no-sprintf-host-port v0.3.1 h1:AyX7+dxI4IdLBPtDbsGAyqiTSLpCP
 github.com/stbenjam/no-sprintf-host-port v0.3.1/go.mod h1:ODbZesTCHMVKthBHskvUUexdcNHAQRXk9NpSsL8p/HQ=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
-github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4=
+github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
 github.com/subosito/gotenv v1.4.1 h1:jyEFiXpy21Wm81FBN71l9VoMMV8H8jG+qIK3GCpY6Qs=
 github.com/subosito/gotenv v1.4.1/go.mod h1:ayKnFf/c6rvx/2iiLrJUk1e6plDbT3edrFNGqEflhK0=
 github.com/tenntenn/modver v1.0.1 h1:2klLppGhDgzJrScMpkj9Ujy3rXPUspSjAcev9tSEBgA=
 github.com/tenntenn/modver v1.0.1/go.mod h1:bePIyQPb7UeioSRkw3Q0XeMhYZSMx9B8ePqg6SAMGH0=
 github.com/tenntenn/text/transform v0.0.0-20200319021203-7eef512accb3 h1:f+jULpRQGxTSkNYKJ51yaw6ChIqO+Je8UqsTKN/cDag=
 github.com/tenntenn/text/transform v0.0.0-20200319021203-7eef512accb3/go.mod h1:ON8b8w4BN/kE1EOhwT0o+d62W65a6aPw1nouo9LMgyY=
-github.com/tetafro/godot v1.5.4 h1:u1ww+gqpRLiIA16yF2PV1CV1n/X3zhyezbNXC3E14Sg=
-github.com/tetafro/godot v1.5.4/go.mod h1:eOkMrVQurDui411nBY2FA05EYH01r14LuWY/NrVDVcU=
-github.com/timakin/bodyclose v0.0.0-20241222091800-1db5c5ca4d67 h1:9LPGD+jzxMlnk5r6+hJnar67cgpDIz/iyD+rfl5r2Vk=
-github.com/timakin/bodyclose v0.0.0-20241222091800-1db5c5ca4d67/go.mod h1:mkjARE7Yr8qU23YcGMSALbIxTQ9r9QBVahQOBRfU460=
-github.com/timonwong/loggercheck v0.11.0 h1:jdaMpYBl+Uq9mWPXv1r8jc5fC3gyXx4/WGwTnnNKn4M=
-github.com/timonwong/loggercheck v0.11.0/go.mod h1:HEAWU8djynujaAVX7QI65Myb8qgfcZ1uKbdpg3ZzKl8=
+github.com/tetafro/godot v1.5.6 h1:IEkrFCwXaYHlOn4mGzGS3F3dkP6m9t0jpwqBFPIkKiA=
+github.com/tetafro/godot v1.5.6/go.mod h1:eOkMrVQurDui411nBY2FA05EYH01r14LuWY/NrVDVcU=
+github.com/timakin/bodyclose v0.0.0-20260723120731-857993a2939c h1:d/FUP8GD4QiY/rdFzZmBu3KqL9eBNVzMu7W/5pGkaMM=
+github.com/timakin/bodyclose v0.0.0-20260723120731-857993a2939c/go.mod h1:sDHLK7rb/59v/ZxZ7KtymgcoxuUMxjXq8gtu9VMOK8M=
+github.com/timonwong/loggercheck v0.12.0 h1:7Cb9XGLJZSWYNjgL459DIhpSiEHupD+MLQ6vaN2Pl3g=
+github.com/timonwong/loggercheck v0.12.0/go.mod h1:Wa6Y+SJHQR01mViZlLLY5GAZVOWOLNMbkXddMjFWQCs=
 github.com/tomarrell/wrapcheck/v2 v2.12.0 h1:H/qQ1aNWz/eeIhxKAFvkfIA+N7YDvq6TWVFL27Of9is=
 github.com/tomarrell/wrapcheck/v2 v2.12.0/go.mod h1:AQhQuZd0p7b6rfW+vUwHm5OMCGgp63moQ9Qr/0BpIWo=
 github.com/tommy-muehle/go-mnd/v2 v2.5.1 h1:NowYhSdyE/1zwK9QCLeRb6USWdoif80Ie+v+yU8u1Zw=
@@ -600,12 +613,12 @@ github.com/ultraware/whitespace v0.2.0 h1:TYowo2m9Nfj1baEQBjuHzvMRbp19i+RCcRYrSW
 github.com/ultraware/whitespace v0.2.0/go.mod h1:XcP1RLD81eV4BW8UhQlpaR+SDc2givTvyI8a586WjW8=
 github.com/uudashr/gocognit v1.2.1 h1:CSJynt5txTnORn/DkhiB4mZjwPuifyASC8/6Q0I/QS4=
 github.com/uudashr/gocognit v1.2.1/go.mod h1:acaubQc6xYlXFEMb9nWX2dYBzJ/bIjEkc1zzvyIZg5Q=
-github.com/uudashr/iface v1.4.1 h1:J16Xl1wyNX9ofhpHmQ9h9gk5rnv2A6lX/2+APLTo0zU=
-github.com/uudashr/iface v1.4.1/go.mod h1:pbeBPlbuU2qkNDn0mmfrxP2X+wjPMIQAy+r1MBXSXtg=
+github.com/uudashr/iface v1.5.1 h1:BS3yrgaT55s3dAtJoxuTnsZNbsejq/mVuzp49YDyfBA=
+github.com/uudashr/iface v1.5.1/go.mod h1:5UWoT6SvTdTww/KToRj6clO+n4Kg3/NrAQvgOB+5Ggw=
 github.com/xen0n/gosmopolitan v1.3.0 h1:zAZI1zefvo7gcpbCOrPSHJZJYA9ZgLfJqtKzZ5pHqQM=
 github.com/xen0n/gosmopolitan v1.3.0/go.mod h1:rckfr5T6o4lBtM1ga7mLGKZmLxswUoH1zxHgNXOsEt4=
-github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
-github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
+github.com/xo/terminfo v1.0.0 h1:2ZpYzqWzyyytjk3TP6aJVDhkMAkc99/1xKQdA3TDTBY=
+github.com/xo/terminfo v1.0.0/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
 github.com/yagipy/maintidx v1.0.0 h1:h5NvIsCz+nRDapQ0exNv4aJ0yXSI0420omVANTv3GJM=
 github.com/yagipy/maintidx v1.0.0/go.mod h1:0qNf/I/CCZXSMhsRsrEPDZ+DkekpKLXAJfsTACwgXLk=
 github.com/yeya24/promlinter v0.3.0 h1:JVDbMp08lVCP7Y6NP3qHroGAO6z2yGKQtS5JsjqtoFs=
@@ -616,7 +629,6 @@ github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 gitlab.com/bosi/decorder v0.4.2 h1:qbQaV3zgwnBZ4zPMhGLW4KZe7A7NwxEhJx39R3shffo=
@@ -625,12 +637,12 @@ go-simpler.org/assert v0.9.0 h1:PfpmcSvL7yAnWyChSjOz6Sp6m9j5lyK8Ok9pEL31YkQ=
 go-simpler.org/assert v0.9.0/go.mod h1:74Eqh5eI6vCK6Y5l3PI8ZYFXG4Sa+tkr70OIPJAUr28=
 go-simpler.org/musttag v0.14.0 h1:XGySZATqQYSEV3/YTy+iX+aofbZZllJaqwFWs+RTtSo=
 go-simpler.org/musttag v0.14.0/go.mod h1:uP8EymctQjJ4Z1kUnjX0u2l60WfUdQxCwSNKzE1JEOE=
-go-simpler.org/sloglint v0.11.1 h1:xRbPepLT/MHPTCA6TS/wNfZrDzkGvCCqUv4Bdwc3H7s=
-go-simpler.org/sloglint v0.11.1/go.mod h1:2PowwiCOK8mjiF+0KGifVOT8ZsCNiFzvfyJeJOIt8MQ=
+go-simpler.org/sloglint v0.12.0 h1:UzWDlLWNE5FLqsvyq3tWYHuQMbqrervOhT8qPl4Mmw4=
+go-simpler.org/sloglint v0.12.0/go.mod h1:jBjjC2bm8rYrs88oTRlFX497kWjJsyZWYoNaXkGRI6I=
 go.augendre.info/arangolint v0.4.0 h1:xSCZjRoS93nXazBSg5d0OGCi9APPLNMmmLrC995tR50=
 go.augendre.info/arangolint v0.4.0/go.mod h1:l+f/b4plABuFISuKnTGD4RioXiCCgghv2xqst/xOvAA=
-go.augendre.info/fatcontext v0.9.0 h1:Gt5jGD4Zcj8CDMVzjOJITlSb9cEch54hjRRlN3qDojE=
-go.augendre.info/fatcontext v0.9.0/go.mod h1:L94brOAT1OOUNue6ph/2HnwxoNlds9aXDF2FcUntbNw=
+go.augendre.info/fatcontext v0.10.1 h1:HCS/+eob32cM0mEtmZM6NiXdqvS5KiZmsR+fCubTpbc=
+go.augendre.info/fatcontext v0.10.1/go.mod h1:pqpGvA9GlrXy+aXkp8L2dKz12Zp4g2FhzcAtwToU+2w=
 go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
 go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
 go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
@@ -642,8 +654,9 @@ go.uber.org/multierr v1.10.0 h1:S0h4aNzvfcFsC3dRF1jLoaov7oRaKqRGC/pUEJ2yvPQ=
 go.uber.org/multierr v1.10.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
 go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
 go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
@@ -651,8 +664,6 @@ golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
-golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -667,8 +678,8 @@ golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b h1:M2rDM6z3Fhozi9O7NWsxAkg/y
 golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b/go.mod h1:3//PLf8L/X+8b4vuAfHzxeRUl04Adcb341+IGKfnqS8=
 golang.org/x/exp/typeparams v0.0.0-20220428152302-39d4317da171/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk=
 golang.org/x/exp/typeparams v0.0.0-20230203172020-98cc5a0785f9/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk=
-golang.org/x/exp/typeparams v0.0.0-20260209203927-2842357ff358 h1:qWFG1Dj7TBjOjOvhEOkmyGPVoquqUKnIU0lEVLp8xyk=
-golang.org/x/exp/typeparams v0.0.0-20260209203927-2842357ff358/go.mod h1:4Mzdyp/6jzw9auFDJ3OMF5qksa7UvPnzKqTVGcb04ms=
+golang.org/x/exp/typeparams v0.0.0-20260811152304-ee035b5b010f h1:+lI8cDJ4uceLipg2f1ODay7fEuLkk0BIHXd6PB8icxo=
+golang.org/x/exp/typeparams v0.0.0-20260811152304-ee035b5b010f/go.mod h1:PqrXSW65cXDZH0k4IeUbhmg/bcAZDbzNz3byBpKCsXo=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -690,14 +701,11 @@ golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzB
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3/go.mod h1:3p9vT2HGsQu2K1YbXdKPJLVgG5VJdoTa1poYQBtP1AY=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.13.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI=
-golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=
+golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
+golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -728,16 +736,12 @@ golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81R
 golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
 golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
-golang.org/x/net v0.16.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
-golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
-golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
+golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues=
+golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -757,10 +761,8 @@ golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
-golang.org/x/sync v0.4.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
+golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -795,9 +797,7 @@ golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -806,20 +806,13 @@ golang.org/x/sys v0.0.0-20220114195835-da31bd327af9/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
-golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/telemetry v0.0.0-20260311193753-579e4da9a98c h1:6a8FdnNk6bTXBjR4AGKFgUKuo+7GnR3FX5L7CbveeZc=
-golang.org/x/telemetry v0.0.0-20260311193753-579e4da9a98c/go.mod h1:TpUTTEp9frx7rTdLpC9gFG9kdI7zVLFTFFlqaH2Cncw=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/telemetry v0.0.0-20260908163034-4bcc4b2ee518 h1:F5BWKvW126NXR74uxkxuc1jQHhm/rwm/J3rSiFyuRs4=
+golang.org/x/telemetry v0.0.0-20260908163034-4bcc4b2ee518/go.mod h1:i+ivNqjDnTF3WTElsdk5g9V5DTSBYgdNo7xTU9SDwYA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
-golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
-golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
 golang.org/x/term v0.39.0 h1:RclSuaJf32jOqZz74CkPA9qFuVTX7vhLlpfj/IGWlqY=
 golang.org/x/term v0.39.0/go.mod h1:yxzUCTP/U+FzoxfdKmLaA0RV1WgE0VY7hXBwKtY/4ww=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -830,10 +823,8 @@ golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
-golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -881,18 +872,17 @@ golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc
 golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
 golang.org/x/tools v0.1.1-0.20210205202024-ef80cdb6ec6d/go.mod h1:9bzcO0MWcOuT0tm1iBGzDVPshzfwoVvREIui8C+MHqU=
 golang.org/x/tools v0.1.1-0.20210302220138-2ac05c832e1a/go.mod h1:9bzcO0MWcOuT0tm1iBGzDVPshzfwoVvREIui8C+MHqU=
-golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.10/go.mod h1:Uh6Zz+xoGYZom868N8YTex3t7RhtHDBrE8Gzo9bV56E=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
-golang.org/x/tools v0.14.0/go.mod h1:uYBEerGOWcJyEORxN+Ek8+TT266gXkNlHdJBwexUsBg=
-golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=
-golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=
+golang.org/x/tools v0.50.0 h1:c2ifzfcuY7L90lZ2aKd8S4K2NpASF08SZx9ZuJkHmSU=
+golang.org/x/tools v0.50.0/go.mod h1:7ulVMw3831Mwi5EZD6RomGyffr4VFjuNYXf2BbCEAV0=
 golang.org/x/tools/go/expect v0.1.1-deprecated h1:jpBZDwmgPhXsKZC6WhL20P4b/wmnpsEAGHaNy0n/rJM=
 golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY=
 golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM=
 golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated/go.mod h1:RVAQXBGNv1ib0J382/DPCRS/BPnsGebyM1Gj5VSDpG8=
+golang.org/x/vuln v1.3.0 h1:hZYzR8uRhYhDSX88d+40TWbKAVw7BIvRWm26rtEn8jw=
+golang.org/x/vuln v1.3.0/go.mod h1:MIY2PaR1y52stzZM3uHBboUAdVJvSVMl5nP3OQrwQaE=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -972,14 +962,13 @@ google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGj
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc=
-google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
+google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
+google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
 gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
@@ -1004,12 +993,12 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-honnef.co/go/tools v0.7.0 h1:w6WUp1VbkqPEgLz4rkBzH/CSU6HkoqNLp6GstyTx3lU=
-honnef.co/go/tools v0.7.0/go.mod h1:pm29oPxeP3P82ISxZDgIYeOaf9ta6Pi0EWvCFoLG2vc=
-mvdan.cc/gofumpt v0.9.2 h1:zsEMWL8SVKGHNztrx6uZrXdp7AX8r421Vvp23sz7ik4=
-mvdan.cc/gofumpt v0.9.2/go.mod h1:iB7Hn+ai8lPvofHd9ZFGVg2GOr8sBUw1QUWjNbmIL/s=
-mvdan.cc/unparam v0.0.0-20251027182757-5beb8c8f8f15 h1:ssMzja7PDPJV8FStj7hq9IKiuiKhgz9ErWw+m68e7DI=
-mvdan.cc/unparam v0.0.0-20251027182757-5beb8c8f8f15/go.mod h1:4M5MMXl2kW6fivUT6yRGpLLPNfuGtU2Z0cPvFquGDYU=
+honnef.co/go/tools v0.8.1 h1:+JKf3xJ1ni4CwrhVg4/pqsfPGP6vNAXcKbMXJodYx3w=
+honnef.co/go/tools v0.8.1/go.mod h1:XA+OnlRA9EDh/ukGvXMNSZNKGwFQJ+5dER0ioUkOxks=
+mvdan.cc/gofumpt v0.12.0 h1:1Lbudkz2kpM9Cjz2pL4M19u7q+GaEhCTNf7N9mfpcho=
+mvdan.cc/gofumpt v0.12.0/go.mod h1:SmBHHrljiZu/uoypeKup3rFzP6eoC9UwCp2iH5E3jZA=
+mvdan.cc/unparam v0.0.0-20260823230713-2fa3d841b0c8 h1:Re1NRyLpiAt9kB+ImaaoapwWiQXrKwER4tY8fLOkDew=
+mvdan.cc/unparam v0.0.0-20260823230713-2fa3d841b0c8/go.mod h1:MrS/+zJ1M2xvGXhKktiHbNQeQPyg3Qel+KkzT+f7/i4=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
diff --git a/tools/lintdiff.py b/tools/lintdiff.py
old mode 100755
new mode 100644
index 07448df32ed..8090602b112
--- a/tools/lintdiff.py
+++ b/tools/lintdiff.py
@@ -8,13 +8,34 @@
 Changes are calculated as diff against the merge base with main by default, use --ref or -H/--head to change this.
 """
 
-import os
-import sys
 import argparse
+import os
 import subprocess
+import sys
 
 # Each entry is a path prefix: "tools" also covers "tools/task", "tools/other", etc.
-NESTED_MODULES = ("bundle/internal/tf/codegen", "tools")
+NESTED_MODULES = ("tools",)
+
+
+def in_nested_module(path):
+    """Check if a path is a nested module or lives under one.
+
+    A path matches a module exactly or as a `/`-separated prefix, but a sibling
+    that merely shares a leading substring does not:
+
+    >>> in_nested_module("tools")
+    True
+
+    >>> in_nested_module("tools/task/subtask.go")
+    True
+
+    >>> in_nested_module("cmd/bundle")
+    False
+
+    >>> in_nested_module("toolz")
+    False
+    """
+    return any(path == m or path.startswith(m + "/") for m in NESTED_MODULES)
 
 
 def parse_lines(cmd):
@@ -45,13 +66,11 @@ def main():
     if gitroot:
         os.chdir(gitroot[0])
 
-    # Resolve the merge base between the ref and HEAD so that we only lint
-    # files changed on this branch, not files that changed on the ref since
-    # the branch point.
-    merge_base = parse_lines(["git", "merge-base", args.ref, "HEAD"])
-    base = merge_base[0] if merge_base else args.ref
-
-    changed = parse_lines(["git", "diff", "--name-only", base, "--", "."])
+    # Diff the merge base against the working tree so we only lint files changed
+    # on this branch, not files that advanced on the ref since the branch point.
+    # Unlike testmask's three-dot "ref...HEAD" form (tools/testmask/git.go), this
+    # includes the dirty tree's uncommitted changes, which is the point of --fix.
+    changed = parse_lines(["git", "diff", "--name-only", "--merge-base", args.ref, "--", "."])
 
     cmd = args.args[:]
 
@@ -61,10 +80,6 @@ def main():
     filter_nested = "run" in cmd
 
     if changed is not None:
-
-        def in_nested_module(path):
-            return filter_nested and any(path == m or path.startswith(m + "/") for m in NESTED_MODULES)
-
         # We need to pass packages to golangci-lint, not individual files.
         # QQQ for lint we should also pass all dependent packages
         dirs = set()
@@ -73,7 +88,7 @@ def in_nested_module(path):
                 continue
             if filename.endswith(".go"):
                 d = os.path.dirname(filename)
-                if in_nested_module(d):
+                if filter_nested and in_nested_module(d):
                     continue
                 dirs.add(d)
 
diff --git a/tools/list_embeds.py b/tools/list_embeds.py
old mode 100755
new mode 100644
index ba534aa47e5..bd42a070790
--- a/tools/list_embeds.py
+++ b/tools/list_embeds.py
@@ -29,8 +29,7 @@ def main():
             continue
         directory = os.path.dirname(file_path)
         for pat in directive[len(EMBED) :].split():
-            if pat.startswith("all:"):
-                pat = pat[len("all:") :]
+            pat = pat.removeprefix("all:")
             full = os.path.join(directory, pat) if directory else pat
             if os.path.isdir(full):
                 paths.add(full + "/**")
diff --git a/tools/run_doctests.py b/tools/run_doctests.py
new file mode 100644
index 00000000000..b4f77d94ae9
--- /dev/null
+++ b/tools/run_doctests.py
@@ -0,0 +1,45 @@
+#!/usr/bin/env python3
+"""Run doctests for every Python file in the repo that has them.
+
+Most Python files here are scripts with no doctests, and many can't even be
+imported standalone (SDK-generated modules, notebooks using injected globals,
+scripts with import-time side effects). So we git grep for files that actually
+contain a `>>>` prompt and only run the doctest runner on those; a file with
+none produces no tests anyway. --untracked also scans new files not yet
+committed while still honoring .gitignore, so generated/ignored files stay out.
+Each file runs in its own subprocess with cwd set to the file's directory, so
+sibling imports (e.g. gron.py's `from print_requests import ...`) resolve as
+they do when the script is invoked normally.
+"""
+
+import subprocess
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent.parent
+
+
+def main() -> int:
+    out = subprocess.check_output(
+        ["git", "grep", "-l", "--untracked", "--no-color", "-F", ">>>", "--", "*.py"],
+        cwd=ROOT,
+        text=True,
+    )
+    files = sorted(ROOT / line for line in out.splitlines())
+    failed = []
+    for path in files:
+        result = subprocess.run(
+            [sys.executable, "-m", "doctest", path.name],
+            cwd=path.parent,
+        )
+        if result.returncode != 0:
+            failed.append(path.relative_to(ROOT))
+
+    print(f"\n{len(files)} files with doctests, {len(failed)} failed")
+    for rel in failed:
+        print(f"FAIL {rel}")
+    return 1 if failed else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/tools/start_integration_tests.py b/tools/start_integration_tests.py
old mode 100755
new mode 100644
index 0f9b7a77e3a..50120d46add
--- a/tools/start_integration_tests.py
+++ b/tools/start_integration_tests.py
@@ -12,7 +12,6 @@
 import subprocess
 import sys
 
-
 CLI_REPO = "databricks/cli"
 CODE_OWNERS = "pietern andrewnester shreyas-goenka denik anton-107".split()
 ALLOWED_HEAD_REPOSITORY = {"id": "R_kgDOHVGMwQ", "name": "cli"}
diff --git a/tools/summarize_failed_tests.py b/tools/summarize_failed_tests.py
new file mode 100644
index 00000000000..940e9af4b15
--- /dev/null
+++ b/tools/summarize_failed_tests.py
@@ -0,0 +1,219 @@
+#!/usr/bin/env python3
+# /// script
+# requires-python = ">=3.12"
+# ///
+"""
+Summarize failed tests from a gotestsum --jsonfile output for a GitHub job summary.
+
+`task test` prints a lot of output that GitHub is slow to render, so this surfaces
+just the failed test names as a Markdown table. It reads the concatenated
+gotestsum --jsonfile output (go test -json events, one JSON object per line) and
+prints Markdown to stdout; the workflow tees that into $GITHUB_STEP_SUMMARY.
+"""
+
+import argparse
+import json
+
+# go test -json result actions. Only these mark the terminal state of a test or
+# package; intermediate actions like "run" and "output" are ignored.
+RESULT_ACTIONS = ("pass", "fail", "skip")
+
+
+def load_events(path):
+    """Yield the result events (parsed JSON objects) from a gotestsum jsonfile."""
+    with open(path, encoding="utf-8") as f:
+        for line in f:
+            line = line.strip()
+            if not line:
+                continue
+            event = json.loads(line)
+            if event.get("Action") in RESULT_ACTIONS:
+                yield event
+
+
+def last_action_by_key(events, key):
+    """Map each key to the Action of its last event.
+
+    >>> events = [
+    ...     {"Action": "run", "id": 1},
+    ...     {"Action": "pass", "id": 1},
+    ...     {"Action": "fail", "id": 2},
+    ... ]
+    >>> last_action_by_key(events, lambda e: e["id"])
+    {1: 'pass', 2: 'fail'}
+
+    Empty events returns empty dict:
+    >>> last_action_by_key([], lambda e: e["id"])
+    {}
+
+    Later occurrences override earlier ones:
+    >>> events = [
+    ...     {"Action": "pass", "test": "A"},
+    ...     {"Action": "fail", "test": "A"},
+    ... ]
+    >>> last_action_by_key(events, lambda e: e["test"])
+    {'A': 'fail'}
+    """
+    last = {}
+    for event in events:
+        last[key(event)] = event["Action"]
+    return last
+
+
+def failed_tests(events):
+    """Return sorted (package, test) pairs whose last result was a failure.
+
+    A test can appear more than once because of --rerun-fails, so we group by
+    package+test and keep only those whose last result was a failure (recovered
+    flakes end on "pass").
+
+    >>> events = [
+    ...     {"Package": "pkg1", "Test": "TestA", "Action": "fail"},
+    ...     {"Package": "pkg1", "Test": "TestB", "Action": "pass"},
+    ... ]
+    >>> failed_tests(events)
+    [('pkg1', 'TestA')]
+
+    Flakes that recover are not reported:
+    >>> events = [
+    ...     {"Package": "pkg1", "Test": "TestFlake", "Action": "fail"},
+    ...     {"Package": "pkg1", "Test": "TestFlake", "Action": "pass"},
+    ... ]
+    >>> failed_tests(events)
+    []
+
+    Multiple failures sorted by package, then test:
+    >>> events = [
+    ...     {"Package": "pkg2", "Test": "B", "Action": "fail"},
+    ...     {"Package": "pkg1", "Test": "A", "Action": "fail"},
+    ... ]
+    >>> failed_tests(events)
+    [('pkg1', 'A'), ('pkg2', 'B')]
+
+    Package-level events (Test=None) are ignored:
+    >>> events = [
+    ...     {"Package": "pkg1", "Test": None, "Action": "fail"},
+    ...     {"Package": "pkg1", "Test": "TestX", "Action": "fail"},
+    ... ]
+    >>> failed_tests(events)
+    [('pkg1', 'TestX')]
+    """
+    test_events = [e for e in events if e.get("Test") is not None]
+    last = last_action_by_key(test_events, lambda e: (e["Package"], e["Test"]))
+    return sorted(key for key, action in last.items() if action == "fail")
+
+
+def failed_packages_without_test(events, failed_test_packages):
+    """Return sorted packages that failed with no failing test (build error / panic).
+
+    A build error or panic surfaces as a package-level "fail" event (Test == null)
+    with no failing test in the package. go test -json also emits a package-level
+    "fail" for every package that merely has a failing test, so exclude packages
+    already reported via failed_tests; otherwise those get double-reported here as
+    spurious build errors.
+
+    >>> events = [
+    ...     {"Package": "pkg1", "Test": None, "Action": "fail"},
+    ...     {"Package": "pkg2", "Test": None, "Action": "fail"},
+    ... ]
+    >>> failed_packages_without_test(events, set())
+    ['pkg1', 'pkg2']
+
+    Packages with failing tests are excluded:
+    >>> events = [
+    ...     {"Package": "pkg1", "Test": None, "Action": "fail"},
+    ... ]
+    >>> failed_packages_without_test(events, {"pkg1"})
+    []
+
+    Passed packages are ignored:
+    >>> events = [
+    ...     {"Package": "pkg1", "Test": None, "Action": "pass"},
+    ...     {"Package": "pkg2", "Test": None, "Action": "fail"},
+    ... ]
+    >>> failed_packages_without_test(events, set())
+    ['pkg2']
+
+    Empty events returns empty:
+    >>> failed_packages_without_test([], set())
+    []
+    """
+    package_events = [e for e in events if e.get("Test") is None]
+    last = last_action_by_key(package_events, lambda e: e["Package"])
+    return sorted(
+        package for package, action in last.items() if action == "fail" and package not in failed_test_packages
+    )
+
+
+def render(tests, packages):
+    """Render failed tests and build-error packages as markdown.
+
+    >>> print(render([("pkg1", "TestA")], []))
+    ## Failed tests
+    <BLANKLINE>
+    | Package | Test |
+    | --- | --- |
+    | pkg1 | `TestA` |
+
+    Build errors without tests:
+    >>> print(render([], ["pkg1", "pkg2"]))
+    ## Failed tests
+    <BLANKLINE>
+    ### Packages that failed without a test (build error / panic)
+    <BLANKLINE>
+    ```
+    pkg1
+    pkg2
+    ```
+
+    Both tests and build errors:
+    >>> print(render([("pkg1", "T1")], ["pkg2"]))
+    ## Failed tests
+    <BLANKLINE>
+    | Package | Test |
+    | --- | --- |
+    | pkg1 | `T1` |
+    <BLANKLINE>
+    ### Packages that failed without a test (build error / panic)
+    <BLANKLINE>
+    ```
+    pkg2
+    ```
+
+    No failures:
+    >>> print(render([], []))
+    ## Failed tests
+    <BLANKLINE>
+    No failed tests found in test-output.json (the failure may be outside the test run).
+    """
+    lines = ["## Failed tests"]
+    if tests:
+        lines += ["", "| Package | Test |", "| --- | --- |"]
+        lines += [f"| {package} | `{test}` |" for package, test in tests]
+    if packages:
+        lines += ["", "### Packages that failed without a test (build error / panic)", "", "```"]
+        lines += packages
+        lines += ["```"]
+    if not tests and not packages:
+        lines += ["", "No failed tests found in test-output.json (the failure may be outside the test run)."]
+    return "\n".join(lines)
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("jsonfile", help="Path to the gotestsum --jsonfile output")
+    args = parser.parse_args()
+
+    try:
+        events = list(load_events(args.jsonfile))
+    except FileNotFoundError:
+        print(f"{args.jsonfile} not found; skipping failed-test summary")
+        return
+
+    tests = failed_tests(events)
+    packages = failed_packages_without_test(events, {package for package, _ in tests})
+    print(render(tests, packages))
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/sweep_test_resources.py b/tools/sweep_test_resources.py
new file mode 100644
index 00000000000..2ba15ace7cb
--- /dev/null
+++ b/tools/sweep_test_resources.py
@@ -0,0 +1,85 @@
+#!/usr/bin/env python3
+"""Sweep leaked acceptance-test resources by name prefix.
+
+Lists (and with --delete, deletes) warehouses, pipelines and jobs whose names
+start with the given prefix, e.g. the per-run prefix "ci<GITHUB_RUN_ID>x" that
+the acceptance harness embeds into $UNIQUE_NAME on CI cloud runs.
+
+Authentication is taken from the environment (DATABRICKS_HOST, DATABRICKS_TOKEN
+or any other auth supported by the databricks CLI).
+
+Usage:
+    uv run tools/sweep_test_resources.py ci15799017600x           # dry run: list only
+    uv run tools/sweep_test_resources.py ci15799017600x --delete  # delete matches
+"""
+
+import argparse
+import json
+import subprocess
+import sys
+
+
+def run_json(*args):
+    out = subprocess.check_output(["databricks", *args, "--output", "json"], text=True)
+    return json.loads(out) if out.strip() else []
+
+
+def sweep(kind, items, name_of, id_of, delete_args, prefix, delete):
+    failures = 0
+    for item in items:
+        name = name_of(item) or ""
+        if not name.startswith(prefix):
+            continue
+        res_id = str(id_of(item))
+        print(f"{kind}\t{res_id}\t{name}")
+        if delete:
+            try:
+                subprocess.check_call(["databricks", *delete_args, res_id])
+            except subprocess.CalledProcessError as e:
+                print(f"failed to delete {kind} {res_id}: {e}", file=sys.stderr)
+                failures += 1
+    return failures
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
+    parser.add_argument("prefix", help="resource name prefix, e.g. ci<GITHUB_RUN_ID>x")
+    parser.add_argument("--delete", action="store_true", help="delete matches (default: list only)")
+    args = parser.parse_args()
+
+    if not args.prefix:
+        parser.error("prefix must not be empty")
+
+    failures = 0
+    failures += sweep(
+        "warehouse",
+        run_json("warehouses", "list"),
+        lambda w: w.get("name"),
+        lambda w: w.get("id"),
+        ["warehouses", "delete"],
+        args.prefix,
+        args.delete,
+    )
+    failures += sweep(
+        "pipeline",
+        run_json("pipelines", "list-pipelines"),
+        lambda p: p.get("name"),
+        lambda p: p.get("pipeline_id"),
+        ["pipelines", "delete"],
+        args.prefix,
+        args.delete,
+    )
+    failures += sweep(
+        "job",
+        run_json("jobs", "list"),
+        lambda j: j.get("settings", {}).get("name"),
+        lambda j: j.get("job_id"),
+        ["jobs", "delete"],
+        args.prefix,
+        args.delete,
+    )
+    return 1 if failures else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/tools/task/go.mod b/tools/task/go.mod
index 0d38220ebaa..3e883010409 100644
--- a/tools/task/go.mod
+++ b/tools/task/go.mod
@@ -1,11 +1,11 @@
 module github.com/databricks/cli/tools/task
 
-go 1.25.8
+go 1.27.0
 
-toolchain go1.25.9
+toolchain go1.27.3
 
 require (
-	cel.dev/expr v0.25.1 // indirect
+	cel.dev/expr v0.25.2 // indirect
 	charm.land/bubbles/v2 v2.1.0 // indirect
 	charm.land/bubbletea/v2 v2.0.2 // indirect
 	charm.land/lipgloss/v2 v2.0.2 // indirect
@@ -16,7 +16,7 @@ require (
 	cloud.google.com/go/iam v1.5.3 // indirect
 	cloud.google.com/go/monitoring v1.24.3 // indirect
 	cloud.google.com/go/storage v1.61.3 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.30.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.33.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 // indirect
 	github.com/Ladicle/tabwriter v1.0.0 // indirect
@@ -53,19 +53,19 @@ require (
 	github.com/charmbracelet/x/windows v0.2.2 // indirect
 	github.com/clipperhouse/displaywidth v0.11.0 // indirect
 	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
-	github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 // indirect
+	github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/dlclark/regexp2 v1.11.5 // indirect
 	github.com/dominikbraun/graph v0.23.0 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/elliotchance/orderedmap/v3 v3.1.0 // indirect
-	github.com/envoyproxy/go-control-plane/envoy v1.36.0 // indirect
-	github.com/envoyproxy/protoc-gen-validate v1.3.0 // indirect
+	github.com/envoyproxy/go-control-plane/envoy v1.37.0 // indirect
+	github.com/envoyproxy/protoc-gen-validate v1.3.3 // indirect
 	github.com/fatih/color v1.19.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
-	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-logr/logr v1.4.4 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
 	github.com/go-task/task/v3 v3.50.0 // indirect
@@ -79,7 +79,7 @@ require (
 	github.com/hashicorp/go-getter v1.8.6 // indirect
 	github.com/hashicorp/go-version v1.8.0 // indirect
 	github.com/joho/godotenv v1.5.1 // indirect
-	github.com/klauspost/compress v1.18.5 // indirect
+	github.com/klauspost/compress v1.18.7 // indirect
 	github.com/klauspost/cpuid/v2 v2.2.10 // indirect
 	github.com/klauspost/pgzip v1.2.6 // indirect
 	github.com/lucasb-eyer/go-colorful v1.3.0 // indirect
@@ -96,7 +96,7 @@ require (
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/sajari/fuzzy v1.0.0 // indirect
 	github.com/spf13/pflag v1.0.10 // indirect
-	github.com/spiffe/go-spiffe/v2 v2.6.0 // indirect
+	github.com/spiffe/go-spiffe/v2 v2.7.0 // indirect
 	github.com/stretchr/objx v0.5.2 // indirect
 	github.com/stretchr/testify v1.11.1 // indirect
 	github.com/u-root/u-root v0.15.1-0.20251208185023-2f8c7e763cf8 // indirect
@@ -105,28 +105,28 @@ require (
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	github.com/zeebo/xxh3 v1.1.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/detectors/gcp v1.39.0 // indirect
+	go.opentelemetry.io/contrib/detectors/gcp v1.44.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
-	go.opentelemetry.io/otel v1.43.0 // indirect
-	go.opentelemetry.io/otel/metric v1.43.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.43.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.43.0 // indirect
-	go.opentelemetry.io/otel/trace v1.43.0 // indirect
+	go.opentelemetry.io/otel v1.45.0 // indirect
+	go.opentelemetry.io/otel/metric v1.45.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.45.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.45.0 // indirect
+	go.opentelemetry.io/otel/trace v1.45.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.49.0 // indirect
-	golang.org/x/net v0.52.0 // indirect
+	golang.org/x/crypto v0.55.0 // indirect
+	golang.org/x/net v0.58.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/sys v0.43.0 // indirect
-	golang.org/x/term v0.42.0 // indirect
-	golang.org/x/text v0.35.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/term v0.45.0 // indirect
+	golang.org/x/text v0.41.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
 	google.golang.org/api v0.271.0 // indirect
 	google.golang.org/genproto v0.0.0-20260128011058-8636f8732409 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260203192932-546029d2fa20 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 // indirect
-	google.golang.org/grpc v1.79.3 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
+	google.golang.org/grpc v1.83.2 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	mvdan.cc/sh/moreinterp v0.0.0-20260120230322-19def062a997 // indirect
diff --git a/tools/task/go.sum b/tools/task/go.sum
index 62126fc7d34..16d0e1307cb 100644
--- a/tools/task/go.sum
+++ b/tools/task/go.sum
@@ -1,5 +1,5 @@
-cel.dev/expr v0.25.1 h1:1KrZg61W6TWSxuNZ37Xy49ps13NUovb66QLprthtwi4=
-cel.dev/expr v0.25.1/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4=
+cel.dev/expr v0.25.2 h1:K6j46C81hXtZQfuX60cVWQFBJahKSE2gfRbNuvr5bFs=
+cel.dev/expr v0.25.2/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4=
 charm.land/bubbles/v2 v2.1.0 h1:YSnNh5cPYlYjPxRrzs5VEn3vwhtEn3jVGRBT3M7/I0g=
 charm.land/bubbles/v2 v2.1.0/go.mod h1:l97h4hym2hvWBVfmJDtrEHHCtkIKeTEb3TTJ4ZOB3wY=
 charm.land/bubbletea/v2 v2.0.2 h1:4CRtRnuZOdFDTWSff9r8QFt/9+z6Emubz3aDMnf/dx0=
@@ -26,8 +26,8 @@ cloud.google.com/go/storage v1.61.3 h1:VS//ZfBuPGDvakfD9xyPW1RGF1Vy3BWUoVZXgW1KM
 cloud.google.com/go/storage v1.61.3/go.mod h1:JtqK8BBB7TWv0HVGHubtUdzYYrakOQIsMLffZ2Z/HWk=
 cloud.google.com/go/trace v1.11.7 h1:kDNDX8JkaAG3R2nq1lIdkb7FCSi1rCmsEtKVsty7p+U=
 cloud.google.com/go/trace v1.11.7/go.mod h1:TNn9d5V3fQVf6s4SCveVMIBS2LJUqo73GACmq/Tky0s=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.30.0 h1:sBEjpZlNHzK1voKq9695PJSX2o5NEXl7/OL3coiIY0c=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.30.0/go.mod h1:P4WPRUkOhJC13W//jWpyfJNDAIpvRbAUIYLX/4jtlE0=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.33.0 h1:l7+6kwRMJNwdCvYdDl7Eax+wzEYHSnNY7zrrfbhDdTA=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.33.0/go.mod h1:pJTkW8hEUIIi3Pf65lPZOnn4Y81yCllX6IWk2jNXdkM=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 h1:UnDZ/zFfG1JhH/DqxIZYU/1CUAlTUScoXD/LcM2Ykk8=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0/go.mod h1:IA1C1U7jO/ENqm/vhi7V9YYpBsp+IMyqNrEN94N7tVc=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.55.0 h1:7t/qx5Ost0s0wbA/VDrByOooURhp+ikYwv20i9Y07TQ=
@@ -110,8 +110,8 @@ github.com/clipperhouse/displaywidth v0.11.0 h1:lBc6kY44VFw+TDx4I8opi/EtL9m20WSE
 github.com/clipperhouse/displaywidth v0.11.0/go.mod h1:bkrFNkf81G8HyVqmKGxsPufD3JhNl3dSqnGhOoSD/o0=
 github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=
 github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
-github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 h1:6xNmx7iTtyBRev0+D/Tv1FZd4SCg8axKApyNyRsAt/w=
-github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5/go.mod h1:KdCmV+x/BuvyMxRnYBlmVaq4OLiKW6iRQfvC62cvdkI=
+github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 h1:aBangftG7EVZoUb69Os8IaYg++6uMOdKK83QtkkvJik=
+github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2/go.mod h1:qwXFYgsP6T7XnJtbKlf1HP8AjxZZyzxMmc+Lq5GjlU4=
 github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
 github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
@@ -126,12 +126,12 @@ github.com/elliotchance/orderedmap/v3 v3.1.0 h1:j4DJ5ObEmMBt/lcwIecKcoRxIQUEnw0L
 github.com/elliotchance/orderedmap/v3 v3.1.0/go.mod h1:G+Hc2RwaZvJMcS4JpGCOyViCnGeKf0bTYCGTO4uhjSo=
 github.com/envoyproxy/go-control-plane v0.14.0 h1:hbG2kr4RuFj222B6+7T83thSPqLjwBIfQawTkC++2HA=
 github.com/envoyproxy/go-control-plane v0.14.0/go.mod h1:NcS5X47pLl/hfqxU70yPwL9ZMkUlwlKxtAohpi2wBEU=
-github.com/envoyproxy/go-control-plane/envoy v1.36.0 h1:yg/JjO5E7ubRyKX3m07GF3reDNEnfOboJ0QySbH736g=
-github.com/envoyproxy/go-control-plane/envoy v1.36.0/go.mod h1:ty89S1YCCVruQAm9OtKeEkQLTb+Lkz0k8v9W0Oxsv98=
+github.com/envoyproxy/go-control-plane/envoy v1.37.0 h1:u3riX6BoYRfF4Dr7dwSOroNfdSbEPe9Yyl09/B6wBrQ=
+github.com/envoyproxy/go-control-plane/envoy v1.37.0/go.mod h1:DReE9MMrmecPy+YvQOAOHNYMALuowAnbjjEMkkWOi6A=
 github.com/envoyproxy/go-control-plane/ratelimit v0.1.0 h1:/G9QYbddjL25KvtKTv3an9lx6VBE2cnb8wp1vEGNYGI=
 github.com/envoyproxy/go-control-plane/ratelimit v0.1.0/go.mod h1:Wk+tMFAFbCXaJPzVVHnPgRKdUdwW/KdbRt94AzgRee4=
-github.com/envoyproxy/protoc-gen-validate v1.3.0 h1:TvGH1wof4H33rezVKWSpqKz5NXWg5VPuZ0uONDT6eb4=
-github.com/envoyproxy/protoc-gen-validate v1.3.0/go.mod h1:HvYl7zwPa5mffgyeTUHA9zHIH36nmrm7oCbo4YKoSWA=
+github.com/envoyproxy/protoc-gen-validate v1.3.3 h1:MVQghNeW+LZcmXe7SY1V36Z+WFMDjpqGAGacLe2T0ds=
+github.com/envoyproxy/protoc-gen-validate v1.3.3/go.mod h1:TsndJ/ngyIdQRhMcVVGDDHINPLWB7C82oDArY51KfB0=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
@@ -141,8 +141,8 @@ github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8
 github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
 github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
-github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
+github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-quicktest/qt v1.101.0 h1:O1K29Txy5P2OK0dGo59b7b0LR6wKfIhttaAhHUyn7eI=
@@ -179,8 +179,8 @@ github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUq
 github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
 github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
 github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
-github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
-github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw=
+github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid/v2 v2.2.10 h1:tBs3QSyvjDyFTq3uoc/9xFpCuOsJQFNPiAhYdw2skhE=
 github.com/klauspost/cpuid/v2 v2.2.10/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/klauspost/pgzip v1.2.6 h1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU=
@@ -223,8 +223,8 @@ github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN
 github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
 github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
 github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spiffe/go-spiffe/v2 v2.6.0 h1:l+DolpxNWYgruGQVV0xsfeya3CsC7m8iBzDnMpsbLuo=
-github.com/spiffe/go-spiffe/v2 v2.6.0/go.mod h1:gm2SeUoMZEtpnzPNs2Csc0D/gX33k1xIx7lEzqblHEs=
+github.com/spiffe/go-spiffe/v2 v2.7.0 h1:uXe1MflJoHw58wAUvxVlcM7WpKtijWG7I1UidcGh6g4=
+github.com/spiffe/go-spiffe/v2 v2.7.0/go.mod h1:47Q0Q9/AqGha8QLHp+kxpH4Wca7X7EnOtlIJy3mxZ3U=
 github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
@@ -243,57 +243,59 @@ github.com/zeebo/xxh3 v1.1.0 h1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs=
 github.com/zeebo/xxh3 v1.1.0/go.mod h1:IisAie1LELR4xhVinxWS5+zf1lA4p0MW4T+w+W07F5s=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/contrib/detectors/gcp v1.39.0 h1:kWRNZMsfBHZ+uHjiH4y7Etn2FK26LAGkNFw7RHv1DhE=
-go.opentelemetry.io/contrib/detectors/gcp v1.39.0/go.mod h1:t/OGqzHBa5v6RHZwrDBJ2OirWc+4q/w2fTbLZwAKjTk=
+go.opentelemetry.io/contrib/detectors/gcp v1.44.0 h1:NmLfL734pJhM0JKaYd2Y28+nY9dPRWYAAbxhRCrKXPw=
+go.opentelemetry.io/contrib/detectors/gcp v1.44.0/go.mod h1:tNAsgd8avTGke1+MndXlU5Cru4PQ9Ai/cCNWQv/ZJ/s=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 h1:YH4g8lQroajqUwWbq/tr2QX1JFmEXaDLgG+ew9bLMWo=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0/go.mod h1:fvPi2qXDqFs8M4B4fmJhE92TyQs9Ydjlg3RvfUp+NbQ=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q=
-go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
-go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
+go.opentelemetry.io/otel v1.45.0 h1:pdrWmLHofpubmArBv1LgFSv1Z0Ie/ppdZzu+kUN5EeU=
+go.opentelemetry.io/otel v1.45.0/go.mod h1:XZxIqPapzEYnhNSScF5DIqXhm/rYi0FzCe2XddAwZfQ=
 go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.40.0 h1:ZrPRak/kS4xI3AVXy8F7pipuDXmDsrO8Lg+yQjBLjw0=
 go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.40.0/go.mod h1:3y6kQCWztq6hyW8Z9YxQDDm0Je9AJoFar2G0yDcmhRk=
-go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
-go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
-go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
-go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
-go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
-go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
-go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
-go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
+go.opentelemetry.io/otel/metric v1.45.0 h1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypRm3br/M=
+go.opentelemetry.io/otel/metric v1.45.0/go.mod h1:HAPbm1nd3p1PmFH7v2dR+6BjXxw+Lq4a2+pndMAm08s=
+go.opentelemetry.io/otel/metric/x v0.67.0 h1:PcicCNZFkZ4bXfSooXdo3WN7RBOVOtjVdo1wD358Uns=
+go.opentelemetry.io/otel/metric/x v0.67.0/go.mod h1:FBjCWZe6wgcqxcMtjdGiClDKXb2YxxXii0CXftE4QtI=
+go.opentelemetry.io/otel/sdk v1.45.0 h1:4VVSMgQ83dUgW2aoX5f6JgLvHwIvzcuLnF9lUdCSpCw=
+go.opentelemetry.io/otel/sdk v1.45.0/go.mod h1:Sr40LgXV7DsKMMJMKOhUWOgMWTfAaqvm2kF0g7ilwuA=
+go.opentelemetry.io/otel/sdk/metric v1.45.0 h1:oVFszMfyj1Am6s24Vtc7wBb8BKLcwepJjNEYILuiE3o=
+go.opentelemetry.io/otel/sdk/metric v1.45.0/go.mod h1:vUWUxDZvu1WVRj8JA8S0AdhsPrZoDpA2DdZauIh4mDA=
+go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag=
+go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc=
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
-golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
+golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
+golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
 golang.org/x/exp v0.0.0-20250305212735-054e65f0b394 h1:nDVHiLt8aIbd/VzvPWN6kSOPE7+F/fNFDSXLVYkE/Iw=
 golang.org/x/exp v0.0.0-20250305212735-054e65f0b394/go.mod h1:sIifuuw/Yco/y6yb6+bDNfyeQ/MdPUy/hKEMYQV17cM=
-golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
-golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
+golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
+golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
-golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
-golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
-golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
-golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
-gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
-gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
+gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
+gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
 google.golang.org/api v0.271.0 h1:cIPN4qcUc61jlh7oXu6pwOQqbJW2GqYh5PS6rB2C/JY=
 google.golang.org/api v0.271.0/go.mod h1:CGT29bhwkbF+i11qkRUJb2KMKqcJ1hdFceEIRd9u64Q=
 google.golang.org/genproto v0.0.0-20260128011058-8636f8732409 h1:VQZ/yAbAtjkHgH80teYd2em3xtIkkHd7ZhqfH2N9CsM=
 google.golang.org/genproto v0.0.0-20260128011058-8636f8732409/go.mod h1:rxKD3IEILWEu3P44seeNOAwZN4SaoKaQ/2eTg4mM6EM=
-google.golang.org/genproto/googleapis/api v0.0.0-20260203192932-546029d2fa20 h1:7ei4lp52gK1uSejlA8AZl5AJjeLUOHBQscRQZUgAcu0=
-google.golang.org/genproto/googleapis/api v0.0.0-20260203192932-546029d2fa20/go.mod h1:ZdbssH/1SOVnjnDlXzxDHK2MCidiqXtbYccJNzNYPEE=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 h1:ggcbiqK8WWh6l1dnltU4BgWGIGo+EVYxCaAPih/zQXQ=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE=
-google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
+google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa h1:Kjn0N0tCrDgiAFW+lGO4JZ3ck44CehvJQMAwj9QF0G8=
+google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:q4lMZS6kskjT5HvCPrnnypcDPVJqT/f4nfxmkE7gryY=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa h1:mZHHdPZl0dbGHCflZgAq/Q468DWVFcU2whhB2KAo8fk=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU=
+google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
diff --git a/tools/testmask/git.go b/tools/testmask/git.go
index 23c25923617..e1f8bba27d6 100644
--- a/tools/testmask/git.go
+++ b/tools/testmask/git.go
@@ -6,9 +6,22 @@ import (
 	"strings"
 )
 
-// GetChangedFiles returns the list of files changed between two git refs.
+// GetChangedFiles returns the files that headRef changes relative to baseRef.
+//
+// It uses git's three-dot form (baseRef...headRef), which diffs headRef against
+// the merge base of the two refs rather than against the current tip of baseRef.
+// This matters in CI: baseRef is the live tip of the target branch (e.g. the PR
+// event's base.sha, which tracks origin/main). A two-dot "git diff baseRef
+// headRef" would then also report every file that advanced on main after the
+// branch was cut, none of which the PR actually touches — inflating the changed
+// set and triggering test jobs (and integration tests) that the change doesn't
+// require. Diffing against the merge base yields only the PR's own changes.
+//
+// "git diff baseRef...headRef" is equivalent to
+// "git diff $(git merge-base baseRef headRef) headRef".
+// See the <commit>...<commit> form at https://git-scm.com/docs/git-diff.
 func GetChangedFiles(headRef, baseRef string) ([]string, error) {
-	cmd := exec.Command("git", "diff", "--name-only", baseRef, headRef)
+	cmd := exec.Command("git", "diff", "--name-only", baseRef+"..."+headRef)
 	output, err := cmd.Output()
 	if err != nil {
 		return nil, fmt.Errorf("failed to get diff between %s and %s: %w", baseRef, headRef, err)
diff --git a/tools/testmask/git_test.go b/tools/testmask/git_test.go
index abf0bd1ba3a..7b7b66e89b5 100644
--- a/tools/testmask/git_test.go
+++ b/tools/testmask/git_test.go
@@ -1,38 +1,62 @@
 package main
 
 import (
+	"os"
+	"os/exec"
 	"testing"
-)
 
-// gitEmptyTreeSHA is the well-known SHA of the empty tree object. Git resolves
-// it without requiring a commit to reference it, so diffing against it works
-// even on shallow clones where HEAD~N is unavailable (as in CI).
-const gitEmptyTreeSHA = "4b825dc642cb6eb9a060e54bf8d69288fbee4904"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
 
 func TestGetChangedFiles(t *testing.T) {
-	// Test with HEAD to HEAD - should return empty list
-	result, err := GetChangedFiles("HEAD", "HEAD")
-	if err != nil {
-		t.Skipf("unable to run git: %q", err)
-		return
-	}
-	if len(result) > 0 {
-		t.Errorf("expected empty list, got %q", result)
+	if _, err := exec.LookPath("git"); err != nil {
+		t.Skipf("git not available: %v", err)
 	}
 
-	// Test against the empty tree - should produce non-empty result (all files in HEAD)
-	result, err = GetChangedFiles("HEAD", gitEmptyTreeSHA)
-	if err != nil {
-		t.Errorf("unable to run git: %q", err)
-		return
+	// Build a repository where main advances after a feature branch is cut.
+	// This is the situation GetChangedFiles must handle correctly: the diff
+	// should report only the feature branch's own changes, not files that moved
+	// on main in the meantime. The repository is self-contained so the test does
+	// not depend on the depth of the surrounding clone.
+	t.Chdir(t.TempDir())
+
+	git := func(args ...string) {
+		t.Helper()
+		if out, err := exec.Command("git", args...).CombinedOutput(); err != nil {
+			t.Fatalf("git %v: %v\n%s", args, err, out)
+		}
 	}
-	if len(result) == 0 {
-		t.Errorf("expected non-empty list, got %q", result)
+	commit := func(file, contents string) {
+		t.Helper()
+		require.NoError(t, os.WriteFile(file, []byte(contents), 0o600))
+		git("add", file)
+		git("commit", "-q", "-m", file)
 	}
 
-	// Test with invalid refs - should error
+	git("init", "-q", "-b", "main")
+	git("config", "user.email", "test@example.invalid")
+	git("config", "user.name", "Test")
+
+	commit("base.txt", "base") // common ancestor
+	git("checkout", "-q", "-b", "feature")
+	commit("feature.txt", "feature") // the change that belongs to the PR
+	git("checkout", "-q", "main")
+	commit("main-only.txt", "main-only") // main advances after the branch was cut
+
+	// base is main's tip; head is the feature branch. A two-dot diff would also
+	// list main-only.txt (absent on the feature side); the three-dot diff must
+	// report only feature.txt.
+	files, err := GetChangedFiles("feature", "main")
+	require.NoError(t, err)
+	assert.Equal(t, []string{"feature.txt"}, files)
+
+	// Identical refs produce no changes.
+	files, err = GetChangedFiles("feature", "feature")
+	require.NoError(t, err)
+	assert.Empty(t, files)
+
+	// Invalid refs error.
 	_, err = GetChangedFiles("invalid-ref-12345", "invalid-ref-67890")
-	if err == nil {
-		t.Error("expected error for invalid refs")
-	}
+	assert.Error(t, err)
 }
diff --git a/tools/testmask/targets.go b/tools/testmask/targets.go
index 32bb7c9cfae..bb0dcbfe1bf 100644
--- a/tools/testmask/targets.go
+++ b/tools/testmask/targets.go
@@ -16,6 +16,7 @@ var ciTargets = []string{
 	"test-exp-aitools",
 	"test-exp-ssh",
 	"test-pipelines",
+	"test-sandbox",
 }
 
 // commonTriggerPatterns lists patterns that trigger all test targets.
diff --git a/tools/testmask/targets_test.go b/tools/testmask/targets_test.go
index fe248d8d413..b2b058fc59d 100644
--- a/tools/testmask/targets_test.go
+++ b/tools/testmask/targets_test.go
@@ -38,6 +38,14 @@ func TestGetTargets(t *testing.T) {
 			},
 			targets: []string{"test-exp-aitools"},
 		},
+		{
+			name: "sandbox",
+			files: []string{
+				"cmd/sandbox/create.go",
+				"acceptance/cmd/sandbox/create/script",
+			},
+			targets: []string{"test-sandbox"},
+		},
 		{
 			name: "non_matching",
 			files: []string{
@@ -51,14 +59,14 @@ func TestGetTargets(t *testing.T) {
 			files: []string{
 				"go.mod",
 			},
-			targets: []string{"test", "test-exp-aitools", "test-exp-ssh", "test-pipelines"},
+			targets: []string{"test", "test-exp-aitools", "test-exp-ssh", "test-pipelines", "test-sandbox"},
 		},
 		{
 			name: "go_sum_triggers_all",
 			files: []string{
 				"go.sum",
 			},
-			targets: []string{"test", "test-exp-aitools", "test-exp-ssh", "test-pipelines"},
+			targets: []string{"test", "test-exp-aitools", "test-exp-ssh", "test-pipelines", "test-sandbox"},
 		},
 		{
 			name: "go_mod_with_other_files_triggers_all",
@@ -66,14 +74,14 @@ func TestGetTargets(t *testing.T) {
 				"experimental/ssh/main.go",
 				"go.mod",
 			},
-			targets: []string{"test", "test-exp-aitools", "test-exp-ssh", "test-pipelines"},
+			targets: []string{"test", "test-exp-aitools", "test-exp-ssh", "test-pipelines", "test-sandbox"},
 		},
 		{
 			name: "setup_build_environment_triggers_all",
 			files: []string{
 				".github/actions/setup-build-environment/action.yml",
 			},
-			targets: []string{"test", "test-exp-aitools", "test-exp-ssh", "test-pipelines"},
+			targets: []string{"test", "test-exp-aitools", "test-exp-ssh", "test-pipelines", "test-sandbox"},
 		},
 		{
 			name:    "empty_files",
diff --git a/tools/testrunner/main.go b/tools/testrunner/main.go
index f3ae8897da5..8415ff8ff9b 100644
--- a/tools/testrunner/main.go
+++ b/tools/testrunner/main.go
@@ -6,6 +6,11 @@ Download https://github.com/databricks/cli/blob/ciconfig/known_failures.txt in p
 If download was successful by the time test runner finishes and test runner finishes with non-zero code,
 analyze failures in the test output identified by --jsonfile option. If all failures are expected (listed in known_failures.txt)
 then the failure is masked, the process exits with 0.
+
+A parent test fails whenever one of its subtests fails, so a rule that lists a
+subtest also allows the parent to fail. That allowance only applies when a
+subtest actually failed; if the parent failed on its own (e.g. in setup, before
+any subtest ran), its failure is reported as unexpected.
 */
 package main
 
@@ -13,11 +18,13 @@ import (
 	"bufio"
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
 	"os"
 	"os/exec"
+	"slices"
 	"strings"
 	"sync/atomic"
 	"syscall"
@@ -39,7 +46,7 @@ func getExitCode(err error) (int, error) {
 	if err == nil {
 		return 0, nil
 	}
-	if exitError, ok := err.(*exec.ExitError); ok {
+	if exitError, ok := errors.AsType[*exec.ExitError](err); ok {
 		if status, ok := exitError.Sys().(syscall.WaitStatus); ok {
 			return status.ExitStatus(), nil
 		}
@@ -158,6 +165,7 @@ func checkFailures(config *Config, jsonFile string, originalExitCode int) int {
 	defer func() { _ = file.Close() }()
 
 	scanner := bufio.NewScanner(file)
+	failed := map[string]bool{}
 	unexpectedFailures := map[string]bool{}
 
 	for scanner.Scan() {
@@ -177,21 +185,33 @@ func checkFailures(config *Config, jsonFile string, originalExitCode int) int {
 		}
 
 		result.Package, _ = strings.CutPrefix(result.Package, cutPrefix)
-
 		key := result.Package + " " + result.Test
 
-		if result.Action == "fail" {
+		switch result.Action {
+		case "fail":
+			// Go reports a parent's failure only after its subtests, so any
+			// failing subtest is already in `failed` by the time we get here.
+			failed[key] = true
 			matchedRule := config.matches(result.Package, result.Test)
-			if matchedRule != "" {
+			switch {
+			case matchedRule != "":
 				fmt.Printf("%s %s failure is allowed, matches rule %q\n", result.Package, result.Test, matchedRule)
-			} else {
+			case hasFailedSubtest(failed, key):
+				// A parent test fails when a subtest fails; the subtest is
+				// reported on its own, so the parent's failure is not counted.
+				fmt.Printf("%s %s failure is allowed, a subtest failed\n", result.Package, result.Test)
+			default:
 				fmt.Printf("%s %s failure is not allowed\n", result.Package, result.Test)
 				unexpectedFailures[key] = true
 			}
-		} else if result.Action == "pass" && unexpectedFailures[key] {
-			fmt.Printf("%s %s passed on retry\n", result.Package, result.Test)
-			// We run gotestsum with --rerun-fails, so we need to account for intermittent failures
-			delete(unexpectedFailures, key)
+		case "pass":
+			// We run gotestsum with --rerun-fails, so a test that fails and
+			// later passes is flaky, not a failure.
+			delete(failed, key)
+			if unexpectedFailures[key] {
+				fmt.Printf("%s %s passed on retry\n", result.Package, result.Test)
+				delete(unexpectedFailures, key)
+			}
 		}
 	}
 
@@ -207,6 +227,18 @@ func checkFailures(config *Config, jsonFile string, originalExitCode int) int {
 	return originalExitCode
 }
 
+// hasFailedSubtest reports whether any failing test is a strict subtest of key.
+// Keys are "<package> <test>", so a subtest's key is prefixed by key + "/".
+func hasFailedSubtest(failed map[string]bool, key string) bool {
+	prefix := key + "/"
+	for k := range failed {
+		if strings.HasPrefix(k, prefix) {
+			return true
+		}
+	}
+	return false
+}
+
 // CI Config Format
 //
 // The CI config is downloaded from the "ciconfig" branch of the repository.
@@ -217,13 +249,18 @@ func checkFailures(config *Config, jsonFile string, originalExitCode int) int {
 // Where:
 // - Lines with whitespace only are ignored
 // - Everything after '#' is a comment and is ignored
-// - Both package and testcase can be '*' meaning any package or any testcase
-// - Both can end with '/' which means it's a prefix match
+// - Both package and testcase are matched segment by segment, split on '/'
+// - A '*' segment matches any number of segments (including zero), so a whole
+//   field of '*' matches anything and an interior '*' spans the segments
+//   between two fixed ones
+// - A trailing '/' makes the pattern a prefix: it matches the listed segments
+//   plus any number of segments below them
 //
 // Examples:
-//   "libs/ *"           - all packages starting with "libs/" and all testcases are allowed to fail
-//   "* TestAccept/"     - all testcases starting with "TestAccept/" are allowed to fail
-//   "bundle TestDeploy" - exact match for package "bundle" and testcase "TestDeploy"
+//   "libs/ *"                  - all packages under "libs/" and all testcases are allowed to fail
+//   "* TestAccept/"            - all testcases under "TestAccept/" are allowed to fail
+//   "bundle TestDeploy"        - exact match for package "bundle" and testcase "TestDeploy"
+//   "* TestAccept/*/DMS=true/" - every testcase with a "DMS=true" segment, at any depth
 //
 // Parse errors for individual lines are logged but do not abort processing.
 
@@ -232,8 +269,10 @@ type Config struct {
 }
 
 func (c *Config) matches(packageName, testName string) string {
+	pkg := strings.Split(packageName, "/")
+	test := strings.Split(testName, "/")
 	for _, rule := range c.rules {
-		if rule.matches(packageName, testName) {
+		if rule.matches(pkg, test) {
 			return rule.OriginalLine
 		}
 	}
@@ -241,10 +280,8 @@ func (c *Config) matches(packageName, testName string) string {
 }
 
 type ConfigRule struct {
-	PackagePattern string
-	TestPattern    string
-	PackagePrefix  bool
-	TestPrefix     bool
+	PackagePattern []string
+	TestPattern    []string
 	OriginalLine   string
 }
 
@@ -283,12 +320,21 @@ func parseConfig(content string) (*Config, error) {
 	return config, scanner.Err()
 }
 
-// parsePattern returns the pattern and whether it's a prefix match.
-func parsePattern(pattern string) (string, bool) {
-	if pattern == "*" {
-		return "", true
+// parsePattern splits a pattern field into segments. A trailing "/" marks a
+// prefix match, represented as a trailing "*" segment so it matches any number
+// of segments below the listed ones. An empty segment (from "//" or a bare "/")
+// can never match a real path segment, so it is rejected rather than silently
+// producing a rule that matches nothing.
+func parsePattern(pattern string) ([]string, error) {
+	prefix := strings.HasSuffix(pattern, "/")
+	segments := strings.Split(strings.TrimSuffix(pattern, "/"), "/")
+	if slices.Contains(segments, "") {
+		return nil, fmt.Errorf("empty segment in pattern %q", pattern)
+	}
+	if prefix {
+		segments = append(segments, "*")
 	}
-	return strings.CutSuffix(pattern, "/")
+	return segments, nil
 }
 
 func parseConfigRule(line, originalLine string) (ConfigRule, error) {
@@ -297,50 +343,53 @@ func parseConfigRule(line, originalLine string) (ConfigRule, error) {
 		return ConfigRule{}, fmt.Errorf("expected 2 fields, got %d", len(parts))
 	}
 
-	packagePattern := parts[0]
-	testPattern := parts[1]
+	packagePattern, err := parsePattern(parts[0])
+	if err != nil {
+		return ConfigRule{}, err
+	}
+	testPattern, err := parsePattern(parts[1])
+	if err != nil {
+		return ConfigRule{}, err
+	}
 
-	rule := ConfigRule{
+	return ConfigRule{
 		PackagePattern: packagePattern,
 		TestPattern:    testPattern,
 		OriginalLine:   strings.TrimSpace(originalLine),
-	}
-
-	// Check for wildcard or prefix
-	rule.PackagePattern, rule.PackagePrefix = parsePattern(packagePattern)
-	rule.TestPattern, rule.TestPrefix = parsePattern(testPattern)
-
-	return rule, nil
+	}, nil
 }
 
-func (r ConfigRule) matches(packageName, testName string) bool {
-	// Check package pattern
-	var packageMatch bool
-	if r.PackagePrefix {
-		packageMatch = matchesPathPrefix(packageName, r.PackagePattern)
-	} else {
-		packageMatch = packageName == r.PackagePattern
-	}
-
-	if !packageMatch {
-		return false
-	}
-
-	// Check test pattern
-	if r.TestPrefix {
-		return matchesPathPrefix(testName, r.TestPattern) || matchesPathPrefix(r.TestPattern, testName)
-	}
-	return testName == r.TestPattern || matchesPathPrefix(r.TestPattern, testName)
+func (r ConfigRule) matches(packageName, testName []string) bool {
+	return matchSegments(r.PackagePattern, packageName) &&
+		matchSegments(r.TestPattern, testName)
 }
 
-// matchesPathPrefix returns true if s matches pattern or starts with pattern + "/"
-// If pattern is empty (wildcard "*"), it matches any string
-func matchesPathPrefix(s, prefix string) bool {
-	if prefix == "" {
-		return true
+// matchSegments reports whether name matches pattern segment by segment, where
+// a "*" pattern segment matches any number of name segments (including zero).
+// It is the standard linear wildcard match that backtracks on the latest "*".
+func matchSegments(pattern, name []string) bool {
+	pi, ni := 0, 0
+	star, match := -1, 0
+	for ni < len(name) {
+		switch {
+		case pi < len(pattern) && pattern[pi] == "*":
+			star = pi
+			match = ni
+			pi++
+		case pi < len(pattern) && pattern[pi] == name[ni]:
+			pi++
+			ni++
+		case star >= 0:
+			// Backtrack: let the last "*" consume one more name segment.
+			pi = star + 1
+			match++
+			ni = match
+		default:
+			return false
+		}
 	}
-	if s == prefix {
-		return true
+	for pi < len(pattern) && pattern[pi] == "*" {
+		pi++
 	}
-	return strings.HasPrefix(s, prefix+"/")
+	return pi == len(pattern)
 }
diff --git a/tools/testrunner/main_test.go b/tools/testrunner/main_test.go
index fe4941e669a..b46356fd91b 100644
--- a/tools/testrunner/main_test.go
+++ b/tools/testrunner/main_test.go
@@ -1,6 +1,10 @@
 package main
 
 import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -44,25 +48,126 @@ func TestConfigRuleMatches(t *testing.T) {
 		{"* TestDeploy", "", "TestDeploy", true},
 		{"bundle *", "bundle", "", true},
 
-		// Subtest failure results in parent test failure as well. So we allow strict prefixes to fail as well
-		{"acceptance TestAccept/bundle/templates/default-python/combinations/classic", "acceptance", "TestAccept", true},
+		// A rule does not match a parent of the listed test; the parent's
+		// cascading failure is handled separately (see TestCheckFailures).
+		{"acceptance TestAccept/bundle/templates/default-python/combinations/classic", "acceptance", "TestAccept", false},
 		{"acceptance TestAccept/bundle/templates/default-python/combinations/classic", "acceptance", "TestAnother", false},
 		{"acceptance TestAccept/bundle/templates/default-python/combinations/classic", "acceptance", "TestAccept/bundle/templates/default-python/combinations/classic/x", false},
 
 		// pattern version
-		{"acceptance TestAccept/bundle/templates/default-python/combinations/classic/", "acceptance", "TestAccept", true},
+		{"acceptance TestAccept/bundle/templates/default-python/combinations/classic/", "acceptance", "TestAccept", false},
 		{"acceptance TestAccept/bundle/templates/default-python/combinations/classic/", "acceptance", "TestAnother", false},
 		{"acceptance TestAccept/bundle/templates/default-python/combinations/classic/", "acceptance", "TestAccept/bundle/templates/default-python/combinations/classic/x", true},
 		{"acceptance TestAccept/bundle/templates/default-python/combinations/classic/", "acceptance", "TestAccept/bundle/templates/default-python/combinations/classic", true},
-		{"acceptance TestAccept/bundle/templates/default-python/combinations/classic/", "acceptance", "TestAccept/bundle/templates/default-python/combinations", true},
+		{"acceptance TestAccept/bundle/templates/default-python/combinations/classic/", "acceptance", "TestAccept/bundle/templates/default-python/combinations", false},
+
+		// Interior "*" spans any number of path segments. This is the DMS=true
+		// use case: match every permutation that carries a DMS=true segment,
+		// regardless of the test name or engine segments preceding it.
+		{"acceptance TestAccept/*/DMS=true/", "acceptance", "TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=job.yml.tmpl", true},
+		{"acceptance TestAccept/*/DMS=true/", "acceptance", "TestAccept/bundle/invariant/migrate/DATABRICKS_BUNDLE_ENGINE=terraform/DMS=true", true},
+		{"acceptance TestAccept/*/DMS=true/", "acceptance", "TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=/INPUT_CONFIG=job.yml.tmpl", false},
+		{"acceptance TestAccept/*/DMS=true/", "acceptance", "TestAccept", false},
+
+		// Interior "*" matching zero segments.
+		{"* TestAccept/*/leaf", "any", "TestAccept/leaf", true},
+		{"* a/*/b", "any", "a/b", true},
+		{"* a/*/b", "any", "a/x/y/b", true},
+		{"* a/*/b", "any", "a/x/b/c", false},
+
+		// Multiple interior wildcards.
+		{"* a/*/b/*/c", "any", "a/1/b/2/c", true},
+		{"* a/*/b/*/c", "any", "a/1/2/b/3/4/c", true},
+		{"* a/*/b/*/c", "any", "a/b/c", true},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.input+"_"+tt.packageName+"_"+tt.testcase, func(t *testing.T) {
 			rule, err := parseConfigRule(tt.input, tt.input)
 			require.NoError(t, err)
-			result := rule.matches(tt.packageName, tt.testcase)
+			result := rule.matches(strings.Split(tt.packageName, "/"), strings.Split(tt.testcase, "/"))
 			assert.Equal(t, tt.match, result)
 		})
 	}
 }
+
+func TestParseConfigRuleErrors(t *testing.T) {
+	for _, input := range []string{
+		"bundle",
+		"a b c",
+		"bundle// TestDeploy",
+		"bundle /",
+		"* TestAccept//Deploy",
+	} {
+		t.Run(input, func(t *testing.T) {
+			_, err := parseConfigRule(input, input)
+			assert.Error(t, err)
+		})
+	}
+}
+
+func TestCheckFailures(t *testing.T) {
+	const config = "* TestAccept/ssh/connection\n"
+
+	tests := []struct {
+		name     string
+		results  []TestResult
+		wantExit int
+	}{
+		{
+			// A parent failing because a listed subtest failed is allowed.
+			name: "parent allowed when subtest failed",
+			results: []TestResult{
+				{Action: "fail", Package: "acceptance", Test: "TestAccept/ssh/connection"},
+				{Action: "fail", Package: "acceptance", Test: "TestAccept"},
+			},
+			wantExit: 0,
+		},
+		{
+			// A parent failing on its own (no subtest failed) is not allowed,
+			// even though a subtest is listed as a known failure. This is the
+			// ruff-missing-in-setup case.
+			name: "parent not allowed without failing subtest",
+			results: []TestResult{
+				{Action: "fail", Package: "acceptance", Test: "TestAccept"},
+			},
+			wantExit: 7,
+		},
+		{
+			name: "unlisted failure is not allowed",
+			results: []TestResult{
+				{Action: "fail", Package: "acceptance", Test: "TestSomethingElse"},
+			},
+			wantExit: 7,
+		},
+		{
+			// gotestsum reruns failed tests; a failure followed by a pass is
+			// flaky, not a failure.
+			name: "failure passing on retry is allowed",
+			results: []TestResult{
+				{Action: "fail", Package: "acceptance", Test: "TestAccept"},
+				{Action: "pass", Package: "acceptance", Test: "TestAccept"},
+			},
+			wantExit: 0,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cfg, err := parseConfig(config)
+			require.NoError(t, err)
+
+			jsonFile := filepath.Join(t.TempDir(), "results.json")
+			var sb strings.Builder
+			for _, r := range tt.results {
+				line, err := json.Marshal(r)
+				require.NoError(t, err)
+				sb.Write(line)
+				sb.WriteByte('\n')
+			}
+			require.NoError(t, os.WriteFile(jsonFile, []byte(sb.String()), 0o600))
+
+			assert.Equal(t, tt.wantExit, checkFailures(cfg, jsonFile, 7))
+		})
+	}
+}
diff --git a/tools/update_github_links.py b/tools/update_github_links.py
deleted file mode 100755
index 93196607962..00000000000
--- a/tools/update_github_links.py
+++ /dev/null
@@ -1,141 +0,0 @@
-#!/usr/bin/env python3
-# /// script
-# requires-python = ">=3.12"
-# ///
-"""Update PR references in changelog files.
-
-1. Convert occurrences of `#1234` to the canonical markdown link
-   `([#1234](https://github.com/databricks/cli/pull/1234))`.
-2. Validate that for existing converted references the PR number in the text
-   and in the URL match.
-"""
-
-import argparse
-import pathlib
-import re
-import sys
-
-DEFAULT_FILES = ("NEXT_CHANGELOG.md", "CHANGELOG.md")
-
-# Canonical form: ([#1234](https://github.com/databricks/cli/pull/1234))
-CONVERTED_LINK_RE = re.compile(
-    r"\(\[#(?P<num_text>\d+)\]\("  # ([#1234](
-    r"https://github\.com/databricks/cli/pull/(?P<num_url>\d+)"  # …/pull/1234
-    r"\)\)"  # ))
-)
-
-# Double-paren form produced by a previous incorrect run:
-#   (([#1234](https://github.com/databricks/cli/pull/1234)))
-DOUBLE_PAREN_LINK_RE = re.compile(
-    r"\(\(\[#(?P<num>\d+)\]\("
-    r"https://github\.com/databricks/cli/pull/\d+"
-    r"\)\)\)"
-)
-
-# Raw reference already wrapped in parens: (#1234)
-PAREN_RAW_REF_RE = re.compile(r"\(#(?P<num>\d+)\)")
-
-# Bare raw reference not already part of a converted link or paren-wrapped ref.
-# Negative look-behinds: '[' means it's inside a converted link; '(' means
-# it will be handled by PAREN_RAW_REF_RE above.
-RAW_REF_RE = re.compile(r"(?<!\[)(?<!\()#(?P<num>\d+)\b")
-
-
-def find_mismatched_links(text):
-    """Return texts of mismatching converted links.
-
-    >>> find_mismatched_links("([#1234](https://github.com/databricks/cli/pull/1234))")
-    []
-    >>> find_mismatched_links("([#1234](https://github.com/databricks/cli/pull/9999))")
-    ['Converted link numbers differ: text #1234 vs URL #9999 — …([#1234](https://github.com/databricks/cli/pull/9999))…']
-    """
-    mismatches = []
-    for m in CONVERTED_LINK_RE.finditer(text):
-        num_text, num_url = m.group("num_text"), m.group("num_url")
-        if num_text != num_url:
-            context = text[max(0, m.start() - 20) : m.end() + 20]
-            mismatches.append(f"Converted link numbers differ: text #{num_text} vs URL #{num_url} — …{context}…")
-    return mismatches
-
-
-def convert_raw_references(text):
-    """Convert raw `#1234` references to markdown links.
-
-    Already-converted single-paren links are left unchanged:
-
-    >>> convert_raw_references("([#1234](https://github.com/databricks/cli/pull/1234))")
-    '([#1234](https://github.com/databricks/cli/pull/1234))'
-
-    Double-paren links from a previous incorrect run are collapsed to single-paren:
-
-    >>> convert_raw_references("(([#1234](https://github.com/databricks/cli/pull/1234)))")
-    '([#1234](https://github.com/databricks/cli/pull/1234))'
-
-    A raw reference with surrounding parens becomes a single-paren link (not double):
-
-    >>> convert_raw_references("(#3456)")
-    '([#3456](https://github.com/databricks/cli/pull/3456))'
-
-    A bare raw reference gets wrapped in a single-paren link:
-
-    >>> convert_raw_references("#3456")
-    '([#3456](https://github.com/databricks/cli/pull/3456))'
-
-    Idempotent: running twice produces the same result:
-
-    >>> t = "(#3456) and #7890"
-    >>> convert_raw_references(convert_raw_references(t)) == convert_raw_references(t)
-    True
-    """
-
-    def _make_link(num):
-        return f"([#{num}](https://github.com/databricks/cli/pull/{num}))"
-
-    # Fix existing double-paren links produced by a previous incorrect run.
-    text = DOUBLE_PAREN_LINK_RE.sub(lambda m: _make_link(m.group("num")), text)
-
-    # Convert (#1234) — parens already present, replace the whole token.
-    text = PAREN_RAW_REF_RE.sub(lambda m: _make_link(m.group("num")), text)
-
-    # Convert bare #1234 — not preceded by [ (converted) or ( (paren-wrapped).
-    text = RAW_REF_RE.sub(lambda m: _make_link(m.group("num")), text)
-
-    return text
-
-
-def process_file(path):
-    """Process a single file.
-
-    Returns True if the file was *modified*.
-    Raises `SystemExit` with non-zero status on mismatching converted links.
-    """
-    original = path.read_text(encoding="utf-8")
-
-    mismatches = find_mismatched_links(original)
-    if mismatches:
-        for msg in mismatches:
-            print(f"{path}:{msg}", file=sys.stderr)
-        sys.exit(1)
-
-    updated = convert_raw_references(original)
-    if updated != original:
-        path.write_text(updated, encoding="utf-8")
-        print(f"Updated {path}")
-        return True
-
-    return False
-
-
-def main(argv=None):
-    parser = argparse.ArgumentParser(description="Convert #PR references in changelogs to links.")
-    parser.add_argument("files", nargs="*", help=f"Markdown files to process (default: {DEFAULT_FILES})")
-    args = parser.parse_args(argv)
-
-    modified_any = False
-    for file_path in args.files or DEFAULT_FILES:
-        file_path = pathlib.Path(file_path)
-        modified_any |= process_file(file_path)
-
-
-if __name__ == "__main__":
-    main()
diff --git a/tools/validate_agents_setup.py b/tools/validate_agents_setup.py
new file mode 100644
index 00000000000..46765a95c2e
--- /dev/null
+++ b/tools/validate_agents_setup.py
@@ -0,0 +1,64 @@
+#!/usr/bin/env python3
+# /// script
+# requires-python = ">=3.12"
+# ///
+"""Keep .cursor/rules/*.mdc in sync with the canonical .agents/rules/*.md rules.
+
+The agent instructions live in AGENTS.md and .agents/ (rules, skills). Claude
+reads AGENTS.md directly. Other integrations use committed symlinks:
+
+  - .github/custom-instructions.md -> AGENTS.md
+  - .claude/rules, .claude/skills  -> .agents/rules, .agents/skills  (directory links)
+
+Cursor is the exception: it only reads .mdc files and won't follow a directory
+link, so every rule needs its own .cursor/rules/<name>.mdc pointing back at the .md.
+This creates the missing ones and drops stale ones, then exits non-zero if it had
+to change anything so CI fails on an out-of-sync tree: a created symlink is
+untracked, so CI's `git diff --exit-code` gate alone would let a missing one pass.
+
+The standalone .cursor/rules/00-agents-context.mdc bootstrap is not a mirror of a
+rule and is left untouched.
+"""
+
+import os
+import sys
+
+AGENTS_RULES = ".agents/rules"
+CURSOR_RULES = ".cursor/rules"
+
+
+def main():
+    changed = False
+
+    stems = sorted(f[:-3] for f in os.listdir(AGENTS_RULES) if f.endswith(".md"))
+
+    # Every rule needs a .mdc symlink. The .mdc lives in .cursor/rules/, so ../../
+    # reaches the repo root.
+    for stem in stems:
+        mdc = os.path.join(CURSOR_RULES, stem + ".mdc")
+        want = f"../../{AGENTS_RULES}/{stem}.md"
+        if os.path.islink(mdc) and os.readlink(mdc) == want:
+            continue
+        if os.path.lexists(mdc):
+            os.remove(mdc)
+        os.symlink(want, mdc)
+        print(f"Linked {mdc} -> {want}")
+        changed = True
+
+    # Drop .mdc symlinks whose rule no longer exists.
+    known = {stem + ".mdc" for stem in stems}
+    for name in sorted(os.listdir(CURSOR_RULES)):
+        path = os.path.join(CURSOR_RULES, name)
+        if os.path.islink(path) and name not in known:
+            os.remove(path)
+            print(f"Removed stale {path}")
+            changed = True
+
+    if changed:
+        print("Cursor rule symlinks were out of sync; they have been fixed, commit the changes", file=sys.stderr)
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/tools/validate_codeowners.py b/tools/validate_codeowners.py
new file mode 100644
index 00000000000..4404a190457
--- /dev/null
+++ b/tools/validate_codeowners.py
@@ -0,0 +1,79 @@
+#!/usr/bin/env python3
+"""Keep CLI maintainers eligible to approve every CODEOWNERS rule."""
+
+import sys
+from pathlib import Path
+
+MAINTAINERS = "@databricks/eng-deco-cli"
+
+
+def validate_contents(data):
+    r"""Return line-numbered errors for missing or misplaced maintainers.
+
+    A maintainer catch-all followed by area owners is valid:
+
+    >>> catch_all = '* @databricks/eng-deco-cli\n'
+    >>> validate_contents(catch_all + '/bundle/ @databricks/eng-deco-cli @databricks/eng-deco-dabs\n')
+    []
+
+    Ignore blank lines and comments, including inline comments:
+
+    >>> validate_contents('\n  # Owners\n\t*\t@databricks/eng-deco-cli # Default\r\n')
+    []
+
+    Missing owners, a different first owner, and a maintainer listed later fail:
+
+    >>> validate_contents(catch_all + '/bundle/\n')
+    ['2: first owner must be @databricks/eng-deco-cli']
+    >>> validate_contents(catch_all + '/bundle/ @databricks/eng-deco-dabs\n')
+    ['2: first owner must be @databricks/eng-deco-cli']
+    >>> validate_contents(catch_all + '/bundle/ @databricks/eng-deco-dabs @databricks/eng-deco-cli\n')
+    ['2: first owner must be @databricks/eng-deco-cli']
+
+    A comment or similarly named team cannot satisfy the owner requirement:
+
+    >>> validate_contents(catch_all + '/bundle/ # @databricks/eng-deco-cli\n')
+    ['2: first owner must be @databricks/eng-deco-cli']
+    >>> validate_contents('* @databricks/eng-deco-cli-extra\n')
+    ['1: first owner must be @databricks/eng-deco-cli']
+
+    The first rule must cover all paths, even if a catch-all appears later:
+
+    >>> validate_contents('# Owners\n/bundle/ @databricks/eng-deco-cli\n' + catch_all)
+    ["2: first rule must use '*' to cover all paths"]
+    >>> validate_contents('')
+    ["1: missing '* @databricks/eng-deco-cli' catch-all rule"]
+    >>> validate_contents('\n# No rules\n')
+    ["1: missing '* @databricks/eng-deco-cli' catch-all rule"]
+
+    Report every invalid rule with its actual line number:
+
+    >>> validate_contents(catch_all + '\n# Bundles\n/bundle/\n/cmd/bundle/ @databricks/eng-deco-dabs\n')
+    ['4: first owner must be @databricks/eng-deco-cli', '5: first owner must be @databricks/eng-deco-cli']
+    """
+    errors = []
+    found_rule = False
+    for lineno, line in enumerate(data.splitlines(), 1):
+        fields = line.split()
+        if not fields or fields[0].startswith("#"):
+            continue
+        if not found_rule and fields[0] != "*":
+            errors.append(f"{lineno}: first rule must use '*' to cover all paths")
+        found_rule = True
+        if fields[1:2] != [MAINTAINERS]:
+            errors.append(f"{lineno}: first owner must be {MAINTAINERS}")
+    if not found_rule:
+        errors.append(f"1: missing '* {MAINTAINERS}' catch-all rule")
+    return errors
+
+
+def main():
+    path = Path(".github/CODEOWNERS")
+    errors = validate_contents(path.read_text(encoding="utf-8"))
+    for error in errors:
+        print(f"{path}:{error}")
+    return 1 if errors else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/tools/validate_nextchanges.py b/tools/validate_nextchanges.py
new file mode 100644
index 00000000000..1b4eb30ceb3
--- /dev/null
+++ b/tools/validate_nextchanges.py
@@ -0,0 +1,568 @@
+#!/usr/bin/env python3
+# /// script
+# requires-python = ">=3.12"
+# ///
+"""Validate changelog fragment placement under ``.nextchanges/``.
+
+Each PR adds its own file under ``.nextchanges/<section>/`` (see
+``.nextchanges/README.md``). This fails CI when a fragment is misfiled or
+empty, so it is caught up front rather than silently dropped when the release
+renders ``.nextchanges/`` into ``CHANGELOG.md`` (see
+``internal/genkit/tagging.py``).
+"""
+
+import argparse
+import json
+import os
+import pathlib
+import re
+import subprocess
+import sys
+
+CHANGELOG_DIR = ".nextchanges"
+CODEGEN_FILE = ".codegen.json"
+NEXTCHANGES_SECTIONS_KEY = "nextchanges_sections"
+
+# .nextchanges/version holds the next release version; the release reads it and
+# bumps it. Accept a bare semver (optionally v-prefixed), e.g. 1.4.0 / v1.4.0.
+VERSION_FILE = "version"
+SEMVER_RE = re.compile(r"^v?\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$")
+
+# README.md is allowed both at the .nextchanges root (the docs) and inside each
+# section directory: the release renderer skips it, so a committed README.md
+# keeps otherwise-empty section directories present in git without being
+# mistaken for a fragment.
+README = "README.md"
+
+# nextversion.go embeds the version file above so the build can report the next
+# release version. It lives here because go:embed cannot reach a parent
+# directory, and keeping it here avoids a second copy of the version that could
+# drift. The release renderer only reads *.md fragments, so it ignores this.
+NEXTVERSION_GO = "nextversion.go"
+
+# A fragment is a single changelog entry: one line that starts with "* " and
+# ends with a period. An optional trailing PR link group "([#N](pull-url))" — or
+# a comma-separated list "([#N](…), [#M](…))" for entries spanning several PRs —
+# may follow the period. Every "#N" reference must be written as a full markdown
+# link: a bare or paren-wrapped "#N" would render as an unintended auto-link in
+# CHANGELOG.md, and nothing expands links anymore.
+BULLET_PREFIX = "* "
+
+# The trailing PR link group: a parenthesized, comma-separated list of markdown
+# links at the very end of the entry, e.g. "([#12](…), [#34](…))". Matched
+# loosely (any "[..](..)" link) so a malformed link inside still makes the group
+# recognizable — it is then reported as a link error, rather than misfiring as
+# "must end with a period" because a strict pattern failed to match.
+_LINK = r"\[[^\]]*\]\([^)]*\)"
+TRAILING_GROUP_RE = re.compile(rf" \((?P<links>{_LINK}(?:, {_LINK})*)\)$")
+LINK_RE = re.compile(_LINK)
+
+# A "#N" not preceded by "[" is a raw, unexpanded reference (bare, or wrapped in
+# parens); the "[#N]" of a markdown link is preceded by "[" and so is excluded.
+RAW_REF_RE = re.compile(r"(?<!\[)#\d+")
+# A well-formed PR link "[#N](…/pull/N)", capturing both numbers so they can be
+# compared and, via fullmatch, to tell a valid PR link from a malformed one.
+PR_LINK_RE = re.compile(r"\[#(\d+)\]\(https://github\.com/databricks/cli/pull/(\d+)\)")
+
+
+def fragment_format_problem(text):
+    r"""Return why ``text`` is not a valid fragment, or ``None`` if it is.
+
+    A fragment is exactly one changelog entry: a single non-empty line that
+    starts with ``"* "`` and ends with ``"."``. An optional trailing PR link
+    group (``([#N](pull-url))``, or a comma-separated list) may follow the period.
+
+    Valid fragments (with or without a trailing PR link) return None:
+
+    >>> fragment_format_problem("* Added the `foo` command.")
+    >>> fragment_format_problem("* Fixed a bug. ([#6208](https://github.com/databricks/cli/pull/6208))")
+
+    Each structural problem returns its own message:
+
+    >>> fragment_format_problem("Added the `foo` command.")
+    'must start with a "* " bullet marker'
+
+    >>> fragment_format_problem("* Added the `foo` command")
+    'must end with a period'
+
+    >>> fragment_format_problem("* First entry.\n* Second entry.")
+    'must be a single entry on one line'
+
+    >>> fragment_format_problem("   ")
+    'empty fragment'
+    """
+    stripped = text.strip()
+    if not stripped:
+        return "empty fragment"
+    if "\n" in stripped:
+        return "must be a single entry on one line"
+    if not stripped.startswith(BULLET_PREFIX):
+        return 'must start with a "* " bullet marker'
+    # The trailing PR link group follows the period; ignore it when checking
+    # that the entry text itself ends with a period. Matched loosely so a
+    # malformed link inside doesn't hide the group and misfire here — pr_link
+    # _problem validates the links.
+    if not TRAILING_GROUP_RE.sub("", stripped).endswith("."):
+        return "must end with a period"
+    return None
+
+
+def link_problem(text):
+    r"""Return a problem with the ``#`` references in ``text``, or ``None``.
+
+    Every reference must be a full markdown link; a bare or paren-wrapped ``#N``
+    (which GitHub would auto-link in the rendered CHANGELOG.md) is rejected. A PR
+    link's text number and URL number must also agree.
+
+    A fully-linked entry is fine (returns None):
+
+    >>> link_problem("* Fixed a bug. ([#5](https://github.com/databricks/cli/pull/5))")
+
+    A bare or paren-wrapped reference is rejected:
+
+    >>> link_problem("* Fixed a bug (#5).")
+    'unexpanded reference #5: write it as a markdown link, e.g. [#5](https://github.com/databricks/cli/pull/5)'
+
+    >>> link_problem("* Reverts #7 for now.")
+    'unexpanded reference #7: write it as a markdown link, e.g. [#7](https://github.com/databricks/cli/pull/7)'
+
+    A link whose text and URL numbers disagree is rejected:
+
+    >>> link_problem("* Oops. ([#5](https://github.com/databricks/cli/pull/9))")
+    'PR link text #5 does not match its URL (pull/9)'
+    """
+    m = RAW_REF_RE.search(text)
+    if m:
+        ref = m.group(0)
+        return f"unexpanded reference {ref}: write it as a markdown link, e.g. [{ref}](https://github.com/databricks/cli/pull/{ref[1:]})"
+    for lm in PR_LINK_RE.finditer(text):
+        if lm.group(1) != lm.group(2):
+            return f"PR link text #{lm.group(1)} does not match its URL (pull/{lm.group(2)})"
+    return None
+
+
+def pr_link_problem(text, require_pr_link, expected_pr):
+    r"""Return a problem with ``text``'s trailing PR link group, or ``None``.
+
+    The group is recognized loosely, then each link must be a well-formed PR link
+    (a malformed URL is reported as such). ``expected_pr`` is the PR that
+    introduced the fragment (see ``infer_expected_pr``); it must appear among the
+    linked PRs, so an entry may also list follow-up PRs. ``require_pr_link`` makes
+    the group mandatory — set whenever the change is associated with a PR (see
+    ``main``). Text/URL number agreement is checked by ``link_problem``.
+
+    When no link is required, a link-less entry is fine:
+
+    >>> pr_link_problem("* A change.", False, None)
+
+    When a link is required but absent, the message names the expected PR (or a
+    placeholder when it is unknown):
+
+    >>> pr_link_problem("* A change.", True, "5")
+    'missing trailing PR link: end with ([#5](https://github.com/databricks/cli/pull/5))'
+
+    >>> pr_link_problem("* A change.", True, None)
+    'missing trailing PR link: end with ([#<PR>](https://github.com/databricks/cli/pull/<PR>))'
+
+    A malformed PR link is reported as such:
+
+    >>> pr_link_problem("* A change. ([#6177](https://github.com/databricks/cli/6177))", True, "6177")
+    'malformed trailing PR link "[#6177](https://github.com/databricks/cli/6177)": expected [#N](https://github.com/databricks/cli/pull/N)'
+
+    The expected PR must appear among the linked PRs (follow-ups may also be listed):
+
+    >>> pr_link_problem("* A change. ([#5](https://github.com/databricks/cli/pull/5))", True, "5")
+    >>> pr_link_problem("* A change. ([#5](https://github.com/databricks/cli/pull/5), [#9](https://github.com/databricks/cli/pull/9))", True, "9")
+
+    >>> pr_link_problem("* A change. ([#5](https://github.com/databricks/cli/pull/5))", True, "9")
+    'trailing PR link #5 must include the PR that added this fragment (#9)'
+
+    >>> pr_link_problem("* A change. ([#5](https://github.com/databricks/cli/pull/5))", False, None)
+    """
+    m = TRAILING_GROUP_RE.search(text.strip())
+    if m is None:
+        if not require_pr_link:
+            return None
+        pr = expected_pr or "<PR>"
+        return f"missing trailing PR link: end with ([#{pr}](https://github.com/databricks/cli/pull/{pr}))"
+    numbers = []
+    for link in LINK_RE.findall(m.group("links")):
+        lm = PR_LINK_RE.fullmatch(link)
+        if lm is None:
+            return f'malformed trailing PR link "{link}": expected [#N](https://github.com/databricks/cli/pull/N)'
+        numbers.append(lm.group(1))
+    if expected_pr is not None and expected_pr not in numbers:
+        shown = ", ".join("#" + n for n in numbers)
+        return f"trailing PR link {shown} must include the PR that added this fragment (#{expected_pr})"
+    return None
+
+
+def infer_expected_pr(path, fallback_pr, base_ref, root):
+    """Return the PR number that introduced the fragment at ``path``.
+
+    databricks/cli squash-merges end the commit subject with ``(#N)``, so the
+    commit that most recently added the file names its PR. A fragment not yet on
+    main (added on the current branch, or uncommitted) has no such commit, so
+    ``fallback_pr`` — the current PR — is used, unless the fragment already exists
+    on the PR's base branch: a gh-stacked PR carries the fragments of the PRs it is
+    stacked on, which keep their own link, so ``None`` is returned for those and no
+    specific PR is imposed (see ``fragment_on_base``). ``git`` runs in ``root`` so
+    the repo being validated is queried even when ``--root`` differs from the
+    process CWD. Requires full git history (the workflow checks out with
+    ``fetch-depth: 0``); best-effort, so any git failure falls back rather than
+    erroring."""
+    try:
+        result = subprocess.run(
+            ["git", "log", "-1", "--diff-filter=A", "--format=%s", "--", str(path)],
+            capture_output=True,
+            text=True,
+            timeout=10,
+            cwd=root,
+        )
+    except (OSError, subprocess.SubprocessError):
+        return fallback_pr
+    if result.returncode == 0:
+        m = re.search(r"\(#(\d+)\)\s*$", result.stdout.strip())
+        if m:
+            return m.group(1)
+    if base_ref and fragment_on_base(path, base_ref, root):
+        return None
+    return fallback_pr
+
+
+def fragment_on_base(path, base_ref, root):
+    """Whether the fragment at ``path`` already exists on the PR's base branch.
+
+    A stacked PR inherits the fragments of the PRs below it; those already live on
+    the base branch and carry their own PR link, so they are not attributed to the
+    current PR. The base is looked up as the remote-tracking ``origin/<base_ref>``
+    (CI's checkout), falling back to a local branch ``<base_ref>``. Best-effort: any
+    git failure returns ``False``, attributing the fragment to the current PR as
+    before."""
+    rel = path.relative_to(root).as_posix()
+    for ref in (f"origin/{base_ref}", base_ref):
+        try:
+            result = subprocess.run(
+                ["git", "cat-file", "-e", f"{ref}:{rel}"],
+                capture_output=True,
+                text=True,
+                timeout=10,
+                cwd=root,
+            )
+        except (OSError, subprocess.SubprocessError) as e:
+            print(f"git cat-file failed: {e}", file=sys.stderr)
+            return False
+        if result.returncode == 0:
+            return True
+    return False
+
+
+def is_shallow(root):
+    """Whether ``root`` is a shallow git clone. Best-effort; a git failure (or a
+    non-repo) returns False. On a shallow clone every file looks added at the
+    single available commit, so ``--diff-filter=A`` attribution is unreliable."""
+    try:
+        result = subprocess.run(
+            ["git", "rev-parse", "--is-shallow-repository"],
+            capture_output=True,
+            text=True,
+            timeout=10,
+            cwd=root,
+        )
+    except (OSError, subprocess.SubprocessError):
+        return False
+    return result.returncode == 0 and result.stdout.strip() == "true"
+
+
+def is_valid_semver(version_str):
+    """Check if a string is a valid semantic version.
+
+    Valid formats (bare or v-prefixed, with optional pre-release/metadata):
+    >>> is_valid_semver("1.0.0")
+    True
+    >>> is_valid_semver("v1.0.0")
+    True
+    >>> is_valid_semver("1.2.3-alpha")
+    True
+    >>> is_valid_semver("1.2.3+build")
+    True
+    >>> is_valid_semver("1.2.3-rc.1+build.123")
+    True
+
+    Invalid formats:
+    >>> is_valid_semver("1.0")
+    False
+    >>> is_valid_semver("v1.0")
+    False
+    >>> is_valid_semver("not-a-version")
+    False
+    >>> is_valid_semver("")
+    False
+
+    Whitespace is stripped, so "1.0.0" with leading/trailing whitespace is valid:
+    >>> is_valid_semver("  1.0.0  ")
+    True
+    """
+    return bool(SEMVER_RE.match(version_str.strip()) if version_str else False)
+
+
+def load_sections(root):
+    """Return the section slugs from .codegen.json, in changelog order.
+
+    A missing or malformed .codegen.json raises: it is not something a PR author
+    can be at fault for, so it crashes with the original traceback rather than
+    being reported as a fragment problem."""
+    codegen = json.loads((root / CODEGEN_FILE).read_text(encoding="utf-8"))
+
+    sections = codegen.get(NEXTCHANGES_SECTIONS_KEY)
+    if not isinstance(sections, dict) or not sections:
+        raise ValueError(f"{CODEGEN_FILE} must define a non-empty {NEXTCHANGES_SECTIONS_KEY} object")
+
+    return tuple(sections)
+
+
+def find_problems(changelog_dir, sections, require_pr_link=False, fallback_pr=None, base_ref=None, root=None):
+    """Return a list of ``(path, message)`` for anything unexpected under
+    ``.nextchanges/``: files that aren't a section fragment or known scaffolding,
+    malformed fragments, a trailing PR link that is missing or names the wrong
+    PR, and a missing/malformed version file. ``require_pr_link`` and
+    ``fallback_pr`` drive the PR-link checks (set in CI / from the branch's PR,
+    see ``main``); ``base_ref`` is the PR's base branch, so fragments inherited
+    from an earlier PR in a stack aren't attributed to the current PR (see
+    ``infer_expected_pr``). ``root`` is the repo the PR inference queries via git."""
+    problems = []
+    known_sections = set(sections)
+    # A shallow clone (e.g. the merge queue's checkout) makes every fragment look
+    # added at the single commit, so PR attribution is unreliable — skip the
+    # PR-link checks. They run at PR time with full history (changelog-preview);
+    # modifying a fragment there must not require re-stamping it with a PR link.
+    shallow = is_shallow(root)
+    if shallow:
+        require_pr_link = False
+    for path in sorted(changelog_dir.rglob("*")):
+        if path.is_dir():
+            continue
+        rel = path.relative_to(changelog_dir)
+        name = path.name
+
+        # Root-level: only the version file and root documentation belong here. This prevents
+        # someone accidentally putting a .md into .nextchanges thinking it would be picked up.
+        if len(rel.parts) == 1:
+            if name not in (VERSION_FILE, README, NEXTVERSION_GO):
+                problems.append((path, "unexpected file at .nextchanges root"))
+            continue
+
+        # Section-level: .nextchanges/<section>/<file>.
+        if len(rel.parts) == 2 and rel.parts[0] in known_sections:
+            # README.md holds section docs and keeps the directory in git; the
+            # renderer skips it, so it is not treated as a fragment.
+            if name == README:
+                continue
+            if not name.endswith(".md"):
+                problems.append((path, "unexpected file (fragments must be *.md)"))
+            else:
+                text = path.read_text(encoding="utf-8")
+                problem = fragment_format_problem(text) or link_problem(text)
+                if problem is None:
+                    # Infer the expected PR (a git call) only for a structurally
+                    # valid fragment, and only with full history — see `shallow`.
+                    expected_pr = None if shallow else infer_expected_pr(path, fallback_pr, base_ref, root)
+                    problem = pr_link_problem(text, require_pr_link, expected_pr)
+                if problem:
+                    problems.append((path, problem))
+            continue
+
+        # Wrong depth or an unknown section directory.
+        problems.append((path, "not in a known section directory"))
+
+    version_path = changelog_dir / VERSION_FILE
+    if not version_path.is_file():
+        problems.append((version_path, "missing; expected the next release version (e.g. 1.4.0)"))
+    elif not is_valid_semver(version_path.read_text(encoding="utf-8")):
+        problems.append((version_path, "not a valid semver version (e.g. 1.4.0)"))
+    return problems
+
+
+def in_ci():
+    """Whether we're running in GitHub Actions (where the link is required).
+
+    GitHub Actions sets ``GITHUB_ACTIONS`` for every step; see
+    https://docs.github.com/en/actions/learn-github-actions/variables#default-environment-variables"""
+    return os.environ.get("GITHUB_ACTIONS") == "true"
+
+
+def current_branch_pr(root):
+    """Best-effort PR number for the current branch (via ``gh``), or ``None``.
+
+    A local convenience only; the branch is ambiguous when its name maps to
+    several PRs, so CI uses the authoritative event number instead (see
+    ``detect_current_pr``). ``gh`` runs in ``root`` so it resolves the repo being
+    validated. Any failure — ``gh`` missing, offline, unauthenticated, or no PR
+    for the branch — returns ``None`` so local runs never hard-fail on tooling."""
+    try:
+        result = subprocess.run(
+            ["gh", "pr", "view", "--json", "number", "-q", ".number"],
+            capture_output=True,
+            text=True,
+            timeout=10,
+            cwd=root,
+        )
+    except (OSError, subprocess.SubprocessError) as e:
+        print(f"gh pr view failed: {e}", file=sys.stderr)
+        return None
+    out = result.stdout.strip()
+    return out if result.returncode == 0 and out.isdigit() else None
+
+
+def detect_current_pr(root):
+    """PR number to expect for not-yet-merged fragments, or ``None``.
+
+    In CI, use the authoritative event PR number (``PR_NUMBER``, set from
+    ``github.event.number``) — never the branch, which is ambiguous when a name
+    maps to several PRs. It is empty on a CI push (e.g. to main), where each
+    fragment's PR is inferred from its own squash-merge commit instead. Locally,
+    fall back to a best-effort ``gh`` lookup of the branch's PR."""
+    pr = os.environ.get("PR_NUMBER", "").strip()
+    if pr:
+        return pr
+    if in_ci():
+        return None
+    return current_branch_pr(root)
+
+
+def current_branch_base(root):
+    """Best-effort base branch of the current branch's PR (via ``gh``), or ``None``.
+
+    A local convenience mirroring ``current_branch_pr``; CI uses the authoritative
+    event base instead (see ``detect_base_ref``). Any ``gh`` failure returns
+    ``None`` so local runs never hard-fail on tooling."""
+    try:
+        result = subprocess.run(
+            ["gh", "pr", "view", "--json", "baseRefName", "-q", ".baseRefName"],
+            capture_output=True,
+            text=True,
+            timeout=10,
+            cwd=root,
+        )
+    except (OSError, subprocess.SubprocessError) as e:
+        print(f"gh pr view failed: {e}", file=sys.stderr)
+        return None
+    out = result.stdout.strip()
+    return out if result.returncode == 0 and out else None
+
+
+def detect_base_ref(root):
+    """Base branch of the PR being validated, or ``None``.
+
+    In CI, the authoritative event base (``BASE_REF``, set from
+    ``github.event.pull_request.base.ref``); empty on a push to main. Locally, a
+    best-effort ``gh`` lookup of the branch's PR. Used to spare a stacked PR's
+    inherited fragments from being attributed to the current PR (see
+    ``infer_expected_pr``)."""
+    base = os.environ.get("BASE_REF", "").strip()
+    if base:
+        return base
+    if in_ci():
+        return None
+    return current_branch_base(root)
+
+
+def has_fragments(changelog_dir):
+    """Whether any *.md fragment (excluding README.md) exists under a section."""
+    return any(p.name != README for p in changelog_dir.glob("*/*.md"))
+
+
+def fragment_paths(changelog_dir):
+    """The section fragments under ``changelog_dir`` (README.md excluded), sorted."""
+    return sorted(p for p in changelog_dir.glob("*/*.md") if p.name != README)
+
+
+def fixed_fragment(text, pr):
+    r"""Return ``text`` with a trailing PR link for ``pr`` appended, or unchanged.
+
+    Only a well-formed fragment (single line, ``* `` bullet, trailing period) with
+    no trailing link group is changed; anything else is returned unchanged for the
+    linter to report, so the fix never guesses at a malformed entry.
+
+    A well-formed fragment with no link gets one appended:
+
+    >>> fixed_fragment("* Added a thing.\n", "42")
+    '* Added a thing. ([#42](https://github.com/databricks/cli/pull/42))\n'
+
+    An already-linked fragment is unchanged:
+
+    >>> fixed_fragment("* Already linked. ([#7](https://github.com/databricks/cli/pull/7))\n", "42")
+    '* Already linked. ([#7](https://github.com/databricks/cli/pull/7))\n'
+
+    A malformed fragment is left for the linter to report:
+
+    >>> fixed_fragment("No bullet.\n", "42")
+    'No bullet.\n'
+    """
+    stripped = text.strip()
+    if fragment_format_problem(text) is not None or TRAILING_GROUP_RE.search(stripped):
+        return text
+    return f"{stripped} ([#{pr}](https://github.com/databricks/cli/pull/{pr}))\n"
+
+
+def autofix(changelog_dir, root):
+    """Append the branch's PR link to fragments missing one (a lint autofix).
+
+    The PR is inferred from the current branch (local only; see
+    ``current_branch_pr``). Prints each file changed. Silently does nothing when
+    the branch has no PR yet — the number can't be inferred, so there's nothing
+    to add — since this runs by default on every validation."""
+    pr = current_branch_pr(root)
+    if pr is None:
+        return
+    for path in fragment_paths(changelog_dir):
+        text = path.read_text(encoding="utf-8")
+        fixed = fixed_fragment(text, pr)
+        if fixed != text:
+            path.write_text(fixed, encoding="utf-8")
+            print(f"Fixed {path.relative_to(root)}: added ([#{pr}](.../pull/{pr}))")
+
+
+def main(argv=None):
+    parser = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
+    parser.add_argument("--root", type=pathlib.Path, default=pathlib.Path.cwd(), help="repository root")
+    args = parser.parse_args(argv)
+
+    changelog_dir = args.root / CHANGELOG_DIR
+    if not changelog_dir.is_dir():
+        return
+
+    sections = load_sections(args.root)
+
+    # Auto-fix by default: add the branch's PR link to fragments missing one
+    # before validating. A no-op in CI and anywhere the branch has no PR.
+    if has_fragments(changelog_dir):
+        autofix(changelog_dir, args.root)
+
+    # A trailing PR link is required whenever the change is associated with a PR:
+    # always in CI (fail closed), and locally when the branch has an open PR.
+    # ``fallback_pr`` is the PR to expect for not-yet-merged fragments — the
+    # authoritative event number in CI, else the branch's PR locally. Detected
+    # only when there are fragments, to avoid a `gh` call on unrelated runs.
+    require_pr_link = False
+    fallback_pr = None
+    base_ref = None
+    if has_fragments(changelog_dir):
+        fallback_pr = detect_current_pr(args.root)
+        base_ref = detect_base_ref(args.root)
+        require_pr_link = in_ci() or fallback_pr is not None
+
+    problems = find_problems(changelog_dir, sections, require_pr_link, fallback_pr, base_ref, args.root)
+    if problems:
+        for path, msg in problems:
+            print(f"{path}: {msg}", file=sys.stderr)
+        print(f"\nFragments must live at {CHANGELOG_DIR}/<section>/<name>.md", file=sys.stderr)
+        print("and be a single line with a `* ` bullet marker and a trailing period, e.g.", file=sys.stderr)
+        print("  * Add the `databricks quickstart` command.", file=sys.stderr)
+        print(f"Valid sections: {', '.join(sections)}", file=sys.stderr)
+        print(f"{CHANGELOG_DIR}/{VERSION_FILE} must hold the next release version.", file=sys.stderr)
+        sys.exit(1)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/validate_whitespace.py b/tools/validate_whitespace.py
old mode 100755
new mode 100644
index 8fac3bba608..0d28dbb0700
--- a/tools/validate_whitespace.py
+++ b/tools/validate_whitespace.py
@@ -2,11 +2,11 @@
 # /// script
 # requires-python = ">=3.12"
 # ///
+import glob
 import os
 import re
-import sys
-import glob
 import subprocess
+import sys
 
 
 def load_ignores():
@@ -18,7 +18,9 @@ def load_ignores():
             continue
         if line.startswith("#"):
             continue
-        expanded = glob.glob(line, recursive=True)
+        # include_hidden: without it `**` skips dot-prefixed names, so a directory
+        # pattern silently fails to cover e.g. a vendored tree's .github/.
+        expanded = glob.glob(line, recursive=True, include_hidden=True)
         if len(expanded) == 0:
             print(f".wsignore:{ind + 1}: No matches for line: {line}")
             fail = True
@@ -29,11 +31,51 @@ def load_ignores():
 
 
 def count_trailing_newlines(s):
+    r"""Count consecutive newlines at the end of a string.
+
+    >>> count_trailing_newlines("hello")
+    0
+
+    >>> count_trailing_newlines("hello\n")
+    1
+
+    >>> count_trailing_newlines("hello\n\n")
+    2
+
+    >>> count_trailing_newlines("")
+    0
+    """
     match = re.search(r"(\n+)$", s)
     return len(match.group(1)) if match else 0
 
 
 def validate_contents(data):
+    r"""Validate file contents and yield error messages for issues found.
+
+    Valid content (single final newline, no trailing spaces) yields nothing:
+
+    >>> list(validate_contents(b'hello\nworld\n'))
+    []
+
+    Each kind of problem yields its own message:
+
+    >>> list(validate_contents(b'hello'))
+    [' File does not end with a newline']
+
+    >>> list(validate_contents(b'hello  \n'))
+    ["1: Trailing whitespace 'hello  '"]
+
+    >>> list(validate_contents(b'hello\n  \nworld\n'))
+    ['2: Whitespace-only line']
+
+    >>> list(validate_contents(b'hello\n\n\n'))
+    [' 3 newlines at the end']
+
+    Empty data yields nothing:
+
+    >>> list(validate_contents(b''))
+    []
+    """
     if not data:
         return
     try:
@@ -61,7 +103,31 @@ def validate_contents(data):
 
 
 def fix_contents(data):
-    """Fix whitespace issues in file contents."""
+    r"""Fix whitespace issues in file contents.
+
+    Trailing whitespace is stripped and the file ends with exactly one newline:
+
+    >>> fix_contents(b'hello  \nworld  \n\n\n')
+    b'hello\nworld\n'
+
+    A missing final newline is added:
+
+    >>> fix_contents(b'hello')
+    b'hello\n'
+
+    A whitespace-only line keeps its now-empty line break:
+
+    >>> fix_contents(b'hello\n  \nworld\n')
+    b'hello\n\nworld\n'
+
+    Empty and already-valid content are returned unchanged:
+
+    >>> fix_contents(b'')
+    b''
+
+    >>> fix_contents(b'hello\nworld\n')
+    b'hello\nworld\n'
+    """
     if not data:
         return data
     try:
diff --git a/tools/vulnbump/.gitignore b/tools/vulnbump/.gitignore
new file mode 100644
index 00000000000..1ff8482621c
--- /dev/null
+++ b/tools/vulnbump/.gitignore
@@ -0,0 +1 @@
+/vulnbump
diff --git a/tools/vulnbump/bumps.go b/tools/vulnbump/bumps.go
new file mode 100644
index 00000000000..ca19a381822
--- /dev/null
+++ b/tools/vulnbump/bumps.go
@@ -0,0 +1,171 @@
+package main
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"maps"
+	"slices"
+	"strings"
+
+	"golang.org/x/mod/semver"
+)
+
+// stdlibModule is govulncheck's module name for the Go standard library.
+// Standard-library fixes map to a toolchain version and are handled by the
+// separate "Bump Go toolchain" workflow, so we skip them here.
+const stdlibModule = "stdlib"
+
+// advisoryBaseURL is the canonical advisory page for a GO-YYYY-NNNN ID. The
+// page cross-links the CVE alias and the per-package fixed version.
+const advisoryBaseURL = "https://pkg.go.dev/vuln/"
+
+// advisory identifies a Go vulnerability and its CVE alias.
+type advisory struct {
+	ID  string // GO-YYYY-NNNN, always present.
+	CVE string // CVE-YYYY-NNNN, empty until one is assigned (it can lag the Go advisory by days).
+}
+
+// label is the link text for an advisory: the CVE when known, else the Go ID.
+func (a advisory) label() string {
+	if a.CVE != "" {
+		return a.CVE
+	}
+	return a.ID
+}
+
+// bump is a single dependency upgrade: the highest fixed version across all
+// advisories affecting a module, plus the advisories it resolves.
+type bump struct {
+	Module       string
+	FixedVersion string
+	Advisories   []advisory
+}
+
+// govulncheckFinding mirrors the "finding" message emitted by
+// `govulncheck -format json`. See https://pkg.go.dev/golang.org/x/vuln/internal/govulncheck#Finding.
+type govulncheckFinding struct {
+	OSV          string `json:"osv"`
+	FixedVersion string `json:"fixed_version"`
+	Trace        []struct {
+		Module string `json:"module"`
+	} `json:"trace"`
+}
+
+// govulncheckOSV mirrors the "osv" message emitted by `govulncheck -format json`,
+// which carries the full advisory record including its CVE aliases.
+type govulncheckOSV struct {
+	ID      string   `json:"id"`
+	Aliases []string `json:"aliases"`
+}
+
+// parseBumps reads the concatenated JSON stream from `govulncheck -format json`
+// and reduces it to one bump per module, choosing the highest fixed version and
+// collecting the advisories it resolves. The standard library is excluded.
+func parseBumps(r io.Reader) ([]bump, error) {
+	// One accumulator per module: the highest fixed version seen and the set of
+	// advisories resolved by upgrading to it.
+	type acc struct {
+		version    string
+		advisories map[string]struct{}
+	}
+	byModule := map[string]*acc{}
+	// govulncheck emits a separate "osv" message per advisory; collect the CVE
+	// aliases so findings (which carry only the Go ID) can be labelled with it.
+	cveByID := map[string]string{}
+
+	dec := json.NewDecoder(r)
+	for {
+		var msg struct {
+			Finding *govulncheckFinding `json:"finding"`
+			OSV     *govulncheckOSV     `json:"osv"`
+		}
+		err := dec.Decode(&msg)
+		if errors.Is(err, io.EOF) {
+			break
+		}
+		if err != nil {
+			return nil, fmt.Errorf("decode govulncheck output: %w", err)
+		}
+
+		if o := msg.OSV; o != nil {
+			cveByID[o.ID] = firstCVE(o.Aliases)
+		}
+
+		f := msg.Finding
+		if f == nil || f.FixedVersion == "" || len(f.Trace) == 0 {
+			continue
+		}
+		// trace[0] is the most specific frame; in module scan mode it carries
+		// the vulnerable module itself.
+		module := f.Trace[0].Module
+		if module == "" || module == stdlibModule {
+			continue
+		}
+
+		a := byModule[module]
+		if a == nil {
+			a = &acc{advisories: map[string]struct{}{}}
+			byModule[module] = a
+		}
+		if a.version == "" || semver.Compare(f.FixedVersion, a.version) > 0 {
+			a.version = f.FixedVersion
+		}
+		a.advisories[f.OSV] = struct{}{}
+	}
+
+	bumps := make([]bump, 0, len(byModule))
+	for module, a := range byModule {
+		var advisories []advisory
+		for _, id := range slices.Sorted(maps.Keys(a.advisories)) {
+			advisories = append(advisories, advisory{ID: id, CVE: cveByID[id]})
+		}
+		bumps = append(bumps, bump{
+			Module:       module,
+			FixedVersion: a.version,
+			Advisories:   advisories,
+		})
+	}
+	slices.SortFunc(bumps, func(a, b bump) int {
+		return strings.Compare(a.Module, b.Module)
+	})
+	return bumps, nil
+}
+
+// firstCVE returns the first CVE alias in the list, or "" if there is none.
+func firstCVE(aliases []string) string {
+	for _, a := range aliases {
+		if strings.HasPrefix(a, "CVE-") {
+			return a
+		}
+	}
+	return ""
+}
+
+// renderSummary formats the bumps as Markdown list items for the PR body. It
+// uses reference-style links so the list lines stay short instead of wrapping,
+// with the advisory link definitions collected in a block at the end.
+func renderSummary(bumps []bump) string {
+	var list, refs strings.Builder
+	seen := map[string]struct{}{}
+
+	for _, bump := range bumps {
+		labels := make([]string, len(bump.Advisories))
+		for i, adv := range bump.Advisories {
+			labels[i] = "[" + adv.label() + "]"
+			if _, ok := seen[adv.label()]; ok {
+				continue
+			}
+			seen[adv.label()] = struct{}{}
+			fmt.Fprintf(&refs, "[%s]: %s%s\n", adv.label(), advisoryBaseURL, adv.ID)
+		}
+		fmt.Fprintf(&list, "- %s → %s (fixes %s)\n",
+			bump.Module, bump.FixedVersion, strings.Join(labels, ", "))
+	}
+
+	if refs.Len() == 0 {
+		return list.String()
+	}
+	return list.String() + "\n" + refs.String()
+}
diff --git a/tools/vulnbump/bumps_test.go b/tools/vulnbump/bumps_test.go
new file mode 100644
index 00000000000..3220086472c
--- /dev/null
+++ b/tools/vulnbump/bumps_test.go
@@ -0,0 +1,112 @@
+package main
+
+import (
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// sampleOutput reads the recorded `govulncheck -format json` fixture. Tests run
+// from the package directory, so testdata is read directly.
+func sampleOutput(t *testing.T) string {
+	t.Helper()
+	data, err := os.ReadFile("testdata/govulncheck.json")
+	require.NoError(t, err)
+	return string(data)
+}
+
+func TestParseBumps(t *testing.T) {
+	bumps, err := parseBumps(strings.NewReader(sampleOutput(t)))
+	require.NoError(t, err)
+
+	// golang.org/x/crypto takes the higher of its two fixed versions (v0.52.0
+	// over v0.51.0), advisories are deduplicated and sorted, the stdlib finding
+	// is dropped, and non-finding messages are ignored. CVE aliases come from
+	// the "osv" messages; GO-2026-5021's osv has only a GHSA alias, so it keeps
+	// an empty CVE and later falls back to the Go ID as its label.
+	assert.Equal(t, []bump{
+		{
+			Module:       "golang.org/x/crypto",
+			FixedVersion: "v0.52.0",
+			Advisories: []advisory{
+				{ID: "GO-2026-5016", CVE: "CVE-2026-39827"},
+				{ID: "GO-2026-5021"},
+			},
+		},
+		{
+			Module:       "golang.org/x/net",
+			FixedVersion: "v0.55.0",
+			Advisories: []advisory{
+				{ID: "GO-2026-5026", CVE: "CVE-2026-39821"},
+			},
+		},
+	}, bumps)
+}
+
+func TestParseBumpsEmpty(t *testing.T) {
+	bumps, err := parseBumps(strings.NewReader(""))
+	require.NoError(t, err)
+	assert.Empty(t, bumps)
+}
+
+func TestParseBumpsInvalid(t *testing.T) {
+	_, err := parseBumps(strings.NewReader("not json"))
+	require.Error(t, err)
+}
+
+func TestRenderSummary(t *testing.T) {
+	bumps := []bump{
+		{
+			Module:       "golang.org/x/crypto",
+			FixedVersion: "v0.52.0",
+			Advisories: []advisory{
+				{ID: "GO-2026-5016", CVE: "CVE-2026-39827"},
+				{ID: "GO-2026-5021"}, // no CVE assigned: falls back to the Go ID
+			},
+		},
+	}
+
+	// Reference-style links keep the list line short; definitions follow in a
+	// block. The CVE is the visible label, linking to the Go advisory page.
+	want := "- golang.org/x/crypto → v0.52.0 (fixes [CVE-2026-39827], [GO-2026-5021])\n" +
+		"\n" +
+		"[CVE-2026-39827]: https://pkg.go.dev/vuln/GO-2026-5016\n" +
+		"[GO-2026-5021]: https://pkg.go.dev/vuln/GO-2026-5021\n"
+	assert.Equal(t, want, renderSummary(bumps))
+}
+
+func TestRenderSummaryEmpty(t *testing.T) {
+	assert.Empty(t, renderSummary(nil))
+}
+
+func TestFirstCVE(t *testing.T) {
+	assert.Equal(t, "CVE-2026-39827", firstCVE([]string{"CVE-2026-39827", "GHSA-xxxx-xxxx-xxxx"}))
+	assert.Equal(t, "CVE-2026-39827", firstCVE([]string{"GHSA-xxxx-xxxx-xxxx", "CVE-2026-39827"}))
+	assert.Empty(t, firstCVE([]string{"GHSA-xxxx-xxxx-xxxx"}))
+	assert.Empty(t, firstCVE(nil))
+}
+
+func TestAdvisoryLabelFallsBackToID(t *testing.T) {
+	assert.Equal(t, "CVE-2026-39827", advisory{ID: "GO-2026-5016", CVE: "CVE-2026-39827"}.label())
+	assert.Equal(t, "GO-2026-5021", advisory{ID: "GO-2026-5021"}.label())
+}
+
+// TestRenderSummaryNoCVE checks the no-alias path renders the Go ID as both the
+// link text and the reference definition.
+func TestRenderSummaryNoCVE(t *testing.T) {
+	bumps := []bump{
+		{
+			Module:       "golang.org/x/crypto",
+			FixedVersion: "v0.52.0",
+			Advisories:   []advisory{{ID: "GO-2026-5021"}},
+		},
+	}
+
+	want := "- golang.org/x/crypto → v0.52.0 (fixes [GO-2026-5021])\n" +
+		"\n" +
+		"[GO-2026-5021]: https://pkg.go.dev/vuln/GO-2026-5021\n"
+	assert.Equal(t, want, renderSummary(bumps))
+}
diff --git a/tools/vulnbump/main.go b/tools/vulnbump/main.go
new file mode 100644
index 00000000000..30dfed403a5
--- /dev/null
+++ b/tools/vulnbump/main.go
@@ -0,0 +1,68 @@
+// Command vulnbump upgrades Go module dependencies that govulncheck reports as
+// vulnerable to their fixed versions and prints a Markdown summary of the
+// upgrades for use in a pull request body.
+//
+// It reads the output of `govulncheck -scan module -format json` from stdin and
+// applies the upgrades to the module in the directory given as the first
+// argument (default "."). End to end it is driven as:
+//
+//	govulncheck -scan module -format json | vulnbump .
+//
+// .github/workflows/bump-vuln-deps.yml runs it this way across every go.mod.
+package main
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+)
+
+// commandRunner runs a command in dir. It is injected so tests can exercise the
+// end-to-end flow without shelling out to the Go toolchain or the network.
+type commandRunner func(dir, name string, args ...string) error
+
+func main() {
+	dir := "."
+	if len(os.Args) > 1 {
+		dir = os.Args[1]
+	}
+	if err := run(dir, os.Stdin, os.Stdout, execCommand); err != nil {
+		fmt.Fprintln(os.Stderr, "vulnbump:", err)
+		os.Exit(1)
+	}
+}
+
+// run reads govulncheck JSON from in, applies each bump in dir via runCmd, and
+// writes the Markdown summary to out.
+func run(dir string, in io.Reader, out io.Writer, runCmd commandRunner) error {
+	bumps, err := parseBumps(in)
+	if err != nil {
+		return err
+	}
+	for _, b := range bumps {
+		if err := runCmd(dir, "go", "get", b.Module+"@"+b.FixedVersion); err != nil {
+			return err
+		}
+	}
+	if len(bumps) > 0 {
+		if err := runCmd(dir, "go", "mod", "tidy"); err != nil {
+			return err
+		}
+	}
+	_, err = io.WriteString(out, renderSummary(bumps))
+	return err
+}
+
+// execCommand runs a command in dir, forwarding its output to stderr so it
+// surfaces in the workflow log without polluting the Markdown summary on stdout.
+func execCommand(dir, name string, args ...string) error {
+	cmd := exec.Command(name, args...)
+	cmd.Dir = dir
+	cmd.Stdout = os.Stderr
+	cmd.Stderr = os.Stderr
+	if err := cmd.Run(); err != nil {
+		return fmt.Errorf("%s %v in %s: %w", name, args, dir, err)
+	}
+	return nil
+}
diff --git a/tools/vulnbump/main_test.go b/tools/vulnbump/main_test.go
new file mode 100644
index 00000000000..9bedcf4f402
--- /dev/null
+++ b/tools/vulnbump/main_test.go
@@ -0,0 +1,61 @@
+package main
+
+import (
+	"errors"
+	"io"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestRunEndToEnd drives the whole program over the sample govulncheck output:
+// it must issue one `go get` per module (highest fixed version), a single
+// `go mod tidy`, and print the linked summary. The toolchain is stubbed so the
+// test stays hermetic; the workflow runs the same flow against the real `go`.
+func TestRunEndToEnd(t *testing.T) {
+	var calls [][]string
+	runCmd := func(dir, name string, args ...string) error {
+		calls = append(calls, append([]string{dir, name}, args...))
+		return nil
+	}
+
+	var out strings.Builder
+	require.NoError(t, run(".", strings.NewReader(sampleOutput(t)), &out, runCmd))
+
+	assert.Equal(t, [][]string{
+		{".", "go", "get", "golang.org/x/crypto@v0.52.0"},
+		{".", "go", "get", "golang.org/x/net@v0.55.0"},
+		{".", "go", "mod", "tidy"},
+	}, calls)
+
+	assert.Contains(t, out.String(), "golang.org/x/crypto → v0.52.0")
+	assert.Contains(t, out.String(), "[CVE-2026-39827]")
+	assert.Contains(t, out.String(), "[CVE-2026-39827]: https://pkg.go.dev/vuln/GO-2026-5016")
+}
+
+func TestRunNoFindings(t *testing.T) {
+	calls := 0
+	runCmd := func(dir, name string, args ...string) error {
+		calls++
+		return nil
+	}
+
+	var out strings.Builder
+	require.NoError(t, run(".", strings.NewReader(""), &out, runCmd))
+
+	// No vulnerabilities means nothing to upgrade and an empty summary, so the
+	// workflow's `git diff` check leaves it without opening a PR.
+	assert.Zero(t, calls)
+	assert.Empty(t, out.String())
+}
+
+func TestRunStopsOnError(t *testing.T) {
+	runCmd := func(dir, name string, args ...string) error {
+		return errors.New("network down")
+	}
+
+	err := run(".", strings.NewReader(sampleOutput(t)), io.Discard, runCmd)
+	require.Error(t, err)
+}
diff --git a/tools/vulnbump/testdata/govulncheck.json b/tools/vulnbump/testdata/govulncheck.json
new file mode 100644
index 00000000000..b6fa9ea6e58
--- /dev/null
+++ b/tools/vulnbump/testdata/govulncheck.json
@@ -0,0 +1,73 @@
+{
+  "config": {
+    "protocol_version": "v1.0.0",
+    "scanner_name": "govulncheck",
+    "scan_level": "module"
+  }
+}
+{
+  "SBOM": {
+    "go_version": "go1.26.3",
+    "roots": ["github.com/databricks/cli"]
+  }
+}
+{
+  "osv": {
+    "id": "GO-2026-5016",
+    "aliases": ["CVE-2026-39827", "GHSA-xxxx-xxxx-xxxx"]
+  }
+}
+{
+  "osv": {
+    "id": "GO-2026-5026",
+    "aliases": ["CVE-2026-39821"]
+  }
+}
+{
+  "osv": {
+    "id": "GO-2026-5021",
+    "aliases": ["GHSA-yyyy-yyyy-yyyy"]
+  }
+}
+{
+  "finding": {
+    "osv": "GO-2026-5016",
+    "fixed_version": "v0.52.0",
+    "trace": [{ "module": "golang.org/x/crypto", "version": "v0.51.0" }]
+  }
+}
+{
+  "finding": {
+    "osv": "GO-2026-5016",
+    "fixed_version": "v0.52.0",
+    "trace": [{ "module": "golang.org/x/crypto", "version": "v0.51.0" }]
+  }
+}
+{
+  "finding": {
+    "osv": "GO-2026-5021",
+    "fixed_version": "v0.51.0",
+    "trace": [{ "module": "golang.org/x/crypto", "version": "v0.51.0" }]
+  }
+}
+{
+  "finding": {
+    "osv": "GO-2026-5026",
+    "fixed_version": "v0.55.0",
+    "trace": [{ "module": "golang.org/x/net", "version": "v0.53.0" }]
+  }
+}
+{
+  "finding": {
+    "osv": "GO-2026-5026",
+    "fixed_version": "v0.55.0",
+    "trace": [{ "module": "golang.org/x/net", "version": "v0.53.0" }]
+  }
+}
+{
+  "finding": {
+    "osv": "GO-2026-5039",
+    "fixed_version": "go1.26.4",
+    "trace": [{ "module": "stdlib", "version": "go1.26.3" }]
+  }
+}
diff --git a/yamlfmt.yml b/yamlfmt.yml
index 6eee333e8d4..25ffe28dd53 100644
--- a/yamlfmt.yml
+++ b/yamlfmt.yml
@@ -3,6 +3,7 @@ exclude:
   - acceptance/selftest/bundleconfig # https://github.com/google/yamlfmt/issues/254
   - acceptance/bundle/artifacts/nil_artifacts/databricks.yml # https://github.com/google/yamlfmt/issues/253
   - bundle/direct/dresources/apitypes.yml # remove comments
+  - acceptance/bundle/resources/permissions/jobs/update/databricks.yml # comment indentation is significant: it is uncommented into a top-level permissions: [] key
 formatter:
   type: basic
   retain_line_breaks_single: true